Merge master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
  [SCSI] sd: udev accessing an uninitialized scsi_disk field results in a crash
  [SCSI] st: A MTIOCTOP/MTWEOF within the early warning will cause the file number to be incorrect
  [SCSI] qla4xxx: bug fixes
  [SCSI] Fix scsi_add_device() for async scanning

10 files changed, 100 insertions, 70 deletions

diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
index 4249e52a5592..6f4cf2dd2f4a 100644
--- a/drivers/scsi/qla4xxx/ql4_def.h
+++ b/drivers/scsi/qla4xxx/ql4_def.h
@@ -418,7 +418,6 @@ struct scsi_qla_host {
          * concurrently.
          */
         struct mutex  mbox_sem;
-        wait_queue_head_t mailbox_wait_queue;
 
         /* temporary mailbox status registers */
         volatile uint8_t mbox_status_count;
diff --git a/drivers/scsi/qla4xxx/ql4_glbl.h b/drivers/scsi/qla4xxx/ql4_glbl.h
index 2122967bbf0b..e021eb5db2b2 100644
--- a/drivers/scsi/qla4xxx/ql4_glbl.h
+++ b/drivers/scsi/qla4xxx/ql4_glbl.h
@@ -76,4 +76,5 @@ int qla4xxx_process_ddb_changed(struct scsi_qla_host * ha,
 extern int ql4xextended_error_logging;
 extern int ql4xdiscoverywait;
 extern int ql4xdontresethba;
+extern int ql4_mod_unload;
 #endif /* _QLA4x_GBL_H */
diff --git a/drivers/scsi/qla4xxx/ql4_init.c b/drivers/scsi/qla4xxx/ql4_init.c
index cc210f297a78..b907b06d72ab 100644
--- a/drivers/scsi/qla4xxx/ql4_init.c
+++ b/drivers/scsi/qla4xxx/ql4_init.c
@@ -958,25 +958,25 @@ static int qla4xxx_start_firmware_from_flash(struct scsi_qla_host *ha)
         return status;
 }
 
-int ql4xxx_lock_drvr_wait(struct scsi_qla_host *a)
+int ql4xxx_lock_drvr_wait(struct scsi_qla_host *ha)
 {
-#define QL4_LOCK_DRVR_WAIT      300
-#define QL4_LOCK_DRVR_SLEEP     100
+#define QL4_LOCK_DRVR_WAIT      30
+#define QL4_LOCK_DRVR_SLEEP     1
 
         int drvr_wait = QL4_LOCK_DRVR_WAIT;
         while (drvr_wait) {
-                if (ql4xxx_lock_drvr(a) == 0) {
-                        msleep(QL4_LOCK_DRVR_SLEEP);
+                if (ql4xxx_lock_drvr(ha) == 0) {
+                        ssleep(QL4_LOCK_DRVR_SLEEP);
                         if (drvr_wait) {
                                 DEBUG2(printk("scsi%ld: %s: Waiting for "
-                                              "Global Init Semaphore...n",
-                                              a->host_no,
-                                              __func__));
+                                              "Global Init Semaphore(%d)...n",
+                                              ha->host_no,
+                                              __func__, drvr_wait));
                         }
                         drvr_wait -= QL4_LOCK_DRVR_SLEEP;
                 } else {
                         DEBUG2(printk("scsi%ld: %s: Global Init Semaphore "
-                                      "acquired.n", a->host_no, __func__));
+                                      "acquired.n", ha->host_no, __func__));
                         return QLA_SUCCESS;
                 }
         }
diff --git a/drivers/scsi/qla4xxx/ql4_isr.c b/drivers/scsi/qla4xxx/ql4_isr.c
index ef975e0dc87f..35b9e36a0e8d 100644
--- a/drivers/scsi/qla4xxx/ql4_isr.c
+++ b/drivers/scsi/qla4xxx/ql4_isr.c
@@ -433,7 +433,6 @@ static void qla4xxx_isr_decode_mailbox(struct scsi_qla_host * ha,
                                         readl(&ha->reg->mailbox[i]);
 
                         set_bit(AF_MBOX_COMMAND_DONE, &ha->flags);
-                        wake_up(&ha->mailbox_wait_queue);
                 }
         } else if (mbox_status >> 12 == MBOX_ASYNC_EVENT_STATUS) {
                 /* Immediately process the AENs that don't require much work.
@@ -686,7 +685,8 @@ irqreturn_t qla4xxx_intr_handler(int irq, void *dev_id)
                                &ha->reg->ctrl_status);
                         readl(&ha->reg->ctrl_status);
 
-                        set_bit(DPC_RESET_HA_INTR, &ha->dpc_flags);
+                        if (!ql4_mod_unload)
+                                set_bit(DPC_RESET_HA_INTR, &ha->dpc_flags);
 
                         break;
                 } else if (intr_status & INTR_PENDING) {
diff --git a/drivers/scsi/qla4xxx/ql4_mbx.c b/drivers/scsi/qla4xxx/ql4_mbx.c
index b721dc5dd711..7f28657eef3f 100644
--- a/drivers/scsi/qla4xxx/ql4_mbx.c
+++ b/drivers/scsi/qla4xxx/ql4_mbx.c
@@ -29,18 +29,30 @@ int qla4xxx_mailbox_command(struct scsi_qla_host *ha, uint8_t inCount,
         u_long wait_count;
         uint32_t intr_status;
         unsigned long flags = 0;
-        DECLARE_WAITQUEUE(wait, current);
-
-        mutex_lock(&ha->mbox_sem);
-
-        /* Mailbox code active */
-        set_bit(AF_MBOX_COMMAND, &ha->flags);
 
         /* Make sure that pointers are valid */
         if (!mbx_cmd || !mbx_sts) {
                 DEBUG2(printk("scsi%ld: %s: Invalid mbx_cmd or mbx_sts "
                               "pointer\n", ha->host_no, __func__));
-                goto mbox_exit;
+                return status;
+        }
+        /* Mailbox code active */
+        wait_count = MBOX_TOV * 100;
+
+        while (wait_count--) {
+                mutex_lock(&ha->mbox_sem);
+                if (!test_bit(AF_MBOX_COMMAND, &ha->flags)) {
+                        set_bit(AF_MBOX_COMMAND, &ha->flags);
+                        mutex_unlock(&ha->mbox_sem);
+                        break;
+                }
+                mutex_unlock(&ha->mbox_sem);
+                if (!wait_count) {
+                        DEBUG2(printk("scsi%ld: %s: mbox_sem failed\n",
+                                ha->host_no, __func__));
+                        return status;
+                }
+                msleep(10);
         }
 
         /* To prevent overwriting mailbox registers for a command that has
@@ -73,8 +85,6 @@ int qla4xxx_mailbox_command(struct scsi_qla_host *ha, uint8_t inCount,
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
         /* Wait for completion */
-        set_current_state(TASK_UNINTERRUPTIBLE);
-        add_wait_queue(&ha->mailbox_wait_queue, &wait);
 
         /*
          * If we don't want status, don't wait for the mailbox command to
@@ -83,8 +93,6 @@ int qla4xxx_mailbox_command(struct scsi_qla_host *ha, uint8_t inCount,
          */
         if (outCount == 0) {
                 status = QLA_SUCCESS;
-                set_current_state(TASK_RUNNING);
-                remove_wait_queue(&ha->mailbox_wait_queue, &wait);
                 goto mbox_exit;
         }
         /* Wait for command to complete */
@@ -108,8 +116,6 @@ int qla4xxx_mailbox_command(struct scsi_qla_host *ha, uint8_t inCount,
                 spin_unlock_irqrestore(&ha->hardware_lock, flags);
                 msleep(10);
         }
-        set_current_state(TASK_RUNNING);
-        remove_wait_queue(&ha->mailbox_wait_queue, &wait);
 
         /* Check for mailbox timeout. */
         if (!test_bit(AF_MBOX_COMMAND_DONE, &ha->flags)) {
@@ -155,9 +161,10 @@ int qla4xxx_mailbox_command(struct scsi_qla_host *ha, uint8_t inCount,
         spin_unlock_irqrestore(&ha->hardware_lock, flags);