5 files changed, 204 insertions, 147 deletions

diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index 139cbba76180..8b1331677407 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -433,12 +433,12 @@ config CDROM_PKTCDVD_BUFFERS
           This controls the maximum number of active concurrent packets. More
           concurrent packets can increase write performance, but also require
           more memory. Each concurrent packet will require approximately 64Kb
-          of non-swappable kernel memory, memory which will be allocated at
-          pktsetup time.
+          of non-swappable kernel memory, memory which will be allocated when
+          a disc is opened for writing.
 
 config CDROM_PKTCDVD_WCACHE
-        bool "Enable write caching"
-        depends on CDROM_PKTCDVD
+        bool "Enable write caching (EXPERIMENTAL)"
+        depends on CDROM_PKTCDVD && EXPERIMENTAL
         help
           If enabled, write caching will be set for the CD-R/W device. For now
           this option is dangerous unless the CD-RW media is known good, as we
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 12d7b9bdfa93..0d65394707db 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -2183,6 +2183,7 @@ static void cciss_softirq_done(struct request *rq)
 {
         CommandList_struct *cmd = rq->completion_data;
         ctlr_info_t *h = hba[cmd->ctlr];
+        unsigned long flags;
         u64bit temp64;
         int i, ddir;
 
@@ -2205,10 +2206,10 @@ static void cciss_softirq_done(struct request *rq)
         printk("Done with %p\n", rq);
 #endif /* CCISS_DEBUG */ 
 
-        spin_lock_irq(&h->lock);
+        spin_lock_irqsave(&h->lock, flags);
         end_that_request_last(rq, rq->errors);
         cmd_free(h, cmd,1);
-        spin_unlock_irq(&h->lock);
+        spin_unlock_irqrestore(&h->lock, flags);
 }
 
 /* checks the status of the job and calls complete buffers to mark all 
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 93affeeef7bd..bc9b2bcd7dba 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -43,8 +43,6 @@
  *
  *************************************************************************/
 
-#define VERSION_CODE    "v0.2.0a 2004-07-14 Jens Axboe (axboe@suse.de) and petero2@telia.com"
-
 #include <linux/pktcdvd.h>
 #include <linux/config.h>
 #include <linux/module.h>
@@ -60,6 +58,7 @@
 #include <linux/suspend.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_ioctl.h>
+#include <scsi/scsi.h>
 
 #include <asm/uaccess.h>
 
@@ -131,7 +130,7 @@ static struct bio *pkt_bio_alloc(int nr_iovecs)
 /*
  * Allocate a packet_data struct
  */
-static struct packet_data *pkt_alloc_packet_data(void)
+static struct packet_data *pkt_alloc_packet_data(int frames)
 {
         int i;
         struct packet_data *pkt;
@@ -140,11 +139,12 @@ static struct packet_data *pkt_alloc_packet_data(void)
         if (!pkt)
                 goto no_pkt;
 
-        pkt->w_bio = pkt_bio_alloc(PACKET_MAX_SIZE);
+        pkt->frames = frames;
+        pkt->w_bio = pkt_bio_alloc(frames);
         if (!pkt->w_bio)
                 goto no_bio;
 
-        for (i = 0; i < PAGES_PER_PACKET; i++) {
+        for (i = 0; i < frames / FRAMES_PER_PAGE; i++) {
                 pkt->pages[i] = alloc_page(GFP_KERNEL|__GFP_ZERO);
                 if (!pkt->pages[i])
                         goto no_page;
@@ -152,7 +152,7 @@ static struct packet_data *pkt_alloc_packet_data(void)
 
         spin_lock_init(&pkt->lock);
 
-        for (i = 0; i < PACKET_MAX_SIZE; i++) {
+        for (i = 0; i < frames; i++) {
                 struct bio *bio = pkt_bio_alloc(1);
                 if (!bio)
                         goto no_rd_bio;
@@ -162,14 +162,14 @@ static struct packet_data *pkt_alloc_packet_data(void)
         return pkt;
 
 no_rd_bio:
-        for (i = 0; i < PACKET_MAX_SIZE; i++) {
+        for (i = 0; i < frames; i++) {
                 struct bio *bio = pkt->r_bios[i];
                 if (bio)
                         bio_put(bio);
         }
 
 no_page:
-        for (i = 0; i < PAGES_PER_PACKET; i++)
+        for (i = 0; i < frames / FRAMES_PER_PAGE; i++)
                 if (pkt->pages[i])
                         __free_page(pkt->pages[i]);
         bio_put(pkt->w_bio);
@@ -186,12 +186,12 @@ static void pkt_free_packet_data(struct packet_data *pkt)
 {
         int i;
 
-        for (i = 0; i < PACKET_MAX_SIZE; i++) {
+        for (i = 0; i < pkt->frames; i++) {
                 struct bio *bio = pkt->r_bios[i];
                 if (bio)
                         bio_put(bio);
         }
-        for (i = 0; i < PAGES_PER_PACKET; i++)
+        for (i = 0; i < pkt->frames / FRAMES_PER_PAGE; i++)
                 __free_page(pkt->pages[i]);
         bio_put(pkt->w_bio);
         kfree(pkt);
@@ -206,17 +206,17 @@ static void pkt_shrink_pktlist(struct pktcdvd_device *pd)
         list_for_each_entry_safe(pkt, next, &pd->cdrw.pkt_free_list, list) {
                 pkt_free_packet_data(pkt);
         }
+        INIT_LIST_HEAD(&pd->cdrw.pkt_free_list);
 }
 
 static int pkt_grow_pktlist(struct pktcdvd_device *pd, int nr_packets)
 {
         struct packet_data *pkt;
 
-        INIT_LIST_HEAD(&pd->cdrw.pkt_free_list);
-        INIT_LIST_HEAD(&pd->cdrw.pkt_active_list);
-        spin_lock_init(&pd->cdrw.active_list_lock);
+        BUG_ON(!list_empty(&pd->cdrw.pkt_free_list));
+
         while (nr_packets > 0) {
-                pkt = pkt_alloc_packet_data();
+                pkt = pkt_alloc_packet_data(pd->settings.size >> 2);
                 if (!pkt) {
                         pkt_shrink_pktlist(pd);
                         return 0;
@@ -381,6 +381,7 @@ static int pkt_generic_packet(struct pktcdvd_device *pd, struct packet_command *
         memcpy(rq->cmd, cgc->cmd, CDROM_PACKET_SIZE);
         if (sizeof(rq->cmd) > CDROM_PACKET_SIZE)
                 memset(rq->cmd + CDROM_PACKET_SIZE, 0, sizeof(rq->cmd) - CDROM_PACKET_SIZE);
+        rq->cmd_len = COMMAND_SIZE(rq->cmd[0]);
 
         rq->ref_count++;
         rq->flags |= REQ_NOMERGE;
@@ -646,7 +647,7 @@ static void pkt_copy_bio_data(struct bio *src_bio, int seg, int offs, struct pag
  * b) The data can be used as cache to avoid read requests if we receive a
  *    new write request for the same zone.
  */
-static void pkt_make_local_copy(struct packet_data *pkt, struct page **pages, int *offsets)
+static void pkt_make_local_copy(struct packet_data *pkt, struct bio_vec *bvec)
 {
         int f, p, offs;
 
@@ -654,15 +655,15 @@ static void pkt_make_local_copy(struct packet_data *pkt, struct page **pages, in
         p = 0;
         offs = 0;
         for (f = 0; f < pkt->frames; f++) {
-                if (pages[f] != pkt->pages[p]) {
-                        void *vfrom = kmap_atomic(pages[f], KM_USER0) + offsets[f];
+                if (bvec[f].bv_page != pkt->pages[p]) {
+                        void *vfrom = kmap_atomic(bvec[f].bv_page, KM_USER0) + bvec[f].bv_offset;
                         void *vto = page_address(pkt->pages[p]) + offs;
                         memcpy(vto, vfrom, CD_FRAMESIZE);
                         kunmap_atomic(vfrom, KM_USER0);
-                        pages[f] = pkt->pages[p];
-                        offsets[f] = offs;
+                        bvec[f].bv_page = pkt->pages[p];
+                        bvec[f].bv_offset = offs;
                 } else {
-                        BUG_ON(offsets[f] != offs);
+                        BUG_ON(bvec[f].bv_offset != offs);
                 }
                 offs += CD_FRAMESIZE;
                 if (offs >= PAGE_SIZE) {
@@ -951,7 +952,7 @@ try_next_bio:
 
         pd->current_sector = zone + pd->settings.size;
         pkt->sector = zone;
-        pkt->frames = pd->settings.size >> 2;
+        BUG_ON(pkt->frames != pd->settings.size >> 2);
         pkt->write_size = 0;
 
         /*
@@ -992,18 +993,17 @@ try_next_bio:
 static void pkt_start_write(struct pktcdvd_device *pd, struct packet_data *pkt)
 {
         struct bio *bio;
-        struct page *pages[PACKET_MAX_SIZE];
-        int offsets[PACKET_MAX_SIZE];
         int f;
         int frames_write;
+        struct bio_vec *bvec = pkt->w_bio->bi_io_vec;
 
         for (f = 0; f < pkt->frames; f++) {
-                pages[f] = pkt->pages[(f * CD_FRAMESIZE) / PAGE_SIZE];
-                offsets[f] = (f * CD_FRAMESIZE) % PAGE_SIZE;
+                bvec[f].bv_page = pkt->pages[(f * CD_FRAMESIZE) / PAGE_SIZE];
+                bvec[f].bv_offset = (f * CD_FRAMESIZE) % PAGE_SIZE;
         }
 
         /*
-         * Fill-in pages[] and offsets[] with data from orig_bios.
+         * Fill-in bvec with data from orig_bios.
          */
         frames_write = 0;
         spin_lock(&pkt->lock);
@@ -1025,11 +1025,11 @@ static void pkt_start_write(struct pktcdvd_device *pd, struct packet_data *pkt)
                         }
 
                         if (src_bvl->bv_len - src_offs >= CD_FRAMESIZE) {
-                                pages[f] = src_bvl->bv_page;
-                                offsets[f] = src_bvl->bv_offset + src_offs;
+                                bvec[f].bv_page = src_bvl->bv_page;
+                                bvec[f].bv_offset = src_bvl->bv_offset + src_offs;
                         } else {
                                 pkt_copy_bio_data(bio, segment, src_offs,
-                                                  pages[f], offsets[f]);
+                                                  bvec[f].bv_page, bvec[f].bv_offset);
                         }
                         src_offs += CD_FRAMESIZE;
                         frames_write++;
@@ -1043,7 +1043,7 @@ static void pkt_start_write(struct pktcdvd_device *pd, struct packet_data *pkt)
         BUG_ON(frames_write != pkt->write_size);
 
         if (test_bit(PACKET_MERGE_SEGS, &pd->flags) || (pkt->write_size < pkt->frames)) {
-                pkt_make_local_copy(pkt, pages, offsets);
+                pkt_make_local_copy(pkt, bvec);
                 pkt->cache_valid = 1;
         } else {
                 pkt->cache_valid = 0;
@@ -1056,17 +1056,9 @@ static void pkt_start_write(struct pktcdvd_device *pd, struct packet_data *pkt)
         pkt->w_bio->bi_bdev = pd->bdev;
         pkt->w_bio->bi_end_io = pkt_end_io_packet_write;
         pkt->w_bio->bi_private = pkt;
-        for (f = 0; f < pkt->frames; f++) {
-                if ((f + 1 < pkt->frames) && (pages[f + 1] == pages[f]) &&
-                    (offsets[f + 1] = offsets[f] + CD_FRAMESIZE)) {
-                        if (!bio_add_page(pkt->w_bio, pages[f], CD_FRAMESIZE * 2, offsets[f]))
-                                BUG();
-                        f++;
-                } else {
-                        if (!bio_add_page(pkt->w_bio, pages[f], CD_FRAMESIZE, offsets[f]))
-                                BUG();
-                }
-        }
+        for (f = 0; f < pkt->frames; f++)
+                if (!bio_add_page(pkt->w_bio, bvec[f].bv_page, CD_FRAMESIZE, bvec[f].bv_offset))
+                        BUG();
         VPRINTK("pktcdvd: vcnt=%d\n", pkt->w_bio->bi_vcnt);
 
         atomic_set(&pkt->io_wait, 1);
@@ -1505,40 +1497,42 @@ static int pkt_set_write_settings(struct pktcdvd_device *pd)
 }
 
 /*
- * 0 -- we can write to this track, 1 -- we can't
+ * 1 -- we can write to this track, 0 -- we can't
  */
-static int pkt_good_track(track_information *ti)
+static int pkt_writable_track(struct pktcdvd_device *pd, track_information *ti)
 {
-        /*
-         * only good for CD-RW at the moment, not DVD-RW
-         */
+        switch (pd->mmc3_profile) {
+                case 0x1a: /* DVD+RW */
+                case 0x12: /* DVD-RAM */
+                        /* The track is always writable on DVD+RW/DVD-RAM */
+                        return 1;
+                default:
+                        break;
+        }
 
-        /*
-         * FIXME: only for FP
-         */
-        if (ti->fp == 0)
+        if (!ti->packet || !ti->fp)
                 return 0;
 
         /*
          * "good" settings as per Mt Fuji.
          */
-        if (ti->rt == 0 && ti->blank == 0 && ti->packet == 1)
-                return 0;
+        if (ti->rt == 0 && ti->blank == 0)
+                return 1;
 
-        if (ti->rt == 0 && ti->blank == 1 && ti->packet == 1)
-                return 0;
+        if (ti->rt == 0 && ti->blank == 1)
+                return 1;
 
-        if (ti->rt == 1 && ti->blank == 0 && ti->packet == 1)
-                return 0;
+        if (ti->rt == 1 && ti->blank == 0)
+                return 1;
 
         printk("pktcdvd: bad state %d-%d-%d\n", ti->rt, ti->blank, ti->packet);
-        return 1;
+        return 0;
 }
 
 /*
- * 0 -- we can write to this disc, 1 -- we can't
+ * 1 -- we can write to this disc, 0 -- we can't
  */
-static int pkt_good_disc(struct pktcdvd_device *pd, disc_information *di)
+static int pkt_writable_disc(struct pktcdvd_device *pd, disc_information *di)
 {
         switch (pd->mmc3_profile) {
                 case 0x0a: /* CD-RW */
@@ -1547,10 +1541,10 @@ static int pkt_good_disc(struct pktcdvd_device *pd, disc_information *di)
                 case 0x1a: /* DVD+RW */
                 case 0x13: /* DVD-RW */
                 case 0x12: /* DVD-RAM */
-                        return 0;
-                default:
-                        printk("pktcdvd: Wrong disc profile (%x)\n", pd->mmc3_profile);
                         return 1;
+                default:
+                        VPRINTK("pktcdvd: Wrong disc profile (%x)\n", pd->mmc3_profile);
+                        return 0;
         }
 
         /*
@@ -1559,25 +1553,25 @@ static int pkt_good_disc(struct pktcdvd_device *pd, disc_information *di)
          */
         if (di->disc_type == 0xff) {
                 printk("pktcdvd: Unknown disc. No track?\n");
-                return 1;
+                return 0;
         }
 
         if (di->disc_type != 0x20 && di->disc_type != 0) {
                 printk("pktcdvd: Wrong disc type (%x)\n", di->disc_type);
-                return 1;
+                return 0;
         }
 
         if (di->erasable == 0) {
                 printk("pktcdvd: Disc not erasable\n");
-                return 1;
+                return 0;
         }
 
         if (di->border_status == PACKET_SESSION_RESERVED) {
                 printk("pktcdvd: Can't write to last track (reserved)\n");
-                return 1;
+                return 0;
         }
 
-        return 0;
+        return 1;
 }
 
 static int pkt_probe_settings(struct pktcdvd_device *pd)
@@ -1602,23 +1596,9 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
                 return ret;
         }
 
-        if (pkt_good_disc(pd, &di))
-                return -ENXIO;
+        if (!pkt_writable_disc(pd, &di))
+                return -EROFS;
 
-        switch (pd->mmc3_profile) {
-                case 0x1a: /* DVD+RW */
-                        printk("pktcdvd: inserted media is DVD+RW\n");
-                        break;
-                case 0x13: /* DVD-RW */
-                        printk("pktcdvd: inserted media is DVD-RW\n");
-                        break;
-                case 0x12: /* DVD-RAM */
-                        printk("pktcdvd: inserted media is DVD-RAM\n");
-                        break;
-                default:
-                        printk("pktcdvd: inserted media is CD-R%s\n", di.erasable ? "W" : "");
-                        break;
-        }
         pd->type = di.erasable ? PACKET_CDRW : PACKET_CDR;
 
         track = 1; /* (di.last_track_msb << 8) | di.last_track_lsb; */
@@ -1627,9 +1607,9 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
                 return ret;
         }
 
-        if (pkt_good_track(&ti)) {
+        if (!pkt_writable_track(pd, &ti)) {
                 printk("pktcdvd: can't write to this track\n");
-                return -ENXIO;
+                return -EROFS;
         }
 
         /*
@@ -1639,11 +1619,11 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
         pd->settings.size = be32_to_cpu(ti.fixed_packet_size) << 2;
         if (pd->settings.size == 0) {
                 printk("pktcdvd: detected zero packet size!\n");
-                pd->settings.size = 128;
+                return -ENXIO;
         }
         if (pd->settings.size > PACKET_MAX_SECTORS) {
                 printk("pktcdvd: packet size is too big\n");
-                return -ENXIO;
+                return -EROFS;
         }
         pd->settings.fp = ti.fp;
         pd->offset = (be32_to_cpu(ti.track_start) << 2) & (pd->settings.size - 1);
@@ -1685,7 +1665,7 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
                         break;
                 default:
                         printk("pktcdvd: unknown data mode\n");
-                        return 1;
+                        return -EROFS;
         }
         return 0;
 }
@@ -1895,8 +1875,8 @@ static int pkt_open_write(struct pktcdvd_device *pd)
         unsigned int write_speed, media_write_speed, read_speed;
 
         if ((ret = pkt_probe_settings(pd))) {
-                DPRINTK("pktcdvd: %s failed probe\n", pd->name);
-                return -EIO;
+                VPRINTK("pktcdvd: %s failed probe\n", pd->name);
+                return ret;
         }
 
         if ((ret = pkt_set_write_settings(pd))) {
@@ -1987,8 +1967,14 @@ static int pkt_open_dev(struct pktcdvd_device *pd, int write)
         if ((ret = pkt_set_segment_merging(pd, q)))
                 goto out_unclaim;
 
-        if (write)
+        if (write) {
+                if (!pkt_grow_pktlist(pd, CONFIG_CDROM_PKTCDVD_BUFFERS)) {
+                        printk("pktcdvd: not enough memory for buffers\n");
+                        ret = -ENOMEM;
+                        goto out_unclaim;
+                }
                 printk("pktcdvd: %lukB available on disc\n", lba << 1);
+        }
 
         return 0;
 
@@ -2014,6 +2000,8 @@ static void pkt_release_dev(struct pktcdvd_device *pd, int flush)
         pkt_set_speed(pd, MAX_SPEED, MAX_SPEED);
         bd_release(pd->bdev);
         blkdev_put(pd->bdev);
+
+        pkt_shrink_pktlist(pd);
 }
 
 static struct pktcdvd_device *pkt_find_dev_from_minor(int dev_minor)
@@ -2046,10 +2034,9 @@ static int pkt_open(struct inode *inode, struct file *file)
                         goto out_dec;
                 }
         } else {
-                if (pkt_open_dev(pd, file->f_mode & FMODE_WRITE)) {
-                        ret = -EIO;
+                ret = pkt_open_dev(pd, file->f_mode & FMODE_WRITE);
+                if (ret)
                         goto out_dec;
-                }
                 /*
                  * needed here as well, since ext2 (among others) may change
                  * the blocksize at mount time
@@ -2379,12 +2366,6 @@ static int pkt_new_dev(struct pktcdvd_device *pd, dev_t dev)
         /* This is safe, since we have a reference from open(). */
         __module_get(THIS_MODULE);
 
-        if (!pkt_grow_pktlist(pd, CONFIG_CDROM_PKTCDVD_BUFFERS)) {
-                printk("pktcdvd: not enough memory for buffers\n");
-                ret = -ENOMEM;
-                goto out_mem;
-        }
-
         pd->bdev = bdev;
         set_blocksize(bdev, CD_FRAMESIZE);
 
@@ -2395,7 +2376,7 @@ static int pkt_new_dev(struct pktcdvd_device *pd, dev_t dev)
         if (IS_ERR(pd->cdrw.thread)) {
                 printk("pktcdvd: can't start kernel thread\n");
                 ret = -ENOMEM;
-                goto out_thread;
+                goto out_mem;
         }
 
         proc = create_proc_entry(pd->name, 0, pkt_proc);
@@ -2406,8 +2387,6 @@ static int pkt_new_dev(struct pktcdvd_device *pd, dev_t dev)
         DPRINTK("pktcdvd: writer %s mapped to %s\n", pd->name, bdevname(bdev, b));
         return 0;
 
-out_thread:
-        pkt_shrink_pktlist(pd);
 out_mem:
         blkdev_put(bdev);
         /* This is safe: open() is still holding a reference. */
@@ -2437,11 +2416,12 @@ static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, u
                  * The door gets locked when the device is opened, so we
                  * have to unlock it or else the eject command fails.
                  */
-                pkt_lock_door(pd, 0);
+                if (pd->refcnt == 1)
+                        pkt_lock_door(pd, 0);
                 return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
 
         default:
-                printk("pktcdvd: Unknown ioctl for %s (%x)\n", pd->name, cmd);
+                VPRINTK("pktcdvd: Unknown ioctl for %s (%x)\n", pd->name, cmd);
                 return -ENOTTY;
         }
 
@@ -2503,6 +2483,10 @@ static int pkt_setup_dev(struct pkt_ctrl_command *ctrl_cmd)
                 goto out_mem;
         pd->disk = disk;
 
+        INIT_LIST_HEAD(&pd->cdrw.pkt_free_list);
+        INIT_LIST_HEAD(&pd->cdrw.pkt_active_list);
+        spin_lock_init(&pd->cdrw.active_list_lock);
+
         spin_lock_init(&pd->lock);
         spin_lock_init(&pd->iosched.lock);
         sprintf(pd->name, "pktcdvd%d", idx);
@@ -2567,8 +2551,6 @@ static int pkt_remove_dev(struct pkt_ctrl_command *ctrl_cmd)
 
         blkdev_put(pd->bdev);
 
-        pkt_shrink_pktlist(pd);
-
         remove_proc_entry(pd->name, pkt_proc);
         DPRINTK("pktcdvd: writer %s unmapped\n", pd->name);
 
@@ -2678,7 +2660,6 @@ static int __init pkt_init(void)
 
         pkt_proc = proc_mkdir("pktcdvd", proc_root_driver);
 
-        DPRINTK("pktcdvd: %s\n", VERSION_CODE);
         return 0;
 
 out:
diff --git a/drivers/block/ub.c b/drivers/block/ub.c
index a05fe5843e6c..f04d864770ad 100644
--- a/drivers/block/ub.c
+++ b/drivers/block/ub.c
@@ -14,7 +14,6 @@
  *  -- special case some senses, e.g. 3a/0 -> no media present, reduce retries
  *  -- verify the 13 conditions and do bulk resets
  *  -- kill last_pipe and simply do two-state clearing on both pipes
- *  -- verify protocol (bulk) from USB descriptors (maybe...)
  *  -- highmem
  *  -- move top_sense and work_bcs into separate allocations (if they survive)
  *     for cache purists and esoteric architectures.
@@ -355,7 +354,7 @@ struct ub_lun {
  * The USB device instance.
  */
 struct ub_dev {
-        spinlock_t lock;
+        spinlock_t *lock;
         atomic_t poison;                /* The USB device is disconnected */
         int openc;                      /* protected by ub_lock! */
                                         /* kref is too implicit for our taste */
@@ -420,11 +419,13 @@ static void ub_state_sense(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 static int ub_submit_clear_stall(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
     int stalled_pipe);
 static void ub_top_sense_done(struct ub_dev *sc, struct ub_scsi_cmd *scmd);
-static void ub_reset_enter(struct ub_dev *sc);
+static void ub_reset_enter(struct ub_dev *sc, int try);
 static void ub_reset_task(void *arg);
 static int ub_sync_tur(struct ub_dev *sc, struct ub_lun *lun);
 static int ub_sync_read_cap(struct ub_dev *sc, struct ub_lun *lun,
     struct ub_capacity *ret);
+static int ub_sync_reset(struct ub_dev *sc);
+static int ub_probe_clear_stall(struct ub_dev *sc, int stalled_pipe);
 static int ub_probe_lun(struct ub_dev *sc, int lnum);
 
 /*
@@ -452,6 +453,10 @@ MODULE_DEVICE_TABLE(usb, ub_usb_ids);
 #define UB_MAX_HOSTS  26
 static char ub_hostv[UB_MAX_HOSTS];
 
+#define UB_QLOCK_NUM 5
+static spinlock_t ub_qlockv[UB_QLOCK_NUM];
+static int ub_qlock_next = 0;
+
 static DEFINE_SPINLOCK(ub_lock);        /* Locks globals and ->openc */
 
 /*
@@ -531,7 +536,7 @@ static ssize_t ub_diag_show(struct device *dev, struct device_attribute *attr,
                 return 0;
 
         cnt = 0;
-        spin_lock_irqsave(&sc->lock, flags);
+        spin_lock_irqsave(sc->lock, flags);
 
         cnt += sprintf(page + cnt,
             "poison %d reset %d\n",
@@ -579,7 +584,7 @@ static ssize_t ub_diag_show(struct device *dev, struct device_attribute *attr,
                 if (++nc == SCMD_TRACE_SZ) nc = 0;
         }
 
-        spin_unlock_irqrestore(&sc->lock, flags);
+        spin_unlock_irqrestore(sc->lock, flags);
         return cnt;
 }
 
@@ -627,6 +632,24 @@ static void ub_id_put(int id)
 }
 
 /*
+ * This is necessitated by the fact that blk_cleanup_queue does not
+ * necesserily destroy the queue. Instead, it may merely decrease q->refcnt.
+ * Since our blk_init_queue() passes a spinlock common with ub_dev,
+ * we have life time issues when ub_cleanup frees ub_dev.
+ */
+static spinlock_t *ub_next_lock(void)
+{
+        unsigned long flags;
+        spinlock_t *ret;
+
+        spin_lock_irqsave(&ub_lock, flags);
+        ret = &ub_qlockv[ub_qlock_next];
+        ub_qlock_next = (ub_qlock_next + 1) % UB_QLOCK_NUM;
+        spin_unlock_irqrestore(&ub_lock, flags);
+        return ret;
+}
+
+/*
  * Downcount for deallocation. This rides on two assumptions:
  *  - once something is poisoned, its refcount cannot grow
  *  - opens cannot happen at this time (del_gendisk was done)
@@ -961,7 +984,7 @@ static int ub_rw_cmd_retry(struct ub_dev *sc, struct ub_lun *lun,
         if (atomic_read(&sc->poison))
                 return -ENXIO;
 
-        ub_reset_enter(sc);
+        ub_reset_enter(sc, urq->current_try);
 
         if (urq->current_try >= 3)
                 return -EIO;
@@ -997,8 +1020,6 @@ static int ub_rw_cmd_retry(struct ub_dev *sc, struct ub_lun *lun,
  * No exceptions.
  *
  * Host is assumed locked.
- *
- * XXX We only support Bulk for the moment.
  */
 static int ub_submit_scsi(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 {
@@ -1083,9 +1104,10 @@ static void ub_urb_timeout(unsigned long arg)
         struct ub_dev *sc = (struct ub_dev *) arg;
         unsigned long flags;
 
-        spin_lock_irqsave(&sc->lock, flags);
-        usb_unlink_urb(&sc->work_urb);
-        spin_unlock_irqrestore(&sc->lock, flags);
+        spin_lock_irqsave(sc->lock, flags);
+        if (!ub_is_completed(&sc->work_done))
+                usb_unlink_urb(&sc->work_urb);
+        spin_unlock_irqrestore(sc->lock, flags);
 }
 
 /*
@@ -1108,10 +1130,9 @@ static void ub_scsi_action(unsigned long _dev)
         struct ub_dev *sc = (struct ub_dev *) _dev;
         unsigned long flags;
 
-        spin_lock_irqsave(&sc->lock, flags);
-        del_timer(&sc->work_timer);
+        spin_lock_irqsave(sc->lock, flags);
         ub_scsi_dispatch(sc);
-        spin_unlock_irqrestore(&sc->lock, flags);
+        spin_unlock_irqrestore(sc->lock, flags);
 }
 
 static void ub_scsi_dispatch(struct ub_dev *sc)
@@ -1133,6 +1154,7 @@ static void ub_scsi_dispatch(struct ub_dev *sc)
                 } else {
                         if (!ub_is_completed(&sc->work_done))
                                 break;
+                        del_timer(&sc->work_timer);
                         ub_scsi_urb_compl(sc, cmd);
                 }
         }
@@ -1680,16 +1702,18 @@ static void ub_top_sense_done(struct ub_dev *sc, struct ub_scsi_cmd *scmd)
 
 /*
  * Reset management
+ * XXX Move usb_reset_device to khubd. Hogging kevent is not a good thing.
+ * XXX Make usb_sync_reset asynchronous.
  */
 
-static void ub_reset_enter(struct ub_dev *sc)
+static void ub_reset_enter(struct ub_dev *sc, int try)
 {
 
         if (sc->reset) {
                 /* This happens often on multi-LUN devices. */
                 return;
         }
-        sc->reset = 1;
+        sc->reset = try + 1;
 
 #if 0 /* Not needed because the disconnect waits for us. */
         unsigned long flags;
@@ -1727,6 +1751,11 @@ static void ub_reset_task(void *arg)
         if (atomic_read(&sc->poison)) {
                 printk(KERN_NOTICE "%s: Not resetting disconnected device\n",
                     sc->name); /* P3 This floods. Remove soon. XXX */
+        } else if ((sc->reset & 1) == 0) {
+                ub_sync_reset(sc);
+                msleep(700);    /* usb-storage sleeps 6s (!) */
+                ub_probe_clear_stall(sc, sc->recv_bulk_pipe);
+                ub_probe_clear_stall(sc, sc->send_bulk_pipe);
         } else if (sc->dev->actconfig->desc.bNumInterfaces != 1) {
                 printk(KERN_NOTICE "%s: Not resetting multi-interface device\n",
                     sc->name); /* P3 This floods. Remove soon. XXX */
@@ -1754,7 +1783,7 @@ static void ub_reset_task(void *arg)
          * queues of resets or anything. We do need a spinlock though,
          * to interact with block layer.
          */
-        spin_lock_irqsave(&sc->lock, flags);
+        spin_lock_irqsave(sc->lock, flags);
         sc->reset = 0;
         tasklet_schedule(&sc->tasklet);
         list_for_each(p, &sc->luns) {
@@ -1762,7 +1791,7 @@ static void ub_reset_task(void *arg)
                 blk_start_queue(lun->disk->queue);
         }
         wake_up(&sc->reset_wait);
-        spin_unlock_irqrestore(&sc->lock, flags);
+        spin_unlock_irqrestore(sc->lock, flags);
 }
 
 /*
@@ -1990,11 +2019,11 @@ static int ub_sync_tur(struct ub_dev *sc, struct ub_lun *lun)
         cmd->done = ub_probe_done;
         cmd->back = &compl;
 
-        spin_lock_irqsave(&sc->lock, flags);
+        spin_lock_irqsave(sc->lock, flags);
         cmd->tag = sc->tagcnt++;
 
         rc = ub_submit_scsi(sc, cmd);
-        spin_unlock_irqrestore(&sc->lock, flags);
+        spin_unlock_irqrestore(sc->lock, flags);
 
         if (rc != 0) {
                 printk("ub: testing ready: submit error (%d)\n", rc); /* P3 */
@@ -2052,11 +2081,11 @@ static int ub_sync_read_cap(struct ub_dev *sc, struct ub_lun *lun,
         cmd->done = ub_probe_done;
         cmd->back = &compl;
 
-        spin_lock_irqsave(&sc->lock, flags);
+        spin_lock_irqsave(sc->lock, flags);
         cmd->tag = sc->tagcnt++;
 
         rc = ub_submit_scsi(sc, cmd);
-        spin_unlock_irqrestore(&sc->lock, flags);
+        spin_unlock_irqrestore(sc->lock, flags);
 
         if (rc != 0) {
                 printk("ub: reading capacity: submit error (%d)\n", rc); /* P3 */
@@ -2118,6 +2147,52 @@ static void ub_probe_timeout(unsigned long arg)
 }
 
 /*
+ * Reset with a Bulk reset.
+ */
+static int ub_sync_reset(struct ub_dev *sc)
+{
+        int ifnum = sc->intf->cur_altsetting->desc.bInterfaceNumber;
+        struct usb_ctrlrequest *cr;
+        struct completion compl;
+        struct timer_list timer;
+        int rc;
+
+        init_completion(&compl);
+
+        cr = &sc->work_cr;
+        cr->bRequestType = USB_TYPE_CLASS | USB_RECIP_INTERFACE;
+        cr->bRequest = US_BULK_RESET_REQUEST;
+        cr->wValue = cpu_to_le16(0);
+        cr->wIndex = cpu_to_le16(ifnum);
+        cr->wLength = cpu_to_le16(0);
+
+        usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
+            (unsigned char*) cr, NULL, 0, ub_probe_urb_complete, &compl);
+        sc->work_urb.actual_length = 0;
+        sc->work_urb.error_count = 0;
+        sc->work_urb.status = 0;
+
+        if ((rc = usb_submit_urb(&sc->work_urb, GFP_KERNEL)) != 0) {
+                printk(KERN_WARNING
+                     "%s: Unable to submit a bulk reset (%d)\n", sc->name, rc);
+                return rc;
+        }
+
+        init_timer(&timer);
+        timer.function = ub_probe_timeout;
+        timer.data = (unsigned long) &compl;
+        timer.expires = jiffies + UB_CTRL_TIMEOUT;
+        add_timer(&timer);
+
+        wait_for_completion(&compl);
+
+        del_timer_sync(&timer);
+        usb_kill_urb(&sc->work_urb);
+
+        return sc->work_urb.status;
+}
+
+/*
  * Get number of LUNs by the way of Bulk GetMaxLUN command.
  */
 static int ub_sync_getmaxlun(struct ub_dev *sc)
@@ -2333,7 +2408,7 @@ static int ub_probe(struct usb_interface *intf,
         if ((sc = kmalloc(sizeof(struct ub_dev), GFP_KERNEL)) == NULL)
                 goto err_core;
         memset(sc, 0, sizeof(struct ub_dev));
-        spin_lock_init(&sc->lock);
+        sc->lock = ub_next_lock();
         INIT_LIST_HEAD(&sc->luns);
         usb_init_urb(&sc->work_urb);
         tasklet_init(&sc->tasklet, ub_scsi_action, (unsigned long)sc);
@@ -2483,7 +2558,7 @@ static int ub_probe_lun(struct ub_dev *sc, int lnum)
         disk->driverfs_dev = &sc->intf->dev;
 
         rc = -ENOMEM;
-        if ((q = blk_init_queue(ub_request_fn, &sc->lock)) == NULL)
+        if ((q = blk_init_queue(ub_request_fn, sc->lock)) == NULL)
                 goto err_blkqinit;
 
         disk->queue = q;
@@ -2554,7 +2629,7 @@ static void ub_disconnect(struct usb_interface *intf)
          * and the whole queue drains. So, we just use this code to
          * print warnings.
          */
-        spin_lock_irqsave(&sc->lock, flags);
+        spin_lock_irqsave(sc->lock, flags);
         {
                 struct ub_scsi_cmd *cmd;
                 int cnt = 0;
@@ -2571,7 +2646,7 @@ static void ub_disconnect(struct usb_interface *intf)
                             "%d was queued after shutdown\n", sc->name, cnt);
                 }
         }
-        spin_unlock_irqrestore(&sc->lock, flags);
+        spin_unlock_irqrestore(sc->lock, flags);
 
         /*
          * Unregister the upper layer.
@@ -2590,19 +2665,15 @@ static void ub_disconnect(struct usb_interface *intf)
         }
 
         /*
-         * Taking a lock on a structure which is about to be freed
-         * is very nonsensual. Here it is largely a way to do a debug freeze,
-         * and a bracket which shows where the nonsensual code segment ends.
-         *
          * Testing for -EINPROGRESS is always a bug, so we are bending
          * the rules a little.
          */
-        spin_lock_irqsave(&sc->lock, flags);
+        spin_lock_irqsave(sc->lock, flags);
         if (sc->work_urb.status == -EINPROGRESS) {      /* janitors: ignore */
                 printk(KERN_WARNING "%s: "
                     "URB is active after disconnect\n", sc->name);
         }
-        spin_unlock_irqrestore(&sc->lock, flags);
+        spin_unlock_irqrestore(sc->lock, flags);
 
         /*
          * There is virtually no chance that other CPU runs times so long
@@ -2636,6 +2707,10 @@ static struct usb_driver ub_driver = {
 static int __init ub_init(void)
 {
         int rc;
+        int i;
+
+        for (i = 0; i < UB_QLOCK_NUM; i++)
+                spin_lock_init(&ub_qlockv[i]);
 
         if ((rc = register_blkdev(UB_MAJOR, DRV_NAME)) != 0)
                 goto err_regblkdev;
diff --git a/drivers/block/umem.c b/drivers/block/umem.c
index a3614e6a68d0..4ada1268b40d 100644
--- a/drivers/block/umem.c
+++ b/drivers/block/umem.c
@@ -882,7 +882,7 @@ static int __devinit mm_pci_probe(struct pci_dev *dev, const struct pci_device_i
                card->card_number, dev->bus->number, dev->devfn);
 
         if (pci_set_dma_mask(dev, 0xffffffffffffffffLL) &&
-            !pci_set_dma_mask(dev, 0xffffffffLL)) {
+            pci_set_dma_mask(dev, 0xffffffffLL)) {
                 printk(KERN_WARNING "MM%d: NO suitable DMA found\n",num_cards);
                 return  -ENOMEM;
         }