50 files changed, 3539 insertions, 506 deletions

diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index a7a0813b24cb..c46666a24809 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -992,6 +992,16 @@ config SCSI_IZIP_SLOW_CTR
 
           Generally, saying N is fine.
 
+config SCSI_MVSAS
+        tristate "Marvell 88SE6440 SAS/SATA support"
+        depends on PCI && SCSI
+        select SCSI_SAS_LIBSAS
+        help
+          This driver supports Marvell SAS/SATA PCI devices.
+
+          To compiler this driver as a module, choose M here: the module
+          will be called mvsas.
+
 config SCSI_NCR53C406A
         tristate "NCR53c406a SCSI support"
         depends on ISA && SCSI
diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
index 925c26b4fff9..23e6ecbd4778 100644
--- a/drivers/scsi/Makefile
+++ b/drivers/scsi/Makefile
@@ -119,6 +119,7 @@ obj-$(CONFIG_SCSI_IBMVSCSI)	+= ibmvscsi/
 obj-$(CONFIG_SCSI_IBMVSCSIS)    += ibmvscsi/
 obj-$(CONFIG_SCSI_HPTIOP)       += hptiop.o
 obj-$(CONFIG_SCSI_STEX)         += stex.o
+obj-$(CONFIG_SCSI_MVSAS)        += mvsas.o
 obj-$(CONFIG_PS3_ROM)           += ps3rom.o
 
 obj-$(CONFIG_ARM)               += arm/
diff --git a/drivers/scsi/aic7xxx/aic79xx_osm_pci.c b/drivers/scsi/aic7xxx/aic79xx_osm_pci.c
index 4150c8a8fdc2..dfaaae5e73ae 100644
--- a/drivers/scsi/aic7xxx/aic79xx_osm_pci.c
+++ b/drivers/scsi/aic7xxx/aic79xx_osm_pci.c
@@ -89,7 +89,7 @@ ahd_linux_pci_dev_suspend(struct pci_dev *pdev, pm_message_t mesg)
         pci_save_state(pdev);
         pci_disable_device(pdev);
 
-        if (mesg.event == PM_EVENT_SUSPEND)
+        if (mesg.event & PM_EVENT_SLEEP)
                 pci_set_power_state(pdev, PCI_D3hot);
 
         return rc;
diff --git a/drivers/scsi/aic7xxx/aic7xxx_core.c b/drivers/scsi/aic7xxx/aic7xxx_core.c
index 6d2ae641273c..64e62ce59c15 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_core.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_core.c
@@ -695,15 +695,16 @@ ahc_handle_seqint(struct ahc_softc *ahc, u_int intstat)
                         scb_index = ahc_inb(ahc, SCB_TAG);
                         scb = ahc_lookup_scb(ahc, scb_index);
                         if (devinfo.role == ROLE_INITIATOR) {
-                                if (scb == NULL)
-                                        panic("HOST_MSG_LOOP with "
-                                              "invalid SCB %x\n", scb_index);
+                                if (bus_phase == P_MESGOUT) {
+                                        if (scb == NULL)
+                                                panic("HOST_MSG_LOOP with "
+                                                      "invalid SCB %x\n",
+                                                      scb_index);
 
-                                if (bus_phase == P_MESGOUT)
                                         ahc_setup_initiator_msgout(ahc,
                                                                    &devinfo,
                                                                    scb);
-                                else {
+                                } else {
                                         ahc->msg_type =
                                             MSG_TYPE_INITIATOR_MSGIN;
                                         ahc->msgin_index = 0;
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c b/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
index dd6e21d6f1dd..3d3eaef65fb3 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
@@ -134,7 +134,7 @@ ahc_linux_pci_dev_suspend(struct pci_dev *pdev, pm_message_t mesg)
         pci_save_state(pdev);
         pci_disable_device(pdev);
 
-        if (mesg.event == PM_EVENT_SUSPEND)
+        if (mesg.event & PM_EVENT_SLEEP)
                 pci_set_power_state(pdev, PCI_D3hot);
 
         return rc;
diff --git a/drivers/scsi/aic94xx/aic94xx.h b/drivers/scsi/aic94xx/aic94xx.h
index 32f513b1b78a..eb8efdcefe48 100644
--- a/drivers/scsi/aic94xx/aic94xx.h
+++ b/drivers/scsi/aic94xx/aic94xx.h
@@ -102,6 +102,7 @@ int  asd_abort_task_set(struct domain_device *, u8 *lun);
 int  asd_clear_aca(struct domain_device *, u8 *lun);
 int  asd_clear_task_set(struct domain_device *, u8 *lun);
 int  asd_lu_reset(struct domain_device *, u8 *lun);
+int  asd_I_T_nexus_reset(struct domain_device *dev);
 int  asd_query_task(struct sas_task *);
 
 /* ---------- Adapter and Port management ---------- */
diff --git a/drivers/scsi/aic94xx/aic94xx_hwi.h b/drivers/scsi/aic94xx/aic94xx_hwi.h
index 150f6706d23f..abc757559c1a 100644
--- a/drivers/scsi/aic94xx/aic94xx_hwi.h
+++ b/drivers/scsi/aic94xx/aic94xx_hwi.h
@@ -140,7 +140,7 @@ struct asd_ascb {
 
         /* internally generated command */
         struct timer_list timer;
-        struct completion completion;
+        struct completion *completion;
         u8        tag_valid:1;
         __be16    tag;            /* error recovery only */
 
@@ -294,7 +294,6 @@ static inline void asd_init_ascb(struct asd_ha_struct *asd_ha,
         ascb->timer.function = NULL;
         init_timer(&ascb->timer);
         ascb->tc_index = -1;
-        init_completion(&ascb->completion);
 }
 
 /* Must be called with the tc_index_lock held!
diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
index 5d761eb67442..88d1e731b65e 100644
--- a/drivers/scsi/aic94xx/aic94xx_init.c
+++ b/drivers/scsi/aic94xx/aic94xx_init.c
@@ -1003,7 +1003,7 @@ static struct sas_domain_function_template aic94xx_transport_functions = {
         .lldd_abort_task_set    = asd_abort_task_set,
         .lldd_clear_aca         = asd_clear_aca,
         .lldd_clear_task_set    = asd_clear_task_set,
-        .lldd_I_T_nexus_reset   = NULL,
+        .lldd_I_T_nexus_reset   = asd_I_T_nexus_reset,
         .lldd_lu_reset          = asd_lu_reset,
         .lldd_query_task        = asd_query_task,
 
diff --git a/drivers/scsi/aic94xx/aic94xx_scb.c b/drivers/scsi/aic94xx/aic94xx_scb.c
index 0febad4dd75f..ab350504ca5a 100644
--- a/drivers/scsi/aic94xx/aic94xx_scb.c
+++ b/drivers/scsi/aic94xx/aic94xx_scb.c
@@ -458,13 +458,19 @@ static void escb_tasklet_complete(struct asd_ascb *ascb,
                 tc_abort = le16_to_cpu(tc_abort);
 
                 list_for_each_entry_safe(a, b, &asd_ha->seq.pend_q, list) {
-                        struct sas_task *task = ascb->uldd_task;
+                        struct sas_task *task = a->uldd_task;
+
+                        if (a->tc_index != tc_abort)
+                                continue;
 
-                        if (task && a->tc_index == tc_abort) {
+                        if (task) {
                                 failed_dev = task->dev;
                                 sas_task_abort(task);
-                                break;
+                        } else {
+                                ASD_DPRINTK("R_T_A for non TASK scb 0x%x\n",
+                                            a->scb->header.opcode);
                         }
+                        break;
                 }
 
                 if (!failed_dev) {
@@ -478,7 +484,7 @@ static void escb_tasklet_complete(struct asd_ascb *ascb,
                  * that the EH will wake up and do something.
                  */
                 list_for_each_entry_safe(a, b, &asd_ha->seq.pend_q, list) {
-                        struct sas_task *task = ascb->uldd_task;
+                        struct sas_task *task = a->uldd_task;
 
                         if (task &&
                             task->dev == failed_dev &&
diff --git a/drivers/scsi/aic94xx/aic94xx_task.c b/drivers/scsi/aic94xx/aic94xx_task.c
index 965d4bb999d9..008df9ab92a5 100644
--- a/drivers/scsi/aic94xx/aic94xx_task.c
+++ b/drivers/scsi/aic94xx/aic94xx_task.c
@@ -343,11 +343,13 @@ Again:
         task->task_state_flags &= ~SAS_TASK_AT_INITIATOR;
         task->task_state_flags |= SAS_TASK_STATE_DONE;
         if (unlikely((task->task_state_flags & SAS_TASK_STATE_ABORTED))) {
+                struct completion *completion = ascb->completion;
                 spin_unlock_irqrestore(&task->task_state_lock, flags);
                 ASD_DPRINTK("task 0x%p done with opcode 0x%x resp 0x%x "
                             "stat 0x%x but aborted by upper layer!\n",
                             task, opcode, ts->resp, ts->stat);
-                complete(&ascb->completion);
+                if (completion)
+                        complete(completion);
         } else {
                 spin_unlock_irqrestore(&task->task_state_lock, flags);
                 task->lldd_task = NULL;
diff --git a/drivers/scsi/aic94xx/aic94xx_tmf.c b/drivers/scsi/aic94xx/aic94xx_tmf.c
index b52124f3d3ac..b9ac8f703a1d 100644
--- a/drivers/scsi/aic94xx/aic94xx_tmf.c
+++ b/drivers/scsi/aic94xx/aic94xx_tmf.c
@@ -53,50 +53,64 @@ static int asd_enqueue_internal(struct asd_ascb *ascb,
         return res;
 }
 
-static inline void asd_timedout_common(unsigned long data)
-{
-        struct asd_ascb *ascb = (void *) data;
-        struct asd_seq_data *seq = &ascb->ha->seq;
-        unsigned long flags;
+/* ---------- CLEAR NEXUS ---------- */
 
-        spin_lock_irqsave(&seq->pend_q_lock, flags);
-        seq->pending--;
-        list_del_init(&ascb->list);
-        spin_unlock_irqrestore(&seq->pend_q_lock, flags);
-}
+struct tasklet_completion_status {
+        int     dl_opcode;
+        int     tmf_state;
+        u8      tag_valid:1;
+        __be16  tag;
+};
+
+#define DECLARE_TCS(tcs) \
+        struct tasklet_completion_status tcs = { \
+                .dl_opcode = 0, \
+                .tmf_state = 0, \
+                .tag_valid = 0, \
+                .tag = 0, \
+        }
 
-/* ---------- CLEAR NEXUS ---------- */
 
 static void asd_clear_nexus_tasklet_complete(struct asd_ascb *ascb,
                                              struct done_list_struct *dl)
 {
+        struct tasklet_completion_status *tcs = ascb->uldd_task;
         ASD_DPRINTK("%s: here\n", __FUNCTION__);
         if (!del_timer(&ascb->timer)) {
                 ASD_DPRINTK("%s: couldn't delete timer\n", __FUNCTION__);
                 return;
         }
         ASD_DPRINTK("%s: opcode: 0x%x\n", __FUNCTION__, dl->opcode);
-        ascb->uldd_task = (void *) (unsigned long) dl->opcode;
-        complete(&ascb->completion);
+        tcs->dl_opcode = dl->opcode;
+        complete(ascb->completion);
+        asd_ascb_free(ascb);
 }
 
 static void asd_clear_nexus_timedout(unsigned long data)
 {
-        struct asd_ascb *ascb = (void *) data;
+        struct asd_ascb *ascb = (void *)data;
+        struct tasklet_completion_status *tcs = ascb->uldd_task;
 
         ASD_DPRINTK("%s: here\n", __FUNCTION__);
-        asd_timedout_common(data);
-        ascb->uldd_task = (void *) TMF_RESP_FUNC_FAILED;
-        complete(&ascb->completion);
+        tcs->dl_opcode = TMF_RESP_FUNC_FAILED;
+        complete(ascb->completion);
 }
 
 #define CLEAR_NEXUS_PRE         \
+        struct asd_ascb *ascb; \
+        struct scb *scb; \
+        int res; \
+        DECLARE_COMPLETION_ONSTACK(completion); \
+        DECLARE_TCS(tcs); \
+                \
         ASD_DPRINTK("%s: PRE\n", __FUNCTION__); \
         res = 1;                \
         ascb = asd_ascb_alloc_list(asd_ha, &res, GFP_KERNEL); \
         if (!ascb)              \
                 return -ENOMEM; \
                                 \
+        ascb->completion = &completion; \
+        ascb->uldd_task = &tcs; \
         scb = ascb->scb;        \
         scb->header.opcode = CLEAR_NEXUS
 
@@ -107,10 +121,11 @@ static void asd_clear_nexus_timedout(unsigned long data)
         if (res)                \
                 goto out_err;   \
         ASD_DPRINTK("%s: clear nexus posted, waiting...\n", __FUNCTION__); \
-        wait_for_completion(&ascb->completion); \
-        res = (int) (unsigned long) ascb->uldd_task; \
+        wait_for_completion(&completion); \
+        res = tcs.dl_opcode; \
         if (res == TC_NO_ERROR) \
                 res = TMF_RESP_FUNC_COMPLETE;   \
+        return res; \
 out_err:                        \
         asd_ascb_free(ascb);    \
         return res
@@ -118,9 +133,6 @@ out_err:                        \
 int asd_clear_nexus_ha(struct sas_ha_struct *sas_ha)
 {
         struct asd_ha_struct *asd_ha = sas_ha->lldd_ha;
-        struct asd_ascb *ascb;
-        struct scb *scb;
-        int res;
 
         CLEAR_NEXUS_PRE;
         scb->clear_nexus.nexus = NEXUS_ADAPTER;
@@ -130,9 +142,6 @@ int asd_clear_nexus_ha(struct sas_ha_struct *sas_ha)
 int asd_clear_nexus_port(struct asd_sas_port *port)
 {
         struct asd_ha_struct *asd_ha = port->ha->lldd_ha;
-        struct asd_ascb *ascb;
-        struct scb *scb;
-        int res;
 
         CLEAR_NEXUS_PRE;
         scb->clear_nexus.nexus = NEXUS_PORT;
@@ -140,37 +149,77 @@ int asd_clear_nexus_port(struct asd_sas_port *port)
         CLEAR_NEXUS_POST;
 }
 
-#if 0
-static int asd_clear_nexus_I_T(struct domain_device *dev)
+enum clear_nexus_phase {
+        NEXUS_PHASE_PRE,
+        NEXUS_PHASE_POST,
+        NEXUS_PHASE_RESUME,
+};
+
+static int asd_clear_nexus_I_T(struct domain_device *dev,
+                               enum clear_nexus_phase phase)
 {
         struct asd_ha_struct *asd_ha = dev->port->ha->lldd_ha;
-        struct asd_ascb *ascb;
-        struct scb *scb;
-        int res;
 
         CLEAR_NEXUS_PRE;
         scb->clear_nexus.nexus = NEXUS_I_T;
-        scb->clear_nexus.flags = SEND_Q | EXEC_Q | NOTINQ;
-        if (dev->tproto)
-                scb->clear_nexus.flags |= SUSPEND_TX;
+        switch (phase) {
+        case NEXUS_PHASE_PRE:
+                scb->clear_nexus.flags = EXEC_Q | SUSPEND_TX;
+                break;
+        case NEXUS_PHASE_POST:
+                scb->clear_nexus.flags = SEND_Q | NOTINQ;
+                break;
+        case NEXUS_PHASE_RESUME:
+                scb->clear_nexus.flags = RESUME_TX;
+        }
         scb->clear_nexus.conn_handle = cpu_to_le16((u16)(unsigned long)
                                                    dev->lldd_dev);
         CLEAR_NEXUS_POST;
 }
-#endif
+
+int asd_I_T_nexus_reset(struct domain_device *dev)
+{
+        int res, tmp_res, i;
+        struct sas_phy *phy = sas_find_local_phy(dev);
+        /* Standard mandates link reset for ATA  (type 0) and
+         * hard reset for SSP (type 1) */
+        int reset_type = (dev->dev_type == SATA_DEV ||
+                          (dev->tproto & SAS_PROTOCOL_STP)) ? 0 : 1;
+
+        asd_clear_nexus_I_T(dev, NEXUS_PHASE_PRE);
+        /* send a hard reset */
+        ASD_DPRINTK("sending %s reset to %s\n",
+                    reset_type ? "hard" : "soft", phy->dev.bus_id);
+        res = sas_phy_reset(phy, reset_type);
+        if (res == TMF_RESP_FUNC_COMPLETE) {
+                /* wait for the maximum settle time */
+                msleep(500);
+                /* clear all outstanding commands (keep nexus suspended) */
+                asd_clear_nexus_I_T(dev, NEXUS_PHASE_POST);
+        }
+        for (i = 0 ; i < 3; i++) {
+                tmp_res = asd_clear_nexus_I_T(dev, NEXUS_PHASE_RESUME);
+                if (tmp_res == TC_RESUME)
+                        return res;
+                msleep(500);
+        }
+
+        /* This is a bit of a problem:  the sequencer is still suspended
+         * and is refusing to resume.  Hope it will resume on a bigger hammer
+         * or the disk is lost */
+        dev_printk(KERN_ERR, &phy->dev,
+                   "Failed to resume nexus after reset 0x%x\n", tmp_res);
+
+        return TMF_RESP_FUNC_FAILED;
+}
 
 static int asd_clear_nexus_I_T_L(struct domain_device *dev, u8 *lun)
 {
         struct asd_ha_struct *asd_ha = dev->port->ha->lldd_ha;
-        struct asd_ascb *ascb;
-        struct scb *scb;
-        int res;
 
         CLEAR_NEXUS_PRE;
         scb->clear_nexus.nexus = NEXUS_I_T_L;
         scb->clear_nexus.flags = SEND_Q | EXEC_Q | NOTINQ;
-        if (dev->tproto)
-                scb->clear_nexus.flags |= SUSPEND_TX;
         memcpy(scb->clear_nexus.ssp_task.lun, lun, 8);
         scb->clear_nexus.conn_handle = cpu_to_le16((u16)(unsigned long)
                                                    dev->lldd_dev);
@@ -181,9 +230,6 @@ static int asd_clear_nexus_tag(struct sas_task *task)
 {
         struct asd_ha_struct *asd_ha = task->dev->port->ha->lldd_ha;
         struct asd_ascb *tascb = task->lldd_task;
-        struct asd_ascb *ascb;
-        struct scb *scb;
-        int res;
 
         CLEAR_NEXUS_PRE;
         scb->clear_nexus.nexus = NEXUS_TAG;
@@ -199,9 +245,6 @@ static int asd_clear_nexus_index(struct sas_task *task)
 {
         struct asd_ha_struct *asd_ha = task->dev->port->ha->lldd_ha;
         struct asd_ascb *tascb = task->lldd_task;
-        struct asd_ascb *ascb;
-        struct scb *scb;
-        int res;
 
         CLEAR_NEXUS_PRE;
         scb->clear_nexus.nexus = NEXUS_TRANS_CX;
@@ -217,11 +260,11 @@ static int asd_clear_nexus_index(struct sas_task *task)
 static void asd_tmf_timedout(unsigned long data)
 {
         struct asd_ascb *ascb = (void *) data;
+        struct tasklet_completion_status *tcs = ascb->uldd_task;
 
         ASD_DPRINTK("tmf timed out\n");
-        asd_timedout_common(data);
-        ascb->uldd_task = (void *) TMF_RESP_FUNC_FAILED;
-        complete(&ascb->completion);
+        tcs->tmf_state = TMF_RESP_FUNC_FAILED;
+        complete(ascb->completion);
 }
 
 static int asd_get_tmf_resp_tasklet(struct asd_ascb *ascb,
@@ -273,18 +316,24 @@ static int asd_get_tmf_resp_tasklet(struct asd_ascb *ascb,
 static void asd_tmf_tasklet_complete(struct asd_ascb *ascb,
                                      struct done_list_struct *dl)
 {
+        struct tasklet_completion_status *tcs;
+
         if (!del_timer(&ascb->timer))
                 return;
 
+        tcs = ascb->uldd_task;
         ASD_DPRINTK("tmf tasklet complete\n");
 
-        if (dl->opcode == TC_SSP_RESP)
-                ascb->uldd_task = (void *) (unsigned long)
-                        asd_get_tmf_resp_tasklet(ascb, dl);
-        else
-                ascb->uldd_task = (void *) 0xFF00 + (unsigned long) dl->opcode;
+        tcs->dl_opcode = dl->opcode;
+
+        if (dl->opcode == TC_SSP_RESP) {
+                tcs->tmf_state = asd_get_tmf_resp_tasklet(ascb, dl);
+                tcs->tag_valid = ascb->tag_valid;
+                tcs->tag = ascb->tag;
+        }
 
-        complete(&ascb->completion);
+        complete(ascb->completion);
+        asd_ascb_free(ascb);
 }
 
 static inline int asd_clear_nexus(struct sas_task *task)
@@ -292,15 +341,19 @@ static inline int asd_clear_nexus(struct sas_task *task)
         int res = TMF_RESP_FUNC_FAILED;
         int leftover;
         struct asd_ascb *tascb = task->lldd_task;
+        DECLARE_COMPLETION_ONSTACK(completion);
         unsigned long flags;
 
+        tascb->completion = &completion;
+
         ASD_DPRINTK("task not done, clearing nexus\n");
         if (tascb->tag_valid)
                 res = asd_clear_nexus_tag(task);
         else
                 res = asd_clear_nexus_index(task);
-        leftover = wait_for_completion_timeout(&tascb->completion,
+        leftover = wait_for_completion_timeout(&completion,
                                                AIC94XX_SCB_TIMEOUT);
+        tascb->completion = NULL;
         ASD_DPRINTK("came back from clear nexus\n");
         spin_lock_irqsave(&task->task_state_lock, flags);
         if (leftover < 1)
@@ -354,6 +407,11 @@ int asd_abort_task(struct sas_task *task)
         struct asd_ascb *ascb = NULL;
         struct scb *scb;
         int leftover;
+        DECLARE_TCS(tcs);
+        DECLARE_COMPLETION_ONSTACK(completion);
+        DECLARE_COMPLETION_ONSTACK(tascb_completion);
+
+        tascb->completion = &tascb_completion;
 
         spin_lock_irqsave(&task->task_state_lock, flags);
         if (task->task_state_flags & SAS_TASK_STATE_DONE) {
@@ -367,8 +425,10 @@ int asd_abort_task(struct sas_task *task)
         ascb = asd_ascb_alloc_list(asd_ha, &res, GFP_KERNEL);
         if (!ascb)
                 return -ENOMEM;
-        scb = ascb->scb;
 
+        ascb->uldd_task = &tcs;
+        ascb->completion = &completion;
+        scb = ascb->scb;
         scb->header.opcode = SCB_ABORT_TASK;
 
         switch (task->task_proto) {
@@ -410,13 +470,12 @@ int asd_abort_task(struct sas_task *task)
         res = asd_enqueue_internal(ascb, asd_tmf_tasklet_complete,
                                    asd_tmf_timedout);
         if (res)
-                goto out;
-        wait_for_completion(&ascb->completion);
+                goto out_free;
+        wait_for_completion(&completion);
         ASD_DPRINTK("tmf came back\n");
 
-        res = (int) (unsigned long) ascb->uldd_task;
-        tascb->tag = ascb->tag;
-        tascb->tag_valid = ascb->tag_valid;
+        tascb->tag = tcs.tag;
+        tascb->tag_valid = tcs.tag_valid;
 
         spin_lock_irqsave(&task->task_state_lock, flags);
         if (task->task_state_flags & SAS_TASK_STATE_DONE) {
@@ -427,63 +486,68 @@ int asd_abort_task(struct sas_task *task)
         }
         spin_unlock_irqrestore(&task->task_state_lock, flags);
 
-        switch (res) {
-        /* The task to be aborted has been sent to the device.
-         * We got a Response IU for the ABORT TASK TMF. */
-        case TC_NO_ERROR + 0xFF00:
-        case TMF_RESP_FUNC_COMPLETE:
-        case TMF_RESP_FUNC_FAILED:
-                res = asd_clear_nexus(task);
-                break;
-        case TMF_RESP_INVALID_FRAME:
-        case TMF_RESP_OVERLAPPED_TAG:
-        case TMF_RESP_FUNC_ESUPP:
-        case TMF_RESP_NO_LUN:
-                goto out_done; break;
-        }
-        /* In the following we assume that the managing layer
-         * will _never_ make a mistake, when issuing ABORT TASK.
-         */
-        switch (res) {
-        default:
-                res = asd_clear_nexus(task);
-                /* fallthrough */
-        case TC_NO_ERROR + 0xFF00:
-        case TMF_RESP_FUNC_COMPLETE:
-                break;
-        /* The task hasn't been sent to the device xor we never got
-         * a (sane) Response IU for the ABORT TASK TMF.
-         */
-        case TF_NAK_RECV + 0xFF00:
-                res = TMF_RESP_INVALID_FRAME;
-                break;
-        case TF_TMF_TASK_DONE + 0xFF00: /* done but not reported yet */
+        if (tcs.dl_opcode == TC_SSP_RESP) {
+                /* The task to be aborted has been sent to the device.
+                 * We got a Response IU for the ABORT TASK TMF. */
+                if (tcs.tmf_state == TMF_RESP_FUNC_COMPLETE)
+                        res = asd_clear_nexus(task);
+                else
+                        res = tcs.tmf_state;
+        } else if (tcs.dl_opcode == TC_NO_ERROR &&
+                   tcs.tmf_state == TMF_RESP_FUNC_FAILED) {
+                /* timeout */
                 res = TMF_RESP_FUNC_FAILED;
-                leftover = wait_for_completion_timeout(&tascb->completion,
-                                                       AIC94XX_SCB_TIMEOUT);
-                spin_lock_irqsave(&task->task_state_lock, flags);
-                if (leftover < 1)
+        } else {
+                /* In the following we assume that the managing layer
+                 * will _never_ make a mistake, when issuing ABORT
+                 * TASK.
+                 */
+                switch (tcs.dl_opcode) {
+                default:
+                        res = asd_clear_nexus(task);
+                        /* fallthrough */
+                case TC_NO_ERROR:
+                        break;
+                        /* The task hasn't been sent to the device xor
+                         * we never got a (sane) Response IU for the
+                         * ABORT TASK TMF.
+                         */
+                case TF_NAK_RECV:
+                        res = TMF_RESP_INVALID_FRAME;
+                        break;
+                case TF_TMF_TASK_DONE:  /* done but not reported yet */
                         res = TMF_RESP_FUNC_FAILED;
-                if (task->task_state_flags & SAS_TASK_STATE_DONE)
+                        leftover =
+                                wait_for_completion_timeout(&tascb_completion,
+                                                          AIC94XX_SCB_TIMEOUT);
+                        spin_lock_irqsave(&task->task_state_lock, flags);
+                        if (leftover < 1)
+                                res = TMF_RESP_FUNC_FAILED;
+                        if (task->task_state_flags & SAS_TASK_STATE_DONE)
+                                res = TMF_RESP_FUNC_COMPLETE;
+                        spin_unlock_irqrestore(&task->task_state_lock, flags);
+                        break;
+                case TF_TMF_NO_TAG:
+                case TF_TMF_TAG_FREE: /* the tag is in the free list */
+                case TF_TMF_NO_CONN_HANDLE: /* no such device */
                         res = TMF_RESP_FUNC_COMPLETE;
-                spin_unlock_irqrestore(&task->task_state_lock, flags);
-                goto out_done;
-        case TF_TMF_NO_TAG + 0xFF00:
-        case TF_TMF_TAG_FREE + 0xFF00: /* the tag is in the free list */
-        case TF_TMF_NO_CONN_HANDLE + 0xFF00: /* no such device */
-                res = TMF_RESP_FUNC_COMPLETE;
-                goto out_done;
-        case TF_TMF_NO_CTX + 0xFF00: /* not in seq, or proto != SSP */
-                res = TMF_RESP_FUNC_ESUPP;
-                goto out;
+                        break;
+                case TF_TMF_NO_CTX: /* not in seq, or proto != SSP */
+                        res = TMF_RESP_FUNC_ESUPP;
+                        break;
+                }
         }
-out_done:
+ out_done:
+        tascb->completion = NULL;
         if (res == TMF_RESP_FUNC_COMPLETE) {
                 task->lldd_task = NULL;
                 mb();
                 asd_ascb_free(tascb);
         }
-out:
+        ASD_DPRINTK("task 0x%p aborted, res: 0x%x\n", task, res);
+        return res;
+
+ out_free:
         asd_ascb_free(ascb);
         ASD_DPRINTK("task 0x%p aborted, res: 0x%x\n", task, res);
         return res;
@@ -511,6 +575,8 @@ static int asd_initiate_ssp_tmf(struct domain_device *dev, u8 *lun,
         struct asd_ascb *ascb;
         int res = 1;
         struct scb *scb;
+        DECLARE_COMPLETION_ONSTACK(completion);
+        DECLARE_TCS(tcs);
 
         if (!(dev->tproto & SAS_PROTOCOL_SSP))
                 return TMF_RESP_FUNC_ESUPP;
@@ -518,6 +584,9 @@ static int asd_initiate_ssp_tmf(struct domain_device *dev, u8 *lun,
         ascb = asd_ascb_alloc_list(asd_ha, &res, GFP_KERNEL);
         if (!ascb)
                 return -ENOMEM;
+
+        ascb->completion = &completion;
+        ascb->uldd_task = &tcs;
         scb = ascb->scb;
 
         if (tmf == TMF_QUERY_TASK)
@@ -550,31 +619,32 @@ static int asd_initiate_ssp_tmf(struct domain_device *dev, u8 *lun,
                                    asd_tmf_timedout);
         if (res)
                 goto out_err;
-        wait_for_completion(&ascb->completion);
-        res = (int) (unsigned long) ascb->uldd_task;
+        wait_for_completion(&completion);
 
-        switch (res) {
-        case TC_NO_ERROR + 0xFF00:
+        switch (tcs.dl_opcode) {
+        case TC_NO_ERROR:
                 res = TMF_RESP_FUNC_COMPLETE;
                 break;
-        case TF_NAK_RECV + 0xFF00:
+        case TF_NAK_RECV:
                 res = TMF_RESP_INVALID_FRAME;
                 break;
-        case TF_TMF_TASK_DONE + 0xFF00:
+        case TF_TMF_TASK_DONE:
                 res = TMF_RESP_FUNC_FAILED;
                 break;
-        case TF_TMF_NO_TAG + 0xFF00:
-        case TF_TMF_TAG_FREE + 0xFF00: /* the tag is in the free list */
-        case TF_TMF_NO_CONN_HANDLE + 0xFF00: /* no such device */
+        case TF_TMF_NO_TAG:
+        case TF_TMF_TAG_FREE: /* the tag is in the free list */
+        case TF_TMF_NO_CONN_HANDLE: /* no such device */
                 res = TMF_RESP_FUNC_COMPLETE;
                 break;
-        case TF_TMF_NO_CTX + 0xFF00: /* not in seq, or proto != SSP */
+        case TF_TMF_NO_CTX: /* not in seq, or proto != SSP */
                 res = TMF_RESP_FUNC_ESUPP;
                 break;
         default:
                 /* Allow TMF response codes to propagate upwards */
+                res = tcs.dl_opcode;
                 break;
         }
+        return res;
 out_err:
         asd_ascb_free(ascb);
         return res;
diff --git a/drivers/scsi/arcmsr/arcmsr.h b/drivers/scsi/arcmsr/arcmsr.h
index 57786502e3ec..0393707bdfce 100644
--- a/drivers/scsi/arcmsr/arcmsr.h
+++ b/drivers/scsi/arcmsr/arcmsr.h
@@ -48,7 +48,7 @@ struct class_device_attribute;
 /*The limit of outstanding scsi command that firmware can handle*/
 #define ARCMSR_MAX_OUTSTANDING_CMD                                              256
 #define ARCMSR_MAX_FREECCB_NUM                                                  320
-#define ARCMSR_DRIVER_VERSION                "Driver Version 1.20.00.15 2007/12/24"
+#define ARCMSR_DRIVER_VERSION                "Driver Version 1.20.00.15 2008/02/27"
 #define ARCMSR_SCSI_INITIATOR_ID                                                255
 #define ARCMSR_MAX_XFER_SECTORS                                                 512
 #define ARCMSR_MAX_XFER_SECTORS_B                                               4096
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
index 4f9ff32cfed0..f91f79c8007d 100644
--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -1387,18 +1387,16 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, \
         switch(controlcode) {
 
         case ARCMSR_MESSAGE_READ_RQBUFFER: {
-                unsigned long *ver_addr;
+                unsigned char *ver_addr;
                 uint8_t *pQbuffer, *ptmpQbuffer;
                 int32_t allxfer_len = 0;
-                void *tmp;
 
-                tmp = kmalloc(1032, GFP_KERNEL|GFP_DMA);
-                ver_addr = (unsigned long *)tmp;
-                if (!tmp) {
+                ver_addr = kmalloc(1032, GFP_ATOMIC);
+                if (!ver_addr) {
                         retvalue = ARCMSR_MESSAGE_FAIL;
                         goto message_out;
                 }
-                ptmpQbuffer = (uint8_t *) ver_addr;
+                ptmpQbuffer = ver_addr;
                 while ((acb->rqbuf_firstindex != acb->rqbuf_lastindex)
                         && (allxfer_len < 1031)) {
                         pQbuffer = &acb->rqbuffer[acb->rqbuf_firstindex];
@@ -1427,26 +1425,24 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, \
                         }
                         arcmsr_iop_message_read(acb);
                 }
-                memcpy(pcmdmessagefld->messagedatabuffer, (uint8_t *)ver_addr, allxfer_len);
+                memcpy(pcmdmessagefld->messagedatabuffer, ver_addr, allxfer_len);
                 pcmdmessagefld->cmdmessage.Length = allxfer_len;
                 pcmdmessagefld->cmdmessage.ReturnCode = ARCMSR_MESSAGE_RETURNCODE_OK;
-                kfree(tmp);
+                kfree(ver_addr);
                 }
                 break;
 
         case ARCMSR_MESSAGE_WRITE_WQBUFFER: {
-                unsigned long *ver_addr;
+                unsigned char *ver_addr;
                 int32_t my_empty_len, user_len, wqbuf_firstindex, wqbuf_lastindex;
                 uint8_t *pQbuffer, *ptmpuserbuffer;
-                void *tmp;
 
-                tmp = kmalloc(1032, GFP_KERNEL|GFP_DMA);
-                ver_addr = (unsigned long *)tmp;
-                if (!tmp) {
+                ver_addr = kmalloc(1032, GFP_ATOMIC);
+                if (!ver_addr) {
                         retvalue = ARCMSR_MESSAGE_FAIL;
                         goto message_out;
                 }
-                ptmpuserbuffer = (uint8_t *)ver_addr;
+                ptmpuserbuffer = ver_addr;
                 user_len = pcmdmessagefld->cmdmessage.Length;
                 memcpy(ptmpuserbuffer, pcmdmessagefld->messagedatabuffer, user_len);
                 wqbuf_lastindex = acb->wqbuf_lastindex;
@@ -1492,7 +1488,7 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, \
                                 retvalue = ARCMSR_MESSAGE_FAIL;
                         }
                         }
-                        kfree(tmp);
+                        kfree(ver_addr);
                 }
                 break;
 
diff --git a/drivers/scsi/arm/fas216.h b/drivers/scsi/arm/fas216.h
index 3e73e264972e..b65f4cf0eec9 100644
--- a/drivers/scsi/arm/fas216.h
+++ b/drivers/scsi/arm/fas216.h
@@ -313,7 +313,7 @@ typedef struct {
 
         /* miscellaneous */
         int                     internal_done;          /* flag to indicate request done */
-        struct scsi_eh_save     *ses;           /* holds request sense restore info */
+        struct scsi_eh_save     ses;            /* holds request sense restore info */
         unsigned long           magic_end;
 } FAS216_Info;
 
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index 6d67f5c0eb8e..27ebd336409b 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -160,7 +160,7 @@ static void gdth_readapp_event(gdth_ha_str *ha, unchar application,
 static void gdth_clear_events(void);
 
 static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
-                                    char *buffer, ushort count, int to_buffer);
+                                    char *buffer, ushort count);
 static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp);
 static int gdth_fill_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp, ushort hdrive);
 
@@ -182,7 +182,6 @@ static int gdth_ioctl(struct inode *inode, struct file *filep,
                       unsigned int cmd, unsigned long arg);
 
 static void gdth_flush(gdth_ha_str *ha);
-static int gdth_halt(struct notifier_block *nb, ulong event, void *buf);
 static int gdth_queuecommand(Scsi_Cmnd *scp,void (*done)(Scsi_Cmnd *));
 static int __gdth_queuecommand(gdth_ha_str *ha, struct scsi_cmnd *scp,
                                 struct gdth_cmndinfo *cmndinfo);
@@ -417,12 +416,6 @@ static inline void gdth_set_sglist(struct scsi_cmnd *cmd,
 #include "gdth_proc.h"
 #include "gdth_proc.c"
 
-/* notifier block to get a notify on system shutdown/halt/reboot */
-static struct notifier_block gdth_notifier = {
-    gdth_halt, NULL, 0
-};
-static int notifier_disabled = 0;
-
 static gdth_ha_str *gdth_find_ha(int hanum)
 {
         gdth_ha_str *ha;
@@ -445,8 +438,8 @@ static struct gdth_cmndinfo *gdth_get_cmndinfo(gdth_ha_str *ha)
         for (i=0; i<GDTH_MAXCMDS; ++i) {
                 if (ha->cmndinfo[i].index == 0) {
                         priv = &ha->cmndinfo[i];
-                        priv->index = i+1;
                         memset(priv, 0, sizeof(*priv));
+                        priv->index = i+1;
                         break;
                 }
         }
@@ -493,7 +486,6 @@ int __gdth_execute(struct scsi_device *sdev, gdth_cmd_str *gdtcmd, char *cmnd,
     gdth_ha_str *ha = shost_priv(sdev->host);
     Scsi_Cmnd *scp;
     struct gdth_cmndinfo cmndinfo;
-    struct scatterlist one_sg;
     DECLARE_COMPLETION_ONSTACK(wait);
     int rval;
 
@@ -507,13 +499,10 @@ int __gdth_execute(struct scsi_device *sdev, gdth_cmd_str *gdtcmd, char *cmnd,
     /* use request field to save the ptr. to completion struct. */
     scp->request = (struct request *)&wait;
     scp->timeout_per_command = timeout*HZ;
-    sg_init_one(&one_sg, gdtcmd, sizeof(*gdtcmd));
-    gdth_set_sglist(scp, &one_sg);
-    gdth_set_sg_count(scp, 1);
-    gdth_set_bufflen(scp, sizeof(*gdtcmd));
     scp->cmd_len = 12;
     memcpy(scp->cmnd, cmnd, 12);
     cmndinfo.priority = IOCTL_PRI;
+    cmndinfo.internal_cmd_str = gdtcmd;
     cmndinfo.internal_command = 1;
 
     TRACE(("__gdth_execute() cmd 0x%x\n", scp->cmnd[0]));
@@ -2355,7 +2344,7 @@ static void gdth_next(gdth_ha_str *ha)
  * buffers, kmap_atomic() as needed.
  */
 static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
-                                    char *buffer, ushort count, int to_buffer)
+                                    char *buffer, ushort count)
 {
     ushort cpcount,i, max_sg = gdth_sg_count(scp);
     ushort cpsum,cpnow;
@@ -2381,10 +2370,7 @@ static void gdth_copy_internal_data(gdth_ha_str *ha, Scsi_Cmnd *scp,
             }
             local_irq_save(flags);
             address = kmap_atomic(sg_page(sl), KM_BIO_SRC_IRQ) + sl->offset;
-            if (to_buffer)
-                memcpy(buffer, address, cpnow);
-            else
-                memcpy(address, buffer, cpnow);
+            memcpy(address, buffer, cpnow);
             flush_dcache_page(sg_page(sl));
             kunmap_atomic(address, KM_BIO_SRC_IRQ);
             local_irq_restore(flags);
@@ -2438,7 +2424,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
         strcpy(inq.vendor,ha->oem_name);
         sprintf(inq.product,"Host Drive  #%02d",t);
         strcpy(inq.revision,"   ");
-        gdth_copy_internal_data(ha, scp, (char*)&inq, sizeof(gdth_inq_data), 0);
+        gdth_copy_internal_data(ha, scp, (char*)&inq, sizeof(gdth_inq_data));
         break;
 
       case REQUEST_SENSE:
@@ -2448,7 +2434,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
         sd.key       = NO_SENSE;
         sd.info      = 0;
         sd.add_length= 0;
-        gdth_copy_internal_data(ha, scp, (char*)&sd, sizeof(gdth_sense_data), 0);
+        gdth_copy_internal_data(ha, scp, (char*)&sd, sizeof(gdth_sense_data));
         break;
 
       case MODE_SENSE:
@@ -2460,7 +2446,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
         mpd.bd.block_length[0] = (SECTOR_SIZE & 0x00ff0000) >> 16;
         mpd.bd.block_length[1] = (SECTOR_SIZE & 0x0000ff00) >> 8;
         mpd.bd.block_length[2] = (SECTOR_SIZE & 0x000000ff);
-        gdth_copy_internal_data(ha, scp, (char*)&mpd, sizeof(gdth_modep_data), 0);
+        gdth_copy_internal_data(ha, scp, (char*)&mpd, sizeof(gdth_modep_data));
         break;
 
       case READ_CAPACITY:
@@ -2470,7 +2456,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
         else
             rdc.last_block_no = cpu_to_be32(ha->hdr[t].size-1);
         rdc.block_length  = cpu_to_be32(SECTOR_SIZE);
-        gdth_copy_internal_data(ha, scp, (char*)&rdc, sizeof(gdth_rdcap_data), 0);
+        gdth_copy_internal_data(ha, scp, (char*)&rdc, sizeof(gdth_rdcap_data));
         break;
 
       case SERVICE_ACTION_IN:
@@ -2482,7 +2468,7 @@ static int gdth_internal_cache_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
             rdc16.last_block_no = cpu_to_be64(ha->hdr[t].size-1);
             rdc16.block_length  = cpu_to_be32(SECTOR_SIZE);
             gdth_copy_internal_data(ha, scp, (char*)&rdc16,
-                                                 sizeof(gdth_rdcap16_data), 0);
+                                                 sizeof(gdth_rdcap16_data));
         } else { 
             scp->result = DID_ABORT << 16;
         }
@@ -2852,6 +2838,7 @@ static int gdth_fill_raw_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp, unchar b)
 static int gdth_special_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
 {
     register gdth_cmd_str *cmdp;
+    struct gdth_cmndinfo *cmndinfo = gdth_cmnd_priv(scp);
     int cmd_index;
 
     cmdp= ha->pccb;
@@ -2860,7 +2847,7 @@ static int gdth_special_cmd(gdth_ha_str *ha, Scsi_Cmnd *scp)
     if (ha->type==GDT_EISA && ha->cmd_cnt>0) 
         return 0;
 
-    gdth_copy_internal_data(ha, scp, (char *)cmdp, sizeof(gdth_cmd_str), 1);
+    *cmdp = *cmndinfo->internal_cmd_str;
     cmdp->RequestBuffer = scp;
 
     /* search free command index */
@@ -3794,6 +3781,8 @@ static void gdth_timeout(ulong data)
     gdth_ha_str *ha;
     ulong flags;
 
+    BUG_ON(list_empty(&gdth_instances));
+
     ha = list_first_entry(&gdth_instances, gdth_ha_str, list);
     spin_lock_irqsave(&ha->smp_lock, flags);
 
@@ -4669,45 +4658,6 @@ static void gdth_flush(gdth_ha_str *ha)
     }
 }
 
-/* shutdown routine */
-static int gdth_halt(struct notifier_block *nb, ulong event, void *buf)
-{
-    gdth_ha_str *ha;
-#ifndef __alpha__
-    gdth_cmd_str    gdtcmd;
-    char            cmnd[MAX_COMMAND_SIZE];   
-#endif
-
-    if (notifier_disabled)
-        return NOTIFY_OK;
-
-    TRACE2(("gdth_halt() event %d\n",(int)event));
-    if (event != SYS_RESTART && event != SYS_HALT && event != SYS_POWER_OFF)
-        return NOTIFY_DONE;
-
-    notifier_disabled = 1;
-    printk("GDT-HA: Flushing all host drives .. ");
-    list_for_each_entry(ha, &gdth_instances, list) {
-        gdth_flush(ha);
-
-#ifndef __alpha__
-        /* controller reset */
-        memset(cmnd, 0xff, MAX_COMMAND_SIZE);
-        gdtcmd.BoardNode = LOCALBOARD;
-        gdtcmd.Service = CACHESERVICE;
-        gdtcmd.OpCode = GDT_RESET;
-        TRACE2(("gdth_halt(): reset controller %d\n", ha->hanum));
-        gdth_execute(ha->shost, &gdtcmd, cmnd, 10, NULL);
-#endif
-    }
-    printk("Done.\n");
-
-#ifdef GDTH_STATISTICS
-    del_timer(&gdth_timer);
-#endif
-    return NOTIFY_OK;
-}
-
 /* configure lun */
 static int gdth_slave_configure(struct scsi_device *sdev)
 {
@@ -5142,13 +5092,13 @@ static void gdth_remove_one(gdth_ha_str *ha)
 
         scsi_remove_host(shp);
 
+        gdth_flush(ha);
+
         if (ha->sdev) {
                 scsi_free_host_dev(ha->sdev);
                 ha->sdev = NULL;
         }
 
-        gdth_flush(ha);
-
         if (shp->irq)
                 free_irq(shp->irq,ha);
 
@@ -5174,6 +5124,24 @@ static void gdth_remove_one(gdth_ha_str *ha)
         scsi_host_put(shp);
 }
 
+static int gdth_halt(struct notifier_block *nb, ulong event, void *buf)
+{
+        gdth_ha_str *ha;
+
+        TRACE2(("gdth_halt() event %d\n", (int)event));
+        if (event != SYS_RESTART && event != SYS_HALT && event != SYS_POWER_OFF)
+                return NOTIFY_DONE;
+
+        list_for_each_entry(ha, &gdth_instances, list)
+                gdth_flush(ha);
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block gdth_notifier = {
+    gdth_halt, NULL, 0
+};
+
 static int __init gdth_init(void)
 {
         if (disable) {
@@ -5236,7 +5204,6 @@ static int __init gdth_init(void)
         add_timer(&gdth_timer);
 #endif
         major = register_chrdev(0,"gdth", &gdth_fops);
-        notifier_disabled = 0;
         register_reboot_notifier(&gdth_notifier);
         gdth_polling = FALSE;
         return 0;
@@ -5246,14 +5213,15 @@ static void __exit gdth_exit(void)
 {
         gdth_ha_str *ha;
 
-        list_for_each_entry(ha, &gdth_instances, list)
-                gdth_remove_one(ha);
+        unregister_chrdev(major, "gdth");
+        unregister_reboot_notifier(&gdth_notifier);
 
 #ifdef GDTH_STATISTICS
-        del_timer(&gdth_timer);
+        del_timer_sync(&gdth_timer);
 #endif
-        unregister_chrdev(major,"gdth");
-        unregister_reboot_notifier(&gdth_notifier);
+
+        list_for_each_entry(ha, &gdth_instances, list)
+                gdth_remove_one(ha);
 }
 
 module_init(gdth_init);
diff --git a/drivers/scsi/gdth.h b/drivers/scsi/gdth.h
index 1434c6b0297c..26e4e92515e0 100644
--- a/drivers/scsi/gdth.h
+++ b/drivers/scsi/gdth.h
@@ -915,6 +915,7 @@ typedef struct {
     struct gdth_cmndinfo {                      /* per-command private info */
         int index;
         int internal_command;                   /* don't call scsi_done */
+        gdth_cmd_str *internal_cmd_str;         /* crier for internal messages*/
         dma_addr_t sense_paddr;                 /* sense dma-addr */
         unchar priority;
         int timeout;
diff --git a/drivers/scsi/gdth_proc.c b/drivers/scsi/gdth_proc.c
index de5773443c62..ce0228e26aec 100644
--- a/drivers/scsi/gdth_proc.c
+++ b/drivers/scsi/gdth_proc.c
@@ -694,15 +694,13 @@ static void gdth_ioctl_free(gdth_ha_str *ha, int size, char *buf, ulong64 paddr)
 {
     ulong flags;
 
-    spin_lock_irqsave(&ha->smp_lock, flags);
-
     if (buf == ha->pscratch) {
+        spin_lock_irqsave(&ha->smp_lock, flags);
         ha->scratch_busy = FALSE;
+        spin_unlock_irqrestore(&ha->smp_lock, flags);
     } else {
         pci_free_consistent(ha->pdev, size, buf, paddr);
     }
-
-    spin_unlock_irqrestore(&ha->smp_lock, flags);
 }
 
 #ifdef GDTH_IOCTL_PROC
diff --git a/drivers/scsi/ibmvscsi/ibmvstgt.c b/drivers/scsi/ibmvscsi/ibmvstgt.c
index bd62131b97a1..e5881e92d0fb 100644
--- a/drivers/scsi/ibmvscsi/ibmvstgt.c
+++ b/drivers/scsi/ibmvscsi/ibmvstgt.c
@@ -290,7 +290,7 @@ static int ibmvstgt_cmd_done(struct scsi_cmnd *sc,
         int err = 0;
 
         dprintk("%p %p %x %u\n", iue, target, vio_iu(iue)->srp.cmd.cdb[0],
-                cmd->usg_sg);
+                scsi_sg_count(sc));
 
         if (scsi_sg_count(sc))
                 err = srp_transfer_data(sc, &vio_iu(iue)->srp.cmd, ibmvstgt_rdma, 1, 1);
@@ -838,9 +838,6 @@ static int ibmvstgt_probe(struct vio_dev *dev, const struct vio_device_id *id)
         if (!shost)
                 goto free_vport;
         shost->transportt = ibmvstgt_transport_template;
-        err = scsi_tgt_alloc_queue(shost);
-        if (err)
-                goto put_host;
 
         target = host_to_srp_target(shost);
         target->shost = shost;
@@ -872,6 +869,10 @@ static int ibmvstgt_probe(struct vio_dev *dev, const struct vio_device_id *id)
         if (err)
                 goto destroy_queue;
 
+        err = scsi_tgt_alloc_queue(shost);
+        if (err)
+                goto destroy_queue;
+
         return 0;
 destroy_queue:
         crq_queue_destroy(target);
diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
index bb152fb9fec7..7ed568f180ae 100644
--- a/drivers/scsi/ips.c
+++ b/drivers/scsi/ips.c
@@ -1576,7 +1576,7 @@ ips_make_passthru(ips_ha_t *ha, struct scsi_cmnd *SC, ips_scb_t *scb, int intr)
         METHOD_TRACE("ips_make_passthru", 1);
 
         scsi_for_each_sg(SC, sg, scsi_sg_count(SC), i)
-                length += sg[i].length;
+                length += sg->length;
 
         if (length < sizeof (ips_passthru_t)) {
                 /* wrong size */
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 59f8445eab0d..bdd7de7da39a 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -1708,8 +1708,8 @@ iscsi_session_setup(struct iscsi_transport *iscsit,
                 qdepth = ISCSI_DEF_CMD_PER_LUN;
         }
 
-        if (!is_power_of_2(cmds_max) ||
-            cmds_max >= ISCSI_MGMT_ITT_OFFSET) {
+        if (!is_power_of_2(cmds_max) || cmds_max >= ISCSI_MGMT_ITT_OFFSET ||
+            cmds_max < 2) {
                 if (cmds_max != 0)
                         printk(KERN_ERR "iscsi: invalid can_queue of %d. "
                                "can_queue must be a power of 2 and between "
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 7cd05b599a12..b0e5ac372a32 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -236,12 +236,12 @@ static void sas_ata_phy_reset(struct ata_port *ap)
         struct domain_device *dev = ap->private_data;
         struct sas_internal *i =
                 to_sas_internal(dev->port->ha->core.shost->transportt);
-        int res = 0;
+        int res = TMF_RESP_FUNC_FAILED;
 
         if (i->dft->lldd_I_T_nexus_reset)
                 res = i->dft->lldd_I_T_nexus_reset(dev);
 
-        if (res)
+        if (res != TMF_RESP_FUNC_COMPLETE)
                 SAS_DPRINTK("%s: Unable to reset I T nexus?\n", __FUNCTION__);
 
         switch (dev->sata_dev.command_set) {
@@ -656,21 +656,6 @@ out:
         return res;
 }
 
-static void sas_sata_propagate_sas_addr(struct domain_device *dev)
-{
-        unsigned long flags;
-        struct asd_sas_port *port = dev->port;
-        struct asd_sas_phy  *phy;
-
-        BUG_ON(dev->parent);
-
-        memcpy(port->attached_sas_addr, dev->sas_addr, SAS_ADDR_SIZE);
-        spin_lock_irqsave(&port->phy_list_lock, flags);
-        list_for_each_entry(phy, &port->phy_list, port_phy_el)
-                memcpy(phy->attached_sas_addr, dev->sas_addr, SAS_ADDR_SIZE);
-        spin_unlock_irqrestore(&port->phy_list_lock, flags);
-}
-
 #define ATA_IDENTIFY_DEV         0xEC
 #define ATA_IDENTIFY_PACKET_DEV  0xA1
 #define ATA_SET_FEATURES         0xEF
@@ -728,26 +713,6 @@ static int sas_discover_sata_dev(struct domain_device *dev)
                         goto out_err;
         }
 cont1:
-        /* Get WWN */
-        if (dev->port->oob_mode != SATA_OOB_MODE) {
-                memcpy(dev->sas_addr, dev->sata_dev.rps_resp.rps.stp_sas_addr,
-                       SAS_ADDR_SIZE);
-        } else if (dev->sata_dev.command_set == ATA_COMMAND_SET &&
-                   (le16_to_cpu(dev->sata_dev.identify_device[108]) & 0xF000)
-                   == 0x5000) {
-                int i;
-
-                for (i = 0; i < 4; i++) {
-                        dev->sas_addr[2*i] =
-             (le16_to_cpu(dev->sata_dev.identify_device[108+i]) & 0xFF00) >> 8;
-                        dev->sas_addr[2*i+1] =
-              le16_to_cpu(dev->sata_dev.identify_device[108+i]) & 0x00FF;
-                }
-        }
-        sas_hash_addr(dev->hashed_sas_addr, dev->sas_addr);
-        if (!dev->parent)
-                sas_sata_propagate_sas_addr(dev);
-
         /* XXX Hint: register this SATA device with SATL.
            When this returns, dev->sata_dev->lu is alive and
            present.
diff --git a/drivers/scsi/libsas/sas_port.c b/drivers/scsi/libsas/sas_port.c
index e1e2d085c920..39ae68a3b0ef 100644
--- a/drivers/scsi/libsas/sas_port.c
+++ b/drivers/scsi/libsas/sas_port.c
@@ -92,9 +92,6 @@ static void sas_form_port(struct asd_sas_phy *phy)
         if (!port->phy)
                 port->phy = phy->phy;
 
-        SAS_DPRINTK("phy%d added to port%d, phy_mask:0x%x\n", phy->id,
-                    port->id, port->phy_mask);
-
         if (*(u64 *)port->attached_sas_addr == 0) {
                 port->class = phy->class;
                 memcpy(port->attached_sas_addr, phy->attached_sas_addr,
@@ -115,6 +112,11 @@ static void sas_form_port(struct asd_sas_phy *phy)
         }
         sas_port_add_phy(port->port, phy->phy);
 
+        SAS_DPRINTK("%s added to %s, phy_mask:0x%x (%16llx)\n",
+                    phy->phy->dev.bus_id,port->port->dev.bus_id,
+                    port->phy_mask,
+                    SAS_ADDR(port->attached_sas_addr));
+
         if (port->port_dev)
                 port->port_dev->pathways = port->num_phys;
 
@@ -255,12 +257,11 @@ void sas_porte_hard_reset(struct work_struct *work)
 static void sas_init_port(struct asd_sas_port *port,
                           struct sas_ha_struct *sas_ha, int i)
 {
+        memset(port, 0, sizeof(*port));
         port->id = i;
         INIT_LIST_HEAD(&port->dev_list);
         spin_lock_init(&port->phy_list_lock);
         INIT_LIST_HEAD(&port->phy_list);
-        port->num_phys = 0;
-        port->phy_mask = 0;
         port->ha = sas_ha;
 
         spin_lock_init(&port->dev_list_lock);
diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
index f869fba86807..1f8241563c6c 100644
--- a/drivers/scsi/libsas/sas_scsi_host.c
+++ b/drivers/scsi/libsas/sas_scsi_host.c
@@ -51,10 +51,14 @@ static void sas_scsi_task_done(struct sas_task *task)
 {
         struct task_status_struct *ts = &task->task_status;
         struct scsi_cmnd *sc = task->uldd_task;
-        struct sas_ha_struct *sas_ha = SHOST_TO_SAS_HA(sc->device->host);
-        unsigned ts_flags = task->task_state_flags;
         int hs = 0, stat = 0;
 
+        if (unlikely(task->task_state_flags & SAS_TASK_STATE_ABORTED)) {
+                /* Aborted tasks will be completed by the error handler */
+                SAS_DPRINTK("task done but aborted\n");
+                return;
+        }
+
         if (unlikely(!sc)) {
                 SAS_DPRINTK("task_done called with non existing SCSI cmnd!\n");
                 list_del_init(&task->list);
@@ -120,11 +124,7 @@ static void sas_scsi_task_done(struct sas_task *task)
         sc->result = (hs << 16) | stat;
         list_del_init(&task->list);
         sas_free_task(task);
-        /* This is very ugly but this is how SCSI Core works. */
-        if (ts_flags & SAS_TASK_STATE_ABORTED)
-                scsi_eh_finish_cmd(sc, &sas_ha->eh_done_q);
-        else
-                sc->scsi_done(sc);
+        sc->scsi_done(sc);
 }
 
 static enum task_attribute sas_scsi_get_task_attr(struct scsi_cmnd *cmd)
@@ -255,13 +255,34 @@ out:
         return res;
 }
 
+static void sas_eh_finish_cmd(struct scsi_cmnd *cmd)
+{
+        struct sas_task *task = TO_SAS_TASK(cmd);
+        struct sas_ha_struct *sas_ha = SHOST_TO_SAS_HA(cmd->device->host);
+
+        /* remove the aborted task flag to allow the task to be
+         * completed now. At this point, we only get called following
+         * an actual abort of the task, so we should be guaranteed not
+         * to be racing with any completions from the LLD (hence we
+         * don't need the task state lock to clear the flag) */
+        task->task_state_flags &= ~SAS_TASK_STATE_ABORTED;
+        /* Now call task_done.  However, task will be free'd after
+         * this */
+        task->task_done(task);
+        /* now finish the command and move it on to the error
+         * handler done list, this also takes it off the
+         * error handler pending list */
+        scsi_eh_finish_cmd(cmd, &sas_ha->eh_done_q);
+}
+
 static void sas_scsi_clear_queue_lu(struct list_head *error_q, struct scsi_cmnd *my_cmd)
 {
         struct scsi_cmnd *cmd, *n;
 
         list_for_each_entry_safe(cmd, n, error_q, eh_entry) {
-                if (cmd == my_cmd)
-                        list_del_init(&cmd->eh_entry);
+                if (cmd->device->sdev_target == my_cmd->device->sdev_target &&
+                    cmd->device->lun == my_cmd->device->lun)
+                        sas_eh_finish_cmd(cmd);
         }
 }
 
@@ -274,7 +295,7 @@ static void sas_scsi_clear_queue_I_T(struct list_head *error_q,
                 struct domain_device *x = cmd_to_domain_dev(cmd);
 
                 if (x == dev)
-                        list_del_init(&cmd->eh_entry);
+                        sas_eh_finish_cmd(cmd);
         }
 }
 
@@ -288,7 +309,7 @@ static void sas_scsi_clear_queue_port(struct list_head *error_q,
                 struct asd_sas_port *x = dev->port;
 
                 if (x == port)
-                        list_del_init(&cmd->eh_entry);
+                        sas_eh_finish_cmd(cmd);
         }
 }
 
@@ -413,7 +434,7 @@ static int sas_recover_I_T(struct domain_device *dev)
 }
 
 /* Find the sas_phy that's attached to this device */
-static struct sas_phy *find_local_sas_phy(struct domain_device *dev)
+struct sas_phy *sas_find_local_phy(struct domain_device *dev)
 {
         struct domain_device *pdev = dev->parent;
         struct ex_phy *exphy = NULL;
@@ -435,6 +456,7 @@ static struct sas_phy *find_local_sas_phy(struct domain_device *dev)
         BUG_ON(!exphy);
         return exphy->phy;
 }
+EXPORT_SYMBOL_GPL(sas_find_local_phy);
 
 /* Attempt to send a LUN reset message to a device */
 int sas_eh_device_reset_handler(struct scsi_cmnd *cmd)
@@ -461,7 +483,7 @@ int sas_eh_device_reset_handler(struct scsi_cmnd *cmd)
 int sas_eh_bus_reset_handler(struct scsi_cmnd *cmd)
 {
         struct domain_device *dev = cmd_to_domain_dev(cmd);
-        struct sas_phy *phy = find_local_sas_phy(dev);
+        struct sas_phy *phy = sas_find_local_phy(dev);
         int res;
 
         res = sas_phy_reset(phy, 1);
@@ -476,10 +498,10 @@ int sas_eh_bus_reset_handler(struct scsi_cmnd *cmd)
 }
 
 /* Try to reset a device */
-static int try_to_reset_cmd_device(struct Scsi_Host *shost,
-                                   struct scsi_cmnd *cmd)
+static int try_to_reset_cmd_device(struct scsi_cmnd *cmd)
 {
         int res;
+        struct Scsi_Host *shost = cmd->device->host;
 
         if (!shost->hostt->eh_device_reset_handler)
                 goto try_bus_reset;
@@ -519,6 +541,12 @@ Again:
                 need_reset = task->task_state_flags & SAS_TASK_NEED_DEV_RESET;
                 spin_unlock_irqrestore(&task->task_state_lock, flags);
 
+                if (need_reset) {
+                        SAS_DPRINTK("%s: task 0x%p requests reset\n",
+                                    __FUNCTION__, task);
+                        goto reset;
+                }
+
                 SAS_DPRINTK("trying to find task 0x%p\n", task);
                 res = sas_scsi_find_task(task);
 
@@ -528,28 +556,23 @@ Again:
                 case TASK_IS_DONE:
                         SAS_DPRINTK("%s: task 0x%p is done\n", __FUNCTION__,
                                     task);
-                        task->task_done(task);
-                        if (need_reset)
-                                try_to_reset_cmd_device(shost, cmd);
+                        sas_eh_finish_cmd(cmd);
                         continue;
                 case TASK_IS_ABORTED:
                         SAS_DPRINTK("%s: task 0x%p is aborted\n",
                                     __FUNCTION__, task);
-                        task->task_done(task);
-                        if (need_reset)
-                                try_to_reset_cmd_device(shost, cmd);
+                        sas_eh_finish_cmd(cmd);
                         continue;
                 case TASK_IS_AT_LU:
                         SAS_DPRINTK("task 0x%p is at LU: lu recover\n", task);
+ reset:
                         tmf_resp = sas_recover_lu(task->dev, cmd);
                         if (tmf_resp == TMF_RESP_FUNC_COMPLETE) {
                                 SAS_DPRINTK("dev %016llx LU %x is "
                                             "recovered\n",
                                             SAS_ADDR(task->dev),
                                             cmd->device->lun);
-                                task->task_done(task);
-                                if (need_reset)
-                                        try_to_reset_cmd_device(shost, cmd);
+                                sas_eh_finish_cmd(cmd);
                                 sas_scsi_clear_queue_lu(work_q, cmd);
                                 goto Again;
                         }
@@ -560,15 +583,15 @@ Again:
                                     task);
                         tmf_resp = sas_recover_I_T(task->dev);
                         if (tmf_resp == TMF_RESP_FUNC_COMPLETE) {
+                                struct domain_device *dev = task->dev;
                                 SAS_DPRINTK("I_T %016llx recovered\n",
                                             SAS_ADDR(task->dev->sas_addr));
-                                task->task_done(task);
-                                if (need_reset)
-                                        try_to_reset_cmd_device(shost, cmd);
-                                sas_scsi_clear_queue_I_T(work_q, task->dev);
+                                sas_eh_finish_cmd(cmd);
+                                sas_scsi_clear_queue_I_T(work_q, dev);
                                 goto Again;
                         }
                         /* Hammer time :-) */
+                        try_to_reset_cmd_device(cmd);
                         if (i->dft->lldd_clear_nexus_port) {
                                 struct asd_sas_port *port = task->dev->port;
                                 SAS_DPRINTK("clearing nexus for port:%d\n",
@@ -577,9 +600,7 @@ Again:
                                 if (res == TMF_RESP_FUNC_COMPLETE) {
                                         SAS_DPRINTK("clear nexus port:%d "
                                                     "succeeded\n", port->id);
-                                        task->task_done(task);
-                                        if (need_reset)
-                                                try_to_reset_cmd_device(shost, cmd);
+                                        sas_eh_finish_cmd(cmd);
                                         sas_scsi_clear_queue_port(work_q,
                                                                   port);
                                         goto Again;
@@ -591,10 +612,8 @@ Again:
                                 if (res == TMF_RESP_FUNC_COMPLETE) {
                                         SAS_DPRINTK("clear nexus ha "
                                                     "succeeded\n");
-                                        task->task_done(task);
-                                        if (need_reset)
-                                                try_to_reset_cmd_device(shost, cmd);
-                                        goto out;
+                                        sas_eh_finish_cmd(cmd);
+                                        goto clear_q;
                                 }
                         }
                         /* If we are here -- this means that no amount
@@ -606,21 +625,16 @@ Again:
                                     SAS_ADDR(task->dev->sas_addr),
                                     cmd->device->lun);
 
-                        task->task_done(task);
-                        if (need_reset)
-                                try_to_reset_cmd_device(shost, cmd);
+                        sas_eh_finish_cmd(cmd);
                         goto clear_q;
                 }
         }
-out:
         return list_empty(work_q);
 clear_q:
         SAS_DPRINTK("--- Exit %s -- clear_q\n", __FUNCTION__);
-        list_for_each_entry_safe(cmd, n, work_q, eh_entry) {
-                struct sas_task *task = TO_SAS_TASK(cmd);
-                list_del_init(&cmd->eh_entry);
-                task->task_done(task);
-        }
+        list_for_each_entry_safe(cmd, n, work_q, eh_entry)
+                sas_eh_finish_cmd(cmd);
+
         return list_empty(work_q);
 }
 
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index 848d97744b4d..0819f5f39de5 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -55,7 +55,6 @@ void lpfc_mbx_cmpl_ns_reg_login(struct lpfc_hba *, LPFC_MBOXQ_t *);
 void lpfc_mbx_cmpl_fdmi_reg_login(struct lpfc_hba *, LPFC_MBOXQ_t *);
 void lpfc_enqueue_node(struct lpfc_vport *, struct lpfc_nodelist *);
 void lpfc_dequeue_node(struct lpfc_vport *, struct lpfc_nodelist *);
-void lpfc_disable_node(struct lpfc_vport *, struct lpfc_nodelist *);
 struct lpfc_nodelist *lpfc_enable_node(struct lpfc_vport *,
                                         struct lpfc_nodelist *, int);
 void lpfc_nlp_set_state(struct lpfc_vport *, struct lpfc_nodelist *, int);
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index bd572d6b60af..976653440fba 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -1694,7 +1694,7 @@ lpfc_dequeue_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
                                 NLP_STE_UNUSED_NODE);
 }
 
-void
+static void
 lpfc_disable_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
 {
         if ((ndlp->nlp_flag & NLP_DELAY_TMO) != 0)
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index f53206411cd8..fc0d9501aba6 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -648,28 +648,24 @@ lpfc_sli_hbqbuf_fill_hbqs(struct lpfc_hba *phba, uint32_t hbqno, uint32_t count)
         unsigned long flags;
         struct hbq_dmabuf *hbq_buffer;
 
-        if (!phba->hbqs[hbqno].hbq_alloc_buffer) {
+        if (!phba->hbqs[hbqno].hbq_alloc_buffer)
                 return 0;
-        }
 
         start = phba->hbqs[hbqno].buffer_count;
         end = count + start;
-        if (end > lpfc_hbq_defs[hbqno]->entry_count) {
+        if (end > lpfc_hbq_defs[hbqno]->entry_count)
                 end = lpfc_hbq_defs[hbqno]->entry_count;
-        }
 
         /* Check whether HBQ is still in use */
         spin_lock_irqsave(&phba->hbalock, flags);
-        if (!phba->hbq_in_use) {
-                spin_unlock_irqrestore(&phba->hbalock, flags);
-                return 0;
-        }
+        if (!phba->hbq_in_use)
+                goto out;
 
         /* Populate HBQ entries */
         for (i = start; i < end; i++) {
                 hbq_buffer = (phba->hbqs[hbqno].hbq_alloc_buffer)(phba);
                 if (!hbq_buffer)
-                        return 1;
+                        goto err;
                 hbq_buffer->tag = (i | (hbqno << 16));
                 if (lpfc_sli_hbq_to_firmware(phba, hbqno, hbq_buffer))
                         phba->hbqs[hbqno].buffer_count++;
@@ -677,8 +673,12 @@ lpfc_sli_hbqbuf_fill_hbqs(struct lpfc_hba *phba, uint32_t hbqno, uint32_t count)
                         (phba->hbqs[hbqno].hbq_free_buffer)(phba, hbq_buffer);
         }
 
+ out:
         spin_unlock_irqrestore(&phba->hbalock, flags);
         return 0;
+ err:
+        spin_unlock_irqrestore(&phba->hbalock, flags);
+        return 1;
 }
 
 int
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index 4d59ae8491a4..b135a1ed4b2c 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -151,19 +151,19 @@ mega_setup_mailbox(adapter_t *adapter)
          */
         if( adapter->flag & BOARD_IOMAP ) {
 
-                outb_p(adapter->mbox_dma & 0xFF,
+                outb(adapter->mbox_dma & 0xFF,
                                 adapter->host->io_port + MBOX_PORT0);
 
-                outb_p((adapter->mbox_dma >> 8) & 0xFF,
+                outb((adapter->mbox_dma >> 8) & 0xFF,
                                 adapter->host->io_port + MBOX_PORT1);
 
-                outb_p((adapter->mbox_dma >> 16) & 0xFF,
+                outb((adapter->mbox_dma >> 16) & 0xFF,
                                 adapter->host->io_port + MBOX_PORT2);
 
-                outb_p((adapter->mbox_dma >> 24) & 0xFF,
+                outb((adapter->mbox_dma >> 24) & 0xFF,
                                 adapter->host->io_port + MBOX_PORT3);
 
-                outb_p(ENABLE_MBOX_BYTE,
+                outb(ENABLE_MBOX_BYTE,
                                 adapter->host->io_port + ENABLE_MBOX_REGION);
 
                 irq_ack(adapter);
diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c
index 651d09b08f2a..fd63b06d9ef1 100644
--- a/drivers/scsi/mesh.c
+++ b/drivers/scsi/mesh.c
@@ -1759,6 +1759,7 @@ static int mesh_suspend(struct macio_dev *mdev, pm_message_t mesg)
 
         switch (mesg.event) {
         case PM_EVENT_SUSPEND:
+        case PM_EVENT_HIBERNATE:
         case PM_EVENT_FREEZE:
                 break;
         default:
diff --git a/drivers/scsi/mvsas.c b/drivers/scsi/mvsas.c
new file mode 100644
index 000000000000..5ec0665b3a3d
--- /dev/null
+++ b/drivers/scsi/mvsas.c
@@ -0,0 +1,2969 @@
+/*
+        mvsas.c - Marvell 88SE6440 SAS/SATA support
+
+        Copyright 2007 Red Hat, Inc.
+        Copyright 2008 Marvell. <kewei@marvell.com>
+
+        This program is free software; you can redistribute it and/or
+        modify it under the terms of the GNU General Public License as
+        published by the Free Software Foundation; either version 2,
+        or (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty
+        of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+        See the GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public
+        License along with this program; see the file COPYING.  If not,
+        write to the Free Software Foundation, 675 Mass Ave, Cambridge,
+        MA 02139, USA.
+
+        ---------------------------------------------------------------
+
+        Random notes:
+        * hardware supports controlling the endian-ness of data
+          structures.  this permits elimination of all the le32_to_cpu()
+          and cpu_to_le32() conversions.
+
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/interrupt.h>
+#include <linux/spinlock.h>
+#include <linux/delay.h>
+#include <linux/dma-mapping.h>
+#include <linux/ctype.h>
+#include <scsi/libsas.h>
+#include <asm/io.h>
+
+#define DRV_NAME        "mvsas"
+#define DRV_VERSION     "0.5.1"
+#define _MV_DUMP 0
+#define MVS_DISABLE_NVRAM
+#define MVS_DISABLE_MSI
+
+#define mr32(reg)       readl(regs + MVS_##reg)
+#define mw32(reg,val)   writel((val), regs + MVS_##reg)
+#define mw32_f(reg,val) do {                    \
+        writel((val), regs + MVS_##reg);        \
+        readl(regs + MVS_##reg);                \
+        } while (0)
+
+#define MVS_ID_NOT_MAPPED       0xff
+#define MVS_CHIP_SLOT_SZ        (1U << mvi->chip->slot_width)
+
+/* offset for D2H FIS in the Received FIS List Structure */
+#define SATA_RECEIVED_D2H_FIS(reg_set)  \
+        ((void *) mvi->rx_fis + 0x400 + 0x100 * reg_set + 0x40)
+#define SATA_RECEIVED_PIO_FIS(reg_set)  \
+        ((void *) mvi->rx_fis + 0x400 + 0x100 * reg_set + 0x20)
+#define UNASSOC_D2H_FIS(id)             \
+        ((void *) mvi->rx_fis + 0x100 * id)
+
+#define for_each_phy(__lseq_mask, __mc, __lseq, __rest)                 \
+        for ((__mc) = (__lseq_mask), (__lseq) = 0;                      \
+                                        (__mc) != 0 && __rest;          \
+                                        (++__lseq), (__mc) >>= 1)
+
+/* driver compile-time configuration */
+enum driver_configuration {
+        MVS_TX_RING_SZ          = 1024, /* TX ring size (12-bit) */
+        MVS_RX_RING_SZ          = 1024, /* RX ring size (12-bit) */
+                                        /* software requires power-of-2
+                                           ring size */
+
+        MVS_SLOTS               = 512,  /* command slots */
+        MVS_SLOT_BUF_SZ         = 8192, /* cmd tbl + IU + status + PRD */
+        MVS_SSP_CMD_SZ          = 64,   /* SSP command table buffer size */
+        MVS_ATA_CMD_SZ          = 96,   /* SATA command table buffer size */
+        MVS_OAF_SZ              = 64,   /* Open address frame buffer size */
+
+        MVS_RX_FIS_COUNT        = 17,   /* Optional rx'd FISs (max 17) */
+
+        MVS_QUEUE_SIZE          = 30,   /* Support Queue depth */
+};
+
+/* unchangeable hardware details */
+enum hardware_details {
+        MVS_MAX_PHYS            = 8,    /* max. possible phys */
+        MVS_MAX_PORTS           = 8,    /* max. possible ports */
+        MVS_RX_FISL_SZ          = 0x400 + (MVS_RX_FIS_COUNT * 0x100),
+};
+
+/* peripheral registers (BAR2) */
+enum peripheral_registers {
+        SPI_CTL                 = 0x10, /* EEPROM control */
+        SPI_CMD                 = 0x14, /* EEPROM command */
+        SPI_DATA                = 0x18, /* EEPROM data */
+};
+
+enum peripheral_register_bits {
+        TWSI_RDY                = (1U << 7),    /* EEPROM interface ready */
+        TWSI_RD                 = (1U << 4),    /* EEPROM read access */
+
+        SPI_ADDR_MASK           = 0x3ffff,      /* bits 17:0 */
+};
+
+/* enhanced mode registers (BAR4) */
+enum hw_registers {
+        MVS_GBL_CTL             = 0x04,  /* global control */
+        MVS_GBL_INT_STAT        = 0x08,  /* global irq status */
+        MVS_GBL_PI              = 0x0C,  /* ports implemented bitmask */
+        MVS_GBL_PORT_TYPE       = 0xa0,  /* port type */
+
+        MVS_CTL                 = 0x100, /* SAS/SATA port configuration */
+        MVS_PCS                 = 0x104, /* SAS/SATA port control/status */
+        MVS_CMD_LIST_LO         = 0x108, /* cmd list addr */
+        MVS_CMD_LIST_HI         = 0x10C,
+        MVS_RX_FIS_LO           = 0x110, /* RX FIS list addr */
+        MVS_RX_FIS_HI           = 0x114,
+
+        MVS_TX_CFG              = 0x120, /* TX configuration */
+        MVS_TX_LO               = 0x124, /* TX (delivery) ring addr */
+        MVS_TX_HI               = 0x128,
+
+        MVS_TX_PROD_IDX         = 0x12C, /* TX producer pointer */
+        MVS_TX_CONS_IDX         = 0x130, /* TX consumer pointer (RO) */
+        MVS_RX_CFG              = 0x134, /* RX configuration */
+        MVS_RX_LO               = 0x138, /* RX (completion) ring addr */
+        MVS_RX_HI               = 0x13C,
+        MVS_RX_CONS_IDX         = 0x140, /* RX consumer pointer (RO) */
+
+        MVS_INT_COAL            = 0x148, /* Int coalescing config */
+        MVS_INT_COAL_TMOUT      = 0x14C, /* Int coalescing timeout */
+        MVS_INT_STAT            = 0x150, /* Central int status */
+        MVS_INT_MASK            = 0x154, /* Central int enable */
+        MVS_INT_STAT_SRS        = 0x158, /* SATA register set status */
+        MVS_INT_MASK_SRS        = 0x15C,
+
+                                         /* ports 1-3 follow after this */
+        MVS_P0_INT_STAT         = 0x160, /* port0 interrupt status */
+        MVS_P0_INT_MASK         = 0x164, /* port0 interrupt mask */
+        MVS_P4_INT_STAT         = 0x200, /* Port 4 interrupt status */
+        MVS_P4_INT_MASK         = 0x204, /* Port 4 interrupt enable mask */
+
+                                         /* ports 1-3 follow after this */
+        MVS_P0_SER_CTLSTAT      = 0x180, /* port0 serial control/status */
+        MVS_P4_SER_CTLSTAT      = 0x220, /* port4 serial control/status */
+
+        MVS_CMD_ADDR            = 0x1B8, /* Command register port (addr) */
+        MVS_CMD_DATA            = 0x1BC, /* Command register port (data) */
+
+                                         /* ports 1-3 follow after this */
+        MVS_P0_CFG_ADDR         = 0x1C0, /* port0 phy register address */
+        MVS_P0_CFG_DATA         = 0x1C4, /* port0 phy register data */
+        MVS_P4_CFG_ADDR         = 0x230, /* Port 4 config address */
+        MVS_P4_CFG_DATA         = 0x234, /* Port 4 config data */
+
+                                         /* ports 1-3 follow after this */
+        MVS_P0_VSR_ADDR         = 0x1E0, /* port0 VSR address */
+        MVS_P0_VSR_DATA         = 0x1E4, /* port0 VSR data */
+        MVS_P4_VSR_ADDR         = 0x250, /* port 4 VSR addr */
+        MVS_P4_VSR_DATA         = 0x254, /* port 4 VSR data */
+};
+
+enum hw_register_bits {
+        /* MVS_GBL_CTL */
+        INT_EN                  = (1U << 1),    /* Global int enable */
+        HBA_RST                 = (1U << 0),    /* HBA reset */
+
+        /* MVS_GBL_INT_STAT */
+        INT_XOR                 = (1U << 4),    /* XOR engine event */
+        INT_SAS_SATA            = (1U << 0),    /* SAS/SATA event */
+
+        /* MVS_GBL_PORT_TYPE */                 /* shl for ports 1-3 */
+        SATA_TARGET             = (1U << 16),   /* port0 SATA target enable */
+        MODE_AUTO_DET_PORT7 = (1U << 15),       /* port0 SAS/SATA autodetect */
+        MODE_AUTO_DET_PORT6 = (1U << 14),
+        MODE_AUTO_DET_PORT5 = (1U << 13),
+        MODE_AUTO_DET_PORT4 = (1U << 12),
+        MODE_AUTO_DET_PORT3 = (1U << 11),
+        MODE_AUTO_DET_PORT2 = (1U << 10),
+        MODE_AUTO_DET_PORT1 = (1U << 9),
+        MODE_AUTO_DET_PORT0 = (1U << 8),
+        MODE_AUTO_DET_EN    =   MODE_AUTO_DET_PORT0 | MODE_AUTO_DET_PORT1 |
+                                MODE_AUTO_DET_PORT2 | MODE_AUTO_DET_PORT3 |
+                                MODE_AUTO_DET_PORT4 | MODE_AUTO_DET_PORT5 |
+                                MODE_AUTO_DET_PORT6 | MODE_AUTO_DET_PORT7,
+        MODE_SAS_PORT7_MASK = (1U << 7),  /* port0 SAS(1), SATA(0) mode */
+        MODE_SAS_PORT6_MASK = (1U << 6),
+        MODE_SAS_PORT5_MASK = (1U << 5),
+        MODE_SAS_PORT4_MASK = (1U << 4),
+        MODE_SAS_PORT3_MASK = (1U << 3),
+        MODE_SAS_PORT2_MASK = (1U << 2),
+        MODE_SAS_PORT1_MASK = (1U << 1),
+        MODE_SAS_PORT0_MASK = (1U << 0),
+        MODE_SAS_SATA   =       MODE_SAS_PORT0_MASK | MODE_SAS_PORT1_MASK |
+                                MODE_SAS_PORT2_MASK | MODE_SAS_PORT3_MASK |
+                                MODE_SAS_PORT4_MASK | MODE_SAS_PORT5_MASK |
+                                MODE_SAS_PORT6_MASK | MODE_SAS_PORT7_MASK,
+
+                                /* SAS_MODE value may be
+                                 * dictated (in hw) by values
+                                 * of SATA_TARGET & AUTO_DET
+                                 */
+
+        /* MVS_TX_CFG */
+        TX_EN                   = (1U << 16),   /* Enable TX */
+        TX_RING_SZ_MASK         = 0xfff,        /* TX ring size, bits 11:0 */
+
+        /* MVS_RX_CFG */
+        RX_EN                   = (1U << 16),   /* Enable RX */
+        RX_RING_SZ_MASK         = 0xfff,        /* RX ring size, bits 11:0 */
+
+        /* MVS_INT_COAL */
+        COAL_EN                 = (1U << 16),   /* Enable int coalescing */
+
+        /* MVS_INT_STAT, MVS_INT_MASK */
+        CINT_I2C                = (1U << 31),   /* I2C event */
+        CINT_SW0                = (1U << 30),   /* software event 0 */
+        CINT_SW1                = (1U << 29),   /* software event 1 */
+        CINT_PRD_BC             = (1U << 28),   /* PRD BC err for read cmd */
+        CINT_DMA_PCIE           = (1U << 27),   /* DMA to PCIE timeout */
+        CINT_MEM                = (1U << 26),   /* int mem parity err */
+        CINT_I2C_SLAVE          = (1U << 25),   /* slave I2C event */
+        CINT_SRS                = (1U << 3),    /* SRS event */
+        CINT_CI_STOP            = (1U << 1),    /* cmd issue stopped */
+        CINT_DONE               = (1U << 0),    /* cmd completion */
+
+                                                /* shl for ports 1-3 */
+        CINT_PORT_STOPPED       = (1U << 16),   /* port0 stopped */
+        CINT_PORT               = (1U << 8),    /* port0 event */
+        CINT_PORT_MASK_OFFSET   = 8,
+        CINT_PORT_MASK          = (0xFF << CINT_PORT_MASK_OFFSET),
+
+        /* TX (delivery) ring bits */
+        TXQ_CMD_SHIFT           = 29,
+        TXQ_CMD_SSP             = 1,            /* SSP protocol */
+        TXQ_CMD_SMP             = 2,            /* SMP protocol */
+        TXQ_CMD_STP             = 3,            /* STP/SATA protocol */
+        TXQ_CMD_SSP_FREE_LIST   = 4,            /* add to SSP targ free list */
+        TXQ_CMD_SLOT_RESET      = 7,            /* reset command slot */
+        TXQ_MODE_I              = (1U << 28),   /* mode: 0=target,1=initiator */
+        TXQ_PRIO_HI             = (1U << 27),   /* priority: 0=normal, 1=high */
+        TXQ_SRS_SHIFT           = 20,           /* SATA register set */
+        TXQ_SRS_MASK            = 0x7f,
+        TXQ_PHY_SHIFT           = 12,           /* PHY bitmap */
+        TXQ_PHY_MASK            = 0xff,
+        TXQ_SLOT_MASK           = 0xfff,        /* slot number */
+
+        /* RX (completion) ring bits */
+        RXQ_GOOD                = (1U << 23),   /* Response good */
+        RXQ_SLOT_RESET          = (1U << 21),   /* Slot reset complete */
+        RXQ_CMD_RX              = (1U << 20),   /* target cmd received */
+        RXQ_ATTN                = (1U << 19),   /* attention */
+        RXQ_RSP                 = (1U << 18),   /* response frame xfer'd */
+        RXQ_ERR                 = (1U << 17),   /* err info rec xfer'd */
+        RXQ_DONE                = (1U << 16),   /* cmd complete */
+        RXQ_SLOT_MASK           = 0xfff,        /* slot number */
+
+        /* mvs_cmd_hdr bits */
+        MCH_PRD_LEN_SHIFT       = 16,           /* 16-bit PRD table len */
+        MCH_SSP_FR_TYPE_SHIFT   = 13,           /* SSP frame type */
+
+                                                /* SSP initiator only */
+        MCH_SSP_FR_CMD          = 0x0,          /* COMMAND frame */
+
+                                                /* SSP initiator or target */
+        MCH_SSP_FR_TASK         = 0x1,          /* TASK frame */
+
+                                                /* SSP target only */
+        MCH_SSP_FR_XFER_RDY     = 0x4,          /* XFER_RDY frame */
+        MCH_SSP_FR_RESP         = 0x5,          /* RESPONSE frame */
+        MCH_SSP_FR_READ         = 0x6,          /* Read DATA frame(s) */
+        MCH_SSP_FR_READ_RESP    = 0x7,          /* ditto, plus RESPONSE */
+
+        MCH_PASSTHRU            = (1U << 12),   /* pass-through (SSP) */
+        MCH_FBURST              = (1U << 11),   /* first burst (SSP) */
+        MCH_CHK_LEN             = (1U << 10),   /* chk xfer len (SSP) */
+        MCH_RETRY               = (1U << 9),    /* tport layer retry (SSP) */
+        MCH_PROTECTION          = (1U << 8),    /* protection info rec (SSP) */
+        MCH_RESET               = (1U << 7),    /* Reset (STP/SATA) */
+        MCH_FPDMA               = (1U << 6),    /* First party DMA (STP/SATA) */
+        MCH_ATAPI               = (1U << 5),    /* ATAPI (STP/SATA) */
+        MCH_BIST                = (1U << 4),    /* BIST activate (STP/SATA) */
+        MCH_PMP_MASK            = 0xf,          /* PMP from cmd FIS (STP/SATA)*/
+
+        CCTL_RST                = (1U << 5),    /* port logic reset */
+
+                                                /* 0(LSB first), 1(MSB first) */
+        CCTL_ENDIAN_DATA        = (1U << 3),    /* PRD data */
+        CCTL_ENDIAN_RSP         = (1U << 2),    /* response frame */
+        CCTL_ENDIAN_OPEN        = (1U << 1),    /* open address frame */
+        CCTL_ENDIAN_CMD         = (1U << 0),    /* command table */
+
+        /* MVS_Px_SER_CTLSTAT (per-phy control) */
+        PHY_SSP_RST             = (1U << 3),    /* reset SSP link layer */
+        PHY_BCAST_CHG           = (1U << 2),    /* broadcast(change) notif */
+        PHY_RST_HARD            = (1U << 1),    /* hard reset + phy reset */
+        PHY_RST                 = (1U << 0),    /* phy reset */
+        PHY_MIN_SPP_PHYS_LINK_RATE_MASK = (0xF << 8),
+        PHY_MAX_SPP_PHYS_LINK_RATE_MASK = (0xF << 12),
+        PHY_NEG_SPP_PHYS_LINK_RATE_MASK_OFFSET = (16),
+        PHY_NEG_SPP_PHYS_LINK_RATE_MASK =
+                        (0xF << PHY_NEG_SPP_PHYS_LINK_RATE_MASK_OFFSET),
+        PHY_READY_MASK          = (1U << 20),
+
+        /* MVS_Px_INT_STAT, MVS_Px_INT_MASK (per-phy events) */
+        PHYEV_DEC_ERR           = (1U << 24),   /* Phy Decoding Error */
+        PHYEV_UNASSOC_FIS       = (1U << 19),   /* unassociated FIS rx'd */
+        PHYEV_AN                = (1U << 18),   /* SATA async notification */
+        PHYEV_BIST_ACT          = (1U << 17),   /* BIST activate FIS */
+        PHYEV_SIG_FIS           = (1U << 16),   /* signature FIS */
+        PHYEV_POOF              = (1U << 12),   /* phy ready from 1 -> 0 */
+        PHYEV_IU_BIG            = (1U << 11),   /* IU too long err */
+        PHYEV_IU_SMALL          = (1U << 10),   /* IU too short err */
+        PHYEV_UNK_TAG           = (1U << 9),    /* unknown tag */
+        PHYEV_BROAD_CH          = (1U << 8),    /* broadcast(CHANGE) */
+        PHYEV_COMWAKE           = (1U << 7),    /* COMWAKE rx'd */
+        PHYEV_PORT_SEL          = (1U << 6),    /* port selector present */
+        PHYEV_HARD_RST          = (1U << 5),    /* hard reset rx'd */
+        PHYEV_ID_TMOUT          = (1U << 4),    /* identify timeout */
+        PHYEV_ID_FAIL           = (1U << 3),    /* identify failed */
+        PHYEV_ID_DONE           = (1U << 2),    /* identify done */
+        PHYEV_HARD_RST_DONE     = (1U << 1),    /* hard reset done */
+        PHYEV_RDY_CH            = (1U << 0),    /* phy ready changed state */
+
+        /* MVS_PCS */
+        PCS_EN_SATA_REG_SHIFT   = (16),         /* Enable SATA Register Set */
+        PCS_EN_PORT_XMT_SHIFT   = (12),         /* Enable Port Transmit */
+        PCS_EN_PORT_XMT_SHIFT2  = (8),          /* For 6480 */
+        PCS_SATA_RETRY          = (1U << 8),    /* retry ctl FIS on R_ERR */
+        PCS_RSP_RX_EN           = (1U << 7),    /* raw response rx */
+        PCS_SELF_CLEAR          = (1U << 5),    /* self-clearing int mode */
+        PCS_FIS_RX_EN           = (1U << 4),    /* FIS rx enable */
+        PCS_CMD_STOP_ERR        = (1U << 3),    /* cmd stop-on-err enable */
+        PCS_CMD_RST             = (1U << 1),    /* reset cmd issue */
+        PCS_CMD_EN              = (1U << 0),    /* enable cmd issue */
+
+        /* Port n Attached Device Info */
+        PORT_DEV_SSP_TRGT       = (1U << 19),
+        PORT_DEV_SMP_TRGT       = (1U << 18),
+        PORT_DEV_STP_TRGT       = (1U << 17),
+        PORT_DEV_SSP_INIT       = (1U << 11),
+        PORT_DEV_SMP_INIT       = (1U << 10),
+        PORT_DEV_STP_INIT       = (1U << 9),
+        PORT_PHY_ID_MASK        = (0xFFU << 24),
+        PORT_DEV_TRGT_MASK      = (0x7U << 17),
+        PORT_DEV_INIT_MASK      = (0x7U << 9),
+        PORT_DEV_TYPE_MASK      = (0x7U << 0),
+
+        /* Port n PHY Status */
+        PHY_RDY                 = (1U << 2),
+        PHY_DW_SYNC             = (1U << 1),
+        PHY_OOB_DTCTD           = (1U << 0),
+
+        /* VSR */
+        /* PHYMODE 6 (CDB) */
+        PHY_MODE6_DTL_SPEED     = (1U << 27),
+};
+
+enum mvs_info_flags {
+        MVF_MSI                 = (1U << 0),    /* MSI is enabled */
+        MVF_PHY_PWR_FIX         = (1U << 1),    /* bug workaround */
+};
+
+enum sas_cmd_port_registers {
+        CMD_CMRST_OOB_DET       = 0x100, /* COMRESET OOB detect register */
+        CMD_CMWK_OOB_DET        = 0x104, /* COMWAKE OOB detect register */
+        CMD_CMSAS_OOB_DET       = 0x108, /* COMSAS OOB detect register */
+        CMD_BRST_OOB_DET        = 0x10c, /* burst OOB detect register */
+        CMD_OOB_SPACE           = 0x110, /* OOB space control register */
+        CMD_OOB_BURST           = 0x114, /* OOB burst control register */
+        CMD_PHY_TIMER           = 0x118, /* PHY timer control register */
+        CMD_PHY_CONFIG0         = 0x11c, /* PHY config register 0 */
+        CMD_PHY_CONFIG1         = 0x120, /* PHY config register 1 */
+        CMD_SAS_CTL0            = 0x124, /* SAS control register 0 */
+        CMD_SAS_CTL1            = 0x128, /* SAS control register 1 */
+        CMD_SAS_CTL2            = 0x12c, /* SAS control register 2 */
+        CMD_SAS_CTL3            = 0x130, /* SAS control register 3 */
+        CMD_ID_TEST             = 0x134, /* ID test register */
+        CMD_PL_TIMER            = 0x138, /* PL timer register */
+        CMD_WD_TIMER            = 0x13c, /* WD timer register */
+        CMD_PORT_SEL_COUNT      = 0x140, /* port selector count register */
+        CMD_APP_MEM_CTL         = 0x144, /* Application Memory Control */
+        CMD_XOR_MEM_CTL         = 0x148, /* XOR Block Memory Control */
+        CMD_DMA_MEM_CTL         = 0x14c, /* DMA Block Memory Control */
+        CMD_PORT_MEM_CTL0       = 0x150, /* Port Memory Control 0 */
+        CMD_PORT_MEM_CTL1       = 0x154, /* Port Memory Control 1 */
+        CMD_SATA_PORT_MEM_CTL0  = 0x158, /* SATA Port Memory Control 0 */
+        CMD_SATA_PORT_MEM_CTL1  = 0x15c, /* SATA Port Memory Control 1 */
+        CMD_XOR_MEM_BIST_CTL    = 0x160, /* XOR Memory BIST Control */
+        CMD_XOR_MEM_BIST_STAT   = 0x164, /* XOR Memroy BIST Status */
+        CMD_DMA_MEM_BIST_CTL    = 0x168, /* DMA Memory BIST Control */
+        CMD_DMA_MEM_BIST_STAT   = 0x16c, /* DMA Memory BIST Status */
+        CMD_PORT_MEM_BIST_CTL   = 0x170, /* Port Memory BIST Control */
+        CMD_PORT_MEM_BIST_STAT0 = 0x174, /* Port Memory BIST Status 0 */
+        CMD_PORT_MEM_BIST_STAT1 = 0x178, /* Port Memory BIST Status 1 */
+        CMD_STP_MEM_BIST_CTL    = 0x17c, /* STP Memory BIST Control */
+        CMD_STP_MEM_BIST_STAT0  = 0x180, /* STP Memory BIST Status 0 */
+        CMD_STP_MEM_BIST_STAT1  = 0x184, /* STP Memory BIST Status 1 */
+        CMD_RESET_COUNT         = 0x188, /* Reset Count */
+        CMD_MONTR_DATA_SEL      = 0x18C, /* Monitor Data/Select */
+        CMD_PLL_PHY_CONFIG      = 0x190, /* PLL/PHY Configuration */
+        CMD_PHY_CTL             = 0x194, /* PHY Control and Status */
+        CMD_PHY_TEST_COUNT0     = 0x198, /* Phy Test Count 0 */
+        CMD_PHY_TEST_COUNT1     = 0x19C, /* Phy Test Count 1 */
+        CMD_PHY_TEST_COUNT2     = 0x1A0, /* Phy Test Count 2 */
+        CMD_APP_ERR_CONFIG      = 0x1A4, /* Application Error Configuration */
+        CMD_PND_FIFO_CTL0       = 0x1A8, /* Pending FIFO Control 0 */
+        CMD_HOST_CTL            = 0x1AC, /* Host Control Status */
+        CMD_HOST_WR_DATA        = 0x1B0, /* Host Write Data */
+        CMD_HOST_RD_DATA        = 0x1B4, /* Host Read Data */
+        CMD_PHY_MODE_21         = 0x1B8, /* Phy Mode 21 */
+        CMD_SL_MODE0            = 0x1BC, /* SL Mode 0 */
+        CMD_SL_MODE1            = 0x1C0, /* SL Mode 1 */
+        CMD_PND_FIFO_CTL1       = 0x1C4, /* Pending FIFO Control 1 */
+};
+
+/* SAS/SATA configuration port registers, aka phy registers */
+enum sas_sata_config_port_regs {
+        PHYR_IDENTIFY           = 0x00, /* info for IDENTIFY frame */
+        PHYR_ADDR_LO            = 0x04, /* my SAS address (low) */
+        PHYR_ADDR_HI            = 0x08, /* my SAS address (high) */
+        PHYR_ATT_DEV_INFO       = 0x0C, /* attached device info */
+        PHYR_ATT_ADDR_LO        = 0x10, /* attached dev SAS addr (low) */
+        PHYR_ATT_ADDR_HI        = 0x14, /* attached dev SAS addr (high) */
+        PHYR_SATA_CTL           = 0x18, /* SATA control */
+        PHYR_PHY_STAT           = 0x1C, /* PHY status */
+        PHYR_SATA_SIG0          = 0x20, /*port SATA signature FIS(Byte 0-3) */
+        PHYR_SATA_SIG1          = 0x24, /*port SATA signature FIS(Byte 4-7) */
+        PHYR_SATA_SIG2          = 0x28, /*port SATA signature FIS(Byte 8-11) */
+        PHYR_SATA_SIG3          = 0x2c, /*port SATA signature FIS(Byte 12-15) */
+        PHYR_R_ERR_COUNT        = 0x30, /* port R_ERR count register */
+        PHYR_CRC_ERR_COUNT      = 0x34, /* port CRC error count register */
+        PHYR_WIDE_PORT          = 0x38, /* wide port participating */
+        PHYR_CURRENT0           = 0x80, /* current connection info 0 */
+        PHYR_CURRENT1           = 0x84, /* current connection info 1 */
+        PHYR_CURRENT2           = 0x88, /* current connection info 2 */
+};
+
+/*  SAS/SATA Vendor Specific Port Registers */
+enum sas_sata_vsp_regs {
+        VSR_PHY_STAT            = 0x00, /* Phy Status */
+        VSR_PHY_MODE1           = 0x01, /* phy tx */
+        VSR_PHY_MODE2           = 0x02, /* tx scc */
+        VSR_PHY_MODE3           = 0x03, /* pll */
+        VSR_PHY_MODE4           = 0x04, /* VCO */
+        VSR_PHY_MODE5           = 0x05, /* Rx */
+        VSR_PHY_MODE6           = 0x06, /* CDR */
+        VSR_PHY_MODE7           = 0x07, /* Impedance */
+        VSR_PHY_MODE8           = 0x08, /* Voltage */
+        VSR_PHY_MODE9           = 0x09, /* Test */
+        VSR_PHY_MODE10          = 0x0A, /* Power */
+        VSR_PHY_MODE11          = 0x0B, /* Phy Mode */
+        VSR_PHY_VS0             = 0x0C, /* Vednor Specific 0 */
+        VSR_PHY_VS1             = 0x0D, /* Vednor Specific 1 */
+};
+
+enum pci_cfg_registers {
+        PCR_PHY_CTL     = 0x40,
+        PCR_PHY_CTL2    = 0x90,
+        PCR_DEV_CTRL    = 0xE8,
+};
+
+enum pci_cfg_register_bits {
+        PCTL_PWR_ON     = (0xFU << 24),
+        PCTL_OFF        = (0xFU << 12),
+        PRD_REQ_SIZE    = (0x4000),
+        PRD_REQ_MASK    = (0x00007000),
+};
+
+enum nvram_layout_offsets {
+        NVR_SIG         = 0x00,         /* 0xAA, 0x55 */
+        NVR_SAS_ADDR    = 0x02,         /* 8-byte SAS address */
+};
+
+enum chip_flavors {
+        chip_6320,
+        chip_6440,
+        chip_6480,
+};
+
+enum port_type {
+        PORT_TYPE_SAS   =  (1L << 1),
+        PORT_TYPE_SATA  =  (1L << 0),
+};
+
+/* Command Table Format */
+enum ct_format {
+        /* SSP */
+        SSP_F_H         =  0x00,
+        SSP_F_IU        =  0x18,
+        SSP_F_MAX       =  0x4D,
+        /* STP */
+        STP_CMD_FIS     =  0x00,
+        STP_ATAPI_CMD   =  0x40,
+        STP_F_MAX       =  0x10,
+        /* SMP */
+        SMP_F_T         =  0x00,
+        SMP_F_DEP       =  0x01,
+        SMP_F_MAX       =  0x101,
+};
+
+enum status_buffer {
+        SB_EIR_OFF      =  0x00,        /* Error Information Record */
+        SB_RFB_OFF      =  0x08,        /* Response Frame Buffer */
+        SB_RFB_MAX      =  0x400,       /* RFB size*/
+};
+
+enum error_info_rec {
+        CMD_ISS_STPD    =  (1U << 31),  /* Cmd Issue Stopped */
+};
+
+struct mvs_chip_info {
+        u32             n_phy;
+        u32             srs_sz;
+        u32             slot_width;
+};
+
+struct mvs_err_info {
+        __le32                  flags;
+        __le32                  flags2;
+};
+
+struct mvs_prd {
+        __le64                  addr;           /* 64-bit buffer address */
+        __le32                  reserved;
+        __le32                  len;            /* 16-bit length */
+};
+
+struct mvs_cmd_hdr {
+        __le32                  flags;          /* PRD tbl len; SAS, SATA ctl */
+        __le32                  lens;           /* cmd, max resp frame len */
+        __le32                  tags;           /* targ port xfer tag; tag */
+        __le32                  data_len;       /* data xfer len */
+        __le64                  cmd_tbl;        /* command table address */
+        __le64                  open_frame;     /* open addr frame address */
+        __le64                  status_buf;     /* status buffer address */
+        __le64                  prd_tbl;        /* PRD tbl address */
+        __le32                  reserved[4];
+};
+
+struct mvs_slot_info {
+        struct sas_task         *task;
+        u32                     n_elem;
+        u32                     tx;
+
+        /* DMA buffer for storing cmd tbl, open addr frame, status buffer,
+         * and PRD table
+         */
+        void                    *buf;
+        dma_addr_t              buf_dma;
+#if _MV_DUMP
+        u32                     cmd_size;
+#endif
+
+        void                    *response;
+};
+
+struct mvs_port {
+        struct asd_sas_port     sas_port;
+        u8                      port_attached;
+        u8                      taskfileset;
+        u8                      wide_port_phymap;
+};
+
+struct mvs_phy {
+        struct mvs_port         *port;
+        struct asd_sas_phy      sas_phy;
+        struct sas_identify     identify;
+        struct scsi_device      *sdev;
+        u64             dev_sas_addr;
+        u64             att_dev_sas_addr;
+        u32             att_dev_info;
+        u32             dev_info;
+        u32             phy_type;
+        u32             phy_status;
+        u32             irq_status;
+        u32             frame_rcvd_size;
+        u8              frame_rcvd[32];
+        u8              phy_attached;
+};
+
+struct mvs_info {
+        unsigned long           flags;
+
+        spinlock_t              lock;           /* host-wide lock */
+        struct pci_dev          *pdev;          /* our device */
+        void __iomem            *regs;          /* enhanced mode registers */
+        void __iomem            *peri_regs;     /* peripheral registers */
+
+        u8                      sas_addr[SAS_ADDR_SIZE];
+        struct sas_ha_struct    sas;            /* SCSI/SAS glue */
+        struct Scsi_Host        *shost;
+
+        __le32                  *tx;            /* TX (delivery) DMA ring */
+        dma_addr_t              tx_dma;
+        u32                     tx_prod;        /* cached next-producer idx */
+
+        __le32                  *rx;            /* RX (completion) DMA ring */
+        dma_addr_t              rx_dma;
+        u32                     rx_cons;        /* RX consumer idx */
+
+        __le32                  *rx_fis;        /* RX'd FIS area */
+        dma_addr_t              rx_fis_dma;
+
+        struct mvs_cmd_hdr      *slot;  /* DMA command header slots */
+        dma_addr_t              slot_dma;
+
+        const struct mvs_chip_info *chip;
+
+        unsigned long           tags[MVS_SLOTS];
+        struct mvs_slot_info    slot_info[MVS_SLOTS];
+                                /* further per-slot information */
+        struct mvs_phy          phy[MVS_MAX_PHYS];
+        struct mvs_port         port[MVS_MAX_PHYS];
+
+        u32                     can_queue;      /* per adapter */
+        u32                     tag_out;        /*Get*/
+        u32                     tag_in;         /*Give*/
+};
+
+struct mvs_queue_task {
+        struct list_head list;
+
+        void   *uldd_task;
+};
+
+static int mvs_phy_control(struct asd_sas_phy *sas_phy, enum phy_func func,
+                           void *funcdata);
+static u32 mvs_read_phy_ctl(struct mvs_info *mvi, u32 port);
+static void mvs_write_phy_ctl(struct mvs_info *mvi, u32 port, u32 val);
+static u32 mvs_read_port_irq_stat(struct mvs_info *mvi, u32 port);
+static void mvs_write_port_irq_stat(struct mvs_info *mvi, u32 port, u32 val);
+static void mvs_write_port_irq_mask(struct mvs_info *mvi, u32 port, u32 val);
+static u32 mvs_read_port_irq_mask(struct mvs_info *mvi, u32 port);
+
+static u32 mvs_is_phy_ready(struct mvs_info *mvi, int i);
+static void mvs_detect_porttype(struct mvs_info *mvi, int i);
+static void mvs_update_phyinfo(struct mvs_info *mvi, int i, int get_st);
+
+static int mvs_scan_finished(struct Scsi_Host *, unsigned long);
+static void mvs_scan_start(struct Scsi_Host *);
+static int mvs_sas_slave_alloc(struct scsi_device *scsi_dev);
+
+static struct scsi_transport_template *mvs_stt;
+
+static const struct mvs_chip_info mvs_chips[] = {
+        [chip_6320] =           { 2, 16, 9  },
+        [chip_6440] =           { 4, 16, 9  },
+        [chip_6480] =           { 8, 32, 10 },
+};
+
+static struct scsi_host_template mvs_sht = {
+        .module                 = THIS_MODULE,
+        .name                   = DRV_NAME,
+        .queuecommand           = sas_queuecommand,
+        .target_alloc           = sas_target_alloc,
+        .slave_configure        = sas_slave_configure,
+        .slave_destroy          = sas_slave_destroy,
+        .scan_finished          = mvs_scan_finished,
+        .scan_start             = mvs_scan_start,
+        .change_queue_depth     = sas_change_queue_depth,
+        .change_queue_type      = sas_change_queue_type,
+        .bios_param             = sas_bios_param,
+        .can_queue              = 1,
+        .cmd_per_lun            = 1,
+        .this_id                = -1,
+        .sg_tablesize           = SG_ALL,
+        .max_sectors            = SCSI_DEFAULT_MAX_SECTORS,
+        .use_clustering         = ENABLE_CLUSTERING,
+        .eh_device_reset_handler        = sas_eh_device_reset_handler,
+        .eh_bus_reset_handler   = sas_eh_bus_reset_handler,
+        .slave_alloc            = mvs_sas_slave_alloc,
+        .target_destroy         = sas_target_destroy,
+        .ioctl                  = sas_ioctl,
+};
+
+static void mvs_hexdump(u32 size, u8 *data, u32 baseaddr)
+{
+        u32 i;
+        u32 run;
+        u32 offset;
+
+        offset = 0;
+        while (size) {
+                printk("%08X : ", baseaddr + offset);
+                if (size >= 16)
+                        run = 16;
+                else
+                        run = size;
+                size -= run;
+                for (i = 0; i < 16; i++) {
+                        if (i < run)
+                                printk("%02X ", (u32)data[i]);
+                        else
+                                printk("   ");
+                }
+                printk(": ");
+                for (i = 0; i < run; i++)
+                        printk("%c", isalnum(data[i]) ? data[i] : '.');
+                printk("\n");
+                data = &data[16];
+                offset += run;
+        }
+        printk("\n");
+}
+
+static void mvs_hba_sb_dump(struct mvs_info *mvi, u32 tag,
+                                   enum sas_protocol proto)
+{
+#if _MV_DUMP
+        u32 offset;
+        struct pci_dev *pdev = mvi->pdev;
+        struct mvs_slot_info *slot = &mvi->slot_info[tag];
+
+        offset = slot->cmd_size + MVS_OAF_SZ +
+            sizeof(struct mvs_prd) * slot->n_elem;
+        dev_printk(KERN_DEBUG, &pdev->dev, "+---->Status buffer[%d] :\n",
+                        tag);
+        mvs_hexdump(32, (u8 *) slot->response,
+                    (u32) slot->buf_dma + offset);
+#endif
+}
+
+static void mvs_hba_memory_dump(struct mvs_info *mvi, u32 tag,
+                                enum sas_protocol proto)
+{
+#if _MV_DUMP
+        u32 sz, w_ptr, r_ptr;
+        u64 addr;
+        void __iomem *regs = mvi->regs;
+        struct pci_dev *pdev = mvi->pdev;
+        struct mvs_slot_info *slot = &mvi->slot_info[tag];
+
+        /*Delivery Queue */
+        sz = mr32(TX_CFG) & TX_RING_SZ_MASK;
+        w_ptr = mr32(TX_PROD_IDX) & TX_RING_SZ_MASK;
+        r_ptr = mr32(TX_CONS_IDX) & TX_RING_SZ_MASK;
+        addr = mr32(TX_HI) << 16 << 16 | mr32(TX_LO);
+        dev_printk(KERN_DEBUG, &pdev->dev,
+                "Delivery Queue Size=%04d , WRT_PTR=%04X , RD_PTR=%04X\n",
+                sz, w_ptr, r_ptr);
+        dev_printk(KERN_DEBUG, &pdev->dev,
+                "Delivery Queue Base Address=0x%llX (PA)"
+                "(tx_dma=0x%llX), Entry=%04d\n",
+                addr, mvi->tx_dma, w_ptr);
+        mvs_hexdump(sizeof(u32), (u8 *)(&mvi->tx[mvi->tx_prod]),
+                        (u32) mvi->tx_dma + sizeof(u32) * w_ptr);
+        /*Command List */
+        addr = mr32(CMD_LIST_HI) << 16 << 16 | mr32(CMD_LIST_LO);
+        dev_printk(KERN_DEBUG, &pdev->dev,
+                "Command List Base Address=0x%llX (PA)"
+                "(slot_dma=0x%llX), Header=%03d\n",
+                addr, mvi->slot_dma, tag);
+        dev_printk(KERN_DEBUG, &pdev->dev, "Command Header[%03d]:\n", tag);
+        /*mvs_cmd_hdr */
+        mvs_hexdump(sizeof(struct mvs_cmd_hdr), (u8 *)(&mvi->slot[tag]),
+                (u32) mvi->slot_dma + tag * sizeof(struct mvs_cmd_hdr));
+        /*1.command table area */
+        dev_printk(KERN_DEBUG, &pdev->dev, "+---->Command Table :\n");
+        mvs_hexdump(slot->cmd_size, (u8 *) slot->buf, (u32) slot->buf_dma);
+        /*2.open address frame area */
+        dev_printk(KERN_DEBUG, &pdev->dev, "+---->Open Address Frame :\n");
+        mvs_hexdump(MVS_OAF_SZ, (u8 *) slot->buf + slot->cmd_size,
+                                (u32) slot->buf_dma + slot->cmd_size);
+        /*3.status buffer */
+        mvs_hba_sb_dump(mvi, tag, proto);
+        /*4.PRD table */
+        dev_printk(KERN_DEBUG, &pdev->dev, "+---->PRD table :\n");
+        mvs_hexdump(sizeof(struct mvs_prd) * slot->n_elem,
+                (u8 *) slot->buf + slot->cmd_size + MVS_OAF_SZ,
+                (u32) slot->buf_dma + slot->cmd_size + MVS_OAF_SZ);
+#endif
+}
+
+static void mvs_hba_cq_dump(struct mvs_info *mvi)
+{
+#if _MV_DUMP
+        u64 addr;
+        void __iomem *regs = mvi->regs;
+        struct pci_dev *pdev = mvi->pdev;
+        u32 entry = mvi->rx_cons + 1;
+        u32 rx_desc = le32_to_cpu(mvi->rx[entry]);
+
+        /*Completion Queue */
+        addr = mr32(RX_HI) << 16 << 16 | mr32(RX_LO);
+        dev_printk(KERN_DEBUG, &pdev->dev, "Completion Task = 0x%08X\n",
+                   (u32) mvi->slot_info[rx_desc & RXQ_SLOT_MASK].task);
+        dev_printk(KERN_DEBUG, &pdev->dev,
+                "Completion List Base Address=0x%llX (PA), "
+                "CQ_Entry=%04d, CQ_WP=0x%08X\n",
+                addr, entry - 1, mvi->rx[0]);
+        mvs_hexdump(sizeof(u32), (u8 *)(&rx_desc),
+                    mvi->rx_dma + sizeof(u32) * entry);
+#endif
+}
+
+static void mvs_hba_interrupt_enable(struct mvs_info *mvi)
+{
+        void __iomem *regs = mvi->regs;
+        u32 tmp;
+
+        tmp = mr32(GBL_CTL);
+
+        mw32(GBL_CTL, tmp | INT_EN);
+}
+
+static void mvs_hba_interrupt_disable(struct mvs_info *mvi)
+{
+        void __iomem *regs = mvi->regs;
+        u32 tmp;
+
+        tmp = mr32(GBL_CTL);
+
+        mw32(GBL_CTL, tmp & ~INT_EN);
+}
+
+static int mvs_int_rx(struct mvs_info *mvi, bool self_clear);
+
+/* move to PCI layer or libata core? */
+static int pci_go_64(struct pci_dev *pdev)
+{
+        int rc;
+
+        if (!pci_set_dma_mask(pdev, DMA_64BIT_MASK)) {
+                rc = pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK);
+                if (rc) {
+                        rc = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK);
+                        if (rc) {
+                                dev_printk(KERN_ERR, &pdev->dev,
+                                           "64-bit DMA enable failed\n");
+                                return rc;
+                        }
+                }
+        } else {
+                rc = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
+                if (rc) {
+                        dev_printk(KERN_ERR, &pdev->dev,
+                                   "32-bit DMA enable failed\n");
+                        return rc;
+                }
+                rc = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK);
+                if (rc) {
+                        dev_printk(KERN_ERR, &pdev->dev,
+                                   "32-bit consistent DMA enable failed\n");
+                        return rc;
+                }
+        }
+
+        return rc;
+}
+
+static void mvs_tag_clear(struct mvs_info *mvi, u32 tag)
+{
+        mvi->tag_in = (mvi->tag_in + 1) & (MVS_SLOTS - 1);
+        mvi->tags[mvi->tag_in] = tag;
+}
+
+static void mvs_tag_free(struct mvs_info *mvi, u32 tag)
+{
+        mvi->tag_out = (mvi->tag_out - 1) & (MVS_SLOTS - 1);
+}
+
+static int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)
+{
+        if (mvi->tag_out != mvi->tag_in) {
+                *tag_out = mvi->tags[mvi->tag_out];
+                mvi->tag_out = (mvi->tag_out + 1) & (MVS_SLOTS - 1);
+                return 0;
+        }
+        return -EBUSY;
+}
+
+static void mvs_tag_init(struct mvs_info *mvi)
+{
+        int i;
+        for (i = 0; i < MVS_SLOTS; ++i)
+                mvi->tags[i] = i;
+        mvi->tag_out = 0;
+        mvi->tag_in = MVS_SLOTS - 1;
+}
+
+#ifndef MVS_DISABLE_NVRAM
+static int mvs_eep_read(void __iomem *regs, u32 addr, u32 *data)
+{
+        int timeout = 1000;
+
+        if (addr & ~SPI_ADDR_MASK)
+                return -EINVAL;
+
+        writel(addr, regs + SPI_CMD);
+        writel(TWSI_RD, regs + SPI_CTL);
+
+        while (timeout-- > 0) {
+                if (readl(regs + SPI_CTL) & TWSI_RDY) {
+                        *data = readl(regs + SPI_DATA);
+                        return 0;
+                }
+
+                udelay(10);
+        }
+
+        return -EBUSY;
+}
+
+static int mvs_eep_read_buf(void __iomem *regs, u32 addr,
+                            void *buf, u32 buflen)
+{
+        u32 addr_end, tmp_addr, i, j;
+        u32 tmp = 0;
+        int rc;
+        u8 *tmp8, *buf8 = buf;
+
+        addr_end = addr + buflen;
+        tmp_addr = ALIGN(addr, 4);
+        if (addr > 0xff)
+                return -EINVAL;
+
+        j = addr & 0x3;
+        if (j) {
+                rc = mvs_eep_read(regs, tmp_addr, &tmp);
+                if (rc)
+                        return rc;
+
+                tmp8 = (u8 *)&tmp;
+                for (i = j; i < 4; i++)
+                        *buf8++ = tmp8[i];
+
+                tmp_addr += 4;
+        }
+
+        for (j = ALIGN(addr_end, 4); tmp_addr < j; tmp_addr += 4) {
+                rc = mvs_eep_read(regs, tmp_addr, &tmp);
+                if (rc)
+                        return rc;
+
+                memcpy(buf8, &tmp, 4);
+                buf8 += 4;
+        }
+
+        if (tmp_addr < addr_end) {
+                rc = mvs_eep_read(regs, tmp_addr, &tmp);
+                if (rc)
+                        return rc;
+
+                tmp8 = (u8 *)&tmp;
+                j = addr_end - tmp_addr;
+                for (i = 0; i < j; i++)
+                        *buf8++ = tmp8[i];
+
+                tmp_addr += 4;
+        }
+
+        return 0;
+}
+#endif
+
+static int mvs_nvram_read(struct mvs_info *mvi, u32 addr,
+                          void *buf, u32 buflen)
+{
+#ifndef MVS_DISABLE_NVRAM
+        void __iomem *regs = mvi->regs;
+        int rc, i;
+        u32 sum;
+        u8 hdr[2], *tmp;
+        const char *msg;
+
+        rc = mvs_eep_read_buf(regs, addr, &hdr, 2);
+        if (rc) {
+                msg = "nvram hdr read failed";
+                goto err_out;
+        }
+        rc = mvs_eep_read_buf(regs, addr + 2, buf, buflen);
+        if (rc) {
+                msg = "nvram read failed";
+                goto err_out;
+        }
+
+        if (hdr[0] != 0x5A) {
+                /* entry id */
+                msg = "invalid nvram entry id";
+                rc = -ENOENT;
+                goto err_out;
+        }
+
+        tmp = buf;
+        sum = ((u32)hdr[0]) + ((u32)hdr[1]);
+        for (i = 0; i < buflen; i++)
+                sum += ((u32)tmp[i]);
+
+        if (sum) {
+                msg = "nvram checksum failure";
+                rc = -EILSEQ;
+                goto err_out;
+        }
+
+        return 0;
+
+err_out:
+        dev_printk(KERN_ERR, &mvi->pdev->dev, "%s", msg);
+        return rc;
+#else
+        /* FIXME , For SAS target mode */
+        memcpy(buf, "\x50\x05\x04\x30\x11\xab\x00\x00", 8);
+        return 0;
+#endif
+}
+
+static void mvs_bytes_dmaed(struct mvs_info *mvi, int i)
+{
+        struct mvs_phy *phy = &mvi->phy[i];
+
+        if (!phy->phy_attached)
+                return;
+
+        if (phy->phy_type & PORT_TYPE_SAS) {
+                struct sas_identify_frame *id;
+
+                id = (struct sas_identify_frame *)phy->frame_rcvd;
+                id->dev_type = phy->identify.device_type;
+                id->initiator_bits = SAS_PROTOCOL_ALL;
+                id->target_bits = phy->identify.target_port_protocols;
+        } else if (phy->phy_type & PORT_TYPE_SATA) {
+                /* TODO */
+        }
+        mvi->sas.sas_phy[i]->frame_rcvd_size = phy->frame_rcvd_size;
+        mvi->sas.notify_port_event(mvi->sas.sas_phy[i],
+                                   PORTE_BYTES_DMAED);
+}
+
+static int mvs_scan_finished(struct Scsi_Host *shost, unsigned long time)
+{
+        /* give the phy enabling interrupt event time to come in (1s
+         * is empirically about all it takes) */
+        if (time < HZ)
+                return 0;
+        /* Wait for discovery to finish */
+        scsi_flush_work(shost);
+        return 1;
+}
+
+static void mvs_scan_start(struct Scsi_Host *shost)
+{
+        int i;
+        struct mvs_info *mvi = SHOST_TO_SAS_HA(shost)->lldd_ha;
+
+        for (i = 0; i < mvi->chip->n_phy; ++i) {
+                mvs_bytes_dmaed(mvi, i);
+        }
+}
+
+static int mvs_sas_slave_alloc(struct scsi_device *scsi_dev)
+{
+        int rc;
+
+        rc = sas_slave_alloc(scsi_dev);
+
+        return rc;
+}
+
+static void mvs_int_port(struct mvs_info *mvi, int port_no, u32 events)
+{
+        struct pci_dev *pdev = mvi->pdev;
+        struct sas_ha_struct *sas_ha = &mvi->sas;
+        struct mvs_phy *phy = &mvi->phy[port_no];
+        struct asd_sas_phy *sas_phy = &phy->sas_phy;
+
+        phy->irq_status = mvs_read_port_irq_stat(mvi, port_no);
+        /*
+        * events is port event now ,
+        * we need check the interrupt status which belongs to per port.
+        */
+        dev_printk(KERN_DEBUG, &pdev->dev,
+                "Port %d Event = %X\n",
+                port_no, phy->irq_status);
+
+        if (phy->irq_status & (PHYEV_POOF | PHYEV_DEC_ERR)) {
+                if (!mvs_is_phy_ready(mvi, port_no)) {
+                        sas_phy_disconnected(sas_phy);
+                        sas_ha->notify_phy_event(sas_phy, PHYE_LOSS_OF_SIGNAL);
+                } else
+                        mvs_phy_control(sas_phy, PHY_FUNC_LINK_RESET, NULL);
+        }
+        if (!(phy->irq_status & PHYEV_DEC_ERR)) {
+                if (phy->irq_status & PHYEV_COMWAKE) {
+                        u32 tmp = mvs_read_port_irq_mask(mvi, port_no);
+                        mvs_write_port_irq_mask(mvi, port_no,
+                                                tmp | PHYEV_SIG_FIS);
+                }
+                if (phy->irq_status & (PHYEV_SIG_FIS | PHYEV_ID_DONE)) {
+                        phy->phy_status = mvs_is_phy_ready(mvi, port_no);
+                        if (phy->phy_status) {
+                                mvs_detect_porttype(mvi, port_no);
+
+                                if (phy->phy_type & PORT_TYPE_SATA) {
+                                        u32 tmp = mvs_read_port_irq_mask(mvi,
+                                                                port_no);
+                                        tmp &= ~PHYEV_SIG_FIS;
+                                        mvs_write_port_irq_mask(mvi,
+                                                                port_no, tmp);
+                                }
+
+                                mvs_update_phyinfo(mvi, port_no, 0);
+                                sas_ha->notify_phy_event(sas_phy,
+                                                        PHYE_OOB_DONE);
+                                mvs_bytes_dmaed(mvi, port_no);
+                        } else {
+                                dev_printk(KERN_DEBUG, &pdev->dev,
+                                        "plugin interrupt but phy is gone\n");
+                                mvs_phy_control(sas_phy, PHY_FUNC_LINK_RESET,
+                                                        NULL);
+                        }
+                } else if (phy->irq_status & PHYEV_BROAD_CH)
+                        sas_ha->notify_port_event(sas_phy,
+                                                PORTE_BROADCAST_RCVD);
+        }
+        mvs_write_port_irq_stat(mvi, port_no, phy->irq_status);
+}
+
+static void mvs_int_sata(struct mvs_info *mvi)
+{
+        /* FIXME */
+}
+
+static void mvs_slot_free(struct mvs_info *mvi, struct sas_task *task,
+                          struct mvs_slot_info *slot, u32 slot_idx)
+{
+        if (!sas_protocol_ata(task->task_proto))
+                if (slot->n_elem)
+                        pci_unmap_sg(mvi->pdev, task->scatter,
+                                     slot->n_elem, task->data_dir);
+
+        switch (task->task_proto) {
+        case SAS_PROTOCOL_SMP:
+                pci_unmap_sg(mvi->pdev, &task->smp_task.smp_resp, 1,
+                             PCI_DMA_FROMDEVICE);
+                pci_unmap_sg(mvi->pdev, &task->smp_task.smp_req, 1,
+                             PCI_DMA_TODEVICE);
+                break;
+
+        case SAS_PROTOCOL_SATA:
+        case SAS_PROTOCOL_STP:
+        case SAS_PROTOCOL_SSP:
+        default:
+                /* do nothing */
+                break;
+        }
+
+        slot->task = NULL;
+        mvs_tag_clear(mvi, slot_idx);
+}
+
+static void mvs_slot_err(struct mvs_info *mvi, struct sas_task *task,
+                         u32 slot_idx)
+{
+        struct mvs_slot_info *slot = &mvi->slot_info[slot_idx];
+        u64 err_dw0 = *(u32 *) slot->response;
+        void __iomem *regs = mvi->regs;
+        u32 tmp;
+
+        if (err_dw0 & CMD_ISS_STPD)
+                if (sas_protocol_ata(task->task_proto)) {
+                        tmp = mr32(INT_STAT_SRS);
+                        mw32(INT_STAT_SRS, tmp & 0xFFFF);
+                }
+
+        mvs_hba_sb_dump(mvi, slot_idx, task->task_proto);
+}
+
+static int mvs_slot_complete(struct mvs_info *mvi, u32 rx_desc)
+{
+        u32 slot_idx = rx_desc & RXQ_SLOT_MASK;
+        struct mvs_slot_info *slot = &mvi->slot_info[slot_idx];
+        struct sas_task *task = slot->task;
+        struct task_status_struct *tstat = &task->task_status;
+        struct mvs_port *port = &mvi->port[task->dev->port->id];
+        bool aborted;
+        void *to;
+
+        spin_lock(&task->task_state_lock);
+        aborted = task->task_state_flags & SAS_TASK_STATE_ABORTED;
+        if (!aborted) {
+                task->task_state_flags &=
+                    ~(SAS_TASK_STATE_PENDING | SAS_TASK_AT_INITIATOR);
+                task->task_state_flags |= SAS_TASK_STATE_DONE;
+        }
+        spin_unlock(&task->task_state_lock);
+
+        if (aborted)
+                return -1;
+
+        memset(tstat, 0, sizeof(*tstat));
+        tstat->resp = SAS_TASK_COMPLETE;
+
+
+        if (unlikely(!port->port_attached)) {
+                tstat->stat = SAS_PHY_DOWN;
+                goto out;
+        }
+
+        /* error info record present */
+        if ((rx_desc & RXQ_ERR) && (*(u64 *) slot->response)) {
+                tstat->stat = SAM_CHECK_COND;
+                mvs_slot_err(mvi, task, slot_idx);
+                goto out;
+        }
+
+        switch (task->task_proto) {
+        case SAS_PROTOCOL_SSP:
+                /* hw says status == 0, datapres == 0 */
+                if (rx_desc & RXQ_GOOD) {
+                        tstat->stat = SAM_GOOD;
+                        tstat->resp = SAS_TASK_COMPLETE;
+                }
+                /* response frame present */
+                else if (rx_desc & RXQ_RSP) {
+                        struct ssp_response_iu *iu =
+                            slot->response + sizeof(struct mvs_err_info);
+                        sas_ssp_task_response(&mvi->pdev->dev, task, iu);
+                }
+
+                /* should never happen? */
+                else
+                        tstat->stat = SAM_CHECK_COND;
+                break;
+
+        case SAS_PROTOCOL_SMP: {
+                        struct scatterlist *sg_resp = &task->smp_task.smp_resp;
+                        tstat->stat = SAM_GOOD;
+                        to = kmap_atomic(sg_page(sg_resp), KM_IRQ0);
+                        memcpy(to + sg_resp->offset,
+                                slot->response + sizeof(struct mvs_err_info),
+                                sg_dma_len(sg_resp));
+                        kunmap_atomic(to, KM_IRQ0);
+                        break;
+                }
+
+        case SAS_PROTOCOL_SATA:
+        case SAS_PROTOCOL_STP:
+        case SAS_PROTOCOL_SATA | SAS_PROTOCOL_STP: {
+                        struct ata_task_resp *resp =
+                            (struct ata_task_resp *)tstat->buf;
+
+                        if ((rx_desc & (RXQ_DONE | RXQ_ERR | RXQ_ATTN)) ==
+                            RXQ_DONE)
+                                tstat->stat = SAM_GOOD;
+                        else
+                                tstat->stat = SAM_CHECK_COND;
+
+                        resp->frame_len = sizeof(struct dev_to_host_fis);
+                        memcpy(&resp->ending_fis[0],
+                               SATA_RECEIVED_D2H_FIS(port->taskfileset),
+                               sizeof(struct dev_to_host_fis));
+                        if (resp->ending_fis[2] & ATA_ERR)
+                                mvs_hexdump(16, resp->ending_fis, 0);
+                        break;
+                }
+
+        default:
+                tstat->stat = SAM_CHECK_COND;
+                break;
+        }
+
+out:
+        mvs_slot_free(mvi, task, slot, slot_idx);
+        task->task_done(task);
+        return tstat->stat;
+}
+
+static void mvs_int_full(struct mvs_info *mvi)
+{
+        void __iomem *regs = mvi->regs;
+        u32 tmp, stat;
+        int i;
+
+        stat = mr32(INT_STAT);
+
+        mvs_int_rx(mvi, false);
+
+        for (i = 0; i < MVS_MAX_PORTS; i++) {
+                tmp = (stat >> i) & (CINT_PORT | CINT_PORT_STOPPED);
+                if (tmp)
+                        mvs_int_port(mvi, i, tmp);
+        }
+
+        if (stat & CINT_SRS)
+                mvs_int_sata(mvi);
+
+        mw32(INT_STAT, stat);
+}
+
+static int mvs_int_rx(struct mvs_info *mvi, bool self_clear)
+{
+        void __iomem *regs = mvi->regs;
+        u32 rx_prod_idx, rx_desc;
+        bool attn = false;
+        struct pci_dev *pdev = mvi->pdev;
+
+        /* the first dword in the RX ring is special: it contains
+         * a mirror of the hardware's RX producer index, so that
+         * we don't have to stall the CPU reading that register.
+         * The actual RX ring is offset by one dword, due to this.
+         */
+        rx_prod_idx = mr32(RX_CONS_IDX) & RX_RING_SZ_MASK;
+        if (rx_prod_idx == 0xfff) {     /* h/w hasn't touched RX ring yet */
+                mvi->rx_cons = 0xfff;
+                return 0;
+        }
+
+        /* The CMPL_Q may come late, read from register and try again
+        * note: if coalescing is enabled,
+        * it will need to read from register every time for sure
+        */
+        if (mvi->rx_cons == rx_prod_idx)
+                return 0;
+
+        if (mvi->rx_cons == 0xfff)
+                mvi->rx_cons = MVS_RX_RING_SZ - 1;
+
+        while (mvi->rx_cons != rx_prod_idx) {
+
+                /* increment our internal RX consumer pointer */
+                mvi->rx_cons = (mvi->rx_cons + 1) & (MVS_RX_RING_SZ - 1);
+
+                rx_desc = le32_to_cpu(mvi->rx[mvi->rx_cons + 1]);
+
+                mvs_hba_cq_dump(mvi);
+
+                if (likely(rx_desc & RXQ_DONE))
+                        mvs_slot_complete(mvi, rx_desc);
+                if (rx_desc & RXQ_ATTN) {
+                        attn = true;
+                        dev_printk(KERN_DEBUG, &pdev->dev, "ATTN %X\n",
+                                rx_desc);
+                } else if (rx_desc & RXQ_ERR) {
+                        dev_printk(KERN_DEBUG, &pdev->dev, "RXQ_ERR %X\n",
+                                rx_desc);
+                }
+        }
+
+        if (attn && self_clear)
+                mvs_int_full(mvi);
+
+        return 0;
+}
+
+static irqreturn_t mvs_interrupt(int irq, void *opaque)
+{
+        struct mvs_info *mvi = opaque;
+        void __iomem *regs = mvi->regs;
+        u32 stat;
+
+        stat = mr32(GBL_INT_STAT);
+
+        /* clear CMD_CMPLT ASAP */
+        mw32_f(INT_STAT, CINT_DONE);
+
+        if (stat == 0 || stat == 0xffffffff)
+                return IRQ_NONE;
+
+        spin_lock(&mvi->lock);
+
+        mvs_int_full(mvi);
+
+        spin_unlock(&mvi->lock);
+
+        return IRQ_HANDLED;
+}
+
+#ifndef MVS_DISABLE_MSI
+static irqreturn_t mvs_msi_interrupt(int irq, void *opaque)
+{
+        struct mvs_info *mvi = opaque;
+
+        spin_lock(&mvi->lock);
+
+        mvs_int_rx(mvi, true);
+
+        spin_unlock(&mvi->lock);
+
+        return IRQ_HANDLED;
+}
+#endif
+
+struct mvs_task_exec_info {
+        struct sas_task *task;
+        struct mvs_cmd_hdr *hdr;
+        struct mvs_port *port;
+        u32 tag;
+        int n_elem;
+};
+
+static int mvs_task_prep_smp(struct mvs_info *mvi,
+                             struct mvs_task_exec_info *tei)
+{
+        int elem, rc, i;
+        struct sas_task *task = tei->task;
+        struct mvs_cmd_hdr *hdr = tei->hdr;
+        struct scatterlist *sg_req, *sg_resp;
+        u32 req_len, resp_len, tag = tei->tag;
+        void *buf_tmp;
+        u8 *buf_oaf;
+        dma_addr_t buf_tmp_dma;
+        struct mvs_prd *buf_prd;
+        struct scatterlist *sg;
+        struct mvs_slot_info *slot = &mvi->slot_info[tag];
+        struct asd_sas_port *sas_port = task->dev->port;
+        u32 flags = (tei->n_elem << MCH_PRD_LEN_SHIFT);
+#if _MV_DUMP
+        u8 *buf_cmd;
+        void *from;
+#endif
+        /*
+         * DMA-map SMP request, response buffers
+         */
+        sg_req = &task->smp_task.smp_req;
+        elem = pci_map_sg(mvi->pdev, sg_req, 1, PCI_DMA_TODEVICE);
+        if (!elem)
+                return -ENOMEM;
+        req_len = sg_dma_len(sg_req);
+
+        sg_resp = &task->smp_task.smp_resp;
+        elem = pci_map_sg(mvi->pdev, sg_resp, 1, PCI_DMA_FROMDEVICE);
+        if (!elem) {
+                rc = -ENOMEM;
+                goto err_out;
+        }
+        resp_len = sg_dma_len(sg_resp);
+
+        /* must be in dwords */
+        if ((req_len & 0x3) || (resp_len & 0x3)) {
+                rc = -EINVAL;
+                goto err_out_2;
+        }
+
+        /*
+         * arrange MVS_SLOT_BUF_SZ-sized DMA buffer according to our needs
+         */
+
+        /* region 1: command table area (MVS_SSP_CMD_SZ bytes) ************** */
+        buf_tmp = slot->buf;
+        buf_tmp_dma = slot->buf_dma;
+
+#if _MV_DUMP
+        buf_cmd = buf_tmp;
+        hdr->cmd_tbl = cpu_to_le64(buf_tmp_dma);
+        buf_tmp += req_len;
+        buf_tmp_dma += req_len;
+        slot->cmd_size = req_len;
+#else
+        hdr->cmd_tbl = cpu_to_le64(sg_dma_address(sg_req));
+#endif
+
+        /* region 2: open address frame area (MVS_OAF_SZ bytes) ********* */
+        buf_oaf = buf_tmp;
+        hdr->open_frame = cpu_to_le64(buf_tmp_dma);
+
+        buf_tmp += MVS_OAF_SZ;
+        buf_tmp_dma += MVS_OAF_SZ;
+
+        /* region 3: PRD table ********************************************* */
+        buf_prd = buf_tmp;
+        if (tei->n_elem)
+                hdr->prd_tbl = cpu_to_le64(buf_tmp_dma);
+        else
+                hdr->prd_tbl = 0;
+
+        i = sizeof(struct mvs_prd) * tei->n_elem;
+        buf_tmp += i;
+        buf_tmp_dma += i;
+
+        /* region 4: status buffer (larger the PRD, smaller this buf) ****** */
+        slot->response = buf_tmp;
+        hdr->status_buf = cpu_to_le64(buf_tmp_dma);
+
+        /*
+         * Fill in TX ring and command slot header
+         */
+        slot->tx = mvi->tx_prod;
+        mvi->tx[mvi->tx_prod] = cpu_to_le32((TXQ_CMD_SMP << TXQ_CMD_SHIFT) |
+                                        TXQ_MODE_I | tag |
+                                        (sas_port->phy_mask << TXQ_PHY_SHIFT));
+
+        hdr->flags |= flags;
+        hdr->lens = cpu_to_le32(((resp_len / 4) << 16) | ((req_len - 4) / 4));
+        hdr->tags = cpu_to_le32(tag);
+        hdr->data_len = 0;
+
+        /* generate open address frame hdr (first 12 bytes) */
+        buf_oaf[0] = (1 << 7) | (0 << 4) | 0x01; /* initiator, SMP, ftype 1h */
+        buf_oaf[1] = task->dev->linkrate & 0xf;
+        *(u16 *)(buf_oaf + 2) = 0xFFFF;         /* SAS SPEC */
+        memcpy(buf_oaf + 4, task->dev->sas_addr, SAS_ADDR_SIZE);
+
+        /* fill in PRD (scatter/gather) table, if any */
+        for_each_sg(task->scatter, sg, tei->n_elem, i) {
+                buf_prd->addr = cpu_to_le64(sg_dma_address(sg));
+                buf_prd->len = cpu_to_le32(sg_dma_len(sg));
+                buf_prd++;
+        }
+
+#if _MV_DUMP
+        /* copy cmd table */
+        from = kmap_atomic(sg_page(sg_req), KM_IRQ0);
+        memcpy(buf_cmd, from + sg_req->offset, req_len);
+        kunmap_atomic(from, KM_IRQ0);
+#endif
+        return 0;
+
+err_out_2:
+        pci_unmap_sg(mvi->pdev, &tei->task->smp_task.smp_resp, 1,
+                     PCI_DMA_FROMDEVICE);
+err_out:
+        pci_unmap_sg(mvi->pdev, &tei->task->smp_task.smp_req, 1,
+                     PCI_DMA_TODEVICE);
+        return rc;
+}
+
+static void mvs_free_reg_set(struct mvs_info *mvi, struct mvs_port *port)
+{
+        void __iomem *regs = mvi->regs;
+        u32 tmp, offs;
+        u8 *tfs = &port->taskfileset;
+
+        if (*tfs == MVS_ID_NOT_MAPPED)
+                return;
+
+        offs = 1U << ((*tfs & 0x0f) + PCS_EN_SATA_REG_SHIFT);
+        if (*tfs < 16) {
+                tmp = mr32(PCS);
+                mw32(PCS, tmp & ~offs);
+        } else {
+                tmp = mr32(CTL);
+                mw32(CTL, tmp & ~offs);
+        }
+
+        tmp = mr32(INT_STAT_SRS) & (1U << *tfs);
+        if (tmp)
+                mw32(INT_STAT_SRS, tmp);
+
+        *tfs = MVS_ID_NOT_MAPPED;
+}
+
+static u8 mvs_assign_reg_set(struct mvs_info *mvi, struct mvs_port *port)
+{
+        int i;
+        u32 tmp, offs;
+        void __iomem *regs = mvi->regs;
+
+        if (port->taskfileset != MVS_ID_NOT_MAPPED)
+                return 0;
+
+        tmp = mr32(PCS);
+
+        for (i = 0; i < mvi->chip->srs_sz; i++) {
+                if (i == 16)
+                        tmp = mr32(CTL);
+                offs = 1U << ((i & 0x0f) + PCS_EN_SATA_REG_SHIFT);
+                if (!(tmp & offs)) {
+                        port->taskfileset = i;
+
+                        if (i < 16)
+                                mw32(PCS, tmp | offs);
+                        else
+                                mw32(CTL, tmp | offs);
+                        tmp = mr32(INT_STAT_SRS) & (1U << i);
+                        if (tmp)
+                                mw32(INT_STAT_SRS, tmp);
+                        return 0;
+                }
+        }
+        return MVS_ID_NOT_MAPPED;
+}
+
+static u32 mvs_get_ncq_tag(struct sas_task *task)
+{
+        u32 tag = 0;
+        struct ata_queued_cmd *qc = task->uldd_task;
+
+        if (qc)
+                tag = qc->tag;
+
+        return tag;
+}
+
+static int mvs_task_prep_ata(struct mvs_info *mvi,
+                             struct mvs_task_exec_info *tei)
+{
+        struct sas_task *task = tei->task;
+        struct domain_device *dev = task->dev;
+        struct mvs_cmd_hdr *hdr = tei->hdr;
+        struct asd_sas_port *sas_port = dev->port;
+        struct mvs_slot_info *slot;
+        struct scatterlist *sg;
+        struct mvs_prd *buf_prd;
+        struct mvs_port *port = tei->port;
+        u32 tag = tei->tag;
+        u32 flags = (tei->n_elem << MCH_PRD_LEN_SHIFT);
+        void *buf_tmp;
+        u8 *buf_cmd, *buf_oaf;
+        dma_addr_t buf_tmp_dma;
+        u32 i, req_len, resp_len;
+        const u32 max_resp_len = SB_RFB_MAX;
+
+        if (mvs_assign_reg_set(mvi, port) == MVS_ID_NOT_MAPPED)
+                return -EBUSY;
+
+        slot = &mvi->slot_info[tag];
+        slot->tx = mvi->tx_prod;
+        mvi->tx[mvi->tx_prod] = cpu_to_le32(TXQ_MODE_I | tag |
+                                        (TXQ_CMD_STP << TXQ_CMD_SHIFT) |
+                                        (sas_port->phy_mask << TXQ_PHY_SHIFT) |
+                                        (port->taskfileset << TXQ_SRS_SHIFT));
+
+        if (task->ata_task.use_ncq)
+                flags |= MCH_FPDMA;
+        if (dev->sata_dev.command_set == ATAPI_COMMAND_SET) {
+                if (task->ata_task.fis.command != ATA_CMD_ID_ATAPI)
+                        flags |= MCH_ATAPI;
+        }
+
+        /* FIXME: fill in port multiplier number */
+
+        hdr->flags = cpu_to_le32(flags);
+
+        /* FIXME: the low order order 5 bits for the TAG if enable NCQ */
+        if (task->ata_task.use_ncq) {
+                hdr->tags = cpu_to_le32(mvs_get_ncq_tag(task));
+                /*Fill in task file */
+                task->ata_task.fis.sector_count = hdr->tags << 3;
+        } else
+                hdr->tags = cpu_to_le32(tag);
+        hdr->data_len = cpu_to_le32(task->total_xfer_len);
+
+        /*
+         * arrange MVS_SLOT_BUF_SZ-sized DMA buffer according to our needs
+         */
+
+        /* region 1: command table area (MVS_ATA_CMD_SZ bytes) ************** */
+        buf_cmd = buf_tmp = slot->buf;
+        buf_tmp_dma = slot->buf_dma;
+
+        hdr->cmd_tbl = cpu_to_le64(buf_tmp_dma);
+
+        buf_tmp += MVS_ATA_CMD_SZ;
+        buf_tmp_dma += MVS_ATA_CMD_SZ;
+#if _MV_DUMP
+        slot->cmd_size = MVS_ATA_CMD_SZ;
+#endif
+
+        /* region 2: open address frame area (MVS_OAF_SZ bytes) ********* */
+        /* used for STP.  unused for SATA? */
+        buf_oaf = buf_tmp;
+        hdr->open_frame = cpu_to_le64(buf_tmp_dma);
+
+        buf_tmp += MVS_OAF_SZ;
+        buf_tmp_dma += MVS_OAF_SZ;
+
+        /* region 3: PRD table ********************************************* */
+        buf_prd = buf_tmp;
+        if (tei->n_elem)
+                hdr->prd_tbl = cpu_to_le64(buf_tmp_dma);
+        else
+                hdr->prd_tbl = 0;
+
+        i = sizeof(struct mvs_prd) * tei->n_elem;
+        buf_tmp += i;
+        buf_tmp_dma += i;
+
+        /* region 4: status buffer (larger the PRD, smaller this buf) ****** */
+        /* FIXME: probably unused, for SATA.  kept here just in case
+         * we get a STP/SATA error information record
+         */
+        slot->response = buf_tmp;
+        hdr->status_buf = cpu_to_le64(buf_tmp_dma);
+
+        req_len = sizeof(struct host_to_dev_fis);
+        resp_len = MVS_SLOT_BUF_SZ - MVS_ATA_CMD_SZ -
+            sizeof(struct mvs_err_info) - i;
+
+        /* request, response lengths */
+        resp_len = min(resp_len, max_resp_len);
+        hdr->lens = cpu_to_le32(((resp_len / 4) << 16) | (req_len / 4));
+
+        task->ata_task.fis.flags |= 0x80; /* C=1: update ATA cmd reg */
+        /* fill in command FIS and ATAPI CDB */
+        memcpy(buf_cmd, &task->ata_task.fis, sizeof(struct host_to_dev_fis));
+        if (dev->sata_dev.command_set == ATAPI_COMMAND_SET)
+                memcpy(buf_cmd + STP_ATAPI_CMD,
+                        task->ata_task.atapi_packet, 16);
+
+        /* generate open address frame hdr (first 12 bytes) */
+        buf_oaf[0] = (1 << 7) | (2 << 4) | 0x1; /* initiator, STP, ftype 1h */
+        buf_oaf[1] = task->dev->linkrate & 0xf;
+        *(u16 *)(buf_oaf + 2) = cpu_to_be16(tag);
+        memcpy(buf_oaf + 4, task->dev->sas_addr, SAS_ADDR_SIZE);
+
+        /* fill in PRD (scatter/gather) table, if any */
+        for_each_sg(task->scatter, sg, tei->n_elem, i) {
+                buf_prd->addr = cpu_to_le64(sg_dma_address(sg));
+                buf_prd->len = cpu_to_le32(sg_dma_len(sg));
+                buf_prd++;
+        }
+
+        return 0;
+}
+
+static int mvs_task_prep_ssp(struct mvs_info *mvi,
+                             struct mvs_task_exec_info *tei)
+{
+        struct sas_task *task = tei->task;
+        struct mvs_cmd_hdr *hdr = tei->hdr;
+        struct mvs_port *port = tei->port;
+        struct mvs_slot_info *slot;
+        struct scatterlist *sg;
+        struct mvs_prd *buf_prd;
+        struct ssp_frame_hdr *ssp_hdr;
+        void *buf_tmp;
+        u8 *buf_cmd, *buf_oaf, fburst = 0;
+        dma_addr_t buf_tmp_dma;
+        u32 flags;
+        u32 resp_len, req_len, i, tag = tei->tag;
+        const u32 max_resp_len = SB_RFB_MAX;
+
+        slot = &mvi->slot_info[tag];
+
+        slot->tx = mvi->tx_prod;
+        mvi->tx[mvi->tx_prod] = cpu_to_le32(TXQ_MODE_I | tag |
+                                (TXQ_CMD_SSP << TXQ_CMD_SHIFT) |
+                                (port->wide_port_phymap << TXQ_PHY_SHIFT));
+
+        flags = MCH_RETRY;
+        if (task->ssp_task.enable_first_burst) {
+                flags |= MCH_FBURST;
+                fburst = (1 << 7);
+        }
+        hdr->flags = cpu_to_le32(flags |
+                                 (tei->n_elem << MCH_PRD_LEN_SHIFT) |
+                                 (MCH_SSP_FR_CMD << MCH_SSP_FR_TYPE_SHIFT));
+
+        hdr->tags = cpu_to_le32(tag);
+        hdr->data_len = cpu_to_le32(task->total_xfer_len);
+
+        /*
+         * arrange MVS_SLOT_BUF_SZ-sized DMA buffer according to our needs
+         */
+
+        /* region 1: command table area (MVS_SSP_CMD_SZ bytes) ************** */
+        buf_cmd = buf_tmp = slot->buf;
+        buf_tmp_dma = slot->buf_dma;
+
+        hdr->cmd_tbl = cpu_to_le64(buf_tmp_dma);
+
+        buf_tmp += MVS_SSP_CMD_SZ;
+        buf_tmp_dma += MVS_SSP_CMD_SZ;
+#if _MV_DUMP
+        slot->cmd_size = MVS_SSP_CMD_SZ;
+#endif
+
+        /* region 2: open address frame area (MVS_OAF_SZ bytes) ********* */
+        buf_oaf = buf_tmp;
+        hdr->open_frame = cpu_to_le64(buf_tmp_dma);
+
+        buf_tmp += MVS_OAF_SZ;
+        buf_tmp_dma += MVS_OAF_SZ;
+
+        /* region 3: PRD table ********************************************* */
+        buf_prd = buf_tmp;
+        if (tei->n_elem)
+                hdr->prd_tbl = cpu_to_le64(buf_tmp_dma);
+        else
+                hdr->prd_tbl = 0;
+
+        i = sizeof(struct mvs_prd) * tei->n_elem;
+        buf_tmp += i;
+        buf_tmp_dma += i;
+
+        /* region 4: status buffer (larger the PRD, smaller this buf) ****** */
+        slot->response = buf_tmp;
+        hdr->status_buf = cpu_to_le64(buf_tmp_dma);
+
+        resp_len = MVS_SLOT_BUF_SZ - MVS_SSP_CMD_SZ - MVS_OAF_SZ -
+            sizeof(struct mvs_err_info) - i;
+        resp_len = min(resp_len, max_resp_len);
+
+        req_len = sizeof(struct ssp_frame_hdr) + 28;
+
+        /* request, response lengths */
+        hdr->lens = cpu_to_le32(((resp_len / 4) << 16) | (req_len / 4));
+
+        /* generate open address frame hdr (first 12 bytes) */
+        buf_oaf[0] = (1 << 7) | (1 << 4) | 0x1; /* initiator, SSP, ftype 1h */
+        buf_oaf[1] = task->dev->linkrate & 0xf;
+        *(u16 *)(buf_oaf + 2) = cpu_to_be16(tag);
+        memcpy(buf_oaf + 4, task->dev->sas_addr, SAS_ADDR_SIZE);
+
+        /* fill in SSP frame header (Command Table.SSP frame header) */
+        ssp_hdr = (struct ssp_frame_hdr *)buf_cmd;
+        ssp_hdr->frame_type = SSP_COMMAND;
+        memcpy(ssp_hdr->hashed_dest_addr, task->dev->hashed_sas_addr,
+               HASHED_SAS_ADDR_SIZE);
+        memcpy(ssp_hdr->hashed_src_addr,
+               task->dev->port->ha->hashed_sas_addr, HASHED_SAS_ADDR_SIZE);
+        ssp_hdr->tag = cpu_to_be16(tag);
+
+        /* fill in command frame IU */
+        buf_cmd += sizeof(*ssp_hdr);
+        memcpy(buf_cmd, &task->ssp_task.LUN, 8);
+        buf_cmd[9] = fburst | task->ssp_task.task_attr |
+                        (task->ssp_task.task_prio << 3);
+        memcpy(buf_cmd + 12, &task->ssp_task.cdb, 16);
+
+        /* fill in PRD (scatter/gather) table, if any */
+        for_each_sg(task->scatter, sg, tei->n_elem, i) {
+                buf_prd->addr = cpu_to_le64(sg_dma_address(sg));
+                buf_prd->len = cpu_to_le32(sg_dma_len(sg));
+                buf_prd++;
+        }
+
+        return 0;
+}
+
+static int mvs_task_exec(struct sas_task *task, const int num, gfp_t gfp_flags)
+{
+        struct domain_device *dev = task->dev;
+        struct mvs_info *mvi = dev->port->ha->lldd_ha;
+        struct pci_dev *pdev = mvi->pdev;
+        void __iomem *regs = mvi->regs;
+        struct mvs_task_exec_info tei;
+        struct sas_task *t = task;
+        u32 tag = 0xdeadbeef, rc, n_elem = 0;
+        unsigned long flags;
+        u32 n = num, pass = 0;
+
+        spin_lock_irqsave(&mvi->lock, flags);
+
+        do {
+                tei.port = &mvi->port[dev->port->id];
+
+                if (!tei.port->port_attached) {
+                        struct task_status_struct *ts = &t->task_status;
+                        ts->stat = SAS_PHY_DOWN;
+                        t->task_done(t);
+                        rc = 0;
+                        goto exec_exit;
+                }
+                if (!sas_protocol_ata(t->task_proto)) {
+                        if (t->num_scatter) {
+                                n_elem = pci_map_sg(mvi->pdev, t->scatter,
+                                                    t->num_scatter,
+                                                    t->data_dir);
+                                if (!n_elem) {
+                                        rc = -ENOMEM;
+                                        goto err_out;
+                                }
+                        }
+                } else {
+                        n_elem = t->num_scatter;
+                }
+
+                rc = mvs_tag_alloc(mvi, &tag);
+                if (rc)
+                        goto err_out;
+
+                mvi->slot_info[tag].task = t;
+                mvi->slot_info[tag].n_elem = n_elem;
+                memset(mvi->slot_info[tag].buf, 0, MVS_SLOT_BUF_SZ);
+                tei.task = t;
+                tei.hdr = &mvi->slot[tag];
+                tei.tag = tag;
+                tei.n_elem = n_elem;
+
+                switch (t->task_proto) {
+                case SAS_PROTOCOL_SMP:
+                        rc = mvs_task_prep_smp(mvi, &tei);
+                        break;
+                case SAS_PROTOCOL_SSP:
+                        rc = mvs_task_prep_ssp(mvi, &tei);
+                        break;
+                case SAS_PROTOCOL_SATA:
+                case SAS_PROTOCOL_STP:
+                case SAS_PROTOCOL_SATA | SAS_PROTOCOL_STP:
+                        rc = mvs_task_prep_ata(mvi, &tei);
+                        break;
+                default:
+                        dev_printk(KERN_ERR, &pdev->dev,
+                                "unknown sas_task proto: 0x%x\n",
+                                t->task_proto);
+                        rc = -EINVAL;
+                        break;
+                }
+
+                if (rc)
+                        goto err_out_tag;
+
+                /* TODO: select normal or high priority */
+
+                spin_lock(&t->task_state_lock);
+                t->task_state_flags |= SAS_TASK_AT_INITIATOR;
+                spin_unlock(&t->task_state_lock);
+
+                if (n == 1) {
+                        spin_unlock_irqrestore(&mvi->lock, flags);
+                        mw32(TX_PROD_IDX, mvi->tx_prod);
+                }
+                mvs_hba_memory_dump(mvi, tag, t->task_proto);
+
+                ++pass;
+                mvi->tx_prod = (mvi->tx_prod + 1) & (MVS_CHIP_SLOT_SZ - 1);
+
+                if (n == 1)
+                        break;
+
+                t = list_entry(t->list.next, struct sas_task, list);
+        } while (--n);
+
+        return 0;
+
+err_out_tag:
+        mvs_tag_free(mvi, tag);
+err_out:
+        dev_printk(KERN_ERR, &pdev->dev, "mvsas exec failed[%d]!\n", rc);
+        if (!sas_protocol_ata(t->task_proto))
+                if (n_elem)
+                        pci_unmap_sg(mvi->pdev, t->scatter, n_elem,
+                                     t->data_dir);
+exec_exit:
+        if (pass)
+                mw32(TX_PROD_IDX, (mvi->tx_prod - 1) & (MVS_CHIP_SLOT_SZ - 1));
+        spin_unlock_irqrestore(&mvi->lock, flags);
+        return rc;
+}
+
+static int mvs_task_abort(struct sas_task *task)
+{
+        int rc = 1;
+        unsigned long flags;
+        struct mvs_info *mvi = task->dev->port->ha->lldd_ha;
+        struct pci_dev *pdev = mvi->pdev;
+
+        spin_lock_irqsave(&task->task_state_lock, flags);
+        if (task->task_state_flags & SAS_TASK_STATE_DONE) {
+                rc = TMF_RESP_FUNC_COMPLETE;
+                goto out_done;
+        }
+        spin_unlock_irqrestore(&task->task_state_lock, flags);
+
+        /*FIXME*/
+        rc = TMF_RESP_FUNC_COMPLETE;
+
+        switch (task->task_proto) {
+        case SAS_PROTOCOL_SMP:
+                dev_printk(KERN_DEBUG, &pdev->dev, "SMP Abort! ");
+                break;
+        case SAS_PROTOCOL_SSP:
+                dev_printk(KERN_DEBUG, &pdev->dev, "SSP Abort! ");
+                break;
+        case SAS_PROTOCOL_SATA:
+        case SAS_PROTOCOL_STP:
+        case SAS_PROTOCOL_SATA | SAS_PROTOCOL_STP:{
+                dev_printk(KERN_DEBUG, &pdev->dev, "STP Abort! "
+                        "Dump D2H FIS: \n");
+                mvs_hexdump(sizeof(struct host_to_dev_fis),
+                                (void *)&task->ata_task.fis, 0);
+                dev_printk(KERN_DEBUG, &pdev->dev, "Dump ATAPI Cmd : \n");
+                mvs_hexdump(16, task->ata_task.atapi_packet, 0);
+                break;
+        }
+        default:
+                break;
+        }
+out_done:
+        return rc;
+}
+
+static void mvs_free(struct mvs_info *mvi)
+{
+        int i;
+
+        if (!mvi)
+                return;
+
+        for (i = 0; i < MVS_SLOTS; i++) {
+                struct mvs_slot_info *slot = &mvi->slot_info[i];
+
+                if (slot->buf)
+                        dma_free_coherent(&mvi->pdev->dev, MVS_SLOT_BUF_SZ,
+                                          slot->buf, slot->buf_dma);
+        }
+
+        if (mvi->tx)
+                dma_free_coherent(&mvi->pdev->dev,
+                                  sizeof(*mvi->tx) * MVS_CHIP_SLOT_SZ,
+                                  mvi->tx, mvi->tx_dma);
+        if (mvi->rx_fis)
+                dma_free_coherent(&mvi->pdev->dev, MVS_RX_FISL_SZ,
+                                  mvi->rx_fis, mvi->rx_fis_dma);
+        if (mvi->rx)
+                dma_free_coherent(&mvi->pdev->dev,
+                                  sizeof(*mvi->rx) * MVS_RX_RING_SZ,
+                                  mvi->rx, mvi->rx_dma);
+        if (mvi->slot)
+                dma_free_coherent(&mvi->pdev->dev,
+                                  sizeof(*mvi->slot) * MVS_SLOTS,
+                                  mvi->slot, mvi->slot_dma);
+#ifdef MVS_ENABLE_PERI
+        if (mvi->peri_regs)
+                iounmap(mvi->peri_regs);
+#endif
+        if (mvi->regs)
+                iounmap(mvi->regs);
+        if (mvi->shost)
+                scsi_host_put(mvi->shost);
+        kfree(mvi->sas.sas_port);
+        kfree(mvi->sas.sas_phy);
+        kfree(mvi);
+}
+
+/* FIXME: locking? */
+static int mvs_phy_control(struct asd_sas_phy *sas_phy, enum phy_func func,
+                           void *funcdata)
+{
+        struct mvs_info *mvi = sas_phy->ha->lldd_ha;
+        int rc = 0, phy_id = sas_phy->id;
+        u32 tmp;
+
+        tmp = mvs_read_phy_ctl(mvi, phy_id);
+
+        switch (func) {
+        case PHY_FUNC_SET_LINK_RATE:{
+                        struct sas_phy_linkrates *rates = funcdata;
+                        u32 lrmin = 0, lrmax = 0;
+
+                        lrmin = (rates->minimum_linkrate << 8);
+                        lrmax = (rates->maximum_linkrate << 12);
+
+                        if (lrmin) {
+                                tmp &= ~(0xf << 8);
+                                tmp |= lrmin;
+                        }
+                        if (lrmax) {
+                                tmp &= ~(0xf << 12);
+                                tmp |= lrmax;
+                        }
+                        mvs_write_phy_ctl(mvi, phy_id, tmp);
+                        break;
+                }
+
+        case PHY_FUNC_HARD_RESET:
+                if (tmp & PHY_RST_HARD)
+                        break;
+                mvs_write_phy_ctl(mvi, phy_id, tmp | PHY_RST_HARD);
+                break;
+
+        case PHY_FUNC_LINK_RESET:
+                mvs_write_phy_ctl(mvi, phy_id, tmp | PHY_RST);
+                break;
+
+        case PHY_FUNC_DISABLE:
+        case PHY_FUNC_RELEASE_SPINUP_HOLD:
+        default:
+                rc = -EOPNOTSUPP;
+        }
+
+        return rc;
+}
+
+static void __devinit mvs_phy_init(struct mvs_info *mvi, int phy_id)
+{
+        struct mvs_phy *phy = &mvi->phy[phy_id];
+        struct asd_sas_phy *sas_phy = &phy->sas_phy;
+
+        sas_phy->enabled = (phy_id < mvi->chip->n_phy) ? 1 : 0;
+        sas_phy->class = SAS;
+        sas_phy->iproto = SAS_PROTOCOL_ALL;
+        sas_phy->tproto = 0;
+        sas_phy->type = PHY_TYPE_PHYSICAL;
+        sas_phy->role = PHY_ROLE_INITIATOR;
+        sas_phy->oob_mode = OOB_NOT_CONNECTED;
+        sas_phy->linkrate = SAS_LINK_RATE_UNKNOWN;
+
+        sas_phy->id = phy_id;
+        sas_phy->sas_addr = &mvi->sas_addr[0];
+        sas_phy->frame_rcvd = &phy->frame_rcvd[0];
+        sas_phy->ha = &mvi->sas;
+        sas_phy->lldd_phy = phy;
+}
+
+static struct mvs_info *__devinit mvs_alloc(struct pci_dev *pdev,
+                                            const struct pci_device_id *ent)
+{
+        struct mvs_info *mvi;
+        unsigned long res_start, res_len, res_flag;
+        struct asd_sas_phy **arr_phy;
+        struct asd_sas_port **arr_port;
+        const struct mvs_chip_info *chip = &mvs_chips[ent->driver_data];
+        int i;
+
+        /*
+         * alloc and init our per-HBA mvs_info struct
+         */
+
+        mvi = kzalloc(sizeof(*mvi), GFP_KERNEL);
+        if (!mvi)
+                return NULL;
+
+        spin_lock_init(&mvi->lock);
+        mvi->pdev = pdev;
+        mvi->chip = chip;
+
+        if (pdev->device == 0x6440 && pdev->revision == 0)
+                mvi->flags |= MVF_PHY_PWR_FIX;
+
+        /*
+         * alloc and init SCSI, SAS glue
+         */
+
+        mvi->shost = scsi_host_alloc(&mvs_sht, sizeof(void *));
+        if (!mvi->shost)
+                goto err_out;
+
+        arr_phy = kcalloc(MVS_MAX_PHYS, sizeof(void *), GFP_KERNEL);
+        arr_port = kcalloc(MVS_MAX_PHYS, sizeof(void *), GFP_KERNEL);
+        if (!arr_phy || !arr_port)
+                goto err_out;
+
+        for (i = 0; i < MVS_MAX_PHYS; i++) {
+                mvs_phy_init(mvi, i);
+                arr_phy[i] = &mvi->phy[i].sas_phy;
+                arr_port[i] = &mvi->port[i].sas_port;
+        }
+
+        SHOST_TO_SAS_HA(mvi->shost) = &mvi->sas;
+        mvi->shost->transportt = mvs_stt;
+        mvi->shost->max_id = 21;
+        mvi->shost->max_lun = ~0;
+        mvi->shost->max_channel = 0;
+        mvi->shost->max_cmd_len = 16;
+
+        mvi->sas.sas_ha_name = DRV_NAME;
+        mvi->sas.dev = &pdev->dev;
+        mvi->sas.lldd_module = THIS_MODULE;
+        mvi->sas.sas_addr = &mvi->sas_addr[0];
+        mvi->sas.sas_phy = arr_phy;
+        mvi->sas.sas_port = arr_port;
+        mvi->sas.num_phys = chip->n_phy;
+        mvi->sas.lldd_max_execute_num = MVS_CHIP_SLOT_SZ - 1;
+        mvi->sas.lldd_queue_size = MVS_QUEUE_SIZE;
+        mvi->can_queue = (MVS_CHIP_SLOT_SZ >> 1) - 1;
+        mvi->sas.lldd_ha = mvi;
+        mvi->sas.core.shost = mvi->shost;
+
+        mvs_tag_init(mvi);
+
+        /*
+         * ioremap main and peripheral registers
+         */
+
+#ifdef MVS_ENABLE_PERI
+        res_start = pci_resource_start(pdev, 2);
+        res_len = pci_resource_len(pdev, 2);
+        if (!res_start || !res_len)
+                goto err_out;
+
+        mvi->peri_regs = ioremap_nocache(res_start, res_len);
+        if (!mvi->peri_regs)
+                goto err_out;
+#endif
+
+        res_start = pci_resource_start(pdev, 4);
+        res_len = pci_resource_len(pdev, 4);
+        if (!res_start || !res_len)
+                goto err_out;
+
+        res_flag = pci_resource_flags(pdev, 4);
+        if (res_flag & IORESOURCE_CACHEABLE)
+                mvi->regs = ioremap(res_start, res_len);
+        else
+                mvi->regs = ioremap_nocache(res_start, res_len);
+
+        if (!mvi->regs)
+                goto err_out;
+
+        /*
+         * alloc and init our DMA areas
+         */
+
+        mvi->tx = dma_alloc_coherent(&pdev->dev,
+                                     sizeof(*mvi->tx) * MVS_CHIP_SLOT_SZ,
+                                     &mvi->tx_dma, GFP_KERNEL);
+        if (!mvi->tx)
+                goto err_out;
+        memset(mvi->tx, 0, sizeof(*mvi->tx) * MVS_CHIP_SLOT_SZ);
+
+        mvi->rx_fis = dma_alloc_coherent(&pdev->dev, MVS_RX_FISL_SZ,
+                                         &mvi->rx_fis_dma, GFP_KERNEL);
+        if (!mvi->rx_fis)
+                goto err_out;
+        memset(mvi->rx_fis, 0, MVS_RX_FISL_SZ);
+
+        mvi->rx = dma_alloc_coherent(&pdev->dev,
+                                     sizeof(*mvi->rx) * MVS_RX_RING_SZ,
+                                     &mvi->rx_dma, GFP_KERNEL);
+        if (!mvi->rx)
+                goto err_out;
+        memset(mvi->rx, 0, sizeof(*mvi->rx) * MVS_RX_RING_SZ);
+
+        mvi->rx[0] = cpu_to_le32(0xfff);
+        mvi->rx_cons = 0xfff;
+
+        mvi->slot = dma_alloc_coherent(&pdev->dev,
+                                       sizeof(*mvi->slot) * MVS_SLOTS,
+                                       &mvi->slot_dma, GFP_KERNEL);
+        if (!mvi->slot)
+                goto err_out;
+        memset(mvi->slot, 0, sizeof(*mvi->slot) * MVS_SLOTS);
+
+        for (i = 0; i < MVS_SLOTS; i++) {
+                struct mvs_slot_info *slot = &mvi->slot_info[i];
+
+                slot->buf = dma_alloc_coherent(&pdev->dev, MVS_SLOT_BUF_SZ,
+                                               &slot->buf_dma, GFP_KERNEL);
+                if (!slot->buf)
+                        goto err_out;
+                memset(slot->buf, 0, MVS_SLOT_BUF_SZ);
+        }
+
+        /* finally, read NVRAM to get our SAS address */
+        if (mvs_nvram_read(mvi, NVR_SAS_ADDR, &mvi->sas_addr, 8))
+                goto err_out;
+        return mvi;
+
+err_out:
+        mvs_free(mvi);
+        return NULL;
+}
+
+static u32 mvs_cr32(void __iomem *regs, u32 addr)
+{
+        mw32(CMD_ADDR, addr);
+        return mr32(CMD_DATA);
+}
+
+static void mvs_cw32(void __iomem *regs, u32 addr, u32 val)
+{
+        mw32(CMD_ADDR, addr);
+        mw32(CMD_DATA, val);
+}
+
+static u32 mvs_read_phy_ctl(struct mvs_info *mvi, u32 port)
+{
+        void __iomem *regs = mvi->regs;
+        return (port < 4)?mr32(P0_SER_CTLSTAT + port * 4):
+                mr32(P4_SER_CTLSTAT + (port - 4) * 4);
+}
+
+static void mvs_write_phy_ctl(struct mvs_info *mvi, u32 port, u32 val)
+{
+        void __iomem *regs = mvi->regs;
+        if (port < 4)
+                mw32(P0_SER_CTLSTAT + port * 4, val);
+        else
+                mw32(P4_SER_CTLSTAT + (port - 4) * 4, val);
+}
+
+static u32 mvs_read_port(struct mvs_info *mvi, u32 off, u32 off2, u32 port)
+{
+        void __iomem *regs = mvi->regs + off;
+        void __iomem *regs2 = mvi->regs + off2;
+        return (port < 4)?readl(regs + port * 8):
+                readl(regs2 + (port - 4) * 8);
+}
+
+static void mvs_write_port(struct mvs_info *mvi, u32 off, u32 off2,
+                                u32 port, u32 val)
+{
+        void __iomem *regs = mvi->regs + off;
+        void __iomem *regs2 = mvi->regs + off2;
+        if (port < 4)
+                writel(val, regs + port * 8);
+        else
+                writel(val, regs2 + (port - 4) * 8);
+}
+
+static u32 mvs_read_port_cfg_data(struct mvs_info *mvi, u32 port)
+{
+        return mvs_read_port(mvi, MVS_P0_CFG_DATA, MVS_P4_CFG_DATA, port);
+}
+
+static void mvs_write_port_cfg_data(struct mvs_info *mvi, u32 port, u32 val)
+{
+        mvs_write_port(mvi, MVS_P0_CFG_DATA, MVS_P4_CFG_DATA, port, val);
+}
+
+static void mvs_write_port_cfg_addr(struct mvs_info *mvi, u32 port, u32 addr)
+{
+        mvs_write_port(mvi, MVS_P0_CFG_ADDR, MVS_P4_CFG_ADDR, port, addr);
+}
+
+static u32 mvs_read_port_vsr_data(struct mvs_info *mvi, u32 port)
+{
+        return mvs_read_port(mvi, MVS_P0_VSR_DATA, MVS_P4_VSR_DATA, port);
+}
+
+static void mvs_write_port_vsr_data(struct mvs_info *mvi, u32 port, u32 val)
+{
+        mvs_write_port(mvi, MVS_P0_VSR_DATA, MVS_P4_VSR_DATA, port, val);
+}
+
+static void mvs_write_port_vsr_addr(struct mvs_info *mvi, u32 port, u32 addr)
+{
+        mvs_write_port(mvi, MVS_P0_VSR_ADDR, MVS_P4_VSR_ADDR, port, addr);
+}
+
+static u32 mvs_read_port_irq_stat(struct mvs_info *mvi, u32 port)
+{
+        return mvs_read_port(mvi, MVS_P0_INT_STAT, MVS_P4_INT_STAT, port);
+}
+
+static void mvs_write_port_irq_stat(struct mvs_info *mvi, u32 port, u32 val)
+{
+        mvs_write_port(mvi, MVS_P0_INT_STAT, MVS_P4_INT_STAT, port, val);
+}
+
+static u32 mvs_read_port_irq_mask(struct mvs_info *mvi, u32 port)
+{
+        return mvs_read_port(mvi, MVS_P0_INT_MASK, MVS_P4_INT_MASK, port);
+}
+
+static void mvs_write_port_irq_mask(struct mvs_info *mvi, u32 port, u32 val)
+{
+        mvs_write_port(mvi, MVS_P0_INT_MASK, MVS_P4_INT_MASK, port, val);
+}
+
+static void __devinit mvs_phy_hacks(struct mvs_info *mvi)
+{
+        void __iomem *regs = mvi->regs;
+        u32 tmp;
+
+        /* workaround for SATA R-ERR, to ignore phy glitch */
+        tmp = mvs_cr32(regs, CMD_PHY_TIMER);
+        tmp &= ~(1 << 9);
+        tmp |= (1 << 10);
+        mvs_cw32(regs, CMD_PHY_TIMER, tmp);
+
+        /* enable retry 127 times */
+        mvs_cw32(regs, CMD_SAS_CTL1, 0x7f7f);
+
+        /* extend open frame timeout to max */
+        tmp = mvs_cr32(regs, CMD_SAS_CTL0);
+        tmp &= ~0xffff;
+        tmp |= 0x3fff;
+        mvs_cw32(regs, CMD_SAS_CTL0, tmp);
+
+        /* workaround for WDTIMEOUT , set to 550 ms */
+        mvs_cw32(regs, CMD_WD_TIMER, 0xffffff);
+
+        /* not to halt for different port op during wideport link change */
+        mvs_cw32(regs, CMD_APP_ERR_CONFIG, 0xffefbf7d);
+
+        /* workaround for Seagate disk not-found OOB sequence, recv
+         * COMINIT before sending out COMWAKE */
+        tmp = mvs_cr32(regs, CMD_PHY_MODE_21);
+        tmp &= 0x0000ffff;
+        tmp |= 0x00fa0000;
+        mvs_cw32(regs, CMD_PHY_MODE_21, tmp);
+
+        tmp = mvs_cr32(regs, CMD_PHY_TIMER);
+        tmp &= 0x1fffffff;
+        tmp |= (2U << 29);      /* 8 ms retry */
+        mvs_cw32(regs, CMD_PHY_TIMER, tmp);
+
+        /* TEST - for phy decoding error, adjust voltage levels */
+        mw32(P0_VSR_ADDR + 0, 0x8);
+        mw32(P0_VSR_DATA + 0, 0x2F0);
+
+        mw32(P0_VSR_ADDR + 8, 0x8);
+        mw32(P0_VSR_DATA + 8, 0x2F0);
+
+        mw32(P0_VSR_ADDR + 16, 0x8);
+        mw32(P0_VSR_DATA + 16, 0x2F0);
+
+        mw32(P0_VSR_ADDR + 24, 0x8);
+        mw32(P0_VSR_DATA + 24, 0x2F0);
+
+}
+
+static void mvs_enable_xmt(struct mvs_info *mvi, int PhyId)
+{
+        void __iomem *regs = mvi->regs;
+        u32 tmp;
+
+        tmp = mr32(PCS);
+        if (mvi->chip->n_phy <= 4)
+                tmp |= 1 << (PhyId + PCS_EN_PORT_XMT_SHIFT);
+        else
+                tmp |= 1 << (PhyId + PCS_EN_PORT_XMT_SHIFT2);
+        mw32(PCS, tmp);
+}
+
+static void mvs_detect_porttype(struct mvs_info *mvi, int i)
+{
+        void __iomem *regs = mvi->regs;
+        u32 reg;
+        struct mvs_phy *phy = &mvi->phy[i];
+
+        /* TODO check & save device type */
+        reg = mr32(GBL_PORT_TYPE);
+
+        if (reg & MODE_SAS_SATA & (1 << i))
+                phy->phy_type |= PORT_TYPE_SAS;
+        else
+                phy->phy_type |= PORT_TYPE_SATA;
+}
+
+static void *mvs_get_d2h_reg(struct mvs_info *mvi, int i, void *buf)
+{
+        u32 *s = (u32 *) buf;
+
+        if (!s)
+                return NULL;
+
+        mvs_write_port_cfg_addr(mvi, i, PHYR_SATA_SIG3);
+        s[3] = mvs_read_port_cfg_data(mvi, i);
+
+        mvs_write_port_cfg_addr(mvi, i, PHYR_SATA_SIG2);
+        s[2] = mvs_read_port_cfg_data(mvi, i);
+
+        mvs_write_port_cfg_addr(mvi, i, PHYR_SATA_SIG1);
+        s[1] = mvs_read_port_cfg_data(mvi, i);
+
+        mvs_write_port_cfg_addr(mvi, i, PHYR_SATA_SIG0);
+        s[0] = mvs_read_port_cfg_data(mvi, i);
+
+        return (void *)s;
+}
+
+static u32 mvs_is_sig_fis_received(u32 irq_status)
+{
+        return irq_status & PHYEV_SIG_FIS;
+}
+
+static void mvs_update_wideport(struct mvs_info *mvi, int i)
+{
+        struct mvs_phy *phy = &mvi->phy[i];
+        struct mvs_port *port = phy->port;
+        int j, no;
+
+        for_each_phy(port->wide_port_phymap, no, j, mvi->chip->n_phy)
+                if (no & 1) {
+                        mvs_write_port_cfg_addr(mvi, no, PHYR_WIDE_PORT);
+                        mvs_write_port_cfg_data(mvi, no,
+                                                port->wide_port_phymap);
+                } else {
+                        mvs_write_port_cfg_addr(mvi, no, PHYR_WIDE_PORT);
+                        mvs_write_port_cfg_data(mvi, no, 0);
+                }
+}
+
+static u32 mvs_is_phy_ready(struct mvs_info *mvi, int i)
+{
+        u32 tmp;
+        struct mvs_phy *phy = &mvi->phy[i];
+        struct mvs_port *port;
+
+        tmp = mvs_read_phy_ctl(mvi, i);
+
+        if ((tmp & PHY_READY_MASK) && !(phy->irq_status & PHYEV_POOF)) {
+                if (!phy->port)
+                        phy->phy_attached = 1;
+                return tmp;
+        }
+
+        port = phy->port;
+        if (port) {
+                if (phy->phy_type & PORT_TYPE_SAS) {
+                        port->wide_port_phymap &= ~(1U << i);
+                        if (!port->wide_port_phymap)
+                                port->port_attached = 0;
+                        mvs_update_wideport(mvi, i);
+                } else if (phy->phy_type & PORT_TYPE_SATA)
+                        port->port_attached = 0;
+                mvs_free_reg_set(mvi, phy->port);
+                phy->port = NULL;
+                phy->phy_attached = 0;
+                phy->phy_type &= ~(PORT_TYPE_SAS | PORT_TYPE_SATA);
+        }
+        return 0;
+}
+
+static void mvs_update_phyinfo(struct mvs_info *mvi, int i,
+                                        int get_st)
+{
+        struct mvs_phy *phy = &mvi->phy[i];
+        struct pci_dev *pdev = mvi->pdev;
+        u32 tmp, j;
+        u64 tmp64;
+
+        mvs_write_port_cfg_addr(mvi, i, PHYR_IDENTIFY);
+        phy->dev_info = mvs_read_port_cfg_data(mvi, i);
+
+        mvs_write_port_cfg_addr(mvi, i, PHYR_ADDR_HI);
+        phy->dev_sas_addr = (u64) mvs_read_port_cfg_data(mvi, i) << 32;
+
+        mvs_write_port_cfg_addr(mvi, i, PHYR_ADDR_LO);
+        phy->dev_sas_addr |= mvs_read_port_cfg_data(mvi, i);
+
+        if (get_st) {
+                phy->irq_status = mvs_read_port_irq_stat(mvi, i);
+                phy->phy_status = mvs_is_phy_ready(mvi, i);
+        }
+
+        if (phy->phy_status) {
+                u32 phy_st;
+                struct asd_sas_phy *sas_phy = mvi->sas.sas_phy[i];
+
+                mvs_write_port_cfg_addr(mvi, i, PHYR_PHY_STAT);
+                phy_st = mvs_read_port_cfg_data(mvi, i);
+
+                sas_phy->linkrate =
+                        (phy->phy_status & PHY_NEG_SPP_PHYS_LINK_RATE_MASK) >>
+                                PHY_NEG_SPP_PHYS_LINK_RATE_MASK_OFFSET;
+
+                /* Updated attached_sas_addr */
+                mvs_write_port_cfg_addr(mvi, i, PHYR_ATT_ADDR_HI);
+                phy->att_dev_sas_addr =
+                                (u64) mvs_read_port_cfg_data(mvi, i) << 32;
+
+                mvs_write_port_cfg_addr(mvi, i, PHYR_ATT_ADDR_LO);
+                phy->att_dev_sas_addr |= mvs_read_port_cfg_data(mvi, i);
+
+                dev_printk(KERN_DEBUG, &pdev->dev,
+                        "phy[%d] Get Attached Address 0x%llX ,"
+                        " SAS Address 0x%llX\n",
+                        i, phy->att_dev_sas_addr, phy->dev_sas_addr);
+                dev_printk(KERN_DEBUG, &pdev->dev,
+                        "Rate = %x , type = %d\n",
+                        sas_phy->linkrate, phy->phy_type);
+
+#if 1
+                /*
+                * If the device is capable of supporting a wide port
+                * on its phys, it may configure the phys as a wide port.
+                */
+                if (phy->phy_type & PORT_TYPE_SAS)
+                        for (j = 0; j < mvi->chip->n_phy && j != i; ++j) {
+                                if ((mvi->phy[j].phy_attached) &&
+                                        (mvi->phy[j].phy_type & PORT_TYPE_SAS))
+                                        if (phy->att_dev_sas_addr ==
+                                        mvi->phy[j].att_dev_sas_addr - 1) {
+                                                phy->att_dev_sas_addr =
+                                                mvi->phy[j].att_dev_sas_addr;
+                                                break;
+                                        }
+                        }
+
+#endif
+
+                tmp64 = cpu_to_be64(phy->att_dev_sas_addr);
+                memcpy(sas_phy->attached_sas_addr, &tmp64, SAS_ADDR_SIZE);
+
+                if (phy->phy_type & PORT_TYPE_SAS) {
+                        mvs_write_port_cfg_addr(mvi, i, PHYR_ATT_DEV_INFO);
+                        phy->att_dev_info = mvs_read_port_cfg_data(mvi, i);
+                        phy->identify.device_type =
+                            phy->att_dev_info & PORT_DEV_TYPE_MASK;
+
+                        if (phy->identify.device_type == SAS_END_DEV)
+                                phy->identify.target_port_protocols =
+                                                        SAS_PROTOCOL_SSP;
+                        else if (phy->identify.device_type != NO_DEVICE)
+                                phy->identify.target_port_protocols =
+                                                        SAS_PROTOCOL_SMP;
+                        if (phy_st & PHY_OOB_DTCTD)
+                                sas_phy->oob_mode = SAS_OOB_MODE;
+                        phy->frame_rcvd_size =
+                            sizeof(struct sas_identify_frame);
+                } else if (phy->phy_type & PORT_TYPE_SATA) {
+                        phy->identify.target_port_protocols = SAS_PROTOCOL_STP;
+                        if (mvs_is_sig_fis_received(phy->irq_status)) {
+                                if (phy_st & PHY_OOB_DTCTD)
+                                        sas_phy->oob_mode = SATA_OOB_MODE;
+                                phy->frame_rcvd_size =
+                                    sizeof(struct dev_to_host_fis);
+                                mvs_get_d2h_reg(mvi, i,
+                                                (void *)sas_phy->frame_rcvd);
+                        } else {
+                                dev_printk(KERN_DEBUG, &pdev->dev,
+                                        "No sig fis\n");
+                        }
+                }
+                /* workaround for HW phy decoding error on 1.5g disk drive */
+                mvs_write_port_vsr_addr(mvi, i, VSR_PHY_MODE6);
+                tmp = mvs_read_port_vsr_data(mvi, i);
+                if (((phy->phy_status & PHY_NEG_SPP_PHYS_LINK_RATE_MASK) >>
+                     PHY_NEG_SPP_PHYS_LINK_RATE_MASK_OFFSET) ==
+                        SAS_LINK_RATE_1_5_GBPS)
+                        tmp &= ~PHY_MODE6_DTL_SPEED;
+                else
+                        tmp |= PHY_MODE6_DTL_SPEED;
+                mvs_write_port_vsr_data(mvi, i, tmp);
+
+        }
+        if (get_st)
+                mvs_write_port_irq_stat(mvi, i, phy->irq_status);
+}
+
+static void mvs_port_formed(struct asd_sas_phy *sas_phy)
+{
+        struct sas_ha_struct *sas_ha = sas_phy->ha;
+        struct mvs_info *mvi = sas_ha->lldd_ha;
+        struct asd_sas_port *sas_port = sas_phy->port;
+        struct mvs_phy *phy = sas_phy->lldd_phy;
+        struct mvs_port *port = &mvi->port[sas_port->id];
+        unsigned long flags;
+
+        spin_lock_irqsave(&mvi->lock, flags);
+        port->port_attached = 1;
+        phy->port = port;
+        port->taskfileset = MVS_ID_NOT_MAPPED;
+        if (phy->phy_type & PORT_TYPE_SAS) {
+                port->wide_port_phymap = sas_port->phy_mask;
+                mvs_update_wideport(mvi, sas_phy->id);
+        }
+        spin_unlock_irqrestore(&mvi->lock, flags);
+}
+
+static int __devinit mvs_hw_init(struct mvs_info *mvi)
+{
+        void __iomem *regs = mvi->regs;
+        int i;
+        u32 tmp, cctl;
+
+        /* make sure interrupts are masked immediately (paranoia) */
+        mw32(GBL_CTL, 0);
+        tmp = mr32(GBL_CTL);
+
+        /* Reset Controller */
+        if (!(tmp & HBA_RST)) {
+                if (mvi->flags & MVF_PHY_PWR_FIX) {
+                        pci_read_config_dword(mvi->pdev, PCR_PHY_CTL, &tmp);
+                        tmp &= ~PCTL_PWR_ON;
+                        tmp |= PCTL_OFF;
+                        pci_write_config_dword(mvi->pdev, PCR_PHY_CTL, tmp);
+
+                        pci_read_config_dword(mvi->pdev, PCR_PHY_CTL2, &tmp);
+                        tmp &= ~PCTL_PWR_ON;
+                        tmp |= PCTL_OFF;
+                        pci_write_config_dword(mvi->pdev, PCR_PHY_CTL2, tmp);
+                }
+
+                /* global reset, incl. COMRESET/H_RESET_N (self-clearing) */
+                mw32_f(GBL_CTL, HBA_RST);
+        }
+
+        /* wait for reset to finish; timeout is just a guess */
+        i = 1000;
+        while (i-- > 0) {
+                msleep(10);
+
+                if (!(mr32(GBL_CTL) & HBA_RST))
+                        break;
+        }
+        if (mr32(GBL_CTL) & HBA_RST) {
+                dev_printk(KERN_ERR, &mvi->pdev->dev, "HBA reset failed\n");
+                return -EBUSY;
+        }
+
+        /* Init Chip */
+        /* make sure RST is set; HBA_RST /should/ have done that for us */
+        cctl = mr32(CTL);
+        if (cctl & CCTL_RST)
+                cctl &= ~CCTL_RST;
+        else
+                mw32_f(CTL, cctl | CCTL_RST);
+
+        /* write to device control _AND_ device status register? - A.C. */
+        pci_read_config_dword(mvi->pdev, PCR_DEV_CTRL, &tmp);
+        tmp &= ~PRD_REQ_MASK;
+        tmp |= PRD_REQ_SIZE;
+        pci_write_config_dword(mvi->pdev, PCR_DEV_CTRL, tmp);
+
+        pci_read_config_dword(mvi->pdev, PCR_PHY_CTL, &tmp);
+        tmp |= PCTL_PWR_ON;
+        tmp &= ~PCTL_OFF;
+        pci_write_config_dword(mvi->pdev, PCR_PHY_CTL, tmp);
+
+        pci_read_config_dword(mvi->pdev, PCR_PHY_CTL2, &tmp);
+        tmp |= PCTL_PWR_ON;
+        tmp &= ~PCTL_OFF;
+        pci_write_config_dword(mvi->pdev, PCR_PHY_CTL2, tmp);
+
+        mw32_f(CTL, cctl);
+
+        /* reset control */
+        mw32(PCS, 0);           /*MVS_PCS */
+
+        mvs_phy_hacks(mvi);
+
+        mw32(CMD_LIST_LO, mvi->slot_dma);
+        mw32(CMD_LIST_HI, (mvi->slot_dma >> 16) >> 16);
+
+        mw32(RX_FIS_LO, mvi->rx_fis_dma);
+        mw32(RX_FIS_HI, (mvi->rx_fis_dma >> 16) >> 16);
+
+        mw32(TX_CFG, MVS_CHIP_SLOT_SZ);
+        mw32(TX_LO, mvi->tx_dma);
+        mw32(TX_HI, (mvi->tx_dma >> 16) >> 16);
+
+        mw32(RX_CFG, MVS_RX_RING_SZ);
+        mw32(RX_LO, mvi->rx_dma);
+        mw32(RX_HI, (mvi->rx_dma >> 16) >> 16);
+
+        /* enable auto port detection */
+        mw32(GBL_PORT_TYPE, MODE_AUTO_DET_EN);
+        msleep(100);
+        /* init and reset phys */
+        for (i = 0; i < mvi->chip->n_phy; i++) {
+                u32 lo = be32_to_cpu(*(u32 *)&mvi->sas_addr[4]);
+                u32 hi = be32_to_cpu(*(u32 *)&mvi->sas_addr[0]);
+
+                mvs_detect_porttype(mvi, i);
+
+                /* set phy local SAS address */
+                mvs_write_port_cfg_addr(mvi, i, PHYR_ADDR_LO);
+                mvs_write_port_cfg_data(mvi, i, lo);
+                mvs_write_port_cfg_addr(mvi, i, PHYR_ADDR_HI);
+                mvs_write_port_cfg_data(mvi, i, hi);
+
+                /* reset phy */
+                tmp = mvs_read_phy_ctl(mvi, i);
+                tmp |= PHY_RST;
+                mvs_write_phy_ctl(mvi, i, tmp);
+        }
+
+        msleep(100);
+
+        for (i = 0; i < mvi->chip->n_phy; i++) {
+                /* clear phy int status */
+                tmp = mvs_read_port_irq_stat(mvi, i);
+                tmp &= ~PHYEV_SIG_FIS;
+                mvs_write_port_irq_stat(mvi, i, tmp);
+
+                /* set phy int mask */
+                tmp = PHYEV_RDY_CH | PHYEV_BROAD_CH | PHYEV_UNASSOC_FIS |
+                        PHYEV_ID_DONE | PHYEV_DEC_ERR;
+                mvs_write_port_irq_mask(mvi, i, tmp);
+
+                msleep(100);
+                mvs_update_phyinfo(mvi, i, 1);
+                mvs_enable_xmt(mvi, i);
+        }
+
+        /* FIXME: update wide port bitmaps */
+
+        /* little endian for open address and command table, etc. */
+        /* A.C.
+         * it seems that ( from the spec ) turning on big-endian won't
+         * do us any good on big-endian machines, need further confirmation
+         */
+        cctl = mr32(CTL);
+        cctl |= CCTL_ENDIAN_CMD;
+        cctl |= CCTL_ENDIAN_DATA;
+        cctl &= ~CCTL_ENDIAN_OPEN;
+        cctl |= CCTL_ENDIAN_RSP;
+        mw32_f(CTL, cctl);
+
+        /* reset CMD queue */
+        tmp = mr32(PCS);
+        tmp |= PCS_CMD_RST;
+        mw32(PCS, tmp);
+        /* interrupt coalescing may cause missing HW interrput in some case,
+         * and the max count is 0x1ff, while our max slot is 0x200,
+         * it will make count 0.
+         */
+        tmp = 0;
+        mw32(INT_COAL, tmp);
+
+        tmp = 0x100;
+        mw32(INT_COAL_TMOUT, tmp);
+
+        /* ladies and gentlemen, start your engines */
+        mw32(TX_CFG, 0);
+        mw32(TX_CFG, MVS_CHIP_SLOT_SZ | TX_EN);
+        mw32(RX_CFG, MVS_RX_RING_SZ | RX_EN);
+        /* enable CMD/CMPL_Q/RESP mode */
+        mw32(PCS, PCS_SATA_RETRY | PCS_FIS_RX_EN | PCS_CMD_EN);
+
+        /* re-enable interrupts globally */
+        mvs_hba_interrupt_enable(mvi);
+
+        /* enable completion queue interrupt */
+        tmp = (CINT_PORT_MASK | CINT_DONE | CINT_MEM);
+        mw32(INT_MASK, tmp);
+
+        return 0;
+}
+
+static void __devinit mvs_print_info(struct mvs_info *mvi)
+{
+        struct pci_dev *pdev = mvi->pdev;
+        static int printed_version;
+
+        if (!printed_version++)
+                dev_printk(KERN_INFO, &pdev->dev, "version " DRV_VERSION "\n");
+
+        dev_printk(KERN_INFO, &pdev->dev, "%u phys, addr %llx\n",
+                   mvi->chip->n_phy, SAS_ADDR(mvi->sas_addr));
+}
+
+static int __devinit mvs_pci_init(struct pci_dev *pdev,
+                                  const struct pci_device_id *ent)
+{
+        int rc;
+        struct mvs_info *mvi;
+        irq_handler_t irq_handler = mvs_interrupt;
+
+        rc = pci_enable_device(pdev);
+        if (rc)
+                return rc;
+
+        pci_set_master(pdev);
+
+        rc = pci_request_regions(pdev, DRV_NAME);
+        if (rc)
+                goto err_out_disable;
+
+        rc = pci_go_64(pdev);
+        if (rc)
+                goto err_out_regions;
+
+        mvi = mvs_alloc(pdev, ent);
+        if (!mvi) {
+                rc = -ENOMEM;
+                goto err_out_regions;
+        }
+
+        rc = mvs_hw_init(mvi);
+        if (rc)
+                goto err_out_mvi;
+
+#ifndef MVS_DISABLE_MSI
+        if (!pci_enable_msi(pdev)) {
+                u32 tmp;
+                void __iomem *regs = mvi->regs;
+                mvi->flags |= MVF_MSI;
+                irq_handler = mvs_msi_interrupt;
+                tmp = mr32(PCS);
+                mw32(PCS, tmp | PCS_SELF_CLEAR);
+        }
+#endif
+
+        rc = request_irq(pdev->irq, irq_handler, IRQF_SHARED, DRV_NAME, mvi);
+        if (rc)
+                goto err_out_msi;
+
+        rc = scsi_add_host(mvi->shost, &pdev->dev);
+        if (rc)
+                goto err_out_irq;
+
+        rc = sas_register_ha(&mvi->sas);
+        if (rc)
+                goto err_out_shost;
+
+        pci_set_drvdata(pdev, mvi);
+
+        mvs_print_info(mvi);
+
+        scsi_scan_host(mvi->shost);
+
+        return 0;
+
+err_out_shost:
+        scsi_remove_host(mvi->shost);
+err_out_irq:
+        free_irq(pdev->irq, mvi);
+err_out_msi:
+        if (mvi->flags |= MVF_MSI)
+                pci_disable_msi(pdev);
+err_out_mvi:
+        mvs_free(mvi);
+err_out_regions:
+        pci_release_regions(pdev);
+err_out_disable:
+        pci_disable_device(pdev);
+        return rc;
+}
+
+static void __devexit mvs_pci_remove(struct pci_dev *pdev)
+{
+        struct mvs_info *mvi = pci_get_drvdata(pdev);
+
+        pci_set_drvdata(pdev, NULL);
+
+        if (mvi) {
+                sas_unregister_ha(&mvi->sas);
+                mvs_hba_interrupt_disable(mvi);
+                sas_remove_host(mvi->shost);
+                scsi_remove_host(mvi->shost);
+
+                free_irq(pdev->irq, mvi);
+                if (mvi->flags & MVF_MSI)
+                        pci_disable_msi(pdev);
+                mvs_free(mvi);
+                pci_release_regions(pdev);
+        }
+        pci_disable_device(pdev);
+}
+
+static struct sas_domain_function_template mvs_transport_ops = {
+        .lldd_execute_task      = mvs_task_exec,
+        .lldd_control_phy       = mvs_phy_control,
+        .lldd_abort_task        = mvs_task_abort,
+        .lldd_port_formed       = mvs_port_formed
+};
+
+static struct pci_device_id __devinitdata mvs_pci_table[] = {
+        { PCI_VDEVICE(MARVELL, 0x6320), chip_6320 },
+        { PCI_VDEVICE(MARVELL, 0x6340), chip_6440 },
+        { PCI_VDEVICE(MARVELL, 0x6440), chip_6440 },
+        { PCI_VDEVICE(MARVELL, 0x6480), chip_6480 },
+
+        { }     /* terminate list */
+};
+
+static struct pci_driver mvs_pci_driver = {
+        .name           = DRV_NAME,
+        .id_table       = mvs_pci_table,
+        .probe          = mvs_pci_init,
+        .remove         = __devexit_p(mvs_pci_remove),
+};
+
+static int __init mvs_init(void)
+{
+        int rc;
+
+        mvs_stt = sas_domain_attach_transport(&mvs_transport_ops);
+        if (!mvs_stt)
+                return -ENOMEM;
+
+        rc = pci_register_driver(&mvs_pci_driver);
+        if (rc)
+                goto err_out;
+
+        return 0;
+
+err_out:
+        sas_release_transport(mvs_stt);
+        return rc;
+}
+
+static void __exit mvs_exit(void)
+{
+        pci_unregister_driver(&mvs_pci_driver);
+        sas_release_transport(mvs_stt);
+}
+
+module_init(mvs_init);
+module_exit(mvs_exit);
+
+MODULE_AUTHOR("Jeff Garzik <jgarzik@pobox.com>");
+MODULE_DESCRIPTION("Marvell 88SE6440 SAS/SATA controller driver");
+MODULE_VERSION(DRV_VERSION);
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(pci, mvs_pci_table);
diff --git a/drivers/scsi/ps3rom.c b/drivers/scsi/ps3rom.c
index 0cd614a0fa73..fad6cb5cba28 100644
--- a/drivers/scsi/ps3rom.c
+++ b/drivers/scsi/ps3rom.c
@@ -124,7 +124,7 @@ static int fill_from_dev_buffer(struct scsi_cmnd *cmd, const void *buf)
                 }
                 req_len += sgpnt->length;
         }
-        scsi_set_resid(cmd, req_len - act_len);
+        scsi_set_resid(cmd, buflen - act_len);
         return 0;
 }
 
@@ -427,7 +427,7 @@ static struct scsi_host_template ps3rom_host_template = {
         .cmd_per_lun =          1,
         .emulated =             1,              /* only sg driver uses this */
         .max_sectors =          PS3ROM_MAX_SECTORS,
-        .use_clustering =       ENABLE_CLUSTERING,
+        .use_clustering =       DISABLE_CLUSTERING,
         .module =               THIS_MODULE,
 };
 
diff --git a/drivers/scsi/qla2xxx/qla_dfs.c b/drivers/scsi/qla2xxx/qla_dfs.c
index 1479c60441c8..2cd899bfe84b 100644
--- a/drivers/scsi/qla2xxx/qla_dfs.c
+++ b/drivers/scsi/qla2xxx/qla_dfs.c
@@ -23,7 +23,7 @@ qla2x00_dfs_fce_show(struct seq_file *s, void *unused)
         mutex_lock(&ha->fce_mutex);
 
         seq_printf(s, "FCE Trace Buffer\n");
-        seq_printf(s, "In Pointer = %llx\n\n", ha->fce_wr);
+        seq_printf(s, "In Pointer = %llx\n\n", (unsigned long long)ha->fce_wr);
         seq_printf(s, "Base = %llx\n\n", (unsigned long long) ha->fce_dma);
         seq_printf(s, "FCE Enable Registers\n");
         seq_printf(s, "%08x %08x %08x %08x %08x %08x\n",
diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
index 6226d88479f5..c1808763d40e 100644
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -39,7 +39,7 @@ qla2x00_prep_ms_iocb(scsi_qla_host_t *ha, uint32_t req_size, uint32_t rsp_size)
         ms_pkt->entry_count = 1;
         SET_TARGET_ID(ha, ms_pkt->loop_id, SIMPLE_NAME_SERVER);
         ms_pkt->control_flags = __constant_cpu_to_le16(CF_READ | CF_HEAD_TAG);
-        ms_pkt->timeout = __constant_cpu_to_le16(25);
+        ms_pkt->timeout = cpu_to_le16(ha->r_a_tov / 10 * 2);
         ms_pkt->cmd_dsd_count = __constant_cpu_to_le16(1);
         ms_pkt->total_dsd_count = __constant_cpu_to_le16(2);
         ms_pkt->rsp_bytecount = cpu_to_le32(rsp_size);
@@ -75,7 +75,7 @@ qla24xx_prep_ms_iocb(scsi_qla_host_t *ha, uint32_t req_size, uint32_t rsp_size)
         ct_pkt->entry_type = CT_IOCB_TYPE;
         ct_pkt->entry_count = 1;
         ct_pkt->nport_handle = __constant_cpu_to_le16(NPH_SNS);
-        ct_pkt->timeout = __constant_cpu_to_le16(25);
+        ct_pkt->timeout = cpu_to_le16(ha->r_a_tov / 10 * 2);
         ct_pkt->cmd_dsd_count = __constant_cpu_to_le16(1);
         ct_pkt->rsp_dsd_count = __constant_cpu_to_le16(1);
         ct_pkt->rsp_byte_count = cpu_to_le32(rsp_size);
@@ -1144,7 +1144,7 @@ qla2x00_prep_ms_fdmi_iocb(scsi_qla_host_t *ha, uint32_t req_size,
         ms_pkt->entry_count = 1;
         SET_TARGET_ID(ha, ms_pkt->loop_id, ha->mgmt_svr_loop_id);
         ms_pkt->control_flags = __constant_cpu_to_le16(CF_READ | CF_HEAD_TAG);
-        ms_pkt->timeout = __constant_cpu_to_le16(59);
+        ms_pkt->timeout = cpu_to_le16(ha->r_a_tov / 10 * 2);
         ms_pkt->cmd_dsd_count = __constant_cpu_to_le16(1);
         ms_pkt->total_dsd_count = __constant_cpu_to_le16(2);
         ms_pkt->rsp_bytecount = cpu_to_le32(rsp_size);
@@ -1181,7 +1181,7 @@ qla24xx_prep_ms_fdmi_iocb(scsi_qla_host_t *ha, uint32_t req_size,
         ct_pkt->entry_type = CT_IOCB_TYPE;
         ct_pkt->entry_count = 1;
         ct_pkt->nport_handle = cpu_to_le16(ha->mgmt_svr_loop_id);
-        ct_pkt->timeout = __constant_cpu_to_le16(59);
+        ct_pkt->timeout = cpu_to_le16(ha->r_a_tov / 10 * 2);
         ct_pkt->cmd_dsd_count = __constant_cpu_to_le16(1);
         ct_pkt->rsp_dsd_count = __constant_cpu_to_le16(1);
         ct_pkt->rsp_byte_count = cpu_to_le32(rsp_size);
@@ -1761,7 +1761,7 @@ qla24xx_prep_ms_fm_iocb(scsi_qla_host_t *ha, uint32_t req_size,
         ct_pkt->entry_type = CT_IOCB_TYPE;
         ct_pkt->entry_count = 1;
         ct_pkt->nport_handle = cpu_to_le16(ha->mgmt_svr_loop_id);
-        ct_pkt->timeout = __constant_cpu_to_le16(59);
+        ct_pkt->timeout = cpu_to_le16(ha->r_a_tov / 10 * 2);
         ct_pkt->cmd_dsd_count = __constant_cpu_to_le16(1);
         ct_pkt->rsp_dsd_count = __constant_cpu_to_le16(1);
         ct_pkt->rsp_byte_count = cpu_to_le32(rsp_size);
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index d5c7853e7eba..364be7d06875 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1733,8 +1733,8 @@ qla2x00_nvram_config(scsi_qla_host_t *ha)
         ha->login_timeout = nv->login_timeout;
         icb->login_timeout = nv->login_timeout;
 
-        /* Set minimum RATOV to 200 tenths of a second. */
-        ha->r_a_tov = 200;
+        /* Set minimum RATOV to 100 tenths of a second. */
+        ha->r_a_tov = 100;
 
         ha->loop_reset_delay = nv->reset_delay;
 
@@ -3645,8 +3645,8 @@ qla24xx_nvram_config(scsi_qla_host_t *ha)
         ha->login_timeout = le16_to_cpu(nv->login_timeout);
         icb->login_timeout = cpu_to_le16(nv->login_timeout);
 
-        /* Set minimum RATOV to 200 tenths of a second. */
-        ha->r_a_tov = 200;
+        /* Set minimum RATOV to 100 tenths of a second. */
+        ha->r_a_tov = 100;
 
         ha->loop_reset_delay = nv->reset_delay;
 
@@ -4022,7 +4022,8 @@ qla2x00_try_to_stop_firmware(scsi_qla_host_t *ha)
                 return;
 
         ret = qla2x00_stop_firmware(ha);
-        for (retries = 5; ret != QLA_SUCCESS && retries ; retries--) {
+        for (retries = 5; ret != QLA_SUCCESS && ret != QLA_FUNCTION_TIMEOUT &&
+            retries ; retries--) {
                 qla2x00_reset_chip(ha);
                 if (qla2x00_chip_diag(ha) != QLA_SUCCESS)
                         continue;
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 14e6f22944b7..f0337036c7bb 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -958,6 +958,11 @@ qla2x00_status_entry(scsi_qla_host_t *ha, void *pkt)
                 }
         }
 
+        /* Check for overrun. */
+        if (IS_FWI2_CAPABLE(ha) && comp_status == CS_COMPLETE &&
+            scsi_status & SS_RESIDUAL_OVER)
+                comp_status = CS_DATA_OVERRUN;
+
         /*
          * Based on Host and scsi status generate status code for Linux
          */
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 99d29fff836d..bb103580e1ba 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -2206,7 +2206,7 @@ qla24xx_abort_target(fc_port_t *fcport)
         tsk->p.tsk.entry_type = TSK_MGMT_IOCB_TYPE;
         tsk->p.tsk.entry_count = 1;
         tsk->p.tsk.nport_handle = cpu_to_le16(fcport->loop_id);
-        tsk->p.tsk.timeout = __constant_cpu_to_le16(25);
+        tsk->p.tsk.timeout = cpu_to_le16(ha->r_a_tov / 10 * 2);
         tsk->p.tsk.control_flags = __constant_cpu_to_le32(TCF_TARGET_RESET);
         tsk->p.tsk.port_id[0] = fcport->d_id.b.al_pa;
         tsk->p.tsk.port_id[1] = fcport->d_id.b.area;
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index c5742cc15abb..ea08a129fee9 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "8.02.00-k8"
+#define QLA2XXX_VERSION      "8.02.00-k9"
 
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    2
diff --git a/drivers/scsi/qla4xxx/ql4_init.c b/drivers/scsi/qla4xxx/ql4_init.c
index 10b3b9a620f3..109c5f5985ec 100644
--- a/drivers/scsi/qla4xxx/ql4_init.c
+++ b/drivers/scsi/qla4xxx/ql4_init.c
@@ -1299,9 +1299,9 @@ int qla4xxx_process_ddb_changed(struct scsi_qla_host *ha,
         ddb_entry->fw_ddb_device_state = state;
         /* Device is back online. */
         if (ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) {
+                atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
                 atomic_set(&ddb_entry->port_down_timer,
                            ha->port_down_retry_count);
-                atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
                 atomic_set(&ddb_entry->relogin_retry_count, 0);
                 atomic_set(&ddb_entry->relogin_timer, 0);
                 clear_bit(DF_RELOGIN, &ddb_entry->flags);
diff --git a/drivers/scsi/qla4xxx/ql4_isr.c b/drivers/scsi/qla4xxx/ql4_isr.c
index 0f029d0d7315..fc84db4069f4 100644
--- a/drivers/scsi/qla4xxx/ql4_isr.c
+++ b/drivers/scsi/qla4xxx/ql4_isr.c
@@ -100,8 +100,7 @@ static void qla4xxx_status_entry(struct scsi_qla_host *ha,
 
                 if (sts_entry->iscsiFlags &ISCSI_FLAG_RESIDUAL_UNDER) {
                         scsi_set_resid(cmd, residual);
-                        if (!scsi_status && ((scsi_bufflen(cmd) - residual) <
-                                cmd->underflow)) {
+                        if ((scsi_bufflen(cmd) - residual) < cmd->underflow) {
 
                                 cmd->result = DID_ERROR << 16;
 
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index c3c59d763037..8b92f348f02c 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -75,6 +75,7 @@ static int qla4xxx_eh_host_reset(struct scsi_cmnd *cmd);
 static int qla4xxx_slave_alloc(struct scsi_device *device);
 static int qla4xxx_slave_configure(struct scsi_device *device);
 static void qla4xxx_slave_destroy(struct scsi_device *sdev);
+static void qla4xxx_scan_start(struct Scsi_Host *shost);
 
 static struct scsi_host_template qla4xxx_driver_template = {
         .module                 = THIS_MODULE,
@@ -90,6 +91,7 @@ static struct scsi_host_template qla4xxx_driver_template = {
         .slave_destroy          = qla4xxx_slave_destroy,
 
         .scan_finished          = iscsi_scan_finished,
+        .scan_start             = qla4xxx_scan_start,
 
         .this_id                = -1,
         .cmd_per_lun            = 3,
@@ -299,6 +301,18 @@ struct ddb_entry *qla4xxx_alloc_sess(struct scsi_qla_host *ha)
         return ddb_entry;
 }
 
+static void qla4xxx_scan_start(struct Scsi_Host *shost)
+{
+        struct scsi_qla_host *ha = shost_priv(shost);
+        struct ddb_entry *ddb_entry, *ddbtemp;
+
+        /* finish setup of sessions that were already setup in firmware */
+        list_for_each_entry_safe(ddb_entry, ddbtemp, &ha->ddb_list, list) {
+                if (ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE)
+                        qla4xxx_add_sess(ddb_entry);
+        }
+}
+
 /*
  * Timer routines
  */
@@ -864,8 +878,9 @@ static void qla4xxx_flush_active_srbs(struct scsi_qla_host *ha)
  * qla4xxx_recover_adapter - recovers adapter after a fatal error
  * @ha: Pointer to host adapter structure.
  * @renew_ddb_list: Indicates what to do with the adapter's ddb list
- *      after adapter recovery has completed.
- *      0=preserve ddb list, 1=destroy and rebuild ddb list
+ *
+ * renew_ddb_list value can be 0=preserve ddb list, 1=destroy and rebuild
+ * ddb list.
  **/
 static int qla4xxx_recover_adapter(struct scsi_qla_host *ha,
                                 uint8_t renew_ddb_list)
@@ -874,6 +889,7 @@ static int qla4xxx_recover_adapter(struct scsi_qla_host *ha,
 
         /* Stall incoming I/O until we are done */
         clear_bit(AF_ONLINE, &ha->flags);
+
         DEBUG2(printk("scsi%ld: %s calling qla4xxx_cmd_wait\n", ha->host_no,
                       __func__));
 
@@ -1176,7 +1192,6 @@ static int __devinit qla4xxx_probe_adapter(struct pci_dev *pdev,
         int ret = -ENODEV, status;
         struct Scsi_Host *host;
         struct scsi_qla_host *ha;
-        struct ddb_entry *ddb_entry, *ddbtemp;
         uint8_t init_retry_count = 0;
         char buf[34];
 
@@ -1295,13 +1310,6 @@ static int __devinit qla4xxx_probe_adapter(struct pci_dev *pdev,
         if (ret)
                 goto probe_failed;
 
-        /* Update transport device information for all devices. */
-        list_for_each_entry_safe(ddb_entry, ddbtemp, &ha->ddb_list, list) {
-                if (ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE)
-                        if (qla4xxx_add_sess(ddb_entry))
-                                goto remove_host;
-        }
-
         printk(KERN_INFO
                " QLogic iSCSI HBA Driver version: %s\n"
                "  QLogic ISP%04x @ %s, host#=%ld, fw=%02d.%02d.%02d.%02d\n",
@@ -1311,10 +1319,6 @@ static int __devinit qla4xxx_probe_adapter(struct pci_dev *pdev,
         scsi_scan_host(host);
         return 0;
 
-remove_host:
-        qla4xxx_free_ddb_list(ha);
-        scsi_remove_host(host);
-
 probe_failed:
         qla4xxx_free_adapter(ha);
         scsi_host_put(ha->host);
@@ -1600,9 +1604,12 @@ static int qla4xxx_eh_host_reset(struct scsi_cmnd *cmd)
                 return FAILED;
         }
 
-        if (qla4xxx_recover_adapter(ha, PRESERVE_DDB_LIST) == QLA_SUCCESS) {
+        /* make sure the dpc thread is stopped while we reset the hba */
+        clear_bit(AF_ONLINE, &ha->flags);
+        flush_workqueue(ha->dpc_thread);
+
+        if (qla4xxx_recover_adapter(ha, PRESERVE_DDB_LIST) == QLA_SUCCESS)
                 return_status = SUCCESS;
-        }
 
         dev_info(&ha->pdev->dev, "HOST RESET %s.\n",
                    return_status == FAILED ? "FAILED" : "SUCCEDED");
diff --git a/drivers/scsi/qlogicpti.c b/drivers/scsi/qlogicpti.c
index 65455ab1f3b9..4a1cf6377f6c 100644
--- a/drivers/scsi/qlogicpti.c
+++ b/drivers/scsi/qlogicpti.c
@@ -651,7 +651,7 @@ static int qlogicpti_verify_tmon(struct qlogicpti *qpti)
 
 static irqreturn_t qpti_intr(int irq, void *dev_id);
 
-static void __init qpti_chain_add(struct qlogicpti *qpti)
+static void __devinit qpti_chain_add(struct qlogicpti *qpti)
 {
         spin_lock_irq(&qptichain_lock);
         if (qptichain != NULL) {
@@ -667,7 +667,7 @@ static void __init qpti_chain_add(struct qlogicpti *qpti)
         spin_unlock_irq(&qptichain_lock);
 }
 
-static void __init qpti_chain_del(struct qlogicpti *qpti)
+static void __devexit qpti_chain_del(struct qlogicpti *qpti)
 {
         spin_lock_irq(&qptichain_lock);
         if (qptichain == qpti) {
@@ -682,7 +682,7 @@ static void __init qpti_chain_del(struct qlogicpti *qpti)
         spin_unlock_irq(&qptichain_lock);
 }
 
-static int __init qpti_map_regs(struct qlogicpti *qpti)
+static int __devinit qpti_map_regs(struct qlogicpti *qpti)
 {
         struct sbus_dev *sdev = qpti->sdev;
 
@@ -705,7 +705,7 @@ static int __init qpti_map_regs(struct qlogicpti *qpti)
         return 0;
 }
 
-static int __init qpti_register_irq(struct qlogicpti *qpti)
+static int __devinit qpti_register_irq(struct qlogicpti *qpti)
 {
         struct sbus_dev *sdev = qpti->sdev;
 
@@ -730,7 +730,7 @@ fail:
         return -1;
 }
 
-static void __init qpti_get_scsi_id(struct qlogicpti *qpti)
+static void __devinit qpti_get_scsi_id(struct qlogicpti *qpti)
 {
         qpti->scsi_id = prom_getintdefault(qpti->prom_node,
                                            "initiator-id",
@@ -783,7 +783,7 @@ static void qpti_get_clock(struct qlogicpti *qpti)
 /* The request and response queues must each be aligned
  * on a page boundary.
  */
-static int __init qpti_map_queues(struct qlogicpti *qpti)
+static int __devinit qpti_map_queues(struct qlogicpti *qpti)
 {
         struct sbus_dev *sdev = qpti->sdev;
 
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index fecba05b4e77..e5c6f6af8765 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -757,7 +757,7 @@ void scsi_finish_command(struct scsi_cmnd *cmd)
                                 "Notifying upper driver of completion "
                                 "(result %x)\n", cmd->result));
 
-        good_bytes = scsi_bufflen(cmd);
+        good_bytes = scsi_bufflen(cmd) + cmd->request->extra_len;
         if (cmd->request->cmd_type != REQ_TYPE_BLOCK_PC) {
                 drv = scsi_cmd_to_driver(cmd);
                 if (drv->done)
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 1541c174937a..d1777a9a9625 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -222,7 +222,7 @@ static struct scsi_host_template sdebug_driver_template = {
         .cmd_per_lun =          16,
         .max_sectors =          0xffff,
         .unchecked_isa_dma =    0,
-        .use_clustering =       ENABLE_CLUSTERING,
+        .use_clustering =       DISABLE_CLUSTERING,
         .module =               THIS_MODULE,
 };
 
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 1dc165ad17fb..e67c14e31bab 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1577,8 +1577,7 @@ static void __scsi_scan_target(struct device *parent, unsigned int channel,
 }
 
 /**
- * scsi_scan_target - scan a target id, possibly including all LUNs on the
- *     target.
+ * scsi_scan_target - scan a target id, possibly including all LUNs on the target.
  * @parent:     host to scan
  * @channel:    channel to scan
  * @id:         target id to scan
diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
index 3677fbb30b72..a0f308bd145b 100644
--- a/drivers/scsi/scsi_tgt_lib.c
+++ b/drivers/scsi/scsi_tgt_lib.c
@@ -103,7 +103,6 @@ struct scsi_cmnd *scsi_host_get_command(struct Scsi_Host *shost,
         if (!cmd)
                 goto release_rq;
 
-        memset(cmd, 0, sizeof(*cmd));
         cmd->sc_data_direction = data_dir;
         cmd->jiffies_at_alloc = jiffies;
         cmd->request = rq;
@@ -382,6 +381,11 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
                 scsi_release_buffers(cmd);
                 goto unmap_rq;
         }
+        /*
+         * we use REQ_TYPE_BLOCK_PC so scsi_init_io doesn't set the
+         * length for us.
+         */
+        cmd->sdb.length = rq->data_len;
 
         return 0;
 
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index fac7534f3ec4..ca7bb6f63bde 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -33,7 +33,7 @@
 #define ISCSI_SESSION_ATTRS 19
 #define ISCSI_CONN_ATTRS 13
 #define ISCSI_HOST_ATTRS 4
-#define ISCSI_TRANSPORT_VERSION "2.0-868"
+#define ISCSI_TRANSPORT_VERSION "2.0-869"
 
 struct iscsi_internal {
         int daemon_pid;
@@ -231,7 +231,7 @@ static struct {
         { ISCSI_SESSION_FREE,           "FREE" },
 };
 
-const char *iscsi_session_state_name(int state)
+static const char *iscsi_session_state_name(int state)
 {
         int i;
         char *name = NULL;
@@ -373,24 +373,25 @@ static void session_recovery_timedout(struct work_struct *work)
         scsi_target_unblock(&session->dev);
 }
 
-void __iscsi_unblock_session(struct iscsi_cls_session *session)
-{
-        if (!cancel_delayed_work(&session->recovery_work))
-                flush_workqueue(iscsi_eh_timer_workq);
-        scsi_target_unblock(&session->dev);
-}
-
-void iscsi_unblock_session(struct iscsi_cls_session *session)
+static void __iscsi_unblock_session(struct work_struct *work)
 {
+        struct iscsi_cls_session *session =
+                        container_of(work, struct iscsi_cls_session,
+                                     unblock_work);
         struct Scsi_Host *shost = iscsi_session_to_shost(session);
         struct iscsi_host *ihost = shost->shost_data;
         unsigned long flags;
 
+        /*
+         * The recovery and unblock work get run from the same workqueue,
+         * so try to cancel it if it was going to run after this unblock.
+         */
+        cancel_delayed_work(&session->recovery_work);
         spin_lock_irqsave(&session->lock, flags);
         session->state = ISCSI_SESSION_LOGGED_IN;
         spin_unlock_irqrestore(&session->lock, flags);
-
-        __iscsi_unblock_session(session);
+        /* start IO */
+        scsi_target_unblock(&session->dev);
         /*
          * Only do kernel scanning if the driver is properly hooked into
          * the async scanning code (drivers like iscsi_tcp do login and
@@ -401,20 +402,43 @@ void iscsi_unblock_session(struct iscsi_cls_session *session)
                         atomic_inc(&ihost->nr_scans);
         }
 }
+
+/**
+ * iscsi_unblock_session - set a session as logged in and start IO.
+ * @session: iscsi session
+ *
+ * Mark a session as ready to accept IO.
+ */
+void iscsi_unblock_session(struct iscsi_cls_session *session)
+{
+        queue_work(iscsi_eh_timer_workq, &session->unblock_work);
+        /*
+         * make sure all the events have completed before tell the driver
+         * it is safe
+         */
+        flush_workqueue(iscsi_eh_timer_workq);
+}
 EXPORT_SYMBOL_GPL(iscsi_unblock_session);
 
-void iscsi_block_session(struct iscsi_cls_session *session)
+static void __iscsi_block_session(struct work_struct *work)
 {
+        struct iscsi_cls_session *session =
+                        container_of(work, struct iscsi_cls_session,
+                                     block_work);
         unsigned long flags;
 
         spin_lock_irqsave(&session->lock, flags);
         session->state = ISCSI_SESSION_FAILED;
         spin_unlock_irqrestore(&session->lock, flags);
-
         scsi_target_block(&session->dev);
         queue_delayed_work(iscsi_eh_timer_workq, &session->recovery_work,
                            session->recovery_tmo * HZ);
 }
+
+void iscsi_block_session(struct iscsi_cls_session *session)
+{
+        queue_work(iscsi_eh_timer_workq, &session->block_work);
+}
 EXPORT_SYMBOL_GPL(iscsi_block_session);
 
 static void __iscsi_unbind_session(struct work_struct *work)
@@ -463,6 +487,8 @@ iscsi_alloc_session(struct Scsi_Host *shost,
         INIT_DELAYED_WORK(&session->recovery_work, session_recovery_timedout);
         INIT_LIST_HEAD(&session->host_list);
         INIT_LIST_HEAD(&session->sess_list);
+        INIT_WORK(&session->unblock_work, __iscsi_unblock_session);
+        INIT_WORK(&session->block_work, __iscsi_block_session);
         INIT_WORK(&session->unbind_work, __iscsi_unbind_session);
         INIT_WORK(&session->scan_work, iscsi_scan_session);
         spin_lock_init(&session->lock);
@@ -575,24 +601,25 @@ void iscsi_remove_session(struct iscsi_cls_session *session)
         list_del(&session->sess_list);
         spin_unlock_irqrestore(&sesslock, flags);
 
+        /* make sure there are no blocks/unblocks queued */
+        flush_workqueue(iscsi_eh_timer_workq);
+        /* make sure the timedout callout is not running */
+        if (!cancel_delayed_work(&session->recovery_work))
+                flush_workqueue(iscsi_eh_timer_workq);
         /*
          * If we are blocked let commands flow again. The lld or iscsi
          * layer should set up the queuecommand to fail commands.
+         * We assume that LLD will not be calling block/unblock while
+         * removing the session.
          */
         spin_lock_irqsave(&session->lock, flags);
         session->state = ISCSI_SESSION_FREE;
         spin_unlock_irqrestore(&session->lock, flags);
-        __iscsi_unblock_session(session);
-        __iscsi_unbind_session(&session->unbind_work);
 
-        /* flush running scans */
+        scsi_target_unblock(&session->dev);
+        /* flush running scans then delete devices */
         flush_workqueue(ihost->scan_workq);
-        /*
-         * If the session dropped while removing devices then we need to make
-         * sure it is not blocked
-         */
-        if (!cancel_delayed_work(&session->recovery_work))
-                flush_workqueue(iscsi_eh_timer_workq);
+        __iscsi_unbind_session(&session->unbind_work);
 
         /* hw iscsi may not have removed all connections from session */
         err = device_for_each_child(&session->dev, NULL,
@@ -802,23 +829,16 @@ EXPORT_SYMBOL_GPL(iscsi_recv_pdu);
 
 void iscsi_conn_error(struct iscsi_cls_conn *conn, enum iscsi_err error)
 {
-        struct iscsi_cls_session *session = iscsi_conn_to_session(conn);
         struct nlmsghdr *nlh;
         struct sk_buff  *skb;
         struct iscsi_uevent *ev;
         struct iscsi_internal *priv;
         int len = NLMSG_SPACE(sizeof(*ev));
-        unsigned long flags;
 
         priv = iscsi_if_transport_lookup(conn->transport);
         if (!priv)
                 return;
 
-        spin_lock_irqsave(&session->lock, flags);
-        if (session->state == ISCSI_SESSION_LOGGED_IN)
-                session->state = ISCSI_SESSION_FAILED;
-        spin_unlock_irqrestore(&session->lock, flags);
-
         skb = alloc_skb(len, GFP_ATOMIC);
         if (!skb) {
                 iscsi_cls_conn_printk(KERN_ERR, conn, "gracefully ignored "
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 37df8bbe7f46..7aee64dbfbeb 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1835,8 +1835,7 @@ static int sd_suspend(struct device *dev, pm_message_t mesg)
                         goto done;
         }
 
-        if (mesg.event == PM_EVENT_SUSPEND &&
-            sdkp->device->manage_start_stop) {
+        if ((mesg.event & PM_EVENT_SLEEP) && sdkp->device->manage_start_stop) {
                 sd_printk(KERN_NOTICE, sdkp, "Stopping disk\n");
                 ret = sd_start_stop_device(sdkp, 0);
         }
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index a57fed47b39d..a6d96694d0a5 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -33,9 +33,9 @@
 #include <scsi/scsi_host.h>
 
 struct ses_device {
-        char *page1;
-        char *page2;
-        char *page10;
+        unsigned char *page1;
+        unsigned char *page2;
+        unsigned char *page10;
         short page1_len;
         short page2_len;
         short page10_len;
@@ -67,7 +67,7 @@ static int ses_probe(struct device *dev)
 static int ses_recv_diag(struct scsi_device *sdev, int page_code,
                          void *buf, int bufflen)
 {
-        char cmd[] = {
+        unsigned char cmd[] = {
                 RECEIVE_DIAGNOSTIC,
                 1,              /* Set PCV bit */
                 page_code,
@@ -85,7 +85,7 @@ static int ses_send_diag(struct scsi_device *sdev, int page_code,
 {
         u32 result;
 
-        char cmd[] = {
+        unsigned char cmd[] = {
                 SEND_DIAGNOSTIC,
                 0x10,           /* Set PF bit */
                 0,
@@ -104,13 +104,13 @@ static int ses_send_diag(struct scsi_device *sdev, int page_code,
 
 static int ses_set_page2_descriptor(struct enclosure_device *edev,
                                       struct enclosure_component *ecomp,
-                                      char *desc)
+                                      unsigned char *desc)
 {
         int i, j, count = 0, descriptor = ecomp->number;
         struct scsi_device *sdev = to_scsi_device(edev->cdev.dev);
         struct ses_device *ses_dev = edev->scratch;
-        char *type_ptr = ses_dev->page1 + 12 + ses_dev->page1[11];
-        char *desc_ptr = ses_dev->page2 + 8;
+        unsigned char *type_ptr = ses_dev->page1 + 12 + ses_dev->page1[11];
+        unsigned char *desc_ptr = ses_dev->page2 + 8;
 
         /* Clear everything */
         memset(desc_ptr, 0, ses_dev->page2_len - 8);
@@ -133,14 +133,14 @@ static int ses_set_page2_descriptor(struct enclosure_device *edev,
         return ses_send_diag(sdev, 2, ses_dev->page2, ses_dev->page2_len);
 }
 
-static char *ses_get_page2_descriptor(struct enclosure_device *edev,
+static unsigned char *ses_get_page2_descriptor(struct enclosure_device *edev,
                                       struct enclosure_component *ecomp)
 {
         int i, j, count = 0, descriptor = ecomp->number;
         struct scsi_device *sdev = to_scsi_device(edev->cdev.dev);
         struct ses_device *ses_dev = edev->scratch;
-        char *type_ptr = ses_dev->page1 + 12 + ses_dev->page1[11];
-        char *desc_ptr = ses_dev->page2 + 8;
+        unsigned char *type_ptr = ses_dev->page1 + 12 + ses_dev->page1[11];
+        unsigned char *desc_ptr = ses_dev->page2 + 8;
 
         ses_recv_diag(sdev, 2, ses_dev->page2, ses_dev->page2_len);
 
@@ -160,17 +160,18 @@ static char *ses_get_page2_descriptor(struct enclosure_device *edev,
 static void ses_get_fault(struct enclosure_device *edev,
                           struct enclosure_component *ecomp)
 {
-        char *desc;
+        unsigned char *desc;
 
         desc = ses_get_page2_descriptor(edev, ecomp);
-        ecomp->fault = (desc[3] & 0x60) >> 4;
+        if (desc)
+                ecomp->fault = (desc[3] & 0x60) >> 4;
 }
 
 static int ses_set_fault(struct enclosure_device *edev,
                           struct enclosure_component *ecomp,
                          enum enclosure_component_setting val)
 {
-        char desc[4] = {0 };
+        unsigned char desc[4] = {0 };
 
         switch (val) {
         case ENCLOSURE_SETTING_DISABLED:
@@ -190,26 +191,28 @@ static int ses_set_fault(struct enclosure_device *edev,
 static void ses_get_status(struct enclosure_device *edev,
                            struct enclosure_component *ecomp)
 {
-        char *desc;
+        unsigned char *desc;
 
         desc = ses_get_page2_descriptor(edev, ecomp);
-        ecomp->status = (desc[0] & 0x0f);
+        if (desc)
+                ecomp->status = (desc[0] & 0x0f);
 }
 
 static void ses_get_locate(struct enclosure_device *edev,
                            struct enclosure_component *ecomp)
 {
-        char *desc;
+        unsigned char *desc;
 
         desc = ses_get_page2_descriptor(edev, ecomp);
-        ecomp->locate = (desc[2] & 0x02) ? 1 : 0;
+        if (desc)
+                ecomp->locate = (desc[2] & 0x02) ? 1 : 0;
 }
 
 static int ses_set_locate(struct enclosure_device *edev,
                           struct enclosure_component *ecomp,
                           enum enclosure_component_setting val)
 {
-        char desc[4] = {0 };
+        unsigned char desc[4] = {0 };
 
         switch (val) {
         case ENCLOSURE_SETTING_DISABLED:
@@ -229,7 +232,7 @@ static int ses_set_active(struct enclosure_device *edev,
                           struct enclosure_component *ecomp,
                           enum enclosure_component_setting val)
 {
-        char desc[4] = {0 };
+        unsigned char desc[4] = {0 };
 
         switch (val) {
         case ENCLOSURE_SETTING_DISABLED:
@@ -409,11 +412,11 @@ static int ses_intf_add(struct class_device *cdev,
 {
         struct scsi_device *sdev = to_scsi_device(cdev->dev);
         struct scsi_device *tmp_sdev;
-        unsigned char *buf = NULL, *hdr_buf, *type_ptr, *desc_ptr,
-                *addl_desc_ptr;
+        unsigned char *buf = NULL, *hdr_buf, *type_ptr, *desc_ptr = NULL,
+                *addl_desc_ptr = NULL;
         struct ses_device *ses_dev;
         u32 result;
-        int i, j, types, len, components = 0;
+        int i, j, types, len, page7_len = 0, components = 0;
         int err = -ENOMEM;
         struct enclosure_device *edev;
         struct ses_component *scomp = NULL;
@@ -447,7 +450,7 @@ static int ses_intf_add(struct class_device *cdev,
                  * traversal routines more complex */
                 sdev_printk(KERN_ERR, sdev,
                         "FIXME driver has no support for subenclosures (%d)\n",
-                        buf[1]);
+                        hdr_buf[1]);
                 goto err_free;
         }
 
@@ -461,9 +464,8 @@ static int ses_intf_add(struct class_device *cdev,
                 goto recv_failed;
 
         types = buf[10];
-        len = buf[11];
 
-        type_ptr = buf + 12 + len;
+        type_ptr = buf + 12 + buf[11];
 
         for (i = 0; i < types; i++, type_ptr += 4) {
                 if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||
@@ -494,22 +496,21 @@ static int ses_intf_add(struct class_device *cdev,
         /* The additional information page --- allows us
          * to match up the devices */
         result = ses_recv_diag(sdev, 10, hdr_buf, INIT_ALLOC_SIZE);
-        if (result)
-                goto no_page10;
-
-        len = (hdr_buf[2] << 8) + hdr_buf[3] + 4;
-        buf = kzalloc(len, GFP_KERNEL);
-        if (!buf)
-                goto err_free;
-
-        result = ses_recv_diag(sdev, 10, buf, len);
-        if (result)
-                goto recv_failed;
-        ses_dev->page10 = buf;
-        ses_dev->page10_len = len;
-        buf = NULL;
+        if (!result) {
+
+                len = (hdr_buf[2] << 8) + hdr_buf[3] + 4;
+                buf = kzalloc(len, GFP_KERNEL);
+                if (!buf)
+                        goto err_free;
+
+                result = ses_recv_diag(sdev, 10, buf, len);
+                if (result)
+                        goto recv_failed;
+                ses_dev->page10 = buf;
+                ses_dev->page10_len = len;
+                buf = NULL;
+        }
 
- no_page10:
         scomp = kzalloc(sizeof(struct ses_component) * components, GFP_KERNEL);
         if (!scomp)
                 goto err_free;
@@ -530,7 +531,7 @@ static int ses_intf_add(struct class_device *cdev,
         if (result)
                 goto simple_populate;
 
-        len = (hdr_buf[2] << 8) + hdr_buf[3] + 4;
+        page7_len = len = (hdr_buf[2] << 8) + hdr_buf[3] + 4;
         /* add 1 for trailing '\0' we'll use */
         buf = kzalloc(len + 1, GFP_KERNEL);
         if (!buf)
@@ -547,7 +548,8 @@ static int ses_intf_add(struct class_device *cdev,
                 len = (desc_ptr[2] << 8) + desc_ptr[3];
                 /* skip past overall descriptor */
                 desc_ptr += len + 4;
-                addl_desc_ptr = ses_dev->page10 + 8;
+                if (ses_dev->page10)
+                        addl_desc_ptr = ses_dev->page10 + 8;
         }
         type_ptr = ses_dev->page1 + 12 + ses_dev->page1[11];
         components = 0;
@@ -557,29 +559,35 @@ static int ses_intf_add(struct class_device *cdev,
                         struct enclosure_component *ecomp;
 
                         if (desc_ptr) {
-                                len = (desc_ptr[2] << 8) + desc_ptr[3];
-                                desc_ptr += 4;
-                                /* Add trailing zero - pushes into
-                                 * reserved space */
-                                desc_ptr[len] = '\0';
-                                name = desc_ptr;
+                                if (desc_ptr >= buf + page7_len) {
+                                        desc_ptr = NULL;
+                                } else {
+                                        len = (desc_ptr[2] << 8) + desc_ptr[3];
+                                        desc_ptr += 4;
+                                        /* Add trailing zero - pushes into
+                                         * reserved space */
+                                        desc_ptr[len] = '\0';
+                                        name = desc_ptr;
+                                }
                         }
-                        if (type_ptr[0] != ENCLOSURE_COMPONENT_DEVICE &&
-                            type_ptr[0] != ENCLOSURE_COMPONENT_ARRAY_DEVICE)
-                                continue;
-                        ecomp = enclosure_component_register(edev,
+                        if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||
+                            type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE) {
+
+                                ecomp = enclosure_component_register(edev,
                                                              components++,
                                                              type_ptr[0],
                                                              name);
-                        if (desc_ptr) {
-                                desc_ptr += len;
-                                if (!IS_ERR(ecomp))
+
+                                if (!IS_ERR(ecomp) && addl_desc_ptr)
                                         ses_process_descriptor(ecomp,
                                                                addl_desc_ptr);
-
-                                if (addl_desc_ptr)
-                                        addl_desc_ptr += addl_desc_ptr[1] + 2;
                         }
+                        if (desc_ptr)
+                                desc_ptr += len;
+
+                        if (addl_desc_ptr)
+                                addl_desc_ptr += addl_desc_ptr[1] + 2;
+
                 }
         }
         kfree(buf);
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 71952703125a..0a52d9d2da2c 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -17,7 +17,7 @@
    Last modified: 18-JAN-1998 Richard Gooch <rgooch@atnf.csiro.au> Devfs support
  */
 
-static const char *verstr = "20080117";
+static const char *verstr = "20080221";
 
 #include <linux/module.h>
 
@@ -1172,7 +1172,7 @@ static int st_open(struct inode *inode, struct file *filp)
         STp->try_dio_now = STp->try_dio;
         STp->recover_count = 0;
         DEB( STp->nbr_waits = STp->nbr_finished = 0;
-             STp->nbr_requests = STp->nbr_dio = STp->nbr_pages = STp->nbr_combinable = 0; )
+             STp->nbr_requests = STp->nbr_dio = STp->nbr_pages = 0; )
 
         retval = check_tape(STp, filp);
         if (retval < 0)
@@ -1226,8 +1226,8 @@ static int st_flush(struct file *filp, fl_owner_t id)
         }
 
         DEBC( if (STp->nbr_requests)
-                printk(KERN_DEBUG "%s: Number of r/w requests %d, dio used in %d, pages %d (%d).\n",
-                       name, STp->nbr_requests, STp->nbr_dio, STp->nbr_pages, STp->nbr_combinable));
+                printk(KERN_DEBUG "%s: Number of r/w requests %d, dio used in %d, pages %d.\n",
+                       name, STp->nbr_requests, STp->nbr_dio, STp->nbr_pages));
 
         if (STps->rw == ST_WRITING && !STp->pos_unknown) {
                 struct st_cmdstatus *cmdstatp = &STp->buffer->cmdstat;
@@ -1422,9 +1422,6 @@ static int setup_buffering(struct scsi_tape *STp, const char __user *buf,
                      if (STbp->do_dio) {
                         STp->nbr_dio++;
                         STp->nbr_pages += STbp->do_dio;
-                        for (i=1; i < STbp->do_dio; i++)
-                                if (page_to_pfn(STbp->sg[i].page) == page_to_pfn(STbp->sg[i-1].page) + 1)
-                                        STp->nbr_combinable++;
                      }
                 )
         } else
diff --git a/drivers/scsi/st.h b/drivers/scsi/st.h
index 6c8075712974..5931726fcf93 100644
--- a/drivers/scsi/st.h
+++ b/drivers/scsi/st.h
@@ -164,7 +164,6 @@ struct scsi_tape {
         int nbr_requests;
         int nbr_dio;
         int nbr_pages;
-        int nbr_combinable;
         unsigned char last_cmnd[6];
         unsigned char last_sense[16];
 #endif
diff --git a/drivers/scsi/stex.c b/drivers/scsi/stex.c
index 72f6d8015358..654430edf74d 100644
--- a/drivers/scsi/stex.c
+++ b/drivers/scsi/stex.c
@@ -461,30 +461,14 @@ static void stex_internal_copy(struct scsi_cmnd *cmd,
         }
 }
 
-static int stex_direct_copy(struct scsi_cmnd *cmd,
-        const void *src, size_t count)
-{
-        size_t cp_len = count;
-        int n_elem = 0;
-
-        n_elem = scsi_dma_map(cmd);
-        if (n_elem < 0)
-                return 0;
-
-        stex_internal_copy(cmd, src, &cp_len, n_elem, ST_TO_CMD);
-
-        scsi_dma_unmap(cmd);
-
-        return cp_len == count;
-}
-
 static void stex_controller_info(struct st_hba *hba, struct st_ccb *ccb)
 {
         struct st_frame *p;
         size_t count = sizeof(struct st_frame);
 
         p = hba->copy_buffer;
-        stex_internal_copy(ccb->cmd, p, &count, ccb->sg_count, ST_FROM_CMD);
+        stex_internal_copy(ccb->cmd, p, &count, scsi_sg_count(ccb->cmd),
+                           ST_FROM_CMD);
         memset(p->base, 0, sizeof(u32)*6);
         *(unsigned long *)(p->base) = pci_resource_start(hba->pdev, 0);
         p->rom_addr = 0;
@@ -502,7 +486,8 @@ static void stex_controller_info(struct st_hba *hba, struct st_ccb *ccb)
         p->subid =
                 hba->pdev->subsystem_vendor << 16 | hba->pdev->subsystem_device;
 
-        stex_internal_copy(ccb->cmd, p, &count, ccb->sg_count, ST_TO_CMD);
+        stex_internal_copy(ccb->cmd, p, &count, scsi_sg_count(ccb->cmd),
+                           ST_TO_CMD);
 }
 
 static void
@@ -569,8 +554,10 @@ stex_queuecommand(struct scsi_cmnd *cmd, void (* done)(struct scsi_cmnd *))
                 unsigned char page;
                 page = cmd->cmnd[2] & 0x3f;
                 if (page == 0x8 || page == 0x3f) {
-                        stex_direct_copy(cmd, ms10_caching_page,
-                                        sizeof(ms10_caching_page));
+                        size_t cp_len = sizeof(ms10_caching_page);
+                        stex_internal_copy(cmd, ms10_caching_page,
+                                           &cp_len, scsi_sg_count(cmd),
+                                           ST_TO_CMD);
                         cmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8;
                         done(cmd);
                 } else
@@ -599,8 +586,10 @@ stex_queuecommand(struct scsi_cmnd *cmd, void (* done)(struct scsi_cmnd *))
                 if (id != host->max_id - 1)
                         break;
                 if (lun == 0 && (cmd->cmnd[1] & INQUIRY_EVPD) == 0) {
-                        stex_direct_copy(cmd, console_inq_page,
-                                sizeof(console_inq_page));
+                        size_t cp_len = sizeof(console_inq_page);
+                        stex_internal_copy(cmd, console_inq_page,
+                                           &cp_len, scsi_sg_count(cmd),
+                                           ST_TO_CMD);
                         cmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8;
                         done(cmd);
                 } else
@@ -609,6 +598,7 @@ stex_queuecommand(struct scsi_cmnd *cmd, void (* done)(struct scsi_cmnd *))
         case PASSTHRU_CMD:
                 if (cmd->cmnd[1] == PASSTHRU_GET_DRVVER) {
                         struct st_drvver ver;
+                        size_t cp_len = sizeof(ver);
                         ver.major = ST_VER_MAJOR;
                         ver.minor = ST_VER_MINOR;
                         ver.oem = ST_OEM;
@@ -616,7 +606,9 @@ stex_queuecommand(struct scsi_cmnd *cmd, void (* done)(struct scsi_cmnd *))
                         ver.signature[0] = PASSTHRU_SIGNATURE;
                         ver.console_id = host->max_id - 1;
                         ver.host_no = hba->host->host_no;
-                        cmd->result = stex_direct_copy(cmd, &ver, sizeof(ver)) ?
+                        stex_internal_copy(cmd, &ver, &cp_len,
+                                           scsi_sg_count(cmd), ST_TO_CMD);
+                        cmd->result = sizeof(ver) == cp_len ?
                                 DID_OK << 16 | COMMAND_COMPLETE << 8 :
                                 DID_ERROR << 16 | COMMAND_COMPLETE << 8;
                         done(cmd);
@@ -709,7 +701,7 @@ static void stex_copy_data(struct st_ccb *ccb,
         if (ccb->cmd == NULL)
                 return;
         stex_internal_copy(ccb->cmd,
-                resp->variable, &count, ccb->sg_count, ST_TO_CMD);
+                resp->variable, &count, scsi_sg_count(ccb->cmd), ST_TO_CMD);
 }
 
 static void stex_ys_commands(struct st_hba *hba,
@@ -734,7 +726,7 @@ static void stex_ys_commands(struct st_hba *hba,
 
                 count = STEX_EXTRA_SIZE;
                 stex_internal_copy(ccb->cmd, hba->copy_buffer,
-                        &count, ccb->sg_count, ST_FROM_CMD);
+                        &count, scsi_sg_count(ccb->cmd), ST_FROM_CMD);
                 inq_data = (ST_INQ *)hba->copy_buffer;
                 if (inq_data->DeviceTypeQualifier != 0)
                         ccb->srb_status = SRB_STATUS_SELECTION_TIMEOUT;