[kernel] r16025 - in dists/sid/linux-2.6/debian: . patches/bugfix/all/stable patches/bugfix/x86 patches/features/all/vserver patches/series
Ben Hutchings
benh at alioth.debian.org
Fri Jul 30 19:02:14 UTC 2010
Author: benh
Date: Fri Jul 30 19:01:59 2010
New Revision: 16025
Log:
Add stable 2.6.32.17-rc1 and 2.6.33.7-rc1
Remove patches included in these.
Update context in vs2.3.0.36.27.patch.
Added:
dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.32.17-rc1.patch
dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.33.7-rc1.patch
Deleted:
dists/sid/linux-2.6/debian/patches/bugfix/x86/drm-i915-Define-MI_ARB_STATE-bits.patch
dists/sid/linux-2.6/debian/patches/bugfix/x86/drm-i915-enable-low-power-render-writes-on-GEN3-hard.patch
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/features/all/vserver/vs2.3.0.36.27.patch
dists/sid/linux-2.6/debian/patches/series/19
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog Fri Jul 30 14:43:39 2010 (r16024)
+++ dists/sid/linux-2.6/debian/changelog Fri Jul 30 19:01:59 2010 (r16025)
@@ -6,14 +6,16 @@
[ Ben Hutchings ]
* linux-base: Remove dependency on libapt-pkg-perl (Closes: #589996)
- * drm/i915: Enable low-power render writes on GEN3 hardware (915, 945,
- G33 and Atom "Pineview") (Closes: #590193, maybe others)
* pata_pdc202xx_old: Fix UDMA mode for PDC2024x and PDC2026x controllers
(Closes: #590532)
* Update Czech debconf templates, thanks to Michal Simunek
(Closes: #590546)
* Update Portugese debconf templates, thanks to Américo Monteiro
(Closes: #590557)
+ * Add stable 2.6.32.17-rc1
+ * Add drm changes from stable 2.6.33.7-rc1:
+ - drm/i915: Enable low-power render writes on GEN3 hardware (915, 945,
+ G33 and Atom "Pineview") (Closes: #590193, maybe others)
[ dann frazier ]
* [ia64] Fix crash when gcore reads gate area (Closes: #588574)
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.32.17-rc1.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.32.17-rc1.patch Fri Jul 30 19:01:59 2010 (r16025)
@@ -0,0 +1,7003 @@
+diff --git a/arch/arm/kernel/kprobes-decode.c b/arch/arm/kernel/kprobes-decode.c
+index da1f949..8bccbfa 100644
+--- a/arch/arm/kernel/kprobes-decode.c
++++ b/arch/arm/kernel/kprobes-decode.c
+@@ -583,13 +583,14 @@ static void __kprobes emulate_ldr(struct kprobe *p, struct pt_regs *regs)
+ {
+ insn_llret_3arg_fn_t *i_fn = (insn_llret_3arg_fn_t *)&p->ainsn.insn[0];
+ kprobe_opcode_t insn = p->opcode;
++ long ppc = (long)p->addr + 8;
+ union reg_pair fnr;
+ int rd = (insn >> 12) & 0xf;
+ int rn = (insn >> 16) & 0xf;
+ int rm = insn & 0xf;
+ long rdv;
+- long rnv = regs->uregs[rn];
+- long rmv = regs->uregs[rm]; /* rm/rmv may be invalid, don't care. */
++ long rnv = (rn == 15) ? ppc : regs->uregs[rn];
++ long rmv = (rm == 15) ? ppc : regs->uregs[rm];
+ long cpsr = regs->ARM_cpsr;
+
+ fnr.dr = insnslot_llret_3arg_rflags(rnv, 0, rmv, cpsr, i_fn);
+diff --git a/arch/arm/mach-omap2/board-rx51-peripherals.c b/arch/arm/mach-omap2/board-rx51-peripherals.c
+index e34d96a..6879cfe 100644
+--- a/arch/arm/mach-omap2/board-rx51-peripherals.c
++++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
+@@ -37,6 +37,10 @@
+ #define SYSTEM_REV_S_USES_VAUX3 0x8
+
+ static int board_keymap[] = {
++ /*
++ * Note that KEY(x, 8, KEY_XXX) entries represent "entrire row
++ * connected to the ground" matrix state.
++ */
+ KEY(0, 0, KEY_Q),
+ KEY(0, 1, KEY_O),
+ KEY(0, 2, KEY_P),
+@@ -44,6 +48,7 @@ static int board_keymap[] = {
+ KEY(0, 4, KEY_BACKSPACE),
+ KEY(0, 6, KEY_A),
+ KEY(0, 7, KEY_S),
++
+ KEY(1, 0, KEY_W),
+ KEY(1, 1, KEY_D),
+ KEY(1, 2, KEY_F),
+@@ -52,6 +57,7 @@ static int board_keymap[] = {
+ KEY(1, 5, KEY_J),
+ KEY(1, 6, KEY_K),
+ KEY(1, 7, KEY_L),
++
+ KEY(2, 0, KEY_E),
+ KEY(2, 1, KEY_DOT),
+ KEY(2, 2, KEY_UP),
+@@ -59,6 +65,8 @@ static int board_keymap[] = {
+ KEY(2, 5, KEY_Z),
+ KEY(2, 6, KEY_X),
+ KEY(2, 7, KEY_C),
++ KEY(2, 8, KEY_F9),
++
+ KEY(3, 0, KEY_R),
+ KEY(3, 1, KEY_V),
+ KEY(3, 2, KEY_B),
+@@ -67,20 +75,23 @@ static int board_keymap[] = {
+ KEY(3, 5, KEY_SPACE),
+ KEY(3, 6, KEY_SPACE),
+ KEY(3, 7, KEY_LEFT),
++
+ KEY(4, 0, KEY_T),
+ KEY(4, 1, KEY_DOWN),
+ KEY(4, 2, KEY_RIGHT),
+ KEY(4, 4, KEY_LEFTCTRL),
+ KEY(4, 5, KEY_RIGHTALT),
+ KEY(4, 6, KEY_LEFTSHIFT),
++ KEY(4, 8, KEY_F10),
++
+ KEY(5, 0, KEY_Y),
++ KEY(5, 8, KEY_F11),
++
+ KEY(6, 0, KEY_U),
++
+ KEY(7, 0, KEY_I),
+ KEY(7, 1, KEY_F7),
+ KEY(7, 2, KEY_F8),
+- KEY(0xff, 2, KEY_F9),
+- KEY(0xff, 4, KEY_F10),
+- KEY(0xff, 5, KEY_F11),
+ };
+
+ static struct matrix_keymap_data board_map_data = {
+diff --git a/arch/arm/mach-realview/Kconfig b/arch/arm/mach-realview/Kconfig
+index c48e1f2..6727c78 100644
+--- a/arch/arm/mach-realview/Kconfig
++++ b/arch/arm/mach-realview/Kconfig
+@@ -18,6 +18,7 @@ config REALVIEW_EB_ARM11MP
+ bool "Support ARM11MPCore tile"
+ depends on MACH_REALVIEW_EB
+ select CPU_V6
++ select ARCH_HAS_BARRIERS if SMP
+ help
+ Enable support for the ARM11MPCore tile on the Realview platform.
+
+@@ -35,6 +36,7 @@ config MACH_REALVIEW_PB11MP
+ select CPU_V6
+ select ARM_GIC
+ select HAVE_PATA_PLATFORM
++ select ARCH_HAS_BARRIERS if SMP
+ help
+ Include support for the ARM(R) RealView MPCore Platform Baseboard.
+ PB11MPCore is a platform with an on-board ARM11MPCore and has
+diff --git a/arch/arm/mach-realview/include/mach/barriers.h b/arch/arm/mach-realview/include/mach/barriers.h
+new file mode 100644
+index 0000000..0c5d749
+--- /dev/null
++++ b/arch/arm/mach-realview/include/mach/barriers.h
+@@ -0,0 +1,8 @@
++/*
++ * Barriers redefined for RealView ARM11MPCore platforms with L220 cache
++ * controller to work around hardware errata causing the outer_sync()
++ * operation to deadlock the system.
++ */
++#define mb() dsb()
++#define rmb() dmb()
++#define wmb() mb()
+diff --git a/arch/ia64/mm/tlb.c b/arch/ia64/mm/tlb.c
+index ee09d26..e2cde52 100644
+--- a/arch/ia64/mm/tlb.c
++++ b/arch/ia64/mm/tlb.c
+@@ -120,7 +120,7 @@ static inline void down_spin(struct spinaphore *ss)
+ ia64_invala();
+
+ for (;;) {
+- asm volatile ("ld4.c.nc %0=[%1]" : "=r"(serve) : "r"(&ss->serve) : "memory");
++ asm volatile ("ld8.c.nc %0=[%1]" : "=r"(serve) : "r"(&ss->serve) : "memory");
+ if (time_before(t, serve))
+ return;
+ cpu_relax();
+diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
+index a581d60..608dc97 100644
+--- a/arch/mips/include/asm/mipsregs.h
++++ b/arch/mips/include/asm/mipsregs.h
+@@ -135,6 +135,12 @@
+ #define FPU_CSR_COND7 0x80000000 /* $fcc7 */
+
+ /*
++ * Bits 18 - 20 of the FPU Status Register will be read as 0,
++ * and should be written as zero.
++ */
++#define FPU_CSR_RSVD 0x001c0000
++
++/*
+ * X the exception cause indicator
+ * E the exception enable
+ * S the sticky/flag bit
+@@ -161,7 +167,8 @@
+ #define FPU_CSR_UDF_S 0x00000008
+ #define FPU_CSR_INE_S 0x00000004
+
+-/* rounding mode */
++/* Bits 0 and 1 of FPU Status Register specify the rounding mode */
++#define FPU_CSR_RM 0x00000003
+ #define FPU_CSR_RN 0x0 /* nearest */
+ #define FPU_CSR_RZ 0x1 /* towards zero */
+ #define FPU_CSR_RU 0x2 /* towards +Infinity */
+diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
+index 454b539..c15d94b 100644
+--- a/arch/mips/math-emu/cp1emu.c
++++ b/arch/mips/math-emu/cp1emu.c
+@@ -75,6 +75,9 @@ struct mips_fpu_emulator_stats fpuemustats;
+ #define FPCREG_RID 0 /* $0 = revision id */
+ #define FPCREG_CSR 31 /* $31 = csr */
+
++/* Determine rounding mode from the RM bits of the FCSR */
++#define modeindex(v) ((v) & FPU_CSR_RM)
++
+ /* Convert Mips rounding mode (0..3) to IEEE library modes. */
+ static const unsigned char ieee_rm[4] = {
+ [FPU_CSR_RN] = IEEE754_RN,
+@@ -381,10 +384,14 @@ static int cop1Emulate(struct pt_regs *xcp, struct mips_fpu_struct *ctx)
+ (void *) (xcp->cp0_epc),
+ MIPSInst_RT(ir), value);
+ #endif
+- value &= (FPU_CSR_FLUSH | FPU_CSR_ALL_E | FPU_CSR_ALL_S | 0x03);
+- ctx->fcr31 &= ~(FPU_CSR_FLUSH | FPU_CSR_ALL_E | FPU_CSR_ALL_S | 0x03);
+- /* convert to ieee library modes */
+- ctx->fcr31 |= (value & ~0x3) | ieee_rm[value & 0x3];
++
++ /*
++ * Don't write reserved bits,
++ * and convert to ieee library modes
++ */
++ ctx->fcr31 = (value &
++ ~(FPU_CSR_RSVD | FPU_CSR_RM)) |
++ ieee_rm[modeindex(value)];
+ }
+ if ((ctx->fcr31 >> 5) & ctx->fcr31 & FPU_CSR_ALL_E) {
+ return SIGFPE;
+diff --git a/arch/sparc/include/asm/stat.h b/arch/sparc/include/asm/stat.h
+index 39327d6..a232e9e 100644
+--- a/arch/sparc/include/asm/stat.h
++++ b/arch/sparc/include/asm/stat.h
+@@ -53,8 +53,8 @@ struct stat {
+ ino_t st_ino;
+ mode_t st_mode;
+ short st_nlink;
+- uid16_t st_uid;
+- gid16_t st_gid;
++ unsigned short st_uid;
++ unsigned short st_gid;
+ unsigned short st_rdev;
+ off_t st_size;
+ time_t st_atime;
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index a7881c7..a7e502f 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -106,6 +106,7 @@
+ #define MSR_AMD64_PATCH_LOADER 0xc0010020
+ #define MSR_AMD64_OSVW_ID_LENGTH 0xc0010140
+ #define MSR_AMD64_OSVW_STATUS 0xc0010141
++#define MSR_AMD64_DC_CFG 0xc0011022
+ #define MSR_AMD64_IBSFETCHCTL 0xc0011030
+ #define MSR_AMD64_IBSFETCHLINAD 0xc0011031
+ #define MSR_AMD64_IBSFETCHPHYSAD 0xc0011032
+diff --git a/arch/x86/include/asm/suspend_32.h b/arch/x86/include/asm/suspend_32.h
+index 48dcfa6..fd921c3 100644
+--- a/arch/x86/include/asm/suspend_32.h
++++ b/arch/x86/include/asm/suspend_32.h
+@@ -15,6 +15,8 @@ static inline int arch_prepare_suspend(void) { return 0; }
+ struct saved_context {
+ u16 es, fs, gs, ss;
+ unsigned long cr0, cr2, cr3, cr4;
++ u64 misc_enable;
++ bool misc_enable_saved;
+ struct desc_ptr gdt;
+ struct desc_ptr idt;
+ u16 ldt;
+diff --git a/arch/x86/include/asm/suspend_64.h b/arch/x86/include/asm/suspend_64.h
+index 06284f4..8d942af 100644
+--- a/arch/x86/include/asm/suspend_64.h
++++ b/arch/x86/include/asm/suspend_64.h
+@@ -27,6 +27,8 @@ struct saved_context {
+ u16 ds, es, fs, gs, ss;
+ unsigned long gs_base, gs_kernel_base, fs_base;
+ unsigned long cr0, cr2, cr3, cr4, cr8;
++ u64 misc_enable;
++ bool misc_enable_saved;
+ unsigned long efer;
+ u16 gdt_pad;
+ u16 gdt_limit;
+diff --git a/arch/x86/include/asm/system.h b/arch/x86/include/asm/system.h
+index f08f973..e0fbf29 100644
+--- a/arch/x86/include/asm/system.h
++++ b/arch/x86/include/asm/system.h
+@@ -449,7 +449,7 @@ void stop_this_cpu(void *dummy);
+ *
+ * (Could use an alternative three way for this if there was one.)
+ */
+-static inline void rdtsc_barrier(void)
++static __always_inline void rdtsc_barrier(void)
+ {
+ alternative(ASM_NOP3, "mfence", X86_FEATURE_MFENCE_RDTSC);
+ alternative(ASM_NOP3, "lfence", X86_FEATURE_LFENCE_RDTSC);
+diff --git a/arch/x86/kernel/acpi/cstate.c b/arch/x86/kernel/acpi/cstate.c
+index 2e837f5..fb7a5f0 100644
+--- a/arch/x86/kernel/acpi/cstate.c
++++ b/arch/x86/kernel/acpi/cstate.c
+@@ -145,6 +145,15 @@ int acpi_processor_ffh_cstate_probe(unsigned int cpu,
+ percpu_entry->states[cx->index].eax = cx->address;
+ percpu_entry->states[cx->index].ecx = MWAIT_ECX_INTERRUPT_BREAK;
+ }
++
++ /*
++ * For _CST FFH on Intel, if GAS.access_size bit 1 is cleared,
++ * then we should skip checking BM_STS for this C-state.
++ * ref: "Intel Processor Vendor-Specific ACPI Interface Specification"
++ */
++ if ((c->x86_vendor == X86_VENDOR_INTEL) && !(reg->access_size & 0x2))
++ cx->bm_sts_skip = 1;
++
+ return retval;
+ }
+ EXPORT_SYMBOL_GPL(acpi_processor_ffh_cstate_probe);
+diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
+index 8b85734..ca93638 100644
+--- a/arch/x86/kernel/acpi/sleep.c
++++ b/arch/x86/kernel/acpi/sleep.c
+@@ -162,8 +162,6 @@ static int __init acpi_sleep_setup(char *str)
+ #endif
+ if (strncmp(str, "old_ordering", 12) == 0)
+ acpi_old_suspend_ordering();
+- if (strncmp(str, "sci_force_enable", 16) == 0)
+- acpi_set_sci_en_on_resume();
+ str = strchr(str, ',');
+ if (str != NULL)
+ str += strspn(str, ", \t");
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 168e172..bc9cd5a 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -941,7 +941,7 @@ void disable_local_APIC(void)
+ unsigned int value;
+
+ /* APIC hasn't been mapped yet */
+- if (!apic_phys)
++ if (!x2apic_mode && !apic_phys)
+ return;
+
+ clear_local_APIC();
+diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
+index 74f5a3f..19528ef 100644
+--- a/arch/x86/kernel/hpet.c
++++ b/arch/x86/kernel/hpet.c
+@@ -949,7 +949,7 @@ fs_initcall(hpet_late_init);
+
+ void hpet_disable(void)
+ {
+- if (is_hpet_capable()) {
++ if (is_hpet_capable() && hpet_virt_address) {
+ unsigned long cfg = hpet_readl(HPET_CFG);
+
+ if (hpet_legacy_int_enabled) {
+diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
+index e6ec8a2..1a2d4b1 100644
+--- a/arch/x86/kernel/pci-calgary_64.c
++++ b/arch/x86/kernel/pci-calgary_64.c
+@@ -102,11 +102,16 @@ int use_calgary __read_mostly = 0;
+ #define PMR_SOFTSTOPFAULT 0x40000000
+ #define PMR_HARDSTOP 0x20000000
+
+-#define MAX_NUM_OF_PHBS 8 /* how many PHBs in total? */
+-#define MAX_NUM_CHASSIS 8 /* max number of chassis */
+-/* MAX_PHB_BUS_NUM is the maximal possible dev->bus->number */
+-#define MAX_PHB_BUS_NUM (MAX_NUM_OF_PHBS * MAX_NUM_CHASSIS * 2)
+-#define PHBS_PER_CALGARY 4
++/*
++ * The maximum PHB bus number.
++ * x3950M2 (rare): 8 chassis, 48 PHBs per chassis = 384
++ * x3950M2: 4 chassis, 48 PHBs per chassis = 192
++ * x3950 (PCIE): 8 chassis, 32 PHBs per chassis = 256
++ * x3950 (PCIX): 8 chassis, 16 PHBs per chassis = 128
++ */
++#define MAX_PHB_BUS_NUM 256
++
++#define PHBS_PER_CALGARY 4
+
+ /* register offsets in Calgary's internal register space */
+ static const unsigned long tar_offsets[] = {
+@@ -1053,8 +1058,6 @@ static int __init calgary_init_one(struct pci_dev *dev)
+ struct iommu_table *tbl;
+ int ret;
+
+- BUG_ON(dev->bus->number >= MAX_PHB_BUS_NUM);
+-
+ bbar = busno_to_bbar(dev->bus->number);
+ ret = calgary_setup_tar(dev, bbar);
+ if (ret)
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index a265626..fdf2e28 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -1843,6 +1843,9 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
+
+ spte |= PT_WRITABLE_MASK;
+
++ if (!tdp_enabled && !(pte_access & ACC_WRITE_MASK))
++ spte &= ~PT_USER_MASK;
++
+ /*
+ * Optimization: for pte sync, if spte was writable the hash
+ * lookup is unnecessary (and expensive). Write protection
+@@ -1898,6 +1901,8 @@ static void mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
+
+ child = page_header(pte & PT64_BASE_ADDR_MASK);
+ mmu_page_remove_parent_pte(child, sptep);
++ __set_spte(sptep, shadow_trap_nonpresent_pte);
++ kvm_flush_remote_tlbs(vcpu->kvm);
+ } else if (pfn != spte_to_pfn(*sptep)) {
+ pgprintk("hfn old %lx new %lx\n",
+ spte_to_pfn(*sptep), pfn);
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 8e65552..61ba669 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -27,6 +27,7 @@
+ #include <linux/sched.h>
+ #include <linux/ftrace_event.h>
+
++#include <asm/tlbflush.h>
+ #include <asm/desc.h>
+
+ #include <asm/virtext.h>
+@@ -62,6 +63,8 @@ MODULE_LICENSE("GPL");
+ #define nsvm_printk(fmt, args...) do {} while(0)
+ #endif
+
++static bool erratum_383_found __read_mostly;
++
+ static const u32 host_save_user_msrs[] = {
+ #ifdef CONFIG_X86_64
+ MSR_STAR, MSR_LSTAR, MSR_CSTAR, MSR_SYSCALL_MASK, MSR_KERNEL_GS_BASE,
+@@ -299,6 +302,31 @@ static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
+ svm_set_interrupt_shadow(vcpu, 0);
+ }
+
++static void svm_init_erratum_383(void)
++{
++ u32 low, high;
++ int err;
++ u64 val;
++
++ /* Only Fam10h is affected */
++ if (boot_cpu_data.x86 != 0x10)
++ return;
++
++ /* Use _safe variants to not break nested virtualization */
++ val = native_read_msr_safe(MSR_AMD64_DC_CFG, &err);
++ if (err)
++ return;
++
++ val |= (1ULL << 47);
++
++ low = lower_32_bits(val);
++ high = upper_32_bits(val);
++
++ native_write_msr_safe(MSR_AMD64_DC_CFG, low, high);
++
++ erratum_383_found = true;
++}
++
+ static int has_svm(void)
+ {
+ const char *msg;
+@@ -318,7 +346,6 @@ static void svm_hardware_disable(void *garbage)
+
+ static void svm_hardware_enable(void *garbage)
+ {
+-
+ struct svm_cpu_data *svm_data;
+ uint64_t efer;
+ struct descriptor_table gdt_descr;
+@@ -350,6 +377,10 @@ static void svm_hardware_enable(void *garbage)
+
+ wrmsrl(MSR_VM_HSAVE_PA,
+ page_to_pfn(svm_data->save_area) << PAGE_SHIFT);
++
++ svm_init_erratum_383();
++
++ return;
+ }
+
+ static void svm_cpu_uninit(int cpu)
+@@ -1257,8 +1288,59 @@ static int nm_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
+ return 1;
+ }
+
+-static int mc_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
++static bool is_erratum_383(void)
+ {
++ int err, i;
++ u64 value;
++
++ if (!erratum_383_found)
++ return false;
++
++ value = native_read_msr_safe(MSR_IA32_MC0_STATUS, &err);
++ if (err)
++ return false;
++
++ /* Bit 62 may or may not be set for this mce */
++ value &= ~(1ULL << 62);
++
++ if (value != 0xb600000000010015ULL)
++ return false;
++
++ /* Clear MCi_STATUS registers */
++ for (i = 0; i < 6; ++i)
++ native_write_msr_safe(MSR_IA32_MCx_STATUS(i), 0, 0);
++
++ value = native_read_msr_safe(MSR_IA32_MCG_STATUS, &err);
++ if (!err) {
++ u32 low, high;
++
++ value &= ~(1ULL << 2);
++ low = lower_32_bits(value);
++ high = upper_32_bits(value);
++
++ native_write_msr_safe(MSR_IA32_MCG_STATUS, low, high);
++ }
++
++ /* Flush tlb to evict multi-match entries */
++ __flush_tlb_all();
++
++ return true;
++}
++
++static void svm_handle_mce(struct vcpu_svm *svm)
++{
++ if (is_erratum_383()) {
++ /*
++ * Erratum 383 triggered. Guest state is corrupt so kill the
++ * guest.
++ */
++ pr_err("KVM: Guest triggered AMD Erratum 383\n");
++
++ set_bit(KVM_REQ_TRIPLE_FAULT, &svm->vcpu.requests);
++
++ return;
++ }
++
+ /*
+ * On an #MC intercept the MCE handler is not called automatically in
+ * the host. So do it by hand here.
+@@ -1267,6 +1349,11 @@ static int mc_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
+ "int $0x12\n");
+ /* not sure if we ever come back to this point */
+
++ return;
++}
++
++static int mc_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
++{
+ return 1;
+ }
+
+@@ -2717,6 +2804,14 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+ vcpu->arch.regs_avail &= ~(1 << VCPU_EXREG_PDPTR);
+ vcpu->arch.regs_dirty &= ~(1 << VCPU_EXREG_PDPTR);
+ }
++
++ /*
++ * We need to handle MC intercepts here before the vcpu has a chance to
++ * change the physical cpu
++ */
++ if (unlikely(svm->vmcb->control.exit_code ==
++ SVM_EXIT_EXCP_BASE + MC_VECTOR))
++ svm_handle_mce(svm);
+ }
+
+ #undef R
+diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
+index 8aa85f1..eeeb522 100644
+--- a/arch/x86/power/cpu.c
++++ b/arch/x86/power/cpu.c
+@@ -104,6 +104,8 @@ static void __save_processor_state(struct saved_context *ctxt)
+ ctxt->cr4 = read_cr4();
+ ctxt->cr8 = read_cr8();
+ #endif
++ ctxt->misc_enable_saved = !rdmsrl_safe(MSR_IA32_MISC_ENABLE,
++ &ctxt->misc_enable);
+ }
+
+ /* Needed by apm.c */
+@@ -176,6 +178,8 @@ static void fix_processor_context(void)
+ */
+ static void __restore_processor_state(struct saved_context *ctxt)
+ {
++ if (ctxt->misc_enable_saved)
++ wrmsrl(MSR_IA32_MISC_ENABLE, ctxt->misc_enable);
+ /*
+ * control registers
+ */
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index c8f0797..a6ad608 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -962,7 +962,7 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
+ if (acpi_idle_suspend)
+ return(acpi_idle_enter_c1(dev, state));
+
+- if (acpi_idle_bm_check()) {
++ if (!cx->bm_sts_skip && acpi_idle_bm_check()) {
+ if (dev->safe_state) {
+ dev->last_state = dev->safe_state;
+ return dev->safe_state->enter(dev, dev->safe_state);
+diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
+index 9ed9292..0458094 100644
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -80,22 +80,6 @@ static int acpi_sleep_prepare(u32 acpi_state)
+
+ #ifdef CONFIG_ACPI_SLEEP
+ static u32 acpi_target_sleep_state = ACPI_STATE_S0;
+-/*
+- * According to the ACPI specification the BIOS should make sure that ACPI is
+- * enabled and SCI_EN bit is set on wake-up from S1 - S3 sleep states. Still,
+- * some BIOSes don't do that and therefore we use acpi_enable() to enable ACPI
+- * on such systems during resume. Unfortunately that doesn't help in
+- * particularly pathological cases in which SCI_EN has to be set directly on
+- * resume, although the specification states very clearly that this flag is
+- * owned by the hardware. The set_sci_en_on_resume variable will be set in such
+- * cases.
+- */
+-static bool set_sci_en_on_resume;
+-
+-void __init acpi_set_sci_en_on_resume(void)
+-{
+- set_sci_en_on_resume = true;
+-}
+
+ /*
+ * ACPI 1.0 wants us to execute _PTS before suspending devices, so we allow the
+@@ -253,11 +237,8 @@ static int acpi_suspend_enter(suspend_state_t pm_state)
+ break;
+ }
+
+- /* If ACPI is not enabled by the BIOS, we need to enable it here. */
+- if (set_sci_en_on_resume)
+- acpi_write_bit_register(ACPI_BITREG_SCI_ENABLE, 1);
+- else
+- acpi_enable();
++ /* This violates the spec but is required for bug compatibility. */
++ acpi_write_bit_register(ACPI_BITREG_SCI_ENABLE, 1);
+
+ /* Reprogram control registers and execute _BFS */
+ acpi_leave_sleep_state_prep(acpi_state);
+@@ -346,12 +327,6 @@ static int __init init_old_suspend_ordering(const struct dmi_system_id *d)
+ return 0;
+ }
+
+-static int __init init_set_sci_en_on_resume(const struct dmi_system_id *d)
+-{
+- set_sci_en_on_resume = true;
+- return 0;
+-}
+-
+ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
+ {
+ .callback = init_old_suspend_ordering,
+@@ -370,22 +345,6 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
+ },
+ },
+ {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Apple MacBook 1,1",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Apple Computer, Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "MacBook1,1"),
+- },
+- },
+- {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Apple MacMini 1,1",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Apple Computer, Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Macmini1,1"),
+- },
+- },
+- {
+ .callback = init_old_suspend_ordering,
+ .ident = "Asus Pundit P1-AH2 (M2N8L motherboard)",
+ .matches = {
+@@ -394,94 +353,6 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
+ },
+ },
+ {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Toshiba Satellite L300",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Satellite L300"),
+- },
+- },
+- {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Hewlett-Packard HP G7000 Notebook PC",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "HP G7000 Notebook PC"),
+- },
+- },
+- {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Hewlett-Packard HP Pavilion dv3 Notebook PC",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv3 Notebook PC"),
+- },
+- },
+- {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Hewlett-Packard Pavilion dv4",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4"),
+- },
+- },
+- {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Hewlett-Packard Pavilion dv7",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv7"),
+- },
+- },
+- {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Hewlett-Packard Compaq Presario C700 Notebook PC",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Compaq Presario C700 Notebook PC"),
+- },
+- },
+- {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Hewlett-Packard Compaq Presario CQ40 Notebook PC",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Compaq Presario CQ40 Notebook PC"),
+- },
+- },
+- {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Lenovo ThinkPad T410",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
+- },
+- },
+- {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Lenovo ThinkPad T510",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
+- },
+- },
+- {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Lenovo ThinkPad W510",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
+- },
+- },
+- {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Lenovo ThinkPad X201[s]",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
+- },
+- },
+- {
+ .callback = init_old_suspend_ordering,
+ .ident = "Panasonic CF51-2L",
+ .matches = {
+@@ -490,30 +361,6 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "CF51-2L"),
+ },
+ },
+- {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Dell Studio 1558",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1558"),
+- },
+- },
+- {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Dell Studio 1557",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1557"),
+- },
+- },
+- {
+- .callback = init_set_sci_en_on_resume,
+- .ident = "Dell Studio 1555",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1555"),
+- },
+- },
+ {},
+ };
+ #endif /* CONFIG_SUSPEND */
+diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
+index 7376367..e0e6570 100644
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -125,6 +125,17 @@ static ssize_t firmware_loading_show(struct device *dev,
+ return sprintf(buf, "%d\n", loading);
+ }
+
++static void firmware_free_data(const struct firmware *fw)
++{
++ int i;
++ vunmap(fw->data);
++ if (fw->pages) {
++ for (i = 0; i < PFN_UP(fw->size); i++)
++ __free_page(fw->pages[i]);
++ kfree(fw->pages);
++ }
++}
++
+ /* Some architectures don't have PAGE_KERNEL_RO */
+ #ifndef PAGE_KERNEL_RO
+ #define PAGE_KERNEL_RO PAGE_KERNEL
+@@ -157,21 +168,21 @@ static ssize_t firmware_loading_store(struct device *dev,
+ mutex_unlock(&fw_lock);
+ break;
+ }
+- vfree(fw_priv->fw->data);
+- fw_priv->fw->data = NULL;
++ firmware_free_data(fw_priv->fw);
++ memset(fw_priv->fw, 0, sizeof(struct firmware));
++ /* If the pages are not owned by 'struct firmware' */
+ for (i = 0; i < fw_priv->nr_pages; i++)
+ __free_page(fw_priv->pages[i]);
+ kfree(fw_priv->pages);
+ fw_priv->pages = NULL;
+ fw_priv->page_array_size = 0;
+ fw_priv->nr_pages = 0;
+- fw_priv->fw->size = 0;
+ set_bit(FW_STATUS_LOADING, &fw_priv->status);
+ mutex_unlock(&fw_lock);
+ break;
+ case 0:
+ if (test_bit(FW_STATUS_LOADING, &fw_priv->status)) {
+- vfree(fw_priv->fw->data);
++ vunmap(fw_priv->fw->data);
+ fw_priv->fw->data = vmap(fw_priv->pages,
+ fw_priv->nr_pages,
+ 0, PAGE_KERNEL_RO);
+@@ -179,7 +190,10 @@ static ssize_t firmware_loading_store(struct device *dev,
+ dev_err(dev, "%s: vmap() failed\n", __func__);
+ goto err;
+ }
+- /* Pages will be freed by vfree() */
++ /* Pages are now owned by 'struct firmware' */
++ fw_priv->fw->pages = fw_priv->pages;
++ fw_priv->pages = NULL;
++
+ fw_priv->page_array_size = 0;
+ fw_priv->nr_pages = 0;
+ complete(&fw_priv->completion);
+@@ -572,7 +586,7 @@ release_firmware(const struct firmware *fw)
+ if (fw->data == builtin->data)
+ goto free_fw;
+ }
+- vfree(fw->data);
++ firmware_free_data(fw);
+ free_fw:
+ kfree(fw);
+ }
+diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
+index 2fb2e6c..c496c8a 100644
+--- a/drivers/char/agp/amd64-agp.c
++++ b/drivers/char/agp/amd64-agp.c
+@@ -499,6 +499,10 @@ static int __devinit agp_amd64_probe(struct pci_dev *pdev,
+ u8 cap_ptr;
+ int err;
+
++ /* The Highlander principle */
++ if (agp_bridges_found)
++ return -ENODEV;
++
+ cap_ptr = pci_find_capability(pdev, PCI_CAP_ID_AGP);
+ if (!cap_ptr)
+ return -ENODEV;
+@@ -562,6 +566,8 @@ static void __devexit agp_amd64_remove(struct pci_dev *pdev)
+ amd64_aperture_sizes[bridge->aperture_size_idx].size);
+ agp_remove_bridge(bridge);
+ agp_put_bridge(bridge);
++
++ agp_bridges_found--;
+ }
+
+ #ifdef CONFIG_PM
+@@ -709,6 +715,11 @@ static struct pci_device_id agp_amd64_pci_table[] = {
+
+ MODULE_DEVICE_TABLE(pci, agp_amd64_pci_table);
+
++static DEFINE_PCI_DEVICE_TABLE(agp_amd64_pci_promisc_table) = {
++ { PCI_DEVICE_CLASS(0, 0) },
++ { }
++};
++
+ static struct pci_driver agp_amd64_pci_driver = {
+ .name = "agpgart-amd64",
+ .id_table = agp_amd64_pci_table,
+@@ -733,7 +744,6 @@ int __init agp_amd64_init(void)
+ return err;
+
+ if (agp_bridges_found == 0) {
+- struct pci_dev *dev;
+ if (!agp_try_unsupported && !agp_try_unsupported_boot) {
+ printk(KERN_INFO PFX "No supported AGP bridge found.\n");
+ #ifdef MODULE
+@@ -749,17 +759,10 @@ int __init agp_amd64_init(void)
+ return -ENODEV;
+
+ /* Look for any AGP bridge */
+- dev = NULL;
+- err = -ENODEV;
+- for_each_pci_dev(dev) {
+- if (!pci_find_capability(dev, PCI_CAP_ID_AGP))
+- continue;
+- /* Only one bridge supported right now */
+- if (agp_amd64_probe(dev, NULL) == 0) {
+- err = 0;
+- break;
+- }
+- }
++ agp_amd64_pci_driver.id_table = agp_amd64_pci_promisc_table;
++ err = driver_attach(&agp_amd64_pci_driver.driver);
++ if (err == 0 && agp_bridges_found == 0)
++ err = -ENODEV;
+ }
+ return err;
+ }
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index 8e00b4d..792868d 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -224,6 +224,7 @@ struct tpm_readpubek_params_out {
+ u8 algorithm[4];
+ u8 encscheme[2];
+ u8 sigscheme[2];
++ __be32 paramsize;
+ u8 parameters[12]; /*assuming RSA*/
+ __be32 keysize;
+ u8 modulus[256];
+diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
+index 2405f17..ca15c04 100644
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -622,7 +622,14 @@ static int tpm_tis_pnp_suspend(struct pnp_dev *dev, pm_message_t msg)
+
+ static int tpm_tis_pnp_resume(struct pnp_dev *dev)
+ {
+- return tpm_pm_resume(&dev->dev);
++ struct tpm_chip *chip = pnp_get_drvdata(dev);
++ int ret;
++
++ ret = tpm_pm_resume(&dev->dev);
++ if (!ret)
++ tpm_continue_selftest(chip);
++
++ return ret;
+ }
+
+ static struct pnp_device_id tpm_pnp_tbl[] __devinitdata = {
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index ff57c40..c18e65e 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1741,17 +1741,8 @@ static int __cpufreq_set_policy(struct cpufreq_policy *data,
+ dprintk("governor switch\n");
+
+ /* end old governor */
+- if (data->governor) {
+- /*
+- * Need to release the rwsem around governor
+- * stop due to lock dependency between
+- * cancel_delayed_work_sync and the read lock
+- * taken in the delayed work handler.
+- */
+- unlock_policy_rwsem_write(data->cpu);
++ if (data->governor)
+ __cpufreq_governor(data, CPUFREQ_GOV_STOP);
+- lock_policy_rwsem_write(data->cpu);
+- }
+
+ /* start new governor */
+ data->governor = policy->governor;
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index 7f436ec..5449239 100644
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index df6f7c9..952c844 100644
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 73e7ec0..7214c85 100644
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index cce453e..88d5e3a 100644
+diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c
+index eb740fc..ccf42c3 100644
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index a4813c6..e5e22b1 100644
+diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+index 0038212..183bef8 100644
+diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
+index cb4290a..5852191 100644
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -53,6 +53,7 @@ struct coretemp_data {
+ struct mutex update_lock;
+ const char *name;
+ u32 id;
++ u16 core_id;
+ char valid; /* zero until following fields are valid */
+ unsigned long last_updated; /* in jiffies */
+ int temp;
+@@ -75,7 +76,7 @@ static ssize_t show_name(struct device *dev, struct device_attribute
+ if (attr->index == SHOW_NAME)
+ ret = sprintf(buf, "%s\n", data->name);
+ else /* show label */
+- ret = sprintf(buf, "Core %d\n", data->id);
++ ret = sprintf(buf, "Core %d\n", data->core_id);
+ return ret;
+ }
+
+@@ -255,6 +256,9 @@ static int __devinit coretemp_probe(struct platform_device *pdev)
+ }
+
+ data->id = pdev->id;
++#ifdef CONFIG_SMP
++ data->core_id = c->cpu_core_id;
++#endif
+ data->name = "coretemp";
+ mutex_init(&data->update_lock);
+
+@@ -352,6 +356,10 @@ struct pdev_entry {
+ struct list_head list;
+ struct platform_device *pdev;
+ unsigned int cpu;
++#ifdef CONFIG_SMP
++ u16 phys_proc_id;
++ u16 cpu_core_id;
++#endif
+ };
+
+ static LIST_HEAD(pdev_list);
+@@ -362,6 +370,22 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)
+ int err;
+ struct platform_device *pdev;
+ struct pdev_entry *pdev_entry;
++#ifdef CONFIG_SMP
++ struct cpuinfo_x86 *c = &cpu_data(cpu);
++#endif
++
++ mutex_lock(&pdev_list_mutex);
++
++#ifdef CONFIG_SMP
++ /* Skip second HT entry of each core */
++ list_for_each_entry(pdev_entry, &pdev_list, list) {
++ if (c->phys_proc_id == pdev_entry->phys_proc_id &&
++ c->cpu_core_id == pdev_entry->cpu_core_id) {
++ err = 0; /* Not an error */
++ goto exit;
++ }
++ }
++#endif
+
+ pdev = platform_device_alloc(DRVNAME, cpu);
+ if (!pdev) {
+@@ -385,7 +409,10 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)
+
+ pdev_entry->pdev = pdev;
+ pdev_entry->cpu = cpu;
+- mutex_lock(&pdev_list_mutex);
++#ifdef CONFIG_SMP
++ pdev_entry->phys_proc_id = c->phys_proc_id;
++ pdev_entry->cpu_core_id = c->cpu_core_id;
++#endif
+ list_add_tail(&pdev_entry->list, &pdev_list);
+ mutex_unlock(&pdev_list_mutex);
+
+@@ -396,6 +423,7 @@ exit_device_free:
+ exit_device_put:
+ platform_device_put(pdev);
+ exit:
++ mutex_unlock(&pdev_list_mutex);
+ return err;
+ }
+
+diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
+index a3749cb..497476f 100644
+--- a/drivers/hwmon/it87.c
++++ b/drivers/hwmon/it87.c
+@@ -80,6 +80,13 @@ superio_inb(int reg)
+ return inb(VAL);
+ }
+
++static inline void
++superio_outb(int reg, int val)
++{
++ outb(reg, REG);
++ outb(val, VAL);
++}
++
+ static int superio_inw(int reg)
+ {
+ int val;
+@@ -1036,6 +1043,21 @@ static int __init it87_find(unsigned short *address,
+ sio_data->vid_value = superio_inb(IT87_SIO_VID_REG);
+
+ reg = superio_inb(IT87_SIO_PINX2_REG);
++ /*
++ * The IT8720F has no VIN7 pin, so VCCH should always be
++ * routed internally to VIN7 with an internal divider.
++ * Curiously, there still is a configuration bit to control
++ * this, which means it can be set incorrectly. And even
++ * more curiously, many boards out there are improperly
++ * configured, even though the IT8720F datasheet claims
++ * that the internal routing of VCCH to VIN7 is the default
++ * setting. So we force the internal routing in this case.
++ */
++ if (sio_data->type == it8720 && !(reg & (1 << 1))) {
++ reg |= (1 << 1);
++ superio_outb(IT87_SIO_PINX2_REG, reg);
++ pr_notice("it87: Routing internal VCCH to in7\n");
++ }
+ if (reg & (1 << 0))
+ pr_info("it87: in3 is VCC (+5V)\n");
+ if (reg & (1 << 1))
+diff --git a/drivers/hwmon/k8temp.c b/drivers/hwmon/k8temp.c
+index 1fe9951..f808d18 100644
+--- a/drivers/hwmon/k8temp.c
++++ b/drivers/hwmon/k8temp.c
+@@ -120,7 +120,7 @@ static ssize_t show_temp(struct device *dev,
+ int temp;
+ struct k8temp_data *data = k8temp_update_device(dev);
+
+- if (data->swap_core_select)
++ if (data->swap_core_select && (data->sensorsp & SEL_CORE))
+ core = core ? 0 : 1;
+
+ temp = TEMP_FROM_REG(data->temp[core][place]) + data->temp_offset;
+@@ -180,11 +180,13 @@ static int __devinit k8temp_probe(struct pci_dev *pdev,
+ }
+
+ if ((model >= 0x69) &&
+- !(model == 0xc1 || model == 0x6c || model == 0x7c)) {
++ !(model == 0xc1 || model == 0x6c || model == 0x7c ||
++ model == 0x6b || model == 0x6f || model == 0x7f)) {
+ /*
+- * RevG desktop CPUs (i.e. no socket S1G1 parts)
+- * need additional offset, otherwise reported
+- * temperature is below ambient temperature
++ * RevG desktop CPUs (i.e. no socket S1G1 or
++ * ASB1 parts) need additional offset,
++ * otherwise reported temperature is below
++ * ambient temperature
+ */
+ data->temp_offset = 21000;
+ }
+diff --git a/drivers/ide/cmd640.c b/drivers/ide/cmd640.c
+index 1a32d62..a9c3313 100644
+--- a/drivers/ide/cmd640.c
++++ b/drivers/ide/cmd640.c
+@@ -632,12 +632,10 @@ static void cmd640_init_dev(ide_drive_t *drive)
+
+ static int cmd640_test_irq(ide_hwif_t *hwif)
+ {
+- struct pci_dev *dev = to_pci_dev(hwif->dev);
+ int irq_reg = hwif->channel ? ARTTIM23 : CFR;
+- u8 irq_stat, irq_mask = hwif->channel ? ARTTIM23_IDE23INTR :
++ u8 irq_mask = hwif->channel ? ARTTIM23_IDE23INTR :
+ CFR_IDE01INTR;
+-
+- pci_read_config_byte(dev, irq_reg, &irq_stat);
++ u8 irq_stat = get_cmd640_reg(irq_reg);
+
+ return (irq_stat & irq_mask) ? 1 : 0;
+ }
+diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c
+index cc8633c..67fb735 100644
+--- a/drivers/ide/ide-taskfile.c
++++ b/drivers/ide/ide-taskfile.c
+@@ -428,13 +428,11 @@ int ide_raw_taskfile(ide_drive_t *drive, struct ide_cmd *cmd, u8 *buf,
+ {
+ struct request *rq;
+ int error;
++ int rw = !(cmd->tf_flags & IDE_TFLAG_WRITE) ? READ : WRITE;
+
+- rq = blk_get_request(drive->queue, READ, __GFP_WAIT);
++ rq = blk_get_request(drive->queue, rw, __GFP_WAIT);
+ rq->cmd_type = REQ_TYPE_ATA_TASKFILE;
+
+- if (cmd->tf_flags & IDE_TFLAG_WRITE)
+- rq->cmd_flags |= REQ_RW;
+-
+ /*
+ * (ks) We transfer currently only whole sectors.
+ * This is suffient for now. But, it would be great,
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index df3eb8c..b4b2257 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1163,7 +1163,7 @@ static ssize_t create_child(struct device *dev,
+
+ return ret ? ret : count;
+ }
+-static DEVICE_ATTR(create_child, S_IWUGO, NULL, create_child);
++static DEVICE_ATTR(create_child, S_IWUSR, NULL, create_child);
+
+ static ssize_t delete_child(struct device *dev,
+ struct device_attribute *attr,
+@@ -1183,7 +1183,7 @@ static ssize_t delete_child(struct device *dev,
+ return ret ? ret : count;
+
+ }
+-static DEVICE_ATTR(delete_child, S_IWUGO, NULL, delete_child);
++static DEVICE_ATTR(delete_child, S_IWUSR, NULL, delete_child);
+
+ int ipoib_add_pkey_attr(struct net_device *dev)
+ {
+diff --git a/drivers/input/keyboard/twl4030_keypad.c b/drivers/input/keyboard/twl4030_keypad.c
+index 9a2977c..2cfbc17 100644
+--- a/drivers/input/keyboard/twl4030_keypad.c
++++ b/drivers/input/keyboard/twl4030_keypad.c
+@@ -50,8 +50,12 @@
+ */
+ #define TWL4030_MAX_ROWS 8 /* TWL4030 hard limit */
+ #define TWL4030_MAX_COLS 8
+-#define TWL4030_ROW_SHIFT 3
+-#define TWL4030_KEYMAP_SIZE (TWL4030_MAX_ROWS * TWL4030_MAX_COLS)
++/*
++ * Note that we add space for an extra column so that we can handle
++ * row lines connected to the gnd (see twl4030_col_xlate()).
++ */
++#define TWL4030_ROW_SHIFT 4
++#define TWL4030_KEYMAP_SIZE (TWL4030_MAX_ROWS << TWL4030_ROW_SHIFT)
+
+ struct twl4030_keypad {
+ unsigned short keymap[TWL4030_KEYMAP_SIZE];
+@@ -181,7 +185,7 @@ static int twl4030_read_kp_matrix_state(struct twl4030_keypad *kp, u16 *state)
+ return ret;
+ }
+
+-static int twl4030_is_in_ghost_state(struct twl4030_keypad *kp, u16 *key_state)
++static bool twl4030_is_in_ghost_state(struct twl4030_keypad *kp, u16 *key_state)
+ {
+ int i;
+ u16 check = 0;
+@@ -190,12 +194,12 @@ static int twl4030_is_in_ghost_state(struct twl4030_keypad *kp, u16 *key_state)
+ u16 col = key_state[i];
+
+ if ((col & check) && hweight16(col) > 1)
+- return 1;
++ return true;
+
+ check |= col;
+ }
+
+- return 0;
++ return false;
+ }
+
+ static void twl4030_kp_scan(struct twl4030_keypad *kp, bool release_all)
+@@ -224,7 +228,8 @@ static void twl4030_kp_scan(struct twl4030_keypad *kp, bool release_all)
+ if (!changed)
+ continue;
+
+- for (col = 0; col < kp->n_cols; col++) {
++ /* Extra column handles "all gnd" rows */
++ for (col = 0; col < kp->n_cols + 1; col++) {
+ int code;
+
+ if (!(changed & (1 << col)))
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 525b9b9..ba09e4d 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -166,6 +166,13 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
+ },
+ },
+ {
++ /* Gigabyte Spring Peak - defines wrong chassis type */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Spring Peak"),
++ },
++ },
++ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv9700"),
+diff --git a/drivers/media/dvb/dvb-core/dvb_net.c b/drivers/media/dvb/dvb-core/dvb_net.c
+index dddfc46..55e591d 100644
+--- a/drivers/media/dvb/dvb-core/dvb_net.c
++++ b/drivers/media/dvb/dvb-core/dvb_net.c
+@@ -350,6 +350,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
+ const u8 *ts, *ts_end, *from_where = NULL;
+ u8 ts_remain = 0, how_much = 0, new_ts = 1;
+ struct ethhdr *ethh = NULL;
++ bool error = false;
+
+ #ifdef ULE_DEBUG
+ /* The code inside ULE_DEBUG keeps a history of the last 100 TS cells processed. */
+@@ -459,10 +460,16 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
+
+ /* Drop partly decoded SNDU, reset state, resync on PUSI. */
+ if (priv->ule_skb) {
+- dev_kfree_skb( priv->ule_skb );
++ error = true;
++ dev_kfree_skb(priv->ule_skb);
++ }
++
++ if (error || priv->ule_sndu_remain) {
+ dev->stats.rx_errors++;
+ dev->stats.rx_frame_errors++;
++ error = false;
+ }
++
+ reset_ule(priv);
+ priv->need_pusi = 1;
+ continue;
+@@ -534,6 +541,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
+ from_where += 2;
+ }
+
++ priv->ule_sndu_remain = priv->ule_sndu_len + 2;
+ /*
+ * State of current TS:
+ * ts_remain (remaining bytes in the current TS cell)
+@@ -543,6 +551,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
+ */
+ switch (ts_remain) {
+ case 1:
++ priv->ule_sndu_remain--;
+ priv->ule_sndu_type = from_where[0] << 8;
+ priv->ule_sndu_type_1 = 1; /* first byte of ule_type is set. */
+ ts_remain -= 1; from_where += 1;
+@@ -556,6 +565,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
+ default: /* complete ULE header is present in current TS. */
+ /* Extract ULE type field. */
+ if (priv->ule_sndu_type_1) {
++ priv->ule_sndu_type_1 = 0;
+ priv->ule_sndu_type |= from_where[0];
+ from_where += 1; /* points to payload start. */
+ ts_remain -= 1;
+diff --git a/drivers/media/dvb/ttpci/Kconfig b/drivers/media/dvb/ttpci/Kconfig
+index d8d4214..32a7ec6 100644
+--- a/drivers/media/dvb/ttpci/Kconfig
++++ b/drivers/media/dvb/ttpci/Kconfig
+@@ -68,13 +68,14 @@ config DVB_BUDGET
+ select DVB_VES1820 if !DVB_FE_CUSTOMISE
+ select DVB_L64781 if !DVB_FE_CUSTOMISE
+ select DVB_TDA8083 if !DVB_FE_CUSTOMISE
+- select DVB_TDA10021 if !DVB_FE_CUSTOMISE
+- select DVB_TDA10023 if !DVB_FE_CUSTOMISE
+ select DVB_S5H1420 if !DVB_FE_CUSTOMISE
+ select DVB_TDA10086 if !DVB_FE_CUSTOMISE
+ select DVB_TDA826X if !DVB_FE_CUSTOMISE
+ select DVB_LNBP21 if !DVB_FE_CUSTOMISE
+ select DVB_TDA1004X if !DVB_FE_CUSTOMISE
++ select DVB_ISL6423 if !DVB_FE_CUSTOMISE
++ select DVB_STV090x if !DVB_FE_CUSTOMISE
++ select DVB_STV6110x if !DVB_FE_CUSTOMISE
+ help
+ Support for simple SAA7146 based DVB cards (so called Budget-
+ or Nova-PCI cards) without onboard MPEG2 decoder, and without
+diff --git a/drivers/media/video/cx23885/cx23885-i2c.c b/drivers/media/video/cx23885/cx23885-i2c.c
+index 4172cb3..d4746e0 100644
+--- a/drivers/media/video/cx23885/cx23885-i2c.c
++++ b/drivers/media/video/cx23885/cx23885-i2c.c
+@@ -365,7 +365,17 @@ int cx23885_i2c_register(struct cx23885_i2c *bus)
+
+ memset(&info, 0, sizeof(struct i2c_board_info));
+ strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
+- i2c_new_probed_device(&bus->i2c_adap, &info, addr_list);
++ /*
++ * We can't call i2c_new_probed_device() because it uses
++ * quick writes for probing and the IR receiver device only
++ * replies to reads.
++ */
++ if (i2c_smbus_xfer(&bus->i2c_adap, addr_list[0], 0,
++ I2C_SMBUS_READ, 0, I2C_SMBUS_QUICK,
++ NULL) >= 0) {
++ info.addr = addr_list[0];
++ i2c_new_device(&bus->i2c_adap, &info);
++ }
+ }
+
+ return bus->i2c_rc;
+diff --git a/drivers/media/video/cx88/cx88-i2c.c b/drivers/media/video/cx88/cx88-i2c.c
+index ee1ca39..fb39f11 100644
+--- a/drivers/media/video/cx88/cx88-i2c.c
++++ b/drivers/media/video/cx88/cx88-i2c.c
+@@ -188,10 +188,24 @@ int cx88_i2c_init(struct cx88_core *core, struct pci_dev *pci)
+ 0x18, 0x6b, 0x71,
+ I2C_CLIENT_END
+ };
++ const unsigned short *addrp;
+
+ memset(&info, 0, sizeof(struct i2c_board_info));
+ strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
+- i2c_new_probed_device(&core->i2c_adap, &info, addr_list);
++ /*
++ * We can't call i2c_new_probed_device() because it uses
++ * quick writes for probing and at least some R receiver
++ * devices only reply to reads.
++ */
++ for (addrp = addr_list; *addrp != I2C_CLIENT_END; addrp++) {
++ if (i2c_smbus_xfer(&core->i2c_adap, *addrp, 0,
++ I2C_SMBUS_READ, 0,
++ I2C_SMBUS_QUICK, NULL) >= 0) {
++ info.addr = *addrp;
++ i2c_new_device(&core->i2c_adap, &info);
++ break;
++ }
++ }
+ }
+ return core->i2c_rc;
+ }
+diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
+index 8756be5..450ac70 100644
+--- a/drivers/media/video/uvc/uvc_driver.c
++++ b/drivers/media/video/uvc/uvc_driver.c
+@@ -58,6 +58,11 @@ static struct uvc_format_desc uvc_fmts[] = {
+ .fcc = V4L2_PIX_FMT_YUYV,
+ },
+ {
++ .name = "YUV 4:2:2 (YUYV)",
++ .guid = UVC_GUID_FORMAT_YUY2_ISIGHT,
++ .fcc = V4L2_PIX_FMT_YUYV,
++ },
++ {
+ .name = "YUV 4:2:0 (NV12)",
+ .guid = UVC_GUID_FORMAT_NV12,
+ .fcc = V4L2_PIX_FMT_NV12,
+@@ -83,11 +88,16 @@ static struct uvc_format_desc uvc_fmts[] = {
+ .fcc = V4L2_PIX_FMT_UYVY,
+ },
+ {
+- .name = "Greyscale",
++ .name = "Greyscale (8-bit)",
+ .guid = UVC_GUID_FORMAT_Y800,
+ .fcc = V4L2_PIX_FMT_GREY,
+ },
+ {
++ .name = "Greyscale (16-bit)",
++ .guid = UVC_GUID_FORMAT_Y16,
++ .fcc = V4L2_PIX_FMT_Y16,
++ },
++ {
+ .name = "RGB Bayer",
+ .guid = UVC_GUID_FORMAT_BY8,
+ .fcc = V4L2_PIX_FMT_SBGGR8,
+@@ -2048,6 +2058,15 @@ static struct usb_device_id uvc_ids[] = {
+ .bInterfaceSubClass = 1,
+ .bInterfaceProtocol = 0,
+ .driver_info = UVC_QUIRK_STREAM_NO_FID },
++ /* Syntek (Packard Bell EasyNote MX52 */
++ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
++ | USB_DEVICE_ID_MATCH_INT_INFO,
++ .idVendor = 0x174f,
++ .idProduct = 0x8a12,
++ .bInterfaceClass = USB_CLASS_VIDEO,
++ .bInterfaceSubClass = 1,
++ .bInterfaceProtocol = 0,
++ .driver_info = UVC_QUIRK_STREAM_NO_FID },
+ /* Syntek (Asus F9SG) */
+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
+ | USB_DEVICE_ID_MATCH_INT_INFO,
+@@ -2112,6 +2131,15 @@ static struct usb_device_id uvc_ids[] = {
+ .bInterfaceSubClass = 1,
+ .bInterfaceProtocol = 0,
+ .driver_info = UVC_QUIRK_PROBE_MINMAX },
++ /* Arkmicro unbranded */
++ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
++ | USB_DEVICE_ID_MATCH_INT_INFO,
++ .idVendor = 0x18ec,
++ .idProduct = 0x3290,
++ .bInterfaceClass = USB_CLASS_VIDEO,
++ .bInterfaceSubClass = 1,
++ .bInterfaceProtocol = 0,
++ .driver_info = UVC_QUIRK_PROBE_DEF },
+ /* Bodelin ProScopeHR */
+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
+ | USB_DEVICE_ID_MATCH_DEV_HI
+diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
+index e7958aa..64007b9 100644
+--- a/drivers/media/video/uvc/uvcvideo.h
++++ b/drivers/media/video/uvc/uvcvideo.h
+@@ -112,6 +112,9 @@ struct uvc_xu_control {
+ #define UVC_GUID_FORMAT_YUY2 \
+ { 'Y', 'U', 'Y', '2', 0x00, 0x00, 0x10, 0x00, \
+ 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
++#define UVC_GUID_FORMAT_YUY2_ISIGHT \
++ { 'Y', 'U', 'Y', '2', 0x00, 0x00, 0x10, 0x00, \
++ 0x80, 0x00, 0x00, 0x00, 0x00, 0x38, 0x9b, 0x71}
+ #define UVC_GUID_FORMAT_NV12 \
+ { 'N', 'V', '1', '2', 0x00, 0x00, 0x10, 0x00, \
+ 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
+@@ -127,11 +130,13 @@ struct uvc_xu_control {
+ #define UVC_GUID_FORMAT_Y800 \
+ { 'Y', '8', '0', '0', 0x00, 0x00, 0x10, 0x00, \
+ 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
++#define UVC_GUID_FORMAT_Y16 \
++ { 'Y', '1', '6', ' ', 0x00, 0x00, 0x10, 0x00, \
++ 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
+ #define UVC_GUID_FORMAT_BY8 \
+ { 'B', 'Y', '8', ' ', 0x00, 0x00, 0x10, 0x00, \
+ 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
+
+-
+ /* ------------------------------------------------------------------------
+ * Driver specific constants.
+ */
+diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
+index 50997d2..676cd0c 100644
+--- a/drivers/mmc/host/sdhci-s3c.c
++++ b/drivers/mmc/host/sdhci-s3c.c
+@@ -372,6 +372,26 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
+
+ static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
+ {
++ struct sdhci_host *host = platform_get_drvdata(pdev);
++ struct sdhci_s3c *sc = sdhci_priv(host);
++ int ptr;
++
++ sdhci_remove_host(host, 1);
++
++ for (ptr = 0; ptr < 3; ptr++) {
++ clk_disable(sc->clk_bus[ptr]);
++ clk_put(sc->clk_bus[ptr]);
++ }
++ clk_disable(sc->clk_io);
++ clk_put(sc->clk_io);
++
++ iounmap(host->ioaddr);
++ release_resource(sc->ioarea);
++ kfree(sc->ioarea);
++
++ sdhci_free_host(host);
++ platform_set_drvdata(pdev, NULL);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/cpmac.c b/drivers/net/cpmac.c
+index 61f9da2..1cace00 100644
+--- a/drivers/net/cpmac.c
++++ b/drivers/net/cpmac.c
+@@ -1176,7 +1176,8 @@ static int __devinit cpmac_probe(struct platform_device *pdev)
+ if (netif_msg_drv(priv))
+ printk(KERN_ERR "%s: Could not attach to PHY\n",
+ dev->name);
+- return PTR_ERR(priv->phy);
++ rc = PTR_ERR(priv->phy);
++ goto fail;
+ }
+
+ if ((rc = register_netdev(dev))) {
+diff --git a/drivers/net/cxgb3/ael1002.c b/drivers/net/cxgb3/ael1002.c
+index 5248f9e..35cd367 100644
+--- a/drivers/net/cxgb3/ael1002.c
++++ b/drivers/net/cxgb3/ael1002.c
+@@ -934,7 +934,7 @@ static struct cphy_ops xaui_direct_ops = {
+ int t3_xaui_direct_phy_prep(struct cphy *phy, struct adapter *adapter,
+ int phy_addr, const struct mdio_ops *mdio_ops)
+ {
+- cphy_init(phy, adapter, MDIO_PRTAD_NONE, &xaui_direct_ops, mdio_ops,
++ cphy_init(phy, adapter, phy_addr, &xaui_direct_ops, mdio_ops,
+ SUPPORTED_10000baseT_Full | SUPPORTED_AUI | SUPPORTED_TP,
+ "10GBASE-CX4");
+ return 0;
+diff --git a/drivers/net/dm9000.c b/drivers/net/dm9000.c
+index 31b8bef..3f5eb81 100644
+--- a/drivers/net/dm9000.c
++++ b/drivers/net/dm9000.c
+@@ -471,17 +471,13 @@ static uint32_t dm9000_get_rx_csum(struct net_device *dev)
+ return dm->rx_csum;
+ }
+
+-static int dm9000_set_rx_csum(struct net_device *dev, uint32_t data)
++static int dm9000_set_rx_csum_unlocked(struct net_device *dev, uint32_t data)
+ {
+ board_info_t *dm = to_dm9000_board(dev);
+- unsigned long flags;
+
+ if (dm->can_csum) {
+ dm->rx_csum = data;
+-
+- spin_lock_irqsave(&dm->lock, flags);
+ iow(dm, DM9000_RCSR, dm->rx_csum ? RCSR_CSUM : 0);
+- spin_unlock_irqrestore(&dm->lock, flags);
+
+ return 0;
+ }
+@@ -489,6 +485,19 @@ static int dm9000_set_rx_csum(struct net_device *dev, uint32_t data)
+ return -EOPNOTSUPP;
+ }
+
++static int dm9000_set_rx_csum(struct net_device *dev, uint32_t data)
++{
++ board_info_t *dm = to_dm9000_board(dev);
++ unsigned long flags;
++ int ret;
++
++ spin_lock_irqsave(&dm->lock, flags);
++ ret = dm9000_set_rx_csum_unlocked(dev, data);
++ spin_unlock_irqrestore(&dm->lock, flags);
++
++ return ret;
++}
++
+ static int dm9000_set_tx_csum(struct net_device *dev, uint32_t data)
+ {
+ board_info_t *dm = to_dm9000_board(dev);
+@@ -667,7 +676,7 @@ static unsigned char dm9000_type_to_char(enum dm9000_type type)
+ * Set DM9000 multicast address
+ */
+ static void
+-dm9000_hash_table(struct net_device *dev)
++dm9000_hash_table_unlocked(struct net_device *dev)
+ {
+ board_info_t *db = netdev_priv(dev);
+ struct dev_mc_list *mcptr = dev->mc_list;
+@@ -676,12 +685,9 @@ dm9000_hash_table(struct net_device *dev)
+ u32 hash_val;
+ u16 hash_table[4];
+ u8 rcr = RCR_DIS_LONG | RCR_DIS_CRC | RCR_RXEN;
+- unsigned long flags;
+
+ dm9000_dbg(db, 1, "entering %s\n", __func__);
+
+- spin_lock_irqsave(&db->lock, flags);
+-
+ for (i = 0, oft = DM9000_PAR; i < 6; i++, oft++)
+ iow(db, oft, dev->dev_addr[i]);
+
+@@ -711,6 +717,16 @@ dm9000_hash_table(struct net_device *dev)
+ }
+
+ iow(db, DM9000_RCR, rcr);
++}
++
++static void
++dm9000_hash_table(struct net_device *dev)
++{
++ board_info_t *db = netdev_priv(dev);
++ unsigned long flags;
++
++ spin_lock_irqsave(&db->lock, flags);
++ dm9000_hash_table_unlocked(dev);
+ spin_unlock_irqrestore(&db->lock, flags);
+ }
+
+@@ -729,7 +745,7 @@ dm9000_init_dm9000(struct net_device *dev)
+ db->io_mode = ior(db, DM9000_ISR) >> 6; /* ISR bit7:6 keeps I/O mode */
+
+ /* Checksum mode */
+- dm9000_set_rx_csum(dev, db->rx_csum);
++ dm9000_set_rx_csum_unlocked(dev, db->rx_csum);
+
+ /* GPIO0 on pre-activate PHY */
+ iow(db, DM9000_GPR, 0); /* REG_1F bit0 activate phyxcer */
+@@ -749,7 +765,7 @@ dm9000_init_dm9000(struct net_device *dev)
+ iow(db, DM9000_ISR, ISR_CLR_STATUS); /* Clear interrupt status */
+
+ /* Set address filter table */
+- dm9000_hash_table(dev);
++ dm9000_hash_table_unlocked(dev);
+
+ imr = IMR_PAR | IMR_PTM | IMR_PRM;
+ if (db->type != TYPE_DM9000E)
+diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
+index 3116601..7cd446d 100644
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -5900,7 +5900,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
+ /* Limit the number of tx's outstanding for hw bug */
+ if (id->driver_data & DEV_NEED_TX_LIMIT) {
+ np->tx_limit = 1;
+- if ((id->driver_data & DEV_NEED_TX_LIMIT2) &&
++ if (((id->driver_data & DEV_NEED_TX_LIMIT2) == DEV_NEED_TX_LIMIT2) &&
+ pci_dev->revision >= 0xA2)
+ np->tx_limit = 0;
+ }
+diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
+index c6d97eb..33352ff 100644
+--- a/drivers/net/igb/e1000_82575.c
++++ b/drivers/net/igb/e1000_82575.c
+@@ -1168,9 +1168,18 @@ static s32 igb_read_mac_addr_82575(struct e1000_hw *hw)
+ {
+ s32 ret_val = 0;
+
+- if (igb_check_alt_mac_addr(hw))
+- ret_val = igb_read_mac_addr(hw);
++ /*
++ * If there's an alternate MAC address place it in RAR0
++ * so that it will override the Si installed default perm
++ * address.
++ */
++ ret_val = igb_check_alt_mac_addr(hw);
++ if (ret_val)
++ goto out;
++
++ ret_val = igb_read_mac_addr(hw);
+
++out:
+ return ret_val;
+ }
+
+diff --git a/drivers/net/igb/e1000_hw.h b/drivers/net/igb/e1000_hw.h
+index 1a23aeb..72081df 100644
+--- a/drivers/net/igb/e1000_hw.h
++++ b/drivers/net/igb/e1000_hw.h
+@@ -53,6 +53,8 @@ struct e1000_hw;
+
+ #define E1000_FUNC_1 1
+
++#define E1000_ALT_MAC_ADDRESS_OFFSET_LAN1 3
++
+ enum e1000_mac_type {
+ e1000_undefined = 0,
+ e1000_82575,
+diff --git a/drivers/net/igb/e1000_mac.c b/drivers/net/igb/e1000_mac.c
+index 7d76bb0..d4fa82c 100644
+--- a/drivers/net/igb/e1000_mac.c
++++ b/drivers/net/igb/e1000_mac.c
+@@ -185,13 +185,12 @@ s32 igb_check_alt_mac_addr(struct e1000_hw *hw)
+ }
+
+ if (nvm_alt_mac_addr_offset == 0xFFFF) {
+- ret_val = -(E1000_NOT_IMPLEMENTED);
++ /* There is no Alternate MAC Address */
+ goto out;
+ }
+
+ if (hw->bus.func == E1000_FUNC_1)
+- nvm_alt_mac_addr_offset += ETH_ALEN/sizeof(u16);
+-
++ nvm_alt_mac_addr_offset += E1000_ALT_MAC_ADDRESS_OFFSET_LAN1;
+ for (i = 0; i < ETH_ALEN; i += 2) {
+ offset = nvm_alt_mac_addr_offset + (i >> 1);
+ ret_val = hw->nvm.ops.read(hw, offset, 1, &nvm_data);
+@@ -206,14 +205,16 @@ s32 igb_check_alt_mac_addr(struct e1000_hw *hw)
+
+ /* if multicast bit is set, the alternate address will not be used */
+ if (alt_mac_addr[0] & 0x01) {
+- ret_val = -(E1000_NOT_IMPLEMENTED);
++ hw_dbg("Ignoring Alternate Mac Address with MC bit set\n");
+ goto out;
+ }
+
+- for (i = 0; i < ETH_ALEN; i++)
+- hw->mac.addr[i] = hw->mac.perm_addr[i] = alt_mac_addr[i];
+-
+- hw->mac.ops.rar_set(hw, hw->mac.perm_addr, 0);
++ /*
++ * We have a valid alternate MAC address, and we want to treat it the
++ * same as the normal permanent MAC address stored by the HW into the
++ * RAR. Do this by mapping this address into RAR0.
++ */
++ hw->mac.ops.rar_set(hw, alt_mac_addr, 0);
+
+ out:
+ return ret_val;
+diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
+index 77125b5..a17aaee 100644
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -704,11 +704,24 @@ static void sky2_phy_power_down(struct sky2_hw *hw, unsigned port)
+ sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
+ }
+
++/* Enable Rx/Tx */
++static void sky2_enable_rx_tx(struct sky2_port *sky2)
++{
++ struct sky2_hw *hw = sky2->hw;
++ unsigned port = sky2->port;
++ u16 reg;
++
++ reg = gma_read16(hw, port, GM_GP_CTRL);
++ reg |= GM_GPCR_RX_ENA | GM_GPCR_TX_ENA;
++ gma_write16(hw, port, GM_GP_CTRL, reg);
++}
++
+ /* Force a renegotiation */
+ static void sky2_phy_reinit(struct sky2_port *sky2)
+ {
+ spin_lock_bh(&sky2->phy_lock);
+ sky2_phy_init(sky2->hw, sky2->port);
++ sky2_enable_rx_tx(sky2);
+ spin_unlock_bh(&sky2->phy_lock);
+ }
+
+@@ -1929,7 +1942,6 @@ static void sky2_link_up(struct sky2_port *sky2)
+ {
+ struct sky2_hw *hw = sky2->hw;
+ unsigned port = sky2->port;
+- u16 reg;
+ static const char *fc_name[] = {
+ [FC_NONE] = "none",
+ [FC_TX] = "tx",
+@@ -1937,10 +1949,7 @@ static void sky2_link_up(struct sky2_port *sky2)
+ [FC_BOTH] = "both",
+ };
+
+- /* enable Rx/Tx */
+- reg = gma_read16(hw, port, GM_GP_CTRL);
+- reg |= GM_GPCR_RX_ENA | GM_GPCR_TX_ENA;
+- gma_write16(hw, port, GM_GP_CTRL, reg);
++ sky2_enable_rx_tx(sky2);
+
+ gm_phy_write(hw, port, PHY_MARV_INT_MASK, PHY_M_DEF_MSK);
+
+diff --git a/drivers/net/wireless/ath/ath5k/attach.c b/drivers/net/wireless/ath/ath5k/attach.c
+index 71a1bd2..88663df 100644
+--- a/drivers/net/wireless/ath/ath5k/attach.c
++++ b/drivers/net/wireless/ath/ath5k/attach.c
+@@ -133,6 +133,7 @@ struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc)
+ ah->ah_cw_min = AR5K_TUNE_CWMIN;
+ ah->ah_limit_tx_retries = AR5K_INIT_TX_RETRY;
+ ah->ah_software_retry = false;
++ ah->ah_current_channel = &sc->channels[0];
+
+ /*
+ * Find the mac version
+diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
+index cefbfb9..7ee61d4 100644
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -1818,11 +1818,6 @@ ath5k_tasklet_rx(unsigned long data)
+ return;
+ }
+
+- if (unlikely(rs.rs_more)) {
+- ATH5K_WARN(sc, "unsupported jumbo\n");
+- goto next;
+- }
+-
+ if (unlikely(rs.rs_status)) {
+ if (rs.rs_status & AR5K_RXERR_PHY)
+ goto next;
+@@ -1852,6 +1847,8 @@ ath5k_tasklet_rx(unsigned long data)
+ sc->opmode != NL80211_IFTYPE_MONITOR)
+ goto next;
+ }
++ if (unlikely(rs.rs_more))
++ goto next;
+ accept:
+ next_skb = ath5k_rx_skb_alloc(sc, &next_skb_addr);
+
+diff --git a/drivers/net/wireless/ath/ath9k/initvals.h b/drivers/net/wireless/ath/ath9k/initvals.h
+index 8622265..a21c214 100644
+--- a/drivers/net/wireless/ath/ath9k/initvals.h
++++ b/drivers/net/wireless/ath/ath9k/initvals.h
+@@ -2762,7 +2762,7 @@ static const u32 ar9280Common_9280_2[][2] = {
+ { 0x00008258, 0x00000000 },
+ { 0x0000825c, 0x400000ff },
+ { 0x00008260, 0x00080922 },
+- { 0x00008264, 0xa8a00010 },
++ { 0x00008264, 0x88a00010 },
+ { 0x00008270, 0x00000000 },
+ { 0x00008274, 0x40000000 },
+ { 0x00008278, 0x003e4180 },
+@@ -3935,7 +3935,7 @@ static const u_int32_t ar9285Common_9285[][2] = {
+ { 0x00008258, 0x00000000 },
+ { 0x0000825c, 0x400000ff },
+ { 0x00008260, 0x00080922 },
+- { 0x00008264, 0xa8a00010 },
++ { 0x00008264, 0x88a00010 },
+ { 0x00008270, 0x00000000 },
+ { 0x00008274, 0x40000000 },
+ { 0x00008278, 0x003e4180 },
+@@ -5072,7 +5072,7 @@ static const u_int32_t ar9287Common_9287_1_0[][2] = {
+ { 0x00008258, 0x00000000 },
+ { 0x0000825c, 0x400000ff },
+ { 0x00008260, 0x00080922 },
+- { 0x00008264, 0xa8a00010 },
++ { 0x00008264, 0x88a00010 },
+ { 0x00008270, 0x00000000 },
+ { 0x00008274, 0x40000000 },
+ { 0x00008278, 0x003e4180 },
+@@ -6864,7 +6864,7 @@ static const u_int32_t ar9271Common_9271_1_0[][2] = {
+ { 0x00008258, 0x00000000 },
+ { 0x0000825c, 0x400000ff },
+ { 0x00008260, 0x00080922 },
+- { 0x00008264, 0xa8a00010 },
++ { 0x00008264, 0x88a00010 },
+ { 0x00008270, 0x00000000 },
+ { 0x00008274, 0x40000000 },
+ { 0x00008278, 0x003e4180 },
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 087b7e5..0c349ce 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1538,6 +1538,8 @@ bad_no_ah:
+
+ void ath_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+ {
++ struct ath_hw *ah = sc->sc_ah;
++
+ hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
+ IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
+ IEEE80211_HW_SIGNAL_DBM |
+@@ -1558,7 +1560,10 @@ void ath_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+ BIT(NL80211_IFTYPE_ADHOC) |
+ BIT(NL80211_IFTYPE_MESH_POINT);
+
+- hw->wiphy->ps_default = false;
++ if (AR_SREV_5416(ah))
++ hw->wiphy->ps_default = false;
++ else
++ hw->wiphy->ps_default = true;
+
+ hw->queues = 4;
+ hw->max_rates = 4;
+diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
+index ad8eab4..b4ff1dc 100644
+--- a/drivers/net/wireless/hostap/hostap_cs.c
++++ b/drivers/net/wireless/hostap/hostap_cs.c
+@@ -626,6 +626,7 @@ static int prism2_config(struct pcmcia_device *link)
+ int ret = 1;
+ int last_fn, last_ret;
+ struct hostap_cs_priv *hw_priv;
++ unsigned long flags;
+
+ PDEBUG(DEBUG_FLOW, "prism2_config()\n");
+
+@@ -661,6 +662,12 @@ static int prism2_config(struct pcmcia_device *link)
+ link->dev_node = &hw_priv->node;
+
+ /*
++ * Make sure the IRQ handler cannot proceed until at least
++ * dev->base_addr is initialized.
++ */
++ spin_lock_irqsave(&local->irq_init_lock, flags);
++
++ /*
+ * Allocate an interrupt line. Note that this does not assign a
+ * handler to the interrupt, unless the 'Handler' member of the
+ * irq structure is initialized.
+@@ -686,6 +693,8 @@ static int prism2_config(struct pcmcia_device *link)
+ dev->irq = link->irq.AssignedIRQ;
+ dev->base_addr = link->io.BasePort1;
+
++ spin_unlock_irqrestore(&local->irq_init_lock, flags);
++
+ /* Finally, report what we've done */
+ printk(KERN_INFO "%s: index 0x%02x: ",
+ dev_info, link->conf.ConfigIndex);
+@@ -715,6 +724,7 @@ static int prism2_config(struct pcmcia_device *link)
+ return ret;
+
+ cs_failed:
++ spin_unlock_irqrestore(&local->irq_init_lock, flags);
+ cs_error(link, last_fn, last_ret);
+
+ failed:
+diff --git a/drivers/net/wireless/hostap/hostap_hw.c b/drivers/net/wireless/hostap/hostap_hw.c
+index ff9b5c8..2f999fc 100644
+--- a/drivers/net/wireless/hostap/hostap_hw.c
++++ b/drivers/net/wireless/hostap/hostap_hw.c
+@@ -2621,6 +2621,18 @@ static irqreturn_t prism2_interrupt(int irq, void *dev_id)
+ iface = netdev_priv(dev);
+ local = iface->local;
+
++ /* Detect early interrupt before driver is fully configued */
++ spin_lock(&local->irq_init_lock);
++ if (!dev->base_addr) {
++ if (net_ratelimit()) {
++ printk(KERN_DEBUG "%s: Interrupt, but dev not configured\n",
++ dev->name);
++ }
++ spin_unlock(&local->irq_init_lock);
++ return IRQ_HANDLED;
++ }
++ spin_unlock(&local->irq_init_lock);
++
+ prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INTERRUPT, 0, 0);
+
+ if (local->func->card_present && !local->func->card_present(local)) {
+@@ -3138,6 +3150,7 @@ prism2_init_local_data(struct prism2_helper_functions *funcs, int card_idx,
+ spin_lock_init(&local->cmdlock);
+ spin_lock_init(&local->baplock);
+ spin_lock_init(&local->lock);
++ spin_lock_init(&local->irq_init_lock);
+ mutex_init(&local->rid_bap_mtx);
+
+ if (card_idx < 0 || card_idx >= MAX_PARM_DEVICES)
+diff --git a/drivers/net/wireless/hostap/hostap_wlan.h b/drivers/net/wireless/hostap/hostap_wlan.h
+index 3d23891..1ba33be 100644
+--- a/drivers/net/wireless/hostap/hostap_wlan.h
++++ b/drivers/net/wireless/hostap/hostap_wlan.h
+@@ -654,7 +654,7 @@ struct local_info {
+ rwlock_t iface_lock; /* hostap_interfaces read lock; use write lock
+ * when removing entries from the list.
+ * TX and RX paths can use read lock. */
+- spinlock_t cmdlock, baplock, lock;
++ spinlock_t cmdlock, baplock, lock, irq_init_lock;
+ struct mutex rid_bap_mtx;
+ u16 infofid; /* MAC buffer id for info frame */
+ /* txfid, intransmitfid, next_txtid, and next_alloc are protected by
+diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
+index 71c0ad4..db2946e 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
++++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
+@@ -799,6 +799,7 @@ void iwl_bg_abort_scan(struct work_struct *work)
+
+ mutex_lock(&priv->mutex);
+
++ cancel_delayed_work_sync(&priv->scan_check);
+ set_bit(STATUS_SCAN_ABORTING, &priv->status);
+ iwl_send_scan_abort(priv);
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
+index 7f15b7e..d21c06e 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
+@@ -1479,6 +1479,11 @@ void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
+ sta_id = ba_resp->sta_id;
+ tid = ba_resp->tid;
+ agg = &priv->stations[sta_id].tid[tid].agg;
++ if (unlikely(agg->txq_id != scd_flow)) {
++ IWL_ERR(priv, "BA scd_flow %d does not match txq_id %d\n",
++ scd_flow, agg->txq_id);
++ return;
++ }
+
+ /* Find index just before block-ack window */
+ index = iwl_queue_dec_wrap(ba_resp_scd_ssn & 0xff, txq->q.n_bd);
+diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
+index 485a8d4..f876d02 100644
+--- a/drivers/net/wireless/libertas/if_sdio.c
++++ b/drivers/net/wireless/libertas/if_sdio.c
+@@ -34,6 +34,8 @@
+ #include <linux/mmc/card.h>
+ #include <linux/mmc/sdio_func.h>
+ #include <linux/mmc/sdio_ids.h>
++#include <linux/mmc/sdio.h>
++#include <linux/mmc/host.h>
+
+ #include "host.h"
+ #include "decl.h"
+@@ -883,6 +885,7 @@ static int if_sdio_probe(struct sdio_func *func,
+ int ret, i;
+ unsigned int model;
+ struct if_sdio_packet *packet;
++ struct mmc_host *host = func->card->host;
+
+ lbs_deb_enter(LBS_DEB_SDIO);
+
+@@ -963,6 +966,25 @@ static int if_sdio_probe(struct sdio_func *func,
+ if (ret)
+ goto disable;
+
++ /* For 1-bit transfers to the 8686 model, we need to enable the
++ * interrupt flag in the CCCR register. Set the MMC_QUIRK_LENIENT_FN0
++ * bit to allow access to non-vendor registers. */
++ if ((card->model == IF_SDIO_MODEL_8686) &&
++ (host->caps & MMC_CAP_SDIO_IRQ) &&
++ (host->ios.bus_width == MMC_BUS_WIDTH_1)) {
++ u8 reg;
++
++ func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
++ reg = sdio_f0_readb(func, SDIO_CCCR_IF, &ret);
++ if (ret)
++ goto release_int;
++
++ reg |= SDIO_BUS_ECSI;
++ sdio_f0_writeb(func, reg, SDIO_CCCR_IF, &ret);
++ if (ret)
++ goto release_int;
++ }
++
+ card->ioport = sdio_readb(func, IF_SDIO_IOPORT, &ret);
+ if (ret)
+ goto release_int;
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index 7bafa83..3df13f5 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -40,6 +40,8 @@ static struct pci_device_id p54p_table[] __devinitdata = {
+ { PCI_DEVICE(0x1260, 0x3877) },
+ /* Intersil PRISM Javelin/Xbow Wireless LAN adapter */
+ { PCI_DEVICE(0x1260, 0x3886) },
++ /* Intersil PRISM Xbow Wireless LAN adapter (Symbol AP-300) */
++ { PCI_DEVICE(0x1260, 0xffff) },
+ { },
+ };
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 595d03a..812d4ac 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2046,6 +2046,7 @@ void pci_msi_off(struct pci_dev *dev)
+ pci_write_config_word(dev, pos + PCI_MSIX_FLAGS, control);
+ }
+ }
++EXPORT_SYMBOL_GPL(pci_msi_off);
+
+ #ifndef HAVE_ARCH_PCI_SET_DMA_MASK
+ /*
+diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
+index 329093e..c533b1c 100644
+--- a/drivers/platform/x86/eeepc-laptop.c
++++ b/drivers/platform/x86/eeepc-laptop.c
+@@ -752,6 +752,8 @@ static void eeepc_rfkill_hotplug(void)
+ struct pci_dev *dev;
+ struct pci_bus *bus;
+ bool blocked = eeepc_wlan_rfkill_blocked();
++ bool absent;
++ u32 l;
+
+ if (ehotk->wlan_rfkill)
+ rfkill_set_sw_state(ehotk->wlan_rfkill, blocked);
+@@ -765,6 +767,22 @@ static void eeepc_rfkill_hotplug(void)
+ goto out_unlock;
+ }
+
++ if (pci_bus_read_config_dword(bus, 0, PCI_VENDOR_ID, &l)) {
++ pr_err("Unable to read PCI config space?\n");
++ goto out_unlock;
++ }
++ absent = (l == 0xffffffff);
++
++ if (blocked != absent) {
++ pr_warning("BIOS says wireless lan is %s, "
++ "but the pci device is %s\n",
++ blocked ? "blocked" : "unblocked",
++ absent ? "absent" : "present");
++ pr_warning("skipped wireless hotplug as probably "
++ "inappropriate for this model\n");
++ goto out_unlock;
++ }
++
+ if (!blocked) {
+ dev = pci_get_slot(bus, 0);
+ if (dev) {
+diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
+index eb99ee4..861d91d 100644
+--- a/drivers/rtc/rtc-ds1307.c
++++ b/drivers/rtc/rtc-ds1307.c
+@@ -775,7 +775,7 @@ static int __devinit ds1307_probe(struct i2c_client *client,
+
+ read_rtc:
+ /* read RTC registers */
+- tmp = ds1307->read_block_data(ds1307->client, 0, 8, buf);
++ tmp = ds1307->read_block_data(ds1307->client, ds1307->offset, 8, buf);
+ if (tmp != 8) {
+ pr_debug("read error %d\n", tmp);
+ err = -EIO;
+@@ -860,7 +860,7 @@ read_rtc:
+ if (ds1307->regs[DS1307_REG_HOUR] & DS1307_BIT_PM)
+ tmp += 12;
+ i2c_smbus_write_byte_data(client,
+- DS1307_REG_HOUR,
++ ds1307->offset + DS1307_REG_HOUR,
+ bin2bcd(tmp));
+ }
+
+diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
+index 0391d75..a5b8e7b 100644
+--- a/drivers/scsi/aacraid/commctrl.c
++++ b/drivers/scsi/aacraid/commctrl.c
+@@ -655,9 +655,9 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
+ /* Does this really need to be GFP_DMA? */
+ p = kmalloc(usg->sg[i].count,GFP_KERNEL|__GFP_DMA);
+ if(!p) {
+- kfree (usg);
+- dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
++ dprintk((KERN_DEBUG "aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
+ usg->sg[i].count,i,usg->count));
++ kfree(usg);
+ rcode = -ENOMEM;
+ goto cleanup;
+ }
+diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
+index 300cea7..7feb902 100644
+--- a/drivers/serial/cpm_uart/cpm_uart_core.c
++++ b/drivers/serial/cpm_uart/cpm_uart_core.c
+@@ -930,6 +930,83 @@ static void cpm_uart_config_port(struct uart_port *port, int flags)
+ }
+ }
+
++#if defined(CONFIG_CONSOLE_POLL) || defined(CONFIG_SERIAL_CPM_CONSOLE)
++/*
++ * Write a string to the serial port
++ * Note that this is called with interrupts already disabled
++ */
++static void cpm_uart_early_write(struct uart_cpm_port *pinfo,
++ const char *string, u_int count)
++{
++ unsigned int i;
++ cbd_t __iomem *bdp, *bdbase;
++ unsigned char *cpm_outp_addr;
++
++ /* Get the address of the host memory buffer.
++ */
++ bdp = pinfo->tx_cur;
++ bdbase = pinfo->tx_bd_base;
++
++ /*
++ * Now, do each character. This is not as bad as it looks
++ * since this is a holding FIFO and not a transmitting FIFO.
++ * We could add the complexity of filling the entire transmit
++ * buffer, but we would just wait longer between accesses......
++ */
++ for (i = 0; i < count; i++, string++) {
++ /* Wait for transmitter fifo to empty.
++ * Ready indicates output is ready, and xmt is doing
++ * that, not that it is ready for us to send.
++ */
++ while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
++ ;
++
++ /* Send the character out.
++ * If the buffer address is in the CPM DPRAM, don't
++ * convert it.
++ */
++ cpm_outp_addr = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr),
++ pinfo);
++ *cpm_outp_addr = *string;
++
++ out_be16(&bdp->cbd_datlen, 1);
++ setbits16(&bdp->cbd_sc, BD_SC_READY);
++
++ if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
++ bdp = bdbase;
++ else
++ bdp++;
++
++ /* if a LF, also do CR... */
++ if (*string == 10) {
++ while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
++ ;
++
++ cpm_outp_addr = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr),
++ pinfo);
++ *cpm_outp_addr = 13;
++
++ out_be16(&bdp->cbd_datlen, 1);
++ setbits16(&bdp->cbd_sc, BD_SC_READY);
++
++ if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
++ bdp = bdbase;
++ else
++ bdp++;
++ }
++ }
++
++ /*
++ * Finally, Wait for transmitter & holding register to empty
++ * and restore the IER
++ */
++ while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
++ ;
++
++ pinfo->tx_cur = bdp;
++}
++#endif
++
+ #ifdef CONFIG_CONSOLE_POLL
+ /* Serial polling routines for writing and reading from the uart while
+ * in an interrupt or debug context.
+@@ -999,7 +1076,7 @@ static void cpm_put_poll_char(struct uart_port *port,
+ static char ch[2];
+
+ ch[0] = (char)c;
+- cpm_uart_early_write(pinfo->port.line, ch, 1);
++ cpm_uart_early_write(pinfo, ch, 1);
+ }
+ #endif /* CONFIG_CONSOLE_POLL */
+
+@@ -1130,9 +1207,6 @@ static void cpm_uart_console_write(struct console *co, const char *s,
+ u_int count)
+ {
+ struct uart_cpm_port *pinfo = &cpm_uart_ports[co->index];
+- unsigned int i;
+- cbd_t __iomem *bdp, *bdbase;
+- unsigned char *cp;
+ unsigned long flags;
+ int nolock = oops_in_progress;
+
+@@ -1142,66 +1216,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
+ spin_lock_irqsave(&pinfo->port.lock, flags);
+ }
+
+- /* Get the address of the host memory buffer.
+- */
+- bdp = pinfo->tx_cur;
+- bdbase = pinfo->tx_bd_base;
+-
+- /*
+- * Now, do each character. This is not as bad as it looks
+- * since this is a holding FIFO and not a transmitting FIFO.
+- * We could add the complexity of filling the entire transmit
+- * buffer, but we would just wait longer between accesses......
+- */
+- for (i = 0; i < count; i++, s++) {
+- /* Wait for transmitter fifo to empty.
+- * Ready indicates output is ready, and xmt is doing
+- * that, not that it is ready for us to send.
+- */
+- while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+- ;
+-
+- /* Send the character out.
+- * If the buffer address is in the CPM DPRAM, don't
+- * convert it.
+- */
+- cp = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), pinfo);
+- *cp = *s;
+-
+- out_be16(&bdp->cbd_datlen, 1);
+- setbits16(&bdp->cbd_sc, BD_SC_READY);
+-
+- if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
+- bdp = bdbase;
+- else
+- bdp++;
+-
+- /* if a LF, also do CR... */
+- if (*s == 10) {
+- while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+- ;
+-
+- cp = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), pinfo);
+- *cp = 13;
+-
+- out_be16(&bdp->cbd_datlen, 1);
+- setbits16(&bdp->cbd_sc, BD_SC_READY);
+-
+- if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
+- bdp = bdbase;
+- else
+- bdp++;
+- }
+- }
+-
+- /*
+- * Finally, Wait for transmitter & holding register to empty
+- * and restore the IER
+- */
+- while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+- ;
+-
+- pinfo->tx_cur = bdp;
++ cpm_uart_early_write(pinfo, s, count);
+
+ if (unlikely(nolock)) {
+ local_irq_restore(flags);
+diff --git a/drivers/ssb/driver_chipcommon.c b/drivers/ssb/driver_chipcommon.c
+index 9681536..bbf1cb2 100644
+--- a/drivers/ssb/driver_chipcommon.c
++++ b/drivers/ssb/driver_chipcommon.c
+@@ -233,6 +233,9 @@ void ssb_chipcommon_init(struct ssb_chipcommon *cc)
+ {
+ if (!cc->dev)
+ return; /* We don't have a ChipCommon */
++ if (cc->dev->id.revision >= 11)
++ cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT);
++ ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status);
+ ssb_pmu_init(cc);
+ chipco_powercontrol_init(cc);
+ ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST);
+diff --git a/drivers/ssb/driver_chipcommon_pmu.c b/drivers/ssb/driver_chipcommon_pmu.c
+index 64abd11..8e194d5 100644
+--- a/drivers/ssb/driver_chipcommon_pmu.c
++++ b/drivers/ssb/driver_chipcommon_pmu.c
+@@ -495,9 +495,9 @@ static void ssb_pmu_resources_init(struct ssb_chipcommon *cc)
+ chipco_write32(cc, SSB_CHIPCO_PMU_MAXRES_MSK, max_msk);
+ }
+
++/* http://bcm-v4.sipsolutions.net/802.11/SSB/PmuInit */
+ void ssb_pmu_init(struct ssb_chipcommon *cc)
+ {
+- struct ssb_bus *bus = cc->dev->bus;
+ u32 pmucap;
+
+ if (!(cc->capabilities & SSB_CHIPCO_CAP_PMU))
+@@ -509,15 +509,12 @@ void ssb_pmu_init(struct ssb_chipcommon *cc)
+ ssb_dprintk(KERN_DEBUG PFX "Found rev %u PMU (capabilities 0x%08X)\n",
+ cc->pmu.rev, pmucap);
+
+- if (cc->pmu.rev >= 1) {
+- if ((bus->chip_id == 0x4325) && (bus->chip_rev < 2)) {
+- chipco_mask32(cc, SSB_CHIPCO_PMU_CTL,
+- ~SSB_CHIPCO_PMU_CTL_NOILPONW);
+- } else {
+- chipco_set32(cc, SSB_CHIPCO_PMU_CTL,
+- SSB_CHIPCO_PMU_CTL_NOILPONW);
+- }
+- }
++ if (cc->pmu.rev == 1)
++ chipco_mask32(cc, SSB_CHIPCO_PMU_CTL,
++ ~SSB_CHIPCO_PMU_CTL_NOILPONW);
++ else
++ chipco_set32(cc, SSB_CHIPCO_PMU_CTL,
++ SSB_CHIPCO_PMU_CTL_NOILPONW);
+ ssb_pmu_pll_init(cc);
+ ssb_pmu_resources_init(cc);
+ }
+diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
+index 9e50896..17a1781 100644
+--- a/drivers/ssb/pci.c
++++ b/drivers/ssb/pci.c
+@@ -22,6 +22,7 @@
+
+ #include "ssb_private.h"
+
++bool ssb_is_sprom_available(struct ssb_bus *bus);
+
+ /* Define the following to 1 to enable a printk on each coreswitch. */
+ #define SSB_VERBOSE_PCICORESWITCH_DEBUG 0
+@@ -167,7 +168,7 @@ err_pci:
+ }
+
+ /* Get the word-offset for a SSB_SPROM_XXX define. */
+-#define SPOFF(offset) (((offset) - SSB_SPROM_BASE) / sizeof(u16))
++#define SPOFF(offset) ((offset) / sizeof(u16))
+ /* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */
+ #define SPEX16(_outvar, _offset, _mask, _shift) \
+ out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
+@@ -252,8 +253,13 @@ static int sprom_do_read(struct ssb_bus *bus, u16 *sprom)
+ {
+ int i;
+
++ /* Check if SPROM can be read */
++ if (ioread16(bus->mmio + bus->sprom_offset) == 0xFFFF) {
++ ssb_printk(KERN_ERR PFX "Unable to read SPROM\n");
++ return -ENODEV;
++ }
+ for (i = 0; i < bus->sprom_size; i++)
+- sprom[i] = ioread16(bus->mmio + SSB_SPROM_BASE + (i * 2));
++ sprom[i] = ioread16(bus->mmio + bus->sprom_offset + (i * 2));
+
+ return 0;
+ }
+@@ -284,7 +290,7 @@ static int sprom_do_write(struct ssb_bus *bus, const u16 *sprom)
+ ssb_printk("75%%");
+ else if (i % 2)
+ ssb_printk(".");
+- writew(sprom[i], bus->mmio + SSB_SPROM_BASE + (i * 2));
++ writew(sprom[i], bus->mmio + bus->sprom_offset + (i * 2));
+ mmiowb();
+ msleep(20);
+ }
+@@ -620,21 +626,49 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
+ int err = -ENOMEM;
+ u16 *buf;
+
++ if (!ssb_is_sprom_available(bus)) {
++ ssb_printk(KERN_ERR PFX "No SPROM available!\n");
++ return -ENODEV;
++ }
++ if (bus->chipco.dev) { /* can be unavailible! */
++ /*
++ * get SPROM offset: SSB_SPROM_BASE1 except for
++ * chipcommon rev >= 31 or chip ID is 0x4312 and
++ * chipcommon status & 3 == 2
++ */
++ if (bus->chipco.dev->id.revision >= 31)
++ bus->sprom_offset = SSB_SPROM_BASE31;
++ else if (bus->chip_id == 0x4312 &&
++ (bus->chipco.status & 0x03) == 2)
++ bus->sprom_offset = SSB_SPROM_BASE31;
++ else
++ bus->sprom_offset = SSB_SPROM_BASE1;
++ } else {
++ bus->sprom_offset = SSB_SPROM_BASE1;
++ }
++ ssb_dprintk(KERN_INFO PFX "SPROM offset is 0x%x\n", bus->sprom_offset);
++
+ buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
+ if (!buf)
+ goto out;
+ bus->sprom_size = SSB_SPROMSIZE_WORDS_R123;
+- sprom_do_read(bus, buf);
++ err = sprom_do_read(bus, buf);
++ if (err)
++ goto out_free;
+ err = sprom_check_crc(buf, bus->sprom_size);
+ if (err) {
+ /* try for a 440 byte SPROM - revision 4 and higher */
+ kfree(buf);
+ buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
+ GFP_KERNEL);
+- if (!buf)
++ if (!buf) {
++ err = -ENOMEM;
+ goto out;
++ }
+ bus->sprom_size = SSB_SPROMSIZE_WORDS_R4;
+- sprom_do_read(bus, buf);
++ err = sprom_do_read(bus, buf);
++ if (err)
++ goto out_free;
+ err = sprom_check_crc(buf, bus->sprom_size);
+ if (err) {
+ /* All CRC attempts failed.
+diff --git a/drivers/ssb/sprom.c b/drivers/ssb/sprom.c
+index eb70843..5f7154d 100644
+--- a/drivers/ssb/sprom.c
++++ b/drivers/ssb/sprom.c
+@@ -179,3 +179,18 @@ const struct ssb_sprom *ssb_get_fallback_sprom(void)
+ {
+ return fallback_sprom;
+ }
++
++/* http://bcm-v4.sipsolutions.net/802.11/IsSpromAvailable */
++bool ssb_is_sprom_available(struct ssb_bus *bus)
++{
++ /* status register only exists on chipcomon rev >= 11 and we need check
++ for >= 31 only */
++ /* this routine differs from specs as we do not access SPROM directly
++ on PCMCIA */
++ if (bus->bustype == SSB_BUSTYPE_PCI &&
++ bus->chipco.dev && /* can be unavailible! */
++ bus->chipco.dev->id.revision >= 31)
++ return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM;
++
++ return true;
++}
+diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
+index 88644ef..6d52d6a 100644
+diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
+index 34fc7bb..d784a8b 100644
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -1743,9 +1743,6 @@ int usb_external_resume_device(struct usb_device *udev, pm_message_t msg)
+
+ static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
+ {
+- int w, i;
+- struct usb_interface *intf;
+-
+ /* Remote wakeup is needed only when we actually go to sleep.
+ * For things like FREEZE and QUIESCE, if the device is already
+ * autosuspended then its current wakeup setting is okay.
+@@ -1755,18 +1752,10 @@ static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
+ return;
+ }
+
+- /* If remote wakeup is permitted, see whether any interface drivers
++ /* Allow remote wakeup if it is enabled, even if no interface drivers
+ * actually want it.
+ */
+- w = 0;
+- if (device_may_wakeup(&udev->dev) && udev->actconfig) {
+- for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
+- intf = udev->actconfig->interface[i];
+- w |= intf->needs_remote_wakeup;
+- }
+- }
+-
+- udev->do_remote_wakeup = w;
++ udev->do_remote_wakeup = device_may_wakeup(&udev->dev);
+ }
+
+ int usb_suspend(struct device *dev, pm_message_t msg)
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index ab93918..a61f160 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -41,6 +41,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Philips PSC805 audio device */
+ { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Artisman Watchdog Dongle */
++ { USB_DEVICE(0x04b4, 0x0526), .driver_info =
++ USB_QUIRK_CONFIG_INTF_STRINGS },
++
+ /* Roland SC-8820 */
+ { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
+
+@@ -64,6 +68,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
+ { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
+
++ /* Broadcom BCM92035DGROM BT dongle */
++ { USB_DEVICE(0x0a5c, 0x2021), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Action Semiconductor flash disk */
+ { USB_DEVICE(0x10d6, 0x2200), .driver_info =
+ USB_QUIRK_STRING_FETCH_255 },
+diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
+index adf8260..9e5f9f1 100644
+--- a/drivers/usb/gadget/u_serial.c
++++ b/drivers/usb/gadget/u_serial.c
+@@ -535,17 +535,11 @@ recycle:
+ list_move(&req->list, &port->read_pool);
+ }
+
+- /* Push from tty to ldisc; this is immediate with low_latency, and
+- * may trigger callbacks to this driver ... so drop the spinlock.
++ /* Push from tty to ldisc; without low_latency set this is handled by
++ * a workqueue, so we won't get callbacks and can hold port_lock
+ */
+ if (tty && do_push) {
+- spin_unlock_irq(&port->port_lock);
+ tty_flip_buffer_push(tty);
+- wake_up_interruptible(&tty->read_wait);
+- spin_lock_irq(&port->port_lock);
+-
+- /* tty may have been closed */
+- tty = port->port_tty;
+ }
+
+
+@@ -783,11 +777,6 @@ static int gs_open(struct tty_struct *tty, struct file *file)
+ port->open_count = 1;
+ port->openclose = false;
+
+- /* low_latency means ldiscs work in tasklet context, without
+- * needing a workqueue schedule ... easier to keep up.
+- */
+- tty->low_latency = 1;
+-
+ /* if connected, start the I/O stream */
+ if (port->port_usb) {
+ struct gserial *gser = port->port_usb;
+@@ -1194,6 +1183,7 @@ void gserial_cleanup(void)
+ n_ports = 0;
+
+ tty_unregister_driver(gs_tty_driver);
++ put_tty_driver(gs_tty_driver);
+ gs_tty_driver = NULL;
+
+ pr_debug("%s: cleaned up ttyGS* support\n", __func__);
+diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
+index 8b37a4b..be41ec3 100644
+--- a/drivers/usb/misc/sisusbvga/sisusb.c
++++ b/drivers/usb/misc/sisusbvga/sisusb.c
+@@ -2435,7 +2435,8 @@ sisusb_open(struct inode *inode, struct file *file)
+ }
+
+ if (!sisusb->devinit) {
+- if (sisusb->sisusb_dev->speed == USB_SPEED_HIGH) {
++ if (sisusb->sisusb_dev->speed == USB_SPEED_HIGH ||
++ sisusb->sisusb_dev->speed == USB_SPEED_SUPER) {
+ if (sisusb_init_gfxdevice(sisusb, 0)) {
+ mutex_unlock(&sisusb->lock);
+ dev_err(&sisusb->sisusb_dev->dev, "Failed to initialize device\n");
+@@ -3167,7 +3168,7 @@ static int sisusb_probe(struct usb_interface *intf,
+
+ sisusb->present = 1;
+
+- if (dev->speed == USB_SPEED_HIGH) {
++ if (dev->speed == USB_SPEED_HIGH || dev->speed == USB_SPEED_SUPER) {
+ int initscreen = 1;
+ #ifdef INCL_SISUSB_CON
+ if (sisusb_first_vc > 0 &&
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index bf56be1..8de8572 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -697,6 +697,7 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+ { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
+ { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
+@@ -743,6 +744,14 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, MJSG_SR_RADIO_PID) },
+ { USB_DEVICE(FTDI_VID, MJSG_HD_RADIO_PID) },
+ { USB_DEVICE(FTDI_VID, MJSG_XM_RADIO_PID) },
++ { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_ST_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SLITE_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH2_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH4_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { }, /* Optional parameter entry */
+ { } /* Terminating entry */
+ };
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 8f9e805..ffdcec7 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -703,6 +703,12 @@
+ #define TELLDUS_TELLSTICK_PID 0x0C30 /* RF control dongle 433 MHz using FT232RL */
+
+ /*
++ * RT Systems programming cables for various ham radios
++ */
++#define RTSYSTEMS_VID 0x2100 /* Vendor ID */
++#define RTSYSTEMS_SERIAL_VX7_PID 0x9e52 /* Serial converter for VX-7 Radios using FT232RL */
++
++/*
+ * Bayer Ascensia Contour blood glucose meter USB-converter cable.
+ * http://winglucofacts.com/cables/
+ */
+@@ -1024,3 +1030,12 @@
+ #define MJSG_SR_RADIO_PID 0x9379
+ #define MJSG_XM_RADIO_PID 0x937A
+ #define MJSG_HD_RADIO_PID 0x937C
++
++/*
++ * Xverve Signalyzer tools (http://www.signalyzer.com/)
++ */
++#define XVERVE_SIGNALYZER_ST_PID 0xBCA0
++#define XVERVE_SIGNALYZER_SLITE_PID 0xBCA1
++#define XVERVE_SIGNALYZER_SH2_PID 0xBCA2
++#define XVERVE_SIGNALYZER_SH4_PID 0xBCA4
++
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index fac0732..2586023 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -226,6 +226,7 @@ static int option_resume(struct usb_serial *serial);
+ #define AMOI_PRODUCT_H01 0x0800
+ #define AMOI_PRODUCT_H01A 0x7002
+ #define AMOI_PRODUCT_H02 0x0802
++#define AMOI_PRODUCT_SKYPEPHONE_S2 0x0407
+
+ #define DELL_VENDOR_ID 0x413C
+
+@@ -316,6 +317,7 @@ static int option_resume(struct usb_serial *serial);
+ #define QISDA_PRODUCT_H21_4512 0x4512
+ #define QISDA_PRODUCT_H21_4523 0x4523
+ #define QISDA_PRODUCT_H20_4515 0x4515
++#define QISDA_PRODUCT_H20_4518 0x4518
+ #define QISDA_PRODUCT_H20_4519 0x4519
+
+ /* TLAYTECH PRODUCTS */
+@@ -503,6 +505,7 @@ static struct usb_device_id option_ids[] = {
+ { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
+ { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
+ { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H02) },
++ { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_SKYPEPHONE_S2) },
+
+ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_MINICARD) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite EV620 CDMA/EV-DO */
+ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5500_MINICARD) }, /* Dell Wireless 5500 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
+@@ -836,6 +839,7 @@ static struct usb_device_id option_ids[] = {
+ { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4512) },
+ { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4523) },
+ { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4515) },
++ { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4518) },
+ { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4519) },
+ { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) },
+ { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index 54f8494..328578b 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -210,6 +210,7 @@ static struct usb_device_id id_table [] = {
+ { USB_DEVICE(0x1199, 0x0021) }, /* Sierra Wireless AirCard 597E */
+ { USB_DEVICE(0x1199, 0x0112) }, /* Sierra Wireless AirCard 580 */
+ { USB_DEVICE(0x1199, 0x0120) }, /* Sierra Wireless USB Dongle 595U */
++ { USB_DEVICE(0x1199, 0x0301) }, /* Sierra Wireless USB Dongle 250U */
+ /* Sierra Wireless C597 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x0023, 0xFF, 0xFF, 0xFF) },
+ /* Sierra Wireless T598 */
+diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
+index 7127bfe..d43859f 100644
+--- a/drivers/virtio/virtio_pci.c
++++ b/drivers/virtio/virtio_pci.c
+@@ -635,6 +635,9 @@ static int __devinit virtio_pci_probe(struct pci_dev *pci_dev,
+ INIT_LIST_HEAD(&vp_dev->virtqueues);
+ spin_lock_init(&vp_dev->lock);
+
++ /* Disable MSI/MSIX to bring device to a known good state. */
++ pci_msi_off(pci_dev);
++
+ /* enable the device */
+ err = pci_enable_device(pci_dev);
+ if (err)
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 64f6b2f..b9840fa 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -947,7 +947,7 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
+ */
+
+ /* the destination must be opened for writing */
+- if (!(file->f_mode & FMODE_WRITE))
++ if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND))
+ return -EINVAL;
+
+ ret = mnt_want_write(file->f_path.mnt);
+@@ -1000,7 +1000,7 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
+
+ /* determine range to clone */
+ ret = -EINVAL;
+- if (off >= src->i_size || off + len > src->i_size)
++ if (off + len > src->i_size || off + len < off)
+ goto out_unlock;
+ if (len == 0)
+ olen = len = src->i_size - off;
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 29f1da7..1445407 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -1033,7 +1033,7 @@ init_cifs(void)
+ goto out_unregister_filesystem;
+ #endif
+ #ifdef CONFIG_CIFS_DFS_UPCALL
+- rc = register_key_type(&key_type_dns_resolver);
++ rc = cifs_init_dns_resolver();
+ if (rc)
+ goto out_unregister_key_type;
+ #endif
+@@ -1045,7 +1045,7 @@ init_cifs(void)
+
+ out_unregister_resolver_key:
+ #ifdef CONFIG_CIFS_DFS_UPCALL
+- unregister_key_type(&key_type_dns_resolver);
++ cifs_exit_dns_resolver();
+ out_unregister_key_type:
+ #endif
+ #ifdef CONFIG_CIFS_UPCALL
+@@ -1071,7 +1071,7 @@ exit_cifs(void)
+ cifs_proc_clean();
+ #ifdef CONFIG_CIFS_DFS_UPCALL
+ cifs_dfs_release_automount_timer();
+- unregister_key_type(&key_type_dns_resolver);
++ cifs_exit_dns_resolver();
+ #endif
+ #ifdef CONFIG_CIFS_UPCALL
+ unregister_key_type(&cifs_spnego_key_type);
+diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
+index 8794814..16f31c1 100644
+--- a/fs/cifs/dns_resolve.c
++++ b/fs/cifs/dns_resolve.c
+@@ -23,12 +23,16 @@
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
++#include <linux/keyctl.h>
++#include <linux/key-type.h>
+ #include <keys/user-type.h>
+ #include "dns_resolve.h"
+ #include "cifsglob.h"
+ #include "cifsproto.h"
+ #include "cifs_debug.h"
+
++static const struct cred *dns_resolver_cache;
++
+ /* Checks if supplied name is IP address
+ * returns:
+ * 1 - name is IP
+@@ -93,6 +97,7 @@ struct key_type key_type_dns_resolver = {
+ int
+ dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
+ {
++ const struct cred *saved_cred;
+ int rc = -EAGAIN;
+ struct key *rkey = ERR_PTR(-EAGAIN);
+ char *name;
+@@ -132,8 +137,15 @@ dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
+ goto skip_upcall;
+ }
+
++ saved_cred = override_creds(dns_resolver_cache);
+ rkey = request_key(&key_type_dns_resolver, name, "");
++ revert_creds(saved_cred);
+ if (!IS_ERR(rkey)) {
++ if (!(rkey->perm & KEY_USR_VIEW)) {
++ down_read(&rkey->sem);
++ rkey->perm |= KEY_USR_VIEW;
++ up_read(&rkey->sem);
++ }
+ len = rkey->type_data.x[0];
+ data = rkey->payload.data;
+ } else {
+@@ -164,4 +176,61 @@ out:
+ return rc;
+ }
+
++int __init cifs_init_dns_resolver(void)
++{
++ struct cred *cred;
++ struct key *keyring;
++ int ret;
++
++ printk(KERN_NOTICE "Registering the %s key type\n",
++ key_type_dns_resolver.name);
++
++ /* create an override credential set with a special thread keyring in
++ * which DNS requests are cached
++ *
++ * this is used to prevent malicious redirections from being installed
++ * with add_key().
++ */
++ cred = prepare_kernel_cred(NULL);
++ if (!cred)
++ return -ENOMEM;
++
++ keyring = key_alloc(&key_type_keyring, ".dns_resolver", 0, 0, cred,
++ (KEY_POS_ALL & ~KEY_POS_SETATTR) |
++ KEY_USR_VIEW | KEY_USR_READ,
++ KEY_ALLOC_NOT_IN_QUOTA);
++ if (IS_ERR(keyring)) {
++ ret = PTR_ERR(keyring);
++ goto failed_put_cred;
++ }
++
++ ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL);
++ if (ret < 0)
++ goto failed_put_key;
++
++ ret = register_key_type(&key_type_dns_resolver);
++ if (ret < 0)
++ goto failed_put_key;
++
++ /* instruct request_key() to use this special keyring as a cache for
++ * the results it looks up */
++ cred->thread_keyring = keyring;
++ cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
++ dns_resolver_cache = cred;
++ return 0;
++
++failed_put_key:
++ key_put(keyring);
++failed_put_cred:
++ put_cred(cred);
++ return ret;
++}
+
++void __exit cifs_exit_dns_resolver(void)
++{
++ key_revoke(dns_resolver_cache->thread_keyring);
++ unregister_key_type(&key_type_dns_resolver);
++ put_cred(dns_resolver_cache);
++ printk(KERN_NOTICE "Unregistered %s key type\n",
++ key_type_dns_resolver.name);
++}
+diff --git a/fs/cifs/dns_resolve.h b/fs/cifs/dns_resolve.h
+index 966e928..26b9eaa 100644
+--- a/fs/cifs/dns_resolve.h
++++ b/fs/cifs/dns_resolve.h
+@@ -24,8 +24,8 @@
+ #define _DNS_RESOLVE_H
+
+ #ifdef __KERNEL__
+-#include <linux/key-type.h>
+-extern struct key_type key_type_dns_resolver;
++extern int __init cifs_init_dns_resolver(void);
++extern void __exit cifs_exit_dns_resolver(void);
+ extern int dns_resolve_server_name_to_ip(const char *unc, char **ip_addr);
+ #endif /* KERNEL */
+
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index a104ca3..303fd7f 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -1284,6 +1284,10 @@ cifs_do_rename(int xid, struct dentry *from_dentry, const char *fromPath,
+ if (rc == 0 || rc != -ETXTBSY)
+ return rc;
+
++ /* open-file renames don't work across directories */
++ if (to_dentry->d_parent != from_dentry->d_parent)
++ return rc;
++
+ /* open the file to be renamed -- we need DELETE perms */
+ rc = CIFSSMBOpen(xid, pTcon, fromPath, FILE_OPEN, DELETE,
+ CREATE_NOT_DIR, &srcfid, &oplock, NULL,
+diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
+index 7085a62..6d6ff4f 100644
+--- a/fs/cifs/sess.c
++++ b/fs/cifs/sess.c
+@@ -723,15 +723,7 @@ ssetup_ntlmssp_authenticate:
+
+ /* calculate session key */
+ setup_ntlmv2_rsp(ses, v2_sess_key, nls_cp);
+- if (first_time) /* should this be moved into common code
+- with similar ntlmv2 path? */
+- /* cifs_calculate_ntlmv2_mac_key(ses->server->mac_signing_key,
+- response BB FIXME, v2_sess_key); */
+-
+- /* copy session key */
+-
+- /* memcpy(bcc_ptr, (char *)ntlm_session_key,LM2_SESS_KEY_SIZE);
+- bcc_ptr += LM2_SESS_KEY_SIZE; */
++ /* FIXME: calculate MAC key */
+ memcpy(bcc_ptr, (char *)v2_sess_key,
+ sizeof(struct ntlmv2_resp));
+ bcc_ptr += sizeof(struct ntlmv2_resp);
+diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c
+index f1c17e8..3dfe7ce 100644
+--- a/fs/ecryptfs/messaging.c
++++ b/fs/ecryptfs/messaging.c
+@@ -30,9 +30,9 @@ static struct mutex ecryptfs_msg_ctx_lists_mux;
+
+ static struct hlist_head *ecryptfs_daemon_hash;
+ struct mutex ecryptfs_daemon_hash_mux;
+-static int ecryptfs_hash_buckets;
++static int ecryptfs_hash_bits;
+ #define ecryptfs_uid_hash(uid) \
+- hash_long((unsigned long)uid, ecryptfs_hash_buckets)
++ hash_long((unsigned long)uid, ecryptfs_hash_bits)
+
+ static u32 ecryptfs_msg_counter;
+ static struct ecryptfs_msg_ctx *ecryptfs_msg_ctx_arr;
+@@ -485,18 +485,19 @@ int ecryptfs_init_messaging(void)
+ }
+ mutex_init(&ecryptfs_daemon_hash_mux);
+ mutex_lock(&ecryptfs_daemon_hash_mux);
+- ecryptfs_hash_buckets = 1;
+- while (ecryptfs_number_of_users >> ecryptfs_hash_buckets)
+- ecryptfs_hash_buckets++;
++ ecryptfs_hash_bits = 1;
++ while (ecryptfs_number_of_users >> ecryptfs_hash_bits)
++ ecryptfs_hash_bits++;
+ ecryptfs_daemon_hash = kmalloc((sizeof(struct hlist_head)
+- * ecryptfs_hash_buckets), GFP_KERNEL);
++ * (1 << ecryptfs_hash_bits)),
++ GFP_KERNEL);
+ if (!ecryptfs_daemon_hash) {
+ rc = -ENOMEM;
+ printk(KERN_ERR "%s: Failed to allocate memory\n", __func__);
+ mutex_unlock(&ecryptfs_daemon_hash_mux);
+ goto out;
+ }
+- for (i = 0; i < ecryptfs_hash_buckets; i++)
++ for (i = 0; i < (1 << ecryptfs_hash_bits); i++)
+ INIT_HLIST_HEAD(&ecryptfs_daemon_hash[i]);
+ mutex_unlock(&ecryptfs_daemon_hash_mux);
+ ecryptfs_msg_ctx_arr = kmalloc((sizeof(struct ecryptfs_msg_ctx)
+@@ -553,7 +554,7 @@ void ecryptfs_release_messaging(void)
+ int i;
+
+ mutex_lock(&ecryptfs_daemon_hash_mux);
+- for (i = 0; i < ecryptfs_hash_buckets; i++) {
++ for (i = 0; i < (1 << ecryptfs_hash_bits); i++) {
+ int rc;
+
+ hlist_for_each_entry(daemon, elem,
+diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
+index 9dc9316..aa6fb6b 100644
+--- a/fs/ext4/dir.c
++++ b/fs/ext4/dir.c
+@@ -84,9 +84,11 @@ int ext4_check_dir_entry(const char *function, struct inode *dir,
+
+ if (error_msg != NULL)
+ ext4_error(dir->i_sb, function,
+- "bad entry in directory #%lu: %s - "
+- "offset=%u, inode=%u, rec_len=%d, name_len=%d",
+- dir->i_ino, error_msg, offset,
++ "bad entry in directory #%lu: %s - block=%llu"
++ "offset=%u(%u), inode=%u, rec_len=%d, name_len=%d",
++ dir->i_ino, error_msg,
++ (unsigned long long) bh->b_blocknr,
++ (unsigned) (offset%bh->b_size), offset,
+ le32_to_cpu(de->inode),
+ rlen, de->name_len);
+ return error_msg == NULL ? 1 : 0;
+@@ -109,7 +111,7 @@ static int ext4_readdir(struct file *filp,
+
+ if (EXT4_HAS_COMPAT_FEATURE(inode->i_sb,
+ EXT4_FEATURE_COMPAT_DIR_INDEX) &&
+- ((EXT4_I(inode)->i_flags & EXT4_INDEX_FL) ||
++ ((ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) ||
+ ((inode->i_size >> sb->s_blocksize_bits) == 1))) {
+ err = ext4_dx_readdir(filp, dirent, filldir);
+ if (err != ERR_BAD_DX_DIR) {
+@@ -120,7 +122,7 @@ static int ext4_readdir(struct file *filp,
+ * We don't set the inode dirty flag since it's not
+ * critical that it get flushed back to the disk.
+ */
+- EXT4_I(filp->f_path.dentry->d_inode)->i_flags &= ~EXT4_INDEX_FL;
++ ext4_clear_inode_flag(filp->f_path.dentry->d_inode, EXT4_INODE_INDEX);
+ }
+ stored = 0;
+ offset = filp->f_pos & (sb->s_blocksize - 1);
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 4a825c1..fa6b79f 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -29,6 +29,9 @@
+ #include <linux/wait.h>
+ #include <linux/blockgroup_lock.h>
+ #include <linux/percpu_counter.h>
++#ifdef __KERNEL__
++#include <linux/compat.h>
++#endif
+
+ /*
+ * The fourth extended filesystem constants/structures
+@@ -284,10 +287,12 @@ struct flex_groups {
+ #define EXT4_TOPDIR_FL 0x00020000 /* Top of directory hierarchies*/
+ #define EXT4_HUGE_FILE_FL 0x00040000 /* Set to each huge file */
+ #define EXT4_EXTENTS_FL 0x00080000 /* Inode uses extents */
++#define EXT4_EA_INODE_FL 0x00200000 /* Inode used for large EA */
++#define EXT4_EOFBLOCKS_FL 0x00400000 /* Blocks allocated beyond EOF */
+ #define EXT4_RESERVED_FL 0x80000000 /* reserved for ext4 lib */
+
+-#define EXT4_FL_USER_VISIBLE 0x000BDFFF /* User visible flags */
+-#define EXT4_FL_USER_MODIFIABLE 0x000B80FF /* User modifiable flags */
++#define EXT4_FL_USER_VISIBLE 0x004BDFFF /* User visible flags */
++#define EXT4_FL_USER_MODIFIABLE 0x004B80FF /* User modifiable flags */
+
+ /* Flags that should be inherited by new inodes from their parent. */
+ #define EXT4_FL_INHERITED (EXT4_SECRM_FL | EXT4_UNRM_FL | EXT4_COMPR_FL |\
+@@ -314,15 +319,81 @@ static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags)
+ }
+
+ /*
+- * Inode dynamic state flags
++ * Inode flags used for atomic set/get
++ */
++enum {
++ EXT4_INODE_SECRM = 0, /* Secure deletion */
++ EXT4_INODE_UNRM = 1, /* Undelete */
++ EXT4_INODE_COMPR = 2, /* Compress file */
++ EXT4_INODE_SYNC = 3, /* Synchronous updates */
++ EXT4_INODE_IMMUTABLE = 4, /* Immutable file */
++ EXT4_INODE_APPEND = 5, /* writes to file may only append */
++ EXT4_INODE_NODUMP = 6, /* do not dump file */
++ EXT4_INODE_NOATIME = 7, /* do not update atime */
++/* Reserved for compression usage... */
++ EXT4_INODE_DIRTY = 8,
++ EXT4_INODE_COMPRBLK = 9, /* One or more compressed clusters */
++ EXT4_INODE_NOCOMPR = 10, /* Don't compress */
++ EXT4_INODE_ECOMPR = 11, /* Compression error */
++/* End compression flags --- maybe not all used */
++ EXT4_INODE_INDEX = 12, /* hash-indexed directory */
++ EXT4_INODE_IMAGIC = 13, /* AFS directory */
++ EXT4_INODE_JOURNAL_DATA = 14, /* file data should be journaled */
++ EXT4_INODE_NOTAIL = 15, /* file tail should not be merged */
++ EXT4_INODE_DIRSYNC = 16, /* dirsync behaviour (directories only) */
++ EXT4_INODE_TOPDIR = 17, /* Top of directory hierarchies*/
++ EXT4_INODE_HUGE_FILE = 18, /* Set to each huge file */
++ EXT4_INODE_EXTENTS = 19, /* Inode uses extents */
++ EXT4_INODE_EA_INODE = 21, /* Inode used for large EA */
++ EXT4_INODE_EOFBLOCKS = 22, /* Blocks allocated beyond EOF */
++ EXT4_INODE_RESERVED = 31, /* reserved for ext4 lib */
++};
++
++#define TEST_FLAG_VALUE(FLAG) (EXT4_##FLAG##_FL == (1 << EXT4_INODE_##FLAG))
++#define CHECK_FLAG_VALUE(FLAG) if (!TEST_FLAG_VALUE(FLAG)) { \
++ printk(KERN_EMERG "EXT4 flag fail: " #FLAG ": %d %d\n", \
++ EXT4_##FLAG##_FL, EXT4_INODE_##FLAG); BUG_ON(1); }
++
++/*
++ * Since it's pretty easy to mix up bit numbers and hex values, and we
++ * can't do a compile-time test for ENUM values, we use a run-time
++ * test to make sure that EXT4_XXX_FL is consistent with respect to
++ * EXT4_INODE_XXX. If all is well the printk and BUG_ON will all drop
++ * out so it won't cost any extra space in the compiled kernel image.
++ * But it's important that these values are the same, since we are
++ * using EXT4_INODE_XXX to test for the flag values, but EXT4_XX_FL
++ * must be consistent with the values of FS_XXX_FL defined in
++ * include/linux/fs.h and the on-disk values found in ext2, ext3, and
++ * ext4 filesystems, and of course the values defined in e2fsprogs.
++ *
++ * It's not paranoia if the Murphy's Law really *is* out to get you. :-)
+ */
+-#define EXT4_STATE_JDATA 0x00000001 /* journaled data exists */
+-#define EXT4_STATE_NEW 0x00000002 /* inode is newly created */
+-#define EXT4_STATE_XATTR 0x00000004 /* has in-inode xattrs */
+-#define EXT4_STATE_NO_EXPAND 0x00000008 /* No space for expansion */
+-#define EXT4_STATE_DA_ALLOC_CLOSE 0x00000010 /* Alloc DA blks on close */
+-#define EXT4_STATE_EXT_MIGRATE 0x00000020 /* Inode is migrating */
+-#define EXT4_STATE_DIO_UNWRITTEN 0x00000040 /* need convert on dio done*/
++static inline void ext4_check_flag_values(void)
++{
++ CHECK_FLAG_VALUE(SECRM);
++ CHECK_FLAG_VALUE(UNRM);
++ CHECK_FLAG_VALUE(COMPR);
++ CHECK_FLAG_VALUE(SYNC);
++ CHECK_FLAG_VALUE(IMMUTABLE);
++ CHECK_FLAG_VALUE(APPEND);
++ CHECK_FLAG_VALUE(NODUMP);
++ CHECK_FLAG_VALUE(NOATIME);
++ CHECK_FLAG_VALUE(DIRTY);
++ CHECK_FLAG_VALUE(COMPRBLK);
++ CHECK_FLAG_VALUE(NOCOMPR);
++ CHECK_FLAG_VALUE(ECOMPR);
++ CHECK_FLAG_VALUE(INDEX);
++ CHECK_FLAG_VALUE(IMAGIC);
++ CHECK_FLAG_VALUE(JOURNAL_DATA);
++ CHECK_FLAG_VALUE(NOTAIL);
++ CHECK_FLAG_VALUE(DIRSYNC);
++ CHECK_FLAG_VALUE(TOPDIR);
++ CHECK_FLAG_VALUE(HUGE_FILE);
++ CHECK_FLAG_VALUE(EXTENTS);
++ CHECK_FLAG_VALUE(EA_INODE);
++ CHECK_FLAG_VALUE(EOFBLOCKS);
++ CHECK_FLAG_VALUE(RESERVED);
++}
+
+ /* Used to pass group descriptor data when online resize is done */
+ struct ext4_new_group_input {
+@@ -335,6 +406,18 @@ struct ext4_new_group_input {
+ __u16 unused;
+ };
+
++#if defined(__KERNEL__) && defined(CONFIG_COMPAT)
++struct compat_ext4_new_group_input {
++ u32 group;
++ compat_u64 block_bitmap;
++ compat_u64 inode_bitmap;
++ compat_u64 inode_table;
++ u32 blocks_count;
++ u16 reserved_blocks;
++ u16 unused;
++};
++#endif
++
+ /* The struct ext4_new_group_input in kernel space, with free_blocks_count */
+ struct ext4_new_group_data {
+ __u32 group;
+@@ -361,14 +444,11 @@ struct ext4_new_group_data {
+ so set the magic i_delalloc_reserve_flag after taking the
+ inode allocation semaphore for */
+ #define EXT4_GET_BLOCKS_DELALLOC_RESERVE 0x0004
+- /* Call ext4_da_update_reserve_space() after successfully
+- allocating the blocks */
+-#define EXT4_GET_BLOCKS_UPDATE_RESERVE_SPACE 0x0008
+ /* caller is from the direct IO path, request to creation of an
+ unitialized extents if not allocated, split the uninitialized
+ extent if blocks has been preallocated already*/
+-#define EXT4_GET_BLOCKS_DIO 0x0010
+-#define EXT4_GET_BLOCKS_CONVERT 0x0020
++#define EXT4_GET_BLOCKS_DIO 0x0008
++#define EXT4_GET_BLOCKS_CONVERT 0x0010
+ #define EXT4_GET_BLOCKS_DIO_CREATE_EXT (EXT4_GET_BLOCKS_DIO|\
+ EXT4_GET_BLOCKS_CREATE_UNINIT_EXT)
+ /* Convert extent to initialized after direct IO complete */
+@@ -397,6 +477,7 @@ struct ext4_new_group_data {
+ #define EXT4_IOC_ALLOC_DA_BLKS _IO('f', 12)
+ #define EXT4_IOC_MOVE_EXT _IOWR('f', 15, struct move_extent)
+
++#if defined(__KERNEL__) && defined(CONFIG_COMPAT)
+ /*
+ * ioctl commands in 32 bit emulation
+ */
+@@ -407,11 +488,13 @@ struct ext4_new_group_data {
+ #define EXT4_IOC32_GETRSVSZ _IOR('f', 5, int)
+ #define EXT4_IOC32_SETRSVSZ _IOW('f', 6, int)
+ #define EXT4_IOC32_GROUP_EXTEND _IOW('f', 7, unsigned int)
++#define EXT4_IOC32_GROUP_ADD _IOW('f', 8, struct compat_ext4_new_group_input)
+ #ifdef CONFIG_JBD2_DEBUG
+ #define EXT4_IOC32_WAIT_FOR_READONLY _IOR('f', 99, int)
+ #endif
+ #define EXT4_IOC32_GETVERSION_OLD FS_IOC32_GETVERSION
+ #define EXT4_IOC32_SETVERSION_OLD FS_IOC32_SETVERSION
++#endif
+
+
+ /*
+@@ -615,9 +698,8 @@ struct ext4_ext_cache {
+ */
+ struct ext4_inode_info {
+ __le32 i_data[15]; /* unconverted */
+- __u32 i_flags;
+- ext4_fsblk_t i_file_acl;
+ __u32 i_dtime;
++ ext4_fsblk_t i_file_acl;
+
+ /*
+ * i_block_group is the number of the block group which contains
+@@ -627,7 +709,8 @@ struct ext4_inode_info {
+ * near to their parent directory's inode.
+ */
+ ext4_group_t i_block_group;
+- __u32 i_state; /* Dynamic state flags for ext4 */
++ unsigned long i_state_flags; /* Dynamic state flags */
++ unsigned long i_flags;
+
+ ext4_lblk_t i_dir_start_lookup;
+ #ifdef CONFIG_EXT4_FS_XATTR
+@@ -693,6 +776,8 @@ struct ext4_inode_info {
+ unsigned int i_reserved_meta_blocks;
+ unsigned int i_allocated_meta_blocks;
+ unsigned short i_delalloc_reserved_flag;
++ sector_t i_da_metadata_calc_last_lblock;
++ int i_da_metadata_calc_len;
+
+ /* on-disk additional length */
+ __u16 i_extra_isize;
+@@ -1045,6 +1130,37 @@ static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino)
+ (ino >= EXT4_FIRST_INO(sb) &&
+ ino <= le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count));
+ }
++
++/*
++ * Inode dynamic state flags
++ */
++enum {
++ EXT4_STATE_JDATA, /* journaled data exists */
++ EXT4_STATE_NEW, /* inode is newly created */
++ EXT4_STATE_XATTR, /* has in-inode xattrs */
++ EXT4_STATE_NO_EXPAND, /* No space for expansion */
++ EXT4_STATE_DA_ALLOC_CLOSE, /* Alloc DA blks on close */
++ EXT4_STATE_EXT_MIGRATE, /* Inode is migrating */
++ EXT4_STATE_DIO_UNWRITTEN, /* need convert on dio done*/
++ EXT4_STATE_NEWENTRY, /* File just added to dir */
++};
++
++#define EXT4_INODE_BIT_FNS(name, field) \
++static inline int ext4_test_inode_##name(struct inode *inode, int bit) \
++{ \
++ return test_bit(bit, &EXT4_I(inode)->i_##field); \
++} \
++static inline void ext4_set_inode_##name(struct inode *inode, int bit) \
++{ \
++ set_bit(bit, &EXT4_I(inode)->i_##field); \
++} \
++static inline void ext4_clear_inode_##name(struct inode *inode, int bit) \
++{ \
++ clear_bit(bit, &EXT4_I(inode)->i_##field); \
++}
++
++EXT4_INODE_BIT_FNS(flag, flags)
++EXT4_INODE_BIT_FNS(state, state_flags)
+ #else
+ /* Assume that user mode programs are passing in an ext4fs superblock, not
+ * a kernel struct super_block. This will allow us to call the feature-test
+@@ -1229,7 +1345,7 @@ struct ext4_dir_entry_2 {
+
+ #define is_dx(dir) (EXT4_HAS_COMPAT_FEATURE(dir->i_sb, \
+ EXT4_FEATURE_COMPAT_DIR_INDEX) && \
+- (EXT4_I(dir)->i_flags & EXT4_INDEX_FL))
++ ext4_test_inode_flag((dir), EXT4_INODE_INDEX))
+ #define EXT4_DIR_LINK_MAX(dir) (!is_dx(dir) && (dir)->i_nlink >= EXT4_LINK_MAX)
+ #define EXT4_DIR_LINK_EMPTY(dir) ((dir)->i_nlink == 2 || (dir)->i_nlink == 1)
+
+@@ -1438,6 +1554,8 @@ extern int ext4_block_truncate_page(handle_t *handle,
+ extern int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf);
+ extern qsize_t *ext4_get_reserved_space(struct inode *inode);
+ extern int flush_aio_dio_completed_IO(struct inode *inode);
++extern void ext4_da_update_reserve_space(struct inode *inode,
++ int used, int quota_claim);
+ /* ioctl.c */
+ extern long ext4_ioctl(struct file *, unsigned int, unsigned long);
+ extern long ext4_compat_ioctl(struct file *, unsigned int, unsigned long);
+@@ -1637,6 +1755,7 @@ struct ext4_group_info {
+ ext4_grpblk_t bb_first_free; /* first free block */
+ ext4_grpblk_t bb_free; /* total free blocks */
+ ext4_grpblk_t bb_fragments; /* nr of freespace fragments */
++ ext4_grpblk_t bb_largest_free_order;/* order of largest frag in BG */
+ struct list_head bb_prealloc_list;
+ #ifdef DOUBLE_CHECK
+ void *bb_bitmap;
+diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h
+index 2ca6864..bdb6ce7 100644
+--- a/fs/ext4/ext4_extents.h
++++ b/fs/ext4/ext4_extents.h
+@@ -225,7 +225,8 @@ static inline void ext4_ext_mark_initialized(struct ext4_extent *ext)
+ ext->ee_len = cpu_to_le16(ext4_ext_get_actual_len(ext));
+ }
+
+-extern int ext4_ext_calc_metadata_amount(struct inode *inode, int blocks);
++extern int ext4_ext_calc_metadata_amount(struct inode *inode,
++ sector_t lblocks);
+ extern ext4_fsblk_t ext_pblock(struct ext4_extent *ex);
+ extern ext4_fsblk_t idx_pblock(struct ext4_extent_idx *);
+ extern void ext4_ext_store_pblock(struct ext4_extent *, ext4_fsblk_t);
+diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
+index 6a94099..496249a 100644
+--- a/fs/ext4/ext4_jbd2.c
++++ b/fs/ext4/ext4_jbd2.c
+@@ -89,7 +89,7 @@ int __ext4_handle_dirty_metadata(const char *where, handle_t *handle,
+ ext4_journal_abort_handle(where, __func__, bh,
+ handle, err);
+ } else {
+- if (inode && bh)
++ if (inode)
+ mark_buffer_dirty_inode(bh, inode);
+ else
+ mark_buffer_dirty(bh);
+diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
+index 1892a77..386095d 100644
+--- a/fs/ext4/ext4_jbd2.h
++++ b/fs/ext4/ext4_jbd2.h
+@@ -282,7 +282,7 @@ static inline int ext4_should_journal_data(struct inode *inode)
+ return 1;
+ if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA)
+ return 1;
+- if (EXT4_I(inode)->i_flags & EXT4_JOURNAL_DATA_FL)
++ if (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA))
+ return 1;
+ return 0;
+ }
+@@ -293,7 +293,7 @@ static inline int ext4_should_order_data(struct inode *inode)
+ return 0;
+ if (!S_ISREG(inode->i_mode))
+ return 0;
+- if (EXT4_I(inode)->i_flags & EXT4_JOURNAL_DATA_FL)
++ if (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA))
+ return 0;
+ if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA)
+ return 1;
+@@ -306,7 +306,7 @@ static inline int ext4_should_writeback_data(struct inode *inode)
+ return 0;
+ if (EXT4_JOURNAL(inode) == NULL)
+ return 1;
+- if (EXT4_I(inode)->i_flags & EXT4_JOURNAL_DATA_FL)
++ if (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA))
+ return 0;
+ if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA)
+ return 1;
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 9e21653..99482ea 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -107,11 +107,8 @@ static int ext4_ext_truncate_extend_restart(handle_t *handle,
+ if (err <= 0)
+ return err;
+ err = ext4_truncate_restart_trans(handle, inode, needed);
+- /*
+- * We have dropped i_data_sem so someone might have cached again
+- * an extent we are going to truncate.
+- */
+- ext4_ext_invalidate_cache(inode);
++ if (err == 0)
++ err = -EAGAIN;
+
+ return err;
+ }
+@@ -296,29 +293,44 @@ static inline int ext4_ext_space_root_idx(struct inode *inode, int check)
+ * to allocate @blocks
+ * Worse case is one block per extent
+ */
+-int ext4_ext_calc_metadata_amount(struct inode *inode, int blocks)
++int ext4_ext_calc_metadata_amount(struct inode *inode, sector_t lblock)
+ {
+- int lcap, icap, rcap, leafs, idxs, num;
+- int newextents = blocks;
+-
+- rcap = ext4_ext_space_root_idx(inode, 0);
+- lcap = ext4_ext_space_block(inode, 0);
+- icap = ext4_ext_space_block_idx(inode, 0);
++ struct ext4_inode_info *ei = EXT4_I(inode);
++ int idxs, num = 0;
+
+- /* number of new leaf blocks needed */
+- num = leafs = (newextents + lcap - 1) / lcap;
++ idxs = ((inode->i_sb->s_blocksize - sizeof(struct ext4_extent_header))
++ / sizeof(struct ext4_extent_idx));
+
+ /*
+- * Worse case, we need separate index block(s)
+- * to link all new leaf blocks
++ * If the new delayed allocation block is contiguous with the
++ * previous da block, it can share index blocks with the
++ * previous block, so we only need to allocate a new index
++ * block every idxs leaf blocks. At ldxs**2 blocks, we need
++ * an additional index block, and at ldxs**3 blocks, yet
++ * another index blocks.
+ */
+- idxs = (leafs + icap - 1) / icap;
+- do {
+- num += idxs;
+- idxs = (idxs + icap - 1) / icap;
+- } while (idxs > rcap);
++ if (ei->i_da_metadata_calc_len &&
++ ei->i_da_metadata_calc_last_lblock+1 == lblock) {
++ if ((ei->i_da_metadata_calc_len % idxs) == 0)
++ num++;
++ if ((ei->i_da_metadata_calc_len % (idxs*idxs)) == 0)
++ num++;
++ if ((ei->i_da_metadata_calc_len % (idxs*idxs*idxs)) == 0) {
++ num++;
++ ei->i_da_metadata_calc_len = 0;
++ } else
++ ei->i_da_metadata_calc_len++;
++ ei->i_da_metadata_calc_last_lblock++;
++ return num;
++ }
+
+- return num;
++ /*
++ * In the worst case we need a new set of index blocks at
++ * every level of the inode's extent tree.
++ */
++ ei->i_da_metadata_calc_len = 1;
++ ei->i_da_metadata_calc_last_lblock = lblock;
++ return ext_depth(inode) + 1;
+ }
+
+ static int
+@@ -2248,7 +2260,7 @@ static int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start)
+ int depth = ext_depth(inode);
+ struct ext4_ext_path *path;
+ handle_t *handle;
+- int i = 0, err = 0;
++ int i, err;
+
+ ext_debug("truncate since %u\n", start);
+
+@@ -2257,23 +2269,26 @@ static int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start)
+ if (IS_ERR(handle))
+ return PTR_ERR(handle);
+
++again:
+ ext4_ext_invalidate_cache(inode);
+
+ /*
+ * We start scanning from right side, freeing all the blocks
+ * after i_size and walking into the tree depth-wise.
+ */
++ depth = ext_depth(inode);
+ path = kzalloc(sizeof(struct ext4_ext_path) * (depth + 1), GFP_NOFS);
+ if (path == NULL) {
+ ext4_journal_stop(handle);
+ return -ENOMEM;
+ }
++ path[0].p_depth = depth;
+ path[0].p_hdr = ext_inode_hdr(inode);
+ if (ext4_ext_check(inode, path[0].p_hdr, depth)) {
+ err = -EIO;
+ goto out;
+ }
+- path[0].p_depth = depth;
++ i = err = 0;
+
+ while (i >= 0 && err == 0) {
+ if (i == depth) {
+@@ -2367,6 +2382,8 @@ static int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start)
+ out:
+ ext4_ext_drop_refs(path);
+ kfree(path);
++ if (err == -EAGAIN)
++ goto again;
+ ext4_journal_stop(handle);
+
+ return err;
+@@ -2431,7 +2448,7 @@ static void bi_complete(struct bio *bio, int error)
+ /* FIXME!! we need to try to merge to left or right after zero-out */
+ static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex)
+ {
+- int ret = -EIO;
++ int ret;
+ struct bio *bio;
+ int blkbits, blocksize;
+ sector_t ee_pblock;
+@@ -2455,6 +2472,9 @@ static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex)
+ len = ee_len;
+
+ bio = bio_alloc(GFP_NOIO, len);
++ if (!bio)
++ return -ENOMEM;
++
+ bio->bi_sector = ee_pblock;
+ bio->bi_bdev = inode->i_sb->s_bdev;
+
+@@ -2482,17 +2502,15 @@ static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex)
+ submit_bio(WRITE, bio);
+ wait_for_completion(&event);
+
+- if (test_bit(BIO_UPTODATE, &bio->bi_flags))
+- ret = 0;
+- else {
+- ret = -EIO;
+- break;
++ if (!test_bit(BIO_UPTODATE, &bio->bi_flags)) {
++ bio_put(bio);
++ return -EIO;
+ }
+ bio_put(bio);
+ ee_len -= done;
+ ee_pblock += done << (blkbits - 9);
+ }
+- return ret;
++ return 0;
+ }
+
+ #define EXT4_EXT_ZERO_LEN 7
+@@ -2517,11 +2535,21 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
+ struct ext4_extent *ex2 = NULL;
+ struct ext4_extent *ex3 = NULL;
+ struct ext4_extent_header *eh;
+- ext4_lblk_t ee_block;
++ ext4_lblk_t ee_block, eof_block;
+ unsigned int allocated, ee_len, depth;
+ ext4_fsblk_t newblock;
+ int err = 0;
+ int ret = 0;
++ int may_zeroout;
++
++ ext_debug("ext4_ext_convert_to_initialized: inode %lu, logical"
++ "block %llu, max_blocks %u\n", inode->i_ino,
++ (unsigned long long)iblock, max_blocks);
++
++ eof_block = (inode->i_size + inode->i_sb->s_blocksize - 1) >>
++ inode->i_sb->s_blocksize_bits;
++ if (eof_block < iblock + max_blocks)
++ eof_block = iblock + max_blocks;
+
+ depth = ext_depth(inode);
+ eh = path[depth].p_hdr;
+@@ -2530,16 +2558,23 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
+ ee_len = ext4_ext_get_actual_len(ex);
+ allocated = ee_len - (iblock - ee_block);
+ newblock = iblock - ee_block + ext_pblock(ex);
++
+ ex2 = ex;
+ orig_ex.ee_block = ex->ee_block;
+ orig_ex.ee_len = cpu_to_le16(ee_len);
+ ext4_ext_store_pblock(&orig_ex, ext_pblock(ex));
+
++ /*
++ * It is safe to convert extent to initialized via explicit
++ * zeroout only if extent is fully insde i_size or new_size.
++ */
++ may_zeroout = ee_block + ee_len <= eof_block;
++
+ err = ext4_ext_get_access(handle, inode, path + depth);
+ if (err)
+ goto out;
+ /* If extent has less than 2*EXT4_EXT_ZERO_LEN zerout directly */
+- if (ee_len <= 2*EXT4_EXT_ZERO_LEN) {
++ if (ee_len <= 2*EXT4_EXT_ZERO_LEN && may_zeroout) {
+ err = ext4_ext_zeroout(inode, &orig_ex);
+ if (err)
+ goto fix_extent_len;
+@@ -2570,7 +2605,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
+ if (allocated > max_blocks) {
+ unsigned int newdepth;
+ /* If extent has less than EXT4_EXT_ZERO_LEN zerout directly */
+- if (allocated <= EXT4_EXT_ZERO_LEN) {
++ if (allocated <= EXT4_EXT_ZERO_LEN && may_zeroout) {
+ /*
+ * iblock == ee_block is handled by the zerouout
+ * at the beginning.
+@@ -2646,7 +2681,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
+ ex3->ee_len = cpu_to_le16(allocated - max_blocks);
+ ext4_ext_mark_uninitialized(ex3);
+ err = ext4_ext_insert_extent(handle, inode, path, ex3, 0);
+- if (err == -ENOSPC) {
++ if (err == -ENOSPC && may_zeroout) {
+ err = ext4_ext_zeroout(inode, &orig_ex);
+ if (err)
+ goto fix_extent_len;
+@@ -2670,8 +2705,10 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
+ * update the extent length after successful insert of the
+ * split extent
+ */
+- orig_ex.ee_len = cpu_to_le16(ee_len -
+- ext4_ext_get_actual_len(ex3));
++ ee_len -= ext4_ext_get_actual_len(ex3);
++ orig_ex.ee_len = cpu_to_le16(ee_len);
++ may_zeroout = ee_block + ee_len <= eof_block;
++
+ depth = newdepth;
+ ext4_ext_drop_refs(path);
+ path = ext4_ext_find_extent(inode, iblock, path);
+@@ -2695,7 +2732,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
+ * otherwise give the extent a chance to merge to left
+ */
+ if (le16_to_cpu(orig_ex.ee_len) <= EXT4_EXT_ZERO_LEN &&
+- iblock != ee_block) {
++ iblock != ee_block && may_zeroout) {
+ err = ext4_ext_zeroout(inode, &orig_ex);
+ if (err)
+ goto fix_extent_len;
+@@ -2764,7 +2801,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
+ goto out;
+ insert:
+ err = ext4_ext_insert_extent(handle, inode, path, &newex, 0);
+- if (err == -ENOSPC) {
++ if (err == -ENOSPC && may_zeroout) {
+ err = ext4_ext_zeroout(inode, &orig_ex);
+ if (err)
+ goto fix_extent_len;
+@@ -2824,14 +2861,21 @@ static int ext4_split_unwritten_extents(handle_t *handle,
+ struct ext4_extent *ex2 = NULL;
+ struct ext4_extent *ex3 = NULL;
+ struct ext4_extent_header *eh;
+- ext4_lblk_t ee_block;
++ ext4_lblk_t ee_block, eof_block;
+ unsigned int allocated, ee_len, depth;
+ ext4_fsblk_t newblock;
+ int err = 0;
++ int may_zeroout;
++
++ ext_debug("ext4_split_unwritten_extents: inode %lu, logical"
++ "block %llu, max_blocks %u\n", inode->i_ino,
++ (unsigned long long)iblock, max_blocks);
++
++ eof_block = (inode->i_size + inode->i_sb->s_blocksize - 1) >>
++ inode->i_sb->s_blocksize_bits;
++ if (eof_block < iblock + max_blocks)
++ eof_block = iblock + max_blocks;
+
+- ext_debug("ext4_split_unwritten_extents: inode %lu,"
+- "iblock %llu, max_blocks %u\n", inode->i_ino,
+- (unsigned long long)iblock, max_blocks);
+ depth = ext_depth(inode);
+ eh = path[depth].p_hdr;
+ ex = path[depth].p_ext;
+@@ -2839,12 +2883,19 @@ static int ext4_split_unwritten_extents(handle_t *handle,
+ ee_len = ext4_ext_get_actual_len(ex);
+ allocated = ee_len - (iblock - ee_block);
+ newblock = iblock - ee_block + ext_pblock(ex);
++
+ ex2 = ex;
+ orig_ex.ee_block = ex->ee_block;
+ orig_ex.ee_len = cpu_to_le16(ee_len);
+ ext4_ext_store_pblock(&orig_ex, ext_pblock(ex));
+
+ /*
++ * It is safe to convert extent to initialized via explicit
++ * zeroout only if extent is fully insde i_size or new_size.
++ */
++ may_zeroout = ee_block + ee_len <= eof_block;
++
++ /*
+ * If the uninitialized extent begins at the same logical
+ * block where the write begins, and the write completely
+ * covers the extent, then we don't need to split it.
+@@ -2878,7 +2929,7 @@ static int ext4_split_unwritten_extents(handle_t *handle,
+ ex3->ee_len = cpu_to_le16(allocated - max_blocks);
+ ext4_ext_mark_uninitialized(ex3);
+ err = ext4_ext_insert_extent(handle, inode, path, ex3, flags);
+- if (err == -ENOSPC) {
++ if (err == -ENOSPC && may_zeroout) {
+ err = ext4_ext_zeroout(inode, &orig_ex);
+ if (err)
+ goto fix_extent_len;
+@@ -2902,8 +2953,10 @@ static int ext4_split_unwritten_extents(handle_t *handle,
+ * update the extent length after successful insert of the
+ * split extent
+ */
+- orig_ex.ee_len = cpu_to_le16(ee_len -
+- ext4_ext_get_actual_len(ex3));
++ ee_len -= ext4_ext_get_actual_len(ex3);
++ orig_ex.ee_len = cpu_to_le16(ee_len);
++ may_zeroout = ee_block + ee_len <= eof_block;
++
+ depth = newdepth;
+ ext4_ext_drop_refs(path);
+ path = ext4_ext_find_extent(inode, iblock, path);
+@@ -2949,7 +3002,7 @@ static int ext4_split_unwritten_extents(handle_t *handle,
+ goto out;
+ insert:
+ err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
+- if (err == -ENOSPC) {
++ if (err == -ENOSPC && may_zeroout) {
+ err = ext4_ext_zeroout(inode, &orig_ex);
+ if (err)
+ goto fix_extent_len;
+@@ -3029,6 +3082,14 @@ out:
+ return err;
+ }
+
++static void unmap_underlying_metadata_blocks(struct block_device *bdev,
++ sector_t block, int count)
++{
++ int i;
++ for (i = 0; i < count; i++)
++ unmap_underlying_metadata(bdev, block + i);
++}
++
+ static int
+ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
+ ext4_lblk_t iblock, unsigned int max_blocks,
+@@ -3059,7 +3120,7 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
+ if (io)
+ io->flag = DIO_AIO_UNWRITTEN;
+ else
+- EXT4_I(inode)->i_state |= EXT4_STATE_DIO_UNWRITTEN;
++ ext4_set_inode_state(inode, EXT4_STATE_DIO_UNWRITTEN);
+ goto out;
+ }
+ /* async DIO end_io complete, convert the filled extent to written */
+@@ -3104,6 +3165,30 @@ out:
+ } else
+ allocated = ret;
+ set_buffer_new(bh_result);
++ /*
++ * if we allocated more blocks than requested
++ * we need to make sure we unmap the extra block
++ * allocated. The actual needed block will get
++ * unmapped later when we find the buffer_head marked
++ * new.
++ */
++ if (allocated > max_blocks) {
++ unmap_underlying_metadata_blocks(inode->i_sb->s_bdev,
++ newblock + max_blocks,
++ allocated - max_blocks);
++ allocated = max_blocks;
++ }
++
++ /*
++ * If we have done fallocate with the offset that is already
++ * delayed allocated, we would have block reservation
++ * and quota reservation done in the delayed write path.
++ * But fallocate would have already updated quota and block
++ * count for this offset. So cancel these reservation
++ */
++ if (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE)
++ ext4_da_update_reserve_space(inode, allocated, 0);
++
+ map_out:
+ set_buffer_mapped(bh_result);
+ out1:
+@@ -3144,9 +3229,9 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
+ {
+ struct ext4_ext_path *path = NULL;
+ struct ext4_extent_header *eh;
+- struct ext4_extent newex, *ex;
++ struct ext4_extent newex, *ex, *last_ex;
+ ext4_fsblk_t newblock;
+- int err = 0, depth, ret, cache_type;
++ int i, err = 0, depth, ret, cache_type;
+ unsigned int allocated = 0;
+ struct ext4_allocation_request ar;
+ ext4_io_end_t *io = EXT4_I(inode)->cur_aio_dio;
+@@ -3196,7 +3281,13 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
+ * this situation is possible, though, _during_ tree modification;
+ * this is why assert can't be put in ext4_ext_find_extent()
+ */
+- BUG_ON(path[depth].p_ext == NULL && depth != 0);
++ if (path[depth].p_ext == NULL && depth != 0) {
++ ext4_error(inode->i_sb, __func__, "bad extent address "
++ "inode: %lu, iblock: %lu, depth: %d",
++ inode->i_ino, (unsigned long) iblock, depth);
++ err = -EIO;
++ goto out2;
++ }
+ eh = path[depth].p_hdr;
+
+ ex = path[depth].p_ext;
+@@ -3315,10 +3406,36 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
+ if (io)
+ io->flag = DIO_AIO_UNWRITTEN;
+ else
+- EXT4_I(inode)->i_state |=
+- EXT4_STATE_DIO_UNWRITTEN;;
++ ext4_set_inode_state(inode,
++ EXT4_STATE_DIO_UNWRITTEN);
+ }
+ }
++
++ if (unlikely(ext4_test_inode_flag(inode, EXT4_INODE_EOFBLOCKS))) {
++ if (unlikely(!eh->eh_entries)) {
++ ext4_error(inode->i_sb, __func__,
++ "inode#%lu, eh->eh_entries = 0 and "
++ "EOFBLOCKS_FL set", inode->i_ino);
++ err = -EIO;
++ goto out2;
++ }
++ last_ex = EXT_LAST_EXTENT(eh);
++ /*
++ * If the current leaf block was reached by looking at
++ * the last index block all the way down the tree, and
++ * we are extending the inode beyond the last extent
++ * in the current leaf block, then clear the
++ * EOFBLOCKS_FL flag.
++ */
++ for (i = depth-1; i >= 0; i--) {
++ if (path[i].p_idx != EXT_LAST_INDEX(path[i].p_hdr))
++ break;
++ }
++ if ((i < 0) &&
++ (iblock + ar.len > le32_to_cpu(last_ex->ee_block) +
++ ext4_ext_get_actual_len(last_ex)))
++ ext4_clear_inode_flag(inode, EXT4_INODE_EOFBLOCKS);
++ }
+ err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
+ if (err) {
+ /* free data blocks we just allocated */
+@@ -3333,9 +3450,18 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
+ /* previous routine could use block we allocated */
+ newblock = ext_pblock(&newex);
+ allocated = ext4_ext_get_actual_len(&newex);
++ if (allocated > max_blocks)
++ allocated = max_blocks;
+ set_buffer_new(bh_result);
+
+ /*
++ * Update reserved blocks/metadata blocks after successful
++ * block allocation which had been deferred till now.
++ */
++ if (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE)
++ ext4_da_update_reserve_space(inode, allocated, 1);
++
++ /*
+ * Cache the extent and update transaction to commit on fdatasync only
+ * when it is _not_ an uninitialized extent.
+ */
+@@ -3443,6 +3569,13 @@ static void ext4_falloc_update_inode(struct inode *inode,
+ i_size_write(inode, new_size);
+ if (new_size > EXT4_I(inode)->i_disksize)
+ ext4_update_i_disksize(inode, new_size);
++ } else {
++ /*
++ * Mark that we allocate beyond EOF so the subsequent truncate
++ * can proceed even if the new size is the same as i_size.
++ */
++ if (new_size > i_size_read(inode))
++ ext4_set_inode_flag(inode, EXT4_INODE_EOFBLOCKS);
+ }
+
+ }
+@@ -3470,7 +3603,7 @@ long ext4_fallocate(struct inode *inode, int mode, loff_t offset, loff_t len)
+ * currently supporting (pre)allocate mode for extent-based
+ * files _only_
+ */
+- if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+ return -EOPNOTSUPP;
+
+ /* preallocation to directories is currently not supported */
+@@ -3489,6 +3622,11 @@ long ext4_fallocate(struct inode *inode, int mode, loff_t offset, loff_t len)
+ */
+ credits = ext4_chunk_trans_blocks(inode, max_blocks);
+ mutex_lock(&inode->i_mutex);
++ ret = inode_newsize_ok(inode, (len + offset));
++ if (ret) {
++ mutex_unlock(&inode->i_mutex);
++ return ret;
++ }
+ retry:
+ while (ret >= 0 && ret < max_blocks) {
+ block = block + ret;
+@@ -3683,7 +3821,7 @@ static int ext4_xattr_fiemap(struct inode *inode,
+ int error = 0;
+
+ /* in-inode? */
+- if (EXT4_I(inode)->i_state & EXT4_STATE_XATTR) {
++ if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) {
+ struct ext4_iloc iloc;
+ int offset; /* offset of xattr in inode */
+
+@@ -3696,6 +3834,7 @@ static int ext4_xattr_fiemap(struct inode *inode,
+ physical += offset;
+ length = EXT4_SB(inode->i_sb)->s_inode_size - offset;
+ flags |= FIEMAP_EXTENT_DATA_INLINE;
++ brelse(iloc.bh);
+ } else { /* external block */
+ physical = EXT4_I(inode)->i_file_acl << blockbits;
+ length = inode->i_sb->s_blocksize;
+@@ -3714,7 +3853,7 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ int error = 0;
+
+ /* fallback to generic here if not in extents fmt */
+- if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+ return generic_block_fiemap(inode, fieinfo, start, len,
+ ext4_get_block);
+
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 9630583..2a60541 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -35,9 +35,9 @@
+ */
+ static int ext4_release_file(struct inode *inode, struct file *filp)
+ {
+- if (EXT4_I(inode)->i_state & EXT4_STATE_DA_ALLOC_CLOSE) {
++ if (ext4_test_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE)) {
+ ext4_alloc_da_blocks(inode);
+- EXT4_I(inode)->i_state &= ~EXT4_STATE_DA_ALLOC_CLOSE;
++ ext4_clear_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE);
+ }
+ /* if we are the last writer on the inode, drop the block reservation */
+ if ((filp->f_mode & FMODE_WRITE) &&
+@@ -65,7 +65,7 @@ ext4_file_write(struct kiocb *iocb, const struct iovec *iov,
+ * is smaller than s_maxbytes, which is for extent-mapped files.
+ */
+
+- if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)) {
++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+ size_t length = iov_length(iov, nr_segs);
+
+diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
+index d6049e4..c3660a6 100644
+--- a/fs/ext4/fsync.c
++++ b/fs/ext4/fsync.c
+@@ -35,6 +35,29 @@
+ #include <trace/events/ext4.h>
+
+ /*
++ * If we're not journaling and this is a just-created file, we have to
++ * sync our parent directory (if it was freshly created) since
++ * otherwise it will only be written by writeback, leaving a huge
++ * window during which a crash may lose the file. This may apply for
++ * the parent directory's parent as well, and so on recursively, if
++ * they are also freshly created.
++ */
++static void ext4_sync_parent(struct inode *inode)
++{
++ struct dentry *dentry = NULL;
++
++ while (inode && ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY)) {
++ ext4_clear_inode_state(inode, EXT4_STATE_NEWENTRY);
++ dentry = list_entry(inode->i_dentry.next,
++ struct dentry, d_alias);
++ if (!dentry || !dentry->d_parent || !dentry->d_parent->d_inode)
++ break;
++ inode = dentry->d_parent->d_inode;
++ sync_mapping_buffers(inode->i_mapping);
++ }
++}
++
++/*
+ * akpm: A new design for ext4_sync_file().
+ *
+ * This is only called from sys_fsync(), sys_fdatasync() and sys_msync().
+@@ -67,8 +90,12 @@ int ext4_sync_file(struct file *file, struct dentry *dentry, int datasync)
+ if (ret < 0)
+ return ret;
+
+- if (!journal)
+- return simple_fsync(file, dentry, datasync);
++ if (!journal) {
++ ret = simple_fsync(file, dentry, datasync);
++ if (!ret && !list_empty(&inode->i_dentry))
++ ext4_sync_parent(inode);
++ return ret;
++ }
+
+ /*
+ * data=writeback,ordered:
+@@ -88,9 +115,21 @@ int ext4_sync_file(struct file *file, struct dentry *dentry, int datasync)
+ return ext4_force_commit(inode->i_sb);
+
+ commit_tid = datasync ? ei->i_datasync_tid : ei->i_sync_tid;
+- if (jbd2_log_start_commit(journal, commit_tid))
+- jbd2_log_wait_commit(journal, commit_tid);
+- else if (journal->j_flags & JBD2_BARRIER)
++ if (jbd2_log_start_commit(journal, commit_tid)) {
++ /*
++ * When the journal is on a different device than the
++ * fs data disk, we need to issue the barrier in
++ * writeback mode. (In ordered mode, the jbd2 layer
++ * will take care of issuing the barrier. In
++ * data=journal, all of the data blocks are written to
++ * the journal device.)
++ */
++ if (ext4_should_writeback_data(inode) &&
++ (journal->j_fs_dev != journal->j_dev) &&
++ (journal->j_flags & JBD2_BARRIER))
++ blkdev_issue_flush(inode->i_sb->s_bdev, NULL);
++ ret = jbd2_log_wait_commit(journal, commit_tid);
++ } else if (journal->j_flags & JBD2_BARRIER)
+ blkdev_issue_flush(inode->i_sb->s_bdev, NULL);
+ return ret;
+ }
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index f3624ea..55a93f5 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -244,57 +244,50 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
+ if (fatal)
+ goto error_return;
+
+- /* Ok, now we can actually update the inode bitmaps.. */
+- cleared = ext4_clear_bit_atomic(ext4_group_lock_ptr(sb, block_group),
+- bit, bitmap_bh->b_data);
+- if (!cleared)
+- ext4_error(sb, "ext4_free_inode",
+- "bit already cleared for inode %lu", ino);
+- else {
+- gdp = ext4_get_group_desc(sb, block_group, &bh2);
+-
++ fatal = -ESRCH;
++ gdp = ext4_get_group_desc(sb, block_group, &bh2);
++ if (gdp) {
+ BUFFER_TRACE(bh2, "get_write_access");
+ fatal = ext4_journal_get_write_access(handle, bh2);
+- if (fatal) goto error_return;
+-
+- if (gdp) {
+- ext4_lock_group(sb, block_group);
+- count = ext4_free_inodes_count(sb, gdp) + 1;
+- ext4_free_inodes_set(sb, gdp, count);
+- if (is_directory) {
+- count = ext4_used_dirs_count(sb, gdp) - 1;
+- ext4_used_dirs_set(sb, gdp, count);
+- if (sbi->s_log_groups_per_flex) {
+- ext4_group_t f;
+-
+- f = ext4_flex_group(sbi, block_group);
+- atomic_dec(&sbi->s_flex_groups[f].free_inodes);
+- }
++ }
++ ext4_lock_group(sb, block_group);
++ cleared = ext4_clear_bit(bit, bitmap_bh->b_data);
++ if (fatal || !cleared) {
++ ext4_unlock_group(sb, block_group);
++ goto out;
++ }
+
+- }
+- gdp->bg_checksum = ext4_group_desc_csum(sbi,
+- block_group, gdp);
+- ext4_unlock_group(sb, block_group);
+- percpu_counter_inc(&sbi->s_freeinodes_counter);
+- if (is_directory)
+- percpu_counter_dec(&sbi->s_dirs_counter);
+-
+- if (sbi->s_log_groups_per_flex) {
+- ext4_group_t f;
+-
+- f = ext4_flex_group(sbi, block_group);
+- atomic_inc(&sbi->s_flex_groups[f].free_inodes);
+- }
+- }
+- BUFFER_TRACE(bh2, "call ext4_handle_dirty_metadata");
+- err = ext4_handle_dirty_metadata(handle, NULL, bh2);
+- if (!fatal) fatal = err;
++ count = ext4_free_inodes_count(sb, gdp) + 1;
++ ext4_free_inodes_set(sb, gdp, count);
++ if (is_directory) {
++ count = ext4_used_dirs_count(sb, gdp) - 1;
++ ext4_used_dirs_set(sb, gdp, count);
++ percpu_counter_dec(&sbi->s_dirs_counter);
+ }
+- BUFFER_TRACE(bitmap_bh, "call ext4_handle_dirty_metadata");
+- err = ext4_handle_dirty_metadata(handle, NULL, bitmap_bh);
+- if (!fatal)
+- fatal = err;
+- sb->s_dirt = 1;
++ gdp->bg_checksum = ext4_group_desc_csum(sbi, block_group, gdp);
++ ext4_unlock_group(sb, block_group);
++
++ percpu_counter_inc(&sbi->s_freeinodes_counter);
++ if (sbi->s_log_groups_per_flex) {
++ ext4_group_t f = ext4_flex_group(sbi, block_group);
++
++ atomic_inc(&sbi->s_flex_groups[f].free_inodes);
++ if (is_directory)
++ atomic_dec(&sbi->s_flex_groups[f].used_dirs);
++ }
++ BUFFER_TRACE(bh2, "call ext4_handle_dirty_metadata");
++ fatal = ext4_handle_dirty_metadata(handle, NULL, bh2);
++out:
++ if (cleared) {
++ BUFFER_TRACE(bitmap_bh, "call ext4_handle_dirty_metadata");
++ err = ext4_handle_dirty_metadata(handle, NULL, bitmap_bh);
++ if (!fatal)
++ fatal = err;
++ sb->s_dirt = 1;
++ } else
++ ext4_error(sb, "ext4_free_inode",
++ "bit already cleared for inode %lu", ino);
++
+ error_return:
+ brelse(bitmap_bh);
+ ext4_std_error(sb, fatal);
+@@ -504,7 +497,7 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent,
+
+ if (S_ISDIR(mode) &&
+ ((parent == sb->s_root->d_inode) ||
+- (EXT4_I(parent)->i_flags & EXT4_TOPDIR_FL))) {
++ (ext4_test_inode_flag(parent, EXT4_INODE_TOPDIR)))) {
+ int best_ndir = inodes_per_group;
+ int ret = -1;
+
+@@ -779,7 +772,7 @@ static int ext4_claim_inode(struct super_block *sb,
+ if (sbi->s_log_groups_per_flex) {
+ ext4_group_t f = ext4_flex_group(sbi, group);
+
+- atomic_inc(&sbi->s_flex_groups[f].free_inodes);
++ atomic_inc(&sbi->s_flex_groups[f].used_dirs);
+ }
+ }
+ gdp->bg_checksum = ext4_group_desc_csum(sbi, group, gdp);
+@@ -904,7 +897,7 @@ repeat_in_this_group:
+ BUFFER_TRACE(inode_bitmap_bh,
+ "call ext4_handle_dirty_metadata");
+ err = ext4_handle_dirty_metadata(handle,
+- inode,
++ NULL,
+ inode_bitmap_bh);
+ if (err)
+ goto fail;
+@@ -1029,7 +1022,8 @@ got:
+ inode->i_generation = sbi->s_next_generation++;
+ spin_unlock(&sbi->s_next_gen_lock);
+
+- ei->i_state = EXT4_STATE_NEW;
++ ei->i_state_flags = 0;
++ ext4_set_inode_state(inode, EXT4_STATE_NEW);
+
+ ei->i_extra_isize = EXT4_SB(sb)->s_want_extra_isize;
+
+@@ -1050,7 +1044,7 @@ got:
+ if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_EXTENTS)) {
+ /* set extent flag only for directory, file and normal symlink*/
+ if (S_ISDIR(mode) || S_ISREG(mode) || S_ISLNK(mode)) {
+- EXT4_I(inode)->i_flags |= EXT4_EXTENTS_FL;
++ ext4_set_inode_flag(inode, EXT4_INODE_EXTENTS);
+ ext4_ext_tree_init(handle, inode);
+ }
+ }
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 16efcee..99596fc 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -957,7 +957,7 @@ static int ext4_ind_get_blocks(handle_t *handle, struct inode *inode,
+ int count = 0;
+ ext4_fsblk_t first_block = 0;
+
+- J_ASSERT(!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL));
++ J_ASSERT(!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)));
+ J_ASSERT(handle != NULL || (flags & EXT4_GET_BLOCKS_CREATE) == 0);
+ depth = ext4_block_to_path(inode, iblock, offsets,
+ &blocks_to_boundary);
+@@ -1051,81 +1051,115 @@ qsize_t *ext4_get_reserved_space(struct inode *inode)
+ return &EXT4_I(inode)->i_reserved_quota;
+ }
+ #endif
++
+ /*
+ * Calculate the number of metadata blocks need to reserve
+- * to allocate @blocks for non extent file based file
++ * to allocate a new block at @lblocks for non extent file based file
+ */
+-static int ext4_indirect_calc_metadata_amount(struct inode *inode, int blocks)
++static int ext4_indirect_calc_metadata_amount(struct inode *inode,
++ sector_t lblock)
+ {
+- int icap = EXT4_ADDR_PER_BLOCK(inode->i_sb);
+- int ind_blks, dind_blks, tind_blks;
+-
+- /* number of new indirect blocks needed */
+- ind_blks = (blocks + icap - 1) / icap;
++ struct ext4_inode_info *ei = EXT4_I(inode);
++ sector_t dind_mask = ~((sector_t)EXT4_ADDR_PER_BLOCK(inode->i_sb) - 1);
++ int blk_bits;
+
+- dind_blks = (ind_blks + icap - 1) / icap;
++ if (lblock < EXT4_NDIR_BLOCKS)
++ return 0;
+
+- tind_blks = 1;
++ lblock -= EXT4_NDIR_BLOCKS;
+
+- return ind_blks + dind_blks + tind_blks;
++ if (ei->i_da_metadata_calc_len &&
++ (lblock & dind_mask) == ei->i_da_metadata_calc_last_lblock) {
++ ei->i_da_metadata_calc_len++;
++ return 0;
++ }
++ ei->i_da_metadata_calc_last_lblock = lblock & dind_mask;
++ ei->i_da_metadata_calc_len = 1;
++ blk_bits = order_base_2(lblock);
++ return (blk_bits / EXT4_ADDR_PER_BLOCK_BITS(inode->i_sb)) + 1;
+ }
+
+ /*
+ * Calculate the number of metadata blocks need to reserve
+- * to allocate given number of blocks
++ * to allocate a block located at @lblock
+ */
+-static int ext4_calc_metadata_amount(struct inode *inode, int blocks)
++static int ext4_calc_metadata_amount(struct inode *inode, sector_t lblock)
+ {
+- if (!blocks)
+- return 0;
+-
+- if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)
+- return ext4_ext_calc_metadata_amount(inode, blocks);
++ if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
++ return ext4_ext_calc_metadata_amount(inode, lblock);
+
+- return ext4_indirect_calc_metadata_amount(inode, blocks);
++ return ext4_indirect_calc_metadata_amount(inode, lblock);
+ }
+
+-static void ext4_da_update_reserve_space(struct inode *inode, int used)
++/*
++ * Called with i_data_sem down, which is important since we can call
++ * ext4_discard_preallocations() from here.
++ */
++void ext4_da_update_reserve_space(struct inode *inode,
++ int used, int quota_claim)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+- int total, mdb, mdb_free;
+-
+- spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
+- /* recalculate the number of metablocks still need to be reserved */
+- total = EXT4_I(inode)->i_reserved_data_blocks - used;
+- mdb = ext4_calc_metadata_amount(inode, total);
+-
+- /* figure out how many metablocks to release */
+- BUG_ON(mdb > EXT4_I(inode)->i_reserved_meta_blocks);
+- mdb_free = EXT4_I(inode)->i_reserved_meta_blocks - mdb;
+-
+- if (mdb_free) {
+- /* Account for allocated meta_blocks */
+- mdb_free -= EXT4_I(inode)->i_allocated_meta_blocks;
+-
+- /* update fs dirty blocks counter */
++ struct ext4_inode_info *ei = EXT4_I(inode);
++ int mdb_free = 0, allocated_meta_blocks = 0;
++
++ spin_lock(&ei->i_block_reservation_lock);
++ if (unlikely(used > ei->i_reserved_data_blocks)) {
++ ext4_msg(inode->i_sb, KERN_NOTICE, "%s: ino %lu, used %d "
++ "with only %d reserved data blocks\n",
++ __func__, inode->i_ino, used,
++ ei->i_reserved_data_blocks);
++ WARN_ON(1);
++ used = ei->i_reserved_data_blocks;
++ }
++
++ /* Update per-inode reservations */
++ ei->i_reserved_data_blocks -= used;
++ used += ei->i_allocated_meta_blocks;
++ ei->i_reserved_meta_blocks -= ei->i_allocated_meta_blocks;
++ allocated_meta_blocks = ei->i_allocated_meta_blocks;
++ ei->i_allocated_meta_blocks = 0;
++ percpu_counter_sub(&sbi->s_dirtyblocks_counter, used);
++
++ if (ei->i_reserved_data_blocks == 0) {
++ /*
++ * We can release all of the reserved metadata blocks
++ * only when we have written all of the delayed
++ * allocation blocks.
++ */
++ mdb_free = ei->i_reserved_meta_blocks;
++ ei->i_reserved_meta_blocks = 0;
++ ei->i_da_metadata_calc_len = 0;
+ percpu_counter_sub(&sbi->s_dirtyblocks_counter, mdb_free);
+- EXT4_I(inode)->i_allocated_meta_blocks = 0;
+- EXT4_I(inode)->i_reserved_meta_blocks = mdb;
+ }
+-
+- /* update per-inode reservations */
+- BUG_ON(used > EXT4_I(inode)->i_reserved_data_blocks);
+- EXT4_I(inode)->i_reserved_data_blocks -= used;
+ spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+
+- /*
+- * free those over-booking quota for metadata blocks
+- */
+- if (mdb_free)
+- vfs_dq_release_reservation_block(inode, mdb_free);
++ /* Update quota subsystem */
++ if (quota_claim) {
++ vfs_dq_claim_block(inode, used);
++ if (mdb_free)
++ vfs_dq_release_reservation_block(inode, mdb_free);
++ } else {
++ /*
++ * We did fallocate with an offset that is already delayed
++ * allocated. So on delayed allocated writeback we should
++ * not update the quota for allocated blocks. But then
++ * converting an fallocate region to initialized region would
++ * have caused a metadata allocation. So claim quota for
++ * that
++ */
++ if (allocated_meta_blocks)
++ vfs_dq_claim_block(inode, allocated_meta_blocks);
++ vfs_dq_release_reservation_block(inode, mdb_free + used -
++ allocated_meta_blocks);
++ }
+
+ /*
+ * If we have done all the pending block allocations and if
+ * there aren't any writers on the inode, we can discard the
+ * inode's preallocations.
+ */
+- if (!total && (atomic_read(&inode->i_writecount) == 0))
++ if ((ei->i_reserved_data_blocks == 0) &&
++ (atomic_read(&inode->i_writecount) == 0))
+ ext4_discard_preallocations(inode);
+ }
+
+@@ -1240,7 +1274,7 @@ int ext4_get_blocks(handle_t *handle, struct inode *inode, sector_t block,
+ * file system block.
+ */
+ down_read((&EXT4_I(inode)->i_data_sem));
+- if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL) {
++ if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) {
+ retval = ext4_ext_get_blocks(handle, inode, block, max_blocks,
+ bh, 0);
+ } else {
+@@ -1302,7 +1336,7 @@ int ext4_get_blocks(handle_t *handle, struct inode *inode, sector_t block,
+ * We need to check for EXT4 here because migrate
+ * could have changed the inode type in between
+ */
+- if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL) {
++ if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) {
+ retval = ext4_ext_get_blocks(handle, inode, block, max_blocks,
+ bh, flags);
+ } else {
+@@ -1315,20 +1349,22 @@ int ext4_get_blocks(handle_t *handle, struct inode *inode, sector_t block,
+ * i_data's format changing. Force the migrate
+ * to fail by clearing migrate flags
+ */
+- EXT4_I(inode)->i_state &= ~EXT4_STATE_EXT_MIGRATE;
++ ext4_clear_inode_state(inode, EXT4_STATE_EXT_MIGRATE);
+ }
+- }
+
++ /*
++ * Update reserved blocks/metadata blocks after successful
++ * block allocation which had been deferred till now. We don't
++ * support fallocate for non extent files. So we can update
++ * reserve space here.
++ */
++ if ((retval > 0) &&
++ (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE))
++ ext4_da_update_reserve_space(inode, retval, 1);
++ }
+ if (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE)
+ EXT4_I(inode)->i_delalloc_reserved_flag = 0;
+
+- /*
+- * Update reserved blocks/metadata blocks after successful
+- * block allocation which had been deferred till now.
+- */
+- if ((retval > 0) && (flags & EXT4_GET_BLOCKS_UPDATE_RESERVE_SPACE))
+- ext4_da_update_reserve_space(inode, retval);
+-
+ up_write((&EXT4_I(inode)->i_data_sem));
+ if (retval > 0 && buffer_mapped(bh)) {
+ int ret = check_block_validity(inode, "file system "
+@@ -1800,7 +1836,7 @@ static int ext4_journalled_write_end(struct file *file,
+ new_i_size = pos + copied;
+ if (new_i_size > inode->i_size)
+ i_size_write(inode, pos+copied);
+- EXT4_I(inode)->i_state |= EXT4_STATE_JDATA;
++ ext4_set_inode_state(inode, EXT4_STATE_JDATA);
+ if (new_i_size > EXT4_I(inode)->i_disksize) {
+ ext4_update_i_disksize(inode, new_i_size);
+ ret2 = ext4_mark_inode_dirty(handle, inode);
+@@ -1834,11 +1870,15 @@ static int ext4_journalled_write_end(struct file *file,
+ return ret ? ret : copied;
+ }
+
+-static int ext4_da_reserve_space(struct inode *inode, int nrblocks)
++/*
++ * Reserve a single block located at lblock
++ */
++static int ext4_da_reserve_space(struct inode *inode, sector_t lblock)
+ {
+ int retries = 0;
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+- unsigned long md_needed, mdblocks, total = 0;
++ struct ext4_inode_info *ei = EXT4_I(inode);
++ unsigned long md_needed, md_reserved;
+
+ /*
+ * recalculate the amount of metadata blocks to reserve
+@@ -1846,35 +1886,31 @@ static int ext4_da_reserve_space(struct inode *inode, int nrblocks)
+ * worse case is one extent per block
+ */
+ repeat:
+- spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
+- total = EXT4_I(inode)->i_reserved_data_blocks + nrblocks;
+- mdblocks = ext4_calc_metadata_amount(inode, total);
+- BUG_ON(mdblocks < EXT4_I(inode)->i_reserved_meta_blocks);
+-
+- md_needed = mdblocks - EXT4_I(inode)->i_reserved_meta_blocks;
+- total = md_needed + nrblocks;
+- spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
++ spin_lock(&ei->i_block_reservation_lock);
++ md_reserved = ei->i_reserved_meta_blocks;
++ md_needed = ext4_calc_metadata_amount(inode, lblock);
++ spin_unlock(&ei->i_block_reservation_lock);
+
+ /*
+ * Make quota reservation here to prevent quota overflow
+ * later. Real quota accounting is done at pages writeout
+ * time.
+ */
+- if (vfs_dq_reserve_block(inode, total))
++ if (vfs_dq_reserve_block(inode, md_needed + 1))
+ return -EDQUOT;
+
+- if (ext4_claim_free_blocks(sbi, total)) {
+- vfs_dq_release_reservation_block(inode, total);
++ if (ext4_claim_free_blocks(sbi, md_needed + 1)) {
++ vfs_dq_release_reservation_block(inode, md_needed + 1);
+ if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
+ yield();
+ goto repeat;
+ }
+ return -ENOSPC;
+ }
+- spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
+- EXT4_I(inode)->i_reserved_data_blocks += nrblocks;
+- EXT4_I(inode)->i_reserved_meta_blocks += md_needed;
+- spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
++ spin_lock(&ei->i_block_reservation_lock);
++ ei->i_reserved_data_blocks++;
++ ei->i_reserved_meta_blocks += md_needed;
++ spin_unlock(&ei->i_block_reservation_lock);
+
+ return 0; /* success */
+ }
+@@ -1882,49 +1918,46 @@ repeat:
+ static void ext4_da_release_space(struct inode *inode, int to_free)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+- int total, mdb, mdb_free, release;
++ struct ext4_inode_info *ei = EXT4_I(inode);
+
+ if (!to_free)
+ return; /* Nothing to release, exit */
+
+ spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
+
+- if (!EXT4_I(inode)->i_reserved_data_blocks) {
++ if (unlikely(to_free > ei->i_reserved_data_blocks)) {
+ /*
+- * if there is no reserved blocks, but we try to free some
+- * then the counter is messed up somewhere.
+- * but since this function is called from invalidate
+- * page, it's harmless to return without any action
++ * if there aren't enough reserved blocks, then the
++ * counter is messed up somewhere. Since this
++ * function is called from invalidate page, it's
++ * harmless to return without any action.
+ */
+- printk(KERN_INFO "ext4 delalloc try to release %d reserved "
+- "blocks for inode %lu, but there is no reserved "
+- "data blocks\n", to_free, inode->i_ino);
+- spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+- return;
++ ext4_msg(inode->i_sb, KERN_NOTICE, "ext4_da_release_space: "
++ "ino %lu, to_free %d with only %d reserved "
++ "data blocks\n", inode->i_ino, to_free,
++ ei->i_reserved_data_blocks);
++ WARN_ON(1);
++ to_free = ei->i_reserved_data_blocks;
+ }
++ ei->i_reserved_data_blocks -= to_free;
+
+- /* recalculate the number of metablocks still need to be reserved */
+- total = EXT4_I(inode)->i_reserved_data_blocks - to_free;
+- mdb = ext4_calc_metadata_amount(inode, total);
+-
+- /* figure out how many metablocks to release */
+- BUG_ON(mdb > EXT4_I(inode)->i_reserved_meta_blocks);
+- mdb_free = EXT4_I(inode)->i_reserved_meta_blocks - mdb;
+-
+- release = to_free + mdb_free;
+-
+- /* update fs dirty blocks counter for truncate case */
+- percpu_counter_sub(&sbi->s_dirtyblocks_counter, release);
++ if (ei->i_reserved_data_blocks == 0) {
++ /*
++ * We can release all of the reserved metadata blocks
++ * only when we have written all of the delayed
++ * allocation blocks.
++ */
++ to_free += ei->i_reserved_meta_blocks;
++ ei->i_reserved_meta_blocks = 0;
++ ei->i_da_metadata_calc_len = 0;
++ }
+
+- /* update per-inode reservations */
+- BUG_ON(to_free > EXT4_I(inode)->i_reserved_data_blocks);
+- EXT4_I(inode)->i_reserved_data_blocks -= to_free;
++ /* update fs dirty blocks counter */
++ percpu_counter_sub(&sbi->s_dirtyblocks_counter, to_free);
+
+- BUG_ON(mdb > EXT4_I(inode)->i_reserved_meta_blocks);
+- EXT4_I(inode)->i_reserved_meta_blocks = mdb;
+ spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+
+- vfs_dq_release_reservation_block(inode, release);
++ vfs_dq_release_reservation_block(inode, to_free);
+ }
+
+ static void ext4_da_page_release_reservation(struct page *page,
+@@ -2229,10 +2262,10 @@ static int mpage_da_map_blocks(struct mpage_da_data *mpd)
+ * variables are updated after the blocks have been allocated.
+ */
+ new.b_state = 0;
+- get_blocks_flags = (EXT4_GET_BLOCKS_CREATE |
+- EXT4_GET_BLOCKS_DELALLOC_RESERVE);
++ get_blocks_flags = EXT4_GET_BLOCKS_CREATE;
+ if (mpd->b_state & (1 << BH_Delay))
+- get_blocks_flags |= EXT4_GET_BLOCKS_UPDATE_RESERVE_SPACE;
++ get_blocks_flags |= EXT4_GET_BLOCKS_DELALLOC_RESERVE;
++
+ blks = ext4_get_blocks(handle, mpd->inode, next, max_blocks,
+ &new, get_blocks_flags);
+ if (blks < 0) {
+@@ -2261,7 +2294,7 @@ static int mpage_da_map_blocks(struct mpage_da_data *mpd)
+ ext4_msg(mpd->inode->i_sb, KERN_CRIT,
+ "delayed block allocation failed for inode %lu at "
+ "logical offset %llu with max blocks %zd with "
+- "error %d\n", mpd->inode->i_ino,
++ "error %d", mpd->inode->i_ino,
+ (unsigned long long) next,
+ mpd->b_size >> mpd->inode->i_blkbits, err);
+ printk(KERN_CRIT "This should not happen!! "
+@@ -2328,8 +2361,17 @@ static void mpage_add_bh_to_extent(struct mpage_da_data *mpd,
+ sector_t next;
+ int nrblocks = mpd->b_size >> mpd->inode->i_blkbits;
+
++ /*
++ * XXX Don't go larger than mballoc is willing to allocate
++ * This is a stopgap solution. We eventually need to fold
++ * mpage_da_submit_io() into this function and then call
++ * ext4_get_blocks() multiple times in a loop
++ */
++ if (nrblocks >= 8*1024*1024/mpd->inode->i_sb->s_blocksize)
++ goto flush_it;
++
+ /* check if thereserved journal credits might overflow */
+- if (!(EXT4_I(mpd->inode)->i_flags & EXT4_EXTENTS_FL)) {
++ if (!(ext4_test_inode_flag(mpd->inode, EXT4_INODE_EXTENTS))) {
+ if (nrblocks >= EXT4_MAX_TRANS_DATA) {
+ /*
+ * With non-extent format we are limited by the journal
+@@ -2530,7 +2572,7 @@ static int ext4_da_get_block_prep(struct inode *inode, sector_t iblock,
+ * XXX: __block_prepare_write() unmaps passed block,
+ * is it OK?
+ */
+- ret = ext4_da_reserve_space(inode, 1);
++ ret = ext4_da_reserve_space(inode, iblock);
+ if (ret)
+ /* not enough space to reserve */
+ return ret;
+@@ -2641,7 +2683,7 @@ static int __ext4_journalled_writepage(struct page *page,
+ ret = err;
+
+ walk_page_buffers(handle, page_bufs, 0, len, NULL, bput_one);
+- EXT4_I(inode)->i_state |= EXT4_STATE_JDATA;
++ ext4_set_inode_state(inode, EXT4_STATE_JDATA);
+ out:
+ return ret;
+ }
+@@ -2794,7 +2836,7 @@ static int ext4_da_writepages_trans_blocks(struct inode *inode)
+ * number of contiguous block. So we will limit
+ * number of contiguous block to a sane value
+ */
+- if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL) &&
++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) &&
+ (max_blocks > EXT4_MAX_TRANS_DATA))
+ max_blocks = EXT4_MAX_TRANS_DATA;
+
+@@ -2914,7 +2956,7 @@ retry:
+ if (IS_ERR(handle)) {
+ ret = PTR_ERR(handle);
+ ext4_msg(inode->i_sb, KERN_CRIT, "%s: jbd2_start: "
+- "%ld pages, ino %lu; err %d\n", __func__,
++ "%ld pages, ino %lu; err %d", __func__,
+ wbc->nr_to_write, inode->i_ino, ret);
+ goto out_writepages;
+ }
+@@ -2989,7 +3031,7 @@ retry:
+ if (pages_skipped != wbc->pages_skipped)
+ ext4_msg(inode->i_sb, KERN_CRIT,
+ "This should not happen leaving %s "
+- "with nr_to_write = %ld ret = %d\n",
++ "with nr_to_write = %ld ret = %d",
+ __func__, wbc->nr_to_write, ret);
+
+ /* Update index */
+@@ -3005,8 +3047,7 @@ retry:
+ out_writepages:
+ if (!no_nrwrite_index_update)
+ wbc->no_nrwrite_index_update = 0;
+- if (wbc->nr_to_write > nr_to_writebump)
+- wbc->nr_to_write -= nr_to_writebump;
++ wbc->nr_to_write -= nr_to_writebump;
+ wbc->range_start = range_start;
+ trace_ext4_da_writepages_result(inode, wbc, ret, pages_written);
+ return ret;
+@@ -3050,7 +3091,7 @@ static int ext4_da_write_begin(struct file *file, struct address_space *mapping,
+ loff_t pos, unsigned len, unsigned flags,
+ struct page **pagep, void **fsdata)
+ {
+- int ret, retries = 0;
++ int ret, retries = 0, quota_retries = 0;
+ struct page *page;
+ pgoff_t index;
+ unsigned from, to;
+@@ -3109,6 +3150,22 @@ retry:
+
+ if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
+ goto retry;
++
++ if ((ret == -EDQUOT) &&
++ EXT4_I(inode)->i_reserved_meta_blocks &&
++ (quota_retries++ < 3)) {
++ /*
++ * Since we often over-estimate the number of meta
++ * data blocks required, we may sometimes get a
++ * spurios out of quota error even though there would
++ * be enough space once we write the data blocks and
++ * find out how many meta data blocks were _really_
++ * required. So try forcing the inode write to see if
++ * that helps.
++ */
++ write_inode_now(inode, (quota_retries == 3));
++ goto retry;
++ }
+ out:
+ return ret;
+ }
+@@ -3297,7 +3354,8 @@ static sector_t ext4_bmap(struct address_space *mapping, sector_t block)
+ filemap_write_and_wait(mapping);
+ }
+
+- if (EXT4_JOURNAL(inode) && EXT4_I(inode)->i_state & EXT4_STATE_JDATA) {
++ if (EXT4_JOURNAL(inode) &&
++ ext4_test_inode_state(inode, EXT4_STATE_JDATA)) {
+ /*
+ * This is a REALLY heavyweight approach, but the use of
+ * bmap on dirty files is expected to be extremely rare:
+@@ -3316,7 +3374,7 @@ static sector_t ext4_bmap(struct address_space *mapping, sector_t block)
+ * everything they get.
+ */
+
+- EXT4_I(inode)->i_state &= ~EXT4_STATE_JDATA;
++ ext4_clear_inode_state(inode, EXT4_STATE_JDATA);
+ journal = EXT4_JOURNAL(inode);
+ jbd2_journal_lock_updates(journal);
+ err = jbd2_journal_flush(journal);
+@@ -3432,6 +3490,9 @@ retry:
+ * but cannot extend i_size. Bail out and pretend
+ * the write failed... */
+ ret = PTR_ERR(handle);
++ if (inode->i_nlink)
++ ext4_orphan_del(NULL, inode);
++
+ goto out;
+ }
+ if (inode->i_nlink)
+@@ -3784,8 +3845,8 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
+ if (ret != -EIOCBQUEUED && ret <= 0 && iocb->private) {
+ ext4_free_io_end(iocb->private);
+ iocb->private = NULL;
+- } else if (ret > 0 && (EXT4_I(inode)->i_state &
+- EXT4_STATE_DIO_UNWRITTEN)) {
++ } else if (ret > 0 && ext4_test_inode_state(inode,
++ EXT4_STATE_DIO_UNWRITTEN)) {
+ int err;
+ /*
+ * for non AIO case, since the IO is already
+@@ -3795,7 +3856,7 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
+ offset, ret);
+ if (err < 0)
+ ret = err;
+- EXT4_I(inode)->i_state &= ~EXT4_STATE_DIO_UNWRITTEN;
++ ext4_clear_inode_state(inode, EXT4_STATE_DIO_UNWRITTEN);
+ }
+ return ret;
+ }
+@@ -3811,7 +3872,7 @@ static ssize_t ext4_direct_IO(int rw, struct kiocb *iocb,
+ struct file *file = iocb->ki_filp;
+ struct inode *inode = file->f_mapping->host;
+
+- if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)
++ if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
+ return ext4_ext_direct_IO(rw, iocb, iov, offset, nr_segs);
+
+ return ext4_ind_direct_IO(rw, iocb, iov, offset, nr_segs);
+@@ -4442,10 +4503,12 @@ void ext4_truncate(struct inode *inode)
+ if (!ext4_can_truncate(inode))
+ return;
+
++ ext4_clear_inode_flag(inode, EXT4_INODE_EOFBLOCKS);
++
+ if (inode->i_size == 0 && !test_opt(inode->i_sb, NO_AUTO_DA_ALLOC))
+- ei->i_state |= EXT4_STATE_DA_ALLOC_CLOSE;
++ ext4_set_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE);
+
+- if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL) {
++ if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) {
+ ext4_ext_truncate(inode);
+ return;
+ }
+@@ -4729,7 +4792,7 @@ int ext4_get_inode_loc(struct inode *inode, struct ext4_iloc *iloc)
+ {
+ /* We have all inode data except xattrs in memory here. */
+ return __ext4_get_inode_loc(inode, iloc,
+- !(EXT4_I(inode)->i_state & EXT4_STATE_XATTR));
++ !ext4_test_inode_state(inode, EXT4_STATE_XATTR));
+ }
+
+ void ext4_set_inode_flags(struct inode *inode)
+@@ -4823,7 +4886,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
+ }
+ inode->i_nlink = le16_to_cpu(raw_inode->i_links_count);
+
+- ei->i_state = 0;
++ ei->i_state_flags = 0;
+ ei->i_dir_start_lookup = 0;
+ ei->i_dtime = le32_to_cpu(raw_inode->i_dtime);
+ /* We now have enough fields to check if the inode was active or not.
+@@ -4906,7 +4969,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
+ EXT4_GOOD_OLD_INODE_SIZE +
+ ei->i_extra_isize;
+ if (*magic == cpu_to_le32(EXT4_XATTR_MAGIC))
+- ei->i_state |= EXT4_STATE_XATTR;
++ ext4_set_inode_state(inode, EXT4_STATE_XATTR);
+ }
+ } else
+ ei->i_extra_isize = 0;
+@@ -5046,7 +5109,7 @@ static int ext4_do_update_inode(handle_t *handle,
+
+ /* For fields not not tracking in the in-memory inode,
+ * initialise them to zero for new inodes. */
+- if (ei->i_state & EXT4_STATE_NEW)
++ if (ext4_test_inode_state(inode, EXT4_STATE_NEW))
+ memset(raw_inode, 0, EXT4_SB(inode->i_sb)->s_inode_size);
+
+ ext4_get_inode_flags(ei);
+@@ -5110,7 +5173,7 @@ static int ext4_do_update_inode(handle_t *handle,
+ EXT4_FEATURE_RO_COMPAT_LARGE_FILE);
+ sb->s_dirt = 1;
+ ext4_handle_sync(handle);
+- err = ext4_handle_dirty_metadata(handle, inode,
++ err = ext4_handle_dirty_metadata(handle, NULL,
+ EXT4_SB(sb)->s_sbh);
+ }
+ }
+@@ -5139,10 +5202,10 @@ static int ext4_do_update_inode(handle_t *handle,
+ }
+
+ BUFFER_TRACE(bh, "call ext4_handle_dirty_metadata");
+- rc = ext4_handle_dirty_metadata(handle, inode, bh);
++ rc = ext4_handle_dirty_metadata(handle, NULL, bh);
+ if (!err)
+ err = rc;
+- ei->i_state &= ~EXT4_STATE_NEW;
++ ext4_clear_inode_state(inode, EXT4_STATE_NEW);
+
+ ext4_update_inode_fsync_trans(handle, inode, 0);
+ out_brelse:
+@@ -5207,7 +5270,7 @@ int ext4_write_inode(struct inode *inode, int wait)
+ } else {
+ struct ext4_iloc iloc;
+
+- err = ext4_get_inode_loc(inode, &iloc);
++ err = __ext4_get_inode_loc(inode, &iloc, 0);
+ if (err)
+ return err;
+ if (wait)
+@@ -5220,6 +5283,7 @@ int ext4_write_inode(struct inode *inode, int wait)
+ (unsigned long long)iloc.bh->b_blocknr);
+ err = -EIO;
+ }
++ brelse(iloc.bh);
+ }
+ return err;
+ }
+@@ -5286,7 +5350,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ }
+
+ if (attr->ia_valid & ATTR_SIZE) {
+- if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)) {
++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+
+ if (attr->ia_size > sbi->s_bitmap_maxbytes) {
+@@ -5297,7 +5361,9 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ }
+
+ if (S_ISREG(inode->i_mode) &&
+- attr->ia_valid & ATTR_SIZE && attr->ia_size < inode->i_size) {
++ attr->ia_valid & ATTR_SIZE &&
++ (attr->ia_size < inode->i_size ||
++ (ext4_test_inode_flag(inode, EXT4_INODE_EOFBLOCKS)))) {
+ handle_t *handle;
+
+ handle = ext4_journal_start(inode, 3);
+@@ -5328,6 +5394,9 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ goto err_out;
+ }
+ }
++ /* ext4_truncate will clear the flag */
++ if ((ext4_test_inode_flag(inode, EXT4_INODE_EOFBLOCKS)))
++ ext4_truncate(inode);
+ }
+
+ rc = inode_setattr(inode, attr);
+@@ -5402,7 +5471,7 @@ static int ext4_indirect_trans_blocks(struct inode *inode, int nrblocks,
+
+ static int ext4_index_trans_blocks(struct inode *inode, int nrblocks, int chunk)
+ {
+- if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+ return ext4_indirect_trans_blocks(inode, nrblocks, chunk);
+ return ext4_ext_index_trans_blocks(inode, nrblocks, chunk);
+ }
+@@ -5566,8 +5635,8 @@ static int ext4_expand_extra_isize(struct inode *inode,
+ entry = IFIRST(header);
+
+ /* No extended attributes present */
+- if (!(EXT4_I(inode)->i_state & EXT4_STATE_XATTR) ||
+- header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) {
++ if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR) ||
++ header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) {
+ memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE, 0,
+ new_extra_isize);
+ EXT4_I(inode)->i_extra_isize = new_extra_isize;
+@@ -5611,7 +5680,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
+ err = ext4_reserve_inode_write(handle, inode, &iloc);
+ if (ext4_handle_valid(handle) &&
+ EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize &&
+- !(EXT4_I(inode)->i_state & EXT4_STATE_NO_EXPAND)) {
++ !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) {
+ /*
+ * We need extra buffer credits since we may write into EA block
+ * with this same handle. If journal_extend fails, then it will
+@@ -5625,7 +5694,8 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
+ sbi->s_want_extra_isize,
+ iloc, handle);
+ if (ret) {
+- EXT4_I(inode)->i_state |= EXT4_STATE_NO_EXPAND;
++ ext4_set_inode_state(inode,
++ EXT4_STATE_NO_EXPAND);
+ if (mnt_count !=
+ le16_to_cpu(sbi->s_es->s_mnt_count)) {
+ ext4_warning(inode->i_sb, __func__,
+@@ -5692,7 +5762,7 @@ static int ext4_pin_inode(handle_t *handle, struct inode *inode)
+ err = jbd2_journal_get_write_access(handle, iloc.bh);
+ if (!err)
+ err = ext4_handle_dirty_metadata(handle,
+- inode,
++ NULL,
+ iloc.bh);
+ brelse(iloc.bh);
+ }
+@@ -5736,9 +5806,9 @@ int ext4_change_inode_journal_flag(struct inode *inode, int val)
+ */
+
+ if (val)
+- EXT4_I(inode)->i_flags |= EXT4_JOURNAL_DATA_FL;
++ ext4_set_inode_flag(inode, EXT4_INODE_JOURNAL_DATA);
+ else
+- EXT4_I(inode)->i_flags &= ~EXT4_JOURNAL_DATA_FL;
++ ext4_clear_inode_flag(inode, EXT4_INODE_JOURNAL_DATA);
+ ext4_set_aops(inode);
+
+ jbd2_journal_unlock_updates(journal);
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index b63d193..bf5ae88 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -92,6 +92,15 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ flags &= ~EXT4_EXTENTS_FL;
+ }
+
++ if (flags & EXT4_EOFBLOCKS_FL) {
++ /* we don't support adding EOFBLOCKS flag */
++ if (!(oldflags & EXT4_EOFBLOCKS_FL)) {
++ err = -EOPNOTSUPP;
++ goto flags_out;
++ }
++ } else if (oldflags & EXT4_EOFBLOCKS_FL)
++ ext4_truncate(inode);
++
+ handle = ext4_journal_start(inode, 1);
+ if (IS_ERR(handle)) {
+ err = PTR_ERR(handle);
+@@ -249,7 +258,8 @@ setversion_out:
+ if (me.moved_len > 0)
+ file_remove_suid(donor_filp);
+
+- if (copy_to_user((struct move_extent *)arg, &me, sizeof(me)))
++ if (copy_to_user((struct move_extent __user *)arg,
++ &me, sizeof(me)))
+ err = -EFAULT;
+ mext_out:
+ fput(donor_filp);
+@@ -363,7 +373,30 @@ long ext4_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ case EXT4_IOC32_SETRSVSZ:
+ cmd = EXT4_IOC_SETRSVSZ;
+ break;
+- case EXT4_IOC_GROUP_ADD:
++ case EXT4_IOC32_GROUP_ADD: {
++ struct compat_ext4_new_group_input __user *uinput;
++ struct ext4_new_group_input input;
++ mm_segment_t old_fs;
++ int err;
++
++ uinput = compat_ptr(arg);
++ err = get_user(input.group, &uinput->group);
++ err |= get_user(input.block_bitmap, &uinput->block_bitmap);
++ err |= get_user(input.inode_bitmap, &uinput->inode_bitmap);
++ err |= get_user(input.inode_table, &uinput->inode_table);
++ err |= get_user(input.blocks_count, &uinput->blocks_count);
++ err |= get_user(input.reserved_blocks,
++ &uinput->reserved_blocks);
++ if (err)
++ return -EFAULT;
++ old_fs = get_fs();
++ set_fs(KERNEL_DS);
++ err = ext4_ioctl(file, EXT4_IOC_GROUP_ADD,
++ (unsigned long) &input);
++ set_fs(old_fs);
++ return err;
++ }
++ case EXT4_IOC_MOVE_EXT:
+ break;
+ default:
+ return -ENOIOCTLCMD;
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 7d71148..04e07e2 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -658,6 +658,27 @@ static void ext4_mb_mark_free_simple(struct super_block *sb,
+ }
+ }
+
++/*
++ * Cache the order of the largest free extent we have available in this block
++ * group.
++ */
++static void
++mb_set_largest_free_order(struct super_block *sb, struct ext4_group_info *grp)
++{
++ int i;
++ int bits;
++
++ grp->bb_largest_free_order = -1; /* uninit */
++
++ bits = sb->s_blocksize_bits + 1;
++ for (i = bits; i >= 0; i--) {
++ if (grp->bb_counters[i] > 0) {
++ grp->bb_largest_free_order = i;
++ break;
++ }
++ }
++}
++
+ static noinline_for_stack
+ void ext4_mb_generate_buddy(struct super_block *sb,
+ void *buddy, void *bitmap, ext4_group_t group)
+@@ -700,6 +721,7 @@ void ext4_mb_generate_buddy(struct super_block *sb,
+ */
+ grp->bb_free = free;
+ }
++ mb_set_largest_free_order(sb, grp);
+
+ clear_bit(EXT4_GROUP_INFO_NEED_INIT_BIT, &(grp->bb_state));
+
+@@ -725,6 +747,9 @@ void ext4_mb_generate_buddy(struct super_block *sb,
+ * contain blocks_per_page (PAGE_CACHE_SIZE / blocksize) blocks.
+ * So it can have information regarding groups_per_page which
+ * is blocks_per_page/2
++ *
++ * Locking note: This routine takes the block group lock of all groups
++ * for this page; do not hold this lock when calling this routine!
+ */
+
+ static int ext4_mb_init_cache(struct page *page, char *incore)
+@@ -910,6 +935,11 @@ out:
+ return err;
+ }
+
++/*
++ * Locking note: This routine calls ext4_mb_init_cache(), which takes the
++ * block group lock of all groups for this page; do not hold the BG lock when
++ * calling this routine!
++ */
+ static noinline_for_stack
+ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
+ {
+@@ -1004,6 +1034,11 @@ err:
+ return ret;
+ }
+
++/*
++ * Locking note: This routine calls ext4_mb_init_cache(), which takes the
++ * block group lock of all groups for this page; do not hold the BG lock when
++ * calling this routine!
++ */
+ static noinline_for_stack int
+ ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,
+ struct ext4_buddy *e4b)
+@@ -1150,7 +1185,7 @@ err:
+ return ret;
+ }
+
+-static void ext4_mb_release_desc(struct ext4_buddy *e4b)
++static void ext4_mb_unload_buddy(struct ext4_buddy *e4b)
+ {
+ if (e4b->bd_bitmap_page)
+ page_cache_release(e4b->bd_bitmap_page);
+@@ -1300,6 +1335,7 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b,
+ buddy = buddy2;
+ } while (1);
+ }
++ mb_set_largest_free_order(sb, e4b->bd_info);
+ mb_check_buddy(e4b);
+ }
+
+@@ -1428,6 +1464,7 @@ static int mb_mark_used(struct ext4_buddy *e4b, struct ext4_free_extent *ex)
+ e4b->bd_info->bb_counters[ord]++;
+ e4b->bd_info->bb_counters[ord]++;
+ }
++ mb_set_largest_free_order(e4b->bd_sb, e4b->bd_info);
+
+ mb_set_bits(EXT4_MB_BITMAP(e4b), ex->fe_start, len0);
+ mb_check_buddy(e4b);
+@@ -1618,7 +1655,7 @@ int ext4_mb_try_best_found(struct ext4_allocation_context *ac,
+ }
+
+ ext4_unlock_group(ac->ac_sb, group);
+- ext4_mb_release_desc(e4b);
++ ext4_mb_unload_buddy(e4b);
+
+ return 0;
+ }
+@@ -1674,7 +1711,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac,
+ ext4_mb_use_best_found(ac, e4b);
+ }
+ ext4_unlock_group(ac->ac_sb, group);
+- ext4_mb_release_desc(e4b);
++ ext4_mb_unload_buddy(e4b);
+
+ return 0;
+ }
+@@ -1823,16 +1860,22 @@ void ext4_mb_scan_aligned(struct ext4_allocation_context *ac,
+ }
+ }
+
++/* This is now called BEFORE we load the buddy bitmap. */
+ static int ext4_mb_good_group(struct ext4_allocation_context *ac,
+ ext4_group_t group, int cr)
+ {
+ unsigned free, fragments;
+- unsigned i, bits;
+ int flex_size = ext4_flex_bg_size(EXT4_SB(ac->ac_sb));
+ struct ext4_group_info *grp = ext4_get_group_info(ac->ac_sb, group);
+
+ BUG_ON(cr < 0 || cr >= 4);
+- BUG_ON(EXT4_MB_GRP_NEED_INIT(grp));
++
++ /* We only do this if the grp has never been initialized */
++ if (unlikely(EXT4_MB_GRP_NEED_INIT(grp))) {
++ int ret = ext4_mb_init_group(ac->ac_sb, group);
++ if (ret)
++ return 0;
++ }
+
+ free = grp->bb_free;
+ fragments = grp->bb_fragments;
+@@ -1845,17 +1888,16 @@ static int ext4_mb_good_group(struct ext4_allocation_context *ac,
+ case 0:
+ BUG_ON(ac->ac_2order == 0);
+
++ if (grp->bb_largest_free_order < ac->ac_2order)
++ return 0;
++
+ /* Avoid using the first bg of a flexgroup for data files */
+ if ((ac->ac_flags & EXT4_MB_HINT_DATA) &&
+ (flex_size >= EXT4_FLEX_SIZE_DIR_ALLOC_SCHEME) &&
+ ((group % flex_size) == 0))
+ return 0;
+
+- bits = ac->ac_sb->s_blocksize_bits + 1;
+- for (i = ac->ac_2order; i <= bits; i++)
+- if (grp->bb_counters[i] > 0)
+- return 1;
+- break;
++ return 1;
+ case 1:
+ if ((free / fragments) >= ac->ac_g_ex.fe_len)
+ return 1;
+@@ -1966,7 +2008,7 @@ ext4_mb_regular_allocator(struct ext4_allocation_context *ac)
+ sbi = EXT4_SB(sb);
+ ngroups = ext4_get_groups_count(sb);
+ /* non-extent files are limited to low blocks/groups */
+- if (!(EXT4_I(ac->ac_inode)->i_flags & EXT4_EXTENTS_FL))
++ if (!(ext4_test_inode_flag(ac->ac_inode, EXT4_INODE_EXTENTS)))
+ ngroups = sbi->s_blockfile_groups;
+
+ BUG_ON(ac->ac_status == AC_STATUS_FOUND);
+@@ -2026,15 +2068,11 @@ repeat:
+ group = ac->ac_g_ex.fe_group;
+
+ for (i = 0; i < ngroups; group++, i++) {
+- struct ext4_group_info *grp;
+- struct ext4_group_desc *desc;
+-
+ if (group == ngroups)
+ group = 0;
+
+- /* quick check to skip empty groups */
+- grp = ext4_get_group_info(sb, group);
+- if (grp->bb_free == 0)
++ /* This now checks without needing the buddy page */
++ if (!ext4_mb_good_group(ac, group, cr))
+ continue;
+
+ err = ext4_mb_load_buddy(sb, group, &e4b);
+@@ -2042,15 +2080,18 @@ repeat:
+ goto out;
+
+ ext4_lock_group(sb, group);
++
++ /*
++ * We need to check again after locking the
++ * block group
++ */
+ if (!ext4_mb_good_group(ac, group, cr)) {
+- /* someone did allocation from this group */
+ ext4_unlock_group(sb, group);
+- ext4_mb_release_desc(&e4b);
++ ext4_mb_unload_buddy(&e4b);
+ continue;
+ }
+
+ ac->ac_groups_scanned++;
+- desc = ext4_get_group_desc(sb, group, NULL);
+ if (cr == 0)
+ ext4_mb_simple_scan_group(ac, &e4b);
+ else if (cr == 1 &&
+@@ -2060,7 +2101,7 @@ repeat:
+ ext4_mb_complex_scan_group(ac, &e4b);
+
+ ext4_unlock_group(sb, group);
+- ext4_mb_release_desc(&e4b);
++ ext4_mb_unload_buddy(&e4b);
+
+ if (ac->ac_status != AC_STATUS_CONTINUE)
+ break;
+@@ -2150,7 +2191,7 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
+ ext4_lock_group(sb, group);
+ memcpy(&sg, ext4_get_group_info(sb, group), i);
+ ext4_unlock_group(sb, group);
+- ext4_mb_release_desc(&e4b);
++ ext4_mb_unload_buddy(&e4b);
+
+ seq_printf(seq, "#%-5u: %-5u %-5u %-5u [", group, sg.info.bb_free,
+ sg.info.bb_fragments, sg.info.bb_first_free);
+@@ -2257,6 +2298,7 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group,
+ INIT_LIST_HEAD(&meta_group_info[i]->bb_prealloc_list);
+ init_rwsem(&meta_group_info[i]->alloc_sem);
+ meta_group_info[i]->bb_free_root.rb_node = NULL;
++ meta_group_info[i]->bb_largest_free_order = -1; /* uninit */
+
+ #ifdef DOUBLE_CHECK
+ {
+@@ -2537,6 +2579,23 @@ static void release_blocks_on_commit(journal_t *journal, transaction_t *txn)
+ mb_debug(1, "gonna free %u blocks in group %u (0x%p):",
+ entry->count, entry->group, entry);
+
++ if (test_opt(sb, DISCARD)) {
++ int ret;
++ ext4_fsblk_t discard_block;
++
++ discard_block = entry->start_blk +
++ ext4_group_first_block_no(sb, entry->group);
++ trace_ext4_discard_blocks(sb,
++ (unsigned long long)discard_block,
++ entry->count);
++ ret = sb_issue_discard(sb, discard_block, entry->count);
++ if (ret == EOPNOTSUPP) {
++ ext4_warning(sb, __func__,
++ "discard not supported, disabling");
++ clear_opt(EXT4_SB(sb)->s_mount_opt, DISCARD);
++ }
++ }
++
+ err = ext4_mb_load_buddy(sb, entry->group, &e4b);
+ /* we expect to find existing buddy because it's pinned */
+ BUG_ON(err != 0);
+@@ -2558,21 +2617,8 @@ static void release_blocks_on_commit(journal_t *journal, transaction_t *txn)
+ page_cache_release(e4b.bd_bitmap_page);
+ }
+ ext4_unlock_group(sb, entry->group);
+- if (test_opt(sb, DISCARD)) {
+- ext4_fsblk_t discard_block;
+- struct ext4_super_block *es = EXT4_SB(sb)->s_es;
+-
+- discard_block = (ext4_fsblk_t)entry->group *
+- EXT4_BLOCKS_PER_GROUP(sb)
+- + entry->start_blk
+- + le32_to_cpu(es->s_first_data_block);
+- trace_ext4_discard_blocks(sb,
+- (unsigned long long)discard_block,
+- entry->count);
+- sb_issue_discard(sb, discard_block, entry->count);
+- }
+ kmem_cache_free(ext4_free_ext_cachep, entry);
+- ext4_mb_release_desc(&e4b);
++ ext4_mb_unload_buddy(&e4b);
+ }
+
+ mb_debug(1, "freed %u blocks in %u structures\n", count, count2);
+@@ -2755,12 +2801,6 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
+ if (!(ac->ac_flags & EXT4_MB_DELALLOC_RESERVED))
+ /* release all the reserved blocks if non delalloc */
+ percpu_counter_sub(&sbi->s_dirtyblocks_counter, reserv_blks);
+- else {
+- percpu_counter_sub(&sbi->s_dirtyblocks_counter,
+- ac->ac_b_ex.fe_len);
+- /* convert reserved quota blocks to real quota blocks */
+- vfs_dq_claim_block(ac->ac_inode, ac->ac_b_ex.fe_len);
+- }
+
+ if (sbi->s_log_groups_per_flex) {
+ ext4_group_t flex_group = ext4_flex_group(sbi,
+@@ -3136,7 +3176,7 @@ ext4_mb_use_preallocated(struct ext4_allocation_context *ac)
+ continue;
+
+ /* non-extent files can't have physical blocks past 2^32 */
+- if (!(EXT4_I(ac->ac_inode)->i_flags & EXT4_EXTENTS_FL) &&
++ if (!(ext4_test_inode_flag(ac->ac_inode, EXT4_INODE_EXTENTS)) &&
+ pa->pa_pstart + pa->pa_len > EXT4_MAX_BLOCK_FILE_PHYS)
+ continue;
+
+@@ -3715,7 +3755,7 @@ out:
+ ext4_unlock_group(sb, group);
+ if (ac)
+ kmem_cache_free(ext4_ac_cachep, ac);
+- ext4_mb_release_desc(&e4b);
++ ext4_mb_unload_buddy(&e4b);
+ put_bh(bitmap_bh);
+ return free;
+ }
+@@ -3819,7 +3859,7 @@ repeat:
+ if (bitmap_bh == NULL) {
+ ext4_error(sb, __func__, "Error in reading block "
+ "bitmap for %u", group);
+- ext4_mb_release_desc(&e4b);
++ ext4_mb_unload_buddy(&e4b);
+ continue;
+ }
+
+@@ -3828,7 +3868,7 @@ repeat:
+ ext4_mb_release_inode_pa(&e4b, bitmap_bh, pa, ac);
+ ext4_unlock_group(sb, group);
+
+- ext4_mb_release_desc(&e4b);
++ ext4_mb_unload_buddy(&e4b);
+ put_bh(bitmap_bh);
+
+ list_del(&pa->u.pa_tmp_list);
+@@ -3944,7 +3984,7 @@ static void ext4_mb_group_or_file(struct ext4_allocation_context *ac)
+
+ /* don't use group allocation for large files */
+ size = max(size, isize);
+- if (size >= sbi->s_mb_stream_request) {
++ if (size > sbi->s_mb_stream_request) {
+ ac->ac_flags |= EXT4_MB_STREAM_ALLOC;
+ return;
+ }
+@@ -4092,7 +4132,7 @@ ext4_mb_discard_lg_preallocations(struct super_block *sb,
+ ext4_mb_release_group_pa(&e4b, pa, ac);
+ ext4_unlock_group(sb, group);
+
+- ext4_mb_release_desc(&e4b);
++ ext4_mb_unload_buddy(&e4b);
+ list_del(&pa->u.pa_tmp_list);
+ call_rcu(&(pa)->u.pa_rcu, ext4_mb_pa_callback);
+ }
+@@ -4594,7 +4634,7 @@ do_more:
+ atomic_add(count, &sbi->s_flex_groups[flex_group].free_blocks);
+ }
+
+- ext4_mb_release_desc(&e4b);
++ ext4_mb_unload_buddy(&e4b);
+
+ *freed += count;
+
+diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
+index 8646149..7901f13 100644
+--- a/fs/ext4/migrate.c
++++ b/fs/ext4/migrate.c
+@@ -357,12 +357,12 @@ static int ext4_ext_swap_inode_data(handle_t *handle, struct inode *inode,
+ * happened after we started the migrate. We need to
+ * fail the migrate
+ */
+- if (!(EXT4_I(inode)->i_state & EXT4_STATE_EXT_MIGRATE)) {
++ if (!ext4_test_inode_state(inode, EXT4_STATE_EXT_MIGRATE)) {
+ retval = -EAGAIN;
+ up_write(&EXT4_I(inode)->i_data_sem);
+ goto err_out;
+ } else
+- EXT4_I(inode)->i_state &= ~EXT4_STATE_EXT_MIGRATE;
++ ext4_clear_inode_state(inode, EXT4_STATE_EXT_MIGRATE);
+ /*
+ * We have the extent map build with the tmp inode.
+ * Now copy the i_data across
+@@ -465,7 +465,7 @@ int ext4_ext_migrate(struct inode *inode)
+ */
+ if (!EXT4_HAS_INCOMPAT_FEATURE(inode->i_sb,
+ EXT4_FEATURE_INCOMPAT_EXTENTS) ||
+- (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
++ (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+ return -EINVAL;
+
+ if (S_ISLNK(inode->i_mode) && inode->i_blocks == 0)
+@@ -494,14 +494,10 @@ int ext4_ext_migrate(struct inode *inode)
+ }
+ i_size_write(tmp_inode, i_size_read(inode));
+ /*
+- * We don't want the inode to be reclaimed
+- * if we got interrupted in between. We have
+- * this tmp inode carrying reference to the
+- * data blocks of the original file. We set
+- * the i_nlink to zero at the last stage after
+- * switching the original file to extent format
++ * Set the i_nlink to zero so it will be deleted later
++ * when we drop inode reference.
+ */
+- tmp_inode->i_nlink = 1;
++ tmp_inode->i_nlink = 0;
+
+ ext4_ext_tree_init(handle, tmp_inode);
+ ext4_orphan_add(handle, tmp_inode);
+@@ -524,10 +520,20 @@ int ext4_ext_migrate(struct inode *inode)
+ * allocation.
+ */
+ down_read((&EXT4_I(inode)->i_data_sem));
+- EXT4_I(inode)->i_state |= EXT4_STATE_EXT_MIGRATE;
++ ext4_set_inode_state(inode, EXT4_STATE_EXT_MIGRATE);
+ up_read((&EXT4_I(inode)->i_data_sem));
+
+ handle = ext4_journal_start(inode, 1);
++ if (IS_ERR(handle)) {
++ /*
++ * It is impossible to update on-disk structures without
++ * a handle, so just rollback in-core changes and live other
++ * work to orphan_list_cleanup()
++ */
++ ext4_orphan_del(NULL, tmp_inode);
++ retval = PTR_ERR(handle);
++ goto out;
++ }
+
+ ei = EXT4_I(inode);
+ i_data = ei->i_data;
+@@ -609,15 +615,8 @@ err_out:
+
+ /* Reset the extent details */
+ ext4_ext_tree_init(handle, tmp_inode);
+-
+- /*
+- * Set the i_nlink to zero so that
+- * generic_drop_inode really deletes the
+- * inode
+- */
+- tmp_inode->i_nlink = 0;
+-
+ ext4_journal_stop(handle);
++out:
+ unlock_new_inode(tmp_inode);
+ iput(tmp_inode);
+
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index f5b03a1..5b14d11 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -252,6 +252,7 @@ mext_insert_across_blocks(handle_t *handle, struct inode *orig_inode,
+ }
+
+ o_start->ee_len = start_ext->ee_len;
++ eblock = le32_to_cpu(start_ext->ee_block);
+ new_flag = 1;
+
+ } else if (start_ext->ee_len && new_ext->ee_len &&
+@@ -262,6 +263,7 @@ mext_insert_across_blocks(handle_t *handle, struct inode *orig_inode,
+ * orig |------------------------------|
+ */
+ o_start->ee_len = start_ext->ee_len;
++ eblock = le32_to_cpu(start_ext->ee_block);
+ new_flag = 1;
+
+ } else if (!start_ext->ee_len && new_ext->ee_len &&
+@@ -475,7 +477,6 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
+ struct ext4_extent *oext, *o_start, *o_end, *prev_ext;
+ struct ext4_extent new_ext, start_ext, end_ext;
+ ext4_lblk_t new_ext_end;
+- ext4_fsblk_t new_phys_end;
+ int oext_alen, new_ext_alen, end_ext_alen;
+ int depth = ext_depth(orig_inode);
+ int ret;
+@@ -489,7 +490,6 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
+ new_ext.ee_len = dext->ee_len;
+ new_ext_alen = ext4_ext_get_actual_len(&new_ext);
+ new_ext_end = le32_to_cpu(new_ext.ee_block) + new_ext_alen - 1;
+- new_phys_end = ext_pblock(&new_ext) + new_ext_alen - 1;
+
+ /*
+ * Case: original extent is first
+@@ -502,6 +502,7 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
+ le32_to_cpu(oext->ee_block) + oext_alen) {
+ start_ext.ee_len = cpu_to_le16(le32_to_cpu(new_ext.ee_block) -
+ le32_to_cpu(oext->ee_block));
++ start_ext.ee_block = oext->ee_block;
+ copy_extent_status(oext, &start_ext);
+ } else if (oext > EXT_FIRST_EXTENT(orig_path[depth].p_hdr)) {
+ prev_ext = oext - 1;
+@@ -515,6 +516,7 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
+ start_ext.ee_len = cpu_to_le16(
+ ext4_ext_get_actual_len(prev_ext) +
+ new_ext_alen);
++ start_ext.ee_block = oext->ee_block;
+ copy_extent_status(prev_ext, &start_ext);
+ new_ext.ee_len = 0;
+ }
+@@ -928,7 +930,7 @@ out2:
+ }
+
+ /**
+- * mext_check_argumants - Check whether move extent can be done
++ * mext_check_arguments - Check whether move extent can be done
+ *
+ * @orig_inode: original inode
+ * @donor_inode: donor inode
+@@ -949,14 +951,6 @@ mext_check_arguments(struct inode *orig_inode,
+ unsigned int blkbits = orig_inode->i_blkbits;
+ unsigned int blocksize = 1 << blkbits;
+
+- /* Regular file check */
+- if (!S_ISREG(orig_inode->i_mode) || !S_ISREG(donor_inode->i_mode)) {
+- ext4_debug("ext4 move extent: The argument files should be "
+- "regular file [ino:orig %lu, donor %lu]\n",
+- orig_inode->i_ino, donor_inode->i_ino);
+- return -EINVAL;
+- }
+-
+ if (donor_inode->i_mode & (S_ISUID|S_ISGID)) {
+ ext4_debug("ext4 move extent: suid or sgid is set"
+ " to donor file [ino:orig %lu, donor %lu]\n",
+@@ -981,11 +975,11 @@ mext_check_arguments(struct inode *orig_inode,
+ }
+
+ /* Ext4 move extent supports only extent based file */
+- if (!(EXT4_I(orig_inode)->i_flags & EXT4_EXTENTS_FL)) {
++ if (!(ext4_test_inode_flag(orig_inode, EXT4_INODE_EXTENTS))) {
+ ext4_debug("ext4 move extent: orig file is not extents "
+ "based file [ino:orig %lu]\n", orig_inode->i_ino);
+ return -EOPNOTSUPP;
+- } else if (!(EXT4_I(donor_inode)->i_flags & EXT4_EXTENTS_FL)) {
++ } else if (!(ext4_test_inode_flag(donor_inode, EXT4_INODE_EXTENTS))) {
+ ext4_debug("ext4 move extent: donor file is not extents "
+ "based file [ino:donor %lu]\n", donor_inode->i_ino);
+ return -EOPNOTSUPP;
+@@ -1204,6 +1198,14 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp,
+ return -EINVAL;
+ }
+
++ /* Regular file check */
++ if (!S_ISREG(orig_inode->i_mode) || !S_ISREG(donor_inode->i_mode)) {
++ ext4_debug("ext4 move extent: The argument files should be "
++ "regular file [ino:orig %lu, donor %lu]\n",
++ orig_inode->i_ino, donor_inode->i_ino);
++ return -EINVAL;
++ }
++
+ /* Protect orig and donor inodes against a truncate */
+ ret1 = mext_inode_double_lock(orig_inode, donor_inode);
+ if (ret1 < 0)
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 17a17e1..c3b6ad0 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -660,7 +660,7 @@ int ext4_htree_fill_tree(struct file *dir_file, __u32 start_hash,
+ dxtrace(printk(KERN_DEBUG "In htree_fill_tree, start hash: %x:%x\n",
+ start_hash, start_minor_hash));
+ dir = dir_file->f_path.dentry->d_inode;
+- if (!(EXT4_I(dir)->i_flags & EXT4_INDEX_FL)) {
++ if (!(ext4_test_inode_flag(dir, EXT4_INODE_INDEX))) {
+ hinfo.hash_version = EXT4_SB(dir->i_sb)->s_def_hash_version;
+ if (hinfo.hash_version <= DX_HASH_TEA)
+ hinfo.hash_version +=
+@@ -805,7 +805,7 @@ static void ext4_update_dx_flag(struct inode *inode)
+ {
+ if (!EXT4_HAS_COMPAT_FEATURE(inode->i_sb,
+ EXT4_FEATURE_COMPAT_DIR_INDEX))
+- EXT4_I(inode)->i_flags &= ~EXT4_INDEX_FL;
++ ext4_clear_inode_flag(inode, EXT4_INODE_INDEX);
+ }
+
+ /*
+@@ -1424,7 +1424,7 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
+ brelse(bh);
+ return retval;
+ }
+- EXT4_I(dir)->i_flags |= EXT4_INDEX_FL;
++ ext4_set_inode_flag(dir, EXT4_INODE_INDEX);
+ data1 = bh2->b_data;
+
+ memcpy (data1, de, len);
+@@ -1497,7 +1497,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ retval = ext4_dx_add_entry(handle, dentry, inode);
+ if (!retval || (retval != ERR_BAD_DX_DIR))
+ return retval;
+- EXT4_I(dir)->i_flags &= ~EXT4_INDEX_FL;
++ ext4_clear_inode_flag(dir, EXT4_INODE_INDEX);
+ dx_fallback++;
+ ext4_mark_inode_dirty(handle, dir);
+ }
+@@ -1525,6 +1525,8 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize);
+ retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
+ brelse(bh);
++ if (retval == 0)
++ ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY);
+ return retval;
+ }
+
+@@ -2020,11 +2022,18 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
+ err = ext4_reserve_inode_write(handle, inode, &iloc);
+ if (err)
+ goto out_unlock;
++ /*
++ * Due to previous errors inode may be already a part of on-disk
++ * orphan list. If so skip on-disk list modification.
++ */
++ if (NEXT_ORPHAN(inode) && NEXT_ORPHAN(inode) <=
++ (le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count)))
++ goto mem_insert;
+
+ /* Insert this inode at the head of the on-disk orphan list... */
+ NEXT_ORPHAN(inode) = le32_to_cpu(EXT4_SB(sb)->s_es->s_last_orphan);
+ EXT4_SB(sb)->s_es->s_last_orphan = cpu_to_le32(inode->i_ino);
+- err = ext4_handle_dirty_metadata(handle, inode, EXT4_SB(sb)->s_sbh);
++ err = ext4_handle_dirty_metadata(handle, NULL, EXT4_SB(sb)->s_sbh);
+ rc = ext4_mark_iloc_dirty(handle, inode, &iloc);
+ if (!err)
+ err = rc;
+@@ -2037,6 +2046,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
+ *
+ * This is safe: on error we're going to ignore the orphan list
+ * anyway on the next recovery. */
++mem_insert:
+ if (!err)
+ list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan);
+
+@@ -2096,7 +2106,7 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
+ if (err)
+ goto out_brelse;
+ sbi->s_es->s_last_orphan = cpu_to_le32(ino_next);
+- err = ext4_handle_dirty_metadata(handle, inode, sbi->s_sbh);
++ err = ext4_handle_dirty_metadata(handle, NULL, sbi->s_sbh);
+ } else {
+ struct ext4_iloc iloc2;
+ struct inode *i_prev =
+@@ -2284,7 +2294,7 @@ retry:
+ }
+ } else {
+ /* clear the extent format for fast symlink */
+- EXT4_I(inode)->i_flags &= ~EXT4_EXTENTS_FL;
++ ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
+ inode->i_op = &ext4_fast_symlink_inode_operations;
+ memcpy((char *)&EXT4_I(inode)->i_data, symname, l);
+ inode->i_size = l-1;
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 3b2c554..433ea27 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -930,7 +930,8 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
+ percpu_counter_add(&sbi->s_freeinodes_counter,
+ EXT4_INODES_PER_GROUP(sb));
+
+- if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG)) {
++ if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG) &&
++ sbi->s_log_groups_per_flex) {
+ ext4_group_t flex_group;
+ flex_group = ext4_flex_group(sbi, input->group);
+ atomic_add(input->free_blocks_count,
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 92943f2..54a05cc 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -227,6 +227,7 @@ handle_t *ext4_journal_start_sb(struct super_block *sb, int nblocks)
+ if (sb->s_flags & MS_RDONLY)
+ return ERR_PTR(-EROFS);
+
++ vfs_check_frozen(sb, SB_FREEZE_WRITE);
+ /* Special case here: if the journal has aborted behind our
+ * backs (eg. EIO in the commit thread), then we still need to
+ * take the FS itself readonly cleanly. */
+@@ -702,6 +703,7 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
+ ei->i_reserved_data_blocks = 0;
+ ei->i_reserved_meta_blocks = 0;
+ ei->i_allocated_meta_blocks = 0;
++ ei->i_da_metadata_calc_len = 0;
+ ei->i_delalloc_reserved_flag = 0;
+ spin_lock_init(&(ei->i_block_reservation_lock));
+ #ifdef CONFIG_QUOTA
+@@ -875,6 +877,8 @@ static int ext4_show_options(struct seq_file *seq, struct vfsmount *vfs)
+ seq_puts(seq, test_opt(sb, BARRIER) ? "1" : "0");
+ if (test_opt(sb, JOURNAL_ASYNC_COMMIT))
+ seq_puts(seq, ",journal_async_commit");
++ else if (test_opt(sb, JOURNAL_CHECKSUM))
++ seq_puts(seq, ",journal_checksum");
+ if (test_opt(sb, NOBH))
+ seq_puts(seq, ",nobh");
+ if (test_opt(sb, I_VERSION))
+@@ -2693,24 +2697,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ get_random_bytes(&sbi->s_next_generation, sizeof(u32));
+ spin_lock_init(&sbi->s_next_gen_lock);
+
+- err = percpu_counter_init(&sbi->s_freeblocks_counter,
+- ext4_count_free_blocks(sb));
+- if (!err) {
+- err = percpu_counter_init(&sbi->s_freeinodes_counter,
+- ext4_count_free_inodes(sb));
+- }
+- if (!err) {
+- err = percpu_counter_init(&sbi->s_dirs_counter,
+- ext4_count_dirs(sb));
+- }
+- if (!err) {
+- err = percpu_counter_init(&sbi->s_dirtyblocks_counter, 0);
+- }
+- if (err) {
+- ext4_msg(sb, KERN_ERR, "insufficient memory");
+- goto failed_mount3;
+- }
+-
+ sbi->s_stripe = ext4_get_stripe_size(sbi);
+ sbi->s_max_writeback_mb_bump = 128;
+
+@@ -2830,7 +2816,20 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);
+
+ no_journal:
+-
++ err = percpu_counter_init(&sbi->s_freeblocks_counter,
++ ext4_count_free_blocks(sb));
++ if (!err)
++ err = percpu_counter_init(&sbi->s_freeinodes_counter,
++ ext4_count_free_inodes(sb));
++ if (!err)
++ err = percpu_counter_init(&sbi->s_dirs_counter,
++ ext4_count_dirs(sb));
++ if (!err)
++ err = percpu_counter_init(&sbi->s_dirtyblocks_counter, 0);
++ if (err) {
++ ext4_msg(sb, KERN_ERR, "insufficient memory");
++ goto failed_mount_wq;
++ }
+ if (test_opt(sb, NOBH)) {
+ if (!(test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA)) {
+ ext4_msg(sb, KERN_WARNING, "Ignoring nobh option - "
+@@ -2905,7 +2904,7 @@ no_journal:
+ err = ext4_setup_system_zone(sb);
+ if (err) {
+ ext4_msg(sb, KERN_ERR, "failed to initialize system "
+- "zone (%d)\n", err);
++ "zone (%d)", err);
+ goto failed_mount4;
+ }
+
+@@ -2963,6 +2962,10 @@ failed_mount_wq:
+ jbd2_journal_destroy(sbi->s_journal);
+ sbi->s_journal = NULL;
+ }
++ percpu_counter_destroy(&sbi->s_freeblocks_counter);
++ percpu_counter_destroy(&sbi->s_freeinodes_counter);
++ percpu_counter_destroy(&sbi->s_dirs_counter);
++ percpu_counter_destroy(&sbi->s_dirtyblocks_counter);
+ failed_mount3:
+ if (sbi->s_flex_groups) {
+ if (is_vmalloc_addr(sbi->s_flex_groups))
+@@ -2970,10 +2973,6 @@ failed_mount3:
+ else
+ kfree(sbi->s_flex_groups);
+ }
+- percpu_counter_destroy(&sbi->s_freeblocks_counter);
+- percpu_counter_destroy(&sbi->s_freeinodes_counter);
+- percpu_counter_destroy(&sbi->s_dirs_counter);
+- percpu_counter_destroy(&sbi->s_dirtyblocks_counter);
+ failed_mount2:
+ for (i = 0; i < db_count; i++)
+ brelse(sbi->s_group_desc[i]);
+@@ -3390,8 +3389,10 @@ int ext4_force_commit(struct super_block *sb)
+ return 0;
+
+ journal = EXT4_SB(sb)->s_journal;
+- if (journal)
++ if (journal) {
++ vfs_check_frozen(sb, SB_FREEZE_WRITE);
+ ret = ext4_journal_force_commit(journal);
++ }
+
+ return ret;
+ }
+@@ -3440,18 +3441,16 @@ static int ext4_freeze(struct super_block *sb)
+ * the journal.
+ */
+ error = jbd2_journal_flush(journal);
+- if (error < 0) {
+- out:
+- jbd2_journal_unlock_updates(journal);
+- return error;
+- }
++ if (error < 0)
++ goto out;
+
+ /* Journal blocked and flushed, clear needs_recovery flag. */
+ EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
+ error = ext4_commit_super(sb, 1);
+- if (error)
+- goto out;
+- return 0;
++out:
++ /* we rely on s_frozen to stop further updates */
++ jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
++ return error;
+ }
+
+ /*
+@@ -3468,7 +3467,6 @@ static int ext4_unfreeze(struct super_block *sb)
+ EXT4_SET_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
+ ext4_commit_super(sb, 1);
+ unlock_super(sb);
+- jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+ return 0;
+ }
+
+@@ -4001,6 +3999,7 @@ static int __init init_ext4_fs(void)
+ {
+ int err;
+
++ ext4_check_flag_values();
+ err = init_ext4_system_zone();
+ if (err)
+ return err;
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 0257019..4de7d0a 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -267,7 +267,7 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name,
+ void *end;
+ int error;
+
+- if (!(EXT4_I(inode)->i_state & EXT4_STATE_XATTR))
++ if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR))
+ return -ENODATA;
+ error = ext4_get_inode_loc(inode, &iloc);
+ if (error)
+@@ -393,7 +393,7 @@ ext4_xattr_ibody_list(struct inode *inode, char *buffer, size_t buffer_size)
+ void *end;
+ int error;
+
+- if (!(EXT4_I(inode)->i_state & EXT4_STATE_XATTR))
++ if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR))
+ return 0;
+ error = ext4_get_inode_loc(inode, &iloc);
+ if (error)
+@@ -816,7 +816,7 @@ inserted:
+ EXT4_I(inode)->i_block_group);
+
+ /* non-extent files can't have physical blocks past 2^32 */
+- if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+ goal = goal & EXT4_MAX_BLOCK_FILE_PHYS;
+
+ block = ext4_new_meta_blocks(handle, inode,
+@@ -824,7 +824,7 @@ inserted:
+ if (error)
+ goto cleanup;
+
+- if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+ BUG_ON(block > EXT4_MAX_BLOCK_FILE_PHYS);
+
+ ea_idebug(inode, "creating block %d", block);
+@@ -903,7 +903,7 @@ ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i,
+ is->s.base = is->s.first = IFIRST(header);
+ is->s.here = is->s.first;
+ is->s.end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
+- if (EXT4_I(inode)->i_state & EXT4_STATE_XATTR) {
++ if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) {
+ error = ext4_xattr_check_names(IFIRST(header), is->s.end);
+ if (error)
+ return error;
+@@ -935,10 +935,10 @@ ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
+ header = IHDR(inode, ext4_raw_inode(&is->iloc));
+ if (!IS_LAST_ENTRY(s->first)) {
+ header->h_magic = cpu_to_le32(EXT4_XATTR_MAGIC);
+- EXT4_I(inode)->i_state |= EXT4_STATE_XATTR;
++ ext4_set_inode_state(inode, EXT4_STATE_XATTR);
+ } else {
+ header->h_magic = cpu_to_le32(0);
+- EXT4_I(inode)->i_state &= ~EXT4_STATE_XATTR;
++ ext4_clear_inode_state(inode, EXT4_STATE_XATTR);
+ }
+ return 0;
+ }
+@@ -981,8 +981,8 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
+ if (strlen(name) > 255)
+ return -ERANGE;
+ down_write(&EXT4_I(inode)->xattr_sem);
+- no_expand = EXT4_I(inode)->i_state & EXT4_STATE_NO_EXPAND;
+- EXT4_I(inode)->i_state |= EXT4_STATE_NO_EXPAND;
++ no_expand = ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND);
++ ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND);
+
+ error = ext4_get_inode_loc(inode, &is.iloc);
+ if (error)
+@@ -992,10 +992,10 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
+ if (error)
+ goto cleanup;
+
+- if (EXT4_I(inode)->i_state & EXT4_STATE_NEW) {
++ if (ext4_test_inode_state(inode, EXT4_STATE_NEW)) {
+ struct ext4_inode *raw_inode = ext4_raw_inode(&is.iloc);
+ memset(raw_inode, 0, EXT4_SB(inode->i_sb)->s_inode_size);
+- EXT4_I(inode)->i_state &= ~EXT4_STATE_NEW;
++ ext4_clear_inode_state(inode, EXT4_STATE_NEW);
+ }
+
+ error = ext4_xattr_ibody_find(inode, &i, &is);
+@@ -1047,7 +1047,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
+ ext4_xattr_update_super_block(handle, inode->i_sb);
+ inode->i_ctime = ext4_current_time(inode);
+ if (!value)
+- EXT4_I(inode)->i_state &= ~EXT4_STATE_NO_EXPAND;
++ ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
+ error = ext4_mark_iloc_dirty(handle, inode, &is.iloc);
+ /*
+ * The bh is consumed by ext4_mark_iloc_dirty, even with
+@@ -1062,7 +1062,7 @@ cleanup:
+ brelse(is.iloc.bh);
+ brelse(bs.bh);
+ if (no_expand == 0)
+- EXT4_I(inode)->i_state &= ~EXT4_STATE_NO_EXPAND;
++ ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
+ up_write(&EXT4_I(inode)->xattr_sem);
+ return error;
+ }
+@@ -1327,6 +1327,8 @@ retry:
+ goto cleanup;
+ kfree(b_entry_name);
+ kfree(buffer);
++ b_entry_name = NULL;
++ buffer = NULL;
+ brelse(is->iloc.bh);
+ kfree(is);
+ kfree(bs);
+diff --git a/fs/gfs2/acl.c b/fs/gfs2/acl.c
+index 3fc4e3a..2168da1 100644
+--- a/fs/gfs2/acl.c
++++ b/fs/gfs2/acl.c
+@@ -12,6 +12,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/completion.h>
+ #include <linux/buffer_head.h>
++#include <linux/xattr.h>
+ #include <linux/posix_acl.h>
+ #include <linux/posix_acl_xattr.h>
+ #include <linux/gfs2_ondisk.h>
+@@ -26,61 +27,6 @@
+ #include "trans.h"
+ #include "util.h"
+
+-#define ACL_ACCESS 1
+-#define ACL_DEFAULT 0
+-
+-int gfs2_acl_validate_set(struct gfs2_inode *ip, int access,
+- struct gfs2_ea_request *er, int *remove, mode_t *mode)
+-{
+- struct posix_acl *acl;
+- int error;
+-
+- error = gfs2_acl_validate_remove(ip, access);
+- if (error)
+- return error;
+-
+- if (!er->er_data)
+- return -EINVAL;
+-
+- acl = posix_acl_from_xattr(er->er_data, er->er_data_len);
+- if (IS_ERR(acl))
+- return PTR_ERR(acl);
+- if (!acl) {
+- *remove = 1;
+- return 0;
+- }
+-
+- error = posix_acl_valid(acl);
+- if (error)
+- goto out;
+-
+- if (access) {
+- error = posix_acl_equiv_mode(acl, mode);
+- if (!error)
+- *remove = 1;
+- else if (error > 0)
+- error = 0;
+- }
+-
+-out:
+- posix_acl_release(acl);
+- return error;
+-}
+-
+-int gfs2_acl_validate_remove(struct gfs2_inode *ip, int access)
+-{
+- if (!GFS2_SB(&ip->i_inode)->sd_args.ar_posix_acl)
+- return -EOPNOTSUPP;
+- if (!is_owner_or_cap(&ip->i_inode))
+- return -EPERM;
+- if (S_ISLNK(ip->i_inode.i_mode))
+- return -EOPNOTSUPP;
+- if (!access && !S_ISDIR(ip->i_inode.i_mode))
+- return -EACCES;
+-
+- return 0;
+-}
+-
+ static int acl_get(struct gfs2_inode *ip, const char *name,
+ struct posix_acl **acl, struct gfs2_ea_location *el,
+ char **datap, unsigned int *lenp)
+@@ -277,3 +223,117 @@ out_brelse:
+ return error;
+ }
+
++static int gfs2_acl_type(const char *name)
++{
++ if (strcmp(name, GFS2_POSIX_ACL_ACCESS) == 0)
++ return ACL_TYPE_ACCESS;
++ if (strcmp(name, GFS2_POSIX_ACL_DEFAULT) == 0)
++ return ACL_TYPE_DEFAULT;
++ return -EINVAL;
++}
++
++static int gfs2_xattr_system_get(struct inode *inode, const char *name,
++ void *buffer, size_t size)
++{
++ int type;
++
++ type = gfs2_acl_type(name);
++ if (type < 0)
++ return type;
++
++ return gfs2_xattr_get(inode, GFS2_EATYPE_SYS, name, buffer, size);
++}
++
++static int gfs2_set_mode(struct inode *inode, mode_t mode)
++{
++ int error = 0;
++
++ if (mode != inode->i_mode) {
++ struct iattr iattr;
++
++ iattr.ia_valid = ATTR_MODE;
++ iattr.ia_mode = mode;
++
++ error = gfs2_setattr_simple(GFS2_I(inode), &iattr);
++ }
++
++ return error;
++}
++
++static int gfs2_xattr_system_set(struct inode *inode, const char *name,
++ const void *value, size_t size, int flags)
++{
++ struct gfs2_sbd *sdp = GFS2_SB(inode);
++ struct posix_acl *acl = NULL;
++ int error = 0, type;
++
++ if (!sdp->sd_args.ar_posix_acl)
++ return -EOPNOTSUPP;
++
++ type = gfs2_acl_type(name);
++ if (type < 0)
++ return type;
++ if (flags & XATTR_CREATE)
++ return -EINVAL;
++ if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
++ return value ? -EACCES : 0;
++ if ((current_fsuid() != inode->i_uid) && !capable(CAP_FOWNER))
++ return -EPERM;
++ if (S_ISLNK(inode->i_mode))
++ return -EOPNOTSUPP;
++
++ if (!value)
++ goto set_acl;
++
++ acl = posix_acl_from_xattr(value, size);
++ if (!acl) {
++ /*
++ * acl_set_file(3) may request that we set default ACLs with
++ * zero length -- defend (gracefully) against that here.
++ */
++ goto out;
++ }
++ if (IS_ERR(acl)) {
++ error = PTR_ERR(acl);
++ goto out;
++ }
++
++ error = posix_acl_valid(acl);
++ if (error)
++ goto out_release;
++
++ error = -EINVAL;
++ if (acl->a_count > GFS2_ACL_MAX_ENTRIES)
++ goto out_release;
++
++ if (type == ACL_TYPE_ACCESS) {
++ mode_t mode = inode->i_mode;
++ error = posix_acl_equiv_mode(acl, &mode);
++
++ if (error <= 0) {
++ posix_acl_release(acl);
++ acl = NULL;
++
++ if (error < 0)
++ return error;
++ }
++
++ error = gfs2_set_mode(inode, mode);
++ if (error)
++ goto out_release;
++ }
++
++set_acl:
++ error = gfs2_xattr_set(inode, GFS2_EATYPE_SYS, name, value, size, 0);
++out_release:
++ posix_acl_release(acl);
++out:
++ return error;
++}
++
++struct xattr_handler gfs2_xattr_system_handler = {
++ .prefix = XATTR_SYSTEM_PREFIX,
++ .get = gfs2_xattr_system_get,
++ .set = gfs2_xattr_system_set,
++};
++
+diff --git a/fs/gfs2/acl.h b/fs/gfs2/acl.h
+index 6751930..cc95439 100644
+--- a/fs/gfs2/acl.h
++++ b/fs/gfs2/acl.h
+@@ -13,26 +13,12 @@
+ #include "incore.h"
+
+ #define GFS2_POSIX_ACL_ACCESS "posix_acl_access"
+-#define GFS2_POSIX_ACL_ACCESS_LEN 16
+ #define GFS2_POSIX_ACL_DEFAULT "posix_acl_default"
+-#define GFS2_POSIX_ACL_DEFAULT_LEN 17
++#define GFS2_ACL_MAX_ENTRIES 25
+
+-#define GFS2_ACL_IS_ACCESS(name, len) \
+- ((len) == GFS2_POSIX_ACL_ACCESS_LEN && \
+- !memcmp(GFS2_POSIX_ACL_ACCESS, (name), (len)))
+-
+-#define GFS2_ACL_IS_DEFAULT(name, len) \
+- ((len) == GFS2_POSIX_ACL_DEFAULT_LEN && \
+- !memcmp(GFS2_POSIX_ACL_DEFAULT, (name), (len)))
+-
+-struct gfs2_ea_request;
+-
+-int gfs2_acl_validate_set(struct gfs2_inode *ip, int access,
+- struct gfs2_ea_request *er,
+- int *remove, mode_t *mode);
+-int gfs2_acl_validate_remove(struct gfs2_inode *ip, int access);
+-int gfs2_check_acl(struct inode *inode, int mask);
+-int gfs2_acl_create(struct gfs2_inode *dip, struct gfs2_inode *ip);
+-int gfs2_acl_chmod(struct gfs2_inode *ip, struct iattr *attr);
++extern int gfs2_check_acl(struct inode *inode, int mask);
++extern int gfs2_acl_create(struct gfs2_inode *dip, struct gfs2_inode *ip);
++extern int gfs2_acl_chmod(struct gfs2_inode *ip, struct iattr *attr);
++extern struct xattr_handler gfs2_xattr_system_handler;
+
+ #endif /* __ACL_DOT_H__ */
+diff --git a/fs/gfs2/xattr.c b/fs/gfs2/xattr.c
+index 8a0f8ef..6b80354 100644
+--- a/fs/gfs2/xattr.c
++++ b/fs/gfs2/xattr.c
+@@ -1507,18 +1507,6 @@ static int gfs2_xattr_user_set(struct inode *inode, const char *name,
+ return gfs2_xattr_set(inode, GFS2_EATYPE_USR, name, value, size, flags);
+ }
+
+-static int gfs2_xattr_system_get(struct inode *inode, const char *name,
+- void *buffer, size_t size)
+-{
+- return gfs2_xattr_get(inode, GFS2_EATYPE_SYS, name, buffer, size);
+-}
+-
+-static int gfs2_xattr_system_set(struct inode *inode, const char *name,
+- const void *value, size_t size, int flags)
+-{
+- return gfs2_xattr_set(inode, GFS2_EATYPE_SYS, name, value, size, flags);
+-}
+-
+ static int gfs2_xattr_security_get(struct inode *inode, const char *name,
+ void *buffer, size_t size)
+ {
+@@ -1543,12 +1531,6 @@ static struct xattr_handler gfs2_xattr_security_handler = {
+ .set = gfs2_xattr_security_set,
+ };
+
+-static struct xattr_handler gfs2_xattr_system_handler = {
+- .prefix = XATTR_SYSTEM_PREFIX,
+- .get = gfs2_xattr_system_get,
+- .set = gfs2_xattr_system_set,
+-};
+-
+ struct xattr_handler *gfs2_xattr_handlers[] = {
+ &gfs2_xattr_user_handler,
+ &gfs2_xattr_security_handler,
+diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
+index ca0f5eb..8868493 100644
+--- a/fs/jbd2/checkpoint.c
++++ b/fs/jbd2/checkpoint.c
+@@ -22,6 +22,7 @@
+ #include <linux/jbd2.h>
+ #include <linux/errno.h>
+ #include <linux/slab.h>
++#include <linux/blkdev.h>
+ #include <trace/events/jbd2.h>
+
+ /*
+@@ -515,6 +516,20 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
+ journal->j_tail_sequence = first_tid;
+ journal->j_tail = blocknr;
+ spin_unlock(&journal->j_state_lock);
++
++ /*
++ * If there is an external journal, we need to make sure that
++ * any data blocks that were recently written out --- perhaps
++ * by jbd2_log_do_checkpoint() --- are flushed out before we
++ * drop the transactions from the external journal. It's
++ * unlikely this will be necessary, especially with a
++ * appropriately sized journal, but we need this to guarantee
++ * correctness. Fortunately jbd2_cleanup_journal_tail()
++ * doesn't get called all that often.
++ */
++ if ((journal->j_fs_dev != journal->j_dev) &&
++ (journal->j_flags & JBD2_BARRIER))
++ blkdev_issue_flush(journal->j_fs_dev, NULL);
+ if (!(journal->j_flags & JBD2_ABORT))
+ jbd2_journal_update_superblock(journal, 1);
+ return 0;
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index 8896c1d..09ab6ac 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -259,6 +259,7 @@ static int journal_submit_data_buffers(journal_t *journal,
+ ret = err;
+ spin_lock(&journal->j_list_lock);
+ J_ASSERT(jinode->i_transaction == commit_transaction);
++ commit_transaction->t_flushed_data_blocks = 1;
+ jinode->i_flags &= ~JI_COMMIT_RUNNING;
+ wake_up_bit(&jinode->i_flags, __JI_COMMIT_RUNNING);
+ }
+@@ -708,8 +709,17 @@ start_journal_io:
+ }
+ }
+
+- /* Done it all: now write the commit record asynchronously. */
++ /*
++ * If the journal is not located on the file system device,
++ * then we must flush the file system device before we issue
++ * the commit record
++ */
++ if (commit_transaction->t_flushed_data_blocks &&
++ (journal->j_fs_dev != journal->j_dev) &&
++ (journal->j_flags & JBD2_BARRIER))
++ blkdev_issue_flush(journal->j_fs_dev, NULL);
+
++ /* Done it all: now write the commit record asynchronously. */
+ if (JBD2_HAS_INCOMPAT_FEATURE(journal,
+ JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT)) {
+ err = journal_submit_commit_record(journal, commit_transaction,
+@@ -720,13 +730,6 @@ start_journal_io:
+ blkdev_issue_flush(journal->j_dev, NULL);
+ }
+
+- /*
+- * This is the right place to wait for data buffers both for ASYNC
+- * and !ASYNC commit. If commit is ASYNC, we need to wait only after
+- * the commit block went to disk (which happens above). If commit is
+- * SYNC, we need to wait for data buffers before we start writing
+- * commit block, which happens below in such setting.
+- */
+ err = journal_finish_inode_data_buffers(journal, commit_transaction);
+ if (err) {
+ printk(KERN_WARNING
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index a4cd1b7..5ec74cd 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -840,8 +840,8 @@ static void encode_attrs(struct xdr_stream *xdr, const struct iattr *iap, const
+ bmval1 |= FATTR4_WORD1_TIME_ACCESS_SET;
+ *p++ = cpu_to_be32(NFS4_SET_TO_CLIENT_TIME);
+ *p++ = cpu_to_be32(0);
+- *p++ = cpu_to_be32(iap->ia_mtime.tv_sec);
+- *p++ = cpu_to_be32(iap->ia_mtime.tv_nsec);
++ *p++ = cpu_to_be32(iap->ia_atime.tv_sec);
++ *p++ = cpu_to_be32(iap->ia_atime.tv_nsec);
+ }
+ else if (iap->ia_valid & ATTR_ATIME) {
+ bmval1 |= FATTR4_WORD1_TIME_ACCESS_SET;
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 4bf23f6..a53b9e5 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -534,6 +534,22 @@ static void nfs_show_mountd_options(struct seq_file *m, struct nfs_server *nfss,
+ }
+ }
+
++#ifdef CONFIG_NFS_V4
++static void nfs_show_nfsv4_options(struct seq_file *m, struct nfs_server *nfss,
++ int showdefaults)
++{
++ struct nfs_client *clp = nfss->nfs_client;
++
++ seq_printf(m, ",clientaddr=%s", clp->cl_ipaddr);
++ seq_printf(m, ",minorversion=%u", clp->cl_minorversion);
++}
++#else
++static void nfs_show_nfsv4_options(struct seq_file *m, struct nfs_server *nfss,
++ int showdefaults)
++{
++}
++#endif
++
+ /*
+ * Describe the mount options in force on this server representation
+ */
+@@ -595,11 +611,9 @@ static void nfs_show_mount_options(struct seq_file *m, struct nfs_server *nfss,
+
+ if (version != 4)
+ nfs_show_mountd_options(m, nfss, showdefaults);
++ else
++ nfs_show_nfsv4_options(m, nfss, showdefaults);
+
+-#ifdef CONFIG_NFS_V4
+- if (clp->rpc_ops->version == 4)
+- seq_printf(m, ",clientaddr=%s", clp->cl_ipaddr);
+-#endif
+ if (nfss->options & NFS_OPTION_FSCACHE)
+ seq_printf(m, ",fsc");
+ }
+diff --git a/include/acpi/processor.h b/include/acpi/processor.h
+index 740ac3a..e7bdaaf 100644
+--- a/include/acpi/processor.h
++++ b/include/acpi/processor.h
+@@ -48,7 +48,7 @@ struct acpi_power_register {
+ u8 space_id;
+ u8 bit_width;
+ u8 bit_offset;
+- u8 reserved;
++ u8 access_size;
+ u64 address;
+ } __attribute__ ((packed));
+
+@@ -74,6 +74,7 @@ struct acpi_processor_cx {
+ u32 power;
+ u32 usage;
+ u64 time;
++ u8 bm_sts_skip;
+ struct acpi_processor_cx_policy promotion;
+ struct acpi_processor_cx_policy demotion;
+ char desc[ACPI_CX_DESC_LEN];
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index 07432a1..c010b94 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -251,7 +251,6 @@ int acpi_check_mem_region(resource_size_t start, resource_size_t n,
+ void __init acpi_no_s4_hw_signature(void);
+ void __init acpi_old_suspend_ordering(void);
+ void __init acpi_s4_no_nvs(void);
+-void __init acpi_set_sci_en_on_resume(void);
+ #endif /* CONFIG_PM_SLEEP */
+
+ struct acpi_osc_context {
+diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
+index 15e4eb7..7ffab7c 100644
+--- a/include/linux/ethtool.h
++++ b/include/linux/ethtool.h
+@@ -357,6 +357,8 @@ struct ethtool_rxnfc {
+ __u32 flow_type;
+ /* The rx flow hash value or the rule DB size */
+ __u64 data;
++ /* The following fields are not valid and must not be used for
++ * the ETHTOOL_{G,X}RXFH commands. */
+ struct ethtool_rx_flow_spec fs;
+ __u32 rule_cnt;
+ __u32 rule_locs[0];
+diff --git a/include/linux/fb.h b/include/linux/fb.h
+index de9c722..862e7d4 100644
+--- a/include/linux/fb.h
++++ b/include/linux/fb.h
+@@ -784,8 +784,6 @@ struct fb_tile_ops {
+ #define FBINFO_MISC_USEREVENT 0x10000 /* event request
+ from userspace */
+ #define FBINFO_MISC_TILEBLITTING 0x20000 /* use tile blitting */
+-#define FBINFO_MISC_FIRMWARE 0x40000 /* a replaceable firmware
+- inited framebuffer */
+
+ /* A driver may set this flag to indicate that it does want a set_par to be
+ * called every time when fbcon_switch is executed. The advantage is that with
+@@ -799,6 +797,8 @@ struct fb_tile_ops {
+ */
+ #define FBINFO_MISC_ALWAYS_SETPAR 0x40000
+
++/* where the fb is a firmware driver, and can be replaced with a proper one */
++#define FBINFO_MISC_FIRMWARE 0x80000
+ /*
+ * Host and GPU endianness differ.
+ */
+diff --git a/include/linux/firmware.h b/include/linux/firmware.h
+index d315446..83d7510 100644
+--- a/include/linux/firmware.h
++++ b/include/linux/firmware.h
+@@ -11,6 +11,7 @@
+ struct firmware {
+ size_t size;
+ const u8 *data;
++ struct page **pages;
+ };
+
+ struct device;
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index 52e15e0..e766072 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -1098,6 +1098,8 @@ enum ieee80211_category {
+ WLAN_CATEGORY_SA_QUERY = 8,
+ WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION = 9,
+ WLAN_CATEGORY_WMM = 17,
++ WLAN_CATEGORY_MESH_PLINK = 30, /* Pending ANA approval */
++ WLAN_CATEGORY_MESH_PATH_SEL = 32, /* Pending ANA approval */
+ WLAN_CATEGORY_VENDOR_SPECIFIC_PROTECTED = 126,
+ WLAN_CATEGORY_VENDOR_SPECIFIC = 127,
+ };
+diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
+index f1011f7..638ce45 100644
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -653,6 +653,7 @@ struct transaction_s
+ * waiting for it to finish.
+ */
+ unsigned int t_synchronous_commit:1;
++ unsigned int t_flushed_data_blocks:1;
+
+ /*
+ * For use by the filesystem to store fs-specific data
+diff --git a/include/linux/mmc/sdio.h b/include/linux/mmc/sdio.h
+index 47ba464..118f029 100644
+--- a/include/linux/mmc/sdio.h
++++ b/include/linux/mmc/sdio.h
+@@ -94,6 +94,8 @@
+
+ #define SDIO_BUS_WIDTH_1BIT 0x00
+ #define SDIO_BUS_WIDTH_4BIT 0x02
++#define SDIO_BUS_ECSI 0x20 /* Enable continuous SPI interrupt */
++#define SDIO_BUS_SCSI 0x40 /* Support continuous SPI interrupt */
+
+ #define SDIO_BUS_CD_DISABLE 0x80 /* disable pull-up on DAT3 (pin 1) */
+
+diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
+index 3d0a9ff..a28c37d 100644
+--- a/include/linux/ssb/ssb.h
++++ b/include/linux/ssb/ssb.h
+@@ -302,6 +302,7 @@ struct ssb_bus {
+ u16 chip_id;
+ u16 chip_rev;
+ u16 sprom_size; /* number of words in sprom */
++ u16 sprom_offset;
+ u8 chip_package;
+
+ /* List of devices (cores) on the backplane. */
+diff --git a/include/linux/ssb/ssb_driver_chipcommon.h b/include/linux/ssb/ssb_driver_chipcommon.h
+index 4e27acf..7600f38 100644
+--- a/include/linux/ssb/ssb_driver_chipcommon.h
++++ b/include/linux/ssb/ssb_driver_chipcommon.h
+@@ -46,6 +46,7 @@
+ #define SSB_PLLTYPE_7 0x00038000 /* 25Mhz, 4 dividers */
+ #define SSB_CHIPCO_CAP_PCTL 0x00040000 /* Power Control */
+ #define SSB_CHIPCO_CAP_OTPS 0x00380000 /* OTP size */
++#define SSB_CHIPCO_CAP_SPROM 0x40000000 /* SPROM present */
+ #define SSB_CHIPCO_CAP_OTPS_SHIFT 19
+ #define SSB_CHIPCO_CAP_OTPS_BASE 5
+ #define SSB_CHIPCO_CAP_JTAGM 0x00400000 /* JTAG master present */
+@@ -564,6 +565,7 @@ struct ssb_chipcommon_pmu {
+ struct ssb_chipcommon {
+ struct ssb_device *dev;
+ u32 capabilities;
++ u32 status;
+ /* Fast Powerup Delay constant */
+ u16 fast_pwrup_delay;
+ struct ssb_chipcommon_pmu pmu;
+diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
+index 9ae9082..b8be23c 100644
+--- a/include/linux/ssb/ssb_regs.h
++++ b/include/linux/ssb/ssb_regs.h
+@@ -170,7 +170,8 @@
+ #define SSB_SPROMSIZE_WORDS_R4 220
+ #define SSB_SPROMSIZE_BYTES_R123 (SSB_SPROMSIZE_WORDS_R123 * sizeof(u16))
+ #define SSB_SPROMSIZE_BYTES_R4 (SSB_SPROMSIZE_WORDS_R4 * sizeof(u16))
+-#define SSB_SPROM_BASE 0x1000
++#define SSB_SPROM_BASE1 0x1000
++#define SSB_SPROM_BASE31 0x0800
+ #define SSB_SPROM_REVISION 0x107E
+ #define SSB_SPROM_REVISION_REV 0x00FF /* SPROM Revision number */
+ #define SSB_SPROM_REVISION_CRC 0xFF00 /* SPROM CRC8 value */
+diff --git a/include/math-emu/op-common.h b/include/math-emu/op-common.h
+index f456534..3e2576d 100644
+--- a/include/math-emu/op-common.h
++++ b/include/math-emu/op-common.h
+@@ -799,7 +799,7 @@ do { \
+ X##_e -= (_FP_W_TYPE_SIZE - rsize); \
+ X##_e = rsize - X##_e - 1; \
+ \
+- if (_FP_FRACBITS_##fs < rsize && _FP_WFRACBITS_##fs < X##_e) \
++ if (_FP_FRACBITS_##fs < rsize && _FP_WFRACBITS_##fs <= X##_e) \
+ __FP_FRAC_SRS_1(ur_, (X##_e - _FP_WFRACBITS_##fs + 1), rsize);\
+ _FP_FRAC_DISASSEMBLE_##wc(X, ur_, rsize); \
+ if ((_FP_WFRACBITS_##fs - X##_e - 1) > 0) \
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 1ad4fa6..3071911 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -429,20 +429,11 @@ static void free_pi_state(struct futex_pi_state *pi_state)
+ static struct task_struct * futex_find_get_task(pid_t pid)
+ {
+ struct task_struct *p;
+- const struct cred *cred = current_cred(), *pcred;
+
+ rcu_read_lock();
+ p = find_task_by_vpid(pid);
+- if (!p) {
+- p = ERR_PTR(-ESRCH);
+- } else {
+- pcred = __task_cred(p);
+- if (cred->euid != pcred->euid &&
+- cred->euid != pcred->uid)
+- p = ERR_PTR(-ESRCH);
+- else
+- get_task_struct(p);
+- }
++ if (p)
++ get_task_struct(p);
+
+ rcu_read_unlock();
+
+@@ -564,8 +555,8 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ if (!pid)
+ return -ESRCH;
+ p = futex_find_get_task(pid);
+- if (IS_ERR(p))
+- return PTR_ERR(p);
++ if (!p)
++ return -ESRCH;
+
+ /*
+ * We need to look at the task state flags to figure out,
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 986519e..fa4bdd4 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -436,6 +436,9 @@ int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
+ /* note that IRQF_TRIGGER_MASK == IRQ_TYPE_SENSE_MASK */
+ desc->status &= ~(IRQ_LEVEL | IRQ_TYPE_SENSE_MASK);
+ desc->status |= flags;
++
++ if (chip != desc->chip)
++ irq_chip_set_defaults(desc->chip);
+ }
+
+ return ret;
+diff --git a/kernel/module.c b/kernel/module.c
+index dfa33e8..4b270e6 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -870,7 +870,6 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
+ mutex_lock(&module_mutex);
+ /* Store the name of the last unloaded module for diagnostic purposes */
+ strlcpy(last_unloaded_module, mod->name, sizeof(last_unloaded_module));
+- ddebug_remove_module(mod->name);
+ free_module(mod);
+
+ out:
+@@ -1533,6 +1532,9 @@ static void free_module(struct module *mod)
+ remove_sect_attrs(mod);
+ mod_kobject_remove(mod);
+
++ /* Remove dynamic debug info */
++ ddebug_remove_module(mod->name);
++
+ /* Arch-specific cleanup. */
+ module_arch_cleanup(mod);
+
+diff --git a/kernel/sched.c b/kernel/sched.c
+index 34d924e..a0157c7 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -1261,6 +1261,12 @@ static void sched_avg_update(struct rq *rq)
+ s64 period = sched_avg_period();
+
+ while ((s64)(rq->clock - rq->age_stamp) > period) {
++ /*
++ * Inline assembly required to prevent the compiler
++ * optimising this loop into a divmod call.
++ * See __iter_div_u64_rem() for another example of this.
++ */
++ asm("" : "+rm" (rq->age_stamp));
+ rq->age_stamp += period;
+ rq->rt_avg /= 2;
+ }
+@@ -1711,9 +1717,6 @@ static void update_shares_locked(struct rq *rq, struct sched_domain *sd)
+
+ static void update_h_load(long cpu)
+ {
+- if (root_task_group_empty())
+- return;
+-
+ walk_tg_tree(tg_load_down, tg_nop, (void *)cpu);
+ }
+
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index 4c12ddb..5aef51e 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -216,22 +216,34 @@ static int ethtool_get_drvinfo(struct net_device *dev, void __user *useraddr)
+ return 0;
+ }
+
+-static int ethtool_set_rxnfc(struct net_device *dev, void __user *useraddr)
++static int ethtool_set_rxnfc(struct net_device *dev,
++ u32 cmd, void __user *useraddr)
+ {
+- struct ethtool_rxnfc cmd;
++ struct ethtool_rxnfc info;
++ size_t info_size = sizeof(info);
+
+ if (!dev->ethtool_ops->set_rxnfc)
+ return -EOPNOTSUPP;
+
+- if (copy_from_user(&cmd, useraddr, sizeof(cmd)))
++ /* struct ethtool_rxnfc was originally defined for
++ * ETHTOOL_{G,S}RXFH with only the cmd, flow_type and data
++ * members. User-space might still be using that
++ * definition. */
++ if (cmd == ETHTOOL_SRXFH)
++ info_size = (offsetof(struct ethtool_rxnfc, data) +
++ sizeof(info.data));
++
++ if (copy_from_user(&info, useraddr, info_size))
+ return -EFAULT;
+
+- return dev->ethtool_ops->set_rxnfc(dev, &cmd);
++ return dev->ethtool_ops->set_rxnfc(dev, &info);
+ }
+
+-static int ethtool_get_rxnfc(struct net_device *dev, void __user *useraddr)
++static int ethtool_get_rxnfc(struct net_device *dev,
++ u32 cmd, void __user *useraddr)
+ {
+ struct ethtool_rxnfc info;
++ size_t info_size = sizeof(info);
+ const struct ethtool_ops *ops = dev->ethtool_ops;
+ int ret;
+ void *rule_buf = NULL;
+@@ -239,13 +251,22 @@ static int ethtool_get_rxnfc(struct net_device *dev, void __user *useraddr)
+ if (!ops->get_rxnfc)
+ return -EOPNOTSUPP;
+
+- if (copy_from_user(&info, useraddr, sizeof(info)))
++ /* struct ethtool_rxnfc was originally defined for
++ * ETHTOOL_{G,S}RXFH with only the cmd, flow_type and data
++ * members. User-space might still be using that
++ * definition. */
++ if (cmd == ETHTOOL_GRXFH)
++ info_size = (offsetof(struct ethtool_rxnfc, data) +
++ sizeof(info.data));
++
++ if (copy_from_user(&info, useraddr, info_size))
+ return -EFAULT;
+
+ if (info.cmd == ETHTOOL_GRXCLSRLALL) {
+ if (info.rule_cnt > 0) {
+- rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
+- GFP_USER);
++ if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
++ rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
++ GFP_USER);
+ if (!rule_buf)
+ return -ENOMEM;
+ }
+@@ -256,7 +277,7 @@ static int ethtool_get_rxnfc(struct net_device *dev, void __user *useraddr)
+ goto err_out;
+
+ ret = -EFAULT;
+- if (copy_to_user(useraddr, &info, sizeof(info)))
++ if (copy_to_user(useraddr, &info, info_size))
+ goto err_out;
+
+ if (rule_buf) {
+@@ -1111,12 +1132,12 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
+ case ETHTOOL_GRXCLSRLCNT:
+ case ETHTOOL_GRXCLSRULE:
+ case ETHTOOL_GRXCLSRLALL:
+- rc = ethtool_get_rxnfc(dev, useraddr);
++ rc = ethtool_get_rxnfc(dev, ethcmd, useraddr);
+ break;
+ case ETHTOOL_SRXFH:
+ case ETHTOOL_SRXCLSRLDEL:
+ case ETHTOOL_SRXCLSRLINS:
+- rc = ethtool_set_rxnfc(dev, useraddr);
++ rc = ethtool_set_rxnfc(dev, ethcmd, useraddr);
+ break;
+ case ETHTOOL_GGRO:
+ rc = ethtool_get_gro(dev, useraddr);
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index e587e68..e696250 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -945,7 +945,10 @@ static void neigh_update_hhs(struct neighbour *neigh)
+ {
+ struct hh_cache *hh;
+ void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
+- = neigh->dev->header_ops->cache_update;
++ = NULL;
++
++ if (neigh->dev->header_ops)
++ update = neigh->dev->header_ops->cache_update;
+
+ if (update) {
+ for (hh = neigh->hh; hh; hh = hh->hh_next) {
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index fcd278a..af83bdf 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2037,6 +2037,9 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
+ int mib_idx;
+ int fwd_rexmitting = 0;
+
++ if (!tp->packets_out)
++ return;
++
+ if (!tp->lost_out)
+ tp->retransmit_high = tp->snd_una;
+
+diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
+index 5a7f00c..1264ad0 100644
+--- a/net/ipv6/netfilter/ip6t_REJECT.c
++++ b/net/ipv6/netfilter/ip6t_REJECT.c
+@@ -95,9 +95,11 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
+ fl.fl_ip_dport = otcph.source;
+ security_skb_classify_flow(oldskb, &fl);
+ dst = ip6_route_output(net, NULL, &fl);
+- if (dst == NULL)
++ if (dst == NULL || dst->error) {
++ dst_release(dst);
+ return;
+- if (dst->error || xfrm_lookup(net, &dst, &fl, NULL, 0))
++ }
++ if (xfrm_lookup(net, &dst, &fl, NULL, 0))
+ return;
+
+ hh_len = (dst->dev->hard_header_len + 15)&~15;
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 4a15df1..5bea319 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -269,12 +269,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
+ if (wk->bss->wmm_used)
+ wmm = 1;
+
+- /* get all rates supported by the device and the AP as
+- * some APs don't like getting a superset of their rates
+- * in the association request (e.g. D-Link DAP 1353 in
+- * b-only mode) */
+- rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates);
+-
+ if ((wk->bss->cbss.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
+ (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
+ capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
+@@ -309,6 +303,17 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
+ *pos++ = wk->ssid_len;
+ memcpy(pos, wk->ssid, wk->ssid_len);
+
++ if (wk->bss->supp_rates_len) {
++ /* get all rates supported by the device and the AP as
++ * some APs don't like getting a superset of their rates
++ * in the association request (e.g. D-Link DAP 1353 in
++ * b-only mode) */
++ rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates);
++ } else {
++ rates = ~0;
++ rates_len = sband->n_bitrates;
++ }
++
+ /* add all rates which were marked to be used above */
+ supp_rates_len = rates_len;
+ if (supp_rates_len > 8)
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 3ee3cb8..38499c4 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1818,6 +1818,11 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
+ return RX_CONTINUE;
+ }
+ break;
++ case WLAN_CATEGORY_MESH_PLINK:
++ case WLAN_CATEGORY_MESH_PATH_SEL:
++ if (ieee80211_vif_is_mesh(&sdata->vif))
++ return ieee80211_mesh_rx_mgmt(sdata, rx->skb);
++ break;
+ default:
+ /* do not process rejected action frames */
+ if (mgmt->u.action.category & 0x80)
+diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
+index fd6411d..169111a 100644
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -62,7 +62,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
+ bool beacon)
+ {
+ struct ieee80211_bss *bss;
+- int clen;
++ int clen, srlen;
+ s32 signal = 0;
+
+ if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+@@ -94,23 +94,24 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
+ if (bss->dtim_period == 0)
+ bss->dtim_period = 1;
+
+- bss->supp_rates_len = 0;
++ /* replace old supported rates if we get new values */
++ srlen = 0;
+ if (elems->supp_rates) {
+- clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
++ clen = IEEE80211_MAX_SUPP_RATES;
+ if (clen > elems->supp_rates_len)
+ clen = elems->supp_rates_len;
+- memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates,
+- clen);
+- bss->supp_rates_len += clen;
++ memcpy(bss->supp_rates, elems->supp_rates, clen);
++ srlen += clen;
+ }
+ if (elems->ext_supp_rates) {
+- clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
++ clen = IEEE80211_MAX_SUPP_RATES - srlen;
+ if (clen > elems->ext_supp_rates_len)
+ clen = elems->ext_supp_rates_len;
+- memcpy(&bss->supp_rates[bss->supp_rates_len],
+- elems->ext_supp_rates, clen);
+- bss->supp_rates_len += clen;
++ memcpy(bss->supp_rates + srlen, elems->ext_supp_rates, clen);
++ srlen += clen;
+ }
++ if (srlen)
++ bss->supp_rates_len = srlen;
+
+ bss->wmm_used = elems->wmm_param || elems->wmm_info;
+
+diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
+index 27c30cf..95682e5 100644
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -146,6 +146,7 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
+ hash = ip_vs_conn_hashkey(cp->af, cp->protocol, &cp->caddr, cp->cport);
+
+ ct_write_lock(hash);
++ spin_lock(&cp->lock);
+
+ if (!(cp->flags & IP_VS_CONN_F_HASHED)) {
+ list_add(&cp->c_list, &ip_vs_conn_tab[hash]);
+@@ -158,6 +159,7 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
+ ret = 0;
+ }
+
++ spin_unlock(&cp->lock);
+ ct_write_unlock(hash);
+
+ return ret;
+@@ -177,6 +179,7 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
+ hash = ip_vs_conn_hashkey(cp->af, cp->protocol, &cp->caddr, cp->cport);
+
+ ct_write_lock(hash);
++ spin_lock(&cp->lock);
+
+ if (cp->flags & IP_VS_CONN_F_HASHED) {
+ list_del(&cp->c_list);
+@@ -186,6 +189,7 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
+ } else
+ ret = 0;
+
++ spin_unlock(&cp->lock);
+ ct_write_unlock(hash);
+
+ return ret;
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 5cdbf7c..b6fcf68 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -238,7 +238,8 @@ struct sock_xprt {
+ * State of TCP reply receive
+ */
+ __be32 tcp_fraghdr,
+- tcp_xid;
++ tcp_xid,
++ tcp_calldir;
+
+ u32 tcp_offset,
+ tcp_reclen;
+@@ -961,7 +962,7 @@ static inline void xs_tcp_read_calldir(struct sock_xprt *transport,
+ {
+ size_t len, used;
+ u32 offset;
+- __be32 calldir;
++ char *p;
+
+ /*
+ * We want transport->tcp_offset to be 8 at the end of this routine
+@@ -970,26 +971,33 @@ static inline void xs_tcp_read_calldir(struct sock_xprt *transport,
+ * transport->tcp_offset is 4 (after having already read the xid).
+ */
+ offset = transport->tcp_offset - sizeof(transport->tcp_xid);
+- len = sizeof(calldir) - offset;
++ len = sizeof(transport->tcp_calldir) - offset;
+ dprintk("RPC: reading CALL/REPLY flag (%Zu bytes)\n", len);
+- used = xdr_skb_read_bits(desc, &calldir, len);
++ p = ((char *) &transport->tcp_calldir) + offset;
++ used = xdr_skb_read_bits(desc, p, len);
+ transport->tcp_offset += used;
+ if (used != len)
+ return;
+ transport->tcp_flags &= ~TCP_RCV_READ_CALLDIR;
+- transport->tcp_flags |= TCP_RCV_COPY_CALLDIR;
+- transport->tcp_flags |= TCP_RCV_COPY_DATA;
+ /*
+ * We don't yet have the XDR buffer, so we will write the calldir
+ * out after we get the buffer from the 'struct rpc_rqst'
+ */
+- if (ntohl(calldir) == RPC_REPLY)
++ switch (ntohl(transport->tcp_calldir)) {
++ case RPC_REPLY:
++ transport->tcp_flags |= TCP_RCV_COPY_CALLDIR;
++ transport->tcp_flags |= TCP_RCV_COPY_DATA;
+ transport->tcp_flags |= TCP_RPC_REPLY;
+- else
++ break;
++ case RPC_CALL:
++ transport->tcp_flags |= TCP_RCV_COPY_CALLDIR;
++ transport->tcp_flags |= TCP_RCV_COPY_DATA;
+ transport->tcp_flags &= ~TCP_RPC_REPLY;
+- dprintk("RPC: reading %s CALL/REPLY flag %08x\n",
+- (transport->tcp_flags & TCP_RPC_REPLY) ?
+- "reply for" : "request with", calldir);
++ break;
++ default:
++ dprintk("RPC: invalid request message type\n");
++ xprt_force_disconnect(&transport->xprt);
++ }
+ xs_tcp_check_fraghdr(transport);
+ }
+
+@@ -1009,12 +1017,10 @@ static inline void xs_tcp_read_common(struct rpc_xprt *xprt,
+ /*
+ * Save the RPC direction in the XDR buffer
+ */
+- __be32 calldir = transport->tcp_flags & TCP_RPC_REPLY ?
+- htonl(RPC_REPLY) : 0;
+-
+ memcpy(rcvbuf->head[0].iov_base + transport->tcp_copied,
+- &calldir, sizeof(calldir));
+- transport->tcp_copied += sizeof(calldir);
++ &transport->tcp_calldir,
++ sizeof(transport->tcp_calldir));
++ transport->tcp_copied += sizeof(transport->tcp_calldir);
+ transport->tcp_flags &= ~TCP_RCV_COPY_CALLDIR;
+ }
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 801a16a..03efeab 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1311,7 +1311,7 @@ static unsigned int *reloc_location(struct elf_info *elf,
+ int section = sechdr->sh_info;
+
+ return (void *)elf->hdr + sechdrs[section].sh_offset +
+- (r->r_offset - sechdrs[section].sh_addr);
++ r->r_offset - sechdrs[section].sh_addr;
+ }
+
+ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
+diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
+index 1305f7c..641d7f0 100644
+--- a/sound/pci/echoaudio/echoaudio.c
++++ b/sound/pci/echoaudio/echoaudio.c
+@@ -1821,7 +1821,9 @@ static irqreturn_t snd_echo_interrupt(int irq, void *dev_id)
+ /* The hardware doesn't tell us which substream caused the irq,
+ thus we have to check all running substreams. */
+ for (ss = 0; ss < DSP_MAXPIPES; ss++) {
+- if ((substream = chip->substream[ss])) {
++ substream = chip->substream[ss];
++ if (substream && ((struct audiopipe *)substream->runtime->
++ private_data)->state == PIPE_STATE_STARTED) {
+ period = pcm_pointer(substream) /
+ substream->runtime->period_size;
+ if (period != chip->last_period[ss]) {
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 82a53d9..aa2ec23 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8942,6 +8942,7 @@ static struct snd_pci_quirk alc882_ssid_cfg_tbl[] = {
+ SND_PCI_QUIRK(0x106b, 0x3800, "MacbookPro 4,1", ALC885_MBP3),
+ SND_PCI_QUIRK(0x106b, 0x3e00, "iMac 24 Aluminum", ALC885_IMAC24),
+ SND_PCI_QUIRK(0x106b, 0x3f00, "Macbook 5,1", ALC885_MB5),
++ SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC885_MB5),
+ /* FIXME: HP jack sense seems not working for MBP 5,1 or 5,2,
+ * so apparently no perfect solution yet
+ */
+diff --git a/sound/soc/codecs/wm8776.c b/sound/soc/codecs/wm8776.c
+index a9829aa..8286c62 100644
+--- a/sound/soc/codecs/wm8776.c
++++ b/sound/soc/codecs/wm8776.c
+@@ -93,7 +93,6 @@ SOC_DAPM_SINGLE("Bypass Switch", WM8776_OUTMUX, 2, 1, 0),
+
+ static const struct snd_soc_dapm_widget wm8776_dapm_widgets[] = {
+ SND_SOC_DAPM_INPUT("AUX"),
+-SND_SOC_DAPM_INPUT("AUX"),
+
+ SND_SOC_DAPM_INPUT("AIN1"),
+ SND_SOC_DAPM_INPUT("AIN2"),
+diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
+index 43cf3ea..a31a8cd 100644
+--- a/tools/perf/util/callchain.h
++++ b/tools/perf/util/callchain.h
+@@ -48,6 +48,9 @@ static inline void callchain_init(struct callchain_node *node)
+ INIT_LIST_HEAD(&node->brothers);
+ INIT_LIST_HEAD(&node->children);
+ INIT_LIST_HEAD(&node->val);
++
++ node->parent = NULL;
++ node->hit = 0;
+ }
+
+ static inline u64 cumul_hits(struct callchain_node *node)
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.33.7-rc1.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.33.7-rc1.patch Fri Jul 30 19:01:59 2010 (r16025)
@@ -0,0 +1,398 @@
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -328,6 +328,7 @@ int i965_reset(struct drm_device *dev, u8 flags)
+ }
+ } else {
+ DRM_ERROR("Error occurred. Don't know how to reset this chip.\n");
++ mutex_unlock(&dev->struct_mutex);
+ return -ENODEV;
+ }
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -2288,8 +2288,9 @@ i915_gem_object_get_pages(struct drm_gem_object *obj,
+ mapping = inode->i_mapping;
+ for (i = 0; i < page_count; i++) {
+ page = read_cache_page_gfp(mapping, i,
+- mapping_gfp_mask (mapping) |
++ GFP_HIGHUSER |
+ __GFP_COLD |
++ __GFP_RECLAIMABLE |
+ gfpmask);
+ if (IS_ERR(page))
+ goto err_pages;
+@@ -4998,6 +4999,16 @@ i915_gem_load(struct drm_device *dev)
+ list_add(&dev_priv->mm.shrink_list, &shrink_list);
+ spin_unlock(&shrink_list_lock);
+
++ /* On GEN3 we really need to make sure the ARB C3 LP bit is set */
++ if (IS_GEN3(dev)) {
++ u32 tmp = I915_READ(MI_ARB_STATE);
++ if (!(tmp & MI_ARB_C3_LP_WRITE_ENABLE)) {
++ /* arb state is a masked write, so set bit + bit in mask */
++ tmp = MI_ARB_C3_LP_WRITE_ENABLE | (MI_ARB_C3_LP_WRITE_ENABLE << MI_ARB_MASK_SHIFT);
++ I915_WRITE(MI_ARB_STATE, tmp);
++ }
++ }
++
+ /* Old X drivers will take 0-2 for front, back, depth buffers */
+ dev_priv->fence_reg_start = 3;
+
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -326,6 +326,70 @@
+ #define LM_BURST_LENGTH 0x00000700
+ #define LM_FIFO_WATERMARK 0x0000001F
+ #define MI_ARB_STATE 0x020e4 /* 915+ only */
++#define MI_ARB_MASK_SHIFT 16 /* shift for enable bits */
++
++/* Make render/texture TLB fetches lower priorty than associated data
++ * fetches. This is not turned on by default
++ */
++#define MI_ARB_RENDER_TLB_LOW_PRIORITY (1 << 15)
++
++/* Isoch request wait on GTT enable (Display A/B/C streams).
++ * Make isoch requests stall on the TLB update. May cause
++ * display underruns (test mode only)
++ */
++#define MI_ARB_ISOCH_WAIT_GTT (1 << 14)
++
++/* Block grant count for isoch requests when block count is
++ * set to a finite value.
++ */
++#define MI_ARB_BLOCK_GRANT_MASK (3 << 12)
++#define MI_ARB_BLOCK_GRANT_8 (0 << 12) /* for 3 display planes */
++#define MI_ARB_BLOCK_GRANT_4 (1 << 12) /* for 2 display planes */
++#define MI_ARB_BLOCK_GRANT_2 (2 << 12) /* for 1 display plane */
++#define MI_ARB_BLOCK_GRANT_0 (3 << 12) /* don't use */
++
++/* Enable render writes to complete in C2/C3/C4 power states.
++ * If this isn't enabled, render writes are prevented in low
++ * power states. That seems bad to me.
++ */
++#define MI_ARB_C3_LP_WRITE_ENABLE (1 << 11)
++
++/* This acknowledges an async flip immediately instead
++ * of waiting for 2TLB fetches.
++ */
++#define MI_ARB_ASYNC_FLIP_ACK_IMMEDIATE (1 << 10)
++
++/* Enables non-sequential data reads through arbiter
++ */
++#define MI_ARB_DUAL_DATA_PHASE_DISABLE (1 << 9)
++
++/* Disable FSB snooping of cacheable write cycles from binner/render
++ * command stream
++ */
++#define MI_ARB_CACHE_SNOOP_DISABLE (1 << 8)
++
++/* Arbiter time slice for non-isoch streams */
++#define MI_ARB_TIME_SLICE_MASK (7 << 5)
++#define MI_ARB_TIME_SLICE_1 (0 << 5)
++#define MI_ARB_TIME_SLICE_2 (1 << 5)
++#define MI_ARB_TIME_SLICE_4 (2 << 5)
++#define MI_ARB_TIME_SLICE_6 (3 << 5)
++#define MI_ARB_TIME_SLICE_8 (4 << 5)
++#define MI_ARB_TIME_SLICE_10 (5 << 5)
++#define MI_ARB_TIME_SLICE_14 (6 << 5)
++#define MI_ARB_TIME_SLICE_16 (7 << 5)
++
++/* Low priority grace period page size */
++#define MI_ARB_LOW_PRIORITY_GRACE_4KB (0 << 4) /* default */
++#define MI_ARB_LOW_PRIORITY_GRACE_8KB (1 << 4)
++
++/* Disable display A/B trickle feed */
++#define MI_ARB_DISPLAY_TRICKLE_FEED_DISABLE (1 << 2)
++
++/* Set display plane priority */
++#define MI_ARB_DISPLAY_PRIORITY_A_B (0 << 0) /* display A > display B */
++#define MI_ARB_DISPLAY_PRIORITY_B_A (1 << 0) /* display B > display A */
++
+ #define CACHE_MODE_0 0x02120 /* 915+ only */
+ #define CM0_MASK_SHIFT 16
+ #define CM0_IZ_OPT_DISABLE (1<<6)
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -879,8 +879,8 @@ intel_g4x_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
+ intel_clock_t clock;
+ int max_n;
+ bool found;
+- /* approximately equals target * 0.00488 */
+- int err_most = (target >> 8) + (target >> 10);
++ /* approximately equals target * 0.00585 */
++ int err_most = (target >> 8) + (target >> 9);
+ found = false;
+
+ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -1384,6 +1384,7 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
+ case RADEON_TXFORMAT_RGB332:
+ case RADEON_TXFORMAT_Y8:
+ track->textures[i].cpp = 1;
++ track->textures[i].compress_format = R100_TRACK_COMP_NONE;
+ break;
+ case RADEON_TXFORMAT_AI88:
+ case RADEON_TXFORMAT_ARGB1555:
+@@ -1395,12 +1396,14 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
+ case RADEON_TXFORMAT_LDUDV655:
+ case RADEON_TXFORMAT_DUDV88:
+ track->textures[i].cpp = 2;
++ track->textures[i].compress_format = R100_TRACK_COMP_NONE;
+ break;
+ case RADEON_TXFORMAT_ARGB8888:
+ case RADEON_TXFORMAT_RGBA8888:
+ case RADEON_TXFORMAT_SHADOW32:
+ case RADEON_TXFORMAT_LDUDUV8888:
+ track->textures[i].cpp = 4;
++ track->textures[i].compress_format = R100_TRACK_COMP_NONE;
+ break;
+ case RADEON_TXFORMAT_DXT1:
+ track->textures[i].cpp = 1;
+@@ -2750,33 +2753,6 @@ static inline void r100_cs_track_texture_print(struct r100_cs_track_texture *t)
+ DRM_ERROR("compress format %d\n", t->compress_format);
+ }
+
+-static int r100_cs_track_cube(struct radeon_device *rdev,
+- struct r100_cs_track *track, unsigned idx)
+-{
+- unsigned face, w, h;
+- struct radeon_bo *cube_robj;
+- unsigned long size;
+-
+- for (face = 0; face < 5; face++) {
+- cube_robj = track->textures[idx].cube_info[face].robj;
+- w = track->textures[idx].cube_info[face].width;
+- h = track->textures[idx].cube_info[face].height;
+-
+- size = w * h;
+- size *= track->textures[idx].cpp;
+-
+- size += track->textures[idx].cube_info[face].offset;
+-
+- if (size > radeon_bo_size(cube_robj)) {
+- DRM_ERROR("Cube texture offset greater than object size %lu %lu\n",
+- size, radeon_bo_size(cube_robj));
+- r100_cs_track_texture_print(&track->textures[idx]);
+- return -1;
+- }
+- }
+- return 0;
+-}
+-
+ static int r100_track_compress_size(int compress_format, int w, int h)
+ {
+ int block_width, block_height, block_bytes;
+@@ -2807,6 +2783,37 @@ static int r100_track_compress_size(int compress_format, int w, int h)
+ return sz;
+ }
+
++static int r100_cs_track_cube(struct radeon_device *rdev,
++ struct r100_cs_track *track, unsigned idx)
++{
++ unsigned face, w, h;
++ struct radeon_bo *cube_robj;
++ unsigned long size;
++ unsigned compress_format = track->textures[idx].compress_format;
++
++ for (face = 0; face < 5; face++) {
++ cube_robj = track->textures[idx].cube_info[face].robj;
++ w = track->textures[idx].cube_info[face].width;
++ h = track->textures[idx].cube_info[face].height;
++
++ if (compress_format) {
++ size = r100_track_compress_size(compress_format, w, h);
++ } else
++ size = w * h;
++ size *= track->textures[idx].cpp;
++
++ size += track->textures[idx].cube_info[face].offset;
++
++ if (size > radeon_bo_size(cube_robj)) {
++ DRM_ERROR("Cube texture offset greater than object size %lu %lu\n",
++ size, radeon_bo_size(cube_robj));
++ r100_cs_track_texture_print(&track->textures[idx]);
++ return -1;
++ }
++ }
++ return 0;
++}
++
+ static int r100_cs_track_texture_check(struct radeon_device *rdev,
+ struct r100_cs_track *track)
+ {
+--- a/drivers/gpu/drm/radeon/r200.c
++++ b/drivers/gpu/drm/radeon/r200.c
+@@ -368,6 +368,8 @@ int r200_packet0_check(struct radeon_cs_parser *p,
+ /* 2D, 3D, CUBE */
+ switch (tmp) {
+ case 0:
++ case 3:
++ case 4:
+ case 5:
+ case 6:
+ case 7:
+@@ -403,6 +405,7 @@ int r200_packet0_check(struct radeon_cs_parser *p,
+ case R200_TXFORMAT_RGB332:
+ case R200_TXFORMAT_Y8:
+ track->textures[i].cpp = 1;
++ track->textures[i].compress_format = R100_TRACK_COMP_NONE;
+ break;
+ case R200_TXFORMAT_AI88:
+ case R200_TXFORMAT_ARGB1555:
+@@ -414,6 +417,7 @@ int r200_packet0_check(struct radeon_cs_parser *p,
+ case R200_TXFORMAT_DVDU88:
+ case R200_TXFORMAT_AVYU4444:
+ track->textures[i].cpp = 2;
++ track->textures[i].compress_format = R100_TRACK_COMP_NONE;
+ break;
+ case R200_TXFORMAT_ARGB8888:
+ case R200_TXFORMAT_RGBA8888:
+@@ -421,6 +425,7 @@ int r200_packet0_check(struct radeon_cs_parser *p,
+ case R200_TXFORMAT_BGR111110:
+ case R200_TXFORMAT_LDVDU8888:
+ track->textures[i].cpp = 4;
++ track->textures[i].compress_format = R100_TRACK_COMP_NONE;
+ break;
+ case R200_TXFORMAT_DXT1:
+ track->textures[i].cpp = 1;
+--- a/drivers/gpu/drm/radeon/r300.c
++++ b/drivers/gpu/drm/radeon/r300.c
+@@ -870,6 +870,7 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
+ case R300_TX_FORMAT_Y4X4:
+ case R300_TX_FORMAT_Z3Y3X2:
+ track->textures[i].cpp = 1;
++ track->textures[i].compress_format = R100_TRACK_COMP_NONE;
+ break;
+ case R300_TX_FORMAT_X16:
+ case R300_TX_FORMAT_Y8X8:
+@@ -881,6 +882,7 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
+ case R300_TX_FORMAT_B8G8_B8G8:
+ case R300_TX_FORMAT_G8R8_G8B8:
+ track->textures[i].cpp = 2;
++ track->textures[i].compress_format = R100_TRACK_COMP_NONE;
+ break;
+ case R300_TX_FORMAT_Y16X16:
+ case R300_TX_FORMAT_Z11Y11X10:
+@@ -891,14 +893,17 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
+ case R300_TX_FORMAT_FL_I32:
+ case 0x1e:
+ track->textures[i].cpp = 4;
++ track->textures[i].compress_format = R100_TRACK_COMP_NONE;
+ break;
+ case R300_TX_FORMAT_W16Z16Y16X16:
+ case R300_TX_FORMAT_FL_R16G16B16A16:
+ case R300_TX_FORMAT_FL_I32A32:
+ track->textures[i].cpp = 8;
++ track->textures[i].compress_format = R100_TRACK_COMP_NONE;
+ break;
+ case R300_TX_FORMAT_FL_R32G32B32A32:
+ track->textures[i].cpp = 16;
++ track->textures[i].compress_format = R100_TRACK_COMP_NONE;
+ break;
+ case R300_TX_FORMAT_DXT1:
+ track->textures[i].cpp = 1;
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -268,6 +268,15 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
+ }
+ }
+
++ /* ASUS HD 3600 board lists the DVI port as HDMI */
++ if ((dev->pdev->device == 0x9598) &&
++ (dev->pdev->subsystem_vendor == 0x1043) &&
++ (dev->pdev->subsystem_device == 0x01e4)) {
++ if (*connector_type == DRM_MODE_CONNECTOR_HDMIA) {
++ *connector_type = DRM_MODE_CONNECTOR_DVII;
++ }
++ }
++
+ /* ASUS HD 3450 board lists the DVI port as HDMI */
+ if ((dev->pdev->device == 0x95C5) &&
+ (dev->pdev->subsystem_vendor == 0x1043) &&
+@@ -977,8 +986,15 @@ bool radeon_atombios_sideport_present(struct radeon_device *rdev)
+ if (igp_info) {
+ switch (crev) {
+ case 1:
+- if (igp_info->info.ucMemoryType & 0xf0)
+- return true;
++ /* AMD IGPS */
++ if ((rdev->family == CHIP_RS690) ||
++ (rdev->family == CHIP_RS740)) {
++ if (igp_info->info.ulBootUpMemoryClock)
++ return true;
++ } else {
++ if (igp_info->info.ucMemoryType & 0xf0)
++ return true;
++ }
+ break;
+ case 2:
+ if (igp_info->info_2.ucMemoryType & 0x0f)
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -779,30 +779,27 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect
+ } else
+ ret = connector_status_connected;
+
+- /* multiple connectors on the same encoder with the same ddc line
+- * This tends to be HDMI and DVI on the same encoder with the
+- * same ddc line. If the edid says HDMI, consider the HDMI port
+- * connected and the DVI port disconnected. If the edid doesn't
+- * say HDMI, vice versa.
++ /* This gets complicated. We have boards with VGA + HDMI with a
++ * shared DDC line and we have boards with DVI-D + HDMI with a shared
++ * DDC line. The latter is more complex because with DVI<->HDMI adapters
++ * you don't really know what's connected to which port as both are digital.
+ */
+ if (radeon_connector->shared_ddc && (ret == connector_status_connected)) {
+ struct drm_device *dev = connector->dev;
++ struct radeon_device *rdev = dev->dev_private;
+ struct drm_connector *list_connector;
+ struct radeon_connector *list_radeon_connector;
+ list_for_each_entry(list_connector, &dev->mode_config.connector_list, head) {
+ if (connector == list_connector)
+ continue;
+ list_radeon_connector = to_radeon_connector(list_connector);
+- if (radeon_connector->devices == list_radeon_connector->devices) {
+- if (drm_detect_hdmi_monitor(radeon_connector->edid)) {
+- if (connector->connector_type == DRM_MODE_CONNECTOR_DVID) {
+- kfree(radeon_connector->edid);
+- radeon_connector->edid = NULL;
+- ret = connector_status_disconnected;
+- }
+- } else {
+- if ((connector->connector_type == DRM_MODE_CONNECTOR_HDMIA) ||
+- (connector->connector_type == DRM_MODE_CONNECTOR_HDMIB)) {
++ if (list_radeon_connector->shared_ddc &&
++ (list_radeon_connector->ddc_bus->rec.i2c_id ==
++ radeon_connector->ddc_bus->rec.i2c_id)) {
++ /* cases where both connectors are digital */
++ if (list_connector->connector_type != DRM_MODE_CONNECTOR_VGA) {
++ /* hpd is our only option in this case */
++ if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) {
+ kfree(radeon_connector->edid);
+ radeon_connector->edid = NULL;
+ ret = connector_status_disconnected;
+--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
++++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+@@ -108,6 +108,7 @@ static void radeon_legacy_lvds_dpms(struct drm_encoder *encoder, int mode)
+ udelay(panel_pwr_delay * 1000);
+ WREG32(RADEON_LVDS_GEN_CNTL, lvds_gen_cntl);
+ WREG32_PLL(RADEON_PIXCLKS_CNTL, pixclks_cntl);
++ udelay(panel_pwr_delay * 1000);
+ break;
+ }
+
+--- a/drivers/gpu/drm/radeon/radeon_legacy_tv.c
++++ b/drivers/gpu/drm/radeon/radeon_legacy_tv.c
+@@ -642,8 +642,8 @@ void radeon_legacy_tv_mode_set(struct drm_encoder *encoder,
+ }
+ flicker_removal = (tmp + 500) / 1000;
+
+- if (flicker_removal < 2)
+- flicker_removal = 2;
++ if (flicker_removal < 3)
++ flicker_removal = 3;
+ for (i = 0; i < ARRAY_SIZE(SLOPE_limit); ++i) {
+ if (flicker_removal == SLOPE_limit[i])
+ break;
Modified: dists/sid/linux-2.6/debian/patches/features/all/vserver/vs2.3.0.36.27.patch
==============================================================================
--- dists/sid/linux-2.6/debian/patches/features/all/vserver/vs2.3.0.36.27.patch Fri Jul 30 14:43:39 2010 (r16024)
+++ dists/sid/linux-2.6/debian/patches/features/all/vserver/vs2.3.0.36.27.patch Fri Jul 30 19:01:59 2010 (r16025)
@@ -1,3 +1,5 @@
+bwh: Adjust context in fs/ext4/ext4.h
+
diff -NurpP --minimal linux-2.6.32.1/arch/alpha/Kconfig linux-2.6.32.1-vs2.3.0.36.27/arch/alpha/Kconfig
--- linux-2.6.32.1/arch/alpha/Kconfig 2009-12-03 20:01:49.000000000 +0100
+++ linux-2.6.32.1-vs2.3.0.36.27/arch/alpha/Kconfig 2009-12-03 20:04:56.000000000 +0100
@@ -3393,21 +3395,20 @@
sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
((sbi->s_mount_opt & EXT3_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
-diff -NurpP --minimal linux-2.6.32.1/fs/ext4/ext4.h linux-2.6.32.1-vs2.3.0.36.27/fs/ext4/ext4.h
---- linux-2.6.32.1/fs/ext4/ext4.h 2009-12-14 21:29:46.000000000 +0100
-+++ linux-2.6.32.1-vs2.3.0.36.27/fs/ext4/ext4.h 2009-12-14 22:20:55.000000000 +0100
-@@ -284,8 +284,12 @@ struct flex_groups {
- #define EXT4_TOPDIR_FL 0x00020000 /* Top of directory hierarchies*/
- #define EXT4_HUGE_FILE_FL 0x00040000 /* Set to each huge file */
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -284,7 +284,11 @@ struct flex_groups {
#define EXT4_EXTENTS_FL 0x00080000 /* Inode uses extents */
+ #define EXT4_EA_INODE_FL 0x00200000 /* Inode used for large EA */
+ #define EXT4_EOFBLOCKS_FL 0x00400000 /* Blocks allocated beyond EOF */
+#define EXT4_IXUNLINK_FL 0x08000000 /* Immutable invert on unlink */
#define EXT4_RESERVED_FL 0x80000000 /* reserved for ext4 lib */
+#define EXT4_BARRIER_FL 0x04000000 /* Barrier for chroot() */
+#define EXT4_COW_FL 0x20000000 /* Copy on Write marker */
+
- #define EXT4_FL_USER_VISIBLE 0x000BDFFF /* User visible flags */
- #define EXT4_FL_USER_MODIFIABLE 0x000B80FF /* User modifiable flags */
+ #define EXT4_FL_USER_VISIBLE 0x004BDFFF /* User visible flags */
+ #define EXT4_FL_USER_MODIFIABLE 0x004B80FF /* User modifiable flags */
@@ -469,7 +473,8 @@ struct ext4_inode {
__le16 l_i_file_acl_high;
Modified: dists/sid/linux-2.6/debian/patches/series/19
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/19 Fri Jul 30 14:43:39 2010 (r16024)
+++ dists/sid/linux-2.6/debian/patches/series/19 Fri Jul 30 19:01:59 2010 (r16025)
@@ -1,7 +1,23 @@
+ bugfix/all/inotify-fix-inotify-oneshot-support.patch
+ bugfix/all/inotify-send-IN_UNMOUNT-events.patch
-+ bugfix/x86/drm-i915-Define-MI_ARB_STATE-bits.patch
-+ bugfix/x86/drm-i915-enable-low-power-render-writes-on-GEN3-hard.patch
+ bugfix/all/pata_pdc202xx_old-fix-UDMA-mode-for-Promise-UDMA33.patch
+ bugfix/all/pata_pdc202xx_old-fix-UDMA-mode-for-PDC2026x-chipset.patch
+ bugfix/ia64/fix-crash-when-gcore-reads-gate-area.patch
+- bugfix/all/sched-fix-over-scheduling-bug.patch
+- bugfix/all/r8169-fix-mdio_read-and-update-mdio_write.patch
+- bugfix/all/r8169-fix-random-mdio_write-failures.patch
+- bugfix/x86/eeepc-laptop-check-wireless-hotplug-events.patch
+- bugfix/all/ext4-Fix-compat-EXT4_IOC_ADD_GROUP.patch
+- bugfix/all/ext4-Conditionally-define-compat-ioctl-numbers.patch
+- bugfix/x86/amd64-agp-Probe-unknown-AGP-devices-the-right-way.patch
+- bugfix/all/V4L-DVB-budget-Select-correct-frontends.patch
+- bugfix/mips/fpu-emulator.patch
+- bugfix/sparc/sparc-Fix-use-of-uid16_t-and-gid16_t.patch
+- bugfix/all/ext4-issue-discard-operation-before-releasing-blocks.patch
+- bugfix/all/forcedeth-fix-tx-limit2-flag-check.patch
+- bugfix/all/ssb_check_for_sprom-fix.patch
+- bugfix/all/ssb_check_for_sprom.patch
++ bugfix/all/stable/2.6.32.17-rc1.patch
+- bugfix/x86/drm-i915-add-reclaimable-to-i915-self-reclaimable-pa.patch
+- bugfix/x86/drm-i915-fix-hibernation-since-i915-self-reclaim-fix.patch
++ bugfix/all/stable/2.6.33.7-rc1.patch
More information about the Kernel-svn-changes
mailing list