]> git.kernelconcepts.de Git - karo-tx-linux.git/commitdiff
Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
authorLinus Torvalds <torvalds@linux-foundation.org>
Tue, 30 Apr 2013 20:16:38 +0000 (13:16 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Tue, 30 Apr 2013 20:16:38 +0000 (13:16 -0700)
Pull first round of SCSI updates from James "Jej B" Bottomley:
 "The patch set is mostly driver updates (qla4, qla2 [ISF support
  updates], lpfc, aacraid [dual firmware image support]) and a few bug
  fixes"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (47 commits)
  [SCSI] iscsi_tcp: support PF_MEMALLOC/__GFP_MEMALLOC
  [SCSI] libiscsi: avoid unnecessary multiple NULL assignments
  [SCSI] qla4xxx: Update driver version to 5.03.00-k8
  [SCSI] qla4xxx: Added print statements to display AENs
  [SCSI] qla4xxx: Use correct value for max flash node entries
  [SCSI] qla4xxx: Restrict logout from boot target session using session id
  [SCSI] qla4xxx: Use correct flash ddb offset for ISP40XX
  [SCSI] isci: add CONFIG_PM_SLEEP to suspend/resume functions
  [SCSI] scsi_dh_alua: Add module parameter to allow failover to non preferred path without STPG
  [SCSI] qla2xxx: Update the driver version to 8.05.00.03-k.
  [SCSI] qla2xxx: Obtain loopback iteration count from bsg request.
  [SCSI] qla2xxx: Add clarifying printk to thermal access fail cases.
  [SCSI] qla2xxx: Remove duplicated include form qla_isr.c
  [SCSI] qla2xxx: Enhancements to support ISPFx00.
  [SCSI] qla4xxx: Update driver version to 5.03.00-k7
  [SCSI] qla4xxx: Replace dev type macros with generic portal type macros
  [SCSI] scsi_transport_iscsi: Declare portal type string macros for generic use
  [SCSI] qla4xxx: Add flash node mgmt support
  [SCSI] libiscsi: export function iscsi_switch_str_param
  [SCSI] scsi_transport_iscsi: Add flash node mgmt support
  ...

1  2 
MAINTAINERS
drivers/scsi/lpfc/lpfc_bsg.c
drivers/scsi/lpfc/lpfc_hbadisc.c
drivers/scsi/lpfc/lpfc_sli.c
drivers/scsi/qla4xxx/ql4_nx.c

diff --combined MAINTAINERS
index 9cc4bd2a5a10fcc95fa7aa97ae983b18b2757d0f,851761b8dc5ee0d26cfaa3a2a9751027e018e1da..ea8f65fc6fa3e541ab2a9567d9c16be7b70bc176
@@@ -90,9 -90,6 +90,9 @@@ Descriptions of section entries
           F:   drivers/net/*   all files in drivers/net, but not below
           F:   */net/*         all files in "any top level directory"/net
           One pattern per line.  Multiple F: lines acceptable.
 +      N: Files and directories with regex patterns.
 +         N:   [^a-z]tegra     all files whose path contains the word tegra
 +         One pattern per line.  Multiple N: lines acceptable.
        X: Files and directories that are NOT maintained, same rules as F:
           Files exclusions are tested before file matches.
           Can be useful for excluding a specific subdirectory, for instance:
           X:   net/ipv6/
           matches all files in and below net excluding net/ipv6/
        K: Keyword perl extended regex pattern to match content in a
 -         patch or file, or an affected filename.  For instance:
 +         patch or file.  For instance:
           K: of_get_profile
 -            matches patch or file content, or filenames, that contain
 -            "of_get_profile"
 +            matches patches or files that contain "of_get_profile"
           K: \b(printk|pr_(info|err))\b
 -            matches patch or file content, or filenames, that contain one or
 -            more of the words printk, pr_info or pr_err
 +            matches patches or files that contain one or more of the words
 +            printk, pr_info or pr_err
           One regex pattern per line.  Multiple K: lines acceptable.
  
  Note: For the hard of thinking, this list is meant to remain in alphabetical
@@@ -1033,7 -1031,6 +1033,7 @@@ F:      drivers/mmc/host/msm_sdcc.
  F:    drivers/tty/serial/msm_serial.h
  F:    drivers/tty/serial/msm_serial.c
  F:    drivers/*/pm8???-*
 +F:    drivers/ssbi/
  F:    include/linux/mfd/pm8xxx/
  T:    git git://git.kernel.org/pub/scm/linux/kernel/git/davidb/linux-msm.git
  S:    Maintained
@@@ -2287,7 -2284,7 +2287,7 @@@ L:      linux-media@vger.kernel.or
  T:    git git://linuxtv.org/media_tree.git
  W:    http://linuxtv.org
  S:    Maintained
 -F:    drivers/media/i2c/cx2341x*
 +F:    drivers/media/common/cx2341x*
  F:    include/media/cx2341x*
  
  CX88 VIDEO4LINUX DRIVER
@@@ -2370,16 -2367,6 +2370,16 @@@ W:    http://www.cyclades.com
  S:    Orphan
  F:    drivers/net/wan/pc300*
  
 +CYPRESS_FIRMWARE MEDIA DRIVER
 +M:    Antti Palosaari <crope@iki.fi>
 +L:    linux-media@vger.kernel.org
 +W:    http://linuxtv.org/
 +W:    http://palosaari.fi/linux/
 +Q:    http://patchwork.linuxtv.org/project/linux-media/list/
 +T:    git git://linuxtv.org/anttip/media_tree.git
 +S:    Maintained
 +F:    drivers/media/common/cypress_firmware*
 +
  CYTTSP TOUCHSCREEN DRIVER
  M:    Javier Martinez Canillas <javier@dowhile0.org>
  L:    linux-input@vger.kernel.org
@@@ -2454,7 -2441,9 +2454,7 @@@ S:      Maintaine
  F:    drivers/platform/x86/dell-laptop.c
  
  DELL LAPTOP SMM DRIVER
 -M:    Massimo Dal Zotto <dz@debian.org>
 -W:    http://www.debian.org/~dz/i8k/
 -S:    Maintained
 +S:    Orphan
  F:    drivers/char/i8k.c
  F:    include/uapi/linux/i8k.h
  
@@@ -2469,12 -2458,6 +2469,12 @@@ M:    Matthew Garrett <mjg59@srcf.ucam.org
  S:    Maintained
  F:    drivers/platform/x86/dell-wmi.c
  
 +DESIGNWARE USB2 DRD IP DRIVER
 +M:    Paul Zimmerman <paulz@synopsys.com>
 +L:    linux-usb@vger.kernel.org
 +S:    Maintained
 +F:    drivers/staging/dwc2/
 +
  DESIGNWARE USB3 DRD IP DRIVER
  M:    Felipe Balbi <balbi@ti.com>
  L:    linux-usb@vger.kernel.org
@@@ -2748,7 -2731,7 +2748,7 @@@ T:      git git://linuxtv.org/media_tree.gi
  S:    Maintained
  F:    drivers/media/usb/dvb-usb/cxusb*
  
 -DVB_USB_CYPRESS_FIRMWARE MEDIA DRIVER
 +DVB_USB_EC168 MEDIA DRIVER
  M:    Antti Palosaari <crope@iki.fi>
  L:    linux-media@vger.kernel.org
  W:    http://linuxtv.org/
@@@ -2756,16 -2739,17 +2756,16 @@@ W:   http://palosaari.fi/linux
  Q:    http://patchwork.linuxtv.org/project/linux-media/list/
  T:    git git://linuxtv.org/anttip/media_tree.git
  S:    Maintained
 -F:    drivers/media/usb/dvb-usb-v2/cypress_firmware*
 +F:    drivers/media/usb/dvb-usb-v2/ec168*
  
 -DVB_USB_EC168 MEDIA DRIVER
 +DVB_USB_GL861 MEDIA DRIVER
  M:    Antti Palosaari <crope@iki.fi>
  L:    linux-media@vger.kernel.org
  W:    http://linuxtv.org/
 -W:    http://palosaari.fi/linux/
  Q:    http://patchwork.linuxtv.org/project/linux-media/list/
  T:    git git://linuxtv.org/anttip/media_tree.git
  S:    Maintained
 -F:    drivers/media/usb/dvb-usb-v2/ec168*
 +F:    drivers/media/usb/dvb-usb-v2/gl861*
  
  DVB_USB_MXL111SF MEDIA DRIVER
  M:    Michael Krufky <mkrufky@linuxtv.org>
@@@ -3524,7 -3508,7 +3524,7 @@@ F:      drivers/isdn/gigaset
  F:    include/uapi/linux/gigaset_dev.h
  
  GPIO SUBSYSTEM
 -M:    Grant Likely <grant.likely@secretlab.ca>
 +M:    Grant Likely <grant.likely@linaro.org>
  M:    Linus Walleij <linus.walleij@linaro.org>
  S:    Maintained
  T:    git git://git.secretlab.ca/git/linux-2.6.git
@@@ -3609,14 -3593,6 +3609,14 @@@ W:    http://www.kernel.org/pub/linux/kern
  S:    Maintained
  F:    drivers/platform/x86/hdaps.c
  
 +HDPVR USB VIDEO ENCODER DRIVER
 +M:    Hans Verkuil <hverkuil@xs4all.nl>
 +L:    linux-media@vger.kernel.org
 +T:    git git://linuxtv.org/media_tree.git
 +W:    http://linuxtv.org
 +S:    Odd Fixes
 +F:    drivers/media/usb/hdpvr
 +
  HWPOISON MEMORY FAILURE HANDLING
  M:    Andi Kleen <andi@firstfloor.org>
  L:    linux-mm@kvack.org
@@@ -4365,7 -4341,7 +4365,7 @@@ F:      drivers/irqchip
  
  IRQ DOMAINS (IRQ NUMBER MAPPING LIBRARY)
  M:    Benjamin Herrenschmidt <benh@kernel.crashing.org>
 -M:    Grant Likely <grant.likely@secretlab.ca>
 +M:    Grant Likely <grant.likely@linaro.org>
  T:    git git://git.secretlab.ca/git/linux-2.6.git irqdomain/next
  S:    Maintained
  F:    Documentation/IRQ-domain.txt
@@@ -4446,16 -4422,6 +4446,16 @@@ Q:    http://patchwork.linuxtv.org/project
  S:    Maintained
  F:    drivers/media/dvb-frontends/it913x-fe*
  
 +IT913X MEDIA DRIVER
 +M:    Antti Palosaari <crope@iki.fi>
 +L:    linux-media@vger.kernel.org
 +W:    http://linuxtv.org/
 +W:    http://palosaari.fi/linux/
 +Q:    http://patchwork.linuxtv.org/project/linux-media/list/
 +T:    git git://linuxtv.org/anttip/media_tree.git
 +S:    Maintained
 +F:    drivers/media/tuners/it913x*
 +
  IVTV VIDEO4LINUX DRIVER
  M:    Andy Walls <awalls@md.metrocast.net>
  L:    ivtv-devel@ivtvdriver.org (moderated for non-subscribers)
@@@ -4862,8 -4828,11 +4862,8 @@@ F:     arch/powerpc/platforms/40x
  F:    arch/powerpc/platforms/44x/
  
  LINUX FOR POWERPC EMBEDDED XILINX VIRTEX
 -M:    Grant Likely <grant.likely@secretlab.ca>
 -W:    http://wiki.secretlab.ca/index.php/Linux_on_Xilinx_Virtex
  L:    linuxppc-dev@lists.ozlabs.org
 -T:    git git://git.secretlab.ca/git/linux-2.6.git
 -S:    Maintained
 +S:    Unmaintained
  F:    arch/powerpc/*/*virtex*
  F:    arch/powerpc/*/*/*virtex*
  
@@@ -4972,12 -4941,6 +4972,12 @@@ W:    logfs.or
  S:    Maintained
  F:    fs/logfs/
  
 +LPC32XX MACHINE SUPPORT
 +M:    Roland Stigge <stigge@antcom.de>
 +L:    linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 +S:    Maintained
 +F:    arch/arm/mach-lpc32xx/
 +
  LSILOGIC MPT FUSION DRIVERS (FC/SAS/SPI)
  M:    Nagalakshmi Nandigama <Nagalakshmi.Nandigama@lsi.com>
  M:    Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
@@@ -5443,13 -5406,6 +5443,13 @@@ L:    linux-scsi@vger.kernel.or
  S:    Maintained
  F:    drivers/scsi/NCR_D700.*
  
 +NCT6775 HARDWARE MONITOR DRIVER
 +M:    Guenter Roeck <linux@roeck-us.net>
 +L:    lm-sensors@lm-sensors.org
 +S:    Maintained
 +F:    Documentation/hwmon/nct6775
 +F:    drivers/hwmon/nct6775.c
 +
  NETEFFECT IWARP RNIC DRIVER (IW_NES)
  M:    Faisal Latif <faisal.latif@intel.com>
  L:    linux-rdma@vger.kernel.org
@@@ -5881,7 -5837,7 +5881,7 @@@ F:      Documentation/i2c/busses/i2c-ocore
  F:    drivers/i2c/busses/i2c-ocores.c
  
  OPEN FIRMWARE AND FLATTENED DEVICE TREE
 -M:    Grant Likely <grant.likely@secretlab.ca>
 +M:    Grant Likely <grant.likely@linaro.org>
  M:    Rob Herring <rob.herring@calxeda.com>
  L:    devicetree-discuss@lists.ozlabs.org (moderated for non-subscribers)
  W:    http://fdt.secretlab.ca
@@@ -6236,7 -6192,7 +6236,7 @@@ S:      Supporte
  F:    drivers/scsi/pmcraid.*
  
  PMC SIERRA PM8001 DRIVER
- M:    jack_wang@usish.com
+ M:    xjtuwjp@gmail.com
  M:    lindar_liu@usish.com
  L:    linux-scsi@vger.kernel.org
  S:    Supported
@@@ -6669,7 -6625,7 +6669,7 @@@ S:      Supporte
  F:    fs/reiserfs/
  
  REGISTER MAP ABSTRACTION
 -M:    Mark Brown <broonie@opensource.wolfsonmicro.com>
 +M:    Mark Brown <broonie@kernel.org>
  T:    git git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git
  S:    Supported
  F:    drivers/base/regmap/
@@@ -6730,16 -6686,6 +6730,16 @@@ T:    git git://linuxtv.org/anttip/media_t
  S:    Maintained
  F:    drivers/media/dvb-frontends/rtl2830*
  
 +RTL2832 MEDIA DRIVER
 +M:    Antti Palosaari <crope@iki.fi>
 +L:    linux-media@vger.kernel.org
 +W:    http://linuxtv.org/
 +W:    http://palosaari.fi/linux/
 +Q:    http://patchwork.linuxtv.org/project/linux-media/list/
 +T:    git git://linuxtv.org/anttip/media_tree.git
 +S:    Maintained
 +F:    drivers/media/dvb-frontends/rtl2832*
 +
  RTL8180 WIRELESS DRIVER
  M:    "John W. Linville" <linville@tuxdriver.com>
  L:    linux-wireless@vger.kernel.org
@@@ -6842,7 -6788,7 +6842,7 @@@ L:      linux-media@vger.kernel.or
  W:    http://linuxtv.org
  T:    git git://linuxtv.org/media_tree.git
  S:    Odd fixes
 -F:    Documentation/video4linux/saa7134/
 +F:    Documentation/video4linux/*.saa7134
  F:    drivers/media/pci/saa7134/
  
  SAA7146 VIDEO4LINUX-2 DRIVER
@@@ -6935,8 -6881,9 +6935,8 @@@ F:      drivers/clocksourc
  
  TLG2300 VIDEO4LINUX-2 DRIVER
  M:    Huang Shijie <shijie8@gmail.com>
 -M:    Kang Yong <kangyong@telegent.com>
 -M:    Zhang Xiaobing <xbzhang@telegent.com>
 -S:    Supported
 +M:    Hans Verkuil <hverkuil@xs4all.nl>
 +S:    Odd Fixes
  F:    drivers/media/usb/tlg2300
  
  SC1200 WDT DRIVER
@@@ -7004,6 -6951,7 +7004,6 @@@ F:      drivers/scsi/st
  
  SCTP PROTOCOL
  M:    Vlad Yasevich <vyasevich@gmail.com>
 -M:    Sridhar Samudrala <sri@us.ibm.com>
  M:    Neil Horman <nhorman@tuxdriver.com>
  L:    linux-sctp@vger.kernel.org
  W:    http://lksctp.sourceforge.net
@@@ -7182,43 -7130,17 +7182,43 @@@ F:   drivers/media/radio/si470x/radio-si4
  F:    drivers/media/radio/si470x/radio-si470x.h
  F:    drivers/media/radio/si470x/radio-si470x-usb.c
  
 +SI4713 FM RADIO TRANSMITTER I2C DRIVER
 +M:    Eduardo Valentin <edubezval@gmail.com>
 +L:    linux-media@vger.kernel.org
 +T:    git git://linuxtv.org/media_tree.git
 +W:    http://linuxtv.org
 +S:    Odd Fixes
 +F:    drivers/media/radio/si4713-i2c.?
 +
 +SI4713 FM RADIO TRANSMITTER PLATFORM DRIVER
 +M:    Eduardo Valentin <edubezval@gmail.com>
 +L:    linux-media@vger.kernel.org
 +T:    git git://linuxtv.org/media_tree.git
 +W:    http://linuxtv.org
 +S:    Odd Fixes
 +F:    drivers/media/radio/radio-si4713.h
 +
 +SIANO DVB DRIVER
 +M:    Mauro Carvalho Chehab <mchehab@redhat.com>
 +L:    linux-media@vger.kernel.org
 +W:    http://linuxtv.org
 +T:    git git://linuxtv.org/media_tree.git
 +S:    Odd fixes
 +F:    drivers/media/common/siano/
 +F:    drivers/media/dvb/siano/
 +F:    drivers/media/usb/siano/
 +F:    drivers/media/mmc/siano
 +
  SH_VEU V4L2 MEM2MEM DRIVER
  M:    Guennadi Liakhovetski <g.liakhovetski@gmx.de>
  L:    linux-media@vger.kernel.org
  S:    Maintained
  F:    drivers/media/platform/sh_veu.c
 -F:    include/media/sh_veu.h
  
  SH_VOU V4L2 OUTPUT DRIVER
  M:    Guennadi Liakhovetski <g.liakhovetski@gmx.de>
  L:    linux-media@vger.kernel.org
 -S:    Maintained
 +S:    Odd Fixes
  F:    drivers/media/platform/sh_vou.c
  F:    include/media/sh_vou.h
  
@@@ -7260,13 -7182,14 +7260,13 @@@ F:   arch/arm/mach-davinc
  F:    drivers/i2c/busses/i2c-davinci.c
  
  TI DAVINCI SERIES MEDIA DRIVER
 -M:    Manjunath Hadli <manjunath.hadli@ti.com>
 -M:    Prabhakar Lad <prabhakar.lad@ti.com>
 +M:    Lad, Prabhakar <prabhakar.csengg@gmail.com>
  L:    linux-media@vger.kernel.org
  L:    davinci-linux-open-source@linux.davincidsp.com (moderated for non-subscribers)
  W:    http://linuxtv.org/
  Q:    http://patchwork.linuxtv.org/project/linux-media/list/
  T:    git git://linuxtv.org/mhadli/v4l-dvb-davinci_devices.git
 -S:    Supported
 +S:    Maintained
  F:    drivers/media/platform/davinci/
  F:    include/media/davinci/
  
@@@ -7451,7 -7374,7 +7451,7 @@@ F:      sound
  
  SOUND - SOC LAYER / DYNAMIC AUDIO POWER MANAGEMENT (ASoC)
  M:    Liam Girdwood <lgirdwood@gmail.com>
 -M:    Mark Brown <broonie@opensource.wolfsonmicro.com>
 +M:    Mark Brown <broonie@kernel.org>
  T:    git git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git
  L:    alsa-devel@alsa-project.org (moderated for non-subscribers)
  W:    http://alsa-project.org/main/index.php/ASoC
@@@ -7539,11 -7462,11 +7539,11 @@@ S:   Maintaine
  F:    drivers/clk/spear/
  
  SPI SUBSYSTEM
 -M:    Grant Likely <grant.likely@secretlab.ca>
 -M:    Mark Brown <broonie@opensource.wolfsonmicro.com>
 +M:    Mark Brown <broonie@kernel.org>
 +M:    Grant Likely <grant.likely@linaro.org>
  L:    spi-devel-general@lists.sourceforge.net
 +T:    git git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git
  Q:    http://patchwork.kernel.org/project/spi-devel-general/list/
 -T:    git git://git.secretlab.ca/git/linux-2.6.git
  S:    Maintained
  F:    Documentation/spi/
  F:    drivers/spi/
@@@ -7638,11 -7561,6 +7638,11 @@@ M:    David Täht <d@teklibre.com
  S:    Odd Fixes
  F:    drivers/staging/frontier/
  
 +STAGING - GO7007 MPEG CODEC
 +M:    Hans Verkuil <hans.verkuil@cisco.com>
 +S:    Maintained
 +F:    drivers/staging/media/go7007/
 +
  STAGING - INDUSTRIAL IO
  M:    Jonathan Cameron <jic23@cam.ac.uk>
  L:    linux-iio@vger.kernel.org
@@@ -7693,8 -7611,8 +7693,8 @@@ S:      Odd Fixe
  F:    drivers/staging/sm7xxfb/
  
  STAGING - SOFTLOGIC 6x10 MPEG CODEC
 -M:    Ben Collins <bcollins@bluecherry.net>
 -S:    Odd Fixes
 +M:    Ismael Luceno <ismael.luceno@corp.bluecherry.net>
 +S:    Supported
  F:    drivers/staging/media/solo6x10/
  
  STAGING - SPEAKUP CONSOLE SPEECH DRIVER
@@@ -7959,7 -7877,7 +7959,7 @@@ L:      linux-tegra@vger.kernel.or
  Q:    http://patchwork.ozlabs.org/project/linux-tegra/list/
  T:    git git://git.kernel.org/pub/scm/linux/kernel/git/swarren/linux-tegra.git
  S:    Supported
 -K:    (?i)[^a-z]tegra
 +N:    [^a-z]tegra
  
  TEHUTI ETHERNET DRIVER
  M:    Andy Gospodarek <andy@greyhouse.net>
@@@ -8002,12 -7920,6 +8002,12 @@@ T:    git git://repo.or.cz/linux-2.6/linux
  S:    Maintained
  F:    drivers/platform/x86/thinkpad_acpi.c
  
 +TI BANDGAP AND THERMAL DRIVER
 +M:    Eduardo Valentin <eduardo.valentin@ti.com>
 +L:    linux-pm@vger.kernel.org
 +S:    Maintained
 +F:    drivers/staging/omap-thermal/
 +
  TI FLASH MEDIA INTERFACE DRIVER
  M:    Alex Dubov <oakad@yahoo.com>
  S:    Maintained
@@@ -8445,10 -8357,9 +8445,10 @@@ S:    Maintaine
  F:    drivers/usb/serial/option.c
  
  USB PEGASUS DRIVER
 -M:    Petko Manolov <petkan@users.sourceforge.net>
 +M:    Petko Manolov <petkan@nucleusys.com>
  L:    linux-usb@vger.kernel.org
  L:    netdev@vger.kernel.org
 +T:    git git://git.code.sf.net/p/pegasus2/git
  W:    http://pegasus2.sourceforge.net/
  S:    Maintained
  F:    drivers/net/usb/pegasus.*
@@@ -8468,10 -8379,9 +8468,10 @@@ S:    Supporte
  F:    drivers/usb/class/usblp.c
  
  USB RTL8150 DRIVER
 -M:    Petko Manolov <petkan@users.sourceforge.net>
 +M:    Petko Manolov <petkan@nucleusys.com>
  L:    linux-usb@vger.kernel.org
  L:    netdev@vger.kernel.org
 +T:    git git://git.code.sf.net/p/pegasus2/git
  W:    http://pegasus2.sourceforge.net/
  S:    Maintained
  F:    drivers/net/usb/rtl8150.c
@@@ -8797,8 -8707,8 +8797,8 @@@ F:      drivers/scsi/vmw_pvscsi.
  F:    drivers/scsi/vmw_pvscsi.h
  
  VOLTAGE AND CURRENT REGULATOR FRAMEWORK
 -M:    Liam Girdwood <lrg@ti.com>
 -M:    Mark Brown <broonie@opensource.wolfsonmicro.com>
 +M:    Liam Girdwood <lgirdwood@gmail.com>
 +M:    Mark Brown <broonie@kernel.org>
  W:    http://opensource.wolfsonmicro.com/node/15
  W:    http://www.slimlogic.co.uk/?p=48
  T:    git git://git.kernel.org/pub/scm/linux/kernel/git/lrg/regulator.git
@@@ -9061,7 -8971,9 +9061,7 @@@ S:      Maintaine
  F:    drivers/net/ethernet/xilinx/xilinx_axienet*
  
  XILINX SYSTEMACE DRIVER
 -M:    Grant Likely <grant.likely@secretlab.ca>
 -W:    http://www.secretlab.ca/
 -S:    Maintained
 +S:    Unmaintained
  F:    drivers/block/xsysace.c
  
  XILINX UARTLITE SERIAL DRIVER
index f5d106456f1d0b449259c3dba06edb1af6b17092,89a0d8016bbd6d038eafb14314b4ebbdb1e29b68..8886668920049e685cb9b5d3572cb1426dbea526
@@@ -64,18 -64,14 +64,14 @@@ struct lpfc_bsg_event 
        struct list_head events_to_get;
        struct list_head events_to_see;
  
-       /* job waiting for this event to finish */
-       struct fc_bsg_job *set_job;
+       /* driver data associated with the job */
+       void *dd_data;
  };
  
  struct lpfc_bsg_iocb {
        struct lpfc_iocbq *cmdiocbq;
-       struct lpfc_iocbq *rspiocbq;
-       struct lpfc_dmabuf *bmp;
+       struct lpfc_dmabuf *rmp;
        struct lpfc_nodelist *ndlp;
-       /* job waiting for this iocb to finish */
-       struct fc_bsg_job *set_job;
  };
  
  struct lpfc_bsg_mbox {
        uint32_t mbOffset; /* from app */
        uint32_t inExtWLen; /* from app */
        uint32_t outExtWLen; /* from app */
-       /* job waiting for this mbox command to finish */
-       struct fc_bsg_job *set_job;
  };
  
  #define MENLO_DID 0x0000FC0E
  
  struct lpfc_bsg_menlo {
        struct lpfc_iocbq *cmdiocbq;
-       struct lpfc_iocbq *rspiocbq;
-       struct lpfc_dmabuf *bmp;
-       /* job waiting for this iocb to finish */
-       struct fc_bsg_job *set_job;
+       struct lpfc_dmabuf *rmp;
  };
  
  #define TYPE_EVT      1
  #define TYPE_MENLO    4
  struct bsg_job_data {
        uint32_t type;
+       struct fc_bsg_job *set_job; /* job waiting for this iocb to finish */
        union {
                struct lpfc_bsg_event *evt;
                struct lpfc_bsg_iocb iocb;
@@@ -141,6 -131,138 +131,138 @@@ struct lpfc_dmabufext 
        uint32_t flag;
  };
  
+ static void
+ lpfc_free_bsg_buffers(struct lpfc_hba *phba, struct lpfc_dmabuf *mlist)
+ {
+       struct lpfc_dmabuf *mlast, *next_mlast;
+       if (mlist) {
+               list_for_each_entry_safe(mlast, next_mlast, &mlist->list,
+                                        list) {
+                       lpfc_mbuf_free(phba, mlast->virt, mlast->phys);
+                       list_del(&mlast->list);
+                       kfree(mlast);
+               }
+               lpfc_mbuf_free(phba, mlist->virt, mlist->phys);
+               kfree(mlist);
+       }
+       return;
+ }
+ static struct lpfc_dmabuf *
+ lpfc_alloc_bsg_buffers(struct lpfc_hba *phba, unsigned int size,
+                      int outbound_buffers, struct ulp_bde64 *bpl,
+                      int *bpl_entries)
+ {
+       struct lpfc_dmabuf *mlist = NULL;
+       struct lpfc_dmabuf *mp;
+       unsigned int bytes_left = size;
+       /* Verify we can support the size specified */
+       if (!size || (size > (*bpl_entries * LPFC_BPL_SIZE)))
+               return NULL;
+       /* Determine the number of dma buffers to allocate */
+       *bpl_entries = (size % LPFC_BPL_SIZE ? size/LPFC_BPL_SIZE + 1 :
+                       size/LPFC_BPL_SIZE);
+       /* Allocate dma buffer and place in BPL passed */
+       while (bytes_left) {
+               /* Allocate dma buffer  */
+               mp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
+               if (!mp) {
+                       if (mlist)
+                               lpfc_free_bsg_buffers(phba, mlist);
+                       return NULL;
+               }
+               INIT_LIST_HEAD(&mp->list);
+               mp->virt = lpfc_mbuf_alloc(phba, MEM_PRI, &(mp->phys));
+               if (!mp->virt) {
+                       kfree(mp);
+                       if (mlist)
+                               lpfc_free_bsg_buffers(phba, mlist);
+                       return NULL;
+               }
+               /* Queue it to a linked list */
+               if (!mlist)
+                       mlist = mp;
+               else
+                       list_add_tail(&mp->list, &mlist->list);
+               /* Add buffer to buffer pointer list */
+               if (outbound_buffers)
+                       bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
+               else
+                       bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
+               bpl->addrLow = le32_to_cpu(putPaddrLow(mp->phys));
+               bpl->addrHigh = le32_to_cpu(putPaddrHigh(mp->phys));
+               bpl->tus.f.bdeSize = (uint16_t)
+                       (bytes_left >= LPFC_BPL_SIZE ? LPFC_BPL_SIZE :
+                        bytes_left);
+               bytes_left -= bpl->tus.f.bdeSize;
+               bpl->tus.w = le32_to_cpu(bpl->tus.w);
+               bpl++;
+       }
+       return mlist;
+ }
+ static unsigned int
+ lpfc_bsg_copy_data(struct lpfc_dmabuf *dma_buffers,
+                  struct fc_bsg_buffer *bsg_buffers,
+                  unsigned int bytes_to_transfer, int to_buffers)
+ {
+       struct lpfc_dmabuf *mp;
+       unsigned int transfer_bytes, bytes_copied = 0;
+       unsigned int sg_offset, dma_offset;
+       unsigned char *dma_address, *sg_address;
+       struct scatterlist *sgel;
+       LIST_HEAD(temp_list);
+       list_splice_init(&dma_buffers->list, &temp_list);
+       list_add(&dma_buffers->list, &temp_list);
+       sg_offset = 0;
+       sgel = bsg_buffers->sg_list;
+       list_for_each_entry(mp, &temp_list, list) {
+               dma_offset = 0;
+               while (bytes_to_transfer && sgel &&
+                      (dma_offset < LPFC_BPL_SIZE)) {
+                       dma_address = mp->virt + dma_offset;
+                       if (sg_offset) {
+                               /* Continue previous partial transfer of sg */
+                               sg_address = sg_virt(sgel) + sg_offset;
+                               transfer_bytes = sgel->length - sg_offset;
+                       } else {
+                               sg_address = sg_virt(sgel);
+                               transfer_bytes = sgel->length;
+                       }
+                       if (bytes_to_transfer < transfer_bytes)
+                               transfer_bytes = bytes_to_transfer;
+                       if (transfer_bytes > (LPFC_BPL_SIZE - dma_offset))
+                               transfer_bytes = LPFC_BPL_SIZE - dma_offset;
+                       if (to_buffers)
+                               memcpy(dma_address, sg_address, transfer_bytes);
+                       else
+                               memcpy(sg_address, dma_address, transfer_bytes);
+                       dma_offset += transfer_bytes;
+                       sg_offset += transfer_bytes;
+                       bytes_to_transfer -= transfer_bytes;
+                       bytes_copied += transfer_bytes;
+                       if (sg_offset >= sgel->length) {
+                               sg_offset = 0;
+                               sgel = sg_next(sgel);
+                       }
+               }
+       }
+       list_del_init(&dma_buffers->list);
+       list_splice(&temp_list, &dma_buffers->list);
+       return bytes_copied;
+ }
  /**
   * lpfc_bsg_send_mgmt_cmd_cmp - lpfc_bsg_send_mgmt_cmd's completion handler
   * @phba: Pointer to HBA context object.
@@@ -166,62 -288,72 +288,72 @@@ lpfc_bsg_send_mgmt_cmd_cmp(struct lpfc_
        struct bsg_job_data *dd_data;
        struct fc_bsg_job *job;
        IOCB_t *rsp;
-       struct lpfc_dmabuf *bmp;
+       struct lpfc_dmabuf *bmp, *cmp, *rmp;
        struct lpfc_nodelist *ndlp;
        struct lpfc_bsg_iocb *iocb;
        unsigned long flags;
+       unsigned int rsp_size;
        int rc = 0;
  
+       dd_data = cmdiocbq->context1;
+       /* Determine if job has been aborted */
        spin_lock_irqsave(&phba->ct_ev_lock, flags);
-       dd_data = cmdiocbq->context2;
-       if (!dd_data) {
-               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
-               lpfc_sli_release_iocbq(phba, cmdiocbq);
-               return;
+       job = dd_data->set_job;
+       if (job) {
+               /* Prevent timeout handling from trying to abort job */
+               job->dd_data = NULL;
        }
+       spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
  
        iocb = &dd_data->context_un.iocb;
-       job = iocb->set_job;
-       job->dd_data = NULL; /* so timeout handler does not reply */
-       bmp = iocb->bmp;
+       ndlp = iocb->ndlp;
+       rmp = iocb->rmp;
+       cmp = cmdiocbq->context2;
+       bmp = cmdiocbq->context3;
        rsp = &rspiocbq->iocb;
-       ndlp = cmdiocbq->context1;
  
-       pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
-                    job->request_payload.sg_cnt, DMA_TO_DEVICE);
-       pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
-                    job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
+       /* Copy the completed data or set the error status */
  
-       if (rsp->ulpStatus) {
-               if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
-                       switch (rsp->un.ulpWord[4] & IOERR_PARAM_MASK) {
-                       case IOERR_SEQUENCE_TIMEOUT:
-                               rc = -ETIMEDOUT;
-                               break;
-                       case IOERR_INVALID_RPI:
-                               rc = -EFAULT;
-                               break;
-                       default:
+       if (job) {
+               if (rsp->ulpStatus) {
+                       if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
+                               switch (rsp->un.ulpWord[4] & IOERR_PARAM_MASK) {
+                               case IOERR_SEQUENCE_TIMEOUT:
+                                       rc = -ETIMEDOUT;
+                                       break;
+                               case IOERR_INVALID_RPI:
+                                       rc = -EFAULT;
+                                       break;
+                               default:
+                                       rc = -EACCES;
+                                       break;
+                               }
+                       } else {
                                rc = -EACCES;
-                               break;
                        }
-               } else
-                       rc = -EACCES;
-       } else
-               job->reply->reply_payload_rcv_len =
-                       rsp->un.genreq64.bdl.bdeSize;
+               } else {
+                       rsp_size = rsp->un.genreq64.bdl.bdeSize;
+                       job->reply->reply_payload_rcv_len =
+                               lpfc_bsg_copy_data(rmp, &job->reply_payload,
+                                                  rsp_size, 0);
+               }
+       }
  
+       lpfc_free_bsg_buffers(phba, cmp);
+       lpfc_free_bsg_buffers(phba, rmp);
        lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
+       kfree(bmp);
        lpfc_sli_release_iocbq(phba, cmdiocbq);
        lpfc_nlp_put(ndlp);
-       kfree(bmp);
        kfree(dd_data);
-       /* make error code available to userspace */
-       job->reply->result = rc;
-       /* complete the job back to userspace */
-       job->job_done(job);
-       spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
+       /* Complete the job if the job is still active */
+       if (job) {
+               job->reply->result = rc;
+               job->job_done(job);
+       }
        return;
  }
  
@@@ -240,12 -372,9 +372,9 @@@ lpfc_bsg_send_mgmt_cmd(struct fc_bsg_jo
        uint32_t timeout;
        struct lpfc_iocbq *cmdiocbq = NULL;
        IOCB_t *cmd;
-       struct lpfc_dmabuf *bmp = NULL;
+       struct lpfc_dmabuf *bmp = NULL, *cmp = NULL, *rmp = NULL;
        int request_nseg;
        int reply_nseg;
-       struct scatterlist *sgel = NULL;
-       int numbde;
-       dma_addr_t busaddr;
        struct bsg_job_data *dd_data;
        uint32_t creg_val;
        int rc = 0;
                goto no_ndlp;
        }
  
-       bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
-       if (!bmp) {
-               rc = -ENOMEM;
-               goto free_ndlp;
-       }
        if (ndlp->nlp_flag & NLP_ELS_SND_MASK) {
                rc = -ENODEV;
-               goto free_bmp;
+               goto free_ndlp;
        }
  
        cmdiocbq = lpfc_sli_get_iocbq(phba);
        if (!cmdiocbq) {
                rc = -ENOMEM;
-               goto free_bmp;
+               goto free_ndlp;
        }
  
        cmd = &cmdiocbq->iocb;
+       bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
+       if (!bmp) {
+               rc = -ENOMEM;
+               goto free_cmdiocbq;
+       }
        bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
        if (!bmp->virt) {
                rc = -ENOMEM;
-               goto free_cmdiocbq;
+               goto free_bmp;
        }
  
        INIT_LIST_HEAD(&bmp->list);
        bpl = (struct ulp_bde64 *) bmp->virt;
-       request_nseg = pci_map_sg(phba->pcidev, job->request_payload.sg_list,
-                                 job->request_payload.sg_cnt, DMA_TO_DEVICE);
-       for_each_sg(job->request_payload.sg_list, sgel, request_nseg, numbde) {
-               busaddr = sg_dma_address(sgel);
-               bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
-               bpl->tus.f.bdeSize = sg_dma_len(sgel);
-               bpl->tus.w = cpu_to_le32(bpl->tus.w);
-               bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
-               bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
-               bpl++;
+       request_nseg = LPFC_BPL_SIZE/sizeof(struct ulp_bde64);
+       cmp = lpfc_alloc_bsg_buffers(phba, job->request_payload.payload_len,
+                                    1, bpl, &request_nseg);
+       if (!cmp) {
+               rc = -ENOMEM;
+               goto free_bmp;
        }
+       lpfc_bsg_copy_data(cmp, &job->request_payload,
+                          job->request_payload.payload_len, 1);
  
-       reply_nseg = pci_map_sg(phba->pcidev, job->reply_payload.sg_list,
-                               job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
-       for_each_sg(job->reply_payload.sg_list, sgel, reply_nseg, numbde) {
-               busaddr = sg_dma_address(sgel);
-               bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
-               bpl->tus.f.bdeSize = sg_dma_len(sgel);
-               bpl->tus.w = cpu_to_le32(bpl->tus.w);
-               bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
-               bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
-               bpl++;
+       bpl += request_nseg;
+       reply_nseg = LPFC_BPL_SIZE/sizeof(struct ulp_bde64) - request_nseg;
+       rmp = lpfc_alloc_bsg_buffers(phba, job->reply_payload.payload_len, 0,
+                                    bpl, &reply_nseg);
+       if (!rmp) {
+               rc = -ENOMEM;
+               goto free_cmp;
        }
  
        cmd->un.genreq64.bdl.ulpIoTag32 = 0;
        cmd->ulpTimeout = timeout;
  
        cmdiocbq->iocb_cmpl = lpfc_bsg_send_mgmt_cmd_cmp;
-       cmdiocbq->context1 = ndlp;
-       cmdiocbq->context2 = dd_data;
+       cmdiocbq->context1 = dd_data;
+       cmdiocbq->context2 = cmp;
+       cmdiocbq->context3 = bmp;
        dd_data->type = TYPE_IOCB;
+       dd_data->set_job = job;
        dd_data->context_un.iocb.cmdiocbq = cmdiocbq;
-       dd_data->context_un.iocb.set_job = job;
-       dd_data->context_un.iocb.bmp = bmp;
+       dd_data->context_un.iocb.ndlp = ndlp;
+       dd_data->context_un.iocb.rmp = rmp;
+       job->dd_data = dd_data;
  
        if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
                if (lpfc_readl(phba->HCregaddr, &creg_val)) {
                        rc = -EIO ;
-                       goto free_cmdiocbq;
+                       goto free_rmp;
                }
                creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
                writel(creg_val, phba->HCregaddr);
        else
                rc = -EIO;
  
        /* iocb failed so cleanup */
-       pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
-                    job->request_payload.sg_cnt, DMA_TO_DEVICE);
-       pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
-                    job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
  
-       lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
- free_cmdiocbq:
-       lpfc_sli_release_iocbq(phba, cmdiocbq);
+ free_rmp:
+       lpfc_free_bsg_buffers(phba, rmp);
+ free_cmp:
+       lpfc_free_bsg_buffers(phba, cmp);
  free_bmp:
+       if (bmp->virt)
+               lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
        kfree(bmp);
+ free_cmdiocbq:
+       lpfc_sli_release_iocbq(phba, cmdiocbq);
  free_ndlp:
        lpfc_nlp_put(ndlp);
  no_ndlp:
@@@ -418,67 -545,68 +545,68 @@@ lpfc_bsg_rport_els_cmp(struct lpfc_hba 
        struct fc_bsg_job *job;
        IOCB_t *rsp;
        struct lpfc_nodelist *ndlp;
-       struct lpfc_dmabuf *pbuflist = NULL;
+       struct lpfc_dmabuf *pcmd = NULL, *prsp = NULL;
        struct fc_bsg_ctels_reply *els_reply;
        uint8_t *rjt_data;
        unsigned long flags;
+       unsigned int rsp_size;
        int rc = 0;
  
-       spin_lock_irqsave(&phba->ct_ev_lock, flags);
        dd_data = cmdiocbq->context1;
-       /* normal completion and timeout crossed paths, already done */
-       if (!dd_data) {
-               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
-               return;
-       }
+       ndlp = dd_data->context_un.iocb.ndlp;
+       cmdiocbq->context1 = ndlp;
  
-       cmdiocbq->iocb_flag |= LPFC_IO_WAKE;
-       if (cmdiocbq->context2 && rspiocbq)
-               memcpy(&((struct lpfc_iocbq *)cmdiocbq->context2)->iocb,
-                      &rspiocbq->iocb, sizeof(IOCB_t));
+       /* Determine if job has been aborted */
+       spin_lock_irqsave(&phba->ct_ev_lock, flags);
+       job = dd_data->set_job;
+       if (job) {
+               /* Prevent timeout handling from trying to abort job  */
+               job->dd_data = NULL;
+       }
+       spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
  
-       job = dd_data->context_un.iocb.set_job;
-       cmdiocbq = dd_data->context_un.iocb.cmdiocbq;
-       rspiocbq = dd_data->context_un.iocb.rspiocbq;
        rsp = &rspiocbq->iocb;
-       ndlp = dd_data->context_un.iocb.ndlp;
+       pcmd = (struct lpfc_dmabuf *)cmdiocbq->context2;
+       prsp = (struct lpfc_dmabuf *)pcmd->list.next;
  
-       pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
-                    job->request_payload.sg_cnt, DMA_TO_DEVICE);
-       pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
-                    job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
+       /* Copy the completed job data or determine the job status if job is
+        * still active
+        */
  
-       if (job->reply->result == -EAGAIN)
-               rc = -EAGAIN;
-       else if (rsp->ulpStatus == IOSTAT_SUCCESS)
-               job->reply->reply_payload_rcv_len =
-                       rsp->un.elsreq64.bdl.bdeSize;
-       else if (rsp->ulpStatus == IOSTAT_LS_RJT) {
-               job->reply->reply_payload_rcv_len =
-                       sizeof(struct fc_bsg_ctels_reply);
-               /* LS_RJT data returned in word 4 */
-               rjt_data = (uint8_t *)&rsp->un.ulpWord[4];
-               els_reply = &job->reply->reply_data.ctels_reply;
-               els_reply->status = FC_CTELS_STATUS_REJECT;
-               els_reply->rjt_data.action = rjt_data[3];
-               els_reply->rjt_data.reason_code = rjt_data[2];
-               els_reply->rjt_data.reason_explanation = rjt_data[1];
-               els_reply->rjt_data.vendor_unique = rjt_data[0];
-       } else
-               rc = -EIO;
+       if (job) {
+               if (rsp->ulpStatus == IOSTAT_SUCCESS) {
+                       rsp_size = rsp->un.elsreq64.bdl.bdeSize;
+                       job->reply->reply_payload_rcv_len =
+                               sg_copy_from_buffer(job->reply_payload.sg_list,
+                                                   job->reply_payload.sg_cnt,
+                                                   prsp->virt,
+                                                   rsp_size);
+               } else if (rsp->ulpStatus == IOSTAT_LS_RJT) {
+                       job->reply->reply_payload_rcv_len =
+                               sizeof(struct fc_bsg_ctels_reply);
+                       /* LS_RJT data returned in word 4 */
+                       rjt_data = (uint8_t *)&rsp->un.ulpWord[4];
+                       els_reply = &job->reply->reply_data.ctels_reply;
+                       els_reply->status = FC_CTELS_STATUS_REJECT;
+                       els_reply->rjt_data.action = rjt_data[3];
+                       els_reply->rjt_data.reason_code = rjt_data[2];
+                       els_reply->rjt_data.reason_explanation = rjt_data[1];
+                       els_reply->rjt_data.vendor_unique = rjt_data[0];
+               } else {
+                       rc = -EIO;
+               }
+       }
  
-       pbuflist = (struct lpfc_dmabuf *) cmdiocbq->context3;
-       lpfc_mbuf_free(phba, pbuflist->virt, pbuflist->phys);
-       lpfc_sli_release_iocbq(phba, rspiocbq);
-       lpfc_sli_release_iocbq(phba, cmdiocbq);
        lpfc_nlp_put(ndlp);
+       lpfc_els_free_iocb(phba, cmdiocbq);
        kfree(dd_data);
-       /* make error code available to userspace */
-       job->reply->result = rc;
-       job->dd_data = NULL;
-       /* complete the job back to userspace */
-       job->job_done(job);
-       spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
+       /* Complete the job if the job is still active */
+       if (job) {
+               job->reply->result = rc;
+               job->job_done(job);
+       }
        return;
  }
  
@@@ -496,19 -624,8 +624,8 @@@ lpfc_bsg_rport_els(struct fc_bsg_job *j
        uint32_t elscmd;
        uint32_t cmdsize;
        uint32_t rspsize;
-       struct lpfc_iocbq *rspiocbq;
        struct lpfc_iocbq *cmdiocbq;
-       IOCB_t *rsp;
        uint16_t rpi = 0;
-       struct lpfc_dmabuf *pcmd;
-       struct lpfc_dmabuf *prsp;
-       struct lpfc_dmabuf *pbuflist = NULL;
-       struct ulp_bde64 *bpl;
-       int request_nseg;
-       int reply_nseg;
-       struct scatterlist *sgel = NULL;
-       int numbde;
-       dma_addr_t busaddr;
        struct bsg_job_data *dd_data;
        uint32_t creg_val;
        int rc = 0;
        /* in case no data is transferred */
        job->reply->reply_payload_rcv_len = 0;
  
+       /* verify the els command is not greater than the
+        * maximum ELS transfer size.
+        */
+       if (job->request_payload.payload_len > FCELSSIZE) {
+               rc = -EINVAL;
+               goto no_dd_data;
+       }
        /* allocate our bsg tracking structure */
        dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
        if (!dd_data) {
                goto no_dd_data;
        }
  
-       if (!lpfc_nlp_get(ndlp)) {
-               rc = -ENODEV;
-               goto free_dd_data;
-       }
        elscmd = job->request->rqst_data.r_els.els_code;
        cmdsize = job->request_payload.payload_len;
        rspsize = job->reply_payload.payload_len;
-       rspiocbq = lpfc_sli_get_iocbq(phba);
-       if (!rspiocbq) {
-               lpfc_nlp_put(ndlp);
-               rc = -ENOMEM;
+       if (!lpfc_nlp_get(ndlp)) {
+               rc = -ENODEV;
                goto free_dd_data;
        }
  
-       rsp = &rspiocbq->iocb;
-       rpi = ndlp->nlp_rpi;
+       /* We will use the allocated dma buffers by prep els iocb for command
+        * and response to ensure if the job times out and the request is freed,
+        * we won't be dma into memory that is no longer allocated to for the
+        * request.
+        */
  
        cmdiocbq = lpfc_prep_els_iocb(vport, 1, cmdsize, 0, ndlp,
                                      ndlp->nlp_DID, elscmd);
        if (!cmdiocbq) {
                rc = -EIO;
-               goto free_rspiocbq;
+               goto release_ndlp;
        }
  
-       /* prep els iocb set context1 to the ndlp, context2 to the command
-        * dmabuf, context3 holds the data dmabuf
-        */
-       pcmd = (struct lpfc_dmabuf *) cmdiocbq->context2;
-       prsp = (struct lpfc_dmabuf *) pcmd->list.next;
-       lpfc_mbuf_free(phba, pcmd->virt, pcmd->phys);
-       kfree(pcmd);
-       lpfc_mbuf_free(phba, prsp->virt, prsp->phys);
-       kfree(prsp);
-       cmdiocbq->context2 = NULL;
-       pbuflist = (struct lpfc_dmabuf *) cmdiocbq->context3;
-       bpl = (struct ulp_bde64 *) pbuflist->virt;
-       request_nseg = pci_map_sg(phba->pcidev, job->request_payload.sg_list,
-                                 job->request_payload.sg_cnt, DMA_TO_DEVICE);
-       for_each_sg(job->request_payload.sg_list, sgel, request_nseg, numbde) {
-               busaddr = sg_dma_address(sgel);
-               bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
-               bpl->tus.f.bdeSize = sg_dma_len(sgel);
-               bpl->tus.w = cpu_to_le32(bpl->tus.w);
-               bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
-               bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
-               bpl++;
-       }
+       rpi = ndlp->nlp_rpi;
+       /* Transfer the request payload to allocated command dma buffer */
+       sg_copy_to_buffer(job->request_payload.sg_list,
+                         job->request_payload.sg_cnt,
+                         ((struct lpfc_dmabuf *)cmdiocbq->context2)->virt,
+                         cmdsize);
  
-       reply_nseg = pci_map_sg(phba->pcidev, job->reply_payload.sg_list,
-                               job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
-       for_each_sg(job->reply_payload.sg_list, sgel, reply_nseg, numbde) {
-               busaddr = sg_dma_address(sgel);
-               bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
-               bpl->tus.f.bdeSize = sg_dma_len(sgel);
-               bpl->tus.w = cpu_to_le32(bpl->tus.w);
-               bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
-               bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
-               bpl++;
-       }
-       cmdiocbq->iocb.un.elsreq64.bdl.bdeSize =
-               (request_nseg + reply_nseg) * sizeof(struct ulp_bde64);
        if (phba->sli_rev == LPFC_SLI_REV4)
                cmdiocbq->iocb.ulpContext = phba->sli4_hba.rpi_ids[rpi];
        else
                cmdiocbq->iocb.ulpContext = rpi;
        cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
-       cmdiocbq->context1 = NULL;
-       cmdiocbq->context2 = NULL;
-       cmdiocbq->iocb_cmpl = lpfc_bsg_rport_els_cmp;
        cmdiocbq->context1 = dd_data;
        cmdiocbq->context_un.ndlp = ndlp;
-       cmdiocbq->context2 = rspiocbq;
+       cmdiocbq->iocb_cmpl = lpfc_bsg_rport_els_cmp;
        dd_data->type = TYPE_IOCB;
+       dd_data->set_job = job;
        dd_data->context_un.iocb.cmdiocbq = cmdiocbq;
-       dd_data->context_un.iocb.rspiocbq = rspiocbq;
-       dd_data->context_un.iocb.set_job = job;
-       dd_data->context_un.iocb.bmp = NULL;
        dd_data->context_un.iocb.ndlp = ndlp;
+       dd_data->context_un.iocb.rmp = NULL;
+       job->dd_data = dd_data;
  
        if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
                if (lpfc_readl(phba->HCregaddr, &creg_val)) {
                writel(creg_val, phba->HCregaddr);
                readl(phba->HCregaddr); /* flush */
        }
        rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0);
-       lpfc_nlp_put(ndlp);
        if (rc == IOCB_SUCCESS)
                return 0; /* done for now */
        else if (rc == IOCB_BUSY)
                rc = -EIO;
  
  linkdown_err:
-       pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
-                    job->request_payload.sg_cnt, DMA_TO_DEVICE);
-       pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
-                    job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
  
-       lpfc_mbuf_free(phba, pbuflist->virt, pbuflist->phys);
-       lpfc_sli_release_iocbq(phba, cmdiocbq);
+       cmdiocbq->context1 = ndlp;
+       lpfc_els_free_iocb(phba, cmdiocbq);
  
free_rspiocbq:
-       lpfc_sli_release_iocbq(phba, rspiocbq);
release_ndlp:
+       lpfc_nlp_put(ndlp);
  
  free_dd_data:
        kfree(dd_data);
@@@ -680,6 -765,7 +765,7 @@@ lpfc_bsg_event_free(struct kref *kref
                kfree(ed);
        }
  
+       kfree(evt->dd_data);
        kfree(evt);
  }
  
@@@ -723,6 -809,7 +809,7 @@@ lpfc_bsg_event_new(uint32_t ev_mask, in
        evt->req_id = ev_req_id;
        evt->reg_id = ev_reg_id;
        evt->wait_time_stamp = jiffies;
+       evt->dd_data = NULL;
        init_waitqueue_head(&evt->wq);
        kref_init(&evt->kref);
        return evt;
@@@ -790,6 -877,7 +877,7 @@@ lpfc_bsg_ct_unsol_event(struct lpfc_hb
        struct lpfc_hbq_entry *hbqe;
        struct lpfc_sli_ct_request *ct_req;
        struct fc_bsg_job *job = NULL;
+       struct bsg_job_data *dd_data = NULL;
        unsigned long flags;
        int size = 0;
  
                }
  
                list_move(evt->events_to_see.prev, &evt->events_to_get);
-               lpfc_bsg_event_unref(evt);
  
-               job = evt->set_job;
-               evt->set_job = NULL;
+               dd_data = (struct bsg_job_data *)evt->dd_data;
+               job = dd_data->set_job;
+               dd_data->set_job = NULL;
+               lpfc_bsg_event_unref(evt);
                if (job) {
                        job->reply->reply_payload_rcv_len = size;
                        /* make error code available to userspace */
@@@ -1078,14 -1167,6 +1167,6 @@@ lpfc_bsg_hba_set_event(struct fc_bsg_jo
                goto job_error;
        }
  
-       dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
-       if (dd_data == NULL) {
-               lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
-                               "2734 Failed allocation of dd_data\n");
-               rc = -ENOMEM;
-               goto job_error;
-       }
        event_req = (struct set_ct_event *)
                job->request->rqst_data.h_vendor.vendor_cmd;
        ev_mask = ((uint32_t)(unsigned long)event_req->type_mask &
                if (evt->reg_id == event_req->ev_reg_id) {
                        lpfc_bsg_event_ref(evt);
                        evt->wait_time_stamp = jiffies;
+                       dd_data = (struct bsg_job_data *)evt->dd_data;
                        break;
                }
        }
  
        if (&evt->node == &phba->ct_ev_waiters) {
                /* no event waiting struct yet - first call */
+               dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
+               if (dd_data == NULL) {
+                       lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
+                                       "2734 Failed allocation of dd_data\n");
+                       rc = -ENOMEM;
+                       goto job_error;
+               }
                evt = lpfc_bsg_event_new(ev_mask, event_req->ev_reg_id,
                                        event_req->ev_req_id);
                if (!evt) {
                        rc = -ENOMEM;
                        goto job_error;
                }
+               dd_data->type = TYPE_EVT;
+               dd_data->set_job = NULL;
+               dd_data->context_un.evt = evt;
+               evt->dd_data = (void *)dd_data;
                spin_lock_irqsave(&phba->ct_ev_lock, flags);
                list_add(&evt->node, &phba->ct_ev_waiters);
                lpfc_bsg_event_ref(evt);
  
        spin_lock_irqsave(&phba->ct_ev_lock, flags);
        evt->waiting = 1;
-       dd_data->type = TYPE_EVT;
-       dd_data->context_un.evt = evt;
-       evt->set_job = job; /* for unsolicited command */
+       dd_data->set_job = job; /* for unsolicited command */
        job->dd_data = dd_data; /* for fc transport timeout callback*/
        spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
        return 0; /* call job done later */
@@@ -1252,57 -1342,64 +1342,64 @@@ lpfc_issue_ct_rsp_cmp(struct lpfc_hba *
        struct bsg_job_data *dd_data;
        struct fc_bsg_job *job;
        IOCB_t *rsp;
-       struct lpfc_dmabuf *bmp;
+       struct lpfc_dmabuf *bmp, *cmp;
        struct lpfc_nodelist *ndlp;
        unsigned long flags;
        int rc = 0;
  
+       dd_data = cmdiocbq->context1;
+       /* Determine if job has been aborted */
        spin_lock_irqsave(&phba->ct_ev_lock, flags);
-       dd_data = cmdiocbq->context2;
-       /* normal completion and timeout crossed paths, already done */
-       if (!dd_data) {
-               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
-               return;
+       job = dd_data->set_job;
+       if (job) {
+               /* Prevent timeout handling from trying to abort job  */
+               job->dd_data = NULL;
        }
+       spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
  
-       job = dd_data->context_un.iocb.set_job;
-       bmp = dd_data->context_un.iocb.bmp;
-       rsp = &rspiocbq->iocb;
        ndlp = dd_data->context_un.iocb.ndlp;
+       cmp = cmdiocbq->context2;
+       bmp = cmdiocbq->context3;
+       rsp = &rspiocbq->iocb;
  
-       pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
-                    job->request_payload.sg_cnt, DMA_TO_DEVICE);
+       /* Copy the completed job data or set the error status */
  
-       if (rsp->ulpStatus) {
-               if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
-                       switch (rsp->un.ulpWord[4] & IOERR_PARAM_MASK) {
-                       case IOERR_SEQUENCE_TIMEOUT:
-                               rc = -ETIMEDOUT;
-                               break;
-                       case IOERR_INVALID_RPI:
-                               rc = -EFAULT;
-                               break;
-                       default:
+       if (job) {
+               if (rsp->ulpStatus) {
+                       if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
+                               switch (rsp->un.ulpWord[4] & IOERR_PARAM_MASK) {
+                               case IOERR_SEQUENCE_TIMEOUT:
+                                       rc = -ETIMEDOUT;
+                                       break;
+                               case IOERR_INVALID_RPI:
+                                       rc = -EFAULT;
+                                       break;
+                               default:
+                                       rc = -EACCES;
+                                       break;
+                               }
+                       } else {
                                rc = -EACCES;
-                               break;
                        }
-               } else
-                       rc = -EACCES;
-       } else
-               job->reply->reply_payload_rcv_len =
-                       rsp->un.genreq64.bdl.bdeSize;
+               } else {
+                       job->reply->reply_payload_rcv_len = 0;
+               }
+       }
  
+       lpfc_free_bsg_buffers(phba, cmp);
        lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
+       kfree(bmp);
        lpfc_sli_release_iocbq(phba, cmdiocbq);
        lpfc_nlp_put(ndlp);
-       kfree(bmp);
        kfree(dd_data);
-       /* make error code available to userspace */
-       job->reply->result = rc;
-       job->dd_data = NULL;
-       /* complete the job back to userspace */
-       job->job_done(job);
-       spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
+       /* Complete the job if the job is still active */
+       if (job) {
+               job->reply->result = rc;
+               job->job_done(job);
+       }
        return;
  }
  
   **/
  static int
  lpfc_issue_ct_rsp(struct lpfc_hba *phba, struct fc_bsg_job *job, uint32_t tag,
-                 struct lpfc_dmabuf *bmp, int num_entry)
+                 struct lpfc_dmabuf *cmp, struct lpfc_dmabuf *bmp,
+                 int num_entry)
  {
        IOCB_t *icmd;
        struct lpfc_iocbq *ctiocb = NULL;
  
                /* Check if the ndlp is active */
                if (!ndlp || !NLP_CHK_NODE_ACT(ndlp)) {
-                       rc = -IOCB_ERROR;
+                       rc = IOCB_ERROR;
                        goto issue_ct_rsp_exit;
                }
  
                 * we respond
                 */
                if (!lpfc_nlp_get(ndlp)) {
-                       rc = -IOCB_ERROR;
+                       rc = IOCB_ERROR;
                        goto issue_ct_rsp_exit;
                }
  
        ctiocb->iocb_cmpl = NULL;
        ctiocb->iocb_flag |= LPFC_IO_LIBDFC;
        ctiocb->vport = phba->pport;
+       ctiocb->context1 = dd_data;
+       ctiocb->context2 = cmp;
        ctiocb->context3 = bmp;
        ctiocb->iocb_cmpl = lpfc_issue_ct_rsp_cmp;
-       ctiocb->context2 = dd_data;
-       ctiocb->context1 = ndlp;
        dd_data->type = TYPE_IOCB;
+       dd_data->set_job = job;
        dd_data->context_un.iocb.cmdiocbq = ctiocb;
-       dd_data->context_un.iocb.rspiocbq = NULL;
-       dd_data->context_un.iocb.set_job = job;
-       dd_data->context_un.iocb.bmp = bmp;
        dd_data->context_un.iocb.ndlp = ndlp;
+       dd_data->context_un.iocb.rmp = NULL;
+       job->dd_data = dd_data;
  
        if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
                if (lpfc_readl(phba->HCregaddr, &creg_val)) {
@@@ -1454,11 -1552,8 +1552,8 @@@ lpfc_bsg_send_mgmt_rsp(struct fc_bsg_jo
        struct send_mgmt_resp *mgmt_resp = (struct send_mgmt_resp *)
                job->request->rqst_data.h_vendor.vendor_cmd;
        struct ulp_bde64 *bpl;
-       struct lpfc_dmabuf *bmp = NULL;
-       struct scatterlist *sgel = NULL;
-       int request_nseg;
-       int numbde;
-       dma_addr_t busaddr;
+       struct lpfc_dmabuf *bmp = NULL, *cmp = NULL;
+       int bpl_entries;
        uint32_t tag = mgmt_resp->tag;
        unsigned long reqbfrcnt =
                        (unsigned long)job->request_payload.payload_len;
  
        INIT_LIST_HEAD(&bmp->list);
        bpl = (struct ulp_bde64 *) bmp->virt;
-       request_nseg = pci_map_sg(phba->pcidev, job->request_payload.sg_list,
-                                 job->request_payload.sg_cnt, DMA_TO_DEVICE);
-       for_each_sg(job->request_payload.sg_list, sgel, request_nseg, numbde) {
-               busaddr = sg_dma_address(sgel);
-               bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
-               bpl->tus.f.bdeSize = sg_dma_len(sgel);
-               bpl->tus.w = cpu_to_le32(bpl->tus.w);
-               bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
-               bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
-               bpl++;
+       bpl_entries = (LPFC_BPL_SIZE/sizeof(struct ulp_bde64));
+       cmp = lpfc_alloc_bsg_buffers(phba, job->request_payload.payload_len,
+                                    1, bpl, &bpl_entries);
+       if (!cmp) {
+               rc = -ENOMEM;
+               goto send_mgmt_rsp_free_bmp;
        }
+       lpfc_bsg_copy_data(cmp, &job->request_payload,
+                          job->request_payload.payload_len, 1);
  
-       rc = lpfc_issue_ct_rsp(phba, job, tag, bmp, request_nseg);
+       rc = lpfc_issue_ct_rsp(phba, job, tag, cmp, bmp, bpl_entries);
  
        if (rc == IOCB_SUCCESS)
                return 0; /* done for now */
  
-       /* TBD need to handle a timeout */
-       pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
-                         job->request_payload.sg_cnt, DMA_TO_DEVICE);
        rc = -EACCES;
-       lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
+       lpfc_free_bsg_buffers(phba, cmp);
  
  send_mgmt_rsp_free_bmp:
+       if (bmp->virt)
+               lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
        kfree(bmp);
  send_mgmt_rsp_exit:
        /* make error code available to userspace */
@@@ -1559,7 -1652,7 +1652,7 @@@ lpfc_bsg_diag_mode_enter(struct lpfc_hb
                scsi_block_requests(shost);
        }
  
-       while (pring->txcmplq_cnt) {
+       while (!list_empty(&pring->txcmplq)) {
                if (i++ > 500)  /* wait up to 5 seconds */
                        break;
                msleep(10);
@@@ -3193,13 -3286,7 +3286,7 @@@ lpfc_bsg_issue_mbox_cmpl(struct lpfc_hb
        unsigned long flags;
        uint8_t *pmb, *pmb_buf;
  
-       spin_lock_irqsave(&phba->ct_ev_lock, flags);
        dd_data = pmboxq->context1;
-       /* job already timed out? */
-       if (!dd_data) {
-               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
-               return;
-       }
  
        /*
         * The outgoing buffer is readily referred from the dma buffer,
        pmb_buf = (uint8_t *)dd_data->context_un.mbox.mb;
        memcpy(pmb_buf, pmb, sizeof(MAILBOX_t));
  
-       job = dd_data->context_un.mbox.set_job;
+       /* Determine if job has been aborted */
+       spin_lock_irqsave(&phba->ct_ev_lock, flags);
+       job = dd_data->set_job;
+       if (job) {
+               /* Prevent timeout handling from trying to abort job  */
+               job->dd_data = NULL;
+       }
+       spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
+       /* Copy the mailbox data to the job if it is still active */
        if (job) {
                size = job->reply_payload.payload_len;
                job->reply->reply_payload_rcv_len =
                        sg_copy_from_buffer(job->reply_payload.sg_list,
                                            job->reply_payload.sg_cnt,
                                            pmb_buf, size);
-               /* need to hold the lock until we set job->dd_data to NULL
-                * to hold off the timeout handler returning to the mid-layer
-                * while we are still processing the job.
-                */
-               job->dd_data = NULL;
-               dd_data->context_un.mbox.set_job = NULL;
-               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
-       } else {
-               dd_data->context_un.mbox.set_job = NULL;
-               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
        }
  
+       dd_data->set_job = NULL;
        mempool_free(dd_data->context_un.mbox.pmboxq, phba->mbox_mem_pool);
        lpfc_bsg_dma_page_free(phba, dd_data->context_un.mbox.dmabuffers);
        kfree(dd_data);
  
+       /* Complete the job if the job is still active */
        if (job) {
                job->reply->result = 0;
                job->job_done(job);
@@@ -3377,19 -3468,22 +3468,22 @@@ lpfc_bsg_issue_mbox_ext_handle_job(stru
        struct lpfc_sli_config_mbox *sli_cfg_mbx;
        uint8_t *pmbx;
  
-       spin_lock_irqsave(&phba->ct_ev_lock, flags);
        dd_data = pmboxq->context1;
-       /* has the job already timed out? */
-       if (!dd_data) {
-               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
-               job = NULL;
-               goto job_done_out;
+       /* Determine if job has been aborted */
+       spin_lock_irqsave(&phba->ct_ev_lock, flags);
+       job = dd_data->set_job;
+       if (job) {
+               /* Prevent timeout handling from trying to abort job  */
+               job->dd_data = NULL;
        }
+       spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
  
        /*
         * The outgoing buffer is readily referred from the dma buffer,
         * just need to get header part from mailboxq structure.
         */
        pmb = (uint8_t *)&pmboxq->u.mb;
        pmb_buf = (uint8_t *)dd_data->context_un.mbox.mb;
        /* Copy the byte swapped response mailbox back to the user */
                        sli_cfg_mbx->un.sli_config_emb0_subsys.mse[0].buf_len);
        }
  
-       job = dd_data->context_un.mbox.set_job;
+       /* Complete the job if the job is still active */
        if (job) {
                size = job->reply_payload.payload_len;
                job->reply->reply_payload_rcv_len =
                        sg_copy_from_buffer(job->reply_payload.sg_list,
                                            job->reply_payload.sg_cnt,
                                            pmb_buf, size);
                /* result for successful */
                job->reply->result = 0;
-               job->dd_data = NULL;
-               /* need to hold the lock util we set job->dd_data to NULL
-                * to hold off the timeout handler from midlayer to take
-                * any action.
-                */
-               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
                lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
                                "2937 SLI_CONFIG ext-buffer maibox command "
                                "(x%x/x%x) complete bsg job done, bsize:%d\n",
                                        phba->mbox_ext_buf_ctx.mboxType,
                                        dma_ebuf, sta_pos_addr,
                                        phba->mbox_ext_buf_ctx.mbx_dmabuf, 0);
-       } else
-               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
- job_done_out:
-       if (!job)
+       } else {
                lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
                                "2938 SLI_CONFIG ext-buffer maibox "
                                "command (x%x/x%x) failure, rc:x%x\n",
                                phba->mbox_ext_buf_ctx.nembType,
                                phba->mbox_ext_buf_ctx.mboxType, rc);
+       }
        /* state change */
        phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_DONE;
        kfree(dd_data);
        return job;
  }
  
@@@ -3461,8 -3550,10 +3550,10 @@@ lpfc_bsg_issue_read_mbox_ext_cmpl(struc
  {
        struct fc_bsg_job *job;
  
+       job = lpfc_bsg_issue_mbox_ext_handle_job(phba, pmboxq);
        /* handle the BSG job with mailbox command */
-       if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_ABTS)
+       if (!job)
                pmboxq->u.mb.mbxStatus = MBXERR_ERROR;
  
        lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
                        "complete, ctxState:x%x, mbxStatus:x%x\n",
                        phba->mbox_ext_buf_ctx.state, pmboxq->u.mb.mbxStatus);
  
-       job = lpfc_bsg_issue_mbox_ext_handle_job(phba, pmboxq);
        if (pmboxq->u.mb.mbxStatus || phba->mbox_ext_buf_ctx.numBuf == 1)
                lpfc_bsg_mbox_ext_session_reset(phba);
  
        /* free base driver mailbox structure memory */
        mempool_free(pmboxq, phba->mbox_mem_pool);
  
-       /* complete the bsg job if we have it */
+       /* if the job is still active, call job done */
        if (job)
                job->job_done(job);
  
@@@ -3498,8 -3587,10 +3587,10 @@@ lpfc_bsg_issue_write_mbox_ext_cmpl(stru
  {
        struct fc_bsg_job *job;
  
+       job = lpfc_bsg_issue_mbox_ext_handle_job(phba, pmboxq);
        /* handle the BSG job with the mailbox command */
-       if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_ABTS)
+       if (!job)
                pmboxq->u.mb.mbxStatus = MBXERR_ERROR;
  
        lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
                        "complete, ctxState:x%x, mbxStatus:x%x\n",
                        phba->mbox_ext_buf_ctx.state, pmboxq->u.mb.mbxStatus);
  
-       job = lpfc_bsg_issue_mbox_ext_handle_job(phba, pmboxq);
        /* free all memory, including dma buffers */
        mempool_free(pmboxq, phba->mbox_mem_pool);
        lpfc_bsg_mbox_ext_session_reset(phba);
  
-       /* complete the bsg job if we have it */
+       /* if the job is still active, call job done */
        if (job)
                job->job_done(job);
  
@@@ -3759,9 -3848,9 +3848,9 @@@ lpfc_bsg_sli_cfg_read_cmd_ext(struct lp
        /* context fields to callback function */
        pmboxq->context1 = dd_data;
        dd_data->type = TYPE_MBOX;
+       dd_data->set_job = job;
        dd_data->context_un.mbox.pmboxq = pmboxq;
        dd_data->context_un.mbox.mb = (MAILBOX_t *)pmbx;
-       dd_data->context_un.mbox.set_job = job;
        job->dd_data = dd_data;
  
        /* state change */
@@@ -3928,14 -4017,14 +4017,14 @@@ lpfc_bsg_sli_cfg_write_cmd_ext(struct l
                /* context fields to callback function */
                pmboxq->context1 = dd_data;
                dd_data->type = TYPE_MBOX;
+               dd_data->set_job = job;
                dd_data->context_un.mbox.pmboxq = pmboxq;
                dd_data->context_un.mbox.mb = (MAILBOX_t *)mbx;
-               dd_data->context_un.mbox.set_job = job;
                job->dd_data = dd_data;
  
                /* state change */
-               phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_PORT;
  
+               phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_PORT;
                rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
                if ((rc == MBX_SUCCESS) || (rc == MBX_BUSY)) {
                        lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
        }
  
        /* wait for additoinal external buffers */
        job->reply->result = 0;
        job->job_done(job);
        return SLI_CONFIG_HANDLED;
@@@ -4268,9 -4358,9 +4358,9 @@@ lpfc_bsg_write_ebuf_set(struct lpfc_hb
                /* context fields to callback function */
                pmboxq->context1 = dd_data;
                dd_data->type = TYPE_MBOX;
+               dd_data->set_job = job;
                dd_data->context_un.mbox.pmboxq = pmboxq;
                dd_data->context_un.mbox.mb = (MAILBOX_t *)pbuf;
-               dd_data->context_un.mbox.set_job = job;
                job->dd_data = dd_data;
  
                /* state change */
@@@ -4455,7 -4545,6 +4545,6 @@@ lpfc_bsg_issue_mbox(struct lpfc_hba *ph
        uint8_t *from;
        uint32_t size;
  
        /* in case no data is transferred */
        job->reply->reply_payload_rcv_len = 0;
  
        /* setup context field to pass wait_queue pointer to wake function */
        pmboxq->context1 = dd_data;
        dd_data->type = TYPE_MBOX;
+       dd_data->set_job = job;
        dd_data->context_un.mbox.pmboxq = pmboxq;
        dd_data->context_un.mbox.mb = (MAILBOX_t *)pmbx;
-       dd_data->context_un.mbox.set_job = job;
        dd_data->context_un.mbox.ext = ext;
        dd_data->context_un.mbox.mbOffset = mbox_req->mbOffset;
        dd_data->context_un.mbox.inExtWLen = mbox_req->inExtWLen;
@@@ -4741,7 -4830,7 +4830,7 @@@ lpfc_bsg_mbox_cmd(struct fc_bsg_job *jo
        if (job->request_len <
            sizeof(struct fc_bsg_request) + sizeof(struct dfc_mbox_req)) {
                lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
 -                              "2737 Mix-and-match backward compability "
 +                              "2737 Mix-and-match backward compatibility "
                                "between MBOX_REQ old size:%d and "
                                "new request size:%d\n",
                                (int)(job->request_len -
@@@ -4797,75 -4886,79 +4886,79 @@@ lpfc_bsg_menlo_cmd_cmp(struct lpfc_hba 
        struct bsg_job_data *dd_data;
        struct fc_bsg_job *job;
        IOCB_t *rsp;
-       struct lpfc_dmabuf *bmp;
+       struct lpfc_dmabuf *bmp, *cmp, *rmp;
        struct lpfc_bsg_menlo *menlo;
        unsigned long flags;
        struct menlo_response *menlo_resp;
+       unsigned int rsp_size;
        int rc = 0;
  
-       spin_lock_irqsave(&phba->ct_ev_lock, flags);
        dd_data = cmdiocbq->context1;
-       if (!dd_data) {
-               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
-               return;
-       }
+       cmp = cmdiocbq->context2;
+       bmp = cmdiocbq->context3;
        menlo = &dd_data->context_un.menlo;
-       job = menlo->set_job;
-       job->dd_data = NULL; /* so timeout handler does not reply */
-       spin_lock(&phba->hbalock);
-       cmdiocbq->iocb_flag |= LPFC_IO_WAKE;
-       if (cmdiocbq->context2 && rspiocbq)
-               memcpy(&((struct lpfc_iocbq *)cmdiocbq->context2)->iocb,
-                      &rspiocbq->iocb, sizeof(IOCB_t));
-       spin_unlock(&phba->hbalock);
-       bmp = menlo->bmp;
-       rspiocbq = menlo->rspiocbq;
+       rmp = menlo->rmp;
        rsp = &rspiocbq->iocb;
  
-       pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
-                    job->request_payload.sg_cnt, DMA_TO_DEVICE);
-       pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
-                    job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
+       /* Determine if job has been aborted */
+       spin_lock_irqsave(&phba->ct_ev_lock, flags);
+       job = dd_data->set_job;
+       if (job) {
+               /* Prevent timeout handling from trying to abort job  */
+               job->dd_data = NULL;
+       }
+       spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
+       /* Copy the job data or set the failing status for the job */
  
-       /* always return the xri, this would be used in the case
-        * of a menlo download to allow the data to be sent as a continuation
-        * of the exchange.
-        */
-       menlo_resp = (struct menlo_response *)
-               job->reply->reply_data.vendor_reply.vendor_rsp;
-       menlo_resp->xri = rsp->ulpContext;
-       if (rsp->ulpStatus) {
-               if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
-                       switch (rsp->un.ulpWord[4] & IOERR_PARAM_MASK) {
-                       case IOERR_SEQUENCE_TIMEOUT:
-                               rc = -ETIMEDOUT;
-                               break;
-                       case IOERR_INVALID_RPI:
-                               rc = -EFAULT;
-                               break;
-                       default:
+       if (job) {
+               /* always return the xri, this would be used in the case
+                * of a menlo download to allow the data to be sent as a
+                * continuation of the exchange.
+                */
+               menlo_resp = (struct menlo_response *)
+                       job->reply->reply_data.vendor_reply.vendor_rsp;
+               menlo_resp->xri = rsp->ulpContext;
+               if (rsp->ulpStatus) {
+                       if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
+                               switch (rsp->un.ulpWord[4] & IOERR_PARAM_MASK) {
+                               case IOERR_SEQUENCE_TIMEOUT:
+                                       rc = -ETIMEDOUT;
+                                       break;
+                               case IOERR_INVALID_RPI:
+                                       rc = -EFAULT;
+                                       break;
+                               default:
+                                       rc = -EACCES;
+                                       break;
+                               }
+                       } else {
                                rc = -EACCES;
-                               break;
                        }
-               } else
-                       rc = -EACCES;
-       } else
-               job->reply->reply_payload_rcv_len =
-                       rsp->un.genreq64.bdl.bdeSize;
+               } else {
+                       rsp_size = rsp->un.genreq64.bdl.bdeSize;
+                       job->reply->reply_payload_rcv_len =
+                               lpfc_bsg_copy_data(rmp, &job->reply_payload,
+                                                  rsp_size, 0);
+               }
+       }
  
-       lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
-       lpfc_sli_release_iocbq(phba, rspiocbq);
        lpfc_sli_release_iocbq(phba, cmdiocbq);
+       lpfc_free_bsg_buffers(phba, cmp);
+       lpfc_free_bsg_buffers(phba, rmp);
+       lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
        kfree(bmp);
        kfree(dd_data);
-       /* make error code available to userspace */
-       job->reply->result = rc;
-       /* complete the job back to userspace */
-       job->job_done(job);
-       spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
+       /* Complete the job if active */
+       if (job) {
+               job->reply->result = rc;
+               job->job_done(job);
+       }
        return;
  }
  
@@@ -4883,17 -4976,14 +4976,14 @@@ lpfc_menlo_cmd(struct fc_bsg_job *job
  {
        struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
        struct lpfc_hba *phba = vport->phba;
-       struct lpfc_iocbq *cmdiocbq, *rspiocbq;
-       IOCB_t *cmd, *rsp;
+       struct lpfc_iocbq *cmdiocbq;
+       IOCB_t *cmd;
        int rc = 0;
        struct menlo_command *menlo_cmd;
        struct menlo_response *menlo_resp;
-       struct lpfc_dmabuf *bmp = NULL;
+       struct lpfc_dmabuf *bmp = NULL, *cmp = NULL, *rmp = NULL;
        int request_nseg;
        int reply_nseg;
-       struct scatterlist *sgel = NULL;
-       int numbde;
-       dma_addr_t busaddr;
        struct bsg_job_data *dd_data;
        struct ulp_bde64 *bpl = NULL;
  
                goto free_dd;
        }
  
-       cmdiocbq = lpfc_sli_get_iocbq(phba);
-       if (!cmdiocbq) {
+       bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
+       if (!bmp->virt) {
                rc = -ENOMEM;
                goto free_bmp;
        }
  
-       rspiocbq = lpfc_sli_get_iocbq(phba);
-       if (!rspiocbq) {
-               rc = -ENOMEM;
-               goto free_cmdiocbq;
-       }
-       rsp = &rspiocbq->iocb;
+       INIT_LIST_HEAD(&bmp->list);
  
-       bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
-       if (!bmp->virt) {
+       bpl = (struct ulp_bde64 *)bmp->virt;
+       request_nseg = LPFC_BPL_SIZE/sizeof(struct ulp_bde64);
+       cmp = lpfc_alloc_bsg_buffers(phba, job->request_payload.payload_len,
+                                    1, bpl, &request_nseg);
+       if (!cmp) {
                rc = -ENOMEM;
-               goto free_rspiocbq;
+               goto free_bmp;
        }
+       lpfc_bsg_copy_data(cmp, &job->request_payload,
+                          job->request_payload.payload_len, 1);
  
-       INIT_LIST_HEAD(&bmp->list);
-       bpl = (struct ulp_bde64 *) bmp->virt;
-       request_nseg = pci_map_sg(phba->pcidev, job->request_payload.sg_list,
-                                 job->request_payload.sg_cnt, DMA_TO_DEVICE);
-       for_each_sg(job->request_payload.sg_list, sgel, request_nseg, numbde) {
-               busaddr = sg_dma_address(sgel);
-               bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
-               bpl->tus.f.bdeSize = sg_dma_len(sgel);
-               bpl->tus.w = cpu_to_le32(bpl->tus.w);
-               bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
-               bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
-               bpl++;
+       bpl += request_nseg;
+       reply_nseg = LPFC_BPL_SIZE/sizeof(struct ulp_bde64) - request_nseg;
+       rmp = lpfc_alloc_bsg_buffers(phba, job->reply_payload.payload_len, 0,
+                                    bpl, &reply_nseg);
+       if (!rmp) {
+               rc = -ENOMEM;
+               goto free_cmp;
        }
  
-       reply_nseg = pci_map_sg(phba->pcidev, job->reply_payload.sg_list,
-                               job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
-       for_each_sg(job->reply_payload.sg_list, sgel, reply_nseg, numbde) {
-               busaddr = sg_dma_address(sgel);
-               bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
-               bpl->tus.f.bdeSize = sg_dma_len(sgel);
-               bpl->tus.w = cpu_to_le32(bpl->tus.w);
-               bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
-               bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
-               bpl++;
+       cmdiocbq = lpfc_sli_get_iocbq(phba);
+       if (!cmdiocbq) {
+               rc = -ENOMEM;
+               goto free_rmp;
        }
  
        cmd = &cmdiocbq->iocb;
        cmdiocbq->vport = phba->pport;
        /* We want the firmware to timeout before we do */
        cmd->ulpTimeout = MENLO_TIMEOUT - 5;
-       cmdiocbq->context3 = bmp;
-       cmdiocbq->context2 = rspiocbq;
        cmdiocbq->iocb_cmpl = lpfc_bsg_menlo_cmd_cmp;
        cmdiocbq->context1 = dd_data;
-       cmdiocbq->context2 = rspiocbq;
+       cmdiocbq->context2 = cmp;
+       cmdiocbq->context3 = bmp;
        if (menlo_cmd->cmd == LPFC_BSG_VENDOR_MENLO_CMD) {
                cmd->ulpCommand = CMD_GEN_REQUEST64_CR;
                cmd->ulpPU = MENLO_PU; /* 3 */
        }
  
        dd_data->type = TYPE_MENLO;
+       dd_data->set_job = job;
        dd_data->context_un.menlo.cmdiocbq = cmdiocbq;
-       dd_data->context_un.menlo.rspiocbq = rspiocbq;
-       dd_data->context_un.menlo.set_job = job;
-       dd_data->context_un.menlo.bmp = bmp;
+       dd_data->context_un.menlo.rmp = rmp;
+       job->dd_data = dd_data;
  
        rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq,
                MENLO_TIMEOUT - 5);
        if (rc == IOCB_SUCCESS)
                return 0; /* done for now */
  
-       /* iocb failed so cleanup */
-       pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
-                    job->request_payload.sg_cnt, DMA_TO_DEVICE);
-       pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
-                    job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
-       lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
- free_rspiocbq:
-       lpfc_sli_release_iocbq(phba, rspiocbq);
- free_cmdiocbq:
        lpfc_sli_release_iocbq(phba, cmdiocbq);
+ free_rmp:
+       lpfc_free_bsg_buffers(phba, rmp);
+ free_cmp:
+       lpfc_free_bsg_buffers(phba, cmp);
  free_bmp:
+       if (bmp->virt)
+               lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
        kfree(bmp);
  free_dd:
        kfree(dd_data);
@@@ -5162,70 -5235,94 +5235,94 @@@ lpfc_bsg_timeout(struct fc_bsg_job *job
        struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
        struct lpfc_hba *phba = vport->phba;
        struct lpfc_iocbq *cmdiocb;
-       struct lpfc_bsg_event *evt;
-       struct lpfc_bsg_iocb *iocb;
-       struct lpfc_bsg_mbox *mbox;
-       struct lpfc_bsg_menlo *menlo;
        struct lpfc_sli_ring *pring = &phba->sli.ring[LPFC_ELS_RING];
        struct bsg_job_data *dd_data;
        unsigned long flags;
+       int rc = 0;
+       LIST_HEAD(completions);
+       struct lpfc_iocbq *check_iocb, *next_iocb;
+       /* if job's driver data is NULL, the command completed or is in the
+        * the process of completing.  In this case, return status to request
+        * so the timeout is retried.  This avoids double completion issues
+        * and the request will be pulled off the timer queue when the
+        * command's completion handler executes.  Otherwise, prevent the
+        * command's completion handler from executing the job done callback
+        * and continue processing to abort the outstanding the command.
+        */
  
        spin_lock_irqsave(&phba->ct_ev_lock, flags);
        dd_data = (struct bsg_job_data *)job->dd_data;
-       /* timeout and completion crossed paths if no dd_data */
-       if (!dd_data) {
+       if (dd_data) {
+               dd_data->set_job = NULL;
+               job->dd_data = NULL;
+       } else {
                spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
-               return 0;
+               return -EAGAIN;
        }
  
        switch (dd_data->type) {
        case TYPE_IOCB:
-               iocb = &dd_data->context_un.iocb;
-               cmdiocb = iocb->cmdiocbq;
-               /* hint to completion handler that the job timed out */
-               job->reply->result = -EAGAIN;
-               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
-               /* this will call our completion handler */
+               /* Check to see if IOCB was issued to the port or not. If not,
+                * remove it from the txq queue and call cancel iocbs.
+                * Otherwise, call abort iotag
+                */
+               cmdiocb = dd_data->context_un.iocb.cmdiocbq;
                spin_lock_irq(&phba->hbalock);
-               lpfc_sli_issue_abort_iotag(phba, pring, cmdiocb);
+               list_for_each_entry_safe(check_iocb, next_iocb, &pring->txq,
+                                        list) {
+                       if (check_iocb == cmdiocb) {
+                               list_move_tail(&check_iocb->list, &completions);
+                               break;
+                       }
+               }
+               if (list_empty(&completions))
+                       lpfc_sli_issue_abort_iotag(phba, pring, cmdiocb);
                spin_unlock_irq(&phba->hbalock);
+               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
+               if (!list_empty(&completions)) {
+                       lpfc_sli_cancel_iocbs(phba, &completions,
+                                             IOSTAT_LOCAL_REJECT,
+                                             IOERR_SLI_ABORTED);
+               }
                break;
        case TYPE_EVT:
-               evt = dd_data->context_un.evt;
-               /* this event has no job anymore */
-               evt->set_job = NULL;
-               job->dd_data = NULL;
-               job->reply->reply_payload_rcv_len = 0;
-               /* Return -EAGAIN which is our way of signallying the
-                * app to retry.
-                */
-               job->reply->result = -EAGAIN;
                spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
-               job->job_done(job);
                break;
        case TYPE_MBOX:
-               mbox = &dd_data->context_un.mbox;
-               /* this mbox has no job anymore */
-               mbox->set_job = NULL;
-               job->dd_data = NULL;
-               job->reply->reply_payload_rcv_len = 0;
-               job->reply->result = -EAGAIN;
-               /* the mbox completion handler can now be run */
-               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
-               job->job_done(job);
+               /* Update the ext buf ctx state if needed */
                if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_PORT)
                        phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_ABTS;
+               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
                break;
        case TYPE_MENLO:
-               menlo = &dd_data->context_un.menlo;
-               cmdiocb = menlo->cmdiocbq;
-               /* hint to completion handler that the job timed out */
-               job->reply->result = -EAGAIN;
-               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
-               /* this will call our completion handler */
+               /* Check to see if IOCB was issued to the port or not. If not,
+                * remove it from the txq queue and call cancel iocbs.
+                * Otherwise, call abort iotag.
+                */
+               cmdiocb = dd_data->context_un.menlo.cmdiocbq;
                spin_lock_irq(&phba->hbalock);
-               lpfc_sli_issue_abort_iotag(phba, pring, cmdiocb);
+               list_for_each_entry_safe(check_iocb, next_iocb, &pring->txq,
+                                        list) {
+                       if (check_iocb == cmdiocb) {
+                               list_move_tail(&check_iocb->list, &completions);
+                               break;
+                       }
+               }
+               if (list_empty(&completions))
+                       lpfc_sli_issue_abort_iotag(phba, pring, cmdiocb);
                spin_unlock_irq(&phba->hbalock);
+               spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
+               if (!list_empty(&completions)) {
+                       lpfc_sli_cancel_iocbs(phba, &completions,
+                                             IOSTAT_LOCAL_REJECT,
+                                             IOERR_SLI_ABORTED);
+               }
                break;
        default:
                spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
         * otherwise an error message will be displayed on the console
         * so always return success (zero)
         */
-       return 0;
+       return rc;
  }
index bfda18467ee6303893a7de77b2442b52afa70481,240492208aba9462e2d306c4ca45d089f6950a60..326e05a65a7314d7648a16f0097485bb5d439a0b
@@@ -691,12 -691,15 +691,15 @@@ lpfc_work_done(struct lpfc_hba *phba
                        /* Set the lpfc data pending flag */
                        set_bit(LPFC_DATA_READY, &phba->data_flags);
                } else {
-                       pring->flag &= ~LPFC_DEFERRED_RING_EVENT;
-                       lpfc_sli_handle_slow_ring_event(phba, pring,
-                                                       (status &
-                                                        HA_RXMASK));
+                       if (phba->link_state >= LPFC_LINK_UP) {
+                               pring->flag &= ~LPFC_DEFERRED_RING_EVENT;
+                               lpfc_sli_handle_slow_ring_event(phba, pring,
+                                                               (status &
+                                                               HA_RXMASK));
+                       }
                }
-               if ((phba->sli_rev == LPFC_SLI_REV4) && pring->txq_cnt)
+               if ((phba->sli_rev == LPFC_SLI_REV4) &
+                                (!list_empty(&pring->txq)))
                        lpfc_drain_txq(phba);
                /*
                 * Turn on Ring interrupts
@@@ -1732,7 -1735,7 +1735,7 @@@ lpfc_check_pending_fcoe_event(struct lp
   * use through a sequence of @fcf_cnt eligible FCF records with equal
   * probability. To perform integer manunipulation of random numbers with
   * size unit32_t, the lower 16 bits of the 32-bit random number returned
 - * from random32() are taken as the random random number generated.
 + * from prandom_u32() are taken as the random random number generated.
   *
   * Returns true when outcome is for the newly read FCF record should be
   * chosen; otherwise, return false when outcome is for keeping the previously
@@@ -1744,7 -1747,7 +1747,7 @@@ lpfc_sli4_new_fcf_random_select(struct 
        uint32_t rand_num;
  
        /* Get 16-bit uniform random number */
 -      rand_num = (0xFFFF & random32());
 +      rand_num = 0xFFFF & prandom_u32();
  
        /* Decision with probability 1/fcf_cnt */
        if ((fcf_cnt * rand_num) < 0xFFFF)
@@@ -1792,6 -1795,8 +1795,8 @@@ lpfc_sli4_fcf_rec_mbox_parse(struct lpf
        virt_addr = mboxq->sge_array->addr[0];
  
        shdr = (union lpfc_sli4_cfg_shdr *)virt_addr;
+       lpfc_sli_pcimem_bcopy(shdr, shdr,
+                             sizeof(union lpfc_sli4_cfg_shdr));
        shdr_status = bf_get(lpfc_mbox_hdr_status, &shdr->response);
        shdr_add_status = bf_get(lpfc_mbox_hdr_add_status, &shdr->response);
        if (shdr_status || shdr_add_status) {
@@@ -2380,7 -2385,7 +2385,7 @@@ lpfc_mbx_cmpl_fcf_scan_read_fcf_rec(str
                phba->fcf.eligible_fcf_cnt = 1;
                /* Seeding the random number generator for random selection */
                seed = (uint32_t)(0xFFFFFFFF & jiffies);
 -              srandom32(seed);
 +              prandom_seed(seed);
        }
        spin_unlock_irq(&phba->hbalock);
        goto read_next_fcf;
@@@ -2888,6 -2893,11 +2893,11 @@@ lpfc_mbx_cmpl_reg_vfi(struct lpfc_hba *
                lpfc_vport_set_state(vport, FC_VPORT_FAILED);
                goto out_free_mem;
        }
+       /* If the VFI is already registered, there is nothing else to do */
+       if (vport->fc_flag & FC_VFI_REGISTERED)
+               goto out_free_mem;
        /* The VPI is implicitly registered when the VFI is registered */
        spin_lock_irq(shost->host_lock);
        vport->vpi_state |= LPFC_VPI_REGISTERED;
@@@ -2980,6 -2990,7 +2990,7 @@@ lpfc_mbx_process_link_up(struct lpfc_hb
        struct lpfc_dmabuf *mp;
        int rc;
        struct fcf_record *fcf_record;
+       uint32_t fc_flags = 0;
  
        spin_lock_irq(&phba->hbalock);
        switch (bf_get(lpfc_mbx_read_top_link_spd, la)) {
                                "1309 Link Up Event npiv not supported in loop "
                                "topology\n");
                                /* Get Loop Map information */
-               if (bf_get(lpfc_mbx_read_top_il, la)) {
-                       spin_lock(shost->host_lock);
-                       vport->fc_flag |= FC_LBIT;
-                       spin_unlock(shost->host_lock);
-               }
+               if (bf_get(lpfc_mbx_read_top_il, la))
+                       fc_flags |= FC_LBIT;
  
                vport->fc_myDID = bf_get(lpfc_mbx_read_top_alpa_granted, la);
                i = la->lilpBde64.tus.f.bdeSize;
                                phba->sli3_options |= LPFC_SLI3_NPIV_ENABLED;
                }
                vport->fc_myDID = phba->fc_pref_DID;
-               spin_lock(shost->host_lock);
-               vport->fc_flag |= FC_LBIT;
-               spin_unlock(shost->host_lock);
+               fc_flags |= FC_LBIT;
        }
        spin_unlock_irq(&phba->hbalock);
  
+       if (fc_flags) {
+               spin_lock_irq(shost->host_lock);
+               vport->fc_flag |= fc_flags;
+               spin_unlock_irq(shost->host_lock);
+       }
        lpfc_linkup(phba);
        sparam_mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
        if (!sparam_mbox)
@@@ -3237,8 -3249,7 +3249,7 @@@ lpfc_mbx_cmpl_read_topology(struct lpfc
                vport->fc_flag &= ~FC_BYPASSED_MODE;
        spin_unlock_irq(shost->host_lock);
  
-       if ((phba->fc_eventTag  < la->eventTag) ||
-           (phba->fc_eventTag == la->eventTag)) {
+       if (phba->fc_eventTag <= la->eventTag) {
                phba->fc_stat.LinkMultiEvent++;
                if (bf_get(lpfc_mbx_read_top_att_type, la) == LPFC_ATT_LINK_UP)
                        if (phba->fc_eventTag != 0)
        }
  
        phba->fc_eventTag = la->eventTag;
-       spin_lock_irq(&phba->hbalock);
-       if (bf_get(lpfc_mbx_read_top_mm, la))
-               phba->sli.sli_flag |= LPFC_MENLO_MAINT;
-       else
-               phba->sli.sli_flag &= ~LPFC_MENLO_MAINT;
-       spin_unlock_irq(&phba->hbalock);
+       if (phba->sli_rev < LPFC_SLI_REV4) {
+               spin_lock_irq(&phba->hbalock);
+               if (bf_get(lpfc_mbx_read_top_mm, la))
+                       phba->sli.sli_flag |= LPFC_MENLO_MAINT;
+               else
+                       phba->sli.sli_flag &= ~LPFC_MENLO_MAINT;
+               spin_unlock_irq(&phba->hbalock);
+       }
  
        phba->link_events++;
        if ((bf_get(lpfc_mbx_read_top_att_type, la) == LPFC_ATT_LINK_UP) &&
-           (!bf_get(lpfc_mbx_read_top_mm, la))) {
+           !(phba->sli.sli_flag & LPFC_MENLO_MAINT)) {
                phba->fc_stat.LinkUp++;
                if (phba->link_flag & LS_LOOPBACK_MODE) {
                        lpfc_printf_log(phba, KERN_ERR, LOG_LINK_EVENT,
                                bf_get(lpfc_mbx_read_top_fa, la));
                lpfc_mbx_issue_link_down(phba);
        }
-       if ((bf_get(lpfc_mbx_read_top_mm, la)) &&
-           (bf_get(lpfc_mbx_read_top_att_type, la) == LPFC_ATT_LINK_UP)) {
+       if ((phba->sli.sli_flag & LPFC_MENLO_MAINT) &&
+           ((bf_get(lpfc_mbx_read_top_att_type, la) == LPFC_ATT_LINK_UP))) {
                if (phba->link_state != LPFC_LINK_DOWN) {
                        phba->fc_stat.LinkDown++;
                        lpfc_printf_log(phba, KERN_ERR, LOG_LINK_EVENT,
                }
        }
  
-       if (bf_get(lpfc_mbx_read_top_fa, la)) {
-               if (bf_get(lpfc_mbx_read_top_mm, la))
+       if ((phba->sli_rev < LPFC_SLI_REV4) &&
+           bf_get(lpfc_mbx_read_top_fa, la)) {
+               if (phba->sli.sli_flag & LPFC_MENLO_MAINT)
                        lpfc_issue_clear_la(phba, vport);
                lpfc_printf_log(phba, KERN_INFO, LOG_LINK_EVENT,
                                "1311 fa %d\n",
@@@ -4354,7 -4368,6 +4368,6 @@@ lpfc_no_rpi(struct lpfc_hba *phba, stru
                                           with an error */
                                        list_move_tail(&iocb->list,
                                                       &completions);
-                                       pring->txq_cnt--;
                                }
                        }
                        spin_unlock_irq(&phba->hbalock);
@@@ -5055,7 -5068,6 +5068,6 @@@ lpfc_free_tx(struct lpfc_hba *phba, str
                    (icmd->ulpCommand == CMD_XMIT_ELS_RSP64_CX)) {
  
                        list_move_tail(&iocb->list, &completions);
-                       pring->txq_cnt--;
                }
        }
  
index d43faf34c1e29221ddc02b3aedcb2c566a0ed5e8,568cebea05bc1720c78350b220cff00b98cba1a0..35dd17eb0f27907f67f4c50968a95452498b93be
@@@ -438,12 -438,11 +438,12 @@@ lpfc_sli4_rq_put(struct lpfc_queue *hq
        struct lpfc_rqe *temp_hrqe;
        struct lpfc_rqe *temp_drqe;
        struct lpfc_register doorbell;
 -      int put_index = hq->host_index;
 +      int put_index;
  
        /* sanity check on queue memory */
        if (unlikely(!hq) || unlikely(!dq))
                return -ENOMEM;
 +      put_index = hq->host_index;
        temp_hrqe = hq->qe[hq->host_index].rqe;
        temp_drqe = dq->qe[dq->host_index].rqe;
  
@@@ -873,14 -872,16 +873,16 @@@ lpfc_set_rrq_active(struct lpfc_hba *ph
                                xritag, rxid, ndlp->nlp_DID, send_rrq);
                return -EINVAL;
        }
-       rrq->send_rrq = send_rrq;
+       if (phba->cfg_enable_rrq == 1)
+               rrq->send_rrq = send_rrq;
+       else
+               rrq->send_rrq = 0;
        rrq->xritag = xritag;
        rrq->rrq_stop_time = jiffies + HZ * (phba->fc_ratov + 1);
        rrq->ndlp = ndlp;
        rrq->nlp_DID = ndlp->nlp_DID;
        rrq->vport = ndlp->vport;
        rrq->rxid = rxid;
-       rrq->send_rrq = send_rrq;
        spin_lock_irqsave(&phba->hbalock, iflags);
        empty = list_empty(&phba->active_rrq_list);
        list_add_tail(&rrq->list, &phba->active_rrq_list);
@@@ -1009,6 -1010,18 +1011,18 @@@ __lpfc_sli_release_iocbq_s4(struct lpfc
        else
                sglq = __lpfc_clear_active_sglq(phba, iocbq->sli4_lxritag);
  
+       /*
+       ** This should have been removed from the txcmplq before calling
+       ** iocbq_release. The normal completion
+       ** path should have already done the list_del_init.
+       */
+       if (unlikely(!list_empty(&iocbq->list))) {
+               if (iocbq->iocb_flag & LPFC_IO_ON_TXCMPLQ)
+                       iocbq->iocb_flag &= ~LPFC_IO_ON_TXCMPLQ;
+               list_del_init(&iocbq->list);
+       }
        if (sglq)  {
                if ((iocbq->iocb_flag & LPFC_EXCHANGE_BUSY) &&
                        (sglq->state != SGL_XRI_ABORTED)) {
                                &phba->sli4_hba.lpfc_sgl_list);
  
                        /* Check if TXQ queue needs to be serviced */
-                       if (pring->txq_cnt)
+                       if (!list_empty(&pring->txq))
                                lpfc_worker_wake_up(phba);
                }
        }
@@@ -1056,6 -1069,14 +1070,14 @@@ __lpfc_sli_release_iocbq_s3(struct lpfc
  {
        size_t start_clean = offsetof(struct lpfc_iocbq, iocb);
  
+       /*
+       ** This should have been removed from the txcmplq before calling
+       ** iocbq_release. The normal completion
+       ** path should have already done the list_del_init.
+       */
+       if (unlikely(!list_empty(&iocbq->list)))
+               list_del_init(&iocbq->list);
        /*
         * Clean all volatile data fields, preserve iotag and node struct.
         */
@@@ -1122,7 -1143,6 +1144,6 @@@ lpfc_sli_cancel_iocbs(struct lpfc_hba *
  
        while (!list_empty(iocblist)) {
                list_remove_head(iocblist, piocb, struct lpfc_iocbq, list);
                if (!piocb->iocb_cmpl)
                        lpfc_sli_release_iocbq(phba, piocb);
                else {
@@@ -1310,9 -1330,6 +1331,6 @@@ lpfc_sli_ringtxcmpl_put(struct lpfc_hb
  {
        list_add_tail(&piocb->list, &pring->txcmplq);
        piocb->iocb_flag |= LPFC_IO_ON_TXCMPLQ;
-       pring->txcmplq_cnt++;
-       if (pring->txcmplq_cnt > pring->txcmplq_max)
-               pring->txcmplq_max = pring->txcmplq_cnt;
  
        if ((unlikely(pring->ringno == LPFC_ELS_RING)) &&
           (piocb->iocb.ulpCommand != CMD_ABORT_XRI_CN) &&
@@@ -1344,8 -1361,6 +1362,6 @@@ lpfc_sli_ringtx_get(struct lpfc_hba *ph
        struct lpfc_iocbq *cmd_iocb;
  
        list_remove_head((&pring->txq), cmd_iocb, struct lpfc_iocbq, list);
-       if (cmd_iocb != NULL)
-               pring->txq_cnt--;
        return cmd_iocb;
  }
  
@@@ -1614,8 -1629,9 +1630,9 @@@ lpfc_sli_resume_iocb(struct lpfc_hba *p
         *  (c) link attention events can be processed (fcp ring only)
         *  (d) IOCB processing is not blocked by the outstanding mbox command.
         */
-       if (pring->txq_cnt &&
-           lpfc_is_link_up(phba) &&
+       if (lpfc_is_link_up(phba) &&
+           (!list_empty(&pring->txq)) &&
            (pring->ringno != phba->sli.fcp_ring ||
             phba->sli.sli_flag & LPFC_PROCESS_LA)) {
  
@@@ -2612,7 -2628,6 +2629,6 @@@ lpfc_sli_iocbq_lookup(struct lpfc_hba *
                cmd_iocb = phba->sli.iocbq_lookup[iotag];
                list_del_init(&cmd_iocb->list);
                if (cmd_iocb->iocb_flag & LPFC_IO_ON_TXCMPLQ) {
-                       pring->txcmplq_cnt--;
                        cmd_iocb->iocb_flag &= ~LPFC_IO_ON_TXCMPLQ;
                }
                return cmd_iocb;
@@@ -2650,7 -2665,6 +2666,6 @@@ lpfc_sli_iocbq_lookup_by_tag(struct lpf
                        /* remove from txcmpl queue list */
                        list_del_init(&cmd_iocb->list);
                        cmd_iocb->iocb_flag &= ~LPFC_IO_ON_TXCMPLQ;
-                       pring->txcmplq_cnt--;
                        return cmd_iocb;
                }
        }
@@@ -3499,7 -3513,6 +3514,6 @@@ lpfc_sli_abort_iocb_ring(struct lpfc_hb
         */
        spin_lock_irq(&phba->hbalock);
        list_splice_init(&pring->txq, &completions);
-       pring->txq_cnt = 0;
  
        /* Next issue ABTS for everything on the txcmplq */
        list_for_each_entry_safe(iocb, next_iocb, &pring->txcmplq, list)
@@@ -3536,11 -3549,9 +3550,9 @@@ lpfc_sli_flush_fcp_rings(struct lpfc_hb
        spin_lock_irq(&phba->hbalock);
        /* Retrieve everything on txq */
        list_splice_init(&pring->txq, &txq);
-       pring->txq_cnt = 0;
  
        /* Retrieve everything on the txcmplq */
        list_splice_init(&pring->txcmplq, &txcmplq);
-       pring->txcmplq_cnt = 0;
  
        /* Indicate the I/O queues are flushed */
        phba->hba_flag |= HBA_FCP_IOQ_FLUSH;
@@@ -5988,9 -5999,9 +6000,9 @@@ lpfc_sli4_repost_els_sgl_list(struct lp
        LIST_HEAD(post_sgl_list);
        LIST_HEAD(free_sgl_list);
  
-       spin_lock(&phba->hbalock);
+       spin_lock_irq(&phba->hbalock);
        list_splice_init(&phba->sli4_hba.lpfc_sgl_list, &allc_sgl_list);
-       spin_unlock(&phba->hbalock);
+       spin_unlock_irq(&phba->hbalock);
  
        list_for_each_entry_safe(sglq_entry, sglq_entry_next,
                                 &allc_sgl_list, list) {
  
        /* push els sgls posted to the availble list */
        if (!list_empty(&post_sgl_list)) {
-               spin_lock(&phba->hbalock);
+               spin_lock_irq(&phba->hbalock);
                list_splice_init(&post_sgl_list,
                                 &phba->sli4_hba.lpfc_sgl_list);
-               spin_unlock(&phba->hbalock);
+               spin_unlock_irq(&phba->hbalock);
        } else {
                lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                "3161 Failure to post els sgl to port.\n");
@@@ -7615,7 -7626,6 +7627,6 @@@ __lpfc_sli_ringtx_put(struct lpfc_hba *
  {
        /* Insert the caller's iocb in the txq tail for later processing. */
        list_add_tail(&piocb->list, &pring->txq);
-       pring->txq_cnt++;
  }
  
  /**
@@@ -8387,7 -8397,7 +8398,7 @@@ __lpfc_sli_issue_iocb_s4(struct lpfc_hb
                    piocb->iocb.ulpCommand == CMD_CLOSE_XRI_CN)
                        sglq = NULL;
                else {
-                       if (pring->txq_cnt) {
+                       if (!list_empty(&pring->txq)) {
                                if (!(flag & SLI_IOCB_RET_IOCB)) {
                                        __lpfc_sli_ringtx_put(phba,
                                                pring, piocb);
@@@ -9055,7 -9065,6 +9066,6 @@@ lpfc_sli_host_down(struct lpfc_vport *v
                        if (iocb->vport != vport)
                                continue;
                        list_move_tail(&iocb->list, &completions);
-                       pring->txq_cnt--;
                }
  
                /* Next issue ABTS for everything on the txcmplq */
@@@ -9124,8 -9133,6 +9134,6 @@@ lpfc_sli_hba_down(struct lpfc_hba *phba
                 * given to the FW yet.
                 */
                list_splice_init(&pring->txq, &completions);
-               pring->txq_cnt = 0;
        }
        spin_unlock_irqrestore(&phba->hbalock, flags);
  
@@@ -9966,6 -9973,9 +9974,9 @@@ lpfc_sli_issue_iocb_wait(struct lpfc_hb
        long timeleft, timeout_req = 0;
        int retval = IOCB_SUCCESS;
        uint32_t creg_val;
+       struct lpfc_iocbq *iocb;
+       int txq_cnt = 0;
+       int txcmplq_cnt = 0;
        struct lpfc_sli_ring *pring = &phba->sli.ring[LPFC_ELS_RING];
        /*
         * If the caller has provided a response iocbq buffer, then context2
                        retval = IOCB_TIMEDOUT;
                }
        } else if (retval == IOCB_BUSY) {
-               lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
-                       "2818 Max IOCBs %d txq cnt %d txcmplq cnt %d\n",
-                       phba->iocb_cnt, pring->txq_cnt, pring->txcmplq_cnt);
+               if (phba->cfg_log_verbose & LOG_SLI) {
+                       list_for_each_entry(iocb, &pring->txq, list) {
+                               txq_cnt++;
+                       }
+                       list_for_each_entry(iocb, &pring->txcmplq, list) {
+                               txcmplq_cnt++;
+                       }
+                       lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
+                               "2818 Max IOCBs %d txq cnt %d txcmplq cnt %d\n",
+                               phba->iocb_cnt, txq_cnt, txcmplq_cnt);
+               }
                return retval;
        } else {
                lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
@@@ -11298,16 -11316,25 +11317,25 @@@ lpfc_sli4_sp_handle_els_wcqe(struct lpf
        struct lpfc_iocbq *irspiocbq;
        unsigned long iflags;
        struct lpfc_sli_ring *pring = cq->pring;
+       int txq_cnt = 0;
+       int txcmplq_cnt = 0;
+       int fcp_txcmplq_cnt = 0;
  
        /* Get an irspiocbq for later ELS response processing use */
        irspiocbq = lpfc_sli_get_iocbq(phba);
        if (!irspiocbq) {
+               if (!list_empty(&pring->txq))
+                       txq_cnt++;
+               if (!list_empty(&pring->txcmplq))
+                       txcmplq_cnt++;
+               if (!list_empty(&phba->sli.ring[LPFC_FCP_RING].txcmplq))
+                       fcp_txcmplq_cnt++;
                lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                        "0387 NO IOCBQ data: txq_cnt=%d iocb_cnt=%d "
                        "fcp_txcmplq_cnt=%d, els_txcmplq_cnt=%d\n",
-                       pring->txq_cnt, phba->iocb_cnt,
-                       phba->sli.ring[LPFC_FCP_RING].txcmplq_cnt,
-                       phba->sli.ring[LPFC_ELS_RING].txcmplq_cnt);
+                       txq_cnt, phba->iocb_cnt,
+                       fcp_txcmplq_cnt,
+                       txcmplq_cnt);
                return false;
        }
  
@@@ -15482,11 -15509,18 +15510,18 @@@ lpfc_check_next_fcf_pri_level(struct lp
                        LPFC_SLI4_FCF_TBL_INDX_MAX);
        lpfc_printf_log(phba, KERN_INFO, LOG_FIP,
                        "3060 Last IDX %d\n", last_index);
-       if (list_empty(&phba->fcf.fcf_pri_list)) {
+       /* Verify the priority list has 2 or more entries */
+       spin_lock_irq(&phba->hbalock);
+       if (list_empty(&phba->fcf.fcf_pri_list) ||
+           list_is_singular(&phba->fcf.fcf_pri_list)) {
+               spin_unlock_irq(&phba->hbalock);
                lpfc_printf_log(phba, KERN_ERR, LOG_FIP,
                        "3061 Last IDX %d\n", last_index);
                return 0; /* Empty rr list */
        }
+       spin_unlock_irq(&phba->hbalock);
        next_fcf_pri = 0;
        /*
         * Clear the rr_bmask and set all of the bits that are at this
@@@ -16245,14 -16279,19 +16280,19 @@@ lpfc_drain_txq(struct lpfc_hba *phba
        char *fail_msg = NULL;
        struct lpfc_sglq *sglq;
        union lpfc_wqe wqe;
+       int txq_cnt = 0;
  
        spin_lock_irqsave(&phba->hbalock, iflags);
-       if (pring->txq_cnt > pring->txq_max)
-               pring->txq_max = pring->txq_cnt;
+       list_for_each_entry(piocbq, &pring->txq, list) {
+               txq_cnt++;
+       }
+       if (txq_cnt > pring->txq_max)
+               pring->txq_max = txq_cnt;
  
        spin_unlock_irqrestore(&phba->hbalock, iflags);
  
-       while (pring->txq_cnt) {
+       while (!list_empty(&pring->txq)) {
                spin_lock_irqsave(&phba->hbalock, iflags);
  
                piocbq = lpfc_sli_ringtx_get(phba, pring);
                        spin_unlock_irqrestore(&phba->hbalock, iflags);
                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                "2823 txq empty and txq_cnt is %d\n ",
-                               pring->txq_cnt);
+                               txq_cnt);
                        break;
                }
                sglq = __lpfc_sli_get_sglq(phba, piocbq);
                        spin_unlock_irqrestore(&phba->hbalock, iflags);
                        break;
                }
+               txq_cnt--;
  
                /* The xri and iocb resources secured,
                 * attempt to issue request
        lpfc_sli_cancel_iocbs(phba, &completions, IOSTAT_LOCAL_REJECT,
                                IOERR_SLI_ABORTED);
  
-       return pring->txq_cnt;
+       return txq_cnt;
  }
index 9299400d3c9e29c99555e13630e59e8380eaa7ac,5f1dbb7c7bef53c195f2064529e605a1cff3c60f..eaf00c162eb2decb59b91df7298fa3b7ab881d80
@@@ -2089,7 -2089,7 +2089,7 @@@ static int qla4_8xxx_minidump_process_r
  
        if (r_addr & 0xf) {
                DEBUG2(ql4_printk(KERN_INFO, ha,
 -                                "[%s]: Read addr 0x%x not 16 bytes alligned\n",
 +                                "[%s]: Read addr 0x%x not 16 bytes aligned\n",
                                  __func__, r_addr));
                return QLA_ERROR;
        }
@@@ -3154,6 -3154,10 +3154,10 @@@ qla4_8xxx_get_flt_info(struct scsi_qla_
                        hw->flt_region_chap =  start;
                        hw->flt_chap_size =  le32_to_cpu(region->size);
                        break;
+               case FLT_REG_ISCSI_DDB:
+                       hw->flt_region_ddb =  start;
+                       hw->flt_ddb_size =  le32_to_cpu(region->size);
+                       break;
                }
        }
        goto done;
@@@ -3166,14 -3170,19 +3170,19 @@@ no_flash_data
        hw->flt_region_boot     = FA_BOOT_CODE_ADDR_82;
        hw->flt_region_bootload = FA_BOOT_LOAD_ADDR_82;
        hw->flt_region_fw       = FA_RISC_CODE_ADDR_82;
-       hw->flt_region_chap     = FA_FLASH_ISCSI_CHAP;
+       hw->flt_region_chap     = FA_FLASH_ISCSI_CHAP >> 2;
        hw->flt_chap_size       = FA_FLASH_CHAP_SIZE;
+       hw->flt_region_ddb      = FA_FLASH_ISCSI_DDB >> 2;
+       hw->flt_ddb_size        = FA_FLASH_DDB_SIZE;
  
  done:
-       DEBUG2(ql4_printk(KERN_INFO, ha, "FLT[%s]: flt=0x%x fdt=0x%x "
-           "boot=0x%x bootload=0x%x fw=0x%x\n", loc, hw->flt_region_flt,
-           hw->flt_region_fdt, hw->flt_region_boot, hw->flt_region_bootload,
-           hw->flt_region_fw));
+       DEBUG2(ql4_printk(KERN_INFO, ha,
+                         "FLT[%s]: flt=0x%x fdt=0x%x boot=0x%x bootload=0x%x fw=0x%x chap=0x%x chap_size=0x%x ddb=0x%x  ddb_size=0x%x\n",
+                         loc, hw->flt_region_flt, hw->flt_region_fdt,
+                         hw->flt_region_boot, hw->flt_region_bootload,
+                         hw->flt_region_fw, hw->flt_region_chap,
+                         hw->flt_chap_size, hw->flt_region_ddb,
+                         hw->flt_ddb_size));
  }
  
  static void