## Automatically generated incremental diff
## From:   linux-2.2.6-pre3
## To:     linux-2.2.6
## Robot:  $Id: make-incremental-diff,v 1.5 2001/12/01 08:32:36 hpa Exp $

diff -urN linux-2.2.6-pre3/Documentation/filesystems/ufs.txt linux/Documentation/filesystems/ufs.txt
--- linux-2.2.6-pre3/Documentation/filesystems/ufs.txt	Mon Dec  3 18:38:36 2001
+++ linux/Documentation/filesystems/ufs.txt	Mon Dec  3 18:38:48 2001
@@ -7,7 +7,7 @@
 UFS OPTIONS
 ===========
 
-ufstype=string
+ufstype=type_of_ufs
 	UFS is a file system widely used in different operating systems.
 	The problem are differencies among implementations. Features of
 	some implementations are undocumented, so its hard to recognize
@@ -26,7 +26,7 @@
 	sunx86	used in SunOS for Intel (Solarisx86)
 		supported as read-write
 
-	nextsptep
+	nextstep
 		used in NextStep
 		supported as read-only
 
@@ -46,4 +46,4 @@
 ===========
 
 Any ufs bug report you can send to daniel.pirkl@email.cz (do not send 
-partition tables bug reports).
+partition tables bug reports.)
diff -urN linux-2.2.6-pre3/MAINTAINERS linux/MAINTAINERS
--- linux-2.2.6-pre3/MAINTAINERS	Mon Dec  3 18:38:36 2001
+++ linux/MAINTAINERS	Mon Dec  3 18:38:50 2001
@@ -643,6 +643,13 @@
 L:	linux-kernel@vger.rutgers.edu
 S:	Maintained
 
+SCSI SG DRIVER
+P:	Doug Gilbert
+M:	dgilbert@interlog.com
+L:	linux-scsi@vger.rutgers.edu
+W:	http://www.torque.net/sg
+S:	Maintained
+
 SCSI SUBSYSTEM
 L:	linux-scsi@vger.rutgers.edu
 S:	Unmaintained
diff -urN linux-2.2.6-pre3/Makefile linux/Makefile
--- linux-2.2.6-pre3/Makefile	Mon Dec  3 18:38:36 2001
+++ linux/Makefile	Mon Dec  3 18:38:50 2001
@@ -343,7 +343,8 @@
 
 clean:	archclean
 	rm -f kernel/ksyms.lst include/linux/compile.h
-	rm -f core `find . -name '*.[oas]' ! -regex '.*lxdialog/.*' -print`
+	rm -f core `find . -name '*.[oas]' ! -regex '.*lxdialog/.*' \
+		! -regex '.*ksymoops/.*' -print`
 	rm -f core `find . -type f -name 'core' -print`
 	rm -f core `find . -name '.*.flags' -print`
 	rm -f vmlinux System.map
@@ -367,6 +368,7 @@
 	rm -f .version .config* config.in config.old
 	rm -f scripts/tkparse scripts/kconfig.tk scripts/kconfig.tmp
 	rm -f scripts/lxdialog/*.o scripts/lxdialog/lxdialog
+	rm -f scripts/ksymoops/*.o scripts/ksymoops/ksymoops
 	rm -f .menuconfig.log
 	rm -f include/asm
 	rm -rf include/config
@@ -379,8 +381,8 @@
 
 distclean: mrproper
 	rm -f core `find . \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
-                -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
-                -o -name '.*.rej' -o -name '.SUMS' -o -size 0 \) -print` TAGS
+		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
+		-o -name '.*.rej' -o -name '.SUMS' -o -size 0 \) -print` TAGS
 
 backup: mrproper
 	cd .. && tar cf - linux/ | gzip -9 > backup.gz
diff -urN linux-2.2.6-pre3/arch/ppc/8xx_io/enet.c linux/arch/ppc/8xx_io/enet.c
--- linux-2.2.6-pre3/arch/ppc/8xx_io/enet.c	Fri Mar 19 10:50:03 1999
+++ linux/arch/ppc/8xx_io/enet.c	Mon Dec  3 18:38:57 2001
@@ -21,6 +21,7 @@
  * small packets.
  *
  */
+#include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/string.h>
diff -urN linux-2.2.6-pre3/arch/ppc/boot/head.S linux/arch/ppc/boot/head.S
--- linux-2.2.6-pre3/arch/ppc/boot/head.S	Fri Mar 19 10:50:03 1999
+++ linux/arch/ppc/boot/head.S	Mon Dec  3 18:38:57 2001
@@ -1,4 +1,3 @@
-#include <linux/config.h>
 #include "../kernel/ppc_defs.h"
 #include "../kernel/ppc_asm.tmpl"
 #include <asm/processor.h>
diff -urN linux-2.2.6-pre3/arch/ppc/lib/string.S linux/arch/ppc/lib/string.S
--- linux-2.2.6-pre3/arch/ppc/lib/string.S	Wed Mar 10 21:30:32 1999
+++ linux/arch/ppc/lib/string.S	Mon Dec  3 18:38:57 2001
@@ -8,7 +8,6 @@
  * as published by the Free Software Foundation; either version
  * 2 of the License, or (at your option) any later version.
  */
-#include <linux/config.h>
 #include "../kernel/ppc_asm.tmpl"
 #include <asm/processor.h>
 #include <asm/errno.h>
diff -urN linux-2.2.6-pre3/arch/ppc/mbxboot/head.S linux/arch/ppc/mbxboot/head.S
--- linux-2.2.6-pre3/arch/ppc/mbxboot/head.S	Fri Mar 19 10:50:03 1999
+++ linux/arch/ppc/mbxboot/head.S	Mon Dec  3 18:38:57 2001
@@ -1,4 +1,3 @@
-#include <linux/config.h>
 #include "../kernel/ppc_defs.h"
 #include "../kernel/ppc_asm.tmpl"
 #include <asm/processor.h>
diff -urN linux-2.2.6-pre3/drivers/char/dtlk.c linux/drivers/char/dtlk.c
--- linux-2.2.6-pre3/drivers/char/dtlk.c	Sun Mar  7 16:15:39 1999
+++ linux/drivers/char/dtlk.c	Mon Dec  3 18:38:57 2001
@@ -56,8 +56,6 @@
 #endif
 
 #define KERNEL
-#include <linux/config.h>
-
 #include <linux/types.h>
 #include <linux/fs.h>
 #include <linux/mm.h>		/* for verify_area */
diff -urN linux-2.2.6-pre3/drivers/char/istallion.c linux/drivers/char/istallion.c
--- linux-2.2.6-pre3/drivers/char/istallion.c	Sun Mar 28 09:02:27 1999
+++ linux/drivers/char/istallion.c	Mon Dec  3 18:38:57 2001
@@ -26,6 +26,7 @@
 
 /*****************************************************************************/
 
+#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/malloc.h>
 #include <linux/interrupt.h>
diff -urN linux-2.2.6-pre3/drivers/char/stallion.c linux/drivers/char/stallion.c
--- linux-2.2.6-pre3/drivers/char/stallion.c	Sun Mar 28 09:02:27 1999
+++ linux/drivers/char/stallion.c	Mon Dec  3 18:38:57 2001
@@ -26,6 +26,7 @@
 
 /*****************************************************************************/
 
+#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/malloc.h>
 #include <linux/interrupt.h>
diff -urN linux-2.2.6-pre3/drivers/macintosh/adb.c linux/drivers/macintosh/adb.c
--- linux-2.2.6-pre3/drivers/macintosh/adb.c	Wed Mar 10 21:48:46 1999
+++ linux/drivers/macintosh/adb.c	Mon Dec  3 18:38:57 2001
@@ -5,7 +5,6 @@
  * Copyright (C) 1996 Paul Mackerras.
  */
 
-#include <linux/config.h>
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
diff -urN linux-2.2.6-pre3/drivers/net/defxx.c linux/drivers/net/defxx.c
--- linux-2.2.6-pre3/drivers/net/defxx.c	Sat Feb  6 12:46:21 1999
+++ linux/drivers/net/defxx.c	Mon Dec  3 18:38:57 2001
@@ -1911,6 +1911,8 @@
 		}
 	bp = (DFX_board_t *) dev->priv;
 
+	spin_lock(&bp->lock);
+	
 	/* See if we're already servicing an interrupt */
 
 	if (dev->interrupt)
@@ -1955,6 +1957,7 @@
 		}
 
 	dev->interrupt = DFX_UNMASK_INTERRUPTS;
+	spin_unlock(&bp->lock);
 	return;
 	}
 
@@ -3205,10 +3208,11 @@
 	)
 
 	{
-	DFX_board_t			*bp = (DFX_board_t *) dev->priv;
-	u8					prod;				/* local transmit producer index */
+	DFX_board_t		*bp = (DFX_board_t *) dev->priv;
+	u8			prod;				/* local transmit producer index */
 	PI_XMT_DESCR		*p_xmt_descr;		/* ptr to transmit descriptor block entry */
 	XMT_DRIVER_DESCR	*p_xmt_drv_descr;	/* ptr to transmit driver descriptor */
+	unsigned long		flags;
 
 	/*
 	 * Verify that incoming transmit request is OK
@@ -3252,6 +3256,8 @@
 			}
 		}
 
+	spin_lock_irqsave(&bp->lock, flags);
+	
 	/* Get the current producer and the next free xmt data descriptor */
 
 	prod		= bp->rcv_xmt_reg.index.xmt_prod;
@@ -3272,9 +3278,10 @@
 
 	/* Write the three PRH bytes immediately before the FC byte */
 
-	*((char *)skb->data - 3) = DFX_PRH0_BYTE;	/* these byte values are defined */
-	*((char *)skb->data - 2) = DFX_PRH1_BYTE;	/* in the Motorola FDDI MAC chip */
-	*((char *)skb->data - 1) = DFX_PRH2_BYTE;	/* specification */
+	skb_push(skb,3);
+	skb->data[0] = DFX_PRH0_BYTE;	/* these byte values are defined */
+	skb->data[1] = DFX_PRH1_BYTE;	/* in the Motorola FDDI MAC chip */
+	skb->data[2] = DFX_PRH2_BYTE;	/* specification */
 
 	/*
 	 * Write the descriptor with buffer info and bump producer
@@ -3304,7 +3311,7 @@
 	 */
 
 	p_xmt_descr->long_0	= (u32) (PI_XMT_DESCR_M_SOP | PI_XMT_DESCR_M_EOP | ((skb->len + 3) << PI_XMT_DESCR_V_SEG_LEN));
-	p_xmt_descr->long_1 = (u32) virt_to_bus(skb->data - 3);
+	p_xmt_descr->long_1 = (u32) virt_to_bus(skb->data);
 
 	/*
 	 * Verify that descriptor is actually available
@@ -3318,7 +3325,11 @@
 	 */
 
 	if (prod == bp->rcv_xmt_reg.index.xmt_comp)
+	{
+		skb_pull(skb,3);
+		spin_unlock_irqrestore(&bp->lock, flags);
 		return(1);			/* requeue packet for later */
+	}
 
 	/*
 	 * Save info for this packet for xmt done indication routine
@@ -3342,6 +3353,7 @@
 
 	bp->rcv_xmt_reg.index.xmt_prod = prod;
 	dfx_port_write_long(bp, PI_PDQ_K_REG_TYPE_2_PROD, bp->rcv_xmt_reg.lword);
+	spin_unlock_irqrestore(&bp->lock, flags);
 	return(0);							/* packet queued to adapter */
 	}
 
diff -urN linux-2.2.6-pre3/drivers/net/defxx.h linux/drivers/net/defxx.h
--- linux-2.2.6-pre3/drivers/net/defxx.h	Fri May  8 00:08:02 1998
+++ linux/drivers/net/defxx.h	Mon Dec  3 18:38:57 2001
@@ -1748,6 +1748,10 @@
 	/* Store pointers to transmit buffers for transmit completion code */
 
 	XMT_DRIVER_DESCR		xmt_drv_descr_blk[PI_XMT_DATA_K_NUM_ENTRIES];
+	
+	/* Transmit spinlocks */
+	
+	spinlock_t			lock;
 
 	/* Store device, bus-specific, and parameter information for this adapter */
 
diff -urN linux-2.2.6-pre3/drivers/net/syncppp.c linux/drivers/net/syncppp.c
--- linux-2.2.6-pre3/drivers/net/syncppp.c	Thu Feb 18 16:29:30 1999
+++ linux/drivers/net/syncppp.c	Mon Dec  3 18:38:57 2001
@@ -121,6 +121,7 @@
 	u16 time1;
 };
 #define CISCO_PACKET_LEN 18
+#define CISCO_BIG_PACKET_LEN 20
 
 static struct sppp *spppq;
 static struct timer_list sppp_keepalive_timer;
@@ -649,7 +650,7 @@
 	struct cisco_packet *h;
 	struct device *dev = sp->pp_if;
 
-	if (skb->len != CISCO_PACKET_LEN) {
+	if (skb->len != CISCO_PACKET_LEN && skb->len != CISCO_BIG_PACKET_LEN) {
 		if (sp->pp_flags & PP_DEBUG)
 			printk (KERN_WARNING "%s: invalid cisco packet length: %d bytes\n",
 				dev->name,  skb->len);
diff -urN linux-2.2.6-pre3/drivers/net/z85230.c linux/drivers/net/z85230.c
--- linux-2.2.6-pre3/drivers/net/z85230.c	Mon Dec  3 18:38:37 2001
+++ linux/drivers/net/z85230.c	Mon Dec  3 18:38:57 2001
@@ -416,8 +416,9 @@
 
 static void z8530_dma_tx(struct z8530_channel *chan)
 {
-	if(!chan->txdma_on)
+	if(!chan->dma_tx)
 	{
+		printk("Hey who turned the DMA off?\n");
 		z8530_tx(chan);
 		return;
 	}
@@ -434,7 +435,7 @@
 	
 	chan->status=status;
 
-	if(chan->txdma_on)
+	if(chan->dma_tx)
 	{
 		if(status&TxEOM)
 		{
@@ -619,6 +620,9 @@
 	z8530_rx_done(c);	/* Load the frame ring */
 	z8530_rx_done(c);	/* Load the backup frame */
 	z8530_rtsdtr(c,1);
+	c->dma_tx = 0;
+	c->regs[R1]|=TxINT_ENAB;
+	write_zsreg(c, R1, c->regs[R1]);
 	write_zsreg(c, R3, c->regs[R3]|RxENABLE);
 	return 0;
 }
@@ -706,6 +710,9 @@
 	c->regs[R14]|= DTRREQ;
 	write_zsreg(c, R14, c->regs[R14]);     
 
+	c->regs[R1]&= ~TxINT_ENAB;
+	write_zsreg(c, R1, c->regs[R1]);
+	
 	/*
 	 *	RX DMA via W/Req
 	 */	 
@@ -713,6 +720,7 @@
 	c->regs[R1]|= WT_FN_RDYFN;
 	c->regs[R1]|= WT_RDY_RT;
 	c->regs[R1]|= INT_ERR_Rx;
+	c->regs[R1]&= ~TxINT_ENAB;
 	write_zsreg(c, R1, c->regs[R1]);
 	c->regs[R1]|= WT_RDY_ENAB;
 	write_zsreg(c, R1, c->regs[R1]);            
@@ -972,7 +980,7 @@
 		dev->name, 
 		z8530_type_name[dev->type],
 		mapping,
-		io,
+		Z8530_PORT_OF(io),
 		dev->irq);
 }
 
@@ -991,7 +999,7 @@
 	dev->chanB.irqs=&z8530_nop;
 	/* Reset the chip */
 	write_zsreg(&dev->chanA, R9, 0xC0);
-	udelay(100);
+	udelay(200);
 	/* Now check its valid */
 	write_zsreg(&dev->chanA, R12, 0xAA);
 	if(read_zsreg(&dev->chanA, R12)!=0xAA)
@@ -1108,7 +1116,7 @@
 	if(c->tx_skb==NULL)
 	{
 		/* Idle on */
-		if(c->txdma)
+		if(c->dma_tx)
 		{
 			flags=claim_dma_lock();
 			disable_dma(c->txdma);
@@ -1126,7 +1134,6 @@
 	}
 	else
 	{
-		c->tx_ptr=c->tx_next_ptr;
 		c->txcount=c->tx_skb->len;
 		
 		
@@ -1141,6 +1148,18 @@
 			 
 			flags=claim_dma_lock();
 			disable_dma(c->txdma);
+
+			/*
+			 *	These two are needed by the 8530/85C30
+			 *	and must be issued when idling.
+			 */
+			 
+			if(c->dev->type!=Z85230)
+			{
+				write_zsctrl(c, RES_Tx_CRC);
+				write_zsctrl(c, RES_EOM_L);
+			}	
+			write_zsreg(c, R10, c->regs[10]&~ABUNDER);
 			clear_dma_ff(c->txdma);
 			set_dma_addr(c->txdma, virt_to_bus(c->tx_ptr));
 			set_dma_count(c->txdma, c->txcount);
@@ -1156,7 +1175,7 @@
 			/* ABUNDER off */
 			write_zsreg(c, R10, c->regs[10]);
 			write_zsctrl(c, RES_Tx_CRC);
-			write_zsctrl(c, RES_EOM_L);
+//???			write_zsctrl(c, RES_EOM_L);
 	
 			while(c->txcount && (read_zsreg(c,R0)&Tx_BUF_EMP))
 			{		
diff -urN linux-2.2.6-pre3/drivers/sbus/audio/dmy.c linux/drivers/sbus/audio/dmy.c
--- linux-2.2.6-pre3/drivers/sbus/audio/dmy.c	Mon Mar 15 16:11:30 1999
+++ linux/drivers/sbus/audio/dmy.c	Mon Dec  3 18:38:57 2001
@@ -8,7 +8,6 @@
  * to a file instead. (or will shortly)
  */
 
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
diff -urN linux-2.2.6-pre3/drivers/scsi/Config.in linux/drivers/scsi/Config.in
--- linux-2.2.6-pre3/drivers/scsi/Config.in	Mon Dec  3 18:38:37 2001
+++ linux/drivers/scsi/Config.in	Mon Dec  3 18:38:57 2001
@@ -36,6 +36,9 @@
 dep_tristate 'Always IN2000 SCSI support' CONFIG_SCSI_IN2000 $CONFIG_SCSI
 dep_tristate 'AM53/79C974 PCI SCSI support' CONFIG_SCSI_AM53C974 $CONFIG_SCSI
 dep_tristate 'AMI MegaRAID support' CONFIG_SCSI_MEGARAID $CONFIG_SCSI
+if [ "$CONFIG_SCSI_MEGARAID" != "n" ]; then
+    bool '   Concurrent IO commands on MegaRAID' CONFIG_MEGARAID_MULTI_IO
+fi
 
 dep_tristate 'BusLogic SCSI support' CONFIG_SCSI_BUSLOGIC $CONFIG_SCSI
 if [ "$CONFIG_SCSI_BUSLOGIC" != "n" ]; then
diff -urN linux-2.2.6-pre3/drivers/scsi/megaraid.c linux/drivers/scsi/megaraid.c
--- linux-2.2.6-pre3/drivers/scsi/megaraid.c	Wed Feb 24 16:27:54 1999
+++ linux/drivers/scsi/megaraid.c	Mon Dec  3 18:38:57 2001
@@ -114,7 +114,6 @@
 #include <linux/sched.h>
 #include <linux/stat.h>
 #include <linux/malloc.h>	/* for kmalloc() */
-#include <linux/config.h>	/* for CONFIG_PCI */
 #if LINUX_VERSION_CODE < 0x20100
 #include <linux/bios32.h>
 #else
@@ -884,7 +883,7 @@
 
   spin_lock_irqsave(&mega_lock,flags);
 
-#if !MULTI_IO
+#ifndef CONFIG_MEGARAID_MULTI_IO
   if (megaCfg->flag & PENDING) {
      spin_unlock_irqrestore(&mega_lock,flags);
      return -1;
diff -urN linux-2.2.6-pre3/drivers/scsi/megaraid.h linux/drivers/scsi/megaraid.h
--- linux-2.2.6-pre3/drivers/scsi/megaraid.h	Sun Mar 28 10:04:12 1999
+++ linux/drivers/scsi/megaraid.h	Mon Dec  3 18:38:57 2001
@@ -5,9 +5,6 @@
 #include <linux/version.h>
 #endif
 
-#define MULTI_IO 0    /* change to 1 for fully parallel I/O to adapter */
-                      /* works on some systems, not on others yet */
-
 #define IN_ISR                  0x80000000L
 #define NO_INTR                 0x40000000L
 #define IN_TIMEOUT              0x20000000L
diff -urN linux-2.2.6-pre3/drivers/scsi/sg.c linux/drivers/scsi/sg.c
--- linux-2.2.6-pre3/drivers/scsi/sg.c	Mon Aug 24 13:14:10 1998
+++ linux/drivers/scsi/sg.c	Mon Dec  3 18:38:58 2001
@@ -4,7 +4,45 @@
  *           to allow user process control of SCSI devices.
  *  Development Sponsored by Killy Corp. NY NY
  *
- *  Borrows code from st driver.
+ * Original driver (sg.c):
+ *        Copyright (C) 1992 Lawrence Foard
+ * 2.x extensions to driver:
+ *        Copyright (C) 1998, 1999 Douglas Gilbert
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ *  Borrows code from st driver. Thanks to Alessandro Rubini's "dd" book.
+ */
+ static char * sg_version_str = "Version: 2.1.31 (990327)";
+/*
+ *  D. P. Gilbert (dgilbert@interlog.com, dougg@triode.net.au)
+ *      - scatter list logic replaces previous large atomic SG_BIG_BUFF
+ *        sized allocation. See notes in <scsi/sg.h> include file. 
+ * 
+ *      - scsi logging is available via SCSI_LOG_TIMEOUT macros. First
+ *        the kernel/module needs to be built with CONFIG_SCSI_LOGGING
+ *        (otherwise the macros compile to empty statements), then do
+ *        something like: 'echo "scsi log all" > /proc/scsi/scsi' to log
+ *        everything or 'echo "scsi log {token} #N" > /proc/scsi/scsi'
+ *        where {token} is one of [error,timeout,scan,mlqueue,mlcomplete,
+ *        llqueue,llcomplete,hlqueue,hlcomplete,ioctl] and #N is 0...7
+ *        (with 0 meaning off). For example: 'scsi log timeout 7 > 
+ *        /proc/scsi/scsi' to get all logging messages from this driver.
+ *        Should use hlcomplete but it is too "noisy" (sd uses it).
+ *
+ *      - This driver obtains memory (heap) for the low-level driver to
+ *        transfer/dma to and from. It is obtained from up to 4 sources:
+ *              - 1 SG_SCATTER_SZ sized buffer on open() (per fd)
+ *                [could be less if SG_SCATTER_SZ bytes not available]
+ *              - obtain heap as required on write()s (get_free_pages)
+ *              - obtain heap from the shared scsi dma pool
+ *              - obtain heap from kernel directly (kmalloc) [last choice]
+ *        the 'alt_address' field in the scatter_list structure and the
+ *        related 'mem_src' indicate the source of the heap allocation.
+ *
  */
 #include <linux/module.h>
 
@@ -28,541 +66,849 @@
 #include <scsi/scsi_ioctl.h>
 #include <scsi/sg.h>
 
-int sg_big_buff = SG_BIG_BUFF;		/* for now, sg_big_buff is read-only through sysctl */
+
+int sg_big_buff = SG_SCATTER_SZ;  /* sg_big_buff is ro through sysctl */
+/* N.B. This global is here to keep existing software happy. It now holds
+   the size of the "first buffer" of the most recent sucessful sg_open(). */
+/* Only available when 'sg' compiled into kernel (rather than a module). */
+
+#define SG_SECTOR_SZ 512
+#define SG_SECTOR_MSK (SG_SECTOR_SZ - 1)
+
+#define SG_LOW_POOL_THRESHHOLD 30
+#define SG_MAX_POOL_SECTORS 320  /* Max. number of pool sectors to take */
+
+static int sg_pool_secs_avail = SG_MAX_POOL_SECTORS;
+
+/* #define SG_DEBUG */  /* for counting varieties of allocations */
+
+#ifdef SG_DEBUG
+static int sg_num_kmal = 0;
+static int sg_num_pool = 0;
+static int sg_num_page = 0;
+#endif
+
+#define SG_HEAP_FB 0    /* heap obtained at open() (one buffer per fd) */
+#define SG_HEAP_PAGE 1  /* heap from kernel via get_free_pages() */
+#define SG_HEAP_KMAL 2  /* heap from kernel via kmalloc() */
+#define SG_HEAP_POOL 3  /* heap from scsi dma pool (mid-level) */
+
 
 static int sg_init(void);
 static int sg_attach(Scsi_Device *);
+static void sg_finish(void);
 static int sg_detect(Scsi_Device *);
 static void sg_detach(Scsi_Device *);
 
 
 struct Scsi_Device_Template sg_template = {NULL, NULL, "sg", NULL, 0xff,
-					       SCSI_GENERIC_MAJOR, 0, 0, 0, 0,
-					       sg_detect, sg_init,
-					       NULL, sg_attach, sg_detach};
-
-#ifdef SG_BIG_BUFF
-static char *big_buff = NULL;
-static struct wait_queue *big_wait;   /* wait for buffer available */
-static int big_inuse=0;
-#endif
+                                           SCSI_GENERIC_MAJOR, 0, 0, 0, 0,
+                                           sg_detect, sg_init,
+                                           sg_finish, sg_attach, sg_detach};
+
 
-struct scsi_generic
+typedef struct sg_scatter_hold  /* holding area for scsi scatter gather info */
 {
-    Scsi_Device *device;
-    int users;   /* how many people have it open? */
-    struct wait_queue *generic_wait; /* wait for device to be available */
-    struct wait_queue *read_wait;    /* wait for response */
-    struct wait_queue *write_wait;   /* wait for free buffer */
-    int timeout; /* current default value for device */
-    int buff_len; /* length of current buffer */
-    char *buff;   /* the buffer */
-    struct sg_header header; /* header of pending command */
-    char exclude; /* opened for exclusive access */
-    char pending;  /* don't accept writes now */
-    char complete; /* command complete allow a read */
-};
+    unsigned short use_sg;      /* Number of pieces of scatter-gather */
+    unsigned short sglist_len;  /* size of malloc'd scatter-gather list */
+    unsigned bufflen;           /* Size of data buffer */
+    unsigned b_malloc_len;      /* actual len malloc'ed in buffer */
+    void * buffer;              /* Data buffer or scatter list (12 bytes) */
+    char mem_src;               /* heap whereabouts of 'buffer' */
+} Sg_scatter_hold;    /* 20 bytes long on i386 */
 
-static struct scsi_generic *scsi_generics=NULL;
-static void sg_free(char *buff,int size);
+struct sg_device;               /* forward declarations */
+struct sg_fd;
 
-static int sg_ioctl(struct inode * inode,struct file * file,
-		    unsigned int cmd_in, unsigned long arg)
+typedef struct sg_request  /* SG_MAX_QUEUE requests outstanding per file */
 {
-    int                         dev = MINOR(inode->i_rdev);
-    int                         result;
+    Scsi_Cmnd * my_cmdp;        /* NULL -> ready to read, else id */
+    struct sg_request * nextrp; /* NULL -> tail request (slist) */
+    struct sg_fd * parentfp;    /* NULL -> not in use */
+    Sg_scatter_hold data;       /* hold buffers, perhaps scatter list */
+    struct sg_header header;    /* scsi command+info <include/sg.h> */
+    char fb_used;               /* 1 -> using fst_buf, normally 0 (used) */
+} Sg_request; /* around 72 bytes long on i386 */
 
-    if ((dev<0) || (dev>=sg_template.dev_max))
-	return -ENXIO;
-
-    /*
-     * If we are in the middle of error recovery, then don't allow any
-     * access to this device.  Also, error recovery *may* have taken the
-     * device offline, in which case all further access is prohibited.
-     */
-    if( !scsi_block_when_processing_errors(scsi_generics[dev].device) )
-      {
-        return -ENXIO;
-      }
+typedef struct sg_fd /* holds the state of a file descriptor */
+{
+    struct sg_fd * nextfp; /* NULL when last opened fd on this device */
+    struct sg_device * parentdp;     /* owning device */
+    struct wait_queue * read_wait;   /* queue read until command done */
+    int timeout;                     /* defaults to SG_DEFAULT_TIMEOUT */
+    char * fst_buf;     /* try to grab SG_SCATTER_SZ sized buffer on open */
+    int fb_size;        /* actual size of allocated fst_buf */
+    Sg_request * headrp; /* head of request slist, NULL->empty */
+    struct fasync_struct * async_qp; /* used by asynchronous notification */
+    Sg_request req_arr[SG_MAX_QUEUE]; /* used as singly-linked list */
+    char low_dma;       /* as in parent but possible overridden to 1 */
+    char force_packid;  /* 1 -> pack_id input to read(), 0 -> ignored */
+    char closed;        /* 1 -> fd closed but request(s) outstanding */
+    char my_mem_src;    /* heap whereabouts of this sg_fb object */
+    char cmd_q;         /* 1 -> allow command queuing, 0 -> don't */
+} Sg_fd; /* around 1192 bytes long on i386 */
+
+typedef struct sg_device /* holds the state of each scsi generic device */
+{
+    Scsi_Device * device;
+    struct wait_queue * generic_wait;/* queue open if O_EXCL on prev. open */
+    int sg_tablesize;   /* adapter's max scatter-gather table size */
+    Sg_fd * headfp;     /* first open fd belonging to this device */
+    kdev_t i_rdev;      /* holds device major+minor number */
+    char exclude;       /* opened for exclusive access */
+    char sgdebug;       /* 0->off, 1->sense, 9->dump dev, 10-> all devs */
+    unsigned char merge_fd; /* 0->sequencing per fd (def) else fd count */
+} Sg_device; /* around 24 bytes long on i386 */
+
+
+static int sg_fasync(int fd, struct file * filp, int mode);
+static void sg_command_done(Scsi_Cmnd * SCpnt);
+static int sg_sc_build(Sg_request * srp, int max_buff_size,
+                       const char * inp, int num_write_xfer);
+static int sg_sc_undo_rem(Sg_request * srp, char * outp,
+                          int num_read_xfer);
+static char * sg_malloc(Sg_request * srp, int size, int * retSzp, 
+                        int * mem_srcp);
+static void sg_free(Sg_request * srp, char * buff, int size, int mem_src);
+static char * sg_low_malloc(int rqSz, int lowDma, int mem_src, 
+                            int * retSzp);
+static void sg_low_free(char * buff, int size, int mem_src);
+static Sg_fd * sg_add_sfp(Sg_device * sdp, int dev);
+static int sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp);
+static Sg_request * sg_get_request(const Sg_fd * sfp, int pack_id);
+static Sg_request * sg_add_request(Sg_fd * sfp);
+static int sg_remove_request(Sg_fd * sfp, const Sg_request * srp);
+static int sg_fb_in_use(const Sg_fd * sfp);
+static void sg_clr_scpnt(Scsi_Cmnd * SCpnt);
+static void sg_shorten_timeout(Scsi_Cmnd * scpnt);
+static void sg_debug(const Sg_device * sdp, const Sg_fd * sfp, int part_of);
+static void sg_debug_all(const Sg_fd * sfp);
+
+static Sg_device * sg_dev_arr = NULL;
+static const int size_sg_header = sizeof(struct sg_header);
 
-    switch(cmd_in)
-    {
-    case SG_SET_TIMEOUT:
-        result = verify_area(VERIFY_READ, (const void *)arg, sizeof(int));
-        if (result) return result;
 
-	get_user(scsi_generics[dev].timeout, (int *) arg);
-	return 0;
-    case SG_GET_TIMEOUT:
-	return scsi_generics[dev].timeout;
-    case SG_EMULATED_HOST:
-    	return put_user(scsi_generics[dev].device->host->hostt->emulated, (int *) arg);
-    case SCSI_IOCTL_SEND_COMMAND:
-	/*
-	  Allow SCSI_IOCTL_SEND_COMMAND without checking suser() since the
-	  user already has read/write access to the generic device and so
-	  can execute arbitrary SCSI commands.
-	*/
-	return scsi_ioctl_send_command(scsi_generics[dev].device, (void *) arg);
-    default:
-	return scsi_ioctl(scsi_generics[dev].device, cmd_in, (void *) arg);
-    }
-}
 
 static int sg_open(struct inode * inode, struct file * filp)
 {
-    int dev=MINOR(inode->i_rdev);
-    int flags=filp->f_flags;
-    if (dev>=sg_template.dev_max || !scsi_generics[dev].device)
-	return -ENXIO;
-
-    if( !scsi_block_when_processing_errors(scsi_generics[dev].device) )
-      {
-        return -ENXIO;
-      }
-
-    if (O_RDWR!=(flags & O_ACCMODE))
-	return -EACCES;
-
-  /*
-   * If we want exclusive access, then wait until the device is not
-   * busy, and then set the flag to prevent anyone else from using it.
-   */
-    if (flags & O_EXCL)
-    {
-	while(scsi_generics[dev].users)
-	{
-	    if (flags & O_NONBLOCK)
-		return -EBUSY;
-	    interruptible_sleep_on(&scsi_generics[dev].generic_wait);
-	    if (signal_pending(current))
-		return -ERESTARTSYS;
-	}
-	scsi_generics[dev].exclude=1;
-    }
-    else
-        /*
-         * Wait until nobody has an exclusive open on
-         * this device.
-         */
-	while(scsi_generics[dev].exclude)
-	{
-	    if (flags & O_NONBLOCK)
-		return -EBUSY;
-	    interruptible_sleep_on(&scsi_generics[dev].generic_wait);
-	    if (signal_pending(current))
-		return -ERESTARTSYS;
-	}
+    int dev = MINOR(inode->i_rdev);
+    int flags = filp->f_flags;
+    Sg_device * sdp;
+    Sg_fd * sfp;
 
-    /*
-     * OK, we should have grabbed the device.  Mark the thing so
+    if ((NULL == sg_dev_arr) || (dev < 0) || (dev >= sg_template.dev_max))
+        return -ENXIO;
+    sdp = &sg_dev_arr[dev];
+    if ((! sdp->device) || (! sdp->device->host))
+        return -ENXIO;
+    if (sdp->i_rdev != inode->i_rdev)
+        printk("sg_open: inode maj=%d, min=%d   sdp maj=%d, min=%d\n",
+               MAJOR(inode->i_rdev), MINOR(inode->i_rdev),
+               MAJOR(sdp->i_rdev), MINOR(sdp->i_rdev));
+    if(! scsi_block_when_processing_errors(sdp->device))
+        return -ENXIO;
+/*  if (O_RDWR != (flags & O_ACCMODE)) */
+/*      return -EACCES;   May just want to get to a ioctl, so remove */
+
+    SCSI_LOG_TIMEOUT(3, printk("sg_open: dev=%d, flags=0x%x\n", dev, flags));
+   /* If we want exclusive access, then wait until the device is not
+    * busy, and then set the flag to prevent anyone else from using it. */
+    if (flags & O_EXCL) {
+        if (O_RDONLY == (flags & O_ACCMODE))
+            return -EACCES;   /* Can't lock it with read only access */
+        while (sdp->headfp) {
+            if (flags & O_NONBLOCK)
+                return -EBUSY;
+            interruptible_sleep_on(&sdp->generic_wait);
+            if (signal_pending(current))
+                return -ERESTARTSYS;
+        }
+        sdp->exclude = 1;
+    }
+    else { /* Wait until nobody has an exclusive open on this device. */
+        while (sdp->exclude) {
+            if (flags & O_NONBLOCK)
+                return -EBUSY;
+            interruptible_sleep_on(&sdp->generic_wait);
+            if (signal_pending(current))
+                return -ERESTARTSYS;
+        }
+    }
+    /* OK, we should have grabbed the device.  Mark the thing so
      * that other processes know that we have it, and initialize the
-     * state variables to known values.
-     */
-    if (!scsi_generics[dev].users
-        && scsi_generics[dev].pending
-        && scsi_generics[dev].complete)
-    {
-	if (scsi_generics[dev].buff != NULL)
-	    sg_free(scsi_generics[dev].buff,scsi_generics[dev].buff_len);
-	scsi_generics[dev].buff=NULL;
-	scsi_generics[dev].pending=0;
-    }
-    if (!scsi_generics[dev].users)
-	scsi_generics[dev].timeout=SG_DEFAULT_TIMEOUT;
-    if (scsi_generics[dev].device->host->hostt->module)
-	__MOD_INC_USE_COUNT(scsi_generics[dev].device->host->hostt->module);
+     * state variables to known values. */
+    if (! sdp->headfp) { /* no existing opens on this device */
+        sdp->sgdebug = 0;
+        sdp->sg_tablesize = sdp->device->host->sg_tablesize;
+        sdp->merge_fd = SG_DEF_MERGE_FD;
+    }
+    if ((sfp = sg_add_sfp(sdp, dev))) {
+        if (0 == sdp->merge_fd)
+            filp->private_data = sfp;
+    }
+    else {
+        if (flags & O_EXCL) sdp->exclude = 0; /* undo if error */
+        return -ENOMEM;
+    }
+
+    if (sdp->device->host->hostt->module)
+        __MOD_INC_USE_COUNT(sdp->device->host->hostt->module);
     if (sg_template.module)
         __MOD_INC_USE_COUNT(sg_template.module);
-    scsi_generics[dev].users++;
     return 0;
 }
 
-static int sg_close(struct inode * inode, struct file * filp)
+/* Following function was formerly called 'sg_close' */
+static int sg_release(struct inode * inode, struct file * filp)
 {
-    int dev=MINOR(inode->i_rdev);
-    scsi_generics[dev].users--;
-    if (scsi_generics[dev].device->host->hostt->module)
-	__MOD_DEC_USE_COUNT(scsi_generics[dev].device->host->hostt->module);
+    Sg_device * sdp;
+    Sg_fd * sfp;
+
+    if ((! (sfp = (Sg_fd *)filp->private_data)) || (! (sdp = sfp->parentdp)))
+        return -ENXIO;
+    SCSI_LOG_TIMEOUT(3, printk("sg_release: dev=%d\n", MINOR(sdp->i_rdev)));
+    sg_fasync(-1, filp, 0);   /* remove filp from async notification list */    
+    sg_remove_sfp(sdp, sfp);
+    if (! sdp->headfp) {
+        filp->private_data = NULL;
+        sdp->merge_fd = 0;
+    }
+
+    if (sdp->device->host->hostt->module)
+        __MOD_DEC_USE_COUNT(sdp->device->host->hostt->module);
     if(sg_template.module)
         __MOD_DEC_USE_COUNT(sg_template.module);
-    scsi_generics[dev].exclude=0;
-    wake_up(&scsi_generics[dev].generic_wait);
+    sdp->exclude = 0;
+    wake_up_interruptible(&sdp->generic_wait);
     return 0;
 }
 
-static char *sg_malloc(int size)
+/* Read back the results of a SCSI command which was sent in a prior
+   write(). */
+static ssize_t sg_read(struct file * filp, char * buf,
+                       size_t count, loff_t *ppos)
 {
-    if (size<=4096)
-	return (char *) scsi_malloc(size);
-#ifdef SG_BIG_BUFF
-    if (size<=SG_BIG_BUFF)
-    {
-	while(big_inuse)
-	{
-	    interruptible_sleep_on(&big_wait);
-	    if (signal_pending(current))
-		return NULL;
-	}
-	big_inuse=1;
-	return big_buff;
+    int k;
+    Sg_device * sdp;
+    Sg_fd * sfp;
+    Sg_request * srp;
+    int req_pack_id = -1;
+    struct sg_header * shp = (struct sg_header *)buf;
+
+    if ((! (sfp = (Sg_fd *)filp->private_data)) || (! (sdp = sfp->parentdp)))
+        return -ENXIO;
+    SCSI_LOG_TIMEOUT(3, printk("sg_read: dev=%d, count=%d\n", 
+                               MINOR(sdp->i_rdev), (int)count));
+    
+    /* If we are in the middle of error recovery, don't let anyone
+     * else try and use this device.  Also, if error recovery fails, it
+     * may try and take the device offline, in which case all further
+     * access to the device is prohibited.  */
+    if(! scsi_block_when_processing_errors(sdp->device))
+        return -ENXIO;
+
+    if (ppos != &filp->f_pos)
+        ; /* FIXME: Hmm.  Seek to the right place, or fail?  */
+    if ((k = verify_area(VERIFY_WRITE, buf, count)))
+        return k;
+    if (sfp->force_packid && (count >= size_sg_header))
+        req_pack_id = shp->pack_id;
+    srp = sg_get_request(sfp, req_pack_id);
+    while(! srp) {
+        if (filp->f_flags & O_NONBLOCK)
+            return -EAGAIN;
+        interruptible_sleep_on(&sfp->read_wait);
+        if (signal_pending(current))
+            return -ERESTARTSYS;
+        srp = sg_get_request(sfp, req_pack_id);
     }
-#endif
-    return NULL;
-}
+    srp->header.pack_len = srp->header.reply_len;   /* Why ????? */
 
-static void sg_free(char *buff,int size)
-{
-#ifdef SG_BIG_BUFF
-    if (buff==big_buff)
-    {
-	big_inuse=0;
-	wake_up(&big_wait);
-	return;
+    /* Now copy the result back to the user buffer.  */
+    if (count >= size_sg_header) {
+        copy_to_user(buf, &srp->header, size_sg_header);
+        buf += size_sg_header;
+        if (count > srp->header.reply_len)
+            count = srp->header.reply_len;
+        if (count > size_sg_header) /* release does copy_to_user */
+            sg_sc_undo_rem(srp, buf, count - size_sg_header);
+        else
+            sg_sc_undo_rem(srp, NULL, 0);
     }
-#endif
-    scsi_free(buff,size);
+    else {
+        count = (srp->header.result == 0) ? 0 : -EIO;
+        sg_sc_undo_rem(srp, NULL, 0);
+    }
+    return count;
 }
 
-/*
- * Read back the results of a previous command.  We use the pending and
- * complete semaphores to tell us whether the buffer is available for us
- * and whether the command is actually done.
- */
-static ssize_t sg_read(struct file *filp, char *buf,
-                       size_t count, loff_t *ppos)
+static ssize_t sg_write(struct file * filp, const char * buf, 
+                        size_t count, loff_t *ppos)
 {
-    struct inode *inode = filp->f_dentry->d_inode;
-    int dev=MINOR(inode->i_rdev);
-    int i;
-    struct scsi_generic *device=&scsi_generics[dev];
+    unsigned long         flags;
+    int                   mxsize, cmd_size, k;
+    unsigned char         cmnd[MAX_COMMAND_SIZE];
+    int                   input_size;
+    unsigned char         opcode;
+    Scsi_Cmnd           * SCpnt;
+    Sg_device           * sdp;
+    Sg_fd               * sfp;
+    Sg_request          * srp;
 
-    /*
-     * If we are in the middle of error recovery, don't let anyone
-     * else try and use this device.  Also, if error recovery fails, it
-     * may try and take the device offline, in which case all further
-     * access to the device is prohibited.
-     */
-    if( !scsi_block_when_processing_errors(scsi_generics[dev].device) )
-      {
+    if ((! (sfp = (Sg_fd *)filp->private_data)) || (! (sdp = sfp->parentdp)))
         return -ENXIO;
-      }
+    SCSI_LOG_TIMEOUT(3, printk("sg_write: dev=%d, count=%d\n", 
+                               MINOR(sdp->i_rdev), (int)count));
 
-    if (ppos != &filp->f_pos) {
-      /* FIXME: Hmm.  Seek to the right place, or fail?  */
+/* If we are in the middle of error recovery, don't let anyone
+ * else try and use this device.  Also, if error recovery fails, it
+ * may try and take the device offline, in which case all further
+ * access to the device is prohibited.  */
+    if(! scsi_block_when_processing_errors(sdp->device) )
+        return -ENXIO;
+
+    if (ppos != &filp->f_pos)
+        ; /* FIXME: Hmm.  Seek to the right place, or fail?  */
+
+    if ((k = verify_area(VERIFY_READ, buf, count)))
+        return k;
+/* The minimum scsi command length is 6 bytes.  If we get anything
+ * less than this, it is clearly bogus.  */
+    if (count < (size_sg_header + 6))
+        return -EIO;
+
+    srp = sg_add_request(sfp);
+    if (! srp) {
+        SCSI_LOG_TIMEOUT(1, printk("sg_write: queue full, domain error\n"));
+        return -EDOM;
+    }
+    copy_from_user(&srp->header, buf, size_sg_header);
+    buf += size_sg_header;
+    srp->header.pack_len = count;
+    get_user(opcode, buf);
+    cmd_size = COMMAND_SIZE(opcode);
+    if ((opcode >= 0xc0) && srp->header.twelve_byte) 
+        cmd_size = 12;
+    SCSI_LOG_TIMEOUT(4, printk("sg_write:   scsi opcode=0x%02x, cmd_size=%d\n", 
+                               (int)opcode, cmd_size));
+/* Determine buffer size.  */
+    input_size = count - cmd_size;
+    mxsize = (input_size > srp->header.reply_len) ? input_size :
+                                                    srp->header.reply_len;
+/* Don't include the command header itself in the size.  */
+    mxsize -= size_sg_header;
+    input_size -= size_sg_header;
+/* Verify user has actually passed enough bytes for this command. */
+    if (input_size < 0) {
+        sg_sc_undo_rem(srp, NULL, 0);
+        return -EIO; 
     }
 
-    if ((i=verify_area(VERIFY_WRITE,buf,count)))
-	return i;
+/* If we cannot allocate the buffer, report an error. */
+    if ((k = sg_sc_build(srp, mxsize, buf + cmd_size, input_size))) {
+        SCSI_LOG_TIMEOUT(1, printk("sg_write: build err=%d\n", k));
+        sg_sc_undo_rem(srp, NULL, 0);
+        return k;
+    }
 
-    /*
-     * Wait until the command is actually done.
-     */
-    while(!device->pending || !device->complete)
-    {
-	if (filp->f_flags & O_NONBLOCK)
-	{
-	    return -EAGAIN;
-	}
-	interruptible_sleep_on(&device->read_wait);
-	if (signal_pending(current))
-	{
-	    return -ERESTARTSYS;
-	}
-    }
-
-    /*
-     * Now copy the result back to the user buffer.
-     */
-    device->header.pack_len=device->header.reply_len;
+/*  SCSI_LOG_TIMEOUT(7, printk("sg_write: allocating device\n")); */
+/* Grab a command pointer for the device we want to talk to. If we
+ * don't want to block, just return with the appropriate message.  */
+    if (! (SCpnt = scsi_allocate_device(NULL, sdp->device, 
+                                        !(filp->f_flags & O_NONBLOCK)))) {
+        sg_sc_undo_rem(srp, NULL, 0);
+        return -EAGAIN;
+    }
+/*  SCSI_LOG_TIMEOUT(7, printk("sg_write: device allocated\n")); */
+
+    srp->my_cmdp = SCpnt;
+    SCpnt->request.rq_dev = sdp->i_rdev;
+    SCpnt->request.rq_status = RQ_ACTIVE;
+    SCpnt->sense_buffer[0] = 0;
+    SCpnt->cmd_len = cmd_size;
+    /* Now copy the SCSI command from the user's address space.  */
+    copy_from_user(cmnd, buf, cmd_size);
+
+/* Set the LUN field in the command structure.  */
+    cmnd[1]= (cmnd[1] & 0x1f) | (sdp->device->lun << 5);
+/*  SCSI_LOG_TIMEOUT(7, printk("sg_write: do cmd\n")); */
+/* Now pass the actual command down to the low-level driver.  We
+ * do not do any more here - when the interrupt arrives, we will
+ * then do the post-processing.  */
+    spin_lock_irqsave(&io_request_lock, flags);
+    SCpnt->use_sg = srp->data.use_sg;
+    SCpnt->sglist_len = srp->data.sglist_len;
+    SCpnt->bufflen = srp->data.bufflen;
+    SCpnt->underflow = srp->data.bufflen;
+/* Not many drivers look at this:
+        aic7xxx driver gives DID_RETRY_COMMAND on underrun
+        seagate comments out its underrun checking code, and the rest ...
+*/
+    SCpnt->buffer = srp->data.buffer;
+    srp->data.use_sg = 0;
+    srp->data.sglist_len = 0;
+    srp->data.bufflen = 0;
+    srp->data.buffer = NULL;
+    scsi_do_cmd(SCpnt, (void *)cmnd,
+                (void *)SCpnt->buffer, mxsize,
+                sg_command_done, sfp->timeout, SG_DEFAULT_RETRIES);
+    /* 'mxsize' overwrites SCpnt->bufflen, hence need for b_malloc_len */
+    spin_unlock_irqrestore(&io_request_lock, flags);
+/*  SCSI_LOG_TIMEOUT(6, printk("sg_write: sent scsi cmd to mid-level\n")); */
+    return count;
+}
 
-    if (count>=sizeof(struct sg_header))
+static int sg_ioctl(struct inode * inode, struct file * filp,
+                    unsigned int cmd_in, unsigned long arg)
+{
+    int result, val;
+    Sg_device * sdp;
+    Sg_fd * sfp;
+    Sg_request * srp;
+
+    if ((! (sfp = (Sg_fd *)filp->private_data)) || (! (sdp = sfp->parentdp)))
+        return -ENXIO;
+    SCSI_LOG_TIMEOUT(3, printk("sg_ioctl: dev=%d, cmd=0x%x\n", 
+                               MINOR(sdp->i_rdev), (int)cmd_in));
+     /* If we are in the middle of error recovery, then don't allow any
+     *  access to this device.  Also, error recovery *may* have taken the
+     *  device offline, in which case all further access is prohibited.  */
+    if(! scsi_block_when_processing_errors(sdp->device) )
+        return -ENXIO;
+
+    switch(cmd_in)
     {
-	copy_to_user(buf,&device->header,sizeof(struct sg_header));
-	buf+=sizeof(struct sg_header);
-	if (count>device->header.pack_len)
-	    count=device->header.pack_len;
-	if (count > sizeof(struct sg_header)) {
-	    copy_to_user(buf,device->buff,count-sizeof(struct sg_header));
-	}
+    case SG_SET_TIMEOUT:
+        result = verify_area(VERIFY_READ, (const void *)arg, sizeof(int));
+        if (result) return result;
+        return get_user(sfp->timeout, (int *)arg);
+    case SG_GET_TIMEOUT:
+        return sfp->timeout; /* strange ..., for backward compatibility */
+    case SG_SET_FORCE_LOW_DMA:
+        result = verify_area(VERIFY_READ, (const void *)arg, sizeof(int));
+        if (result) return result;
+        result = get_user(val, (int *)arg);
+        if (result) return result;
+        if (val) {
+            if ((0 == sfp->low_dma) && (0 == sg_fb_in_use(sfp))) {
+                sg_low_free(sfp->fst_buf, sfp->fb_size, SG_HEAP_PAGE);
+                sfp->fst_buf = sg_low_malloc(SG_SCATTER_SZ, 1, 
+                                             SG_HEAP_PAGE, &sfp->fb_size);
+            }
+            sfp->low_dma = 1;
+            if (! sfp->fst_buf)
+                return -ENOMEM;
+        }
+        else
+            sfp->low_dma = sdp->device->host->unchecked_isa_dma;
+        return 0;
+    case SG_GET_LOW_DMA:
+        result = verify_area(VERIFY_WRITE, (void *) arg, sizeof(int));
+        if (result) return result;
+        put_user((int)sfp->low_dma, (int *)arg);
+        return 0;
+    case SG_GET_SCSI_ID:
+        result = verify_area(VERIFY_WRITE, (void *)arg, sizeof(Sg_scsi_id));
+        if (result) return result;
+        else {
+            Sg_scsi_id * sg_idp = (Sg_scsi_id *)arg;
+            put_user((int)sdp->device->host->host_no, &sg_idp->host_no);
+            put_user((int)sdp->device->channel, &sg_idp->channel);
+            put_user((int)sdp->device->id, &sg_idp->scsi_id);
+            put_user((int)sdp->device->lun, &sg_idp->lun);
+            put_user((int)sdp->device->type, &sg_idp->scsi_type);
+            put_user(0, &sg_idp->unused1);
+            put_user(0, &sg_idp->unused2);
+            put_user(0, &sg_idp->unused3);
+            return 0;
+        }
+    case SG_SET_FORCE_PACK_ID:
+        result = verify_area(VERIFY_READ, (const void *)arg, sizeof(int));
+        if (result) return result;
+        result = get_user(val, (int *)arg);
+        if (result) return result;
+        sfp->force_packid = val ? 1 : 0;
+        return 0;
+    case SG_GET_PACK_ID:
+        result = verify_area(VERIFY_WRITE, (void *) arg, sizeof(int));
+        if (result) return result;
+        srp = sfp->headrp;
+        while (srp) {
+            if (! srp->my_cmdp) {
+                put_user(srp->header.pack_id, (int *)arg);
+                return 0;
+            }
+            srp = srp->nextrp;
+        }
+        put_user(-1, (int *)arg);
+        return 0;
+    case SG_GET_NUM_WAITING:
+        result = verify_area(VERIFY_WRITE, (void *) arg, sizeof(int));
+        if (result) return result;
+        srp = sfp->headrp;
+        val = 0;
+        while (srp) {
+            if (! srp->my_cmdp)
+                ++val;
+            srp = srp->nextrp;
+        }
+        put_user(val, (int *)arg);
+        return 0;
+    case SG_GET_SG_TABLESIZE:
+        result = verify_area(VERIFY_WRITE, (void *) arg, sizeof(int));
+        if (result) return result;
+        put_user(sdp->sg_tablesize, (int *)arg);
+        return 0;
+    case SG_SET_RESERVED_SIZE:
+        /* currently ignored, future extension */
+        if (O_RDWR != (filp->f_flags & O_ACCMODE))
+            return -EACCES;
+        result = verify_area(VERIFY_READ, (const void *)arg, sizeof(int));
+        if (result) return result;
+        return 0;
+    case SG_GET_RESERVED_SIZE:
+        result = verify_area(VERIFY_WRITE, (void *) arg, sizeof(int));
+        if (result) return result;
+        put_user(sfp->fb_size, (int *)arg);
+        return 0;
+    case SG_GET_MERGE_FD:
+        result = verify_area(VERIFY_WRITE, (void *) arg, sizeof(int));
+        if (result) return result;
+        put_user((int)sdp->merge_fd, (int *)arg);
+        return 0;
+    case SG_SET_MERGE_FD:
+        if (O_RDWR != (filp->f_flags & O_ACCMODE))
+            return -EACCES; /* require write access since effect wider
+                               then just this fd */
+        result = verify_area(VERIFY_READ, (const void *)arg, sizeof(int));
+        if (result) return result;
+        result = get_user(val, (int *)arg);
+        if (result) return result;
+        val = val ? 1 : 0;
+        if ((val ^ (0 != sdp->merge_fd)) && 
+            sdp->headfp && sdp->headfp->nextfp)
+            return -EBUSY;   /* too much work if multiple fds already */
+        sdp->merge_fd = val;
+        return 0;
+    case SG_SET_COMMAND_Q:
+        result = verify_area(VERIFY_READ, (const void *)arg, sizeof(int));
+        if (result) return result;
+        result = get_user(val, (int *)arg);
+        if (result) return result;
+        sfp->cmd_q = val ? 1 : 0;
+        return 0;
+    case SG_GET_COMMAND_Q:
+        result = verify_area(VERIFY_WRITE, (void *) arg, sizeof(int));
+        if (result) return result;
+        put_user((int)sfp->cmd_q, (int *)arg);
+        return 0;
+    case SG_EMULATED_HOST:
+        return put_user(sdp->device->host->hostt->emulated, (int *)arg);
+    case SCSI_IOCTL_SEND_COMMAND:
+        /* Allow SCSI_IOCTL_SEND_COMMAND without checking suser() since the
+           user already has read/write access to the generic device and so
+           can execute arbitrary SCSI commands.  */
+        if (O_RDWR != (filp->f_flags & O_ACCMODE))
+            return -EACCES; /* require write access since these could be
+                               dangerous */
+        return scsi_ioctl_send_command(sdp->device, (void *)arg);
+    case SG_SET_DEBUG:
+        result = verify_area(VERIFY_READ, (const void *)arg, sizeof(int));
+        if (result) return result;
+        result = get_user(val, (int *)arg);
+        if (result) return result;
+        sdp->sgdebug = (char)val;
+        if (9 == sdp->sgdebug)
+            sg_debug(sdp, sfp, 0);
+        else if (sdp->sgdebug > 9)
+            sg_debug_all(sfp);
+        return 0;
+    case SCSI_IOCTL_GET_IDLUN:
+    case SCSI_IOCTL_GET_BUS_NUMBER:
+        return scsi_ioctl(sdp->device, cmd_in, (void *)arg);
+    default:
+        if (O_RDWR != (filp->f_flags & O_ACCMODE))
+            return -EACCES; /* require write access since these could be
+                               dangerous */
+        return scsi_ioctl(sdp->device, cmd_in, (void *)arg);
     }
-    else
-	count= device->header.result==0 ? 0 : -EIO;
+}
 
-    /*
-     * Clean up, and release the device so that we can send another
-     * command.
-     */
-    sg_free(device->buff,device->buff_len);
-    device->buff = NULL;
-    device->pending=0;
-    wake_up(&device->write_wait);
-    return count;
+static unsigned int sg_poll(struct file * filp, poll_table * wait)
+{
+    unsigned int res = 0;
+    Sg_device * sdp;
+    Sg_fd * sfp;
+    Sg_request * srp;
+    int count = 0;
+
+    if ((! (sfp = (Sg_fd *)filp->private_data)) || (! (sdp = sfp->parentdp)))
+        return POLLERR;
+    poll_wait(filp, &sfp->read_wait, wait);
+    srp = sfp->headrp;
+    while (srp) {   /* if any read waiting, flag it */
+        if (! (res || srp->my_cmdp))
+            res = POLLIN | POLLRDNORM;
+        ++count;
+        srp = srp->nextrp;
+    }
+    if (0 == sfp->cmd_q) {
+        if (0 == count)
+            res |= POLLOUT | POLLWRNORM;
+    }
+    else if (count < SG_MAX_QUEUE)
+        res |= POLLOUT | POLLWRNORM;
+    SCSI_LOG_TIMEOUT(3, printk("sg_poll: dev=%d, res=0x%x\n", 
+                        MINOR(sdp->i_rdev), (int)res));
+    return res;
 }
 
-/*
- * This function is called by the interrupt handler when we
+static int sg_fasync(int fd, struct file * filp, int mode)
+{
+    int retval;
+    Sg_device * sdp;
+    Sg_fd * sfp;
+
+    if ((! (sfp = (Sg_fd *)filp->private_data)) || (! (sdp = sfp->parentdp)))
+        return -ENXIO;
+    SCSI_LOG_TIMEOUT(3, printk("sg_fasync: dev=%d, mode=%d\n", 
+                               MINOR(sdp->i_rdev), mode));
+
+    retval = fasync_helper(fd, filp, mode, &sfp->async_qp);
+    return (retval < 0) ? retval : 0;
+}
+
+/* This function is called by the interrupt handler when we
  * actually have a command that is complete.  Change the
- * flags to indicate that we have a result.
- */
+ * flags to indicate that we have a result.  */
 static void sg_command_done(Scsi_Cmnd * SCpnt)
 {
     int dev = MINOR(SCpnt->request.rq_dev);
-    struct scsi_generic *device = &scsi_generics[dev];
-    if (!device->pending)
-    {
-	printk("unexpected done for sg %d\n",dev);
+    Sg_device * sdp;
+    Sg_fd * sfp;
+    Sg_request * srp = NULL;
+    int closed = 0;
+
+    if ((NULL == sg_dev_arr) || (dev < 0) || (dev >= sg_template.dev_max)) {
+        SCSI_LOG_TIMEOUT(1, printk("sg__done: bad args dev=%d\n", dev));
         scsi_release_command(SCpnt);
         SCpnt = NULL;
-	return;
+        return;
     }
-
-    /*
-     * See if the command completed normally, or whether something went
-     * wrong.
-     */
-    memcpy(device->header.sense_buffer, SCpnt->sense_buffer,
-	   sizeof(SCpnt->sense_buffer));
-    switch (host_byte(SCpnt->result)) {
+    sdp = &sg_dev_arr[dev];
+    if (NULL == sdp->device)
+        return; /* Get out of here quick ... */
+    sfp = sdp->headfp;
+    while (sfp) {
+        srp = sfp->headrp;
+        while (srp) {
+            if (SCpnt == srp->my_cmdp)
+                break;
+            srp = srp->nextrp;
+        }
+        if (srp)
+            break;
+        sfp = sfp->nextfp;
+    }
+    if (! srp) {
+        SCSI_LOG_TIMEOUT(1, printk("sg__done: req missing, dev=%d\n", dev));
+        scsi_release_command(SCpnt);
+        SCpnt = NULL;
+        return;
+    }
+/* First transfer ownership of data buffers to sg_device object. */
+    srp->data.use_sg = SCpnt->use_sg;
+    srp->data.sglist_len = SCpnt->sglist_len;
+    srp->data.bufflen = SCpnt->bufflen;
+    srp->data.buffer = SCpnt->buffer;
+    sg_clr_scpnt(SCpnt);
+    srp->my_cmdp = NULL;
+
+    SCSI_LOG_TIMEOUT(4, 
+              printk("sg__done: dev=%d, scsi_stat=%d, res=0x%x\n", 
+                dev, (int)status_byte(SCpnt->result), (int)SCpnt->result));
+/* See if the command completed normally, or whether something went wrong. */
+    memcpy(srp->header.sense_buffer, SCpnt->sense_buffer,
+           sizeof(SCpnt->sense_buffer));
+    switch (host_byte(SCpnt->result)) 
+    {
     case DID_OK:
-      device->header.result = 0;
+    case DID_PASSTHROUGH: /* just guessing */
+    case DID_SOFT_ERROR:  /* just guessing */
+      srp->header.result = 0;
       break;
     case DID_NO_CONNECT:
     case DID_BUS_BUSY:
     case DID_TIME_OUT:
-      device->header.result = EBUSY;
+      srp->header.result = EBUSY;
       break;
     case DID_BAD_TARGET:
     case DID_ABORT:
     case DID_PARITY:
     case DID_RESET:
     case DID_BAD_INTR:
-      device->header.result = EIO;
+      srp->header.result = EIO;
       break;
     case DID_ERROR:
-      /*
-       * There really should be DID_UNDERRUN and DID_OVERRUN error values,
+      /* There really should be DID_UNDERRUN and DID_OVERRUN error values,
        * and a means for callers of scsi_do_cmd to indicate whether an
        * underrun or overrun should signal an error.  Until that can be
        * implemented, this kludge allows for returning useful error values
        * except in cases that return DID_ERROR that might be due to an
-       * underrun.
-       */
+       * underrun. [Underrun on advansys adapter yields DID_ABORT -dpg]  */
       if (SCpnt->sense_buffer[0] == 0 &&
-	  status_byte(SCpnt->result) == GOOD)
-	device->header.result = 0;
-      else device->header.result = EIO;
+          status_byte(SCpnt->result) == GOOD)
+          srp->header.result = 0;
+      else 
+          srp->header.result = EIO;
       break;
+    default:
+      SCSI_LOG_TIMEOUT(1, printk(
+                "sg: unexpected host_byte=%d, dev=%d in 'done'\n", 
+                host_byte(SCpnt->result), dev));
+      srp->header.result = EIO;
+      break;
+    }
+
+/* Following if statement is a patch supplied by Eric Youngdale */
+    if (driver_byte(SCpnt->result) != 0
+        && (SCpnt->sense_buffer[0] & 0x7f) == 0x70
+        && (SCpnt->sense_buffer[2] & 0xf) == UNIT_ATTENTION
+        && sdp->device->removable) {
+/* Detected disc change. Set the bit - this may be used if there are */
+/* filesystems using this device. */
+        sdp->device->changed = 1;
     }
 
-    /*
-     * Now wake up the process that is waiting for the
-     * result.
-     */
-    device->complete=1;
+/* Pick up error and status information */
+    srp->header.target_status = status_byte(SCpnt->result);
+    if ((sdp->sgdebug > 0) && 
+        ((CHECK_CONDITION == srp->header.target_status) ||
+         (COMMAND_TERMINATED == srp->header.target_status)))
+        print_sense("sg_command_done", SCpnt);
+    srp->header.host_status = host_byte(SCpnt->result);
+    srp->header.driver_status = driver_byte(SCpnt->result);
+
     scsi_release_command(SCpnt);
     SCpnt = NULL;
-    wake_up(&scsi_generics[dev].read_wait);
+    if (sfp->closed) { /* whoops this fd already released, cleanup */
+        closed = 1;
+        SCSI_LOG_TIMEOUT(1,
+               printk("sg__done: already closed, freeing ...\n"));
+/* should check if module is unloaded <<<<<<< */
+        sg_sc_undo_rem(srp, NULL, 0);
+        if (NULL == sfp->headrp) { 
+            SCSI_LOG_TIMEOUT(1,
+                printk("sg__done: already closed, final cleanup\n"));
+            sg_remove_sfp(sdp, sfp);
+        }
+    }
+/* Now wake up the process that is waiting for the result. */
+    /* A. Rubini says this is preferable+faster than wake_up() */
+    wake_up_interruptible(&sfp->read_wait);
+    if ((sfp->async_qp) && (! closed))
+        kill_fasync(sfp->async_qp, SIGPOLL);
 }
 
-static ssize_t sg_write(struct file *filp, const char *buf, 
-                        size_t count, loff_t *ppos)
+static void sg_debug_all(const Sg_fd * sfp)
 {
-    unsigned long	  flags;
-    struct inode         *inode = filp->f_dentry->d_inode;
-    int			  bsize,size,amt,i;
-    unsigned char	  cmnd[MAX_COMMAND_SIZE];
-    kdev_t		  devt = inode->i_rdev;
-    int			  dev = MINOR(devt);
-    struct scsi_generic   * device=&scsi_generics[dev];
-    int			  input_size;
-    unsigned char	  opcode;
-    Scsi_Cmnd		* SCpnt;
-
-    /*
-     * If we are in the middle of error recovery, don't let anyone
-     * else try and use this device.  Also, if error recovery fails, it
-     * may try and take the device offline, in which case all further
-     * access to the device is prohibited.
-     */
-    if( !scsi_block_when_processing_errors(scsi_generics[dev].device) )
-      {
-        return -ENXIO;
-      }
-
-    if (ppos != &filp->f_pos) {
-      /* FIXME: Hmm.  Seek to the right place, or fail?  */
-    }
-
-    if ((i=verify_area(VERIFY_READ,buf,count)))
-	return i;
-    /*
-     * The minimum scsi command length is 6 bytes.  If we get anything
-     * less than this, it is clearly bogus.
-     */
-    if (count<(sizeof(struct sg_header) + 6))
-	return -EIO;
-
-    /*
-     * If we still have a result pending from a previous command,
-     * wait until the result has been read by the user before sending
-     * another command.
-     */
-    while(device->pending)
-    {
-	if (filp->f_flags & O_NONBLOCK)
-	    return -EAGAIN;
-#ifdef DEBUG
-	printk("sg_write: sleeping on pending request\n");
+    const Sg_device * sdp = sg_dev_arr;
+    int k;
+   
+    if (NULL == sg_dev_arr) {
+        printk("sg_debug_all: sg_dev_arr NULL, death is imminent\n"); 
+        return;
+    }
+    if (! sfp)
+        printk("sg_debug_all: sfp (file descriptor pointer) NULL\n"); 
+    
+    printk("sg_debug_all: dev_max=%d, %s\n", 
+           sg_template.dev_max, sg_version_str);
+    printk(" scsi_dma_free_sectors=%u, sg_pool_secs_aval=%d\n",
+           scsi_dma_free_sectors, sg_pool_secs_avail);
+    printk(" sg_big_buff=%d\n", sg_big_buff);
+#ifdef SG_DEBUG
+    printk(" malloc counts, kmallocs=%d, dma_pool=%d, pages=%d\n",
+           sg_num_kmal, sg_num_pool, sg_num_page);
 #endif
-	interruptible_sleep_on(&device->write_wait);
-	if (signal_pending(current))
-	    return -ERESTARTSYS;
-    }
-
-    /*
-     * Mark the device flags for the new state.
-     */
-    device->pending=1;
-    device->complete=0;
-    copy_from_user(&device->header,buf,sizeof(struct sg_header));
-
-    device->header.pack_len=count;
-    buf+=sizeof(struct sg_header);
-
-    /*
-     * Now we need to grab the command itself from the user's buffer.
-     */
-    get_user(opcode, buf);
-    size=COMMAND_SIZE(opcode);
-    if (opcode >= 0xc0 && device->header.twelve_byte) size = 12;
-
-    /*
-     * Determine buffer size.
-     */
-    input_size = device->header.pack_len - size;
-    if( input_size > device->header.reply_len)
-    {
-        bsize = input_size;
-    } else {
-        bsize = device->header.reply_len;
+    for (k = 0; k < sg_template.dev_max; ++k, ++sdp) {
+        if (sdp->headfp) {
+            if (! sfp)
+                sfp = sdp->headfp;      /* just to keep things going */
+            else if (sdp == sfp->parentdp)
+        printk("  ***** Invoking device follows *****\n");
+            sg_debug(sdp, sfp, 1);
+        }
     }
+}
 
-    /*
-     * Don't include the command header itself in the size.
-     */
-    bsize-=sizeof(struct sg_header);
-    input_size-=sizeof(struct sg_header);
-
-    /*
-     * Verify that the user has actually passed enough bytes for this command.
-     */
-    if( input_size < 0 )
-    {
-	device->pending=0;
-        wake_up( &device->write_wait );
-	return -EIO;
-    }
-
-    /*
-     * Allocate a buffer that is large enough to hold the data
-     * that has been requested.  Round up to an even number of sectors,
-     * since scsi_malloc allocates in chunks of 512 bytes.
-     */
-    amt=bsize;
-    if (!bsize)
-	bsize++;
-    bsize=(bsize+511) & ~511;
-
-    /*
-     * If we cannot allocate the buffer, report an error.
-     */
-    if ((bsize<0) || !(device->buff=sg_malloc(device->buff_len=bsize)))
-    {
-	device->pending=0;
-	wake_up(&device->write_wait);
-	return -ENOMEM;
+static void sg_debug(const Sg_device * sdp, const Sg_fd * sfp, int part_of)
+{
+    Sg_fd * fp;
+    Sg_request * srp;
+    int dev;
+    int k;
+   
+    if (! sfp)
+        printk("sg_debug: sfp (file descriptor pointer) NULL\n"); 
+    if (! sdp) {
+        printk("sg_debug: sdp pointer (to device) NULL\n"); 
+        return;
     }
-
-#ifdef DEBUG
-    printk("allocating device\n");
-#endif
-
-    /*
-     * Grab a device pointer for the device we want to talk to.  If we
-     * don't want to block, just return with the appropriate message.
-     */
-    if (!(SCpnt=scsi_allocate_device(NULL,device->device, !(filp->f_flags & O_NONBLOCK))))
-    {
-	device->pending=0;
-	wake_up(&device->write_wait);
-	sg_free(device->buff,device->buff_len);
-	device->buff = NULL;
-	return -EAGAIN;
+    else if (! sdp->device) {
+        printk("sg_debug: device detached ??\n"); 
+        return;
     }
-#ifdef DEBUG
-    printk("device allocated\n");
-#endif
-
-    SCpnt->request.rq_dev = devt;
-    SCpnt->request.rq_status = RQ_ACTIVE;
-    SCpnt->sense_buffer[0]=0;
-    SCpnt->cmd_len = size;
-
-    /*
-     * Now copy the SCSI command from the user's address space.
-     */
-    copy_from_user(cmnd,buf,size);
-    buf+=size;
-
-    /*
-     * If we are writing data, copy the data we are writing.  The pack_len
-     * field also includes the length of the header and the command,
-     * so we need to subtract these off.
-     */
-    if (input_size > 0) copy_from_user(device->buff, buf, input_size);
-
-    /*
-     * Set the LUN field in the command structure.
-     */
-    cmnd[1]= (cmnd[1] & 0x1f) | (device->device->lun<<5);
-
-#ifdef DEBUG
-    printk("do cmd\n");
-#endif
-
-    /*
-     * Now pass the actual command down to the low-level driver.  We
-     * do not do any more here - when the interrupt arrives, we will
-     * then do the post-processing.
-     */
-    spin_lock_irqsave(&io_request_lock, flags);
-    scsi_do_cmd (SCpnt,(void *) cmnd,
-		 (void *) device->buff,amt,
-		 sg_command_done,device->timeout,SG_DEFAULT_RETRIES);
-    spin_unlock_irqrestore(&io_request_lock, flags);
+    dev = MINOR(sdp->i_rdev);
 
-#ifdef DEBUG
-    printk("done cmd\n");
+    if (part_of)
+        printk(" >>> device=%d(sg%c), ", dev, 'a' + dev);
+    else
+        printk("sg_debug: device=%d(sg%c), ", dev, 'a' + dev);
+    printk("scsi%d chan=%d id=%d lun=%d  em=%d\n", sdp->device->host->host_no,
+           sdp->device->channel, sdp->device->id, sdp->device->lun,
+           sdp->device->host->hostt->emulated);
+    printk(" sg_tablesize=%d, excl=%d, sgdebug=%d, merge_fd=%d\n",
+           sdp->sg_tablesize, sdp->exclude, sdp->sgdebug, sdp->merge_fd);
+    if (! part_of) {
+        printk(" scsi_dma_free_sectors=%u, sg_pool_secs_aval=%d\n",
+               scsi_dma_free_sectors, sg_pool_secs_avail);
+#ifdef SG_DEBUG
+        printk(" mallocs: kmallocs=%d, dma_pool=%d, pages=%d\n",
+               sg_num_kmal, sg_num_pool, sg_num_page);
 #endif
+    }
 
-    return count;
-}
-
-static unsigned int sg_poll(struct file *file, poll_table * wait)
-{
-        int dev = MINOR(file->f_dentry->d_inode->i_rdev);
-        struct scsi_generic *device = &scsi_generics[dev];
-        unsigned int mask = 0;
-
-        poll_wait(file, &scsi_generics[dev].read_wait, wait);
-        poll_wait(file, &scsi_generics[dev].write_wait, wait);
-        if(device->pending && device->complete)
-                mask |= POLLIN | POLLRDNORM;
-        if(!device->pending)
-                mask |= POLLOUT | POLLWRNORM;
-
-        return mask;
+    fp = sdp->headfp;
+    for (k = 1; fp; fp = fp->nextfp, ++k) {
+        if (sfp == fp)
+            printk("  *** Following data belongs to invoking FD ***\n");
+        else if (! fp->parentdp)
+            printk(">> Following FD has NULL parent pointer ???\n");
+        printk("   FD(%d): timeout=%d, fb_size=%d, cmd_q=%d\n",
+               k, fp->timeout, fp->fb_size, (int)fp->cmd_q);
+        printk("   low_dma=%d, force_packid=%d, closed=%d\n",
+               (int)fp->low_dma, (int)fp->force_packid, (int)fp->closed);
+        srp = fp->headrp;
+        if (NULL == srp)
+            printk("     No requests active\n");
+        while (srp) {
+            if (srp->fb_used)
+                printk("using 1st buff >> ");
+            else
+                printk("     ");
+            if (srp->my_cmdp)
+                printk("written: pack_id=%d, bufflen=%d, use_sg=%d\n",
+                       srp->header.pack_id, srp->my_cmdp->bufflen, 
+                       srp->my_cmdp->use_sg);
+            else
+                printk("to_read: pack_id=%d, bufflen=%d, use_sg=%d\n",
+                   srp->header.pack_id, srp->data.bufflen, srp->data.use_sg);
+            if (! srp->parentfp)
+                printk(">> request has NULL parent pointer ???\n");
+            srp = srp->nextrp;
+        }
+    }
 }
 
 static struct file_operations sg_fops = {
@@ -574,24 +920,30 @@
     sg_ioctl,        /* ioctl */
     NULL,            /* mmap */
     sg_open,         /* open */
-    NULL,	     /* flush */
-    sg_close,        /* release */
-    NULL             /* fsync */
+    NULL,            /* flush */
+    sg_release,      /* release, was formerly sg_close */
+    NULL,            /* fsync */
+    sg_fasync,       /* fasync */
+    NULL,            /* check_media_change */
+    NULL,            /* revalidate */
+    NULL,            /* lock */
 };
 
 
-static int sg_detect(Scsi_Device * SDp){
-
-    switch (SDp->type) {
-	case TYPE_DISK:
-	case TYPE_MOD:
-	case TYPE_ROM:
-	case TYPE_WORM:
-	case TYPE_TAPE: break;
-	default:
-	printk("Detected scsi generic sg%c at scsi%d, channel %d, id %d, lun %d\n",
-           'a'+sg_template.dev_noticed,
-           SDp->host->host_no, SDp->channel, SDp->id, SDp->lun);
+static int sg_detect(Scsi_Device * scsidp)
+{
+    switch (scsidp->type) {
+        case TYPE_DISK:
+        case TYPE_MOD:
+        case TYPE_ROM:
+        case TYPE_WORM:
+        case TYPE_TAPE: break;
+        default:
+        printk("Detected scsi generic sg%c at scsi%d,"
+                " channel %d, id %d, lun %d\n",
+               'a'+sg_template.dev_noticed,
+               scsidp->host->host_no, scsidp->channel, 
+               scsidp->id, scsidp->lun);
     }
     sg_template.dev_noticed++;
     return 1;
@@ -605,84 +957,108 @@
     if (sg_template.dev_noticed == 0) return 0;
 
     if(!sg_registered) {
-	if (register_chrdev(SCSI_GENERIC_MAJOR,"sg",&sg_fops))
-	{
-	    printk("Unable to get major %d for generic SCSI device\n",
-		   SCSI_GENERIC_MAJOR);
-	    return 1;
-	}
-	sg_registered++;
+        if (register_chrdev(SCSI_GENERIC_MAJOR,"sg",&sg_fops))
+        {
+            printk("Unable to get major %d for generic SCSI device\n",
+                   SCSI_GENERIC_MAJOR);
+            return 1;
+        }
+        sg_registered++;
     }
 
     /* If we have already been through here, return */
-    if(scsi_generics) return 0;
-
-#ifdef DEBUG
-    printk("sg: Init generic device.\n");
-#endif
-
-#ifdef SG_BIG_BUFF
-    big_buff= (char *) scsi_init_malloc(SG_BIG_BUFF, GFP_ATOMIC | GFP_DMA);
-#endif
-
-    scsi_generics = (struct scsi_generic *)
-	scsi_init_malloc((sg_template.dev_noticed + SG_EXTRA_DEVS)
-			 * sizeof(struct scsi_generic), GFP_ATOMIC);
-    memset(scsi_generics, 0, (sg_template.dev_noticed + SG_EXTRA_DEVS)
-	   * sizeof(struct scsi_generic));
+    if(sg_dev_arr) return 0;
 
+    SCSI_LOG_TIMEOUT(3, printk("sg_init\n"));
+    sg_dev_arr = (Sg_device *)
+        scsi_init_malloc((sg_template.dev_noticed + SG_EXTRA_DEVS)
+                         * sizeof(Sg_device), GFP_ATOMIC);
+    if (NULL == sg_dev_arr) {
+        printk("sg_init: no space for sg_dev_arr\n");
+        return 1;
+    }
     sg_template.dev_max = sg_template.dev_noticed + SG_EXTRA_DEVS;
     return 0;
 }
 
-static int sg_attach(Scsi_Device * SDp)
+static int sg_attach(Scsi_Device * scsidp)
 {
-    struct scsi_generic * gpnt;
-    int i;
+    Sg_device * sdp = sg_dev_arr;
+    int k;
 
-    if(sg_template.nr_dev >= sg_template.dev_max)
+    if ((sg_template.nr_dev >= sg_template.dev_max) || (! sdp))
     {
-	SDp->attached--;
-	return 1;
+        scsidp->attached--;
+        return 1;
     }
 
-    for(gpnt = scsi_generics, i=0; i<sg_template.dev_max; i++, gpnt++)
-	if(!gpnt->device) break;
+    for(k = 0; k < sg_template.dev_max; k++, sdp++)
+        if(! sdp->device) break;
 
-    if(i >= sg_template.dev_max) panic ("scsi_devices corrupt (sg)");
+    if(k >= sg_template.dev_max) panic ("scsi_devices corrupt (sg)");
 
-    scsi_generics[i].device=SDp;
-    scsi_generics[i].users=0;
-    scsi_generics[i].generic_wait=NULL;
-    scsi_generics[i].read_wait=NULL;
-    scsi_generics[i].write_wait=NULL;
-    scsi_generics[i].buff=NULL;
-    scsi_generics[i].exclude=0;
-    scsi_generics[i].pending=0;
-    scsi_generics[i].timeout=SG_DEFAULT_TIMEOUT;
+    SCSI_LOG_TIMEOUT(3, printk("sg_attach: dev=%d \n", k));
+    sdp->device = scsidp;
+    sdp->generic_wait = NULL;
+    sdp->headfp= NULL;
+    sdp->exclude = 0;
+    sdp->merge_fd = 0;
+    sdp->sgdebug = 0;
+    sdp->sg_tablesize = scsidp->host ? scsidp->host->sg_tablesize : 0;
+    sdp->i_rdev = MKDEV(SCSI_GENERIC_MAJOR, k);
     sg_template.nr_dev++;
     return 0;
-};
-
-
+}
 
-static void sg_detach(Scsi_Device * SDp)
+/* Called at 'finish' of init process, after all attaches */
+static void sg_finish(void)
 {
-    struct scsi_generic * gpnt;
-    int i;
+    SCSI_LOG_TIMEOUT(3, printk("sg_finish: dma_free_sectors=%u\n",
+                     scsi_dma_free_sectors));
+}
 
-    for(gpnt = scsi_generics, i=0; i<sg_template.dev_max; i++, gpnt++)
-	if(gpnt->device == SDp) {
-	    gpnt->device = NULL;
-	    SDp->attached--;
-	    sg_template.nr_dev--;
-            /*
-             * avoid associated device /dev/sg? bying incremented
-             * each time module is inserted/removed , <dan@lectra.fr>
-             */
-            sg_template.dev_noticed--;
-	    return;
-	}
+static void sg_detach(Scsi_Device * scsidp)
+{
+    Sg_device * sdp = sg_dev_arr;
+    unsigned long flags = 0;
+    Sg_fd * sfp;
+    Sg_request * srp;
+    int k;
+
+    if (NULL == sdp) return; /* all is not well ... */
+    for (k = 0; k < sg_template.dev_max; k++, sdp++) {
+        if(sdp->device != scsidp)
+            continue;   /* dirty but lowers nesting */
+        if (sdp->headfp) {
+/* Need to stop sg_command_done() playing with this list during this loop */
+            spin_lock_irqsave(&io_request_lock, flags);
+            sfp = sdp->headfp;
+            while (sfp) {
+                srp = sfp->headrp;
+                while (srp) {
+                    if (srp->my_cmdp)
+                        sg_shorten_timeout(srp->my_cmdp);
+                    srp = srp->nextrp;
+                }
+                sfp = sfp->nextfp;
+            }
+            spin_unlock_irqrestore(&io_request_lock, flags);
+    SCSI_LOG_TIMEOUT(3, printk("sg_detach: dev=%d, dirty, sleep(3)\n", k));
+            scsi_sleep(3); /* sleep 3 jiffies, hoping for timeout to go off */
+        }
+        else {
+            SCSI_LOG_TIMEOUT(3, printk("sg_detach: dev=%d\n", k));
+            sdp->device = NULL; 
+        }
+        scsidp->attached--;
+        sg_template.nr_dev--;
+        /*
+         * avoid associated device /dev/sg? bying incremented
+         * each time module is inserted/removed , <dan@lectra.fr>
+         */
+        sg_template.dev_noticed--;
+        return;
+    }
     return;
 }
 
@@ -698,34 +1074,555 @@
     scsi_unregister_module(MODULE_SCSI_DEV, &sg_template);
     unregister_chrdev(SCSI_GENERIC_MAJOR, "sg");
 
-    if(scsi_generics != NULL) {
-	scsi_init_free((char *) scsi_generics,
-		       (sg_template.dev_noticed + SG_EXTRA_DEVS)
-		       * sizeof(struct scsi_generic));
+    if(sg_dev_arr != NULL) {
+/* Really worrying situation of writes still pending and get here */
+/* Strategy: shorten timeout on release + wait on detach ... */
+        scsi_init_free((char *) sg_dev_arr,
+                       (sg_template.dev_noticed + SG_EXTRA_DEVS)
+                       * sizeof(Sg_device));
+        sg_dev_arr = NULL;
     }
     sg_template.dev_max = 0;
-#ifdef SG_BIG_BUFF
-    if(big_buff != NULL)
-	scsi_init_free(big_buff, SG_BIG_BUFF);
-#endif
 }
 #endif /* MODULE */
 
-/*
- * Overrides for Emacs so that we almost follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-indent-level: 4
- * c-brace-imaginary-offset: 0
- * c-brace-offset: -4
- * c-argdecl-indent: 4
- * c-label-offset: -4
- * c-continued-statement-offset: 4
- * c-continued-brace-offset: 0
- * indent-tabs-mode: nil
- * tab-width: 8
- * End:
- */
+
+#if 0
+extern void scsi_times_out (Scsi_Cmnd * SCpnt);
+extern void scsi_old_times_out (Scsi_Cmnd * SCpnt);
+#endif
+
+/* Can't see clean way to abort a command so shorten timeout to 1 jiffy */
+static void sg_shorten_timeout(Scsi_Cmnd * scpnt)
+{
+#if 0 /* scsi_syms.c is very miserly about exported functions */
+    scsi_delete_timer(scpnt);
+    if (! scpnt)
+        return;
+    scpnt->timeout_per_command = 1; /* try 1 jiffy (perhaps 0 jiffies) */
+    if (scpnt->host->hostt->use_new_eh_code)
+        scsi_add_timer(scpnt, scpnt->timeout_per_command, scsi_times_out);
+    else
+        scsi_add_timer(scpnt, scpnt->timeout_per_command,
+                       scsi_old_times_out);
+#else
+    scsi_sleep(HZ); /* just sleep 1 second and hope ... */
+#endif
+}
+
+static int sg_sc_build(Sg_request * srp, int max_buff_size,
+                       const char * inp, int num_write_xfer)
+{
+    int ret_sz, mem_src;
+    int blk_size = max_buff_size;
+    char * p = NULL;
+
+    if ((blk_size < 0) || (! srp))
+        return -EFAULT;
+    
+    SCSI_LOG_TIMEOUT(4, printk("sg build: m_b_s=%d, num_write_xfer=%d\n", 
+                                  max_buff_size, num_write_xfer)); 
+    if (0 == blk_size)
+        ++blk_size;             /* don't know why */
+/* round request up to next highest SG_SECTOR_SZ byte boundary */
+    blk_size = (blk_size + SG_SECTOR_MSK) & (~SG_SECTOR_MSK);
+    SCSI_LOG_TIMEOUT(5, printk("sg_sc_build: blk_size=%d\n", blk_size));
+
+    if (blk_size <= SG_SCATTER_SZ) {
+        mem_src = SG_HEAP_FB;
+        p = sg_malloc(srp, blk_size, &ret_sz, &mem_src);
+        if (! p)
+            return -ENOMEM;
+        if (blk_size == ret_sz) { /* got it on the first attempt */
+            srp->data.buffer = p;
+            srp->data.bufflen = blk_size;
+            srp->data.mem_src = mem_src;
+            srp->data.b_malloc_len = blk_size;
+            if (inp && (num_write_xfer > 0))
+                copy_from_user(srp->data.buffer, inp, num_write_xfer);
+            return 0;
+        }
+    }
+    else {
+        mem_src = SG_HEAP_PAGE;
+        p = sg_malloc(srp, SG_SCATTER_SZ, &ret_sz, &mem_src);
+        if (! p)
+            return -ENOMEM;
+    }
+/* Want some local declarations, so start new block ... */
+    {   /* lets try and build a scatter gather list */
+        struct scatterlist * sclp;
+        int k, rem_sz, num, nxt;
+        int sc_bufflen = PAGE_SIZE;
+        int mx_sc_elems = (sc_bufflen / sizeof(struct scatterlist)) - 1;
+        int sg_tablesize = srp->parentfp->parentdp->sg_tablesize;
+        int first = 1;
+
+        k = SG_HEAP_KMAL;  /* want to protect mem_src, use k as scratch */
+        srp->data.buffer = (struct scatterlist *)sg_malloc(srp, 
+                                sc_bufflen, &num, &k);
+        srp->data.mem_src = (char)k;
+        /* N.B. ret_sz and mem_src carried into this block ... */
+        if (! srp->data.buffer)
+            return -ENOMEM;
+        else if (num != sc_bufflen) {
+            sc_bufflen = num;
+            mx_sc_elems = (sc_bufflen / sizeof(struct scatterlist)) - 1;
+        }
+        srp->data.sglist_len = sc_bufflen;
+        memset(srp->data.buffer, 0, sc_bufflen);
+        for (k = 0, sclp = srp->data.buffer, rem_sz = blk_size, nxt =0; 
+             (k < sg_tablesize) && (rem_sz > 0) && (k < mx_sc_elems); 
+             ++k, rem_sz -= ret_sz, ++sclp) {
+            if (first) 
+                first = 0;
+            else {
+                num = (rem_sz > SG_SCATTER_SZ) ? SG_SCATTER_SZ : rem_sz;
+                mem_src = SG_HEAP_PAGE;
+                p = sg_malloc(srp, num, &ret_sz, &mem_src);
+                if (! p)
+                    break;
+            }
+            sclp->address = p;
+            sclp->length = ret_sz;
+            sclp->alt_address = (char *)mem_src;
+            
+            if(inp && (num_write_xfer > 0)) {
+                num = (ret_sz > num_write_xfer) ? num_write_xfer : ret_sz;
+                copy_from_user(sclp->address, inp, num);
+                num_write_xfer -= num;
+                inp += num;
+            }
+            SCSI_LOG_TIMEOUT(5, 
+                printk("sg_sc_build: k=%d, a=0x%x, len=%d, ms=%d\n", 
+                k, (int)sclp->address, ret_sz, (int)sclp->alt_address));
+        } /* end of for loop */
+        srp->data.use_sg = k;
+        SCSI_LOG_TIMEOUT(5, 
+            printk("sg_sc_build: use_sg=%d, rem_sz=%d\n", k, rem_sz));
+        srp->data.bufflen = blk_size;
+        if (rem_sz > 0)   /* must have failed */
+            return -ENOMEM;
+    }
+    return 0;
+}
+
+static int sg_sc_undo_rem(Sg_request * srp, char * outp,
+                          int num_read_xfer)
+{
+    if (! srp)
+        return -EFAULT;
+    SCSI_LOG_TIMEOUT(4, printk("sg_sc_undo_rem: num_read_xfer=%d\n", 
+                               num_read_xfer)); 
+    if (! outp)
+        num_read_xfer = 0;
+    if(srp->data.use_sg) {
+        int k, num, mem_src;
+        struct scatterlist * sclp = (struct scatterlist *)srp->data.buffer;
+
+        for (k = 0; (k < srp->data.use_sg) && sclp->address; ++k, ++sclp) {
+            if (num_read_xfer > 0) {
+                num = (int)sclp->length;
+                if (num > num_read_xfer) {
+                    copy_to_user(outp, sclp->address, num_read_xfer);
+                    outp += num_read_xfer;
+                    num_read_xfer = 0;
+                }
+                else {
+                    copy_to_user(outp, sclp->address, num);
+                    outp += num;
+                    num_read_xfer -= num;
+                }
+            }
+            mem_src = (int)sclp->alt_address;
+            SCSI_LOG_TIMEOUT(5, 
+                printk("sg_sc_undo_rem: k=%d, a=0x%x, len=%d, ms=%d\n", 
+                       k, (int)sclp->address, sclp->length, mem_src));
+            sg_free(srp, sclp->address, sclp->length, mem_src);
+        }
+        sg_free(srp, srp->data.buffer, srp->data.sglist_len, 
+                srp->data.mem_src);
+    }
+    else {
+        if (num_read_xfer > 0) 
+            copy_to_user(outp, srp->data.buffer, num_read_xfer);
+        sg_free(srp, srp->data.buffer, srp->data.b_malloc_len, 
+                srp->data.mem_src);
+    }
+    if (0 == sg_remove_request(srp->parentfp, srp)) {
+        SCSI_LOG_TIMEOUT(1, printk("sg_sc_undo_rem: srp=%d not found\n", 
+                                   (int)srp));
+    }
+    return 0;
+}
+
+static Sg_request * sg_get_request(const Sg_fd * sfp, int pack_id)
+{
+    Sg_request * resp = NULL;
+
+    resp = sfp->headrp;
+    while (resp) {
+        if ((! resp->my_cmdp) && 
+            ((-1 == pack_id) || (resp->header.pack_id == pack_id)))
+            return resp;
+        resp = resp->nextrp;
+    }
+    return resp;
+}
+
+/* always adds to end of list */
+static Sg_request * sg_add_request(Sg_fd * sfp)
+{
+    int k;
+    Sg_request * resp = NULL;
+    Sg_request * rp;
+
+    resp = sfp->headrp;
+    rp = sfp->req_arr;
+    if (! resp) {
+        resp = rp;
+        sfp->headrp = resp;
+    }
+    else {
+        if (0 == sfp->cmd_q)
+            resp = NULL;   /* command queuing disallowed */
+        else {
+            for (k = 0, rp; k < SG_MAX_QUEUE; ++k, ++rp) {
+                if (! rp->parentfp)
+                    break;
+            }
+            if (k < SG_MAX_QUEUE) {
+                while (resp->nextrp) resp = resp->nextrp;
+                resp->nextrp = rp;
+                resp = rp;
+            }
+            else
+                resp = NULL;
+        }
+    }
+    if (resp) {
+        resp->parentfp = sfp;
+        resp->nextrp = NULL;
+        resp->fb_used = 0;
+        memset(&resp->data, 0, sizeof(Sg_scatter_hold));
+        memset(&resp->header, 0, sizeof(struct sg_header));
+        resp->my_cmdp = NULL;
+    }
+    return resp;
+}
+
+/* Return of 1 for found; 0 for not found */
+static int sg_remove_request(Sg_fd * sfp, const Sg_request * srp)
+{
+    Sg_request * prev_rp;
+    Sg_request * rp;
+
+    if ((! sfp) || (! srp) || (! sfp->headrp))
+        return 0;
+    prev_rp = sfp->headrp;
+    if (srp == prev_rp) {
+        prev_rp->parentfp = NULL;
+        sfp->headrp = prev_rp->nextrp;
+        return 1;
+    }
+    while ((rp = prev_rp->nextrp)) {
+        if (srp == rp) {
+            rp->parentfp = NULL;
+            prev_rp->nextrp = rp->nextrp;
+            return 1;
+        }
+        prev_rp = rp;
+    }
+    return 0;
+}
+
+static Sg_fd * sg_add_sfp(Sg_device * sdp, int dev)
+{
+    Sg_fd * sfp;
+
+    if (sdp->merge_fd) {
+        ++sdp->merge_fd;
+        return sdp->headfp;
+    }
+    sfp = (Sg_fd *)sg_low_malloc(sizeof(Sg_fd), 0, SG_HEAP_KMAL, 0);
+    if (sfp) {
+        memset(sfp, 0, sizeof(Sg_fd));
+        sfp->my_mem_src = SG_HEAP_KMAL;
+    }
+    else
+        return NULL;
+        
+    sfp->timeout = SG_DEFAULT_TIMEOUT;
+    sfp->force_packid = SG_DEF_FORCE_PACK_ID;
+    sfp->low_dma = (SG_DEF_FORCE_LOW_DMA == 0) ?
+                   sdp->device->host->unchecked_isa_dma : 1;
+    sfp->cmd_q = SG_DEF_COMMAND_Q;
+    sfp->fst_buf = sg_low_malloc(SG_SCATTER_SZ, sfp->low_dma, 
+                                 SG_HEAP_PAGE, &sfp->fb_size);
+    if (! sfp->fst_buf)
+        sfp->fb_size = 0;
+    sfp->parentdp = sdp;
+    if (! sdp->headfp)
+        sdp->headfp = sfp;
+    else {    /* add to tail of existing list */
+        Sg_fd * pfp = sdp->headfp;
+        while (pfp->nextfp)
+           pfp = pfp->nextfp;
+        pfp->nextfp = sfp;
+    }
+    sg_big_buff = sfp->fb_size; /* show sysctl most recent "fb" size */
+    SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp: sfp=0x%x, m_s=%d\n",
+                               (int)sfp, (int)sfp->my_mem_src));
+    SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp:   fb_sz=%d, fst_buf=0x%x\n",
+                               sfp->fb_size, (int)sfp->fst_buf));
+    return sfp;
+}
+
+static int sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp)
+{
+    Sg_request * srp;
+    Sg_request * tsrp;
+    int dirty = 0;
+    int res = 0;
+
+    if (sdp->merge_fd) {
+        if (--sdp->merge_fd)
+            return 0;   /* if merge_fd then dec merge_fd counter */
+    }
+    srp = sfp->headrp;
+    if (srp) {
+/* Need to stop sg_command_done() playing with this list during this loop */
+        while (srp) {
+            tsrp = srp->nextrp;
+            if (! srp->my_cmdp)
+                sg_sc_undo_rem(srp, NULL, 0);
+            else
+                ++dirty;
+            srp = tsrp;
+        }
+    }
+    if (0 == dirty) {
+        Sg_fd * fp;
+        Sg_fd * prev_fp =  sdp->headfp;
+
+        if (sfp == prev_fp)
+            sdp->headfp = prev_fp->nextfp;
+        else {
+            while ((fp = prev_fp->nextfp)) {
+                if (sfp == fp) {
+                    prev_fp->nextfp = fp->nextfp;
+                    break;
+                }
+                prev_fp = fp;
+            }
+        }
+SCSI_LOG_TIMEOUT(6, printk("sg_remove_sfp:    fb_sz=%d, fst_buf=0x%x\n",
+                 sfp->fb_size, (int)sfp->fst_buf));
+        sg_low_free(sfp->fst_buf, sfp->fb_size, SG_HEAP_PAGE);
+        sfp->parentdp = NULL;
+        sfp->fst_buf = NULL;
+        sfp->fb_size = 0;
+    SCSI_LOG_TIMEOUT(6, printk("sg_remove_sfp:    sfp=0x%x\n", (int)sfp));
+        sg_low_free((char *)sfp, sizeof(Sg_fd), sfp->my_mem_src);
+        res = 1;
+    }
+    else {
+        sfp->closed = 1; /* flag dirty state on this fd */
+        SCSI_LOG_TIMEOUT(1, printk(
+          "sg_remove_sfp: worrisome, %d writes pending\n", dirty));
+    }
+    return res;
+}
+
+static int sg_fb_in_use(const Sg_fd * sfp)
+{
+    const Sg_request * srp = sfp->headrp;
+
+    while (srp) {
+        if (srp->fb_used)
+            return 1;
+        srp = srp->nextrp;
+    }
+    return 0;
+}
+
+/* If retSzp==NULL want exact size or fail */
+/* sg_low_malloc() should always be called from a process context allowing
+   GFP_KERNEL to be used instead of GFP_ATOMIC */
+static char * sg_low_malloc(int rqSz, int lowDma, int mem_src, int * retSzp)
+{
+    char * resp = NULL;
+    int page_mask = lowDma ? (GFP_KERNEL | GFP_DMA) : GFP_KERNEL;
+
+    if (rqSz <= 0)
+        return resp;
+    if (SG_HEAP_KMAL == mem_src) {
+        page_mask = lowDma ? (GFP_ATOMIC | GFP_DMA) : GFP_ATOMIC;
+        /* Seen kmalloc(..,GFP_KERNEL) hang for 40 secs! */
+        resp = kmalloc(rqSz, page_mask);
+        if (resp && retSzp) *retSzp = rqSz;
+#ifdef SG_DEBUG
+        if (resp) ++sg_num_kmal;
+#endif
+        return resp;
+    }
+    if (SG_HEAP_POOL == mem_src) {
+        int num_sect = rqSz / SG_SECTOR_SZ;
+
+        if (0 != (rqSz & SG_SECTOR_MSK)) {
+            if (! retSzp)
+                return resp;
+            ++num_sect;
+            rqSz = num_sect * SG_SECTOR_SZ;
+        }
+        while (num_sect > 0) {
+            if ((num_sect <= sg_pool_secs_avail) &&
+                (scsi_dma_free_sectors > (SG_LOW_POOL_THRESHHOLD + num_sect))) {
+                resp = scsi_malloc(rqSz);
+                if (resp) {
+                    if (retSzp) *retSzp = rqSz;
+                    sg_pool_secs_avail -= num_sect;
+#ifdef SG_DEBUG
+                    ++sg_num_pool;
+#endif
+                    return resp;
+                }
+            }
+            if (! retSzp)
+                return resp;
+            num_sect /= 2;      /* try half as many */
+            rqSz = num_sect * SG_SECTOR_SZ;
+        }
+    }
+    else if (SG_HEAP_PAGE == mem_src) {
+        int order, a_size;
+        int resSz = rqSz;
+
+        for (order = 0, a_size = PAGE_SIZE;
+             a_size < rqSz; order++, a_size <<= 1)
+            ;
+        resp = (char *)__get_free_pages(page_mask, order);
+        while ((! resp) && order && retSzp) {
+            --order;
+            a_size >>= 1;   /* divide by 2, until PAGE_SIZE */
+            resp = (char *)__get_free_pages(page_mask, order); /* try half */
+            resSz = a_size;
+        }
+        if (retSzp) *retSzp = resSz;
+#ifdef SG_DEBUG
+        if (resp) ++sg_num_page;
+#endif
+    }
+    else
+        printk("sg_low_malloc: bad mem_src=%d, rqSz=%df\n", mem_src, rqSz);
+    return resp;
+}
+
+static char * sg_malloc(Sg_request * srp, int size, int * retSzp, 
+                        int * mem_srcp)
+{
+    char * resp = NULL;
+
+    if (retSzp) *retSzp = size;
+    if (size <= 0)
+        ;
+    else {
+        Sg_fd * sfp = srp->parentfp;
+        int low_dma = sfp->low_dma;
+        int l_ms = -1;  /* invalid value */
+
+        switch (*mem_srcp) 
+        {
+        case SG_HEAP_PAGE:
+        case SG_HEAP_FB:
+            l_ms = (size < PAGE_SIZE) ? SG_HEAP_POOL : SG_HEAP_PAGE;
+            resp = sg_low_malloc(size, low_dma, l_ms, 0);
+            if (resp)
+                break;
+            if ((size <= sfp->fb_size) && (0 == sg_fb_in_use(sfp))) {
+                SCSI_LOG_TIMEOUT(6,
+                    printk("sg_malloc: scsi_malloc failed, get fst_buf\n"));
+                resp = sfp->fst_buf;
+                srp->fb_used = 1;
+                l_ms = SG_HEAP_FB;
+                break;
+            }
+            resp = sg_low_malloc(size, low_dma, l_ms, &size);
+            if (! resp) {
+                l_ms = (SG_HEAP_POOL == l_ms) ? SG_HEAP_PAGE : SG_HEAP_POOL;
+                resp = sg_low_malloc(size, low_dma, l_ms, &size);
+                if (! resp) {
+                    l_ms = SG_HEAP_KMAL;
+                    resp = sg_low_malloc(size, low_dma, l_ms, &size);
+                }
+            }
+            if (resp && retSzp) *retSzp = size;
+            break;
+        case SG_HEAP_KMAL:
+            l_ms = SG_HEAP_PAGE;
+            resp = sg_low_malloc(size, low_dma, l_ms, 0);
+            if (resp)
+                break;
+            l_ms = SG_HEAP_POOL;
+            resp = sg_low_malloc(size, low_dma, l_ms, &size);
+            if (resp && retSzp) *retSzp = size;
+            break;
+        default:
+            SCSI_LOG_TIMEOUT(1, printk("sg_malloc: bad ms=%d\n", *mem_srcp));
+            break;
+        }
+        if (resp) *mem_srcp = l_ms;
+    }
+    SCSI_LOG_TIMEOUT(6, printk("sg_malloc: size=%d, ms=%d, ret=0x%x\n", 
+                               size, *mem_srcp, (int)resp));
+    return resp;
+}
+
+static void sg_low_free(char * buff, int size, int mem_src)
+{
+    if (! buff)
+        return;
+    if (SG_HEAP_POOL == mem_src) {
+        int num_sect = size / SG_SECTOR_SZ;
+        scsi_free(buff, size);
+        sg_pool_secs_avail += num_sect;
+    }
+    else if (SG_HEAP_KMAL == mem_src)
+        kfree(buff);    /* size not used */
+    else if (SG_HEAP_PAGE == mem_src) {
+        int order, a_size;
+
+        for (order = 0, a_size = PAGE_SIZE;
+             a_size < size; order++, a_size <<= 1)
+            ;
+        free_pages((unsigned long)buff, order);
+    }
+    else
+        printk("sg_low_free: bad mem_src=%d, buff=0x%x, rqSz=%df\n", 
+               mem_src, (int)buff, size);
+}
+
+static void sg_free(Sg_request * srp, char * buff, int size, int mem_src)
+{
+    Sg_fd * sfp = srp->parentfp;
+
+    SCSI_LOG_TIMEOUT(6, 
+        printk("sg_free: buff=0x%x, size=%d\n", (int)buff, size));
+    if ((! sfp) || (! buff) || (size <= 0))
+        ;
+    else if (sfp->fst_buf == buff) {
+        srp->fb_used = 0;
+        SCSI_LOG_TIMEOUT(6, printk("sg_free:   left cause fst_buf\n"));
+    }
+    else
+        sg_low_free(buff, size, mem_src);
+}
+        
+static void sg_clr_scpnt(Scsi_Cmnd * SCpnt)
+{
+    SCpnt->use_sg = 0;
+    SCpnt->sglist_len = 0;
+    SCpnt->bufflen = 0;
+    SCpnt->buffer = NULL;
+}
+
diff -urN linux-2.2.6-pre3/drivers/video/promcon.c linux/drivers/video/promcon.c
--- linux-2.2.6-pre3/drivers/video/promcon.c	Mon Mar 15 16:11:31 1999
+++ linux/drivers/video/promcon.c	Mon Dec  3 18:38:58 2001
@@ -5,6 +5,7 @@
  * Copyright (C) 1998  Jakub Jelinek  (jj@ultra.linux.cz)
  */
 
+#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
diff -urN linux-2.2.6-pre3/drivers/video/sgivwfb.c linux/drivers/video/sgivwfb.c
--- linux-2.2.6-pre3/drivers/video/sgivwfb.c	Wed Mar 17 09:17:22 1999
+++ linux/drivers/video/sgivwfb.c	Mon Dec  3 18:38:58 2001
@@ -9,6 +9,7 @@
  *  more details.
  */
 
+#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
diff -urN linux-2.2.6-pre3/fs/open.c linux/fs/open.c
--- linux-2.2.6-pre3/fs/open.c	Mon Dec  3 18:38:37 2001
+++ linux/fs/open.c	Mon Dec  3 18:38:58 2001
@@ -69,6 +69,10 @@
 	int error;
 	struct iattr newattrs;
 
+	/* Not pretty: "inode->i_size" shouldn't really be "off_t". But it is. */
+	if ((off_t) length < 0)
+		return -EINVAL;
+
 	down(&inode->i_sem);
 	newattrs.ia_size = length;
 	newattrs.ia_valid = ATTR_SIZE | ATTR_CTIME;
diff -urN linux-2.2.6-pre3/include/asm-alpha/semaphore.h linux/include/asm-alpha/semaphore.h
--- linux-2.2.6-pre3/include/asm-alpha/semaphore.h	Mon Dec  3 18:38:37 2001
+++ linux/include/asm-alpha/semaphore.h	Mon Dec  3 18:38:58 2001
@@ -123,12 +123,14 @@
 	   do {
 	       tmp = ldq_l;
 	       sub = 0x0000000100000000;
-	       ret = ((int)tmp <= 0);		// count <= 0 ?
-	       // If we're subtracting one from count, we don't need 
-	       // one from waking and vice versa.
-	       if ((int)tmp > 0) sub = 1;	// count > 0 ?
-	       if ((long)tmp >= 0) ret = 0;	// waking >= 0 ?
-	       if (ret) break;	
+	       ret = ((int)tmp <= 0);		// count =< 0 ?
+	       if ((int)tmp >= 0) sub = 0;	// count >= 0 ?
+			// note that if count=0 subq overflows to the high
+			// longword (i.e waking)
+	       ret &= ((long)tmp < 0);		// waking < 0 ?
+	       sub += 1;
+	       if (ret) 
+			break;	
 	       tmp -= sub;
 	       tmp = stq_c = tmp;
 	   } while (tmp == 0);
@@ -140,13 +142,14 @@
 		"	addl	%1,0,%2\n"
 		"	sll	%3,32,%3\n"
 		"	cmple	%2,0,%0\n"
-		"	cmovgt	%2,1,%3\n"
-		"	cmovge	%1,0,%0\n"
+		"	cmovge	%2,0,%3\n"
+		"	cmplt	%1,0,%2\n"
+		"	addq	%3,1,%3\n"
+		"	and	%0,%2,%0\n"
 		"	bne	%0,2f\n"
 		"	subq	%1,%3,%1\n"
 		"	stq_c	%1,%4\n"
 		"	beq	%1,3f\n"
-		"	mb\n"
 		"2:\n"
 		".section .text2,\"ax\"\n"
 		"3:	br	1b\n"
diff -urN linux-2.2.6-pre3/include/linux/pagemap.h linux/include/linux/pagemap.h
--- linux-2.2.6-pre3/include/linux/pagemap.h	Sun Mar 28 10:04:01 1999
+++ linux/include/linux/pagemap.h	Mon Dec  3 18:38:58 2001
@@ -17,7 +17,7 @@
 	return PAGE_OFFSET + PAGE_SIZE * (page - mem_map);
 }
 
-#define PAGE_HASH_BITS 11
+#define PAGE_HASH_BITS 12
 #define PAGE_HASH_SIZE (1 << PAGE_HASH_BITS)
 
 #define PAGE_AGE_VALUE 16
diff -urN linux-2.2.6-pre3/include/scsi/sg.h linux/include/scsi/sg.h
--- linux-2.2.6-pre3/include/scsi/sg.h	Fri Apr 10 15:22:21 1998
+++ linux/include/scsi/sg.h	Mon Dec  3 18:38:58 2001
@@ -1,34 +1,157 @@
+#ifndef _SCSI_GENERIC_H
+#define _SCSI_GENERIC_H
+
 /*
    History:
     Started: Aug 9 by Lawrence Foard (entropy@world.std.com), to allow user 
-     process control of SCSI devices.
+     process control of SCSI devices. 
     Development Sponsored by Killy Corp. NY NY
-*/
-
-#ifndef _SCSI_GENERIC_H
-#define _SCSI_GENERIC_H
+Original driver (sg.h):
+*       Copyright (C) 1992 Lawrence Foard
+2.x extensions to driver:
+*       Copyright (C) 1998, 1999 Douglas Gilbert
+
+
+    Version: 2.1.31 (990327)
+    This version for later 2.1.x series and 2.2.x kernels
+    D. P. Gilbert (dgilbert@interlog.com, dougg@triode.net.au)
+
+    Changes since 2.1.30 (990320)
+        - memory tweaks: change flags on kmalloc (GFP_KERNEL to GFP_ATOMIC)
+        -                increase max allowable mid-level pool usage
+    Changes since 2.1.21 (990315)
+        - skipped to 2.1.30 indicating interface change (revert to 2.1.9)
+        - remove attempt to accomodate cdrecord 1.8, will fix app
+        - keep SG_?ET_RESERVED_SIZE naming for clarity
+    Changes since 2.1.20 (990313)
+        - ommission: left out logic for SG_?ET_ALT_INTERFACE, now added
+    Changes since 2.1.9 (990309)
+        - skipped to version 2.1.20 to indicate some interface changes
+        - incorporate sg changes to make cdrecord 1.8 work (had its
+          own patches that were different from the original)
+        - change SG_?ET_BUFF_SIZE to SG_?ET_RESERVED_SIZE for clarity
+    Changes since 2.1.8 (990303)
+        - debug ">9" option dumps debug for _all_ active sg devices
+        - increase allowable dma pool usage + increase minimum threshhold
+        - pad out sg_scsi_id structure
+    Changes since 2.1.7 (990227)
+        - command queuing now "non-default" [back. compat. with cdparanoia]
+        - Tighten access on some ioctls
+
+
+    New features and changes:
+        - per file descriptor (fd) write-read sequencing and command queues.
+        - command queuing supported (SG_MAX_QUEUE is maximum per fd).
+        - scatter-gather supported (allowing potentially megabyte transfers).
+        - the SCSI target, host and driver status are returned
+          in unused fields of sg_header (maintaining its original size).
+        - asynchronous notification support added (SIGPOLL, SIGIO) for
+          read()s ( write()s should never block).
+        - pack_id logic added so read() can be made to wait for a specific
+          pack_id. 
+        - uses memory > ISA_DMA_THRESHOLD if adapter allows it (e.g. a
+          pci scsi adapter).
+        - this driver no longer uses a single SG_BIG_BUFF sized buffer
+          obtained at driver/module init time. Rather it obtains a 
+          SG_SCATTER_SZ buffer when a fd is open()ed and frees it at
+          the corresponding release() (ie pr fd). Hence open() can return
+          ENOMEM! If write() request > SG_SCATTER_SZ bytes for data then
+          it can fail with ENOMEM as well (if so, scale back).
+        - adds several ioctl calls, see ioctl section below.
+        - SG_SCATTER_SZ's presence indicates this version of "sg" driver.
+ 
+ Good documentation on the original "sg" device interface and usage can be
+ found in the Linux HOWTO document: "SCSI Programming HOWTO" by Heiko
+ Eissfeldt; last updated 7 May 1996. I will add more info on using the
+ extensions in this driver as required. A quick summary:
+ An SG device is accessed by writing SCSI commands plus any associated 
+ outgoing data to it; the resulting status codes and any incoming data
+ are then obtained by a read call. The device can be opened O_NONBLOCK
+ (non-blocking) and poll() used to monitor its progress. The device may be
+ opened O_EXCL which excludes other "sg" users from this device (but not 
+ "sd", "st" or "sr" users). The buffer given to the write() call is made
+ up as follows:
+        - struct sg_header image (see below)
+        - scsi command (6, 10 or 12 bytes long)
+        - data to be written to the device (if any)
+
+ The buffer received from the corresponding read() call contains:
+        - struct sg_header image (check results + sense_buffer)
+        - data read back from device (if any)
+
+ The given SCSI command has its LUN field overwritten internally by the
+ value associated with the device that has been opened.
+
+ Memory (RAM) is used within this driver for direct memory access (DMA)
+ in transferring data to and from the SCSI device. The dreaded ENOMEM
+ seems to be more prevalent under early 2.2.x kernels than under the
+ 2.0.x kernel series. For a given (large) transfer the memory obtained by
+ this driver must be contiguous or scatter-gather must be used (if
+ supported by the adapter). [Furthermore, ISA SCSI adapters can only use
+ memory below the 16MB level on a i386.]
+ This driver tries hard to find some suitable memory before admitting
+ defeat and returning ENOMEM. All is not lost if application writers
+ then back off the amount they are requesting. The value returned by
+ the SG_GET_RESERVED_SIZE ioctl is guaranteed to be available (one
+ per fd). This driver does the following:
+   -  attempts to reserve a SG_SCATTER_SZ sized buffer on open(). The
+      actual amount reserved is given by the SG_GET_RESERVED_SIZE ioctl().
+   -  each write() needs to reserve a DMA buffer of the size of the
+      data buffer indicated (excluding sg_header and command overhead).
+      This buffer, depending on its size, adapter type (ISA or not) and
+      the amount of memory available will be obtained from the kernel
+      directly (get_free_pages or kmalloc) or the from the scsi mid-level
+      dma pool (taking care not to exhaust it).
+      If the buffer requested is > SG_SCATTER_SZ or memory is tight then
+      scatter-gather will be used if supported by the adapter.
+  -   write() will also attempt to use the buffer reserved on open()
+      if it is large enough.
+ The above strategy ensures that a write() can always depend on a buffer 
+ of the size indicated by the SG_GET_RESERVED_SIZE ioctl() (which could be
+ 0, but at least the app knows things are tight in advance).
+ Hence application writers can adopt quite aggressive strategies (e.g. 
+ requesting 512KB) and scale them back in the face of ENOMEM errors.
+ N.B. Queuing up commands also ties up kernel memory.
 
-/* 
- An SG device is accessed by writing "packets" to it, the replies
- are then read using the read call. The same header is used for 
- reply, just ignore reply_len field.
+ More documentation can be found at www.netwinder.org/~dougg
 */
 
+#define SG_MAX_SENSE 16   /* too little, unlikely to change in 2.2.x */
+
 struct sg_header
- {
-  int pack_len;    /* length of incoming packet <4096 (including header) */
-  int reply_len;   /* maximum length <4096 of expected reply */
-  int pack_id;     /* id number of packet */
-  int result;      /* 0==ok, otherwise refer to errno codes */
-  unsigned int twelve_byte:1; /* Force 12 byte command length for group 6 & 7 commands  */
-  unsigned int other_flags:31;			/* for future use */
-  unsigned char sense_buffer[16]; /* used only by reads */
-  /* command follows then data for command */
- };
-
-/* ioctl's */
-#define SG_SET_TIMEOUT 0x2201  /* set timeout *(int *)arg==timeout */
-#define SG_GET_TIMEOUT 0x2202  /* get timeout return timeout */
+{
+    int pack_len;    /* [o] reply_len (ie useless), ignored as input */
+    int reply_len;   /* [i] max length of expected reply (inc. sg_header) */
+    int pack_id;     /* [io] id number of packet (use ints >= 0) */
+    int result;      /* [o] 0==ok, else (+ve) Unix errno code (e.g. EIO) */
+    unsigned int twelve_byte:1; 
+        /* [i] Force 12 byte command length for group 6 & 7 commands  */
+    unsigned int target_status:5;   /* [o] scsi status from target */
+    unsigned int host_status:8;     /* [o] host status (see "DID" codes) */
+    unsigned int driver_status:8;   /* [o] driver status+suggestion */
+    unsigned int other_flags:10;    /* unused */
+    unsigned char sense_buffer[SG_MAX_SENSE]; /* [o] Output in 3 cases:
+           when target_status is CHECK_CONDITION or 
+           when target_status is COMMAND_TERMINATED or
+           when (driver_status & DRIVER_SENSE) is true. */
+};      /* This structure is 36 bytes long on i386 */
+
+
+typedef struct sg_scsi_id {
+    int host_no;        /* as in "scsi<n>" where 'n' is one of 0, 1, 2 etc */
+    int channel;
+    int scsi_id;        /* scsi id of target device */
+    int lun;
+    int scsi_type;      /* TYPE_... defined in scsi/scsi.h */
+    int unused1;        /* probably find a good use, set 0 for now */
+    int unused2;        /* ditto */
+    int unused3;  
+} Sg_scsi_id;
+
+/* ioctls  ( _GET_s yield result via 'int *' 3rd argument unless 
+            otherwise indicated */
+#define SG_SET_TIMEOUT 0x2201  /* unit: jiffies, 10ms on i386 */
+#define SG_GET_TIMEOUT 0x2202  /* yield timeout as _return_ value */
 
 #define SG_EMULATED_HOST 0x2203 /* true for emulated host adapter (ATAPI) */
 
@@ -36,12 +159,66 @@
 #define SG_SET_TRANSFORM 0x2204
 #define SG_GET_TRANSFORM 0x2205
 
-#define SG_DEFAULT_TIMEOUT (60*HZ) /* 1 minute timeout */
+#define SG_SET_RESERVED_SIZE 0x2275  /* currently ignored, future addition */
+/* Following yields buffer reserved by open(): 0 <= x <= SG_SCATTER_SZ */
+#define SG_GET_RESERVED_SIZE 0x2272
+
+/* The following ioctl takes a 'Sg_scsi_id *' object as its 3rd argument. */
+#define SG_GET_SCSI_ID 0x2276   /* Yields fd's bus,chan,dev,lun+type */
+/* SCSI id information can also be obtained from SCSI_IOCTL_GET_IDLUN */
+
+/* Override adapter setting and always DMA using low memory ( <16MB on i386).
+   Default is 0 (off - use adapter setting) */
+#define SG_SET_FORCE_LOW_DMA 0x2279  /* 0-> use adapter setting, 1-> force */
+#define SG_GET_LOW_DMA 0x227a   /* 0-> use all ram for dma; 1-> low dma ram */
+
+/* When SG_SET_FORCE_PACK_ID set to 1, pack_id is input to read() which
+   will attempt to read that pack_id or block (or return EAGAIN). If 
+   pack_id is -1 then read oldest waiting. When ...FORCE_PACK_ID set to 0
+   (default) then pack_id ignored by read() and oldest readable fetched. */ 
+#define SG_SET_FORCE_PACK_ID 0x227b
+#define SG_GET_PACK_ID 0x227c /* Yields oldest readable pack_id (or -1) */
+
+#define SG_GET_NUM_WAITING 0x227d /* Number of commands awaiting read() */
+
+/* Turn on error sense trace (1..8), dump this device to log/console (9)
+   or dump all sg device states ( >9 ) to log/console */
+#define SG_SET_DEBUG 0x227e    /* 0 -> turn off debug */
+
+/* Yields max scatter gather tablesize allowed by current host adapter */
+#define SG_GET_SG_TABLESIZE 0x227F  /* 0 implies can't do scatter gather */
+
+/* Control whether sequencing per file descriptor (default) or per device */
+#define SG_GET_MERGE_FD 0x2274   /* 0-> per fd (default), 1-> per device */
+#define SG_SET_MERGE_FD 0x2273   /* Attempt to change sequencing state,
+  if more than 1 fd open on device, will fail with EBUSY */
+
+/* Get/set command queuing state per fd (default is SG_DEF_COMMAND_Q) */
+#define SG_GET_COMMAND_Q 0x2270   /* Yields 0 (queuing off) or 1 (on) */
+#define SG_SET_COMMAND_Q 0x2271   /* Change queuing state with 0 or 1 */
+
+
+#define SG_DEFAULT_TIMEOUT (60*HZ) /* HZ == 'jiffies in 1 second' */
 #define SG_DEFAULT_RETRIES 1
 
-#define SG_MAX_QUEUE 4 /* maximum outstanding request, arbitrary, may be
-			  changed if sufficient DMA buffer room available */
+/* Default modes, commented if they differ from original sg driver */
+#define SG_DEF_COMMAND_Q 0
+#define SG_DEF_MERGE_FD 0       /* was 1 -> per device sequencing */
+#define SG_DEF_FORCE_LOW_DMA 0  /* was 1 -> memory below 16MB on i386 */
+#define SG_DEF_FORCE_PACK_ID 0
+
+/* maximum outstanding requests, write() yields EDOM if exceeded */
+#define SG_MAX_QUEUE 16
+
+#define SG_SCATTER_SZ (8 * 4096)  /* PAGE_SIZE not available to user */
+/* Largest size (in bytes) a single scatter-gather list element can have.
+   The value must be a power of 2 and <= (PAGE_SIZE * 32) [131072 bytes on 
+   i386]. The minimum value is PAGE_SIZE. If scatter-gather not supported
+   by adapter then this value is the largest data block that can be
+   read/written by a single scsi command. Max number of scatter-gather
+   list elements seems to be limited to 255. */
 
-#define SG_BIG_BUFF 32768
+#define SG_BIG_BUFF SG_SCATTER_SZ       /* for backward compatibility */
+/* #define SG_BIG_BUFF (SG_SCATTER_SZ * 8) */ /* =256KB, if you want */
 
 #endif
diff -urN linux-2.2.6-pre3/net/ipv6/tcp_ipv6.c linux/net/ipv6/tcp_ipv6.c
--- linux-2.2.6-pre3/net/ipv6/tcp_ipv6.c	Sun Mar 28 09:07:47 1999
+++ linux/net/ipv6/tcp_ipv6.c	Mon Dec  3 18:38:58 2001
@@ -18,6 +18,7 @@
  *      2 of the License, or (at your option) any later version.
  */
 
+#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
diff -urN linux-2.2.6-pre3/net/irda/af_irda.c linux/net/irda/af_irda.c
--- linux-2.2.6-pre3/net/irda/af_irda.c	Mon Dec  3 18:38:37 2001
+++ linux/net/irda/af_irda.c	Mon Dec  3 18:38:58 2001
@@ -23,7 +23,6 @@
  *     
  ********************************************************************/
 
-#include <linux/config.h>
 #include <linux/types.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
diff -urN linux-2.2.6-pre3/net/irda/irlap_frame.c linux/net/irda/irlap_frame.c
--- linux-2.2.6-pre3/net/irda/irlap_frame.c	Mon Dec  3 18:38:38 2001
+++ linux/net/irda/irlap_frame.c	Mon Dec  3 18:38:58 2001
@@ -22,7 +22,6 @@
  *
  ********************************************************************/
 
-#include <linux/config.h>
 #include <linux/skbuff.h>
 #include <linux/if.h>
 #include <linux/if_ether.h>
Binary files linux-2.2.6-pre3/scripts/ksymoops/ksymoops and linux/scripts/ksymoops/ksymoops differ
diff -urN linux-2.2.6-pre3/scripts/ver_linux linux/scripts/ver_linux
--- linux-2.2.6-pre3/scripts/ver_linux	Tue Mar 16 14:21:52 1999
+++ linux/scripts/ver_linux	Mon Dec  3 18:38:59 2001
@@ -20,10 +20,7 @@
        '{print "Linux C++ Library      " $4"."$5"."$6}'
 ps --version 2>&1 | awk 'NR==1{print "Procps                ", $NF}'
 mount --version | awk -F\- '{print "Mount                 ", $NF}'
-netstat --version | awk \
-'NR==1{if ($5 != "") { n=split($5,buf,"-"); ver=buf[n]; done=1 }}
- NR==2{if (done != 1) ver=$3 }
- END{print "Net-tools             ",ver}'
+hostname -V 2>&1 | awk 'NR==1{print "Net-tools             ", $NF}'
 loadkeys -h 2>&1 | awk \
 '(NR==1 && $3) {ver=$3}
  (NR==2 && $1 ~ /console-tools/) {print "Console-tools         ",$3; done=1}
