[kernel] r17723 - in dists/sid/linux-2.6/debian: . patches/bugfix/all patches/bugfix/all/stable patches/series

Maximilian Attems maks at alioth.debian.org
Sat Jun 25 08:04:23 UTC 2011


Author: maks
Date: Sat Jun 25 08:04:21 2011
New Revision: 17723

Log:
add stable 2.6.39.2

remove patch that ships in it

Added:
   dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.39.2
Deleted:
   dists/sid/linux-2.6/debian/patches/bugfix/all/block-blkdev_get-should-access-bd_disk-only-after-su.patch
Modified:
   dists/sid/linux-2.6/debian/changelog
   dists/sid/linux-2.6/debian/patches/series/3

Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog	Sat Jun 25 05:30:12 2011	(r17722)
+++ dists/sid/linux-2.6/debian/changelog	Sat Jun 25 08:04:21 2011	(r17723)
@@ -6,6 +6,13 @@
   * block: Fix crash (oops) in blkdev_get() on failed exclusive open
     (Closes: #631574)
 
+  [ maximilian attems ]
+  * Add stable 2.6.39.2, including:
+    - drm/radeon/kms: viewport height has to be even
+    - drm/radeon/kms: fix for radeon on systems >4GB without hardware iommu
+    - fat: Fix corrupt inode flags when remove ATTR_SYS flag
+    - scsi:  Fix oops caused by queue refcounting failure
+
  -- Ben Hutchings <ben at decadent.org.uk>  Tue, 21 Jun 2011 05:27:43 +0100
 
 linux-2.6 (2.6.39-2) unstable; urgency=low

Added: dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.39.2
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.39.2	Sat Jun 25 08:04:21 2011	(r17723)
@@ -0,0 +1,2839 @@
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index cc85a92..066b642 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -2590,6 +2590,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+ 					unlock ejectable media);
+ 				m = MAX_SECTORS_64 (don't transfer more
+ 					than 64 sectors = 32 KB at a time);
++				n = INITIAL_READ10 (force a retry of the
++					initial READ(10) command);
+ 				o = CAPACITY_OK (accept the capacity
+ 					reported by the device);
+ 				r = IGNORE_RESIDUE (the device reports
+diff --git a/arch/powerpc/kernel/head_32.S b/arch/powerpc/kernel/head_32.S
+index c5c24be..727f40a 100644
+--- a/arch/powerpc/kernel/head_32.S
++++ b/arch/powerpc/kernel/head_32.S
+@@ -896,7 +896,7 @@ _GLOBAL(start_secondary_resume)
+ 	rlwinm	r1,r1,0,0,(31-THREAD_SHIFT)	/* current_thread_info() */
+ 	addi	r1,r1,THREAD_SIZE-STACK_FRAME_OVERHEAD
+ 	li	r3,0
+-	std	r3,0(r1)		/* Zero the stack frame pointer	*/
++	stw	r3,0(r1)		/* Zero the stack frame pointer	*/
+ 	bl	start_secondary
+ 	b	.
+ #endif /* CONFIG_SMP */
+diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
+index cbdbb14..f2dcab7 100644
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -410,8 +410,6 @@ int __cpuinit __cpu_up(unsigned int cpu)
+ {
+ 	int rc, c;
+ 
+-	secondary_ti = current_set[cpu];
+-
+ 	if (smp_ops == NULL ||
+ 	    (smp_ops->cpu_bootable && !smp_ops->cpu_bootable(cpu)))
+ 		return -EINVAL;
+@@ -421,6 +419,8 @@ int __cpuinit __cpu_up(unsigned int cpu)
+ 	if (rc)
+ 		return rc;
+ 
++	secondary_ti = current_set[cpu];
++
+ 	/* Make sure callin-map entry is 0 (can be leftover a CPU
+ 	 * hotplug
+ 	 */
+diff --git a/arch/tile/kernel/pci.c b/arch/tile/kernel/pci.c
+index ea38f0c..1073269 100644
+--- a/arch/tile/kernel/pci.c
++++ b/arch/tile/kernel/pci.c
+@@ -179,12 +179,6 @@ int __init tile_pci_init(void)
+ 
+ 		controller = &controllers[num_controllers];
+ 
+-		if (tile_init_irqs(i, controller)) {
+-			pr_err("PCI: Could not initialize "
+-			       "IRQs, aborting.\n");
+-			goto err_cont;
+-		}
+-
+ 		controller->index = num_controllers;
+ 		controller->hv_cfg_fd[0] = hv_cfg_fd0;
+ 		controller->hv_cfg_fd[1] = hv_cfg_fd1;
+@@ -300,6 +294,11 @@ static int __init pcibios_init(void)
+ 		struct pci_controller *controller = &controllers[i];
+ 		struct pci_bus *bus;
+ 
++		if (tile_init_irqs(i, controller)) {
++			pr_err("PCI: Could not initialize IRQS\n");
++			continue;
++		}
++
+ 		pr_info("PCI: initializing controller #%d\n", i);
+ 
+ 		/*
+diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
+index 57ca777..e7115c8 100644
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -28,6 +28,7 @@
+ #include <asm/proto.h>
+ #include <asm/iommu.h>
+ #include <asm/gart.h>
++#include <asm/dma.h>
+ #include <asm/amd_iommu_proto.h>
+ #include <asm/amd_iommu_types.h>
+ #include <asm/amd_iommu.h>
+@@ -153,6 +154,10 @@ static int iommu_init_device(struct device *dev)
+ 	pdev = pci_get_bus_and_slot(PCI_BUS(alias), alias & 0xff);
+ 	if (pdev)
+ 		dev_data->alias = &pdev->dev;
++	else {
++		kfree(dev_data);
++		return -ENOTSUPP;
++	}
+ 
+ 	atomic_set(&dev_data->bind, 0);
+ 
+@@ -162,6 +167,20 @@ static int iommu_init_device(struct device *dev)
+ 	return 0;
+ }
+ 
++static void iommu_ignore_device(struct device *dev)
++{
++	u16 devid, alias;
++
++	devid = get_device_id(dev);
++	alias = amd_iommu_alias_table[devid];
++
++	memset(&amd_iommu_dev_table[devid], 0, sizeof(struct dev_table_entry));
++	memset(&amd_iommu_dev_table[alias], 0, sizeof(struct dev_table_entry));
++
++	amd_iommu_rlookup_table[devid] = NULL;
++	amd_iommu_rlookup_table[alias] = NULL;
++}
++
+ static void iommu_uninit_device(struct device *dev)
+ {
+ 	kfree(dev->archdata.iommu);
+@@ -191,7 +210,9 @@ int __init amd_iommu_init_devices(void)
+ 			continue;
+ 
+ 		ret = iommu_init_device(&pdev->dev);
+-		if (ret)
++		if (ret == -ENOTSUPP)
++			iommu_ignore_device(&pdev->dev);
++		else if (ret)
+ 			goto out_free;
+ 	}
+ 
+@@ -2296,6 +2317,23 @@ static struct dma_map_ops amd_iommu_dma_ops = {
+ 	.dma_supported = amd_iommu_dma_supported,
+ };
+ 
++static unsigned device_dma_ops_init(void)
++{
++	struct pci_dev *pdev = NULL;
++	unsigned unhandled = 0;
++
++	for_each_pci_dev(pdev) {
++		if (!check_device(&pdev->dev)) {
++			unhandled += 1;
++			continue;
++		}
++
++		pdev->dev.archdata.dma_ops = &amd_iommu_dma_ops;
++	}
++
++	return unhandled;
++}
++
+ /*
+  * The function which clues the AMD IOMMU driver into dma_ops.
+  */
+@@ -2308,7 +2346,7 @@ void __init amd_iommu_init_api(void)
+ int __init amd_iommu_init_dma_ops(void)
+ {
+ 	struct amd_iommu *iommu;
+-	int ret;
++	int ret, unhandled;
+ 
+ 	/*
+ 	 * first allocate a default protection domain for every IOMMU we
+@@ -2334,7 +2372,11 @@ int __init amd_iommu_init_dma_ops(void)
+ 	swiotlb = 0;
+ 
+ 	/* Make the driver finally visible to the drivers */
+-	dma_ops = &amd_iommu_dma_ops;
++	unhandled = device_dma_ops_init();
++	if (unhandled && max_pfn > MAX_DMA32_PFN) {
++		/* There are unhandled devices - initialize swiotlb for them */
++		swiotlb = 1;
++	}
+ 
+ 	amd_iommu_stats_init();
+ 
+diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c
+index 246d727..b9e207e 100644
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -701,8 +701,8 @@ static void __init init_iommu_from_acpi(struct amd_iommu *iommu,
+ {
+ 	u8 *p = (u8 *)h;
+ 	u8 *end = p, flags = 0;
+-	u16 dev_i, devid = 0, devid_start = 0, devid_to = 0;
+-	u32 ext_flags = 0;
++	u16 devid = 0, devid_start = 0, devid_to = 0;
++	u32 dev_i, ext_flags = 0;
+ 	bool alias = false;
+ 	struct ivhd_entry *e;
+ 
+@@ -857,7 +857,7 @@ static void __init init_iommu_from_acpi(struct amd_iommu *iommu,
+ /* Initializes the device->iommu mapping for the driver */
+ static int __init init_iommu_devices(struct amd_iommu *iommu)
+ {
+-	u16 i;
++	u32 i;
+ 
+ 	for (i = iommu->first_device; i <= iommu->last_device; ++i)
+ 		set_iommu_for_device(iommu, i);
+@@ -1146,7 +1146,7 @@ static int __init init_memory_definitions(struct acpi_table_header *table)
+  */
+ static void init_device_table(void)
+ {
+-	u16 devid;
++	u32 devid;
+ 
+ 	for (devid = 0; devid <= amd_iommu_last_bdf; ++devid) {
+ 		set_dev_entry_bit(devid, DEV_ENTRY_VALID);
+diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c
+index e90f084..bea9c03 100644
+--- a/arch/x86/kernel/devicetree.c
++++ b/arch/x86/kernel/devicetree.c
+@@ -13,6 +13,7 @@
+ #include <linux/slab.h>
+ #include <linux/pci.h>
+ #include <linux/of_pci.h>
++#include <linux/initrd.h>
+ 
+ #include <asm/hpet.h>
+ #include <asm/irq_controller.h>
+@@ -98,6 +99,16 @@ void * __init early_init_dt_alloc_memory_arch(u64 size, u64 align)
+ 	return __alloc_bootmem(size, align, __pa(MAX_DMA_ADDRESS));
+ }
+ 
++#ifdef CONFIG_BLK_DEV_INITRD
++void __init early_init_dt_setup_initrd_arch(unsigned long start,
++					    unsigned long end)
++{
++	initrd_start = (unsigned long)__va(start);
++	initrd_end = (unsigned long)__va(end);
++	initrd_below_start_ok = 1;
++}
++#endif
++
+ void __init add_dtb(u64 data)
+ {
+ 	initial_dtb = data + offsetof(struct setup_data, data);
+diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
+index 8d12878..a3d0dc5 100644
+--- a/arch/x86/kernel/process_32.c
++++ b/arch/x86/kernel/process_32.c
+@@ -245,7 +245,6 @@ start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp)
+ {
+ 	set_user_gs(regs, 0);
+ 	regs->fs		= 0;
+-	set_fs(USER_DS);
+ 	regs->ds		= __USER_DS;
+ 	regs->es		= __USER_DS;
+ 	regs->ss		= __USER_DS;
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index 6c9dd92..ca6f7ab 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -338,7 +338,6 @@ start_thread_common(struct pt_regs *regs, unsigned long new_ip,
+ 	regs->cs		= _cs;
+ 	regs->ss		= _ss;
+ 	regs->flags		= X86_EFLAGS_IF;
+-	set_fs(USER_DS);
+ 	/*
+ 	 * Free the old FP and other extended state
+ 	 */
+diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
+index c6724e4..4be9b39 100644
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -912,13 +912,6 @@ void __init setup_arch(char **cmdline_p)
+ 	memblock.current_limit = get_max_mapped();
+ 	memblock_x86_fill();
+ 
+-	/*
+-	 * The EFI specification says that boot service code won't be called
+-	 * after ExitBootServices(). This is, in fact, a lie.
+-	 */
+-	if (efi_enabled)
+-		efi_reserve_boot_services();
+-
+ 	/* preallocate 4k for mptable mpc */
+ 	early_reserve_e820_mpc_new();
+ 
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index c2871d3..c58d144 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -285,6 +285,19 @@ notrace static void __cpuinit start_secondary(void *unused)
+ 	per_cpu(cpu_state, smp_processor_id()) = CPU_ONLINE;
+ 	x86_platform.nmi_init();
+ 
++	/*
++	 * Wait until the cpu which brought this one up marked it
++	 * online before enabling interrupts. If we don't do that then
++	 * we can end up waking up the softirq thread before this cpu
++	 * reached the active state, which makes the scheduler unhappy
++	 * and schedule the softirq thread on the wrong cpu. This is
++	 * only observable with forced threaded interrupts, but in
++	 * theory it could also happen w/o them. It's just way harder
++	 * to achieve.
++	 */
++	while (!cpumask_test_cpu(smp_processor_id(), cpu_active_mask))
++		cpu_relax();
++
+ 	/* enable local interrupts */
+ 	local_irq_enable();
+ 
+diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
+index 1cd6089..493ea1f 100644
+--- a/arch/x86/lguest/boot.c
++++ b/arch/x86/lguest/boot.c
+@@ -995,6 +995,7 @@ static void lguest_time_irq(unsigned int irq, struct irq_desc *desc)
+ static void lguest_time_init(void)
+ {
+ 	/* Set up the timer interrupt (0) to go to our simple timer routine */
++	lguest_setup_irq(0);
+ 	irq_set_handler(0, lguest_time_irq);
+ 
+ 	clocksource_register(&lguest_clock);
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index b00c4ea..0fe27d7 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -315,40 +315,6 @@ static void __init print_efi_memmap(void)
+ }
+ #endif  /*  EFI_DEBUG  */
+ 
+-void __init efi_reserve_boot_services(void)
+-{
+-	void *p;
+-
+-	for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
+-		efi_memory_desc_t *md = p;
+-		unsigned long long start = md->phys_addr;
+-		unsigned long long size = md->num_pages << EFI_PAGE_SHIFT;
+-
+-		if (md->type != EFI_BOOT_SERVICES_CODE &&
+-		    md->type != EFI_BOOT_SERVICES_DATA)
+-			continue;
+-
+-		memblock_x86_reserve_range(start, start + size, "EFI Boot");
+-	}
+-}
+-
+-static void __init efi_free_boot_services(void)
+-{
+-	void *p;
+-
+-	for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
+-		efi_memory_desc_t *md = p;
+-		unsigned long long start = md->phys_addr;
+-		unsigned long long size = md->num_pages << EFI_PAGE_SHIFT;
+-
+-		if (md->type != EFI_BOOT_SERVICES_CODE &&
+-		    md->type != EFI_BOOT_SERVICES_DATA)
+-			continue;
+-
+-		free_bootmem_late(start, size);
+-	}
+-}
+-
+ void __init efi_init(void)
+ {
+ 	efi_config_table_t *config_tables;
+@@ -541,9 +507,7 @@ void __init efi_enter_virtual_mode(void)
+ 	efi.systab = NULL;
+ 	for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
+ 		md = p;
+-		if (!(md->attribute & EFI_MEMORY_RUNTIME) &&
+-		    md->type != EFI_BOOT_SERVICES_CODE &&
+-		    md->type != EFI_BOOT_SERVICES_DATA)
++		if (!(md->attribute & EFI_MEMORY_RUNTIME))
+ 			continue;
+ 
+ 		size = md->num_pages << EFI_PAGE_SHIFT;
+@@ -594,13 +558,6 @@ void __init efi_enter_virtual_mode(void)
+ 	}
+ 
+ 	/*
+-	 * Thankfully, it does seem that no runtime services other than
+-	 * SetVirtualAddressMap() will touch boot services code, so we can
+-	 * get rid of it all at this point
+-	 */
+-	efi_free_boot_services();
+-
+-	/*
+ 	 * Now that EFI is in virtual mode, update the function
+ 	 * pointers in the runtime service table to the new virtual addresses.
+ 	 *
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index 641264c..ac0621a 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -64,11 +64,10 @@ static void __init early_runtime_code_mapping_set_exec(int executable)
+ 	if (!(__supported_pte_mask & _PAGE_NX))
+ 		return;
+ 
+-	/* Make EFI service code area executable */
++	/* Make EFI runtime service code area executable */
+ 	for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
+ 		md = p;
+-		if (md->type == EFI_RUNTIME_SERVICES_CODE ||
+-		    md->type == EFI_BOOT_SERVICES_CODE) {
++		if (md->type == EFI_RUNTIME_SERVICES_CODE) {
+ 			unsigned long end;
+ 			end = md->phys_addr + (md->num_pages << EFI_PAGE_SHIFT);
+ 			early_mapping_set_exec(md->phys_addr, end, executable);
+diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
+index 8bff7e7..1b2b73f 100644
+--- a/arch/x86/xen/multicalls.c
++++ b/arch/x86/xen/multicalls.c
+@@ -189,10 +189,10 @@ struct multicall_space __xen_mc_entry(size_t args)
+ 	unsigned argidx = roundup(b->argidx, sizeof(u64));
+ 
+ 	BUG_ON(preemptible());
+-	BUG_ON(b->argidx > MC_ARGS);
++	BUG_ON(b->argidx >= MC_ARGS);
+ 
+ 	if (b->mcidx == MC_BATCH ||
+-	    (argidx + args) > MC_ARGS) {
++	    (argidx + args) >= MC_ARGS) {
+ 		mc_stats_flush(b->mcidx == MC_BATCH ? FL_SLOTS : FL_ARGS);
+ 		xen_mc_flush();
+ 		argidx = roundup(b->argidx, sizeof(u64));
+@@ -206,7 +206,7 @@ struct multicall_space __xen_mc_entry(size_t args)
+ 	ret.args = &b->args[argidx];
+ 	b->argidx = argidx + args;
+ 
+-	BUG_ON(b->argidx > MC_ARGS);
++	BUG_ON(b->argidx >= MC_ARGS);
+ 	return ret;
+ }
+ 
+@@ -216,7 +216,7 @@ struct multicall_space xen_mc_extend_args(unsigned long op, size_t size)
+ 	struct multicall_space ret = { NULL, NULL };
+ 
+ 	BUG_ON(preemptible());
+-	BUG_ON(b->argidx > MC_ARGS);
++	BUG_ON(b->argidx >= MC_ARGS);
+ 
+ 	if (b->mcidx == 0)
+ 		return ret;
+@@ -224,14 +224,14 @@ struct multicall_space xen_mc_extend_args(unsigned long op, size_t size)
+ 	if (b->entries[b->mcidx - 1].op != op)
+ 		return ret;
+ 
+-	if ((b->argidx + size) > MC_ARGS)
++	if ((b->argidx + size) >= MC_ARGS)
+ 		return ret;
+ 
+ 	ret.mc = &b->entries[b->mcidx - 1];
+ 	ret.args = &b->args[b->argidx];
+ 	b->argidx += size;
+ 
+-	BUG_ON(b->argidx > MC_ARGS);
++	BUG_ON(b->argidx >= MC_ARGS);
+ 	return ret;
+ }
+ 
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 3fe00a1..5323076 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -345,6 +345,7 @@ void blk_put_queue(struct request_queue *q)
+ {
+ 	kobject_put(&q->kobj);
+ }
++EXPORT_SYMBOL(blk_put_queue);
+ 
+ /*
+  * Note: If a driver supplied the queue lock, it should not zap that lock
+@@ -566,6 +567,7 @@ int blk_get_queue(struct request_queue *q)
+ 
+ 	return 1;
+ }
++EXPORT_SYMBOL(blk_get_queue);
+ 
+ static inline void blk_free_request(struct request_queue *q, struct request *rq)
+ {
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index e6fc716..a576406 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -756,6 +756,12 @@ static int __init nbd_init(void)
+ 	if (max_part > 0)
+ 		part_shift = fls(max_part);
+ 
++	if ((1UL << part_shift) > DISK_MAX_PARTS)
++		return -EINVAL;
++
++	if (nbds_max > 1UL << (MINORBITS - part_shift))
++		return -EINVAL;
++
+ 	for (i = 0; i < nbds_max; i++) {
+ 		struct gendisk *disk = alloc_disk(1 << part_shift);
+ 		if (!disk)
+diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
+index 4f1b8de..7c7a1e4 100644
+--- a/drivers/cpufreq/cpufreq_stats.c
++++ b/drivers/cpufreq/cpufreq_stats.c
+@@ -388,6 +388,7 @@ static void __exit cpufreq_stats_exit(void)
+ 	unregister_hotcpu_notifier(&cpufreq_stat_cpu_notifier);
+ 	for_each_online_cpu(cpu) {
+ 		cpufreq_stats_free_table(cpu);
++		cpufreq_stats_free_sysfs(cpu);
+ 	}
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index 67cb076..b28f7bd 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -727,6 +727,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "U800"),
+ 		},
+ 	},
++	{
++		.callback = intel_no_lvds_dmi_callback,
++		.ident = "Asus EeeBox PC EB1007",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "EB1007"),
++		},
++	},
+ 
+ 	{ }	/* terminating entry */
+ };
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 529a3a7..02705c7 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1011,7 +1011,7 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
+ 	uint64_t fb_location;
+ 	uint32_t fb_format, fb_pitch_pixels, tiling_flags;
+ 	u32 fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_NONE);
+-	u32 tmp;
++	u32 tmp, viewport_w, viewport_h;
+ 	int r;
+ 
+ 	/* no fb bound */
+@@ -1137,8 +1137,10 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
+ 	y &= ~1;
+ 	WREG32(EVERGREEN_VIEWPORT_START + radeon_crtc->crtc_offset,
+ 	       (x << 16) | y);
++	viewport_w = crtc->mode.hdisplay;
++	viewport_h = (crtc->mode.vdisplay + 1) & ~1;
+ 	WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+-	       (crtc->mode.hdisplay << 16) | crtc->mode.vdisplay);
++	       (viewport_w << 16) | viewport_h);
+ 
+ 	/* pageflip setup */
+ 	/* make sure flip is at vb rather than hb */
+@@ -1179,7 +1181,7 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
+ 	uint64_t fb_location;
+ 	uint32_t fb_format, fb_pitch_pixels, tiling_flags;
+ 	u32 fb_swap = R600_D1GRPH_SWAP_ENDIAN_NONE;
+-	u32 tmp;
++	u32 tmp, viewport_w, viewport_h;
+ 	int r;
+ 
+ 	/* no fb bound */
+@@ -1304,8 +1306,10 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
+ 	y &= ~1;
+ 	WREG32(AVIVO_D1MODE_VIEWPORT_START + radeon_crtc->crtc_offset,
+ 	       (x << 16) | y);
++	viewport_w = crtc->mode.hdisplay;
++	viewport_h = (crtc->mode.vdisplay + 1) & ~1;
+ 	WREG32(AVIVO_D1MODE_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+-	       (crtc->mode.hdisplay << 16) | crtc->mode.vdisplay);
++	       (viewport_w << 16) | viewport_h);
+ 
+ 	/* pageflip setup */
+ 	/* make sure flip is at vb rather than hb */
+diff --git a/drivers/gpu/drm/radeon/r100_track.h b/drivers/gpu/drm/radeon/r100_track.h
+index 2fef9de..686f9dc 100644
+--- a/drivers/gpu/drm/radeon/r100_track.h
++++ b/drivers/gpu/drm/radeon/r100_track.h
+@@ -63,7 +63,7 @@ struct r100_cs_track {
+ 	unsigned			num_arrays;
+ 	unsigned			max_indx;
+ 	unsigned			color_channel_mask;
+-	struct r100_cs_track_array	arrays[11];
++	struct r100_cs_track_array	arrays[16];
+ 	struct r100_cs_track_cb 	cb[R300_MAX_CB];
+ 	struct r100_cs_track_cb 	zb;
+ 	struct r100_cs_track_cb 	aa;
+@@ -146,6 +146,12 @@ static inline int r100_packet3_load_vbpntr(struct radeon_cs_parser *p,
+ 	ib = p->ib->ptr;
+ 	track = (struct r100_cs_track *)p->track;
+ 	c = radeon_get_ib_value(p, idx++) & 0x1F;
++	if (c > 16) {
++	    DRM_ERROR("Only 16 vertex buffers are allowed %d\n",
++		      pkt->opcode);
++	    r100_cs_dump_packet(p, pkt);
++	    return -EINVAL;
++	}
+ 	track->num_arrays = c;
+ 	for (i = 0; i < (c - 1); i+=2, idx+=3) {
+ 		r = r100_cs_packet_next_reloc(p, &reloc);
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index 890217e..5d6ccc3 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -752,6 +752,7 @@ int radeon_device_init(struct radeon_device *rdev,
+ 	dma_bits = rdev->need_dma32 ? 32 : 40;
+ 	r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(dma_bits));
+ 	if (r) {
++		rdev->need_dma32 = true;
+ 		printk(KERN_WARNING "radeon: No suitable DMA available.\n");
+ 	}
+ 
+diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
+index 194ca0a..08cea44 100644
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -263,7 +263,7 @@ static int __devinit get_tjmax(struct cpuinfo_x86 *c, u32 id,
+ 		 * If the TjMax is not plausible, an assumption
+ 		 * will be used
+ 		 */
+-		if ((val > 80) && (val < 120)) {
++		if (val >= 70 && val <= 125) {
+ 			dev_info(dev, "TjMax is %d C.\n", val);
+ 			return val * 1000;
+ 		}
+@@ -271,24 +271,9 @@ static int __devinit get_tjmax(struct cpuinfo_x86 *c, u32 id,
+ 
+ 	/*
+ 	 * An assumption is made for early CPUs and unreadable MSR.
+-	 * NOTE: the given value may not be correct.
++	 * NOTE: the calculated value may not be correct.
+ 	 */
+-
+-	switch (c->x86_model) {
+-	case 0xe:
+-	case 0xf:
+-	case 0x16:
+-	case 0x1a:
+-		dev_warn(dev, "TjMax is assumed as 100 C!\n");
+-		return 100000;
+-	case 0x17:
+-	case 0x1c:		/* Atom CPUs */
+-		return adjust_tjmax(c, id, dev);
+-	default:
+-		dev_warn(dev, "CPU (model=0x%x) is not supported yet,"
+-			" using default TjMax of 100C.\n", c->x86_model);
+-		return 100000;
+-	}
++	return adjust_tjmax(c, id, dev);
+ }
+ 
+ static void __devinit get_ucode_rev_on_cpu(void *edx)
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 4a4c0f8..9930792 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2462,7 +2462,7 @@ slot_store(mdk_rdev_t *rdev, const char *buf, size_t len)
+ 		if (rdev->raid_disk == -1)
+ 			return -EEXIST;
+ 		/* personality does all needed checks */
+-		if (rdev->mddev->pers->hot_add_disk == NULL)
++		if (rdev->mddev->pers->hot_remove_disk == NULL)
+ 			return -EINVAL;
+ 		err = rdev->mddev->pers->
+ 			hot_remove_disk(rdev->mddev, rdev->raid_disk);
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 49bf5f8..3d13d11 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -129,7 +129,7 @@ static inline int raid5_dec_bi_hw_segments(struct bio *bio)
+ 
+ static inline void raid5_set_bi_hw_segments(struct bio *bio, unsigned int cnt)
+ {
+-	bio->bi_phys_segments = raid5_bi_phys_segments(bio) || (cnt << 16);
++	bio->bi_phys_segments = raid5_bi_phys_segments(bio) | (cnt << 16);
+ }
+ 
+ /* Find first data disk in a raid6 stripe */
+@@ -514,7 +514,7 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
+ 		bi = &sh->dev[i].req;
+ 
+ 		bi->bi_rw = rw;
+-		if (rw == WRITE)
++		if (rw & WRITE)
+ 			bi->bi_end_io = raid5_end_write_request;
+ 		else
+ 			bi->bi_end_io = raid5_end_read_request;
+@@ -548,13 +548,13 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
+ 			bi->bi_io_vec[0].bv_offset = 0;
+ 			bi->bi_size = STRIPE_SIZE;
+ 			bi->bi_next = NULL;
+-			if (rw == WRITE &&
++			if ((rw & WRITE) &&
+ 			    test_bit(R5_ReWrite, &sh->dev[i].flags))
+ 				atomic_add(STRIPE_SECTORS,
+ 					&rdev->corrected_errors);
+ 			generic_make_request(bi);
+ 		} else {
+-			if (rw == WRITE)
++			if (rw & WRITE)
+ 				set_bit(STRIPE_DEGRADED, &sh->state);
+ 			pr_debug("skip op %ld on disc %d for sector %llu\n",
+ 				bi->bi_rw, i, (unsigned long long)sh->sector);
+diff --git a/drivers/media/media-devnode.c b/drivers/media/media-devnode.c
+index af5263c..7b42ace 100644
+--- a/drivers/media/media-devnode.c
++++ b/drivers/media/media-devnode.c
+@@ -213,14 +213,14 @@ int __must_check media_devnode_register(struct media_devnode *mdev)
+ 
+ 	/* Part 1: Find a free minor number */
+ 	mutex_lock(&media_devnode_lock);
+-	minor = find_next_zero_bit(media_devnode_nums, 0, MEDIA_NUM_DEVICES);
++	minor = find_next_zero_bit(media_devnode_nums, MEDIA_NUM_DEVICES, 0);
+ 	if (minor == MEDIA_NUM_DEVICES) {
+ 		mutex_unlock(&media_devnode_lock);
+ 		printk(KERN_ERR "could not get a free minor\n");
+ 		return -ENFILE;
+ 	}
+ 
+-	set_bit(mdev->minor, media_devnode_nums);
++	set_bit(minor, media_devnode_nums);
+ 	mutex_unlock(&media_devnode_lock);
+ 
+ 	mdev->minor = minor;
+diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
+index 0dfd1b9..0e3fccb 100644
+--- a/drivers/net/igb/igb_main.c
++++ b/drivers/net/igb/igb_main.c
+@@ -2372,6 +2372,9 @@ static int __devinit igb_sw_init(struct igb_adapter *adapter)
+ 	}
+ #endif /* CONFIG_PCI_IOV */
+ 	adapter->rss_queues = min_t(u32, IGB_MAX_RX_QUEUES, num_online_cpus());
++	/* i350 cannot do RSS and SR-IOV at the same time */
++	if (hw->mac.type == e1000_i350 && adapter->vfs_allocated_count)
++		adapter->rss_queues = 1;
+ 
+ 	/*
+ 	 * if rss_queues > 4 or vfs are going to be allocated with rss_queues
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index 1033ef6..f2b974d 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1254,6 +1254,7 @@ static struct usb_driver cdc_ncm_driver = {
+ 	.disconnect = cdc_ncm_disconnect,
+ 	.suspend = usbnet_suspend,
+ 	.resume = usbnet_resume,
++	.reset_resume =	usbnet_resume,
+ 	.supports_autosuspend = 1,
+ };
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+index 37af3f4..db4416c 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -4598,10 +4598,16 @@ static void ar9003_hw_set_power_per_rate_table(struct ath_hw *ah,
+ 	case 1:
+ 		break;
+ 	case 2:
+-		scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
++		if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
++			scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
++		else
++			scaledPower = 0;
+ 		break;
+ 	case 3:
+-		scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
++		if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
++			scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
++		else
++			scaledPower = 0;
+ 		break;
+ 	}
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+index 8cd8333..945e448 100644
+--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
++++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+@@ -522,10 +522,16 @@ static void ath9k_hw_set_ar9287_power_per_rate_table(struct ath_hw *ah,
+ 	case 1:
+ 		break;
+ 	case 2:
+-		scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
++		if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
++			scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
++		else
++			scaledPower = 0;
+ 		break;
+ 	case 3:
+-		scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
++		if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
++			scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
++		else
++			scaledPower = 0;
+ 		break;
+ 	}
+ 	scaledPower = max((u16)0, scaledPower);
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 1482fa6..846bb4f 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -633,7 +633,8 @@ void ath9k_tasklet(unsigned long data)
+ 	u32 status = sc->intrstatus;
+ 	u32 rxmask;
+ 
+-	if (status & ATH9K_INT_FATAL) {
++	if ((status & ATH9K_INT_FATAL) ||
++	    (status & ATH9K_INT_BB_WATCHDOG)) {
+ 		ath_reset(sc, true);
+ 		return;
+ 	}
+@@ -699,6 +700,7 @@ irqreturn_t ath_isr(int irq, void *dev)
+ {
+ #define SCHED_INTR (				\
+ 		ATH9K_INT_FATAL |		\
++		ATH9K_INT_BB_WATCHDOG |		\
+ 		ATH9K_INT_RXORN |		\
+ 		ATH9K_INT_RXEOL |		\
+ 		ATH9K_INT_RX |			\
+diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
+index 4c0d36a..a39dfc4 100644
+--- a/drivers/net/wireless/ath/ath9k/rc.c
++++ b/drivers/net/wireless/ath/ath9k/rc.c
+@@ -689,7 +689,8 @@ static void ath_rc_rate_set_series(const struct ath_rate_table *rate_table,
+ 
+ 	if (WLAN_RC_PHY_HT(rate_table->info[rix].phy)) {
+ 		rate->flags |= IEEE80211_TX_RC_MCS;
+-		if (WLAN_RC_PHY_40(rate_table->info[rix].phy))
++		if (WLAN_RC_PHY_40(rate_table->info[rix].phy) &&
++		    conf_is_ht40(&txrc->hw->conf))
+ 			rate->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
+ 		if (WLAN_RC_PHY_SGI(rate_table->info[rix].phy))
+ 			rate->flags |= IEEE80211_TX_RC_SHORT_GI;
+diff --git a/drivers/net/wireless/iwlegacy/iwl-4965-lib.c b/drivers/net/wireless/iwlegacy/iwl-4965-lib.c
+index 5a8a3cc..455f1f7 100644
+--- a/drivers/net/wireless/iwlegacy/iwl-4965-lib.c
++++ b/drivers/net/wireless/iwlegacy/iwl-4965-lib.c
+@@ -628,11 +628,11 @@ void iwl4965_rx_reply_rx(struct iwl_priv *priv,
+ 
+ 	/* rx_status carries information about the packet to mac80211 */
+ 	rx_status.mactime = le64_to_cpu(phy_res->timestamp);
++	rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
++				IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
+ 	rx_status.freq =
+ 		ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel),
+ 							rx_status.band);
+-	rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
+-				IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
+ 	rx_status.rate_idx =
+ 		iwl4965_hwrate_to_mac80211_idx(rate_n_flags, rx_status.band);
+ 	rx_status.flag = 0;
+diff --git a/drivers/net/wireless/iwlegacy/iwl-4965.c b/drivers/net/wireless/iwlegacy/iwl-4965.c
+index f5433c7..facc94e 100644
+--- a/drivers/net/wireless/iwlegacy/iwl-4965.c
++++ b/drivers/net/wireless/iwlegacy/iwl-4965.c
+@@ -1218,10 +1218,10 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *c
+ 	 * receive commit_rxon request
+ 	 * abort any previous channel switch if still in process
+ 	 */
+-	if (priv->switch_rxon.switch_in_progress &&
+-	    (priv->switch_rxon.channel != ctx->staging.channel)) {
++	if (test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status) &&
++	    (priv->switch_channel != ctx->staging.channel)) {
+ 		IWL_DEBUG_11H(priv, "abort channel switch on %d\n",
+-		      le16_to_cpu(priv->switch_rxon.channel));
++		      le16_to_cpu(priv->switch_channel));
+ 		iwl_legacy_chswitch_done(priv, false);
+ 	}
+ 
+@@ -1237,7 +1237,7 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *c
+ 
+ 		memcpy(active_rxon, &ctx->staging, sizeof(*active_rxon));
+ 		iwl_legacy_print_rx_config_cmd(priv, ctx);
+-		return 0;
++		goto set_tx_power;
+ 	}
+ 
+ 	/* If we are currently associated and the new config requires
+@@ -1317,6 +1317,7 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *c
+ 
+ 	iwl4965_init_sensitivity(priv);
+ 
++set_tx_power:
+ 	/* If we issue a new RXON command which required a tune then we must
+ 	 * send a new TXPOWER command or we won't be able to Tx any frames */
+ 	ret = iwl_legacy_set_tx_power(priv, priv->tx_power_next, true);
+@@ -1403,9 +1404,6 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv,
+ 		return rc;
+ 	}
+ 
+-	priv->switch_rxon.channel = cmd.channel;
+-	priv->switch_rxon.switch_in_progress = true;
+-
+ 	return iwl_legacy_send_cmd_pdu(priv,
+ 			 REPLY_CHANNEL_SWITCH, sizeof(cmd), &cmd);
+ }
+@@ -1543,7 +1541,7 @@ static void iwl4965_temperature_calib(struct iwl_priv *priv)
+ 	s32 temp;
+ 
+ 	temp = iwl4965_hw_get_temperature(priv);
+-	if (temp < 0)
++	if (IWL_TX_POWER_TEMPERATURE_OUT_OF_RANGE(temp))
+ 		return;
+ 
+ 	if (priv->temperature != temp) {
+diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c
+index 42db0fc..8ad7922 100644
+--- a/drivers/net/wireless/iwlegacy/iwl-core.c
++++ b/drivers/net/wireless/iwlegacy/iwl-core.c
+@@ -862,12 +862,8 @@ void iwl_legacy_chswitch_done(struct iwl_priv *priv, bool is_success)
+ 	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+ 		return;
+ 
+-	if (priv->switch_rxon.switch_in_progress) {
++	if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+ 		ieee80211_chswitch_done(ctx->vif, is_success);
+-		mutex_lock(&priv->mutex);
+-		priv->switch_rxon.switch_in_progress = false;
+-		mutex_unlock(&priv->mutex);
+-	}
+ }
+ EXPORT_SYMBOL(iwl_legacy_chswitch_done);
+ 
+@@ -879,19 +875,19 @@ void iwl_legacy_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
+ 	struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+ 	struct iwl_legacy_rxon_cmd *rxon = (void *)&ctx->active;
+ 
+-	if (priv->switch_rxon.switch_in_progress) {
+-		if (!le32_to_cpu(csa->status) &&
+-		    (csa->channel == priv->switch_rxon.channel)) {
+-			rxon->channel = csa->channel;
+-			ctx->staging.channel = csa->channel;
+-			IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
+-			      le16_to_cpu(csa->channel));
+-			iwl_legacy_chswitch_done(priv, true);
+-		} else {
+-			IWL_ERR(priv, "CSA notif (fail) : channel %d\n",
++	if (!test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
++		return;
++
++	if (!le32_to_cpu(csa->status) && csa->channel == priv->switch_channel) {
++		rxon->channel = csa->channel;
++		ctx->staging.channel = csa->channel;
++		IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
+ 			      le16_to_cpu(csa->channel));
+-			iwl_legacy_chswitch_done(priv, false);
+-		}
++		iwl_legacy_chswitch_done(priv, true);
++	} else {
++		IWL_ERR(priv, "CSA notif (fail) : channel %d\n",
++			le16_to_cpu(csa->channel));
++		iwl_legacy_chswitch_done(priv, false);
+ 	}
+ }
+ EXPORT_SYMBOL(iwl_legacy_rx_csa);
+diff --git a/drivers/net/wireless/iwlegacy/iwl-core.h b/drivers/net/wireless/iwlegacy/iwl-core.h
+index f03b463..e49176a 100644
+--- a/drivers/net/wireless/iwlegacy/iwl-core.h
++++ b/drivers/net/wireless/iwlegacy/iwl-core.h
+@@ -561,7 +561,7 @@ void iwl_legacy_free_geos(struct iwl_priv *priv);
+ #define STATUS_SCAN_HW		15
+ #define STATUS_POWER_PMI	16
+ #define STATUS_FW_ERROR		17
+-
++#define STATUS_CHANNEL_SWITCH_PENDING 18
+ 
+ static inline int iwl_legacy_is_ready(struct iwl_priv *priv)
+ {
+diff --git a/drivers/net/wireless/iwlegacy/iwl-dev.h b/drivers/net/wireless/iwlegacy/iwl-dev.h
+index f43ac1e..54f89b4 100644
+--- a/drivers/net/wireless/iwlegacy/iwl-dev.h
++++ b/drivers/net/wireless/iwlegacy/iwl-dev.h
+@@ -854,17 +854,6 @@ struct traffic_stats {
+ };
+ 
+ /*
+- * iwl_switch_rxon: "channel switch" structure
+- *
+- * @ switch_in_progress: channel switch in progress
+- * @ channel: new channel
+- */
+-struct iwl_switch_rxon {
+-	bool switch_in_progress;
+-	__le16 channel;
+-};
+-
+-/*
+  * schedule the timer to wake up every UCODE_TRACE_PERIOD milliseconds
+  * to perform continuous uCode event logging operation if enabled
+  */
+@@ -1115,7 +1104,7 @@ struct iwl_priv {
+ 
+ 	struct iwl_rxon_context contexts[NUM_IWL_RXON_CTX];
+ 
+-	struct iwl_switch_rxon switch_rxon;
++	__le16 switch_channel;
+ 
+ 	/* 1st responses from initialize and runtime uCode images.
+ 	 * _4965's initialize alive response contains some calibration data. */
+diff --git a/drivers/net/wireless/iwlegacy/iwl4965-base.c b/drivers/net/wireless/iwlegacy/iwl4965-base.c
+index a62fe24..d654876 100644
+--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c
++++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c
+@@ -2851,16 +2851,13 @@ void iwl4965_mac_channel_switch(struct ieee80211_hw *hw,
+ 		goto out_exit;
+ 
+ 	if (test_bit(STATUS_EXIT_PENDING, &priv->status) ||
+-	    test_bit(STATUS_SCANNING, &priv->status))
++	    test_bit(STATUS_SCANNING, &priv->status) ||
++	    test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+ 		goto out_exit;
+ 
+ 	if (!iwl_legacy_is_associated_ctx(ctx))
+ 		goto out_exit;
+ 
+-	/* channel switch in progress */
+-	if (priv->switch_rxon.switch_in_progress == true)
+-		goto out_exit;
+-
+ 	mutex_lock(&priv->mutex);
+ 	if (priv->cfg->ops->lib->set_channel_switch) {
+ 
+@@ -2910,16 +2907,20 @@ void iwl4965_mac_channel_switch(struct ieee80211_hw *hw,
+ 			 * at this point, staging_rxon has the
+ 			 * configuration for channel switch
+ 			 */
++			set_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status);
++			priv->switch_channel = cpu_to_le16(ch);
+ 			if (priv->cfg->ops->lib->set_channel_switch(priv,
+-								    ch_switch))
+-				priv->switch_rxon.switch_in_progress = false;
++								    ch_switch)) {
++				clear_bit(STATUS_CHANNEL_SWITCH_PENDING,
++					  &priv->status);
++				priv->switch_channel = 0;
++				ieee80211_chswitch_done(ctx->vif, false);
++			}
+ 		}
+ 	}
+ out:
+ 	mutex_unlock(&priv->mutex);
+ out_exit:
+-	if (!priv->switch_rxon.switch_in_progress)
+-		ieee80211_chswitch_done(ctx->vif, false);
+ 	IWL_DEBUG_MAC80211(priv, "leave\n");
+ }
+ 
+diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
+index d7b6126..d474cf3 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
+@@ -181,79 +181,6 @@ static int iwl2000_hw_set_hw_params(struct iwl_priv *priv)
+ 	return 0;
+ }
+ 
+-static int iwl2030_hw_channel_switch(struct iwl_priv *priv,
+-                                    struct ieee80211_channel_switch *ch_switch)
+-{
+-	/*
+-	 * MULTI-FIXME
+-	 * See iwl_mac_channel_switch.
+-	 */
+-	struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+-	struct iwl6000_channel_switch_cmd cmd;
+-	const struct iwl_channel_info *ch_info;
+-	u32 switch_time_in_usec, ucode_switch_time;
+-	u16 ch;
+-	u32 tsf_low;
+-	u8 switch_count;
+-	u16 beacon_interval = le16_to_cpu(ctx->timing.beacon_interval);
+-	struct ieee80211_vif *vif = ctx->vif;
+-	struct iwl_host_cmd hcmd = {
+-		.id = REPLY_CHANNEL_SWITCH,
+-		.len = sizeof(cmd),
+-		.flags = CMD_SYNC,
+-		.data = &cmd,
+-	};
+-
+-	cmd.band = priv->band == IEEE80211_BAND_2GHZ;
+-	ch = ch_switch->channel->hw_value;
+-	IWL_DEBUG_11H(priv, "channel switch from %u to %u\n",
+-		ctx->active.channel, ch);
+-	cmd.channel = cpu_to_le16(ch);
+-	cmd.rxon_flags = ctx->staging.flags;
+-	cmd.rxon_filter_flags = ctx->staging.filter_flags;
+-	switch_count = ch_switch->count;
+-	tsf_low = ch_switch->timestamp & 0x0ffffffff;
+-	/*
+-	 * calculate the ucode channel switch time
+-	 * adding TSF as one of the factor for when to switch
+-	 */
+-	if ((priv->ucode_beacon_time > tsf_low) && beacon_interval) {
+-		if (switch_count > ((priv->ucode_beacon_time - tsf_low) /
+-		    beacon_interval)) {
+-			switch_count -= (priv->ucode_beacon_time -
+-				tsf_low) / beacon_interval;
+-		} else
+-			switch_count = 0;
+-	}
+-	if (switch_count <= 1)
+-		cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+-	else {
+-		switch_time_in_usec =
+-			vif->bss_conf.beacon_int * switch_count * TIME_UNIT;
+-		ucode_switch_time = iwl_usecs_to_beacons(priv,
+-						switch_time_in_usec,
+-						beacon_interval);
+-		cmd.switch_time = iwl_add_beacon_time(priv,
+-						priv->ucode_beacon_time,
+-						ucode_switch_time,
+-						beacon_interval);
+-	}
+-	IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
+-		      cmd.switch_time);
+-	ch_info = iwl_get_channel_info(priv, priv->band, ch);
+-	if (ch_info)
+-		cmd.expect_beacon = is_channel_radar(ch_info);
+-	else {
+-		IWL_ERR(priv, "invalid channel switch from %u to %u\n",
+-			ctx->active.channel, ch);
+-		return -EFAULT;
+-	}
+-	priv->switch_rxon.channel = cmd.channel;
+-	priv->switch_rxon.switch_in_progress = true;
+-
+-	return iwl_send_cmd_sync(priv, &hcmd);
+-}
+-
+ static struct iwl_lib_ops iwl2000_lib = {
+ 	.set_hw_params = iwl2000_hw_set_hw_params,
+ 	.txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
+@@ -277,7 +204,6 @@ static struct iwl_lib_ops iwl2000_lib = {
+ 	.alive_notify = iwlagn_alive_notify,
+ 	.send_tx_power = iwlagn_send_tx_power,
+ 	.update_chain_flags = iwl_update_chain_flags,
+-	.set_channel_switch = iwl2030_hw_channel_switch,
+ 	.apm_ops = {
+ 		.init = iwl_apm_init,
+ 		.config = iwl2000_nic_config,
+diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
+index 22e045b..dcf40e8 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
+@@ -337,8 +337,6 @@ static int iwl5000_hw_channel_switch(struct iwl_priv *priv,
+ 			ctx->active.channel, ch);
+ 		return -EFAULT;
+ 	}
+-	priv->switch_rxon.channel = cmd.channel;
+-	priv->switch_rxon.switch_in_progress = true;
+ 
+ 	return iwl_send_cmd_sync(priv, &hcmd);
+ }
+@@ -513,7 +511,6 @@ static struct iwl_base_params iwl5000_base_params = {
+ };
+ static struct iwl_ht_params iwl5000_ht_params = {
+ 	.ht_greenfield_support = true,
+-	.use_rts_for_aggregation = true, /* use rts/cts protection */
+ };
+ 
+ #define IWL_DEVICE_5000						\
+diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
+index a745b01..9035255 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
+@@ -277,8 +277,6 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
+ 			ctx->active.channel, ch);
+ 		return -EFAULT;
+ 	}
+-	priv->switch_rxon.channel = cmd.channel;
+-	priv->switch_rxon.switch_in_progress = true;
+ 
+ 	return iwl_send_cmd_sync(priv, &hcmd);
+ }
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
+index 41543ad..129a551 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
+@@ -217,17 +217,9 @@ static void iwlagn_tx_cmd_protection(struct iwl_priv *priv,
+ 				     __le16 fc, __le32 *tx_flags)
+ {
+ 	if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS ||
+-	    info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
++	    info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT ||
++	    info->flags & IEEE80211_TX_CTL_AMPDU)
+ 		*tx_flags |= TX_CMD_FLG_PROT_REQUIRE_MSK;
+-		return;
+-	}
+-
+-	if (priv->cfg->ht_params &&
+-	    priv->cfg->ht_params->use_rts_for_aggregation &&
+-	    info->flags & IEEE80211_TX_CTL_AMPDU) {
+-		*tx_flags |= TX_CMD_FLG_PROT_REQUIRE_MSK;
+-		return;
+-	}
+ }
+ 
+ /* Calc max signal level (dBm) among 3 possible receivers */
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+index fbbde07..7c0f80c 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+@@ -173,6 +173,14 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+ 			return 0;
+ 	}
+ 
++	/*
++	 * force CTS-to-self frames protection if RTS-CTS is not preferred
++	 * one aggregation protection method
++	 */
++	if (!(priv->cfg->ht_params &&
++	      priv->cfg->ht_params->use_rts_for_aggregation))
++		ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
++
+ 	if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) ||
+ 	    !(ctx->staging.flags & RXON_FLG_BAND_24G_MSK))
+ 		ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
+@@ -189,10 +197,10 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+ 	 * receive commit_rxon request
+ 	 * abort any previous channel switch if still in process
+ 	 */
+-	if (priv->switch_rxon.switch_in_progress &&
+-	    (priv->switch_rxon.channel != ctx->staging.channel)) {
++	if (test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status) &&
++	    (priv->switch_channel != ctx->staging.channel)) {
+ 		IWL_DEBUG_11H(priv, "abort channel switch on %d\n",
+-		      le16_to_cpu(priv->switch_rxon.channel));
++			      le16_to_cpu(priv->switch_channel));
+ 		iwl_chswitch_done(priv, false);
+ 	}
+ 
+@@ -210,6 +218,11 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+ 
+ 		memcpy(active, &ctx->staging, sizeof(*active));
+ 		iwl_print_rx_config_cmd(priv, ctx);
++		/*
++		 * We do not commit tx power settings while channel changing,
++		 * do it now if after settings changed.
++		 */
++		iwl_set_tx_power(priv, priv->tx_power_next, false);
+ 		return 0;
+ 	}
+ 
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
+index 321b18b..5941e61 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -3461,16 +3461,13 @@ void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
+ 		goto out_exit;
+ 
+ 	if (test_bit(STATUS_EXIT_PENDING, &priv->status) ||
+-	    test_bit(STATUS_SCANNING, &priv->status))
++	    test_bit(STATUS_SCANNING, &priv->status) ||
++	    test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+ 		goto out_exit;
+ 
+ 	if (!iwl_is_associated_ctx(ctx))
+ 		goto out_exit;
+ 
+-	/* channel switch in progress */
+-	if (priv->switch_rxon.switch_in_progress == true)
+-		goto out_exit;
+-
+ 	mutex_lock(&priv->mutex);
+ 	if (priv->cfg->ops->lib->set_channel_switch) {
+ 
+@@ -3520,16 +3517,20 @@ void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
+ 			 * at this point, staging_rxon has the
+ 			 * configuration for channel switch
+ 			 */
++			set_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status);
++			priv->switch_channel = cpu_to_le16(ch);
+ 			if (priv->cfg->ops->lib->set_channel_switch(priv,
+-								    ch_switch))
+-				priv->switch_rxon.switch_in_progress = false;
++								    ch_switch)) {
++				clear_bit(STATUS_CHANNEL_SWITCH_PENDING,
++					  &priv->status);
++				priv->switch_channel = 0;
++				ieee80211_chswitch_done(ctx->vif, false);
++			}
+ 		}
+ 	}
+ out:
+ 	mutex_unlock(&priv->mutex);
+ out_exit:
+-	if (!priv->switch_rxon.switch_in_progress)
+-		ieee80211_chswitch_done(ctx->vif, false);
+ 	IWL_DEBUG_MAC80211(priv, "leave\n");
+ }
+ 
+diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
+index 1755729..7950bc4 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -861,12 +861,8 @@ void iwl_chswitch_done(struct iwl_priv *priv, bool is_success)
+ 	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+ 		return;
+ 
+-	if (priv->switch_rxon.switch_in_progress) {
++	if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+ 		ieee80211_chswitch_done(ctx->vif, is_success);
+-		mutex_lock(&priv->mutex);
+-		priv->switch_rxon.switch_in_progress = false;
+-		mutex_unlock(&priv->mutex);
+-	}
+ }
+ 
+ #ifdef CONFIG_IWLWIFI_DEBUG
+diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
+index b316d83..92f65b6 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-core.h
++++ b/drivers/net/wireless/iwlwifi/iwl-core.h
+@@ -662,7 +662,7 @@ void iwlcore_free_geos(struct iwl_priv *priv);
+ #define STATUS_SCAN_HW		15
+ #define STATUS_POWER_PMI	16
+ #define STATUS_FW_ERROR		17
+-
++#define STATUS_CHANNEL_SWITCH_PENDING 19
+ 
+ static inline int iwl_is_ready(struct iwl_priv *priv)
+ {
+diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
+index c0a4cfb..65a16ae 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
++++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
+@@ -1037,17 +1037,6 @@ struct traffic_stats {
+ };
+ 
+ /*
+- * iwl_switch_rxon: "channel switch" structure
+- *
+- * @ switch_in_progress: channel switch in progress
+- * @ channel: new channel
+- */
+-struct iwl_switch_rxon {
+-	bool switch_in_progress;
+-	__le16 channel;
+-};
+-
+-/*
+  * schedule the timer to wake up every UCODE_TRACE_PERIOD milliseconds
+  * to perform continuous uCode event logging operation if enabled
+  */
+@@ -1344,7 +1333,7 @@ struct iwl_priv {
+ 
+ 	struct iwl_rxon_context contexts[NUM_IWL_RXON_CTX];
+ 
+-	struct iwl_switch_rxon switch_rxon;
++	__le16 switch_channel;
+ 
+ 	/* 1st responses from initialize and runtime uCode images.
+ 	 * _agn's initialize alive response contains some calibration data. */
+diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
+index 6f9a2fa..8055910 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
+@@ -299,19 +299,19 @@ static void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
+ 	struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+ 	struct iwl_rxon_cmd *rxon = (void *)&ctx->active;
+ 
+-	if (priv->switch_rxon.switch_in_progress) {
+-		if (!le32_to_cpu(csa->status) &&
+-		    (csa->channel == priv->switch_rxon.channel)) {
+-			rxon->channel = csa->channel;
+-			ctx->staging.channel = csa->channel;
+-			IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
+-			      le16_to_cpu(csa->channel));
+-			iwl_chswitch_done(priv, true);
+-		} else {
+-			IWL_ERR(priv, "CSA notif (fail) : channel %d\n",
++	if (!test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
++		return;
++
++	if (!le32_to_cpu(csa->status) && csa->channel == priv->switch_channel) {
++		rxon->channel = csa->channel;
++		ctx->staging.channel = csa->channel;
++		IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
+ 			      le16_to_cpu(csa->channel));
+-			iwl_chswitch_done(priv, false);
+-		}
++		iwl_chswitch_done(priv, true);
++	} else {
++		IWL_ERR(priv, "CSA notif (fail) : channel %d\n",
++			le16_to_cpu(csa->channel));
++		iwl_chswitch_done(priv, false);
+ 	}
+ }
+ 
+diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
+index ab607bb..13c0c77 100644
+--- a/drivers/net/wireless/zd1211rw/zd_usb.c
++++ b/drivers/net/wireless/zd1211rw/zd_usb.c
+@@ -1533,6 +1533,31 @@ static void __exit usb_exit(void)
+ module_init(usb_init);
+ module_exit(usb_exit);
+ 
++static int zd_ep_regs_out_msg(struct usb_device *udev, void *data, int len,
++			      int *actual_length, int timeout)
++{
++	/* In USB 2.0 mode EP_REGS_OUT endpoint is interrupt type. However in
++	 * USB 1.1 mode endpoint is bulk. Select correct type URB by endpoint
++	 * descriptor.
++	 */
++	struct usb_host_endpoint *ep;
++	unsigned int pipe;
++
++	pipe = usb_sndintpipe(udev, EP_REGS_OUT);
++	ep = usb_pipe_endpoint(udev, pipe);
++	if (!ep)
++		return -EINVAL;
++
++	if (usb_endpoint_xfer_int(&ep->desc)) {
++		return usb_interrupt_msg(udev, pipe, data, len,
++					 actual_length, timeout);
++	} else {
++		pipe = usb_sndbulkpipe(udev, EP_REGS_OUT);
++		return usb_bulk_msg(udev, pipe, data, len, actual_length,
++				    timeout);
++	}
++}
++
+ static int usb_int_regs_length(unsigned int count)
+ {
+ 	return sizeof(struct usb_int_regs) + count * sizeof(struct reg_data);
+@@ -1648,15 +1673,14 @@ int zd_usb_ioread16v(struct zd_usb *usb, u16 *values,
+ 
+ 	udev = zd_usb_to_usbdev(usb);
+ 	prepare_read_regs_int(usb);
+-	r = usb_interrupt_msg(udev, usb_sndintpipe(udev, EP_REGS_OUT),
+-			      req, req_len, &actual_req_len, 50 /* ms */);
++	r = zd_ep_regs_out_msg(udev, req, req_len, &actual_req_len, 50 /*ms*/);
+ 	if (r) {
+ 		dev_dbg_f(zd_usb_dev(usb),
+-			"error in usb_interrupt_msg(). Error number %d\n", r);
++			"error in zd_ep_regs_out_msg(). Error number %d\n", r);
+ 		goto error;
+ 	}
+ 	if (req_len != actual_req_len) {
+-		dev_dbg_f(zd_usb_dev(usb), "error in usb_interrupt_msg()\n"
++		dev_dbg_f(zd_usb_dev(usb), "error in zd_ep_regs_out_msg()\n"
+ 			" req_len %d != actual_req_len %d\n",
+ 			req_len, actual_req_len);
+ 		r = -EIO;
+@@ -1818,9 +1842,17 @@ int zd_usb_iowrite16v_async(struct zd_usb *usb, const struct zd_ioreq16 *ioreqs,
+ 		rw->value = cpu_to_le16(ioreqs[i].value);
+ 	}
+ 
+-	usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT),
+-			 req, req_len, iowrite16v_urb_complete, usb,
+-			 ep->desc.bInterval);
++	/* In USB 2.0 mode endpoint is interrupt type. However in USB 1.1 mode
++	 * endpoint is bulk. Select correct type URB by endpoint descriptor.
++	 */
++	if (usb_endpoint_xfer_int(&ep->desc))
++		usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT),
++				 req, req_len, iowrite16v_urb_complete, usb,
++				 ep->desc.bInterval);
++	else
++		usb_fill_bulk_urb(urb, udev, usb_sndbulkpipe(udev, EP_REGS_OUT),
++				  req, req_len, iowrite16v_urb_complete, usb);
++
+ 	urb->transfer_flags |= URB_FREE_BUFFER;
+ 
+ 	/* Submit previous URB */
+@@ -1924,15 +1956,14 @@ int zd_usb_rfwrite(struct zd_usb *usb, u32 value, u8 bits)
+ 	}
+ 
+ 	udev = zd_usb_to_usbdev(usb);
+-	r = usb_interrupt_msg(udev, usb_sndintpipe(udev, EP_REGS_OUT),
+-			      req, req_len, &actual_req_len, 50 /* ms */);
++	r = zd_ep_regs_out_msg(udev, req, req_len, &actual_req_len, 50 /*ms*/);
+ 	if (r) {
+ 		dev_dbg_f(zd_usb_dev(usb),
+-			"error in usb_interrupt_msg(). Error number %d\n", r);
++			"error in zd_ep_regs_out_msg(). Error number %d\n", r);
+ 		goto out;
+ 	}
+ 	if (req_len != actual_req_len) {
+-		dev_dbg_f(zd_usb_dev(usb), "error in usb_interrupt_msg()"
++		dev_dbg_f(zd_usb_dev(usb), "error in zd_ep_regs_out_msg()"
+ 			" req_len %d != actual_req_len %d\n",
+ 			req_len, actual_req_len);
+ 		r = -EIO;
+diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
+index a3984f4..f34b5b2 100644
+--- a/drivers/oprofile/buffer_sync.c
++++ b/drivers/oprofile/buffer_sync.c
+@@ -141,6 +141,13 @@ static struct notifier_block module_load_nb = {
+ 	.notifier_call = module_load_notify,
+ };
+ 
++static void free_all_tasks(void)
++{
++	/* make sure we don't leak task structs */
++	process_task_mortuary();
++	process_task_mortuary();
++}
++
+ int sync_start(void)
+ {
+ 	int err;
+@@ -148,8 +155,6 @@ int sync_start(void)
+ 	if (!zalloc_cpumask_var(&marked_cpus, GFP_KERNEL))
+ 		return -ENOMEM;
+ 
+-	mutex_lock(&buffer_mutex);
+-
+ 	err = task_handoff_register(&task_free_nb);
+ 	if (err)
+ 		goto out1;
+@@ -166,7 +171,6 @@ int sync_start(void)
+ 	start_cpu_work();
+ 
+ out:
+-	mutex_unlock(&buffer_mutex);
+ 	return err;
+ out4:
+ 	profile_event_unregister(PROFILE_MUNMAP, &munmap_nb);
+@@ -174,6 +178,7 @@ out3:
+ 	profile_event_unregister(PROFILE_TASK_EXIT, &task_exit_nb);
+ out2:
+ 	task_handoff_unregister(&task_free_nb);
++	free_all_tasks();
+ out1:
+ 	free_cpumask_var(marked_cpus);
+ 	goto out;
+@@ -182,20 +187,16 @@ out1:
+ 
+ void sync_stop(void)
+ {
+-	/* flush buffers */
+-	mutex_lock(&buffer_mutex);
+ 	end_cpu_work();
+ 	unregister_module_notifier(&module_load_nb);
+ 	profile_event_unregister(PROFILE_MUNMAP, &munmap_nb);
+ 	profile_event_unregister(PROFILE_TASK_EXIT, &task_exit_nb);
+ 	task_handoff_unregister(&task_free_nb);
+-	mutex_unlock(&buffer_mutex);
+-	flush_cpu_work();
++	barrier();			/* do all of the above first */
+ 
+-	/* make sure we don't leak task structs */
+-	process_task_mortuary();
+-	process_task_mortuary();
++	flush_cpu_work();
+ 
++	free_all_tasks();
+ 	free_cpumask_var(marked_cpus);
+ }
+ 
+diff --git a/drivers/pci/hotplug/pcihp_slot.c b/drivers/pci/hotplug/pcihp_slot.c
+index 80b461c..749fdf0 100644
+--- a/drivers/pci/hotplug/pcihp_slot.c
++++ b/drivers/pci/hotplug/pcihp_slot.c
+@@ -158,6 +158,47 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
+ 	 */
+ }
+ 
++/* Program PCIE MaxPayload setting on device: ensure parent maxpayload <= device */
++static int pci_set_payload(struct pci_dev *dev)
++{
++       int pos, ppos;
++       u16 pctl, psz;
++       u16 dctl, dsz, dcap, dmax;
++       struct pci_dev *parent;
++
++       parent = dev->bus->self;
++       pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
++       if (!pos)
++               return 0;
++
++       /* Read Device MaxPayload capability and setting */
++       pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &dctl);
++       pci_read_config_word(dev, pos + PCI_EXP_DEVCAP, &dcap);
++       dsz = (dctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5;
++       dmax = (dcap & PCI_EXP_DEVCAP_PAYLOAD);
++
++       /* Read Parent MaxPayload setting */
++       ppos = pci_find_capability(parent, PCI_CAP_ID_EXP);
++       if (!ppos)
++               return 0;
++       pci_read_config_word(parent, ppos + PCI_EXP_DEVCTL, &pctl);
++       psz = (pctl &  PCI_EXP_DEVCTL_PAYLOAD) >> 5;
++
++       /* If parent payload > device max payload -> error
++        * If parent payload > device payload -> set speed
++        * If parent payload <= device payload -> do nothing
++        */
++       if (psz > dmax)
++               return -1;
++       else if (psz > dsz) {
++               dev_info(&dev->dev, "Setting MaxPayload to %d\n", 128 << psz);
++               pci_write_config_word(dev, pos + PCI_EXP_DEVCTL,
++                                     (dctl & ~PCI_EXP_DEVCTL_PAYLOAD) +
++                                     (psz << 5));
++       }
++       return 0;
++}
++
+ void pci_configure_slot(struct pci_dev *dev)
+ {
+ 	struct pci_dev *cdev;
+@@ -169,6 +210,10 @@ void pci_configure_slot(struct pci_dev *dev)
+ 			(dev->class >> 8) == PCI_CLASS_BRIDGE_PCI)))
+ 		return;
+ 
++       ret = pci_set_payload(dev);
++       if (ret)
++               dev_warn(&dev->dev, "could not set device max payload\n");
++
+ 	memset(&hpp, 0, sizeof(hpp));
+ 	ret = pci_get_hp_params(dev, &hpp);
+ 	if (ret)
+diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
+index d552d2c..5db70c7 100644
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -46,6 +46,8 @@
+ #define ROOT_SIZE		VTD_PAGE_SIZE
+ #define CONTEXT_SIZE		VTD_PAGE_SIZE
+ 
++#define IS_BRIDGE_HOST_DEVICE(pdev) \
++			    ((pdev->class >> 8) == PCI_CLASS_BRIDGE_HOST)
+ #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
+ #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
+ #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
+@@ -1416,6 +1418,10 @@ static void domain_exit(struct dmar_domain *domain)
+ 	if (!domain)
+ 		return;
+ 
++	/* Flush any lazy unmaps that may reference this domain */
++	if (!intel_iommu_strict)
++		flush_unmaps_timeout(0);
++
+ 	domain_remove_dev_info(domain);
+ 	/* destroy iovas */
+ 	put_iova_domain(&domain->iovad);
+@@ -2105,10 +2111,10 @@ static int identity_mapping(struct pci_dev *pdev)
+ 	if (likely(!iommu_identity_mapping))
+ 		return 0;
+ 
++	info = pdev->dev.archdata.iommu;
++	if (info && info != DUMMY_DEVICE_DOMAIN_INFO)
++		return (info->domain == si_domain);
+ 
+-	list_for_each_entry(info, &si_domain->devices, link)
+-		if (info->dev == pdev)
+-			return 1;
+ 	return 0;
+ }
+ 
+@@ -2186,8 +2192,19 @@ static int iommu_should_identity_map(struct pci_dev *pdev, int startup)
+ 	 * Assume that they will -- if they turn out not to be, then we can 
+ 	 * take them out of the 1:1 domain later.
+ 	 */
+-	if (!startup)
+-		return pdev->dma_mask > DMA_BIT_MASK(32);
++	if (!startup) {
++		/*
++		 * If the device's dma_mask is less than the system's memory
++		 * size then this is not a candidate for identity mapping.
++		 */
++		u64 dma_mask = pdev->dma_mask;
++
++		if (pdev->dev.coherent_dma_mask &&
++		    pdev->dev.coherent_dma_mask < dma_mask)
++			dma_mask = pdev->dev.coherent_dma_mask;
++
++		return dma_mask >= dma_get_required_mask(&pdev->dev);
++	}
+ 
+ 	return 1;
+ }
+@@ -2202,6 +2219,9 @@ static int __init iommu_prepare_static_identity_mapping(int hw)
+ 		return -EFAULT;
+ 
+ 	for_each_pci_dev(pdev) {
++		/* Skip Host/PCI Bridge devices */
++		if (IS_BRIDGE_HOST_DEVICE(pdev))
++			continue;
+ 		if (iommu_should_identity_map(pdev, 1)) {
+ 			printk(KERN_INFO "IOMMU: %s identity mapping for device %s\n",
+ 			       hw ? "hardware" : "software", pci_name(pdev));
+@@ -2591,8 +2611,7 @@ static dma_addr_t __intel_map_single(struct device *hwdev, phys_addr_t paddr,
+ 	iommu = domain_get_iommu(domain);
+ 	size = aligned_nrpages(paddr, size);
+ 
+-	iova = intel_alloc_iova(hwdev, domain, dma_to_mm_pfn(size),
+-				pdev->dma_mask);
++	iova = intel_alloc_iova(hwdev, domain, dma_to_mm_pfn(size), dma_mask);
+ 	if (!iova)
+ 		goto error;
+ 
+@@ -3379,8 +3398,8 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain,
+ 	spin_lock_irqsave(&device_domain_lock, flags);
+ 	list_for_each_safe(entry, tmp, &domain->devices) {
+ 		info = list_entry(entry, struct device_domain_info, link);
+-		/* No need to compare PCI domain; it has to be the same */
+-		if (info->bus == pdev->bus->number &&
++		if (info->segment == pci_domain_nr(pdev->bus) &&
++		    info->bus == pdev->bus->number &&
+ 		    info->devfn == pdev->devfn) {
+ 			list_del(&info->link);
+ 			list_del(&info->global);
+@@ -3418,10 +3437,13 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain,
+ 		domain_update_iommu_cap(domain);
+ 		spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags);
+ 
+-		spin_lock_irqsave(&iommu->lock, tmp_flags);
+-		clear_bit(domain->id, iommu->domain_ids);
+-		iommu->domains[domain->id] = NULL;
+-		spin_unlock_irqrestore(&iommu->lock, tmp_flags);
++		if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
++		    !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY)) {
++			spin_lock_irqsave(&iommu->lock, tmp_flags);
++			clear_bit(domain->id, iommu->domain_ids);
++			iommu->domains[domain->id] = NULL;
++			spin_unlock_irqrestore(&iommu->lock, tmp_flags);
++		}
+ 	}
+ 
+ 	spin_unlock_irqrestore(&device_domain_lock, flags);
+diff --git a/drivers/pci/iova.c b/drivers/pci/iova.c
+index 9606e59..c5c274a 100644
+--- a/drivers/pci/iova.c
++++ b/drivers/pci/iova.c
+@@ -63,8 +63,16 @@ __cached_rbnode_delete_update(struct iova_domain *iovad, struct iova *free)
+ 	curr = iovad->cached32_node;
+ 	cached_iova = container_of(curr, struct iova, node);
+ 
+-	if (free->pfn_lo >= cached_iova->pfn_lo)
+-		iovad->cached32_node = rb_next(&free->node);
++	if (free->pfn_lo >= cached_iova->pfn_lo) {
++		struct rb_node *node = rb_next(&free->node);
++		struct iova *iova = container_of(node, struct iova, node);
++
++		/* only cache if it's below 32bit pfn */
++		if (node && iova->pfn_lo < iovad->dma_32bit_pfn)
++			iovad->cached32_node = node;
++		else
++			iovad->cached32_node = NULL;
++	}
+ }
+ 
+ /* Computes the padding size required, to make the
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index 832a3fd7..c8c9842 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -1223,7 +1223,7 @@ static int asus_wmi_sysfs_init(struct platform_device *device)
+ /*
+  * Platform device
+  */
+-static int __init asus_wmi_platform_init(struct asus_wmi *asus)
++static int asus_wmi_platform_init(struct asus_wmi *asus)
+ {
+ 	int rv;
+ 
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index 58584dc..44e8ca3 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -297,7 +297,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
+ 		kfree(sdev);
+ 		goto out;
+ 	}
+-
++	blk_get_queue(sdev->request_queue);
+ 	sdev->request_queue->queuedata = sdev;
+ 	scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun);
+ 
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index e639125..e0bd3f7 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -322,6 +322,7 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
+ 		kfree(evt);
+ 	}
+ 
++	blk_put_queue(sdev->request_queue);
+ 	/* NULL queue means the device can't be used */
+ 	sdev->request_queue = NULL;
+ 
+diff --git a/drivers/staging/gma500/psb_fb.c b/drivers/staging/gma500/psb_fb.c
+index f67f53b..1b96199 100644
+--- a/drivers/staging/gma500/psb_fb.c
++++ b/drivers/staging/gma500/psb_fb.c
+@@ -489,6 +489,16 @@ static int psbfb_create(struct psb_fbdev *fbdev,
+ 	info->screen_size = size;
+ 	memset(info->screen_base, 0, size);
+ 
++	if (dev_priv->pg->stolen_size) {
++		info->apertures = alloc_apertures(1);
++		if (!info->apertures) {
++			ret = -ENOMEM;
++			goto out_err0;
++		}
++		info->apertures->ranges[0].base = dev->mode_config.fb_base;
++		info->apertures->ranges[0].size = dev_priv->pg->stolen_size;
++	}
++
+ 	drm_fb_helper_fill_fix(info, fb->pitch, fb->depth);
+ 	drm_fb_helper_fill_var(info, &fbdev->psb_fb_helper,
+ 				sizes->fb_width, sizes->fb_height);
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 733fe8e..d4bee1b 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -172,12 +172,16 @@ static int uart_startup(struct tty_struct *tty, struct uart_state *state, int in
+ 
+ 	retval = uport->ops->startup(uport);
+ 	if (retval == 0) {
+-		if (init_hw) {
+-			/*
+-			 * Initialise the hardware port settings.
+-			 */
+-			uart_change_speed(tty, state, NULL);
++		if (uart_console(uport) && uport->cons->cflag) {
++			tty->termios->c_cflag = uport->cons->cflag;
++			uport->cons->cflag = 0;
++		}
++		/*
++		 * Initialise the hardware port settings.
++		 */
++		uart_change_speed(tty, state, NULL);
+ 
++		if (init_hw) {
+ 			/*
+ 			 * Setup the RTS and DTR signals once the
+ 			 * port is open and ready to respond.
+@@ -1466,45 +1470,6 @@ static void uart_hangup(struct tty_struct *tty)
+ 	mutex_unlock(&port->mutex);
+ }
+ 
+-/**
+- *	uart_update_termios	-	update the terminal hw settings
+- *	@tty: tty associated with UART
+- *	@state: UART to update
+- *
+- *	Copy across the serial console cflag setting into the termios settings
+- *	for the initial open of the port.  This allows continuity between the
+- *	kernel settings, and the settings init adopts when it opens the port
+- *	for the first time.
+- */
+-static void uart_update_termios(struct tty_struct *tty,
+-						struct uart_state *state)
+-{
+-	struct uart_port *port = state->uart_port;
+-
+-	if (uart_console(port) && port->cons->cflag) {
+-		tty->termios->c_cflag = port->cons->cflag;
+-		port->cons->cflag = 0;
+-	}
+-
+-	/*
+-	 * If the device failed to grab its irq resources,
+-	 * or some other error occurred, don't try to talk
+-	 * to the port hardware.
+-	 */
+-	if (!(tty->flags & (1 << TTY_IO_ERROR))) {
+-		/*
+-		 * Make termios settings take effect.
+-		 */
+-		uart_change_speed(tty, state, NULL);
+-
+-		/*
+-		 * And finally enable the RTS and DTR signals.
+-		 */
+-		if (tty->termios->c_cflag & CBAUD)
+-			uart_set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
+-	}
+-}
+-
+ static int uart_carrier_raised(struct tty_port *port)
+ {
+ 	struct uart_state *state = container_of(port, struct uart_state, port);
+@@ -1524,16 +1489,8 @@ static void uart_dtr_rts(struct tty_port *port, int onoff)
+ 	struct uart_state *state = container_of(port, struct uart_state, port);
+ 	struct uart_port *uport = state->uart_port;
+ 
+-	if (onoff) {
++	if (onoff)
+ 		uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
+-
+-		/*
+-		 * If this is the first open to succeed,
+-		 * adjust things to suit.
+-		 */
+-		if (!test_and_set_bit(ASYNCB_NORMAL_ACTIVE, &port->flags))
+-			uart_update_termios(port->tty, state);
+-	}
+ 	else
+ 		uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
+ }
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index caa2535..d0b84ff 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1617,6 +1617,8 @@ static const struct usb_device_id acm_ids[] = {
+ 	{ NOKIA_PCSUITE_ACM_INFO(0x04ce), }, /* Nokia E90 */
+ 	{ NOKIA_PCSUITE_ACM_INFO(0x01d4), }, /* Nokia E55 */
+ 	{ NOKIA_PCSUITE_ACM_INFO(0x0302), }, /* Nokia N8 */
++	{ NOKIA_PCSUITE_ACM_INFO(0x0335), }, /* Nokia E7 */
++	{ NOKIA_PCSUITE_ACM_INFO(0x03cd), }, /* Nokia C7 */
+ 	{ SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */
+ 
+ 	/* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 93720bd..78e7f25 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -339,7 +339,8 @@ static int get_hub_status(struct usb_device *hdev,
+ {
+ 	int i, status = -ETIMEDOUT;
+ 
+-	for (i = 0; i < USB_STS_RETRIES && status == -ETIMEDOUT; i++) {
++	for (i = 0; i < USB_STS_RETRIES &&
++			(status == -ETIMEDOUT || status == -EPIPE); i++) {
+ 		status = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
+ 			USB_REQ_GET_STATUS, USB_DIR_IN | USB_RT_HUB, 0, 0,
+ 			data, sizeof(*data), USB_STS_TIMEOUT);
+@@ -355,7 +356,8 @@ static int get_port_status(struct usb_device *hdev, int port1,
+ {
+ 	int i, status = -ETIMEDOUT;
+ 
+-	for (i = 0; i < USB_STS_RETRIES && status == -ETIMEDOUT; i++) {
++	for (i = 0; i < USB_STS_RETRIES &&
++			(status == -ETIMEDOUT || status == -EPIPE); i++) {
+ 		status = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
+ 			USB_REQ_GET_STATUS, USB_DIR_IN | USB_RT_PORT, 0, port1,
+ 			data, sizeof(*data), USB_STS_TIMEOUT);
+diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c
+index 0231814..ff00bd8 100644
+--- a/drivers/usb/host/xhci-dbg.c
++++ b/drivers/usb/host/xhci-dbg.c
+@@ -437,13 +437,13 @@ char *xhci_get_slot_state(struct xhci_hcd *xhci,
+ 	struct xhci_slot_ctx *slot_ctx = xhci_get_slot_ctx(xhci, ctx);
+ 
+ 	switch (GET_SLOT_STATE(slot_ctx->dev_state)) {
+-	case 0:
++	case SLOT_STATE_ENABLED:
+ 		return "enabled/disabled";
+-	case 1:
++	case SLOT_STATE_DEFAULT:
+ 		return "default";
+-	case 2:
++	case SLOT_STATE_ADDRESSED:
+ 		return "addressed";
+-	case 3:
++	case SLOT_STATE_CONFIGURED:
+ 		return "configured";
+ 	default:
+ 		return "reserved";
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 783e5e0..976422a 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -986,9 +986,19 @@ static unsigned int xhci_parse_exponent_interval(struct usb_device *udev,
+ 	interval = clamp_val(ep->desc.bInterval, 1, 16) - 1;
+ 	if (interval != ep->desc.bInterval - 1)
+ 		dev_warn(&udev->dev,
+-			 "ep %#x - rounding interval to %d microframes\n",
++			 "ep %#x - rounding interval to %d %sframes\n",
+ 			 ep->desc.bEndpointAddress,
+-			 1 << interval);
++			 1 << interval,
++			 udev->speed == USB_SPEED_FULL ? "" : "micro");
++
++	if (udev->speed == USB_SPEED_FULL) {
++		/*
++		 * Full speed isoc endpoints specify interval in frames,
++		 * not microframes. We are using microframes everywhere,
++		 * so adjust accordingly.
++		 */
++		interval += 3;	/* 1 frame = 2^3 uframes */
++	}
+ 
+ 	return interval;
+ }
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index a10494c..4940717 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -105,12 +105,22 @@ static int xhci_pci_setup(struct usb_hcd *hcd)
+ 
+ 	/* Look for vendor-specific quirks */
+ 	if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC &&
+-			pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK &&
+-			pdev->revision == 0x0) {
++			pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK) {
++		if (pdev->revision == 0x0) {
+ 			xhci->quirks |= XHCI_RESET_EP_QUIRK;
+ 			xhci_dbg(xhci, "QUIRK: Fresco Logic xHC needs configure"
+ 					" endpoint cmd after reset endpoint\n");
++		}
++		/* Fresco Logic confirms: all revisions of this chip do not
++		 * support MSI, even though some of them claim to in their PCI
++		 * capabilities.
++		 */
++		xhci->quirks |= XHCI_BROKEN_MSI;
++		xhci_dbg(xhci, "QUIRK: Fresco Logic revision %u "
++				"has broken MSI implementation\n",
++				pdev->revision);
+ 	}
++
+ 	if (pdev->vendor == PCI_VENDOR_ID_NEC)
+ 		xhci->quirks |= XHCI_NEC_HOST;
+ 
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index d2cd3ce..e5c4861 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -430,12 +430,19 @@ int xhci_run(struct usb_hcd *hcd)
+ 		free_irq(hcd->irq, hcd);
+ 	hcd->irq = -1;
+ 
++	/* Some Fresco Logic host controllers advertise MSI, but fail to
++	 * generate interrupts.  Don't even try to enable MSI.
++	 */
++	if (xhci->quirks & XHCI_BROKEN_MSI)
++		goto legacy_irq;
++
+ 	ret = xhci_setup_msix(xhci);
+ 	if (ret)
+ 		/* fall back to msi*/
+ 		ret = xhci_setup_msi(xhci);
+ 
+ 	if (ret) {
++legacy_irq:
+ 		/* fall back to legacy interrupt*/
+ 		ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
+ 					hcd->irq_descr, hcd);
+@@ -2284,6 +2291,7 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
+ 	struct xhci_command *reset_device_cmd;
+ 	int timeleft;
+ 	int last_freed_endpoint;
++	struct xhci_slot_ctx *slot_ctx;
+ 
+ 	ret = xhci_check_args(hcd, udev, NULL, 0, false, __func__);
+ 	if (ret <= 0)
+@@ -2316,6 +2324,12 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
+ 			return -EINVAL;
+ 	}
+ 
++	/* If device is not setup, there is no point in resetting it */
++	slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx);
++	if (GET_SLOT_STATE(le32_to_cpu(slot_ctx->dev_state)) ==
++						SLOT_STATE_DISABLED)
++		return 0;
++
+ 	xhci_dbg(xhci, "Resetting device with slot ID %u\n", slot_id);
+ 	/* Allocate the command structure that holds the struct completion.
+ 	 * Assume we're in process context, since the normal device reset
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index ba1be6b..fb85ce3 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -560,6 +560,11 @@ struct xhci_slot_ctx {
+ #define SLOT_STATE	(0x1f << 27)
+ #define GET_SLOT_STATE(p)	(((p) & (0x1f << 27)) >> 27)
+ 
++#define SLOT_STATE_DISABLED	0
++#define SLOT_STATE_ENABLED	SLOT_STATE_DISABLED
++#define SLOT_STATE_DEFAULT	1
++#define SLOT_STATE_ADDRESSED	2
++#define SLOT_STATE_CONFIGURED	3
+ 
+ /**
+  * struct xhci_ep_ctx
+@@ -1281,6 +1286,7 @@ struct xhci_hcd {
+ #define XHCI_RESET_EP_QUIRK	(1 << 1)
+ #define XHCI_NEC_HOST		(1 << 2)
+ #define XHCI_AMD_PLL_FIX	(1 << 3)
++#define XHCI_BROKEN_MSI		(1 << 6)
+ 	/* There are two roothubs to keep track of bus suspend info for */
+ 	struct xhci_bus_state   bus_state[2];
+ 	/* Is each xHCI roothub port a USB 3.0, USB 2.0, or USB 1.1 port? */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index e8dbde5..1627289 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -647,6 +647,7 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, EVER_ECO_PRO_CDS) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_1_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_2_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_3_PID) },
+ 	{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_0_PID) },
+ 	{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_1_PID) },
+ 	{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_2_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 1d946cd..ab1fcdf 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -351,6 +351,7 @@
+  */
+ #define FTDI_4N_GALAXY_DE_1_PID	0xF3C0
+ #define FTDI_4N_GALAXY_DE_2_PID	0xF3C1
++#define FTDI_4N_GALAXY_DE_3_PID	0xF3C2
+ 
+ /*
+  * Linx Technologies product ids
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 318dd00..60b25d8 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -311,10 +311,6 @@ static void option_instat_callback(struct urb *urb);
+ #define ZTE_PRODUCT_AC2726			0xfff5
+ #define ZTE_PRODUCT_AC8710T			0xffff
+ 
+-/* ZTE PRODUCTS -- alternate vendor ID */
+-#define ZTE_VENDOR_ID2				0x1d6b
+-#define ZTE_PRODUCT_MF_330			0x0002
+-
+ #define BENQ_VENDOR_ID				0x04a5
+ #define BENQ_PRODUCT_H10			0x4068
+ 
+@@ -340,11 +336,12 @@ static void option_instat_callback(struct urb *urb);
+ #define TOSHIBA_PRODUCT_G450			0x0d45
+ 
+ #define ALINK_VENDOR_ID				0x1e0e
++#define ALINK_PRODUCT_PH300			0x9100
+ #define ALINK_PRODUCT_3GU			0x9200
+ 
+ /* ALCATEL PRODUCTS */
+ #define ALCATEL_VENDOR_ID			0x1bbb
+-#define ALCATEL_PRODUCT_X060S			0x0000
++#define ALCATEL_PRODUCT_X060S_X200		0x0000
+ 
+ #define PIRELLI_VENDOR_ID			0x1266
+ #define PIRELLI_PRODUCT_C100_1			0x1002
+@@ -379,6 +376,9 @@ static void option_instat_callback(struct urb *urb);
+  * It seems to contain a Qualcomm QSC6240/6290 chipset            */
+ #define FOUR_G_SYSTEMS_PRODUCT_W14		0x9603
+ 
++/* Zoom */
++#define ZOOM_PRODUCT_4597			0x9607
++
+ /* Haier products */
+ #define HAIER_VENDOR_ID				0x201e
+ #define HAIER_PRODUCT_CE100			0x2009
+@@ -432,6 +432,20 @@ static const struct option_blacklist_info four_g_w14_blacklist = {
+ 	.reason = OPTION_BLACKLIST_SENDSETUP
+ };
+ 
++static const u8 alcatel_x200_no_sendsetup[] = { 0, 1 };
++static const struct option_blacklist_info alcatel_x200_blacklist = {
++	.infolen = ARRAY_SIZE(alcatel_x200_no_sendsetup),
++	.ifaceinfo = alcatel_x200_no_sendsetup,
++	.reason = OPTION_BLACKLIST_SENDSETUP
++};
++
++static const u8 zte_k3765_z_no_sendsetup[] = { 0, 1, 2 };
++static const struct option_blacklist_info zte_k3765_z_blacklist = {
++	.infolen = ARRAY_SIZE(zte_k3765_z_no_sendsetup),
++	.ifaceinfo = zte_k3765_z_no_sendsetup,
++	.reason = OPTION_BLACKLIST_SENDSETUP
++};
++
+ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
+ 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
+@@ -916,13 +930,13 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
+-	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
++	  0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) },
+-	{ USB_DEVICE(ZTE_VENDOR_ID2, ZTE_PRODUCT_MF_330) },
+ 	{ USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
+ 	{ USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
+ 	{ USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
+@@ -935,13 +949,17 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) },
+ 	{ USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */
+ 	{ USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
++	{ USB_DEVICE(ALINK_VENDOR_ID, ALINK_PRODUCT_PH300) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
+-	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) },
++	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
++	  .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist
++	},
+ 	{ USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+ 	{ USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
+ 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
+   	  .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
+   	},
++	{ USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
+ 	{ USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
+ 	/* Pirelli  */
+ 	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1)},
+diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
+index 0041899..e8ae21b 100644
+--- a/drivers/usb/storage/transport.c
++++ b/drivers/usb/storage/transport.c
+@@ -819,6 +819,35 @@ Retry_Sense:
+ 		}
+ 	}
+ 
++	/*
++	 * Some devices don't work or return incorrect data the first
++	 * time they get a READ(10) command, or for the first READ(10)
++	 * after a media change.  If the INITIAL_READ10 flag is set,
++	 * keep track of whether READ(10) commands succeed.  If the
++	 * previous one succeeded and this one failed, set the REDO_READ10
++	 * flag to force a retry.
++	 */
++	if (unlikely((us->fflags & US_FL_INITIAL_READ10) &&
++			srb->cmnd[0] == READ_10)) {
++		if (srb->result == SAM_STAT_GOOD) {
++			set_bit(US_FLIDX_READ10_WORKED, &us->dflags);
++		} else if (test_bit(US_FLIDX_READ10_WORKED, &us->dflags)) {
++			clear_bit(US_FLIDX_READ10_WORKED, &us->dflags);
++			set_bit(US_FLIDX_REDO_READ10, &us->dflags);
++		}
++
++		/*
++		 * Next, if the REDO_READ10 flag is set, return a result
++		 * code that will cause the SCSI core to retry the READ(10)
++		 * command immediately.
++		 */
++		if (test_bit(US_FLIDX_REDO_READ10, &us->dflags)) {
++			clear_bit(US_FLIDX_REDO_READ10, &us->dflags);
++			srb->result = DID_IMM_RETRY << 16;
++			srb->sense_buffer[0] = 0;
++		}
++	}
++
+ 	/* Did we transfer less than the minimum amount required? */
+ 	if ((srb->result == SAM_STAT_GOOD || srb->sense_buffer[2] == 0) &&
+ 			scsi_bufflen(srb) - scsi_get_resid(srb) < srb->underflow)
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index c1602b8..ccff348 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1114,6 +1114,16 @@ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_FIX_CAPACITY ),
+ 
++/* Reported by Paul Hartman <paul.hartman+linux at gmail.com>
++ * This card reader returns "Illegal Request, Logical Block Address
++ * Out of Range" for the first READ(10) after a new card is inserted.
++ */
++UNUSUAL_DEV(  0x090c, 0x6000, 0x0100, 0x0100,
++		"Feiya",
++		"SD/SDHC Card Reader",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_INITIAL_READ10 ),
++
+ /* This Pentax still camera is not conformant
+  * to the USB storage specification: -
+  * - It does not like the INQUIRY command. So we must handle this command
+@@ -1888,6 +1898,15 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_NO_READ_DISC_INFO ),
+ 
++/* Reported by Sven Geggus <sven-usbst at geggus.net>
++ * This encrypted pen drive returns bogus data for the initial READ(10).
++ */
++UNUSUAL_DEV(  0x1b1c, 0x1ab5, 0x0200, 0x0200,
++		"Corsair",
++		"Padlock v2",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_INITIAL_READ10 ),
++
+ /* Patch by Richard Schütz <r.schtz at t-online.de>
+  * This external hard drive enclosure uses a JMicron chip which
+  * needs the US_FL_IGNORE_RESIDUE flag to work properly. */
+diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
+index 4219c19..07d6d73 100644
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -439,7 +439,8 @@ static void adjust_quirks(struct us_data *us)
+ 			US_FL_CAPACITY_HEURISTICS | US_FL_IGNORE_DEVICE |
+ 			US_FL_NOT_LOCKABLE | US_FL_MAX_SECTORS_64 |
+ 			US_FL_CAPACITY_OK | US_FL_IGNORE_RESIDUE |
+-			US_FL_SINGLE_LUN | US_FL_NO_WP_DETECT);
++			US_FL_SINGLE_LUN | US_FL_NO_WP_DETECT |
++			US_FL_INITIAL_READ10);
+ 
+ 	p = quirks;
+ 	while (*p) {
+@@ -483,6 +484,9 @@ static void adjust_quirks(struct us_data *us)
+ 		case 'm':
+ 			f |= US_FL_MAX_SECTORS_64;
+ 			break;
++		case 'n':
++			f |= US_FL_INITIAL_READ10;
++			break;
+ 		case 'o':
+ 			f |= US_FL_CAPACITY_OK;
+ 			break;
+@@ -946,6 +950,13 @@ int usb_stor_probe2(struct us_data *us)
+ 	if (result)
+ 		goto BadDevice;
+ 
++	/*
++	 * If the device returns invalid data for the first READ(10)
++	 * command, indicate the command should be retried.
++	 */
++	if (us->fflags & US_FL_INITIAL_READ10)
++		set_bit(US_FLIDX_REDO_READ10, &us->dflags);
++
+ 	/* Acquire all the other resources and add the host */
+ 	result = usb_stor_acquire_resources(us);
+ 	if (result)
+diff --git a/drivers/usb/storage/usb.h b/drivers/usb/storage/usb.h
+index 89d3bff..7b0f211 100644
+--- a/drivers/usb/storage/usb.h
++++ b/drivers/usb/storage/usb.h
+@@ -73,6 +73,8 @@ struct us_unusual_dev {
+ #define US_FLIDX_RESETTING	4	/* device reset in progress */
+ #define US_FLIDX_TIMED_OUT	5	/* SCSI midlayer timed out  */
+ #define US_FLIDX_DONT_SCAN	6	/* don't scan (disconnect)  */
++#define US_FLIDX_REDO_READ10	7	/* redo READ(10) command    */
++#define US_FLIDX_READ10_WORKED	8	/* previous READ(10) succeeded */
+ 
+ #define USB_STOR_STRING_LEN 32
+ 
+diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c
+index 53b2c5a..305c975 100644
+--- a/drivers/video/vga16fb.c
++++ b/drivers/video/vga16fb.c
+@@ -1265,9 +1265,11 @@ static void vga16fb_imageblit(struct fb_info *info, const struct fb_image *image
+ 
+ static void vga16fb_destroy(struct fb_info *info)
+ {
++	struct platform_device *dev = container_of(info->device, struct platform_device, dev);
+ 	iounmap(info->screen_base);
+ 	fb_dealloc_cmap(&info->cmap);
+ 	/* XXX unshare VGA regions */
++	platform_set_drvdata(dev, NULL);
+ 	framebuffer_release(info);
+ }
+ 
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 1f2b199..1a2421f 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1272,8 +1272,8 @@ int blkdev_get(struct block_device *bdev, fmode_t mode, void *holder)
+ 		 * individual writeable reference is too fragile given the
+ 		 * way @mode is used in blkdev_get/put().
+ 		 */
+-		if ((disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE) &&
+-		    !res && (mode & FMODE_WRITE) && !bdev->bd_write_holder) {
++		if (!res && (mode & FMODE_WRITE) && !bdev->bd_write_holder &&
++		    (disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE)) {
+ 			bdev->bd_write_holder = true;
+ 			disk_block_events(disk);
+ 		}
+diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
+index d1a016b..ba3d95b 100644
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -184,7 +184,7 @@ int cifs_verify_signature(struct smb_hdr *cifs_pdu,
+ 	if (cifs_pdu == NULL || server == NULL)
+ 		return -EINVAL;
+ 
+-	if (cifs_pdu->Command == SMB_COM_NEGOTIATE)
++	if (!server->session_estab)
+ 		return 0;
+ 
+ 	if (cifs_pdu->Command == SMB_COM_LOCKING_ANDX) {
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 29fac128..5236582 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -199,7 +199,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ 	}
+ 	spin_unlock(&GlobalMid_Lock);
+ 
+-	while (server->tcpStatus == CifsNeedReconnect) {
++	do {
+ 		try_to_freeze();
+ 
+ 		/* we should try only the port we connected to before */
+@@ -214,7 +214,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ 				server->tcpStatus = CifsNeedNegotiate;
+ 			spin_unlock(&GlobalMid_Lock);
+ 		}
+-	}
++	} while (server->tcpStatus == CifsNeedReconnect);
+ 
+ 	return rc;
+ }
+@@ -3208,7 +3208,7 @@ int cifs_negotiate_protocol(unsigned int xid, struct cifsSesInfo *ses)
+ 	}
+ 	if (rc == 0) {
+ 		spin_lock(&GlobalMid_Lock);
+-		if (server->tcpStatus != CifsExiting)
++		if (server->tcpStatus == CifsNeedNegotiate)
+ 			server->tcpStatus = CifsGood;
+ 		else
+ 			rc = -EHOSTDOWN;
+diff --git a/fs/dcookies.c b/fs/dcookies.c
+index a21cabd..dda0dc7 100644
+--- a/fs/dcookies.c
++++ b/fs/dcookies.c
+@@ -178,6 +178,8 @@ SYSCALL_DEFINE(lookup_dcookie)(u64 cookie64, char __user * buf, size_t len)
+ 	/* FIXME: (deleted) ? */
+ 	path = d_path(&dcs->path, kbuf, PAGE_SIZE);
+ 
++	mutex_unlock(&dcookie_mutex);
++
+ 	if (IS_ERR(path)) {
+ 		err = PTR_ERR(path);
+ 		goto out_free;
+@@ -194,6 +196,7 @@ SYSCALL_DEFINE(lookup_dcookie)(u64 cookie64, char __user * buf, size_t len)
+ 
+ out_free:
+ 	kfree(kbuf);
++	return err;
+ out:
+ 	mutex_unlock(&dcookie_mutex);
+ 	return err;
+diff --git a/fs/exec.c b/fs/exec.c
+index 5e62d26..0c3682d 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1046,6 +1046,7 @@ int flush_old_exec(struct linux_binprm * bprm)
+ 
+ 	bprm->mm = NULL;		/* We're using it now */
+ 
++	set_fs(USER_DS);
+ 	current->flags &= ~(PF_RANDOMIZE | PF_KTHREAD);
+ 	flush_thread();
+ 	current->personality &= ~bprm->per_clear;
+@@ -1310,10 +1311,6 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+ 	if (retval)
+ 		return retval;
+ 
+-	/* kernel module loader fixup */
+-	/* so we don't try to load run modprobe in kernel space. */
+-	set_fs(USER_DS);
+-
+ 	retval = audit_bprm(bprm);
+ 	if (retval)
+ 		return retval;
+diff --git a/fs/fat/file.c b/fs/fat/file.c
+index 7257752..7018e1d 100644
+--- a/fs/fat/file.c
++++ b/fs/fat/file.c
+@@ -102,7 +102,7 @@ static int fat_ioctl_set_attributes(struct file *file, u32 __user *user_attr)
+ 		if (attr & ATTR_SYS)
+ 			inode->i_flags |= S_IMMUTABLE;
+ 		else
+-			inode->i_flags &= S_IMMUTABLE;
++			inode->i_flags &= ~S_IMMUTABLE;
+ 	}
+ 
+ 	fat_save_attrs(inode, attr);
+diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
+index aed25e8..e5cb2ce 100644
+--- a/fs/ubifs/journal.c
++++ b/fs/ubifs/journal.c
+@@ -666,6 +666,7 @@ out_free:
+ 
+ out_release:
+ 	release_head(c, BASEHD);
++	kfree(dent);
+ out_ro:
+ 	ubifs_ro_mode(c, err);
+ 	if (last_reference)
+diff --git a/fs/ubifs/shrinker.c b/fs/ubifs/shrinker.c
+index 46961c0..d8f5d0f 100644
+--- a/fs/ubifs/shrinker.c
++++ b/fs/ubifs/shrinker.c
+@@ -283,7 +283,11 @@ int ubifs_shrinker(struct shrinker *shrink, int nr, gfp_t gfp_mask)
+ 	long clean_zn_cnt = atomic_long_read(&ubifs_clean_zn_cnt);
+ 
+ 	if (nr == 0)
+-		return clean_zn_cnt;
++		/*
++		 * Due to the way UBIFS updates the clean znode counter it may
++		 * temporarily be negative.
++		 */
++		return clean_zn_cnt >= 0 ? clean_zn_cnt : 1;
+ 
+ 	if (!clean_zn_cnt) {
+ 		/*
+diff --git a/include/linux/efi.h b/include/linux/efi.h
+index e376270..33fa120 100644
+--- a/include/linux/efi.h
++++ b/include/linux/efi.h
+@@ -299,7 +299,6 @@ extern void efi_initialize_iomem_resources(struct resource *code_resource,
+ 		struct resource *data_resource, struct resource *bss_resource);
+ extern unsigned long efi_get_time(void);
+ extern int efi_set_rtc_mmss(unsigned long nowtime);
+-extern void efi_reserve_boot_services(void);
+ extern struct efi_memory_map memmap;
+ 
+ /**
+diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
+index 71693d4..17df360 100644
+--- a/include/linux/usb_usual.h
++++ b/include/linux/usb_usual.h
+@@ -62,7 +62,9 @@
+ 	US_FLAG(NO_READ_DISC_INFO,	0x00040000)		\
+ 		/* cannot handle READ_DISC_INFO */		\
+ 	US_FLAG(NO_READ_CAPACITY_16,	0x00080000)		\
+-		/* cannot handle READ_CAPACITY_16 */
++		/* cannot handle READ_CAPACITY_16 */		\
++	US_FLAG(INITIAL_READ10,	0x00100000)			\
++		/* Initial READ(10) (and others) must be retried */
+ 
+ #define US_FLAG(name, value)	US_FL_##name = value ,
+ enum { US_DO_ALL_FLAGS };
+diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
+index 2c039c9..51e4944 100644
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -257,13 +257,11 @@ int __init early_irq_init(void)
+ 	count = ARRAY_SIZE(irq_desc);
+ 
+ 	for (i = 0; i < count; i++) {
+-		desc[i].irq_data.irq = i;
+-		desc[i].irq_data.chip = &no_irq_chip;
+ 		desc[i].kstat_irqs = alloc_percpu(unsigned int);
+-		irq_settings_clr_and_set(desc, ~0, _IRQ_DEFAULT_INIT_FLAGS);
+-		alloc_masks(desc + i, GFP_KERNEL, node);
+-		desc_smp_init(desc + i, node);
++		alloc_masks(&desc[i], GFP_KERNEL, node);
++		raw_spin_lock_init(&desc[i].lock);
+ 		lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
++		desc_set_defaults(i, &desc[i], node);
+ 	}
+ 	return arch_early_irq_init();
+ }
+diff --git a/kernel/lockdep.c b/kernel/lockdep.c
+index 53a6895..49452a7 100644
+--- a/kernel/lockdep.c
++++ b/kernel/lockdep.c
+@@ -3242,7 +3242,7 @@ int lock_is_held(struct lockdep_map *lock)
+ 	int ret = 0;
+ 
+ 	if (unlikely(current->lockdep_recursion))
+-		return ret;
++		return 1; /* avoid false negative lockdep_assert_held() */
+ 
+ 	raw_local_irq_save(flags);
+ 	check_flags(flags);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 8ee3bd8..39f86fc 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1033,10 +1033,10 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma,
+ 	 */
+ 	chg = vma_needs_reservation(h, vma, addr);
+ 	if (chg < 0)
+-		return ERR_PTR(chg);
++		return ERR_PTR(-VM_FAULT_OOM);
+ 	if (chg)
+ 		if (hugetlb_get_quota(inode->i_mapping, chg))
+-			return ERR_PTR(-ENOSPC);
++			return ERR_PTR(-VM_FAULT_SIGBUS);
+ 
+ 	spin_lock(&hugetlb_lock);
+ 	page = dequeue_huge_page_vma(h, vma, addr, avoid_reserve);
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index 3e81af1..821590d 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -967,6 +967,10 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
+ 
+ 	mutex_lock(&sdata->u.ibss.mtx);
+ 
++	sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
++	memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
++	sdata->u.ibss.ssid_len = 0;
++
+ 	active_ibss = ieee80211_sta_active_ibss(sdata);
+ 
+ 	if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
+@@ -1000,8 +1004,6 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
+ 	kfree_skb(skb);
+ 
+ 	skb_queue_purge(&sdata->skb_queue);
+-	memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
+-	sdata->u.ibss.ssid_len = 0;
+ 
+ 	del_timer_sync(&sdata->u.ibss.timer);
+ 
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 2c70a1e..29a1ce1 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3239,12 +3239,12 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
+ 	i = 0;
+ 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
+ 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
++			request->ssids[i].ssid_len = nla_len(attr);
+ 			if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
+ 				err = -EINVAL;
+ 				goto out_free;
+ 			}
+ 			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
+-			request->ssids[i].ssid_len = nla_len(attr);
+ 			i++;
+ 		}
+ 	}
+diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
+index ec1bcec..3d2fd14 100644
+--- a/security/apparmor/lsm.c
++++ b/security/apparmor/lsm.c
+@@ -612,7 +612,7 @@ static int apparmor_setprocattr(struct task_struct *task, char *name,
+ static int apparmor_task_setrlimit(struct task_struct *task,
+ 		unsigned int resource, struct rlimit *new_rlim)
+ {
+-	struct aa_profile *profile = aa_current_profile();
++	struct aa_profile *profile = __aa_current_profile();
+ 	int error = 0;
+ 
+ 	if (!unconfined(profile))
+diff --git a/security/tomoyo/mount.c b/security/tomoyo/mount.c
+index 82bf8c2..afa07cf 100644
+--- a/security/tomoyo/mount.c
++++ b/security/tomoyo/mount.c
+@@ -138,7 +138,7 @@ static int tomoyo_mount_acl(struct tomoyo_request_info *r, char *dev_name,
+ 	}
+ 	if (need_dev) {
+ 		/* Get mount point or device file. */
+-		if (kern_path(dev_name, LOOKUP_FOLLOW, &path)) {
++		if (!dev_name || kern_path(dev_name, LOOKUP_FOLLOW, &path)) {
+ 			error = -ENOENT;
+ 			goto out;
+ 		}
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index c82979a..2e95f01 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -13804,6 +13804,7 @@ static struct snd_pci_quirk alc268_cfg_tbl[] = {
+ 	SND_PCI_QUIRK(0x1025, 0x015b, "Acer Aspire One",
+ 						ALC268_ACER_ASPIRE_ONE),
+ 	SND_PCI_QUIRK(0x1028, 0x0253, "Dell OEM", ALC268_DELL),
++	SND_PCI_QUIRK(0x1028, 0x02b0, "Dell Inspiron 910", ALC268_AUTO),
+ 	SND_PCI_QUIRK_MASK(0x1028, 0xfff0, 0x02b0,
+ 			"Dell Inspiron Mini9/Vostro A90", ALC268_DELL),
+ 	/* almost compatible with toshiba but with optional digital outs;
+diff --git a/sound/soc/codecs/ad1836.c b/sound/soc/codecs/ad1836.c
+index ab63d52..754c496 100644
+--- a/sound/soc/codecs/ad1836.c
++++ b/sound/soc/codecs/ad1836.c
+@@ -145,22 +145,22 @@ static int ad1836_hw_params(struct snd_pcm_substream *substream,
+ 	/* bit size */
+ 	switch (params_format(params)) {
+ 	case SNDRV_PCM_FORMAT_S16_LE:
+-		word_len = 3;
++		word_len = AD1836_WORD_LEN_16;
+ 		break;
+ 	case SNDRV_PCM_FORMAT_S20_3LE:
+-		word_len = 1;
++		word_len = AD1836_WORD_LEN_20;
+ 		break;
+ 	case SNDRV_PCM_FORMAT_S24_LE:
+ 	case SNDRV_PCM_FORMAT_S32_LE:
+-		word_len = 0;
++		word_len = AD1836_WORD_LEN_24;
+ 		break;
+ 	}
+ 
+-	snd_soc_update_bits(codec, AD1836_DAC_CTRL1,
+-		AD1836_DAC_WORD_LEN_MASK, word_len);
++	snd_soc_update_bits(codec, AD1836_DAC_CTRL1, AD1836_DAC_WORD_LEN_MASK,
++		word_len << AD1836_DAC_WORD_LEN_OFFSET);
+ 
+-	snd_soc_update_bits(codec, AD1836_ADC_CTRL2,
+-		AD1836_ADC_WORD_LEN_MASK, word_len);
++	snd_soc_update_bits(codec, AD1836_ADC_CTRL2, AD1836_ADC_WORD_LEN_MASK,
++		word_len << AD1836_ADC_WORD_OFFSET);
+ 
+ 	return 0;
+ }
+diff --git a/sound/soc/codecs/ad1836.h b/sound/soc/codecs/ad1836.h
+index 8455967..9d6a3f8 100644
+--- a/sound/soc/codecs/ad1836.h
++++ b/sound/soc/codecs/ad1836.h
+@@ -25,6 +25,7 @@
+ #define AD1836_DAC_SERFMT_PCK256       (0x4 << 5)
+ #define AD1836_DAC_SERFMT_PCK128       (0x5 << 5)
+ #define AD1836_DAC_WORD_LEN_MASK       0x18
++#define AD1836_DAC_WORD_LEN_OFFSET     3
+ 
+ #define AD1836_DAC_CTRL2               1
+ #define AD1836_DACL1_MUTE              0
+@@ -51,6 +52,7 @@
+ #define AD1836_ADCL2_MUTE 		2
+ #define AD1836_ADCR2_MUTE 		3
+ #define AD1836_ADC_WORD_LEN_MASK       0x30
++#define AD1836_ADC_WORD_OFFSET         5
+ #define AD1836_ADC_SERFMT_MASK	       (7 << 6)
+ #define AD1836_ADC_SERFMT_PCK256       (0x4 << 6)
+ #define AD1836_ADC_SERFMT_PCK128       (0x5 << 6)
+@@ -60,4 +62,8 @@
+ 
+ #define AD1836_NUM_REGS                16
+ 
++#define AD1836_WORD_LEN_24 0x0
++#define AD1836_WORD_LEN_20 0x1
++#define AD1836_WORD_LEN_16 0x2
++
+ #endif
+diff --git a/sound/soc/codecs/wm8804.c b/sound/soc/codecs/wm8804.c
+index 6785688..9a5e67c 100644
+--- a/sound/soc/codecs/wm8804.c
++++ b/sound/soc/codecs/wm8804.c
+@@ -680,20 +680,25 @@ static struct snd_soc_dai_ops wm8804_dai_ops = {
+ #define WM8804_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE | \
+ 			SNDRV_PCM_FMTBIT_S24_LE)
+ 
++#define WM8804_RATES (SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_44100 | \
++		      SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_64000 | \
++		      SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000 | \
++		      SNDRV_PCM_RATE_176400 | SNDRV_PCM_RATE_192000)
++
+ static struct snd_soc_dai_driver wm8804_dai = {
+ 	.name = "wm8804-spdif",
+ 	.playback = {
+ 		.stream_name = "Playback",
+ 		.channels_min = 2,
+ 		.channels_max = 2,
+-		.rates = SNDRV_PCM_RATE_8000_192000,
++		.rates = WM8804_RATES,
+ 		.formats = WM8804_FORMATS,
+ 	},
+ 	.capture = {
+ 		.stream_name = "Capture",
+ 		.channels_min = 2,
+ 		.channels_max = 2,
+-		.rates = SNDRV_PCM_RATE_8000_192000,
++		.rates = WM8804_RATES,
+ 		.formats = WM8804_FORMATS,
+ 	},
+ 	.ops = &wm8804_dai_ops,
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 500011e..c22659e 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -1998,12 +1998,12 @@ static int wm8962_put_hp_sw(struct snd_kcontrol *kcontrol,
+ 		return 0;
+ 
+ 	/* If the left PGA is enabled hit that VU bit... */
+-	if (reg_cache[WM8962_PWR_MGMT_2] & WM8962_HPOUTL_PGA_ENA)
++	if (snd_soc_read(codec, WM8962_PWR_MGMT_2) & WM8962_HPOUTL_PGA_ENA)
+ 		return snd_soc_write(codec, WM8962_HPOUTL_VOLUME,
+ 				     reg_cache[WM8962_HPOUTL_VOLUME]);
+ 
+ 	/* ...otherwise the right.  The VU is stereo. */
+-	if (reg_cache[WM8962_PWR_MGMT_2] & WM8962_HPOUTR_PGA_ENA)
++	if (snd_soc_read(codec, WM8962_PWR_MGMT_2) & WM8962_HPOUTR_PGA_ENA)
+ 		return snd_soc_write(codec, WM8962_HPOUTR_VOLUME,
+ 				     reg_cache[WM8962_HPOUTR_VOLUME]);
+ 
+diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
+index ffa09b3..992a732 100644
+--- a/sound/soc/samsung/i2s.c
++++ b/sound/soc/samsung/i2s.c
+@@ -191,7 +191,7 @@ static inline bool tx_active(struct i2s_dai *i2s)
+ 	if (!i2s)
+ 		return false;
+ 
+-	active = readl(i2s->addr + I2SMOD);
++	active = readl(i2s->addr + I2SCON);
+ 
+ 	if (is_secondary(i2s))
+ 		active &= CON_TXSDMA_ACTIVE;
+@@ -223,7 +223,7 @@ static inline bool rx_active(struct i2s_dai *i2s)
+ 	if (!i2s)
+ 		return false;
+ 
+-	active = readl(i2s->addr + I2SMOD) & CON_RXDMA_ACTIVE;
++	active = readl(i2s->addr + I2SCON) & CON_RXDMA_ACTIVE;
+ 
+ 	return active ? true : false;
+ }
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 81c4052..586d10b 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -362,9 +362,9 @@ static int dapm_update_bits(struct snd_soc_dapm_widget *widget)
+ }
+ 
+ /* create new dapm mixer control */
+-static int dapm_new_mixer(struct snd_soc_dapm_context *dapm,
+-	struct snd_soc_dapm_widget *w)
++static int dapm_new_mixer(struct snd_soc_dapm_widget *w)
+ {
++	struct snd_soc_dapm_context *dapm = w->dapm;
+ 	int i, ret = 0;
+ 	size_t name_len, prefix_len;
+ 	struct snd_soc_dapm_path *path;
+@@ -443,9 +443,9 @@ static int dapm_new_mixer(struct snd_soc_dapm_context *dapm,
+ }
+ 
+ /* create new dapm mux control */
+-static int dapm_new_mux(struct snd_soc_dapm_context *dapm,
+-	struct snd_soc_dapm_widget *w)
++static int dapm_new_mux(struct snd_soc_dapm_widget *w)
+ {
++	struct snd_soc_dapm_context *dapm = w->dapm;
+ 	struct snd_soc_dapm_path *path = NULL;
+ 	struct snd_kcontrol *kcontrol;
+ 	struct snd_card *card = dapm->card->snd_card;
+@@ -490,8 +490,7 @@ err:
+ }
+ 
+ /* create new dapm volume control */
+-static int dapm_new_pga(struct snd_soc_dapm_context *dapm,
+-	struct snd_soc_dapm_widget *w)
++static int dapm_new_pga(struct snd_soc_dapm_widget *w)
+ {
+ 	if (w->num_kcontrols)
+ 		dev_err(w->dapm->dev,
+@@ -1735,13 +1734,13 @@ int snd_soc_dapm_new_widgets(struct snd_soc_dapm_context *dapm)
+ 		case snd_soc_dapm_mixer:
+ 		case snd_soc_dapm_mixer_named_ctl:
+ 			w->power_check = dapm_generic_check_power;
+-			dapm_new_mixer(dapm, w);
++			dapm_new_mixer(w);
+ 			break;
+ 		case snd_soc_dapm_mux:
+ 		case snd_soc_dapm_virt_mux:
+ 		case snd_soc_dapm_value_mux:
+ 			w->power_check = dapm_generic_check_power;
+-			dapm_new_mux(dapm, w);
++			dapm_new_mux(w);
+ 			break;
+ 		case snd_soc_dapm_adc:
+ 		case snd_soc_dapm_aif_out:
+@@ -1754,7 +1753,7 @@ int snd_soc_dapm_new_widgets(struct snd_soc_dapm_context *dapm)
+ 		case snd_soc_dapm_pga:
+ 		case snd_soc_dapm_out_drv:
+ 			w->power_check = dapm_generic_check_power;
+-			dapm_new_pga(dapm, w);
++			dapm_new_pga(w);
+ 			break;
+ 		case snd_soc_dapm_input:
+ 		case snd_soc_dapm_output:

Modified: dists/sid/linux-2.6/debian/patches/series/3
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/3	Sat Jun 25 05:30:12 2011	(r17722)
+++ dists/sid/linux-2.6/debian/patches/series/3	Sat Jun 25 08:04:21 2011	(r17723)
@@ -1,2 +1,2 @@
 + bugfix/x86/Revert-drm-i915-Enable-GMBUS-for-post-gen2-chipsets.patch
-+ bugfix/all/block-blkdev_get-should-access-bd_disk-only-after-su.patch
++ bugfix/all/stable/2.6.39.2



More information about the Kernel-svn-changes mailing list