9 files changed, 239 insertions, 129 deletions

diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index b594768b0241..51b0af1cebee 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -6,7 +6,7 @@ menu "Block devices"
 
 config BLK_DEV_FD
         tristate "Normal floppy disk support"
-        depends on (!ARCH_S390 && !M68K && !IA64 && !UML && !ARM) || Q40 || (SUN3X && BROKEN) || ARCH_RPC || ARCH_EBSA285
+        depends on ARCH_MAY_HAVE_PC_FDC
         ---help---
           If you want to use the floppy disk drive(s) of your PC under Linux,
           say Y. Information about this driver, especially important for IBM
@@ -408,54 +408,12 @@ config BLK_DEV_INITRD
           "real" root file system, etc. See <file:Documentation/initrd.txt>
           for details.
 
-config INITRAMFS_SOURCE
-        string "Initramfs source file(s)"
-        default ""
-        help
-          This can be either a single cpio archive with a .cpio suffix or a
-          space-separated list of directories and files for building the
-          initramfs image.  A cpio archive should contain a filesystem archive
-          to be used as an initramfs image.  Directories should contain a
-          filesystem layout to be included in the initramfs image.  Files
-          should contain entries according to the format described by the
-          "usr/gen_init_cpio" program in the kernel tree.
-
-          When multiple directories and files are specified then the
-          initramfs image will be the aggregate of all of them.
-
-          See <file:Documentation/early-userspace/README for more details.
-
-          If you are not sure, leave it blank.
-
-config INITRAMFS_ROOT_UID
-        int "User ID to map to 0 (user root)"
-        depends on INITRAMFS_SOURCE!=""
-        default "0"
-        help
-          This setting is only meaningful if the INITRAMFS_SOURCE is
-          contains a directory.  Setting this user ID (UID) to something
-          other than "0" will cause all files owned by that UID to be
-          owned by user root in the initial ramdisk image.
-
-          If you are not sure, leave it set to "0".
-
-config INITRAMFS_ROOT_GID
-        int "Group ID to map to 0 (group root)"
-        depends on INITRAMFS_SOURCE!=""
-        default "0"
-        help
-          This setting is only meaningful if the INITRAMFS_SOURCE is
-          contains a directory.  Setting this group ID (GID) to something
-          other than "0" will cause all files owned by that GID to be
-          owned by group root in the initial ramdisk image.
-
-          If you are not sure, leave it set to "0".
 
 #XXX - it makes sense to enable this only for 32-bit subarch's, not for x86_64
 #for instance.
 config LBD
         bool "Support for Large Block Devices"
-        depends on X86 || MIPS32 || PPC32 || ARCH_S390_31 || SUPERH || UML
+        depends on X86 || (MIPS && 32BIT) || PPC32 || ARCH_S390_31 || SUPERH || UML
         help
           Say Y here if you want to attach large (bigger than 2TB) discs to
           your machine, or if you want to have a raid or loopback device
diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c
index 6e231c5a1199..ded33ba31acc 100644
--- a/drivers/block/aoe/aoedev.c
+++ b/drivers/block/aoe/aoedev.c
@@ -35,7 +35,7 @@ aoedev_newdev(ulong nframes)
         struct aoedev *d;
         struct frame *f, *e;
 
-        d = kcalloc(1, sizeof *d, GFP_ATOMIC);
+        d = kzalloc(sizeof *d, GFP_ATOMIC);
         if (d == NULL)
                 return NULL;
         f = kcalloc(nframes, sizeof *f, GFP_ATOMIC);
diff --git a/drivers/block/cfq-iosched.c b/drivers/block/cfq-iosched.c
index cd056e7e64ec..30c0903c7cdd 100644
--- a/drivers/block/cfq-iosched.c
+++ b/drivers/block/cfq-iosched.c
@@ -2260,8 +2260,6 @@ static void cfq_put_cfqd(struct cfq_data *cfqd)
         if (!atomic_dec_and_test(&cfqd->ref))
                 return;
 
-        blk_put_queue(q);
-
         cfq_shutdown_timer_wq(cfqd);
         q->elevator->elevator_data = NULL;
 
@@ -2318,7 +2316,6 @@ static int cfq_init_queue(request_queue_t *q, elevator_t *e)
         e->elevator_data = cfqd;
 
         cfqd->queue = q;
-        atomic_inc(&q->refcnt);
 
         cfqd->max_queued = q->nr_requests / 4;
         q->nr_batching = cfq_queued;
diff --git a/drivers/block/cryptoloop.c b/drivers/block/cryptoloop.c
index 5be6f998d8c5..3d4261c39f16 100644
--- a/drivers/block/cryptoloop.c
+++ b/drivers/block/cryptoloop.c
@@ -57,9 +57,11 @@ cryptoloop_init(struct loop_device *lo, const struct loop_info64 *info)
         mode = strsep(&cmsp, "-");
 
         if (mode == NULL || strcmp(mode, "cbc") == 0)
-                tfm = crypto_alloc_tfm(cipher, CRYPTO_TFM_MODE_CBC);
+                tfm = crypto_alloc_tfm(cipher, CRYPTO_TFM_MODE_CBC |
+                                               CRYPTO_TFM_REQ_MAY_SLEEP);
         else if (strcmp(mode, "ecb") == 0)
-                tfm = crypto_alloc_tfm(cipher, CRYPTO_TFM_MODE_ECB);
+                tfm = crypto_alloc_tfm(cipher, CRYPTO_TFM_MODE_ECB |
+                                               CRYPTO_TFM_REQ_MAY_SLEEP);
         if (tfm == NULL)
                 return -EINVAL;
 
diff --git a/drivers/block/deadline-iosched.c b/drivers/block/deadline-iosched.c
index ff5201e02153..24594c57c323 100644
--- a/drivers/block/deadline-iosched.c
+++ b/drivers/block/deadline-iosched.c
@@ -507,18 +507,12 @@ static int deadline_dispatch_requests(struct deadline_data *dd)
         const int reads = !list_empty(&dd->fifo_list[READ]);
         const int writes = !list_empty(&dd->fifo_list[WRITE]);
         struct deadline_rq *drq;
-        int data_dir, other_dir;
+        int data_dir;
 
         /*
          * batches are currently reads XOR writes
          */
-        drq = NULL;
-
-        if (dd->next_drq[READ])
-                drq = dd->next_drq[READ];
-
-        if (dd->next_drq[WRITE])
-                drq = dd->next_drq[WRITE];
+        drq = dd->next_drq[WRITE] ? : dd->next_drq[READ];
 
         if (drq) {
                 /* we have a "next request" */
@@ -544,7 +538,6 @@ static int deadline_dispatch_requests(struct deadline_data *dd)
                         goto dispatch_writes;
 
                 data_dir = READ;
-                other_dir = WRITE;
 
                 goto dispatch_find_request;
         }
@@ -560,7 +553,6 @@ dispatch_writes:
                 dd->starved = 0;
 
                 data_dir = WRITE;
-                other_dir = READ;
 
                 goto dispatch_find_request;
         }
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index f0c1084b840f..888dad5eef34 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -493,6 +493,8 @@ static struct floppy_struct user_params[N_DRIVE];
 
 static sector_t floppy_sizes[256];
 
+static char floppy_device_name[] = "floppy";
+
 /*
  * The driver is trying to determine the correct media format
  * while probing is set. rw_interrupt() clears it after a
@@ -4191,18 +4193,24 @@ static int __init floppy_setup(char *str)
 
 static int have_no_fdc = -ENODEV;
 
+static ssize_t floppy_cmos_show(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        struct platform_device *p;
+        int drive;
+
+        p = container_of(dev, struct platform_device,dev);
+        drive = p->id;
+        return sprintf(buf, "%X\n", UDP->cmos);
+}
+DEVICE_ATTR(cmos,S_IRUGO,floppy_cmos_show,NULL);
+
 static void floppy_device_release(struct device *dev)
 {
         complete(&device_release);
 }
 
-static struct platform_device floppy_device = {
-        .name           = "floppy",
-        .id             = 0,
-        .dev            = {
-                        .release = floppy_device_release,
-                        }
-};
+static struct platform_device floppy_device[N_DRIVE];
 
 static struct kobject *floppy_find(dev_t dev, int *part, void *data)
 {
@@ -4370,20 +4378,26 @@ static int __init floppy_init(void)
                 goto out_flush_work;
         }
 
-        err = platform_device_register(&floppy_device);
-        if (err)
-                goto out_flush_work;
-
         for (drive = 0; drive < N_DRIVE; drive++) {
                 if (!(allowed_drive_mask & (1 << drive)))
                         continue;
                 if (fdc_state[FDC(drive)].version == FDC_NONE)
                         continue;
+
+                floppy_device[drive].name = floppy_device_name;
+                floppy_device[drive].id = drive;
+                floppy_device[drive].dev.release = floppy_device_release;
+
+                err = platform_device_register(&floppy_device[drive]);
+                if (err)
+                        goto out_flush_work;
+
+                device_create_file(&floppy_device[drive].dev,&dev_attr_cmos);
                 /* to be cleaned up... */
                 disks[drive]->private_data = (void *)(long)drive;
                 disks[drive]->queue = floppy_queue;
                 disks[drive]->flags |= GENHD_FL_REMOVABLE;
-                disks[drive]->driverfs_dev = &floppy_device.dev;
+                disks[drive]->driverfs_dev = &floppy_device[drive].dev;
                 add_disk(disks[drive]);
         }
 
@@ -4603,10 +4617,11 @@ void cleanup_module(void)
                     fdc_state[FDC(drive)].version != FDC_NONE) {
                         del_gendisk(disks[drive]);
                         unregister_devfs_entries(drive);
+                        device_remove_file(&floppy_device[drive].dev, &dev_attr_cmos);
+                        platform_device_unregister(&floppy_device[drive]);
                 }
                 put_disk(disks[drive]);
         }
-        platform_device_unregister(&floppy_device);
         devfs_remove("floppy");
 
         del_timer_sync(&fd_timeout);
diff --git a/drivers/block/genhd.c b/drivers/block/genhd.c
index 47fd3659a061..d42840cc0d1d 100644
--- a/drivers/block/genhd.c
+++ b/drivers/block/genhd.c
@@ -45,7 +45,7 @@ int get_blkdev_list(char *p, int used)
         struct blk_major_name *n;
         int i, len;
 
-        len = sprintf(p, "\nBlock devices:\n");
+        len = snprintf(p, (PAGE_SIZE-used), "\nBlock devices:\n");
 
         down(&block_subsys_sem);
         for (i = 0; i < ARRAY_SIZE(major_names); i++) {
diff --git a/drivers/block/ll_rw_blk.c b/drivers/block/ll_rw_blk.c
index 3c818544475e..483d71b10cf9 100644
--- a/drivers/block/ll_rw_blk.c
+++ b/drivers/block/ll_rw_blk.c
@@ -235,8 +235,8 @@ void blk_queue_make_request(request_queue_t * q, make_request_fn * mfn)
          * set defaults
          */
         q->nr_requests = BLKDEV_MAX_RQ;
-        q->max_phys_segments = MAX_PHYS_SEGMENTS;
-        q->max_hw_segments = MAX_HW_SEGMENTS;
+        blk_queue_max_phys_segments(q, MAX_PHYS_SEGMENTS);
+        blk_queue_max_hw_segments(q, MAX_HW_SEGMENTS);
         q->make_request_fn = mfn;
         q->backing_dev_info.ra_pages = (VM_MAX_READAHEAD * 1024) / PAGE_CACHE_SIZE;
         q->backing_dev_info.state = 0;
@@ -284,6 +284,7 @@ static inline void rq_init(request_queue_t *q, struct request *rq)
         rq->special = NULL;
         rq->data_len = 0;
         rq->data = NULL;
+        rq->nr_phys_segments = 0;
         rq->sense = NULL;
         rq->end_io = NULL;
         rq->end_io_data = NULL;
@@ -2115,7 +2116,7 @@ EXPORT_SYMBOL(blk_insert_request);
 /**
  * blk_rq_map_user - map user data to a request, for REQ_BLOCK_PC usage
  * @q:          request queue where request should be inserted
- * @rw:         READ or WRITE data
+ * @rq:         request structure to fill
  * @ubuf:       the user buffer
  * @len:        length of user data
  *
@@ -2132,21 +2133,19 @@ EXPORT_SYMBOL(blk_insert_request);
  *    original bio must be passed back in to blk_rq_unmap_user() for proper
  *    unmapping.
  */
-struct request *blk_rq_map_user(request_queue_t *q, int rw, void __user *ubuf,
-                                unsigned int len)
+int blk_rq_map_user(request_queue_t *q, struct request *rq, void __user *ubuf,
+                    unsigned int len)
 {
         unsigned long uaddr;
-        struct request *rq;
         struct bio *bio;
+        int reading;
 
         if (len > (q->max_sectors << 9))
-                return ERR_PTR(-EINVAL);
-        if ((!len && ubuf) || (len && !ubuf))
-                return ERR_PTR(-EINVAL);
+                return -EINVAL;
+        if (!len || !ubuf)
+                return -EINVAL;
 
-        rq = blk_get_request(q, rw, __GFP_WAIT);
-        if (!rq)
-                return ERR_PTR(-ENOMEM);
+        reading = rq_data_dir(rq) == READ;
 
         /*
          * if alignment requirement is satisfied, map in user pages for
@@ -2154,9 +2153,9 @@ struct request *blk_rq_map_user(request_queue_t *q, int rw, void __user *ubuf,
          */
         uaddr = (unsigned long) ubuf;
         if (!(uaddr & queue_dma_alignment(q)) && !(len & queue_dma_alignment(q)))
-                bio = bio_map_user(q, NULL, uaddr, len, rw == READ);
+                bio = bio_map_user(q, NULL, uaddr, len, reading);
         else
-                bio = bio_copy_user(q, uaddr, len, rw == READ);
+                bio = bio_copy_user(q, uaddr, len, reading);
 
         if (!IS_ERR(bio)) {
                 rq->bio = rq->biotail = bio;
@@ -2164,28 +2163,70 @@ struct request *blk_rq_map_user(request_queue_t *q, int rw, void __user *ubuf,
 
                 rq->buffer = rq->data = NULL;
                 rq->data_len = len;
-                return rq;
+                return 0;
         }
 
         /*
          * bio is the err-ptr
          */
-        blk_put_request(rq);
-        return (struct request *) bio;
+        return PTR_ERR(bio);
 }
 
 EXPORT_SYMBOL(blk_rq_map_user);
 
 /**
+ * blk_rq_map_user_iov - map user data to a request, for REQ_BLOCK_PC usage
+ * @q:          request queue where request should be inserted
+ * @rq:         request to map data to
+ * @iov:        pointer to the iovec
+ * @iov_count:  number of elements in the iovec
+ *
+ * Description:
+ *    Data will be mapped directly for zero copy io, if possible. Otherwise
+ *    a kernel bounce buffer is used.
+ *
+ *    A matching blk_rq_unmap_user() must be issued at the end of io, while
+ *    still in process context.
+ *
+ *    Note: The mapped bio may need to be bounced through blk_queue_bounce()
+ *    before being submitted to the device, as pages mapped may be out of
+ *    reach. It's the callers responsibility to make sure this happens. The
+ *    original bio must be passed back in to blk_rq_unmap_user() for proper
+ *    unmapping.
+ */
+int blk_rq_map_user_iov(request_queue_t *q, struct request *rq,
+                        struct sg_iovec *iov, int iov_count)
+{
+        struct bio *bio;
+
+        if (!iov || iov_count <= 0)
+                return -EINVAL;
+
+        /* we don't allow misaligned data like bio_map_user() does.  If the
+         * user is using sg, they're expected to know the alignment constraints
+         * and respect them accordingly */
+        bio = bio_map_user_iov(q, NULL, iov, iov_count, rq_data_dir(rq)== READ);
+        if (IS_ERR(bio))
+                return PTR_ERR(bio);
+
+        rq->bio = rq->biotail = bio;
+        blk_rq_bio_prep(q, rq, bio);
+        rq->buffer = rq->data = NULL;
+        rq->data_len = bio->bi_size;
+        return 0;
+}
+
+EXPORT_SYMBOL(blk_rq_map_user_iov);
+
+/**
  * blk_rq_unmap_user - unmap a request with user data
- * @rq:         request to be unmapped
- * @bio:        bio for the request
+ * @bio:        bio to be unmapped
  * @ulen:       length of user buffer
  *
  * Description:
- *    Unmap a request previously mapped by blk_rq_map_user().
+ *    Unmap a bio previously mapped by blk_rq_map_user().
  */
-int blk_rq_unmap_user(struct request *rq, struct bio *bio, unsigned int ulen)
+int blk_rq_unmap_user(struct bio *bio, unsigned int ulen)
 {
         int ret = 0;
 
@@ -2196,31 +2237,89 @@ int blk_rq_unmap_user(struct request *rq, struct bio *bio, unsigned int ulen)
                         ret = bio_uncopy_user(bio);
         }
 
-        blk_put_request(rq);
-        return ret;
+        return 0;
 }
 
 EXPORT_SYMBOL(blk_rq_unmap_user);
 
 /**
+ * blk_rq_map_kern - map kernel data to a request, for REQ_BLOCK_PC usage
+ * @q:          request queue where request should be inserted
+ * @rq:         request to fill
+ * @kbuf:       the kernel buffer
+ * @len:        length of user data
+ * @gfp_mask:   memory allocation flags
+ */
+int blk_rq_map_kern(request_queue_t *q, struct request *rq, void *kbuf,
+                    unsigned int len, unsigned int gfp_mask)
+{
+        struct bio *bio;
+
+        if (len > (q->max_sectors << 9))
+                return -EINVAL;
+        if (!len || !kbuf)
+                return -EINVAL;
+
+        bio = bio_map_kern(q, kbuf, len, gfp_mask);
+        if (IS_ERR(bio))
+                return PTR_ERR(bio);
+
+        if (rq_data_dir(rq) == WRITE)
+                bio->bi_rw |= (1 << BIO_RW);
+
+        rq->bio = rq->biotail = bio;
+        blk_rq_bio_prep(q, rq, bio);
+
+        rq->buffer = rq->data = NULL;
+        rq->data_len = len;
+        return 0;
+}
+
+EXPORT_SYMBOL(blk_rq_map_kern);
+
+/**
+ * blk_execute_rq_nowait - insert a request into queue for execution
+ * @q:          queue to insert the request in
+ * @bd_disk:    matching gendisk
+ * @rq:         request to insert
+ * @at_head:    insert request at head or tail of queue
+ * @done:       I/O completion handler
+ *
+ * Description:
+ *    Insert a fully prepared request at the back of the io scheduler queue
+ *    for execution.  Don't wait for completion.
+ */
+void blk_execute_rq_nowait(request_queue_t *q, struct gendisk *bd_disk,
+                           struct request *rq, int at_head,
+                           void (*done)(struct request *))
+{
+        int where = at_head ? ELEVATOR_INSERT_FRONT : ELEVATOR_INSERT_BACK;
+
+        rq->rq_disk = bd_disk;
+        rq->flags |= REQ_NOMERGE;
+        rq->end_io = done;
+        elv_add_request(q, rq, where, 1);
+        generic_unplug_device(q);
+}
+
+/**
  * blk_execute_rq - insert a request into queue for execution
  * @q:          queue to insert the request in
  * @bd_disk:    matching gendisk
  * @rq:         request to insert
+ * @at_head:    insert request at head or tail of queue
  *
  * Description:
  *    Insert a fully prepared request at the back of the io scheduler queue
- *    for execution.
+ *    for execution and wait for completion.
  */
 int blk_execute_rq(request_queue_t *q, struct gendisk *bd_disk,
-                   struct request *rq)
+                   struct request *rq, int at_head)
 {
         DECLARE_COMPLETION(wait);
         char sense[SCSI_SENSE_BUFFERSIZE];
         int err = 0;
 
-        rq->rq_disk = bd_disk;
-
         /*
          * we need an extra reference to the request, so we can look at
          * it after io completion
@@ -2233,11 +2332,8 @@ int blk_execute_rq(request_queue_t *q, struct gendisk *bd_disk,
                 rq->sense_len = 0;
         }
 
-        rq->flags |= REQ_NOMERGE;
         rq->waiting = &wait;
-        rq->end_io = blk_end_sync_rq;
-        elv_add_request(q, rq, ELEVATOR_INSERT_BACK, 1);
-        generic_unplug_device(q);
+        blk_execute_rq_nowait(q, bd_disk, rq, at_head, blk_end_sync_rq);
         wait_for_completion(&wait);
         rq->waiting = NULL;
 
@@ -2277,6 +2373,44 @@ int blkdev_issue_flush(struct block_device *bdev, sector_t *error_sector)
 
 EXPORT_SYMBOL(blkdev_issue_flush);
 
+/**
+ * blkdev_scsi_issue_flush_fn - issue flush for SCSI devices
+ * @q:          device queue
+ * @disk:       gendisk
+ * @error_sector:       error offset
+ *
+ * Description:
+ *    Devices understanding the SCSI command set, can use this function as
+ *    a helper for issuing a cache flush. Note: driver is required to store
+ *    the error offset (in case of error flushing) in ->sector of struct
+ *    request.
+ */
+int blkdev_scsi_issue_flush_fn(request_queue_t *q, struct gendisk *disk,
+                               sector_t *error_sector)
+{
+        struct request *rq = blk_get_request(q, WRITE, __GFP_WAIT);
+        int ret;
+
+        rq->flags |= REQ_BLOCK_PC | REQ_SOFTBARRIER;
+        rq->sector = 0;
+        memset(rq->cmd, 0, sizeof(rq->cmd));
+        rq->cmd[0] = 0x35;
+        rq->cmd_len = 12;
+        rq->data = NULL;
+        rq->data_len = 0;
+        rq->timeout = 60 * HZ;
+
+        ret = blk_execute_rq(q, disk, rq, 0);
+
+        if (ret && error_sector)
+                *error_sector = rq->sector;
+
+        blk_put_request(rq);
+        return ret;
+}
+
+EXPORT_SYMBOL(blkdev_scsi_issue_flush_fn);
+
 static void drive_stat_acct(struct request *rq, int nr_sectors, int new_io)
 {
         int rw = rq_data_dir(rq);
diff --git a/drivers/block/scsi_ioctl.c b/drivers/block/scsi_ioctl.c
index 681871ca5d60..abb2df249fd3 100644
--- a/drivers/block/scsi_ioctl.c
+++ b/drivers/block/scsi_ioctl.c
@@ -216,7 +216,7 @@ static int sg_io(struct file *file, request_queue_t *q,
                 struct gendisk *bd_disk, struct sg_io_hdr *hdr)
 {
         unsigned long start_time;
-        int reading, writing;
+        int writing = 0, ret = 0;
         struct request *rq;
         struct bio *bio;
         char sense[SCSI_SENSE_BUFFERSIZE];
@@ -231,38 +231,48 @@ static int sg_io(struct file *file, request_queue_t *q,
         if (verify_command(file, cmd))
                 return -EPERM;
 
-        /*
-         * we'll do that later
-         */
-        if (hdr->iovec_count)
-                return -EOPNOTSUPP;
-
         if (hdr->dxfer_len > (q->max_sectors << 9))
                 return -EIO;
 
-        reading = writing = 0;
-        if (hdr->dxfer_len) {
+        if (hdr->dxfer_len)
                 switch (hdr->dxfer_direction) {
                 default:
                         return -EINVAL;
                 case SG_DXFER_TO_FROM_DEV:
-                        reading = 1;
-                        /* fall through */
                 case SG_DXFER_TO_DEV:
                         writing = 1;
                         break;
                 case SG_DXFER_FROM_DEV:
-                        reading = 1;
                         break;
                 }
 
-                rq = blk_rq_map_user(q, writing ? WRITE : READ, hdr->dxferp,
-                                     hdr->dxfer_len);
+        rq = blk_get_request(q, writing ? WRITE : READ, GFP_KERNEL);
+        if (!rq)
+                return -ENOMEM;
+
+        if (hdr->iovec_count) {
+                const int size = sizeof(struct sg_iovec) * hdr->iovec_count;
+                struct sg_iovec *iov;
+
+                iov = kmalloc(size, GFP_KERNEL);
+                if (!iov) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
+
+                if (copy_from_user(iov, hdr->dxferp, size)) {
+                        kfree(iov);
+                        ret = -EFAULT;
+                        goto out;
+                }
+
+                ret = blk_rq_map_user_iov(q, rq, iov, hdr->iovec_count);
+                kfree(iov);
+        } else if (hdr->dxfer_len)
+                ret = blk_rq_map_user(q, rq, hdr->dxferp, hdr->dxfer_len);
 
-                if (IS_ERR(rq))
-                        return PTR_ERR(rq);
-        } else
-                rq = blk_get_request(q, READ, __GFP_WAIT);
+        if (ret)
+                goto out;
 
         /*
          * fill in request structure
@@ -298,7 +308,7 @@ static int sg_io(struct file *file, request_queue_t *q,
          * (if he doesn't check that is his problem).
          * N.B. a non-zero SCSI status is _not_ necessarily an error.
          */
-        blk_execute_rq(q, bd_disk, rq);
+        blk_execute_rq(q, bd_disk, rq, 0);
 
         /* write to all output members */
         hdr->status = 0xff & rq->errors;
@@ -320,12 +330,14 @@ static int sg_io(struct file *file, request_queue_t *q,
                         hdr->sb_len_wr = len;
         }
 
-        if (blk_rq_unmap_user(rq, bio, hdr->dxfer_len))
-                return -EFAULT;
+        if (blk_rq_unmap_user(bio, hdr->dxfer_len))
+                ret = -EFAULT;
 
         /* may not have succeeded, but output values written to control
          * structure (struct sg_io_hdr).  */
-        return 0;
+out:
+        blk_put_request(rq);
+        return ret;
 }
 
 #define OMAX_SB_LEN 16          /* For backward compatibility */
@@ -408,7 +420,7 @@ static int sg_scsi_ioctl(struct file *file, request_queue_t *q,
         rq->data_len = bytes;
         rq->flags |= REQ_BLOCK_PC;
 
-        blk_execute_rq(q, bd_disk, rq);
+        blk_execute_rq(q, bd_disk, rq, 0);
         err = rq->errors & 0xff;        /* only 8 bit SCSI status */
         if (err) {
                 if (rq->sense_len && rq->sense) {
@@ -561,7 +573,7 @@ int scsi_cmd_ioctl(struct file *file, struct gendisk *bd_disk, unsigned int cmd,
                         rq->cmd[0] = GPCMD_START_STOP_UNIT;
                         rq->cmd[4] = 0x02 + (close != 0);
                         rq->cmd_len = 6;
-                        err = blk_execute_rq(q, bd_disk, rq);
+                        err = blk_execute_rq(q, bd_disk, rq, 0);
                         blk_put_request(rq);
                         break;
                 default: