116 files changed, 1855 insertions, 1488 deletions
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 1c4df22dfd2a..7b0eca703a67 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1233,6 +1233,50 @@ static inline void complete_buffers(struct bio *bio, int status)
        }
 }
+static void cciss_check_queues(ctlr_info_t *h)
+{
+        int start_queue = h->next_to_run;
+        int i;
+        /* check to see if we have maxed out the number of commands that can
+         * be placed on the queue.  If so then exit.  We do this check here
+         * in case the interrupt we serviced was from an ioctl and did not
+         * free any new commands.
+         */
+        if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS)
+                return;
+        /* We have room on the queue for more commands.  Now we need to queue
+         * them up.  We will also keep track of the next queue to run so
+         * that every queue gets a chance to be started first.
+         */
+        for (i = 0; i < h->highest_lun + 1; i++) {
+                int curr_queue = (start_queue + i) % (h->highest_lun + 1);
+                /* make sure the disk has been added and the drive is real
+                 * because this can be called from the middle of init_one.
+                 */
+                if (!(h->drv[curr_queue].queue) || !(h->drv[curr_queue].heads))
+                        continue;
+                blk_start_queue(h->gendisk[curr_queue]->queue);
+                /* check to see if we have maxed out the number of commands
+                 * that can be placed on the queue.
+                 */
+                if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS) {
+                        if (curr_queue == start_queue) {
+                                h->next_to_run =
+                                    (start_queue + 1) % (h->highest_lun + 1);
+                                break;
+                        } else {
+                                h->next_to_run = curr_queue;
+                                break;
+                        }
+                } else {
+                        curr_queue = (curr_queue + 1) % (h->highest_lun + 1);
+                }
+        }
+}
 static void cciss_softirq_done(struct request *rq)
 {
        CommandList_struct *cmd = rq->completion_data;
@@ -1264,6 +1308,7 @@ static void cciss_softirq_done(struct request *rq)
        spin_lock_irqsave(&h->lock, flags);
        end_that_request_last(rq, rq->errors);
        cmd_free(h, cmd, 1);
+        cciss_check_queues(h);
        spin_unlock_irqrestore(&h->lock, flags);
 }
@@ -2528,8 +2573,6 @@ static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
        CommandList_struct *c;
        unsigned long flags;
        __u32 a, a1, a2;
-        int j;
-        int start_queue = h->next_to_run;
        if (interrupt_not_for_us(h))
                return IRQ_NONE;
@@ -2588,45 +2631,6 @@ static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
                }
        }
-        /* check to see if we have maxed out the number of commands that can
-         * be placed on the queue.  If so then exit.  We do this check here
-         * in case the interrupt we serviced was from an ioctl and did not
-         * free any new commands.
-         */
-        if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS)
-                goto cleanup;
-        /* We have room on the queue for more commands.  Now we need to queue
-         * them up.  We will also keep track of the next queue to run so
-         * that every queue gets a chance to be started first.
-         */
-        for (j = 0; j < h->highest_lun + 1; j++) {
-                int curr_queue = (start_queue + j) % (h->highest_lun + 1);
-                /* make sure the disk has been added and the drive is real
-                 * because this can be called from the middle of init_one.
-                 */
-                if (!(h->drv[curr_queue].queue) || !(h->drv[curr_queue].heads))
-                        continue;
-                blk_start_queue(h->gendisk[curr_queue]->queue);
-                /* check to see if we have maxed out the number of commands
-                 * that can be placed on the queue.
-                 */
-                if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS) {
-                        if (curr_queue == start_queue) {
-                                h->next_to_run =
-                                    (start_queue + 1) % (h->highest_lun + 1);
-                                goto cleanup;
-                        } else {
-                                h->next_to_run = curr_queue;
-                                goto cleanup;
-                        }
-                } else {
-                        curr_queue = (curr_queue + 1) % (h->highest_lun + 1);
-                }
-        }
-      cleanup:
        spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
        return IRQ_HANDLED;
 }
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index 6a0c2230f82f..e2d4beac7420 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -67,6 +67,8 @@ static int ignore = 0;
 static int ignore_dga = 0;
 static int ignore_csr = 0;
 static int ignore_sniffer = 0;
+static int disable_scofix = 0;
+static int force_scofix = 0;
 static int reset = 0;
 #ifdef CONFIG_BT_HCIUSB_SCO
@@ -107,9 +109,12 @@ static struct usb_device_id blacklist_ids[] = {
        { USB_DEVICE(0x0a5c, 0x2033), .driver_info = HCI_IGNORE },
        /* Broadcom BCM2035 */
-        { USB_DEVICE(0x0a5c, 0x200a), .driver_info = HCI_RESET | HCI_BROKEN_ISOC },
+        { USB_DEVICE(0x0a5c, 0x200a), .driver_info = HCI_RESET | HCI_WRONG_SCO_MTU },
        { USB_DEVICE(0x0a5c, 0x2009), .driver_info = HCI_BCM92035 },
+        /* IBM/Lenovo ThinkPad with Broadcom chip */
+        { USB_DEVICE(0x0a5c, 0x201e), .driver_info = HCI_WRONG_SCO_MTU },
        /* Microsoft Wireless Transceiver for Bluetooth 2.0 */
        { USB_DEVICE(0x045e, 0x009c), .driver_info = HCI_RESET },
@@ -119,11 +124,13 @@ static struct usb_device_id blacklist_ids[] = {
        /* ISSC Bluetooth Adapter v3.1 */
        { USB_DEVICE(0x1131, 0x1001), .driver_info = HCI_RESET },
-        /* RTX Telecom based adapter with buggy SCO support */
+        /* RTX Telecom based adapters with buggy SCO support */
        { USB_DEVICE(0x0400, 0x0807), .driver_info = HCI_BROKEN_ISOC },
+        { USB_DEVICE(0x0400, 0x080a), .driver_info = HCI_BROKEN_ISOC },
-        /* Belkin F8T012 */
+        /* Belkin F8T012 and F8T013 devices */
        { USB_DEVICE(0x050d, 0x0012), .driver_info = HCI_WRONG_SCO_MTU },
+        { USB_DEVICE(0x050d, 0x0013), .driver_info = HCI_WRONG_SCO_MTU },
        /* Digianswer devices */
        { USB_DEVICE(0x08fd, 0x0001), .driver_info = HCI_DIGIANSWER },
@@ -990,8 +997,10 @@ static int hci_usb_probe(struct usb_interface *intf, const struct usb_device_id
        if (reset || id->driver_info & HCI_RESET)
                set_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks);
-        if (id->driver_info & HCI_WRONG_SCO_MTU)
+        if (force_scofix || id->driver_info & HCI_WRONG_SCO_MTU) {
-                set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
+                if (!disable_scofix)
+                        set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
+        }
        if (id->driver_info & HCI_SNIFFER) {
                if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
@@ -1161,6 +1170,12 @@ MODULE_PARM_DESC(ignore_csr, "Ignore devices with id 0a12:0001");
 module_param(ignore_sniffer, bool, 0644);
 MODULE_PARM_DESC(ignore_sniffer, "Ignore devices with id 0a12:0002");
+module_param(disable_scofix, bool, 0644);
+MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
+module_param(force_scofix, bool, 0644);
+MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
 module_param(reset, bool, 0644);
 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index 17bc8abd5df5..00f574cbb0d4 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -1174,8 +1174,12 @@ static void dcd_change(MGSLPC_INFO *info)
        else
                info->input_signal_events.dcd_down++;
 #ifdef CONFIG_HDLC
-        if (info->netcount)
+        if (info->netcount) {
-                hdlc_set_carrier(info->serial_signals & SerialSignal_DCD, info->netdev);
+                if (info->serial_signals & SerialSignal_DCD)
+                        netif_carrier_on(info->netdev);
+                else
+                        netif_carrier_off(info->netdev);
+        }
 #endif
        wake_up_interruptible(&info->status_event_wait_q);
        wake_up_interruptible(&info->event_wait_q);
@@ -4251,8 +4255,10 @@ static int hdlcdev_open(struct net_device *dev)
        spin_lock_irqsave(&info->lock, flags);
        get_signals(info);
        spin_unlock_irqrestore(&info->lock, flags);
-        hdlc_set_carrier(info->serial_signals & SerialSignal_DCD, dev);
+        if (info->serial_signals & SerialSignal_DCD)
+                netif_carrier_on(dev);
+        else
+                netif_carrier_off(dev);
        return 0;
 }
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index df782dd1098c..78b1b1a2732b 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -1344,8 +1344,12 @@ static void mgsl_isr_io_pin( struct mgsl_struct *info )
                        } else
                                info->input_signal_events.dcd_down++;
 #ifdef CONFIG_HDLC
-                        if (info->netcount)
+                        if (info->netcount) {
-                                hdlc_set_carrier(status & MISCSTATUS_DCD, info->netdev);
+                                if (status & MISCSTATUS_DCD)
+                                        netif_carrier_on(info->netdev);
+                                else
+                                        netif_carrier_off(info->netdev);
+                        }
 #endif
                }
                if (status & MISCSTATUS_CTS_LATCHED)
@@ -7844,8 +7848,10 @@ static int hdlcdev_open(struct net_device *dev)
        spin_lock_irqsave(&info->irq_spinlock, flags);
        usc_get_serial_signals(info);
        spin_unlock_irqrestore(&info->irq_spinlock, flags);
-        hdlc_set_carrier(info->serial_signals & SerialSignal_DCD, dev);
+        if (info->serial_signals & SerialSignal_DCD)
+                netif_carrier_on(dev);
+        else
+                netif_carrier_off(dev);
        return 0;
 }
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index e829594195c1..b2dbbdb1bf81 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -1497,8 +1497,10 @@ static int hdlcdev_open(struct net_device *dev)
        spin_lock_irqsave(&info->lock, flags);
        get_signals(info);
        spin_unlock_irqrestore(&info->lock, flags);
-        hdlc_set_carrier(info->signals & SerialSignal_DCD, dev);
+        if (info->signals & SerialSignal_DCD)
+                netif_carrier_on(dev);
+        else
+                netif_carrier_off(dev);
        return 0;
 }
@@ -1997,8 +1999,12 @@ static void dcd_change(struct slgt_info *info)
                info->input_signal_events.dcd_down++;
        }
 #ifdef CONFIG_HDLC
-        if (info->netcount)
+        if (info->netcount) {
-                hdlc_set_carrier(info->signals & SerialSignal_DCD, info->netdev);
+                if (info->signals & SerialSignal_DCD)
+                        netif_carrier_on(info->netdev);
+                else
+                        netif_carrier_off(info->netdev);
+        }
 #endif
        wake_up_interruptible(&info->status_event_wait_q);
        wake_up_interruptible(&info->event_wait_q);
diff --git a/drivers/char/synclinkmp.c b/drivers/char/synclinkmp.c
index 1e443a233f51..66f3754fbbdf 100644
--- a/drivers/char/synclinkmp.c
+++ b/drivers/char/synclinkmp.c
@@ -1752,8 +1752,10 @@ static int hdlcdev_open(struct net_device *dev)
        spin_lock_irqsave(&info->lock, flags);
        get_signals(info);
        spin_unlock_irqrestore(&info->lock, flags);
-        hdlc_set_carrier(info->serial_signals & SerialSignal_DCD, dev);
+        if (info->serial_signals & SerialSignal_DCD)
+                netif_carrier_on(dev);
+        else
+                netif_carrier_off(dev);
        return 0;
 }
@@ -2522,8 +2524,12 @@ void isr_io_pin( SLMP_INFO *info, u16 status )
                        } else
                                info->input_signal_events.dcd_down++;
 #ifdef CONFIG_HDLC
-                        if (info->netcount)
+                        if (info->netcount) {
-                                hdlc_set_carrier(status & SerialSignal_DCD, info->netdev);
+                                if (status & SerialSignal_DCD)
+                                        netif_carrier_on(info->netdev);
+                                else
+                                        netif_carrier_off(info->netdev);
+                        }
 #endif
                }
                if (status & MISCSTATUS_CTS_LATCHED)
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 8d328186f774..bc1088d9b379 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -364,10 +364,12 @@ static ssize_t store_##file_name					\
        if (ret != 1)                                                   \
                return -EINVAL;                                         \
                                                                        \
+        lock_cpu_hotplug();                                             \
        mutex_lock(&policy->lock);                                      \
        ret = __cpufreq_set_policy(policy, &new_policy);                \
        policy->user_policy.object = policy->object;                    \
        mutex_unlock(&policy->lock);                                    \
+        unlock_cpu_hotplug();                                           \
                                                                        \
        return ret ? ret : count;                                       \
 }
@@ -1197,20 +1199,18 @@ EXPORT_SYMBOL(cpufreq_unregister_notifier);
 *********************************************************************/
+/* Must be called with lock_cpu_hotplug held */
 int __cpufreq_driver_target(struct cpufreq_policy *policy,
                            unsigned int target_freq,
                            unsigned int relation)
 {
        int retval = -EINVAL;
-        lock_cpu_hotplug();
        dprintk("target for CPU %u: %u kHz, relation %u\n", policy->cpu,
                target_freq, relation);
        if (cpu_online(policy->cpu) && cpufreq_driver->target)
                retval = cpufreq_driver->target(policy, target_freq, relation);
-        unlock_cpu_hotplug();
        return retval;
 }
 EXPORT_SYMBOL_GPL(__cpufreq_driver_target);
@@ -1225,17 +1225,23 @@ int cpufreq_driver_target(struct cpufreq_policy *policy,
        if (!policy)
                return -EINVAL;
+        lock_cpu_hotplug();
        mutex_lock(&policy->lock);
        ret = __cpufreq_driver_target(policy, target_freq, relation);
        mutex_unlock(&policy->lock);
+        unlock_cpu_hotplug();
        cpufreq_cpu_put(policy);
        return ret;
 }
 EXPORT_SYMBOL_GPL(cpufreq_driver_target);
+/*
+ * Locking: Must be called with the lock_cpu_hotplug() lock held
+ * when "event" is CPUFREQ_GOV_LIMITS
+ */
 static int __cpufreq_governor(struct cpufreq_policy *policy, unsigned int event)
 {
@@ -1257,24 +1263,6 @@ static int __cpufreq_governor(struct cpufreq_policy *policy, unsigned int event)
 }
-int cpufreq_governor(unsigned int cpu, unsigned int event)
-{
-        int ret = 0;
-        struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
-        if (!policy)
-                return -EINVAL;
-        mutex_lock(&policy->lock);
-        ret = __cpufreq_governor(policy, event);
-        mutex_unlock(&policy->lock);
-        cpufreq_cpu_put(policy);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(cpufreq_governor);
 int cpufreq_register_governor(struct cpufreq_governor *governor)
 {
        struct cpufreq_governor *t;
@@ -1342,6 +1330,9 @@ int cpufreq_get_policy(struct cpufreq_policy *policy, unsigned int cpu)
 EXPORT_SYMBOL(cpufreq_get_policy);
+/*
+ * Locking: Must be called with the lock_cpu_hotplug() lock held
+ */
 static int __cpufreq_set_policy(struct cpufreq_policy *data, struct cpufreq_policy *policy)
 {
        int ret = 0;
@@ -1436,6 +1427,8 @@ int cpufreq_set_policy(struct cpufreq_policy *policy)
        if (!data)
                return -EINVAL;
+        lock_cpu_hotplug();
        /* lock this CPU */
        mutex_lock(&data->lock);
@@ -1446,6 +1439,8 @@ int cpufreq_set_policy(struct cpufreq_policy *policy)
        data->user_policy.governor = data->governor;
        mutex_unlock(&data->lock);
+        unlock_cpu_hotplug();
        cpufreq_cpu_put(data);
        return ret;
@@ -1469,6 +1464,7 @@ int cpufreq_update_policy(unsigned int cpu)
        if (!data)
                return -ENODEV;
+        lock_cpu_hotplug();
        mutex_lock(&data->lock);
        dprintk("updating policy for CPU %u\n", cpu);
@@ -1494,7 +1490,7 @@ int cpufreq_update_policy(unsigned int cpu)
        ret = __cpufreq_set_policy(data, &policy);
        mutex_unlock(&data->lock);
+        unlock_cpu_hotplug();
        cpufreq_cpu_put(data);
        return ret;
 }
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index b3ebc8f01975..c4c578defabf 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -525,7 +525,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                break;
        case CPUFREQ_GOV_LIMITS:
-                lock_cpu_hotplug();
                mutex_lock(&dbs_mutex);
                if (policy->max < this_dbs_info->cur_policy->cur)
                        __cpufreq_driver_target(
@@ -536,7 +535,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                                        this_dbs_info->cur_policy,
                                        policy->min, CPUFREQ_RELATION_L);
                mutex_unlock(&dbs_mutex);
-                unlock_cpu_hotplug();
                break;
        }
        return 0;
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 87299924e735..52cf1f021825 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -239,6 +239,8 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
        total_ticks = (unsigned int) cputime64_sub(cur_jiffies,
                        this_dbs_info->prev_cpu_wall);
        this_dbs_info->prev_cpu_wall = cur_jiffies;
+        if (!total_ticks)
+                return;
        /*
         * Every sampling_rate, we check, if current idle time is less
         * than 20% (default), then we try to increase frequency
@@ -304,7 +306,12 @@ static void do_dbs_timer(void *data)
        unsigned int cpu = smp_processor_id();
        struct cpu_dbs_info_s *dbs_info = &per_cpu(cpu_dbs_info, cpu);
+        if (!dbs_info->enable)
+                return;
+        lock_cpu_hotplug();
        dbs_check_cpu(dbs_info);
+        unlock_cpu_hotplug();
        queue_delayed_work_on(cpu, kondemand_wq, &dbs_info->work,
                        usecs_to_jiffies(dbs_tuners_ins.sampling_rate));
 }
@@ -319,11 +326,11 @@ static inline void dbs_timer_init(unsigned int cpu)
        return;
 }
-static inline void dbs_timer_exit(unsigned int cpu)
+static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
 {
-        struct cpu_dbs_info_s *dbs_info = &per_cpu(cpu_dbs_info, cpu);
+        dbs_info->enable = 0;
+        cancel_delayed_work(&dbs_info->work);
-        cancel_rearming_delayed_workqueue(kondemand_wq, &dbs_info->work);
+        flush_workqueue(kondemand_wq);
 }
 static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
@@ -396,8 +403,7 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
        case CPUFREQ_GOV_STOP:
                mutex_lock(&dbs_mutex);
-                dbs_timer_exit(policy->cpu);
+                dbs_timer_exit(this_dbs_info);
-                this_dbs_info->enable = 0;
                sysfs_remove_group(&policy->kobj, &dbs_attr_group);
                dbs_enable--;
                if (dbs_enable == 0)
@@ -408,7 +414,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                break;
        case CPUFREQ_GOV_LIMITS:
-                lock_cpu_hotplug();
                mutex_lock(&dbs_mutex);
                if (policy->max < this_dbs_info->cur_policy->cur)
                        __cpufreq_driver_target(this_dbs_info->cur_policy,
@@ -419,7 +424,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                                                policy->min,
                                                CPUFREQ_RELATION_L);
                mutex_unlock(&dbs_mutex);
-                unlock_cpu_hotplug();
                break;
        }
        return 0;
diff --git a/drivers/cpufreq/cpufreq_userspace.c b/drivers/cpufreq/cpufreq_userspace.c
index 44ae5e5b94cf..a06c204589cd 100644
--- a/drivers/cpufreq/cpufreq_userspace.c
+++ b/drivers/cpufreq/cpufreq_userspace.c
@@ -18,6 +18,7 @@
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
 #include <linux/cpufreq.h>
+#include <linux/cpu.h>
 #include <linux/types.h>
 #include <linux/fs.h>
 #include <linux/sysfs.h>
@@ -70,6 +71,7 @@ static int cpufreq_set(unsigned int freq, struct cpufreq_policy *policy)
        dprintk("cpufreq_set for cpu %u, freq %u kHz\n", policy->cpu, freq);
+        lock_cpu_hotplug();
        mutex_lock(&userspace_mutex);
        if (!cpu_is_managed[policy->cpu])
                goto err;
@@ -92,6 +94,7 @@ static int cpufreq_set(unsigned int freq, struct cpufreq_policy *policy)
 err:
        mutex_unlock(&userspace_mutex);
+        unlock_cpu_hotplug();
        return ret;
 }
diff --git a/drivers/dma/ioatdma.c b/drivers/dma/ioatdma.c
index 78bf46d917b7..dbd4d6c3698e 100644
--- a/drivers/dma/ioatdma.c
+++ b/drivers/dma/ioatdma.c
@@ -828,7 +828,7 @@ static int __init ioat_init_module(void)
        /* if forced, worst case is that rmmod hangs */
        __unsafe(THIS_MODULE);
-        return pci_module_init(&ioat_pci_drv);
+        return pci_register_driver(&ioat_pci_drv);
 }
 module_init(ioat_init_module);
diff --git a/drivers/fc4/fc.c b/drivers/fc4/fc.c
index 66d03f242d3c..1a159e8843ca 100644
--- a/drivers/fc4/fc.c
+++ b/drivers/fc4/fc.c
@@ -429,7 +429,7 @@ static inline void fcp_scsi_receive(fc_channel *fc, int token, int status, fc_hd
                
                if (fcmd->data) {
                        if (SCpnt->use_sg)
-                                dma_unmap_sg(fc->dev, (struct scatterlist *)SCpnt->buffer,
+                                dma_unmap_sg(fc->dev, (struct scatterlist *)SCpnt->request_buffer,
                                                SCpnt->use_sg,
                                                SCpnt->sc_data_direction);
                        else
@@ -810,7 +810,7 @@ static int fcp_scsi_queue_it(fc_channel *fc, Scsi_Cmnd *SCpnt, fcp_cmnd *fcmd, i
                                                             SCpnt->request_bufflen,
                                                             SCpnt->sc_data_direction);
                        } else {
-                                struct scatterlist *sg = (struct scatterlist *)SCpnt->buffer;
+                                struct scatterlist *sg = (struct scatterlist *)SCpnt->request_buffer;
                                int nents;
                                FCD(("XXX: Use_sg %d %d\n", SCpnt->use_sg, sg->length))
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index f712e4cfd9dc..7cf3eb023521 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -776,7 +776,7 @@ static void update_ordered(ide_drive_t *drive)
                 * not available so we don't need to recheck that.
                 */
                capacity = idedisk_capacity(drive);
-                barrier = ide_id_has_flush_cache(id) &&
+                barrier = ide_id_has_flush_cache(id) && !drive->noflush &&
                        (drive->addressing == 0 || capacity <= (1ULL << 28) ||
                         ide_id_has_flush_cache_ext(id));
diff --git a/drivers/ide/ide-dma.c b/drivers/ide/ide-dma.c
index 98918fb6b2ce..7c3a13e1cf64 100644
--- a/drivers/ide/ide-dma.c
+++ b/drivers/ide/ide-dma.c
@@ -750,7 +750,7 @@ void ide_dma_verbose(ide_drive_t *drive)
                        goto bug_dma_off;
                printk(", DMA");
        } else if (id->field_valid & 1) {
-                printk(", BUG");
+                goto bug_dma_off;
        }
        return;
 bug_dma_off:
diff --git a/drivers/ide/ide.c b/drivers/ide/ide.c
index 05fbd9298db7..defd4b4bd374 100644
--- a/drivers/ide/ide.c
+++ b/drivers/ide/ide.c
@@ -1539,7 +1539,7 @@ static int __init ide_setup(char *s)
                const char *hd_words[] = {
                        "none", "noprobe", "nowerr", "cdrom", "serialize",
                        "autotune", "noautotune", "minus8", "swapdata", "bswap",
-                        "minus11", "remap", "remap63", "scsi", NULL };
+                        "noflush", "remap", "remap63", "scsi", NULL };
                unit = s[2] - 'a';
                hw   = unit / MAX_DRIVES;
                unit = unit % MAX_DRIVES;
@@ -1578,6 +1578,9 @@ static int __init ide_setup(char *s)
                        case -10: /* "bswap" */
                                drive->bswap = 1;
                                goto done;
+                        case -11: /* noflush */
+                                drive->noflush = 1;
+                                goto done;
                        case -12: /* "remap" */
                                drive->remap_0_to_1 = 1;
                                goto done;
diff --git a/drivers/ide/pci/it821x.c b/drivers/ide/pci/it821x.c
index 3cb04424d351..e9bad185968a 100644
--- a/drivers/ide/pci/it821x.c
+++ b/drivers/ide/pci/it821x.c
@@ -498,9 +498,14 @@ static int config_chipset_for_dma (ide_drive_t *drive)
 {
        u8 speed        = ide_dma_speed(drive, it821x_ratemask(drive));
-        config_it821x_chipset_for_pio(drive, !speed);
+        if (speed) {
-        it821x_tune_chipset(drive, speed);
+                config_it821x_chipset_for_pio(drive, 0);
-        return ide_dma_enable(drive);
+                it821x_tune_chipset(drive, speed);
+                return ide_dma_enable(drive);
+        }
+        return 0;
 }
 /**
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 5ed4dab52a6f..1c3cfbbe6a97 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -167,6 +167,15 @@ static int is_vendor_method_in_use(
        return 0;
 }
+int ib_response_mad(struct ib_mad *mad)
+{
+        return ((mad->mad_hdr.method & IB_MGMT_METHOD_RESP) ||
+                (mad->mad_hdr.method == IB_MGMT_METHOD_TRAP_REPRESS) ||
+                ((mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_BM) &&
+                 (mad->mad_hdr.attr_mod & IB_BM_ATTR_MOD_RESP)));
+}
+EXPORT_SYMBOL(ib_response_mad);
 /*
 * ib_register_mad_agent - Register to send/receive MADs
 */
@@ -570,13 +579,6 @@ int ib_unregister_mad_agent(struct ib_mad_agent *mad_agent)
 }
 EXPORT_SYMBOL(ib_unregister_mad_agent);
-static inline int response_mad(struct ib_mad *mad)
-{
-        /* Trap represses are responses although response bit is reset */
-        return ((mad->mad_hdr.method == IB_MGMT_METHOD_TRAP_REPRESS) ||
-                (mad->mad_hdr.method & IB_MGMT_METHOD_RESP));
-}
 static void dequeue_mad(struct ib_mad_list_head *mad_list)
 {
        struct ib_mad_queue *mad_queue;
@@ -723,7 +725,7 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
        switch (ret)
        {
        case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY:
-                if (response_mad(&mad_priv->mad.mad) &&
+                if (ib_response_mad(&mad_priv->mad.mad) &&
                    mad_agent_priv->agent.recv_handler) {
                        local->mad_priv = mad_priv;
                        local->recv_mad_agent = mad_agent_priv;
@@ -1551,7 +1553,7 @@ find_mad_agent(struct ib_mad_port_private *port_priv,
        unsigned long flags;
        spin_lock_irqsave(&port_priv->reg_lock, flags);
-        if (response_mad(mad)) {
+        if (ib_response_mad(mad)) {
                u32 hi_tid;
                struct ib_mad_agent_private *entry;
@@ -1799,7 +1801,7 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
        }
        /* Complete corresponding request */
-        if (response_mad(mad_recv_wc->recv_buf.mad)) {
+        if (ib_response_mad(mad_recv_wc->recv_buf.mad)) {
                spin_lock_irqsave(&mad_agent_priv->lock, flags);
                mad_send_wr = ib_find_send_mad(mad_agent_priv, mad_recv_wc);
                if (!mad_send_wr) {
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index afe70a549c2f..1273f8807e84 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -112,8 +112,10 @@ struct ib_umad_device {
 struct ib_umad_file {
        struct ib_umad_port    *port;
        struct list_head        recv_list;
+        struct list_head        send_list;
        struct list_head        port_list;
        spinlock_t              recv_lock;
+        spinlock_t              send_lock;
        wait_queue_head_t       recv_wait;
        struct ib_mad_agent    *agent[IB_UMAD_MAX_AGENTS];
        int                     agents_dead;
@@ -177,12 +179,21 @@ static int queue_packet(struct ib_umad_file *file,
        return ret;
 }
+static void dequeue_send(struct ib_umad_file *file,
+                         struct ib_umad_packet *packet)
+ {
+        spin_lock_irq(&file->send_lock);
+        list_del(&packet->list);
+        spin_unlock_irq(&file->send_lock);
+ }
 static void send_handler(struct ib_mad_agent *agent,
                         struct ib_mad_send_wc *send_wc)
 {
        struct ib_umad_file *file = agent->context;
        struct ib_umad_packet *packet = send_wc->send_buf->context[0];
+        dequeue_send(file, packet);
        ib_destroy_ah(packet->msg->ah);
        ib_free_send_mad(packet->msg);
@@ -370,6 +381,51 @@ static int copy_rmpp_mad(struct ib_mad_send_buf *msg, const char __user *buf)
        return 0;
 }
+static int same_destination(struct ib_user_mad_hdr *hdr1,
+                            struct ib_user_mad_hdr *hdr2)
+{
+        if (!hdr1->grh_present && !hdr2->grh_present)
+           return (hdr1->lid == hdr2->lid);
+        if (hdr1->grh_present && hdr2->grh_present)
+           return !memcmp(hdr1->gid, hdr2->gid, 16);
+        return 0;
+}
+static int is_duplicate(struct ib_umad_file *file,
+                        struct ib_umad_packet *packet)
+{
+        struct ib_umad_packet *sent_packet;
+        struct ib_mad_hdr *sent_hdr, *hdr;
+        hdr = (struct ib_mad_hdr *) packet->mad.data;
+        list_for_each_entry(sent_packet, &file->send_list, list) {
+                sent_hdr = (struct ib_mad_hdr *) sent_packet->mad.data;
+                if ((hdr->tid != sent_hdr->tid) ||
+                    (hdr->mgmt_class != sent_hdr->mgmt_class))
+                        continue;
+                /*
+                 * No need to be overly clever here.  If two new operations have
+                 * the same TID, reject the second as a duplicate.  This is more
+                 * restrictive than required by the spec.
+                 */
+                if (!ib_response_mad((struct ib_mad *) hdr)) {
+                        if (!ib_response_mad((struct ib_mad *) sent_hdr))
+                                return 1;
+                        continue;
+                } else if (!ib_response_mad((struct ib_mad *) sent_hdr))
+                        continue;
+                if (same_destination(&packet->mad.hdr, &sent_packet->mad.hdr))
+                        return 1;
+        }
+        return 0;
+}
 static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
                             size_t count, loff_t *pos)
 {
@@ -379,7 +435,6 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
        struct ib_ah_attr ah_attr;
        struct ib_ah *ah;
        struct ib_rmpp_mad *rmpp_mad;
-        u8 method;
        __be64 *tid;
        int ret, data_len, hdr_len, copy_offset, rmpp_active;
@@ -473,28 +528,36 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
        }
        /*
-         * If userspace is generating a request that will generate a
+         * Set the high-order part of the transaction ID to make MADs from
-         * response, we need to make sure the high-order part of the
+         * different agents unique, and allow routing responses back to the
-         * transaction ID matches the agent being used to send the
+         * original requestor.
-         * MAD.
         */
-        method = ((struct ib_mad_hdr *) packet->msg->mad)->method;
+        if (!ib_response_mad(packet->msg->mad)) {
-        if (!(method & IB_MGMT_METHOD_RESP)       &&
-            method != IB_MGMT_METHOD_TRAP_REPRESS &&
-            method != IB_MGMT_METHOD_SEND) {
                tid = &((struct ib_mad_hdr *) packet->msg->mad)->tid;
                *tid = cpu_to_be64(((u64) agent->hi_tid) << 32 |
                                   (be64_to_cpup(tid) & 0xffffffff));
+                rmpp_mad->mad_hdr.tid = *tid;
+        }
+        spin_lock_irq(&file->send_lock);
+        ret = is_duplicate(file, packet);
+        if (!ret)
+                list_add_tail(&packet->list, &file->send_list);
+        spin_unlock_irq(&file->send_lock);
+        if (ret) {
+                ret = -EINVAL;
+                goto err_msg;
        }
        ret = ib_post_send_mad(packet->msg, NULL);
        if (ret)
-                goto err_msg;
+                goto err_send;
        up_read(&file->port->mutex);
        return count;
+err_send:
+        dequeue_send(file, packet);
 err_msg:
        ib_free_send_mad(packet->msg);
 err_ah:
@@ -657,7 +720,9 @@ static int ib_umad_open(struct inode *inode, struct file *filp)
        }
        spin_lock_init(&file->recv_lock);
+        spin_lock_init(&file->send_lock);
        INIT_LIST_HEAD(&file->recv_list);
+        INIT_LIST_HEAD(&file->send_list);
        init_waitqueue_head(&file->recv_wait);
        file->port = port;
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index bdf5d5098190..30923eb68ec7 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -42,6 +42,13 @@
 #include "uverbs.h"
+static struct lock_class_key pd_lock_key;
+static struct lock_class_key mr_lock_key;
+static struct lock_class_key cq_lock_key;
+static struct lock_class_key qp_lock_key;
+static struct lock_class_key ah_lock_key;
+static struct lock_class_key srq_lock_key;
 #define INIT_UDATA(udata, ibuf, obuf, ilen, olen)                       \
        do {                                                            \
                (udata)->inbuf  = (void __user *) (ibuf);               \
@@ -76,12 +83,13 @@
 */
 static void init_uobj(struct ib_uobject *uobj, u64 user_handle,
-                      struct ib_ucontext *context)
+                      struct ib_ucontext *context, struct lock_class_key *key)
 {
        uobj->user_handle = user_handle;
        uobj->context     = context;
        kref_init(&uobj->ref);
        init_rwsem(&uobj->mutex);
+        lockdep_set_class(&uobj->mutex, key);
        uobj->live        = 0;
 }
@@ -470,7 +478,7 @@ ssize_t ib_uverbs_alloc_pd(struct ib_uverbs_file *file,
        if (!uobj)
                return -ENOMEM;
-        init_uobj(uobj, 0, file->ucontext);
+        init_uobj(uobj, 0, file->ucontext, &pd_lock_key);
        down_write(&uobj->mutex);
        pd = file->device->ib_dev->alloc_pd(file->device->ib_dev,
@@ -591,7 +599,7 @@ ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file,
        if (!obj)
                return -ENOMEM;
-        init_uobj(&obj->uobject, 0, file->ucontext);
+        init_uobj(&obj->uobject, 0, file->ucontext, &mr_lock_key);
        down_write(&obj->uobject.mutex);
        /*
@@ -770,7 +778,7 @@ ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file,
        if (!obj)
                return -ENOMEM;
-        init_uobj(&obj->uobject, cmd.user_handle, file->ucontext);
+        init_uobj(&obj->uobject, cmd.user_handle, file->ucontext, &cq_lock_key);
        down_write(&obj->uobject.mutex);
        if (cmd.comp_channel >= 0) {
@@ -1051,13 +1059,14 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
        if (!obj)
                return -ENOMEM;
-        init_uobj(&obj->uevent.uobject, cmd.user_handle, file->ucontext);
+        init_uobj(&obj->uevent.uobject, cmd.user_handle, file->ucontext, &qp_lock_key);
        down_write(&obj->uevent.uobject.mutex);
+        srq = cmd.is_srq ? idr_read_srq(cmd.srq_handle, file->ucontext) : NULL;
        pd  = idr_read_pd(cmd.pd_handle, file->ucontext);
        scq = idr_read_cq(cmd.send_cq_handle, file->ucontext);
-        rcq = idr_read_cq(cmd.recv_cq_handle, file->ucontext);
+        rcq = cmd.recv_cq_handle == cmd.send_cq_handle ?
-        srq = cmd.is_srq ? idr_read_srq(cmd.srq_handle, file->ucontext) : NULL;
+                scq : idr_read_cq(cmd.recv_cq_handle, file->ucontext);
        if (!pd || !scq || !rcq || (cmd.is_srq && !srq)) {
                ret = -EINVAL;
@@ -1125,7 +1134,8 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
        put_pd_read(pd);
        put_cq_read(scq);
-        put_cq_read(rcq);
+        if (rcq != scq)
+                put_cq_read(rcq);
        if (srq)
                put_srq_read(srq);
@@ -1150,7 +1160,7 @@ err_put:
                put_pd_read(pd);
        if (scq)
                put_cq_read(scq);
-        if (rcq)
+        if (rcq && rcq != scq)
                put_cq_read(rcq);
        if (srq)
                put_srq_read(srq);
@@ -1751,7 +1761,7 @@ ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
        if (!uobj)
                return -ENOMEM;
-        init_uobj(uobj, cmd.user_handle, file->ucontext);
+        init_uobj(uobj, cmd.user_handle, file->ucontext, &ah_lock_key);
        down_write(&uobj->mutex);
        pd = idr_read_pd(cmd.pd_handle, file->ucontext);
@@ -1775,7 +1785,7 @@ ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
        ah = ib_create_ah(pd, &attr);
        if (IS_ERR(ah)) {
                ret = PTR_ERR(ah);
-                goto err;
+                goto err_put;
        }
        ah->uobject  = uobj;
@@ -1811,6 +1821,9 @@ err_copy:
 err_destroy:
        ib_destroy_ah(ah);
+err_put:
+        put_pd_read(pd);
 err:
        put_uobj_write(uobj);
        return ret;
@@ -1963,7 +1976,7 @@ ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,
        if (!obj)
                return -ENOMEM;
-        init_uobj(&obj->uobject, cmd.user_handle, file->ucontext);
+        init_uobj(&obj->uobject, cmd.user_handle, file->ucontext, &srq_lock_key);
        down_write(&obj->uobject.mutex);
        pd  = idr_read_pd(cmd.pd_handle, file->ucontext);
@@ -1984,7 +1997,7 @@ ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,
        srq = pd->device->create_srq(pd, &attr, &udata);
        if (IS_ERR(srq)) {
                ret = PTR_ERR(srq);
-                goto err;
+                goto err_put;
        }
        srq->device        = pd->device;
@@ -2029,6 +2042,9 @@ err_copy:
 err_destroy:
        ib_destroy_srq(srq);
+err_put:
+        put_pd_read(pd);
 err:
        put_uobj_write(&obj->uobject);
        return ret;
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index 823131d58b34..f98518d912b5 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -859,6 +859,38 @@ static void ipath_rcv_layer(struct ipath_devdata *dd, u32 etail,
                __ipath_layer_rcv_lid(dd, hdr);
 }
+static void ipath_rcv_hdrerr(struct ipath_devdata *dd,
+                             u32 eflags,
+                             u32 l,
+                             u32 etail,
+                             u64 *rc)
+{
+        char emsg[128];
+        struct ipath_message_header *hdr;
+        get_rhf_errstring(eflags, emsg, sizeof emsg);
+        hdr = (struct ipath_message_header *)&rc[1];
+        ipath_cdbg(PKT, "RHFerrs %x hdrqtail=%x typ=%u "
+                   "tlen=%x opcode=%x egridx=%x: %s\n",
+                   eflags, l,
+                   ipath_hdrget_rcv_type((__le32 *) rc),
+                   ipath_hdrget_length_in_bytes((__le32 *) rc),
+                   be32_to_cpu(hdr->bth[0]) >> 24,
+                   etail, emsg);
+        /* Count local link integrity errors. */
+        if (eflags & (INFINIPATH_RHF_H_ICRCERR | INFINIPATH_RHF_H_VCRCERR)) {
+                u8 n = (dd->ipath_ibcctrl >>
+                        INFINIPATH_IBCC_PHYERRTHRESHOLD_SHIFT) &
+                        INFINIPATH_IBCC_PHYERRTHRESHOLD_MASK;
+                if (++dd->ipath_lli_counter > n) {
+                        dd->ipath_lli_counter = 0;
+                        dd->ipath_lli_errors++;
+                }
+        }
+}
 /*
 * ipath_kreceive - receive a packet
 * @dd: the infinipath device
@@ -875,7 +907,6 @@ void ipath_kreceive(struct ipath_devdata *dd)
        struct ipath_message_header *hdr;
        u32 eflags, i, etype, tlen, pkttot = 0, updegr=0, reloop=0;
        static u64 totcalls;    /* stats, may eventually remove */
-        char emsg[128];
        if (!dd->ipath_hdrqtailptr) {
                ipath_dev_err(dd,
@@ -938,26 +969,9 @@ reloop:
                                   "%x\n", etype);
                }
-                if (eflags & ~(INFINIPATH_RHF_H_TIDERR |
+                if (unlikely(eflags))
-                               INFINIPATH_RHF_H_IHDRERR)) {
+                        ipath_rcv_hdrerr(dd, eflags, l, etail, rc);
-                        get_rhf_errstring(eflags, emsg, sizeof emsg);
+                else if (etype == RCVHQ_RCV_TYPE_NON_KD) {
-                        ipath_cdbg(PKT, "RHFerrs %x hdrqtail=%x typ=%u "
-                                   "tlen=%x opcode=%x egridx=%x: %s\n",
-                                   eflags, l, etype, tlen, bthbytes[0],
-                                   ipath_hdrget_index((__le32 *) rc), emsg);
-                        /* Count local link integrity errors. */
-                        if (eflags & (INFINIPATH_RHF_H_ICRCERR |
-                                      INFINIPATH_RHF_H_VCRCERR)) {
-                                u8 n = (dd->ipath_ibcctrl >>
-                                        INFINIPATH_IBCC_PHYERRTHRESHOLD_SHIFT) &
-                                        INFINIPATH_IBCC_PHYERRTHRESHOLD_MASK;
-                                if (++dd->ipath_lli_counter > n) {
-                                        dd->ipath_lli_counter = 0;
-                                        dd->ipath_lli_errors++;
-                                }
-                        }
-                } else if (etype == RCVHQ_RCV_TYPE_NON_KD) {
                                int ret = __ipath_verbs_rcv(dd, rc + 1,
                                                            ebuf, tlen);
                                if (ret == -ENODEV)
@@ -981,25 +995,7 @@ reloop:
                else if (etype == RCVHQ_RCV_TYPE_EXPECTED)
                        ipath_dbg("Bug: Expected TID, opcode %x; ignored\n",
                                  be32_to_cpu(hdr->bth[0]) & 0xff);
-                else if (eflags & (INFINIPATH_RHF_H_TIDERR |
+                else {
-                                   INFINIPATH_RHF_H_IHDRERR)) {
-                        /*
-                         * This is a type 3 packet, only the LRH is in the
-                         * rcvhdrq, the rest of the header is in the eager
-                         * buffer.
-                         */
-                        u8 opcode;
-                        if (ebuf) {
-                                bthbytes = (u8 *) ebuf;
-                                opcode = *bthbytes;
-                        }
-                        else
-                                opcode = 0;
-                        get_rhf_errstring(eflags, emsg, sizeof emsg);
-                        ipath_dbg("Err %x (%s), opcode %x, egrbuf %x, "
-                                  "len %x\n", eflags, emsg, opcode, etail,
-                                  tlen);
-                } else {
                        /*
                         * error packet, type of error  unknown.
                         * Probably type 3, but we don't know, so don't
diff --git a/drivers/infiniband/hw/ipath/ipath_keys.c b/drivers/infiniband/hw/ipath/ipath_keys.c
index 46773c673a1a..a5ca279370aa 100644
--- a/drivers/infiniband/hw/ipath/ipath_keys.c
+++ b/drivers/infiniband/hw/ipath/ipath_keys.c
@@ -197,6 +197,21 @@ int ipath_rkey_ok(struct ipath_ibdev *dev, struct ipath_sge_state *ss,
        size_t off;
        int ret;
+        /*
+         * We use RKEY == zero for physical addresses
+         * (see ipath_get_dma_mr).
+         */
+        if (rkey == 0) {
+                sge->mr = NULL;
+                sge->vaddr = phys_to_virt(vaddr);
+                sge->length = len;
+                sge->sge_length = len;
+                ss->sg_list = NULL;
+                ss->num_sge = 1;
+                ret = 1;
+                goto bail;
+        }
        mr = rkt->table[(rkey >> (32 - ib_ipath_lkey_table_size))];
        if (unlikely(mr == NULL || mr->lkey != rkey)) {
                ret = 0;
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index 56ac336dd1ec..d70a9b6b5239 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -191,10 +191,6 @@ void ipath_skip_sge(struct ipath_sge_state *ss, u32 length)
 {
        struct ipath_sge *sge = &ss->sge;
-        while (length > sge->sge_length) {
-                length -= sge->sge_length;
-                ss->sge = *ss->sg_list++;
-        }
        while (length) {
                u32 len = sge->length;
@@ -627,6 +623,7 @@ static int ipath_query_device(struct ib_device *ibdev,
        props->device_cap_flags = IB_DEVICE_BAD_PKEY_CNTR |
                IB_DEVICE_BAD_QKEY_CNTR | IB_DEVICE_SHUTDOWN_PORT |
                IB_DEVICE_SYS_IMAGE_GUID;
+        props->page_size_cap = PAGE_SIZE;
        props->vendor_id = ipath_layer_get_vendorid(dev->dd);
        props->vendor_part_id = ipath_layer_get_deviceid(dev->dd);
        props->hw_ver = ipath_layer_get_pcirev(dev->dd);
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index d0f7731802c9..deabc14b4ea4 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -778,11 +778,12 @@ int mthca_QUERY_FW(struct mthca_dev *dev, u8 *status)
                ((dev->fw_ver & 0xffff0000ull) >> 16) |
                ((dev->fw_ver & 0x0000ffffull) << 16);
+        MTHCA_GET(lg, outbox, QUERY_FW_MAX_CMD_OFFSET);
+        dev->cmd.max_cmds = 1 << lg;
        mthca_dbg(dev, "FW version %012llx, max commands %d\n",
                  (unsigned long long) dev->fw_ver, dev->cmd.max_cmds);
-        MTHCA_GET(lg, outbox, QUERY_FW_MAX_CMD_OFFSET);
-        dev->cmd.max_cmds = 1 << lg;
        MTHCA_GET(dev->catas_err.addr, outbox, QUERY_FW_ERR_START_OFFSET);
        MTHCA_GET(dev->catas_err.size, outbox, QUERY_FW_ERR_SIZE_OFFSET);
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index fab417c5cf43..b60a9d79ae54 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -370,7 +370,8 @@ int mthca_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
                return -EINVAL;
        if (attr_mask & IB_SRQ_LIMIT) {
-                if (attr->srq_limit > srq->max)
+                u32 max_wr = mthca_is_memfree(dev) ? srq->max - 1 : srq->max;
+                if (attr->srq_limit > max_wr)
                        return -EINVAL;
                mutex_lock(&srq->mutex);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 3f89f5e19036..474aa214ab57 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -212,6 +212,7 @@ struct ipoib_path {
 struct ipoib_neigh {
        struct ipoib_ah    *ah;
+        union ib_gid        dgid;
        struct sk_buff_head queue;
        struct neighbour   *neighbour;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 1c6ea1c682a5..cf71d2a5515c 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -404,6 +404,8 @@ static void path_rec_completion(int status,
                list_for_each_entry(neigh, &path->neigh_list, list) {
                        kref_get(&path->ah->ref);
                        neigh->ah = path->ah;
+                        memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
+                               sizeof(union ib_gid));
                        while ((skb = __skb_dequeue(&neigh->queue)))
                                __skb_queue_tail(&skqueue, skb);
@@ -510,6 +512,8 @@ static void neigh_add_path(struct sk_buff *skb, struct net_device *dev)
        if (path->ah) {
                kref_get(&path->ah->ref);
                neigh->ah = path->ah;
+                memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
+                       sizeof(union ib_gid));
                ipoib_send(dev, skb, path->ah,
                           be32_to_cpup((__be32 *) skb->dst->neighbour->ha));
@@ -633,6 +637,25 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
                neigh = *to_ipoib_neigh(skb->dst->neighbour);
                if (likely(neigh->ah)) {
+                        if (unlikely(memcmp(&neigh->dgid.raw,
+                                            skb->dst->neighbour->ha + 4,
+                                            sizeof(union ib_gid)))) {
+                                spin_lock(&priv->lock);
+                                /*
+                                 * It's safe to call ipoib_put_ah() inside
+                                 * priv->lock here, because we know that
+                                 * path->ah will always hold one more reference,
+                                 * so ipoib_put_ah() will never do more than
+                                 * decrement the ref count.
+                                 */
+                                ipoib_put_ah(neigh->ah);
+                                list_del(&neigh->list);
+                                ipoib_neigh_free(neigh);
+                                spin_unlock(&priv->lock);
+                                ipoib_path_lookup(skb, dev);
+                                goto out;
+                        }
                        ipoib_send(dev, skb, neigh->ah,
                                   be32_to_cpup((__be32 *) skb->dst->neighbour->ha));
                        goto out;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index ab40488182b3..b5e6a7be603d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -264,6 +264,10 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
                if (!ah) {
                        ipoib_warn(priv, "ib_address_create failed\n");
                } else {
+                        spin_lock_irq(&priv->lock);
+                        mcast->ah = ah;
+                        spin_unlock_irq(&priv->lock);
                        ipoib_dbg_mcast(priv, "MGID " IPOIB_GID_FMT
                                        " AV %p, LID 0x%04x, SL %d\n",
                                        IPOIB_GID_ARG(mcast->mcmember.mgid),
@@ -271,10 +275,6 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
                                        be16_to_cpu(mcast->mcmember.mlid),
                                        mcast->mcmember.sl);
                }
-                spin_lock_irq(&priv->lock);
-                mcast->ah = ah;
-                spin_unlock_irq(&priv->lock);
        }
        /* actually send any queued packets */
diff --git a/drivers/message/fusion/Kconfig b/drivers/message/fusion/Kconfig
index bbc229852881..ea31d8470510 100644
--- a/drivers/message/fusion/Kconfig
+++ b/drivers/message/fusion/Kconfig
@@ -48,10 +48,8 @@ config FUSION_SAS
          List of supported controllers:
          LSISAS1064
-          LSISAS1066
          LSISAS1068
          LSISAS1064E
-          LSISAS1066E
          LSISAS1068E
 config FUSION_MAX_SGE
diff --git a/drivers/message/fusion/Makefile b/drivers/message/fusion/Makefile
index b114236f4395..341691390e86 100644
--- a/drivers/message/fusion/Makefile
+++ b/drivers/message/fusion/Makefile
@@ -9,7 +9,6 @@
 #EXTRA_CFLAGS += -DMPT_DEBUG_EXIT
 #EXTRA_CFLAGS += -DMPT_DEBUG_FAIL
 #
 # driver/module specifics...
 #
diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index 43308df64623..29d0635cce1d 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -436,8 +436,6 @@ mpt_base_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *reply)
                 */
                if (pEvReply->MsgFlags & MPI_MSGFLAGS_CONTINUATION_REPLY) {
                        freereq = 0;
-                        devtverboseprintk((MYIOC_s_WARN_FMT "EVENT_NOTIFICATION reply %p does not return Request frame\n",
-                                ioc->name, pEvReply));
                } else {
                        devtverboseprintk((MYIOC_s_WARN_FMT "EVENT_NOTIFICATION reply %p returns Request frame\n",
                                ioc->name, pEvReply));
@@ -678,19 +676,19 @@ int
 mpt_device_driver_register(struct mpt_pci_driver * dd_cbfunc, int cb_idx)
 {
        MPT_ADAPTER     *ioc;
+        const struct pci_device_id *id;
-        if (cb_idx < 1 || cb_idx >= MPT_MAX_PROTOCOL_DRIVERS) {
+        if (cb_idx < 1 || cb_idx >= MPT_MAX_PROTOCOL_DRIVERS)
                return -EINVAL;
-        }
        MptDeviceDriverHandlers[cb_idx] = dd_cbfunc;
        /* call per pci device probe entry point */
        list_for_each_entry(ioc, &ioc_list, list) {
-                if(dd_cbfunc->probe) {
+                id = ioc->pcidev->driver ?
-                        dd_cbfunc->probe(ioc->pcidev,
+                    ioc->pcidev->driver->id_table : NULL;
-                          ioc->pcidev->driver->id_table);
+                if (dd_cbfunc->probe)
-                }
+                        dd_cbfunc->probe(ioc->pcidev, id);
         }
        return 0;
@@ -1056,9 +1054,8 @@ mpt_host_page_alloc(MPT_ADAPTER *ioc, pIOCInit_t ioc_init)
                                dinitprintk((MYIOC_s_INFO_FMT
                                    "host_page_buffer @ %p, dma @ %x, sz=%d bytes\n",
-                                    ioc->name,
+                                    ioc->name, ioc->HostPageBuffer,
-                                    ioc->HostPageBuffer,
+                                    (u32)ioc->HostPageBuffer_dma,
-                                    ioc->HostPageBuffer_dma,
                                    host_page_buffer_sz));
                                ioc->alloc_total += host_page_buffer_sz;
                                ioc->HostPageBuffer_sz = host_page_buffer_sz;
@@ -1380,6 +1377,7 @@ mpt_attach(struct pci_dev *pdev, const struct pci_device_id *id)
                printk(KERN_WARNING MYNAM
                  ": WARNING - %s did not initialize properly! (%d)\n",
                  ioc->name, r);
                list_del(&ioc->list);
                if (ioc->alt_ioc)
                        ioc->alt_ioc->alt_ioc = NULL;
@@ -1762,9 +1760,9 @@ mpt_do_ioc_recovery(MPT_ADAPTER *ioc, u32 reason, int sleepFlag)
                                                 * chips (mpt_adapter_disable,
                                                 * mpt_diag_reset)
                                                 */
-                                                ioc->cached_fw = NULL;
                                                ddlprintk((MYIOC_s_INFO_FMT ": mpt_upload:  alt_%s has cached_fw=%p \n",
                                                        ioc->name, ioc->alt_ioc->name, ioc->alt_ioc->cached_fw));
+                                                ioc->alt_ioc->cached_fw = NULL;
                                        }
                                } else {
                                        printk(KERN_WARNING MYNAM ": firmware upload failure!\n");
@@ -1885,7 +1883,7 @@ mpt_do_ioc_recovery(MPT_ADAPTER *ioc, u32 reason, int sleepFlag)
                /* FIXME?  Examine results here? */
        }
-out:
+ out:
        if ((ret != 0) && irq_allocated) {
                free_irq(ioc->pci_irq, ioc);
                if (mpt_msi_enable)
@@ -2670,6 +2668,7 @@ SendIocInit(MPT_ADAPTER *ioc, int sleepFlag)
        dinitprintk((MYIOC_s_INFO_FMT "INFO - Wait IOC_OPERATIONAL state (cnt=%d)\n",
                        ioc->name, count));
+        ioc->aen_event_read_flag=0;
        return r;
 }
@@ -2737,6 +2736,8 @@ mpt_alloc_fw_memory(MPT_ADAPTER *ioc, int size)
        if (ioc->alt_ioc && ioc->alt_ioc->cached_fw) {
                ioc->cached_fw = ioc->alt_ioc->cached_fw;  /* use alt_ioc's memory */
                ioc->cached_fw_dma = ioc->alt_ioc->cached_fw_dma;
+                ioc->alloc_total += size;
+                ioc->alt_ioc->alloc_total -= size;
        } else {
                if ( (ioc->cached_fw = pci_alloc_consistent(ioc->pcidev, size, &ioc->cached_fw_dma) ) )
                        ioc->alloc_total += size;
@@ -3166,6 +3167,7 @@ KickStart(MPT_ADAPTER *ioc, int force, int sleepFlag)
 static int
 mpt_diag_reset(MPT_ADAPTER *ioc, int ignore, int sleepFlag)
 {
+        MPT_ADAPTER     *iocp=NULL;
        u32 diag0val;
        u32 doorbell;
        int hard_reset_done = 0;
@@ -3301,17 +3303,23 @@ mpt_diag_reset(MPT_ADAPTER *ioc, int ignore, int sleepFlag)
                        /* FIXME?  Examine results here? */
                }
-                if (ioc->cached_fw) {
+                if (ioc->cached_fw)
+                        iocp = ioc;
+                else if (ioc->alt_ioc && ioc->alt_ioc->cached_fw)
+                        iocp = ioc->alt_ioc;
+                if (iocp) {
                        /* If the DownloadBoot operation fails, the
                         * IOC will be left unusable. This is a fatal error
                         * case.  _diag_reset will return < 0
                         */
                        for (count = 0; count < 30; count ++) {
-                                diag0val = CHIPREG_READ32(&ioc->chip->Diagnostic);
+                                diag0val = CHIPREG_READ32(&iocp->chip->Diagnostic);
                                if (!(diag0val & MPI_DIAG_RESET_ADAPTER)) {
                                        break;
                                }
+                                dprintk((MYIOC_s_INFO_FMT "cached_fw: diag0val=%x count=%d\n",
+                                        iocp->name, diag0val, count));
                                /* wait 1 sec */
                                if (sleepFlag == CAN_SLEEP) {
                                        msleep (1000);
@@ -3320,7 +3328,7 @@ mpt_diag_reset(MPT_ADAPTER *ioc, int ignore, int sleepFlag)
                                }
                        }
                        if ((count = mpt_downloadboot(ioc,
-                                (MpiFwHeader_t *)ioc->cached_fw, sleepFlag)) < 0) {
+                                (MpiFwHeader_t *)iocp->cached_fw, sleepFlag)) < 0) {
                                printk(KERN_WARNING MYNAM
                                        ": firmware downloadboot failure (%d)!\n", count);
                        }
@@ -3907,18 +3915,18 @@ WaitForDoorbellAck(MPT_ADAPTER *ioc, int howlong, int sleepFlag)
        if (sleepFlag == CAN_SLEEP) {
                while (--cntdn) {
+                        msleep (1);
                        intstat = CHIPREG_READ32(&ioc->chip->IntStatus);
                        if (! (intstat & MPI_HIS_IOP_DOORBELL_STATUS))
                                break;
-                        msleep (1);
                        count++;
                }
        } else {
                while (--cntdn) {
+                        mdelay (1);
                        intstat = CHIPREG_READ32(&ioc->chip->IntStatus);
                        if (! (intstat & MPI_HIS_IOP_DOORBELL_STATUS))
                                break;
-                        mdelay (1);
                        count++;
                }
        }
@@ -4883,6 +4891,7 @@ mpt_read_ioc_pg_4(MPT_ADAPTER *ioc)
                pIoc4 = pci_alloc_consistent(ioc->pcidev, iocpage4sz, &ioc4_dma);
                if (!pIoc4)
                        return;
+                ioc->alloc_total += iocpage4sz;
        } else {
                ioc4_dma = ioc->spi_data.IocPg4_dma;
                iocpage4sz = ioc->spi_data.IocPg4Sz;
@@ -4899,6 +4908,7 @@ mpt_read_ioc_pg_4(MPT_ADAPTER *ioc)
        } else {
                pci_free_consistent(ioc->pcidev, iocpage4sz, pIoc4, ioc4_dma);
                ioc->spi_data.pIocPg4 = NULL;
+                ioc->alloc_total -= iocpage4sz;
        }
 }
@@ -5030,19 +5040,18 @@ SendEventAck(MPT_ADAPTER *ioc, EventNotificationReply_t *evnp)
        EventAck_t      *pAck;
        if ((pAck = (EventAck_t *) mpt_get_msg_frame(mpt_base_index, ioc)) == NULL) {
-                printk(MYIOC_s_WARN_FMT "Unable to allocate event ACK "
+                dfailprintk((MYIOC_s_WARN_FMT "%s, no msg frames!!\n",
-                        "request frame for Event=%x EventContext=%x EventData=%x!\n",
+                    ioc->name,__FUNCTION__));
-                        ioc->name, evnp->Event, le32_to_cpu(evnp->EventContext),
-                        le32_to_cpu(evnp->Data[0]));
                return -1;
        }
-        memset(pAck, 0, sizeof(*pAck));
-        dprintk((MYIOC_s_INFO_FMT "Sending EventAck\n", ioc->name));
+        devtverboseprintk((MYIOC_s_INFO_FMT "Sending EventAck\n", ioc->name));
        pAck->Function     = MPI_FUNCTION_EVENT_ACK;
        pAck->ChainOffset  = 0;
+        pAck->Reserved[0]  = pAck->Reserved[1] = 0;
        pAck->MsgFlags     = 0;
+        pAck->Reserved1[0] = pAck->Reserved1[1] = pAck->Reserved1[2] = 0;
        pAck->Event        = evnp->Event;
        pAck->EventContext = evnp->EventContext;
@@ -5704,9 +5713,9 @@ EventDescriptionStr(u8 event, u32 evData0, char *evStr)
                break;
        case MPI_EVENT_EVENT_CHANGE:
                if (evData0)
-                        ds = "Events(ON) Change";
+                        ds = "Events ON";
                else
-                        ds = "Events(OFF) Change";
+                        ds = "Events OFF";
                break;
        case MPI_EVENT_INTEGRATED_RAID:
        {
@@ -5777,8 +5786,27 @@ EventDescriptionStr(u8 event, u32 evData0, char *evStr)
                        break;
                case MPI_EVENT_SAS_DEV_STAT_RC_NO_PERSIST_ADDED:
                        snprintf(evStr, EVENT_DESCR_STR_SZ,
-                            "SAS Device Status Change: No Persistancy "
+                            "SAS Device Status Change: No Persistancy: id=%d", id);
-                            "Added: id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_INTERNAL_DEVICE_RESET:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Device Reset : id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_TASK_ABORT_INTERNAL:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Task Abort : id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_ABORT_TASK_SET_INTERNAL:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Abort Task Set : id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_CLEAR_TASK_SET_INTERNAL:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Clear Task Set : id=%d", id);
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_QUERY_TASK_INTERNAL:
+                        snprintf(evStr, EVENT_DESCR_STR_SZ,
+                            "SAS Device Status Change: Internal Query Task : id=%d", id);
                        break;
                default:
                        snprintf(evStr, EVENT_DESCR_STR_SZ,
@@ -6034,7 +6062,7 @@ ProcessEventNotification(MPT_ADAPTER *ioc, EventNotificationReply_t *pEventReply
 *      @ioc: Pointer to MPT_ADAPTER structure
 *      @log_info: U32 LogInfo reply word from the IOC
 *
- *      Refer to lsi/fc_log.h.
+ *      Refer to lsi/mpi_log_fc.h.
 */
 static void
 mpt_fc_log_info(MPT_ADAPTER *ioc, u32 log_info)
@@ -6131,8 +6159,10 @@ mpt_spi_log_info(MPT_ADAPTER *ioc, u32 log_info)
                "Invalid SAS Address",                          /* 01h */
                NULL,                                           /* 02h */
                "Invalid Page",                                 /* 03h */
-                NULL,                                           /* 04h */
+                "Diag Message Error",                           /* 04h */
-                "Task Terminated"                               /* 05h */
+                "Task Terminated",                              /* 05h */
+                "Enclosure Management",                         /* 06h */
+                "Target Mode"                                   /* 07h */
        };
        static char *pl_code_str[] = {
                NULL,                                           /* 00h */
@@ -6158,7 +6188,7 @@ mpt_spi_log_info(MPT_ADAPTER *ioc, u32 log_info)
                "IO Executed",                                  /* 14h */
                "Persistant Reservation Out Not Affiliation Owner", /* 15h */
                "Open Transmit DMA Abort",                      /* 16h */
-                NULL,                                           /* 17h */
+                "IO Device Missing Delay Retry",                /* 17h */
                NULL,                                           /* 18h */
                NULL,                                           /* 19h */
                NULL,                                           /* 1Ah */
@@ -6238,7 +6268,7 @@ static void
 mpt_sp_ioc_info(MPT_ADAPTER *ioc, u32 ioc_status, MPT_FRAME_HDR *mf)
 {
        u32 status = ioc_status & MPI_IOCSTATUS_MASK;
-        char *desc = "";
+        char *desc = NULL;
        switch (status) {
        case MPI_IOCSTATUS_INVALID_FUNCTION: /* 0x0001 */
@@ -6348,7 +6378,7 @@ mpt_sp_ioc_info(MPT_ADAPTER *ioc, u32 ioc_status, MPT_FRAME_HDR *mf)
                desc = "Others";
                break;
        }
-        if (desc != "")
+        if (desc != NULL)
                printk(MYIOC_s_INFO_FMT "IOCStatus(0x%04x): %s\n", ioc->name, status, desc);
 }
@@ -6386,7 +6416,6 @@ EXPORT_SYMBOL(mpt_alloc_fw_memory);
 EXPORT_SYMBOL(mpt_free_fw_memory);
 EXPORT_SYMBOL(mptbase_sas_persist_operation);
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
 *      fusion_init - Fusion MPT base driver initialization routine.
diff --git a/drivers/message/fusion/mptbase.h b/drivers/message/fusion/mptbase.h
index a5ce10b67d02..d4cb144ab402 100644
--- a/drivers/message/fusion/mptbase.h
+++ b/drivers/message/fusion/mptbase.h
@@ -75,8 +75,8 @@
 #define COPYRIGHT       "Copyright (c) 1999-2005 " MODULEAUTHOR
 #endif
-#define MPT_LINUX_VERSION_COMMON        "3.04.00"
+#define MPT_LINUX_VERSION_COMMON        "3.04.01"
-#define MPT_LINUX_PACKAGE_NAME          "@(#)mptlinux-3.04.00"
+#define MPT_LINUX_PACKAGE_NAME          "@(#)mptlinux-3.04.01"
 #define WHAT_MAGIC_STRING               "@" "(" "#" ")"
 #define show_mptmod_ver(s,ver)  \
@@ -307,8 +307,8 @@ typedef struct _SYSIF_REGS
        u32     HostIndex;      /* 50     Host Index register        */
        u32     Reserved4[15];  /* 54-8F                             */
        u32     Fubar;          /* 90     For Fubar usage            */
-        u32     Reserved5[1050];/* 94-10F8                           */
+        u32     Reserved5[1050];/* 94-10F8                           */
-        u32     Reset_1078;     /* 10FC   Reset 1078                 */
+        u32     Reset_1078;     /* 10FC   Reset 1078                 */
 } SYSIF_REGS;
 /*
@@ -363,6 +363,7 @@ typedef struct _VirtDevice {
 #define MPT_TARGET_FLAGS_VALID_56       0x10
 #define MPT_TARGET_FLAGS_SAF_TE_ISSUED  0x20
 #define MPT_TARGET_FLAGS_RAID_COMPONENT 0x40
+#define MPT_TARGET_FLAGS_LED_ON         0x80
 /*
 *      /proc/mpt interface
@@ -634,7 +635,6 @@ typedef struct _MPT_ADAPTER
        u16                      handle;
        int                      sas_index; /* index refrencing */
        MPT_SAS_MGMT             sas_mgmt;
-        int                      num_ports;
        struct work_struct       sas_persist_task;
        struct work_struct       fc_setup_reset_work;
@@ -644,7 +644,6 @@ typedef struct _MPT_ADAPTER
        struct work_struct       fc_rescan_work;
        char                     fc_rescan_work_q_name[KOBJ_NAME_LEN];
        struct workqueue_struct *fc_rescan_work_q;
-        u8              port_serial_number;
 } MPT_ADAPTER;
 /*
@@ -982,7 +981,7 @@ typedef struct _MPT_SCSI_HOST {
        wait_queue_head_t         scandv_waitq;
        int                       scandv_wait_done;
        long                      last_queue_full;
-        u8                        mpt_pq_filter;
+        u16                       tm_iocstatus;
 } MPT_SCSI_HOST;
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
index b4967bb8a7d6..30975ccd9947 100644
--- a/drivers/message/fusion/mptctl.c
+++ b/drivers/message/fusion/mptctl.c
@@ -2332,7 +2332,7 @@ done_free_mem:
 }
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
-/* Prototype Routine for the HP HOST INFO command.
+/* Prototype Routine for the HOST INFO command.
 *
 * Outputs:     None.
 * Return:      0 if successful
@@ -2568,7 +2568,7 @@ mptctl_hp_hostinfo(unsigned long arg, unsigned int data_size)
 }
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
-/* Prototype Routine for the HP TARGET INFO command.
+/* Prototype Routine for the TARGET INFO command.
 *
 * Outputs:     None.
 * Return:      0 if successful
diff --git a/drivers/message/fusion/mptctl.h b/drivers/message/fusion/mptctl.h
index a2f8a97992e6..043941882c6e 100644
--- a/drivers/message/fusion/mptctl.h
+++ b/drivers/message/fusion/mptctl.h
@@ -354,9 +354,6 @@ struct mpt_ioctl_command32 {
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
-/*
- *      HP Specific IOCTL Defines and Structures
- */
 #define CPQFCTS_IOC_MAGIC 'Z'
 #define HP_IOC_MAGIC 'Z'
@@ -364,8 +361,6 @@ struct mpt_ioctl_command32 {
 #define HP_GETHOSTINFO1         _IOR(HP_IOC_MAGIC, 20, hp_host_info_rev0_t)
 #define HP_GETTARGETINFO        _IOR(HP_IOC_MAGIC, 21, hp_target_info_t)
-/* All HP IOCTLs must include this header
- */
 typedef struct _hp_header {
        unsigned int iocnum;
        unsigned int host;
diff --git a/drivers/message/fusion/mptfc.c b/drivers/message/fusion/mptfc.c
index a8f2fa985455..90da7d63b08e 100644
--- a/drivers/message/fusion/mptfc.c
+++ b/drivers/message/fusion/mptfc.c
@@ -77,10 +77,6 @@ MODULE_DESCRIPTION(my_NAME);
 MODULE_LICENSE("GPL");
 /* Command line args */
-static int mpt_pq_filter = 0;
-module_param(mpt_pq_filter, int, 0);
-MODULE_PARM_DESC(mpt_pq_filter, " Enable peripheral qualifier filter: enable=1  (default=0)");
 #define MPTFC_DEV_LOSS_TMO (60)
 static int mptfc_dev_loss_tmo = MPTFC_DEV_LOSS_TMO;     /* reasonable default */
 module_param(mptfc_dev_loss_tmo, int, 0);
@@ -513,8 +509,7 @@ mptfc_slave_alloc(struct scsi_device *sdev)
        if (vtarget->num_luns == 0) {
                vtarget->ioc_id = hd->ioc->id;
-                vtarget->tflags = MPT_TARGET_FLAGS_Q_YES |
+                vtarget->tflags = MPT_TARGET_FLAGS_Q_YES;
-                                  MPT_TARGET_FLAGS_VALID_INQUIRY;
                hd->Targets[sdev->id] = vtarget;
        }
@@ -1129,13 +1124,6 @@ mptfc_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        hd->timer.data = (unsigned long) hd;
        hd->timer.function = mptscsih_timer_expired;
-        hd->mpt_pq_filter = mpt_pq_filter;
-        ddvprintk((MYIOC_s_INFO_FMT
-                "mpt_pq_filter %x\n",
-                ioc->name, 
-                mpt_pq_filter));
        init_waitqueue_head(&hd->scandv_waitq);
        hd->scandv_wait_done = 0;
        hd->last_queue_full = 0;
diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
index f7bd8b11ed3b..f66f2203143a 100644
--- a/drivers/message/fusion/mptsas.c
+++ b/drivers/message/fusion/mptsas.c
@@ -67,20 +67,19 @@
 #define my_VERSION      MPT_LINUX_VERSION_COMMON
 #define MYNAM           "mptsas"
+/*
+ * Reserved channel for integrated raid
+ */
+#define MPTSAS_RAID_CHANNEL     1
 MODULE_AUTHOR(MODULEAUTHOR);
 MODULE_DESCRIPTION(my_NAME);
 MODULE_LICENSE("GPL");
-static int mpt_pq_filter;
-module_param(mpt_pq_filter, int, 0);
-MODULE_PARM_DESC(mpt_pq_filter,
-                "Enable peripheral qualifier filter: enable=1  "
-                "(default=0)");
 static int mpt_pt_clear;
 module_param(mpt_pt_clear, int, 0);
 MODULE_PARM_DESC(mpt_pt_clear,
-                "Clear persistency table: enable=1  "
+                " Clear persistency table: enable=1  "
                "(default=MPTSCSIH_PT_CLEAR=0)");
 static int      mptsasDoneCtx = -1;
@@ -144,7 +143,6 @@ struct mptsas_devinfo {
 * Specific details on ports, wide/narrow
 */
 struct mptsas_portinfo_details{
-        u8      port_id;        /* port number provided to transport */
        u16     num_phys;       /* number of phys belong to this port */
        u64     phy_bitmask;    /* TODO, extend support for 255 phys */
        struct sas_rphy *rphy;  /* transport layer rphy object */
@@ -350,10 +348,10 @@ mptsas_port_delete(struct mptsas_portinfo_details * port_details)
        port_info = port_details->port_info;
        phy_info = port_info->phy_info;
-        dsaswideprintk((KERN_DEBUG "%s: [%p]: port=%02d num_phys=%02d "
+        dsaswideprintk((KERN_DEBUG "%s: [%p]: num_phys=%02d "
                "bitmask=0x%016llX\n",
-                __FUNCTION__, port_details, port_details->port_id,
+                __FUNCTION__, port_details, port_details->num_phys,
-                port_details->num_phys, port_details->phy_bitmask));
+                    port_details->phy_bitmask));
        for (i = 0; i < port_info->num_phys; i++, phy_info++) {
                if(phy_info->port_details != port_details)
@@ -462,9 +460,8 @@ mptsas_setup_wide_ports(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
                 * phy be removed by firmware events.
                 */
                dsaswideprintk((KERN_DEBUG
-                        "%s: [%p]: port=%d deleting phy = %d\n",
+                        "%s: [%p]: deleting phy = %d\n",
-                        __FUNCTION__, port_details,
+                        __FUNCTION__, port_details, i));
-                        port_details->port_id, i));
                port_details->num_phys--;
                port_details->phy_bitmask &= ~ (1 << phy_info->phy_id);
                memset(&phy_info->attached, 0, sizeof(struct mptsas_devinfo));
@@ -493,7 +490,6 @@ mptsas_setup_wide_ports(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
                                goto out;
                        port_details->num_phys = 1;
                        port_details->port_info = port_info;
-                        port_details->port_id = ioc->port_serial_number++;
                        if (phy_info->phy_id < 64 )
                                port_details->phy_bitmask |=
                                    (1 << phy_info->phy_id);
@@ -525,12 +521,8 @@ mptsas_setup_wide_ports(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
                                    mptsas_get_port(phy_info_cmp);
                                port_details->starget =
                                    mptsas_get_starget(phy_info_cmp);
-                                port_details->port_id =
-                                        phy_info_cmp->port_details->port_id;
                                port_details->num_phys =
                                        phy_info_cmp->port_details->num_phys;
-//                              port_info->port_serial_number--;
-                                ioc->port_serial_number--;
                                if (!phy_info_cmp->port_details->num_phys)
                                        kfree(phy_info_cmp->port_details);
                        } else
@@ -554,11 +546,11 @@ mptsas_setup_wide_ports(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
                if (!port_details)
                        continue;
                dsaswideprintk((KERN_DEBUG
-                        "%s: [%p]: phy_id=%02d port_id=%02d num_phys=%02d "
+                        "%s: [%p]: phy_id=%02d num_phys=%02d "
                        "bitmask=0x%016llX\n",
                        __FUNCTION__,
-                        port_details, i, port_details->port_id,
+                        port_details, i, port_details->num_phys,
-                        port_details->num_phys, port_details->phy_bitmask));
+                        port_details->phy_bitmask));
                dsaswideprintk((KERN_DEBUG"\t\tport = %p rphy=%p\n",
                        port_details->port, port_details->rphy));
        }
@@ -651,16 +643,13 @@ mptsas_sas_enclosure_pg0(MPT_ADAPTER *ioc, struct mptsas_enclosure *enclosure,
 static int
 mptsas_slave_configure(struct scsi_device *sdev)
 {
-        struct Scsi_Host        *host = sdev->host;
-        MPT_SCSI_HOST           *hd = (MPT_SCSI_HOST *)host->hostdata;
-        /*
+        if (sdev->channel == MPTSAS_RAID_CHANNEL)
-         * RAID volumes placed beyond the last expected port.
+                goto out;
-         * Ignore sending sas mode pages in that case..
-         */
+        sas_read_port_mode_page(sdev);
-        if (sdev->channel < hd->ioc->num_ports)
-                sas_read_port_mode_page(sdev);
+ out:
        return mptscsih_slave_configure(sdev);
 }
@@ -689,10 +678,7 @@ mptsas_target_alloc(struct scsi_target *starget)
        hd->Targets[target_id] = vtarget;
-        /*
+        if (starget->channel == MPTSAS_RAID_CHANNEL)
-         * RAID volumes placed beyond the last expected port.
-         */
-        if (starget->channel == hd->ioc->num_ports)
                goto out;
        rphy = dev_to_rphy(starget->dev.parent);
@@ -743,7 +729,7 @@ mptsas_target_destroy(struct scsi_target *starget)
        if (!starget->hostdata)
                return;
-        if (starget->channel == hd->ioc->num_ports)
+        if (starget->channel == MPTSAS_RAID_CHANNEL)
                goto out;
        rphy = dev_to_rphy(starget->dev.parent);
@@ -783,10 +769,7 @@ mptsas_slave_alloc(struct scsi_device *sdev)
        starget = scsi_target(sdev);
        vdev->vtarget = starget->hostdata;
-        /*
+        if (sdev->channel == MPTSAS_RAID_CHANNEL)
-         * RAID volumes placed beyond the last expected port.
-         */
-        if (sdev->channel == hd->ioc->num_ports)
                goto out;
        rphy = dev_to_rphy(sdev->sdev_target->dev.parent);
@@ -1608,11 +1591,7 @@ static int mptsas_probe_one_phy(struct device *dev,
        if (phy_info->sas_port_add_phy) {
                if (!port) {
-                        port = sas_port_alloc(dev,
+                        port = sas_port_alloc_num(dev);
-                            phy_info->port_details->port_id);
-                        dsaswideprintk((KERN_DEBUG
-                            "sas_port_alloc: port=%p dev=%p port_id=%d\n",
-                            port, dev, phy_info->port_details->port_id));
                        if (!port) {
                                error = -ENOMEM;
                                goto out;
@@ -1625,6 +1604,9 @@ static int mptsas_probe_one_phy(struct device *dev,
                                goto out;
                        }
                        mptsas_set_port(phy_info, port);
+                        dsaswideprintk((KERN_DEBUG
+                            "sas_port_alloc: port=%p dev=%p port_id=%d\n",
+                            port, dev, port->port_identifier));
                }
                dsaswideprintk((KERN_DEBUG "sas_port_add_phy: phy_id=%d\n",
                    phy_info->phy_id));
@@ -1736,7 +1718,6 @@ mptsas_probe_hba_phys(MPT_ADAPTER *ioc)
                hba = NULL;
        }
        mutex_unlock(&ioc->sas_topology_mutex);
-        ioc->num_ports = port_info->num_phys;
        for (i = 0; i < port_info->num_phys; i++) {
                mptsas_sas_phy_pg0(ioc, &port_info->phy_info[i],
@@ -1939,7 +1920,8 @@ mptsas_delete_expander_phys(MPT_ADAPTER *ioc)
                                        expander_sas_address)
                                        continue;
 #ifdef MPT_DEBUG_SAS_WIDE
-                                dev_printk(KERN_DEBUG, &port->dev, "delete\n");
+                                dev_printk(KERN_DEBUG, &port->dev,
+                                    "delete port (%d)\n", port->port_identifier);
 #endif
                                sas_port_delete(port);
                                mptsas_port_delete(phy_info->port_details);
@@ -1984,7 +1966,7 @@ mptsas_scan_sas_topology(MPT_ADAPTER *ioc)
        if (!ioc->raid_data.pIocPg2->NumActiveVolumes)
                goto out;
        for (i=0; i<ioc->raid_data.pIocPg2->NumActiveVolumes; i++) {
-                scsi_add_device(ioc->sh, ioc->num_ports,
+                scsi_add_device(ioc->sh, MPTSAS_RAID_CHANNEL,
                    ioc->raid_data.pIocPg2->RaidVolume[i].VolumeID, 0);
        }
 out:
@@ -2185,7 +2167,8 @@ mptsas_hotplug_work(void *arg)
                       ioc->name, ds, ev->channel, ev->id, phy_info->phy_id);
 #ifdef MPT_DEBUG_SAS_WIDE
-                dev_printk(KERN_DEBUG, &port->dev, "delete\n");
+                dev_printk(KERN_DEBUG, &port->dev,
+                    "delete port (%d)\n", port->port_identifier);
 #endif
                sas_port_delete(port);
                mptsas_port_delete(phy_info->port_details);
@@ -2289,35 +2272,26 @@ mptsas_hotplug_work(void *arg)
                mptsas_set_rphy(phy_info, rphy);
                break;
        case MPTSAS_ADD_RAID:
-                sdev = scsi_device_lookup(
+                sdev = scsi_device_lookup(ioc->sh, MPTSAS_RAID_CHANNEL,
-                        ioc->sh,
+                    ev->id, 0);
-                        ioc->num_ports,
-                        ev->id,
-                        0);
                if (sdev) {
                        scsi_device_put(sdev);
                        break;
                }
                printk(MYIOC_s_INFO_FMT
                       "attaching raid volume, channel %d, id %d\n",
-                       ioc->name, ioc->num_ports, ev->id);
+                       ioc->name, MPTSAS_RAID_CHANNEL, ev->id);
-                scsi_add_device(ioc->sh,
+                scsi_add_device(ioc->sh, MPTSAS_RAID_CHANNEL, ev->id, 0);
-                        ioc->num_ports,
-                        ev->id,
-                        0);
                mpt_findImVolumes(ioc);
                break;
        case MPTSAS_DEL_RAID:
-                sdev = scsi_device_lookup(
+                sdev = scsi_device_lookup(ioc->sh, MPTSAS_RAID_CHANNEL,
-                        ioc->sh,
+                    ev->id, 0);
-                        ioc->num_ports,
-                        ev->id,
-                        0);
                if (!sdev)
                        break;
                printk(MYIOC_s_INFO_FMT
                       "removing raid volume, channel %d, id %d\n",
-                       ioc->name, ioc->num_ports, ev->id);
+                       ioc->name, MPTSAS_RAID_CHANNEL, ev->id);
                vdevice = sdev->hostdata;
                vdevice->vtarget->deleted = 1;
                mptsas_target_reset(ioc, vdevice->vtarget);
@@ -2723,7 +2697,6 @@ mptsas_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        hd->timer.data = (unsigned long) hd;
        hd->timer.function = mptscsih_timer_expired;
-        hd->mpt_pq_filter = mpt_pq_filter;
        ioc->sas_data.ptClear = mpt_pt_clear;
        if (ioc->sas_data.ptClear==1) {
@@ -2731,12 +2704,6 @@ mptsas_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                    ioc, MPI_SAS_OP_CLEAR_ALL_PERSISTENT);
        }
-        ddvprintk((MYIOC_s_INFO_FMT
-                "mpt_pq_filter %x mpt_pq_filter %x\n",
-                ioc->name,
-                mpt_pq_filter,
-                mpt_pq_filter));
        init_waitqueue_head(&hd->scandv_waitq);
        hd->scandv_wait_done = 0;
        hd->last_queue_full = 0;
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index 8242b16e3168..30524dc54b16 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -66,6 +66,7 @@
 #include "mptbase.h"
 #include "mptscsih.h"
+#include "lsi/mpi_log_sas.h"
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 #define my_NAME         "Fusion MPT SCSI Host driver"
@@ -127,7 +128,7 @@ static void	mptscsih_freeChainBuffers(MPT_ADAPTER *ioc, int req_idx);
 static void     mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR *mf, SCSIIOReply_t *pScsiReply);
 static int      mptscsih_tm_pending_wait(MPT_SCSI_HOST * hd);
 static int      mptscsih_tm_wait_for_completion(MPT_SCSI_HOST * hd, ulong timeout );
-static u32      SCPNT_TO_LOOKUP_IDX(struct scsi_cmnd *sc);
+static int      SCPNT_TO_LOOKUP_IDX(struct scsi_cmnd *sc);
 static int      mptscsih_IssueTaskMgmt(MPT_SCSI_HOST *hd, u8 type, u8 channel, u8 target, u8 lun, int ctx2abort, ulong timeout);
@@ -497,6 +498,34 @@ nextSGEset:
        return SUCCESS;
 } /* mptscsih_AddSGE() */
+static void
+mptscsih_issue_sep_command(MPT_ADAPTER *ioc, VirtTarget *vtarget,
+    U32 SlotStatus)
+{
+        MPT_FRAME_HDR *mf;
+        SEPRequest_t     *SEPMsg;
+        if (ioc->bus_type == FC)
+                return;
+        if ((mf = mpt_get_msg_frame(ioc->InternalCtx, ioc)) == NULL) {
+                dfailprintk((MYIOC_s_WARN_FMT "%s: no msg frames!!\n",
+                    ioc->name,__FUNCTION__));
+                return;
+        }
+        SEPMsg = (SEPRequest_t *)mf;
+        SEPMsg->Function = MPI_FUNCTION_SCSI_ENCLOSURE_PROCESSOR;
+        SEPMsg->Bus = vtarget->bus_id;
+        SEPMsg->TargetID = vtarget->target_id;
+        SEPMsg->Action = MPI_SEP_REQ_ACTION_WRITE_STATUS;
+        SEPMsg->SlotStatus = SlotStatus;
+        devtverboseprintk((MYIOC_s_WARN_FMT
+            "Sending SEP cmd=%x id=%d bus=%d\n",
+            ioc->name, SlotStatus, SEPMsg->TargetID, SEPMsg->Bus));
+        mpt_put_msg_frame(ioc->DoneCtx, ioc, mf);
+}
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
 *      mptscsih_io_done - Main SCSI IO callback routine registered to
@@ -520,6 +549,8 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
        SCSIIORequest_t *pScsiReq;
        SCSIIOReply_t   *pScsiReply;
        u16              req_idx, req_idx_MR;
+        VirtDevice       *vdev;
+        VirtTarget       *vtarget;
        hd = (MPT_SCSI_HOST *) ioc->sh->hostdata;
@@ -538,6 +569,7 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
        }
        sc = hd->ScsiLookup[req_idx];
+        hd->ScsiLookup[req_idx] = NULL;
        if (sc == NULL) {
                MPIHeader_t *hdr = (MPIHeader_t *)mf;
@@ -553,6 +585,12 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                return 1;
        }
+        if ((unsigned char *)mf != sc->host_scribble) {
+                mptscsih_freeChainBuffers(ioc, req_idx);
+                return 1;
+        }
+        sc->host_scribble = NULL;
        sc->result = DID_OK << 16;              /* Set default reply as OK */
        pScsiReq = (SCSIIORequest_t *) mf;
        pScsiReply = (SCSIIOReply_t *) mr;
@@ -640,10 +678,36 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                        if (hd->sel_timeout[pScsiReq->TargetID] < 0xFFFF)
                                hd->sel_timeout[pScsiReq->TargetID]++;
+                        vdev = sc->device->hostdata;
+                        if (!vdev)
+                                break;
+                        vtarget = vdev->vtarget;
+                        if (vtarget->tflags & MPT_TARGET_FLAGS_LED_ON) {
+                                mptscsih_issue_sep_command(ioc, vtarget,
+                                    MPI_SEP_REQ_SLOTSTATUS_UNCONFIGURED);
+                                vtarget->tflags &= ~MPT_TARGET_FLAGS_LED_ON;
+                        }
                        break;
-                case MPI_IOCSTATUS_SCSI_TASK_TERMINATED:        /* 0x0048 */
                case MPI_IOCSTATUS_SCSI_IOC_TERMINATED:         /* 0x004B */
+                        if ( ioc->bus_type == SAS ) {
+                                u16 ioc_status = le16_to_cpu(pScsiReply->IOCStatus);
+                                if (ioc_status & MPI_IOCSTATUS_FLAG_LOG_INFO_AVAILABLE) {
+                                        u32 log_info = le32_to_cpu(mr->u.reply.IOCLogInfo);
+                                        log_info &=SAS_LOGINFO_MASK;
+                                        if (log_info == SAS_LOGINFO_NEXUS_LOSS) {
+                                                sc->result = (DID_BUS_BUSY << 16);
+                                                break;
+                                        }
+                                }
+                        }
+                        /*
+                         * Allow non-SAS & non-NEXUS_LOSS to drop into below code
+                         */
+                case MPI_IOCSTATUS_SCSI_TASK_TERMINATED:        /* 0x0048 */
                case MPI_IOCSTATUS_SCSI_EXT_TERMINATED:         /* 0x004C */
                        /* Linux handles an unsolicited DID_RESET better
                         * than an unsolicited DID_ABORT.
@@ -658,7 +722,7 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                                sc->result=DID_SOFT_ERROR << 16;
                        else /* Sufficient data transfer occurred */
                                sc->result = (DID_OK << 16) | scsi_status;
-                        dreplyprintk((KERN_NOTICE 
+                        dreplyprintk((KERN_NOTICE
                            "RESIDUAL_MISMATCH: result=%x on id=%d\n", sc->result, sc->device->id));
                        break;
@@ -784,8 +848,6 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                                sc->request_bufflen, sc->sc_data_direction);
        }
-        hd->ScsiLookup[req_idx] = NULL;
        sc->scsi_done(sc);              /* Issue the command callback */
        /* Free Chain buffers */
@@ -827,9 +889,17 @@ mptscsih_flush_running_cmds(MPT_SCSI_HOST *hd)
                        dmfprintk(( "flush: ScsiDone (mf=%p,sc=%p)\n",
                                        mf, SCpnt));
+                        /* Free Chain buffers */
+                        mptscsih_freeChainBuffers(ioc, ii);
+                        /* Free Message frames */
+                        mpt_free_msg_frame(ioc, mf);
+                        if ((unsigned char *)mf != SCpnt->host_scribble)
+                                continue;
                        /* Set status, free OS resources (SG DMA buffers)
                         * Do OS callback
-                         * Free driver resources (chain, msg buffers)
                         */
                        if (SCpnt->use_sg) {
                                pci_unmap_sg(ioc->pcidev,
@@ -845,12 +915,6 @@ mptscsih_flush_running_cmds(MPT_SCSI_HOST *hd)
                        SCpnt->result = DID_RESET << 16;
                        SCpnt->host_scribble = NULL;
-                        /* Free Chain buffers */
-                        mptscsih_freeChainBuffers(ioc, ii);
-                        /* Free Message frames */
-                        mpt_free_msg_frame(ioc, mf);
                        SCpnt->scsi_done(SCpnt);        /* Issue the command callback */
                }
        }
@@ -887,10 +951,10 @@ mptscsih_search_running_cmds(MPT_SCSI_HOST *hd, VirtDevice *vdevice)
                if ((sc = hd->ScsiLookup[ii]) != NULL) {
                        mf = (SCSIIORequest_t *)MPT_INDEX_2_MFPTR(hd->ioc, ii);
+                        if (mf == NULL)
+                                continue;
                        dsprintk(( "search_running: found (sc=%p, mf = %p) target %d, lun %d \n",
                                        hd->ScsiLookup[ii], mf, mf->TargetID, mf->LUN[1]));
                        if ((mf->TargetID != ((u8)vdevice->vtarget->target_id)) || (mf->LUN[1] != ((u8) vdevice->lun)))
                                continue;
@@ -899,6 +963,8 @@ mptscsih_search_running_cmds(MPT_SCSI_HOST *hd, VirtDevice *vdevice)
                        hd->ScsiLookup[ii] = NULL;
                        mptscsih_freeChainBuffers(hd->ioc, ii);
                        mpt_free_msg_frame(hd->ioc, (MPT_FRAME_HDR *)mf);
+                        if ((unsigned char *)mf != sc->host_scribble)
+                                continue;
                        if (sc->use_sg) {
                                pci_unmap_sg(hd->ioc->pcidev,
                                (struct scatterlist *) sc->request_buffer,
@@ -1341,8 +1407,8 @@ mptscsih_qcmd(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
                        goto fail;
        }
+        SCpnt->host_scribble = (unsigned char *)mf;
        hd->ScsiLookup[my_idx] = SCpnt;
-        SCpnt->host_scribble = NULL;
        mpt_put_msg_frame(hd->ioc->DoneCtx, hd->ioc, mf);
        dmfprintk((MYIOC_s_INFO_FMT "Issued SCSI cmd (%p) mf=%p idx=%d\n",
@@ -1529,6 +1595,12 @@ mptscsih_TMHandler(MPT_SCSI_HOST *hd, u8 type, u8 channel, u8 target, u8 lun, in
                rc = mpt_HardResetHandler(hd->ioc, CAN_SLEEP);
        }
+        /*
+         * Check IOCStatus from TM reply message
+         */
+         if (hd->tm_iocstatus != MPI_IOCSTATUS_SUCCESS)
+                rc = FAILED;
        dtmprintk((MYIOC_s_INFO_FMT "TMHandler rc = %d!\n", hd->ioc->name, rc));
        return rc;
@@ -1654,6 +1726,7 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
        int              scpnt_idx;
        int              retval;
        VirtDevice       *vdev;
+        ulong            sn = SCpnt->serial_number;
        /* If we can't locate our host adapter structure, return FAILED status.
         */
@@ -1707,6 +1780,11 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
                vdev->vtarget->bus_id, vdev->vtarget->target_id, vdev->lun,
                ctx2abort, mptscsih_get_tm_timeout(hd->ioc));
+        if (SCPNT_TO_LOOKUP_IDX(SCpnt) == scpnt_idx &&
+            SCpnt->serial_number == sn) {
+                retval = FAILED;
+        }
        printk (KERN_WARNING MYNAM ": %s: task abort: %s (sc=%p)\n",
                hd->ioc->name,
                ((retval == 0) ? "SUCCESS" : "FAILED" ), SCpnt);
@@ -2023,6 +2101,7 @@ mptscsih_taskmgmt_complete(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *m
                DBG_DUMP_TM_REPLY_FRAME((u32 *)pScsiTmReply);
                iocstatus = le16_to_cpu(pScsiTmReply->IOCStatus) & MPI_IOCSTATUS_MASK;
+                hd->tm_iocstatus = iocstatus;
                dtmprintk((MYIOC_s_WARN_FMT "  SCSI TaskMgmt (%d) IOCStatus=%04x IOCLogInfo=%08x\n",
                        ioc->name, tmType, iocstatus, le32_to_cpu(pScsiTmReply->IOCLogInfo)));
                /* Error?  (anything non-zero?) */
@@ -2401,6 +2480,13 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR
                                ioc->events[idx].data[1] = (sense_data[13] << 8) || sense_data[12];
                                ioc->eventContext++;
+                                if (hd->ioc->pcidev->vendor ==
+                                    PCI_VENDOR_ID_IBM) {
+                                        mptscsih_issue_sep_command(hd->ioc,
+                                            vdev->vtarget, MPI_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT);
+                                        vdev->vtarget->tflags |=
+                                            MPT_TARGET_FLAGS_LED_ON;
+                                }
                        }
                }
        } else {
@@ -2409,7 +2495,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR
        }
 }
-static u32
+static int
 SCPNT_TO_LOOKUP_IDX(struct scsi_cmnd *sc)
 {
        MPT_SCSI_HOST *hd;
diff --git a/drivers/message/fusion/mptspi.c b/drivers/message/fusion/mptspi.c
index 0a1ff762205f..e4cc3dd5fc9f 100644
--- a/drivers/message/fusion/mptspi.c
+++ b/drivers/message/fusion/mptspi.c
@@ -83,10 +83,6 @@ static int mpt_saf_te = MPTSCSIH_SAF_TE;
 module_param(mpt_saf_te, int, 0);
 MODULE_PARM_DESC(mpt_saf_te, " Force enabling SEP Processor: enable=1  (default=MPTSCSIH_SAF_TE=0)");
-static int mpt_pq_filter = 0;
-module_param(mpt_pq_filter, int, 0);
-MODULE_PARM_DESC(mpt_pq_filter, " Enable peripheral qualifier filter: enable=1  (default=0)");
 static void mptspi_write_offset(struct scsi_target *, int);
 static void mptspi_write_width(struct scsi_target *, int);
 static int mptspi_write_spi_device_pg1(struct scsi_target *,
@@ -1047,14 +1043,12 @@ mptspi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        hd->timer.function = mptscsih_timer_expired;
        ioc->spi_data.Saf_Te = mpt_saf_te;
-        hd->mpt_pq_filter = mpt_pq_filter;
        hd->negoNvram = MPT_SCSICFG_USE_NVRAM;
        ddvprintk((MYIOC_s_INFO_FMT
-                "saf_te %x mpt_pq_filter %x\n",
+                "saf_te %x\n",
                ioc->name,
-                mpt_saf_te,
+                mpt_saf_te));
-                mpt_pq_filter));
        ioc->spi_data.noQas = 0;
        init_waitqueue_head(&hd->scandv_waitq);
diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
index 36d511729f71..2146cf74425e 100644
--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
@@ -132,6 +132,7 @@ static int __init dummy_init_module(void)
        for (i = 0; i < numdummies && !err; i++)
                err = dummy_init_one(i); 
        if (err) { 
+                i--;
                while (--i >= 0)
                        dummy_free_one(i);
        }
diff --git a/drivers/net/e1000/e1000.h b/drivers/net/e1000/e1000.h
index f411bbb44f86..d304297c496c 100644
--- a/drivers/net/e1000/e1000.h
+++ b/drivers/net/e1000/e1000.h
@@ -110,6 +110,9 @@ struct e1000_adapter;
 #define E1000_MIN_RXD                       80
 #define E1000_MAX_82544_RXD               4096
+/* this is the size past which hardware will drop packets when setting LPE=0 */
+#define MAXIMUM_ETHERNET_VLAN_SIZE 1522
 /* Supported Rx Buffer Sizes */
 #define E1000_RXBUFFER_128   128    /* Used for packet split */
 #define E1000_RXBUFFER_256   256    /* Used for packet split */
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 6d3d41934503..da62db897426 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -36,7 +36,7 @@ static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
 #else
 #define DRIVERNAPI "-NAPI"
 #endif
-#define DRV_VERSION "7.1.9-k2"DRIVERNAPI
+#define DRV_VERSION "7.1.9-k4"DRIVERNAPI
 char e1000_driver_version[] = DRV_VERSION;
 static char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
@@ -1068,7 +1068,7 @@ e1000_sw_init(struct e1000_adapter *adapter)
        pci_read_config_word(pdev, PCI_COMMAND, &hw->pci_cmd_word);
-        adapter->rx_buffer_len = MAXIMUM_ETHERNET_FRAME_SIZE;
+        adapter->rx_buffer_len = MAXIMUM_ETHERNET_VLAN_SIZE;
        adapter->rx_ps_bsize0 = E1000_RXBUFFER_128;
        hw->max_frame_size = netdev->mtu +
                             ENET_HEADER_SIZE + ETHERNET_FCS_SIZE;
@@ -3148,7 +3148,6 @@ e1000_change_mtu(struct net_device *netdev, int new_mtu)
                adapter->rx_buffer_len = E1000_RXBUFFER_16384;
        /* adjust allocation if LPE protects us, and we aren't using SBP */
-#define MAXIMUM_ETHERNET_VLAN_SIZE 1522
        if (!adapter->hw.tbi_compatibility_on &&
            ((max_frame == MAXIMUM_ETHERNET_FRAME_SIZE) ||
             (max_frame == MAXIMUM_ETHERNET_VLAN_SIZE)))
@@ -3387,8 +3386,8 @@ e1000_intr(int irq, void *data, struct pt_regs *regs)
                E1000_WRITE_REG(hw, IMC, ~0);
                E1000_WRITE_FLUSH(hw);
        }
-        if (likely(netif_rx_schedule_prep(&adapter->polling_netdev[0])))
+        if (likely(netif_rx_schedule_prep(netdev)))
-                __netif_rx_schedule(&adapter->polling_netdev[0]);
+                __netif_rx_schedule(netdev);
        else
                e1000_irq_enable(adapter);
 #else
@@ -3431,34 +3430,26 @@ e1000_clean(struct net_device *poll_dev, int *budget)
 {
        struct e1000_adapter *adapter;
        int work_to_do = min(*budget, poll_dev->quota);
-        int tx_cleaned = 0, i = 0, work_done = 0;
+        int tx_cleaned = 0, work_done = 0;
        /* Must NOT use netdev_priv macro here. */
        adapter = poll_dev->priv;
        /* Keep link state information with original netdev */
-        if (!netif_carrier_ok(adapter->netdev))
+        if (!netif_carrier_ok(poll_dev))
                goto quit_polling;
-        while (poll_dev != &adapter->polling_netdev[i]) {
+        /* e1000_clean is called per-cpu.  This lock protects
-                i++;
+         * tx_ring[0] from being cleaned by multiple cpus
-                BUG_ON(i == adapter->num_rx_queues);
+         * simultaneously.  A failure obtaining the lock means
+         * tx_ring[0] is currently being cleaned anyway. */
+        if (spin_trylock(&adapter->tx_queue_lock)) {
+                tx_cleaned = e1000_clean_tx_irq(adapter,
+                                                &adapter->tx_ring[0]);
+                spin_unlock(&adapter->tx_queue_lock);
        }
-        if (likely(adapter->num_tx_queues == 1)) {
+        adapter->clean_rx(adapter, &adapter->rx_ring[0],
-                /* e1000_clean is called per-cpu.  This lock protects
-                 * tx_ring[0] from being cleaned by multiple cpus
-                 * simultaneously.  A failure obtaining the lock means
-                 * tx_ring[0] is currently being cleaned anyway. */
-                if (spin_trylock(&adapter->tx_queue_lock)) {
-                        tx_cleaned = e1000_clean_tx_irq(adapter,
-                                                        &adapter->tx_ring[0]);
-                        spin_unlock(&adapter->tx_queue_lock);
-                }
-        } else
-                tx_cleaned = e1000_clean_tx_irq(adapter, &adapter->tx_ring[i]);
-        adapter->clean_rx(adapter, &adapter->rx_ring[i],
                          &work_done, work_to_do);
        *budget -= work_done;
@@ -3466,7 +3457,7 @@ e1000_clean(struct net_device *poll_dev, int *budget)
        /* If no Tx and not enough Rx work done, exit the polling mode */
        if ((!tx_cleaned && (work_done == 0)) ||
-           !netif_running(adapter->netdev)) {
+           !netif_running(poll_dev)) {
 quit_polling:
                netif_rx_complete(poll_dev);
                e1000_irq_enable(adapter);
@@ -3681,6 +3672,9 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
                length = le16_to_cpu(rx_desc->length);
+                /* adjust length to remove Ethernet CRC */
+                length -= 4;
                if (unlikely(!(status & E1000_RXD_STAT_EOP))) {
                        /* All receives must fit into a single buffer */
                        E1000_DBG("%s: Receive packet consumed multiple"
@@ -3885,8 +3879,9 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                        pci_dma_sync_single_for_device(pdev,
                                ps_page_dma->ps_page_dma[0],
                                PAGE_SIZE, PCI_DMA_FROMDEVICE);
+                        /* remove the CRC */
+                        l1 -= 4;
                        skb_put(skb, l1);
-                        length += l1;
                        goto copydone;
                } /* if */
                }
@@ -3905,6 +3900,10 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                        skb->truesize += length;
                }
+                /* strip the ethernet crc, problem is we're using pages now so
+                 * this whole operation can get a little cpu intensive */
+                pskb_trim(skb, skb->len - 4);
 copydone:
                e1000_rx_checksum(adapter, staterr,
                                  le16_to_cpu(rx_desc->wb.lower.hi_dword.csum_ip.csum), skb);
@@ -4752,6 +4751,7 @@ static void
 e1000_netpoll(struct net_device *netdev)
 {
        struct e1000_adapter *adapter = netdev_priv(netdev);
        disable_irq(adapter->pdev->irq);
        e1000_intr(adapter->pdev->irq, netdev, NULL);
        e1000_clean_tx_irq(adapter, adapter->tx_ring);
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index 3a42afab5036..43e3f33ed5e2 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -271,6 +271,7 @@ static int __init ifb_init_module(void)
        for (i = 0; i < numifbs && !err; i++)
                err = ifb_init_one(i); 
        if (err) { 
+                i--;
                while (--i >= 0)
                        ifb_free_one(i);
        }
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index 07ca9480a6fe..c3e52c806b13 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -620,7 +620,7 @@ static int myri10ge_load_firmware(struct myri10ge_priv *mgp)
                return -ENXIO;
        }
        dev_info(&mgp->pdev->dev, "handoff confirmed\n");
-        myri10ge_dummy_rdma(mgp, mgp->tx.boundary != 4096);
+        myri10ge_dummy_rdma(mgp, 1);
        return 0;
 }
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 82200bfaa8ed..7de9a07b2ac2 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -516,10 +516,7 @@ static int skge_set_pauseparam(struct net_device *dev,
 /* Chip internal frequency for clock calculations */
 static inline u32 hwkhz(const struct skge_hw *hw)
 {
-        if (hw->chip_id == CHIP_ID_GENESIS)
+        return (hw->chip_id == CHIP_ID_GENESIS) ? 53125 : 78125;
-                return 53215; /* or:  53.125 MHz */
-        else
-                return 78215; /* or:  78.125 MHz */
 }
 /* Chip HZ to microseconds */
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index d98f28c34e5c..de91609ca112 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -50,7 +50,7 @@
 #include "sky2.h"
 #define DRV_NAME                "sky2"
-#define DRV_VERSION             "1.4"
+#define DRV_VERSION             "1.5"
 #define PFX                     DRV_NAME " "
 /*
@@ -2204,9 +2204,6 @@ static int sky2_poll(struct net_device *dev0, int *budget)
        int work_done = 0;
        u32 status = sky2_read32(hw, B0_Y2_SP_EISR);
-        if (!~status)
-                goto out;
        if (status & Y2_IS_HW_ERR)
                sky2_hw_intr(hw);
@@ -2243,7 +2240,7 @@ static int sky2_poll(struct net_device *dev0, int *budget)
        if (sky2_more_work(hw))
                return 1;
-out:
        netif_rx_complete(dev0);
        sky2_read32(hw, B0_Y2_SP_LISR);
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
index fb1d5a8a45cf..647f62e9707d 100644
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -84,7 +84,7 @@ MODULE_DEVICE_TABLE(pci, spider_net_pci_tbl);
 *
 * returns the content of the specified SMMIO register.
 */
-static u32
+static inline u32
 spider_net_read_reg(struct spider_net_card *card, u32 reg)
 {
        u32 value;
@@ -101,7 +101,7 @@ spider_net_read_reg(struct spider_net_card *card, u32 reg)
 * @reg: register to write to
 * @value: value to write into the specified SMMIO register
 */
-static void
+static inline void
 spider_net_write_reg(struct spider_net_card *card, u32 reg, u32 value)
 {
        value = cpu_to_le32(value);
@@ -259,39 +259,10 @@ spider_net_get_mac_address(struct net_device *netdev)
 *
 * returns the status as in the dmac_cmd_status field of the descriptor
 */
-static enum spider_net_descr_status
+static inline int
 spider_net_get_descr_status(struct spider_net_descr *descr)
 {
-        u32 cmd_status;
+        return descr->dmac_cmd_status & SPIDER_NET_DESCR_IND_PROC_MASK;
-        cmd_status = descr->dmac_cmd_status;
-        cmd_status >>= SPIDER_NET_DESCR_IND_PROC_SHIFT;
-        /* no need to mask out any bits, as cmd_status is 32 bits wide only
-         * (and unsigned) */
-        return cmd_status;
-}
-/**
- * spider_net_set_descr_status -- sets the status of a descriptor
- * @descr: descriptor to change
- * @status: status to set in the descriptor
- *
- * changes the status to the specified value. Doesn't change other bits
- * in the status
- */
-static void
-spider_net_set_descr_status(struct spider_net_descr *descr,
-                            enum spider_net_descr_status status)
-{
-        u32 cmd_status;
-        /* read the status */
-        cmd_status = descr->dmac_cmd_status;
-        /* clean the upper 4 bits */
-        cmd_status &= SPIDER_NET_DESCR_IND_PROC_MASKO;
-        /* add the status to it */
-        cmd_status |= ((u32)status)<<SPIDER_NET_DESCR_IND_PROC_SHIFT;
-        /* and write it back */
-        descr->dmac_cmd_status = cmd_status;
 }
 /**
@@ -328,24 +299,23 @@ spider_net_free_chain(struct spider_net_card *card,
 static int
 spider_net_init_chain(struct spider_net_card *card,
                       struct spider_net_descr_chain *chain,
-                       struct spider_net_descr *start_descr, int no)
+                       struct spider_net_descr *start_descr,
+                       int direction, int no)
 {
        int i;
        struct spider_net_descr *descr;
        dma_addr_t buf;
-        atomic_set(&card->rx_chain_refill,0);
        descr = start_descr;
        memset(descr, 0, sizeof(*descr) * no);
        /* set up the hardware pointers in each descriptor */
        for (i=0; i<no; i++, descr++) {
-                spider_net_set_descr_status(descr, SPIDER_NET_DESCR_NOT_IN_USE);
+                descr->dmac_cmd_status = SPIDER_NET_DESCR_NOT_IN_USE;
                buf = pci_map_single(card->pdev, descr,
                                     SPIDER_NET_DESCR_SIZE,
-                                     PCI_DMA_BIDIRECTIONAL);
+                                     direction);
                if (buf == DMA_ERROR_CODE)
                        goto iommu_error;
@@ -360,10 +330,11 @@ spider_net_init_chain(struct spider_net_card *card,
        start_descr->prev = descr-1;
        descr = start_descr;
-        for (i=0; i < no; i++, descr++) {
+        if (direction == PCI_DMA_FROMDEVICE)
-                descr->next_descr_addr = descr->next->bus_addr;
+                for (i=0; i < no; i++, descr++)
-        }
+                        descr->next_descr_addr = descr->next->bus_addr;
+        spin_lock_init(&chain->lock);
        chain->head = start_descr;
        chain->tail = start_descr;
@@ -375,7 +346,7 @@ iommu_error:
                if (descr->bus_addr)
                        pci_unmap_single(card->pdev, descr->bus_addr,
                                         SPIDER_NET_DESCR_SIZE,
-                                         PCI_DMA_BIDIRECTIONAL);
+                                         direction);
        return -ENOMEM;
 }
@@ -396,7 +367,7 @@ spider_net_free_rx_chain_contents(struct spider_net_card *card)
                        dev_kfree_skb(descr->skb);
                        pci_unmap_single(card->pdev, descr->buf_addr,
                                         SPIDER_NET_MAX_FRAME,
-                                         PCI_DMA_BIDIRECTIONAL);
+                                         PCI_DMA_FROMDEVICE);
                }
                descr = descr->next;
        }
@@ -446,15 +417,16 @@ spider_net_prepare_rx_descr(struct spider_net_card *card,
                skb_reserve(descr->skb, SPIDER_NET_RXBUF_ALIGN - offset);
        /* io-mmu-map the skb */
        buf = pci_map_single(card->pdev, descr->skb->data,
-                             SPIDER_NET_MAX_FRAME, PCI_DMA_BIDIRECTIONAL);
+                        SPIDER_NET_MAX_FRAME, PCI_DMA_FROMDEVICE);
        descr->buf_addr = buf;
        if (buf == DMA_ERROR_CODE) {
                dev_kfree_skb_any(descr->skb);
                if (netif_msg_rx_err(card) && net_ratelimit())
                        pr_err("Could not iommu-map rx buffer\n");
-                spider_net_set_descr_status(descr, SPIDER_NET_DESCR_NOT_IN_USE);
+                descr->dmac_cmd_status = SPIDER_NET_DESCR_NOT_IN_USE;
        } else {
-                descr->dmac_cmd_status = SPIDER_NET_DMAC_RX_CARDOWNED;
+                descr->dmac_cmd_status = SPIDER_NET_DESCR_CARDOWNED |
+                                         SPIDER_NET_DMAC_NOINTR_COMPLETE;
        }
        return error;
@@ -468,7 +440,7 @@ spider_net_prepare_rx_descr(struct spider_net_card *card,
 * chip by writing to the appropriate register. DMA is enabled in
 * spider_net_enable_rxdmac.
 */
-static void
+static inline void
 spider_net_enable_rxchtails(struct spider_net_card *card)
 {
        /* assume chain is aligned correctly */
@@ -483,7 +455,7 @@ spider_net_enable_rxchtails(struct spider_net_card *card)
 * spider_net_enable_rxdmac enables the DMA controller by setting RX_DMA_EN
 * in the GDADMACCNTR register
 */
-static void
+static inline void
 spider_net_enable_rxdmac(struct spider_net_card *card)
 {
        wmb();
@@ -500,23 +472,24 @@ spider_net_enable_rxdmac(struct spider_net_card *card)
 static void
 spider_net_refill_rx_chain(struct spider_net_card *card)
 {
-        struct spider_net_descr_chain *chain;
+        struct spider_net_descr_chain *chain = &card->rx_chain;
+        unsigned long flags;
-        chain = &card->rx_chain;
        /* one context doing the refill (and a second context seeing that
         * and omitting it) is ok. If called by NAPI, we'll be called again
         * as spider_net_decode_one_descr is called several times. If some
         * interrupt calls us, the NAPI is about to clean up anyway. */
-        if (atomic_inc_return(&card->rx_chain_refill) == 1)
+        if (!spin_trylock_irqsave(&chain->lock, flags))
-                while (spider_net_get_descr_status(chain->head) ==
+                return;
-                       SPIDER_NET_DESCR_NOT_IN_USE) {
-                        if (spider_net_prepare_rx_descr(card, chain->head))
+        while (spider_net_get_descr_status(chain->head) ==
-                                break;
+                        SPIDER_NET_DESCR_NOT_IN_USE) {
-                        chain->head = chain->head->next;
+                if (spider_net_prepare_rx_descr(card, chain->head))
-                }
+                        break;
+                chain->head = chain->head->next;
+        }
-        atomic_dec(&card->rx_chain_refill);
+        spin_unlock_irqrestore(&chain->lock, flags);
 }
 /**
@@ -554,111 +527,6 @@ error:
 }
 /**
- * spider_net_release_tx_descr - processes a used tx descriptor
- * @card: card structure
- * @descr: descriptor to release
- *
- * releases a used tx descriptor (unmapping, freeing of skb)
- */
-static void
-spider_net_release_tx_descr(struct spider_net_card *card,
-                            struct spider_net_descr *descr)
-{
-        struct sk_buff *skb;
-        /* unmap the skb */
-        skb = descr->skb;
-        pci_unmap_single(card->pdev, descr->buf_addr, skb->len,
-                         PCI_DMA_BIDIRECTIONAL);
-        dev_kfree_skb_any(skb);
-        /* set status to not used */
-        spider_net_set_descr_status(descr, SPIDER_NET_DESCR_NOT_IN_USE);
-}
-/**
- * spider_net_release_tx_chain - processes sent tx descriptors
- * @card: adapter structure
- * @brutal: if set, don't care about whether descriptor seems to be in use
- *
- * returns 0 if the tx ring is empty, otherwise 1.
- *
- * spider_net_release_tx_chain releases the tx descriptors that spider has
- * finished with (if non-brutal) or simply release tx descriptors (if brutal).
- * If some other context is calling this function, we return 1 so that we're
- * scheduled again (if we were scheduled) and will not loose initiative.
- */
-static int
-spider_net_release_tx_chain(struct spider_net_card *card, int brutal)
-{
-        struct spider_net_descr_chain *tx_chain = &card->tx_chain;
-        enum spider_net_descr_status status;
-        if (atomic_inc_return(&card->tx_chain_release) != 1) {
-                atomic_dec(&card->tx_chain_release);
-                return 1;
-        }
-        for (;;) {
-                status = spider_net_get_descr_status(tx_chain->tail);
-                switch (status) {
-                case SPIDER_NET_DESCR_CARDOWNED:
-                        if (!brutal)
-                                goto out;
-                        /* fallthrough, if we release the descriptors
-                         * brutally (then we don't care about
-                         * SPIDER_NET_DESCR_CARDOWNED) */
-                case SPIDER_NET_DESCR_RESPONSE_ERROR:
-                case SPIDER_NET_DESCR_PROTECTION_ERROR:
-                case SPIDER_NET_DESCR_FORCE_END:
-                        if (netif_msg_tx_err(card))
-                                pr_err("%s: forcing end of tx descriptor "
-                                       "with status x%02x\n",
-                                       card->netdev->name, status);
-                        card->netdev_stats.tx_dropped++;
-                        break;
-                case SPIDER_NET_DESCR_COMPLETE:
-                        card->netdev_stats.tx_packets++;
-                        card->netdev_stats.tx_bytes +=
-                                tx_chain->tail->skb->len;
-                        break;
-                default: /* any other value (== SPIDER_NET_DESCR_NOT_IN_USE) */
-                        goto out;
-                }
-                spider_net_release_tx_descr(card, tx_chain->tail);
-                tx_chain->tail = tx_chain->tail->next;
-        }
-out:
-        atomic_dec(&card->tx_chain_release);
-        netif_wake_queue(card->netdev);
-        if (status == SPIDER_NET_DESCR_CARDOWNED)
-                return 1;
-        return 0;
-}
-/**
- * spider_net_cleanup_tx_ring - cleans up the TX ring
- * @card: card structure
- *
- * spider_net_cleanup_tx_ring is called by the tx_timer (as we don't use
- * interrupts to cleanup our TX ring) and returns sent packets to the stack
- * by freeing them
- */
-static void
-spider_net_cleanup_tx_ring(struct spider_net_card *card)
-{
-        if ( (spider_net_release_tx_chain(card, 0)) &&
-              (card->netdev->flags & IFF_UP) ) {
-                mod_timer(&card->tx_timer, jiffies + SPIDER_NET_TX_TIMER);
-        }
-}
-/**
 * spider_net_get_multicast_hash - generates hash for multicast filter table
 * @addr: multicast address
 *
@@ -761,97 +629,6 @@ spider_net_disable_rxdmac(struct spider_net_card *card)
 }
 /**
- * spider_net_stop - called upon ifconfig down
- * @netdev: interface device structure
- *
- * always returns 0
- */
-int
-spider_net_stop(struct net_device *netdev)
-{
-        struct spider_net_card *card = netdev_priv(netdev);
-        tasklet_kill(&card->rxram_full_tl);
-        netif_poll_disable(netdev);
-        netif_carrier_off(netdev);
-        netif_stop_queue(netdev);
-        del_timer_sync(&card->tx_timer);
-        /* disable/mask all interrupts */
-        spider_net_write_reg(card, SPIDER_NET_GHIINT0MSK, 0);
-        spider_net_write_reg(card, SPIDER_NET_GHIINT1MSK, 0);
-        spider_net_write_reg(card, SPIDER_NET_GHIINT2MSK, 0);
-        /* free_irq(netdev->irq, netdev);*/
-        free_irq(to_pci_dev(netdev->class_dev.dev)->irq, netdev);
-        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
-                             SPIDER_NET_DMA_TX_FEND_VALUE);
-        /* turn off DMA, force end */
-        spider_net_disable_rxdmac(card);
-        /* release chains */
-        spider_net_release_tx_chain(card, 1);
-        spider_net_free_chain(card, &card->tx_chain);
-        spider_net_free_chain(card, &card->rx_chain);
-        return 0;
-}
-/**
- * spider_net_get_next_tx_descr - returns the next available tx descriptor
- * @card: device structure to get descriptor from
- *
- * returns the address of the next descriptor, or NULL if not available.
- */
-static struct spider_net_descr *
-spider_net_get_next_tx_descr(struct spider_net_card *card)
-{
-        /* check, if head points to not-in-use descr */
-        if ( spider_net_get_descr_status(card->tx_chain.head) ==
-             SPIDER_NET_DESCR_NOT_IN_USE ) {
-                return card->tx_chain.head;
-        } else {
-                return NULL;
-        }
-}
-/**
- * spider_net_set_txdescr_cmdstat - sets the tx descriptor command field
- * @descr: descriptor structure to fill out
- * @skb: packet to consider
- *
- * fills out the command and status field of the descriptor structure,
- * depending on hardware checksum settings.
- */
-static void
-spider_net_set_txdescr_cmdstat(struct spider_net_descr *descr,
-                               struct sk_buff *skb)
-{
-        /* make sure the other fields in the descriptor are written */
-        wmb();
-        if (skb->ip_summed != CHECKSUM_HW) {
-                descr->dmac_cmd_status = SPIDER_NET_DMAC_CMDSTAT_NOCS;
-                return;
-        }
-        /* is packet ip?
-         * if yes: tcp? udp? */
-        if (skb->protocol == htons(ETH_P_IP)) {
-                if (skb->nh.iph->protocol == IPPROTO_TCP)
-                        descr->dmac_cmd_status = SPIDER_NET_DMAC_CMDSTAT_TCPCS;
-                else if (skb->nh.iph->protocol == IPPROTO_UDP)
-                        descr->dmac_cmd_status = SPIDER_NET_DMAC_CMDSTAT_UDPCS;
-                else /* the stack should checksum non-tcp and non-udp
-                        packets on his own: NETIF_F_IP_CSUM */
-                        descr->dmac_cmd_status = SPIDER_NET_DMAC_CMDSTAT_NOCS;
-        }
-}
-/**
 * spider_net_prepare_tx_descr - fill tx descriptor with skb data
 * @card: card structure
 * @descr: descriptor structure to fill out
@@ -864,13 +641,12 @@ spider_net_set_txdescr_cmdstat(struct spider_net_descr *descr,
 */
 static int
 spider_net_prepare_tx_descr(struct spider_net_card *card,
-                            struct spider_net_descr *descr,
                            struct sk_buff *skb)
 {
+        struct spider_net_descr *descr = card->tx_chain.head;
        dma_addr_t buf;
-        buf = pci_map_single(card->pdev, skb->data,
+        buf = pci_map_single(card->pdev, skb->data, skb->len, PCI_DMA_TODEVICE);
-                             skb->len, PCI_DMA_BIDIRECTIONAL);
        if (buf == DMA_ERROR_CODE) {
                if (netif_msg_tx_err(card) && net_ratelimit())
                        pr_err("could not iommu-map packet (%p, %i). "
@@ -880,10 +656,101 @@ spider_net_prepare_tx_descr(struct spider_net_card *card,
        descr->buf_addr = buf;
        descr->buf_size = skb->len;
+        descr->next_descr_addr = 0;
        descr->skb = skb;
        descr->data_status = 0;
-        spider_net_set_txdescr_cmdstat(descr,skb);
+        descr->dmac_cmd_status =
+                        SPIDER_NET_DESCR_CARDOWNED | SPIDER_NET_DMAC_NOCS;
+        if (skb->protocol == htons(ETH_P_IP))
+                switch (skb->nh.iph->protocol) {
+                case IPPROTO_TCP:
+                        descr->dmac_cmd_status |= SPIDER_NET_DMAC_TCP;
+                        break;
+                case IPPROTO_UDP:
+                        descr->dmac_cmd_status |= SPIDER_NET_DMAC_UDP;
+                        break;
+                }
+        descr->prev->next_descr_addr = descr->bus_addr;
+        return 0;
+}
+/**
+ * spider_net_release_tx_descr - processes a used tx descriptor
+ * @card: card structure
+ * @descr: descriptor to release
+ *
+ * releases a used tx descriptor (unmapping, freeing of skb)
+ */
+static inline void
+spider_net_release_tx_descr(struct spider_net_card *card)
+{
+        struct spider_net_descr *descr = card->tx_chain.tail;
+        struct sk_buff *skb;
+        card->tx_chain.tail = card->tx_chain.tail->next;
+        descr->dmac_cmd_status |= SPIDER_NET_DESCR_NOT_IN_USE;
+        /* unmap the skb */
+        skb = descr->skb;
+        pci_unmap_single(card->pdev, descr->buf_addr, skb->len,
+                        PCI_DMA_TODEVICE);
+        dev_kfree_skb_any(skb);
+}
+/**
+ * spider_net_release_tx_chain - processes sent tx descriptors
+ * @card: adapter structure
+ * @brutal: if set, don't care about whether descriptor seems to be in use
+ *
+ * returns 0 if the tx ring is empty, otherwise 1.
+ *
+ * spider_net_release_tx_chain releases the tx descriptors that spider has
+ * finished with (if non-brutal) or simply release tx descriptors (if brutal).
+ * If some other context is calling this function, we return 1 so that we're
+ * scheduled again (if we were scheduled) and will not loose initiative.
+ */
+static int
+spider_net_release_tx_chain(struct spider_net_card *card, int brutal)
+{
+        struct spider_net_descr_chain *chain = &card->tx_chain;
+        int status;
+        spider_net_read_reg(card, SPIDER_NET_GDTDMACCNTR);
+        while (chain->tail != chain->head) {
+                status = spider_net_get_descr_status(chain->tail);
+                switch (status) {
+                case SPIDER_NET_DESCR_COMPLETE:
+                        card->netdev_stats.tx_packets++;
+                        card->netdev_stats.tx_bytes += chain->tail->skb->len;
+                        break;
+                case SPIDER_NET_DESCR_CARDOWNED:
+                        if (!brutal)
+                                return 1;
+                        /* fallthrough, if we release the descriptors
+                         * brutally (then we don't care about
+                         * SPIDER_NET_DESCR_CARDOWNED) */
+                case SPIDER_NET_DESCR_RESPONSE_ERROR:
+                case SPIDER_NET_DESCR_PROTECTION_ERROR:
+                case SPIDER_NET_DESCR_FORCE_END:
+                        if (netif_msg_tx_err(card))
+                                pr_err("%s: forcing end of tx descriptor "
+                                       "with status x%02x\n",
+                                       card->netdev->name, status);
+                        card->netdev_stats.tx_errors++;
+                        break;
+                default:
+                        card->netdev_stats.tx_dropped++;
+                        return 1;
+                }
+                spider_net_release_tx_descr(card);
+        }
        return 0;
 }
@@ -896,18 +763,32 @@ spider_net_prepare_tx_descr(struct spider_net_card *card,
 * spider_net_kick_tx_dma writes the current tx chain head as start address
 * of the tx descriptor chain and enables the transmission DMA engine
 */
-static void
+static inline void
-spider_net_kick_tx_dma(struct spider_net_card *card,
+spider_net_kick_tx_dma(struct spider_net_card *card)
-                       struct spider_net_descr *descr)
 {
-        /* this is the only descriptor in the output chain.
+        struct spider_net_descr *descr;
-         * Enable TX DMA */
-        spider_net_write_reg(card, SPIDER_NET_GDTDCHA,
+        if (spider_net_read_reg(card, SPIDER_NET_GDTDMACCNTR) &
-                             descr->bus_addr);
+                        SPIDER_NET_TX_DMA_EN)
+                goto out;
-        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
+        descr = card->tx_chain.tail;
-                             SPIDER_NET_DMA_TX_VALUE);
+        for (;;) {
+                if (spider_net_get_descr_status(descr) ==
+                                SPIDER_NET_DESCR_CARDOWNED) {
+                        spider_net_write_reg(card, SPIDER_NET_GDTDCHA,
+                                        descr->bus_addr);
+                        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
+                                        SPIDER_NET_DMA_TX_VALUE);
+                        break;
+                }
+                if (descr == card->tx_chain.head)
+                        break;
+                descr = descr->next;
+        }
+out:
+        mod_timer(&card->tx_timer, jiffies + SPIDER_NET_TX_TIMER);
 }
 /**
@@ -915,47 +796,69 @@ spider_net_kick_tx_dma(struct spider_net_card *card,
 * @skb: packet to send out
 * @netdev: interface device structure
 *
- * returns 0 on success, <0 on failure
+ * returns 0 on success, !0 on failure
 */
 static int
 spider_net_xmit(struct sk_buff *skb, struct net_device *netdev)
 {
        struct spider_net_card *card = netdev_priv(netdev);
-        struct spider_net_descr *descr;
+        struct spider_net_descr_chain *chain = &card->tx_chain;
+        struct spider_net_descr *descr = chain->head;
+        unsigned long flags;
        int result;
+        spin_lock_irqsave(&chain->lock, flags);
        spider_net_release_tx_chain(card, 0);
-        descr = spider_net_get_next_tx_descr(card);
+        if (chain->head->next == chain->tail->prev) {
+                card->netdev_stats.tx_dropped++;
+                result = NETDEV_TX_LOCKED;
+                goto out;
+        }
-        if (!descr)
+        if (spider_net_get_descr_status(descr) != SPIDER_NET_DESCR_NOT_IN_USE) {
-                goto error;
+                result = NETDEV_TX_LOCKED;
+                goto out;
+        }
-        result = spider_net_prepare_tx_descr(card, descr, skb);
+        if (spider_net_prepare_tx_descr(card, skb) != 0) {
-        if (result)
+                card->netdev_stats.tx_dropped++;
-                goto error;
+                result = NETDEV_TX_BUSY;
+                goto out;
+        }
+        result = NETDEV_TX_OK;
+        spider_net_kick_tx_dma(card);
        card->tx_chain.head = card->tx_chain.head->next;
-        if (spider_net_get_descr_status(descr->prev) !=
+out:
-            SPIDER_NET_DESCR_CARDOWNED) {
+        spin_unlock_irqrestore(&chain->lock, flags);
-                /* make sure the current descriptor is in memory. Then
+        netif_wake_queue(netdev);
-                 * kicking it on again makes sense, if the previous is not
+        return result;
-                 * card-owned anymore. Check the previous descriptor twice
+}
-                 * to omit an mb() in heavy traffic cases */
-                mb();
-                if (spider_net_get_descr_status(descr->prev) !=
-                    SPIDER_NET_DESCR_CARDOWNED)
-                        spider_net_kick_tx_dma(card, descr);
-        }
-        mod_timer(&card->tx_timer, jiffies + SPIDER_NET_TX_TIMER);
+/**
+ * spider_net_cleanup_tx_ring - cleans up the TX ring
+ * @card: card structure
+ *
+ * spider_net_cleanup_tx_ring is called by the tx_timer (as we don't use
+ * interrupts to cleanup our TX ring) and returns sent packets to the stack
+ * by freeing them
+ */
+static void
+spider_net_cleanup_tx_ring(struct spider_net_card *card)
+{
+        unsigned long flags;
-        return NETDEV_TX_OK;
+        spin_lock_irqsave(&card->tx_chain.lock, flags);
-error:
+        if ((spider_net_release_tx_chain(card, 0) != 0) &&
-        card->netdev_stats.tx_dropped++;
+            (card->netdev->flags & IFF_UP))
-        return NETDEV_TX_BUSY;
+                spider_net_kick_tx_dma(card);
+        spin_unlock_irqrestore(&card->tx_chain.lock, flags);
 }
 /**
@@ -1002,7 +905,7 @@ spider_net_pass_skb_up(struct spider_net_descr *descr,
        /* unmap descriptor */
        pci_unmap_single(card->pdev, descr->buf_addr, SPIDER_NET_MAX_FRAME,
-                         PCI_DMA_BIDIRECTIONAL);
+                        PCI_DMA_FROMDEVICE);
        /* the cases we'll throw away the packet immediately */
        if (data_error & SPIDER_NET_DESTROY_RX_FLAGS) {
@@ -1067,14 +970,11 @@ spider_net_pass_skb_up(struct spider_net_descr *descr,
 static int
 spider_net_decode_one_descr(struct spider_net_card *card, int napi)
 {
-        enum spider_net_descr_status status;
+        struct spider_net_descr_chain *chain = &card->rx_chain;
-        struct spider_net_descr *descr;
+        struct spider_net_descr *descr = chain->tail;
-        struct spider_net_descr_chain *chain;
+        int status;
        int result;
-        chain = &card->rx_chain;
-        descr = chain->tail;
        status = spider_net_get_descr_status(descr);
        if (status == SPIDER_NET_DESCR_CARDOWNED) {
@@ -1103,7 +1003,7 @@ spider_net_decode_one_descr(struct spider_net_card *card, int napi)
                               card->netdev->name, status);
                card->netdev_stats.rx_dropped++;
                pci_unmap_single(card->pdev, descr->buf_addr,
-                                 SPIDER_NET_MAX_FRAME, PCI_DMA_BIDIRECTIONAL);
+                                SPIDER_NET_MAX_FRAME, PCI_DMA_FROMDEVICE);
                dev_kfree_skb_irq(descr->skb);
                goto refill;
        }
@@ -1119,7 +1019,7 @@ spider_net_decode_one_descr(struct spider_net_card *card, int napi)
        /* ok, we've got a packet in descr */
        result = spider_net_pass_skb_up(descr, card, napi);
 refill:
-        spider_net_set_descr_status(descr, SPIDER_NET_DESCR_NOT_IN_USE);
+        descr->dmac_cmd_status = SPIDER_NET_DESCR_NOT_IN_USE;
        /* change the descriptor state: */
        if (!napi)
                spider_net_refill_rx_chain(card);
@@ -1291,21 +1191,6 @@ spider_net_set_mac(struct net_device *netdev, void *p)
 }
 /**
- * spider_net_enable_txdmac - enables a TX DMA controller
- * @card: card structure
- *
- * spider_net_enable_txdmac enables the TX DMA controller by setting the
- * descriptor chain tail address
- */
-static void
-spider_net_enable_txdmac(struct spider_net_card *card)
-{
-        /* assume chain is aligned correctly */
-        spider_net_write_reg(card, SPIDER_NET_GDTDCHA,
-                             card->tx_chain.tail->bus_addr);
-}
-/**
 * spider_net_handle_rxram_full - cleans up RX ring upon RX RAM full interrupt
 * @card: card structure
 *
@@ -1653,7 +1538,6 @@ spider_net_enable_card(struct spider_net_card *card)
                { SPIDER_NET_GMRWOLCTRL, 0 },
                { SPIDER_NET_GTESTMD, 0x10000000 },
                { SPIDER_NET_GTTQMSK, 0x00400040 },
-                { SPIDER_NET_GTESTMD, 0 },
                { SPIDER_NET_GMACINTEN, 0 },
@@ -1692,9 +1576,6 @@ spider_net_enable_card(struct spider_net_card *card)
        spider_net_write_reg(card, SPIDER_NET_GRXDMAEN, SPIDER_NET_WOL_VALUE);
-        /* set chain tail adress for TX chain */
-        spider_net_enable_txdmac(card);
        spider_net_write_reg(card, SPIDER_NET_GMACLENLMT,
                             SPIDER_NET_LENLMT_VALUE);
        spider_net_write_reg(card, SPIDER_NET_GMACMODE,
@@ -1709,6 +1590,9 @@ spider_net_enable_card(struct spider_net_card *card)
                             SPIDER_NET_INT1_MASK_VALUE);
        spider_net_write_reg(card, SPIDER_NET_GHIINT2MSK,
                             SPIDER_NET_INT2_MASK_VALUE);
+        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
+                             SPIDER_NET_GDTDCEIDIS);
 }
 /**
@@ -1728,10 +1612,12 @@ spider_net_open(struct net_device *netdev)
        result = -ENOMEM;
        if (spider_net_init_chain(card, &card->tx_chain,
-                          card->descr, tx_descriptors))
+                        card->descr,
+                        PCI_DMA_TODEVICE, tx_descriptors))
                goto alloc_tx_failed;
        if (spider_net_init_chain(card, &card->rx_chain,
-                          card->descr + tx_descriptors, rx_descriptors))
+                        card->descr + tx_descriptors,
+                        PCI_DMA_FROMDEVICE, rx_descriptors))
                goto alloc_rx_failed;
        /* allocate rx skbs */
@@ -1938,7 +1824,7 @@ spider_net_workaround_rxramfull(struct spider_net_card *card)
        /* empty sequencer data */
        for (sequencer = 0; sequencer < SPIDER_NET_FIRMWARE_SEQS;
             sequencer++) {
-                spider_net_write_reg(card, SPIDER_NET_GSnPRGDAT +
+                spider_net_write_reg(card, SPIDER_NET_GSnPRGADR +
                                     sequencer * 8, 0x0);
                for (i = 0; i < SPIDER_NET_FIRMWARE_SEQWORDS; i++) {
                        spider_net_write_reg(card, SPIDER_NET_GSnPRGDAT +
@@ -1955,6 +1841,49 @@ spider_net_workaround_rxramfull(struct spider_net_card *card)
 }
 /**
+ * spider_net_stop - called upon ifconfig down
+ * @netdev: interface device structure
+ *
+ * always returns 0
+ */
+int
+spider_net_stop(struct net_device *netdev)
+{
+        struct spider_net_card *card = netdev_priv(netdev);
+        tasklet_kill(&card->rxram_full_tl);
+        netif_poll_disable(netdev);
+        netif_carrier_off(netdev);
+        netif_stop_queue(netdev);
+        del_timer_sync(&card->tx_timer);
+        /* disable/mask all interrupts */
+        spider_net_write_reg(card, SPIDER_NET_GHIINT0MSK, 0);
+        spider_net_write_reg(card, SPIDER_NET_GHIINT1MSK, 0);
+        spider_net_write_reg(card, SPIDER_NET_GHIINT2MSK, 0);
+        /* free_irq(netdev->irq, netdev);*/
+        free_irq(to_pci_dev(netdev->class_dev.dev)->irq, netdev);
+        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
+                             SPIDER_NET_DMA_TX_FEND_VALUE);
+        /* turn off DMA, force end */
+        spider_net_disable_rxdmac(card);
+        /* release chains */
+        if (spin_trylock(&card->tx_chain.lock)) {
+                spider_net_release_tx_chain(card, 1);
+                spin_unlock(&card->tx_chain.lock);
+        }
+        spider_net_free_chain(card, &card->tx_chain);
+        spider_net_free_chain(card, &card->rx_chain);
+        return 0;
+}
+/**
 * spider_net_tx_timeout_task - task scheduled by the watchdog timeout
 * function (to be called not under interrupt status)
 * @data: data, is interface device structure
@@ -1982,7 +1911,7 @@ spider_net_tx_timeout_task(void *data)
                goto out;
        spider_net_open(netdev);
-        spider_net_kick_tx_dma(card, card->tx_chain.head);
+        spider_net_kick_tx_dma(card);
        netif_device_attach(netdev);
 out:
@@ -2065,7 +1994,6 @@ spider_net_setup_netdev(struct spider_net_card *card)
        pci_set_drvdata(card->pdev, netdev);
-        atomic_set(&card->tx_chain_release,0);
        card->rxram_full_tl.data = (unsigned long) card;
        card->rxram_full_tl.func =
                (void (*)(unsigned long)) spider_net_handle_rxram_full;
@@ -2079,7 +2007,7 @@ spider_net_setup_netdev(struct spider_net_card *card)
        spider_net_setup_netdev_ops(netdev);
-        netdev->features = NETIF_F_HW_CSUM;
+        netdev->features = NETIF_F_HW_CSUM | NETIF_F_LLTX;
        /* some time: NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX |
         *              NETIF_F_HW_VLAN_FILTER */
diff --git a/drivers/net/spider_net.h b/drivers/net/spider_net.h
index 3b8d951cf73c..f6dcf180ae3d 100644
--- a/drivers/net/spider_net.h
+++ b/drivers/net/spider_net.h
@@ -208,7 +208,10 @@ extern char spider_net_driver_name[];
 #define SPIDER_NET_DMA_RX_VALUE         0x80000000
 #define SPIDER_NET_DMA_RX_FEND_VALUE    0x00030003
 /* to set TX_DMA_EN */
-#define SPIDER_NET_DMA_TX_VALUE         0x80000000
+#define SPIDER_NET_TX_DMA_EN            0x80000000
+#define SPIDER_NET_GDTDCEIDIS           0x00000002
+#define SPIDER_NET_DMA_TX_VALUE         SPIDER_NET_TX_DMA_EN | \
+                                        SPIDER_NET_GDTDCEIDIS
 #define SPIDER_NET_DMA_TX_FEND_VALUE    0x00030003
 /* SPIDER_NET_UA_DESCR_VALUE is OR'ed with the unicast address */
@@ -329,55 +332,23 @@ enum spider_net_int2_status {
                                  (~SPIDER_NET_TXINT) & \
                                  (~SPIDER_NET_RXINT) )
-#define SPIDER_NET_GPREXEC              0x80000000
+#define SPIDER_NET_GPREXEC                      0x80000000
-#define SPIDER_NET_GPRDAT_MASK          0x0000ffff
+#define SPIDER_NET_GPRDAT_MASK                  0x0000ffff
-/* descriptor bits
+#define SPIDER_NET_DMAC_NOINTR_COMPLETE         0x00800000
- *
+#define SPIDER_NET_DMAC_NOCS                    0x00040000
- * 1010                                 descriptor ready
+#define SPIDER_NET_DMAC_TCP                     0x00020000
- *     0                                descr in middle of chain
+#define SPIDER_NET_DMAC_UDP                     0x00030000
- *      000                             fixed to 0
+#define SPIDER_NET_TXDCEST                      0x08000000
- *
- *         0                            no interrupt on completion
+#define SPIDER_NET_DESCR_IND_PROC_MASK          0xF0000000
- *          000                         fixed to 0
+#define SPIDER_NET_DESCR_COMPLETE               0x00000000 /* used in rx and tx */
- *             1                        no ipsec processing
+#define SPIDER_NET_DESCR_RESPONSE_ERROR         0x10000000 /* used in rx and tx */
- *              1                       last descriptor for this frame
+#define SPIDER_NET_DESCR_PROTECTION_ERROR       0x20000000 /* used in rx and tx */
- *               00                     no checksum
+#define SPIDER_NET_DESCR_FRAME_END              0x40000000 /* used in rx */
- *               10                     tcp checksum
+#define SPIDER_NET_DESCR_FORCE_END              0x50000000 /* used in rx and tx */
- *               11                     udp checksum
+#define SPIDER_NET_DESCR_CARDOWNED              0xA0000000 /* used in rx and tx */
- *
+#define SPIDER_NET_DESCR_NOT_IN_USE             0xF0000000
- *                 00                   fixed to 0
- *                   0                  fixed to 0
- *                    0                 no interrupt on response errors
- *                     0                no interrupt on invalid descr
- *                      0               no interrupt on dma process termination
- *                       0              no interrupt on descr chain end
- *                        0             no interrupt on descr complete
- *
- *                         000          fixed to 0
- *                            0         response error interrupt status
- *                             0        invalid descr status
- *                              0       dma termination status
- *                               0      descr chain end status
- *                                0     descr complete status */
-#define SPIDER_NET_DMAC_CMDSTAT_NOCS    0xa00c0000
-#define SPIDER_NET_DMAC_CMDSTAT_TCPCS   0xa00e0000
-#define SPIDER_NET_DMAC_CMDSTAT_UDPCS   0xa00f0000
-#define SPIDER_NET_DESCR_IND_PROC_SHIFT 28
-#define SPIDER_NET_DESCR_IND_PROC_MASKO 0x0fffffff
-/* descr ready, descr is in middle of chain, get interrupt on completion */
-#define SPIDER_NET_DMAC_RX_CARDOWNED    0xa0800000
-enum spider_net_descr_status {
-        SPIDER_NET_DESCR_COMPLETE               = 0x00, /* used in rx and tx */
-        SPIDER_NET_DESCR_RESPONSE_ERROR         = 0x01, /* used in rx and tx */
-        SPIDER_NET_DESCR_PROTECTION_ERROR       = 0x02, /* used in rx and tx */
-        SPIDER_NET_DESCR_FRAME_END              = 0x04, /* used in rx */
-        SPIDER_NET_DESCR_FORCE_END              = 0x05, /* used in rx and tx */
-        SPIDER_NET_DESCR_CARDOWNED              = 0x0a, /* used in rx and tx */
-        SPIDER_NET_DESCR_NOT_IN_USE /* any other value */
-};
 struct spider_net_descr {
        /* as defined by the hardware */
@@ -398,7 +369,7 @@ struct spider_net_descr {
 } __attribute__((aligned(32)));
 struct spider_net_descr_chain {
-        /* we walk from tail to head */
+        spinlock_t lock;
        struct spider_net_descr *head;
        struct spider_net_descr *tail;
 };
@@ -453,8 +424,6 @@ struct spider_net_card {
        struct spider_net_descr_chain tx_chain;
        struct spider_net_descr_chain rx_chain;
-        atomic_t rx_chain_refill;
-        atomic_t tx_chain_release;
        struct net_device_stats netdev_stats;
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index 8673fd4c08c7..c6f5bc3c042f 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -3255,12 +3255,7 @@ static void __devexit happy_meal_pci_remove(struct pci_dev *pdev)
 }
 static struct pci_device_id happymeal_pci_ids[] = {
-        {
+        { PCI_DEVICE(PCI_VENDOR_ID_SUN, PCI_DEVICE_ID_SUN_HAPPYMEAL) },
-          .vendor       = PCI_VENDOR_ID_SUN,
-          .device       = PCI_DEVICE_ID_SUN_HAPPYMEAL,
-          .subvendor    = PCI_ANY_ID,
-          .subdevice    = PCI_ANY_ID,
-        },
        { }                     /* Terminating entry */
 };
@@ -3275,7 +3270,7 @@ static struct pci_driver hme_pci_driver = {
 static int __init happy_meal_pci_init(void)
 {
-        return pci_module_init(&hme_pci_driver);
+        return pci_register_driver(&hme_pci_driver);
 }
 static void happy_meal_pci_exit(void)
diff --git a/drivers/net/sunlance.c b/drivers/net/sunlance.c
index 1ef9fd39a79a..0e3fdf7c6dd3 100644
--- a/drivers/net/sunlance.c
+++ b/drivers/net/sunlance.c
@@ -1537,7 +1537,7 @@ static int __init sparc_lance_init(void)
 {
        if ((idprom->id_machtype == (SM_SUN4|SM_4_330)) ||
            (idprom->id_machtype == (SM_SUN4|SM_4_470))) {
-                memset(&sun4_sdev, 0, sizeof(sdev));
+                memset(&sun4_sdev, 0, sizeof(struct sbus_dev));
                sun4_sdev.reg_addrs[0].phys_addr = sun4_eth_physaddr;
                sun4_sdev.irqs[0] = 6;
                return sparc_lance_probe_one(&sun4_sdev, NULL, NULL);
@@ -1547,16 +1547,16 @@ static int __init sparc_lance_init(void)
 static int __exit sunlance_sun4_remove(void)
 {
-        struct lance_private *lp = dev_get_drvdata(&sun4_sdev->dev);
+        struct lance_private *lp = dev_get_drvdata(&sun4_sdev.ofdev.dev);
        struct net_device *net_dev = lp->dev;
        unregister_netdevice(net_dev);
-        lance_free_hwresources(root_lance_dev);
+        lance_free_hwresources(lp);
        free_netdev(net_dev);
-        dev_set_drvdata(&sun4_sdev->dev, NULL);
+        dev_set_drvdata(&sun4_sdev.ofdev.dev, NULL);
        return 0;
 }
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index ce6f3be86da0..1b8138f641e3 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -68,8 +68,8 @@
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.62"
+#define DRV_MODULE_VERSION      "3.63"
-#define DRV_MODULE_RELDATE      "June 30, 2006"
+#define DRV_MODULE_RELDATE      "July 25, 2006"
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -3590,6 +3590,28 @@ static irqreturn_t tg3_test_isr(int irq, void *dev_id,
 static int tg3_init_hw(struct tg3 *, int);
 static int tg3_halt(struct tg3 *, int, int);
+/* Restart hardware after configuration changes, self-test, etc.
+ * Invoked with tp->lock held.
+ */
+static int tg3_restart_hw(struct tg3 *tp, int reset_phy)
+{
+        int err;
+        err = tg3_init_hw(tp, reset_phy);
+        if (err) {
+                printk(KERN_ERR PFX "%s: Failed to re-initialize device, "
+                       "aborting.\n", tp->dev->name);
+                tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+                tg3_full_unlock(tp);
+                del_timer_sync(&tp->timer);
+                tp->irq_sync = 0;
+                netif_poll_enable(tp->dev);
+                dev_close(tp->dev);
+                tg3_full_lock(tp, 0);
+        }
+        return err;
+}
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void tg3_poll_controller(struct net_device *dev)
 {
@@ -3630,13 +3652,15 @@ static void tg3_reset_task(void *_data)
        }
        tg3_halt(tp, RESET_KIND_SHUTDOWN, 0);
-        tg3_init_hw(tp, 1);
+        if (tg3_init_hw(tp, 1))
+                goto out;
        tg3_netif_start(tp);
        if (restart_timer)
                mod_timer(&tp->timer, jiffies + 1);
+out:
        tp->tg3_flags &= ~TG3_FLAG_IN_RESET_TASK;
        tg3_full_unlock(tp);
@@ -4124,6 +4148,7 @@ static inline void tg3_set_mtu(struct net_device *dev, struct tg3 *tp,
 static int tg3_change_mtu(struct net_device *dev, int new_mtu)
 {
        struct tg3 *tp = netdev_priv(dev);
+        int err;
        if (new_mtu < TG3_MIN_MTU || new_mtu > TG3_MAX_MTU(tp))
                return -EINVAL;
@@ -4144,13 +4169,14 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
        tg3_set_mtu(dev, tp, new_mtu);
-        tg3_init_hw(tp, 0);
+        err = tg3_restart_hw(tp, 0);
-        tg3_netif_start(tp);
+        if (!err)
+                tg3_netif_start(tp);
        tg3_full_unlock(tp);
-        return 0;
+        return err;
 }
 /* Free up pending packets in all rx/tx rings.
@@ -4232,7 +4258,7 @@ static void tg3_free_rings(struct tg3 *tp)
 * end up in the driver.  tp->{tx,}lock are held and thus
 * we may not sleep.
 */
-static void tg3_init_rings(struct tg3 *tp)
+static int tg3_init_rings(struct tg3 *tp)
 {
        u32 i;
@@ -4281,18 +4307,38 @@ static void tg3_init_rings(struct tg3 *tp)
        /* Now allocate fresh SKBs for each rx ring. */
        for (i = 0; i < tp->rx_pending; i++) {
-                if (tg3_alloc_rx_skb(tp, RXD_OPAQUE_RING_STD,
+                if (tg3_alloc_rx_skb(tp, RXD_OPAQUE_RING_STD, -1, i) < 0) {
-                                     -1, i) < 0)
+                        printk(KERN_WARNING PFX
+                               "%s: Using a smaller RX standard ring, "
+                               "only %d out of %d buffers were allocated "
+                               "successfully.\n",
+                               tp->dev->name, i, tp->rx_pending);
+                        if (i == 0)
+                                return -ENOMEM;
+                        tp->rx_pending = i;
                        break;
+                }
        }
        if (tp->tg3_flags & TG3_FLAG_JUMBO_RING_ENABLE) {
                for (i = 0; i < tp->rx_jumbo_pending; i++) {
                        if (tg3_alloc_rx_skb(tp, RXD_OPAQUE_RING_JUMBO,
-                                             -1, i) < 0)
+                                             -1, i) < 0) {
+                                printk(KERN_WARNING PFX
+                                       "%s: Using a smaller RX jumbo ring, "
+                                       "only %d out of %d buffers were "
+                                       "allocated successfully.\n",
+                                       tp->dev->name, i, tp->rx_jumbo_pending);
+                                if (i == 0) {
+                                        tg3_free_rings(tp);
+                                        return -ENOMEM;
+                                }
+                                tp->rx_jumbo_pending = i;
                                break;
+                        }
                }
        }
+        return 0;
 }
 /*
@@ -5815,6 +5861,7 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
 {
        struct tg3 *tp = netdev_priv(dev);
        struct sockaddr *addr = p;
+        int err = 0;
        if (!is_valid_ether_addr(addr->sa_data))
                return -EINVAL;
@@ -5832,9 +5879,9 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
                tg3_full_lock(tp, 1);
                tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp, 0);
+                err = tg3_restart_hw(tp, 0);
+                if (!err)
-                tg3_netif_start(tp);
+                        tg3_netif_start(tp);
                tg3_full_unlock(tp);
        } else {
                spin_lock_bh(&tp->lock);
@@ -5842,7 +5889,7 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
                spin_unlock_bh(&tp->lock);
        }
-        return 0;
+        return err;
 }
 /* tp->lock is held. */
@@ -5942,7 +5989,9 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
         * can only do this after the hardware has been
         * successfully reset.
         */
-        tg3_init_rings(tp);
+        err = tg3_init_rings(tp);
+        if (err)
+                return err;
        /* This value is determined during the probe time DMA
         * engine test, tg3_test_dma.
@@ -7956,7 +8005,7 @@ static void tg3_get_ringparam(struct net_device *dev, struct ethtool_ringparam *
 static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ering)
 {
        struct tg3 *tp = netdev_priv(dev);
-        int irq_sync = 0;
+        int irq_sync = 0, err = 0;
  
        if ((ering->rx_pending > TG3_RX_RING_SIZE - 1) ||
            (ering->rx_jumbo_pending > TG3_RX_JUMBO_RING_SIZE - 1) ||
@@ -7980,13 +8029,14 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
        if (netif_running(dev)) {
                tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp, 1);
+                err = tg3_restart_hw(tp, 1);
-                tg3_netif_start(tp);
+                if (!err)
+                        tg3_netif_start(tp);
        }
        tg3_full_unlock(tp);
  
-        return 0;
+        return err;
 }
  
 static void tg3_get_pauseparam(struct net_device *dev, struct ethtool_pauseparam *epause)
@@ -8001,7 +8051,7 @@ static void tg3_get_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam *epause)
 {
        struct tg3 *tp = netdev_priv(dev);
-        int irq_sync = 0;
+        int irq_sync = 0, err = 0;
  
        if (netif_running(dev)) {
                tg3_netif_stop(tp);
@@ -8025,13 +8075,14 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
        if (netif_running(dev)) {
                tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp, 1);
+                err = tg3_restart_hw(tp, 1);
-                tg3_netif_start(tp);
+                if (!err)
+                        tg3_netif_start(tp);
        }
        tg3_full_unlock(tp);
  
-        return 0;
+        return err;
 }
  
 static u32 tg3_get_rx_csum(struct net_device *dev)
@@ -8666,7 +8717,9 @@ static int tg3_test_loopback(struct tg3 *tp)
        if (!netif_running(tp->dev))
                return TG3_LOOPBACK_FAILED;
-        tg3_reset_hw(tp, 1);
+        err = tg3_reset_hw(tp, 1);
+        if (err)
+                return TG3_LOOPBACK_FAILED;
        if (tg3_run_loopback(tp, TG3_MAC_LOOPBACK))
                err |= TG3_MAC_LOOPBACK_FAILED;
@@ -8740,8 +8793,8 @@ static void tg3_self_test(struct net_device *dev, struct ethtool_test *etest,
                tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
                if (netif_running(dev)) {
                        tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-                        tg3_init_hw(tp, 1);
+                        if (!tg3_restart_hw(tp, 1))
-                        tg3_netif_start(tp);
+                                tg3_netif_start(tp);
                }
                tg3_full_unlock(tp);
@@ -11699,7 +11752,8 @@ static int tg3_suspend(struct pci_dev *pdev, pm_message_t state)
                tg3_full_lock(tp, 0);
                tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-                tg3_init_hw(tp, 1);
+                if (tg3_restart_hw(tp, 1))
+                        goto out;
                tp->timer.expires = jiffies + tp->timer_offset;
                add_timer(&tp->timer);
@@ -11707,6 +11761,7 @@ static int tg3_suspend(struct pci_dev *pdev, pm_message_t state)
                netif_device_attach(dev);
                tg3_netif_start(tp);
+out:
                tg3_full_unlock(tp);
        }
@@ -11733,16 +11788,19 @@ static int tg3_resume(struct pci_dev *pdev)
        tg3_full_lock(tp, 0);
        tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-        tg3_init_hw(tp, 1);
+        err = tg3_restart_hw(tp, 1);
+        if (err)
+                goto out;
        tp->timer.expires = jiffies + tp->timer_offset;
        add_timer(&tp->timer);
        tg3_netif_start(tp);
+out:
        tg3_full_unlock(tp);
-        return 0;
+        return err;
 }
 static struct pci_driver tg3_driver = {
diff --git a/drivers/net/wan/c101.c b/drivers/net/wan/c101.c
index 2c09ec908a3f..435e91ec4620 100644
--- a/drivers/net/wan/c101.c
+++ b/drivers/net/wan/c101.c
@@ -197,7 +197,6 @@ static int c101_open(struct net_device *dev)
        sca_out(IE0_TXINT, MSCI0_OFFSET + IE0, port);
        set_carrier(port);
-        printk(KERN_DEBUG "0x%X\n", sca_in(MSCI1_OFFSET + ST3, port));
        /* enable MSCI1 CDCD interrupt */
        sca_out(IE1_CDCD, MSCI1_OFFSET + IE1, port);
@@ -449,4 +448,5 @@ module_exit(c101_cleanup);
 MODULE_AUTHOR("Krzysztof Halasa <khc@pm.waw.pl>");
 MODULE_DESCRIPTION("Moxa C101 serial port driver");
 MODULE_LICENSE("GPL v2");
-module_param(hw, charp, 0444);  /* hw=irq,ram:irq,... */
+module_param(hw, charp, 0444);
+MODULE_PARM_DESC(hw, "irq,ram:irq,...");
diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
index b81263eaede0..fbaab5bf71eb 100644
--- a/drivers/net/wan/hdlc_ppp.c
+++ b/drivers/net/wan/hdlc_ppp.c
@@ -107,6 +107,7 @@ int hdlc_ppp_ioctl(struct net_device *dev, struct ifreq *ifr)
                dev->hard_header = NULL;
                dev->type = ARPHRD_PPP;
                dev->addr_len = 0;
+                netif_dormant_off(dev);
                return 0;
        }
diff --git a/drivers/net/wan/hdlc_raw.c b/drivers/net/wan/hdlc_raw.c
index 9456d31cb1c1..f15aa6ba77f1 100644
--- a/drivers/net/wan/hdlc_raw.c
+++ b/drivers/net/wan/hdlc_raw.c
@@ -82,6 +82,7 @@ int hdlc_raw_ioctl(struct net_device *dev, struct ifreq *ifr)
                dev->type = ARPHRD_RAWHDLC;
                dev->flags = IFF_POINTOPOINT | IFF_NOARP;
                dev->addr_len = 0;
+                netif_dormant_off(dev);
                return 0;
        }
diff --git a/drivers/net/wan/hdlc_raw_eth.c b/drivers/net/wan/hdlc_raw_eth.c
index b1285cc8fee6..d1884987f94e 100644
--- a/drivers/net/wan/hdlc_raw_eth.c
+++ b/drivers/net/wan/hdlc_raw_eth.c
@@ -100,6 +100,7 @@ int hdlc_raw_eth_ioctl(struct net_device *dev, struct ifreq *ifr)
                dev->tx_queue_len = old_qlen;
                memcpy(dev->dev_addr, "\x00\x01", 2);
                get_random_bytes(dev->dev_addr + 2, ETH_ALEN - 2);
+                netif_dormant_off(dev);
                return 0;
        }
diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
index 07e5eef1fe0f..a867fb411f89 100644
--- a/drivers/net/wan/hdlc_x25.c
+++ b/drivers/net/wan/hdlc_x25.c
@@ -212,6 +212,7 @@ int hdlc_x25_ioctl(struct net_device *dev, struct ifreq *ifr)
                dev->hard_header = NULL;
                dev->type = ARPHRD_X25;
                dev->addr_len = 0;
+                netif_dormant_off(dev);
                return 0;
        }
diff --git a/drivers/net/wan/n2.c b/drivers/net/wan/n2.c
index e013b817cab8..dcf46add3adf 100644
--- a/drivers/net/wan/n2.c
+++ b/drivers/net/wan/n2.c
@@ -564,4 +564,5 @@ module_exit(n2_cleanup);
 MODULE_AUTHOR("Krzysztof Halasa <khc@pm.waw.pl>");
 MODULE_DESCRIPTION("RISCom/N2 serial port driver");
 MODULE_LICENSE("GPL v2");
-module_param(hw, charp, 0444);  /* hw=io,irq,ram,ports:io,irq,... */
+module_param(hw, charp, 0444);
+MODULE_PARM_DESC(hw, "io,irq,ram,ports:io,irq,...");
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index fa9d2c4edc93..2e8ac995d56f 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -447,6 +447,7 @@ config AIRO_CS
        tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards"
        depends on NET_RADIO && PCMCIA && (BROKEN || !M32R)
        select CRYPTO
+        select CRYPTO_AES
        ---help---
          This is the standard Linux driver to support Cisco/Aironet PCMCIA
          802.11 wireless cards.  This driver is the same as the Aironet
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index 3889f79e7128..df317c1e12a8 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -3701,7 +3701,7 @@ static void bcm43xx_ieee80211_set_security(struct net_device *net_dev,
        }
        if (sec->flags & SEC_AUTH_MODE) {
                secinfo->auth_mode = sec->auth_mode;
-                dprintk(", .auth_mode = %d\n", sec->auth_mode);
+                dprintk(", .auth_mode = %d", sec->auth_mode);
        }
        dprintk("\n");
        if (bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED &&
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index d6ed5781b93a..317ace7f9aae 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -2875,7 +2875,7 @@ static int orinoco_ioctl_setiwencode(struct net_device *dev,
        if (orinoco_lock(priv, &flags) != 0)
                return -EBUSY;
-        if (erq->pointer) {
+        if (erq->length > 0) {
                if ((index < 0) || (index >= ORINOCO_MAX_KEYS))
                        index = priv->tx_key;
@@ -2918,7 +2918,7 @@ static int orinoco_ioctl_setiwencode(struct net_device *dev,
        if (erq->flags & IW_ENCODE_RESTRICTED)
                restricted = 1;
-        if (erq->pointer) {
+        if (erq->pointer && erq->length > 0) {
                priv->keys[index].len = cpu_to_le16(xlen);
                memset(priv->keys[index].data, 0,
                       sizeof(priv->keys[index].data));
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
index 662ecc8a33ff..c52e9bcf8d02 100644
--- a/drivers/net/wireless/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -1820,6 +1820,8 @@ static int zd1201_probe(struct usb_interface *interface,
            zd->dev->name);
        usb_set_intfdata(interface, zd);
+        zd1201_enable(zd);      /* zd1201 likes to startup enabled, */
+        zd1201_disable(zd);     /* interfering with all the wifis in range */
        return 0;
 err_net:
diff --git a/drivers/s390/block/xpram.c b/drivers/s390/block/xpram.c
index 4cd879cb9bdd..1140302ff11d 100644
--- a/drivers/s390/block/xpram.c
+++ b/drivers/s390/block/xpram.c
@@ -304,6 +304,7 @@ static int __init xpram_setup_sizes(unsigned long pages)
 {
        unsigned long mem_needed;
        unsigned long mem_auto;
+        unsigned long long size;
        int mem_auto_no;
        int i;
@@ -321,9 +322,19 @@ static int __init xpram_setup_sizes(unsigned long pages)
        mem_needed = 0;
        mem_auto_no = 0;
        for (i = 0; i < xpram_devs; i++) {
-                if (sizes[i])
+                if (sizes[i]) {
-                        xpram_sizes[i] =
+                        size = simple_strtoull(sizes[i], &sizes[i], 0);
-                                (memparse(sizes[i], &sizes[i]) + 3) & -4UL;
+                        switch (sizes[i][0]) {
+                        case 'g':
+                        case 'G':
+                                size <<= 20;
+                                break;
+                        case 'm':
+                        case 'M':
+                                size <<= 10;
+                        }
+                        xpram_sizes[i] = (size + 3) & -4UL;
+                }
                if (xpram_sizes[i])
                        mem_needed += xpram_sizes[i];
                else
diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
index 95e285b2e25c..7a84014f2037 100644
--- a/drivers/s390/char/raw3270.c
+++ b/drivers/s390/char/raw3270.c
@@ -1106,10 +1106,10 @@ raw3270_delete_device(struct raw3270 *rp)
        /* Remove from device chain. */
        mutex_lock(&raw3270_mutex);
-        if (rp->clttydev)
+        if (rp->clttydev && !IS_ERR(rp->clttydev))
                class_device_destroy(class3270,
                                     MKDEV(IBM_TTY3270_MAJOR, rp->minor));
-        if (rp->cltubdev)
+        if (rp->cltubdev && !IS_ERR(rp->cltubdev))
                class_device_destroy(class3270,
                                     MKDEV(IBM_FS3270_MAJOR, rp->minor));
        list_del_init(&rp->list);
@@ -1173,21 +1173,37 @@ static struct attribute_group raw3270_attr_group = {
        .attrs = raw3270_attrs,
 };
-static void
+static int raw3270_create_attributes(struct raw3270 *rp)
-raw3270_create_attributes(struct raw3270 *rp)
 {
-        //FIXME: check return code
+        int rc;
-        sysfs_create_group(&rp->cdev->dev.kobj, &raw3270_attr_group);
-        rp->clttydev =
+        rc = sysfs_create_group(&rp->cdev->dev.kobj, &raw3270_attr_group);
-                class_device_create(class3270, NULL,
+        if (rc)
-                                    MKDEV(IBM_TTY3270_MAJOR, rp->minor),
+                goto out;
-                                    &rp->cdev->dev, "tty%s",
-                                    rp->cdev->dev.bus_id);
+        rp->clttydev = class_device_create(class3270, NULL,
-        rp->cltubdev =
+                                           MKDEV(IBM_TTY3270_MAJOR, rp->minor),
-                class_device_create(class3270, NULL,
+                                           &rp->cdev->dev, "tty%s",
-                                    MKDEV(IBM_FS3270_MAJOR, rp->minor),
+                                           rp->cdev->dev.bus_id);
-                                    &rp->cdev->dev, "tub%s",
+        if (IS_ERR(rp->clttydev)) {
-                                    rp->cdev->dev.bus_id);
+                rc = PTR_ERR(rp->clttydev);
+                goto out_ttydev;
+        }
+        rp->cltubdev = class_device_create(class3270, NULL,
+                                           MKDEV(IBM_FS3270_MAJOR, rp->minor),
+                                           &rp->cdev->dev, "tub%s",
+                                           rp->cdev->dev.bus_id);
+        if (!IS_ERR(rp->cltubdev))
+                goto out;
+        rc = PTR_ERR(rp->cltubdev);
+        class_device_destroy(class3270, MKDEV(IBM_TTY3270_MAJOR, rp->minor));
+out_ttydev:
+        sysfs_remove_group(&rp->cdev->dev.kobj, &raw3270_attr_group);
+out:
+        return rc;
 }
 /*
@@ -1255,7 +1271,9 @@ raw3270_set_online (struct ccw_device *cdev)
        rc = raw3270_reset_device(rp);
        if (rc)
                goto failure;
-        raw3270_create_attributes(rp);
+        rc = raw3270_create_attributes(rp);
+        if (rc)
+                goto failure;
        set_bit(RAW3270_FLAGS_READY, &rp->flags);
        mutex_lock(&raw3270_mutex);
        list_for_each_entry(np, &raw3270_notifier, list)
diff --git a/drivers/s390/char/tape_class.c b/drivers/s390/char/tape_class.c
index a5c68e60fcf4..643b6d078563 100644
--- a/drivers/s390/char/tape_class.c
+++ b/drivers/s390/char/tape_class.c
@@ -76,14 +76,22 @@ struct tape_class_device *register_tape_dev(
                                device,
                                "%s", tcd->device_name
                        );
-        sysfs_create_link(
+        rc = PTR_ERR(tcd->class_device);
+        if (rc)
+                goto fail_with_cdev;
+        rc = sysfs_create_link(
                &device->kobj,
                &tcd->class_device->kobj,
                tcd->mode_name
        );
+        if (rc)
+                goto fail_with_class_device;
        return tcd;
+fail_with_class_device:
+        class_device_destroy(tape_class, tcd->char_device->dev);
 fail_with_cdev:
        cdev_del(tcd->char_device);
diff --git a/drivers/s390/char/tape_core.c b/drivers/s390/char/tape_core.c
index 122b4d8965c3..2826aed91043 100644
--- a/drivers/s390/char/tape_core.c
+++ b/drivers/s390/char/tape_core.c
@@ -543,20 +543,24 @@ int
 tape_generic_probe(struct ccw_device *cdev)
 {
        struct tape_device *device;
+        int ret;
        device = tape_alloc_device();
        if (IS_ERR(device))
                return -ENODEV;
-        PRINT_INFO("tape device %s found\n", cdev->dev.bus_id);
+        ccw_device_set_options(cdev, CCWDEV_DO_PATHGROUP);
+        ret = sysfs_create_group(&cdev->dev.kobj, &tape_attr_group);
+        if (ret) {
+                tape_put_device(device);
+                PRINT_ERR("probe failed for tape device %s\n", cdev->dev.bus_id);
+                return ret;
+        }
        cdev->dev.driver_data = device;
+        cdev->handler = __tape_do_irq;
        device->cdev = cdev;
        device->cdev_id = busid_to_int(cdev->dev.bus_id);
-        cdev->handler = __tape_do_irq;
+        PRINT_INFO("tape device %s found\n", cdev->dev.bus_id);
+        return ret;
-        ccw_device_set_options(cdev, CCWDEV_DO_PATHGROUP);
-        sysfs_create_group(&cdev->dev.kobj, &tape_attr_group);
-        return 0;
 }
 static inline void
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index f26a2ee3aad8..3cba6c9fab11 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -152,7 +152,6 @@ ccwgroup_create(struct device *root,
        struct ccwgroup_device *gdev;
        int i;
        int rc;
-        int del_drvdata;
        if (argc > 256) /* disallow dumb users */
                return -EINVAL;
@@ -163,7 +162,6 @@ ccwgroup_create(struct device *root,
        atomic_set(&gdev->onoff, 0);
-        del_drvdata = 0;
        for (i = 0; i < argc; i++) {
                gdev->cdev[i] = get_ccwdev_by_busid(cdrv, argv[i]);
@@ -180,10 +178,8 @@ ccwgroup_create(struct device *root,
                        rc = -EINVAL;
                        goto free_dev;
                }
-        }
-        for (i = 0; i < argc; i++)
                gdev->cdev[i]->dev.driver_data = gdev;
-        del_drvdata = 1;
+        }
        gdev->creator_id = creator_id;
        gdev->count = argc;
@@ -226,9 +222,9 @@ error:
 free_dev:
        for (i = 0; i < argc; i++)
                if (gdev->cdev[i]) {
-                        put_device(&gdev->cdev[i]->dev);
+                        if (gdev->cdev[i]->dev.driver_data == gdev)
-                        if (del_drvdata)
                                gdev->cdev[i]->dev.driver_data = NULL;
+                        put_device(&gdev->cdev[i]->dev);
                }
        kfree(gdev);
        return rc;
diff --git a/drivers/s390/cio/cmf.c b/drivers/s390/cio/cmf.c
index 0df3af1f08de..828b2d334f0a 100644
--- a/drivers/s390/cio/cmf.c
+++ b/drivers/s390/cio/cmf.c
@@ -1068,6 +1068,7 @@ cmb_show_avg_sample_interval(struct device *dev, struct device_attribute *attr,
        if (count) {
                interval = cmb_data->last_update -
                        cdev->private->cmb_start_time;
+                interval = (interval * 1000) >> 12;
                interval /= count;
        } else
                interval = -1;
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index ac6e0c7e43d9..7a39e0b0386c 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -152,7 +152,8 @@ ccw_device_cancel_halt_clear(struct ccw_device *cdev)
                if (cdev->private->iretry) {
                        cdev->private->iretry--;
                        ret = cio_halt(sch);
-                        return (ret == 0) ? -EBUSY : ret;
+                        if (ret != -EBUSY)
+                                return (ret == 0) ? -EBUSY : ret;
                }
                /* halt io unsuccessful. */
                cdev->private->iretry = 255;    /* 255 clear retries. */
diff --git a/drivers/s390/net/ctcmain.c b/drivers/s390/net/ctcmain.c
index 20c8eb16f464..8a4b58120146 100644
--- a/drivers/s390/net/ctcmain.c
+++ b/drivers/s390/net/ctcmain.c
@@ -2686,9 +2686,17 @@ static struct attribute_group ctc_attr_group = {
 static int
 ctc_add_attributes(struct device *dev)
 {
-        device_create_file(dev, &dev_attr_loglevel);
+        int rc;
-        device_create_file(dev, &dev_attr_stats);
-        return 0;
+        rc = device_create_file(dev, &dev_attr_loglevel);
+        if (rc)
+                goto out;
+        rc = device_create_file(dev, &dev_attr_stats);
+        if (!rc)
+                goto out;
+        device_remove_file(dev, &dev_attr_loglevel);
+out:
+        return rc;
 }
 static void
@@ -2901,7 +2909,12 @@ ctc_new_device(struct ccwgroup_device *cgdev)
                goto out;
        }
-        ctc_add_attributes(&cgdev->dev);
+        if (ctc_add_attributes(&cgdev->dev)) {
+                ctc_netdev_unregister(dev);
+                dev->priv = NULL;
+                ctc_free_netdevice(dev, 1);
+                goto out;
+        }
        strlcpy(privptr->fsm->name, dev->name, sizeof (privptr->fsm->name));
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index 103c41470bd2..5fff1f93973a 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -8451,10 +8451,11 @@ __qeth_reboot_event_card(struct device *dev, void *data)
 static int
 qeth_reboot_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
+        int ret;
-        driver_for_each_device(&qeth_ccwgroup_driver.driver, NULL, NULL,
+        ret = driver_for_each_device(&qeth_ccwgroup_driver.driver, NULL, NULL,
-                               __qeth_reboot_event_card);
+                                     __qeth_reboot_event_card);
-        return NOTIFY_DONE;
+        return ret ? NOTIFY_BAD : NOTIFY_DONE;
 }
diff --git a/drivers/sbus/sbus.c b/drivers/sbus/sbus.c
index 16b59773c0bb..935952ef88f1 100644
--- a/drivers/sbus/sbus.c
+++ b/drivers/sbus/sbus.c
@@ -233,7 +233,7 @@ static void __init build_one_sbus(struct device_node *dp, int num_sbus)
        sbus->ofdev.node = dp;
        sbus->ofdev.dev.parent = NULL;
        sbus->ofdev.dev.bus = &sbus_bus_type;
-        strcpy(sbus->ofdev.dev.bus_id, dp->path_component_name);
+        sprintf(sbus->ofdev.dev.bus_id, "sbus%d", num_sbus);
        if (of_device_register(&sbus->ofdev) != 0)
                printk(KERN_DEBUG "sbus: device registration error for %s!\n",
diff --git a/drivers/scsi/53c7xx.c b/drivers/scsi/53c7xx.c
index c690c2b89e41..acf292736b4e 100644
--- a/drivers/scsi/53c7xx.c
+++ b/drivers/scsi/53c7xx.c
@@ -3451,12 +3451,12 @@ create_cmd (Scsi_Cmnd *cmd) {
    for (i = 0; cmd->use_sg ? (i < cmd->use_sg) : !i; cmd_datain += 4, 
        cmd_dataout += 4, ++i) {
        u32 vbuf = cmd->use_sg
-            ? (u32)page_address(((struct scatterlist *)cmd->buffer)[i].page)+
+            ? (u32)page_address(((struct scatterlist *)cmd->request_buffer)[i].page)+
-              ((struct scatterlist *)cmd->buffer)[i].offset
+              ((struct scatterlist *)cmd->request_buffer)[i].offset
            : (u32)(cmd->request_buffer);
        u32 bbuf = virt_to_bus((void *)vbuf);
        u32 count = cmd->use_sg ?
-            ((struct scatterlist *)cmd->buffer)[i].length :
+            ((struct scatterlist *)cmd->request_buffer)[i].length :
            cmd->request_bufflen;
        /*
@@ -5417,7 +5417,7 @@ insn_to_offset (Scsi_Cmnd *cmd, u32 *insn) {
            if ((buffers = cmd->use_sg)) {
                for (offset = 0, 
-                        segment = (struct scatterlist *) cmd->buffer;
+                        segment = (struct scatterlist *) cmd->request_buffer;
                     buffers && !((found = ((ptr >= (char *)page_address(segment->page)+segment->offset) && 
                            (ptr < ((char *)page_address(segment->page)+segment->offset+segment->length)))));
                     --buffers, offset += segment->length, ++segment)
diff --git a/drivers/scsi/NCR53C9x.c b/drivers/scsi/NCR53C9x.c
index 8a4659e94105..bdc6bb262bce 100644
--- a/drivers/scsi/NCR53C9x.c
+++ b/drivers/scsi/NCR53C9x.c
@@ -911,7 +911,7 @@ static void esp_get_dmabufs(struct NCR_ESP *esp, Scsi_Cmnd *sp)
                        sp->SCp.ptr =
                                (char *) virt_to_phys(sp->request_buffer);
        } else {
-                sp->SCp.buffer = (struct scatterlist *) sp->buffer;
+                sp->SCp.buffer = (struct scatterlist *) sp->request_buffer;
                sp->SCp.buffers_residual = sp->use_sg - 1;
                sp->SCp.this_residual = sp->SCp.buffer->length;
                if (esp->dma_mmu_get_scsi_sgl)
@@ -2152,29 +2152,23 @@ static int esp_do_data_finale(struct NCR_ESP *esp,
 */
 static int esp_should_clear_sync(Scsi_Cmnd *sp)
 {
-        unchar cmd1 = sp->cmnd[0];
+        unchar cmd = sp->cmnd[0];
-        unchar cmd2 = sp->data_cmnd[0];
        /* These cases are for spinning up a disk and
         * waiting for that spinup to complete.
         */
-        if(cmd1 == START_STOP ||
+        if(cmd == START_STOP)
-           cmd2 == START_STOP)
                return 0;
-        if(cmd1 == TEST_UNIT_READY ||
+        if(cmd == TEST_UNIT_READY)
-           cmd2 == TEST_UNIT_READY)
                return 0;
        /* One more special case for SCSI tape drives,
         * this is what is used to probe the device for
         * completion of a rewind or tape load operation.
         */
-        if(sp->device->type == TYPE_TAPE) {
+        if(sp->device->type == TYPE_TAPE && cmd == MODE_SENSE)
-                if(cmd1 == MODE_SENSE ||
+                return 0;
-                   cmd2 == MODE_SENSE)
-                        return 0;
-        }
        return 1;
 }
diff --git a/drivers/scsi/NCR_D700.c b/drivers/scsi/NCR_D700.c
index a06f547e87f7..d05681f9d81a 100644
--- a/drivers/scsi/NCR_D700.c
+++ b/drivers/scsi/NCR_D700.c
@@ -114,7 +114,7 @@ MODULE_DESCRIPTION("NCR Dual700 SCSI Driver");
 MODULE_LICENSE("GPL");
 module_param(NCR_D700, charp, 0);
-static __u8 __initdata id_array[2*(MCA_MAX_SLOT_NR + 1)] =
+static __u8 __devinitdata id_array[2*(MCA_MAX_SLOT_NR + 1)] =
        { [0 ... 2*(MCA_MAX_SLOT_NR + 1)-1] = 7 };
 #ifdef MODULE
@@ -173,7 +173,7 @@ struct NCR_D700_private {
        char                    pad;
 };
-static int 
+static int __devinit
 NCR_D700_probe_one(struct NCR_D700_private *p, int siop, int irq,
                   int slot, u32 region, int differential)
 {
@@ -243,7 +243,7 @@ NCR_D700_intr(int irq, void *data, struct pt_regs *regs)
 * essentially connectecd to the MCA bus independently, it is easier
 * to set them up as two separate host adapters, rather than one
 * adapter with two channels */
-static int
+static int __devinit
 NCR_D700_probe(struct device *dev)
 {
        struct NCR_D700_private *p;
@@ -329,7 +329,7 @@ NCR_D700_probe(struct device *dev)
        for (i = 0; i < 2; i++) {
                int err;
-                if ((err = NCR_D700_probe_one(p, i, slot, irq,
+                if ((err = NCR_D700_probe_one(p, i, irq, slot,
                                              offset_addr + (0x80 * i),
                                              differential)) != 0)
                        printk("D700: SIOP%d: probe failed, error = %d\n",
@@ -349,7 +349,7 @@ NCR_D700_probe(struct device *dev)
        return 0;
 }
-static void
+static void __devexit
 NCR_D700_remove_one(struct Scsi_Host *host)
 {
        scsi_remove_host(host);
@@ -359,7 +359,7 @@ NCR_D700_remove_one(struct Scsi_Host *host)
        release_region(host->base, 64);
 }
-static int
+static int __devexit
 NCR_D700_remove(struct device *dev)
 {
        struct NCR_D700_private *p = dev_get_drvdata(dev);
@@ -380,7 +380,7 @@ static struct mca_driver NCR_D700_driver = {
                .name           = "NCR_D700",
                .bus            = &mca_bus_type,
                .probe          = NCR_D700_probe,
-                .remove         = NCR_D700_remove,
+                .remove         = __devexit_p(NCR_D700_remove),
        },
 };
diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c
index 36e63f82d9f8..f974869ea323 100644
--- a/drivers/scsi/aha152x.c
+++ b/drivers/scsi/aha152x.c
@@ -551,6 +551,11 @@ struct aha152x_hostdata {
 struct aha152x_scdata {
        Scsi_Cmnd *next;        /* next sc in queue */
        struct semaphore *sem;  /* semaphore to block on */
+        unsigned char cmd_len;
+        unsigned char cmnd[MAX_COMMAND_SIZE];
+        unsigned short use_sg;
+        unsigned request_bufflen;
+        void *request_buffer;
 };
@@ -1006,11 +1011,20 @@ static int aha152x_internal_queue(Scsi_Cmnd *SCpnt, struct semaphore *sem, int p
                        return FAILED;
                }
        } else {
+                struct aha152x_scdata *sc;
                SCpnt->host_scribble = kmalloc(sizeof(struct aha152x_scdata), GFP_ATOMIC);
                if(SCpnt->host_scribble==0) {
                        printk(ERR_LEAD "allocation failed\n", CMDINFO(SCpnt));
                        return FAILED;
                }
+                sc = SCDATA(SCpnt);
+                memcpy(sc->cmnd, SCpnt->cmnd, sizeof(sc->cmnd));
+                sc->request_buffer  = SCpnt->request_buffer;
+                sc->request_bufflen = SCpnt->request_bufflen;
+                sc->use_sg          = SCpnt->use_sg;
+                sc->cmd_len         = SCpnt->cmd_len;
        }
        SCNEXT(SCpnt)           = NULL;
@@ -1165,6 +1179,10 @@ static int aha152x_device_reset(Scsi_Cmnd * SCpnt)
        DECLARE_MUTEX_LOCKED(sem);
        struct timer_list timer;
        int ret, issued, disconnected;
+        unsigned char old_cmd_len = SCpnt->cmd_len;
+        unsigned short old_use_sg = SCpnt->use_sg;
+        void *old_buffer = SCpnt->request_buffer;
+        unsigned old_bufflen = SCpnt->request_bufflen;
        unsigned long flags;
 #if defined(AHA152X_DEBUG)
@@ -1198,11 +1216,11 @@ static int aha152x_device_reset(Scsi_Cmnd * SCpnt)
        add_timer(&timer);
        down(&sem);
        del_timer(&timer);
-        
-        SCpnt->cmd_len         = SCpnt->old_cmd_len;
+        SCpnt->cmd_len         = old_cmd_len;
-        SCpnt->use_sg          = SCpnt->old_use_sg;
+        SCpnt->use_sg          = old_use_sg;
-        SCpnt->request_buffer  = SCpnt->buffer;
+        SCpnt->request_buffer  = old_buffer;
-        SCpnt->request_bufflen = SCpnt->bufflen;
+        SCpnt->request_bufflen = old_bufflen;
        DO_LOCK(flags);
@@ -1565,6 +1583,9 @@ static void busfree_run(struct Scsi_Host *shpnt)
 #endif
                if(DONE_SC->SCp.phase & check_condition) {
+                        struct scsi_cmnd *cmd = HOSTDATA(shpnt)->done_SC;
+                        struct aha152x_scdata *sc = SCDATA(cmd);
 #if 0
                        if(HOSTDATA(shpnt)->debug & debug_eh) {
                                printk(ERR_LEAD "received sense: ", CMDINFO(DONE_SC));
@@ -1573,13 +1594,13 @@ static void busfree_run(struct Scsi_Host *shpnt)
 #endif
                        /* restore old command */
-                        memcpy((void *) DONE_SC->cmnd, (void *) DONE_SC->data_cmnd, sizeof(DONE_SC->data_cmnd));
+                        memcpy(cmd->cmnd, sc->cmnd, sizeof(sc->cmnd));
-                        DONE_SC->request_buffer  = DONE_SC->buffer;
+                        cmd->request_buffer  = sc->request_buffer;
-                        DONE_SC->request_bufflen = DONE_SC->bufflen;
+                        cmd->request_bufflen = sc->request_bufflen;
-                        DONE_SC->use_sg          = DONE_SC->old_use_sg;
+                        cmd->use_sg          = sc->use_sg;
-                        DONE_SC->cmd_len         = DONE_SC->old_cmd_len;
+                        cmd->cmd_len         = sc->cmd_len;
-                        DONE_SC->SCp.Status = 0x02;
+                        cmd->SCp.Status = 0x02;
                        HOSTDATA(shpnt)->commands--;
                        if (!HOSTDATA(shpnt)->commands)
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index a1e8ca758594..653818d2f802 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -7289,7 +7289,7 @@ ahd_reset_cmds_pending(struct ahd_softc *ahd)
        ahd->flags &= ~AHD_UPDATE_PEND_CMDS;
 }
-void
+static void
 ahd_done_with_status(struct ahd_softc *ahd, struct scb *scb, uint32_t status)
 {
        cam_status ostat;
diff --git a/drivers/scsi/aic7xxx/aic79xx_osm.c b/drivers/scsi/aic7xxx/aic79xx_osm.c
index b244c7124179..998999c0a972 100644
--- a/drivers/scsi/aic7xxx/aic79xx_osm.c
+++ b/drivers/scsi/aic7xxx/aic79xx_osm.c
@@ -243,25 +243,6 @@ ahd_print_path(struct ahd_softc *ahd, struct scb *scb)
 static uint32_t aic79xx_no_reset;
 /*
- * Certain PCI motherboards will scan PCI devices from highest to lowest,
- * others scan from lowest to highest, and they tend to do all kinds of
- * strange things when they come into contact with PCI bridge chips.  The
- * net result of all this is that the PCI card that is actually used to boot
- * the machine is very hard to detect.  Most motherboards go from lowest
- * PCI slot number to highest, and the first SCSI controller found is the
- * one you boot from.  The only exceptions to this are when a controller
- * has its BIOS disabled.  So, we by default sort all of our SCSI controllers
- * from lowest PCI slot number to highest PCI slot number.  We also force
- * all controllers with their BIOS disabled to the end of the list.  This
- * works on *almost* all computers.  Where it doesn't work, we have this
- * option.  Setting this option to non-0 will reverse the order of the sort
- * to highest first, then lowest, but will still leave cards with their BIOS
- * disabled at the very end.  That should fix everyone up unless there are
- * really strange cirumstances.
- */
-static uint32_t aic79xx_reverse_scan;
-/*
 * Should we force EXTENDED translation on a controller.
 *     0 == Use whatever is in the SEEPROM or default to off
 *     1 == Use whatever is in the SEEPROM or default to on
@@ -350,7 +331,6 @@ MODULE_PARM_DESC(aic79xx,
 "                               periodically to prevent tag starvation.\n"
 "                               This may be required by some older disk\n"
 "                               or drives/RAID arrays.\n"
-"       reverse_scan            Sort PCI devices highest Bus/Slot to lowest\n"
 "       tag_info:<tag_str>      Set per-target tag depth\n"
 "       global_tag_depth:<int>  Global tag depth for all targets on all buses\n"
 "       slewrate:<slewrate_list>Set the signal slew rate (0-15).\n"
@@ -1031,7 +1011,6 @@ aic79xx_setup(char *s)
 #ifdef AHD_DEBUG
                { "debug", &ahd_debug },
 #endif
-                { "reverse_scan", &aic79xx_reverse_scan },
                { "periodic_otag", &aic79xx_periodic_otag },
                { "pci_parity", &aic79xx_pci_parity },
                { "seltime", &aic79xx_seltime },
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c
index debf3e2a0798..aa4be8a31415 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c
@@ -353,7 +353,6 @@ MODULE_PARM_DESC(aic7xxx,
 "                               periodically to prevent tag starvation.\n"
 "                               This may be required by some older disk\n"
 "                               drives or RAID arrays.\n"
-"       reverse_scan            Sort PCI devices highest Bus/Slot to lowest\n"
 "       tag_info:<tag_str>      Set per-target tag depth\n"
 "       global_tag_depth:<int>  Global tag depth for every target\n"
 "                               on every bus\n"
diff --git a/drivers/scsi/arm/fas216.c b/drivers/scsi/arm/fas216.c
index 3e1053f111dc..4cf7afc31cc7 100644
--- a/drivers/scsi/arm/fas216.c
+++ b/drivers/scsi/arm/fas216.c
@@ -2427,7 +2427,7 @@ int fas216_eh_abort(Scsi_Cmnd *SCpnt)
        info->stats.aborts += 1;
        printk(KERN_WARNING "scsi%d: abort command ", info->host->host_no);
-        __scsi_print_command(SCpnt->data_cmnd);
+        __scsi_print_command(SCpnt->cmnd);
        print_debug_list();
        fas216_dumpstate(info);
diff --git a/drivers/scsi/ata_piix.c b/drivers/scsi/ata_piix.c
index 94b1261a259d..19745a31072b 100644
--- a/drivers/scsi/ata_piix.c
+++ b/drivers/scsi/ata_piix.c
@@ -105,9 +105,6 @@ enum {
        PIIX_FLAG_SCR           = (1 << 26), /* SCR available */
        PIIX_FLAG_AHCI          = (1 << 27), /* AHCI possible */
        PIIX_FLAG_CHECKINTR     = (1 << 28), /* make sure PCI INTx enabled */
-        PIIX_FLAG_COMBINED      = (1 << 29), /* combined mode possible */
-        /* ICH6/7 use different scheme for map value */
-        PIIX_FLAG_COMBINED_ICH6 = PIIX_FLAG_COMBINED | (1 << 30),
        /* combined mode.  if set, PATA is channel 0.
         * if clear, PATA is channel 1.
@@ -126,6 +123,7 @@ enum {
        ich6_sata               = 4,
        ich6_sata_ahci          = 5,
        ich6m_sata_ahci         = 6,
+        ich8_sata_ahci          = 7,
        /* constants for mapping table */
        P0                      = 0,  /* port 0 */
@@ -141,11 +139,19 @@ enum {
 struct piix_map_db {
        const u32 mask;
+        const u16 port_enable;
+        const int present_shift;
        const int map[][4];
 };
+struct piix_host_priv {
+        const int *map;
+        const struct piix_map_db *map_db;
+};
 static int piix_init_one (struct pci_dev *pdev,
                                    const struct pci_device_id *ent);
+static void piix_host_stop(struct ata_host_set *host_set);
 static void piix_set_piomode (struct ata_port *ap, struct ata_device *adev);
 static void piix_set_dmamode (struct ata_port *ap, struct ata_device *adev);
 static void piix_pata_error_handler(struct ata_port *ap);
@@ -186,11 +192,11 @@ static const struct pci_device_id piix_pci_tbl[] = {
        /* Enterprise Southbridge 2 (where's the datasheet?) */
        { 0x8086, 0x2680, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich6_sata_ahci },
        /* SATA Controller 1 IDE (ICH8, no datasheet yet) */
-        { 0x8086, 0x2820, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich6_sata_ahci },
+        { 0x8086, 0x2820, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_ahci },
        /* SATA Controller 2 IDE (ICH8, ditto) */
-        { 0x8086, 0x2825, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich6_sata_ahci },
+        { 0x8086, 0x2825, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_ahci },
        /* Mobile SATA Controller IDE (ICH8M, ditto) */
-        { 0x8086, 0x2828, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich6m_sata_ahci },
+        { 0x8086, 0x2828, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_ahci },
        { }     /* terminate list */
 };
@@ -254,7 +260,7 @@ static const struct ata_port_operations piix_pata_ops = {
        .port_start             = ata_port_start,
        .port_stop              = ata_port_stop,
-        .host_stop              = ata_host_stop,
+        .host_stop              = piix_host_stop,
 };
 static const struct ata_port_operations piix_sata_ops = {
@@ -284,11 +290,13 @@ static const struct ata_port_operations piix_sata_ops = {
        .port_start             = ata_port_start,
        .port_stop              = ata_port_stop,
-        .host_stop              = ata_host_stop,
+        .host_stop              = piix_host_stop,
 };
-static struct piix_map_db ich5_map_db = {
+static const struct piix_map_db ich5_map_db = {
        .mask = 0x7,
+        .port_enable = 0x3,
+        .present_shift = 4,
        .map = {
                /* PM   PS   SM   SS       MAP  */
                {  P0,  NA,  P1,  NA }, /* 000b */
@@ -302,8 +310,10 @@ static struct piix_map_db ich5_map_db = {
        },
 };
-static struct piix_map_db ich6_map_db = {
+static const struct piix_map_db ich6_map_db = {
        .mask = 0x3,
+        .port_enable = 0xf,
+        .present_shift = 4,
        .map = {
                /* PM   PS   SM   SS       MAP */
                {  P0,  P2,  P1,  P3 }, /* 00b */
@@ -313,8 +323,10 @@ static struct piix_map_db ich6_map_db = {
        },
 };
-static struct piix_map_db ich6m_map_db = {
+static const struct piix_map_db ich6m_map_db = {
        .mask = 0x3,
+        .port_enable = 0x5,
+        .present_shift = 4,
        .map = {
                /* PM   PS   SM   SS       MAP */
                {  P0,  P2,  RV,  RV }, /* 00b */
@@ -324,6 +336,28 @@ static struct piix_map_db ich6m_map_db = {
        },
 };
+static const struct piix_map_db ich8_map_db = {
+        .mask = 0x3,
+        .port_enable = 0x3,
+        .present_shift = 8,
+        .map = {
+                /* PM   PS   SM   SS       MAP */
+                {  P0,  NA,  P1,  NA }, /* 00b (hardwired) */
+                {  RV,  RV,  RV,  RV },
+                {  RV,  RV,  RV,  RV }, /* 10b (never) */
+                {  RV,  RV,  RV,  RV },
+        },
+};
+static const struct piix_map_db *piix_map_db_table[] = {
+        [ich5_sata]             = &ich5_map_db,
+        [esb_sata]              = &ich5_map_db,
+        [ich6_sata]             = &ich6_map_db,
+        [ich6_sata_ahci]        = &ich6_map_db,
+        [ich6m_sata_ahci]       = &ich6m_map_db,
+        [ich8_sata_ahci]        = &ich8_map_db,
+};
 static struct ata_port_info piix_port_info[] = {
        /* piix4_pata */
        {
@@ -356,63 +390,69 @@ static struct ata_port_info piix_port_info[] = {
        /* ich5_sata */
        {
                .sht            = &piix_sht,
-                .host_flags     = ATA_FLAG_SATA | PIIX_FLAG_COMBINED |
+                .host_flags     = ATA_FLAG_SATA | PIIX_FLAG_CHECKINTR,
-                                  PIIX_FLAG_CHECKINTR,
                .pio_mask       = 0x1f, /* pio0-4 */
                .mwdma_mask     = 0x07, /* mwdma0-2 */
                .udma_mask      = 0x7f, /* udma0-6 */
                .port_ops       = &piix_sata_ops,
-                .private_data   = &ich5_map_db,
        },
        /* i6300esb_sata */
        {
                .sht            = &piix_sht,
-                .host_flags     = ATA_FLAG_SATA | PIIX_FLAG_COMBINED |
+                .host_flags     = ATA_FLAG_SATA |
                                  PIIX_FLAG_CHECKINTR | PIIX_FLAG_IGNORE_PCS,
                .pio_mask       = 0x1f, /* pio0-4 */
                .mwdma_mask     = 0x07, /* mwdma0-2 */
                .udma_mask      = 0x7f, /* udma0-6 */
                .port_ops       = &piix_sata_ops,
-                .private_data   = &ich5_map_db,
        },
        /* ich6_sata */
        {
                .sht            = &piix_sht,
-                .host_flags     = ATA_FLAG_SATA | PIIX_FLAG_COMBINED_ICH6 |
+                .host_flags     = ATA_FLAG_SATA |
                                  PIIX_FLAG_CHECKINTR | PIIX_FLAG_SCR,
                .pio_mask       = 0x1f, /* pio0-4 */
                .mwdma_mask     = 0x07, /* mwdma0-2 */
                .udma_mask      = 0x7f, /* udma0-6 */
                .port_ops       = &piix_sata_ops,
-                .private_data   = &ich6_map_db,
        },
        /* ich6_sata_ahci */
        {
                .sht            = &piix_sht,
-                .host_flags     = ATA_FLAG_SATA | PIIX_FLAG_COMBINED_ICH6 |
+                .host_flags     = ATA_FLAG_SATA |
                                  PIIX_FLAG_CHECKINTR | PIIX_FLAG_SCR |
                                  PIIX_FLAG_AHCI,
                .pio_mask       = 0x1f, /* pio0-4 */
                .mwdma_mask     = 0x07, /* mwdma0-2 */
                .udma_mask      = 0x7f, /* udma0-6 */
                .port_ops       = &piix_sata_ops,
-                .private_data   = &ich6_map_db,
        },
        /* ich6m_sata_ahci */
        {
                .sht            = &piix_sht,
-                .host_flags     = ATA_FLAG_SATA | PIIX_FLAG_COMBINED_ICH6 |
+                .host_flags     = ATA_FLAG_SATA |
+                                  PIIX_FLAG_CHECKINTR | PIIX_FLAG_SCR |
+                                  PIIX_FLAG_AHCI,
+                .pio_mask       = 0x1f, /* pio0-4 */
+                .mwdma_mask     = 0x07, /* mwdma0-2 */
+                .udma_mask      = 0x7f, /* udma0-6 */
+                .port_ops       = &piix_sata_ops,
+        },
+        /* ich8_sata_ahci */
+        {
+                .sht            = &piix_sht,
+                .host_flags     = ATA_FLAG_SATA |
                                  PIIX_FLAG_CHECKINTR | PIIX_FLAG_SCR |
                                  PIIX_FLAG_AHCI,
                .pio_mask       = 0x1f, /* pio0-4 */
                .mwdma_mask     = 0x07, /* mwdma0-2 */
                .udma_mask      = 0x7f, /* udma0-6 */
                .port_ops       = &piix_sata_ops,
-                .private_data   = &ich6m_map_db,
        },
 };
@@ -508,46 +548,29 @@ static void piix_pata_error_handler(struct ata_port *ap)
 static int piix_sata_prereset(struct ata_port *ap)
 {
        struct pci_dev *pdev = to_pci_dev(ap->host_set->dev);
-        const unsigned int *map = ap->host_set->private_data;
+        struct piix_host_priv *hpriv = ap->host_set->private_data;
+        const unsigned int *map = hpriv->map;
        int base = 2 * ap->hard_port_no;
-        unsigned int present_mask = 0;
+        unsigned int present = 0;
        int port, i;
-        u8 pcs;
+        u16 pcs;
-        pci_read_config_byte(pdev, ICH5_PCS, &pcs);
+        pci_read_config_word(pdev, ICH5_PCS, &pcs);
        DPRINTK("ata%u: ENTER, pcs=0x%x base=%d\n", ap->id, pcs, base);
-        /* enable all ports on this ap and wait for them to settle */
-        for (i = 0; i < 2; i++) {
-                port = map[base + i];
-                if (port >= 0)
-                        pcs |= 1 << port;
-        }
-        pci_write_config_byte(pdev, ICH5_PCS, pcs);
-        msleep(100);
-        /* let's see which devices are present */
-        pci_read_config_byte(pdev, ICH5_PCS, &pcs);
        for (i = 0; i < 2; i++) {
                port = map[base + i];
                if (port < 0)
                        continue;
-                if (ap->flags & PIIX_FLAG_IGNORE_PCS || pcs & 1 << (4 + port))
+                if ((ap->flags & PIIX_FLAG_IGNORE_PCS) ||
-                        present_mask |= 1 << i;
+                    (pcs & 1 << (hpriv->map_db->present_shift + port)))
-                else
+                        present = 1;
-                        pcs &= ~(1 << port);
        }
-        /* disable offline ports on non-AHCI controllers */
-        if (!(ap->flags & PIIX_FLAG_AHCI))
-                pci_write_config_byte(pdev, ICH5_PCS, pcs);
        DPRINTK("ata%u: LEAVE, pcs=0x%x present_mask=0x%x\n",
                ap->id, pcs, present_mask);
-        if (!present_mask) {
+        if (!present) {
                ata_port_printk(ap, KERN_INFO, "SATA port has no device.\n");
                ap->eh_context.i.action &= ~ATA_EH_RESET_MASK;
                return 0;
@@ -761,10 +784,27 @@ static int __devinit piix_check_450nx_errata(struct pci_dev *ata_dev)
        return no_piix_dma;
 }
+static void __devinit piix_init_pcs(struct pci_dev *pdev,
+                                    const struct piix_map_db *map_db)
+{
+        u16 pcs, new_pcs;
+        pci_read_config_word(pdev, ICH5_PCS, &pcs);
+        new_pcs = pcs | map_db->port_enable;
+        if (new_pcs != pcs) {
+                DPRINTK("updating PCS from 0x%x to 0x%x\n", pcs, new_pcs);
+                pci_write_config_word(pdev, ICH5_PCS, new_pcs);
+                msleep(150);
+        }
+}
 static void __devinit piix_init_sata_map(struct pci_dev *pdev,
-                                         struct ata_port_info *pinfo)
+                                         struct ata_port_info *pinfo,
+                                         const struct piix_map_db *map_db)
 {
-        struct piix_map_db *map_db = pinfo[0].private_data;
+        struct piix_host_priv *hpriv = pinfo[0].private_data;
        const unsigned int *map;
        int i, invalid_map = 0;
        u8 map_value;
@@ -805,8 +845,8 @@ static void __devinit piix_init_sata_map(struct pci_dev *pdev,
                dev_printk(KERN_ERR, &pdev->dev,
                           "invalid MAP value %u\n", map_value);
-        pinfo[0].private_data = (void *)map;
+        hpriv->map = map;
-        pinfo[1].private_data = (void *)map;
+        hpriv->map_db = map_db;
 }
 /**
@@ -829,6 +869,7 @@ static int piix_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
        static int printed_version;
        struct ata_port_info port_info[2];
        struct ata_port_info *ppinfo[2] = { &port_info[0], &port_info[1] };
+        struct piix_host_priv *hpriv;
        unsigned long host_flags;
        if (!printed_version++)
@@ -839,8 +880,14 @@ static int piix_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
        if (!in_module_init)
                return -ENODEV;
+        hpriv = kzalloc(sizeof(*hpriv), GFP_KERNEL);
+        if (!hpriv)
+                return -ENOMEM;
        port_info[0] = piix_port_info[ent->driver_data];
        port_info[1] = piix_port_info[ent->driver_data];
+        port_info[0].private_data = hpriv;
+        port_info[1].private_data = hpriv;
        host_flags = port_info[0].host_flags;
@@ -855,8 +902,11 @@ static int piix_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
        }
        /* Initialize SATA map */
-        if (host_flags & ATA_FLAG_SATA)
+        if (host_flags & ATA_FLAG_SATA) {
-                piix_init_sata_map(pdev, port_info);
+                piix_init_sata_map(pdev, port_info,
+                                   piix_map_db_table[ent->driver_data]);
+                piix_init_pcs(pdev, piix_map_db_table[ent->driver_data]);
+        }
        /* On ICH5, some BIOSen disable the interrupt using the
         * PCI_COMMAND_INTX_DISABLE bit added in PCI 2.3.
@@ -879,6 +929,13 @@ static int piix_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
        return ata_pci_init_one(pdev, ppinfo, 2);
 }
+static void piix_host_stop(struct ata_host_set *host_set)
+{
+        if (host_set->next == NULL)
+                kfree(host_set->private_data);
+        ata_host_stop(host_set);
+}
 static int __init piix_init(void)
 {
        int rc;
diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c
index 007a14e5c3fd..e397129c90d1 100644
--- a/drivers/scsi/atari_NCR5380.c
+++ b/drivers/scsi/atari_NCR5380.c
@@ -507,7 +507,7 @@ static __inline__ void initialize_SCp(Scsi_Cmnd *cmd)
     */
    if (cmd->use_sg) {
-        cmd->SCp.buffer = (struct scatterlist *) cmd->buffer;
+        cmd->SCp.buffer = (struct scatterlist *) cmd->request_buffer;
        cmd->SCp.buffers_residual = cmd->use_sg - 1;
        cmd->SCp.ptr = (char *)page_address(cmd->SCp.buffer->page)+
                       cmd->SCp.buffer->offset;
diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c
index dddd2acce76f..61f6024b61ba 100644
--- a/drivers/scsi/constants.c
+++ b/drivers/scsi/constants.c
@@ -5,6 +5,7 @@
 * Additions for SCSI 3+ (SPC-3 T10/1416-D Rev 07 3 May 2002)
 *   by D. Gilbert and aeb (20020609)
 * Additions for SPC-3 T10/1416-D Rev 21 22 Sept 2004, D. Gilbert 20041025
+ * Update to SPC-4 T10/1713-D Rev 5a, 14 June 2006, D. Gilbert 20060702
 */
 #include <linux/blkdev.h>
@@ -36,55 +37,56 @@ static const char * cdb_byte0_names[] = {
 /* 00-03 */ "Test Unit Ready", "Rezero Unit/Rewind", NULL, "Request Sense",
 /* 04-07 */ "Format Unit/Medium", "Read Block Limits", NULL,
            "Reasssign Blocks",
-/* 08-0d */ "Read (6)", NULL, "Write (6)", "Seek (6)", NULL, NULL,
+/* 08-0d */ "Read(6)", NULL, "Write(6)", "Seek(6)", NULL, NULL,
 /* 0e-12 */ NULL, "Read Reverse", "Write Filemarks", "Space", "Inquiry",  
-/* 13-16 */ "Verify (6)", "Recover Buffered Data", "Mode Select (6)",
+/* 13-16 */ "Verify(6)", "Recover Buffered Data", "Mode Select(6)",
-            "Reserve (6)",
+            "Reserve(6)",
-/* 17-1a */ "Release (6)", "Copy", "Erase", "Mode Sense (6)", 
+/* 17-1a */ "Release(6)", "Copy", "Erase", "Mode Sense(6)",
 /* 1b-1d */ "Start/Stop Unit", "Receive Diagnostic", "Send Diagnostic", 
 /* 1e-1f */ "Prevent/Allow Medium Removal", NULL,
 /* 20-22 */  NULL, NULL, NULL,
 /* 23-28 */ "Read Format Capacities", "Set Window",
-            "Read Capacity (10)", NULL, NULL, "Read (10)", 
+            "Read Capacity(10)", NULL, NULL, "Read(10)",
-/* 29-2d */ "Read Generation", "Write (10)", "Seek (10)", "Erase (10)", 
+/* 29-2d */ "Read Generation", "Write(10)", "Seek(10)", "Erase(10)",
-            "Read updated block", 
+            "Read updated block",
-/* 2e-31 */ "Write Verify (10)", "Verify (10)", "Search High", "Search Equal", 
+/* 2e-31 */ "Write Verify(10)", "Verify(10)", "Search High", "Search Equal",
 /* 32-34 */ "Search Low", "Set Limits", "Prefetch/Read Position", 
-/* 35-37 */ "Synchronize Cache (10)", "Lock/Unlock Cache (10)",
+/* 35-37 */ "Synchronize Cache(10)", "Lock/Unlock Cache(10)",
            "Read Defect Data(10)", 
 /* 38-3c */ "Medium Scan", "Compare", "Copy Verify", "Write Buffer", 
            "Read Buffer", 
-/* 3d-3f */ "Update Block", "Read Long (10)",  "Write Long (10)",
+/* 3d-3f */ "Update Block", "Read Long(10)",  "Write Long(10)",
-/* 40-41 */ "Change Definition", "Write Same (10)",
+/* 40-41 */ "Change Definition", "Write Same(10)",
 /* 42-48 */ "Read sub-channel", "Read TOC/PMA/ATIP", "Read density support",
-            "Play audio (10)", "Get configuration", "Play audio msf",
+            "Play audio(10)", "Get configuration", "Play audio msf",
            "Play audio track/index",
-/* 49-4f */ "Play track relative (10)", "Get event status notification",
+/* 49-4f */ "Play track relative(10)", "Get event status notification",
            "Pause/resume", "Log Select", "Log Sense", "Stop play/scan",
            NULL,
 /* 50-55 */ "Xdwrite", "Xpwrite, Read disk info", "Xdread, Read track info",
-            "Reserve track", "Send OPC info", "Mode Select (10)",
+            "Reserve track", "Send OPC info", "Mode Select(10)",
-/* 56-5b */ "Reserve (10)", "Release (10)", "Repair track", "Read master cue",
+/* 56-5b */ "Reserve(10)", "Release(10)", "Repair track", "Read master cue",
-            "Mode Sense (10)", "Close track/session",
+            "Mode Sense(10)", "Close track/session",
 /* 5c-5f */ "Read buffer capacity", "Send cue sheet", "Persistent reserve in",
            "Persistent reserve out",
 /* 60-67 */ NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 /* 68-6f */ NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 /* 70-77 */ NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 /* 78-7f */ NULL, NULL, NULL, NULL, NULL, NULL, NULL, "Variable length",
-/* 80-84 */ "Xdwrite (16)", "Rebuild (16)", "Regenerate (16)", "Extended copy",
+/* 80-84 */ "Xdwrite(16)", "Rebuild(16)", "Regenerate(16)", "Extended copy",
            "Receive copy results",
-/* 85-89 */ "Memory Export In (16)", "Access control in", "Access control out",
+/* 85-89 */ "ATA command pass through(16)", "Access control in",
-            "Read (16)", "Memory Export Out (16)",
+            "Access control out", "Read(16)", "Memory Export Out(16)",
-/* 8a-8f */ "Write (16)", NULL, "Read attributes", "Write attributes",
+/* 8a-8f */ "Write(16)", NULL, "Read attributes", "Write attributes",
-            "Write and verify (16)", "Verify (16)",
+            "Write and verify(16)", "Verify(16)",
-/* 90-94 */ "Pre-fetch (16)", "Synchronize cache (16)",
+/* 90-94 */ "Pre-fetch(16)", "Synchronize cache(16)",
-            "Lock/unlock cache (16)", "Write same (16)", NULL,
+            "Lock/unlock cache(16)", "Write same(16)", NULL,
 /* 95-99 */ NULL, NULL, NULL, NULL, NULL,
-/* 9a-9f */ NULL, NULL, NULL, NULL, "Service action in (16)",
+/* 9a-9f */ NULL, NULL, NULL, NULL, "Service action in(16)",
-            "Service action out (16)",
+            "Service action out(16)",
-/* a0-a5 */ "Report luns", "Blank", "Send event", "Maintenance in",
+/* a0-a5 */ "Report luns", "ATA command pass through(12)/Blank",
-            "Maintenance out", "Move medium/play audio(12)",
+            "Security protocol in", "Maintenance in", "Maintenance out",
+            "Move medium/play audio(12)",
 /* a6-a9 */ "Exchange medium", "Move medium attached", "Read(12)",
            "Play track relative(12)",
 /* aa-ae */ "Write(12)", NULL, "Erase(12), Get Performance",
@@ -92,12 +94,12 @@ static const char * cdb_byte0_names[] = {
 /* af-b1 */ "Verify(12)", "Search data high(12)", "Search data equal(12)",
 /* b2-b4 */ "Search data low(12)", "Set limits(12)",
            "Read element status attached",
-/* b5-b6 */ "Request volume element address", "Send volume tag, set streaming",
+/* b5-b6 */ "Security protocol out", "Send volume tag, set streaming",
 /* b7-b9 */ "Read defect data(12)", "Read element status", "Read CD msf",
 /* ba-bc */ "Redundancy group (in), Scan",
-            "Redundancy group (out), Set cd-rom speed", "Spare in, Play cd",
+            "Redundancy group (out), Set cd-rom speed", "Spare (in), Play cd",
-/* bd-bf */ "Spare out, Mechanism status", "Volume set in, Read cd",
+/* bd-bf */ "Spare (out), Mechanism status", "Volume set (in), Read cd",
-            "Volume set out, Send DVD structure",
+            "Volume set (out), Send DVD structure",
 };
 struct value_name_pair {
@@ -112,6 +114,7 @@ static const struct value_name_pair maint_in_arr[] = {
        {0xc, "Report supported operation codes"},
        {0xd, "Report supported task management functions"},
        {0xe, "Report priority"},
+        {0xf, "Report timestamp"},
 };
 #define MAINT_IN_SZ ARRAY_SIZE(maint_in_arr)
@@ -120,6 +123,7 @@ static const struct value_name_pair maint_out_arr[] = {
        {0xa, "Set target port groups"},
        {0xb, "Change aliases"},
        {0xe, "Set priority"},
+        {0xe, "Set timestamp"},
 };
 #define MAINT_OUT_SZ ARRAY_SIZE(maint_out_arr)
@@ -427,6 +431,7 @@ static struct error_info additional[] =
        {0x001A, "Rewind operation in progress"},
        {0x001B, "Set capacity operation in progress"},
        {0x001C, "Verify operation in progress"},
+        {0x001D, "ATA pass through information available"},
        {0x0100, "No index/sector signal"},
@@ -438,7 +443,7 @@ static struct error_info additional[] =
        {0x0400, "Logical unit not ready, cause not reportable"},
        {0x0401, "Logical unit is in process of becoming ready"},
-        {0x0402, "Logical unit not ready, initializing cmd. required"},
+        {0x0402, "Logical unit not ready, initializing command required"},
        {0x0403, "Logical unit not ready, manual intervention required"},
        {0x0404, "Logical unit not ready, format in progress"},
        {0x0405, "Logical unit not ready, rebuild in progress"},
@@ -478,6 +483,9 @@ static struct error_info additional[] =
        {0x0B00, "Warning"},
        {0x0B01, "Warning - specified temperature exceeded"},
        {0x0B02, "Warning - enclosure degraded"},
+        {0x0B03, "Warning - background self-test failed"},
+        {0x0B04, "Warning - background pre-scan detected medium error"},
+        {0x0B05, "Warning - background medium scan detected medium error"},
        {0x0C00, "Write error"},
        {0x0C01, "Write error - recovered with auto reallocation"},
@@ -493,6 +501,7 @@ static struct error_info additional[] =
        {0x0C0B, "Auxiliary memory write error"},
        {0x0C0C, "Write error - unexpected unsolicited data"},
        {0x0C0D, "Write error - not enough unsolicited data"},
+        {0x0C0F, "Defects in error window"},
        {0x0D00, "Error detected by third party temporary initiator"},
        {0x0D01, "Third party device failure"},
@@ -504,11 +513,12 @@ static struct error_info additional[] =
        {0x0E00, "Invalid information unit"},
        {0x0E01, "Information unit too short"},
        {0x0E02, "Information unit too long"},
+        {0x0E03, "Invalid field in command information unit"},
        {0x1000, "Id CRC or ECC error"},
-        {0x1001, "Data block guard check failed"},
+        {0x1001, "Logical block guard check failed"},
-        {0x1002, "Data block application tag check failed"},
+        {0x1002, "Logical block application tag check failed"},
-        {0x1003, "Data block reference tag check failed"},
+        {0x1003, "Logical block reference tag check failed"},
        {0x1100, "Unrecovered read error"},
        {0x1101, "Read retries exhausted"},
@@ -530,6 +540,7 @@ static struct error_info additional[] =
        {0x1111, "Read error - loss of streaming"},
        {0x1112, "Auxiliary memory read error"},
        {0x1113, "Read error - failed retransmission request"},
+        {0x1114, "Read error - lba marked bad by application client"},
        {0x1200, "Address mark not found for id field"},
@@ -610,11 +621,14 @@ static struct error_info additional[] =
        {0x2100, "Logical block address out of range"},
        {0x2101, "Invalid element address"},
        {0x2102, "Invalid address for write"},
+        {0x2103, "Invalid write crossing layer jump"},
        {0x2200, "Illegal function (use 20 00, 24 00, or 26 00)"},
        {0x2400, "Invalid field in cdb"},
        {0x2401, "CDB decryption error"},
+        {0x2402, "Obsolete"},
+        {0x2403, "Obsolete"},
        {0x2404, "Security audit value frozen"},
        {0x2405, "Security working key frozen"},
        {0x2406, "Nonce not unique"},
@@ -637,7 +651,10 @@ static struct error_info additional[] =
        {0x260C, "Invalid operation for copy source or destination"},
        {0x260D, "Copy segment granularity violation"},
        {0x260E, "Invalid parameter while port is enabled"},
-        {0x260F, "Invalid data-out buffer integrity"},
+        {0x260F, "Invalid data-out buffer integrity check value"},
+        {0x2610, "Data decryption key fail limit reached"},
+        {0x2611, "Incomplete key-associated data set"},
+        {0x2612, "Vendor specific key reference not found"},
        {0x2700, "Write protected"},
        {0x2701, "Hardware write protected"},
@@ -649,6 +666,7 @@ static struct error_info additional[] =
        {0x2800, "Not ready to ready change, medium may have changed"},
        {0x2801, "Import or export element accessed"},
+        {0x2802, "Format-layer may have changed"},
        {0x2900, "Power on, reset, or bus device reset occurred"},
        {0x2901, "Power on occurred"},
@@ -669,6 +687,11 @@ static struct error_info additional[] =
        {0x2A07, "Implicit asymmetric access state transition failed"},
        {0x2A08, "Priority changed"},
        {0x2A09, "Capacity data has changed"},
+        {0x2A10, "Timestamp changed"},
+        {0x2A11, "Data encryption parameters changed by another i_t nexus"},
+        {0x2A12, "Data encryption parameters changed by vendor specific "
+                 "event"},
+        {0x2A13, "Data encryption key instance counter has changed"},
        {0x2B00, "Copy cannot execute since host cannot disconnect"},
@@ -690,6 +713,7 @@ static struct error_info additional[] =
        {0x2E00, "Insufficient time for operation"},
        {0x2F00, "Commands cleared by another initiator"},
+        {0x2F01, "Commands cleared by power loss notification"},
        {0x3000, "Incompatible medium installed"},
        {0x3001, "Cannot read medium - unknown format"},
@@ -702,7 +726,8 @@ static struct error_info additional[] =
        {0x3008, "Cannot write - application code mismatch"},
        {0x3009, "Current session not fixated for append"},
        {0x300A, "Cleaning request rejected"},
-        {0x300C, "WORM medium, overwrite attempted"},
+        {0x300C, "WORM medium - overwrite attempted"},
+        {0x300D, "WORM medium - integrity check"},
        {0x3010, "Medium not formatted"},
        {0x3100, "Medium format corrupted"},
@@ -790,6 +815,9 @@ static struct error_info additional[] =
        {0x3F0F, "Echo buffer overwritten"},
        {0x3F10, "Medium loadable"},
        {0x3F11, "Medium auxiliary memory accessible"},
+        {0x3F12, "iSCSI IP address added"},
+        {0x3F13, "iSCSI IP address removed"},
+        {0x3F14, "iSCSI IP address changed"},
 /*
 *      {0x40NN, "Ram failure"},
 *      {0x40NN, "Diagnostic failure on component nn"},
@@ -799,6 +827,7 @@ static struct error_info additional[] =
        {0x4300, "Message error"},
        {0x4400, "Internal target failure"},
+        {0x4471, "ATA device failed set features"},
        {0x4500, "Select or reselect failure"},
@@ -807,9 +836,10 @@ static struct error_info additional[] =
        {0x4700, "Scsi parity error"},
        {0x4701, "Data phase CRC error detected"},
        {0x4702, "Scsi parity error detected during st data phase"},
-        {0x4703, "Information unit CRC error detected"},
+        {0x4703, "Information unit iuCRC error detected"},
        {0x4704, "Asynchronous information protection error detected"},
        {0x4705, "Protocol service CRC error"},
+        {0x4706, "Phy test function in progress"},
        {0x477f, "Some commands cleared by iSCSI Protocol event"},
        {0x4800, "Initiator detected error message received"},
@@ -844,6 +874,8 @@ static struct error_info additional[] =
        {0x5300, "Media load or eject failed"},
        {0x5301, "Unload tape failure"},
        {0x5302, "Medium removal prevented"},
+        {0x5303, "Medium removal prevented by data transfer element"},
+        {0x5304, "Medium thread or unthread failure"},
        {0x5400, "Scsi to host system interface failure"},
@@ -855,6 +887,7 @@ static struct error_info additional[] =
        {0x5505, "Insufficient access control resources"},
        {0x5506, "Auxiliary memory out of space"},
        {0x5507, "Quota error"},
+        {0x5508, "Maximum number of supplemental decryption keys exceeded"},
        {0x5700, "Unable to recover table-of-contents"},
@@ -1004,6 +1037,7 @@ static struct error_info additional[] =
        {0x6708, "Assign failure occurred"},
        {0x6709, "Multiply assigned logical unit"},
        {0x670A, "Set target port groups command failed"},
+        {0x670B, "ATA device feature not enabled"},
        {0x6800, "Logical unit not configured"},
@@ -1030,6 +1064,8 @@ static struct error_info additional[] =
        {0x6F03, "Read of scrambled sector without authentication"},
        {0x6F04, "Media region code is mismatched to logical unit region"},
        {0x6F05, "Drive region must be permanent/region reset count error"},
+        {0x6F06, "Insufficient block count for binding nonce recording"},
+        {0x6F07, "Conflict in binding nonce recording"},
 /*
 *      {0x70NN, "Decompression exception short algorithm id of nn"},
 */
@@ -1041,6 +1077,8 @@ static struct error_info additional[] =
        {0x7203, "Session fixation error - incomplete track in session"},
        {0x7204, "Empty or partially written reserved track"},
        {0x7205, "No more track reservations allowed"},
+        {0x7206, "RMZ extension is not allowed"},
+        {0x7207, "No more test zone extensions are allowed"},
        {0x7300, "Cd control error"},
        {0x7301, "Power calibration area almost full"},
@@ -1049,6 +1087,18 @@ static struct error_info additional[] =
        {0x7304, "Program memory area update failure"},
        {0x7305, "Program memory area is full"},
        {0x7306, "RMA/PMA is almost full"},
+        {0x7310, "Current power calibration area almost full"},
+        {0x7311, "Current power calibration area is full"},
+        {0x7317, "RDZ is full"},
+        {0x7400, "Security error"},
+        {0x7401, "Unable to decrypt data"},
+        {0x7402, "Unencrypted data encountered while decrypting"},
+        {0x7403, "Incorrect data encryption key"},
+        {0x7404, "Cryptographic integrity validation failed"},
+        {0x7405, "Error decrypting data"},
+        {0x7471, "Logical unit access not authorized"},
        {0, NULL}
 };
diff --git a/drivers/scsi/esp.c b/drivers/scsi/esp.c
index 10573c24a50b..98bd22714d0d 100644
--- a/drivers/scsi/esp.c
+++ b/drivers/scsi/esp.c
@@ -1397,7 +1397,7 @@ static void esp_get_dmabufs(struct esp *esp, struct scsi_cmnd *sp)
                        sp->SCp.ptr = NULL;
                }
        } else {
-                sp->SCp.buffer = (struct scatterlist *) sp->buffer;
+                sp->SCp.buffer = (struct scatterlist *) sp->request_buffer;
                sp->SCp.buffers_residual = sbus_map_sg(esp->sdev,
                                                       sp->SCp.buffer,
                                                       sp->use_sg,
@@ -1410,7 +1410,7 @@ static void esp_get_dmabufs(struct esp *esp, struct scsi_cmnd *sp)
 static void esp_release_dmabufs(struct esp *esp, struct scsi_cmnd *sp)
 {
        if (sp->use_sg) {
-                sbus_unmap_sg(esp->sdev, sp->buffer, sp->use_sg,
+                sbus_unmap_sg(esp->sdev, sp->request_buffer, sp->use_sg,
                              sp->sc_data_direction);
        } else if (sp->request_bufflen) {
                sbus_unmap_single(esp->sdev,
@@ -2754,18 +2754,15 @@ static int esp_do_data_finale(struct esp *esp)
 */
 static int esp_should_clear_sync(struct scsi_cmnd *sp)
 {
-        u8 cmd1 = sp->cmnd[0];
+        u8 cmd = sp->cmnd[0];
-        u8 cmd2 = sp->data_cmnd[0];
        /* These cases are for spinning up a disk and
         * waiting for that spinup to complete.
         */
-        if (cmd1 == START_STOP ||
+        if (cmd == START_STOP)
-            cmd2 == START_STOP)
                return 0;
-        if (cmd1 == TEST_UNIT_READY ||
+        if (cmd == TEST_UNIT_READY)
-            cmd2 == TEST_UNIT_READY)
                return 0;
        /* One more special case for SCSI tape drives,
@@ -2773,8 +2770,7 @@ static int esp_should_clear_sync(struct scsi_cmnd *sp)
         * completion of a rewind or tape load operation.
         */
        if (sp->device->type == TYPE_TAPE) {
-                if (cmd1 == MODE_SENSE ||
+                if (cmd == MODE_SENSE)
-                    cmd2 == MODE_SENSE)
                        return 0;
        }
diff --git a/drivers/scsi/ibmvscsi/iseries_vscsi.c b/drivers/scsi/ibmvscsi/iseries_vscsi.c
index 7eed0b098171..6aeb5f003c3c 100644
--- a/drivers/scsi/ibmvscsi/iseries_vscsi.c
+++ b/drivers/scsi/ibmvscsi/iseries_vscsi.c
@@ -81,7 +81,7 @@ int ibmvscsi_init_crq_queue(struct crq_queue *queue,
        int rc;
        single_host_data = hostdata;
-        rc = viopath_open(viopath_hostLp, viomajorsubtype_scsi, 0);
+        rc = viopath_open(viopath_hostLp, viomajorsubtype_scsi, max_requests);
        if (rc < 0) {
                printk("viopath_open failed with rc %d in open_event_path\n",
                       rc);
diff --git a/drivers/scsi/ibmvscsi/rpa_vscsi.c b/drivers/scsi/ibmvscsi/rpa_vscsi.c
index 242b8873b333..ed22b96580c6 100644
--- a/drivers/scsi/ibmvscsi/rpa_vscsi.c
+++ b/drivers/scsi/ibmvscsi/rpa_vscsi.c
@@ -238,6 +238,7 @@ int ibmvscsi_init_crq_queue(struct crq_queue *queue,
        if (rc == 2) {
                /* Adapter is good, but other end is not ready */
                printk(KERN_WARNING "ibmvscsi: Partner adapter not ready\n");
+                retrc = 0;
        } else if (rc != 0) {
                printk(KERN_WARNING "ibmvscsi: Error %d opening adapter\n", rc);
                goto reg_crq_failed;
diff --git a/drivers/scsi/jazz_esp.c b/drivers/scsi/jazz_esp.c
index 3fd8a96f2af3..bfac4441d89f 100644
--- a/drivers/scsi/jazz_esp.c
+++ b/drivers/scsi/jazz_esp.c
@@ -257,7 +257,7 @@ static void dma_mmu_release_scsi_one (struct NCR_ESP *esp, struct scsi_cmnd *sp)
 static void dma_mmu_release_scsi_sgl (struct NCR_ESP *esp, struct scsi_cmnd *sp)
 {
    int sz = sp->use_sg - 1;
-    struct scatterlist *sg = (struct scatterlist *)sp->buffer;
+    struct scatterlist *sg = (struct scatterlist *)sp->request_buffer;
                        
    while(sz >= 0) {
        vdma_free(sg[sz].dma_address);
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index f81691fcf177..d44f9aac6b8f 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -21,10 +21,12 @@
 struct lpfc_sli2_slim;
-#define LPFC_MAX_TARGET         256     /* max targets supported */
-#define LPFC_MAX_DISC_THREADS   64      /* max outstanding discovery els req */
-#define LPFC_MAX_NS_RETRY       3       /* max NameServer retries */
+#define LPFC_MAX_TARGET         256     /* max number of targets supported */
+#define LPFC_MAX_DISC_THREADS   64      /* max outstanding discovery els
+                                           requests */
+#define LPFC_MAX_NS_RETRY       3       /* Number of retry attempts to contact
+                                           the NameServer  before giving up. */
 #define LPFC_DFT_HBA_Q_DEPTH    2048    /* max cmds per hba */
 #define LPFC_LC_HBA_Q_DEPTH     1024    /* max cmds per low cost hba */
 #define LPFC_LP101_HBA_Q_DEPTH  128     /* max cmds per low cost hba */
@@ -41,7 +43,6 @@ struct lpfc_sli2_slim;
                             (( (u64)(high)<<16 ) << 16)|( (u64)(low))))
 /* Provide maximum configuration definitions. */
 #define LPFC_DRVR_TIMEOUT       16      /* driver iocb timeout value in sec */
-#define MAX_FCP_TARGET          256     /* max num of FCP targets supported */
 #define FC_MAX_ADPTMSG          64
 #define MAX_HBAEVT      32
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index b62a72dfab29..5c68cdd8736f 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -219,9 +219,19 @@ lpfc_issue_lip(struct Scsi_Host *host)
                return -ENOMEM;
        memset((void *)pmboxq, 0, sizeof (LPFC_MBOXQ_t));
-        lpfc_init_link(phba, pmboxq, phba->cfg_topology, phba->cfg_link_speed);
+        pmboxq->mb.mbxCommand = MBX_DOWN_LINK;
+        pmboxq->mb.mbxOwner = OWN_HOST;
        mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, phba->fc_ratov * 2);
+        if ((mbxstatus == MBX_SUCCESS) && (pmboxq->mb.mbxStatus == 0)) {
+                memset((void *)pmboxq, 0, sizeof (LPFC_MBOXQ_t));
+                lpfc_init_link(phba, pmboxq, phba->cfg_topology,
+                               phba->cfg_link_speed);
+                mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq,
+                                                     phba->fc_ratov * 2);
+        }
        if (mbxstatus == MBX_TIMEOUT)
                pmboxq->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
        else
@@ -233,51 +243,53 @@ lpfc_issue_lip(struct Scsi_Host *host)
        return 0;
 }
-static ssize_t
+static int
-lpfc_nport_evt_cnt_show(struct class_device *cdev, char *buf)
+lpfc_selective_reset(struct lpfc_hba *phba)
 {
-        struct Scsi_Host *host = class_to_shost(cdev);
+        struct completion online_compl;
-        struct lpfc_hba *phba = (struct lpfc_hba*)host->hostdata;
+        int status = 0;
-        return snprintf(buf, PAGE_SIZE, "%d\n", phba->nport_event_cnt);
+        init_completion(&online_compl);
+        lpfc_workq_post_event(phba, &status, &online_compl,
+                              LPFC_EVT_OFFLINE);
+        wait_for_completion(&online_compl);
+        if (status != 0)
+                return -EIO;
+        init_completion(&online_compl);
+        lpfc_workq_post_event(phba, &status, &online_compl,
+                              LPFC_EVT_ONLINE);
+        wait_for_completion(&online_compl);
+        if (status != 0)
+                return -EIO;
+        return 0;
 }
 static ssize_t
-lpfc_board_online_show(struct class_device *cdev, char *buf)
+lpfc_issue_reset(struct class_device *cdev, const char *buf, size_t count)
 {
        struct Scsi_Host *host = class_to_shost(cdev);
        struct lpfc_hba *phba = (struct lpfc_hba*)host->hostdata;
+        int status = -EINVAL;
-        if (phba->fc_flag & FC_OFFLINE_MODE)
+        if (strncmp(buf, "selective", sizeof("selective") - 1) == 0)
-                return snprintf(buf, PAGE_SIZE, "0\n");
+                status = lpfc_selective_reset(phba);
+        if (status == 0)
+                return strlen(buf);
        else
-                return snprintf(buf, PAGE_SIZE, "1\n");
+                return status;
 }
 static ssize_t
-lpfc_board_online_store(struct class_device *cdev, const char *buf,
+lpfc_nport_evt_cnt_show(struct class_device *cdev, char *buf)
-                                                                size_t count)
 {
        struct Scsi_Host *host = class_to_shost(cdev);
        struct lpfc_hba *phba = (struct lpfc_hba*)host->hostdata;
-        struct completion online_compl;
+        return snprintf(buf, PAGE_SIZE, "%d\n", phba->nport_event_cnt);
-        int val=0, status=0;
-        if (sscanf(buf, "%d", &val) != 1)
-                return -EINVAL;
-        init_completion(&online_compl);
-        if (val)
-                lpfc_workq_post_event(phba, &status, &online_compl,
-                                                        LPFC_EVT_ONLINE);
-        else
-                lpfc_workq_post_event(phba, &status, &online_compl,
-                                                        LPFC_EVT_OFFLINE);
-        wait_for_completion(&online_compl);
-        if (!status)
-                return strlen(buf);
-        else
-                return -EIO;
 }
 static ssize_t
@@ -532,10 +544,9 @@ static CLASS_DEVICE_ATTR(lpfc_drvr_version, S_IRUGO, lpfc_drvr_version_show,
                         NULL);
 static CLASS_DEVICE_ATTR(management_version, S_IRUGO, management_version_show,
                         NULL);
-static CLASS_DEVICE_ATTR(board_online, S_IRUGO | S_IWUSR,
-                         lpfc_board_online_show, lpfc_board_online_store);
 static CLASS_DEVICE_ATTR(board_mode, S_IRUGO | S_IWUSR,
                         lpfc_board_mode_show, lpfc_board_mode_store);
+static CLASS_DEVICE_ATTR(issue_reset, S_IWUSR, NULL, lpfc_issue_reset);
 static int lpfc_poll = 0;
 module_param(lpfc_poll, int, 0);
@@ -695,12 +706,12 @@ LPFC_ATTR(discovery_threads, 32, 1, 64, "Maximum number of ELS commands "
                 "during discovery");
 /*
-# lpfc_max_luns: maximum number of LUNs per target driver will support
+# lpfc_max_luns: maximum allowed LUN.
-# Value range is [1,32768]. Default value is 256.
+# Value range is [0,65535]. Default value is 255.
-# NOTE: The SCSI layer will scan each target for this many luns
+# NOTE: The SCSI layer might probe all allowed LUN on some old targets.
 */
-LPFC_ATTR_R(max_luns, 256, 1, 32768,
+LPFC_ATTR_R(max_luns, 255, 0, 65535,
-             "Maximum number of LUNs per target driver will support");
+             "Maximum allowed LUN");
 /*
 # lpfc_poll_tmo: .Milliseconds driver will wait between polling FCP ring.
@@ -739,8 +750,8 @@ struct class_device_attribute *lpfc_host_attrs[] = {
        &class_device_attr_lpfc_max_luns,
        &class_device_attr_nport_evt_cnt,
        &class_device_attr_management_version,
-        &class_device_attr_board_online,
        &class_device_attr_board_mode,
+        &class_device_attr_issue_reset,
        &class_device_attr_lpfc_poll,
        &class_device_attr_lpfc_poll_tmo,
        NULL,
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index ee22173fce43..517e9e4dd461 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -147,6 +147,7 @@ int lpfc_sli_hba_setup(struct lpfc_hba *);
 int lpfc_sli_hba_down(struct lpfc_hba *);
 int lpfc_sli_issue_mbox(struct lpfc_hba *, LPFC_MBOXQ_t *, uint32_t);
 int lpfc_sli_handle_mb_event(struct lpfc_hba *);
+int lpfc_sli_flush_mbox_queue(struct lpfc_hba *);
 int lpfc_sli_handle_slow_ring_event(struct lpfc_hba *,
                                    struct lpfc_sli_ring *, uint32_t);
 void lpfc_sli_def_mbox_cmpl(struct lpfc_hba *, LPFC_MBOXQ_t *);
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 4126fd87956f..b89f6cb641e6 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -648,33 +648,32 @@ lpfc_more_plogi(struct lpfc_hba * phba)
 }
 static struct lpfc_nodelist *
-lpfc_plogi_confirm_nport(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
+lpfc_plogi_confirm_nport(struct lpfc_hba * phba, struct lpfc_dmabuf *prsp,
                         struct lpfc_nodelist *ndlp)
 {
        struct lpfc_nodelist *new_ndlp;
-        struct lpfc_dmabuf *pcmd, *prsp;
        uint32_t *lp;
        struct serv_parm *sp;
        uint8_t name[sizeof (struct lpfc_name)];
        uint32_t rc;
-        pcmd = (struct lpfc_dmabuf *) cmdiocb->context2;
-        prsp = (struct lpfc_dmabuf *) pcmd->list.next;
        lp = (uint32_t *) prsp->virt;
        sp = (struct serv_parm *) ((uint8_t *) lp + sizeof (uint32_t));
+        memset(name, 0, sizeof (struct lpfc_name));
        /* Now we to find out if the NPort we are logging into, matches the WWPN
         * we have for that ndlp. If not, we have some work to do.
         */
        new_ndlp = lpfc_findnode_wwpn(phba, NLP_SEARCH_ALL, &sp->portName);
-        memset(name, 0, sizeof (struct lpfc_name));
+        if (new_ndlp == ndlp)
-        rc =  memcmp(&ndlp->nlp_portname, name, sizeof(struct lpfc_name));
-        if (!rc || (new_ndlp == ndlp)) {
                return ndlp;
-        }
        if (!new_ndlp) {
+                rc =
+                   memcmp(&ndlp->nlp_portname, name, sizeof(struct lpfc_name));
+                if (!rc)
+                        return ndlp;
                new_ndlp = mempool_alloc(phba->nlp_mem_pool, GFP_ATOMIC);
                if (!new_ndlp)
                        return ndlp;
@@ -683,17 +682,21 @@ lpfc_plogi_confirm_nport(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
        }
        lpfc_unreg_rpi(phba, new_ndlp);
-        new_ndlp->nlp_prev_state = ndlp->nlp_state;
        new_ndlp->nlp_DID = ndlp->nlp_DID;
-        new_ndlp->nlp_state = NLP_STE_PLOGI_ISSUE;
+        new_ndlp->nlp_prev_state = ndlp->nlp_prev_state;
-        lpfc_nlp_list(phba, new_ndlp, NLP_PLOGI_LIST);
+        new_ndlp->nlp_state = ndlp->nlp_state;
+        lpfc_nlp_list(phba, new_ndlp, ndlp->nlp_flag & NLP_LIST_MASK);
        /* Move this back to NPR list */
-        lpfc_unreg_rpi(phba, ndlp);
+        if (memcmp(&ndlp->nlp_portname, name, sizeof(struct lpfc_name)) == 0) {
-        ndlp->nlp_DID = 0; /* Two ndlps cannot have the same did */
+                lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
-        ndlp->nlp_state = NLP_STE_NPR_NODE;
+        }
-        lpfc_nlp_list(phba, ndlp, NLP_NPR_LIST);
+        else {
+                lpfc_unreg_rpi(phba, ndlp);
+                ndlp->nlp_DID = 0; /* Two ndlps cannot have the same did */
+                ndlp->nlp_state = NLP_STE_NPR_NODE;
+                lpfc_nlp_list(phba, ndlp, NLP_NPR_LIST);
+        }
        return new_ndlp;
 }
@@ -703,6 +706,7 @@ lpfc_cmpl_els_plogi(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
 {
        IOCB_t *irsp;
        struct lpfc_nodelist *ndlp;
+        struct lpfc_dmabuf *prsp;
        int disc, rc, did, type;
@@ -769,7 +773,10 @@ lpfc_cmpl_els_plogi(struct lpfc_hba * phba, struct lpfc_iocbq * cmdiocb,
                }
        } else {
                /* Good status, call state machine */
-                ndlp = lpfc_plogi_confirm_nport(phba, cmdiocb, ndlp);
+                prsp = list_entry(((struct lpfc_dmabuf *)
+                        cmdiocb->context2)->list.next,
+                        struct lpfc_dmabuf, list);
+                ndlp = lpfc_plogi_confirm_nport(phba, prsp, ndlp);
                rc = lpfc_disc_state_machine(phba, ndlp, cmdiocb,
                                        NLP_EVT_CMPL_PLOGI);
        }
@@ -3282,10 +3289,9 @@ lpfc_els_timeout_handler(struct lpfc_hba *phba)
                } else
                        lpfc_sli_release_iocbq(phba, piocb);
        }
-        if (phba->sli.ring[LPFC_ELS_RING].txcmplq_cnt) {
+        if (phba->sli.ring[LPFC_ELS_RING].txcmplq_cnt)
-                phba->els_tmofunc.expires = jiffies + HZ * timeout;
+                mod_timer(&phba->els_tmofunc, jiffies + HZ * timeout);
-                add_timer(&phba->els_tmofunc);
-        }
        spin_unlock_irq(phba->host->host_lock);
 }
@@ -3442,6 +3448,8 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                if ((did & Fabric_DID_MASK) == Fabric_DID_MASK) {
                        ndlp->nlp_type |= NLP_FABRIC;
                }
+                ndlp->nlp_state = NLP_STE_UNUSED_NODE;
+                lpfc_nlp_list(phba, ndlp, NLP_UNUSED_LIST);
        }
        phba->fc_stat.elsRcvFrame++;
@@ -3463,13 +3471,14 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                        rjt_err = 1;
                        break;
                }
+                ndlp = lpfc_plogi_confirm_nport(phba, mp, ndlp);
                lpfc_disc_state_machine(phba, ndlp, elsiocb, NLP_EVT_RCV_PLOGI);
                break;
        case ELS_CMD_FLOGI:
                phba->fc_stat.elsRcvFLOGI++;
                lpfc_els_rcv_flogi(phba, elsiocb, ndlp, newnode);
                if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                }
                break;
        case ELS_CMD_LOGO:
@@ -3492,7 +3501,7 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                phba->fc_stat.elsRcvRSCN++;
                lpfc_els_rcv_rscn(phba, elsiocb, ndlp, newnode);
                if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                }
                break;
        case ELS_CMD_ADISC:
@@ -3535,28 +3544,28 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                phba->fc_stat.elsRcvLIRR++;
                lpfc_els_rcv_lirr(phba, elsiocb, ndlp);
                if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                }
                break;
        case ELS_CMD_RPS:
                phba->fc_stat.elsRcvRPS++;
                lpfc_els_rcv_rps(phba, elsiocb, ndlp);
                if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                }
                break;
        case ELS_CMD_RPL:
                phba->fc_stat.elsRcvRPL++;
                lpfc_els_rcv_rpl(phba, elsiocb, ndlp);
                if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                }
                break;
        case ELS_CMD_RNID:
                phba->fc_stat.elsRcvRNID++;
                lpfc_els_rcv_rnid(phba, elsiocb, ndlp);
                if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                }
                break;
        default:
@@ -3568,7 +3577,7 @@ lpfc_els_unsol_event(struct lpfc_hba * phba,
                                "%d:0115 Unknown ELS command x%x received from "
                                "NPORT x%x\n", phba->brd_no, cmd, did);
                if (newnode) {
-                        mempool_free( ndlp, phba->nlp_mem_pool);
+                        lpfc_nlp_list(phba, ndlp, NLP_NO_LIST);
                }
                break;
        }
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index adb086009ae0..4d6cf990c4fc 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -1084,7 +1084,7 @@ lpfc_register_remote_port(struct lpfc_hba * phba,
                fc_remote_port_rolechg(rport, rport_ids.roles);
        if ((rport->scsi_target_id != -1) &&
-                (rport->scsi_target_id < MAX_FCP_TARGET)) {
+                (rport->scsi_target_id < LPFC_MAX_TARGET)) {
                ndlp->nlp_sid = rport->scsi_target_id;
        }
@@ -1313,7 +1313,7 @@ lpfc_nlp_list(struct lpfc_hba * phba, struct lpfc_nodelist * nlp, int list)
                        if ((rport_add == mapped) &&
                            ((!nlp->rport) ||
                             (nlp->rport->scsi_target_id == -1) ||
-                             (nlp->rport->scsi_target_id >= MAX_FCP_TARGET))) {
+                             (nlp->rport->scsi_target_id >= LPFC_MAX_TARGET))) {
                                nlp->nlp_state = NLP_STE_UNMAPPED_NODE;
                                spin_lock_irq(phba->host->host_lock);
                                nlp->nlp_flag |= NLP_TGT_NO_SCSIID;
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 81755a3f7c68..ef47b824cbed 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -71,6 +71,7 @@ lpfc_config_port_prep(struct lpfc_hba * phba)
        uint16_t offset = 0;
        static char licensed[56] =
                    "key unlock for use with gnu public licensed code only\0";
+        static int init_key = 1;
        pmb = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
        if (!pmb) {
@@ -82,10 +83,13 @@ lpfc_config_port_prep(struct lpfc_hba * phba)
        phba->hba_state = LPFC_INIT_MBX_CMDS;
        if (lpfc_is_LC_HBA(phba->pcidev->device)) {
-                uint32_t *ptext = (uint32_t *) licensed;
+                if (init_key) {
+                        uint32_t *ptext = (uint32_t *) licensed;
-                for (i = 0; i < 56; i += sizeof (uint32_t), ptext++)
+                        for (i = 0; i < 56; i += sizeof (uint32_t), ptext++)
-                        *ptext = cpu_to_be32(*ptext);
+                                *ptext = cpu_to_be32(*ptext);
+                        init_key = 0;
+                }
                lpfc_read_nv(phba, pmb);
                memset((char*)mb->un.varRDnvp.rsvd3, 0,
@@ -405,19 +409,26 @@ lpfc_config_port_post(struct lpfc_hba * phba)
        }
        /* MBOX buffer will be freed in mbox compl */
-        i = 0;
+        return (0);
+}
+static int
+lpfc_discovery_wait(struct lpfc_hba *phba)
+{
+        int i = 0;
        while ((phba->hba_state != LPFC_HBA_READY) ||
               (phba->num_disc_nodes) || (phba->fc_prli_sent) ||
               ((phba->fc_map_cnt == 0) && (i<2)) ||
-               (psli->sli_flag & LPFC_SLI_MBOX_ACTIVE)) {
+               (phba->sli.sli_flag & LPFC_SLI_MBOX_ACTIVE)) {
                /* Check every second for 30 retries. */
                i++;
                if (i > 30) {
-                        break;
+                        return -ETIMEDOUT;
                }
                if ((i >= 15) && (phba->hba_state <= LPFC_LINK_DOWN)) {
                        /* The link is down.  Set linkdown timeout */
-                        break;
+                        return -ETIMEDOUT;
                }
                /* Delay for 1 second to give discovery time to complete. */
@@ -425,12 +436,7 @@ lpfc_config_port_post(struct lpfc_hba * phba)
        }
-        /* Since num_disc_nodes keys off of PLOGI, delay a bit to let
+        return 0;
-         * any potential PRLIs to flush thru the SLI sub-system.
-         */
-        msleep(50);
-        return (0);
 }
 /************************************************************************/
@@ -1339,7 +1345,8 @@ lpfc_offline(struct lpfc_hba * phba)
        struct lpfc_sli_ring *pring;
        struct lpfc_sli *psli;
        unsigned long iflag;
-        int i = 0;
+        int i;
+        int cnt = 0;
        if (!phba)
                return 0;
@@ -1348,17 +1355,27 @@ lpfc_offline(struct lpfc_hba * phba)
                return 0;
        psli = &phba->sli;
-        pring = &psli->ring[psli->fcp_ring];
        lpfc_linkdown(phba);
+        lpfc_sli_flush_mbox_queue(phba);
-        /* The linkdown event takes 30 seconds to timeout. */
+        for (i = 0; i < psli->num_rings; i++) {
-        while (pring->txcmplq_cnt) {
+                pring = &psli->ring[i];
-                mdelay(10);
+                /* The linkdown event takes 30 seconds to timeout. */
-                if (i++ > 3000)
+                while (pring->txcmplq_cnt) {
-                        break;
+                        mdelay(10);
+                        if (cnt++ > 3000) {
+                                lpfc_printf_log(phba,
+                                        KERN_WARNING, LOG_INIT,
+                                        "%d:0466 Outstanding IO when "
+                                        "bringing Adapter offline\n",
+                                        phba->brd_no);
+                                break;
+                        }
+                }
        }
        /* stop all timers associated with this hba */
        lpfc_stop_timer(phba);
        phba->work_hba_events = 0;
@@ -1639,6 +1656,8 @@ lpfc_pci_probe_one(struct pci_dev *pdev, const struct pci_device_id *pid)
                goto out_free_irq;
        }
+        lpfc_discovery_wait(phba);
        if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
                spin_lock_irq(phba->host->host_lock);
                lpfc_poll_start_timer(phba);
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index 07017658ac56..066292d3995a 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -133,6 +133,11 @@ lpfc_mem_free(struct lpfc_hba * phba)
        pci_pool_destroy(phba->lpfc_scsi_dma_buf_pool);
        pci_pool_destroy(phba->lpfc_mbuf_pool);
+        /* Free the iocb lookup array */
+        kfree(psli->iocbq_lookup);
+        psli->iocbq_lookup = NULL;
 }
 void *
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 27d60ad897cd..bd0b0e293d63 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -1110,6 +1110,17 @@ lpfc_cmpl_reglogin_reglogin_issue(struct lpfc_hba * phba,
                                phba->brd_no,
                                did, mb->mbxStatus, phba->hba_state);
+                /*
+                 * If RegLogin failed due to lack of HBA resources do not
+                 * retry discovery.
+                 */
+                if (mb->mbxStatus == MBXERR_RPI_FULL) {
+                        ndlp->nlp_prev_state = NLP_STE_UNUSED_NODE;
+                        ndlp->nlp_state = NLP_STE_UNUSED_NODE;
+                        lpfc_nlp_list(phba, ndlp, NLP_UNUSED_LIST);
+                        return ndlp->nlp_state;
+                }
                /* Put ndlp in npr list set plogi timer for 1 sec */
                mod_timer(&ndlp->nlp_delayfunc, jiffies + HZ * 1);
                spin_lock_irq(phba->host->host_lock);
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index aea1ee472f3d..a760a44173df 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -153,22 +153,6 @@ static void
 lpfc_release_scsi_buf(struct lpfc_hba * phba, struct lpfc_scsi_buf * psb)
 {
        unsigned long iflag = 0;
-        /*
-         * There are only two special cases to consider.  (1) the scsi command
-         * requested scatter-gather usage or (2) the scsi command allocated
-         * a request buffer, but did not request use_sg.  There is a third
-         * case, but it does not require resource deallocation.
-         */
-        if ((psb->seg_cnt > 0) && (psb->pCmd->use_sg)) {
-                dma_unmap_sg(&phba->pcidev->dev, psb->pCmd->request_buffer,
-                                psb->seg_cnt, psb->pCmd->sc_data_direction);
-        } else {
-                 if ((psb->nonsg_phys) && (psb->pCmd->request_bufflen)) {
-                        dma_unmap_single(&phba->pcidev->dev, psb->nonsg_phys,
-                                                psb->pCmd->request_bufflen,
-                                                psb->pCmd->sc_data_direction);
-                 }
-        }
        spin_lock_irqsave(&phba->scsi_buf_list_lock, iflag);
        psb->pCmd = NULL;
@@ -282,6 +266,27 @@ lpfc_scsi_prep_dma_buf(struct lpfc_hba * phba, struct lpfc_scsi_buf * lpfc_cmd)
 }
 static void
+lpfc_scsi_unprep_dma_buf(struct lpfc_hba * phba, struct lpfc_scsi_buf * psb)
+{
+        /*
+         * There are only two special cases to consider.  (1) the scsi command
+         * requested scatter-gather usage or (2) the scsi command allocated
+         * a request buffer, but did not request use_sg.  There is a third
+         * case, but it does not require resource deallocation.
+         */
+        if ((psb->seg_cnt > 0) && (psb->pCmd->use_sg)) {
+                dma_unmap_sg(&phba->pcidev->dev, psb->pCmd->request_buffer,
+                                psb->seg_cnt, psb->pCmd->sc_data_direction);
+        } else {
+                 if ((psb->nonsg_phys) && (psb->pCmd->request_bufflen)) {
+                        dma_unmap_single(&phba->pcidev->dev, psb->nonsg_phys,
+                                                psb->pCmd->request_bufflen,
+                                                psb->pCmd->sc_data_direction);
+                 }
+        }
+}
+static void
 lpfc_handle_fcp_err(struct lpfc_scsi_buf *lpfc_cmd)
 {
        struct scsi_cmnd *cmnd = lpfc_cmd->pCmd;
@@ -454,6 +459,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
        cmd->scsi_done(cmd);
        if (phba->cfg_poll & ENABLE_FCP_RING_POLLING) {
+                lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
                lpfc_release_scsi_buf(phba, lpfc_cmd);
                return;
        }
@@ -511,6 +517,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
                }
        }
+        lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
        lpfc_release_scsi_buf(phba, lpfc_cmd);
 }
@@ -609,6 +616,7 @@ lpfc_scsi_prep_cmnd(struct lpfc_hba * phba, struct lpfc_scsi_buf * lpfc_cmd,
 static int
 lpfc_scsi_prep_task_mgmt_cmd(struct lpfc_hba *phba,
                             struct lpfc_scsi_buf *lpfc_cmd,
+                             unsigned int lun,
                             uint8_t task_mgmt_cmd)
 {
        struct lpfc_sli *psli;
@@ -627,8 +635,7 @@ lpfc_scsi_prep_task_mgmt_cmd(struct lpfc_hba *phba,
        piocb = &piocbq->iocb;
        fcp_cmnd = lpfc_cmd->fcp_cmnd;
-        int_to_scsilun(lpfc_cmd->pCmd->device->lun,
+        int_to_scsilun(lun, &lpfc_cmd->fcp_cmnd->fcp_lun);
-                        &lpfc_cmd->fcp_cmnd->fcp_lun);
        fcp_cmnd->fcpCntl2 = task_mgmt_cmd;
        piocb->ulpCommand = CMD_FCP_ICMND64_CR;
@@ -655,14 +662,16 @@ lpfc_scsi_prep_task_mgmt_cmd(struct lpfc_hba *phba,
 static int
 lpfc_scsi_tgt_reset(struct lpfc_scsi_buf * lpfc_cmd, struct lpfc_hba * phba,
-                    unsigned  tgt_id, struct lpfc_rport_data *rdata)
+                    unsigned  tgt_id, unsigned int lun,
+                    struct lpfc_rport_data *rdata)
 {
        struct lpfc_iocbq *iocbq;
        struct lpfc_iocbq *iocbqrsp;
        int ret;
        lpfc_cmd->rdata = rdata;
-        ret = lpfc_scsi_prep_task_mgmt_cmd(phba, lpfc_cmd, FCP_TARGET_RESET);
+        ret = lpfc_scsi_prep_task_mgmt_cmd(phba, lpfc_cmd, lun,
+                                           FCP_TARGET_RESET);
        if (!ret)
                return FAILED;
@@ -822,6 +831,7 @@ lpfc_queuecommand(struct scsi_cmnd *cmnd, void (*done) (struct scsi_cmnd *))
        return 0;
 out_host_busy_free_buf:
+        lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
        lpfc_release_scsi_buf(phba, lpfc_cmd);
 out_host_busy:
        return SCSI_MLQUEUE_HOST_BUSY;
@@ -969,12 +979,12 @@ lpfc_reset_lun_handler(struct scsi_cmnd *cmnd)
        if (lpfc_cmd == NULL)
                goto out;
-        lpfc_cmd->pCmd = cmnd;
        lpfc_cmd->timeout = 60;
        lpfc_cmd->scsi_hba = phba;
        lpfc_cmd->rdata = rdata;
-        ret = lpfc_scsi_prep_task_mgmt_cmd(phba, lpfc_cmd, FCP_LUN_RESET);
+        ret = lpfc_scsi_prep_task_mgmt_cmd(phba, lpfc_cmd, cmnd->device->lun,
+                                           FCP_LUN_RESET);
        if (!ret)
                goto out_free_scsi_buf;
@@ -1001,7 +1011,6 @@ lpfc_reset_lun_handler(struct scsi_cmnd *cmnd)
        cmd_status = iocbqrsp->iocb.ulpStatus;
        lpfc_sli_release_iocbq(phba, iocbqrsp);
-        lpfc_release_scsi_buf(phba, lpfc_cmd);
        /*
         * All outstanding txcmplq I/Os should have been aborted by the device.
@@ -1040,6 +1049,8 @@ lpfc_reset_lun_handler(struct scsi_cmnd *cmnd)
        }
 out_free_scsi_buf:
+        lpfc_release_scsi_buf(phba, lpfc_cmd);
        lpfc_printf_log(phba, KERN_ERR, LOG_FCP,
                        "%d:0713 SCSI layer issued LUN reset (%d, %d) "
                        "Data: x%x x%x x%x\n",
@@ -1070,7 +1081,6 @@ lpfc_reset_bus_handler(struct scsi_cmnd *cmnd)
        /* The lpfc_cmd storage is reused.  Set all loop invariants. */
        lpfc_cmd->timeout = 60;
-        lpfc_cmd->pCmd = cmnd;
        lpfc_cmd->scsi_hba = phba;
        /*
@@ -1078,7 +1088,7 @@ lpfc_reset_bus_handler(struct scsi_cmnd *cmnd)
         * targets known to the driver.  Should any target reset
         * fail, this routine returns failure to the midlayer.
         */
-        for (i = 0; i < MAX_FCP_TARGET; i++) {
+        for (i = 0; i < LPFC_MAX_TARGET; i++) {
                /* Search the mapped list for this target ID */
                match = 0;
                list_for_each_entry(ndlp, &phba->fc_nlpmap_list, nlp_listp) {
@@ -1090,8 +1100,8 @@ lpfc_reset_bus_handler(struct scsi_cmnd *cmnd)
                if (!match)
                        continue;
-                ret = lpfc_scsi_tgt_reset(lpfc_cmd, phba,
+                ret = lpfc_scsi_tgt_reset(lpfc_cmd, phba, i, cmnd->device->lun,
-                                          i, ndlp->rport->dd_data);
+                                          ndlp->rport->dd_data);
                if (ret != SUCCESS) {
                        lpfc_printf_log(phba, KERN_ERR, LOG_FCP,
                                "%d:0713 Bus Reset on target %d failed\n",
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index bb69a7a1ec59..350a625fa224 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -191,35 +191,12 @@ static int
 lpfc_sli_ringtxcmpl_put(struct lpfc_hba * phba,
                        struct lpfc_sli_ring * pring, struct lpfc_iocbq * piocb)
 {
-        uint16_t iotag;
        list_add_tail(&piocb->list, &pring->txcmplq);
        pring->txcmplq_cnt++;
        if (unlikely(pring->ringno == LPFC_ELS_RING))
                mod_timer(&phba->els_tmofunc,
                                        jiffies + HZ * (phba->fc_ratov << 1));
-        if (pring->fast_lookup) {
-                /* Setup fast lookup based on iotag for completion */
-                iotag = piocb->iocb.ulpIoTag;
-                if (iotag && (iotag < pring->fast_iotag))
-                        *(pring->fast_lookup + iotag) = piocb;
-                else {
-                        /* Cmd ring <ringno> put: iotag <iotag> greater then
-                           configured max <fast_iotag> wd0 <icmd> */
-                        lpfc_printf_log(phba,
-                                        KERN_ERR,
-                                        LOG_SLI,
-                                        "%d:0316 Cmd ring %d put: iotag x%x "
-                                        "greater then configured max x%x "
-                                        "wd0 x%x\n",
-                                        phba->brd_no,
-                                        pring->ringno, iotag,
-                                        pring->fast_iotag,
-                                        *(((uint32_t *)(&piocb->iocb)) + 7));
-                }
-        }
        return (0);
 }
@@ -601,7 +578,7 @@ lpfc_sli_handle_mb_event(struct lpfc_hba * phba)
                        /* Stray Mailbox Interrupt, mbxCommand <cmd> mbxStatus
                           <status> */
                        lpfc_printf_log(phba,
-                                        KERN_ERR,
+                                        KERN_WARNING,
                                        LOG_MBOX | LOG_SLI,
                                        "%d:0304 Stray Mailbox Interrupt "
                                        "mbxCommand x%x mbxStatus x%x\n",
@@ -1570,8 +1547,8 @@ lpfc_sli_brdready(struct lpfc_hba * phba, uint32_t mask)
 void lpfc_reset_barrier(struct lpfc_hba * phba)
 {
-        uint32_t * resp_buf;
+        uint32_t __iomem *resp_buf;
-        uint32_t * mbox_buf;
+        uint32_t __iomem *mbox_buf;
        volatile uint32_t mbox;
        uint32_t hc_copy;
        int  i;
@@ -1587,7 +1564,7 @@ void lpfc_reset_barrier(struct lpfc_hba * phba)
         * Tell the other part of the chip to suspend temporarily all
         * its DMA activity.
         */
-        resp_buf =  (uint32_t *)phba->MBslimaddr;
+        resp_buf = phba->MBslimaddr;
        /* Disable the error attention */
        hc_copy = readl(phba->HCregaddr);
@@ -1605,7 +1582,7 @@ void lpfc_reset_barrier(struct lpfc_hba * phba)
        ((MAILBOX_t *)&mbox)->mbxOwner = OWN_CHIP;
        writel(BARRIER_TEST_PATTERN, (resp_buf + 1));
-        mbox_buf = (uint32_t *)phba->MBslimaddr;
+        mbox_buf = phba->MBslimaddr;
        writel(mbox, mbox_buf);
        for (i = 0;
@@ -1805,7 +1782,7 @@ lpfc_sli_brdrestart(struct lpfc_hba * phba)
                skip_post = 0;
                word0 = 0;      /* This is really setting up word1 */
        }
-        to_slim = (uint8_t *) phba->MBslimaddr + sizeof (uint32_t);
+        to_slim = phba->MBslimaddr + sizeof (uint32_t);
        writel(*(uint32_t *) mb, to_slim);
        readl(to_slim); /* flush */
@@ -2659,8 +2636,6 @@ lpfc_sli_hba_down(struct lpfc_hba * phba)
                INIT_LIST_HEAD(&(pring->txq));
-                kfree(pring->fast_lookup);
-                pring->fast_lookup = NULL;
        }
        spin_unlock_irqrestore(phba->host->host_lock, flags);
@@ -3110,6 +3085,24 @@ lpfc_sli_issue_mbox_wait(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmboxq,
        return retval;
 }
+int
+lpfc_sli_flush_mbox_queue(struct lpfc_hba * phba)
+{
+        int i = 0;
+        while (phba->sli.sli_flag & LPFC_SLI_MBOX_ACTIVE && !phba->stopped) {
+                if (i++ > LPFC_MBOX_TMO * 1000)
+                        return 1;
+                if (lpfc_sli_handle_mb_event(phba) == 0)
+                        i = 0;
+                msleep(1);
+        }
+        return (phba->sli.sli_flag & LPFC_SLI_MBOX_ACTIVE) ? 1 : 0;
+}
 irqreturn_t
 lpfc_intr_handler(int irq, void *dev_id, struct pt_regs * regs)
 {
diff --git a/drivers/scsi/lpfc/lpfc_sli.h b/drivers/scsi/lpfc/lpfc_sli.h
index a52d6c6cf083..d8ef0d2894d4 100644
--- a/drivers/scsi/lpfc/lpfc_sli.h
+++ b/drivers/scsi/lpfc/lpfc_sli.h
@@ -135,8 +135,6 @@ struct lpfc_sli_ring {
        uint32_t fast_iotag;    /* max fastlookup based iotag           */
        uint32_t iotag_ctr;     /* keeps track of the next iotag to use */
        uint32_t iotag_max;     /* max iotag value to use               */
-        struct lpfc_iocbq ** fast_lookup; /* array of IOCB ptrs indexed by
-                                           iotag */
        struct list_head txq;
        uint16_t txq_cnt;       /* current length of queue */
        uint16_t txq_max;       /* max length */
diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h
index 6b737568b831..10e89c6ae823 100644
--- a/drivers/scsi/lpfc/lpfc_version.h
+++ b/drivers/scsi/lpfc/lpfc_version.h
@@ -18,7 +18,7 @@
 * included with this package.                                     *
 *******************************************************************/
-#define LPFC_DRIVER_VERSION "8.1.6"
+#define LPFC_DRIVER_VERSION "8.1.7"
 #define LPFC_DRIVER_NAME "lpfc"
diff --git a/drivers/scsi/mac53c94.c b/drivers/scsi/mac53c94.c
index 93edaa8696cf..89ef34df5a1d 100644
--- a/drivers/scsi/mac53c94.c
+++ b/drivers/scsi/mac53c94.c
@@ -378,7 +378,7 @@ static void set_dma_cmds(struct fsc_state *state, struct scsi_cmnd *cmd)
                int nseg;
                total = 0;
-                scl = (struct scatterlist *) cmd->buffer;
+                scl = (struct scatterlist *) cmd->request_buffer;
                nseg = pci_map_sg(state->pdev, scl, cmd->use_sg,
                                cmd->sc_data_direction);
                for (i = 0; i < nseg; ++i) {
diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c
index c88717727be8..5572981a9f92 100644
--- a/drivers/scsi/mesh.c
+++ b/drivers/scsi/mesh.c
@@ -1268,7 +1268,7 @@ static void set_dma_cmds(struct mesh_state *ms, struct scsi_cmnd *cmd)
                if (cmd->use_sg > 0) {
                        int nseg;
                        total = 0;
-                        scl = (struct scatterlist *) cmd->buffer;
+                        scl = (struct scatterlist *) cmd->request_buffer;
                        off = ms->data_ptr;
                        nseg = pci_map_sg(ms->pdev, scl, cmd->use_sg,
                                          cmd->sc_data_direction);
diff --git a/drivers/scsi/pluto.c b/drivers/scsi/pluto.c
index 7abf64d1bfc9..0bd9c60e6455 100644
--- a/drivers/scsi/pluto.c
+++ b/drivers/scsi/pluto.c
@@ -169,8 +169,6 @@ int __init pluto_detect(struct scsi_host_template *tpnt)
                SCpnt->request->rq_status = RQ_SCSI_BUSY;
                
                SCpnt->done = pluto_detect_done;
-                SCpnt->bufflen = 256;
-                SCpnt->buffer = fcs[i].inquiry;
                SCpnt->request_bufflen = 256;
                SCpnt->request_buffer = fcs[i].inquiry;
                PLD(("set up %d %08lx\n", i, (long)SCpnt))
diff --git a/drivers/scsi/qlogicpti.c b/drivers/scsi/qlogicpti.c
index 69e0551a81d2..5b2f0741a55b 100644
--- a/drivers/scsi/qlogicpti.c
+++ b/drivers/scsi/qlogicpti.c
@@ -874,7 +874,7 @@ static inline int load_cmd(struct scsi_cmnd *Cmnd, struct Command_Entry *cmd,
        if (Cmnd->use_sg) {
                int sg_count;
-                sg = (struct scatterlist *) Cmnd->buffer;
+                sg = (struct scatterlist *) Cmnd->request_buffer;
                sg_count = sbus_map_sg(qpti->sdev, sg, Cmnd->use_sg, Cmnd->sc_data_direction);
                ds = cmd->dataseg;
@@ -1278,7 +1278,7 @@ static struct scsi_cmnd *qlogicpti_intr_handler(struct qlogicpti *qpti)
                if (Cmnd->use_sg) {
                        sbus_unmap_sg(qpti->sdev,
-                                      (struct scatterlist *)Cmnd->buffer,
+                                      (struct scatterlist *)Cmnd->request_buffer,
                                      Cmnd->use_sg,
                                      Cmnd->sc_data_direction);
                } else {
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 2ab7df0dcfe8..b332caddd5b3 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -346,7 +346,7 @@ void scsi_log_send(struct scsi_cmnd *cmd)
                        if (level > 3) {
                                printk(KERN_INFO "buffer = 0x%p, bufflen = %d,"
                                       " done = 0x%p, queuecommand 0x%p\n",
-                                        cmd->buffer, cmd->bufflen,
+                                        cmd->request_buffer, cmd->request_bufflen,
                                        cmd->done,
                                        sdev->host->hostt->queuecommand);
@@ -661,11 +661,6 @@ void __scsi_done(struct scsi_cmnd *cmd)
 */
 int scsi_retry_command(struct scsi_cmnd *cmd)
 {
-        /*
-         * Restore the SCSI command state.
-         */
-        scsi_setup_cmd_retry(cmd);
        /*
         * Zero the sense information from the last time we tried
         * this command.
@@ -711,10 +706,6 @@ void scsi_finish_command(struct scsi_cmnd *cmd)
                                "Notifying upper driver of completion "
                                "(result %x)\n", cmd->result));
-        /*
-         * We can get here with use_sg=0, causing a panic in the upper level
-         */
-        cmd->use_sg = cmd->old_use_sg;
        cmd->done(cmd);
 }
 EXPORT_SYMBOL(scsi_finish_command);
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 9c63b00773c4..a80303c6b3fd 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -286,7 +286,7 @@ static int inquiry_evpd_83(unsigned char * arr, int target_dev_id,
                           int dev_id_num, const char * dev_id_str,
                           int dev_id_str_len);
 static int inquiry_evpd_88(unsigned char * arr, int target_dev_id);
-static void do_create_driverfs_files(void);
+static int do_create_driverfs_files(void);
 static void do_remove_driverfs_files(void);
 static int sdebug_add_adapter(void);
@@ -2487,19 +2487,22 @@ static ssize_t sdebug_add_host_store(struct device_driver * ddp,
 DRIVER_ATTR(add_host, S_IRUGO | S_IWUSR, sdebug_add_host_show, 
            sdebug_add_host_store);
-static void do_create_driverfs_files(void)
+static int do_create_driverfs_files(void)
 {
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_add_host);
+        int ret;
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_delay);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_dev_size_mb);
+        ret = driver_create_file(&sdebug_driverfs_driver, &driver_attr_add_host);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_dsense);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_delay);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_every_nth);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_dev_size_mb);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_max_luns);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_dsense);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_num_tgts);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_every_nth);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_num_parts);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_max_luns);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_ptype);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_num_tgts);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_opts);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_num_parts);
-        driver_create_file(&sdebug_driverfs_driver, &driver_attr_scsi_level);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_ptype);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_opts);
+        ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_scsi_level);
+        return ret;
 }
 static void do_remove_driverfs_files(void)
@@ -2522,6 +2525,7 @@ static int __init scsi_debug_init(void)
        unsigned int sz;
        int host_to_add;
        int k;
+        int ret;
        if (scsi_debug_dev_size_mb < 1)
                scsi_debug_dev_size_mb = 1;  /* force minimum 1 MB ramdisk */
@@ -2560,12 +2564,32 @@ static int __init scsi_debug_init(void)
        if (scsi_debug_num_parts > 0)
                sdebug_build_parts(fake_storep);
-        init_all_queued();
+        ret = device_register(&pseudo_primary);
+        if (ret < 0) {
+                printk(KERN_WARNING "scsi_debug: device_register error: %d\n",
+                        ret);
+                goto free_vm;
+        }
+        ret = bus_register(&pseudo_lld_bus);
+        if (ret < 0) {
+                printk(KERN_WARNING "scsi_debug: bus_register error: %d\n",
+                        ret);
+                goto dev_unreg;
+        }
+        ret = driver_register(&sdebug_driverfs_driver);
+        if (ret < 0) {
+                printk(KERN_WARNING "scsi_debug: driver_register error: %d\n",
+                        ret);
+                goto bus_unreg;
+        }
+        ret = do_create_driverfs_files();
+        if (ret < 0) {
+                printk(KERN_WARNING "scsi_debug: driver_create_file error: %d\n",
+                        ret);
+                goto del_files;
+        }
-        device_register(&pseudo_primary);
+        init_all_queued();
-        bus_register(&pseudo_lld_bus);
-        driver_register(&sdebug_driverfs_driver);
-        do_create_driverfs_files();
        sdebug_driver_template.proc_name = (char *)sdebug_proc_name;
@@ -2585,6 +2609,18 @@ static int __init scsi_debug_init(void)
                       scsi_debug_add_host);
        }
        return 0;
+del_files:
+        do_remove_driverfs_files();
+        driver_unregister(&sdebug_driverfs_driver);
+bus_unreg:
+        bus_unregister(&pseudo_lld_bus);
+dev_unreg:
+        device_unregister(&pseudo_primary);
+free_vm:
+        vfree(fake_storep);
+        return ret;
 }
 static void __exit scsi_debug_exit(void)
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 6683d596234a..6a5b731bd5ba 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -460,19 +460,67 @@ static void scsi_eh_done(struct scsi_cmnd *scmd)
 * Return value:
 *    SUCCESS or FAILED or NEEDS_RETRY
 **/
-static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout)
+static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout, int copy_sense)
 {
        struct scsi_device *sdev = scmd->device;
        struct Scsi_Host *shost = sdev->host;
+        int old_result = scmd->result;
        DECLARE_COMPLETION(done);
        unsigned long timeleft;
        unsigned long flags;
+        unsigned char old_cmnd[MAX_COMMAND_SIZE];
+        enum dma_data_direction old_data_direction;
+        unsigned short old_use_sg;
+        unsigned char old_cmd_len;
+        unsigned old_bufflen;
+        void *old_buffer;
        int rtn;
+        /*
+         * We need saved copies of a number of fields - this is because
+         * error handling may need to overwrite these with different values
+         * to run different commands, and once error handling is complete,
+         * we will need to restore these values prior to running the actual
+         * command.
+         */
+        old_buffer = scmd->request_buffer;
+        old_bufflen = scmd->request_bufflen;
+        memcpy(old_cmnd, scmd->cmnd, sizeof(scmd->cmnd));
+        old_data_direction = scmd->sc_data_direction;
+        old_cmd_len = scmd->cmd_len;
+        old_use_sg = scmd->use_sg;
+        if (copy_sense) {
+                int gfp_mask = GFP_ATOMIC;
+                if (shost->hostt->unchecked_isa_dma)
+                        gfp_mask |= __GFP_DMA;
+                scmd->sc_data_direction = DMA_FROM_DEVICE;
+                scmd->request_bufflen = 252;
+                scmd->request_buffer = kzalloc(scmd->request_bufflen, gfp_mask);
+                if (!scmd->request_buffer)
+                        return FAILED;
+        } else {
+                scmd->request_buffer = NULL;
+                scmd->request_bufflen = 0;
+                scmd->sc_data_direction = DMA_NONE;
+        }
+        scmd->underflow = 0;
+        scmd->use_sg = 0;
+        scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
        if (sdev->scsi_level <= SCSI_2)
                scmd->cmnd[1] = (scmd->cmnd[1] & 0x1f) |
                        (sdev->lun << 5 & 0xe0);
+        /*
+         * Zero the sense buffer.  The scsi spec mandates that any
+         * untransferred sense data should be interpreted as being zero.
+         */
+        memset(scmd->sense_buffer, 0, sizeof(scmd->sense_buffer));
        shost->eh_action = &done;
        spin_lock_irqsave(shost->host_lock, flags);
@@ -522,6 +570,29 @@ static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout)
                rtn = FAILED;
        }
+        /*
+         * Last chance to have valid sense data.
+         */
+        if (copy_sense) {
+                if (!SCSI_SENSE_VALID(scmd)) {
+                        memcpy(scmd->sense_buffer, scmd->request_buffer,
+                               sizeof(scmd->sense_buffer));
+                }
+                kfree(scmd->request_buffer);
+        }
+        /*
+         * Restore original data
+         */
+        scmd->request_buffer = old_buffer;
+        scmd->request_bufflen = old_bufflen;
+        memcpy(scmd->cmnd, old_cmnd, sizeof(scmd->cmnd));
+        scmd->sc_data_direction = old_data_direction;
+        scmd->cmd_len = old_cmd_len;
+        scmd->use_sg = old_use_sg;
+        scmd->result = old_result;
        return rtn;
 }
@@ -537,56 +608,10 @@ static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout)
 static int scsi_request_sense(struct scsi_cmnd *scmd)
 {
        static unsigned char generic_sense[6] =
-        {REQUEST_SENSE, 0, 0, 0, 252, 0};
+                {REQUEST_SENSE, 0, 0, 0, 252, 0};
-        unsigned char *scsi_result;
-        int saved_result;
-        int rtn;
        memcpy(scmd->cmnd, generic_sense, sizeof(generic_sense));
+        return scsi_send_eh_cmnd(scmd, SENSE_TIMEOUT, 1);
-        scsi_result = kmalloc(252, GFP_ATOMIC | ((scmd->device->host->hostt->unchecked_isa_dma) ? __GFP_DMA : 0));
-        if (unlikely(!scsi_result)) {
-                printk(KERN_ERR "%s: cannot allocate scsi_result.\n",
-                       __FUNCTION__);
-                return FAILED;
-        }
-        /*
-         * zero the sense buffer.  some host adapters automatically always
-         * request sense, so it is not a good idea that
-         * scmd->request_buffer and scmd->sense_buffer point to the same
-         * address (db).  0 is not a valid sense code. 
-         */
-        memset(scmd->sense_buffer, 0, sizeof(scmd->sense_buffer));
-        memset(scsi_result, 0, 252);
-        saved_result = scmd->result;
-        scmd->request_buffer = scsi_result;
-        scmd->request_bufflen = 252;
-        scmd->use_sg = 0;
-        scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
-        scmd->sc_data_direction = DMA_FROM_DEVICE;
-        scmd->underflow = 0;
-        rtn = scsi_send_eh_cmnd(scmd, SENSE_TIMEOUT);
-        /* last chance to have valid sense data */
-        if(!SCSI_SENSE_VALID(scmd)) {
-                memcpy(scmd->sense_buffer, scmd->request_buffer,
-                       sizeof(scmd->sense_buffer));
-        }
-        kfree(scsi_result);
-        /*
-         * when we eventually call scsi_finish, we really wish to complete
-         * the original request, so let's restore the original data. (db)
-         */
-        scsi_setup_cmd_retry(scmd);
-        scmd->result = saved_result;
-        return rtn;
 }
 /**
@@ -605,12 +630,6 @@ void scsi_eh_finish_cmd(struct scsi_cmnd *scmd, struct list_head *done_q)
 {
        scmd->device->host->host_failed--;
        scmd->eh_eflags = 0;
-        /*
-         * set this back so that the upper level can correctly free up
-         * things.
-         */
-        scsi_setup_cmd_retry(scmd);
        list_move_tail(&scmd->eh_entry, done_q);
 }
 EXPORT_SYMBOL(scsi_eh_finish_cmd);
@@ -715,47 +734,26 @@ static int scsi_eh_tur(struct scsi_cmnd *scmd)
 {
        static unsigned char tur_command[6] = {TEST_UNIT_READY, 0, 0, 0, 0, 0};
        int retry_cnt = 1, rtn;
-        int saved_result;
 retry_tur:
        memcpy(scmd->cmnd, tur_command, sizeof(tur_command));
-        /*
-         * zero the sense buffer.  the scsi spec mandates that any
-         * untransferred sense data should be interpreted as being zero.
-         */
-        memset(scmd->sense_buffer, 0, sizeof(scmd->sense_buffer));
-        saved_result = scmd->result;
-        scmd->request_buffer = NULL;
-        scmd->request_bufflen = 0;
-        scmd->use_sg = 0;
-        scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
-        scmd->underflow = 0;
-        scmd->sc_data_direction = DMA_NONE;
-        rtn = scsi_send_eh_cmnd(scmd, SENSE_TIMEOUT);
+        rtn = scsi_send_eh_cmnd(scmd, SENSE_TIMEOUT, 0);
-        /*
-         * when we eventually call scsi_finish, we really wish to complete
-         * the original request, so let's restore the original data. (db)
-         */
-        scsi_setup_cmd_retry(scmd);
-        scmd->result = saved_result;
-        /*
-         * hey, we are done.  let's look to see what happened.
-         */
        SCSI_LOG_ERROR_RECOVERY(3, printk("%s: scmd %p rtn %x\n",
                __FUNCTION__, scmd, rtn));
-        if (rtn == SUCCESS)
-                return 0;
+        switch (rtn) {
-        else if (rtn == NEEDS_RETRY) {
+        case NEEDS_RETRY:
                if (retry_cnt--)
                        goto retry_tur;
+                /*FALLTHRU*/
+        case SUCCESS:
                return 0;
+        default:
+                return 1;
        }
-        return 1;
 }
 /**
@@ -837,44 +835,16 @@ static int scsi_try_bus_device_reset(struct scsi_cmnd *scmd)
 static int scsi_eh_try_stu(struct scsi_cmnd *scmd)
 {
        static unsigned char stu_command[6] = {START_STOP, 0, 0, 0, 1, 0};
-        int rtn;
-        int saved_result;
-        if (!scmd->device->allow_restart)
+        if (scmd->device->allow_restart) {
-                return 1;
+                int rtn;
-        memcpy(scmd->cmnd, stu_command, sizeof(stu_command));
-        /*
-         * zero the sense buffer.  the scsi spec mandates that any
-         * untransferred sense data should be interpreted as being zero.
-         */
-        memset(scmd->sense_buffer, 0, sizeof(scmd->sense_buffer));
-        saved_result = scmd->result;
-        scmd->request_buffer = NULL;
-        scmd->request_bufflen = 0;
-        scmd->use_sg = 0;
-        scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
-        scmd->underflow = 0;
-        scmd->sc_data_direction = DMA_NONE;
-        rtn = scsi_send_eh_cmnd(scmd, START_UNIT_TIMEOUT);
+                memcpy(scmd->cmnd, stu_command, sizeof(stu_command));
+                rtn = scsi_send_eh_cmnd(scmd, START_UNIT_TIMEOUT, 0);
-        /*
+                if (rtn == SUCCESS)
-         * when we eventually call scsi_finish, we really wish to complete
+                        return 0;
-         * the original request, so let's restore the original data. (db)
+        }
-         */
-        scsi_setup_cmd_retry(scmd);
-        scmd->result = saved_result;
-        /*
-         * hey, we are done.  let's look to see what happened.
-         */
-        SCSI_LOG_ERROR_RECOVERY(3, printk("%s: scmd %p rtn %x\n",
-                __FUNCTION__, scmd, rtn));
-        if (rtn == SUCCESS)
-                return 0;
        return 1;
 }
@@ -1684,8 +1654,6 @@ scsi_reset_provider(struct scsi_device *dev, int flag)
    
        scmd->scsi_done         = scsi_reset_provider_done_command;
        scmd->done                      = NULL;
-        scmd->buffer                    = NULL;
-        scmd->bufflen                   = 0;
        scmd->request_buffer            = NULL;
        scmd->request_bufflen           = 0;
diff --git a/drivers/scsi/scsi_ioctl.c b/drivers/scsi/scsi_ioctl.c
index a89c4115cfba..32293f451669 100644
--- a/drivers/scsi/scsi_ioctl.c
+++ b/drivers/scsi/scsi_ioctl.c
@@ -110,11 +110,8 @@ static int ioctl_internal_command(struct scsi_device *sdev, char *cmd,
                                       sshdr.asc, sshdr.ascq);
                        break;
                case NOT_READY: /* This happens if there is no disc in drive */
-                        if (sdev->removable && (cmd[0] != TEST_UNIT_READY)) {
+                        if (sdev->removable)
-                                printk(KERN_INFO "Device not ready. Make sure"
-                                       " there is a disc in the drive.\n");
                                break;
-                        }
                case UNIT_ATTENTION:
                        if (sdev->removable) {
                                sdev->changed = 1;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 08af9aae7df3..077c1c691210 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -436,60 +436,16 @@ EXPORT_SYMBOL_GPL(scsi_execute_async);
 *
 * Arguments:   cmd     - command that is ready to be queued.
 *
- * Returns:     Nothing
- *
 * Notes:       This function has the job of initializing a number of
 *              fields related to error handling.   Typically this will
 *              be called once for each command, as required.
 */
-static int scsi_init_cmd_errh(struct scsi_cmnd *cmd)
+static void scsi_init_cmd_errh(struct scsi_cmnd *cmd)
 {
        cmd->serial_number = 0;
        memset(cmd->sense_buffer, 0, sizeof cmd->sense_buffer);
        if (cmd->cmd_len == 0)
                cmd->cmd_len = COMMAND_SIZE(cmd->cmnd[0]);
-        /*
-         * We need saved copies of a number of fields - this is because
-         * error handling may need to overwrite these with different values
-         * to run different commands, and once error handling is complete,
-         * we will need to restore these values prior to running the actual
-         * command.
-         */
-        cmd->old_use_sg = cmd->use_sg;
-        cmd->old_cmd_len = cmd->cmd_len;
-        cmd->sc_old_data_direction = cmd->sc_data_direction;
-        cmd->old_underflow = cmd->underflow;
-        memcpy(cmd->data_cmnd, cmd->cmnd, sizeof(cmd->cmnd));
-        cmd->buffer = cmd->request_buffer;
-        cmd->bufflen = cmd->request_bufflen;
-        return 1;
-}
-/*
- * Function:   scsi_setup_cmd_retry()
- *
- * Purpose:    Restore the command state for a retry
- *
- * Arguments:  cmd      - command to be restored
- *
- * Returns:    Nothing
- *
- * Notes:      Immediately prior to retrying a command, we need
- *             to restore certain fields that we saved above.
- */
-void scsi_setup_cmd_retry(struct scsi_cmnd *cmd)
-{
-        memcpy(cmd->cmnd, cmd->data_cmnd, sizeof(cmd->data_cmnd));
-        cmd->request_buffer = cmd->buffer;
-        cmd->request_bufflen = cmd->bufflen;
-        cmd->use_sg = cmd->old_use_sg;
-        cmd->cmd_len = cmd->old_cmd_len;
-        cmd->sc_data_direction = cmd->sc_old_data_direction;
-        cmd->underflow = cmd->old_underflow;
 }
 void scsi_device_unbusy(struct scsi_device *sdev)
@@ -807,22 +763,13 @@ static void scsi_free_sgtable(struct scatterlist *sgl, int index)
 */
 static void scsi_release_buffers(struct scsi_cmnd *cmd)
 {
-        struct request *req = cmd->request;
-        /*
-         * Free up any indirection buffers we allocated for DMA purposes. 
-         */
        if (cmd->use_sg)
                scsi_free_sgtable(cmd->request_buffer, cmd->sglist_len);
-        else if (cmd->request_buffer != req->buffer)
-                kfree(cmd->request_buffer);
        /*
         * Zero these out.  They now point to freed memory, and it is
         * dangerous to hang onto the pointers.
         */
-        cmd->buffer  = NULL;
-        cmd->bufflen = 0;
        cmd->request_buffer = NULL;
        cmd->request_bufflen = 0;
 }
@@ -858,7 +805,7 @@ static void scsi_release_buffers(struct scsi_cmnd *cmd)
 void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
 {
        int result = cmd->result;
-        int this_count = cmd->bufflen;
+        int this_count = cmd->request_bufflen;
        request_queue_t *q = cmd->device->request_queue;
        struct request *req = cmd->request;
        int clear_errors = 1;
@@ -866,28 +813,14 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
        int sense_valid = 0;
        int sense_deferred = 0;
-        /*
+        scsi_release_buffers(cmd);
-         * Free up any indirection buffers we allocated for DMA purposes. 
-         * For the case of a READ, we need to copy the data out of the
-         * bounce buffer and into the real buffer.
-         */
-        if (cmd->use_sg)
-                scsi_free_sgtable(cmd->buffer, cmd->sglist_len);
-        else if (cmd->buffer != req->buffer) {
-                if (rq_data_dir(req) == READ) {
-                        unsigned long flags;
-                        char *to = bio_kmap_irq(req->bio, &flags);
-                        memcpy(to, cmd->buffer, cmd->bufflen);
-                        bio_kunmap_irq(to, &flags);
-                }
-                kfree(cmd->buffer);
-        }
        if (result) {
                sense_valid = scsi_command_normalize_sense(cmd, &sshdr);
                if (sense_valid)
                        sense_deferred = scsi_sense_is_deferred(&sshdr);
        }
        if (blk_pc_request(req)) { /* SG_IO ioctl from block level */
                req->errors = result;
                if (result) {
@@ -908,15 +841,6 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
        }
        /*
-         * Zero these out.  They now point to freed memory, and it is
-         * dangerous to hang onto the pointers.
-         */
-        cmd->buffer  = NULL;
-        cmd->bufflen = 0;
-        cmd->request_buffer = NULL;
-        cmd->request_bufflen = 0;
-        /*
         * Next deal with any sectors which we were able to correctly
         * handle.
         */
@@ -1012,7 +936,7 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
                        if (!(req->flags & REQ_QUIET)) {
                                scmd_printk(KERN_INFO, cmd,
                                            "Volume overflow, CDB: ");
-                                __scsi_print_command(cmd->data_cmnd);
+                                __scsi_print_command(cmd->cmnd);
                                scsi_print_sense("", cmd);
                        }
                        /* See SSC3rXX or current. */
@@ -1143,7 +1067,7 @@ static void scsi_blk_pc_done(struct scsi_cmnd *cmd)
         * successfully. Since this is a REQ_BLOCK_PC command the
         * caller should check the request's errors value
         */
-        scsi_io_completion(cmd, cmd->bufflen);
+        scsi_io_completion(cmd, cmd->request_bufflen);
 }
 static void scsi_setup_blk_pc_cmnd(struct scsi_cmnd *cmd)
diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h
index e2fbe9a9d5a9..ae24c85aaeea 100644
--- a/drivers/scsi/scsi_priv.h
+++ b/drivers/scsi/scsi_priv.h
@@ -57,7 +57,6 @@ extern int scsi_eh_scmd_add(struct scsi_cmnd *, int);
 /* scsi_lib.c */
 extern int scsi_maybe_unblock_host(struct scsi_device *sdev);
-extern void scsi_setup_cmd_retry(struct scsi_cmnd *cmd);
 extern void scsi_device_unbusy(struct scsi_device *sdev);
 extern int scsi_queue_insert(struct scsi_cmnd *cmd, int reason);
 extern void scsi_next_command(struct scsi_cmnd *cmd);
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index dd075627e605..5a625c3fddae 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -41,6 +41,7 @@ struct sas_host_attrs {
        struct mutex lock;
        u32 next_target_id;
        u32 next_expander_id;
+        int next_port_id;
 };
 #define to_sas_host_attrs(host) ((struct sas_host_attrs *)(host)->shost_data)
@@ -146,6 +147,7 @@ static int sas_host_setup(struct transport_container *tc, struct device *dev,
        mutex_init(&sas_host->lock);
        sas_host->next_target_id = 0;
        sas_host->next_expander_id = 0;
+        sas_host->next_port_id = 0;
        return 0;
 }
@@ -327,7 +329,7 @@ sas_phy_protocol_attr(identify.target_port_protocols,
 sas_phy_simple_attr(identify.sas_address, sas_address, "0x%016llx\n",
                unsigned long long);
 sas_phy_simple_attr(identify.phy_identifier, phy_identifier, "%d\n", u8);
-//sas_phy_simple_attr(port_identifier, port_identifier, "%d\n", u8);
+//sas_phy_simple_attr(port_identifier, port_identifier, "%d\n", int);
 sas_phy_linkspeed_attr(negotiated_linkrate);
 sas_phy_linkspeed_attr(minimum_linkrate_hw);
 sas_phy_linkspeed_attr(minimum_linkrate);
@@ -590,6 +592,38 @@ struct sas_port *sas_port_alloc(struct device *parent, int port_id)
 }
 EXPORT_SYMBOL(sas_port_alloc);
+/** sas_port_alloc_num - allocate and initialize a SAS port structure
+ *
+ * @parent:     parent device
+ *
+ * Allocates a SAS port structure and a number to go with it.  This
+ * interface is really for adapters where the port number has no
+ * meansing, so the sas class should manage them.  It will be added to
+ * the device tree below the device specified by @parent which must be
+ * either a Scsi_Host or a sas_expander_device.
+ *
+ * Returns %NULL on error
+ */
+struct sas_port *sas_port_alloc_num(struct device *parent)
+{
+        int index;
+        struct Scsi_Host *shost = dev_to_shost(parent);
+        struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
+        /* FIXME: use idr for this eventually */
+        mutex_lock(&sas_host->lock);
+        if (scsi_is_sas_expander_device(parent)) {
+                struct sas_rphy *rphy = dev_to_rphy(parent);
+                struct sas_expander_device *exp = rphy_to_expander_device(rphy);
+                index = exp->next_port_id++;
+        } else
+                index = sas_host->next_port_id++;
+        mutex_unlock(&sas_host->lock);
+        return sas_port_alloc(parent, index);
+}
+EXPORT_SYMBOL(sas_port_alloc_num);
 /**
 * sas_port_add - add a SAS port to the device hierarchy
 *
@@ -658,6 +692,13 @@ void sas_port_delete(struct sas_port *port)
        }
        mutex_unlock(&port->phy_list_mutex);
+        if (port->is_backlink) {
+                struct device *parent = port->dev.parent;
+                sysfs_remove_link(&port->dev.kobj, parent->bus_id);
+                port->is_backlink = 0;
+        }
        transport_remove_device(dev);
        device_del(dev);
        transport_destroy_device(dev);
@@ -733,6 +774,19 @@ void sas_port_delete_phy(struct sas_port *port, struct sas_phy *phy)
 }
 EXPORT_SYMBOL(sas_port_delete_phy);
+void sas_port_mark_backlink(struct sas_port *port)
+{
+        struct device *parent = port->dev.parent->parent->parent;
+        if (port->is_backlink)
+                return;
+        port->is_backlink = 1;
+        sysfs_create_link(&port->dev.kobj, &parent->kobj,
+                          parent->bus_id);
+}
+EXPORT_SYMBOL(sas_port_mark_backlink);
 /*
 * SAS remote PHY attributes.
 */
@@ -1140,7 +1194,7 @@ int sas_rphy_add(struct sas_rphy *rphy)
        if (identify->device_type == SAS_END_DEVICE &&
            rphy->scsi_target_id != -1) {
-                scsi_scan_target(&rphy->dev, parent->port_identifier,
+                scsi_scan_target(&rphy->dev, 0,
                                rphy->scsi_target_id, ~0, 0);
        }
@@ -1242,15 +1296,13 @@ static int sas_user_scan(struct Scsi_Host *shost, uint channel,
        mutex_lock(&sas_host->lock);
        list_for_each_entry(rphy, &sas_host->rphy_list, list) {
-                struct sas_port *parent = dev_to_sas_port(rphy->dev.parent);
                if (rphy->identify.device_type != SAS_END_DEVICE ||
                    rphy->scsi_target_id == -1)
                        continue;
-                if ((channel == SCAN_WILD_CARD || channel == parent->port_identifier) &&
+                if ((channel == SCAN_WILD_CARD || channel == 0) &&
                    (id == SCAN_WILD_CARD || id == rphy->scsi_target_id)) {
-                        scsi_scan_target(&rphy->dev, parent->port_identifier,
+                        scsi_scan_target(&rphy->dev, 0,
                                         rphy->scsi_target_id, lun, 1);
                }
        }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 3225d31449e1..98bd3aab9739 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -502,8 +502,7 @@ static int sd_init_command(struct scsi_cmnd * SCpnt)
                SCpnt->cmnd[4] = (unsigned char) this_count;
                SCpnt->cmnd[5] = 0;
        }
-        SCpnt->request_bufflen = SCpnt->bufflen =
+        SCpnt->request_bufflen = this_count * sdp->sector_size;
-                        this_count * sdp->sector_size;
        /*
         * We shouldn't disconnect in the middle of a sector, so with a dumb
diff --git a/drivers/scsi/seagate.c b/drivers/scsi/seagate.c
index 3f312a84c6a7..2679ea8bff1a 100644
--- a/drivers/scsi/seagate.c
+++ b/drivers/scsi/seagate.c
@@ -1002,7 +1002,7 @@ connect_loop:
                        }
 #endif
-                        buffer = (struct scatterlist *) SCint->buffer;
+                        buffer = (struct scatterlist *) SCint->request_buffer;
                        len = buffer->length;
                        data = page_address(buffer->page) + buffer->offset;
                } else {
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index fd94408577e5..fae6e95a6298 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -360,7 +360,7 @@ static int sr_init_command(struct scsi_cmnd * SCpnt)
                                "mismatch count %d, bytes %d\n",
                                size, SCpnt->request_bufflen);
                        if (SCpnt->request_bufflen > size)
-                                SCpnt->request_bufflen = SCpnt->bufflen = size;
+                                SCpnt->request_bufflen = size;
                }
        }
@@ -387,8 +387,7 @@ static int sr_init_command(struct scsi_cmnd * SCpnt)
        if (this_count > 0xffff) {
                this_count = 0xffff;
-                SCpnt->request_bufflen = SCpnt->bufflen =
+                SCpnt->request_bufflen = this_count * s_size;
-                                this_count * s_size;
        }
        SCpnt->cmnd[2] = (unsigned char) (block >> 24) & 0xff;
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 756ceb93ddc8..7f669b600677 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -368,7 +368,7 @@ static int st_chk_result(struct scsi_tape *STp, struct st_request * SRpnt)
                       SRpnt->cmd[0], SRpnt->cmd[1], SRpnt->cmd[2],
                       SRpnt->cmd[3], SRpnt->cmd[4], SRpnt->cmd[5]);
                if (cmdstatp->have_sense)
-                         __scsi_print_sense("st", SRpnt->sense, SCSI_SENSE_BUFFERSIZE);
+                         __scsi_print_sense(name, SRpnt->sense, SCSI_SENSE_BUFFERSIZE);
        } ) /* end DEB */
        if (!debugging) { /* Abnormal conditions for tape */
                if (!cmdstatp->have_sense)
@@ -384,9 +384,8 @@ static int st_chk_result(struct scsi_tape *STp, struct st_request * SRpnt)
                         scode != VOLUME_OVERFLOW &&
                         SRpnt->cmd[0] != MODE_SENSE &&
                         SRpnt->cmd[0] != TEST_UNIT_READY) {
-                                printk(KERN_WARNING "%s: Error with sense data: ", name);
-                                __scsi_print_sense("st", SRpnt->sense,
+                        __scsi_print_sense(name, SRpnt->sense, SCSI_SENSE_BUFFERSIZE);
-                                                   SCSI_SENSE_BUFFERSIZE);
                }
        }
diff --git a/drivers/scsi/sun3_NCR5380.c b/drivers/scsi/sun3_NCR5380.c
index 2ebe0d663899..2f8073b73bf3 100644
--- a/drivers/scsi/sun3_NCR5380.c
+++ b/drivers/scsi/sun3_NCR5380.c
@@ -517,7 +517,7 @@ static __inline__ void initialize_SCp(Scsi_Cmnd *cmd)
     */
    if (cmd->use_sg) {
-        cmd->SCp.buffer = (struct scatterlist *) cmd->buffer;
+        cmd->SCp.buffer = (struct scatterlist *) cmd->request_buffer;
        cmd->SCp.buffers_residual = cmd->use_sg - 1;
        cmd->SCp.ptr = (char *) SGADDR(cmd->SCp.buffer);
        cmd->SCp.this_residual = cmd->SCp.buffer->length;
diff --git a/drivers/scsi/sun3x_esp.c b/drivers/scsi/sun3x_esp.c
index 1f328cae5c05..6b60536ac92b 100644
--- a/drivers/scsi/sun3x_esp.c
+++ b/drivers/scsi/sun3x_esp.c
@@ -347,7 +347,7 @@ static void dma_mmu_release_scsi_one (struct NCR_ESP *esp, Scsi_Cmnd *sp)
 static void dma_mmu_release_scsi_sgl (struct NCR_ESP *esp, Scsi_Cmnd *sp)
 {
    int sz = sp->use_sg - 1;
-    struct scatterlist *sg = (struct scatterlist *)sp->buffer;
+    struct scatterlist *sg = (struct scatterlist *)sp->request_buffer;
                        
    while(sz >= 0) {
        dvma_unmap((char *)sg[sz].dma_address);
diff --git a/drivers/scsi/wd33c93.c b/drivers/scsi/wd33c93.c
index 680f38ab60d8..2083454db511 100644
--- a/drivers/scsi/wd33c93.c
+++ b/drivers/scsi/wd33c93.c
@@ -373,7 +373,7 @@ wd33c93_queuecommand(struct scsi_cmnd *cmd,
 */
        if (cmd->use_sg) {
-                cmd->SCp.buffer = (struct scatterlist *) cmd->buffer;
+                cmd->SCp.buffer = (struct scatterlist *) cmd->request_buffer;
                cmd->SCp.buffers_residual = cmd->use_sg - 1;
                cmd->SCp.ptr = page_address(cmd->SCp.buffer->page) +
                    cmd->SCp.buffer->offset;
diff --git a/drivers/serial/sunsab.c b/drivers/serial/sunsab.c
index 979497f108c8..dc673e1b6fd9 100644
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -1047,12 +1047,13 @@ static int __devinit sab_probe(struct of_device *op, const struct of_device_id *
        up = &sunsab_ports[inst * 2];
        err = sunsab_init_one(&up[0], op,
-                              sizeof(union sab82532_async_regs),
+                              0,
                              (inst * 2) + 0);
        if (err)
                return err;
-        err = sunsab_init_one(&up[1], op, 0,
+        err = sunsab_init_one(&up[1], op,
+                              sizeof(union sab82532_async_regs),
                              (inst * 2) + 1);
        if (err) {
                of_iounmap(up[0].port.membase,
@@ -1117,7 +1118,7 @@ static int __init sunsab_init(void)
        int err;
        num_channels = 0;
-        for_each_node_by_name(dp, "su")
+        for_each_node_by_name(dp, "se")
                num_channels += 2;
        for_each_node_by_name(dp, "serial") {
                if (of_device_is_compatible(dp, "sab82532"))
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index a1456d9352cb..47bc3d57e019 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -68,9 +68,6 @@ static int num_sunzilog;
 #define NUM_SUNZILOG    num_sunzilog
 #define NUM_CHANNELS    (NUM_SUNZILOG * 2)
-#define KEYBOARD_LINE 0x2
-#define MOUSE_LINE    0x3
 #define ZS_CLOCK                4915200 /* Zilog input clock rate. */
 #define ZS_CLOCK_DIVISOR        16      /* Divisor this driver uses. */
@@ -1225,12 +1222,10 @@ static void __init sunzilog_init_kbdms(struct uart_sunzilog_port *up, int channe
 {
        int baud, brg;
-        if (channel == KEYBOARD_LINE) {
+        if (up->flags & SUNZILOG_FLAG_CONS_KEYB) {
-                up->flags |= SUNZILOG_FLAG_CONS_KEYB;
                up->cflag = B1200 | CS8 | CLOCAL | CREAD;
                baud = 1200;
        } else {
-                up->flags |= SUNZILOG_FLAG_CONS_MOUSE;
                up->cflag = B4800 | CS8 | CLOCAL | CREAD;
                baud = 4800;
        }
@@ -1243,14 +1238,14 @@ static void __init sunzilog_init_kbdms(struct uart_sunzilog_port *up, int channe
 }
 #ifdef CONFIG_SERIO
-static void __init sunzilog_register_serio(struct uart_sunzilog_port *up, int channel)
+static void __init sunzilog_register_serio(struct uart_sunzilog_port *up)
 {
        struct serio *serio = &up->serio;
        serio->port_data = up;
        serio->id.type = SERIO_RS232;
-        if (channel == KEYBOARD_LINE) {
+        if (up->flags & SUNZILOG_FLAG_CONS_KEYB) {
                serio->id.proto = SERIO_SUNKBD;
                strlcpy(serio->name, "zskbd", sizeof(serio->name));
        } else {
@@ -1259,7 +1254,8 @@ static void __init sunzilog_register_serio(struct uart_sunzilog_port *up, int ch
                strlcpy(serio->name, "zsms", sizeof(serio->name));
        }
        strlcpy(serio->phys,
-                (channel == KEYBOARD_LINE ? "zs/serio0" : "zs/serio1"),
+                ((up->flags & SUNZILOG_FLAG_CONS_KEYB) ?
+                 "zs/serio0" : "zs/serio1"),
                sizeof(serio->phys));
        serio->write = sunzilog_serio_write;
@@ -1286,8 +1282,8 @@ static void __init sunzilog_init_hw(struct uart_sunzilog_port *up)
                (void) read_zsreg(channel, R0);
        }
-        if (up->port.line == KEYBOARD_LINE ||
+        if (up->flags & (SUNZILOG_FLAG_CONS_KEYB |
-            up->port.line == MOUSE_LINE) {
+                         SUNZILOG_FLAG_CONS_MOUSE)) {
                sunzilog_init_kbdms(up, up->port.line);
                up->curregs[R9] |= (NV | MIE);
                write_zsreg(channel, R9, up->curregs[R9]);
@@ -1313,37 +1309,26 @@ static void __init sunzilog_init_hw(struct uart_sunzilog_port *up)
        spin_unlock_irqrestore(&up->port.lock, flags);
 #ifdef CONFIG_SERIO
-        if (up->port.line == KEYBOARD_LINE || up->port.line == MOUSE_LINE)
+        if (up->flags & (SUNZILOG_FLAG_CONS_KEYB |
-                sunzilog_register_serio(up, up->port.line);
+                         SUNZILOG_FLAG_CONS_MOUSE))
+                sunzilog_register_serio(up);
 #endif
 }
-static int __devinit zs_get_instance(struct device_node *dp)
-{
-        int ret;
-        ret = of_getintprop_default(dp, "slave", -1);
-        if (ret != -1)
-                return ret;
-        if (of_find_property(dp, "keyboard", NULL))
-                ret = 1;
-        else
-                ret = 0;
-        return ret;
-}
 static int zilog_irq = -1;
-static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *match)
+static int __devinit zs_probe(struct of_device *op, const struct of_device_id *match)
 {
-        struct of_device *op = to_of_device(&dev->dev);
+        static int inst;
        struct uart_sunzilog_port *up;
        struct zilog_layout __iomem *rp;
-        int inst = zs_get_instance(dev->node);
+        int keyboard_mouse;
        int err;
+        keyboard_mouse = 0;
+        if (of_find_property(op->node, "keyboard", NULL))
+                keyboard_mouse = 1;
        sunzilog_chip_regs[inst] = of_ioremap(&op->resource[0], 0,
                                              sizeof(struct zilog_layout),
                                              "zs");
@@ -1352,16 +1337,8 @@ static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *
        rp = sunzilog_chip_regs[inst];
-        if (zilog_irq == -1) {
+        if (zilog_irq == -1)
                zilog_irq = op->irqs[0];
-                err = request_irq(zilog_irq, sunzilog_interrupt, IRQF_SHARED,
-                                  "zs", sunzilog_irq_chain);
-                if (err) {
-                        of_iounmap(rp, sizeof(struct zilog_layout));
-                        return err;
-                }
-        }
        up = &sunzilog_port_table[inst * 2];
@@ -1378,7 +1355,7 @@ static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *
        up[0].port.line = (inst * 2) + 0;
        up[0].port.dev = &op->dev;
        up[0].flags |= SUNZILOG_FLAG_IS_CHANNEL_A;
-        if (inst == 1)
+        if (keyboard_mouse)
                up[0].flags |= SUNZILOG_FLAG_CONS_KEYB;
        sunzilog_init_hw(&up[0]);
@@ -1395,11 +1372,11 @@ static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *
        up[1].port.line = (inst * 2) + 1;
        up[1].port.dev = &op->dev;
        up[1].flags |= 0;
-        if (inst == 1)
+        if (keyboard_mouse)
                up[1].flags |= SUNZILOG_FLAG_CONS_MOUSE;
        sunzilog_init_hw(&up[1]);
-        if (inst != 1) {
+        if (!keyboard_mouse) {
                err = uart_add_one_port(&sunzilog_reg, &up[0].port);
                if (err) {
                        of_iounmap(rp, sizeof(struct zilog_layout));
@@ -1411,9 +1388,18 @@ static int __devinit zs_probe(struct of_device *dev, const struct of_device_id *
                        of_iounmap(rp, sizeof(struct zilog_layout));
                        return err;
                }
+        } else {
+                printk(KERN_INFO "%s: Keyboard at MMIO %lx (irq = %d) "
+                       "is a zs\n",
+                       op->dev.bus_id, up[0].port.mapbase, op->irqs[0]);
+                printk(KERN_INFO "%s: Mouse at MMIO %lx (irq = %d) "
+                       "is a zs\n",
+                       op->dev.bus_id, up[1].port.mapbase, op->irqs[0]);
        }
-        dev_set_drvdata(&dev->dev, &up[0]);
+        dev_set_drvdata(&op->dev, &up[0]);
+        inst++;
        return 0;
 }
@@ -1462,36 +1448,65 @@ static struct of_platform_driver zs_driver = {
 static int __init sunzilog_init(void)
 {
        struct device_node *dp;
-        int err;
+        int err, uart_count;
+        int num_keybms;
        NUM_SUNZILOG = 0;
-        for_each_node_by_name(dp, "zs")
+        num_keybms = 0;
+        for_each_node_by_name(dp, "zs") {
                NUM_SUNZILOG++;
+                if (of_find_property(dp, "keyboard", NULL))
+                        num_keybms++;
+        }
+        uart_count = 0;
        if (NUM_SUNZILOG) {
                int uart_count;
                err = sunzilog_alloc_tables();
                if (err)
-                        return err;
+                        goto out;
-                /* Subtract 1 for keyboard, 1 for mouse.  */
+                uart_count = (NUM_SUNZILOG * 2) - (2 * num_keybms);
-                uart_count = (NUM_SUNZILOG * 2) - 2;
                sunzilog_reg.nr = uart_count;
                sunzilog_reg.minor = sunserial_current_minor;
                err = uart_register_driver(&sunzilog_reg);
-                if (err) {
+                if (err)
-                        sunzilog_free_tables();
+                        goto out_free_tables;
-                        return err;
-                }
                sunzilog_reg.tty_driver->name_base = sunzilog_reg.minor - 64;
                sunzilog_reg.cons = SUNZILOG_CONSOLE();
                sunserial_current_minor += uart_count;
        }
-        return of_register_driver(&zs_driver, &of_bus_type);
+        err = of_register_driver(&zs_driver, &of_bus_type);
+        if (err)
+                goto out_unregister_uart;
+        if (zilog_irq != -1) {
+                err = request_irq(zilog_irq, sunzilog_interrupt, IRQF_SHARED,
+                                  "zs", sunzilog_irq_chain);
+                if (err)
+                        goto out_unregister_driver;
+        }
+out:
+        return err;
+out_unregister_driver:
+        of_unregister_driver(&zs_driver);
+out_unregister_uart:
+        if (NUM_SUNZILOG) {
+                uart_unregister_driver(&sunzilog_reg);
+                sunzilog_reg.cons = NULL;
+        }
+out_free_tables:
+        sunzilog_free_tables();
+        goto out;
 }
 static void __exit sunzilog_exit(void)