9 files changed, 591 insertions, 333 deletions

diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 28f2c177a541..486b6e1c7dfb 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -47,14 +47,14 @@
 #include <linux/completion.h>
 
 #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
-#define DRIVER_NAME "HP CISS Driver (v 2.6.6)"
-#define DRIVER_VERSION CCISS_DRIVER_VERSION(2,6,6)
+#define DRIVER_NAME "HP CISS Driver (v 2.6.8)"
+#define DRIVER_VERSION CCISS_DRIVER_VERSION(2,6,8)
 
 /* Embedded module documentation macros - see modules.h */
 MODULE_AUTHOR("Hewlett-Packard Company");
-MODULE_DESCRIPTION("Driver for HP Controller SA5xxx SA6xxx version 2.6.6");
+MODULE_DESCRIPTION("Driver for HP Controller SA5xxx SA6xxx version 2.6.8");
 MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
-                        " SA6i P600 P800 E400 E300");
+                        " SA6i P600 P800 P400 P400i E200 E200i");
 MODULE_LICENSE("GPL");
 
 #include "cciss_cmd.h"
@@ -83,12 +83,22 @@ static const struct pci_device_id cciss_pci_device_id[] = {
                 0x0E11, 0x4091, 0, 0, 0},
         { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSA,
                 0x103C, 0x3225, 0, 0, 0},
-        { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSB,
+        { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSC,
                 0x103c, 0x3223, 0, 0, 0},
         { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSC,
-                0x103c, 0x3231, 0, 0, 0},
+                0x103c, 0x3234, 0, 0, 0},
         { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSC,
-                0x103c, 0x3233, 0, 0, 0},
+                0x103c, 0x3235, 0, 0, 0},
+        { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSD,
+                0x103c, 0x3211, 0, 0, 0},
+        { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSD,
+                0x103c, 0x3212, 0, 0, 0},
+        { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSD,
+                0x103c, 0x3213, 0, 0, 0},
+        { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSD,
+                0x103c, 0x3214, 0, 0, 0},
+        { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSD,
+                0x103c, 0x3215, 0, 0, 0},
         {0,}
 };
 MODULE_DEVICE_TABLE(pci, cciss_pci_device_id);
@@ -111,8 +121,13 @@ static struct board_type products[] = {
         { 0x40910E11, "Smart Array 6i", &SA5_access},
         { 0x3225103C, "Smart Array P600", &SA5_access},
         { 0x3223103C, "Smart Array P800", &SA5_access},
-        { 0x3231103C, "Smart Array E400", &SA5_access},
-        { 0x3233103C, "Smart Array E300", &SA5_access},
+        { 0x3234103C, "Smart Array P400", &SA5_access},
+        { 0x3235103C, "Smart Array P400i", &SA5_access},
+        { 0x3211103C, "Smart Array E200i", &SA5_access},
+        { 0x3212103C, "Smart Array E200", &SA5_access},
+        { 0x3213103C, "Smart Array E200i", &SA5_access},
+        { 0x3214103C, "Smart Array E200i", &SA5_access},
+        { 0x3215103C, "Smart Array E200i", &SA5_access},
 };
 
 /* How long to wait (in millesconds) for board to go into simple mode */
@@ -140,15 +155,26 @@ static int cciss_ioctl(struct inode *inode, struct file *filep,
 
 static int revalidate_allvol(ctlr_info_t *host);
 static int cciss_revalidate(struct gendisk *disk);
-static int deregister_disk(struct gendisk *disk);
-static int register_new_disk(ctlr_info_t *h);
+static int rebuild_lun_table(ctlr_info_t *h, struct gendisk *del_disk);
+static int deregister_disk(struct gendisk *disk, drive_info_struct *drv, int clear_all);
 
+static void cciss_read_capacity(int ctlr, int logvol, ReadCapdata_struct *buf,
+        int withirq, unsigned int *total_size, unsigned int *block_size);
+static void cciss_geometry_inquiry(int ctlr, int logvol,
+                        int withirq, unsigned int total_size,
+                        unsigned int block_size, InquiryData_struct *inq_buff,
+                        drive_info_struct *drv);
 static void cciss_getgeometry(int cntl_num);
 
 static void start_io( ctlr_info_t *h);
 static int sendcmd( __u8 cmd, int ctlr, void *buff, size_t size,
         unsigned int use_unit_num, unsigned int log_unit, __u8 page_code,
         unsigned char *scsi3addr, int cmd_type);
+static int sendcmd_withirq(__u8 cmd, int ctlr, void *buff, size_t size,
+        unsigned int use_unit_num, unsigned int log_unit, __u8  page_code,
+        int cmd_type);
+
+static void fail_all_cmds(unsigned long ctlr);
 
 #ifdef CONFIG_PROC_FS
 static int cciss_proc_get_info(char *buffer, char **start, off_t offset, 
@@ -265,7 +291,7 @@ static int cciss_proc_get_info(char *buffer, char **start, off_t offset,
         for(i=0; i<=h->highest_lun; i++) {
 
                 drv = &h->drv[i];
-                if (drv->block_size == 0)
+                if (drv->heads == 0)
                         continue;
 
                 vol_sz = drv->nr_blocks;
@@ -363,6 +389,8 @@ static CommandList_struct * cmd_alloc(ctlr_info_t *h, int get_from_pool)
                         return NULL;
                 memset(c, 0, sizeof(CommandList_struct));
 
+                c->cmdindex = -1;
+
                 c->err_info = (ErrorInfo_struct *)pci_alloc_consistent(
                                         h->pdev, sizeof(ErrorInfo_struct), 
                                         &err_dma_handle);
@@ -393,6 +421,8 @@ static CommandList_struct * cmd_alloc(ctlr_info_t *h, int get_from_pool)
                 err_dma_handle = h->errinfo_pool_dhandle 
                                         + i*sizeof(ErrorInfo_struct);
                 h->nr_allocs++;
+
+                c->cmdindex = i;
         }
 
         c->busaddr = (__u32) cmd_dma_handle;
@@ -453,6 +483,8 @@ static int cciss_open(struct inode *inode, struct file *filep)
         printk(KERN_DEBUG "cciss_open %s\n", inode->i_bdev->bd_disk->disk_name);
 #endif /* CCISS_DEBUG */ 
 
+        if (host->busy_initializing || drv->busy_configuring)
+                return -EBUSY;
         /*
          * Root is allowed to open raw volume zero even if it's not configured
          * so array config can still work. Root is also allowed to open any
@@ -796,10 +828,10 @@ static int cciss_ioctl(struct inode *inode, struct file *filep,
                 return(0);
         }
         case CCISS_DEREGDISK:
-                return deregister_disk(disk);
+                return rebuild_lun_table(host, disk);
 
         case CCISS_REGNEWD:
-                return register_new_disk(host);
+                return rebuild_lun_table(host, NULL);
 
         case CCISS_PASSTHRU:
         {
@@ -1143,48 +1175,323 @@ static int revalidate_allvol(ctlr_info_t *host)
         return 0;
 }
 
-static int deregister_disk(struct gendisk *disk)
+/* This function will check the usage_count of the drive to be updated/added.
+ * If the usage_count is zero then the drive information will be updated and
+ * the disk will be re-registered with the kernel.  If not then it will be
+ * left alone for the next reboot.  The exception to this is disk 0 which
+ * will always be left registered with the kernel since it is also the
+ * controller node.  Any changes to disk 0 will show up on the next
+ * reboot.
+*/
+static void cciss_update_drive_info(int ctlr, int drv_index)
+  {
+        ctlr_info_t *h = hba[ctlr];
+        struct gendisk *disk;
+        ReadCapdata_struct *size_buff = NULL;
+        InquiryData_struct *inq_buff = NULL;
+        unsigned int block_size;
+        unsigned int total_size;
+        unsigned long flags = 0;
+        int ret = 0;
+
+        /* if the disk already exists then deregister it before proceeding*/
+        if (h->drv[drv_index].raid_level != -1){
+                spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
+                h->drv[drv_index].busy_configuring = 1;
+                spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
+                ret = deregister_disk(h->gendisk[drv_index],
+                        &h->drv[drv_index], 0);
+                h->drv[drv_index].busy_configuring = 0;
+        }
+
+        /* If the disk is in use return */
+        if (ret)
+                return;
+
+
+        /* Get information about the disk and modify the driver sturcture */
+        size_buff = kmalloc(sizeof( ReadCapdata_struct), GFP_KERNEL);
+        if (size_buff == NULL)
+                goto mem_msg;
+        inq_buff = kmalloc(sizeof( InquiryData_struct), GFP_KERNEL);
+        if (inq_buff == NULL)
+                goto mem_msg;
+
+        cciss_read_capacity(ctlr, drv_index, size_buff, 1,
+                &total_size, &block_size);
+        cciss_geometry_inquiry(ctlr, drv_index, 1, total_size, block_size,
+                inq_buff, &h->drv[drv_index]);
+
+        ++h->num_luns;
+        disk = h->gendisk[drv_index];
+        set_capacity(disk, h->drv[drv_index].nr_blocks);
+
+
+        /* if it's the controller it's already added */
+        if (drv_index){
+                disk->queue = blk_init_queue(do_cciss_request, &h->lock);
+
+                /* Set up queue information */
+                disk->queue->backing_dev_info.ra_pages = READ_AHEAD;
+                blk_queue_bounce_limit(disk->queue, hba[ctlr]->pdev->dma_mask);
+
+                /* This is a hardware imposed limit. */
+                blk_queue_max_hw_segments(disk->queue, MAXSGENTRIES);
+
+                /* This is a limit in the driver and could be eliminated. */
+                blk_queue_max_phys_segments(disk->queue, MAXSGENTRIES);
+
+                blk_queue_max_sectors(disk->queue, 512);
+
+                disk->queue->queuedata = hba[ctlr];
+
+                blk_queue_hardsect_size(disk->queue,
+                        hba[ctlr]->drv[drv_index].block_size);
+
+                h->drv[drv_index].queue = disk->queue;
+                add_disk(disk);
+        }
+
+freeret:
+        kfree(size_buff);
+        kfree(inq_buff);
+        return;
+mem_msg:
+        printk(KERN_ERR "cciss: out of memory\n");
+        goto freeret;
+}
+
+/* This function will find the first index of the controllers drive array
+ * that has a -1 for the raid_level and will return that index.  This is
+ * where new drives will be added.  If the index to be returned is greater
+ * than the highest_lun index for the controller then highest_lun is set
+ * to this new index.  If there are no available indexes then -1 is returned.
+*/
+static int cciss_find_free_drive_index(int ctlr)
 {
+        int i;
+
+        for (i=0; i < CISS_MAX_LUN; i++){
+                if (hba[ctlr]->drv[i].raid_level == -1){
+                        if (i > hba[ctlr]->highest_lun)
+                                hba[ctlr]->highest_lun = i;
+                        return i;
+                }
+        }
+        return -1;
+}
+
+/* This function will add and remove logical drives from the Logical
+ * drive array of the controller and maintain persistancy of ordering
+ * so that mount points are preserved until the next reboot.  This allows
+ * for the removal of logical drives in the middle of the drive array
+ * without a re-ordering of those drives.
+ * INPUT
+ * h            = The controller to perform the operations on
+ * del_disk     = The disk to remove if specified.  If the value given
+ *                is NULL then no disk is removed.
+*/
+static int rebuild_lun_table(ctlr_info_t *h, struct gendisk *del_disk)
+{
+        int ctlr = h->ctlr;
+        int num_luns;
+        ReportLunData_struct *ld_buff = NULL;
+        drive_info_struct *drv = NULL;
+        int return_code;
+        int listlength = 0;
+        int i;
+        int drv_found;
+        int drv_index = 0;
+        __u32 lunid = 0;
         unsigned long flags;
+
+        /* Set busy_configuring flag for this operation */
+        spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
+        if (h->num_luns >= CISS_MAX_LUN){
+                spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
+                return -EINVAL;
+        }
+
+        if (h->busy_configuring){
+                spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
+                return -EBUSY;
+        }
+        h->busy_configuring = 1;
+
+        /* if del_disk is NULL then we are being called to add a new disk
+         * and update the logical drive table.  If it is not NULL then
+         * we will check if the disk is in use or not.
+         */
+        if (del_disk != NULL){
+                drv = get_drv(del_disk);
+                drv->busy_configuring = 1;
+                spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
+                return_code = deregister_disk(del_disk, drv, 1);
+                drv->busy_configuring = 0;
+                h->busy_configuring = 0;
+                return return_code;
+        } else {
+                spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
+                if (!capable(CAP_SYS_RAWIO))
+                        return -EPERM;
+
+                ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
+                if (ld_buff == NULL)
+                        goto mem_msg;
+
+                return_code = sendcmd_withirq(CISS_REPORT_LOG, ctlr, ld_buff,
+                                sizeof(ReportLunData_struct), 0, 0, 0,
+                                TYPE_CMD);
+
+                if (return_code == IO_OK){
+                        listlength |= (0xff & (unsigned int)(ld_buff->LUNListLength[0])) << 24;
+                        listlength |= (0xff & (unsigned int)(ld_buff->LUNListLength[1])) << 16;
+                        listlength |= (0xff & (unsigned int)(ld_buff->LUNListLength[2])) << 8;
+                        listlength |= 0xff & (unsigned int)(ld_buff->LUNListLength[3]);
+                } else{ /* reading number of logical volumes failed */
+                        printk(KERN_WARNING "cciss: report logical volume"
+                                " command failed\n");
+                        listlength = 0;
+                        goto freeret;
+                }
+
+                num_luns = listlength / 8;      /* 8 bytes per entry */
+                if (num_luns > CISS_MAX_LUN){
+                        num_luns = CISS_MAX_LUN;
+                        printk(KERN_WARNING "cciss: more luns configured"
+                                " on controller than can be handled by"
+                                " this driver.\n");
+                }
+
+                /* Compare controller drive array to drivers drive array.
+                * Check for updates in the drive information and any new drives
+                * on the controller.
+                */
+                for (i=0; i < num_luns; i++){
+                        int j;
+
+                        drv_found = 0;
+
+                        lunid = (0xff &
+                                (unsigned int)(ld_buff->LUN[i][3])) << 24;
+                        lunid |= (0xff &
+                                (unsigned int)(ld_buff->LUN[i][2])) << 16;
+                        lunid |= (0xff &
+                                (unsigned int)(ld_buff->LUN[i][1])) << 8;
+                        lunid |= 0xff &
+                                (unsigned int)(ld_buff->LUN[i][0]);
+
+                        /* Find if the LUN is already in the drive array
+                         * of the controller.  If so then update its info
+                         * if not is use.  If it does not exist then find
+                         * the first free index and add it.
+                        */
+                        for (j=0; j <= h->highest_lun; j++){
+                                if (h->drv[j].LunID == lunid){
+                                        drv_index = j;
+                                        drv_found = 1;
+                                }
+                        }
+
+                        /* check if the drive was found already in the array */
+                        if (!drv_found){
+                                drv_index = cciss_find_free_drive_index(ctlr);
+                                if (drv_index == -1)
+                                        goto freeret;
+
+                        }
+                        h->drv[drv_index].LunID = lunid;
+                        cciss_update_drive_info(ctlr, drv_index);
+                } /* end for */
+        } /* end else */
+
+freeret:
+        kfree(ld_buff);
+        h->busy_configuring = 0;
+        /* We return -1 here to tell the ACU that we have registered/updated
+         * all of the drives that we can and to keep it from calling us
+         * additional times.
+        */
+        return -1;
+mem_msg:
+        printk(KERN_ERR "cciss: out of memory\n");
+        goto freeret;
+}
+
+/* This function will deregister the disk and it's queue from the
+ * kernel.  It must be called with the controller lock held and the
+ * drv structures busy_configuring flag set.  It's parameters are:
+ *
+ * disk = This is the disk to be deregistered
+ * drv  = This is the drive_info_struct associated with the disk to be
+ *        deregistered.  It contains information about the disk used
+ *        by the driver.
+ * clear_all = This flag determines whether or not the disk information
+ *             is going to be completely cleared out and the highest_lun
+ *             reset.  Sometimes we want to clear out information about
+ *             the disk in preperation for re-adding it.  In this case
+ *             the highest_lun should be left unchanged and the LunID
+ *             should not be cleared.
+*/
+static int deregister_disk(struct gendisk *disk, drive_info_struct *drv,
+                           int clear_all)
+{
         ctlr_info_t *h = get_host(disk);
-        drive_info_struct *drv = get_drv(disk);
-        int ctlr = h->ctlr;
 
         if (!capable(CAP_SYS_RAWIO))
                 return -EPERM;
 
-        spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
         /* make sure logical volume is NOT is use */
-        if( drv->usage_count > 1) {
-                spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
+        if(clear_all || (h->gendisk[0] == disk)) {
+        if (drv->usage_count > 1)
                 return -EBUSY;
         }
-        drv->usage_count++;
-        spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
+        else
+                if( drv->usage_count > 0 )
+                        return -EBUSY;
 
-        /* invalidate the devices and deregister the disk */ 
-        if (disk->flags & GENHD_FL_UP)
+        /* invalidate the devices and deregister the disk.  If it is disk
+         * zero do not deregister it but just zero out it's values.  This
+         * allows us to delete disk zero but keep the controller registered.
+        */
+        if (h->gendisk[0] != disk){
+                if (disk->flags & GENHD_FL_UP){
+                        blk_cleanup_queue(disk->queue);
                 del_gendisk(disk);
+                        drv->queue = NULL;
+                }
+        }
+
+        --h->num_luns;
+        /* zero out the disk size info */
+        drv->nr_blocks = 0;
+        drv->block_size = 0;
+        drv->heads = 0;
+        drv->sectors = 0;
+        drv->cylinders = 0;
+        drv->raid_level = -1;   /* This can be used as a flag variable to
+                                 * indicate that this element of the drive
+                                 * array is free.
+                                */
+
+        if (clear_all){
         /* check to see if it was the last disk */
         if (drv == h->drv + h->highest_lun) {
                 /* if so, find the new hightest lun */
                 int i, newhighest =-1;
                 for(i=0; i<h->highest_lun; i++) {
                         /* if the disk has size > 0, it is available */
-                        if (h->drv[i].nr_blocks)
+                                if (h->drv[i].heads)
                                 newhighest = i;
                 }
                 h->highest_lun = newhighest;
-                                
         }
-        --h->num_luns;
-        /* zero out the disk size info */ 
-        drv->nr_blocks = 0;
-        drv->block_size = 0;
-        drv->cylinders = 0;
+
         drv->LunID = 0;
+        }
         return(0);
 }
+
 static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
         size_t size,
         unsigned int use_unit_num, /* 0: address the controller,
@@ -1420,8 +1727,10 @@ case CMD_HARDWARE_ERR:
                 }
         }       
         /* unlock the buffers from DMA */
+        buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
+        buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
         pci_unmap_single( h->pdev, (dma_addr_t) buff_dma_handle.val,
-                        size, PCI_DMA_BIDIRECTIONAL);
+                        c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
         cmd_free(h, c, 0);
         return(return_status);
 
@@ -1495,164 +1804,6 @@ cciss_read_capacity(int ctlr, int logvol, ReadCapdata_struct *buf,
         return;
 }
 
-static int register_new_disk(ctlr_info_t *h)
-{
-        struct gendisk *disk;
-        int ctlr = h->ctlr;
-        int i;
-        int num_luns;
-        int logvol;
-        int new_lun_found = 0;
-        int new_lun_index = 0;
-        int free_index_found = 0;
-        int free_index = 0;
-        ReportLunData_struct *ld_buff = NULL;
-        ReadCapdata_struct *size_buff = NULL;
-        InquiryData_struct *inq_buff = NULL;
-        int return_code;
-        int listlength = 0;
-        __u32 lunid = 0;
-        unsigned int block_size;
-        unsigned int total_size;
-
-        if (!capable(CAP_SYS_RAWIO))
-                return -EPERM;
-        /* if we have no space in our disk array left to add anything */
-        if(  h->num_luns >= CISS_MAX_LUN)
-                return -EINVAL;
-        
-        ld_buff = kmalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
-        if (ld_buff == NULL)
-                goto mem_msg;
-        memset(ld_buff, 0, sizeof(ReportLunData_struct));
-        size_buff = kmalloc(sizeof( ReadCapdata_struct), GFP_KERNEL);
-        if (size_buff == NULL)
-                goto mem_msg;
-        inq_buff = kmalloc(sizeof( InquiryData_struct), GFP_KERNEL);
-        if (inq_buff == NULL)
-                goto mem_msg;
-        
-        return_code = sendcmd_withirq(CISS_REPORT_LOG, ctlr, ld_buff, 
-                        sizeof(ReportLunData_struct), 0, 0, 0, TYPE_CMD);
-
-        if( return_code == IO_OK)
-        {
-                
-                // printk("LUN Data\n--------------------------\n");
-
-                listlength |= (0xff & (unsigned int)(ld_buff->LUNListLength[0])) << 24;
-                listlength |= (0xff & (unsigned int)(ld_buff->LUNListLength[1])) << 16;
-                listlength |= (0xff & (unsigned int)(ld_buff->LUNListLength[2])) << 8;  
-                listlength |= 0xff & (unsigned int)(ld_buff->LUNListLength[3]);
-        } else /* reading number of logical volumes failed */
-        {
-                printk(KERN_WARNING "cciss: report logical volume"
-                        " command failed\n");
-                listlength = 0;
-                goto free_err;
-        }
-        num_luns = listlength / 8; // 8 bytes pre entry
-        if (num_luns > CISS_MAX_LUN)
-        {
-                num_luns = CISS_MAX_LUN;
-        }
-#ifdef CCISS_DEBUG
-        printk(KERN_DEBUG "Length = %x %x %x %x = %d\n", ld_buff->LUNListLength[0],
-                ld_buff->LUNListLength[1], ld_buff->LUNListLength[2],
-                ld_buff->LUNListLength[3],  num_luns);
-#endif 
-        for(i=0; i<  num_luns; i++)
-        {
-                int j;
-                int lunID_found = 0;
-
-                lunid = (0xff & (unsigned int)(ld_buff->LUN[i][3])) << 24;
-                lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][2])) << 16;
-                lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][1])) << 8;
-                lunid |= 0xff & (unsigned int)(ld_buff->LUN[i][0]);
-                
-                /* check to see if this is a new lun */ 
-                for(j=0; j <= h->highest_lun; j++)
-                {
-#ifdef CCISS_DEBUG
-                        printk("Checking %d %x against %x\n", j,h->drv[j].LunID,
-                                                lunid);
-#endif /* CCISS_DEBUG */
-                        if (h->drv[j].LunID == lunid)
-                        {
-                                lunID_found = 1;
-                                break;
-                        }
-                        
-                }
-                if( lunID_found == 1)
-                        continue;
-                else
-                {       /* It is the new lun we have been looking for */
-#ifdef CCISS_DEBUG
-                        printk("new lun found at %d\n", i);
-#endif /* CCISS_DEBUG */
-                        new_lun_index = i;
-                        new_lun_found = 1;
-                        break;  
-                }
-         }
-         if (!new_lun_found)
-         {
-                printk(KERN_WARNING "cciss:  New Logical Volume not found\n");
-                goto free_err;
-         }
-         /* Now find the free index     */
-        for(i=0; i <CISS_MAX_LUN; i++)
-        {
-#ifdef CCISS_DEBUG
-                printk("Checking Index %d\n", i);
-#endif /* CCISS_DEBUG */
-                if(h->drv[i].LunID == 0)
-                {
-#ifdef CCISS_DEBUG
-                        printk("free index found at %d\n", i);
-#endif /* CCISS_DEBUG */
-                        free_index_found = 1;
-                        free_index = i;
-                        break;
-                }
-        }
-        if (!free_index_found)
-        {
-                printk(KERN_WARNING "cciss: unable to find free slot for disk\n");
-                goto free_err;
-         }
-
-        logvol = free_index;
-        h->drv[logvol].LunID = lunid;
-                /* there could be gaps in lun numbers, track hightest */
-        if(h->highest_lun < lunid)
-                h->highest_lun = logvol;
-        cciss_read_capacity(ctlr, logvol, size_buff, 1,
-                &total_size, &block_size);
-        cciss_geometry_inquiry(ctlr, logvol, 1, total_size, block_size,
-                        inq_buff, &h->drv[logvol]);
-        h->drv[logvol].usage_count = 0;
-        ++h->num_luns;
-        /* setup partitions per disk */
-        disk = h->gendisk[logvol];
-        set_capacity(disk, h->drv[logvol].nr_blocks);
-        /* if it's the controller it's already added */
-        if(logvol)
-                add_disk(disk);
-freeret:
-        kfree(ld_buff);
-        kfree(size_buff);
-        kfree(inq_buff);
-        return (logvol);
-mem_msg:
-        printk(KERN_ERR "cciss: out of memory\n");
-free_err:
-        logvol = -1;
-        goto freeret;
-}
-
 static int cciss_revalidate(struct gendisk *disk)
 {
         ctlr_info_t *h = get_host(disk);
@@ -1859,8 +2010,10 @@ resend_cmd1:
                 
 cleanup1:       
         /* unlock the data buffer from DMA */
+        buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
+        buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
         pci_unmap_single(info_p->pdev, (dma_addr_t) buff_dma_handle.val,
-                                size, PCI_DMA_BIDIRECTIONAL);
+                                c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
         cmd_free(info_p, c, 1);
         return (status);
 } 
@@ -2111,7 +2264,11 @@ queue:
         /* fill in the request */ 
         drv = creq->rq_disk->private_data;
         c->Header.ReplyQueue = 0;  // unused in simple mode
-        c->Header.Tag.lower = c->busaddr;  // use the physical address the cmd block for tag
+        /* got command from pool, so use the command block index instead */
+        /* for direct lookups. */
+        /* The first 2 bits are reserved for controller error reporting. */
+        c->Header.Tag.lower = (c->cmdindex << 3);
+        c->Header.Tag.lower |= 0x04; /* flag for direct lookup. */
         c->Header.LUN.LogDev.VolId= drv->LunID;
         c->Header.LUN.LogDev.Mode = 1;
         c->Request.CDBLen = 10; // 12 byte commands not in FW yet;
@@ -2186,7 +2343,7 @@ static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
         ctlr_info_t *h = dev_id;
         CommandList_struct *c;
         unsigned long flags;
-        __u32 a, a1;
+        __u32 a, a1, a2;
         int j;
         int start_queue = h->next_to_run;
 
@@ -2204,10 +2361,21 @@ static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
                 while((a = h->access.command_completed(h)) != FIFO_EMPTY) 
                 {
                         a1 = a;
+                        if ((a & 0x04)) {
+                                a2 = (a >> 3);
+                                if (a2 >= NR_CMDS) {
+                                        printk(KERN_WARNING "cciss: controller cciss%d failed, stopping.\n", h->ctlr);
+                                        fail_all_cmds(h->ctlr);
+                                        return IRQ_HANDLED;
+                                }
+
+                                c = h->cmd_pool + a2;
+                                a = c->busaddr;
+
+                        } else {
                         a &= ~3;
-                        if ((c = h->cmpQ) == NULL)
-                        {  
-                                printk(KERN_WARNING "cciss: Completion of %08lx ignored\n", (unsigned long)a1);
+                                if ((c = h->cmpQ) == NULL) {
+                                        printk(KERN_WARNING "cciss: Completion of %08x ignored\n", a1);
                                 continue;       
                         } 
                         while(c->busaddr != a) {
@@ -2215,6 +2383,7 @@ static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
                                 if (c == h->cmpQ) 
                                         break;
                         }
+                        }
                         /*
                          * If we've found the command, take it off the
                          * completion Q and free it
@@ -2634,12 +2803,16 @@ static void cciss_getgeometry(int cntl_num)
 #endif /* CCISS_DEBUG */
 
         hba[cntl_num]->highest_lun = hba[cntl_num]->num_luns-1;
-        for(i=0; i<  hba[cntl_num]->num_luns; i++)
+//      for(i=0; i<  hba[cntl_num]->num_luns; i++)
+        for(i=0; i < CISS_MAX_LUN; i++)
         {
-
-                lunid = (0xff & (unsigned int)(ld_buff->LUN[i][3])) << 24;
-                lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][2])) << 16;
-                lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][1])) << 8;
+                if (i < hba[cntl_num]->num_luns){
+                        lunid = (0xff & (unsigned int)(ld_buff->LUN[i][3]))
+                                 << 24;
+                        lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][2]))
+                                 << 16;
+                        lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][1]))
+                                 << 8;
                 lunid |= 0xff & (unsigned int)(ld_buff->LUN[i][0]);
                 
                 hba[cntl_num]->drv[i].LunID = lunid;
@@ -2647,13 +2820,18 @@ static void cciss_getgeometry(int cntl_num)
 
 #ifdef CCISS_DEBUG
                 printk(KERN_DEBUG "LUN[%d]:  %x %x %x %x = %x\n", i, 
-                ld_buff->LUN[i][0], ld_buff->LUN[i][1],ld_buff->LUN[i][2], 
-                ld_buff->LUN[i][3], hba[cntl_num]->drv[i].LunID);
+                        ld_buff->LUN[i][0], ld_buff->LUN[i][1],
+                        ld_buff->LUN[i][2], ld_buff->LUN[i][3],
+                        hba[cntl_num]->drv[i].LunID);
 #endif /* CCISS_DEBUG */
                 cciss_read_capacity(cntl_num, i, size_buff, 0,
                         &total_size, &block_size);
-                cciss_geometry_inquiry(cntl_num, i, 0, total_size, block_size,
-                        inq_buff, &hba[cntl_num]->drv[i]);
+                        cciss_geometry_inquiry(cntl_num, i, 0, total_size,
+                                block_size, inq_buff, &hba[cntl_num]->drv[i]);
+                } else {
+                        /* initialize raid_level to indicate a free space */
+                        hba[cntl_num]->drv[i].raid_level = -1;
+                }
         }
         kfree(ld_buff);
         kfree(size_buff);
@@ -2727,6 +2905,9 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
         i = alloc_cciss_hba();
         if(i < 0)
                 return (-1);
+
+        hba[i]->busy_initializing = 1;
+
         if (cciss_pci_init(hba[i], pdev) != 0)
                 goto clean1;
 
@@ -2807,6 +2988,7 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
         hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_ON);
 
         cciss_procinit(i);
+        hba[i]->busy_initializing = 0;
 
         for(j=0; j < NWD; j++) { /* mfm */
                 drive_info_struct *drv = &(hba[i]->drv[j]);
@@ -2869,6 +3051,7 @@ clean2:
 clean1:
         release_io_mem(hba[i]);
         free_hba(i);
+        hba[i]->busy_initializing = 0;
         return(-1);
 }
 
@@ -2913,9 +3096,10 @@ static void __devexit cciss_remove_one (struct pci_dev *pdev)
         /* remove it from the disk list */
         for (j = 0; j < NWD; j++) {
                 struct gendisk *disk = hba[i]->gendisk[j];
-                if (disk->flags & GENHD_FL_UP)
-                        blk_cleanup_queue(disk->queue);
+                if (disk->flags & GENHD_FL_UP) {
                         del_gendisk(disk);
+                        blk_cleanup_queue(disk->queue);
+                }
         }
 
         pci_free_consistent(hba[i]->pdev, NR_CMDS * sizeof(CommandList_struct),
@@ -2964,5 +3148,43 @@ static void __exit cciss_cleanup(void)
         remove_proc_entry("cciss", proc_root_driver);
 }
 
+static void fail_all_cmds(unsigned long ctlr)
+{
+        /* If we get here, the board is apparently dead. */
+        ctlr_info_t *h = hba[ctlr];
+        CommandList_struct *c;
+        unsigned long flags;
+
+        printk(KERN_WARNING "cciss%d: controller not responding.\n", h->ctlr);
+        h->alive = 0;   /* the controller apparently died... */
+
+        spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
+
+        pci_disable_device(h->pdev); /* Make sure it is really dead. */
+
+        /* move everything off the request queue onto the completed queue */
+        while( (c = h->reqQ) != NULL ) {
+                removeQ(&(h->reqQ), c);
+                h->Qdepth--;
+                addQ (&(h->cmpQ), c);
+        }
+
+        /* Now, fail everything on the completed queue with a HW error */
+        while( (c = h->cmpQ) != NULL ) {
+                removeQ(&h->cmpQ, c);
+                c->err_info->CommandStatus = CMD_HARDWARE_ERR;
+                if (c->cmd_type == CMD_RWREQ) {
+                        complete_command(h, c, 0);
+                } else if (c->cmd_type == CMD_IOCTL_PEND)
+                        complete(c->waiting);
+#ifdef CONFIG_CISS_SCSI_TAPE
+                        else if (c->cmd_type == CMD_SCSI)
+                                complete_scsi_command(c, 0, 0);
+#endif
+        }
+        spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
+        return;
+}
+
 module_init(cciss_init);
 module_exit(cciss_cleanup);
diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
index 566587d0a500..ef277baee9fd 100644
--- a/drivers/block/cciss.h
+++ b/drivers/block/cciss.h
@@ -35,7 +35,13 @@ typedef struct _drive_info_struct
         int     heads;
         int     sectors;
         int     cylinders;
-        int     raid_level;
+        int     raid_level; /* set to -1 to indicate that
+                             * the drive is not in use/configured
+                            */
+        int     busy_configuring; /*This is set when the drive is being removed
+                                   *to prevent it from being opened or it's queue
+                                   *from being started.
+                                  */
 } drive_info_struct;
 
 struct ctlr_info 
@@ -83,6 +89,7 @@ struct ctlr_info
         int                     nr_allocs;
         int                     nr_frees; 
         int                     busy_configuring;
+        int                     busy_initializing;
 
         /* This element holds the zero based queue number of the last
          * queue to be started.  It is used for fairness.
@@ -94,6 +101,7 @@ struct ctlr_info
 #ifdef CONFIG_CISS_SCSI_TAPE
         void *scsi_ctlr; /* ptr to structure containing scsi related stuff */
 #endif
+        unsigned char alive;
 };
 
 /*  Defining the diffent access_menthods */
diff --git a/drivers/block/cciss_cmd.h b/drivers/block/cciss_cmd.h
index a88a88817623..53fea549ba8b 100644
--- a/drivers/block/cciss_cmd.h
+++ b/drivers/block/cciss_cmd.h
@@ -226,6 +226,10 @@ typedef struct _ErrorInfo_struct {
 #define CMD_MSG_DONE    0x04
 #define CMD_MSG_TIMEOUT 0x05
 
+/* This structure needs to be divisible by 8 for new
+ * indexing method.
+ */
+#define PADSIZE (sizeof(long) - 4)
 typedef struct _CommandList_struct {
   CommandListHeader_struct Header;
   RequestBlock_struct      Request;
@@ -236,14 +240,14 @@ typedef struct _CommandList_struct {
   ErrorInfo_struct *       err_info; /* pointer to the allocated mem */ 
   int                      ctlr;
   int                      cmd_type; 
+  long                     cmdindex;
   struct _CommandList_struct *prev;
   struct _CommandList_struct *next;
   struct request *         rq;
   struct completion *waiting;
   int    retry_count;
-#ifdef CONFIG_CISS_SCSI_TAPE
   void * scsi_cmd;
-#endif
+  char   pad[PADSIZE];
 } CommandList_struct;
 
 //Configuration Table Structure
diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
index f16e3caed58a..e183a3ef7839 100644
--- a/drivers/block/cciss_scsi.c
+++ b/drivers/block/cciss_scsi.c
@@ -93,6 +93,7 @@ struct cciss_scsi_cmd_stack_elem_t {
         CommandList_struct cmd;
         ErrorInfo_struct Err;
         __u32 busaddr;
+        __u32 pad;
 };
 
 #pragma pack()
@@ -877,7 +878,7 @@ cciss_scsi_interpret_error(CommandList_struct *cp)
 
 static int
 cciss_scsi_do_inquiry(ctlr_info_t *c, unsigned char *scsi3addr, 
-                 InquiryData_struct *buf)
+                 unsigned char *buf, unsigned char bufsize)
 {
         int rc;
         CommandList_struct *cp;
@@ -900,11 +901,10 @@ cciss_scsi_do_inquiry(ctlr_info_t *c, unsigned char *scsi3addr,
         cdb[1] = 0;
         cdb[2] = 0;
         cdb[3] = 0;
-        cdb[4] = sizeof(*buf) & 0xff;
+        cdb[4] = bufsize;
         cdb[5] = 0;
         rc = cciss_scsi_do_simple_cmd(c, cp, scsi3addr, cdb, 
-                                6, (unsigned char *) buf, 
-                                sizeof(*buf), XFER_READ);
+                                6, buf, bufsize, XFER_READ);
 
         if (rc != 0) return rc; /* something went wrong */
 
@@ -1000,9 +1000,10 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
            that though.  
 
          */
-
+#define OBDR_TAPE_INQ_SIZE 49
+#define OBDR_TAPE_SIG "$DR-10"
         ReportLunData_struct *ld_buff;
-        InquiryData_struct *inq_buff;
+        unsigned char *inq_buff;
         unsigned char scsi3addr[8];
         ctlr_info_t *c;
         __u32 num_luns=0;
@@ -1020,7 +1021,7 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
                 return;
         }
         memset(ld_buff, 0, reportlunsize);
-        inq_buff = kmalloc(sizeof( InquiryData_struct), GFP_KERNEL);
+        inq_buff = kmalloc(OBDR_TAPE_INQ_SIZE, GFP_KERNEL);
         if (inq_buff == NULL) {
                 printk(KERN_ERR "cciss: out of memory\n");
                 kfree(ld_buff);
@@ -1051,19 +1052,36 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
 
                 /* for each physical lun, do an inquiry */
                 if (ld_buff->LUN[i][3] & 0xC0) continue;
-                memset(inq_buff, 0, sizeof(InquiryData_struct));
+                memset(inq_buff, 0, OBDR_TAPE_INQ_SIZE);
                 memcpy(&scsi3addr[0], &ld_buff->LUN[i][0], 8);
 
-                if (cciss_scsi_do_inquiry(hba[cntl_num], 
-                        scsi3addr, inq_buff) != 0)
-                {
+                if (cciss_scsi_do_inquiry(hba[cntl_num], scsi3addr, inq_buff,
+                        (unsigned char) OBDR_TAPE_INQ_SIZE) != 0) {
                         /* Inquiry failed (msg printed already) */
                         devtype = 0; /* so we will skip this device. */
                 } else /* what kind of device is this? */
-                        devtype = (inq_buff->data_byte[0] & 0x1f);
+                        devtype = (inq_buff[0] & 0x1f);
 
                 switch (devtype)
                 {
+                  case 0x05: /* CD-ROM */ {
+
+                        /* We don't *really* support actual CD-ROM devices,
+                         * just this "One Button Disaster Recovery" tape drive
+                         * which temporarily pretends to be a CD-ROM drive.
+                         * So we check that the device is really an OBDR tape
+                         * device by checking for "$DR-10" in bytes 43-48 of
+                         * the inquiry data.
+                         */
+                                char obdr_sig[7];
+
+                                strncpy(obdr_sig, &inq_buff[43], 6);
+                                obdr_sig[6] = '\0';
+                                if (strncmp(obdr_sig, OBDR_TAPE_SIG, 6) != 0)
+                                        /* Not OBDR device, ignore it. */
+                                        break;
+                        }
+                        /* fall through . . . */
                   case 0x01: /* sequential access, (tape) */
                   case 0x08: /* medium changer */
                         if (ncurrent >= CCISS_MAX_SCSI_DEVS_PER_HBA) {
@@ -1126,6 +1144,7 @@ cciss_scsi_proc_info(struct Scsi_Host *sh,
 
         int buflen, datalen;
         ctlr_info_t *ci;
+        int i;
         int cntl_num;
 
 
@@ -1136,8 +1155,28 @@ cciss_scsi_proc_info(struct Scsi_Host *sh,
         cntl_num = ci->ctlr;    /* Get our index into the hba[] array */
 
         if (func == 0) {        /* User is reading from /proc/scsi/ciss*?/?*  */
-                buflen = sprintf(buffer, "hostnum=%d\n", sh->host_no);  
-
+                buflen = sprintf(buffer, "cciss%d: SCSI host: %d\n",
+                                cntl_num, sh->host_no);
+
+                /* this information is needed by apps to know which cciss
+                   device corresponds to which scsi host number without
+                   having to open a scsi target device node.  The device
+                   information is not a duplicate of /proc/scsi/scsi because
+                   the two may be out of sync due to scsi hotplug, rather
+                   this info is for an app to be able to use to know how to
+                   get them back in sync. */
+
+                for (i=0;i<ccissscsi[cntl_num].ndevices;i++) {
+                        struct cciss_scsi_dev_t *sd = &ccissscsi[cntl_num].dev[i];
+                        buflen += sprintf(&buffer[buflen], "c%db%dt%dl%d %02d "
+                                "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
+                                sh->host_no, sd->bus, sd->target, sd->lun,
+                                sd->devtype,
+                                sd->scsi3addr[0], sd->scsi3addr[1],
+                                sd->scsi3addr[2], sd->scsi3addr[3],
+                                sd->scsi3addr[4], sd->scsi3addr[5],
+                                sd->scsi3addr[6], sd->scsi3addr[7]);
+                }
                 datalen = buflen - offset;
                 if (datalen < 0) {      /* they're reading past EOF. */
                         datalen = 0;
@@ -1399,7 +1438,7 @@ cciss_proc_tape_report(int ctlr, unsigned char *buffer, off_t *pos, off_t *len)
 
         CPQ_TAPE_LOCK(ctlr, flags);
         size = sprintf(buffer + *len, 
-                "       Sequential access devices: %d\n\n",
+                "Sequential access devices: %d\n\n",
                         ccissscsi[ctlr].ndevices);
         CPQ_TAPE_UNLOCK(ctlr, flags);
         *pos += size; *len += size;
diff --git a/drivers/block/ll_rw_blk.c b/drivers/block/ll_rw_blk.c
index 483d71b10cf9..baedac522945 100644
--- a/drivers/block/ll_rw_blk.c
+++ b/drivers/block/ll_rw_blk.c
@@ -2373,44 +2373,6 @@ int blkdev_issue_flush(struct block_device *bdev, sector_t *error_sector)
 
 EXPORT_SYMBOL(blkdev_issue_flush);
 
-/**
- * blkdev_scsi_issue_flush_fn - issue flush for SCSI devices
- * @q:          device queue
- * @disk:       gendisk
- * @error_sector:       error offset
- *
- * Description:
- *    Devices understanding the SCSI command set, can use this function as
- *    a helper for issuing a cache flush. Note: driver is required to store
- *    the error offset (in case of error flushing) in ->sector of struct
- *    request.
- */
-int blkdev_scsi_issue_flush_fn(request_queue_t *q, struct gendisk *disk,
-                               sector_t *error_sector)
-{
-        struct request *rq = blk_get_request(q, WRITE, __GFP_WAIT);
-        int ret;
-
-        rq->flags |= REQ_BLOCK_PC | REQ_SOFTBARRIER;
-        rq->sector = 0;
-        memset(rq->cmd, 0, sizeof(rq->cmd));
-        rq->cmd[0] = 0x35;
-        rq->cmd_len = 12;
-        rq->data = NULL;
-        rq->data_len = 0;
-        rq->timeout = 60 * HZ;
-
-        ret = blk_execute_rq(q, disk, rq, 0);
-
-        if (ret && error_sector)
-                *error_sector = rq->sector;
-
-        blk_put_request(rq);
-        return ret;
-}
-
-EXPORT_SYMBOL(blkdev_scsi_issue_flush_fn);
-
 static void drive_stat_acct(struct request *rq, int nr_sectors, int new_io)
 {
         int rw = rq_data_dir(rq);
diff --git a/drivers/block/paride/pf.c b/drivers/block/paride/pf.c
index 711d2f314ac3..94af920465b5 100644
--- a/drivers/block/paride/pf.c
+++ b/drivers/block/paride/pf.c
@@ -750,6 +750,14 @@ static int pf_ready(void)
 
 static struct request_queue *pf_queue;
 
+static void pf_end_request(int uptodate)
+{
+        if (pf_req) {
+                end_request(pf_req, uptodate);
+                pf_req = NULL;
+        }
+}
+
 static void do_pf_request(request_queue_t * q)
 {
         if (pf_busy)
@@ -765,7 +773,7 @@ repeat:
         pf_count = pf_req->current_nr_sectors;
 
         if (pf_block + pf_count > get_capacity(pf_req->rq_disk)) {
-                end_request(pf_req, 0);
+                pf_end_request(0);
                 goto repeat;
         }
 
@@ -780,7 +788,7 @@ repeat:
                 pi_do_claimed(pf_current->pi, do_pf_write);
         else {
                 pf_busy = 0;
-                end_request(pf_req, 0);
+                pf_end_request(0);
                 goto repeat;
         }
 }
@@ -798,9 +806,11 @@ static int pf_next_buf(void)
         if (!pf_count)
                 return 1;
         spin_lock_irqsave(&pf_spin_lock, saved_flags);
-        end_request(pf_req, 1);
-        pf_count = pf_req->current_nr_sectors;
-        pf_buf = pf_req->buffer;
+        pf_end_request(1);
+        if (pf_req) {
+                pf_count = pf_req->current_nr_sectors;
+                pf_buf = pf_req->buffer;
+        }
         spin_unlock_irqrestore(&pf_spin_lock, saved_flags);
         return 1;
 }
@@ -810,7 +820,7 @@ static inline void next_request(int success)
         unsigned long saved_flags;
 
         spin_lock_irqsave(&pf_spin_lock, saved_flags);
-        end_request(pf_req, success);
+        pf_end_request(success);
         pf_busy = 0;
         do_pf_request(pf_queue);
         spin_unlock_irqrestore(&pf_spin_lock, saved_flags);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 7b838342f0a3..7e22a58926b8 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -5,29 +5,41 @@
  * May be copied or modified under the terms of the GNU General Public
  * License.  See linux/COPYING for more information.
  *
- * Packet writing layer for ATAPI and SCSI CD-R, CD-RW, DVD-R, and
- * DVD-RW devices (aka an exercise in block layer masturbation)
+ * Packet writing layer for ATAPI and SCSI CD-RW, DVD+RW, DVD-RW and
+ * DVD-RAM devices.
  *
+ * Theory of operation:
  *
- * TODO: (circa order of when I will fix it)
- * - Only able to write on CD-RW media right now.
- * - check host application code on media and set it in write page
- * - interface for UDF <-> packet to negotiate a new location when a write
- *   fails.
- * - handle OPC, especially for -RW media
+ * At the lowest level, there is the standard driver for the CD/DVD device,
+ * typically ide-cd.c or sr.c. This driver can handle read and write requests,
+ * but it doesn't know anything about the special restrictions that apply to
+ * packet writing. One restriction is that write requests must be aligned to
+ * packet boundaries on the physical media, and the size of a write request
+ * must be equal to the packet size. Another restriction is that a
+ * GPCMD_FLUSH_CACHE command has to be issued to the drive before a read
+ * command, if the previous command was a write.
  *
- * Theory of operation:
+ * The purpose of the packet writing driver is to hide these restrictions from
+ * higher layers, such as file systems, and present a block device that can be
+ * randomly read and written using 2kB-sized blocks.
+ *
+ * The lowest layer in the packet writing driver is the packet I/O scheduler.
+ * Its data is defined by the struct packet_iosched and includes two bio
+ * queues with pending read and write requests. These queues are processed
+ * by the pkt_iosched_process_queue() function. The write requests in this
+ * queue are already properly aligned and sized. This layer is responsible for
+ * issuing the flush cache commands and scheduling the I/O in a good order.
  *
- * We use a custom make_request_fn function that forwards reads directly to
- * the underlying CD device. Write requests are either attached directly to
- * a live packet_data object, or simply stored sequentially in a list for
- * later processing by the kcdrwd kernel thread. This driver doesn't use
- * any elevator functionally as defined by the elevator_s struct, but the
- * underlying CD device uses a standard elevator.
+ * The next layer transforms unaligned write requests to aligned writes. This
+ * transformation requires reading missing pieces of data from the underlying
+ * block device, assembling the pieces to full packets and queuing them to the
+ * packet I/O scheduler.
  *
- * This strategy makes it possible to do very late merging of IO requests.
- * A new bio sent to pkt_make_request can be merged with a live packet_data
- * object even if the object is in the data gathering state.
+ * At the top layer there is a custom make_request_fn function that forwards
+ * read requests directly to the iosched queue and puts write requests in the
+ * unaligned write queue. A kernel thread performs the necessary read
+ * gathering to convert the unaligned writes to aligned writes and then feeds
+ * them to the packet I/O scheduler.
  *
  *************************************************************************/
 
@@ -100,10 +112,9 @@ static struct bio *pkt_bio_alloc(int nr_iovecs)
                 goto no_bio;
         bio_init(bio);
 
-        bvl = kmalloc(nr_iovecs * sizeof(struct bio_vec), GFP_KERNEL);
+        bvl = kcalloc(nr_iovecs, sizeof(struct bio_vec), GFP_KERNEL);
         if (!bvl)
                 goto no_bvl;
-        memset(bvl, 0, nr_iovecs * sizeof(struct bio_vec));
 
         bio->bi_max_vecs = nr_iovecs;
         bio->bi_io_vec = bvl;
@@ -125,10 +136,9 @@ static struct packet_data *pkt_alloc_packet_data(void)
         int i;
         struct packet_data *pkt;
 
-        pkt = kmalloc(sizeof(struct packet_data), GFP_KERNEL);
+        pkt = kzalloc(sizeof(struct packet_data), GFP_KERNEL);
         if (!pkt)
                 goto no_pkt;
-        memset(pkt, 0, sizeof(struct packet_data));
 
         pkt->w_bio = pkt_bio_alloc(PACKET_MAX_SIZE);
         if (!pkt->w_bio)
@@ -659,7 +669,6 @@ static void pkt_make_local_copy(struct packet_data *pkt, struct page **pages, in
                 }
                 offs += CD_FRAMESIZE;
                 if (offs >= PAGE_SIZE) {
-                        BUG_ON(offs > PAGE_SIZE);
                         offs = 0;
                         p++;
                 }
@@ -724,12 +733,6 @@ static void pkt_gather_data(struct pktcdvd_device *pd, struct packet_data *pkt)
         atomic_set(&pkt->io_wait, 0);
         atomic_set(&pkt->io_errors, 0);
 
-        if (pkt->cache_valid) {
-                VPRINTK("pkt_gather_data: zone %llx cached\n",
-                        (unsigned long long)pkt->sector);
-                goto out_account;
-        }
-
         /*
          * Figure out which frames we need to read before we can write.
          */
@@ -738,6 +741,7 @@ static void pkt_gather_data(struct pktcdvd_device *pd, struct packet_data *pkt)
         for (bio = pkt->orig_bios; bio; bio = bio->bi_next) {
                 int first_frame = (bio->bi_sector - pkt->sector) / (CD_FRAMESIZE >> 9);
                 int num_frames = bio->bi_size / CD_FRAMESIZE;
+                pd->stats.secs_w += num_frames * (CD_FRAMESIZE >> 9);
                 BUG_ON(first_frame < 0);
                 BUG_ON(first_frame + num_frames > pkt->frames);
                 for (f = first_frame; f < first_frame + num_frames; f++)
@@ -745,6 +749,12 @@ static void pkt_gather_data(struct pktcdvd_device *pd, struct packet_data *pkt)
         }
         spin_unlock(&pkt->lock);
 
+        if (pkt->cache_valid) {
+                VPRINTK("pkt_gather_data: zone %llx cached\n",
+                        (unsigned long long)pkt->sector);
+                goto out_account;
+        }
+
         /*
          * Schedule reads for missing parts of the packet.
          */
@@ -778,7 +788,6 @@ out_account:
                 frames_read, (unsigned long long)pkt->sector);
         pd->stats.pkt_started++;
         pd->stats.secs_rg += frames_read * (CD_FRAMESIZE >> 9);
-        pd->stats.secs_w += pd->settings.size;
 }
 
 /*
@@ -794,10 +803,11 @@ static struct packet_data *pkt_get_packet_data(struct pktcdvd_device *pd, int zo
                         list_del_init(&pkt->list);
                         if (pkt->sector != zone)
                                 pkt->cache_valid = 0;
-                        break;
+                        return pkt;
                 }
         }
-        return pkt;
+        BUG();
+        return NULL;
 }
 
 static void pkt_put_packet_data(struct pktcdvd_device *pd, struct packet_data *pkt)
@@ -941,12 +951,10 @@ try_next_bio:
         }
 
         pkt = pkt_get_packet_data(pd, zone);
-        BUG_ON(!pkt);
 
         pd->current_sector = zone + pd->settings.size;
         pkt->sector = zone;
         pkt->frames = pd->settings.size >> 2;
-        BUG_ON(pkt->frames > PACKET_MAX_SIZE);
         pkt->write_size = 0;
 
         /*
@@ -1636,6 +1644,10 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
                 printk("pktcdvd: detected zero packet size!\n");
                 pd->settings.size = 128;
         }
+        if (pd->settings.size > PACKET_MAX_SECTORS) {
+                printk("pktcdvd: packet size is too big\n");
+                return -ENXIO;
+        }
         pd->settings.fp = ti.fp;
         pd->offset = (be32_to_cpu(ti.track_start) << 2) & (pd->settings.size - 1);
 
@@ -2198,7 +2210,6 @@ static int pkt_make_request(request_queue_t *q, struct bio *bio)
          * No matching packet found. Store the bio in the work queue.
          */
         node = mempool_alloc(pd->rb_pool, GFP_NOIO);
-        BUG_ON(!node);
         node->bio = bio;
         spin_lock(&pd->lock);
         BUG_ON(pd->bio_queue_size < 0);
@@ -2406,7 +2417,6 @@ static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, u
         struct pktcdvd_device *pd = inode->i_bdev->bd_disk->private_data;
 
         VPRINTK("pkt_ioctl: cmd %x, dev %d:%d\n", cmd, imajor(inode), iminor(inode));
-        BUG_ON(!pd);
 
         switch (cmd) {
         /*
@@ -2477,10 +2487,9 @@ static int pkt_setup_dev(struct pkt_ctrl_command *ctrl_cmd)
                 return -EBUSY;
         }
 
-        pd = kmalloc(sizeof(struct pktcdvd_device), GFP_KERNEL);
+        pd = kzalloc(sizeof(struct pktcdvd_device), GFP_KERNEL);
         if (!pd)
                 return ret;
-        memset(pd, 0, sizeof(struct pktcdvd_device));
 
         pd->rb_pool = mempool_create(PKT_RB_POOL_SIZE, pkt_rb_alloc, pkt_rb_free, NULL);
         if (!pd->rb_pool)
diff --git a/drivers/block/scsi_ioctl.c b/drivers/block/scsi_ioctl.c
index 856c2278e9d0..079ec344eb47 100644
--- a/drivers/block/scsi_ioctl.c
+++ b/drivers/block/scsi_ioctl.c
@@ -168,6 +168,7 @@ static int verify_command(struct file *file, unsigned char *cmd)
                 safe_for_write(WRITE_VERIFY_12),
                 safe_for_write(WRITE_16),
                 safe_for_write(WRITE_LONG),
+                safe_for_write(WRITE_LONG_2),
                 safe_for_write(ERASE),
                 safe_for_write(GPCMD_MODE_SELECT_10),
                 safe_for_write(MODE_SELECT),
diff --git a/drivers/block/ub.c b/drivers/block/ub.c
index aa0bf7ee008d..ed4d5006fe62 100644
--- a/drivers/block/ub.c
+++ b/drivers/block/ub.c
@@ -172,7 +172,7 @@ struct bulk_cs_wrap {
  */
 struct ub_dev;
 
-#define UB_MAX_REQ_SG   4
+#define UB_MAX_REQ_SG   9       /* cdrecord requires 32KB and maybe a header */
 #define UB_MAX_SECTORS 64
 
 /*
@@ -387,7 +387,7 @@ struct ub_dev {
         struct bulk_cs_wrap work_bcs;
         struct usb_ctrlrequest work_cr;
 
-        int sg_stat[UB_MAX_REQ_SG+1];
+        int sg_stat[6];
         struct ub_scsi_trace tr;
 };
 
@@ -525,12 +525,13 @@ static ssize_t ub_diag_show(struct device *dev, struct device_attribute *attr,
             "qlen %d qmax %d\n",
             sc->cmd_queue.qlen, sc->cmd_queue.qmax);
         cnt += sprintf(page + cnt,
-            "sg %d %d %d %d %d\n",
+            "sg %d %d %d %d %d .. %d\n",
             sc->sg_stat[0],
             sc->sg_stat[1],
             sc->sg_stat[2],
             sc->sg_stat[3],
-            sc->sg_stat[4]);
+            sc->sg_stat[4],
+            sc->sg_stat[5]);
 
         list_for_each (p, &sc->luns) {
                 lun = list_entry(p, struct ub_lun, link);
@@ -835,7 +836,7 @@ static int ub_cmd_build_block(struct ub_dev *sc, struct ub_lun *lun,
                 return -1;
         }
         cmd->nsg = n_elem;
-        sc->sg_stat[n_elem]++;
+        sc->sg_stat[n_elem < 5 ? n_elem : 5]++;
 
         /*
          * build the command
@@ -891,7 +892,7 @@ static int ub_cmd_build_packet(struct ub_dev *sc, struct ub_lun *lun,
                 return -1;
         }
         cmd->nsg = n_elem;
-        sc->sg_stat[n_elem]++;
+        sc->sg_stat[n_elem < 5 ? n_elem : 5]++;
 
         memcpy(&cmd->cdb, rq->cmd, rq->cmd_len);
         cmd->cdb_len = rq->cmd_len;
@@ -1010,7 +1011,6 @@ static int ub_scsi_cmd_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
         sc->last_pipe = sc->send_bulk_pipe;
         usb_fill_bulk_urb(&sc->work_urb, sc->dev, sc->send_bulk_pipe,
             bcb, US_BULK_CB_WRAP_LEN, ub_urb_complete, sc);
-        sc->work_urb.transfer_flags = 0;
 
         /* Fill what we shouldn't be filling, because usb-storage did so. */
         sc->work_urb.actual_length = 0;
@@ -1019,7 +1019,6 @@ static int ub_scsi_cmd_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 
         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
                 /* XXX Clear stalls */
-                printk("ub: cmd #%d start failed (%d)\n", cmd->tag, rc); /* P3 */
                 ub_complete(&sc->work_done);
                 return rc;
         }
@@ -1190,11 +1189,9 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                         return;
                 }
                 if (urb->status != 0) {
-                        printk("ub: cmd #%d cmd status (%d)\n", cmd->tag, urb->status); /* P3 */
                         goto Bad_End;
                 }
                 if (urb->actual_length != US_BULK_CB_WRAP_LEN) {
-                        printk("ub: cmd #%d xferred %d\n", cmd->tag, urb->actual_length); /* P3 */
                         /* XXX Must do reset here to unconfuse the device */
                         goto Bad_End;
                 }
@@ -1395,14 +1392,12 @@ static void ub_data_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
         usb_fill_bulk_urb(&sc->work_urb, sc->dev, pipe,
             page_address(sg->page) + sg->offset, sg->length,
             ub_urb_complete, sc);
-        sc->work_urb.transfer_flags = 0;
         sc->work_urb.actual_length = 0;
         sc->work_urb.error_count = 0;
         sc->work_urb.status = 0;
 
         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
                 /* XXX Clear stalls */
-                printk("ub: data #%d submit failed (%d)\n", cmd->tag, rc); /* P3 */
                 ub_complete(&sc->work_done);
                 ub_state_done(sc, cmd, rc);
                 return;
@@ -1442,7 +1437,6 @@ static int __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
         sc->last_pipe = sc->recv_bulk_pipe;
         usb_fill_bulk_urb(&sc->work_urb, sc->dev, sc->recv_bulk_pipe,
             &sc->work_bcs, US_BULK_CS_WRAP_LEN, ub_urb_complete, sc);
-        sc->work_urb.transfer_flags = 0;
         sc->work_urb.actual_length = 0;
         sc->work_urb.error_count = 0;
         sc->work_urb.status = 0;
@@ -1563,7 +1557,6 @@ static int ub_submit_clear_stall(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
 
         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
             (unsigned char*) cr, NULL, 0, ub_urb_complete, sc);
-        sc->work_urb.transfer_flags = 0;
         sc->work_urb.actual_length = 0;
         sc->work_urb.error_count = 0;
         sc->work_urb.status = 0;
@@ -2000,17 +1993,16 @@ static int ub_sync_getmaxlun(struct ub_dev *sc)
 
         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->recv_ctrl_pipe,
             (unsigned char*) cr, p, 1, ub_probe_urb_complete, &compl);
-        sc->work_urb.transfer_flags = 0;
         sc->work_urb.actual_length = 0;
         sc->work_urb.error_count = 0;
         sc->work_urb.status = 0;
 
         if ((rc = usb_submit_urb(&sc->work_urb, GFP_KERNEL)) != 0) {
                 if (rc == -EPIPE) {
-                        printk("%s: Stall at GetMaxLUN, using 1 LUN\n",
+                        printk("%s: Stall submitting GetMaxLUN, using 1 LUN\n",
                              sc->name); /* P3 */
                 } else {
-                        printk(KERN_WARNING
+                        printk(KERN_NOTICE
                              "%s: Unable to submit GetMaxLUN (%d)\n",
                              sc->name, rc);
                 }
@@ -2028,6 +2020,18 @@ static int ub_sync_getmaxlun(struct ub_dev *sc)
         del_timer_sync(&timer);
         usb_kill_urb(&sc->work_urb);
 
+        if ((rc = sc->work_urb.status) < 0) {
+                if (rc == -EPIPE) {
+                        printk("%s: Stall at GetMaxLUN, using 1 LUN\n",
+                             sc->name); /* P3 */
+                } else {
+                        printk(KERN_NOTICE
+                             "%s: Error at GetMaxLUN (%d)\n",
+                             sc->name, rc);
+                }
+                goto err_io;
+        }
+
         if (sc->work_urb.actual_length != 1) {
                 printk("%s: GetMaxLUN returned %d bytes\n", sc->name,
                     sc->work_urb.actual_length); /* P3 */
@@ -2048,6 +2052,7 @@ static int ub_sync_getmaxlun(struct ub_dev *sc)
         kfree(p);
         return nluns;
 
+err_io:
 err_submit:
         kfree(p);
 err_alloc:
@@ -2080,7 +2085,6 @@ static int ub_probe_clear_stall(struct ub_dev *sc, int stalled_pipe)
 
         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
             (unsigned char*) cr, NULL, 0, ub_probe_urb_complete, &compl);
-        sc->work_urb.transfer_flags = 0;
         sc->work_urb.actual_length = 0;
         sc->work_urb.error_count = 0;
         sc->work_urb.status = 0;
@@ -2213,8 +2217,10 @@ static int ub_probe(struct usb_interface *intf,
          * This is needed to clear toggles. It is a problem only if we do
          * `rmmod ub && modprobe ub` without disconnects, but we like that.
          */
+#if 0 /* iPod Mini fails if we do this (big white iPod works) */
         ub_probe_clear_stall(sc, sc->recv_bulk_pipe);
         ub_probe_clear_stall(sc, sc->send_bulk_pipe);
+#endif
 
         /*
          * The way this is used by the startup code is a little specific.
@@ -2241,10 +2247,10 @@ static int ub_probe(struct usb_interface *intf,
         for (i = 0; i < 3; i++) {
                 if ((rc = ub_sync_getmaxlun(sc)) < 0) {
                         /* 
-                         * Some devices (i.e. Iomega Zip100) need this --
-                         * apparently the bulk pipes get STALLed when the
-                         * GetMaxLUN request is processed.
-                         * XXX I have a ZIP-100, verify it does this.
+                         * This segment is taken from usb-storage. They say
+                         * that ZIP-100 needs this, but my own ZIP-100 works
+                         * fine without this.
+                         * Still, it does not seem to hurt anything.
                          */
                         if (rc == -EPIPE) {
                                 ub_probe_clear_stall(sc, sc->recv_bulk_pipe);
@@ -2313,7 +2319,7 @@ static int ub_probe_lun(struct ub_dev *sc, int lnum)
         disk->first_minor = lun->id * UB_MINORS_PER_MAJOR;
         disk->fops = &ub_bd_fops;
         disk->private_data = lun;
-        disk->driverfs_dev = &sc->intf->dev;    /* XXX Many to one ok? */
+        disk->driverfs_dev = &sc->intf->dev;
 
         rc = -ENOMEM;
         if ((q = blk_init_queue(ub_request_fn, &sc->lock)) == NULL)
@@ -2466,9 +2472,6 @@ static int __init ub_init(void)
 {
         int rc;
 
-        /* P3 */ printk("ub: sizeof ub_scsi_cmd %zu ub_dev %zu ub_lun %zu\n",
-                        sizeof(struct ub_scsi_cmd), sizeof(struct ub_dev), sizeof(struct ub_lun));
-
         if ((rc = register_blkdev(UB_MAJOR, DRV_NAME)) != 0)
                 goto err_regblkdev;
         devfs_mk_dir(DEVFS_NAME);