14 files changed, 231 insertions, 19 deletions

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 245057df69d6..94144ed50a6b 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -841,6 +841,9 @@ static void ata_scsi_dev_config(struct scsi_device *sdev,
                 blk_queue_max_hw_segments(q, q->max_hw_segments - 1);
         }
 
+        if (dev->flags & ATA_DFLAG_AN)
+                set_bit(SDEV_EVT_MEDIA_CHANGE, sdev->supported_events);
+
         if (dev->flags & ATA_DFLAG_NCQ) {
                 int depth;
 
@@ -3296,10 +3299,9 @@ static void ata_scsi_handle_link_detach(struct ata_link *link)
  */
 void ata_scsi_media_change_notify(struct ata_device *dev)
 {
-#ifdef OTHER_AN_PATCHES_HAVE_BEEN_APPLIED
         if (dev->sdev)
-                scsi_device_event_notify(dev->sdev, SDEV_MEDIA_CHANGE);
-#endif
+                sdev_evt_send_simple(dev->sdev, SDEV_EVT_MEDIA_CHANGE,
+                                     GFP_ATOMIC);
 }
 
 /**
diff --git a/drivers/char/drm/radeon_cp.c b/drivers/char/drm/radeon_cp.c
index 335423c5c186..24fca8ec1379 100644
--- a/drivers/char/drm/radeon_cp.c
+++ b/drivers/char/drm/radeon_cp.c
@@ -1679,7 +1679,7 @@ static int radeon_do_init_cp(struct drm_device * dev, drm_radeon_init_t * init)
                         dev_priv->gart_info.bus_addr =
                             dev_priv->pcigart_offset + dev_priv->fb_location;
                         dev_priv->gart_info.mapping.offset =
-                            dev_priv->gart_info.bus_addr;
+                            dev_priv->pcigart_offset + dev_priv->fb_aper_offset;
                         dev_priv->gart_info.mapping.size =
                             dev_priv->gart_info.table_size;
 
@@ -2275,7 +2275,8 @@ int radeon_driver_firstopen(struct drm_device *dev)
         if (ret != 0)
                 return ret;
 
-        ret = drm_addmap(dev, drm_get_resource_start(dev, 0),
+        dev_priv->fb_aper_offset = drm_get_resource_start(dev, 0);
+        ret = drm_addmap(dev, dev_priv->fb_aper_offset,
                          drm_get_resource_len(dev, 0), _DRM_FRAME_BUFFER,
                          _DRM_WRITE_COMBINING, &map);
         if (ret != 0)
diff --git a/drivers/char/drm/radeon_drv.h b/drivers/char/drm/radeon_drv.h
index e4077bc212b3..bfbb60a9298c 100644
--- a/drivers/char/drm/radeon_drv.h
+++ b/drivers/char/drm/radeon_drv.h
@@ -293,6 +293,7 @@ typedef struct drm_radeon_private {
 
         /* starting from here on, data is preserved accross an open */
         uint32_t flags;         /* see radeon_chip_flags */
+        unsigned long fb_aper_offset;
 } drm_radeon_private_t;
 
 typedef struct drm_radeon_buf_priv {
diff --git a/drivers/char/drm/sis_mm.c b/drivers/char/drm/sis_mm.c
index 6be1c5757580..a6b7ccdaf73d 100644
--- a/drivers/char/drm/sis_mm.c
+++ b/drivers/char/drm/sis_mm.c
@@ -134,6 +134,7 @@ static int sis_drm_alloc(struct drm_device *dev, struct drm_file *file_priv,
                       dev_priv->agp_initialized)) {
                 DRM_ERROR
                     ("Attempt to allocate from uninitialized memory manager.\n");
+                mutex_unlock(&dev->struct_mutex);
                 return -EINVAL;
         }
 
diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index 859f870552e3..5e083d1f57e7 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -193,6 +193,12 @@ dcssblk_segment_warn(int rc, char* seg_name)
         }
 }
 
+static void dcssblk_unregister_callback(struct device *dev)
+{
+        device_unregister(dev);
+        put_device(dev);
+}
+
 /*
  * device attribute for switching shared/nonshared (exclusive)
  * operation (show + store)
@@ -276,8 +282,7 @@ removeseg:
         blk_cleanup_queue(dev_info->dcssblk_queue);
         dev_info->gd->queue = NULL;
         put_disk(dev_info->gd);
-        device_unregister(dev);
-        put_device(dev);
+        rc = device_schedule_callback(dev, dcssblk_unregister_callback);
 out:
         up_write(&dcssblk_devices_sem);
         return rc;
diff --git a/drivers/s390/cio/cmf.c b/drivers/s390/cio/cmf.c
index 725b0dd14269..f4c132ab39ed 100644
--- a/drivers/s390/cio/cmf.c
+++ b/drivers/s390/cio/cmf.c
@@ -343,10 +343,10 @@ static int cmf_copy_block(struct ccw_device *cdev)
 
         if (sch->schib.scsw.fctl & SCSW_FCTL_START_FUNC) {
                 /* Don't copy if a start function is in progress. */
-                if ((!sch->schib.scsw.actl & SCSW_ACTL_SUSPENDED) &&
+                if ((!(sch->schib.scsw.actl & SCSW_ACTL_SUSPENDED)) &&
                     (sch->schib.scsw.actl &
                      (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT)) &&
-                    (!sch->schib.scsw.stctl & SCSW_STCTL_SEC_STATUS))
+                    (!(sch->schib.scsw.stctl & SCSW_STCTL_SEC_STATUS)))
                         return -EBUSY;
         }
         cmb_data = cdev->private->cmb;
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 7ee57f084a89..74f6b539974a 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -738,7 +738,7 @@ static int io_subchannel_initialize_dev(struct subchannel *sch,
         atomic_set(&cdev->private->onoff, 0);
         cdev->dev.parent = &sch->dev;
         cdev->dev.release = ccw_device_release;
-        INIT_LIST_HEAD(&cdev->private->kick_work.entry);
+        INIT_WORK(&cdev->private->kick_work, NULL);
         cdev->dev.groups = ccwdev_attr_groups;
         /* Do first half of device_register. */
         device_initialize(&cdev->dev);
diff --git a/drivers/s390/net/smsgiucv.c b/drivers/s390/net/smsgiucv.c
index 3ccca5871fdf..47bb47b48581 100644
--- a/drivers/s390/net/smsgiucv.c
+++ b/drivers/s390/net/smsgiucv.c
@@ -148,6 +148,10 @@ static int __init smsg_init(void)
 {
         int rc;
 
+        if (!MACHINE_IS_VM) {
+                rc = -EPROTONOSUPPORT;
+                goto out;
+        }
         rc = driver_register(&smsg_driver);
         if (rc != 0)
                 goto out;
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index 22d91ee173c5..5f2396c03958 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -556,7 +556,7 @@ static int ibmvscsi_send_srp_event(struct srp_event_struct *evt_struct,
                                    unsigned long timeout)
 {
         u64 *crq_as_u64 = (u64 *) &evt_struct->crq;
-        int request_status;
+        int request_status = 0;
         int rc;
 
         /* If we have exhausted our request limit, just fail this request,
@@ -574,6 +574,13 @@ static int ibmvscsi_send_srp_event(struct srp_event_struct *evt_struct,
                 if (request_status < -1)
                         goto send_error;
                 /* Otherwise, we may have run out of requests. */
+                /* If request limit was 0 when we started the adapter is in the
+                 * process of performing a login with the server adapter, or
+                 * we may have run out of requests.
+                 */
+                else if (request_status == -1 &&
+                         evt_struct->iu.srp.login_req.opcode != SRP_LOGIN_REQ)
+                        goto send_busy;
                 /* Abort and reset calls should make it through.
                  * Nothing except abort and reset should use the last two
                  * slots unless we had two or less to begin with.
@@ -633,7 +640,8 @@ static int ibmvscsi_send_srp_event(struct srp_event_struct *evt_struct,
         unmap_cmd_data(&evt_struct->iu.srp.cmd, evt_struct, hostdata->dev);
 
         free_event_struct(&hostdata->pool, evt_struct);
-        atomic_inc(&hostdata->request_limit);
+        if (request_status != -1)
+                atomic_inc(&hostdata->request_limit);
         return SCSI_MLQUEUE_HOST_BUSY;
 
  send_error:
@@ -927,10 +935,11 @@ static int send_srp_login(struct ibmvscsi_host_data *hostdata)
         login->req_buf_fmt = SRP_BUF_FORMAT_DIRECT | SRP_BUF_FORMAT_INDIRECT;
         
         spin_lock_irqsave(hostdata->host->host_lock, flags);
-        /* Start out with a request limit of 1, since this is negotiated in
-         * the login request we are just sending
+        /* Start out with a request limit of 0, since this is negotiated in
+         * the login request we are just sending and login requests always
+         * get sent by the driver regardless of request_limit.
          */
-        atomic_set(&hostdata->request_limit, 1);
+        atomic_set(&hostdata->request_limit, 0);
 
         rc = ibmvscsi_send_srp_event(evt_struct, hostdata, init_timeout * 2);
         spin_unlock_irqrestore(hostdata->host->host_lock, flags);
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index c0755565fae9..4e46045dea6d 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -682,6 +682,7 @@ lpfc_scsi_prep_cmnd(struct lpfc_vport *vport, struct lpfc_scsi_buf *lpfc_cmd,
         IOCB_t *iocb_cmd = &lpfc_cmd->cur_iocbq.iocb;
         struct lpfc_iocbq *piocbq = &(lpfc_cmd->cur_iocbq);
         int datadir = scsi_cmnd->sc_data_direction;
+        char tag[2];
 
         lpfc_cmd->fcp_rsp->rspSnsLen = 0;
         /* clear task management bits */
@@ -692,8 +693,8 @@ lpfc_scsi_prep_cmnd(struct lpfc_vport *vport, struct lpfc_scsi_buf *lpfc_cmd,
 
         memcpy(&fcp_cmnd->fcpCdb[0], scsi_cmnd->cmnd, 16);
 
-        if (scsi_cmnd->device->tagged_supported) {
-                switch (scsi_cmnd->tag) {
+        if (scsi_populate_tag_msg(scsi_cmnd, tag)) {
+                switch (tag[0]) {
                 case HEAD_OF_QUEUE_TAG:
                         fcp_cmnd->fcpCntl1 = HEAD_OF_Q;
                         break;
diff --git a/drivers/scsi/osst.c b/drivers/scsi/osst.c
index 4652ad22516b..abef7048f25b 100644
--- a/drivers/scsi/osst.c
+++ b/drivers/scsi/osst.c
@@ -593,10 +593,11 @@ static int osst_verify_frame(struct osst_tape * STp, int frame_seq_number, int q
         if (aux->frame_type != OS_FRAME_TYPE_DATA &&
             aux->frame_type != OS_FRAME_TYPE_EOD &&
             aux->frame_type != OS_FRAME_TYPE_MARKER) {
-                if (!quiet)
+                if (!quiet) {
 #if DEBUG
                         printk(OSST_DEB_MSG "%s:D: Skipping frame, frame type %x\n", name, aux->frame_type);
 #endif
+                }
                 goto err_out;
         }
         if (aux->frame_type == OS_FRAME_TYPE_EOD &&
@@ -606,11 +607,12 @@ static int osst_verify_frame(struct osst_tape * STp, int frame_seq_number, int q
                 goto err_out;
         }
         if (frame_seq_number != -1 && ntohl(aux->frame_seq_num) != frame_seq_number) {
-                if (!quiet)
+                if (!quiet) {
 #if DEBUG
                         printk(OSST_DEB_MSG "%s:D: Skipping frame, sequence number %u (expected %d)\n", 
                                             name, ntohl(aux->frame_seq_num), frame_seq_number);
 #endif
+                }
                 goto err_out;
         }
         if (aux->frame_type == OS_FRAME_TYPE_MARKER) {
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 88de771d3569..0e81e4cf8876 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -2115,6 +2115,142 @@ scsi_device_set_state(struct scsi_device *sdev, enum scsi_device_state state)
 EXPORT_SYMBOL(scsi_device_set_state);
 
 /**
+ *      sdev_evt_emit - emit a single SCSI device uevent
+ *      @sdev: associated SCSI device
+ *      @evt: event to emit
+ *
+ *      Send a single uevent (scsi_event) to the associated scsi_device.
+ */
+static void scsi_evt_emit(struct scsi_device *sdev, struct scsi_event *evt)
+{
+        int idx = 0;
+        char *envp[3];
+
+        switch (evt->evt_type) {
+        case SDEV_EVT_MEDIA_CHANGE:
+                envp[idx++] = "SDEV_MEDIA_CHANGE=1";
+                break;
+
+        default:
+                /* do nothing */
+                break;
+        }
+
+        envp[idx++] = NULL;
+
+        kobject_uevent_env(&sdev->sdev_gendev.kobj, KOBJ_CHANGE, envp);
+}
+
+/**
+ *      sdev_evt_thread - send a uevent for each scsi event
+ *      @work: work struct for scsi_device
+ *
+ *      Dispatch queued events to their associated scsi_device kobjects
+ *      as uevents.
+ */
+void scsi_evt_thread(struct work_struct *work)
+{
+        struct scsi_device *sdev;
+        LIST_HEAD(event_list);
+
+        sdev = container_of(work, struct scsi_device, event_work);
+
+        while (1) {
+                struct scsi_event *evt;
+                struct list_head *this, *tmp;
+                unsigned long flags;
+
+                spin_lock_irqsave(&sdev->list_lock, flags);
+                list_splice_init(&sdev->event_list, &event_list);
+                spin_unlock_irqrestore(&sdev->list_lock, flags);
+
+                if (list_empty(&event_list))
+                        break;
+
+                list_for_each_safe(this, tmp, &event_list) {
+                        evt = list_entry(this, struct scsi_event, node);
+                        list_del(&evt->node);
+                        scsi_evt_emit(sdev, evt);
+                        kfree(evt);
+                }
+        }
+}
+
+/**
+ *      sdev_evt_send - send asserted event to uevent thread
+ *      @sdev: scsi_device event occurred on
+ *      @evt: event to send
+ *
+ *      Assert scsi device event asynchronously.
+ */
+void sdev_evt_send(struct scsi_device *sdev, struct scsi_event *evt)
+{
+        unsigned long flags;
+
+        if (!test_bit(evt->evt_type, sdev->supported_events)) {
+                kfree(evt);
+                return;
+        }
+
+        spin_lock_irqsave(&sdev->list_lock, flags);
+        list_add_tail(&evt->node, &sdev->event_list);
+        schedule_work(&sdev->event_work);
+        spin_unlock_irqrestore(&sdev->list_lock, flags);
+}
+EXPORT_SYMBOL_GPL(sdev_evt_send);
+
+/**
+ *      sdev_evt_alloc - allocate a new scsi event
+ *      @evt_type: type of event to allocate
+ *      @gfpflags: GFP flags for allocation
+ *
+ *      Allocates and returns a new scsi_event.
+ */
+struct scsi_event *sdev_evt_alloc(enum scsi_device_event evt_type,
+                                  gfp_t gfpflags)
+{
+        struct scsi_event *evt = kzalloc(sizeof(struct scsi_event), gfpflags);
+        if (!evt)
+                return NULL;
+
+        evt->evt_type = evt_type;
+        INIT_LIST_HEAD(&evt->node);
+
+        /* evt_type-specific initialization, if any */
+        switch (evt_type) {
+        case SDEV_EVT_MEDIA_CHANGE:
+        default:
+                /* do nothing */
+                break;
+        }
+
+        return evt;
+}
+EXPORT_SYMBOL_GPL(sdev_evt_alloc);
+
+/**
+ *      sdev_evt_send_simple - send asserted event to uevent thread
+ *      @sdev: scsi_device event occurred on
+ *      @evt_type: type of event to send
+ *      @gfpflags: GFP flags for allocation
+ *
+ *      Assert scsi device event asynchronously, given an event type.
+ */
+void sdev_evt_send_simple(struct scsi_device *sdev,
+                          enum scsi_device_event evt_type, gfp_t gfpflags)
+{
+        struct scsi_event *evt = sdev_evt_alloc(evt_type, gfpflags);
+        if (!evt) {
+                sdev_printk(KERN_ERR, sdev, "event %d eaten due to OOM\n",
+                            evt_type);
+                return;
+        }
+
+        sdev_evt_send(sdev, evt);
+}
+EXPORT_SYMBOL_GPL(sdev_evt_send_simple);
+
+/**
  *      scsi_device_quiesce - Block user issued commands.
  *      @sdev:  scsi device to quiesce.
  *
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index b53c5f67e372..40ea71cd2ca6 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -236,6 +236,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
         struct scsi_device *sdev;
         int display_failure_msg = 1, ret;
         struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
+        extern void scsi_evt_thread(struct work_struct *work);
 
         sdev = kzalloc(sizeof(*sdev) + shost->transportt->device_size,
                        GFP_ATOMIC);
@@ -254,7 +255,9 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
         INIT_LIST_HEAD(&sdev->same_target_siblings);
         INIT_LIST_HEAD(&sdev->cmd_list);
         INIT_LIST_HEAD(&sdev->starved_entry);
+        INIT_LIST_HEAD(&sdev->event_list);
         spin_lock_init(&sdev->list_lock);
+        INIT_WORK(&sdev->event_work, scsi_evt_thread);
 
         sdev->sdev_gendev.parent = get_device(&starget->dev);
         sdev->sdev_target = starget;
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index d531ceeb0d8c..f374fdcb6815 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -268,6 +268,7 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
         struct scsi_device *sdev;
         struct device *parent;
         struct scsi_target *starget;
+        struct list_head *this, *tmp;
         unsigned long flags;
 
         sdev = container_of(work, struct scsi_device, ew.work);
@@ -282,6 +283,16 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
         list_del(&sdev->starved_entry);
         spin_unlock_irqrestore(sdev->host->host_lock, flags);
 
+        cancel_work_sync(&sdev->event_work);
+
+        list_for_each_safe(this, tmp, &sdev->event_list) {
+                struct scsi_event *evt;
+
+                evt = list_entry(this, struct scsi_event, node);
+                list_del(&evt->node);
+                kfree(evt);
+        }
+
         if (sdev->request_queue) {
                 sdev->request_queue->queuedata = NULL;
                 /* user context needed to free queue */
@@ -614,6 +625,41 @@ sdev_show_modalias(struct device *dev, struct device_attribute *attr, char *buf)
 }
 static DEVICE_ATTR(modalias, S_IRUGO, sdev_show_modalias, NULL);
 
+#define DECLARE_EVT_SHOW(name, Cap_name)                                \
+static ssize_t                                                          \
+sdev_show_evt_##name(struct device *dev, struct device_attribute *attr, \
+                                char *buf)                              \
+{                                                                       \
+        struct scsi_device *sdev = to_scsi_device(dev);                 \
+        int val = test_bit(SDEV_EVT_##Cap_name, sdev->supported_events);\
+        return snprintf(buf, 20, "%d\n", val);                          \
+}
+
+#define DECLARE_EVT_STORE(name, Cap_name)                               \
+static ssize_t                                                          \
+sdev_store_evt_##name(struct device *dev, struct device_attribute *attr, \
+                      const char *buf, size_t count)                    \
+{                                                                       \
+        struct scsi_device *sdev = to_scsi_device(dev);                 \
+        int val = simple_strtoul(buf, NULL, 0);                         \
+        if (val == 0)                                                   \
+                clear_bit(SDEV_EVT_##Cap_name, sdev->supported_events); \
+        else if (val == 1)                                              \
+                set_bit(SDEV_EVT_##Cap_name, sdev->supported_events);   \
+        else                                                            \
+                return -EINVAL;                                         \
+        return count;                                                   \
+}
+
+#define DECLARE_EVT(name, Cap_name)                                     \
+        DECLARE_EVT_SHOW(name, Cap_name)                                \
+        DECLARE_EVT_STORE(name, Cap_name)                               \
+        static DEVICE_ATTR(evt_##name, S_IRUGO, sdev_show_evt_##name,   \
+                           sdev_store_evt_##name);
+#define REF_EVT(name) &dev_attr_evt_##name.attr
+
+DECLARE_EVT(media_change, MEDIA_CHANGE)
+
 /* Default template for device attributes.  May NOT be modified */
 static struct attribute *scsi_sdev_attrs[] = {
         &dev_attr_device_blocked.attr,
@@ -631,6 +677,7 @@ static struct attribute *scsi_sdev_attrs[] = {
         &dev_attr_iodone_cnt.attr,
         &dev_attr_ioerr_cnt.attr,
         &dev_attr_modalias.attr,
+        REF_EVT(media_change),
         NULL
 };