From c89c017aea95aaab6f872faf73665e67148ccf5f Mon Sep 17 00:00:00 2001 From: Maximilian Attems Date: Sat, 25 Jun 2011 08:04:21 +0000 Subject: [PATCH] add stable 2.6.39.2 remove patch that ships in it svn path=/dists/sid/linux-2.6/; revision=17723 --- debian/changelog | 7 + ...-should-access-bd_disk-only-after-su.patch | 41 - debian/patches/bugfix/all/stable/2.6.39.2 | 2839 +++++++++++++++++ debian/patches/series/3 | 2 +- 4 files changed, 2847 insertions(+), 42 deletions(-) delete mode 100644 debian/patches/bugfix/all/block-blkdev_get-should-access-bd_disk-only-after-su.patch create mode 100644 debian/patches/bugfix/all/stable/2.6.39.2 diff --git a/debian/changelog b/debian/changelog index 25f010550..14df4d944 100644 --- a/debian/changelog +++ b/debian/changelog @@ -6,6 +6,13 @@ linux-2.6 (2.6.39-3) UNRELEASED; urgency=low * block: Fix crash (oops) in blkdev_get() on failed exclusive open (Closes: #631574) + [ maximilian attems ] + * Add stable 2.6.39.2, including: + - drm/radeon/kms: viewport height has to be even + - drm/radeon/kms: fix for radeon on systems >4GB without hardware iommu + - fat: Fix corrupt inode flags when remove ATTR_SYS flag + - scsi: Fix oops caused by queue refcounting failure + -- Ben Hutchings Tue, 21 Jun 2011 05:27:43 +0100 linux-2.6 (2.6.39-2) unstable; urgency=low diff --git a/debian/patches/bugfix/all/block-blkdev_get-should-access-bd_disk-only-after-su.patch b/debian/patches/bugfix/all/block-blkdev_get-should-access-bd_disk-only-after-su.patch deleted file mode 100644 index 7db1a364c..000000000 --- a/debian/patches/bugfix/all/block-blkdev_get-should-access-bd_disk-only-after-su.patch +++ /dev/null @@ -1,41 +0,0 @@ -From: Tejun Heo -Date: Wed, 1 Jun 2011 08:27:41 +0200 -Subject: [PATCH] block: blkdev_get() should access ->bd_disk only after - success - -commit 4c49ff3fe128ca68dabd07537415c419ad7f82f9 upstream. - -d4dc210f69 (block: don't block events on excl write for non-optical -devices) added dereferencing of bdev->bd_disk to test -GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE; however, bdev->bd_disk can be -%NULL if open failed which can lead to an oops. - -Test the flag after testing open was successful, not before. - -Signed-off-by: Tejun Heo -Reported-by: David Miller -Tested-by: David Miller -Cc: stable@kernel.org -Signed-off-by: Jens Axboe ---- - fs/block_dev.c | 4 ++-- - 1 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/fs/block_dev.c b/fs/block_dev.c -index 1f2b199..1a2421f 100644 ---- a/fs/block_dev.c -+++ b/fs/block_dev.c -@@ -1272,8 +1272,8 @@ int blkdev_get(struct block_device *bdev, fmode_t mode, void *holder) - * individual writeable reference is too fragile given the - * way @mode is used in blkdev_get/put(). - */ -- if ((disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE) && -- !res && (mode & FMODE_WRITE) && !bdev->bd_write_holder) { -+ if (!res && (mode & FMODE_WRITE) && !bdev->bd_write_holder && -+ (disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE)) { - bdev->bd_write_holder = true; - disk_block_events(disk); - } --- -1.7.5.4 - diff --git a/debian/patches/bugfix/all/stable/2.6.39.2 b/debian/patches/bugfix/all/stable/2.6.39.2 new file mode 100644 index 000000000..78dc01a9c --- /dev/null +++ b/debian/patches/bugfix/all/stable/2.6.39.2 @@ -0,0 +1,2839 @@ +diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt +index cc85a92..066b642 100644 +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -2590,6 +2590,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted. + unlock ejectable media); + m = MAX_SECTORS_64 (don't transfer more + than 64 sectors = 32 KB at a time); ++ n = INITIAL_READ10 (force a retry of the ++ initial READ(10) command); + o = CAPACITY_OK (accept the capacity + reported by the device); + r = IGNORE_RESIDUE (the device reports +diff --git a/arch/powerpc/kernel/head_32.S b/arch/powerpc/kernel/head_32.S +index c5c24be..727f40a 100644 +--- a/arch/powerpc/kernel/head_32.S ++++ b/arch/powerpc/kernel/head_32.S +@@ -896,7 +896,7 @@ _GLOBAL(start_secondary_resume) + rlwinm r1,r1,0,0,(31-THREAD_SHIFT) /* current_thread_info() */ + addi r1,r1,THREAD_SIZE-STACK_FRAME_OVERHEAD + li r3,0 +- std r3,0(r1) /* Zero the stack frame pointer */ ++ stw r3,0(r1) /* Zero the stack frame pointer */ + bl start_secondary + b . + #endif /* CONFIG_SMP */ +diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c +index cbdbb14..f2dcab7 100644 +--- a/arch/powerpc/kernel/smp.c ++++ b/arch/powerpc/kernel/smp.c +@@ -410,8 +410,6 @@ int __cpuinit __cpu_up(unsigned int cpu) + { + int rc, c; + +- secondary_ti = current_set[cpu]; +- + if (smp_ops == NULL || + (smp_ops->cpu_bootable && !smp_ops->cpu_bootable(cpu))) + return -EINVAL; +@@ -421,6 +419,8 @@ int __cpuinit __cpu_up(unsigned int cpu) + if (rc) + return rc; + ++ secondary_ti = current_set[cpu]; ++ + /* Make sure callin-map entry is 0 (can be leftover a CPU + * hotplug + */ +diff --git a/arch/tile/kernel/pci.c b/arch/tile/kernel/pci.c +index ea38f0c..1073269 100644 +--- a/arch/tile/kernel/pci.c ++++ b/arch/tile/kernel/pci.c +@@ -179,12 +179,6 @@ int __init tile_pci_init(void) + + controller = &controllers[num_controllers]; + +- if (tile_init_irqs(i, controller)) { +- pr_err("PCI: Could not initialize " +- "IRQs, aborting.\n"); +- goto err_cont; +- } +- + controller->index = num_controllers; + controller->hv_cfg_fd[0] = hv_cfg_fd0; + controller->hv_cfg_fd[1] = hv_cfg_fd1; +@@ -300,6 +294,11 @@ static int __init pcibios_init(void) + struct pci_controller *controller = &controllers[i]; + struct pci_bus *bus; + ++ if (tile_init_irqs(i, controller)) { ++ pr_err("PCI: Could not initialize IRQS\n"); ++ continue; ++ } ++ + pr_info("PCI: initializing controller #%d\n", i); + + /* +diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c +index 57ca777..e7115c8 100644 +--- a/arch/x86/kernel/amd_iommu.c ++++ b/arch/x86/kernel/amd_iommu.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -153,6 +154,10 @@ static int iommu_init_device(struct device *dev) + pdev = pci_get_bus_and_slot(PCI_BUS(alias), alias & 0xff); + if (pdev) + dev_data->alias = &pdev->dev; ++ else { ++ kfree(dev_data); ++ return -ENOTSUPP; ++ } + + atomic_set(&dev_data->bind, 0); + +@@ -162,6 +167,20 @@ static int iommu_init_device(struct device *dev) + return 0; + } + ++static void iommu_ignore_device(struct device *dev) ++{ ++ u16 devid, alias; ++ ++ devid = get_device_id(dev); ++ alias = amd_iommu_alias_table[devid]; ++ ++ memset(&amd_iommu_dev_table[devid], 0, sizeof(struct dev_table_entry)); ++ memset(&amd_iommu_dev_table[alias], 0, sizeof(struct dev_table_entry)); ++ ++ amd_iommu_rlookup_table[devid] = NULL; ++ amd_iommu_rlookup_table[alias] = NULL; ++} ++ + static void iommu_uninit_device(struct device *dev) + { + kfree(dev->archdata.iommu); +@@ -191,7 +210,9 @@ int __init amd_iommu_init_devices(void) + continue; + + ret = iommu_init_device(&pdev->dev); +- if (ret) ++ if (ret == -ENOTSUPP) ++ iommu_ignore_device(&pdev->dev); ++ else if (ret) + goto out_free; + } + +@@ -2296,6 +2317,23 @@ static struct dma_map_ops amd_iommu_dma_ops = { + .dma_supported = amd_iommu_dma_supported, + }; + ++static unsigned device_dma_ops_init(void) ++{ ++ struct pci_dev *pdev = NULL; ++ unsigned unhandled = 0; ++ ++ for_each_pci_dev(pdev) { ++ if (!check_device(&pdev->dev)) { ++ unhandled += 1; ++ continue; ++ } ++ ++ pdev->dev.archdata.dma_ops = &amd_iommu_dma_ops; ++ } ++ ++ return unhandled; ++} ++ + /* + * The function which clues the AMD IOMMU driver into dma_ops. + */ +@@ -2308,7 +2346,7 @@ void __init amd_iommu_init_api(void) + int __init amd_iommu_init_dma_ops(void) + { + struct amd_iommu *iommu; +- int ret; ++ int ret, unhandled; + + /* + * first allocate a default protection domain for every IOMMU we +@@ -2334,7 +2372,11 @@ int __init amd_iommu_init_dma_ops(void) + swiotlb = 0; + + /* Make the driver finally visible to the drivers */ +- dma_ops = &amd_iommu_dma_ops; ++ unhandled = device_dma_ops_init(); ++ if (unhandled && max_pfn > MAX_DMA32_PFN) { ++ /* There are unhandled devices - initialize swiotlb for them */ ++ swiotlb = 1; ++ } + + amd_iommu_stats_init(); + +diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c +index 246d727..b9e207e 100644 +--- a/arch/x86/kernel/amd_iommu_init.c ++++ b/arch/x86/kernel/amd_iommu_init.c +@@ -701,8 +701,8 @@ static void __init init_iommu_from_acpi(struct amd_iommu *iommu, + { + u8 *p = (u8 *)h; + u8 *end = p, flags = 0; +- u16 dev_i, devid = 0, devid_start = 0, devid_to = 0; +- u32 ext_flags = 0; ++ u16 devid = 0, devid_start = 0, devid_to = 0; ++ u32 dev_i, ext_flags = 0; + bool alias = false; + struct ivhd_entry *e; + +@@ -857,7 +857,7 @@ static void __init init_iommu_from_acpi(struct amd_iommu *iommu, + /* Initializes the device->iommu mapping for the driver */ + static int __init init_iommu_devices(struct amd_iommu *iommu) + { +- u16 i; ++ u32 i; + + for (i = iommu->first_device; i <= iommu->last_device; ++i) + set_iommu_for_device(iommu, i); +@@ -1146,7 +1146,7 @@ static int __init init_memory_definitions(struct acpi_table_header *table) + */ + static void init_device_table(void) + { +- u16 devid; ++ u32 devid; + + for (devid = 0; devid <= amd_iommu_last_bdf; ++devid) { + set_dev_entry_bit(devid, DEV_ENTRY_VALID); +diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c +index e90f084..bea9c03 100644 +--- a/arch/x86/kernel/devicetree.c ++++ b/arch/x86/kernel/devicetree.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -98,6 +99,16 @@ void * __init early_init_dt_alloc_memory_arch(u64 size, u64 align) + return __alloc_bootmem(size, align, __pa(MAX_DMA_ADDRESS)); + } + ++#ifdef CONFIG_BLK_DEV_INITRD ++void __init early_init_dt_setup_initrd_arch(unsigned long start, ++ unsigned long end) ++{ ++ initrd_start = (unsigned long)__va(start); ++ initrd_end = (unsigned long)__va(end); ++ initrd_below_start_ok = 1; ++} ++#endif ++ + void __init add_dtb(u64 data) + { + initial_dtb = data + offsetof(struct setup_data, data); +diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c +index 8d12878..a3d0dc5 100644 +--- a/arch/x86/kernel/process_32.c ++++ b/arch/x86/kernel/process_32.c +@@ -245,7 +245,6 @@ start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp) + { + set_user_gs(regs, 0); + regs->fs = 0; +- set_fs(USER_DS); + regs->ds = __USER_DS; + regs->es = __USER_DS; + regs->ss = __USER_DS; +diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c +index 6c9dd92..ca6f7ab 100644 +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -338,7 +338,6 @@ start_thread_common(struct pt_regs *regs, unsigned long new_ip, + regs->cs = _cs; + regs->ss = _ss; + regs->flags = X86_EFLAGS_IF; +- set_fs(USER_DS); + /* + * Free the old FP and other extended state + */ +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index c6724e4..4be9b39 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -912,13 +912,6 @@ void __init setup_arch(char **cmdline_p) + memblock.current_limit = get_max_mapped(); + memblock_x86_fill(); + +- /* +- * The EFI specification says that boot service code won't be called +- * after ExitBootServices(). This is, in fact, a lie. +- */ +- if (efi_enabled) +- efi_reserve_boot_services(); +- + /* preallocate 4k for mptable mpc */ + early_reserve_e820_mpc_new(); + +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index c2871d3..c58d144 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -285,6 +285,19 @@ notrace static void __cpuinit start_secondary(void *unused) + per_cpu(cpu_state, smp_processor_id()) = CPU_ONLINE; + x86_platform.nmi_init(); + ++ /* ++ * Wait until the cpu which brought this one up marked it ++ * online before enabling interrupts. If we don't do that then ++ * we can end up waking up the softirq thread before this cpu ++ * reached the active state, which makes the scheduler unhappy ++ * and schedule the softirq thread on the wrong cpu. This is ++ * only observable with forced threaded interrupts, but in ++ * theory it could also happen w/o them. It's just way harder ++ * to achieve. ++ */ ++ while (!cpumask_test_cpu(smp_processor_id(), cpu_active_mask)) ++ cpu_relax(); ++ + /* enable local interrupts */ + local_irq_enable(); + +diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c +index 1cd6089..493ea1f 100644 +--- a/arch/x86/lguest/boot.c ++++ b/arch/x86/lguest/boot.c +@@ -995,6 +995,7 @@ static void lguest_time_irq(unsigned int irq, struct irq_desc *desc) + static void lguest_time_init(void) + { + /* Set up the timer interrupt (0) to go to our simple timer routine */ ++ lguest_setup_irq(0); + irq_set_handler(0, lguest_time_irq); + + clocksource_register(&lguest_clock); +diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c +index b00c4ea..0fe27d7 100644 +--- a/arch/x86/platform/efi/efi.c ++++ b/arch/x86/platform/efi/efi.c +@@ -315,40 +315,6 @@ static void __init print_efi_memmap(void) + } + #endif /* EFI_DEBUG */ + +-void __init efi_reserve_boot_services(void) +-{ +- void *p; +- +- for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { +- efi_memory_desc_t *md = p; +- unsigned long long start = md->phys_addr; +- unsigned long long size = md->num_pages << EFI_PAGE_SHIFT; +- +- if (md->type != EFI_BOOT_SERVICES_CODE && +- md->type != EFI_BOOT_SERVICES_DATA) +- continue; +- +- memblock_x86_reserve_range(start, start + size, "EFI Boot"); +- } +-} +- +-static void __init efi_free_boot_services(void) +-{ +- void *p; +- +- for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { +- efi_memory_desc_t *md = p; +- unsigned long long start = md->phys_addr; +- unsigned long long size = md->num_pages << EFI_PAGE_SHIFT; +- +- if (md->type != EFI_BOOT_SERVICES_CODE && +- md->type != EFI_BOOT_SERVICES_DATA) +- continue; +- +- free_bootmem_late(start, size); +- } +-} +- + void __init efi_init(void) + { + efi_config_table_t *config_tables; +@@ -541,9 +507,7 @@ void __init efi_enter_virtual_mode(void) + efi.systab = NULL; + for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { + md = p; +- if (!(md->attribute & EFI_MEMORY_RUNTIME) && +- md->type != EFI_BOOT_SERVICES_CODE && +- md->type != EFI_BOOT_SERVICES_DATA) ++ if (!(md->attribute & EFI_MEMORY_RUNTIME)) + continue; + + size = md->num_pages << EFI_PAGE_SHIFT; +@@ -594,13 +558,6 @@ void __init efi_enter_virtual_mode(void) + } + + /* +- * Thankfully, it does seem that no runtime services other than +- * SetVirtualAddressMap() will touch boot services code, so we can +- * get rid of it all at this point +- */ +- efi_free_boot_services(); +- +- /* + * Now that EFI is in virtual mode, update the function + * pointers in the runtime service table to the new virtual addresses. + * +diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c +index 641264c..ac0621a 100644 +--- a/arch/x86/platform/efi/efi_64.c ++++ b/arch/x86/platform/efi/efi_64.c +@@ -64,11 +64,10 @@ static void __init early_runtime_code_mapping_set_exec(int executable) + if (!(__supported_pte_mask & _PAGE_NX)) + return; + +- /* Make EFI service code area executable */ ++ /* Make EFI runtime service code area executable */ + for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { + md = p; +- if (md->type == EFI_RUNTIME_SERVICES_CODE || +- md->type == EFI_BOOT_SERVICES_CODE) { ++ if (md->type == EFI_RUNTIME_SERVICES_CODE) { + unsigned long end; + end = md->phys_addr + (md->num_pages << EFI_PAGE_SHIFT); + early_mapping_set_exec(md->phys_addr, end, executable); +diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c +index 8bff7e7..1b2b73f 100644 +--- a/arch/x86/xen/multicalls.c ++++ b/arch/x86/xen/multicalls.c +@@ -189,10 +189,10 @@ struct multicall_space __xen_mc_entry(size_t args) + unsigned argidx = roundup(b->argidx, sizeof(u64)); + + BUG_ON(preemptible()); +- BUG_ON(b->argidx > MC_ARGS); ++ BUG_ON(b->argidx >= MC_ARGS); + + if (b->mcidx == MC_BATCH || +- (argidx + args) > MC_ARGS) { ++ (argidx + args) >= MC_ARGS) { + mc_stats_flush(b->mcidx == MC_BATCH ? FL_SLOTS : FL_ARGS); + xen_mc_flush(); + argidx = roundup(b->argidx, sizeof(u64)); +@@ -206,7 +206,7 @@ struct multicall_space __xen_mc_entry(size_t args) + ret.args = &b->args[argidx]; + b->argidx = argidx + args; + +- BUG_ON(b->argidx > MC_ARGS); ++ BUG_ON(b->argidx >= MC_ARGS); + return ret; + } + +@@ -216,7 +216,7 @@ struct multicall_space xen_mc_extend_args(unsigned long op, size_t size) + struct multicall_space ret = { NULL, NULL }; + + BUG_ON(preemptible()); +- BUG_ON(b->argidx > MC_ARGS); ++ BUG_ON(b->argidx >= MC_ARGS); + + if (b->mcidx == 0) + return ret; +@@ -224,14 +224,14 @@ struct multicall_space xen_mc_extend_args(unsigned long op, size_t size) + if (b->entries[b->mcidx - 1].op != op) + return ret; + +- if ((b->argidx + size) > MC_ARGS) ++ if ((b->argidx + size) >= MC_ARGS) + return ret; + + ret.mc = &b->entries[b->mcidx - 1]; + ret.args = &b->args[b->argidx]; + b->argidx += size; + +- BUG_ON(b->argidx > MC_ARGS); ++ BUG_ON(b->argidx >= MC_ARGS); + return ret; + } + +diff --git a/block/blk-core.c b/block/blk-core.c +index 3fe00a1..5323076 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -345,6 +345,7 @@ void blk_put_queue(struct request_queue *q) + { + kobject_put(&q->kobj); + } ++EXPORT_SYMBOL(blk_put_queue); + + /* + * Note: If a driver supplied the queue lock, it should not zap that lock +@@ -566,6 +567,7 @@ int blk_get_queue(struct request_queue *q) + + return 1; + } ++EXPORT_SYMBOL(blk_get_queue); + + static inline void blk_free_request(struct request_queue *q, struct request *rq) + { +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index e6fc716..a576406 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -756,6 +756,12 @@ static int __init nbd_init(void) + if (max_part > 0) + part_shift = fls(max_part); + ++ if ((1UL << part_shift) > DISK_MAX_PARTS) ++ return -EINVAL; ++ ++ if (nbds_max > 1UL << (MINORBITS - part_shift)) ++ return -EINVAL; ++ + for (i = 0; i < nbds_max; i++) { + struct gendisk *disk = alloc_disk(1 << part_shift); + if (!disk) +diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c +index 4f1b8de..7c7a1e4 100644 +--- a/drivers/cpufreq/cpufreq_stats.c ++++ b/drivers/cpufreq/cpufreq_stats.c +@@ -388,6 +388,7 @@ static void __exit cpufreq_stats_exit(void) + unregister_hotcpu_notifier(&cpufreq_stat_cpu_notifier); + for_each_online_cpu(cpu) { + cpufreq_stats_free_table(cpu); ++ cpufreq_stats_free_sysfs(cpu); + } + } + +diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c +index 67cb076..b28f7bd 100644 +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -727,6 +727,14 @@ static const struct dmi_system_id intel_no_lvds[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "U800"), + }, + }, ++ { ++ .callback = intel_no_lvds_dmi_callback, ++ .ident = "Asus EeeBox PC EB1007", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "EB1007"), ++ }, ++ }, + + { } /* terminating entry */ + }; +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index 529a3a7..02705c7 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -1011,7 +1011,7 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc, + uint64_t fb_location; + uint32_t fb_format, fb_pitch_pixels, tiling_flags; + u32 fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_NONE); +- u32 tmp; ++ u32 tmp, viewport_w, viewport_h; + int r; + + /* no fb bound */ +@@ -1137,8 +1137,10 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc, + y &= ~1; + WREG32(EVERGREEN_VIEWPORT_START + radeon_crtc->crtc_offset, + (x << 16) | y); ++ viewport_w = crtc->mode.hdisplay; ++ viewport_h = (crtc->mode.vdisplay + 1) & ~1; + WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset, +- (crtc->mode.hdisplay << 16) | crtc->mode.vdisplay); ++ (viewport_w << 16) | viewport_h); + + /* pageflip setup */ + /* make sure flip is at vb rather than hb */ +@@ -1179,7 +1181,7 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc, + uint64_t fb_location; + uint32_t fb_format, fb_pitch_pixels, tiling_flags; + u32 fb_swap = R600_D1GRPH_SWAP_ENDIAN_NONE; +- u32 tmp; ++ u32 tmp, viewport_w, viewport_h; + int r; + + /* no fb bound */ +@@ -1304,8 +1306,10 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc, + y &= ~1; + WREG32(AVIVO_D1MODE_VIEWPORT_START + radeon_crtc->crtc_offset, + (x << 16) | y); ++ viewport_w = crtc->mode.hdisplay; ++ viewport_h = (crtc->mode.vdisplay + 1) & ~1; + WREG32(AVIVO_D1MODE_VIEWPORT_SIZE + radeon_crtc->crtc_offset, +- (crtc->mode.hdisplay << 16) | crtc->mode.vdisplay); ++ (viewport_w << 16) | viewport_h); + + /* pageflip setup */ + /* make sure flip is at vb rather than hb */ +diff --git a/drivers/gpu/drm/radeon/r100_track.h b/drivers/gpu/drm/radeon/r100_track.h +index 2fef9de..686f9dc 100644 +--- a/drivers/gpu/drm/radeon/r100_track.h ++++ b/drivers/gpu/drm/radeon/r100_track.h +@@ -63,7 +63,7 @@ struct r100_cs_track { + unsigned num_arrays; + unsigned max_indx; + unsigned color_channel_mask; +- struct r100_cs_track_array arrays[11]; ++ struct r100_cs_track_array arrays[16]; + struct r100_cs_track_cb cb[R300_MAX_CB]; + struct r100_cs_track_cb zb; + struct r100_cs_track_cb aa; +@@ -146,6 +146,12 @@ static inline int r100_packet3_load_vbpntr(struct radeon_cs_parser *p, + ib = p->ib->ptr; + track = (struct r100_cs_track *)p->track; + c = radeon_get_ib_value(p, idx++) & 0x1F; ++ if (c > 16) { ++ DRM_ERROR("Only 16 vertex buffers are allowed %d\n", ++ pkt->opcode); ++ r100_cs_dump_packet(p, pkt); ++ return -EINVAL; ++ } + track->num_arrays = c; + for (i = 0; i < (c - 1); i+=2, idx+=3) { + r = r100_cs_packet_next_reloc(p, &reloc); +diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c +index 890217e..5d6ccc3 100644 +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -752,6 +752,7 @@ int radeon_device_init(struct radeon_device *rdev, + dma_bits = rdev->need_dma32 ? 32 : 40; + r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(dma_bits)); + if (r) { ++ rdev->need_dma32 = true; + printk(KERN_WARNING "radeon: No suitable DMA available.\n"); + } + +diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c +index 194ca0a..08cea44 100644 +--- a/drivers/hwmon/coretemp.c ++++ b/drivers/hwmon/coretemp.c +@@ -263,7 +263,7 @@ static int __devinit get_tjmax(struct cpuinfo_x86 *c, u32 id, + * If the TjMax is not plausible, an assumption + * will be used + */ +- if ((val > 80) && (val < 120)) { ++ if (val >= 70 && val <= 125) { + dev_info(dev, "TjMax is %d C.\n", val); + return val * 1000; + } +@@ -271,24 +271,9 @@ static int __devinit get_tjmax(struct cpuinfo_x86 *c, u32 id, + + /* + * An assumption is made for early CPUs and unreadable MSR. +- * NOTE: the given value may not be correct. ++ * NOTE: the calculated value may not be correct. + */ +- +- switch (c->x86_model) { +- case 0xe: +- case 0xf: +- case 0x16: +- case 0x1a: +- dev_warn(dev, "TjMax is assumed as 100 C!\n"); +- return 100000; +- case 0x17: +- case 0x1c: /* Atom CPUs */ +- return adjust_tjmax(c, id, dev); +- default: +- dev_warn(dev, "CPU (model=0x%x) is not supported yet," +- " using default TjMax of 100C.\n", c->x86_model); +- return 100000; +- } ++ return adjust_tjmax(c, id, dev); + } + + static void __devinit get_ucode_rev_on_cpu(void *edx) +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 4a4c0f8..9930792 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -2462,7 +2462,7 @@ slot_store(mdk_rdev_t *rdev, const char *buf, size_t len) + if (rdev->raid_disk == -1) + return -EEXIST; + /* personality does all needed checks */ +- if (rdev->mddev->pers->hot_add_disk == NULL) ++ if (rdev->mddev->pers->hot_remove_disk == NULL) + return -EINVAL; + err = rdev->mddev->pers-> + hot_remove_disk(rdev->mddev, rdev->raid_disk); +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 49bf5f8..3d13d11 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -129,7 +129,7 @@ static inline int raid5_dec_bi_hw_segments(struct bio *bio) + + static inline void raid5_set_bi_hw_segments(struct bio *bio, unsigned int cnt) + { +- bio->bi_phys_segments = raid5_bi_phys_segments(bio) || (cnt << 16); ++ bio->bi_phys_segments = raid5_bi_phys_segments(bio) | (cnt << 16); + } + + /* Find first data disk in a raid6 stripe */ +@@ -514,7 +514,7 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s) + bi = &sh->dev[i].req; + + bi->bi_rw = rw; +- if (rw == WRITE) ++ if (rw & WRITE) + bi->bi_end_io = raid5_end_write_request; + else + bi->bi_end_io = raid5_end_read_request; +@@ -548,13 +548,13 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s) + bi->bi_io_vec[0].bv_offset = 0; + bi->bi_size = STRIPE_SIZE; + bi->bi_next = NULL; +- if (rw == WRITE && ++ if ((rw & WRITE) && + test_bit(R5_ReWrite, &sh->dev[i].flags)) + atomic_add(STRIPE_SECTORS, + &rdev->corrected_errors); + generic_make_request(bi); + } else { +- if (rw == WRITE) ++ if (rw & WRITE) + set_bit(STRIPE_DEGRADED, &sh->state); + pr_debug("skip op %ld on disc %d for sector %llu\n", + bi->bi_rw, i, (unsigned long long)sh->sector); +diff --git a/drivers/media/media-devnode.c b/drivers/media/media-devnode.c +index af5263c..7b42ace 100644 +--- a/drivers/media/media-devnode.c ++++ b/drivers/media/media-devnode.c +@@ -213,14 +213,14 @@ int __must_check media_devnode_register(struct media_devnode *mdev) + + /* Part 1: Find a free minor number */ + mutex_lock(&media_devnode_lock); +- minor = find_next_zero_bit(media_devnode_nums, 0, MEDIA_NUM_DEVICES); ++ minor = find_next_zero_bit(media_devnode_nums, MEDIA_NUM_DEVICES, 0); + if (minor == MEDIA_NUM_DEVICES) { + mutex_unlock(&media_devnode_lock); + printk(KERN_ERR "could not get a free minor\n"); + return -ENFILE; + } + +- set_bit(mdev->minor, media_devnode_nums); ++ set_bit(minor, media_devnode_nums); + mutex_unlock(&media_devnode_lock); + + mdev->minor = minor; +diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c +index 0dfd1b9..0e3fccb 100644 +--- a/drivers/net/igb/igb_main.c ++++ b/drivers/net/igb/igb_main.c +@@ -2372,6 +2372,9 @@ static int __devinit igb_sw_init(struct igb_adapter *adapter) + } + #endif /* CONFIG_PCI_IOV */ + adapter->rss_queues = min_t(u32, IGB_MAX_RX_QUEUES, num_online_cpus()); ++ /* i350 cannot do RSS and SR-IOV at the same time */ ++ if (hw->mac.type == e1000_i350 && adapter->vfs_allocated_count) ++ adapter->rss_queues = 1; + + /* + * if rss_queues > 4 or vfs are going to be allocated with rss_queues +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index 1033ef6..f2b974d 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -1254,6 +1254,7 @@ static struct usb_driver cdc_ncm_driver = { + .disconnect = cdc_ncm_disconnect, + .suspend = usbnet_suspend, + .resume = usbnet_resume, ++ .reset_resume = usbnet_resume, + .supports_autosuspend = 1, + }; + +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +index 37af3f4..db4416c 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +@@ -4598,10 +4598,16 @@ static void ar9003_hw_set_power_per_rate_table(struct ath_hw *ah, + case 1: + break; + case 2: +- scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN; ++ if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN) ++ scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN; ++ else ++ scaledPower = 0; + break; + case 3: +- scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN; ++ if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN) ++ scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN; ++ else ++ scaledPower = 0; + break; + } + +diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c +index 8cd8333..945e448 100644 +--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c ++++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c +@@ -522,10 +522,16 @@ static void ath9k_hw_set_ar9287_power_per_rate_table(struct ath_hw *ah, + case 1: + break; + case 2: +- scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN; ++ if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN) ++ scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN; ++ else ++ scaledPower = 0; + break; + case 3: +- scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN; ++ if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN) ++ scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN; ++ else ++ scaledPower = 0; + break; + } + scaledPower = max((u16)0, scaledPower); +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index 1482fa6..846bb4f 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -633,7 +633,8 @@ void ath9k_tasklet(unsigned long data) + u32 status = sc->intrstatus; + u32 rxmask; + +- if (status & ATH9K_INT_FATAL) { ++ if ((status & ATH9K_INT_FATAL) || ++ (status & ATH9K_INT_BB_WATCHDOG)) { + ath_reset(sc, true); + return; + } +@@ -699,6 +700,7 @@ irqreturn_t ath_isr(int irq, void *dev) + { + #define SCHED_INTR ( \ + ATH9K_INT_FATAL | \ ++ ATH9K_INT_BB_WATCHDOG | \ + ATH9K_INT_RXORN | \ + ATH9K_INT_RXEOL | \ + ATH9K_INT_RX | \ +diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c +index 4c0d36a..a39dfc4 100644 +--- a/drivers/net/wireless/ath/ath9k/rc.c ++++ b/drivers/net/wireless/ath/ath9k/rc.c +@@ -689,7 +689,8 @@ static void ath_rc_rate_set_series(const struct ath_rate_table *rate_table, + + if (WLAN_RC_PHY_HT(rate_table->info[rix].phy)) { + rate->flags |= IEEE80211_TX_RC_MCS; +- if (WLAN_RC_PHY_40(rate_table->info[rix].phy)) ++ if (WLAN_RC_PHY_40(rate_table->info[rix].phy) && ++ conf_is_ht40(&txrc->hw->conf)) + rate->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH; + if (WLAN_RC_PHY_SGI(rate_table->info[rix].phy)) + rate->flags |= IEEE80211_TX_RC_SHORT_GI; +diff --git a/drivers/net/wireless/iwlegacy/iwl-4965-lib.c b/drivers/net/wireless/iwlegacy/iwl-4965-lib.c +index 5a8a3cc..455f1f7 100644 +--- a/drivers/net/wireless/iwlegacy/iwl-4965-lib.c ++++ b/drivers/net/wireless/iwlegacy/iwl-4965-lib.c +@@ -628,11 +628,11 @@ void iwl4965_rx_reply_rx(struct iwl_priv *priv, + + /* rx_status carries information about the packet to mac80211 */ + rx_status.mactime = le64_to_cpu(phy_res->timestamp); ++ rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ? ++ IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ; + rx_status.freq = + ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel), + rx_status.band); +- rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ? +- IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ; + rx_status.rate_idx = + iwl4965_hwrate_to_mac80211_idx(rate_n_flags, rx_status.band); + rx_status.flag = 0; +diff --git a/drivers/net/wireless/iwlegacy/iwl-4965.c b/drivers/net/wireless/iwlegacy/iwl-4965.c +index f5433c7..facc94e 100644 +--- a/drivers/net/wireless/iwlegacy/iwl-4965.c ++++ b/drivers/net/wireless/iwlegacy/iwl-4965.c +@@ -1218,10 +1218,10 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *c + * receive commit_rxon request + * abort any previous channel switch if still in process + */ +- if (priv->switch_rxon.switch_in_progress && +- (priv->switch_rxon.channel != ctx->staging.channel)) { ++ if (test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status) && ++ (priv->switch_channel != ctx->staging.channel)) { + IWL_DEBUG_11H(priv, "abort channel switch on %d\n", +- le16_to_cpu(priv->switch_rxon.channel)); ++ le16_to_cpu(priv->switch_channel)); + iwl_legacy_chswitch_done(priv, false); + } + +@@ -1237,7 +1237,7 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *c + + memcpy(active_rxon, &ctx->staging, sizeof(*active_rxon)); + iwl_legacy_print_rx_config_cmd(priv, ctx); +- return 0; ++ goto set_tx_power; + } + + /* If we are currently associated and the new config requires +@@ -1317,6 +1317,7 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *c + + iwl4965_init_sensitivity(priv); + ++set_tx_power: + /* If we issue a new RXON command which required a tune then we must + * send a new TXPOWER command or we won't be able to Tx any frames */ + ret = iwl_legacy_set_tx_power(priv, priv->tx_power_next, true); +@@ -1403,9 +1404,6 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv, + return rc; + } + +- priv->switch_rxon.channel = cmd.channel; +- priv->switch_rxon.switch_in_progress = true; +- + return iwl_legacy_send_cmd_pdu(priv, + REPLY_CHANNEL_SWITCH, sizeof(cmd), &cmd); + } +@@ -1543,7 +1541,7 @@ static void iwl4965_temperature_calib(struct iwl_priv *priv) + s32 temp; + + temp = iwl4965_hw_get_temperature(priv); +- if (temp < 0) ++ if (IWL_TX_POWER_TEMPERATURE_OUT_OF_RANGE(temp)) + return; + + if (priv->temperature != temp) { +diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c +index 42db0fc..8ad7922 100644 +--- a/drivers/net/wireless/iwlegacy/iwl-core.c ++++ b/drivers/net/wireless/iwlegacy/iwl-core.c +@@ -862,12 +862,8 @@ void iwl_legacy_chswitch_done(struct iwl_priv *priv, bool is_success) + if (test_bit(STATUS_EXIT_PENDING, &priv->status)) + return; + +- if (priv->switch_rxon.switch_in_progress) { ++ if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status)) + ieee80211_chswitch_done(ctx->vif, is_success); +- mutex_lock(&priv->mutex); +- priv->switch_rxon.switch_in_progress = false; +- mutex_unlock(&priv->mutex); +- } + } + EXPORT_SYMBOL(iwl_legacy_chswitch_done); + +@@ -879,19 +875,19 @@ void iwl_legacy_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb) + struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS]; + struct iwl_legacy_rxon_cmd *rxon = (void *)&ctx->active; + +- if (priv->switch_rxon.switch_in_progress) { +- if (!le32_to_cpu(csa->status) && +- (csa->channel == priv->switch_rxon.channel)) { +- rxon->channel = csa->channel; +- ctx->staging.channel = csa->channel; +- IWL_DEBUG_11H(priv, "CSA notif: channel %d\n", +- le16_to_cpu(csa->channel)); +- iwl_legacy_chswitch_done(priv, true); +- } else { +- IWL_ERR(priv, "CSA notif (fail) : channel %d\n", ++ if (!test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status)) ++ return; ++ ++ if (!le32_to_cpu(csa->status) && csa->channel == priv->switch_channel) { ++ rxon->channel = csa->channel; ++ ctx->staging.channel = csa->channel; ++ IWL_DEBUG_11H(priv, "CSA notif: channel %d\n", + le16_to_cpu(csa->channel)); +- iwl_legacy_chswitch_done(priv, false); +- } ++ iwl_legacy_chswitch_done(priv, true); ++ } else { ++ IWL_ERR(priv, "CSA notif (fail) : channel %d\n", ++ le16_to_cpu(csa->channel)); ++ iwl_legacy_chswitch_done(priv, false); + } + } + EXPORT_SYMBOL(iwl_legacy_rx_csa); +diff --git a/drivers/net/wireless/iwlegacy/iwl-core.h b/drivers/net/wireless/iwlegacy/iwl-core.h +index f03b463..e49176a 100644 +--- a/drivers/net/wireless/iwlegacy/iwl-core.h ++++ b/drivers/net/wireless/iwlegacy/iwl-core.h +@@ -561,7 +561,7 @@ void iwl_legacy_free_geos(struct iwl_priv *priv); + #define STATUS_SCAN_HW 15 + #define STATUS_POWER_PMI 16 + #define STATUS_FW_ERROR 17 +- ++#define STATUS_CHANNEL_SWITCH_PENDING 18 + + static inline int iwl_legacy_is_ready(struct iwl_priv *priv) + { +diff --git a/drivers/net/wireless/iwlegacy/iwl-dev.h b/drivers/net/wireless/iwlegacy/iwl-dev.h +index f43ac1e..54f89b4 100644 +--- a/drivers/net/wireless/iwlegacy/iwl-dev.h ++++ b/drivers/net/wireless/iwlegacy/iwl-dev.h +@@ -854,17 +854,6 @@ struct traffic_stats { + }; + + /* +- * iwl_switch_rxon: "channel switch" structure +- * +- * @ switch_in_progress: channel switch in progress +- * @ channel: new channel +- */ +-struct iwl_switch_rxon { +- bool switch_in_progress; +- __le16 channel; +-}; +- +-/* + * schedule the timer to wake up every UCODE_TRACE_PERIOD milliseconds + * to perform continuous uCode event logging operation if enabled + */ +@@ -1115,7 +1104,7 @@ struct iwl_priv { + + struct iwl_rxon_context contexts[NUM_IWL_RXON_CTX]; + +- struct iwl_switch_rxon switch_rxon; ++ __le16 switch_channel; + + /* 1st responses from initialize and runtime uCode images. + * _4965's initialize alive response contains some calibration data. */ +diff --git a/drivers/net/wireless/iwlegacy/iwl4965-base.c b/drivers/net/wireless/iwlegacy/iwl4965-base.c +index a62fe24..d654876 100644 +--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c ++++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c +@@ -2851,16 +2851,13 @@ void iwl4965_mac_channel_switch(struct ieee80211_hw *hw, + goto out_exit; + + if (test_bit(STATUS_EXIT_PENDING, &priv->status) || +- test_bit(STATUS_SCANNING, &priv->status)) ++ test_bit(STATUS_SCANNING, &priv->status) || ++ test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status)) + goto out_exit; + + if (!iwl_legacy_is_associated_ctx(ctx)) + goto out_exit; + +- /* channel switch in progress */ +- if (priv->switch_rxon.switch_in_progress == true) +- goto out_exit; +- + mutex_lock(&priv->mutex); + if (priv->cfg->ops->lib->set_channel_switch) { + +@@ -2910,16 +2907,20 @@ void iwl4965_mac_channel_switch(struct ieee80211_hw *hw, + * at this point, staging_rxon has the + * configuration for channel switch + */ ++ set_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status); ++ priv->switch_channel = cpu_to_le16(ch); + if (priv->cfg->ops->lib->set_channel_switch(priv, +- ch_switch)) +- priv->switch_rxon.switch_in_progress = false; ++ ch_switch)) { ++ clear_bit(STATUS_CHANNEL_SWITCH_PENDING, ++ &priv->status); ++ priv->switch_channel = 0; ++ ieee80211_chswitch_done(ctx->vif, false); ++ } + } + } + out: + mutex_unlock(&priv->mutex); + out_exit: +- if (!priv->switch_rxon.switch_in_progress) +- ieee80211_chswitch_done(ctx->vif, false); + IWL_DEBUG_MAC80211(priv, "leave\n"); + } + +diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c +index d7b6126..d474cf3 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-2000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-2000.c +@@ -181,79 +181,6 @@ static int iwl2000_hw_set_hw_params(struct iwl_priv *priv) + return 0; + } + +-static int iwl2030_hw_channel_switch(struct iwl_priv *priv, +- struct ieee80211_channel_switch *ch_switch) +-{ +- /* +- * MULTI-FIXME +- * See iwl_mac_channel_switch. +- */ +- struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS]; +- struct iwl6000_channel_switch_cmd cmd; +- const struct iwl_channel_info *ch_info; +- u32 switch_time_in_usec, ucode_switch_time; +- u16 ch; +- u32 tsf_low; +- u8 switch_count; +- u16 beacon_interval = le16_to_cpu(ctx->timing.beacon_interval); +- struct ieee80211_vif *vif = ctx->vif; +- struct iwl_host_cmd hcmd = { +- .id = REPLY_CHANNEL_SWITCH, +- .len = sizeof(cmd), +- .flags = CMD_SYNC, +- .data = &cmd, +- }; +- +- cmd.band = priv->band == IEEE80211_BAND_2GHZ; +- ch = ch_switch->channel->hw_value; +- IWL_DEBUG_11H(priv, "channel switch from %u to %u\n", +- ctx->active.channel, ch); +- cmd.channel = cpu_to_le16(ch); +- cmd.rxon_flags = ctx->staging.flags; +- cmd.rxon_filter_flags = ctx->staging.filter_flags; +- switch_count = ch_switch->count; +- tsf_low = ch_switch->timestamp & 0x0ffffffff; +- /* +- * calculate the ucode channel switch time +- * adding TSF as one of the factor for when to switch +- */ +- if ((priv->ucode_beacon_time > tsf_low) && beacon_interval) { +- if (switch_count > ((priv->ucode_beacon_time - tsf_low) / +- beacon_interval)) { +- switch_count -= (priv->ucode_beacon_time - +- tsf_low) / beacon_interval; +- } else +- switch_count = 0; +- } +- if (switch_count <= 1) +- cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time); +- else { +- switch_time_in_usec = +- vif->bss_conf.beacon_int * switch_count * TIME_UNIT; +- ucode_switch_time = iwl_usecs_to_beacons(priv, +- switch_time_in_usec, +- beacon_interval); +- cmd.switch_time = iwl_add_beacon_time(priv, +- priv->ucode_beacon_time, +- ucode_switch_time, +- beacon_interval); +- } +- IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n", +- cmd.switch_time); +- ch_info = iwl_get_channel_info(priv, priv->band, ch); +- if (ch_info) +- cmd.expect_beacon = is_channel_radar(ch_info); +- else { +- IWL_ERR(priv, "invalid channel switch from %u to %u\n", +- ctx->active.channel, ch); +- return -EFAULT; +- } +- priv->switch_rxon.channel = cmd.channel; +- priv->switch_rxon.switch_in_progress = true; +- +- return iwl_send_cmd_sync(priv, &hcmd); +-} +- + static struct iwl_lib_ops iwl2000_lib = { + .set_hw_params = iwl2000_hw_set_hw_params, + .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl, +@@ -277,7 +204,6 @@ static struct iwl_lib_ops iwl2000_lib = { + .alive_notify = iwlagn_alive_notify, + .send_tx_power = iwlagn_send_tx_power, + .update_chain_flags = iwl_update_chain_flags, +- .set_channel_switch = iwl2030_hw_channel_switch, + .apm_ops = { + .init = iwl_apm_init, + .config = iwl2000_nic_config, +diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c +index 22e045b..dcf40e8 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-5000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c +@@ -337,8 +337,6 @@ static int iwl5000_hw_channel_switch(struct iwl_priv *priv, + ctx->active.channel, ch); + return -EFAULT; + } +- priv->switch_rxon.channel = cmd.channel; +- priv->switch_rxon.switch_in_progress = true; + + return iwl_send_cmd_sync(priv, &hcmd); + } +@@ -513,7 +511,6 @@ static struct iwl_base_params iwl5000_base_params = { + }; + static struct iwl_ht_params iwl5000_ht_params = { + .ht_greenfield_support = true, +- .use_rts_for_aggregation = true, /* use rts/cts protection */ + }; + + #define IWL_DEVICE_5000 \ +diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c +index a745b01..9035255 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-6000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-6000.c +@@ -277,8 +277,6 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv, + ctx->active.channel, ch); + return -EFAULT; + } +- priv->switch_rxon.channel = cmd.channel; +- priv->switch_rxon.switch_in_progress = true; + + return iwl_send_cmd_sync(priv, &hcmd); + } +diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c +index 41543ad..129a551 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c +@@ -217,17 +217,9 @@ static void iwlagn_tx_cmd_protection(struct iwl_priv *priv, + __le16 fc, __le32 *tx_flags) + { + if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS || +- info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) { ++ info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT || ++ info->flags & IEEE80211_TX_CTL_AMPDU) + *tx_flags |= TX_CMD_FLG_PROT_REQUIRE_MSK; +- return; +- } +- +- if (priv->cfg->ht_params && +- priv->cfg->ht_params->use_rts_for_aggregation && +- info->flags & IEEE80211_TX_CTL_AMPDU) { +- *tx_flags |= TX_CMD_FLG_PROT_REQUIRE_MSK; +- return; +- } + } + + /* Calc max signal level (dBm) among 3 possible receivers */ +diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c +index fbbde07..7c0f80c 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c +@@ -173,6 +173,14 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx) + return 0; + } + ++ /* ++ * force CTS-to-self frames protection if RTS-CTS is not preferred ++ * one aggregation protection method ++ */ ++ if (!(priv->cfg->ht_params && ++ priv->cfg->ht_params->use_rts_for_aggregation)) ++ ctx->staging.flags |= RXON_FLG_SELF_CTS_EN; ++ + if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) || + !(ctx->staging.flags & RXON_FLG_BAND_24G_MSK)) + ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK; +@@ -189,10 +197,10 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx) + * receive commit_rxon request + * abort any previous channel switch if still in process + */ +- if (priv->switch_rxon.switch_in_progress && +- (priv->switch_rxon.channel != ctx->staging.channel)) { ++ if (test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status) && ++ (priv->switch_channel != ctx->staging.channel)) { + IWL_DEBUG_11H(priv, "abort channel switch on %d\n", +- le16_to_cpu(priv->switch_rxon.channel)); ++ le16_to_cpu(priv->switch_channel)); + iwl_chswitch_done(priv, false); + } + +@@ -210,6 +218,11 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx) + + memcpy(active, &ctx->staging, sizeof(*active)); + iwl_print_rx_config_cmd(priv, ctx); ++ /* ++ * We do not commit tx power settings while channel changing, ++ * do it now if after settings changed. ++ */ ++ iwl_set_tx_power(priv, priv->tx_power_next, false); + return 0; + } + +diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c +index 321b18b..5941e61 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-agn.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c +@@ -3461,16 +3461,13 @@ void iwlagn_mac_channel_switch(struct ieee80211_hw *hw, + goto out_exit; + + if (test_bit(STATUS_EXIT_PENDING, &priv->status) || +- test_bit(STATUS_SCANNING, &priv->status)) ++ test_bit(STATUS_SCANNING, &priv->status) || ++ test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status)) + goto out_exit; + + if (!iwl_is_associated_ctx(ctx)) + goto out_exit; + +- /* channel switch in progress */ +- if (priv->switch_rxon.switch_in_progress == true) +- goto out_exit; +- + mutex_lock(&priv->mutex); + if (priv->cfg->ops->lib->set_channel_switch) { + +@@ -3520,16 +3517,20 @@ void iwlagn_mac_channel_switch(struct ieee80211_hw *hw, + * at this point, staging_rxon has the + * configuration for channel switch + */ ++ set_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status); ++ priv->switch_channel = cpu_to_le16(ch); + if (priv->cfg->ops->lib->set_channel_switch(priv, +- ch_switch)) +- priv->switch_rxon.switch_in_progress = false; ++ ch_switch)) { ++ clear_bit(STATUS_CHANNEL_SWITCH_PENDING, ++ &priv->status); ++ priv->switch_channel = 0; ++ ieee80211_chswitch_done(ctx->vif, false); ++ } + } + } + out: + mutex_unlock(&priv->mutex); + out_exit: +- if (!priv->switch_rxon.switch_in_progress) +- ieee80211_chswitch_done(ctx->vif, false); + IWL_DEBUG_MAC80211(priv, "leave\n"); + } + +diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c +index 1755729..7950bc4 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-core.c ++++ b/drivers/net/wireless/iwlwifi/iwl-core.c +@@ -861,12 +861,8 @@ void iwl_chswitch_done(struct iwl_priv *priv, bool is_success) + if (test_bit(STATUS_EXIT_PENDING, &priv->status)) + return; + +- if (priv->switch_rxon.switch_in_progress) { ++ if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status)) + ieee80211_chswitch_done(ctx->vif, is_success); +- mutex_lock(&priv->mutex); +- priv->switch_rxon.switch_in_progress = false; +- mutex_unlock(&priv->mutex); +- } + } + + #ifdef CONFIG_IWLWIFI_DEBUG +diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h +index b316d83..92f65b6 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-core.h ++++ b/drivers/net/wireless/iwlwifi/iwl-core.h +@@ -662,7 +662,7 @@ void iwlcore_free_geos(struct iwl_priv *priv); + #define STATUS_SCAN_HW 15 + #define STATUS_POWER_PMI 16 + #define STATUS_FW_ERROR 17 +- ++#define STATUS_CHANNEL_SWITCH_PENDING 19 + + static inline int iwl_is_ready(struct iwl_priv *priv) + { +diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h +index c0a4cfb..65a16ae 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-dev.h ++++ b/drivers/net/wireless/iwlwifi/iwl-dev.h +@@ -1037,17 +1037,6 @@ struct traffic_stats { + }; + + /* +- * iwl_switch_rxon: "channel switch" structure +- * +- * @ switch_in_progress: channel switch in progress +- * @ channel: new channel +- */ +-struct iwl_switch_rxon { +- bool switch_in_progress; +- __le16 channel; +-}; +- +-/* + * schedule the timer to wake up every UCODE_TRACE_PERIOD milliseconds + * to perform continuous uCode event logging operation if enabled + */ +@@ -1344,7 +1333,7 @@ struct iwl_priv { + + struct iwl_rxon_context contexts[NUM_IWL_RXON_CTX]; + +- struct iwl_switch_rxon switch_rxon; ++ __le16 switch_channel; + + /* 1st responses from initialize and runtime uCode images. + * _agn's initialize alive response contains some calibration data. */ +diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c +index 6f9a2fa..8055910 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-rx.c ++++ b/drivers/net/wireless/iwlwifi/iwl-rx.c +@@ -299,19 +299,19 @@ static void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb) + struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS]; + struct iwl_rxon_cmd *rxon = (void *)&ctx->active; + +- if (priv->switch_rxon.switch_in_progress) { +- if (!le32_to_cpu(csa->status) && +- (csa->channel == priv->switch_rxon.channel)) { +- rxon->channel = csa->channel; +- ctx->staging.channel = csa->channel; +- IWL_DEBUG_11H(priv, "CSA notif: channel %d\n", +- le16_to_cpu(csa->channel)); +- iwl_chswitch_done(priv, true); +- } else { +- IWL_ERR(priv, "CSA notif (fail) : channel %d\n", ++ if (!test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status)) ++ return; ++ ++ if (!le32_to_cpu(csa->status) && csa->channel == priv->switch_channel) { ++ rxon->channel = csa->channel; ++ ctx->staging.channel = csa->channel; ++ IWL_DEBUG_11H(priv, "CSA notif: channel %d\n", + le16_to_cpu(csa->channel)); +- iwl_chswitch_done(priv, false); +- } ++ iwl_chswitch_done(priv, true); ++ } else { ++ IWL_ERR(priv, "CSA notif (fail) : channel %d\n", ++ le16_to_cpu(csa->channel)); ++ iwl_chswitch_done(priv, false); + } + } + +diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c +index ab607bb..13c0c77 100644 +--- a/drivers/net/wireless/zd1211rw/zd_usb.c ++++ b/drivers/net/wireless/zd1211rw/zd_usb.c +@@ -1533,6 +1533,31 @@ static void __exit usb_exit(void) + module_init(usb_init); + module_exit(usb_exit); + ++static int zd_ep_regs_out_msg(struct usb_device *udev, void *data, int len, ++ int *actual_length, int timeout) ++{ ++ /* In USB 2.0 mode EP_REGS_OUT endpoint is interrupt type. However in ++ * USB 1.1 mode endpoint is bulk. Select correct type URB by endpoint ++ * descriptor. ++ */ ++ struct usb_host_endpoint *ep; ++ unsigned int pipe; ++ ++ pipe = usb_sndintpipe(udev, EP_REGS_OUT); ++ ep = usb_pipe_endpoint(udev, pipe); ++ if (!ep) ++ return -EINVAL; ++ ++ if (usb_endpoint_xfer_int(&ep->desc)) { ++ return usb_interrupt_msg(udev, pipe, data, len, ++ actual_length, timeout); ++ } else { ++ pipe = usb_sndbulkpipe(udev, EP_REGS_OUT); ++ return usb_bulk_msg(udev, pipe, data, len, actual_length, ++ timeout); ++ } ++} ++ + static int usb_int_regs_length(unsigned int count) + { + return sizeof(struct usb_int_regs) + count * sizeof(struct reg_data); +@@ -1648,15 +1673,14 @@ int zd_usb_ioread16v(struct zd_usb *usb, u16 *values, + + udev = zd_usb_to_usbdev(usb); + prepare_read_regs_int(usb); +- r = usb_interrupt_msg(udev, usb_sndintpipe(udev, EP_REGS_OUT), +- req, req_len, &actual_req_len, 50 /* ms */); ++ r = zd_ep_regs_out_msg(udev, req, req_len, &actual_req_len, 50 /*ms*/); + if (r) { + dev_dbg_f(zd_usb_dev(usb), +- "error in usb_interrupt_msg(). Error number %d\n", r); ++ "error in zd_ep_regs_out_msg(). Error number %d\n", r); + goto error; + } + if (req_len != actual_req_len) { +- dev_dbg_f(zd_usb_dev(usb), "error in usb_interrupt_msg()\n" ++ dev_dbg_f(zd_usb_dev(usb), "error in zd_ep_regs_out_msg()\n" + " req_len %d != actual_req_len %d\n", + req_len, actual_req_len); + r = -EIO; +@@ -1818,9 +1842,17 @@ int zd_usb_iowrite16v_async(struct zd_usb *usb, const struct zd_ioreq16 *ioreqs, + rw->value = cpu_to_le16(ioreqs[i].value); + } + +- usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT), +- req, req_len, iowrite16v_urb_complete, usb, +- ep->desc.bInterval); ++ /* In USB 2.0 mode endpoint is interrupt type. However in USB 1.1 mode ++ * endpoint is bulk. Select correct type URB by endpoint descriptor. ++ */ ++ if (usb_endpoint_xfer_int(&ep->desc)) ++ usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT), ++ req, req_len, iowrite16v_urb_complete, usb, ++ ep->desc.bInterval); ++ else ++ usb_fill_bulk_urb(urb, udev, usb_sndbulkpipe(udev, EP_REGS_OUT), ++ req, req_len, iowrite16v_urb_complete, usb); ++ + urb->transfer_flags |= URB_FREE_BUFFER; + + /* Submit previous URB */ +@@ -1924,15 +1956,14 @@ int zd_usb_rfwrite(struct zd_usb *usb, u32 value, u8 bits) + } + + udev = zd_usb_to_usbdev(usb); +- r = usb_interrupt_msg(udev, usb_sndintpipe(udev, EP_REGS_OUT), +- req, req_len, &actual_req_len, 50 /* ms */); ++ r = zd_ep_regs_out_msg(udev, req, req_len, &actual_req_len, 50 /*ms*/); + if (r) { + dev_dbg_f(zd_usb_dev(usb), +- "error in usb_interrupt_msg(). Error number %d\n", r); ++ "error in zd_ep_regs_out_msg(). Error number %d\n", r); + goto out; + } + if (req_len != actual_req_len) { +- dev_dbg_f(zd_usb_dev(usb), "error in usb_interrupt_msg()" ++ dev_dbg_f(zd_usb_dev(usb), "error in zd_ep_regs_out_msg()" + " req_len %d != actual_req_len %d\n", + req_len, actual_req_len); + r = -EIO; +diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c +index a3984f4..f34b5b2 100644 +--- a/drivers/oprofile/buffer_sync.c ++++ b/drivers/oprofile/buffer_sync.c +@@ -141,6 +141,13 @@ static struct notifier_block module_load_nb = { + .notifier_call = module_load_notify, + }; + ++static void free_all_tasks(void) ++{ ++ /* make sure we don't leak task structs */ ++ process_task_mortuary(); ++ process_task_mortuary(); ++} ++ + int sync_start(void) + { + int err; +@@ -148,8 +155,6 @@ int sync_start(void) + if (!zalloc_cpumask_var(&marked_cpus, GFP_KERNEL)) + return -ENOMEM; + +- mutex_lock(&buffer_mutex); +- + err = task_handoff_register(&task_free_nb); + if (err) + goto out1; +@@ -166,7 +171,6 @@ int sync_start(void) + start_cpu_work(); + + out: +- mutex_unlock(&buffer_mutex); + return err; + out4: + profile_event_unregister(PROFILE_MUNMAP, &munmap_nb); +@@ -174,6 +178,7 @@ out3: + profile_event_unregister(PROFILE_TASK_EXIT, &task_exit_nb); + out2: + task_handoff_unregister(&task_free_nb); ++ free_all_tasks(); + out1: + free_cpumask_var(marked_cpus); + goto out; +@@ -182,20 +187,16 @@ out1: + + void sync_stop(void) + { +- /* flush buffers */ +- mutex_lock(&buffer_mutex); + end_cpu_work(); + unregister_module_notifier(&module_load_nb); + profile_event_unregister(PROFILE_MUNMAP, &munmap_nb); + profile_event_unregister(PROFILE_TASK_EXIT, &task_exit_nb); + task_handoff_unregister(&task_free_nb); +- mutex_unlock(&buffer_mutex); +- flush_cpu_work(); ++ barrier(); /* do all of the above first */ + +- /* make sure we don't leak task structs */ +- process_task_mortuary(); +- process_task_mortuary(); ++ flush_cpu_work(); + ++ free_all_tasks(); + free_cpumask_var(marked_cpus); + } + +diff --git a/drivers/pci/hotplug/pcihp_slot.c b/drivers/pci/hotplug/pcihp_slot.c +index 80b461c..749fdf0 100644 +--- a/drivers/pci/hotplug/pcihp_slot.c ++++ b/drivers/pci/hotplug/pcihp_slot.c +@@ -158,6 +158,47 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp) + */ + } + ++/* Program PCIE MaxPayload setting on device: ensure parent maxpayload <= device */ ++static int pci_set_payload(struct pci_dev *dev) ++{ ++ int pos, ppos; ++ u16 pctl, psz; ++ u16 dctl, dsz, dcap, dmax; ++ struct pci_dev *parent; ++ ++ parent = dev->bus->self; ++ pos = pci_find_capability(dev, PCI_CAP_ID_EXP); ++ if (!pos) ++ return 0; ++ ++ /* Read Device MaxPayload capability and setting */ ++ pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &dctl); ++ pci_read_config_word(dev, pos + PCI_EXP_DEVCAP, &dcap); ++ dsz = (dctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5; ++ dmax = (dcap & PCI_EXP_DEVCAP_PAYLOAD); ++ ++ /* Read Parent MaxPayload setting */ ++ ppos = pci_find_capability(parent, PCI_CAP_ID_EXP); ++ if (!ppos) ++ return 0; ++ pci_read_config_word(parent, ppos + PCI_EXP_DEVCTL, &pctl); ++ psz = (pctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5; ++ ++ /* If parent payload > device max payload -> error ++ * If parent payload > device payload -> set speed ++ * If parent payload <= device payload -> do nothing ++ */ ++ if (psz > dmax) ++ return -1; ++ else if (psz > dsz) { ++ dev_info(&dev->dev, "Setting MaxPayload to %d\n", 128 << psz); ++ pci_write_config_word(dev, pos + PCI_EXP_DEVCTL, ++ (dctl & ~PCI_EXP_DEVCTL_PAYLOAD) + ++ (psz << 5)); ++ } ++ return 0; ++} ++ + void pci_configure_slot(struct pci_dev *dev) + { + struct pci_dev *cdev; +@@ -169,6 +210,10 @@ void pci_configure_slot(struct pci_dev *dev) + (dev->class >> 8) == PCI_CLASS_BRIDGE_PCI))) + return; + ++ ret = pci_set_payload(dev); ++ if (ret) ++ dev_warn(&dev->dev, "could not set device max payload\n"); ++ + memset(&hpp, 0, sizeof(hpp)); + ret = pci_get_hp_params(dev, &hpp); + if (ret) +diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c +index d552d2c..5db70c7 100644 +--- a/drivers/pci/intel-iommu.c ++++ b/drivers/pci/intel-iommu.c +@@ -46,6 +46,8 @@ + #define ROOT_SIZE VTD_PAGE_SIZE + #define CONTEXT_SIZE VTD_PAGE_SIZE + ++#define IS_BRIDGE_HOST_DEVICE(pdev) \ ++ ((pdev->class >> 8) == PCI_CLASS_BRIDGE_HOST) + #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY) + #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA) + #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e) +@@ -1416,6 +1418,10 @@ static void domain_exit(struct dmar_domain *domain) + if (!domain) + return; + ++ /* Flush any lazy unmaps that may reference this domain */ ++ if (!intel_iommu_strict) ++ flush_unmaps_timeout(0); ++ + domain_remove_dev_info(domain); + /* destroy iovas */ + put_iova_domain(&domain->iovad); +@@ -2105,10 +2111,10 @@ static int identity_mapping(struct pci_dev *pdev) + if (likely(!iommu_identity_mapping)) + return 0; + ++ info = pdev->dev.archdata.iommu; ++ if (info && info != DUMMY_DEVICE_DOMAIN_INFO) ++ return (info->domain == si_domain); + +- list_for_each_entry(info, &si_domain->devices, link) +- if (info->dev == pdev) +- return 1; + return 0; + } + +@@ -2186,8 +2192,19 @@ static int iommu_should_identity_map(struct pci_dev *pdev, int startup) + * Assume that they will -- if they turn out not to be, then we can + * take them out of the 1:1 domain later. + */ +- if (!startup) +- return pdev->dma_mask > DMA_BIT_MASK(32); ++ if (!startup) { ++ /* ++ * If the device's dma_mask is less than the system's memory ++ * size then this is not a candidate for identity mapping. ++ */ ++ u64 dma_mask = pdev->dma_mask; ++ ++ if (pdev->dev.coherent_dma_mask && ++ pdev->dev.coherent_dma_mask < dma_mask) ++ dma_mask = pdev->dev.coherent_dma_mask; ++ ++ return dma_mask >= dma_get_required_mask(&pdev->dev); ++ } + + return 1; + } +@@ -2202,6 +2219,9 @@ static int __init iommu_prepare_static_identity_mapping(int hw) + return -EFAULT; + + for_each_pci_dev(pdev) { ++ /* Skip Host/PCI Bridge devices */ ++ if (IS_BRIDGE_HOST_DEVICE(pdev)) ++ continue; + if (iommu_should_identity_map(pdev, 1)) { + printk(KERN_INFO "IOMMU: %s identity mapping for device %s\n", + hw ? "hardware" : "software", pci_name(pdev)); +@@ -2591,8 +2611,7 @@ static dma_addr_t __intel_map_single(struct device *hwdev, phys_addr_t paddr, + iommu = domain_get_iommu(domain); + size = aligned_nrpages(paddr, size); + +- iova = intel_alloc_iova(hwdev, domain, dma_to_mm_pfn(size), +- pdev->dma_mask); ++ iova = intel_alloc_iova(hwdev, domain, dma_to_mm_pfn(size), dma_mask); + if (!iova) + goto error; + +@@ -3379,8 +3398,8 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain, + spin_lock_irqsave(&device_domain_lock, flags); + list_for_each_safe(entry, tmp, &domain->devices) { + info = list_entry(entry, struct device_domain_info, link); +- /* No need to compare PCI domain; it has to be the same */ +- if (info->bus == pdev->bus->number && ++ if (info->segment == pci_domain_nr(pdev->bus) && ++ info->bus == pdev->bus->number && + info->devfn == pdev->devfn) { + list_del(&info->link); + list_del(&info->global); +@@ -3418,10 +3437,13 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain, + domain_update_iommu_cap(domain); + spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags); + +- spin_lock_irqsave(&iommu->lock, tmp_flags); +- clear_bit(domain->id, iommu->domain_ids); +- iommu->domains[domain->id] = NULL; +- spin_unlock_irqrestore(&iommu->lock, tmp_flags); ++ if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) && ++ !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY)) { ++ spin_lock_irqsave(&iommu->lock, tmp_flags); ++ clear_bit(domain->id, iommu->domain_ids); ++ iommu->domains[domain->id] = NULL; ++ spin_unlock_irqrestore(&iommu->lock, tmp_flags); ++ } + } + + spin_unlock_irqrestore(&device_domain_lock, flags); +diff --git a/drivers/pci/iova.c b/drivers/pci/iova.c +index 9606e59..c5c274a 100644 +--- a/drivers/pci/iova.c ++++ b/drivers/pci/iova.c +@@ -63,8 +63,16 @@ __cached_rbnode_delete_update(struct iova_domain *iovad, struct iova *free) + curr = iovad->cached32_node; + cached_iova = container_of(curr, struct iova, node); + +- if (free->pfn_lo >= cached_iova->pfn_lo) +- iovad->cached32_node = rb_next(&free->node); ++ if (free->pfn_lo >= cached_iova->pfn_lo) { ++ struct rb_node *node = rb_next(&free->node); ++ struct iova *iova = container_of(node, struct iova, node); ++ ++ /* only cache if it's below 32bit pfn */ ++ if (node && iova->pfn_lo < iovad->dma_32bit_pfn) ++ iovad->cached32_node = node; ++ else ++ iovad->cached32_node = NULL; ++ } + } + + /* Computes the padding size required, to make the +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 832a3fd7..c8c9842 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -1223,7 +1223,7 @@ static int asus_wmi_sysfs_init(struct platform_device *device) + /* + * Platform device + */ +-static int __init asus_wmi_platform_init(struct asus_wmi *asus) ++static int asus_wmi_platform_init(struct asus_wmi *asus) + { + int rv; + +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 58584dc..44e8ca3 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -297,7 +297,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, + kfree(sdev); + goto out; + } +- ++ blk_get_queue(sdev->request_queue); + sdev->request_queue->queuedata = sdev; + scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun); + +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index e639125..e0bd3f7 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -322,6 +322,7 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work) + kfree(evt); + } + ++ blk_put_queue(sdev->request_queue); + /* NULL queue means the device can't be used */ + sdev->request_queue = NULL; + +diff --git a/drivers/staging/gma500/psb_fb.c b/drivers/staging/gma500/psb_fb.c +index f67f53b..1b96199 100644 +--- a/drivers/staging/gma500/psb_fb.c ++++ b/drivers/staging/gma500/psb_fb.c +@@ -489,6 +489,16 @@ static int psbfb_create(struct psb_fbdev *fbdev, + info->screen_size = size; + memset(info->screen_base, 0, size); + ++ if (dev_priv->pg->stolen_size) { ++ info->apertures = alloc_apertures(1); ++ if (!info->apertures) { ++ ret = -ENOMEM; ++ goto out_err0; ++ } ++ info->apertures->ranges[0].base = dev->mode_config.fb_base; ++ info->apertures->ranges[0].size = dev_priv->pg->stolen_size; ++ } ++ + drm_fb_helper_fill_fix(info, fb->pitch, fb->depth); + drm_fb_helper_fill_var(info, &fbdev->psb_fb_helper, + sizes->fb_width, sizes->fb_height); +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 733fe8e..d4bee1b 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -172,12 +172,16 @@ static int uart_startup(struct tty_struct *tty, struct uart_state *state, int in + + retval = uport->ops->startup(uport); + if (retval == 0) { +- if (init_hw) { +- /* +- * Initialise the hardware port settings. +- */ +- uart_change_speed(tty, state, NULL); ++ if (uart_console(uport) && uport->cons->cflag) { ++ tty->termios->c_cflag = uport->cons->cflag; ++ uport->cons->cflag = 0; ++ } ++ /* ++ * Initialise the hardware port settings. ++ */ ++ uart_change_speed(tty, state, NULL); + ++ if (init_hw) { + /* + * Setup the RTS and DTR signals once the + * port is open and ready to respond. +@@ -1466,45 +1470,6 @@ static void uart_hangup(struct tty_struct *tty) + mutex_unlock(&port->mutex); + } + +-/** +- * uart_update_termios - update the terminal hw settings +- * @tty: tty associated with UART +- * @state: UART to update +- * +- * Copy across the serial console cflag setting into the termios settings +- * for the initial open of the port. This allows continuity between the +- * kernel settings, and the settings init adopts when it opens the port +- * for the first time. +- */ +-static void uart_update_termios(struct tty_struct *tty, +- struct uart_state *state) +-{ +- struct uart_port *port = state->uart_port; +- +- if (uart_console(port) && port->cons->cflag) { +- tty->termios->c_cflag = port->cons->cflag; +- port->cons->cflag = 0; +- } +- +- /* +- * If the device failed to grab its irq resources, +- * or some other error occurred, don't try to talk +- * to the port hardware. +- */ +- if (!(tty->flags & (1 << TTY_IO_ERROR))) { +- /* +- * Make termios settings take effect. +- */ +- uart_change_speed(tty, state, NULL); +- +- /* +- * And finally enable the RTS and DTR signals. +- */ +- if (tty->termios->c_cflag & CBAUD) +- uart_set_mctrl(port, TIOCM_DTR | TIOCM_RTS); +- } +-} +- + static int uart_carrier_raised(struct tty_port *port) + { + struct uart_state *state = container_of(port, struct uart_state, port); +@@ -1524,16 +1489,8 @@ static void uart_dtr_rts(struct tty_port *port, int onoff) + struct uart_state *state = container_of(port, struct uart_state, port); + struct uart_port *uport = state->uart_port; + +- if (onoff) { ++ if (onoff) + uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS); +- +- /* +- * If this is the first open to succeed, +- * adjust things to suit. +- */ +- if (!test_and_set_bit(ASYNCB_NORMAL_ACTIVE, &port->flags)) +- uart_update_termios(port->tty, state); +- } + else + uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS); + } +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index caa2535..d0b84ff 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1617,6 +1617,8 @@ static const struct usb_device_id acm_ids[] = { + { NOKIA_PCSUITE_ACM_INFO(0x04ce), }, /* Nokia E90 */ + { NOKIA_PCSUITE_ACM_INFO(0x01d4), }, /* Nokia E55 */ + { NOKIA_PCSUITE_ACM_INFO(0x0302), }, /* Nokia N8 */ ++ { NOKIA_PCSUITE_ACM_INFO(0x0335), }, /* Nokia E7 */ ++ { NOKIA_PCSUITE_ACM_INFO(0x03cd), }, /* Nokia C7 */ + { SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */ + + /* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */ +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 93720bd..78e7f25 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -339,7 +339,8 @@ static int get_hub_status(struct usb_device *hdev, + { + int i, status = -ETIMEDOUT; + +- for (i = 0; i < USB_STS_RETRIES && status == -ETIMEDOUT; i++) { ++ for (i = 0; i < USB_STS_RETRIES && ++ (status == -ETIMEDOUT || status == -EPIPE); i++) { + status = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0), + USB_REQ_GET_STATUS, USB_DIR_IN | USB_RT_HUB, 0, 0, + data, sizeof(*data), USB_STS_TIMEOUT); +@@ -355,7 +356,8 @@ static int get_port_status(struct usb_device *hdev, int port1, + { + int i, status = -ETIMEDOUT; + +- for (i = 0; i < USB_STS_RETRIES && status == -ETIMEDOUT; i++) { ++ for (i = 0; i < USB_STS_RETRIES && ++ (status == -ETIMEDOUT || status == -EPIPE); i++) { + status = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0), + USB_REQ_GET_STATUS, USB_DIR_IN | USB_RT_PORT, 0, port1, + data, sizeof(*data), USB_STS_TIMEOUT); +diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c +index 0231814..ff00bd8 100644 +--- a/drivers/usb/host/xhci-dbg.c ++++ b/drivers/usb/host/xhci-dbg.c +@@ -437,13 +437,13 @@ char *xhci_get_slot_state(struct xhci_hcd *xhci, + struct xhci_slot_ctx *slot_ctx = xhci_get_slot_ctx(xhci, ctx); + + switch (GET_SLOT_STATE(slot_ctx->dev_state)) { +- case 0: ++ case SLOT_STATE_ENABLED: + return "enabled/disabled"; +- case 1: ++ case SLOT_STATE_DEFAULT: + return "default"; +- case 2: ++ case SLOT_STATE_ADDRESSED: + return "addressed"; +- case 3: ++ case SLOT_STATE_CONFIGURED: + return "configured"; + default: + return "reserved"; +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 783e5e0..976422a 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -986,9 +986,19 @@ static unsigned int xhci_parse_exponent_interval(struct usb_device *udev, + interval = clamp_val(ep->desc.bInterval, 1, 16) - 1; + if (interval != ep->desc.bInterval - 1) + dev_warn(&udev->dev, +- "ep %#x - rounding interval to %d microframes\n", ++ "ep %#x - rounding interval to %d %sframes\n", + ep->desc.bEndpointAddress, +- 1 << interval); ++ 1 << interval, ++ udev->speed == USB_SPEED_FULL ? "" : "micro"); ++ ++ if (udev->speed == USB_SPEED_FULL) { ++ /* ++ * Full speed isoc endpoints specify interval in frames, ++ * not microframes. We are using microframes everywhere, ++ * so adjust accordingly. ++ */ ++ interval += 3; /* 1 frame = 2^3 uframes */ ++ } + + return interval; + } +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index a10494c..4940717 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -105,12 +105,22 @@ static int xhci_pci_setup(struct usb_hcd *hcd) + + /* Look for vendor-specific quirks */ + if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC && +- pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK && +- pdev->revision == 0x0) { ++ pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK) { ++ if (pdev->revision == 0x0) { + xhci->quirks |= XHCI_RESET_EP_QUIRK; + xhci_dbg(xhci, "QUIRK: Fresco Logic xHC needs configure" + " endpoint cmd after reset endpoint\n"); ++ } ++ /* Fresco Logic confirms: all revisions of this chip do not ++ * support MSI, even though some of them claim to in their PCI ++ * capabilities. ++ */ ++ xhci->quirks |= XHCI_BROKEN_MSI; ++ xhci_dbg(xhci, "QUIRK: Fresco Logic revision %u " ++ "has broken MSI implementation\n", ++ pdev->revision); + } ++ + if (pdev->vendor == PCI_VENDOR_ID_NEC) + xhci->quirks |= XHCI_NEC_HOST; + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index d2cd3ce..e5c4861 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -430,12 +430,19 @@ int xhci_run(struct usb_hcd *hcd) + free_irq(hcd->irq, hcd); + hcd->irq = -1; + ++ /* Some Fresco Logic host controllers advertise MSI, but fail to ++ * generate interrupts. Don't even try to enable MSI. ++ */ ++ if (xhci->quirks & XHCI_BROKEN_MSI) ++ goto legacy_irq; ++ + ret = xhci_setup_msix(xhci); + if (ret) + /* fall back to msi*/ + ret = xhci_setup_msi(xhci); + + if (ret) { ++legacy_irq: + /* fall back to legacy interrupt*/ + ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED, + hcd->irq_descr, hcd); +@@ -2284,6 +2291,7 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev) + struct xhci_command *reset_device_cmd; + int timeleft; + int last_freed_endpoint; ++ struct xhci_slot_ctx *slot_ctx; + + ret = xhci_check_args(hcd, udev, NULL, 0, false, __func__); + if (ret <= 0) +@@ -2316,6 +2324,12 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev) + return -EINVAL; + } + ++ /* If device is not setup, there is no point in resetting it */ ++ slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx); ++ if (GET_SLOT_STATE(le32_to_cpu(slot_ctx->dev_state)) == ++ SLOT_STATE_DISABLED) ++ return 0; ++ + xhci_dbg(xhci, "Resetting device with slot ID %u\n", slot_id); + /* Allocate the command structure that holds the struct completion. + * Assume we're in process context, since the normal device reset +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index ba1be6b..fb85ce3 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -560,6 +560,11 @@ struct xhci_slot_ctx { + #define SLOT_STATE (0x1f << 27) + #define GET_SLOT_STATE(p) (((p) & (0x1f << 27)) >> 27) + ++#define SLOT_STATE_DISABLED 0 ++#define SLOT_STATE_ENABLED SLOT_STATE_DISABLED ++#define SLOT_STATE_DEFAULT 1 ++#define SLOT_STATE_ADDRESSED 2 ++#define SLOT_STATE_CONFIGURED 3 + + /** + * struct xhci_ep_ctx +@@ -1281,6 +1286,7 @@ struct xhci_hcd { + #define XHCI_RESET_EP_QUIRK (1 << 1) + #define XHCI_NEC_HOST (1 << 2) + #define XHCI_AMD_PLL_FIX (1 << 3) ++#define XHCI_BROKEN_MSI (1 << 6) + /* There are two roothubs to keep track of bus suspend info for */ + struct xhci_bus_state bus_state[2]; + /* Is each xHCI roothub port a USB 3.0, USB 2.0, or USB 1.1 port? */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index e8dbde5..1627289 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -647,6 +647,7 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, EVER_ECO_PRO_CDS) }, + { USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_1_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_2_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_3_PID) }, + { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_0_PID) }, + { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_1_PID) }, + { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_2_PID) }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 1d946cd..ab1fcdf 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -351,6 +351,7 @@ + */ + #define FTDI_4N_GALAXY_DE_1_PID 0xF3C0 + #define FTDI_4N_GALAXY_DE_2_PID 0xF3C1 ++#define FTDI_4N_GALAXY_DE_3_PID 0xF3C2 + + /* + * Linx Technologies product ids +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 318dd00..60b25d8 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -311,10 +311,6 @@ static void option_instat_callback(struct urb *urb); + #define ZTE_PRODUCT_AC2726 0xfff5 + #define ZTE_PRODUCT_AC8710T 0xffff + +-/* ZTE PRODUCTS -- alternate vendor ID */ +-#define ZTE_VENDOR_ID2 0x1d6b +-#define ZTE_PRODUCT_MF_330 0x0002 +- + #define BENQ_VENDOR_ID 0x04a5 + #define BENQ_PRODUCT_H10 0x4068 + +@@ -340,11 +336,12 @@ static void option_instat_callback(struct urb *urb); + #define TOSHIBA_PRODUCT_G450 0x0d45 + + #define ALINK_VENDOR_ID 0x1e0e ++#define ALINK_PRODUCT_PH300 0x9100 + #define ALINK_PRODUCT_3GU 0x9200 + + /* ALCATEL PRODUCTS */ + #define ALCATEL_VENDOR_ID 0x1bbb +-#define ALCATEL_PRODUCT_X060S 0x0000 ++#define ALCATEL_PRODUCT_X060S_X200 0x0000 + + #define PIRELLI_VENDOR_ID 0x1266 + #define PIRELLI_PRODUCT_C100_1 0x1002 +@@ -379,6 +376,9 @@ static void option_instat_callback(struct urb *urb); + * It seems to contain a Qualcomm QSC6240/6290 chipset */ + #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 + ++/* Zoom */ ++#define ZOOM_PRODUCT_4597 0x9607 ++ + /* Haier products */ + #define HAIER_VENDOR_ID 0x201e + #define HAIER_PRODUCT_CE100 0x2009 +@@ -432,6 +432,20 @@ static const struct option_blacklist_info four_g_w14_blacklist = { + .reason = OPTION_BLACKLIST_SENDSETUP + }; + ++static const u8 alcatel_x200_no_sendsetup[] = { 0, 1 }; ++static const struct option_blacklist_info alcatel_x200_blacklist = { ++ .infolen = ARRAY_SIZE(alcatel_x200_no_sendsetup), ++ .ifaceinfo = alcatel_x200_no_sendsetup, ++ .reason = OPTION_BLACKLIST_SENDSETUP ++}; ++ ++static const u8 zte_k3765_z_no_sendsetup[] = { 0, 1, 2 }; ++static const struct option_blacklist_info zte_k3765_z_blacklist = { ++ .infolen = ARRAY_SIZE(zte_k3765_z_no_sendsetup), ++ .ifaceinfo = zte_k3765_z_no_sendsetup, ++ .reason = OPTION_BLACKLIST_SENDSETUP ++}; ++ + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, +@@ -916,13 +930,13 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, ++ 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) }, +- { USB_DEVICE(ZTE_VENDOR_ID2, ZTE_PRODUCT_MF_330) }, + { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) }, + { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) }, + { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */ +@@ -935,13 +949,17 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) }, + { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */ + { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) }, ++ { USB_DEVICE(ALINK_VENDOR_ID, ALINK_PRODUCT_PH300) }, + { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) }, +- { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) }, ++ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), ++ .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist ++ }, + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, + { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), + .driver_info = (kernel_ulong_t)&four_g_w14_blacklist + }, ++ { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, + { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, + /* Pirelli */ + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1)}, +diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c +index 0041899..e8ae21b 100644 +--- a/drivers/usb/storage/transport.c ++++ b/drivers/usb/storage/transport.c +@@ -819,6 +819,35 @@ Retry_Sense: + } + } + ++ /* ++ * Some devices don't work or return incorrect data the first ++ * time they get a READ(10) command, or for the first READ(10) ++ * after a media change. If the INITIAL_READ10 flag is set, ++ * keep track of whether READ(10) commands succeed. If the ++ * previous one succeeded and this one failed, set the REDO_READ10 ++ * flag to force a retry. ++ */ ++ if (unlikely((us->fflags & US_FL_INITIAL_READ10) && ++ srb->cmnd[0] == READ_10)) { ++ if (srb->result == SAM_STAT_GOOD) { ++ set_bit(US_FLIDX_READ10_WORKED, &us->dflags); ++ } else if (test_bit(US_FLIDX_READ10_WORKED, &us->dflags)) { ++ clear_bit(US_FLIDX_READ10_WORKED, &us->dflags); ++ set_bit(US_FLIDX_REDO_READ10, &us->dflags); ++ } ++ ++ /* ++ * Next, if the REDO_READ10 flag is set, return a result ++ * code that will cause the SCSI core to retry the READ(10) ++ * command immediately. ++ */ ++ if (test_bit(US_FLIDX_REDO_READ10, &us->dflags)) { ++ clear_bit(US_FLIDX_REDO_READ10, &us->dflags); ++ srb->result = DID_IMM_RETRY << 16; ++ srb->sense_buffer[0] = 0; ++ } ++ } ++ + /* Did we transfer less than the minimum amount required? */ + if ((srb->result == SAM_STAT_GOOD || srb->sense_buffer[2] == 0) && + scsi_bufflen(srb) - scsi_get_resid(srb) < srb->underflow) +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index c1602b8..ccff348 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1114,6 +1114,16 @@ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_FIX_CAPACITY ), + ++/* Reported by Paul Hartman ++ * This card reader returns "Illegal Request, Logical Block Address ++ * Out of Range" for the first READ(10) after a new card is inserted. ++ */ ++UNUSUAL_DEV( 0x090c, 0x6000, 0x0100, 0x0100, ++ "Feiya", ++ "SD/SDHC Card Reader", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_INITIAL_READ10 ), ++ + /* This Pentax still camera is not conformant + * to the USB storage specification: - + * - It does not like the INQUIRY command. So we must handle this command +@@ -1888,6 +1898,15 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_READ_DISC_INFO ), + ++/* Reported by Sven Geggus ++ * This encrypted pen drive returns bogus data for the initial READ(10). ++ */ ++UNUSUAL_DEV( 0x1b1c, 0x1ab5, 0x0200, 0x0200, ++ "Corsair", ++ "Padlock v2", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_INITIAL_READ10 ), ++ + /* Patch by Richard Schütz + * This external hard drive enclosure uses a JMicron chip which + * needs the US_FL_IGNORE_RESIDUE flag to work properly. */ +diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c +index 4219c19..07d6d73 100644 +--- a/drivers/usb/storage/usb.c ++++ b/drivers/usb/storage/usb.c +@@ -439,7 +439,8 @@ static void adjust_quirks(struct us_data *us) + US_FL_CAPACITY_HEURISTICS | US_FL_IGNORE_DEVICE | + US_FL_NOT_LOCKABLE | US_FL_MAX_SECTORS_64 | + US_FL_CAPACITY_OK | US_FL_IGNORE_RESIDUE | +- US_FL_SINGLE_LUN | US_FL_NO_WP_DETECT); ++ US_FL_SINGLE_LUN | US_FL_NO_WP_DETECT | ++ US_FL_INITIAL_READ10); + + p = quirks; + while (*p) { +@@ -483,6 +484,9 @@ static void adjust_quirks(struct us_data *us) + case 'm': + f |= US_FL_MAX_SECTORS_64; + break; ++ case 'n': ++ f |= US_FL_INITIAL_READ10; ++ break; + case 'o': + f |= US_FL_CAPACITY_OK; + break; +@@ -946,6 +950,13 @@ int usb_stor_probe2(struct us_data *us) + if (result) + goto BadDevice; + ++ /* ++ * If the device returns invalid data for the first READ(10) ++ * command, indicate the command should be retried. ++ */ ++ if (us->fflags & US_FL_INITIAL_READ10) ++ set_bit(US_FLIDX_REDO_READ10, &us->dflags); ++ + /* Acquire all the other resources and add the host */ + result = usb_stor_acquire_resources(us); + if (result) +diff --git a/drivers/usb/storage/usb.h b/drivers/usb/storage/usb.h +index 89d3bff..7b0f211 100644 +--- a/drivers/usb/storage/usb.h ++++ b/drivers/usb/storage/usb.h +@@ -73,6 +73,8 @@ struct us_unusual_dev { + #define US_FLIDX_RESETTING 4 /* device reset in progress */ + #define US_FLIDX_TIMED_OUT 5 /* SCSI midlayer timed out */ + #define US_FLIDX_DONT_SCAN 6 /* don't scan (disconnect) */ ++#define US_FLIDX_REDO_READ10 7 /* redo READ(10) command */ ++#define US_FLIDX_READ10_WORKED 8 /* previous READ(10) succeeded */ + + #define USB_STOR_STRING_LEN 32 + +diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c +index 53b2c5a..305c975 100644 +--- a/drivers/video/vga16fb.c ++++ b/drivers/video/vga16fb.c +@@ -1265,9 +1265,11 @@ static void vga16fb_imageblit(struct fb_info *info, const struct fb_image *image + + static void vga16fb_destroy(struct fb_info *info) + { ++ struct platform_device *dev = container_of(info->device, struct platform_device, dev); + iounmap(info->screen_base); + fb_dealloc_cmap(&info->cmap); + /* XXX unshare VGA regions */ ++ platform_set_drvdata(dev, NULL); + framebuffer_release(info); + } + +diff --git a/fs/block_dev.c b/fs/block_dev.c +index 1f2b199..1a2421f 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -1272,8 +1272,8 @@ int blkdev_get(struct block_device *bdev, fmode_t mode, void *holder) + * individual writeable reference is too fragile given the + * way @mode is used in blkdev_get/put(). + */ +- if ((disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE) && +- !res && (mode & FMODE_WRITE) && !bdev->bd_write_holder) { ++ if (!res && (mode & FMODE_WRITE) && !bdev->bd_write_holder && ++ (disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE)) { + bdev->bd_write_holder = true; + disk_block_events(disk); + } +diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c +index d1a016b..ba3d95b 100644 +--- a/fs/cifs/cifsencrypt.c ++++ b/fs/cifs/cifsencrypt.c +@@ -184,7 +184,7 @@ int cifs_verify_signature(struct smb_hdr *cifs_pdu, + if (cifs_pdu == NULL || server == NULL) + return -EINVAL; + +- if (cifs_pdu->Command == SMB_COM_NEGOTIATE) ++ if (!server->session_estab) + return 0; + + if (cifs_pdu->Command == SMB_COM_LOCKING_ANDX) { +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 29fac128..5236582 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -199,7 +199,7 @@ cifs_reconnect(struct TCP_Server_Info *server) + } + spin_unlock(&GlobalMid_Lock); + +- while (server->tcpStatus == CifsNeedReconnect) { ++ do { + try_to_freeze(); + + /* we should try only the port we connected to before */ +@@ -214,7 +214,7 @@ cifs_reconnect(struct TCP_Server_Info *server) + server->tcpStatus = CifsNeedNegotiate; + spin_unlock(&GlobalMid_Lock); + } +- } ++ } while (server->tcpStatus == CifsNeedReconnect); + + return rc; + } +@@ -3208,7 +3208,7 @@ int cifs_negotiate_protocol(unsigned int xid, struct cifsSesInfo *ses) + } + if (rc == 0) { + spin_lock(&GlobalMid_Lock); +- if (server->tcpStatus != CifsExiting) ++ if (server->tcpStatus == CifsNeedNegotiate) + server->tcpStatus = CifsGood; + else + rc = -EHOSTDOWN; +diff --git a/fs/dcookies.c b/fs/dcookies.c +index a21cabd..dda0dc7 100644 +--- a/fs/dcookies.c ++++ b/fs/dcookies.c +@@ -178,6 +178,8 @@ SYSCALL_DEFINE(lookup_dcookie)(u64 cookie64, char __user * buf, size_t len) + /* FIXME: (deleted) ? */ + path = d_path(&dcs->path, kbuf, PAGE_SIZE); + ++ mutex_unlock(&dcookie_mutex); ++ + if (IS_ERR(path)) { + err = PTR_ERR(path); + goto out_free; +@@ -194,6 +196,7 @@ SYSCALL_DEFINE(lookup_dcookie)(u64 cookie64, char __user * buf, size_t len) + + out_free: + kfree(kbuf); ++ return err; + out: + mutex_unlock(&dcookie_mutex); + return err; +diff --git a/fs/exec.c b/fs/exec.c +index 5e62d26..0c3682d 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1046,6 +1046,7 @@ int flush_old_exec(struct linux_binprm * bprm) + + bprm->mm = NULL; /* We're using it now */ + ++ set_fs(USER_DS); + current->flags &= ~(PF_RANDOMIZE | PF_KTHREAD); + flush_thread(); + current->personality &= ~bprm->per_clear; +@@ -1310,10 +1311,6 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs) + if (retval) + return retval; + +- /* kernel module loader fixup */ +- /* so we don't try to load run modprobe in kernel space. */ +- set_fs(USER_DS); +- + retval = audit_bprm(bprm); + if (retval) + return retval; +diff --git a/fs/fat/file.c b/fs/fat/file.c +index 7257752..7018e1d 100644 +--- a/fs/fat/file.c ++++ b/fs/fat/file.c +@@ -102,7 +102,7 @@ static int fat_ioctl_set_attributes(struct file *file, u32 __user *user_attr) + if (attr & ATTR_SYS) + inode->i_flags |= S_IMMUTABLE; + else +- inode->i_flags &= S_IMMUTABLE; ++ inode->i_flags &= ~S_IMMUTABLE; + } + + fat_save_attrs(inode, attr); +diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c +index aed25e8..e5cb2ce 100644 +--- a/fs/ubifs/journal.c ++++ b/fs/ubifs/journal.c +@@ -666,6 +666,7 @@ out_free: + + out_release: + release_head(c, BASEHD); ++ kfree(dent); + out_ro: + ubifs_ro_mode(c, err); + if (last_reference) +diff --git a/fs/ubifs/shrinker.c b/fs/ubifs/shrinker.c +index 46961c0..d8f5d0f 100644 +--- a/fs/ubifs/shrinker.c ++++ b/fs/ubifs/shrinker.c +@@ -283,7 +283,11 @@ int ubifs_shrinker(struct shrinker *shrink, int nr, gfp_t gfp_mask) + long clean_zn_cnt = atomic_long_read(&ubifs_clean_zn_cnt); + + if (nr == 0) +- return clean_zn_cnt; ++ /* ++ * Due to the way UBIFS updates the clean znode counter it may ++ * temporarily be negative. ++ */ ++ return clean_zn_cnt >= 0 ? clean_zn_cnt : 1; + + if (!clean_zn_cnt) { + /* +diff --git a/include/linux/efi.h b/include/linux/efi.h +index e376270..33fa120 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -299,7 +299,6 @@ extern void efi_initialize_iomem_resources(struct resource *code_resource, + struct resource *data_resource, struct resource *bss_resource); + extern unsigned long efi_get_time(void); + extern int efi_set_rtc_mmss(unsigned long nowtime); +-extern void efi_reserve_boot_services(void); + extern struct efi_memory_map memmap; + + /** +diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h +index 71693d4..17df360 100644 +--- a/include/linux/usb_usual.h ++++ b/include/linux/usb_usual.h +@@ -62,7 +62,9 @@ + US_FLAG(NO_READ_DISC_INFO, 0x00040000) \ + /* cannot handle READ_DISC_INFO */ \ + US_FLAG(NO_READ_CAPACITY_16, 0x00080000) \ +- /* cannot handle READ_CAPACITY_16 */ ++ /* cannot handle READ_CAPACITY_16 */ \ ++ US_FLAG(INITIAL_READ10, 0x00100000) \ ++ /* Initial READ(10) (and others) must be retried */ + + #define US_FLAG(name, value) US_FL_##name = value , + enum { US_DO_ALL_FLAGS }; +diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c +index 2c039c9..51e4944 100644 +--- a/kernel/irq/irqdesc.c ++++ b/kernel/irq/irqdesc.c +@@ -257,13 +257,11 @@ int __init early_irq_init(void) + count = ARRAY_SIZE(irq_desc); + + for (i = 0; i < count; i++) { +- desc[i].irq_data.irq = i; +- desc[i].irq_data.chip = &no_irq_chip; + desc[i].kstat_irqs = alloc_percpu(unsigned int); +- irq_settings_clr_and_set(desc, ~0, _IRQ_DEFAULT_INIT_FLAGS); +- alloc_masks(desc + i, GFP_KERNEL, node); +- desc_smp_init(desc + i, node); ++ alloc_masks(&desc[i], GFP_KERNEL, node); ++ raw_spin_lock_init(&desc[i].lock); + lockdep_set_class(&desc[i].lock, &irq_desc_lock_class); ++ desc_set_defaults(i, &desc[i], node); + } + return arch_early_irq_init(); + } +diff --git a/kernel/lockdep.c b/kernel/lockdep.c +index 53a6895..49452a7 100644 +--- a/kernel/lockdep.c ++++ b/kernel/lockdep.c +@@ -3242,7 +3242,7 @@ int lock_is_held(struct lockdep_map *lock) + int ret = 0; + + if (unlikely(current->lockdep_recursion)) +- return ret; ++ return 1; /* avoid false negative lockdep_assert_held() */ + + raw_local_irq_save(flags); + check_flags(flags); +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 8ee3bd8..39f86fc 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -1033,10 +1033,10 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma, + */ + chg = vma_needs_reservation(h, vma, addr); + if (chg < 0) +- return ERR_PTR(chg); ++ return ERR_PTR(-VM_FAULT_OOM); + if (chg) + if (hugetlb_get_quota(inode->i_mapping, chg)) +- return ERR_PTR(-ENOSPC); ++ return ERR_PTR(-VM_FAULT_SIGBUS); + + spin_lock(&hugetlb_lock); + page = dequeue_huge_page_vma(h, vma, addr, avoid_reserve); +diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c +index 3e81af1..821590d 100644 +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -967,6 +967,10 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata) + + mutex_lock(&sdata->u.ibss.mtx); + ++ sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH; ++ memset(sdata->u.ibss.bssid, 0, ETH_ALEN); ++ sdata->u.ibss.ssid_len = 0; ++ + active_ibss = ieee80211_sta_active_ibss(sdata); + + if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) { +@@ -1000,8 +1004,6 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata) + kfree_skb(skb); + + skb_queue_purge(&sdata->skb_queue); +- memset(sdata->u.ibss.bssid, 0, ETH_ALEN); +- sdata->u.ibss.ssid_len = 0; + + del_timer_sync(&sdata->u.ibss.timer); + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 2c70a1e..29a1ce1 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -3239,12 +3239,12 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) + i = 0; + if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) { + nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { ++ request->ssids[i].ssid_len = nla_len(attr); + if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) { + err = -EINVAL; + goto out_free; + } + memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); +- request->ssids[i].ssid_len = nla_len(attr); + i++; + } + } +diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c +index ec1bcec..3d2fd14 100644 +--- a/security/apparmor/lsm.c ++++ b/security/apparmor/lsm.c +@@ -612,7 +612,7 @@ static int apparmor_setprocattr(struct task_struct *task, char *name, + static int apparmor_task_setrlimit(struct task_struct *task, + unsigned int resource, struct rlimit *new_rlim) + { +- struct aa_profile *profile = aa_current_profile(); ++ struct aa_profile *profile = __aa_current_profile(); + int error = 0; + + if (!unconfined(profile)) +diff --git a/security/tomoyo/mount.c b/security/tomoyo/mount.c +index 82bf8c2..afa07cf 100644 +--- a/security/tomoyo/mount.c ++++ b/security/tomoyo/mount.c +@@ -138,7 +138,7 @@ static int tomoyo_mount_acl(struct tomoyo_request_info *r, char *dev_name, + } + if (need_dev) { + /* Get mount point or device file. */ +- if (kern_path(dev_name, LOOKUP_FOLLOW, &path)) { ++ if (!dev_name || kern_path(dev_name, LOOKUP_FOLLOW, &path)) { + error = -ENOENT; + goto out; + } +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index c82979a..2e95f01 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -13804,6 +13804,7 @@ static struct snd_pci_quirk alc268_cfg_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x015b, "Acer Aspire One", + ALC268_ACER_ASPIRE_ONE), + SND_PCI_QUIRK(0x1028, 0x0253, "Dell OEM", ALC268_DELL), ++ SND_PCI_QUIRK(0x1028, 0x02b0, "Dell Inspiron 910", ALC268_AUTO), + SND_PCI_QUIRK_MASK(0x1028, 0xfff0, 0x02b0, + "Dell Inspiron Mini9/Vostro A90", ALC268_DELL), + /* almost compatible with toshiba but with optional digital outs; +diff --git a/sound/soc/codecs/ad1836.c b/sound/soc/codecs/ad1836.c +index ab63d52..754c496 100644 +--- a/sound/soc/codecs/ad1836.c ++++ b/sound/soc/codecs/ad1836.c +@@ -145,22 +145,22 @@ static int ad1836_hw_params(struct snd_pcm_substream *substream, + /* bit size */ + switch (params_format(params)) { + case SNDRV_PCM_FORMAT_S16_LE: +- word_len = 3; ++ word_len = AD1836_WORD_LEN_16; + break; + case SNDRV_PCM_FORMAT_S20_3LE: +- word_len = 1; ++ word_len = AD1836_WORD_LEN_20; + break; + case SNDRV_PCM_FORMAT_S24_LE: + case SNDRV_PCM_FORMAT_S32_LE: +- word_len = 0; ++ word_len = AD1836_WORD_LEN_24; + break; + } + +- snd_soc_update_bits(codec, AD1836_DAC_CTRL1, +- AD1836_DAC_WORD_LEN_MASK, word_len); ++ snd_soc_update_bits(codec, AD1836_DAC_CTRL1, AD1836_DAC_WORD_LEN_MASK, ++ word_len << AD1836_DAC_WORD_LEN_OFFSET); + +- snd_soc_update_bits(codec, AD1836_ADC_CTRL2, +- AD1836_ADC_WORD_LEN_MASK, word_len); ++ snd_soc_update_bits(codec, AD1836_ADC_CTRL2, AD1836_ADC_WORD_LEN_MASK, ++ word_len << AD1836_ADC_WORD_OFFSET); + + return 0; + } +diff --git a/sound/soc/codecs/ad1836.h b/sound/soc/codecs/ad1836.h +index 8455967..9d6a3f8 100644 +--- a/sound/soc/codecs/ad1836.h ++++ b/sound/soc/codecs/ad1836.h +@@ -25,6 +25,7 @@ + #define AD1836_DAC_SERFMT_PCK256 (0x4 << 5) + #define AD1836_DAC_SERFMT_PCK128 (0x5 << 5) + #define AD1836_DAC_WORD_LEN_MASK 0x18 ++#define AD1836_DAC_WORD_LEN_OFFSET 3 + + #define AD1836_DAC_CTRL2 1 + #define AD1836_DACL1_MUTE 0 +@@ -51,6 +52,7 @@ + #define AD1836_ADCL2_MUTE 2 + #define AD1836_ADCR2_MUTE 3 + #define AD1836_ADC_WORD_LEN_MASK 0x30 ++#define AD1836_ADC_WORD_OFFSET 5 + #define AD1836_ADC_SERFMT_MASK (7 << 6) + #define AD1836_ADC_SERFMT_PCK256 (0x4 << 6) + #define AD1836_ADC_SERFMT_PCK128 (0x5 << 6) +@@ -60,4 +62,8 @@ + + #define AD1836_NUM_REGS 16 + ++#define AD1836_WORD_LEN_24 0x0 ++#define AD1836_WORD_LEN_20 0x1 ++#define AD1836_WORD_LEN_16 0x2 ++ + #endif +diff --git a/sound/soc/codecs/wm8804.c b/sound/soc/codecs/wm8804.c +index 6785688..9a5e67c 100644 +--- a/sound/soc/codecs/wm8804.c ++++ b/sound/soc/codecs/wm8804.c +@@ -680,20 +680,25 @@ static struct snd_soc_dai_ops wm8804_dai_ops = { + #define WM8804_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE | \ + SNDRV_PCM_FMTBIT_S24_LE) + ++#define WM8804_RATES (SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_44100 | \ ++ SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_64000 | \ ++ SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000 | \ ++ SNDRV_PCM_RATE_176400 | SNDRV_PCM_RATE_192000) ++ + static struct snd_soc_dai_driver wm8804_dai = { + .name = "wm8804-spdif", + .playback = { + .stream_name = "Playback", + .channels_min = 2, + .channels_max = 2, +- .rates = SNDRV_PCM_RATE_8000_192000, ++ .rates = WM8804_RATES, + .formats = WM8804_FORMATS, + }, + .capture = { + .stream_name = "Capture", + .channels_min = 2, + .channels_max = 2, +- .rates = SNDRV_PCM_RATE_8000_192000, ++ .rates = WM8804_RATES, + .formats = WM8804_FORMATS, + }, + .ops = &wm8804_dai_ops, +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 500011e..c22659e 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -1998,12 +1998,12 @@ static int wm8962_put_hp_sw(struct snd_kcontrol *kcontrol, + return 0; + + /* If the left PGA is enabled hit that VU bit... */ +- if (reg_cache[WM8962_PWR_MGMT_2] & WM8962_HPOUTL_PGA_ENA) ++ if (snd_soc_read(codec, WM8962_PWR_MGMT_2) & WM8962_HPOUTL_PGA_ENA) + return snd_soc_write(codec, WM8962_HPOUTL_VOLUME, + reg_cache[WM8962_HPOUTL_VOLUME]); + + /* ...otherwise the right. The VU is stereo. */ +- if (reg_cache[WM8962_PWR_MGMT_2] & WM8962_HPOUTR_PGA_ENA) ++ if (snd_soc_read(codec, WM8962_PWR_MGMT_2) & WM8962_HPOUTR_PGA_ENA) + return snd_soc_write(codec, WM8962_HPOUTR_VOLUME, + reg_cache[WM8962_HPOUTR_VOLUME]); + +diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c +index ffa09b3..992a732 100644 +--- a/sound/soc/samsung/i2s.c ++++ b/sound/soc/samsung/i2s.c +@@ -191,7 +191,7 @@ static inline bool tx_active(struct i2s_dai *i2s) + if (!i2s) + return false; + +- active = readl(i2s->addr + I2SMOD); ++ active = readl(i2s->addr + I2SCON); + + if (is_secondary(i2s)) + active &= CON_TXSDMA_ACTIVE; +@@ -223,7 +223,7 @@ static inline bool rx_active(struct i2s_dai *i2s) + if (!i2s) + return false; + +- active = readl(i2s->addr + I2SMOD) & CON_RXDMA_ACTIVE; ++ active = readl(i2s->addr + I2SCON) & CON_RXDMA_ACTIVE; + + return active ? true : false; + } +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 81c4052..586d10b 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -362,9 +362,9 @@ static int dapm_update_bits(struct snd_soc_dapm_widget *widget) + } + + /* create new dapm mixer control */ +-static int dapm_new_mixer(struct snd_soc_dapm_context *dapm, +- struct snd_soc_dapm_widget *w) ++static int dapm_new_mixer(struct snd_soc_dapm_widget *w) + { ++ struct snd_soc_dapm_context *dapm = w->dapm; + int i, ret = 0; + size_t name_len, prefix_len; + struct snd_soc_dapm_path *path; +@@ -443,9 +443,9 @@ static int dapm_new_mixer(struct snd_soc_dapm_context *dapm, + } + + /* create new dapm mux control */ +-static int dapm_new_mux(struct snd_soc_dapm_context *dapm, +- struct snd_soc_dapm_widget *w) ++static int dapm_new_mux(struct snd_soc_dapm_widget *w) + { ++ struct snd_soc_dapm_context *dapm = w->dapm; + struct snd_soc_dapm_path *path = NULL; + struct snd_kcontrol *kcontrol; + struct snd_card *card = dapm->card->snd_card; +@@ -490,8 +490,7 @@ err: + } + + /* create new dapm volume control */ +-static int dapm_new_pga(struct snd_soc_dapm_context *dapm, +- struct snd_soc_dapm_widget *w) ++static int dapm_new_pga(struct snd_soc_dapm_widget *w) + { + if (w->num_kcontrols) + dev_err(w->dapm->dev, +@@ -1735,13 +1734,13 @@ int snd_soc_dapm_new_widgets(struct snd_soc_dapm_context *dapm) + case snd_soc_dapm_mixer: + case snd_soc_dapm_mixer_named_ctl: + w->power_check = dapm_generic_check_power; +- dapm_new_mixer(dapm, w); ++ dapm_new_mixer(w); + break; + case snd_soc_dapm_mux: + case snd_soc_dapm_virt_mux: + case snd_soc_dapm_value_mux: + w->power_check = dapm_generic_check_power; +- dapm_new_mux(dapm, w); ++ dapm_new_mux(w); + break; + case snd_soc_dapm_adc: + case snd_soc_dapm_aif_out: +@@ -1754,7 +1753,7 @@ int snd_soc_dapm_new_widgets(struct snd_soc_dapm_context *dapm) + case snd_soc_dapm_pga: + case snd_soc_dapm_out_drv: + w->power_check = dapm_generic_check_power; +- dapm_new_pga(dapm, w); ++ dapm_new_pga(w); + break; + case snd_soc_dapm_input: + case snd_soc_dapm_output: diff --git a/debian/patches/series/3 b/debian/patches/series/3 index 0993280c1..6af0ec76b 100644 --- a/debian/patches/series/3 +++ b/debian/patches/series/3 @@ -1,2 +1,2 @@ + bugfix/x86/Revert-drm-i915-Enable-GMBUS-for-post-gen2-chipsets.patch -+ bugfix/all/block-blkdev_get-should-access-bd_disk-only-after-su.patch ++ bugfix/all/stable/2.6.39.2