Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-3.6/0103-3.6.4-all-fixes.patch

    Annotation of /trunk/kernel-magellan/patches-3.6/0103-3.6.4-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1926 - (hide annotations) (download)
    Mon Oct 29 10:45:43 2012 UTC (11 years, 6 months ago) by niro
    File size: 159333 byte(s) 
    -3.6.4-magellan-r1
    1 niro 1926 diff --git a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt
    2     index c8e5782..683fde9 100644
    3     --- a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt
    4     +++ b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt
    5     @@ -93,7 +93,7 @@ Valid values for pin and group names are:
    6    
    7     With some exceptions, these support nvidia,high-speed-mode,
    8     nvidia,schmitt, nvidia,low-power-mode, nvidia,pull-down-strength,
    9     - nvidia,pull-up-strength, nvidia,slew_rate-rising, nvidia,slew_rate-falling.
    10     + nvidia,pull-up-strength, nvidia,slew-rate-rising, nvidia,slew-rate-falling.
    11    
    12     drive_ao1, drive_ao2, drive_at1, drive_at2, drive_cdev1, drive_cdev2,
    13     drive_csus, drive_dap1, drive_dap2, drive_dap3, drive_dap4, drive_dbg,
    14     diff --git a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra30-pinmux.txt b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra30-pinmux.txt
    15     index c275b70..6f426ed 100644
    16     --- a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra30-pinmux.txt
    17     +++ b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra30-pinmux.txt
    18     @@ -83,7 +83,7 @@ Valid values for pin and group names are:
    19     drive groups:
    20    
    21     These all support nvidia,pull-down-strength, nvidia,pull-up-strength,
    22     - nvidia,slew_rate-rising, nvidia,slew_rate-falling. Most but not all
    23     + nvidia,slew-rate-rising, nvidia,slew-rate-falling. Most but not all
    24     support nvidia,high-speed-mode, nvidia,schmitt, nvidia,low-power-mode.
    25    
    26     ao1, ao2, at1, at2, at3, at4, at5, cdev1, cdev2, cec, crt, csus, dap1,
    27     diff --git a/Documentation/hwmon/coretemp b/Documentation/hwmon/coretemp
    28     index c86b50c..f17256f 100644
    29     --- a/Documentation/hwmon/coretemp
    30     +++ b/Documentation/hwmon/coretemp
    31     @@ -105,6 +105,7 @@ Process Processor TjMax(C)
    32     330/230 125
    33     E680/660/640/620 90
    34     E680T/660T/640T/620T 110
    35     + CE4170/4150/4110 110
    36    
    37     45nm Core2 Processors
    38     Solo ULV SU3500/3300 100
    39     diff --git a/arch/s390/boot/compressed/vmlinux.lds.S b/arch/s390/boot/compressed/vmlinux.lds.S
    40     index d80f79d..8e1fb82 100644
    41     --- a/arch/s390/boot/compressed/vmlinux.lds.S
    42     +++ b/arch/s390/boot/compressed/vmlinux.lds.S
    43     @@ -5,7 +5,7 @@ OUTPUT_FORMAT("elf64-s390", "elf64-s390", "elf64-s390")
    44     OUTPUT_ARCH(s390:64-bit)
    45     #else
    46     OUTPUT_FORMAT("elf32-s390", "elf32-s390", "elf32-s390")
    47     -OUTPUT_ARCH(s390)
    48     +OUTPUT_ARCH(s390:31-bit)
    49     #endif
    50    
    51     ENTRY(startup)
    52     diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
    53     index de8fa9b..79cb51a 100644
    54     --- a/arch/s390/kernel/vmlinux.lds.S
    55     +++ b/arch/s390/kernel/vmlinux.lds.S
    56     @@ -8,7 +8,7 @@
    57    
    58     #ifndef CONFIG_64BIT
    59     OUTPUT_FORMAT("elf32-s390", "elf32-s390", "elf32-s390")
    60     -OUTPUT_ARCH(s390)
    61     +OUTPUT_ARCH(s390:31-bit)
    62     ENTRY(startup)
    63     jiffies = jiffies_64 + 4;
    64     #else
    65     diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
    66     index 5713957..ac18037 100644
    67     --- a/arch/sparc/kernel/perf_event.c
    68     +++ b/arch/sparc/kernel/perf_event.c
    69     @@ -557,11 +557,13 @@ static u64 nop_for_index(int idx)
    70    
    71     static inline void sparc_pmu_enable_event(struct cpu_hw_events *cpuc, struct hw_perf_event *hwc, int idx)
    72     {
    73     - u64 val, mask = mask_for_index(idx);
    74     + u64 enc, val, mask = mask_for_index(idx);
    75     +
    76     + enc = perf_event_get_enc(cpuc->events[idx]);
    77    
    78     val = cpuc->pcr;
    79     val &= ~mask;
    80     - val |= hwc->config;
    81     + val |= event_encoding(enc, idx);
    82     cpuc->pcr = val;
    83    
    84     pcr_ops->write(cpuc->pcr);
    85     @@ -1426,8 +1428,6 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry,
    86     {
    87     unsigned long ufp;
    88    
    89     - perf_callchain_store(entry, regs->tpc);
    90     -
    91     ufp = regs->u_regs[UREG_I6] + STACK_BIAS;
    92     do {
    93     struct sparc_stackf *usf, sf;
    94     @@ -1448,8 +1448,6 @@ static void perf_callchain_user_32(struct perf_callchain_entry *entry,
    95     {
    96     unsigned long ufp;
    97    
    98     - perf_callchain_store(entry, regs->tpc);
    99     -
    100     ufp = regs->u_regs[UREG_I6] & 0xffffffffUL;
    101     do {
    102     struct sparc_stackf32 *usf, sf;
    103     @@ -1468,6 +1466,11 @@ static void perf_callchain_user_32(struct perf_callchain_entry *entry,
    104     void
    105     perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
    106     {
    107     + perf_callchain_store(entry, regs->tpc);
    108     +
    109     + if (!current->mm)
    110     + return;
    111     +
    112     flushw_user();
    113     if (test_thread_flag(TIF_32BIT))
    114     perf_callchain_user_32(entry, regs);
    115     diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
    116     index 1d7e274..7f5f65d 100644
    117     --- a/arch/sparc/kernel/syscalls.S
    118     +++ b/arch/sparc/kernel/syscalls.S
    119     @@ -212,24 +212,20 @@ linux_sparc_syscall:
    120     3: stx %o0, [%sp + PTREGS_OFF + PT_V9_I0]
    121     ret_sys_call:
    122     ldx [%sp + PTREGS_OFF + PT_V9_TSTATE], %g3
    123     - ldx [%sp + PTREGS_OFF + PT_V9_TNPC], %l1 ! pc = npc
    124     sra %o0, 0, %o0
    125     mov %ulo(TSTATE_XCARRY | TSTATE_ICARRY), %g2
    126     sllx %g2, 32, %g2
    127    
    128     - /* Check if force_successful_syscall_return()
    129     - * was invoked.
    130     - */
    131     - ldub [%g6 + TI_SYS_NOERROR], %l2
    132     - brnz,a,pn %l2, 80f
    133     - stb %g0, [%g6 + TI_SYS_NOERROR]
    134     -
    135     cmp %o0, -ERESTART_RESTARTBLOCK
    136     bgeu,pn %xcc, 1f
    137     - andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %l6
    138     -80:
    139     + andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %g0
    140     + ldx [%sp + PTREGS_OFF + PT_V9_TNPC], %l1 ! pc = npc
    141     +
    142     +2:
    143     + stb %g0, [%g6 + TI_SYS_NOERROR]
    144     /* System call success, clear Carry condition code. */
    145     andn %g3, %g2, %g3
    146     +3:
    147     stx %g3, [%sp + PTREGS_OFF + PT_V9_TSTATE]
    148     bne,pn %icc, linux_syscall_trace2
    149     add %l1, 0x4, %l2 ! npc = npc+4
    150     @@ -238,20 +234,20 @@ ret_sys_call:
    151     stx %l2, [%sp + PTREGS_OFF + PT_V9_TNPC]
    152    
    153     1:
    154     + /* Check if force_successful_syscall_return()
    155     + * was invoked.
    156     + */
    157     + ldub [%g6 + TI_SYS_NOERROR], %l2
    158     + brnz,pn %l2, 2b
    159     + ldx [%sp + PTREGS_OFF + PT_V9_TNPC], %l1 ! pc = npc
    160     /* System call failure, set Carry condition code.
    161     * Also, get abs(errno) to return to the process.
    162     */
    163     - andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %l6
    164     sub %g0, %o0, %o0
    165     - or %g3, %g2, %g3
    166     stx %o0, [%sp + PTREGS_OFF + PT_V9_I0]
    167     - stx %g3, [%sp + PTREGS_OFF + PT_V9_TSTATE]
    168     - bne,pn %icc, linux_syscall_trace2
    169     - add %l1, 0x4, %l2 ! npc = npc+4
    170     - stx %l1, [%sp + PTREGS_OFF + PT_V9_TPC]
    171     + ba,pt %xcc, 3b
    172     + or %g3, %g2, %g3
    173    
    174     - b,pt %xcc, rtrap
    175     - stx %l2, [%sp + PTREGS_OFF + PT_V9_TNPC]
    176     linux_syscall_trace2:
    177     call syscall_trace_leave
    178     add %sp, PTREGS_OFF, %o0
    179     diff --git a/arch/tile/Makefile b/arch/tile/Makefile
    180     index 55640cf..3d15364 100644
    181     --- a/arch/tile/Makefile
    182     +++ b/arch/tile/Makefile
    183     @@ -26,6 +26,10 @@ $(error Set TILERA_ROOT or CROSS_COMPILE when building $(ARCH) on $(HOST_ARCH))
    184     endif
    185     endif
    186    
    187     +# The tile compiler may emit .eh_frame information for backtracing.
    188     +# In kernel modules, this causes load failures due to unsupported relocations.
    189     +KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
    190     +
    191     ifneq ($(CONFIG_DEBUG_EXTRA_FLAGS),"")
    192     KBUILD_CFLAGS += $(CONFIG_DEBUG_EXTRA_FLAGS)
    193     endif
    194     diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
    195     index c4e916d..698b6ec 100644
    196     --- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
    197     +++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
    198     @@ -576,12 +576,10 @@ static __cpuinit int threshold_create_bank(unsigned int cpu, unsigned int bank)
    199     int err = 0;
    200    
    201     if (shared_bank[bank]) {
    202     -
    203     nb = node_to_amd_nb(amd_get_nb_id(cpu));
    204     - WARN_ON(!nb);
    205    
    206     /* threshold descriptor already initialized on this node? */
    207     - if (nb->bank4) {
    208     + if (nb && nb->bank4) {
    209     /* yes, use it */
    210     b = nb->bank4;
    211     err = kobject_add(b->kobj, &dev->kobj, name);
    212     @@ -615,8 +613,10 @@ static __cpuinit int threshold_create_bank(unsigned int cpu, unsigned int bank)
    213     atomic_set(&b->cpus, 1);
    214    
    215     /* nb is already initialized, see above */
    216     - WARN_ON(nb->bank4);
    217     - nb->bank4 = b;
    218     + if (nb) {
    219     + WARN_ON(nb->bank4);
    220     + nb->bank4 = b;
    221     + }
    222     }
    223    
    224     err = allocate_threshold_blocks(cpu, bank, 0,
    225     diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
    226     index 623f288..8f8e8ee 100644
    227     --- a/arch/x86/kernel/entry_32.S
    228     +++ b/arch/x86/kernel/entry_32.S
    229     @@ -1016,7 +1016,7 @@ ENTRY(xen_sysenter_target)
    230    
    231     ENTRY(xen_hypervisor_callback)
    232     CFI_STARTPROC
    233     - pushl_cfi $0
    234     + pushl_cfi $-1 /* orig_ax = -1 => not a system call */
    235     SAVE_ALL
    236     TRACE_IRQS_OFF
    237    
    238     @@ -1058,14 +1058,16 @@ ENTRY(xen_failsafe_callback)
    239     2: mov 8(%esp),%es
    240     3: mov 12(%esp),%fs
    241     4: mov 16(%esp),%gs
    242     + /* EAX == 0 => Category 1 (Bad segment)
    243     + EAX != 0 => Category 2 (Bad IRET) */
    244     testl %eax,%eax
    245     popl_cfi %eax
    246     lea 16(%esp),%esp
    247     CFI_ADJUST_CFA_OFFSET -16
    248     jz 5f
    249     addl $16,%esp
    250     - jmp iret_exc # EAX != 0 => Category 2 (Bad IRET)
    251     -5: pushl_cfi $0 # EAX == 0 => Category 1 (Bad segment)
    252     + jmp iret_exc
    253     +5: pushl_cfi $-1 /* orig_ax = -1 => not a system call */
    254     SAVE_ALL
    255     jmp ret_from_exception
    256     CFI_ENDPROC
    257     diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
    258     index 69babd8..dcdd0ea 100644
    259     --- a/arch/x86/kernel/entry_64.S
    260     +++ b/arch/x86/kernel/entry_64.S
    261     @@ -1363,7 +1363,7 @@ ENTRY(xen_failsafe_callback)
    262     CFI_RESTORE r11
    263     addq $0x30,%rsp
    264     CFI_ADJUST_CFA_OFFSET -0x30
    265     - pushq_cfi $0
    266     + pushq_cfi $-1 /* orig_ax = -1 => not a system call */
    267     SAVE_ALL
    268     jmp error_exit
    269     CFI_ENDPROC
    270     diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
    271     index f4b9b80..198e774 100644
    272     --- a/arch/x86/kernel/setup.c
    273     +++ b/arch/x86/kernel/setup.c
    274     @@ -919,8 +919,21 @@ void __init setup_arch(char **cmdline_p)
    275    
    276     #ifdef CONFIG_X86_64
    277     if (max_pfn > max_low_pfn) {
    278     - max_pfn_mapped = init_memory_mapping(1UL<<32,
    279     - max_pfn<<PAGE_SHIFT);
    280     + int i;
    281     + for (i = 0; i < e820.nr_map; i++) {
    282     + struct e820entry *ei = &e820.map[i];
    283     +
    284     + if (ei->addr + ei->size <= 1UL << 32)
    285     + continue;
    286     +
    287     + if (ei->type == E820_RESERVED)
    288     + continue;
    289     +
    290     + max_pfn_mapped = init_memory_mapping(
    291     + ei->addr < 1UL << 32 ? 1UL << 32 : ei->addr,
    292     + ei->addr + ei->size);
    293     + }
    294     +
    295     /* can we preseve max_low_pfn ?*/
    296     max_low_pfn = max_pfn;
    297     }
    298     diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
    299     index 26b8a85..48768df 100644
    300     --- a/arch/x86/oprofile/nmi_int.c
    301     +++ b/arch/x86/oprofile/nmi_int.c
    302     @@ -55,7 +55,7 @@ u64 op_x86_get_ctrl(struct op_x86_model_spec const *model,
    303     val |= counter_config->extra;
    304     event &= model->event_mask ? model->event_mask : 0xFF;
    305     val |= event & 0xFF;
    306     - val |= (event & 0x0F00) << 24;
    307     + val |= (u64)(event & 0x0F00) << 24;
    308    
    309     return val;
    310     }
    311     diff --git a/arch/xtensa/include/asm/unistd.h b/arch/xtensa/include/asm/unistd.h
    312     index bc7e005..6b3ff98 100644
    313     --- a/arch/xtensa/include/asm/unistd.h
    314     +++ b/arch/xtensa/include/asm/unistd.h
    315     @@ -148,8 +148,8 @@ __SYSCALL( 59, sys_getdents, 3)
    316     __SYSCALL( 60, sys_getdents64, 3)
    317     #define __NR_fcntl64 61
    318     __SYSCALL( 61, sys_fcntl64, 3)
    319     -#define __NR_available62 62
    320     -__SYSCALL( 62, sys_ni_syscall, 0)
    321     +#define __NR_fallocate 62
    322     +__SYSCALL( 62, sys_fallocate, 6)
    323     #define __NR_fadvise64_64 63
    324     __SYSCALL( 63, xtensa_fadvise64_64, 6)
    325     #define __NR_utime 64 /* glibc 2.3.3 ?? */
    326     @@ -264,8 +264,8 @@ __SYSCALL(112, sys_socketpair, 4)
    327     __SYSCALL(113, sys_sendfile, 4)
    328     #define __NR_sendfile64 114
    329     __SYSCALL(114, sys_sendfile64, 4)
    330     -#define __NR_available115 115
    331     -__SYSCALL(115, sys_ni_syscall, 0)
    332     +#define __NR_sendmmsg 115
    333     +__SYSCALL(115, sys_sendmmsg, 4)
    334    
    335     /* Process Operations */
    336    
    337     @@ -380,11 +380,11 @@ __SYSCALL(168, sys_msgrcv, 4)
    338     __SYSCALL(169, sys_msgctl, 4)
    339     #define __NR_available170 170
    340     __SYSCALL(170, sys_ni_syscall, 0)
    341     -#define __NR_available171 171
    342     -__SYSCALL(171, sys_ni_syscall, 0)
    343    
    344     /* File System */
    345    
    346     +#define __NR_umount2 171
    347     +__SYSCALL(171, sys_umount, 2)
    348     #define __NR_mount 172
    349     __SYSCALL(172, sys_mount, 5)
    350     #define __NR_swapon 173
    351     @@ -399,8 +399,8 @@ __SYSCALL(176, sys_umount, 2)
    352     __SYSCALL(177, sys_swapoff, 1)
    353     #define __NR_sync 178
    354     __SYSCALL(178, sys_sync, 0)
    355     -#define __NR_available179 179
    356     -__SYSCALL(179, sys_ni_syscall, 0)
    357     +#define __NR_syncfs 179
    358     +__SYSCALL(179, sys_syncfs, 1)
    359     #define __NR_setfsuid 180
    360     __SYSCALL(180, sys_setfsuid, 1)
    361     #define __NR_setfsgid 181
    362     @@ -455,7 +455,7 @@ __SYSCALL(203, sys_reboot, 3)
    363     #define __NR_quotactl 204
    364     __SYSCALL(204, sys_quotactl, 4)
    365     #define __NR_nfsservctl 205
    366     -__SYSCALL(205, sys_ni_syscall, 0)
    367     +__SYSCALL(205, sys_ni_syscall, 0) /* old nfsservctl */
    368     #define __NR__sysctl 206
    369     __SYSCALL(206, sys_sysctl, 1)
    370     #define __NR_bdflush 207
    371     @@ -562,7 +562,7 @@ __SYSCALL(252, sys_timer_getoverrun, 1)
    372    
    373     /* System */
    374    
    375     -#define __NR_reserved244 253
    376     +#define __NR_reserved253 253
    377     __SYSCALL(253, sys_ni_syscall, 0)
    378     #define __NR_lookup_dcookie 254
    379     __SYSCALL(254, sys_lookup_dcookie, 4)
    380     @@ -609,8 +609,8 @@ __SYSCALL(272, sys_pselect6, 0)
    381     __SYSCALL(273, sys_ppoll, 0)
    382     #define __NR_epoll_pwait 274
    383     __SYSCALL(274, sys_epoll_pwait, 0)
    384     -#define __NR_available275 275
    385     -__SYSCALL(275, sys_ni_syscall, 0)
    386     +#define __NR_epoll_create1 275
    387     +__SYSCALL(275, sys_epoll_create1, 1)
    388    
    389     #define __NR_inotify_init 276
    390     __SYSCALL(276, sys_inotify_init, 0)
    391     @@ -618,8 +618,8 @@ __SYSCALL(276, sys_inotify_init, 0)
    392     __SYSCALL(277, sys_inotify_add_watch, 3)
    393     #define __NR_inotify_rm_watch 278
    394     __SYSCALL(278, sys_inotify_rm_watch, 2)
    395     -#define __NR_available279 279
    396     -__SYSCALL(279, sys_ni_syscall, 0)
    397     +#define __NR_inotify_init1 279
    398     +__SYSCALL(279, sys_inotify_init1, 1)
    399    
    400     #define __NR_getcpu 280
    401     __SYSCALL(280, sys_getcpu, 0)
    402     @@ -635,10 +635,10 @@ __SYSCALL(283, sys_ioprio_get, 3)
    403     __SYSCALL(284, sys_set_robust_list, 3)
    404     #define __NR_get_robust_list 285
    405     __SYSCALL(285, sys_get_robust_list, 3)
    406     -#define __NR_reserved286 286 /* sync_file_rangeX */
    407     -__SYSCALL(286, sys_ni_syscall, 3)
    408     +#define __NR_available286 286
    409     +__SYSCALL(286, sys_ni_syscall, 0)
    410     #define __NR_available287 287
    411     -__SYSCALL(287, sys_faccessat, 0)
    412     +__SYSCALL(287, sys_ni_syscall, 0)
    413    
    414     /* Relative File Operations */
    415    
    416     @@ -683,10 +683,63 @@ __SYSCALL(305, sys_ni_syscall, 0)
    417     __SYSCALL(306, sys_eventfd, 1)
    418     #define __NR_recvmmsg 307
    419     __SYSCALL(307, sys_recvmmsg, 5)
    420     +
    421     #define __NR_setns 308
    422     __SYSCALL(308, sys_setns, 2)
    423     -
    424     -#define __NR_syscall_count 309
    425     +#define __NR_signalfd4 309
    426     +__SYSCALL(309, sys_signalfd4, 4)
    427     +#define __NR_dup3 310
    428     +__SYSCALL(310, sys_dup3, 3)
    429     +#define __NR_pipe2 311
    430     +__SYSCALL(311, sys_pipe2, 2)
    431     +
    432     +#define __NR_timerfd_create 312
    433     +__SYSCALL(312, sys_timerfd_create, 2)
    434     +#define __NR_timerfd_settime 313
    435     +__SYSCALL(313, sys_timerfd_settime, 4)
    436     +#define __NR_timerfd_gettime 314
    437     +__SYSCALL(314, sys_timerfd_gettime, 2)
    438     +#define __NR_available315 315
    439     +__SYSCALL(315, sys_ni_syscall, 0)
    440     +
    441     +#define __NR_eventfd2 316
    442     +__SYSCALL(316, sys_eventfd2, 2)
    443     +#define __NR_preadv 317
    444     +__SYSCALL(317, sys_preadv, 5)
    445     +#define __NR_pwritev 318
    446     +__SYSCALL(318, sys_pwritev, 5)
    447     +#define __NR_available319 319
    448     +__SYSCALL(319, sys_ni_syscall, 0)
    449     +
    450     +#define __NR_fanotify_init 320
    451     +__SYSCALL(320, sys_fanotify_init, 2)
    452     +#define __NR_fanotify_mark 321
    453     +__SYSCALL(321, sys_fanotify_mark, 6)
    454     +#define __NR_process_vm_readv 322
    455     +__SYSCALL(322, sys_process_vm_readv, 6)
    456     +#define __NR_process_vm_writev 323
    457     +__SYSCALL(323, sys_process_vm_writev, 6)
    458     +
    459     +#define __NR_name_to_handle_at 324
    460     +__SYSCALL(324, sys_name_to_handle_at, 5)
    461     +#define __NR_open_by_handle_at 325
    462     +__SYSCALL(325, sys_open_by_handle_at, 3)
    463     +#define __NR_sync_file_range 326
    464     +__SYSCALL(326, sys_sync_file_range2, 6)
    465     +#define __NR_perf_event_open 327
    466     +__SYSCALL(327, sys_perf_event_open, 5)
    467     +
    468     +#define __NR_rt_tgsigqueueinfo 328
    469     +__SYSCALL(328, sys_rt_tgsigqueueinfo, 4)
    470     +#define __NR_clock_adjtime 329
    471     +__SYSCALL(329, sys_clock_adjtime, 2)
    472     +#define __NR_prlimit64 330
    473     +__SYSCALL(330, sys_prlimit64, 4)
    474     +#define __NR_kcmp 331
    475     +__SYSCALL(331, sys_kcmp, 5)
    476     +
    477     +
    478     +#define __NR_syscall_count 332
    479    
    480     /*
    481     * sysxtensa syscall handler
    482     diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
    483     index 5a297a2..cc8e7c7 100644
    484     --- a/drivers/edac/amd64_edac.c
    485     +++ b/drivers/edac/amd64_edac.c
    486     @@ -170,8 +170,11 @@ static int __amd64_set_scrub_rate(struct pci_dev *ctl, u32 new_bw, u32 min_rate)
    487     * memory controller and apply to register. Search for the first
    488     * bandwidth entry that is greater or equal than the setting requested
    489     * and program that. If at last entry, turn off DRAM scrubbing.
    490     + *
    491     + * If no suitable bandwidth is found, turn off DRAM scrubbing entirely
    492     + * by falling back to the last element in scrubrates[].
    493     */
    494     - for (i = 0; i < ARRAY_SIZE(scrubrates); i++) {
    495     + for (i = 0; i < ARRAY_SIZE(scrubrates) - 1; i++) {
    496     /*
    497     * skip scrub rates which aren't recommended
    498     * (see F10 BKDG, F3x58)
    499     @@ -181,12 +184,6 @@ static int __amd64_set_scrub_rate(struct pci_dev *ctl, u32 new_bw, u32 min_rate)
    500    
    501     if (scrubrates[i].bandwidth <= new_bw)
    502     break;
    503     -
    504     - /*
    505     - * if no suitable bandwidth found, turn off DRAM scrubbing
    506     - * entirely by falling back to the last element in the
    507     - * scrubrates array.
    508     - */
    509     }
    510    
    511     scrubval = scrubrates[i].scrubval;
    512     diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    513     index ff2819e..cdf46b5 100644
    514     --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    515     +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    516     @@ -269,6 +269,7 @@ eb_destroy(struct eb_objects *eb)
    517     static inline int use_cpu_reloc(struct drm_i915_gem_object *obj)
    518     {
    519     return (obj->base.write_domain == I915_GEM_DOMAIN_CPU ||
    520     + !obj->map_and_fenceable ||
    521     obj->cache_level != I915_CACHE_NONE);
    522     }
    523    
    524     diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
    525     index 984a3f1..47b8d84 100644
    526     --- a/drivers/hwmon/coretemp.c
    527     +++ b/drivers/hwmon/coretemp.c
    528     @@ -205,8 +205,11 @@ static const struct tjmax __cpuinitconst tjmax_table[] = {
    529     { "CPU N455", 100000 },
    530     { "CPU N470", 100000 },
    531     { "CPU N475", 100000 },
    532     - { "CPU 230", 100000 },
    533     - { "CPU 330", 125000 },
    534     + { "CPU 230", 100000 }, /* Model 0x1c, stepping 2 */
    535     + { "CPU 330", 125000 }, /* Model 0x1c, stepping 2 */
    536     + { "CPU CE4110", 110000 }, /* Model 0x1c, stepping 10 */
    537     + { "CPU CE4150", 110000 }, /* Model 0x1c, stepping 10 */
    538     + { "CPU CE4170", 110000 }, /* Model 0x1c, stepping 10 */
    539     };
    540    
    541     static int __cpuinit adjust_tjmax(struct cpuinfo_x86 *c, u32 id,
    542     diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
    543     index 7172559..d1febf0 100644
    544     --- a/drivers/infiniband/core/cma.c
    545     +++ b/drivers/infiniband/core/cma.c
    546     @@ -3495,7 +3495,8 @@ out:
    547     }
    548    
    549     static const struct ibnl_client_cbs cma_cb_table[] = {
    550     - [RDMA_NL_RDMA_CM_ID_STATS] = { .dump = cma_get_id_stats },
    551     + [RDMA_NL_RDMA_CM_ID_STATS] = { .dump = cma_get_id_stats,
    552     + .module = THIS_MODULE },
    553     };
    554    
    555     static int __init cma_init(void)
    556     diff --git a/drivers/infiniband/core/netlink.c b/drivers/infiniband/core/netlink.c
    557     index 3ae2bfd..53b43a5 100644
    558     --- a/drivers/infiniband/core/netlink.c
    559     +++ b/drivers/infiniband/core/netlink.c
    560     @@ -154,6 +154,7 @@ static int ibnl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
    561     {
    562     struct netlink_dump_control c = {
    563     .dump = client->cb_table[op].dump,
    564     + .module = client->cb_table[op].module,
    565     };
    566     return netlink_dump_start(nls, skb, nlh, &c);
    567     }
    568     diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
    569     index 2a4bb36..cef812a 100644
    570     --- a/drivers/iommu/tegra-smmu.c
    571     +++ b/drivers/iommu/tegra-smmu.c
    572     @@ -146,7 +146,7 @@
    573    
    574     #define SMMU_ADDR_TO_PFN(addr) ((addr) >> 12)
    575     #define SMMU_ADDR_TO_PDN(addr) ((addr) >> 22)
    576     -#define SMMU_PDN_TO_ADDR(addr) ((pdn) << 22)
    577     +#define SMMU_PDN_TO_ADDR(pdn) ((pdn) << 22)
    578    
    579     #define _READABLE (1 << SMMU_PTB_DATA_ASID_READABLE_SHIFT)
    580     #define _WRITABLE (1 << SMMU_PTB_DATA_ASID_WRITABLE_SHIFT)
    581     diff --git a/drivers/media/video/au0828/au0828-video.c b/drivers/media/video/au0828/au0828-video.c
    582     index ac3dd73..902825a 100644
    583     --- a/drivers/media/video/au0828/au0828-video.c
    584     +++ b/drivers/media/video/au0828/au0828-video.c
    585     @@ -1692,14 +1692,18 @@ static int vidioc_streamoff(struct file *file, void *priv,
    586     (AUVI_INPUT(i).audio_setup)(dev, 0);
    587     }
    588    
    589     - videobuf_streamoff(&fh->vb_vidq);
    590     - res_free(fh, AU0828_RESOURCE_VIDEO);
    591     + if (res_check(fh, AU0828_RESOURCE_VIDEO)) {
    592     + videobuf_streamoff(&fh->vb_vidq);
    593     + res_free(fh, AU0828_RESOURCE_VIDEO);
    594     + }
    595     } else if (fh->type == V4L2_BUF_TYPE_VBI_CAPTURE) {
    596     dev->vbi_timeout_running = 0;
    597     del_timer_sync(&dev->vbi_timeout);
    598    
    599     - videobuf_streamoff(&fh->vb_vbiq);
    600     - res_free(fh, AU0828_RESOURCE_VBI);
    601     + if (res_check(fh, AU0828_RESOURCE_VBI)) {
    602     + videobuf_streamoff(&fh->vb_vbiq);
    603     + res_free(fh, AU0828_RESOURCE_VBI);
    604     + }
    605     }
    606    
    607     return 0;
    608     diff --git a/drivers/net/ethernet/calxeda/xgmac.c b/drivers/net/ethernet/calxeda/xgmac.c
    609     index 2b4b4f5..16814b3 100644
    610     --- a/drivers/net/ethernet/calxeda/xgmac.c
    611     +++ b/drivers/net/ethernet/calxeda/xgmac.c
    612     @@ -375,7 +375,6 @@ struct xgmac_priv {
    613     unsigned int tx_tail;
    614    
    615     void __iomem *base;
    616     - struct sk_buff_head rx_recycle;
    617     unsigned int dma_buf_sz;
    618     dma_addr_t dma_rx_phy;
    619     dma_addr_t dma_tx_phy;
    620     @@ -672,9 +671,7 @@ static void xgmac_rx_refill(struct xgmac_priv *priv)
    621     p = priv->dma_rx + entry;
    622    
    623     if (priv->rx_skbuff[entry] == NULL) {
    624     - skb = __skb_dequeue(&priv->rx_recycle);
    625     - if (skb == NULL)
    626     - skb = netdev_alloc_skb(priv->dev, priv->dma_buf_sz);
    627     + skb = netdev_alloc_skb(priv->dev, priv->dma_buf_sz);
    628     if (unlikely(skb == NULL))
    629     break;
    630    
    631     @@ -887,17 +884,7 @@ static void xgmac_tx_complete(struct xgmac_priv *priv)
    632     desc_get_buf_len(p), DMA_TO_DEVICE);
    633     }
    634    
    635     - /*
    636     - * If there's room in the queue (limit it to size)
    637     - * we add this skb back into the pool,
    638     - * if it's the right size.
    639     - */
    640     - if ((skb_queue_len(&priv->rx_recycle) <
    641     - DMA_RX_RING_SZ) &&
    642     - skb_recycle_check(skb, priv->dma_buf_sz))
    643     - __skb_queue_head(&priv->rx_recycle, skb);
    644     - else
    645     - dev_kfree_skb(skb);
    646     + dev_kfree_skb(skb);
    647     }
    648    
    649     if (dma_ring_space(priv->tx_head, priv->tx_tail, DMA_TX_RING_SZ) >
    650     @@ -1016,7 +1003,6 @@ static int xgmac_open(struct net_device *dev)
    651     dev->dev_addr);
    652     }
    653    
    654     - skb_queue_head_init(&priv->rx_recycle);
    655     memset(&priv->xstats, 0, sizeof(struct xgmac_extra_stats));
    656    
    657     /* Initialize the XGMAC and descriptors */
    658     @@ -1053,7 +1039,6 @@ static int xgmac_stop(struct net_device *dev)
    659     napi_disable(&priv->napi);
    660    
    661     writel(0, priv->base + XGMAC_DMA_INTR_ENA);
    662     - skb_queue_purge(&priv->rx_recycle);
    663    
    664     /* Disable the MAC core */
    665     xgmac_mac_disable(priv->base);
    666     diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
    667     index d3233f5..e0ef1e5 100644
    668     --- a/drivers/net/ethernet/freescale/gianfar.c
    669     +++ b/drivers/net/ethernet/freescale/gianfar.c
    670     @@ -1757,7 +1757,6 @@ static void free_skb_resources(struct gfar_private *priv)
    671     sizeof(struct rxbd8) * priv->total_rx_ring_size,
    672     priv->tx_queue[0]->tx_bd_base,
    673     priv->tx_queue[0]->tx_bd_dma_base);
    674     - skb_queue_purge(&priv->rx_recycle);
    675     }
    676    
    677     void gfar_start(struct net_device *dev)
    678     @@ -1935,8 +1934,6 @@ static int gfar_enet_open(struct net_device *dev)
    679    
    680     enable_napi(priv);
    681    
    682     - skb_queue_head_init(&priv->rx_recycle);
    683     -
    684     /* Initialize a bunch of registers */
    685     init_registers(dev);
    686    
    687     @@ -2525,16 +2522,7 @@ static int gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
    688    
    689     bytes_sent += skb->len;
    690    
    691     - /* If there's room in the queue (limit it to rx_buffer_size)
    692     - * we add this skb back into the pool, if it's the right size
    693     - */
    694     - if (skb_queue_len(&priv->rx_recycle) < rx_queue->rx_ring_size &&
    695     - skb_recycle_check(skb, priv->rx_buffer_size +
    696     - RXBUF_ALIGNMENT)) {
    697     - gfar_align_skb(skb);
    698     - skb_queue_head(&priv->rx_recycle, skb);
    699     - } else
    700     - dev_kfree_skb_any(skb);
    701     + dev_kfree_skb_any(skb);
    702    
    703     tx_queue->tx_skbuff[skb_dirtytx] = NULL;
    704    
    705     @@ -2600,7 +2588,7 @@ static void gfar_new_rxbdp(struct gfar_priv_rx_q *rx_queue, struct rxbd8 *bdp,
    706     static struct sk_buff *gfar_alloc_skb(struct net_device *dev)
    707     {
    708     struct gfar_private *priv = netdev_priv(dev);
    709     - struct sk_buff *skb = NULL;
    710     + struct sk_buff *skb;
    711    
    712     skb = netdev_alloc_skb(dev, priv->rx_buffer_size + RXBUF_ALIGNMENT);
    713     if (!skb)
    714     @@ -2613,14 +2601,7 @@ static struct sk_buff *gfar_alloc_skb(struct net_device *dev)
    715    
    716     struct sk_buff *gfar_new_skb(struct net_device *dev)
    717     {
    718     - struct gfar_private *priv = netdev_priv(dev);
    719     - struct sk_buff *skb = NULL;
    720     -
    721     - skb = skb_dequeue(&priv->rx_recycle);
    722     - if (!skb)
    723     - skb = gfar_alloc_skb(dev);
    724     -
    725     - return skb;
    726     + return gfar_alloc_skb(dev);
    727     }
    728    
    729     static inline void count_errors(unsigned short status, struct net_device *dev)
    730     @@ -2779,7 +2760,7 @@ int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue, int rx_work_limit)
    731     if (unlikely(!newskb))
    732     newskb = skb;
    733     else if (skb)
    734     - skb_queue_head(&priv->rx_recycle, skb);
    735     + dev_kfree_skb(skb);
    736     } else {
    737     /* Increment the number of packets */
    738     rx_queue->stats.rx_packets++;
    739     diff --git a/drivers/net/ethernet/freescale/gianfar.h b/drivers/net/ethernet/freescale/gianfar.h
    740     index 2136c7f..27d8aeb 100644
    741     --- a/drivers/net/ethernet/freescale/gianfar.h
    742     +++ b/drivers/net/ethernet/freescale/gianfar.h
    743     @@ -1072,8 +1072,6 @@ struct gfar_private {
    744    
    745     u32 cur_filer_idx;
    746    
    747     - struct sk_buff_head rx_recycle;
    748     -
    749     /* RX queue filer rule set*/
    750     struct ethtool_rx_list rx_list;
    751     struct mutex rx_queue_access;
    752     diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
    753     index 21c6574..f6259ff 100644
    754     --- a/drivers/net/ethernet/freescale/ucc_geth.c
    755     +++ b/drivers/net/ethernet/freescale/ucc_geth.c
    756     @@ -210,14 +210,12 @@ static struct list_head *dequeue(struct list_head *lh)
    757     static struct sk_buff *get_new_skb(struct ucc_geth_private *ugeth,
    758     u8 __iomem *bd)
    759     {
    760     - struct sk_buff *skb = NULL;
    761     + struct sk_buff *skb;
    762    
    763     - skb = __skb_dequeue(&ugeth->rx_recycle);
    764     + skb = netdev_alloc_skb(ugeth->ndev,
    765     + ugeth->ug_info->uf_info.max_rx_buf_length +
    766     + UCC_GETH_RX_DATA_BUF_ALIGNMENT);
    767     if (!skb)
    768     - skb = netdev_alloc_skb(ugeth->ndev,
    769     - ugeth->ug_info->uf_info.max_rx_buf_length +
    770     - UCC_GETH_RX_DATA_BUF_ALIGNMENT);
    771     - if (skb == NULL)
    772     return NULL;
    773    
    774     /* We need the data buffer to be aligned properly. We will reserve
    775     @@ -2021,8 +2019,6 @@ static void ucc_geth_memclean(struct ucc_geth_private *ugeth)
    776     iounmap(ugeth->ug_regs);
    777     ugeth->ug_regs = NULL;
    778     }
    779     -
    780     - skb_queue_purge(&ugeth->rx_recycle);
    781     }
    782    
    783     static void ucc_geth_set_multi(struct net_device *dev)
    784     @@ -2231,8 +2227,6 @@ static int ucc_struct_init(struct ucc_geth_private *ugeth)
    785     return -ENOMEM;
    786     }
    787    
    788     - skb_queue_head_init(&ugeth->rx_recycle);
    789     -
    790     return 0;
    791     }
    792    
    793     @@ -3275,12 +3269,7 @@ static int ucc_geth_rx(struct ucc_geth_private *ugeth, u8 rxQ, int rx_work_limit
    794     if (netif_msg_rx_err(ugeth))
    795     ugeth_err("%s, %d: ERROR!!! skb - 0x%08x",
    796     __func__, __LINE__, (u32) skb);
    797     - if (skb) {
    798     - skb->data = skb->head + NET_SKB_PAD;
    799     - skb->len = 0;
    800     - skb_reset_tail_pointer(skb);
    801     - __skb_queue_head(&ugeth->rx_recycle, skb);
    802     - }
    803     + dev_kfree_skb(skb);
    804    
    805     ugeth->rx_skbuff[rxQ][ugeth->skb_currx[rxQ]] = NULL;
    806     dev->stats.rx_dropped++;
    807     @@ -3350,13 +3339,7 @@ static int ucc_geth_tx(struct net_device *dev, u8 txQ)
    808    
    809     dev->stats.tx_packets++;
    810    
    811     - if (skb_queue_len(&ugeth->rx_recycle) < RX_BD_RING_LEN &&
    812     - skb_recycle_check(skb,
    813     - ugeth->ug_info->uf_info.max_rx_buf_length +
    814     - UCC_GETH_RX_DATA_BUF_ALIGNMENT))
    815     - __skb_queue_head(&ugeth->rx_recycle, skb);
    816     - else
    817     - dev_kfree_skb(skb);
    818     + dev_kfree_skb(skb);
    819    
    820     ugeth->tx_skbuff[txQ][ugeth->skb_dirtytx[txQ]] = NULL;
    821     ugeth->skb_dirtytx[txQ] =
    822     diff --git a/drivers/net/ethernet/freescale/ucc_geth.h b/drivers/net/ethernet/freescale/ucc_geth.h
    823     index f71b3e7..75f3371 100644
    824     --- a/drivers/net/ethernet/freescale/ucc_geth.h
    825     +++ b/drivers/net/ethernet/freescale/ucc_geth.h
    826     @@ -1214,8 +1214,6 @@ struct ucc_geth_private {
    827     /* index of the first skb which hasn't been transmitted yet. */
    828     u16 skb_dirtytx[NUM_TX_QUEUES];
    829    
    830     - struct sk_buff_head rx_recycle;
    831     -
    832     struct ugeth_mii_info *mii_info;
    833     struct phy_device *phydev;
    834     phy_interface_t phy_interface;
    835     diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
    836     index 087b9e0..84c1326 100644
    837     --- a/drivers/net/ethernet/marvell/mv643xx_eth.c
    838     +++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
    839     @@ -412,7 +412,6 @@ struct mv643xx_eth_private {
    840     u8 work_rx_refill;
    841    
    842     int skb_size;
    843     - struct sk_buff_head rx_recycle;
    844    
    845     /*
    846     * RX state.
    847     @@ -673,9 +672,7 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
    848     struct rx_desc *rx_desc;
    849     int size;
    850    
    851     - skb = __skb_dequeue(&mp->rx_recycle);
    852     - if (skb == NULL)
    853     - skb = netdev_alloc_skb(mp->dev, mp->skb_size);
    854     + skb = netdev_alloc_skb(mp->dev, mp->skb_size);
    855    
    856     if (skb == NULL) {
    857     mp->oom = 1;
    858     @@ -989,14 +986,7 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
    859     desc->byte_cnt, DMA_TO_DEVICE);
    860     }
    861    
    862     - if (skb != NULL) {
    863     - if (skb_queue_len(&mp->rx_recycle) <
    864     - mp->rx_ring_size &&
    865     - skb_recycle_check(skb, mp->skb_size))
    866     - __skb_queue_head(&mp->rx_recycle, skb);
    867     - else
    868     - dev_kfree_skb(skb);
    869     - }
    870     + dev_kfree_skb(skb);
    871     }
    872    
    873     __netif_tx_unlock(nq);
    874     @@ -2349,8 +2339,6 @@ static int mv643xx_eth_open(struct net_device *dev)
    875    
    876     napi_enable(&mp->napi);
    877    
    878     - skb_queue_head_init(&mp->rx_recycle);
    879     -
    880     mp->int_mask = INT_EXT;
    881    
    882     for (i = 0; i < mp->rxq_count; i++) {
    883     @@ -2445,8 +2433,6 @@ static int mv643xx_eth_stop(struct net_device *dev)
    884     mib_counters_update(mp);
    885     del_timer_sync(&mp->mib_counters_timer);
    886    
    887     - skb_queue_purge(&mp->rx_recycle);
    888     -
    889     for (i = 0; i < mp->rxq_count; i++)
    890     rxq_deinit(mp->rxq + i);
    891     for (i = 0; i < mp->txq_count; i++)
    892     diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
    893     index 5a30bf8..f4be8f7 100644
    894     --- a/drivers/net/ethernet/marvell/skge.c
    895     +++ b/drivers/net/ethernet/marvell/skge.c
    896     @@ -4153,6 +4153,13 @@ static struct dmi_system_id skge_32bit_dma_boards[] = {
    897     DMI_MATCH(DMI_BOARD_NAME, "nForce"),
    898     },
    899     },
    900     + {
    901     + .ident = "ASUS P5NSLI",
    902     + .matches = {
    903     + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
    904     + DMI_MATCH(DMI_BOARD_NAME, "P5NSLI")
    905     + },
    906     + },
    907     {}
    908     };
    909    
    910     diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
    911     index e872e1d..7d51a65 100644
    912     --- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
    913     +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
    914     @@ -50,7 +50,6 @@ struct stmmac_priv {
    915     unsigned int dirty_rx;
    916     struct sk_buff **rx_skbuff;
    917     dma_addr_t *rx_skbuff_dma;
    918     - struct sk_buff_head rx_recycle;
    919    
    920     struct net_device *dev;
    921     dma_addr_t dma_rx_phy;
    922     diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    923     index 3be8833..c6cdbc4 100644
    924     --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    925     +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    926     @@ -747,18 +747,7 @@ static void stmmac_tx(struct stmmac_priv *priv)
    927     priv->hw->ring->clean_desc3(p);
    928    
    929     if (likely(skb != NULL)) {
    930     - /*
    931     - * If there's room in the queue (limit it to size)
    932     - * we add this skb back into the pool,
    933     - * if it's the right size.
    934     - */
    935     - if ((skb_queue_len(&priv->rx_recycle) <
    936     - priv->dma_rx_size) &&
    937     - skb_recycle_check(skb, priv->dma_buf_sz))
    938     - __skb_queue_head(&priv->rx_recycle, skb);
    939     - else
    940     - dev_kfree_skb(skb);
    941     -
    942     + dev_kfree_skb(skb);
    943     priv->tx_skbuff[entry] = NULL;
    944     }
    945    
    946     @@ -1169,7 +1158,6 @@ static int stmmac_open(struct net_device *dev)
    947     priv->eee_enabled = stmmac_eee_init(priv);
    948    
    949     napi_enable(&priv->napi);
    950     - skb_queue_head_init(&priv->rx_recycle);
    951     netif_start_queue(dev);
    952    
    953     return 0;
    954     @@ -1222,7 +1210,6 @@ static int stmmac_release(struct net_device *dev)
    955     kfree(priv->tm);
    956     #endif
    957     napi_disable(&priv->napi);
    958     - skb_queue_purge(&priv->rx_recycle);
    959    
    960     /* Free the IRQ lines */
    961     free_irq(dev->irq, dev);
    962     @@ -1388,10 +1375,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv)
    963     if (likely(priv->rx_skbuff[entry] == NULL)) {
    964     struct sk_buff *skb;
    965    
    966     - skb = __skb_dequeue(&priv->rx_recycle);
    967     - if (skb == NULL)
    968     - skb = netdev_alloc_skb_ip_align(priv->dev,
    969     - bfsize);
    970     + skb = netdev_alloc_skb_ip_align(priv->dev, bfsize);
    971    
    972     if (unlikely(skb == NULL))
    973     break;
    974     diff --git a/drivers/pcmcia/pxa2xx_sharpsl.c b/drivers/pcmcia/pxa2xx_sharpsl.c
    975     index b066273..7dd879c 100644
    976     --- a/drivers/pcmcia/pxa2xx_sharpsl.c
    977     +++ b/drivers/pcmcia/pxa2xx_sharpsl.c
    978     @@ -194,7 +194,7 @@ static void sharpsl_pcmcia_socket_suspend(struct soc_pcmcia_socket *skt)
    979     sharpsl_pcmcia_init_reset(skt);
    980     }
    981    
    982     -static struct pcmcia_low_level sharpsl_pcmcia_ops __initdata = {
    983     +static struct pcmcia_low_level sharpsl_pcmcia_ops = {
    984     .owner = THIS_MODULE,
    985     .hw_init = sharpsl_pcmcia_hw_init,
    986     .socket_state = sharpsl_pcmcia_socket_state,
    987     diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
    988     index dc5c126..63560c3 100644
    989     --- a/drivers/pinctrl/core.c
    990     +++ b/drivers/pinctrl/core.c
    991     @@ -1059,8 +1059,10 @@ static int pinctrl_groups_show(struct seq_file *s, void *what)
    992     seq_printf(s, "group: %s\n", gname);
    993     for (i = 0; i < num_pins; i++) {
    994     pname = pin_get_name(pctldev, pins[i]);
    995     - if (WARN_ON(!pname))
    996     + if (WARN_ON(!pname)) {
    997     + mutex_unlock(&pinctrl_mutex);
    998     return -EINVAL;
    999     + }
    1000     seq_printf(s, "pin %d (%s)\n", pins[i], pname);
    1001     }
    1002     seq_puts(s, "\n");
    1003     diff --git a/drivers/pinctrl/pinconf.c b/drivers/pinctrl/pinconf.c
    1004     index 43f474c..baee2cc 100644
    1005     --- a/drivers/pinctrl/pinconf.c
    1006     +++ b/drivers/pinctrl/pinconf.c
    1007     @@ -537,8 +537,6 @@ static int pinconf_groups_show(struct seq_file *s, void *what)
    1008     seq_puts(s, "Pin config settings per pin group\n");
    1009     seq_puts(s, "Format: group (name): configs\n");
    1010    
    1011     - mutex_lock(&pinctrl_mutex);
    1012     -
    1013     while (selector < ngroups) {
    1014     const char *gname = pctlops->get_group_name(pctldev, selector);
    1015    
    1016     @@ -549,8 +547,6 @@ static int pinconf_groups_show(struct seq_file *s, void *what)
    1017     selector++;
    1018     }
    1019    
    1020     - mutex_unlock(&pinctrl_mutex);
    1021     -
    1022     return 0;
    1023     }
    1024    
    1025     diff --git a/drivers/pinctrl/pinctrl-tegra.c b/drivers/pinctrl/pinctrl-tegra.c
    1026     index ae52e4e..5a5f261 100644
    1027     --- a/drivers/pinctrl/pinctrl-tegra.c
    1028     +++ b/drivers/pinctrl/pinctrl-tegra.c
    1029     @@ -466,7 +466,7 @@ static int tegra_pinconf_reg(struct tegra_pmx *pmx,
    1030     *bank = g->drv_bank;
    1031     *reg = g->drv_reg;
    1032     *bit = g->lpmd_bit;
    1033     - *width = 1;
    1034     + *width = 2;
    1035     break;
    1036     case TEGRA_PINCONF_PARAM_DRIVE_DOWN_STRENGTH:
    1037     *bank = g->drv_bank;
    1038     diff --git a/drivers/pinctrl/pinctrl-tegra30.c b/drivers/pinctrl/pinctrl-tegra30.c
    1039     index 0386fdf..7894f14 100644
    1040     --- a/drivers/pinctrl/pinctrl-tegra30.c
    1041     +++ b/drivers/pinctrl/pinctrl-tegra30.c
    1042     @@ -3345,10 +3345,10 @@ static const struct tegra_function tegra30_functions[] = {
    1043     FUNCTION(vi_alt3),
    1044     };
    1045    
    1046     -#define MUXCTL_REG_A 0x3000
    1047     -#define PINGROUP_REG_A 0x868
    1048     +#define DRV_PINGROUP_REG_A 0x868 /* bank 0 */
    1049     +#define PINGROUP_REG_A 0x3000 /* bank 1 */
    1050    
    1051     -#define PINGROUP_REG_Y(r) ((r) - MUXCTL_REG_A)
    1052     +#define PINGROUP_REG_Y(r) ((r) - PINGROUP_REG_A)
    1053     #define PINGROUP_REG_N(r) -1
    1054    
    1055     #define PINGROUP(pg_name, f0, f1, f2, f3, f_safe, r, od, ior) \
    1056     @@ -3364,25 +3364,25 @@ static const struct tegra_function tegra30_functions[] = {
    1057     }, \
    1058     .func_safe = TEGRA_MUX_ ## f_safe, \
    1059     .mux_reg = PINGROUP_REG_Y(r), \
    1060     - .mux_bank = 0, \
    1061     + .mux_bank = 1, \
    1062     .mux_bit = 0, \
    1063     .pupd_reg = PINGROUP_REG_Y(r), \
    1064     - .pupd_bank = 0, \
    1065     + .pupd_bank = 1, \
    1066     .pupd_bit = 2, \
    1067     .tri_reg = PINGROUP_REG_Y(r), \
    1068     - .tri_bank = 0, \
    1069     + .tri_bank = 1, \
    1070     .tri_bit = 4, \
    1071     .einput_reg = PINGROUP_REG_Y(r), \
    1072     - .einput_bank = 0, \
    1073     + .einput_bank = 1, \
    1074     .einput_bit = 5, \
    1075     .odrain_reg = PINGROUP_REG_##od(r), \
    1076     - .odrain_bank = 0, \
    1077     + .odrain_bank = 1, \
    1078     .odrain_bit = 6, \
    1079     .lock_reg = PINGROUP_REG_Y(r), \
    1080     - .lock_bank = 0, \
    1081     + .lock_bank = 1, \
    1082     .lock_bit = 7, \
    1083     .ioreset_reg = PINGROUP_REG_##ior(r), \
    1084     - .ioreset_bank = 0, \
    1085     + .ioreset_bank = 1, \
    1086     .ioreset_bit = 8, \
    1087     .drv_reg = -1, \
    1088     }
    1089     @@ -3401,8 +3401,8 @@ static const struct tegra_function tegra30_functions[] = {
    1090     .odrain_reg = -1, \
    1091     .lock_reg = -1, \
    1092     .ioreset_reg = -1, \
    1093     - .drv_reg = ((r) - PINGROUP_REG_A), \
    1094     - .drv_bank = 1, \
    1095     + .drv_reg = ((r) - DRV_PINGROUP_REG_A), \
    1096     + .drv_bank = 0, \
    1097     .hsm_bit = hsm_b, \
    1098     .schmitt_bit = schmitt_b, \
    1099     .lpmd_bit = lpmd_b, \
    1100     diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
    1101     index e8007b8..84f7dff 100644
    1102     --- a/drivers/usb/class/cdc-acm.c
    1103     +++ b/drivers/usb/class/cdc-acm.c
    1104     @@ -818,10 +818,6 @@ static const __u32 acm_tty_speed[] = {
    1105     2500000, 3000000, 3500000, 4000000
    1106     };
    1107    
    1108     -static const __u8 acm_tty_size[] = {
    1109     - 5, 6, 7, 8
    1110     -};
    1111     -
    1112     static void acm_tty_set_termios(struct tty_struct *tty,
    1113     struct ktermios *termios_old)
    1114     {
    1115     @@ -835,7 +831,21 @@ static void acm_tty_set_termios(struct tty_struct *tty,
    1116     newline.bParityType = termios->c_cflag & PARENB ?
    1117     (termios->c_cflag & PARODD ? 1 : 2) +
    1118     (termios->c_cflag & CMSPAR ? 2 : 0) : 0;
    1119     - newline.bDataBits = acm_tty_size[(termios->c_cflag & CSIZE) >> 4];
    1120     + switch (termios->c_cflag & CSIZE) {
    1121     + case CS5:
    1122     + newline.bDataBits = 5;
    1123     + break;
    1124     + case CS6:
    1125     + newline.bDataBits = 6;
    1126     + break;
    1127     + case CS7:
    1128     + newline.bDataBits = 7;
    1129     + break;
    1130     + case CS8:
    1131     + default:
    1132     + newline.bDataBits = 8;
    1133     + break;
    1134     + }
    1135     /* FIXME: Needs to clear unsupported bits in the termios */
    1136     acm->clocal = ((termios->c_cflag & CLOCAL) != 0);
    1137    
    1138     @@ -1234,7 +1244,7 @@ made_compressed_probe:
    1139    
    1140     if (usb_endpoint_xfer_int(epwrite))
    1141     usb_fill_int_urb(snd->urb, usb_dev,
    1142     - usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress),
    1143     + usb_sndintpipe(usb_dev, epwrite->bEndpointAddress),
    1144     NULL, acm->writesize, acm_write_bulk, snd, epwrite->bInterval);
    1145     else
    1146     usb_fill_bulk_urb(snd->urb, usb_dev,
    1147     diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
    1148     index ebb8a9d..7f75343 100644
    1149     --- a/drivers/usb/core/devio.c
    1150     +++ b/drivers/usb/core/devio.c
    1151     @@ -1348,6 +1348,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
    1152     ret = -EFAULT;
    1153     goto error;
    1154     }
    1155     + uurb->buffer += u;
    1156     }
    1157     totlen -= u;
    1158     }
    1159     diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
    1160     index 445455a..fb6e97f 100644
    1161     --- a/drivers/usb/core/driver.c
    1162     +++ b/drivers/usb/core/driver.c
    1163     @@ -372,6 +372,10 @@ static int usb_probe_interface(struct device *dev)
    1164     intf->condition = USB_INTERFACE_UNBOUND;
    1165     usb_cancel_queued_reset(intf);
    1166    
    1167     + /* If the LPM disable succeeded, balance the ref counts. */
    1168     + if (!lpm_disable_error)
    1169     + usb_unlocked_enable_lpm(udev);
    1170     +
    1171     /* Unbound interfaces are always runtime-PM-disabled and -suspended */
    1172     if (driver->supports_autosuspend)
    1173     pm_runtime_disable(dev);
    1174     diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    1175     index 128a804..bbff143 100644
    1176     --- a/drivers/usb/core/hub.c
    1177     +++ b/drivers/usb/core/hub.c
    1178     @@ -3258,16 +3258,6 @@ static int usb_set_device_initiated_lpm(struct usb_device *udev,
    1179    
    1180     if (enable) {
    1181     /*
    1182     - * First, let the device know about the exit latencies
    1183     - * associated with the link state we're about to enable.
    1184     - */
    1185     - ret = usb_req_set_sel(udev, state);
    1186     - if (ret < 0) {
    1187     - dev_warn(&udev->dev, "Set SEL for device-initiated "
    1188     - "%s failed.\n", usb3_lpm_names[state]);
    1189     - return -EBUSY;
    1190     - }
    1191     - /*
    1192     * Now send the control transfer to enable device-initiated LPM
    1193     * for either U1 or U2.
    1194     */
    1195     @@ -3352,7 +3342,28 @@ static int usb_set_lpm_timeout(struct usb_device *udev,
    1196     static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev,
    1197     enum usb3_link_state state)
    1198     {
    1199     - int timeout;
    1200     + int timeout, ret;
    1201     + __u8 u1_mel = udev->bos->ss_cap->bU1devExitLat;
    1202     + __le16 u2_mel = udev->bos->ss_cap->bU2DevExitLat;
    1203     +
    1204     + /* If the device says it doesn't have *any* exit latency to come out of
    1205     + * U1 or U2, it's probably lying. Assume it doesn't implement that link
    1206     + * state.
    1207     + */
    1208     + if ((state == USB3_LPM_U1 && u1_mel == 0) ||
    1209     + (state == USB3_LPM_U2 && u2_mel == 0))
    1210     + return;
    1211     +
    1212     + /*
    1213     + * First, let the device know about the exit latencies
    1214     + * associated with the link state we're about to enable.
    1215     + */
    1216     + ret = usb_req_set_sel(udev, state);
    1217     + if (ret < 0) {
    1218     + dev_warn(&udev->dev, "Set SEL for device-initiated %s failed.\n",
    1219     + usb3_lpm_names[state]);
    1220     + return;
    1221     + }
    1222    
    1223     /* We allow the host controller to set the U1/U2 timeout internally
    1224     * first, so that it can change its schedule to account for the
    1225     diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
    1226     index c2813c2b..eb0fd10 100644
    1227     --- a/drivers/usb/dwc3/gadget.c
    1228     +++ b/drivers/usb/dwc3/gadget.c
    1229     @@ -1899,6 +1899,7 @@ static void dwc3_stop_active_transfer(struct dwc3 *dwc, u32 epnum)
    1230     ret = dwc3_send_gadget_ep_cmd(dwc, dep->number, cmd, &params);
    1231     WARN_ON_ONCE(ret);
    1232     dep->resource_index = 0;
    1233     + dep->flags &= ~DWC3_EP_BUSY;
    1234     }
    1235    
    1236     static void dwc3_stop_active_transfers(struct dwc3 *dwc)
    1237     diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    1238     index a49868d..0644f65 100644
    1239     --- a/drivers/usb/host/xhci.c
    1240     +++ b/drivers/usb/host/xhci.c
    1241     @@ -479,7 +479,8 @@ static bool compliance_mode_recovery_timer_quirk_check(void)
    1242    
    1243     if (strstr(dmi_product_name, "Z420") ||
    1244     strstr(dmi_product_name, "Z620") ||
    1245     - strstr(dmi_product_name, "Z820"))
    1246     + strstr(dmi_product_name, "Z820") ||
    1247     + strstr(dmi_product_name, "Z1"))
    1248     return true;
    1249    
    1250     return false;
    1251     diff --git a/drivers/usb/musb/am35x.c b/drivers/usb/musb/am35x.c
    1252     index 7a95ab8..ee9ec13 100644
    1253     --- a/drivers/usb/musb/am35x.c
    1254     +++ b/drivers/usb/musb/am35x.c
    1255     @@ -312,6 +312,12 @@ static irqreturn_t am35x_musb_interrupt(int irq, void *hci)
    1256     ret = IRQ_HANDLED;
    1257     }
    1258    
    1259     + /* Drop spurious RX and TX if device is disconnected */
    1260     + if (musb->int_usb & MUSB_INTR_DISCONNECT) {
    1261     + musb->int_tx = 0;
    1262     + musb->int_rx = 0;
    1263     + }
    1264     +
    1265     if (musb->int_tx || musb->int_rx || musb->int_usb)
    1266     ret |= musb_interrupt(musb);
    1267    
    1268     diff --git a/drivers/usb/serial/ark3116.c b/drivers/usb/serial/ark3116.c
    1269     index f8ce97d..a6758ff 100644
    1270     --- a/drivers/usb/serial/ark3116.c
    1271     +++ b/drivers/usb/serial/ark3116.c
    1272     @@ -126,9 +126,6 @@ static inline int calc_divisor(int bps)
    1273    
    1274     static int ark3116_attach(struct usb_serial *serial)
    1275     {
    1276     - struct usb_serial_port *port = serial->port[0];
    1277     - struct ark3116_private *priv;
    1278     -
    1279     /* make sure we have our end-points */
    1280     if ((serial->num_bulk_in == 0) ||
    1281     (serial->num_bulk_out == 0) ||
    1282     @@ -143,8 +140,15 @@ static int ark3116_attach(struct usb_serial *serial)
    1283     return -EINVAL;
    1284     }
    1285    
    1286     - priv = kzalloc(sizeof(struct ark3116_private),
    1287     - GFP_KERNEL);
    1288     + return 0;
    1289     +}
    1290     +
    1291     +static int ark3116_port_probe(struct usb_serial_port *port)
    1292     +{
    1293     + struct usb_serial *serial = port->serial;
    1294     + struct ark3116_private *priv;
    1295     +
    1296     + priv = kzalloc(sizeof(*priv), GFP_KERNEL);
    1297     if (!priv)
    1298     return -ENOMEM;
    1299    
    1300     @@ -199,18 +203,15 @@ static int ark3116_attach(struct usb_serial *serial)
    1301     return 0;
    1302     }
    1303    
    1304     -static void ark3116_release(struct usb_serial *serial)
    1305     +static int ark3116_port_remove(struct usb_serial_port *port)
    1306     {
    1307     - struct usb_serial_port *port = serial->port[0];
    1308     struct ark3116_private *priv = usb_get_serial_port_data(port);
    1309    
    1310     /* device is closed, so URBs and DMA should be down */
    1311     -
    1312     - usb_set_serial_port_data(port, NULL);
    1313     -
    1314     mutex_destroy(&priv->hw_lock);
    1315     -
    1316     kfree(priv);
    1317     +
    1318     + return 0;
    1319     }
    1320    
    1321     static void ark3116_init_termios(struct tty_struct *tty)
    1322     @@ -725,7 +726,8 @@ static struct usb_serial_driver ark3116_device = {
    1323     .id_table = id_table,
    1324     .num_ports = 1,
    1325     .attach = ark3116_attach,
    1326     - .release = ark3116_release,
    1327     + .port_probe = ark3116_port_probe,
    1328     + .port_remove = ark3116_port_remove,
    1329     .set_termios = ark3116_set_termios,
    1330     .init_termios = ark3116_init_termios,
    1331     .ioctl = ark3116_ioctl,
    1332     diff --git a/drivers/usb/serial/belkin_sa.c b/drivers/usb/serial/belkin_sa.c
    1333     index 6b73656..89a3dd3 100644
    1334     --- a/drivers/usb/serial/belkin_sa.c
    1335     +++ b/drivers/usb/serial/belkin_sa.c
    1336     @@ -47,8 +47,8 @@ static bool debug;
    1337     #define DRIVER_DESC "USB Belkin Serial converter driver"
    1338    
    1339     /* function prototypes for a Belkin USB Serial Adapter F5U103 */
    1340     -static int belkin_sa_startup(struct usb_serial *serial);
    1341     -static void belkin_sa_release(struct usb_serial *serial);
    1342     +static int belkin_sa_port_probe(struct usb_serial_port *port);
    1343     +static int belkin_sa_port_remove(struct usb_serial_port *port);
    1344     static int belkin_sa_open(struct tty_struct *tty,
    1345     struct usb_serial_port *port);
    1346     static void belkin_sa_close(struct usb_serial_port *port);
    1347     @@ -90,8 +90,8 @@ static struct usb_serial_driver belkin_device = {
    1348     .break_ctl = belkin_sa_break_ctl,
    1349     .tiocmget = belkin_sa_tiocmget,
    1350     .tiocmset = belkin_sa_tiocmset,
    1351     - .attach = belkin_sa_startup,
    1352     - .release = belkin_sa_release,
    1353     + .port_probe = belkin_sa_port_probe,
    1354     + .port_remove = belkin_sa_port_remove,
    1355     };
    1356    
    1357     static struct usb_serial_driver * const serial_drivers[] = {
    1358     @@ -120,17 +120,15 @@ struct belkin_sa_private {
    1359     (c), BELKIN_SA_SET_REQUEST_TYPE, \
    1360     (v), 0, NULL, 0, WDR_TIMEOUT)
    1361    
    1362     -/* do some startup allocations not currently performed by usb_serial_probe() */
    1363     -static int belkin_sa_startup(struct usb_serial *serial)
    1364     +static int belkin_sa_port_probe(struct usb_serial_port *port)
    1365     {
    1366     - struct usb_device *dev = serial->dev;
    1367     + struct usb_device *dev = port->serial->dev;
    1368     struct belkin_sa_private *priv;
    1369    
    1370     - /* allocate the private data structure */
    1371     priv = kmalloc(sizeof(struct belkin_sa_private), GFP_KERNEL);
    1372     if (!priv)
    1373     - return -1; /* error */
    1374     - /* set initial values for control structures */
    1375     + return -ENOMEM;
    1376     +
    1377     spin_lock_init(&priv->lock);
    1378     priv->control_state = 0;
    1379     priv->last_lsr = 0;
    1380     @@ -142,18 +140,19 @@ static int belkin_sa_startup(struct usb_serial *serial)
    1381     le16_to_cpu(dev->descriptor.bcdDevice),
    1382     priv->bad_flow_control);
    1383    
    1384     - init_waitqueue_head(&serial->port[0]->write_wait);
    1385     - usb_set_serial_port_data(serial->port[0], priv);
    1386     + usb_set_serial_port_data(port, priv);
    1387    
    1388     return 0;
    1389     }
    1390    
    1391     -static void belkin_sa_release(struct usb_serial *serial)
    1392     +static int belkin_sa_port_remove(struct usb_serial_port *port)
    1393     {
    1394     - int i;
    1395     + struct belkin_sa_private *priv;
    1396    
    1397     - for (i = 0; i < serial->num_ports; ++i)
    1398     - kfree(usb_get_serial_port_data(serial->port[i]));
    1399     + priv = usb_get_serial_port_data(port);
    1400     + kfree(priv);
    1401     +
    1402     + return 0;
    1403     }
    1404    
    1405     static int belkin_sa_open(struct tty_struct *tty,
    1406     diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    1407     index 1e71079..4ea9e33 100644
    1408     --- a/drivers/usb/serial/cp210x.c
    1409     +++ b/drivers/usb/serial/cp210x.c
    1410     @@ -164,7 +164,7 @@ static const struct usb_device_id id_table[] = {
    1411    
    1412     MODULE_DEVICE_TABLE(usb, id_table);
    1413    
    1414     -struct cp210x_port_private {
    1415     +struct cp210x_serial_private {
    1416     __u8 bInterfaceNumber;
    1417     };
    1418    
    1419     @@ -278,7 +278,7 @@ static int cp210x_get_config(struct usb_serial_port *port, u8 request,
    1420     unsigned int *data, int size)
    1421     {
    1422     struct usb_serial *serial = port->serial;
    1423     - struct cp210x_port_private *port_priv = usb_get_serial_port_data(port);
    1424     + struct cp210x_serial_private *spriv = usb_get_serial_data(serial);
    1425     __le32 *buf;
    1426     int result, i, length;
    1427    
    1428     @@ -294,7 +294,7 @@ static int cp210x_get_config(struct usb_serial_port *port, u8 request,
    1429     /* Issue the request, attempting to read 'size' bytes */
    1430     result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
    1431     request, REQTYPE_INTERFACE_TO_HOST, 0x0000,
    1432     - port_priv->bInterfaceNumber, buf, size,
    1433     + spriv->bInterfaceNumber, buf, size,
    1434     USB_CTRL_GET_TIMEOUT);
    1435    
    1436     /* Convert data into an array of integers */
    1437     @@ -326,7 +326,7 @@ static int cp210x_set_config(struct usb_serial_port *port, u8 request,
    1438     unsigned int *data, int size)
    1439     {
    1440     struct usb_serial *serial = port->serial;
    1441     - struct cp210x_port_private *port_priv = usb_get_serial_port_data(port);
    1442     + struct cp210x_serial_private *spriv = usb_get_serial_data(serial);
    1443     __le32 *buf;
    1444     int result, i, length;
    1445    
    1446     @@ -348,13 +348,13 @@ static int cp210x_set_config(struct usb_serial_port *port, u8 request,
    1447     result = usb_control_msg(serial->dev,
    1448     usb_sndctrlpipe(serial->dev, 0),
    1449     request, REQTYPE_HOST_TO_INTERFACE, 0x0000,
    1450     - port_priv->bInterfaceNumber, buf, size,
    1451     + spriv->bInterfaceNumber, buf, size,
    1452     USB_CTRL_SET_TIMEOUT);
    1453     } else {
    1454     result = usb_control_msg(serial->dev,
    1455     usb_sndctrlpipe(serial->dev, 0),
    1456     request, REQTYPE_HOST_TO_INTERFACE, data[0],
    1457     - port_priv->bInterfaceNumber, NULL, 0,
    1458     + spriv->bInterfaceNumber, NULL, 0,
    1459     USB_CTRL_SET_TIMEOUT);
    1460     }
    1461    
    1462     @@ -854,37 +854,30 @@ static void cp210x_break_ctl (struct tty_struct *tty, int break_state)
    1463    
    1464     static int cp210x_startup(struct usb_serial *serial)
    1465     {
    1466     - struct cp210x_port_private *port_priv;
    1467     - int i;
    1468     + struct usb_host_interface *cur_altsetting;
    1469     + struct cp210x_serial_private *spriv;
    1470    
    1471     /* cp210x buffers behave strangely unless device is reset */
    1472     usb_reset_device(serial->dev);
    1473    
    1474     - for (i = 0; i < serial->num_ports; i++) {
    1475     - port_priv = kzalloc(sizeof(*port_priv), GFP_KERNEL);
    1476     - if (!port_priv)
    1477     - return -ENOMEM;
    1478     + spriv = kzalloc(sizeof(*spriv), GFP_KERNEL);
    1479     + if (!spriv)
    1480     + return -ENOMEM;
    1481    
    1482     - memset(port_priv, 0x00, sizeof(*port_priv));
    1483     - port_priv->bInterfaceNumber =
    1484     - serial->interface->cur_altsetting->desc.bInterfaceNumber;
    1485     + cur_altsetting = serial->interface->cur_altsetting;
    1486     + spriv->bInterfaceNumber = cur_altsetting->desc.bInterfaceNumber;
    1487    
    1488     - usb_set_serial_port_data(serial->port[i], port_priv);
    1489     - }
    1490     + usb_set_serial_data(serial, spriv);
    1491    
    1492     return 0;
    1493     }
    1494    
    1495     static void cp210x_release(struct usb_serial *serial)
    1496     {
    1497     - struct cp210x_port_private *port_priv;
    1498     - int i;
    1499     + struct cp210x_serial_private *spriv;
    1500    
    1501     - for (i = 0; i < serial->num_ports; i++) {
    1502     - port_priv = usb_get_serial_port_data(serial->port[i]);
    1503     - kfree(port_priv);
    1504     - usb_set_serial_port_data(serial->port[i], NULL);
    1505     - }
    1506     + spriv = usb_get_serial_data(serial);
    1507     + kfree(spriv);
    1508     }
    1509    
    1510     module_usb_serial_driver(serial_drivers, id_table);
    1511     diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
    1512     index 3aa0b53..bfec6f4 100644
    1513     --- a/drivers/usb/serial/cyberjack.c
    1514     +++ b/drivers/usb/serial/cyberjack.c
    1515     @@ -57,9 +57,9 @@ static bool debug;
    1516     #define CYBERJACK_PRODUCT_ID 0x0100
    1517    
    1518     /* Function prototypes */
    1519     -static int cyberjack_startup(struct usb_serial *serial);
    1520     static void cyberjack_disconnect(struct usb_serial *serial);
    1521     -static void cyberjack_release(struct usb_serial *serial);
    1522     +static int cyberjack_port_probe(struct usb_serial_port *port);
    1523     +static int cyberjack_port_remove(struct usb_serial_port *port);
    1524     static int cyberjack_open(struct tty_struct *tty,
    1525     struct usb_serial_port *port);
    1526     static void cyberjack_close(struct usb_serial_port *port);
    1527     @@ -85,9 +85,9 @@ static struct usb_serial_driver cyberjack_device = {
    1528     .description = "Reiner SCT Cyberjack USB card reader",
    1529     .id_table = id_table,
    1530     .num_ports = 1,
    1531     - .attach = cyberjack_startup,
    1532     .disconnect = cyberjack_disconnect,
    1533     - .release = cyberjack_release,
    1534     + .port_probe = cyberjack_port_probe,
    1535     + .port_remove = cyberjack_port_remove,
    1536     .open = cyberjack_open,
    1537     .close = cyberjack_close,
    1538     .write = cyberjack_write,
    1539     @@ -109,55 +109,45 @@ struct cyberjack_private {
    1540     short wrsent; /* Data already sent */
    1541     };
    1542    
    1543     -/* do some startup allocations not currently performed by usb_serial_probe() */
    1544     -static int cyberjack_startup(struct usb_serial *serial)
    1545     +static int cyberjack_port_probe(struct usb_serial_port *port)
    1546     {
    1547     struct cyberjack_private *priv;
    1548     - int i;
    1549     + int result;
    1550    
    1551     - /* allocate the private data structure */
    1552     priv = kmalloc(sizeof(struct cyberjack_private), GFP_KERNEL);
    1553     if (!priv)
    1554     return -ENOMEM;
    1555    
    1556     - /* set initial values */
    1557     spin_lock_init(&priv->lock);
    1558     priv->rdtodo = 0;
    1559     priv->wrfilled = 0;
    1560     priv->wrsent = 0;
    1561     - usb_set_serial_port_data(serial->port[0], priv);
    1562    
    1563     - init_waitqueue_head(&serial->port[0]->write_wait);
    1564     + usb_set_serial_port_data(port, priv);
    1565    
    1566     - for (i = 0; i < serial->num_ports; ++i) {
    1567     - int result;
    1568     - result = usb_submit_urb(serial->port[i]->interrupt_in_urb,
    1569     - GFP_KERNEL);
    1570     - if (result)
    1571     - dev_err(&serial->dev->dev,
    1572     - "usb_submit_urb(read int) failed\n");
    1573     - dbg("%s - usb_submit_urb(int urb)", __func__);
    1574     - }
    1575     + result = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);
    1576     + if (result)
    1577     + dev_err(&port->dev, "usb_submit_urb(read int) failed\n");
    1578    
    1579     return 0;
    1580     }
    1581    
    1582     -static void cyberjack_disconnect(struct usb_serial *serial)
    1583     +static int cyberjack_port_remove(struct usb_serial_port *port)
    1584     {
    1585     - int i;
    1586     + struct cyberjack_private *priv;
    1587    
    1588     - for (i = 0; i < serial->num_ports; ++i)
    1589     - usb_kill_urb(serial->port[i]->interrupt_in_urb);
    1590     + priv = usb_get_serial_port_data(port);
    1591     + kfree(priv);
    1592     +
    1593     + return 0;
    1594     }
    1595    
    1596     -static void cyberjack_release(struct usb_serial *serial)
    1597     +static void cyberjack_disconnect(struct usb_serial *serial)
    1598     {
    1599     int i;
    1600    
    1601     - for (i = 0; i < serial->num_ports; ++i) {
    1602     - /* My special items, the standard routines free my urbs */
    1603     - kfree(usb_get_serial_port_data(serial->port[i]));
    1604     - }
    1605     + for (i = 0; i < serial->num_ports; ++i)
    1606     + usb_kill_urb(serial->port[i]->interrupt_in_urb);
    1607     }
    1608    
    1609     static int cyberjack_open(struct tty_struct *tty,
    1610     diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
    1611     index b78c34e..5ad6e7d 100644
    1612     --- a/drivers/usb/serial/cypress_m8.c
    1613     +++ b/drivers/usb/serial/cypress_m8.c
    1614     @@ -124,10 +124,10 @@ struct cypress_private {
    1615     };
    1616    
    1617     /* function prototypes for the Cypress USB to serial device */
    1618     -static int cypress_earthmate_startup(struct usb_serial *serial);
    1619     -static int cypress_hidcom_startup(struct usb_serial *serial);
    1620     -static int cypress_ca42v2_startup(struct usb_serial *serial);
    1621     -static void cypress_release(struct usb_serial *serial);
    1622     +static int cypress_earthmate_port_probe(struct usb_serial_port *port);
    1623     +static int cypress_hidcom_port_probe(struct usb_serial_port *port);
    1624     +static int cypress_ca42v2_port_probe(struct usb_serial_port *port);
    1625     +static int cypress_port_remove(struct usb_serial_port *port);
    1626     static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port);
    1627     static void cypress_close(struct usb_serial_port *port);
    1628     static void cypress_dtr_rts(struct usb_serial_port *port, int on);
    1629     @@ -157,8 +157,8 @@ static struct usb_serial_driver cypress_earthmate_device = {
    1630     .description = "DeLorme Earthmate USB",
    1631     .id_table = id_table_earthmate,
    1632     .num_ports = 1,
    1633     - .attach = cypress_earthmate_startup,
    1634     - .release = cypress_release,
    1635     + .port_probe = cypress_earthmate_port_probe,
    1636     + .port_remove = cypress_port_remove,
    1637     .open = cypress_open,
    1638     .close = cypress_close,
    1639     .dtr_rts = cypress_dtr_rts,
    1640     @@ -183,8 +183,8 @@ static struct usb_serial_driver cypress_hidcom_device = {
    1641     .description = "HID->COM RS232 Adapter",
    1642     .id_table = id_table_cyphidcomrs232,
    1643     .num_ports = 1,
    1644     - .attach = cypress_hidcom_startup,
    1645     - .release = cypress_release,
    1646     + .port_probe = cypress_hidcom_port_probe,
    1647     + .port_remove = cypress_port_remove,
    1648     .open = cypress_open,
    1649     .close = cypress_close,
    1650     .dtr_rts = cypress_dtr_rts,
    1651     @@ -209,8 +209,8 @@ static struct usb_serial_driver cypress_ca42v2_device = {
    1652     .description = "Nokia CA-42 V2 Adapter",
    1653     .id_table = id_table_nokiaca42v2,
    1654     .num_ports = 1,
    1655     - .attach = cypress_ca42v2_startup,
    1656     - .release = cypress_release,
    1657     + .port_probe = cypress_ca42v2_port_probe,
    1658     + .port_remove = cypress_port_remove,
    1659     .open = cypress_open,
    1660     .close = cypress_close,
    1661     .dtr_rts = cypress_dtr_rts,
    1662     @@ -437,10 +437,10 @@ static void cypress_set_dead(struct usb_serial_port *port)
    1663     *****************************************************************************/
    1664    
    1665    
    1666     -static int generic_startup(struct usb_serial *serial)
    1667     +static int cypress_generic_port_probe(struct usb_serial_port *port)
    1668     {
    1669     + struct usb_serial *serial = port->serial;
    1670     struct cypress_private *priv;
    1671     - struct usb_serial_port *port = serial->port[0];
    1672    
    1673     priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL);
    1674     if (!priv)
    1675     @@ -489,15 +489,17 @@ static int generic_startup(struct usb_serial *serial)
    1676     }
    1677    
    1678    
    1679     -static int cypress_earthmate_startup(struct usb_serial *serial)
    1680     +static int cypress_earthmate_port_probe(struct usb_serial_port *port)
    1681     {
    1682     + struct usb_serial *serial = port->serial;
    1683     struct cypress_private *priv;
    1684     - struct usb_serial_port *port = serial->port[0];
    1685     + int ret;
    1686    
    1687     - if (generic_startup(serial)) {
    1688     + ret = cypress_generic_port_probe(port);
    1689     + if (ret) {
    1690     dbg("%s - Failed setting up port %d", __func__,
    1691     port->number);
    1692     - return 1;
    1693     + return ret;
    1694     }
    1695    
    1696     priv = usb_get_serial_port_data(port);
    1697     @@ -517,54 +519,52 @@ static int cypress_earthmate_startup(struct usb_serial *serial)
    1698     }
    1699    
    1700     return 0;
    1701     -} /* cypress_earthmate_startup */
    1702     -
    1703     +}
    1704    
    1705     -static int cypress_hidcom_startup(struct usb_serial *serial)
    1706     +static int cypress_hidcom_port_probe(struct usb_serial_port *port)
    1707     {
    1708     struct cypress_private *priv;
    1709     + int ret;
    1710    
    1711     - if (generic_startup(serial)) {
    1712     - dbg("%s - Failed setting up port %d", __func__,
    1713     - serial->port[0]->number);
    1714     - return 1;
    1715     + ret = cypress_generic_port_probe(port);
    1716     + if (ret) {
    1717     + dev_dbg(&port->dev, "%s - Failed setting up port\n", __func__);
    1718     + return ret;
    1719     }
    1720    
    1721     - priv = usb_get_serial_port_data(serial->port[0]);
    1722     + priv = usb_get_serial_port_data(port);
    1723     priv->chiptype = CT_CYPHIDCOM;
    1724    
    1725     return 0;
    1726     -} /* cypress_hidcom_startup */
    1727     -
    1728     +}
    1729    
    1730     -static int cypress_ca42v2_startup(struct usb_serial *serial)
    1731     +static int cypress_ca42v2_port_probe(struct usb_serial_port *port)
    1732     {
    1733     struct cypress_private *priv;
    1734     + int ret;
    1735    
    1736     - if (generic_startup(serial)) {
    1737     - dbg("%s - Failed setting up port %d", __func__,
    1738     - serial->port[0]->number);
    1739     - return 1;
    1740     + ret = cypress_generic_port_probe(port);
    1741     + if (ret) {
    1742     + dev_dbg(&port->dev, "%s - Failed setting up port\n", __func__);
    1743     + return ret;
    1744     }
    1745    
    1746     - priv = usb_get_serial_port_data(serial->port[0]);
    1747     + priv = usb_get_serial_port_data(port);
    1748     priv->chiptype = CT_CA42V2;
    1749    
    1750     return 0;
    1751     -} /* cypress_ca42v2_startup */
    1752     -
    1753     +}
    1754    
    1755     -static void cypress_release(struct usb_serial *serial)
    1756     +static int cypress_port_remove(struct usb_serial_port *port)
    1757     {
    1758     struct cypress_private *priv;
    1759    
    1760     - /* all open ports are closed at this point */
    1761     - priv = usb_get_serial_port_data(serial->port[0]);
    1762     + priv = usb_get_serial_port_data(port);
    1763     +
    1764     + kfifo_free(&priv->write_fifo);
    1765     + kfree(priv);
    1766    
    1767     - if (priv) {
    1768     - kfifo_free(&priv->write_fifo);
    1769     - kfree(priv);
    1770     - }
    1771     + return 0;
    1772     }
    1773    
    1774    
    1775     diff --git a/drivers/usb/serial/f81232.c b/drivers/usb/serial/f81232.c
    1776     index 499b15f..be94436 100644
    1777     --- a/drivers/usb/serial/f81232.c
    1778     +++ b/drivers/usb/serial/f81232.c
    1779     @@ -319,39 +319,30 @@ static int f81232_ioctl(struct tty_struct *tty,
    1780     return -ENOIOCTLCMD;
    1781     }
    1782    
    1783     -static int f81232_startup(struct usb_serial *serial)
    1784     +static int f81232_port_probe(struct usb_serial_port *port)
    1785     {
    1786     struct f81232_private *priv;
    1787     - int i;
    1788    
    1789     - for (i = 0; i < serial->num_ports; ++i) {
    1790     - priv = kzalloc(sizeof(struct f81232_private), GFP_KERNEL);
    1791     - if (!priv)
    1792     - goto cleanup;
    1793     - spin_lock_init(&priv->lock);
    1794     - init_waitqueue_head(&priv->delta_msr_wait);
    1795     - usb_set_serial_port_data(serial->port[i], priv);
    1796     - }
    1797     - return 0;
    1798     + priv = kzalloc(sizeof(*priv), GFP_KERNEL);
    1799     + if (!priv)
    1800     + return -ENOMEM;
    1801    
    1802     -cleanup:
    1803     - for (--i; i >= 0; --i) {
    1804     - priv = usb_get_serial_port_data(serial->port[i]);
    1805     - kfree(priv);
    1806     - usb_set_serial_port_data(serial->port[i], NULL);
    1807     - }
    1808     - return -ENOMEM;
    1809     + spin_lock_init(&priv->lock);
    1810     + init_waitqueue_head(&priv->delta_msr_wait);
    1811     +
    1812     + usb_set_serial_port_data(port, priv);
    1813     +
    1814     + return 0;
    1815     }
    1816    
    1817     -static void f81232_release(struct usb_serial *serial)
    1818     +static int f81232_port_remove(struct usb_serial_port *port)
    1819     {
    1820     - int i;
    1821     struct f81232_private *priv;
    1822    
    1823     - for (i = 0; i < serial->num_ports; ++i) {
    1824     - priv = usb_get_serial_port_data(serial->port[i]);
    1825     - kfree(priv);
    1826     - }
    1827     + priv = usb_get_serial_port_data(port);
    1828     + kfree(priv);
    1829     +
    1830     + return 0;
    1831     }
    1832    
    1833     static struct usb_serial_driver f81232_device = {
    1834     @@ -374,8 +365,8 @@ static struct usb_serial_driver f81232_device = {
    1835     .tiocmset = f81232_tiocmset,
    1836     .process_read_urb = f81232_process_read_urb,
    1837     .read_int_callback = f81232_read_int_callback,
    1838     - .attach = f81232_startup,
    1839     - .release = f81232_release,
    1840     + .port_probe = f81232_port_probe,
    1841     + .port_remove = f81232_port_remove,
    1842     };
    1843    
    1844     static struct usb_serial_driver * const serial_drivers[] = {
    1845     diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
    1846     index 346c15a..de9cfd4 100644
    1847     --- a/drivers/usb/serial/garmin_gps.c
    1848     +++ b/drivers/usb/serial/garmin_gps.c
    1849     @@ -1414,11 +1414,10 @@ static void timeout_handler(unsigned long data)
    1850    
    1851    
    1852    
    1853     -static int garmin_attach(struct usb_serial *serial)
    1854     +static int garmin_port_probe(struct usb_serial_port *port)
    1855     {
    1856     - int status = 0;
    1857     - struct usb_serial_port *port = serial->port[0];
    1858     - struct garmin_data *garmin_data_p = NULL;
    1859     + int status;
    1860     + struct garmin_data *garmin_data_p;
    1861    
    1862     garmin_data_p = kzalloc(sizeof(struct garmin_data), GFP_KERNEL);
    1863     if (garmin_data_p == NULL) {
    1864     @@ -1443,22 +1442,14 @@ static int garmin_attach(struct usb_serial *serial)
    1865     }
    1866    
    1867    
    1868     -static void garmin_disconnect(struct usb_serial *serial)
    1869     +static int garmin_port_remove(struct usb_serial_port *port)
    1870     {
    1871     - struct usb_serial_port *port = serial->port[0];
    1872     struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
    1873    
    1874     usb_kill_urb(port->interrupt_in_urb);
    1875     del_timer_sync(&garmin_data_p->timer);
    1876     -}
    1877     -
    1878     -
    1879     -static void garmin_release(struct usb_serial *serial)
    1880     -{
    1881     - struct usb_serial_port *port = serial->port[0];
    1882     - struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
    1883     -
    1884     kfree(garmin_data_p);
    1885     + return 0;
    1886     }
    1887    
    1888    
    1889     @@ -1475,9 +1466,8 @@ static struct usb_serial_driver garmin_device = {
    1890     .close = garmin_close,
    1891     .throttle = garmin_throttle,
    1892     .unthrottle = garmin_unthrottle,
    1893     - .attach = garmin_attach,
    1894     - .disconnect = garmin_disconnect,
    1895     - .release = garmin_release,
    1896     + .port_probe = garmin_port_probe,
    1897     + .port_remove = garmin_port_remove,
    1898     .write = garmin_write,
    1899     .write_room = garmin_write_room,
    1900     .write_bulk_callback = garmin_write_bulk_callback,
    1901     diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
    1902     index e1f5ccd..dca27a5 100644
    1903     --- a/drivers/usb/serial/io_edgeport.c
    1904     +++ b/drivers/usb/serial/io_edgeport.c
    1905     @@ -228,6 +228,8 @@ static int edge_get_icount(struct tty_struct *tty,
    1906     static int edge_startup(struct usb_serial *serial);
    1907     static void edge_disconnect(struct usb_serial *serial);
    1908     static void edge_release(struct usb_serial *serial);
    1909     +static int edge_port_probe(struct usb_serial_port *port);
    1910     +static int edge_port_remove(struct usb_serial_port *port);
    1911    
    1912     #include "io_tables.h" /* all of the devices that this driver supports */
    1913    
    1914     @@ -2921,9 +2923,8 @@ static void load_application_firmware(struct edgeport_serial *edge_serial)
    1915     static int edge_startup(struct usb_serial *serial)
    1916     {
    1917     struct edgeport_serial *edge_serial;
    1918     - struct edgeport_port *edge_port;
    1919     struct usb_device *dev;
    1920     - int i, j;
    1921     + int i;
    1922     int response;
    1923     bool interrupt_in_found;
    1924     bool bulk_in_found;
    1925     @@ -3007,26 +3008,6 @@ static int edge_startup(struct usb_serial *serial)
    1926     /* we set up the pointers to the endpoints in the edge_open function,
    1927     * as the structures aren't created yet. */
    1928    
    1929     - /* set up our port private structures */
    1930     - for (i = 0; i < serial->num_ports; ++i) {
    1931     - edge_port = kzalloc(sizeof(struct edgeport_port), GFP_KERNEL);
    1932     - if (edge_port == NULL) {
    1933     - dev_err(&serial->dev->dev, "%s - Out of memory\n",
    1934     - __func__);
    1935     - for (j = 0; j < i; ++j) {
    1936     - kfree(usb_get_serial_port_data(serial->port[j]));
    1937     - usb_set_serial_port_data(serial->port[j],
    1938     - NULL);
    1939     - }
    1940     - usb_set_serial_data(serial, NULL);
    1941     - kfree(edge_serial);
    1942     - return -ENOMEM;
    1943     - }
    1944     - spin_lock_init(&edge_port->ep_lock);
    1945     - edge_port->port = serial->port[i];
    1946     - usb_set_serial_port_data(serial->port[i], edge_port);
    1947     - }
    1948     -
    1949     response = 0;
    1950    
    1951     if (edge_serial->is_epic) {
    1952     @@ -3175,12 +3156,35 @@ static void edge_release(struct usb_serial *serial)
    1953    
    1954     dbg("%s", __func__);
    1955    
    1956     - for (i = 0; i < serial->num_ports; ++i)
    1957     - kfree(usb_get_serial_port_data(serial->port[i]));
    1958     -
    1959     kfree(edge_serial);
    1960     }
    1961    
    1962     +static int edge_port_probe(struct usb_serial_port *port)
    1963     +{
    1964     + struct edgeport_port *edge_port;
    1965     +
    1966     + edge_port = kzalloc(sizeof(*edge_port), GFP_KERNEL);
    1967     + if (!edge_port)
    1968     + return -ENOMEM;
    1969     +
    1970     + spin_lock_init(&edge_port->ep_lock);
    1971     + edge_port->port = port;
    1972     +
    1973     + usb_set_serial_port_data(port, edge_port);
    1974     +
    1975     + return 0;
    1976     +}
    1977     +
    1978     +static int edge_port_remove(struct usb_serial_port *port)
    1979     +{
    1980     + struct edgeport_port *edge_port;
    1981     +
    1982     + edge_port = usb_get_serial_port_data(port);
    1983     + kfree(edge_port);
    1984     +
    1985     + return 0;
    1986     +}
    1987     +
    1988     module_usb_serial_driver(serial_drivers, id_table_combined);
    1989    
    1990     MODULE_AUTHOR(DRIVER_AUTHOR);
    1991     diff --git a/drivers/usb/serial/io_tables.h b/drivers/usb/serial/io_tables.h
    1992     index 350afdd..1511dd0 100644
    1993     --- a/drivers/usb/serial/io_tables.h
    1994     +++ b/drivers/usb/serial/io_tables.h
    1995     @@ -110,6 +110,8 @@ static struct usb_serial_driver edgeport_2port_device = {
    1996     .attach = edge_startup,
    1997     .disconnect = edge_disconnect,
    1998     .release = edge_release,
    1999     + .port_probe = edge_port_probe,
    2000     + .port_remove = edge_port_remove,
    2001     .ioctl = edge_ioctl,
    2002     .set_termios = edge_set_termios,
    2003     .tiocmget = edge_tiocmget,
    2004     @@ -139,6 +141,8 @@ static struct usb_serial_driver edgeport_4port_device = {
    2005     .attach = edge_startup,
    2006     .disconnect = edge_disconnect,
    2007     .release = edge_release,
    2008     + .port_probe = edge_port_probe,
    2009     + .port_remove = edge_port_remove,
    2010     .ioctl = edge_ioctl,
    2011     .set_termios = edge_set_termios,
    2012     .tiocmget = edge_tiocmget,
    2013     @@ -168,6 +172,8 @@ static struct usb_serial_driver edgeport_8port_device = {
    2014     .attach = edge_startup,
    2015     .disconnect = edge_disconnect,
    2016     .release = edge_release,
    2017     + .port_probe = edge_port_probe,
    2018     + .port_remove = edge_port_remove,
    2019     .ioctl = edge_ioctl,
    2020     .set_termios = edge_set_termios,
    2021     .tiocmget = edge_tiocmget,
    2022     @@ -197,6 +203,8 @@ static struct usb_serial_driver epic_device = {
    2023     .attach = edge_startup,
    2024     .disconnect = edge_disconnect,
    2025     .release = edge_release,
    2026     + .port_probe = edge_port_probe,
    2027     + .port_remove = edge_port_remove,
    2028     .ioctl = edge_ioctl,
    2029     .set_termios = edge_set_termios,
    2030     .tiocmget = edge_tiocmget,
    2031     diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
    2032     index 3936904..ccf297d 100644
    2033     --- a/drivers/usb/serial/io_ti.c
    2034     +++ b/drivers/usb/serial/io_ti.c
    2035     @@ -2594,12 +2594,7 @@ static void edge_break(struct tty_struct *tty, int break_state)
    2036     static int edge_startup(struct usb_serial *serial)
    2037     {
    2038     struct edgeport_serial *edge_serial;
    2039     - struct edgeport_port *edge_port;
    2040     - struct usb_device *dev;
    2041     int status;
    2042     - int i;
    2043     -
    2044     - dev = serial->dev;
    2045    
    2046     /* create our private serial structure */
    2047     edge_serial = kzalloc(sizeof(struct edgeport_serial), GFP_KERNEL);
    2048     @@ -2617,40 +2612,7 @@ static int edge_startup(struct usb_serial *serial)
    2049     return status;
    2050     }
    2051    
    2052     - /* set up our port private structures */
    2053     - for (i = 0; i < serial->num_ports; ++i) {
    2054     - edge_port = kzalloc(sizeof(struct edgeport_port), GFP_KERNEL);
    2055     - if (edge_port == NULL) {
    2056     - dev_err(&serial->dev->dev, "%s - Out of memory\n",
    2057     - __func__);
    2058     - goto cleanup;
    2059     - }
    2060     - spin_lock_init(&edge_port->ep_lock);
    2061     - if (kfifo_alloc(&edge_port->write_fifo, EDGE_OUT_BUF_SIZE,
    2062     - GFP_KERNEL)) {
    2063     - dev_err(&serial->dev->dev, "%s - Out of memory\n",
    2064     - __func__);
    2065     - kfree(edge_port);
    2066     - goto cleanup;
    2067     - }
    2068     - edge_port->port = serial->port[i];
    2069     - edge_port->edge_serial = edge_serial;
    2070     - usb_set_serial_port_data(serial->port[i], edge_port);
    2071     - edge_port->bUartMode = default_uart_mode;
    2072     - }
    2073     -
    2074     return 0;
    2075     -
    2076     -cleanup:
    2077     - for (--i; i >= 0; --i) {
    2078     - edge_port = usb_get_serial_port_data(serial->port[i]);
    2079     - kfifo_free(&edge_port->write_fifo);
    2080     - kfree(edge_port);
    2081     - usb_set_serial_port_data(serial->port[i], NULL);
    2082     - }
    2083     - kfree(edge_serial);
    2084     - usb_set_serial_data(serial, NULL);
    2085     - return -ENOMEM;
    2086     }
    2087    
    2088     static void edge_disconnect(struct usb_serial *serial)
    2089     @@ -2660,19 +2622,54 @@ static void edge_disconnect(struct usb_serial *serial)
    2090    
    2091     static void edge_release(struct usb_serial *serial)
    2092     {
    2093     - int i;
    2094     + kfree(usb_get_serial_data(serial));
    2095     +}
    2096     +
    2097     +static int edge_port_probe(struct usb_serial_port *port)
    2098     +{
    2099     struct edgeport_port *edge_port;
    2100     + int ret;
    2101    
    2102     - dbg("%s", __func__);
    2103     + edge_port = kzalloc(sizeof(*edge_port), GFP_KERNEL);
    2104     + if (!edge_port)
    2105     + return -ENOMEM;
    2106     +
    2107     + ret = kfifo_alloc(&edge_port->write_fifo, EDGE_OUT_BUF_SIZE,
    2108     + GFP_KERNEL);
    2109     + if (ret) {
    2110     + kfree(edge_port);
    2111     + return -ENOMEM;
    2112     + }
    2113     +
    2114     + spin_lock_init(&edge_port->ep_lock);
    2115     + edge_port->port = port;
    2116     + edge_port->edge_serial = usb_get_serial_data(port->serial);
    2117     + edge_port->bUartMode = default_uart_mode;
    2118     +
    2119     + usb_set_serial_port_data(port, edge_port);
    2120    
    2121     - for (i = 0; i < serial->num_ports; ++i) {
    2122     - edge_port = usb_get_serial_port_data(serial->port[i]);
    2123     + ret = edge_create_sysfs_attrs(port);
    2124     + if (ret) {
    2125     kfifo_free(&edge_port->write_fifo);
    2126     kfree(edge_port);
    2127     + return ret;
    2128     }
    2129     - kfree(usb_get_serial_data(serial));
    2130     +
    2131     + return 0;
    2132     }
    2133    
    2134     +static int edge_port_remove(struct usb_serial_port *port)
    2135     +{
    2136     + struct edgeport_port *edge_port;
    2137     +
    2138     + edge_port = usb_get_serial_port_data(port);
    2139     +
    2140     + edge_remove_sysfs_attrs(port);
    2141     + kfifo_free(&edge_port->write_fifo);
    2142     + kfree(edge_port);
    2143     +
    2144     + return 0;
    2145     +}
    2146    
    2147     /* Sysfs Attributes */
    2148    
    2149     @@ -2732,8 +2729,8 @@ static struct usb_serial_driver edgeport_1port_device = {
    2150     .attach = edge_startup,
    2151     .disconnect = edge_disconnect,
    2152     .release = edge_release,
    2153     - .port_probe = edge_create_sysfs_attrs,
    2154     - .port_remove = edge_remove_sysfs_attrs,
    2155     + .port_probe = edge_port_probe,
    2156     + .port_remove = edge_port_remove,
    2157     .ioctl = edge_ioctl,
    2158     .set_termios = edge_set_termios,
    2159     .tiocmget = edge_tiocmget,
    2160     @@ -2763,8 +2760,8 @@ static struct usb_serial_driver edgeport_2port_device = {
    2161     .attach = edge_startup,
    2162     .disconnect = edge_disconnect,
    2163     .release = edge_release,
    2164     - .port_probe = edge_create_sysfs_attrs,
    2165     - .port_remove = edge_remove_sysfs_attrs,
    2166     + .port_probe = edge_port_probe,
    2167     + .port_remove = edge_port_remove,
    2168     .ioctl = edge_ioctl,
    2169     .set_termios = edge_set_termios,
    2170     .tiocmget = edge_tiocmget,
    2171     diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
    2172     index 22b1eb5..cdf0f99 100644
    2173     --- a/drivers/usb/serial/iuu_phoenix.c
    2174     +++ b/drivers/usb/serial/iuu_phoenix.c
    2175     @@ -60,6 +60,8 @@ static int iuu_cardout;
    2176     static bool xmas;
    2177     static int vcc_default = 5;
    2178    
    2179     +static int iuu_create_sysfs_attrs(struct usb_serial_port *port);
    2180     +static int iuu_remove_sysfs_attrs(struct usb_serial_port *port);
    2181     static void read_rxcmd_callback(struct urb *urb);
    2182    
    2183     struct iuu_private {
    2184     @@ -80,64 +82,64 @@ struct iuu_private {
    2185     u32 clk;
    2186     };
    2187    
    2188     -
    2189     -static void iuu_free_buf(struct iuu_private *priv)
    2190     +static int iuu_port_probe(struct usb_serial_port *port)
    2191     {
    2192     - kfree(priv->buf);
    2193     - kfree(priv->dbgbuf);
    2194     - kfree(priv->writebuf);
    2195     -}
    2196     + struct iuu_private *priv;
    2197     + int ret;
    2198     +
    2199     + priv = kzalloc(sizeof(struct iuu_private), GFP_KERNEL);
    2200     + if (!priv)
    2201     + return -ENOMEM;
    2202    
    2203     -static int iuu_alloc_buf(struct iuu_private *priv)
    2204     -{
    2205     priv->buf = kzalloc(256, GFP_KERNEL);
    2206     - priv->dbgbuf = kzalloc(256, GFP_KERNEL);
    2207     - priv->writebuf = kzalloc(256, GFP_KERNEL);
    2208     - if (!priv->buf || !priv->dbgbuf || !priv->writebuf) {
    2209     - iuu_free_buf(priv);
    2210     - dbg("%s problem allocation buffer", __func__);
    2211     + if (!priv->buf) {
    2212     + kfree(priv);
    2213     return -ENOMEM;
    2214     }
    2215     - dbg("%s - Privates buffers allocation success", __func__);
    2216     - return 0;
    2217     -}
    2218    
    2219     -static int iuu_startup(struct usb_serial *serial)
    2220     -{
    2221     - struct iuu_private *priv;
    2222     - priv = kzalloc(sizeof(struct iuu_private), GFP_KERNEL);
    2223     - dbg("%s- priv allocation success", __func__);
    2224     - if (!priv)
    2225     + priv->writebuf = kzalloc(256, GFP_KERNEL);
    2226     + if (!priv->writebuf) {
    2227     + kfree(priv->buf);
    2228     + kfree(priv);
    2229     return -ENOMEM;
    2230     - if (iuu_alloc_buf(priv)) {
    2231     + }
    2232     +
    2233     + priv->dbgbuf = kzalloc(256, GFP_KERNEL);
    2234     + if (!priv->writebuf) {
    2235     + kfree(priv->writebuf);
    2236     + kfree(priv->buf);
    2237     kfree(priv);
    2238     return -ENOMEM;
    2239     }
    2240     +
    2241     priv->vcc = vcc_default;
    2242     spin_lock_init(&priv->lock);
    2243     init_waitqueue_head(&priv->delta_msr_wait);
    2244     - usb_set_serial_port_data(serial->port[0], priv);
    2245     +
    2246     + usb_set_serial_port_data(port, priv);
    2247     +
    2248     + ret = iuu_create_sysfs_attrs(port);
    2249     + if (ret) {
    2250     + kfree(priv->writebuf);
    2251     + kfree(priv->buf);
    2252     + kfree(priv);
    2253     + return ret;
    2254     + }
    2255     +
    2256     return 0;
    2257     }
    2258    
    2259     -/* Release function */
    2260     -static void iuu_release(struct usb_serial *serial)
    2261     +static int iuu_port_remove(struct usb_serial_port *port)
    2262     {
    2263     - struct usb_serial_port *port = serial->port[0];
    2264     struct iuu_private *priv = usb_get_serial_port_data(port);
    2265     - if (!port)
    2266     - return;
    2267     -
    2268     - if (priv) {
    2269     - iuu_free_buf(priv);
    2270     - dbg("%s - I will free all", __func__);
    2271     - usb_set_serial_port_data(port, NULL);
    2272    
    2273     - dbg("%s - priv is not anymore in port structure", __func__);
    2274     - kfree(priv);
    2275     + iuu_remove_sysfs_attrs(port);
    2276     + kfree(priv->dbgbuf);
    2277     + kfree(priv->writebuf);
    2278     + kfree(priv->buf);
    2279     + kfree(priv);
    2280    
    2281     - dbg("%s priv is now kfree", __func__);
    2282     - }
    2283     + return 0;
    2284     }
    2285    
    2286     static int iuu_tiocmset(struct tty_struct *tty,
    2287     @@ -1231,8 +1233,6 @@ static struct usb_serial_driver iuu_device = {
    2288     .num_ports = 1,
    2289     .bulk_in_size = 512,
    2290     .bulk_out_size = 512,
    2291     - .port_probe = iuu_create_sysfs_attrs,
    2292     - .port_remove = iuu_remove_sysfs_attrs,
    2293     .open = iuu_open,
    2294     .close = iuu_close,
    2295     .write = iuu_uart_write,
    2296     @@ -1241,8 +1241,8 @@ static struct usb_serial_driver iuu_device = {
    2297     .tiocmset = iuu_tiocmset,
    2298     .set_termios = iuu_set_termios,
    2299     .init_termios = iuu_init_termios,
    2300     - .attach = iuu_startup,
    2301     - .release = iuu_release,
    2302     + .port_probe = iuu_port_probe,
    2303     + .port_remove = iuu_port_remove,
    2304     };
    2305    
    2306     static struct usb_serial_driver * const serial_drivers[] = {
    2307     diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
    2308     index a4ac3cf..1e73171 100644
    2309     --- a/drivers/usb/serial/keyspan_pda.c
    2310     +++ b/drivers/usb/serial/keyspan_pda.c
    2311     @@ -735,29 +735,33 @@ MODULE_FIRMWARE("keyspan_pda/keyspan_pda.fw");
    2312     MODULE_FIRMWARE("keyspan_pda/xircom_pgs.fw");
    2313     #endif
    2314    
    2315     -static int keyspan_pda_startup(struct usb_serial *serial)
    2316     +static int keyspan_pda_port_probe(struct usb_serial_port *port)
    2317     {
    2318    
    2319     struct keyspan_pda_private *priv;
    2320    
    2321     - /* allocate the private data structures for all ports. Well, for all
    2322     - one ports. */
    2323     -
    2324     priv = kmalloc(sizeof(struct keyspan_pda_private), GFP_KERNEL);
    2325     if (!priv)
    2326     - return 1; /* error */
    2327     - usb_set_serial_port_data(serial->port[0], priv);
    2328     - init_waitqueue_head(&serial->port[0]->write_wait);
    2329     + return -ENOMEM;
    2330     +
    2331     INIT_WORK(&priv->wakeup_work, keyspan_pda_wakeup_write);
    2332     INIT_WORK(&priv->unthrottle_work, keyspan_pda_request_unthrottle);
    2333     - priv->serial = serial;
    2334     - priv->port = serial->port[0];
    2335     + priv->serial = port->serial;
    2336     + priv->port = port;
    2337     +
    2338     + usb_set_serial_port_data(port, priv);
    2339     +
    2340     return 0;
    2341     }
    2342    
    2343     -static void keyspan_pda_release(struct usb_serial *serial)
    2344     +static int keyspan_pda_port_remove(struct usb_serial_port *port)
    2345     {
    2346     - kfree(usb_get_serial_port_data(serial->port[0]));
    2347     + struct keyspan_pda_private *priv;
    2348     +
    2349     + priv = usb_get_serial_port_data(port);
    2350     + kfree(priv);
    2351     +
    2352     + return 0;
    2353     }
    2354    
    2355     #ifdef KEYSPAN
    2356     @@ -808,8 +812,8 @@ static struct usb_serial_driver keyspan_pda_device = {
    2357     .break_ctl = keyspan_pda_break_ctl,
    2358     .tiocmget = keyspan_pda_tiocmget,
    2359     .tiocmset = keyspan_pda_tiocmset,
    2360     - .attach = keyspan_pda_startup,
    2361     - .release = keyspan_pda_release,
    2362     + .port_probe = keyspan_pda_port_probe,
    2363     + .port_remove = keyspan_pda_port_remove,
    2364     };
    2365    
    2366     static struct usb_serial_driver * const serial_drivers[] = {
    2367     diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
    2368     index 5bed59c..366ddee 100644
    2369     --- a/drivers/usb/serial/kl5kusb105.c
    2370     +++ b/drivers/usb/serial/kl5kusb105.c
    2371     @@ -62,8 +62,8 @@ static bool debug;
    2372     /*
    2373     * Function prototypes
    2374     */
    2375     -static int klsi_105_startup(struct usb_serial *serial);
    2376     -static void klsi_105_release(struct usb_serial *serial);
    2377     +static int klsi_105_port_probe(struct usb_serial_port *port);
    2378     +static int klsi_105_port_remove(struct usb_serial_port *port);
    2379     static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port);
    2380     static void klsi_105_close(struct usb_serial_port *port);
    2381     static void klsi_105_set_termios(struct tty_struct *tty,
    2382     @@ -101,8 +101,8 @@ static struct usb_serial_driver kl5kusb105d_device = {
    2383     /*.break_ctl = klsi_105_break_ctl,*/
    2384     .tiocmget = klsi_105_tiocmget,
    2385     .tiocmset = klsi_105_tiocmset,
    2386     - .attach = klsi_105_startup,
    2387     - .release = klsi_105_release,
    2388     + .port_probe = klsi_105_port_probe,
    2389     + .port_remove = klsi_105_port_remove,
    2390     .throttle = usb_serial_generic_throttle,
    2391     .unthrottle = usb_serial_generic_unthrottle,
    2392     .process_read_urb = klsi_105_process_read_urb,
    2393     @@ -225,58 +225,40 @@ static int klsi_105_get_line_state(struct usb_serial_port *port,
    2394     * Driver's tty interface functions
    2395     */
    2396    
    2397     -static int klsi_105_startup(struct usb_serial *serial)
    2398     +static int klsi_105_port_probe(struct usb_serial_port *port)
    2399     {
    2400     struct klsi_105_private *priv;
    2401     - int i;
    2402    
    2403     - /* check if we support the product id (see keyspan.c)
    2404     - * FIXME
    2405     - */
    2406     + priv = kmalloc(sizeof(*priv), GFP_KERNEL);
    2407     + if (!priv)
    2408     + return -ENOMEM;
    2409    
    2410     - /* allocate the private data structure */
    2411     - for (i = 0; i < serial->num_ports; i++) {
    2412     - priv = kmalloc(sizeof(struct klsi_105_private),
    2413     - GFP_KERNEL);
    2414     - if (!priv) {
    2415     - dbg("%skmalloc for klsi_105_private failed.", __func__);
    2416     - i--;
    2417     - goto err_cleanup;
    2418     - }
    2419     - /* set initial values for control structures */
    2420     - priv->cfg.pktlen = 5;
    2421     - priv->cfg.baudrate = kl5kusb105a_sio_b9600;
    2422     - priv->cfg.databits = kl5kusb105a_dtb_8;
    2423     - priv->cfg.unknown1 = 0;
    2424     - priv->cfg.unknown2 = 1;
    2425     + /* set initial values for control structures */
    2426     + priv->cfg.pktlen = 5;
    2427     + priv->cfg.baudrate = kl5kusb105a_sio_b9600;
    2428     + priv->cfg.databits = kl5kusb105a_dtb_8;
    2429     + priv->cfg.unknown1 = 0;
    2430     + priv->cfg.unknown2 = 1;
    2431    
    2432     - priv->line_state = 0;
    2433     + priv->line_state = 0;
    2434    
    2435     - usb_set_serial_port_data(serial->port[i], priv);
    2436     + spin_lock_init(&priv->lock);
    2437    
    2438     - spin_lock_init(&priv->lock);
    2439     + /* priv->termios is left uninitialized until port opening */
    2440    
    2441     - /* priv->termios is left uninitialized until port opening */
    2442     - init_waitqueue_head(&serial->port[i]->write_wait);
    2443     - }
    2444     + usb_set_serial_port_data(port, priv);
    2445    
    2446     return 0;
    2447     -
    2448     -err_cleanup:
    2449     - for (; i >= 0; i--) {
    2450     - priv = usb_get_serial_port_data(serial->port[i]);
    2451     - kfree(priv);
    2452     - usb_set_serial_port_data(serial->port[i], NULL);
    2453     - }
    2454     - return -ENOMEM;
    2455     }
    2456    
    2457     -static void klsi_105_release(struct usb_serial *serial)
    2458     +static int klsi_105_port_remove(struct usb_serial_port *port)
    2459     {
    2460     - int i;
    2461     + struct klsi_105_private *priv;
    2462    
    2463     - for (i = 0; i < serial->num_ports; ++i)
    2464     - kfree(usb_get_serial_port_data(serial->port[i]));
    2465     + priv = usb_get_serial_port_data(port);
    2466     + kfree(priv);
    2467     +
    2468     + return 0;
    2469     }
    2470    
    2471     static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
    2472     diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
    2473     index fafeabb..a579fdc 100644
    2474     --- a/drivers/usb/serial/kobil_sct.c
    2475     +++ b/drivers/usb/serial/kobil_sct.c
    2476     @@ -56,8 +56,8 @@ static bool debug;
    2477    
    2478    
    2479     /* Function prototypes */
    2480     -static int kobil_startup(struct usb_serial *serial);
    2481     -static void kobil_release(struct usb_serial *serial);
    2482     +static int kobil_port_probe(struct usb_serial_port *probe);
    2483     +static int kobil_port_remove(struct usb_serial_port *probe);
    2484     static int kobil_open(struct tty_struct *tty, struct usb_serial_port *port);
    2485     static void kobil_close(struct usb_serial_port *port);
    2486     static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port,
    2487     @@ -91,8 +91,8 @@ static struct usb_serial_driver kobil_device = {
    2488     .description = "KOBIL USB smart card terminal",
    2489     .id_table = id_table,
    2490     .num_ports = 1,
    2491     - .attach = kobil_startup,
    2492     - .release = kobil_release,
    2493     + .port_probe = kobil_port_probe,
    2494     + .port_remove = kobil_port_remove,
    2495     .ioctl = kobil_ioctl,
    2496     .set_termios = kobil_set_termios,
    2497     .init_termios = kobil_init_termios,
    2498     @@ -119,9 +119,10 @@ struct kobil_private {
    2499     };
    2500    
    2501    
    2502     -static int kobil_startup(struct usb_serial *serial)
    2503     +static int kobil_port_probe(struct usb_serial_port *port)
    2504     {
    2505     int i;
    2506     + struct usb_serial *serial = port->serial;
    2507     struct kobil_private *priv;
    2508     struct usb_device *pdev;
    2509     struct usb_host_config *actconfig;
    2510     @@ -152,7 +153,7 @@ static int kobil_startup(struct usb_serial *serial)
    2511     printk(KERN_DEBUG "KOBIL KAAN SIM detected\n");
    2512     break;
    2513     }
    2514     - usb_set_serial_port_data(serial->port[0], priv);
    2515     + usb_set_serial_port_data(port, priv);
    2516    
    2517     /* search for the necessary endpoints */
    2518     pdev = serial->dev;
    2519     @@ -180,12 +181,14 @@ static int kobil_startup(struct usb_serial *serial)
    2520     }
    2521    
    2522    
    2523     -static void kobil_release(struct usb_serial *serial)
    2524     +static int kobil_port_remove(struct usb_serial_port *port)
    2525     {
    2526     - int i;
    2527     + struct kobil_private *priv;
    2528    
    2529     - for (i = 0; i < serial->num_ports; ++i)
    2530     - kfree(usb_get_serial_port_data(serial->port[i]));
    2531     + priv = usb_get_serial_port_data(port);
    2532     + kfree(priv);
    2533     +
    2534     + return 0;
    2535     }
    2536    
    2537     static void kobil_init_termios(struct tty_struct *tty)
    2538     diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    2539     index 5f30800..a0542ca 100644
    2540     --- a/drivers/usb/serial/option.c
    2541     +++ b/drivers/usb/serial/option.c
    2542     @@ -503,11 +503,19 @@ static const struct option_blacklist_info net_intf5_blacklist = {
    2543     .reserved = BIT(5),
    2544     };
    2545    
    2546     +static const struct option_blacklist_info net_intf6_blacklist = {
    2547     + .reserved = BIT(6),
    2548     +};
    2549     +
    2550     static const struct option_blacklist_info zte_mf626_blacklist = {
    2551     .sendsetup = BIT(0) | BIT(1),
    2552     .reserved = BIT(4),
    2553     };
    2554    
    2555     +static const struct option_blacklist_info zte_1255_blacklist = {
    2556     + .reserved = BIT(3) | BIT(4),
    2557     +};
    2558     +
    2559     static const struct usb_device_id option_ids[] = {
    2560     { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
    2561     { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
    2562     @@ -853,13 +861,19 @@ static const struct usb_device_id option_ids[] = {
    2563     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff),
    2564     .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
    2565     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0117, 0xff, 0xff, 0xff) },
    2566     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff) },
    2567     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff) },
    2568     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff),
    2569     + .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
    2570     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff),
    2571     + .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
    2572     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0122, 0xff, 0xff, 0xff) },
    2573     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff) },
    2574     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff) },
    2575     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff) },
    2576     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff) },
    2577     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff),
    2578     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2579     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff),
    2580     + .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
    2581     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff),
    2582     + .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
    2583     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff),
    2584     + .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
    2585     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0128, 0xff, 0xff, 0xff) },
    2586     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0142, 0xff, 0xff, 0xff) },
    2587     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) },
    2588     @@ -872,7 +886,8 @@ static const struct usb_device_id option_ids[] = {
    2589     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) },
    2590     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff),
    2591     .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
    2592     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) },
    2593     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff),
    2594     + .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
    2595     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) },
    2596     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) },
    2597     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) },
    2598     @@ -880,13 +895,22 @@ static const struct usb_device_id option_ids[] = {
    2599     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) },
    2600     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0167, 0xff, 0xff, 0xff),
    2601     .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2602     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0191, 0xff, 0xff, 0xff), /* ZTE EuFi890 */
    2603     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2604     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0199, 0xff, 0xff, 0xff), /* ZTE MF820S */
    2605     + .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
    2606     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0257, 0xff, 0xff, 0xff), /* ZTE MF821 */
    2607     + .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
    2608     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0326, 0xff, 0xff, 0xff),
    2609     .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2610     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff),
    2611     .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2612     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
    2613     .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2614     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
    2615     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff),
    2616     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2617     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1021, 0xff, 0xff, 0xff),
    2618     + .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
    2619     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) },
    2620     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) },
    2621     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) },
    2622     @@ -1002,18 +1026,24 @@ static const struct usb_device_id option_ids[] = {
    2623     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1169, 0xff, 0xff, 0xff) },
    2624     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1170, 0xff, 0xff, 0xff) },
    2625     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1244, 0xff, 0xff, 0xff) },
    2626     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1245, 0xff, 0xff, 0xff) },
    2627     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1245, 0xff, 0xff, 0xff),
    2628     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2629     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1246, 0xff, 0xff, 0xff) },
    2630     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1247, 0xff, 0xff, 0xff) },
    2631     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1247, 0xff, 0xff, 0xff),
    2632     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2633     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1248, 0xff, 0xff, 0xff) },
    2634     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1249, 0xff, 0xff, 0xff) },
    2635     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1250, 0xff, 0xff, 0xff) },
    2636     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1251, 0xff, 0xff, 0xff) },
    2637     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1252, 0xff, 0xff, 0xff) },
    2638     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1252, 0xff, 0xff, 0xff),
    2639     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2640     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1253, 0xff, 0xff, 0xff) },
    2641     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1254, 0xff, 0xff, 0xff) },
    2642     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1255, 0xff, 0xff, 0xff) },
    2643     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1256, 0xff, 0xff, 0xff) },
    2644     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1254, 0xff, 0xff, 0xff),
    2645     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2646     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1255, 0xff, 0xff, 0xff),
    2647     + .driver_info = (kernel_ulong_t)&zte_1255_blacklist },
    2648     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1256, 0xff, 0xff, 0xff),
    2649     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2650     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1257, 0xff, 0xff, 0xff) },
    2651     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1258, 0xff, 0xff, 0xff) },
    2652     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1259, 0xff, 0xff, 0xff) },
    2653     @@ -1058,8 +1088,16 @@ static const struct usb_device_id option_ids[] = {
    2654     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) },
    2655     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) },
    2656     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) },
    2657     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1401, 0xff, 0xff, 0xff),
    2658     + .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
    2659     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1402, 0xff, 0xff, 0xff),
    2660     .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
    2661     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1424, 0xff, 0xff, 0xff),
    2662     + .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
    2663     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1425, 0xff, 0xff, 0xff),
    2664     + .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
    2665     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff), /* ZTE MF91 */
    2666     + .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
    2667     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
    2668     0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
    2669     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
    2670     @@ -1071,15 +1109,21 @@ static const struct usb_device_id option_ids[] = {
    2671     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
    2672     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
    2673     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) },
    2674     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
    2675     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff) },
    2676     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
    2677     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff),
    2678     + .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
    2679     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff),
    2680     + .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
    2681     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff),
    2682     + .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
    2683     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) },
    2684     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
    2685     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff) },
    2686     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff),
    2687     + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    2688     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) },
    2689     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff) },
    2690     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff) },
    2691     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff),
    2692     + .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
    2693     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff),
    2694     + .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
    2695    
    2696     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
    2697     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
    2698     diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
    2699     index 5976b65..3aa582e 100644
    2700     --- a/drivers/usb/serial/oti6858.c
    2701     +++ b/drivers/usb/serial/oti6858.c
    2702     @@ -139,8 +139,8 @@ static int oti6858_chars_in_buffer(struct tty_struct *tty);
    2703     static int oti6858_tiocmget(struct tty_struct *tty);
    2704     static int oti6858_tiocmset(struct tty_struct *tty,
    2705     unsigned int set, unsigned int clear);
    2706     -static int oti6858_startup(struct usb_serial *serial);
    2707     -static void oti6858_release(struct usb_serial *serial);
    2708     +static int oti6858_port_probe(struct usb_serial_port *port);
    2709     +static int oti6858_port_remove(struct usb_serial_port *port);
    2710    
    2711     /* device info */
    2712     static struct usb_serial_driver oti6858_device = {
    2713     @@ -163,8 +163,8 @@ static struct usb_serial_driver oti6858_device = {
    2714     .write_bulk_callback = oti6858_write_bulk_callback,
    2715     .write_room = oti6858_write_room,
    2716     .chars_in_buffer = oti6858_chars_in_buffer,
    2717     - .attach = oti6858_startup,
    2718     - .release = oti6858_release,
    2719     + .port_probe = oti6858_port_probe,
    2720     + .port_remove = oti6858_port_remove,
    2721     };
    2722    
    2723     static struct usb_serial_driver * const serial_drivers[] = {
    2724     @@ -333,36 +333,33 @@ static void send_data(struct work_struct *work)
    2725     usb_serial_port_softint(port);
    2726     }
    2727    
    2728     -static int oti6858_startup(struct usb_serial *serial)
    2729     +static int oti6858_port_probe(struct usb_serial_port *port)
    2730     {
    2731     - struct usb_serial_port *port = serial->port[0];
    2732     struct oti6858_private *priv;
    2733     - int i;
    2734     -
    2735     - for (i = 0; i < serial->num_ports; ++i) {
    2736     - priv = kzalloc(sizeof(struct oti6858_private), GFP_KERNEL);
    2737     - if (!priv)
    2738     - break;
    2739     -
    2740     - spin_lock_init(&priv->lock);
    2741     - init_waitqueue_head(&priv->intr_wait);
    2742     -/* INIT_WORK(&priv->setup_work, setup_line, serial->port[i]); */
    2743     -/* INIT_WORK(&priv->write_work, send_data, serial->port[i]); */
    2744     - priv->port = port;
    2745     - INIT_DELAYED_WORK(&priv->delayed_setup_work, setup_line);
    2746     - INIT_DELAYED_WORK(&priv->delayed_write_work, send_data);
    2747     -
    2748     - usb_set_serial_port_data(serial->port[i], priv);
    2749     - }
    2750     - if (i == serial->num_ports)
    2751     - return 0;
    2752    
    2753     - for (--i; i >= 0; --i) {
    2754     - priv = usb_get_serial_port_data(serial->port[i]);
    2755     - kfree(priv);
    2756     - usb_set_serial_port_data(serial->port[i], NULL);
    2757     - }
    2758     - return -ENOMEM;
    2759     + priv = kzalloc(sizeof(*priv), GFP_KERNEL);
    2760     + if (!priv)
    2761     + return -ENOMEM;
    2762     +
    2763     + spin_lock_init(&priv->lock);
    2764     + init_waitqueue_head(&priv->intr_wait);
    2765     + priv->port = port;
    2766     + INIT_DELAYED_WORK(&priv->delayed_setup_work, setup_line);
    2767     + INIT_DELAYED_WORK(&priv->delayed_write_work, send_data);
    2768     +
    2769     + usb_set_serial_port_data(port, priv);
    2770     +
    2771     + return 0;
    2772     +}
    2773     +
    2774     +static int oti6858_port_remove(struct usb_serial_port *port)
    2775     +{
    2776     + struct oti6858_private *priv;
    2777     +
    2778     + priv = usb_get_serial_port_data(port);
    2779     + kfree(priv);
    2780     +
    2781     + return 0;
    2782     }
    2783    
    2784     static int oti6858_write(struct tty_struct *tty, struct usb_serial_port *port,
    2785     @@ -714,15 +711,6 @@ static int oti6858_ioctl(struct tty_struct *tty,
    2786     return -ENOIOCTLCMD;
    2787     }
    2788    
    2789     -
    2790     -static void oti6858_release(struct usb_serial *serial)
    2791     -{
    2792     - int i;
    2793     -
    2794     - for (i = 0; i < serial->num_ports; ++i)
    2795     - kfree(usb_get_serial_port_data(serial->port[i]));
    2796     -}
    2797     -
    2798     static void oti6858_read_int_callback(struct urb *urb)
    2799     {
    2800     struct usb_serial_port *port = urb->context;
    2801     diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
    2802     index 13b8dd6..4d8d210 100644
    2803     --- a/drivers/usb/serial/pl2303.c
    2804     +++ b/drivers/usb/serial/pl2303.c
    2805     @@ -135,12 +135,15 @@ enum pl2303_type {
    2806     HX, /* HX version of the pl2303 chip */
    2807     };
    2808    
    2809     +struct pl2303_serial_private {
    2810     + enum pl2303_type type;
    2811     +};
    2812     +
    2813     struct pl2303_private {
    2814     spinlock_t lock;
    2815     wait_queue_head_t delta_msr_wait;
    2816     u8 line_control;
    2817     u8 line_status;
    2818     - enum pl2303_type type;
    2819     };
    2820    
    2821     static int pl2303_vendor_read(__u16 value, __u16 index,
    2822     @@ -169,14 +172,19 @@ static int pl2303_vendor_write(__u16 value, __u16 index,
    2823    
    2824     static int pl2303_startup(struct usb_serial *serial)
    2825     {
    2826     - struct pl2303_private *priv;
    2827     + struct pl2303_serial_private *spriv;
    2828     enum pl2303_type type = type_0;
    2829     unsigned char *buf;
    2830     - int i;
    2831     +
    2832     + spriv = kzalloc(sizeof(*spriv), GFP_KERNEL);
    2833     + if (!spriv)
    2834     + return -ENOMEM;
    2835    
    2836     buf = kmalloc(10, GFP_KERNEL);
    2837     - if (buf == NULL)
    2838     + if (!buf) {
    2839     + kfree(spriv);
    2840     return -ENOMEM;
    2841     + }
    2842    
    2843     if (serial->dev->descriptor.bDeviceClass == 0x02)
    2844     type = type_0;
    2845     @@ -188,15 +196,8 @@ static int pl2303_startup(struct usb_serial *serial)
    2846     type = type_1;
    2847     dev_dbg(&serial->interface->dev, "device type: %d\n", type);
    2848    
    2849     - for (i = 0; i < serial->num_ports; ++i) {
    2850     - priv = kzalloc(sizeof(struct pl2303_private), GFP_KERNEL);
    2851     - if (!priv)
    2852     - goto cleanup;
    2853     - spin_lock_init(&priv->lock);
    2854     - init_waitqueue_head(&priv->delta_msr_wait);
    2855     - priv->type = type;
    2856     - usb_set_serial_port_data(serial->port[i], priv);
    2857     - }
    2858     + spriv->type = type;
    2859     + usb_set_serial_data(serial, spriv);
    2860    
    2861     pl2303_vendor_read(0x8484, 0, serial, buf);
    2862     pl2303_vendor_write(0x0404, 0, serial);
    2863     @@ -215,15 +216,40 @@ static int pl2303_startup(struct usb_serial *serial)
    2864    
    2865     kfree(buf);
    2866     return 0;
    2867     +}
    2868    
    2869     -cleanup:
    2870     - kfree(buf);
    2871     - for (--i; i >= 0; --i) {
    2872     - priv = usb_get_serial_port_data(serial->port[i]);
    2873     - kfree(priv);
    2874     - usb_set_serial_port_data(serial->port[i], NULL);
    2875     - }
    2876     - return -ENOMEM;
    2877     +static void pl2303_release(struct usb_serial *serial)
    2878     +{
    2879     + struct pl2303_serial_private *spriv;
    2880     +
    2881     + spriv = usb_get_serial_data(serial);
    2882     + kfree(spriv);
    2883     +}
    2884     +
    2885     +static int pl2303_port_probe(struct usb_serial_port *port)
    2886     +{
    2887     + struct pl2303_private *priv;
    2888     +
    2889     + priv = kzalloc(sizeof(*priv), GFP_KERNEL);
    2890     + if (!priv)
    2891     + return -ENOMEM;
    2892     +
    2893     + spin_lock_init(&priv->lock);
    2894     + init_waitqueue_head(&priv->delta_msr_wait);
    2895     +
    2896     + usb_set_serial_port_data(port, priv);
    2897     +
    2898     + return 0;
    2899     +}
    2900     +
    2901     +static int pl2303_port_remove(struct usb_serial_port *port)
    2902     +{
    2903     + struct pl2303_private *priv;
    2904     +
    2905     + priv = usb_get_serial_port_data(port);
    2906     + kfree(priv);
    2907     +
    2908     + return 0;
    2909     }
    2910    
    2911     static int set_control_lines(struct usb_device *dev, u8 value)
    2912     @@ -242,6 +268,7 @@ static void pl2303_set_termios(struct tty_struct *tty,
    2913     struct usb_serial_port *port, struct ktermios *old_termios)
    2914     {
    2915     struct usb_serial *serial = port->serial;
    2916     + struct pl2303_serial_private *spriv = usb_get_serial_data(serial);
    2917     struct pl2303_private *priv = usb_get_serial_port_data(port);
    2918     unsigned long flags;
    2919     unsigned int cflag;
    2920     @@ -325,7 +352,7 @@ static void pl2303_set_termios(struct tty_struct *tty,
    2921     }
    2922     if (baud > 1228800) {
    2923     /* type_0, type_1 only support up to 1228800 baud */
    2924     - if (priv->type != HX)
    2925     + if (spriv->type != HX)
    2926     baud = 1228800;
    2927     else if (baud > 6000000)
    2928     baud = 6000000;
    2929     @@ -428,7 +455,7 @@ static void pl2303_set_termios(struct tty_struct *tty,
    2930     buf[0], buf[1], buf[2], buf[3], buf[4], buf[5], buf[6]);
    2931    
    2932     if (cflag & CRTSCTS) {
    2933     - if (priv->type == HX)
    2934     + if (spriv->type == HX)
    2935     pl2303_vendor_write(0x0, 0x61, serial);
    2936     else
    2937     pl2303_vendor_write(0x0, 0x41, serial);
    2938     @@ -470,10 +497,10 @@ static int pl2303_open(struct tty_struct *tty, struct usb_serial_port *port)
    2939     {
    2940     struct ktermios tmp_termios;
    2941     struct usb_serial *serial = port->serial;
    2942     - struct pl2303_private *priv = usb_get_serial_port_data(port);
    2943     + struct pl2303_serial_private *spriv = usb_get_serial_data(serial);
    2944     int result;
    2945    
    2946     - if (priv->type != HX) {
    2947     + if (spriv->type != HX) {
    2948     usb_clear_halt(serial->dev, port->write_urb->pipe);
    2949     usb_clear_halt(serial->dev, port->read_urb->pipe);
    2950     } else {
    2951     @@ -657,17 +684,6 @@ static void pl2303_break_ctl(struct tty_struct *tty, int break_state)
    2952     dev_err(&port->dev, "error sending break = %d\n", result);
    2953     }
    2954    
    2955     -static void pl2303_release(struct usb_serial *serial)
    2956     -{
    2957     - int i;
    2958     - struct pl2303_private *priv;
    2959     -
    2960     - for (i = 0; i < serial->num_ports; ++i) {
    2961     - priv = usb_get_serial_port_data(serial->port[i]);
    2962     - kfree(priv);
    2963     - }
    2964     -}
    2965     -
    2966     static void pl2303_update_line_status(struct usb_serial_port *port,
    2967     unsigned char *data,
    2968     unsigned int actual_length)
    2969     @@ -829,6 +845,8 @@ static struct usb_serial_driver pl2303_device = {
    2970     .read_int_callback = pl2303_read_int_callback,
    2971     .attach = pl2303_startup,
    2972     .release = pl2303_release,
    2973     + .port_probe = pl2303_port_probe,
    2974     + .port_remove = pl2303_port_remove,
    2975     };
    2976    
    2977     static struct usb_serial_driver * const serial_drivers[] = {
    2978     diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
    2979     index cad6089..2451c08 100644
    2980     --- a/drivers/usb/serial/spcp8x5.c
    2981     +++ b/drivers/usb/serial/spcp8x5.c
    2982     @@ -159,13 +159,10 @@ struct spcp8x5_private {
    2983     u8 line_status;
    2984     };
    2985    
    2986     -/* desc : when device plug in,this function would be called.
    2987     - * thanks to usb_serial subsystem,then do almost every things for us. And what
    2988     - * we should do just alloc the buffer */
    2989     -static int spcp8x5_startup(struct usb_serial *serial)
    2990     +static int spcp8x5_port_probe(struct usb_serial_port *port)
    2991     {
    2992     + struct usb_serial *serial = port->serial;
    2993     struct spcp8x5_private *priv;
    2994     - int i;
    2995     enum spcp8x5_type type = SPCP825_007_TYPE;
    2996     u16 product = le16_to_cpu(serial->dev->descriptor.idProduct);
    2997    
    2998     @@ -182,34 +179,27 @@ static int spcp8x5_startup(struct usb_serial *serial)
    2999     type = SPCP825_PHILIP_TYPE;
    3000     dev_dbg(&serial->dev->dev, "device type = %d\n", (int)type);
    3001    
    3002     - for (i = 0; i < serial->num_ports; ++i) {
    3003     - priv = kzalloc(sizeof(struct spcp8x5_private), GFP_KERNEL);
    3004     - if (!priv)
    3005     - goto cleanup;
    3006     + priv = kzalloc(sizeof(*priv), GFP_KERNEL);
    3007     + if (!priv)
    3008     + return -ENOMEM;
    3009    
    3010     - spin_lock_init(&priv->lock);
    3011     - init_waitqueue_head(&priv->delta_msr_wait);
    3012     - priv->type = type;
    3013     - usb_set_serial_port_data(serial->port[i] , priv);
    3014     - }
    3015     + spin_lock_init(&priv->lock);
    3016     + init_waitqueue_head(&priv->delta_msr_wait);
    3017     + priv->type = type;
    3018     +
    3019     + usb_set_serial_port_data(port , priv);
    3020    
    3021     return 0;
    3022     -cleanup:
    3023     - for (--i; i >= 0; --i) {
    3024     - priv = usb_get_serial_port_data(serial->port[i]);
    3025     - kfree(priv);
    3026     - usb_set_serial_port_data(serial->port[i] , NULL);
    3027     - }
    3028     - return -ENOMEM;
    3029     }
    3030    
    3031     -/* call when the device plug out. free all the memory alloced by probe */
    3032     -static void spcp8x5_release(struct usb_serial *serial)
    3033     +static int spcp8x5_port_remove(struct usb_serial_port *port)
    3034     {
    3035     - int i;
    3036     + struct spcp8x5_private *priv;
    3037    
    3038     - for (i = 0; i < serial->num_ports; i++)
    3039     - kfree(usb_get_serial_port_data(serial->port[i]));
    3040     + priv = usb_get_serial_port_data(port);
    3041     + kfree(priv);
    3042     +
    3043     + return 0;
    3044     }
    3045    
    3046     /* set the modem control line of the device.
    3047     @@ -651,8 +641,8 @@ static struct usb_serial_driver spcp8x5_device = {
    3048     .ioctl = spcp8x5_ioctl,
    3049     .tiocmget = spcp8x5_tiocmget,
    3050     .tiocmset = spcp8x5_tiocmset,
    3051     - .attach = spcp8x5_startup,
    3052     - .release = spcp8x5_release,
    3053     + .port_probe = spcp8x5_port_probe,
    3054     + .port_remove = spcp8x5_port_remove,
    3055     .process_read_urb = spcp8x5_process_read_urb,
    3056     };
    3057    
    3058     diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c
    3059     index 3fee23b..fe3a8a0 100644
    3060     --- a/drivers/usb/serial/ssu100.c
    3061     +++ b/drivers/usb/serial/ssu100.c
    3062     @@ -69,13 +69,6 @@ struct ssu100_port_private {
    3063     struct async_icount icount;
    3064     };
    3065    
    3066     -static void ssu100_release(struct usb_serial *serial)
    3067     -{
    3068     - struct ssu100_port_private *priv = usb_get_serial_port_data(*serial->port);
    3069     -
    3070     - kfree(priv);
    3071     -}
    3072     -
    3073     static inline int ssu100_control_msg(struct usb_device *dev,
    3074     u8 request, u16 data, u16 index)
    3075     {
    3076     @@ -444,21 +437,33 @@ static int ssu100_ioctl(struct tty_struct *tty,
    3077    
    3078     static int ssu100_attach(struct usb_serial *serial)
    3079     {
    3080     + return ssu100_initdevice(serial->dev);
    3081     +}
    3082     +
    3083     +static int ssu100_port_probe(struct usb_serial_port *port)
    3084     +{
    3085     struct ssu100_port_private *priv;
    3086     - struct usb_serial_port *port = *serial->port;
    3087    
    3088     priv = kzalloc(sizeof(*priv), GFP_KERNEL);
    3089     - if (!priv) {
    3090     - dev_err(&port->dev, "%s- kmalloc(%Zd) failed.\n", __func__,
    3091     - sizeof(*priv));
    3092     + if (!priv)
    3093     return -ENOMEM;
    3094     - }
    3095    
    3096     spin_lock_init(&priv->status_lock);
    3097     init_waitqueue_head(&priv->delta_msr_wait);
    3098     +
    3099     usb_set_serial_port_data(port, priv);
    3100    
    3101     - return ssu100_initdevice(serial->dev);
    3102     + return 0;
    3103     +}
    3104     +
    3105     +static int ssu100_port_remove(struct usb_serial_port *port)
    3106     +{
    3107     + struct ssu100_port_private *priv;
    3108     +
    3109     + priv = usb_get_serial_port_data(port);
    3110     + kfree(priv);
    3111     +
    3112     + return 0;
    3113     }
    3114    
    3115     static int ssu100_tiocmget(struct tty_struct *tty)
    3116     @@ -649,7 +654,8 @@ static struct usb_serial_driver ssu100_device = {
    3117     .open = ssu100_open,
    3118     .close = ssu100_close,
    3119     .attach = ssu100_attach,
    3120     - .release = ssu100_release,
    3121     + .port_probe = ssu100_port_probe,
    3122     + .port_remove = ssu100_port_remove,
    3123     .dtr_rts = ssu100_dtr_rts,
    3124     .process_read_urb = ssu100_process_read_urb,
    3125     .tiocmget = ssu100_tiocmget,
    3126     diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
    3127     index a4404f5..33537bb 100644
    3128     --- a/drivers/usb/serial/ti_usb_3410_5052.c
    3129     +++ b/drivers/usb/serial/ti_usb_3410_5052.c
    3130     @@ -98,6 +98,8 @@ struct ti_device {
    3131    
    3132     static int ti_startup(struct usb_serial *serial);
    3133     static void ti_release(struct usb_serial *serial);
    3134     +static int ti_port_probe(struct usb_serial_port *port);
    3135     +static int ti_port_remove(struct usb_serial_port *port);
    3136     static int ti_open(struct tty_struct *tty, struct usb_serial_port *port);
    3137     static void ti_close(struct usb_serial_port *port);
    3138     static int ti_write(struct tty_struct *tty, struct usb_serial_port *port,
    3139     @@ -223,6 +225,8 @@ static struct usb_serial_driver ti_1port_device = {
    3140     .num_ports = 1,
    3141     .attach = ti_startup,
    3142     .release = ti_release,
    3143     + .port_probe = ti_port_probe,
    3144     + .port_remove = ti_port_remove,
    3145     .open = ti_open,
    3146     .close = ti_close,
    3147     .write = ti_write,
    3148     @@ -251,6 +255,8 @@ static struct usb_serial_driver ti_2port_device = {
    3149     .num_ports = 2,
    3150     .attach = ti_startup,
    3151     .release = ti_release,
    3152     + .port_probe = ti_port_probe,
    3153     + .port_remove = ti_port_remove,
    3154     .open = ti_open,
    3155     .close = ti_close,
    3156     .write = ti_write,
    3157     @@ -358,11 +364,8 @@ module_exit(ti_exit);
    3158     static int ti_startup(struct usb_serial *serial)
    3159     {
    3160     struct ti_device *tdev;
    3161     - struct ti_port *tport;
    3162     struct usb_device *dev = serial->dev;
    3163     int status;
    3164     - int i;
    3165     -
    3166    
    3167     dbg("%s - product 0x%4X, num configurations %d, configuration value %d",
    3168     __func__, le16_to_cpu(dev->descriptor.idProduct),
    3169     @@ -409,42 +412,8 @@ static int ti_startup(struct usb_serial *serial)
    3170     goto free_tdev;
    3171     }
    3172    
    3173     - /* set up port structures */
    3174     - for (i = 0; i < serial->num_ports; ++i) {
    3175     - tport = kzalloc(sizeof(struct ti_port), GFP_KERNEL);
    3176     - if (tport == NULL) {
    3177     - dev_err(&dev->dev, "%s - out of memory\n", __func__);
    3178     - status = -ENOMEM;
    3179     - goto free_tports;
    3180     - }
    3181     - spin_lock_init(&tport->tp_lock);
    3182     - tport->tp_uart_base_addr = (i == 0 ?
    3183     - TI_UART1_BASE_ADDR : TI_UART2_BASE_ADDR);
    3184     - tport->tp_closing_wait = closing_wait;
    3185     - init_waitqueue_head(&tport->tp_msr_wait);
    3186     - init_waitqueue_head(&tport->tp_write_wait);
    3187     - if (kfifo_alloc(&tport->write_fifo, TI_WRITE_BUF_SIZE,
    3188     - GFP_KERNEL)) {
    3189     - dev_err(&dev->dev, "%s - out of memory\n", __func__);
    3190     - kfree(tport);
    3191     - status = -ENOMEM;
    3192     - goto free_tports;
    3193     - }
    3194     - tport->tp_port = serial->port[i];
    3195     - tport->tp_tdev = tdev;
    3196     - usb_set_serial_port_data(serial->port[i], tport);
    3197     - tport->tp_uart_mode = 0; /* default is RS232 */
    3198     - }
    3199     -
    3200     return 0;
    3201    
    3202     -free_tports:
    3203     - for (--i; i >= 0; --i) {
    3204     - tport = usb_get_serial_port_data(serial->port[i]);
    3205     - kfifo_free(&tport->write_fifo);
    3206     - kfree(tport);
    3207     - usb_set_serial_port_data(serial->port[i], NULL);
    3208     - }
    3209     free_tdev:
    3210     kfree(tdev);
    3211     usb_set_serial_data(serial, NULL);
    3212     @@ -454,21 +423,50 @@ free_tdev:
    3213    
    3214     static void ti_release(struct usb_serial *serial)
    3215     {
    3216     - int i;
    3217     struct ti_device *tdev = usb_get_serial_data(serial);
    3218     +
    3219     + kfree(tdev);
    3220     +}
    3221     +
    3222     +static int ti_port_probe(struct usb_serial_port *port)
    3223     +{
    3224     struct ti_port *tport;
    3225    
    3226     - for (i = 0; i < serial->num_ports; ++i) {
    3227     - tport = usb_get_serial_port_data(serial->port[i]);
    3228     - if (tport) {
    3229     - kfifo_free(&tport->write_fifo);
    3230     - kfree(tport);
    3231     - }
    3232     + tport = kzalloc(sizeof(*tport), GFP_KERNEL);
    3233     + if (!tport)
    3234     + return -ENOMEM;
    3235     +
    3236     + spin_lock_init(&tport->tp_lock);
    3237     + if (port == port->serial->port[0])
    3238     + tport->tp_uart_base_addr = TI_UART1_BASE_ADDR;
    3239     + else
    3240     + tport->tp_uart_base_addr = TI_UART2_BASE_ADDR;
    3241     + tport->tp_closing_wait = closing_wait;
    3242     + init_waitqueue_head(&tport->tp_msr_wait);
    3243     + init_waitqueue_head(&tport->tp_write_wait);
    3244     + if (kfifo_alloc(&tport->write_fifo, TI_WRITE_BUF_SIZE, GFP_KERNEL)) {
    3245     + kfree(tport);
    3246     + return -ENOMEM;
    3247     }
    3248     + tport->tp_port = port;
    3249     + tport->tp_tdev = usb_get_serial_data(port->serial);
    3250     + tport->tp_uart_mode = 0; /* default is RS232 */
    3251    
    3252     - kfree(tdev);
    3253     + usb_set_serial_port_data(port, tport);
    3254     +
    3255     + return 0;
    3256     }
    3257    
    3258     +static int ti_port_remove(struct usb_serial_port *port)
    3259     +{
    3260     + struct ti_port *tport;
    3261     +
    3262     + tport = usb_get_serial_port_data(port);
    3263     + kfifo_free(&tport->write_fifo);
    3264     + kfree(tport);
    3265     +
    3266     + return 0;
    3267     +}
    3268    
    3269     static int ti_open(struct tty_struct *tty, struct usb_serial_port *port)
    3270     {
    3271     diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
    3272     index 1b50890..cf18217 100644
    3273     --- a/fs/ext4/balloc.c
    3274     +++ b/fs/ext4/balloc.c
    3275     @@ -174,8 +174,7 @@ void ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
    3276     ext4_free_inodes_set(sb, gdp, 0);
    3277     ext4_itable_unused_set(sb, gdp, 0);
    3278     memset(bh->b_data, 0xff, sb->s_blocksize);
    3279     - ext4_block_bitmap_csum_set(sb, block_group, gdp, bh,
    3280     - EXT4_BLOCKS_PER_GROUP(sb) / 8);
    3281     + ext4_block_bitmap_csum_set(sb, block_group, gdp, bh);
    3282     return;
    3283     }
    3284     memset(bh->b_data, 0, sb->s_blocksize);
    3285     @@ -212,8 +211,7 @@ void ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
    3286     */
    3287     ext4_mark_bitmap_end(num_clusters_in_group(sb, block_group),
    3288     sb->s_blocksize * 8, bh->b_data);
    3289     - ext4_block_bitmap_csum_set(sb, block_group, gdp, bh,
    3290     - EXT4_BLOCKS_PER_GROUP(sb) / 8);
    3291     + ext4_block_bitmap_csum_set(sb, block_group, gdp, bh);
    3292     ext4_group_desc_csum_set(sb, block_group, gdp);
    3293     }
    3294    
    3295     @@ -350,7 +348,7 @@ void ext4_validate_block_bitmap(struct super_block *sb,
    3296     return;
    3297     }
    3298     if (unlikely(!ext4_block_bitmap_csum_verify(sb, block_group,
    3299     - desc, bh, EXT4_BLOCKS_PER_GROUP(sb) / 8))) {
    3300     + desc, bh))) {
    3301     ext4_unlock_group(sb, block_group);
    3302     ext4_error(sb, "bg %u: bad block bitmap checksum", block_group);
    3303     return;
    3304     diff --git a/fs/ext4/bitmap.c b/fs/ext4/bitmap.c
    3305     index 5c2d181..3285aa5 100644
    3306     --- a/fs/ext4/bitmap.c
    3307     +++ b/fs/ext4/bitmap.c
    3308     @@ -58,11 +58,12 @@ void ext4_inode_bitmap_csum_set(struct super_block *sb, ext4_group_t group,
    3309    
    3310     int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
    3311     struct ext4_group_desc *gdp,
    3312     - struct buffer_head *bh, int sz)
    3313     + struct buffer_head *bh)
    3314     {
    3315     __u32 hi;
    3316     __u32 provided, calculated;
    3317     struct ext4_sb_info *sbi = EXT4_SB(sb);
    3318     + int sz = EXT4_CLUSTERS_PER_GROUP(sb) / 8;
    3319    
    3320     if (!EXT4_HAS_RO_COMPAT_FEATURE(sb,
    3321     EXT4_FEATURE_RO_COMPAT_METADATA_CSUM))
    3322     @@ -84,8 +85,9 @@ int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
    3323    
    3324     void ext4_block_bitmap_csum_set(struct super_block *sb, ext4_group_t group,
    3325     struct ext4_group_desc *gdp,
    3326     - struct buffer_head *bh, int sz)
    3327     + struct buffer_head *bh)
    3328     {
    3329     + int sz = EXT4_CLUSTERS_PER_GROUP(sb) / 8;
    3330     __u32 csum;
    3331     struct ext4_sb_info *sbi = EXT4_SB(sb);
    3332    
    3333     diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
    3334     index c3411d4..5c69f2b 100644
    3335     --- a/fs/ext4/ext4.h
    3336     +++ b/fs/ext4/ext4.h
    3337     @@ -1867,10 +1867,10 @@ int ext4_inode_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
    3338     struct buffer_head *bh, int sz);
    3339     void ext4_block_bitmap_csum_set(struct super_block *sb, ext4_group_t group,
    3340     struct ext4_group_desc *gdp,
    3341     - struct buffer_head *bh, int sz);
    3342     + struct buffer_head *bh);
    3343     int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
    3344     struct ext4_group_desc *gdp,
    3345     - struct buffer_head *bh, int sz);
    3346     + struct buffer_head *bh);
    3347    
    3348     /* balloc.c */
    3349     extern void ext4_validate_block_bitmap(struct super_block *sb,
    3350     diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
    3351     index aabbb3f..741bb94 100644
    3352     --- a/fs/ext4/extents.c
    3353     +++ b/fs/ext4/extents.c
    3354     @@ -52,6 +52,9 @@
    3355     #define EXT4_EXT_MARK_UNINIT1 0x2 /* mark first half uninitialized */
    3356     #define EXT4_EXT_MARK_UNINIT2 0x4 /* mark second half uninitialized */
    3357    
    3358     +#define EXT4_EXT_DATA_VALID1 0x8 /* first half contains valid data */
    3359     +#define EXT4_EXT_DATA_VALID2 0x10 /* second half contains valid data */
    3360     +
    3361     static __le32 ext4_extent_block_csum(struct inode *inode,
    3362     struct ext4_extent_header *eh)
    3363     {
    3364     @@ -2895,6 +2898,9 @@ static int ext4_split_extent_at(handle_t *handle,
    3365     unsigned int ee_len, depth;
    3366     int err = 0;
    3367    
    3368     + BUG_ON((split_flag & (EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2)) ==
    3369     + (EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2));
    3370     +
    3371     ext_debug("ext4_split_extents_at: inode %lu, logical"
    3372     "block %llu\n", inode->i_ino, (unsigned long long)split);
    3373    
    3374     @@ -2953,7 +2959,14 @@ static int ext4_split_extent_at(handle_t *handle,
    3375    
    3376     err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
    3377     if (err == -ENOSPC && (EXT4_EXT_MAY_ZEROOUT & split_flag)) {
    3378     - err = ext4_ext_zeroout(inode, &orig_ex);
    3379     + if (split_flag & (EXT4_EXT_DATA_VALID1|EXT4_EXT_DATA_VALID2)) {
    3380     + if (split_flag & EXT4_EXT_DATA_VALID1)
    3381     + err = ext4_ext_zeroout(inode, ex2);
    3382     + else
    3383     + err = ext4_ext_zeroout(inode, ex);
    3384     + } else
    3385     + err = ext4_ext_zeroout(inode, &orig_ex);
    3386     +
    3387     if (err)
    3388     goto fix_extent_len;
    3389     /* update the extent length and mark as initialized */
    3390     @@ -3006,12 +3019,13 @@ static int ext4_split_extent(handle_t *handle,
    3391     uninitialized = ext4_ext_is_uninitialized(ex);
    3392    
    3393     if (map->m_lblk + map->m_len < ee_block + ee_len) {
    3394     - split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT ?
    3395     - EXT4_EXT_MAY_ZEROOUT : 0;
    3396     + split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT;
    3397     flags1 = flags | EXT4_GET_BLOCKS_PRE_IO;
    3398     if (uninitialized)
    3399     split_flag1 |= EXT4_EXT_MARK_UNINIT1 |
    3400     EXT4_EXT_MARK_UNINIT2;
    3401     + if (split_flag & EXT4_EXT_DATA_VALID2)
    3402     + split_flag1 |= EXT4_EXT_DATA_VALID1;
    3403     err = ext4_split_extent_at(handle, inode, path,
    3404     map->m_lblk + map->m_len, split_flag1, flags1);
    3405     if (err)
    3406     @@ -3024,8 +3038,8 @@ static int ext4_split_extent(handle_t *handle,
    3407     return PTR_ERR(path);
    3408    
    3409     if (map->m_lblk >= ee_block) {
    3410     - split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT ?
    3411     - EXT4_EXT_MAY_ZEROOUT : 0;
    3412     + split_flag1 = split_flag & (EXT4_EXT_MAY_ZEROOUT |
    3413     + EXT4_EXT_DATA_VALID2);
    3414     if (uninitialized)
    3415     split_flag1 |= EXT4_EXT_MARK_UNINIT1;
    3416     if (split_flag & EXT4_EXT_MARK_UNINIT2)
    3417     @@ -3303,26 +3317,47 @@ static int ext4_split_unwritten_extents(handle_t *handle,
    3418    
    3419     split_flag |= ee_block + ee_len <= eof_block ? EXT4_EXT_MAY_ZEROOUT : 0;
    3420     split_flag |= EXT4_EXT_MARK_UNINIT2;
    3421     -
    3422     + if (flags & EXT4_GET_BLOCKS_CONVERT)
    3423     + split_flag |= EXT4_EXT_DATA_VALID2;
    3424     flags |= EXT4_GET_BLOCKS_PRE_IO;
    3425     return ext4_split_extent(handle, inode, path, map, split_flag, flags);
    3426     }
    3427    
    3428     static int ext4_convert_unwritten_extents_endio(handle_t *handle,
    3429     - struct inode *inode,
    3430     - struct ext4_ext_path *path)
    3431     + struct inode *inode,
    3432     + struct ext4_map_blocks *map,
    3433     + struct ext4_ext_path *path)
    3434     {
    3435     struct ext4_extent *ex;
    3436     + ext4_lblk_t ee_block;
    3437     + unsigned int ee_len;
    3438     int depth;
    3439     int err = 0;
    3440    
    3441     depth = ext_depth(inode);
    3442     ex = path[depth].p_ext;
    3443     + ee_block = le32_to_cpu(ex->ee_block);
    3444     + ee_len = ext4_ext_get_actual_len(ex);
    3445    
    3446     ext_debug("ext4_convert_unwritten_extents_endio: inode %lu, logical"
    3447     "block %llu, max_blocks %u\n", inode->i_ino,
    3448     - (unsigned long long)le32_to_cpu(ex->ee_block),
    3449     - ext4_ext_get_actual_len(ex));
    3450     + (unsigned long long)ee_block, ee_len);
    3451     +
    3452     + /* If extent is larger than requested then split is required */
    3453     + if (ee_block != map->m_lblk || ee_len > map->m_len) {
    3454     + err = ext4_split_unwritten_extents(handle, inode, map, path,
    3455     + EXT4_GET_BLOCKS_CONVERT);
    3456     + if (err < 0)
    3457     + goto out;
    3458     + ext4_ext_drop_refs(path);
    3459     + path = ext4_ext_find_extent(inode, map->m_lblk, path);
    3460     + if (IS_ERR(path)) {
    3461     + err = PTR_ERR(path);
    3462     + goto out;
    3463     + }
    3464     + depth = ext_depth(inode);
    3465     + ex = path[depth].p_ext;
    3466     + }
    3467    
    3468     err = ext4_ext_get_access(handle, inode, path + depth);
    3469     if (err)
    3470     @@ -3630,7 +3665,7 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
    3471     }
    3472     /* IO end_io complete, convert the filled extent to written */
    3473     if ((flags & EXT4_GET_BLOCKS_CONVERT)) {
    3474     - ret = ext4_convert_unwritten_extents_endio(handle, inode,
    3475     + ret = ext4_convert_unwritten_extents_endio(handle, inode, map,
    3476     path);
    3477     if (ret >= 0) {
    3478     ext4_update_inode_fsync_trans(handle, inode, 1);
    3479     diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
    3480     index 26154b8..8ce0076 100644
    3481     --- a/fs/ext4/ialloc.c
    3482     +++ b/fs/ext4/ialloc.c
    3483     @@ -753,9 +753,7 @@ got:
    3484     ext4_free_group_clusters_set(sb, gdp,
    3485     ext4_free_clusters_after_init(sb, group, gdp));
    3486     ext4_block_bitmap_csum_set(sb, group, gdp,
    3487     - block_bitmap_bh,
    3488     - EXT4_BLOCKS_PER_GROUP(sb) /
    3489     - 8);
    3490     + block_bitmap_bh);
    3491     ext4_group_desc_csum_set(sb, group, gdp);
    3492     }
    3493     ext4_unlock_group(sb, group);
    3494     diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
    3495     index 8eae947..b26410c 100644
    3496     --- a/fs/ext4/mballoc.c
    3497     +++ b/fs/ext4/mballoc.c
    3498     @@ -2804,8 +2804,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
    3499     }
    3500     len = ext4_free_group_clusters(sb, gdp) - ac->ac_b_ex.fe_len;
    3501     ext4_free_group_clusters_set(sb, gdp, len);
    3502     - ext4_block_bitmap_csum_set(sb, ac->ac_b_ex.fe_group, gdp, bitmap_bh,
    3503     - EXT4_BLOCKS_PER_GROUP(sb) / 8);
    3504     + ext4_block_bitmap_csum_set(sb, ac->ac_b_ex.fe_group, gdp, bitmap_bh);
    3505     ext4_group_desc_csum_set(sb, ac->ac_b_ex.fe_group, gdp);
    3506    
    3507     ext4_unlock_group(sb, ac->ac_b_ex.fe_group);
    3508     @@ -4664,8 +4663,7 @@ do_more:
    3509    
    3510     ret = ext4_free_group_clusters(sb, gdp) + count_clusters;
    3511     ext4_free_group_clusters_set(sb, gdp, ret);
    3512     - ext4_block_bitmap_csum_set(sb, block_group, gdp, bitmap_bh,
    3513     - EXT4_BLOCKS_PER_GROUP(sb) / 8);
    3514     + ext4_block_bitmap_csum_set(sb, block_group, gdp, bitmap_bh);
    3515     ext4_group_desc_csum_set(sb, block_group, gdp);
    3516     ext4_unlock_group(sb, block_group);
    3517     percpu_counter_add(&sbi->s_freeclusters_counter, count_clusters);
    3518     @@ -4809,8 +4807,7 @@ int ext4_group_add_blocks(handle_t *handle, struct super_block *sb,
    3519     mb_free_blocks(NULL, &e4b, bit, count);
    3520     blk_free_count = blocks_freed + ext4_free_group_clusters(sb, desc);
    3521     ext4_free_group_clusters_set(sb, desc, blk_free_count);
    3522     - ext4_block_bitmap_csum_set(sb, block_group, desc, bitmap_bh,
    3523     - EXT4_BLOCKS_PER_GROUP(sb) / 8);
    3524     + ext4_block_bitmap_csum_set(sb, block_group, desc, bitmap_bh);
    3525     ext4_group_desc_csum_set(sb, block_group, desc);
    3526     ext4_unlock_group(sb, block_group);
    3527     percpu_counter_add(&sbi->s_freeclusters_counter,
    3528     @@ -4990,8 +4987,9 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)
    3529     end = start + (range->len >> sb->s_blocksize_bits) - 1;
    3530     minlen = range->minlen >> sb->s_blocksize_bits;
    3531    
    3532     - if (unlikely(minlen > EXT4_CLUSTERS_PER_GROUP(sb)) ||
    3533     - unlikely(start >= max_blks))
    3534     + if (minlen > EXT4_CLUSTERS_PER_GROUP(sb) ||
    3535     + start >= max_blks ||
    3536     + range->len < sb->s_blocksize)
    3537     return -EINVAL;
    3538     if (end >= max_blks)
    3539     end = max_blks - 1;
    3540     diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
    3541     index 0be1789..71241bc 100644
    3542     --- a/fs/ext4/resize.c
    3543     +++ b/fs/ext4/resize.c
    3544     @@ -1121,8 +1121,7 @@ static int ext4_set_bitmap_checksums(struct super_block *sb,
    3545     bh = ext4_get_bitmap(sb, group_data->block_bitmap);
    3546     if (!bh)
    3547     return -EIO;
    3548     - ext4_block_bitmap_csum_set(sb, group, gdp, bh,
    3549     - EXT4_BLOCKS_PER_GROUP(sb) / 8);
    3550     + ext4_block_bitmap_csum_set(sb, group, gdp, bh);
    3551     brelse(bh);
    3552    
    3553     return 0;
    3554     diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c
    3555     index d269ada..982d267 100644
    3556     --- a/fs/lockd/clntxdr.c
    3557     +++ b/fs/lockd/clntxdr.c
    3558     @@ -223,7 +223,7 @@ static void encode_nlm_stat(struct xdr_stream *xdr,
    3559     {
    3560     __be32 *p;
    3561    
    3562     - BUG_ON(be32_to_cpu(stat) > NLM_LCK_DENIED_GRACE_PERIOD);
    3563     + WARN_ON_ONCE(be32_to_cpu(stat) > NLM_LCK_DENIED_GRACE_PERIOD);
    3564     p = xdr_reserve_space(xdr, 4);
    3565     *p = stat;
    3566     }
    3567     diff --git a/fs/lockd/svcproc.c b/fs/lockd/svcproc.c
    3568     index 3009a36..21171f0 100644
    3569     --- a/fs/lockd/svcproc.c
    3570     +++ b/fs/lockd/svcproc.c
    3571     @@ -68,7 +68,8 @@ nlmsvc_retrieve_args(struct svc_rqst *rqstp, struct nlm_args *argp,
    3572    
    3573     /* Obtain file pointer. Not used by FREE_ALL call. */
    3574     if (filp != NULL) {
    3575     - if ((error = nlm_lookup_file(rqstp, &file, &lock->fh)) != 0)
    3576     + error = cast_status(nlm_lookup_file(rqstp, &file, &lock->fh));
    3577     + if (error != 0)
    3578     goto no_locks;
    3579     *filp = file;
    3580    
    3581     diff --git a/fs/proc/stat.c b/fs/proc/stat.c
    3582     index 64c3b31..e296572 100644
    3583     --- a/fs/proc/stat.c
    3584     +++ b/fs/proc/stat.c
    3585     @@ -45,10 +45,13 @@ static cputime64_t get_iowait_time(int cpu)
    3586    
    3587     static u64 get_idle_time(int cpu)
    3588     {
    3589     - u64 idle, idle_time = get_cpu_idle_time_us(cpu, NULL);
    3590     + u64 idle, idle_time = -1ULL;
    3591     +
    3592     + if (cpu_online(cpu))
    3593     + idle_time = get_cpu_idle_time_us(cpu, NULL);
    3594    
    3595     if (idle_time == -1ULL)
    3596     - /* !NO_HZ so we can rely on cpustat.idle */
    3597     + /* !NO_HZ or cpu offline so we can rely on cpustat.idle */
    3598     idle = kcpustat_cpu(cpu).cpustat[CPUTIME_IDLE];
    3599     else
    3600     idle = usecs_to_cputime64(idle_time);
    3601     @@ -58,10 +61,13 @@ static u64 get_idle_time(int cpu)
    3602    
    3603     static u64 get_iowait_time(int cpu)
    3604     {
    3605     - u64 iowait, iowait_time = get_cpu_iowait_time_us(cpu, NULL);
    3606     + u64 iowait, iowait_time = -1ULL;
    3607     +
    3608     + if (cpu_online(cpu))
    3609     + iowait_time = get_cpu_iowait_time_us(cpu, NULL);
    3610    
    3611     if (iowait_time == -1ULL)
    3612     - /* !NO_HZ so we can rely on cpustat.iowait */
    3613     + /* !NO_HZ or cpu offline so we can rely on cpustat.iowait */
    3614     iowait = kcpustat_cpu(cpu).cpustat[CPUTIME_IOWAIT];
    3615     else
    3616     iowait = usecs_to_cputime64(iowait_time);
    3617     diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
    3618     index a810987..561e130 100644
    3619     --- a/include/linux/if_vlan.h
    3620     +++ b/include/linux/if_vlan.h
    3621     @@ -82,6 +82,8 @@ static inline int is_vlan_dev(struct net_device *dev)
    3622     }
    3623    
    3624     #define vlan_tx_tag_present(__skb) ((__skb)->vlan_tci & VLAN_TAG_PRESENT)
    3625     +#define vlan_tx_nonzero_tag_present(__skb) \
    3626     + (vlan_tx_tag_present(__skb) && ((__skb)->vlan_tci & VLAN_VID_MASK))
    3627     #define vlan_tx_tag_get(__skb) ((__skb)->vlan_tci & ~VLAN_TAG_PRESENT)
    3628    
    3629     #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
    3630     @@ -91,7 +93,7 @@ extern struct net_device *__vlan_find_dev_deep(struct net_device *real_dev,
    3631     extern struct net_device *vlan_dev_real_dev(const struct net_device *dev);
    3632     extern u16 vlan_dev_vlan_id(const struct net_device *dev);
    3633    
    3634     -extern bool vlan_do_receive(struct sk_buff **skb, bool last_handler);
    3635     +extern bool vlan_do_receive(struct sk_buff **skb);
    3636     extern struct sk_buff *vlan_untag(struct sk_buff *skb);
    3637    
    3638     extern int vlan_vid_add(struct net_device *dev, unsigned short vid);
    3639     @@ -120,10 +122,8 @@ static inline u16 vlan_dev_vlan_id(const struct net_device *dev)
    3640     return 0;
    3641     }
    3642    
    3643     -static inline bool vlan_do_receive(struct sk_buff **skb, bool last_handler)
    3644     +static inline bool vlan_do_receive(struct sk_buff **skb)
    3645     {
    3646     - if (((*skb)->vlan_tci & VLAN_VID_MASK) && last_handler)
    3647     - (*skb)->pkt_type = PACKET_OTHERHOST;
    3648     return false;
    3649     }
    3650    
    3651     diff --git a/include/linux/netlink.h b/include/linux/netlink.h
    3652     index f74dd13..e893736 100644
    3653     --- a/include/linux/netlink.h
    3654     +++ b/include/linux/netlink.h
    3655     @@ -153,6 +153,7 @@ struct nlattr {
    3656    
    3657     #include <linux/capability.h>
    3658     #include <linux/skbuff.h>
    3659     +#include <linux/export.h>
    3660    
    3661     struct net;
    3662    
    3663     @@ -232,6 +233,8 @@ struct netlink_callback {
    3664     struct netlink_callback *cb);
    3665     int (*done)(struct netlink_callback *cb);
    3666     void *data;
    3667     + /* the module that dump function belong to */
    3668     + struct module *module;
    3669     u16 family;
    3670     u16 min_dump_alloc;
    3671     unsigned int prev_seq, seq;
    3672     @@ -249,14 +252,24 @@ __nlmsg_put(struct sk_buff *skb, u32 pid, u32 seq, int type, int len, int flags)
    3673    
    3674     struct netlink_dump_control {
    3675     int (*dump)(struct sk_buff *skb, struct netlink_callback *);
    3676     - int (*done)(struct netlink_callback*);
    3677     + int (*done)(struct netlink_callback *);
    3678     void *data;
    3679     + struct module *module;
    3680     u16 min_dump_alloc;
    3681     };
    3682    
    3683     -extern int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    3684     - const struct nlmsghdr *nlh,
    3685     - struct netlink_dump_control *control);
    3686     +extern int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    3687     + const struct nlmsghdr *nlh,
    3688     + struct netlink_dump_control *control);
    3689     +static inline int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    3690     + const struct nlmsghdr *nlh,
    3691     + struct netlink_dump_control *control)
    3692     +{
    3693     + if (!control->module)
    3694     + control->module = THIS_MODULE;
    3695     +
    3696     + return __netlink_dump_start(ssk, skb, nlh, control);
    3697     +}
    3698    
    3699    
    3700     #define NL_NONROOT_RECV 0x1
    3701     diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
    3702     index 7632c87..f3165d2 100644
    3703     --- a/include/linux/skbuff.h
    3704     +++ b/include/linux/skbuff.h
    3705     @@ -589,9 +589,6 @@ static inline struct sk_buff *alloc_skb_fclone(unsigned int size,
    3706     return __alloc_skb(size, priority, SKB_ALLOC_FCLONE, NUMA_NO_NODE);
    3707     }
    3708    
    3709     -extern void skb_recycle(struct sk_buff *skb);
    3710     -extern bool skb_recycle_check(struct sk_buff *skb, int skb_size);
    3711     -
    3712     extern struct sk_buff *skb_morph(struct sk_buff *dst, struct sk_buff *src);
    3713     extern int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask);
    3714     extern struct sk_buff *skb_clone(struct sk_buff *skb,
    3715     @@ -2642,27 +2639,6 @@ static inline void skb_checksum_none_assert(const struct sk_buff *skb)
    3716    
    3717     bool skb_partial_csum_set(struct sk_buff *skb, u16 start, u16 off);
    3718    
    3719     -static inline bool skb_is_recycleable(const struct sk_buff *skb, int skb_size)
    3720     -{
    3721     - if (irqs_disabled())
    3722     - return false;
    3723     -
    3724     - if (skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY)
    3725     - return false;
    3726     -
    3727     - if (skb_is_nonlinear(skb) || skb->fclone != SKB_FCLONE_UNAVAILABLE)
    3728     - return false;
    3729     -
    3730     - skb_size = SKB_DATA_ALIGN(skb_size + NET_SKB_PAD);
    3731     - if (skb_end_offset(skb) < skb_size)
    3732     - return false;
    3733     -
    3734     - if (skb_shared(skb) || skb_cloned(skb))
    3735     - return false;
    3736     -
    3737     - return true;
    3738     -}
    3739     -
    3740     /**
    3741     * skb_head_is_locked - Determine if the skb->head is locked down
    3742     * @skb: skb to check
    3743     diff --git a/include/net/flow.h b/include/net/flow.h
    3744     index e1dd508..628e11b 100644
    3745     --- a/include/net/flow.h
    3746     +++ b/include/net/flow.h
    3747     @@ -21,6 +21,7 @@ struct flowi_common {
    3748     __u8 flowic_flags;
    3749     #define FLOWI_FLAG_ANYSRC 0x01
    3750     #define FLOWI_FLAG_CAN_SLEEP 0x02
    3751     +#define FLOWI_FLAG_KNOWN_NH 0x04
    3752     __u32 flowic_secid;
    3753     };
    3754    
    3755     diff --git a/include/net/route.h b/include/net/route.h
    3756     index da22243..bc40b63 100644
    3757     --- a/include/net/route.h
    3758     +++ b/include/net/route.h
    3759     @@ -48,7 +48,8 @@ struct rtable {
    3760     int rt_genid;
    3761     unsigned int rt_flags;
    3762     __u16 rt_type;
    3763     - __u16 rt_is_input;
    3764     + __u8 rt_is_input;
    3765     + __u8 rt_uses_gateway;
    3766    
    3767     int rt_iif;
    3768    
    3769     diff --git a/include/rdma/rdma_netlink.h b/include/rdma/rdma_netlink.h
    3770     index 3c5363a..bd3d8b2 100644
    3771     --- a/include/rdma/rdma_netlink.h
    3772     +++ b/include/rdma/rdma_netlink.h
    3773     @@ -39,6 +39,7 @@ struct rdma_cm_id_stats {
    3774    
    3775     struct ibnl_client_cbs {
    3776     int (*dump)(struct sk_buff *skb, struct netlink_callback *nlcb);
    3777     + struct module *module;
    3778     };
    3779    
    3780     int ibnl_init(void);
    3781     diff --git a/kernel/cgroup.c b/kernel/cgroup.c
    3782     index 7981850..ff2bce5 100644
    3783     --- a/kernel/cgroup.c
    3784     +++ b/kernel/cgroup.c
    3785     @@ -1923,9 +1923,8 @@ static void cgroup_task_migrate(struct cgroup *cgrp, struct cgroup *oldcgrp,
    3786     * trading it for newcg is protected by cgroup_mutex, we're safe to drop
    3787     * it here; it will be freed under RCU.
    3788     */
    3789     - put_css_set(oldcg);
    3790     -
    3791     set_bit(CGRP_RELEASABLE, &oldcgrp->flags);
    3792     + put_css_set(oldcg);
    3793     }
    3794    
    3795     /**
    3796     @@ -4695,31 +4694,20 @@ static const struct file_operations proc_cgroupstats_operations = {
    3797     *
    3798     * A pointer to the shared css_set was automatically copied in
    3799     * fork.c by dup_task_struct(). However, we ignore that copy, since
    3800     - * it was not made under the protection of RCU, cgroup_mutex or
    3801     - * threadgroup_change_begin(), so it might no longer be a valid
    3802     - * cgroup pointer. cgroup_attach_task() might have already changed
    3803     - * current->cgroups, allowing the previously referenced cgroup
    3804     - * group to be removed and freed.
    3805     - *
    3806     - * Outside the pointer validity we also need to process the css_set
    3807     - * inheritance between threadgoup_change_begin() and
    3808     - * threadgoup_change_end(), this way there is no leak in any process
    3809     - * wide migration performed by cgroup_attach_proc() that could otherwise
    3810     - * miss a thread because it is too early or too late in the fork stage.
    3811     + * it was not made under the protection of RCU or cgroup_mutex, so
    3812     + * might no longer be a valid cgroup pointer. cgroup_attach_task() might
    3813     + * have already changed current->cgroups, allowing the previously
    3814     + * referenced cgroup group to be removed and freed.
    3815     *
    3816     * At the point that cgroup_fork() is called, 'current' is the parent
    3817     * task, and the passed argument 'child' points to the child task.
    3818     */
    3819     void cgroup_fork(struct task_struct *child)
    3820     {
    3821     - /*
    3822     - * We don't need to task_lock() current because current->cgroups
    3823     - * can't be changed concurrently here. The parent obviously hasn't
    3824     - * exited and called cgroup_exit(), and we are synchronized against
    3825     - * cgroup migration through threadgroup_change_begin().
    3826     - */
    3827     + task_lock(current);
    3828     child->cgroups = current->cgroups;
    3829     get_css_set(child->cgroups);
    3830     + task_unlock(current);
    3831     INIT_LIST_HEAD(&child->cg_list);
    3832     }
    3833    
    3834     @@ -4772,19 +4760,10 @@ void cgroup_post_fork(struct task_struct *child)
    3835     */
    3836     if (use_task_css_set_links) {
    3837     write_lock(&css_set_lock);
    3838     - if (list_empty(&child->cg_list)) {
    3839     - /*
    3840     - * It's safe to use child->cgroups without task_lock()
    3841     - * here because we are protected through
    3842     - * threadgroup_change_begin() against concurrent
    3843     - * css_set change in cgroup_task_migrate(). Also
    3844     - * the task can't exit at that point until
    3845     - * wake_up_new_task() is called, so we are protected
    3846     - * against cgroup_exit() setting child->cgroup to
    3847     - * init_css_set.
    3848     - */
    3849     + task_lock(child);
    3850     + if (list_empty(&child->cg_list))
    3851     list_add(&child->cg_list, &child->cgroups->tasks);
    3852     - }
    3853     + task_unlock(child);
    3854     write_unlock(&css_set_lock);
    3855     }
    3856     }
    3857     diff --git a/kernel/sys.c b/kernel/sys.c
    3858     index 6fab59a..909148a 100644
    3859     --- a/kernel/sys.c
    3860     +++ b/kernel/sys.c
    3861     @@ -1265,15 +1265,16 @@ DECLARE_RWSEM(uts_sem);
    3862     * Work around broken programs that cannot handle "Linux 3.0".
    3863     * Instead we map 3.x to 2.6.40+x, so e.g. 3.0 would be 2.6.40
    3864     */
    3865     -static int override_release(char __user *release, int len)
    3866     +static int override_release(char __user *release, size_t len)
    3867     {
    3868     int ret = 0;
    3869     - char buf[65];
    3870    
    3871     if (current->personality & UNAME26) {
    3872     - char *rest = UTS_RELEASE;
    3873     + const char *rest = UTS_RELEASE;
    3874     + char buf[65] = { 0 };
    3875     int ndots = 0;
    3876     unsigned v;
    3877     + size_t copy;
    3878    
    3879     while (*rest) {
    3880     if (*rest == '.' && ++ndots >= 3)
    3881     @@ -1283,8 +1284,9 @@ static int override_release(char __user *release, int len)
    3882     rest++;
    3883     }
    3884     v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40;
    3885     - snprintf(buf, len, "2.6.%u%s", v, rest);
    3886     - ret = copy_to_user(release, buf, len);
    3887     + copy = clamp_t(size_t, len, 1, sizeof(buf));
    3888     + copy = scnprintf(buf, copy, "2.6.%u%s", v, rest);
    3889     + ret = copy_to_user(release, buf, copy + 1);
    3890     }
    3891     return ret;
    3892     }
    3893     diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
    3894     index 49491fa..ebd284f 100644
    3895     --- a/kernel/trace/ring_buffer.c
    3896     +++ b/kernel/trace/ring_buffer.c
    3897     @@ -1567,6 +1567,10 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size,
    3898    
    3899     put_online_cpus();
    3900     } else {
    3901     + /* Make sure this CPU has been intitialized */
    3902     + if (!cpumask_test_cpu(cpu_id, buffer->cpumask))
    3903     + goto out;
    3904     +
    3905     cpu_buffer = buffer->buffers[cpu_id];
    3906    
    3907     if (nr_pages == cpu_buffer->nr_pages)
    3908     diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
    3909     index 830059d..fe29a64 100644
    3910     --- a/net/8021q/vlan_core.c
    3911     +++ b/net/8021q/vlan_core.c
    3912     @@ -5,7 +5,7 @@
    3913     #include <linux/export.h>
    3914     #include "vlan.h"
    3915    
    3916     -bool vlan_do_receive(struct sk_buff **skbp, bool last_handler)
    3917     +bool vlan_do_receive(struct sk_buff **skbp)
    3918     {
    3919     struct sk_buff *skb = *skbp;
    3920     u16 vlan_id = skb->vlan_tci & VLAN_VID_MASK;
    3921     @@ -13,14 +13,8 @@ bool vlan_do_receive(struct sk_buff **skbp, bool last_handler)
    3922     struct vlan_pcpu_stats *rx_stats;
    3923    
    3924     vlan_dev = vlan_find_dev(skb->dev, vlan_id);
    3925     - if (!vlan_dev) {
    3926     - /* Only the last call to vlan_do_receive() should change
    3927     - * pkt_type to PACKET_OTHERHOST
    3928     - */
    3929     - if (vlan_id && last_handler)
    3930     - skb->pkt_type = PACKET_OTHERHOST;
    3931     + if (!vlan_dev)
    3932     return false;
    3933     - }
    3934    
    3935     skb = *skbp = skb_share_check(skb, GFP_ATOMIC);
    3936     if (unlikely(!skb))
    3937     diff --git a/net/core/dev.c b/net/core/dev.c
    3938     index 89e33a5..2fb9f59 100644
    3939     --- a/net/core/dev.c
    3940     +++ b/net/core/dev.c
    3941     @@ -3275,18 +3275,18 @@ ncls:
    3942     && !skb_pfmemalloc_protocol(skb))
    3943     goto drop;
    3944    
    3945     - rx_handler = rcu_dereference(skb->dev->rx_handler);
    3946     if (vlan_tx_tag_present(skb)) {
    3947     if (pt_prev) {
    3948     ret = deliver_skb(skb, pt_prev, orig_dev);
    3949     pt_prev = NULL;
    3950     }
    3951     - if (vlan_do_receive(&skb, !rx_handler))
    3952     + if (vlan_do_receive(&skb))
    3953     goto another_round;
    3954     else if (unlikely(!skb))
    3955     goto unlock;
    3956     }
    3957    
    3958     + rx_handler = rcu_dereference(skb->dev->rx_handler);
    3959     if (rx_handler) {
    3960     if (pt_prev) {
    3961     ret = deliver_skb(skb, pt_prev, orig_dev);
    3962     @@ -3306,6 +3306,9 @@ ncls:
    3963     }
    3964     }
    3965    
    3966     + if (vlan_tx_nonzero_tag_present(skb))
    3967     + skb->pkt_type = PACKET_OTHERHOST;
    3968     +
    3969     /* deliver only exact match when indicated */
    3970     null_or_dev = deliver_exact ? skb->dev : NULL;
    3971    
    3972     diff --git a/net/core/neighbour.c b/net/core/neighbour.c
    3973     index 117afaf..058bb1e 100644
    3974     --- a/net/core/neighbour.c
    3975     +++ b/net/core/neighbour.c
    3976     @@ -1301,8 +1301,6 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
    3977     if (!dst)
    3978     goto discard;
    3979    
    3980     - __skb_pull(skb, skb_network_offset(skb));
    3981     -
    3982     if (!neigh_event_send(neigh, skb)) {
    3983     int err;
    3984     struct net_device *dev = neigh->dev;
    3985     @@ -1312,6 +1310,7 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
    3986     neigh_hh_init(neigh, dst);
    3987    
    3988     do {
    3989     + __skb_pull(skb, skb_network_offset(skb));
    3990     seq = read_seqbegin(&neigh->ha_lock);
    3991     err = dev_hard_header(skb, dev, ntohs(skb->protocol),
    3992     neigh->ha, NULL, skb->len);
    3993     @@ -1342,9 +1341,8 @@ int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
    3994     unsigned int seq;
    3995     int err;
    3996    
    3997     - __skb_pull(skb, skb_network_offset(skb));
    3998     -
    3999     do {
    4000     + __skb_pull(skb, skb_network_offset(skb));
    4001     seq = read_seqbegin(&neigh->ha_lock);
    4002     err = dev_hard_header(skb, dev, ntohs(skb->protocol),
    4003     neigh->ha, NULL, skb->len);
    4004     diff --git a/net/core/skbuff.c b/net/core/skbuff.c
    4005     index e33ebae..ef172af 100644
    4006     --- a/net/core/skbuff.c
    4007     +++ b/net/core/skbuff.c
    4008     @@ -641,53 +641,6 @@ void consume_skb(struct sk_buff *skb)
    4009     }
    4010     EXPORT_SYMBOL(consume_skb);
    4011    
    4012     -/**
    4013     - * skb_recycle - clean up an skb for reuse
    4014     - * @skb: buffer
    4015     - *
    4016     - * Recycles the skb to be reused as a receive buffer. This
    4017     - * function does any necessary reference count dropping, and
    4018     - * cleans up the skbuff as if it just came from __alloc_skb().
    4019     - */
    4020     -void skb_recycle(struct sk_buff *skb)
    4021     -{
    4022     - struct skb_shared_info *shinfo;
    4023     -
    4024     - skb_release_head_state(skb);
    4025     -
    4026     - shinfo = skb_shinfo(skb);
    4027     - memset(shinfo, 0, offsetof(struct skb_shared_info, dataref));
    4028     - atomic_set(&shinfo->dataref, 1);
    4029     -
    4030     - memset(skb, 0, offsetof(struct sk_buff, tail));
    4031     - skb->data = skb->head + NET_SKB_PAD;
    4032     - skb_reset_tail_pointer(skb);
    4033     -}
    4034     -EXPORT_SYMBOL(skb_recycle);
    4035     -
    4036     -/**
    4037     - * skb_recycle_check - check if skb can be reused for receive
    4038     - * @skb: buffer
    4039     - * @skb_size: minimum receive buffer size
    4040     - *
    4041     - * Checks that the skb passed in is not shared or cloned, and
    4042     - * that it is linear and its head portion at least as large as
    4043     - * skb_size so that it can be recycled as a receive buffer.
    4044     - * If these conditions are met, this function does any necessary
    4045     - * reference count dropping and cleans up the skbuff as if it
    4046     - * just came from __alloc_skb().
    4047     - */
    4048     -bool skb_recycle_check(struct sk_buff *skb, int skb_size)
    4049     -{
    4050     - if (!skb_is_recycleable(skb, skb_size))
    4051     - return false;
    4052     -
    4053     - skb_recycle(skb);
    4054     -
    4055     - return true;
    4056     -}
    4057     -EXPORT_SYMBOL(skb_recycle_check);
    4058     -
    4059     static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
    4060     {
    4061     new->tstamp = old->tstamp;
    4062     diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
    4063     index 8e2b475..f444ac7 100644
    4064     --- a/net/ipv4/fib_frontend.c
    4065     +++ b/net/ipv4/fib_frontend.c
    4066     @@ -322,7 +322,8 @@ int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
    4067     {
    4068     int r = secpath_exists(skb) ? 0 : IN_DEV_RPFILTER(idev);
    4069    
    4070     - if (!r && !fib_num_tclassid_users(dev_net(dev))) {
    4071     + if (!r && !fib_num_tclassid_users(dev_net(dev)) &&
    4072     + (dev->ifindex != oif || !IN_DEV_TX_REDIRECTS(idev))) {
    4073     *itag = 0;
    4074     return 0;
    4075     }
    4076     diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
    4077     index a747100..9633661 100644
    4078     --- a/net/ipv4/fib_semantics.c
    4079     +++ b/net/ipv4/fib_semantics.c
    4080     @@ -840,6 +840,8 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
    4081     change_nexthops(fi) {
    4082     nexthop_nh->nh_parent = fi;
    4083     nexthop_nh->nh_pcpu_rth_output = alloc_percpu(struct rtable __rcu *);
    4084     + if (!nexthop_nh->nh_pcpu_rth_output)
    4085     + goto failure;
    4086     } endfor_nexthops(fi)
    4087    
    4088     if (cfg->fc_mx) {
    4089     diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
    4090     index 7f75f21..0405cc8 100644
    4091     --- a/net/ipv4/inet_connection_sock.c
    4092     +++ b/net/ipv4/inet_connection_sock.c
    4093     @@ -386,7 +386,7 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
    4094     rt = ip_route_output_flow(net, fl4, sk);
    4095     if (IS_ERR(rt))
    4096     goto no_route;
    4097     - if (opt && opt->opt.is_strictroute && rt->rt_gateway)
    4098     + if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway)
    4099     goto route_err;
    4100     return &rt->dst;
    4101    
    4102     @@ -422,7 +422,7 @@ struct dst_entry *inet_csk_route_child_sock(struct sock *sk,
    4103     rt = ip_route_output_flow(net, fl4, sk);
    4104     if (IS_ERR(rt))
    4105     goto no_route;
    4106     - if (opt && opt->opt.is_strictroute && rt->rt_gateway)
    4107     + if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway)
    4108     goto route_err;
    4109     rcu_read_unlock();
    4110     return &rt->dst;
    4111     diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
    4112     index ab09b12..694de3b 100644
    4113     --- a/net/ipv4/ip_forward.c
    4114     +++ b/net/ipv4/ip_forward.c
    4115     @@ -85,7 +85,7 @@ int ip_forward(struct sk_buff *skb)
    4116    
    4117     rt = skb_rtable(skb);
    4118    
    4119     - if (opt->is_strictroute && opt->nexthop != rt->rt_gateway)
    4120     + if (opt->is_strictroute && rt->rt_uses_gateway)
    4121     goto sr_failed;
    4122    
    4123     if (unlikely(skb->len > dst_mtu(&rt->dst) && !skb_is_gso(skb) &&
    4124     diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
    4125     index c196d74..94ad7ea 100644
    4126     --- a/net/ipv4/ip_output.c
    4127     +++ b/net/ipv4/ip_output.c
    4128     @@ -193,7 +193,7 @@ static inline int ip_finish_output2(struct sk_buff *skb)
    4129     }
    4130    
    4131     rcu_read_lock_bh();
    4132     - nexthop = rt->rt_gateway ? rt->rt_gateway : ip_hdr(skb)->daddr;
    4133     + nexthop = (__force u32) rt_nexthop(rt, ip_hdr(skb)->daddr);
    4134     neigh = __ipv4_neigh_lookup_noref(dev, nexthop);
    4135     if (unlikely(!neigh))
    4136     neigh = __neigh_create(&arp_tbl, &nexthop, dev, false);
    4137     @@ -371,7 +371,7 @@ int ip_queue_xmit(struct sk_buff *skb, struct flowi *fl)
    4138     skb_dst_set_noref(skb, &rt->dst);
    4139    
    4140     packet_routed:
    4141     - if (inet_opt && inet_opt->opt.is_strictroute && rt->rt_gateway)
    4142     + if (inet_opt && inet_opt->opt.is_strictroute && rt->rt_uses_gateway)
    4143     goto no_route;
    4144    
    4145     /* OK, we know where to send it, allocate and build IP header. */
    4146     diff --git a/net/ipv4/route.c b/net/ipv4/route.c
    4147     index fd9af60..2a1383c 100644
    4148     --- a/net/ipv4/route.c
    4149     +++ b/net/ipv4/route.c
    4150     @@ -802,7 +802,8 @@ void ip_rt_send_redirect(struct sk_buff *skb)
    4151     net = dev_net(rt->dst.dev);
    4152     peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, 1);
    4153     if (!peer) {
    4154     - icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, rt->rt_gateway);
    4155     + icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST,
    4156     + rt_nexthop(rt, ip_hdr(skb)->daddr));
    4157     return;
    4158     }
    4159    
    4160     @@ -827,7 +828,9 @@ void ip_rt_send_redirect(struct sk_buff *skb)
    4161     time_after(jiffies,
    4162     (peer->rate_last +
    4163     (ip_rt_redirect_load << peer->rate_tokens)))) {
    4164     - icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, rt->rt_gateway);
    4165     + __be32 gw = rt_nexthop(rt, ip_hdr(skb)->daddr);
    4166     +
    4167     + icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
    4168     peer->rate_last = jiffies;
    4169     ++peer->rate_tokens;
    4170     #ifdef CONFIG_IP_ROUTE_VERBOSE
    4171     @@ -835,7 +838,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
    4172     peer->rate_tokens == ip_rt_redirect_number)
    4173     net_warn_ratelimited("host %pI4/if%d ignores redirects for %pI4 to %pI4\n",
    4174     &ip_hdr(skb)->saddr, inet_iif(skb),
    4175     - &ip_hdr(skb)->daddr, &rt->rt_gateway);
    4176     + &ip_hdr(skb)->daddr, &gw);
    4177     #endif
    4178     }
    4179     out_put_peer:
    4180     @@ -904,22 +907,32 @@ out: kfree_skb(skb);
    4181     return 0;
    4182     }
    4183    
    4184     -static u32 __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
    4185     +static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
    4186     {
    4187     + struct dst_entry *dst = &rt->dst;
    4188     struct fib_result res;
    4189    
    4190     + if (dst->dev->mtu < mtu)
    4191     + return;
    4192     +
    4193     if (mtu < ip_rt_min_pmtu)
    4194     mtu = ip_rt_min_pmtu;
    4195    
    4196     + if (!rt->rt_pmtu) {
    4197     + dst->obsolete = DST_OBSOLETE_KILL;
    4198     + } else {
    4199     + rt->rt_pmtu = mtu;
    4200     + dst->expires = max(1UL, jiffies + ip_rt_mtu_expires);
    4201     + }
    4202     +
    4203     rcu_read_lock();
    4204     - if (fib_lookup(dev_net(rt->dst.dev), fl4, &res) == 0) {
    4205     + if (fib_lookup(dev_net(dst->dev), fl4, &res) == 0) {
    4206     struct fib_nh *nh = &FIB_RES_NH(res);
    4207    
    4208     update_or_create_fnhe(nh, fl4->daddr, 0, mtu,
    4209     jiffies + ip_rt_mtu_expires);
    4210     }
    4211     rcu_read_unlock();
    4212     - return mtu;
    4213     }
    4214    
    4215     static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
    4216     @@ -929,14 +942,7 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
    4217     struct flowi4 fl4;
    4218    
    4219     ip_rt_build_flow_key(&fl4, sk, skb);
    4220     - mtu = __ip_rt_update_pmtu(rt, &fl4, mtu);
    4221     -
    4222     - if (!rt->rt_pmtu) {
    4223     - dst->obsolete = DST_OBSOLETE_KILL;
    4224     - } else {
    4225     - rt->rt_pmtu = mtu;
    4226     - rt->dst.expires = max(1UL, jiffies + ip_rt_mtu_expires);
    4227     - }
    4228     + __ip_rt_update_pmtu(rt, &fl4, mtu);
    4229     }
    4230    
    4231     void ipv4_update_pmtu(struct sk_buff *skb, struct net *net, u32 mtu,
    4232     @@ -1123,7 +1129,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
    4233     mtu = dst->dev->mtu;
    4234    
    4235     if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
    4236     - if (rt->rt_gateway && mtu > 576)
    4237     + if (rt->rt_uses_gateway && mtu > 576)
    4238     mtu = 576;
    4239     }
    4240    
    4241     @@ -1174,7 +1180,9 @@ static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
    4242     if (fnhe->fnhe_gw) {
    4243     rt->rt_flags |= RTCF_REDIRECTED;
    4244     rt->rt_gateway = fnhe->fnhe_gw;
    4245     - }
    4246     + rt->rt_uses_gateway = 1;
    4247     + } else if (!rt->rt_gateway)
    4248     + rt->rt_gateway = daddr;
    4249    
    4250     orig = rcu_dereference(fnhe->fnhe_rth);
    4251     rcu_assign_pointer(fnhe->fnhe_rth, rt);
    4252     @@ -1183,13 +1191,6 @@ static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
    4253    
    4254     fnhe->fnhe_stamp = jiffies;
    4255     ret = true;
    4256     - } else {
    4257     - /* Routes we intend to cache in nexthop exception have
    4258     - * the DST_NOCACHE bit clear. However, if we are
    4259     - * unsuccessful at storing this route into the cache
    4260     - * we really need to set it.
    4261     - */
    4262     - rt->dst.flags |= DST_NOCACHE;
    4263     }
    4264     spin_unlock_bh(&fnhe_lock);
    4265    
    4266     @@ -1204,8 +1205,6 @@ static bool rt_cache_route(struct fib_nh *nh, struct rtable *rt)
    4267     if (rt_is_input_route(rt)) {
    4268     p = (struct rtable **)&nh->nh_rth_input;
    4269     } else {
    4270     - if (!nh->nh_pcpu_rth_output)
    4271     - goto nocache;
    4272     p = (struct rtable **)__this_cpu_ptr(nh->nh_pcpu_rth_output);
    4273     }
    4274     orig = *p;
    4275     @@ -1214,16 +1213,8 @@ static bool rt_cache_route(struct fib_nh *nh, struct rtable *rt)
    4276     if (prev == orig) {
    4277     if (orig)
    4278     rt_free(orig);
    4279     - } else {
    4280     - /* Routes we intend to cache in the FIB nexthop have
    4281     - * the DST_NOCACHE bit clear. However, if we are
    4282     - * unsuccessful at storing this route into the cache
    4283     - * we really need to set it.
    4284     - */
    4285     -nocache:
    4286     - rt->dst.flags |= DST_NOCACHE;
    4287     + } else
    4288     ret = false;
    4289     - }
    4290    
    4291     return ret;
    4292     }
    4293     @@ -1284,8 +1275,10 @@ static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
    4294     if (fi) {
    4295     struct fib_nh *nh = &FIB_RES_NH(*res);
    4296    
    4297     - if (nh->nh_gw && nh->nh_scope == RT_SCOPE_LINK)
    4298     + if (nh->nh_gw && nh->nh_scope == RT_SCOPE_LINK) {
    4299     rt->rt_gateway = nh->nh_gw;
    4300     + rt->rt_uses_gateway = 1;
    4301     + }
    4302     dst_init_metrics(&rt->dst, fi->fib_metrics, true);
    4303     #ifdef CONFIG_IP_ROUTE_CLASSID
    4304     rt->dst.tclassid = nh->nh_tclassid;
    4305     @@ -1294,8 +1287,18 @@ static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
    4306     cached = rt_bind_exception(rt, fnhe, daddr);
    4307     else if (!(rt->dst.flags & DST_NOCACHE))
    4308     cached = rt_cache_route(nh, rt);
    4309     - }
    4310     - if (unlikely(!cached))
    4311     + if (unlikely(!cached)) {
    4312     + /* Routes we intend to cache in nexthop exception or
    4313     + * FIB nexthop have the DST_NOCACHE bit clear.
    4314     + * However, if we are unsuccessful at storing this
    4315     + * route into the cache we really need to set it.
    4316     + */
    4317     + rt->dst.flags |= DST_NOCACHE;
    4318     + if (!rt->rt_gateway)
    4319     + rt->rt_gateway = daddr;
    4320     + rt_add_uncached_list(rt);
    4321     + }
    4322     + } else
    4323     rt_add_uncached_list(rt);
    4324    
    4325     #ifdef CONFIG_IP_ROUTE_CLASSID
    4326     @@ -1363,6 +1366,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
    4327     rth->rt_iif = 0;
    4328     rth->rt_pmtu = 0;
    4329     rth->rt_gateway = 0;
    4330     + rth->rt_uses_gateway = 0;
    4331     INIT_LIST_HEAD(&rth->rt_uncached);
    4332     if (our) {
    4333     rth->dst.input= ip_local_deliver;
    4334     @@ -1432,7 +1436,6 @@ static int __mkroute_input(struct sk_buff *skb,
    4335     return -EINVAL;
    4336     }
    4337    
    4338     -
    4339     err = fib_validate_source(skb, saddr, daddr, tos, FIB_RES_OIF(*res),
    4340     in_dev->dev, in_dev, &itag);
    4341     if (err < 0) {
    4342     @@ -1442,10 +1445,13 @@ static int __mkroute_input(struct sk_buff *skb,
    4343     goto cleanup;
    4344     }
    4345    
    4346     - if (out_dev == in_dev && err &&
    4347     + do_cache = res->fi && !itag;
    4348     + if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
    4349     (IN_DEV_SHARED_MEDIA(out_dev) ||
    4350     - inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
    4351     + inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) {
    4352     flags |= RTCF_DOREDIRECT;
    4353     + do_cache = false;
    4354     + }
    4355    
    4356     if (skb->protocol != htons(ETH_P_IP)) {
    4357     /* Not IP (i.e. ARP). Do not create route, if it is
    4358     @@ -1462,15 +1468,11 @@ static int __mkroute_input(struct sk_buff *skb,
    4359     }
    4360     }
    4361    
    4362     - do_cache = false;
    4363     - if (res->fi) {
    4364     - if (!itag) {
    4365     - rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
    4366     - if (rt_cache_valid(rth)) {
    4367     - skb_dst_set_noref(skb, &rth->dst);
    4368     - goto out;
    4369     - }
    4370     - do_cache = true;
    4371     + if (do_cache) {
    4372     + rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
    4373     + if (rt_cache_valid(rth)) {
    4374     + skb_dst_set_noref(skb, &rth->dst);
    4375     + goto out;
    4376     }
    4377     }
    4378    
    4379     @@ -1489,6 +1491,7 @@ static int __mkroute_input(struct sk_buff *skb,
    4380     rth->rt_iif = 0;
    4381     rth->rt_pmtu = 0;
    4382     rth->rt_gateway = 0;
    4383     + rth->rt_uses_gateway = 0;
    4384     INIT_LIST_HEAD(&rth->rt_uncached);
    4385    
    4386     rth->dst.input = ip_forward;
    4387     @@ -1656,6 +1659,7 @@ local_input:
    4388     rth->rt_iif = 0;
    4389     rth->rt_pmtu = 0;
    4390     rth->rt_gateway = 0;
    4391     + rth->rt_uses_gateway = 0;
    4392     INIT_LIST_HEAD(&rth->rt_uncached);
    4393     if (res.type == RTN_UNREACHABLE) {
    4394     rth->dst.input= ip_error;
    4395     @@ -1758,6 +1762,7 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
    4396     struct in_device *in_dev;
    4397     u16 type = res->type;
    4398     struct rtable *rth;
    4399     + bool do_cache;
    4400    
    4401     in_dev = __in_dev_get_rcu(dev_out);
    4402     if (!in_dev)
    4403     @@ -1794,24 +1799,36 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
    4404     }
    4405    
    4406     fnhe = NULL;
    4407     + do_cache = fi != NULL;
    4408     if (fi) {
    4409     struct rtable __rcu **prth;
    4410     + struct fib_nh *nh = &FIB_RES_NH(*res);
    4411    
    4412     - fnhe = find_exception(&FIB_RES_NH(*res), fl4->daddr);
    4413     + fnhe = find_exception(nh, fl4->daddr);
    4414     if (fnhe)
    4415     prth = &fnhe->fnhe_rth;
    4416     - else
    4417     - prth = __this_cpu_ptr(FIB_RES_NH(*res).nh_pcpu_rth_output);
    4418     + else {
    4419     + if (unlikely(fl4->flowi4_flags &
    4420     + FLOWI_FLAG_KNOWN_NH &&
    4421     + !(nh->nh_gw &&
    4422     + nh->nh_scope == RT_SCOPE_LINK))) {
    4423     + do_cache = false;
    4424     + goto add;
    4425     + }
    4426     + prth = __this_cpu_ptr(nh->nh_pcpu_rth_output);
    4427     + }
    4428     rth = rcu_dereference(*prth);
    4429     if (rt_cache_valid(rth)) {
    4430     dst_hold(&rth->dst);
    4431     return rth;
    4432     }
    4433     }
    4434     +
    4435     +add:
    4436     rth = rt_dst_alloc(dev_out,
    4437     IN_DEV_CONF_GET(in_dev, NOPOLICY),
    4438     IN_DEV_CONF_GET(in_dev, NOXFRM),
    4439     - fi);
    4440     + do_cache);
    4441     if (!rth)
    4442     return ERR_PTR(-ENOBUFS);
    4443    
    4444     @@ -1824,6 +1841,7 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
    4445     rth->rt_iif = orig_oif ? : 0;
    4446     rth->rt_pmtu = 0;
    4447     rth->rt_gateway = 0;
    4448     + rth->rt_uses_gateway = 0;
    4449     INIT_LIST_HEAD(&rth->rt_uncached);
    4450    
    4451     RT_CACHE_STAT_INC(out_slow_tot);
    4452     @@ -2102,6 +2120,7 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or
    4453     rt->rt_flags = ort->rt_flags;
    4454     rt->rt_type = ort->rt_type;
    4455     rt->rt_gateway = ort->rt_gateway;
    4456     + rt->rt_uses_gateway = ort->rt_uses_gateway;
    4457    
    4458     INIT_LIST_HEAD(&rt->rt_uncached);
    4459    
    4460     @@ -2180,12 +2199,22 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
    4461     if (nla_put_be32(skb, RTA_PREFSRC, fl4->saddr))
    4462     goto nla_put_failure;
    4463     }
    4464     - if (rt->rt_gateway &&
    4465     + if (rt->rt_uses_gateway &&
    4466     nla_put_be32(skb, RTA_GATEWAY, rt->rt_gateway))
    4467     goto nla_put_failure;
    4468    
    4469     + expires = rt->dst.expires;
    4470     + if (expires) {
    4471     + unsigned long now = jiffies;
    4472     +
    4473     + if (time_before(now, expires))
    4474     + expires -= now;
    4475     + else
    4476     + expires = 0;
    4477     + }
    4478     +
    4479     memcpy(metrics, dst_metrics_ptr(&rt->dst), sizeof(metrics));
    4480     - if (rt->rt_pmtu)
    4481     + if (rt->rt_pmtu && expires)
    4482     metrics[RTAX_MTU - 1] = rt->rt_pmtu;
    4483     if (rtnetlink_put_metrics(skb, metrics) < 0)
    4484     goto nla_put_failure;
    4485     @@ -2195,13 +2224,6 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
    4486     goto nla_put_failure;
    4487    
    4488     error = rt->dst.error;
    4489     - expires = rt->dst.expires;
    4490     - if (expires) {
    4491     - if (time_before(jiffies, expires))
    4492     - expires -= jiffies;
    4493     - else
    4494     - expires = 0;
    4495     - }
    4496    
    4497     if (rt_is_input_route(rt)) {
    4498     if (nla_put_u32(skb, RTA_IIF, rt->rt_iif))
    4499     diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
    4500     index 00a748d..db7bfad 100644
    4501     --- a/net/ipv4/tcp_ipv4.c
    4502     +++ b/net/ipv4/tcp_ipv4.c
    4503     @@ -693,10 +693,11 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
    4504     arg.csumoffset = offsetof(struct tcphdr, check) / 2;
    4505     arg.flags = (sk && inet_sk(sk)->transparent) ? IP_REPLY_ARG_NOSRCCHECK : 0;
    4506     /* When socket is gone, all binding information is lost.
    4507     - * routing might fail in this case. using iif for oif to
    4508     - * make sure we can deliver it
    4509     + * routing might fail in this case. No choice here, if we choose to force
    4510     + * input interface, we will misroute in case of asymmetric route.
    4511     */
    4512     - arg.bound_dev_if = sk ? sk->sk_bound_dev_if : inet_iif(skb);
    4513     + if (sk)
    4514     + arg.bound_dev_if = sk->sk_bound_dev_if;
    4515    
    4516     net = dev_net(skb_dst(skb)->dev);
    4517     arg.tos = ip_hdr(skb)->tos;
    4518     diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
    4519     index 681ea2f..05c5ab8 100644
    4520     --- a/net/ipv4/xfrm4_policy.c
    4521     +++ b/net/ipv4/xfrm4_policy.c
    4522     @@ -91,6 +91,7 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
    4523     RTCF_LOCAL);
    4524     xdst->u.rt.rt_type = rt->rt_type;
    4525     xdst->u.rt.rt_gateway = rt->rt_gateway;
    4526     + xdst->u.rt.rt_uses_gateway = rt->rt_uses_gateway;
    4527     xdst->u.rt.rt_pmtu = rt->rt_pmtu;
    4528     INIT_LIST_HEAD(&xdst->u.rt.rt_uncached);
    4529    
    4530     diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
    4531     index ea3e9af..b10374d 100644
    4532     --- a/net/ipv6/addrconf.c
    4533     +++ b/net/ipv6/addrconf.c
    4534     @@ -3088,14 +3088,15 @@ static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
    4535     struct hlist_node *n;
    4536     hlist_for_each_entry_rcu_bh(ifa, n, &inet6_addr_lst[state->bucket],
    4537     addr_lst) {
    4538     + if (!net_eq(dev_net(ifa->idev->dev), net))
    4539     + continue;
    4540     /* sync with offset */
    4541     if (p < state->offset) {
    4542     p++;
    4543     continue;
    4544     }
    4545     state->offset++;
    4546     - if (net_eq(dev_net(ifa->idev->dev), net))
    4547     - return ifa;
    4548     + return ifa;
    4549     }
    4550    
    4551     /* prepare for next bucket */
    4552     @@ -3113,18 +3114,20 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
    4553     struct hlist_node *n = &ifa->addr_lst;
    4554    
    4555     hlist_for_each_entry_continue_rcu_bh(ifa, n, addr_lst) {
    4556     + if (!net_eq(dev_net(ifa->idev->dev), net))
    4557     + continue;
    4558     state->offset++;
    4559     - if (net_eq(dev_net(ifa->idev->dev), net))
    4560     - return ifa;
    4561     + return ifa;
    4562     }
    4563    
    4564     while (++state->bucket < IN6_ADDR_HSIZE) {
    4565     state->offset = 0;
    4566     hlist_for_each_entry_rcu_bh(ifa, n,
    4567     &inet6_addr_lst[state->bucket], addr_lst) {
    4568     + if (!net_eq(dev_net(ifa->idev->dev), net))
    4569     + continue;
    4570     state->offset++;
    4571     - if (net_eq(dev_net(ifa->idev->dev), net))
    4572     - return ifa;
    4573     + return ifa;
    4574     }
    4575     }
    4576    
    4577     diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
    4578     index e22e6d8..f757e3b 100644
    4579     --- a/net/ipv6/af_inet6.c
    4580     +++ b/net/ipv6/af_inet6.c
    4581     @@ -880,22 +880,25 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
    4582     nlen = skb_network_header_len(skb);
    4583    
    4584     for (p = *head; p; p = p->next) {
    4585     - struct ipv6hdr *iph2;
    4586     + const struct ipv6hdr *iph2;
    4587     + __be32 first_word; /* <Version:4><Traffic_Class:8><Flow_Label:20> */
    4588    
    4589     if (!NAPI_GRO_CB(p)->same_flow)
    4590     continue;
    4591    
    4592     iph2 = ipv6_hdr(p);
    4593     + first_word = *(__be32 *)iph ^ *(__be32 *)iph2 ;
    4594    
    4595     - /* All fields must match except length. */
    4596     + /* All fields must match except length and Traffic Class. */
    4597     if (nlen != skb_network_header_len(p) ||
    4598     - memcmp(iph, iph2, offsetof(struct ipv6hdr, payload_len)) ||
    4599     + (first_word & htonl(0xF00FFFFF)) ||
    4600     memcmp(&iph->nexthdr, &iph2->nexthdr,
    4601     nlen - offsetof(struct ipv6hdr, nexthdr))) {
    4602     NAPI_GRO_CB(p)->same_flow = 0;
    4603     continue;
    4604     }
    4605     -
    4606     + /* flush if Traffic Class fields are different */
    4607     + NAPI_GRO_CB(p)->flush |= !!(first_word & htonl(0x0FF00000));
    4608     NAPI_GRO_CB(p)->flush |= flush;
    4609     }
    4610    
    4611     diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
    4612     index acd32e3..7e32d42 100644
    4613     --- a/net/ipv6/tcp_ipv6.c
    4614     +++ b/net/ipv6/tcp_ipv6.c
    4615     @@ -863,7 +863,8 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
    4616     __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
    4617    
    4618     fl6.flowi6_proto = IPPROTO_TCP;
    4619     - fl6.flowi6_oif = inet6_iif(skb);
    4620     + if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL)
    4621     + fl6.flowi6_oif = inet6_iif(skb);
    4622     fl6.fl6_dport = t1->dest;
    4623     fl6.fl6_sport = t1->source;
    4624     security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
    4625     diff --git a/net/mac80211/mesh_sync.c b/net/mac80211/mesh_sync.c
    4626     index accfa00..a16b7b4 100644
    4627     --- a/net/mac80211/mesh_sync.c
    4628     +++ b/net/mac80211/mesh_sync.c
    4629     @@ -56,7 +56,6 @@ void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata)
    4630     u64 tsfdelta;
    4631    
    4632     spin_lock_bh(&ifmsh->sync_offset_lock);
    4633     -
    4634     if (ifmsh->sync_offset_clockdrift_max < beacon_int_fraction) {
    4635     msync_dbg(sdata, "TBTT : max clockdrift=%lld; adjusting\n",
    4636     (long long) ifmsh->sync_offset_clockdrift_max);
    4637     @@ -69,11 +68,11 @@ void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata)
    4638     tsfdelta = -beacon_int_fraction;
    4639     ifmsh->sync_offset_clockdrift_max -= beacon_int_fraction;
    4640     }
    4641     + spin_unlock_bh(&ifmsh->sync_offset_lock);
    4642    
    4643     tsf = drv_get_tsf(local, sdata);
    4644     if (tsf != -1ULL)
    4645     drv_set_tsf(local, sdata, tsf + tsfdelta);
    4646     - spin_unlock_bh(&ifmsh->sync_offset_lock);
    4647     }
    4648    
    4649     static void mesh_sync_offset_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
    4650     diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
    4651     index 65b616a..c3c6291 100644
    4652     --- a/net/netfilter/ipvs/ip_vs_xmit.c
    4653     +++ b/net/netfilter/ipvs/ip_vs_xmit.c
    4654     @@ -49,6 +49,7 @@ enum {
    4655     IP_VS_RT_MODE_RDR = 4, /* Allow redirect from remote daddr to
    4656     * local
    4657     */
    4658     + IP_VS_RT_MODE_KNOWN_NH = 16,/* Route via remote addr */
    4659     };
    4660    
    4661     /*
    4662     @@ -103,6 +104,8 @@ __ip_vs_get_out_rt(struct sk_buff *skb, struct ip_vs_dest *dest,
    4663     memset(&fl4, 0, sizeof(fl4));
    4664     fl4.daddr = dest->addr.ip;
    4665     fl4.flowi4_tos = rtos;
    4666     + fl4.flowi4_flags = (rt_mode & IP_VS_RT_MODE_KNOWN_NH) ?
    4667     + FLOWI_FLAG_KNOWN_NH : 0;
    4668     rt = ip_route_output_key(net, &fl4);
    4669     if (IS_ERR(rt)) {
    4670     spin_unlock(&dest->dst_lock);
    4671     @@ -127,6 +130,8 @@ __ip_vs_get_out_rt(struct sk_buff *skb, struct ip_vs_dest *dest,
    4672     memset(&fl4, 0, sizeof(fl4));
    4673     fl4.daddr = daddr;
    4674     fl4.flowi4_tos = rtos;
    4675     + fl4.flowi4_flags = (rt_mode & IP_VS_RT_MODE_KNOWN_NH) ?
    4676     + FLOWI_FLAG_KNOWN_NH : 0;
    4677     rt = ip_route_output_key(net, &fl4);
    4678     if (IS_ERR(rt)) {
    4679     IP_VS_DBG_RL("ip_route_output error, dest: %pI4\n",
    4680     @@ -1014,7 +1019,8 @@ ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
    4681     if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,
    4682     RT_TOS(iph->tos),
    4683     IP_VS_RT_MODE_LOCAL |
    4684     - IP_VS_RT_MODE_NON_LOCAL, NULL)))
    4685     + IP_VS_RT_MODE_NON_LOCAL |
    4686     + IP_VS_RT_MODE_KNOWN_NH, NULL)))
    4687     goto tx_error_icmp;
    4688     if (rt->rt_flags & RTCF_LOCAL) {
    4689     ip_rt_put(rt);
    4690     diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
    4691     index 5270238..9172179 100644
    4692     --- a/net/netlink/af_netlink.c
    4693     +++ b/net/netlink/af_netlink.c
    4694     @@ -169,6 +169,8 @@ static void netlink_sock_destruct(struct sock *sk)
    4695     if (nlk->cb) {
    4696     if (nlk->cb->done)
    4697     nlk->cb->done(nlk->cb);
    4698     +
    4699     + module_put(nlk->cb->module);
    4700     netlink_destroy_callback(nlk->cb);
    4701     }
    4702    
    4703     @@ -1760,6 +1762,7 @@ static int netlink_dump(struct sock *sk)
    4704     nlk->cb = NULL;
    4705     mutex_unlock(nlk->cb_mutex);
    4706    
    4707     + module_put(cb->module);
    4708     netlink_consume_callback(cb);
    4709     return 0;
    4710    
    4711     @@ -1769,9 +1772,9 @@ errout_skb:
    4712     return err;
    4713     }
    4714    
    4715     -int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    4716     - const struct nlmsghdr *nlh,
    4717     - struct netlink_dump_control *control)
    4718     +int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    4719     + const struct nlmsghdr *nlh,
    4720     + struct netlink_dump_control *control)
    4721     {
    4722     struct netlink_callback *cb;
    4723     struct sock *sk;
    4724     @@ -1786,6 +1789,7 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    4725     cb->done = control->done;
    4726     cb->nlh = nlh;
    4727     cb->data = control->data;
    4728     + cb->module = control->module;
    4729     cb->min_dump_alloc = control->min_dump_alloc;
    4730     atomic_inc(&skb->users);
    4731     cb->skb = skb;
    4732     @@ -1796,19 +1800,28 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    4733     return -ECONNREFUSED;
    4734     }
    4735     nlk = nlk_sk(sk);
    4736     - /* A dump is in progress... */
    4737     +
    4738     mutex_lock(nlk->cb_mutex);
    4739     + /* A dump is in progress... */
    4740     if (nlk->cb) {
    4741     mutex_unlock(nlk->cb_mutex);
    4742     netlink_destroy_callback(cb);
    4743     - sock_put(sk);
    4744     - return -EBUSY;
    4745     + ret = -EBUSY;
    4746     + goto out;
    4747     }
    4748     + /* add reference of module which cb->dump belongs to */
    4749     + if (!try_module_get(cb->module)) {
    4750     + mutex_unlock(nlk->cb_mutex);
    4751     + netlink_destroy_callback(cb);
    4752     + ret = -EPROTONOSUPPORT;
    4753     + goto out;
    4754     + }
    4755     +
    4756     nlk->cb = cb;
    4757     mutex_unlock(nlk->cb_mutex);
    4758    
    4759     ret = netlink_dump(sk);
    4760     -
    4761     +out:
    4762     sock_put(sk);
    4763    
    4764     if (ret)
    4765     @@ -1819,7 +1832,7 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
    4766     */
    4767     return -EINTR;
    4768     }
    4769     -EXPORT_SYMBOL(netlink_dump_start);
    4770     +EXPORT_SYMBOL(__netlink_dump_start);
    4771    
    4772     void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
    4773     {
    4774     diff --git a/net/rds/send.c b/net/rds/send.c
    4775     index 96531d4..88eace5 100644
    4776     --- a/net/rds/send.c
    4777     +++ b/net/rds/send.c
    4778     @@ -1122,7 +1122,7 @@ rds_send_pong(struct rds_connection *conn, __be16 dport)
    4779     rds_stats_inc(s_send_pong);
    4780    
    4781     if (!test_bit(RDS_LL_SEND_FULL, &conn->c_flags))
    4782     - rds_send_xmit(conn);
    4783     + queue_delayed_work(rds_wq, &conn->c_send_w, 0);
    4784    
    4785     rds_message_put(rm);
    4786     return 0;
    4787     diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
    4788     index 2afd2a8..f86d95e 100644
    4789     --- a/net/sunrpc/cache.c
    4790     +++ b/net/sunrpc/cache.c
    4791     @@ -1409,11 +1409,11 @@ static ssize_t read_flush(struct file *file, char __user *buf,
    4792     size_t count, loff_t *ppos,
    4793     struct cache_detail *cd)
    4794     {
    4795     - char tbuf[20];
    4796     + char tbuf[22];
    4797     unsigned long p = *ppos;
    4798     size_t len;
    4799    
    4800     - sprintf(tbuf, "%lu\n", convert_to_wallclock(cd->flush_time));
    4801     + snprintf(tbuf, sizeof(tbuf), "%lu\n", convert_to_wallclock(cd->flush_time));
    4802     len = strlen(tbuf);
    4803     if (p >= len)
    4804     return 0;
    4805     diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
    4806     index d1988cf..97f8918 100644
    4807     --- a/net/sunrpc/xprtsock.c
    4808     +++ b/net/sunrpc/xprtsock.c
    4809     @@ -2539,6 +2539,7 @@ static struct rpc_xprt_ops xs_tcp_ops = {
    4810     static struct rpc_xprt_ops bc_tcp_ops = {
    4811     .reserve_xprt = xprt_reserve_xprt,
    4812     .release_xprt = xprt_release_xprt,
    4813     + .alloc_slot = xprt_alloc_slot,
    4814     .rpcbind = xs_local_rpcbind,
    4815     .buf_alloc = bc_malloc,
    4816     .buf_free = bc_free,