Merge tag 'v3.5'

Linux 3.5

* tag 'v3.5': (1242 commits)
  Linux 3.5
  Remove SYSTEM_SUSPEND_DISK system state
  kdb: Switch to nolock variants of kmsg_dump functions
  printk: Implement some unlocked kmsg_dump functions
  printk: Remove kdb_syslog_data
  kdb: Revive dmesg command
  dm raid1: set discard_zeroes_data_unsupported
  dm thin: do not send discards to shared blocks
  dm raid1: fix crash with mirror recovery and discard
  pnfs-obj: Fix __r4w_get_page when offset is beyond i_size
  pnfs-obj: don't leak objio_state if ore_write/read fails
  ore: Unlock r4w pages in exact reverse order of locking
  ore: Remove support of partial IO request (NFS crash)
  ore: Fix NFS crash by supporting any unaligned RAID IO
  UBIFS: fix a bug in empty space fix-up
  cx25821: Remove bad strcpy to read-only char*
  HID: hid-multitouch: add support for Zytronic panels
  MIPS: PCI: Move fixups from __init to __devinit.
  MIPS: Fix bug.h MIPS build regression
  MIPS: sync-r4k: remove redundant irq operation
  ...

10 files changed, 267 insertions, 94 deletions

diff --git a/drivers/block/drbd/drbd_bitmap.c b/drivers/block/drbd/drbd_bitmap.c
index b5c5ff53cb57..fcb956bb4b4c 100644
--- a/drivers/block/drbd/drbd_bitmap.c
+++ b/drivers/block/drbd/drbd_bitmap.c
@@ -1475,10 +1475,17 @@ void _drbd_bm_set_bits(struct drbd_conf *mdev, const unsigned long s, const unsi
                 first_word = 0;
                 spin_lock_irq(&b->bm_lock);
         }
-
         /* last page (respectively only page, for first page == last page) */
         last_word = MLPP(el >> LN2_BPL);
-        bm_set_full_words_within_one_page(mdev->bitmap, last_page, first_word, last_word);
+
+        /* consider bitmap->bm_bits = 32768, bitmap->bm_number_of_pages = 1. (or multiples).
+         * ==> e = 32767, el = 32768, last_page = 2,
+         * and now last_word = 0.
+         * We do not want to touch last_page in this case,
+         * as we did not allocate it, it is not present in bitmap->bm_pages.
+         */
+        if (last_word)
+                bm_set_full_words_within_one_page(mdev->bitmap, last_page, first_word, last_word);
 
         /* possibly trailing bits.
          * example: (e & 63) == 63, el will be e+1.
diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index 9c5c84946b05..8e93a6ac9bb6 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -472,12 +472,17 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
                 req->rq_state |= RQ_LOCAL_COMPLETED;
                 req->rq_state &= ~RQ_LOCAL_PENDING;
 
-                D_ASSERT(!(req->rq_state & RQ_NET_MASK));
+                if (req->rq_state & RQ_LOCAL_ABORTED) {
+                        _req_may_be_done(req, m);
+                        break;
+                }
 
                 __drbd_chk_io_error(mdev, false);
 
         goto_queue_for_net_read:
 
+                D_ASSERT(!(req->rq_state & RQ_NET_MASK));
+
                 /* no point in retrying if there is no good remote data,
                  * or we have no connection. */
                 if (mdev->state.pdsk != D_UP_TO_DATE) {
@@ -765,6 +770,40 @@ static int drbd_may_do_local_read(struct drbd_conf *mdev, sector_t sector, int s
         return 0 == drbd_bm_count_bits(mdev, sbnr, ebnr);
 }
 
+static void maybe_pull_ahead(struct drbd_conf *mdev)
+{
+        int congested = 0;
+
+        /* If I don't even have good local storage, we can not reasonably try
+         * to pull ahead of the peer. We also need the local reference to make
+         * sure mdev->act_log is there.
+         * Note: caller has to make sure that net_conf is there.
+         */
+        if (!get_ldev_if_state(mdev, D_UP_TO_DATE))
+                return;
+
+        if (mdev->net_conf->cong_fill &&
+            atomic_read(&mdev->ap_in_flight) >= mdev->net_conf->cong_fill) {
+                dev_info(DEV, "Congestion-fill threshold reached\n");
+                congested = 1;
+        }
+
+        if (mdev->act_log->used >= mdev->net_conf->cong_extents) {
+                dev_info(DEV, "Congestion-extents threshold reached\n");
+                congested = 1;
+        }
+
+        if (congested) {
+                queue_barrier(mdev); /* last barrier, after mirrored writes */
+
+                if (mdev->net_conf->on_congestion == OC_PULL_AHEAD)
+                        _drbd_set_state(_NS(mdev, conn, C_AHEAD), 0, NULL);
+                else  /*mdev->net_conf->on_congestion == OC_DISCONNECT */
+                        _drbd_set_state(_NS(mdev, conn, C_DISCONNECTING), 0, NULL);
+        }
+        put_ldev(mdev);
+}
+
 static int drbd_make_request_common(struct drbd_conf *mdev, struct bio *bio, unsigned long start_time)
 {
         const int rw = bio_rw(bio);
@@ -972,29 +1011,8 @@ allocate_barrier:
                 _req_mod(req, queue_for_send_oos);
 
         if (remote &&
-            mdev->net_conf->on_congestion != OC_BLOCK && mdev->agreed_pro_version >= 96) {
-                int congested = 0;
-
-                if (mdev->net_conf->cong_fill &&
-                    atomic_read(&mdev->ap_in_flight) >= mdev->net_conf->cong_fill) {
-                        dev_info(DEV, "Congestion-fill threshold reached\n");
-                        congested = 1;
-                }
-
-                if (mdev->act_log->used >= mdev->net_conf->cong_extents) {
-                        dev_info(DEV, "Congestion-extents threshold reached\n");
-                        congested = 1;
-                }
-
-                if (congested) {
-                        queue_barrier(mdev); /* last barrier, after mirrored writes */
-
-                        if (mdev->net_conf->on_congestion == OC_PULL_AHEAD)
-                                _drbd_set_state(_NS(mdev, conn, C_AHEAD), 0, NULL);
-                        else  /*mdev->net_conf->on_congestion == OC_DISCONNECT */
-                                _drbd_set_state(_NS(mdev, conn, C_DISCONNECTING), 0, NULL);
-                }
-        }
+            mdev->net_conf->on_congestion != OC_BLOCK && mdev->agreed_pro_version >= 96)
+                maybe_pull_ahead(mdev);
 
         spin_unlock_irq(&mdev->req_lock);
         kfree(b); /* if someone else has beaten us to it... */
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index cce7df367b79..553f43a90953 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -671,6 +671,7 @@ static void __reschedule_timeout(int drive, const char *message)
 
         if (drive == current_reqD)
                 drive = current_drive;
+        __cancel_delayed_work(&fd_timeout);
 
         if (drive < 0 || drive >= N_DRIVE) {
                 delay = 20UL * HZ;
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index bbca966f8f66..3bba65510d23 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1597,14 +1597,12 @@ static int loop_add(struct loop_device **l, int i)
         struct gendisk *disk;
         int err;
 
+        err = -ENOMEM;
         lo = kzalloc(sizeof(*lo), GFP_KERNEL);
-        if (!lo) {
-                err = -ENOMEM;
+        if (!lo)
                 goto out;
-        }
 
-        err = idr_pre_get(&loop_index_idr, GFP_KERNEL);
-        if (err < 0)
+        if (!idr_pre_get(&loop_index_idr, GFP_KERNEL))
                 goto out_free_dev;
 
         if (i >= 0) {
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 264bc77dcb91..a8fddeb3d638 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -37,6 +37,7 @@
 #include <linux/kthread.h>
 #include <../drivers/ata/ahci.h>
 #include <linux/export.h>
+#include <linux/debugfs.h>
 #include "mtip32xx.h"
 
 #define HW_CMD_SLOT_SZ          (MTIP_MAX_COMMAND_SLOTS * 32)
@@ -85,6 +86,7 @@ static int instance;
  * allocated in mtip_init().
  */
 static int mtip_major;
+static struct dentry *dfs_parent;
 
 static DEFINE_SPINLOCK(rssd_index_lock);
 static DEFINE_IDA(rssd_index_ida);
@@ -2546,7 +2548,7 @@ static struct scatterlist *mtip_hw_get_scatterlist(struct driver_data *dd,
 }
 
 /*
- * Sysfs register/status dump.
+ * Sysfs status dump.
  *
  * @dev  Pointer to the device structure, passed by the kernrel.
  * @attr Pointer to the device_attribute structure passed by the kernel.
@@ -2555,45 +2557,68 @@ static struct scatterlist *mtip_hw_get_scatterlist(struct driver_data *dd,
  * return value
  *      The size, in bytes, of the data copied into buf.
  */
-static ssize_t mtip_hw_show_registers(struct device *dev,
+static ssize_t mtip_hw_show_status(struct device *dev,
                                 struct device_attribute *attr,
                                 char *buf)
 {
-        u32 group_allocated;
         struct driver_data *dd = dev_to_disk(dev)->private_data;
         int size = 0;
+
+        if (test_bit(MTIP_DDF_OVER_TEMP_BIT, &dd->dd_flag))
+                size += sprintf(buf, "%s", "thermal_shutdown\n");
+        else if (test_bit(MTIP_DDF_WRITE_PROTECT_BIT, &dd->dd_flag))
+                size += sprintf(buf, "%s", "write_protect\n");
+        else
+                size += sprintf(buf, "%s", "online\n");
+
+        return size;
+}
+
+static DEVICE_ATTR(status, S_IRUGO, mtip_hw_show_status, NULL);
+
+static ssize_t mtip_hw_read_registers(struct file *f, char __user *ubuf,
+                                  size_t len, loff_t *offset)
+{
+        struct driver_data *dd =  (struct driver_data *)f->private_data;
+        char buf[MTIP_DFS_MAX_BUF_SIZE];
+        u32 group_allocated;
+        int size = *offset;
         int n;
 
-        size += sprintf(&buf[size], "Hardware\n--------\n");
-        size += sprintf(&buf[size], "S ACTive      : [ 0x");
+        if (!len || size)
+                return 0;
+
+        if (size < 0)
+                return -EINVAL;
+
+        size += sprintf(&buf[size], "H/ S ACTive      : [ 0x");
 
         for (n = dd->slot_groups-1; n >= 0; n--)
                 size += sprintf(&buf[size], "%08X ",
                                          readl(dd->port->s_active[n]));
 
         size += sprintf(&buf[size], "]\n");
-        size += sprintf(&buf[size], "Command Issue : [ 0x");
+        size += sprintf(&buf[size], "H/ Command Issue : [ 0x");
 
         for (n = dd->slot_groups-1; n >= 0; n--)
                 size += sprintf(&buf[size], "%08X ",
                                         readl(dd->port->cmd_issue[n]));
 
         size += sprintf(&buf[size], "]\n");
-        size += sprintf(&buf[size], "Completed     : [ 0x");
+        size += sprintf(&buf[size], "H/ Completed     : [ 0x");
 
         for (n = dd->slot_groups-1; n >= 0; n--)
                 size += sprintf(&buf[size], "%08X ",
                                 readl(dd->port->completed[n]));
 
         size += sprintf(&buf[size], "]\n");
-        size += sprintf(&buf[size], "PORT IRQ STAT : [ 0x%08X ]\n",
+        size += sprintf(&buf[size], "H/ PORT IRQ STAT : [ 0x%08X ]\n",
                                 readl(dd->port->mmio + PORT_IRQ_STAT));
-        size += sprintf(&buf[size], "HOST IRQ STAT : [ 0x%08X ]\n",
+        size += sprintf(&buf[size], "H/ HOST IRQ STAT : [ 0x%08X ]\n",
                                 readl(dd->mmio + HOST_IRQ_STAT));
         size += sprintf(&buf[size], "\n");
 
-        size += sprintf(&buf[size], "Local\n-----\n");
-        size += sprintf(&buf[size], "Allocated    : [ 0x");
+        size += sprintf(&buf[size], "L/ Allocated     : [ 0x");
 
         for (n = dd->slot_groups-1; n >= 0; n--) {
                 if (sizeof(long) > sizeof(u32))
@@ -2605,7 +2630,7 @@ static ssize_t mtip_hw_show_registers(struct device *dev,
         }
         size += sprintf(&buf[size], "]\n");
 
-        size += sprintf(&buf[size], "Commands in Q: [ 0x");
+        size += sprintf(&buf[size], "L/ Commands in Q : [ 0x");
 
         for (n = dd->slot_groups-1; n >= 0; n--) {
                 if (sizeof(long) > sizeof(u32))
@@ -2617,44 +2642,53 @@ static ssize_t mtip_hw_show_registers(struct device *dev,
         }
         size += sprintf(&buf[size], "]\n");
 
-        return size;
+        *offset = size <= len ? size : len;
+        size = copy_to_user(ubuf, buf, *offset);
+        if (size)
+                return -EFAULT;
+
+        return *offset;
 }
 
-static ssize_t mtip_hw_show_status(struct device *dev,
-                                struct device_attribute *attr,
-                                char *buf)
+static ssize_t mtip_hw_read_flags(struct file *f, char __user *ubuf,
+                                  size_t len, loff_t *offset)
 {
-        struct driver_data *dd = dev_to_disk(dev)->private_data;
-        int size = 0;
+        struct driver_data *dd =  (struct driver_data *)f->private_data;
+        char buf[MTIP_DFS_MAX_BUF_SIZE];
+        int size = *offset;
 
-        if (test_bit(MTIP_DDF_OVER_TEMP_BIT, &dd->dd_flag))
-                size += sprintf(buf, "%s", "thermal_shutdown\n");
-        else if (test_bit(MTIP_DDF_WRITE_PROTECT_BIT, &dd->dd_flag))
-                size += sprintf(buf, "%s", "write_protect\n");
-        else
-                size += sprintf(buf, "%s", "online\n");
-
-        return size;
-}
+        if (!len || size)
+                return 0;
 
-static ssize_t mtip_hw_show_flags(struct device *dev,
-                                struct device_attribute *attr,
-                                char *buf)
-{
-        struct driver_data *dd = dev_to_disk(dev)->private_data;
-        int size = 0;
+        if (size < 0)
+                return -EINVAL;
 
-        size += sprintf(&buf[size], "Flag in port struct : [ %08lX ]\n",
+        size += sprintf(&buf[size], "Flag-port : [ %08lX ]\n",
                                                         dd->port->flags);
-        size += sprintf(&buf[size], "Flag in dd struct   : [ %08lX ]\n",
+        size += sprintf(&buf[size], "Flag-dd   : [ %08lX ]\n",
                                                         dd->dd_flag);
 
-        return size;
+        *offset = size <= len ? size : len;
+        size = copy_to_user(ubuf, buf, *offset);
+        if (size)
+                return -EFAULT;
+
+        return *offset;
 }
 
-static DEVICE_ATTR(registers, S_IRUGO, mtip_hw_show_registers, NULL);
-static DEVICE_ATTR(status, S_IRUGO, mtip_hw_show_status, NULL);
-static DEVICE_ATTR(flags, S_IRUGO, mtip_hw_show_flags, NULL);
+static const struct file_operations mtip_regs_fops = {
+        .owner  = THIS_MODULE,
+        .open   = simple_open,
+        .read   = mtip_hw_read_registers,
+        .llseek = no_llseek,
+};
+
+static const struct file_operations mtip_flags_fops = {
+        .owner  = THIS_MODULE,
+        .open   = simple_open,
+        .read   = mtip_hw_read_flags,
+        .llseek = no_llseek,
+};
 
 /*
  * Create the sysfs related attributes.
@@ -2671,15 +2705,9 @@ static int mtip_hw_sysfs_init(struct driver_data *dd, struct kobject *kobj)
         if (!kobj || !dd)
                 return -EINVAL;
 
-        if (sysfs_create_file(kobj, &dev_attr_registers.attr))
-                dev_warn(&dd->pdev->dev,
-                        "Error creating 'registers' sysfs entry\n");
         if (sysfs_create_file(kobj, &dev_attr_status.attr))
                 dev_warn(&dd->pdev->dev,
                         "Error creating 'status' sysfs entry\n");
-        if (sysfs_create_file(kobj, &dev_attr_flags.attr))
-                dev_warn(&dd->pdev->dev,
-                        "Error creating 'flags' sysfs entry\n");
         return 0;
 }
 
@@ -2698,13 +2726,39 @@ static int mtip_hw_sysfs_exit(struct driver_data *dd, struct kobject *kobj)
         if (!kobj || !dd)
                 return -EINVAL;
 
-        sysfs_remove_file(kobj, &dev_attr_registers.attr);
         sysfs_remove_file(kobj, &dev_attr_status.attr);
-        sysfs_remove_file(kobj, &dev_attr_flags.attr);
 
         return 0;
 }
 
+static int mtip_hw_debugfs_init(struct driver_data *dd)
+{
+        if (!dfs_parent)
+                return -1;
+
+        dd->dfs_node = debugfs_create_dir(dd->disk->disk_name, dfs_parent);
+        if (IS_ERR_OR_NULL(dd->dfs_node)) {
+                dev_warn(&dd->pdev->dev,
+                        "Error creating node %s under debugfs\n",
+                                                dd->disk->disk_name);
+                dd->dfs_node = NULL;
+                return -1;
+        }
+
+        debugfs_create_file("flags", S_IRUGO, dd->dfs_node, dd,
+                                                        &mtip_flags_fops);
+        debugfs_create_file("registers", S_IRUGO, dd->dfs_node, dd,
+                                                        &mtip_regs_fops);
+
+        return 0;
+}
+
+static void mtip_hw_debugfs_exit(struct driver_data *dd)
+{
+        debugfs_remove_recursive(dd->dfs_node);
+}
+
+
 /*
  * Perform any init/resume time hardware setup
  *
@@ -3730,6 +3784,7 @@ skip_create_disk:
                 mtip_hw_sysfs_init(dd, kobj);
                 kobject_put(kobj);
         }
+        mtip_hw_debugfs_init(dd);
 
         if (dd->mtip_svc_handler) {
                 set_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag);
@@ -3755,6 +3810,8 @@ start_service_thread:
         return rv;
 
 kthread_run_error:
+        mtip_hw_debugfs_exit(dd);
+
         /* Delete our gendisk. This also removes the device from /dev */
         del_gendisk(dd->disk);
 
@@ -3805,6 +3862,7 @@ static int mtip_block_remove(struct driver_data *dd)
                         kobject_put(kobj);
                 }
         }
+        mtip_hw_debugfs_exit(dd);
 
         /*
          * Delete our gendisk structure. This also removes the device
@@ -4152,10 +4210,20 @@ static int __init mtip_init(void)
         }
         mtip_major = error;
 
+        if (!dfs_parent) {
+                dfs_parent = debugfs_create_dir("rssd", NULL);
+                if (IS_ERR_OR_NULL(dfs_parent)) {
+                        printk(KERN_WARNING "Error creating debugfs parent\n");
+                        dfs_parent = NULL;
+                }
+        }
+
         /* Register our PCI operations. */
         error = pci_register_driver(&mtip_pci_driver);
-        if (error)
+        if (error) {
+                debugfs_remove(dfs_parent);
                 unregister_blkdev(mtip_major, MTIP_DRV_NAME);
+        }
 
         return error;
 }
@@ -4172,6 +4240,8 @@ static int __init mtip_init(void)
  */
 static void __exit mtip_exit(void)
 {
+        debugfs_remove_recursive(dfs_parent);
+
         /* Release the allocated major block device number. */
         unregister_blkdev(mtip_major, MTIP_DRV_NAME);
 
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index b2c88da26b2a..f51fc23d17bb 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -26,7 +26,6 @@
 #include <linux/ata.h>
 #include <linux/interrupt.h>
 #include <linux/genhd.h>
-#include <linux/version.h>
 
 /* Offset of Subsystem Device ID in pci confoguration space */
 #define PCI_SUBSYSTEM_DEVICEID  0x2E
@@ -111,6 +110,8 @@
  #define dbg_printk(format, arg...)
 #endif
 
+#define MTIP_DFS_MAX_BUF_SIZE 1024
+
 #define __force_bit2int (unsigned int __force)
 
 enum {
@@ -447,6 +448,8 @@ struct driver_data {
         unsigned long dd_flag; /* NOTE: use atomic bit operations on this */
 
         struct task_struct *mtip_svc_handler; /* task_struct of svc thd */
+
+        struct dentry *dfs_node;
 };
 
 #endif
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 65665c9c42c6..8f428a8ab003 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -499,7 +499,7 @@ static int rbd_header_from_disk(struct rbd_image_header *header,
                          / sizeof (*ondisk))
                 return -EINVAL;
         header->snapc = kmalloc(sizeof(struct ceph_snap_context) +
-                                snap_count * sizeof (*ondisk),
+                                snap_count * sizeof(u64),
                                 gfp_flags);
         if (!header->snapc)
                 return -ENOMEM;
@@ -977,7 +977,7 @@ static void rbd_req_cb(struct ceph_osd_request *req, struct ceph_msg *msg)
         op = (void *)(replyhead + 1);
         rc = le32_to_cpu(replyhead->result);
         bytes = le64_to_cpu(op->extent.length);
-        read_op = (le32_to_cpu(op->op) == CEPH_OSD_OP_READ);
+        read_op = (le16_to_cpu(op->op) == CEPH_OSD_OP_READ);
 
         dout("rbd_req_cb bytes=%lld readop=%d rc=%d\n", bytes, read_op, rc);
 
diff --git a/drivers/block/umem.c b/drivers/block/umem.c
index aa2712060bfb..9a72277a31df 100644
--- a/drivers/block/umem.c
+++ b/drivers/block/umem.c
@@ -513,6 +513,44 @@ static void process_page(unsigned long data)
         }
 }
 
+struct mm_plug_cb {
+        struct blk_plug_cb cb;
+        struct cardinfo *card;
+};
+
+static void mm_unplug(struct blk_plug_cb *cb)
+{
+        struct mm_plug_cb *mmcb = container_of(cb, struct mm_plug_cb, cb);
+
+        spin_lock_irq(&mmcb->card->lock);
+        activate(mmcb->card);
+        spin_unlock_irq(&mmcb->card->lock);
+        kfree(mmcb);
+}
+
+static int mm_check_plugged(struct cardinfo *card)
+{
+        struct blk_plug *plug = current->plug;
+        struct mm_plug_cb *mmcb;
+
+        if (!plug)
+                return 0;
+
+        list_for_each_entry(mmcb, &plug->cb_list, cb.list) {
+                if (mmcb->cb.callback == mm_unplug && mmcb->card == card)
+                        return 1;
+        }
+        /* Not currently on the callback list */
+        mmcb = kmalloc(sizeof(*mmcb), GFP_ATOMIC);
+        if (!mmcb)
+                return 0;
+
+        mmcb->card = card;
+        mmcb->cb.callback = mm_unplug;
+        list_add(&mmcb->cb.list, &plug->cb_list);
+        return 1;
+}
+
 static void mm_make_request(struct request_queue *q, struct bio *bio)
 {
         struct cardinfo *card = q->queuedata;
@@ -523,6 +561,8 @@ static void mm_make_request(struct request_queue *q, struct bio *bio)
         *card->biotail = bio;
         bio->bi_next = NULL;
         card->biotail = &bio->bi_next;
+        if (bio->bi_rw & REQ_SYNC || !mm_check_plugged(card))
+                activate(card);
         spin_unlock_irq(&card->lock);
 
         return;
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index 773cf27dc23f..9ad3b5ec1dc1 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -257,6 +257,7 @@ static inline void blkif_get_x86_32_req(struct blkif_request *dst,
                 break;
         case BLKIF_OP_DISCARD:
                 dst->u.discard.flag = src->u.discard.flag;
+                dst->u.discard.id = src->u.discard.id;
                 dst->u.discard.sector_number = src->u.discard.sector_number;
                 dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
                 break;
@@ -287,6 +288,7 @@ static inline void blkif_get_x86_64_req(struct blkif_request *dst,
                 break;
         case BLKIF_OP_DISCARD:
                 dst->u.discard.flag = src->u.discard.flag;
+                dst->u.discard.id = src->u.discard.id;
                 dst->u.discard.sector_number = src->u.discard.sector_number;
                 dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
                 break;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 60eed4bdd2e4..e4fb3374dcd2 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -141,14 +141,36 @@ static int get_id_from_freelist(struct blkfront_info *info)
         return free;
 }
 
-static void add_id_to_freelist(struct blkfront_info *info,
+static int add_id_to_freelist(struct blkfront_info *info,
                                unsigned long id)
 {
+        if (info->shadow[id].req.u.rw.id != id)
+                return -EINVAL;
+        if (info->shadow[id].request == NULL)
+                return -EINVAL;
         info->shadow[id].req.u.rw.id  = info->shadow_free;
         info->shadow[id].request = NULL;
         info->shadow_free = id;
+        return 0;
 }
 
+static const char *op_name(int op)
+{
+        static const char *const names[] = {
+                [BLKIF_OP_READ] = "read",
+                [BLKIF_OP_WRITE] = "write",
+                [BLKIF_OP_WRITE_BARRIER] = "barrier",
+                [BLKIF_OP_FLUSH_DISKCACHE] = "flush",
+                [BLKIF_OP_DISCARD] = "discard" };
+
+        if (op < 0 || op >= ARRAY_SIZE(names))
+                return "unknown";
+
+        if (!names[op])
+                return "reserved";
+
+        return names[op];
+}
 static int xlbd_reserve_minors(unsigned int minor, unsigned int nr)
 {
         unsigned int end = minor + nr;
@@ -746,20 +768,36 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
 
                 bret = RING_GET_RESPONSE(&info->ring, i);
                 id   = bret->id;
+                /*
+                 * The backend has messed up and given us an id that we would
+                 * never have given to it (we stamp it up to BLK_RING_SIZE -
+                 * look in get_id_from_freelist.
+                 */
+                if (id >= BLK_RING_SIZE) {
+                        WARN(1, "%s: response to %s has incorrect id (%ld)\n",
+                             info->gd->disk_name, op_name(bret->operation), id);
+                        /* We can't safely get the 'struct request' as
+                         * the id is busted. */
+                        continue;
+                }
                 req  = info->shadow[id].request;
 
                 if (bret->operation != BLKIF_OP_DISCARD)
                         blkif_completion(&info->shadow[id]);
 
-                add_id_to_freelist(info, id);
+                if (add_id_to_freelist(info, id)) {
+                        WARN(1, "%s: response to %s (id %ld) couldn't be recycled!\n",
+                             info->gd->disk_name, op_name(bret->operation), id);
+                        continue;
+                }
 
                 error = (bret->status == BLKIF_RSP_OKAY) ? 0 : -EIO;
                 switch (bret->operation) {
                 case BLKIF_OP_DISCARD:
                         if (unlikely(bret->status == BLKIF_RSP_EOPNOTSUPP)) {
                                 struct request_queue *rq = info->rq;
-                                printk(KERN_WARNING "blkfront: %s: discard op failed\n",
-                                           info->gd->disk_name);
+                                printk(KERN_WARNING "blkfront: %s: %s op failed\n",
+                                           info->gd->disk_name, op_name(bret->operation));
                                 error = -EOPNOTSUPP;
                                 info->feature_discard = 0;
                                 info->feature_secdiscard = 0;
@@ -771,18 +809,14 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
                 case BLKIF_OP_FLUSH_DISKCACHE:
                 case BLKIF_OP_WRITE_BARRIER:
                         if (unlikely(bret->status == BLKIF_RSP_EOPNOTSUPP)) {
-                                printk(KERN_WARNING "blkfront: %s: write %s op failed\n",
-                                       info->flush_op == BLKIF_OP_WRITE_BARRIER ?
-                                       "barrier" :  "flush disk cache",
-                                       info->gd->disk_name);
+                                printk(KERN_WARNING "blkfront: %s: %s op failed\n",
+                                       info->gd->disk_name, op_name(bret->operation));
                                 error = -EOPNOTSUPP;
                         }
                         if (unlikely(bret->status == BLKIF_RSP_ERROR &&
                                      info->shadow[id].req.u.rw.nr_segments == 0)) {
-                                printk(KERN_WARNING "blkfront: %s: empty write %s op failed\n",
-                                       info->flush_op == BLKIF_OP_WRITE_BARRIER ?
-                                       "barrier" :  "flush disk cache",
-                                       info->gd->disk_name);
+                                printk(KERN_WARNING "blkfront: %s: empty %s op failed\n",
+                                       info->gd->disk_name, op_name(bret->operation));
                                 error = -EOPNOTSUPP;
                         }
                         if (unlikely(error)) {