Merge commit 'v3.6-rc5' into pci/gavin-window-alignment

* commit 'v3.6-rc5': (1098 commits)
  Linux 3.6-rc5
  HID: tpkbd: work even if the new Lenovo Keyboard driver is not configured
  Remove user-triggerable BUG from mpol_to_str
  xen/pciback: Fix proper FLR steps.
  uml: fix compile error in deliver_alarm()
  dj: memory scribble in logi_dj
  Fix order of arguments to compat_put_time[spec|val]
  xen: Use correct masking in xen_swiotlb_alloc_coherent.
  xen: fix logical error in tlb flushing
  xen/p2m: Fix one-off error in checking the P2M tree directory.
  powerpc: Don't use __put_user() in patch_instruction
  powerpc: Make sure IPI handlers see data written by IPI senders
  powerpc: Restore correct DSCR in context switch
  powerpc: Fix DSCR inheritance in copy_thread()
  powerpc: Keep thread.dscr and thread.dscr_inherit in sync
  powerpc: Update DSCR on all CPUs when writing sysfs dscr_default
  powerpc/powernv: Always go into nap mode when CPU is offline
  powerpc: Give hypervisor decrementer interrupts their own handler
  powerpc/vphn: Fix arch_update_cpu_topology() return value
  ARM: gemini: fix the gemini build
  ...

Conflicts:
	drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
	drivers/rapidio/devices/tsi721.c

13 files changed, 101 insertions, 48 deletions

diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 6bf850422895..055ed59838dc 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -267,6 +267,7 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id,
         if (!uevent)
                 return event->event == RDMA_CM_EVENT_CONNECT_REQUEST;
 
+        mutex_lock(&ctx->file->mut);
         uevent->cm_id = cm_id;
         ucma_set_event_context(ctx, event, uevent);
         uevent->resp.event = event->event;
@@ -277,7 +278,6 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id,
                 ucma_copy_conn_event(&uevent->resp.param.conn,
                                      &event->param.conn);
 
-        mutex_lock(&ctx->file->mut);
         if (event->event == RDMA_CM_EVENT_CONNECT_REQUEST) {
                 if (!ctx->backlog) {
                         ret = -ENOMEM;
diff --git a/drivers/infiniband/hw/amso1100/c2_rnic.c b/drivers/infiniband/hw/amso1100/c2_rnic.c
index 8c81992fa6db..e4a73158fc7f 100644
--- a/drivers/infiniband/hw/amso1100/c2_rnic.c
+++ b/drivers/infiniband/hw/amso1100/c2_rnic.c
@@ -439,7 +439,7 @@ static int c2_rnic_close(struct c2_dev *c2dev)
 
 /*
  * Called by c2_probe to initialize the RNIC. This principally
- * involves initalizing the various limits and resouce pools that
+ * involves initializing the various limits and resource pools that
  * comprise the RNIC instance.
  */
 int __devinit c2_rnic_init(struct c2_dev *c2dev)
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index 77b6b182778a..aaf88ef9409c 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -1680,7 +1680,7 @@ static int close_con_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
  * T3A does 3 things when a TERM is received:
  * 1) send up a CPL_RDMA_TERMINATE message with the TERM packet
  * 2) generate an async event on the QP with the TERMINATE opcode
- * 3) post a TERMINATE opcde cqe into the associated CQ.
+ * 3) post a TERMINATE opcode cqe into the associated CQ.
  *
  * For (1), we save the message in the qp for later consumer consumption.
  * For (2), we move the QP into TERMINATE, post a QP event and disconnect.
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index c27141fef1ab..9c2ae7efd00f 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -125,6 +125,7 @@ static void update_sm_ah(struct mlx4_ib_dev *dev, u8 port_num, u16 lid, u8 sl)
 {
         struct ib_ah *new_ah;
         struct ib_ah_attr ah_attr;
+        unsigned long flags;
 
         if (!dev->send_agent[port_num - 1][0])
                 return;
@@ -139,11 +140,11 @@ static void update_sm_ah(struct mlx4_ib_dev *dev, u8 port_num, u16 lid, u8 sl)
         if (IS_ERR(new_ah))
                 return;
 
-        spin_lock(&dev->sm_lock);
+        spin_lock_irqsave(&dev->sm_lock, flags);
         if (dev->sm_ah[port_num - 1])
                 ib_destroy_ah(dev->sm_ah[port_num - 1]);
         dev->sm_ah[port_num - 1] = new_ah;
-        spin_unlock(&dev->sm_lock);
+        spin_unlock_irqrestore(&dev->sm_lock, flags);
 }
 
 /*
@@ -197,13 +198,15 @@ static void smp_snoop(struct ib_device *ibdev, u8 port_num, struct ib_mad *mad,
 static void node_desc_override(struct ib_device *dev,
                                struct ib_mad *mad)
 {
+        unsigned long flags;
+
         if ((mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_LID_ROUTED ||
              mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) &&
             mad->mad_hdr.method == IB_MGMT_METHOD_GET_RESP &&
             mad->mad_hdr.attr_id == IB_SMP_ATTR_NODE_DESC) {
-                spin_lock(&to_mdev(dev)->sm_lock);
+                spin_lock_irqsave(&to_mdev(dev)->sm_lock, flags);
                 memcpy(((struct ib_smp *) mad)->data, dev->node_desc, 64);
-                spin_unlock(&to_mdev(dev)->sm_lock);
+                spin_unlock_irqrestore(&to_mdev(dev)->sm_lock, flags);
         }
 }
 
@@ -213,6 +216,7 @@ static void forward_trap(struct mlx4_ib_dev *dev, u8 port_num, struct ib_mad *ma
         struct ib_mad_send_buf *send_buf;
         struct ib_mad_agent *agent = dev->send_agent[port_num - 1][qpn];
         int ret;
+        unsigned long flags;
 
         if (agent) {
                 send_buf = ib_create_send_mad(agent, qpn, 0, 0, IB_MGMT_MAD_HDR,
@@ -225,13 +229,13 @@ static void forward_trap(struct mlx4_ib_dev *dev, u8 port_num, struct ib_mad *ma
                  * wrong following the IB spec strictly, but we know
                  * it's OK for our devices).
                  */
-                spin_lock(&dev->sm_lock);
+                spin_lock_irqsave(&dev->sm_lock, flags);
                 memcpy(send_buf->mad, mad, sizeof *mad);
                 if ((send_buf->ah = dev->sm_ah[port_num - 1]))
                         ret = ib_post_send_mad(send_buf, NULL);
                 else
                         ret = -EINVAL;
-                spin_unlock(&dev->sm_lock);
+                spin_unlock_irqrestore(&dev->sm_lock, flags);
 
                 if (ret)
                         ib_free_send_mad(send_buf);
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index fe2088cfa6ee..cc05579ebce7 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -423,6 +423,7 @@ static int mlx4_ib_modify_device(struct ib_device *ibdev, int mask,
                                  struct ib_device_modify *props)
 {
         struct mlx4_cmd_mailbox *mailbox;
+        unsigned long flags;
 
         if (mask & ~IB_DEVICE_MODIFY_NODE_DESC)
                 return -EOPNOTSUPP;
@@ -430,9 +431,9 @@ static int mlx4_ib_modify_device(struct ib_device *ibdev, int mask,
         if (!(mask & IB_DEVICE_MODIFY_NODE_DESC))
                 return 0;
 
-        spin_lock(&to_mdev(ibdev)->sm_lock);
+        spin_lock_irqsave(&to_mdev(ibdev)->sm_lock, flags);
         memcpy(ibdev->node_desc, props->node_desc, 64);
-        spin_unlock(&to_mdev(ibdev)->sm_lock);
+        spin_unlock_irqrestore(&to_mdev(ibdev)->sm_lock, flags);
 
         /*
          * If possible, pass node desc to FW, so it can generate
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index a6d8ea060ea8..f585eddef4b7 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1407,6 +1407,7 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_send_wr *wr,
         struct mlx4_wqe_mlx_seg *mlx = wqe;
         struct mlx4_wqe_inline_seg *inl = wqe + sizeof *mlx;
         struct mlx4_ib_ah *ah = to_mah(wr->wr.ud.ah);
+        struct net_device *ndev;
         union ib_gid sgid;
         u16 pkey;
         int send_size;
@@ -1483,7 +1484,10 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_send_wr *wr,
 
                 memcpy(sqp->ud_header.eth.dmac_h, ah->av.eth.mac, 6);
                 /* FIXME: cache smac value? */
-                smac = to_mdev(sqp->qp.ibqp.device)->iboe.netdevs[sqp->qp.port - 1]->dev_addr;
+                ndev = to_mdev(sqp->qp.ibqp.device)->iboe.netdevs[sqp->qp.port - 1];
+                if (!ndev)
+                        return -ENODEV;
+                smac = ndev->dev_addr;
                 memcpy(sqp->ud_header.eth.smac_h, smac, 6);
                 if (!memcmp(sqp->ud_header.eth.smac_h, sqp->ud_header.eth.dmac_h, 6))
                         mlx->flags |= cpu_to_be32(MLX4_WQE_CTRL_FORCE_LOOPBACK);
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index 5a044526e4f4..c4e0131f1b57 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -161,7 +161,7 @@ static void ocrdma_add_default_sgid(struct ocrdma_dev *dev)
         ocrdma_get_guid(dev, &sgid->raw[8]);
 }
 
-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
+#if IS_ENABLED(CONFIG_VLAN_8021Q)
 static void ocrdma_add_vlan_sgids(struct ocrdma_dev *dev)
 {
         struct net_device *netdev, *tmp;
@@ -202,14 +202,13 @@ static int ocrdma_build_sgid_tbl(struct ocrdma_dev *dev)
         return 0;
 }
 
-#if IS_ENABLED(CONFIG_IPV6) || IS_ENABLED(CONFIG_VLAN_8021Q)
+#if IS_ENABLED(CONFIG_IPV6)
 
 static int ocrdma_inet6addr_event(struct notifier_block *notifier,
                                   unsigned long event, void *ptr)
 {
         struct inet6_ifaddr *ifa = (struct inet6_ifaddr *)ptr;
-        struct net_device *event_netdev = ifa->idev->dev;
-        struct net_device *netdev = NULL;
+        struct net_device *netdev = ifa->idev->dev;
         struct ib_event gid_event;
         struct ocrdma_dev *dev;
         bool found = false;
@@ -217,11 +216,12 @@ static int ocrdma_inet6addr_event(struct notifier_block *notifier,
         bool is_vlan = false;
         u16 vid = 0;
 
-        netdev = vlan_dev_real_dev(event_netdev);
-        if (netdev != event_netdev) {
-                is_vlan = true;
-                vid = vlan_dev_vlan_id(event_netdev);
+        is_vlan = netdev->priv_flags & IFF_802_1Q_VLAN;
+        if (is_vlan) {
+                vid = vlan_dev_vlan_id(netdev);
+                netdev = vlan_dev_real_dev(netdev);
         }
+
         rcu_read_lock();
         list_for_each_entry_rcu(dev, &ocrdma_dev_list, entry) {
                 if (dev->nic_info.netdev == netdev) {
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 0d7280af99bc..3f6b21e9dc11 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -6346,8 +6346,10 @@ static int qib_init_7322_variables(struct qib_devdata *dd)
                         dd->piobcnt4k * dd->align4k;
                 dd->piovl15base = ioremap_nocache(vl15off,
                                                   NUM_VL15_BUFS * dd->align4k);
-                if (!dd->piovl15base)
+                if (!dd->piovl15base) {
+                        ret = -ENOMEM;
                         goto bail;
+                }
         }
         qib_7322_set_baseaddrs(dd); /* set chip access pointers now */
 
diff --git a/drivers/infiniband/hw/qib/qib_sd7220.c b/drivers/infiniband/hw/qib/qib_sd7220.c
index a322d5171a2c..50a8a0d4fe67 100644
--- a/drivers/infiniband/hw/qib/qib_sd7220.c
+++ b/drivers/infiniband/hw/qib/qib_sd7220.c
@@ -372,7 +372,7 @@ static void qib_sd_trimdone_monitor(struct qib_devdata *dd,
                 /* Read CTRL reg for each channel to check TRIMDONE */
                 if (baduns & (1 << chn)) {
                         qib_dev_err(dd,
-                                "Reseting TRIMDONE on chn %d (%s)\n",
+                                "Resetting TRIMDONE on chn %d (%s)\n",
                                 chn, where);
                         ret = qib_sd7220_reg_mod(dd, IB_7220_SERDES,
                                 IB_CTRL2(chn), 0x10, 0x10);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 95ecf4eadf5f..24683fda8e21 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1271,12 +1271,15 @@ struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path
 void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx)
 {
         struct ipoib_dev_priv *priv = netdev_priv(tx->dev);
+        unsigned long flags;
         if (test_and_clear_bit(IPOIB_FLAG_INITIALIZED, &tx->flags)) {
+                spin_lock_irqsave(&priv->lock, flags);
                 list_move(&tx->list, &priv->cm.reap_list);
                 queue_work(ipoib_workqueue, &priv->cm.reap_task);
                 ipoib_dbg(priv, "Reap connection for gid %pI6\n",
                           tx->neigh->daddr + 4);
                 tx->neigh = NULL;
+                spin_unlock_irqrestore(&priv->lock, flags);
         }
 }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 97920b77a5d0..3e2085a3ee47 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1052,7 +1052,7 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh)
         for (n = rcu_dereference_protected(*np,
                                             lockdep_is_held(&ntbl->rwlock));
              n != NULL;
-             n = rcu_dereference_protected(neigh->hnext,
+             n = rcu_dereference_protected(*np,
                                         lockdep_is_held(&ntbl->rwlock))) {
                 if (n == neigh) {
                         /* found */
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index bcbf22ee0aa7..1b5b0c730054 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -586,24 +586,62 @@ static void srp_unmap_data(struct scsi_cmnd *scmnd,
                         scmnd->sc_data_direction);
 }
 
-static void srp_remove_req(struct srp_target_port *target,
-                           struct srp_request *req, s32 req_lim_delta)
+/**
+ * srp_claim_req - Take ownership of the scmnd associated with a request.
+ * @target: SRP target port.
+ * @req: SRP request.
+ * @scmnd: If NULL, take ownership of @req->scmnd. If not NULL, only take
+ *         ownership of @req->scmnd if it equals @scmnd.
+ *
+ * Return value:
+ * Either NULL or a pointer to the SCSI command the caller became owner of.
+ */
+static struct scsi_cmnd *srp_claim_req(struct srp_target_port *target,
+                                       struct srp_request *req,
+                                       struct scsi_cmnd *scmnd)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&target->lock, flags);
+        if (!scmnd) {
+                scmnd = req->scmnd;
+                req->scmnd = NULL;
+        } else if (req->scmnd == scmnd) {
+                req->scmnd = NULL;
+        } else {
+                scmnd = NULL;
+        }
+        spin_unlock_irqrestore(&target->lock, flags);
+
+        return scmnd;
+}
+
+/**
+ * srp_free_req() - Unmap data and add request to the free request list.
+ */
+static void srp_free_req(struct srp_target_port *target,
+                         struct srp_request *req, struct scsi_cmnd *scmnd,
+                         s32 req_lim_delta)
 {
         unsigned long flags;
 
-        srp_unmap_data(req->scmnd, target, req);
+        srp_unmap_data(scmnd, target, req);
+
         spin_lock_irqsave(&target->lock, flags);
         target->req_lim += req_lim_delta;
-        req->scmnd = NULL;
         list_add_tail(&req->list, &target->free_reqs);
         spin_unlock_irqrestore(&target->lock, flags);
 }
 
 static void srp_reset_req(struct srp_target_port *target, struct srp_request *req)
 {
-        req->scmnd->result = DID_RESET << 16;
-        req->scmnd->scsi_done(req->scmnd);
-        srp_remove_req(target, req, 0);
+        struct scsi_cmnd *scmnd = srp_claim_req(target, req, NULL);
+
+        if (scmnd) {
+                scmnd->result = DID_RESET << 16;
+                scmnd->scsi_done(scmnd);
+                srp_free_req(target, req, scmnd, 0);
+        }
 }
 
 static int srp_reconnect_target(struct srp_target_port *target)
@@ -1073,11 +1111,18 @@ static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
                 complete(&target->tsk_mgmt_done);
         } else {
                 req = &target->req_ring[rsp->tag];
-                scmnd = req->scmnd;
-                if (!scmnd)
+                scmnd = srp_claim_req(target, req, NULL);
+                if (!scmnd) {
                         shost_printk(KERN_ERR, target->scsi_host,
                                      "Null scmnd for RSP w/tag %016llx\n",
                                      (unsigned long long) rsp->tag);
+
+                        spin_lock_irqsave(&target->lock, flags);
+                        target->req_lim += be32_to_cpu(rsp->req_lim_delta);
+                        spin_unlock_irqrestore(&target->lock, flags);
+
+                        return;
+                }
                 scmnd->result = rsp->status;
 
                 if (rsp->flags & SRP_RSP_FLAG_SNSVALID) {
@@ -1092,7 +1137,9 @@ static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
                 else if (rsp->flags & (SRP_RSP_FLAG_DIOVER | SRP_RSP_FLAG_DIUNDER))
                         scsi_set_resid(scmnd, be32_to_cpu(rsp->data_in_res_cnt));
 
-                srp_remove_req(target, req, be32_to_cpu(rsp->req_lim_delta));
+                srp_free_req(target, req, scmnd,
+                             be32_to_cpu(rsp->req_lim_delta));
+
                 scmnd->host_scribble = NULL;
                 scmnd->scsi_done(scmnd);
         }
@@ -1631,25 +1678,17 @@ static int srp_abort(struct scsi_cmnd *scmnd)
 {
         struct srp_target_port *target = host_to_target(scmnd->device->host);
         struct srp_request *req = (struct srp_request *) scmnd->host_scribble;
-        int ret = SUCCESS;
 
         shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n");
 
-        if (!req || target->qp_in_error)
+        if (!req || target->qp_in_error || !srp_claim_req(target, req, scmnd))
                 return FAILED;
-        if (srp_send_tsk_mgmt(target, req->index, scmnd->device->lun,
-                              SRP_TSK_ABORT_TASK))
-                return FAILED;
-
-        if (req->scmnd) {
-                if (!target->tsk_mgmt_status) {
-                        srp_remove_req(target, req, 0);
-                        scmnd->result = DID_ABORT << 16;
-                } else
-                        ret = FAILED;
-        }
+        srp_send_tsk_mgmt(target, req->index, scmnd->device->lun,
+                          SRP_TSK_ABORT_TASK);
+        srp_free_req(target, req, scmnd, 0);
+        scmnd->result = DID_ABORT << 16;
 
-        return ret;
+        return SUCCESS;
 }
 
 static int srp_reset_device(struct scsi_cmnd *scmnd)
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 7a0ce8d42887..9e1449f8c6a2 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1469,7 +1469,7 @@ static void srpt_handle_send_comp(struct srpt_rdma_ch *ch,
  *
  * XXX: what is now target_execute_cmd used to be asynchronous, and unmapping
  * the data that has been transferred via IB RDMA had to be postponed until the
- * check_stop_free() callback.  None of this is nessecary anymore and needs to
+ * check_stop_free() callback.  None of this is necessary anymore and needs to
  * be cleaned up.
  */
 static void srpt_handle_rdma_comp(struct srpt_rdma_ch *ch,