36 files changed, 832 insertions, 497 deletions

diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index d369130f4235..ffcb9fd31c38 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -1928,7 +1928,9 @@ he_service_rbrq(struct he_dev *he_dev, int group)
 #ifdef notdef
                 ATM_SKB(skb)->vcc = vcc;
 #endif
+                spin_unlock(&he_dev->global_lock);
                 vcc->push(vcc, skb);
+                spin_lock(&he_dev->global_lock);
 
                 atomic_inc(&vcc->stats->rx);
 
@@ -2282,6 +2284,8 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
                                 TPDRQ_MASK(he_readl(he_dev, TPDRQ_B_H)));
 
                 if (new_tail == he_dev->tpdrq_head) {
+                        int slot;
+
                         hprintk("tpdrq full (cid 0x%x)\n", cid);
                         /*
                          * FIXME
@@ -2289,6 +2293,13 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
                          * after service_tbrq, service the backlog
                          * for now, we just drop the pdu
                          */
+                        for (slot = 0; slot < TPD_MAXIOV; ++slot) {
+                                if (tpd->iovec[slot].addr)
+                                        pci_unmap_single(he_dev->pci_dev,
+                                                tpd->iovec[slot].addr,
+                                                tpd->iovec[slot].len & TPD_LEN_MASK,
+                                                                PCI_DMA_TODEVICE);
+                        }
                         if (tpd->skb) {
                                 if (tpd->vcc->pop)
                                         tpd->vcc->pop(tpd->vcc, tpd->skb);
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index 1d1bd34b7f12..a76d2c40dd5e 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -667,6 +667,7 @@ int khvcd(void *unused)
         do {
                 poll_mask = 0;
                 hvc_kicked = 0;
+                try_to_freeze();
                 wmb();
                 if (cpus_empty(cpus_in_xmon)) {
                         spin_lock(&hvc_structs_lock);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index f57eba0bf253..abca98beac14 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -402,10 +402,10 @@ static void handle_flags(struct smi_info *smi_info)
                         smi_info->curr_msg->data,
                         smi_info->curr_msg->data_size);
                 smi_info->si_state = SI_GETTING_EVENTS;
-        } else if (smi_info->msg_flags & OEM_DATA_AVAIL) {
-                if (smi_info->oem_data_avail_handler)
-                        if (smi_info->oem_data_avail_handler(smi_info))
-                                goto retry;
+        } else if (smi_info->msg_flags & OEM_DATA_AVAIL &&
+                   smi_info->oem_data_avail_handler) {
+                if (smi_info->oem_data_avail_handler(smi_info))
+                        goto retry;
         } else {
                 smi_info->si_state = SI_NORMAL;
         }
@@ -2481,6 +2481,7 @@ static __devinit int init_ipmi_si(void)
 #ifdef CONFIG_PCI
                 pci_unregister_driver(&ipmi_pci_driver);
 #endif
+                driver_unregister(&ipmi_driver);
                 printk("ipmi_si: Unable to find any System Interface(s)\n");
                 return -ENODEV;
         } else {
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index d6f99d5720fc..5d625a81193f 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -49,7 +49,7 @@ MODULE_DESCRIPTION("Generic RDMA CM Agent");
 MODULE_LICENSE("Dual BSD/GPL");
 
 #define CMA_CM_RESPONSE_TIMEOUT 20
-#define CMA_MAX_CM_RETRIES 3
+#define CMA_MAX_CM_RETRIES 15
 
 static void cma_add_one(struct ib_device *device);
 static void cma_remove_one(struct ib_device *device);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index b5e6a7be603d..ec356ce7cdcd 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -326,6 +326,7 @@ ipoib_mcast_sendonly_join_complete(int status,
 
                 /* Clear the busy flag so we try again */
                 clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
+                mcast->query = NULL;
         }
 
         complete(&mcast->done);
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 8257d5a2c8f8..fd8344cdc0db 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -799,13 +799,6 @@ static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
         spin_unlock_irqrestore(target->scsi_host->host_lock, flags);
 }
 
-static void srp_reconnect_work(void *target_ptr)
-{
-        struct srp_target_port *target = target_ptr;
-
-        srp_reconnect_target(target);
-}
-
 static void srp_handle_recv(struct srp_target_port *target, struct ib_wc *wc)
 {
         struct srp_iu *iu;
@@ -858,7 +851,6 @@ static void srp_completion(struct ib_cq *cq, void *target_ptr)
 {
         struct srp_target_port *target = target_ptr;
         struct ib_wc wc;
-        unsigned long flags;
 
         ib_req_notify_cq(cq, IB_CQ_NEXT_COMP);
         while (ib_poll_cq(cq, 1, &wc) > 0) {
@@ -866,10 +858,6 @@ static void srp_completion(struct ib_cq *cq, void *target_ptr)
                         printk(KERN_ERR PFX "failed %s status %d\n",
                                wc.wr_id & SRP_OP_RECV ? "receive" : "send",
                                wc.status);
-                        spin_lock_irqsave(target->scsi_host->host_lock, flags);
-                        if (target->state == SRP_TARGET_LIVE)
-                                schedule_work(&target->work);
-                        spin_unlock_irqrestore(target->scsi_host->host_lock, flags);
                         break;
                 }
 
@@ -1705,8 +1693,6 @@ static ssize_t srp_create_target(struct class_device *class_dev,
         target->scsi_host  = target_host;
         target->srp_host   = host;
 
-        INIT_WORK(&target->work, srp_reconnect_work, target);
-
         INIT_LIST_HEAD(&target->free_reqs);
         INIT_LIST_HEAD(&target->req_queue);
         for (i = 0; i < SRP_SQ_SIZE; ++i) {
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 39edb8250fbc..7ea49a0d5ec3 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -908,7 +908,7 @@ static void __xipram xip_enable(struct map_info *map, struct flchip *chip,
 
 static int __xipram xip_wait_for_operation(
                 struct map_info *map, struct flchip *chip,
-                unsigned long adr, int *chip_op_time )
+                unsigned long adr, unsigned int chip_op_time )
 {
         struct cfi_private *cfi = map->fldrv_priv;
         struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
@@ -917,7 +917,7 @@ static int __xipram xip_wait_for_operation(
         flstate_t oldstate, newstate;
 
         start = xip_currtime();
-        usec = *chip_op_time * 8;
+        usec = chip_op_time * 8;
         if (usec == 0)
                 usec = 500000;
         done = 0;
@@ -1027,8 +1027,8 @@ static int __xipram xip_wait_for_operation(
 #define XIP_INVAL_CACHED_RANGE(map, from, size)  \
         INVALIDATE_CACHED_RANGE(map, from, size)
 
-#define INVAL_CACHE_AND_WAIT(map, chip, cmd_adr, inval_adr, inval_len, p_usec) \
-        xip_wait_for_operation(map, chip, cmd_adr, p_usec)
+#define INVAL_CACHE_AND_WAIT(map, chip, cmd_adr, inval_adr, inval_len, usec) \
+        xip_wait_for_operation(map, chip, cmd_adr, usec)
 
 #else
 
@@ -1040,64 +1040,64 @@ static int __xipram xip_wait_for_operation(
 static int inval_cache_and_wait_for_operation(
                 struct map_info *map, struct flchip *chip,
                 unsigned long cmd_adr, unsigned long inval_adr, int inval_len,
-                int *chip_op_time )
+                unsigned int chip_op_time)
 {
         struct cfi_private *cfi = map->fldrv_priv;
         map_word status, status_OK = CMD(0x80);
-        int z, chip_state = chip->state;
-        unsigned long timeo;
+        int chip_state = chip->state;
+        unsigned int timeo, sleep_time;
 
         spin_unlock(chip->mutex);
         if (inval_len)
                 INVALIDATE_CACHED_RANGE(map, inval_adr, inval_len);
-        if (*chip_op_time)
-                cfi_udelay(*chip_op_time);
         spin_lock(chip->mutex);
 
-        timeo = *chip_op_time * 8 * HZ / 1000000;
-        if (timeo < HZ/2)
-                timeo = HZ/2;
-        timeo += jiffies;
+        /* set our timeout to 8 times the expected delay */
+        timeo = chip_op_time * 8;
+        if (!timeo)
+                timeo = 500000;
+        sleep_time = chip_op_time / 2;
 
-        z = 0;
         for (;;) {
-                if (chip->state != chip_state) {
-                        /* Someone's suspended the operation: sleep */
-                        DECLARE_WAITQUEUE(wait, current);
-
-                        set_current_state(TASK_UNINTERRUPTIBLE);
-                        add_wait_queue(&chip->wq, &wait);
-                        spin_unlock(chip->mutex);
-                        schedule();
-                        remove_wait_queue(&chip->wq, &wait);
-                        timeo = jiffies + (HZ / 2); /* FIXME */
-                        spin_lock(chip->mutex);
-                        continue;
-                }
-
                 status = map_read(map, cmd_adr);
                 if (map_word_andequal(map, status, status_OK, status_OK))
                         break;
 
-                /* OK Still waiting */
-                if (time_after(jiffies, timeo)) {
+                if (!timeo) {
                         map_write(map, CMD(0x70), cmd_adr);
                         chip->state = FL_STATUS;
                         return -ETIME;
                 }
 
-                /* Latency issues. Drop the lock, wait a while and retry */
-                z++;
+                /* OK Still waiting. Drop the lock, wait a while and retry. */
                 spin_unlock(chip->mutex);
-                cfi_udelay(1);
+                if (sleep_time >= 1000000/HZ) {
+                        /*
+                         * Half of the normal delay still remaining
+                         * can be performed with a sleeping delay instead
+                         * of busy waiting.
+                         */
+                        msleep(sleep_time/1000);
+                        timeo -= sleep_time;
+                        sleep_time = 1000000/HZ;
+                } else {
+                        udelay(1);
+                        cond_resched();
+                        timeo--;
+                }
                 spin_lock(chip->mutex);
-        }
 
-        if (!z) {
-                if (!--(*chip_op_time))
-                        *chip_op_time = 1;
-        } else if (z > 1)
-                ++(*chip_op_time);
+                if (chip->state != chip_state) {
+                        /* Someone's suspended the operation: sleep */
+                        DECLARE_WAITQUEUE(wait, current);
+                        set_current_state(TASK_UNINTERRUPTIBLE);
+                        add_wait_queue(&chip->wq, &wait);
+                        spin_unlock(chip->mutex);
+                        schedule();
+                        remove_wait_queue(&chip->wq, &wait);
+                        spin_lock(chip->mutex);
+                }
+        }
 
         /* Done and happy. */
         chip->state = FL_STATUS;
@@ -1107,8 +1107,7 @@ static int inval_cache_and_wait_for_operation(
 #endif
 
 #define WAIT_TIMEOUT(map, chip, adr, udelay) \
-        ({ int __udelay = (udelay); \
-           INVAL_CACHE_AND_WAIT(map, chip, adr, 0, 0, &__udelay); })
+        INVAL_CACHE_AND_WAIT(map, chip, adr, 0, 0, udelay);
 
 
 static int do_point_onechip (struct map_info *map, struct flchip *chip, loff_t adr, size_t len)
@@ -1332,7 +1331,7 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
 
         ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
                                    adr, map_bankwidth(map),
-                                   &chip->word_write_time);
+                                   chip->word_write_time);
         if (ret) {
                 xip_enable(map, chip, adr);
                 printk(KERN_ERR "%s: word write error (status timeout)\n", map->name);
@@ -1569,7 +1568,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
 
         ret = INVAL_CACHE_AND_WAIT(map, chip, cmd_adr,
                                    adr, len,
-                                   &chip->buffer_write_time);
+                                   chip->buffer_write_time);
         if (ret) {
                 map_write(map, CMD(0x70), cmd_adr);
                 chip->state = FL_STATUS;
@@ -1704,7 +1703,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
 
         ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
                                    adr, len,
-                                   &chip->erase_time);
+                                   chip->erase_time);
         if (ret) {
                 map_write(map, CMD(0x70), adr);
                 chip->state = FL_STATUS;
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 9885726a16e4..a482e8922de1 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -45,9 +45,11 @@
 #define MAX_WORD_RETRIES 3
 
 #define MANUFACTURER_AMD        0x0001
+#define MANUFACTURER_ATMEL      0x001F
 #define MANUFACTURER_SST        0x00BF
 #define SST49LF004B             0x0060
 #define SST49LF008A             0x005a
+#define AT49BV6416              0x00d6
 
 static int cfi_amdstd_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 static int cfi_amdstd_write_words(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
@@ -68,6 +70,9 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
 static void put_chip(struct map_info *map, struct flchip *chip, unsigned long adr);
 #include "fwh_lock.h"
 
+static int cfi_atmel_lock(struct mtd_info *mtd, loff_t ofs, size_t len);
+static int cfi_atmel_unlock(struct mtd_info *mtd, loff_t ofs, size_t len);
+
 static struct mtd_chip_driver cfi_amdstd_chipdrv = {
         .probe          = NULL, /* Not usable directly */
         .destroy        = cfi_amdstd_destroy,
@@ -161,6 +166,26 @@ static void fixup_use_write_buffers(struct mtd_info *mtd, void *param)
         }
 }
 
+/* Atmel chips don't use the same PRI format as AMD chips */
+static void fixup_convert_atmel_pri(struct mtd_info *mtd, void *param)
+{
+        struct map_info *map = mtd->priv;
+        struct cfi_private *cfi = map->fldrv_priv;
+        struct cfi_pri_amdstd *extp = cfi->cmdset_priv;
+        struct cfi_pri_atmel atmel_pri;
+
+        memcpy(&atmel_pri, extp, sizeof(atmel_pri));
+        memset((char *)extp + 5, 0, sizeof(*extp) - 5);
+
+        if (atmel_pri.Features & 0x02)
+                extp->EraseSuspend = 2;
+
+        if (atmel_pri.BottomBoot)
+                extp->TopBottom = 2;
+        else
+                extp->TopBottom = 3;
+}
+
 static void fixup_use_secsi(struct mtd_info *mtd, void *param)
 {
         /* Setup for chips with a secsi area */
@@ -179,6 +204,16 @@ static void fixup_use_erase_chip(struct mtd_info *mtd, void *param)
 
 }
 
+/*
+ * Some Atmel chips (e.g. the AT49BV6416) power-up with all sectors
+ * locked by default.
+ */
+static void fixup_use_atmel_lock(struct mtd_info *mtd, void *param)
+{
+        mtd->lock = cfi_atmel_lock;
+        mtd->unlock = cfi_atmel_unlock;
+}
+
 static struct cfi_fixup cfi_fixup_table[] = {
 #ifdef AMD_BOOTLOC_BUG
         { CFI_MFR_AMD, CFI_ID_ANY, fixup_amd_bootblock, NULL },
@@ -192,6 +227,7 @@ static struct cfi_fixup cfi_fixup_table[] = {
 #if !FORCE_WORD_WRITE
         { CFI_MFR_ANY, CFI_ID_ANY, fixup_use_write_buffers, NULL, },
 #endif
+        { CFI_MFR_ATMEL, CFI_ID_ANY, fixup_convert_atmel_pri, NULL },
         { 0, 0, NULL, NULL }
 };
 static struct cfi_fixup jedec_fixup_table[] = {
@@ -207,6 +243,7 @@ static struct cfi_fixup fixup_table[] = {
          * we know that is the case.
          */
         { CFI_MFR_ANY, CFI_ID_ANY, fixup_use_erase_chip, NULL },
+        { CFI_MFR_ATMEL, AT49BV6416, fixup_use_atmel_lock, NULL },
         { 0, 0, NULL, NULL }
 };
 
@@ -1607,6 +1644,80 @@ static int cfi_amdstd_erase_chip(struct mtd_info *mtd, struct erase_info *instr)
         return 0;
 }
 
+static int do_atmel_lock(struct map_info *map, struct flchip *chip,
+                         unsigned long adr, int len, void *thunk)
+{
+        struct cfi_private *cfi = map->fldrv_priv;
+        int ret;
+
+        spin_lock(chip->mutex);
+        ret = get_chip(map, chip, adr + chip->start, FL_LOCKING);
+        if (ret)
+                goto out_unlock;
+        chip->state = FL_LOCKING;
+
+        DEBUG(MTD_DEBUG_LEVEL3, "MTD %s(): LOCK 0x%08lx len %d\n",
+              __func__, adr, len);
+
+        cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi,
+                         cfi->device_type, NULL);
+        cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi,
+                         cfi->device_type, NULL);
+        cfi_send_gen_cmd(0x80, cfi->addr_unlock1, chip->start, map, cfi,
+                         cfi->device_type, NULL);
+        cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi,
+                         cfi->device_type, NULL);
+        cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi,
+                         cfi->device_type, NULL);
+        map_write(map, CMD(0x40), chip->start + adr);
+
+        chip->state = FL_READY;
+        put_chip(map, chip, adr + chip->start);
+        ret = 0;
+
+out_unlock:
+        spin_unlock(chip->mutex);
+        return ret;
+}
+
+static int do_atmel_unlock(struct map_info *map, struct flchip *chip,
+                           unsigned long adr, int len, void *thunk)
+{
+        struct cfi_private *cfi = map->fldrv_priv;
+        int ret;
+
+        spin_lock(chip->mutex);
+        ret = get_chip(map, chip, adr + chip->start, FL_UNLOCKING);
+        if (ret)
+                goto out_unlock;
+        chip->state = FL_UNLOCKING;
+
+        DEBUG(MTD_DEBUG_LEVEL3, "MTD %s(): LOCK 0x%08lx len %d\n",
+              __func__, adr, len);
+
+        cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi,
+                         cfi->device_type, NULL);
+        map_write(map, CMD(0x70), adr);
+
+        chip->state = FL_READY;
+        put_chip(map, chip, adr + chip->start);
+        ret = 0;
+
+out_unlock:
+        spin_unlock(chip->mutex);
+        return ret;
+}
+
+static int cfi_atmel_lock(struct mtd_info *mtd, loff_t ofs, size_t len)
+{
+        return cfi_varsize_frob(mtd, do_atmel_lock, ofs, len, NULL);
+}
+
+static int cfi_atmel_unlock(struct mtd_info *mtd, loff_t ofs, size_t len)
+{
+        return cfi_varsize_frob(mtd, do_atmel_unlock, ofs, len, NULL);
+}
+
 
 static void cfi_amdstd_sync (struct mtd_info *mtd)
 {
diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
index 8f39d0a31438..1154dac715aa 100644
--- a/drivers/mtd/chips/jedec_probe.c
+++ b/drivers/mtd/chips/jedec_probe.c
@@ -111,6 +111,7 @@
 #define MX29LV040C      0x004F
 #define MX29LV160T      0x22C4
 #define MX29LV160B      0x2249
+#define MX29F040        0x00A4
 #define MX29F016        0x00AD
 #define MX29F002T       0x00B0
 #define MX29F004T       0x0045
@@ -1172,6 +1173,19 @@ static const struct amd_flash_info jedec_table[] = {
                 }
         }, {
                 .mfr_id         = MANUFACTURER_MACRONIX,
+                .dev_id         = MX29F040,
+                .name           = "Macronix MX29F040",
+                .uaddr          = {
+                        [0] = MTD_UADDR_0x0555_0x02AA /* x8 */
+                },
+                .DevSize        = SIZE_512KiB,
+                .CmdSet         = P_ID_AMD_STD,
+                .NumEraseRegions= 1,
+                .regions        = {
+                        ERASEINFO(0x10000,8),
+                }
+        }, {
+                .mfr_id         = MANUFACTURER_MACRONIX,
                 .dev_id         = MX29F016,
                 .name           = "Macronix MX29F016",
                 .uaddr          = {
diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
index ede3561be870..401c6a294baa 100644
--- a/drivers/mtd/devices/block2mtd.c
+++ b/drivers/mtd/devices/block2mtd.c
@@ -18,6 +18,7 @@
 #include <linux/mtd/mtd.h>
 #include <linux/buffer_head.h>
 #include <linux/mutex.h>
+#include <linux/mount.h>
 
 #define VERSION "$Revision: 1.30 $"
 
@@ -236,6 +237,8 @@ static int _block2mtd_write(struct block2mtd_dev *dev, const u_char *buf,
         }
         return 0;
 }
+
+
 static int block2mtd_write(struct mtd_info *mtd, loff_t to, size_t len,
                 size_t *retlen, const u_char *buf)
 {
@@ -299,6 +302,19 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size)
 
         /* Get a handle on the device */
         bdev = open_bdev_excl(devname, O_RDWR, NULL);
+#ifndef MODULE
+        if (IS_ERR(bdev)) {
+
+                /* We might not have rootfs mounted at this point. Try
+                   to resolve the device name by other means. */
+
+                dev_t dev = name_to_dev_t(devname);
+                if (dev != 0) {
+                        bdev = open_by_devnum(dev, FMODE_WRITE | FMODE_READ);
+                }
+        }
+#endif
+
         if (IS_ERR(bdev)) {
                 ERROR("error: cannot open device %s", devname);
                 goto devinit_err;
@@ -393,26 +409,6 @@ static int parse_num(size_t *num, const char *token)
 }
 
 
-static int parse_name(char **pname, const char *token, size_t limit)
-{
-        size_t len;
-        char *name;
-
-        len = strlen(token) + 1;
-        if (len > limit)
-                return -ENOSPC;
-
-        name = kmalloc(len, GFP_KERNEL);
-        if (!name)
-                return -ENOMEM;
-
-        strcpy(name, token);
-
-        *pname = name;
-        return 0;
-}
-
-
 static inline void kill_final_newline(char *str)
 {
         char *newline = strrchr(str, '\n');
@@ -426,9 +422,15 @@ static inline void kill_final_newline(char *str)
         return 0;                               \
 } while (0)
 
-static int block2mtd_setup(const char *val, struct kernel_param *kp)
+#ifndef MODULE
+static int block2mtd_init_called = 0;
+static __initdata char block2mtd_paramline[80 + 12]; /* 80 for device, 12 for erase size */
+#endif
+
+
+static int block2mtd_setup2(const char *val)
 {
-        char buf[80+12]; /* 80 for device, 12 for erase size */
+        char buf[80 + 12]; /* 80 for device, 12 for erase size */
         char *str = buf;
         char *token[2];
         char *name;
@@ -450,13 +452,9 @@ static int block2mtd_setup(const char *val, struct kernel_param *kp)
         if (!token[0])
                 parse_err("no argument");
 
-        ret = parse_name(&name, token[0], 80);
-        if (ret == -ENOMEM)
-                parse_err("out of memory");
-        if (ret == -ENOSPC)
-                parse_err("name too long");
-        if (ret)
-                return 0;
+        name = token[0];
+        if (strlen(name) + 1 > 80)
+                parse_err("device name too long");
 
         if (token[1]) {
                 ret = parse_num(&erase_size, token[1]);
@@ -472,13 +470,48 @@ static int block2mtd_setup(const char *val, struct kernel_param *kp)
 }
 
 
+static int block2mtd_setup(const char *val, struct kernel_param *kp)
+{
+#ifdef MODULE
+        return block2mtd_setup2(val);
+#else
+        /* If more parameters are later passed in via
+           /sys/module/block2mtd/parameters/block2mtd
+           and block2mtd_init() has already been called,
+           we can parse the argument now. */
+
+        if (block2mtd_init_called)
+                return block2mtd_setup2(val);
+
+        /* During early boot stage, we only save the parameters
+           here. We must parse them later: if the param passed
+           from kernel boot command line, block2mtd_setup() is
+           called so early that it is not possible to resolve
+           the device (even kmalloc() fails). Deter that work to
+           block2mtd_setup2(). */
+
+        strlcpy(block2mtd_paramline, val, sizeof(block2mtd_paramline));
+
+        return 0;
+#endif
+}
+
+
 module_param_call(block2mtd, block2mtd_setup, NULL, NULL, 0200);
 MODULE_PARM_DESC(block2mtd, "Device to use. \"block2mtd=<dev>[,<erasesize>]\"");
 
 static int __init block2mtd_init(void)
 {
+        int ret = 0;
         INFO("version " VERSION);
-        return 0;
+
+#ifndef MODULE
+        if (strlen(block2mtd_paramline))
+                ret = block2mtd_setup2(block2mtd_paramline);
+        block2mtd_init_called = 1;
+#endif
+
+        return ret;
 }
 
 
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index a8466141e914..ef4a731ca5c2 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -406,13 +406,13 @@ struct flash_info {
 
 static struct flash_info __devinitdata m25p_data [] = {
         /* REVISIT: fill in JEDEC ids, for parts that have them */
-        { "m25p05", 0x05, 0x0000, 32 * 1024, 2 },
-        { "m25p10", 0x10, 0x0000, 32 * 1024, 4 },
-        { "m25p20", 0x11, 0x0000, 64 * 1024, 4 },
-        { "m25p40", 0x12, 0x0000, 64 * 1024, 8 },
+        { "m25p05", 0x05, 0x2010, 32 * 1024, 2 },
+        { "m25p10", 0x10, 0x2011, 32 * 1024, 4 },
+        { "m25p20", 0x11, 0x2012, 64 * 1024, 4 },
+        { "m25p40", 0x12, 0x2013, 64 * 1024, 8 },
         { "m25p80", 0x13, 0x0000, 64 * 1024, 16 },
-        { "m25p16", 0x14, 0x0000, 64 * 1024, 32 },
-        { "m25p32", 0x15, 0x0000, 64 * 1024, 64 },
+        { "m25p16", 0x14, 0x2015, 64 * 1024, 32 },
+        { "m25p32", 0x15, 0x2016, 64 * 1024, 64 },
         { "m25p64", 0x16, 0x2017, 64 * 1024, 128 },
 };
 
diff --git a/drivers/mtd/devices/pmc551.c b/drivers/mtd/devices/pmc551.c
index 6f9bbf6fee4d..2c0149708739 100644
--- a/drivers/mtd/devices/pmc551.c
+++ b/drivers/mtd/devices/pmc551.c
@@ -99,10 +99,6 @@
 #include <asm/system.h>
 #include <linux/pci.h>
 
-#ifndef CONFIG_PCI
-#error Enable PCI in your kernel config
-#endif
-
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/pmc551.h>
 #include <linux/mtd/compatmac.h>
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index 83d0b2a52527..64d1b6a6c920 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -13,13 +13,13 @@ config MTD_COMPLEX_MAPPINGS
 
 config MTD_PHYSMAP
         tristate "CFI Flash device in physical memory map"
-        depends on MTD_CFI
+        depends on MTD_CFI || MTD_JEDECPROBE || MTD_ROM
         help
-          This provides a 'mapping' driver which allows the CFI probe and
-          command set driver code to communicate with flash chips which
-          are mapped physically into the CPU's memory. You will need to
-          configure the physical address and size of the flash chips on
-          your particular board as well as the bus width, either statically
+          This provides a 'mapping' driver which allows the NOR Flash and
+          ROM driver code to communicate with chips which are mapped
+          physically into the CPU's memory. You will need to configure
+          the physical address and size of the flash chips on your
+          particular board as well as the bus width, either statically
           with config options or at run-time.
 
 config MTD_PHYSMAP_START
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index fb8b4f7e48d3..5b6acfcb2b88 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -62,15 +62,12 @@ static loff_t mtd_lseek (struct file *file, loff_t offset, int orig)
         struct mtd_info *mtd = mfi->mtd;
 
         switch (orig) {
-        case 0:
-                /* SEEK_SET */
+        case SEEK_SET:
                 break;
-        case 1:
-                /* SEEK_CUR */
+        case SEEK_CUR:
                 offset += file->f_pos;
                 break;
-        case 2:
-                /* SEEK_END */
+        case SEEK_END:
                 offset += mtd->size;
                 break;
         default:
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 3db77eec0ed2..c99302ed3823 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -11,7 +11,7 @@ config MTD_NAND
         help
           This enables support for accessing all type of NAND flash
           devices. For further information see
-          <http://www.linux-mtd.infradead.org/tech/nand.html>.
+          <http://www.linux-mtd.infradead.org/doc/nand.html>.
 
 config MTD_NAND_VERIFY_WRITE
         bool "Verify NAND page writes"
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index c8cbc00243fe..975b2ef61121 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -1204,7 +1204,7 @@ static int nand_write_oob_syndrome(struct mtd_info *mtd,
                 pos = steps * (eccsize + chunk);
                 steps = 0;
         } else
-                pos = eccsize + chunk;
+                pos = eccsize;
 
         chip->cmdfunc(mtd, NAND_CMD_SEQIN, pos, page);
         for (i = 0; i < steps; i++) {
@@ -1567,7 +1567,7 @@ static uint8_t *nand_fill_oob(struct nand_chip *chip, uint8_t *oob,
                                 bytes = min_t(size_t, len, free->length);
                                 boffs = free->offset;
                         }
-                        memcpy(chip->oob_poi + woffs, oob, bytes);
+                        memcpy(chip->oob_poi + boffs, oob, bytes);
                         oob += bytes;
                 }
                 return oob;
@@ -2224,7 +2224,7 @@ static struct nand_flash_dev *nand_get_flash_type(struct mtd_info *mtd,
         }
 
         /* Try to identify manufacturer */
-        for (maf_idx = 0; nand_manuf_ids[maf_idx].id != 0x0; maf_id++) {
+        for (maf_idx = 0; nand_manuf_ids[maf_idx].id != 0x0; maf_idx++) {
                 if (nand_manuf_ids[maf_idx].id == *maf_id)
                         break;
         }
diff --git a/drivers/mtd/nand/sharpsl.c b/drivers/mtd/nand/sharpsl.c
index fbeedc3184e9..51c7288ab49a 100644
--- a/drivers/mtd/nand/sharpsl.c
+++ b/drivers/mtd/nand/sharpsl.c
@@ -78,7 +78,7 @@ static struct mtd_partition sharpsl_nand_default_partition_info[] = {
 /*
  *      hardware specific access to control-lines
  *      ctrl:
- *      NAND_CNE: bit 0 -> bit 0 & 4
+ *      NAND_CNE: bit 0 -> ! bit 0 & 4
  *      NAND_CLE: bit 1 -> bit 1
  *      NAND_ALE: bit 2 -> bit 2
  *
@@ -92,7 +92,10 @@ static void sharpsl_nand_hwcontrol(struct mtd_info *mtd, int cmd,
                 unsigned char bits = ctrl & 0x07;
 
                 bits |= (ctrl & 0x01) << 4;
-                writeb((readb(FLASHCTL) & 0x17) | bits, FLASHCTL);
+
+                bits ^= 0x11;
+
+                writeb((readb(FLASHCTL) & ~0x17) | bits, FLASHCTL);
         }
 
         if (cmd != NAND_CMD_NONE)
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 726f43d55937..98ef9f85482f 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -1433,8 +1433,8 @@ e1000_configure_tx(struct e1000_adapter *adapter)
                 E1000_WRITE_REG(hw, TDBAL, (tdba & 0x00000000ffffffffULL));
                 E1000_WRITE_REG(hw, TDT, 0);
                 E1000_WRITE_REG(hw, TDH, 0);
-                adapter->tx_ring[0].tdh = E1000_TDH;
-                adapter->tx_ring[0].tdt = E1000_TDT;
+                adapter->tx_ring[0].tdh = ((hw->mac_type >= e1000_82543) ? E1000_TDH : E1000_82542_TDH);
+                adapter->tx_ring[0].tdt = ((hw->mac_type >= e1000_82543) ? E1000_TDT : E1000_82542_TDT);
                 break;
         }
 
@@ -1840,8 +1840,8 @@ e1000_configure_rx(struct e1000_adapter *adapter)
                 E1000_WRITE_REG(hw, RDBAL, (rdba & 0x00000000ffffffffULL));
                 E1000_WRITE_REG(hw, RDT, 0);
                 E1000_WRITE_REG(hw, RDH, 0);
-                adapter->rx_ring[0].rdh = E1000_RDH;
-                adapter->rx_ring[0].rdt = E1000_RDT;
+                adapter->rx_ring[0].rdh = ((hw->mac_type >= e1000_82543) ? E1000_RDH : E1000_82542_RDH);
+                adapter->rx_ring[0].rdt = ((hw->mac_type >= e1000_82543) ? E1000_RDT : E1000_82542_RDT);
                 break;
         }
 
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 760c61b98867..eeab1df5bef3 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -385,6 +385,8 @@ static int mv643xx_eth_receive_queue(struct net_device *dev, int budget)
         struct pkt_info pkt_info;
 
         while (budget-- > 0 && eth_port_receive(mp, &pkt_info) == ETH_OK) {
+                dma_unmap_single(NULL, pkt_info.buf_ptr, RX_SKB_SIZE,
+                                                        DMA_FROM_DEVICE);
                 mp->rx_desc_count--;
                 received_packets++;
 
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index da9d06bdb818..aa792821854e 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -1430,9 +1430,43 @@ static int ofdm_qual_db(u8 status_quality, u8 rate, unsigned int size)
                         break;
         }
 
+        switch (rate) {
+        case ZD_OFDM_RATE_6M:
+        case ZD_OFDM_RATE_9M:
+                i += 3;
+                break;
+        case ZD_OFDM_RATE_12M:
+        case ZD_OFDM_RATE_18M:
+                i += 5;
+                break;
+        case ZD_OFDM_RATE_24M:
+        case ZD_OFDM_RATE_36M:
+                i += 9;
+                break;
+        case ZD_OFDM_RATE_48M:
+        case ZD_OFDM_RATE_54M:
+                i += 15;
+                break;
+        default:
+                return -EINVAL;
+        }
+
         return i;
 }
 
+static int ofdm_qual_percent(u8 status_quality, u8 rate, unsigned int size)
+{
+        int r;
+
+        r = ofdm_qual_db(status_quality, rate, size);
+        ZD_ASSERT(r >= 0);
+        if (r < 0)
+                r = 0;
+
+        r = (r * 100)/29;
+        return r <= 100 ? r : 100;
+}
+
 static unsigned int log10times100(unsigned int x)
 {
         static const u8 log10[] = {
@@ -1476,31 +1510,28 @@ static int cck_snr_db(u8 status_quality)
         return r;
 }
 
-static int rx_qual_db(const void *rx_frame, unsigned int size,
-                      const struct rx_status *status)
+static int cck_qual_percent(u8 status_quality)
 {
-        return (status->frame_status&ZD_RX_OFDM) ?
-                ofdm_qual_db(status->signal_quality_ofdm,
-                             zd_ofdm_plcp_header_rate(rx_frame),
-                             size) :
-                cck_snr_db(status->signal_quality_cck);
+        int r;
+
+        r = cck_snr_db(status_quality);
+        r = (100*r)/17;
+        return r <= 100 ? r : 100;
 }
 
 u8 zd_rx_qual_percent(const void *rx_frame, unsigned int size,
                       const struct rx_status *status)
 {
-        int r = rx_qual_db(rx_frame, size, status);
-        if (r < 0)
-                r = 0;
-        r = (r * 100) / 14;
-        if (r > 100)
-                r = 100;
-        return r;
+        return (status->frame_status&ZD_RX_OFDM) ?
+                ofdm_qual_percent(status->signal_quality_ofdm,
+                                  zd_ofdm_plcp_header_rate(rx_frame),
+                                  size) :
+                cck_qual_percent(status->signal_quality_cck);
 }
 
 u8 zd_rx_strength_percent(u8 rssi)
 {
-        int r = (rssi*100) / 30;
+        int r = (rssi*100) / 41;
         if (r > 100)
                 r = 100;
         return (u8) r;
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index d6f3e02a0b54..a9bd80a08613 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -816,13 +816,25 @@ static int filter_rx(struct ieee80211_device *ieee,
         return -EINVAL;
 }
 
-static void update_qual_rssi(struct zd_mac *mac, u8 qual_percent, u8 rssi)
+static void update_qual_rssi(struct zd_mac *mac,
+                             const u8 *buffer, unsigned int length,
+                             u8 qual_percent, u8 rssi_percent)
 {
         unsigned long flags;
+        struct ieee80211_hdr_3addr *hdr;
+        int i;
+
+        hdr = (struct ieee80211_hdr_3addr *)buffer;
+        if (length < offsetof(struct ieee80211_hdr_3addr, addr3))
+                return;
+        if (memcmp(hdr->addr2, zd_mac_to_ieee80211(mac)->bssid, ETH_ALEN) != 0)
+                return;
 
         spin_lock_irqsave(&mac->lock, flags);
-        mac->qual_average = (7 * mac->qual_average + qual_percent) / 8;
-        mac->rssi_average = (7 * mac->rssi_average + rssi) / 8;
+        i = mac->stats_count % ZD_MAC_STATS_BUFFER_SIZE;
+        mac->qual_buffer[i] = qual_percent;
+        mac->rssi_buffer[i] = rssi_percent;
+        mac->stats_count++;
         spin_unlock_irqrestore(&mac->lock, flags);
 }
 
@@ -853,7 +865,6 @@ static int fill_rx_stats(struct ieee80211_rx_stats *stats,
         if (stats->rate)
                 stats->mask |= IEEE80211_STATMASK_RATE;
 
-        update_qual_rssi(mac, stats->signal, stats->rssi);
         return 0;
 }
 
@@ -877,6 +888,8 @@ int zd_mac_rx(struct zd_mac *mac, const u8 *buffer, unsigned int length)
                   sizeof(struct rx_status);
         buffer += ZD_PLCP_HEADER_SIZE;
 
+        update_qual_rssi(mac, buffer, length, stats.signal, stats.rssi);
+
         r = filter_rx(ieee, buffer, length, &stats);
         if (r <= 0)
                 return r;
@@ -981,17 +994,31 @@ struct iw_statistics *zd_mac_get_wireless_stats(struct net_device *ndev)
 {
         struct zd_mac *mac = zd_netdev_mac(ndev);
         struct iw_statistics *iw_stats = &mac->iw_stats;
+        unsigned int i, count, qual_total, rssi_total;
 
         memset(iw_stats, 0, sizeof(struct iw_statistics));
         /* We are not setting the status, because ieee->state is not updated
          * at all and this driver doesn't track authentication state.
          */
         spin_lock_irq(&mac->lock);
-        iw_stats->qual.qual = mac->qual_average;
-        iw_stats->qual.level = mac->rssi_average;
-        iw_stats->qual.updated = IW_QUAL_QUAL_UPDATED|IW_QUAL_LEVEL_UPDATED|
-                                 IW_QUAL_NOISE_INVALID;
+        count = mac->stats_count < ZD_MAC_STATS_BUFFER_SIZE ?
+                mac->stats_count : ZD_MAC_STATS_BUFFER_SIZE;
+        qual_total = rssi_total = 0;
+        for (i = 0; i < count; i++) {
+                qual_total += mac->qual_buffer[i];
+                rssi_total += mac->rssi_buffer[i];
+        }
         spin_unlock_irq(&mac->lock);
+        iw_stats->qual.updated = IW_QUAL_NOISE_INVALID;
+        if (count > 0) {
+                iw_stats->qual.qual = qual_total / count;
+                iw_stats->qual.level = rssi_total / count;
+                iw_stats->qual.updated |=
+                        IW_QUAL_QUAL_UPDATED|IW_QUAL_LEVEL_UPDATED;
+        } else {
+                iw_stats->qual.updated |=
+                        IW_QUAL_QUAL_INVALID|IW_QUAL_LEVEL_INVALID;
+        }
         /* TODO: update counter */
         return iw_stats;
 }
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.h b/drivers/net/wireless/zd1211rw/zd_mac.h
index 71e382c589ee..b3ba49b84634 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.h
+++ b/drivers/net/wireless/zd1211rw/zd_mac.h
@@ -1,4 +1,4 @@
-/* zd_mac.c
+/* zd_mac.h
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -87,9 +87,9 @@ struct rx_length_info {
 #define RX_LENGTH_INFO_TAG              0x697e
 
 struct rx_status {
+        u8 signal_quality_cck;
         /* rssi */
         u8 signal_strength;
-        u8 signal_quality_cck;
         u8 signal_quality_ofdm;
         u8 decryption_type;
         u8 frame_status;
@@ -120,14 +120,17 @@ enum mac_flags {
         MAC_FIXED_CHANNEL = 0x01,
 };
 
+#define ZD_MAC_STATS_BUFFER_SIZE 16
+
 struct zd_mac {
         struct net_device *netdev;
         struct zd_chip chip;
         spinlock_t lock;
         /* Unlocked reading possible */
         struct iw_statistics iw_stats;
-        u8 qual_average;
-        u8 rssi_average;
+        unsigned int stats_count;
+        u8 qual_buffer[ZD_MAC_STATS_BUFFER_SIZE];
+        u8 rssi_buffer[ZD_MAC_STATS_BUFFER_SIZE];
         u8 regdomain;
         u8 default_regdomain;
         u8 requested_channel;
diff --git a/drivers/s390/net/Kconfig b/drivers/s390/net/Kconfig
index 548854754921..1a93fa684e9f 100644
--- a/drivers/s390/net/Kconfig
+++ b/drivers/s390/net/Kconfig
@@ -92,15 +92,6 @@ config QETH_VLAN
           If CONFIG_QETH is switched on, this option will include IEEE
           802.1q VLAN support in the qeth device driver.
 
-config QETH_PERF_STATS
-        bool "Performance statistics in /proc"
-        depends on QETH
-        help
-          When switched on, this option will add a file in the proc-fs
-          (/proc/qeth_perf_stats) containing performance statistics. It
-          may slightly impact performance, so this is only recommended for
-          internal tuning of the device driver.
-
 config CCWGROUP
         tristate
         default (LCS || CTC || QETH)
diff --git a/drivers/s390/net/Makefile b/drivers/s390/net/Makefile
index 6775a837d646..4777e36a922f 100644
--- a/drivers/s390/net/Makefile
+++ b/drivers/s390/net/Makefile
@@ -10,7 +10,6 @@ obj-$(CONFIG_SMSGIUCV) += smsgiucv.o
 obj-$(CONFIG_CTC) += ctc.o fsm.o cu3088.o
 obj-$(CONFIG_LCS) += lcs.o cu3088.o
 obj-$(CONFIG_CLAW) += claw.o cu3088.o
-obj-$(CONFIG_MPC) += ctcmpc.o fsm.o cu3088.o
 qeth-y := qeth_main.o qeth_mpc.o qeth_sys.o qeth_eddp.o 
 qeth-$(CONFIG_PROC_FS) += qeth_proc.o
 obj-$(CONFIG_QETH) += qeth.o
diff --git a/drivers/s390/net/ctcmain.c b/drivers/s390/net/ctcmain.c
index 8a4b58120146..3257c22dd79c 100644
--- a/drivers/s390/net/ctcmain.c
+++ b/drivers/s390/net/ctcmain.c
@@ -1714,6 +1714,9 @@ add_channel(struct ccw_device *cdev, enum channel_types type)
                 kfree(ch);
                 return 0;
         }
+
+        spin_lock_init(&ch->collect_lock);
+
         fsm_settimer(ch->fsm, &ch->timer);
         skb_queue_head_init(&ch->io_queue);
         skb_queue_head_init(&ch->collect_queue);
diff --git a/drivers/s390/net/iucv.c b/drivers/s390/net/iucv.c
index 0e863df4027a..821dde86e240 100644
--- a/drivers/s390/net/iucv.c
+++ b/drivers/s390/net/iucv.c
@@ -335,8 +335,8 @@ do { \
 
 #else
 
-#define iucv_debug(lvl, fmt, args...)
-#define iucv_dumpit(title, buf, len)
+#define iucv_debug(lvl, fmt, args...)   do { } while (0)
+#define iucv_dumpit(title, buf, len)    do { } while (0)
 
 #endif
 
diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
index 2eded55ae88d..16ac68c27a27 100644
--- a/drivers/s390/net/lcs.c
+++ b/drivers/s390/net/lcs.c
@@ -670,9 +670,8 @@ lcs_ready_buffer(struct lcs_channel *channel, struct lcs_buffer *buffer)
         int index, rc;
 
         LCS_DBF_TEXT(5, trace, "rdybuff");
-        if (buffer->state != BUF_STATE_LOCKED &&
-            buffer->state != BUF_STATE_PROCESSED)
-                BUG();
+        BUG_ON(buffer->state != BUF_STATE_LOCKED &&
+               buffer->state != BUF_STATE_PROCESSED);
         spin_lock_irqsave(get_ccwdev_lock(channel->ccwdev), flags);
         buffer->state = BUF_STATE_READY;
         index = buffer - channel->iob;
@@ -696,8 +695,7 @@ __lcs_processed_buffer(struct lcs_channel *channel, struct lcs_buffer *buffer)
         int index, prev, next;
 
         LCS_DBF_TEXT(5, trace, "prcsbuff");
-        if (buffer->state != BUF_STATE_READY)
-                BUG();
+        BUG_ON(buffer->state != BUF_STATE_READY);
         buffer->state = BUF_STATE_PROCESSED;
         index = buffer - channel->iob;
         prev = (index - 1) & (LCS_NUM_BUFFS - 1);
@@ -729,9 +727,8 @@ lcs_release_buffer(struct lcs_channel *channel, struct lcs_buffer *buffer)
         unsigned long flags;
 
         LCS_DBF_TEXT(5, trace, "relbuff");
-        if (buffer->state != BUF_STATE_LOCKED &&
-            buffer->state != BUF_STATE_PROCESSED)
-                BUG();
+        BUG_ON(buffer->state != BUF_STATE_LOCKED &&
+               buffer->state != BUF_STATE_PROCESSED);
         spin_lock_irqsave(get_ccwdev_lock(channel->ccwdev), flags);
         buffer->state = BUF_STATE_EMPTY;
         spin_unlock_irqrestore(get_ccwdev_lock(channel->ccwdev), flags);
diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c
index 5d6e6cbfa360..d7d1cc0a5c8e 100644
--- a/drivers/s390/net/netiucv.c
+++ b/drivers/s390/net/netiucv.c
@@ -112,7 +112,12 @@ struct iucv_connection {
 /**
  * Linked list of all connection structs.
  */
-static struct iucv_connection *iucv_connections;
+struct iucv_connection_struct {
+        struct iucv_connection *iucv_connections;
+        rwlock_t iucv_rwlock;
+};
+
+static struct iucv_connection_struct iucv_conns;
 
 /**
  * Representation of event-data for the
@@ -1368,8 +1373,10 @@ user_write (struct device *dev, struct device_attribute *attr, const char *buf,
         struct net_device *ndev = priv->conn->netdev;
         char    *p;
         char    *tmp;
-        char    username[10];
+        char    username[9];
         int     i;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
+        unsigned long flags;
 
         IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
         if (count>9) {
@@ -1382,7 +1389,7 @@ user_write (struct device *dev, struct device_attribute *attr, const char *buf,
         tmp = strsep((char **) &buf, "\n");
         for (i=0, p=tmp; i<8 && *p; i++, p++) {
                 if (isalnum(*p) || (*p == '$'))
-                        username[i]= *p;
+                        username[i]= toupper(*p);
                 else if (*p == '\n') {
                         /* trailing lf, grr */
                         break;
@@ -1395,11 +1402,11 @@ user_write (struct device *dev, struct device_attribute *attr, const char *buf,
                         return -EINVAL;
                 }
         }
-        while (i<9)
+        while (i<8)
                 username[i++] = ' ';
-        username[9] = '\0';
+        username[8] = '\0';
 
-        if (memcmp(username, priv->conn->userid, 8)) {
+        if (memcmp(username, priv->conn->userid, 9)) {
                 /* username changed */
                 if (ndev->flags & (IFF_UP | IFF_RUNNING)) {
                         PRINT_WARN(
@@ -1410,6 +1417,19 @@ user_write (struct device *dev, struct device_attribute *attr, const char *buf,
                         return -EBUSY;
                 }
         }
+        read_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
+        while (*clist) {
+                if (!strncmp(username, (*clist)->userid, 9) ||
+                    ((*clist)->netdev != ndev))
+                        break;
+                clist = &((*clist)->next);
+        }
+        read_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
+        if (*clist) {
+                PRINT_WARN("netiucv: Connection to %s already exists\n",
+                        username);
+                return -EEXIST;
+        }
         memcpy(priv->conn->userid, username, 9);
 
         return count;
@@ -1781,13 +1801,15 @@ netiucv_unregister_device(struct device *dev)
 static struct iucv_connection *
 netiucv_new_connection(struct net_device *dev, char *username)
 {
-        struct iucv_connection **clist = &iucv_connections;
+        unsigned long flags;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
         struct iucv_connection *conn =
                 kzalloc(sizeof(struct iucv_connection), GFP_KERNEL);
 
         if (conn) {
                 skb_queue_head_init(&conn->collect_queue);
                 skb_queue_head_init(&conn->commit_queue);
+                spin_lock_init(&conn->collect_lock);
                 conn->max_buffsize = NETIUCV_BUFSIZE_DEFAULT;
                 conn->netdev = dev;
 
@@ -1822,8 +1844,10 @@ netiucv_new_connection(struct net_device *dev, char *username)
                         fsm_newstate(conn->fsm, CONN_STATE_STOPPED);
                 }
 
+                write_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
                 conn->next = *clist;
                 *clist = conn;
+                write_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
         }
         return conn;
 }
@@ -1835,14 +1859,17 @@ netiucv_new_connection(struct net_device *dev, char *username)
 static void
 netiucv_remove_connection(struct iucv_connection *conn)
 {
-        struct iucv_connection **clist = &iucv_connections;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
+        unsigned long flags;
 
         IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
         if (conn == NULL)
                 return;
+        write_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
         while (*clist) {
                 if (*clist == conn) {
                         *clist = conn->next;
+                        write_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
                         if (conn->handle) {
                                 iucv_unregister_program(conn->handle);
                                 conn->handle = NULL;
@@ -1855,6 +1882,7 @@ netiucv_remove_connection(struct iucv_connection *conn)
                 }
                 clist = &((*clist)->next);
         }
+        write_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
 }
 
 /**
@@ -1947,9 +1975,11 @@ static ssize_t
 conn_write(struct device_driver *drv, const char *buf, size_t count)
 {
         char *p;
-        char username[10];
+        char username[9];
         int i, ret;
         struct net_device *dev;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
+        unsigned long flags;
 
         IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
         if (count>9) {
@@ -1960,7 +1990,7 @@ conn_write(struct device_driver *drv, const char *buf, size_t count)
 
         for (i=0, p=(char *)buf; i<8 && *p; i++, p++) {
                 if (isalnum(*p) || (*p == '$'))
-                        username[i]= *p;
+                        username[i]= toupper(*p);
                 else if (*p == '\n') {
                         /* trailing lf, grr */
                         break;
@@ -1971,9 +2001,22 @@ conn_write(struct device_driver *drv, const char *buf, size_t count)
                         return -EINVAL;
                 }
         }
-        while (i<9)
+        while (i<8)
                 username[i++] = ' ';
-        username[9] = '\0';
+        username[8] = '\0';
+
+        read_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
+        while (*clist) {
+                if (!strncmp(username, (*clist)->userid, 9))
+                        break;
+                clist = &((*clist)->next);
+        }
+        read_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
+        if (*clist) {
+                PRINT_WARN("netiucv: Connection to %s already exists\n",
+                        username);
+                return -EEXIST;
+        }
         dev = netiucv_init_netdevice(username);
         if (!dev) {
                 PRINT_WARN(
@@ -2015,7 +2058,8 @@ DRIVER_ATTR(connection, 0200, NULL, conn_write);
 static ssize_t
 remove_write (struct device_driver *drv, const char *buf, size_t count)
 {
-        struct iucv_connection **clist = &iucv_connections;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
+        unsigned long flags;
         struct net_device *ndev;
         struct netiucv_priv *priv;
         struct device *dev;
@@ -2026,7 +2070,7 @@ remove_write (struct device_driver *drv, const char *buf, size_t count)
         IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
         if (count >= IFNAMSIZ)
-                count = IFNAMSIZ-1;
+                count = IFNAMSIZ - 1;;
 
         for (i=0, p=(char *)buf; i<count && *p; i++, p++) {
                 if ((*p == '\n') || (*p == ' ')) {
@@ -2038,6 +2082,7 @@ remove_write (struct device_driver *drv, const char *buf, size_t count)
         }
         name[i] = '\0';
 
+        read_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
         while (*clist) {
                 ndev = (*clist)->netdev;
                 priv = (struct netiucv_priv*)ndev->priv;
@@ -2047,6 +2092,7 @@ remove_write (struct device_driver *drv, const char *buf, size_t count)
                         clist = &((*clist)->next);
                         continue;
                 }
+                read_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
                 if (ndev->flags & (IFF_UP | IFF_RUNNING)) {
                         PRINT_WARN(
                                 "netiucv: net device %s active with peer %s\n",
@@ -2060,6 +2106,7 @@ remove_write (struct device_driver *drv, const char *buf, size_t count)
                 netiucv_unregister_device(dev);
                 return count;
         }
+        read_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
         PRINT_WARN("netiucv: net device %s unknown\n", name);
         IUCV_DBF_TEXT(data, 2, "remove_write: unknown device\n");
         return -EINVAL;
@@ -2077,8 +2124,8 @@ static void __exit
 netiucv_exit(void)
 {
         IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
-        while (iucv_connections) {
-                struct net_device *ndev = iucv_connections->netdev;
+        while (iucv_conns.iucv_connections) {
+                struct net_device *ndev = iucv_conns.iucv_connections->netdev;
                 struct netiucv_priv *priv = (struct netiucv_priv*)ndev->priv;
                 struct device *dev = priv->dev;
 
@@ -2120,6 +2167,7 @@ netiucv_init(void)
         if (!ret) {
                 ret = driver_create_file(&netiucv_driver, &driver_attr_remove);
                 netiucv_banner();
+                rwlock_init(&iucv_conns.iucv_rwlock);
         } else {
                 PRINT_ERR("NETIUCV: failed to add driver attribute.\n");
                 IUCV_DBF_TEXT_(setup, 2, "ret %d from driver_create_file\n", ret);
diff --git a/drivers/s390/net/qeth.h b/drivers/s390/net/qeth.h
index 619f4a0c7160..821383d8cbe7 100644
--- a/drivers/s390/net/qeth.h
+++ b/drivers/s390/net/qeth.h
@@ -176,7 +176,6 @@ extern struct ccwgroup_driver qeth_ccwgroup_driver;
 /**
  * card stuff
  */
-#ifdef CONFIG_QETH_PERF_STATS
 struct qeth_perf_stats {
         unsigned int bufs_rec;
         unsigned int bufs_sent;
@@ -211,8 +210,10 @@ struct qeth_perf_stats {
         unsigned int large_send_cnt;
         unsigned int sg_skbs_sent;
         unsigned int sg_frags_sent;
+        /* initial values when measuring starts */
+        unsigned long initial_rx_packets;
+        unsigned long initial_tx_packets;
 };
-#endif /* CONFIG_QETH_PERF_STATS */
 
 /* Routing stuff */
 struct qeth_routing_info {
@@ -462,6 +463,7 @@ enum qeth_qdio_info_states {
         QETH_QDIO_UNINITIALIZED,
         QETH_QDIO_ALLOCATED,
         QETH_QDIO_ESTABLISHED,
+        QETH_QDIO_CLEANING
 };
 
 struct qeth_buffer_pool_entry {
@@ -536,7 +538,7 @@ struct qeth_qdio_out_q {
 } __attribute__ ((aligned(256)));
 
 struct qeth_qdio_info {
-        volatile enum qeth_qdio_info_states state;
+        atomic_t state;
         /* input */
         struct qeth_qdio_q *in_q;
         struct qeth_qdio_buffer_pool in_buf_pool;
@@ -767,6 +769,7 @@ struct qeth_card_options {
         int fake_ll;
         int layer2;
         enum qeth_large_send_types large_send;
+        int performance_stats;
 };
 
 /*
@@ -819,9 +822,7 @@ struct qeth_card {
         struct list_head cmd_waiter_list;
         /* QDIO buffer handling */
         struct qeth_qdio_info qdio;
-#ifdef CONFIG_QETH_PERF_STATS
         struct qeth_perf_stats perf_stats;
-#endif /* CONFIG_QETH_PERF_STATS */
         int use_hard_stop;
         int (*orig_hard_header)(struct sk_buff *,struct net_device *,
                                 unsigned short,void *,void *,unsigned);
@@ -859,23 +860,18 @@ qeth_get_ipa_adp_type(enum qeth_link_types link_type)
         }
 }
 
-static inline int
-qeth_realloc_headroom(struct qeth_card *card, struct sk_buff **skb, int size)
+static inline struct sk_buff *
+qeth_realloc_headroom(struct qeth_card *card, struct sk_buff *skb, int size)
 {
-        struct sk_buff *new_skb = NULL;
-
-        if (skb_headroom(*skb) < size){
-                new_skb = skb_realloc_headroom(*skb, size);
-                if (!new_skb) {
-                        PRINT_ERR("qeth_prepare_skb: could "
-                                  "not realloc headroom for qeth_hdr "
-                                  "on interface %s", QETH_CARD_IFNAME(card));
-                        return -ENOMEM;
-                }
-                kfree_skb(*skb);
-                *skb = new_skb;
-        }
-        return 0;
+        struct sk_buff *new_skb = skb;
+
+        if (skb_headroom(skb) >= size)
+                return skb;
+        new_skb = skb_realloc_headroom(skb, size);
+        if (!new_skb) 
+                PRINT_ERR("Could not realloc headroom for qeth_hdr "
+                          "on interface %s", QETH_CARD_IFNAME(card));
+        return new_skb;
 }
 
 static inline struct sk_buff *
@@ -885,16 +881,15 @@ qeth_pskb_unshare(struct sk_buff *skb, int pri)
         if (!skb_cloned(skb))
                 return skb;
         nskb = skb_copy(skb, pri);
-        kfree_skb(skb); /* free our shared copy */
         return nskb;
 }
 
 static inline void *
-qeth_push_skb(struct qeth_card *card, struct sk_buff **skb, int size)
+qeth_push_skb(struct qeth_card *card, struct sk_buff *skb, int size)
 {
         void *hdr;
 
-        hdr = (void *) skb_push(*skb, size);
+        hdr = (void *) skb_push(skb, size);
         /*
          * sanity check, the Linux memory allocation scheme should
          * never present us cases like this one (the qdio header size plus
@@ -903,8 +898,7 @@ qeth_push_skb(struct qeth_card *card, struct sk_buff **skb, int size)
         if ((((unsigned long) hdr) & (~(PAGE_SIZE - 1))) !=
             (((unsigned long) hdr + size +
               QETH_IP_HEADER_SIZE) & (~(PAGE_SIZE - 1)))) {
-                PRINT_ERR("qeth_prepare_skb: misaligned "
-                          "packet on interface %s. Discarded.",
+                PRINT_ERR("Misaligned packet on interface %s. Discarded.",
                           QETH_CARD_IFNAME(card));
                 return NULL;
         }
@@ -1056,13 +1050,11 @@ qeth_get_arphdr_type(int cardtype, int linktype)
         }
 }
 
-#ifdef CONFIG_QETH_PERF_STATS
 static inline int
 qeth_get_micros(void)
 {
         return (int) (get_clock() >> 12);
 }
-#endif
 
 static inline int
 qeth_get_qdio_q_format(struct qeth_card *card)
@@ -1096,10 +1088,11 @@ qeth_string_to_ipaddr4(const char *buf, __u8 *addr)
 {
         int count = 0, rc = 0;
         int in[4];
+        char c;
 
-        rc = sscanf(buf, "%d.%d.%d.%d%n",
-                    &in[0], &in[1], &in[2], &in[3], &count);
-        if (rc != 4  || count<=0)
+        rc = sscanf(buf, "%u.%u.%u.%u%c",
+                    &in[0], &in[1], &in[2], &in[3], &c);
+        if (rc != 4 && (rc != 5 || c != '\n'))
                 return -EINVAL;
         for (count = 0; count < 4; count++) {
                 if (in[count] > 255)
@@ -1123,24 +1116,28 @@ qeth_ipaddr6_to_string(const __u8 *addr, char *buf)
 static inline int
 qeth_string_to_ipaddr6(const char *buf, __u8 *addr)
 {
-        char *end, *start;
+        const char *end, *end_tmp, *start;
         __u16 *in;
         char num[5];
         int num2, cnt, out, found, save_cnt;
         unsigned short in_tmp[8] = {0, };
 
         cnt = out = found = save_cnt = num2 = 0;
-        end = start = (char *) buf;
+        end = start = buf;
         in = (__u16 *) addr;
         memset(in, 0, 16);
-        while (end) {
-                end = strchr(end,':');
+        while (*end) {
+                end = strchr(start,':');
                 if (end == NULL) {
-                        end = (char *)buf + (strlen(buf));
-                        out = 1;
+                        end = buf + strlen(buf);
+                        if ((end_tmp = strchr(start, '\n')) != NULL)
+                                end = end_tmp;
+                        out = 1;
                 }
                 if ((end - start)) {
                         memset(num, 0, 5);
+                        if ((end - start) > 4)
+                                return -EINVAL;
                         memcpy(num, start, end - start);
                         if (!qeth_isxdigit(num))
                                 return -EINVAL;
@@ -1158,6 +1155,8 @@ qeth_string_to_ipaddr6(const char *buf, __u8 *addr)
                 }
                 start = ++end;
         }
+        if (cnt + save_cnt > 8)
+                return -EINVAL;
         cnt = 7;
         while (save_cnt)
                 in[cnt--] = in_tmp[--save_cnt];
diff --git a/drivers/s390/net/qeth_eddp.c b/drivers/s390/net/qeth_eddp.c
index 8491598f9149..a363721cf28d 100644
--- a/drivers/s390/net/qeth_eddp.c
+++ b/drivers/s390/net/qeth_eddp.c
@@ -179,9 +179,8 @@ out_check:
                         flush_cnt++;
                 }
         } else {
-#ifdef CONFIG_QETH_PERF_STATS
-                queue->card->perf_stats.skbs_sent_pack++;
-#endif
+                if (queue->card->options.performance_stats)
+                        queue->card->perf_stats.skbs_sent_pack++;
                 QETH_DBF_TEXT(trace, 6, "fillbfpa");
                 if (buf->next_element_to_fill >=
                                 QETH_MAX_BUFFER_ELEMENTS(queue->card)) {
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index e1327b8fce00..5613b4564fa2 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -1073,6 +1073,7 @@ qeth_set_intial_options(struct qeth_card *card)
                 card->options.layer2 = 1;
         else
                 card->options.layer2 = 0;
+        card->options.performance_stats = 1;
 }
 
 /**
@@ -1708,6 +1709,7 @@ qeth_check_ipa_data(struct qeth_card *card, struct qeth_cmd_buffer *iob)
                                            "IP address reset.\n",
                                            QETH_CARD_IFNAME(card),
                                            card->info.chpid);
+                                netif_carrier_on(card->dev);
                                 qeth_schedule_recovery(card);
                                 return NULL;
                         case IPA_CMD_MODCCID:
@@ -2464,24 +2466,6 @@ qeth_rebuild_skb_fake_ll(struct qeth_card *card, struct sk_buff *skb,
                 qeth_rebuild_skb_fake_ll_eth(card, skb, hdr);
 }
 
-static inline void
-qeth_rebuild_skb_vlan(struct qeth_card *card, struct sk_buff *skb,
-                      struct qeth_hdr *hdr)
-{
-#ifdef CONFIG_QETH_VLAN
-        u16 *vlan_tag;
-
-        if (hdr->hdr.l3.ext_flags &
-            (QETH_HDR_EXT_VLAN_FRAME | QETH_HDR_EXT_INCLUDE_VLAN_TAG)) {
-                vlan_tag = (u16 *) skb_push(skb, VLAN_HLEN);
-                *vlan_tag = (hdr->hdr.l3.ext_flags & QETH_HDR_EXT_VLAN_FRAME)?
-                        hdr->hdr.l3.vlan_id : *((u16 *)&hdr->hdr.l3.dest_addr[12]);
-                *(vlan_tag + 1) = skb->protocol;
-                skb->protocol = __constant_htons(ETH_P_8021Q);
-        }
-#endif /* CONFIG_QETH_VLAN */
-}
-
 static inline __u16
 qeth_layer2_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
                         struct qeth_hdr *hdr)
@@ -2510,15 +2494,16 @@ qeth_layer2_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
         return vlan_id;
 }
 
-static inline void
+static inline __u16
 qeth_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
                  struct qeth_hdr *hdr)
 {
+        unsigned short vlan_id = 0;
 #ifdef CONFIG_QETH_IPV6
         if (hdr->hdr.l3.flags & QETH_HDR_PASSTHRU) {
                 skb->pkt_type = PACKET_HOST;
                 skb->protocol = qeth_type_trans(skb, card->dev);
-                return;
+                return 0;
         }
 #endif /* CONFIG_QETH_IPV6 */
         skb->protocol = htons((hdr->hdr.l3.flags & QETH_HDR_IPV6)? ETH_P_IPV6 :
@@ -2540,7 +2525,13 @@ qeth_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
         default:
                 skb->pkt_type = PACKET_HOST;
         }
-        qeth_rebuild_skb_vlan(card, skb, hdr);
+
+        if (hdr->hdr.l3.ext_flags &
+            (QETH_HDR_EXT_VLAN_FRAME | QETH_HDR_EXT_INCLUDE_VLAN_TAG)) {
+                vlan_id = (hdr->hdr.l3.ext_flags & QETH_HDR_EXT_VLAN_FRAME)?
+                        hdr->hdr.l3.vlan_id : *((u16 *)&hdr->hdr.l3.dest_addr[12]);
+        }
+
         if (card->options.fake_ll)
                 qeth_rebuild_skb_fake_ll(card, skb, hdr);
         else
@@ -2556,6 +2547,7 @@ qeth_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
                 else
                         skb->ip_summed = SW_CHECKSUMMING;
         }
+        return vlan_id;
 }
 
 static inline void
@@ -2568,20 +2560,20 @@ qeth_process_inbound_buffer(struct qeth_card *card,
         int offset;
         int rxrc;
         __u16 vlan_tag = 0;
+        __u16 *vlan_addr;
 
         /* get first element of current buffer */
         element = (struct qdio_buffer_element *)&buf->buffer->element[0];
         offset = 0;
-#ifdef CONFIG_QETH_PERF_STATS
-        card->perf_stats.bufs_rec++;
-#endif
+        if (card->options.performance_stats)
+                card->perf_stats.bufs_rec++;
         while((skb = qeth_get_next_skb(card, buf->buffer, &element,
                                        &offset, &hdr))) {
                 skb->dev = card->dev;
                 if (hdr->hdr.l2.id == QETH_HEADER_TYPE_LAYER2)
                         vlan_tag = qeth_layer2_rebuild_skb(card, skb, hdr);
                 else if (hdr->hdr.l3.id == QETH_HEADER_TYPE_LAYER3)
-                        qeth_rebuild_skb(card, skb, hdr);
+                        vlan_tag = qeth_rebuild_skb(card, skb, hdr);
                 else { /*in case of OSN*/
                         skb_push(skb, sizeof(struct qeth_hdr));
                         memcpy(skb->data, hdr, sizeof(struct qeth_hdr));
@@ -2591,14 +2583,19 @@ qeth_process_inbound_buffer(struct qeth_card *card,
                         dev_kfree_skb_any(skb);
                         continue;
                 }
+                if (card->info.type == QETH_CARD_TYPE_OSN)
+                        rxrc = card->osn_info.data_cb(skb);
+                else
 #ifdef CONFIG_QETH_VLAN
                 if (vlan_tag)
-                        vlan_hwaccel_rx(skb, card->vlangrp, vlan_tag);
+                        if (card->vlangrp)
+                                vlan_hwaccel_rx(skb, card->vlangrp, vlan_tag);
+                        else {
+                                dev_kfree_skb_any(skb);
+                                continue;
+                        }
                 else
 #endif
-                if (card->info.type == QETH_CARD_TYPE_OSN)
-                        rxrc = card->osn_info.data_cb(skb);
-                else
                         rxrc = netif_rx(skb);
                 card->dev->last_rx = jiffies;
                 card->stats.rx_packets++;
@@ -2626,7 +2623,7 @@ qeth_init_input_buffer(struct qeth_card *card, struct qeth_qdio_buffer *buf)
 {
         struct qeth_buffer_pool_entry *pool_entry;
         int i;
-
+ 
         pool_entry = qeth_get_buffer_pool_entry(card);
         /*
          * since the buffer is accessed only from the input_tasklet
@@ -2700,17 +2697,18 @@ qeth_queue_input_buffer(struct qeth_card *card, int index)
                  * 'index') un-requeued -> this buffer is the first buffer that
                  * will be requeued the next time
                  */
-#ifdef CONFIG_QETH_PERF_STATS
-                card->perf_stats.inbound_do_qdio_cnt++;
-                card->perf_stats.inbound_do_qdio_start_time = qeth_get_micros();
-#endif
+                if (card->options.performance_stats) {
+                        card->perf_stats.inbound_do_qdio_cnt++;
+                        card->perf_stats.inbound_do_qdio_start_time =
+                                qeth_get_micros();
+                }
                 rc = do_QDIO(CARD_DDEV(card),
                              QDIO_FLAG_SYNC_INPUT | QDIO_FLAG_UNDER_INTERRUPT,
                              0, queue->next_buf_to_init, count, NULL);
-#ifdef CONFIG_QETH_PERF_STATS
-                card->perf_stats.inbound_do_qdio_time += qeth_get_micros() -
-                        card->perf_stats.inbound_do_qdio_start_time;
-#endif
+                if (card->options.performance_stats)
+                        card->perf_stats.inbound_do_qdio_time +=
+                                qeth_get_micros() -
+                                card->perf_stats.inbound_do_qdio_start_time;
                 if (rc){
                         PRINT_WARN("qeth_queue_input_buffer's do_QDIO "
                                    "return %i (device %s).\n",
@@ -2746,10 +2744,10 @@ qeth_qdio_input_handler(struct ccw_device * ccwdev, unsigned int status,
         QETH_DBF_TEXT(trace, 6, "qdinput");
         card = (struct qeth_card *) card_ptr;
         net_dev = card->dev;
-#ifdef CONFIG_QETH_PERF_STATS
-        card->perf_stats.inbound_cnt++;
-        card->perf_stats.inbound_start_time = qeth_get_micros();
-#endif
+        if (card->options.performance_stats) {
+                card->perf_stats.inbound_cnt++;
+                card->perf_stats.inbound_start_time = qeth_get_micros();
+        }
         if (status & QDIO_STATUS_LOOK_FOR_ERROR) {
                 if (status & QDIO_STATUS_ACTIVATE_CHECK_CONDITION){
                         QETH_DBF_TEXT(trace, 1,"qdinchk");
@@ -2771,10 +2769,9 @@ qeth_qdio_input_handler(struct ccw_device * ccwdev, unsigned int status,
                 qeth_put_buffer_pool_entry(card, buffer->pool_entry);
                 qeth_queue_input_buffer(card, index);
         }
-#ifdef CONFIG_QETH_PERF_STATS
-        card->perf_stats.inbound_time += qeth_get_micros() -
-                card->perf_stats.inbound_start_time;
-#endif
+        if (card->options.performance_stats)
+                card->perf_stats.inbound_time += qeth_get_micros() -
+                        card->perf_stats.inbound_start_time;
 }
 
 static inline int
@@ -2864,10 +2861,11 @@ qeth_flush_buffers(struct qeth_qdio_out_q *queue, int under_int,
         }
 
         queue->card->dev->trans_start = jiffies;
-#ifdef CONFIG_QETH_PERF_STATS
-        queue->card->perf_stats.outbound_do_qdio_cnt++;
-        queue->card->perf_stats.outbound_do_qdio_start_time = qeth_get_micros();
-#endif
+        if (queue->card->options.performance_stats) {
+                queue->card->perf_stats.outbound_do_qdio_cnt++;
+                queue->card->perf_stats.outbound_do_qdio_start_time =
+                        qeth_get_micros();
+        }
         if (under_int)
                 rc = do_QDIO(CARD_DDEV(queue->card),
                              QDIO_FLAG_SYNC_OUTPUT | QDIO_FLAG_UNDER_INTERRUPT,
@@ -2875,10 +2873,10 @@ qeth_flush_buffers(struct qeth_qdio_out_q *queue, int under_int,
         else
                 rc = do_QDIO(CARD_DDEV(queue->card), QDIO_FLAG_SYNC_OUTPUT,
                              queue->queue_no, index, count, NULL);
-#ifdef CONFIG_QETH_PERF_STATS
-        queue->card->perf_stats.outbound_do_qdio_time += qeth_get_micros() -
-                queue->card->perf_stats.outbound_do_qdio_start_time;
-#endif
+        if (queue->card->options.performance_stats)
+                queue->card->perf_stats.outbound_do_qdio_time +=
+                        qeth_get_micros() -
+                        queue->card->perf_stats.outbound_do_qdio_start_time;
         if (rc){
                 QETH_DBF_TEXT(trace, 2, "flushbuf");
                 QETH_DBF_TEXT_(trace, 2, " err%d", rc);
@@ -2890,9 +2888,8 @@ qeth_flush_buffers(struct qeth_qdio_out_q *queue, int under_int,
                 return;
         }
         atomic_add(count, &queue->used_buffers);
-#ifdef CONFIG_QETH_PERF_STATS
-        queue->card->perf_stats.bufs_sent += count;
-#endif
+        if (queue->card->options.performance_stats)
+                queue->card->perf_stats.bufs_sent += count;
 }
 
 /*
@@ -2907,9 +2904,8 @@ qeth_switch_to_packing_if_needed(struct qeth_qdio_out_q *queue)
                     >= QETH_HIGH_WATERMARK_PACK){
                         /* switch non-PACKING -> PACKING */
                         QETH_DBF_TEXT(trace, 6, "np->pack");
-#ifdef CONFIG_QETH_PERF_STATS
-                        queue->card->perf_stats.sc_dp_p++;
-#endif
+                        if (queue->card->options.performance_stats)
+                                queue->card->perf_stats.sc_dp_p++;
                         queue->do_pack = 1;
                 }
         }
@@ -2932,9 +2928,8 @@ qeth_switch_to_nonpacking_if_needed(struct qeth_qdio_out_q *queue)
                     <= QETH_LOW_WATERMARK_PACK) {
                         /* switch PACKING -> non-PACKING */
                         QETH_DBF_TEXT(trace, 6, "pack->np");
-#ifdef CONFIG_QETH_PERF_STATS
-                        queue->card->perf_stats.sc_p_dp++;
-#endif
+                        if (queue->card->options.performance_stats)
+                                queue->card->perf_stats.sc_p_dp++;
                         queue->do_pack = 0;
                         /* flush packing buffers */
                         buffer = &queue->bufs[queue->next_buf_to_fill];
@@ -2946,7 +2941,7 @@ qeth_switch_to_nonpacking_if_needed(struct qeth_qdio_out_q *queue)
                                 queue->next_buf_to_fill =
                                         (queue->next_buf_to_fill + 1) %
                                         QDIO_MAX_BUFFERS_PER_Q;
-                        }
+                        }
                 }
         }
         return flush_count;
@@ -3002,11 +2997,10 @@ qeth_check_outbound_queue(struct qeth_qdio_out_q *queue)
                             !atomic_read(&queue->set_pci_flags_count))
                                 flush_cnt +=
                                         qeth_flush_buffers_on_no_pci(queue);
-#ifdef CONFIG_QETH_PERF_STATS
-                        if (q_was_packing)
+                        if (queue->card->options.performance_stats &&
+                            q_was_packing)
                                 queue->card->perf_stats.bufs_sent_pack +=
                                         flush_cnt;
-#endif
                         if (flush_cnt)
                                 qeth_flush_buffers(queue, 1, index, flush_cnt);
                         atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
@@ -3036,10 +3030,11 @@ qeth_qdio_output_handler(struct ccw_device * ccwdev, unsigned int status,
                         return;
                 }
         }
-#ifdef CONFIG_QETH_PERF_STATS
-        card->perf_stats.outbound_handler_cnt++;
-        card->perf_stats.outbound_handler_start_time = qeth_get_micros();
-#endif
+        if (card->options.performance_stats) {
+                card->perf_stats.outbound_handler_cnt++;
+                card->perf_stats.outbound_handler_start_time =
+                        qeth_get_micros();
+        }
         for(i = first_element; i < (first_element + count); ++i){
                 buffer = &queue->bufs[i % QDIO_MAX_BUFFERS_PER_Q];
                 /*we only handle the KICK_IT error by doing a recovery */
@@ -3058,10 +3053,9 @@ qeth_qdio_output_handler(struct ccw_device * ccwdev, unsigned int status,
                 qeth_check_outbound_queue(queue);
 
         netif_wake_queue(queue->card->dev);
-#ifdef CONFIG_QETH_PERF_STATS
-        card->perf_stats.outbound_handler_time += qeth_get_micros() -
-                card->perf_stats.outbound_handler_start_time;
-#endif
+        if (card->options.performance_stats)
+                card->perf_stats.outbound_handler_time += qeth_get_micros() -
+                        card->perf_stats.outbound_handler_start_time;
 }
 
 static void
@@ -3185,13 +3179,14 @@ qeth_alloc_qdio_buffers(struct qeth_card *card)
 
         QETH_DBF_TEXT(setup, 2, "allcqdbf");
 
-        if (card->qdio.state == QETH_QDIO_ALLOCATED)
+        if (atomic_cmpxchg(&card->qdio.state, QETH_QDIO_UNINITIALIZED,
+                QETH_QDIO_ALLOCATED) != QETH_QDIO_UNINITIALIZED)
                 return 0;
 
         card->qdio.in_q = kmalloc(sizeof(struct qeth_qdio_q),
                                   GFP_KERNEL|GFP_DMA);
         if (!card->qdio.in_q)
-                return - ENOMEM;
+                goto out_nomem;
         QETH_DBF_TEXT(setup, 2, "inq");
         QETH_DBF_HEX(setup, 2, &card->qdio.in_q, sizeof(void *));
         memset(card->qdio.in_q, 0, sizeof(struct qeth_qdio_q));
@@ -3200,27 +3195,19 @@ qeth_alloc_qdio_buffers(struct qeth_card *card)
                 card->qdio.in_q->bufs[i].buffer =
                         &card->qdio.in_q->qdio_bufs[i];
         /* inbound buffer pool */
-        if (qeth_alloc_buffer_pool(card)){
-                kfree(card->qdio.in_q);
-                return -ENOMEM;
-        }
+        if (qeth_alloc_buffer_pool(card))
+                goto out_freeinq;
         /* outbound */
         card->qdio.out_qs =
                 kmalloc(card->qdio.no_out_queues *
                         sizeof(struct qeth_qdio_out_q *), GFP_KERNEL);
-        if (!card->qdio.out_qs){
-                qeth_free_buffer_pool(card);
-                return -ENOMEM;
-        }
-        for (i = 0; i < card->qdio.no_out_queues; ++i){
+        if (!card->qdio.out_qs)
+                goto out_freepool;
+        for (i = 0; i < card->qdio.no_out_queues; ++i) {
                 card->qdio.out_qs[i] = kmalloc(sizeof(struct qeth_qdio_out_q),
                                                GFP_KERNEL|GFP_DMA);
-                if (!card->qdio.out_qs[i]){
-                        while (i > 0)
-                                kfree(card->qdio.out_qs[--i]);
-                        kfree(card->qdio.out_qs);
-                        return -ENOMEM;
-                }
+                if (!card->qdio.out_qs[i])
+                        goto out_freeoutq;
                 QETH_DBF_TEXT_(setup, 2, "outq %i", i);
                 QETH_DBF_HEX(setup, 2, &card->qdio.out_qs[i], sizeof(void *));
                 memset(card->qdio.out_qs[i], 0, sizeof(struct qeth_qdio_out_q));
@@ -3237,8 +3224,19 @@ qeth_alloc_qdio_buffers(struct qeth_card *card)
                         INIT_LIST_HEAD(&card->qdio.out_qs[i]->bufs[j].ctx_list);
                 }
         }
-        card->qdio.state = QETH_QDIO_ALLOCATED;
         return 0;
+
+out_freeoutq:
+        while (i > 0)
+                kfree(card->qdio.out_qs[--i]);
+        kfree(card->qdio.out_qs);
+out_freepool:
+        qeth_free_buffer_pool(card);
+out_freeinq:
+        kfree(card->qdio.in_q);
+out_nomem:
+        atomic_set(&card->qdio.state, QETH_QDIO_UNINITIALIZED);
+        return -ENOMEM;
 }
 
 static void
@@ -3247,7 +3245,8 @@ qeth_free_qdio_buffers(struct qeth_card *card)
         int i, j;
 
         QETH_DBF_TEXT(trace, 2, "freeqdbf");
-        if (card->qdio.state == QETH_QDIO_UNINITIALIZED)
+        if (atomic_swap(&card->qdio.state, QETH_QDIO_UNINITIALIZED) ==
+                QETH_QDIO_UNINITIALIZED)
                 return;
         kfree(card->qdio.in_q);
         /* inbound buffer pool */
@@ -3260,7 +3259,6 @@ qeth_free_qdio_buffers(struct qeth_card *card)
                 kfree(card->qdio.out_qs[i]);
         }
         kfree(card->qdio.out_qs);
-        card->qdio.state = QETH_QDIO_UNINITIALIZED;
 }
 
 static void
@@ -3282,7 +3280,7 @@ static void
 qeth_init_qdio_info(struct qeth_card *card)
 {
         QETH_DBF_TEXT(setup, 4, "intqdinf");
-        card->qdio.state = QETH_QDIO_UNINITIALIZED;
+        atomic_set(&card->qdio.state, QETH_QDIO_UNINITIALIZED);
         /* inbound */
         card->qdio.in_buf_size = QETH_IN_BUF_SIZE_DEFAULT;
         card->qdio.init_pool.buf_count = QETH_IN_BUF_COUNT_DEFAULT;
@@ -3345,7 +3343,7 @@ qeth_qdio_establish(struct qeth_card *card)
         struct qdio_buffer **in_sbal_ptrs;
         struct qdio_buffer **out_sbal_ptrs;
         int i, j, k;
-        int rc;
+        int rc = 0;
 
         QETH_DBF_TEXT(setup, 2, "qdioest");
 
@@ -3404,8 +3402,10 @@ qeth_qdio_establish(struct qeth_card *card)
         init_data.input_sbal_addr_array  = (void **) in_sbal_ptrs;
         init_data.output_sbal_addr_array = (void **) out_sbal_ptrs;
 
-        if (!(rc = qdio_initialize(&init_data)))
-                card->qdio.state = QETH_QDIO_ESTABLISHED;
+        if (atomic_cmpxchg(&card->qdio.state, QETH_QDIO_ALLOCATED,
+                QETH_QDIO_ESTABLISHED) == QETH_QDIO_ALLOCATED)
+                if ((rc = qdio_initialize(&init_data)))
+                        atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
 
         kfree(out_sbal_ptrs);
         kfree(in_sbal_ptrs);
@@ -3521,13 +3521,20 @@ qeth_qdio_clear_card(struct qeth_card *card, int use_halt)
         int rc = 0;
 
         QETH_DBF_TEXT(trace,3,"qdioclr");
-        if (card->qdio.state == QETH_QDIO_ESTABLISHED){
+        switch (atomic_cmpxchg(&card->qdio.state, QETH_QDIO_ESTABLISHED,
+                QETH_QDIO_CLEANING)) {
+        case QETH_QDIO_ESTABLISHED:
                 if ((rc = qdio_cleanup(CARD_DDEV(card),
-                             (card->info.type == QETH_CARD_TYPE_IQD) ?
-                             QDIO_FLAG_CLEANUP_USING_HALT :
-                             QDIO_FLAG_CLEANUP_USING_CLEAR)))
+                                (card->info.type == QETH_CARD_TYPE_IQD) ?
+                                QDIO_FLAG_CLEANUP_USING_HALT :
+                                QDIO_FLAG_CLEANUP_USING_CLEAR)))
                         QETH_DBF_TEXT_(trace, 3, "1err%d", rc);
-                card->qdio.state = QETH_QDIO_ALLOCATED;
+                atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
+                break;
+        case QETH_QDIO_CLEANING:
+                return rc;
+        default:
+                break;
         }
         if ((rc = qeth_clear_halt_card(card, use_halt)))
                 QETH_DBF_TEXT_(trace, 3, "2err%d", rc);
@@ -3687,10 +3694,10 @@ qeth_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 /* return OK; otherwise ksoftirqd goes to 100% */
                 return NETDEV_TX_OK;
         }
-#ifdef CONFIG_QETH_PERF_STATS
-        card->perf_stats.outbound_cnt++;
-        card->perf_stats.outbound_start_time = qeth_get_micros();
-#endif
+        if (card->options.performance_stats) {
+                card->perf_stats.outbound_cnt++;
+                card->perf_stats.outbound_start_time = qeth_get_micros();
+        }
         netif_stop_queue(dev);
         if ((rc = qeth_send_packet(card, skb))) {
                 if (rc == -EBUSY) {
@@ -3704,10 +3711,9 @@ qeth_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
         }
         netif_wake_queue(dev);
-#ifdef CONFIG_QETH_PERF_STATS
-        card->perf_stats.outbound_time += qeth_get_micros() -
-                card->perf_stats.outbound_start_time;
-#endif
+        if (card->options.performance_stats)
+                card->perf_stats.outbound_time += qeth_get_micros() -
+                        card->perf_stats.outbound_start_time;
         return rc;
 }
 
@@ -3922,49 +3928,59 @@ qeth_get_ip_version(struct sk_buff *skb)
         }
 }
 
-static inline int
-qeth_prepare_skb(struct qeth_card *card, struct sk_buff **skb,
-                 struct qeth_hdr **hdr, int ipv)
+static inline struct qeth_hdr *
+__qeth_prepare_skb(struct qeth_card *card, struct sk_buff *skb, int ipv)
 {
-        int rc = 0;
 #ifdef CONFIG_QETH_VLAN
         u16 *tag;
-#endif
-
-        QETH_DBF_TEXT(trace, 6, "prepskb");
-        if (card->info.type == QETH_CARD_TYPE_OSN) {
-                *hdr = (struct qeth_hdr *)(*skb)->data;
-                return rc;
-        }
-        rc = qeth_realloc_headroom(card, skb, sizeof(struct qeth_hdr));
-        if (rc)
-                return rc;
-#ifdef CONFIG_QETH_VLAN
-        if (card->vlangrp && vlan_tx_tag_present(*skb) &&
+        if (card->vlangrp && vlan_tx_tag_present(skb) &&
             ((ipv == 6) || card->options.layer2) ) {
                 /*
                  * Move the mac addresses (6 bytes src, 6 bytes dest)
                  * to the beginning of the new header.  We are using three
                  * memcpys instead of one memmove to save cycles.
                  */
-                skb_push(*skb, VLAN_HLEN);
-                memcpy((*skb)->data, (*skb)->data + 4, 4);
-                memcpy((*skb)->data + 4, (*skb)->data + 8, 4);
-                memcpy((*skb)->data + 8, (*skb)->data + 12, 4);
-                tag = (u16 *)((*skb)->data + 12);
+                skb_push(skb, VLAN_HLEN);
+                memcpy(skb->data, skb->data + 4, 4);
+                memcpy(skb->data + 4, skb->data + 8, 4);
+                memcpy(skb->data + 8, skb->data + 12, 4);
+                tag = (u16 *)(skb->data + 12);
                 /*
                  * first two bytes  = ETH_P_8021Q (0x8100)
                  * second two bytes = VLANID
                  */
                 *tag = __constant_htons(ETH_P_8021Q);
-                *(tag + 1) = htons(vlan_tx_tag_get(*skb));
+                *(tag + 1) = htons(vlan_tx_tag_get(skb));
         }
 #endif
-        *hdr = (struct qeth_hdr *)
-                qeth_push_skb(card, skb, sizeof(struct qeth_hdr));
-        if (*hdr == NULL)
-                return -EINVAL;
-        return 0;
+        return ((struct qeth_hdr *)
+                qeth_push_skb(card, skb, sizeof(struct qeth_hdr)));
+}
+
+static inline void
+__qeth_free_new_skb(struct sk_buff *orig_skb, struct sk_buff *new_skb)
+{
+        if (orig_skb != new_skb)
+                dev_kfree_skb_any(new_skb);
+}
+
+static inline struct sk_buff *
+qeth_prepare_skb(struct qeth_card *card, struct sk_buff *skb,
+                 struct qeth_hdr **hdr, int ipv)
+{
+        struct sk_buff *new_skb;
+        
+        QETH_DBF_TEXT(trace, 6, "prepskb");
+
+        new_skb = qeth_realloc_headroom(card, skb, sizeof(struct qeth_hdr));
+        if (new_skb == NULL)
+                return NULL;
+        *hdr = __qeth_prepare_skb(card, new_skb, ipv);
+        if (*hdr == NULL) {
+                __qeth_free_new_skb(skb, new_skb);
+                return NULL;
+        }
+        return new_skb;
 }
 
 static inline u8
@@ -4206,9 +4222,8 @@ qeth_fill_buffer(struct qeth_qdio_out_q *queue,
                 flush_cnt = 1;
         } else {
                 QETH_DBF_TEXT(trace, 6, "fillbfpa");
-#ifdef CONFIG_QETH_PERF_STATS
-                queue->card->perf_stats.skbs_sent_pack++;
-#endif
+                if (queue->card->options.performance_stats)
+                        queue->card->perf_stats.skbs_sent_pack++;
                 if (buf->next_element_to_fill >=
                                 QETH_MAX_BUFFER_ELEMENTS(queue->card)) {
                         /*
@@ -4245,21 +4260,15 @@ qeth_do_send_packet_fast(struct qeth_card *card, struct qeth_qdio_out_q *queue,
          * check if buffer is empty to make sure that we do not 'overtake'
          * ourselves and try to fill a buffer that is already primed
          */
-        if (atomic_read(&buffer->state) != QETH_QDIO_BUF_EMPTY) {
-                card->stats.tx_dropped++;
-                atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
-                return -EBUSY;
-        }
+        if (atomic_read(&buffer->state) != QETH_QDIO_BUF_EMPTY) 
+                goto out;
         if (ctx == NULL)
                 queue->next_buf_to_fill = (queue->next_buf_to_fill + 1) %
                                           QDIO_MAX_BUFFERS_PER_Q;
         else {
                 buffers_needed = qeth_eddp_check_buffers_for_context(queue,ctx);
-                if (buffers_needed < 0) {
-                        card->stats.tx_dropped++;
-                        atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
-                        return -EBUSY;
-                }
+                if (buffers_needed < 0) 
+                        goto out;
                 queue->next_buf_to_fill =
                         (queue->next_buf_to_fill + buffers_needed) %
                         QDIO_MAX_BUFFERS_PER_Q;
@@ -4274,6 +4283,9 @@ qeth_do_send_packet_fast(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                 qeth_flush_buffers(queue, 0, index, flush_cnt);
         }
         return 0;
+out:
+        atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
+        return -EBUSY;
 }
 
 static inline int
@@ -4299,8 +4311,7 @@ qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
          * check if buffer is empty to make sure that we do not 'overtake'
          * ourselves and try to fill a buffer that is already primed
          */
-        if (atomic_read(&buffer->state) != QETH_QDIO_BUF_EMPTY){
-                card->stats.tx_dropped++;
+        if (atomic_read(&buffer->state) != QETH_QDIO_BUF_EMPTY) {
                 atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
                 return -EBUSY;
         }
@@ -4323,7 +4334,6 @@ qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                                  * again */
                                 if (atomic_read(&buffer->state) !=
                                                 QETH_QDIO_BUF_EMPTY){
-                                        card->stats.tx_dropped++;
                                         qeth_flush_buffers(queue, 0, start_index, flush_count);
                                         atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
                                         return -EBUSY;
@@ -4334,7 +4344,6 @@ qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                          * free buffers) to handle eddp context */
                         if (qeth_eddp_check_buffers_for_context(queue,ctx) < 0){
                                 printk("eddp tx_dropped 1\n");
-                                card->stats.tx_dropped++;
                                 rc = -EBUSY;
                                 goto out;
                         }
@@ -4346,7 +4355,6 @@ qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                 tmp = qeth_eddp_fill_buffer(queue,ctx,queue->next_buf_to_fill);
                 if (tmp < 0) {
                         printk("eddp tx_dropped 2\n");
-                        card->stats.tx_dropped++;
                         rc = - EBUSY;
                         goto out;
                 }
@@ -4380,10 +4388,8 @@ out:
                         qeth_flush_buffers(queue, 0, start_index, flush_count);
         }
         /* at this point the queue is UNLOCKED again */
-#ifdef CONFIG_QETH_PERF_STATS
-        if (do_pack)
+        if (queue->card->options.performance_stats && do_pack)
                 queue->card->perf_stats.bufs_sent_pack += flush_count;
-#endif /* CONFIG_QETH_PERF_STATS */
 
         return rc;
 }
@@ -4394,21 +4400,21 @@ qeth_get_elements_no(struct qeth_card *card, void *hdr,
 {
         int elements_needed = 0;
 
-        if (skb_shinfo(skb)->nr_frags > 0) {
+        if (skb_shinfo(skb)->nr_frags > 0) 
                 elements_needed = (skb_shinfo(skb)->nr_frags + 1);
-        }
-        if (elements_needed == 0 )
+        if (elements_needed == 0)
                 elements_needed = 1 + (((((unsigned long) hdr) % PAGE_SIZE)
                                         + skb->len) >> PAGE_SHIFT);
         if ((elements_needed + elems) > QETH_MAX_BUFFER_ELEMENTS(card)){
-                PRINT_ERR("qeth_do_send_packet: invalid size of "
-                          "IP packet (Number=%d / Length=%d). Discarded.\n",
+                PRINT_ERR("Invalid size of IP packet "
+                          "(Number=%d / Length=%d). Discarded.\n",
                           (elements_needed+elems), skb->len);
                 return 0;
         }
         return elements_needed;
 }
 
+
 static inline int
 qeth_send_packet(struct qeth_card *card, struct sk_buff *skb)
 {
@@ -4420,112 +4426,112 @@ qeth_send_packet(struct qeth_card *card, struct sk_buff *skb)
         enum qeth_large_send_types large_send = QETH_LARGE_SEND_NO;
         struct qeth_eddp_context *ctx = NULL;
         int tx_bytes = skb->len;
-#ifdef CONFIG_QETH_PERF_STATS
         unsigned short nr_frags = skb_shinfo(skb)->nr_frags;
         unsigned short tso_size = skb_shinfo(skb)->gso_size;
-#endif
+        struct sk_buff *new_skb, *new_skb2;
         int rc;
 
         QETH_DBF_TEXT(trace, 6, "sendpkt");
 
+        new_skb = skb;
+        if ((card->info.type == QETH_CARD_TYPE_OSN) &&
+            (skb->protocol == htons(ETH_P_IPV6)))
+                return -EPERM;
+        cast_type = qeth_get_cast_type(card, skb);
+        if ((cast_type == RTN_BROADCAST) &&
+            (card->info.broadcast_capable == 0))
+                return -EPERM;
+        queue = card->qdio.out_qs
+                [qeth_get_priority_queue(card, skb, ipv, cast_type)];
         if (!card->options.layer2) {
                 ipv = qeth_get_ip_version(skb);
                 if ((card->dev->hard_header == qeth_fake_header) && ipv) {
-                        if ((skb = qeth_pskb_unshare(skb,GFP_ATOMIC)) == NULL) {
-                                card->stats.tx_dropped++;
-                                dev_kfree_skb_irq(skb);
-                                return 0;
-                        }
+                        new_skb = qeth_pskb_unshare(skb, GFP_ATOMIC);
+                        if (!new_skb)
+                                return -ENOMEM;
                         if(card->dev->type == ARPHRD_IEEE802_TR){
-                                skb_pull(skb, QETH_FAKE_LL_LEN_TR);
+                                skb_pull(new_skb, QETH_FAKE_LL_LEN_TR);
                         } else {
-                                skb_pull(skb, QETH_FAKE_LL_LEN_ETH);
+                                skb_pull(new_skb, QETH_FAKE_LL_LEN_ETH);
                         }
                 }
         }
-        if ((card->info.type == QETH_CARD_TYPE_OSN) &&
-                (skb->protocol == htons(ETH_P_IPV6))) {
-                dev_kfree_skb_any(skb);
-                return 0;
-        }
-        cast_type = qeth_get_cast_type(card, skb);
-        if ((cast_type == RTN_BROADCAST) &&
-            (card->info.broadcast_capable == 0)){
-                card->stats.tx_dropped++;
-                card->stats.tx_errors++;
-                dev_kfree_skb_any(skb);
-                return NETDEV_TX_OK;
-        }
-        queue = card->qdio.out_qs
-                [qeth_get_priority_queue(card, skb, ipv, cast_type)];
-
         if (skb_is_gso(skb))
                 large_send = card->options.large_send;
-
-        /*are we able to do TSO ? If so ,prepare and send it from here */
+        /* check on OSN device*/
+        if (card->info.type == QETH_CARD_TYPE_OSN)
+                hdr = (struct qeth_hdr *)new_skb->data;
+        /*are we able to do TSO ? */
         if ((large_send == QETH_LARGE_SEND_TSO) &&
             (cast_type == RTN_UNSPEC)) {
-                rc = qeth_tso_prepare_packet(card, skb, ipv, cast_type);
+                rc = qeth_tso_prepare_packet(card, new_skb, ipv, cast_type);
                 if (rc) {
-                        card->stats.tx_dropped++;
-                        card->stats.tx_errors++;
-                        dev_kfree_skb_any(skb);
-                        return NETDEV_TX_OK;
+                        __qeth_free_new_skb(skb, new_skb);
+                        return rc;
                 }
                 elements_needed++;
-        } else {
-                if ((rc = qeth_prepare_skb(card, &skb, &hdr, ipv))) {
-                        QETH_DBF_TEXT_(trace, 4, "pskbe%d", rc);
-                        return rc;
+        } else if (card->info.type != QETH_CARD_TYPE_OSN) {
+                new_skb2 = qeth_prepare_skb(card, new_skb, &hdr, ipv);
+                if (!new_skb2) {
+                        __qeth_free_new_skb(skb, new_skb);
+                        return -EINVAL;
                 }
-                if (card->info.type != QETH_CARD_TYPE_OSN)
-                        qeth_fill_header(card, hdr, skb, ipv, cast_type);
+                if (new_skb != skb)
+                        __qeth_free_new_skb(new_skb2, new_skb);
+                new_skb = new_skb2;
+                qeth_fill_header(card, hdr, new_skb, ipv, cast_type);
         }
-
         if (large_send == QETH_LARGE_SEND_EDDP) {
-                ctx = qeth_eddp_create_context(card, skb, hdr);
+                ctx = qeth_eddp_create_context(card, new_skb, hdr);
                 if (ctx == NULL) {
+                        __qeth_free_new_skb(skb, new_skb);
                         PRINT_WARN("could not create eddp context\n");
                         return -EINVAL;
                 }
         } else {
-                int elems = qeth_get_elements_no(card,(void*) hdr, skb,
+                int elems = qeth_get_elements_no(card,(void*) hdr, new_skb,
                                                  elements_needed);
-                if (!elems)
+                if (!elems) {
+                        __qeth_free_new_skb(skb, new_skb);
                         return -EINVAL;
+                }
                 elements_needed += elems;
         }
 
         if (card->info.type != QETH_CARD_TYPE_IQD)
-                rc = qeth_do_send_packet(card, queue, skb, hdr,
+                rc = qeth_do_send_packet(card, queue, new_skb, hdr,
                                          elements_needed, ctx);
         else
-                rc = qeth_do_send_packet_fast(card, queue, skb, hdr,
+                rc = qeth_do_send_packet_fast(card, queue, new_skb, hdr,
                                               elements_needed, ctx);
-        if (!rc){
+        if (!rc) {
                 card->stats.tx_packets++;
                 card->stats.tx_bytes += tx_bytes;
-#ifdef CONFIG_QETH_PERF_STATS
-                if (tso_size &&
-                   !(large_send == QETH_LARGE_SEND_NO)) {
-                        card->perf_stats.large_send_bytes += tx_bytes;
-                        card->perf_stats.large_send_cnt++;
-                }
-                if (nr_frags > 0){
-                        card->perf_stats.sg_skbs_sent++;
-                        /* nr_frags + skb->data */
-                        card->perf_stats.sg_frags_sent +=
-                                nr_frags + 1;
+                if (new_skb != skb)
+                        dev_kfree_skb_any(skb);
+                if (card->options.performance_stats) {
+                        if (tso_size &&
+                            !(large_send == QETH_LARGE_SEND_NO)) {
+                                card->perf_stats.large_send_bytes += tx_bytes;
+                                card->perf_stats.large_send_cnt++;
+                        }
+                        if (nr_frags > 0) {
+                                card->perf_stats.sg_skbs_sent++;
+                                /* nr_frags + skb->data */
+                                card->perf_stats.sg_frags_sent +=
+                                        nr_frags + 1;
+                        }
                 }
-#endif /* CONFIG_QETH_PERF_STATS */
+        } else {
+                card->stats.tx_dropped++;
+                __qeth_free_new_skb(skb, new_skb);
         }
         if (ctx != NULL) {
                 /* drop creator's reference */
                 qeth_eddp_put_context(ctx);
                 /* free skb; it's not referenced by a buffer */
-                if (rc == 0)
-                        dev_kfree_skb_any(skb);
-
+                if (!rc)
+                       dev_kfree_skb_any(new_skb);
         }
         return rc;
 }
@@ -7338,6 +7344,8 @@ qeth_setrouting_v6(struct qeth_card *card)
         QETH_DBF_TEXT(trace,3,"setrtg6");
 #ifdef CONFIG_QETH_IPV6
 
+        if (!qeth_is_supported(card, IPA_IPV6))
+                return 0;
         qeth_correct_routing_type(card, &card->options.route6.type,
                                   QETH_PROT_IPV6);
 
@@ -7876,12 +7884,12 @@ __qeth_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                 QETH_DBF_TEXT_(setup, 2, "5err%d", rc);
                 goto out_remove;
         }
-        card->state = CARD_STATE_SOFTSETUP;
 
         if ((rc = qeth_init_qdio_queues(card))){
                 QETH_DBF_TEXT_(setup, 2, "6err%d", rc);
                 goto out_remove;
         }
+        card->state = CARD_STATE_SOFTSETUP;
         netif_carrier_on(card->dev);
 
         qeth_set_allowed_threads(card, 0xffffffff, 0);
@@ -8538,34 +8546,44 @@ qeth_ipv6_uninit(void)
 static void
 qeth_sysfs_unregister(void)
 {
+        s390_root_dev_unregister(qeth_root_dev);
         qeth_remove_driver_attributes();
         ccw_driver_unregister(&qeth_ccw_driver);
         ccwgroup_driver_unregister(&qeth_ccwgroup_driver);
-        s390_root_dev_unregister(qeth_root_dev);
 }
+
 /**
  * register qeth at sysfs
  */
 static int
 qeth_sysfs_register(void)
 {
-        int rc=0;
+        int rc;
 
         rc = ccwgroup_driver_register(&qeth_ccwgroup_driver);
         if (rc)
-                return rc;
+                goto out;
+
         rc = ccw_driver_register(&qeth_ccw_driver);
         if (rc)
-                return rc;
+                goto out_ccw_driver;
+
         rc = qeth_create_driver_attributes();
         if (rc)
-                return rc;
+                goto out_qeth_attr;
+
         qeth_root_dev = s390_root_dev_register("qeth");
-        if (IS_ERR(qeth_root_dev)) {
-                rc = PTR_ERR(qeth_root_dev);
-                return rc;
-        }
-        return 0;
+        rc = IS_ERR(qeth_root_dev) ? PTR_ERR(qeth_root_dev) : 0;
+        if (!rc)
+                goto out;
+
+        qeth_remove_driver_attributes();
+out_qeth_attr:
+        ccw_driver_unregister(&qeth_ccw_driver);
+out_ccw_driver:
+        ccwgroup_driver_unregister(&qeth_ccwgroup_driver);
+out:
+        return rc;
 }
 
 /***
@@ -8574,7 +8592,7 @@ qeth_sysfs_register(void)
 static int __init
 qeth_init(void)
 {
-        int rc=0;
+        int rc;
 
         PRINT_INFO("loading %s\n", version);
 
@@ -8583,20 +8601,26 @@ qeth_init(void)
         spin_lock_init(&qeth_notify_lock);
         rwlock_init(&qeth_card_list.rwlock);
 
-        if (qeth_register_dbf_views())
+        rc = qeth_register_dbf_views();
+        if (rc)
                 goto out_err;
-        if (qeth_sysfs_register())
-                goto out_sysfs;
+
+        rc = qeth_sysfs_register();
+        if (rc)
+                goto out_dbf;
 
 #ifdef CONFIG_QETH_IPV6
-        if (qeth_ipv6_init()) {
-                PRINT_ERR("Out of memory during ipv6 init.\n");
+        rc = qeth_ipv6_init();
+        if (rc) {
+                PRINT_ERR("Out of memory during ipv6 init code = %d\n", rc);
                 goto out_sysfs;
         }
 #endif /* QETH_IPV6 */
-        if (qeth_register_notifiers())
+        rc = qeth_register_notifiers();
+        if (rc)
                 goto out_ipv6;
-        if (qeth_create_procfs_entries())
+        rc = qeth_create_procfs_entries();
+        if (rc)
                 goto out_notifiers;
 
         return rc;
@@ -8606,12 +8630,13 @@ out_notifiers:
 out_ipv6:
 #ifdef CONFIG_QETH_IPV6
         qeth_ipv6_uninit();
-#endif /* QETH_IPV6 */
 out_sysfs:
+#endif /* QETH_IPV6 */
         qeth_sysfs_unregister();
+out_dbf:
         qeth_unregister_dbf_views();
 out_err:
-        PRINT_ERR("Initialization failed");
+        PRINT_ERR("Initialization failed with code %d\n", rc);
         return rc;
 }
 
diff --git a/drivers/s390/net/qeth_proc.c b/drivers/s390/net/qeth_proc.c
index 66f2da14e6e3..faa768e59257 100644
--- a/drivers/s390/net/qeth_proc.c
+++ b/drivers/s390/net/qeth_proc.c
@@ -173,7 +173,6 @@ static struct file_operations qeth_procfile_fops = {
 #define QETH_PERF_PROCFILE_NAME "qeth_perf"
 static struct proc_dir_entry *qeth_perf_procfile;
 
-#ifdef CONFIG_QETH_PERF_STATS
 static int
 qeth_perf_procfile_seq_show(struct seq_file *s, void *it)
 {
@@ -192,14 +191,21 @@ qeth_perf_procfile_seq_show(struct seq_file *s, void *it)
                         CARD_DDEV_ID(card),
                         QETH_CARD_IFNAME(card)
                   );
+        if (!card->options.performance_stats)
+                seq_printf(s, "Performance statistics are deactivated.\n");
         seq_printf(s, "  Skb's/buffers received                 : %lu/%u\n"
                       "  Skb's/buffers sent                     : %lu/%u\n\n",
-                        card->stats.rx_packets, card->perf_stats.bufs_rec,
-                        card->stats.tx_packets, card->perf_stats.bufs_sent
+                        card->stats.rx_packets -
+                                card->perf_stats.initial_rx_packets,
+                        card->perf_stats.bufs_rec,
+                        card->stats.tx_packets -
+                                card->perf_stats.initial_tx_packets,
+                        card->perf_stats.bufs_sent
                   );
         seq_printf(s, "  Skb's/buffers sent without packing     : %lu/%u\n"
                       "  Skb's/buffers sent with packing        : %u/%u\n\n",
-                   card->stats.tx_packets - card->perf_stats.skbs_sent_pack,
+                   card->stats.tx_packets - card->perf_stats.initial_tx_packets
+                                          - card->perf_stats.skbs_sent_pack,
                    card->perf_stats.bufs_sent - card->perf_stats.bufs_sent_pack,
                    card->perf_stats.skbs_sent_pack,
                    card->perf_stats.bufs_sent_pack
@@ -275,11 +281,6 @@ static struct file_operations qeth_perf_procfile_fops = {
         .release = seq_release,
 };
 
-#define qeth_perf_procfile_created qeth_perf_procfile
-#else
-#define qeth_perf_procfile_created 1
-#endif /* CONFIG_QETH_PERF_STATS */
-
 int __init
 qeth_create_procfs_entries(void)
 {
@@ -288,15 +289,13 @@ qeth_create_procfs_entries(void)
         if (qeth_procfile)
                 qeth_procfile->proc_fops = &qeth_procfile_fops;
 
-#ifdef CONFIG_QETH_PERF_STATS
         qeth_perf_procfile = create_proc_entry(QETH_PERF_PROCFILE_NAME,
                                            S_IFREG | 0444, NULL);
         if (qeth_perf_procfile)
                 qeth_perf_procfile->proc_fops = &qeth_perf_procfile_fops;
-#endif /* CONFIG_QETH_PERF_STATS */
 
         if (qeth_procfile &&
-            qeth_perf_procfile_created)
+            qeth_perf_procfile)
                 return 0;
         else
                 return -ENOMEM;
diff --git a/drivers/s390/net/qeth_sys.c b/drivers/s390/net/qeth_sys.c
index 001497bbea16..5836737ac58f 100644
--- a/drivers/s390/net/qeth_sys.c
+++ b/drivers/s390/net/qeth_sys.c
@@ -743,6 +743,47 @@ static DEVICE_ATTR(layer2, 0644, qeth_dev_layer2_show,
                    qeth_dev_layer2_store);
 
 static ssize_t
+qeth_dev_performance_stats_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct qeth_card *card = dev->driver_data;
+
+        if (!card)
+                return -EINVAL;
+
+        return sprintf(buf, "%i\n", card->options.performance_stats ? 1:0);
+}
+
+static ssize_t
+qeth_dev_performance_stats_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct qeth_card *card = dev->driver_data;
+        char *tmp;
+        int i;
+
+        if (!card)
+                return -EINVAL;
+
+        i = simple_strtoul(buf, &tmp, 16);
+        if ((i == 0) || (i == 1)) {
+                if (i == card->options.performance_stats)
+                        return count;
+                card->options.performance_stats = i;
+                if (i == 0)
+                        memset(&card->perf_stats, 0,
+                                sizeof(struct qeth_perf_stats));
+                card->perf_stats.initial_rx_packets = card->stats.rx_packets;
+                card->perf_stats.initial_tx_packets = card->stats.tx_packets;
+        } else {
+                PRINT_WARN("performance_stats: write 0 or 1 to this file!\n");
+                return -EINVAL;
+        }
+        return count;
+}
+
+static DEVICE_ATTR(performance_stats, 0644, qeth_dev_performance_stats_show,
+                   qeth_dev_performance_stats_store);
+
+static ssize_t
 qeth_dev_large_send_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct qeth_card *card = dev->driver_data;
@@ -928,6 +969,7 @@ static struct device_attribute * qeth_device_attrs[] = {
         &dev_attr_canonical_macaddr,
         &dev_attr_layer2,
         &dev_attr_large_send,
+        &dev_attr_performance_stats,
         NULL,
 };
 
@@ -1110,12 +1152,12 @@ qeth_parse_ipatoe(const char* buf, enum qeth_prot_versions proto,
 {
         const char *start, *end;
         char *tmp;
-        char buffer[49] = {0, };
+        char buffer[40] = {0, };
 
         start = buf;
         /* get address string */
         end = strchr(start, '/');
-        if (!end || (end-start >= 49)){
+        if (!end || (end - start >= 40)){
                 PRINT_WARN("Invalid format for ipato_addx/delx. "
                            "Use <ip addr>/<mask bits>\n");
                 return -EINVAL;
@@ -1127,7 +1169,12 @@ qeth_parse_ipatoe(const char* buf, enum qeth_prot_versions proto,
         }
         start = end + 1;
         *mask_bits = simple_strtoul(start, &tmp, 10);
-
+        if (!strlen(start) ||
+            (tmp == start) ||
+            (*mask_bits > ((proto == QETH_PROT_IPV4) ? 32 : 128))) {
+                PRINT_WARN("Invalid mask bits for ipato_addx/delx !\n");
+                return -EINVAL;
+        }
         return 0;
 }
 
@@ -1698,11 +1745,16 @@ qeth_create_device_attributes(struct device *dev)
                 sysfs_remove_group(&dev->kobj, &qeth_device_attr_group);
                 sysfs_remove_group(&dev->kobj, &qeth_device_ipato_group);
                 sysfs_remove_group(&dev->kobj, &qeth_device_vipa_group);
+                return ret;
         }
-        if ((ret = sysfs_create_group(&dev->kobj, &qeth_device_blkt_group)))
+        if ((ret = sysfs_create_group(&dev->kobj, &qeth_device_blkt_group))){
+                sysfs_remove_group(&dev->kobj, &qeth_device_attr_group);
+                sysfs_remove_group(&dev->kobj, &qeth_device_ipato_group);
+                sysfs_remove_group(&dev->kobj, &qeth_device_vipa_group);
+                sysfs_remove_group(&dev->kobj, &qeth_device_rxip_group);
                 return ret;
-
-        return ret;
+        }
+        return 0;
 }
 
 void
diff --git a/drivers/s390/net/qeth_tso.h b/drivers/s390/net/qeth_tso.h
index 593f298142c1..14504afb044e 100644
--- a/drivers/s390/net/qeth_tso.h
+++ b/drivers/s390/net/qeth_tso.h
@@ -24,7 +24,7 @@ static inline struct qeth_hdr_tso *
 qeth_tso_prepare_skb(struct qeth_card *card, struct sk_buff **skb)
 {
         QETH_DBF_TEXT(trace, 5, "tsoprsk");
-        return qeth_push_skb(card, skb, sizeof(struct qeth_hdr_tso));
+        return qeth_push_skb(card, *skb, sizeof(struct qeth_hdr_tso));
 }
 
 /**
diff --git a/drivers/sbus/char/openprom.c b/drivers/sbus/char/openprom.c
index 293bb2fdb1d5..2f698763ba5d 100644
--- a/drivers/sbus/char/openprom.c
+++ b/drivers/sbus/char/openprom.c
@@ -145,8 +145,9 @@ static int opromgetprop(void __user *argp, struct device_node *dp, struct openpr
         void *pval;
         int len;
 
-        pval = of_get_property(dp, op->oprom_array, &len);
-        if (!pval || len <= 0 || len > bufsize)
+        if (!dp ||
+            !(pval = of_get_property(dp, op->oprom_array, &len)) ||
+            len <= 0 || len > bufsize)
                 return copyout(argp, op, sizeof(int));
 
         memcpy(op->oprom_array, pval, len);
@@ -161,6 +162,8 @@ static int opromnxtprop(void __user *argp, struct device_node *dp, struct openpr
         struct property *prop;
         int len;
 
+        if (!dp)
+                return copyout(argp, op, sizeof(int));
         if (op->oprom_array[0] == '\0') {
                 prop = dp->properties;
                 if (!prop)
@@ -266,9 +269,13 @@ static int oprompci2node(void __user *argp, struct device_node *dp, struct openp
 
 static int oprompath2node(void __user *argp, struct device_node *dp, struct openpromio *op, int bufsize, DATA *data)
 {
+        phandle ph = 0;
+
         dp = of_find_node_by_path(op->oprom_array);
+        if (dp)
+                ph = dp->node;
         data->current_node = dp;
-        *((int *)op->oprom_array) = dp->node;
+        *((int *)op->oprom_array) = ph;
         op->oprom_size = sizeof(int);
 
         return copyout(argp, op, bufsize + sizeof(int));
diff --git a/drivers/serial/s3c2410.c b/drivers/serial/s3c2410.c
index 392bffcf96e8..95738a19cde7 100644
--- a/drivers/serial/s3c2410.c
+++ b/drivers/serial/s3c2410.c
@@ -1621,7 +1621,7 @@ static struct s3c24xx_uart_info s3c2412_uart_inf = {
 static int s3c2412_serial_probe(struct platform_device *dev)
 {
         dbg("s3c2440_serial_probe: dev=%p\n", dev);
-        return s3c24xx_serial_probe(dev, &s3c2440_uart_inf);
+        return s3c24xx_serial_probe(dev, &s3c2412_uart_inf);
 }
 
 static struct platform_driver s3c2412_serial_drv = {