69 files changed, 1965 insertions, 1366 deletions
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index c7f06298bd3c..d3b211af4e1c 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -63,7 +63,7 @@ comment "SCSI support type (disk, tape, CD-ROM)"
 config BLK_DEV_SD
        tristate "SCSI disk support"
        depends on SCSI
-        select CRC_T10DIF
+        select CRC_T10DIF if BLK_DEV_INTEGRITY
        ---help---
          If you want to use SCSI hard disks, Fibre Channel disks,
          Serial ATA (SATA) or Parallel ATA (PATA) hard disks,
@@ -1325,14 +1325,6 @@ config SCSI_QLOGIC_FAS
          To compile this driver as a module, choose M here: the
          module will be called qlogicfas.
-config SCSI_QLOGIC_FC_FIRMWARE
-        bool "Include loadable firmware in driver"
-        depends on SCSI_QLOGIC_FC
-        help
-          Say Y to include ISP2X00 Fabric Initiator/Target Firmware, with
-          expanded LUN addressing and FcTape (FCP-2) support, in the
-          qlogicfc driver. This is required on some platforms.
 config SCSI_QLOGIC_1280
        tristate "Qlogic QLA 1240/1x80/1x160 SCSI support"
        depends on PCI && SCSI
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index aa4e77c25273..8abfd06b5a72 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -1139,7 +1139,7 @@ static struct aac_srb * aac_scsi_common(struct fib * fib, struct scsi_cmnd * cmd
        srbcmd->id       = cpu_to_le32(scmd_id(cmd));
        srbcmd->lun      = cpu_to_le32(cmd->device->lun);
        srbcmd->flags    = cpu_to_le32(flag);
-        timeout = cmd->timeout_per_command/HZ;
+        timeout = cmd->request->timeout/HZ;
        if (timeout == 0)
                timeout = 1;
        srbcmd->timeout  = cpu_to_le32(timeout);  // timeout in seconds
diff --git a/drivers/scsi/arm/acornscsi-io.S b/drivers/scsi/arm/acornscsi-io.S
index 5cebe3105260..22171b2110a8 100644
--- a/drivers/scsi/arm/acornscsi-io.S
+++ b/drivers/scsi/arm/acornscsi-io.S
@@ -8,7 +8,7 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
-#include <asm/hardware.h>
+#include <mach/hardware.h>
 #if defined(__APCS_32__)
 #define LOADREGS(t,r,l...)      ldm##t  r, l
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index fcdd73f25625..708e475896b9 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -425,7 +425,7 @@ static int alua_check_sense(struct scsi_device *sdev,
                        /*
                         * LUN Not Accessible - ALUA state transition
                         */
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                if (sense_hdr->asc == 0x04 && sense_hdr->ascq == 0x0b)
                        /*
                         * LUN Not Accessible -- Target port in standby state
@@ -447,18 +447,18 @@ static int alua_check_sense(struct scsi_device *sdev,
                        /*
                         * Power On, Reset, or Bus Device Reset, just retry.
                         */
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                if (sense_hdr->asc == 0x2a && sense_hdr->ascq == 0x06) {
                        /*
                         * ALUA state changed
                         */
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                }
                if (sense_hdr->asc == 0x2a && sense_hdr->ascq == 0x07) {
                        /*
                         * Implicit ALUA state transition failed
                         */
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                }
                break;
        }
@@ -490,7 +490,7 @@ static int alua_stpg(struct scsi_device *sdev, int state,
                if (!err)
                        return SCSI_DH_IO;
                err = alua_check_sense(sdev, &sense_hdr);
-                if (retry > 0 && err == NEEDS_RETRY) {
+                if (retry > 0 && err == ADD_TO_MLQUEUE) {
                        retry--;
                        goto retry;
                }
@@ -535,7 +535,7 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_dh_data *h)
                        return SCSI_DH_IO;
                err = alua_check_sense(sdev, &sense_hdr);
-                if (err == NEEDS_RETRY)
+                if (err == ADD_TO_MLQUEUE)
                        goto retry;
                sdev_printk(KERN_INFO, sdev,
                            "%s: rtpg sense code %02x/%02x/%02x\n",
@@ -680,7 +680,7 @@ static int alua_prep_fn(struct scsi_device *sdev, struct request *req)
 }
-const struct scsi_dh_devlist alua_dev_list[] = {
+static const struct scsi_dh_devlist alua_dev_list[] = {
        {"HP", "MSA VOLUME" },
        {"HP", "HSV101" },
        {"HP", "HSV111" },
diff --git a/drivers/scsi/device_handler/scsi_dh_emc.c b/drivers/scsi/device_handler/scsi_dh_emc.c
index aa46b131b20e..8f45570a8a01 100644
--- a/drivers/scsi/device_handler/scsi_dh_emc.c
+++ b/drivers/scsi/device_handler/scsi_dh_emc.c
@@ -84,7 +84,7 @@ struct clariion_dh_data {
        /*
         * I/O buffer for both MODE_SELECT and INQUIRY commands.
         */
-        char buffer[CLARIION_BUFFER_SIZE];
+        unsigned char buffer[CLARIION_BUFFER_SIZE];
        /*
         * SCSI sense buffer for commands -- assumes serial issuance
         * and completion sequence of all commands for same multipath.
@@ -176,7 +176,7 @@ static int parse_sp_info_reply(struct scsi_device *sdev,
                err = SCSI_DH_DEV_TEMP_BUSY;
                goto out;
        }
-        if (csdev->buffer[4] < 0 || csdev->buffer[4] > 2) {
+        if (csdev->buffer[4] > 2) {
                /* Invalid buffer format */
                sdev_printk(KERN_NOTICE, sdev,
                            "%s: invalid VPD page 0xC0 format\n",
@@ -278,7 +278,6 @@ static struct request *get_req(struct scsi_device *sdev, int cmd,
                return NULL;
        }
-        memset(rq->cmd, 0, BLK_MAX_CDB);
        rq->cmd_len = COMMAND_SIZE(cmd);
        rq->cmd[0] = cmd;
@@ -439,7 +438,7 @@ static int clariion_check_sense(struct scsi_device *sdev,
                         * Unit Attention Code. This is the first IO
                         * to the new path, so just retry.
                         */
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                break;
        }
@@ -514,7 +513,7 @@ retry:
                        return SCSI_DH_IO;
                err = clariion_check_sense(sdev, &sshdr);
-                if (retry > 0 && err == NEEDS_RETRY) {
+                if (retry > 0 && err == ADD_TO_MLQUEUE) {
                        retry--;
                        goto retry;
                }
@@ -562,7 +561,7 @@ done:
        return result;
 }
-const struct scsi_dh_devlist clariion_dev_list[] = {
+static const struct scsi_dh_devlist clariion_dev_list[] = {
        {"DGC", "RAID"},
        {"DGC", "DISK"},
        {"DGC", "VRAID"},
diff --git a/drivers/scsi/device_handler/scsi_dh_hp_sw.c b/drivers/scsi/device_handler/scsi_dh_hp_sw.c
index 9c7a1f8ebb72..5e93c88ad66b 100644
--- a/drivers/scsi/device_handler/scsi_dh_hp_sw.c
+++ b/drivers/scsi/device_handler/scsi_dh_hp_sw.c
@@ -114,7 +114,6 @@ static int hp_sw_tur(struct scsi_device *sdev, struct hp_sw_dh_data *h)
        req->cmd_type = REQ_TYPE_BLOCK_PC;
        req->cmd_flags |= REQ_FAILFAST;
        req->cmd_len = COMMAND_SIZE(TEST_UNIT_READY);
-        memset(req->cmd, 0, MAX_COMMAND_SIZE);
        req->cmd[0] = TEST_UNIT_READY;
        req->timeout = HP_SW_TIMEOUT;
        req->sense = h->sense;
@@ -207,7 +206,6 @@ static int hp_sw_start_stop(struct scsi_device *sdev, struct hp_sw_dh_data *h)
        req->cmd_type = REQ_TYPE_BLOCK_PC;
        req->cmd_flags |= REQ_FAILFAST;
        req->cmd_len = COMMAND_SIZE(START_STOP);
-        memset(req->cmd, 0, MAX_COMMAND_SIZE);
        req->cmd[0] = START_STOP;
        req->cmd[4] = 1;        /* Start spin cycle */
        req->timeout = HP_SW_TIMEOUT;
@@ -282,7 +280,7 @@ static int hp_sw_activate(struct scsi_device *sdev)
        return ret;
 }
-const struct scsi_dh_devlist hp_sw_dh_data_list[] = {
+static const struct scsi_dh_devlist hp_sw_dh_data_list[] = {
        {"COMPAQ", "MSA1000 VOLUME"},
        {"COMPAQ", "HSV110"},
        {"HP", "HSV100"},
diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index b093a501f8ae..50bf95f3b5c4 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -225,8 +225,6 @@ static struct request *get_rdac_req(struct scsi_device *sdev,
                return NULL;
        }
-        memset(rq->cmd, 0, BLK_MAX_CDB);
        rq->cmd_type = REQ_TYPE_BLOCK_PC;
        rq->cmd_flags |= REQ_FAILFAST | REQ_NOMERGE;
        rq->retries = RDAC_RETRIES;
@@ -376,7 +374,7 @@ static int get_lun(struct scsi_device *sdev, struct rdac_dh_data *h)
                if (inqp->page_id[0] != 'e' || inqp->page_id[1] != 'd' ||
                    inqp->page_id[2] != 'i' || inqp->page_id[3] != 'd')
                        return SCSI_DH_NOSYS;
-                h->lun = scsilun_to_int((struct scsi_lun *)inqp->lun);
+                h->lun = inqp->lun[7]; /* Uses only the last byte */
        }
        return err;
 }
@@ -386,6 +384,7 @@ static int check_ownership(struct scsi_device *sdev, struct rdac_dh_data *h)
        int err;
        struct c9_inquiry *inqp;
+        h->lun_state = RDAC_LUN_UNOWNED;
        err = submit_inquiry(sdev, 0xC9, sizeof(struct c9_inquiry), h);
        if (err == SCSI_DH_OK) {
                inqp = &h->inq.c9;
@@ -550,7 +549,7 @@ static int rdac_check_sense(struct scsi_device *sdev,
                         *
                         * Just retry and wait.
                         */
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                break;
        case ILLEGAL_REQUEST:
                if (sense_hdr->asc == 0x94 && sense_hdr->ascq == 0x01) {
@@ -567,14 +566,14 @@ static int rdac_check_sense(struct scsi_device *sdev,
                        /*
                         * Power On, Reset, or Bus Device Reset, just retry.
                         */
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                break;
        }
        /* success just means we do not care what scsi-ml does */
        return SCSI_RETURN_NOT_HANDLED;
 }
-const struct scsi_dh_devlist rdac_dev_list[] = {
+static const struct scsi_dh_devlist rdac_dev_list[] = {
        {"IBM", "1722"},
        {"IBM", "1724"},
        {"IBM", "1726"},
@@ -589,6 +588,8 @@ const struct scsi_dh_devlist rdac_dev_list[] = {
        {"STK", "OPENstorage D280"},
        {"SUN", "CSM200_R"},
        {"SUN", "LCSM100_F"},
+        {"DELL", "MD3000"},
+        {"DELL", "MD3000i"},
        {NULL, NULL},
 };
diff --git a/drivers/scsi/dpt/dpti_i2o.h b/drivers/scsi/dpt/dpti_i2o.h
index 19406cea6d6a..179ad77f6cc9 100644
--- a/drivers/scsi/dpt/dpti_i2o.h
+++ b/drivers/scsi/dpt/dpti_i2o.h
@@ -21,7 +21,6 @@
 #include <linux/i2o-dev.h>
-#include <linux/version.h>
 #include <linux/notifier.h>
 #include <asm/atomic.h>
diff --git a/drivers/scsi/esp_scsi.h b/drivers/scsi/esp_scsi.h
index bb43a1388188..28e22acf87ea 100644
--- a/drivers/scsi/esp_scsi.h
+++ b/drivers/scsi/esp_scsi.h
@@ -521,7 +521,8 @@ struct esp {
        struct completion       *eh_reset;
-        struct sbus_dma         *dma;
+        void                    *dma;
+        int                     dmarev;
 };
 /* A front-end driver for the ESP chip should do the following in
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index 822d5214692b..c387c15a2128 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -464,7 +464,6 @@ int __gdth_execute(struct scsi_device *sdev, gdth_cmd_str *gdtcmd, char *cmnd,
    /* use request field to save the ptr. to completion struct. */
    scp->request = (struct request *)&wait;
-    scp->timeout_per_command = timeout*HZ;
    scp->cmd_len = 12;
    scp->cmnd = cmnd;
    cmndinfo.priority = IOCTL_PRI;
@@ -1995,23 +1994,12 @@ static void gdth_putq(gdth_ha_str *ha, Scsi_Cmnd *scp, unchar priority)
    register Scsi_Cmnd *pscp;
    register Scsi_Cmnd *nscp;
    ulong flags;
-    unchar b, t;
    TRACE(("gdth_putq() priority %d\n",priority));
    spin_lock_irqsave(&ha->smp_lock, flags);
-    if (!cmndinfo->internal_command) {
+    if (!cmndinfo->internal_command)
        cmndinfo->priority = priority;
-        b = scp->device->channel;
-        t = scp->device->id;
-        if (priority >= DEFAULT_PRI) {
-            if ((b != ha->virt_bus && ha->raw[BUS_L2P(ha,b)].lock) ||
-                (b==ha->virt_bus && t<MAX_HDRIVES && ha->hdr[t].lock)) {
-                TRACE2(("gdth_putq(): locked IO ->update_timeout()\n"));
-                cmndinfo->timeout = gdth_update_timeout(scp, 0);
-            }
-        }
-    }
    if (ha->req_first==NULL) {
        ha->req_first = scp;                    /* queue was empty */
@@ -3899,6 +3887,39 @@ static const char *gdth_info(struct Scsi_Host *shp)
    return ((const char *)ha->binfo.type_string);
 }
+static enum blk_eh_timer_return gdth_timed_out(struct scsi_cmnd *scp)
+{
+        gdth_ha_str *ha = shost_priv(scp->device->host);
+        struct gdth_cmndinfo *cmndinfo = gdth_cmnd_priv(scp);
+        unchar b, t;
+        ulong flags;
+        enum blk_eh_timer_return retval = BLK_EH_NOT_HANDLED;
+        TRACE(("%s() cmd 0x%x\n", scp->cmnd[0], __func__));
+        b = scp->device->channel;
+        t = scp->device->id;
+        /*
+         * We don't really honor the command timeout, but we try to
+         * honor 6 times of the actual command timeout! So reset the
+         * timer if this is less than 6th timeout on this command!
+         */
+        if (++cmndinfo->timeout_count < 6)
+                retval = BLK_EH_RESET_TIMER;
+        /* Reset the timeout if it is locked IO */
+        spin_lock_irqsave(&ha->smp_lock, flags);
+        if ((b != ha->virt_bus && ha->raw[BUS_L2P(ha, b)].lock) ||
+            (b == ha->virt_bus && t < MAX_HDRIVES && ha->hdr[t].lock)) {
+                TRACE2(("%s(): locked IO, reset timeout\n", __func__));
+                retval = BLK_EH_RESET_TIMER;
+        }
+        spin_unlock_irqrestore(&ha->smp_lock, flags);
+        return retval;
+}
 static int gdth_eh_bus_reset(Scsi_Cmnd *scp)
 {
    gdth_ha_str *ha = shost_priv(scp->device->host);
@@ -3992,7 +4013,7 @@ static int gdth_queuecommand(struct scsi_cmnd *scp,
    BUG_ON(!cmndinfo);
    scp->scsi_done = done;
-    gdth_update_timeout(scp, scp->timeout_per_command * 6);
+    cmndinfo->timeout_count = 0;
    cmndinfo->priority = DEFAULT_PRI;
    return __gdth_queuecommand(ha, scp, cmndinfo);
@@ -4096,12 +4117,10 @@ static int ioc_lockdrv(void __user *arg)
            ha->hdr[j].lock = 1;
            spin_unlock_irqrestore(&ha->smp_lock, flags);
            gdth_wait_completion(ha, ha->bus_cnt, j);
-            gdth_stop_timeout(ha, ha->bus_cnt, j);
        } else {
            spin_lock_irqsave(&ha->smp_lock, flags);
            ha->hdr[j].lock = 0;
            spin_unlock_irqrestore(&ha->smp_lock, flags);
-            gdth_start_timeout(ha, ha->bus_cnt, j);
            gdth_next(ha);
        }
    } 
@@ -4539,18 +4558,14 @@ static int gdth_ioctl(struct inode *inode, struct file *filep,
                spin_lock_irqsave(&ha->smp_lock, flags);
                ha->raw[i].lock = 1;
                spin_unlock_irqrestore(&ha->smp_lock, flags);
-                for (j = 0; j < ha->tid_cnt; ++j) {
+                for (j = 0; j < ha->tid_cnt; ++j)
                    gdth_wait_completion(ha, i, j);
-                    gdth_stop_timeout(ha, i, j);
-                }
            } else {
                spin_lock_irqsave(&ha->smp_lock, flags);
                ha->raw[i].lock = 0;
                spin_unlock_irqrestore(&ha->smp_lock, flags);
-                for (j = 0; j < ha->tid_cnt; ++j) {
+                for (j = 0; j < ha->tid_cnt; ++j)
-                    gdth_start_timeout(ha, i, j);
                    gdth_next(ha);
-                }
            }
        } 
        break;
@@ -4644,6 +4659,7 @@ static struct scsi_host_template gdth_template = {
        .slave_configure        = gdth_slave_configure,
        .bios_param             = gdth_bios_param,
        .proc_info              = gdth_proc_info,
+        .eh_timed_out           = gdth_timed_out,
        .proc_name              = "gdth",
        .can_queue              = GDTH_MAXCMDS,
        .this_id                = -1,
diff --git a/drivers/scsi/gdth.h b/drivers/scsi/gdth.h
index ca92476727cf..1646444e9bd5 100644
--- a/drivers/scsi/gdth.h
+++ b/drivers/scsi/gdth.h
@@ -916,7 +916,7 @@ typedef struct {
        gdth_cmd_str *internal_cmd_str;         /* crier for internal messages*/
        dma_addr_t sense_paddr;                 /* sense dma-addr */
        unchar priority;
-        int timeout;
+        int timeout_count;                      /* # of timeout calls */
        volatile int wait_for_completion;
        ushort status;
        ulong32 info;
diff --git a/drivers/scsi/gdth_proc.c b/drivers/scsi/gdth_proc.c
index ce0228e26aec..59349a316e13 100644
--- a/drivers/scsi/gdth_proc.c
+++ b/drivers/scsi/gdth_proc.c
@@ -748,69 +748,3 @@ static void gdth_wait_completion(gdth_ha_str *ha, int busnum, int id)
    }
    spin_unlock_irqrestore(&ha->smp_lock, flags);
 }
-static void gdth_stop_timeout(gdth_ha_str *ha, int busnum, int id)
-{
-    ulong flags;
-    Scsi_Cmnd *scp;
-    unchar b, t;
-    spin_lock_irqsave(&ha->smp_lock, flags);
-    for (scp = ha->req_first; scp; scp = (Scsi_Cmnd *)scp->SCp.ptr) {
-        struct gdth_cmndinfo *cmndinfo = gdth_cmnd_priv(scp);
-        if (!cmndinfo->internal_command) {
-            b = scp->device->channel;
-            t = scp->device->id;
-            if (t == (unchar)id && b == (unchar)busnum) {
-                TRACE2(("gdth_stop_timeout(): update_timeout()\n"));
-                cmndinfo->timeout = gdth_update_timeout(scp, 0);
-            }
-        }
-    }
-    spin_unlock_irqrestore(&ha->smp_lock, flags);
-}
-static void gdth_start_timeout(gdth_ha_str *ha, int busnum, int id)
-{
-    ulong flags;
-    Scsi_Cmnd *scp;
-    unchar b, t;
-    spin_lock_irqsave(&ha->smp_lock, flags);
-    for (scp = ha->req_first; scp; scp = (Scsi_Cmnd *)scp->SCp.ptr) {
-        struct gdth_cmndinfo *cmndinfo = gdth_cmnd_priv(scp);
-        if (!cmndinfo->internal_command) {
-            b = scp->device->channel;
-            t = scp->device->id;
-            if (t == (unchar)id && b == (unchar)busnum) {
-                TRACE2(("gdth_start_timeout(): update_timeout()\n"));
-                gdth_update_timeout(scp, cmndinfo->timeout);
-            }
-        }
-    }
-    spin_unlock_irqrestore(&ha->smp_lock, flags);
-}
-static int gdth_update_timeout(Scsi_Cmnd *scp, int timeout)
-{
-    int oldto;
-    oldto = scp->timeout_per_command;
-    scp->timeout_per_command = timeout;
-    if (timeout == 0) {
-        del_timer(&scp->eh_timeout);
-        scp->eh_timeout.data = (unsigned long) NULL;
-        scp->eh_timeout.expires = 0;
-    } else {
-        if (scp->eh_timeout.data != (unsigned long) NULL) 
-            del_timer(&scp->eh_timeout);
-        scp->eh_timeout.data = (unsigned long) scp;
-        scp->eh_timeout.expires = jiffies + timeout;
-        add_timer(&scp->eh_timeout);
-    }
-    return oldto;
-}
diff --git a/drivers/scsi/gdth_proc.h b/drivers/scsi/gdth_proc.h
index 45e6fdacf36e..9b900cc9ebe8 100644
--- a/drivers/scsi/gdth_proc.h
+++ b/drivers/scsi/gdth_proc.h
@@ -20,9 +20,6 @@ static char *gdth_ioctl_alloc(gdth_ha_str *ha, int size, int scratch,
                              ulong64 *paddr);
 static void gdth_ioctl_free(gdth_ha_str *ha, int size, char *buf, ulong64 paddr);
 static void gdth_wait_completion(gdth_ha_str *ha, int busnum, int id);
-static void gdth_stop_timeout(gdth_ha_str *ha, int busnum, int id);
-static void gdth_start_timeout(gdth_ha_str *ha, int busnum, int id);
-static int gdth_update_timeout(Scsi_Cmnd *scp, int timeout);
 #endif
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index fed0b02ebc1d..3fdbb13e80a8 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -464,7 +464,7 @@ static int __scsi_host_match(struct device *dev, void *data)
 struct Scsi_Host *scsi_host_lookup(unsigned short hostnum)
 {
        struct device *cdev;
-        struct Scsi_Host *shost = ERR_PTR(-ENXIO);
+        struct Scsi_Host *shost = NULL;
        cdev = class_find_device(&shost_class, NULL, &hostnum,
                                 __scsi_host_match);
diff --git a/drivers/scsi/hptiop.c b/drivers/scsi/hptiop.c
index da876d3924be..a48e4990fe12 100644
--- a/drivers/scsi/hptiop.c
+++ b/drivers/scsi/hptiop.c
@@ -25,7 +25,6 @@
 #include <linux/delay.h>
 #include <linux/timer.h>
 #include <linux/spinlock.h>
-#include <linux/hdreg.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include <asm/div64.h>
@@ -1249,6 +1248,13 @@ static struct pci_device_id hptiop_id_table[] = {
        { PCI_VDEVICE(TTI, 0x3522), (kernel_ulong_t)&hptiop_itl_ops },
        { PCI_VDEVICE(TTI, 0x3410), (kernel_ulong_t)&hptiop_itl_ops },
        { PCI_VDEVICE(TTI, 0x3540), (kernel_ulong_t)&hptiop_itl_ops },
+        { PCI_VDEVICE(TTI, 0x3530), (kernel_ulong_t)&hptiop_itl_ops },
+        { PCI_VDEVICE(TTI, 0x3560), (kernel_ulong_t)&hptiop_itl_ops },
+        { PCI_VDEVICE(TTI, 0x4322), (kernel_ulong_t)&hptiop_itl_ops },
+        { PCI_VDEVICE(TTI, 0x4210), (kernel_ulong_t)&hptiop_itl_ops },
+        { PCI_VDEVICE(TTI, 0x4211), (kernel_ulong_t)&hptiop_itl_ops },
+        { PCI_VDEVICE(TTI, 0x4310), (kernel_ulong_t)&hptiop_itl_ops },
+        { PCI_VDEVICE(TTI, 0x4311), (kernel_ulong_t)&hptiop_itl_ops },
        { PCI_VDEVICE(TTI, 0x3120), (kernel_ulong_t)&hptiop_mv_ops },
        { PCI_VDEVICE(TTI, 0x3122), (kernel_ulong_t)&hptiop_mv_ops },
        { PCI_VDEVICE(TTI, 0x3020), (kernel_ulong_t)&hptiop_mv_ops },
diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
index ae560bc04f9d..4e0b7c8eb32e 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -556,11 +556,12 @@ static void ibmvfc_link_down(struct ibmvfc_host *vhost,
 /**
 * ibmvfc_init_host - Start host initialization
 * @vhost:              ibmvfc host struct
+ * @relogin:    is this a re-login?
 *
 * Return value:
 *      nothing
 **/
-static void ibmvfc_init_host(struct ibmvfc_host *vhost)
+static void ibmvfc_init_host(struct ibmvfc_host *vhost, int relogin)
 {
        struct ibmvfc_target *tgt;
@@ -574,6 +575,11 @@ static void ibmvfc_init_host(struct ibmvfc_host *vhost)
        }
        if (!ibmvfc_set_host_state(vhost, IBMVFC_INITIALIZING)) {
+                if (!relogin) {
+                        memset(vhost->async_crq.msgs, 0, PAGE_SIZE);
+                        vhost->async_crq.cur = 0;
+                }
                list_for_each_entry(tgt, &vhost->targets, queue)
                        tgt->need_login = 1;
                scsi_block_requests(vhost->host);
@@ -1059,9 +1065,10 @@ static void ibmvfc_get_starget_port_id(struct scsi_target *starget)
 static int ibmvfc_wait_while_resetting(struct ibmvfc_host *vhost)
 {
        long timeout = wait_event_timeout(vhost->init_wait_q,
-                                          (vhost->state == IBMVFC_ACTIVE ||
+                                          ((vhost->state == IBMVFC_ACTIVE ||
-                                           vhost->state == IBMVFC_HOST_OFFLINE ||
+                                            vhost->state == IBMVFC_HOST_OFFLINE ||
-                                           vhost->state == IBMVFC_LINK_DEAD),
+                                            vhost->state == IBMVFC_LINK_DEAD) &&
+                                           vhost->action == IBMVFC_HOST_ACTION_NONE),
                                          (init_timeout * HZ));
        return timeout ? 0 : -EIO;
@@ -1450,8 +1457,8 @@ static void ibmvfc_scsi_done(struct ibmvfc_event *evt)
        struct ibmvfc_cmd *vfc_cmd = &evt->xfer_iu->cmd;
        struct ibmvfc_fcp_rsp *rsp = &vfc_cmd->rsp;
        struct scsi_cmnd *cmnd = evt->cmnd;
-        int rsp_len = 0;
+        u32 rsp_len = 0;
-        int sense_len = rsp->fcp_sense_len;
+        u32 sense_len = rsp->fcp_sense_len;
        if (cmnd) {
                if (vfc_cmd->response_flags & IBMVFC_ADAPTER_RESID_VALID)
@@ -1468,7 +1475,7 @@ static void ibmvfc_scsi_done(struct ibmvfc_event *evt)
                                rsp_len = rsp->fcp_rsp_len;
                        if ((sense_len + rsp_len) > SCSI_SENSE_BUFFERSIZE)
                                sense_len = SCSI_SENSE_BUFFERSIZE - rsp_len;
-                        if ((rsp->flags & FCP_SNS_LEN_VALID) && rsp->fcp_sense_len)
+                        if ((rsp->flags & FCP_SNS_LEN_VALID) && rsp->fcp_sense_len && rsp_len <= 8)
                                memcpy(cmnd->sense_buffer, rsp->data.sense + rsp_len, sense_len);
                        ibmvfc_log_error(evt);
@@ -2077,17 +2084,18 @@ static void ibmvfc_handle_async(struct ibmvfc_async_crq *crq,
 {
        const char *desc = ibmvfc_get_ae_desc(crq->event);
-        ibmvfc_log(vhost, 3, "%s event received\n", desc);
+        ibmvfc_log(vhost, 3, "%s event received. scsi_id: %lx, wwpn: %lx,"
+                   " node_name: %lx\n", desc, crq->scsi_id, crq->wwpn, crq->node_name);
        switch (crq->event) {
        case IBMVFC_AE_LINK_UP:
        case IBMVFC_AE_RESUME:
                vhost->events_to_log |= IBMVFC_AE_LINKUP;
-                ibmvfc_init_host(vhost);
+                ibmvfc_init_host(vhost, 1);
                break;
        case IBMVFC_AE_SCN_FABRIC:
                vhost->events_to_log |= IBMVFC_AE_RSCN;
-                ibmvfc_init_host(vhost);
+                ibmvfc_init_host(vhost, 1);
                break;
        case IBMVFC_AE_SCN_NPORT:
        case IBMVFC_AE_SCN_GROUP:
@@ -2133,13 +2141,13 @@ static void ibmvfc_handle_crq(struct ibmvfc_crq *crq, struct ibmvfc_host *vhost)
                        /* Send back a response */
                        rc = ibmvfc_send_crq_init_complete(vhost);
                        if (rc == 0)
-                                ibmvfc_init_host(vhost);
+                                ibmvfc_init_host(vhost, 0);
                        else
                                dev_err(vhost->dev, "Unable to send init rsp. rc=%ld\n", rc);
                        break;
                case IBMVFC_CRQ_INIT_COMPLETE:
                        dev_info(vhost->dev, "Partner initialization complete\n");
-                        ibmvfc_init_host(vhost);
+                        ibmvfc_init_host(vhost, 0);
                        break;
                default:
                        dev_err(vhost->dev, "Unknown crq message type: %d\n", crq->format);
@@ -3357,8 +3365,6 @@ static void ibmvfc_npiv_login(struct ibmvfc_host *vhost)
        mad->buffer.va = vhost->login_buf_dma;
        mad->buffer.len = sizeof(*vhost->login_buf);
-        memset(vhost->async_crq.msgs, 0, PAGE_SIZE);
-        vhost->async_crq.cur = 0;
        ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_INIT_WAIT);
        if (!ibmvfc_send_event(evt, vhost, default_timeout))
@@ -3601,8 +3607,9 @@ static void ibmvfc_do_work(struct ibmvfc_host *vhost)
                        }
                }
-                if (vhost->reinit) {
+                if (vhost->reinit && !ibmvfc_set_host_state(vhost, IBMVFC_INITIALIZING)) {
                        vhost->reinit = 0;
+                        scsi_block_requests(vhost->host);
                        ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_QUERY);
                } else {
                        ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_NONE);
diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h
index 4bf6e374f076..fb3177ab6691 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.h
+++ b/drivers/scsi/ibmvscsi/ibmvfc.h
@@ -29,8 +29,8 @@
 #include "viosrp.h"
 #define IBMVFC_NAME     "ibmvfc"
-#define IBMVFC_DRIVER_VERSION           "1.0.1"
+#define IBMVFC_DRIVER_VERSION           "1.0.2"
-#define IBMVFC_DRIVER_DATE              "(July 11, 2008)"
+#define IBMVFC_DRIVER_DATE              "(August 14, 2008)"
 #define IBMVFC_DEFAULT_TIMEOUT  15
 #define IBMVFC_INIT_TIMEOUT             30
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index 6b24b9cdb04c..87e09f35d3d4 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -756,7 +756,7 @@ static int ibmvscsi_queuecommand(struct scsi_cmnd *cmnd,
        init_event_struct(evt_struct,
                          handle_cmd_rsp,
                          VIOSRP_SRP_FORMAT,
-                          cmnd->timeout_per_command/HZ);
+                          cmnd->request->timeout/HZ);
        evt_struct->cmnd = cmnd;
        evt_struct->cmnd_done = done;
@@ -1636,7 +1636,7 @@ static unsigned long ibmvscsi_get_desired_dma(struct vio_dev *vdev)
        unsigned long desired_io = max_requests * sizeof(union viosrp_iu);
        /* add io space for sg data */
-        desired_io += (IBMVSCSI_MAX_SECTORS_DEFAULT *
+        desired_io += (IBMVSCSI_MAX_SECTORS_DEFAULT * 512 *
                             IBMVSCSI_CMDS_PER_LUN_DEFAULT);
        return desired_io;
diff --git a/drivers/scsi/ide-scsi.c b/drivers/scsi/ide-scsi.c
index b40a673985aa..90212ac33be3 100644
--- a/drivers/scsi/ide-scsi.c
+++ b/drivers/scsi/ide-scsi.c
@@ -40,7 +40,6 @@
 #include <linux/ioport.h>
 #include <linux/blkdev.h>
 #include <linux/errno.h>
-#include <linux/hdreg.h>
 #include <linux/slab.h>
 #include <linux/ide.h>
 #include <linux/scatterlist.h>
@@ -102,11 +101,10 @@ static struct ide_scsi_obj *ide_scsi_get(struct gendisk *disk)
        mutex_lock(&idescsi_ref_mutex);
        scsi = ide_scsi_g(disk);
        if (scsi) {
-                scsi_host_get(scsi->host);
+                if (ide_device_get(scsi->drive))
-                if (ide_device_get(scsi->drive)) {
-                        scsi_host_put(scsi->host);
                        scsi = NULL;
-                }
+                else
+                        scsi_host_get(scsi->host);
        }
        mutex_unlock(&idescsi_ref_mutex);
        return scsi;
@@ -114,9 +112,11 @@ static struct ide_scsi_obj *ide_scsi_get(struct gendisk *disk)
 static void ide_scsi_put(struct ide_scsi_obj *scsi)
 {
+        ide_drive_t *drive = scsi->drive;
        mutex_lock(&idescsi_ref_mutex);
-        ide_device_put(scsi->drive);
        scsi_host_put(scsi->host);
+        ide_device_put(drive);
        mutex_unlock(&idescsi_ref_mutex);
 }
@@ -130,50 +130,6 @@ static inline idescsi_scsi_t *drive_to_idescsi(ide_drive_t *ide_drive)
        return scsihost_to_idescsi(ide_drive->driver_data);
 }
-/*
- *      PIO data transfer routine using the scatter gather table.
- */
-static void ide_scsi_io_buffers(ide_drive_t *drive, struct ide_atapi_pc *pc,
-                                unsigned int bcount, int write)
-{
-        ide_hwif_t *hwif = drive->hwif;
-        const struct ide_tp_ops *tp_ops = hwif->tp_ops;
-        xfer_func_t *xf = write ? tp_ops->output_data : tp_ops->input_data;
-        char *buf;
-        int count;
-        while (bcount) {
-                count = min(pc->sg->length - pc->b_count, bcount);
-                if (PageHighMem(sg_page(pc->sg))) {
-                        unsigned long flags;
-                        local_irq_save(flags);
-                        buf = kmap_atomic(sg_page(pc->sg), KM_IRQ0) +
-                                          pc->sg->offset;
-                        xf(drive, NULL, buf + pc->b_count, count);
-                        kunmap_atomic(buf - pc->sg->offset, KM_IRQ0);
-                        local_irq_restore(flags);
-                } else {
-                        buf = sg_virt(pc->sg);
-                        xf(drive, NULL, buf + pc->b_count, count);
-                }
-                bcount -= count; pc->b_count += count;
-                if (pc->b_count == pc->sg->length) {
-                        if (!--pc->sg_cnt)
-                                break;
-                        pc->sg = sg_next(pc->sg);
-                        pc->b_count = 0;
-                }
-        }
-        if (bcount) {
-                printk(KERN_ERR "%s: scatter gather table too small, %s\n",
-                                drive->name, write ? "padding with zeros"
-                                                   : "discarding data");
-                ide_pad_transfer(drive, write, bcount);
-        }
-}
 static void ide_scsi_hex_dump(u8 *data, int len)
 {
        print_hex_dump(KERN_CONT, "", DUMP_PREFIX_NONE, 16, 1, data, len, 0);
@@ -243,9 +199,9 @@ idescsi_atapi_error(ide_drive_t *drive, struct request *rq, u8 stat, u8 err)
 {
        ide_hwif_t *hwif = drive->hwif;
-        if (hwif->tp_ops->read_status(hwif) & (BUSY_STAT | DRQ_STAT))
+        if (hwif->tp_ops->read_status(hwif) & (ATA_BUSY | ATA_DRQ))
                /* force an abort */
-                hwif->tp_ops->exec_command(hwif, WIN_IDLEIMMEDIATE);
+                hwif->tp_ops->exec_command(hwif, ATA_CMD_IDLEIMMEDIATE);
        rq->errors++;
@@ -343,7 +299,7 @@ static ide_startstop_t idescsi_pc_intr (ide_drive_t *drive)
        return ide_pc_intr(drive, pc, idescsi_pc_intr, get_timeout(pc),
                           idescsi_expiry, NULL, NULL, NULL,
-                           ide_scsi_io_buffers);
+                           ide_io_buffers);
 }
 static ide_startstop_t idescsi_transfer_pc(ide_drive_t *drive)
@@ -429,21 +385,41 @@ static ide_startstop_t idescsi_do_request (ide_drive_t *drive, struct request *r
 }
 #ifdef CONFIG_IDE_PROC_FS
-static void idescsi_add_settings(ide_drive_t *drive)
+#define ide_scsi_devset_get(name, field) \
-{
+static int get_##name(ide_drive_t *drive) \
-        idescsi_scsi_t *scsi = drive_to_idescsi(drive);
+{ \
+        idescsi_scsi_t *scsi = drive_to_idescsi(drive); \
-/*
+        return scsi->field; \
- *                      drive   setting name    read/write      data type       min     max     mul_factor      div_factor      data pointer            set function
+}
- */
-        ide_add_setting(drive,  "bios_cyl",     SETTING_RW,     TYPE_INT,       0,      1023,   1,              1,              &drive->bios_cyl,       NULL);
+#define ide_scsi_devset_set(name, field) \
-        ide_add_setting(drive,  "bios_head",    SETTING_RW,     TYPE_BYTE,      0,      255,    1,              1,              &drive->bios_head,      NULL);
+static int set_##name(ide_drive_t *drive, int arg) \
-        ide_add_setting(drive,  "bios_sect",    SETTING_RW,     TYPE_BYTE,      0,      63,     1,              1,              &drive->bios_sect,      NULL);
+{ \
-        ide_add_setting(drive,  "transform",    SETTING_RW,     TYPE_INT,       0,      3,      1,              1,              &scsi->transform,       NULL);
+        idescsi_scsi_t *scsi = drive_to_idescsi(drive); \
-        ide_add_setting(drive,  "log",          SETTING_RW,     TYPE_INT,       0,      1,      1,              1,              &scsi->log,             NULL);
+        scsi->field = arg; \
-}
+        return 0; \
-#else
+}
-static inline void idescsi_add_settings(ide_drive_t *drive) { ; }
+#define ide_scsi_devset_rw_field(_name, _field) \
+ide_scsi_devset_get(_name, _field); \
+ide_scsi_devset_set(_name, _field); \
+IDE_DEVSET(_name, DS_SYNC, get_##_name, set_##_name);
+ide_devset_rw_field(bios_cyl, bios_cyl);
+ide_devset_rw_field(bios_head, bios_head);
+ide_devset_rw_field(bios_sect, bios_sect);
+ide_scsi_devset_rw_field(transform, transform);
+ide_scsi_devset_rw_field(log, log);
+static const struct ide_proc_devset idescsi_settings[] = {
+        IDE_PROC_DEVSET(bios_cyl,  0, 1023),
+        IDE_PROC_DEVSET(bios_head, 0,  255),
+        IDE_PROC_DEVSET(bios_sect, 0,   63),
+        IDE_PROC_DEVSET(log,       0,    1),
+        IDE_PROC_DEVSET(transform, 0,    3),
+        { 0 },
+};
 #endif
 /*
@@ -451,7 +427,7 @@ static inline void idescsi_add_settings(ide_drive_t *drive) { ; }
 */
 static void idescsi_setup (ide_drive_t *drive, idescsi_scsi_t *scsi)
 {
-        if (drive->id && (drive->id->config & 0x0060) == 0x20)
+        if ((drive->id[ATA_ID_CONFIG] & 0x0060) == 0x20)
                set_bit(IDE_AFLAG_DRQ_INTERRUPT, &drive->atapi_flags);
        clear_bit(IDESCSI_SG_TRANSFORM, &scsi->transform);
 #if IDESCSI_DEBUG_LOG
@@ -460,7 +436,7 @@ static void idescsi_setup (ide_drive_t *drive, idescsi_scsi_t *scsi)
        drive->pc_callback = ide_scsi_callback;
-        idescsi_add_settings(drive);
+        ide_proc_register_driver(drive, scsi->driver);
 }
 static void ide_scsi_remove(ide_drive_t *drive)
@@ -502,12 +478,12 @@ static ide_driver_t idescsi_driver = {
        .remove                 = ide_scsi_remove,
        .version                = IDESCSI_VERSION,
        .media                  = ide_scsi,
-        .supports_dsc_overlap   = 0,
        .do_request             = idescsi_do_request,
        .end_request            = idescsi_end_request,
        .error                  = idescsi_atapi_error,
 #ifdef CONFIG_IDE_PROC_FS
        .proc                   = idescsi_proc,
+        .settings               = idescsi_settings,
 #endif
 };
@@ -611,7 +587,7 @@ static int idescsi_queue (struct scsi_cmnd *cmd,
        pc->req_xfer = pc->buf_size = scsi_bufflen(cmd);
        pc->scsi_cmd = cmd;
        pc->done = done;
-        pc->timeout = jiffies + cmd->timeout_per_command;
+        pc->timeout = jiffies + cmd->request->timeout;
        if (test_bit(IDESCSI_LOG_CMD, &scsi->log)) {
                printk ("ide-scsi: %s: que %lu, cmd = ", drive->name, cmd->serial_number);
@@ -810,6 +786,7 @@ static int ide_scsi_probe(ide_drive_t *drive)
        struct gendisk *g;
        static int warned;
        int err = -ENOMEM;
+        u16 last_lun;
        if (!warned && drive->media == ide_cdrom) {
                printk(KERN_WARNING "ide-scsi is deprecated for cd burning! Use ide-cd and give dev=/dev/hdX as device\n");
@@ -820,7 +797,6 @@ static int ide_scsi_probe(ide_drive_t *drive)
                return -ENODEV;
        if (!strstr("ide-scsi", drive->driver_req) ||
-            !drive->present ||
            drive->media == ide_disk ||
            !(host = scsi_host_alloc(&idescsi_template,sizeof(idescsi_scsi_t))))
                return -ENODEV;
@@ -835,12 +811,12 @@ static int ide_scsi_probe(ide_drive_t *drive)
        host->max_id = 1;
-        if (drive->id->last_lun)
+        last_lun = drive->id[ATA_ID_LAST_LUN];
-                debug_log("%s: id->last_lun=%u\n", drive->name,
+        if (last_lun)
-                          drive->id->last_lun);
+                debug_log("%s: last_lun=%u\n", drive->name, last_lun);
-        if ((drive->id->last_lun & 0x7) != 7)
+        if ((last_lun & 7) != 7)
-                host->max_lun = (drive->id->last_lun & 0x7) + 1;
+                host->max_lun = (last_lun & 7) + 1;
        else
                host->max_lun = 1;
@@ -851,7 +827,6 @@ static int ide_scsi_probe(ide_drive_t *drive)
        idescsi->host = host;
        idescsi->disk = g;
        g->private_data = &idescsi->driver;
-        ide_proc_register_driver(drive, &idescsi_driver);
        err = 0;
        idescsi_setup(drive, idescsi);
        g->fops = &idescsi_ops;
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index e7a3a6554425..d30eb7ba018e 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -3670,7 +3670,8 @@ static int ipr_slave_configure(struct scsi_device *sdev)
                        sdev->no_uld_attach = 1;
                }
                if (ipr_is_vset_device(res)) {
-                        sdev->timeout = IPR_VSET_RW_TIMEOUT;
+                        blk_queue_rq_timeout(sdev->request_queue,
+                                             IPR_VSET_RW_TIMEOUT);
                        blk_queue_max_sectors(sdev->request_queue, IPR_VSET_MAX_SECTORS);
                }
                if (ipr_is_vset_device(res) || ipr_is_scsi_disk(res))
diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
index 7c615c70ec5c..ef683f0d2b5a 100644
--- a/drivers/scsi/ips.c
+++ b/drivers/scsi/ips.c
@@ -165,7 +165,6 @@
 #include <asm/byteorder.h>
 #include <asm/page.h>
 #include <linux/stddef.h>
-#include <linux/version.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
@@ -3819,7 +3818,7 @@ ips_send_cmd(ips_ha_t * ha, ips_scb_t * scb)
                scb->cmd.dcdb.segment_4G = 0;
                scb->cmd.dcdb.enhanced_sg = 0;
-                TimeOut = scb->scsi_cmd->timeout_per_command;
+                TimeOut = scb->scsi_cmd->request->timeout;
                if (ha->subsys->param[4] & 0x00100000) {        /* If NEW Tape DCDB is Supported */
                        if (!scb->sg_len) {
diff --git a/drivers/scsi/ips.h b/drivers/scsi/ips.h
index e0657b6f009c..4e49fbcfe8af 100644
--- a/drivers/scsi/ips.h
+++ b/drivers/scsi/ips.h
@@ -50,7 +50,6 @@
 #ifndef _IPS_H_
   #define _IPS_H_
-#include <linux/version.h>
 #include <linux/nmi.h>
   #include <asm/uaccess.h>
   #include <asm/io.h>
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 299e075a7b34..da7b67d30d9a 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -1456,7 +1456,7 @@ static void fail_all_commands(struct iscsi_conn *conn, unsigned lun,
                if (lun == task->sc->device->lun || lun == -1) {
                        debug_scsi("failing in progress sc %p itt 0x%x\n",
                                   task->sc, task->itt);
-                        fail_command(conn, task, DID_BUS_BUSY << 16);
+                        fail_command(conn, task, error << 16);
                }
        }
 }
@@ -1476,12 +1476,12 @@ static void iscsi_start_tx(struct iscsi_conn *conn)
                scsi_queue_work(conn->session->host, &conn->xmitwork);
 }
-static enum scsi_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *scmd)
+static enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *scmd)
 {
        struct iscsi_cls_session *cls_session;
        struct iscsi_session *session;
        struct iscsi_conn *conn;
-        enum scsi_eh_timer_return rc = EH_NOT_HANDLED;
+        enum blk_eh_timer_return rc = BLK_EH_NOT_HANDLED;
        cls_session = starget_to_session(scsi_target(scmd->device));
        session = cls_session->dd_data;
@@ -1494,14 +1494,14 @@ static enum scsi_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *scmd)
                 * We are probably in the middle of iscsi recovery so let
                 * that complete and handle the error.
                 */
-                rc = EH_RESET_TIMER;
+                rc = BLK_EH_RESET_TIMER;
                goto done;
        }
        conn = session->leadconn;
        if (!conn) {
                /* In the middle of shuting down */
-                rc = EH_RESET_TIMER;
+                rc = BLK_EH_RESET_TIMER;
                goto done;
        }
@@ -1513,20 +1513,21 @@ static enum scsi_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *scmd)
         */
        if (time_before_eq(conn->last_recv + (conn->recv_timeout * HZ) +
                            (conn->ping_timeout * HZ), jiffies))
-                rc = EH_RESET_TIMER;
+                rc = BLK_EH_RESET_TIMER;
        /*
         * if we are about to check the transport then give the command
         * more time
         */
        if (time_before_eq(conn->last_recv + (conn->recv_timeout * HZ),
                           jiffies))
-                rc = EH_RESET_TIMER;
+                rc = BLK_EH_RESET_TIMER;
        /* if in the middle of checking the transport then give us more time */
        if (conn->ping_task)
-                rc = EH_RESET_TIMER;
+                rc = BLK_EH_RESET_TIMER;
 done:
        spin_unlock(&session->lock);
-        debug_scsi("return %s\n", rc == EH_RESET_TIMER ? "timer reset" : "nh");
+        debug_scsi("return %s\n", rc == BLK_EH_RESET_TIMER ?
+                                        "timer reset" : "nh");
        return rc;
 }
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 48ee8c7f5bdd..e15501170698 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -294,10 +294,10 @@ static void sas_ata_post_internal(struct ata_queued_cmd *qc)
        }
 }
-static int sas_ata_scr_write(struct ata_port *ap, unsigned int sc_reg_in,
+static int sas_ata_scr_write(struct ata_link *link, unsigned int sc_reg_in,
                              u32 val)
 {
-        struct domain_device *dev = ap->private_data;
+        struct domain_device *dev = link->ap->private_data;
        SAS_DPRINTK("STUB %s\n", __func__);
        switch (sc_reg_in) {
@@ -319,10 +319,10 @@ static int sas_ata_scr_write(struct ata_port *ap, unsigned int sc_reg_in,
        return 0;
 }
-static int sas_ata_scr_read(struct ata_port *ap, unsigned int sc_reg_in,
+static int sas_ata_scr_read(struct ata_link *link, unsigned int sc_reg_in,
                            u32 *val)
 {
-        struct domain_device *dev = ap->private_data;
+        struct domain_device *dev = link->ap->private_data;
        SAS_DPRINTK("STUB %s\n", __func__);
        switch (sc_reg_in) {
@@ -398,7 +398,7 @@ void sas_ata_task_abort(struct sas_task *task)
        /* Bounce SCSI-initiated commands to the SCSI EH */
        if (qc->scsicmd) {
-                scsi_req_abort_cmd(qc->scsicmd);
+                blk_abort_request(qc->scsicmd->request);
                scsi_schedule_eh(qc->scsicmd->device->host);
                return;
        }
diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h
index b4f9368f116a..0001374bd6b2 100644
--- a/drivers/scsi/libsas/sas_internal.h
+++ b/drivers/scsi/libsas/sas_internal.h
@@ -55,7 +55,7 @@ void sas_unregister_phys(struct sas_ha_struct *sas_ha);
 int  sas_register_ports(struct sas_ha_struct *sas_ha);
 void sas_unregister_ports(struct sas_ha_struct *sas_ha);
-enum scsi_eh_timer_return sas_scsi_timed_out(struct scsi_cmnd *);
+enum blk_eh_timer_return sas_scsi_timed_out(struct scsi_cmnd *);
 int  sas_init_queue(struct sas_ha_struct *sas_ha);
 int  sas_init_events(struct sas_ha_struct *sas_ha);
diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
index a8e3ef309070..744838780ada 100644
--- a/drivers/scsi/libsas/sas_scsi_host.c
+++ b/drivers/scsi/libsas/sas_scsi_host.c
@@ -673,43 +673,43 @@ out:
        return;
 }
-enum scsi_eh_timer_return sas_scsi_timed_out(struct scsi_cmnd *cmd)
+enum blk_eh_timer_return sas_scsi_timed_out(struct scsi_cmnd *cmd)
 {
        struct sas_task *task = TO_SAS_TASK(cmd);
        unsigned long flags;
        if (!task) {
-                cmd->timeout_per_command /= 2;
+                cmd->request->timeout /= 2;
                SAS_DPRINTK("command 0x%p, task 0x%p, gone: %s\n",
-                            cmd, task, (cmd->timeout_per_command ?
+                            cmd, task, (cmd->request->timeout ?
-                            "EH_RESET_TIMER" : "EH_NOT_HANDLED"));
+                            "BLK_EH_RESET_TIMER" : "BLK_EH_NOT_HANDLED"));
-                if (!cmd->timeout_per_command)
+                if (!cmd->request->timeout)
-                        return EH_NOT_HANDLED;
+                        return BLK_EH_NOT_HANDLED;
-                return EH_RESET_TIMER;
+                return BLK_EH_RESET_TIMER;
        }
        spin_lock_irqsave(&task->task_state_lock, flags);
        BUG_ON(task->task_state_flags & SAS_TASK_STATE_ABORTED);
        if (task->task_state_flags & SAS_TASK_STATE_DONE) {
                spin_unlock_irqrestore(&task->task_state_lock, flags);
-                SAS_DPRINTK("command 0x%p, task 0x%p, timed out: EH_HANDLED\n",
+                SAS_DPRINTK("command 0x%p, task 0x%p, timed out: "
-                            cmd, task);
+                            "BLK_EH_HANDLED\n", cmd, task);
-                return EH_HANDLED;
+                return BLK_EH_HANDLED;
        }
        if (!(task->task_state_flags & SAS_TASK_AT_INITIATOR)) {
                spin_unlock_irqrestore(&task->task_state_lock, flags);
                SAS_DPRINTK("command 0x%p, task 0x%p, not at initiator: "
-                            "EH_RESET_TIMER\n",
+                            "BLK_EH_RESET_TIMER\n",
                            cmd, task);
-                return EH_RESET_TIMER;
+                return BLK_EH_RESET_TIMER;
        }
        task->task_state_flags |= SAS_TASK_STATE_ABORTED;
        spin_unlock_irqrestore(&task->task_state_lock, flags);
-        SAS_DPRINTK("command 0x%p, task 0x%p, timed out: EH_NOT_HANDLED\n",
+        SAS_DPRINTK("command 0x%p, task 0x%p, timed out: BLK_EH_NOT_HANDLED\n",
                    cmd, task);
-        return EH_NOT_HANDLED;
+        return BLK_EH_NOT_HANDLED;
 }
 int sas_ioctl(struct scsi_device *sdev, int cmd, void __user *arg)
@@ -1039,7 +1039,7 @@ void sas_task_abort(struct sas_task *task)
                return;
        }
-        scsi_req_abort_cmd(sc);
+        blk_abort_request(sc->request);
        scsi_schedule_eh(sc->device->host);
 }
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 90272e65957a..094b47e94b29 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -27,7 +27,6 @@
 #include <linux/pci.h>
 #include <linux/spinlock.h>
 #include <linux/ctype.h>
-#include <linux/version.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_device.h>
diff --git a/drivers/scsi/megaraid/megaraid_sas.c b/drivers/scsi/megaraid/megaraid_sas.c
index fc7ac158476c..afe1de998763 100644
--- a/drivers/scsi/megaraid/megaraid_sas.c
+++ b/drivers/scsi/megaraid/megaraid_sas.c
@@ -10,7 +10,7 @@
 *         2 of the License, or (at your option) any later version.
 *
 * FILE         : megaraid_sas.c
- * Version      : v00.00.03.20-rc1
+ * Version     : v00.00.04.01-rc1
 *
 * Authors:
 *      (email-id : megaraidlinux@lsi.com)
@@ -71,6 +71,10 @@ static struct pci_device_id megasas_pci_table[] = {
        /* ppc IOP */
        {PCI_DEVICE(PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1078DE)},
        /* ppc IOP */
+        {PCI_DEVICE(PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1078GEN2)},
+        /* gen2*/
+        {PCI_DEVICE(PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS0079GEN2)},
+        /* gen2*/
        {PCI_DEVICE(PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_VERDE_ZCR)},
        /* xscale IOP, vega */
        {PCI_DEVICE(PCI_VENDOR_ID_DELL, PCI_DEVICE_ID_DELL_PERC5)},
@@ -198,6 +202,9 @@ megasas_clear_intr_xscale(struct megasas_register_set __iomem * regs)
         */
        writel(status, &regs->outbound_intr_status);
+        /* Dummy readl to force pci flush */
+        readl(&regs->outbound_intr_status);
        return 0;
 }
@@ -293,6 +300,9 @@ megasas_clear_intr_ppc(struct megasas_register_set __iomem * regs)
         */
        writel(status, &regs->outbound_doorbell_clear);
+        /* Dummy readl to force pci flush */
+        readl(&regs->outbound_doorbell_clear);
        return 0;
 }
 /**
@@ -318,6 +328,99 @@ static struct megasas_instance_template megasas_instance_template_ppc = {
 };
 /**
+*       The following functions are defined for gen2 (deviceid : 0x78 0x79)
+*       controllers
+*/
+/**
+ * megasas_enable_intr_gen2 -  Enables interrupts
+ * @regs:                      MFI register set
+ */
+static inline void
+megasas_enable_intr_gen2(struct megasas_register_set __iomem *regs)
+{
+        writel(0xFFFFFFFF, &(regs)->outbound_doorbell_clear);
+        /* write ~0x00000005 (4 & 1) to the intr mask*/
+        writel(~MFI_GEN2_ENABLE_INTERRUPT_MASK, &(regs)->outbound_intr_mask);
+        /* Dummy readl to force pci flush */
+        readl(&regs->outbound_intr_mask);
+}
+/**
+ * megasas_disable_intr_gen2 - Disables interrupt
+ * @regs:                      MFI register set
+ */
+static inline void
+megasas_disable_intr_gen2(struct megasas_register_set __iomem *regs)
+{
+        u32 mask = 0xFFFFFFFF;
+        writel(mask, &regs->outbound_intr_mask);
+        /* Dummy readl to force pci flush */
+        readl(&regs->outbound_intr_mask);
+}
+/**
+ * megasas_read_fw_status_reg_gen2 - returns the current FW status value
+ * @regs:                      MFI register set
+ */
+static u32
+megasas_read_fw_status_reg_gen2(struct megasas_register_set __iomem *regs)
+{
+        return readl(&(regs)->outbound_scratch_pad);
+}
+/**
+ * megasas_clear_interrupt_gen2 -      Check & clear interrupt
+ * @regs:                              MFI register set
+ */
+static int
+megasas_clear_intr_gen2(struct megasas_register_set __iomem *regs)
+{
+        u32 status;
+        /*
+         * Check if it is our interrupt
+         */
+        status = readl(&regs->outbound_intr_status);
+        if (!(status & MFI_GEN2_ENABLE_INTERRUPT_MASK))
+                return 1;
+        /*
+         * Clear the interrupt by writing back the same value
+         */
+        writel(status, &regs->outbound_doorbell_clear);
+        /* Dummy readl to force pci flush */
+        readl(&regs->outbound_intr_status);
+        return 0;
+}
+/**
+ * megasas_fire_cmd_gen2 -     Sends command to the FW
+ * @frame_phys_addr :          Physical address of cmd
+ * @frame_count :              Number of frames for the command
+ * @regs :                     MFI register set
+ */
+static inline void
+megasas_fire_cmd_gen2(dma_addr_t frame_phys_addr, u32 frame_count,
+                        struct megasas_register_set __iomem *regs)
+{
+        writel((frame_phys_addr | (frame_count<<1))|1,
+                        &(regs)->inbound_queue_port);
+}
+static struct megasas_instance_template megasas_instance_template_gen2 = {
+        .fire_cmd = megasas_fire_cmd_gen2,
+        .enable_intr = megasas_enable_intr_gen2,
+        .disable_intr = megasas_disable_intr_gen2,
+        .clear_intr = megasas_clear_intr_gen2,
+        .read_fw_status_reg = megasas_read_fw_status_reg_gen2,
+};
+/**
 *       This is the end of set of functions & definitions
 *       specific to ppc (deviceid : 0x60) controllers
 */
@@ -1064,7 +1167,7 @@ static int megasas_generic_reset(struct scsi_cmnd *scmd)
 * cmd has not been completed within the timeout period.
 */
 static enum
-scsi_eh_timer_return megasas_reset_timer(struct scsi_cmnd *scmd)
+blk_eh_timer_return megasas_reset_timer(struct scsi_cmnd *scmd)
 {
        struct megasas_cmd *cmd = (struct megasas_cmd *)scmd->SCp.ptr;
        struct megasas_instance *instance;
@@ -1072,7 +1175,7 @@ scsi_eh_timer_return megasas_reset_timer(struct scsi_cmnd *scmd)
        if (time_after(jiffies, scmd->jiffies_at_alloc +
                                (MEGASAS_DEFAULT_CMD_TIMEOUT * 2) * HZ)) {
-                return EH_NOT_HANDLED;
+                return BLK_EH_NOT_HANDLED;
        }
        instance = cmd->instance;
@@ -1086,7 +1189,7 @@ scsi_eh_timer_return megasas_reset_timer(struct scsi_cmnd *scmd)
                spin_unlock_irqrestore(instance->host->host_lock, flags);
        }
-        return EH_RESET_TIMER;
+        return BLK_EH_RESET_TIMER;
 }
 /**
@@ -1976,7 +2079,12 @@ static int megasas_init_mfi(struct megasas_instance *instance)
        /*
         * Map the message registers
         */
-        instance->base_addr = pci_resource_start(instance->pdev, 0);
+        if ((instance->pdev->device == PCI_DEVICE_ID_LSI_SAS1078GEN2) ||
+                (instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0079GEN2)) {
+                instance->base_addr = pci_resource_start(instance->pdev, 1);
+        } else {
+                instance->base_addr = pci_resource_start(instance->pdev, 0);
+        }
        if (pci_request_regions(instance->pdev, "megasas: LSI")) {
                printk(KERN_DEBUG "megasas: IO memory region busy!\n");
@@ -1998,6 +2106,10 @@ static int megasas_init_mfi(struct megasas_instance *instance)
                case PCI_DEVICE_ID_LSI_SAS1078DE:
                        instance->instancet = &megasas_instance_template_ppc;
                        break;
+                case PCI_DEVICE_ID_LSI_SAS1078GEN2:
+                case PCI_DEVICE_ID_LSI_SAS0079GEN2:
+                        instance->instancet = &megasas_instance_template_gen2;
+                        break;
                case PCI_DEVICE_ID_LSI_SAS1064R:
                case PCI_DEVICE_ID_DELL_PERC5:
                default:
@@ -2857,6 +2969,7 @@ static void megasas_shutdown(struct pci_dev *pdev)
 {
        struct megasas_instance *instance = pci_get_drvdata(pdev);
        megasas_flush_cache(instance);
+        megasas_shutdown_controller(instance, MR_DCMD_CTRL_SHUTDOWN);
 }
 /**
@@ -3292,7 +3405,7 @@ megasas_sysfs_set_dbg_lvl(struct device_driver *dd, const char *buf, size_t coun
        return retval;
 }
-static DRIVER_ATTR(dbg_lvl, S_IRUGO|S_IWUGO, megasas_sysfs_show_dbg_lvl,
+static DRIVER_ATTR(dbg_lvl, S_IRUGO|S_IWUSR, megasas_sysfs_show_dbg_lvl,
                megasas_sysfs_set_dbg_lvl);
 static ssize_t
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
index b0c41e671702..0d033248fdf1 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -18,9 +18,9 @@
 /*
 * MegaRAID SAS Driver meta data
 */
-#define MEGASAS_VERSION                 "00.00.03.20-rc1"
+#define MEGASAS_VERSION                         "00.00.04.01"
-#define MEGASAS_RELDATE                 "March 10, 2008"
+#define MEGASAS_RELDATE                         "July 24, 2008"
-#define MEGASAS_EXT_VERSION             "Mon. March 10 11:02:31 PDT 2008"
+#define MEGASAS_EXT_VERSION                     "Thu July 24 11:41:51 PST 2008"
 /*
 * Device IDs
@@ -28,6 +28,8 @@
 #define PCI_DEVICE_ID_LSI_SAS1078R              0x0060
 #define PCI_DEVICE_ID_LSI_SAS1078DE             0x007C
 #define PCI_DEVICE_ID_LSI_VERDE_ZCR             0x0413
+#define PCI_DEVICE_ID_LSI_SAS1078GEN2           0x0078
+#define PCI_DEVICE_ID_LSI_SAS0079GEN2           0x0079
 /*
 * =====================================
@@ -580,6 +582,8 @@ struct megasas_ctrl_info {
 #define MEGASAS_COMPLETION_TIMER_INTERVAL      (HZ/10)
 #define MFI_REPLY_1078_MESSAGE_INTERRUPT        0x80000000
+#define MFI_REPLY_GEN2_MESSAGE_INTERRUPT        0x00000001
+#define MFI_GEN2_ENABLE_INTERRUPT_MASK          (0x00000001 | 0x00000004)
 /*
 * register set for both 1068 and 1078 controllers
diff --git a/drivers/scsi/ncr53c8xx.c b/drivers/scsi/ncr53c8xx.c
index c57c94c0ffd2..3b7240e40819 100644
--- a/drivers/scsi/ncr53c8xx.c
+++ b/drivers/scsi/ncr53c8xx.c
@@ -4170,8 +4170,8 @@ static int ncr_queue_command (struct ncb *np, struct scsi_cmnd *cmd)
        **
        **----------------------------------------------------
        */
-        if (np->settle_time && cmd->timeout_per_command >= HZ) {
+        if (np->settle_time && cmd->request->timeout >= HZ) {
-                u_long tlimit = jiffies + cmd->timeout_per_command - HZ;
+                u_long tlimit = jiffies + cmd->request->timeout - HZ;
                if (time_after(np->settle_time, tlimit))
                        np->settle_time = tlimit;
        }
diff --git a/drivers/scsi/nsp32.c b/drivers/scsi/nsp32.c
index edf9fdb3cb3c..22052bb7becb 100644
--- a/drivers/scsi/nsp32.c
+++ b/drivers/scsi/nsp32.c
@@ -23,7 +23,6 @@
 *   1.2: PowerPC (big endian) support.
 */
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
diff --git a/drivers/scsi/nsp32.h b/drivers/scsi/nsp32.h
index 6715ecb3bfca..9565acf1aa72 100644
--- a/drivers/scsi/nsp32.h
+++ b/drivers/scsi/nsp32.h
@@ -16,7 +16,6 @@
 #ifndef _NSP32_H
 #define _NSP32_H
-#include <linux/version.h>
 //#define NSP32_DEBUG 9
 /*
diff --git a/drivers/scsi/pcmcia/nsp_cs.c b/drivers/scsi/pcmcia/nsp_cs.c
index 7c19bf264873..11a61ea8d5d9 100644
--- a/drivers/scsi/pcmcia/nsp_cs.c
+++ b/drivers/scsi/pcmcia/nsp_cs.c
@@ -25,7 +25,6 @@
 ***********************************************************************/
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c
index 37f9ba0cd798..b6cd12b2e996 100644
--- a/drivers/scsi/qla1280.c
+++ b/drivers/scsi/qla1280.c
@@ -2845,7 +2845,7 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
        memset(((char *)pkt + 8), 0, (REQUEST_ENTRY_SIZE - 8));
        /* Set ISP command timeout. */
-        pkt->timeout = cpu_to_le16(cmd->timeout_per_command/HZ);
+        pkt->timeout = cpu_to_le16(cmd->request->timeout/HZ);
        /* Set device target ID and LUN */
        pkt->lun = SCSI_LUN_32(cmd);
@@ -3114,7 +3114,7 @@ qla1280_32bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
        memset(((char *)pkt + 8), 0, (REQUEST_ENTRY_SIZE - 8));
        /* Set ISP command timeout. */
-        pkt->timeout = cpu_to_le16(cmd->timeout_per_command/HZ);
+        pkt->timeout = cpu_to_le16(cmd->request->timeout/HZ);
        /* Set device target ID and LUN */
        pkt->lun = SCSI_LUN_32(cmd);
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index a319a20ed440..0ddfe7106b3b 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -292,10 +292,11 @@ qla2x00_sysfs_write_optrom_ctl(struct kobject *kobj,
                valid = 0;
                if (ha->optrom_size == OPTROM_SIZE_2300 && start == 0)
                        valid = 1;
-                else if (start == (FA_BOOT_CODE_ADDR*4) ||
+                else if (start == (ha->flt_region_boot * 4) ||
-                    start == (FA_RISC_CODE_ADDR*4))
+                    start == (ha->flt_region_fw * 4))
                        valid = 1;
-                else if (IS_QLA25XX(ha) && start == (FA_VPD_NVRAM_ADDR*4))
+                else if (IS_QLA25XX(ha) &&
+                    start == (ha->flt_region_vpd_nvram * 4))
                    valid = 1;
                if (!valid) {
                        qla_printk(KERN_WARNING, ha,
@@ -993,6 +994,17 @@ qla2x00_terminate_rport_io(struct fc_rport *rport)
 {
        fc_port_t *fcport = *(fc_port_t **)rport->dd_data;
+        /*
+         * At this point all fcport's software-states are cleared.  Perform any
+         * final cleanup of firmware resources (PCBs and XCBs).
+         */
+        if (fcport->loop_id != FC_NO_LOOP_ID) {
+                fcport->ha->isp_ops->fabric_logout(fcport->ha, fcport->loop_id,
+                    fcport->d_id.b.domain, fcport->d_id.b.area,
+                    fcport->d_id.b.al_pa);
+                fcport->loop_id = FC_NO_LOOP_ID;
+        }
        qla2x00_abort_fcport_cmds(fcport);
        scsi_target_unblock(&rport->dev);
 }
@@ -1054,6 +1066,8 @@ qla2x00_get_fc_host_stats(struct Scsi_Host *shost)
                pfc_host_stat->dumped_frames = stats->dumped_frames;
                pfc_host_stat->nos_count = stats->nos_rcvd;
        }
+        pfc_host_stat->fcp_input_megabytes = ha->qla_stats.input_bytes >> 20;
+        pfc_host_stat->fcp_output_megabytes = ha->qla_stats.output_bytes >> 20;
 done_free:
        dma_pool_free(ha->s_dma_pool, stats, stats_dma);
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 6da31ba94404..83c819216771 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -25,7 +25,6 @@
 #include <linux/firmware.h>
 #include <linux/aer.h>
 #include <linux/mutex.h>
-#include <linux/semaphore.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_host.h>
@@ -2157,6 +2156,8 @@ struct qla_chip_state_84xx {
 struct qla_statistics {
        uint32_t total_isp_aborts;
+        uint64_t input_bytes;
+        uint64_t output_bytes;
 };
 /*
@@ -2237,6 +2238,8 @@ typedef struct scsi_qla_host {
 #define REGISTER_FDMI_NEEDED    26
 #define FCPORT_UPDATE_NEEDED    27
 #define VP_DPC_NEEDED           28      /* wake up for VP dpc handling */
+#define UNLOADING               29
+#define NPIV_CONFIG_NEEDED      30
        uint32_t        device_flags;
 #define DFLG_LOCAL_DEVICES              BIT_0
@@ -2506,7 +2509,6 @@ typedef struct scsi_qla_host {
        uint64_t        fce_wr, fce_rd;
        struct mutex    fce_mutex;
-        uint32_t        hw_event_start;
        uint32_t        hw_event_ptr;
        uint32_t        hw_event_pause_errors;
@@ -2552,6 +2554,14 @@ typedef struct scsi_qla_host {
        uint32_t        fdt_unprotect_sec_cmd;
        uint32_t        fdt_protect_sec_cmd;
+        uint32_t        flt_region_flt;
+        uint32_t        flt_region_fdt;
+        uint32_t        flt_region_boot;
+        uint32_t        flt_region_fw;
+        uint32_t        flt_region_vpd_nvram;
+        uint32_t        flt_region_hw_event;
+        uint32_t        flt_region_npiv_conf;
        /* Needed for BEACON */
        uint16_t        beacon_blink_led;
        uint8_t         beacon_color_state;
diff --git a/drivers/scsi/qla2xxx/qla_fw.h b/drivers/scsi/qla2xxx/qla_fw.h
index cf194517400d..d1d14202575a 100644
--- a/drivers/scsi/qla2xxx/qla_fw.h
+++ b/drivers/scsi/qla2xxx/qla_fw.h
@@ -789,14 +789,23 @@ struct device_reg_24xx {
 #define FA_RISC_CODE_ADDR       0x20000
 #define FA_RISC_CODE_SEGMENTS   2
+#define FA_FLASH_DESCR_ADDR_24  0x11000
+#define FA_FLASH_LAYOUT_ADDR_24 0x11400
+#define FA_NPIV_CONF0_ADDR_24   0x16000
+#define FA_NPIV_CONF1_ADDR_24   0x17000
 #define FA_FW_AREA_ADDR         0x40000
 #define FA_VPD_NVRAM_ADDR       0x48000
 #define FA_FEATURE_ADDR         0x4C000
 #define FA_FLASH_DESCR_ADDR     0x50000
+#define FA_FLASH_LAYOUT_ADDR    0x50400
 #define FA_HW_EVENT0_ADDR       0x54000
-#define FA_HW_EVENT1_ADDR       0x54200
+#define FA_HW_EVENT1_ADDR       0x54400
 #define FA_HW_EVENT_SIZE        0x200
 #define FA_HW_EVENT_ENTRY_SIZE  4
+#define FA_NPIV_CONF0_ADDR      0x5C000
+#define FA_NPIV_CONF1_ADDR      0x5D000
 /*
 * Flash Error Log Event Codes.
 */
@@ -806,10 +815,6 @@ struct device_reg_24xx {
 #define HW_EVENT_NVRAM_CHKSUM_ERR       0xF023
 #define HW_EVENT_FLASH_FW_ERR   0xF024
-#define FA_BOOT_LOG_ADDR        0x58000
-#define FA_FW_DUMP0_ADDR        0x60000
-#define FA_FW_DUMP1_ADDR        0x70000
        uint32_t flash_data;            /* Flash/NVRAM BIOS data. */
        uint32_t ctrl_status;           /* Control/Status. */
@@ -1203,6 +1208,62 @@ struct qla_fdt_layout {
        uint8_t unused2[65];
 };
+/* Flash Layout Table ********************************************************/
+struct qla_flt_location {
+        uint8_t sig[4];
+        uint32_t start_lo;
+        uint32_t start_hi;
+        uint16_t unused;
+        uint16_t checksum;
+};
+struct qla_flt_header {
+        uint16_t version;
+        uint16_t length;
+        uint16_t checksum;
+        uint16_t unused;
+};
+#define FLT_REG_FW              0x01
+#define FLT_REG_BOOT_CODE       0x07
+#define FLT_REG_VPD_0           0x14
+#define FLT_REG_NVRAM_0         0x15
+#define FLT_REG_VPD_1           0x16
+#define FLT_REG_NVRAM_1         0x17
+#define FLT_REG_FDT             0x1a
+#define FLT_REG_FLT             0x1c
+#define FLT_REG_HW_EVENT_0      0x1d
+#define FLT_REG_HW_EVENT_1      0x1f
+#define FLT_REG_NPIV_CONF_0     0x29
+#define FLT_REG_NPIV_CONF_1     0x2a
+struct qla_flt_region {
+        uint32_t code;
+        uint32_t size;
+        uint32_t start;
+        uint32_t end;
+};
+/* Flash NPIV Configuration Table ********************************************/
+struct qla_npiv_header {
+        uint8_t sig[2];
+        uint16_t version;
+        uint16_t entries;
+        uint16_t unused[4];
+        uint16_t checksum;
+};
+struct qla_npiv_entry {
+        uint16_t flags;
+        uint16_t vf_id;
+        uint16_t qos;
+        uint16_t unused1;
+        uint8_t port_name[WWN_SIZE];
+        uint8_t node_name[WWN_SIZE];
+};
 /* 84XX Support **************************************************************/
 #define MBA_ISP84XX_ALERT       0x800f  /* Alert Notification. */
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index 0b156735e9a6..753dbe6cce6e 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -313,9 +313,11 @@ extern int qla24xx_get_flash_version(scsi_qla_host_t *, void *);
 extern int qla2xxx_hw_event_log(scsi_qla_host_t *, uint16_t , uint16_t,
    uint16_t, uint16_t);
-extern void qla2xxx_get_flash_info(scsi_qla_host_t *);
+extern int qla2xxx_get_flash_info(scsi_qla_host_t *);
 extern int qla2xxx_get_vpd_field(scsi_qla_host_t *, char *, char *, size_t);
+extern void qla2xxx_flash_npiv_conf(scsi_qla_host_t *);
 /*
 * Global Function Prototypes in qla_dbg.c source file.
 */
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 601a6b29750c..a470f2d3270d 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -83,6 +83,13 @@ qla2x00_initialize_adapter(scsi_qla_host_t *ha)
        ha->isp_ops->reset_chip(ha);
+        rval = qla2xxx_get_flash_info(ha);
+        if (rval) {
+                DEBUG2(printk("scsi(%ld): Unable to validate FLASH data.\n",
+                    ha->host_no));
+                return (rval);
+        }
        ha->isp_ops->get_flash_version(ha, ha->request_ring);
        qla_printk(KERN_INFO, ha, "Configure NVRAM parameters...\n");
@@ -109,7 +116,6 @@ qla2x00_initialize_adapter(scsi_qla_host_t *ha)
                rval = qla2x00_setup_chip(ha);
                if (rval)
                        return (rval);
-                qla2xxx_get_flash_info(ha);
        }
        if (IS_QLA84XX(ha)) {
                ha->cs84xx = qla84xx_get_chip(ha);
@@ -976,8 +982,9 @@ qla2x00_setup_chip(scsi_qla_host_t *ha)
                                    &ha->fw_attributes, &ha->fw_memory_size);
                                qla2x00_resize_request_q(ha);
                                ha->flags.npiv_supported = 0;
-                                if ((IS_QLA24XX(ha) || IS_QLA25XX(ha)) &&
+                                if ((IS_QLA24XX(ha) || IS_QLA25XX(ha) ||
-                                    (ha->fw_attributes & BIT_2)) {
+                                     IS_QLA84XX(ha)) &&
+                                         (ha->fw_attributes & BIT_2)) {
                                        ha->flags.npiv_supported = 1;
                                        if ((!ha->max_npiv_vports) ||
                                            ((ha->max_npiv_vports + 1) %
@@ -2015,7 +2022,7 @@ qla2x00_configure_loop(scsi_qla_host_t *ha)
                DEBUG3(printk("%s: exiting normally\n", __func__));
        }
-        /* Restore state if a resync event occured during processing */
+        /* Restore state if a resync event occurred during processing */
        if (test_bit(LOOP_RESYNC_NEEDED, &ha->dpc_flags)) {
                if (test_bit(LOCAL_LOOP_UPDATE, &save_flags))
                        set_bit(LOCAL_LOOP_UPDATE, &ha->dpc_flags);
@@ -2560,7 +2567,7 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *ha, struct list_head *new_fcports)
        rval = QLA_SUCCESS;
        /* Try GID_PT to get device list, else GAN. */
-        swl = kcalloc(MAX_FIBRE_DEVICES, sizeof(sw_info_t), GFP_ATOMIC);
+        swl = kcalloc(MAX_FIBRE_DEVICES, sizeof(sw_info_t), GFP_KERNEL);
        if (!swl) {
                /*EMPTY*/
                DEBUG2(printk("scsi(%ld): GID_PT allocations failed, fallback "
@@ -3251,6 +3258,7 @@ qla2x00_abort_isp(scsi_qla_host_t *ha)
 {
        int rval;
        uint8_t        status = 0;
+        scsi_qla_host_t *vha;
        if (ha->flags.online) {
                ha->flags.online = 0;
@@ -3265,6 +3273,8 @@ qla2x00_abort_isp(scsi_qla_host_t *ha)
                if (atomic_read(&ha->loop_state) != LOOP_DOWN) {
                        atomic_set(&ha->loop_state, LOOP_DOWN);
                        qla2x00_mark_all_devices_lost(ha, 0);
+                        list_for_each_entry(vha, &ha->vp_list, vp_list)
+                               qla2x00_mark_all_devices_lost(vha, 0);
                } else {
                        if (!atomic_read(&ha->loop_down_timer))
                                atomic_set(&ha->loop_down_timer,
@@ -3747,7 +3757,7 @@ qla24xx_load_risc_flash(scsi_qla_host_t *ha, uint32_t *srisc_addr)
        rval = QLA_SUCCESS;
        segments = FA_RISC_CODE_SEGMENTS;
-        faddr = FA_RISC_CODE_ADDR;
+        faddr = ha->flt_region_fw;
        dcode = (uint32_t *)ha->request_ring;
        *srisc_addr = 0;
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 92fafbdbbaab..e90afad120ee 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -52,7 +52,7 @@ to_qla_parent(scsi_qla_host_t *ha)
 * @ha: HA context
 * @ha_locked: is function called with the hardware lock
 *
- * Returns non-zero if a failure occured, else zero.
+ * Returns non-zero if a failure occurred, else zero.
 */
 static inline int
 qla2x00_issue_marker(scsi_qla_host_t *ha, int ha_locked)
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index d57669aa4615..85bc0a48598b 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -21,17 +21,22 @@ static void qla2x00_isp_cmd(scsi_qla_host_t *ha);
 * Returns the proper CF_* direction based on CDB.
 */
 static inline uint16_t
-qla2x00_get_cmd_direction(struct scsi_cmnd *cmd)
+qla2x00_get_cmd_direction(srb_t *sp)
 {
        uint16_t cflags;
        cflags = 0;
        /* Set transfer direction */
-        if (cmd->sc_data_direction == DMA_TO_DEVICE)
+        if (sp->cmd->sc_data_direction == DMA_TO_DEVICE) {
                cflags = CF_WRITE;
-        else if (cmd->sc_data_direction == DMA_FROM_DEVICE)
+                sp->fcport->ha->qla_stats.output_bytes +=
+                    scsi_bufflen(sp->cmd);
+        } else if (sp->cmd->sc_data_direction == DMA_FROM_DEVICE) {
                cflags = CF_READ;
+                sp->fcport->ha->qla_stats.input_bytes +=
+                    scsi_bufflen(sp->cmd);
+        }
        return (cflags);
 }
@@ -169,7 +174,7 @@ void qla2x00_build_scsi_iocbs_32(srb_t *sp, cmd_entry_t *cmd_pkt,
        ha = sp->ha;
-        cmd_pkt->control_flags |= cpu_to_le16(qla2x00_get_cmd_direction(cmd));
+        cmd_pkt->control_flags |= cpu_to_le16(qla2x00_get_cmd_direction(sp));
        /* Three DSDs are available in the Command Type 2 IOCB */
        avail_dsds = 3;
@@ -228,7 +233,7 @@ void qla2x00_build_scsi_iocbs_64(srb_t *sp, cmd_entry_t *cmd_pkt,
        ha = sp->ha;
-        cmd_pkt->control_flags |= cpu_to_le16(qla2x00_get_cmd_direction(cmd));
+        cmd_pkt->control_flags |= cpu_to_le16(qla2x00_get_cmd_direction(sp));
        /* Two DSDs are available in the Command Type 3 IOCB */
        avail_dsds = 2;
@@ -262,7 +267,7 @@ void qla2x00_build_scsi_iocbs_64(srb_t *sp, cmd_entry_t *cmd_pkt,
 * qla2x00_start_scsi() - Send a SCSI command to the ISP
 * @sp: command to send to the ISP
 *
- * Returns non-zero if a failure occured, else zero.
+ * Returns non-zero if a failure occurred, else zero.
 */
 int
 qla2x00_start_scsi(srb_t *sp)
@@ -407,7 +412,7 @@ queuing_error:
 *
 * Can be called from both normal and interrupt context.
 *
- * Returns non-zero if a failure occured, else zero.
+ * Returns non-zero if a failure occurred, else zero.
 */
 int
 __qla2x00_marker(scsi_qla_host_t *ha, uint16_t loop_id, uint16_t lun,
@@ -625,12 +630,17 @@ qla24xx_build_scsi_iocbs(srb_t *sp, struct cmd_type_7 *cmd_pkt,
        ha = sp->ha;
        /* Set transfer direction */
-        if (cmd->sc_data_direction == DMA_TO_DEVICE)
+        if (cmd->sc_data_direction == DMA_TO_DEVICE) {
                cmd_pkt->task_mgmt_flags =
                    __constant_cpu_to_le16(TMF_WRITE_DATA);
-        else if (cmd->sc_data_direction == DMA_FROM_DEVICE)
+                sp->fcport->ha->qla_stats.output_bytes +=
+                    scsi_bufflen(sp->cmd);
+        } else if (cmd->sc_data_direction == DMA_FROM_DEVICE) {
                cmd_pkt->task_mgmt_flags =
                    __constant_cpu_to_le16(TMF_READ_DATA);
+                sp->fcport->ha->qla_stats.input_bytes +=
+                    scsi_bufflen(sp->cmd);
+        }
        /* One DSD is available in the Command Type 3 IOCB */
        avail_dsds = 1;
@@ -666,7 +676,7 @@ qla24xx_build_scsi_iocbs(srb_t *sp, struct cmd_type_7 *cmd_pkt,
 * qla24xx_start_scsi() - Send a SCSI command to the ISP
 * @sp: command to send to the ISP
 *
- * Returns non-zero if a failure occured, else zero.
+ * Returns non-zero if a failure occurred, else zero.
 */
 int
 qla24xx_start_scsi(srb_t *sp)
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 874d802edb7d..fc4bfa7f839c 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -391,9 +391,9 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
                break;
        case MBA_LIP_OCCURRED:          /* Loop Initialization Procedure */
-                DEBUG2(printk("scsi(%ld): LIP occured (%x).\n", ha->host_no,
+                DEBUG2(printk("scsi(%ld): LIP occurred (%x).\n", ha->host_no,
                    mb[1]));
-                qla_printk(KERN_INFO, ha, "LIP occured (%x).\n", mb[1]);
+                qla_printk(KERN_INFO, ha, "LIP occurred (%x).\n", mb[1]);
                if (atomic_read(&ha->loop_state) != LOOP_DOWN) {
                        atomic_set(&ha->loop_state, LOOP_DOWN);
@@ -460,7 +460,7 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
                DEBUG2(printk("scsi(%ld): Asynchronous LIP RESET (%x).\n",
                    ha->host_no, mb[1]));
                qla_printk(KERN_INFO, ha,
-                    "LIP reset occured (%x).\n", mb[1]);
+                    "LIP reset occurred (%x).\n", mb[1]);
                if (atomic_read(&ha->loop_state) != LOOP_DOWN) {
                        atomic_set(&ha->loop_state, LOOP_DOWN);
@@ -543,7 +543,7 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
        case MBA_PORT_UPDATE:           /* Port database update */
                /*
-                 * If PORT UPDATE is global (recieved LIP_OCCURED/LIP_RESET
+                 * If PORT UPDATE is global (received LIP_OCCURRED/LIP_RESET
                 * event etc. earlier indicating loop is down) then process
                 * it.  Otherwise ignore it and Wait for RSCN to come in.
                 */
@@ -589,7 +589,7 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
                    "scsi(%ld): RSCN database changed -- %04x %04x %04x.\n",
                    ha->host_no, mb[1], mb[2], mb[3]));
-                rscn_entry = (mb[1] << 16) | mb[2];
+                rscn_entry = ((mb[1] & 0xff) << 16) | mb[2];
                host_pid = (ha->d_id.b.domain << 16) | (ha->d_id.b.area << 8) |
                    ha->d_id.b.al_pa;
                if (rscn_entry == host_pid) {
@@ -600,6 +600,8 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
                        break;
                }
+                /* Ignore reserved bits from RSCN-payload. */
+                rscn_entry = ((mb[1] & 0x3ff) << 16) | mb[2];
                rscn_queue_index = ha->rscn_in_ptr + 1;
                if (rscn_queue_index == MAX_RSCN_COUNT)
                        rscn_queue_index = 0;
@@ -879,11 +881,12 @@ qla2x00_handle_sense(srb_t *sp, uint8_t *sense_data, uint32_t sense_len)
        sp->request_sense_ptr += sense_len;
        sp->request_sense_length -= sense_len;
        if (sp->request_sense_length != 0)
-                sp->ha->status_srb = sp;
+                sp->fcport->ha->status_srb = sp;
        DEBUG5(printk("%s(): Check condition Sense data, scsi(%ld:%d:%d:%d) "
-            "cmd=%p pid=%ld\n", __func__, sp->ha->host_no, cp->device->channel,
+            "cmd=%p pid=%ld\n", __func__, sp->fcport->ha->host_no,
-            cp->device->id, cp->device->lun, cp, cp->serial_number));
+            cp->device->channel, cp->device->id, cp->device->lun, cp,
+            cp->serial_number));
        if (sense_len)
                DEBUG5(qla2x00_dump_buffer(cp->sense_buffer,
                    CMD_ACTUAL_SNSLEN(cp)));
@@ -1059,8 +1062,9 @@ qla2x00_status_entry(scsi_qla_host_t *ha, void *pkt)
                resid = resid_len;
                /* Use F/W calculated residual length. */
                if (IS_FWI2_CAPABLE(ha)) {
-                        if (scsi_status & SS_RESIDUAL_UNDER &&
+                        if (!(scsi_status & SS_RESIDUAL_UNDER)) {
-                            resid != fw_resid_len) {
+                                lscsi_status = 0;
+                        } else if (resid != fw_resid_len) {
                                scsi_status &= ~SS_RESIDUAL_UNDER;
                                lscsi_status = 0;
                        }
@@ -1184,9 +1188,8 @@ qla2x00_status_entry(scsi_qla_host_t *ha, void *pkt)
                    atomic_read(&fcport->state)));
                cp->result = DID_BUS_BUSY << 16;
-                if (atomic_read(&fcport->state) == FCS_ONLINE) {
+                if (atomic_read(&fcport->state) == FCS_ONLINE)
-                        qla2x00_mark_device_lost(ha, fcport, 1, 1);
+                        qla2x00_mark_device_lost(fcport->ha, fcport, 1, 1);
-                }
                break;
        case CS_RESET:
@@ -1229,7 +1232,7 @@ qla2x00_status_entry(scsi_qla_host_t *ha, void *pkt)
                /* Check to see if logout occurred. */
                if ((le16_to_cpu(sts->status_flags) & SF_LOGOUT_SENT))
-                        qla2x00_mark_device_lost(ha, fcport, 1, 1);
+                        qla2x00_mark_device_lost(fcport->ha, fcport, 1, 1);
                break;
        default:
@@ -1834,7 +1837,6 @@ clear_risc_ints:
                WRT_REG_WORD(&reg->isp.hccr, HCCR_CLR_HOST_INT);
        }
        spin_unlock_irq(&ha->hardware_lock);
-        ha->isp_ops->enable_intrs(ha);
 fail:
        return ret;
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index bc90d6b8d0a0..36bc6851e23d 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -233,7 +233,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *pvha, mbx_cmd_t *mcp)
                        DEBUG2_3_11(printk("%s(%ld): timeout schedule "
                            "isp_abort_needed.\n", __func__, ha->host_no));
                        qla_printk(KERN_WARNING, ha,
-                            "Mailbox command timeout occured. Scheduling ISP "
+                            "Mailbox command timeout occurred. Scheduling ISP "
                            "abort.\n");
                        set_bit(ISP_ABORT_NEEDED, &ha->dpc_flags);
                        qla2xxx_wake_dpc(ha);
@@ -244,7 +244,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *pvha, mbx_cmd_t *mcp)
                        DEBUG2_3_11(printk("%s(%ld): timeout calling "
                            "abort_isp\n", __func__, ha->host_no));
                        qla_printk(KERN_WARNING, ha,
-                            "Mailbox command timeout occured. Issuing ISP "
+                            "Mailbox command timeout occurred. Issuing ISP "
                            "abort.\n");
                        set_bit(ABORT_ISP_ACTIVE, &ha->dpc_flags);
@@ -1995,7 +1995,7 @@ qla2x00_get_fcal_position_map(scsi_qla_host_t *ha, char *pos_map)
        char *pmap;
        dma_addr_t pmap_dma;
-        pmap = dma_pool_alloc(ha->s_dma_pool, GFP_ATOMIC, &pmap_dma);
+        pmap = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &pmap_dma);
        if (pmap  == NULL) {
                DEBUG2_3_11(printk("%s(%ld): **** Mem Alloc Failed ****",
                    __func__, ha->host_no));
@@ -2686,7 +2686,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *ha,
                set_bit(VP_IDX_ACQUIRED, &vha->vp_flags);
                set_bit(VP_DPC_NEEDED, &ha->dpc_flags);
-                wake_up_process(ha->dpc_thread);
+                qla2xxx_wake_dpc(ha);
        }
 }
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index 50baf6a1d67c..93560cd72784 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -6,7 +6,6 @@
 */
 #include "qla_def.h"
-#include <linux/version.h>
 #include <linux/moduleparam.h>
 #include <linux/vmalloc.h>
 #include <linux/smp_lock.h>
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 7c8af7ed2a5d..3433441b956a 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -780,7 +780,8 @@ qla2x00_eh_wait_for_pending_commands(scsi_qla_host_t *ha, unsigned int t,
                sp = pha->outstanding_cmds[cnt];
                if (!sp)
                        continue;
-                if (ha->vp_idx != sp->ha->vp_idx)
+                if (ha->vp_idx != sp->fcport->ha->vp_idx)
                        continue;
                match = 0;
                switch (type) {
@@ -1080,9 +1081,7 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *ha, int res)
                sp = ha->outstanding_cmds[cnt];
                if (sp) {
                        ha->outstanding_cmds[cnt] = NULL;
-                        sp->flags = 0;
                        sp->cmd->result = res;
-                        sp->cmd->host_scribble = (unsigned char *)NULL;
                        qla2x00_sp_compl(ha, sp);
                }
        }
@@ -1518,6 +1517,7 @@ qla2xxx_scan_start(struct Scsi_Host *shost)
        set_bit(LOOP_RESYNC_NEEDED, &ha->dpc_flags);
        set_bit(LOCAL_LOOP_UPDATE, &ha->dpc_flags);
        set_bit(RSCN_UPDATE, &ha->dpc_flags);
+        set_bit(NPIV_CONFIG_NEEDED, &ha->dpc_flags);
 }
 static int
@@ -1664,8 +1664,6 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                ha->gid_list_info_size = 8;
                ha->optrom_size = OPTROM_SIZE_25XX;
                ha->isp_ops = &qla25xx_isp_ops;
-                ha->hw_event_start = PCI_FUNC(pdev->devfn) ?
-                    FA_HW_EVENT1_ADDR: FA_HW_EVENT0_ADDR;
        }
        host->can_queue = ha->request_q_length + 128;
@@ -1741,6 +1739,8 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
        if (ret)
                goto probe_failed;
+        ha->isp_ops->enable_intrs(ha);
        scsi_scan_host(host);
        qla2x00_alloc_sysfs_attr(ha);
@@ -1776,10 +1776,15 @@ probe_out:
 static void
 qla2x00_remove_one(struct pci_dev *pdev)
 {
-        scsi_qla_host_t *ha;
+        scsi_qla_host_t *ha, *vha, *temp;
        ha = pci_get_drvdata(pdev);
+        list_for_each_entry_safe(vha, temp, &ha->vp_list, vp_list)
+                fc_vport_terminate(vha->fc_vport);
+        set_bit(UNLOADING, &ha->dpc_flags);
        qla2x00_dfs_remove(ha);
        qla84xx_put_chip(ha);
@@ -2427,6 +2432,12 @@ qla2x00_do_dpc(void *data)
                            ha->host_no));
                }
+                if (test_bit(NPIV_CONFIG_NEEDED, &ha->dpc_flags) &&
+                    atomic_read(&ha->loop_state) == LOOP_READY) {
+                        clear_bit(NPIV_CONFIG_NEEDED, &ha->dpc_flags);
+                        qla2xxx_flash_npiv_conf(ha);
+                }
                if (!ha->interrupts_on)
                        ha->isp_ops->enable_intrs(ha);
@@ -2451,8 +2462,10 @@ qla2x00_do_dpc(void *data)
 void
 qla2xxx_wake_dpc(scsi_qla_host_t *ha)
 {
-        if (ha->dpc_thread)
+        struct task_struct *t = ha->dpc_thread;
-                wake_up_process(ha->dpc_thread);
+        if (!test_bit(UNLOADING, &ha->dpc_flags) && t)
+                wake_up_process(t);
 }
 /*
diff --git a/drivers/scsi/qla2xxx/qla_sup.c b/drivers/scsi/qla2xxx/qla_sup.c
index 1bca74474935..90a13211717f 100644
--- a/drivers/scsi/qla2xxx/qla_sup.c
+++ b/drivers/scsi/qla2xxx/qla_sup.c
@@ -543,23 +543,198 @@ qla24xx_get_flash_manufacturer(scsi_qla_host_t *ha, uint8_t *man_id,
        }
 }
-void
+static int
-qla2xxx_get_flash_info(scsi_qla_host_t *ha)
+qla2xxx_find_flt_start(scsi_qla_host_t *ha, uint32_t *start)
+{
+        const char *loc, *locations[] = { "DEF", "PCI" };
+        uint32_t pcihdr, pcids;
+        uint32_t *dcode;
+        uint8_t *buf, *bcode, last_image;
+        uint16_t cnt, chksum, *wptr;
+        struct qla_flt_location *fltl;
+        /*
+         * FLT-location structure resides after the last PCI region.
+         */
+        /* Begin with sane defaults. */
+        loc = locations[0];
+        *start = IS_QLA24XX_TYPE(ha) ? FA_FLASH_LAYOUT_ADDR_24:
+            FA_FLASH_LAYOUT_ADDR;
+        /* Begin with first PCI expansion ROM header. */
+        buf = (uint8_t *)ha->request_ring;
+        dcode = (uint32_t *)ha->request_ring;
+        pcihdr = 0;
+        last_image = 1;
+        do {
+                /* Verify PCI expansion ROM header. */
+                qla24xx_read_flash_data(ha, dcode, pcihdr >> 2, 0x20);
+                bcode = buf + (pcihdr % 4);
+                if (bcode[0x0] != 0x55 || bcode[0x1] != 0xaa)
+                        goto end;
+                /* Locate PCI data structure. */
+                pcids = pcihdr + ((bcode[0x19] << 8) | bcode[0x18]);
+                qla24xx_read_flash_data(ha, dcode, pcids >> 2, 0x20);
+                bcode = buf + (pcihdr % 4);
+                /* Validate signature of PCI data structure. */
+                if (bcode[0x0] != 'P' || bcode[0x1] != 'C' ||
+                    bcode[0x2] != 'I' || bcode[0x3] != 'R')
+                        goto end;
+                last_image = bcode[0x15] & BIT_7;
+                /* Locate next PCI expansion ROM. */
+                pcihdr += ((bcode[0x11] << 8) | bcode[0x10]) * 512;
+        } while (!last_image);
+        /* Now verify FLT-location structure. */
+        fltl = (struct qla_flt_location *)ha->request_ring;
+        qla24xx_read_flash_data(ha, dcode, pcihdr >> 2,
+            sizeof(struct qla_flt_location) >> 2);
+        if (fltl->sig[0] != 'Q' || fltl->sig[1] != 'F' ||
+            fltl->sig[2] != 'L' || fltl->sig[3] != 'T')
+                goto end;
+        wptr = (uint16_t *)ha->request_ring;
+        cnt = sizeof(struct qla_flt_location) >> 1;
+        for (chksum = 0; cnt; cnt--)
+                chksum += le16_to_cpu(*wptr++);
+        if (chksum) {
+                qla_printk(KERN_ERR, ha,
+                    "Inconsistent FLTL detected: checksum=0x%x.\n", chksum);
+                qla2x00_dump_buffer(buf, sizeof(struct qla_flt_location));
+                return QLA_FUNCTION_FAILED;
+        }
+        /* Good data.  Use specified location. */
+        loc = locations[1];
+        *start = le16_to_cpu(fltl->start_hi) << 16 |
+            le16_to_cpu(fltl->start_lo);
+end:
+        DEBUG2(qla_printk(KERN_DEBUG, ha, "FLTL[%s] = 0x%x.\n", loc, *start));
+        return QLA_SUCCESS;
+}
+static void
+qla2xxx_get_flt_info(scsi_qla_host_t *ha, uint32_t flt_addr)
+{
+        const char *loc, *locations[] = { "DEF", "FLT" };
+        uint16_t *wptr;
+        uint16_t cnt, chksum;
+        uint32_t start;
+        struct qla_flt_header *flt;
+        struct qla_flt_region *region;
+        ha->flt_region_flt = flt_addr;
+        wptr = (uint16_t *)ha->request_ring;
+        flt = (struct qla_flt_header *)ha->request_ring;
+        region = (struct qla_flt_region *)&flt[1];
+        ha->isp_ops->read_optrom(ha, (uint8_t *)ha->request_ring,
+            flt_addr << 2, OPTROM_BURST_SIZE);
+        if (*wptr == __constant_cpu_to_le16(0xffff))
+                goto no_flash_data;
+        if (flt->version != __constant_cpu_to_le16(1)) {
+                DEBUG2(qla_printk(KERN_INFO, ha, "Unsupported FLT detected: "
+                    "version=0x%x length=0x%x checksum=0x%x.\n",
+                    le16_to_cpu(flt->version), le16_to_cpu(flt->length),
+                    le16_to_cpu(flt->checksum)));
+                goto no_flash_data;
+        }
+        cnt = (sizeof(struct qla_flt_header) + le16_to_cpu(flt->length)) >> 1;
+        for (chksum = 0; cnt; cnt--)
+                chksum += le16_to_cpu(*wptr++);
+        if (chksum) {
+                DEBUG2(qla_printk(KERN_INFO, ha, "Inconsistent FLT detected: "
+                    "version=0x%x length=0x%x checksum=0x%x.\n",
+                    le16_to_cpu(flt->version), le16_to_cpu(flt->length),
+                    chksum));
+                goto no_flash_data;
+        }
+        loc = locations[1];
+        cnt = le16_to_cpu(flt->length) / sizeof(struct qla_flt_region);
+        for ( ; cnt; cnt--, region++) {
+                /* Store addresses as DWORD offsets. */
+                start = le32_to_cpu(region->start) >> 2;
+                DEBUG3(qla_printk(KERN_DEBUG, ha, "FLT[%02x]: start=0x%x "
+                    "end=0x%x size=0x%x.\n", le32_to_cpu(region->code), start,
+                    le32_to_cpu(region->end) >> 2, le32_to_cpu(region->size)));
+                switch (le32_to_cpu(region->code)) {
+                case FLT_REG_FW:
+                        ha->flt_region_fw = start;
+                        break;
+                case FLT_REG_BOOT_CODE:
+                        ha->flt_region_boot = start;
+                        break;
+                case FLT_REG_VPD_0:
+                        ha->flt_region_vpd_nvram = start;
+                        break;
+                case FLT_REG_FDT:
+                        ha->flt_region_fdt = start;
+                        break;
+                case FLT_REG_HW_EVENT_0:
+                        if (!PCI_FUNC(ha->pdev->devfn))
+                                ha->flt_region_hw_event = start;
+                        break;
+                case FLT_REG_HW_EVENT_1:
+                        if (PCI_FUNC(ha->pdev->devfn))
+                                ha->flt_region_hw_event = start;
+                        break;
+                case FLT_REG_NPIV_CONF_0:
+                        if (!PCI_FUNC(ha->pdev->devfn))
+                                ha->flt_region_npiv_conf = start;
+                        break;
+                case FLT_REG_NPIV_CONF_1:
+                        if (PCI_FUNC(ha->pdev->devfn))
+                                ha->flt_region_npiv_conf = start;
+                        break;
+                }
+        }
+        goto done;
+no_flash_data:
+        /* Use hardcoded defaults. */
+        loc = locations[0];
+        ha->flt_region_fw = FA_RISC_CODE_ADDR;
+        ha->flt_region_boot = FA_BOOT_CODE_ADDR;
+        ha->flt_region_vpd_nvram = FA_VPD_NVRAM_ADDR;
+        ha->flt_region_fdt = IS_QLA24XX_TYPE(ha) ? FA_FLASH_DESCR_ADDR_24:
+            FA_FLASH_DESCR_ADDR;
+        ha->flt_region_hw_event = !PCI_FUNC(ha->pdev->devfn) ?
+            FA_HW_EVENT0_ADDR: FA_HW_EVENT1_ADDR;
+        ha->flt_region_npiv_conf = !PCI_FUNC(ha->pdev->devfn) ?
+            (IS_QLA24XX_TYPE(ha) ? FA_NPIV_CONF0_ADDR_24: FA_NPIV_CONF0_ADDR):
+            (IS_QLA24XX_TYPE(ha) ? FA_NPIV_CONF1_ADDR_24: FA_NPIV_CONF1_ADDR);
+done:
+        DEBUG2(qla_printk(KERN_DEBUG, ha, "FLT[%s]: boot=0x%x fw=0x%x "
+            "vpd_nvram=0x%x fdt=0x%x flt=0x%x hwe=0x%x npiv=0x%x.\n", loc,
+            ha->flt_region_boot, ha->flt_region_fw, ha->flt_region_vpd_nvram,
+            ha->flt_region_fdt, ha->flt_region_flt, ha->flt_region_hw_event,
+            ha->flt_region_npiv_conf));
+}
+static void
+qla2xxx_get_fdt_info(scsi_qla_host_t *ha)
 {
 #define FLASH_BLK_SIZE_32K      0x8000
 #define FLASH_BLK_SIZE_64K      0x10000
+        const char *loc, *locations[] = { "MID", "FDT" };
        uint16_t cnt, chksum;
        uint16_t *wptr;
        struct qla_fdt_layout *fdt;
        uint8_t man_id, flash_id;
+        uint16_t mid, fid;
-        if (!IS_QLA24XX_TYPE(ha) && !IS_QLA25XX(ha))
-                return;
        wptr = (uint16_t *)ha->request_ring;
        fdt = (struct qla_fdt_layout *)ha->request_ring;
        ha->isp_ops->read_optrom(ha, (uint8_t *)ha->request_ring,
-            FA_FLASH_DESCR_ADDR << 2, OPTROM_BURST_SIZE);
+            ha->flt_region_fdt << 2, OPTROM_BURST_SIZE);
        if (*wptr == __constant_cpu_to_le16(0xffff))
                goto no_flash_data;
        if (fdt->sig[0] != 'Q' || fdt->sig[1] != 'L' || fdt->sig[2] != 'I' ||
@@ -577,7 +752,10 @@ qla2xxx_get_flash_info(scsi_qla_host_t *ha)
                goto no_flash_data;
        }
-        ha->fdt_odd_index = le16_to_cpu(fdt->man_id) == 0x1f;
+        loc = locations[1];
+        mid = le16_to_cpu(fdt->man_id);
+        fid = le16_to_cpu(fdt->id);
+        ha->fdt_odd_index = mid == 0x1f;
        ha->fdt_wrt_disable = fdt->wrt_disable_bits;
        ha->fdt_erase_cmd = flash_conf_to_access_addr(0x0300 | fdt->erase_cmd);
        ha->fdt_block_size = le32_to_cpu(fdt->block_size);
@@ -588,16 +766,12 @@ qla2xxx_get_flash_info(scsi_qla_host_t *ha)
                    flash_conf_to_access_addr(0x0300 | fdt->protect_sec_cmd):
                    flash_conf_to_access_addr(0x0336);
        }
+        goto done;
-        DEBUG2(qla_printk(KERN_DEBUG, ha, "Flash[FDT]: (0x%x/0x%x) erase=0x%x "
-            "pro=%x upro=%x idx=%d wrtd=0x%x blk=0x%x.\n",
-            le16_to_cpu(fdt->man_id), le16_to_cpu(fdt->id), ha->fdt_erase_cmd,
-            ha->fdt_protect_sec_cmd, ha->fdt_unprotect_sec_cmd,
-            ha->fdt_odd_index, ha->fdt_wrt_disable, ha->fdt_block_size));
-        return;
 no_flash_data:
+        loc = locations[0];
        qla24xx_get_flash_manufacturer(ha, &man_id, &flash_id);
+        mid = man_id;
+        fid = flash_id;
        ha->fdt_wrt_disable = 0x9c;
        ha->fdt_erase_cmd = flash_conf_to_access_addr(0x03d8);
        switch (man_id) {
@@ -625,14 +799,117 @@ no_flash_data:
                ha->fdt_block_size = FLASH_BLK_SIZE_64K;
                break;
        }
+done:
-        DEBUG2(qla_printk(KERN_DEBUG, ha, "Flash[MID]: (0x%x/0x%x) erase=0x%x "
+        DEBUG2(qla_printk(KERN_DEBUG, ha, "FDT[%s]: (0x%x/0x%x) erase=0x%x "
-            "pro=%x upro=%x idx=%d wrtd=0x%x blk=0x%x.\n", man_id, flash_id,
+            "pro=%x upro=%x idx=%d wrtd=0x%x blk=0x%x.\n", loc, mid, fid,
            ha->fdt_erase_cmd, ha->fdt_protect_sec_cmd,
            ha->fdt_unprotect_sec_cmd, ha->fdt_odd_index, ha->fdt_wrt_disable,
            ha->fdt_block_size));
 }
+int
+qla2xxx_get_flash_info(scsi_qla_host_t *ha)
+{
+        int ret;
+        uint32_t flt_addr;
+        if (!IS_QLA24XX_TYPE(ha) && !IS_QLA25XX(ha))
+                return QLA_SUCCESS;
+        ret = qla2xxx_find_flt_start(ha, &flt_addr);
+        if (ret != QLA_SUCCESS)
+                return ret;
+        qla2xxx_get_flt_info(ha, flt_addr);
+        qla2xxx_get_fdt_info(ha);
+        return QLA_SUCCESS;
+}
+void
+qla2xxx_flash_npiv_conf(scsi_qla_host_t *ha)
+{
+#define NPIV_CONFIG_SIZE        (16*1024)
+        void *data;
+        uint16_t *wptr;
+        uint16_t cnt, chksum;
+        struct qla_npiv_header hdr;
+        struct qla_npiv_entry *entry;
+        if (!IS_QLA24XX_TYPE(ha) && !IS_QLA25XX(ha))
+                return;
+        ha->isp_ops->read_optrom(ha, (uint8_t *)&hdr,
+            ha->flt_region_npiv_conf << 2, sizeof(struct qla_npiv_header));
+        if (hdr.version == __constant_cpu_to_le16(0xffff))
+                return;
+        if (hdr.version != __constant_cpu_to_le16(1)) {
+                DEBUG2(qla_printk(KERN_INFO, ha, "Unsupported NPIV-Config "
+                    "detected: version=0x%x entries=0x%x checksum=0x%x.\n",
+                    le16_to_cpu(hdr.version), le16_to_cpu(hdr.entries),
+                    le16_to_cpu(hdr.checksum)));
+                return;
+        }
+        data = kmalloc(NPIV_CONFIG_SIZE, GFP_KERNEL);
+        if (!data) {
+                DEBUG2(qla_printk(KERN_INFO, ha, "NPIV-Config: Unable to "
+                    "allocate memory.\n"));
+                return;
+        }
+        ha->isp_ops->read_optrom(ha, (uint8_t *)data,
+            ha->flt_region_npiv_conf << 2, NPIV_CONFIG_SIZE);
+        cnt = (sizeof(struct qla_npiv_header) + le16_to_cpu(hdr.entries) *
+            sizeof(struct qla_npiv_entry)) >> 1;
+        for (wptr = data, chksum = 0; cnt; cnt--)
+                chksum += le16_to_cpu(*wptr++);
+        if (chksum) {
+                DEBUG2(qla_printk(KERN_INFO, ha, "Inconsistent NPIV-Config "
+                    "detected: version=0x%x entries=0x%x checksum=0x%x.\n",
+                    le16_to_cpu(hdr.version), le16_to_cpu(hdr.entries),
+                    chksum));
+                goto done;
+        }
+        entry = data + sizeof(struct qla_npiv_header);
+        cnt = le16_to_cpu(hdr.entries);
+        for ( ; cnt; cnt--, entry++) {
+                uint16_t flags;
+                struct fc_vport_identifiers vid;
+                struct fc_vport *vport;
+                flags = le16_to_cpu(entry->flags);
+                if (flags == 0xffff)
+                        continue;
+                if ((flags & BIT_0) == 0)
+                        continue;
+                memset(&vid, 0, sizeof(vid));
+                vid.roles = FC_PORT_ROLE_FCP_INITIATOR;
+                vid.vport_type = FC_PORTTYPE_NPIV;
+                vid.disable = false;
+                vid.port_name = wwn_to_u64(entry->port_name);
+                vid.node_name = wwn_to_u64(entry->node_name);
+                DEBUG2(qla_printk(KERN_DEBUG, ha, "NPIV[%02x]: wwpn=%llx "
+                    "wwnn=%llx vf_id=0x%x qos=0x%x.\n", cnt,
+                    (unsigned long long)vid.port_name,
+                    (unsigned long long)vid.node_name,
+                    le16_to_cpu(entry->vf_id), le16_to_cpu(entry->qos)));
+                vport = fc_vport_create(ha->host, 0, &vid);
+                if (!vport)
+                        qla_printk(KERN_INFO, ha, "NPIV-Config: Failed to "
+                            "create vport [%02x]: wwpn=%llx wwnn=%llx.\n", cnt,
+                            (unsigned long long)vid.port_name,
+                            (unsigned long long)vid.node_name);
+        }
+done:
+        kfree(data);
+}
 static void
 qla24xx_unprotect_flash(scsi_qla_host_t *ha)
 {
@@ -920,7 +1197,8 @@ qla25xx_read_nvram_data(scsi_qla_host_t *ha, uint8_t *buf, uint32_t naddr,
        dwptr = (uint32_t *)buf;
        for (i = 0; i < bytes >> 2; i++, naddr++)
                dwptr[i] = cpu_to_le32(qla24xx_read_flash_dword(ha,
-                    flash_data_to_access_addr(FA_VPD_NVRAM_ADDR | naddr)));
+                    flash_data_to_access_addr(ha->flt_region_vpd_nvram |
+                    naddr)));
        return buf;
 }
@@ -935,10 +1213,10 @@ qla25xx_write_nvram_data(scsi_qla_host_t *ha, uint8_t *buf, uint32_t naddr,
        dbuf = vmalloc(RMW_BUFFER_SIZE);
        if (!dbuf)
                return QLA_MEMORY_ALLOC_FAILED;
-        ha->isp_ops->read_optrom(ha, dbuf, FA_VPD_NVRAM_ADDR << 2,
+        ha->isp_ops->read_optrom(ha, dbuf, ha->flt_region_vpd_nvram << 2,
            RMW_BUFFER_SIZE);
        memcpy(dbuf + (naddr << 2), buf, bytes);
-        ha->isp_ops->write_optrom(ha, dbuf, FA_VPD_NVRAM_ADDR << 2,
+        ha->isp_ops->write_optrom(ha, dbuf, ha->flt_region_vpd_nvram << 2,
            RMW_BUFFER_SIZE);
        vfree(dbuf);
@@ -2166,7 +2444,7 @@ qla2x00_get_flash_version(scsi_qla_host_t *ha, void *mbuf)
                memset(dbyte, 0, 8);
                dcode = (uint16_t *)dbyte;
-                qla2x00_read_flash_data(ha, dbyte, FA_RISC_CODE_ADDR * 4 + 10,
+                qla2x00_read_flash_data(ha, dbyte, ha->flt_region_fw * 4 + 10,
                    8);
                DEBUG3(printk("%s(%ld): dumping fw ver from flash:\n",
                    __func__, ha->host_no));
@@ -2177,7 +2455,7 @@ qla2x00_get_flash_version(scsi_qla_host_t *ha, void *mbuf)
                    (dcode[0] == 0 && dcode[1] == 0 && dcode[2] == 0 &&
                    dcode[3] == 0)) {
                        DEBUG2(printk("%s(): Unrecognized fw revision at "
-                            "%x.\n", __func__, FA_RISC_CODE_ADDR * 4));
+                            "%x.\n", __func__, ha->flt_region_fw * 4));
                } else {
                        /* values are in big endian */
                        ha->fw_revision[0] = dbyte[0] << 16 | dbyte[1];
@@ -2212,7 +2490,7 @@ qla24xx_get_flash_version(scsi_qla_host_t *ha, void *mbuf)
        dcode = mbuf;
        /* Begin with first PCI expansion ROM header. */
-        pcihdr = 0;
+        pcihdr = ha->flt_region_boot;
        last_image = 1;
        do {
                /* Verify PCI expansion ROM header. */
@@ -2282,7 +2560,7 @@ qla24xx_get_flash_version(scsi_qla_host_t *ha, void *mbuf)
        memset(ha->fw_revision, 0, sizeof(ha->fw_revision));
        dcode = mbuf;
-        qla24xx_read_flash_data(ha, dcode, FA_RISC_CODE_ADDR + 4, 4);
+        qla24xx_read_flash_data(ha, dcode, ha->flt_region_fw + 4, 4);
        for (i = 0; i < 4; i++)
                dcode[i] = be32_to_cpu(dcode[i]);
@@ -2291,7 +2569,7 @@ qla24xx_get_flash_version(scsi_qla_host_t *ha, void *mbuf)
            (dcode[0] == 0 && dcode[1] == 0 && dcode[2] == 0 &&
            dcode[3] == 0)) {
                DEBUG2(printk("%s(): Unrecognized fw version at %x.\n",
-                    __func__, FA_RISC_CODE_ADDR));
+                    __func__, ha->flt_region_fw));
        } else {
                ha->fw_revision[0] = dcode[0];
                ha->fw_revision[1] = dcode[1];
@@ -2355,7 +2633,7 @@ qla2xxx_hw_event_store(scsi_qla_host_t *ha, uint32_t *fdata)
        /* Locate first empty entry. */
        for (;;) {
                if (ha->hw_event_ptr >=
-                    ha->hw_event_start + FA_HW_EVENT_SIZE) {
+                    ha->flt_region_hw_event + FA_HW_EVENT_SIZE) {
                        DEBUG2(qla_printk(KERN_WARNING, ha,
                            "HW event -- Log Full!\n"));
                        return QLA_MEMORY_ALLOC_FAILED;
@@ -2391,7 +2669,7 @@ qla2xxx_hw_event_log(scsi_qla_host_t *ha, uint16_t code, uint16_t d1,
        int rval;
        uint32_t marker[2], fdata[4];
-        if (ha->hw_event_start == 0)
+        if (ha->flt_region_hw_event == 0)
                return QLA_FUNCTION_FAILED;
        DEBUG2(qla_printk(KERN_WARNING, ha,
@@ -2406,7 +2684,7 @@ qla2xxx_hw_event_log(scsi_qla_host_t *ha, uint16_t code, uint16_t d1,
                    QLA_DRIVER_PATCH_VER, QLA_DRIVER_BETA_VER);
                /* Locate marker. */
-                ha->hw_event_ptr = ha->hw_event_start;
+                ha->hw_event_ptr = ha->flt_region_hw_event;
                for (;;) {
                        qla24xx_read_flash_data(ha, fdata, ha->hw_event_ptr,
                            4);
@@ -2415,7 +2693,7 @@ qla2xxx_hw_event_log(scsi_qla_host_t *ha, uint16_t code, uint16_t d1,
                                break;
                        ha->hw_event_ptr += FA_HW_EVENT_ENTRY_SIZE;
                        if (ha->hw_event_ptr >=
-                            ha->hw_event_start + FA_HW_EVENT_SIZE) {
+                            ha->flt_region_hw_event + FA_HW_EVENT_SIZE) {
                                DEBUG2(qla_printk(KERN_WARNING, ha,
                                    "HW event -- Log Full!\n"));
                                return QLA_MEMORY_ALLOC_FAILED;
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index 676c390db354..be5e299df528 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
 * Driver version
 */
-#define QLA2XXX_VERSION      "8.02.01-k6"
+#define QLA2XXX_VERSION      "8.02.01-k8"
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    2
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index 88bebb13bc52..de8279ad7d89 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -1542,7 +1542,7 @@ static int qla4xxx_eh_device_reset(struct scsi_cmnd *cmd)
        DEBUG2(printk(KERN_INFO
                      "scsi%ld: DEVICE_RESET cmd=%p jiffies = 0x%lx, to=%x,"
                      "dpc_flags=%lx, status=%x allowed=%d\n", ha->host_no,
-                      cmd, jiffies, cmd->timeout_per_command / HZ,
+                      cmd, jiffies, cmd->request->timeout / HZ,
                      ha->dpc_flags, cmd->result, cmd->allowed));
        /* FIXME: wait for hba to go online */
@@ -1598,7 +1598,7 @@ static int qla4xxx_eh_target_reset(struct scsi_cmnd *cmd)
        DEBUG2(printk(KERN_INFO
                      "scsi%ld: TARGET_DEVICE_RESET cmd=%p jiffies = 0x%lx, "
                      "to=%x,dpc_flags=%lx, status=%x allowed=%d\n",
-                      ha->host_no, cmd, jiffies, cmd->timeout_per_command / HZ,
+                      ha->host_no, cmd, jiffies, cmd->request->timeout / HZ,
                      ha->dpc_flags, cmd->result, cmd->allowed));
        stat = qla4xxx_reset_target(ha, ddb_entry);
diff --git a/drivers/scsi/qlogicpti.c b/drivers/scsi/qlogicpti.c
index 4a1cf6377f6c..69d6ad862b60 100644
--- a/drivers/scsi/qlogicpti.c
+++ b/drivers/scsi/qlogicpti.c
@@ -1,6 +1,6 @@
 /* qlogicpti.c: Performance Technologies QlogicISP sbus card driver.
 *
- * Copyright (C) 1996, 2006 David S. Miller (davem@davemloft.net)
+ * Copyright (C) 1996, 2006, 2008 David S. Miller (davem@davemloft.net)
 *
 * A lot of this driver was directly stolen from Erik H. Moe's PCI
 * Qlogic ISP driver.  Mucho kudos to him for this code.
@@ -25,12 +25,14 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/jiffies.h>
+#include <linux/dma-mapping.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
 #include <asm/byteorder.h>
 #include "qlogicpti.h"
-#include <asm/sbus.h>
 #include <asm/dma.h>
 #include <asm/system.h>
 #include <asm/ptrace.h>
@@ -157,7 +159,7 @@ static inline void set_sbus_cfg1(struct qlogicpti *qpti)
         * is a nop and the chip ends up using the smallest burst
         * size. -DaveM
         */
-        if (sbus_can_burst64(qpti->sdev) && (bursts & DMA_BURST64)) {
+        if (sbus_can_burst64() && (bursts & DMA_BURST64)) {
                val = (SBUS_CFG1_BENAB | SBUS_CFG1_B64);
        } else
 #endif
@@ -684,19 +686,19 @@ static void __devexit qpti_chain_del(struct qlogicpti *qpti)
 static int __devinit qpti_map_regs(struct qlogicpti *qpti)
 {
-        struct sbus_dev *sdev = qpti->sdev;
+        struct of_device *op = qpti->op;
-        qpti->qregs = sbus_ioremap(&sdev->resource[0], 0,
+        qpti->qregs = of_ioremap(&op->resource[0], 0,
-                                   sdev->reg_addrs[0].reg_size,
+                                 resource_size(&op->resource[0]),
-                                   "PTI Qlogic/ISP");
+                                 "PTI Qlogic/ISP");
        if (!qpti->qregs) {
                printk("PTI: Qlogic/ISP registers are unmappable\n");
                return -1;
        }
        if (qpti->is_pti) {
-                qpti->sreg = sbus_ioremap(&sdev->resource[0], (16 * 4096),
+                qpti->sreg = of_ioremap(&op->resource[0], (16 * 4096),
-                                          sizeof(unsigned char),
+                                        sizeof(unsigned char),
-                                          "PTI Qlogic/ISP statreg");
+                                        "PTI Qlogic/ISP statreg");
                if (!qpti->sreg) {
                        printk("PTI: Qlogic/ISP status register is unmappable\n");
                        return -1;
@@ -707,9 +709,9 @@ static int __devinit qpti_map_regs(struct qlogicpti *qpti)
 static int __devinit qpti_register_irq(struct qlogicpti *qpti)
 {
-        struct sbus_dev *sdev = qpti->sdev;
+        struct of_device *op = qpti->op;
-        qpti->qhost->irq = qpti->irq = sdev->irqs[0];
+        qpti->qhost->irq = qpti->irq = op->irqs[0];
        /* We used to try various overly-clever things to
         * reduce the interrupt processing overhead on
@@ -732,17 +734,19 @@ fail:
 static void __devinit qpti_get_scsi_id(struct qlogicpti *qpti)
 {
-        qpti->scsi_id = prom_getintdefault(qpti->prom_node,
+        struct of_device *op = qpti->op;
-                                           "initiator-id",
+        struct device_node *dp;
-                                           -1);
+        dp = op->node;
+        qpti->scsi_id = of_getintprop_default(dp, "initiator-id", -1);
        if (qpti->scsi_id == -1)
-                qpti->scsi_id = prom_getintdefault(qpti->prom_node,
+                qpti->scsi_id = of_getintprop_default(dp, "scsi-initiator-id",
-                                                   "scsi-initiator-id",
+                                                      -1);
-                                                   -1);
        if (qpti->scsi_id == -1)
                qpti->scsi_id =
-                        prom_getintdefault(qpti->sdev->bus->prom_node,
+                        of_getintprop_default(dp->parent,
-                                           "scsi-initiator-id", 7);
+                                              "scsi-initiator-id", 7);
        qpti->qhost->this_id = qpti->scsi_id;
        qpti->qhost->max_sectors = 64;
@@ -751,12 +755,11 @@ static void __devinit qpti_get_scsi_id(struct qlogicpti *qpti)
 static void qpti_get_bursts(struct qlogicpti *qpti)
 {
-        struct sbus_dev *sdev = qpti->sdev;
+        struct of_device *op = qpti->op;
        u8 bursts, bmask;
-        bursts = prom_getintdefault(qpti->prom_node, "burst-sizes", 0xff);
+        bursts = of_getintprop_default(op->node, "burst-sizes", 0xff);
-        bmask = prom_getintdefault(sdev->bus->prom_node,
+        bmask = of_getintprop_default(op->node->parent, "burst-sizes", 0xff);
-                                   "burst-sizes", 0xff);
        if (bmask != 0xff)
                bursts &= bmask;
        if (bursts == 0xff ||
@@ -785,25 +788,25 @@ static void qpti_get_clock(struct qlogicpti *qpti)
 */
 static int __devinit qpti_map_queues(struct qlogicpti *qpti)
 {
-        struct sbus_dev *sdev = qpti->sdev;
+        struct of_device *op = qpti->op;
 #define QSIZE(entries)  (((entries) + 1) * QUEUE_ENTRY_LEN)
-        qpti->res_cpu = sbus_alloc_consistent(sdev,
+        qpti->res_cpu = dma_alloc_coherent(&op->dev,
-                                              QSIZE(RES_QUEUE_LEN),
+                                           QSIZE(RES_QUEUE_LEN),
-                                              &qpti->res_dvma);
+                                           &qpti->res_dvma, GFP_ATOMIC);
        if (qpti->res_cpu == NULL ||
            qpti->res_dvma == 0) {
                printk("QPTI: Cannot map response queue.\n");
                return -1;
        }
-        qpti->req_cpu = sbus_alloc_consistent(sdev,
+        qpti->req_cpu = dma_alloc_coherent(&op->dev,
-                                              QSIZE(QLOGICPTI_REQ_QUEUE_LEN),
+                                           QSIZE(QLOGICPTI_REQ_QUEUE_LEN),
-                                              &qpti->req_dvma);
+                                           &qpti->req_dvma, GFP_ATOMIC);
        if (qpti->req_cpu == NULL ||
            qpti->req_dvma == 0) {
-                sbus_free_consistent(sdev, QSIZE(RES_QUEUE_LEN),
+                dma_free_coherent(&op->dev, QSIZE(RES_QUEUE_LEN),
-                                     qpti->res_cpu, qpti->res_dvma);
+                                  qpti->res_cpu, qpti->res_dvma);
                printk("QPTI: Cannot map request queue.\n");
                return -1;
        }
@@ -875,8 +878,9 @@ static inline int load_cmd(struct scsi_cmnd *Cmnd, struct Command_Entry *cmd,
                int sg_count;
                sg = scsi_sglist(Cmnd);
-                sg_count = sbus_map_sg(qpti->sdev, sg, scsi_sg_count(Cmnd),
+                sg_count = dma_map_sg(&qpti->op->dev, sg,
-                                                      Cmnd->sc_data_direction);
+                                      scsi_sg_count(Cmnd),
+                                      Cmnd->sc_data_direction);
                ds = cmd->dataseg;
                cmd->segment_cnt = sg_count;
@@ -914,6 +918,7 @@ static inline int load_cmd(struct scsi_cmnd *Cmnd, struct Command_Entry *cmd,
                                ds[i].d_count = sg_dma_len(s);
                        }
                        sg_count -= n;
+                        sg = s;
                }
        } else {
                cmd->dataseg[0].d_base = 0;
@@ -1151,9 +1156,9 @@ static struct scsi_cmnd *qlogicpti_intr_handler(struct qlogicpti *qpti)
                        Cmnd->result = DID_ERROR << 16;
                if (scsi_bufflen(Cmnd))
-                        sbus_unmap_sg(qpti->sdev,
+                        dma_unmap_sg(&qpti->op->dev,
-                                      scsi_sglist(Cmnd), scsi_sg_count(Cmnd),
+                                     scsi_sglist(Cmnd), scsi_sg_count(Cmnd),
-                                      Cmnd->sc_data_direction);
+                                     Cmnd->sc_data_direction);
                qpti->cmd_count[Cmnd->device->id]--;
                sbus_writew(out_ptr, qpti->qregs + MBOX5);
@@ -1267,34 +1272,32 @@ static struct scsi_host_template qpti_template = {
        .use_clustering         = ENABLE_CLUSTERING,
 };
-static int __devinit qpti_sbus_probe(struct of_device *dev, const struct of_device_id *match)
+static int __devinit qpti_sbus_probe(struct of_device *op, const struct of_device_id *match)
 {
-        static int nqptis;
-        struct sbus_dev *sdev = to_sbus_device(&dev->dev);
-        struct device_node *dp = dev->node;
        struct scsi_host_template *tpnt = match->data;
+        struct device_node *dp = op->node;
        struct Scsi_Host *host;
        struct qlogicpti *qpti;
+        static int nqptis;
        const char *fcode;
        /* Sometimes Antares cards come up not completely
         * setup, and we get a report of a zero IRQ.
         */
-        if (sdev->irqs[0] == 0)
+        if (op->irqs[0] == 0)
                return -ENODEV;
        host = scsi_host_alloc(tpnt, sizeof(struct qlogicpti));
        if (!host)
                return -ENOMEM;
-        qpti = (struct qlogicpti *) host->hostdata;
+        qpti = shost_priv(host);
        host->max_id = MAX_TARGETS;
        qpti->qhost = host;
-        qpti->sdev = sdev;
+        qpti->op = op;
        qpti->qpti_id = nqptis;
-        qpti->prom_node = sdev->prom_node;
+        strcpy(qpti->prom_name, op->node->name);
-        strcpy(qpti->prom_name, sdev->ofdev.node->name);
        qpti->is_pti = strcmp(qpti->prom_name, "QLGC,isp");
        if (qpti_map_regs(qpti) < 0)
@@ -1340,12 +1343,12 @@ static int __devinit qpti_sbus_probe(struct of_device *dev, const struct of_devi
                (qpti->ultra ? "Ultra" : "Fast"),
                (qpti->differential ? "differential" : "single ended"));
-        if (scsi_add_host(host, &dev->dev)) {
+        if (scsi_add_host(host, &op->dev)) {
                printk("qlogicpti%d: Failed scsi_add_host\n", qpti->qpti_id);
                goto fail_unmap_queues;
        }
-        dev_set_drvdata(&sdev->ofdev.dev, qpti);
+        dev_set_drvdata(&op->dev, qpti);
        qpti_chain_add(qpti);
@@ -1356,19 +1359,20 @@ static int __devinit qpti_sbus_probe(struct of_device *dev, const struct of_devi
 fail_unmap_queues:
 #define QSIZE(entries)  (((entries) + 1) * QUEUE_ENTRY_LEN)
-        sbus_free_consistent(qpti->sdev,
+        dma_free_coherent(&op->dev,
-                             QSIZE(RES_QUEUE_LEN),
+                          QSIZE(RES_QUEUE_LEN),
-                             qpti->res_cpu, qpti->res_dvma);
+                          qpti->res_cpu, qpti->res_dvma);
-        sbus_free_consistent(qpti->sdev,
+        dma_free_coherent(&op->dev,
-                             QSIZE(QLOGICPTI_REQ_QUEUE_LEN),
+                          QSIZE(QLOGICPTI_REQ_QUEUE_LEN),
-                             qpti->req_cpu, qpti->req_dvma);
+                          qpti->req_cpu, qpti->req_dvma);
 #undef QSIZE
 fail_unmap_regs:
-        sbus_iounmap(qpti->qregs,
+        of_iounmap(&op->resource[0], qpti->qregs,
-                     qpti->sdev->reg_addrs[0].reg_size);
+                   resource_size(&op->resource[0]));
        if (qpti->is_pti)
-                sbus_iounmap(qpti->sreg, sizeof(unsigned char));
+                of_iounmap(&op->resource[0], qpti->sreg,
+                           sizeof(unsigned char));
 fail_free_irq:
        free_irq(qpti->irq, qpti);
@@ -1379,9 +1383,9 @@ fail_unlink:
        return -ENODEV;
 }
-static int __devexit qpti_sbus_remove(struct of_device *dev)
+static int __devexit qpti_sbus_remove(struct of_device *op)
 {
-        struct qlogicpti *qpti = dev_get_drvdata(&dev->dev);
+        struct qlogicpti *qpti = dev_get_drvdata(&op->dev);
        qpti_chain_del(qpti);
@@ -1394,24 +1398,25 @@ static int __devexit qpti_sbus_remove(struct of_device *dev)
        free_irq(qpti->irq, qpti);
 #define QSIZE(entries)  (((entries) + 1) * QUEUE_ENTRY_LEN)
-        sbus_free_consistent(qpti->sdev,
+        dma_free_coherent(&op->dev,
-                             QSIZE(RES_QUEUE_LEN),
+                          QSIZE(RES_QUEUE_LEN),
-                             qpti->res_cpu, qpti->res_dvma);
+                          qpti->res_cpu, qpti->res_dvma);
-        sbus_free_consistent(qpti->sdev,
+        dma_free_coherent(&op->dev,
-                             QSIZE(QLOGICPTI_REQ_QUEUE_LEN),
+                          QSIZE(QLOGICPTI_REQ_QUEUE_LEN),
-                             qpti->req_cpu, qpti->req_dvma);
+                          qpti->req_cpu, qpti->req_dvma);
 #undef QSIZE
-        sbus_iounmap(qpti->qregs, qpti->sdev->reg_addrs[0].reg_size);
+        of_iounmap(&op->resource[0], qpti->qregs,
+                   resource_size(&op->resource[0]));
        if (qpti->is_pti)
-                sbus_iounmap(qpti->sreg, sizeof(unsigned char));
+                of_iounmap(&op->resource[0], qpti->sreg, sizeof(unsigned char));
        scsi_host_put(qpti->qhost);
        return 0;
 }
-static struct of_device_id qpti_match[] = {
+static const struct of_device_id qpti_match[] = {
        {
                .name = "ptisp",
                .data = &qpti_template,
@@ -1441,7 +1446,7 @@ static struct of_platform_driver qpti_sbus_driver = {
 static int __init qpti_init(void)
 {
-        return of_register_driver(&qpti_sbus_driver, &sbus_bus_type);
+        return of_register_driver(&qpti_sbus_driver, &of_bus_type);
 }
 static void __exit qpti_exit(void)
@@ -1452,7 +1457,7 @@ static void __exit qpti_exit(void)
 MODULE_DESCRIPTION("QlogicISP SBUS driver");
 MODULE_AUTHOR("David S. Miller (davem@davemloft.net)");
 MODULE_LICENSE("GPL");
-MODULE_VERSION("2.0");
+MODULE_VERSION("2.1");
 module_init(qpti_init);
 module_exit(qpti_exit);
diff --git a/drivers/scsi/qlogicpti.h b/drivers/scsi/qlogicpti.h
index ef6da2df584b..9c053bbaa877 100644
--- a/drivers/scsi/qlogicpti.h
+++ b/drivers/scsi/qlogicpti.h
@@ -342,7 +342,7 @@ struct qlogicpti {
        u_int                     req_in_ptr;           /* index of next request slot */
        u_int                     res_out_ptr;          /* index of next result slot  */
        long                      send_marker;          /* must we send a marker?     */
-        struct sbus_dev          *sdev;
+        struct of_device         *op;
        unsigned long             __pad;
        int                       cmd_count[MAX_TARGETS];
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index ee6be596503d..2ac3cb2b9081 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -291,7 +291,6 @@ struct scsi_cmnd *scsi_get_command(struct scsi_device *dev, gfp_t gfp_mask)
                unsigned long flags;
                cmd->device = dev;
-                init_timer(&cmd->eh_timeout);
                INIT_LIST_HEAD(&cmd->list);
                spin_lock_irqsave(&dev->list_lock, flags);
                list_add_tail(&cmd->list, &dev->cmd_list);
@@ -652,26 +651,33 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
        unsigned long timeout;
        int rtn = 0;
+        /*
+         * We will use a queued command if possible, otherwise we will
+         * emulate the queuing and calling of completion function ourselves.
+         */
+        atomic_inc(&cmd->device->iorequest_cnt);
        /* check if the device is still usable */
        if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
                /* in SDEV_DEL we error all commands. DID_NO_CONNECT
                 * returns an immediate error upwards, and signals
                 * that the device is no longer present */
                cmd->result = DID_NO_CONNECT << 16;
-                atomic_inc(&cmd->device->iorequest_cnt);
+                scsi_done(cmd);
-                __scsi_done(cmd);
                /* return 0 (because the command has been processed) */
                goto out;
        }
-        /* Check to see if the scsi lld put this device into state SDEV_BLOCK. */
+        /* Check to see if the scsi lld made this device blocked. */
-        if (unlikely(cmd->device->sdev_state == SDEV_BLOCK)) {
+        if (unlikely(scsi_device_blocked(cmd->device))) {
                /* 
-                 * in SDEV_BLOCK, the command is just put back on the device
+                 * in blocked state, the command is just put back on
-                 * queue.  The suspend state has already blocked the queue so
+                 * the device queue.  The suspend state has already
-                 * future requests should not occur until the device 
+                 * blocked the queue so future requests should not
-                 * transitions out of the suspend state.
+                 * occur until the device transitions out of the
+                 * suspend state.
                 */
                scsi_queue_insert(cmd, SCSI_MLQUEUE_DEVICE_BUSY);
                SCSI_LOG_MLQUEUE(3, printk("queuecommand : device blocked \n"));
@@ -714,21 +720,9 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
                host->resetting = 0;
        }
-        /* 
-         * AK: unlikely race here: for some reason the timer could
-         * expire before the serial number is set up below.
-         */
-        scsi_add_timer(cmd, cmd->timeout_per_command, scsi_times_out);
        scsi_log_send(cmd);
        /*
-         * We will use a queued command if possible, otherwise we will
-         * emulate the queuing and calling of completion function ourselves.
-         */
-        atomic_inc(&cmd->device->iorequest_cnt);
-        /*
         * Before we queue this command, check if the command
         * length exceeds what the host adapter can handle.
         */
@@ -744,6 +738,12 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
        }
        spin_lock_irqsave(host->host_lock, flags);
+        /*
+         * AK: unlikely race here: for some reason the timer could
+         * expire before the serial number is set up below.
+         *
+         * TODO: kill serial or move to blk layer
+         */
        scsi_cmd_get_serial(host, cmd); 
        if (unlikely(host->shost_state == SHOST_DEL)) {
@@ -754,12 +754,8 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
        }
        spin_unlock_irqrestore(host->host_lock, flags);
        if (rtn) {
-                if (scsi_delete_timer(cmd)) {
+                scsi_queue_insert(cmd, (rtn == SCSI_MLQUEUE_DEVICE_BUSY) ?
-                        atomic_inc(&cmd->device->iodone_cnt);
+                                                rtn : SCSI_MLQUEUE_HOST_BUSY);
-                        scsi_queue_insert(cmd,
-                                          (rtn == SCSI_MLQUEUE_DEVICE_BUSY) ?
-                                          rtn : SCSI_MLQUEUE_HOST_BUSY);
-                }
                SCSI_LOG_MLQUEUE(3,
                    printk("queuecommand : request rejected\n"));
        }
@@ -770,24 +766,6 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
 }
 /**
- * scsi_req_abort_cmd -- Request command recovery for the specified command
- * @cmd: pointer to the SCSI command of interest
- *
- * This function requests that SCSI Core start recovery for the
- * command by deleting the timer and adding the command to the eh
- * queue.  It can be called by either LLDDs or SCSI Core.  LLDDs who
- * implement their own error recovery MAY ignore the timeout event if
- * they generated scsi_req_abort_cmd.
- */
-void scsi_req_abort_cmd(struct scsi_cmnd *cmd)
-{
-        if (!scsi_delete_timer(cmd))
-                return;
-        scsi_times_out(cmd);
-}
-EXPORT_SYMBOL(scsi_req_abort_cmd);
-/**
 * scsi_done - Enqueue the finished SCSI command into the done queue.
 * @cmd: The SCSI Command for which a low-level device driver (LLDD) gives
 * ownership back to SCSI Core -- i.e. the LLDD has finished with it.
@@ -802,42 +780,7 @@ EXPORT_SYMBOL(scsi_req_abort_cmd);
 */
 static void scsi_done(struct scsi_cmnd *cmd)
 {
-        /*
+        blk_complete_request(cmd->request);
-         * We don't have to worry about this one timing out anymore.
-         * If we are unable to remove the timer, then the command
-         * has already timed out.  In which case, we have no choice but to
-         * let the timeout function run, as we have no idea where in fact
-         * that function could really be.  It might be on another processor,
-         * etc, etc.
-         */
-        if (!scsi_delete_timer(cmd))
-                return;
-        __scsi_done(cmd);
-}
-/* Private entry to scsi_done() to complete a command when the timer
- * isn't running --- used by scsi_times_out */
-void __scsi_done(struct scsi_cmnd *cmd)
-{
-        struct request *rq = cmd->request;
-        /*
-         * Set the serial numbers back to zero
-         */
-        cmd->serial_number = 0;
-        atomic_inc(&cmd->device->iodone_cnt);
-        if (cmd->result)
-                atomic_inc(&cmd->device->ioerr_cnt);
-        BUG_ON(!rq);
-        /*
-         * The uptodate/nbytes values don't matter, as we allow partial
-         * completes and thus will check this in the softirq callback
-         */
-        rq->completion_data = cmd;
-        blk_complete_request(rq);
 }
 /* Move this to a header if it becomes more generally useful */
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 880051c89bde..fecefa05cb62 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -112,69 +112,8 @@ int scsi_eh_scmd_add(struct scsi_cmnd *scmd, int eh_flag)
 }
 /**
- * scsi_add_timer - Start timeout timer for a single scsi command.
- * @scmd:       scsi command that is about to start running.
- * @timeout:    amount of time to allow this command to run.
- * @complete:   timeout function to call if timer isn't canceled.
- *
- * Notes:
- *    This should be turned into an inline function.  Each scsi command
- *    has its own timer, and as it is added to the queue, we set up the
- *    timer.  When the command completes, we cancel the timer.
- */
-void scsi_add_timer(struct scsi_cmnd *scmd, int timeout,
-                    void (*complete)(struct scsi_cmnd *))
-{
-        /*
-         * If the clock was already running for this command, then
-         * first delete the timer.  The timer handling code gets rather
-         * confused if we don't do this.
-         */
-        if (scmd->eh_timeout.function)
-                del_timer(&scmd->eh_timeout);
-        scmd->eh_timeout.data = (unsigned long)scmd;
-        scmd->eh_timeout.expires = jiffies + timeout;
-        scmd->eh_timeout.function = (void (*)(unsigned long)) complete;
-        SCSI_LOG_ERROR_RECOVERY(5, printk("%s: scmd: %p, time:"
-                                          " %d, (%p)\n", __func__,
-                                          scmd, timeout, complete));
-        add_timer(&scmd->eh_timeout);
-}
-/**
- * scsi_delete_timer - Delete/cancel timer for a given function.
- * @scmd:       Cmd that we are canceling timer for
- *
- * Notes:
- *     This should be turned into an inline function.
- *
- * Return value:
- *     1 if we were able to detach the timer.  0 if we blew it, and the
- *     timer function has already started to run.
- */
-int scsi_delete_timer(struct scsi_cmnd *scmd)
-{
-        int rtn;
-        rtn = del_timer(&scmd->eh_timeout);
-        SCSI_LOG_ERROR_RECOVERY(5, printk("%s: scmd: %p,"
-                                         " rtn: %d\n", __func__,
-                                         scmd, rtn));
-        scmd->eh_timeout.data = (unsigned long)NULL;
-        scmd->eh_timeout.function = NULL;
-        return rtn;
-}
-/**
 * scsi_times_out - Timeout function for normal scsi commands.
- * @scmd:       Cmd that is timing out.
+ * @req:        request that is timing out.
 *
 * Notes:
 *     We do not need to lock this.  There is the potential for a race
@@ -182,9 +121,11 @@ int scsi_delete_timer(struct scsi_cmnd *scmd)
 *     normal completion function determines that the timer has already
 *     fired, then it mustn't do anything.
 */
-void scsi_times_out(struct scsi_cmnd *scmd)
+enum blk_eh_timer_return scsi_times_out(struct request *req)
 {
-        enum scsi_eh_timer_return (* eh_timed_out)(struct scsi_cmnd *);
+        struct scsi_cmnd *scmd = req->special;
+        enum blk_eh_timer_return (*eh_timed_out)(struct scsi_cmnd *);
+        enum blk_eh_timer_return rtn = BLK_EH_NOT_HANDLED;
        scsi_log_completion(scmd, TIMEOUT_ERROR);
@@ -196,22 +137,20 @@ void scsi_times_out(struct scsi_cmnd *scmd)
                eh_timed_out = NULL;
        if (eh_timed_out)
-                switch (eh_timed_out(scmd)) {
+                rtn = eh_timed_out(scmd);
-                case EH_HANDLED:
+                switch (rtn) {
-                        __scsi_done(scmd);
+                case BLK_EH_NOT_HANDLED:
-                        return;
-                case EH_RESET_TIMER:
-                        scsi_add_timer(scmd, scmd->timeout_per_command,
-                                       scsi_times_out);
-                        return;
-                case EH_NOT_HANDLED:
                        break;
+                default:
+                        return rtn;
                }
        if (unlikely(!scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD))) {
                scmd->result |= DID_TIME_OUT << 16;
-                __scsi_done(scmd);
+                return BLK_EH_HANDLED;
        }
+        return BLK_EH_NOT_HANDLED;
 }
 /**
@@ -391,7 +330,7 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
        case HARDWARE_ERROR:
                if (scmd->device->retry_hwerror)
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                else
                        return SUCCESS;
@@ -1793,7 +1732,6 @@ scsi_reset_provider(struct scsi_device *dev, int flag)
        blk_rq_init(NULL, &req);
        scmd->request = &req;
-        memset(&scmd->eh_timeout, 0, sizeof(scmd->eh_timeout));
        scmd->cmnd = req.cmd;
@@ -1804,8 +1742,6 @@ scsi_reset_provider(struct scsi_device *dev, int flag)
        scmd->sc_data_direction         = DMA_BIDIRECTIONAL;
-        init_timer(&scmd->eh_timeout);
        spin_lock_irqsave(shost->host_lock, flags);
        shost->tmf_in_progress = 1;
        spin_unlock_irqrestore(shost->host_lock, flags);
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ff5d56b3ee4d..98ee55ced592 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -852,7 +852,7 @@ static void scsi_end_bidi_request(struct scsi_cmnd *cmd)
 void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
 {
        int result = cmd->result;
-        int this_count = scsi_bufflen(cmd);
+        int this_count;
        struct request_queue *q = cmd->device->request_queue;
        struct request *req = cmd->request;
        int error = 0;
@@ -908,6 +908,7 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
         */
        if (scsi_end_request(cmd, error, good_bytes, result == 0) == NULL)
                return;
+        this_count = blk_rq_bytes(req);
        /* good_bytes = 0, or (inclusive) there were leftovers and
         * result = 0, so scsi_end_request couldn't retry.
@@ -1180,7 +1181,6 @@ int scsi_setup_blk_pc_cmnd(struct scsi_device *sdev, struct request *req)
        
        cmd->transfersize = req->data_len;
        cmd->allowed = req->retries;
-        cmd->timeout_per_command = req->timeout;
        return BLKPREP_OK;
 }
 EXPORT_SYMBOL(scsi_setup_blk_pc_cmnd);
@@ -1250,6 +1250,7 @@ int scsi_prep_state_check(struct scsi_device *sdev, struct request *req)
                        break;
                case SDEV_QUIESCE:
                case SDEV_BLOCK:
+                case SDEV_CREATED_BLOCK:
                        /*
                         * If the devices is blocked we defer normal commands.
                         */
@@ -1415,17 +1416,26 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
        spin_unlock(shost->host_lock);
        spin_lock(sdev->request_queue->queue_lock);
-        __scsi_done(cmd);
+        blk_complete_request(req);
 }
 static void scsi_softirq_done(struct request *rq)
 {
-        struct scsi_cmnd *cmd = rq->completion_data;
+        struct scsi_cmnd *cmd = rq->special;
-        unsigned long wait_for = (cmd->allowed + 1) * cmd->timeout_per_command;
+        unsigned long wait_for = (cmd->allowed + 1) * rq->timeout;
        int disposition;
        INIT_LIST_HEAD(&cmd->eh_entry);
+        /*
+         * Set the serial numbers back to zero
+         */
+        cmd->serial_number = 0;
+        atomic_inc(&cmd->device->iodone_cnt);
+        if (cmd->result)
+                atomic_inc(&cmd->device->ioerr_cnt);
        disposition = scsi_decide_disposition(cmd);
        if (disposition != SUCCESS &&
            time_before(cmd->jiffies_at_alloc + wait_for, jiffies)) {
@@ -1674,6 +1684,7 @@ struct request_queue *scsi_alloc_queue(struct scsi_device *sdev)
        blk_queue_prep_rq(q, scsi_prep_fn);
        blk_queue_softirq_done(q, scsi_softirq_done);
+        blk_queue_rq_timed_out(q, scsi_times_out);
        return q;
 }
@@ -2063,10 +2074,13 @@ scsi_device_set_state(struct scsi_device *sdev, enum scsi_device_state state)
        switch (state) {
        case SDEV_CREATED:
-                /* There are no legal states that come back to
+                switch (oldstate) {
-                 * created.  This is the manually initialised start
+                case SDEV_CREATED_BLOCK:
-                 * state */
+                        break;
-                goto illegal;
+                default:
+                        goto illegal;
+                }
+                break;
                        
        case SDEV_RUNNING:
                switch (oldstate) {
@@ -2104,8 +2118,17 @@ scsi_device_set_state(struct scsi_device *sdev, enum scsi_device_state state)
        case SDEV_BLOCK:
                switch (oldstate) {
-                case SDEV_CREATED:
                case SDEV_RUNNING:
+                case SDEV_CREATED_BLOCK:
+                        break;
+                default:
+                        goto illegal;
+                }
+                break;
+        case SDEV_CREATED_BLOCK:
+                switch (oldstate) {
+                case SDEV_CREATED:
                        break;
                default:
                        goto illegal;
@@ -2393,8 +2416,12 @@ scsi_internal_device_block(struct scsi_device *sdev)
        int err = 0;
        err = scsi_device_set_state(sdev, SDEV_BLOCK);
-        if (err)
+        if (err) {
-                return err;
+                err = scsi_device_set_state(sdev, SDEV_CREATED_BLOCK);
+                if (err)
+                        return err;
+        }
        /* 
         * The device has transitioned to SDEV_BLOCK.  Stop the
@@ -2437,8 +2464,12 @@ scsi_internal_device_unblock(struct scsi_device *sdev)
         * and goose the device queue if successful.  
         */
        err = scsi_device_set_state(sdev, SDEV_RUNNING);
-        if (err)
+        if (err) {
-                return err;
+                err = scsi_device_set_state(sdev, SDEV_CREATED);
+                if (err)
+                        return err;
+        }
        spin_lock_irqsave(q->queue_lock, flags);
        blk_start_queue(q);
diff --git a/drivers/scsi/scsi_netlink.c b/drivers/scsi/scsi_netlink.c
index ae7ed9a22662..b37e133de805 100644
--- a/drivers/scsi/scsi_netlink.c
+++ b/drivers/scsi/scsi_netlink.c
@@ -21,6 +21,7 @@
 #include <linux/time.h>
 #include <linux/jiffies.h>
 #include <linux/security.h>
+#include <linux/delay.h>
 #include <net/sock.h>
 #include <net/netlink.h>
@@ -30,6 +31,39 @@
 struct sock *scsi_nl_sock = NULL;
 EXPORT_SYMBOL_GPL(scsi_nl_sock);
+static DEFINE_SPINLOCK(scsi_nl_lock);
+static struct list_head scsi_nl_drivers;
+static u32      scsi_nl_state;
+#define STATE_EHANDLER_BSY              0x00000001
+struct scsi_nl_transport {
+        int (*msg_handler)(struct sk_buff *);
+        void (*event_handler)(struct notifier_block *, unsigned long, void *);
+        unsigned int refcnt;
+        int flags;
+};
+/* flags values (bit flags) */
+#define HANDLER_DELETING                0x1
+static struct scsi_nl_transport transports[SCSI_NL_MAX_TRANSPORTS] =
+        { {NULL, }, };
+struct scsi_nl_drvr {
+        struct list_head next;
+        int (*dmsg_handler)(struct Scsi_Host *shost, void *payload,
+                                 u32 len, u32 pid);
+        void (*devt_handler)(struct notifier_block *nb,
+                                 unsigned long event, void *notify_ptr);
+        struct scsi_host_template *hostt;
+        u64 vendor_id;
+        unsigned int refcnt;
+        int flags;
+};
 /**
 * scsi_nl_rcv_msg - Receive message handler.
@@ -45,8 +79,9 @@ scsi_nl_rcv_msg(struct sk_buff *skb)
 {
        struct nlmsghdr *nlh;
        struct scsi_nl_hdr *hdr;
-        uint32_t rlen;
+        unsigned long flags;
-        int err;
+        u32 rlen;
+        int err, tport;
        while (skb->len >= NLMSG_SPACE(0)) {
                err = 0;
@@ -65,7 +100,7 @@ scsi_nl_rcv_msg(struct sk_buff *skb)
                if (nlh->nlmsg_type != SCSI_TRANSPORT_MSG) {
                        err = -EBADMSG;
-                        return;
+                        goto next_msg;
                }
                hdr = NLMSG_DATA(nlh);
@@ -83,12 +118,27 @@ scsi_nl_rcv_msg(struct sk_buff *skb)
                if (nlh->nlmsg_len < (sizeof(*nlh) + hdr->msglen)) {
                        printk(KERN_WARNING "%s: discarding partial message\n",
                                 __func__);
-                        return;
+                        goto next_msg;
                }
                /*
-                 * We currently don't support anyone sending us a message
+                 * Deliver message to the appropriate transport
                 */
+                spin_lock_irqsave(&scsi_nl_lock, flags);
+                tport = hdr->transport;
+                if ((tport < SCSI_NL_MAX_TRANSPORTS) &&
+                    !(transports[tport].flags & HANDLER_DELETING) &&
+                    (transports[tport].msg_handler)) {
+                        transports[tport].refcnt++;
+                        spin_unlock_irqrestore(&scsi_nl_lock, flags);
+                        err = transports[tport].msg_handler(skb);
+                        spin_lock_irqsave(&scsi_nl_lock, flags);
+                        transports[tport].refcnt--;
+                } else
+                        err = -ENOENT;
+                spin_unlock_irqrestore(&scsi_nl_lock, flags);
 next_msg:
                if ((err) || (nlh->nlmsg_flags & NLM_F_ACK))
@@ -110,14 +160,42 @@ static int
 scsi_nl_rcv_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
        struct netlink_notify *n = ptr;
+        struct scsi_nl_drvr *driver;
+        unsigned long flags;
+        int tport;
        if (n->protocol != NETLINK_SCSITRANSPORT)
                return NOTIFY_DONE;
+        spin_lock_irqsave(&scsi_nl_lock, flags);
+        scsi_nl_state |= STATE_EHANDLER_BSY;
        /*
-         * Currently, we are not tracking PID's, etc. There is nothing
+         * Pass event on to any transports that may be listening
-         * to handle.
         */
+        for (tport = 0; tport < SCSI_NL_MAX_TRANSPORTS; tport++) {
+                if (!(transports[tport].flags & HANDLER_DELETING) &&
+                    (transports[tport].event_handler)) {
+                        spin_unlock_irqrestore(&scsi_nl_lock, flags);
+                        transports[tport].event_handler(this, event, ptr);
+                        spin_lock_irqsave(&scsi_nl_lock, flags);
+                }
+        }
+        /*
+         * Pass event on to any drivers that may be listening
+         */
+        list_for_each_entry(driver, &scsi_nl_drivers, next) {
+                if (!(driver->flags & HANDLER_DELETING) &&
+                    (driver->devt_handler)) {
+                        spin_unlock_irqrestore(&scsi_nl_lock, flags);
+                        driver->devt_handler(this, event, ptr);
+                        spin_lock_irqsave(&scsi_nl_lock, flags);
+                }
+        }
+        scsi_nl_state &= ~STATE_EHANDLER_BSY;
+        spin_unlock_irqrestore(&scsi_nl_lock, flags);
        return NOTIFY_DONE;
 }
@@ -128,7 +206,281 @@ static struct notifier_block scsi_netlink_notifier = {
 /**
- * scsi_netlink_init - Called by SCSI subsystem to intialize the SCSI transport netlink interface
+ * GENERIC SCSI transport receive and event handlers
+ **/
+/**
+ * scsi_generic_msg_handler - receive message handler for GENERIC transport
+ *                       messages
+ *
+ * @skb:                socket receive buffer
+ *
+ **/
+static int
+scsi_generic_msg_handler(struct sk_buff *skb)
+{
+        struct nlmsghdr *nlh = nlmsg_hdr(skb);
+        struct scsi_nl_hdr *snlh = NLMSG_DATA(nlh);
+        struct scsi_nl_drvr *driver;
+        struct Scsi_Host *shost;
+        unsigned long flags;
+        int err = 0, match, pid;
+        pid = NETLINK_CREDS(skb)->pid;
+        switch (snlh->msgtype) {
+        case SCSI_NL_SHOST_VENDOR:
+                {
+                struct scsi_nl_host_vendor_msg *msg = NLMSG_DATA(nlh);
+                /* Locate the driver that corresponds to the message */
+                spin_lock_irqsave(&scsi_nl_lock, flags);
+                match = 0;
+                list_for_each_entry(driver, &scsi_nl_drivers, next) {
+                        if (driver->vendor_id == msg->vendor_id) {
+                                match = 1;
+                                break;
+                        }
+                }
+                if ((!match) || (!driver->dmsg_handler)) {
+                        spin_unlock_irqrestore(&scsi_nl_lock, flags);
+                        err = -ESRCH;
+                        goto rcv_exit;
+                }
+                if (driver->flags & HANDLER_DELETING) {
+                        spin_unlock_irqrestore(&scsi_nl_lock, flags);
+                        err = -ESHUTDOWN;
+                        goto rcv_exit;
+                }
+                driver->refcnt++;
+                spin_unlock_irqrestore(&scsi_nl_lock, flags);
+                /* if successful, scsi_host_lookup takes a shost reference */
+                shost = scsi_host_lookup(msg->host_no);
+                if (!shost) {
+                        err = -ENODEV;
+                        goto driver_exit;
+                }
+                /* is this host owned by the vendor ? */
+                if (shost->hostt != driver->hostt) {
+                        err = -EINVAL;
+                        goto vendormsg_put;
+                }
+                /* pass message on to the driver */
+                err = driver->dmsg_handler(shost, (void *)&msg[1],
+                                         msg->vmsg_datalen, pid);
+vendormsg_put:
+                /* release reference by scsi_host_lookup */
+                scsi_host_put(shost);
+driver_exit:
+                /* release our own reference on the registration object */
+                spin_lock_irqsave(&scsi_nl_lock, flags);
+                driver->refcnt--;
+                spin_unlock_irqrestore(&scsi_nl_lock, flags);
+                break;
+                }
+        default:
+                err = -EBADR;
+                break;
+        }
+rcv_exit:
+        if (err)
+                printk(KERN_WARNING "%s: Msgtype %d failed - err %d\n",
+                         __func__, snlh->msgtype, err);
+        return err;
+}
+/**
+ * scsi_nl_add_transport -
+ *    Registers message and event handlers for a transport. Enables
+ *    receipt of netlink messages and events to a transport.
+ *
+ * @tport:              transport registering handlers
+ * @msg_handler:        receive message handler callback
+ * @event_handler:      receive event handler callback
+ **/
+int
+scsi_nl_add_transport(u8 tport,
+        int (*msg_handler)(struct sk_buff *),
+        void (*event_handler)(struct notifier_block *, unsigned long, void *))
+{
+        unsigned long flags;
+        int err = 0;
+        if (tport >= SCSI_NL_MAX_TRANSPORTS)
+                return -EINVAL;
+        spin_lock_irqsave(&scsi_nl_lock, flags);
+        if (scsi_nl_state & STATE_EHANDLER_BSY) {
+                spin_unlock_irqrestore(&scsi_nl_lock, flags);
+                msleep(1);
+                spin_lock_irqsave(&scsi_nl_lock, flags);
+        }
+        if (transports[tport].msg_handler || transports[tport].event_handler) {
+                err = -EALREADY;
+                goto register_out;
+        }
+        transports[tport].msg_handler = msg_handler;
+        transports[tport].event_handler = event_handler;
+        transports[tport].flags = 0;
+        transports[tport].refcnt = 0;
+register_out:
+        spin_unlock_irqrestore(&scsi_nl_lock, flags);
+        return err;
+}
+EXPORT_SYMBOL_GPL(scsi_nl_add_transport);
+/**
+ * scsi_nl_remove_transport -
+ *    Disable transport receiption of messages and events
+ *
+ * @tport:              transport deregistering handlers
+ *
+ **/
+void
+scsi_nl_remove_transport(u8 tport)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&scsi_nl_lock, flags);
+        if (scsi_nl_state & STATE_EHANDLER_BSY) {
+                spin_unlock_irqrestore(&scsi_nl_lock, flags);
+                msleep(1);
+                spin_lock_irqsave(&scsi_nl_lock, flags);
+        }
+        if (tport < SCSI_NL_MAX_TRANSPORTS) {
+                transports[tport].flags |= HANDLER_DELETING;
+                while (transports[tport].refcnt != 0) {
+                        spin_unlock_irqrestore(&scsi_nl_lock, flags);
+                        schedule_timeout_uninterruptible(HZ/4);
+                        spin_lock_irqsave(&scsi_nl_lock, flags);
+                }
+                transports[tport].msg_handler = NULL;
+                transports[tport].event_handler = NULL;
+                transports[tport].flags = 0;
+        }
+        spin_unlock_irqrestore(&scsi_nl_lock, flags);
+        return;
+}
+EXPORT_SYMBOL_GPL(scsi_nl_remove_transport);
+/**
+ * scsi_nl_add_driver -
+ *    A driver is registering its interfaces for SCSI netlink messages
+ *
+ * @vendor_id:          A unique identification value for the driver.
+ * @hostt:              address of the driver's host template. Used
+ *                      to verify an shost is bound to the driver
+ * @nlmsg_handler:      receive message handler callback
+ * @nlevt_handler:      receive event handler callback
+ *
+ * Returns:
+ *   0 on Success
+ *   error result otherwise
+ **/
+int
+scsi_nl_add_driver(u64 vendor_id, struct scsi_host_template *hostt,
+        int (*nlmsg_handler)(struct Scsi_Host *shost, void *payload,
+                                 u32 len, u32 pid),
+        void (*nlevt_handler)(struct notifier_block *nb,
+                                 unsigned long event, void *notify_ptr))
+{
+        struct scsi_nl_drvr *driver;
+        unsigned long flags;
+        driver = kzalloc(sizeof(*driver), GFP_KERNEL);
+        if (unlikely(!driver)) {
+                printk(KERN_ERR "%s: allocation failure\n", __func__);
+                return -ENOMEM;
+        }
+        driver->dmsg_handler = nlmsg_handler;
+        driver->devt_handler = nlevt_handler;
+        driver->hostt = hostt;
+        driver->vendor_id = vendor_id;
+        spin_lock_irqsave(&scsi_nl_lock, flags);
+        if (scsi_nl_state & STATE_EHANDLER_BSY) {
+                spin_unlock_irqrestore(&scsi_nl_lock, flags);
+                msleep(1);
+                spin_lock_irqsave(&scsi_nl_lock, flags);
+        }
+        list_add_tail(&driver->next, &scsi_nl_drivers);
+        spin_unlock_irqrestore(&scsi_nl_lock, flags);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(scsi_nl_add_driver);
+/**
+ * scsi_nl_remove_driver -
+ *    An driver is unregistering with the SCSI netlink messages
+ *
+ * @vendor_id:          The unique identification value for the driver.
+ **/
+void
+scsi_nl_remove_driver(u64 vendor_id)
+{
+        struct scsi_nl_drvr *driver;
+        unsigned long flags;
+        spin_lock_irqsave(&scsi_nl_lock, flags);
+        if (scsi_nl_state & STATE_EHANDLER_BSY) {
+                spin_unlock_irqrestore(&scsi_nl_lock, flags);
+                msleep(1);
+                spin_lock_irqsave(&scsi_nl_lock, flags);
+        }
+        list_for_each_entry(driver, &scsi_nl_drivers, next) {
+                if (driver->vendor_id == vendor_id) {
+                        driver->flags |= HANDLER_DELETING;
+                        while (driver->refcnt != 0) {
+                                spin_unlock_irqrestore(&scsi_nl_lock, flags);
+                                schedule_timeout_uninterruptible(HZ/4);
+                                spin_lock_irqsave(&scsi_nl_lock, flags);
+                        }
+                        list_del(&driver->next);
+                        kfree(driver);
+                        spin_unlock_irqrestore(&scsi_nl_lock, flags);
+                        return;
+                }
+        }
+        spin_unlock_irqrestore(&scsi_nl_lock, flags);
+        printk(KERN_ERR "%s: removal of driver failed - vendor_id 0x%llx\n",
+               __func__, (unsigned long long)vendor_id);
+        return;
+}
+EXPORT_SYMBOL_GPL(scsi_nl_remove_driver);
+/**
+ * scsi_netlink_init - Called by SCSI subsystem to intialize
+ *      the SCSI transport netlink interface
 *
 **/
 void
@@ -136,6 +488,8 @@ scsi_netlink_init(void)
 {
        int error;
+        INIT_LIST_HEAD(&scsi_nl_drivers);
        error = netlink_register_notifier(&scsi_netlink_notifier);
        if (error) {
                printk(KERN_ERR "%s: register of event handler failed - %d\n",
@@ -150,8 +504,15 @@ scsi_netlink_init(void)
                printk(KERN_ERR "%s: register of recieve handler failed\n",
                                __func__);
                netlink_unregister_notifier(&scsi_netlink_notifier);
+                return;
        }
+        /* Register the entry points for the generic SCSI transport */
+        error = scsi_nl_add_transport(SCSI_NL_TRANSPORT,
+                                scsi_generic_msg_handler, NULL);
+        if (error)
+                printk(KERN_ERR "%s: register of GENERIC transport handler"
+                                "  failed - %d\n", __func__, error);
        return;
 }
@@ -163,6 +524,8 @@ scsi_netlink_init(void)
 void
 scsi_netlink_exit(void)
 {
+        scsi_nl_remove_transport(SCSI_NL_TRANSPORT);
        if (scsi_nl_sock) {
                netlink_kernel_release(scsi_nl_sock);
                netlink_unregister_notifier(&scsi_netlink_notifier);
@@ -172,3 +535,147 @@ scsi_netlink_exit(void)
 }
+/*
+ * Exported Interfaces
+ */
+/**
+ * scsi_nl_send_transport_msg -
+ *    Generic function to send a single message from a SCSI transport to
+ *    a single process
+ *
+ * @pid:                receiving pid
+ * @hdr:                message payload
+ *
+ **/
+void
+scsi_nl_send_transport_msg(u32 pid, struct scsi_nl_hdr *hdr)
+{
+        struct sk_buff *skb;
+        struct nlmsghdr *nlh;
+        const char *fn;
+        char *datab;
+        u32 len, skblen;
+        int err;
+        if (!scsi_nl_sock) {
+                err = -ENOENT;
+                fn = "netlink socket";
+                goto msg_fail;
+        }
+        len = NLMSG_SPACE(hdr->msglen);
+        skblen = NLMSG_SPACE(len);
+        skb = alloc_skb(skblen, GFP_KERNEL);
+        if (!skb) {
+                err = -ENOBUFS;
+                fn = "alloc_skb";
+                goto msg_fail;
+        }
+        nlh = nlmsg_put(skb, pid, 0, SCSI_TRANSPORT_MSG, len - sizeof(*nlh), 0);
+        if (!nlh) {
+                err = -ENOBUFS;
+                fn = "nlmsg_put";
+                goto msg_fail_skb;
+        }
+        datab = NLMSG_DATA(nlh);
+        memcpy(datab, hdr, hdr->msglen);
+        err = nlmsg_unicast(scsi_nl_sock, skb, pid);
+        if (err < 0) {
+                fn = "nlmsg_unicast";
+                /* nlmsg_unicast already kfree_skb'd */
+                goto msg_fail;
+        }
+        return;
+msg_fail_skb:
+        kfree_skb(skb);
+msg_fail:
+        printk(KERN_WARNING
+                "%s: Dropped Message : pid %d Transport %d, msgtype x%x, "
+                "msglen %d: %s : err %d\n",
+                __func__, pid, hdr->transport, hdr->msgtype, hdr->msglen,
+                fn, err);
+        return;
+}
+EXPORT_SYMBOL_GPL(scsi_nl_send_transport_msg);
+/**
+ * scsi_nl_send_vendor_msg - called to send a shost vendor unique message
+ *                      to a specific process id.
+ *
+ * @pid:                process id of the receiver
+ * @host_no:            host # sending the message
+ * @vendor_id:          unique identifier for the driver's vendor
+ * @data_len:           amount, in bytes, of vendor unique payload data
+ * @data_buf:           pointer to vendor unique data buffer
+ *
+ * Returns:
+ *   0 on succesful return
+ *   otherwise, failing error code
+ *
+ * Notes:
+ *      This routine assumes no locks are held on entry.
+ */
+int
+scsi_nl_send_vendor_msg(u32 pid, unsigned short host_no, u64 vendor_id,
+                         char *data_buf, u32 data_len)
+{
+        struct sk_buff *skb;
+        struct nlmsghdr *nlh;
+        struct scsi_nl_host_vendor_msg *msg;
+        u32 len, skblen;
+        int err;
+        if (!scsi_nl_sock) {
+                err = -ENOENT;
+                goto send_vendor_fail;
+        }
+        len = SCSI_NL_MSGALIGN(sizeof(*msg) + data_len);
+        skblen = NLMSG_SPACE(len);
+        skb = alloc_skb(skblen, GFP_KERNEL);
+        if (!skb) {
+                err = -ENOBUFS;
+                goto send_vendor_fail;
+        }
+        nlh = nlmsg_put(skb, 0, 0, SCSI_TRANSPORT_MSG,
+                                skblen - sizeof(*nlh), 0);
+        if (!nlh) {
+                err = -ENOBUFS;
+                goto send_vendor_fail_skb;
+        }
+        msg = NLMSG_DATA(nlh);
+        INIT_SCSI_NL_HDR(&msg->snlh, SCSI_NL_TRANSPORT,
+                                SCSI_NL_SHOST_VENDOR, len);
+        msg->vendor_id = vendor_id;
+        msg->host_no = host_no;
+        msg->vmsg_datalen = data_len;   /* bytes */
+        memcpy(&msg[1], data_buf, data_len);
+        err = nlmsg_unicast(scsi_nl_sock, skb, pid);
+        if (err)
+                /* nlmsg_multicast already kfree_skb'd */
+                goto send_vendor_fail;
+        return 0;
+send_vendor_fail_skb:
+        kfree_skb(skb);
+send_vendor_fail:
+        printk(KERN_WARNING
+                "%s: Dropped SCSI Msg : host %d vendor_unique - err %d\n",
+                __func__, host_no, err);
+        return err;
+}
+EXPORT_SYMBOL(scsi_nl_send_vendor_msg);
diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h
index 79f0f7511204..6cddd5dd323c 100644
--- a/drivers/scsi/scsi_priv.h
+++ b/drivers/scsi/scsi_priv.h
@@ -4,6 +4,7 @@
 #include <linux/device.h>
 struct request_queue;
+struct request;
 struct scsi_cmnd;
 struct scsi_device;
 struct scsi_host_template;
@@ -27,7 +28,6 @@ extern void scsi_exit_hosts(void);
 extern int scsi_dispatch_cmd(struct scsi_cmnd *cmd);
 extern int scsi_setup_command_freelist(struct Scsi_Host *shost);
 extern void scsi_destroy_command_freelist(struct Scsi_Host *shost);
-extern void __scsi_done(struct scsi_cmnd *cmd);
 #ifdef CONFIG_SCSI_LOGGING
 void scsi_log_send(struct scsi_cmnd *cmd);
 void scsi_log_completion(struct scsi_cmnd *cmd, int disposition);
@@ -49,10 +49,7 @@ extern int __init scsi_init_devinfo(void);
 extern void scsi_exit_devinfo(void);
 /* scsi_error.c */
-extern void scsi_add_timer(struct scsi_cmnd *, int,
+extern enum blk_eh_timer_return scsi_times_out(struct request *req);
-                void (*)(struct scsi_cmnd *));
-extern int scsi_delete_timer(struct scsi_cmnd *);
-extern void scsi_times_out(struct scsi_cmnd *cmd);
 extern int scsi_error_handler(void *host);
 extern int scsi_decide_disposition(struct scsi_cmnd *cmd);
 extern void scsi_eh_wakeup(struct Scsi_Host *shost);
diff --git a/drivers/scsi/scsi_proc.c b/drivers/scsi/scsi_proc.c
index c6a904a45bf9..82f7b2dd08a2 100644
--- a/drivers/scsi/scsi_proc.c
+++ b/drivers/scsi/scsi_proc.c
@@ -259,8 +259,8 @@ static int scsi_add_single_device(uint host, uint channel, uint id, uint lun)
        int error = -ENXIO;
        shost = scsi_host_lookup(host);
-        if (IS_ERR(shost))
+        if (!shost)
-                return PTR_ERR(shost);
+                return error;
        if (shost->transportt->user_scan)
                error = shost->transportt->user_scan(shost, channel, id, lun);
@@ -287,8 +287,8 @@ static int scsi_remove_single_device(uint host, uint channel, uint id, uint lun)
        int error = -ENXIO;
        shost = scsi_host_lookup(host);
-        if (IS_ERR(shost))
+        if (!shost)
-                return PTR_ERR(shost);
+                return error;
        sdev = scsi_device_lookup(shost, channel, id, lun);
        if (sdev) {
                scsi_remove_device(sdev);
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 84b4879cff11..334862e26a1b 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -730,6 +730,8 @@ static int scsi_probe_lun(struct scsi_device *sdev, unsigned char *inq_result,
 static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
                int *bflags, int async)
 {
+        int ret;
        /*
         * XXX do not save the inquiry, since it can change underneath us,
         * save just vendor/model/rev.
@@ -885,7 +887,17 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
        /* set the device running here so that slave configure
         * may do I/O */
-        scsi_device_set_state(sdev, SDEV_RUNNING);
+        ret = scsi_device_set_state(sdev, SDEV_RUNNING);
+        if (ret) {
+                ret = scsi_device_set_state(sdev, SDEV_BLOCK);
+                if (ret) {
+                        sdev_printk(KERN_ERR, sdev,
+                                    "in wrong state %s to complete scan\n",
+                                    scsi_device_state_name(sdev->sdev_state));
+                        return SCSI_SCAN_NO_RESPONSE;
+                }
+        }
        if (*bflags & BLIST_MS_192_BYTES_FOR_3F)
                sdev->use_192_bytes_for_3f = 1;
@@ -899,7 +911,7 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
        transport_configure_device(&sdev->sdev_gendev);
        if (sdev->host->hostt->slave_configure) {
-                int ret = sdev->host->hostt->slave_configure(sdev);
+                ret = sdev->host->hostt->slave_configure(sdev);
                if (ret) {
                        /*
                         * if LLDD reports slave not present, don't clutter
@@ -994,7 +1006,7 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,
         */
        sdev = scsi_device_lookup_by_target(starget, lun);
        if (sdev) {
-                if (rescan || sdev->sdev_state != SDEV_CREATED) {
+                if (rescan || !scsi_device_created(sdev)) {
                        SCSI_LOG_SCAN_BUS(3, printk(KERN_INFO
                                "scsi scan: device exists on %s\n",
                                sdev->sdev_gendev.bus_id));
@@ -1080,7 +1092,8 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,
         * PDT=1Fh none (no FDD connected to the requested logical unit)
         */
        if (((result[0] >> 5) == 1 || starget->pdt_1f_for_no_lun) &&
-             (result[0] & 0x1f) == 0x1f) {
+            (result[0] & 0x1f) == 0x1f &&
+            !scsi_is_wlun(lun)) {
                SCSI_LOG_SCAN_BUS(3, printk(KERN_INFO
                                        "scsi scan: peripheral device type"
                                        " of 31, no device added\n"));
@@ -1466,7 +1479,7 @@ static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
        kfree(lun_data);
 out:
        scsi_device_put(sdev);
-        if (sdev->sdev_state == SDEV_CREATED)
+        if (scsi_device_created(sdev))
                /*
                 * the sdev we used didn't appear in the report luns scan
                 */
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index ab3c71869be5..93c28f30bbd7 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -34,6 +34,7 @@ static const struct {
        { SDEV_QUIESCE, "quiesce" },
        { SDEV_OFFLINE, "offline" },
        { SDEV_BLOCK,   "blocked" },
+        { SDEV_CREATED_BLOCK, "created-blocked" },
 };
 const char *scsi_device_state_name(enum scsi_device_state state)
@@ -560,12 +561,15 @@ sdev_rd_attr (vendor, "%.8s\n");
 sdev_rd_attr (model, "%.16s\n");
 sdev_rd_attr (rev, "%.4s\n");
+/*
+ * TODO: can we make these symlinks to the block layer ones?
+ */
 static ssize_t
 sdev_show_timeout (struct device *dev, struct device_attribute *attr, char *buf)
 {
        struct scsi_device *sdev;
        sdev = to_scsi_device(dev);
-        return snprintf (buf, 20, "%d\n", sdev->timeout / HZ);
+        return snprintf(buf, 20, "%d\n", sdev->request_queue->rq_timeout / HZ);
 }
 static ssize_t
@@ -576,7 +580,7 @@ sdev_store_timeout (struct device *dev, struct device_attribute *attr,
        int timeout;
        sdev = to_scsi_device(dev);
        sscanf (buf, "%d\n", &timeout);
-        sdev->timeout = timeout * HZ;
+        blk_queue_rq_timeout(sdev->request_queue, timeout * HZ);
        return count;
 }
 static DEVICE_ATTR(timeout, S_IRUGO | S_IWUSR, sdev_show_timeout, sdev_store_timeout);
diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
index 257e097c39af..48ba413f7f6a 100644
--- a/drivers/scsi/scsi_tgt_lib.c
+++ b/drivers/scsi/scsi_tgt_lib.c
@@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
        int err;
        dprintk("%lx %u\n", uaddr, len);
-        err = blk_rq_map_user(q, rq, (void *)uaddr, len);
+        err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
        if (err) {
                /*
                 * TODO: need to fixup sg_tablesize, max_segment_size,
@@ -460,7 +460,7 @@ int scsi_tgt_kspace_exec(int host_no, u64 itn_id, int result, u64 tag,
        /* TODO: replace with a O(1) alg */
        shost = scsi_host_lookup(host_no);
-        if (IS_ERR(shost)) {
+        if (!shost) {
                printk(KERN_ERR "Could not find host no %d\n", host_no);
                return -EINVAL;
        }
@@ -550,7 +550,7 @@ int scsi_tgt_kspace_tsk_mgmt(int host_no, u64 itn_id, u64 mid, int result)
        dprintk("%d %d %llx\n", host_no, result, (unsigned long long) mid);
        shost = scsi_host_lookup(host_no);
-        if (IS_ERR(shost)) {
+        if (!shost) {
                printk(KERN_ERR "Could not find host no %d\n", host_no);
                return err;
        }
@@ -603,7 +603,7 @@ int scsi_tgt_kspace_it_nexus_rsp(int host_no, u64 itn_id, int result)
        dprintk("%d %d%llx\n", host_no, result, (unsigned long long)itn_id);
        shost = scsi_host_lookup(host_no);
-        if (IS_ERR(shost)) {
+        if (!shost) {
                printk(KERN_ERR "Could not find host no %d\n", host_no);
                return err;
        }
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 56823fd1fb84..d5f7653bb94b 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -40,31 +40,7 @@
 static int fc_queue_work(struct Scsi_Host *, struct work_struct *);
 static void fc_vport_sched_delete(struct work_struct *work);
+static int fc_vport_setup(struct Scsi_Host *shost, int channel,
-/*
- * This is a temporary carrier for creating a vport. It will eventually
- * be replaced  by a real message definition for sgio or netlink.
- *
- * fc_vport_identifiers: This set of data contains all elements
- * to uniquely identify and instantiate a FC virtual port.
- *
- * Notes:
- *   symbolic_name: The driver is to append the symbolic_name string data
- *      to the symbolic_node_name data that it generates by default.
- *      the resulting combination should then be registered with the switch.
- *      It is expected that things like Xen may stuff a VM title into
- *      this field.
- */
-struct fc_vport_identifiers {
-        u64 node_name;
-        u64 port_name;
-        u32 roles;
-        bool disable;
-        enum fc_port_type vport_type;   /* only FC_PORTTYPE_NPIV allowed */
-        char symbolic_name[FC_VPORT_SYMBOLIC_NAMELEN];
-};
-static int fc_vport_create(struct Scsi_Host *shost, int channel,
        struct device *pdev, struct fc_vport_identifiers  *ids,
        struct fc_vport **vport);
@@ -1760,7 +1736,7 @@ store_fc_host_vport_create(struct device *dev, struct device_attribute *attr,
        vid.disable = false;            /* always enabled */
        /* we only allow support on Channel 0 !!! */
-        stat = fc_vport_create(shost, 0, &shost->shost_gendev, &vid, &vport);
+        stat = fc_vport_setup(shost, 0, &shost->shost_gendev, &vid, &vport);
        return stat ? stat : count;
 }
 static FC_DEVICE_ATTR(host, vport_create, S_IWUSR, NULL,
@@ -1950,15 +1926,15 @@ static int fc_vport_match(struct attribute_container *cont,
 * Notes:
 *      This routine assumes no locks are held on entry.
 */
-static enum scsi_eh_timer_return
+static enum blk_eh_timer_return
 fc_timed_out(struct scsi_cmnd *scmd)
 {
        struct fc_rport *rport = starget_to_rport(scsi_target(scmd->device));
        if (rport->port_state == FC_PORTSTATE_BLOCKED)
-                return EH_RESET_TIMER;
+                return BLK_EH_RESET_TIMER;
-        return EH_NOT_HANDLED;
+        return BLK_EH_NOT_HANDLED;
 }
 /*
@@ -3103,7 +3079,7 @@ fc_scsi_scan_rport(struct work_struct *work)
 /**
- * fc_vport_create - allocates and creates a FC virtual port.
+ * fc_vport_setup - allocates and creates a FC virtual port.
 * @shost:      scsi host the virtual port is connected to.
 * @channel:    Channel on shost port connected to.
 * @pdev:       parent device for vport
@@ -3118,7 +3094,7 @@ fc_scsi_scan_rport(struct work_struct *work)
 *      This routine assumes no locks are held on entry.
 */
 static int
-fc_vport_create(struct Scsi_Host *shost, int channel, struct device *pdev,
+fc_vport_setup(struct Scsi_Host *shost, int channel, struct device *pdev,
        struct fc_vport_identifiers  *ids, struct fc_vport **ret_vport)
 {
        struct fc_host_attrs *fc_host = shost_to_fc_host(shost);
@@ -3231,6 +3207,28 @@ delete_vport:
        return error;
 }
+/**
+ * fc_vport_create - Admin App or LLDD requests creation of a vport
+ * @shost:      scsi host the virtual port is connected to.
+ * @channel:    channel on shost port connected to.
+ * @ids:        The world wide names, FC4 port roles, etc for
+ *              the virtual port.
+ *
+ * Notes:
+ *      This routine assumes no locks are held on entry.
+ */
+struct fc_vport *
+fc_vport_create(struct Scsi_Host *shost, int channel,
+        struct fc_vport_identifiers *ids)
+{
+        int stat;
+        struct fc_vport *vport;
+        stat = fc_vport_setup(shost, channel, &shost->shost_gendev,
+                 ids, &vport);
+        return stat ? NULL : vport;
+}
+EXPORT_SYMBOL(fc_vport_create);
 /**
 * fc_vport_terminate - Admin App or LLDD requests termination of a vport
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 043c3921164f..0ce5f7cdfe2a 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -1361,7 +1361,7 @@ iscsi_tgt_dscvr(struct iscsi_transport *transport,
                return -EINVAL;
        shost = scsi_host_lookup(ev->u.tgt_dscvr.host_no);
-        if (IS_ERR(shost)) {
+        if (!shost) {
                printk(KERN_ERR "target discovery could not find host no %u\n",
                       ev->u.tgt_dscvr.host_no);
                return -ENODEV;
@@ -1387,7 +1387,7 @@ iscsi_set_host_param(struct iscsi_transport *transport,
                return -ENOSYS;
        shost = scsi_host_lookup(ev->u.set_host_param.host_no);
-        if (IS_ERR(shost)) {
+        if (!shost) {
                printk(KERN_ERR "set_host_param could not find host no %u\n",
                       ev->u.set_host_param.host_no);
                return -ENODEV;
diff --git a/drivers/scsi/scsi_transport_spi.c b/drivers/scsi/scsi_transport_spi.c
index 75a64a6cae8c..b29360ed0bdc 100644
--- a/drivers/scsi/scsi_transport_spi.c
+++ b/drivers/scsi/scsi_transport_spi.c
@@ -366,12 +366,14 @@ spi_transport_rd_attr(rti, "%d\n");
 spi_transport_rd_attr(pcomp_en, "%d\n");
 spi_transport_rd_attr(hold_mcs, "%d\n");
-/* we only care about the first child device so we return 1 */
+/* we only care about the first child device that's a real SCSI device
+ * so we return 1 to terminate the iteration when we find it */
 static int child_iter(struct device *dev, void *data)
 {
-        struct scsi_device *sdev = to_scsi_device(dev);
+        if (!scsi_is_sdev_device(dev))
+                return 0;
-        spi_dv_device(sdev);
+        spi_dv_device(to_scsi_device(dev));
        return 1;
 }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index e5e7d7856454..a7b53be63367 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -47,6 +47,7 @@
 #include <linux/blkpg.h>
 #include <linux/delay.h>
 #include <linux/mutex.h>
+#include <linux/string_helpers.h>
 #include <asm/uaccess.h>
 #include <scsi/scsi.h>
@@ -86,6 +87,12 @@ MODULE_ALIAS_SCSI_DEVICE(TYPE_DISK);
 MODULE_ALIAS_SCSI_DEVICE(TYPE_MOD);
 MODULE_ALIAS_SCSI_DEVICE(TYPE_RBC);
+#if !defined(CONFIG_DEBUG_BLOCK_EXT_DEVT)
+#define SD_MINORS       16
+#else
+#define SD_MINORS       0
+#endif
 static int  sd_revalidate_disk(struct gendisk *);
 static int  sd_probe(struct device *);
 static int  sd_remove(struct device *);
@@ -159,7 +166,7 @@ sd_store_cache_type(struct device *dev, struct device_attribute *attr,
                        sd_print_sense_hdr(sdkp, &sshdr);
                return -EINVAL;
        }
-        sd_revalidate_disk(sdkp->disk);
+        revalidate_disk(sdkp->disk);
        return count;
 }
@@ -377,7 +384,6 @@ static int sd_prep_fn(struct request_queue *q, struct request *rq)
        sector_t block = rq->sector;
        sector_t threshold;
        unsigned int this_count = rq->nr_sectors;
-        unsigned int timeout = sdp->timeout;
        int ret;
        if (rq->cmd_type == REQ_TYPE_BLOCK_PC) {
@@ -578,7 +584,6 @@ static int sd_prep_fn(struct request_queue *q, struct request *rq)
        SCpnt->transfersize = sdp->sector_size;
        SCpnt->underflow = this_count << 9;
        SCpnt->allowed = SD_MAX_RETRIES;
-        SCpnt->timeout_per_command = timeout;
        /*
         * This indicates that the command is ready from our end to be
@@ -910,7 +915,7 @@ static void sd_rescan(struct device *dev)
        struct scsi_disk *sdkp = scsi_disk_get_from_dev(dev);
        if (sdkp) {
-                sd_revalidate_disk(sdkp->disk);
+                revalidate_disk(sdkp->disk);
                scsi_disk_put(sdkp);
        }
 }
@@ -1429,27 +1434,21 @@ got_data:
                 */
                sector_size = 512;
        }
+        blk_queue_hardsect_size(sdp->request_queue, sector_size);
        {
-                /*
+                char cap_str_2[10], cap_str_10[10];
-                 * The msdos fs needs to know the hardware sector size
+                u64 sz = sdkp->capacity << ffz(~sector_size);
-                 * So I have created this table. See ll_rw_blk.c
-                 * Jacques Gelinas (Jacques@solucorp.qc.ca)
-                 */
-                int hard_sector = sector_size;
-                sector_t sz = (sdkp->capacity/2) * (hard_sector/256);
-                struct request_queue *queue = sdp->request_queue;
-                sector_t mb = sz;
-                blk_queue_hardsect_size(queue, hard_sector);
+                string_get_size(sz, STRING_UNITS_2, cap_str_2,
-                /* avoid 64-bit division on 32-bit platforms */
+                                sizeof(cap_str_2));
-                sector_div(sz, 625);
+                string_get_size(sz, STRING_UNITS_10, cap_str_10,
-                mb -= sz - 974;
+                                sizeof(cap_str_10));
-                sector_div(mb, 1950);
                sd_printk(KERN_NOTICE, sdkp,
-                          "%llu %d-byte hardware sectors (%llu MB)\n",
+                          "%llu %d-byte hardware sectors: (%s/%s)\n",
                          (unsigned long long)sdkp->capacity,
-                          hard_sector, (unsigned long long)mb);
+                          sector_size, cap_str_10, cap_str_2);
        }
        /* Rescale capacity to 512-byte units */
@@ -1764,6 +1763,52 @@ static int sd_revalidate_disk(struct gendisk *disk)
 }
 /**
+ *      sd_format_disk_name - format disk name
+ *      @prefix: name prefix - ie. "sd" for SCSI disks
+ *      @index: index of the disk to format name for
+ *      @buf: output buffer
+ *      @buflen: length of the output buffer
+ *
+ *      SCSI disk names starts at sda.  The 26th device is sdz and the
+ *      27th is sdaa.  The last one for two lettered suffix is sdzz
+ *      which is followed by sdaaa.
+ *
+ *      This is basically 26 base counting with one extra 'nil' entry
+ *      at the beggining from the second digit on and can be
+ *      determined using similar method as 26 base conversion with the
+ *      index shifted -1 after each digit is computed.
+ *
+ *      CONTEXT:
+ *      Don't care.
+ *
+ *      RETURNS:
+ *      0 on success, -errno on failure.
+ */
+static int sd_format_disk_name(char *prefix, int index, char *buf, int buflen)
+{
+        const int base = 'z' - 'a' + 1;
+        char *begin = buf + strlen(prefix);
+        char *end = buf + buflen;
+        char *p;
+        int unit;
+        p = end - 1;
+        *p = '\0';
+        unit = base;
+        do {
+                if (p == begin)
+                        return -EINVAL;
+                *--p = 'a' + (index % unit);
+                index = (index / unit) - 1;
+        } while (index >= 0);
+        memmove(begin, p, end - p);
+        memcpy(buf, prefix, strlen(prefix));
+        return 0;
+}
+/**
 *      sd_probe - called during driver initialization and whenever a
 *      new scsi device is attached to the system. It is called once
 *      for each scsi device (not just disks) present.
@@ -1801,7 +1846,7 @@ static int sd_probe(struct device *dev)
        if (!sdkp)
                goto out;
-        gd = alloc_disk(16);
+        gd = alloc_disk(SD_MINORS);
        if (!gd)
                goto out_free;
@@ -1815,8 +1860,8 @@ static int sd_probe(struct device *dev)
        if (error)
                goto out_put;
-        error = -EBUSY;
+        error = sd_format_disk_name("sd", index, gd->disk_name, DISK_NAME_LEN);
-        if (index >= SD_MAX_DISKS)
+        if (error)
                goto out_free_index;
        sdkp->device = sdp;
@@ -1826,11 +1871,12 @@ static int sd_probe(struct device *dev)
        sdkp->openers = 0;
        sdkp->previous_state = 1;
-        if (!sdp->timeout) {
+        if (!sdp->request_queue->rq_timeout) {
                if (sdp->type != TYPE_MOD)
-                        sdp->timeout = SD_TIMEOUT;
+                        blk_queue_rq_timeout(sdp->request_queue, SD_TIMEOUT);
                else
-                        sdp->timeout = SD_MOD_TIMEOUT;
+                        blk_queue_rq_timeout(sdp->request_queue,
+                                             SD_MOD_TIMEOUT);
        }
        device_initialize(&sdkp->dev);
@@ -1843,24 +1889,12 @@ static int sd_probe(struct device *dev)
        get_device(&sdp->sdev_gendev);
-        gd->major = sd_major((index & 0xf0) >> 4);
+        if (index < SD_MAX_DISKS) {
-        gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);
+                gd->major = sd_major((index & 0xf0) >> 4);
-        gd->minors = 16;
+                gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);
-        gd->fops = &sd_fops;
+                gd->minors = SD_MINORS;
-        if (index < 26) {
-                sprintf(gd->disk_name, "sd%c", 'a' + index % 26);
-        } else if (index < (26 + 1) * 26) {
-                sprintf(gd->disk_name, "sd%c%c",
-                        'a' + index / 26 - 1,'a' + index % 26);
-        } else {
-                const unsigned int m1 = (index / 26 - 1) / 26 - 1;
-                const unsigned int m2 = (index / 26 - 1) % 26;
-                const unsigned int m3 =  index % 26;
-                sprintf(gd->disk_name, "sd%c%c%c",
-                        'a' + m1, 'a' + m2, 'a' + m3);
        }
+        gd->fops = &sd_fops;
        gd->private_data = &sdkp->driver;
        gd->queue = sdkp->device->request_queue;
@@ -1869,7 +1903,7 @@ static int sd_probe(struct device *dev)
        blk_queue_prep_rq(sdp->request_queue, sd_prep_fn);
        gd->driverfs_dev = &sdp->sdev_gendev;
-        gd->flags = GENHD_FL_DRIVERFS;
+        gd->flags = GENHD_FL_EXT_DEVT | GENHD_FL_DRIVERFS;
        if (sdp->removable)
                gd->flags |= GENHD_FL_REMOVABLE;
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 0fe031f003e7..1bcf3c33d7ff 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -345,14 +345,14 @@ static int ses_enclosure_find_by_addr(struct enclosure_device *edev,
        return 0;
 }
-#define VPD_INQUIRY_SIZE 512
+#define VPD_INQUIRY_SIZE 36
 static void ses_match_to_enclosure(struct enclosure_device *edev,
                                   struct scsi_device *sdev)
 {
        unsigned char *buf = kmalloc(VPD_INQUIRY_SIZE, GFP_KERNEL);
        unsigned char *desc;
-        int len;
+        u16 vpd_len;
        struct efd efd = {
                .addr = 0,
        };
@@ -372,9 +372,19 @@ static void ses_match_to_enclosure(struct enclosure_device *edev,
                             VPD_INQUIRY_SIZE, NULL, SES_TIMEOUT, SES_RETRIES))
                goto free;
-        len = (buf[2] << 8) + buf[3];
+        vpd_len = (buf[2] << 8) + buf[3];
+        kfree(buf);
+        buf = kmalloc(vpd_len, GFP_KERNEL);
+        if (!buf)
+                return;
+        cmd[3] = vpd_len >> 8;
+        cmd[4] = vpd_len & 0xff;
+        if (scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf,
+                             vpd_len, NULL, SES_TIMEOUT, SES_RETRIES))
+                goto free;
        desc = buf + 4;
-        while (desc < buf + len) {
+        while (desc < buf + vpd_len) {
                enum scsi_protocol proto = desc[0] >> 4;
                u8 code_set = desc[0] & 0x0f;
                u8 piv = desc[1] & 0x80;
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index d3b8ebb83776..ba9b9bbd4e73 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -47,7 +47,6 @@ static int sg_version_num = 30534;	/* 2 digits for each component */
 #include <linux/seq_file.h>
 #include <linux/blkdev.h>
 #include <linux/delay.h>
-#include <linux/scatterlist.h>
 #include <linux/blktrace_api.h>
 #include <linux/smp_lock.h>
@@ -69,7 +68,6 @@ static void sg_proc_cleanup(void);
 #endif
 #define SG_ALLOW_DIO_DEF 0
-#define SG_ALLOW_DIO_CODE /* compile out by commenting this define */
 #define SG_MAX_DEVS 32768
@@ -118,8 +116,8 @@ typedef struct sg_scatter_hold { /* holding area for scsi scatter gather info */
        unsigned short k_use_sg; /* Count of kernel scatter-gather pieces */
        unsigned sglist_len; /* size of malloc'd scatter-gather list ++ */
        unsigned bufflen;       /* Size of (aggregate) data buffer */
-        unsigned b_malloc_len;  /* actual len malloc'ed in buffer */
+        struct page **pages;
-        struct scatterlist *buffer;/* scatter list */
+        int page_order;
        char dio_in_use;        /* 0->indirect IO (or mmap), 1->dio */
        unsigned char cmd_opcode; /* first byte of command */
 } Sg_scatter_hold;
@@ -137,6 +135,8 @@ typedef struct sg_request {	/* SG_MAX_QUEUE requests outstanding per file */
        char orphan;            /* 1 -> drop on sight, 0 -> normal */
        char sg_io_owned;       /* 1 -> packet belongs to SG_IO */
        volatile char done;     /* 0->before bh, 1->before read, 2->read */
+        struct request *rq;
+        struct bio *bio;
 } Sg_request;
 typedef struct sg_fd {          /* holds the state of a file descriptor */
@@ -175,8 +175,8 @@ typedef struct sg_device { /* holds the state of each scsi generic device */
 static int sg_fasync(int fd, struct file *filp, int mode);
 /* tasklet or soft irq callback */
-static void sg_cmd_done(void *data, char *sense, int result, int resid);
+static void sg_rq_end_io(struct request *rq, int uptodate);
-static int sg_start_req(Sg_request * srp);
+static int sg_start_req(Sg_request *srp, unsigned char *cmd);
 static void sg_finish_rem_req(Sg_request * srp);
 static int sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size);
 static int sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp,
@@ -188,17 +188,11 @@ static ssize_t sg_new_write(Sg_fd *sfp, struct file *file,
                        int read_only, Sg_request **o_srp);
 static int sg_common_write(Sg_fd * sfp, Sg_request * srp,
                           unsigned char *cmnd, int timeout, int blocking);
-static int sg_u_iovec(sg_io_hdr_t * hp, int sg_num, int ind,
-                      int wr_xf, int *countp, unsigned char __user **up);
-static int sg_write_xfer(Sg_request * srp);
-static int sg_read_xfer(Sg_request * srp);
 static int sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer);
 static void sg_remove_scat(Sg_scatter_hold * schp);
 static void sg_build_reserve(Sg_fd * sfp, int req_size);
 static void sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size);
 static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp);
-static struct page *sg_page_malloc(int rqSz, int lowDma, int *retSzp);
-static void sg_page_free(struct page *page, int size);
 static Sg_fd *sg_add_sfp(Sg_device * sdp, int dev);
 static int sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp);
 static void __sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp);
@@ -206,7 +200,6 @@ static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id);
 static Sg_request *sg_add_request(Sg_fd * sfp);
 static int sg_remove_request(Sg_fd * sfp, Sg_request * srp);
 static int sg_res_in_use(Sg_fd * sfp);
-static int sg_build_direct(Sg_request * srp, Sg_fd * sfp, int dxfer_len);
 static Sg_device *sg_get_dev(int dev);
 #ifdef CONFIG_SCSI_PROC_FS
 static int sg_last_dev(void);
@@ -217,6 +210,18 @@ static int sg_last_dev(void);
 #define SZ_SG_IOVEC sizeof(sg_iovec_t)
 #define SZ_SG_REQ_INFO sizeof(sg_req_info_t)
+static int sg_allow_access(struct file *filp, unsigned char *cmd)
+{
+        struct sg_fd *sfp = (struct sg_fd *)filp->private_data;
+        struct request_queue *q = sfp->parentdp->device->request_queue;
+        if (sfp->parentdp->device->type == TYPE_SCANNER)
+                return 0;
+        return blk_verify_command(&q->cmd_filter,
+                                  cmd, filp->f_mode & FMODE_WRITE);
+}
 static int
 sg_open(struct inode *inode, struct file *filp)
 {
@@ -517,8 +522,7 @@ sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
                err = -EFAULT;
                goto err_out;
        }
-        err = sg_read_xfer(srp);
+err_out:
-      err_out:
        sg_finish_rem_req(srp);
        return (0 == err) ? count : err;
 }
@@ -600,7 +604,10 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
        else
                hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE;
        hp->dxfer_len = mxsize;
-        hp->dxferp = (char __user *)buf + cmd_size;
+        if (hp->dxfer_direction == SG_DXFER_TO_DEV)
+                hp->dxferp = (char __user *)buf + cmd_size;
+        else
+                hp->dxferp = NULL;
        hp->sbp = NULL;
        hp->timeout = old_hdr.reply_len;        /* structure abuse ... */
        hp->flags = input_size; /* structure abuse ... */
@@ -689,7 +696,7 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
                sg_remove_request(sfp, srp);
                return -EFAULT;
        }
-        if (read_only && !blk_verify_command(file, cmnd)) {
+        if (read_only && sg_allow_access(file, cmnd)) {
                sg_remove_request(sfp, srp);
                return -EPERM;
        }
@@ -720,16 +727,12 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
        SCSI_LOG_TIMEOUT(4, printk("sg_common_write:  scsi opcode=0x%02x, cmd_size=%d\n",
                          (int) cmnd[0], (int) hp->cmd_len));
-        if ((k = sg_start_req(srp))) {
+        k = sg_start_req(srp, cmnd);
+        if (k) {
                SCSI_LOG_TIMEOUT(1, printk("sg_common_write: start_req err=%d\n", k));
                sg_finish_rem_req(srp);
                return k;       /* probably out of space --> ENOMEM */
        }
-        if ((k = sg_write_xfer(srp))) {
-                SCSI_LOG_TIMEOUT(1, printk("sg_common_write: write_xfer, bad address\n"));
-                sg_finish_rem_req(srp);
-                return k;
-        }
        if (sdp->detached) {
                sg_finish_rem_req(srp);
                return -ENODEV;
@@ -751,20 +754,11 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
                break;
        }
        hp->duration = jiffies_to_msecs(jiffies);
-/* Now send everything of to mid-level. The next time we hear about this
-   packet is when sg_cmd_done() is called (i.e. a callback). */
+        srp->rq->timeout = timeout;
-        if (scsi_execute_async(sdp->device, cmnd, hp->cmd_len, data_dir, srp->data.buffer,
+        blk_execute_rq_nowait(sdp->device->request_queue, sdp->disk,
-                                hp->dxfer_len, srp->data.k_use_sg, timeout,
+                              srp->rq, 1, sg_rq_end_io);
-                                SG_DEFAULT_RETRIES, srp, sg_cmd_done,
+        return 0;
-                                GFP_ATOMIC)) {
-                SCSI_LOG_TIMEOUT(1, printk("sg_common_write: scsi_execute_async failed\n"));
-                /*
-                 * most likely out of mem, but could also be a bad map
-                 */
-                sg_finish_rem_req(srp);
-                return -ENOMEM;
-        } else
-                return 0;
 }
 static int
@@ -793,6 +787,7 @@ sg_ioctl(struct inode *inode, struct file *filp,
        if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
                return -ENXIO;
        SCSI_LOG_TIMEOUT(3, printk("sg_ioctl: %s, cmd=0x%x\n",
                                   sdp->disk->disk_name, (int) cmd_in));
        read_only = (O_RDWR != (filp->f_flags & O_ACCMODE));
@@ -1061,7 +1056,7 @@ sg_ioctl(struct inode *inode, struct file *filp,
                        if (copy_from_user(&opcode, siocp->data, 1))
                                return -EFAULT;
-                        if (!blk_verify_command(filp, &opcode))
+                        if (sg_allow_access(filp, &opcode))
                                return -EPERM;
                }
                return sg_scsi_ioctl(filp, sdp->device->request_queue, NULL, p);
@@ -1179,8 +1174,7 @@ sg_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
        Sg_fd *sfp;
        unsigned long offset, len, sa;
        Sg_scatter_hold *rsv_schp;
-        struct scatterlist *sg;
+        int k, length;
-        int k;
        if ((NULL == vma) || (!(sfp = (Sg_fd *) vma->vm_private_data)))
                return VM_FAULT_SIGBUS;
@@ -1190,15 +1184,14 @@ sg_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
                return VM_FAULT_SIGBUS;
        SCSI_LOG_TIMEOUT(3, printk("sg_vma_fault: offset=%lu, scatg=%d\n",
                                   offset, rsv_schp->k_use_sg));
-        sg = rsv_schp->buffer;
        sa = vma->vm_start;
-        for (k = 0; (k < rsv_schp->k_use_sg) && (sa < vma->vm_end);
+        length = 1 << (PAGE_SHIFT + rsv_schp->page_order);
-             ++k, sg = sg_next(sg)) {
+        for (k = 0; k < rsv_schp->k_use_sg && sa < vma->vm_end; k++) {
                len = vma->vm_end - sa;
-                len = (len < sg->length) ? len : sg->length;
+                len = (len < length) ? len : length;
                if (offset < len) {
-                        struct page *page;
+                        struct page *page = nth_page(rsv_schp->pages[k],
-                        page = virt_to_page(page_address(sg_page(sg)) + offset);
+                                                     offset >> PAGE_SHIFT);
                        get_page(page); /* increment page count */
                        vmf->page = page;
                        return 0; /* success */
@@ -1220,8 +1213,7 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
        Sg_fd *sfp;
        unsigned long req_sz, len, sa;
        Sg_scatter_hold *rsv_schp;
-        int k;
+        int k, length;
-        struct scatterlist *sg;
        if ((!filp) || (!vma) || (!(sfp = (Sg_fd *) filp->private_data)))
                return -ENXIO;
@@ -1235,11 +1227,10 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
                return -ENOMEM; /* cannot map more than reserved buffer */
        sa = vma->vm_start;
-        sg = rsv_schp->buffer;
+        length = 1 << (PAGE_SHIFT + rsv_schp->page_order);
-        for (k = 0; (k < rsv_schp->k_use_sg) && (sa < vma->vm_end);
+        for (k = 0; k < rsv_schp->k_use_sg && sa < vma->vm_end; k++) {
-             ++k, sg = sg_next(sg)) {
                len = vma->vm_end - sa;
-                len = (len < sg->length) ? len : sg->length;
+                len = (len < length) ? len : length;
                sa += len;
        }
@@ -1250,16 +1241,19 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
        return 0;
 }
-/* This function is a "bottom half" handler that is called by the
+/*
- * mid level when a command is completed (or has failed). */
+ * This function is a "bottom half" handler that is called by the mid
-static void
+ * level when a command is completed (or has failed).
-sg_cmd_done(void *data, char *sense, int result, int resid)
+ */
+static void sg_rq_end_io(struct request *rq, int uptodate)
 {
-        Sg_request *srp = data;
+        struct sg_request *srp = rq->end_io_data;
        Sg_device *sdp = NULL;
        Sg_fd *sfp;
        unsigned long iflags;
        unsigned int ms;
+        char *sense;
+        int result, resid;
        if (NULL == srp) {
                printk(KERN_ERR "sg_cmd_done: NULL request\n");
@@ -1273,6 +1267,9 @@ sg_cmd_done(void *data, char *sense, int result, int resid)
                return;
        }
+        sense = rq->sense;
+        result = rq->errors;
+        resid = rq->data_len;
        SCSI_LOG_TIMEOUT(4, printk("sg_cmd_done: %s, pack_id=%d, res=0x%x\n",
                sdp->disk->disk_name, srp->header.pack_id, result));
@@ -1283,7 +1280,6 @@ sg_cmd_done(void *data, char *sense, int result, int resid)
        if (0 != result) {
                struct scsi_sense_hdr sshdr;
-                memcpy(srp->sense_b, sense, sizeof (srp->sense_b));
                srp->header.status = 0xff & result;
                srp->header.masked_status = status_byte(result);
                srp->header.msg_status = msg_byte(result);
@@ -1621,37 +1617,79 @@ exit_sg(void)
        idr_destroy(&sg_index_idr);
 }
-static int
+static int sg_start_req(Sg_request *srp, unsigned char *cmd)
-sg_start_req(Sg_request * srp)
 {
        int res;
+        struct request *rq;
        Sg_fd *sfp = srp->parentfp;
        sg_io_hdr_t *hp = &srp->header;
        int dxfer_len = (int) hp->dxfer_len;
        int dxfer_dir = hp->dxfer_direction;
+        unsigned int iov_count = hp->iovec_count;
        Sg_scatter_hold *req_schp = &srp->data;
        Sg_scatter_hold *rsv_schp = &sfp->reserve;
+        struct request_queue *q = sfp->parentdp->device->request_queue;
+        struct rq_map_data *md, map_data;
+        int rw = hp->dxfer_direction == SG_DXFER_TO_DEV ? WRITE : READ;
+        SCSI_LOG_TIMEOUT(4, printk(KERN_INFO "sg_start_req: dxfer_len=%d\n",
+                                   dxfer_len));
+        rq = blk_get_request(q, rw, GFP_ATOMIC);
+        if (!rq)
+                return -ENOMEM;
+        memcpy(rq->cmd, cmd, hp->cmd_len);
+        rq->cmd_len = hp->cmd_len;
+        rq->cmd_type = REQ_TYPE_BLOCK_PC;
+        srp->rq = rq;
+        rq->end_io_data = srp;
+        rq->sense = srp->sense_b;
+        rq->retries = SG_DEFAULT_RETRIES;
-        SCSI_LOG_TIMEOUT(4, printk("sg_start_req: dxfer_len=%d\n", dxfer_len));
        if ((dxfer_len <= 0) || (dxfer_dir == SG_DXFER_NONE))
                return 0;
-        if (sg_allow_dio && (hp->flags & SG_FLAG_DIRECT_IO) &&
-            (dxfer_dir != SG_DXFER_UNKNOWN) && (0 == hp->iovec_count) &&
+        if (sg_allow_dio && hp->flags & SG_FLAG_DIRECT_IO &&
-            (!sfp->parentdp->device->host->unchecked_isa_dma)) {
+            dxfer_dir != SG_DXFER_UNKNOWN && !iov_count &&
-                res = sg_build_direct(srp, sfp, dxfer_len);
+            !sfp->parentdp->device->host->unchecked_isa_dma &&
-                if (res <= 0)   /* -ve -> error, 0 -> done, 1 -> try indirect */
+            blk_rq_aligned(q, hp->dxferp, dxfer_len))
-                        return res;
+                md = NULL;
-        }
+        else
-        if ((!sg_res_in_use(sfp)) && (dxfer_len <= rsv_schp->bufflen))
+                md = &map_data;
-                sg_link_reserve(sfp, srp, dxfer_len);
-        else {
+        if (md) {
-                res = sg_build_indirect(req_schp, sfp, dxfer_len);
+                if (!sg_res_in_use(sfp) && dxfer_len <= rsv_schp->bufflen)
-                if (res) {
+                        sg_link_reserve(sfp, srp, dxfer_len);
-                        sg_remove_scat(req_schp);
+                else {
-                        return res;
+                        res = sg_build_indirect(req_schp, sfp, dxfer_len);
+                        if (res)
+                                return res;
                }
+                md->pages = req_schp->pages;
+                md->page_order = req_schp->page_order;
+                md->nr_entries = req_schp->k_use_sg;
        }
-        return 0;
+        if (iov_count)
+                res = blk_rq_map_user_iov(q, rq, md, hp->dxferp, iov_count,
+                                          hp->dxfer_len, GFP_ATOMIC);
+        else
+                res = blk_rq_map_user(q, rq, md, hp->dxferp,
+                                      hp->dxfer_len, GFP_ATOMIC);
+        if (!res) {
+                srp->bio = rq->bio;
+                if (!md) {
+                        req_schp->dio_in_use = 1;
+                        hp->info |= SG_INFO_DIRECT_IO;
+                }
+        }
+        return res;
 }
 static void
@@ -1665,186 +1703,37 @@ sg_finish_rem_req(Sg_request * srp)
                sg_unlink_reserve(sfp, srp);
        else
                sg_remove_scat(req_schp);
+        if (srp->rq) {
+                if (srp->bio)
+                        blk_rq_unmap_user(srp->bio);
+                blk_put_request(srp->rq);
+        }
        sg_remove_request(sfp, srp);
 }
 static int
 sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp, int tablesize)
 {
-        int sg_bufflen = tablesize * sizeof(struct scatterlist);
+        int sg_bufflen = tablesize * sizeof(struct page *);
        gfp_t gfp_flags = GFP_ATOMIC | __GFP_NOWARN;
-        /*
+        schp->pages = kzalloc(sg_bufflen, gfp_flags);
-         * TODO: test without low_dma, we should not need it since
+        if (!schp->pages)
-         * the block layer will bounce the buffer for us
-         *
-         * XXX(hch): we shouldn't need GFP_DMA for the actual S/G list.
-         */
-        if (sfp->low_dma)
-                 gfp_flags |= GFP_DMA;
-        schp->buffer = kzalloc(sg_bufflen, gfp_flags);
-        if (!schp->buffer)
                return -ENOMEM;
-        sg_init_table(schp->buffer, tablesize);
        schp->sglist_len = sg_bufflen;
        return tablesize;       /* number of scat_gath elements allocated */
 }
-#ifdef SG_ALLOW_DIO_CODE
-/* vvvvvvvv  following code borrowed from st driver's direct IO vvvvvvvvv */
-        /* TODO: hopefully we can use the generic block layer code */
-/* Pin down user pages and put them into a scatter gather list. Returns <= 0 if
-   - mapping of all pages not successful
-   (i.e., either completely successful or fails)
-*/
-static int 
-st_map_user_pages(struct scatterlist *sgl, const unsigned int max_pages, 
-                  unsigned long uaddr, size_t count, int rw)
-{
-        unsigned long end = (uaddr + count + PAGE_SIZE - 1) >> PAGE_SHIFT;
-        unsigned long start = uaddr >> PAGE_SHIFT;
-        const int nr_pages = end - start;
-        int res, i, j;
-        struct page **pages;
-        /* User attempted Overflow! */
-        if ((uaddr + count) < uaddr)
-                return -EINVAL;
-        /* Too big */
-        if (nr_pages > max_pages)
-                return -ENOMEM;
-        /* Hmm? */
-        if (count == 0)
-                return 0;
-        if ((pages = kmalloc(max_pages * sizeof(*pages), GFP_ATOMIC)) == NULL)
-                return -ENOMEM;
-        /* Try to fault in all of the necessary pages */
-        down_read(&current->mm->mmap_sem);
-        /* rw==READ means read from drive, write into memory area */
-        res = get_user_pages(
-                current,
-                current->mm,
-                uaddr,
-                nr_pages,
-                rw == READ,
-                0, /* don't force */
-                pages,
-                NULL);
-        up_read(&current->mm->mmap_sem);
-        /* Errors and no page mapped should return here */
-        if (res < nr_pages)
-                goto out_unmap;
-        for (i=0; i < nr_pages; i++) {
-                /* FIXME: flush superflous for rw==READ,
-                 * probably wrong function for rw==WRITE
-                 */
-                flush_dcache_page(pages[i]);
-                /* ?? Is locking needed? I don't think so */
-                /* if (TestSetPageLocked(pages[i]))
-                   goto out_unlock; */
-        }
-        sg_set_page(sgl, pages[0], 0, uaddr & ~PAGE_MASK);
-        if (nr_pages > 1) {
-                sgl[0].length = PAGE_SIZE - sgl[0].offset;
-                count -= sgl[0].length;
-                for (i=1; i < nr_pages ; i++)
-                        sg_set_page(&sgl[i], pages[i], count < PAGE_SIZE ? count : PAGE_SIZE, 0);
-        }
-        else {
-                sgl[0].length = count;
-        }
-        kfree(pages);
-        return nr_pages;
- out_unmap:
-        if (res > 0) {
-                for (j=0; j < res; j++)
-                        page_cache_release(pages[j]);
-                res = 0;
-        }
-        kfree(pages);
-        return res;
-}
-/* And unmap them... */
-static int 
-st_unmap_user_pages(struct scatterlist *sgl, const unsigned int nr_pages,
-                    int dirtied)
-{
-        int i;
-        for (i=0; i < nr_pages; i++) {
-                struct page *page = sg_page(&sgl[i]);
-                if (dirtied)
-                        SetPageDirty(page);
-                /* unlock_page(page); */
-                /* FIXME: cache flush missing for rw==READ
-                 * FIXME: call the correct reference counting function
-                 */
-                page_cache_release(page);
-        }
-        return 0;
-}
-/* ^^^^^^^^  above code borrowed from st driver's direct IO ^^^^^^^^^ */
-#endif
-/* Returns: -ve -> error, 0 -> done, 1 -> try indirect */
-static int
-sg_build_direct(Sg_request * srp, Sg_fd * sfp, int dxfer_len)
-{
-#ifdef SG_ALLOW_DIO_CODE
-        sg_io_hdr_t *hp = &srp->header;
-        Sg_scatter_hold *schp = &srp->data;
-        int sg_tablesize = sfp->parentdp->sg_tablesize;
-        int mx_sc_elems, res;
-        struct scsi_device *sdev = sfp->parentdp->device;
-        if (((unsigned long)hp->dxferp &
-                        queue_dma_alignment(sdev->request_queue)) != 0)
-                return 1;
-        mx_sc_elems = sg_build_sgat(schp, sfp, sg_tablesize);
-        if (mx_sc_elems <= 0) {
-                return 1;
-        }
-        res = st_map_user_pages(schp->buffer, mx_sc_elems,
-                                (unsigned long)hp->dxferp, dxfer_len, 
-                                (SG_DXFER_TO_DEV == hp->dxfer_direction) ? 1 : 0);
-        if (res <= 0) {
-                sg_remove_scat(schp);
-                return 1;
-        }
-        schp->k_use_sg = res;
-        schp->dio_in_use = 1;
-        hp->info |= SG_INFO_DIRECT_IO;
-        return 0;
-#else
-        return 1;
-#endif
-}
 static int
 sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
 {
-        struct scatterlist *sg;
+        int ret_sz = 0, i, k, rem_sz, num, mx_sc_elems;
-        int ret_sz = 0, k, rem_sz, num, mx_sc_elems;
        int sg_tablesize = sfp->parentdp->sg_tablesize;
-        int blk_size = buff_size;
+        int blk_size = buff_size, order;
-        struct page *p = NULL;
+        gfp_t gfp_mask = GFP_ATOMIC | __GFP_COMP | __GFP_NOWARN;
        if (blk_size < 0)
                return -EFAULT;
@@ -1868,15 +1757,26 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
                } else
                        scatter_elem_sz_prev = num;
        }
-        for (k = 0, sg = schp->buffer, rem_sz = blk_size;
-             (rem_sz > 0) && (k < mx_sc_elems);
+        if (sfp->low_dma)
-             ++k, rem_sz -= ret_sz, sg = sg_next(sg)) {
+                gfp_mask |= GFP_DMA;
-                
+        if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
+                gfp_mask |= __GFP_ZERO;
+        order = get_order(num);
+retry:
+        ret_sz = 1 << (PAGE_SHIFT + order);
+        for (k = 0, rem_sz = blk_size; rem_sz > 0 && k < mx_sc_elems;
+             k++, rem_sz -= ret_sz) {
                num = (rem_sz > scatter_elem_sz_prev) ?
-                      scatter_elem_sz_prev : rem_sz;
+                        scatter_elem_sz_prev : rem_sz;
-                p = sg_page_malloc(num, sfp->low_dma, &ret_sz);
-                if (!p)
+                schp->pages[k] = alloc_pages(gfp_mask, order);
-                        return -ENOMEM;
+                if (!schp->pages[k])
+                        goto out;
                if (num == scatter_elem_sz_prev) {
                        if (unlikely(ret_sz > scatter_elem_sz_prev)) {
@@ -1884,12 +1784,12 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
                                scatter_elem_sz_prev = ret_sz;
                        }
                }
-                sg_set_page(sg, p, (ret_sz > num) ? num : ret_sz, 0);
                SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k=%d, num=%d, "
                                 "ret_sz=%d\n", k, num, ret_sz));
        }               /* end of for loop */
+        schp->page_order = order;
        schp->k_use_sg = k;
        SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k_use_sg=%d, "
                         "rem_sz=%d\n", k, rem_sz));
@@ -1897,223 +1797,42 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
        schp->bufflen = blk_size;
        if (rem_sz > 0) /* must have failed */
                return -ENOMEM;
-        return 0;
-}
-static int
-sg_write_xfer(Sg_request * srp)
-{
-        sg_io_hdr_t *hp = &srp->header;
-        Sg_scatter_hold *schp = &srp->data;
-        struct scatterlist *sg = schp->buffer;
-        int num_xfer = 0;
-        int j, k, onum, usglen, ksglen, res;
-        int iovec_count = (int) hp->iovec_count;
-        int dxfer_dir = hp->dxfer_direction;
-        unsigned char *p;
-        unsigned char __user *up;
-        int new_interface = ('\0' == hp->interface_id) ? 0 : 1;
-        if ((SG_DXFER_UNKNOWN == dxfer_dir) || (SG_DXFER_TO_DEV == dxfer_dir) ||
-            (SG_DXFER_TO_FROM_DEV == dxfer_dir)) {
-                num_xfer = (int) (new_interface ? hp->dxfer_len : hp->flags);
-                if (schp->bufflen < num_xfer)
-                        num_xfer = schp->bufflen;
-        }
-        if ((num_xfer <= 0) || (schp->dio_in_use) ||
-            (new_interface
-             && ((SG_FLAG_NO_DXFER | SG_FLAG_MMAP_IO) & hp->flags)))
-                return 0;
-        SCSI_LOG_TIMEOUT(4, printk("sg_write_xfer: num_xfer=%d, iovec_count=%d, k_use_sg=%d\n",
-                          num_xfer, iovec_count, schp->k_use_sg));
-        if (iovec_count) {
-                onum = iovec_count;
-                if (!access_ok(VERIFY_READ, hp->dxferp, SZ_SG_IOVEC * onum))
-                        return -EFAULT;
-        } else
-                onum = 1;
-        ksglen = sg->length;
-        p = page_address(sg_page(sg));
-        for (j = 0, k = 0; j < onum; ++j) {
-                res = sg_u_iovec(hp, iovec_count, j, 1, &usglen, &up);
-                if (res)
-                        return res;
-                for (; p; sg = sg_next(sg), ksglen = sg->length,
-                     p = page_address(sg_page(sg))) {
-                        if (usglen <= 0)
-                                break;
-                        if (ksglen > usglen) {
-                                if (usglen >= num_xfer) {
-                                        if (__copy_from_user(p, up, num_xfer))
-                                                return -EFAULT;
-                                        return 0;
-                                }
-                                if (__copy_from_user(p, up, usglen))
-                                        return -EFAULT;
-                                p += usglen;
-                                ksglen -= usglen;
-                                break;
-                        } else {
-                                if (ksglen >= num_xfer) {
-                                        if (__copy_from_user(p, up, num_xfer))
-                                                return -EFAULT;
-                                        return 0;
-                                }
-                                if (__copy_from_user(p, up, ksglen))
-                                        return -EFAULT;
-                                up += ksglen;
-                                usglen -= ksglen;
-                        }
-                        ++k;
-                        if (k >= schp->k_use_sg)
-                                return 0;
-                }
-        }
        return 0;
-}
+out:
+        for (i = 0; i < k; i++)
+                __free_pages(schp->pages[k], order);
-static int
+        if (--order >= 0)
-sg_u_iovec(sg_io_hdr_t * hp, int sg_num, int ind,
+                goto retry;
-           int wr_xf, int *countp, unsigned char __user **up)
-{
-        int num_xfer = (int) hp->dxfer_len;
-        unsigned char __user *p = hp->dxferp;
-        int count;
-        if (0 == sg_num) {
+        return -ENOMEM;
-                if (wr_xf && ('\0' == hp->interface_id))
-                        count = (int) hp->flags;        /* holds "old" input_size */
-                else
-                        count = num_xfer;
-        } else {
-                sg_iovec_t iovec;
-                if (__copy_from_user(&iovec, p + ind*SZ_SG_IOVEC, SZ_SG_IOVEC))
-                        return -EFAULT;
-                p = iovec.iov_base;
-                count = (int) iovec.iov_len;
-        }
-        if (!access_ok(wr_xf ? VERIFY_READ : VERIFY_WRITE, p, count))
-                return -EFAULT;
-        if (up)
-                *up = p;
-        if (countp)
-                *countp = count;
-        return 0;
 }
 static void
 sg_remove_scat(Sg_scatter_hold * schp)
 {
        SCSI_LOG_TIMEOUT(4, printk("sg_remove_scat: k_use_sg=%d\n", schp->k_use_sg));
-        if (schp->buffer && (schp->sglist_len > 0)) {
+        if (schp->pages && schp->sglist_len > 0) {
-                struct scatterlist *sg = schp->buffer;
+                if (!schp->dio_in_use) {
-                if (schp->dio_in_use) {
-#ifdef SG_ALLOW_DIO_CODE
-                        st_unmap_user_pages(sg, schp->k_use_sg, TRUE);
-#endif
-                } else {
                        int k;
-                        for (k = 0; (k < schp->k_use_sg) && sg_page(sg);
+                        for (k = 0; k < schp->k_use_sg && schp->pages[k]; k++) {
-                             ++k, sg = sg_next(sg)) {
                                SCSI_LOG_TIMEOUT(5, printk(
-                                    "sg_remove_scat: k=%d, pg=0x%p, len=%d\n",
+                                    "sg_remove_scat: k=%d, pg=0x%p\n",
-                                    k, sg_page(sg), sg->length));
+                                    k, schp->pages[k]));
-                                sg_page_free(sg_page(sg), sg->length);
+                                __free_pages(schp->pages[k], schp->page_order);
                        }
-                }
-                kfree(schp->buffer);
-        }
-        memset(schp, 0, sizeof (*schp));
-}
-static int
-sg_read_xfer(Sg_request * srp)
-{
-        sg_io_hdr_t *hp = &srp->header;
-        Sg_scatter_hold *schp = &srp->data;
-        struct scatterlist *sg = schp->buffer;
-        int num_xfer = 0;
-        int j, k, onum, usglen, ksglen, res;
-        int iovec_count = (int) hp->iovec_count;
-        int dxfer_dir = hp->dxfer_direction;
-        unsigned char *p;
-        unsigned char __user *up;
-        int new_interface = ('\0' == hp->interface_id) ? 0 : 1;
-        if ((SG_DXFER_UNKNOWN == dxfer_dir) || (SG_DXFER_FROM_DEV == dxfer_dir)
-            || (SG_DXFER_TO_FROM_DEV == dxfer_dir)) {
-                num_xfer = hp->dxfer_len;
-                if (schp->bufflen < num_xfer)
-                        num_xfer = schp->bufflen;
-        }
-        if ((num_xfer <= 0) || (schp->dio_in_use) ||
-            (new_interface
-             && ((SG_FLAG_NO_DXFER | SG_FLAG_MMAP_IO) & hp->flags)))
-                return 0;
-        SCSI_LOG_TIMEOUT(4, printk("sg_read_xfer: num_xfer=%d, iovec_count=%d, k_use_sg=%d\n",
+                        kfree(schp->pages);
-                          num_xfer, iovec_count, schp->k_use_sg));
-        if (iovec_count) {
-                onum = iovec_count;
-                if (!access_ok(VERIFY_READ, hp->dxferp, SZ_SG_IOVEC * onum))
-                        return -EFAULT;
-        } else
-                onum = 1;
-        p = page_address(sg_page(sg));
-        ksglen = sg->length;
-        for (j = 0, k = 0; j < onum; ++j) {
-                res = sg_u_iovec(hp, iovec_count, j, 0, &usglen, &up);
-                if (res)
-                        return res;
-                for (; p; sg = sg_next(sg), ksglen = sg->length,
-                     p = page_address(sg_page(sg))) {
-                        if (usglen <= 0)
-                                break;
-                        if (ksglen > usglen) {
-                                if (usglen >= num_xfer) {
-                                        if (__copy_to_user(up, p, num_xfer))
-                                                return -EFAULT;
-                                        return 0;
-                                }
-                                if (__copy_to_user(up, p, usglen))
-                                        return -EFAULT;
-                                p += usglen;
-                                ksglen -= usglen;
-                                break;
-                        } else {
-                                if (ksglen >= num_xfer) {
-                                        if (__copy_to_user(up, p, num_xfer))
-                                                return -EFAULT;
-                                        return 0;
-                                }
-                                if (__copy_to_user(up, p, ksglen))
-                                        return -EFAULT;
-                                up += ksglen;
-                                usglen -= ksglen;
-                        }
-                        ++k;
-                        if (k >= schp->k_use_sg)
-                                return 0;
                }
        }
+        memset(schp, 0, sizeof (*schp));
-        return 0;
 }
 static int
 sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer)
 {
        Sg_scatter_hold *schp = &srp->data;
-        struct scatterlist *sg = schp->buffer;
        int k, num;
        SCSI_LOG_TIMEOUT(4, printk("sg_read_oxfer: num_read_xfer=%d\n",
@@ -2121,15 +1840,15 @@ sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer)
        if ((!outp) || (num_read_xfer <= 0))
                return 0;
-        for (k = 0; (k < schp->k_use_sg) && sg_page(sg); ++k, sg = sg_next(sg)) {
+        num = 1 << (PAGE_SHIFT + schp->page_order);
-                num = sg->length;
+        for (k = 0; k < schp->k_use_sg && schp->pages[k]; k++) {
                if (num > num_read_xfer) {
-                        if (__copy_to_user(outp, page_address(sg_page(sg)),
+                        if (__copy_to_user(outp, page_address(schp->pages[k]),
                                           num_read_xfer))
                                return -EFAULT;
                        break;
                } else {
-                        if (__copy_to_user(outp, page_address(sg_page(sg)),
+                        if (__copy_to_user(outp, page_address(schp->pages[k]),
                                           num))
                                return -EFAULT;
                        num_read_xfer -= num;
@@ -2164,24 +1883,21 @@ sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size)
 {
        Sg_scatter_hold *req_schp = &srp->data;
        Sg_scatter_hold *rsv_schp = &sfp->reserve;
-        struct scatterlist *sg = rsv_schp->buffer;
        int k, num, rem;
        srp->res_used = 1;
        SCSI_LOG_TIMEOUT(4, printk("sg_link_reserve: size=%d\n", size));
        rem = size;
-        for (k = 0; k < rsv_schp->k_use_sg; ++k, sg = sg_next(sg)) {
+        num = 1 << (PAGE_SHIFT + rsv_schp->page_order);
-                num = sg->length;
+        for (k = 0; k < rsv_schp->k_use_sg; k++) {
                if (rem <= num) {
-                        sfp->save_scat_len = num;
-                        sg->length = rem;
                        req_schp->k_use_sg = k + 1;
                        req_schp->sglist_len = rsv_schp->sglist_len;
-                        req_schp->buffer = rsv_schp->buffer;
+                        req_schp->pages = rsv_schp->pages;
                        req_schp->bufflen = size;
-                        req_schp->b_malloc_len = rsv_schp->b_malloc_len;
+                        req_schp->page_order = rsv_schp->page_order;
                        break;
                } else
                        rem -= num;
@@ -2195,22 +1911,13 @@ static void
 sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp)
 {
        Sg_scatter_hold *req_schp = &srp->data;
-        Sg_scatter_hold *rsv_schp = &sfp->reserve;
        SCSI_LOG_TIMEOUT(4, printk("sg_unlink_reserve: req->k_use_sg=%d\n",
                                   (int) req_schp->k_use_sg));
-        if ((rsv_schp->k_use_sg > 0) && (req_schp->k_use_sg > 0)) {
-                struct scatterlist *sg = rsv_schp->buffer;
-                if (sfp->save_scat_len > 0)
-                        (sg + (req_schp->k_use_sg - 1))->length =
-                            (unsigned) sfp->save_scat_len;
-                else
-                        SCSI_LOG_TIMEOUT(1, printk ("sg_unlink_reserve: BAD save_scat_len\n"));
-        }
        req_schp->k_use_sg = 0;
        req_schp->bufflen = 0;
-        req_schp->buffer = NULL;
+        req_schp->pages = NULL;
+        req_schp->page_order = 0;
        req_schp->sglist_len = 0;
        sfp->save_scat_len = 0;
        srp->res_used = 0;
@@ -2468,53 +2175,6 @@ sg_res_in_use(Sg_fd * sfp)
        return srp ? 1 : 0;
 }
-/* The size fetched (value output via retSzp) set when non-NULL return */
-static struct page *
-sg_page_malloc(int rqSz, int lowDma, int *retSzp)
-{
-        struct page *resp = NULL;
-        gfp_t page_mask;
-        int order, a_size;
-        int resSz;
-        if ((rqSz <= 0) || (NULL == retSzp))
-                return resp;
-        if (lowDma)
-                page_mask = GFP_ATOMIC | GFP_DMA | __GFP_COMP | __GFP_NOWARN;
-        else
-                page_mask = GFP_ATOMIC | __GFP_COMP | __GFP_NOWARN;
-        for (order = 0, a_size = PAGE_SIZE; a_size < rqSz;
-             order++, a_size <<= 1) ;
-        resSz = a_size;         /* rounded up if necessary */
-        resp = alloc_pages(page_mask, order);
-        while ((!resp) && order) {
-                --order;
-                a_size >>= 1;   /* divide by 2, until PAGE_SIZE */
-                resp =  alloc_pages(page_mask, order);  /* try half */
-                resSz = a_size;
-        }
-        if (resp) {
-                if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
-                        memset(page_address(resp), 0, resSz);
-                *retSzp = resSz;
-        }
-        return resp;
-}
-static void
-sg_page_free(struct page *page, int size)
-{
-        int order, a_size;
-        if (!page)
-                return;
-        for (order = 0, a_size = PAGE_SIZE; a_size < size;
-             order++, a_size <<= 1) ;
-        __free_pages(page, order);
-}
 #ifdef CONFIG_SCSI_PROC_FS
 static int
 sg_idr_max_id(int id, void *p, void *data)
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 27f5bfd1def3..0f17009c99d2 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -331,7 +331,7 @@ static int sr_done(struct scsi_cmnd *SCpnt)
 static int sr_prep_fn(struct request_queue *q, struct request *rq)
 {
-        int block=0, this_count, s_size, timeout = SR_TIMEOUT;
+        int block = 0, this_count, s_size;
        struct scsi_cd *cd;
        struct scsi_cmnd *SCpnt;
        struct scsi_device *sdp = q->queuedata;
@@ -461,7 +461,6 @@ static int sr_prep_fn(struct request_queue *q, struct request *rq)
        SCpnt->transfersize = cd->device->sector_size;
        SCpnt->underflow = this_count << 9;
        SCpnt->allowed = MAX_RETRIES;
-        SCpnt->timeout_per_command = timeout;
        /*
         * This indicates that the command is ready from our end to be
@@ -620,6 +619,8 @@ static int sr_probe(struct device *dev)
        disk->fops = &sr_bdops;
        disk->flags = GENHD_FL_CD;
+        blk_queue_rq_timeout(sdev->request_queue, SR_TIMEOUT);
        cd->device = sdev;
        cd->disk = disk;
        cd->driver = &sr_template;
@@ -878,7 +879,7 @@ static void sr_kref_release(struct kref *kref)
        struct gendisk *disk = cd->disk;
        spin_lock(&sr_index_lock);
-        clear_bit(disk->first_minor, sr_index_bits);
+        clear_bit(MINOR(disk_devt(disk)), sr_index_bits);
        spin_unlock(&sr_index_lock);
        unregister_cdrom(&cd->cdi);
diff --git a/drivers/scsi/sun_esp.c b/drivers/scsi/sun_esp.c
index f9cf70151366..3d73aad4bc82 100644
--- a/drivers/scsi/sun_esp.c
+++ b/drivers/scsi/sun_esp.c
@@ -1,6 +1,6 @@
 /* sun_esp.c: ESP front-end for Sparc SBUS systems.
 *
- * Copyright (C) 2007 David S. Miller (davem@davemloft.net)
+ * Copyright (C) 2007, 2008 David S. Miller (davem@davemloft.net)
 */
 #include <linux/kernel.h>
@@ -9,60 +9,70 @@
 #include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/init.h>
+#include <linux/dma-mapping.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
 #include <asm/irq.h>
 #include <asm/io.h>
 #include <asm/dma.h>
-#include <asm/sbus.h>
 #include <scsi/scsi_host.h>
 #include "esp_scsi.h"
 #define DRV_MODULE_NAME         "sun_esp"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_VERSION             "1.000"
+#define DRV_VERSION             "1.100"
-#define DRV_MODULE_RELDATE      "April 19, 2007"
+#define DRV_MODULE_RELDATE      "August 27, 2008"
 #define dma_read32(REG) \
        sbus_readl(esp->dma_regs + (REG))
 #define dma_write32(VAL, REG) \
        sbus_writel((VAL), esp->dma_regs + (REG))
-static int __devinit esp_sbus_find_dma(struct esp *esp, struct sbus_dev *dma_sdev)
+/* DVMA chip revisions */
-{
+enum dvma_rev {
-        struct sbus_dev *sdev = esp->dev;
+        dvmarev0,
-        struct sbus_dma *dma;
+        dvmaesc1,
+        dvmarev1,
+        dvmarev2,
+        dvmarev3,
+        dvmarevplus,
+        dvmahme
+};
-        if (dma_sdev != NULL) {
+static int __devinit esp_sbus_setup_dma(struct esp *esp,
-                for_each_dvma(dma) {
+                                        struct of_device *dma_of)
-                        if (dma->sdev == dma_sdev)
+{
-                                break;
+        esp->dma = dma_of;
-                }
-        } else {
-                for_each_dvma(dma) {
-                        if (dma->sdev == NULL)
-                                break;
-                        /* If bus + slot are the same and it has the
+        esp->dma_regs = of_ioremap(&dma_of->resource[0], 0,
-                         * correct OBP name, it's ours.
+                                   resource_size(&dma_of->resource[0]),
-                         */
+                                   "espdma");
-                        if (sdev->bus == dma->sdev->bus &&
+        if (!esp->dma_regs)
-                            sdev->slot == dma->sdev->slot &&
+                return -ENOMEM;
-                            (!strcmp(dma->sdev->prom_name, "dma") ||
-                             !strcmp(dma->sdev->prom_name, "espdma")))
-                                break;
-                }
-        }
-        if (dma == NULL) {
+        switch (dma_read32(DMA_CSR) & DMA_DEVICE_ID) {
-                printk(KERN_ERR PFX "[%s] Cannot find dma.\n",
+        case DMA_VERS0:
-                       sdev->ofdev.node->full_name);
+                esp->dmarev = dvmarev0;
-                return -ENODEV;
+                break;
+        case DMA_ESCV1:
+                esp->dmarev = dvmaesc1;
+                break;
+        case DMA_VERS1:
+                esp->dmarev = dvmarev1;
+                break;
+        case DMA_VERS2:
+                esp->dmarev = dvmarev2;
+                break;
+        case DMA_VERHME:
+                esp->dmarev = dvmahme;
+                break;
+        case DMA_VERSPLUS:
+                esp->dmarev = dvmarevplus;
+                break;
        }
-        esp->dma = dma;
-        esp->dma_regs = dma->regs;
        return 0;
@@ -70,18 +80,18 @@ static int __devinit esp_sbus_find_dma(struct esp *esp, struct sbus_dev *dma_sde
 static int __devinit esp_sbus_map_regs(struct esp *esp, int hme)
 {
-        struct sbus_dev *sdev = esp->dev;
+        struct of_device *op = esp->dev;
        struct resource *res;
        /* On HME, two reg sets exist, first is DVMA,
         * second is ESP registers.
         */
        if (hme)
-                res = &sdev->resource[1];
+                res = &op->resource[1];
        else
-                res = &sdev->resource[0];
+                res = &op->resource[0];
-        esp->regs = sbus_ioremap(res, 0, SBUS_ESP_REG_SIZE, "ESP");
+        esp->regs = of_ioremap(res, 0, SBUS_ESP_REG_SIZE, "ESP");
        if (!esp->regs)
                return -ENOMEM;
@@ -90,10 +100,11 @@ static int __devinit esp_sbus_map_regs(struct esp *esp, int hme)
 static int __devinit esp_sbus_map_command_block(struct esp *esp)
 {
-        struct sbus_dev *sdev = esp->dev;
+        struct of_device *op = esp->dev;
-        esp->command_block = sbus_alloc_consistent(sdev, 16,
+        esp->command_block = dma_alloc_coherent(&op->dev, 16,
-                                                   &esp->command_block_dma);
+                                                &esp->command_block_dma,
+                                                GFP_ATOMIC);
        if (!esp->command_block)
                return -ENOMEM;
        return 0;
@@ -102,17 +113,18 @@ static int __devinit esp_sbus_map_command_block(struct esp *esp)
 static int __devinit esp_sbus_register_irq(struct esp *esp)
 {
        struct Scsi_Host *host = esp->host;
-        struct sbus_dev *sdev = esp->dev;
+        struct of_device *op = esp->dev;
-        host->irq = sdev->irqs[0];
+        host->irq = op->irqs[0];
        return request_irq(host->irq, scsi_esp_intr, IRQF_SHARED, "ESP", esp);
 }
-static void __devinit esp_get_scsi_id(struct esp *esp)
+static void __devinit esp_get_scsi_id(struct esp *esp, struct of_device *espdma)
 {
-        struct sbus_dev *sdev = esp->dev;
+        struct of_device *op = esp->dev;
-        struct device_node *dp = sdev->ofdev.node;
+        struct device_node *dp;
+        dp = op->node;
        esp->scsi_id = of_getintprop_default(dp, "initiator-id", 0xff);
        if (esp->scsi_id != 0xff)
                goto done;
@@ -121,13 +133,7 @@ static void __devinit esp_get_scsi_id(struct esp *esp)
        if (esp->scsi_id != 0xff)
                goto done;
-        if (!sdev->bus) {
+        esp->scsi_id = of_getintprop_default(espdma->node,
-                /* SUN4 */
-                esp->scsi_id = 7;
-                goto done;
-        }
-        esp->scsi_id = of_getintprop_default(sdev->bus->ofdev.node,
                                             "scsi-initiator-id", 7);
 done:
@@ -137,9 +143,10 @@ done:
 static void __devinit esp_get_differential(struct esp *esp)
 {
-        struct sbus_dev *sdev = esp->dev;
+        struct of_device *op = esp->dev;
-        struct device_node *dp = sdev->ofdev.node;
+        struct device_node *dp;
+        dp = op->node;
        if (of_find_property(dp, "differential", NULL))
                esp->flags |= ESP_FLAG_DIFFERENTIAL;
        else
@@ -148,43 +155,36 @@ static void __devinit esp_get_differential(struct esp *esp)
 static void __devinit esp_get_clock_params(struct esp *esp)
 {
-        struct sbus_dev *sdev = esp->dev;
+        struct of_device *op = esp->dev;
-        struct device_node *dp = sdev->ofdev.node;
+        struct device_node *bus_dp, *dp;
-        struct device_node *bus_dp;
        int fmhz;
-        bus_dp = NULL;
+        dp = op->node;
-        if (sdev != NULL && sdev->bus != NULL)
+        bus_dp = dp->parent;
-                bus_dp = sdev->bus->ofdev.node;
        fmhz = of_getintprop_default(dp, "clock-frequency", 0);
        if (fmhz == 0)
-                fmhz = (!bus_dp) ? 0 :
+                fmhz = of_getintprop_default(bus_dp, "clock-frequency", 0);
-                        of_getintprop_default(bus_dp, "clock-frequency", 0);
        esp->cfreq = fmhz;
 }
-static void __devinit esp_get_bursts(struct esp *esp, struct sbus_dev *dma)
+static void __devinit esp_get_bursts(struct esp *esp, struct of_device *dma_of)
 {
-        struct sbus_dev *sdev = esp->dev;
+        struct device_node *dma_dp = dma_of->node;
-        struct device_node *dp = sdev->ofdev.node;
+        struct of_device *op = esp->dev;
-        u8 bursts;
+        struct device_node *dp;
+        u8 bursts, val;
+        dp = op->node;
        bursts = of_getintprop_default(dp, "burst-sizes", 0xff);
-        if (dma) {
+        val = of_getintprop_default(dma_dp, "burst-sizes", 0xff);
-                struct device_node *dma_dp = dma->ofdev.node;
+        if (val != 0xff)
-                u8 val = of_getintprop_default(dma_dp, "burst-sizes", 0xff);
+                bursts &= val;
-                if (val != 0xff)
-                        bursts &= val;
-        }
-        if (sdev->bus) {
+        val = of_getintprop_default(dma_dp->parent, "burst-sizes", 0xff);
-                u8 val = of_getintprop_default(sdev->bus->ofdev.node,
+        if (val != 0xff)
-                                               "burst-sizes", 0xff);
+                bursts &= val;
-                if (val != 0xff)
-                        bursts &= val;
-        }
        if (bursts == 0xff ||
            (bursts & DMA_BURST16) == 0 ||
@@ -194,9 +194,9 @@ static void __devinit esp_get_bursts(struct esp *esp, struct sbus_dev *dma)
        esp->bursts = bursts;
 }
-static void __devinit esp_sbus_get_props(struct esp *esp, struct sbus_dev *espdma)
+static void __devinit esp_sbus_get_props(struct esp *esp, struct of_device *espdma)
 {
-        esp_get_scsi_id(esp);
+        esp_get_scsi_id(esp, espdma);
        esp_get_differential(esp);
        esp_get_clock_params(esp);
        esp_get_bursts(esp, espdma);
@@ -215,25 +215,33 @@ static u8 sbus_esp_read8(struct esp *esp, unsigned long reg)
 static dma_addr_t sbus_esp_map_single(struct esp *esp, void *buf,
                                      size_t sz, int dir)
 {
-        return sbus_map_single(esp->dev, buf, sz, dir);
+        struct of_device *op = esp->dev;
+        return dma_map_single(&op->dev, buf, sz, dir);
 }
 static int sbus_esp_map_sg(struct esp *esp, struct scatterlist *sg,
                                  int num_sg, int dir)
 {
-        return sbus_map_sg(esp->dev, sg, num_sg, dir);
+        struct of_device *op = esp->dev;
+        return dma_map_sg(&op->dev, sg, num_sg, dir);
 }
 static void sbus_esp_unmap_single(struct esp *esp, dma_addr_t addr,
                                  size_t sz, int dir)
 {
-        sbus_unmap_single(esp->dev, addr, sz, dir);
+        struct of_device *op = esp->dev;
+        dma_unmap_single(&op->dev, addr, sz, dir);
 }
 static void sbus_esp_unmap_sg(struct esp *esp, struct scatterlist *sg,
                              int num_sg, int dir)
 {
-        sbus_unmap_sg(esp->dev, sg, num_sg, dir);
+        struct of_device *op = esp->dev;
+        dma_unmap_sg(&op->dev, sg, num_sg, dir);
 }
 static int sbus_esp_irq_pending(struct esp *esp)
@@ -247,24 +255,26 @@ static void sbus_esp_reset_dma(struct esp *esp)
 {
        int can_do_burst16, can_do_burst32, can_do_burst64;
        int can_do_sbus64, lim;
+        struct of_device *op;
        u32 val;
        can_do_burst16 = (esp->bursts & DMA_BURST16) != 0;
        can_do_burst32 = (esp->bursts & DMA_BURST32) != 0;
        can_do_burst64 = 0;
        can_do_sbus64 = 0;
-        if (sbus_can_dma_64bit(esp->dev))
+        op = esp->dev;
+        if (sbus_can_dma_64bit())
                can_do_sbus64 = 1;
-        if (sbus_can_burst64(esp->sdev))
+        if (sbus_can_burst64())
                can_do_burst64 = (esp->bursts & DMA_BURST64) != 0;
        /* Put the DVMA into a known state. */
-        if (esp->dma->revision != dvmahme) {
+        if (esp->dmarev != dvmahme) {
                val = dma_read32(DMA_CSR);
                dma_write32(val | DMA_RST_SCSI, DMA_CSR);
                dma_write32(val & ~DMA_RST_SCSI, DMA_CSR);
        }
-        switch (esp->dma->revision) {
+        switch (esp->dmarev) {
        case dvmahme:
                dma_write32(DMA_RESET_FAS366, DMA_CSR);
                dma_write32(DMA_RST_SCSI, DMA_CSR);
@@ -282,7 +292,7 @@ static void sbus_esp_reset_dma(struct esp *esp)
                if (can_do_sbus64) {
                        esp->prev_hme_dmacsr |= DMA_SCSI_SBUS64;
-                        sbus_set_sbus64(esp->dev, esp->bursts);
+                        sbus_set_sbus64(&op->dev, esp->bursts);
                }
                lim = 1000;
@@ -346,14 +356,14 @@ static void sbus_esp_dma_drain(struct esp *esp)
        u32 csr;
        int lim;
-        if (esp->dma->revision == dvmahme)
+        if (esp->dmarev == dvmahme)
                return;
        csr = dma_read32(DMA_CSR);
        if (!(csr & DMA_FIFO_ISDRAIN))
                return;
-        if (esp->dma->revision != dvmarev3 && esp->dma->revision != dvmaesc1)
+        if (esp->dmarev != dvmarev3 && esp->dmarev != dvmaesc1)
                dma_write32(csr | DMA_FIFO_STDRAIN, DMA_CSR);
        lim = 1000;
@@ -369,7 +379,7 @@ static void sbus_esp_dma_drain(struct esp *esp)
 static void sbus_esp_dma_invalidate(struct esp *esp)
 {
-        if (esp->dma->revision == dvmahme) {
+        if (esp->dmarev == dvmahme) {
                dma_write32(DMA_RST_SCSI, DMA_CSR);
                esp->prev_hme_dmacsr = ((esp->prev_hme_dmacsr |
@@ -440,7 +450,7 @@ static void sbus_esp_send_dma_cmd(struct esp *esp, u32 addr, u32 esp_count,
                else
                        csr &= ~DMA_ST_WRITE;
                dma_write32(csr, DMA_CSR);
-                if (esp->dma->revision == dvmaesc1) {
+                if (esp->dmarev == dvmaesc1) {
                        u32 end = PAGE_ALIGN(addr + dma_count + 16U);
                        dma_write32(end - addr, DMA_COUNT);
                }
@@ -476,10 +486,8 @@ static const struct esp_driver_ops sbus_esp_ops = {
        .dma_error      =       sbus_esp_dma_error,
 };
-static int __devinit esp_sbus_probe_one(struct device *dev,
+static int __devinit esp_sbus_probe_one(struct of_device *op,
-                                        struct sbus_dev *esp_dev,
+                                        struct of_device *espdma,
-                                        struct sbus_dev *espdma,
-                                        struct sbus_bus *sbus,
                                        int hme)
 {
        struct scsi_host_template *tpnt = &scsi_esp_template;
@@ -497,13 +505,13 @@ static int __devinit esp_sbus_probe_one(struct device *dev,
        esp = shost_priv(host);
        esp->host = host;
-        esp->dev = esp_dev;
+        esp->dev = op;
        esp->ops = &sbus_esp_ops;
        if (hme)
                esp->flags |= ESP_FLAG_WIDE_CAPABLE;
-        err = esp_sbus_find_dma(esp, espdma);
+        err = esp_sbus_setup_dma(esp, espdma);
        if (err < 0)
                goto fail_unlink;
@@ -525,15 +533,15 @@ static int __devinit esp_sbus_probe_one(struct device *dev,
         * come up with the reset bit set, so make sure that
         * is clear first.
         */
-        if (esp->dma->revision == dvmaesc1) {
+        if (esp->dmarev == dvmaesc1) {
                u32 val = dma_read32(DMA_CSR);
                dma_write32(val & ~DMA_RST_SCSI, DMA_CSR);
        }
-        dev_set_drvdata(&esp_dev->ofdev.dev, esp);
+        dev_set_drvdata(&op->dev, esp);
-        err = scsi_esp_register(esp, dev);
+        err = scsi_esp_register(esp, &op->dev);
        if (err)
                goto fail_free_irq;
@@ -542,41 +550,46 @@ static int __devinit esp_sbus_probe_one(struct device *dev,
 fail_free_irq:
        free_irq(host->irq, esp);
 fail_unmap_command_block:
-        sbus_free_consistent(esp->dev, 16,
+        dma_free_coherent(&op->dev, 16,
-                             esp->command_block,
+                          esp->command_block,
-                             esp->command_block_dma);
+                          esp->command_block_dma);
 fail_unmap_regs:
-        sbus_iounmap(esp->regs, SBUS_ESP_REG_SIZE);
+        of_iounmap(&op->resource[(hme ? 1 : 0)], esp->regs, SBUS_ESP_REG_SIZE);
 fail_unlink:
        scsi_host_put(host);
 fail:
        return err;
 }
-static int __devinit esp_sbus_probe(struct of_device *dev, const struct of_device_id *match)
+static int __devinit esp_sbus_probe(struct of_device *op, const struct of_device_id *match)
 {
-        struct sbus_dev *sdev = to_sbus_device(&dev->dev);
+        struct device_node *dma_node = NULL;
-        struct device_node *dp = dev->node;
+        struct device_node *dp = op->node;
-        struct sbus_dev *dma_sdev = NULL;
+        struct of_device *dma_of = NULL;
        int hme = 0;
        if (dp->parent &&
            (!strcmp(dp->parent->name, "espdma") ||
             !strcmp(dp->parent->name, "dma")))
-                dma_sdev = sdev->parent;
+                dma_node = dp->parent;
        else if (!strcmp(dp->name, "SUNW,fas")) {
-                dma_sdev = sdev;
+                dma_node = op->node;
                hme = 1;
        }
+        if (dma_node)
+                dma_of = of_find_device_by_node(dma_node);
+        if (!dma_of)
+                return -ENODEV;
-        return esp_sbus_probe_one(&dev->dev, sdev, dma_sdev,
+        return esp_sbus_probe_one(op, dma_of, hme);
-                                  sdev->bus, hme);
 }
-static int __devexit esp_sbus_remove(struct of_device *dev)
+static int __devexit esp_sbus_remove(struct of_device *op)
 {
-        struct esp *esp = dev_get_drvdata(&dev->dev);
+        struct esp *esp = dev_get_drvdata(&op->dev);
+        struct of_device *dma_of = esp->dma;
        unsigned int irq = esp->host->irq;
+        bool is_hme;
        u32 val;
        scsi_esp_unregister(esp);
@@ -586,17 +599,25 @@ static int __devexit esp_sbus_remove(struct of_device *dev)
        dma_write32(val & ~DMA_INT_ENAB, DMA_CSR);
        free_irq(irq, esp);
-        sbus_free_consistent(esp->dev, 16,
-                             esp->command_block,
+        is_hme = (esp->dmarev == dvmahme);
-                             esp->command_block_dma);
-        sbus_iounmap(esp->regs, SBUS_ESP_REG_SIZE);
+        dma_free_coherent(&op->dev, 16,
+                          esp->command_block,
+                          esp->command_block_dma);
+        of_iounmap(&op->resource[(is_hme ? 1 : 0)], esp->regs,
+                   SBUS_ESP_REG_SIZE);
+        of_iounmap(&dma_of->resource[0], esp->dma_regs,
+                   resource_size(&dma_of->resource[0]));
        scsi_host_put(esp->host);
+        dev_set_drvdata(&op->dev, NULL);
        return 0;
 }
-static struct of_device_id esp_match[] = {
+static const struct of_device_id esp_match[] = {
        {
                .name = "SUNW,esp",
        },
@@ -619,7 +640,7 @@ static struct of_platform_driver esp_sbus_driver = {
 static int __init sunesp_init(void)
 {
-        return of_register_driver(&esp_sbus_driver, &sbus_bus_type);
+        return of_register_driver(&esp_sbus_driver, &of_bus_type);
 }
 static void __exit sunesp_exit(void)
diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
index d39107b7669b..f4e6cde1fd0d 100644
--- a/drivers/scsi/sym53c8xx_2/sym_glue.c
+++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
@@ -519,8 +519,8 @@ static int sym53c8xx_queue_command(struct scsi_cmnd *cmd,
         *  Shorten our settle_time if needed for 
         *  this command not to time out.
         */
-        if (np->s.settle_time_valid && cmd->timeout_per_command) {
+        if (np->s.settle_time_valid && cmd->request->timeout) {
-                unsigned long tlimit = jiffies + cmd->timeout_per_command;
+                unsigned long tlimit = jiffies + cmd->request->timeout;
                tlimit -= SYM_CONF_TIMER_INTERVAL*2;
                if (time_after(np->s.settle_time, tlimit)) {
                        np->s.settle_time = tlimit;
diff --git a/drivers/scsi/tmscsim.c b/drivers/scsi/tmscsim.c
index 1723d71cbf3f..69ac6e590f1d 100644
--- a/drivers/scsi/tmscsim.c
+++ b/drivers/scsi/tmscsim.c
@@ -2573,8 +2573,8 @@ static struct pci_driver dc390_driver = {
 static int __init dc390_module_init(void)
 {
        if (!disable_clustering)
-                printk(KERN_INFO "DC390: clustering now enabled by default. If you get problems load\n"
+                printk(KERN_INFO "DC390: clustering now enabled by default. If you get problems load\n");
-                       "\twith \"disable_clustering=1\" and report to maintainers\n");
+                printk(KERN_INFO "       with \"disable_clustering=1\" and report to maintainers\n");
        if (tmscsim[0] == -1 || tmscsim[0] > 15) {
                tmscsim[0] = 7;