9 files changed, 294 insertions, 48 deletions

diff --git a/drivers/block/aoe/aoe.h b/drivers/block/aoe/aoe.h
index c237527b1aa5..5e41e6dd657b 100644
--- a/drivers/block/aoe/aoe.h
+++ b/drivers/block/aoe/aoe.h
@@ -18,6 +18,7 @@
 enum {
         AOECMD_ATA,
         AOECMD_CFG,
+        AOECMD_VEND_MIN = 0xf0,
 
         AOEFL_RSP = (1<<3),
         AOEFL_ERR = (1<<2),
diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c
index cc250577d405..eeea477d9601 100644
--- a/drivers/block/aoe/aoedev.c
+++ b/drivers/block/aoe/aoedev.c
@@ -173,7 +173,7 @@ skbfree(struct sk_buff *skb)
                 return;
         while (atomic_read(&skb_shinfo(skb)->dataref) != 1 && i-- > 0)
                 msleep(Sms);
-        if (i <= 0) {
+        if (i < 0) {
                 printk(KERN_ERR
                         "aoe: %s holds ref: %s\n",
                         skb->dev ? skb->dev->name : "netif",
diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
index 30de5b1c647e..c6099ba9a4b8 100644
--- a/drivers/block/aoe/aoenet.c
+++ b/drivers/block/aoe/aoenet.c
@@ -142,6 +142,8 @@ aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt,
                 aoecmd_cfg_rsp(skb);
                 break;
         default:
+                if (h->cmd >= AOECMD_VEND_MIN)
+                        break;  /* don't complain about vendor commands */
                 printk(KERN_INFO "aoe: unknown cmd %d\n", h->cmd);
         }
 exit:
diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
index 69e1df7dfa14..4234c11c1e4c 100644
--- a/drivers/block/ataflop.c
+++ b/drivers/block/ataflop.c
@@ -1730,7 +1730,7 @@ static int __init fd_test_drive_present( int drive )
 
         timeout = jiffies + 2*HZ+HZ/2;
         while (time_before(jiffies, timeout))
-                if (!(mfp.par_dt_reg & 0x20))
+                if (!(st_mfp.par_dt_reg & 0x20))
                         break;
 
         status = FDC_READ( FDCREG_STATUS );
@@ -1747,7 +1747,7 @@ static int __init fd_test_drive_present( int drive )
                 /* dummy seek command to make WP bit accessible */
                 FDC_WRITE( FDCREG_DATA, 0 );
                 FDC_WRITE( FDCREG_CMD, FDCCMD_SEEK );
-                while( mfp.par_dt_reg & 0x20 )
+                while( st_mfp.par_dt_reg & 0x20 )
                         ;
                 status = FDC_READ( FDCREG_STATUS );
         }
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 01e69383d9c0..4f9b6d792017 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -3390,6 +3390,203 @@ static void free_hba(int i)
         kfree(p);
 }
 
+/* Send a message CDB to the firmware. */
+static __devinit int cciss_message(struct pci_dev *pdev, unsigned char opcode, unsigned char type)
+{
+        typedef struct {
+                CommandListHeader_struct CommandHeader;
+                RequestBlock_struct Request;
+                ErrDescriptor_struct ErrorDescriptor;
+        } Command;
+        static const size_t cmd_sz = sizeof(Command) + sizeof(ErrorInfo_struct);
+        Command *cmd;
+        dma_addr_t paddr64;
+        uint32_t paddr32, tag;
+        void __iomem *vaddr;
+        int i, err;
+
+        vaddr = ioremap_nocache(pci_resource_start(pdev, 0), pci_resource_len(pdev, 0));
+        if (vaddr == NULL)
+                return -ENOMEM;
+
+        /* The Inbound Post Queue only accepts 32-bit physical addresses for the
+           CCISS commands, so they must be allocated from the lower 4GiB of
+           memory. */
+        err = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK);
+        if (err) {
+                iounmap(vaddr);
+                return -ENOMEM;
+        }
+
+        cmd = pci_alloc_consistent(pdev, cmd_sz, &paddr64);
+        if (cmd == NULL) {
+                iounmap(vaddr);
+                return -ENOMEM;
+        }
+
+        /* This must fit, because of the 32-bit consistent DMA mask.  Also,
+           although there's no guarantee, we assume that the address is at
+           least 4-byte aligned (most likely, it's page-aligned). */
+        paddr32 = paddr64;
+
+        cmd->CommandHeader.ReplyQueue = 0;
+        cmd->CommandHeader.SGList = 0;
+        cmd->CommandHeader.SGTotal = 0;
+        cmd->CommandHeader.Tag.lower = paddr32;
+        cmd->CommandHeader.Tag.upper = 0;
+        memset(&cmd->CommandHeader.LUN.LunAddrBytes, 0, 8);
+
+        cmd->Request.CDBLen = 16;
+        cmd->Request.Type.Type = TYPE_MSG;
+        cmd->Request.Type.Attribute = ATTR_HEADOFQUEUE;
+        cmd->Request.Type.Direction = XFER_NONE;
+        cmd->Request.Timeout = 0; /* Don't time out */
+        cmd->Request.CDB[0] = opcode;
+        cmd->Request.CDB[1] = type;
+        memset(&cmd->Request.CDB[2], 0, 14); /* the rest of the CDB is reserved */
+
+        cmd->ErrorDescriptor.Addr.lower = paddr32 + sizeof(Command);
+        cmd->ErrorDescriptor.Addr.upper = 0;
+        cmd->ErrorDescriptor.Len = sizeof(ErrorInfo_struct);
+
+        writel(paddr32, vaddr + SA5_REQUEST_PORT_OFFSET);
+
+        for (i = 0; i < 10; i++) {
+                tag = readl(vaddr + SA5_REPLY_PORT_OFFSET);
+                if ((tag & ~3) == paddr32)
+                        break;
+                schedule_timeout_uninterruptible(HZ);
+        }
+
+        iounmap(vaddr);
+
+        /* we leak the DMA buffer here ... no choice since the controller could
+           still complete the command. */
+        if (i == 10) {
+                printk(KERN_ERR "cciss: controller message %02x:%02x timed out\n",
+                        opcode, type);
+                return -ETIMEDOUT;
+        }
+
+        pci_free_consistent(pdev, cmd_sz, cmd, paddr64);
+
+        if (tag & 2) {
+                printk(KERN_ERR "cciss: controller message %02x:%02x failed\n",
+                        opcode, type);
+                return -EIO;
+        }
+
+        printk(KERN_INFO "cciss: controller message %02x:%02x succeeded\n",
+                opcode, type);
+        return 0;
+}
+
+#define cciss_soft_reset_controller(p) cciss_message(p, 1, 0)
+#define cciss_noop(p) cciss_message(p, 3, 0)
+
+static __devinit int cciss_reset_msi(struct pci_dev *pdev)
+{
+/* the #defines are stolen from drivers/pci/msi.h. */
+#define msi_control_reg(base)           (base + PCI_MSI_FLAGS)
+#define PCI_MSIX_FLAGS_ENABLE           (1 << 15)
+
+        int pos;
+        u16 control = 0;
+
+        pos = pci_find_capability(pdev, PCI_CAP_ID_MSI);
+        if (pos) {
+                pci_read_config_word(pdev, msi_control_reg(pos), &control);
+                if (control & PCI_MSI_FLAGS_ENABLE) {
+                        printk(KERN_INFO "cciss: resetting MSI\n");
+                        pci_write_config_word(pdev, msi_control_reg(pos), control & ~PCI_MSI_FLAGS_ENABLE);
+                }
+        }
+
+        pos = pci_find_capability(pdev, PCI_CAP_ID_MSIX);
+        if (pos) {
+                pci_read_config_word(pdev, msi_control_reg(pos), &control);
+                if (control & PCI_MSIX_FLAGS_ENABLE) {
+                        printk(KERN_INFO "cciss: resetting MSI-X\n");
+                        pci_write_config_word(pdev, msi_control_reg(pos), control & ~PCI_MSIX_FLAGS_ENABLE);
+                }
+        }
+
+        return 0;
+}
+
+/* This does a hard reset of the controller using PCI power management
+ * states. */
+static __devinit int cciss_hard_reset_controller(struct pci_dev *pdev)
+{
+        u16 pmcsr, saved_config_space[32];
+        int i, pos;
+
+        printk(KERN_INFO "cciss: using PCI PM to reset controller\n");
+
+        /* This is very nearly the same thing as
+
+           pci_save_state(pci_dev);
+           pci_set_power_state(pci_dev, PCI_D3hot);
+           pci_set_power_state(pci_dev, PCI_D0);
+           pci_restore_state(pci_dev);
+
+           but we can't use these nice canned kernel routines on
+           kexec, because they also check the MSI/MSI-X state in PCI
+           configuration space and do the wrong thing when it is
+           set/cleared.  Also, the pci_save/restore_state functions
+           violate the ordering requirements for restoring the
+           configuration space from the CCISS document (see the
+           comment below).  So we roll our own .... */
+
+        for (i = 0; i < 32; i++)
+                pci_read_config_word(pdev, 2*i, &saved_config_space[i]);
+
+        pos = pci_find_capability(pdev, PCI_CAP_ID_PM);
+        if (pos == 0) {
+                printk(KERN_ERR "cciss_reset_controller: PCI PM not supported\n");
+                return -ENODEV;
+        }
+
+        /* Quoting from the Open CISS Specification: "The Power
+         * Management Control/Status Register (CSR) controls the power
+         * state of the device.  The normal operating state is D0,
+         * CSR=00h.  The software off state is D3, CSR=03h.  To reset
+         * the controller, place the interface device in D3 then to
+         * D0, this causes a secondary PCI reset which will reset the
+         * controller." */
+
+        /* enter the D3hot power management state */
+        pci_read_config_word(pdev, pos + PCI_PM_CTRL, &pmcsr);
+        pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
+        pmcsr |= PCI_D3hot;
+        pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
+
+        schedule_timeout_uninterruptible(HZ >> 1);
+
+        /* enter the D0 power management state */
+        pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
+        pmcsr |= PCI_D0;
+        pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
+
+        schedule_timeout_uninterruptible(HZ >> 1);
+
+        /* Restore the PCI configuration space.  The Open CISS
+         * Specification says, "Restore the PCI Configuration
+         * Registers, offsets 00h through 60h. It is important to
+         * restore the command register, 16-bits at offset 04h,
+         * last. Do not restore the configuration status register,
+         * 16-bits at offset 06h."  Note that the offset is 2*i. */
+        for (i = 0; i < 32; i++) {
+                if (i == 2 || i == 3)
+                        continue;
+                pci_write_config_word(pdev, 2*i, saved_config_space[i]);
+        }
+        wmb();
+        pci_write_config_word(pdev, 4, saved_config_space[2]);
+
+        return 0;
+}
+
 /*
  *  This is it.  Find all the controllers and register them.  I really hate
  *  stealing all these major device numbers.
@@ -3404,6 +3601,26 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
         int dac, return_code;
         InquiryData_struct *inq_buff = NULL;
 
+        if (reset_devices) {
+                /* Reset the controller with a PCI power-cycle */
+                if (cciss_hard_reset_controller(pdev) || cciss_reset_msi(pdev))
+                        return -ENODEV;
+
+                /* Now try to get the controller to respond to a no-op. Some
+                   devices (notably the HP Smart Array 5i Controller) need
+                   up to 30 seconds to respond. */
+                for (i=0; i<30; i++) {
+                        if (cciss_noop(pdev) == 0)
+                                break;
+
+                        schedule_timeout_uninterruptible(HZ);
+                }
+                if (i == 30) {
+                        printk(KERN_ERR "cciss: controller seems dead\n");
+                        return -EBUSY;
+                }
+        }
+
         i = alloc_cciss_hba();
         if (i < 0)
                 return -1;
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index cf29cc4e6ab7..83d8ed39433d 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -558,6 +558,8 @@ static void process_fd_request(void);
 static void recalibrate_floppy(void);
 static void floppy_shutdown(unsigned long);
 
+static int floppy_request_regions(int);
+static void floppy_release_regions(int);
 static int floppy_grab_irq_and_dma(void);
 static void floppy_release_irq_and_dma(void);
 
@@ -4274,8 +4276,7 @@ static int __init floppy_init(void)
                 FDCS->rawcmd = 2;
                 if (user_reset_fdc(-1, FD_RESET_ALWAYS, 0)) {
                         /* free ioports reserved by floppy_grab_irq_and_dma() */
-                        release_region(FDCS->address + 2, 4);
-                        release_region(FDCS->address + 7, 1);
+                        floppy_release_regions(fdc);
                         FDCS->address = -1;
                         FDCS->version = FDC_NONE;
                         continue;
@@ -4284,8 +4285,7 @@ static int __init floppy_init(void)
                 FDCS->version = get_fdc_version();
                 if (FDCS->version == FDC_NONE) {
                         /* free ioports reserved by floppy_grab_irq_and_dma() */
-                        release_region(FDCS->address + 2, 4);
-                        release_region(FDCS->address + 7, 1);
+                        floppy_release_regions(fdc);
                         FDCS->address = -1;
                         continue;
                 }
@@ -4358,6 +4358,47 @@ out_put_disk:
 
 static DEFINE_SPINLOCK(floppy_usage_lock);
 
+static const struct io_region {
+        int offset;
+        int size;
+} io_regions[] = {
+        { 2, 1 },
+        /* address + 3 is sometimes reserved by pnp bios for motherboard */
+        { 4, 2 },
+        /* address + 6 is reserved, and may be taken by IDE.
+         * Unfortunately, Adaptec doesn't know this :-(, */
+        { 7, 1 },
+};
+
+static void floppy_release_allocated_regions(int fdc, const struct io_region *p)
+{
+        while (p != io_regions) {
+                p--;
+                release_region(FDCS->address + p->offset, p->size);
+        }
+}
+
+#define ARRAY_END(X) (&((X)[ARRAY_SIZE(X)]))
+
+static int floppy_request_regions(int fdc)
+{
+        const struct io_region *p;
+
+        for (p = io_regions; p < ARRAY_END(io_regions); p++) {
+                if (!request_region(FDCS->address + p->offset, p->size, "floppy")) {
+                        DPRINT("Floppy io-port 0x%04lx in use\n", FDCS->address + p->offset);
+                        floppy_release_allocated_regions(fdc, p);
+                        return -EBUSY;
+                }
+        }
+        return 0;
+}
+
+static void floppy_release_regions(int fdc)
+{
+        floppy_release_allocated_regions(fdc, ARRAY_END(io_regions));
+}
+
 static int floppy_grab_irq_and_dma(void)
 {
         unsigned long flags;
@@ -4399,18 +4440,8 @@ static int floppy_grab_irq_and_dma(void)
 
         for (fdc = 0; fdc < N_FDC; fdc++) {
                 if (FDCS->address != -1) {
-                        if (!request_region(FDCS->address + 2, 4, "floppy")) {
-                                DPRINT("Floppy io-port 0x%04lx in use\n",
-                                       FDCS->address + 2);
-                                goto cleanup1;
-                        }
-                        if (!request_region(FDCS->address + 7, 1, "floppy DIR")) {
-                                DPRINT("Floppy io-port 0x%04lx in use\n",
-                                       FDCS->address + 7);
-                                goto cleanup2;
-                        }
-                        /* address + 6 is reserved, and may be taken by IDE.
-                         * Unfortunately, Adaptec doesn't know this :-(, */
+                        if (floppy_request_regions(fdc))
+                                goto cleanup;
                 }
         }
         for (fdc = 0; fdc < N_FDC; fdc++) {
@@ -4432,15 +4463,11 @@ static int floppy_grab_irq_and_dma(void)
         fdc = 0;
         irqdma_allocated = 1;
         return 0;
-cleanup2:
-        release_region(FDCS->address + 2, 4);
-cleanup1:
+cleanup:
         fd_free_irq();
         fd_free_dma();
-        while (--fdc >= 0) {
-                release_region(FDCS->address + 2, 4);
-                release_region(FDCS->address + 7, 1);
-        }
+        while (--fdc >= 0)
+                floppy_release_regions(fdc);
         spin_lock_irqsave(&floppy_usage_lock, flags);
         usage_count--;
         spin_unlock_irqrestore(&floppy_usage_lock, flags);
@@ -4501,10 +4528,8 @@ static void floppy_release_irq_and_dma(void)
 #endif
         old_fdc = fdc;
         for (fdc = 0; fdc < N_FDC; fdc++)
-                if (FDCS->address != -1) {
-                        release_region(FDCS->address + 2, 4);
-                        release_region(FDCS->address + 7, 1);
-                }
+                if (FDCS->address != -1)
+                        floppy_release_regions(fdc);
         fdc = old_fdc;
 }
 
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index edbaac6c0573..bf0345577672 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -392,8 +392,7 @@ lo_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
         struct loop_device *lo = p->lo;
         struct page *page = buf->page;
         sector_t IV;
-        size_t size;
-        int ret;
+        int size, ret;
 
         ret = buf->ops->confirm(pipe, buf);
         if (unlikely(ret))
diff --git a/drivers/block/paride/pg.c b/drivers/block/paride/pg.c
index 9dfa27163001..c397b3ddba9b 100644
--- a/drivers/block/paride/pg.c
+++ b/drivers/block/paride/pg.c
@@ -422,7 +422,7 @@ static void xs(char *buf, char *targ, int len)
 
         for (k = 0; k < len; k++) {
                 char c = *buf++;
-                if (c != ' ' || c != l)
+                if (c != ' ' && c != l)
                         l = *targ++ = c;
         }
         if (l == ' ')
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 918ef725de41..8f905089b72b 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -40,6 +40,7 @@
 #include <linux/hdreg.h>
 #include <linux/cdrom.h>
 #include <linux/module.h>
+#include <linux/scatterlist.h>
 
 #include <xen/xenbus.h>
 #include <xen/grant_table.h>
@@ -82,6 +83,7 @@ struct blkfront_info
         enum blkif_state connected;
         int ring_ref;
         struct blkif_front_ring ring;
+        struct scatterlist sg[BLKIF_MAX_SEGMENTS_PER_REQUEST];
         unsigned int evtchn, irq;
         struct request_queue *rq;
         struct work_struct work;
@@ -204,12 +206,11 @@ static int blkif_queue_request(struct request *req)
         struct blkfront_info *info = req->rq_disk->private_data;
         unsigned long buffer_mfn;
         struct blkif_request *ring_req;
-        struct req_iterator iter;
-        struct bio_vec *bvec;
         unsigned long id;
         unsigned int fsect, lsect;
-        int ref;
+        int i, ref;
         grant_ref_t gref_head;
+        struct scatterlist *sg;
 
         if (unlikely(info->connected != BLKIF_STATE_CONNECTED))
                 return 1;
@@ -238,12 +239,13 @@ static int blkif_queue_request(struct request *req)
         if (blk_barrier_rq(req))
                 ring_req->operation = BLKIF_OP_WRITE_BARRIER;
 
-        ring_req->nr_segments = 0;
-        rq_for_each_segment(bvec, req, iter) {
-                BUG_ON(ring_req->nr_segments == BLKIF_MAX_SEGMENTS_PER_REQUEST);
-                buffer_mfn = pfn_to_mfn(page_to_pfn(bvec->bv_page));
-                fsect = bvec->bv_offset >> 9;
-                lsect = fsect + (bvec->bv_len >> 9) - 1;
+        ring_req->nr_segments = blk_rq_map_sg(req->q, req, info->sg);
+        BUG_ON(ring_req->nr_segments > BLKIF_MAX_SEGMENTS_PER_REQUEST);
+
+        for_each_sg(info->sg, sg, ring_req->nr_segments, i) {
+                buffer_mfn = pfn_to_mfn(page_to_pfn(sg_page(sg)));
+                fsect = sg->offset >> 9;
+                lsect = fsect + (sg->length >> 9) - 1;
                 /* install a grant reference. */
                 ref = gnttab_claim_grant_reference(&gref_head);
                 BUG_ON(ref == -ENOSPC);
@@ -254,16 +256,12 @@ static int blkif_queue_request(struct request *req)
                                 buffer_mfn,
                                 rq_data_dir(req) );
 
-                info->shadow[id].frame[ring_req->nr_segments] =
-                                mfn_to_pfn(buffer_mfn);
-
-                ring_req->seg[ring_req->nr_segments] =
+                info->shadow[id].frame[i] = mfn_to_pfn(buffer_mfn);
+                ring_req->seg[i] =
                                 (struct blkif_request_segment) {
                                         .gref       = ref,
                                         .first_sect = fsect,
                                         .last_sect  = lsect };
-
-                ring_req->nr_segments++;
         }
 
         info->ring.req_prod_pvt++;
@@ -622,6 +620,8 @@ static int setup_blkring(struct xenbus_device *dev,
         SHARED_RING_INIT(sring);
         FRONT_RING_INIT(&info->ring, sring, PAGE_SIZE);
 
+        sg_init_table(info->sg, BLKIF_MAX_SEGMENTS_PER_REQUEST);
+
         err = xenbus_grant_ring(dev, virt_to_mfn(info->ring.sring));
         if (err < 0) {
                 free_page((unsigned long)sring);
@@ -977,6 +977,8 @@ static void backend_changed(struct xenbus_device *dev,
                 break;
 
         case XenbusStateClosing:
+                if (info->gd == NULL)
+                        xenbus_dev_fatal(dev, -ENODEV, "gd is NULL");
                 bd = bdget_disk(info->gd, 0);
                 if (bd == NULL)
                         xenbus_dev_fatal(dev, -ENODEV, "bdget failed");