lkml.org 
[lkml]   [2010]   [Aug]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: Linux 2.6.32.17
    diff --git a/Makefile b/Makefile
    index 9797439..2e357ce 100644
    --- a/Makefile
    +++ b/Makefile
    @@ -1,7 +1,7 @@
    VERSION = 2
    PATCHLEVEL = 6
    SUBLEVEL = 32
    -EXTRAVERSION = .16
    +EXTRAVERSION = .17
    NAME = Man-Eating Seals of Antiquity

    # *DOCUMENTATION*
    diff --git a/arch/arm/kernel/kprobes-decode.c b/arch/arm/kernel/kprobes-decode.c
    index da1f949..8bccbfa 100644
    --- a/arch/arm/kernel/kprobes-decode.c
    +++ b/arch/arm/kernel/kprobes-decode.c
    @@ -583,13 +583,14 @@ static void __kprobes emulate_ldr(struct kprobe *p, struct pt_regs *regs)
    {
    insn_llret_3arg_fn_t *i_fn = (insn_llret_3arg_fn_t *)&p->ainsn.insn[0];
    kprobe_opcode_t insn = p->opcode;
    + long ppc = (long)p->addr + 8;
    union reg_pair fnr;
    int rd = (insn >> 12) & 0xf;
    int rn = (insn >> 16) & 0xf;
    int rm = insn & 0xf;
    long rdv;
    - long rnv = regs->uregs[rn];
    - long rmv = regs->uregs[rm]; /* rm/rmv may be invalid, don't care. */
    + long rnv = (rn == 15) ? ppc : regs->uregs[rn];
    + long rmv = (rm == 15) ? ppc : regs->uregs[rm];
    long cpsr = regs->ARM_cpsr;

    fnr.dr = insnslot_llret_3arg_rflags(rnv, 0, rmv, cpsr, i_fn);
    diff --git a/arch/arm/mach-omap2/board-rx51-peripherals.c b/arch/arm/mach-omap2/board-rx51-peripherals.c
    index e34d96a..6879cfe 100644
    --- a/arch/arm/mach-omap2/board-rx51-peripherals.c
    +++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
    @@ -37,6 +37,10 @@
    #define SYSTEM_REV_S_USES_VAUX3 0x8

    static int board_keymap[] = {
    + /*
    + * Note that KEY(x, 8, KEY_XXX) entries represent "entrire row
    + * connected to the ground" matrix state.
    + */
    KEY(0, 0, KEY_Q),
    KEY(0, 1, KEY_O),
    KEY(0, 2, KEY_P),
    @@ -44,6 +48,7 @@ static int board_keymap[] = {
    KEY(0, 4, KEY_BACKSPACE),
    KEY(0, 6, KEY_A),
    KEY(0, 7, KEY_S),
    +
    KEY(1, 0, KEY_W),
    KEY(1, 1, KEY_D),
    KEY(1, 2, KEY_F),
    @@ -52,6 +57,7 @@ static int board_keymap[] = {
    KEY(1, 5, KEY_J),
    KEY(1, 6, KEY_K),
    KEY(1, 7, KEY_L),
    +
    KEY(2, 0, KEY_E),
    KEY(2, 1, KEY_DOT),
    KEY(2, 2, KEY_UP),
    @@ -59,6 +65,8 @@ static int board_keymap[] = {
    KEY(2, 5, KEY_Z),
    KEY(2, 6, KEY_X),
    KEY(2, 7, KEY_C),
    + KEY(2, 8, KEY_F9),
    +
    KEY(3, 0, KEY_R),
    KEY(3, 1, KEY_V),
    KEY(3, 2, KEY_B),
    @@ -67,20 +75,23 @@ static int board_keymap[] = {
    KEY(3, 5, KEY_SPACE),
    KEY(3, 6, KEY_SPACE),
    KEY(3, 7, KEY_LEFT),
    +
    KEY(4, 0, KEY_T),
    KEY(4, 1, KEY_DOWN),
    KEY(4, 2, KEY_RIGHT),
    KEY(4, 4, KEY_LEFTCTRL),
    KEY(4, 5, KEY_RIGHTALT),
    KEY(4, 6, KEY_LEFTSHIFT),
    + KEY(4, 8, KEY_F10),
    +
    KEY(5, 0, KEY_Y),
    + KEY(5, 8, KEY_F11),
    +
    KEY(6, 0, KEY_U),
    +
    KEY(7, 0, KEY_I),
    KEY(7, 1, KEY_F7),
    KEY(7, 2, KEY_F8),
    - KEY(0xff, 2, KEY_F9),
    - KEY(0xff, 4, KEY_F10),
    - KEY(0xff, 5, KEY_F11),
    };

    static struct matrix_keymap_data board_map_data = {
    diff --git a/arch/arm/mach-realview/Kconfig b/arch/arm/mach-realview/Kconfig
    index c48e1f2..6727c78 100644
    --- a/arch/arm/mach-realview/Kconfig
    +++ b/arch/arm/mach-realview/Kconfig
    @@ -18,6 +18,7 @@ config REALVIEW_EB_ARM11MP
    bool "Support ARM11MPCore tile"
    depends on MACH_REALVIEW_EB
    select CPU_V6
    + select ARCH_HAS_BARRIERS if SMP
    help
    Enable support for the ARM11MPCore tile on the Realview platform.

    @@ -35,6 +36,7 @@ config MACH_REALVIEW_PB11MP
    select CPU_V6
    select ARM_GIC
    select HAVE_PATA_PLATFORM
    + select ARCH_HAS_BARRIERS if SMP
    help
    Include support for the ARM(R) RealView MPCore Platform Baseboard.
    PB11MPCore is a platform with an on-board ARM11MPCore and has
    diff --git a/arch/arm/mach-realview/include/mach/barriers.h b/arch/arm/mach-realview/include/mach/barriers.h
    new file mode 100644
    index 0000000..0c5d749
    --- /dev/null
    +++ b/arch/arm/mach-realview/include/mach/barriers.h
    @@ -0,0 +1,8 @@
    +/*
    + * Barriers redefined for RealView ARM11MPCore platforms with L220 cache
    + * controller to work around hardware errata causing the outer_sync()
    + * operation to deadlock the system.
    + */
    +#define mb() dsb()
    +#define rmb() dmb()
    +#define wmb() mb()
    diff --git a/arch/ia64/mm/tlb.c b/arch/ia64/mm/tlb.c
    index ee09d26..e2cde52 100644
    --- a/arch/ia64/mm/tlb.c
    +++ b/arch/ia64/mm/tlb.c
    @@ -120,7 +120,7 @@ static inline void down_spin(struct spinaphore *ss)
    ia64_invala();

    for (;;) {
    - asm volatile ("ld4.c.nc %0=[%1]" : "=r"(serve) : "r"(&ss->serve) : "memory");
    + asm volatile ("ld8.c.nc %0=[%1]" : "=r"(serve) : "r"(&ss->serve) : "memory");
    if (time_before(t, serve))
    return;
    cpu_relax();
    diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
    index a581d60..608dc97 100644
    --- a/arch/mips/include/asm/mipsregs.h
    +++ b/arch/mips/include/asm/mipsregs.h
    @@ -135,6 +135,12 @@
    #define FPU_CSR_COND7 0x80000000 /* $fcc7 */

    /*
    + * Bits 18 - 20 of the FPU Status Register will be read as 0,
    + * and should be written as zero.
    + */
    +#define FPU_CSR_RSVD 0x001c0000
    +
    +/*
    * X the exception cause indicator
    * E the exception enable
    * S the sticky/flag bit
    @@ -161,7 +167,8 @@
    #define FPU_CSR_UDF_S 0x00000008
    #define FPU_CSR_INE_S 0x00000004

    -/* rounding mode */
    +/* Bits 0 and 1 of FPU Status Register specify the rounding mode */
    +#define FPU_CSR_RM 0x00000003
    #define FPU_CSR_RN 0x0 /* nearest */
    #define FPU_CSR_RZ 0x1 /* towards zero */
    #define FPU_CSR_RU 0x2 /* towards +Infinity */
    diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
    index 454b539..c15d94b 100644
    --- a/arch/mips/math-emu/cp1emu.c
    +++ b/arch/mips/math-emu/cp1emu.c
    @@ -75,6 +75,9 @@ struct mips_fpu_emulator_stats fpuemustats;
    #define FPCREG_RID 0 /* $0 = revision id */
    #define FPCREG_CSR 31 /* $31 = csr */

    +/* Determine rounding mode from the RM bits of the FCSR */
    +#define modeindex(v) ((v) & FPU_CSR_RM)
    +
    /* Convert Mips rounding mode (0..3) to IEEE library modes. */
    static const unsigned char ieee_rm[4] = {
    [FPU_CSR_RN] = IEEE754_RN,
    @@ -381,10 +384,14 @@ static int cop1Emulate(struct pt_regs *xcp, struct mips_fpu_struct *ctx)
    (void *) (xcp->cp0_epc),
    MIPSInst_RT(ir), value);
    #endif
    - value &= (FPU_CSR_FLUSH | FPU_CSR_ALL_E | FPU_CSR_ALL_S | 0x03);
    - ctx->fcr31 &= ~(FPU_CSR_FLUSH | FPU_CSR_ALL_E | FPU_CSR_ALL_S | 0x03);
    - /* convert to ieee library modes */
    - ctx->fcr31 |= (value & ~0x3) | ieee_rm[value & 0x3];
    +
    + /*
    + * Don't write reserved bits,
    + * and convert to ieee library modes
    + */
    + ctx->fcr31 = (value &
    + ~(FPU_CSR_RSVD | FPU_CSR_RM)) |
    + ieee_rm[modeindex(value)];
    }
    if ((ctx->fcr31 >> 5) & ctx->fcr31 & FPU_CSR_ALL_E) {
    return SIGFPE;
    diff --git a/arch/sparc/include/asm/stat.h b/arch/sparc/include/asm/stat.h
    index 39327d6..a232e9e 100644
    --- a/arch/sparc/include/asm/stat.h
    +++ b/arch/sparc/include/asm/stat.h
    @@ -53,8 +53,8 @@ struct stat {
    ino_t st_ino;
    mode_t st_mode;
    short st_nlink;
    - uid16_t st_uid;
    - gid16_t st_gid;
    + unsigned short st_uid;
    + unsigned short st_gid;
    unsigned short st_rdev;
    off_t st_size;
    time_t st_atime;
    diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
    index a7881c7..a7e502f 100644
    --- a/arch/x86/include/asm/msr-index.h
    +++ b/arch/x86/include/asm/msr-index.h
    @@ -106,6 +106,7 @@
    #define MSR_AMD64_PATCH_LOADER 0xc0010020
    #define MSR_AMD64_OSVW_ID_LENGTH 0xc0010140
    #define MSR_AMD64_OSVW_STATUS 0xc0010141
    +#define MSR_AMD64_DC_CFG 0xc0011022
    #define MSR_AMD64_IBSFETCHCTL 0xc0011030
    #define MSR_AMD64_IBSFETCHLINAD 0xc0011031
    #define MSR_AMD64_IBSFETCHPHYSAD 0xc0011032
    diff --git a/arch/x86/include/asm/suspend_32.h b/arch/x86/include/asm/suspend_32.h
    index 48dcfa6..fd921c3 100644
    --- a/arch/x86/include/asm/suspend_32.h
    +++ b/arch/x86/include/asm/suspend_32.h
    @@ -15,6 +15,8 @@ static inline int arch_prepare_suspend(void) { return 0; }
    struct saved_context {
    u16 es, fs, gs, ss;
    unsigned long cr0, cr2, cr3, cr4;
    + u64 misc_enable;
    + bool misc_enable_saved;
    struct desc_ptr gdt;
    struct desc_ptr idt;
    u16 ldt;
    diff --git a/arch/x86/include/asm/suspend_64.h b/arch/x86/include/asm/suspend_64.h
    index 06284f4..8d942af 100644
    --- a/arch/x86/include/asm/suspend_64.h
    +++ b/arch/x86/include/asm/suspend_64.h
    @@ -27,6 +27,8 @@ struct saved_context {
    u16 ds, es, fs, gs, ss;
    unsigned long gs_base, gs_kernel_base, fs_base;
    unsigned long cr0, cr2, cr3, cr4, cr8;
    + u64 misc_enable;
    + bool misc_enable_saved;
    unsigned long efer;
    u16 gdt_pad;
    u16 gdt_limit;
    diff --git a/arch/x86/include/asm/system.h b/arch/x86/include/asm/system.h
    index f08f973..e0fbf29 100644
    --- a/arch/x86/include/asm/system.h
    +++ b/arch/x86/include/asm/system.h
    @@ -449,7 +449,7 @@ void stop_this_cpu(void *dummy);
    *
    * (Could use an alternative three way for this if there was one.)
    */
    -static inline void rdtsc_barrier(void)
    +static __always_inline void rdtsc_barrier(void)
    {
    alternative(ASM_NOP3, "mfence", X86_FEATURE_MFENCE_RDTSC);
    alternative(ASM_NOP3, "lfence", X86_FEATURE_LFENCE_RDTSC);
    diff --git a/arch/x86/kernel/acpi/cstate.c b/arch/x86/kernel/acpi/cstate.c
    index 2e837f5..fb7a5f0 100644
    --- a/arch/x86/kernel/acpi/cstate.c
    +++ b/arch/x86/kernel/acpi/cstate.c
    @@ -145,6 +145,15 @@ int acpi_processor_ffh_cstate_probe(unsigned int cpu,
    percpu_entry->states[cx->index].eax = cx->address;
    percpu_entry->states[cx->index].ecx = MWAIT_ECX_INTERRUPT_BREAK;
    }
    +
    + /*
    + * For _CST FFH on Intel, if GAS.access_size bit 1 is cleared,
    + * then we should skip checking BM_STS for this C-state.
    + * ref: "Intel Processor Vendor-Specific ACPI Interface Specification"
    + */
    + if ((c->x86_vendor == X86_VENDOR_INTEL) && !(reg->access_size & 0x2))
    + cx->bm_sts_skip = 1;
    +
    return retval;
    }
    EXPORT_SYMBOL_GPL(acpi_processor_ffh_cstate_probe);
    diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
    index 8b85734..ca93638 100644
    --- a/arch/x86/kernel/acpi/sleep.c
    +++ b/arch/x86/kernel/acpi/sleep.c
    @@ -162,8 +162,6 @@ static int __init acpi_sleep_setup(char *str)
    #endif
    if (strncmp(str, "old_ordering", 12) == 0)
    acpi_old_suspend_ordering();
    - if (strncmp(str, "sci_force_enable", 16) == 0)
    - acpi_set_sci_en_on_resume();
    str = strchr(str, ',');
    if (str != NULL)
    str += strspn(str, ", \t");
    diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
    index 168e172..bc9cd5a 100644
    --- a/arch/x86/kernel/apic/apic.c
    +++ b/arch/x86/kernel/apic/apic.c
    @@ -941,7 +941,7 @@ void disable_local_APIC(void)
    unsigned int value;

    /* APIC hasn't been mapped yet */
    - if (!apic_phys)
    + if (!x2apic_mode && !apic_phys)
    return;

    clear_local_APIC();
    diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
    index 74f5a3f..19528ef 100644
    --- a/arch/x86/kernel/hpet.c
    +++ b/arch/x86/kernel/hpet.c
    @@ -949,7 +949,7 @@ fs_initcall(hpet_late_init);

    void hpet_disable(void)
    {
    - if (is_hpet_capable()) {
    + if (is_hpet_capable() && hpet_virt_address) {
    unsigned long cfg = hpet_readl(HPET_CFG);

    if (hpet_legacy_int_enabled) {
    diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
    index e6ec8a2..1a2d4b1 100644
    --- a/arch/x86/kernel/pci-calgary_64.c
    +++ b/arch/x86/kernel/pci-calgary_64.c
    @@ -102,11 +102,16 @@ int use_calgary __read_mostly = 0;
    #define PMR_SOFTSTOPFAULT 0x40000000
    #define PMR_HARDSTOP 0x20000000

    -#define MAX_NUM_OF_PHBS 8 /* how many PHBs in total? */
    -#define MAX_NUM_CHASSIS 8 /* max number of chassis */
    -/* MAX_PHB_BUS_NUM is the maximal possible dev->bus->number */
    -#define MAX_PHB_BUS_NUM (MAX_NUM_OF_PHBS * MAX_NUM_CHASSIS * 2)
    -#define PHBS_PER_CALGARY 4
    +/*
    + * The maximum PHB bus number.
    + * x3950M2 (rare): 8 chassis, 48 PHBs per chassis = 384
    + * x3950M2: 4 chassis, 48 PHBs per chassis = 192
    + * x3950 (PCIE): 8 chassis, 32 PHBs per chassis = 256
    + * x3950 (PCIX): 8 chassis, 16 PHBs per chassis = 128
    + */
    +#define MAX_PHB_BUS_NUM 256
    +
    +#define PHBS_PER_CALGARY 4

    /* register offsets in Calgary's internal register space */
    static const unsigned long tar_offsets[] = {
    @@ -1053,8 +1058,6 @@ static int __init calgary_init_one(struct pci_dev *dev)
    struct iommu_table *tbl;
    int ret;

    - BUG_ON(dev->bus->number >= MAX_PHB_BUS_NUM);
    -
    bbar = busno_to_bbar(dev->bus->number);
    ret = calgary_setup_tar(dev, bbar);
    if (ret)
    diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
    index a265626..fdf2e28 100644
    --- a/arch/x86/kvm/mmu.c
    +++ b/arch/x86/kvm/mmu.c
    @@ -1843,6 +1843,9 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,

    spte |= PT_WRITABLE_MASK;

    + if (!tdp_enabled && !(pte_access & ACC_WRITE_MASK))
    + spte &= ~PT_USER_MASK;
    +
    /*
    * Optimization: for pte sync, if spte was writable the hash
    * lookup is unnecessary (and expensive). Write protection
    @@ -1898,6 +1901,8 @@ static void mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep,

    child = page_header(pte & PT64_BASE_ADDR_MASK);
    mmu_page_remove_parent_pte(child, sptep);
    + __set_spte(sptep, shadow_trap_nonpresent_pte);
    + kvm_flush_remote_tlbs(vcpu->kvm);
    } else if (pfn != spte_to_pfn(*sptep)) {
    pgprintk("hfn old %lx new %lx\n",
    spte_to_pfn(*sptep), pfn);
    diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
    index 8e65552..61ba669 100644
    --- a/arch/x86/kvm/svm.c
    +++ b/arch/x86/kvm/svm.c
    @@ -27,6 +27,7 @@
    #include <linux/sched.h>
    #include <linux/ftrace_event.h>

    +#include <asm/tlbflush.h>
    #include <asm/desc.h>

    #include <asm/virtext.h>
    @@ -62,6 +63,8 @@ MODULE_LICENSE("GPL");
    #define nsvm_printk(fmt, args...) do {} while(0)
    #endif

    +static bool erratum_383_found __read_mostly;
    +
    static const u32 host_save_user_msrs[] = {
    #ifdef CONFIG_X86_64
    MSR_STAR, MSR_LSTAR, MSR_CSTAR, MSR_SYSCALL_MASK, MSR_KERNEL_GS_BASE,
    @@ -299,6 +302,31 @@ static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
    svm_set_interrupt_shadow(vcpu, 0);
    }

    +static void svm_init_erratum_383(void)
    +{
    + u32 low, high;
    + int err;
    + u64 val;
    +
    + /* Only Fam10h is affected */
    + if (boot_cpu_data.x86 != 0x10)
    + return;
    +
    + /* Use _safe variants to not break nested virtualization */
    + val = native_read_msr_safe(MSR_AMD64_DC_CFG, &err);
    + if (err)
    + return;
    +
    + val |= (1ULL << 47);
    +
    + low = lower_32_bits(val);
    + high = upper_32_bits(val);
    +
    + native_write_msr_safe(MSR_AMD64_DC_CFG, low, high);
    +
    + erratum_383_found = true;
    +}
    +
    static int has_svm(void)
    {
    const char *msg;
    @@ -318,7 +346,6 @@ static void svm_hardware_disable(void *garbage)

    static void svm_hardware_enable(void *garbage)
    {
    -
    struct svm_cpu_data *svm_data;
    uint64_t efer;
    struct descriptor_table gdt_descr;
    @@ -350,6 +377,10 @@ static void svm_hardware_enable(void *garbage)

    wrmsrl(MSR_VM_HSAVE_PA,
    page_to_pfn(svm_data->save_area) << PAGE_SHIFT);
    +
    + svm_init_erratum_383();
    +
    + return;
    }

    static void svm_cpu_uninit(int cpu)
    @@ -1257,8 +1288,59 @@ static int nm_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
    return 1;
    }

    -static int mc_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
    +static bool is_erratum_383(void)
    {
    + int err, i;
    + u64 value;
    +
    + if (!erratum_383_found)
    + return false;
    +
    + value = native_read_msr_safe(MSR_IA32_MC0_STATUS, &err);
    + if (err)
    + return false;
    +
    + /* Bit 62 may or may not be set for this mce */
    + value &= ~(1ULL << 62);
    +
    + if (value != 0xb600000000010015ULL)
    + return false;
    +
    + /* Clear MCi_STATUS registers */
    + for (i = 0; i < 6; ++i)
    + native_write_msr_safe(MSR_IA32_MCx_STATUS(i), 0, 0);
    +
    + value = native_read_msr_safe(MSR_IA32_MCG_STATUS, &err);
    + if (!err) {
    + u32 low, high;
    +
    + value &= ~(1ULL << 2);
    + low = lower_32_bits(value);
    + high = upper_32_bits(value);
    +
    + native_write_msr_safe(MSR_IA32_MCG_STATUS, low, high);
    + }
    +
    + /* Flush tlb to evict multi-match entries */
    + __flush_tlb_all();
    +
    + return true;
    +}
    +
    +static void svm_handle_mce(struct vcpu_svm *svm)
    +{
    + if (is_erratum_383()) {
    + /*
    + * Erratum 383 triggered. Guest state is corrupt so kill the
    + * guest.
    + */
    + pr_err("KVM: Guest triggered AMD Erratum 383\n");
    +
    + set_bit(KVM_REQ_TRIPLE_FAULT, &svm->vcpu.requests);
    +
    + return;
    + }
    +
    /*
    * On an #MC intercept the MCE handler is not called automatically in
    * the host. So do it by hand here.
    @@ -1267,6 +1349,11 @@ static int mc_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
    "int $0x12\n");
    /* not sure if we ever come back to this point */

    + return;
    +}
    +
    +static int mc_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
    +{
    return 1;
    }

    @@ -2717,6 +2804,14 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
    vcpu->arch.regs_avail &= ~(1 << VCPU_EXREG_PDPTR);
    vcpu->arch.regs_dirty &= ~(1 << VCPU_EXREG_PDPTR);
    }
    +
    + /*
    + * We need to handle MC intercepts here before the vcpu has a chance to
    + * change the physical cpu
    + */
    + if (unlikely(svm->vmcb->control.exit_code ==
    + SVM_EXIT_EXCP_BASE + MC_VECTOR))
    + svm_handle_mce(svm);
    }

    #undef R
    diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
    index 8aa85f1..eeeb522 100644
    --- a/arch/x86/power/cpu.c
    +++ b/arch/x86/power/cpu.c
    @@ -104,6 +104,8 @@ static void __save_processor_state(struct saved_context *ctxt)
    ctxt->cr4 = read_cr4();
    ctxt->cr8 = read_cr8();
    #endif
    + ctxt->misc_enable_saved = !rdmsrl_safe(MSR_IA32_MISC_ENABLE,
    + &ctxt->misc_enable);
    }

    /* Needed by apm.c */
    @@ -176,6 +178,8 @@ static void fix_processor_context(void)
    */
    static void __restore_processor_state(struct saved_context *ctxt)
    {
    + if (ctxt->misc_enable_saved)
    + wrmsrl(MSR_IA32_MISC_ENABLE, ctxt->misc_enable);
    /*
    * control registers
    */
    diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
    index c8f0797..a6ad608 100644
    --- a/drivers/acpi/processor_idle.c
    +++ b/drivers/acpi/processor_idle.c
    @@ -962,7 +962,7 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
    if (acpi_idle_suspend)
    return(acpi_idle_enter_c1(dev, state));

    - if (acpi_idle_bm_check()) {
    + if (!cx->bm_sts_skip && acpi_idle_bm_check()) {
    if (dev->safe_state) {
    dev->last_state = dev->safe_state;
    return dev->safe_state->enter(dev, dev->safe_state);
    diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
    index 9ed9292..0458094 100644
    --- a/drivers/acpi/sleep.c
    +++ b/drivers/acpi/sleep.c
    @@ -80,22 +80,6 @@ static int acpi_sleep_prepare(u32 acpi_state)

    #ifdef CONFIG_ACPI_SLEEP
    static u32 acpi_target_sleep_state = ACPI_STATE_S0;
    -/*
    - * According to the ACPI specification the BIOS should make sure that ACPI is
    - * enabled and SCI_EN bit is set on wake-up from S1 - S3 sleep states. Still,
    - * some BIOSes don't do that and therefore we use acpi_enable() to enable ACPI
    - * on such systems during resume. Unfortunately that doesn't help in
    - * particularly pathological cases in which SCI_EN has to be set directly on
    - * resume, although the specification states very clearly that this flag is
    - * owned by the hardware. The set_sci_en_on_resume variable will be set in such
    - * cases.
    - */
    -static bool set_sci_en_on_resume;
    -
    -void __init acpi_set_sci_en_on_resume(void)
    -{
    - set_sci_en_on_resume = true;
    -}

    /*
    * ACPI 1.0 wants us to execute _PTS before suspending devices, so we allow the
    @@ -253,11 +237,8 @@ static int acpi_suspend_enter(suspend_state_t pm_state)
    break;
    }

    - /* If ACPI is not enabled by the BIOS, we need to enable it here. */
    - if (set_sci_en_on_resume)
    - acpi_write_bit_register(ACPI_BITREG_SCI_ENABLE, 1);
    - else
    - acpi_enable();
    + /* This violates the spec but is required for bug compatibility. */
    + acpi_write_bit_register(ACPI_BITREG_SCI_ENABLE, 1);

    /* Reprogram control registers and execute _BFS */
    acpi_leave_sleep_state_prep(acpi_state);
    @@ -346,12 +327,6 @@ static int __init init_old_suspend_ordering(const struct dmi_system_id *d)
    return 0;
    }

    -static int __init init_set_sci_en_on_resume(const struct dmi_system_id *d)
    -{
    - set_sci_en_on_resume = true;
    - return 0;
    -}
    -
    static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
    {
    .callback = init_old_suspend_ordering,
    @@ -370,22 +345,6 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
    },
    },
    {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Apple MacBook 1,1",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "Apple Computer, Inc."),
    - DMI_MATCH(DMI_PRODUCT_NAME, "MacBook1,1"),
    - },
    - },
    - {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Apple MacMini 1,1",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "Apple Computer, Inc."),
    - DMI_MATCH(DMI_PRODUCT_NAME, "Macmini1,1"),
    - },
    - },
    - {
    .callback = init_old_suspend_ordering,
    .ident = "Asus Pundit P1-AH2 (M2N8L motherboard)",
    .matches = {
    @@ -394,94 +353,6 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
    },
    },
    {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Toshiba Satellite L300",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
    - DMI_MATCH(DMI_PRODUCT_NAME, "Satellite L300"),
    - },
    - },
    - {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Hewlett-Packard HP G7000 Notebook PC",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
    - DMI_MATCH(DMI_PRODUCT_NAME, "HP G7000 Notebook PC"),
    - },
    - },
    - {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Hewlett-Packard HP Pavilion dv3 Notebook PC",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
    - DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv3 Notebook PC"),
    - },
    - },
    - {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Hewlett-Packard Pavilion dv4",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
    - DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4"),
    - },
    - },
    - {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Hewlett-Packard Pavilion dv7",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
    - DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv7"),
    - },
    - },
    - {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Hewlett-Packard Compaq Presario C700 Notebook PC",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
    - DMI_MATCH(DMI_PRODUCT_NAME, "Compaq Presario C700 Notebook PC"),
    - },
    - },
    - {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Hewlett-Packard Compaq Presario CQ40 Notebook PC",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
    - DMI_MATCH(DMI_PRODUCT_NAME, "Compaq Presario CQ40 Notebook PC"),
    - },
    - },
    - {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Lenovo ThinkPad T410",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
    - DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
    - },
    - },
    - {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Lenovo ThinkPad T510",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
    - DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
    - },
    - },
    - {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Lenovo ThinkPad W510",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
    - DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
    - },
    - },
    - {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Lenovo ThinkPad X201[s]",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
    - DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
    - },
    - },
    - {
    .callback = init_old_suspend_ordering,
    .ident = "Panasonic CF51-2L",
    .matches = {
    @@ -490,30 +361,6 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
    DMI_MATCH(DMI_BOARD_NAME, "CF51-2L"),
    },
    },
    - {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Dell Studio 1558",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
    - DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1558"),
    - },
    - },
    - {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Dell Studio 1557",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
    - DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1557"),
    - },
    - },
    - {
    - .callback = init_set_sci_en_on_resume,
    - .ident = "Dell Studio 1555",
    - .matches = {
    - DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
    - DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1555"),
    - },
    - },
    {},
    };
    #endif /* CONFIG_SUSPEND */
    diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
    index 7376367..e0e6570 100644
    --- a/drivers/base/firmware_class.c
    +++ b/drivers/base/firmware_class.c
    @@ -125,6 +125,17 @@ static ssize_t firmware_loading_show(struct device *dev,
    return sprintf(buf, "%d\n", loading);
    }

    +static void firmware_free_data(const struct firmware *fw)
    +{
    + int i;
    + vunmap(fw->data);
    + if (fw->pages) {
    + for (i = 0; i < PFN_UP(fw->size); i++)
    + __free_page(fw->pages[i]);
    + kfree(fw->pages);
    + }
    +}
    +
    /* Some architectures don't have PAGE_KERNEL_RO */
    #ifndef PAGE_KERNEL_RO
    #define PAGE_KERNEL_RO PAGE_KERNEL
    @@ -157,21 +168,21 @@ static ssize_t firmware_loading_store(struct device *dev,
    mutex_unlock(&fw_lock);
    break;
    }
    - vfree(fw_priv->fw->data);
    - fw_priv->fw->data = NULL;
    + firmware_free_data(fw_priv->fw);
    + memset(fw_priv->fw, 0, sizeof(struct firmware));
    + /* If the pages are not owned by 'struct firmware' */
    for (i = 0; i < fw_priv->nr_pages; i++)
    __free_page(fw_priv->pages[i]);
    kfree(fw_priv->pages);
    fw_priv->pages = NULL;
    fw_priv->page_array_size = 0;
    fw_priv->nr_pages = 0;
    - fw_priv->fw->size = 0;
    set_bit(FW_STATUS_LOADING, &fw_priv->status);
    mutex_unlock(&fw_lock);
    break;
    case 0:
    if (test_bit(FW_STATUS_LOADING, &fw_priv->status)) {
    - vfree(fw_priv->fw->data);
    + vunmap(fw_priv->fw->data);
    fw_priv->fw->data = vmap(fw_priv->pages,
    fw_priv->nr_pages,
    0, PAGE_KERNEL_RO);
    @@ -179,7 +190,10 @@ static ssize_t firmware_loading_store(struct device *dev,
    dev_err(dev, "%s: vmap() failed\n", __func__);
    goto err;
    }
    - /* Pages will be freed by vfree() */
    + /* Pages are now owned by 'struct firmware' */
    + fw_priv->fw->pages = fw_priv->pages;
    + fw_priv->pages = NULL;
    +
    fw_priv->page_array_size = 0;
    fw_priv->nr_pages = 0;
    complete(&fw_priv->completion);
    @@ -572,7 +586,7 @@ release_firmware(const struct firmware *fw)
    if (fw->data == builtin->data)
    goto free_fw;
    }
    - vfree(fw->data);
    + firmware_free_data(fw);
    free_fw:
    kfree(fw);
    }
    diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
    index 2fb2e6c..c496c8a 100644
    --- a/drivers/char/agp/amd64-agp.c
    +++ b/drivers/char/agp/amd64-agp.c
    @@ -499,6 +499,10 @@ static int __devinit agp_amd64_probe(struct pci_dev *pdev,
    u8 cap_ptr;
    int err;

    + /* The Highlander principle */
    + if (agp_bridges_found)
    + return -ENODEV;
    +
    cap_ptr = pci_find_capability(pdev, PCI_CAP_ID_AGP);
    if (!cap_ptr)
    return -ENODEV;
    @@ -562,6 +566,8 @@ static void __devexit agp_amd64_remove(struct pci_dev *pdev)
    amd64_aperture_sizes[bridge->aperture_size_idx].size);
    agp_remove_bridge(bridge);
    agp_put_bridge(bridge);
    +
    + agp_bridges_found--;
    }

    #ifdef CONFIG_PM
    @@ -709,6 +715,11 @@ static struct pci_device_id agp_amd64_pci_table[] = {

    MODULE_DEVICE_TABLE(pci, agp_amd64_pci_table);

    +static DEFINE_PCI_DEVICE_TABLE(agp_amd64_pci_promisc_table) = {
    + { PCI_DEVICE_CLASS(0, 0) },
    + { }
    +};
    +
    static struct pci_driver agp_amd64_pci_driver = {
    .name = "agpgart-amd64",
    .id_table = agp_amd64_pci_table,
    @@ -733,7 +744,6 @@ int __init agp_amd64_init(void)
    return err;

    if (agp_bridges_found == 0) {
    - struct pci_dev *dev;
    if (!agp_try_unsupported && !agp_try_unsupported_boot) {
    printk(KERN_INFO PFX "No supported AGP bridge found.\n");
    #ifdef MODULE
    @@ -749,17 +759,10 @@ int __init agp_amd64_init(void)
    return -ENODEV;

    /* Look for any AGP bridge */
    - dev = NULL;
    - err = -ENODEV;
    - for_each_pci_dev(dev) {
    - if (!pci_find_capability(dev, PCI_CAP_ID_AGP))
    - continue;
    - /* Only one bridge supported right now */
    - if (agp_amd64_probe(dev, NULL) == 0) {
    - err = 0;
    - break;
    - }
    - }
    + agp_amd64_pci_driver.id_table = agp_amd64_pci_promisc_table;
    + err = driver_attach(&agp_amd64_pci_driver.driver);
    + if (err == 0 && agp_bridges_found == 0)
    + err = -ENODEV;
    }
    return err;
    }
    diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
    index 8e00b4d..792868d 100644
    --- a/drivers/char/tpm/tpm.h
    +++ b/drivers/char/tpm/tpm.h
    @@ -224,6 +224,7 @@ struct tpm_readpubek_params_out {
    u8 algorithm[4];
    u8 encscheme[2];
    u8 sigscheme[2];
    + __be32 paramsize;
    u8 parameters[12]; /*assuming RSA*/
    __be32 keysize;
    u8 modulus[256];
    diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
    index 2405f17..ca15c04 100644
    --- a/drivers/char/tpm/tpm_tis.c
    +++ b/drivers/char/tpm/tpm_tis.c
    @@ -622,7 +622,14 @@ static int tpm_tis_pnp_suspend(struct pnp_dev *dev, pm_message_t msg)

    static int tpm_tis_pnp_resume(struct pnp_dev *dev)
    {
    - return tpm_pm_resume(&dev->dev);
    + struct tpm_chip *chip = pnp_get_drvdata(dev);
    + int ret;
    +
    + ret = tpm_pm_resume(&dev->dev);
    + if (!ret)
    + tpm_continue_selftest(chip);
    +
    + return ret;
    }

    static struct pnp_device_id tpm_pnp_tbl[] __devinitdata = {
    diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
    index ff57c40..c18e65e 100644
    --- a/drivers/cpufreq/cpufreq.c
    +++ b/drivers/cpufreq/cpufreq.c
    @@ -1741,17 +1741,8 @@ static int __cpufreq_set_policy(struct cpufreq_policy *data,
    dprintk("governor switch\n");

    /* end old governor */
    - if (data->governor) {
    - /*
    - * Need to release the rwsem around governor
    - * stop due to lock dependency between
    - * cancel_delayed_work_sync and the read lock
    - * taken in the delayed work handler.
    - */
    - unlock_policy_rwsem_write(data->cpu);
    + if (data->governor)
    __cpufreq_governor(data, CPUFREQ_GOV_STOP);
    - lock_policy_rwsem_write(data->cpu);
    - }

    /* start new governor */
    data->governor = policy->governor;
    diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
    index 7f436ec..5449239 100644
    --- a/drivers/gpu/drm/i915/i915_drv.c
    +++ b/drivers/gpu/drm/i915/i915_drv.c
    @@ -192,6 +192,7 @@ int i965_reset(struct drm_device *dev, u8 flags)
    }
    } else {
    DRM_ERROR("Error occurred. Don't know how to reset this chip.\n");
    + mutex_unlock(&dev->struct_mutex);
    return -ENODEV;
    }

    diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
    index df6f7c9..952c844 100644
    --- a/drivers/gpu/drm/i915/i915_gem.c
    +++ b/drivers/gpu/drm/i915/i915_gem.c
    @@ -4697,6 +4697,16 @@ i915_gem_load(struct drm_device *dev)
    list_add(&dev_priv->mm.shrink_list, &shrink_list);
    spin_unlock(&shrink_list_lock);

    + /* On GEN3 we really need to make sure the ARB C3 LP bit is set */
    + if (IS_I915G(dev) || IS_I915GM(dev) || IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev)) {
    + u32 tmp = I915_READ(MI_ARB_STATE);
    + if (!(tmp & MI_ARB_C3_LP_WRITE_ENABLE)) {
    + /* arb state is a masked write, so set bit + bit in mask */
    + tmp = MI_ARB_C3_LP_WRITE_ENABLE | (MI_ARB_C3_LP_WRITE_ENABLE << MI_ARB_MASK_SHIFT);
    + I915_WRITE(MI_ARB_STATE, tmp);
    + }
    + }
    +
    /* Old X drivers will take 0-2 for front, back, depth buffers */
    dev_priv->fence_reg_start = 3;

    diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
    index 73e7ec0..7214c85 100644
    --- a/drivers/gpu/drm/i915/i915_reg.h
    +++ b/drivers/gpu/drm/i915/i915_reg.h
    @@ -307,6 +307,70 @@
    #define LM_BURST_LENGTH 0x00000700
    #define LM_FIFO_WATERMARK 0x0000001F
    #define MI_ARB_STATE 0x020e4 /* 915+ only */
    +#define MI_ARB_MASK_SHIFT 16 /* shift for enable bits */
    +
    +/* Make render/texture TLB fetches lower priorty than associated data
    + * fetches. This is not turned on by default
    + */
    +#define MI_ARB_RENDER_TLB_LOW_PRIORITY (1 << 15)
    +
    +/* Isoch request wait on GTT enable (Display A/B/C streams).
    + * Make isoch requests stall on the TLB update. May cause
    + * display underruns (test mode only)
    + */
    +#define MI_ARB_ISOCH_WAIT_GTT (1 << 14)
    +
    +/* Block grant count for isoch requests when block count is
    + * set to a finite value.
    + */
    +#define MI_ARB_BLOCK_GRANT_MASK (3 << 12)
    +#define MI_ARB_BLOCK_GRANT_8 (0 << 12) /* for 3 display planes */
    +#define MI_ARB_BLOCK_GRANT_4 (1 << 12) /* for 2 display planes */
    +#define MI_ARB_BLOCK_GRANT_2 (2 << 12) /* for 1 display plane */
    +#define MI_ARB_BLOCK_GRANT_0 (3 << 12) /* don't use */
    +
    +/* Enable render writes to complete in C2/C3/C4 power states.
    + * If this isn't enabled, render writes are prevented in low
    + * power states. That seems bad to me.
    + */
    +#define MI_ARB_C3_LP_WRITE_ENABLE (1 << 11)
    +
    +/* This acknowledges an async flip immediately instead
    + * of waiting for 2TLB fetches.
    + */
    +#define MI_ARB_ASYNC_FLIP_ACK_IMMEDIATE (1 << 10)
    +
    +/* Enables non-sequential data reads through arbiter
    + */
    +#define MI_ARB_DUAL_DATA_PHASE_DISABLE (1 << 9)
    +
    +/* Disable FSB snooping of cacheable write cycles from binner/render
    + * command stream
    + */
    +#define MI_ARB_CACHE_SNOOP_DISABLE (1 << 8)
    +
    +/* Arbiter time slice for non-isoch streams */
    +#define MI_ARB_TIME_SLICE_MASK (7 << 5)
    +#define MI_ARB_TIME_SLICE_1 (0 << 5)
    +#define MI_ARB_TIME_SLICE_2 (1 << 5)
    +#define MI_ARB_TIME_SLICE_4 (2 << 5)
    +#define MI_ARB_TIME_SLICE_6 (3 << 5)
    +#define MI_ARB_TIME_SLICE_8 (4 << 5)
    +#define MI_ARB_TIME_SLICE_10 (5 << 5)
    +#define MI_ARB_TIME_SLICE_14 (6 << 5)
    +#define MI_ARB_TIME_SLICE_16 (7 << 5)
    +
    +/* Low priority grace period page size */
    +#define MI_ARB_LOW_PRIORITY_GRACE_4KB (0 << 4) /* default */
    +#define MI_ARB_LOW_PRIORITY_GRACE_8KB (1 << 4)
    +
    +/* Disable display A/B trickle feed */
    +#define MI_ARB_DISPLAY_TRICKLE_FEED_DISABLE (1 << 2)
    +
    +/* Set display plane priority */
    +#define MI_ARB_DISPLAY_PRIORITY_A_B (0 << 0) /* display A > display B */
    +#define MI_ARB_DISPLAY_PRIORITY_B_A (1 << 0) /* display B > display A */
    +
    #define CACHE_MODE_0 0x02120 /* 915+ only */
    #define CM0_MASK_SHIFT 16
    #define CM0_IZ_OPT_DISABLE (1<<6)
    diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
    index cce453e..88d5e3a 100644
    --- a/drivers/gpu/drm/i915/intel_display.c
    +++ b/drivers/gpu/drm/i915/intel_display.c
    @@ -785,8 +785,8 @@ intel_g4x_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
    intel_clock_t clock;
    int max_n;
    bool found;
    - /* approximately equals target * 0.00488 */
    - int err_most = (target >> 8) + (target >> 10);
    + /* approximately equals target * 0.00585 */
    + int err_most = (target >> 8) + (target >> 9);
    found = false;

    if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
    diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c
    index eb740fc..ccf42c3 100644
    --- a/drivers/gpu/drm/radeon/r200.c
    +++ b/drivers/gpu/drm/radeon/r200.c
    @@ -368,6 +368,8 @@ int r200_packet0_check(struct radeon_cs_parser *p,
    /* 2D, 3D, CUBE */
    switch (tmp) {
    case 0:
    + case 3:
    + case 4:
    case 5:
    case 6:
    case 7:
    diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
    index a4813c6..e5e22b1 100644
    --- a/drivers/gpu/drm/radeon/radeon_atombios.c
    +++ b/drivers/gpu/drm/radeon/radeon_atombios.c
    @@ -161,6 +161,15 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
    }
    }

    + /* ASUS HD 3600 board lists the DVI port as HDMI */
    + if ((dev->pdev->device == 0x9598) &&
    + (dev->pdev->subsystem_vendor == 0x1043) &&
    + (dev->pdev->subsystem_device == 0x01e4)) {
    + if (*connector_type == DRM_MODE_CONNECTOR_HDMIA) {
    + *connector_type = DRM_MODE_CONNECTOR_DVII;
    + }
    + }
    +
    /* ASUS HD 3450 board lists the DVI port as HDMI */
    if ((dev->pdev->device == 0x95C5) &&
    (dev->pdev->subsystem_vendor == 0x1043) &&
    diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
    index 0038212..183bef8 100644
    --- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
    +++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
    @@ -89,6 +89,7 @@ static void radeon_legacy_lvds_dpms(struct drm_encoder *encoder, int mode)
    udelay(panel_pwr_delay * 1000);
    WREG32(RADEON_LVDS_GEN_CNTL, lvds_gen_cntl);
    WREG32_PLL(RADEON_PIXCLKS_CNTL, pixclks_cntl);
    + udelay(panel_pwr_delay * 1000);
    break;
    }

    diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
    index cb4290a..5852191 100644
    --- a/drivers/hwmon/coretemp.c
    +++ b/drivers/hwmon/coretemp.c
    @@ -53,6 +53,7 @@ struct coretemp_data {
    struct mutex update_lock;
    const char *name;
    u32 id;
    + u16 core_id;
    char valid; /* zero until following fields are valid */
    unsigned long last_updated; /* in jiffies */
    int temp;
    @@ -75,7 +76,7 @@ static ssize_t show_name(struct device *dev, struct device_attribute
    if (attr->index == SHOW_NAME)
    ret = sprintf(buf, "%s\n", data->name);
    else /* show label */
    - ret = sprintf(buf, "Core %d\n", data->id);
    + ret = sprintf(buf, "Core %d\n", data->core_id);
    return ret;
    }

    @@ -255,6 +256,9 @@ static int __devinit coretemp_probe(struct platform_device *pdev)
    }

    data->id = pdev->id;
    +#ifdef CONFIG_SMP
    + data->core_id = c->cpu_core_id;
    +#endif
    data->name = "coretemp";
    mutex_init(&data->update_lock);

    @@ -352,6 +356,10 @@ struct pdev_entry {
    struct list_head list;
    struct platform_device *pdev;
    unsigned int cpu;
    +#ifdef CONFIG_SMP
    + u16 phys_proc_id;
    + u16 cpu_core_id;
    +#endif
    };

    static LIST_HEAD(pdev_list);
    @@ -362,6 +370,22 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)
    int err;
    struct platform_device *pdev;
    struct pdev_entry *pdev_entry;
    +#ifdef CONFIG_SMP
    + struct cpuinfo_x86 *c = &cpu_data(cpu);
    +#endif
    +
    + mutex_lock(&pdev_list_mutex);
    +
    +#ifdef CONFIG_SMP
    + /* Skip second HT entry of each core */
    + list_for_each_entry(pdev_entry, &pdev_list, list) {
    + if (c->phys_proc_id == pdev_entry->phys_proc_id &&
    + c->cpu_core_id == pdev_entry->cpu_core_id) {
    + err = 0; /* Not an error */
    + goto exit;
    + }
    + }
    +#endif

    pdev = platform_device_alloc(DRVNAME, cpu);
    if (!pdev) {
    @@ -385,7 +409,10 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)

    pdev_entry->pdev = pdev;
    pdev_entry->cpu = cpu;
    - mutex_lock(&pdev_list_mutex);
    +#ifdef CONFIG_SMP
    + pdev_entry->phys_proc_id = c->phys_proc_id;
    + pdev_entry->cpu_core_id = c->cpu_core_id;
    +#endif
    list_add_tail(&pdev_entry->list, &pdev_list);
    mutex_unlock(&pdev_list_mutex);

    @@ -396,6 +423,7 @@ exit_device_free:
    exit_device_put:
    platform_device_put(pdev);
    exit:
    + mutex_unlock(&pdev_list_mutex);
    return err;
    }

    diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
    index a3749cb..497476f 100644
    --- a/drivers/hwmon/it87.c
    +++ b/drivers/hwmon/it87.c
    @@ -80,6 +80,13 @@ superio_inb(int reg)
    return inb(VAL);
    }

    +static inline void
    +superio_outb(int reg, int val)
    +{
    + outb(reg, REG);
    + outb(val, VAL);
    +}
    +
    static int superio_inw(int reg)
    {
    int val;
    @@ -1036,6 +1043,21 @@ static int __init it87_find(unsigned short *address,
    sio_data->vid_value = superio_inb(IT87_SIO_VID_REG);

    reg = superio_inb(IT87_SIO_PINX2_REG);
    + /*
    + * The IT8720F has no VIN7 pin, so VCCH should always be
    + * routed internally to VIN7 with an internal divider.
    + * Curiously, there still is a configuration bit to control
    + * this, which means it can be set incorrectly. And even
    + * more curiously, many boards out there are improperly
    + * configured, even though the IT8720F datasheet claims
    + * that the internal routing of VCCH to VIN7 is the default
    + * setting. So we force the internal routing in this case.
    + */
    + if (sio_data->type == it8720 && !(reg & (1 << 1))) {
    + reg |= (1 << 1);
    + superio_outb(IT87_SIO_PINX2_REG, reg);
    + pr_notice("it87: Routing internal VCCH to in7\n");
    + }
    if (reg & (1 << 0))
    pr_info("it87: in3 is VCC (+5V)\n");
    if (reg & (1 << 1))
    diff --git a/drivers/hwmon/k8temp.c b/drivers/hwmon/k8temp.c
    index 1fe9951..f808d18 100644
    --- a/drivers/hwmon/k8temp.c
    +++ b/drivers/hwmon/k8temp.c
    @@ -120,7 +120,7 @@ static ssize_t show_temp(struct device *dev,
    int temp;
    struct k8temp_data *data = k8temp_update_device(dev);

    - if (data->swap_core_select)
    + if (data->swap_core_select && (data->sensorsp & SEL_CORE))
    core = core ? 0 : 1;

    temp = TEMP_FROM_REG(data->temp[core][place]) + data->temp_offset;
    @@ -180,11 +180,13 @@ static int __devinit k8temp_probe(struct pci_dev *pdev,
    }

    if ((model >= 0x69) &&
    - !(model == 0xc1 || model == 0x6c || model == 0x7c)) {
    + !(model == 0xc1 || model == 0x6c || model == 0x7c ||
    + model == 0x6b || model == 0x6f || model == 0x7f)) {
    /*
    - * RevG desktop CPUs (i.e. no socket S1G1 parts)
    - * need additional offset, otherwise reported
    - * temperature is below ambient temperature
    + * RevG desktop CPUs (i.e. no socket S1G1 or
    + * ASB1 parts) need additional offset,
    + * otherwise reported temperature is below
    + * ambient temperature
    */
    data->temp_offset = 21000;
    }
    diff --git a/drivers/ide/cmd640.c b/drivers/ide/cmd640.c
    index 1a32d62..a9c3313 100644
    --- a/drivers/ide/cmd640.c
    +++ b/drivers/ide/cmd640.c
    @@ -632,12 +632,10 @@ static void cmd640_init_dev(ide_drive_t *drive)

    static int cmd640_test_irq(ide_hwif_t *hwif)
    {
    - struct pci_dev *dev = to_pci_dev(hwif->dev);
    int irq_reg = hwif->channel ? ARTTIM23 : CFR;
    - u8 irq_stat, irq_mask = hwif->channel ? ARTTIM23_IDE23INTR :
    + u8 irq_mask = hwif->channel ? ARTTIM23_IDE23INTR :
    CFR_IDE01INTR;
    -
    - pci_read_config_byte(dev, irq_reg, &irq_stat);
    + u8 irq_stat = get_cmd640_reg(irq_reg);

    return (irq_stat & irq_mask) ? 1 : 0;
    }
    diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c
    index cc8633c..67fb735 100644
    --- a/drivers/ide/ide-taskfile.c
    +++ b/drivers/ide/ide-taskfile.c
    @@ -428,13 +428,11 @@ int ide_raw_taskfile(ide_drive_t *drive, struct ide_cmd *cmd, u8 *buf,
    {
    struct request *rq;
    int error;
    + int rw = !(cmd->tf_flags & IDE_TFLAG_WRITE) ? READ : WRITE;

    - rq = blk_get_request(drive->queue, READ, __GFP_WAIT);
    + rq = blk_get_request(drive->queue, rw, __GFP_WAIT);
    rq->cmd_type = REQ_TYPE_ATA_TASKFILE;

    - if (cmd->tf_flags & IDE_TFLAG_WRITE)
    - rq->cmd_flags |= REQ_RW;
    -
    /*
    * (ks) We transfer currently only whole sectors.
    * This is suffient for now. But, it would be great,
    diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
    index df3eb8c..b4b2257 100644
    --- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
    +++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
    @@ -1163,7 +1163,7 @@ static ssize_t create_child(struct device *dev,

    return ret ? ret : count;
    }
    -static DEVICE_ATTR(create_child, S_IWUGO, NULL, create_child);
    +static DEVICE_ATTR(create_child, S_IWUSR, NULL, create_child);

    static ssize_t delete_child(struct device *dev,
    struct device_attribute *attr,
    @@ -1183,7 +1183,7 @@ static ssize_t delete_child(struct device *dev,
    return ret ? ret : count;

    }
    -static DEVICE_ATTR(delete_child, S_IWUGO, NULL, delete_child);
    +static DEVICE_ATTR(delete_child, S_IWUSR, NULL, delete_child);

    int ipoib_add_pkey_attr(struct net_device *dev)
    {
    diff --git a/drivers/input/keyboard/twl4030_keypad.c b/drivers/input/keyboard/twl4030_keypad.c
    index 9a2977c..2cfbc17 100644
    --- a/drivers/input/keyboard/twl4030_keypad.c
    +++ b/drivers/input/keyboard/twl4030_keypad.c
    @@ -50,8 +50,12 @@
    */
    #define TWL4030_MAX_ROWS 8 /* TWL4030 hard limit */
    #define TWL4030_MAX_COLS 8
    -#define TWL4030_ROW_SHIFT 3
    -#define TWL4030_KEYMAP_SIZE (TWL4030_MAX_ROWS * TWL4030_MAX_COLS)
    +/*
    + * Note that we add space for an extra column so that we can handle
    + * row lines connected to the gnd (see twl4030_col_xlate()).
    + */
    +#define TWL4030_ROW_SHIFT 4
    +#define TWL4030_KEYMAP_SIZE (TWL4030_MAX_ROWS << TWL4030_ROW_SHIFT)

    struct twl4030_keypad {
    unsigned short keymap[TWL4030_KEYMAP_SIZE];
    @@ -181,7 +185,7 @@ static int twl4030_read_kp_matrix_state(struct twl4030_keypad *kp, u16 *state)
    return ret;
    }

    -static int twl4030_is_in_ghost_state(struct twl4030_keypad *kp, u16 *key_state)
    +static bool twl4030_is_in_ghost_state(struct twl4030_keypad *kp, u16 *key_state)
    {
    int i;
    u16 check = 0;
    @@ -190,12 +194,12 @@ static int twl4030_is_in_ghost_state(struct twl4030_keypad *kp, u16 *key_state)
    u16 col = key_state[i];

    if ((col & check) && hweight16(col) > 1)
    - return 1;
    + return true;

    check |= col;
    }

    - return 0;
    + return false;
    }

    static void twl4030_kp_scan(struct twl4030_keypad *kp, bool release_all)
    @@ -224,7 +228,8 @@ static void twl4030_kp_scan(struct twl4030_keypad *kp, bool release_all)
    if (!changed)
    continue;

    - for (col = 0; col < kp->n_cols; col++) {
    + /* Extra column handles "all gnd" rows */
    + for (col = 0; col < kp->n_cols + 1; col++) {
    int code;

    if (!(changed & (1 << col)))
    diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
    index 525b9b9..ba09e4d 100644
    --- a/drivers/input/serio/i8042-x86ia64io.h
    +++ b/drivers/input/serio/i8042-x86ia64io.h
    @@ -166,6 +166,13 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
    },
    },
    {
    + /* Gigabyte Spring Peak - defines wrong chassis type */
    + .matches = {
    + DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
    + DMI_MATCH(DMI_PRODUCT_NAME, "Spring Peak"),
    + },
    + },
    + {
    .matches = {
    DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
    DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv9700"),
    diff --git a/drivers/media/dvb/dvb-core/dvb_net.c b/drivers/media/dvb/dvb-core/dvb_net.c
    index dddfc46..55e591d 100644
    --- a/drivers/media/dvb/dvb-core/dvb_net.c
    +++ b/drivers/media/dvb/dvb-core/dvb_net.c
    @@ -350,6 +350,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
    const u8 *ts, *ts_end, *from_where = NULL;
    u8 ts_remain = 0, how_much = 0, new_ts = 1;
    struct ethhdr *ethh = NULL;
    + bool error = false;

    #ifdef ULE_DEBUG
    /* The code inside ULE_DEBUG keeps a history of the last 100 TS cells processed. */
    @@ -459,10 +460,16 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )

    /* Drop partly decoded SNDU, reset state, resync on PUSI. */
    if (priv->ule_skb) {
    - dev_kfree_skb( priv->ule_skb );
    + error = true;
    + dev_kfree_skb(priv->ule_skb);
    + }
    +
    + if (error || priv->ule_sndu_remain) {
    dev->stats.rx_errors++;
    dev->stats.rx_frame_errors++;
    + error = false;
    }
    +
    reset_ule(priv);
    priv->need_pusi = 1;
    continue;
    @@ -534,6 +541,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
    from_where += 2;
    }

    + priv->ule_sndu_remain = priv->ule_sndu_len + 2;
    /*
    * State of current TS:
    * ts_remain (remaining bytes in the current TS cell)
    @@ -543,6 +551,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
    */
    switch (ts_remain) {
    case 1:
    + priv->ule_sndu_remain--;
    priv->ule_sndu_type = from_where[0] << 8;
    priv->ule_sndu_type_1 = 1; /* first byte of ule_type is set. */
    ts_remain -= 1; from_where += 1;
    @@ -556,6 +565,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
    default: /* complete ULE header is present in current TS. */
    /* Extract ULE type field. */
    if (priv->ule_sndu_type_1) {
    + priv->ule_sndu_type_1 = 0;
    priv->ule_sndu_type |= from_where[0];
    from_where += 1; /* points to payload start. */
    ts_remain -= 1;
    diff --git a/drivers/media/dvb/ttpci/Kconfig b/drivers/media/dvb/ttpci/Kconfig
    index d8d4214..32a7ec6 100644
    --- a/drivers/media/dvb/ttpci/Kconfig
    +++ b/drivers/media/dvb/ttpci/Kconfig
    @@ -68,13 +68,14 @@ config DVB_BUDGET
    select DVB_VES1820 if !DVB_FE_CUSTOMISE
    select DVB_L64781 if !DVB_FE_CUSTOMISE
    select DVB_TDA8083 if !DVB_FE_CUSTOMISE
    - select DVB_TDA10021 if !DVB_FE_CUSTOMISE
    - select DVB_TDA10023 if !DVB_FE_CUSTOMISE
    select DVB_S5H1420 if !DVB_FE_CUSTOMISE
    select DVB_TDA10086 if !DVB_FE_CUSTOMISE
    select DVB_TDA826X if !DVB_FE_CUSTOMISE
    select DVB_LNBP21 if !DVB_FE_CUSTOMISE
    select DVB_TDA1004X if !DVB_FE_CUSTOMISE
    + select DVB_ISL6423 if !DVB_FE_CUSTOMISE
    + select DVB_STV090x if !DVB_FE_CUSTOMISE
    + select DVB_STV6110x if !DVB_FE_CUSTOMISE
    help
    Support for simple SAA7146 based DVB cards (so called Budget-
    or Nova-PCI cards) without onboard MPEG2 decoder, and without
    diff --git a/drivers/media/video/cx23885/cx23885-i2c.c b/drivers/media/video/cx23885/cx23885-i2c.c
    index 4172cb3..d4746e0 100644
    --- a/drivers/media/video/cx23885/cx23885-i2c.c
    +++ b/drivers/media/video/cx23885/cx23885-i2c.c
    @@ -365,7 +365,17 @@ int cx23885_i2c_register(struct cx23885_i2c *bus)

    memset(&info, 0, sizeof(struct i2c_board_info));
    strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
    - i2c_new_probed_device(&bus->i2c_adap, &info, addr_list);
    + /*
    + * We can't call i2c_new_probed_device() because it uses
    + * quick writes for probing and the IR receiver device only
    + * replies to reads.
    + */
    + if (i2c_smbus_xfer(&bus->i2c_adap, addr_list[0], 0,
    + I2C_SMBUS_READ, 0, I2C_SMBUS_QUICK,
    + NULL) >= 0) {
    + info.addr = addr_list[0];
    + i2c_new_device(&bus->i2c_adap, &info);
    + }
    }

    return bus->i2c_rc;
    diff --git a/drivers/media/video/cx88/cx88-i2c.c b/drivers/media/video/cx88/cx88-i2c.c
    index ee1ca39..fb39f11 100644
    --- a/drivers/media/video/cx88/cx88-i2c.c
    +++ b/drivers/media/video/cx88/cx88-i2c.c
    @@ -188,10 +188,24 @@ int cx88_i2c_init(struct cx88_core *core, struct pci_dev *pci)
    0x18, 0x6b, 0x71,
    I2C_CLIENT_END
    };
    + const unsigned short *addrp;

    memset(&info, 0, sizeof(struct i2c_board_info));
    strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
    - i2c_new_probed_device(&core->i2c_adap, &info, addr_list);
    + /*
    + * We can't call i2c_new_probed_device() because it uses
    + * quick writes for probing and at least some R receiver
    + * devices only reply to reads.
    + */
    + for (addrp = addr_list; *addrp != I2C_CLIENT_END; addrp++) {
    + if (i2c_smbus_xfer(&core->i2c_adap, *addrp, 0,
    + I2C_SMBUS_READ, 0,
    + I2C_SMBUS_QUICK, NULL) >= 0) {
    + info.addr = *addrp;
    + i2c_new_device(&core->i2c_adap, &info);
    + break;
    + }
    + }
    }
    return core->i2c_rc;
    }
    diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
    index 8756be5..450ac70 100644
    --- a/drivers/media/video/uvc/uvc_driver.c
    +++ b/drivers/media/video/uvc/uvc_driver.c
    @@ -58,6 +58,11 @@ static struct uvc_format_desc uvc_fmts[] = {
    .fcc = V4L2_PIX_FMT_YUYV,
    },
    {
    + .name = "YUV 4:2:2 (YUYV)",
    + .guid = UVC_GUID_FORMAT_YUY2_ISIGHT,
    + .fcc = V4L2_PIX_FMT_YUYV,
    + },
    + {
    .name = "YUV 4:2:0 (NV12)",
    .guid = UVC_GUID_FORMAT_NV12,
    .fcc = V4L2_PIX_FMT_NV12,
    @@ -83,11 +88,16 @@ static struct uvc_format_desc uvc_fmts[] = {
    .fcc = V4L2_PIX_FMT_UYVY,
    },
    {
    - .name = "Greyscale",
    + .name = "Greyscale (8-bit)",
    .guid = UVC_GUID_FORMAT_Y800,
    .fcc = V4L2_PIX_FMT_GREY,
    },
    {
    + .name = "Greyscale (16-bit)",
    + .guid = UVC_GUID_FORMAT_Y16,
    + .fcc = V4L2_PIX_FMT_Y16,
    + },
    + {
    .name = "RGB Bayer",
    .guid = UVC_GUID_FORMAT_BY8,
    .fcc = V4L2_PIX_FMT_SBGGR8,
    @@ -2048,6 +2058,15 @@ static struct usb_device_id uvc_ids[] = {
    .bInterfaceSubClass = 1,
    .bInterfaceProtocol = 0,
    .driver_info = UVC_QUIRK_STREAM_NO_FID },
    + /* Syntek (Packard Bell EasyNote MX52 */
    + { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
    + | USB_DEVICE_ID_MATCH_INT_INFO,
    + .idVendor = 0x174f,
    + .idProduct = 0x8a12,
    + .bInterfaceClass = USB_CLASS_VIDEO,
    + .bInterfaceSubClass = 1,
    + .bInterfaceProtocol = 0,
    + .driver_info = UVC_QUIRK_STREAM_NO_FID },
    /* Syntek (Asus F9SG) */
    { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
    | USB_DEVICE_ID_MATCH_INT_INFO,
    @@ -2112,6 +2131,15 @@ static struct usb_device_id uvc_ids[] = {
    .bInterfaceSubClass = 1,
    .bInterfaceProtocol = 0,
    .driver_info = UVC_QUIRK_PROBE_MINMAX },
    + /* Arkmicro unbranded */
    + { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
    + | USB_DEVICE_ID_MATCH_INT_INFO,
    + .idVendor = 0x18ec,
    + .idProduct = 0x3290,
    + .bInterfaceClass = USB_CLASS_VIDEO,
    + .bInterfaceSubClass = 1,
    + .bInterfaceProtocol = 0,
    + .driver_info = UVC_QUIRK_PROBE_DEF },
    /* Bodelin ProScopeHR */
    { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
    | USB_DEVICE_ID_MATCH_DEV_HI
    diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
    index e7958aa..64007b9 100644
    --- a/drivers/media/video/uvc/uvcvideo.h
    +++ b/drivers/media/video/uvc/uvcvideo.h
    @@ -112,6 +112,9 @@ struct uvc_xu_control {
    #define UVC_GUID_FORMAT_YUY2 \
    { 'Y', 'U', 'Y', '2', 0x00, 0x00, 0x10, 0x00, \
    0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
    +#define UVC_GUID_FORMAT_YUY2_ISIGHT \
    + { 'Y', 'U', 'Y', '2', 0x00, 0x00, 0x10, 0x00, \
    + 0x80, 0x00, 0x00, 0x00, 0x00, 0x38, 0x9b, 0x71}
    #define UVC_GUID_FORMAT_NV12 \
    { 'N', 'V', '1', '2', 0x00, 0x00, 0x10, 0x00, \
    0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
    @@ -127,11 +130,13 @@ struct uvc_xu_control {
    #define UVC_GUID_FORMAT_Y800 \
    { 'Y', '8', '0', '0', 0x00, 0x00, 0x10, 0x00, \
    0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
    +#define UVC_GUID_FORMAT_Y16 \
    + { 'Y', '1', '6', ' ', 0x00, 0x00, 0x10, 0x00, \
    + 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
    #define UVC_GUID_FORMAT_BY8 \
    { 'B', 'Y', '8', ' ', 0x00, 0x00, 0x10, 0x00, \
    0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}

    -
    /* ------------------------------------------------------------------------
    * Driver specific constants.
    */
    diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
    index 50997d2..676cd0c 100644
    --- a/drivers/mmc/host/sdhci-s3c.c
    +++ b/drivers/mmc/host/sdhci-s3c.c
    @@ -372,6 +372,26 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)

    static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
    {
    + struct sdhci_host *host = platform_get_drvdata(pdev);
    + struct sdhci_s3c *sc = sdhci_priv(host);
    + int ptr;
    +
    + sdhci_remove_host(host, 1);
    +
    + for (ptr = 0; ptr < 3; ptr++) {
    + clk_disable(sc->clk_bus[ptr]);
    + clk_put(sc->clk_bus[ptr]);
    + }
    + clk_disable(sc->clk_io);
    + clk_put(sc->clk_io);
    +
    + iounmap(host->ioaddr);
    + release_resource(sc->ioarea);
    + kfree(sc->ioarea);
    +
    + sdhci_free_host(host);
    + platform_set_drvdata(pdev, NULL);
    +
    return 0;
    }

    diff --git a/drivers/net/cpmac.c b/drivers/net/cpmac.c
    index 61f9da2..1cace00 100644
    --- a/drivers/net/cpmac.c
    +++ b/drivers/net/cpmac.c
    @@ -1176,7 +1176,8 @@ static int __devinit cpmac_probe(struct platform_device *pdev)
    if (netif_msg_drv(priv))
    printk(KERN_ERR "%s: Could not attach to PHY\n",
    dev->name);
    - return PTR_ERR(priv->phy);
    + rc = PTR_ERR(priv->phy);
    + goto fail;
    }

    if ((rc = register_netdev(dev))) {
    diff --git a/drivers/net/cxgb3/ael1002.c b/drivers/net/cxgb3/ael1002.c
    index 5248f9e..35cd367 100644
    --- a/drivers/net/cxgb3/ael1002.c
    +++ b/drivers/net/cxgb3/ael1002.c
    @@ -934,7 +934,7 @@ static struct cphy_ops xaui_direct_ops = {
    int t3_xaui_direct_phy_prep(struct cphy *phy, struct adapter *adapter,
    int phy_addr, const struct mdio_ops *mdio_ops)
    {
    - cphy_init(phy, adapter, MDIO_PRTAD_NONE, &xaui_direct_ops, mdio_ops,
    + cphy_init(phy, adapter, phy_addr, &xaui_direct_ops, mdio_ops,
    SUPPORTED_10000baseT_Full | SUPPORTED_AUI | SUPPORTED_TP,
    "10GBASE-CX4");
    return 0;
    diff --git a/drivers/net/dm9000.c b/drivers/net/dm9000.c
    index 31b8bef..3f5eb81 100644
    --- a/drivers/net/dm9000.c
    +++ b/drivers/net/dm9000.c
    @@ -471,17 +471,13 @@ static uint32_t dm9000_get_rx_csum(struct net_device *dev)
    return dm->rx_csum;
    }

    -static int dm9000_set_rx_csum(struct net_device *dev, uint32_t data)
    +static int dm9000_set_rx_csum_unlocked(struct net_device *dev, uint32_t data)
    {
    board_info_t *dm = to_dm9000_board(dev);
    - unsigned long flags;

    if (dm->can_csum) {
    dm->rx_csum = data;
    -
    - spin_lock_irqsave(&dm->lock, flags);
    iow(dm, DM9000_RCSR, dm->rx_csum ? RCSR_CSUM : 0);
    - spin_unlock_irqrestore(&dm->lock, flags);

    return 0;
    }
    @@ -489,6 +485,19 @@ static int dm9000_set_rx_csum(struct net_device *dev, uint32_t data)
    return -EOPNOTSUPP;
    }

    +static int dm9000_set_rx_csum(struct net_device *dev, uint32_t data)
    +{
    + board_info_t *dm = to_dm9000_board(dev);
    + unsigned long flags;
    + int ret;
    +
    + spin_lock_irqsave(&dm->lock, flags);
    + ret = dm9000_set_rx_csum_unlocked(dev, data);
    + spin_unlock_irqrestore(&dm->lock, flags);
    +
    + return ret;
    +}
    +
    static int dm9000_set_tx_csum(struct net_device *dev, uint32_t data)
    {
    board_info_t *dm = to_dm9000_board(dev);
    @@ -667,7 +676,7 @@ static unsigned char dm9000_type_to_char(enum dm9000_type type)
    * Set DM9000 multicast address
    */
    static void
    -dm9000_hash_table(struct net_device *dev)
    +dm9000_hash_table_unlocked(struct net_device *dev)
    {
    board_info_t *db = netdev_priv(dev);
    struct dev_mc_list *mcptr = dev->mc_list;
    @@ -676,12 +685,9 @@ dm9000_hash_table(struct net_device *dev)
    u32 hash_val;
    u16 hash_table[4];
    u8 rcr = RCR_DIS_LONG | RCR_DIS_CRC | RCR_RXEN;
    - unsigned long flags;

    dm9000_dbg(db, 1, "entering %s\n", __func__);

    - spin_lock_irqsave(&db->lock, flags);
    -
    for (i = 0, oft = DM9000_PAR; i < 6; i++, oft++)
    iow(db, oft, dev->dev_addr[i]);

    @@ -711,6 +717,16 @@ dm9000_hash_table(struct net_device *dev)
    }

    iow(db, DM9000_RCR, rcr);
    +}
    +
    +static void
    +dm9000_hash_table(struct net_device *dev)
    +{
    + board_info_t *db = netdev_priv(dev);
    + unsigned long flags;
    +
    + spin_lock_irqsave(&db->lock, flags);
    + dm9000_hash_table_unlocked(dev);
    spin_unlock_irqrestore(&db->lock, flags);
    }

    @@ -729,7 +745,7 @@ dm9000_init_dm9000(struct net_device *dev)
    db->io_mode = ior(db, DM9000_ISR) >> 6; /* ISR bit7:6 keeps I/O mode */

    /* Checksum mode */
    - dm9000_set_rx_csum(dev, db->rx_csum);
    + dm9000_set_rx_csum_unlocked(dev, db->rx_csum);

    /* GPIO0 on pre-activate PHY */
    iow(db, DM9000_GPR, 0); /* REG_1F bit0 activate phyxcer */
    @@ -749,7 +765,7 @@ dm9000_init_dm9000(struct net_device *dev)
    iow(db, DM9000_ISR, ISR_CLR_STATUS); /* Clear interrupt status */

    /* Set address filter table */
    - dm9000_hash_table(dev);
    + dm9000_hash_table_unlocked(dev);

    imr = IMR_PAR | IMR_PTM | IMR_PRM;
    if (db->type != TYPE_DM9000E)
    diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
    index 3116601..7cd446d 100644
    --- a/drivers/net/forcedeth.c
    +++ b/drivers/net/forcedeth.c
    @@ -5900,7 +5900,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
    /* Limit the number of tx's outstanding for hw bug */
    if (id->driver_data & DEV_NEED_TX_LIMIT) {
    np->tx_limit = 1;
    - if ((id->driver_data & DEV_NEED_TX_LIMIT2) &&
    + if (((id->driver_data & DEV_NEED_TX_LIMIT2) == DEV_NEED_TX_LIMIT2) &&
    pci_dev->revision >= 0xA2)
    np->tx_limit = 0;
    }
    diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
    index c6d97eb..33352ff 100644
    --- a/drivers/net/igb/e1000_82575.c
    +++ b/drivers/net/igb/e1000_82575.c
    @@ -1168,9 +1168,18 @@ static s32 igb_read_mac_addr_82575(struct e1000_hw *hw)
    {
    s32 ret_val = 0;

    - if (igb_check_alt_mac_addr(hw))
    - ret_val = igb_read_mac_addr(hw);
    + /*
    + * If there's an alternate MAC address place it in RAR0
    + * so that it will override the Si installed default perm
    + * address.
    + */
    + ret_val = igb_check_alt_mac_addr(hw);
    + if (ret_val)
    + goto out;
    +
    + ret_val = igb_read_mac_addr(hw);

    +out:
    return ret_val;
    }

    diff --git a/drivers/net/igb/e1000_hw.h b/drivers/net/igb/e1000_hw.h
    index 1a23aeb..72081df 100644
    --- a/drivers/net/igb/e1000_hw.h
    +++ b/drivers/net/igb/e1000_hw.h
    @@ -53,6 +53,8 @@ struct e1000_hw;

    #define E1000_FUNC_1 1

    +#define E1000_ALT_MAC_ADDRESS_OFFSET_LAN1 3
    +
    enum e1000_mac_type {
    e1000_undefined = 0,
    e1000_82575,
    diff --git a/drivers/net/igb/e1000_mac.c b/drivers/net/igb/e1000_mac.c
    index 7d76bb0..d4fa82c 100644
    --- a/drivers/net/igb/e1000_mac.c
    +++ b/drivers/net/igb/e1000_mac.c
    @@ -185,13 +185,12 @@ s32 igb_check_alt_mac_addr(struct e1000_hw *hw)
    }

    if (nvm_alt_mac_addr_offset == 0xFFFF) {
    - ret_val = -(E1000_NOT_IMPLEMENTED);
    + /* There is no Alternate MAC Address */
    goto out;
    }

    if (hw->bus.func == E1000_FUNC_1)
    - nvm_alt_mac_addr_offset += ETH_ALEN/sizeof(u16);
    -
    + nvm_alt_mac_addr_offset += E1000_ALT_MAC_ADDRESS_OFFSET_LAN1;
    for (i = 0; i < ETH_ALEN; i += 2) {
    offset = nvm_alt_mac_addr_offset + (i >> 1);
    ret_val = hw->nvm.ops.read(hw, offset, 1, &nvm_data);
    @@ -206,14 +205,16 @@ s32 igb_check_alt_mac_addr(struct e1000_hw *hw)

    /* if multicast bit is set, the alternate address will not be used */
    if (alt_mac_addr[0] & 0x01) {
    - ret_val = -(E1000_NOT_IMPLEMENTED);
    + hw_dbg("Ignoring Alternate Mac Address with MC bit set\n");
    goto out;
    }

    - for (i = 0; i < ETH_ALEN; i++)
    - hw->mac.addr[i] = hw->mac.perm_addr[i] = alt_mac_addr[i];
    -
    - hw->mac.ops.rar_set(hw, hw->mac.perm_addr, 0);
    + /*
    + * We have a valid alternate MAC address, and we want to treat it the
    + * same as the normal permanent MAC address stored by the HW into the
    + * RAR. Do this by mapping this address into RAR0.
    + */
    + hw->mac.ops.rar_set(hw, alt_mac_addr, 0);

    out:
    return ret_val;
    diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
    index 77125b5..a17aaee 100644
    --- a/drivers/net/sky2.c
    +++ b/drivers/net/sky2.c
    @@ -704,11 +704,24 @@ static void sky2_phy_power_down(struct sky2_hw *hw, unsigned port)
    sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
    }

    +/* Enable Rx/Tx */
    +static void sky2_enable_rx_tx(struct sky2_port *sky2)
    +{
    + struct sky2_hw *hw = sky2->hw;
    + unsigned port = sky2->port;
    + u16 reg;
    +
    + reg = gma_read16(hw, port, GM_GP_CTRL);
    + reg |= GM_GPCR_RX_ENA | GM_GPCR_TX_ENA;
    + gma_write16(hw, port, GM_GP_CTRL, reg);
    +}
    +
    /* Force a renegotiation */
    static void sky2_phy_reinit(struct sky2_port *sky2)
    {
    spin_lock_bh(&sky2->phy_lock);
    sky2_phy_init(sky2->hw, sky2->port);
    + sky2_enable_rx_tx(sky2);
    spin_unlock_bh(&sky2->phy_lock);
    }

    @@ -1929,7 +1942,6 @@ static void sky2_link_up(struct sky2_port *sky2)
    {
    struct sky2_hw *hw = sky2->hw;
    unsigned port = sky2->port;
    - u16 reg;
    static const char *fc_name[] = {
    [FC_NONE] = "none",
    [FC_TX] = "tx",
    @@ -1937,10 +1949,7 @@ static void sky2_link_up(struct sky2_port *sky2)
    [FC_BOTH] = "both",
    };

    - /* enable Rx/Tx */
    - reg = gma_read16(hw, port, GM_GP_CTRL);
    - reg |= GM_GPCR_RX_ENA | GM_GPCR_TX_ENA;
    - gma_write16(hw, port, GM_GP_CTRL, reg);
    + sky2_enable_rx_tx(sky2);

    gm_phy_write(hw, port, PHY_MARV_INT_MASK, PHY_M_DEF_MSK);

    diff --git a/drivers/net/wireless/ath/ath5k/attach.c b/drivers/net/wireless/ath/ath5k/attach.c
    index 71a1bd25..88663df 100644
    --- a/drivers/net/wireless/ath/ath5k/attach.c
    +++ b/drivers/net/wireless/ath/ath5k/attach.c
    @@ -133,6 +133,7 @@ struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc)
    ah->ah_cw_min = AR5K_TUNE_CWMIN;
    ah->ah_limit_tx_retries = AR5K_INIT_TX_RETRY;
    ah->ah_software_retry = false;
    + ah->ah_current_channel = &sc->channels[0];

    /*
    * Find the mac version
    diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
    index cefbfb9..7ee61d4 100644
    --- a/drivers/net/wireless/ath/ath5k/base.c
    +++ b/drivers/net/wireless/ath/ath5k/base.c
    @@ -1818,11 +1818,6 @@ ath5k_tasklet_rx(unsigned long data)
    return;
    }

    - if (unlikely(rs.rs_more)) {
    - ATH5K_WARN(sc, "unsupported jumbo\n");
    - goto next;
    - }
    -
    if (unlikely(rs.rs_status)) {
    if (rs.rs_status & AR5K_RXERR_PHY)
    goto next;
    @@ -1852,6 +1847,8 @@ ath5k_tasklet_rx(unsigned long data)
    sc->opmode != NL80211_IFTYPE_MONITOR)
    goto next;
    }
    + if (unlikely(rs.rs_more))
    + goto next;
    accept:
    next_skb = ath5k_rx_skb_alloc(sc, &next_skb_addr);

    diff --git a/drivers/net/wireless/ath/ath9k/initvals.h b/drivers/net/wireless/ath/ath9k/initvals.h
    index 8622265..a21c214 100644
    --- a/drivers/net/wireless/ath/ath9k/initvals.h
    +++ b/drivers/net/wireless/ath/ath9k/initvals.h
    @@ -2762,7 +2762,7 @@ static const u32 ar9280Common_9280_2[][2] = {
    { 0x00008258, 0x00000000 },
    { 0x0000825c, 0x400000ff },
    { 0x00008260, 0x00080922 },
    - { 0x00008264, 0xa8a00010 },
    + { 0x00008264, 0x88a00010 },
    { 0x00008270, 0x00000000 },
    { 0x00008274, 0x40000000 },
    { 0x00008278, 0x003e4180 },
    @@ -3935,7 +3935,7 @@ static const u_int32_t ar9285Common_9285[][2] = {
    { 0x00008258, 0x00000000 },
    { 0x0000825c, 0x400000ff },
    { 0x00008260, 0x00080922 },
    - { 0x00008264, 0xa8a00010 },
    + { 0x00008264, 0x88a00010 },
    { 0x00008270, 0x00000000 },
    { 0x00008274, 0x40000000 },
    { 0x00008278, 0x003e4180 },
    @@ -5072,7 +5072,7 @@ static const u_int32_t ar9287Common_9287_1_0[][2] = {
    { 0x00008258, 0x00000000 },
    { 0x0000825c, 0x400000ff },
    { 0x00008260, 0x00080922 },
    - { 0x00008264, 0xa8a00010 },
    + { 0x00008264, 0x88a00010 },
    { 0x00008270, 0x00000000 },
    { 0x00008274, 0x40000000 },
    { 0x00008278, 0x003e4180 },
    @@ -6864,7 +6864,7 @@ static const u_int32_t ar9271Common_9271_1_0[][2] = {
    { 0x00008258, 0x00000000 },
    { 0x0000825c, 0x400000ff },
    { 0x00008260, 0x00080922 },
    - { 0x00008264, 0xa8a00010 },
    + { 0x00008264, 0x88a00010 },
    { 0x00008270, 0x00000000 },
    { 0x00008274, 0x40000000 },
    { 0x00008278, 0x003e4180 },
    diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
    index 087b7e5..0c349ce 100644
    --- a/drivers/net/wireless/ath/ath9k/main.c
    +++ b/drivers/net/wireless/ath/ath9k/main.c
    @@ -1538,6 +1538,8 @@ bad_no_ah:

    void ath_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
    {
    + struct ath_hw *ah = sc->sc_ah;
    +
    hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
    IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
    IEEE80211_HW_SIGNAL_DBM |
    @@ -1558,7 +1560,10 @@ void ath_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
    BIT(NL80211_IFTYPE_ADHOC) |
    BIT(NL80211_IFTYPE_MESH_POINT);

    - hw->wiphy->ps_default = false;
    + if (AR_SREV_5416(ah))
    + hw->wiphy->ps_default = false;
    + else
    + hw->wiphy->ps_default = true;

    hw->queues = 4;
    hw->max_rates = 4;
    diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
    index ad8eab4..b4ff1dc 100644
    --- a/drivers/net/wireless/hostap/hostap_cs.c
    +++ b/drivers/net/wireless/hostap/hostap_cs.c
    @@ -626,6 +626,7 @@ static int prism2_config(struct pcmcia_device *link)
    int ret = 1;
    int last_fn, last_ret;
    struct hostap_cs_priv *hw_priv;
    + unsigned long flags;

    PDEBUG(DEBUG_FLOW, "prism2_config()\n");

    @@ -661,6 +662,12 @@ static int prism2_config(struct pcmcia_device *link)
    link->dev_node = &hw_priv->node;

    /*
    + * Make sure the IRQ handler cannot proceed until at least
    + * dev->base_addr is initialized.
    + */
    + spin_lock_irqsave(&local->irq_init_lock, flags);
    +
    + /*
    * Allocate an interrupt line. Note that this does not assign a
    * handler to the interrupt, unless the 'Handler' member of the
    * irq structure is initialized.
    @@ -686,6 +693,8 @@ static int prism2_config(struct pcmcia_device *link)
    dev->irq = link->irq.AssignedIRQ;
    dev->base_addr = link->io.BasePort1;

    + spin_unlock_irqrestore(&local->irq_init_lock, flags);
    +
    /* Finally, report what we've done */
    printk(KERN_INFO "%s: index 0x%02x: ",
    dev_info, link->conf.ConfigIndex);
    @@ -715,6 +724,7 @@ static int prism2_config(struct pcmcia_device *link)
    return ret;

    cs_failed:
    + spin_unlock_irqrestore(&local->irq_init_lock, flags);
    cs_error(link, last_fn, last_ret);

    failed:
    diff --git a/drivers/net/wireless/hostap/hostap_hw.c b/drivers/net/wireless/hostap/hostap_hw.c
    index ff9b5c8..2f999fc 100644
    --- a/drivers/net/wireless/hostap/hostap_hw.c
    +++ b/drivers/net/wireless/hostap/hostap_hw.c
    @@ -2621,6 +2621,18 @@ static irqreturn_t prism2_interrupt(int irq, void *dev_id)
    iface = netdev_priv(dev);
    local = iface->local;

    + /* Detect early interrupt before driver is fully configued */
    + spin_lock(&local->irq_init_lock);
    + if (!dev->base_addr) {
    + if (net_ratelimit()) {
    + printk(KERN_DEBUG "%s: Interrupt, but dev not configured\n",
    + dev->name);
    + }
    + spin_unlock(&local->irq_init_lock);
    + return IRQ_HANDLED;
    + }
    + spin_unlock(&local->irq_init_lock);
    +
    prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INTERRUPT, 0, 0);

    if (local->func->card_present && !local->func->card_present(local)) {
    @@ -3138,6 +3150,7 @@ prism2_init_local_data(struct prism2_helper_functions *funcs, int card_idx,
    spin_lock_init(&local->cmdlock);
    spin_lock_init(&local->baplock);
    spin_lock_init(&local->lock);
    + spin_lock_init(&local->irq_init_lock);
    mutex_init(&local->rid_bap_mtx);

    if (card_idx < 0 || card_idx >= MAX_PARM_DEVICES)
    diff --git a/drivers/net/wireless/hostap/hostap_wlan.h b/drivers/net/wireless/hostap/hostap_wlan.h
    index 3d23891..1ba33be 100644
    --- a/drivers/net/wireless/hostap/hostap_wlan.h
    +++ b/drivers/net/wireless/hostap/hostap_wlan.h
    @@ -654,7 +654,7 @@ struct local_info {
    rwlock_t iface_lock; /* hostap_interfaces read lock; use write lock
    * when removing entries from the list.
    * TX and RX paths can use read lock. */
    - spinlock_t cmdlock, baplock, lock;
    + spinlock_t cmdlock, baplock, lock, irq_init_lock;
    struct mutex rid_bap_mtx;
    u16 infofid; /* MAC buffer id for info frame */
    /* txfid, intransmitfid, next_txtid, and next_alloc are protected by
    diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
    index 71c0ad4..db2946e 100644
    --- a/drivers/net/wireless/iwlwifi/iwl-scan.c
    +++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
    @@ -799,6 +799,7 @@ void iwl_bg_abort_scan(struct work_struct *work)

    mutex_lock(&priv->mutex);

    + cancel_delayed_work_sync(&priv->scan_check);
    set_bit(STATUS_SCAN_ABORTING, &priv->status);
    iwl_send_scan_abort(priv);

    diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
    index 7f15b7e..d21c06e 100644
    --- a/drivers/net/wireless/iwlwifi/iwl-tx.c
    +++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
    @@ -1479,6 +1479,11 @@ void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
    sta_id = ba_resp->sta_id;
    tid = ba_resp->tid;
    agg = &priv->stations[sta_id].tid[tid].agg;
    + if (unlikely(agg->txq_id != scd_flow)) {
    + IWL_ERR(priv, "BA scd_flow %d does not match txq_id %d\n",
    + scd_flow, agg->txq_id);
    + return;
    + }

    /* Find index just before block-ack window */
    index = iwl_queue_dec_wrap(ba_resp_scd_ssn & 0xff, txq->q.n_bd);
    diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
    index 485a8d4..f876d02 100644
    --- a/drivers/net/wireless/libertas/if_sdio.c
    +++ b/drivers/net/wireless/libertas/if_sdio.c
    @@ -34,6 +34,8 @@
    #include <linux/mmc/card.h>
    #include <linux/mmc/sdio_func.h>
    #include <linux/mmc/sdio_ids.h>
    +#include <linux/mmc/sdio.h>
    +#include <linux/mmc/host.h>

    #include "host.h"
    #include "decl.h"
    @@ -883,6 +885,7 @@ static int if_sdio_probe(struct sdio_func *func,
    int ret, i;
    unsigned int model;
    struct if_sdio_packet *packet;
    + struct mmc_host *host = func->card->host;

    lbs_deb_enter(LBS_DEB_SDIO);

    @@ -963,6 +966,25 @@ static int if_sdio_probe(struct sdio_func *func,
    if (ret)
    goto disable;

    + /* For 1-bit transfers to the 8686 model, we need to enable the
    + * interrupt flag in the CCCR register. Set the MMC_QUIRK_LENIENT_FN0
    + * bit to allow access to non-vendor registers. */
    + if ((card->model == IF_SDIO_MODEL_8686) &&
    + (host->caps & MMC_CAP_SDIO_IRQ) &&
    + (host->ios.bus_width == MMC_BUS_WIDTH_1)) {
    + u8 reg;
    +
    + func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
    + reg = sdio_f0_readb(func, SDIO_CCCR_IF, &ret);
    + if (ret)
    + goto release_int;
    +
    + reg |= SDIO_BUS_ECSI;
    + sdio_f0_writeb(func, reg, SDIO_CCCR_IF, &ret);
    + if (ret)
    + goto release_int;
    + }
    +
    card->ioport = sdio_readb(func, IF_SDIO_IOPORT, &ret);
    if (ret)
    goto release_int;
    diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
    index 7bafa83..3df13f5 100644
    --- a/drivers/net/wireless/p54/p54pci.c
    +++ b/drivers/net/wireless/p54/p54pci.c
    @@ -40,6 +40,8 @@ static struct pci_device_id p54p_table[] __devinitdata = {
    { PCI_DEVICE(0x1260, 0x3877) },
    /* Intersil PRISM Javelin/Xbow Wireless LAN adapter */
    { PCI_DEVICE(0x1260, 0x3886) },
    + /* Intersil PRISM Xbow Wireless LAN adapter (Symbol AP-300) */
    + { PCI_DEVICE(0x1260, 0xffff) },
    { },
    };

    diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
    index 595d03a..812d4ac 100644
    --- a/drivers/pci/pci.c
    +++ b/drivers/pci/pci.c
    @@ -2046,6 +2046,7 @@ void pci_msi_off(struct pci_dev *dev)
    pci_write_config_word(dev, pos + PCI_MSIX_FLAGS, control);
    }
    }
    +EXPORT_SYMBOL_GPL(pci_msi_off);

    #ifndef HAVE_ARCH_PCI_SET_DMA_MASK
    /*
    diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
    index 329093e..c533b1c 100644
    --- a/drivers/platform/x86/eeepc-laptop.c
    +++ b/drivers/platform/x86/eeepc-laptop.c
    @@ -752,6 +752,8 @@ static void eeepc_rfkill_hotplug(void)
    struct pci_dev *dev;
    struct pci_bus *bus;
    bool blocked = eeepc_wlan_rfkill_blocked();
    + bool absent;
    + u32 l;

    if (ehotk->wlan_rfkill)
    rfkill_set_sw_state(ehotk->wlan_rfkill, blocked);
    @@ -765,6 +767,22 @@ static void eeepc_rfkill_hotplug(void)
    goto out_unlock;
    }

    + if (pci_bus_read_config_dword(bus, 0, PCI_VENDOR_ID, &l)) {
    + pr_err("Unable to read PCI config space?\n");
    + goto out_unlock;
    + }
    + absent = (l == 0xffffffff);
    +
    + if (blocked != absent) {
    + pr_warning("BIOS says wireless lan is %s, "
    + "but the pci device is %s\n",
    + blocked ? "blocked" : "unblocked",
    + absent ? "absent" : "present");
    + pr_warning("skipped wireless hotplug as probably "
    + "inappropriate for this model\n");
    + goto out_unlock;
    + }
    +
    if (!blocked) {
    dev = pci_get_slot(bus, 0);
    if (dev) {
    diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
    index eb99ee4..861d91d 100644
    --- a/drivers/rtc/rtc-ds1307.c
    +++ b/drivers/rtc/rtc-ds1307.c
    @@ -775,7 +775,7 @@ static int __devinit ds1307_probe(struct i2c_client *client,

    read_rtc:
    /* read RTC registers */
    - tmp = ds1307->read_block_data(ds1307->client, 0, 8, buf);
    + tmp = ds1307->read_block_data(ds1307->client, ds1307->offset, 8, buf);
    if (tmp != 8) {
    pr_debug("read error %d\n", tmp);
    err = -EIO;
    @@ -860,7 +860,7 @@ read_rtc:
    if (ds1307->regs[DS1307_REG_HOUR] & DS1307_BIT_PM)
    tmp += 12;
    i2c_smbus_write_byte_data(client,
    - DS1307_REG_HOUR,
    + ds1307->offset + DS1307_REG_HOUR,
    bin2bcd(tmp));
    }

    diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
    index 0391d75..a5b8e7b 100644
    --- a/drivers/scsi/aacraid/commctrl.c
    +++ b/drivers/scsi/aacraid/commctrl.c
    @@ -655,9 +655,9 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
    /* Does this really need to be GFP_DMA? */
    p = kmalloc(usg->sg[i].count,GFP_KERNEL|__GFP_DMA);
    if(!p) {
    - kfree (usg);
    - dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
    + dprintk((KERN_DEBUG "aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
    usg->sg[i].count,i,usg->count));
    + kfree(usg);
    rcode = -ENOMEM;
    goto cleanup;
    }
    diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
    index 300cea7..7feb902 100644
    --- a/drivers/serial/cpm_uart/cpm_uart_core.c
    +++ b/drivers/serial/cpm_uart/cpm_uart_core.c
    @@ -930,6 +930,83 @@ static void cpm_uart_config_port(struct uart_port *port, int flags)
    }
    }

    +#if defined(CONFIG_CONSOLE_POLL) || defined(CONFIG_SERIAL_CPM_CONSOLE)
    +/*
    + * Write a string to the serial port
    + * Note that this is called with interrupts already disabled
    + */
    +static void cpm_uart_early_write(struct uart_cpm_port *pinfo,
    + const char *string, u_int count)
    +{
    + unsigned int i;
    + cbd_t __iomem *bdp, *bdbase;
    + unsigned char *cpm_outp_addr;
    +
    + /* Get the address of the host memory buffer.
    + */
    + bdp = pinfo->tx_cur;
    + bdbase = pinfo->tx_bd_base;
    +
    + /*
    + * Now, do each character. This is not as bad as it looks
    + * since this is a holding FIFO and not a transmitting FIFO.
    + * We could add the complexity of filling the entire transmit
    + * buffer, but we would just wait longer between accesses......
    + */
    + for (i = 0; i < count; i++, string++) {
    + /* Wait for transmitter fifo to empty.
    + * Ready indicates output is ready, and xmt is doing
    + * that, not that it is ready for us to send.
    + */
    + while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
    + ;
    +
    + /* Send the character out.
    + * If the buffer address is in the CPM DPRAM, don't
    + * convert it.
    + */
    + cpm_outp_addr = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr),
    + pinfo);
    + *cpm_outp_addr = *string;
    +
    + out_be16(&bdp->cbd_datlen, 1);
    + setbits16(&bdp->cbd_sc, BD_SC_READY);
    +
    + if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
    + bdp = bdbase;
    + else
    + bdp++;
    +
    + /* if a LF, also do CR... */
    + if (*string == 10) {
    + while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
    + ;
    +
    + cpm_outp_addr = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr),
    + pinfo);
    + *cpm_outp_addr = 13;
    +
    + out_be16(&bdp->cbd_datlen, 1);
    + setbits16(&bdp->cbd_sc, BD_SC_READY);
    +
    + if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
    + bdp = bdbase;
    + else
    + bdp++;
    + }
    + }
    +
    + /*
    + * Finally, Wait for transmitter & holding register to empty
    + * and restore the IER
    + */
    + while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
    + ;
    +
    + pinfo->tx_cur = bdp;
    +}
    +#endif
    +
    #ifdef CONFIG_CONSOLE_POLL
    /* Serial polling routines for writing and reading from the uart while
    * in an interrupt or debug context.
    @@ -999,7 +1076,7 @@ static void cpm_put_poll_char(struct uart_port *port,
    static char ch[2];

    ch[0] = (char)c;
    - cpm_uart_early_write(pinfo->port.line, ch, 1);
    + cpm_uart_early_write(pinfo, ch, 1);
    }
    #endif /* CONFIG_CONSOLE_POLL */

    @@ -1130,9 +1207,6 @@ static void cpm_uart_console_write(struct console *co, const char *s,
    u_int count)
    {
    struct uart_cpm_port *pinfo = &cpm_uart_ports[co->index];
    - unsigned int i;
    - cbd_t __iomem *bdp, *bdbase;
    - unsigned char *cp;
    unsigned long flags;
    int nolock = oops_in_progress;

    @@ -1142,66 +1216,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
    spin_lock_irqsave(&pinfo->port.lock, flags);
    }

    - /* Get the address of the host memory buffer.
    - */
    - bdp = pinfo->tx_cur;
    - bdbase = pinfo->tx_bd_base;
    -
    - /*
    - * Now, do each character. This is not as bad as it looks
    - * since this is a holding FIFO and not a transmitting FIFO.
    - * We could add the complexity of filling the entire transmit
    - * buffer, but we would just wait longer between accesses......
    - */
    - for (i = 0; i < count; i++, s++) {
    - /* Wait for transmitter fifo to empty.
    - * Ready indicates output is ready, and xmt is doing
    - * that, not that it is ready for us to send.
    - */
    - while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
    - ;
    -
    - /* Send the character out.
    - * If the buffer address is in the CPM DPRAM, don't
    - * convert it.
    - */
    - cp = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), pinfo);
    - *cp = *s;
    -
    - out_be16(&bdp->cbd_datlen, 1);
    - setbits16(&bdp->cbd_sc, BD_SC_READY);
    -
    - if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
    - bdp = bdbase;
    - else
    - bdp++;
    -
    - /* if a LF, also do CR... */
    - if (*s == 10) {
    - while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
    - ;
    -
    - cp = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), pinfo);
    - *cp = 13;
    -
    - out_be16(&bdp->cbd_datlen, 1);
    - setbits16(&bdp->cbd_sc, BD_SC_READY);
    -
    - if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
    - bdp = bdbase;
    - else
    - bdp++;
    - }
    - }
    -
    - /*
    - * Finally, Wait for transmitter & holding register to empty
    - * and restore the IER
    - */
    - while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
    - ;
    -
    - pinfo->tx_cur = bdp;
    + cpm_uart_early_write(pinfo, s, count);

    if (unlikely(nolock)) {
    local_irq_restore(flags);
    diff --git a/drivers/ssb/driver_chipcommon.c b/drivers/ssb/driver_chipcommon.c
    index 9681536..bbf1cb2 100644
    --- a/drivers/ssb/driver_chipcommon.c
    +++ b/drivers/ssb/driver_chipcommon.c
    @@ -233,6 +233,9 @@ void ssb_chipcommon_init(struct ssb_chipcommon *cc)
    {
    if (!cc->dev)
    return; /* We don't have a ChipCommon */
    + if (cc->dev->id.revision >= 11)
    + cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT);
    + ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status);
    ssb_pmu_init(cc);
    chipco_powercontrol_init(cc);
    ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST);
    diff --git a/drivers/ssb/driver_chipcommon_pmu.c b/drivers/ssb/driver_chipcommon_pmu.c
    index 64abd11..8e194d5 100644
    --- a/drivers/ssb/driver_chipcommon_pmu.c
    +++ b/drivers/ssb/driver_chipcommon_pmu.c
    @@ -495,9 +495,9 @@ static void ssb_pmu_resources_init(struct ssb_chipcommon *cc)
    chipco_write32(cc, SSB_CHIPCO_PMU_MAXRES_MSK, max_msk);
    }

    +/* http://bcm-v4.sipsolutions.net/802.11/SSB/PmuInit */
    void ssb_pmu_init(struct ssb_chipcommon *cc)
    {
    - struct ssb_bus *bus = cc->dev->bus;
    u32 pmucap;

    if (!(cc->capabilities & SSB_CHIPCO_CAP_PMU))
    @@ -509,15 +509,12 @@ void ssb_pmu_init(struct ssb_chipcommon *cc)
    ssb_dprintk(KERN_DEBUG PFX "Found rev %u PMU (capabilities 0x%08X)\n",
    cc->pmu.rev, pmucap);

    - if (cc->pmu.rev >= 1) {
    - if ((bus->chip_id == 0x4325) && (bus->chip_rev < 2)) {
    - chipco_mask32(cc, SSB_CHIPCO_PMU_CTL,
    - ~SSB_CHIPCO_PMU_CTL_NOILPONW);
    - } else {
    - chipco_set32(cc, SSB_CHIPCO_PMU_CTL,
    - SSB_CHIPCO_PMU_CTL_NOILPONW);
    - }
    - }
    + if (cc->pmu.rev == 1)
    + chipco_mask32(cc, SSB_CHIPCO_PMU_CTL,
    + ~SSB_CHIPCO_PMU_CTL_NOILPONW);
    + else
    + chipco_set32(cc, SSB_CHIPCO_PMU_CTL,
    + SSB_CHIPCO_PMU_CTL_NOILPONW);
    ssb_pmu_pll_init(cc);
    ssb_pmu_resources_init(cc);
    }
    diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
    index 9e50896..17a1781 100644
    --- a/drivers/ssb/pci.c
    +++ b/drivers/ssb/pci.c
    @@ -22,6 +22,7 @@

    #include "ssb_private.h"

    +bool ssb_is_sprom_available(struct ssb_bus *bus);

    /* Define the following to 1 to enable a printk on each coreswitch. */
    #define SSB_VERBOSE_PCICORESWITCH_DEBUG 0
    @@ -167,7 +168,7 @@ err_pci:
    }

    /* Get the word-offset for a SSB_SPROM_XXX define. */
    -#define SPOFF(offset) (((offset) - SSB_SPROM_BASE) / sizeof(u16))
    +#define SPOFF(offset) ((offset) / sizeof(u16))
    /* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */
    #define SPEX16(_outvar, _offset, _mask, _shift) \
    out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
    @@ -252,8 +253,13 @@ static int sprom_do_read(struct ssb_bus *bus, u16 *sprom)
    {
    int i;

    + /* Check if SPROM can be read */
    + if (ioread16(bus->mmio + bus->sprom_offset) == 0xFFFF) {
    + ssb_printk(KERN_ERR PFX "Unable to read SPROM\n");
    + return -ENODEV;
    + }
    for (i = 0; i < bus->sprom_size; i++)
    - sprom[i] = ioread16(bus->mmio + SSB_SPROM_BASE + (i * 2));
    + sprom[i] = ioread16(bus->mmio + bus->sprom_offset + (i * 2));

    return 0;
    }
    @@ -284,7 +290,7 @@ static int sprom_do_write(struct ssb_bus *bus, const u16 *sprom)
    ssb_printk("75%%");
    else if (i % 2)
    ssb_printk(".");
    - writew(sprom[i], bus->mmio + SSB_SPROM_BASE + (i * 2));
    + writew(sprom[i], bus->mmio + bus->sprom_offset + (i * 2));
    mmiowb();
    msleep(20);
    }
    @@ -620,21 +626,49 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
    int err = -ENOMEM;
    u16 *buf;

    + if (!ssb_is_sprom_available(bus)) {
    + ssb_printk(KERN_ERR PFX "No SPROM available!\n");
    + return -ENODEV;
    + }
    + if (bus->chipco.dev) { /* can be unavailible! */
    + /*
    + * get SPROM offset: SSB_SPROM_BASE1 except for
    + * chipcommon rev >= 31 or chip ID is 0x4312 and
    + * chipcommon status & 3 == 2
    + */
    + if (bus->chipco.dev->id.revision >= 31)
    + bus->sprom_offset = SSB_SPROM_BASE31;
    + else if (bus->chip_id == 0x4312 &&
    + (bus->chipco.status & 0x03) == 2)
    + bus->sprom_offset = SSB_SPROM_BASE31;
    + else
    + bus->sprom_offset = SSB_SPROM_BASE1;
    + } else {
    + bus->sprom_offset = SSB_SPROM_BASE1;
    + }
    + ssb_dprintk(KERN_INFO PFX "SPROM offset is 0x%x\n", bus->sprom_offset);
    +
    buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
    if (!buf)
    goto out;
    bus->sprom_size = SSB_SPROMSIZE_WORDS_R123;
    - sprom_do_read(bus, buf);
    + err = sprom_do_read(bus, buf);
    + if (err)
    + goto out_free;
    err = sprom_check_crc(buf, bus->sprom_size);
    if (err) {
    /* try for a 440 byte SPROM - revision 4 and higher */
    kfree(buf);
    buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
    GFP_KERNEL);
    - if (!buf)
    + if (!buf) {
    + err = -ENOMEM;
    goto out;
    + }
    bus->sprom_size = SSB_SPROMSIZE_WORDS_R4;
    - sprom_do_read(bus, buf);
    + err = sprom_do_read(bus, buf);
    + if (err)
    + goto out_free;
    err = sprom_check_crc(buf, bus->sprom_size);
    if (err) {
    /* All CRC attempts failed.
    diff --git a/drivers/ssb/sprom.c b/drivers/ssb/sprom.c
    index eb70843..5f7154d 100644
    --- a/drivers/ssb/sprom.c
    +++ b/drivers/ssb/sprom.c
    @@ -179,3 +179,18 @@ const struct ssb_sprom *ssb_get_fallback_sprom(void)
    {
    return fallback_sprom;
    }
    +
    +/* http://bcm-v4.sipsolutions.net/802.11/IsSpromAvailable */
    +bool ssb_is_sprom_available(struct ssb_bus *bus)
    +{
    + /* status register only exists on chipcomon rev >= 11 and we need check
    + for >= 31 only */
    + /* this routine differs from specs as we do not access SPROM directly
    + on PCMCIA */
    + if (bus->bustype == SSB_BUSTYPE_PCI &&
    + bus->chipco.dev && /* can be unavailible! */
    + bus->chipco.dev->id.revision >= 31)
    + return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM;
    +
    + return true;
    +}
    diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
    index 88644ef..6d52d6a 100644
    --- a/drivers/staging/rtl8192su/r8192U_core.c
    +++ b/drivers/staging/rtl8192su/r8192U_core.c
    @@ -112,12 +112,14 @@ u32 rt_global_debug_component = \

    static struct usb_device_id rtl8192_usb_id_tbl[] = {
    /* Realtek */
    + {USB_DEVICE(0x0bda, 0x8171)},
    {USB_DEVICE(0x0bda, 0x8192)},
    {USB_DEVICE(0x0bda, 0x8709)},
    /* Corega */
    {USB_DEVICE(0x07aa, 0x0043)},
    /* Belkin */
    {USB_DEVICE(0x050d, 0x805E)},
    + {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */
    /* Sitecom */
    {USB_DEVICE(0x0df6, 0x0031)},
    {USB_DEVICE(0x0df6, 0x004b)}, /* WL-349 */
    @@ -127,6 +129,8 @@ static struct usb_device_id rtl8192_usb_id_tbl[] = {
    {USB_DEVICE(0x2001, 0x3301)},
    /* Zinwell */
    {USB_DEVICE(0x5a57, 0x0290)},
    + /* Guillemot */
    + {USB_DEVICE(0x06f8, 0xe031)},
    //92SU
    {USB_DEVICE(0x0bda, 0x8172)},
    {}
    diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
    index 34fc7bb..d784a8b 100644
    --- a/drivers/usb/core/driver.c
    +++ b/drivers/usb/core/driver.c
    @@ -1743,9 +1743,6 @@ int usb_external_resume_device(struct usb_device *udev, pm_message_t msg)

    static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
    {
    - int w, i;
    - struct usb_interface *intf;
    -
    /* Remote wakeup is needed only when we actually go to sleep.
    * For things like FREEZE and QUIESCE, if the device is already
    * autosuspended then its current wakeup setting is okay.
    @@ -1755,18 +1752,10 @@ static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
    return;
    }

    - /* If remote wakeup is permitted, see whether any interface drivers
    + /* Allow remote wakeup if it is enabled, even if no interface drivers
    * actually want it.
    */
    - w = 0;
    - if (device_may_wakeup(&udev->dev) && udev->actconfig) {
    - for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
    - intf = udev->actconfig->interface[i];
    - w |= intf->needs_remote_wakeup;
    - }
    - }
    -
    - udev->do_remote_wakeup = w;
    + udev->do_remote_wakeup = device_may_wakeup(&udev->dev);
    }

    int usb_suspend(struct device *dev, pm_message_t msg)
    diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    index ab93918..a61f160 100644
    --- a/drivers/usb/core/quirks.c
    +++ b/drivers/usb/core/quirks.c
    @@ -41,6 +41,10 @@ static const struct usb_device_id usb_quirk_list[] = {
    /* Philips PSC805 audio device */
    { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },

    + /* Artisman Watchdog Dongle */
    + { USB_DEVICE(0x04b4, 0x0526), .driver_info =
    + USB_QUIRK_CONFIG_INTF_STRINGS },
    +
    /* Roland SC-8820 */
    { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },

    @@ -64,6 +68,9 @@ static const struct usb_device_id usb_quirk_list[] = {
    /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
    { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },

    + /* Broadcom BCM92035DGROM BT dongle */
    + { USB_DEVICE(0x0a5c, 0x2021), .driver_info = USB_QUIRK_RESET_RESUME },
    +
    /* Action Semiconductor flash disk */
    { USB_DEVICE(0x10d6, 0x2200), .driver_info =
    USB_QUIRK_STRING_FETCH_255 },
    diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
    index adf8260..9e5f9f1 100644
    --- a/drivers/usb/gadget/u_serial.c
    +++ b/drivers/usb/gadget/u_serial.c
    @@ -535,17 +535,11 @@ recycle:
    list_move(&req->list, &port->read_pool);
    }

    - /* Push from tty to ldisc; this is immediate with low_latency, and
    - * may trigger callbacks to this driver ... so drop the spinlock.
    + /* Push from tty to ldisc; without low_latency set this is handled by
    + * a workqueue, so we won't get callbacks and can hold port_lock
    */
    if (tty && do_push) {
    - spin_unlock_irq(&port->port_lock);
    tty_flip_buffer_push(tty);
    - wake_up_interruptible(&tty->read_wait);
    - spin_lock_irq(&port->port_lock);
    -
    - /* tty may have been closed */
    - tty = port->port_tty;
    }


    @@ -783,11 +777,6 @@ static int gs_open(struct tty_struct *tty, struct file *file)
    port->open_count = 1;
    port->openclose = false;

    - /* low_latency means ldiscs work in tasklet context, without
    - * needing a workqueue schedule ... easier to keep up.
    - */
    - tty->low_latency = 1;
    -
    /* if connected, start the I/O stream */
    if (port->port_usb) {
    struct gserial *gser = port->port_usb;
    @@ -1194,6 +1183,7 @@ void gserial_cleanup(void)
    n_ports = 0;

    tty_unregister_driver(gs_tty_driver);
    + put_tty_driver(gs_tty_driver);
    gs_tty_driver = NULL;

    pr_debug("%s: cleaned up ttyGS* support\n", __func__);
    diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
    index 8b37a4b..be41ec3 100644
    --- a/drivers/usb/misc/sisusbvga/sisusb.c
    +++ b/drivers/usb/misc/sisusbvga/sisusb.c
    @@ -2435,7 +2435,8 @@ sisusb_open(struct inode *inode, struct file *file)
    }

    if (!sisusb->devinit) {
    - if (sisusb->sisusb_dev->speed == USB_SPEED_HIGH) {
    + if (sisusb->sisusb_dev->speed == USB_SPEED_HIGH ||
    + sisusb->sisusb_dev->speed == USB_SPEED_SUPER) {
    if (sisusb_init_gfxdevice(sisusb, 0)) {
    mutex_unlock(&sisusb->lock);
    dev_err(&sisusb->sisusb_dev->dev, "Failed to initialize device\n");
    @@ -3167,7 +3168,7 @@ static int sisusb_probe(struct usb_interface *intf,

    sisusb->present = 1;

    - if (dev->speed == USB_SPEED_HIGH) {
    + if (dev->speed == USB_SPEED_HIGH || dev->speed == USB_SPEED_SUPER) {
    int initscreen = 1;
    #ifdef INCL_SISUSB_CON
    if (sisusb_first_vc > 0 &&
    diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    index bf56be1..8de8572 100644
    --- a/drivers/usb/serial/ftdi_sio.c
    +++ b/drivers/usb/serial/ftdi_sio.c
    @@ -697,6 +697,7 @@ static struct usb_device_id id_table_combined [] = {
    { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
    .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
    { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
    + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
    { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
    { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
    { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
    @@ -743,6 +744,14 @@ static struct usb_device_id id_table_combined [] = {
    { USB_DEVICE(FTDI_VID, MJSG_SR_RADIO_PID) },
    { USB_DEVICE(FTDI_VID, MJSG_HD_RADIO_PID) },
    { USB_DEVICE(FTDI_VID, MJSG_XM_RADIO_PID) },
    + { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_ST_PID),
    + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    + { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SLITE_PID),
    + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    + { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH2_PID),
    + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    + { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH4_PID),
    + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    { }, /* Optional parameter entry */
    { } /* Terminating entry */
    };
    diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
    index 8f9e805..ffdcec7 100644
    --- a/drivers/usb/serial/ftdi_sio_ids.h
    +++ b/drivers/usb/serial/ftdi_sio_ids.h
    @@ -703,6 +703,12 @@
    #define TELLDUS_TELLSTICK_PID 0x0C30 /* RF control dongle 433 MHz using FT232RL */

    /*
    + * RT Systems programming cables for various ham radios
    + */
    +#define RTSYSTEMS_VID 0x2100 /* Vendor ID */
    +#define RTSYSTEMS_SERIAL_VX7_PID 0x9e52 /* Serial converter for VX-7 Radios using FT232RL */
    +
    +/*
    * Bayer Ascensia Contour blood glucose meter USB-converter cable.
    * http://winglucofacts.com/cables/
    */
    @@ -1024,3 +1030,12 @@
    #define MJSG_SR_RADIO_PID 0x9379
    #define MJSG_XM_RADIO_PID 0x937A
    #define MJSG_HD_RADIO_PID 0x937C
    +
    +/*
    + * Xverve Signalyzer tools (http://www.signalyzer.com/)
    + */
    +#define XVERVE_SIGNALYZER_ST_PID 0xBCA0
    +#define XVERVE_SIGNALYZER_SLITE_PID 0xBCA1
    +#define XVERVE_SIGNALYZER_SH2_PID 0xBCA2
    +#define XVERVE_SIGNALYZER_SH4_PID 0xBCA4
    +
    diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    index fac0732..2586023 100644
    --- a/drivers/usb/serial/option.c
    +++ b/drivers/usb/serial/option.c
    @@ -226,6 +226,7 @@ static int option_resume(struct usb_serial *serial);
    #define AMOI_PRODUCT_H01 0x0800
    #define AMOI_PRODUCT_H01A 0x7002
    #define AMOI_PRODUCT_H02 0x0802
    +#define AMOI_PRODUCT_SKYPEPHONE_S2 0x0407

    #define DELL_VENDOR_ID 0x413C

    @@ -316,6 +317,7 @@ static int option_resume(struct usb_serial *serial);
    #define QISDA_PRODUCT_H21_4512 0x4512
    #define QISDA_PRODUCT_H21_4523 0x4523
    #define QISDA_PRODUCT_H20_4515 0x4515
    +#define QISDA_PRODUCT_H20_4518 0x4518
    #define QISDA_PRODUCT_H20_4519 0x4519

    /* TLAYTECH PRODUCTS */
    @@ -503,6 +505,7 @@ static struct usb_device_id option_ids[] = {
    { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
    { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
    { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H02) },
    + { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_SKYPEPHONE_S2) },

    { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_MINICARD) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite EV620 CDMA/EV-DO */
    { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5500_MINICARD) }, /* Dell Wireless 5500 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
    @@ -836,6 +839,7 @@ static struct usb_device_id option_ids[] = {
    { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4512) },
    { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4523) },
    { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4515) },
    + { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4518) },
    { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4519) },
    { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) },
    { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */
    diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
    index 54f8494..328578b 100644
    --- a/drivers/usb/serial/sierra.c
    +++ b/drivers/usb/serial/sierra.c
    @@ -210,6 +210,7 @@ static struct usb_device_id id_table [] = {
    { USB_DEVICE(0x1199, 0x0021) }, /* Sierra Wireless AirCard 597E */
    { USB_DEVICE(0x1199, 0x0112) }, /* Sierra Wireless AirCard 580 */
    { USB_DEVICE(0x1199, 0x0120) }, /* Sierra Wireless USB Dongle 595U */
    + { USB_DEVICE(0x1199, 0x0301) }, /* Sierra Wireless USB Dongle 250U */
    /* Sierra Wireless C597 */
    { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x0023, 0xFF, 0xFF, 0xFF) },
    /* Sierra Wireless T598 */
    diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
    index 7127bfe..d43859f 100644
    --- a/drivers/virtio/virtio_pci.c
    +++ b/drivers/virtio/virtio_pci.c
    @@ -635,6 +635,9 @@ static int __devinit virtio_pci_probe(struct pci_dev *pci_dev,
    INIT_LIST_HEAD(&vp_dev->virtqueues);
    spin_lock_init(&vp_dev->lock);

    + /* Disable MSI/MSIX to bring device to a known good state. */
    + pci_msi_off(pci_dev);
    +
    /* enable the device */
    err = pci_enable_device(pci_dev);
    if (err)
    diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
    index 64f6b2f..b9840fa 100644
    --- a/fs/btrfs/ioctl.c
    +++ b/fs/btrfs/ioctl.c
    @@ -947,7 +947,7 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
    */

    /* the destination must be opened for writing */
    - if (!(file->f_mode & FMODE_WRITE))
    + if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND))
    return -EINVAL;

    ret = mnt_want_write(file->f_path.mnt);
    @@ -1000,7 +1000,7 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,

    /* determine range to clone */
    ret = -EINVAL;
    - if (off >= src->i_size || off + len > src->i_size)
    + if (off + len > src->i_size || off + len < off)
    goto out_unlock;
    if (len == 0)
    olen = len = src->i_size - off;
    diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
    index 29f1da7..1445407 100644
    --- a/fs/cifs/cifsfs.c
    +++ b/fs/cifs/cifsfs.c
    @@ -1033,7 +1033,7 @@ init_cifs(void)
    goto out_unregister_filesystem;
    #endif
    #ifdef CONFIG_CIFS_DFS_UPCALL
    - rc = register_key_type(&key_type_dns_resolver);
    + rc = cifs_init_dns_resolver();
    if (rc)
    goto out_unregister_key_type;
    #endif
    @@ -1045,7 +1045,7 @@ init_cifs(void)

    out_unregister_resolver_key:
    #ifdef CONFIG_CIFS_DFS_UPCALL
    - unregister_key_type(&key_type_dns_resolver);
    + cifs_exit_dns_resolver();
    out_unregister_key_type:
    #endif
    #ifdef CONFIG_CIFS_UPCALL
    @@ -1071,7 +1071,7 @@ exit_cifs(void)
    cifs_proc_clean();
    #ifdef CONFIG_CIFS_DFS_UPCALL
    cifs_dfs_release_automount_timer();
    - unregister_key_type(&key_type_dns_resolver);
    + cifs_exit_dns_resolver();
    #endif
    #ifdef CONFIG_CIFS_UPCALL
    unregister_key_type(&cifs_spnego_key_type);
    diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
    index 8794814..16f31c1 100644
    --- a/fs/cifs/dns_resolve.c
    +++ b/fs/cifs/dns_resolve.c
    @@ -23,12 +23,16 @@
    * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
    */

    +#include <linux/keyctl.h>
    +#include <linux/key-type.h>
    #include <keys/user-type.h>
    #include "dns_resolve.h"
    #include "cifsglob.h"
    #include "cifsproto.h"
    #include "cifs_debug.h"

    +static const struct cred *dns_resolver_cache;
    +
    /* Checks if supplied name is IP address
    * returns:
    * 1 - name is IP
    @@ -93,6 +97,7 @@ struct key_type key_type_dns_resolver = {
    int
    dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
    {
    + const struct cred *saved_cred;
    int rc = -EAGAIN;
    struct key *rkey = ERR_PTR(-EAGAIN);
    char *name;
    @@ -132,8 +137,15 @@ dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
    goto skip_upcall;
    }

    + saved_cred = override_creds(dns_resolver_cache);
    rkey = request_key(&key_type_dns_resolver, name, "");
    + revert_creds(saved_cred);
    if (!IS_ERR(rkey)) {
    + if (!(rkey->perm & KEY_USR_VIEW)) {
    + down_read(&rkey->sem);
    + rkey->perm |= KEY_USR_VIEW;
    + up_read(&rkey->sem);
    + }
    len = rkey->type_data.x[0];
    data = rkey->payload.data;
    } else {
    @@ -164,4 +176,61 @@ out:
    return rc;
    }

    +int __init cifs_init_dns_resolver(void)
    +{
    + struct cred *cred;
    + struct key *keyring;
    + int ret;
    +
    + printk(KERN_NOTICE "Registering the %s key type\n",
    + key_type_dns_resolver.name);
    +
    + /* create an override credential set with a special thread keyring in
    + * which DNS requests are cached
    + *
    + * this is used to prevent malicious redirections from being installed
    + * with add_key().
    + */
    + cred = prepare_kernel_cred(NULL);
    + if (!cred)
    + return -ENOMEM;
    +
    + keyring = key_alloc(&key_type_keyring, ".dns_resolver", 0, 0, cred,
    + (KEY_POS_ALL & ~KEY_POS_SETATTR) |
    + KEY_USR_VIEW | KEY_USR_READ,
    + KEY_ALLOC_NOT_IN_QUOTA);
    + if (IS_ERR(keyring)) {
    + ret = PTR_ERR(keyring);
    + goto failed_put_cred;
    + }
    +
    + ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL);
    + if (ret < 0)
    + goto failed_put_key;
    +
    + ret = register_key_type(&key_type_dns_resolver);
    + if (ret < 0)
    + goto failed_put_key;
    +
    + /* instruct request_key() to use this special keyring as a cache for
    + * the results it looks up */
    + cred->thread_keyring = keyring;
    + cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
    + dns_resolver_cache = cred;
    + return 0;
    +
    +failed_put_key:
    + key_put(keyring);
    +failed_put_cred:
    + put_cred(cred);
    + return ret;
    +}

    +void __exit cifs_exit_dns_resolver(void)
    +{
    + key_revoke(dns_resolver_cache->thread_keyring);
    + unregister_key_type(&key_type_dns_resolver);
    + put_cred(dns_resolver_cache);
    + printk(KERN_NOTICE "Unregistered %s key type\n",
    + key_type_dns_resolver.name);
    +}
    diff --git a/fs/cifs/dns_resolve.h b/fs/cifs/dns_resolve.h
    index 966e928..26b9eaa 100644
    --- a/fs/cifs/dns_resolve.h
    +++ b/fs/cifs/dns_resolve.h
    @@ -24,8 +24,8 @@
    #define _DNS_RESOLVE_H

    #ifdef __KERNEL__
    -#include <linux/key-type.h>
    -extern struct key_type key_type_dns_resolver;
    +extern int __init cifs_init_dns_resolver(void);
    +extern void __exit cifs_exit_dns_resolver(void);
    extern int dns_resolve_server_name_to_ip(const char *unc, char **ip_addr);
    #endif /* KERNEL */

    diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
    index a104ca3..303fd7f 100644
    --- a/fs/cifs/inode.c
    +++ b/fs/cifs/inode.c
    @@ -1284,6 +1284,10 @@ cifs_do_rename(int xid, struct dentry *from_dentry, const char *fromPath,
    if (rc == 0 || rc != -ETXTBSY)
    return rc;

    + /* open-file renames don't work across directories */
    + if (to_dentry->d_parent != from_dentry->d_parent)
    + return rc;
    +
    /* open the file to be renamed -- we need DELETE perms */
    rc = CIFSSMBOpen(xid, pTcon, fromPath, FILE_OPEN, DELETE,
    CREATE_NOT_DIR, &srcfid, &oplock, NULL,
    diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
    index 7085a62..6d6ff4f 100644
    --- a/fs/cifs/sess.c
    +++ b/fs/cifs/sess.c
    @@ -723,15 +723,7 @@ ssetup_ntlmssp_authenticate:

    /* calculate session key */
    setup_ntlmv2_rsp(ses, v2_sess_key, nls_cp);
    - if (first_time) /* should this be moved into common code
    - with similar ntlmv2 path? */
    - /* cifs_calculate_ntlmv2_mac_key(ses->server->mac_signing_key,
    - response BB FIXME, v2_sess_key); */
    -
    - /* copy session key */
    -
    - /* memcpy(bcc_ptr, (char *)ntlm_session_key,LM2_SESS_KEY_SIZE);
    - bcc_ptr += LM2_SESS_KEY_SIZE; */
    + /* FIXME: calculate MAC key */
    memcpy(bcc_ptr, (char *)v2_sess_key,
    sizeof(struct ntlmv2_resp));
    bcc_ptr += sizeof(struct ntlmv2_resp);
    diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c
    index f1c17e8..3dfe7ce 100644
    --- a/fs/ecryptfs/messaging.c
    +++ b/fs/ecryptfs/messaging.c
    @@ -30,9 +30,9 @@ static struct mutex ecryptfs_msg_ctx_lists_mux;

    static struct hlist_head *ecryptfs_daemon_hash;
    struct mutex ecryptfs_daemon_hash_mux;
    -static int ecryptfs_hash_buckets;
    +static int ecryptfs_hash_bits;
    #define ecryptfs_uid_hash(uid) \
    - hash_long((unsigned long)uid, ecryptfs_hash_buckets)
    + hash_long((unsigned long)uid, ecryptfs_hash_bits)

    static u32 ecryptfs_msg_counter;
    static struct ecryptfs_msg_ctx *ecryptfs_msg_ctx_arr;
    @@ -485,18 +485,19 @@ int ecryptfs_init_messaging(void)
    }
    mutex_init(&ecryptfs_daemon_hash_mux);
    mutex_lock(&ecryptfs_daemon_hash_mux);
    - ecryptfs_hash_buckets = 1;
    - while (ecryptfs_number_of_users >> ecryptfs_hash_buckets)
    - ecryptfs_hash_buckets++;
    + ecryptfs_hash_bits = 1;
    + while (ecryptfs_number_of_users >> ecryptfs_hash_bits)
    + ecryptfs_hash_bits++;
    ecryptfs_daemon_hash = kmalloc((sizeof(struct hlist_head)
    - * ecryptfs_hash_buckets), GFP_KERNEL);
    + * (1 << ecryptfs_hash_bits)),
    + GFP_KERNEL);
    if (!ecryptfs_daemon_hash) {
    rc = -ENOMEM;
    printk(KERN_ERR "%s: Failed to allocate memory\n", __func__);
    mutex_unlock(&ecryptfs_daemon_hash_mux);
    goto out;
    }
    - for (i = 0; i < ecryptfs_hash_buckets; i++)
    + for (i = 0; i < (1 << ecryptfs_hash_bits); i++)
    INIT_HLIST_HEAD(&ecryptfs_daemon_hash[i]);
    mutex_unlock(&ecryptfs_daemon_hash_mux);
    ecryptfs_msg_ctx_arr = kmalloc((sizeof(struct ecryptfs_msg_ctx)
    @@ -553,7 +554,7 @@ void ecryptfs_release_messaging(void)
    int i;

    mutex_lock(&ecryptfs_daemon_hash_mux);
    - for (i = 0; i < ecryptfs_hash_buckets; i++) {
    + for (i = 0; i < (1 << ecryptfs_hash_bits); i++) {
    int rc;

    hlist_for_each_entry(daemon, elem,
    diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
    index 9dc93168..aa6fb6b 100644
    --- a/fs/ext4/dir.c
    +++ b/fs/ext4/dir.c
    @@ -84,9 +84,11 @@ int ext4_check_dir_entry(const char *function, struct inode *dir,

    if (error_msg != NULL)
    ext4_error(dir->i_sb, function,
    - "bad entry in directory #%lu: %s - "
    - "offset=%u, inode=%u, rec_len=%d, name_len=%d",
    - dir->i_ino, error_msg, offset,
    + "bad entry in directory #%lu: %s - block=%llu"
    + "offset=%u(%u), inode=%u, rec_len=%d, name_len=%d",
    + dir->i_ino, error_msg,
    + (unsigned long long) bh->b_blocknr,
    + (unsigned) (offset%bh->b_size), offset,
    le32_to_cpu(de->inode),
    rlen, de->name_len);
    return error_msg == NULL ? 1 : 0;
    @@ -109,7 +111,7 @@ static int ext4_readdir(struct file *filp,

    if (EXT4_HAS_COMPAT_FEATURE(inode->i_sb,
    EXT4_FEATURE_COMPAT_DIR_INDEX) &&
    - ((EXT4_I(inode)->i_flags & EXT4_INDEX_FL) ||
    + ((ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) ||
    ((inode->i_size >> sb->s_blocksize_bits) == 1))) {
    err = ext4_dx_readdir(filp, dirent, filldir);
    if (err != ERR_BAD_DX_DIR) {
    @@ -120,7 +122,7 @@ static int ext4_readdir(struct file *filp,
    * We don't set the inode dirty flag since it's not
    * critical that it get flushed back to the disk.
    */
    - EXT4_I(filp->f_path.dentry->d_inode)->i_flags &= ~EXT4_INDEX_FL;
    + ext4_clear_inode_flag(filp->f_path.dentry->d_inode, EXT4_INODE_INDEX);
    }
    stored = 0;
    offset = filp->f_pos & (sb->s_blocksize - 1);
    diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
    index 4a825c1..fa6b79f 100644
    --- a/fs/ext4/ext4.h
    +++ b/fs/ext4/ext4.h
    @@ -29,6 +29,9 @@
    #include <linux/wait.h>
    #include <linux/blockgroup_lock.h>
    #include <linux/percpu_counter.h>
    +#ifdef __KERNEL__
    +#include <linux/compat.h>
    +#endif

    /*
    * The fourth extended filesystem constants/structures
    @@ -284,10 +287,12 @@ struct flex_groups {
    #define EXT4_TOPDIR_FL 0x00020000 /* Top of directory hierarchies*/
    #define EXT4_HUGE_FILE_FL 0x00040000 /* Set to each huge file */
    #define EXT4_EXTENTS_FL 0x00080000 /* Inode uses extents */
    +#define EXT4_EA_INODE_FL 0x00200000 /* Inode used for large EA */
    +#define EXT4_EOFBLOCKS_FL 0x00400000 /* Blocks allocated beyond EOF */
    #define EXT4_RESERVED_FL 0x80000000 /* reserved for ext4 lib */

    -#define EXT4_FL_USER_VISIBLE 0x000BDFFF /* User visible flags */
    -#define EXT4_FL_USER_MODIFIABLE 0x000B80FF /* User modifiable flags */
    +#define EXT4_FL_USER_VISIBLE 0x004BDFFF /* User visible flags */
    +#define EXT4_FL_USER_MODIFIABLE 0x004B80FF /* User modifiable flags */

    /* Flags that should be inherited by new inodes from their parent. */
    #define EXT4_FL_INHERITED (EXT4_SECRM_FL | EXT4_UNRM_FL | EXT4_COMPR_FL |\
    @@ -314,15 +319,81 @@ static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags)
    }

    /*
    - * Inode dynamic state flags
    + * Inode flags used for atomic set/get
    + */
    +enum {
    + EXT4_INODE_SECRM = 0, /* Secure deletion */
    + EXT4_INODE_UNRM = 1, /* Undelete */
    + EXT4_INODE_COMPR = 2, /* Compress file */
    + EXT4_INODE_SYNC = 3, /* Synchronous updates */
    + EXT4_INODE_IMMUTABLE = 4, /* Immutable file */
    + EXT4_INODE_APPEND = 5, /* writes to file may only append */
    + EXT4_INODE_NODUMP = 6, /* do not dump file */
    + EXT4_INODE_NOATIME = 7, /* do not update atime */
    +/* Reserved for compression usage... */
    + EXT4_INODE_DIRTY = 8,
    + EXT4_INODE_COMPRBLK = 9, /* One or more compressed clusters */
    + EXT4_INODE_NOCOMPR = 10, /* Don't compress */
    + EXT4_INODE_ECOMPR = 11, /* Compression error */
    +/* End compression flags --- maybe not all used */
    + EXT4_INODE_INDEX = 12, /* hash-indexed directory */
    + EXT4_INODE_IMAGIC = 13, /* AFS directory */
    + EXT4_INODE_JOURNAL_DATA = 14, /* file data should be journaled */
    + EXT4_INODE_NOTAIL = 15, /* file tail should not be merged */
    + EXT4_INODE_DIRSYNC = 16, /* dirsync behaviour (directories only) */
    + EXT4_INODE_TOPDIR = 17, /* Top of directory hierarchies*/
    + EXT4_INODE_HUGE_FILE = 18, /* Set to each huge file */
    + EXT4_INODE_EXTENTS = 19, /* Inode uses extents */
    + EXT4_INODE_EA_INODE = 21, /* Inode used for large EA */
    + EXT4_INODE_EOFBLOCKS = 22, /* Blocks allocated beyond EOF */
    + EXT4_INODE_RESERVED = 31, /* reserved for ext4 lib */
    +};
    +
    +#define TEST_FLAG_VALUE(FLAG) (EXT4_##FLAG##_FL == (1 << EXT4_INODE_##FLAG))
    +#define CHECK_FLAG_VALUE(FLAG) if (!TEST_FLAG_VALUE(FLAG)) { \
    + printk(KERN_EMERG "EXT4 flag fail: " #FLAG ": %d %d\n", \
    + EXT4_##FLAG##_FL, EXT4_INODE_##FLAG); BUG_ON(1); }
    +
    +/*
    + * Since it's pretty easy to mix up bit numbers and hex values, and we
    + * can't do a compile-time test for ENUM values, we use a run-time
    + * test to make sure that EXT4_XXX_FL is consistent with respect to
    + * EXT4_INODE_XXX. If all is well the printk and BUG_ON will all drop
    + * out so it won't cost any extra space in the compiled kernel image.
    + * But it's important that these values are the same, since we are
    + * using EXT4_INODE_XXX to test for the flag values, but EXT4_XX_FL
    + * must be consistent with the values of FS_XXX_FL defined in
    + * include/linux/fs.h and the on-disk values found in ext2, ext3, and
    + * ext4 filesystems, and of course the values defined in e2fsprogs.
    + *
    + * It's not paranoia if the Murphy's Law really *is* out to get you. :-)
    */
    -#define EXT4_STATE_JDATA 0x00000001 /* journaled data exists */
    -#define EXT4_STATE_NEW 0x00000002 /* inode is newly created */
    -#define EXT4_STATE_XATTR 0x00000004 /* has in-inode xattrs */
    -#define EXT4_STATE_NO_EXPAND 0x00000008 /* No space for expansion */
    -#define EXT4_STATE_DA_ALLOC_CLOSE 0x00000010 /* Alloc DA blks on close */
    -#define EXT4_STATE_EXT_MIGRATE 0x00000020 /* Inode is migrating */
    -#define EXT4_STATE_DIO_UNWRITTEN 0x00000040 /* need convert on dio done*/
    +static inline void ext4_check_flag_values(void)
    +{
    + CHECK_FLAG_VALUE(SECRM);
    + CHECK_FLAG_VALUE(UNRM);
    + CHECK_FLAG_VALUE(COMPR);
    + CHECK_FLAG_VALUE(SYNC);
    + CHECK_FLAG_VALUE(IMMUTABLE);
    + CHECK_FLAG_VALUE(APPEND);
    + CHECK_FLAG_VALUE(NODUMP);
    + CHECK_FLAG_VALUE(NOATIME);
    + CHECK_FLAG_VALUE(DIRTY);
    + CHECK_FLAG_VALUE(COMPRBLK);
    + CHECK_FLAG_VALUE(NOCOMPR);
    + CHECK_FLAG_VALUE(ECOMPR);
    + CHECK_FLAG_VALUE(INDEX);
    + CHECK_FLAG_VALUE(IMAGIC);
    + CHECK_FLAG_VALUE(JOURNAL_DATA);
    + CHECK_FLAG_VALUE(NOTAIL);
    + CHECK_FLAG_VALUE(DIRSYNC);
    + CHECK_FLAG_VALUE(TOPDIR);
    + CHECK_FLAG_VALUE(HUGE_FILE);
    + CHECK_FLAG_VALUE(EXTENTS);
    + CHECK_FLAG_VALUE(EA_INODE);
    + CHECK_FLAG_VALUE(EOFBLOCKS);
    + CHECK_FLAG_VALUE(RESERVED);
    +}

    /* Used to pass group descriptor data when online resize is done */
    struct ext4_new_group_input {
    @@ -335,6 +406,18 @@ struct ext4_new_group_input {
    __u16 unused;
    };

    +#if defined(__KERNEL__) && defined(CONFIG_COMPAT)
    +struct compat_ext4_new_group_input {
    + u32 group;
    + compat_u64 block_bitmap;
    + compat_u64 inode_bitmap;
    + compat_u64 inode_table;
    + u32 blocks_count;
    + u16 reserved_blocks;
    + u16 unused;
    +};
    +#endif
    +
    /* The struct ext4_new_group_input in kernel space, with free_blocks_count */
    struct ext4_new_group_data {
    __u32 group;
    @@ -361,14 +444,11 @@ struct ext4_new_group_data {
    so set the magic i_delalloc_reserve_flag after taking the
    inode allocation semaphore for */
    #define EXT4_GET_BLOCKS_DELALLOC_RESERVE 0x0004
    - /* Call ext4_da_update_reserve_space() after successfully
    - allocating the blocks */
    -#define EXT4_GET_BLOCKS_UPDATE_RESERVE_SPACE 0x0008
    /* caller is from the direct IO path, request to creation of an
    unitialized extents if not allocated, split the uninitialized
    extent if blocks has been preallocated already*/
    -#define EXT4_GET_BLOCKS_DIO 0x0010
    -#define EXT4_GET_BLOCKS_CONVERT 0x0020
    +#define EXT4_GET_BLOCKS_DIO 0x0008
    +#define EXT4_GET_BLOCKS_CONVERT 0x0010
    #define EXT4_GET_BLOCKS_DIO_CREATE_EXT (EXT4_GET_BLOCKS_DIO|\
    EXT4_GET_BLOCKS_CREATE_UNINIT_EXT)
    /* Convert extent to initialized after direct IO complete */
    @@ -397,6 +477,7 @@ struct ext4_new_group_data {
    #define EXT4_IOC_ALLOC_DA_BLKS _IO('f', 12)
    #define EXT4_IOC_MOVE_EXT _IOWR('f', 15, struct move_extent)

    +#if defined(__KERNEL__) && defined(CONFIG_COMPAT)
    /*
    * ioctl commands in 32 bit emulation
    */
    @@ -407,11 +488,13 @@ struct ext4_new_group_data {
    #define EXT4_IOC32_GETRSVSZ _IOR('f', 5, int)
    #define EXT4_IOC32_SETRSVSZ _IOW('f', 6, int)
    #define EXT4_IOC32_GROUP_EXTEND _IOW('f', 7, unsigned int)
    +#define EXT4_IOC32_GROUP_ADD _IOW('f', 8, struct compat_ext4_new_group_input)
    #ifdef CONFIG_JBD2_DEBUG
    #define EXT4_IOC32_WAIT_FOR_READONLY _IOR('f', 99, int)
    #endif
    #define EXT4_IOC32_GETVERSION_OLD FS_IOC32_GETVERSION
    #define EXT4_IOC32_SETVERSION_OLD FS_IOC32_SETVERSION
    +#endif


    /*
    @@ -615,9 +698,8 @@ struct ext4_ext_cache {
    */
    struct ext4_inode_info {
    __le32 i_data[15]; /* unconverted */
    - __u32 i_flags;
    - ext4_fsblk_t i_file_acl;
    __u32 i_dtime;
    + ext4_fsblk_t i_file_acl;

    /*
    * i_block_group is the number of the block group which contains
    @@ -627,7 +709,8 @@ struct ext4_inode_info {
    * near to their parent directory's inode.
    */
    ext4_group_t i_block_group;
    - __u32 i_state; /* Dynamic state flags for ext4 */
    + unsigned long i_state_flags; /* Dynamic state flags */
    + unsigned long i_flags;

    ext4_lblk_t i_dir_start_lookup;
    #ifdef CONFIG_EXT4_FS_XATTR
    @@ -693,6 +776,8 @@ struct ext4_inode_info {
    unsigned int i_reserved_meta_blocks;
    unsigned int i_allocated_meta_blocks;
    unsigned short i_delalloc_reserved_flag;
    + sector_t i_da_metadata_calc_last_lblock;
    + int i_da_metadata_calc_len;

    /* on-disk additional length */
    __u16 i_extra_isize;
    @@ -1045,6 +1130,37 @@ static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino)
    (ino >= EXT4_FIRST_INO(sb) &&
    ino <= le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count));
    }
    +
    +/*
    + * Inode dynamic state flags
    + */
    +enum {
    + EXT4_STATE_JDATA, /* journaled data exists */
    + EXT4_STATE_NEW, /* inode is newly created */
    + EXT4_STATE_XATTR, /* has in-inode xattrs */
    + EXT4_STATE_NO_EXPAND, /* No space for expansion */
    + EXT4_STATE_DA_ALLOC_CLOSE, /* Alloc DA blks on close */
    + EXT4_STATE_EXT_MIGRATE, /* Inode is migrating */
    + EXT4_STATE_DIO_UNWRITTEN, /* need convert on dio done*/
    + EXT4_STATE_NEWENTRY, /* File just added to dir */
    +};
    +
    +#define EXT4_INODE_BIT_FNS(name, field) \
    +static inline int ext4_test_inode_##name(struct inode *inode, int bit) \
    +{ \
    + return test_bit(bit, &EXT4_I(inode)->i_##field); \
    +} \
    +static inline void ext4_set_inode_##name(struct inode *inode, int bit) \
    +{ \
    + set_bit(bit, &EXT4_I(inode)->i_##field); \
    +} \
    +static inline void ext4_clear_inode_##name(struct inode *inode, int bit) \
    +{ \
    + clear_bit(bit, &EXT4_I(inode)->i_##field); \
    +}
    +
    +EXT4_INODE_BIT_FNS(flag, flags)
    +EXT4_INODE_BIT_FNS(state, state_flags)
    #else
    /* Assume that user mode programs are passing in an ext4fs superblock, not
    * a kernel struct super_block. This will allow us to call the feature-test
    @@ -1229,7 +1345,7 @@ struct ext4_dir_entry_2 {

    #define is_dx(dir) (EXT4_HAS_COMPAT_FEATURE(dir->i_sb, \
    EXT4_FEATURE_COMPAT_DIR_INDEX) && \
    - (EXT4_I(dir)->i_flags & EXT4_INDEX_FL))
    + ext4_test_inode_flag((dir), EXT4_INODE_INDEX))
    #define EXT4_DIR_LINK_MAX(dir) (!is_dx(dir) && (dir)->i_nlink >= EXT4_LINK_MAX)
    #define EXT4_DIR_LINK_EMPTY(dir) ((dir)->i_nlink == 2 || (dir)->i_nlink == 1)

    @@ -1438,6 +1554,8 @@ extern int ext4_block_truncate_page(handle_t *handle,
    extern int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf);
    extern qsize_t *ext4_get_reserved_space(struct inode *inode);
    extern int flush_aio_dio_completed_IO(struct inode *inode);
    +extern void ext4_da_update_reserve_space(struct inode *inode,
    + int used, int quota_claim);
    /* ioctl.c */
    extern long ext4_ioctl(struct file *, unsigned int, unsigned long);
    extern long ext4_compat_ioctl(struct file *, unsigned int, unsigned long);
    @@ -1637,6 +1755,7 @@ struct ext4_group_info {
    ext4_grpblk_t bb_first_free; /* first free block */
    ext4_grpblk_t bb_free; /* total free blocks */
    ext4_grpblk_t bb_fragments; /* nr of freespace fragments */
    + ext4_grpblk_t bb_largest_free_order;/* order of largest frag in BG */
    struct list_head bb_prealloc_list;
    #ifdef DOUBLE_CHECK
    void *bb_bitmap;
    diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h
    index 2ca6864..bdb6ce7 100644
    --- a/fs/ext4/ext4_extents.h
    +++ b/fs/ext4/ext4_extents.h
    @@ -225,7 +225,8 @@ static inline void ext4_ext_mark_initialized(struct ext4_extent *ext)
    ext->ee_len = cpu_to_le16(ext4_ext_get_actual_len(ext));
    }

    -extern int ext4_ext_calc_metadata_amount(struct inode *inode, int blocks);
    +extern int ext4_ext_calc_metadata_amount(struct inode *inode,
    + sector_t lblocks);
    extern ext4_fsblk_t ext_pblock(struct ext4_extent *ex);
    extern ext4_fsblk_t idx_pblock(struct ext4_extent_idx *);
    extern void ext4_ext_store_pblock(struct ext4_extent *, ext4_fsblk_t);
    diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
    index 6a94099..496249a 100644
    --- a/fs/ext4/ext4_jbd2.c
    +++ b/fs/ext4/ext4_jbd2.c
    @@ -89,7 +89,7 @@ int __ext4_handle_dirty_metadata(const char *where, handle_t *handle,
    ext4_journal_abort_handle(where, __func__, bh,
    handle, err);
    } else {
    - if (inode && bh)
    + if (inode)
    mark_buffer_dirty_inode(bh, inode);
    else
    mark_buffer_dirty(bh);
    diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
    index 1892a77..386095d 100644
    --- a/fs/ext4/ext4_jbd2.h
    +++ b/fs/ext4/ext4_jbd2.h
    @@ -282,7 +282,7 @@ static inline int ext4_should_journal_data(struct inode *inode)
    return 1;
    if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA)
    return 1;
    - if (EXT4_I(inode)->i_flags & EXT4_JOURNAL_DATA_FL)
    + if (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA))
    return 1;
    return 0;
    }
    @@ -293,7 +293,7 @@ static inline int ext4_should_order_data(struct inode *inode)
    return 0;
    if (!S_ISREG(inode->i_mode))
    return 0;
    - if (EXT4_I(inode)->i_flags & EXT4_JOURNAL_DATA_FL)
    + if (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA))
    return 0;
    if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA)
    return 1;
    @@ -306,7 +306,7 @@ static inline int ext4_should_writeback_data(struct inode *inode)
    return 0;
    if (EXT4_JOURNAL(inode) == NULL)
    return 1;
    - if (EXT4_I(inode)->i_flags & EXT4_JOURNAL_DATA_FL)
    + if (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA))
    return 0;
    if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA)
    return 1;
    diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
    index 9e21653..99482ea 100644
    --- a/fs/ext4/extents.c
    +++ b/fs/ext4/extents.c
    @@ -107,11 +107,8 @@ static int ext4_ext_truncate_extend_restart(handle_t *handle,
    if (err <= 0)
    return err;
    err = ext4_truncate_restart_trans(handle, inode, needed);
    - /*
    - * We have dropped i_data_sem so someone might have cached again
    - * an extent we are going to truncate.
    - */
    - ext4_ext_invalidate_cache(inode);
    + if (err == 0)
    + err = -EAGAIN;

    return err;
    }
    @@ -296,29 +293,44 @@ static inline int ext4_ext_space_root_idx(struct inode *inode, int check)
    * to allocate @blocks
    * Worse case is one block per extent
    */
    -int ext4_ext_calc_metadata_amount(struct inode *inode, int blocks)
    +int ext4_ext_calc_metadata_amount(struct inode *inode, sector_t lblock)
    {
    - int lcap, icap, rcap, leafs, idxs, num;
    - int newextents = blocks;
    -
    - rcap = ext4_ext_space_root_idx(inode, 0);
    - lcap = ext4_ext_space_block(inode, 0);
    - icap = ext4_ext_space_block_idx(inode, 0);
    + struct ext4_inode_info *ei = EXT4_I(inode);
    + int idxs, num = 0;

    - /* number of new leaf blocks needed */
    - num = leafs = (newextents + lcap - 1) / lcap;
    + idxs = ((inode->i_sb->s_blocksize - sizeof(struct ext4_extent_header))
    + / sizeof(struct ext4_extent_idx));

    /*
    - * Worse case, we need separate index block(s)
    - * to link all new leaf blocks
    + * If the new delayed allocation block is contiguous with the
    + * previous da block, it can share index blocks with the
    + * previous block, so we only need to allocate a new index
    + * block every idxs leaf blocks. At ldxs**2 blocks, we need
    + * an additional index block, and at ldxs**3 blocks, yet
    + * another index blocks.
    */
    - idxs = (leafs + icap - 1) / icap;
    - do {
    - num += idxs;
    - idxs = (idxs + icap - 1) / icap;
    - } while (idxs > rcap);
    + if (ei->i_da_metadata_calc_len &&
    + ei->i_da_metadata_calc_last_lblock+1 == lblock) {
    + if ((ei->i_da_metadata_calc_len % idxs) == 0)
    + num++;
    + if ((ei->i_da_metadata_calc_len % (idxs*idxs)) == 0)
    + num++;
    + if ((ei->i_da_metadata_calc_len % (idxs*idxs*idxs)) == 0) {
    + num++;
    + ei->i_da_metadata_calc_len = 0;
    + } else
    + ei->i_da_metadata_calc_len++;
    + ei->i_da_metadata_calc_last_lblock++;
    + return num;
    + }

    - return num;
    + /*
    + * In the worst case we need a new set of index blocks at
    + * every level of the inode's extent tree.
    + */
    + ei->i_da_metadata_calc_len = 1;
    + ei->i_da_metadata_calc_last_lblock = lblock;
    + return ext_depth(inode) + 1;
    }

    static int
    @@ -2248,7 +2260,7 @@ static int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start)
    int depth = ext_depth(inode);
    struct ext4_ext_path *path;
    handle_t *handle;
    - int i = 0, err = 0;
    + int i, err;

    ext_debug("truncate since %u\n", start);

    @@ -2257,23 +2269,26 @@ static int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start)
    if (IS_ERR(handle))
    return PTR_ERR(handle);

    +again:
    ext4_ext_invalidate_cache(inode);

    /*
    * We start scanning from right side, freeing all the blocks
    * after i_size and walking into the tree depth-wise.
    */
    + depth = ext_depth(inode);
    path = kzalloc(sizeof(struct ext4_ext_path) * (depth + 1), GFP_NOFS);
    if (path == NULL) {
    ext4_journal_stop(handle);
    return -ENOMEM;
    }
    + path[0].p_depth = depth;
    path[0].p_hdr = ext_inode_hdr(inode);
    if (ext4_ext_check(inode, path[0].p_hdr, depth)) {
    err = -EIO;
    goto out;
    }
    - path[0].p_depth = depth;
    + i = err = 0;

    while (i >= 0 && err == 0) {
    if (i == depth) {
    @@ -2367,6 +2382,8 @@ static int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start)
    out:
    ext4_ext_drop_refs(path);
    kfree(path);
    + if (err == -EAGAIN)
    + goto again;
    ext4_journal_stop(handle);

    return err;
    @@ -2431,7 +2448,7 @@ static void bi_complete(struct bio *bio, int error)
    /* FIXME!! we need to try to merge to left or right after zero-out */
    static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex)
    {
    - int ret = -EIO;
    + int ret;
    struct bio *bio;
    int blkbits, blocksize;
    sector_t ee_pblock;
    @@ -2455,6 +2472,9 @@ static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex)
    len = ee_len;

    bio = bio_alloc(GFP_NOIO, len);
    + if (!bio)
    + return -ENOMEM;
    +
    bio->bi_sector = ee_pblock;
    bio->bi_bdev = inode->i_sb->s_bdev;

    @@ -2482,17 +2502,15 @@ static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex)
    submit_bio(WRITE, bio);
    wait_for_completion(&event);

    - if (test_bit(BIO_UPTODATE, &bio->bi_flags))
    - ret = 0;
    - else {
    - ret = -EIO;
    - break;
    + if (!test_bit(BIO_UPTODATE, &bio->bi_flags)) {
    + bio_put(bio);
    + return -EIO;
    }
    bio_put(bio);
    ee_len -= done;
    ee_pblock += done << (blkbits - 9);
    }
    - return ret;
    + return 0;
    }

    #define EXT4_EXT_ZERO_LEN 7
    @@ -2517,11 +2535,21 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
    struct ext4_extent *ex2 = NULL;
    struct ext4_extent *ex3 = NULL;
    struct ext4_extent_header *eh;
    - ext4_lblk_t ee_block;
    + ext4_lblk_t ee_block, eof_block;
    unsigned int allocated, ee_len, depth;
    ext4_fsblk_t newblock;
    int err = 0;
    int ret = 0;
    + int may_zeroout;
    +
    + ext_debug("ext4_ext_convert_to_initialized: inode %lu, logical"
    + "block %llu, max_blocks %u\n", inode->i_ino,
    + (unsigned long long)iblock, max_blocks);
    +
    + eof_block = (inode->i_size + inode->i_sb->s_blocksize - 1) >>
    + inode->i_sb->s_blocksize_bits;
    + if (eof_block < iblock + max_blocks)
    + eof_block = iblock + max_blocks;

    depth = ext_depth(inode);
    eh = path[depth].p_hdr;
    @@ -2530,16 +2558,23 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
    ee_len = ext4_ext_get_actual_len(ex);
    allocated = ee_len - (iblock - ee_block);
    newblock = iblock - ee_block + ext_pblock(ex);
    +
    ex2 = ex;
    orig_ex.ee_block = ex->ee_block;
    orig_ex.ee_len = cpu_to_le16(ee_len);
    ext4_ext_store_pblock(&orig_ex, ext_pblock(ex));

    + /*
    + * It is safe to convert extent to initialized via explicit
    + * zeroout only if extent is fully insde i_size or new_size.
    + */
    + may_zeroout = ee_block + ee_len <= eof_block;
    +
    err = ext4_ext_get_access(handle, inode, path + depth);
    if (err)
    goto out;
    /* If extent has less than 2*EXT4_EXT_ZERO_LEN zerout directly */
    - if (ee_len <= 2*EXT4_EXT_ZERO_LEN) {
    + if (ee_len <= 2*EXT4_EXT_ZERO_LEN && may_zeroout) {
    err = ext4_ext_zeroout(inode, &orig_ex);
    if (err)
    goto fix_extent_len;
    @@ -2570,7 +2605,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
    if (allocated > max_blocks) {
    unsigned int newdepth;
    /* If extent has less than EXT4_EXT_ZERO_LEN zerout directly */
    - if (allocated <= EXT4_EXT_ZERO_LEN) {
    + if (allocated <= EXT4_EXT_ZERO_LEN && may_zeroout) {
    /*
    * iblock == ee_block is handled by the zerouout
    * at the beginning.
    @@ -2646,7 +2681,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
    ex3->ee_len = cpu_to_le16(allocated - max_blocks);
    ext4_ext_mark_uninitialized(ex3);
    err = ext4_ext_insert_extent(handle, inode, path, ex3, 0);
    - if (err == -ENOSPC) {
    + if (err == -ENOSPC && may_zeroout) {
    err = ext4_ext_zeroout(inode, &orig_ex);
    if (err)
    goto fix_extent_len;
    @@ -2670,8 +2705,10 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
    * update the extent length after successful insert of the
    * split extent
    */
    - orig_ex.ee_len = cpu_to_le16(ee_len -
    - ext4_ext_get_actual_len(ex3));
    + ee_len -= ext4_ext_get_actual_len(ex3);
    + orig_ex.ee_len = cpu_to_le16(ee_len);
    + may_zeroout = ee_block + ee_len <= eof_block;
    +
    depth = newdepth;
    ext4_ext_drop_refs(path);
    path = ext4_ext_find_extent(inode, iblock, path);
    @@ -2695,7 +2732,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
    * otherwise give the extent a chance to merge to left
    */
    if (le16_to_cpu(orig_ex.ee_len) <= EXT4_EXT_ZERO_LEN &&
    - iblock != ee_block) {
    + iblock != ee_block && may_zeroout) {
    err = ext4_ext_zeroout(inode, &orig_ex);
    if (err)
    goto fix_extent_len;
    @@ -2764,7 +2801,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
    goto out;
    insert:
    err = ext4_ext_insert_extent(handle, inode, path, &newex, 0);
    - if (err == -ENOSPC) {
    + if (err == -ENOSPC && may_zeroout) {
    err = ext4_ext_zeroout(inode, &orig_ex);
    if (err)
    goto fix_extent_len;
    @@ -2824,14 +2861,21 @@ static int ext4_split_unwritten_extents(handle_t *handle,
    struct ext4_extent *ex2 = NULL;
    struct ext4_extent *ex3 = NULL;
    struct ext4_extent_header *eh;
    - ext4_lblk_t ee_block;
    + ext4_lblk_t ee_block, eof_block;
    unsigned int allocated, ee_len, depth;
    ext4_fsblk_t newblock;
    int err = 0;
    + int may_zeroout;
    +
    + ext_debug("ext4_split_unwritten_extents: inode %lu, logical"
    + "block %llu, max_blocks %u\n", inode->i_ino,
    + (unsigned long long)iblock, max_blocks);
    +
    + eof_block = (inode->i_size + inode->i_sb->s_blocksize - 1) >>
    + inode->i_sb->s_blocksize_bits;
    + if (eof_block < iblock + max_blocks)
    + eof_block = iblock + max_blocks;

    - ext_debug("ext4_split_unwritten_extents: inode %lu,"
    - "iblock %llu, max_blocks %u\n", inode->i_ino,
    - (unsigned long long)iblock, max_blocks);
    depth = ext_depth(inode);
    eh = path[depth].p_hdr;
    ex = path[depth].p_ext;
    @@ -2839,12 +2883,19 @@ static int ext4_split_unwritten_extents(handle_t *handle,
    ee_len = ext4_ext_get_actual_len(ex);
    allocated = ee_len - (iblock - ee_block);
    newblock = iblock - ee_block + ext_pblock(ex);
    +
    ex2 = ex;
    orig_ex.ee_block = ex->ee_block;
    orig_ex.ee_len = cpu_to_le16(ee_len);
    ext4_ext_store_pblock(&orig_ex, ext_pblock(ex));

    /*
    + * It is safe to convert extent to initialized via explicit
    + * zeroout only if extent is fully insde i_size or new_size.
    + */
    + may_zeroout = ee_block + ee_len <= eof_block;
    +
    + /*
    * If the uninitialized extent begins at the same logical
    * block where the write begins, and the write completely
    * covers the extent, then we don't need to split it.
    @@ -2878,7 +2929,7 @@ static int ext4_split_unwritten_extents(handle_t *handle,
    ex3->ee_len = cpu_to_le16(allocated - max_blocks);
    ext4_ext_mark_uninitialized(ex3);
    err = ext4_ext_insert_extent(handle, inode, path, ex3, flags);
    - if (err == -ENOSPC) {
    + if (err == -ENOSPC && may_zeroout) {
    err = ext4_ext_zeroout(inode, &orig_ex);
    if (err)
    goto fix_extent_len;
    @@ -2902,8 +2953,10 @@ static int ext4_split_unwritten_extents(handle_t *handle,
    * update the extent length after successful insert of the
    * split extent
    */
    - orig_ex.ee_len = cpu_to_le16(ee_len -
    - ext4_ext_get_actual_len(ex3));
    + ee_len -= ext4_ext_get_actual_len(ex3);
    + orig_ex.ee_len = cpu_to_le16(ee_len);
    + may_zeroout = ee_block + ee_len <= eof_block;
    +
    depth = newdepth;
    ext4_ext_drop_refs(path);
    path = ext4_ext_find_extent(inode, iblock, path);
    @@ -2949,7 +3002,7 @@ static int ext4_split_unwritten_extents(handle_t *handle,
    goto out;
    insert:
    err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
    - if (err == -ENOSPC) {
    + if (err == -ENOSPC && may_zeroout) {
    err = ext4_ext_zeroout(inode, &orig_ex);
    if (err)
    goto fix_extent_len;
    @@ -3029,6 +3082,14 @@ out:
    return err;
    }

    +static void unmap_underlying_metadata_blocks(struct block_device *bdev,
    + sector_t block, int count)
    +{
    + int i;
    + for (i = 0; i < count; i++)
    + unmap_underlying_metadata(bdev, block + i);
    +}
    +
    static int
    ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
    ext4_lblk_t iblock, unsigned int max_blocks,
    @@ -3059,7 +3120,7 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
    if (io)
    io->flag = DIO_AIO_UNWRITTEN;
    else
    - EXT4_I(inode)->i_state |= EXT4_STATE_DIO_UNWRITTEN;
    + ext4_set_inode_state(inode, EXT4_STATE_DIO_UNWRITTEN);
    goto out;
    }
    /* async DIO end_io complete, convert the filled extent to written */
    @@ -3104,6 +3165,30 @@ out:
    } else
    allocated = ret;
    set_buffer_new(bh_result);
    + /*
    + * if we allocated more blocks than requested
    + * we need to make sure we unmap the extra block
    + * allocated. The actual needed block will get
    + * unmapped later when we find the buffer_head marked
    + * new.
    + */
    + if (allocated > max_blocks) {
    + unmap_underlying_metadata_blocks(inode->i_sb->s_bdev,
    + newblock + max_blocks,
    + allocated - max_blocks);
    + allocated = max_blocks;
    + }
    +
    + /*
    + * If we have done fallocate with the offset that is already
    + * delayed allocated, we would have block reservation
    + * and quota reservation done in the delayed write path.
    + * But fallocate would have already updated quota and block
    + * count for this offset. So cancel these reservation
    + */
    + if (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE)
    + ext4_da_update_reserve_space(inode, allocated, 0);
    +
    map_out:
    set_buffer_mapped(bh_result);
    out1:
    @@ -3144,9 +3229,9 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
    {
    struct ext4_ext_path *path = NULL;
    struct ext4_extent_header *eh;
    - struct ext4_extent newex, *ex;
    + struct ext4_extent newex, *ex, *last_ex;
    ext4_fsblk_t newblock;
    - int err = 0, depth, ret, cache_type;
    + int i, err = 0, depth, ret, cache_type;
    unsigned int allocated = 0;
    struct ext4_allocation_request ar;
    ext4_io_end_t *io = EXT4_I(inode)->cur_aio_dio;
    @@ -3196,7 +3281,13 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
    * this situation is possible, though, _during_ tree modification;
    * this is why assert can't be put in ext4_ext_find_extent()
    */
    - BUG_ON(path[depth].p_ext == NULL && depth != 0);
    + if (path[depth].p_ext == NULL && depth != 0) {
    + ext4_error(inode->i_sb, __func__, "bad extent address "
    + "inode: %lu, iblock: %lu, depth: %d",
    + inode->i_ino, (unsigned long) iblock, depth);
    + err = -EIO;
    + goto out2;
    + }
    eh = path[depth].p_hdr;

    ex = path[depth].p_ext;
    @@ -3315,10 +3406,36 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
    if (io)
    io->flag = DIO_AIO_UNWRITTEN;
    else
    - EXT4_I(inode)->i_state |=
    - EXT4_STATE_DIO_UNWRITTEN;;
    + ext4_set_inode_state(inode,
    + EXT4_STATE_DIO_UNWRITTEN);
    }
    }
    +
    + if (unlikely(ext4_test_inode_flag(inode, EXT4_INODE_EOFBLOCKS))) {
    + if (unlikely(!eh->eh_entries)) {
    + ext4_error(inode->i_sb, __func__,
    + "inode#%lu, eh->eh_entries = 0 and "
    + "EOFBLOCKS_FL set", inode->i_ino);
    + err = -EIO;
    + goto out2;
    + }
    + last_ex = EXT_LAST_EXTENT(eh);
    + /*
    + * If the current leaf block was reached by looking at
    + * the last index block all the way down the tree, and
    + * we are extending the inode beyond the last extent
    + * in the current leaf block, then clear the
    + * EOFBLOCKS_FL flag.
    + */
    + for (i = depth-1; i >= 0; i--) {
    + if (path[i].p_idx != EXT_LAST_INDEX(path[i].p_hdr))
    + break;
    + }
    + if ((i < 0) &&
    + (iblock + ar.len > le32_to_cpu(last_ex->ee_block) +
    + ext4_ext_get_actual_len(last_ex)))
    + ext4_clear_inode_flag(inode, EXT4_INODE_EOFBLOCKS);
    + }
    err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
    if (err) {
    /* free data blocks we just allocated */
    @@ -3333,9 +3450,18 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
    /* previous routine could use block we allocated */
    newblock = ext_pblock(&newex);
    allocated = ext4_ext_get_actual_len(&newex);
    + if (allocated > max_blocks)
    + allocated = max_blocks;
    set_buffer_new(bh_result);

    /*
    + * Update reserved blocks/metadata blocks after successful
    + * block allocation which had been deferred till now.
    + */
    + if (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE)
    + ext4_da_update_reserve_space(inode, allocated, 1);
    +
    + /*
    * Cache the extent and update transaction to commit on fdatasync only
    * when it is _not_ an uninitialized extent.
    */
    @@ -3443,6 +3569,13 @@ static void ext4_falloc_update_inode(struct inode *inode,
    i_size_write(inode, new_size);
    if (new_size > EXT4_I(inode)->i_disksize)
    ext4_update_i_disksize(inode, new_size);
    + } else {
    + /*
    + * Mark that we allocate beyond EOF so the subsequent truncate
    + * can proceed even if the new size is the same as i_size.
    + */
    + if (new_size > i_size_read(inode))
    + ext4_set_inode_flag(inode, EXT4_INODE_EOFBLOCKS);
    }

    }
    @@ -3470,7 +3603,7 @@ long ext4_fallocate(struct inode *inode, int mode, loff_t offset, loff_t len)
    * currently supporting (pre)allocate mode for extent-based
    * files _only_
    */
    - if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
    + if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
    return -EOPNOTSUPP;

    /* preallocation to directories is currently not supported */
    @@ -3489,6 +3622,11 @@ long ext4_fallocate(struct inode *inode, int mode, loff_t offset, loff_t len)
    */
    credits = ext4_chunk_trans_blocks(inode, max_blocks);
    mutex_lock(&inode->i_mutex);
    + ret = inode_newsize_ok(inode, (len + offset));
    + if (ret) {
    + mutex_unlock(&inode->i_mutex);
    + return ret;
    + }
    retry:
    while (ret >= 0 && ret < max_blocks) {
    block = block + ret;
    @@ -3683,7 +3821,7 @@ static int ext4_xattr_fiemap(struct inode *inode,
    int error = 0;

    /* in-inode? */
    - if (EXT4_I(inode)->i_state & EXT4_STATE_XATTR) {
    + if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) {
    struct ext4_iloc iloc;
    int offset; /* offset of xattr in inode */

    @@ -3696,6 +3834,7 @@ static int ext4_xattr_fiemap(struct inode *inode,
    physical += offset;
    length = EXT4_SB(inode->i_sb)->s_inode_size - offset;
    flags |= FIEMAP_EXTENT_DATA_INLINE;
    + brelse(iloc.bh);
    } else { /* external block */
    physical = EXT4_I(inode)->i_file_acl << blockbits;
    length = inode->i_sb->s_blocksize;
    @@ -3714,7 +3853,7 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
    int error = 0;

    /* fallback to generic here if not in extents fmt */
    - if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
    + if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
    return generic_block_fiemap(inode, fieinfo, start, len,
    ext4_get_block);

    diff --git a/fs/ext4/file.c b/fs/ext4/file.c
    index 9630583..2a60541 100644
    --- a/fs/ext4/file.c
    +++ b/fs/ext4/file.c
    @@ -35,9 +35,9 @@
    */
    static int ext4_release_file(struct inode *inode, struct file *filp)
    {
    - if (EXT4_I(inode)->i_state & EXT4_STATE_DA_ALLOC_CLOSE) {
    + if (ext4_test_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE)) {
    ext4_alloc_da_blocks(inode);
    - EXT4_I(inode)->i_state &= ~EXT4_STATE_DA_ALLOC_CLOSE;
    + ext4_clear_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE);
    }
    /* if we are the last writer on the inode, drop the block reservation */
    if ((filp->f_mode & FMODE_WRITE) &&
    @@ -65,7 +65,7 @@ ext4_file_write(struct kiocb *iocb, const struct iovec *iov,
    * is smaller than s_maxbytes, which is for extent-mapped files.
    */

    - if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)) {
    + if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
    struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
    size_t length = iov_length(iov, nr_segs);

    diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
    index d6049e4..c3660a6 100644
    --- a/fs/ext4/fsync.c
    +++ b/fs/ext4/fsync.c
    @@ -35,6 +35,29 @@
    #include <trace/events/ext4.h>

    /*
    + * If we're not journaling and this is a just-created file, we have to
    + * sync our parent directory (if it was freshly created) since
    + * otherwise it will only be written by writeback, leaving a huge
    + * window during which a crash may lose the file. This may apply for
    + * the parent directory's parent as well, and so on recursively, if
    + * they are also freshly created.
    + */
    +static void ext4_sync_parent(struct inode *inode)
    +{
    + struct dentry *dentry = NULL;
    +
    + while (inode && ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY)) {
    + ext4_clear_inode_state(inode, EXT4_STATE_NEWENTRY);
    + dentry = list_entry(inode->i_dentry.next,
    + struct dentry, d_alias);
    + if (!dentry || !dentry->d_parent || !dentry->d_parent->d_inode)
    + break;
    + inode = dentry->d_parent->d_inode;
    + sync_mapping_buffers(inode->i_mapping);
    + }
    +}
    +
    +/*
    * akpm: A new design for ext4_sync_file().
    *
    * This is only called from sys_fsync(), sys_fdatasync() and sys_msync().
    @@ -67,8 +90,12 @@ int ext4_sync_file(struct file *file, struct dentry *dentry, int datasync)
    if (ret < 0)
    return ret;

    - if (!journal)
    - return simple_fsync(file, dentry, datasync);
    + if (!journal) {
    + ret = simple_fsync(file, dentry, datasync);
    + if (!ret && !list_empty(&inode->i_dentry))
    + ext4_sync_parent(inode);
    + return ret;
    + }

    /*
    * data=writeback,ordered:
    @@ -88,9 +115,21 @@ int ext4_sync_file(struct file *file, struct dentry *dentry, int datasync)
    return ext4_force_commit(inode->i_sb);

    commit_tid = datasync ? ei->i_datasync_tid : ei->i_sync_tid;
    - if (jbd2_log_start_commit(journal, commit_tid))
    - jbd2_log_wait_commit(journal, commit_tid);
    - else if (journal->j_flags & JBD2_BARRIER)
    + if (jbd2_log_start_commit(journal, commit_tid)) {
    + /*
    + * When the journal is on a different device than the
    + * fs data disk, we need to issue the barrier in
    + * writeback mode. (In ordered mode, the jbd2 layer
    + * will take care of issuing the barrier. In
    + * data=journal, all of the data blocks are written to
    + * the journal device.)
    + */
    + if (ext4_should_writeback_data(inode) &&
    + (journal->j_fs_dev != journal->j_dev) &&
    + (journal->j_flags & JBD2_BARRIER))
    + blkdev_issue_flush(inode->i_sb->s_bdev, NULL);
    + ret = jbd2_log_wait_commit(journal, commit_tid);
    + } else if (journal->j_flags & JBD2_BARRIER)
    blkdev_issue_flush(inode->i_sb->s_bdev, NULL);
    return ret;
    }
    diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
    index f3624ea..55a93f5 100644
    --- a/fs/ext4/ialloc.c
    +++ b/fs/ext4/ialloc.c
    @@ -244,57 +244,50 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
    if (fatal)
    goto error_return;

    - /* Ok, now we can actually update the inode bitmaps.. */
    - cleared = ext4_clear_bit_atomic(ext4_group_lock_ptr(sb, block_group),
    - bit, bitmap_bh->b_data);
    - if (!cleared)
    - ext4_error(sb, "ext4_free_inode",
    - "bit already cleared for inode %lu", ino);
    - else {
    - gdp = ext4_get_group_desc(sb, block_group, &bh2);
    -
    + fatal = -ESRCH;
    + gdp = ext4_get_group_desc(sb, block_group, &bh2);
    + if (gdp) {
    BUFFER_TRACE(bh2, "get_write_access");
    fatal = ext4_journal_get_write_access(handle, bh2);
    - if (fatal) goto error_return;
    -
    - if (gdp) {
    - ext4_lock_group(sb, block_group);
    - count = ext4_free_inodes_count(sb, gdp) + 1;
    - ext4_free_inodes_set(sb, gdp, count);
    - if (is_directory) {
    - count = ext4_used_dirs_count(sb, gdp) - 1;
    - ext4_used_dirs_set(sb, gdp, count);
    - if (sbi->s_log_groups_per_flex) {
    - ext4_group_t f;
    -
    - f = ext4_flex_group(sbi, block_group);
    - atomic_dec(&sbi->s_flex_groups[f].free_inodes);
    - }
    + }
    + ext4_lock_group(sb, block_group);
    + cleared = ext4_clear_bit(bit, bitmap_bh->b_data);
    + if (fatal || !cleared) {
    + ext4_unlock_group(sb, block_group);
    + goto out;
    + }

    - }
    - gdp->bg_checksum = ext4_group_desc_csum(sbi,
    - block_group, gdp);
    - ext4_unlock_group(sb, block_group);
    - percpu_counter_inc(&sbi->s_freeinodes_counter);
    - if (is_directory)
    - percpu_counter_dec(&sbi->s_dirs_counter);
    -
    - if (sbi->s_log_groups_per_flex) {
    - ext4_group_t f;
    -
    - f = ext4_flex_group(sbi, block_group);
    - atomic_inc(&sbi->s_flex_groups[f].free_inodes);
    - }
    - }
    - BUFFER_TRACE(bh2, "call ext4_handle_dirty_metadata");
    - err = ext4_handle_dirty_metadata(handle, NULL, bh2);
    - if (!fatal) fatal = err;
    + count = ext4_free_inodes_count(sb, gdp) + 1;
    + ext4_free_inodes_set(sb, gdp, count);
    + if (is_directory) {
    + count = ext4_used_dirs_count(sb, gdp) - 1;
    + ext4_used_dirs_set(sb, gdp, count);
    + percpu_counter_dec(&sbi->s_dirs_counter);
    }
    - BUFFER_TRACE(bitmap_bh, "call ext4_handle_dirty_metadata");
    - err = ext4_handle_dirty_metadata(handle, NULL, bitmap_bh);
    - if (!fatal)
    - fatal = err;
    - sb->s_dirt = 1;
    + gdp->bg_checksum = ext4_group_desc_csum(sbi, block_group, gdp);
    + ext4_unlock_group(sb, block_group);
    +
    + percpu_counter_inc(&sbi->s_freeinodes_counter);
    + if (sbi->s_log_groups_per_flex) {
    + ext4_group_t f = ext4_flex_group(sbi, block_group);
    +
    + atomic_inc(&sbi->s_flex_groups[f].free_inodes);
    + if (is_directory)
    + atomic_dec(&sbi->s_flex_groups[f].used_dirs);
    + }
    + BUFFER_TRACE(bh2, "call ext4_handle_dirty_metadata");
    + fatal = ext4_handle_dirty_metadata(handle, NULL, bh2);
    +out:
    + if (cleared) {
    + BUFFER_TRACE(bitmap_bh, "call ext4_handle_dirty_metadata");
    + err = ext4_handle_dirty_metadata(handle, NULL, bitmap_bh);
    + if (!fatal)
    + fatal = err;
    + sb->s_dirt = 1;
    + } else
    + ext4_error(sb, "ext4_free_inode",
    + "bit already cleared for inode %lu", ino);
    +
    error_return:
    brelse(bitmap_bh);
    ext4_std_error(sb, fatal);
    @@ -504,7 +497,7 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent,

    if (S_ISDIR(mode) &&
    ((parent == sb->s_root->d_inode) ||
    - (EXT4_I(parent)->i_flags & EXT4_TOPDIR_FL))) {
    + (ext4_test_inode_flag(parent, EXT4_INODE_TOPDIR)))) {
    int best_ndir = inodes_per_group;
    int ret = -1;

    @@ -779,7 +772,7 @@ static int ext4_claim_inode(struct super_block *sb,
    if (sbi->s_log_groups_per_flex) {
    ext4_group_t f = ext4_flex_group(sbi, group);

    - atomic_inc(&sbi->s_flex_groups[f].free_inodes);
    + atomic_inc(&sbi->s_flex_groups[f].used_dirs);
    }
    }
    gdp->bg_checksum = ext4_group_desc_csum(sbi, group, gdp);
    @@ -904,7 +897,7 @@ repeat_in_this_group:
    BUFFER_TRACE(inode_bitmap_bh,
    "call ext4_handle_dirty_metadata");
    err = ext4_handle_dirty_metadata(handle,
    - inode,
    + NULL,
    inode_bitmap_bh);
    if (err)
    goto fail;
    @@ -1029,7 +1022,8 @@ got:
    inode->i_generation = sbi->s_next_generation++;
    spin_unlock(&sbi->s_next_gen_lock);

    - ei->i_state = EXT4_STATE_NEW;
    + ei->i_state_flags = 0;
    + ext4_set_inode_state(inode, EXT4_STATE_NEW);

    ei->i_extra_isize = EXT4_SB(sb)->s_want_extra_isize;

    @@ -1050,7 +1044,7 @@ got:
    if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_EXTENTS)) {
    /* set extent flag only for directory, file and normal symlink*/
    if (S_ISDIR(mode) || S_ISREG(mode) || S_ISLNK(mode)) {
    - EXT4_I(inode)->i_flags |= EXT4_EXTENTS_FL;
    + ext4_set_inode_flag(inode, EXT4_INODE_EXTENTS);
    ext4_ext_tree_init(handle, inode);
    }
    }
    diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
    index 16efcee..99596fc 100644
    --- a/fs/ext4/inode.c
    +++ b/fs/ext4/inode.c
    @@ -957,7 +957,7 @@ static int ext4_ind_get_blocks(handle_t *handle, struct inode *inode,
    int count = 0;
    ext4_fsblk_t first_block = 0;

    - J_ASSERT(!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL));
    + J_ASSERT(!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)));
    J_ASSERT(handle != NULL || (flags & EXT4_GET_BLOCKS_CREATE) == 0);
    depth = ext4_block_to_path(inode, iblock, offsets,
    &blocks_to_boundary);
    @@ -1051,81 +1051,115 @@ qsize_t *ext4_get_reserved_space(struct inode *inode)
    return &EXT4_I(inode)->i_reserved_quota;
    }
    #endif
    +
    /*
    * Calculate the number of metadata blocks need to reserve
    - * to allocate @blocks for non extent file based file
    + * to allocate a new block at @lblocks for non extent file based file
    */
    -static int ext4_indirect_calc_metadata_amount(struct inode *inode, int blocks)
    +static int ext4_indirect_calc_metadata_amount(struct inode *inode,
    + sector_t lblock)
    {
    - int icap = EXT4_ADDR_PER_BLOCK(inode->i_sb);
    - int ind_blks, dind_blks, tind_blks;
    -
    - /* number of new indirect blocks needed */
    - ind_blks = (blocks + icap - 1) / icap;
    + struct ext4_inode_info *ei = EXT4_I(inode);
    + sector_t dind_mask = ~((sector_t)EXT4_ADDR_PER_BLOCK(inode->i_sb) - 1);
    + int blk_bits;

    - dind_blks = (ind_blks + icap - 1) / icap;
    + if (lblock < EXT4_NDIR_BLOCKS)
    + return 0;

    - tind_blks = 1;
    + lblock -= EXT4_NDIR_BLOCKS;

    - return ind_blks + dind_blks + tind_blks;
    + if (ei->i_da_metadata_calc_len &&
    + (lblock & dind_mask) == ei->i_da_metadata_calc_last_lblock) {
    + ei->i_da_metadata_calc_len++;
    + return 0;
    + }
    + ei->i_da_metadata_calc_last_lblock = lblock & dind_mask;
    + ei->i_da_metadata_calc_len = 1;
    + blk_bits = order_base_2(lblock);
    + return (blk_bits / EXT4_ADDR_PER_BLOCK_BITS(inode->i_sb)) + 1;
    }

    /*
    * Calculate the number of metadata blocks need to reserve
    - * to allocate given number of blocks
    + * to allocate a block located at @lblock
    */
    -static int ext4_calc_metadata_amount(struct inode *inode, int blocks)
    +static int ext4_calc_metadata_amount(struct inode *inode, sector_t lblock)
    {
    - if (!blocks)
    - return 0;
    -
    - if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)
    - return ext4_ext_calc_metadata_amount(inode, blocks);
    + if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
    + return ext4_ext_calc_metadata_amount(inode, lblock);

    - return ext4_indirect_calc_metadata_amount(inode, blocks);
    + return ext4_indirect_calc_metadata_amount(inode, lblock);
    }

    -static void ext4_da_update_reserve_space(struct inode *inode, int used)
    +/*
    + * Called with i_data_sem down, which is important since we can call
    + * ext4_discard_preallocations() from here.
    + */
    +void ext4_da_update_reserve_space(struct inode *inode,
    + int used, int quota_claim)
    {
    struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
    - int total, mdb, mdb_free;
    -
    - spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
    - /* recalculate the number of metablocks still need to be reserved */
    - total = EXT4_I(inode)->i_reserved_data_blocks - used;
    - mdb = ext4_calc_metadata_amount(inode, total);
    -
    - /* figure out how many metablocks to release */
    - BUG_ON(mdb > EXT4_I(inode)->i_reserved_meta_blocks);
    - mdb_free = EXT4_I(inode)->i_reserved_meta_blocks - mdb;
    -
    - if (mdb_free) {
    - /* Account for allocated meta_blocks */
    - mdb_free -= EXT4_I(inode)->i_allocated_meta_blocks;
    -
    - /* update fs dirty blocks counter */
    + struct ext4_inode_info *ei = EXT4_I(inode);
    + int mdb_free = 0, allocated_meta_blocks = 0;
    +
    + spin_lock(&ei->i_block_reservation_lock);
    + if (unlikely(used > ei->i_reserved_data_blocks)) {
    + ext4_msg(inode->i_sb, KERN_NOTICE, "%s: ino %lu, used %d "
    + "with only %d reserved data blocks\n",
    + __func__, inode->i_ino, used,
    + ei->i_reserved_data_blocks);
    + WARN_ON(1);
    + used = ei->i_reserved_data_blocks;
    + }
    +
    + /* Update per-inode reservations */
    + ei->i_reserved_data_blocks -= used;
    + used += ei->i_allocated_meta_blocks;
    + ei->i_reserved_meta_blocks -= ei->i_allocated_meta_blocks;
    + allocated_meta_blocks = ei->i_allocated_meta_blocks;
    + ei->i_allocated_meta_blocks = 0;
    + percpu_counter_sub(&sbi->s_dirtyblocks_counter, used);
    +
    + if (ei->i_reserved_data_blocks == 0) {
    + /*
    + * We can release all of the reserved metadata blocks
    + * only when we have written all of the delayed
    + * allocation blocks.
    + */
    + mdb_free = ei->i_reserved_meta_blocks;
    + ei->i_reserved_meta_blocks = 0;
    + ei->i_da_metadata_calc_len = 0;
    percpu_counter_sub(&sbi->s_dirtyblocks_counter, mdb_free);
    - EXT4_I(inode)->i_allocated_meta_blocks = 0;
    - EXT4_I(inode)->i_reserved_meta_blocks = mdb;
    }
    -
    - /* update per-inode reservations */
    - BUG_ON(used > EXT4_I(inode)->i_reserved_data_blocks);
    - EXT4_I(inode)->i_reserved_data_blocks -= used;
    spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);

    - /*
    - * free those over-booking quota for metadata blocks
    - */
    - if (mdb_free)
    - vfs_dq_release_reservation_block(inode, mdb_free);
    + /* Update quota subsystem */
    + if (quota_claim) {
    + vfs_dq_claim_block(inode, used);
    + if (mdb_free)
    + vfs_dq_release_reservation_block(inode, mdb_free);
    + } else {
    + /*
    + * We did fallocate with an offset that is already delayed
    + * allocated. So on delayed allocated writeback we should
    + * not update the quota for allocated blocks. But then
    + * converting an fallocate region to initialized region would
    + * have caused a metadata allocation. So claim quota for
    + * that
    + */
    + if (allocated_meta_blocks)
    + vfs_dq_claim_block(inode, allocated_meta_blocks);
    + vfs_dq_release_reservation_block(inode, mdb_free + used -
    + allocated_meta_blocks);
    + }

    /*
    * If we have done all the pending block allocations and if
    * there aren't any writers on the inode, we can discard the
    * inode's preallocations.
    */
    - if (!total && (atomic_read(&inode->i_writecount) == 0))
    + if ((ei->i_reserved_data_blocks == 0) &&
    + (atomic_read(&inode->i_writecount) == 0))
    ext4_discard_preallocations(inode);
    }

    @@ -1240,7 +1274,7 @@ int ext4_get_blocks(handle_t *handle, struct inode *inode, sector_t block,
    * file system block.
    */
    down_read((&EXT4_I(inode)->i_data_sem));
    - if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL) {
    + if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) {
    retval = ext4_ext_get_blocks(handle, inode, block, max_blocks,
    bh, 0);
    } else {
    @@ -1302,7 +1336,7 @@ int ext4_get_blocks(handle_t *handle, struct inode *inode, sector_t block,
    * We need to check for EXT4 here because migrate
    * could have changed the inode type in between
    */
    - if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL) {
    + if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) {
    retval = ext4_ext_get_blocks(handle, inode, block, max_blocks,
    bh, flags);
    } else {
    @@ -1315,20 +1349,22 @@ int ext4_get_blocks(handle_t *handle, struct inode *inode, sector_t block,
    * i_data's format changing. Force the migrate
    * to fail by clearing migrate flags
    */
    - EXT4_I(inode)->i_state &= ~EXT4_STATE_EXT_MIGRATE;
    + ext4_clear_inode_state(inode, EXT4_STATE_EXT_MIGRATE);
    }
    - }

    + /*
    + * Update reserved blocks/metadata blocks after successful
    + * block allocation which had been deferred till now. We don't
    + * support fallocate for non extent files. So we can update
    + * reserve space here.
    + */
    + if ((retval > 0) &&
    + (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE))
    + ext4_da_update_reserve_space(inode, retval, 1);
    + }
    if (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE)
    EXT4_I(inode)->i_delalloc_reserved_flag = 0;

    - /*
    - * Update reserved blocks/metadata blocks after successful
    - * block allocation which had been deferred till now.
    - */
    - if ((retval > 0) && (flags & EXT4_GET_BLOCKS_UPDATE_RESERVE_SPACE))
    - ext4_da_update_reserve_space(inode, retval);
    -
    up_write((&EXT4_I(inode)->i_data_sem));
    if (retval > 0 && buffer_mapped(bh)) {
    int ret = check_block_validity(inode, "file system "
    @@ -1800,7 +1836,7 @@ static int ext4_journalled_write_end(struct file *file,
    new_i_size = pos + copied;
    if (new_i_size > inode->i_size)
    i_size_write(inode, pos+copied);
    - EXT4_I(inode)->i_state |= EXT4_STATE_JDATA;
    + ext4_set_inode_state(inode, EXT4_STATE_JDATA);
    if (new_i_size > EXT4_I(inode)->i_disksize) {
    ext4_update_i_disksize(inode, new_i_size);
    ret2 = ext4_mark_inode_dirty(handle, inode);
    @@ -1834,11 +1870,15 @@ static int ext4_journalled_write_end(struct file *file,
    return ret ? ret : copied;
    }

    -static int ext4_da_reserve_space(struct inode *inode, int nrblocks)
    +/*
    + * Reserve a single block located at lblock
    + */
    +static int ext4_da_reserve_space(struct inode *inode, sector_t lblock)
    {
    int retries = 0;
    struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
    - unsigned long md_needed, mdblocks, total = 0;
    + struct ext4_inode_info *ei = EXT4_I(inode);
    + unsigned long md_needed, md_reserved;

    /*
    * recalculate the amount of metadata blocks to reserve
    @@ -1846,35 +1886,31 @@ static int ext4_da_reserve_space(struct inode *inode, int nrblocks)
    * worse case is one extent per block
    */
    repeat:
    - spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
    - total = EXT4_I(inode)->i_reserved_data_blocks + nrblocks;
    - mdblocks = ext4_calc_metadata_amount(inode, total);
    - BUG_ON(mdblocks < EXT4_I(inode)->i_reserved_meta_blocks);
    -
    - md_needed = mdblocks - EXT4_I(inode)->i_reserved_meta_blocks;
    - total = md_needed + nrblocks;
    - spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
    + spin_lock(&ei->i_block_reservation_lock);
    + md_reserved = ei->i_reserved_meta_blocks;
    + md_needed = ext4_calc_metadata_amount(inode, lblock);
    + spin_unlock(&ei->i_block_reservation_lock);

    /*
    * Make quota reservation here to prevent quota overflow
    * later. Real quota accounting is done at pages writeout
    * time.
    */
    - if (vfs_dq_reserve_block(inode, total))
    + if (vfs_dq_reserve_block(inode, md_needed + 1))
    return -EDQUOT;

    - if (ext4_claim_free_blocks(sbi, total)) {
    - vfs_dq_release_reservation_block(inode, total);
    + if (ext4_claim_free_blocks(sbi, md_needed + 1)) {
    + vfs_dq_release_reservation_block(inode, md_needed + 1);
    if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
    yield();
    goto repeat;
    }
    return -ENOSPC;
    }
    - spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
    - EXT4_I(inode)->i_reserved_data_blocks += nrblocks;
    - EXT4_I(inode)->i_reserved_meta_blocks += md_needed;
    - spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
    + spin_lock(&ei->i_block_reservation_lock);
    + ei->i_reserved_data_blocks++;
    + ei->i_reserved_meta_blocks += md_needed;
    + spin_unlock(&ei->i_block_reservation_lock);

    return 0; /* success */
    }
    @@ -1882,49 +1918,46 @@ repeat:
    static void ext4_da_release_space(struct inode *inode, int to_free)
    {
    struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
    - int total, mdb, mdb_free, release;
    + struct ext4_inode_info *ei = EXT4_I(inode);

    if (!to_free)
    return; /* Nothing to release, exit */

    spin_lock(&EXT4_I(inode)->i_block_reservation_lock);

    - if (!EXT4_I(inode)->i_reserved_data_blocks) {
    + if (unlikely(to_free > ei->i_reserved_data_blocks)) {
    /*
    - * if there is no reserved blocks, but we try to free some
    - * then the counter is messed up somewhere.
    - * but since this function is called from invalidate
    - * page, it's harmless to return without any action
    + * if there aren't enough reserved blocks, then the
    + * counter is messed up somewhere. Since this
    + * function is called from invalidate page, it's
    + * harmless to return without any action.
    */
    - printk(KERN_INFO "ext4 delalloc try to release %d reserved "
    - "blocks for inode %lu, but there is no reserved "
    - "data blocks\n", to_free, inode->i_ino);
    - spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
    - return;
    + ext4_msg(inode->i_sb, KERN_NOTICE, "ext4_da_release_space: "
    + "ino %lu, to_free %d with only %d reserved "
    + "data blocks\n", inode->i_ino, to_free,
    + ei->i_reserved_data_blocks);
    + WARN_ON(1);
    + to_free = ei->i_reserved_data_blocks;
    }
    + ei->i_reserved_data_blocks -= to_free;

    - /* recalculate the number of metablocks still need to be reserved */
    - total = EXT4_I(inode)->i_reserved_data_blocks - to_free;
    - mdb = ext4_calc_metadata_amount(inode, total);
    -
    - /* figure out how many metablocks to release */
    - BUG_ON(mdb > EXT4_I(inode)->i_reserved_meta_blocks);
    - mdb_free = EXT4_I(inode)->i_reserved_meta_blocks - mdb;
    -
    - release = to_free + mdb_free;
    -
    - /* update fs dirty blocks counter for truncate case */
    - percpu_counter_sub(&sbi->s_dirtyblocks_counter, release);
    + if (ei->i_reserved_data_blocks == 0) {
    + /*
    + * We can release all of the reserved metadata blocks
    + * only when we have written all of the delayed
    + * allocation blocks.
    + */
    + to_free += ei->i_reserved_meta_blocks;
    + ei->i_reserved_meta_blocks = 0;
    + ei->i_da_metadata_calc_len = 0;
    + }

    - /* update per-inode reservations */
    - BUG_ON(to_free > EXT4_I(inode)->i_reserved_data_blocks);
    - EXT4_I(inode)->i_reserved_data_blocks -= to_free;
    + /* update fs dirty blocks counter */
    + percpu_counter_sub(&sbi->s_dirtyblocks_counter, to_free);

    - BUG_ON(mdb > EXT4_I(inode)->i_reserved_meta_blocks);
    - EXT4_I(inode)->i_reserved_meta_blocks = mdb;
    spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);

    - vfs_dq_release_reservation_block(inode, release);
    + vfs_dq_release_reservation_block(inode, to_free);
    }

    static void ext4_da_page_release_reservation(struct page *page,
    @@ -2229,10 +2262,10 @@ static int mpage_da_map_blocks(struct mpage_da_data *mpd)
    * variables are updated after the blocks have been allocated.
    */
    new.b_state = 0;
    - get_blocks_flags = (EXT4_GET_BLOCKS_CREATE |
    - EXT4_GET_BLOCKS_DELALLOC_RESERVE);
    + get_blocks_flags = EXT4_GET_BLOCKS_CREATE;
    if (mpd->b_state & (1 << BH_Delay))
    - get_blocks_flags |= EXT4_GET_BLOCKS_UPDATE_RESERVE_SPACE;
    + get_blocks_flags |= EXT4_GET_BLOCKS_DELALLOC_RESERVE;
    +
    blks = ext4_get_blocks(handle, mpd->inode, next, max_blocks,
    &new, get_blocks_flags);
    if (blks < 0) {
    @@ -2261,7 +2294,7 @@ static int mpage_da_map_blocks(struct mpage_da_data *mpd)
    ext4_msg(mpd->inode->i_sb, KERN_CRIT,
    "delayed block allocation failed for inode %lu at "
    "logical offset %llu with max blocks %zd with "
    - "error %d\n", mpd->inode->i_ino,
    + "error %d", mpd->inode->i_ino,
    (unsigned long long) next,
    mpd->b_size >> mpd->inode->i_blkbits, err);
    printk(KERN_CRIT "This should not happen!! "
    @@ -2328,8 +2361,17 @@ static void mpage_add_bh_to_extent(struct mpage_da_data *mpd,
    sector_t next;
    int nrblocks = mpd->b_size >> mpd->inode->i_blkbits;

    + /*
    + * XXX Don't go larger than mballoc is willing to allocate
    + * This is a stopgap solution. We eventually need to fold
    + * mpage_da_submit_io() into this function and then call
    + * ext4_get_blocks() multiple times in a loop
    + */
    + if (nrblocks >= 8*1024*1024/mpd->inode->i_sb->s_blocksize)
    + goto flush_it;
    +
    /* check if thereserved journal credits might overflow */
    - if (!(EXT4_I(mpd->inode)->i_flags & EXT4_EXTENTS_FL)) {
    + if (!(ext4_test_inode_flag(mpd->inode, EXT4_INODE_EXTENTS))) {
    if (nrblocks >= EXT4_MAX_TRANS_DATA) {
    /*
    * With non-extent format we are limited by the journal
    @@ -2530,7 +2572,7 @@ static int ext4_da_get_block_prep(struct inode *inode, sector_t iblock,
    * XXX: __block_prepare_write() unmaps passed block,
    * is it OK?
    */
    - ret = ext4_da_reserve_space(inode, 1);
    + ret = ext4_da_reserve_space(inode, iblock);
    if (ret)
    /* not enough space to reserve */
    return ret;
    @@ -2641,7 +2683,7 @@ static int __ext4_journalled_writepage(struct page *page,
    ret = err;

    walk_page_buffers(handle, page_bufs, 0, len, NULL, bput_one);
    - EXT4_I(inode)->i_state |= EXT4_STATE_JDATA;
    + ext4_set_inode_state(inode, EXT4_STATE_JDATA);
    out:
    return ret;
    }
    @@ -2794,7 +2836,7 @@ static int ext4_da_writepages_trans_blocks(struct inode *inode)
    * number of contiguous block. So we will limit
    * number of contiguous block to a sane value
    */
    - if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL) &&
    + if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) &&
    (max_blocks > EXT4_MAX_TRANS_DATA))
    max_blocks = EXT4_MAX_TRANS_DATA;

    @@ -2914,7 +2956,7 @@ retry:
    if (IS_ERR(handle)) {
    ret = PTR_ERR(handle);
    ext4_msg(inode->i_sb, KERN_CRIT, "%s: jbd2_start: "
    - "%ld pages, ino %lu; err %d\n", __func__,
    + "%ld pages, ino %lu; err %d", __func__,
    wbc->nr_to_write, inode->i_ino, ret);
    goto out_writepages;
    }
    @@ -2989,7 +3031,7 @@ retry:
    if (pages_skipped != wbc->pages_skipped)
    ext4_msg(inode->i_sb, KERN_CRIT,
    "This should not happen leaving %s "
    - "with nr_to_write = %ld ret = %d\n",
    + "with nr_to_write = %ld ret = %d",
    __func__, wbc->nr_to_write, ret);

    /* Update index */
    @@ -3005,8 +3047,7 @@ retry:
    out_writepages:
    if (!no_nrwrite_index_update)
    wbc->no_nrwrite_index_update = 0;
    - if (wbc->nr_to_write > nr_to_writebump)
    - wbc->nr_to_write -= nr_to_writebump;
    + wbc->nr_to_write -= nr_to_writebump;
    wbc->range_start = range_start;
    trace_ext4_da_writepages_result(inode, wbc, ret, pages_written);
    return ret;
    @@ -3050,7 +3091,7 @@ static int ext4_da_write_begin(struct file *file, struct address_space *mapping,
    loff_t pos, unsigned len, unsigned flags,
    struct page **pagep, void **fsdata)
    {
    - int ret, retries = 0;
    + int ret, retries = 0, quota_retries = 0;
    struct page *page;
    pgoff_t index;
    unsigned from, to;
    @@ -3109,6 +3150,22 @@ retry:

    if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
    goto retry;
    +
    + if ((ret == -EDQUOT) &&
    + EXT4_I(inode)->i_reserved_meta_blocks &&
    + (quota_retries++ < 3)) {
    + /*
    + * Since we often over-estimate the number of meta
    + * data blocks required, we may sometimes get a
    + * spurios out of quota error even though there would
    + * be enough space once we write the data blocks and
    + * find out how many meta data blocks were _really_
    + * required. So try forcing the inode write to see if
    + * that helps.
    + */
    + write_inode_now(inode, (quota_retries == 3));
    + goto retry;
    + }
    out:
    return ret;
    }
    @@ -3297,7 +3354,8 @@ static sector_t ext4_bmap(struct address_space *mapping, sector_t block)
    filemap_write_and_wait(mapping);
    }

    - if (EXT4_JOURNAL(inode) && EXT4_I(inode)->i_state & EXT4_STATE_JDATA) {
    + if (EXT4_JOURNAL(inode) &&
    + ext4_test_inode_state(inode, EXT4_STATE_JDATA)) {
    /*
    * This is a REALLY heavyweight approach, but the use of
    * bmap on dirty files is expected to be extremely rare:
    @@ -3316,7 +3374,7 @@ static sector_t ext4_bmap(struct address_space *mapping, sector_t block)
    * everything they get.
    */

    - EXT4_I(inode)->i_state &= ~EXT4_STATE_JDATA;
    + ext4_clear_inode_state(inode, EXT4_STATE_JDATA);
    journal = EXT4_JOURNAL(inode);
    jbd2_journal_lock_updates(journal);
    err = jbd2_journal_flush(journal);
    @@ -3432,6 +3490,9 @@ retry:
    * but cannot extend i_size. Bail out and pretend
    * the write failed... */
    ret = PTR_ERR(handle);
    + if (inode->i_nlink)
    + ext4_orphan_del(NULL, inode);
    +
    goto out;
    }
    if (inode->i_nlink)
    @@ -3784,8 +3845,8 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
    if (ret != -EIOCBQUEUED && ret <= 0 && iocb->private) {
    ext4_free_io_end(iocb->private);
    iocb->private = NULL;
    - } else if (ret > 0 && (EXT4_I(inode)->i_state &
    - EXT4_STATE_DIO_UNWRITTEN)) {
    + } else if (ret > 0 && ext4_test_inode_state(inode,
    + EXT4_STATE_DIO_UNWRITTEN)) {
    int err;
    /*
    * for non AIO case, since the IO is already
    @@ -3795,7 +3856,7 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
    offset, ret);
    if (err < 0)
    ret = err;
    - EXT4_I(inode)->i_state &= ~EXT4_STATE_DIO_UNWRITTEN;
    + ext4_clear_inode_state(inode, EXT4_STATE_DIO_UNWRITTEN);
    }
    return ret;
    }
    @@ -3811,7 +3872,7 @@ static ssize_t ext4_direct_IO(int rw, struct kiocb *iocb,
    struct file *file = iocb->ki_filp;
    struct inode *inode = file->f_mapping->host;

    - if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)
    + if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
    return ext4_ext_direct_IO(rw, iocb, iov, offset, nr_segs);

    return ext4_ind_direct_IO(rw, iocb, iov, offset, nr_segs);
    @@ -4442,10 +4503,12 @@ void ext4_truncate(struct inode *inode)
    if (!ext4_can_truncate(inode))
    return;

    + ext4_clear_inode_flag(inode, EXT4_INODE_EOFBLOCKS);
    +
    if (inode->i_size == 0 && !test_opt(inode->i_sb, NO_AUTO_DA_ALLOC))
    - ei->i_state |= EXT4_STATE_DA_ALLOC_CLOSE;
    + ext4_set_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE);

    - if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL) {
    + if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) {
    ext4_ext_truncate(inode);
    return;
    }
    @@ -4729,7 +4792,7 @@ int ext4_get_inode_loc(struct inode *inode, struct ext4_iloc *iloc)
    {
    /* We have all inode data except xattrs in memory here. */
    return __ext4_get_inode_loc(inode, iloc,
    - !(EXT4_I(inode)->i_state & EXT4_STATE_XATTR));
    + !ext4_test_inode_state(inode, EXT4_STATE_XATTR));
    }

    void ext4_set_inode_flags(struct inode *inode)
    @@ -4823,7 +4886,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
    }
    inode->i_nlink = le16_to_cpu(raw_inode->i_links_count);

    - ei->i_state = 0;
    + ei->i_state_flags = 0;
    ei->i_dir_start_lookup = 0;
    ei->i_dtime = le32_to_cpu(raw_inode->i_dtime);
    /* We now have enough fields to check if the inode was active or not.
    @@ -4906,7 +4969,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
    EXT4_GOOD_OLD_INODE_SIZE +
    ei->i_extra_isize;
    if (*magic == cpu_to_le32(EXT4_XATTR_MAGIC))
    - ei->i_state |= EXT4_STATE_XATTR;
    + ext4_set_inode_state(inode, EXT4_STATE_XATTR);
    }
    } else
    ei->i_extra_isize = 0;
    @@ -5046,7 +5109,7 @@ static int ext4_do_update_inode(handle_t *handle,

    /* For fields not not tracking in the in-memory inode,
    * initialise them to zero for new inodes. */
    - if (ei->i_state & EXT4_STATE_NEW)
    + if (ext4_test_inode_state(inode, EXT4_STATE_NEW))
    memset(raw_inode, 0, EXT4_SB(inode->i_sb)->s_inode_size);

    ext4_get_inode_flags(ei);
    @@ -5110,7 +5173,7 @@ static int ext4_do_update_inode(handle_t *handle,
    EXT4_FEATURE_RO_COMPAT_LARGE_FILE);
    sb->s_dirt = 1;
    ext4_handle_sync(handle);
    - err = ext4_handle_dirty_metadata(handle, inode,
    + err = ext4_handle_dirty_metadata(handle, NULL,
    EXT4_SB(sb)->s_sbh);
    }
    }
    @@ -5139,10 +5202,10 @@ static int ext4_do_update_inode(handle_t *handle,
    }

    BUFFER_TRACE(bh, "call ext4_handle_dirty_metadata");
    - rc = ext4_handle_dirty_metadata(handle, inode, bh);
    + rc = ext4_handle_dirty_metadata(handle, NULL, bh);
    if (!err)
    err = rc;
    - ei->i_state &= ~EXT4_STATE_NEW;
    + ext4_clear_inode_state(inode, EXT4_STATE_NEW);

    ext4_update_inode_fsync_trans(handle, inode, 0);
    out_brelse:
    @@ -5207,7 +5270,7 @@ int ext4_write_inode(struct inode *inode, int wait)
    } else {
    struct ext4_iloc iloc;

    - err = ext4_get_inode_loc(inode, &iloc);
    + err = __ext4_get_inode_loc(inode, &iloc, 0);
    if (err)
    return err;
    if (wait)
    @@ -5220,6 +5283,7 @@ int ext4_write_inode(struct inode *inode, int wait)
    (unsigned long long)iloc.bh->b_blocknr);
    err = -EIO;
    }
    + brelse(iloc.bh);
    }
    return err;
    }
    @@ -5286,7 +5350,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
    }

    if (attr->ia_valid & ATTR_SIZE) {
    - if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)) {
    + if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
    struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);

    if (attr->ia_size > sbi->s_bitmap_maxbytes) {
    @@ -5297,7 +5361,9 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
    }

    if (S_ISREG(inode->i_mode) &&
    - attr->ia_valid & ATTR_SIZE && attr->ia_size < inode->i_size) {
    + attr->ia_valid & ATTR_SIZE &&
    + (attr->ia_size < inode->i_size ||
    + (ext4_test_inode_flag(inode, EXT4_INODE_EOFBLOCKS)))) {
    handle_t *handle;

    handle = ext4_journal_start(inode, 3);
    @@ -5328,6 +5394,9 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
    goto err_out;
    }
    }
    + /* ext4_truncate will clear the flag */
    + if ((ext4_test_inode_flag(inode, EXT4_INODE_EOFBLOCKS)))
    + ext4_truncate(inode);
    }

    rc = inode_setattr(inode, attr);
    @@ -5402,7 +5471,7 @@ static int ext4_indirect_trans_blocks(struct inode *inode, int nrblocks,

    static int ext4_index_trans_blocks(struct inode *inode, int nrblocks, int chunk)
    {
    - if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
    + if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
    return ext4_indirect_trans_blocks(inode, nrblocks, chunk);
    return ext4_ext_index_trans_blocks(inode, nrblocks, chunk);
    }
    @@ -5566,8 +5635,8 @@ static int ext4_expand_extra_isize(struct inode *inode,
    entry = IFIRST(header);

    /* No extended attributes present */
    - if (!(EXT4_I(inode)->i_state & EXT4_STATE_XATTR) ||
    - header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) {
    + if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR) ||
    + header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) {
    memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE, 0,
    new_extra_isize);
    EXT4_I(inode)->i_extra_isize = new_extra_isize;
    @@ -5611,7 +5680,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
    err = ext4_reserve_inode_write(handle, inode, &iloc);
    if (ext4_handle_valid(handle) &&
    EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize &&
    - !(EXT4_I(inode)->i_state & EXT4_STATE_NO_EXPAND)) {
    + !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) {
    /*
    * We need extra buffer credits since we may write into EA block
    * with this same handle. If journal_extend fails, then it will
    @@ -5625,7 +5694,8 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
    sbi->s_want_extra_isize,
    iloc, handle);
    if (ret) {
    - EXT4_I(inode)->i_state |= EXT4_STATE_NO_EXPAND;
    + ext4_set_inode_state(inode,
    + EXT4_STATE_NO_EXPAND);
    if (mnt_count !=
    le16_to_cpu(sbi->s_es->s_mnt_count)) {
    ext4_warning(inode->i_sb, __func__,
    @@ -5692,7 +5762,7 @@ static int ext4_pin_inode(handle_t *handle, struct inode *inode)
    err = jbd2_journal_get_write_access(handle, iloc.bh);
    if (!err)
    err = ext4_handle_dirty_metadata(handle,
    - inode,
    + NULL,
    iloc.bh);
    brelse(iloc.bh);
    }
    @@ -5736,9 +5806,9 @@ int ext4_change_inode_journal_flag(struct inode *inode, int val)
    */

    if (val)
    - EXT4_I(inode)->i_flags |= EXT4_JOURNAL_DATA_FL;
    + ext4_set_inode_flag(inode, EXT4_INODE_JOURNAL_DATA);
    else
    - EXT4_I(inode)->i_flags &= ~EXT4_JOURNAL_DATA_FL;
    + ext4_clear_inode_flag(inode, EXT4_INODE_JOURNAL_DATA);
    ext4_set_aops(inode);

    jbd2_journal_unlock_updates(journal);
    diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
    index b63d193..bf5ae88 100644
    --- a/fs/ext4/ioctl.c
    +++ b/fs/ext4/ioctl.c
    @@ -92,6 +92,15 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
    flags &= ~EXT4_EXTENTS_FL;
    }

    + if (flags & EXT4_EOFBLOCKS_FL) {
    + /* we don't support adding EOFBLOCKS flag */
    + if (!(oldflags & EXT4_EOFBLOCKS_FL)) {
    + err = -EOPNOTSUPP;
    + goto flags_out;
    + }
    + } else if (oldflags & EXT4_EOFBLOCKS_FL)
    + ext4_truncate(inode);
    +
    handle = ext4_journal_start(inode, 1);
    if (IS_ERR(handle)) {
    err = PTR_ERR(handle);
    @@ -249,7 +258,8 @@ setversion_out:
    if (me.moved_len > 0)
    file_remove_suid(donor_filp);

    - if (copy_to_user((struct move_extent *)arg, &me, sizeof(me)))
    + if (copy_to_user((struct move_extent __user *)arg,
    + &me, sizeof(me)))
    err = -EFAULT;
    mext_out:
    fput(donor_filp);
    @@ -363,7 +373,30 @@ long ext4_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
    case EXT4_IOC32_SETRSVSZ:
    cmd = EXT4_IOC_SETRSVSZ;
    break;
    - case EXT4_IOC_GROUP_ADD:
    + case EXT4_IOC32_GROUP_ADD: {
    + struct compat_ext4_new_group_input __user *uinput;
    + struct ext4_new_group_input input;
    + mm_segment_t old_fs;
    + int err;
    +
    + uinput = compat_ptr(arg);
    + err = get_user(input.group, &uinput->group);
    + err |= get_user(input.block_bitmap, &uinput->block_bitmap);
    + err |= get_user(input.inode_bitmap, &uinput->inode_bitmap);
    + err |= get_user(input.inode_table, &uinput->inode_table);
    + err |= get_user(input.blocks_count, &uinput->blocks_count);
    + err |= get_user(input.reserved_blocks,
    + &uinput->reserved_blocks);
    + if (err)
    + return -EFAULT;
    + old_fs = get_fs();
    + set_fs(KERNEL_DS);
    + err = ext4_ioctl(file, EXT4_IOC_GROUP_ADD,
    + (unsigned long) &input);
    + set_fs(old_fs);
    + return err;
    + }
    + case EXT4_IOC_MOVE_EXT:
    break;
    default:
    return -ENOIOCTLCMD;
    diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
    index 7d71148..04e07e2 100644
    --- a/fs/ext4/mballoc.c
    +++ b/fs/ext4/mballoc.c
    @@ -658,6 +658,27 @@ static void ext4_mb_mark_free_simple(struct super_block *sb,
    }
    }

    +/*
    + * Cache the order of the largest free extent we have available in this block
    + * group.
    + */
    +static void
    +mb_set_largest_free_order(struct super_block *sb, struct ext4_group_info *grp)
    +{
    + int i;
    + int bits;
    +
    + grp->bb_largest_free_order = -1; /* uninit */
    +
    + bits = sb->s_blocksize_bits + 1;
    + for (i = bits; i >= 0; i--) {
    + if (grp->bb_counters[i] > 0) {
    + grp->bb_largest_free_order = i;
    + break;
    + }
    + }
    +}
    +
    static noinline_for_stack
    void ext4_mb_generate_buddy(struct super_block *sb,
    void *buddy, void *bitmap, ext4_group_t group)
    @@ -700,6 +721,7 @@ void ext4_mb_generate_buddy(struct super_block *sb,
    */
    grp->bb_free = free;
    }
    + mb_set_largest_free_order(sb, grp);

    clear_bit(EXT4_GROUP_INFO_NEED_INIT_BIT, &(grp->bb_state));

    @@ -725,6 +747,9 @@ void ext4_mb_generate_buddy(struct super_block *sb,
    * contain blocks_per_page (PAGE_CACHE_SIZE / blocksize) blocks.
    * So it can have information regarding groups_per_page which
    * is blocks_per_page/2
    + *
    + * Locking note: This routine takes the block group lock of all groups
    + * for this page; do not hold this lock when calling this routine!
    */

    static int ext4_mb_init_cache(struct page *page, char *incore)
    @@ -910,6 +935,11 @@ out:
    return err;
    }

    +/*
    + * Locking note: This routine calls ext4_mb_init_cache(), which takes the
    + * block group lock of all groups for this page; do not hold the BG lock when
    + * calling this routine!
    + */
    static noinline_for_stack
    int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
    {
    @@ -1004,6 +1034,11 @@ err:
    return ret;
    }

    +/*
    + * Locking note: This routine calls ext4_mb_init_cache(), which takes the
    + * block group lock of all groups for this page; do not hold the BG lock when
    + * calling this routine!
    + */
    static noinline_for_stack int
    ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,
    struct ext4_buddy *e4b)
    @@ -1150,7 +1185,7 @@ err:
    return ret;
    }

    -static void ext4_mb_release_desc(struct ext4_buddy *e4b)
    +static void ext4_mb_unload_buddy(struct ext4_buddy *e4b)
    {
    if (e4b->bd_bitmap_page)
    page_cache_release(e4b->bd_bitmap_page);
    @@ -1300,6 +1335,7 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b,
    buddy = buddy2;
    } while (1);
    }
    + mb_set_largest_free_order(sb, e4b->bd_info);
    mb_check_buddy(e4b);
    }

    @@ -1428,6 +1464,7 @@ static int mb_mark_used(struct ext4_buddy *e4b, struct ext4_free_extent *ex)
    e4b->bd_info->bb_counters[ord]++;
    e4b->bd_info->bb_counters[ord]++;
    }
    + mb_set_largest_free_order(e4b->bd_sb, e4b->bd_info);

    mb_set_bits(EXT4_MB_BITMAP(e4b), ex->fe_start, len0);
    mb_check_buddy(e4b);
    @@ -1618,7 +1655,7 @@ int ext4_mb_try_best_found(struct ext4_allocation_context *ac,
    }

    ext4_unlock_group(ac->ac_sb, group);
    - ext4_mb_release_desc(e4b);
    + ext4_mb_unload_buddy(e4b);

    return 0;
    }
    @@ -1674,7 +1711,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac,
    ext4_mb_use_best_found(ac, e4b);
    }
    ext4_unlock_group(ac->ac_sb, group);
    - ext4_mb_release_desc(e4b);
    + ext4_mb_unload_buddy(e4b);

    return 0;
    }
    @@ -1823,16 +1860,22 @@ void ext4_mb_scan_aligned(struct ext4_allocation_context *ac,
    }
    }

    +/* This is now called BEFORE we load the buddy bitmap. */
    static int ext4_mb_good_group(struct ext4_allocation_context *ac,
    ext4_group_t group, int cr)
    {
    unsigned free, fragments;
    - unsigned i, bits;
    int flex_size = ext4_flex_bg_size(EXT4_SB(ac->ac_sb));
    struct ext4_group_info *grp = ext4_get_group_info(ac->ac_sb, group);

    BUG_ON(cr < 0 || cr >= 4);
    - BUG_ON(EXT4_MB_GRP_NEED_INIT(grp));
    +
    + /* We only do this if the grp has never been initialized */
    + if (unlikely(EXT4_MB_GRP_NEED_INIT(grp))) {
    + int ret = ext4_mb_init_group(ac->ac_sb, group);
    + if (ret)
    + return 0;
    + }

    free = grp->bb_free;
    fragments = grp->bb_fragments;
    @@ -1845,17 +1888,16 @@ static int ext4_mb_good_group(struct ext4_allocation_context *ac,
    case 0:
    BUG_ON(ac->ac_2order == 0);

    + if (grp->bb_largest_free_order < ac->ac_2order)
    + return 0;
    +
    /* Avoid using the first bg of a flexgroup for data files */
    if ((ac->ac_flags & EXT4_MB_HINT_DATA) &&
    (flex_size >= EXT4_FLEX_SIZE_DIR_ALLOC_SCHEME) &&
    ((group % flex_size) == 0))
    return 0;

    - bits = ac->ac_sb->s_blocksize_bits + 1;
    - for (i = ac->ac_2order; i <= bits; i++)
    - if (grp->bb_counters[i] > 0)
    - return 1;
    - break;
    + return 1;
    case 1:
    if ((free / fragments) >= ac->ac_g_ex.fe_len)
    return 1;
    @@ -1966,7 +2008,7 @@ ext4_mb_regular_allocator(struct ext4_allocation_context *ac)
    sbi = EXT4_SB(sb);
    ngroups = ext4_get_groups_count(sb);
    /* non-extent files are limited to low blocks/groups */
    - if (!(EXT4_I(ac->ac_inode)->i_flags & EXT4_EXTENTS_FL))
    + if (!(ext4_test_inode_flag(ac->ac_inode, EXT4_INODE_EXTENTS)))
    ngroups = sbi->s_blockfile_groups;

    BUG_ON(ac->ac_status == AC_STATUS_FOUND);
    @@ -2026,15 +2068,11 @@ repeat:
    group = ac->ac_g_ex.fe_group;

    for (i = 0; i < ngroups; group++, i++) {
    - struct ext4_group_info *grp;
    - struct ext4_group_desc *desc;
    -
    if (group == ngroups)
    group = 0;

    - /* quick check to skip empty groups */
    - grp = ext4_get_group_info(sb, group);
    - if (grp->bb_free == 0)
    + /* This now checks without needing the buddy page */
    + if (!ext4_mb_good_group(ac, group, cr))
    continue;

    err = ext4_mb_load_buddy(sb, group, &e4b);
    @@ -2042,15 +2080,18 @@ repeat:
    goto out;

    ext4_lock_group(sb, group);
    +
    + /*
    + * We need to check again after locking the
    + * block group
    + */
    if (!ext4_mb_good_group(ac, group, cr)) {
    - /* someone did allocation from this group */
    ext4_unlock_group(sb, group);
    - ext4_mb_release_desc(&e4b);
    + ext4_mb_unload_buddy(&e4b);
    continue;
    }

    ac->ac_groups_scanned++;
    - desc = ext4_get_group_desc(sb, group, NULL);
    if (cr == 0)
    ext4_mb_simple_scan_group(ac, &e4b);
    else if (cr == 1 &&
    @@ -2060,7 +2101,7 @@ repeat:
    ext4_mb_complex_scan_group(ac, &e4b);

    ext4_unlock_group(sb, group);
    - ext4_mb_release_desc(&e4b);
    + ext4_mb_unload_buddy(&e4b);

    if (ac->ac_status != AC_STATUS_CONTINUE)
    break;
    @@ -2150,7 +2191,7 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
    ext4_lock_group(sb, group);
    memcpy(&sg, ext4_get_group_info(sb, group), i);
    ext4_unlock_group(sb, group);
    - ext4_mb_release_desc(&e4b);
    + ext4_mb_unload_buddy(&e4b);

    seq_printf(seq, "#%-5u: %-5u %-5u %-5u [", group, sg.info.bb_free,
    sg.info.bb_fragments, sg.info.bb_first_free);
    @@ -2257,6 +2298,7 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group,
    INIT_LIST_HEAD(&meta_group_info[i]->bb_prealloc_list);
    init_rwsem(&meta_group_info[i]->alloc_sem);
    meta_group_info[i]->bb_free_root.rb_node = NULL;
    + meta_group_info[i]->bb_largest_free_order = -1; /* uninit */

    #ifdef DOUBLE_CHECK
    {
    @@ -2537,6 +2579,23 @@ static void release_blocks_on_commit(journal_t *journal, transaction_t *txn)
    mb_debug(1, "gonna free %u blocks in group %u (0x%p):",
    entry->count, entry->group, entry);

    + if (test_opt(sb, DISCARD)) {
    + int ret;
    + ext4_fsblk_t discard_block;
    +
    + discard_block = entry->start_blk +
    + ext4_group_first_block_no(sb, entry->group);
    + trace_ext4_discard_blocks(sb,
    + (unsigned long long)discard_block,
    + entry->count);
    + ret = sb_issue_discard(sb, discard_block, entry->count);
    + if (ret == EOPNOTSUPP) {
    + ext4_warning(sb, __func__,
    + "discard not supported, disabling");
    + clear_opt(EXT4_SB(sb)->s_mount_opt, DISCARD);
    + }
    + }
    +
    err = ext4_mb_load_buddy(sb, entry->group, &e4b);
    /* we expect to find existing buddy because it's pinned */
    BUG_ON(err != 0);
    @@ -2558,21 +2617,8 @@ static void release_blocks_on_commit(journal_t *journal, transaction_t *txn)
    page_cache_release(e4b.bd_bitmap_page);
    }
    ext4_unlock_group(sb, entry->group);
    - if (test_opt(sb, DISCARD)) {
    - ext4_fsblk_t discard_block;
    - struct ext4_super_block *es = EXT4_SB(sb)->s_es;
    -
    - discard_block = (ext4_fsblk_t)entry->group *
    - EXT4_BLOCKS_PER_GROUP(sb)
    - + entry->start_blk
    - + le32_to_cpu(es->s_first_data_block);
    - trace_ext4_discard_blocks(sb,
    - (unsigned long long)discard_block,
    - entry->count);
    - sb_issue_discard(sb, discard_block, entry->count);
    - }
    kmem_cache_free(ext4_free_ext_cachep, entry);
    - ext4_mb_release_desc(&e4b);
    + ext4_mb_unload_buddy(&e4b);
    }

    mb_debug(1, "freed %u blocks in %u structures\n", count, count2);
    @@ -2755,12 +2801,6 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
    if (!(ac->ac_flags & EXT4_MB_DELALLOC_RESERVED))
    /* release all the reserved blocks if non delalloc */
    percpu_counter_sub(&sbi->s_dirtyblocks_counter, reserv_blks);
    - else {
    - percpu_counter_sub(&sbi->s_dirtyblocks_counter,
    - ac->ac_b_ex.fe_len);
    - /* convert reserved quota blocks to real quota blocks */
    - vfs_dq_claim_block(ac->ac_inode, ac->ac_b_ex.fe_len);
    - }

    if (sbi->s_log_groups_per_flex) {
    ext4_group_t flex_group = ext4_flex_group(sbi,
    @@ -3136,7 +3176,7 @@ ext4_mb_use_preallocated(struct ext4_allocation_context *ac)
    continue;

    /* non-extent files can't have physical blocks past 2^32 */
    - if (!(EXT4_I(ac->ac_inode)->i_flags & EXT4_EXTENTS_FL) &&
    + if (!(ext4_test_inode_flag(ac->ac_inode, EXT4_INODE_EXTENTS)) &&
    pa->pa_pstart + pa->pa_len > EXT4_MAX_BLOCK_FILE_PHYS)
    continue;

    @@ -3715,7 +3755,7 @@ out:
    ext4_unlock_group(sb, group);
    if (ac)
    kmem_cache_free(ext4_ac_cachep, ac);
    - ext4_mb_release_desc(&e4b);
    + ext4_mb_unload_buddy(&e4b);
    put_bh(bitmap_bh);
    return free;
    }
    @@ -3819,7 +3859,7 @@ repeat:
    if (bitmap_bh == NULL) {
    ext4_error(sb, __func__, "Error in reading block "
    "bitmap for %u", group);
    - ext4_mb_release_desc(&e4b);
    + ext4_mb_unload_buddy(&e4b);
    continue;
    }

    @@ -3828,7 +3868,7 @@ repeat:
    ext4_mb_release_inode_pa(&e4b, bitmap_bh, pa, ac);
    ext4_unlock_group(sb, group);

    - ext4_mb_release_desc(&e4b);
    + ext4_mb_unload_buddy(&e4b);
    put_bh(bitmap_bh);

    list_del(&pa->u.pa_tmp_list);
    @@ -3944,7 +3984,7 @@ static void ext4_mb_group_or_file(struct ext4_allocation_context *ac)

    /* don't use group allocation for large files */
    size = max(size, isize);
    - if (size >= sbi->s_mb_stream_request) {
    + if (size > sbi->s_mb_stream_request) {
    ac->ac_flags |= EXT4_MB_STREAM_ALLOC;
    return;
    }
    @@ -4092,7 +4132,7 @@ ext4_mb_discard_lg_preallocations(struct super_block *sb,
    ext4_mb_release_group_pa(&e4b, pa, ac);
    ext4_unlock_group(sb, group);

    - ext4_mb_release_desc(&e4b);
    + ext4_mb_unload_buddy(&e4b);
    list_del(&pa->u.pa_tmp_list);
    call_rcu(&(pa)->u.pa_rcu, ext4_mb_pa_callback);
    }
    @@ -4594,7 +4634,7 @@ do_more:
    atomic_add(count, &sbi->s_flex_groups[flex_group].free_blocks);
    }

    - ext4_mb_release_desc(&e4b);
    + ext4_mb_unload_buddy(&e4b);

    *freed += count;

    diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
    index 8646149..7901f13 100644
    --- a/fs/ext4/migrate.c
    +++ b/fs/ext4/migrate.c
    @@ -357,12 +357,12 @@ static int ext4_ext_swap_inode_data(handle_t *handle, struct inode *inode,
    * happened after we started the migrate. We need to
    * fail the migrate
    */
    - if (!(EXT4_I(inode)->i_state & EXT4_STATE_EXT_MIGRATE)) {
    + if (!ext4_test_inode_state(inode, EXT4_STATE_EXT_MIGRATE)) {
    retval = -EAGAIN;
    up_write(&EXT4_I(inode)->i_data_sem);
    goto err_out;
    } else
    - EXT4_I(inode)->i_state &= ~EXT4_STATE_EXT_MIGRATE;
    + ext4_clear_inode_state(inode, EXT4_STATE_EXT_MIGRATE);
    /*
    * We have the extent map build with the tmp inode.
    * Now copy the i_data across
    @@ -465,7 +465,7 @@ int ext4_ext_migrate(struct inode *inode)
    */
    if (!EXT4_HAS_INCOMPAT_FEATURE(inode->i_sb,
    EXT4_FEATURE_INCOMPAT_EXTENTS) ||
    - (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
    + (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
    return -EINVAL;

    if (S_ISLNK(inode->i_mode) && inode->i_blocks == 0)
    @@ -494,14 +494,10 @@ int ext4_ext_migrate(struct inode *inode)
    }
    i_size_write(tmp_inode, i_size_read(inode));
    /*
    - * We don't want the inode to be reclaimed
    - * if we got interrupted in between. We have
    - * this tmp inode carrying reference to the
    - * data blocks of the original file. We set
    - * the i_nlink to zero at the last stage after
    - * switching the original file to extent format
    + * Set the i_nlink to zero so it will be deleted later
    + * when we drop inode reference.
    */
    - tmp_inode->i_nlink = 1;
    + tmp_inode->i_nlink = 0;

    ext4_ext_tree_init(handle, tmp_inode);
    ext4_orphan_add(handle, tmp_inode);
    @@ -524,10 +520,20 @@ int ext4_ext_migrate(struct inode *inode)
    * allocation.
    */
    down_read((&EXT4_I(inode)->i_data_sem));
    - EXT4_I(inode)->i_state |= EXT4_STATE_EXT_MIGRATE;
    + ext4_set_inode_state(inode, EXT4_STATE_EXT_MIGRATE);
    up_read((&EXT4_I(inode)->i_data_sem));

    handle = ext4_journal_start(inode, 1);
    + if (IS_ERR(handle)) {
    + /*
    + * It is impossible to update on-disk structures without
    + * a handle, so just rollback in-core changes and live other
    + * work to orphan_list_cleanup()
    + */
    + ext4_orphan_del(NULL, tmp_inode);
    + retval = PTR_ERR(handle);
    + goto out;
    + }

    ei = EXT4_I(inode);
    i_data = ei->i_data;
    @@ -609,15 +615,8 @@ err_out:

    /* Reset the extent details */
    ext4_ext_tree_init(handle, tmp_inode);
    -
    - /*
    - * Set the i_nlink to zero so that
    - * generic_drop_inode really deletes the
    - * inode
    - */
    - tmp_inode->i_nlink = 0;
    -
    ext4_journal_stop(handle);
    +out:
    unlock_new_inode(tmp_inode);
    iput(tmp_inode);

    diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
    index f5b03a1..5b14d11 100644
    --- a/fs/ext4/move_extent.c
    +++ b/fs/ext4/move_extent.c
    @@ -252,6 +252,7 @@ mext_insert_across_blocks(handle_t *handle, struct inode *orig_inode,
    }

    o_start->ee_len = start_ext->ee_len;
    + eblock = le32_to_cpu(start_ext->ee_block);
    new_flag = 1;

    } else if (start_ext->ee_len && new_ext->ee_len &&
    @@ -262,6 +263,7 @@ mext_insert_across_blocks(handle_t *handle, struct inode *orig_inode,
    * orig |------------------------------|
    */
    o_start->ee_len = start_ext->ee_len;
    + eblock = le32_to_cpu(start_ext->ee_block);
    new_flag = 1;

    } else if (!start_ext->ee_len && new_ext->ee_len &&
    @@ -475,7 +477,6 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
    struct ext4_extent *oext, *o_start, *o_end, *prev_ext;
    struct ext4_extent new_ext, start_ext, end_ext;
    ext4_lblk_t new_ext_end;
    - ext4_fsblk_t new_phys_end;
    int oext_alen, new_ext_alen, end_ext_alen;
    int depth = ext_depth(orig_inode);
    int ret;
    @@ -489,7 +490,6 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
    new_ext.ee_len = dext->ee_len;
    new_ext_alen = ext4_ext_get_actual_len(&new_ext);
    new_ext_end = le32_to_cpu(new_ext.ee_block) + new_ext_alen - 1;
    - new_phys_end = ext_pblock(&new_ext) + new_ext_alen - 1;

    /*
    * Case: original extent is first
    @@ -502,6 +502,7 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
    le32_to_cpu(oext->ee_block) + oext_alen) {
    start_ext.ee_len = cpu_to_le16(le32_to_cpu(new_ext.ee_block) -
    le32_to_cpu(oext->ee_block));
    + start_ext.ee_block = oext->ee_block;
    copy_extent_status(oext, &start_ext);
    } else if (oext > EXT_FIRST_EXTENT(orig_path[depth].p_hdr)) {
    prev_ext = oext - 1;
    @@ -515,6 +516,7 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
    start_ext.ee_len = cpu_to_le16(
    ext4_ext_get_actual_len(prev_ext) +
    new_ext_alen);
    + start_ext.ee_block = oext->ee_block;
    copy_extent_status(prev_ext, &start_ext);
    new_ext.ee_len = 0;
    }
    @@ -928,7 +930,7 @@ out2:
    }

    /**
    - * mext_check_argumants - Check whether move extent can be done
    + * mext_check_arguments - Check whether move extent can be done
    *
    * @orig_inode: original inode
    * @donor_inode: donor inode
    @@ -949,14 +951,6 @@ mext_check_arguments(struct inode *orig_inode,
    unsigned int blkbits = orig_inode->i_blkbits;
    unsigned int blocksize = 1 << blkbits;

    - /* Regular file check */
    - if (!S_ISREG(orig_inode->i_mode) || !S_ISREG(donor_inode->i_mode)) {
    - ext4_debug("ext4 move extent: The argument files should be "
    - "regular file [ino:orig %lu, donor %lu]\n",
    - orig_inode->i_ino, donor_inode->i_ino);
    - return -EINVAL;
    - }
    -
    if (donor_inode->i_mode & (S_ISUID|S_ISGID)) {
    ext4_debug("ext4 move extent: suid or sgid is set"
    " to donor file [ino:orig %lu, donor %lu]\n",
    @@ -981,11 +975,11 @@ mext_check_arguments(struct inode *orig_inode,
    }

    /* Ext4 move extent supports only extent based file */
    - if (!(EXT4_I(orig_inode)->i_flags & EXT4_EXTENTS_FL)) {
    + if (!(ext4_test_inode_flag(orig_inode, EXT4_INODE_EXTENTS))) {
    ext4_debug("ext4 move extent: orig file is not extents "
    "based file [ino:orig %lu]\n", orig_inode->i_ino);
    return -EOPNOTSUPP;
    - } else if (!(EXT4_I(donor_inode)->i_flags & EXT4_EXTENTS_FL)) {
    + } else if (!(ext4_test_inode_flag(donor_inode, EXT4_INODE_EXTENTS))) {
    ext4_debug("ext4 move extent: donor file is not extents "
    "based file [ino:donor %lu]\n", donor_inode->i_ino);
    return -EOPNOTSUPP;
    @@ -1204,6 +1198,14 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp,
    return -EINVAL;
    }

    + /* Regular file check */
    + if (!S_ISREG(orig_inode->i_mode) || !S_ISREG(donor_inode->i_mode)) {
    + ext4_debug("ext4 move extent: The argument files should be "
    + "regular file [ino:orig %lu, donor %lu]\n",
    + orig_inode->i_ino, donor_inode->i_ino);
    + return -EINVAL;
    + }
    +
    /* Protect orig and donor inodes against a truncate */
    ret1 = mext_inode_double_lock(orig_inode, donor_inode);
    if (ret1 < 0)
    diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
    index 17a17e1..c3b6ad0 100644
    --- a/fs/ext4/namei.c
    +++ b/fs/ext4/namei.c
    @@ -660,7 +660,7 @@ int ext4_htree_fill_tree(struct file *dir_file, __u32 start_hash,
    dxtrace(printk(KERN_DEBUG "In htree_fill_tree, start hash: %x:%x\n",
    start_hash, start_minor_hash));
    dir = dir_file->f_path.dentry->d_inode;
    - if (!(EXT4_I(dir)->i_flags & EXT4_INDEX_FL)) {
    + if (!(ext4_test_inode_flag(dir, EXT4_INODE_INDEX))) {
    hinfo.hash_version = EXT4_SB(dir->i_sb)->s_def_hash_version;
    if (hinfo.hash_version <= DX_HASH_TEA)
    hinfo.hash_version +=
    @@ -805,7 +805,7 @@ static void ext4_update_dx_flag(struct inode *inode)
    {
    if (!EXT4_HAS_COMPAT_FEATURE(inode->i_sb,
    EXT4_FEATURE_COMPAT_DIR_INDEX))
    - EXT4_I(inode)->i_flags &= ~EXT4_INDEX_FL;
    + ext4_clear_inode_flag(inode, EXT4_INODE_INDEX);
    }

    /*
    @@ -1424,7 +1424,7 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
    brelse(bh);
    return retval;
    }
    - EXT4_I(dir)->i_flags |= EXT4_INDEX_FL;
    + ext4_set_inode_flag(dir, EXT4_INODE_INDEX);
    data1 = bh2->b_data;

    memcpy (data1, de, len);
    @@ -1497,7 +1497,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
    retval = ext4_dx_add_entry(handle, dentry, inode);
    if (!retval || (retval != ERR_BAD_DX_DIR))
    return retval;
    - EXT4_I(dir)->i_flags &= ~EXT4_INDEX_FL;
    + ext4_clear_inode_flag(dir, EXT4_INODE_INDEX);
    dx_fallback++;
    ext4_mark_inode_dirty(handle, dir);
    }
    @@ -1525,6 +1525,8 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
    de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize);
    retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
    brelse(bh);
    + if (retval == 0)
    + ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY);
    return retval;
    }

    @@ -2020,11 +2022,18 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
    err = ext4_reserve_inode_write(handle, inode, &iloc);
    if (err)
    goto out_unlock;
    + /*
    + * Due to previous errors inode may be already a part of on-disk
    + * orphan list. If so skip on-disk list modification.
    + */
    + if (NEXT_ORPHAN(inode) && NEXT_ORPHAN(inode) <=
    + (le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count)))
    + goto mem_insert;

    /* Insert this inode at the head of the on-disk orphan list... */
    NEXT_ORPHAN(inode) = le32_to_cpu(EXT4_SB(sb)->s_es->s_last_orphan);
    EXT4_SB(sb)->s_es->s_last_orphan = cpu_to_le32(inode->i_ino);
    - err = ext4_handle_dirty_metadata(handle, inode, EXT4_SB(sb)->s_sbh);
    + err = ext4_handle_dirty_metadata(handle, NULL, EXT4_SB(sb)->s_sbh);
    rc = ext4_mark_iloc_dirty(handle, inode, &iloc);
    if (!err)
    err = rc;
    @@ -2037,6 +2046,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
    *
    * This is safe: on error we're going to ignore the orphan list
    * anyway on the next recovery. */
    +mem_insert:
    if (!err)
    list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan);

    @@ -2096,7 +2106,7 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
    if (err)
    goto out_brelse;
    sbi->s_es->s_last_orphan = cpu_to_le32(ino_next);
    - err = ext4_handle_dirty_metadata(handle, inode, sbi->s_sbh);
    + err = ext4_handle_dirty_metadata(handle, NULL, sbi->s_sbh);
    } else {
    struct ext4_iloc iloc2;
    struct inode *i_prev =
    @@ -2284,7 +2294,7 @@ retry:
    }
    } else {
    /* clear the extent format for fast symlink */
    - EXT4_I(inode)->i_flags &= ~EXT4_EXTENTS_FL;
    + ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
    inode->i_op = &ext4_fast_symlink_inode_operations;
    memcpy((char *)&EXT4_I(inode)->i_data, symname, l);
    inode->i_size = l-1;
    diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
    index 3b2c554..433ea27 100644
    --- a/fs/ext4/resize.c
    +++ b/fs/ext4/resize.c
    @@ -930,7 +930,8 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
    percpu_counter_add(&sbi->s_freeinodes_counter,
    EXT4_INODES_PER_GROUP(sb));

    - if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG)) {
    + if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG) &&
    + sbi->s_log_groups_per_flex) {
    ext4_group_t flex_group;
    flex_group = ext4_flex_group(sbi, input->group);
    atomic_add(input->free_blocks_count,
    diff --git a/fs/ext4/super.c b/fs/ext4/super.c
    index 92943f2..54a05cc 100644
    --- a/fs/ext4/super.c
    +++ b/fs/ext4/super.c
    @@ -227,6 +227,7 @@ handle_t *ext4_journal_start_sb(struct super_block *sb, int nblocks)
    if (sb->s_flags & MS_RDONLY)
    return ERR_PTR(-EROFS);

    + vfs_check_frozen(sb, SB_FREEZE_WRITE);
    /* Special case here: if the journal has aborted behind our
    * backs (eg. EIO in the commit thread), then we still need to
    * take the FS itself readonly cleanly. */
    @@ -702,6 +703,7 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
    ei->i_reserved_data_blocks = 0;
    ei->i_reserved_meta_blocks = 0;
    ei->i_allocated_meta_blocks = 0;
    + ei->i_da_metadata_calc_len = 0;
    ei->i_delalloc_reserved_flag = 0;
    spin_lock_init(&(ei->i_block_reservation_lock));
    #ifdef CONFIG_QUOTA
    @@ -875,6 +877,8 @@ static int ext4_show_options(struct seq_file *seq, struct vfsmount *vfs)
    seq_puts(seq, test_opt(sb, BARRIER) ? "1" : "0");
    if (test_opt(sb, JOURNAL_ASYNC_COMMIT))
    seq_puts(seq, ",journal_async_commit");
    + else if (test_opt(sb, JOURNAL_CHECKSUM))
    + seq_puts(seq, ",journal_checksum");
    if (test_opt(sb, NOBH))
    seq_puts(seq, ",nobh");
    if (test_opt(sb, I_VERSION))
    @@ -2693,24 +2697,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
    get_random_bytes(&sbi->s_next_generation, sizeof(u32));
    spin_lock_init(&sbi->s_next_gen_lock);

    - err = percpu_counter_init(&sbi->s_freeblocks_counter,
    - ext4_count_free_blocks(sb));
    - if (!err) {
    - err = percpu_counter_init(&sbi->s_freeinodes_counter,
    - ext4_count_free_inodes(sb));
    - }
    - if (!err) {
    - err = percpu_counter_init(&sbi->s_dirs_counter,
    - ext4_count_dirs(sb));
    - }
    - if (!err) {
    - err = percpu_counter_init(&sbi->s_dirtyblocks_counter, 0);
    - }
    - if (err) {
    - ext4_msg(sb, KERN_ERR, "insufficient memory");
    - goto failed_mount3;
    - }
    -
    sbi->s_stripe = ext4_get_stripe_size(sbi);
    sbi->s_max_writeback_mb_bump = 128;

    @@ -2830,7 +2816,20 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
    set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);

    no_journal:
    -
    + err = percpu_counter_init(&sbi->s_freeblocks_counter,
    + ext4_count_free_blocks(sb));
    + if (!err)
    + err = percpu_counter_init(&sbi->s_freeinodes_counter,
    + ext4_count_free_inodes(sb));
    + if (!err)
    + err = percpu_counter_init(&sbi->s_dirs_counter,
    + ext4_count_dirs(sb));
    + if (!err)
    + err = percpu_counter_init(&sbi->s_dirtyblocks_counter, 0);
    + if (err) {
    + ext4_msg(sb, KERN_ERR, "insufficient memory");
    + goto failed_mount_wq;
    + }
    if (test_opt(sb, NOBH)) {
    if (!(test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA)) {
    ext4_msg(sb, KERN_WARNING, "Ignoring nobh option - "
    @@ -2905,7 +2904,7 @@ no_journal:
    err = ext4_setup_system_zone(sb);
    if (err) {
    ext4_msg(sb, KERN_ERR, "failed to initialize system "
    - "zone (%d)\n", err);
    + "zone (%d)", err);
    goto failed_mount4;
    }

    @@ -2963,6 +2962,10 @@ failed_mount_wq:
    jbd2_journal_destroy(sbi->s_journal);
    sbi->s_journal = NULL;
    }
    + percpu_counter_destroy(&sbi->s_freeblocks_counter);
    + percpu_counter_destroy(&sbi->s_freeinodes_counter);
    + percpu_counter_destroy(&sbi->s_dirs_counter);
    + percpu_counter_destroy(&sbi->s_dirtyblocks_counter);
    failed_mount3:
    if (sbi->s_flex_groups) {
    if (is_vmalloc_addr(sbi->s_flex_groups))
    @@ -2970,10 +2973,6 @@ failed_mount3:
    else
    kfree(sbi->s_flex_groups);
    }
    - percpu_counter_destroy(&sbi->s_freeblocks_counter);
    - percpu_counter_destroy(&sbi->s_freeinodes_counter);
    - percpu_counter_destroy(&sbi->s_dirs_counter);
    - percpu_counter_destroy(&sbi->s_dirtyblocks_counter);
    failed_mount2:
    for (i = 0; i < db_count; i++)
    brelse(sbi->s_group_desc[i]);
    @@ -3390,8 +3389,10 @@ int ext4_force_commit(struct super_block *sb)
    return 0;

    journal = EXT4_SB(sb)->s_journal;
    - if (journal)
    + if (journal) {
    + vfs_check_frozen(sb, SB_FREEZE_WRITE);
    ret = ext4_journal_force_commit(journal);
    + }

    return ret;
    }
    @@ -3440,18 +3441,16 @@ static int ext4_freeze(struct super_block *sb)
    * the journal.
    */
    error = jbd2_journal_flush(journal);
    - if (error < 0) {
    - out:
    - jbd2_journal_unlock_updates(journal);
    - return error;
    - }
    + if (error < 0)
    + goto out;

    /* Journal blocked and flushed, clear needs_recovery flag. */
    EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
    error = ext4_commit_super(sb, 1);
    - if (error)
    - goto out;
    - return 0;
    +out:
    + /* we rely on s_frozen to stop further updates */
    + jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
    + return error;
    }

    /*
    @@ -3468,7 +3467,6 @@ static int ext4_unfreeze(struct super_block *sb)
    EXT4_SET_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
    ext4_commit_super(sb, 1);
    unlock_super(sb);
    - jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
    return 0;
    }

    @@ -4001,6 +3999,7 @@ static int __init init_ext4_fs(void)
    {
    int err;

    + ext4_check_flag_values();
    err = init_ext4_system_zone();
    if (err)
    return err;
    diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
    index 0257019..4de7d0a 100644
    --- a/fs/ext4/xattr.c
    +++ b/fs/ext4/xattr.c
    @@ -267,7 +267,7 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name,
    void *end;
    int error;

    - if (!(EXT4_I(inode)->i_state & EXT4_STATE_XATTR))
    + if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR))
    return -ENODATA;
    error = ext4_get_inode_loc(inode, &iloc);
    if (error)
    @@ -393,7 +393,7 @@ ext4_xattr_ibody_list(struct inode *inode, char *buffer, size_t buffer_size)
    void *end;
    int error;

    - if (!(EXT4_I(inode)->i_state & EXT4_STATE_XATTR))
    + if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR))
    return 0;
    error = ext4_get_inode_loc(inode, &iloc);
    if (error)
    @@ -816,7 +816,7 @@ inserted:
    EXT4_I(inode)->i_block_group);

    /* non-extent files can't have physical blocks past 2^32 */
    - if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
    + if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
    goal = goal & EXT4_MAX_BLOCK_FILE_PHYS;

    block = ext4_new_meta_blocks(handle, inode,
    @@ -824,7 +824,7 @@ inserted:
    if (error)
    goto cleanup;

    - if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
    + if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
    BUG_ON(block > EXT4_MAX_BLOCK_FILE_PHYS);

    ea_idebug(inode, "creating block %d", block);
    @@ -903,7 +903,7 @@ ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i,
    is->s.base = is->s.first = IFIRST(header);
    is->s.here = is->s.first;
    is->s.end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
    - if (EXT4_I(inode)->i_state & EXT4_STATE_XATTR) {
    + if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) {
    error = ext4_xattr_check_names(IFIRST(header), is->s.end);
    if (error)
    return error;
    @@ -935,10 +935,10 @@ ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
    header = IHDR(inode, ext4_raw_inode(&is->iloc));
    if (!IS_LAST_ENTRY(s->first)) {
    header->h_magic = cpu_to_le32(EXT4_XATTR_MAGIC);
    - EXT4_I(inode)->i_state |= EXT4_STATE_XATTR;
    + ext4_set_inode_state(inode, EXT4_STATE_XATTR);
    } else {
    header->h_magic = cpu_to_le32(0);
    - EXT4_I(inode)->i_state &= ~EXT4_STATE_XATTR;
    + ext4_clear_inode_state(inode, EXT4_STATE_XATTR);
    }
    return 0;
    }
    @@ -981,8 +981,8 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
    if (strlen(name) > 255)
    return -ERANGE;
    down_write(&EXT4_I(inode)->xattr_sem);
    - no_expand = EXT4_I(inode)->i_state & EXT4_STATE_NO_EXPAND;
    - EXT4_I(inode)->i_state |= EXT4_STATE_NO_EXPAND;
    + no_expand = ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND);
    + ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND);

    error = ext4_get_inode_loc(inode, &is.iloc);
    if (error)
    @@ -992,10 +992,10 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
    if (error)
    goto cleanup;

    - if (EXT4_I(inode)->i_state & EXT4_STATE_NEW) {
    + if (ext4_test_inode_state(inode, EXT4_STATE_NEW)) {
    struct ext4_inode *raw_inode = ext4_raw_inode(&is.iloc);
    memset(raw_inode, 0, EXT4_SB(inode->i_sb)->s_inode_size);
    - EXT4_I(inode)->i_state &= ~EXT4_STATE_NEW;
    + ext4_clear_inode_state(inode, EXT4_STATE_NEW);
    }

    error = ext4_xattr_ibody_find(inode, &i, &is);
    @@ -1047,7 +1047,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
    ext4_xattr_update_super_block(handle, inode->i_sb);
    inode->i_ctime = ext4_current_time(inode);
    if (!value)
    - EXT4_I(inode)->i_state &= ~EXT4_STATE_NO_EXPAND;
    + ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
    error = ext4_mark_iloc_dirty(handle, inode, &is.iloc);
    /*
    * The bh is consumed by ext4_mark_iloc_dirty, even with
    @@ -1062,7 +1062,7 @@ cleanup:
    brelse(is.iloc.bh);
    brelse(bs.bh);
    if (no_expand == 0)
    - EXT4_I(inode)->i_state &= ~EXT4_STATE_NO_EXPAND;
    + ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
    up_write(&EXT4_I(inode)->xattr_sem);
    return error;
    }
    @@ -1327,6 +1327,8 @@ retry:
    goto cleanup;
    kfree(b_entry_name);
    kfree(buffer);
    + b_entry_name = NULL;
    + buffer = NULL;
    brelse(is->iloc.bh);
    kfree(is);
    kfree(bs);
    diff --git a/fs/gfs2/acl.c b/fs/gfs2/acl.c
    index 3fc4e3a..2168da1 100644
    --- a/fs/gfs2/acl.c
    +++ b/fs/gfs2/acl.c
    @@ -12,6 +12,7 @@
    #include <linux/spinlock.h>
    #include <linux/completion.h>
    #include <linux/buffer_head.h>
    +#include <linux/xattr.h>
    #include <linux/posix_acl.h>
    #include <linux/posix_acl_xattr.h>
    #include <linux/gfs2_ondisk.h>
    @@ -26,61 +27,6 @@
    #include "trans.h"
    #include "util.h"

    -#define ACL_ACCESS 1
    -#define ACL_DEFAULT 0
    -
    -int gfs2_acl_validate_set(struct gfs2_inode *ip, int access,
    - struct gfs2_ea_request *er, int *remove, mode_t *mode)
    -{
    - struct posix_acl *acl;
    - int error;
    -
    - error = gfs2_acl_validate_remove(ip, access);
    - if (error)
    - return error;
    -
    - if (!er->er_data)
    - return -EINVAL;
    -
    - acl = posix_acl_from_xattr(er->er_data, er->er_data_len);
    - if (IS_ERR(acl))
    - return PTR_ERR(acl);
    - if (!acl) {
    - *remove = 1;
    - return 0;
    - }
    -
    - error = posix_acl_valid(acl);
    - if (error)
    - goto out;
    -
    - if (access) {
    - error = posix_acl_equiv_mode(acl, mode);
    - if (!error)
    - *remove = 1;
    - else if (error > 0)
    - error = 0;
    - }
    -
    -out:
    - posix_acl_release(acl);
    - return error;
    -}
    -
    -int gfs2_acl_validate_remove(struct gfs2_inode *ip, int access)
    -{
    - if (!GFS2_SB(&ip->i_inode)->sd_args.ar_posix_acl)
    - return -EOPNOTSUPP;
    - if (!is_owner_or_cap(&ip->i_inode))
    - return -EPERM;
    - if (S_ISLNK(ip->i_inode.i_mode))
    - return -EOPNOTSUPP;
    - if (!access && !S_ISDIR(ip->i_inode.i_mode))
    - return -EACCES;
    -
    - return 0;
    -}
    -
    static int acl_get(struct gfs2_inode *ip, const char *name,
    struct posix_acl **acl, struct gfs2_ea_location *el,
    char **datap, unsigned int *lenp)
    @@ -277,3 +223,117 @@ out_brelse:
    return error;
    }

    +static int gfs2_acl_type(const char *name)
    +{
    + if (strcmp(name, GFS2_POSIX_ACL_ACCESS) == 0)
    + return ACL_TYPE_ACCESS;
    + if (strcmp(name, GFS2_POSIX_ACL_DEFAULT) == 0)
    + return ACL_TYPE_DEFAULT;
    + return -EINVAL;
    +}
    +
    +static int gfs2_xattr_system_get(struct inode *inode, const char *name,
    + void *buffer, size_t size)
    +{
    + int type;
    +
    + type = gfs2_acl_type(name);
    + if (type < 0)
    + return type;
    +
    + return gfs2_xattr_get(inode, GFS2_EATYPE_SYS, name, buffer, size);
    +}
    +
    +static int gfs2_set_mode(struct inode *inode, mode_t mode)
    +{
    + int error = 0;
    +
    + if (mode != inode->i_mode) {
    + struct iattr iattr;
    +
    + iattr.ia_valid = ATTR_MODE;
    + iattr.ia_mode = mode;
    +
    + error = gfs2_setattr_simple(GFS2_I(inode), &iattr);
    + }
    +
    + return error;
    +}
    +
    +static int gfs2_xattr_system_set(struct inode *inode, const char *name,
    + const void *value, size_t size, int flags)
    +{
    + struct gfs2_sbd *sdp = GFS2_SB(inode);
    + struct posix_acl *acl = NULL;
    + int error = 0, type;
    +
    + if (!sdp->sd_args.ar_posix_acl)
    + return -EOPNOTSUPP;
    +
    + type = gfs2_acl_type(name);
    + if (type < 0)
    + return type;
    + if (flags & XATTR_CREATE)
    + return -EINVAL;
    + if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
    + return value ? -EACCES : 0;
    + if ((current_fsuid() != inode->i_uid) && !capable(CAP_FOWNER))
    + return -EPERM;
    + if (S_ISLNK(inode->i_mode))
    + return -EOPNOTSUPP;
    +
    + if (!value)
    + goto set_acl;
    +
    + acl = posix_acl_from_xattr(value, size);
    + if (!acl) {
    + /*
    + * acl_set_file(3) may request that we set default ACLs with
    + * zero length -- defend (gracefully) against that here.
    + */
    + goto out;
    + }
    + if (IS_ERR(acl)) {
    + error = PTR_ERR(acl);
    + goto out;
    + }
    +
    + error = posix_acl_valid(acl);
    + if (error)
    + goto out_release;
    +
    + error = -EINVAL;
    + if (acl->a_count > GFS2_ACL_MAX_ENTRIES)
    + goto out_release;
    +
    + if (type == ACL_TYPE_ACCESS) {
    + mode_t mode = inode->i_mode;
    + error = posix_acl_equiv_mode(acl, &mode);
    +
    + if (error <= 0) {
    + posix_acl_release(acl);
    + acl = NULL;
    +
    + if (error < 0)
    + return error;
    + }
    +
    + error = gfs2_set_mode(inode, mode);
    + if (error)
    + goto out_release;
    + }
    +
    +set_acl:
    + error = gfs2_xattr_set(inode, GFS2_EATYPE_SYS, name, value, size, 0);
    +out_release:
    + posix_acl_release(acl);
    +out:
    + return error;
    +}
    +
    +struct xattr_handler gfs2_xattr_system_handler = {
    + .prefix = XATTR_SYSTEM_PREFIX,
    + .get = gfs2_xattr_system_get,
    + .set = gfs2_xattr_system_set,
    +};
    +
    diff --git a/fs/gfs2/acl.h b/fs/gfs2/acl.h
    index 6751930..cc95439 100644
    --- a/fs/gfs2/acl.h
    +++ b/fs/gfs2/acl.h
    @@ -13,26 +13,12 @@
    #include "incore.h"

    #define GFS2_POSIX_ACL_ACCESS "posix_acl_access"
    -#define GFS2_POSIX_ACL_ACCESS_LEN 16
    #define GFS2_POSIX_ACL_DEFAULT "posix_acl_default"
    -#define GFS2_POSIX_ACL_DEFAULT_LEN 17
    +#define GFS2_ACL_MAX_ENTRIES 25

    -#define GFS2_ACL_IS_ACCESS(name, len) \
    - ((len) == GFS2_POSIX_ACL_ACCESS_LEN && \
    - !memcmp(GFS2_POSIX_ACL_ACCESS, (name), (len)))
    -
    -#define GFS2_ACL_IS_DEFAULT(name, len) \
    - ((len) == GFS2_POSIX_ACL_DEFAULT_LEN && \
    - !memcmp(GFS2_POSIX_ACL_DEFAULT, (name), (len)))
    -
    -struct gfs2_ea_request;
    -
    -int gfs2_acl_validate_set(struct gfs2_inode *ip, int access,
    - struct gfs2_ea_request *er,
    - int *remove, mode_t *mode);
    -int gfs2_acl_validate_remove(struct gfs2_inode *ip, int access);
    -int gfs2_check_acl(struct inode *inode, int mask);
    -int gfs2_acl_create(struct gfs2_inode *dip, struct gfs2_inode *ip);
    -int gfs2_acl_chmod(struct gfs2_inode *ip, struct iattr *attr);
    +extern int gfs2_check_acl(struct inode *inode, int mask);
    +extern int gfs2_acl_create(struct gfs2_inode *dip, struct gfs2_inode *ip);
    +extern int gfs2_acl_chmod(struct gfs2_inode *ip, struct iattr *attr);
    +extern struct xattr_handler gfs2_xattr_system_handler;

    #endif /* __ACL_DOT_H__ */
    diff --git a/fs/gfs2/xattr.c b/fs/gfs2/xattr.c
    index 8a0f8ef..6b80354 100644
    --- a/fs/gfs2/xattr.c
    +++ b/fs/gfs2/xattr.c
    @@ -1507,18 +1507,6 @@ static int gfs2_xattr_user_set(struct inode *inode, const char *name,
    return gfs2_xattr_set(inode, GFS2_EATYPE_USR, name, value, size, flags);
    }

    -static int gfs2_xattr_system_get(struct inode *inode, const char *name,
    - void *buffer, size_t size)
    -{
    - return gfs2_xattr_get(inode, GFS2_EATYPE_SYS, name, buffer, size);
    -}
    -
    -static int gfs2_xattr_system_set(struct inode *inode, const char *name,
    - const void *value, size_t size, int flags)
    -{
    - return gfs2_xattr_set(inode, GFS2_EATYPE_SYS, name, value, size, flags);
    -}
    -
    static int gfs2_xattr_security_get(struct inode *inode, const char *name,
    void *buffer, size_t size)
    {
    @@ -1543,12 +1531,6 @@ static struct xattr_handler gfs2_xattr_security_handler = {
    .set = gfs2_xattr_security_set,
    };

    -static struct xattr_handler gfs2_xattr_system_handler = {
    - .prefix = XATTR_SYSTEM_PREFIX,
    - .get = gfs2_xattr_system_get,
    - .set = gfs2_xattr_system_set,
    -};
    -
    struct xattr_handler *gfs2_xattr_handlers[] = {
    &gfs2_xattr_user_handler,
    &gfs2_xattr_security_handler,
    diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
    index ca0f5eb..8868493 100644
    --- a/fs/jbd2/checkpoint.c
    +++ b/fs/jbd2/checkpoint.c
    @@ -22,6 +22,7 @@
    #include <linux/jbd2.h>
    #include <linux/errno.h>
    #include <linux/slab.h>
    +#include <linux/blkdev.h>
    #include <trace/events/jbd2.h>

    /*
    @@ -515,6 +516,20 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
    journal->j_tail_sequence = first_tid;
    journal->j_tail = blocknr;
    spin_unlock(&journal->j_state_lock);
    +
    + /*
    + * If there is an external journal, we need to make sure that
    + * any data blocks that were recently written out --- perhaps
    + * by jbd2_log_do_checkpoint() --- are flushed out before we
    + * drop the transactions from the external journal. It's
    + * unlikely this will be necessary, especially with a
    + * appropriately sized journal, but we need this to guarantee
    + * correctness. Fortunately jbd2_cleanup_journal_tail()
    + * doesn't get called all that often.
    + */
    + if ((journal->j_fs_dev != journal->j_dev) &&
    + (journal->j_flags & JBD2_BARRIER))
    + blkdev_issue_flush(journal->j_fs_dev, NULL);
    if (!(journal->j_flags & JBD2_ABORT))
    jbd2_journal_update_superblock(journal, 1);
    return 0;
    diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
    index 8896c1d..09ab6ac 100644
    --- a/fs/jbd2/commit.c
    +++ b/fs/jbd2/commit.c
    @@ -259,6 +259,7 @@ static int journal_submit_data_buffers(journal_t *journal,
    ret = err;
    spin_lock(&journal->j_list_lock);
    J_ASSERT(jinode->i_transaction == commit_transaction);
    + commit_transaction->t_flushed_data_blocks = 1;
    jinode->i_flags &= ~JI_COMMIT_RUNNING;
    wake_up_bit(&jinode->i_flags, __JI_COMMIT_RUNNING);
    }
    @@ -708,8 +709,17 @@ start_journal_io:
    }
    }

    - /* Done it all: now write the commit record asynchronously. */
    + /*
    + * If the journal is not located on the file system device,
    + * then we must flush the file system device before we issue
    + * the commit record
    + */
    + if (commit_transaction->t_flushed_data_blocks &&
    + (journal->j_fs_dev != journal->j_dev) &&
    + (journal->j_flags & JBD2_BARRIER))
    + blkdev_issue_flush(journal->j_fs_dev, NULL);

    + /* Done it all: now write the commit record asynchronously. */
    if (JBD2_HAS_INCOMPAT_FEATURE(journal,
    JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT)) {
    err = journal_submit_commit_record(journal, commit_transaction,
    @@ -720,13 +730,6 @@ start_journal_io:
    blkdev_issue_flush(journal->j_dev, NULL);
    }

    - /*
    - * This is the right place to wait for data buffers both for ASYNC
    - * and !ASYNC commit. If commit is ASYNC, we need to wait only after
    - * the commit block went to disk (which happens above). If commit is
    - * SYNC, we need to wait for data buffers before we start writing
    - * commit block, which happens below in such setting.
    - */
    err = journal_finish_inode_data_buffers(journal, commit_transaction);
    if (err) {
    printk(KERN_WARNING
    diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
    index a4cd1b7..5ec74cd 100644
    --- a/fs/nfs/nfs4xdr.c
    +++ b/fs/nfs/nfs4xdr.c
    @@ -840,8 +840,8 @@ static void encode_attrs(struct xdr_stream *xdr, const struct iattr *iap, const
    bmval1 |= FATTR4_WORD1_TIME_ACCESS_SET;
    *p++ = cpu_to_be32(NFS4_SET_TO_CLIENT_TIME);
    *p++ = cpu_to_be32(0);
    - *p++ = cpu_to_be32(iap->ia_mtime.tv_sec);
    - *p++ = cpu_to_be32(iap->ia_mtime.tv_nsec);
    + *p++ = cpu_to_be32(iap->ia_atime.tv_sec);
    + *p++ = cpu_to_be32(iap->ia_atime.tv_nsec);
    }
    else if (iap->ia_valid & ATTR_ATIME) {
    bmval1 |= FATTR4_WORD1_TIME_ACCESS_SET;
    diff --git a/fs/nfs/super.c b/fs/nfs/super.c
    index 4bf23f6..a53b9e5 100644
    --- a/fs/nfs/super.c
    +++ b/fs/nfs/super.c
    @@ -534,6 +534,22 @@ static void nfs_show_mountd_options(struct seq_file *m, struct nfs_server *nfss,
    }
    }

    +#ifdef CONFIG_NFS_V4
    +static void nfs_show_nfsv4_options(struct seq_file *m, struct nfs_server *nfss,
    + int showdefaults)
    +{
    + struct nfs_client *clp = nfss->nfs_client;
    +
    + seq_printf(m, ",clientaddr=%s", clp->cl_ipaddr);
    + seq_printf(m, ",minorversion=%u", clp->cl_minorversion);
    +}
    +#else
    +static void nfs_show_nfsv4_options(struct seq_file *m, struct nfs_server *nfss,
    + int showdefaults)
    +{
    +}
    +#endif
    +
    /*
    * Describe the mount options in force on this server representation
    */
    @@ -595,11 +611,9 @@ static void nfs_show_mount_options(struct seq_file *m, struct nfs_server *nfss,

    if (version != 4)
    nfs_show_mountd_options(m, nfss, showdefaults);
    + else
    + nfs_show_nfsv4_options(m, nfss, showdefaults);

    -#ifdef CONFIG_NFS_V4
    - if (clp->rpc_ops->version == 4)
    - seq_printf(m, ",clientaddr=%s", clp->cl_ipaddr);
    -#endif
    if (nfss->options & NFS_OPTION_FSCACHE)
    seq_printf(m, ",fsc");
    }
    diff --git a/include/acpi/processor.h b/include/acpi/processor.h
    index 740ac3a..e7bdaaf 100644
    --- a/include/acpi/processor.h
    +++ b/include/acpi/processor.h
    @@ -48,7 +48,7 @@ struct acpi_power_register {
    u8 space_id;
    u8 bit_width;
    u8 bit_offset;
    - u8 reserved;
    + u8 access_size;
    u64 address;
    } __attribute__ ((packed));

    @@ -74,6 +74,7 @@ struct acpi_processor_cx {
    u32 power;
    u32 usage;
    u64 time;
    + u8 bm_sts_skip;
    struct acpi_processor_cx_policy promotion;
    struct acpi_processor_cx_policy demotion;
    char desc[ACPI_CX_DESC_LEN];
    diff --git a/include/linux/acpi.h b/include/linux/acpi.h
    index 07432a1..c010b94 100644
    --- a/include/linux/acpi.h
    +++ b/include/linux/acpi.h
    @@ -251,7 +251,6 @@ int acpi_check_mem_region(resource_size_t start, resource_size_t n,
    void __init acpi_no_s4_hw_signature(void);
    void __init acpi_old_suspend_ordering(void);
    void __init acpi_s4_no_nvs(void);
    -void __init acpi_set_sci_en_on_resume(void);
    #endif /* CONFIG_PM_SLEEP */

    struct acpi_osc_context {
    diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
    index 15e4eb7..7ffab7c 100644
    --- a/include/linux/ethtool.h
    +++ b/include/linux/ethtool.h
    @@ -357,6 +357,8 @@ struct ethtool_rxnfc {
    __u32 flow_type;
    /* The rx flow hash value or the rule DB size */
    __u64 data;
    + /* The following fields are not valid and must not be used for
    + * the ETHTOOL_{G,X}RXFH commands. */
    struct ethtool_rx_flow_spec fs;
    __u32 rule_cnt;
    __u32 rule_locs[0];
    diff --git a/include/linux/fb.h b/include/linux/fb.h
    index de9c722..862e7d4 100644
    --- a/include/linux/fb.h
    +++ b/include/linux/fb.h
    @@ -784,8 +784,6 @@ struct fb_tile_ops {
    #define FBINFO_MISC_USEREVENT 0x10000 /* event request
    from userspace */
    #define FBINFO_MISC_TILEBLITTING 0x20000 /* use tile blitting */
    -#define FBINFO_MISC_FIRMWARE 0x40000 /* a replaceable firmware
    - inited framebuffer */

    /* A driver may set this flag to indicate that it does want a set_par to be
    * called every time when fbcon_switch is executed. The advantage is that with
    @@ -799,6 +797,8 @@ struct fb_tile_ops {
    */
    #define FBINFO_MISC_ALWAYS_SETPAR 0x40000

    +/* where the fb is a firmware driver, and can be replaced with a proper one */
    +#define FBINFO_MISC_FIRMWARE 0x80000
    /*
    * Host and GPU endianness differ.
    */
    diff --git a/include/linux/firmware.h b/include/linux/firmware.h
    index d315446..83d7510 100644
    --- a/include/linux/firmware.h
    +++ b/include/linux/firmware.h
    @@ -11,6 +11,7 @@
    struct firmware {
    size_t size;
    const u8 *data;
    + struct page **pages;
    };

    struct device;
    diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
    index 52e15e0..e766072 100644
    --- a/include/linux/ieee80211.h
    +++ b/include/linux/ieee80211.h
    @@ -1098,6 +1098,8 @@ enum ieee80211_category {
    WLAN_CATEGORY_SA_QUERY = 8,
    WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION = 9,
    WLAN_CATEGORY_WMM = 17,
    + WLAN_CATEGORY_MESH_PLINK = 30, /* Pending ANA approval */
    + WLAN_CATEGORY_MESH_PATH_SEL = 32, /* Pending ANA approval */
    WLAN_CATEGORY_VENDOR_SPECIFIC_PROTECTED = 126,
    WLAN_CATEGORY_VENDOR_SPECIFIC = 127,
    };
    diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
    index f1011f7..638ce45 100644
    --- a/include/linux/jbd2.h
    +++ b/include/linux/jbd2.h
    @@ -653,6 +653,7 @@ struct transaction_s
    * waiting for it to finish.
    */
    unsigned int t_synchronous_commit:1;
    + unsigned int t_flushed_data_blocks:1;

    /*
    * For use by the filesystem to store fs-specific data
    diff --git a/include/linux/mmc/sdio.h b/include/linux/mmc/sdio.h
    index 47ba464..118f029 100644
    --- a/include/linux/mmc/sdio.h
    +++ b/include/linux/mmc/sdio.h
    @@ -94,6 +94,8 @@

    #define SDIO_BUS_WIDTH_1BIT 0x00
    #define SDIO_BUS_WIDTH_4BIT 0x02
    +#define SDIO_BUS_ECSI 0x20 /* Enable continuous SPI interrupt */
    +#define SDIO_BUS_SCSI 0x40 /* Support continuous SPI interrupt */

    #define SDIO_BUS_CD_DISABLE 0x80 /* disable pull-up on DAT3 (pin 1) */

    diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
    index 3d0a9ff..a28c37d 100644
    --- a/include/linux/ssb/ssb.h
    +++ b/include/linux/ssb/ssb.h
    @@ -302,6 +302,7 @@ struct ssb_bus {
    u16 chip_id;
    u16 chip_rev;
    u16 sprom_size; /* number of words in sprom */
    + u16 sprom_offset;
    u8 chip_package;

    /* List of devices (cores) on the backplane. */
    diff --git a/include/linux/ssb/ssb_driver_chipcommon.h b/include/linux/ssb/ssb_driver_chipcommon.h
    index 4e27acf..7600f38 100644
    --- a/include/linux/ssb/ssb_driver_chipcommon.h
    +++ b/include/linux/ssb/ssb_driver_chipcommon.h
    @@ -46,6 +46,7 @@
    #define SSB_PLLTYPE_7 0x00038000 /* 25Mhz, 4 dividers */
    #define SSB_CHIPCO_CAP_PCTL 0x00040000 /* Power Control */
    #define SSB_CHIPCO_CAP_OTPS 0x00380000 /* OTP size */
    +#define SSB_CHIPCO_CAP_SPROM 0x40000000 /* SPROM present */
    #define SSB_CHIPCO_CAP_OTPS_SHIFT 19
    #define SSB_CHIPCO_CAP_OTPS_BASE 5
    #define SSB_CHIPCO_CAP_JTAGM 0x00400000 /* JTAG master present */
    @@ -564,6 +565,7 @@ struct ssb_chipcommon_pmu {
    struct ssb_chipcommon {
    struct ssb_device *dev;
    u32 capabilities;
    + u32 status;
    /* Fast Powerup Delay constant */
    u16 fast_pwrup_delay;
    struct ssb_chipcommon_pmu pmu;
    diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
    index 9ae9082..b8be23c 100644
    --- a/include/linux/ssb/ssb_regs.h
    +++ b/include/linux/ssb/ssb_regs.h
    @@ -170,7 +170,8 @@
    #define SSB_SPROMSIZE_WORDS_R4 220
    #define SSB_SPROMSIZE_BYTES_R123 (SSB_SPROMSIZE_WORDS_R123 * sizeof(u16))
    #define SSB_SPROMSIZE_BYTES_R4 (SSB_SPROMSIZE_WORDS_R4 * sizeof(u16))
    -#define SSB_SPROM_BASE 0x1000
    +#define SSB_SPROM_BASE1 0x1000
    +#define SSB_SPROM_BASE31 0x0800
    #define SSB_SPROM_REVISION 0x107E
    #define SSB_SPROM_REVISION_REV 0x00FF /* SPROM Revision number */
    #define SSB_SPROM_REVISION_CRC 0xFF00 /* SPROM CRC8 value */
    diff --git a/include/math-emu/op-common.h b/include/math-emu/op-common.h
    index f456534..3e2576d 100644
    --- a/include/math-emu/op-common.h
    +++ b/include/math-emu/op-common.h
    @@ -799,7 +799,7 @@ do { \
    X##_e -= (_FP_W_TYPE_SIZE - rsize); \
    X##_e = rsize - X##_e - 1; \
    \
    - if (_FP_FRACBITS_##fs < rsize && _FP_WFRACBITS_##fs < X##_e) \
    + if (_FP_FRACBITS_##fs < rsize && _FP_WFRACBITS_##fs <= X##_e) \
    __FP_FRAC_SRS_1(ur_, (X##_e - _FP_WFRACBITS_##fs + 1), rsize);\
    _FP_FRAC_DISASSEMBLE_##wc(X, ur_, rsize); \
    if ((_FP_WFRACBITS_##fs - X##_e - 1) > 0) \
    diff --git a/kernel/futex.c b/kernel/futex.c
    index 1ad4fa6..3071911 100644
    --- a/kernel/futex.c
    +++ b/kernel/futex.c
    @@ -429,20 +429,11 @@ static void free_pi_state(struct futex_pi_state *pi_state)
    static struct task_struct * futex_find_get_task(pid_t pid)
    {
    struct task_struct *p;
    - const struct cred *cred = current_cred(), *pcred;

    rcu_read_lock();
    p = find_task_by_vpid(pid);
    - if (!p) {
    - p = ERR_PTR(-ESRCH);
    - } else {
    - pcred = __task_cred(p);
    - if (cred->euid != pcred->euid &&
    - cred->euid != pcred->uid)
    - p = ERR_PTR(-ESRCH);
    - else
    - get_task_struct(p);
    - }
    + if (p)
    + get_task_struct(p);

    rcu_read_unlock();

    @@ -564,8 +555,8 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
    if (!pid)
    return -ESRCH;
    p = futex_find_get_task(pid);
    - if (IS_ERR(p))
    - return PTR_ERR(p);
    + if (!p)
    + return -ESRCH;

    /*
    * We need to look at the task state flags to figure out,
    diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
    index 986519e..fa4bdd4 100644
    --- a/kernel/irq/manage.c
    +++ b/kernel/irq/manage.c
    @@ -436,6 +436,9 @@ int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
    /* note that IRQF_TRIGGER_MASK == IRQ_TYPE_SENSE_MASK */
    desc->status &= ~(IRQ_LEVEL | IRQ_TYPE_SENSE_MASK);
    desc->status |= flags;
    +
    + if (chip != desc->chip)
    + irq_chip_set_defaults(desc->chip);
    }

    return ret;
    diff --git a/kernel/module.c b/kernel/module.c
    index dfa33e8..4b270e6 100644
    --- a/kernel/module.c
    +++ b/kernel/module.c
    @@ -870,7 +870,6 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
    mutex_lock(&module_mutex);
    /* Store the name of the last unloaded module for diagnostic purposes */
    strlcpy(last_unloaded_module, mod->name, sizeof(last_unloaded_module));
    - ddebug_remove_module(mod->name);
    free_module(mod);

    out:
    @@ -1533,6 +1532,9 @@ static void free_module(struct module *mod)
    remove_sect_attrs(mod);
    mod_kobject_remove(mod);

    + /* Remove dynamic debug info */
    + ddebug_remove_module(mod->name);
    +
    /* Arch-specific cleanup. */
    module_arch_cleanup(mod);

    diff --git a/kernel/sched.c b/kernel/sched.c
    index 34d924e..a0157c7 100644
    --- a/kernel/sched.c
    +++ b/kernel/sched.c
    @@ -1261,6 +1261,12 @@ static void sched_avg_update(struct rq *rq)
    s64 period = sched_avg_period();

    while ((s64)(rq->clock - rq->age_stamp) > period) {
    + /*
    + * Inline assembly required to prevent the compiler
    + * optimising this loop into a divmod call.
    + * See __iter_div_u64_rem() for another example of this.
    + */
    + asm("" : "+rm" (rq->age_stamp));
    rq->age_stamp += period;
    rq->rt_avg /= 2;
    }
    @@ -1711,9 +1717,6 @@ static void update_shares_locked(struct rq *rq, struct sched_domain *sd)

    static void update_h_load(long cpu)
    {
    - if (root_task_group_empty())
    - return;
    -
    walk_tg_tree(tg_load_down, tg_nop, (void *)cpu);
    }

    diff --git a/net/core/ethtool.c b/net/core/ethtool.c
    index 4c12ddb..5aef51e 100644
    --- a/net/core/ethtool.c
    +++ b/net/core/ethtool.c
    @@ -216,22 +216,34 @@ static int ethtool_get_drvinfo(struct net_device *dev, void __user *useraddr)
    return 0;
    }

    -static int ethtool_set_rxnfc(struct net_device *dev, void __user *useraddr)
    +static int ethtool_set_rxnfc(struct net_device *dev,
    + u32 cmd, void __user *useraddr)
    {
    - struct ethtool_rxnfc cmd;
    + struct ethtool_rxnfc info;
    + size_t info_size = sizeof(info);

    if (!dev->ethtool_ops->set_rxnfc)
    return -EOPNOTSUPP;

    - if (copy_from_user(&cmd, useraddr, sizeof(cmd)))
    + /* struct ethtool_rxnfc was originally defined for
    + * ETHTOOL_{G,S}RXFH with only the cmd, flow_type and data
    + * members. User-space might still be using that
    + * definition. */
    + if (cmd == ETHTOOL_SRXFH)
    + info_size = (offsetof(struct ethtool_rxnfc, data) +
    + sizeof(info.data));
    +
    + if (copy_from_user(&info, useraddr, info_size))
    return -EFAULT;

    - return dev->ethtool_ops->set_rxnfc(dev, &cmd);
    + return dev->ethtool_ops->set_rxnfc(dev, &info);
    }

    -static int ethtool_get_rxnfc(struct net_device *dev, void __user *useraddr)
    +static int ethtool_get_rxnfc(struct net_device *dev,
    + u32 cmd, void __user *useraddr)
    {
    struct ethtool_rxnfc info;
    + size_t info_size = sizeof(info);
    const struct ethtool_ops *ops = dev->ethtool_ops;
    int ret;
    void *rule_buf = NULL;
    @@ -239,13 +251,22 @@ static int ethtool_get_rxnfc(struct net_device *dev, void __user *useraddr)
    if (!ops->get_rxnfc)
    return -EOPNOTSUPP;

    - if (copy_from_user(&info, useraddr, sizeof(info)))
    + /* struct ethtool_rxnfc was originally defined for
    + * ETHTOOL_{G,S}RXFH with only the cmd, flow_type and data
    + * members. User-space might still be using that
    + * definition. */
    + if (cmd == ETHTOOL_GRXFH)
    + info_size = (offsetof(struct ethtool_rxnfc, data) +
    + sizeof(info.data));
    +
    + if (copy_from_user(&info, useraddr, info_size))
    return -EFAULT;

    if (info.cmd == ETHTOOL_GRXCLSRLALL) {
    if (info.rule_cnt > 0) {
    - rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
    - GFP_USER);
    + if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
    + rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
    + GFP_USER);
    if (!rule_buf)
    return -ENOMEM;
    }
    @@ -256,7 +277,7 @@ static int ethtool_get_rxnfc(struct net_device *dev, void __user *useraddr)
    goto err_out;

    ret = -EFAULT;
    - if (copy_to_user(useraddr, &info, sizeof(info)))
    + if (copy_to_user(useraddr, &info, info_size))
    goto err_out;

    if (rule_buf) {
    @@ -1111,12 +1132,12 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
    case ETHTOOL_GRXCLSRLCNT:
    case ETHTOOL_GRXCLSRULE:
    case ETHTOOL_GRXCLSRLALL:
    - rc = ethtool_get_rxnfc(dev, useraddr);
    + rc = ethtool_get_rxnfc(dev, ethcmd, useraddr);
    break;
    case ETHTOOL_SRXFH:
    case ETHTOOL_SRXCLSRLDEL:
    case ETHTOOL_SRXCLSRLINS:
    - rc = ethtool_set_rxnfc(dev, useraddr);
    + rc = ethtool_set_rxnfc(dev, ethcmd, useraddr);
    break;
    case ETHTOOL_GGRO:
    rc = ethtool_get_gro(dev, useraddr);
    diff --git a/net/core/neighbour.c b/net/core/neighbour.c
    index e587e68..e696250 100644
    --- a/net/core/neighbour.c
    +++ b/net/core/neighbour.c
    @@ -945,7 +945,10 @@ static void neigh_update_hhs(struct neighbour *neigh)
    {
    struct hh_cache *hh;
    void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
    - = neigh->dev->header_ops->cache_update;
    + = NULL;
    +
    + if (neigh->dev->header_ops)
    + update = neigh->dev->header_ops->cache_update;

    if (update) {
    for (hh = neigh->hh; hh; hh = hh->hh_next) {
    diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    index fcd278a..af83bdf 100644
    --- a/net/ipv4/tcp_output.c
    +++ b/net/ipv4/tcp_output.c
    @@ -2037,6 +2037,9 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
    int mib_idx;
    int fwd_rexmitting = 0;

    + if (!tp->packets_out)
    + return;
    +
    if (!tp->lost_out)
    tp->retransmit_high = tp->snd_una;

    diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
    index 5a7f00c..1264ad0 100644
    --- a/net/ipv6/netfilter/ip6t_REJECT.c
    +++ b/net/ipv6/netfilter/ip6t_REJECT.c
    @@ -95,9 +95,11 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
    fl.fl_ip_dport = otcph.source;
    security_skb_classify_flow(oldskb, &fl);
    dst = ip6_route_output(net, NULL, &fl);
    - if (dst == NULL)
    + if (dst == NULL || dst->error) {
    + dst_release(dst);
    return;
    - if (dst->error || xfrm_lookup(net, &dst, &fl, NULL, 0))
    + }
    + if (xfrm_lookup(net, &dst, &fl, NULL, 0))
    return;

    hh_len = (dst->dev->hard_header_len + 15)&~15;
    diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
    index 4a15df1..5bea319 100644
    --- a/net/mac80211/mlme.c
    +++ b/net/mac80211/mlme.c
    @@ -269,12 +269,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
    if (wk->bss->wmm_used)
    wmm = 1;

    - /* get all rates supported by the device and the AP as
    - * some APs don't like getting a superset of their rates
    - * in the association request (e.g. D-Link DAP 1353 in
    - * b-only mode) */
    - rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates);
    -
    if ((wk->bss->cbss.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
    (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
    capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
    @@ -309,6 +303,17 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
    *pos++ = wk->ssid_len;
    memcpy(pos, wk->ssid, wk->ssid_len);

    + if (wk->bss->supp_rates_len) {
    + /* get all rates supported by the device and the AP as
    + * some APs don't like getting a superset of their rates
    + * in the association request (e.g. D-Link DAP 1353 in
    + * b-only mode) */
    + rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates);
    + } else {
    + rates = ~0;
    + rates_len = sband->n_bitrates;
    + }
    +
    /* add all rates which were marked to be used above */
    supp_rates_len = rates_len;
    if (supp_rates_len > 8)
    diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
    index 3ee3cb8..38499c4 100644
    --- a/net/mac80211/rx.c
    +++ b/net/mac80211/rx.c
    @@ -1818,6 +1818,11 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
    return RX_CONTINUE;
    }
    break;
    + case WLAN_CATEGORY_MESH_PLINK:
    + case WLAN_CATEGORY_MESH_PATH_SEL:
    + if (ieee80211_vif_is_mesh(&sdata->vif))
    + return ieee80211_mesh_rx_mgmt(sdata, rx->skb);
    + break;
    default:
    /* do not process rejected action frames */
    if (mgmt->u.action.category & 0x80)
    diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
    index fd6411d..169111a 100644
    --- a/net/mac80211/scan.c
    +++ b/net/mac80211/scan.c
    @@ -62,7 +62,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
    bool beacon)
    {
    struct ieee80211_bss *bss;
    - int clen;
    + int clen, srlen;
    s32 signal = 0;

    if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
    @@ -94,23 +94,24 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
    if (bss->dtim_period == 0)
    bss->dtim_period = 1;

    - bss->supp_rates_len = 0;
    + /* replace old supported rates if we get new values */
    + srlen = 0;
    if (elems->supp_rates) {
    - clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
    + clen = IEEE80211_MAX_SUPP_RATES;
    if (clen > elems->supp_rates_len)
    clen = elems->supp_rates_len;
    - memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates,
    - clen);
    - bss->supp_rates_len += clen;
    + memcpy(bss->supp_rates, elems->supp_rates, clen);
    + srlen += clen;
    }
    if (elems->ext_supp_rates) {
    - clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
    + clen = IEEE80211_MAX_SUPP_RATES - srlen;
    if (clen > elems->ext_supp_rates_len)
    clen = elems->ext_supp_rates_len;
    - memcpy(&bss->supp_rates[bss->supp_rates_len],
    - elems->ext_supp_rates, clen);
    - bss->supp_rates_len += clen;
    + memcpy(bss->supp_rates + srlen, elems->ext_supp_rates, clen);
    + srlen += clen;
    }
    + if (srlen)
    + bss->supp_rates_len = srlen;

    bss->wmm_used = elems->wmm_param || elems->wmm_info;

    diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
    index 27c30cf..95682e5 100644
    --- a/net/netfilter/ipvs/ip_vs_conn.c
    +++ b/net/netfilter/ipvs/ip_vs_conn.c
    @@ -146,6 +146,7 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
    hash = ip_vs_conn_hashkey(cp->af, cp->protocol, &cp->caddr, cp->cport);

    ct_write_lock(hash);
    + spin_lock(&cp->lock);

    if (!(cp->flags & IP_VS_CONN_F_HASHED)) {
    list_add(&cp->c_list, &ip_vs_conn_tab[hash]);
    @@ -158,6 +159,7 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
    ret = 0;
    }

    + spin_unlock(&cp->lock);
    ct_write_unlock(hash);

    return ret;
    @@ -177,6 +179,7 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
    hash = ip_vs_conn_hashkey(cp->af, cp->protocol, &cp->caddr, cp->cport);

    ct_write_lock(hash);
    + spin_lock(&cp->lock);

    if (cp->flags & IP_VS_CONN_F_HASHED) {
    list_del(&cp->c_list);
    @@ -186,6 +189,7 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
    } else
    ret = 0;

    + spin_unlock(&cp->lock);
    ct_write_unlock(hash);

    return ret;
    diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
    index 5cdbf7c..b6fcf68 100644
    --- a/net/sunrpc/xprtsock.c
    +++ b/net/sunrpc/xprtsock.c
    @@ -238,7 +238,8 @@ struct sock_xprt {
    * State of TCP reply receive
    */
    __be32 tcp_fraghdr,
    - tcp_xid;
    + tcp_xid,
    + tcp_calldir;

    u32 tcp_offset,
    tcp_reclen;
    @@ -961,7 +962,7 @@ static inline void xs_tcp_read_calldir(struct sock_xprt *transport,
    {
    size_t len, used;
    u32 offset;
    - __be32 calldir;
    + char *p;

    /*
    * We want transport->tcp_offset to be 8 at the end of this routine
    @@ -970,26 +971,33 @@ static inline void xs_tcp_read_calldir(struct sock_xprt *transport,
    * transport->tcp_offset is 4 (after having already read the xid).
    */
    offset = transport->tcp_offset - sizeof(transport->tcp_xid);
    - len = sizeof(calldir) - offset;
    + len = sizeof(transport->tcp_calldir) - offset;
    dprintk("RPC: reading CALL/REPLY flag (%Zu bytes)\n", len);
    - used = xdr_skb_read_bits(desc, &calldir, len);
    + p = ((char *) &transport->tcp_calldir) + offset;
    + used = xdr_skb_read_bits(desc, p, len);
    transport->tcp_offset += used;
    if (used != len)
    return;
    transport->tcp_flags &= ~TCP_RCV_READ_CALLDIR;
    - transport->tcp_flags |= TCP_RCV_COPY_CALLDIR;
    - transport->tcp_flags |= TCP_RCV_COPY_DATA;
    /*
    * We don't yet have the XDR buffer, so we will write the calldir
    * out after we get the buffer from the 'struct rpc_rqst'
    */
    - if (ntohl(calldir) == RPC_REPLY)
    + switch (ntohl(transport->tcp_calldir)) {
    + case RPC_REPLY:
    + transport->tcp_flags |= TCP_RCV_COPY_CALLDIR;
    + transport->tcp_flags |= TCP_RCV_COPY_DATA;
    transport->tcp_flags |= TCP_RPC_REPLY;
    - else
    + break;
    + case RPC_CALL:
    + transport->tcp_flags |= TCP_RCV_COPY_CALLDIR;
    + transport->tcp_flags |= TCP_RCV_COPY_DATA;
    transport->tcp_flags &= ~TCP_RPC_REPLY;
    - dprintk("RPC: reading %s CALL/REPLY flag %08x\n",
    - (transport->tcp_flags & TCP_RPC_REPLY) ?
    - "reply for" : "request with", calldir);
    + break;
    + default:
    + dprintk("RPC: invalid request message type\n");
    + xprt_force_disconnect(&transport->xprt);
    + }
    xs_tcp_check_fraghdr(transport);
    }

    @@ -1009,12 +1017,10 @@ static inline void xs_tcp_read_common(struct rpc_xprt *xprt,
    /*
    * Save the RPC direction in the XDR buffer
    */
    - __be32 calldir = transport->tcp_flags & TCP_RPC_REPLY ?
    - htonl(RPC_REPLY) : 0;
    -
    memcpy(rcvbuf->head[0].iov_base + transport->tcp_copied,
    - &calldir, sizeof(calldir));
    - transport->tcp_copied += sizeof(calldir);
    + &transport->tcp_calldir,
    + sizeof(transport->tcp_calldir));
    + transport->tcp_copied += sizeof(transport->tcp_calldir);
    transport->tcp_flags &= ~TCP_RCV_COPY_CALLDIR;
    }

    diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
    index 801a16a..03efeab 100644
    --- a/scripts/mod/modpost.c
    +++ b/scripts/mod/modpost.c
    @@ -1311,7 +1311,7 @@ static unsigned int *reloc_location(struct elf_info *elf,
    int section = sechdr->sh_info;

    return (void *)elf->hdr + sechdrs[section].sh_offset +
    - (r->r_offset - sechdrs[section].sh_addr);
    + r->r_offset - sechdrs[section].sh_addr;
    }

    static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
    diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
    index 1305f7c..641d7f0 100644
    --- a/sound/pci/echoaudio/echoaudio.c
    +++ b/sound/pci/echoaudio/echoaudio.c
    @@ -1821,7 +1821,9 @@ static irqreturn_t snd_echo_interrupt(int irq, void *dev_id)
    /* The hardware doesn't tell us which substream caused the irq,
    thus we have to check all running substreams. */
    for (ss = 0; ss < DSP_MAXPIPES; ss++) {
    - if ((substream = chip->substream[ss])) {
    + substream = chip->substream[ss];
    + if (substream && ((struct audiopipe *)substream->runtime->
    + private_data)->state == PIPE_STATE_STARTED) {
    period = pcm_pointer(substream) /
    substream->runtime->period_size;
    if (period != chip->last_period[ss]) {
    diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    index 82a53d9..aa2ec23 100644
    --- a/sound/pci/hda/patch_realtek.c
    +++ b/sound/pci/hda/patch_realtek.c
    @@ -8942,6 +8942,7 @@ static struct snd_pci_quirk alc882_ssid_cfg_tbl[] = {
    SND_PCI_QUIRK(0x106b, 0x3800, "MacbookPro 4,1", ALC885_MBP3),
    SND_PCI_QUIRK(0x106b, 0x3e00, "iMac 24 Aluminum", ALC885_IMAC24),
    SND_PCI_QUIRK(0x106b, 0x3f00, "Macbook 5,1", ALC885_MB5),
    + SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC885_MB5),
    /* FIXME: HP jack sense seems not working for MBP 5,1 or 5,2,
    * so apparently no perfect solution yet
    */
    diff --git a/sound/soc/codecs/wm8776.c b/sound/soc/codecs/wm8776.c
    index a9829aa..8286c62 100644
    --- a/sound/soc/codecs/wm8776.c
    +++ b/sound/soc/codecs/wm8776.c
    @@ -93,7 +93,6 @@ SOC_DAPM_SINGLE("Bypass Switch", WM8776_OUTMUX, 2, 1, 0),

    static const struct snd_soc_dapm_widget wm8776_dapm_widgets[] = {
    SND_SOC_DAPM_INPUT("AUX"),
    -SND_SOC_DAPM_INPUT("AUX"),

    SND_SOC_DAPM_INPUT("AIN1"),
    SND_SOC_DAPM_INPUT("AIN2"),
    diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
    index 43cf3ea..a31a8cd 100644
    --- a/tools/perf/util/callchain.h
    +++ b/tools/perf/util/callchain.h
    @@ -48,6 +48,9 @@ static inline void callchain_init(struct callchain_node *node)
    INIT_LIST_HEAD(&node->brothers);
    INIT_LIST_HEAD(&node->children);
    INIT_LIST_HEAD(&node->val);
    +
    + node->parent = NULL;
    + node->hit = 0;
    }

    static inline u64 cumul_hits(struct callchain_node *node)

    \
     
     \ /
      Last update: 2010-08-02 21:07    [W:0.483 / U:1.124 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site