[kernel] r17723 - in dists/sid/linux-2.6/debian: . patches/bugfix/all patches/bugfix/all/stable patches/series
Maximilian Attems
maks at alioth.debian.org
Sat Jun 25 08:04:23 UTC 2011
Author: maks
Date: Sat Jun 25 08:04:21 2011
New Revision: 17723
Log:
add stable 2.6.39.2
remove patch that ships in it
Added:
dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.39.2
Deleted:
dists/sid/linux-2.6/debian/patches/bugfix/all/block-blkdev_get-should-access-bd_disk-only-after-su.patch
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/series/3
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog Sat Jun 25 05:30:12 2011 (r17722)
+++ dists/sid/linux-2.6/debian/changelog Sat Jun 25 08:04:21 2011 (r17723)
@@ -6,6 +6,13 @@
* block: Fix crash (oops) in blkdev_get() on failed exclusive open
(Closes: #631574)
+ [ maximilian attems ]
+ * Add stable 2.6.39.2, including:
+ - drm/radeon/kms: viewport height has to be even
+ - drm/radeon/kms: fix for radeon on systems >4GB without hardware iommu
+ - fat: Fix corrupt inode flags when remove ATTR_SYS flag
+ - scsi: Fix oops caused by queue refcounting failure
+
-- Ben Hutchings <ben at decadent.org.uk> Tue, 21 Jun 2011 05:27:43 +0100
linux-2.6 (2.6.39-2) unstable; urgency=low
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.39.2
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.39.2 Sat Jun 25 08:04:21 2011 (r17723)
@@ -0,0 +1,2839 @@
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index cc85a92..066b642 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -2590,6 +2590,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+ unlock ejectable media);
+ m = MAX_SECTORS_64 (don't transfer more
+ than 64 sectors = 32 KB at a time);
++ n = INITIAL_READ10 (force a retry of the
++ initial READ(10) command);
+ o = CAPACITY_OK (accept the capacity
+ reported by the device);
+ r = IGNORE_RESIDUE (the device reports
+diff --git a/arch/powerpc/kernel/head_32.S b/arch/powerpc/kernel/head_32.S
+index c5c24be..727f40a 100644
+--- a/arch/powerpc/kernel/head_32.S
++++ b/arch/powerpc/kernel/head_32.S
+@@ -896,7 +896,7 @@ _GLOBAL(start_secondary_resume)
+ rlwinm r1,r1,0,0,(31-THREAD_SHIFT) /* current_thread_info() */
+ addi r1,r1,THREAD_SIZE-STACK_FRAME_OVERHEAD
+ li r3,0
+- std r3,0(r1) /* Zero the stack frame pointer */
++ stw r3,0(r1) /* Zero the stack frame pointer */
+ bl start_secondary
+ b .
+ #endif /* CONFIG_SMP */
+diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
+index cbdbb14..f2dcab7 100644
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -410,8 +410,6 @@ int __cpuinit __cpu_up(unsigned int cpu)
+ {
+ int rc, c;
+
+- secondary_ti = current_set[cpu];
+-
+ if (smp_ops == NULL ||
+ (smp_ops->cpu_bootable && !smp_ops->cpu_bootable(cpu)))
+ return -EINVAL;
+@@ -421,6 +419,8 @@ int __cpuinit __cpu_up(unsigned int cpu)
+ if (rc)
+ return rc;
+
++ secondary_ti = current_set[cpu];
++
+ /* Make sure callin-map entry is 0 (can be leftover a CPU
+ * hotplug
+ */
+diff --git a/arch/tile/kernel/pci.c b/arch/tile/kernel/pci.c
+index ea38f0c..1073269 100644
+--- a/arch/tile/kernel/pci.c
++++ b/arch/tile/kernel/pci.c
+@@ -179,12 +179,6 @@ int __init tile_pci_init(void)
+
+ controller = &controllers[num_controllers];
+
+- if (tile_init_irqs(i, controller)) {
+- pr_err("PCI: Could not initialize "
+- "IRQs, aborting.\n");
+- goto err_cont;
+- }
+-
+ controller->index = num_controllers;
+ controller->hv_cfg_fd[0] = hv_cfg_fd0;
+ controller->hv_cfg_fd[1] = hv_cfg_fd1;
+@@ -300,6 +294,11 @@ static int __init pcibios_init(void)
+ struct pci_controller *controller = &controllers[i];
+ struct pci_bus *bus;
+
++ if (tile_init_irqs(i, controller)) {
++ pr_err("PCI: Could not initialize IRQS\n");
++ continue;
++ }
++
+ pr_info("PCI: initializing controller #%d\n", i);
+
+ /*
+diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
+index 57ca777..e7115c8 100644
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -28,6 +28,7 @@
+ #include <asm/proto.h>
+ #include <asm/iommu.h>
+ #include <asm/gart.h>
++#include <asm/dma.h>
+ #include <asm/amd_iommu_proto.h>
+ #include <asm/amd_iommu_types.h>
+ #include <asm/amd_iommu.h>
+@@ -153,6 +154,10 @@ static int iommu_init_device(struct device *dev)
+ pdev = pci_get_bus_and_slot(PCI_BUS(alias), alias & 0xff);
+ if (pdev)
+ dev_data->alias = &pdev->dev;
++ else {
++ kfree(dev_data);
++ return -ENOTSUPP;
++ }
+
+ atomic_set(&dev_data->bind, 0);
+
+@@ -162,6 +167,20 @@ static int iommu_init_device(struct device *dev)
+ return 0;
+ }
+
++static void iommu_ignore_device(struct device *dev)
++{
++ u16 devid, alias;
++
++ devid = get_device_id(dev);
++ alias = amd_iommu_alias_table[devid];
++
++ memset(&amd_iommu_dev_table[devid], 0, sizeof(struct dev_table_entry));
++ memset(&amd_iommu_dev_table[alias], 0, sizeof(struct dev_table_entry));
++
++ amd_iommu_rlookup_table[devid] = NULL;
++ amd_iommu_rlookup_table[alias] = NULL;
++}
++
+ static void iommu_uninit_device(struct device *dev)
+ {
+ kfree(dev->archdata.iommu);
+@@ -191,7 +210,9 @@ int __init amd_iommu_init_devices(void)
+ continue;
+
+ ret = iommu_init_device(&pdev->dev);
+- if (ret)
++ if (ret == -ENOTSUPP)
++ iommu_ignore_device(&pdev->dev);
++ else if (ret)
+ goto out_free;
+ }
+
+@@ -2296,6 +2317,23 @@ static struct dma_map_ops amd_iommu_dma_ops = {
+ .dma_supported = amd_iommu_dma_supported,
+ };
+
++static unsigned device_dma_ops_init(void)
++{
++ struct pci_dev *pdev = NULL;
++ unsigned unhandled = 0;
++
++ for_each_pci_dev(pdev) {
++ if (!check_device(&pdev->dev)) {
++ unhandled += 1;
++ continue;
++ }
++
++ pdev->dev.archdata.dma_ops = &amd_iommu_dma_ops;
++ }
++
++ return unhandled;
++}
++
+ /*
+ * The function which clues the AMD IOMMU driver into dma_ops.
+ */
+@@ -2308,7 +2346,7 @@ void __init amd_iommu_init_api(void)
+ int __init amd_iommu_init_dma_ops(void)
+ {
+ struct amd_iommu *iommu;
+- int ret;
++ int ret, unhandled;
+
+ /*
+ * first allocate a default protection domain for every IOMMU we
+@@ -2334,7 +2372,11 @@ int __init amd_iommu_init_dma_ops(void)
+ swiotlb = 0;
+
+ /* Make the driver finally visible to the drivers */
+- dma_ops = &amd_iommu_dma_ops;
++ unhandled = device_dma_ops_init();
++ if (unhandled && max_pfn > MAX_DMA32_PFN) {
++ /* There are unhandled devices - initialize swiotlb for them */
++ swiotlb = 1;
++ }
+
+ amd_iommu_stats_init();
+
+diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c
+index 246d727..b9e207e 100644
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -701,8 +701,8 @@ static void __init init_iommu_from_acpi(struct amd_iommu *iommu,
+ {
+ u8 *p = (u8 *)h;
+ u8 *end = p, flags = 0;
+- u16 dev_i, devid = 0, devid_start = 0, devid_to = 0;
+- u32 ext_flags = 0;
++ u16 devid = 0, devid_start = 0, devid_to = 0;
++ u32 dev_i, ext_flags = 0;
+ bool alias = false;
+ struct ivhd_entry *e;
+
+@@ -857,7 +857,7 @@ static void __init init_iommu_from_acpi(struct amd_iommu *iommu,
+ /* Initializes the device->iommu mapping for the driver */
+ static int __init init_iommu_devices(struct amd_iommu *iommu)
+ {
+- u16 i;
++ u32 i;
+
+ for (i = iommu->first_device; i <= iommu->last_device; ++i)
+ set_iommu_for_device(iommu, i);
+@@ -1146,7 +1146,7 @@ static int __init init_memory_definitions(struct acpi_table_header *table)
+ */
+ static void init_device_table(void)
+ {
+- u16 devid;
++ u32 devid;
+
+ for (devid = 0; devid <= amd_iommu_last_bdf; ++devid) {
+ set_dev_entry_bit(devid, DEV_ENTRY_VALID);
+diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c
+index e90f084..bea9c03 100644
+--- a/arch/x86/kernel/devicetree.c
++++ b/arch/x86/kernel/devicetree.c
+@@ -13,6 +13,7 @@
+ #include <linux/slab.h>
+ #include <linux/pci.h>
+ #include <linux/of_pci.h>
++#include <linux/initrd.h>
+
+ #include <asm/hpet.h>
+ #include <asm/irq_controller.h>
+@@ -98,6 +99,16 @@ void * __init early_init_dt_alloc_memory_arch(u64 size, u64 align)
+ return __alloc_bootmem(size, align, __pa(MAX_DMA_ADDRESS));
+ }
+
++#ifdef CONFIG_BLK_DEV_INITRD
++void __init early_init_dt_setup_initrd_arch(unsigned long start,
++ unsigned long end)
++{
++ initrd_start = (unsigned long)__va(start);
++ initrd_end = (unsigned long)__va(end);
++ initrd_below_start_ok = 1;
++}
++#endif
++
+ void __init add_dtb(u64 data)
+ {
+ initial_dtb = data + offsetof(struct setup_data, data);
+diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
+index 8d12878..a3d0dc5 100644
+--- a/arch/x86/kernel/process_32.c
++++ b/arch/x86/kernel/process_32.c
+@@ -245,7 +245,6 @@ start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp)
+ {
+ set_user_gs(regs, 0);
+ regs->fs = 0;
+- set_fs(USER_DS);
+ regs->ds = __USER_DS;
+ regs->es = __USER_DS;
+ regs->ss = __USER_DS;
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index 6c9dd92..ca6f7ab 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -338,7 +338,6 @@ start_thread_common(struct pt_regs *regs, unsigned long new_ip,
+ regs->cs = _cs;
+ regs->ss = _ss;
+ regs->flags = X86_EFLAGS_IF;
+- set_fs(USER_DS);
+ /*
+ * Free the old FP and other extended state
+ */
+diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
+index c6724e4..4be9b39 100644
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -912,13 +912,6 @@ void __init setup_arch(char **cmdline_p)
+ memblock.current_limit = get_max_mapped();
+ memblock_x86_fill();
+
+- /*
+- * The EFI specification says that boot service code won't be called
+- * after ExitBootServices(). This is, in fact, a lie.
+- */
+- if (efi_enabled)
+- efi_reserve_boot_services();
+-
+ /* preallocate 4k for mptable mpc */
+ early_reserve_e820_mpc_new();
+
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index c2871d3..c58d144 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -285,6 +285,19 @@ notrace static void __cpuinit start_secondary(void *unused)
+ per_cpu(cpu_state, smp_processor_id()) = CPU_ONLINE;
+ x86_platform.nmi_init();
+
++ /*
++ * Wait until the cpu which brought this one up marked it
++ * online before enabling interrupts. If we don't do that then
++ * we can end up waking up the softirq thread before this cpu
++ * reached the active state, which makes the scheduler unhappy
++ * and schedule the softirq thread on the wrong cpu. This is
++ * only observable with forced threaded interrupts, but in
++ * theory it could also happen w/o them. It's just way harder
++ * to achieve.
++ */
++ while (!cpumask_test_cpu(smp_processor_id(), cpu_active_mask))
++ cpu_relax();
++
+ /* enable local interrupts */
+ local_irq_enable();
+
+diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
+index 1cd6089..493ea1f 100644
+--- a/arch/x86/lguest/boot.c
++++ b/arch/x86/lguest/boot.c
+@@ -995,6 +995,7 @@ static void lguest_time_irq(unsigned int irq, struct irq_desc *desc)
+ static void lguest_time_init(void)
+ {
+ /* Set up the timer interrupt (0) to go to our simple timer routine */
++ lguest_setup_irq(0);
+ irq_set_handler(0, lguest_time_irq);
+
+ clocksource_register(&lguest_clock);
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index b00c4ea..0fe27d7 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -315,40 +315,6 @@ static void __init print_efi_memmap(void)
+ }
+ #endif /* EFI_DEBUG */
+
+-void __init efi_reserve_boot_services(void)
+-{
+- void *p;
+-
+- for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
+- efi_memory_desc_t *md = p;
+- unsigned long long start = md->phys_addr;
+- unsigned long long size = md->num_pages << EFI_PAGE_SHIFT;
+-
+- if (md->type != EFI_BOOT_SERVICES_CODE &&
+- md->type != EFI_BOOT_SERVICES_DATA)
+- continue;
+-
+- memblock_x86_reserve_range(start, start + size, "EFI Boot");
+- }
+-}
+-
+-static void __init efi_free_boot_services(void)
+-{
+- void *p;
+-
+- for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
+- efi_memory_desc_t *md = p;
+- unsigned long long start = md->phys_addr;
+- unsigned long long size = md->num_pages << EFI_PAGE_SHIFT;
+-
+- if (md->type != EFI_BOOT_SERVICES_CODE &&
+- md->type != EFI_BOOT_SERVICES_DATA)
+- continue;
+-
+- free_bootmem_late(start, size);
+- }
+-}
+-
+ void __init efi_init(void)
+ {
+ efi_config_table_t *config_tables;
+@@ -541,9 +507,7 @@ void __init efi_enter_virtual_mode(void)
+ efi.systab = NULL;
+ for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
+ md = p;
+- if (!(md->attribute & EFI_MEMORY_RUNTIME) &&
+- md->type != EFI_BOOT_SERVICES_CODE &&
+- md->type != EFI_BOOT_SERVICES_DATA)
++ if (!(md->attribute & EFI_MEMORY_RUNTIME))
+ continue;
+
+ size = md->num_pages << EFI_PAGE_SHIFT;
+@@ -594,13 +558,6 @@ void __init efi_enter_virtual_mode(void)
+ }
+
+ /*
+- * Thankfully, it does seem that no runtime services other than
+- * SetVirtualAddressMap() will touch boot services code, so we can
+- * get rid of it all at this point
+- */
+- efi_free_boot_services();
+-
+- /*
+ * Now that EFI is in virtual mode, update the function
+ * pointers in the runtime service table to the new virtual addresses.
+ *
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index 641264c..ac0621a 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -64,11 +64,10 @@ static void __init early_runtime_code_mapping_set_exec(int executable)
+ if (!(__supported_pte_mask & _PAGE_NX))
+ return;
+
+- /* Make EFI service code area executable */
++ /* Make EFI runtime service code area executable */
+ for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
+ md = p;
+- if (md->type == EFI_RUNTIME_SERVICES_CODE ||
+- md->type == EFI_BOOT_SERVICES_CODE) {
++ if (md->type == EFI_RUNTIME_SERVICES_CODE) {
+ unsigned long end;
+ end = md->phys_addr + (md->num_pages << EFI_PAGE_SHIFT);
+ early_mapping_set_exec(md->phys_addr, end, executable);
+diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
+index 8bff7e7..1b2b73f 100644
+--- a/arch/x86/xen/multicalls.c
++++ b/arch/x86/xen/multicalls.c
+@@ -189,10 +189,10 @@ struct multicall_space __xen_mc_entry(size_t args)
+ unsigned argidx = roundup(b->argidx, sizeof(u64));
+
+ BUG_ON(preemptible());
+- BUG_ON(b->argidx > MC_ARGS);
++ BUG_ON(b->argidx >= MC_ARGS);
+
+ if (b->mcidx == MC_BATCH ||
+- (argidx + args) > MC_ARGS) {
++ (argidx + args) >= MC_ARGS) {
+ mc_stats_flush(b->mcidx == MC_BATCH ? FL_SLOTS : FL_ARGS);
+ xen_mc_flush();
+ argidx = roundup(b->argidx, sizeof(u64));
+@@ -206,7 +206,7 @@ struct multicall_space __xen_mc_entry(size_t args)
+ ret.args = &b->args[argidx];
+ b->argidx = argidx + args;
+
+- BUG_ON(b->argidx > MC_ARGS);
++ BUG_ON(b->argidx >= MC_ARGS);
+ return ret;
+ }
+
+@@ -216,7 +216,7 @@ struct multicall_space xen_mc_extend_args(unsigned long op, size_t size)
+ struct multicall_space ret = { NULL, NULL };
+
+ BUG_ON(preemptible());
+- BUG_ON(b->argidx > MC_ARGS);
++ BUG_ON(b->argidx >= MC_ARGS);
+
+ if (b->mcidx == 0)
+ return ret;
+@@ -224,14 +224,14 @@ struct multicall_space xen_mc_extend_args(unsigned long op, size_t size)
+ if (b->entries[b->mcidx - 1].op != op)
+ return ret;
+
+- if ((b->argidx + size) > MC_ARGS)
++ if ((b->argidx + size) >= MC_ARGS)
+ return ret;
+
+ ret.mc = &b->entries[b->mcidx - 1];
+ ret.args = &b->args[b->argidx];
+ b->argidx += size;
+
+- BUG_ON(b->argidx > MC_ARGS);
++ BUG_ON(b->argidx >= MC_ARGS);
+ return ret;
+ }
+
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 3fe00a1..5323076 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -345,6 +345,7 @@ void blk_put_queue(struct request_queue *q)
+ {
+ kobject_put(&q->kobj);
+ }
++EXPORT_SYMBOL(blk_put_queue);
+
+ /*
+ * Note: If a driver supplied the queue lock, it should not zap that lock
+@@ -566,6 +567,7 @@ int blk_get_queue(struct request_queue *q)
+
+ return 1;
+ }
++EXPORT_SYMBOL(blk_get_queue);
+
+ static inline void blk_free_request(struct request_queue *q, struct request *rq)
+ {
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index e6fc716..a576406 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -756,6 +756,12 @@ static int __init nbd_init(void)
+ if (max_part > 0)
+ part_shift = fls(max_part);
+
++ if ((1UL << part_shift) > DISK_MAX_PARTS)
++ return -EINVAL;
++
++ if (nbds_max > 1UL << (MINORBITS - part_shift))
++ return -EINVAL;
++
+ for (i = 0; i < nbds_max; i++) {
+ struct gendisk *disk = alloc_disk(1 << part_shift);
+ if (!disk)
+diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
+index 4f1b8de..7c7a1e4 100644
+--- a/drivers/cpufreq/cpufreq_stats.c
++++ b/drivers/cpufreq/cpufreq_stats.c
+@@ -388,6 +388,7 @@ static void __exit cpufreq_stats_exit(void)
+ unregister_hotcpu_notifier(&cpufreq_stat_cpu_notifier);
+ for_each_online_cpu(cpu) {
+ cpufreq_stats_free_table(cpu);
++ cpufreq_stats_free_sysfs(cpu);
+ }
+ }
+
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index 67cb076..b28f7bd 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -727,6 +727,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "U800"),
+ },
+ },
++ {
++ .callback = intel_no_lvds_dmi_callback,
++ .ident = "Asus EeeBox PC EB1007",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "EB1007"),
++ },
++ },
+
+ { } /* terminating entry */
+ };
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 529a3a7..02705c7 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1011,7 +1011,7 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
+ uint64_t fb_location;
+ uint32_t fb_format, fb_pitch_pixels, tiling_flags;
+ u32 fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_NONE);
+- u32 tmp;
++ u32 tmp, viewport_w, viewport_h;
+ int r;
+
+ /* no fb bound */
+@@ -1137,8 +1137,10 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
+ y &= ~1;
+ WREG32(EVERGREEN_VIEWPORT_START + radeon_crtc->crtc_offset,
+ (x << 16) | y);
++ viewport_w = crtc->mode.hdisplay;
++ viewport_h = (crtc->mode.vdisplay + 1) & ~1;
+ WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+- (crtc->mode.hdisplay << 16) | crtc->mode.vdisplay);
++ (viewport_w << 16) | viewport_h);
+
+ /* pageflip setup */
+ /* make sure flip is at vb rather than hb */
+@@ -1179,7 +1181,7 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
+ uint64_t fb_location;
+ uint32_t fb_format, fb_pitch_pixels, tiling_flags;
+ u32 fb_swap = R600_D1GRPH_SWAP_ENDIAN_NONE;
+- u32 tmp;
++ u32 tmp, viewport_w, viewport_h;
+ int r;
+
+ /* no fb bound */
+@@ -1304,8 +1306,10 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
+ y &= ~1;
+ WREG32(AVIVO_D1MODE_VIEWPORT_START + radeon_crtc->crtc_offset,
+ (x << 16) | y);
++ viewport_w = crtc->mode.hdisplay;
++ viewport_h = (crtc->mode.vdisplay + 1) & ~1;
+ WREG32(AVIVO_D1MODE_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+- (crtc->mode.hdisplay << 16) | crtc->mode.vdisplay);
++ (viewport_w << 16) | viewport_h);
+
+ /* pageflip setup */
+ /* make sure flip is at vb rather than hb */
+diff --git a/drivers/gpu/drm/radeon/r100_track.h b/drivers/gpu/drm/radeon/r100_track.h
+index 2fef9de..686f9dc 100644
+--- a/drivers/gpu/drm/radeon/r100_track.h
++++ b/drivers/gpu/drm/radeon/r100_track.h
+@@ -63,7 +63,7 @@ struct r100_cs_track {
+ unsigned num_arrays;
+ unsigned max_indx;
+ unsigned color_channel_mask;
+- struct r100_cs_track_array arrays[11];
++ struct r100_cs_track_array arrays[16];
+ struct r100_cs_track_cb cb[R300_MAX_CB];
+ struct r100_cs_track_cb zb;
+ struct r100_cs_track_cb aa;
+@@ -146,6 +146,12 @@ static inline int r100_packet3_load_vbpntr(struct radeon_cs_parser *p,
+ ib = p->ib->ptr;
+ track = (struct r100_cs_track *)p->track;
+ c = radeon_get_ib_value(p, idx++) & 0x1F;
++ if (c > 16) {
++ DRM_ERROR("Only 16 vertex buffers are allowed %d\n",
++ pkt->opcode);
++ r100_cs_dump_packet(p, pkt);
++ return -EINVAL;
++ }
+ track->num_arrays = c;
+ for (i = 0; i < (c - 1); i+=2, idx+=3) {
+ r = r100_cs_packet_next_reloc(p, &reloc);
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index 890217e..5d6ccc3 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -752,6 +752,7 @@ int radeon_device_init(struct radeon_device *rdev,
+ dma_bits = rdev->need_dma32 ? 32 : 40;
+ r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(dma_bits));
+ if (r) {
++ rdev->need_dma32 = true;
+ printk(KERN_WARNING "radeon: No suitable DMA available.\n");
+ }
+
+diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
+index 194ca0a..08cea44 100644
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -263,7 +263,7 @@ static int __devinit get_tjmax(struct cpuinfo_x86 *c, u32 id,
+ * If the TjMax is not plausible, an assumption
+ * will be used
+ */
+- if ((val > 80) && (val < 120)) {
++ if (val >= 70 && val <= 125) {
+ dev_info(dev, "TjMax is %d C.\n", val);
+ return val * 1000;
+ }
+@@ -271,24 +271,9 @@ static int __devinit get_tjmax(struct cpuinfo_x86 *c, u32 id,
+
+ /*
+ * An assumption is made for early CPUs and unreadable MSR.
+- * NOTE: the given value may not be correct.
++ * NOTE: the calculated value may not be correct.
+ */
+-
+- switch (c->x86_model) {
+- case 0xe:
+- case 0xf:
+- case 0x16:
+- case 0x1a:
+- dev_warn(dev, "TjMax is assumed as 100 C!\n");
+- return 100000;
+- case 0x17:
+- case 0x1c: /* Atom CPUs */
+- return adjust_tjmax(c, id, dev);
+- default:
+- dev_warn(dev, "CPU (model=0x%x) is not supported yet,"
+- " using default TjMax of 100C.\n", c->x86_model);
+- return 100000;
+- }
++ return adjust_tjmax(c, id, dev);
+ }
+
+ static void __devinit get_ucode_rev_on_cpu(void *edx)
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 4a4c0f8..9930792 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2462,7 +2462,7 @@ slot_store(mdk_rdev_t *rdev, const char *buf, size_t len)
+ if (rdev->raid_disk == -1)
+ return -EEXIST;
+ /* personality does all needed checks */
+- if (rdev->mddev->pers->hot_add_disk == NULL)
++ if (rdev->mddev->pers->hot_remove_disk == NULL)
+ return -EINVAL;
+ err = rdev->mddev->pers->
+ hot_remove_disk(rdev->mddev, rdev->raid_disk);
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 49bf5f8..3d13d11 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -129,7 +129,7 @@ static inline int raid5_dec_bi_hw_segments(struct bio *bio)
+
+ static inline void raid5_set_bi_hw_segments(struct bio *bio, unsigned int cnt)
+ {
+- bio->bi_phys_segments = raid5_bi_phys_segments(bio) || (cnt << 16);
++ bio->bi_phys_segments = raid5_bi_phys_segments(bio) | (cnt << 16);
+ }
+
+ /* Find first data disk in a raid6 stripe */
+@@ -514,7 +514,7 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
+ bi = &sh->dev[i].req;
+
+ bi->bi_rw = rw;
+- if (rw == WRITE)
++ if (rw & WRITE)
+ bi->bi_end_io = raid5_end_write_request;
+ else
+ bi->bi_end_io = raid5_end_read_request;
+@@ -548,13 +548,13 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
+ bi->bi_io_vec[0].bv_offset = 0;
+ bi->bi_size = STRIPE_SIZE;
+ bi->bi_next = NULL;
+- if (rw == WRITE &&
++ if ((rw & WRITE) &&
+ test_bit(R5_ReWrite, &sh->dev[i].flags))
+ atomic_add(STRIPE_SECTORS,
+ &rdev->corrected_errors);
+ generic_make_request(bi);
+ } else {
+- if (rw == WRITE)
++ if (rw & WRITE)
+ set_bit(STRIPE_DEGRADED, &sh->state);
+ pr_debug("skip op %ld on disc %d for sector %llu\n",
+ bi->bi_rw, i, (unsigned long long)sh->sector);
+diff --git a/drivers/media/media-devnode.c b/drivers/media/media-devnode.c
+index af5263c..7b42ace 100644
+--- a/drivers/media/media-devnode.c
++++ b/drivers/media/media-devnode.c
+@@ -213,14 +213,14 @@ int __must_check media_devnode_register(struct media_devnode *mdev)
+
+ /* Part 1: Find a free minor number */
+ mutex_lock(&media_devnode_lock);
+- minor = find_next_zero_bit(media_devnode_nums, 0, MEDIA_NUM_DEVICES);
++ minor = find_next_zero_bit(media_devnode_nums, MEDIA_NUM_DEVICES, 0);
+ if (minor == MEDIA_NUM_DEVICES) {
+ mutex_unlock(&media_devnode_lock);
+ printk(KERN_ERR "could not get a free minor\n");
+ return -ENFILE;
+ }
+
+- set_bit(mdev->minor, media_devnode_nums);
++ set_bit(minor, media_devnode_nums);
+ mutex_unlock(&media_devnode_lock);
+
+ mdev->minor = minor;
+diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
+index 0dfd1b9..0e3fccb 100644
+--- a/drivers/net/igb/igb_main.c
++++ b/drivers/net/igb/igb_main.c
+@@ -2372,6 +2372,9 @@ static int __devinit igb_sw_init(struct igb_adapter *adapter)
+ }
+ #endif /* CONFIG_PCI_IOV */
+ adapter->rss_queues = min_t(u32, IGB_MAX_RX_QUEUES, num_online_cpus());
++ /* i350 cannot do RSS and SR-IOV at the same time */
++ if (hw->mac.type == e1000_i350 && adapter->vfs_allocated_count)
++ adapter->rss_queues = 1;
+
+ /*
+ * if rss_queues > 4 or vfs are going to be allocated with rss_queues
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index 1033ef6..f2b974d 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1254,6 +1254,7 @@ static struct usb_driver cdc_ncm_driver = {
+ .disconnect = cdc_ncm_disconnect,
+ .suspend = usbnet_suspend,
+ .resume = usbnet_resume,
++ .reset_resume = usbnet_resume,
+ .supports_autosuspend = 1,
+ };
+
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+index 37af3f4..db4416c 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -4598,10 +4598,16 @@ static void ar9003_hw_set_power_per_rate_table(struct ath_hw *ah,
+ case 1:
+ break;
+ case 2:
+- scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
++ if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
++ scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
++ else
++ scaledPower = 0;
+ break;
+ case 3:
+- scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
++ if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
++ scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
++ else
++ scaledPower = 0;
+ break;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+index 8cd8333..945e448 100644
+--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
++++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+@@ -522,10 +522,16 @@ static void ath9k_hw_set_ar9287_power_per_rate_table(struct ath_hw *ah,
+ case 1:
+ break;
+ case 2:
+- scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
++ if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
++ scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
++ else
++ scaledPower = 0;
+ break;
+ case 3:
+- scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
++ if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
++ scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
++ else
++ scaledPower = 0;
+ break;
+ }
+ scaledPower = max((u16)0, scaledPower);
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 1482fa6..846bb4f 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -633,7 +633,8 @@ void ath9k_tasklet(unsigned long data)
+ u32 status = sc->intrstatus;
+ u32 rxmask;
+
+- if (status & ATH9K_INT_FATAL) {
++ if ((status & ATH9K_INT_FATAL) ||
++ (status & ATH9K_INT_BB_WATCHDOG)) {
+ ath_reset(sc, true);
+ return;
+ }
+@@ -699,6 +700,7 @@ irqreturn_t ath_isr(int irq, void *dev)
+ {
+ #define SCHED_INTR ( \
+ ATH9K_INT_FATAL | \
++ ATH9K_INT_BB_WATCHDOG | \
+ ATH9K_INT_RXORN | \
+ ATH9K_INT_RXEOL | \
+ ATH9K_INT_RX | \
+diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
+index 4c0d36a..a39dfc4 100644
+--- a/drivers/net/wireless/ath/ath9k/rc.c
++++ b/drivers/net/wireless/ath/ath9k/rc.c
+@@ -689,7 +689,8 @@ static void ath_rc_rate_set_series(const struct ath_rate_table *rate_table,
+
+ if (WLAN_RC_PHY_HT(rate_table->info[rix].phy)) {
+ rate->flags |= IEEE80211_TX_RC_MCS;
+- if (WLAN_RC_PHY_40(rate_table->info[rix].phy))
++ if (WLAN_RC_PHY_40(rate_table->info[rix].phy) &&
++ conf_is_ht40(&txrc->hw->conf))
+ rate->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
+ if (WLAN_RC_PHY_SGI(rate_table->info[rix].phy))
+ rate->flags |= IEEE80211_TX_RC_SHORT_GI;
+diff --git a/drivers/net/wireless/iwlegacy/iwl-4965-lib.c b/drivers/net/wireless/iwlegacy/iwl-4965-lib.c
+index 5a8a3cc..455f1f7 100644
+--- a/drivers/net/wireless/iwlegacy/iwl-4965-lib.c
++++ b/drivers/net/wireless/iwlegacy/iwl-4965-lib.c
+@@ -628,11 +628,11 @@ void iwl4965_rx_reply_rx(struct iwl_priv *priv,
+
+ /* rx_status carries information about the packet to mac80211 */
+ rx_status.mactime = le64_to_cpu(phy_res->timestamp);
++ rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
++ IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
+ rx_status.freq =
+ ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel),
+ rx_status.band);
+- rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
+- IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
+ rx_status.rate_idx =
+ iwl4965_hwrate_to_mac80211_idx(rate_n_flags, rx_status.band);
+ rx_status.flag = 0;
+diff --git a/drivers/net/wireless/iwlegacy/iwl-4965.c b/drivers/net/wireless/iwlegacy/iwl-4965.c
+index f5433c7..facc94e 100644
+--- a/drivers/net/wireless/iwlegacy/iwl-4965.c
++++ b/drivers/net/wireless/iwlegacy/iwl-4965.c
+@@ -1218,10 +1218,10 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *c
+ * receive commit_rxon request
+ * abort any previous channel switch if still in process
+ */
+- if (priv->switch_rxon.switch_in_progress &&
+- (priv->switch_rxon.channel != ctx->staging.channel)) {
++ if (test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status) &&
++ (priv->switch_channel != ctx->staging.channel)) {
+ IWL_DEBUG_11H(priv, "abort channel switch on %d\n",
+- le16_to_cpu(priv->switch_rxon.channel));
++ le16_to_cpu(priv->switch_channel));
+ iwl_legacy_chswitch_done(priv, false);
+ }
+
+@@ -1237,7 +1237,7 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *c
+
+ memcpy(active_rxon, &ctx->staging, sizeof(*active_rxon));
+ iwl_legacy_print_rx_config_cmd(priv, ctx);
+- return 0;
++ goto set_tx_power;
+ }
+
+ /* If we are currently associated and the new config requires
+@@ -1317,6 +1317,7 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *c
+
+ iwl4965_init_sensitivity(priv);
+
++set_tx_power:
+ /* If we issue a new RXON command which required a tune then we must
+ * send a new TXPOWER command or we won't be able to Tx any frames */
+ ret = iwl_legacy_set_tx_power(priv, priv->tx_power_next, true);
+@@ -1403,9 +1404,6 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv,
+ return rc;
+ }
+
+- priv->switch_rxon.channel = cmd.channel;
+- priv->switch_rxon.switch_in_progress = true;
+-
+ return iwl_legacy_send_cmd_pdu(priv,
+ REPLY_CHANNEL_SWITCH, sizeof(cmd), &cmd);
+ }
+@@ -1543,7 +1541,7 @@ static void iwl4965_temperature_calib(struct iwl_priv *priv)
+ s32 temp;
+
+ temp = iwl4965_hw_get_temperature(priv);
+- if (temp < 0)
++ if (IWL_TX_POWER_TEMPERATURE_OUT_OF_RANGE(temp))
+ return;
+
+ if (priv->temperature != temp) {
+diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c
+index 42db0fc..8ad7922 100644
+--- a/drivers/net/wireless/iwlegacy/iwl-core.c
++++ b/drivers/net/wireless/iwlegacy/iwl-core.c
+@@ -862,12 +862,8 @@ void iwl_legacy_chswitch_done(struct iwl_priv *priv, bool is_success)
+ if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+ return;
+
+- if (priv->switch_rxon.switch_in_progress) {
++ if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+ ieee80211_chswitch_done(ctx->vif, is_success);
+- mutex_lock(&priv->mutex);
+- priv->switch_rxon.switch_in_progress = false;
+- mutex_unlock(&priv->mutex);
+- }
+ }
+ EXPORT_SYMBOL(iwl_legacy_chswitch_done);
+
+@@ -879,19 +875,19 @@ void iwl_legacy_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
+ struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+ struct iwl_legacy_rxon_cmd *rxon = (void *)&ctx->active;
+
+- if (priv->switch_rxon.switch_in_progress) {
+- if (!le32_to_cpu(csa->status) &&
+- (csa->channel == priv->switch_rxon.channel)) {
+- rxon->channel = csa->channel;
+- ctx->staging.channel = csa->channel;
+- IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
+- le16_to_cpu(csa->channel));
+- iwl_legacy_chswitch_done(priv, true);
+- } else {
+- IWL_ERR(priv, "CSA notif (fail) : channel %d\n",
++ if (!test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
++ return;
++
++ if (!le32_to_cpu(csa->status) && csa->channel == priv->switch_channel) {
++ rxon->channel = csa->channel;
++ ctx->staging.channel = csa->channel;
++ IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
+ le16_to_cpu(csa->channel));
+- iwl_legacy_chswitch_done(priv, false);
+- }
++ iwl_legacy_chswitch_done(priv, true);
++ } else {
++ IWL_ERR(priv, "CSA notif (fail) : channel %d\n",
++ le16_to_cpu(csa->channel));
++ iwl_legacy_chswitch_done(priv, false);
+ }
+ }
+ EXPORT_SYMBOL(iwl_legacy_rx_csa);
+diff --git a/drivers/net/wireless/iwlegacy/iwl-core.h b/drivers/net/wireless/iwlegacy/iwl-core.h
+index f03b463..e49176a 100644
+--- a/drivers/net/wireless/iwlegacy/iwl-core.h
++++ b/drivers/net/wireless/iwlegacy/iwl-core.h
+@@ -561,7 +561,7 @@ void iwl_legacy_free_geos(struct iwl_priv *priv);
+ #define STATUS_SCAN_HW 15
+ #define STATUS_POWER_PMI 16
+ #define STATUS_FW_ERROR 17
+-
++#define STATUS_CHANNEL_SWITCH_PENDING 18
+
+ static inline int iwl_legacy_is_ready(struct iwl_priv *priv)
+ {
+diff --git a/drivers/net/wireless/iwlegacy/iwl-dev.h b/drivers/net/wireless/iwlegacy/iwl-dev.h
+index f43ac1e..54f89b4 100644
+--- a/drivers/net/wireless/iwlegacy/iwl-dev.h
++++ b/drivers/net/wireless/iwlegacy/iwl-dev.h
+@@ -854,17 +854,6 @@ struct traffic_stats {
+ };
+
+ /*
+- * iwl_switch_rxon: "channel switch" structure
+- *
+- * @ switch_in_progress: channel switch in progress
+- * @ channel: new channel
+- */
+-struct iwl_switch_rxon {
+- bool switch_in_progress;
+- __le16 channel;
+-};
+-
+-/*
+ * schedule the timer to wake up every UCODE_TRACE_PERIOD milliseconds
+ * to perform continuous uCode event logging operation if enabled
+ */
+@@ -1115,7 +1104,7 @@ struct iwl_priv {
+
+ struct iwl_rxon_context contexts[NUM_IWL_RXON_CTX];
+
+- struct iwl_switch_rxon switch_rxon;
++ __le16 switch_channel;
+
+ /* 1st responses from initialize and runtime uCode images.
+ * _4965's initialize alive response contains some calibration data. */
+diff --git a/drivers/net/wireless/iwlegacy/iwl4965-base.c b/drivers/net/wireless/iwlegacy/iwl4965-base.c
+index a62fe24..d654876 100644
+--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c
++++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c
+@@ -2851,16 +2851,13 @@ void iwl4965_mac_channel_switch(struct ieee80211_hw *hw,
+ goto out_exit;
+
+ if (test_bit(STATUS_EXIT_PENDING, &priv->status) ||
+- test_bit(STATUS_SCANNING, &priv->status))
++ test_bit(STATUS_SCANNING, &priv->status) ||
++ test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+ goto out_exit;
+
+ if (!iwl_legacy_is_associated_ctx(ctx))
+ goto out_exit;
+
+- /* channel switch in progress */
+- if (priv->switch_rxon.switch_in_progress == true)
+- goto out_exit;
+-
+ mutex_lock(&priv->mutex);
+ if (priv->cfg->ops->lib->set_channel_switch) {
+
+@@ -2910,16 +2907,20 @@ void iwl4965_mac_channel_switch(struct ieee80211_hw *hw,
+ * at this point, staging_rxon has the
+ * configuration for channel switch
+ */
++ set_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status);
++ priv->switch_channel = cpu_to_le16(ch);
+ if (priv->cfg->ops->lib->set_channel_switch(priv,
+- ch_switch))
+- priv->switch_rxon.switch_in_progress = false;
++ ch_switch)) {
++ clear_bit(STATUS_CHANNEL_SWITCH_PENDING,
++ &priv->status);
++ priv->switch_channel = 0;
++ ieee80211_chswitch_done(ctx->vif, false);
++ }
+ }
+ }
+ out:
+ mutex_unlock(&priv->mutex);
+ out_exit:
+- if (!priv->switch_rxon.switch_in_progress)
+- ieee80211_chswitch_done(ctx->vif, false);
+ IWL_DEBUG_MAC80211(priv, "leave\n");
+ }
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
+index d7b6126..d474cf3 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
+@@ -181,79 +181,6 @@ static int iwl2000_hw_set_hw_params(struct iwl_priv *priv)
+ return 0;
+ }
+
+-static int iwl2030_hw_channel_switch(struct iwl_priv *priv,
+- struct ieee80211_channel_switch *ch_switch)
+-{
+- /*
+- * MULTI-FIXME
+- * See iwl_mac_channel_switch.
+- */
+- struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+- struct iwl6000_channel_switch_cmd cmd;
+- const struct iwl_channel_info *ch_info;
+- u32 switch_time_in_usec, ucode_switch_time;
+- u16 ch;
+- u32 tsf_low;
+- u8 switch_count;
+- u16 beacon_interval = le16_to_cpu(ctx->timing.beacon_interval);
+- struct ieee80211_vif *vif = ctx->vif;
+- struct iwl_host_cmd hcmd = {
+- .id = REPLY_CHANNEL_SWITCH,
+- .len = sizeof(cmd),
+- .flags = CMD_SYNC,
+- .data = &cmd,
+- };
+-
+- cmd.band = priv->band == IEEE80211_BAND_2GHZ;
+- ch = ch_switch->channel->hw_value;
+- IWL_DEBUG_11H(priv, "channel switch from %u to %u\n",
+- ctx->active.channel, ch);
+- cmd.channel = cpu_to_le16(ch);
+- cmd.rxon_flags = ctx->staging.flags;
+- cmd.rxon_filter_flags = ctx->staging.filter_flags;
+- switch_count = ch_switch->count;
+- tsf_low = ch_switch->timestamp & 0x0ffffffff;
+- /*
+- * calculate the ucode channel switch time
+- * adding TSF as one of the factor for when to switch
+- */
+- if ((priv->ucode_beacon_time > tsf_low) && beacon_interval) {
+- if (switch_count > ((priv->ucode_beacon_time - tsf_low) /
+- beacon_interval)) {
+- switch_count -= (priv->ucode_beacon_time -
+- tsf_low) / beacon_interval;
+- } else
+- switch_count = 0;
+- }
+- if (switch_count <= 1)
+- cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+- else {
+- switch_time_in_usec =
+- vif->bss_conf.beacon_int * switch_count * TIME_UNIT;
+- ucode_switch_time = iwl_usecs_to_beacons(priv,
+- switch_time_in_usec,
+- beacon_interval);
+- cmd.switch_time = iwl_add_beacon_time(priv,
+- priv->ucode_beacon_time,
+- ucode_switch_time,
+- beacon_interval);
+- }
+- IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
+- cmd.switch_time);
+- ch_info = iwl_get_channel_info(priv, priv->band, ch);
+- if (ch_info)
+- cmd.expect_beacon = is_channel_radar(ch_info);
+- else {
+- IWL_ERR(priv, "invalid channel switch from %u to %u\n",
+- ctx->active.channel, ch);
+- return -EFAULT;
+- }
+- priv->switch_rxon.channel = cmd.channel;
+- priv->switch_rxon.switch_in_progress = true;
+-
+- return iwl_send_cmd_sync(priv, &hcmd);
+-}
+-
+ static struct iwl_lib_ops iwl2000_lib = {
+ .set_hw_params = iwl2000_hw_set_hw_params,
+ .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
+@@ -277,7 +204,6 @@ static struct iwl_lib_ops iwl2000_lib = {
+ .alive_notify = iwlagn_alive_notify,
+ .send_tx_power = iwlagn_send_tx_power,
+ .update_chain_flags = iwl_update_chain_flags,
+- .set_channel_switch = iwl2030_hw_channel_switch,
+ .apm_ops = {
+ .init = iwl_apm_init,
+ .config = iwl2000_nic_config,
+diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
+index 22e045b..dcf40e8 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
+@@ -337,8 +337,6 @@ static int iwl5000_hw_channel_switch(struct iwl_priv *priv,
+ ctx->active.channel, ch);
+ return -EFAULT;
+ }
+- priv->switch_rxon.channel = cmd.channel;
+- priv->switch_rxon.switch_in_progress = true;
+
+ return iwl_send_cmd_sync(priv, &hcmd);
+ }
+@@ -513,7 +511,6 @@ static struct iwl_base_params iwl5000_base_params = {
+ };
+ static struct iwl_ht_params iwl5000_ht_params = {
+ .ht_greenfield_support = true,
+- .use_rts_for_aggregation = true, /* use rts/cts protection */
+ };
+
+ #define IWL_DEVICE_5000 \
+diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
+index a745b01..9035255 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
+@@ -277,8 +277,6 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
+ ctx->active.channel, ch);
+ return -EFAULT;
+ }
+- priv->switch_rxon.channel = cmd.channel;
+- priv->switch_rxon.switch_in_progress = true;
+
+ return iwl_send_cmd_sync(priv, &hcmd);
+ }
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
+index 41543ad..129a551 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
+@@ -217,17 +217,9 @@ static void iwlagn_tx_cmd_protection(struct iwl_priv *priv,
+ __le16 fc, __le32 *tx_flags)
+ {
+ if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS ||
+- info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
++ info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT ||
++ info->flags & IEEE80211_TX_CTL_AMPDU)
+ *tx_flags |= TX_CMD_FLG_PROT_REQUIRE_MSK;
+- return;
+- }
+-
+- if (priv->cfg->ht_params &&
+- priv->cfg->ht_params->use_rts_for_aggregation &&
+- info->flags & IEEE80211_TX_CTL_AMPDU) {
+- *tx_flags |= TX_CMD_FLG_PROT_REQUIRE_MSK;
+- return;
+- }
+ }
+
+ /* Calc max signal level (dBm) among 3 possible receivers */
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+index fbbde07..7c0f80c 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+@@ -173,6 +173,14 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+ return 0;
+ }
+
++ /*
++ * force CTS-to-self frames protection if RTS-CTS is not preferred
++ * one aggregation protection method
++ */
++ if (!(priv->cfg->ht_params &&
++ priv->cfg->ht_params->use_rts_for_aggregation))
++ ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
++
+ if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) ||
+ !(ctx->staging.flags & RXON_FLG_BAND_24G_MSK))
+ ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
+@@ -189,10 +197,10 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+ * receive commit_rxon request
+ * abort any previous channel switch if still in process
+ */
+- if (priv->switch_rxon.switch_in_progress &&
+- (priv->switch_rxon.channel != ctx->staging.channel)) {
++ if (test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status) &&
++ (priv->switch_channel != ctx->staging.channel)) {
+ IWL_DEBUG_11H(priv, "abort channel switch on %d\n",
+- le16_to_cpu(priv->switch_rxon.channel));
++ le16_to_cpu(priv->switch_channel));
+ iwl_chswitch_done(priv, false);
+ }
+
+@@ -210,6 +218,11 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+
+ memcpy(active, &ctx->staging, sizeof(*active));
+ iwl_print_rx_config_cmd(priv, ctx);
++ /*
++ * We do not commit tx power settings while channel changing,
++ * do it now if after settings changed.
++ */
++ iwl_set_tx_power(priv, priv->tx_power_next, false);
+ return 0;
+ }
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
+index 321b18b..5941e61 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -3461,16 +3461,13 @@ void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
+ goto out_exit;
+
+ if (test_bit(STATUS_EXIT_PENDING, &priv->status) ||
+- test_bit(STATUS_SCANNING, &priv->status))
++ test_bit(STATUS_SCANNING, &priv->status) ||
++ test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+ goto out_exit;
+
+ if (!iwl_is_associated_ctx(ctx))
+ goto out_exit;
+
+- /* channel switch in progress */
+- if (priv->switch_rxon.switch_in_progress == true)
+- goto out_exit;
+-
+ mutex_lock(&priv->mutex);
+ if (priv->cfg->ops->lib->set_channel_switch) {
+
+@@ -3520,16 +3517,20 @@ void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
+ * at this point, staging_rxon has the
+ * configuration for channel switch
+ */
++ set_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status);
++ priv->switch_channel = cpu_to_le16(ch);
+ if (priv->cfg->ops->lib->set_channel_switch(priv,
+- ch_switch))
+- priv->switch_rxon.switch_in_progress = false;
++ ch_switch)) {
++ clear_bit(STATUS_CHANNEL_SWITCH_PENDING,
++ &priv->status);
++ priv->switch_channel = 0;
++ ieee80211_chswitch_done(ctx->vif, false);
++ }
+ }
+ }
+ out:
+ mutex_unlock(&priv->mutex);
+ out_exit:
+- if (!priv->switch_rxon.switch_in_progress)
+- ieee80211_chswitch_done(ctx->vif, false);
+ IWL_DEBUG_MAC80211(priv, "leave\n");
+ }
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
+index 1755729..7950bc4 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -861,12 +861,8 @@ void iwl_chswitch_done(struct iwl_priv *priv, bool is_success)
+ if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+ return;
+
+- if (priv->switch_rxon.switch_in_progress) {
++ if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+ ieee80211_chswitch_done(ctx->vif, is_success);
+- mutex_lock(&priv->mutex);
+- priv->switch_rxon.switch_in_progress = false;
+- mutex_unlock(&priv->mutex);
+- }
+ }
+
+ #ifdef CONFIG_IWLWIFI_DEBUG
+diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
+index b316d83..92f65b6 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-core.h
++++ b/drivers/net/wireless/iwlwifi/iwl-core.h
+@@ -662,7 +662,7 @@ void iwlcore_free_geos(struct iwl_priv *priv);
+ #define STATUS_SCAN_HW 15
+ #define STATUS_POWER_PMI 16
+ #define STATUS_FW_ERROR 17
+-
++#define STATUS_CHANNEL_SWITCH_PENDING 19
+
+ static inline int iwl_is_ready(struct iwl_priv *priv)
+ {
+diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
+index c0a4cfb..65a16ae 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
++++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
+@@ -1037,17 +1037,6 @@ struct traffic_stats {
+ };
+
+ /*
+- * iwl_switch_rxon: "channel switch" structure
+- *
+- * @ switch_in_progress: channel switch in progress
+- * @ channel: new channel
+- */
+-struct iwl_switch_rxon {
+- bool switch_in_progress;
+- __le16 channel;
+-};
+-
+-/*
+ * schedule the timer to wake up every UCODE_TRACE_PERIOD milliseconds
+ * to perform continuous uCode event logging operation if enabled
+ */
+@@ -1344,7 +1333,7 @@ struct iwl_priv {
+
+ struct iwl_rxon_context contexts[NUM_IWL_RXON_CTX];
+
+- struct iwl_switch_rxon switch_rxon;
++ __le16 switch_channel;
+
+ /* 1st responses from initialize and runtime uCode images.
+ * _agn's initialize alive response contains some calibration data. */
+diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
+index 6f9a2fa..8055910 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
+@@ -299,19 +299,19 @@ static void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
+ struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+ struct iwl_rxon_cmd *rxon = (void *)&ctx->active;
+
+- if (priv->switch_rxon.switch_in_progress) {
+- if (!le32_to_cpu(csa->status) &&
+- (csa->channel == priv->switch_rxon.channel)) {
+- rxon->channel = csa->channel;
+- ctx->staging.channel = csa->channel;
+- IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
+- le16_to_cpu(csa->channel));
+- iwl_chswitch_done(priv, true);
+- } else {
+- IWL_ERR(priv, "CSA notif (fail) : channel %d\n",
++ if (!test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
++ return;
++
++ if (!le32_to_cpu(csa->status) && csa->channel == priv->switch_channel) {
++ rxon->channel = csa->channel;
++ ctx->staging.channel = csa->channel;
++ IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
+ le16_to_cpu(csa->channel));
+- iwl_chswitch_done(priv, false);
+- }
++ iwl_chswitch_done(priv, true);
++ } else {
++ IWL_ERR(priv, "CSA notif (fail) : channel %d\n",
++ le16_to_cpu(csa->channel));
++ iwl_chswitch_done(priv, false);
+ }
+ }
+
+diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
+index ab607bb..13c0c77 100644
+--- a/drivers/net/wireless/zd1211rw/zd_usb.c
++++ b/drivers/net/wireless/zd1211rw/zd_usb.c
+@@ -1533,6 +1533,31 @@ static void __exit usb_exit(void)
+ module_init(usb_init);
+ module_exit(usb_exit);
+
++static int zd_ep_regs_out_msg(struct usb_device *udev, void *data, int len,
++ int *actual_length, int timeout)
++{
++ /* In USB 2.0 mode EP_REGS_OUT endpoint is interrupt type. However in
++ * USB 1.1 mode endpoint is bulk. Select correct type URB by endpoint
++ * descriptor.
++ */
++ struct usb_host_endpoint *ep;
++ unsigned int pipe;
++
++ pipe = usb_sndintpipe(udev, EP_REGS_OUT);
++ ep = usb_pipe_endpoint(udev, pipe);
++ if (!ep)
++ return -EINVAL;
++
++ if (usb_endpoint_xfer_int(&ep->desc)) {
++ return usb_interrupt_msg(udev, pipe, data, len,
++ actual_length, timeout);
++ } else {
++ pipe = usb_sndbulkpipe(udev, EP_REGS_OUT);
++ return usb_bulk_msg(udev, pipe, data, len, actual_length,
++ timeout);
++ }
++}
++
+ static int usb_int_regs_length(unsigned int count)
+ {
+ return sizeof(struct usb_int_regs) + count * sizeof(struct reg_data);
+@@ -1648,15 +1673,14 @@ int zd_usb_ioread16v(struct zd_usb *usb, u16 *values,
+
+ udev = zd_usb_to_usbdev(usb);
+ prepare_read_regs_int(usb);
+- r = usb_interrupt_msg(udev, usb_sndintpipe(udev, EP_REGS_OUT),
+- req, req_len, &actual_req_len, 50 /* ms */);
++ r = zd_ep_regs_out_msg(udev, req, req_len, &actual_req_len, 50 /*ms*/);
+ if (r) {
+ dev_dbg_f(zd_usb_dev(usb),
+- "error in usb_interrupt_msg(). Error number %d\n", r);
++ "error in zd_ep_regs_out_msg(). Error number %d\n", r);
+ goto error;
+ }
+ if (req_len != actual_req_len) {
+- dev_dbg_f(zd_usb_dev(usb), "error in usb_interrupt_msg()\n"
++ dev_dbg_f(zd_usb_dev(usb), "error in zd_ep_regs_out_msg()\n"
+ " req_len %d != actual_req_len %d\n",
+ req_len, actual_req_len);
+ r = -EIO;
+@@ -1818,9 +1842,17 @@ int zd_usb_iowrite16v_async(struct zd_usb *usb, const struct zd_ioreq16 *ioreqs,
+ rw->value = cpu_to_le16(ioreqs[i].value);
+ }
+
+- usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT),
+- req, req_len, iowrite16v_urb_complete, usb,
+- ep->desc.bInterval);
++ /* In USB 2.0 mode endpoint is interrupt type. However in USB 1.1 mode
++ * endpoint is bulk. Select correct type URB by endpoint descriptor.
++ */
++ if (usb_endpoint_xfer_int(&ep->desc))
++ usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT),
++ req, req_len, iowrite16v_urb_complete, usb,
++ ep->desc.bInterval);
++ else
++ usb_fill_bulk_urb(urb, udev, usb_sndbulkpipe(udev, EP_REGS_OUT),
++ req, req_len, iowrite16v_urb_complete, usb);
++
+ urb->transfer_flags |= URB_FREE_BUFFER;
+
+ /* Submit previous URB */
+@@ -1924,15 +1956,14 @@ int zd_usb_rfwrite(struct zd_usb *usb, u32 value, u8 bits)
+ }
+
+ udev = zd_usb_to_usbdev(usb);
+- r = usb_interrupt_msg(udev, usb_sndintpipe(udev, EP_REGS_OUT),
+- req, req_len, &actual_req_len, 50 /* ms */);
++ r = zd_ep_regs_out_msg(udev, req, req_len, &actual_req_len, 50 /*ms*/);
+ if (r) {
+ dev_dbg_f(zd_usb_dev(usb),
+- "error in usb_interrupt_msg(). Error number %d\n", r);
++ "error in zd_ep_regs_out_msg(). Error number %d\n", r);
+ goto out;
+ }
+ if (req_len != actual_req_len) {
+- dev_dbg_f(zd_usb_dev(usb), "error in usb_interrupt_msg()"
++ dev_dbg_f(zd_usb_dev(usb), "error in zd_ep_regs_out_msg()"
+ " req_len %d != actual_req_len %d\n",
+ req_len, actual_req_len);
+ r = -EIO;
+diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
+index a3984f4..f34b5b2 100644
+--- a/drivers/oprofile/buffer_sync.c
++++ b/drivers/oprofile/buffer_sync.c
+@@ -141,6 +141,13 @@ static struct notifier_block module_load_nb = {
+ .notifier_call = module_load_notify,
+ };
+
++static void free_all_tasks(void)
++{
++ /* make sure we don't leak task structs */
++ process_task_mortuary();
++ process_task_mortuary();
++}
++
+ int sync_start(void)
+ {
+ int err;
+@@ -148,8 +155,6 @@ int sync_start(void)
+ if (!zalloc_cpumask_var(&marked_cpus, GFP_KERNEL))
+ return -ENOMEM;
+
+- mutex_lock(&buffer_mutex);
+-
+ err = task_handoff_register(&task_free_nb);
+ if (err)
+ goto out1;
+@@ -166,7 +171,6 @@ int sync_start(void)
+ start_cpu_work();
+
+ out:
+- mutex_unlock(&buffer_mutex);
+ return err;
+ out4:
+ profile_event_unregister(PROFILE_MUNMAP, &munmap_nb);
+@@ -174,6 +178,7 @@ out3:
+ profile_event_unregister(PROFILE_TASK_EXIT, &task_exit_nb);
+ out2:
+ task_handoff_unregister(&task_free_nb);
++ free_all_tasks();
+ out1:
+ free_cpumask_var(marked_cpus);
+ goto out;
+@@ -182,20 +187,16 @@ out1:
+
+ void sync_stop(void)
+ {
+- /* flush buffers */
+- mutex_lock(&buffer_mutex);
+ end_cpu_work();
+ unregister_module_notifier(&module_load_nb);
+ profile_event_unregister(PROFILE_MUNMAP, &munmap_nb);
+ profile_event_unregister(PROFILE_TASK_EXIT, &task_exit_nb);
+ task_handoff_unregister(&task_free_nb);
+- mutex_unlock(&buffer_mutex);
+- flush_cpu_work();
++ barrier(); /* do all of the above first */
+
+- /* make sure we don't leak task structs */
+- process_task_mortuary();
+- process_task_mortuary();
++ flush_cpu_work();
+
++ free_all_tasks();
+ free_cpumask_var(marked_cpus);
+ }
+
+diff --git a/drivers/pci/hotplug/pcihp_slot.c b/drivers/pci/hotplug/pcihp_slot.c
+index 80b461c..749fdf0 100644
+--- a/drivers/pci/hotplug/pcihp_slot.c
++++ b/drivers/pci/hotplug/pcihp_slot.c
+@@ -158,6 +158,47 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
+ */
+ }
+
++/* Program PCIE MaxPayload setting on device: ensure parent maxpayload <= device */
++static int pci_set_payload(struct pci_dev *dev)
++{
++ int pos, ppos;
++ u16 pctl, psz;
++ u16 dctl, dsz, dcap, dmax;
++ struct pci_dev *parent;
++
++ parent = dev->bus->self;
++ pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
++ if (!pos)
++ return 0;
++
++ /* Read Device MaxPayload capability and setting */
++ pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &dctl);
++ pci_read_config_word(dev, pos + PCI_EXP_DEVCAP, &dcap);
++ dsz = (dctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5;
++ dmax = (dcap & PCI_EXP_DEVCAP_PAYLOAD);
++
++ /* Read Parent MaxPayload setting */
++ ppos = pci_find_capability(parent, PCI_CAP_ID_EXP);
++ if (!ppos)
++ return 0;
++ pci_read_config_word(parent, ppos + PCI_EXP_DEVCTL, &pctl);
++ psz = (pctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5;
++
++ /* If parent payload > device max payload -> error
++ * If parent payload > device payload -> set speed
++ * If parent payload <= device payload -> do nothing
++ */
++ if (psz > dmax)
++ return -1;
++ else if (psz > dsz) {
++ dev_info(&dev->dev, "Setting MaxPayload to %d\n", 128 << psz);
++ pci_write_config_word(dev, pos + PCI_EXP_DEVCTL,
++ (dctl & ~PCI_EXP_DEVCTL_PAYLOAD) +
++ (psz << 5));
++ }
++ return 0;
++}
++
+ void pci_configure_slot(struct pci_dev *dev)
+ {
+ struct pci_dev *cdev;
+@@ -169,6 +210,10 @@ void pci_configure_slot(struct pci_dev *dev)
+ (dev->class >> 8) == PCI_CLASS_BRIDGE_PCI)))
+ return;
+
++ ret = pci_set_payload(dev);
++ if (ret)
++ dev_warn(&dev->dev, "could not set device max payload\n");
++
+ memset(&hpp, 0, sizeof(hpp));
+ ret = pci_get_hp_params(dev, &hpp);
+ if (ret)
+diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
+index d552d2c..5db70c7 100644
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -46,6 +46,8 @@
+ #define ROOT_SIZE VTD_PAGE_SIZE
+ #define CONTEXT_SIZE VTD_PAGE_SIZE
+
++#define IS_BRIDGE_HOST_DEVICE(pdev) \
++ ((pdev->class >> 8) == PCI_CLASS_BRIDGE_HOST)
+ #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
+ #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
+ #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
+@@ -1416,6 +1418,10 @@ static void domain_exit(struct dmar_domain *domain)
+ if (!domain)
+ return;
+
++ /* Flush any lazy unmaps that may reference this domain */
++ if (!intel_iommu_strict)
++ flush_unmaps_timeout(0);
++
+ domain_remove_dev_info(domain);
+ /* destroy iovas */
+ put_iova_domain(&domain->iovad);
+@@ -2105,10 +2111,10 @@ static int identity_mapping(struct pci_dev *pdev)
+ if (likely(!iommu_identity_mapping))
+ return 0;
+
++ info = pdev->dev.archdata.iommu;
++ if (info && info != DUMMY_DEVICE_DOMAIN_INFO)
++ return (info->domain == si_domain);
+
+- list_for_each_entry(info, &si_domain->devices, link)
+- if (info->dev == pdev)
+- return 1;
+ return 0;
+ }
+
+@@ -2186,8 +2192,19 @@ static int iommu_should_identity_map(struct pci_dev *pdev, int startup)
+ * Assume that they will -- if they turn out not to be, then we can
+ * take them out of the 1:1 domain later.
+ */
+- if (!startup)
+- return pdev->dma_mask > DMA_BIT_MASK(32);
++ if (!startup) {
++ /*
++ * If the device's dma_mask is less than the system's memory
++ * size then this is not a candidate for identity mapping.
++ */
++ u64 dma_mask = pdev->dma_mask;
++
++ if (pdev->dev.coherent_dma_mask &&
++ pdev->dev.coherent_dma_mask < dma_mask)
++ dma_mask = pdev->dev.coherent_dma_mask;
++
++ return dma_mask >= dma_get_required_mask(&pdev->dev);
++ }
+
+ return 1;
+ }
+@@ -2202,6 +2219,9 @@ static int __init iommu_prepare_static_identity_mapping(int hw)
+ return -EFAULT;
+
+ for_each_pci_dev(pdev) {
++ /* Skip Host/PCI Bridge devices */
++ if (IS_BRIDGE_HOST_DEVICE(pdev))
++ continue;
+ if (iommu_should_identity_map(pdev, 1)) {
+ printk(KERN_INFO "IOMMU: %s identity mapping for device %s\n",
+ hw ? "hardware" : "software", pci_name(pdev));
+@@ -2591,8 +2611,7 @@ static dma_addr_t __intel_map_single(struct device *hwdev, phys_addr_t paddr,
+ iommu = domain_get_iommu(domain);
+ size = aligned_nrpages(paddr, size);
+
+- iova = intel_alloc_iova(hwdev, domain, dma_to_mm_pfn(size),
+- pdev->dma_mask);
++ iova = intel_alloc_iova(hwdev, domain, dma_to_mm_pfn(size), dma_mask);
+ if (!iova)
+ goto error;
+
+@@ -3379,8 +3398,8 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain,
+ spin_lock_irqsave(&device_domain_lock, flags);
+ list_for_each_safe(entry, tmp, &domain->devices) {
+ info = list_entry(entry, struct device_domain_info, link);
+- /* No need to compare PCI domain; it has to be the same */
+- if (info->bus == pdev->bus->number &&
++ if (info->segment == pci_domain_nr(pdev->bus) &&
++ info->bus == pdev->bus->number &&
+ info->devfn == pdev->devfn) {
+ list_del(&info->link);
+ list_del(&info->global);
+@@ -3418,10 +3437,13 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain,
+ domain_update_iommu_cap(domain);
+ spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags);
+
+- spin_lock_irqsave(&iommu->lock, tmp_flags);
+- clear_bit(domain->id, iommu->domain_ids);
+- iommu->domains[domain->id] = NULL;
+- spin_unlock_irqrestore(&iommu->lock, tmp_flags);
++ if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
++ !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY)) {
++ spin_lock_irqsave(&iommu->lock, tmp_flags);
++ clear_bit(domain->id, iommu->domain_ids);
++ iommu->domains[domain->id] = NULL;
++ spin_unlock_irqrestore(&iommu->lock, tmp_flags);
++ }
+ }
+
+ spin_unlock_irqrestore(&device_domain_lock, flags);
+diff --git a/drivers/pci/iova.c b/drivers/pci/iova.c
+index 9606e59..c5c274a 100644
+--- a/drivers/pci/iova.c
++++ b/drivers/pci/iova.c
+@@ -63,8 +63,16 @@ __cached_rbnode_delete_update(struct iova_domain *iovad, struct iova *free)
+ curr = iovad->cached32_node;
+ cached_iova = container_of(curr, struct iova, node);
+
+- if (free->pfn_lo >= cached_iova->pfn_lo)
+- iovad->cached32_node = rb_next(&free->node);
++ if (free->pfn_lo >= cached_iova->pfn_lo) {
++ struct rb_node *node = rb_next(&free->node);
++ struct iova *iova = container_of(node, struct iova, node);
++
++ /* only cache if it's below 32bit pfn */
++ if (node && iova->pfn_lo < iovad->dma_32bit_pfn)
++ iovad->cached32_node = node;
++ else
++ iovad->cached32_node = NULL;
++ }
+ }
+
+ /* Computes the padding size required, to make the
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index 832a3fd7..c8c9842 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -1223,7 +1223,7 @@ static int asus_wmi_sysfs_init(struct platform_device *device)
+ /*
+ * Platform device
+ */
+-static int __init asus_wmi_platform_init(struct asus_wmi *asus)
++static int asus_wmi_platform_init(struct asus_wmi *asus)
+ {
+ int rv;
+
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index 58584dc..44e8ca3 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -297,7 +297,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
+ kfree(sdev);
+ goto out;
+ }
+-
++ blk_get_queue(sdev->request_queue);
+ sdev->request_queue->queuedata = sdev;
+ scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun);
+
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index e639125..e0bd3f7 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -322,6 +322,7 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
+ kfree(evt);
+ }
+
++ blk_put_queue(sdev->request_queue);
+ /* NULL queue means the device can't be used */
+ sdev->request_queue = NULL;
+
+diff --git a/drivers/staging/gma500/psb_fb.c b/drivers/staging/gma500/psb_fb.c
+index f67f53b..1b96199 100644
+--- a/drivers/staging/gma500/psb_fb.c
++++ b/drivers/staging/gma500/psb_fb.c
+@@ -489,6 +489,16 @@ static int psbfb_create(struct psb_fbdev *fbdev,
+ info->screen_size = size;
+ memset(info->screen_base, 0, size);
+
++ if (dev_priv->pg->stolen_size) {
++ info->apertures = alloc_apertures(1);
++ if (!info->apertures) {
++ ret = -ENOMEM;
++ goto out_err0;
++ }
++ info->apertures->ranges[0].base = dev->mode_config.fb_base;
++ info->apertures->ranges[0].size = dev_priv->pg->stolen_size;
++ }
++
+ drm_fb_helper_fill_fix(info, fb->pitch, fb->depth);
+ drm_fb_helper_fill_var(info, &fbdev->psb_fb_helper,
+ sizes->fb_width, sizes->fb_height);
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 733fe8e..d4bee1b 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -172,12 +172,16 @@ static int uart_startup(struct tty_struct *tty, struct uart_state *state, int in
+
+ retval = uport->ops->startup(uport);
+ if (retval == 0) {
+- if (init_hw) {
+- /*
+- * Initialise the hardware port settings.
+- */
+- uart_change_speed(tty, state, NULL);
++ if (uart_console(uport) && uport->cons->cflag) {
++ tty->termios->c_cflag = uport->cons->cflag;
++ uport->cons->cflag = 0;
++ }
++ /*
++ * Initialise the hardware port settings.
++ */
++ uart_change_speed(tty, state, NULL);
+
++ if (init_hw) {
+ /*
+ * Setup the RTS and DTR signals once the
+ * port is open and ready to respond.
+@@ -1466,45 +1470,6 @@ static void uart_hangup(struct tty_struct *tty)
+ mutex_unlock(&port->mutex);
+ }
+
+-/**
+- * uart_update_termios - update the terminal hw settings
+- * @tty: tty associated with UART
+- * @state: UART to update
+- *
+- * Copy across the serial console cflag setting into the termios settings
+- * for the initial open of the port. This allows continuity between the
+- * kernel settings, and the settings init adopts when it opens the port
+- * for the first time.
+- */
+-static void uart_update_termios(struct tty_struct *tty,
+- struct uart_state *state)
+-{
+- struct uart_port *port = state->uart_port;
+-
+- if (uart_console(port) && port->cons->cflag) {
+- tty->termios->c_cflag = port->cons->cflag;
+- port->cons->cflag = 0;
+- }
+-
+- /*
+- * If the device failed to grab its irq resources,
+- * or some other error occurred, don't try to talk
+- * to the port hardware.
+- */
+- if (!(tty->flags & (1 << TTY_IO_ERROR))) {
+- /*
+- * Make termios settings take effect.
+- */
+- uart_change_speed(tty, state, NULL);
+-
+- /*
+- * And finally enable the RTS and DTR signals.
+- */
+- if (tty->termios->c_cflag & CBAUD)
+- uart_set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
+- }
+-}
+-
+ static int uart_carrier_raised(struct tty_port *port)
+ {
+ struct uart_state *state = container_of(port, struct uart_state, port);
+@@ -1524,16 +1489,8 @@ static void uart_dtr_rts(struct tty_port *port, int onoff)
+ struct uart_state *state = container_of(port, struct uart_state, port);
+ struct uart_port *uport = state->uart_port;
+
+- if (onoff) {
++ if (onoff)
+ uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
+-
+- /*
+- * If this is the first open to succeed,
+- * adjust things to suit.
+- */
+- if (!test_and_set_bit(ASYNCB_NORMAL_ACTIVE, &port->flags))
+- uart_update_termios(port->tty, state);
+- }
+ else
+ uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
+ }
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index caa2535..d0b84ff 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1617,6 +1617,8 @@ static const struct usb_device_id acm_ids[] = {
+ { NOKIA_PCSUITE_ACM_INFO(0x04ce), }, /* Nokia E90 */
+ { NOKIA_PCSUITE_ACM_INFO(0x01d4), }, /* Nokia E55 */
+ { NOKIA_PCSUITE_ACM_INFO(0x0302), }, /* Nokia N8 */
++ { NOKIA_PCSUITE_ACM_INFO(0x0335), }, /* Nokia E7 */
++ { NOKIA_PCSUITE_ACM_INFO(0x03cd), }, /* Nokia C7 */
+ { SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */
+
+ /* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 93720bd..78e7f25 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -339,7 +339,8 @@ static int get_hub_status(struct usb_device *hdev,
+ {
+ int i, status = -ETIMEDOUT;
+
+- for (i = 0; i < USB_STS_RETRIES && status == -ETIMEDOUT; i++) {
++ for (i = 0; i < USB_STS_RETRIES &&
++ (status == -ETIMEDOUT || status == -EPIPE); i++) {
+ status = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
+ USB_REQ_GET_STATUS, USB_DIR_IN | USB_RT_HUB, 0, 0,
+ data, sizeof(*data), USB_STS_TIMEOUT);
+@@ -355,7 +356,8 @@ static int get_port_status(struct usb_device *hdev, int port1,
+ {
+ int i, status = -ETIMEDOUT;
+
+- for (i = 0; i < USB_STS_RETRIES && status == -ETIMEDOUT; i++) {
++ for (i = 0; i < USB_STS_RETRIES &&
++ (status == -ETIMEDOUT || status == -EPIPE); i++) {
+ status = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
+ USB_REQ_GET_STATUS, USB_DIR_IN | USB_RT_PORT, 0, port1,
+ data, sizeof(*data), USB_STS_TIMEOUT);
+diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c
+index 0231814..ff00bd8 100644
+--- a/drivers/usb/host/xhci-dbg.c
++++ b/drivers/usb/host/xhci-dbg.c
+@@ -437,13 +437,13 @@ char *xhci_get_slot_state(struct xhci_hcd *xhci,
+ struct xhci_slot_ctx *slot_ctx = xhci_get_slot_ctx(xhci, ctx);
+
+ switch (GET_SLOT_STATE(slot_ctx->dev_state)) {
+- case 0:
++ case SLOT_STATE_ENABLED:
+ return "enabled/disabled";
+- case 1:
++ case SLOT_STATE_DEFAULT:
+ return "default";
+- case 2:
++ case SLOT_STATE_ADDRESSED:
+ return "addressed";
+- case 3:
++ case SLOT_STATE_CONFIGURED:
+ return "configured";
+ default:
+ return "reserved";
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 783e5e0..976422a 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -986,9 +986,19 @@ static unsigned int xhci_parse_exponent_interval(struct usb_device *udev,
+ interval = clamp_val(ep->desc.bInterval, 1, 16) - 1;
+ if (interval != ep->desc.bInterval - 1)
+ dev_warn(&udev->dev,
+- "ep %#x - rounding interval to %d microframes\n",
++ "ep %#x - rounding interval to %d %sframes\n",
+ ep->desc.bEndpointAddress,
+- 1 << interval);
++ 1 << interval,
++ udev->speed == USB_SPEED_FULL ? "" : "micro");
++
++ if (udev->speed == USB_SPEED_FULL) {
++ /*
++ * Full speed isoc endpoints specify interval in frames,
++ * not microframes. We are using microframes everywhere,
++ * so adjust accordingly.
++ */
++ interval += 3; /* 1 frame = 2^3 uframes */
++ }
+
+ return interval;
+ }
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index a10494c..4940717 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -105,12 +105,22 @@ static int xhci_pci_setup(struct usb_hcd *hcd)
+
+ /* Look for vendor-specific quirks */
+ if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC &&
+- pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK &&
+- pdev->revision == 0x0) {
++ pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK) {
++ if (pdev->revision == 0x0) {
+ xhci->quirks |= XHCI_RESET_EP_QUIRK;
+ xhci_dbg(xhci, "QUIRK: Fresco Logic xHC needs configure"
+ " endpoint cmd after reset endpoint\n");
++ }
++ /* Fresco Logic confirms: all revisions of this chip do not
++ * support MSI, even though some of them claim to in their PCI
++ * capabilities.
++ */
++ xhci->quirks |= XHCI_BROKEN_MSI;
++ xhci_dbg(xhci, "QUIRK: Fresco Logic revision %u "
++ "has broken MSI implementation\n",
++ pdev->revision);
+ }
++
+ if (pdev->vendor == PCI_VENDOR_ID_NEC)
+ xhci->quirks |= XHCI_NEC_HOST;
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index d2cd3ce..e5c4861 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -430,12 +430,19 @@ int xhci_run(struct usb_hcd *hcd)
+ free_irq(hcd->irq, hcd);
+ hcd->irq = -1;
+
++ /* Some Fresco Logic host controllers advertise MSI, but fail to
++ * generate interrupts. Don't even try to enable MSI.
++ */
++ if (xhci->quirks & XHCI_BROKEN_MSI)
++ goto legacy_irq;
++
+ ret = xhci_setup_msix(xhci);
+ if (ret)
+ /* fall back to msi*/
+ ret = xhci_setup_msi(xhci);
+
+ if (ret) {
++legacy_irq:
+ /* fall back to legacy interrupt*/
+ ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
+ hcd->irq_descr, hcd);
+@@ -2284,6 +2291,7 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
+ struct xhci_command *reset_device_cmd;
+ int timeleft;
+ int last_freed_endpoint;
++ struct xhci_slot_ctx *slot_ctx;
+
+ ret = xhci_check_args(hcd, udev, NULL, 0, false, __func__);
+ if (ret <= 0)
+@@ -2316,6 +2324,12 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
+ return -EINVAL;
+ }
+
++ /* If device is not setup, there is no point in resetting it */
++ slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx);
++ if (GET_SLOT_STATE(le32_to_cpu(slot_ctx->dev_state)) ==
++ SLOT_STATE_DISABLED)
++ return 0;
++
+ xhci_dbg(xhci, "Resetting device with slot ID %u\n", slot_id);
+ /* Allocate the command structure that holds the struct completion.
+ * Assume we're in process context, since the normal device reset
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index ba1be6b..fb85ce3 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -560,6 +560,11 @@ struct xhci_slot_ctx {
+ #define SLOT_STATE (0x1f << 27)
+ #define GET_SLOT_STATE(p) (((p) & (0x1f << 27)) >> 27)
+
++#define SLOT_STATE_DISABLED 0
++#define SLOT_STATE_ENABLED SLOT_STATE_DISABLED
++#define SLOT_STATE_DEFAULT 1
++#define SLOT_STATE_ADDRESSED 2
++#define SLOT_STATE_CONFIGURED 3
+
+ /**
+ * struct xhci_ep_ctx
+@@ -1281,6 +1286,7 @@ struct xhci_hcd {
+ #define XHCI_RESET_EP_QUIRK (1 << 1)
+ #define XHCI_NEC_HOST (1 << 2)
+ #define XHCI_AMD_PLL_FIX (1 << 3)
++#define XHCI_BROKEN_MSI (1 << 6)
+ /* There are two roothubs to keep track of bus suspend info for */
+ struct xhci_bus_state bus_state[2];
+ /* Is each xHCI roothub port a USB 3.0, USB 2.0, or USB 1.1 port? */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index e8dbde5..1627289 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -647,6 +647,7 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, EVER_ECO_PRO_CDS) },
+ { USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_1_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_2_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_3_PID) },
+ { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_0_PID) },
+ { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_1_PID) },
+ { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_2_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 1d946cd..ab1fcdf 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -351,6 +351,7 @@
+ */
+ #define FTDI_4N_GALAXY_DE_1_PID 0xF3C0
+ #define FTDI_4N_GALAXY_DE_2_PID 0xF3C1
++#define FTDI_4N_GALAXY_DE_3_PID 0xF3C2
+
+ /*
+ * Linx Technologies product ids
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 318dd00..60b25d8 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -311,10 +311,6 @@ static void option_instat_callback(struct urb *urb);
+ #define ZTE_PRODUCT_AC2726 0xfff5
+ #define ZTE_PRODUCT_AC8710T 0xffff
+
+-/* ZTE PRODUCTS -- alternate vendor ID */
+-#define ZTE_VENDOR_ID2 0x1d6b
+-#define ZTE_PRODUCT_MF_330 0x0002
+-
+ #define BENQ_VENDOR_ID 0x04a5
+ #define BENQ_PRODUCT_H10 0x4068
+
+@@ -340,11 +336,12 @@ static void option_instat_callback(struct urb *urb);
+ #define TOSHIBA_PRODUCT_G450 0x0d45
+
+ #define ALINK_VENDOR_ID 0x1e0e
++#define ALINK_PRODUCT_PH300 0x9100
+ #define ALINK_PRODUCT_3GU 0x9200
+
+ /* ALCATEL PRODUCTS */
+ #define ALCATEL_VENDOR_ID 0x1bbb
+-#define ALCATEL_PRODUCT_X060S 0x0000
++#define ALCATEL_PRODUCT_X060S_X200 0x0000
+
+ #define PIRELLI_VENDOR_ID 0x1266
+ #define PIRELLI_PRODUCT_C100_1 0x1002
+@@ -379,6 +376,9 @@ static void option_instat_callback(struct urb *urb);
+ * It seems to contain a Qualcomm QSC6240/6290 chipset */
+ #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603
+
++/* Zoom */
++#define ZOOM_PRODUCT_4597 0x9607
++
+ /* Haier products */
+ #define HAIER_VENDOR_ID 0x201e
+ #define HAIER_PRODUCT_CE100 0x2009
+@@ -432,6 +432,20 @@ static const struct option_blacklist_info four_g_w14_blacklist = {
+ .reason = OPTION_BLACKLIST_SENDSETUP
+ };
+
++static const u8 alcatel_x200_no_sendsetup[] = { 0, 1 };
++static const struct option_blacklist_info alcatel_x200_blacklist = {
++ .infolen = ARRAY_SIZE(alcatel_x200_no_sendsetup),
++ .ifaceinfo = alcatel_x200_no_sendsetup,
++ .reason = OPTION_BLACKLIST_SENDSETUP
++};
++
++static const u8 zte_k3765_z_no_sendsetup[] = { 0, 1, 2 };
++static const struct option_blacklist_info zte_k3765_z_blacklist = {
++ .infolen = ARRAY_SIZE(zte_k3765_z_no_sendsetup),
++ .ifaceinfo = zte_k3765_z_no_sendsetup,
++ .reason = OPTION_BLACKLIST_SENDSETUP
++};
++
+ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
+@@ -916,13 +930,13 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
++ 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) },
+- { USB_DEVICE(ZTE_VENDOR_ID2, ZTE_PRODUCT_MF_330) },
+ { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
+ { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
+ { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
+@@ -935,13 +949,17 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) },
+ { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */
+ { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
++ { USB_DEVICE(ALINK_VENDOR_ID, ALINK_PRODUCT_PH300) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
+- { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) },
++ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
++ .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist
++ },
+ { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+ { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
+ .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
+ },
++ { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
+ { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
+ /* Pirelli */
+ { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1)},
+diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
+index 0041899..e8ae21b 100644
+--- a/drivers/usb/storage/transport.c
++++ b/drivers/usb/storage/transport.c
+@@ -819,6 +819,35 @@ Retry_Sense:
+ }
+ }
+
++ /*
++ * Some devices don't work or return incorrect data the first
++ * time they get a READ(10) command, or for the first READ(10)
++ * after a media change. If the INITIAL_READ10 flag is set,
++ * keep track of whether READ(10) commands succeed. If the
++ * previous one succeeded and this one failed, set the REDO_READ10
++ * flag to force a retry.
++ */
++ if (unlikely((us->fflags & US_FL_INITIAL_READ10) &&
++ srb->cmnd[0] == READ_10)) {
++ if (srb->result == SAM_STAT_GOOD) {
++ set_bit(US_FLIDX_READ10_WORKED, &us->dflags);
++ } else if (test_bit(US_FLIDX_READ10_WORKED, &us->dflags)) {
++ clear_bit(US_FLIDX_READ10_WORKED, &us->dflags);
++ set_bit(US_FLIDX_REDO_READ10, &us->dflags);
++ }
++
++ /*
++ * Next, if the REDO_READ10 flag is set, return a result
++ * code that will cause the SCSI core to retry the READ(10)
++ * command immediately.
++ */
++ if (test_bit(US_FLIDX_REDO_READ10, &us->dflags)) {
++ clear_bit(US_FLIDX_REDO_READ10, &us->dflags);
++ srb->result = DID_IMM_RETRY << 16;
++ srb->sense_buffer[0] = 0;
++ }
++ }
++
+ /* Did we transfer less than the minimum amount required? */
+ if ((srb->result == SAM_STAT_GOOD || srb->sense_buffer[2] == 0) &&
+ scsi_bufflen(srb) - scsi_get_resid(srb) < srb->underflow)
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index c1602b8..ccff348 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1114,6 +1114,16 @@ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_FIX_CAPACITY ),
+
++/* Reported by Paul Hartman <paul.hartman+linux at gmail.com>
++ * This card reader returns "Illegal Request, Logical Block Address
++ * Out of Range" for the first READ(10) after a new card is inserted.
++ */
++UNUSUAL_DEV( 0x090c, 0x6000, 0x0100, 0x0100,
++ "Feiya",
++ "SD/SDHC Card Reader",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_INITIAL_READ10 ),
++
+ /* This Pentax still camera is not conformant
+ * to the USB storage specification: -
+ * - It does not like the INQUIRY command. So we must handle this command
+@@ -1888,6 +1898,15 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_READ_DISC_INFO ),
+
++/* Reported by Sven Geggus <sven-usbst at geggus.net>
++ * This encrypted pen drive returns bogus data for the initial READ(10).
++ */
++UNUSUAL_DEV( 0x1b1c, 0x1ab5, 0x0200, 0x0200,
++ "Corsair",
++ "Padlock v2",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_INITIAL_READ10 ),
++
+ /* Patch by Richard Schütz <r.schtz at t-online.de>
+ * This external hard drive enclosure uses a JMicron chip which
+ * needs the US_FL_IGNORE_RESIDUE flag to work properly. */
+diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
+index 4219c19..07d6d73 100644
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -439,7 +439,8 @@ static void adjust_quirks(struct us_data *us)
+ US_FL_CAPACITY_HEURISTICS | US_FL_IGNORE_DEVICE |
+ US_FL_NOT_LOCKABLE | US_FL_MAX_SECTORS_64 |
+ US_FL_CAPACITY_OK | US_FL_IGNORE_RESIDUE |
+- US_FL_SINGLE_LUN | US_FL_NO_WP_DETECT);
++ US_FL_SINGLE_LUN | US_FL_NO_WP_DETECT |
++ US_FL_INITIAL_READ10);
+
+ p = quirks;
+ while (*p) {
+@@ -483,6 +484,9 @@ static void adjust_quirks(struct us_data *us)
+ case 'm':
+ f |= US_FL_MAX_SECTORS_64;
+ break;
++ case 'n':
++ f |= US_FL_INITIAL_READ10;
++ break;
+ case 'o':
+ f |= US_FL_CAPACITY_OK;
+ break;
+@@ -946,6 +950,13 @@ int usb_stor_probe2(struct us_data *us)
+ if (result)
+ goto BadDevice;
+
++ /*
++ * If the device returns invalid data for the first READ(10)
++ * command, indicate the command should be retried.
++ */
++ if (us->fflags & US_FL_INITIAL_READ10)
++ set_bit(US_FLIDX_REDO_READ10, &us->dflags);
++
+ /* Acquire all the other resources and add the host */
+ result = usb_stor_acquire_resources(us);
+ if (result)
+diff --git a/drivers/usb/storage/usb.h b/drivers/usb/storage/usb.h
+index 89d3bff..7b0f211 100644
+--- a/drivers/usb/storage/usb.h
++++ b/drivers/usb/storage/usb.h
+@@ -73,6 +73,8 @@ struct us_unusual_dev {
+ #define US_FLIDX_RESETTING 4 /* device reset in progress */
+ #define US_FLIDX_TIMED_OUT 5 /* SCSI midlayer timed out */
+ #define US_FLIDX_DONT_SCAN 6 /* don't scan (disconnect) */
++#define US_FLIDX_REDO_READ10 7 /* redo READ(10) command */
++#define US_FLIDX_READ10_WORKED 8 /* previous READ(10) succeeded */
+
+ #define USB_STOR_STRING_LEN 32
+
+diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c
+index 53b2c5a..305c975 100644
+--- a/drivers/video/vga16fb.c
++++ b/drivers/video/vga16fb.c
+@@ -1265,9 +1265,11 @@ static void vga16fb_imageblit(struct fb_info *info, const struct fb_image *image
+
+ static void vga16fb_destroy(struct fb_info *info)
+ {
++ struct platform_device *dev = container_of(info->device, struct platform_device, dev);
+ iounmap(info->screen_base);
+ fb_dealloc_cmap(&info->cmap);
+ /* XXX unshare VGA regions */
++ platform_set_drvdata(dev, NULL);
+ framebuffer_release(info);
+ }
+
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 1f2b199..1a2421f 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1272,8 +1272,8 @@ int blkdev_get(struct block_device *bdev, fmode_t mode, void *holder)
+ * individual writeable reference is too fragile given the
+ * way @mode is used in blkdev_get/put().
+ */
+- if ((disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE) &&
+- !res && (mode & FMODE_WRITE) && !bdev->bd_write_holder) {
++ if (!res && (mode & FMODE_WRITE) && !bdev->bd_write_holder &&
++ (disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE)) {
+ bdev->bd_write_holder = true;
+ disk_block_events(disk);
+ }
+diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
+index d1a016b..ba3d95b 100644
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -184,7 +184,7 @@ int cifs_verify_signature(struct smb_hdr *cifs_pdu,
+ if (cifs_pdu == NULL || server == NULL)
+ return -EINVAL;
+
+- if (cifs_pdu->Command == SMB_COM_NEGOTIATE)
++ if (!server->session_estab)
+ return 0;
+
+ if (cifs_pdu->Command == SMB_COM_LOCKING_ANDX) {
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 29fac128..5236582 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -199,7 +199,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ }
+ spin_unlock(&GlobalMid_Lock);
+
+- while (server->tcpStatus == CifsNeedReconnect) {
++ do {
+ try_to_freeze();
+
+ /* we should try only the port we connected to before */
+@@ -214,7 +214,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ server->tcpStatus = CifsNeedNegotiate;
+ spin_unlock(&GlobalMid_Lock);
+ }
+- }
++ } while (server->tcpStatus == CifsNeedReconnect);
+
+ return rc;
+ }
+@@ -3208,7 +3208,7 @@ int cifs_negotiate_protocol(unsigned int xid, struct cifsSesInfo *ses)
+ }
+ if (rc == 0) {
+ spin_lock(&GlobalMid_Lock);
+- if (server->tcpStatus != CifsExiting)
++ if (server->tcpStatus == CifsNeedNegotiate)
+ server->tcpStatus = CifsGood;
+ else
+ rc = -EHOSTDOWN;
+diff --git a/fs/dcookies.c b/fs/dcookies.c
+index a21cabd..dda0dc7 100644
+--- a/fs/dcookies.c
++++ b/fs/dcookies.c
+@@ -178,6 +178,8 @@ SYSCALL_DEFINE(lookup_dcookie)(u64 cookie64, char __user * buf, size_t len)
+ /* FIXME: (deleted) ? */
+ path = d_path(&dcs->path, kbuf, PAGE_SIZE);
+
++ mutex_unlock(&dcookie_mutex);
++
+ if (IS_ERR(path)) {
+ err = PTR_ERR(path);
+ goto out_free;
+@@ -194,6 +196,7 @@ SYSCALL_DEFINE(lookup_dcookie)(u64 cookie64, char __user * buf, size_t len)
+
+ out_free:
+ kfree(kbuf);
++ return err;
+ out:
+ mutex_unlock(&dcookie_mutex);
+ return err;
+diff --git a/fs/exec.c b/fs/exec.c
+index 5e62d26..0c3682d 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1046,6 +1046,7 @@ int flush_old_exec(struct linux_binprm * bprm)
+
+ bprm->mm = NULL; /* We're using it now */
+
++ set_fs(USER_DS);
+ current->flags &= ~(PF_RANDOMIZE | PF_KTHREAD);
+ flush_thread();
+ current->personality &= ~bprm->per_clear;
+@@ -1310,10 +1311,6 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+ if (retval)
+ return retval;
+
+- /* kernel module loader fixup */
+- /* so we don't try to load run modprobe in kernel space. */
+- set_fs(USER_DS);
+-
+ retval = audit_bprm(bprm);
+ if (retval)
+ return retval;
+diff --git a/fs/fat/file.c b/fs/fat/file.c
+index 7257752..7018e1d 100644
+--- a/fs/fat/file.c
++++ b/fs/fat/file.c
+@@ -102,7 +102,7 @@ static int fat_ioctl_set_attributes(struct file *file, u32 __user *user_attr)
+ if (attr & ATTR_SYS)
+ inode->i_flags |= S_IMMUTABLE;
+ else
+- inode->i_flags &= S_IMMUTABLE;
++ inode->i_flags &= ~S_IMMUTABLE;
+ }
+
+ fat_save_attrs(inode, attr);
+diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
+index aed25e8..e5cb2ce 100644
+--- a/fs/ubifs/journal.c
++++ b/fs/ubifs/journal.c
+@@ -666,6 +666,7 @@ out_free:
+
+ out_release:
+ release_head(c, BASEHD);
++ kfree(dent);
+ out_ro:
+ ubifs_ro_mode(c, err);
+ if (last_reference)
+diff --git a/fs/ubifs/shrinker.c b/fs/ubifs/shrinker.c
+index 46961c0..d8f5d0f 100644
+--- a/fs/ubifs/shrinker.c
++++ b/fs/ubifs/shrinker.c
+@@ -283,7 +283,11 @@ int ubifs_shrinker(struct shrinker *shrink, int nr, gfp_t gfp_mask)
+ long clean_zn_cnt = atomic_long_read(&ubifs_clean_zn_cnt);
+
+ if (nr == 0)
+- return clean_zn_cnt;
++ /*
++ * Due to the way UBIFS updates the clean znode counter it may
++ * temporarily be negative.
++ */
++ return clean_zn_cnt >= 0 ? clean_zn_cnt : 1;
+
+ if (!clean_zn_cnt) {
+ /*
+diff --git a/include/linux/efi.h b/include/linux/efi.h
+index e376270..33fa120 100644
+--- a/include/linux/efi.h
++++ b/include/linux/efi.h
+@@ -299,7 +299,6 @@ extern void efi_initialize_iomem_resources(struct resource *code_resource,
+ struct resource *data_resource, struct resource *bss_resource);
+ extern unsigned long efi_get_time(void);
+ extern int efi_set_rtc_mmss(unsigned long nowtime);
+-extern void efi_reserve_boot_services(void);
+ extern struct efi_memory_map memmap;
+
+ /**
+diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
+index 71693d4..17df360 100644
+--- a/include/linux/usb_usual.h
++++ b/include/linux/usb_usual.h
+@@ -62,7 +62,9 @@
+ US_FLAG(NO_READ_DISC_INFO, 0x00040000) \
+ /* cannot handle READ_DISC_INFO */ \
+ US_FLAG(NO_READ_CAPACITY_16, 0x00080000) \
+- /* cannot handle READ_CAPACITY_16 */
++ /* cannot handle READ_CAPACITY_16 */ \
++ US_FLAG(INITIAL_READ10, 0x00100000) \
++ /* Initial READ(10) (and others) must be retried */
+
+ #define US_FLAG(name, value) US_FL_##name = value ,
+ enum { US_DO_ALL_FLAGS };
+diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
+index 2c039c9..51e4944 100644
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -257,13 +257,11 @@ int __init early_irq_init(void)
+ count = ARRAY_SIZE(irq_desc);
+
+ for (i = 0; i < count; i++) {
+- desc[i].irq_data.irq = i;
+- desc[i].irq_data.chip = &no_irq_chip;
+ desc[i].kstat_irqs = alloc_percpu(unsigned int);
+- irq_settings_clr_and_set(desc, ~0, _IRQ_DEFAULT_INIT_FLAGS);
+- alloc_masks(desc + i, GFP_KERNEL, node);
+- desc_smp_init(desc + i, node);
++ alloc_masks(&desc[i], GFP_KERNEL, node);
++ raw_spin_lock_init(&desc[i].lock);
+ lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
++ desc_set_defaults(i, &desc[i], node);
+ }
+ return arch_early_irq_init();
+ }
+diff --git a/kernel/lockdep.c b/kernel/lockdep.c
+index 53a6895..49452a7 100644
+--- a/kernel/lockdep.c
++++ b/kernel/lockdep.c
+@@ -3242,7 +3242,7 @@ int lock_is_held(struct lockdep_map *lock)
+ int ret = 0;
+
+ if (unlikely(current->lockdep_recursion))
+- return ret;
++ return 1; /* avoid false negative lockdep_assert_held() */
+
+ raw_local_irq_save(flags);
+ check_flags(flags);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 8ee3bd8..39f86fc 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1033,10 +1033,10 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma,
+ */
+ chg = vma_needs_reservation(h, vma, addr);
+ if (chg < 0)
+- return ERR_PTR(chg);
++ return ERR_PTR(-VM_FAULT_OOM);
+ if (chg)
+ if (hugetlb_get_quota(inode->i_mapping, chg))
+- return ERR_PTR(-ENOSPC);
++ return ERR_PTR(-VM_FAULT_SIGBUS);
+
+ spin_lock(&hugetlb_lock);
+ page = dequeue_huge_page_vma(h, vma, addr, avoid_reserve);
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index 3e81af1..821590d 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -967,6 +967,10 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
+
+ mutex_lock(&sdata->u.ibss.mtx);
+
++ sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
++ memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
++ sdata->u.ibss.ssid_len = 0;
++
+ active_ibss = ieee80211_sta_active_ibss(sdata);
+
+ if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
+@@ -1000,8 +1004,6 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
+ kfree_skb(skb);
+
+ skb_queue_purge(&sdata->skb_queue);
+- memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
+- sdata->u.ibss.ssid_len = 0;
+
+ del_timer_sync(&sdata->u.ibss.timer);
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 2c70a1e..29a1ce1 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3239,12 +3239,12 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
+ i = 0;
+ if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
+ nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
++ request->ssids[i].ssid_len = nla_len(attr);
+ if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
+ err = -EINVAL;
+ goto out_free;
+ }
+ memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
+- request->ssids[i].ssid_len = nla_len(attr);
+ i++;
+ }
+ }
+diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
+index ec1bcec..3d2fd14 100644
+--- a/security/apparmor/lsm.c
++++ b/security/apparmor/lsm.c
+@@ -612,7 +612,7 @@ static int apparmor_setprocattr(struct task_struct *task, char *name,
+ static int apparmor_task_setrlimit(struct task_struct *task,
+ unsigned int resource, struct rlimit *new_rlim)
+ {
+- struct aa_profile *profile = aa_current_profile();
++ struct aa_profile *profile = __aa_current_profile();
+ int error = 0;
+
+ if (!unconfined(profile))
+diff --git a/security/tomoyo/mount.c b/security/tomoyo/mount.c
+index 82bf8c2..afa07cf 100644
+--- a/security/tomoyo/mount.c
++++ b/security/tomoyo/mount.c
+@@ -138,7 +138,7 @@ static int tomoyo_mount_acl(struct tomoyo_request_info *r, char *dev_name,
+ }
+ if (need_dev) {
+ /* Get mount point or device file. */
+- if (kern_path(dev_name, LOOKUP_FOLLOW, &path)) {
++ if (!dev_name || kern_path(dev_name, LOOKUP_FOLLOW, &path)) {
+ error = -ENOENT;
+ goto out;
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index c82979a..2e95f01 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -13804,6 +13804,7 @@ static struct snd_pci_quirk alc268_cfg_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x015b, "Acer Aspire One",
+ ALC268_ACER_ASPIRE_ONE),
+ SND_PCI_QUIRK(0x1028, 0x0253, "Dell OEM", ALC268_DELL),
++ SND_PCI_QUIRK(0x1028, 0x02b0, "Dell Inspiron 910", ALC268_AUTO),
+ SND_PCI_QUIRK_MASK(0x1028, 0xfff0, 0x02b0,
+ "Dell Inspiron Mini9/Vostro A90", ALC268_DELL),
+ /* almost compatible with toshiba but with optional digital outs;
+diff --git a/sound/soc/codecs/ad1836.c b/sound/soc/codecs/ad1836.c
+index ab63d52..754c496 100644
+--- a/sound/soc/codecs/ad1836.c
++++ b/sound/soc/codecs/ad1836.c
+@@ -145,22 +145,22 @@ static int ad1836_hw_params(struct snd_pcm_substream *substream,
+ /* bit size */
+ switch (params_format(params)) {
+ case SNDRV_PCM_FORMAT_S16_LE:
+- word_len = 3;
++ word_len = AD1836_WORD_LEN_16;
+ break;
+ case SNDRV_PCM_FORMAT_S20_3LE:
+- word_len = 1;
++ word_len = AD1836_WORD_LEN_20;
+ break;
+ case SNDRV_PCM_FORMAT_S24_LE:
+ case SNDRV_PCM_FORMAT_S32_LE:
+- word_len = 0;
++ word_len = AD1836_WORD_LEN_24;
+ break;
+ }
+
+- snd_soc_update_bits(codec, AD1836_DAC_CTRL1,
+- AD1836_DAC_WORD_LEN_MASK, word_len);
++ snd_soc_update_bits(codec, AD1836_DAC_CTRL1, AD1836_DAC_WORD_LEN_MASK,
++ word_len << AD1836_DAC_WORD_LEN_OFFSET);
+
+- snd_soc_update_bits(codec, AD1836_ADC_CTRL2,
+- AD1836_ADC_WORD_LEN_MASK, word_len);
++ snd_soc_update_bits(codec, AD1836_ADC_CTRL2, AD1836_ADC_WORD_LEN_MASK,
++ word_len << AD1836_ADC_WORD_OFFSET);
+
+ return 0;
+ }
+diff --git a/sound/soc/codecs/ad1836.h b/sound/soc/codecs/ad1836.h
+index 8455967..9d6a3f8 100644
+--- a/sound/soc/codecs/ad1836.h
++++ b/sound/soc/codecs/ad1836.h
+@@ -25,6 +25,7 @@
+ #define AD1836_DAC_SERFMT_PCK256 (0x4 << 5)
+ #define AD1836_DAC_SERFMT_PCK128 (0x5 << 5)
+ #define AD1836_DAC_WORD_LEN_MASK 0x18
++#define AD1836_DAC_WORD_LEN_OFFSET 3
+
+ #define AD1836_DAC_CTRL2 1
+ #define AD1836_DACL1_MUTE 0
+@@ -51,6 +52,7 @@
+ #define AD1836_ADCL2_MUTE 2
+ #define AD1836_ADCR2_MUTE 3
+ #define AD1836_ADC_WORD_LEN_MASK 0x30
++#define AD1836_ADC_WORD_OFFSET 5
+ #define AD1836_ADC_SERFMT_MASK (7 << 6)
+ #define AD1836_ADC_SERFMT_PCK256 (0x4 << 6)
+ #define AD1836_ADC_SERFMT_PCK128 (0x5 << 6)
+@@ -60,4 +62,8 @@
+
+ #define AD1836_NUM_REGS 16
+
++#define AD1836_WORD_LEN_24 0x0
++#define AD1836_WORD_LEN_20 0x1
++#define AD1836_WORD_LEN_16 0x2
++
+ #endif
+diff --git a/sound/soc/codecs/wm8804.c b/sound/soc/codecs/wm8804.c
+index 6785688..9a5e67c 100644
+--- a/sound/soc/codecs/wm8804.c
++++ b/sound/soc/codecs/wm8804.c
+@@ -680,20 +680,25 @@ static struct snd_soc_dai_ops wm8804_dai_ops = {
+ #define WM8804_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE | \
+ SNDRV_PCM_FMTBIT_S24_LE)
+
++#define WM8804_RATES (SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_44100 | \
++ SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_64000 | \
++ SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000 | \
++ SNDRV_PCM_RATE_176400 | SNDRV_PCM_RATE_192000)
++
+ static struct snd_soc_dai_driver wm8804_dai = {
+ .name = "wm8804-spdif",
+ .playback = {
+ .stream_name = "Playback",
+ .channels_min = 2,
+ .channels_max = 2,
+- .rates = SNDRV_PCM_RATE_8000_192000,
++ .rates = WM8804_RATES,
+ .formats = WM8804_FORMATS,
+ },
+ .capture = {
+ .stream_name = "Capture",
+ .channels_min = 2,
+ .channels_max = 2,
+- .rates = SNDRV_PCM_RATE_8000_192000,
++ .rates = WM8804_RATES,
+ .formats = WM8804_FORMATS,
+ },
+ .ops = &wm8804_dai_ops,
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 500011e..c22659e 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -1998,12 +1998,12 @@ static int wm8962_put_hp_sw(struct snd_kcontrol *kcontrol,
+ return 0;
+
+ /* If the left PGA is enabled hit that VU bit... */
+- if (reg_cache[WM8962_PWR_MGMT_2] & WM8962_HPOUTL_PGA_ENA)
++ if (snd_soc_read(codec, WM8962_PWR_MGMT_2) & WM8962_HPOUTL_PGA_ENA)
+ return snd_soc_write(codec, WM8962_HPOUTL_VOLUME,
+ reg_cache[WM8962_HPOUTL_VOLUME]);
+
+ /* ...otherwise the right. The VU is stereo. */
+- if (reg_cache[WM8962_PWR_MGMT_2] & WM8962_HPOUTR_PGA_ENA)
++ if (snd_soc_read(codec, WM8962_PWR_MGMT_2) & WM8962_HPOUTR_PGA_ENA)
+ return snd_soc_write(codec, WM8962_HPOUTR_VOLUME,
+ reg_cache[WM8962_HPOUTR_VOLUME]);
+
+diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
+index ffa09b3..992a732 100644
+--- a/sound/soc/samsung/i2s.c
++++ b/sound/soc/samsung/i2s.c
+@@ -191,7 +191,7 @@ static inline bool tx_active(struct i2s_dai *i2s)
+ if (!i2s)
+ return false;
+
+- active = readl(i2s->addr + I2SMOD);
++ active = readl(i2s->addr + I2SCON);
+
+ if (is_secondary(i2s))
+ active &= CON_TXSDMA_ACTIVE;
+@@ -223,7 +223,7 @@ static inline bool rx_active(struct i2s_dai *i2s)
+ if (!i2s)
+ return false;
+
+- active = readl(i2s->addr + I2SMOD) & CON_RXDMA_ACTIVE;
++ active = readl(i2s->addr + I2SCON) & CON_RXDMA_ACTIVE;
+
+ return active ? true : false;
+ }
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 81c4052..586d10b 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -362,9 +362,9 @@ static int dapm_update_bits(struct snd_soc_dapm_widget *widget)
+ }
+
+ /* create new dapm mixer control */
+-static int dapm_new_mixer(struct snd_soc_dapm_context *dapm,
+- struct snd_soc_dapm_widget *w)
++static int dapm_new_mixer(struct snd_soc_dapm_widget *w)
+ {
++ struct snd_soc_dapm_context *dapm = w->dapm;
+ int i, ret = 0;
+ size_t name_len, prefix_len;
+ struct snd_soc_dapm_path *path;
+@@ -443,9 +443,9 @@ static int dapm_new_mixer(struct snd_soc_dapm_context *dapm,
+ }
+
+ /* create new dapm mux control */
+-static int dapm_new_mux(struct snd_soc_dapm_context *dapm,
+- struct snd_soc_dapm_widget *w)
++static int dapm_new_mux(struct snd_soc_dapm_widget *w)
+ {
++ struct snd_soc_dapm_context *dapm = w->dapm;
+ struct snd_soc_dapm_path *path = NULL;
+ struct snd_kcontrol *kcontrol;
+ struct snd_card *card = dapm->card->snd_card;
+@@ -490,8 +490,7 @@ err:
+ }
+
+ /* create new dapm volume control */
+-static int dapm_new_pga(struct snd_soc_dapm_context *dapm,
+- struct snd_soc_dapm_widget *w)
++static int dapm_new_pga(struct snd_soc_dapm_widget *w)
+ {
+ if (w->num_kcontrols)
+ dev_err(w->dapm->dev,
+@@ -1735,13 +1734,13 @@ int snd_soc_dapm_new_widgets(struct snd_soc_dapm_context *dapm)
+ case snd_soc_dapm_mixer:
+ case snd_soc_dapm_mixer_named_ctl:
+ w->power_check = dapm_generic_check_power;
+- dapm_new_mixer(dapm, w);
++ dapm_new_mixer(w);
+ break;
+ case snd_soc_dapm_mux:
+ case snd_soc_dapm_virt_mux:
+ case snd_soc_dapm_value_mux:
+ w->power_check = dapm_generic_check_power;
+- dapm_new_mux(dapm, w);
++ dapm_new_mux(w);
+ break;
+ case snd_soc_dapm_adc:
+ case snd_soc_dapm_aif_out:
+@@ -1754,7 +1753,7 @@ int snd_soc_dapm_new_widgets(struct snd_soc_dapm_context *dapm)
+ case snd_soc_dapm_pga:
+ case snd_soc_dapm_out_drv:
+ w->power_check = dapm_generic_check_power;
+- dapm_new_pga(dapm, w);
++ dapm_new_pga(w);
+ break;
+ case snd_soc_dapm_input:
+ case snd_soc_dapm_output:
Modified: dists/sid/linux-2.6/debian/patches/series/3
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/3 Sat Jun 25 05:30:12 2011 (r17722)
+++ dists/sid/linux-2.6/debian/patches/series/3 Sat Jun 25 08:04:21 2011 (r17723)
@@ -1,2 +1,2 @@
+ bugfix/x86/Revert-drm-i915-Enable-GMBUS-for-post-gen2-chipsets.patch
-+ bugfix/all/block-blkdev_get-should-access-bd_disk-only-after-su.patch
++ bugfix/all/stable/2.6.39.2
More information about the Kernel-svn-changes
mailing list