71 files changed, 509 insertions, 276 deletions
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 68699b3e7998..bbaa545ea999 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1410,7 +1410,7 @@ static void ata_qc_complete_internal(struct ata_queued_cmd *qc)
 */
 unsigned ata_exec_internal_sg(struct ata_device *dev,
                              struct ata_taskfile *tf, const u8 *cdb,
-                              int dma_dir, struct scatterlist *sg,
+                              int dma_dir, struct scatterlist *sgl,
                              unsigned int n_elem, unsigned long timeout)
 {
        struct ata_link *link = dev->link;
@@ -1472,11 +1472,12 @@ unsigned ata_exec_internal_sg(struct ata_device *dev,
        qc->dma_dir = dma_dir;
        if (dma_dir != DMA_NONE) {
                unsigned int i, buflen = 0;
+                struct scatterlist *sg;
-                for (i = 0; i < n_elem; i++)
+                for_each_sg(sgl, sg, n_elem, i)
-                        buflen += sg[i].length;
+                        buflen += sg->length;
-                ata_sg_init(qc, sg, n_elem);
+                ata_sg_init(qc, sgl, n_elem);
                qc->nbytes = buflen;
        }
@@ -4292,7 +4293,7 @@ void ata_sg_clean(struct ata_queued_cmd *qc)
                if (qc->n_elem)
                        dma_unmap_sg(ap->dev, sg, qc->n_elem, dir);
                /* restore last sg */
-                sg[qc->orig_n_elem - 1].length += qc->pad_len;
+                sg_last(sg, qc->orig_n_elem)->length += qc->pad_len;
                if (pad_buf) {
                        struct scatterlist *psg = &qc->pad_sgent;
                        void *addr = kmap_atomic(psg->page, KM_IRQ0);
@@ -4547,6 +4548,7 @@ void ata_sg_init_one(struct ata_queued_cmd *qc, void *buf, unsigned int buflen)
        qc->orig_n_elem = 1;
        qc->buf_virt = buf;
        qc->nbytes = buflen;
+        qc->cursg = qc->__sg;
        sg_init_one(&qc->sgent, buf, buflen);
 }
@@ -4572,6 +4574,7 @@ void ata_sg_init(struct ata_queued_cmd *qc, struct scatterlist *sg,
        qc->__sg = sg;
        qc->n_elem = n_elem;
        qc->orig_n_elem = n_elem;
+        qc->cursg = qc->__sg;
 }
 /**
@@ -4661,7 +4664,7 @@ static int ata_sg_setup(struct ata_queued_cmd *qc)
 {
        struct ata_port *ap = qc->ap;
        struct scatterlist *sg = qc->__sg;
-        struct scatterlist *lsg = &sg[qc->n_elem - 1];
+        struct scatterlist *lsg = sg_last(qc->__sg, qc->n_elem);
        int n_elem, pre_n_elem, dir, trim_sg = 0;
        VPRINTK("ENTER, ata%u\n", ap->print_id);
@@ -4825,7 +4828,6 @@ void ata_data_xfer_noirq(struct ata_device *adev, unsigned char *buf,
 static void ata_pio_sector(struct ata_queued_cmd *qc)
 {
        int do_write = (qc->tf.flags & ATA_TFLAG_WRITE);
-        struct scatterlist *sg = qc->__sg;
        struct ata_port *ap = qc->ap;
        struct page *page;
        unsigned int offset;
@@ -4834,8 +4836,8 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
        if (qc->curbytes == qc->nbytes - qc->sect_size)
                ap->hsm_task_state = HSM_ST_LAST;
-        page = sg[qc->cursg].page;
+        page = qc->cursg->page;
-        offset = sg[qc->cursg].offset + qc->cursg_ofs;
+        offset = qc->cursg->offset + qc->cursg_ofs;
        /* get the current page and offset */
        page = nth_page(page, (offset >> PAGE_SHIFT));
@@ -4863,8 +4865,8 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
        qc->curbytes += qc->sect_size;
        qc->cursg_ofs += qc->sect_size;
-        if (qc->cursg_ofs == (&sg[qc->cursg])->length) {
+        if (qc->cursg_ofs == qc->cursg->length) {
-                qc->cursg++;
+                qc->cursg = sg_next(qc->cursg);
                qc->cursg_ofs = 0;
        }
 }
@@ -4950,16 +4952,18 @@ static void __atapi_pio_bytes(struct ata_queued_cmd *qc, unsigned int bytes)
 {
        int do_write = (qc->tf.flags & ATA_TFLAG_WRITE);
        struct scatterlist *sg = qc->__sg;
+        struct scatterlist *lsg = sg_last(qc->__sg, qc->n_elem);
        struct ata_port *ap = qc->ap;
        struct page *page;
        unsigned char *buf;
        unsigned int offset, count;
+        int no_more_sg = 0;
        if (qc->curbytes + bytes >= qc->nbytes)
                ap->hsm_task_state = HSM_ST_LAST;
 next_sg:
-        if (unlikely(qc->cursg >= qc->n_elem)) {
+        if (unlikely(no_more_sg)) {
                /*
                 * The end of qc->sg is reached and the device expects
                 * more data to transfer. In order not to overrun qc->sg
@@ -4982,7 +4986,7 @@ next_sg:
                return;
        }
-        sg = &qc->__sg[qc->cursg];
+        sg = qc->cursg;
        page = sg->page;
        offset = sg->offset + qc->cursg_ofs;
@@ -5021,7 +5025,10 @@ next_sg:
        qc->cursg_ofs += count;
        if (qc->cursg_ofs == sg->length) {
-                qc->cursg++;
+                if (qc->cursg == lsg)
+                        no_more_sg = 1;
+                qc->cursg = sg_next(qc->cursg);
                qc->cursg_ofs = 0;
        }
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index d63c81ed084f..ba62d534f32b 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -801,8 +801,6 @@ int ata_scsi_slave_config(struct scsi_device *sdev)
        ata_scsi_sdev_config(sdev);
-        blk_queue_max_phys_segments(sdev->request_queue, LIBATA_MAX_PRD);
        sdev->manage_start_stop = 1;
        if (dev)
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index a895228f3d70..3fb7e8bc436d 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -2569,6 +2569,7 @@ static void do_cciss_request(struct request_queue *q)
               (int)creq->nr_sectors);
 #endif                          /* CCISS_DEBUG */
+        memset(tmp_sg, 0, sizeof(tmp_sg));
        seg = blk_rq_map_sg(q, creq, tmp_sg);
        /* get the DMA records for the setup */
diff --git a/drivers/ide/cris/ide-cris.c b/drivers/ide/cris/ide-cris.c
index 2b4d2a0ae5c2..c306c9f534ab 100644
--- a/drivers/ide/cris/ide-cris.c
+++ b/drivers/ide/cris/ide-cris.c
@@ -939,7 +939,8 @@ static int cris_ide_build_dmatable (ide_drive_t *drive)
                /* group sequential buffers into one large buffer */
                addr = page_to_phys(sg->page) + sg->offset;
                size = sg_dma_len(sg);
-                while (sg++, --i) {
+                while (--i) {
+                        sg = sg_next(sg);
                        if ((addr + size) != page_to_phys(sg->page) + sg->offset)
                                break;
                        size += sg_dma_len(sg);
diff --git a/drivers/ide/ide-dma.c b/drivers/ide/ide-dma.c
index b453211ee0fc..a4cbbbaccde9 100644
--- a/drivers/ide/ide-dma.c
+++ b/drivers/ide/ide-dma.c
@@ -280,7 +280,7 @@ int ide_build_dmatable (ide_drive_t *drive, struct request *rq)
                        }
                }
-                sg++;
+                sg = sg_next(sg);
                i--;
        }
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index f36ff5962af6..04273d3c147c 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -846,7 +846,8 @@ void ide_init_sg_cmd(ide_drive_t *drive, struct request *rq)
        ide_hwif_t *hwif = drive->hwif;
        hwif->nsect = hwif->nleft = rq->nr_sectors;
-        hwif->cursg = hwif->cursg_ofs = 0;
+        hwif->cursg_ofs = 0;
+        hwif->cursg = NULL;
 }
 EXPORT_SYMBOL_GPL(ide_init_sg_cmd);
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index d1011712601c..34b1fb65bc79 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1349,7 +1349,7 @@ static int hwif_init(ide_hwif_t *hwif)
        if (!hwif->sg_max_nents)
                hwif->sg_max_nents = PRD_ENTRIES;
-        hwif->sg_table = kmalloc(sizeof(struct scatterlist)*hwif->sg_max_nents,
+        hwif->sg_table = kzalloc(sizeof(struct scatterlist)*hwif->sg_max_nents,
                                 GFP_KERNEL);
        if (!hwif->sg_table) {
                printk(KERN_ERR "%s: unable to allocate SG table.\n", hwif->name);
diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c
index aa06dafb74ac..2a3c8d498343 100644
--- a/drivers/ide/ide-taskfile.c
+++ b/drivers/ide/ide-taskfile.c
@@ -45,6 +45,7 @@
 #include <linux/hdreg.h>
 #include <linux/ide.h>
 #include <linux/bitops.h>
+#include <linux/scatterlist.h>
 #include <asm/byteorder.h>
 #include <asm/irq.h>
@@ -263,6 +264,7 @@ static void ide_pio_sector(ide_drive_t *drive, unsigned int write)
 {
        ide_hwif_t *hwif = drive->hwif;
        struct scatterlist *sg = hwif->sg_table;
+        struct scatterlist *cursg = hwif->cursg;
        struct page *page;
 #ifdef CONFIG_HIGHMEM
        unsigned long flags;
@@ -270,8 +272,14 @@ static void ide_pio_sector(ide_drive_t *drive, unsigned int write)
        unsigned int offset;
        u8 *buf;
-        page = sg[hwif->cursg].page;
+        cursg = hwif->cursg;
-        offset = sg[hwif->cursg].offset + hwif->cursg_ofs * SECTOR_SIZE;
+        if (!cursg) {
+                cursg = sg;
+                hwif->cursg = sg;
+        }
+        page = cursg->page;
+        offset = cursg->offset + hwif->cursg_ofs * SECTOR_SIZE;
        /* get the current page and offset */
        page = nth_page(page, (offset >> PAGE_SHIFT));
@@ -285,8 +293,8 @@ static void ide_pio_sector(ide_drive_t *drive, unsigned int write)
        hwif->nleft--;
        hwif->cursg_ofs++;
-        if ((hwif->cursg_ofs * SECTOR_SIZE) == sg[hwif->cursg].length) {
+        if ((hwif->cursg_ofs * SECTOR_SIZE) == cursg->length) {
-                hwif->cursg++;
+                hwif->cursg = sg_next(hwif->cursg);
                hwif->cursg_ofs = 0;
        }
@@ -367,6 +375,8 @@ static ide_startstop_t task_error(ide_drive_t *drive, struct request *rq,
 static void task_end_request(ide_drive_t *drive, struct request *rq, u8 stat)
 {
+        HWIF(drive)->cursg = NULL;
        if (rq->cmd_type == REQ_TYPE_ATA_TASKFILE) {
                ide_task_t *task = rq->special;
diff --git a/drivers/ide/mips/au1xxx-ide.c b/drivers/ide/mips/au1xxx-ide.c
index aebde49365d1..892d08f61dc0 100644
--- a/drivers/ide/mips/au1xxx-ide.c
+++ b/drivers/ide/mips/au1xxx-ide.c
@@ -296,7 +296,7 @@ static int auide_build_dmatable(ide_drive_t *drive)
                        cur_addr += tc;
                        cur_len -= tc;
                }
-                sg++;
+                sg = sg_next(sg);
                i--;
        }
diff --git a/drivers/ide/pci/sgiioc4.c b/drivers/ide/pci/sgiioc4.c
index 85ffaaa39b1b..c74fef6bbc91 100644
--- a/drivers/ide/pci/sgiioc4.c
+++ b/drivers/ide/pci/sgiioc4.c
@@ -29,6 +29,7 @@
 #include <linux/mm.h>
 #include <linux/ioport.h>
 #include <linux/blkdev.h>
+#include <linux/scatterlist.h>
 #include <linux/ioc4.h>
 #include <asm/io.h>
@@ -537,7 +538,7 @@ sgiioc4_build_dma_table(ide_drive_t * drive, struct request *rq, int ddir)
                        }
                }
-                sg++;
+                sg = sg_next(sg);
                i--;
        }
diff --git a/drivers/ide/ppc/pmac.c b/drivers/ide/ppc/pmac.c
index 7d8873839e21..9e86406bf44b 100644
--- a/drivers/ide/ppc/pmac.c
+++ b/drivers/ide/ppc/pmac.c
@@ -1539,7 +1539,7 @@ pmac_ide_build_dmatable(ide_drive_t *drive, struct request *rq)
                        cur_len -= tc;
                        ++table;
                }
-                sg++;
+                sg = sg_next(sg);
                i--;
        }
diff --git a/drivers/infiniband/hw/ipath/ipath_dma.c b/drivers/infiniband/hw/ipath/ipath_dma.c
index f87f003e3ef8..22709a4f8fc8 100644
--- a/drivers/infiniband/hw/ipath/ipath_dma.c
+++ b/drivers/infiniband/hw/ipath/ipath_dma.c
@@ -30,6 +30,7 @@
 * SOFTWARE.
 */
+#include <linux/scatterlist.h>
 #include <rdma/ib_verbs.h>
 #include "ipath_verbs.h"
@@ -96,17 +97,18 @@ static void ipath_dma_unmap_page(struct ib_device *dev,
        BUG_ON(!valid_dma_direction(direction));
 }
-static int ipath_map_sg(struct ib_device *dev, struct scatterlist *sg, int nents,
+static int ipath_map_sg(struct ib_device *dev, struct scatterlist *sgl,
-                        enum dma_data_direction direction)
+                        int nents, enum dma_data_direction direction)
 {
+        struct scatterlist *sg;
        u64 addr;
        int i;
        int ret = nents;
        BUG_ON(!valid_dma_direction(direction));
-        for (i = 0; i < nents; i++) {
+        for_each_sg(sgl, sg, nents, i) {
-                addr = (u64) page_address(sg[i].page);
+                addr = (u64) page_address(sg->page);
                /* TODO: handle highmem pages */
                if (!addr) {
                        ret = 0;
diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
index e05690e3592f..f3529b6f0a33 100644
--- a/drivers/infiniband/ulp/iser/iser_memory.c
+++ b/drivers/infiniband/ulp/iser/iser_memory.c
@@ -124,17 +124,19 @@ static int iser_start_rdma_unaligned_sg(struct iscsi_iser_cmd_task *iser_ctask,
        if (cmd_dir == ISER_DIR_OUT) {
                /* copy the unaligned sg the buffer which is used for RDMA */
-                struct scatterlist *sg = (struct scatterlist *)data->buf;
+                struct scatterlist *sgl = (struct scatterlist *)data->buf;
+                struct scatterlist *sg;
                int i;
                char *p, *from;
-                for (p = mem, i = 0; i < data->size; i++) {
+                p = mem;
-                        from = kmap_atomic(sg[i].page, KM_USER0);
+                for_each_sg(sgl, sg, data->size, i) {
+                        from = kmap_atomic(sg->page, KM_USER0);
                        memcpy(p,
-                               from + sg[i].offset,
+                               from + sg->offset,
-                               sg[i].length);
+                               sg->length);
                        kunmap_atomic(from, KM_USER0);
-                        p += sg[i].length;
+                        p += sg->length;
                }
        }
@@ -176,7 +178,7 @@ void iser_finalize_rdma_unaligned_sg(struct iscsi_iser_cmd_task *iser_ctask,
        if (cmd_dir == ISER_DIR_IN) {
                char *mem;
-                struct scatterlist *sg;
+                struct scatterlist *sgl, *sg;
                unsigned char *p, *to;
                unsigned int sg_size;
                int i;
@@ -184,16 +186,17 @@ void iser_finalize_rdma_unaligned_sg(struct iscsi_iser_cmd_task *iser_ctask,
                /* copy back read RDMA to unaligned sg */
                mem     = mem_copy->copy_buf;
-                sg      = (struct scatterlist *)iser_ctask->data[ISER_DIR_IN].buf;
+                sgl     = (struct scatterlist *)iser_ctask->data[ISER_DIR_IN].buf;
                sg_size = iser_ctask->data[ISER_DIR_IN].size;
-                for (p = mem, i = 0; i < sg_size; i++){
+                p = mem;
-                        to = kmap_atomic(sg[i].page, KM_SOFTIRQ0);
+                for_each_sg(sgl, sg, sg_size, i) {
-                        memcpy(to + sg[i].offset,
+                        to = kmap_atomic(sg->page, KM_SOFTIRQ0);
+                        memcpy(to + sg->offset,
                               p,
-                               sg[i].length);
+                               sg->length);
                        kunmap_atomic(to, KM_SOFTIRQ0);
-                        p += sg[i].length;
+                        p += sg->length;
                }
        }
@@ -224,7 +227,8 @@ static int iser_sg_to_page_vec(struct iser_data_buf *data,
                               struct iser_page_vec *page_vec,
                               struct ib_device *ibdev)
 {
-        struct scatterlist *sg = (struct scatterlist *)data->buf;
+        struct scatterlist *sgl = (struct scatterlist *)data->buf;
+        struct scatterlist *sg;
        u64 first_addr, last_addr, page;
        int end_aligned;
        unsigned int cur_page = 0;
@@ -232,24 +236,25 @@ static int iser_sg_to_page_vec(struct iser_data_buf *data,
        int i;
        /* compute the offset of first element */
-        page_vec->offset = (u64) sg[0].offset & ~MASK_4K;
+        page_vec->offset = (u64) sgl[0].offset & ~MASK_4K;
-        for (i = 0; i < data->dma_nents; i++) {
+        for_each_sg(sgl, sg, data->dma_nents, i) {
-                unsigned int dma_len = ib_sg_dma_len(ibdev, &sg[i]);
+                unsigned int dma_len = ib_sg_dma_len(ibdev, sg);
                total_sz += dma_len;
-                first_addr = ib_sg_dma_address(ibdev, &sg[i]);
+                first_addr = ib_sg_dma_address(ibdev, sg);
                last_addr  = first_addr + dma_len;
                end_aligned   = !(last_addr  & ~MASK_4K);
                /* continue to collect page fragments till aligned or SG ends */
                while (!end_aligned && (i + 1 < data->dma_nents)) {
+                        sg = sg_next(sg);
                        i++;
-                        dma_len = ib_sg_dma_len(ibdev, &sg[i]);
+                        dma_len = ib_sg_dma_len(ibdev, sg);
                        total_sz += dma_len;
-                        last_addr = ib_sg_dma_address(ibdev, &sg[i]) + dma_len;
+                        last_addr = ib_sg_dma_address(ibdev, sg) + dma_len;
                        end_aligned = !(last_addr  & ~MASK_4K);
                }
@@ -284,25 +289,26 @@ static int iser_sg_to_page_vec(struct iser_data_buf *data,
 static unsigned int iser_data_buf_aligned_len(struct iser_data_buf *data,
                                              struct ib_device *ibdev)
 {
-        struct scatterlist *sg;
+        struct scatterlist *sgl, *sg;
        u64 end_addr, next_addr;
        int i, cnt;
        unsigned int ret_len = 0;
-        sg = (struct scatterlist *)data->buf;
+        sgl = (struct scatterlist *)data->buf;
-        for (cnt = 0, i = 0; i < data->dma_nents; i++, cnt++) {
+        cnt = 0;
+        for_each_sg(sgl, sg, data->dma_nents, i) {
                /* iser_dbg("Checking sg iobuf [%d]: phys=0x%08lX "
                   "offset: %ld sz: %ld\n", i,
-                   (unsigned long)page_to_phys(sg[i].page),
+                   (unsigned long)page_to_phys(sg->page),
-                   (unsigned long)sg[i].offset,
+                   (unsigned long)sg->offset,
-                   (unsigned long)sg[i].length); */
+                   (unsigned long)sg->length); */
-                end_addr = ib_sg_dma_address(ibdev, &sg[i]) +
+                end_addr = ib_sg_dma_address(ibdev, sg) +
-                           ib_sg_dma_len(ibdev, &sg[i]);
+                           ib_sg_dma_len(ibdev, sg);
                /* iser_dbg("Checking sg iobuf end address "
                       "0x%08lX\n", end_addr); */
                if (i + 1 < data->dma_nents) {
-                        next_addr = ib_sg_dma_address(ibdev, &sg[i+1]);
+                        next_addr = ib_sg_dma_address(ibdev, sg_next(sg));
                        /* are i, i+1 fragments of the same page? */
                        if (end_addr == next_addr)
                                continue;
@@ -322,15 +328,16 @@ static unsigned int iser_data_buf_aligned_len(struct iser_data_buf *data,
 static void iser_data_buf_dump(struct iser_data_buf *data,
                               struct ib_device *ibdev)
 {
-        struct scatterlist *sg = (struct scatterlist *)data->buf;
+        struct scatterlist *sgl = (struct scatterlist *)data->buf;
+        struct scatterlist *sg;
        int i;
-        for (i = 0; i < data->dma_nents; i++)
+        for_each_sg(sgl, sg, data->dma_nents, i)
                iser_err("sg[%d] dma_addr:0x%lX page:0x%p "
                         "off:0x%x sz:0x%x dma_len:0x%x\n",
-                         i, (unsigned long)ib_sg_dma_address(ibdev, &sg[i]),
+                         i, (unsigned long)ib_sg_dma_address(ibdev, sg),
-                         sg[i].page, sg[i].offset,
+                         sg->page, sg->offset,
-                         sg[i].length, ib_sg_dma_len(ibdev, &sg[i]));
+                         sg->length, ib_sg_dma_len(ibdev, sg));
 }
 static void iser_dump_page_vec(struct iser_page_vec *page_vec)
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index bdff950a54a1..3918ebf01e8d 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -293,7 +293,7 @@ nextSGEset:
        for (ii=0; ii < (numSgeThisFrame-1); ii++) {
                thisxfer = sg_dma_len(sg);
                if (thisxfer == 0) {
-                        sg ++; /* Get next SG element from the OS */
+                        sg = sg_next(sg); /* Get next SG element from the OS */
                        sg_done++;
                        continue;
                }
@@ -301,7 +301,7 @@ nextSGEset:
                v2 = sg_dma_address(sg);
                mptscsih_add_sge(psge, sgflags | thisxfer, v2);
-                sg++;           /* Get next SG element from the OS */
+                sg = sg_next(sg);       /* Get next SG element from the OS */
                psge += (sizeof(u32) + sizeof(dma_addr_t));
                sgeOffset += (sizeof(u32) + sizeof(dma_addr_t));
                sg_done++;
@@ -322,7 +322,7 @@ nextSGEset:
                v2 = sg_dma_address(sg);
                mptscsih_add_sge(psge, sgflags | thisxfer, v2);
                /*
-                sg++;
+                sg = sg_next(sg);
                psge += (sizeof(u32) + sizeof(dma_addr_t));
                */
                sgeOffset += (sizeof(u32) + sizeof(dma_addr_t));
diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
index b0abc7d92805..a5d0354bbbda 100644
--- a/drivers/mmc/card/queue.c
+++ b/drivers/mmc/card/queue.c
@@ -153,14 +153,14 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card, spinlock_t *lock
                        blk_queue_max_hw_segments(mq->queue, bouncesz / 512);
                        blk_queue_max_segment_size(mq->queue, bouncesz);
-                        mq->sg = kmalloc(sizeof(struct scatterlist),
+                        mq->sg = kzalloc(sizeof(struct scatterlist),
                                GFP_KERNEL);
                        if (!mq->sg) {
                                ret = -ENOMEM;
                                goto cleanup_queue;
                        }
-                        mq->bounce_sg = kmalloc(sizeof(struct scatterlist) *
+                        mq->bounce_sg = kzalloc(sizeof(struct scatterlist) *
                                bouncesz / 512, GFP_KERNEL);
                        if (!mq->bounce_sg) {
                                ret = -ENOMEM;
@@ -177,7 +177,7 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card, spinlock_t *lock
                blk_queue_max_hw_segments(mq->queue, host->max_hw_segs);
                blk_queue_max_segment_size(mq->queue, host->max_seg_size);
-                mq->sg = kmalloc(sizeof(struct scatterlist) *
+                mq->sg = kzalloc(sizeof(struct scatterlist) *
                        host->max_phys_segs, GFP_KERNEL);
                if (!mq->sg) {
                        ret = -ENOMEM;
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index 16e5563e0c65..57cac7008e0b 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -34,6 +34,7 @@
 #include <linux/slab.h>
 #include <linux/mempool.h>
 #include <linux/syscalls.h>
+#include <linux/scatterlist.h>
 #include <linux/ioctl.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_tcq.h>
diff --git a/drivers/s390/scsi/zfcp_qdio.c b/drivers/s390/scsi/zfcp_qdio.c
index 3f105fdcf239..51d92b196ee7 100644
--- a/drivers/s390/scsi/zfcp_qdio.c
+++ b/drivers/s390/scsi/zfcp_qdio.c
@@ -590,7 +590,7 @@ zfcp_qdio_sbals_from_segment(struct zfcp_fsf_req *fsf_req, unsigned long sbtype,
 */
 int
 zfcp_qdio_sbals_from_sg(struct zfcp_fsf_req *fsf_req, unsigned long sbtype,
-                        struct scatterlist *sg, int sg_count, int max_sbals)
+                        struct scatterlist *sgl, int sg_count, int max_sbals)
 {
        int sg_index;
        struct scatterlist *sg_segment;
@@ -606,9 +606,7 @@ zfcp_qdio_sbals_from_sg(struct zfcp_fsf_req *fsf_req, unsigned long sbtype,
        sbale->flags |= sbtype;
        /* process all segements of scatter-gather list */
-        for (sg_index = 0, sg_segment = sg, bytes = 0;
+        for_each_sg(sgl, sg_segment, sg_count, sg_index) {
-             sg_index < sg_count;
-             sg_index++, sg_segment++) {
                retval = zfcp_qdio_sbals_from_segment(
                                fsf_req,
                                sbtype,
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index efd9d8d3a890..fb14014ee16e 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -1990,6 +1990,7 @@ static struct scsi_host_template driver_template = {
        .max_sectors            = TW_MAX_SECTORS,
        .cmd_per_lun            = TW_MAX_CMDS_PER_LUN,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
        .shost_attrs            = twa_host_attrs,
        .emulated               = 1
 };
diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
index c7995fc216e8..a64153b96034 100644
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -2261,6 +2261,7 @@ static struct scsi_host_template driver_template = {
        .max_sectors            = TW_MAX_SECTORS,
        .cmd_per_lun            = TW_MAX_CMDS_PER_LUN,  
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
        .shost_attrs            = tw_host_attrs,
        .emulated               = 1
 };
diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
index 9b206176f717..49e1ffa4b2ff 100644
--- a/drivers/scsi/BusLogic.c
+++ b/drivers/scsi/BusLogic.c
@@ -3575,6 +3575,7 @@ static struct scsi_host_template Bus_Logic_template = {
        .unchecked_isa_dma = 1,
        .max_sectors = 128,
        .use_clustering = ENABLE_CLUSTERING,
+        .use_sg_chaining = ENABLE_SG_CHAINING,
 };
 /*
diff --git a/drivers/scsi/NCR53c406a.c b/drivers/scsi/NCR53c406a.c
index eda8c48f6be7..3168a1794849 100644
--- a/drivers/scsi/NCR53c406a.c
+++ b/drivers/scsi/NCR53c406a.c
@@ -1066,7 +1066,8 @@ static struct scsi_host_template driver_template =
     .sg_tablesize              = 32                    /*SG_ALL*/ /*SG_NONE*/, 
     .cmd_per_lun               = 1                     /* commands per lun */, 
     .unchecked_isa_dma         = 1                     /* unchecked_isa_dma */,
-     .use_clustering            = ENABLE_CLUSTERING                               
+     .use_clustering            = ENABLE_CLUSTERING,
+     .use_sg_chaining           = ENABLE_SG_CHAINING,
 };
 #include "scsi_module.c"
diff --git a/drivers/scsi/a100u2w.c b/drivers/scsi/a100u2w.c
index f608d4a1d6da..d3a6d15fb77a 100644
--- a/drivers/scsi/a100u2w.c
+++ b/drivers/scsi/a100u2w.c
@@ -1071,6 +1071,7 @@ static struct scsi_host_template inia100_template = {
        .sg_tablesize           = SG_ALL,
        .cmd_per_lun            = 1,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
 };
 static int __devinit inia100_probe_one(struct pci_dev *pdev,
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index a7f42a17b5c7..038980be763d 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -944,6 +944,7 @@ static struct scsi_host_template aac_driver_template = {
        .cmd_per_lun                    = AAC_NUM_IO_FIB, 
 #endif  
        .use_clustering                 = ENABLE_CLUSTERING,
+        .use_sg_chaining                = ENABLE_SG_CHAINING,
        .emulated                       = 1,
 };
diff --git a/drivers/scsi/aha1542.c b/drivers/scsi/aha1542.c
index cbbfbc9f3e0f..961a1882cb7e 100644
--- a/drivers/scsi/aha1542.c
+++ b/drivers/scsi/aha1542.c
@@ -61,15 +61,15 @@ static void BAD_DMA(void *address, unsigned int length)
 }
 static void BAD_SG_DMA(Scsi_Cmnd * SCpnt,
-                       struct scatterlist *sgpnt,
+                       struct scatterlist *sgp,
                       int nseg,
                       int badseg)
 {
        printk(KERN_CRIT "sgpnt[%d:%d] page %p/0x%llx length %u\n",
               badseg, nseg,
-               page_address(sgpnt[badseg].page) + sgpnt[badseg].offset,
+               page_address(sgp->page) + sgp->offset,
-               (unsigned long long)SCSI_SG_PA(&sgpnt[badseg]),
+               (unsigned long long)SCSI_SG_PA(sgp),
-               sgpnt[badseg].length);
+               sgp->length);
        /*
         * Not safe to continue.
@@ -691,7 +691,7 @@ static int aha1542_queuecommand(Scsi_Cmnd * SCpnt, void (*done) (Scsi_Cmnd *))
        memcpy(ccb[mbo].cdb, cmd, ccb[mbo].cdblen);
        if (SCpnt->use_sg) {
-                struct scatterlist *sgpnt;
+                struct scatterlist *sg;
                struct chain *cptr;
 #ifdef DEBUG
                unsigned char *ptr;
@@ -699,23 +699,21 @@ static int aha1542_queuecommand(Scsi_Cmnd * SCpnt, void (*done) (Scsi_Cmnd *))
                int i;
                ccb[mbo].op = 2;        /* SCSI Initiator Command  w/scatter-gather */
                SCpnt->host_scribble = kmalloc(512, GFP_KERNEL | GFP_DMA);
-                sgpnt = (struct scatterlist *) SCpnt->request_buffer;
                cptr = (struct chain *) SCpnt->host_scribble;
                if (cptr == NULL) {
                        /* free the claimed mailbox slot */
                        HOSTDATA(SCpnt->device->host)->SCint[mbo] = NULL;
                        return SCSI_MLQUEUE_HOST_BUSY;
                }
-                for (i = 0; i < SCpnt->use_sg; i++) {
+                scsi_for_each_sg(SCpnt, sg, SCpnt->use_sg, i) {
-                        if (sgpnt[i].length == 0 || SCpnt->use_sg > 16 ||
+                        if (sg->length == 0 || SCpnt->use_sg > 16 ||
-                            (((int) sgpnt[i].offset) & 1) || (sgpnt[i].length & 1)) {
+                            (((int) sg->offset) & 1) || (sg->length & 1)) {
                                unsigned char *ptr;
                                printk(KERN_CRIT "Bad segment list supplied to aha1542.c (%d, %d)\n", SCpnt->use_sg, i);
-                                for (i = 0; i < SCpnt->use_sg; i++) {
+                                scsi_for_each_sg(SCpnt, sg, SCpnt->use_sg, i) {
                                        printk(KERN_CRIT "%d: %p %d\n", i,
-                                               (page_address(sgpnt[i].page) +
+                                               (page_address(sg->page) +
-                                                sgpnt[i].offset),
+                                                sg->offset), sg->length);
-                                               sgpnt[i].length);
                                };
                                printk(KERN_CRIT "cptr %x: ", (unsigned int) cptr);
                                ptr = (unsigned char *) &cptr[i];
@@ -723,10 +721,10 @@ static int aha1542_queuecommand(Scsi_Cmnd * SCpnt, void (*done) (Scsi_Cmnd *))
                                        printk("%02x ", ptr[i]);
                                panic("Foooooooood fight!");
                        };
-                        any2scsi(cptr[i].dataptr, SCSI_SG_PA(&sgpnt[i]));
+                        any2scsi(cptr[i].dataptr, SCSI_SG_PA(sg));
-                        if (SCSI_SG_PA(&sgpnt[i]) + sgpnt[i].length - 1 > ISA_DMA_THRESHOLD)
+                        if (SCSI_SG_PA(sg) + sg->length - 1 > ISA_DMA_THRESHOLD)
-                                BAD_SG_DMA(SCpnt, sgpnt, SCpnt->use_sg, i);
+                                BAD_SG_DMA(SCpnt, sg, SCpnt->use_sg, i);
-                        any2scsi(cptr[i].datalen, sgpnt[i].length);
+                        any2scsi(cptr[i].datalen, sg->length);
                };
                any2scsi(ccb[mbo].datalen, SCpnt->use_sg * sizeof(struct chain));
                any2scsi(ccb[mbo].dataptr, SCSI_BUF_PA(cptr));
diff --git a/drivers/scsi/aha1740.c b/drivers/scsi/aha1740.c
index e4a4f3a965d9..f6722fd46008 100644
--- a/drivers/scsi/aha1740.c
+++ b/drivers/scsi/aha1740.c
@@ -563,6 +563,7 @@ static struct scsi_host_template aha1740_template = {
        .sg_tablesize     = AHA1740_SCATTER,
        .cmd_per_lun      = AHA1740_CMDLUN,
        .use_clustering   = ENABLE_CLUSTERING,
+        .use_sg_chaining  = ENABLE_SG_CHAINING,
        .eh_abort_handler = aha1740_eh_abort_handler,
 };
diff --git a/drivers/scsi/aic7xxx/aic79xx_osm.c b/drivers/scsi/aic7xxx/aic79xx_osm.c
index a055a96e3ad3..42c0f14a262c 100644
--- a/drivers/scsi/aic7xxx/aic79xx_osm.c
+++ b/drivers/scsi/aic7xxx/aic79xx_osm.c
@@ -766,6 +766,7 @@ struct scsi_host_template aic79xx_driver_template = {
        .max_sectors            = 8192,
        .cmd_per_lun            = 2,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
        .slave_alloc            = ahd_linux_slave_alloc,
        .slave_configure        = ahd_linux_slave_configure,
        .target_alloc           = ahd_linux_target_alloc,
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c
index 2e9c38f2e8a6..7770befbf50c 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c
@@ -747,6 +747,7 @@ struct scsi_host_template aic7xxx_driver_template = {
        .max_sectors            = 8192,
        .cmd_per_lun            = 2,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
        .slave_alloc            = ahc_linux_slave_alloc,
        .slave_configure        = ahc_linux_slave_configure,
        .target_alloc           = ahc_linux_target_alloc,
diff --git a/drivers/scsi/aic7xxx_old.c b/drivers/scsi/aic7xxx_old.c
index 1a71b0236c97..4025608d6964 100644
--- a/drivers/scsi/aic7xxx_old.c
+++ b/drivers/scsi/aic7xxx_old.c
@@ -11142,6 +11142,7 @@ static struct scsi_host_template driver_template = {
        .max_sectors            = 2048,
        .cmd_per_lun            = 3,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
 };
 #include "scsi_module.c"
diff --git a/drivers/scsi/aic94xx/aic94xx_task.c b/drivers/scsi/aic94xx/aic94xx_task.c
index f2b23e01401a..ee0a98bffcd4 100644
--- a/drivers/scsi/aic94xx/aic94xx_task.c
+++ b/drivers/scsi/aic94xx/aic94xx_task.c
@@ -94,7 +94,7 @@ static inline int asd_map_scatterlist(struct sas_task *task,
                        res = -ENOMEM;
                        goto err_unmap;
                }
-                for (sc = task->scatter, i = 0; i < num_sg; i++, sc++) {
+                for_each_sg(task->scatter, sc, num_sg, i) {
                        struct sg_el *sg =
                                &((struct sg_el *)ascb->sg_arr->vaddr)[i];
                        sg->bus_addr = cpu_to_le64((u64)sg_dma_address(sc));
@@ -103,7 +103,7 @@ static inline int asd_map_scatterlist(struct sas_task *task,
                                sg->flags |= ASD_SG_EL_LIST_EOL;
                }
-                for (sc = task->scatter, i = 0; i < 2; i++, sc++) {
+                for_each_sg(task->scatter, sc, 2, i) {
                        sg_arr[i].bus_addr =
                                cpu_to_le64((u64)sg_dma_address(sc));
                        sg_arr[i].size = cpu_to_le32((u32)sg_dma_len(sc));
@@ -115,7 +115,7 @@ static inline int asd_map_scatterlist(struct sas_task *task,
                sg_arr[2].bus_addr=cpu_to_le64((u64)ascb->sg_arr->dma_handle);
        } else {
                int i;
-                for (sc = task->scatter, i = 0; i < num_sg; i++, sc++) {
+                for_each_sg(task->scatter, sc, num_sg, i) {
                        sg_arr[i].bus_addr =
                                cpu_to_le64((u64)sg_dma_address(sc));
                        sg_arr[i].size = cpu_to_le32((u32)sg_dma_len(sc));
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
index cfcf40159eab..f81777586b8f 100644
--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -122,6 +122,7 @@ static struct scsi_host_template arcmsr_scsi_host_template = {
        .max_sectors            = ARCMSR_MAX_XFER_SECTORS,
        .cmd_per_lun            = ARCMSR_MAX_CMD_PERLUN,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
        .shost_attrs            = arcmsr_host_attrs,
 };
 #ifdef CONFIG_SCSI_ARCMSR_AER
diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
index 1591824cf4b3..fd42d4789202 100644
--- a/drivers/scsi/dc395x.c
+++ b/drivers/scsi/dc395x.c
@@ -4765,6 +4765,7 @@ static struct scsi_host_template dc395x_driver_template = {
        .eh_bus_reset_handler   = dc395x_eh_bus_reset,
        .unchecked_isa_dma      = 0,
        .use_clustering         = DISABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
 };
diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index bea9d659af15..8258506ba7d7 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -3295,6 +3295,7 @@ static struct scsi_host_template adpt_template = {
        .this_id                = 7,
        .cmd_per_lun            = 1,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
 };
 static s32 adpt_scsi_register(adpt_hba* pHba)
diff --git a/drivers/scsi/eata.c b/drivers/scsi/eata.c
index ec2233114bc9..7ead5210de96 100644
--- a/drivers/scsi/eata.c
+++ b/drivers/scsi/eata.c
@@ -523,7 +523,8 @@ static struct scsi_host_template driver_template = {
        .slave_configure = eata2x_slave_configure,
        .this_id = 7,
        .unchecked_isa_dma = 1,
-        .use_clustering = ENABLE_CLUSTERING
+        .use_clustering = ENABLE_CLUSTERING,
+        .use_sg_chaining = ENABLE_SG_CHAINING,
 };
 #if !defined(__BIG_ENDIAN_BITFIELD) && !defined(__LITTLE_ENDIAN_BITFIELD)
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index adc9559cb6f4..112ab6abe62b 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -343,6 +343,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
        shost->use_clustering = sht->use_clustering;
        shost->ordered_tag = sht->ordered_tag;
        shost->active_mode = sht->supported_mode;
+        shost->use_sg_chaining = sht->use_sg_chaining;
        if (sht->max_host_blocked)
                shost->max_host_blocked = sht->max_host_blocked;
diff --git a/drivers/scsi/hptiop.c b/drivers/scsi/hptiop.c
index 8b384fa7f048..8515054cdf70 100644
--- a/drivers/scsi/hptiop.c
+++ b/drivers/scsi/hptiop.c
@@ -655,6 +655,7 @@ static struct scsi_host_template driver_template = {
        .unchecked_isa_dma          = 0,
        .emulated                   = 0,
        .use_clustering             = ENABLE_CLUSTERING,
+        .use_sg_chaining            = ENABLE_SG_CHAINING,
        .proc_name                  = driver_name,
        .shost_attrs                = hptiop_attrs,
        .this_id                    = -1,
diff --git a/drivers/scsi/ibmmca.c b/drivers/scsi/ibmmca.c
index 1a924e9b0271..714e6273a70d 100644
--- a/drivers/scsi/ibmmca.c
+++ b/drivers/scsi/ibmmca.c
@@ -1501,6 +1501,7 @@ static struct scsi_host_template ibmmca_driver_template = {
          .sg_tablesize   = 16,
          .cmd_per_lun    = 1,
          .use_clustering = ENABLE_CLUSTERING,
+          .use_sg_chaining = ENABLE_SG_CHAINING,
 };
 static int ibmmca_probe(struct device *dev)
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index cda0cc3d182f..22d91ee173c5 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -1548,6 +1548,7 @@ static struct scsi_host_template driver_template = {
        .this_id = -1,
        .sg_tablesize = SG_ALL,
        .use_clustering = ENABLE_CLUSTERING,
+        .use_sg_chaining = ENABLE_SG_CHAINING,
        .shost_attrs = ibmvscsi_attrs,
 };
diff --git a/drivers/scsi/ide-scsi.c b/drivers/scsi/ide-scsi.c
index d81bb076a15a..d297f64cd432 100644
--- a/drivers/scsi/ide-scsi.c
+++ b/drivers/scsi/ide-scsi.c
@@ -70,6 +70,7 @@ typedef struct idescsi_pc_s {
        u8 *buffer;                             /* Data buffer */
        u8 *current_position;                   /* Pointer into the above buffer */
        struct scatterlist *sg;                 /* Scatter gather table */
+        struct scatterlist *last_sg;            /* Last sg element */
        int b_count;                            /* Bytes transferred from current entry */
        struct scsi_cmnd *scsi_cmd;             /* SCSI command */
        void (*done)(struct scsi_cmnd *);       /* Scsi completion routine */
@@ -173,12 +174,6 @@ static void idescsi_input_buffers (ide_drive_t *drive, idescsi_pc_t *pc, unsigne
        char *buf;
        while (bcount) {
-                if (pc->sg - scsi_sglist(pc->scsi_cmd) >
-                                                 scsi_sg_count(pc->scsi_cmd)) {
-                        printk (KERN_ERR "ide-scsi: scatter gather table too small, discarding data\n");
-                        idescsi_discard_data (drive, bcount);
-                        return;
-                }
                count = min(pc->sg->length - pc->b_count, bcount);
                if (PageHighMem(pc->sg->page)) {
                        unsigned long flags;
@@ -197,10 +192,17 @@ static void idescsi_input_buffers (ide_drive_t *drive, idescsi_pc_t *pc, unsigne
                }
                bcount -= count; pc->b_count += count;
                if (pc->b_count == pc->sg->length) {
-                        pc->sg++;
+                        if (pc->sg == pc->last_sg)
+                                break;
+                        pc->sg = sg_next(pc->sg);
                        pc->b_count = 0;
                }
        }
+        if (bcount) {
+                printk (KERN_ERR "ide-scsi: scatter gather table too small, discarding data\n");
+                idescsi_discard_data (drive, bcount);
+        }
 }
 static void idescsi_output_buffers (ide_drive_t *drive, idescsi_pc_t *pc, unsigned int bcount)
@@ -209,12 +211,6 @@ static void idescsi_output_buffers (ide_drive_t *drive, idescsi_pc_t *pc, unsign
        char *buf;
        while (bcount) {
-                if (pc->sg - scsi_sglist(pc->scsi_cmd) >
-                                                 scsi_sg_count(pc->scsi_cmd)) {
-                        printk (KERN_ERR "ide-scsi: scatter gather table too small, padding with zeros\n");
-                        idescsi_output_zeros (drive, bcount);
-                        return;
-                }
                count = min(pc->sg->length - pc->b_count, bcount);
                if (PageHighMem(pc->sg->page)) {
                        unsigned long flags;
@@ -233,10 +229,17 @@ static void idescsi_output_buffers (ide_drive_t *drive, idescsi_pc_t *pc, unsign
                }
                bcount -= count; pc->b_count += count;
                if (pc->b_count == pc->sg->length) {
-                        pc->sg++;
+                        if (pc->sg == pc->last_sg)
+                                break;
+                        pc->sg = sg_next(pc->sg);
                        pc->b_count = 0;
                }
        }
+        if (bcount) {
+                printk (KERN_ERR "ide-scsi: scatter gather table too small, padding with zeros\n");
+                idescsi_output_zeros (drive, bcount);
+        }
 }
 static void hexdump(u8 *x, int len)
@@ -804,6 +807,7 @@ static int idescsi_queue (struct scsi_cmnd *cmd,
        memcpy (pc->c, cmd->cmnd, cmd->cmd_len);
        pc->buffer = NULL;
        pc->sg = scsi_sglist(cmd);
+        pc->last_sg = sg_last(pc->sg, cmd->use_sg);
        pc->b_count = 0;
        pc->request_transfer = pc->buffer_size = scsi_bufflen(cmd);
        pc->scsi_cmd = cmd;
diff --git a/drivers/scsi/initio.c b/drivers/scsi/initio.c
index d9dfb69ae031..22d40fd5845b 100644
--- a/drivers/scsi/initio.c
+++ b/drivers/scsi/initio.c
@@ -2831,6 +2831,7 @@ static struct scsi_host_template initio_template = {
        .sg_tablesize           = SG_ALL,
        .cmd_per_lun            = 1,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
 };
 static int initio_probe_one(struct pci_dev *pdev,
diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
index 2ed099e2c20d..edaac2714c5a 100644
--- a/drivers/scsi/ips.c
+++ b/drivers/scsi/ips.c
@@ -3252,7 +3252,7 @@ ips_done(ips_ha_t * ha, ips_scb_t * scb)
                 */
                if ((scb->breakup) || (scb->sg_break)) {
                        struct scatterlist *sg;
-                        int sg_dma_index, ips_sg_index = 0;
+                        int i, sg_dma_index, ips_sg_index = 0;
                        /* we had a data breakup */
                        scb->data_len = 0;
@@ -3261,20 +3261,22 @@ ips_done(ips_ha_t * ha, ips_scb_t * scb)
                        /* Spin forward to last dma chunk */
                        sg_dma_index = scb->breakup;
+                        for (i = 0; i < scb->breakup; i++)
+                                sg = sg_next(sg);
                        /* Take care of possible partial on last chunk */
                        ips_fill_scb_sg_single(ha,
-                                               sg_dma_address(&sg[sg_dma_index]),
+                                               sg_dma_address(sg),
                                               scb, ips_sg_index++,
-                                               sg_dma_len(&sg[sg_dma_index]));
+                                               sg_dma_len(sg));
                        for (; sg_dma_index < scsi_sg_count(scb->scsi_cmd);
-                             sg_dma_index++) {
+                             sg_dma_index++, sg = sg_next(sg)) {
                                if (ips_fill_scb_sg_single
                                    (ha,
-                                     sg_dma_address(&sg[sg_dma_index]),
+                                     sg_dma_address(sg),
                                     scb, ips_sg_index++,
-                                     sg_dma_len(&sg[sg_dma_index])) < 0)
+                                     sg_dma_len(sg)) < 0)
                                        break;
                        }
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index cd674938ccd5..c0755565fae9 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -1438,6 +1438,7 @@ struct scsi_host_template lpfc_template = {
        .scan_finished          = lpfc_scan_finished,
        .this_id                = -1,
        .sg_tablesize           = LPFC_SG_SEG_CNT,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
        .cmd_per_lun            = LPFC_CMD_PER_LUN,
        .use_clustering         = ENABLE_CLUSTERING,
        .shost_attrs            = lpfc_hba_attrs,
@@ -1460,6 +1461,7 @@ struct scsi_host_template lpfc_vport_template = {
        .sg_tablesize           = LPFC_SG_SEG_CNT,
        .cmd_per_lun            = LPFC_CMD_PER_LUN,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
        .shost_attrs            = lpfc_vport_attrs,
        .max_sectors            = 0xFFFF,
 };
diff --git a/drivers/scsi/mac53c94.c b/drivers/scsi/mac53c94.c
index b12ad7c7c673..a035001f4438 100644
--- a/drivers/scsi/mac53c94.c
+++ b/drivers/scsi/mac53c94.c
@@ -402,6 +402,7 @@ static struct scsi_host_template mac53c94_template = {
        .sg_tablesize   = SG_ALL,
        .cmd_per_lun    = 1,
        .use_clustering = DISABLE_CLUSTERING,
+        .use_sg_chaining = ENABLE_SG_CHAINING,
 };
 static int mac53c94_probe(struct macio_dev *mdev, const struct of_device_id *match)
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index e7e11f282c8f..10d1aff9938a 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -4492,6 +4492,7 @@ static struct scsi_host_template megaraid_template = {
        .sg_tablesize                   = MAX_SGLIST,
        .cmd_per_lun                    = DEF_CMD_PER_LUN,
        .use_clustering                 = ENABLE_CLUSTERING,
+        .use_sg_chaining                = ENABLE_SG_CHAINING,
        .eh_abort_handler               = megaraid_abort,
        .eh_device_reset_handler        = megaraid_reset,
        .eh_bus_reset_handler           = megaraid_reset,
diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
index c6a53dccc16a..e4e4c6a39ed6 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.c
+++ b/drivers/scsi/megaraid/megaraid_mbox.c
@@ -361,6 +361,7 @@ static struct scsi_host_template megaraid_template_g = {
        .eh_host_reset_handler          = megaraid_reset_handler,
        .change_queue_depth             = megaraid_change_queue_depth,
        .use_clustering                 = ENABLE_CLUSTERING,
+        .use_sg_chaining                = ENABLE_SG_CHAINING,
        .sdev_attrs                     = megaraid_sdev_attrs,
        .shost_attrs                    = megaraid_shost_attrs,
 };
diff --git a/drivers/scsi/megaraid/megaraid_sas.c b/drivers/scsi/megaraid/megaraid_sas.c
index ebb948c016bb..e3c5c5282203 100644
--- a/drivers/scsi/megaraid/megaraid_sas.c
+++ b/drivers/scsi/megaraid/megaraid_sas.c
@@ -1110,6 +1110,7 @@ static struct scsi_host_template megasas_template = {
        .eh_timed_out = megasas_reset_timer,
        .bios_param = megasas_bios_param,
        .use_clustering = ENABLE_CLUSTERING,
+        .use_sg_chaining = ENABLE_SG_CHAINING,
 };
 /**
diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c
index 651d09b08f2a..7470ff39ab22 100644
--- a/drivers/scsi/mesh.c
+++ b/drivers/scsi/mesh.c
@@ -1843,6 +1843,7 @@ static struct scsi_host_template mesh_template = {
        .sg_tablesize                   = SG_ALL,
        .cmd_per_lun                    = 2,
        .use_clustering                 = DISABLE_CLUSTERING,
+        .use_sg_chaining                = ENABLE_SG_CHAINING,
 };
 static int mesh_probe(struct macio_dev *mdev, const struct of_device_id *match)
diff --git a/drivers/scsi/nsp32.c b/drivers/scsi/nsp32.c
index 7fed35372150..28161dc95e0d 100644
--- a/drivers/scsi/nsp32.c
+++ b/drivers/scsi/nsp32.c
@@ -281,6 +281,7 @@ static struct scsi_host_template nsp32_template = {
        .cmd_per_lun                    = 1,
        .this_id                        = NSP32_HOST_SCSIID,
        .use_clustering                 = DISABLE_CLUSTERING,
+        .use_sg_chaining                = ENABLE_SG_CHAINING,
        .eh_abort_handler               = nsp32_eh_abort,
        .eh_bus_reset_handler           = nsp32_eh_bus_reset,
        .eh_host_reset_handler          = nsp32_eh_host_reset,
diff --git a/drivers/scsi/pcmcia/sym53c500_cs.c b/drivers/scsi/pcmcia/sym53c500_cs.c
index 961839ecfe86..190e2a7d7067 100644
--- a/drivers/scsi/pcmcia/sym53c500_cs.c
+++ b/drivers/scsi/pcmcia/sym53c500_cs.c
@@ -694,6 +694,7 @@ static struct scsi_host_template sym53c500_driver_template = {
     .sg_tablesize              = 32,
     .cmd_per_lun               = 1,
     .use_clustering            = ENABLE_CLUSTERING,
+     .use_sg_chaining           = ENABLE_SG_CHAINING,
     .shost_attrs               = SYM53C500_shost_attrs
 };
diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c
index fba8aa8a81b5..76089cf55f4e 100644
--- a/drivers/scsi/qla1280.c
+++ b/drivers/scsi/qla1280.c
@@ -2775,7 +2775,7 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
        struct device_reg __iomem *reg = ha->iobase;
        struct scsi_cmnd *cmd = sp->cmd;
        cmd_a64_entry_t *pkt;
-        struct scatterlist *sg = NULL;
+        struct scatterlist *sg = NULL, *s;
        __le32 *dword_ptr;
        dma_addr_t dma_handle;
        int status = 0;
@@ -2889,13 +2889,16 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
         * Load data segments.
         */
        if (seg_cnt) {  /* If data transfer. */
+                int remseg = seg_cnt;
                /* Setup packet address segment pointer. */
                dword_ptr = (u32 *)&pkt->dseg_0_address;
                if (cmd->use_sg) {      /* If scatter gather */
                        /* Load command entry data segments. */
-                        for (cnt = 0; cnt < 2 && seg_cnt; cnt++, seg_cnt--) {
+                        for_each_sg(sg, s, seg_cnt, cnt) {
-                                dma_handle = sg_dma_address(sg);
+                                if (cnt == 2)
+                                        break;
+                                dma_handle = sg_dma_address(s);
 #if defined(CONFIG_IA64_GENERIC) || defined(CONFIG_IA64_SGI_SN2)
                                if (ha->flags.use_pci_vchannel)
                                        sn_pci_set_vchan(ha->pdev,
@@ -2906,12 +2909,12 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
                                        cpu_to_le32(pci_dma_lo32(dma_handle));
                                *dword_ptr++ =
                                        cpu_to_le32(pci_dma_hi32(dma_handle));
-                                *dword_ptr++ = cpu_to_le32(sg_dma_len(sg));
+                                *dword_ptr++ = cpu_to_le32(sg_dma_len(s));
-                                sg++;
                                dprintk(3, "S/G Segment phys_addr=%x %x, len=0x%x\n",
                                        cpu_to_le32(pci_dma_hi32(dma_handle)),
                                        cpu_to_le32(pci_dma_lo32(dma_handle)),
-                                        cpu_to_le32(sg_dma_len(sg)));
+                                        cpu_to_le32(sg_dma_len(sg_next(s))));
+                                remseg--;
                        }
                        dprintk(5, "qla1280_64bit_start_scsi: Scatter/gather "
                                "command packet data - b %i, t %i, l %i \n",
@@ -2926,7 +2929,9 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
                        dprintk(3, "S/G Building Continuation...seg_cnt=0x%x "
                                "remains\n", seg_cnt);
-                        while (seg_cnt > 0) {
+                        while (remseg > 0) {
+                                /* Update sg start */
+                                sg = s;
                                /* Adjust ring index. */
                                ha->req_ring_index++;
                                if (ha->req_ring_index == REQUEST_ENTRY_CNT) {
@@ -2952,9 +2957,10 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
                                        (u32 *)&((struct cont_a64_entry *) pkt)->dseg_0_address;
                                /* Load continuation entry data segments. */
-                                for (cnt = 0; cnt < 5 && seg_cnt;
+                                for_each_sg(sg, s, remseg, cnt) {
-                                     cnt++, seg_cnt--) {
+                                        if (cnt == 5)
-                                        dma_handle = sg_dma_address(sg);
+                                                break;
+                                        dma_handle = sg_dma_address(s);
 #if defined(CONFIG_IA64_GENERIC) || defined(CONFIG_IA64_SGI_SN2)
                                if (ha->flags.use_pci_vchannel)
                                        sn_pci_set_vchan(ha->pdev, 
@@ -2966,13 +2972,13 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
                                        *dword_ptr++ =
                                                cpu_to_le32(pci_dma_hi32(dma_handle));
                                        *dword_ptr++ =
-                                                cpu_to_le32(sg_dma_len(sg));
+                                                cpu_to_le32(sg_dma_len(s));
                                        dprintk(3, "S/G Segment Cont. phys_addr=%x %x, len=0x%x\n",
                                                cpu_to_le32(pci_dma_hi32(dma_handle)),
                                                cpu_to_le32(pci_dma_lo32(dma_handle)),
-                                                cpu_to_le32(sg_dma_len(sg)));
+                                                cpu_to_le32(sg_dma_len(s)));
-                                        sg++;
                                }
+                                remseg -= cnt;
                                dprintk(5, "qla1280_64bit_start_scsi: "
                                        "continuation packet data - b %i, t "
                                        "%i, l %i \n", SCSI_BUS_32(cmd),
@@ -3062,7 +3068,7 @@ qla1280_32bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
        struct device_reg __iomem *reg = ha->iobase;
        struct scsi_cmnd *cmd = sp->cmd;
        struct cmd_entry *pkt;
-        struct scatterlist *sg = NULL;
+        struct scatterlist *sg = NULL, *s;
        __le32 *dword_ptr;
        int status = 0;
        int cnt;
@@ -3188,6 +3194,7 @@ qla1280_32bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
         * Load data segments.
         */
        if (seg_cnt) {
+                int remseg = seg_cnt;
                /* Setup packet address segment pointer. */
                dword_ptr = &pkt->dseg_0_address;
@@ -3196,22 +3203,25 @@ qla1280_32bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
                        qla1280_dump_buffer(1, (char *)sg, 4 * 16);
                        /* Load command entry data segments. */
-                        for (cnt = 0; cnt < 4 && seg_cnt; cnt++, seg_cnt--) {
+                        for_each_sg(sg, s, seg_cnt, cnt) {
+                                if (cnt == 4)
+                                        break;
                                *dword_ptr++ =
-                                        cpu_to_le32(pci_dma_lo32(sg_dma_address(sg)));
+                                        cpu_to_le32(pci_dma_lo32(sg_dma_address(s)));
-                                *dword_ptr++ =
+                                *dword_ptr++ = cpu_to_le32(sg_dma_len(s));
-                                        cpu_to_le32(sg_dma_len(sg));
                                dprintk(3, "S/G Segment phys_addr=0x%lx, len=0x%x\n",
-                                        (pci_dma_lo32(sg_dma_address(sg))),
+                                        (pci_dma_lo32(sg_dma_address(s))),
-                                        (sg_dma_len(sg)));
+                                        (sg_dma_len(s)));
-                                sg++;
+                                remseg--;
                        }
                        /*
                         * Build continuation packets.
                         */
                        dprintk(3, "S/G Building Continuation"
                                "...seg_cnt=0x%x remains\n", seg_cnt);
-                        while (seg_cnt > 0) {
+                        while (remseg > 0) {
+                                /* Continue from end point */
+                                sg = s;
                                /* Adjust ring index. */
                                ha->req_ring_index++;
                                if (ha->req_ring_index == REQUEST_ENTRY_CNT) {
@@ -3239,19 +3249,20 @@ qla1280_32bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
                                        &((struct cont_entry *) pkt)->dseg_0_address;
                                /* Load continuation entry data segments. */
-                                for (cnt = 0; cnt < 7 && seg_cnt;
+                                for_each_sg(sg, s, remseg, cnt) {
-                                     cnt++, seg_cnt--) {
+                                        if (cnt == 7)
+                                                break;
                                        *dword_ptr++ =
-                                                cpu_to_le32(pci_dma_lo32(sg_dma_address(sg)));
+                                                cpu_to_le32(pci_dma_lo32(sg_dma_address(s)));
                                        *dword_ptr++ =
-                                                cpu_to_le32(sg_dma_len(sg));
+                                                cpu_to_le32(sg_dma_len(s));
                                        dprintk(1,
                                                "S/G Segment Cont. phys_addr=0x%x, "
                                                "len=0x%x\n",
-                                                cpu_to_le32(pci_dma_lo32(sg_dma_address(sg))),
+                                                cpu_to_le32(pci_dma_lo32(sg_dma_address(s))),
-                                                cpu_to_le32(sg_dma_len(sg)));
+                                                cpu_to_le32(sg_dma_len(s)));
-                                        sg++;
                                }
+                                remseg -= cnt;
                                dprintk(5, "qla1280_32bit_start_scsi: "
                                        "continuation packet data - "
                                        "scsi(%i:%i:%i)\n", SCSI_BUS_32(cmd),
@@ -4248,6 +4259,7 @@ static struct scsi_host_template qla1280_driver_template = {
        .sg_tablesize           = SG_ALL,
        .cmd_per_lun            = 1,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
 };
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index a6bb8d0ecf13..0351d380c2d7 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -132,6 +132,7 @@ struct scsi_host_template qla2x00_driver_template = {
        .this_id                = -1,
        .cmd_per_lun            = 3,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
        .sg_tablesize           = SG_ALL,
        /*
@@ -163,6 +164,7 @@ struct scsi_host_template qla24xx_driver_template = {
        .this_id                = -1,
        .cmd_per_lun            = 3,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
        .sg_tablesize           = SG_ALL,
        .max_sectors            = 0xFFFF,
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index b1d565c12c5b..03b68d4f3bd0 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -94,6 +94,7 @@ static struct scsi_host_template qla4xxx_driver_template = {
        .this_id                = -1,
        .cmd_per_lun            = 3,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
        .sg_tablesize           = SG_ALL,
        .max_sectors            = 0xFFFF,
diff --git a/drivers/scsi/qlogicfas.c b/drivers/scsi/qlogicfas.c
index 1e874f1fb5c6..1769f965eedf 100644
--- a/drivers/scsi/qlogicfas.c
+++ b/drivers/scsi/qlogicfas.c
@@ -197,6 +197,7 @@ static struct scsi_host_template qlogicfas_driver_template = {
        .sg_tablesize           = SG_ALL,
        .cmd_per_lun            = 1,
        .use_clustering         = DISABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
 };
 static __init int qlogicfas_init(void)
diff --git a/drivers/scsi/qlogicpti.c b/drivers/scsi/qlogicpti.c
index e93f80316a19..7a2e7986b038 100644
--- a/drivers/scsi/qlogicpti.c
+++ b/drivers/scsi/qlogicpti.c
@@ -868,7 +868,7 @@ static inline int load_cmd(struct scsi_cmnd *Cmnd, struct Command_Entry *cmd,
                           struct qlogicpti *qpti, u_int in_ptr, u_int out_ptr)
 {
        struct dataseg *ds;
-        struct scatterlist *sg;
+        struct scatterlist *sg, *s;
        int i, n;
        if (Cmnd->use_sg) {
@@ -884,11 +884,12 @@ static inline int load_cmd(struct scsi_cmnd *Cmnd, struct Command_Entry *cmd,
                n = sg_count;
                if (n > 4)
                        n = 4;
-                for (i = 0; i < n; i++, sg++) {
+                for_each_sg(sg, s, n, i) {
-                        ds[i].d_base = sg_dma_address(sg);
+                        ds[i].d_base = sg_dma_address(s);
-                        ds[i].d_count = sg_dma_len(sg);
+                        ds[i].d_count = sg_dma_len(s);
                }
                sg_count -= 4;
+                sg = s;
                while (sg_count > 0) {
                        struct Continuation_Entry *cont;
@@ -907,9 +908,9 @@ static inline int load_cmd(struct scsi_cmnd *Cmnd, struct Command_Entry *cmd,
                        n = sg_count;
                        if (n > 7)
                                n = 7;
-                        for (i = 0; i < n; i++, sg++) {
+                        for_each_sg(sg, s, n, i) {
-                                ds[i].d_base = sg_dma_address(sg);
+                                ds[i].d_base = sg_dma_address(s);
-                                ds[i].d_count = sg_dma_len(sg);
+                                ds[i].d_count = sg_dma_len(s);
                        }
                        sg_count -= n;
                }
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 4947dfe625a6..72ee4c9cfb1a 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -38,6 +38,7 @@
 #include <linux/proc_fs.h>
 #include <linux/vmalloc.h>
 #include <linux/moduleparam.h>
+#include <linux/scatterlist.h>
 #include <linux/blkdev.h>
 #include "scsi.h"
@@ -600,7 +601,7 @@ static int fill_from_dev_buffer(struct scsi_cmnd * scp, unsigned char * arr,
        int k, req_len, act_len, len, active;
        void * kaddr;
        void * kaddr_off;
-        struct scatterlist * sgpnt;
+        struct scatterlist * sg;
        if (0 == scp->request_bufflen)
                return 0;
@@ -619,16 +620,16 @@ static int fill_from_dev_buffer(struct scsi_cmnd * scp, unsigned char * arr,
                        scp->resid = req_len - act_len;
                return 0;
        }
-        sgpnt = (struct scatterlist *)scp->request_buffer;
        active = 1;
-        for (k = 0, req_len = 0, act_len = 0; k < scp->use_sg; ++k, ++sgpnt) {
+        req_len = act_len = 0;
+        scsi_for_each_sg(scp, sg, scp->use_sg, k) {
                if (active) {
                        kaddr = (unsigned char *)
-                                kmap_atomic(sgpnt->page, KM_USER0);
+                                kmap_atomic(sg->page, KM_USER0);
                        if (NULL == kaddr)
                                return (DID_ERROR << 16);
-                        kaddr_off = (unsigned char *)kaddr + sgpnt->offset;
+                        kaddr_off = (unsigned char *)kaddr + sg->offset;
-                        len = sgpnt->length;
+                        len = sg->length;
                        if ((req_len + len) > arr_len) {
                                active = 0;
                                len = arr_len - req_len;
@@ -637,7 +638,7 @@ static int fill_from_dev_buffer(struct scsi_cmnd * scp, unsigned char * arr,
                        kunmap_atomic(kaddr, KM_USER0);
                        act_len += len;
                }
-                req_len += sgpnt->length;
+                req_len += sg->length;
        }
        if (scp->resid)
                scp->resid -= act_len;
@@ -653,7 +654,7 @@ static int fetch_to_dev_buffer(struct scsi_cmnd * scp, unsigned char * arr,
        int k, req_len, len, fin;
        void * kaddr;
        void * kaddr_off;
-        struct scatterlist * sgpnt;
+        struct scatterlist * sg;
        if (0 == scp->request_bufflen)
                return 0;
@@ -668,13 +669,14 @@ static int fetch_to_dev_buffer(struct scsi_cmnd * scp, unsigned char * arr,
                memcpy(arr, scp->request_buffer, len);
                return len;
        }
-        sgpnt = (struct scatterlist *)scp->request_buffer;
+        sg = scsi_sglist(scp);
-        for (k = 0, req_len = 0, fin = 0; k < scp->use_sg; ++k, ++sgpnt) {
+        req_len = fin = 0;
-                kaddr = (unsigned char *)kmap_atomic(sgpnt->page, KM_USER0);
+        for (k = 0; k < scp->use_sg; ++k, sg = sg_next(sg)) {
+                kaddr = (unsigned char *)kmap_atomic(sg->page, KM_USER0);
                if (NULL == kaddr)
                        return -1;
-                kaddr_off = (unsigned char *)kaddr + sgpnt->offset;
+                kaddr_off = (unsigned char *)kaddr + sg->offset;
-                len = sgpnt->length;
+                len = sg->length;
                if ((req_len + len) > max_arr_len) {
                        len = max_arr_len - req_len;
                        fin = 1;
@@ -683,7 +685,7 @@ static int fetch_to_dev_buffer(struct scsi_cmnd * scp, unsigned char * arr,
                kunmap_atomic(kaddr, KM_USER0);
                if (fin)
                        return req_len + len;
-                req_len += sgpnt->length;
+                req_len += sg->length;
        }
        return req_len;
 }
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 207f1aa08869..aac8a02cbe80 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -17,6 +17,7 @@
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/hardirq.h>
+#include <linux/scatterlist.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_cmnd.h>
@@ -33,35 +34,34 @@
 #define SG_MEMPOOL_NR           ARRAY_SIZE(scsi_sg_pools)
 #define SG_MEMPOOL_SIZE         2
+/*
+ * The maximum number of SG segments that we will put inside a scatterlist
+ * (unless chaining is used). Should ideally fit inside a single page, to
+ * avoid a higher order allocation.
+ */
+#define SCSI_MAX_SG_SEGMENTS    128
 struct scsi_host_sg_pool {
        size_t          size;
-        char            *name; 
+        char            *name;
        struct kmem_cache       *slab;
        mempool_t       *pool;
 };
-#if (SCSI_MAX_PHYS_SEGMENTS < 32)
+#define SP(x) { x, "sgpool-" #x }
-#error SCSI_MAX_PHYS_SEGMENTS is too small
-#endif
-#define SP(x) { x, "sgpool-" #x } 
 static struct scsi_host_sg_pool scsi_sg_pools[] = {
        SP(8),
        SP(16),
+#if (SCSI_MAX_SG_SEGMENTS > 16)
        SP(32),
-#if (SCSI_MAX_PHYS_SEGMENTS > 32)
+#if (SCSI_MAX_SG_SEGMENTS > 32)
        SP(64),
-#if (SCSI_MAX_PHYS_SEGMENTS > 64)
+#if (SCSI_MAX_SG_SEGMENTS > 64)
        SP(128),
-#if (SCSI_MAX_PHYS_SEGMENTS > 128)
-        SP(256),
-#if (SCSI_MAX_PHYS_SEGMENTS > 256)
-#error SCSI_MAX_PHYS_SEGMENTS is too large
-#endif
 #endif
 #endif
 #endif
-};      
+};
 #undef SP
 static void scsi_run_queue(struct request_queue *q);
@@ -289,14 +289,16 @@ static int scsi_req_map_sg(struct request *rq, struct scatterlist *sgl,
        struct request_queue *q = rq->q;
        int nr_pages = (bufflen + sgl[0].offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
        unsigned int data_len = bufflen, len, bytes, off;
+        struct scatterlist *sg;
        struct page *page;
        struct bio *bio = NULL;
        int i, err, nr_vecs = 0;
-        for (i = 0; i < nsegs; i++) {
+        for_each_sg(sgl, sg, nsegs, i) {
-                page = sgl[i].page;
+                page = sg->page;
-                off = sgl[i].offset;
+                off = sg->offset;
-                len = sgl[i].length;
+                len = sg->length;
+                data_len += len;
                while (len > 0 && data_len > 0) {
                        /*
@@ -695,56 +697,170 @@ static struct scsi_cmnd *scsi_end_request(struct scsi_cmnd *cmd, int uptodate,
        return NULL;
 }
-struct scatterlist *scsi_alloc_sgtable(struct scsi_cmnd *cmd, gfp_t gfp_mask)
+/*
-{
+ * Like SCSI_MAX_SG_SEGMENTS, but for archs that have sg chaining. This limit
-        struct scsi_host_sg_pool *sgp;
+ * is totally arbitrary, a setting of 2048 will get you at least 8mb ios.
-        struct scatterlist *sgl;
+ */
+#define SCSI_MAX_SG_CHAIN_SEGMENTS      2048
-        BUG_ON(!cmd->use_sg);
+static inline unsigned int scsi_sgtable_index(unsigned short nents)
+{
+        unsigned int index;
-        switch (cmd->use_sg) {
+        switch (nents) {
        case 1 ... 8:
-                cmd->sglist_len = 0;
+                index = 0;
                break;
        case 9 ... 16:
-                cmd->sglist_len = 1;
+                index = 1;
                break;
+#if (SCSI_MAX_SG_SEGMENTS > 16)
        case 17 ... 32:
-                cmd->sglist_len = 2;
+                index = 2;
                break;
-#if (SCSI_MAX_PHYS_SEGMENTS > 32)
+#if (SCSI_MAX_SG_SEGMENTS > 32)
        case 33 ... 64:
-                cmd->sglist_len = 3;
+                index = 3;
                break;
-#if (SCSI_MAX_PHYS_SEGMENTS > 64)
+#if (SCSI_MAX_SG_SEGMENTS > 64)
        case 65 ... 128:
-                cmd->sglist_len = 4;
+                index = 4;
-                break;
-#if (SCSI_MAX_PHYS_SEGMENTS  > 128)
-        case 129 ... 256:
-                cmd->sglist_len = 5;
                break;
 #endif
 #endif
 #endif
        default:
-                return NULL;
+                printk(KERN_ERR "scsi: bad segment count=%d\n", nents);
+                BUG();
        }
-        sgp = scsi_sg_pools + cmd->sglist_len;
+        return index;
-        sgl = mempool_alloc(sgp->pool, gfp_mask);
+}
-        return sgl;
+struct scatterlist *scsi_alloc_sgtable(struct scsi_cmnd *cmd, gfp_t gfp_mask)
+{
+        struct scsi_host_sg_pool *sgp;
+        struct scatterlist *sgl, *prev, *ret;
+        unsigned int index;
+        int this, left;
+        BUG_ON(!cmd->use_sg);
+        left = cmd->use_sg;
+        ret = prev = NULL;
+        do {
+                this = left;
+                if (this > SCSI_MAX_SG_SEGMENTS) {
+                        this = SCSI_MAX_SG_SEGMENTS - 1;
+                        index = SG_MEMPOOL_NR - 1;
+                } else
+                        index = scsi_sgtable_index(this);
+                left -= this;
+                sgp = scsi_sg_pools + index;
+                sgl = mempool_alloc(sgp->pool, gfp_mask);
+                if (unlikely(!sgl))
+                        goto enomem;
+                memset(sgl, 0, sizeof(*sgl) * sgp->size);
+                /*
+                 * first loop through, set initial index and return value
+                 */
+                if (!ret)
+                        ret = sgl;
+                /*
+                 * chain previous sglist, if any. we know the previous
+                 * sglist must be the biggest one, or we would not have
+                 * ended up doing another loop.
+                 */
+                if (prev)
+                        sg_chain(prev, SCSI_MAX_SG_SEGMENTS, sgl);
+                /*
+                 * don't allow subsequent mempool allocs to sleep, it would
+                 * violate the mempool principle.
+                 */
+                gfp_mask &= ~__GFP_WAIT;
+                gfp_mask |= __GFP_HIGH;
+                prev = sgl;
+        } while (left);
+        /*
+         * ->use_sg may get modified after dma mapping has potentially
+         * shrunk the number of segments, so keep a copy of it for free.
+         */
+        cmd->__use_sg = cmd->use_sg;
+        return ret;
+enomem:
+        if (ret) {
+                /*
+                 * Free entries chained off ret. Since we were trying to
+                 * allocate another sglist, we know that all entries are of
+                 * the max size.
+                 */
+                sgp = scsi_sg_pools + SG_MEMPOOL_NR - 1;
+                prev = ret;
+                ret = &ret[SCSI_MAX_SG_SEGMENTS - 1];
+                while ((sgl = sg_chain_ptr(ret)) != NULL) {
+                        ret = &sgl[SCSI_MAX_SG_SEGMENTS - 1];
+                        mempool_free(sgl, sgp->pool);
+                }
+                mempool_free(prev, sgp->pool);
+        }
+        return NULL;
 }
 EXPORT_SYMBOL(scsi_alloc_sgtable);
-void scsi_free_sgtable(struct scatterlist *sgl, int index)
+void scsi_free_sgtable(struct scsi_cmnd *cmd)
 {
+        struct scatterlist *sgl = cmd->request_buffer;
        struct scsi_host_sg_pool *sgp;
-        BUG_ON(index >= SG_MEMPOOL_NR);
+        /*
+         * if this is the biggest size sglist, check if we have
+         * chained parts we need to free
+         */
+        if (cmd->__use_sg > SCSI_MAX_SG_SEGMENTS) {
+                unsigned short this, left;
+                struct scatterlist *next;
+                unsigned int index;
+                left = cmd->__use_sg - (SCSI_MAX_SG_SEGMENTS - 1);
+                next = sg_chain_ptr(&sgl[SCSI_MAX_SG_SEGMENTS - 1]);
+                while (left && next) {
+                        sgl = next;
+                        this = left;
+                        if (this > SCSI_MAX_SG_SEGMENTS) {
+                                this = SCSI_MAX_SG_SEGMENTS - 1;
+                                index = SG_MEMPOOL_NR - 1;
+                        } else
+                                index = scsi_sgtable_index(this);
+                        left -= this;
+                        sgp = scsi_sg_pools + index;
+                        if (left)
+                                next = sg_chain_ptr(&sgl[sgp->size - 1]);
+                        mempool_free(sgl, sgp->pool);
+                }
+                /*
+                 * Restore original, will be freed below
+                 */
+                sgl = cmd->request_buffer;
+                sgp = scsi_sg_pools + SG_MEMPOOL_NR - 1;
+        } else
+                sgp = scsi_sg_pools + scsi_sgtable_index(cmd->__use_sg);
-        sgp = scsi_sg_pools + index;
        mempool_free(sgl, sgp->pool);
 }
@@ -770,7 +886,7 @@ EXPORT_SYMBOL(scsi_free_sgtable);
 static void scsi_release_buffers(struct scsi_cmnd *cmd)
 {
        if (cmd->use_sg)
-                scsi_free_sgtable(cmd->request_buffer, cmd->sglist_len);
+                scsi_free_sgtable(cmd);
        /*
         * Zero these out.  They now point to freed memory, and it is
@@ -984,7 +1100,6 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
 static int scsi_init_io(struct scsi_cmnd *cmd)
 {
        struct request     *req = cmd->request;
-        struct scatterlist *sgpnt;
        int                count;
        /*
@@ -997,14 +1112,13 @@ static int scsi_init_io(struct scsi_cmnd *cmd)
        /*
         * If sg table allocation fails, requeue request later.
         */
-        sgpnt = scsi_alloc_sgtable(cmd, GFP_ATOMIC);
+        cmd->request_buffer = scsi_alloc_sgtable(cmd, GFP_ATOMIC);
-        if (unlikely(!sgpnt)) {
+        if (unlikely(!cmd->request_buffer)) {
                scsi_unprep_request(req);
                return BLKPREP_DEFER;
        }
        req->buffer = NULL;
-        cmd->request_buffer = (char *) sgpnt;
        if (blk_pc_request(req))
                cmd->request_bufflen = req->data_len;
        else
@@ -1529,8 +1643,25 @@ struct request_queue *__scsi_alloc_queue(struct Scsi_Host *shost,
        if (!q)
                return NULL;
+        /*
+         * this limit is imposed by hardware restrictions
+         */
        blk_queue_max_hw_segments(q, shost->sg_tablesize);
-        blk_queue_max_phys_segments(q, SCSI_MAX_PHYS_SEGMENTS);
+        /*
+         * In the future, sg chaining support will be mandatory and this
+         * ifdef can then go away. Right now we don't have all archs
+         * converted, so better keep it safe.
+         */
+#ifdef ARCH_HAS_SG_CHAIN
+        if (shost->use_sg_chaining)
+                blk_queue_max_phys_segments(q, SCSI_MAX_SG_CHAIN_SEGMENTS);
+        else
+                blk_queue_max_phys_segments(q, SCSI_MAX_SG_SEGMENTS);
+#else
+        blk_queue_max_phys_segments(q, SCSI_MAX_SG_SEGMENTS);
+#endif
        blk_queue_max_sectors(q, shost->max_sectors);
        blk_queue_bounce_limit(q, scsi_calculate_bounce_limit(shost));
        blk_queue_segment_boundary(q, shost->dma_boundary);
@@ -2193,18 +2324,19 @@ EXPORT_SYMBOL_GPL(scsi_target_unblock);
 *
 * Returns virtual address of the start of the mapped page
 */
-void *scsi_kmap_atomic_sg(struct scatterlist *sg, int sg_count,
+void *scsi_kmap_atomic_sg(struct scatterlist *sgl, int sg_count,
                          size_t *offset, size_t *len)
 {
        int i;
        size_t sg_len = 0, len_complete = 0;
+        struct scatterlist *sg;
        struct page *page;
        WARN_ON(!irqs_disabled());
-        for (i = 0; i < sg_count; i++) {
+        for_each_sg(sgl, sg, sg_count, i) {
                len_complete = sg_len; /* Complete sg-entries */
-                sg_len += sg[i].length;
+                sg_len += sg->length;
                if (sg_len > *offset)
                        break;
        }
@@ -2218,10 +2350,10 @@ void *scsi_kmap_atomic_sg(struct scatterlist *sg, int sg_count,
        }
        /* Offset starting from the beginning of first page in this sg-entry */
-        *offset = *offset - len_complete + sg[i].offset;
+        *offset = *offset - len_complete + sg->offset;
        /* Assumption: contiguous pages can be accessed as "page + i" */
-        page = nth_page(sg[i].page, (*offset >> PAGE_SHIFT));
+        page = nth_page(sg->page, (*offset >> PAGE_SHIFT));
        *offset &= ~PAGE_MASK;
        /* Bytes in this sg-entry from *offset to the end of the page */
diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
index 66c692ffa305..a91761c3645f 100644
--- a/drivers/scsi/scsi_tgt_lib.c
+++ b/drivers/scsi/scsi_tgt_lib.c
@@ -332,7 +332,7 @@ static void scsi_tgt_cmd_done(struct scsi_cmnd *cmd)
        scsi_tgt_uspace_send_status(cmd, tcmd->itn_id, tcmd->tag);
        if (cmd->request_buffer)
-                scsi_free_sgtable(cmd->request_buffer, cmd->sglist_len);
+                scsi_free_sgtable(cmd);
        queue_work(scsi_tgtd, &tcmd->work);
 }
@@ -373,7 +373,7 @@ static int scsi_tgt_init_cmd(struct scsi_cmnd *cmd, gfp_t gfp_mask)
        }
        eprintk("cmd %p cnt %d\n", cmd, cmd->use_sg);
-        scsi_free_sgtable(cmd->request_buffer, cmd->sglist_len);
+        scsi_free_sgtable(cmd);
        return -EINVAL;
 }
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index f6f5fc7d0cee..7238b2dfc497 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1165,7 +1165,7 @@ sg_vma_nopage(struct vm_area_struct *vma, unsigned long addr, int *type)
        sg = rsv_schp->buffer;
        sa = vma->vm_start;
        for (k = 0; (k < rsv_schp->k_use_sg) && (sa < vma->vm_end);
-             ++k, ++sg) {
+             ++k, sg = sg_next(sg)) {
                len = vma->vm_end - sa;
                len = (len < sg->length) ? len : sg->length;
                if (offset < len) {
@@ -1209,7 +1209,7 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
        sa = vma->vm_start;
        sg = rsv_schp->buffer;
        for (k = 0; (k < rsv_schp->k_use_sg) && (sa < vma->vm_end);
-             ++k, ++sg) {
+             ++k, sg = sg_next(sg)) {
                len = vma->vm_end - sa;
                len = (len < sg->length) ? len : sg->length;
                sa += len;
@@ -1840,7 +1840,7 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
        }
        for (k = 0, sg = schp->buffer, rem_sz = blk_size;
             (rem_sz > 0) && (k < mx_sc_elems);
-             ++k, rem_sz -= ret_sz, ++sg) {
+             ++k, rem_sz -= ret_sz, sg = sg_next(sg)) {
                
                num = (rem_sz > scatter_elem_sz_prev) ?
                      scatter_elem_sz_prev : rem_sz;
@@ -1913,7 +1913,7 @@ sg_write_xfer(Sg_request * srp)
                if (res)
                        return res;
-                for (; p; ++sg, ksglen = sg->length,
+                for (; p; sg = sg_next(sg), ksglen = sg->length,
                     p = page_address(sg->page)) {
                        if (usglen <= 0)
                                break;
@@ -1992,7 +1992,7 @@ sg_remove_scat(Sg_scatter_hold * schp)
                        int k;
                        for (k = 0; (k < schp->k_use_sg) && sg->page;
-                             ++k, ++sg) {
+                             ++k, sg = sg_next(sg)) {
                                SCSI_LOG_TIMEOUT(5, printk(
                                    "sg_remove_scat: k=%d, pg=0x%p, len=%d\n",
                                    k, sg->page, sg->length));
@@ -2045,7 +2045,7 @@ sg_read_xfer(Sg_request * srp)
                if (res)
                        return res;
-                for (; p; ++sg, ksglen = sg->length,
+                for (; p; sg = sg_next(sg), ksglen = sg->length,
                     p = page_address(sg->page)) {
                        if (usglen <= 0)
                                break;
@@ -2092,7 +2092,7 @@ sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer)
        if ((!outp) || (num_read_xfer <= 0))
                return 0;
-        for (k = 0; (k < schp->k_use_sg) && sg->page; ++k, ++sg) {
+        for (k = 0; (k < schp->k_use_sg) && sg->page; ++k, sg = sg_next(sg)) {
                num = sg->length;
                if (num > num_read_xfer) {
                        if (__copy_to_user(outp, page_address(sg->page),
@@ -2142,7 +2142,7 @@ sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size)
        SCSI_LOG_TIMEOUT(4, printk("sg_link_reserve: size=%d\n", size));
        rem = size;
-        for (k = 0; k < rsv_schp->k_use_sg; ++k, ++sg) {
+        for (k = 0; k < rsv_schp->k_use_sg; ++k, sg = sg_next(sg)) {
                num = sg->length;
                if (rem <= num) {
                        sfp->save_scat_len = num;
diff --git a/drivers/scsi/stex.c b/drivers/scsi/stex.c
index 72f6d8015358..e3fab3a6aed7 100644
--- a/drivers/scsi/stex.c
+++ b/drivers/scsi/stex.c
@@ -1123,6 +1123,7 @@ static struct scsi_host_template driver_template = {
        .this_id                        = -1,
        .sg_tablesize                   = ST_MAX_SG,
        .cmd_per_lun                    = ST_CMD_PER_LUN,
+        .use_sg_chaining                = ENABLE_SG_CHAINING,
 };
 static int stex_set_dma_mask(struct pci_dev * pdev)
diff --git a/drivers/scsi/sym53c416.c b/drivers/scsi/sym53c416.c
index 92bfaeafe30d..8befab7e9839 100644
--- a/drivers/scsi/sym53c416.c
+++ b/drivers/scsi/sym53c416.c
@@ -854,5 +854,6 @@ static struct scsi_host_template driver_template = {
        .cmd_per_lun =          1,
        .unchecked_isa_dma =    1,
        .use_clustering =       ENABLE_CLUSTERING,
+        .use_sg_chaining =      ENABLE_SG_CHAINING,
 };
 #include "scsi_module.c"
diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
index 3db22325ea2c..db03c4c8ec1e 100644
--- a/drivers/scsi/sym53c8xx_2/sym_glue.c
+++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
@@ -1808,6 +1808,7 @@ static struct scsi_host_template sym2_template = {
        .eh_host_reset_handler  = sym53c8xx_eh_host_reset_handler,
        .this_id                = 7,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
        .max_sectors            = 0xFFFF,
 #ifdef SYM_LINUX_PROC_INFO_SUPPORT
        .proc_info              = sym53c8xx_proc_info,
diff --git a/drivers/scsi/u14-34f.c b/drivers/scsi/u14-34f.c
index fc9f51818e8f..7edd6ceb13b2 100644
--- a/drivers/scsi/u14-34f.c
+++ b/drivers/scsi/u14-34f.c
@@ -450,7 +450,8 @@ static struct scsi_host_template driver_template = {
                .slave_configure         = u14_34f_slave_configure,
                .this_id                 = 7,
                .unchecked_isa_dma       = 1,
-                .use_clustering          = ENABLE_CLUSTERING
+                .use_clustering          = ENABLE_CLUSTERING,
+                .use_sg_chaining         = ENABLE_SG_CHAINING,
                };
 #if !defined(__BIG_ENDIAN_BITFIELD) && !defined(__LITTLE_ENDIAN_BITFIELD)
diff --git a/drivers/scsi/ultrastor.c b/drivers/scsi/ultrastor.c
index c08235d5afc9..ea72bbeb8f9d 100644
--- a/drivers/scsi/ultrastor.c
+++ b/drivers/scsi/ultrastor.c
@@ -1197,5 +1197,6 @@ static struct scsi_host_template driver_template = {
        .cmd_per_lun       = ULTRASTOR_MAX_CMDS_PER_LUN,
        .unchecked_isa_dma = 1,
        .use_clustering    = ENABLE_CLUSTERING,
+        .use_sg_chaining   = ENABLE_SG_CHAINING,
 };
 #include "scsi_module.c"
diff --git a/drivers/scsi/wd7000.c b/drivers/scsi/wd7000.c
index d6fd4259c56b..255c611e78b8 100644
--- a/drivers/scsi/wd7000.c
+++ b/drivers/scsi/wd7000.c
@@ -1671,6 +1671,7 @@ static struct scsi_host_template driver_template = {
        .cmd_per_lun            = 1,
        .unchecked_isa_dma      = 1,
        .use_clustering         = ENABLE_CLUSTERING,
+        .use_sg_chaining        = ENABLE_SG_CHAINING,
 };
 #include "scsi_module.c"
diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
index 4d3cbb12b713..8d3711a7ff06 100644
--- a/drivers/usb/storage/alauda.c
+++ b/drivers/usb/storage/alauda.c
@@ -798,12 +798,13 @@ static int alauda_read_data(struct us_data *us, unsigned long address,
 {
        unsigned char *buffer;
        u16 lba, max_lba;
-        unsigned int page, len, index, offset;
+        unsigned int page, len, offset;
        unsigned int blockshift = MEDIA_INFO(us).blockshift;
        unsigned int pageshift = MEDIA_INFO(us).pageshift;
        unsigned int blocksize = MEDIA_INFO(us).blocksize;
        unsigned int pagesize = MEDIA_INFO(us).pagesize;
        unsigned int uzonesize = MEDIA_INFO(us).uzonesize;
+        struct scatterlist *sg;
        int result;
        /*
@@ -827,7 +828,8 @@ static int alauda_read_data(struct us_data *us, unsigned long address,
        max_lba = MEDIA_INFO(us).capacity >> (blockshift + pageshift);
        result = USB_STOR_TRANSPORT_GOOD;
-        index = offset = 0;
+        offset = 0;
+        sg = NULL;
        while (sectors > 0) {
                unsigned int zone = lba / uzonesize; /* integer division */
@@ -873,7 +875,7 @@ static int alauda_read_data(struct us_data *us, unsigned long address,
                /* Store the data in the transfer buffer */
                usb_stor_access_xfer_buf(buffer, len, us->srb,
-                                &index, &offset, TO_XFER_BUF);
+                                &sg, &offset, TO_XFER_BUF);
                page = 0;
                lba++;
@@ -891,11 +893,12 @@ static int alauda_write_data(struct us_data *us, unsigned long address,
                unsigned int sectors)
 {
        unsigned char *buffer, *blockbuffer;
-        unsigned int page, len, index, offset;
+        unsigned int page, len, offset;
        unsigned int blockshift = MEDIA_INFO(us).blockshift;
        unsigned int pageshift = MEDIA_INFO(us).pageshift;
        unsigned int blocksize = MEDIA_INFO(us).blocksize;
        unsigned int pagesize = MEDIA_INFO(us).pagesize;
+        struct scatterlist *sg;
        u16 lba, max_lba;
        int result;
@@ -929,7 +932,8 @@ static int alauda_write_data(struct us_data *us, unsigned long address,
        max_lba = MEDIA_INFO(us).capacity >> (pageshift + blockshift);
        result = USB_STOR_TRANSPORT_GOOD;
-        index = offset = 0;
+        offset = 0;
+        sg = NULL;
        while (sectors > 0) {
                /* Write as many sectors as possible in this block */
@@ -946,7 +950,7 @@ static int alauda_write_data(struct us_data *us, unsigned long address,
                /* Get the data from the transfer buffer */
                usb_stor_access_xfer_buf(buffer, len, us->srb,
-                                &index, &offset, FROM_XFER_BUF);
+                                &sg, &offset, FROM_XFER_BUF);
                result = alauda_write_lba(us, lba, page, pages, buffer,
                        blockbuffer);
diff --git a/drivers/usb/storage/datafab.c b/drivers/usb/storage/datafab.c
index c87ad1bae1d6..579e9f52053a 100644
--- a/drivers/usb/storage/datafab.c
+++ b/drivers/usb/storage/datafab.c
@@ -98,7 +98,8 @@ static int datafab_read_data(struct us_data *us,
        unsigned char  thistime;
        unsigned int totallen, alloclen;
        int len, result;
-        unsigned int sg_idx = 0, sg_offset = 0;
+        unsigned int sg_offset = 0;
+        struct scatterlist *sg = NULL;
        // we're working in LBA mode.  according to the ATA spec, 
        // we can support up to 28-bit addressing.  I don't know if Datafab
@@ -155,7 +156,7 @@ static int datafab_read_data(struct us_data *us,
                // Store the data in the transfer buffer
                usb_stor_access_xfer_buf(buffer, len, us->srb,
-                                 &sg_idx, &sg_offset, TO_XFER_BUF);
+                                 &sg, &sg_offset, TO_XFER_BUF);
                sector += thistime;
                totallen -= len;
@@ -181,7 +182,8 @@ static int datafab_write_data(struct us_data *us,
        unsigned char thistime;
        unsigned int totallen, alloclen;
        int len, result;
-        unsigned int sg_idx = 0, sg_offset = 0;
+        unsigned int sg_offset = 0;
+        struct scatterlist *sg = NULL;
        // we're working in LBA mode.  according to the ATA spec, 
        // we can support up to 28-bit addressing.  I don't know if Datafab
@@ -217,7 +219,7 @@ static int datafab_write_data(struct us_data *us,
                // Get the data from the transfer buffer
                usb_stor_access_xfer_buf(buffer, len, us->srb,
-                                &sg_idx, &sg_offset, FROM_XFER_BUF);
+                                &sg, &sg_offset, FROM_XFER_BUF);
                command[0] = 0;
                command[1] = thistime;
diff --git a/drivers/usb/storage/jumpshot.c b/drivers/usb/storage/jumpshot.c
index 003fcf545888..61097cbb1585 100644
--- a/drivers/usb/storage/jumpshot.c
+++ b/drivers/usb/storage/jumpshot.c
@@ -119,7 +119,8 @@ static int jumpshot_read_data(struct us_data *us,
        unsigned char  thistime;
        unsigned int totallen, alloclen;
        int len, result;
-        unsigned int sg_idx = 0, sg_offset = 0;
+        unsigned int sg_offset = 0;
+        struct scatterlist *sg = NULL;
        // we're working in LBA mode.  according to the ATA spec, 
        // we can support up to 28-bit addressing.  I don't know if Jumpshot
@@ -170,7 +171,7 @@ static int jumpshot_read_data(struct us_data *us,
                // Store the data in the transfer buffer
                usb_stor_access_xfer_buf(buffer, len, us->srb,
-                                 &sg_idx, &sg_offset, TO_XFER_BUF);
+                                 &sg, &sg_offset, TO_XFER_BUF);
                sector += thistime;
                totallen -= len;
@@ -195,7 +196,8 @@ static int jumpshot_write_data(struct us_data *us,
        unsigned char  thistime;
        unsigned int totallen, alloclen;
        int len, result, waitcount;
-        unsigned int sg_idx = 0, sg_offset = 0;
+        unsigned int sg_offset = 0;
+        struct scatterlist *sg = NULL;
        // we're working in LBA mode.  according to the ATA spec, 
        // we can support up to 28-bit addressing.  I don't know if Jumpshot
@@ -225,7 +227,7 @@ static int jumpshot_write_data(struct us_data *us,
                // Get the data from the transfer buffer
                usb_stor_access_xfer_buf(buffer, len, us->srb,
-                                &sg_idx, &sg_offset, FROM_XFER_BUF);
+                                &sg, &sg_offset, FROM_XFER_BUF);
                command[0] = 0;
                command[1] = thistime;
diff --git a/drivers/usb/storage/protocol.c b/drivers/usb/storage/protocol.c
index 9ad30428d2dd..cc8f7c52c729 100644
--- a/drivers/usb/storage/protocol.c
+++ b/drivers/usb/storage/protocol.c
@@ -157,7 +157,7 @@ void usb_stor_transparent_scsi_command(struct scsi_cmnd *srb,
 * pick up from where this one left off. */
 unsigned int usb_stor_access_xfer_buf(unsigned char *buffer,
-        unsigned int buflen, struct scsi_cmnd *srb, unsigned int *index,
+        unsigned int buflen, struct scsi_cmnd *srb, struct scatterlist **sgptr,
        unsigned int *offset, enum xfer_buf_dir dir)
 {
        unsigned int cnt;
@@ -184,16 +184,17 @@ unsigned int usb_stor_access_xfer_buf(unsigned char *buffer,
         * located in high memory -- then kmap() will map it to a temporary
         * position in the kernel's virtual address space. */
        } else {
-                struct scatterlist *sg =
+                struct scatterlist *sg = *sgptr;
-                                (struct scatterlist *) srb->request_buffer
-                                + *index;
+                if (!sg)
+                        sg = (struct scatterlist *) srb->request_buffer;
                /* This loop handles a single s-g list entry, which may
                 * include multiple pages.  Find the initial page structure
                 * and the starting offset within the page, and update
                 * the *offset and *index values for the next loop. */
                cnt = 0;
-                while (cnt < buflen && *index < srb->use_sg) {
+                while (cnt < buflen) {
                        struct page *page = sg->page +
                                        ((sg->offset + *offset) >> PAGE_SHIFT);
                        unsigned int poff =
@@ -209,8 +210,7 @@ unsigned int usb_stor_access_xfer_buf(unsigned char *buffer,
                                /* Transfer continues to next s-g entry */
                                *offset = 0;
-                                ++*index;
+                                sg = sg_next(sg);
-                                ++sg;
                        }
                        /* Transfer the data for all the pages in this
@@ -234,6 +234,7 @@ unsigned int usb_stor_access_xfer_buf(unsigned char *buffer,
                                sglen -= plen;
                        }
                }
+                *sgptr = sg;
        }
        /* Return the amount actually transferred */
@@ -245,9 +246,10 @@ unsigned int usb_stor_access_xfer_buf(unsigned char *buffer,
 void usb_stor_set_xfer_buf(unsigned char *buffer,
        unsigned int buflen, struct scsi_cmnd *srb)
 {
-        unsigned int index = 0, offset = 0;
+        unsigned int offset = 0;
+        struct scatterlist *sg = NULL;
-        usb_stor_access_xfer_buf(buffer, buflen, srb, &index, &offset,
+        usb_stor_access_xfer_buf(buffer, buflen, srb, &sg, &offset,
                        TO_XFER_BUF);
        if (buflen < srb->request_bufflen)
                srb->resid = srb->request_bufflen - buflen;
diff --git a/drivers/usb/storage/protocol.h b/drivers/usb/storage/protocol.h
index 845bed4b8031..8737a36891ca 100644
--- a/drivers/usb/storage/protocol.h
+++ b/drivers/usb/storage/protocol.h
@@ -52,7 +52,7 @@ extern void usb_stor_transparent_scsi_command(struct scsi_cmnd*,
 enum xfer_buf_dir       {TO_XFER_BUF, FROM_XFER_BUF};
 extern unsigned int usb_stor_access_xfer_buf(unsigned char *buffer,
-        unsigned int buflen, struct scsi_cmnd *srb, unsigned int *index,
+        unsigned int buflen, struct scsi_cmnd *srb, struct scatterlist **,
        unsigned int *offset, enum xfer_buf_dir dir);
 extern void usb_stor_set_xfer_buf(unsigned char *buffer,
diff --git a/drivers/usb/storage/sddr09.c b/drivers/usb/storage/sddr09.c
index b2ed2a3e6fca..b12202c5da2d 100644
--- a/drivers/usb/storage/sddr09.c
+++ b/drivers/usb/storage/sddr09.c
@@ -705,7 +705,8 @@ sddr09_read_data(struct us_data *us,
        unsigned char *buffer;
        unsigned int lba, maxlba, pba;
        unsigned int page, pages;
-        unsigned int len, index, offset;
+        unsigned int len, offset;
+        struct scatterlist *sg;
        int result;
        // Figure out the initial LBA and page
@@ -730,7 +731,8 @@ sddr09_read_data(struct us_data *us,
        // contiguous LBA's. Another exercise left to the student.
        result = 0;
-        index = offset = 0;
+        offset = 0;
+        sg = NULL;
        while (sectors > 0) {
@@ -777,7 +779,7 @@ sddr09_read_data(struct us_data *us,
                // Store the data in the transfer buffer
                usb_stor_access_xfer_buf(buffer, len, us->srb,
-                                &index, &offset, TO_XFER_BUF);
+                                &sg, &offset, TO_XFER_BUF);
                page = 0;
                lba++;
@@ -931,7 +933,8 @@ sddr09_write_data(struct us_data *us,
        unsigned int pagelen, blocklen;
        unsigned char *blockbuffer;
        unsigned char *buffer;
-        unsigned int len, index, offset;
+        unsigned int len, offset;
+        struct scatterlist *sg;
        int result;
        // Figure out the initial LBA and page
@@ -968,7 +971,8 @@ sddr09_write_data(struct us_data *us,
        }
        result = 0;
-        index = offset = 0;
+        offset = 0;
+        sg = NULL;
        while (sectors > 0) {
@@ -987,7 +991,7 @@ sddr09_write_data(struct us_data *us,
                // Get the data from the transfer buffer
                usb_stor_access_xfer_buf(buffer, len, us->srb,
-                                &index, &offset, FROM_XFER_BUF);
+                                &sg, &offset, FROM_XFER_BUF);
                result = sddr09_write_lba(us, lba, page, pages,
                                buffer, blockbuffer);
diff --git a/drivers/usb/storage/sddr55.c b/drivers/usb/storage/sddr55.c
index 0b1b5b59ca7b..d43a3415e12f 100644
--- a/drivers/usb/storage/sddr55.c
+++ b/drivers/usb/storage/sddr55.c
@@ -167,7 +167,8 @@ static int sddr55_read_data(struct us_data *us,
        unsigned long address;
        unsigned short pages;
-        unsigned int len, index, offset;
+        unsigned int len, offset;
+        struct scatterlist *sg;
        // Since we only read in one block at a time, we have to create
        // a bounce buffer and move the data a piece at a time between the
@@ -178,7 +179,8 @@ static int sddr55_read_data(struct us_data *us,
        buffer = kmalloc(len, GFP_NOIO);
        if (buffer == NULL)
                return USB_STOR_TRANSPORT_ERROR; /* out of memory */
-        index = offset = 0;
+        offset = 0;
+        sg = NULL;
        while (sectors>0) {
@@ -255,7 +257,7 @@ static int sddr55_read_data(struct us_data *us,
                // Store the data in the transfer buffer
                usb_stor_access_xfer_buf(buffer, len, us->srb,
-                                &index, &offset, TO_XFER_BUF);
+                                &sg, &offset, TO_XFER_BUF);
                page = 0;
                lba++;
@@ -287,7 +289,8 @@ static int sddr55_write_data(struct us_data *us,
        unsigned short pages;
        int i;
-        unsigned int len, index, offset;
+        unsigned int len, offset;
+        struct scatterlist *sg;
        /* check if we are allowed to write */
        if (info->read_only || info->force_read_only) {
@@ -304,7 +307,8 @@ static int sddr55_write_data(struct us_data *us,
        buffer = kmalloc(len, GFP_NOIO);
        if (buffer == NULL)
                return USB_STOR_TRANSPORT_ERROR;
-        index = offset = 0;
+        offset = 0;
+        sg = NULL;
        while (sectors > 0) {
@@ -322,7 +326,7 @@ static int sddr55_write_data(struct us_data *us,
                // Get the data from the transfer buffer
                usb_stor_access_xfer_buf(buffer, len, us->srb,
-                                &index, &offset, FROM_XFER_BUF);
+                                &sg, &offset, FROM_XFER_BUF);
                US_DEBUGP("Write %02X pages, to PBA %04X"
                        " (LBA %04X) page %02X\n",
diff --git a/drivers/usb/storage/shuttle_usbat.c b/drivers/usb/storage/shuttle_usbat.c
index 17ca4d73577b..cb22a9ad1694 100644
--- a/drivers/usb/storage/shuttle_usbat.c
+++ b/drivers/usb/storage/shuttle_usbat.c
@@ -993,7 +993,8 @@ static int usbat_flash_read_data(struct us_data *us,
        unsigned char  thistime;
        unsigned int totallen, alloclen;
        int len, result;
-        unsigned int sg_idx = 0, sg_offset = 0;
+        unsigned int sg_offset = 0;
+        struct scatterlist *sg = NULL;
        result = usbat_flash_check_media(us, info);
        if (result != USB_STOR_TRANSPORT_GOOD)
@@ -1047,7 +1048,7 @@ static int usbat_flash_read_data(struct us_data *us,
        
                /* Store the data in the transfer buffer */
                usb_stor_access_xfer_buf(buffer, len, us->srb,
-                                         &sg_idx, &sg_offset, TO_XFER_BUF);
+                                         &sg, &sg_offset, TO_XFER_BUF);
                sector += thistime;
                totallen -= len;
@@ -1083,7 +1084,8 @@ static int usbat_flash_write_data(struct us_data *us,
        unsigned char  thistime;
        unsigned int totallen, alloclen;
        int len, result;
-        unsigned int sg_idx = 0, sg_offset = 0;
+        unsigned int sg_offset = 0;
+        struct scatterlist *sg = NULL;
        result = usbat_flash_check_media(us, info);
        if (result != USB_STOR_TRANSPORT_GOOD)
@@ -1122,7 +1124,7 @@ static int usbat_flash_write_data(struct us_data *us,
                /* Get the data from the transfer buffer */
                usb_stor_access_xfer_buf(buffer, len, us->srb,
-                                         &sg_idx, &sg_offset, FROM_XFER_BUF);
+                                         &sg, &sg_offset, FROM_XFER_BUF);
                /* ATA command 0x30 (WRITE SECTORS) */
                usbat_pack_ata_sector_cmd(command, thistime, sector, 0x30);
@@ -1162,8 +1164,8 @@ static int usbat_hp8200e_handle_read10(struct us_data *us,
        unsigned char *buffer;
        unsigned int len;
        unsigned int sector;
-        unsigned int sg_segment = 0;
        unsigned int sg_offset = 0;
+        struct scatterlist *sg = NULL;
        US_DEBUGP("handle_read10: transfersize %d\n",
                srb->transfersize);
@@ -1220,9 +1222,6 @@ static int usbat_hp8200e_handle_read10(struct us_data *us,
        sector |= short_pack(data[7+5], data[7+4]);
        transferred = 0;
-        sg_segment = 0; /* for keeping track of where we are in */
-        sg_offset = 0;  /* the scatter/gather list */
        while (transferred != srb->request_bufflen) {
                if (len > srb->request_bufflen - transferred)
@@ -1255,7 +1254,7 @@ static int usbat_hp8200e_handle_read10(struct us_data *us,
                /* Store the data in the transfer buffer */
                usb_stor_access_xfer_buf(buffer, len, srb,
-                                 &sg_segment, &sg_offset, TO_XFER_BUF);
+                                 &sg, &sg_offset, TO_XFER_BUF);
                /* Update the amount transferred and the sector number */