Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-3.2/0100-3.2.1-all-fixes.patch

    Contents of /trunk/kernel-magellan/patches-3.2/0100-3.2.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1644 - (show annotations) (download)
    Thu Feb 16 12:24:52 2012 UTC (12 years, 2 months ago) by niro
    File size: 59100 byte(s) 
    -3.2.6-magellan-r1
    1 diff --git a/Documentation/HOWTO b/Documentation/HOWTO
    2 index 81bc1a9..f7ade3b 100644
    3 --- a/Documentation/HOWTO
    4 +++ b/Documentation/HOWTO
    5 @@ -275,8 +275,8 @@ versions.
    6 If no 2.6.x.y kernel is available, then the highest numbered 2.6.x
    7 kernel is the current stable kernel.
    8
    9 -2.6.x.y are maintained by the "stable" team <stable@kernel.org>, and are
    10 -released as needs dictate. The normal release period is approximately
    11 +2.6.x.y are maintained by the "stable" team <stable@vger.kernel.org>, and
    12 +are released as needs dictate. The normal release period is approximately
    13 two weeks, but it can be longer if there are no pressing problems. A
    14 security-related problem, instead, can cause a release to happen almost
    15 instantly.
    16 diff --git a/Documentation/development-process/5.Posting b/Documentation/development-process/5.Posting
    17 index 903a254..8a48c9b 100644
    18 --- a/Documentation/development-process/5.Posting
    19 +++ b/Documentation/development-process/5.Posting
    20 @@ -271,10 +271,10 @@ copies should go to:
    21 the linux-kernel list.
    22
    23 - If you are fixing a bug, think about whether the fix should go into the
    24 - next stable update. If so, stable@kernel.org should get a copy of the
    25 - patch. Also add a "Cc: stable@kernel.org" to the tags within the patch
    26 - itself; that will cause the stable team to get a notification when your
    27 - fix goes into the mainline.
    28 + next stable update. If so, stable@vger.kernel.org should get a copy of
    29 + the patch. Also add a "Cc: stable@vger.kernel.org" to the tags within
    30 + the patch itself; that will cause the stable team to get a notification
    31 + when your fix goes into the mainline.
    32
    33 When selecting recipients for a patch, it is good to have an idea of who
    34 you think will eventually accept the patch and get it merged. While it
    35 diff --git a/Documentation/usb/usbmon.txt b/Documentation/usb/usbmon.txt
    36 index a4efa04..5335fa8 100644
    37 --- a/Documentation/usb/usbmon.txt
    38 +++ b/Documentation/usb/usbmon.txt
    39 @@ -47,10 +47,11 @@ This allows to filter away annoying devices that talk continuously.
    40
    41 2. Find which bus connects to the desired device
    42
    43 -Run "cat /proc/bus/usb/devices", and find the T-line which corresponds to
    44 -the device. Usually you do it by looking for the vendor string. If you have
    45 -many similar devices, unplug one and compare two /proc/bus/usb/devices outputs.
    46 -The T-line will have a bus number. Example:
    47 +Run "cat /sys/kernel/debug/usb/devices", and find the T-line which corresponds
    48 +to the device. Usually you do it by looking for the vendor string. If you have
    49 +many similar devices, unplug one and compare the two
    50 +/sys/kernel/debug/usb/devices outputs. The T-line will have a bus number.
    51 +Example:
    52
    53 T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
    54 D: Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
    55 @@ -58,7 +59,10 @@ P: Vendor=0557 ProdID=2004 Rev= 1.00
    56 S: Manufacturer=ATEN
    57 S: Product=UC100KM V2.00
    58
    59 -Bus=03 means it's bus 3.
    60 +"Bus=03" means it's bus 3. Alternatively, you can look at the output from
    61 +"lsusb" and get the bus number from the appropriate line. Example:
    62 +
    63 +Bus 003 Device 002: ID 0557:2004 ATEN UC100KM V2.00
    64
    65 3. Start 'cat'
    66
    67 diff --git a/MAINTAINERS b/MAINTAINERS
    68 index 62f1cd3..f986e7d 100644
    69 --- a/MAINTAINERS
    70 +++ b/MAINTAINERS
    71 @@ -6258,7 +6258,7 @@ F: arch/alpha/kernel/srm_env.c
    72
    73 STABLE BRANCH
    74 M: Greg Kroah-Hartman <greg@kroah.com>
    75 -L: stable@kernel.org
    76 +L: stable@vger.kernel.org
    77 S: Maintained
    78
    79 STAGING SUBSYSTEM
    80 diff --git a/arch/powerpc/include/asm/time.h b/arch/powerpc/include/asm/time.h
    81 index fe6f7c2..bc3c745 100644
    82 --- a/arch/powerpc/include/asm/time.h
    83 +++ b/arch/powerpc/include/asm/time.h
    84 @@ -219,5 +219,7 @@ DECLARE_PER_CPU(struct cpu_usage, cpu_usage_array);
    85 extern void secondary_cpu_time_init(void);
    86 extern void iSeries_time_init_early(void);
    87
    88 +extern void decrementer_check_overflow(void);
    89 +
    90 #endif /* __KERNEL__ */
    91 #endif /* __POWERPC_TIME_H */
    92 diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
    93 index 5c3c469..745c1e7 100644
    94 --- a/arch/powerpc/kernel/irq.c
    95 +++ b/arch/powerpc/kernel/irq.c
    96 @@ -164,16 +164,13 @@ notrace void arch_local_irq_restore(unsigned long en)
    97 */
    98 local_paca->hard_enabled = en;
    99
    100 -#ifndef CONFIG_BOOKE
    101 - /* On server, re-trigger the decrementer if it went negative since
    102 - * some processors only trigger on edge transitions of the sign bit.
    103 - *
    104 - * BookE has a level sensitive decrementer (latches in TSR) so we
    105 - * don't need that
    106 + /*
    107 + * Trigger the decrementer if we have a pending event. Some processors
    108 + * only trigger on edge transitions of the sign bit. We might also
    109 + * have disabled interrupts long enough that the decrementer wrapped
    110 + * to positive.
    111 */
    112 - if ((int)mfspr(SPRN_DEC) < 0)
    113 - mtspr(SPRN_DEC, 1);
    114 -#endif /* CONFIG_BOOKE */
    115 + decrementer_check_overflow();
    116
    117 /*
    118 * Force the delivery of pending soft-disabled interrupts on PS3.
    119 diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
    120 index 522bb1d..5db163c 100644
    121 --- a/arch/powerpc/kernel/time.c
    122 +++ b/arch/powerpc/kernel/time.c
    123 @@ -889,6 +889,15 @@ static void __init clocksource_init(void)
    124 clock->name, clock->mult, clock->shift);
    125 }
    126
    127 +void decrementer_check_overflow(void)
    128 +{
    129 + u64 now = get_tb_or_rtc();
    130 + struct decrementer_clock *decrementer = &__get_cpu_var(decrementers);
    131 +
    132 + if (now >= decrementer->next_tb)
    133 + set_dec(1);
    134 +}
    135 +
    136 static int decrementer_set_next_event(unsigned long evt,
    137 struct clock_event_device *dev)
    138 {
    139 diff --git a/arch/powerpc/platforms/pseries/hvCall_inst.c b/arch/powerpc/platforms/pseries/hvCall_inst.c
    140 index f106662..c9311cf 100644
    141 --- a/arch/powerpc/platforms/pseries/hvCall_inst.c
    142 +++ b/arch/powerpc/platforms/pseries/hvCall_inst.c
    143 @@ -109,7 +109,7 @@ static void probe_hcall_entry(void *ignored, unsigned long opcode, unsigned long
    144 if (opcode > MAX_HCALL_OPCODE)
    145 return;
    146
    147 - h = &get_cpu_var(hcall_stats)[opcode / 4];
    148 + h = &__get_cpu_var(hcall_stats)[opcode / 4];
    149 h->tb_start = mftb();
    150 h->purr_start = mfspr(SPRN_PURR);
    151 }
    152 @@ -126,8 +126,6 @@ static void probe_hcall_exit(void *ignored, unsigned long opcode, unsigned long
    153 h->num_calls++;
    154 h->tb_total += mftb() - h->tb_start;
    155 h->purr_total += mfspr(SPRN_PURR) - h->purr_start;
    156 -
    157 - put_cpu_var(hcall_stats);
    158 }
    159
    160 static int __init hcall_inst_init(void)
    161 diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
    162 index 27a4950..dc36ea6 100644
    163 --- a/arch/powerpc/platforms/pseries/lpar.c
    164 +++ b/arch/powerpc/platforms/pseries/lpar.c
    165 @@ -554,6 +554,7 @@ void __trace_hcall_entry(unsigned long opcode, unsigned long *args)
    166 goto out;
    167
    168 (*depth)++;
    169 + preempt_disable();
    170 trace_hcall_entry(opcode, args);
    171 (*depth)--;
    172
    173 @@ -576,6 +577,7 @@ void __trace_hcall_exit(long opcode, unsigned long retval,
    174
    175 (*depth)++;
    176 trace_hcall_exit(opcode, retval, retbuf);
    177 + preempt_enable();
    178 (*depth)--;
    179
    180 out:
    181 diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
    182 index 06ed6b4..3719c94 100644
    183 --- a/drivers/base/firmware_class.c
    184 +++ b/drivers/base/firmware_class.c
    185 @@ -226,13 +226,13 @@ static ssize_t firmware_loading_store(struct device *dev,
    186 int loading = simple_strtol(buf, NULL, 10);
    187 int i;
    188
    189 + mutex_lock(&fw_lock);
    190 +
    191 + if (!fw_priv->fw)
    192 + goto out;
    193 +
    194 switch (loading) {
    195 case 1:
    196 - mutex_lock(&fw_lock);
    197 - if (!fw_priv->fw) {
    198 - mutex_unlock(&fw_lock);
    199 - break;
    200 - }
    201 firmware_free_data(fw_priv->fw);
    202 memset(fw_priv->fw, 0, sizeof(struct firmware));
    203 /* If the pages are not owned by 'struct firmware' */
    204 @@ -243,7 +243,6 @@ static ssize_t firmware_loading_store(struct device *dev,
    205 fw_priv->page_array_size = 0;
    206 fw_priv->nr_pages = 0;
    207 set_bit(FW_STATUS_LOADING, &fw_priv->status);
    208 - mutex_unlock(&fw_lock);
    209 break;
    210 case 0:
    211 if (test_bit(FW_STATUS_LOADING, &fw_priv->status)) {
    212 @@ -274,7 +273,8 @@ static ssize_t firmware_loading_store(struct device *dev,
    213 fw_load_abort(fw_priv);
    214 break;
    215 }
    216 -
    217 +out:
    218 + mutex_unlock(&fw_lock);
    219 return count;
    220 }
    221
    222 diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
    223 index 30a3085..fda56bd 100644
    224 --- a/drivers/bcma/bcma_private.h
    225 +++ b/drivers/bcma/bcma_private.h
    226 @@ -18,6 +18,9 @@ void bcma_bus_unregister(struct bcma_bus *bus);
    227 int __init bcma_bus_early_register(struct bcma_bus *bus,
    228 struct bcma_device *core_cc,
    229 struct bcma_device *core_mips);
    230 +#ifdef CONFIG_PM
    231 +int bcma_bus_resume(struct bcma_bus *bus);
    232 +#endif
    233
    234 /* scan.c */
    235 int bcma_bus_scan(struct bcma_bus *bus);
    236 diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
    237 index 1b51d8b..990f5a8 100644
    238 --- a/drivers/bcma/host_pci.c
    239 +++ b/drivers/bcma/host_pci.c
    240 @@ -224,6 +224,41 @@ static void bcma_host_pci_remove(struct pci_dev *dev)
    241 pci_set_drvdata(dev, NULL);
    242 }
    243
    244 +#ifdef CONFIG_PM
    245 +static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
    246 +{
    247 + /* Host specific */
    248 + pci_save_state(dev);
    249 + pci_disable_device(dev);
    250 + pci_set_power_state(dev, pci_choose_state(dev, state));
    251 +
    252 + return 0;
    253 +}
    254 +
    255 +static int bcma_host_pci_resume(struct pci_dev *dev)
    256 +{
    257 + struct bcma_bus *bus = pci_get_drvdata(dev);
    258 + int err;
    259 +
    260 + /* Host specific */
    261 + pci_set_power_state(dev, 0);
    262 + err = pci_enable_device(dev);
    263 + if (err)
    264 + return err;
    265 + pci_restore_state(dev);
    266 +
    267 + /* Bus specific */
    268 + err = bcma_bus_resume(bus);
    269 + if (err)
    270 + return err;
    271 +
    272 + return 0;
    273 +}
    274 +#else /* CONFIG_PM */
    275 +# define bcma_host_pci_suspend NULL
    276 +# define bcma_host_pci_resume NULL
    277 +#endif /* CONFIG_PM */
    278 +
    279 static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
    280 { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
    281 { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
    282 @@ -239,6 +274,8 @@ static struct pci_driver bcma_pci_bridge_driver = {
    283 .id_table = bcma_pci_bridge_tbl,
    284 .probe = bcma_host_pci_probe,
    285 .remove = bcma_host_pci_remove,
    286 + .suspend = bcma_host_pci_suspend,
    287 + .resume = bcma_host_pci_resume,
    288 };
    289
    290 int __init bcma_host_pci_init(void)
    291 diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
    292 index 70c84b9..10f92b3 100644
    293 --- a/drivers/bcma/main.c
    294 +++ b/drivers/bcma/main.c
    295 @@ -240,6 +240,22 @@ int __init bcma_bus_early_register(struct bcma_bus *bus,
    296 return 0;
    297 }
    298
    299 +#ifdef CONFIG_PM
    300 +int bcma_bus_resume(struct bcma_bus *bus)
    301 +{
    302 + struct bcma_device *core;
    303 +
    304 + /* Init CC core */
    305 + core = bcma_find_core(bus, BCMA_CORE_CHIPCOMMON);
    306 + if (core) {
    307 + bus->drv_cc.setup_done = false;
    308 + bcma_core_chipcommon_init(&bus->drv_cc);
    309 + }
    310 +
    311 + return 0;
    312 +}
    313 +#endif
    314 +
    315 int __bcma_driver_register(struct bcma_driver *drv, struct module *owner)
    316 {
    317 drv->drv.name = drv->name;
    318 diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
    319 index 0c048dd..d2d0a2a 100644
    320 --- a/drivers/hv/vmbus_drv.c
    321 +++ b/drivers/hv/vmbus_drv.c
    322 @@ -62,6 +62,14 @@ struct hv_device_info {
    323 struct hv_dev_port_info outbound;
    324 };
    325
    326 +static int vmbus_exists(void)
    327 +{
    328 + if (hv_acpi_dev == NULL)
    329 + return -ENODEV;
    330 +
    331 + return 0;
    332 +}
    333 +
    334
    335 static void get_channel_info(struct hv_device *device,
    336 struct hv_device_info *info)
    337 @@ -590,6 +598,10 @@ int __vmbus_driver_register(struct hv_driver *hv_driver, struct module *owner, c
    338
    339 pr_info("registering driver %s\n", hv_driver->name);
    340
    341 + ret = vmbus_exists();
    342 + if (ret < 0)
    343 + return ret;
    344 +
    345 hv_driver->driver.name = hv_driver->name;
    346 hv_driver->driver.owner = owner;
    347 hv_driver->driver.mod_name = mod_name;
    348 @@ -614,8 +626,8 @@ void vmbus_driver_unregister(struct hv_driver *hv_driver)
    349 {
    350 pr_info("unregistering driver %s\n", hv_driver->name);
    351
    352 - driver_unregister(&hv_driver->driver);
    353 -
    354 + if (!vmbus_exists())
    355 + driver_unregister(&hv_driver->driver);
    356 }
    357 EXPORT_SYMBOL_GPL(vmbus_driver_unregister);
    358
    359 @@ -776,6 +788,7 @@ static int __init hv_acpi_init(void)
    360
    361 cleanup:
    362 acpi_bus_unregister_driver(&vmbus_acpi_driver);
    363 + hv_acpi_dev = NULL;
    364 return ret;
    365 }
    366
    367 diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
    368 index 254f164..e3db8ef 100644
    369 --- a/drivers/infiniband/core/uverbs_cmd.c
    370 +++ b/drivers/infiniband/core/uverbs_cmd.c
    371 @@ -241,11 +241,24 @@ static struct ib_qp *idr_read_qp(int qp_handle, struct ib_ucontext *context)
    372 return idr_read_obj(&ib_uverbs_qp_idr, qp_handle, context, 0);
    373 }
    374
    375 +static struct ib_qp *idr_write_qp(int qp_handle, struct ib_ucontext *context)
    376 +{
    377 + struct ib_uobject *uobj;
    378 +
    379 + uobj = idr_write_uobj(&ib_uverbs_qp_idr, qp_handle, context);
    380 + return uobj ? uobj->object : NULL;
    381 +}
    382 +
    383 static void put_qp_read(struct ib_qp *qp)
    384 {
    385 put_uobj_read(qp->uobject);
    386 }
    387
    388 +static void put_qp_write(struct ib_qp *qp)
    389 +{
    390 + put_uobj_write(qp->uobject);
    391 +}
    392 +
    393 static struct ib_srq *idr_read_srq(int srq_handle, struct ib_ucontext *context)
    394 {
    395 return idr_read_obj(&ib_uverbs_srq_idr, srq_handle, context, 0);
    396 @@ -2375,7 +2388,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
    397 if (copy_from_user(&cmd, buf, sizeof cmd))
    398 return -EFAULT;
    399
    400 - qp = idr_read_qp(cmd.qp_handle, file->ucontext);
    401 + qp = idr_write_qp(cmd.qp_handle, file->ucontext);
    402 if (!qp)
    403 return -EINVAL;
    404
    405 @@ -2404,7 +2417,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
    406 kfree(mcast);
    407
    408 out_put:
    409 - put_qp_read(qp);
    410 + put_qp_write(qp);
    411
    412 return ret ? ret : in_len;
    413 }
    414 @@ -2422,7 +2435,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
    415 if (copy_from_user(&cmd, buf, sizeof cmd))
    416 return -EFAULT;
    417
    418 - qp = idr_read_qp(cmd.qp_handle, file->ucontext);
    419 + qp = idr_write_qp(cmd.qp_handle, file->ucontext);
    420 if (!qp)
    421 return -EINVAL;
    422
    423 @@ -2441,7 +2454,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
    424 }
    425
    426 out_put:
    427 - put_qp_read(qp);
    428 + put_qp_write(qp);
    429
    430 return ret ? ret : in_len;
    431 }
    432 diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
    433 index 781a802..4f18e2d 100644
    434 --- a/drivers/infiniband/hw/qib/qib_iba6120.c
    435 +++ b/drivers/infiniband/hw/qib/qib_iba6120.c
    436 @@ -2076,9 +2076,11 @@ static void qib_6120_config_ctxts(struct qib_devdata *dd)
    437 static void qib_update_6120_usrhead(struct qib_ctxtdata *rcd, u64 hd,
    438 u32 updegr, u32 egrhd, u32 npkts)
    439 {
    440 - qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
    441 if (updegr)
    442 qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
    443 + mmiowb();
    444 + qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
    445 + mmiowb();
    446 }
    447
    448 static u32 qib_6120_hdrqempty(struct qib_ctxtdata *rcd)
    449 diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
    450 index 439d3c5..7ec4048 100644
    451 --- a/drivers/infiniband/hw/qib/qib_iba7220.c
    452 +++ b/drivers/infiniband/hw/qib/qib_iba7220.c
    453 @@ -2725,9 +2725,11 @@ static int qib_7220_set_loopback(struct qib_pportdata *ppd, const char *what)
    454 static void qib_update_7220_usrhead(struct qib_ctxtdata *rcd, u64 hd,
    455 u32 updegr, u32 egrhd, u32 npkts)
    456 {
    457 - qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
    458 if (updegr)
    459 qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
    460 + mmiowb();
    461 + qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
    462 + mmiowb();
    463 }
    464
    465 static u32 qib_7220_hdrqempty(struct qib_ctxtdata *rcd)
    466 diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
    467 index 1d58959..5a070e8 100644
    468 --- a/drivers/infiniband/hw/qib/qib_iba7322.c
    469 +++ b/drivers/infiniband/hw/qib/qib_iba7322.c
    470 @@ -4082,10 +4082,12 @@ static void qib_update_7322_usrhead(struct qib_ctxtdata *rcd, u64 hd,
    471 */
    472 if (hd >> IBA7322_HDRHEAD_PKTINT_SHIFT)
    473 adjust_rcv_timeout(rcd, npkts);
    474 - qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
    475 - qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
    476 if (updegr)
    477 qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
    478 + mmiowb();
    479 + qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
    480 + qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
    481 + mmiowb();
    482 }
    483
    484 static u32 qib_7322_hdrqempty(struct qib_ctxtdata *rcd)
    485 diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
    486 index 7f87568..e58aa2b 100644
    487 --- a/drivers/net/bonding/bond_main.c
    488 +++ b/drivers/net/bonding/bond_main.c
    489 @@ -1822,7 +1822,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
    490 "but new slave device does not support netpoll.\n",
    491 bond_dev->name);
    492 res = -EBUSY;
    493 - goto err_close;
    494 + goto err_detach;
    495 }
    496 }
    497 #endif
    498 @@ -1831,7 +1831,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
    499
    500 res = bond_create_slave_symlinks(bond_dev, slave_dev);
    501 if (res)
    502 - goto err_close;
    503 + goto err_detach;
    504
    505 res = netdev_rx_handler_register(slave_dev, bond_handle_frame,
    506 new_slave);
    507 @@ -1852,6 +1852,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
    508 err_dest_symlinks:
    509 bond_destroy_slave_symlinks(bond_dev, slave_dev);
    510
    511 +err_detach:
    512 + write_lock_bh(&bond->lock);
    513 + bond_detach_slave(bond, new_slave);
    514 + write_unlock_bh(&bond->lock);
    515 +
    516 err_close:
    517 dev_close(slave_dev);
    518
    519 diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
    520 index e95f0e6..dd2625a 100644
    521 --- a/drivers/net/usb/asix.c
    522 +++ b/drivers/net/usb/asix.c
    523 @@ -376,7 +376,7 @@ static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
    524
    525 skb_pull(skb, (size + 1) & 0xfffe);
    526
    527 - if (skb->len == 0)
    528 + if (skb->len < sizeof(header))
    529 break;
    530
    531 head = (u8 *) skb->data;
    532 diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
    533 index 69d5f85..8b9ff28 100644
    534 --- a/drivers/net/wireless/iwlwifi/iwl-commands.h
    535 +++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
    536 @@ -809,7 +809,7 @@ struct iwl_qosparam_cmd {
    537 #define IWLAGN_STATION_COUNT 16
    538
    539 #define IWL_INVALID_STATION 255
    540 -#define IWL_MAX_TID_COUNT 9
    541 +#define IWL_MAX_TID_COUNT 8
    542
    543 #define STA_FLG_TX_RATE_MSK cpu_to_le32(1 << 2)
    544 #define STA_FLG_PWR_SAVE_MSK cpu_to_le32(1 << 8)
    545 diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
    546 index 2b6756e..5c29281 100644
    547 --- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
    548 +++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
    549 @@ -219,9 +219,7 @@ struct iwl_trans_pcie {
    550
    551 /* INT ICT Table */
    552 __le32 *ict_tbl;
    553 - void *ict_tbl_vir;
    554 dma_addr_t ict_tbl_dma;
    555 - dma_addr_t aligned_ict_tbl_dma;
    556 int ict_index;
    557 u32 inta;
    558 bool use_ict;
    559 diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
    560 index 374c68c..1920237 100644
    561 --- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
    562 +++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
    563 @@ -1136,7 +1136,11 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
    564 * ICT functions
    565 *
    566 ******************************************************************************/
    567 -#define ICT_COUNT (PAGE_SIZE/sizeof(u32))
    568 +
    569 +/* a device (PCI-E) page is 4096 bytes long */
    570 +#define ICT_SHIFT 12
    571 +#define ICT_SIZE (1 << ICT_SHIFT)
    572 +#define ICT_COUNT (ICT_SIZE / sizeof(u32))
    573
    574 /* Free dram table */
    575 void iwl_free_isr_ict(struct iwl_trans *trans)
    576 @@ -1144,21 +1148,19 @@ void iwl_free_isr_ict(struct iwl_trans *trans)
    577 struct iwl_trans_pcie *trans_pcie =
    578 IWL_TRANS_GET_PCIE_TRANS(trans);
    579
    580 - if (trans_pcie->ict_tbl_vir) {
    581 - dma_free_coherent(bus(trans)->dev,
    582 - (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
    583 - trans_pcie->ict_tbl_vir,
    584 + if (trans_pcie->ict_tbl) {
    585 + dma_free_coherent(bus(trans)->dev, ICT_SIZE,
    586 + trans_pcie->ict_tbl,
    587 trans_pcie->ict_tbl_dma);
    588 - trans_pcie->ict_tbl_vir = NULL;
    589 - memset(&trans_pcie->ict_tbl_dma, 0,
    590 - sizeof(trans_pcie->ict_tbl_dma));
    591 - memset(&trans_pcie->aligned_ict_tbl_dma, 0,
    592 - sizeof(trans_pcie->aligned_ict_tbl_dma));
    593 + trans_pcie->ict_tbl = NULL;
    594 + trans_pcie->ict_tbl_dma = 0;
    595 }
    596 }
    597
    598
    599 -/* allocate dram shared table it is a PAGE_SIZE aligned
    600 +/*
    601 + * allocate dram shared table, it is an aligned memory
    602 + * block of ICT_SIZE.
    603 * also reset all data related to ICT table interrupt.
    604 */
    605 int iwl_alloc_isr_ict(struct iwl_trans *trans)
    606 @@ -1166,36 +1168,26 @@ int iwl_alloc_isr_ict(struct iwl_trans *trans)
    607 struct iwl_trans_pcie *trans_pcie =
    608 IWL_TRANS_GET_PCIE_TRANS(trans);
    609
    610 - /* allocate shrared data table */
    611 - trans_pcie->ict_tbl_vir =
    612 - dma_alloc_coherent(bus(trans)->dev,
    613 - (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
    614 - &trans_pcie->ict_tbl_dma, GFP_KERNEL);
    615 - if (!trans_pcie->ict_tbl_vir)
    616 + trans_pcie->ict_tbl =
    617 + dma_alloc_coherent(bus(trans)->dev, ICT_SIZE,
    618 + &trans_pcie->ict_tbl_dma,
    619 + GFP_KERNEL);
    620 + if (!trans_pcie->ict_tbl)
    621 return -ENOMEM;
    622
    623 - /* align table to PAGE_SIZE boundary */
    624 - trans_pcie->aligned_ict_tbl_dma =
    625 - ALIGN(trans_pcie->ict_tbl_dma, PAGE_SIZE);
    626 -
    627 - IWL_DEBUG_ISR(trans, "ict dma addr %Lx dma aligned %Lx diff %d\n",
    628 - (unsigned long long)trans_pcie->ict_tbl_dma,
    629 - (unsigned long long)trans_pcie->aligned_ict_tbl_dma,
    630 - (int)(trans_pcie->aligned_ict_tbl_dma -
    631 - trans_pcie->ict_tbl_dma));
    632 + /* just an API sanity check ... it is guaranteed to be aligned */
    633 + if (WARN_ON(trans_pcie->ict_tbl_dma & (ICT_SIZE - 1))) {
    634 + iwl_free_isr_ict(trans);
    635 + return -EINVAL;
    636 + }
    637
    638 - trans_pcie->ict_tbl = trans_pcie->ict_tbl_vir +
    639 - (trans_pcie->aligned_ict_tbl_dma -
    640 - trans_pcie->ict_tbl_dma);
    641 + IWL_DEBUG_ISR(trans, "ict dma addr %Lx\n",
    642 + (unsigned long long)trans_pcie->ict_tbl_dma);
    643
    644 - IWL_DEBUG_ISR(trans, "ict vir addr %p vir aligned %p diff %d\n",
    645 - trans_pcie->ict_tbl, trans_pcie->ict_tbl_vir,
    646 - (int)(trans_pcie->aligned_ict_tbl_dma -
    647 - trans_pcie->ict_tbl_dma));
    648 + IWL_DEBUG_ISR(trans, "ict vir addr %p\n", trans_pcie->ict_tbl);
    649
    650 /* reset table and index to all 0 */
    651 - memset(trans_pcie->ict_tbl_vir, 0,
    652 - (sizeof(u32) * ICT_COUNT) + PAGE_SIZE);
    653 + memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
    654 trans_pcie->ict_index = 0;
    655
    656 /* add periodic RX interrupt */
    657 @@ -1213,23 +1205,20 @@ int iwl_reset_ict(struct iwl_trans *trans)
    658 struct iwl_trans_pcie *trans_pcie =
    659 IWL_TRANS_GET_PCIE_TRANS(trans);
    660
    661 - if (!trans_pcie->ict_tbl_vir)
    662 + if (!trans_pcie->ict_tbl)
    663 return 0;
    664
    665 spin_lock_irqsave(&trans->shrd->lock, flags);
    666 iwl_disable_interrupts(trans);
    667
    668 - memset(&trans_pcie->ict_tbl[0], 0, sizeof(u32) * ICT_COUNT);
    669 + memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
    670
    671 - val = trans_pcie->aligned_ict_tbl_dma >> PAGE_SHIFT;
    672 + val = trans_pcie->ict_tbl_dma >> ICT_SHIFT;
    673
    674 val |= CSR_DRAM_INT_TBL_ENABLE;
    675 val |= CSR_DRAM_INIT_TBL_WRAP_CHECK;
    676
    677 - IWL_DEBUG_ISR(trans, "CSR_DRAM_INT_TBL_REG =0x%X "
    678 - "aligned dma address %Lx\n",
    679 - val,
    680 - (unsigned long long)trans_pcie->aligned_ict_tbl_dma);
    681 + IWL_DEBUG_ISR(trans, "CSR_DRAM_INT_TBL_REG =0x%x\n", val);
    682
    683 iwl_write32(bus(trans), CSR_DRAM_INT_TBL_REG, val);
    684 trans_pcie->use_ict = true;
    685 diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
    686 index a7f1ab2..db64ef1 100644
    687 --- a/drivers/net/wireless/libertas/cfg.c
    688 +++ b/drivers/net/wireless/libertas/cfg.c
    689 @@ -728,9 +728,11 @@ static void lbs_scan_worker(struct work_struct *work)
    690 le16_to_cpu(scan_cmd->hdr.size),
    691 lbs_ret_scan, 0);
    692
    693 - if (priv->scan_channel >= priv->scan_req->n_channels)
    694 + if (priv->scan_channel >= priv->scan_req->n_channels) {
    695 /* Mark scan done */
    696 + cancel_delayed_work(&priv->scan_work);
    697 lbs_scan_done(priv);
    698 + }
    699
    700 /* Restart network */
    701 if (carrier)
    702 @@ -759,12 +761,12 @@ static void _internal_start_scan(struct lbs_private *priv, bool internal,
    703 request->n_ssids, request->n_channels, request->ie_len);
    704
    705 priv->scan_channel = 0;
    706 - queue_delayed_work(priv->work_thread, &priv->scan_work,
    707 - msecs_to_jiffies(50));
    708 -
    709 priv->scan_req = request;
    710 priv->internal_scan = internal;
    711
    712 + queue_delayed_work(priv->work_thread, &priv->scan_work,
    713 + msecs_to_jiffies(50));
    714 +
    715 lbs_deb_leave(LBS_DEB_CFG80211);
    716 }
    717
    718 diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
    719 index 3778763..3265b34 100644
    720 --- a/drivers/net/wireless/rt2x00/rt2800usb.c
    721 +++ b/drivers/net/wireless/rt2x00/rt2800usb.c
    722 @@ -976,6 +976,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
    723 { USB_DEVICE(0x13b1, 0x0031) },
    724 { USB_DEVICE(0x1737, 0x0070) },
    725 { USB_DEVICE(0x1737, 0x0071) },
    726 + { USB_DEVICE(0x1737, 0x0077) },
    727 /* Logitec */
    728 { USB_DEVICE(0x0789, 0x0162) },
    729 { USB_DEVICE(0x0789, 0x0163) },
    730 @@ -1171,7 +1172,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
    731 { USB_DEVICE(0x1740, 0x0605) },
    732 { USB_DEVICE(0x1740, 0x0615) },
    733 /* Linksys */
    734 - { USB_DEVICE(0x1737, 0x0077) },
    735 { USB_DEVICE(0x1737, 0x0078) },
    736 /* Logitec */
    737 { USB_DEVICE(0x0789, 0x0168) },
    738 diff --git a/drivers/net/wireless/wl12xx/boot.c b/drivers/net/wireless/wl12xx/boot.c
    739 index 6813379..a7b327d 100644
    740 --- a/drivers/net/wireless/wl12xx/boot.c
    741 +++ b/drivers/net/wireless/wl12xx/boot.c
    742 @@ -347,6 +347,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
    743 nvs_ptr += 3;
    744
    745 for (i = 0; i < burst_len; i++) {
    746 + if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len)
    747 + goto out_badnvs;
    748 +
    749 val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
    750 | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
    751
    752 @@ -358,6 +361,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
    753 nvs_ptr += 4;
    754 dest_addr += 4;
    755 }
    756 +
    757 + if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
    758 + goto out_badnvs;
    759 }
    760
    761 /*
    762 @@ -369,6 +375,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
    763 */
    764 nvs_ptr = (u8 *)wl->nvs +
    765 ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4);
    766 +
    767 + if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
    768 + goto out_badnvs;
    769 +
    770 nvs_len -= nvs_ptr - (u8 *)wl->nvs;
    771
    772 /* Now we must set the partition correctly */
    773 @@ -384,6 +394,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
    774
    775 kfree(nvs_aligned);
    776 return 0;
    777 +
    778 +out_badnvs:
    779 + wl1271_error("nvs data is malformed");
    780 + return -EILSEQ;
    781 }
    782
    783 static void wl1271_boot_enable_interrupts(struct wl1271 *wl)
    784 diff --git a/drivers/net/wireless/wl12xx/cmd.c b/drivers/net/wireless/wl12xx/cmd.c
    785 index a52299e..54a0d66 100644
    786 --- a/drivers/net/wireless/wl12xx/cmd.c
    787 +++ b/drivers/net/wireless/wl12xx/cmd.c
    788 @@ -120,6 +120,11 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
    789 if (!wl->nvs)
    790 return -ENODEV;
    791
    792 + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
    793 + wl1271_warning("FEM index from INI out of bounds");
    794 + return -EINVAL;
    795 + }
    796 +
    797 gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
    798 if (!gen_parms)
    799 return -ENOMEM;
    800 @@ -143,6 +148,12 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
    801 gp->tx_bip_fem_manufacturer =
    802 gen_parms->general_params.tx_bip_fem_manufacturer;
    803
    804 + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
    805 + wl1271_warning("FEM index from FW out of bounds");
    806 + ret = -EINVAL;
    807 + goto out;
    808 + }
    809 +
    810 wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
    811 answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
    812
    813 @@ -162,6 +173,11 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
    814 if (!wl->nvs)
    815 return -ENODEV;
    816
    817 + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
    818 + wl1271_warning("FEM index from ini out of bounds");
    819 + return -EINVAL;
    820 + }
    821 +
    822 gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
    823 if (!gen_parms)
    824 return -ENOMEM;
    825 @@ -186,6 +202,12 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
    826 gp->tx_bip_fem_manufacturer =
    827 gen_parms->general_params.tx_bip_fem_manufacturer;
    828
    829 + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
    830 + wl1271_warning("FEM index from FW out of bounds");
    831 + ret = -EINVAL;
    832 + goto out;
    833 + }
    834 +
    835 wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
    836 answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
    837
    838 diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c
    839 index 4ae8eff..abfb120 100644
    840 --- a/drivers/net/wireless/wl12xx/testmode.c
    841 +++ b/drivers/net/wireless/wl12xx/testmode.c
    842 @@ -36,6 +36,7 @@ enum wl1271_tm_commands {
    843 WL1271_TM_CMD_TEST,
    844 WL1271_TM_CMD_INTERROGATE,
    845 WL1271_TM_CMD_CONFIGURE,
    846 + WL1271_TM_CMD_NVS_PUSH, /* Not in use. Keep to not break ABI */
    847 WL1271_TM_CMD_SET_PLT_MODE,
    848 WL1271_TM_CMD_RECOVER,
    849
    850 diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
    851 index 4c823f3..90c8e3a 100644
    852 --- a/drivers/tty/serial/atmel_serial.c
    853 +++ b/drivers/tty/serial/atmel_serial.c
    854 @@ -212,8 +212,9 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
    855 {
    856 struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
    857 unsigned int mode;
    858 + unsigned long flags;
    859
    860 - spin_lock(&port->lock);
    861 + spin_lock_irqsave(&port->lock, flags);
    862
    863 /* Disable interrupts */
    864 UART_PUT_IDR(port, atmel_port->tx_done_mask);
    865 @@ -244,7 +245,7 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
    866 /* Enable interrupts */
    867 UART_PUT_IER(port, atmel_port->tx_done_mask);
    868
    869 - spin_unlock(&port->lock);
    870 + spin_unlock_irqrestore(&port->lock, flags);
    871
    872 }
    873
    874 diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
    875 index a8078d0..e61d9c4 100644
    876 --- a/drivers/usb/class/cdc-acm.c
    877 +++ b/drivers/usb/class/cdc-acm.c
    878 @@ -554,10 +554,18 @@ static void acm_port_down(struct acm *acm)
    879
    880 static void acm_tty_hangup(struct tty_struct *tty)
    881 {
    882 - struct acm *acm = tty->driver_data;
    883 - tty_port_hangup(&acm->port);
    884 + struct acm *acm;
    885 +
    886 mutex_lock(&open_mutex);
    887 + acm = tty->driver_data;
    888 +
    889 + if (!acm)
    890 + goto out;
    891 +
    892 + tty_port_hangup(&acm->port);
    893 acm_port_down(acm);
    894 +
    895 +out:
    896 mutex_unlock(&open_mutex);
    897 }
    898
    899 @@ -1183,6 +1191,8 @@ made_compressed_probe:
    900 i = device_create_file(&intf->dev, &dev_attr_wCountryCodes);
    901 if (i < 0) {
    902 kfree(acm->country_codes);
    903 + acm->country_codes = NULL;
    904 + acm->country_code_size = 0;
    905 goto skip_countries;
    906 }
    907
    908 @@ -1191,6 +1201,8 @@ made_compressed_probe:
    909 if (i < 0) {
    910 device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
    911 kfree(acm->country_codes);
    912 + acm->country_codes = NULL;
    913 + acm->country_code_size = 0;
    914 goto skip_countries;
    915 }
    916 }
    917 diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
    918 index e3beaf2..7abf060 100644
    919 --- a/drivers/usb/core/devio.c
    920 +++ b/drivers/usb/core/devio.c
    921 @@ -249,7 +249,8 @@ static struct async *alloc_async(unsigned int numisoframes)
    922 static void free_async(struct async *as)
    923 {
    924 put_pid(as->pid);
    925 - put_cred(as->cred);
    926 + if (as->cred)
    927 + put_cred(as->cred);
    928 kfree(as->urb->transfer_buffer);
    929 kfree(as->urb->setup_packet);
    930 usb_free_urb(as->urb);
    931 diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
    932 index 13222d3..179e364 100644
    933 --- a/drivers/usb/core/hcd.c
    934 +++ b/drivers/usb/core/hcd.c
    935 @@ -1412,11 +1412,10 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
    936 ret = -EAGAIN;
    937 else
    938 urb->transfer_flags |= URB_DMA_MAP_SG;
    939 - if (n != urb->num_sgs) {
    940 - urb->num_sgs = n;
    941 + urb->num_mapped_sgs = n;
    942 + if (n != urb->num_sgs)
    943 urb->transfer_flags |=
    944 URB_DMA_SG_COMBINED;
    945 - }
    946 } else if (urb->sg) {
    947 struct scatterlist *sg = urb->sg;
    948 urb->transfer_dma = dma_map_page(
    949 diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    950 index ecf12e1..4c65eb6 100644
    951 --- a/drivers/usb/core/quirks.c
    952 +++ b/drivers/usb/core/quirks.c
    953 @@ -117,9 +117,12 @@ static const struct usb_device_id usb_quirk_list[] = {
    954 { USB_DEVICE(0x06a3, 0x0006), .driver_info =
    955 USB_QUIRK_CONFIG_INTF_STRINGS },
    956
    957 - /* Guillemot Webcam Hercules Dualpix Exchange*/
    958 + /* Guillemot Webcam Hercules Dualpix Exchange (2nd ID) */
    959 { USB_DEVICE(0x06f8, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME },
    960
    961 + /* Guillemot Webcam Hercules Dualpix Exchange*/
    962 + { USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME },
    963 +
    964 /* M-Systems Flash Disk Pioneers */
    965 { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
    966
    967 diff --git a/drivers/usb/host/ehci-pxa168.c b/drivers/usb/host/ehci-pxa168.c
    968 index ac0c16e..8d0e7a2 100644
    969 --- a/drivers/usb/host/ehci-pxa168.c
    970 +++ b/drivers/usb/host/ehci-pxa168.c
    971 @@ -299,7 +299,7 @@ static int __devinit ehci_pxa168_drv_probe(struct platform_device *pdev)
    972 ehci = hcd_to_ehci(hcd);
    973 ehci->caps = hcd->regs + 0x100;
    974 ehci->regs = hcd->regs + 0x100 +
    975 - HC_LENGTH(ehci_readl(ehci, &ehci->caps->hc_capbase));
    976 + HC_LENGTH(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase));
    977 ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
    978 hcd->has_tt = 1;
    979 ehci->sbrn = 0x20;
    980 diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
    981 index 4e4066c..fef1db3 100644
    982 --- a/drivers/usb/host/ehci-q.c
    983 +++ b/drivers/usb/host/ehci-q.c
    984 @@ -647,7 +647,7 @@ qh_urb_transaction (
    985 /*
    986 * data transfer stage: buffer setup
    987 */
    988 - i = urb->num_sgs;
    989 + i = urb->num_mapped_sgs;
    990 if (len > 0 && i > 0) {
    991 sg = urb->sg;
    992 buf = sg_dma_address(sg);
    993 diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
    994 index f6ca80e..d2c6f5a 100644
    995 --- a/drivers/usb/host/uhci-q.c
    996 +++ b/drivers/usb/host/uhci-q.c
    997 @@ -943,7 +943,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
    998 if (usb_pipein(urb->pipe))
    999 status |= TD_CTRL_SPD;
    1000
    1001 - i = urb->num_sgs;
    1002 + i = urb->num_mapped_sgs;
    1003 if (len > 0 && i > 0) {
    1004 sg = urb->sg;
    1005 data = sg_dma_address(sg);
    1006 diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
    1007 index a403b53..76083ae 100644
    1008 --- a/drivers/usb/host/whci/qset.c
    1009 +++ b/drivers/usb/host/whci/qset.c
    1010 @@ -443,7 +443,7 @@ static int qset_add_urb_sg(struct whc *whc, struct whc_qset *qset, struct urb *u
    1011
    1012 remaining = urb->transfer_buffer_length;
    1013
    1014 - for_each_sg(urb->sg, sg, urb->num_sgs, i) {
    1015 + for_each_sg(urb->sg, sg, urb->num_mapped_sgs, i) {
    1016 dma_addr_t dma_addr;
    1017 size_t dma_remaining;
    1018 dma_addr_t sp, ep;
    1019 @@ -561,7 +561,7 @@ static int qset_add_urb_sg_linearize(struct whc *whc, struct whc_qset *qset,
    1020
    1021 remaining = urb->transfer_buffer_length;
    1022
    1023 - for_each_sg(urb->sg, sg, urb->num_sgs, i) {
    1024 + for_each_sg(urb->sg, sg, urb->num_mapped_sgs, i) {
    1025 size_t len;
    1026 size_t sg_remaining;
    1027 void *orig;
    1028 diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    1029 index 9f1d4b1..d28c586 100644
    1030 --- a/drivers/usb/host/xhci-ring.c
    1031 +++ b/drivers/usb/host/xhci-ring.c
    1032 @@ -2561,7 +2561,7 @@ static unsigned int count_sg_trbs_needed(struct xhci_hcd *xhci, struct urb *urb)
    1033 struct scatterlist *sg;
    1034
    1035 sg = NULL;
    1036 - num_sgs = urb->num_sgs;
    1037 + num_sgs = urb->num_mapped_sgs;
    1038 temp = urb->transfer_buffer_length;
    1039
    1040 xhci_dbg(xhci, "count sg list trbs: \n");
    1041 @@ -2745,7 +2745,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
    1042 return -EINVAL;
    1043
    1044 num_trbs = count_sg_trbs_needed(xhci, urb);
    1045 - num_sgs = urb->num_sgs;
    1046 + num_sgs = urb->num_mapped_sgs;
    1047 total_packet_count = roundup(urb->transfer_buffer_length,
    1048 usb_endpoint_maxp(&urb->ep->desc));
    1049
    1050 diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    1051 index a1afb7c..b33f059 100644
    1052 --- a/drivers/usb/host/xhci.c
    1053 +++ b/drivers/usb/host/xhci.c
    1054 @@ -1620,6 +1620,7 @@ static int xhci_configure_endpoint_result(struct xhci_hcd *xhci,
    1055 /* FIXME: can we allocate more resources for the HC? */
    1056 break;
    1057 case COMP_BW_ERR:
    1058 + case COMP_2ND_BW_ERR:
    1059 dev_warn(&udev->dev, "Not enough bandwidth "
    1060 "for new device state.\n");
    1061 ret = -ENOSPC;
    1062 @@ -2796,8 +2797,7 @@ static int xhci_calculate_streams_and_bitmask(struct xhci_hcd *xhci,
    1063 if (ret < 0)
    1064 return ret;
    1065
    1066 - max_streams = USB_SS_MAX_STREAMS(
    1067 - eps[i]->ss_ep_comp.bmAttributes);
    1068 + max_streams = usb_ss_max_streams(&eps[i]->ss_ep_comp);
    1069 if (max_streams < (*num_streams - 1)) {
    1070 xhci_dbg(xhci, "Ep 0x%x only supports %u stream IDs.\n",
    1071 eps[i]->desc.bEndpointAddress,
    1072 diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
    1073 index 3c8fbd2..09eda3a 100644
    1074 --- a/drivers/usb/host/xhci.h
    1075 +++ b/drivers/usb/host/xhci.h
    1076 @@ -1033,7 +1033,6 @@ struct xhci_transfer_event {
    1077 /* Invalid Stream ID Error */
    1078 #define COMP_STRID_ERR 34
    1079 /* Secondary Bandwidth Error - may be returned by a Configure Endpoint cmd */
    1080 -/* FIXME - check for this */
    1081 #define COMP_2ND_BW_ERR 35
    1082 /* Split Transaction Error */
    1083 #define COMP_SPLIT_ERR 36
    1084 diff --git a/drivers/usb/misc/isight_firmware.c b/drivers/usb/misc/isight_firmware.c
    1085 index fe1d443..8f725f6 100644
    1086 --- a/drivers/usb/misc/isight_firmware.c
    1087 +++ b/drivers/usb/misc/isight_firmware.c
    1088 @@ -55,8 +55,9 @@ static int isight_firmware_load(struct usb_interface *intf,
    1089
    1090 ptr = firmware->data;
    1091
    1092 + buf[0] = 0x01;
    1093 if (usb_control_msg
    1094 - (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\1", 1,
    1095 + (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
    1096 300) != 1) {
    1097 printk(KERN_ERR
    1098 "Failed to initialise isight firmware loader\n");
    1099 @@ -100,8 +101,9 @@ static int isight_firmware_load(struct usb_interface *intf,
    1100 }
    1101 }
    1102
    1103 + buf[0] = 0x00;
    1104 if (usb_control_msg
    1105 - (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\0", 1,
    1106 + (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
    1107 300) != 1) {
    1108 printk(KERN_ERR "isight firmware loading completion failed\n");
    1109 ret = -ENODEV;
    1110 diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
    1111 index b63ab15..920f04e 100644
    1112 --- a/drivers/usb/musb/musb_core.c
    1113 +++ b/drivers/usb/musb/musb_core.c
    1114 @@ -2012,8 +2012,6 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
    1115 if (status < 0)
    1116 goto fail3;
    1117
    1118 - pm_runtime_put(musb->controller);
    1119 -
    1120 status = musb_init_debugfs(musb);
    1121 if (status < 0)
    1122 goto fail4;
    1123 diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    1124 index fd67cc5..a1a324b 100644
    1125 --- a/drivers/usb/serial/cp210x.c
    1126 +++ b/drivers/usb/serial/cp210x.c
    1127 @@ -92,6 +92,7 @@ static const struct usb_device_id id_table[] = {
    1128 { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */
    1129 { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */
    1130 { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */
    1131 + { USB_DEVICE(0x10C4, 0x81A9) }, /* Multiplex RC Interface */
    1132 { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */
    1133 { USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */
    1134 { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
    1135 diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
    1136 index 60f38d5..0a8c1e6 100644
    1137 --- a/drivers/usb/serial/omninet.c
    1138 +++ b/drivers/usb/serial/omninet.c
    1139 @@ -315,7 +315,7 @@ static int omninet_write_room(struct tty_struct *tty)
    1140 int room = 0; /* Default: no room */
    1141
    1142 /* FIXME: no consistent locking for write_urb_busy */
    1143 - if (wport->write_urb_busy)
    1144 + if (!wport->write_urb_busy)
    1145 room = wport->bulk_out_size - OMNINET_HEADERLEN;
    1146
    1147 dbg("%s - returns %d", __func__, room);
    1148 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    1149 index 6dd6453..c96b6b6 100644
    1150 --- a/drivers/usb/serial/option.c
    1151 +++ b/drivers/usb/serial/option.c
    1152 @@ -476,6 +476,10 @@ static void option_instat_callback(struct urb *urb);
    1153 #define VIETTEL_VENDOR_ID 0x2262
    1154 #define VIETTEL_PRODUCT_VT1000 0x0002
    1155
    1156 +/* ZD Incorporated */
    1157 +#define ZD_VENDOR_ID 0x0685
    1158 +#define ZD_PRODUCT_7000 0x7000
    1159 +
    1160 /* some devices interfaces need special handling due to a number of reasons */
    1161 enum option_blacklist_reason {
    1162 OPTION_BLACKLIST_NONE = 0,
    1163 @@ -1178,6 +1182,7 @@ static const struct usb_device_id option_ids[] = {
    1164 { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU528) },
    1165 { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) },
    1166 { USB_DEVICE_AND_INTERFACE_INFO(VIETTEL_VENDOR_ID, VIETTEL_PRODUCT_VT1000, 0xff, 0xff, 0xff) },
    1167 + { USB_DEVICE_AND_INTERFACE_INFO(ZD_VENDOR_ID, ZD_PRODUCT_7000, 0xff, 0xff, 0xff) },
    1168 { } /* Terminating entry */
    1169 };
    1170 MODULE_DEVICE_TABLE(usb, option_ids);
    1171 diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
    1172 index c325e69..9e069ef 100644
    1173 --- a/drivers/usb/storage/usb.c
    1174 +++ b/drivers/usb/storage/usb.c
    1175 @@ -1073,6 +1073,7 @@ static struct usb_driver usb_storage_driver = {
    1176 .id_table = usb_storage_usb_ids,
    1177 .supports_autosuspend = 1,
    1178 .soft_unbind = 1,
    1179 + .no_dynamic_id = 1,
    1180 };
    1181
    1182 static int __init usb_stor_init(void)
    1183 diff --git a/drivers/video/offb.c b/drivers/video/offb.c
    1184 index cb163a5..3251a02 100644
    1185 --- a/drivers/video/offb.c
    1186 +++ b/drivers/video/offb.c
    1187 @@ -100,36 +100,32 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
    1188 u_int transp, struct fb_info *info)
    1189 {
    1190 struct offb_par *par = (struct offb_par *) info->par;
    1191 - int i, depth;
    1192 - u32 *pal = info->pseudo_palette;
    1193 -
    1194 - depth = info->var.bits_per_pixel;
    1195 - if (depth == 16)
    1196 - depth = (info->var.green.length == 5) ? 15 : 16;
    1197 -
    1198 - if (regno > 255 ||
    1199 - (depth == 16 && regno > 63) ||
    1200 - (depth == 15 && regno > 31))
    1201 - return 1;
    1202 -
    1203 - if (regno < 16) {
    1204 - switch (depth) {
    1205 - case 15:
    1206 - pal[regno] = (regno << 10) | (regno << 5) | regno;
    1207 - break;
    1208 - case 16:
    1209 - pal[regno] = (regno << 11) | (regno << 5) | regno;
    1210 - break;
    1211 - case 24:
    1212 - pal[regno] = (regno << 16) | (regno << 8) | regno;
    1213 - break;
    1214 - case 32:
    1215 - i = (regno << 8) | regno;
    1216 - pal[regno] = (i << 16) | i;
    1217 - break;
    1218 +
    1219 + if (info->fix.visual == FB_VISUAL_TRUECOLOR) {
    1220 + u32 *pal = info->pseudo_palette;
    1221 + u32 cr = red >> (16 - info->var.red.length);
    1222 + u32 cg = green >> (16 - info->var.green.length);
    1223 + u32 cb = blue >> (16 - info->var.blue.length);
    1224 + u32 value;
    1225 +
    1226 + if (regno >= 16)
    1227 + return -EINVAL;
    1228 +
    1229 + value = (cr << info->var.red.offset) |
    1230 + (cg << info->var.green.offset) |
    1231 + (cb << info->var.blue.offset);
    1232 + if (info->var.transp.length > 0) {
    1233 + u32 mask = (1 << info->var.transp.length) - 1;
    1234 + mask <<= info->var.transp.offset;
    1235 + value |= mask;
    1236 }
    1237 + pal[regno] = value;
    1238 + return 0;
    1239 }
    1240
    1241 + if (regno > 255)
    1242 + return -EINVAL;
    1243 +
    1244 red >>= 8;
    1245 green >>= 8;
    1246 blue >>= 8;
    1247 @@ -381,7 +377,7 @@ static void __init offb_init_fb(const char *name, const char *full_name,
    1248 int pitch, unsigned long address,
    1249 int foreign_endian, struct device_node *dp)
    1250 {
    1251 - unsigned long res_size = pitch * height * (depth + 7) / 8;
    1252 + unsigned long res_size = pitch * height;
    1253 struct offb_par *par = &default_par;
    1254 unsigned long res_start = address;
    1255 struct fb_fix_screeninfo *fix;
    1256 diff --git a/fs/Kconfig b/fs/Kconfig
    1257 index 5f4c45d..6ad58a5 100644
    1258 --- a/fs/Kconfig
    1259 +++ b/fs/Kconfig
    1260 @@ -218,6 +218,8 @@ source "fs/exofs/Kconfig"
    1261
    1262 endif # MISC_FILESYSTEMS
    1263
    1264 +source "fs/exofs/Kconfig.ore"
    1265 +
    1266 menuconfig NETWORK_FILESYSTEMS
    1267 bool "Network File Systems"
    1268 default y
    1269 diff --git a/fs/exofs/Kconfig b/fs/exofs/Kconfig
    1270 index da42f32..86194b2 100644
    1271 --- a/fs/exofs/Kconfig
    1272 +++ b/fs/exofs/Kconfig
    1273 @@ -1,14 +1,3 @@
    1274 -# Note ORE needs to "select ASYNC_XOR". So Not to force multiple selects
    1275 -# for every ORE user we do it like this. Any user should add itself here
    1276 -# at the "depends on EXOFS_FS || ..." with an ||. The dependencies are
    1277 -# selected here, and we default to "ON". So in effect it is like been
    1278 -# selected by any of the users.
    1279 -config ORE
    1280 - tristate
    1281 - depends on EXOFS_FS || PNFS_OBJLAYOUT
    1282 - select ASYNC_XOR
    1283 - default SCSI_OSD_ULD
    1284 -
    1285 config EXOFS_FS
    1286 tristate "exofs: OSD based file system support"
    1287 depends on SCSI_OSD_ULD
    1288 diff --git a/fs/exofs/Kconfig.ore b/fs/exofs/Kconfig.ore
    1289 new file mode 100644
    1290 index 0000000..1ca7fb7
    1291 --- /dev/null
    1292 +++ b/fs/exofs/Kconfig.ore
    1293 @@ -0,0 +1,12 @@
    1294 +# ORE - Objects Raid Engine (libore.ko)
    1295 +#
    1296 +# Note ORE needs to "select ASYNC_XOR". So Not to force multiple selects
    1297 +# for every ORE user we do it like this. Any user should add itself here
    1298 +# at the "depends on EXOFS_FS || ..." with an ||. The dependencies are
    1299 +# selected here, and we default to "ON". So in effect it is like been
    1300 +# selected by any of the users.
    1301 +config ORE
    1302 + tristate
    1303 + depends on EXOFS_FS || PNFS_OBJLAYOUT
    1304 + select ASYNC_XOR
    1305 + default SCSI_OSD_ULD
    1306 diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c
    1307 index d271ad8..49cf230 100644
    1308 --- a/fs/exofs/ore.c
    1309 +++ b/fs/exofs/ore.c
    1310 @@ -266,7 +266,7 @@ int ore_get_rw_state(struct ore_layout *layout, struct ore_components *oc,
    1311
    1312 /* first/last seg is split */
    1313 num_raid_units += layout->group_width;
    1314 - sgs_per_dev = div_u64(num_raid_units, data_devs);
    1315 + sgs_per_dev = div_u64(num_raid_units, data_devs) + 2;
    1316 } else {
    1317 /* For Writes add parity pages array. */
    1318 max_par_pages = num_raid_units * pages_in_unit *
    1319 @@ -445,10 +445,10 @@ int ore_check_io(struct ore_io_state *ios, ore_on_dev_error on_dev_error)
    1320 u64 residual = ios->reading ?
    1321 or->in.residual : or->out.residual;
    1322 u64 offset = (ios->offset + ios->length) - residual;
    1323 - struct ore_dev *od = ios->oc->ods[
    1324 - per_dev->dev - ios->oc->first_dev];
    1325 + unsigned dev = per_dev->dev - ios->oc->first_dev;
    1326 + struct ore_dev *od = ios->oc->ods[dev];
    1327
    1328 - on_dev_error(ios, od, per_dev->dev, osi.osd_err_pri,
    1329 + on_dev_error(ios, od, dev, osi.osd_err_pri,
    1330 offset, residual);
    1331 }
    1332 if (osi.osd_err_pri >= acumulated_osd_err) {
    1333 diff --git a/fs/exofs/ore_raid.c b/fs/exofs/ore_raid.c
    1334 index 29c47e5..d222c77 100644
    1335 --- a/fs/exofs/ore_raid.c
    1336 +++ b/fs/exofs/ore_raid.c
    1337 @@ -328,8 +328,8 @@ static int _alloc_read_4_write(struct ore_io_state *ios)
    1338 /* @si contains info of the to-be-inserted page. Update of @si should be
    1339 * maintained by caller. Specificaly si->dev, si->obj_offset, ...
    1340 */
    1341 -static int _add_to_read_4_write(struct ore_io_state *ios,
    1342 - struct ore_striping_info *si, struct page *page)
    1343 +static int _add_to_r4w(struct ore_io_state *ios, struct ore_striping_info *si,
    1344 + struct page *page, unsigned pg_len)
    1345 {
    1346 struct request_queue *q;
    1347 struct ore_per_dev_state *per_dev;
    1348 @@ -366,17 +366,60 @@ static int _add_to_read_4_write(struct ore_io_state *ios,
    1349 _ore_add_sg_seg(per_dev, gap, true);
    1350 }
    1351 q = osd_request_queue(ore_comp_dev(read_ios->oc, per_dev->dev));
    1352 - added_len = bio_add_pc_page(q, per_dev->bio, page, PAGE_SIZE, 0);
    1353 - if (unlikely(added_len != PAGE_SIZE)) {
    1354 + added_len = bio_add_pc_page(q, per_dev->bio, page, pg_len,
    1355 + si->obj_offset % PAGE_SIZE);
    1356 + if (unlikely(added_len != pg_len)) {
    1357 ORE_DBGMSG("Failed to bio_add_pc_page bi_vcnt=%d\n",
    1358 per_dev->bio->bi_vcnt);
    1359 return -ENOMEM;
    1360 }
    1361
    1362 - per_dev->length += PAGE_SIZE;
    1363 + per_dev->length += pg_len;
    1364 return 0;
    1365 }
    1366
    1367 +/* read the beginning of an unaligned first page */
    1368 +static int _add_to_r4w_first_page(struct ore_io_state *ios, struct page *page)
    1369 +{
    1370 + struct ore_striping_info si;
    1371 + unsigned pg_len;
    1372 +
    1373 + ore_calc_stripe_info(ios->layout, ios->offset, 0, &si);
    1374 +
    1375 + pg_len = si.obj_offset % PAGE_SIZE;
    1376 + si.obj_offset -= pg_len;
    1377 +
    1378 + ORE_DBGMSG("offset=0x%llx len=0x%x index=0x%lx dev=%x\n",
    1379 + _LLU(si.obj_offset), pg_len, page->index, si.dev);
    1380 +
    1381 + return _add_to_r4w(ios, &si, page, pg_len);
    1382 +}
    1383 +
    1384 +/* read the end of an incomplete last page */
    1385 +static int _add_to_r4w_last_page(struct ore_io_state *ios, u64 *offset)
    1386 +{
    1387 + struct ore_striping_info si;
    1388 + struct page *page;
    1389 + unsigned pg_len, p, c;
    1390 +
    1391 + ore_calc_stripe_info(ios->layout, *offset, 0, &si);
    1392 +
    1393 + p = si.unit_off / PAGE_SIZE;
    1394 + c = _dev_order(ios->layout->group_width * ios->layout->mirrors_p1,
    1395 + ios->layout->mirrors_p1, si.par_dev, si.dev);
    1396 + page = ios->sp2d->_1p_stripes[p].pages[c];
    1397 +
    1398 + pg_len = PAGE_SIZE - (si.unit_off % PAGE_SIZE);
    1399 + *offset += pg_len;
    1400 +
    1401 + ORE_DBGMSG("p=%d, c=%d next-offset=0x%llx len=0x%x dev=%x par_dev=%d\n",
    1402 + p, c, _LLU(*offset), pg_len, si.dev, si.par_dev);
    1403 +
    1404 + BUG_ON(!page);
    1405 +
    1406 + return _add_to_r4w(ios, &si, page, pg_len);
    1407 +}
    1408 +
    1409 static void _mark_read4write_pages_uptodate(struct ore_io_state *ios, int ret)
    1410 {
    1411 struct bio_vec *bv;
    1412 @@ -444,9 +487,13 @@ static int _read_4_write(struct ore_io_state *ios)
    1413 struct page **pp = &_1ps->pages[c];
    1414 bool uptodate;
    1415
    1416 - if (*pp)
    1417 + if (*pp) {
    1418 + if (ios->offset % PAGE_SIZE)
    1419 + /* Read the remainder of the page */
    1420 + _add_to_r4w_first_page(ios, *pp);
    1421 /* to-be-written pages start here */
    1422 goto read_last_stripe;
    1423 + }
    1424
    1425 *pp = ios->r4w->get_page(ios->private, offset,
    1426 &uptodate);
    1427 @@ -454,7 +501,7 @@ static int _read_4_write(struct ore_io_state *ios)
    1428 return -ENOMEM;
    1429
    1430 if (!uptodate)
    1431 - _add_to_read_4_write(ios, &read_si, *pp);
    1432 + _add_to_r4w(ios, &read_si, *pp, PAGE_SIZE);
    1433
    1434 /* Mark read-pages to be cache_released */
    1435 _1ps->page_is_read[c] = true;
    1436 @@ -465,8 +512,11 @@ static int _read_4_write(struct ore_io_state *ios)
    1437 }
    1438
    1439 read_last_stripe:
    1440 - offset = ios->offset + (ios->length + PAGE_SIZE - 1) /
    1441 - PAGE_SIZE * PAGE_SIZE;
    1442 + offset = ios->offset + ios->length;
    1443 + if (offset % PAGE_SIZE)
    1444 + _add_to_r4w_last_page(ios, &offset);
    1445 + /* offset will be aligned to next page */
    1446 +
    1447 last_stripe_end = div_u64(offset + bytes_in_stripe - 1, bytes_in_stripe)
    1448 * bytes_in_stripe;
    1449 if (offset == last_stripe_end) /* Optimize for the aligned case */
    1450 @@ -503,7 +553,7 @@ read_last_stripe:
    1451 /* Mark read-pages to be cache_released */
    1452 _1ps->page_is_read[c] = true;
    1453 if (!uptodate)
    1454 - _add_to_read_4_write(ios, &read_si, page);
    1455 + _add_to_r4w(ios, &read_si, page, PAGE_SIZE);
    1456 }
    1457
    1458 offset += PAGE_SIZE;
    1459 @@ -551,7 +601,11 @@ int _ore_add_parity_unit(struct ore_io_state *ios,
    1460 unsigned cur_len)
    1461 {
    1462 if (ios->reading) {
    1463 - BUG_ON(per_dev->cur_sg >= ios->sgs_per_dev);
    1464 + if (per_dev->cur_sg >= ios->sgs_per_dev) {
    1465 + ORE_DBGMSG("cur_sg(%d) >= sgs_per_dev(%d)\n" ,
    1466 + per_dev->cur_sg, ios->sgs_per_dev);
    1467 + return -ENOMEM;
    1468 + }
    1469 _ore_add_sg_seg(per_dev, cur_len, true);
    1470 } else {
    1471 struct __stripe_pages_2d *sp2d = ios->sp2d;
    1472 @@ -612,8 +666,6 @@ int _ore_post_alloc_raid_stuff(struct ore_io_state *ios)
    1473 return -ENOMEM;
    1474 }
    1475
    1476 - BUG_ON(ios->offset % PAGE_SIZE);
    1477 -
    1478 /* Round io down to last full strip */
    1479 first_stripe = div_u64(ios->offset, stripe_size);
    1480 last_stripe = div_u64(ios->offset + ios->length, stripe_size);
    1481 diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
    1482 index 85fe655..5b3f907 100644
    1483 --- a/fs/ext3/inode.c
    1484 +++ b/fs/ext3/inode.c
    1485 @@ -1617,7 +1617,13 @@ static int ext3_ordered_writepage(struct page *page,
    1486 int err;
    1487
    1488 J_ASSERT(PageLocked(page));
    1489 - WARN_ON_ONCE(IS_RDONLY(inode));
    1490 + /*
    1491 + * We don't want to warn for emergency remount. The condition is
    1492 + * ordered to avoid dereferencing inode->i_sb in non-error case to
    1493 + * avoid slow-downs.
    1494 + */
    1495 + WARN_ON_ONCE(IS_RDONLY(inode) &&
    1496 + !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
    1497
    1498 /*
    1499 * We give up here if we're reentered, because it might be for a
    1500 @@ -1692,7 +1698,13 @@ static int ext3_writeback_writepage(struct page *page,
    1501 int err;
    1502
    1503 J_ASSERT(PageLocked(page));
    1504 - WARN_ON_ONCE(IS_RDONLY(inode));
    1505 + /*
    1506 + * We don't want to warn for emergency remount. The condition is
    1507 + * ordered to avoid dereferencing inode->i_sb in non-error case to
    1508 + * avoid slow-downs.
    1509 + */
    1510 + WARN_ON_ONCE(IS_RDONLY(inode) &&
    1511 + !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
    1512
    1513 if (ext3_journal_current_handle())
    1514 goto out_fail;
    1515 @@ -1735,7 +1747,13 @@ static int ext3_journalled_writepage(struct page *page,
    1516 int err;
    1517
    1518 J_ASSERT(PageLocked(page));
    1519 - WARN_ON_ONCE(IS_RDONLY(inode));
    1520 + /*
    1521 + * We don't want to warn for emergency remount. The condition is
    1522 + * ordered to avoid dereferencing inode->i_sb in non-error case to
    1523 + * avoid slow-downs.
    1524 + */
    1525 + WARN_ON_ONCE(IS_RDONLY(inode) &&
    1526 + !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
    1527
    1528 if (ext3_journal_current_handle())
    1529 goto no_write;
    1530 diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
    1531 index 14363b9..5e3527b 100644
    1532 --- a/fs/reiserfs/super.c
    1533 +++ b/fs/reiserfs/super.c
    1534 @@ -453,16 +453,20 @@ int remove_save_link(struct inode *inode, int truncate)
    1535 static void reiserfs_kill_sb(struct super_block *s)
    1536 {
    1537 if (REISERFS_SB(s)) {
    1538 - if (REISERFS_SB(s)->xattr_root) {
    1539 - d_invalidate(REISERFS_SB(s)->xattr_root);
    1540 - dput(REISERFS_SB(s)->xattr_root);
    1541 - REISERFS_SB(s)->xattr_root = NULL;
    1542 - }
    1543 - if (REISERFS_SB(s)->priv_root) {
    1544 - d_invalidate(REISERFS_SB(s)->priv_root);
    1545 - dput(REISERFS_SB(s)->priv_root);
    1546 - REISERFS_SB(s)->priv_root = NULL;
    1547 - }
    1548 + /*
    1549 + * Force any pending inode evictions to occur now. Any
    1550 + * inodes to be removed that have extended attributes
    1551 + * associated with them need to clean them up before
    1552 + * we can release the extended attribute root dentries.
    1553 + * shrink_dcache_for_umount will BUG if we don't release
    1554 + * those before it's called so ->put_super is too late.
    1555 + */
    1556 + shrink_dcache_sb(s);
    1557 +
    1558 + dput(REISERFS_SB(s)->xattr_root);
    1559 + REISERFS_SB(s)->xattr_root = NULL;
    1560 + dput(REISERFS_SB(s)->priv_root);
    1561 + REISERFS_SB(s)->priv_root = NULL;
    1562 }
    1563
    1564 kill_block_super(s);
    1565 @@ -1164,7 +1168,8 @@ static void handle_quota_files(struct super_block *s, char **qf_names,
    1566 kfree(REISERFS_SB(s)->s_qf_names[i]);
    1567 REISERFS_SB(s)->s_qf_names[i] = qf_names[i];
    1568 }
    1569 - REISERFS_SB(s)->s_jquota_fmt = *qfmt;
    1570 + if (*qfmt)
    1571 + REISERFS_SB(s)->s_jquota_fmt = *qfmt;
    1572 }
    1573 #endif
    1574
    1575 diff --git a/fs/udf/file.c b/fs/udf/file.c
    1576 index d8ffa7c..dca0c38 100644
    1577 --- a/fs/udf/file.c
    1578 +++ b/fs/udf/file.c
    1579 @@ -125,7 +125,6 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
    1580 err = udf_expand_file_adinicb(inode);
    1581 if (err) {
    1582 udf_debug("udf_expand_adinicb: err=%d\n", err);
    1583 - up_write(&iinfo->i_data_sem);
    1584 return err;
    1585 }
    1586 } else {
    1587 @@ -133,9 +132,10 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
    1588 iinfo->i_lenAlloc = pos + count;
    1589 else
    1590 iinfo->i_lenAlloc = inode->i_size;
    1591 + up_write(&iinfo->i_data_sem);
    1592 }
    1593 - }
    1594 - up_write(&iinfo->i_data_sem);
    1595 + } else
    1596 + up_write(&iinfo->i_data_sem);
    1597
    1598 retval = generic_file_aio_write(iocb, iov, nr_segs, ppos);
    1599 if (retval > 0)
    1600 diff --git a/fs/udf/inode.c b/fs/udf/inode.c
    1601 index 4fd1d80..e2787d0 100644
    1602 --- a/fs/udf/inode.c
    1603 +++ b/fs/udf/inode.c
    1604 @@ -151,6 +151,12 @@ const struct address_space_operations udf_aops = {
    1605 .bmap = udf_bmap,
    1606 };
    1607
    1608 +/*
    1609 + * Expand file stored in ICB to a normal one-block-file
    1610 + *
    1611 + * This function requires i_data_sem for writing and releases it.
    1612 + * This function requires i_mutex held
    1613 + */
    1614 int udf_expand_file_adinicb(struct inode *inode)
    1615 {
    1616 struct page *page;
    1617 @@ -169,9 +175,15 @@ int udf_expand_file_adinicb(struct inode *inode)
    1618 iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
    1619 /* from now on we have normal address_space methods */
    1620 inode->i_data.a_ops = &udf_aops;
    1621 + up_write(&iinfo->i_data_sem);
    1622 mark_inode_dirty(inode);
    1623 return 0;
    1624 }
    1625 + /*
    1626 + * Release i_data_sem so that we can lock a page - page lock ranks
    1627 + * above i_data_sem. i_mutex still protects us against file changes.
    1628 + */
    1629 + up_write(&iinfo->i_data_sem);
    1630
    1631 page = find_or_create_page(inode->i_mapping, 0, GFP_NOFS);
    1632 if (!page)
    1633 @@ -187,6 +199,7 @@ int udf_expand_file_adinicb(struct inode *inode)
    1634 SetPageUptodate(page);
    1635 kunmap(page);
    1636 }
    1637 + down_write(&iinfo->i_data_sem);
    1638 memset(iinfo->i_ext.i_data + iinfo->i_lenEAttr, 0x00,
    1639 iinfo->i_lenAlloc);
    1640 iinfo->i_lenAlloc = 0;
    1641 @@ -196,17 +209,20 @@ int udf_expand_file_adinicb(struct inode *inode)
    1642 iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
    1643 /* from now on we have normal address_space methods */
    1644 inode->i_data.a_ops = &udf_aops;
    1645 + up_write(&iinfo->i_data_sem);
    1646 err = inode->i_data.a_ops->writepage(page, &udf_wbc);
    1647 if (err) {
    1648 /* Restore everything back so that we don't lose data... */
    1649 lock_page(page);
    1650 kaddr = kmap(page);
    1651 + down_write(&iinfo->i_data_sem);
    1652 memcpy(iinfo->i_ext.i_data + iinfo->i_lenEAttr, kaddr,
    1653 inode->i_size);
    1654 kunmap(page);
    1655 unlock_page(page);
    1656 iinfo->i_alloc_type = ICBTAG_FLAG_AD_IN_ICB;
    1657 inode->i_data.a_ops = &udf_adinicb_aops;
    1658 + up_write(&iinfo->i_data_sem);
    1659 }
    1660 page_cache_release(page);
    1661 mark_inode_dirty(inode);
    1662 @@ -1111,10 +1127,9 @@ int udf_setsize(struct inode *inode, loff_t newsize)
    1663 if (bsize <
    1664 (udf_file_entry_alloc_offset(inode) + newsize)) {
    1665 err = udf_expand_file_adinicb(inode);
    1666 - if (err) {
    1667 - up_write(&iinfo->i_data_sem);
    1668 + if (err)
    1669 return err;
    1670 - }
    1671 + down_write(&iinfo->i_data_sem);
    1672 } else
    1673 iinfo->i_lenAlloc = newsize;
    1674 }
    1675 diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c
    1676 index 76e4266..ac702a6 100644
    1677 --- a/fs/xfs/xfs_acl.c
    1678 +++ b/fs/xfs/xfs_acl.c
    1679 @@ -39,7 +39,7 @@ xfs_acl_from_disk(struct xfs_acl *aclp)
    1680 struct posix_acl_entry *acl_e;
    1681 struct posix_acl *acl;
    1682 struct xfs_acl_entry *ace;
    1683 - int count, i;
    1684 + unsigned int count, i;
    1685
    1686 count = be32_to_cpu(aclp->acl_cnt);
    1687 if (count > XFS_ACL_MAX_ENTRIES)
    1688 diff --git a/include/linux/usb.h b/include/linux/usb.h
    1689 index d3d0c13..7503352 100644
    1690 --- a/include/linux/usb.h
    1691 +++ b/include/linux/usb.h
    1692 @@ -1221,6 +1221,7 @@ struct urb {
    1693 void *transfer_buffer; /* (in) associated data buffer */
    1694 dma_addr_t transfer_dma; /* (in) dma addr for transfer_buffer */
    1695 struct scatterlist *sg; /* (in) scatter gather buffer list */
    1696 + int num_mapped_sgs; /* (internal) mapped sg entries */
    1697 int num_sgs; /* (in) number of entries in the sg list */
    1698 u32 transfer_buffer_length; /* (in) data buffer length */
    1699 u32 actual_length; /* (return) actual transfer length */
    1700 diff --git a/include/linux/usb/ch9.h b/include/linux/usb/ch9.h
    1701 index d5da6c6..61b2905 100644
    1702 --- a/include/linux/usb/ch9.h
    1703 +++ b/include/linux/usb/ch9.h
    1704 @@ -605,8 +605,26 @@ struct usb_ss_ep_comp_descriptor {
    1705 } __attribute__ ((packed));
    1706
    1707 #define USB_DT_SS_EP_COMP_SIZE 6
    1708 +
    1709 /* Bits 4:0 of bmAttributes if this is a bulk endpoint */
    1710 -#define USB_SS_MAX_STREAMS(p) (1 << ((p) & 0x1f))
    1711 +static inline int
    1712 +usb_ss_max_streams(const struct usb_ss_ep_comp_descriptor *comp)
    1713 +{
    1714 + int max_streams;
    1715 +
    1716 + if (!comp)
    1717 + return 0;
    1718 +
    1719 + max_streams = comp->bmAttributes & 0x1f;
    1720 +
    1721 + if (!max_streams)
    1722 + return 0;
    1723 +
    1724 + max_streams = 1 << max_streams;
    1725 +
    1726 + return max_streams;
    1727 +}
    1728 +
    1729 /* Bits 1:0 of bmAttributes if this is an isoc endpoint */
    1730 #define USB_SS_MULT(p) (1 + ((p) & 0x3))
    1731
    1732 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
    1733 index a184470..cdc0354 100644
    1734 --- a/kernel/cgroup.c
    1735 +++ b/kernel/cgroup.c
    1736 @@ -1175,10 +1175,10 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
    1737
    1738 /*
    1739 * If the 'all' option was specified select all the subsystems,
    1740 - * otherwise 'all, 'none' and a subsystem name options were not
    1741 - * specified, let's default to 'all'
    1742 + * otherwise if 'none', 'name=' and a subsystem name options
    1743 + * were not specified, let's default to 'all'
    1744 */
    1745 - if (all_ss || (!all_ss && !one_ss && !opts->none)) {
    1746 + if (all_ss || (!one_ss && !opts->none && !opts->name)) {
    1747 for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
    1748 struct cgroup_subsys *ss = subsys[i];
    1749 if (ss == NULL)
    1750 diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
    1751 index b2ca095..c3cc64c 100644
    1752 --- a/net/ipv4/igmp.c
    1753 +++ b/net/ipv4/igmp.c
    1754 @@ -875,6 +875,8 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
    1755 * to be intended in a v3 query.
    1756 */
    1757 max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
    1758 + if (!max_delay)
    1759 + max_delay = 1; /* can't mod w/ 0 */
    1760 } else { /* v3 */
    1761 if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
    1762 return;
    1763 diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
    1764 index 6c164dc..bf54c48 100644
    1765 --- a/tools/perf/util/trace-event-parse.c
    1766 +++ b/tools/perf/util/trace-event-parse.c
    1767 @@ -1582,6 +1582,8 @@ process_symbols(struct event *event, struct print_arg *arg, char **tok)
    1768 field = malloc_or_die(sizeof(*field));
    1769
    1770 type = process_arg(event, field, &token);
    1771 + while (type == EVENT_OP)
    1772 + type = process_op(event, field, &token);
    1773 if (test_type_token(type, token, EVENT_DELIM, ","))
    1774 goto out_free;
    1775