vserver 2.0 rc7
[linux-2.6.git] / drivers / block / ub.c
index acea9f0..19c5e59 100644 (file)
@@ -8,13 +8,12 @@
  * and is not licensed separately. See file COPYING for details.
  *
  * TODO (sorted by decreasing priority)
+ *  -- Kill first_open (Al Viro fixed the block layer now)
  *  -- Do resets with usb_device_reset (needs a thread context, use khubd)
  *  -- set readonly flag for CDs, set removable flag for CF readers
  *  -- do inquiry and verify we got a disk and not a tape (for LUN mismatch)
- *  -- support pphaneuf's SDDR-75 with two LUNs (also broken capacity...)
  *  -- special case some senses, e.g. 3a/0 -> no media present, reduce retries
  *  -- verify the 13 conditions and do bulk resets
- *  -- normal pool of commands instead of cmdv[]?
  *  -- kill last_pipe and simply do two-state clearing on both pipes
  *  -- verify protocol (bulk) from USB descriptors (maybe...)
  *  -- highmem and sg
 #define US_SC_SCSI     0x06            /* Transparent */
 
 /*
+ * This many LUNs per USB device.
+ * Every one of them takes a host, see UB_MAX_HOSTS.
  */
+#define UB_MAX_LUNS   9
+
+/*
+ */
+
 #define UB_MINORS_PER_MAJOR    8
 
 #define UB_MAX_CDB_SIZE      16                /* Corresponds to Bulk */
@@ -65,7 +71,7 @@ struct bulk_cb_wrap {
        u32     Tag;                    /* unique per command id */
        __le32  DataTransferLength;     /* size of data */
        u8      Flags;                  /* direction in bit 0 */
-       u8      Lun;                    /* LUN normally 0 */
+       u8      Lun;                    /* LUN */
        u8      Length;                 /* of of the CDB */
        u8      CDB[UB_MAX_CDB_SIZE];   /* max command */
 };
@@ -168,6 +174,7 @@ struct ub_scsi_cmd {
        unsigned int len;               /* Requested length */
        // struct scatterlist sgv[UB_MAX_REQ_SG];
 
+       struct ub_lun *lun;
        void (*done)(struct ub_dev *, struct ub_scsi_cmd *);
        void *back;
 };
@@ -252,25 +259,47 @@ struct ub_scsi_cmd_queue {
 };
 
 /*
- * The UB device instance.
+ * The block device instance (one per LUN).
+ */
+struct ub_lun {
+       struct ub_dev *udev;
+       struct list_head link;
+       struct gendisk *disk;
+       int id;                         /* Host index */
+       int num;                        /* LUN number */
+       char name[16];
+
+       int changed;                    /* Media was changed */
+       int removable;
+       int readonly;
+       int first_open;                 /* Kludge. See ub_bd_open. */
+
+       /* Use Ingo's mempool if or when we have more than one command. */
+       /*
+        * Currently we never need more than one command for the whole device.
+        * However, giving every LUN a command is a cheap and automatic way
+        * to enforce fairness between them.
+        */
+       int cmda[1];
+       struct ub_scsi_cmd cmdv[1];
+
+       struct ub_capacity capacity; 
+};
+
+/*
+ * The USB device instance.
  */
 struct ub_dev {
        spinlock_t lock;
-       int id;                         /* Number among ub's */
        atomic_t poison;                /* The USB device is disconnected */
        int openc;                      /* protected by ub_lock! */
                                        /* kref is too implicit for our taste */
        unsigned int tagcnt;
-       int changed;                    /* Media was changed */
-       int removable;
-       int readonly;
-       int first_open;                 /* Kludge. See ub_bd_open. */
-       char name[8];
+       char name[12];
        struct usb_device *dev;
        struct usb_interface *intf;
 
-       struct ub_capacity capacity; 
-       struct gendisk *disk;
+       struct list_head luns;
 
        unsigned int send_bulk_pipe;    /* cached pipe values */
        unsigned int recv_bulk_pipe;
@@ -279,10 +308,6 @@ struct ub_dev {
 
        struct tasklet_struct tasklet;
 
-       /* XXX Use Ingo's mempool (once we have more than one) */
-       int cmda[1];
-       struct ub_scsi_cmd cmdv[1];
-
        struct ub_scsi_cmd_queue cmd_queue;
        struct ub_scsi_cmd top_rqs_cmd; /* REQUEST SENSE */
        unsigned char top_sense[UB_SENSE_SIZE];
@@ -300,9 +325,10 @@ struct ub_dev {
 
 /*
  */
-static int ub_bd_rq_fn_1(struct ub_dev *sc, struct request *rq);
-static int ub_cmd_build_block(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
-    struct request *rq);
+static void ub_cleanup(struct ub_dev *sc);
+static int ub_bd_rq_fn_1(struct ub_lun *lun, struct request *rq);
+static int ub_cmd_build_block(struct ub_dev *sc, struct ub_lun *lun,
+    struct ub_scsi_cmd *cmd, struct request *rq);
 static int ub_cmd_build_packet(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
     struct request *rq);
 static void ub_rw_cmd_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
@@ -319,8 +345,10 @@ static void ub_state_sense(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 static int ub_submit_clear_stall(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
     int stalled_pipe);
 static void ub_top_sense_done(struct ub_dev *sc, struct ub_scsi_cmd *scmd);
-static int ub_sync_tur(struct ub_dev *sc);
-static int ub_sync_read_cap(struct ub_dev *sc, struct ub_capacity *ret);
+static int ub_sync_tur(struct ub_dev *sc, struct ub_lun *lun);
+static int ub_sync_read_cap(struct ub_dev *sc, struct ub_lun *lun,
+    struct ub_capacity *ret);
+static int ub_probe_lun(struct ub_dev *sc, int lnum);
 
 /*
  */
@@ -341,6 +369,7 @@ MODULE_DEVICE_TABLE(usb, ub_usb_ids);
  */
 #define UB_MAX_HOSTS  26
 static char ub_hostv[UB_MAX_HOSTS];
+
 static DEFINE_SPINLOCK(ub_lock);       /* Locks globals and ->openc */
 
 /*
@@ -405,6 +434,8 @@ static ssize_t ub_diag_show(struct device *dev, char *page)
 {
        struct usb_interface *intf;
        struct ub_dev *sc;
+       struct list_head *p;
+       struct ub_lun *lun;
        int cnt;
        unsigned long flags;
        int nc, nh;
@@ -420,9 +451,15 @@ static ssize_t ub_diag_show(struct device *dev, char *page)
        spin_lock_irqsave(&sc->lock, flags);
 
        cnt += sprintf(page + cnt,
-           "qlen %d qmax %d changed %d removable %d readonly %d\n",
-           sc->cmd_queue.qlen, sc->cmd_queue.qmax,
-           sc->changed, sc->removable, sc->readonly);
+           "qlen %d qmax %d\n",
+           sc->cmd_queue.qlen, sc->cmd_queue.qmax);
+
+       list_for_each (p, &sc->luns) {
+               lun = list_entry(p, struct ub_lun, link);
+               cnt += sprintf(page + cnt,
+                   "lun %u changed %d removable %d readonly %d\n",
+                   lun->num, lun->changed, lun->removable, lun->readonly);
+       }
 
        if ((nc = sc->tr.cur + 1) == SCMD_TRACE_SZ) nc = 0;
        for (j = 0; j < SCMD_TRACE_SZ; j++) {
@@ -478,66 +515,107 @@ static int ub_id_get(void)
 
 static void ub_id_put(int id)
 {
+       unsigned long flags;
 
        if (id < 0 || id >= UB_MAX_HOSTS) {
                printk(KERN_ERR DRV_NAME ": bad host ID %d\n", id);
                return;
        }
+
+       spin_lock_irqsave(&ub_lock, flags);
        if (ub_hostv[id] == 0) {
+               spin_unlock_irqrestore(&ub_lock, flags);
                printk(KERN_ERR DRV_NAME ": freeing free host ID %d\n", id);
                return;
        }
        ub_hostv[id] = 0;
+       spin_unlock_irqrestore(&ub_lock, flags);
+}
+
+/*
+ * Downcount for deallocation. This rides on two assumptions:
+ *  - once something is poisoned, its refcount cannot grow
+ *  - opens cannot happen at this time (del_gendisk was done)
+ * If the above is true, we can drop the lock, which we need for
+ * blk_cleanup_queue(): the silly thing may attempt to sleep.
+ * [Actually, it never needs to sleep for us, but it calls might_sleep()]
+ */
+static void ub_put(struct ub_dev *sc)
+{
+       unsigned long flags;
+
+       spin_lock_irqsave(&ub_lock, flags);
+       --sc->openc;
+       if (sc->openc == 0 && atomic_read(&sc->poison)) {
+               spin_unlock_irqrestore(&ub_lock, flags);
+               ub_cleanup(sc);
+       } else {
+               spin_unlock_irqrestore(&ub_lock, flags);
+       }
 }
 
 /*
  * Final cleanup and deallocation.
- * This must be called with ub_lock taken.
  */
 static void ub_cleanup(struct ub_dev *sc)
 {
+       struct list_head *p;
+       struct ub_lun *lun;
+       request_queue_t *q;
 
-       /*
-        * If we zero disk->private_data BEFORE put_disk, we have to check
-        * for NULL all over the place in open, release, check_media and
-        * revalidate, because the block level semaphore is well inside the
-        * put_disk. But we cannot zero after the call, because *disk is gone.
-        * The sd.c is blatantly racy in this area.
-        */
-       /* disk->private_data = NULL; */
-       put_disk(sc->disk);
-       sc->disk = NULL;
+       while (!list_empty(&sc->luns)) {
+               p = sc->luns.next;
+               lun = list_entry(p, struct ub_lun, link);
+               list_del(p);
+
+               /* I don't think queue can be NULL. But... Stolen from sx8.c */
+               if ((q = lun->disk->queue) != NULL)
+                       blk_cleanup_queue(q);
+               /*
+                * If we zero disk->private_data BEFORE put_disk, we have
+                * to check for NULL all over the place in open, release,
+                * check_media and revalidate, because the block level
+                * semaphore is well inside the put_disk.
+                * But we cannot zero after the call, because *disk is gone.
+                * The sd.c is blatantly racy in this area.
+                */
+               /* disk->private_data = NULL; */
+               put_disk(lun->disk);
+               lun->disk = NULL;
+
+               ub_id_put(lun->id);
+               kfree(lun);
+       }
 
-       ub_id_put(sc->id);
        kfree(sc);
 }
 
 /*
  * The "command allocator".
  */
-static struct ub_scsi_cmd *ub_get_cmd(struct ub_dev *sc)
+static struct ub_scsi_cmd *ub_get_cmd(struct ub_lun *lun)
 {
        struct ub_scsi_cmd *ret;
 
-       if (sc->cmda[0])
+       if (lun->cmda[0])
                return NULL;
-       ret = &sc->cmdv[0];
-       sc->cmda[0] = 1;
+       ret = &lun->cmdv[0];
+       lun->cmda[0] = 1;
        return ret;
 }
 
-static void ub_put_cmd(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
+static void ub_put_cmd(struct ub_lun *lun, struct ub_scsi_cmd *cmd)
 {
-       if (cmd != &sc->cmdv[0]) {
+       if (cmd != &lun->cmdv[0]) {
                printk(KERN_WARNING "%s: releasing a foreign cmd %p\n",
-                   sc->name, cmd);
+                   lun->name, cmd);
                return;
        }
-       if (!sc->cmda[0]) {
-               printk(KERN_WARNING "%s: releasing a free cmd\n", sc->name);
+       if (!lun->cmda[0]) {
+               printk(KERN_WARNING "%s: releasing a free cmd\n", lun->name);
                return;
        }
-       sc->cmda[0] = 0;
+       lun->cmda[0] = 0;
 }
 
 /*
@@ -598,29 +676,30 @@ static struct ub_scsi_cmd *ub_cmdq_pop(struct ub_dev *sc)
 
 static void ub_bd_rq_fn(request_queue_t *q)
 {
-       struct ub_dev *sc = q->queuedata;
+       struct ub_lun *lun = q->queuedata;
        struct request *rq;
 
        while ((rq = elv_next_request(q)) != NULL) {
-               if (ub_bd_rq_fn_1(sc, rq) != 0) {
+               if (ub_bd_rq_fn_1(lun, rq) != 0) {
                        blk_stop_queue(q);
                        break;
                }
        }
 }
 
-static int ub_bd_rq_fn_1(struct ub_dev *sc, struct request *rq)
+static int ub_bd_rq_fn_1(struct ub_lun *lun, struct request *rq)
 {
+       struct ub_dev *sc = lun->udev;
        struct ub_scsi_cmd *cmd;
        int rc;
 
-       if (atomic_read(&sc->poison) || sc->changed) {
+       if (atomic_read(&sc->poison) || lun->changed) {
                blkdev_dequeue_request(rq);
                ub_end_rq(rq, 0);
                return 0;
        }
 
-       if ((cmd = ub_get_cmd(sc)) == NULL)
+       if ((cmd = ub_get_cmd(lun)) == NULL)
                return -1;
        memset(cmd, 0, sizeof(struct ub_scsi_cmd));
 
@@ -629,32 +708,30 @@ static int ub_bd_rq_fn_1(struct ub_dev *sc, struct request *rq)
        if (blk_pc_request(rq)) {
                rc = ub_cmd_build_packet(sc, cmd, rq);
        } else {
-               rc = ub_cmd_build_block(sc, cmd, rq);
+               rc = ub_cmd_build_block(sc, lun, cmd, rq);
        }
        if (rc != 0) {
-               ub_put_cmd(sc, cmd);
+               ub_put_cmd(lun, cmd);
                ub_end_rq(rq, 0);
-               blk_start_queue(sc->disk->queue);
                return 0;
        }
-
        cmd->state = UB_CMDST_INIT;
+       cmd->lun = lun;
        cmd->done = ub_rw_cmd_done;
        cmd->back = rq;
 
        cmd->tag = sc->tagcnt++;
        if ((rc = ub_submit_scsi(sc, cmd)) != 0) {
-               ub_put_cmd(sc, cmd);
+               ub_put_cmd(lun, cmd);
                ub_end_rq(rq, 0);
-               blk_start_queue(sc->disk->queue);
                return 0;
        }
 
        return 0;
 }
 
-static int ub_cmd_build_block(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
-    struct request *rq)
+static int ub_cmd_build_block(struct ub_dev *sc, struct ub_lun *lun,
+    struct ub_scsi_cmd *cmd, struct request *rq)
 {
        int ub_dir;
 #if 0 /* We use rq->buffer for now */
@@ -675,7 +752,7 @@ static int ub_cmd_build_block(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
        sg = &cmd->sgv[0];
        n_elem = blk_rq_map_sg(q, rq, sg);
        if (n_elem <= 0) {
-               ub_put_cmd(sc, cmd);
+               ub_put_cmd(lun, cmd);
                ub_end_rq(rq, 0);
                blk_start_queue(q);
                return 0;               /* request with no s/g entries? */
@@ -684,7 +761,7 @@ static int ub_cmd_build_block(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
        if (n_elem != 1) {              /* Paranoia */
                printk(KERN_WARNING "%s: request with %d segments\n",
                    sc->name, n_elem);
-               ub_put_cmd(sc, cmd);
+               ub_put_cmd(lun, cmd);
                ub_end_rq(rq, 0);
                blk_start_queue(q);
                return 0;
@@ -716,8 +793,8 @@ static int ub_cmd_build_block(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
         * The call to blk_queue_hardsect_size() guarantees that request
         * is aligned, but it is given in terms of 512 byte units, always.
         */
-       block = rq->sector >> sc->capacity.bshift;
-       nblks = rq->nr_sectors >> sc->capacity.bshift;
+       block = rq->sector >> lun->capacity.bshift;
+       nblks = rq->nr_sectors >> lun->capacity.bshift;
 
        cmd->cdb[0] = (ub_dir == UB_DIR_READ)? READ_10: WRITE_10;
        /* 10-byte uses 4 bytes of LBA: 2147483648KB, 2097152MB, 2048GB */
@@ -771,7 +848,8 @@ static int ub_cmd_build_packet(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
 static void ub_rw_cmd_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 {
        struct request *rq = cmd->back;
-       struct gendisk *disk = sc->disk;
+       struct ub_lun *lun = cmd->lun;
+       struct gendisk *disk = lun->disk;
        request_queue_t *q = disk->queue;
        int uptodate;
 
@@ -786,7 +864,7 @@ static void ub_rw_cmd_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
        else
                uptodate = 0;
 
-       ub_put_cmd(sc, cmd);
+       ub_put_cmd(lun, cmd);
        ub_end_rq(rq, uptodate);
        blk_start_queue(q);
 }
@@ -855,7 +933,7 @@ static int ub_scsi_cmd_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
        bcb->Tag = cmd->tag;            /* Endianness is not important */
        bcb->DataTransferLength = cpu_to_le32(cmd->len);
        bcb->Flags = (cmd->dir == UB_DIR_READ) ? 0x80 : 0;
-       bcb->Lun = 0;                   /* No multi-LUN yet */
+       bcb->Lun = (cmd->lun != NULL) ? cmd->lun->num : 0;
        bcb->Length = cmd->cdb_len;
 
        /* copy the command payload */
@@ -970,9 +1048,8 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                         * The control pipe clears itself - nothing to do.
                         * XXX Might try to reset the device here and retry.
                         */
-                       printk(KERN_NOTICE "%s: "
-                           "stall on control pipe for device %u\n",
-                           sc->name, sc->dev->devnum);
+                       printk(KERN_NOTICE "%s: stall on control pipe\n",
+                           sc->name);
                        goto Bad_End;
                }
 
@@ -993,9 +1070,8 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                         * The control pipe clears itself - nothing to do.
                         * XXX Might try to reset the device here and retry.
                         */
-                       printk(KERN_NOTICE "%s: "
-                           "stall on control pipe for device %u\n",
-                           sc->name, sc->dev->devnum);
+                       printk(KERN_NOTICE "%s: stall on control pipe\n",
+                           sc->name);
                        goto Bad_End;
                }
 
@@ -1014,9 +1090,8 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                        rc = ub_submit_clear_stall(sc, cmd, sc->last_pipe);
                        if (rc != 0) {
                                printk(KERN_NOTICE "%s: "
-                                   "unable to submit clear for device %u"
-                                   " (code %d)\n",
-                                   sc->name, sc->dev->devnum, rc);
+                                   "unable to submit clear (%d)\n",
+                                   sc->name, rc);
                                /*
                                 * This is typically ENOMEM or some other such shit.
                                 * Retrying is pointless. Just do Bad End on it...
@@ -1075,9 +1150,8 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                        rc = ub_submit_clear_stall(sc, cmd, sc->last_pipe);
                        if (rc != 0) {
                                printk(KERN_NOTICE "%s: "
-                                   "unable to submit clear for device %u"
-                                   " (code %d)\n",
-                                   sc->name, sc->dev->devnum, rc);
+                                   "unable to submit clear (%d)\n",
+                                   sc->name, rc);
                                /*
                                 * This is typically ENOMEM or some other such shit.
                                 * Retrying is pointless. Just do Bad End on it...
@@ -1108,9 +1182,8 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                        rc = ub_submit_clear_stall(sc, cmd, sc->last_pipe);
                        if (rc != 0) {
                                printk(KERN_NOTICE "%s: "
-                                   "unable to submit clear for device %u"
-                                   " (code %d)\n",
-                                   sc->name, sc->dev->devnum, rc);
+                                   "unable to submit clear (%d)\n",
+                                   sc->name, rc);
                                /*
                                 * This is typically ENOMEM or some other such shit.
                                 * Retrying is pointless. Just do Bad End on it...
@@ -1132,9 +1205,8 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                         * encounter such a thing, try to read the CSW again.
                         */
                        if (++cmd->stat_count >= 4) {
-                               printk(KERN_NOTICE "%s: "
-                                   "unable to get CSW on device %u\n",
-                                   sc->name, sc->dev->devnum);
+                               printk(KERN_NOTICE "%s: unable to get CSW\n",
+                                   sc->name);
                                goto Bad_End;
                        }
                        __ub_state_stat(sc, cmd);
@@ -1175,10 +1247,8 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                         */
                        if (++cmd->stat_count >= 4) {
                                printk(KERN_NOTICE "%s: "
-                                   "tag mismatch orig 0x%x reply 0x%x "
-                                   "on device %u\n",
-                                   sc->name, cmd->tag, bcs->Tag,
-                                   sc->dev->devnum);
+                                   "tag mismatch orig 0x%x reply 0x%x\n",
+                                   sc->name, cmd->tag, bcs->Tag);
                                goto Bad_End;
                        }
                        __ub_state_stat(sc, cmd);
@@ -1212,8 +1282,8 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 
        } else {
                printk(KERN_WARNING "%s: "
-                   "wrong command state %d on device %u\n",
-                   sc->name, cmd->state, sc->dev->devnum);
+                   "wrong command state %d\n",
+                   sc->name, cmd->state);
                goto Bad_End;
        }
        return;
@@ -1256,7 +1326,6 @@ static void __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 
        if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
                /* XXX Clear stalls */
-               printk("%s: CSW #%d submit failed (%d)\n", sc->name, cmd->tag, rc); /* P3 */
                ub_complete(&sc->work_done);
                ub_state_done(sc, cmd, rc);
                return;
@@ -1301,6 +1370,7 @@ static void ub_state_sense(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
        scmd->state = UB_CMDST_INIT;
        scmd->data = sc->top_sense;
        scmd->len = UB_SENSE_SIZE;
+       scmd->lun = cmd->lun;
        scmd->done = ub_top_sense_done;
        scmd->back = cmd;
 
@@ -1379,14 +1449,14 @@ static void ub_top_sense_done(struct ub_dev *sc, struct ub_scsi_cmd *scmd)
        }
        if (cmd != scmd->back) {
                printk(KERN_WARNING "%s: "
-                   "sense done for wrong command 0x%x on device %u\n",
-                   sc->name, cmd->tag, sc->dev->devnum);
+                   "sense done for wrong command 0x%x\n",
+                   sc->name, cmd->tag);
                return;
        }
        if (cmd->state != UB_CMDST_SENSE) {
                printk(KERN_WARNING "%s: "
-                   "sense done with bad cmd state %d on device %u\n",
-                   sc->name, cmd->state, sc->dev->devnum);
+                   "sense done with bad cmd state %d\n",
+                   sc->name, cmd->state);
                return;
        }
 
@@ -1397,68 +1467,32 @@ static void ub_top_sense_done(struct ub_dev *sc, struct ub_scsi_cmd *scmd)
        ub_scsi_urb_compl(sc, cmd);
 }
 
-#if 0
-/* Determine what the maximum LUN supported is */
-int usb_stor_Bulk_max_lun(struct us_data *us)
-{
-       int result;
-
-       /* issue the command */
-       result = usb_stor_control_msg(us, us->recv_ctrl_pipe,
-                                US_BULK_GET_MAX_LUN, 
-                                USB_DIR_IN | USB_TYPE_CLASS | 
-                                USB_RECIP_INTERFACE,
-                                0, us->ifnum, us->iobuf, 1, HZ);
-
-       /* 
-        * Some devices (i.e. Iomega Zip100) need this -- apparently
-        * the bulk pipes get STALLed when the GetMaxLUN request is
-        * processed.   This is, in theory, harmless to all other devices
-        * (regardless of if they stall or not).
-        */
-       if (result < 0) {
-               usb_stor_clear_halt(us, us->recv_bulk_pipe);
-               usb_stor_clear_halt(us, us->send_bulk_pipe);
-       }
-
-       US_DEBUGP("GetMaxLUN command result is %d, data is %d\n", 
-                 result, us->iobuf[0]);
-
-       /* if we have a successful request, return the result */
-       if (result == 1)
-               return us->iobuf[0];
-
-       /* return the default -- no LUNs */
-       return 0;
-}
-#endif
-
 /*
  * This is called from a process context.
  */
-static void ub_revalidate(struct ub_dev *sc)
+static void ub_revalidate(struct ub_dev *sc, struct ub_lun *lun)
 {
 
-       sc->readonly = 0;       /* XXX Query this from the device */
+       lun->readonly = 0;      /* XXX Query this from the device */
 
-       sc->capacity.nsec = 0;
-       sc->capacity.bsize = 512;
-       sc->capacity.bshift = 0;
+       lun->capacity.nsec = 0;
+       lun->capacity.bsize = 512;
+       lun->capacity.bshift = 0;
 
-       if (ub_sync_tur(sc) != 0)
+       if (ub_sync_tur(sc, lun) != 0)
                return;                 /* Not ready */
-       sc->changed = 0;
+       lun->changed = 0;
 
-       if (ub_sync_read_cap(sc, &sc->capacity) != 0) {
+       if (ub_sync_read_cap(sc, lun, &lun->capacity) != 0) {
                /*
                 * The retry here means something is wrong, either with the
                 * device, with the transport, or with our code.
                 * We keep this because sd.c has retries for capacity.
                 */
-               if (ub_sync_read_cap(sc, &sc->capacity) != 0) {
-                       sc->capacity.nsec = 0;
-                       sc->capacity.bsize = 512;
-                       sc->capacity.bshift = 0;
+               if (ub_sync_read_cap(sc, lun, &lun->capacity) != 0) {
+                       lun->capacity.nsec = 0;
+                       lun->capacity.bsize = 512;
+                       lun->capacity.bshift = 0;
                }
        }
 }
@@ -1471,12 +1505,15 @@ static void ub_revalidate(struct ub_dev *sc)
 static int ub_bd_open(struct inode *inode, struct file *filp)
 {
        struct gendisk *disk = inode->i_bdev->bd_disk;
+       struct ub_lun *lun;
        struct ub_dev *sc;
        unsigned long flags;
        int rc;
 
-       if ((sc = disk->private_data) == NULL)
+       if ((lun = disk->private_data) == NULL)
                return -ENXIO;
+       sc = lun->udev;
+
        spin_lock_irqsave(&ub_lock, flags);
        if (atomic_read(&sc->poison)) {
                spin_unlock_irqrestore(&ub_lock, flags);
@@ -1497,15 +1534,15 @@ static int ub_bd_open(struct inode *inode, struct file *filp)
         * The bottom line is, Al Viro says that we should not allow
         * bdev->bd_invalidated to be set when doing add_disk no matter what.
         */
-       if (sc->first_open) {
-               if (sc->changed) {
-                       sc->first_open = 0;
+       if (lun->first_open) {
+               lun->first_open = 0;
+               if (lun->changed) {
                        rc = -ENOMEDIUM;
                        goto err_open;
                }
        }
 
-       if (sc->removable || sc->readonly)
+       if (lun->removable || lun->readonly)
                check_disk_change(inode->i_bdev);
 
        /*
@@ -1513,12 +1550,12 @@ static int ub_bd_open(struct inode *inode, struct file *filp)
         * under some pretty murky conditions (a failure of READ CAPACITY).
         * We may need it one day.
         */
-       if (sc->removable && sc->changed && !(filp->f_flags & O_NDELAY)) {
+       if (lun->removable && lun->changed && !(filp->f_flags & O_NDELAY)) {
                rc = -ENOMEDIUM;
                goto err_open;
        }
 
-       if (sc->readonly && (filp->f_mode & FMODE_WRITE)) {
+       if (lun->readonly && (filp->f_mode & FMODE_WRITE)) {
                rc = -EROFS;
                goto err_open;
        }
@@ -1526,11 +1563,7 @@ static int ub_bd_open(struct inode *inode, struct file *filp)
        return 0;
 
 err_open:
-       spin_lock_irqsave(&ub_lock, flags);
-       --sc->openc;
-       if (sc->openc == 0 && atomic_read(&sc->poison))
-               ub_cleanup(sc);
-       spin_unlock_irqrestore(&ub_lock, flags);
+       ub_put(sc);
        return rc;
 }
 
@@ -1539,16 +1572,10 @@ err_open:
 static int ub_bd_release(struct inode *inode, struct file *filp)
 {
        struct gendisk *disk = inode->i_bdev->bd_disk;
-       struct ub_dev *sc = disk->private_data;
-       unsigned long flags;
+       struct ub_lun *lun = disk->private_data;
+       struct ub_dev *sc = lun->udev;
 
-       spin_lock_irqsave(&ub_lock, flags);
-       --sc->openc;
-       if (sc->openc == 0)
-               sc->first_open = 0;
-       if (sc->openc == 0 && atomic_read(&sc->poison))
-               ub_cleanup(sc);
-       spin_unlock_irqrestore(&ub_lock, flags);
+       ub_put(sc);
        return 0;
 }
 
@@ -1576,20 +1603,14 @@ static int ub_bd_ioctl(struct inode *inode, struct file *filp,
  */
 static int ub_bd_revalidate(struct gendisk *disk)
 {
-       struct ub_dev *sc = disk->private_data;
-
-       ub_revalidate(sc);
-       /* This is pretty much a long term P3 */
-       if (!atomic_read(&sc->poison)) {                /* Cover sc->dev */
-               printk(KERN_INFO "%s: device %u capacity nsec %ld bsize %u\n",
-                   sc->name, sc->dev->devnum,
-                   sc->capacity.nsec, sc->capacity.bsize);
-       }
+       struct ub_lun *lun = disk->private_data;
+
+       ub_revalidate(lun->udev, lun);
 
        /* XXX Support sector size switching like in sr.c */
-       blk_queue_hardsect_size(disk->queue, sc->capacity.bsize);
-       set_capacity(disk, sc->capacity.nsec);
-       // set_disk_ro(sdkp->disk, sc->readonly);
+       blk_queue_hardsect_size(disk->queue, lun->capacity.bsize);
+       set_capacity(disk, lun->capacity.nsec);
+       // set_disk_ro(sdkp->disk, lun->readonly);
 
        return 0;
 }
@@ -1605,9 +1626,9 @@ static int ub_bd_revalidate(struct gendisk *disk)
  */
 static int ub_bd_media_changed(struct gendisk *disk)
 {
-       struct ub_dev *sc = disk->private_data;
+       struct ub_lun *lun = disk->private_data;
 
-       if (!sc->removable)
+       if (!lun->removable)
                return 0;
 
        /*
@@ -1619,12 +1640,12 @@ static int ub_bd_media_changed(struct gendisk *disk)
         * will fail, then block layer discards the data. Since we never
         * spin drives up, such devices simply cannot be used with ub anyway.
         */
-       if (ub_sync_tur(sc) != 0) {
-               sc->changed = 1;
+       if (ub_sync_tur(lun->udev, lun) != 0) {
+               lun->changed = 1;
                return 1;
        }
 
-       return sc->changed;
+       return lun->changed;
 }
 
 static struct block_device_operations ub_bd_fops = {
@@ -1648,7 +1669,7 @@ static void ub_probe_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 /*
  * Test if the device has a check condition on it, synchronously.
  */
-static int ub_sync_tur(struct ub_dev *sc)
+static int ub_sync_tur(struct ub_dev *sc, struct ub_lun *lun)
 {
        struct ub_scsi_cmd *cmd;
        enum { ALLOC_SIZE = sizeof(struct ub_scsi_cmd) };
@@ -1667,6 +1688,7 @@ static int ub_sync_tur(struct ub_dev *sc)
        cmd->cdb_len = 6;
        cmd->dir = UB_DIR_NONE;
        cmd->state = UB_CMDST_INIT;
+       cmd->lun = lun;                 /* This may be NULL, but that's ok */
        cmd->done = ub_probe_done;
        cmd->back = &compl;
 
@@ -1697,7 +1719,8 @@ err_alloc:
 /*
  * Read the SCSI capacity synchronously (for probing).
  */
-static int ub_sync_read_cap(struct ub_dev *sc, struct ub_capacity *ret)
+static int ub_sync_read_cap(struct ub_dev *sc, struct ub_lun *lun,
+    struct ub_capacity *ret)
 {
        struct ub_scsi_cmd *cmd;
        char *p;
@@ -1722,6 +1745,7 @@ static int ub_sync_read_cap(struct ub_dev *sc, struct ub_capacity *ret)
        cmd->state = UB_CMDST_INIT;
        cmd->data = p;
        cmd->len = 8;
+       cmd->lun = lun;
        cmd->done = ub_probe_done;
        cmd->back = &compl;
 
@@ -1790,6 +1814,90 @@ static void ub_probe_timeout(unsigned long arg)
        complete(cop);
 }
 
+/*
+ * Get number of LUNs by the way of Bulk GetMaxLUN command.
+ */
+static int ub_sync_getmaxlun(struct ub_dev *sc)
+{
+       int ifnum = sc->intf->cur_altsetting->desc.bInterfaceNumber;
+       unsigned char *p;
+       enum { ALLOC_SIZE = 1 };
+       struct usb_ctrlrequest *cr;
+       struct completion compl;
+       struct timer_list timer;
+       int nluns;
+       int rc;
+
+       init_completion(&compl);
+
+       rc = -ENOMEM;
+       if ((p = kmalloc(ALLOC_SIZE, GFP_KERNEL)) == NULL)
+               goto err_alloc;
+       *p = 55;
+
+       cr = &sc->work_cr;
+       cr->bRequestType = USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
+       cr->bRequest = US_BULK_GET_MAX_LUN;
+       cr->wValue = cpu_to_le16(0);
+       cr->wIndex = cpu_to_le16(ifnum);
+       cr->wLength = cpu_to_le16(1);
+
+       usb_fill_control_urb(&sc->work_urb, sc->dev, sc->recv_ctrl_pipe,
+           (unsigned char*) cr, p, 1, ub_probe_urb_complete, &compl);
+       sc->work_urb.transfer_flags = 0;
+       sc->work_urb.actual_length = 0;
+       sc->work_urb.error_count = 0;
+       sc->work_urb.status = 0;
+
+       if ((rc = usb_submit_urb(&sc->work_urb, GFP_KERNEL)) != 0) {
+               if (rc == -EPIPE) {
+                       printk("%s: Stall at GetMaxLUN, using 1 LUN\n",
+                            sc->name); /* P3 */
+               } else {
+                       printk(KERN_WARNING
+                            "%s: Unable to submit GetMaxLUN (%d)\n",
+                            sc->name, rc);
+               }
+               goto err_submit;
+       }
+
+       init_timer(&timer);
+       timer.function = ub_probe_timeout;
+       timer.data = (unsigned long) &compl;
+       timer.expires = jiffies + UB_CTRL_TIMEOUT;
+       add_timer(&timer);
+
+       wait_for_completion(&compl);
+
+       del_timer_sync(&timer);
+       usb_kill_urb(&sc->work_urb);
+
+       if (sc->work_urb.actual_length != 1) {
+               printk("%s: GetMaxLUN returned %d bytes\n", sc->name,
+                   sc->work_urb.actual_length); /* P3 */
+               nluns = 0;
+       } else {
+               if ((nluns = *p) == 55) {
+                       nluns = 0;
+               } else {
+                       /* GetMaxLUN returns the maximum LUN number */
+                       nluns += 1;
+                       if (nluns > UB_MAX_LUNS)
+                               nluns = UB_MAX_LUNS;
+               }
+               printk("%s: GetMaxLUN returned %d, using %d LUNs\n", sc->name,
+                   *p, nluns); /* P3 */
+       }
+
+       kfree(p);
+       return nluns;
+
+err_submit:
+       kfree(p);
+err_alloc:
+       return rc;
+}
+
 /*
  * Clear initial stalls.
  */
@@ -1876,8 +1984,8 @@ static int ub_get_pipes(struct ub_dev *sc, struct usb_device *dev,
        }
 
        if (ep_in == NULL || ep_out == NULL) {
-               printk(KERN_NOTICE "%s: device %u failed endpoint check\n",
-                   sc->name, sc->dev->devnum);
+               printk(KERN_NOTICE "%s: failed endpoint check\n",
+                   sc->name);
                return -EIO;
        }
 
@@ -1900,8 +2008,7 @@ static int ub_probe(struct usb_interface *intf,
     const struct usb_device_id *dev_id)
 {
        struct ub_dev *sc;
-       request_queue_t *q;
-       struct gendisk *disk;
+       int nluns;
        int rc;
        int i;
 
@@ -1910,6 +2017,7 @@ static int ub_probe(struct usb_interface *intf,
                goto err_core;
        memset(sc, 0, sizeof(struct ub_dev));
        spin_lock_init(&sc->lock);
+       INIT_LIST_HEAD(&sc->luns);
        usb_init_urb(&sc->work_urb);
        tasklet_init(&sc->tasklet, ub_scsi_action, (unsigned long)sc);
        atomic_set(&sc->poison, 0);
@@ -1921,19 +2029,16 @@ static int ub_probe(struct usb_interface *intf,
        ub_init_completion(&sc->work_done);
        sc->work_done.done = 1;         /* A little yuk, but oh well... */
 
-       rc = -ENOSR;
-       if ((sc->id = ub_id_get()) == -1)
-               goto err_id;
-       snprintf(sc->name, 8, DRV_NAME "%c", sc->id + 'a');
-
        sc->dev = interface_to_usbdev(intf);
        sc->intf = intf;
        // sc->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
-
        usb_set_intfdata(intf, sc);
        usb_get_dev(sc->dev);
        // usb_get_intf(sc->intf);      /* Do we need this? */
 
+       snprintf(sc->name, 12, DRV_NAME "(%d.%d)",
+           sc->dev->bus->busnum, sc->dev->devnum);
+
        /* XXX Verify that we can handle the device (from descriptors) */
 
        ub_get_pipes(sc, sc->dev, intf);
@@ -1971,35 +2076,88 @@ static int ub_probe(struct usb_interface *intf,
         * In any case it's not our business how revaliadation is implemented.
         */
        for (i = 0; i < 3; i++) {       /* Retries for benh's key */
-               if ((rc = ub_sync_tur(sc)) <= 0) break;
+               if ((rc = ub_sync_tur(sc, NULL)) <= 0) break;
                if (rc != 0x6) break;
                msleep(10);
        }
 
-       sc->removable = 1;              /* XXX Query this from the device */
-       sc->changed = 1;                /* ub_revalidate clears only */
-       sc->first_open = 1;
+       nluns = 1;
+       for (i = 0; i < 3; i++) {
+               if ((rc = ub_sync_getmaxlun(sc)) < 0) {
+                       /* 
+                        * Some devices (i.e. Iomega Zip100) need this --
+                        * apparently the bulk pipes get STALLed when the
+                        * GetMaxLUN request is processed.
+                        * XXX I have a ZIP-100, verify it does this.
+                        */
+                       if (rc == -EPIPE) {
+                               ub_probe_clear_stall(sc, sc->recv_bulk_pipe);
+                               ub_probe_clear_stall(sc, sc->send_bulk_pipe);
+                       }
+                       break;
+               }
+               if (rc != 0) {
+                       nluns = rc;
+                       break;
+               }
+               msleep(100);
+       }
 
-       ub_revalidate(sc);
-       /* This is pretty much a long term P3 */
-       printk(KERN_INFO "%s: device %u capacity nsec %ld bsize %u\n",
-           sc->name, sc->dev->devnum, sc->capacity.nsec, sc->capacity.bsize);
+       for (i = 0; i < nluns; i++) {
+               ub_probe_lun(sc, i);
+       }
+       return 0;
+
+       /* device_remove_file(&sc->intf->dev, &dev_attr_diag); */
+err_diag:
+       usb_set_intfdata(intf, NULL);
+       // usb_put_intf(sc->intf);
+       usb_put_dev(sc->dev);
+       kfree(sc);
+err_core:
+       return rc;
+}
+
+static int ub_probe_lun(struct ub_dev *sc, int lnum)
+{
+       struct ub_lun *lun;
+       request_queue_t *q;
+       struct gendisk *disk;
+       int rc;
+
+       rc = -ENOMEM;
+       if ((lun = kmalloc(sizeof(struct ub_lun), GFP_KERNEL)) == NULL)
+               goto err_alloc;
+       memset(lun, 0, sizeof(struct ub_lun));
+       lun->num = lnum;
+
+       rc = -ENOSR;
+       if ((lun->id = ub_id_get()) == -1)
+               goto err_id;
+
+       lun->udev = sc;
+       list_add(&lun->link, &sc->luns);
+
+       snprintf(lun->name, 16, DRV_NAME "%c(%d.%d.%d)",
+           lun->id + 'a', sc->dev->bus->busnum, sc->dev->devnum, lun->num);
+
+       lun->removable = 1;             /* XXX Query this from the device */
+       lun->changed = 1;               /* ub_revalidate clears only */
+       lun->first_open = 1;
+       ub_revalidate(sc, lun);
 
-       /*
-        * Just one disk per sc currently, but maybe more.
-        */
        rc = -ENOMEM;
        if ((disk = alloc_disk(UB_MINORS_PER_MAJOR)) == NULL)
                goto err_diskalloc;
 
-       sc->disk = disk;
-       sprintf(disk->disk_name, DRV_NAME "%c", sc->id + 'a');
-       sprintf(disk->devfs_name, DEVFS_NAME "/%c", sc->id + 'a');
+       lun->disk = disk;
+       sprintf(disk->disk_name, DRV_NAME "%c", lun->id + 'a');
+       sprintf(disk->devfs_name, DEVFS_NAME "/%c", lun->id + 'a');
        disk->major = UB_MAJOR;
-       disk->first_minor = sc->id * UB_MINORS_PER_MAJOR;
+       disk->first_minor = lun->id * UB_MINORS_PER_MAJOR;
        disk->fops = &ub_bd_fops;
-       disk->private_data = sc;
-       disk->driverfs_dev = &intf->dev;
+       disk->private_data = lun;
+       disk->driverfs_dev = &sc->intf->dev;    /* XXX Many to one ok? */
 
        rc = -ENOMEM;
        if ((q = blk_init_queue(ub_bd_rq_fn, &sc->lock)) == NULL)
@@ -2007,28 +2165,17 @@ static int ub_probe(struct usb_interface *intf,
 
        disk->queue = q;
 
-        // blk_queue_bounce_limit(q, hba[i]->pdev->dma_mask);
+       blk_queue_bounce_limit(q, BLK_BOUNCE_HIGH);
        blk_queue_max_hw_segments(q, UB_MAX_REQ_SG);
        blk_queue_max_phys_segments(q, UB_MAX_REQ_SG);
-       // blk_queue_segment_boundary(q, CARM_SG_BOUNDARY);
+       blk_queue_segment_boundary(q, 0xffffffff);      /* Dubious. */
        blk_queue_max_sectors(q, UB_MAX_SECTORS);
-       blk_queue_hardsect_size(q, sc->capacity.bsize);
-
-       /*
-        * This is a serious infraction, caused by a deficiency in the
-        * USB sg interface (usb_sg_wait()). We plan to remove this once
-        * we get mileage on the driver and can justify a change to USB API.
-        * See blk_queue_bounce_limit() to understand this part.
-        *
-        * XXX And I still need to be aware of the DMA mask in the HC.
-        */
-       q->bounce_pfn = blk_max_low_pfn;
-       q->bounce_gfp = GFP_NOIO;
+       blk_queue_hardsect_size(q, lun->capacity.bsize);
 
-       q->queuedata = sc;
+       q->queuedata = lun;
 
-       set_capacity(disk, sc->capacity.nsec);
-       if (sc->removable)
+       set_capacity(disk, lun->capacity.nsec);
+       if (lun->removable)
                disk->flags |= GENHD_FL_REMOVABLE;
 
        add_disk(disk);
@@ -2038,27 +2185,31 @@ static int ub_probe(struct usb_interface *intf,
 err_blkqinit:
        put_disk(disk);
 err_diskalloc:
-       device_remove_file(&sc->intf->dev, &dev_attr_diag);
-err_diag:
-       usb_set_intfdata(intf, NULL);
-       // usb_put_intf(sc->intf);
-       usb_put_dev(sc->dev);
-       spin_lock_irq(&ub_lock);
-       ub_id_put(sc->id);
-       spin_unlock_irq(&ub_lock);
+       list_del(&lun->link);
+       ub_id_put(lun->id);
 err_id:
-       kfree(sc);
-err_core:
+       kfree(lun);
+err_alloc:
        return rc;
 }
 
 static void ub_disconnect(struct usb_interface *intf)
 {
        struct ub_dev *sc = usb_get_intfdata(intf);
-       struct gendisk *disk = sc->disk;
-       request_queue_t *q = disk->queue;
+       struct list_head *p;
+       struct ub_lun *lun;
+       struct gendisk *disk;
        unsigned long flags;
 
+       /*
+        * Prevent ub_bd_release from pulling the rug from under us.
+        * XXX This is starting to look like a kref.
+        * XXX Why not to take this ref at probe time?
+        */
+       spin_lock_irqsave(&ub_lock, flags);
+       sc->openc++;
+       spin_unlock_irqrestore(&ub_lock, flags);
+
        /*
         * Fence stall clearnings, operations triggered by unlinkings and so on.
         * We do not attempt to unlink any URBs, because we do not trust the
@@ -2095,17 +2246,22 @@ static void ub_disconnect(struct usb_interface *intf)
        spin_unlock_irqrestore(&sc->lock, flags);
 
        /*
-        * Unregister the upper layer, this waits for all commands to end.
+        * Unregister the upper layer.
         */
-       if (disk->flags & GENHD_FL_UP)
-               del_gendisk(disk);
-       if (q)
-               blk_cleanup_queue(q);
+       list_for_each (p, &sc->luns) {
+               lun = list_entry(p, struct ub_lun, link);
+               disk = lun->disk;
+               if (disk->flags & GENHD_FL_UP)
+                       del_gendisk(disk);
+               /*
+                * I wish I could do:
+                *    set_bit(QUEUE_FLAG_DEAD, &q->queue_flags);
+                * As it is, we rely on our internal poisoning and let
+                * the upper levels to spin furiously failing all the I/O.
+                */
+       }
 
        /*
-        * We really expect blk_cleanup_queue() to wait, so no amount
-        * of paranoya is too much.
-        *
         * Taking a lock on a structure which is about to be freed
         * is very nonsensual. Here it is largely a way to do a debug freeze,
         * and a bracket which shows where the nonsensual code segment ends.
@@ -2139,13 +2295,10 @@ static void ub_disconnect(struct usb_interface *intf)
        usb_put_dev(sc->dev);
        sc->dev = NULL;
 
-       spin_lock_irqsave(&ub_lock, flags);
-       if (sc->openc == 0)
-               ub_cleanup(sc);
-       spin_unlock_irqrestore(&ub_lock, flags);
+       ub_put(sc);
 }
 
-struct usb_driver ub_driver = {
+static struct usb_driver ub_driver = {
        .owner =        THIS_MODULE,
        .name =         "ub",
        .probe =        ub_probe,
@@ -2157,8 +2310,8 @@ static int __init ub_init(void)
 {
        int rc;
 
-       /* P3 */ printk("ub: sizeof ub_scsi_cmd %zu ub_dev %zu\n",
-                       sizeof(struct ub_scsi_cmd), sizeof(struct ub_dev));
+       /* P3 */ printk("ub: sizeof ub_scsi_cmd %zu ub_dev %zu ub_lun %zu\n",
+                       sizeof(struct ub_scsi_cmd), sizeof(struct ub_dev), sizeof(struct ub_lun));
 
        if ((rc = register_blkdev(UB_MAJOR, DRV_NAME)) != 0)
                goto err_regblkdev;