Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-3.6/0104-3.6.5-all-fixes.patch

    Annotation of /trunk/kernel-magellan/patches-3.6/0104-3.6.5-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1938 - (hide annotations) (download)
    Mon Nov 5 13:38:02 2012 UTC (11 years, 6 months ago) by niro
    File size: 154425 byte(s) 
    -3.6.6-magellan-r1
    1 niro 1938 diff --git a/Documentation/devicetree/bindings/arm/atmel-at91.txt b/Documentation/devicetree/bindings/arm/atmel-at91.txt
    2     index ecc81e3..d187e9f 100644
    3     --- a/Documentation/devicetree/bindings/arm/atmel-at91.txt
    4     +++ b/Documentation/devicetree/bindings/arm/atmel-at91.txt
    5     @@ -8,7 +8,7 @@ PIT Timer required properties:
    6     shared across all System Controller members.
    7    
    8     TC/TCLIB Timer required properties:
    9     -- compatible: Should be "atmel,<chip>-pit".
    10     +- compatible: Should be "atmel,<chip>-tcb".
    11     <chip> can be "at91rm9200" or "at91sam9x5"
    12     - reg: Should contain registers location and length
    13     - interrupts: Should contain all interrupts for the TC block
    14     diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
    15     index ebd8ad2..0181f7e 100644
    16     --- a/arch/arm/kernel/smp.c
    17     +++ b/arch/arm/kernel/smp.c
    18     @@ -222,18 +222,24 @@ static void percpu_timer_setup(void);
    19     asmlinkage void __cpuinit secondary_start_kernel(void)
    20     {
    21     struct mm_struct *mm = &init_mm;
    22     - unsigned int cpu = smp_processor_id();
    23     + unsigned int cpu;
    24     +
    25     + /*
    26     + * The identity mapping is uncached (strongly ordered), so
    27     + * switch away from it before attempting any exclusive accesses.
    28     + */
    29     + cpu_switch_mm(mm->pgd, mm);
    30     + enter_lazy_tlb(mm, current);
    31     + local_flush_tlb_all();
    32    
    33     /*
    34     * All kernel threads share the same mm context; grab a
    35     * reference and switch to it.
    36     */
    37     + cpu = smp_processor_id();
    38     atomic_inc(&mm->mm_count);
    39     current->active_mm = mm;
    40     cpumask_set_cpu(cpu, mm_cpumask(mm));
    41     - cpu_switch_mm(mm->pgd, mm);
    42     - enter_lazy_tlb(mm, current);
    43     - local_flush_tlb_all();
    44    
    45     printk("CPU%u: Booted secondary processor\n", cpu);
    46    
    47     diff --git a/arch/arm/mach-at91/at91rm9200_devices.c b/arch/arm/mach-at91/at91rm9200_devices.c
    48     index 01fb732..d5a4913 100644
    49     --- a/arch/arm/mach-at91/at91rm9200_devices.c
    50     +++ b/arch/arm/mach-at91/at91rm9200_devices.c
    51     @@ -463,7 +463,7 @@ static struct i2c_gpio_platform_data pdata = {
    52    
    53     static struct platform_device at91rm9200_twi_device = {
    54     .name = "i2c-gpio",
    55     - .id = -1,
    56     + .id = 0,
    57     .dev.platform_data = &pdata,
    58     };
    59    
    60     diff --git a/arch/arm/mach-at91/at91sam9260_devices.c b/arch/arm/mach-at91/at91sam9260_devices.c
    61     index bce572a..18ca240 100644
    62     --- a/arch/arm/mach-at91/at91sam9260_devices.c
    63     +++ b/arch/arm/mach-at91/at91sam9260_devices.c
    64     @@ -471,7 +471,7 @@ static struct i2c_gpio_platform_data pdata = {
    65    
    66     static struct platform_device at91sam9260_twi_device = {
    67     .name = "i2c-gpio",
    68     - .id = -1,
    69     + .id = 0,
    70     .dev.platform_data = &pdata,
    71     };
    72    
    73     diff --git a/arch/arm/mach-at91/at91sam9261_devices.c b/arch/arm/mach-at91/at91sam9261_devices.c
    74     index bc2590d..2495de8 100644
    75     --- a/arch/arm/mach-at91/at91sam9261_devices.c
    76     +++ b/arch/arm/mach-at91/at91sam9261_devices.c
    77     @@ -285,7 +285,7 @@ static struct i2c_gpio_platform_data pdata = {
    78    
    79     static struct platform_device at91sam9261_twi_device = {
    80     .name = "i2c-gpio",
    81     - .id = -1,
    82     + .id = 0,
    83     .dev.platform_data = &pdata,
    84     };
    85    
    86     diff --git a/arch/arm/mach-at91/at91sam9263_devices.c b/arch/arm/mach-at91/at91sam9263_devices.c
    87     index 9b6ca73..9877963 100644
    88     --- a/arch/arm/mach-at91/at91sam9263_devices.c
    89     +++ b/arch/arm/mach-at91/at91sam9263_devices.c
    90     @@ -542,7 +542,7 @@ static struct i2c_gpio_platform_data pdata = {
    91    
    92     static struct platform_device at91sam9263_twi_device = {
    93     .name = "i2c-gpio",
    94     - .id = -1,
    95     + .id = 0,
    96     .dev.platform_data = &pdata,
    97     };
    98    
    99     diff --git a/arch/arm/mach-at91/at91sam9rl_devices.c b/arch/arm/mach-at91/at91sam9rl_devices.c
    100     index b3d365d..c82a427 100644
    101     --- a/arch/arm/mach-at91/at91sam9rl_devices.c
    102     +++ b/arch/arm/mach-at91/at91sam9rl_devices.c
    103     @@ -314,7 +314,7 @@ static struct i2c_gpio_platform_data pdata = {
    104    
    105     static struct platform_device at91sam9rl_twi_device = {
    106     .name = "i2c-gpio",
    107     - .id = -1,
    108     + .id = 0,
    109     .dev.platform_data = &pdata,
    110     };
    111    
    112     diff --git a/arch/arm/mach-at91/board-neocore926.c b/arch/arm/mach-at91/board-neocore926.c
    113     index 18103c5d..997d359 100644
    114     --- a/arch/arm/mach-at91/board-neocore926.c
    115     +++ b/arch/arm/mach-at91/board-neocore926.c
    116     @@ -129,7 +129,7 @@ static struct spi_board_info neocore926_spi_devices[] = {
    117     .max_speed_hz = 125000 * 16,
    118     .bus_num = 0,
    119     .platform_data = &ads_info,
    120     - .irq = AT91SAM9263_ID_IRQ1,
    121     + .irq = NR_IRQS_LEGACY + AT91SAM9263_ID_IRQ1,
    122     },
    123     #endif
    124     };
    125     diff --git a/arch/arm/mach-at91/board-sam9261ek.c b/arch/arm/mach-at91/board-sam9261ek.c
    126     index 2269be5..17659be 100644
    127     --- a/arch/arm/mach-at91/board-sam9261ek.c
    128     +++ b/arch/arm/mach-at91/board-sam9261ek.c
    129     @@ -309,7 +309,7 @@ static struct spi_board_info ek_spi_devices[] = {
    130     .max_speed_hz = 125000 * 26, /* (max sample rate @ 3V) * (cmd + data + overhead) */
    131     .bus_num = 0,
    132     .platform_data = &ads_info,
    133     - .irq = AT91SAM9261_ID_IRQ0,
    134     + .irq = NR_IRQS_LEGACY + AT91SAM9261_ID_IRQ0,
    135     .controller_data = (void *) AT91_PIN_PA28, /* CS pin */
    136     },
    137     #endif
    138     diff --git a/arch/arm/mach-at91/board-sam9263ek.c b/arch/arm/mach-at91/board-sam9263ek.c
    139     index 82adf58..9e7153b 100644
    140     --- a/arch/arm/mach-at91/board-sam9263ek.c
    141     +++ b/arch/arm/mach-at91/board-sam9263ek.c
    142     @@ -132,7 +132,7 @@ static struct spi_board_info ek_spi_devices[] = {
    143     .max_speed_hz = 125000 * 26, /* (max sample rate @ 3V) * (cmd + data + overhead) */
    144     .bus_num = 0,
    145     .platform_data = &ads_info,
    146     - .irq = AT91SAM9263_ID_IRQ1,
    147     + .irq = NR_IRQS_LEGACY + AT91SAM9263_ID_IRQ1,
    148     },
    149     #endif
    150     };
    151     diff --git a/arch/arm/mach-at91/generic.h b/arch/arm/mach-at91/generic.h
    152     index f496506..b62f560e 100644
    153     --- a/arch/arm/mach-at91/generic.h
    154     +++ b/arch/arm/mach-at91/generic.h
    155     @@ -26,7 +26,8 @@ extern void __init at91_dt_initialize(void);
    156     extern void __init at91_init_irq_default(void);
    157     extern void __init at91_init_interrupts(unsigned int priority[]);
    158     extern void __init at91x40_init_interrupts(unsigned int priority[]);
    159     -extern void __init at91_aic_init(unsigned int priority[]);
    160     +extern void __init at91_aic_init(unsigned int priority[],
    161     + unsigned int ext_irq_mask);
    162     extern int __init at91_aic_of_init(struct device_node *node,
    163     struct device_node *parent);
    164     extern int __init at91_aic5_of_init(struct device_node *node,
    165     diff --git a/arch/arm/mach-at91/irq.c b/arch/arm/mach-at91/irq.c
    166     index 1e02c0e..febc2ee 100644
    167     --- a/arch/arm/mach-at91/irq.c
    168     +++ b/arch/arm/mach-at91/irq.c
    169     @@ -502,14 +502,19 @@ int __init at91_aic5_of_init(struct device_node *node,
    170     /*
    171     * Initialize the AIC interrupt controller.
    172     */
    173     -void __init at91_aic_init(unsigned int *priority)
    174     +void __init at91_aic_init(unsigned int *priority, unsigned int ext_irq_mask)
    175     {
    176     unsigned int i;
    177     int irq_base;
    178    
    179     - if (at91_aic_pm_init())
    180     + at91_extern_irq = kzalloc(BITS_TO_LONGS(n_irqs)
    181     + * sizeof(*at91_extern_irq), GFP_KERNEL);
    182     +
    183     + if (at91_aic_pm_init() || at91_extern_irq == NULL)
    184     panic("Unable to allocate bit maps\n");
    185    
    186     + *at91_extern_irq = ext_irq_mask;
    187     +
    188     at91_aic_base = ioremap(AT91_AIC, 512);
    189     if (!at91_aic_base)
    190     panic("Unable to ioremap AIC registers\n");
    191     diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c
    192     index 944bffb..bd0e88c 100644
    193     --- a/arch/arm/mach-at91/setup.c
    194     +++ b/arch/arm/mach-at91/setup.c
    195     @@ -47,7 +47,7 @@ void __init at91_init_irq_default(void)
    196     void __init at91_init_interrupts(unsigned int *priority)
    197     {
    198     /* Initialize the AIC interrupt controller */
    199     - at91_aic_init(priority);
    200     + at91_aic_init(priority, at91_extern_irq);
    201    
    202     /* Enable GPIO interrupts */
    203     at91_gpio_irq_setup();
    204     @@ -151,7 +151,7 @@ static void __init soc_detect(u32 dbgu_base)
    205     }
    206    
    207     /* at91sam9g10 */
    208     - if ((cidr & ~AT91_CIDR_EXT) == ARCH_ID_AT91SAM9G10) {
    209     + if ((socid & ~AT91_CIDR_EXT) == ARCH_ID_AT91SAM9G10) {
    210     at91_soc_initdata.type = AT91_SOC_SAM9G10;
    211     at91_boot_soc = at91sam9261_soc;
    212     }
    213     diff --git a/arch/arm/mach-exynos/common.c b/arch/arm/mach-exynos/common.c
    214     index 4eb39cd..3e02ae6 100644
    215     --- a/arch/arm/mach-exynos/common.c
    216     +++ b/arch/arm/mach-exynos/common.c
    217     @@ -47,6 +47,7 @@
    218     #include <plat/fimc-core.h>
    219     #include <plat/iic-core.h>
    220     #include <plat/tv-core.h>
    221     +#include <plat/spi-core.h>
    222     #include <plat/regs-serial.h>
    223    
    224     #include "common.h"
    225     @@ -346,6 +347,8 @@ static void __init exynos4_map_io(void)
    226    
    227     s5p_fb_setname(0, "exynos4-fb");
    228     s5p_hdmi_setname("exynos4-hdmi");
    229     +
    230     + s3c64xx_spi_setname("exynos4210-spi");
    231     }
    232    
    233     static void __init exynos5_map_io(void)
    234     @@ -366,6 +369,8 @@ static void __init exynos5_map_io(void)
    235     s3c_i2c0_setname("s3c2440-i2c");
    236     s3c_i2c1_setname("s3c2440-i2c");
    237     s3c_i2c2_setname("s3c2440-i2c");
    238     +
    239     + s3c64xx_spi_setname("exynos4210-spi");
    240     }
    241    
    242     static void __init exynos4_init_clocks(int xtal)
    243     diff --git a/arch/arm/mach-s3c24xx/s3c2416.c b/arch/arm/mach-s3c24xx/s3c2416.c
    244     index ed5a95ec..77ee0b7 100644
    245     --- a/arch/arm/mach-s3c24xx/s3c2416.c
    246     +++ b/arch/arm/mach-s3c24xx/s3c2416.c
    247     @@ -61,6 +61,7 @@
    248     #include <plat/nand-core.h>
    249     #include <plat/adc-core.h>
    250     #include <plat/rtc-core.h>
    251     +#include <plat/spi-core.h>
    252    
    253     static struct map_desc s3c2416_iodesc[] __initdata = {
    254     IODESC_ENT(WATCHDOG),
    255     @@ -132,6 +133,7 @@ void __init s3c2416_map_io(void)
    256     /* initialize device information early */
    257     s3c2416_default_sdhci0();
    258     s3c2416_default_sdhci1();
    259     + s3c64xx_spi_setname("s3c2443-spi");
    260    
    261     iotable_init(s3c2416_iodesc, ARRAY_SIZE(s3c2416_iodesc));
    262     }
    263     diff --git a/arch/arm/mach-s3c24xx/s3c2443.c b/arch/arm/mach-s3c24xx/s3c2443.c
    264     index ab648ad..165b6a6 100644
    265     --- a/arch/arm/mach-s3c24xx/s3c2443.c
    266     +++ b/arch/arm/mach-s3c24xx/s3c2443.c
    267     @@ -43,6 +43,7 @@
    268     #include <plat/nand-core.h>
    269     #include <plat/adc-core.h>
    270     #include <plat/rtc-core.h>
    271     +#include <plat/spi-core.h>
    272    
    273     static struct map_desc s3c2443_iodesc[] __initdata = {
    274     IODESC_ENT(WATCHDOG),
    275     @@ -100,6 +101,9 @@ void __init s3c2443_map_io(void)
    276     s3c24xx_gpiocfg_default.set_pull = s3c2443_gpio_setpull;
    277     s3c24xx_gpiocfg_default.get_pull = s3c2443_gpio_getpull;
    278    
    279     + /* initialize device information early */
    280     + s3c64xx_spi_setname("s3c2443-spi");
    281     +
    282     iotable_init(s3c2443_iodesc, ARRAY_SIZE(s3c2443_iodesc));
    283     }
    284    
    285     diff --git a/arch/arm/mach-s5p64x0/common.c b/arch/arm/mach-s5p64x0/common.c
    286     index 6e6a0a9..111e404 100644
    287     --- a/arch/arm/mach-s5p64x0/common.c
    288     +++ b/arch/arm/mach-s5p64x0/common.c
    289     @@ -44,6 +44,7 @@
    290     #include <plat/sdhci.h>
    291     #include <plat/adc-core.h>
    292     #include <plat/fb-core.h>
    293     +#include <plat/spi-core.h>
    294     #include <plat/gpio-cfg.h>
    295     #include <plat/regs-irqtype.h>
    296     #include <plat/regs-serial.h>
    297     @@ -179,6 +180,7 @@ void __init s5p6440_map_io(void)
    298     /* initialize any device information early */
    299     s3c_adc_setname("s3c64xx-adc");
    300     s3c_fb_setname("s5p64x0-fb");
    301     + s3c64xx_spi_setname("s5p64x0-spi");
    302    
    303     s5p64x0_default_sdhci0();
    304     s5p64x0_default_sdhci1();
    305     @@ -193,6 +195,7 @@ void __init s5p6450_map_io(void)
    306     /* initialize any device information early */
    307     s3c_adc_setname("s3c64xx-adc");
    308     s3c_fb_setname("s5p64x0-fb");
    309     + s3c64xx_spi_setname("s5p64x0-spi");
    310    
    311     s5p64x0_default_sdhci0();
    312     s5p64x0_default_sdhci1();
    313     diff --git a/arch/arm/mach-s5pc100/common.c b/arch/arm/mach-s5pc100/common.c
    314     index 6219086..cc6e561 100644
    315     --- a/arch/arm/mach-s5pc100/common.c
    316     +++ b/arch/arm/mach-s5pc100/common.c
    317     @@ -45,6 +45,7 @@
    318     #include <plat/fb-core.h>
    319     #include <plat/iic-core.h>
    320     #include <plat/onenand-core.h>
    321     +#include <plat/spi-core.h>
    322     #include <plat/regs-serial.h>
    323     #include <plat/watchdog-reset.h>
    324    
    325     @@ -165,6 +166,8 @@ void __init s5pc100_map_io(void)
    326     s3c_onenand_setname("s5pc100-onenand");
    327     s3c_fb_setname("s5pc100-fb");
    328     s3c_cfcon_setname("s5pc100-pata");
    329     +
    330     + s3c64xx_spi_setname("s5pc100-spi");
    331     }
    332    
    333     void __init s5pc100_init_clocks(int xtal)
    334     diff --git a/arch/arm/mach-s5pv210/common.c b/arch/arm/mach-s5pv210/common.c
    335     index 4c9e902..a0c50ef 100644
    336     --- a/arch/arm/mach-s5pv210/common.c
    337     +++ b/arch/arm/mach-s5pv210/common.c
    338     @@ -43,6 +43,7 @@
    339     #include <plat/iic-core.h>
    340     #include <plat/keypad-core.h>
    341     #include <plat/tv-core.h>
    342     +#include <plat/spi-core.h>
    343     #include <plat/regs-serial.h>
    344    
    345     #include "common.h"
    346     @@ -196,6 +197,8 @@ void __init s5pv210_map_io(void)
    347    
    348     /* setup TV devices */
    349     s5p_hdmi_setname("s5pv210-hdmi");
    350     +
    351     + s3c64xx_spi_setname("s5pv210-spi");
    352     }
    353    
    354     void __init s5pv210_init_clocks(int xtal)
    355     diff --git a/arch/arm/plat-samsung/include/plat/spi-core.h b/arch/arm/plat-samsung/include/plat/spi-core.h
    356     new file mode 100644
    357     index 0000000..0b9428a
    358     --- /dev/null
    359     +++ b/arch/arm/plat-samsung/include/plat/spi-core.h
    360     @@ -0,0 +1,30 @@
    361     +/*
    362     + * Copyright (C) 2012 Heiko Stuebner <heiko@sntech.de>
    363     + *
    364     + * This program is free software; you can redistribute it and/or modify
    365     + * it under the terms of the GNU General Public License version 2 as
    366     + * published by the Free Software Foundation.
    367     + */
    368     +
    369     +#ifndef __PLAT_S3C_SPI_CORE_H
    370     +#define __PLAT_S3C_SPI_CORE_H
    371     +
    372     +/* These functions are only for use with the core support code, such as
    373     + * the cpu specific initialisation code
    374     + */
    375     +
    376     +/* re-define device name depending on support. */
    377     +static inline void s3c64xx_spi_setname(char *name)
    378     +{
    379     +#ifdef CONFIG_S3C64XX_DEV_SPI0
    380     + s3c64xx_device_spi0.name = name;
    381     +#endif
    382     +#ifdef CONFIG_S3C64XX_DEV_SPI1
    383     + s3c64xx_device_spi1.name = name;
    384     +#endif
    385     +#ifdef CONFIG_S3C64XX_DEV_SPI2
    386     + s3c64xx_device_spi2.name = name;
    387     +#endif
    388     +}
    389     +
    390     +#endif /* __PLAT_S3C_SPI_CORE_H */
    391     diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
    392     index c9dcc18..029189d 100644
    393     --- a/arch/x86/include/asm/efi.h
    394     +++ b/arch/x86/include/asm/efi.h
    395     @@ -98,6 +98,7 @@ extern void efi_set_executable(efi_memory_desc_t *md, bool executable);
    396     extern int efi_memblock_x86_reserve_range(void);
    397     extern void efi_call_phys_prelog(void);
    398     extern void efi_call_phys_epilog(void);
    399     +extern void efi_unmap_memmap(void);
    400    
    401     #ifndef CONFIG_EFI
    402     /*
    403     diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
    404     index ed858e9..df06ade 100644
    405     --- a/arch/x86/kernel/e820.c
    406     +++ b/arch/x86/kernel/e820.c
    407     @@ -1077,6 +1077,9 @@ void __init memblock_x86_fill(void)
    408     memblock_add(ei->addr, ei->size);
    409     }
    410    
    411     + /* throw away partial pages */
    412     + memblock_trim_memory(PAGE_SIZE);
    413     +
    414     memblock_dump_all();
    415     }
    416    
    417     diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
    418     index 198e774..5cee802 100644
    419     --- a/arch/x86/kernel/setup.c
    420     +++ b/arch/x86/kernel/setup.c
    421     @@ -920,18 +920,19 @@ void __init setup_arch(char **cmdline_p)
    422     #ifdef CONFIG_X86_64
    423     if (max_pfn > max_low_pfn) {
    424     int i;
    425     - for (i = 0; i < e820.nr_map; i++) {
    426     - struct e820entry *ei = &e820.map[i];
    427     + unsigned long start, end;
    428     + unsigned long start_pfn, end_pfn;
    429    
    430     - if (ei->addr + ei->size <= 1UL << 32)
    431     - continue;
    432     + for_each_mem_pfn_range(i, MAX_NUMNODES, &start_pfn, &end_pfn,
    433     + NULL) {
    434    
    435     - if (ei->type == E820_RESERVED)
    436     + end = PFN_PHYS(end_pfn);
    437     + if (end <= (1UL<<32))
    438     continue;
    439    
    440     + start = PFN_PHYS(start_pfn);
    441     max_pfn_mapped = init_memory_mapping(
    442     - ei->addr < 1UL << 32 ? 1UL << 32 : ei->addr,
    443     - ei->addr + ei->size);
    444     + max((1UL<<32), start), end);
    445     }
    446    
    447     /* can we preseve max_low_pfn ?*/
    448     @@ -1047,6 +1048,18 @@ void __init setup_arch(char **cmdline_p)
    449     mcheck_init();
    450    
    451     arch_init_ideal_nops();
    452     +
    453     +#ifdef CONFIG_EFI
    454     + /* Once setup is done above, disable efi_enabled on mismatched
    455     + * firmware/kernel archtectures since there is no support for
    456     + * runtime services.
    457     + */
    458     + if (efi_enabled && IS_ENABLED(CONFIG_X86_64) != efi_64bit) {
    459     + pr_info("efi: Setup done, disabling due to 32/64-bit mismatch\n");
    460     + efi_unmap_memmap();
    461     + efi_enabled = 0;
    462     + }
    463     +#endif
    464     }
    465    
    466     #ifdef CONFIG_X86_32
    467     diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
    468     index ab1f6a9..d7aea41 100644
    469     --- a/arch/x86/mm/init.c
    470     +++ b/arch/x86/mm/init.c
    471     @@ -35,40 +35,44 @@ struct map_range {
    472     unsigned page_size_mask;
    473     };
    474    
    475     -static void __init find_early_table_space(struct map_range *mr, unsigned long end,
    476     - int use_pse, int use_gbpages)
    477     +/*
    478     + * First calculate space needed for kernel direct mapping page tables to cover
    479     + * mr[0].start to mr[nr_range - 1].end, while accounting for possible 2M and 1GB
    480     + * pages. Then find enough contiguous space for those page tables.
    481     + */
    482     +static void __init find_early_table_space(struct map_range *mr, int nr_range)
    483     {
    484     - unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
    485     + int i;
    486     + unsigned long puds = 0, pmds = 0, ptes = 0, tables;
    487     + unsigned long start = 0, good_end;
    488     phys_addr_t base;
    489    
    490     - puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
    491     - tables = roundup(puds * sizeof(pud_t), PAGE_SIZE);
    492     -
    493     - if (use_gbpages) {
    494     - unsigned long extra;
    495     -
    496     - extra = end - ((end>>PUD_SHIFT) << PUD_SHIFT);
    497     - pmds = (extra + PMD_SIZE - 1) >> PMD_SHIFT;
    498     - } else
    499     - pmds = (end + PMD_SIZE - 1) >> PMD_SHIFT;
    500     + for (i = 0; i < nr_range; i++) {
    501     + unsigned long range, extra;
    502    
    503     - tables += roundup(pmds * sizeof(pmd_t), PAGE_SIZE);
    504     + range = mr[i].end - mr[i].start;
    505     + puds += (range + PUD_SIZE - 1) >> PUD_SHIFT;
    506    
    507     - if (use_pse) {
    508     - unsigned long extra;
    509     + if (mr[i].page_size_mask & (1 << PG_LEVEL_1G)) {
    510     + extra = range - ((range >> PUD_SHIFT) << PUD_SHIFT);
    511     + pmds += (extra + PMD_SIZE - 1) >> PMD_SHIFT;
    512     + } else {
    513     + pmds += (range + PMD_SIZE - 1) >> PMD_SHIFT;
    514     + }
    515    
    516     - extra = end - ((end>>PMD_SHIFT) << PMD_SHIFT);
    517     + if (mr[i].page_size_mask & (1 << PG_LEVEL_2M)) {
    518     + extra = range - ((range >> PMD_SHIFT) << PMD_SHIFT);
    519     #ifdef CONFIG_X86_32
    520     - extra += PMD_SIZE;
    521     + extra += PMD_SIZE;
    522     #endif
    523     - /* The first 2/4M doesn't use large pages. */
    524     - if (mr->start < PMD_SIZE)
    525     - extra += mr->end - mr->start;
    526     -
    527     - ptes = (extra + PAGE_SIZE - 1) >> PAGE_SHIFT;
    528     - } else
    529     - ptes = (end + PAGE_SIZE - 1) >> PAGE_SHIFT;
    530     + ptes += (extra + PAGE_SIZE - 1) >> PAGE_SHIFT;
    531     + } else {
    532     + ptes += (range + PAGE_SIZE - 1) >> PAGE_SHIFT;
    533     + }
    534     + }
    535    
    536     + tables = roundup(puds * sizeof(pud_t), PAGE_SIZE);
    537     + tables += roundup(pmds * sizeof(pmd_t), PAGE_SIZE);
    538     tables += roundup(ptes * sizeof(pte_t), PAGE_SIZE);
    539    
    540     #ifdef CONFIG_X86_32
    541     @@ -86,7 +90,7 @@ static void __init find_early_table_space(struct map_range *mr, unsigned long en
    542     pgt_buf_top = pgt_buf_start + (tables >> PAGE_SHIFT);
    543    
    544     printk(KERN_DEBUG "kernel direct mapping tables up to %#lx @ [mem %#010lx-%#010lx]\n",
    545     - end - 1, pgt_buf_start << PAGE_SHIFT,
    546     + mr[nr_range - 1].end - 1, pgt_buf_start << PAGE_SHIFT,
    547     (pgt_buf_top << PAGE_SHIFT) - 1);
    548     }
    549    
    550     @@ -267,7 +271,7 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
    551     * nodes are discovered.
    552     */
    553     if (!after_bootmem)
    554     - find_early_table_space(&mr[0], end, use_pse, use_gbpages);
    555     + find_early_table_space(mr, nr_range);
    556    
    557     for (i = 0; i < nr_range; i++)
    558     ret = kernel_physical_mapping_init(mr[i].start, mr[i].end,
    559     diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
    560     index 2b6b4a3..3baff25 100644
    561     --- a/arch/x86/mm/init_64.c
    562     +++ b/arch/x86/mm/init_64.c
    563     @@ -386,7 +386,8 @@ phys_pte_init(pte_t *pte_page, unsigned long addr, unsigned long end,
    564     * these mappings are more intelligent.
    565     */
    566     if (pte_val(*pte)) {
    567     - pages++;
    568     + if (!after_bootmem)
    569     + pages++;
    570     continue;
    571     }
    572    
    573     @@ -451,6 +452,8 @@ phys_pmd_init(pmd_t *pmd_page, unsigned long address, unsigned long end,
    574     * attributes.
    575     */
    576     if (page_size_mask & (1 << PG_LEVEL_2M)) {
    577     + if (!after_bootmem)
    578     + pages++;
    579     last_map_addr = next;
    580     continue;
    581     }
    582     @@ -526,6 +529,8 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
    583     * attributes.
    584     */
    585     if (page_size_mask & (1 << PG_LEVEL_1G)) {
    586     + if (!after_bootmem)
    587     + pages++;
    588     last_map_addr = next;
    589     continue;
    590     }
    591     diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
    592     index f55a4ce..72d8899 100644
    593     --- a/arch/x86/platform/efi/efi.c
    594     +++ b/arch/x86/platform/efi/efi.c
    595     @@ -69,11 +69,15 @@ EXPORT_SYMBOL(efi);
    596     struct efi_memory_map memmap;
    597    
    598     bool efi_64bit;
    599     -static bool efi_native;
    600    
    601     static struct efi efi_phys __initdata;
    602     static efi_system_table_t efi_systab __initdata;
    603    
    604     +static inline bool efi_is_native(void)
    605     +{
    606     + return IS_ENABLED(CONFIG_X86_64) == efi_64bit;
    607     +}
    608     +
    609     static int __init setup_noefi(char *arg)
    610     {
    611     efi_enabled = 0;
    612     @@ -419,10 +423,21 @@ void __init efi_reserve_boot_services(void)
    613     }
    614     }
    615    
    616     -static void __init efi_free_boot_services(void)
    617     +void __init efi_unmap_memmap(void)
    618     +{
    619     + if (memmap.map) {
    620     + early_iounmap(memmap.map, memmap.nr_map * memmap.desc_size);
    621     + memmap.map = NULL;
    622     + }
    623     +}
    624     +
    625     +void __init efi_free_boot_services(void)
    626     {
    627     void *p;
    628    
    629     + if (!efi_is_native())
    630     + return;
    631     +
    632     for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
    633     efi_memory_desc_t *md = p;
    634     unsigned long long start = md->phys_addr;
    635     @@ -438,6 +453,8 @@ static void __init efi_free_boot_services(void)
    636    
    637     free_bootmem_late(start, size);
    638     }
    639     +
    640     + efi_unmap_memmap();
    641     }
    642    
    643     static int __init efi_systab_init(void *phys)
    644     @@ -670,12 +687,10 @@ void __init efi_init(void)
    645     return;
    646     }
    647     efi_phys.systab = (efi_system_table_t *)boot_params.efi_info.efi_systab;
    648     - efi_native = !efi_64bit;
    649     #else
    650     efi_phys.systab = (efi_system_table_t *)
    651     (boot_params.efi_info.efi_systab |
    652     ((__u64)boot_params.efi_info.efi_systab_hi<<32));
    653     - efi_native = efi_64bit;
    654     #endif
    655    
    656     if (efi_systab_init(efi_phys.systab)) {
    657     @@ -709,7 +724,7 @@ void __init efi_init(void)
    658     * that doesn't match the kernel 32/64-bit mode.
    659     */
    660    
    661     - if (!efi_native)
    662     + if (!efi_is_native())
    663     pr_info("No EFI runtime due to 32/64-bit mismatch with kernel\n");
    664     else if (efi_runtime_init()) {
    665     efi_enabled = 0;
    666     @@ -721,7 +736,7 @@ void __init efi_init(void)
    667     return;
    668     }
    669     #ifdef CONFIG_X86_32
    670     - if (efi_native) {
    671     + if (efi_is_native()) {
    672     x86_platform.get_wallclock = efi_get_time;
    673     x86_platform.set_wallclock = efi_set_rtc_mmss;
    674     }
    675     @@ -787,8 +802,10 @@ void __init efi_enter_virtual_mode(void)
    676     * non-native EFI
    677     */
    678    
    679     - if (!efi_native)
    680     - goto out;
    681     + if (!efi_is_native()) {
    682     + efi_unmap_memmap();
    683     + return;
    684     + }
    685    
    686     /* Merge contiguous regions of the same type and attribute */
    687     for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
    688     @@ -878,13 +895,6 @@ void __init efi_enter_virtual_mode(void)
    689     }
    690    
    691     /*
    692     - * Thankfully, it does seem that no runtime services other than
    693     - * SetVirtualAddressMap() will touch boot services code, so we can
    694     - * get rid of it all at this point
    695     - */
    696     - efi_free_boot_services();
    697     -
    698     - /*
    699     * Now that EFI is in virtual mode, update the function
    700     * pointers in the runtime service table to the new virtual addresses.
    701     *
    702     @@ -907,9 +917,6 @@ void __init efi_enter_virtual_mode(void)
    703     if (__supported_pte_mask & _PAGE_NX)
    704     runtime_code_page_mkexec();
    705    
    706     -out:
    707     - early_iounmap(memmap.map, memmap.nr_map * memmap.desc_size);
    708     - memmap.map = NULL;
    709     kfree(new_memmap);
    710     }
    711    
    712     diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
    713     index 758af9c..0059e26 100644
    714     --- a/drivers/bcma/main.c
    715     +++ b/drivers/bcma/main.c
    716     @@ -141,9 +141,10 @@ static int bcma_register_cores(struct bcma_bus *bus)
    717    
    718     static void bcma_unregister_cores(struct bcma_bus *bus)
    719     {
    720     - struct bcma_device *core;
    721     + struct bcma_device *core, *tmp;
    722    
    723     - list_for_each_entry(core, &bus->cores, list) {
    724     + list_for_each_entry_safe(core, tmp, &bus->cores, list) {
    725     + list_del(&core->list);
    726     if (core->dev_registered)
    727     device_unregister(&core->dev);
    728     }
    729     diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
    730     index 1a40935..c671369 100644
    731     --- a/drivers/cpufreq/powernow-k8.c
    732     +++ b/drivers/cpufreq/powernow-k8.c
    733     @@ -1223,14 +1223,7 @@ static int powernowk8_target(struct cpufreq_policy *pol,
    734     struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq,
    735     .relation = relation };
    736    
    737     - /*
    738     - * Must run on @pol->cpu. cpufreq core is responsible for ensuring
    739     - * that we're bound to the current CPU and pol->cpu stays online.
    740     - */
    741     - if (smp_processor_id() == pol->cpu)
    742     - return powernowk8_target_fn(&pta);
    743     - else
    744     - return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
    745     + return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
    746     }
    747    
    748     /* Driver entry point to verify the policy and range of frequencies */
    749     diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
    750     index 5084975..8aa9113 100644
    751     --- a/drivers/dma/imx-dma.c
    752     +++ b/drivers/dma/imx-dma.c
    753     @@ -474,8 +474,10 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
    754     slot = i;
    755     break;
    756     }
    757     - if (slot < 0)
    758     + if (slot < 0) {
    759     + spin_unlock_irqrestore(&imxdma->lock, flags);
    760     return -EBUSY;
    761     + }
    762    
    763     imxdma->slots_2d[slot].xsr = d->x;
    764     imxdma->slots_2d[slot].ysr = d->y;
    765     diff --git a/drivers/dma/sirf-dma.c b/drivers/dma/sirf-dma.c
    766     index 434ad31..c439489 100644
    767     --- a/drivers/dma/sirf-dma.c
    768     +++ b/drivers/dma/sirf-dma.c
    769     @@ -109,7 +109,7 @@ static void sirfsoc_dma_execute(struct sirfsoc_dma_chan *schan)
    770     sdesc = list_first_entry(&schan->queued, struct sirfsoc_dma_desc,
    771     node);
    772     /* Move the first queued descriptor to active list */
    773     - list_move_tail(&schan->queued, &schan->active);
    774     + list_move_tail(&sdesc->node, &schan->active);
    775    
    776     /* Start the DMA transfer */
    777     writel_relaxed(sdesc->width, sdma->base + SIRFSOC_DMA_WIDTH_0 +
    778     @@ -428,7 +428,7 @@ static struct dma_async_tx_descriptor *sirfsoc_dma_prep_interleaved(
    779     unsigned long iflags;
    780     int ret;
    781    
    782     - if ((xt->dir != DMA_MEM_TO_DEV) || (xt->dir != DMA_DEV_TO_MEM)) {
    783     + if ((xt->dir != DMA_MEM_TO_DEV) && (xt->dir != DMA_DEV_TO_MEM)) {
    784     ret = -EINVAL;
    785     goto err_dir;
    786     }
    787     diff --git a/drivers/extcon/extcon_class.c b/drivers/extcon/extcon_class.c
    788     index f6419f9..7dcfb7c 100644
    789     --- a/drivers/extcon/extcon_class.c
    790     +++ b/drivers/extcon/extcon_class.c
    791     @@ -575,6 +575,10 @@ static void extcon_cleanup(struct extcon_dev *edev, bool skip)
    792     kfree(edev->cables);
    793     }
    794    
    795     +#if defined(CONFIG_ANDROID)
    796     + if (switch_class)
    797     + class_compat_remove_link(switch_class, edev->dev, NULL);
    798     +#endif
    799     device_unregister(edev->dev);
    800     put_device(edev->dev);
    801     }
    802     @@ -821,6 +825,9 @@ module_init(extcon_class_init);
    803    
    804     static void __exit extcon_class_exit(void)
    805     {
    806     +#if defined(CONFIG_ANDROID)
    807     + class_compat_unregister(switch_class);
    808     +#endif
    809     class_destroy(extcon_class);
    810     }
    811     module_exit(extcon_class_exit);
    812     diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
    813     index d883b20..e932810 100644
    814     --- a/drivers/gpu/drm/radeon/evergreen_cs.c
    815     +++ b/drivers/gpu/drm/radeon/evergreen_cs.c
    816     @@ -2829,6 +2829,7 @@ static bool evergreen_vm_reg_valid(u32 reg)
    817     case CAYMAN_SQ_EX_ALLOC_TABLE_SLOTS:
    818     return true;
    819     default:
    820     + DRM_ERROR("Invalid register 0x%x in CS\n", reg);
    821     return false;
    822     }
    823     }
    824     diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
    825     index 4065374..f4c3d28 100644
    826     --- a/drivers/hv/channel.c
    827     +++ b/drivers/hv/channel.c
    828     @@ -146,14 +146,14 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
    829    
    830     if (ret != 0) {
    831     err = ret;
    832     - goto errorout;
    833     + goto error0;
    834     }
    835    
    836     ret = hv_ringbuffer_init(
    837     &newchannel->inbound, in, recv_ringbuffer_size);
    838     if (ret != 0) {
    839     err = ret;
    840     - goto errorout;
    841     + goto error0;
    842     }
    843    
    844    
    845     @@ -168,7 +168,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
    846    
    847     if (ret != 0) {
    848     err = ret;
    849     - goto errorout;
    850     + goto error0;
    851     }
    852    
    853     /* Create and init the channel open message */
    854     @@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
    855     GFP_KERNEL);
    856     if (!open_info) {
    857     err = -ENOMEM;
    858     - goto errorout;
    859     + goto error0;
    860     }
    861    
    862     init_completion(&open_info->waitevent);
    863     @@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
    864    
    865     if (userdatalen > MAX_USER_DEFINED_BYTES) {
    866     err = -EINVAL;
    867     - goto errorout;
    868     + goto error0;
    869     }
    870    
    871     if (userdatalen)
    872     @@ -208,19 +208,18 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
    873     sizeof(struct vmbus_channel_open_channel));
    874    
    875     if (ret != 0)
    876     - goto cleanup;
    877     + goto error1;
    878    
    879     t = wait_for_completion_timeout(&open_info->waitevent, 5*HZ);
    880     if (t == 0) {
    881     err = -ETIMEDOUT;
    882     - goto errorout;
    883     + goto error1;
    884     }
    885    
    886    
    887     if (open_info->response.open_result.status)
    888     err = open_info->response.open_result.status;
    889    
    890     -cleanup:
    891     spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
    892     list_del(&open_info->msglistentry);
    893     spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
    894     @@ -228,9 +227,12 @@ cleanup:
    895     kfree(open_info);
    896     return err;
    897    
    898     -errorout:
    899     - hv_ringbuffer_cleanup(&newchannel->outbound);
    900     - hv_ringbuffer_cleanup(&newchannel->inbound);
    901     +error1:
    902     + spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
    903     + list_del(&open_info->msglistentry);
    904     + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
    905     +
    906     +error0:
    907     free_pages((unsigned long)out,
    908     get_order(send_ringbuffer_size + recv_ringbuffer_size));
    909     kfree(open_info);
    910     diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
    911     index 4e2a162..4e98100 100644
    912     --- a/drivers/net/ethernet/tile/tilegx.c
    913     +++ b/drivers/net/ethernet/tile/tilegx.c
    914     @@ -1334,11 +1334,11 @@ static int tso_count_edescs(struct sk_buff *skb)
    915     {
    916     struct skb_shared_info *sh = skb_shinfo(skb);
    917     unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
    918     - unsigned int data_len = skb->data_len + skb->hdr_len - sh_len;
    919     + unsigned int data_len = skb->len - sh_len;
    920     unsigned int p_len = sh->gso_size;
    921     long f_id = -1; /* id of the current fragment */
    922     - long f_size = skb->hdr_len; /* size of the current fragment */
    923     - long f_used = sh_len; /* bytes used from the current fragment */
    924     + long f_size = skb_headlen(skb) - sh_len; /* current fragment size */
    925     + long f_used = 0; /* bytes used from the current fragment */
    926     long n; /* size of the current piece of payload */
    927     int num_edescs = 0;
    928     int segment;
    929     @@ -1353,7 +1353,7 @@ static int tso_count_edescs(struct sk_buff *skb)
    930     /* Advance as needed. */
    931     while (f_used >= f_size) {
    932     f_id++;
    933     - f_size = sh->frags[f_id].size;
    934     + f_size = skb_frag_size(&sh->frags[f_id]);
    935     f_used = 0;
    936     }
    937    
    938     @@ -1384,13 +1384,13 @@ static void tso_headers_prepare(struct sk_buff *skb, unsigned char *headers,
    939     struct iphdr *ih;
    940     struct tcphdr *th;
    941     unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
    942     - unsigned int data_len = skb->data_len + skb->hdr_len - sh_len;
    943     + unsigned int data_len = skb->len - sh_len;
    944     unsigned char *data = skb->data;
    945     unsigned int ih_off, th_off, p_len;
    946     unsigned int isum_seed, tsum_seed, id, seq;
    947     long f_id = -1; /* id of the current fragment */
    948     - long f_size = skb->hdr_len; /* size of the current fragment */
    949     - long f_used = sh_len; /* bytes used from the current fragment */
    950     + long f_size = skb_headlen(skb) - sh_len; /* current fragment size */
    951     + long f_used = 0; /* bytes used from the current fragment */
    952     long n; /* size of the current piece of payload */
    953     int segment;
    954    
    955     @@ -1405,7 +1405,7 @@ static void tso_headers_prepare(struct sk_buff *skb, unsigned char *headers,
    956     isum_seed = ((0xFFFF - ih->check) +
    957     (0xFFFF - ih->tot_len) +
    958     (0xFFFF - ih->id));
    959     - tsum_seed = th->check + (0xFFFF ^ htons(sh_len + data_len));
    960     + tsum_seed = th->check + (0xFFFF ^ htons(skb->len));
    961     id = ntohs(ih->id);
    962     seq = ntohl(th->seq);
    963    
    964     @@ -1444,7 +1444,7 @@ static void tso_headers_prepare(struct sk_buff *skb, unsigned char *headers,
    965     /* Advance as needed. */
    966     while (f_used >= f_size) {
    967     f_id++;
    968     - f_size = sh->frags[f_id].size;
    969     + f_size = skb_frag_size(&sh->frags[f_id]);
    970     f_used = 0;
    971     }
    972    
    973     @@ -1478,14 +1478,14 @@ static void tso_egress(struct net_device *dev, gxio_mpipe_equeue_t *equeue,
    974     struct tile_net_priv *priv = netdev_priv(dev);
    975     struct skb_shared_info *sh = skb_shinfo(skb);
    976     unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
    977     - unsigned int data_len = skb->data_len + skb->hdr_len - sh_len;
    978     + unsigned int data_len = skb->len - sh_len;
    979     unsigned int p_len = sh->gso_size;
    980     gxio_mpipe_edesc_t edesc_head = { { 0 } };
    981     gxio_mpipe_edesc_t edesc_body = { { 0 } };
    982     long f_id = -1; /* id of the current fragment */
    983     - long f_size = skb->hdr_len; /* size of the current fragment */
    984     - long f_used = sh_len; /* bytes used from the current fragment */
    985     - void *f_data = skb->data;
    986     + long f_size = skb_headlen(skb) - sh_len; /* current fragment size */
    987     + long f_used = 0; /* bytes used from the current fragment */
    988     + void *f_data = skb->data + sh_len;
    989     long n; /* size of the current piece of payload */
    990     unsigned long tx_packets = 0, tx_bytes = 0;
    991     unsigned int csum_start;
    992     @@ -1516,15 +1516,18 @@ static void tso_egress(struct net_device *dev, gxio_mpipe_equeue_t *equeue,
    993    
    994     /* Egress the payload. */
    995     while (p_used < p_len) {
    996     + void *va;
    997    
    998     /* Advance as needed. */
    999     while (f_used >= f_size) {
    1000     f_id++;
    1001     - f_size = sh->frags[f_id].size;
    1002     - f_used = 0;
    1003     + f_size = skb_frag_size(&sh->frags[f_id]);
    1004     f_data = tile_net_frag_buf(&sh->frags[f_id]);
    1005     + f_used = 0;
    1006     }
    1007    
    1008     + va = f_data + f_used;
    1009     +
    1010     /* Use bytes from the current fragment. */
    1011     n = p_len - p_used;
    1012     if (n > f_size - f_used)
    1013     @@ -1533,7 +1536,7 @@ static void tso_egress(struct net_device *dev, gxio_mpipe_equeue_t *equeue,
    1014     p_used += n;
    1015    
    1016     /* Egress a piece of the payload. */
    1017     - edesc_body.va = va_to_tile_io_addr(f_data) + f_used;
    1018     + edesc_body.va = va_to_tile_io_addr(va);
    1019     edesc_body.xfer_size = n;
    1020     edesc_body.bound = !(p_used < p_len);
    1021     gxio_mpipe_equeue_put_at(equeue, edesc_body, slot);
    1022     diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
    1023     index a03de71..d012982 100644
    1024     --- a/drivers/net/usb/cdc_ether.c
    1025     +++ b/drivers/net/usb/cdc_ether.c
    1026     @@ -592,6 +592,32 @@ static const struct usb_device_id products [] = {
    1027     .driver_info = 0,
    1028     },
    1029    
    1030     +/* Novatel USB551L and MC551 - handled by qmi_wwan */
    1031     +{
    1032     + .match_flags = USB_DEVICE_ID_MATCH_VENDOR
    1033     + | USB_DEVICE_ID_MATCH_PRODUCT
    1034     + | USB_DEVICE_ID_MATCH_INT_INFO,
    1035     + .idVendor = NOVATEL_VENDOR_ID,
    1036     + .idProduct = 0xB001,
    1037     + .bInterfaceClass = USB_CLASS_COMM,
    1038     + .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET,
    1039     + .bInterfaceProtocol = USB_CDC_PROTO_NONE,
    1040     + .driver_info = 0,
    1041     +},
    1042     +
    1043     +/* Novatel E362 - handled by qmi_wwan */
    1044     +{
    1045     + .match_flags = USB_DEVICE_ID_MATCH_VENDOR
    1046     + | USB_DEVICE_ID_MATCH_PRODUCT
    1047     + | USB_DEVICE_ID_MATCH_INT_INFO,
    1048     + .idVendor = NOVATEL_VENDOR_ID,
    1049     + .idProduct = 0x9010,
    1050     + .bInterfaceClass = USB_CLASS_COMM,
    1051     + .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET,
    1052     + .bInterfaceProtocol = USB_CDC_PROTO_NONE,
    1053     + .driver_info = 0,
    1054     +},
    1055     +
    1056     /*
    1057     * WHITELIST!!!
    1058     *
    1059     @@ -604,21 +630,6 @@ static const struct usb_device_id products [] = {
    1060     * because of bugs/quirks in a given product (like Zaurus, above).
    1061     */
    1062     {
    1063     - /* Novatel USB551L */
    1064     - /* This match must come *before* the generic CDC-ETHER match so that
    1065     - * we get FLAG_WWAN set on the device, since it's descriptors are
    1066     - * generic CDC-ETHER.
    1067     - */
    1068     - .match_flags = USB_DEVICE_ID_MATCH_VENDOR
    1069     - | USB_DEVICE_ID_MATCH_PRODUCT
    1070     - | USB_DEVICE_ID_MATCH_INT_INFO,
    1071     - .idVendor = NOVATEL_VENDOR_ID,
    1072     - .idProduct = 0xB001,
    1073     - .bInterfaceClass = USB_CLASS_COMM,
    1074     - .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET,
    1075     - .bInterfaceProtocol = USB_CDC_PROTO_NONE,
    1076     - .driver_info = (unsigned long)&wwan_info,
    1077     -}, {
    1078     /* ZTE (Vodafone) K3805-Z */
    1079     .match_flags = USB_DEVICE_ID_MATCH_VENDOR
    1080     | USB_DEVICE_ID_MATCH_PRODUCT
    1081     diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
    1082     index 3543c9e..3585f93 100644
    1083     --- a/drivers/net/usb/qmi_wwan.c
    1084     +++ b/drivers/net/usb/qmi_wwan.c
    1085     @@ -364,6 +364,20 @@ static const struct usb_device_id products[] = {
    1086     USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 57),
    1087     .driver_info = (unsigned long)&qmi_wwan_info,
    1088     },
    1089     + { /* Novatel USB551L and MC551 */
    1090     + USB_DEVICE_AND_INTERFACE_INFO(0x1410, 0xb001,
    1091     + USB_CLASS_COMM,
    1092     + USB_CDC_SUBCLASS_ETHERNET,
    1093     + USB_CDC_PROTO_NONE),
    1094     + .driver_info = (unsigned long)&qmi_wwan_info,
    1095     + },
    1096     + { /* Novatel E362 */
    1097     + USB_DEVICE_AND_INTERFACE_INFO(0x1410, 0x9010,
    1098     + USB_CLASS_COMM,
    1099     + USB_CDC_SUBCLASS_ETHERNET,
    1100     + USB_CDC_PROTO_NONE),
    1101     + .driver_info = (unsigned long)&qmi_wwan_info,
    1102     + },
    1103    
    1104     /* 2. Combined interface devices matching on class+protocol */
    1105     { /* Huawei E367 and possibly others in "Windows mode" */
    1106     diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
    1107     index 89bf94d..6f7cf49 100644
    1108     --- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
    1109     +++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
    1110     @@ -534,107 +534,107 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
    1111    
    1112     static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
    1113     /* Addr 5G_HT20 5G_HT40 2G_HT40 2G_HT20 */
    1114     - {0x0000a2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
    1115     - {0x0000a2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
    1116     - {0x0000a2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
    1117     + {0x0000a2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
    1118     + {0x0000a2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
    1119     + {0x0000a2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
    1120     {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
    1121     {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
    1122     {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
    1123     {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
    1124     {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
    1125     {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
    1126     - {0x0000a510, 0x15000028, 0x15000028, 0x0f000202, 0x0f000202},
    1127     - {0x0000a514, 0x1b00002b, 0x1b00002b, 0x12000400, 0x12000400},
    1128     - {0x0000a518, 0x1f020028, 0x1f020028, 0x16000402, 0x16000402},
    1129     - {0x0000a51c, 0x2502002b, 0x2502002b, 0x19000404, 0x19000404},
    1130     - {0x0000a520, 0x2a04002a, 0x2a04002a, 0x1c000603, 0x1c000603},
    1131     - {0x0000a524, 0x2e06002a, 0x2e06002a, 0x21000a02, 0x21000a02},
    1132     - {0x0000a528, 0x3302202d, 0x3302202d, 0x25000a04, 0x25000a04},
    1133     - {0x0000a52c, 0x3804202c, 0x3804202c, 0x28000a20, 0x28000a20},
    1134     - {0x0000a530, 0x3c06202c, 0x3c06202c, 0x2c000e20, 0x2c000e20},
    1135     - {0x0000a534, 0x4108202d, 0x4108202d, 0x30000e22, 0x30000e22},
    1136     - {0x0000a538, 0x4506402d, 0x4506402d, 0x34000e24, 0x34000e24},
    1137     - {0x0000a53c, 0x4906222d, 0x4906222d, 0x38001640, 0x38001640},
    1138     - {0x0000a540, 0x4d062231, 0x4d062231, 0x3c001660, 0x3c001660},
    1139     - {0x0000a544, 0x50082231, 0x50082231, 0x3f001861, 0x3f001861},
    1140     - {0x0000a548, 0x5608422e, 0x5608422e, 0x43001a81, 0x43001a81},
    1141     - {0x0000a54c, 0x5a08442e, 0x5a08442e, 0x47001a83, 0x47001a83},
    1142     - {0x0000a550, 0x5e0a4431, 0x5e0a4431, 0x4a001c84, 0x4a001c84},
    1143     - {0x0000a554, 0x640a4432, 0x640a4432, 0x4e001ce3, 0x4e001ce3},
    1144     - {0x0000a558, 0x680a4434, 0x680a4434, 0x52001ce5, 0x52001ce5},
    1145     - {0x0000a55c, 0x6c0a6434, 0x6c0a6434, 0x56001ce9, 0x56001ce9},
    1146     - {0x0000a560, 0x6f0a6633, 0x6f0a6633, 0x5a001ceb, 0x5a001ceb},
    1147     - {0x0000a564, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
    1148     - {0x0000a568, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
    1149     - {0x0000a56c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
    1150     - {0x0000a570, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
    1151     - {0x0000a574, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
    1152     - {0x0000a578, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
    1153     - {0x0000a57c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
    1154     + {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
    1155     + {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400},
    1156     + {0x0000a518, 0x21002220, 0x21002220, 0x16000402, 0x16000402},
    1157     + {0x0000a51c, 0x27002223, 0x27002223, 0x19000404, 0x19000404},
    1158     + {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603},
    1159     + {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02},
    1160     + {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04},
    1161     + {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20},
    1162     + {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20},
    1163     + {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22},
    1164     + {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24},
    1165     + {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640},
    1166     + {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660},
    1167     + {0x0000a544, 0x52022470, 0x52022470, 0x3f001861, 0x3f001861},
    1168     + {0x0000a548, 0x55022490, 0x55022490, 0x43001a81, 0x43001a81},
    1169     + {0x0000a54c, 0x59022492, 0x59022492, 0x47001a83, 0x47001a83},
    1170     + {0x0000a550, 0x5d022692, 0x5d022692, 0x4a001c84, 0x4a001c84},
    1171     + {0x0000a554, 0x61022892, 0x61022892, 0x4e001ce3, 0x4e001ce3},
    1172     + {0x0000a558, 0x65024890, 0x65024890, 0x52001ce5, 0x52001ce5},
    1173     + {0x0000a55c, 0x69024892, 0x69024892, 0x56001ce9, 0x56001ce9},
    1174     + {0x0000a560, 0x6e024c92, 0x6e024c92, 0x5a001ceb, 0x5a001ceb},
    1175     + {0x0000a564, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
    1176     + {0x0000a568, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
    1177     + {0x0000a56c, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
    1178     + {0x0000a570, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
    1179     + {0x0000a574, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
    1180     + {0x0000a578, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
    1181     + {0x0000a57c, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
    1182     {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
    1183     {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
    1184     {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
    1185     {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200},
    1186     - {0x0000a590, 0x15800028, 0x15800028, 0x0f800202, 0x0f800202},
    1187     - {0x0000a594, 0x1b80002b, 0x1b80002b, 0x12800400, 0x12800400},
    1188     - {0x0000a598, 0x1f820028, 0x1f820028, 0x16800402, 0x16800402},
    1189     - {0x0000a59c, 0x2582002b, 0x2582002b, 0x19800404, 0x19800404},
    1190     - {0x0000a5a0, 0x2a84002a, 0x2a84002a, 0x1c800603, 0x1c800603},
    1191     - {0x0000a5a4, 0x2e86002a, 0x2e86002a, 0x21800a02, 0x21800a02},
    1192     - {0x0000a5a8, 0x3382202d, 0x3382202d, 0x25800a04, 0x25800a04},
    1193     - {0x0000a5ac, 0x3884202c, 0x3884202c, 0x28800a20, 0x28800a20},
    1194     - {0x0000a5b0, 0x3c86202c, 0x3c86202c, 0x2c800e20, 0x2c800e20},
    1195     - {0x0000a5b4, 0x4188202d, 0x4188202d, 0x30800e22, 0x30800e22},
    1196     - {0x0000a5b8, 0x4586402d, 0x4586402d, 0x34800e24, 0x34800e24},
    1197     - {0x0000a5bc, 0x4986222d, 0x4986222d, 0x38801640, 0x38801640},
    1198     - {0x0000a5c0, 0x4d862231, 0x4d862231, 0x3c801660, 0x3c801660},
    1199     - {0x0000a5c4, 0x50882231, 0x50882231, 0x3f801861, 0x3f801861},
    1200     - {0x0000a5c8, 0x5688422e, 0x5688422e, 0x43801a81, 0x43801a81},
    1201     - {0x0000a5cc, 0x5a88442e, 0x5a88442e, 0x47801a83, 0x47801a83},
    1202     - {0x0000a5d0, 0x5e8a4431, 0x5e8a4431, 0x4a801c84, 0x4a801c84},
    1203     - {0x0000a5d4, 0x648a4432, 0x648a4432, 0x4e801ce3, 0x4e801ce3},
    1204     - {0x0000a5d8, 0x688a4434, 0x688a4434, 0x52801ce5, 0x52801ce5},
    1205     - {0x0000a5dc, 0x6c8a6434, 0x6c8a6434, 0x56801ce9, 0x56801ce9},
    1206     - {0x0000a5e0, 0x6f8a6633, 0x6f8a6633, 0x5a801ceb, 0x5a801ceb},
    1207     - {0x0000a5e4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
    1208     - {0x0000a5e8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
    1209     - {0x0000a5ec, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
    1210     - {0x0000a5f0, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
    1211     - {0x0000a5f4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
    1212     - {0x0000a5f8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
    1213     - {0x0000a5fc, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
    1214     + {0x0000a590, 0x16800220, 0x16800220, 0x0f800202, 0x0f800202},
    1215     + {0x0000a594, 0x1c800223, 0x1c800223, 0x12800400, 0x12800400},
    1216     + {0x0000a598, 0x21802220, 0x21802220, 0x16800402, 0x16800402},
    1217     + {0x0000a59c, 0x27802223, 0x27802223, 0x19800404, 0x19800404},
    1218     + {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1c800603, 0x1c800603},
    1219     + {0x0000a5a4, 0x2f822222, 0x2f822222, 0x21800a02, 0x21800a02},
    1220     + {0x0000a5a8, 0x34822225, 0x34822225, 0x25800a04, 0x25800a04},
    1221     + {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x28800a20, 0x28800a20},
    1222     + {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x2c800e20, 0x2c800e20},
    1223     + {0x0000a5b4, 0x4282242a, 0x4282242a, 0x30800e22, 0x30800e22},
    1224     + {0x0000a5b8, 0x4782244a, 0x4782244a, 0x34800e24, 0x34800e24},
    1225     + {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x38801640, 0x38801640},
    1226     + {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x3c801660, 0x3c801660},
    1227     + {0x0000a5c4, 0x52822470, 0x52822470, 0x3f801861, 0x3f801861},
    1228     + {0x0000a5c8, 0x55822490, 0x55822490, 0x43801a81, 0x43801a81},
    1229     + {0x0000a5cc, 0x59822492, 0x59822492, 0x47801a83, 0x47801a83},
    1230     + {0x0000a5d0, 0x5d822692, 0x5d822692, 0x4a801c84, 0x4a801c84},
    1231     + {0x0000a5d4, 0x61822892, 0x61822892, 0x4e801ce3, 0x4e801ce3},
    1232     + {0x0000a5d8, 0x65824890, 0x65824890, 0x52801ce5, 0x52801ce5},
    1233     + {0x0000a5dc, 0x69824892, 0x69824892, 0x56801ce9, 0x56801ce9},
    1234     + {0x0000a5e0, 0x6e824c92, 0x6e824c92, 0x5a801ceb, 0x5a801ceb},
    1235     + {0x0000a5e4, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
    1236     + {0x0000a5e8, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
    1237     + {0x0000a5ec, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
    1238     + {0x0000a5f0, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
    1239     + {0x0000a5f4, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
    1240     + {0x0000a5f8, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
    1241     + {0x0000a5fc, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
    1242     {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
    1243     {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
    1244     - {0x0000a608, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
    1245     - {0x0000a60c, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
    1246     - {0x0000a610, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
    1247     - {0x0000a614, 0x01804601, 0x01804601, 0x01404000, 0x01404000},
    1248     - {0x0000a618, 0x01804601, 0x01804601, 0x01404501, 0x01404501},
    1249     - {0x0000a61c, 0x01804601, 0x01804601, 0x02008501, 0x02008501},
    1250     - {0x0000a620, 0x03408d02, 0x03408d02, 0x0280ca03, 0x0280ca03},
    1251     - {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
    1252     - {0x0000a628, 0x03410d04, 0x03410d04, 0x04014c04, 0x04014c04},
    1253     - {0x0000a62c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
    1254     - {0x0000a630, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
    1255     - {0x0000a634, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
    1256     - {0x0000a638, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
    1257     - {0x0000a63c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
    1258     - {0x0000b2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
    1259     - {0x0000b2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
    1260     - {0x0000b2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
    1261     + {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
    1262     + {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
    1263     + {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
    1264     + {0x0000a614, 0x02004000, 0x02004000, 0x01404000, 0x01404000},
    1265     + {0x0000a618, 0x02004801, 0x02004801, 0x01404501, 0x01404501},
    1266     + {0x0000a61c, 0x02808a02, 0x02808a02, 0x02008501, 0x02008501},
    1267     + {0x0000a620, 0x0380ce03, 0x0380ce03, 0x0280ca03, 0x0280ca03},
    1268     + {0x0000a624, 0x04411104, 0x04411104, 0x03010c04, 0x03010c04},
    1269     + {0x0000a628, 0x04411104, 0x04411104, 0x04014c04, 0x04014c04},
    1270     + {0x0000a62c, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
    1271     + {0x0000a630, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
    1272     + {0x0000a634, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
    1273     + {0x0000a638, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
    1274     + {0x0000a63c, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
    1275     + {0x0000b2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
    1276     + {0x0000b2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
    1277     + {0x0000b2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
    1278     {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
    1279     - {0x0000c2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
    1280     - {0x0000c2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
    1281     - {0x0000c2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
    1282     + {0x0000c2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
    1283     + {0x0000c2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
    1284     + {0x0000c2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
    1285     {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
    1286     {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
    1287     - {0x00016048, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
    1288     + {0x00016048, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
    1289     {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
    1290     {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
    1291     - {0x00016448, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
    1292     + {0x00016448, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
    1293     {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
    1294     {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
    1295     - {0x00016848, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
    1296     + {0x00016848, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
    1297     {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
    1298     };
    1299    
    1300     diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
    1301     index a140165..46d9d4e 100644
    1302     --- a/drivers/net/wireless/b43/main.c
    1303     +++ b/drivers/net/wireless/b43/main.c
    1304     @@ -5374,6 +5374,8 @@ static void b43_bcma_remove(struct bcma_device *core)
    1305     cancel_work_sync(&wldev->restart_work);
    1306    
    1307     B43_WARN_ON(!wl);
    1308     + if (!wldev->fw.ucode.data)
    1309     + return; /* NULL if firmware never loaded */
    1310     if (wl->current_dev == wldev && wl->hw_registred) {
    1311     b43_leds_stop(wldev);
    1312     ieee80211_unregister_hw(wl->hw);
    1313     @@ -5448,6 +5450,8 @@ static void b43_ssb_remove(struct ssb_device *sdev)
    1314     cancel_work_sync(&wldev->restart_work);
    1315    
    1316     B43_WARN_ON(!wl);
    1317     + if (!wldev->fw.ucode.data)
    1318     + return; /* NULL if firmware never loaded */
    1319     if (wl->current_dev == wldev && wl->hw_registred) {
    1320     b43_leds_stop(wldev);
    1321     ieee80211_unregister_hw(wl->hw);
    1322     diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
    1323     index 0df4591..6d1754a 100644
    1324     --- a/drivers/net/wireless/ipw2x00/ipw2200.c
    1325     +++ b/drivers/net/wireless/ipw2x00/ipw2200.c
    1326     @@ -10479,7 +10479,7 @@ static void ipw_handle_promiscuous_tx(struct ipw_priv *priv,
    1327     } else
    1328     len = src->len;
    1329    
    1330     - dst = alloc_skb(len + sizeof(*rt_hdr), GFP_ATOMIC);
    1331     + dst = alloc_skb(len + sizeof(*rt_hdr) + sizeof(u16)*2, GFP_ATOMIC);
    1332     if (!dst)
    1333     continue;
    1334    
    1335     diff --git a/drivers/net/wireless/iwlwifi/dvm/devices.c b/drivers/net/wireless/iwlwifi/dvm/devices.c
    1336     index 349c205..da58620 100644
    1337     --- a/drivers/net/wireless/iwlwifi/dvm/devices.c
    1338     +++ b/drivers/net/wireless/iwlwifi/dvm/devices.c
    1339     @@ -518,7 +518,7 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
    1340     * See iwlagn_mac_channel_switch.
    1341     */
    1342     struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
    1343     - struct iwl6000_channel_switch_cmd cmd;
    1344     + struct iwl6000_channel_switch_cmd *cmd;
    1345     u32 switch_time_in_usec, ucode_switch_time;
    1346     u16 ch;
    1347     u32 tsf_low;
    1348     @@ -527,18 +527,25 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
    1349     struct ieee80211_vif *vif = ctx->vif;
    1350     struct iwl_host_cmd hcmd = {
    1351     .id = REPLY_CHANNEL_SWITCH,
    1352     - .len = { sizeof(cmd), },
    1353     + .len = { sizeof(*cmd), },
    1354     .flags = CMD_SYNC,
    1355     - .data = { &cmd, },
    1356     + .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
    1357     };
    1358     + int err;
    1359    
    1360     - cmd.band = priv->band == IEEE80211_BAND_2GHZ;
    1361     + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
    1362     + if (!cmd)
    1363     + return -ENOMEM;
    1364     +
    1365     + hcmd.data[0] = cmd;
    1366     +
    1367     + cmd->band = priv->band == IEEE80211_BAND_2GHZ;
    1368     ch = ch_switch->channel->hw_value;
    1369     IWL_DEBUG_11H(priv, "channel switch from %u to %u\n",
    1370     ctx->active.channel, ch);
    1371     - cmd.channel = cpu_to_le16(ch);
    1372     - cmd.rxon_flags = ctx->staging.flags;
    1373     - cmd.rxon_filter_flags = ctx->staging.filter_flags;
    1374     + cmd->channel = cpu_to_le16(ch);
    1375     + cmd->rxon_flags = ctx->staging.flags;
    1376     + cmd->rxon_filter_flags = ctx->staging.filter_flags;
    1377     switch_count = ch_switch->count;
    1378     tsf_low = ch_switch->timestamp & 0x0ffffffff;
    1379     /*
    1380     @@ -554,23 +561,25 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
    1381     switch_count = 0;
    1382     }
    1383     if (switch_count <= 1)
    1384     - cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
    1385     + cmd->switch_time = cpu_to_le32(priv->ucode_beacon_time);
    1386     else {
    1387     switch_time_in_usec =
    1388     vif->bss_conf.beacon_int * switch_count * TIME_UNIT;
    1389     ucode_switch_time = iwl_usecs_to_beacons(priv,
    1390     switch_time_in_usec,
    1391     beacon_interval);
    1392     - cmd.switch_time = iwl_add_beacon_time(priv,
    1393     - priv->ucode_beacon_time,
    1394     - ucode_switch_time,
    1395     - beacon_interval);
    1396     + cmd->switch_time = iwl_add_beacon_time(priv,
    1397     + priv->ucode_beacon_time,
    1398     + ucode_switch_time,
    1399     + beacon_interval);
    1400     }
    1401     IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
    1402     - cmd.switch_time);
    1403     - cmd.expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
    1404     + cmd->switch_time);
    1405     + cmd->expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
    1406    
    1407     - return iwl_dvm_send_cmd(priv, &hcmd);
    1408     + err = iwl_dvm_send_cmd(priv, &hcmd);
    1409     + kfree(cmd);
    1410     + return err;
    1411     }
    1412    
    1413     struct iwl_lib_ops iwl6000_lib = {
    1414     diff --git a/drivers/rtc/rtc-imxdi.c b/drivers/rtc/rtc-imxdi.c
    1415     index 891cd6c..4eed510 100644
    1416     --- a/drivers/rtc/rtc-imxdi.c
    1417     +++ b/drivers/rtc/rtc-imxdi.c
    1418     @@ -392,6 +392,8 @@ static int dryice_rtc_probe(struct platform_device *pdev)
    1419     if (imxdi->ioaddr == NULL)
    1420     return -ENOMEM;
    1421    
    1422     + spin_lock_init(&imxdi->irq_lock);
    1423     +
    1424     imxdi->irq = platform_get_irq(pdev, 0);
    1425     if (imxdi->irq < 0)
    1426     return imxdi->irq;
    1427     diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
    1428     index 574e992..467d493 100644
    1429     --- a/drivers/staging/android/binder.c
    1430     +++ b/drivers/staging/android/binder.c
    1431     @@ -655,7 +655,7 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
    1432     page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE];
    1433    
    1434     BUG_ON(*page);
    1435     - *page = alloc_page(GFP_KERNEL | __GFP_ZERO);
    1436     + *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO);
    1437     if (*page == NULL) {
    1438     pr_err("binder: %d: binder_alloc_buf failed "
    1439     "for page at %p\n", proc->pid, page_addr);
    1440     @@ -2507,14 +2507,38 @@ static void binder_release_work(struct list_head *list)
    1441     struct binder_transaction *t;
    1442    
    1443     t = container_of(w, struct binder_transaction, work);
    1444     - if (t->buffer->target_node && !(t->flags & TF_ONE_WAY))
    1445     + if (t->buffer->target_node &&
    1446     + !(t->flags & TF_ONE_WAY)) {
    1447     binder_send_failed_reply(t, BR_DEAD_REPLY);
    1448     + } else {
    1449     + binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
    1450     + "binder: undelivered transaction %d\n",
    1451     + t->debug_id);
    1452     + t->buffer->transaction = NULL;
    1453     + kfree(t);
    1454     + binder_stats_deleted(BINDER_STAT_TRANSACTION);
    1455     + }
    1456     } break;
    1457     case BINDER_WORK_TRANSACTION_COMPLETE: {
    1458     + binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
    1459     + "binder: undelivered TRANSACTION_COMPLETE\n");
    1460     kfree(w);
    1461     binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
    1462     } break;
    1463     + case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
    1464     + case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
    1465     + struct binder_ref_death *death;
    1466     +
    1467     + death = container_of(w, struct binder_ref_death, work);
    1468     + binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
    1469     + "binder: undelivered death notification, %p\n",
    1470     + death->cookie);
    1471     + kfree(death);
    1472     + binder_stats_deleted(BINDER_STAT_DEATH);
    1473     + } break;
    1474     default:
    1475     + pr_err("binder: unexpected work type, %d, not freed\n",
    1476     + w->type);
    1477     break;
    1478     }
    1479     }
    1480     @@ -2984,6 +3008,7 @@ static void binder_deferred_release(struct binder_proc *proc)
    1481     nodes++;
    1482     rb_erase(&node->rb_node, &proc->nodes);
    1483     list_del_init(&node->work.entry);
    1484     + binder_release_work(&node->async_todo);
    1485     if (hlist_empty(&node->refs)) {
    1486     kfree(node);
    1487     binder_stats_deleted(BINDER_STAT_NODE);
    1488     @@ -3022,6 +3047,7 @@ static void binder_deferred_release(struct binder_proc *proc)
    1489     binder_delete_ref(ref);
    1490     }
    1491     binder_release_work(&proc->todo);
    1492     + binder_release_work(&proc->delivered_death);
    1493     buffers = 0;
    1494    
    1495     while ((n = rb_first(&proc->allocated_buffers))) {
    1496     diff --git a/drivers/staging/comedi/drivers/amplc_dio200.c b/drivers/staging/comedi/drivers/amplc_dio200.c
    1497     index cc8931f..aee22fd 100644
    1498     --- a/drivers/staging/comedi/drivers/amplc_dio200.c
    1499     +++ b/drivers/staging/comedi/drivers/amplc_dio200.c
    1500     @@ -1429,6 +1429,8 @@ static void dio200_detach(struct comedi_device *dev)
    1501     const struct dio200_layout_struct *layout;
    1502     unsigned n;
    1503    
    1504     + if (!thisboard)
    1505     + return;
    1506     if (dev->irq)
    1507     free_irq(dev->irq, dev);
    1508     if (dev->subdevices) {
    1509     diff --git a/drivers/staging/comedi/drivers/amplc_pc236.c b/drivers/staging/comedi/drivers/amplc_pc236.c
    1510     index f502879..b46e663 100644
    1511     --- a/drivers/staging/comedi/drivers/amplc_pc236.c
    1512     +++ b/drivers/staging/comedi/drivers/amplc_pc236.c
    1513     @@ -577,10 +577,12 @@ static int __devinit pc236_attach_pci(struct comedi_device *dev,
    1514    
    1515     static void pc236_detach(struct comedi_device *dev)
    1516     {
    1517     - struct pc236_private *devpriv = dev->private;
    1518     + const struct pc236_board *thisboard = comedi_board(dev);
    1519     struct pci_dev *pcidev = comedi_to_pci_dev(dev);
    1520    
    1521     - if (devpriv)
    1522     + if (!thisboard)
    1523     + return;
    1524     + if (dev->iobase)
    1525     pc236_intr_disable(dev);
    1526     if (dev->irq)
    1527     free_irq(dev->irq, dev);
    1528     diff --git a/drivers/staging/comedi/drivers/amplc_pc263.c b/drivers/staging/comedi/drivers/amplc_pc263.c
    1529     index 8191c4e..8c0fbd1 100644
    1530     --- a/drivers/staging/comedi/drivers/amplc_pc263.c
    1531     +++ b/drivers/staging/comedi/drivers/amplc_pc263.c
    1532     @@ -310,8 +310,11 @@ static int __devinit pc263_attach_pci(struct comedi_device *dev,
    1533    
    1534     static void pc263_detach(struct comedi_device *dev)
    1535     {
    1536     + const struct pc263_board *thisboard = comedi_board(dev);
    1537     struct pci_dev *pcidev = comedi_to_pci_dev(dev);
    1538    
    1539     + if (!thisboard)
    1540     + return;
    1541     if (pcidev) {
    1542     if (dev->iobase)
    1543     comedi_pci_disable(pcidev);
    1544     diff --git a/drivers/staging/comedi/drivers/das08.c b/drivers/staging/comedi/drivers/das08.c
    1545     index 67a914a..d893e3b 100644
    1546     --- a/drivers/staging/comedi/drivers/das08.c
    1547     +++ b/drivers/staging/comedi/drivers/das08.c
    1548     @@ -1028,6 +1028,8 @@ static void __maybe_unused das08_detach(struct comedi_device *dev)
    1549     const struct das08_board_struct *thisboard = comedi_board(dev);
    1550     struct das08_private_struct *devpriv = dev->private;
    1551    
    1552     + if (!thisboard)
    1553     + return;
    1554     das08_common_detach(dev);
    1555     if (IS_ENABLED(CONFIG_COMEDI_DAS08_ISA) &&
    1556     (thisboard->bustype == isa || thisboard->bustype == pc104)) {
    1557     diff --git a/drivers/staging/comedi/drivers/ni_daq_700.c b/drivers/staging/comedi/drivers/ni_daq_700.c
    1558     index 83016b4..bcf6a65 100644
    1559     --- a/drivers/staging/comedi/drivers/ni_daq_700.c
    1560     +++ b/drivers/staging/comedi/drivers/ni_daq_700.c
    1561     @@ -71,7 +71,7 @@ static int subdev_700_insn(struct comedi_device *dev,
    1562     }
    1563    
    1564     data[1] = s->state & 0xff;
    1565     - data[1] |= inb(dev->iobase + DIO_R);
    1566     + data[1] |= inb(dev->iobase + DIO_R) << 8;
    1567    
    1568     return insn->n;
    1569     }
    1570     diff --git a/drivers/staging/comedi/drivers/ni_labpc.c b/drivers/staging/comedi/drivers/ni_labpc.c
    1571     index ab8b787..d3a1d65 100644
    1572     --- a/drivers/staging/comedi/drivers/ni_labpc.c
    1573     +++ b/drivers/staging/comedi/drivers/ni_labpc.c
    1574     @@ -809,6 +809,8 @@ static int labpc_find_device(struct comedi_device *dev, int bus, int slot)
    1575    
    1576     void labpc_common_detach(struct comedi_device *dev)
    1577     {
    1578     + if (!thisboard)
    1579     + return;
    1580     if (dev->subdevices)
    1581     subdev_8255_cleanup(dev, dev->subdevices + 2);
    1582     #ifdef CONFIG_ISA_DMA_API
    1583     diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
    1584     index 653b074..6edefde 100644
    1585     --- a/drivers/staging/zram/zram_drv.c
    1586     +++ b/drivers/staging/zram/zram_drv.c
    1587     @@ -223,8 +223,13 @@ static int zram_bvec_read(struct zram *zram, struct bio_vec *bvec,
    1588     cmem = zs_map_object(zram->mem_pool, zram->table[index].handle,
    1589     ZS_MM_RO);
    1590    
    1591     - ret = lzo1x_decompress_safe(cmem, zram->table[index].size,
    1592     + if (zram->table[index].size == PAGE_SIZE) {
    1593     + memcpy(uncmem, cmem, PAGE_SIZE);
    1594     + ret = LZO_E_OK;
    1595     + } else {
    1596     + ret = lzo1x_decompress_safe(cmem, zram->table[index].size,
    1597     uncmem, &clen);
    1598     + }
    1599    
    1600     if (is_partial_io(bvec)) {
    1601     memcpy(user_mem + bvec->bv_offset, uncmem + offset,
    1602     @@ -342,8 +347,11 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
    1603     goto out;
    1604     }
    1605    
    1606     - if (unlikely(clen > max_zpage_size))
    1607     + if (unlikely(clen > max_zpage_size)) {
    1608     zram_stat_inc(&zram->stats.bad_compress);
    1609     + src = uncmem;
    1610     + clen = PAGE_SIZE;
    1611     + }
    1612    
    1613     handle = zs_malloc(zram->mem_pool, clen);
    1614     if (!handle) {
    1615     diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    1616     index bbff143..fe7faf0 100644
    1617     --- a/drivers/usb/core/hub.c
    1618     +++ b/drivers/usb/core/hub.c
    1619     @@ -730,13 +730,16 @@ static void hub_tt_work(struct work_struct *work)
    1620     int limit = 100;
    1621    
    1622     spin_lock_irqsave (&hub->tt.lock, flags);
    1623     - while (--limit && !list_empty (&hub->tt.clear_list)) {
    1624     + while (!list_empty(&hub->tt.clear_list)) {
    1625     struct list_head *next;
    1626     struct usb_tt_clear *clear;
    1627     struct usb_device *hdev = hub->hdev;
    1628     const struct hc_driver *drv;
    1629     int status;
    1630    
    1631     + if (!hub->quiescing && --limit < 0)
    1632     + break;
    1633     +
    1634     next = hub->tt.clear_list.next;
    1635     clear = list_entry (next, struct usb_tt_clear, clear_list);
    1636     list_del (&clear->clear_list);
    1637     @@ -1201,7 +1204,7 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type)
    1638     if (hub->has_indicators)
    1639     cancel_delayed_work_sync(&hub->leds);
    1640     if (hub->tt.hub)
    1641     - cancel_work_sync(&hub->tt.clear_work);
    1642     + flush_work_sync(&hub->tt.clear_work);
    1643     }
    1644    
    1645     /* caller has locked the hub device */
    1646     diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
    1647     index 966d148..39f9e4a 100644
    1648     --- a/drivers/usb/host/pci-quirks.c
    1649     +++ b/drivers/usb/host/pci-quirks.c
    1650     @@ -545,7 +545,14 @@ static const struct dmi_system_id __devinitconst ehci_dmi_nohandoff_table[] = {
    1651     /* Pegatron Lucid (Ordissimo AIRIS) */
    1652     .matches = {
    1653     DMI_MATCH(DMI_BOARD_NAME, "M11JB"),
    1654     - DMI_MATCH(DMI_BIOS_VERSION, "Lucid-GE-133"),
    1655     + DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"),
    1656     + },
    1657     + },
    1658     + {
    1659     + /* Pegatron Lucid (Ordissimo) */
    1660     + .matches = {
    1661     + DMI_MATCH(DMI_BOARD_NAME, "Ordissimo"),
    1662     + DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"),
    1663     },
    1664     },
    1665     { }
    1666     diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    1667     index a6e18b9..4f1e265 100644
    1668     --- a/drivers/usb/host/xhci-ring.c
    1669     +++ b/drivers/usb/host/xhci-ring.c
    1670     @@ -1228,6 +1228,17 @@ static void xhci_cmd_to_noop(struct xhci_hcd *xhci, struct xhci_cd *cur_cd)
    1671     cur_seg = find_trb_seg(xhci->cmd_ring->first_seg,
    1672     xhci->cmd_ring->dequeue, &cycle_state);
    1673    
    1674     + if (!cur_seg) {
    1675     + xhci_warn(xhci, "Command ring mismatch, dequeue = %p %llx (dma)\n",
    1676     + xhci->cmd_ring->dequeue,
    1677     + (unsigned long long)
    1678     + xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg,
    1679     + xhci->cmd_ring->dequeue));
    1680     + xhci_debug_ring(xhci, xhci->cmd_ring);
    1681     + xhci_dbg_ring_ptrs(xhci, xhci->cmd_ring);
    1682     + return;
    1683     + }
    1684     +
    1685     /* find the command trb matched by cd from command ring */
    1686     for (cmd_trb = xhci->cmd_ring->dequeue;
    1687     cmd_trb != xhci->cmd_ring->enqueue;
    1688     diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    1689     index 0644f65..a6e910b 100644
    1690     --- a/drivers/usb/host/xhci.c
    1691     +++ b/drivers/usb/host/xhci.c
    1692     @@ -4020,7 +4020,7 @@ int xhci_update_device(struct usb_hcd *hcd, struct usb_device *udev)
    1693     static unsigned long long xhci_service_interval_to_ns(
    1694     struct usb_endpoint_descriptor *desc)
    1695     {
    1696     - return (1 << (desc->bInterval - 1)) * 125 * 1000;
    1697     + return (1ULL << (desc->bInterval - 1)) * 125 * 1000;
    1698     }
    1699    
    1700     static u16 xhci_get_timeout_no_hub_lpm(struct usb_device *udev,
    1701     @@ -4141,7 +4141,7 @@ static u16 xhci_calculate_intel_u2_timeout(struct usb_device *udev,
    1702     (xhci_service_interval_to_ns(desc) > timeout_ns))
    1703     timeout_ns = xhci_service_interval_to_ns(desc);
    1704    
    1705     - u2_del_ns = udev->bos->ss_cap->bU2DevExitLat * 1000;
    1706     + u2_del_ns = le16_to_cpu(udev->bos->ss_cap->bU2DevExitLat) * 1000ULL;
    1707     if (u2_del_ns > timeout_ns)
    1708     timeout_ns = u2_del_ns;
    1709    
    1710     diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
    1711     index cabd1b1..8391d30 100644
    1712     --- a/drivers/usb/serial/ch341.c
    1713     +++ b/drivers/usb/serial/ch341.c
    1714     @@ -241,13 +241,11 @@ out: kfree(buffer);
    1715     return r;
    1716     }
    1717    
    1718     -/* allocate private data */
    1719     -static int ch341_attach(struct usb_serial *serial)
    1720     +static int ch341_port_probe(struct usb_serial_port *port)
    1721     {
    1722     struct ch341_private *priv;
    1723     int r;
    1724    
    1725     - /* private data */
    1726     priv = kzalloc(sizeof(struct ch341_private), GFP_KERNEL);
    1727     if (!priv)
    1728     return -ENOMEM;
    1729     @@ -257,17 +255,27 @@ static int ch341_attach(struct usb_serial *serial)
    1730     priv->baud_rate = DEFAULT_BAUD_RATE;
    1731     priv->line_control = CH341_BIT_RTS | CH341_BIT_DTR;
    1732    
    1733     - r = ch341_configure(serial->dev, priv);
    1734     + r = ch341_configure(port->serial->dev, priv);
    1735     if (r < 0)
    1736     goto error;
    1737    
    1738     - usb_set_serial_port_data(serial->port[0], priv);
    1739     + usb_set_serial_port_data(port, priv);
    1740     return 0;
    1741    
    1742     error: kfree(priv);
    1743     return r;
    1744     }
    1745    
    1746     +static int ch341_port_remove(struct usb_serial_port *port)
    1747     +{
    1748     + struct ch341_private *priv;
    1749     +
    1750     + priv = usb_get_serial_port_data(port);
    1751     + kfree(priv);
    1752     +
    1753     + return 0;
    1754     +}
    1755     +
    1756     static int ch341_carrier_raised(struct usb_serial_port *port)
    1757     {
    1758     struct ch341_private *priv = usb_get_serial_port_data(port);
    1759     @@ -303,7 +311,7 @@ static void ch341_close(struct usb_serial_port *port)
    1760     static int ch341_open(struct tty_struct *tty, struct usb_serial_port *port)
    1761     {
    1762     struct usb_serial *serial = port->serial;
    1763     - struct ch341_private *priv = usb_get_serial_port_data(serial->port[0]);
    1764     + struct ch341_private *priv = usb_get_serial_port_data(port);
    1765     int r;
    1766    
    1767     priv->baud_rate = DEFAULT_BAUD_RATE;
    1768     @@ -606,7 +614,8 @@ static struct usb_serial_driver ch341_device = {
    1769     .tiocmget = ch341_tiocmget,
    1770     .tiocmset = ch341_tiocmset,
    1771     .read_int_callback = ch341_read_int_callback,
    1772     - .attach = ch341_attach,
    1773     + .port_probe = ch341_port_probe,
    1774     + .port_remove = ch341_port_remove,
    1775     .reset_resume = ch341_reset_resume,
    1776     };
    1777    
    1778     diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
    1779     index b5cd838..06e8bf4 100644
    1780     --- a/drivers/usb/serial/digi_acceleport.c
    1781     +++ b/drivers/usb/serial/digi_acceleport.c
    1782     @@ -244,6 +244,8 @@ static int digi_startup_device(struct usb_serial *serial);
    1783     static int digi_startup(struct usb_serial *serial);
    1784     static void digi_disconnect(struct usb_serial *serial);
    1785     static void digi_release(struct usb_serial *serial);
    1786     +static int digi_port_probe(struct usb_serial_port *port);
    1787     +static int digi_port_remove(struct usb_serial_port *port);
    1788     static void digi_read_bulk_callback(struct urb *urb);
    1789     static int digi_read_inb_callback(struct urb *urb);
    1790     static int digi_read_oob_callback(struct urb *urb);
    1791     @@ -298,6 +300,8 @@ static struct usb_serial_driver digi_acceleport_2_device = {
    1792     .attach = digi_startup,
    1793     .disconnect = digi_disconnect,
    1794     .release = digi_release,
    1795     + .port_probe = digi_port_probe,
    1796     + .port_remove = digi_port_remove,
    1797     };
    1798    
    1799     static struct usb_serial_driver digi_acceleport_4_device = {
    1800     @@ -324,6 +328,8 @@ static struct usb_serial_driver digi_acceleport_4_device = {
    1801     .attach = digi_startup,
    1802     .disconnect = digi_disconnect,
    1803     .release = digi_release,
    1804     + .port_probe = digi_port_probe,
    1805     + .port_remove = digi_port_remove,
    1806     };
    1807    
    1808     static struct usb_serial_driver * const serial_drivers[] = {
    1809     @@ -1237,59 +1243,50 @@ static int digi_startup_device(struct usb_serial *serial)
    1810     return ret;
    1811     }
    1812    
    1813     -
    1814     -static int digi_startup(struct usb_serial *serial)
    1815     +static int digi_port_init(struct usb_serial_port *port, unsigned port_num)
    1816     {
    1817     -
    1818     - int i;
    1819     struct digi_port *priv;
    1820     - struct digi_serial *serial_priv;
    1821    
    1822     - /* allocate the private data structures for all ports */
    1823     - /* number of regular ports + 1 for the out-of-band port */
    1824     - for (i = 0; i < serial->type->num_ports + 1; i++) {
    1825     - /* allocate port private structure */
    1826     - priv = kmalloc(sizeof(struct digi_port), GFP_KERNEL);
    1827     - if (priv == NULL) {
    1828     - while (--i >= 0)
    1829     - kfree(usb_get_serial_port_data(serial->port[i]));
    1830     - return 1; /* error */
    1831     - }
    1832     + priv = kzalloc(sizeof(*priv), GFP_KERNEL);
    1833     + if (!priv)
    1834     + return -ENOMEM;
    1835    
    1836     - /* initialize port private structure */
    1837     - spin_lock_init(&priv->dp_port_lock);
    1838     - priv->dp_port_num = i;
    1839     - priv->dp_out_buf_len = 0;
    1840     - priv->dp_write_urb_in_use = 0;
    1841     - priv->dp_modem_signals = 0;
    1842     - init_waitqueue_head(&priv->dp_modem_change_wait);
    1843     - priv->dp_transmit_idle = 0;
    1844     - init_waitqueue_head(&priv->dp_transmit_idle_wait);
    1845     - priv->dp_throttled = 0;
    1846     - priv->dp_throttle_restart = 0;
    1847     - init_waitqueue_head(&priv->dp_flush_wait);
    1848     - init_waitqueue_head(&priv->dp_close_wait);
    1849     - INIT_WORK(&priv->dp_wakeup_work, digi_wakeup_write_lock);
    1850     - priv->dp_port = serial->port[i];
    1851     - /* initialize write wait queue for this port */
    1852     - init_waitqueue_head(&serial->port[i]->write_wait);
    1853     -
    1854     - usb_set_serial_port_data(serial->port[i], priv);
    1855     - }
    1856     + spin_lock_init(&priv->dp_port_lock);
    1857     + priv->dp_port_num = port_num;
    1858     + init_waitqueue_head(&priv->dp_modem_change_wait);
    1859     + init_waitqueue_head(&priv->dp_transmit_idle_wait);
    1860     + init_waitqueue_head(&priv->dp_flush_wait);
    1861     + init_waitqueue_head(&priv->dp_close_wait);
    1862     + INIT_WORK(&priv->dp_wakeup_work, digi_wakeup_write_lock);
    1863     + priv->dp_port = port;
    1864    
    1865     - /* allocate serial private structure */
    1866     - serial_priv = kmalloc(sizeof(struct digi_serial), GFP_KERNEL);
    1867     - if (serial_priv == NULL) {
    1868     - for (i = 0; i < serial->type->num_ports + 1; i++)
    1869     - kfree(usb_get_serial_port_data(serial->port[i]));
    1870     - return 1; /* error */
    1871     - }
    1872     + init_waitqueue_head(&port->write_wait);
    1873     +
    1874     + usb_set_serial_port_data(port, priv);
    1875     +
    1876     + return 0;
    1877     +}
    1878     +
    1879     +static int digi_startup(struct usb_serial *serial)
    1880     +{
    1881     + struct digi_serial *serial_priv;
    1882     + int ret;
    1883     +
    1884     + serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL);
    1885     + if (!serial_priv)
    1886     + return -ENOMEM;
    1887    
    1888     - /* initialize serial private structure */
    1889     spin_lock_init(&serial_priv->ds_serial_lock);
    1890     serial_priv->ds_oob_port_num = serial->type->num_ports;
    1891     serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num];
    1892     - serial_priv->ds_device_started = 0;
    1893     +
    1894     + ret = digi_port_init(serial_priv->ds_oob_port,
    1895     + serial_priv->ds_oob_port_num);
    1896     + if (ret) {
    1897     + kfree(serial_priv);
    1898     + return ret;
    1899     + }
    1900     +
    1901     usb_set_serial_data(serial, serial_priv);
    1902    
    1903     return 0;
    1904     @@ -1310,15 +1307,35 @@ static void digi_disconnect(struct usb_serial *serial)
    1905    
    1906     static void digi_release(struct usb_serial *serial)
    1907     {
    1908     - int i;
    1909     + struct digi_serial *serial_priv;
    1910     + struct digi_port *priv;
    1911     +
    1912     + serial_priv = usb_get_serial_data(serial);
    1913     +
    1914     + priv = usb_get_serial_port_data(serial_priv->ds_oob_port);
    1915     + kfree(priv);
    1916    
    1917     - /* free the private data structures for all ports */
    1918     - /* number of regular ports + 1 for the out-of-band port */
    1919     - for (i = 0; i < serial->type->num_ports + 1; i++)
    1920     - kfree(usb_get_serial_port_data(serial->port[i]));
    1921     - kfree(usb_get_serial_data(serial));
    1922     + kfree(serial_priv);
    1923     }
    1924    
    1925     +static int digi_port_probe(struct usb_serial_port *port)
    1926     +{
    1927     + unsigned port_num;
    1928     +
    1929     + port_num = port->number - port->serial->minor;
    1930     +
    1931     + return digi_port_init(port, port_num);
    1932     +}
    1933     +
    1934     +static int digi_port_remove(struct usb_serial_port *port)
    1935     +{
    1936     + struct digi_port *priv;
    1937     +
    1938     + priv = usb_get_serial_port_data(port);
    1939     + kfree(priv);
    1940     +
    1941     + return 0;
    1942     +}
    1943    
    1944     static void digi_read_bulk_callback(struct urb *urb)
    1945     {
    1946     diff --git a/drivers/usb/serial/ipw.c b/drivers/usb/serial/ipw.c
    1947     index 2cb30c5..8df011f 100644
    1948     --- a/drivers/usb/serial/ipw.c
    1949     +++ b/drivers/usb/serial/ipw.c
    1950     @@ -209,8 +209,7 @@ static int ipw_open(struct tty_struct *tty, struct usb_serial_port *port)
    1951     return 0;
    1952     }
    1953    
    1954     -/* fake probe - only to allocate data structures */
    1955     -static int ipw_probe(struct usb_serial *serial, const struct usb_device_id *id)
    1956     +static int ipw_attach(struct usb_serial *serial)
    1957     {
    1958     struct usb_wwan_intf_private *data;
    1959    
    1960     @@ -310,9 +309,9 @@ static struct usb_serial_driver ipw_device = {
    1961     .num_ports = 1,
    1962     .open = ipw_open,
    1963     .close = ipw_close,
    1964     - .probe = ipw_probe,
    1965     - .attach = usb_wwan_startup,
    1966     + .attach = ipw_attach,
    1967     .release = ipw_release,
    1968     + .port_probe = usb_wwan_port_probe,
    1969     .port_remove = usb_wwan_port_remove,
    1970     .dtr_rts = ipw_dtr_rts,
    1971     .write = usb_wwan_write,
    1972     diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
    1973     index af0b70e..f6788d7 100644
    1974     --- a/drivers/usb/serial/keyspan.c
    1975     +++ b/drivers/usb/serial/keyspan.c
    1976     @@ -1392,13 +1392,9 @@ static struct callbacks {
    1977     data in device_details */
    1978     static void keyspan_setup_urbs(struct usb_serial *serial)
    1979     {
    1980     - int i, j;
    1981     struct keyspan_serial_private *s_priv;
    1982     const struct keyspan_device_details *d_details;
    1983     - struct usb_serial_port *port;
    1984     - struct keyspan_port_private *p_priv;
    1985     struct callbacks *cback;
    1986     - int endp;
    1987    
    1988     s_priv = usb_get_serial_data(serial);
    1989     d_details = s_priv->device_details;
    1990     @@ -1422,45 +1418,6 @@ static void keyspan_setup_urbs(struct usb_serial *serial)
    1991     (serial, d_details->glocont_endpoint, USB_DIR_OUT,
    1992     serial, s_priv->glocont_buf, GLOCONT_BUFLEN,
    1993     cback->glocont_callback);
    1994     -
    1995     - /* Setup endpoints for each port specific thing */
    1996     - for (i = 0; i < d_details->num_ports; i++) {
    1997     - port = serial->port[i];
    1998     - p_priv = usb_get_serial_port_data(port);
    1999     -
    2000     - /* Do indat endpoints first, once for each flip */
    2001     - endp = d_details->indat_endpoints[i];
    2002     - for (j = 0; j <= d_details->indat_endp_flip; ++j, ++endp) {
    2003     - p_priv->in_urbs[j] = keyspan_setup_urb
    2004     - (serial, endp, USB_DIR_IN, port,
    2005     - p_priv->in_buffer[j], 64,
    2006     - cback->indat_callback);
    2007     - }
    2008     - for (; j < 2; ++j)
    2009     - p_priv->in_urbs[j] = NULL;
    2010     -
    2011     - /* outdat endpoints also have flip */
    2012     - endp = d_details->outdat_endpoints[i];
    2013     - for (j = 0; j <= d_details->outdat_endp_flip; ++j, ++endp) {
    2014     - p_priv->out_urbs[j] = keyspan_setup_urb
    2015     - (serial, endp, USB_DIR_OUT, port,
    2016     - p_priv->out_buffer[j], 64,
    2017     - cback->outdat_callback);
    2018     - }
    2019     - for (; j < 2; ++j)
    2020     - p_priv->out_urbs[j] = NULL;
    2021     -
    2022     - /* inack endpoint */
    2023     - p_priv->inack_urb = keyspan_setup_urb
    2024     - (serial, d_details->inack_endpoints[i], USB_DIR_IN,
    2025     - port, p_priv->inack_buffer, 1, cback->inack_callback);
    2026     -
    2027     - /* outcont endpoint */
    2028     - p_priv->outcont_urb = keyspan_setup_urb
    2029     - (serial, d_details->outcont_endpoints[i], USB_DIR_OUT,
    2030     - port, p_priv->outcont_buffer, 64,
    2031     - cback->outcont_callback);
    2032     - }
    2033     }
    2034    
    2035     /* usa19 function doesn't require prescaler */
    2036     @@ -2422,9 +2379,7 @@ static void keyspan_send_setup(struct usb_serial_port *port, int reset_port)
    2037     static int keyspan_startup(struct usb_serial *serial)
    2038     {
    2039     int i, err;
    2040     - struct usb_serial_port *port;
    2041     struct keyspan_serial_private *s_priv;
    2042     - struct keyspan_port_private *p_priv;
    2043     const struct keyspan_device_details *d_details;
    2044    
    2045     for (i = 0; (d_details = keyspan_devices[i]) != NULL; ++i)
    2046     @@ -2448,19 +2403,6 @@ static int keyspan_startup(struct usb_serial *serial)
    2047     s_priv->device_details = d_details;
    2048     usb_set_serial_data(serial, s_priv);
    2049    
    2050     - /* Now setup per port private data */
    2051     - for (i = 0; i < serial->num_ports; i++) {
    2052     - port = serial->port[i];
    2053     - p_priv = kzalloc(sizeof(struct keyspan_port_private),
    2054     - GFP_KERNEL);
    2055     - if (!p_priv) {
    2056     - dbg("%s - kmalloc for keyspan_port_private (%d) failed!.", __func__, i);
    2057     - return 1;
    2058     - }
    2059     - p_priv->device_details = d_details;
    2060     - usb_set_serial_port_data(port, p_priv);
    2061     - }
    2062     -
    2063     keyspan_setup_urbs(serial);
    2064    
    2065     if (s_priv->instat_urb != NULL) {
    2066     @@ -2481,61 +2423,112 @@ static int keyspan_startup(struct usb_serial *serial)
    2067    
    2068     static void keyspan_disconnect(struct usb_serial *serial)
    2069     {
    2070     - int i, j;
    2071     - struct usb_serial_port *port;
    2072     - struct keyspan_serial_private *s_priv;
    2073     - struct keyspan_port_private *p_priv;
    2074     + struct keyspan_serial_private *s_priv;
    2075    
    2076     s_priv = usb_get_serial_data(serial);
    2077    
    2078     - /* Stop reading/writing urbs */
    2079     stop_urb(s_priv->instat_urb);
    2080     stop_urb(s_priv->glocont_urb);
    2081     stop_urb(s_priv->indat_urb);
    2082     - for (i = 0; i < serial->num_ports; ++i) {
    2083     - port = serial->port[i];
    2084     - p_priv = usb_get_serial_port_data(port);
    2085     - stop_urb(p_priv->inack_urb);
    2086     - stop_urb(p_priv->outcont_urb);
    2087     - for (j = 0; j < 2; j++) {
    2088     - stop_urb(p_priv->in_urbs[j]);
    2089     - stop_urb(p_priv->out_urbs[j]);
    2090     - }
    2091     - }
    2092     +}
    2093     +
    2094     +static void keyspan_release(struct usb_serial *serial)
    2095     +{
    2096     + struct keyspan_serial_private *s_priv;
    2097     +
    2098     + s_priv = usb_get_serial_data(serial);
    2099    
    2100     - /* Now free them */
    2101     usb_free_urb(s_priv->instat_urb);
    2102     usb_free_urb(s_priv->indat_urb);
    2103     usb_free_urb(s_priv->glocont_urb);
    2104     - for (i = 0; i < serial->num_ports; ++i) {
    2105     - port = serial->port[i];
    2106     - p_priv = usb_get_serial_port_data(port);
    2107     - usb_free_urb(p_priv->inack_urb);
    2108     - usb_free_urb(p_priv->outcont_urb);
    2109     - for (j = 0; j < 2; j++) {
    2110     - usb_free_urb(p_priv->in_urbs[j]);
    2111     - usb_free_urb(p_priv->out_urbs[j]);
    2112     - }
    2113     - }
    2114     +
    2115     + kfree(s_priv);
    2116     }
    2117    
    2118     -static void keyspan_release(struct usb_serial *serial)
    2119     +static int keyspan_port_probe(struct usb_serial_port *port)
    2120     {
    2121     - int i;
    2122     - struct usb_serial_port *port;
    2123     - struct keyspan_serial_private *s_priv;
    2124     + struct usb_serial *serial = port->serial;
    2125     + struct keyspan_port_private *s_priv;
    2126     + struct keyspan_port_private *p_priv;
    2127     + const struct keyspan_device_details *d_details;
    2128     + struct callbacks *cback;
    2129     + int endp;
    2130     + int port_num;
    2131     + int i;
    2132    
    2133     s_priv = usb_get_serial_data(serial);
    2134     + d_details = s_priv->device_details;
    2135    
    2136     - /* dbg("Freeing serial->private."); */
    2137     - kfree(s_priv);
    2138     + p_priv = kzalloc(sizeof(*p_priv), GFP_KERNEL);
    2139     + if (!p_priv)
    2140     + return -ENOMEM;
    2141    
    2142     - /* dbg("Freeing port->private."); */
    2143     - /* Now free per port private data */
    2144     - for (i = 0; i < serial->num_ports; i++) {
    2145     - port = serial->port[i];
    2146     - kfree(usb_get_serial_port_data(port));
    2147     + s_priv = usb_get_serial_data(port->serial);
    2148     + p_priv->device_details = d_details;
    2149     +
    2150     + /* Setup values for the various callback routines */
    2151     + cback = &keyspan_callbacks[d_details->msg_format];
    2152     +
    2153     + port_num = port->number - port->serial->minor;
    2154     +
    2155     + /* Do indat endpoints first, once for each flip */
    2156     + endp = d_details->indat_endpoints[port_num];
    2157     + for (i = 0; i <= d_details->indat_endp_flip; ++i, ++endp) {
    2158     + p_priv->in_urbs[i] = keyspan_setup_urb(serial, endp,
    2159     + USB_DIR_IN, port,
    2160     + p_priv->in_buffer[i], 64,
    2161     + cback->indat_callback);
    2162     + }
    2163     + /* outdat endpoints also have flip */
    2164     + endp = d_details->outdat_endpoints[port_num];
    2165     + for (i = 0; i <= d_details->outdat_endp_flip; ++i, ++endp) {
    2166     + p_priv->out_urbs[i] = keyspan_setup_urb(serial, endp,
    2167     + USB_DIR_OUT, port,
    2168     + p_priv->out_buffer[i], 64,
    2169     + cback->outdat_callback);
    2170     + }
    2171     + /* inack endpoint */
    2172     + p_priv->inack_urb = keyspan_setup_urb(serial,
    2173     + d_details->inack_endpoints[port_num],
    2174     + USB_DIR_IN, port,
    2175     + p_priv->inack_buffer, 1,
    2176     + cback->inack_callback);
    2177     + /* outcont endpoint */
    2178     + p_priv->outcont_urb = keyspan_setup_urb(serial,
    2179     + d_details->outcont_endpoints[port_num],
    2180     + USB_DIR_OUT, port,
    2181     + p_priv->outcont_buffer, 64,
    2182     + cback->outcont_callback);
    2183     +
    2184     + usb_set_serial_port_data(port, p_priv);
    2185     +
    2186     + return 0;
    2187     +}
    2188     +
    2189     +static int keyspan_port_remove(struct usb_serial_port *port)
    2190     +{
    2191     + struct keyspan_port_private *p_priv;
    2192     + int i;
    2193     +
    2194     + p_priv = usb_get_serial_port_data(port);
    2195     +
    2196     + stop_urb(p_priv->inack_urb);
    2197     + stop_urb(p_priv->outcont_urb);
    2198     + for (i = 0; i < 2; i++) {
    2199     + stop_urb(p_priv->in_urbs[i]);
    2200     + stop_urb(p_priv->out_urbs[i]);
    2201     + }
    2202     +
    2203     + usb_free_urb(p_priv->inack_urb);
    2204     + usb_free_urb(p_priv->outcont_urb);
    2205     + for (i = 0; i < 2; i++) {
    2206     + usb_free_urb(p_priv->in_urbs[i]);
    2207     + usb_free_urb(p_priv->out_urbs[i]);
    2208     }
    2209     +
    2210     + kfree(p_priv);
    2211     +
    2212     + return 0;
    2213     }
    2214    
    2215     MODULE_AUTHOR(DRIVER_AUTHOR);
    2216     diff --git a/drivers/usb/serial/keyspan.h b/drivers/usb/serial/keyspan.h
    2217     index fe1c5d9..90a7b36 100644
    2218     --- a/drivers/usb/serial/keyspan.h
    2219     +++ b/drivers/usb/serial/keyspan.h
    2220     @@ -42,6 +42,8 @@ static void keyspan_dtr_rts (struct usb_serial_port *port, int on);
    2221     static int keyspan_startup (struct usb_serial *serial);
    2222     static void keyspan_disconnect (struct usb_serial *serial);
    2223     static void keyspan_release (struct usb_serial *serial);
    2224     +static int keyspan_port_probe(struct usb_serial_port *port);
    2225     +static int keyspan_port_remove(struct usb_serial_port *port);
    2226     static int keyspan_write_room (struct tty_struct *tty);
    2227    
    2228     static int keyspan_write (struct tty_struct *tty,
    2229     @@ -562,6 +564,8 @@ static struct usb_serial_driver keyspan_1port_device = {
    2230     .attach = keyspan_startup,
    2231     .disconnect = keyspan_disconnect,
    2232     .release = keyspan_release,
    2233     + .port_probe = keyspan_port_probe,
    2234     + .port_remove = keyspan_port_remove,
    2235     };
    2236    
    2237     static struct usb_serial_driver keyspan_2port_device = {
    2238     @@ -584,6 +588,8 @@ static struct usb_serial_driver keyspan_2port_device = {
    2239     .attach = keyspan_startup,
    2240     .disconnect = keyspan_disconnect,
    2241     .release = keyspan_release,
    2242     + .port_probe = keyspan_port_probe,
    2243     + .port_remove = keyspan_port_remove,
    2244     };
    2245    
    2246     static struct usb_serial_driver keyspan_4port_device = {
    2247     @@ -606,6 +612,8 @@ static struct usb_serial_driver keyspan_4port_device = {
    2248     .attach = keyspan_startup,
    2249     .disconnect = keyspan_disconnect,
    2250     .release = keyspan_release,
    2251     + .port_probe = keyspan_port_probe,
    2252     + .port_remove = keyspan_port_remove,
    2253     };
    2254    
    2255     static struct usb_serial_driver * const serial_drivers[] = {
    2256     diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
    2257     index a71fa0a..c088250 100644
    2258     --- a/drivers/usb/serial/mct_u232.c
    2259     +++ b/drivers/usb/serial/mct_u232.c
    2260     @@ -51,7 +51,8 @@ static bool debug;
    2261     * Function prototypes
    2262     */
    2263     static int mct_u232_startup(struct usb_serial *serial);
    2264     -static void mct_u232_release(struct usb_serial *serial);
    2265     +static int mct_u232_port_probe(struct usb_serial_port *port);
    2266     +static int mct_u232_port_remove(struct usb_serial_port *remove);
    2267     static int mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port);
    2268     static void mct_u232_close(struct usb_serial_port *port);
    2269     static void mct_u232_dtr_rts(struct usb_serial_port *port, int on);
    2270     @@ -101,7 +102,8 @@ static struct usb_serial_driver mct_u232_device = {
    2271     .tiocmget = mct_u232_tiocmget,
    2272     .tiocmset = mct_u232_tiocmset,
    2273     .attach = mct_u232_startup,
    2274     - .release = mct_u232_release,
    2275     + .port_probe = mct_u232_port_probe,
    2276     + .port_remove = mct_u232_port_remove,
    2277     .ioctl = mct_u232_ioctl,
    2278     .get_icount = mct_u232_get_icount,
    2279     };
    2280     @@ -392,18 +394,8 @@ static void mct_u232_msr_to_state(unsigned int *control_state,
    2281    
    2282     static int mct_u232_startup(struct usb_serial *serial)
    2283     {
    2284     - struct mct_u232_private *priv;
    2285     struct usb_serial_port *port, *rport;
    2286    
    2287     - priv = kzalloc(sizeof(struct mct_u232_private), GFP_KERNEL);
    2288     - if (!priv)
    2289     - return -ENOMEM;
    2290     - spin_lock_init(&priv->lock);
    2291     - init_waitqueue_head(&priv->msr_wait);
    2292     - usb_set_serial_port_data(serial->port[0], priv);
    2293     -
    2294     - init_waitqueue_head(&serial->port[0]->write_wait);
    2295     -
    2296     /* Puh, that's dirty */
    2297     port = serial->port[0];
    2298     rport = serial->port[1];
    2299     @@ -416,18 +408,31 @@ static int mct_u232_startup(struct usb_serial *serial)
    2300     return 0;
    2301     } /* mct_u232_startup */
    2302    
    2303     +static int mct_u232_port_probe(struct usb_serial_port *port)
    2304     +{
    2305     + struct mct_u232_private *priv;
    2306     +
    2307     + priv = kzalloc(sizeof(*priv), GFP_KERNEL);
    2308     + if (!priv)
    2309     + return -ENOMEM;
    2310     +
    2311     + spin_lock_init(&priv->lock);
    2312     + init_waitqueue_head(&priv->msr_wait);
    2313     +
    2314     + usb_set_serial_port_data(port, priv);
    2315    
    2316     -static void mct_u232_release(struct usb_serial *serial)
    2317     + return 0;
    2318     +}
    2319     +
    2320     +static int mct_u232_port_remove(struct usb_serial_port *port)
    2321     {
    2322     struct mct_u232_private *priv;
    2323     - int i;
    2324    
    2325     - for (i = 0; i < serial->num_ports; ++i) {
    2326     - /* My special items, the standard routines free my urbs */
    2327     - priv = usb_get_serial_port_data(serial->port[i]);
    2328     - kfree(priv);
    2329     - }
    2330     -} /* mct_u232_release */
    2331     + priv = usb_get_serial_port_data(port);
    2332     + kfree(priv);
    2333     +
    2334     + return 0;
    2335     +}
    2336    
    2337     static int mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port)
    2338     {
    2339     @@ -519,12 +524,14 @@ static void mct_u232_dtr_rts(struct usb_serial_port *port, int on)
    2340    
    2341     static void mct_u232_close(struct usb_serial_port *port)
    2342     {
    2343     - if (port->serial->dev) {
    2344     - /* shutdown our urbs */
    2345     - usb_kill_urb(port->write_urb);
    2346     - usb_kill_urb(port->read_urb);
    2347     - usb_kill_urb(port->interrupt_in_urb);
    2348     - }
    2349     + /*
    2350     + * Must kill the read urb as it is actually an interrupt urb, which
    2351     + * generic close thus fails to kill.
    2352     + */
    2353     + usb_kill_urb(port->read_urb);
    2354     + usb_kill_urb(port->interrupt_in_urb);
    2355     +
    2356     + usb_serial_generic_close(port);
    2357     } /* mct_u232_close */
    2358    
    2359    
    2360     diff --git a/drivers/usb/serial/metro-usb.c b/drivers/usb/serial/metro-usb.c
    2361     index d47eb06..d284fb8 100644
    2362     --- a/drivers/usb/serial/metro-usb.c
    2363     +++ b/drivers/usb/serial/metro-usb.c
    2364     @@ -188,16 +188,13 @@ static void metrousb_cleanup(struct usb_serial_port *port)
    2365     {
    2366     dev_dbg(&port->dev, "%s\n", __func__);
    2367    
    2368     - if (port->serial->dev) {
    2369     - /* Shutdown any interrupt in urbs. */
    2370     - if (port->interrupt_in_urb) {
    2371     - usb_unlink_urb(port->interrupt_in_urb);
    2372     - usb_kill_urb(port->interrupt_in_urb);
    2373     - }
    2374     -
    2375     - /* Send deactivate cmd to device */
    2376     + usb_unlink_urb(port->interrupt_in_urb);
    2377     + usb_kill_urb(port->interrupt_in_urb);
    2378     +
    2379     + mutex_lock(&port->serial->disc_mutex);
    2380     + if (!port->serial->disconnected)
    2381     metrousb_send_unidirectional_cmd(UNI_CMD_CLOSE, port);
    2382     - }
    2383     + mutex_unlock(&port->serial->disc_mutex);
    2384     }
    2385    
    2386     static int metrousb_open(struct tty_struct *tty, struct usb_serial_port *port)
    2387     @@ -280,51 +277,27 @@ static int metrousb_set_modem_ctrl(struct usb_serial *serial, unsigned int contr
    2388     return retval;
    2389     }
    2390    
    2391     -static void metrousb_shutdown(struct usb_serial *serial)
    2392     +static int metrousb_port_probe(struct usb_serial_port *port)
    2393     {
    2394     - int i = 0;
    2395     + struct metrousb_private *metro_priv;
    2396    
    2397     - dev_dbg(&serial->dev->dev, "%s\n", __func__);
    2398     + metro_priv = kzalloc(sizeof(*metro_priv), GFP_KERNEL);
    2399     + if (!metro_priv)
    2400     + return -ENOMEM;
    2401    
    2402     - /* Stop reading and writing on all ports. */
    2403     - for (i = 0; i < serial->num_ports; ++i) {
    2404     - /* Close any open urbs. */
    2405     - metrousb_cleanup(serial->port[i]);
    2406     + spin_lock_init(&metro_priv->lock);
    2407    
    2408     - /* Free memory. */
    2409     - kfree(usb_get_serial_port_data(serial->port[i]));
    2410     - usb_set_serial_port_data(serial->port[i], NULL);
    2411     + usb_set_serial_port_data(port, metro_priv);
    2412    
    2413     - dev_dbg(&serial->dev->dev, "%s - freed port number=%d\n",
    2414     - __func__, serial->port[i]->number);
    2415     - }
    2416     + return 0;
    2417     }
    2418    
    2419     -static int metrousb_startup(struct usb_serial *serial)
    2420     +static int metrousb_port_remove(struct usb_serial_port *port)
    2421     {
    2422     struct metrousb_private *metro_priv;
    2423     - struct usb_serial_port *port;
    2424     - int i = 0;
    2425    
    2426     - dev_dbg(&serial->dev->dev, "%s\n", __func__);
    2427     -
    2428     - /* Loop through the serial ports setting up the private structures.
    2429     - * Currently we only use one port. */
    2430     - for (i = 0; i < serial->num_ports; ++i) {
    2431     - port = serial->port[i];
    2432     -
    2433     - /* Declare memory. */
    2434     - metro_priv = kzalloc(sizeof(struct metrousb_private), GFP_KERNEL);
    2435     - if (!metro_priv)
    2436     - return -ENOMEM;
    2437     -
    2438     - /* Initialize memory. */
    2439     - spin_lock_init(&metro_priv->lock);
    2440     - usb_set_serial_port_data(port, metro_priv);
    2441     -
    2442     - dev_dbg(&serial->dev->dev, "%s - port number=%d\n ",
    2443     - __func__, port->number);
    2444     - }
    2445     + metro_priv = usb_get_serial_port_data(port);
    2446     + kfree(metro_priv);
    2447    
    2448     return 0;
    2449     }
    2450     @@ -423,8 +396,8 @@ static struct usb_serial_driver metrousb_device = {
    2451     .close = metrousb_cleanup,
    2452     .read_int_callback = metrousb_read_int_callback,
    2453     .write_int_callback = metrousb_write_int_callback,
    2454     - .attach = metrousb_startup,
    2455     - .release = metrousb_shutdown,
    2456     + .port_probe = metrousb_port_probe,
    2457     + .port_remove = metrousb_port_remove,
    2458     .throttle = metrousb_throttle,
    2459     .unthrottle = metrousb_unthrottle,
    2460     .tiocmget = metrousb_tiocmget,
    2461     diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
    2462     index a07dd3c..eb84767 100644
    2463     --- a/drivers/usb/serial/mos7720.c
    2464     +++ b/drivers/usb/serial/mos7720.c
    2465     @@ -2023,9 +2023,7 @@ static int mos7720_ioctl(struct tty_struct *tty,
    2466    
    2467     static int mos7720_startup(struct usb_serial *serial)
    2468     {
    2469     - struct moschip_port *mos7720_port;
    2470     struct usb_device *dev;
    2471     - int i;
    2472     char data;
    2473     u16 product;
    2474     int ret_val;
    2475     @@ -2063,29 +2061,6 @@ static int mos7720_startup(struct usb_serial *serial)
    2476     serial->port[1]->interrupt_in_buffer = NULL;
    2477     }
    2478    
    2479     -
    2480     - /* set up serial port private structures */
    2481     - for (i = 0; i < serial->num_ports; ++i) {
    2482     - mos7720_port = kzalloc(sizeof(struct moschip_port), GFP_KERNEL);
    2483     - if (mos7720_port == NULL) {
    2484     - dev_err(&dev->dev, "%s - Out of memory\n", __func__);
    2485     - return -ENOMEM;
    2486     - }
    2487     -
    2488     - /* Initialize all port interrupt end point to port 0 int
    2489     - * endpoint. Our device has only one interrupt endpoint
    2490     - * common to all ports */
    2491     - serial->port[i]->interrupt_in_endpointAddress =
    2492     - serial->port[0]->interrupt_in_endpointAddress;
    2493     -
    2494     - mos7720_port->port = serial->port[i];
    2495     - usb_set_serial_port_data(serial->port[i], mos7720_port);
    2496     -
    2497     - dbg("port number is %d", serial->port[i]->number);
    2498     - dbg("serial number is %d", serial->minor);
    2499     - }
    2500     -
    2501     -
    2502     /* setting configuration feature to one */
    2503     usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
    2504     (__u8)0x03, 0x00, 0x01, 0x00, NULL, 0x00, 5*HZ);
    2505     @@ -2113,8 +2088,6 @@ static int mos7720_startup(struct usb_serial *serial)
    2506    
    2507     static void mos7720_release(struct usb_serial *serial)
    2508     {
    2509     - int i;
    2510     -
    2511     #ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT
    2512     /* close the parallel port */
    2513    
    2514     @@ -2153,9 +2126,36 @@ static void mos7720_release(struct usb_serial *serial)
    2515     kref_put(&mos_parport->ref_count, destroy_mos_parport);
    2516     }
    2517     #endif
    2518     - /* free private structure allocated for serial port */
    2519     - for (i = 0; i < serial->num_ports; ++i)
    2520     - kfree(usb_get_serial_port_data(serial->port[i]));
    2521     +}
    2522     +
    2523     +static int mos7720_port_probe(struct usb_serial_port *port)
    2524     +{
    2525     + struct moschip_port *mos7720_port;
    2526     +
    2527     + mos7720_port = kzalloc(sizeof(*mos7720_port), GFP_KERNEL);
    2528     + if (!mos7720_port)
    2529     + return -ENOMEM;
    2530     +
    2531     + /* Initialize all port interrupt end point to port 0 int endpoint.
    2532     + * Our device has only one interrupt endpoint common to all ports.
    2533     + */
    2534     + port->interrupt_in_endpointAddress =
    2535     + port->serial->port[0]->interrupt_in_endpointAddress;
    2536     + mos7720_port->port = port;
    2537     +
    2538     + usb_set_serial_port_data(port, mos7720_port);
    2539     +
    2540     + return 0;
    2541     +}
    2542     +
    2543     +static int mos7720_port_remove(struct usb_serial_port *port)
    2544     +{
    2545     + struct moschip_port *mos7720_port;
    2546     +
    2547     + mos7720_port = usb_get_serial_port_data(port);
    2548     + kfree(mos7720_port);
    2549     +
    2550     + return 0;
    2551     }
    2552    
    2553     static struct usb_serial_driver moschip7720_2port_driver = {
    2554     @@ -2173,6 +2173,8 @@ static struct usb_serial_driver moschip7720_2port_driver = {
    2555     .probe = mos77xx_probe,
    2556     .attach = mos7720_startup,
    2557     .release = mos7720_release,
    2558     + .port_probe = mos7720_port_probe,
    2559     + .port_remove = mos7720_port_remove,
    2560     .ioctl = mos7720_ioctl,
    2561     .tiocmget = mos7720_tiocmget,
    2562     .tiocmset = mos7720_tiocmset,
    2563     diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
    2564     index 2f6da1e..52e5ca7 100644
    2565     --- a/drivers/usb/serial/mos7840.c
    2566     +++ b/drivers/usb/serial/mos7840.c
    2567     @@ -218,12 +218,10 @@ struct moschip_port {
    2568     int port_num; /*Actual port number in the device(1,2,etc) */
    2569     struct urb *write_urb; /* write URB for this port */
    2570     struct urb *read_urb; /* read URB for this port */
    2571     - struct urb *int_urb;
    2572     __u8 shadowLCR; /* last LCR value received */
    2573     __u8 shadowMCR; /* last MCR value received */
    2574     char open;
    2575     char open_ports;
    2576     - char zombie;
    2577     wait_queue_head_t wait_chase; /* for handling sleeping while waiting for chase to finish */
    2578     wait_queue_head_t delta_msr_wait; /* for handling sleeping while waiting for msr change to happen */
    2579     int delta_msr_cond;
    2580     @@ -493,7 +491,6 @@ static void mos7840_control_callback(struct urb *urb)
    2581     unsigned char *data;
    2582     struct moschip_port *mos7840_port;
    2583     __u8 regval = 0x0;
    2584     - int result = 0;
    2585     int status = urb->status;
    2586    
    2587     mos7840_port = urb->context;
    2588     @@ -512,7 +509,7 @@ static void mos7840_control_callback(struct urb *urb)
    2589     default:
    2590     dbg("%s - nonzero urb status received: %d", __func__,
    2591     status);
    2592     - goto exit;
    2593     + return;
    2594     }
    2595    
    2596     dbg("%s urb buffer size is %d", __func__, urb->actual_length);
    2597     @@ -525,17 +522,6 @@ static void mos7840_control_callback(struct urb *urb)
    2598     mos7840_handle_new_msr(mos7840_port, regval);
    2599     else if (mos7840_port->MsrLsr == 1)
    2600     mos7840_handle_new_lsr(mos7840_port, regval);
    2601     -
    2602     -exit:
    2603     - spin_lock(&mos7840_port->pool_lock);
    2604     - if (!mos7840_port->zombie)
    2605     - result = usb_submit_urb(mos7840_port->int_urb, GFP_ATOMIC);
    2606     - spin_unlock(&mos7840_port->pool_lock);
    2607     - if (result) {
    2608     - dev_err(&urb->dev->dev,
    2609     - "%s - Error %d submitting interrupt urb\n",
    2610     - __func__, result);
    2611     - }
    2612     }
    2613    
    2614     static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
    2615     @@ -704,14 +690,7 @@ static void mos7840_interrupt_callback(struct urb *urb)
    2616     wreg = MODEM_STATUS_REGISTER;
    2617     break;
    2618     }
    2619     - spin_lock(&mos7840_port->pool_lock);
    2620     - if (!mos7840_port->zombie) {
    2621     - rv = mos7840_get_reg(mos7840_port, wval, wreg, &Data);
    2622     - } else {
    2623     - spin_unlock(&mos7840_port->pool_lock);
    2624     - return;
    2625     - }
    2626     - spin_unlock(&mos7840_port->pool_lock);
    2627     + rv = mos7840_get_reg(mos7840_port, wval, wreg, &Data);
    2628     }
    2629     }
    2630     }
    2631     @@ -2684,7 +2663,6 @@ error:
    2632     kfree(mos7840_port->ctrl_buf);
    2633     usb_free_urb(mos7840_port->control_urb);
    2634     kfree(mos7840_port);
    2635     - serial->port[i] = NULL;
    2636     }
    2637     return status;
    2638     }
    2639     @@ -2714,9 +2692,6 @@ static void mos7840_disconnect(struct usb_serial *serial)
    2640     mos7840_port = mos7840_get_port_private(serial->port[i]);
    2641     dbg ("mos7840_port %d = %p", i, mos7840_port);
    2642     if (mos7840_port) {
    2643     - spin_lock_irqsave(&mos7840_port->pool_lock, flags);
    2644     - mos7840_port->zombie = 1;
    2645     - spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
    2646     usb_kill_urb(mos7840_port->control_urb);
    2647     }
    2648     }
    2649     @@ -2754,6 +2729,7 @@ static void mos7840_release(struct usb_serial *serial)
    2650     del_timer_sync(&mos7840_port->led_timer1);
    2651     del_timer_sync(&mos7840_port->led_timer2);
    2652     }
    2653     + usb_free_urb(mos7840_port->control_urb);
    2654     kfree(mos7840_port->ctrl_buf);
    2655     kfree(mos7840_port->dr);
    2656     kfree(mos7840_port);
    2657     diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
    2658     index 6f3d705..27c9d06 100644
    2659     --- a/drivers/usb/serial/omninet.c
    2660     +++ b/drivers/usb/serial/omninet.c
    2661     @@ -46,8 +46,8 @@ static int omninet_write(struct tty_struct *tty, struct usb_serial_port *port,
    2662     const unsigned char *buf, int count);
    2663     static int omninet_write_room(struct tty_struct *tty);
    2664     static void omninet_disconnect(struct usb_serial *serial);
    2665     -static void omninet_release(struct usb_serial *serial);
    2666     -static int omninet_attach(struct usb_serial *serial);
    2667     +static int omninet_port_probe(struct usb_serial_port *port);
    2668     +static int omninet_port_remove(struct usb_serial_port *port);
    2669    
    2670     static const struct usb_device_id id_table[] = {
    2671     { USB_DEVICE(ZYXEL_VENDOR_ID, ZYXEL_OMNINET_ID) },
    2672     @@ -64,7 +64,8 @@ static struct usb_serial_driver zyxel_omninet_device = {
    2673     .description = "ZyXEL - omni.net lcd plus usb",
    2674     .id_table = id_table,
    2675     .num_ports = 1,
    2676     - .attach = omninet_attach,
    2677     + .port_probe = omninet_port_probe,
    2678     + .port_remove = omninet_port_remove,
    2679     .open = omninet_open,
    2680     .close = omninet_close,
    2681     .write = omninet_write,
    2682     @@ -72,7 +73,6 @@ static struct usb_serial_driver zyxel_omninet_device = {
    2683     .read_bulk_callback = omninet_read_bulk_callback,
    2684     .write_bulk_callback = omninet_write_bulk_callback,
    2685     .disconnect = omninet_disconnect,
    2686     - .release = omninet_release,
    2687     };
    2688    
    2689     static struct usb_serial_driver * const serial_drivers[] = {
    2690     @@ -114,18 +114,26 @@ struct omninet_data {
    2691     __u8 od_outseq; /* Sequence number for bulk_out URBs */
    2692     };
    2693    
    2694     -static int omninet_attach(struct usb_serial *serial)
    2695     +static int omninet_port_probe(struct usb_serial_port *port)
    2696     {
    2697     struct omninet_data *od;
    2698     - struct usb_serial_port *port = serial->port[0];
    2699    
    2700     od = kmalloc(sizeof(struct omninet_data), GFP_KERNEL);
    2701     - if (!od) {
    2702     - dev_err(&port->dev, "%s- kmalloc(%Zd) failed.\n",
    2703     - __func__, sizeof(struct omninet_data));
    2704     + if (!od)
    2705     return -ENOMEM;
    2706     - }
    2707     +
    2708     usb_set_serial_port_data(port, od);
    2709     +
    2710     + return 0;
    2711     +}
    2712     +
    2713     +static int omninet_port_remove(struct usb_serial_port *port)
    2714     +{
    2715     + struct omninet_data *od;
    2716     +
    2717     + od = usb_get_serial_port_data(port);
    2718     + kfree(od);
    2719     +
    2720     return 0;
    2721     }
    2722    
    2723     @@ -291,14 +299,6 @@ static void omninet_disconnect(struct usb_serial *serial)
    2724     usb_kill_urb(wport->write_urb);
    2725     }
    2726    
    2727     -
    2728     -static void omninet_release(struct usb_serial *serial)
    2729     -{
    2730     - struct usb_serial_port *port = serial->port[0];
    2731     -
    2732     - kfree(usb_get_serial_port_data(port));
    2733     -}
    2734     -
    2735     module_usb_serial_driver(serial_drivers, id_table);
    2736    
    2737     MODULE_AUTHOR(DRIVER_AUTHOR);
    2738     diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
    2739     index 02cb1b7..623358a 100644
    2740     --- a/drivers/usb/serial/opticon.c
    2741     +++ b/drivers/usb/serial/opticon.c
    2742     @@ -158,7 +158,11 @@ static int send_control_msg(struct usb_serial_port *port, u8 requesttype,
    2743     {
    2744     struct usb_serial *serial = port->serial;
    2745     int retval;
    2746     - u8 buffer[2];
    2747     + u8 *buffer;
    2748     +
    2749     + buffer = kzalloc(1, GFP_KERNEL);
    2750     + if (!buffer)
    2751     + return -ENOMEM;
    2752    
    2753     buffer[0] = val;
    2754     /* Send the message to the vendor control endpoint
    2755     @@ -167,6 +171,7 @@ static int send_control_msg(struct usb_serial_port *port, u8 requesttype,
    2756     requesttype,
    2757     USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE,
    2758     0, 0, buffer, 1, 0);
    2759     + kfree(buffer);
    2760    
    2761     return retval;
    2762     }
    2763     @@ -284,7 +289,7 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port,
    2764     if (!dr) {
    2765     dev_err(&port->dev, "out of memory\n");
    2766     count = -ENOMEM;
    2767     - goto error;
    2768     + goto error_no_dr;
    2769     }
    2770    
    2771     dr->bRequestType = USB_TYPE_VENDOR | USB_RECIP_INTERFACE | USB_DIR_OUT;
    2772     @@ -314,6 +319,8 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port,
    2773    
    2774     return count;
    2775     error:
    2776     + kfree(dr);
    2777     +error_no_dr:
    2778     usb_free_urb(urb);
    2779     error_no_urb:
    2780     kfree(buffer);
    2781     diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    2782     index a0542ca..76a48e4 100644
    2783     --- a/drivers/usb/serial/option.c
    2784     +++ b/drivers/usb/serial/option.c
    2785     @@ -47,6 +47,7 @@
    2786     /* Function prototypes */
    2787     static int option_probe(struct usb_serial *serial,
    2788     const struct usb_device_id *id);
    2789     +static int option_attach(struct usb_serial *serial);
    2790     static void option_release(struct usb_serial *serial);
    2791     static int option_send_setup(struct usb_serial_port *port);
    2792     static void option_instat_callback(struct urb *urb);
    2793     @@ -1288,8 +1289,9 @@ static struct usb_serial_driver option_1port_device = {
    2794     .tiocmget = usb_wwan_tiocmget,
    2795     .tiocmset = usb_wwan_tiocmset,
    2796     .ioctl = usb_wwan_ioctl,
    2797     - .attach = usb_wwan_startup,
    2798     + .attach = option_attach,
    2799     .release = option_release,
    2800     + .port_probe = usb_wwan_port_probe,
    2801     .port_remove = usb_wwan_port_remove,
    2802     .read_int_callback = option_instat_callback,
    2803     #ifdef CONFIG_PM
    2804     @@ -1337,8 +1339,6 @@ static bool is_blacklisted(const u8 ifnum, enum option_blacklist_reason reason,
    2805     static int option_probe(struct usb_serial *serial,
    2806     const struct usb_device_id *id)
    2807     {
    2808     - struct usb_wwan_intf_private *data;
    2809     - struct option_private *priv;
    2810     struct usb_interface_descriptor *iface_desc =
    2811     &serial->interface->cur_altsetting->desc;
    2812     struct usb_device_descriptor *dev_desc = &serial->dev->descriptor;
    2813     @@ -1376,6 +1376,19 @@ static int option_probe(struct usb_serial *serial,
    2814     iface_desc->bInterfaceClass != USB_CLASS_CDC_DATA)
    2815     return -ENODEV;
    2816    
    2817     + /* Store device id so we can use it during attach. */
    2818     + usb_set_serial_data(serial, (void *)id);
    2819     +
    2820     + return 0;
    2821     +}
    2822     +
    2823     +static int option_attach(struct usb_serial *serial)
    2824     +{
    2825     + struct usb_interface_descriptor *iface_desc;
    2826     + const struct usb_device_id *id;
    2827     + struct usb_wwan_intf_private *data;
    2828     + struct option_private *priv;
    2829     +
    2830     data = kzalloc(sizeof(struct usb_wwan_intf_private), GFP_KERNEL);
    2831     if (!data)
    2832     return -ENOMEM;
    2833     @@ -1386,6 +1399,10 @@ static int option_probe(struct usb_serial *serial,
    2834     return -ENOMEM;
    2835     }
    2836    
    2837     + /* Retrieve device id stored at probe. */
    2838     + id = usb_get_serial_data(serial);
    2839     + iface_desc = &serial->interface->cur_altsetting->desc;
    2840     +
    2841     priv->bInterfaceNumber = iface_desc->bInterfaceNumber;
    2842     data->private = priv;
    2843    
    2844     diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
    2845     index bfd5077..93232ca 100644
    2846     --- a/drivers/usb/serial/qcserial.c
    2847     +++ b/drivers/usb/serial/qcserial.c
    2848     @@ -140,7 +140,6 @@ MODULE_DEVICE_TABLE(usb, id_table);
    2849    
    2850     static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
    2851     {
    2852     - struct usb_wwan_intf_private *data;
    2853     struct usb_host_interface *intf = serial->interface->cur_altsetting;
    2854     struct device *dev = &serial->dev->dev;
    2855     int retval = -ENODEV;
    2856     @@ -156,13 +155,6 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
    2857     ifnum = intf->desc.bInterfaceNumber;
    2858     dev_dbg(dev, "This Interface = %d\n", ifnum);
    2859    
    2860     - data = kzalloc(sizeof(struct usb_wwan_intf_private),
    2861     - GFP_KERNEL);
    2862     - if (!data)
    2863     - return -ENOMEM;
    2864     -
    2865     - spin_lock_init(&data->susp_lock);
    2866     -
    2867     if (nintf == 1) {
    2868     /* QDL mode */
    2869     /* Gobi 2000 has a single altsetting, older ones have two */
    2870     @@ -255,20 +247,28 @@ done:
    2871     }
    2872     }
    2873    
    2874     - /* Set serial->private if not returning error */
    2875     - if (retval == 0)
    2876     - usb_set_serial_data(serial, data);
    2877     - else
    2878     - kfree(data);
    2879     -
    2880     return retval;
    2881     }
    2882    
    2883     +static int qc_attach(struct usb_serial *serial)
    2884     +{
    2885     + struct usb_wwan_intf_private *data;
    2886     +
    2887     + data = kzalloc(sizeof(*data), GFP_KERNEL);
    2888     + if (!data)
    2889     + return -ENOMEM;
    2890     +
    2891     + spin_lock_init(&data->susp_lock);
    2892     +
    2893     + usb_set_serial_data(serial, data);
    2894     +
    2895     + return 0;
    2896     +}
    2897     +
    2898     static void qc_release(struct usb_serial *serial)
    2899     {
    2900     struct usb_wwan_intf_private *priv = usb_get_serial_data(serial);
    2901    
    2902     - /* Free the private data allocated in qcprobe */
    2903     usb_set_serial_data(serial, NULL);
    2904     kfree(priv);
    2905     }
    2906     @@ -287,8 +287,9 @@ static struct usb_serial_driver qcdevice = {
    2907     .write = usb_wwan_write,
    2908     .write_room = usb_wwan_write_room,
    2909     .chars_in_buffer = usb_wwan_chars_in_buffer,
    2910     - .attach = usb_wwan_startup,
    2911     + .attach = qc_attach,
    2912     .release = qc_release,
    2913     + .port_probe = usb_wwan_port_probe,
    2914     .port_remove = usb_wwan_port_remove,
    2915     #ifdef CONFIG_PM
    2916     .suspend = usb_wwan_suspend,
    2917     diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c
    2918     index 151670b..ea69301 100644
    2919     --- a/drivers/usb/serial/quatech2.c
    2920     +++ b/drivers/usb/serial/quatech2.c
    2921     @@ -145,12 +145,12 @@ static void qt2_read_bulk_callback(struct urb *urb);
    2922    
    2923     static void qt2_release(struct usb_serial *serial)
    2924     {
    2925     - int i;
    2926     + struct qt2_serial_private *serial_priv;
    2927    
    2928     - kfree(usb_get_serial_data(serial));
    2929     + serial_priv = usb_get_serial_data(serial);
    2930    
    2931     - for (i = 0; i < serial->num_ports; i++)
    2932     - kfree(usb_get_serial_port_data(serial->port[i]));
    2933     + usb_free_urb(serial_priv->read_urb);
    2934     + kfree(serial_priv);
    2935     }
    2936    
    2937     static inline int calc_baud_divisor(int baudrate)
    2938     @@ -425,11 +425,16 @@ static void qt2_close(struct usb_serial_port *port)
    2939     port_priv->is_open = false;
    2940    
    2941     spin_lock_irqsave(&port_priv->urb_lock, flags);
    2942     - if (port_priv->write_urb->status == -EINPROGRESS)
    2943     - usb_kill_urb(port_priv->write_urb);
    2944     + usb_kill_urb(port_priv->write_urb);
    2945     port_priv->urb_in_use = false;
    2946     spin_unlock_irqrestore(&port_priv->urb_lock, flags);
    2947    
    2948     + mutex_lock(&port->serial->disc_mutex);
    2949     + if (port->serial->disconnected) {
    2950     + mutex_unlock(&port->serial->disc_mutex);
    2951     + return;
    2952     + }
    2953     +
    2954     /* flush the port transmit buffer */
    2955     i = usb_control_msg(serial->dev,
    2956     usb_rcvctrlpipe(serial->dev, 0),
    2957     @@ -461,26 +466,14 @@ static void qt2_close(struct usb_serial_port *port)
    2958     dev_err(&port->dev, "%s - close port failed %i\n",
    2959     __func__, i);
    2960    
    2961     + mutex_unlock(&port->serial->disc_mutex);
    2962     }
    2963    
    2964     static void qt2_disconnect(struct usb_serial *serial)
    2965     {
    2966     struct qt2_serial_private *serial_priv = usb_get_serial_data(serial);
    2967     - struct qt2_port_private *port_priv;
    2968     - int i;
    2969     -
    2970     - if (serial_priv->read_urb->status == -EINPROGRESS)
    2971     - usb_kill_urb(serial_priv->read_urb);
    2972     -
    2973     - usb_free_urb(serial_priv->read_urb);
    2974    
    2975     - for (i = 0; i < serial->num_ports; i++) {
    2976     - port_priv = usb_get_serial_port_data(serial->port[i]);
    2977     -
    2978     - if (port_priv->write_urb->status == -EINPROGRESS)
    2979     - usb_kill_urb(port_priv->write_urb);
    2980     - usb_free_urb(port_priv->write_urb);
    2981     - }
    2982     + usb_kill_urb(serial_priv->read_urb);
    2983     }
    2984    
    2985     static int get_serial_info(struct usb_serial_port *port,
    2986     @@ -775,11 +768,9 @@ static void qt2_read_bulk_callback(struct urb *urb)
    2987    
    2988     static int qt2_setup_urbs(struct usb_serial *serial)
    2989     {
    2990     - struct usb_serial_port *port;
    2991     struct usb_serial_port *port0;
    2992     struct qt2_serial_private *serial_priv;
    2993     - struct qt2_port_private *port_priv;
    2994     - int pcount, status;
    2995     + int status;
    2996    
    2997     port0 = serial->port[0];
    2998    
    2999     @@ -797,46 +788,21 @@ static int qt2_setup_urbs(struct usb_serial *serial)
    3000     sizeof(serial_priv->read_buffer),
    3001     qt2_read_bulk_callback, serial);
    3002    
    3003     - /* setup write_urb for each port */
    3004     - for (pcount = 0; pcount < serial->num_ports; pcount++) {
    3005     -
    3006     - port = serial->port[pcount];
    3007     - port_priv = usb_get_serial_port_data(port);
    3008     -
    3009     - port_priv->write_urb = usb_alloc_urb(0, GFP_KERNEL);
    3010     - if (!port_priv->write_urb) {
    3011     - dev_err(&serial->dev->dev,
    3012     - "failed to alloc write_urb for port %i\n",
    3013     - pcount);
    3014     - return -ENOMEM;
    3015     - }
    3016     -
    3017     - usb_fill_bulk_urb(port_priv->write_urb,
    3018     - serial->dev,
    3019     - usb_sndbulkpipe(serial->dev,
    3020     - port0->
    3021     - bulk_out_endpointAddress),
    3022     - port_priv->write_buffer,
    3023     - sizeof(port_priv->write_buffer),
    3024     - qt2_write_bulk_callback, port);
    3025     - }
    3026     -
    3027     status = usb_submit_urb(serial_priv->read_urb, GFP_KERNEL);
    3028     if (status != 0) {
    3029     dev_err(&serial->dev->dev,
    3030     "%s - submit read urb failed %i\n", __func__, status);
    3031     + usb_free_urb(serial_priv->read_urb);
    3032     return status;
    3033     }
    3034    
    3035     return 0;
    3036     -
    3037     }
    3038    
    3039     static int qt2_attach(struct usb_serial *serial)
    3040     {
    3041     struct qt2_serial_private *serial_priv;
    3042     - struct qt2_port_private *port_priv;
    3043     - int status, pcount;
    3044     + int status;
    3045    
    3046     /* power on unit */
    3047     status = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
    3048     @@ -856,26 +822,6 @@ static int qt2_attach(struct usb_serial *serial)
    3049    
    3050     usb_set_serial_data(serial, serial_priv);
    3051    
    3052     - for (pcount = 0; pcount < serial->num_ports; pcount++) {
    3053     - port_priv = kzalloc(sizeof(*port_priv), GFP_KERNEL);
    3054     - if (!port_priv) {
    3055     - dev_err(&serial->dev->dev,
    3056     - "%s- kmalloc(%Zd) failed.\n", __func__,
    3057     - sizeof(*port_priv));
    3058     - pcount--;
    3059     - status = -ENOMEM;
    3060     - goto attach_failed;
    3061     - }
    3062     -
    3063     - spin_lock_init(&port_priv->lock);
    3064     - spin_lock_init(&port_priv->urb_lock);
    3065     - init_waitqueue_head(&port_priv->delta_msr_wait);
    3066     -
    3067     - port_priv->port = serial->port[pcount];
    3068     -
    3069     - usb_set_serial_port_data(serial->port[pcount], port_priv);
    3070     - }
    3071     -
    3072     status = qt2_setup_urbs(serial);
    3073     if (status != 0)
    3074     goto attach_failed;
    3075     @@ -883,14 +829,53 @@ static int qt2_attach(struct usb_serial *serial)
    3076     return 0;
    3077    
    3078     attach_failed:
    3079     - for (/* empty */; pcount >= 0; pcount--) {
    3080     - port_priv = usb_get_serial_port_data(serial->port[pcount]);
    3081     - kfree(port_priv);
    3082     - }
    3083     kfree(serial_priv);
    3084     return status;
    3085     }
    3086    
    3087     +static int qt2_port_probe(struct usb_serial_port *port)
    3088     +{
    3089     + struct usb_serial *serial = port->serial;
    3090     + struct qt2_port_private *port_priv;
    3091     + u8 bEndpointAddress;
    3092     +
    3093     + port_priv = kzalloc(sizeof(*port_priv), GFP_KERNEL);
    3094     + if (!port_priv)
    3095     + return -ENOMEM;
    3096     +
    3097     + spin_lock_init(&port_priv->lock);
    3098     + spin_lock_init(&port_priv->urb_lock);
    3099     + init_waitqueue_head(&port_priv->delta_msr_wait);
    3100     + port_priv->port = port;
    3101     +
    3102     + port_priv->write_urb = usb_alloc_urb(0, GFP_KERNEL);
    3103     + if (!port_priv->write_urb) {
    3104     + kfree(port_priv);
    3105     + return -ENOMEM;
    3106     + }
    3107     + bEndpointAddress = serial->port[0]->bulk_out_endpointAddress;
    3108     + usb_fill_bulk_urb(port_priv->write_urb, serial->dev,
    3109     + usb_sndbulkpipe(serial->dev, bEndpointAddress),
    3110     + port_priv->write_buffer,
    3111     + sizeof(port_priv->write_buffer),
    3112     + qt2_write_bulk_callback, port);
    3113     +
    3114     + usb_set_serial_port_data(port, port_priv);
    3115     +
    3116     + return 0;
    3117     +}
    3118     +
    3119     +static int qt2_port_remove(struct usb_serial_port *port)
    3120     +{
    3121     + struct qt2_port_private *port_priv;
    3122     +
    3123     + port_priv = usb_get_serial_port_data(port);
    3124     + usb_free_urb(port_priv->write_urb);
    3125     + kfree(port_priv);
    3126     +
    3127     + return 0;
    3128     +}
    3129     +
    3130     static int qt2_tiocmget(struct tty_struct *tty)
    3131     {
    3132     struct usb_serial_port *port = tty->driver_data;
    3133     @@ -1129,6 +1114,8 @@ static struct usb_serial_driver qt2_device = {
    3134     .attach = qt2_attach,
    3135     .release = qt2_release,
    3136     .disconnect = qt2_disconnect,
    3137     + .port_probe = qt2_port_probe,
    3138     + .port_remove = qt2_port_remove,
    3139     .dtr_rts = qt2_dtr_rts,
    3140     .break_ctl = qt2_break_ctl,
    3141     .tiocmget = qt2_tiocmget,
    3142     diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
    3143     index 0274710..cf6d149 100644
    3144     --- a/drivers/usb/serial/sierra.c
    3145     +++ b/drivers/usb/serial/sierra.c
    3146     @@ -162,7 +162,6 @@ static int sierra_probe(struct usb_serial *serial,
    3147     {
    3148     int result = 0;
    3149     struct usb_device *udev;
    3150     - struct sierra_intf_private *data;
    3151     u8 ifnum;
    3152    
    3153     udev = serial->dev;
    3154     @@ -189,11 +188,6 @@ static int sierra_probe(struct usb_serial *serial,
    3155     return -ENODEV;
    3156     }
    3157    
    3158     - data = serial->private = kzalloc(sizeof(struct sierra_intf_private), GFP_KERNEL);
    3159     - if (!data)
    3160     - return -ENOMEM;
    3161     - spin_lock_init(&data->susp_lock);
    3162     -
    3163     return result;
    3164     }
    3165    
    3166     @@ -886,11 +880,15 @@ static void sierra_dtr_rts(struct usb_serial_port *port, int on)
    3167    
    3168     static int sierra_startup(struct usb_serial *serial)
    3169     {
    3170     - struct usb_serial_port *port;
    3171     - struct sierra_port_private *portdata;
    3172     - struct sierra_iface_info *himemoryp = NULL;
    3173     - int i;
    3174     - u8 ifnum;
    3175     + struct sierra_intf_private *intfdata;
    3176     +
    3177     + intfdata = kzalloc(sizeof(*intfdata), GFP_KERNEL);
    3178     + if (!intfdata)
    3179     + return -ENOMEM;
    3180     +
    3181     + spin_lock_init(&intfdata->susp_lock);
    3182     +
    3183     + usb_set_serial_data(serial, intfdata);
    3184    
    3185     /* Set Device mode to D0 */
    3186     sierra_set_power_state(serial->dev, 0x0000);
    3187     @@ -899,68 +897,71 @@ static int sierra_startup(struct usb_serial *serial)
    3188     if (nmea)
    3189     sierra_vsc_set_nmea(serial->dev, 1);
    3190    
    3191     - /* Now setup per port private data */
    3192     - for (i = 0; i < serial->num_ports; i++) {
    3193     - port = serial->port[i];
    3194     - portdata = kzalloc(sizeof(*portdata), GFP_KERNEL);
    3195     - if (!portdata) {
    3196     - dev_dbg(&port->dev, "%s: kmalloc for "
    3197     - "sierra_port_private (%d) failed!\n",
    3198     - __func__, i);
    3199     - return -ENOMEM;
    3200     - }
    3201     - spin_lock_init(&portdata->lock);
    3202     - init_usb_anchor(&portdata->active);
    3203     - init_usb_anchor(&portdata->delayed);
    3204     - ifnum = i;
    3205     - /* Assume low memory requirements */
    3206     - portdata->num_out_urbs = N_OUT_URB;
    3207     - portdata->num_in_urbs = N_IN_URB;
    3208     -
    3209     - /* Determine actual memory requirements */
    3210     - if (serial->num_ports == 1) {
    3211     - /* Get interface number for composite device */
    3212     - ifnum = sierra_calc_interface(serial);
    3213     - himemoryp =
    3214     - (struct sierra_iface_info *)&typeB_interface_list;
    3215     - if (is_himemory(ifnum, himemoryp)) {
    3216     - portdata->num_out_urbs = N_OUT_URB_HM;
    3217     - portdata->num_in_urbs = N_IN_URB_HM;
    3218     - }
    3219     - }
    3220     - else {
    3221     - himemoryp =
    3222     - (struct sierra_iface_info *)&typeA_interface_list;
    3223     - if (is_himemory(i, himemoryp)) {
    3224     - portdata->num_out_urbs = N_OUT_URB_HM;
    3225     - portdata->num_in_urbs = N_IN_URB_HM;
    3226     - }
    3227     - }
    3228     - dev_dbg(&serial->dev->dev,
    3229     - "Memory usage (urbs) interface #%d, in=%d, out=%d\n",
    3230     - ifnum,portdata->num_in_urbs, portdata->num_out_urbs );
    3231     - /* Set the port private data pointer */
    3232     - usb_set_serial_port_data(port, portdata);
    3233     - }
    3234     -
    3235     return 0;
    3236     }
    3237    
    3238     static void sierra_release(struct usb_serial *serial)
    3239     {
    3240     - int i;
    3241     - struct usb_serial_port *port;
    3242     + struct sierra_intf_private *intfdata;
    3243     +
    3244     + intfdata = usb_get_serial_data(serial);
    3245     + kfree(intfdata);
    3246     +}
    3247     +
    3248     +static int sierra_port_probe(struct usb_serial_port *port)
    3249     +{
    3250     + struct usb_serial *serial = port->serial;
    3251     struct sierra_port_private *portdata;
    3252     + const struct sierra_iface_info *himemoryp;
    3253     + u8 ifnum;
    3254    
    3255     - for (i = 0; i < serial->num_ports; ++i) {
    3256     - port = serial->port[i];
    3257     - if (!port)
    3258     - continue;
    3259     - portdata = usb_get_serial_port_data(port);
    3260     - if (!portdata)
    3261     - continue;
    3262     - kfree(portdata);
    3263     + portdata = kzalloc(sizeof(*portdata), GFP_KERNEL);
    3264     + if (!portdata)
    3265     + return -ENOMEM;
    3266     +
    3267     + spin_lock_init(&portdata->lock);
    3268     + init_usb_anchor(&portdata->active);
    3269     + init_usb_anchor(&portdata->delayed);
    3270     +
    3271     + /* Assume low memory requirements */
    3272     + portdata->num_out_urbs = N_OUT_URB;
    3273     + portdata->num_in_urbs = N_IN_URB;
    3274     +
    3275     + /* Determine actual memory requirements */
    3276     + if (serial->num_ports == 1) {
    3277     + /* Get interface number for composite device */
    3278     + ifnum = sierra_calc_interface(serial);
    3279     + himemoryp = &typeB_interface_list;
    3280     + } else {
    3281     + /* This is really the usb-serial port number of the interface
    3282     + * rather than the interface number.
    3283     + */
    3284     + ifnum = port->number - serial->minor;
    3285     + himemoryp = &typeA_interface_list;
    3286     }
    3287     +
    3288     + if (is_himemory(ifnum, himemoryp)) {
    3289     + portdata->num_out_urbs = N_OUT_URB_HM;
    3290     + portdata->num_in_urbs = N_IN_URB_HM;
    3291     + }
    3292     +
    3293     + dev_dbg(&port->dev,
    3294     + "Memory usage (urbs) interface #%d, in=%d, out=%d\n",
    3295     + ifnum, portdata->num_in_urbs, portdata->num_out_urbs);
    3296     +
    3297     + usb_set_serial_port_data(port, portdata);
    3298     +
    3299     + return 0;
    3300     +}
    3301     +
    3302     +static int sierra_port_remove(struct usb_serial_port *port)
    3303     +{
    3304     + struct sierra_port_private *portdata;
    3305     +
    3306     + portdata = usb_get_serial_port_data(port);
    3307     + kfree(portdata);
    3308     +
    3309     + return 0;
    3310     }
    3311    
    3312     #ifdef CONFIG_PM
    3313     @@ -1064,6 +1065,8 @@ static struct usb_serial_driver sierra_device = {
    3314     .tiocmset = sierra_tiocmset,
    3315     .attach = sierra_startup,
    3316     .release = sierra_release,
    3317     + .port_probe = sierra_port_probe,
    3318     + .port_remove = sierra_port_remove,
    3319     .suspend = sierra_suspend,
    3320     .resume = sierra_resume,
    3321     .read_int_callback = sierra_instat_callback,
    3322     diff --git a/drivers/usb/serial/usb-wwan.h b/drivers/usb/serial/usb-wwan.h
    3323     index 1f034d2..684739b 100644
    3324     --- a/drivers/usb/serial/usb-wwan.h
    3325     +++ b/drivers/usb/serial/usb-wwan.h
    3326     @@ -8,7 +8,7 @@
    3327     extern void usb_wwan_dtr_rts(struct usb_serial_port *port, int on);
    3328     extern int usb_wwan_open(struct tty_struct *tty, struct usb_serial_port *port);
    3329     extern void usb_wwan_close(struct usb_serial_port *port);
    3330     -extern int usb_wwan_startup(struct usb_serial *serial);
    3331     +extern int usb_wwan_port_probe(struct usb_serial_port *port);
    3332     extern int usb_wwan_port_remove(struct usb_serial_port *port);
    3333     extern int usb_wwan_write_room(struct tty_struct *tty);
    3334     extern void usb_wwan_set_termios(struct tty_struct *tty,
    3335     diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
    3336     index 6855d5e..2f2d074 100644
    3337     --- a/drivers/usb/serial/usb_wwan.c
    3338     +++ b/drivers/usb/serial/usb_wwan.c
    3339     @@ -447,10 +447,12 @@ void usb_wwan_close(struct usb_serial_port *port)
    3340     EXPORT_SYMBOL(usb_wwan_close);
    3341    
    3342     /* Helper functions used by usb_wwan_setup_urbs */
    3343     -static struct urb *usb_wwan_setup_urb(struct usb_serial *serial, int endpoint,
    3344     +static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port,
    3345     + int endpoint,
    3346     int dir, void *ctx, char *buf, int len,
    3347     void (*callback) (struct urb *))
    3348     {
    3349     + struct usb_serial *serial = port->serial;
    3350     struct urb *urb;
    3351    
    3352     if (endpoint == -1)
    3353     @@ -470,100 +472,74 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial *serial, int endpoint,
    3354     return urb;
    3355     }
    3356    
    3357     -/* Setup urbs */
    3358     -static void usb_wwan_setup_urbs(struct usb_serial *serial)
    3359     +int usb_wwan_port_probe(struct usb_serial_port *port)
    3360     {
    3361     - int i, j;
    3362     - struct usb_serial_port *port;
    3363     struct usb_wwan_port_private *portdata;
    3364     + struct urb *urb;
    3365     + u8 *buffer;
    3366     + int err;
    3367     + int i;
    3368    
    3369     - for (i = 0; i < serial->num_ports; i++) {
    3370     - port = serial->port[i];
    3371     - portdata = usb_get_serial_port_data(port);
    3372     -
    3373     - /* Do indat endpoints first */
    3374     - for (j = 0; j < N_IN_URB; ++j) {
    3375     - portdata->in_urbs[j] = usb_wwan_setup_urb(serial,
    3376     - port->
    3377     - bulk_in_endpointAddress,
    3378     - USB_DIR_IN,
    3379     - port,
    3380     - portdata->
    3381     - in_buffer[j],
    3382     - IN_BUFLEN,
    3383     - usb_wwan_indat_callback);
    3384     - }
    3385     -
    3386     - /* outdat endpoints */
    3387     - for (j = 0; j < N_OUT_URB; ++j) {
    3388     - portdata->out_urbs[j] = usb_wwan_setup_urb(serial,
    3389     - port->
    3390     - bulk_out_endpointAddress,
    3391     - USB_DIR_OUT,
    3392     - port,
    3393     - portdata->
    3394     - out_buffer
    3395     - [j],
    3396     - OUT_BUFLEN,
    3397     - usb_wwan_outdat_callback);
    3398     - }
    3399     - }
    3400     -}
    3401     + portdata = kzalloc(sizeof(*portdata), GFP_KERNEL);
    3402     + if (!portdata)
    3403     + return -ENOMEM;
    3404    
    3405     -int usb_wwan_startup(struct usb_serial *serial)
    3406     -{
    3407     - int i, j, err;
    3408     - struct usb_serial_port *port;
    3409     - struct usb_wwan_port_private *portdata;
    3410     - u8 *buffer;
    3411     + init_usb_anchor(&portdata->delayed);
    3412    
    3413     - /* Now setup per port private data */
    3414     - for (i = 0; i < serial->num_ports; i++) {
    3415     - port = serial->port[i];
    3416     - portdata = kzalloc(sizeof(*portdata), GFP_KERNEL);
    3417     - if (!portdata) {
    3418     - dbg("%s: kmalloc for usb_wwan_port_private (%d) failed!.",
    3419     - __func__, i);
    3420     - return 1;
    3421     - }
    3422     - init_usb_anchor(&portdata->delayed);
    3423     + for (i = 0; i < N_IN_URB; i++) {
    3424     + buffer = (u8 *)__get_free_page(GFP_KERNEL);
    3425     + if (!buffer)
    3426     + goto bail_out_error;
    3427     + portdata->in_buffer[i] = buffer;
    3428     +
    3429     + urb = usb_wwan_setup_urb(port, port->bulk_in_endpointAddress,
    3430     + USB_DIR_IN, port,
    3431     + buffer, IN_BUFLEN,
    3432     + usb_wwan_indat_callback);
    3433     + portdata->in_urbs[i] = urb;
    3434     + }
    3435     + for (i = 0; i < N_OUT_URB; i++) {
    3436     + if (port->bulk_out_endpointAddress == -1)
    3437     + continue;
    3438    
    3439     - for (j = 0; j < N_IN_URB; j++) {
    3440     - buffer = (u8 *) __get_free_page(GFP_KERNEL);
    3441     - if (!buffer)
    3442     - goto bail_out_error;
    3443     - portdata->in_buffer[j] = buffer;
    3444     - }
    3445     + buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL);
    3446     + if (!buffer)
    3447     + goto bail_out_error2;
    3448     + portdata->out_buffer[i] = buffer;
    3449    
    3450     - for (j = 0; j < N_OUT_URB; j++) {
    3451     - buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL);
    3452     - if (!buffer)
    3453     - goto bail_out_error2;
    3454     - portdata->out_buffer[j] = buffer;
    3455     - }
    3456     + urb = usb_wwan_setup_urb(port, port->bulk_out_endpointAddress,
    3457     + USB_DIR_OUT, port,
    3458     + buffer, OUT_BUFLEN,
    3459     + usb_wwan_outdat_callback);
    3460     + portdata->out_urbs[i] = urb;
    3461     + }
    3462    
    3463     - usb_set_serial_port_data(port, portdata);
    3464     + usb_set_serial_port_data(port, portdata);
    3465    
    3466     - if (!port->interrupt_in_urb)
    3467     - continue;
    3468     + if (port->interrupt_in_urb) {
    3469     err = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);
    3470     if (err)
    3471     - dbg("%s: submit irq_in urb failed %d", __func__, err);
    3472     + dev_dbg(&port->dev, "%s: submit irq_in urb failed %d\n",
    3473     + __func__, err);
    3474     }
    3475     - usb_wwan_setup_urbs(serial);
    3476     +
    3477     return 0;
    3478    
    3479     bail_out_error2:
    3480     - for (j = 0; j < N_OUT_URB; j++)
    3481     - kfree(portdata->out_buffer[j]);
    3482     + for (i = 0; i < N_OUT_URB; i++) {
    3483     + usb_free_urb(portdata->out_urbs[i]);
    3484     + kfree(portdata->out_buffer[i]);
    3485     + }
    3486     bail_out_error:
    3487     - for (j = 0; j < N_IN_URB; j++)
    3488     - if (portdata->in_buffer[j])
    3489     - free_page((unsigned long)portdata->in_buffer[j]);
    3490     + for (i = 0; i < N_IN_URB; i++) {
    3491     + usb_free_urb(portdata->in_urbs[i]);
    3492     + free_page((unsigned long)portdata->in_buffer[i]);
    3493     + }
    3494     kfree(portdata);
    3495     - return 1;
    3496     +
    3497     + return -ENOMEM;
    3498     }
    3499     -EXPORT_SYMBOL(usb_wwan_startup);
    3500     +EXPORT_SYMBOL_GPL(usb_wwan_port_probe);
    3501    
    3502     int usb_wwan_port_remove(struct usb_serial_port *port)
    3503     {
    3504     diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
    3505     index 473635e..bd36321 100644
    3506     --- a/drivers/usb/serial/whiteheat.c
    3507     +++ b/drivers/usb/serial/whiteheat.c
    3508     @@ -86,6 +86,8 @@ static int whiteheat_firmware_attach(struct usb_serial *serial);
    3509     /* function prototypes for the Connect Tech WhiteHEAT serial converter */
    3510     static int whiteheat_attach(struct usb_serial *serial);
    3511     static void whiteheat_release(struct usb_serial *serial);
    3512     +static int whiteheat_port_probe(struct usb_serial_port *port);
    3513     +static int whiteheat_port_remove(struct usb_serial_port *port);
    3514     static int whiteheat_open(struct tty_struct *tty,
    3515     struct usb_serial_port *port);
    3516     static void whiteheat_close(struct usb_serial_port *port);
    3517     @@ -120,6 +122,8 @@ static struct usb_serial_driver whiteheat_device = {
    3518     .num_ports = 4,
    3519     .attach = whiteheat_attach,
    3520     .release = whiteheat_release,
    3521     + .port_probe = whiteheat_port_probe,
    3522     + .port_remove = whiteheat_port_remove,
    3523     .open = whiteheat_open,
    3524     .close = whiteheat_close,
    3525     .ioctl = whiteheat_ioctl,
    3526     @@ -290,15 +294,12 @@ static int whiteheat_attach(struct usb_serial *serial)
    3527     {
    3528     struct usb_serial_port *command_port;
    3529     struct whiteheat_command_private *command_info;
    3530     - struct usb_serial_port *port;
    3531     - struct whiteheat_private *info;
    3532     struct whiteheat_hw_info *hw_info;
    3533     int pipe;
    3534     int ret;
    3535     int alen;
    3536     __u8 *command;
    3537     __u8 *result;
    3538     - int i;
    3539    
    3540     command_port = serial->port[COMMAND_PORT];
    3541    
    3542     @@ -357,22 +358,6 @@ static int whiteheat_attach(struct usb_serial *serial)
    3543     serial->type->description,
    3544     hw_info->sw_major_rev, hw_info->sw_minor_rev);
    3545    
    3546     - for (i = 0; i < serial->num_ports; i++) {
    3547     - port = serial->port[i];
    3548     -
    3549     - info = kmalloc(sizeof(struct whiteheat_private), GFP_KERNEL);
    3550     - if (info == NULL) {
    3551     - dev_err(&port->dev,
    3552     - "%s: Out of memory for port structures\n",
    3553     - serial->type->description);
    3554     - goto no_private;
    3555     - }
    3556     -
    3557     - info->mcr = 0;
    3558     -
    3559     - usb_set_serial_port_data(port, info);
    3560     - }
    3561     -
    3562     command_info = kmalloc(sizeof(struct whiteheat_command_private),
    3563     GFP_KERNEL);
    3564     if (command_info == NULL) {
    3565     @@ -405,16 +390,10 @@ no_firmware:
    3566     "%s: please contact support@connecttech.com\n",
    3567     serial->type->description);
    3568     kfree(result);
    3569     + kfree(command);
    3570     return -ENODEV;
    3571    
    3572     no_command_private:
    3573     - for (i = serial->num_ports - 1; i >= 0; i--) {
    3574     - port = serial->port[i];
    3575     - info = usb_get_serial_port_data(port);
    3576     - kfree(info);
    3577     -no_private:
    3578     - ;
    3579     - }
    3580     kfree(result);
    3581     no_result_buffer:
    3582     kfree(command);
    3583     @@ -422,21 +401,36 @@ no_command_buffer:
    3584     return -ENOMEM;
    3585     }
    3586    
    3587     -
    3588     static void whiteheat_release(struct usb_serial *serial)
    3589     {
    3590     struct usb_serial_port *command_port;
    3591     - struct whiteheat_private *info;
    3592     - int i;
    3593    
    3594     /* free up our private data for our command port */
    3595     command_port = serial->port[COMMAND_PORT];
    3596     kfree(usb_get_serial_port_data(command_port));
    3597     +}
    3598    
    3599     - for (i = 0; i < serial->num_ports; i++) {
    3600     - info = usb_get_serial_port_data(serial->port[i]);
    3601     - kfree(info);
    3602     - }
    3603     +static int whiteheat_port_probe(struct usb_serial_port *port)
    3604     +{
    3605     + struct whiteheat_private *info;
    3606     +
    3607     + info = kzalloc(sizeof(*info), GFP_KERNEL);
    3608     + if (!info)
    3609     + return -ENOMEM;
    3610     +
    3611     + usb_set_serial_port_data(port, info);
    3612     +
    3613     + return 0;
    3614     +}
    3615     +
    3616     +static int whiteheat_port_remove(struct usb_serial_port *port)
    3617     +{
    3618     + struct whiteheat_private *info;
    3619     +
    3620     + info = usb_get_serial_port_data(port);
    3621     + kfree(info);
    3622     +
    3623     + return 0;
    3624     }
    3625    
    3626     static int whiteheat_open(struct tty_struct *tty, struct usb_serial_port *port)
    3627     diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    3628     index 62a31be..8f98c9a 100644
    3629     --- a/drivers/usb/storage/unusual_devs.h
    3630     +++ b/drivers/usb/storage/unusual_devs.h
    3631     @@ -1004,6 +1004,12 @@ UNUSUAL_DEV( 0x07cf, 0x1001, 0x1000, 0x9999,
    3632     USB_SC_8070, USB_PR_CB, NULL,
    3633     US_FL_NEED_OVERRIDE | US_FL_FIX_INQUIRY ),
    3634    
    3635     +/* Submitted by Oleksandr Chumachenko <ledest@gmail.com> */
    3636     +UNUSUAL_DEV( 0x07cf, 0x1167, 0x0100, 0x0100,
    3637     + "Casio",
    3638     + "EX-N1 DigitalCamera",
    3639     + USB_SC_8070, USB_PR_DEVICE, NULL, 0),
    3640     +
    3641     /* Submitted by Hartmut Wahl <hwahl@hwahl.de>*/
    3642     UNUSUAL_DEV( 0x0839, 0x000a, 0x0001, 0x0001,
    3643     "Samsung",
    3644     diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
    3645     index 072cbba..7f93f34 100644
    3646     --- a/drivers/vhost/net.c
    3647     +++ b/drivers/vhost/net.c
    3648     @@ -379,7 +379,8 @@ static void handle_rx(struct vhost_net *net)
    3649     .hdr.gso_type = VIRTIO_NET_HDR_GSO_NONE
    3650     };
    3651     size_t total_len = 0;
    3652     - int err, headcount, mergeable;
    3653     + int err, mergeable;
    3654     + s16 headcount;
    3655     size_t vhost_hlen, sock_hlen;
    3656     size_t vhost_len, sock_len;
    3657     /* TODO: check that we are running from vhost_worker? */
    3658     diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
    3659     index debdfe0..5d2069f 100644
    3660     --- a/fs/compat_ioctl.c
    3661     +++ b/fs/compat_ioctl.c
    3662     @@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd,
    3663    
    3664     err = get_user(palp, &up->palette);
    3665     err |= get_user(length, &up->length);
    3666     + if (err)
    3667     + return -EFAULT;
    3668    
    3669     up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
    3670     err = put_user(compat_ptr(palp), &up_native->palette);
    3671     diff --git a/fs/exec.c b/fs/exec.c
    3672     index 574cf4d..fab2c6d 100644
    3673     --- a/fs/exec.c
    3674     +++ b/fs/exec.c
    3675     @@ -1110,7 +1110,8 @@ int flush_old_exec(struct linux_binprm * bprm)
    3676     bprm->mm = NULL; /* We're using it now */
    3677    
    3678     set_fs(USER_DS);
    3679     - current->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD);
    3680     + current->flags &=
    3681     + ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD | PF_NOFREEZE);
    3682     flush_thread();
    3683     current->personality &= ~bprm->per_clear;
    3684    
    3685     diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c
    3686     index e4fb3ba..3d7e09b 100644
    3687     --- a/fs/lockd/mon.c
    3688     +++ b/fs/lockd/mon.c
    3689     @@ -85,29 +85,38 @@ static struct rpc_clnt *nsm_create(struct net *net)
    3690     return rpc_create(&args);
    3691     }
    3692    
    3693     +static struct rpc_clnt *nsm_client_set(struct lockd_net *ln,
    3694     + struct rpc_clnt *clnt)
    3695     +{
    3696     + spin_lock(&ln->nsm_clnt_lock);
    3697     + if (ln->nsm_users == 0) {
    3698     + if (clnt == NULL)
    3699     + goto out;
    3700     + ln->nsm_clnt = clnt;
    3701     + }
    3702     + clnt = ln->nsm_clnt;
    3703     + ln->nsm_users++;
    3704     +out:
    3705     + spin_unlock(&ln->nsm_clnt_lock);
    3706     + return clnt;
    3707     +}
    3708     +
    3709     static struct rpc_clnt *nsm_client_get(struct net *net)
    3710     {
    3711     - static DEFINE_MUTEX(nsm_create_mutex);
    3712     - struct rpc_clnt *clnt;
    3713     + struct rpc_clnt *clnt, *new;
    3714     struct lockd_net *ln = net_generic(net, lockd_net_id);
    3715    
    3716     - spin_lock(&ln->nsm_clnt_lock);
    3717     - if (ln->nsm_users) {
    3718     - ln->nsm_users++;
    3719     - clnt = ln->nsm_clnt;
    3720     - spin_unlock(&ln->nsm_clnt_lock);
    3721     + clnt = nsm_client_set(ln, NULL);
    3722     + if (clnt != NULL)
    3723     goto out;
    3724     - }
    3725     - spin_unlock(&ln->nsm_clnt_lock);
    3726    
    3727     - mutex_lock(&nsm_create_mutex);
    3728     - clnt = nsm_create(net);
    3729     - if (!IS_ERR(clnt)) {
    3730     - ln->nsm_clnt = clnt;
    3731     - smp_wmb();
    3732     - ln->nsm_users = 1;
    3733     - }
    3734     - mutex_unlock(&nsm_create_mutex);
    3735     + clnt = new = nsm_create(net);
    3736     + if (IS_ERR(clnt))
    3737     + goto out;
    3738     +
    3739     + clnt = nsm_client_set(ln, new);
    3740     + if (clnt != new)
    3741     + rpc_shutdown_client(new);
    3742     out:
    3743     return clnt;
    3744     }
    3745     @@ -115,18 +124,16 @@ out:
    3746     static void nsm_client_put(struct net *net)
    3747     {
    3748     struct lockd_net *ln = net_generic(net, lockd_net_id);
    3749     - struct rpc_clnt *clnt = ln->nsm_clnt;
    3750     - int shutdown = 0;
    3751     + struct rpc_clnt *clnt = NULL;
    3752    
    3753     spin_lock(&ln->nsm_clnt_lock);
    3754     - if (ln->nsm_users) {
    3755     - if (--ln->nsm_users)
    3756     - ln->nsm_clnt = NULL;
    3757     - shutdown = !ln->nsm_users;
    3758     + ln->nsm_users--;
    3759     + if (ln->nsm_users == 0) {
    3760     + clnt = ln->nsm_clnt;
    3761     + ln->nsm_clnt = NULL;
    3762     }
    3763     spin_unlock(&ln->nsm_clnt_lock);
    3764     -
    3765     - if (shutdown)
    3766     + if (clnt != NULL)
    3767     rpc_shutdown_client(clnt);
    3768     }
    3769    
    3770     diff --git a/fs/namei.c b/fs/namei.c
    3771     index 81bd546..091c4b7 100644
    3772     --- a/fs/namei.c
    3773     +++ b/fs/namei.c
    3774     @@ -651,8 +651,8 @@ static inline void put_link(struct nameidata *nd, struct path *link, void *cooki
    3775     path_put(link);
    3776     }
    3777    
    3778     -int sysctl_protected_symlinks __read_mostly = 1;
    3779     -int sysctl_protected_hardlinks __read_mostly = 1;
    3780     +int sysctl_protected_symlinks __read_mostly = 0;
    3781     +int sysctl_protected_hardlinks __read_mostly = 0;
    3782    
    3783     /**
    3784     * may_follow_link - Check symlink following for unsafe situations
    3785     diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
    3786     index f3d16ad..1093968 100644
    3787     --- a/fs/nfs/blocklayout/blocklayout.c
    3788     +++ b/fs/nfs/blocklayout/blocklayout.c
    3789     @@ -242,14 +242,6 @@ bl_end_par_io_read(void *data, int unused)
    3790     schedule_work(&rdata->task.u.tk_work);
    3791     }
    3792    
    3793     -static bool
    3794     -bl_check_alignment(u64 offset, u32 len, unsigned long blkmask)
    3795     -{
    3796     - if ((offset & blkmask) || (len & blkmask))
    3797     - return false;
    3798     - return true;
    3799     -}
    3800     -
    3801     static enum pnfs_try_status
    3802     bl_read_pagelist(struct nfs_read_data *rdata)
    3803     {
    3804     @@ -260,15 +252,15 @@ bl_read_pagelist(struct nfs_read_data *rdata)
    3805     sector_t isect, extent_length = 0;
    3806     struct parallel_io *par;
    3807     loff_t f_offset = rdata->args.offset;
    3808     + size_t bytes_left = rdata->args.count;
    3809     + unsigned int pg_offset, pg_len;
    3810     struct page **pages = rdata->args.pages;
    3811     int pg_index = rdata->args.pgbase >> PAGE_CACHE_SHIFT;
    3812     + const bool is_dio = (header->dreq != NULL);
    3813    
    3814     dprintk("%s enter nr_pages %u offset %lld count %u\n", __func__,
    3815     rdata->pages.npages, f_offset, (unsigned int)rdata->args.count);
    3816    
    3817     - if (!bl_check_alignment(f_offset, rdata->args.count, PAGE_CACHE_MASK))
    3818     - goto use_mds;
    3819     -
    3820     par = alloc_parallel(rdata);
    3821     if (!par)
    3822     goto use_mds;
    3823     @@ -298,36 +290,53 @@ bl_read_pagelist(struct nfs_read_data *rdata)
    3824     extent_length = min(extent_length, cow_length);
    3825     }
    3826     }
    3827     +
    3828     + if (is_dio) {
    3829     + pg_offset = f_offset & ~PAGE_CACHE_MASK;
    3830     + if (pg_offset + bytes_left > PAGE_CACHE_SIZE)
    3831     + pg_len = PAGE_CACHE_SIZE - pg_offset;
    3832     + else
    3833     + pg_len = bytes_left;
    3834     +
    3835     + f_offset += pg_len;
    3836     + bytes_left -= pg_len;
    3837     + isect += (pg_offset >> SECTOR_SHIFT);
    3838     + } else {
    3839     + pg_offset = 0;
    3840     + pg_len = PAGE_CACHE_SIZE;
    3841     + }
    3842     +
    3843     hole = is_hole(be, isect);
    3844     if (hole && !cow_read) {
    3845     bio = bl_submit_bio(READ, bio);
    3846     /* Fill hole w/ zeroes w/o accessing device */
    3847     dprintk("%s Zeroing page for hole\n", __func__);
    3848     - zero_user_segment(pages[i], 0, PAGE_CACHE_SIZE);
    3849     + zero_user_segment(pages[i], pg_offset, pg_len);
    3850     print_page(pages[i]);
    3851     SetPageUptodate(pages[i]);
    3852     } else {
    3853     struct pnfs_block_extent *be_read;
    3854    
    3855     be_read = (hole && cow_read) ? cow_read : be;
    3856     - bio = bl_add_page_to_bio(bio, rdata->pages.npages - i,
    3857     + bio = do_add_page_to_bio(bio, rdata->pages.npages - i,
    3858     READ,
    3859     isect, pages[i], be_read,
    3860     - bl_end_io_read, par);
    3861     + bl_end_io_read, par,
    3862     + pg_offset, pg_len);
    3863     if (IS_ERR(bio)) {
    3864     header->pnfs_error = PTR_ERR(bio);
    3865     bio = NULL;
    3866     goto out;
    3867     }
    3868     }
    3869     - isect += PAGE_CACHE_SECTORS;
    3870     + isect += (pg_len >> SECTOR_SHIFT);
    3871     extent_length -= PAGE_CACHE_SECTORS;
    3872     }
    3873     if ((isect << SECTOR_SHIFT) >= header->inode->i_size) {
    3874     rdata->res.eof = 1;
    3875     - rdata->res.count = header->inode->i_size - f_offset;
    3876     + rdata->res.count = header->inode->i_size - rdata->args.offset;
    3877     } else {
    3878     - rdata->res.count = (isect << SECTOR_SHIFT) - f_offset;
    3879     + rdata->res.count = (isect << SECTOR_SHIFT) - rdata->args.offset;
    3880     }
    3881     out:
    3882     bl_put_extent(be);
    3883     @@ -688,10 +697,13 @@ bl_write_pagelist(struct nfs_write_data *wdata, int sync)
    3884     NFS_SERVER(header->inode)->pnfs_blksize >> PAGE_CACHE_SHIFT;
    3885    
    3886     dprintk("%s enter, %Zu@%lld\n", __func__, count, offset);
    3887     - /* Check for alignment first */
    3888     - if (!bl_check_alignment(offset, count, PAGE_CACHE_MASK))
    3889     - goto out_mds;
    3890    
    3891     + if (header->dreq != NULL &&
    3892     + (!IS_ALIGNED(offset, NFS_SERVER(header->inode)->pnfs_blksize) ||
    3893     + !IS_ALIGNED(count, NFS_SERVER(header->inode)->pnfs_blksize))) {
    3894     + dprintk("pnfsblock nonblock aligned DIO writes. Resend MDS\n");
    3895     + goto out_mds;
    3896     + }
    3897     /* At this point, wdata->pages is a (sequential) list of nfs_pages.
    3898     * We want to write each, and if there is an error set pnfs_error
    3899     * to have it redone using nfs.
    3900     @@ -1164,33 +1176,64 @@ bl_clear_layoutdriver(struct nfs_server *server)
    3901     return 0;
    3902     }
    3903    
    3904     +static bool
    3905     +is_aligned_req(struct nfs_page *req, unsigned int alignment)
    3906     +{
    3907     + return IS_ALIGNED(req->wb_offset, alignment) &&
    3908     + IS_ALIGNED(req->wb_bytes, alignment);
    3909     +}
    3910     +
    3911     static void
    3912     bl_pg_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
    3913     {
    3914     - if (!bl_check_alignment(req->wb_offset, req->wb_bytes, PAGE_CACHE_MASK))
    3915     + if (pgio->pg_dreq != NULL &&
    3916     + !is_aligned_req(req, SECTOR_SIZE))
    3917     nfs_pageio_reset_read_mds(pgio);
    3918     else
    3919     pnfs_generic_pg_init_read(pgio, req);
    3920     }
    3921    
    3922     -static void
    3923     +static bool
    3924     +bl_pg_test_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
    3925     + struct nfs_page *req)
    3926     +{
    3927     + if (pgio->pg_dreq != NULL &&
    3928     + !is_aligned_req(req, SECTOR_SIZE))
    3929     + return false;
    3930     +
    3931     + return pnfs_generic_pg_test(pgio, prev, req);
    3932     +}
    3933     +
    3934     +void
    3935     bl_pg_init_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
    3936     {
    3937     - if (!bl_check_alignment(req->wb_offset, req->wb_bytes, PAGE_CACHE_MASK))
    3938     + if (pgio->pg_dreq != NULL &&
    3939     + !is_aligned_req(req, PAGE_CACHE_SIZE))
    3940     nfs_pageio_reset_write_mds(pgio);
    3941     else
    3942     pnfs_generic_pg_init_write(pgio, req);
    3943     }
    3944    
    3945     +static bool
    3946     +bl_pg_test_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
    3947     + struct nfs_page *req)
    3948     +{
    3949     + if (pgio->pg_dreq != NULL &&
    3950     + !is_aligned_req(req, PAGE_CACHE_SIZE))
    3951     + return false;
    3952     +
    3953     + return pnfs_generic_pg_test(pgio, prev, req);
    3954     +}
    3955     +
    3956     static const struct nfs_pageio_ops bl_pg_read_ops = {
    3957     .pg_init = bl_pg_init_read,
    3958     - .pg_test = pnfs_generic_pg_test,
    3959     + .pg_test = bl_pg_test_read,
    3960     .pg_doio = pnfs_generic_pg_readpages,
    3961     };
    3962    
    3963     static const struct nfs_pageio_ops bl_pg_write_ops = {
    3964     .pg_init = bl_pg_init_write,
    3965     - .pg_test = pnfs_generic_pg_test,
    3966     + .pg_test = bl_pg_test_write,
    3967     .pg_doio = pnfs_generic_pg_writepages,
    3968     };
    3969    
    3970     diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
    3971     index 6b0bb00..2fbdff6 100644
    3972     --- a/fs/sysfs/dir.c
    3973     +++ b/fs/sysfs/dir.c
    3974     @@ -485,20 +485,18 @@ int __sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd)
    3975     /**
    3976     * sysfs_pathname - return full path to sysfs dirent
    3977     * @sd: sysfs_dirent whose path we want
    3978     - * @path: caller allocated buffer
    3979     + * @path: caller allocated buffer of size PATH_MAX
    3980     *
    3981     * Gives the name "/" to the sysfs_root entry; any path returned
    3982     * is relative to wherever sysfs is mounted.
    3983     - *
    3984     - * XXX: does no error checking on @path size
    3985     */
    3986     static char *sysfs_pathname(struct sysfs_dirent *sd, char *path)
    3987     {
    3988     if (sd->s_parent) {
    3989     sysfs_pathname(sd->s_parent, path);
    3990     - strcat(path, "/");
    3991     + strlcat(path, "/", PATH_MAX);
    3992     }
    3993     - strcat(path, sd->s_name);
    3994     + strlcat(path, sd->s_name, PATH_MAX);
    3995     return path;
    3996     }
    3997    
    3998     @@ -531,9 +529,11 @@ int sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd)
    3999     char *path = kzalloc(PATH_MAX, GFP_KERNEL);
    4000     WARN(1, KERN_WARNING
    4001     "sysfs: cannot create duplicate filename '%s'\n",
    4002     - (path == NULL) ? sd->s_name :
    4003     - strcat(strcat(sysfs_pathname(acxt->parent_sd, path), "/"),
    4004     - sd->s_name));
    4005     + (path == NULL) ? sd->s_name
    4006     + : (sysfs_pathname(acxt->parent_sd, path),
    4007     + strlcat(path, "/", PATH_MAX),
    4008     + strlcat(path, sd->s_name, PATH_MAX),
    4009     + path));
    4010     kfree(path);
    4011     }
    4012    
    4013     diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
    4014     index c78bb99..af1cbaf 100644
    4015     --- a/include/drm/drm_pciids.h
    4016     +++ b/include/drm/drm_pciids.h
    4017     @@ -205,6 +205,8 @@
    4018     {0x1002, 0x6788, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
    4019     {0x1002, 0x678A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
    4020     {0x1002, 0x6790, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
    4021     + {0x1002, 0x6791, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
    4022     + {0x1002, 0x6792, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
    4023     {0x1002, 0x6798, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
    4024     {0x1002, 0x6799, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
    4025     {0x1002, 0x679A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
    4026     @@ -217,6 +219,7 @@
    4027     {0x1002, 0x6808, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
    4028     {0x1002, 0x6809, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
    4029     {0x1002, 0x6810, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
    4030     + {0x1002, 0x6811, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
    4031     {0x1002, 0x6816, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
    4032     {0x1002, 0x6817, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
    4033     {0x1002, 0x6818, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
    4034     diff --git a/include/linux/efi.h b/include/linux/efi.h
    4035     index ec45ccd..5782114 100644
    4036     --- a/include/linux/efi.h
    4037     +++ b/include/linux/efi.h
    4038     @@ -496,6 +496,11 @@ extern void efi_map_pal_code (void);
    4039     extern void efi_memmap_walk (efi_freemem_callback_t callback, void *arg);
    4040     extern void efi_gettimeofday (struct timespec *ts);
    4041     extern void efi_enter_virtual_mode (void); /* switch EFI to virtual mode, if possible */
    4042     +#ifdef CONFIG_X86
    4043     +extern void efi_free_boot_services(void);
    4044     +#else
    4045     +static inline void efi_free_boot_services(void) {}
    4046     +#endif
    4047     extern u64 efi_get_iobase (void);
    4048     extern u32 efi_mem_type (unsigned long phys_addr);
    4049     extern u64 efi_mem_attributes (unsigned long phys_addr);
    4050     diff --git a/include/linux/memblock.h b/include/linux/memblock.h
    4051     index 19dc455..c948c44 100644
    4052     --- a/include/linux/memblock.h
    4053     +++ b/include/linux/memblock.h
    4054     @@ -57,6 +57,7 @@ int memblock_add(phys_addr_t base, phys_addr_t size);
    4055     int memblock_remove(phys_addr_t base, phys_addr_t size);
    4056     int memblock_free(phys_addr_t base, phys_addr_t size);
    4057     int memblock_reserve(phys_addr_t base, phys_addr_t size);
    4058     +void memblock_trim_memory(phys_addr_t align);
    4059    
    4060     #ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP
    4061     void __next_mem_pfn_range(int *idx, int nid, unsigned long *out_start_pfn,
    4062     diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
    4063     index 3d254e1..f10553c 100644
    4064     --- a/include/net/cfg80211.h
    4065     +++ b/include/net/cfg80211.h
    4066     @@ -1217,6 +1217,7 @@ struct cfg80211_deauth_request {
    4067     const u8 *ie;
    4068     size_t ie_len;
    4069     u16 reason_code;
    4070     + bool local_state_change;
    4071     };
    4072    
    4073     /**
    4074     diff --git a/init/main.c b/init/main.c
    4075     index b286730..d61ec54 100644
    4076     --- a/init/main.c
    4077     +++ b/init/main.c
    4078     @@ -631,6 +631,9 @@ asmlinkage void __init start_kernel(void)
    4079     acpi_early_init(); /* before LAPIC and SMP init */
    4080     sfi_init_late();
    4081    
    4082     + if (efi_enabled)
    4083     + efi_free_boot_services();
    4084     +
    4085     ftrace_init();
    4086    
    4087     /* Do the rest non-__init'ed, we're now alive */
    4088     diff --git a/lib/genalloc.c b/lib/genalloc.c
    4089     index 6bc04aa..7cb7a5d 100644
    4090     --- a/lib/genalloc.c
    4091     +++ b/lib/genalloc.c
    4092     @@ -176,7 +176,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy
    4093     struct gen_pool_chunk *chunk;
    4094     int nbits = size >> pool->min_alloc_order;
    4095     int nbytes = sizeof(struct gen_pool_chunk) +
    4096     - (nbits + BITS_PER_BYTE - 1) / BITS_PER_BYTE;
    4097     + BITS_TO_LONGS(nbits) * sizeof(long);
    4098    
    4099     chunk = kmalloc_node(nbytes, GFP_KERNEL | __GFP_ZERO, nid);
    4100     if (unlikely(chunk == NULL))
    4101     diff --git a/mm/memblock.c b/mm/memblock.c
    4102     index 82aa349..0e490e8 100644
    4103     --- a/mm/memblock.c
    4104     +++ b/mm/memblock.c
    4105     @@ -929,6 +929,30 @@ int __init_memblock memblock_is_region_reserved(phys_addr_t base, phys_addr_t si
    4106     return memblock_overlaps_region(&memblock.reserved, base, size) >= 0;
    4107     }
    4108    
    4109     +void __init_memblock memblock_trim_memory(phys_addr_t align)
    4110     +{
    4111     + int i;
    4112     + phys_addr_t start, end, orig_start, orig_end;
    4113     + struct memblock_type *mem = &memblock.memory;
    4114     +
    4115     + for (i = 0; i < mem->cnt; i++) {
    4116     + orig_start = mem->regions[i].base;
    4117     + orig_end = mem->regions[i].base + mem->regions[i].size;
    4118     + start = round_up(orig_start, align);
    4119     + end = round_down(orig_end, align);
    4120     +
    4121     + if (start == orig_start && end == orig_end)
    4122     + continue;
    4123     +
    4124     + if (start < end) {
    4125     + mem->regions[i].base = start;
    4126     + mem->regions[i].size = end - start;
    4127     + } else {
    4128     + memblock_remove_region(mem, i);
    4129     + i--;
    4130     + }
    4131     + }
    4132     +}
    4133    
    4134     void __init_memblock memblock_set_current_limit(phys_addr_t limit)
    4135     {
    4136     diff --git a/mm/rmap.c b/mm/rmap.c
    4137     index 0f3b7cd..aa95e59 100644
    4138     --- a/mm/rmap.c
    4139     +++ b/mm/rmap.c
    4140     @@ -56,6 +56,7 @@
    4141     #include <linux/mmu_notifier.h>
    4142     #include <linux/migrate.h>
    4143     #include <linux/hugetlb.h>
    4144     +#include <linux/backing-dev.h>
    4145    
    4146     #include <asm/tlbflush.h>
    4147    
    4148     @@ -971,11 +972,8 @@ int page_mkclean(struct page *page)
    4149    
    4150     if (page_mapped(page)) {
    4151     struct address_space *mapping = page_mapping(page);
    4152     - if (mapping) {
    4153     + if (mapping)
    4154     ret = page_mkclean_file(mapping, page);
    4155     - if (page_test_and_clear_dirty(page_to_pfn(page), 1))
    4156     - ret = 1;
    4157     - }
    4158     }
    4159    
    4160     return ret;
    4161     @@ -1161,6 +1159,7 @@ void page_add_file_rmap(struct page *page)
    4162     */
    4163     void page_remove_rmap(struct page *page)
    4164     {
    4165     + struct address_space *mapping = page_mapping(page);
    4166     bool anon = PageAnon(page);
    4167     bool locked;
    4168     unsigned long flags;
    4169     @@ -1183,8 +1182,19 @@ void page_remove_rmap(struct page *page)
    4170     * this if the page is anon, so about to be freed; but perhaps
    4171     * not if it's in swapcache - there might be another pte slot
    4172     * containing the swap entry, but page not yet written to swap.
    4173     + *
    4174     + * And we can skip it on file pages, so long as the filesystem
    4175     + * participates in dirty tracking; but need to catch shm and tmpfs
    4176     + * and ramfs pages which have been modified since creation by read
    4177     + * fault.
    4178     + *
    4179     + * Note that mapping must be decided above, before decrementing
    4180     + * mapcount (which luckily provides a barrier): once page is unmapped,
    4181     + * it could be truncated and page->mapping reset to NULL at any moment.
    4182     + * Note also that we are relying on page_mapping(page) to set mapping
    4183     + * to &swapper_space when PageSwapCache(page).
    4184     */
    4185     - if ((!anon || PageSwapCache(page)) &&
    4186     + if (mapping && !mapping_cap_account_dirty(mapping) &&
    4187     page_test_and_clear_dirty(page_to_pfn(page), 1))
    4188     set_page_dirty(page);
    4189     /*
    4190     diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
    4191     index 8c225ef..2ac8d50 100644
    4192     --- a/net/bluetooth/smp.c
    4193     +++ b/net/bluetooth/smp.c
    4194     @@ -32,6 +32,8 @@
    4195    
    4196     #define SMP_TIMEOUT msecs_to_jiffies(30000)
    4197    
    4198     +#define AUTH_REQ_MASK 0x07
    4199     +
    4200     static inline void swap128(u8 src[16], u8 dst[16])
    4201     {
    4202     int i;
    4203     @@ -230,7 +232,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
    4204     req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
    4205     req->init_key_dist = 0;
    4206     req->resp_key_dist = dist_keys;
    4207     - req->auth_req = authreq;
    4208     + req->auth_req = (authreq & AUTH_REQ_MASK);
    4209     return;
    4210     }
    4211    
    4212     @@ -239,7 +241,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
    4213     rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
    4214     rsp->init_key_dist = 0;
    4215     rsp->resp_key_dist = req->resp_key_dist & dist_keys;
    4216     - rsp->auth_req = authreq;
    4217     + rsp->auth_req = (authreq & AUTH_REQ_MASK);
    4218     }
    4219    
    4220     static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
    4221     diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
    4222     index bfb57dc..c93d395 100644
    4223     --- a/net/mac80211/iface.c
    4224     +++ b/net/mac80211/iface.c
    4225     @@ -822,7 +822,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
    4226     struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
    4227     if (info->control.vif == &sdata->vif) {
    4228     __skb_unlink(skb, &local->pending[i]);
    4229     - dev_kfree_skb_irq(skb);
    4230     + ieee80211_free_txskb(&local->hw, skb);
    4231     }
    4232     }
    4233     }
    4234     diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
    4235     index f76b833..b71d466 100644
    4236     --- a/net/mac80211/mlme.c
    4237     +++ b/net/mac80211/mlme.c
    4238     @@ -3065,22 +3065,32 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
    4239     ht_cfreq, ht_oper->primary_chan,
    4240     cbss->channel->band);
    4241     ht_oper = NULL;
    4242     + } else {
    4243     + channel_type = NL80211_CHAN_HT20;
    4244     }
    4245     }
    4246    
    4247     - if (ht_oper) {
    4248     - channel_type = NL80211_CHAN_HT20;
    4249     + if (ht_oper && sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
    4250     + /*
    4251     + * cfg80211 already verified that the channel itself can
    4252     + * be used, but it didn't check that we can do the right
    4253     + * HT type, so do that here as well. If HT40 isn't allowed
    4254     + * on this channel, disable 40 MHz operation.
    4255     + */
    4256    
    4257     - if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
    4258     - switch (ht_oper->ht_param &
    4259     - IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
    4260     - case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
    4261     + switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
    4262     + case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
    4263     + if (cbss->channel->flags & IEEE80211_CHAN_NO_HT40PLUS)
    4264     + ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ;
    4265     + else
    4266     channel_type = NL80211_CHAN_HT40PLUS;
    4267     - break;
    4268     - case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
    4269     + break;
    4270     + case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
    4271     + if (cbss->channel->flags & IEEE80211_CHAN_NO_HT40MINUS)
    4272     + ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ;
    4273     + else
    4274     channel_type = NL80211_CHAN_HT40MINUS;
    4275     - break;
    4276     - }
    4277     + break;
    4278     }
    4279     }
    4280    
    4281     @@ -3457,6 +3467,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
    4282     {
    4283     struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
    4284     u8 frame_buf[DEAUTH_DISASSOC_LEN];
    4285     + bool tx = !req->local_state_change;
    4286    
    4287     mutex_lock(&ifmgd->mtx);
    4288    
    4289     @@ -3473,11 +3484,11 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
    4290     if (ifmgd->associated &&
    4291     ether_addr_equal(ifmgd->associated->bssid, req->bssid))
    4292     ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
    4293     - req->reason_code, true, frame_buf);
    4294     + req->reason_code, tx, frame_buf);
    4295     else
    4296     ieee80211_send_deauth_disassoc(sdata, req->bssid,
    4297     IEEE80211_STYPE_DEAUTH,
    4298     - req->reason_code, true,
    4299     + req->reason_code, tx,
    4300     frame_buf);
    4301     mutex_unlock(&ifmgd->mtx);
    4302    
    4303     diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
    4304     index 06fa75c..63882b9 100644
    4305     --- a/net/mac80211/sta_info.c
    4306     +++ b/net/mac80211/sta_info.c
    4307     @@ -585,7 +585,7 @@ static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local,
    4308     */
    4309     if (!skb)
    4310     break;
    4311     - dev_kfree_skb(skb);
    4312     + ieee80211_free_txskb(&local->hw, skb);
    4313     }
    4314    
    4315     /*
    4316     @@ -614,7 +614,7 @@ static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local,
    4317     local->total_ps_buffered--;
    4318     ps_dbg(sta->sdata, "Buffered frame expired (STA %pM)\n",
    4319     sta->sta.addr);
    4320     - dev_kfree_skb(skb);
    4321     + ieee80211_free_txskb(&local->hw, skb);
    4322     }
    4323    
    4324     /*
    4325     diff --git a/net/mac80211/util.c b/net/mac80211/util.c
    4326     index 39b82fe..c9b52f7 100644
    4327     --- a/net/mac80211/util.c
    4328     +++ b/net/mac80211/util.c
    4329     @@ -400,7 +400,7 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
    4330     int queue = info->hw_queue;
    4331    
    4332     if (WARN_ON(!info->control.vif)) {
    4333     - kfree_skb(skb);
    4334     + ieee80211_free_txskb(&local->hw, skb);
    4335     return;
    4336     }
    4337    
    4338     @@ -425,7 +425,7 @@ void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
    4339     struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
    4340    
    4341     if (WARN_ON(!info->control.vif)) {
    4342     - kfree_skb(skb);
    4343     + ieee80211_free_txskb(&local->hw, skb);
    4344     continue;
    4345     }
    4346    
    4347     diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
    4348     index bdb53ab..e72562a 100644
    4349     --- a/net/mac80211/wpa.c
    4350     +++ b/net/mac80211/wpa.c
    4351     @@ -106,7 +106,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
    4352     if (status->flag & RX_FLAG_MMIC_ERROR)
    4353     goto mic_fail;
    4354    
    4355     - if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
    4356     + if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key &&
    4357     + rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP)
    4358     goto update_iv;
    4359    
    4360     return RX_CONTINUE;
    4361     diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
    4362     index 97f8918..6a70db4 100644
    4363     --- a/net/sunrpc/xprtsock.c
    4364     +++ b/net/sunrpc/xprtsock.c
    4365     @@ -254,7 +254,6 @@ struct sock_xprt {
    4366     void (*old_data_ready)(struct sock *, int);
    4367     void (*old_state_change)(struct sock *);
    4368     void (*old_write_space)(struct sock *);
    4369     - void (*old_error_report)(struct sock *);
    4370     };
    4371    
    4372     /*
    4373     @@ -737,10 +736,10 @@ static int xs_tcp_send_request(struct rpc_task *task)
    4374     dprintk("RPC: sendmsg returned unrecognized error %d\n",
    4375     -status);
    4376     case -ECONNRESET:
    4377     - case -EPIPE:
    4378     xs_tcp_shutdown(xprt);
    4379     case -ECONNREFUSED:
    4380     case -ENOTCONN:
    4381     + case -EPIPE:
    4382     clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags);
    4383     }
    4384    
    4385     @@ -781,7 +780,6 @@ static void xs_save_old_callbacks(struct sock_xprt *transport, struct sock *sk)
    4386     transport->old_data_ready = sk->sk_data_ready;
    4387     transport->old_state_change = sk->sk_state_change;
    4388     transport->old_write_space = sk->sk_write_space;
    4389     - transport->old_error_report = sk->sk_error_report;
    4390     }
    4391    
    4392     static void xs_restore_old_callbacks(struct sock_xprt *transport, struct sock *sk)
    4393     @@ -789,7 +787,6 @@ static void xs_restore_old_callbacks(struct sock_xprt *transport, struct sock *s
    4394     sk->sk_data_ready = transport->old_data_ready;
    4395     sk->sk_state_change = transport->old_state_change;
    4396     sk->sk_write_space = transport->old_write_space;
    4397     - sk->sk_error_report = transport->old_error_report;
    4398     }
    4399    
    4400     static void xs_reset_transport(struct sock_xprt *transport)
    4401     @@ -1462,7 +1459,7 @@ static void xs_tcp_cancel_linger_timeout(struct rpc_xprt *xprt)
    4402     xprt_clear_connecting(xprt);
    4403     }
    4404    
    4405     -static void xs_sock_mark_closed(struct rpc_xprt *xprt)
    4406     +static void xs_sock_reset_connection_flags(struct rpc_xprt *xprt)
    4407     {
    4408     smp_mb__before_clear_bit();
    4409     clear_bit(XPRT_CONNECTION_ABORT, &xprt->state);
    4410     @@ -1470,6 +1467,11 @@ static void xs_sock_mark_closed(struct rpc_xprt *xprt)
    4411     clear_bit(XPRT_CLOSE_WAIT, &xprt->state);
    4412     clear_bit(XPRT_CLOSING, &xprt->state);
    4413     smp_mb__after_clear_bit();
    4414     +}
    4415     +
    4416     +static void xs_sock_mark_closed(struct rpc_xprt *xprt)
    4417     +{
    4418     + xs_sock_reset_connection_flags(xprt);
    4419     /* Mark transport as closed and wake up all pending tasks */
    4420     xprt_disconnect_done(xprt);
    4421     }
    4422     @@ -1525,6 +1527,7 @@ static void xs_tcp_state_change(struct sock *sk)
    4423     case TCP_CLOSE_WAIT:
    4424     /* The server initiated a shutdown of the socket */
    4425     xprt->connect_cookie++;
    4426     + clear_bit(XPRT_CONNECTED, &xprt->state);
    4427     xs_tcp_force_close(xprt);
    4428     case TCP_CLOSING:
    4429     /*
    4430     @@ -1549,25 +1552,6 @@ static void xs_tcp_state_change(struct sock *sk)
    4431     read_unlock_bh(&sk->sk_callback_lock);
    4432     }
    4433    
    4434     -/**
    4435     - * xs_error_report - callback mainly for catching socket errors
    4436     - * @sk: socket
    4437     - */
    4438     -static void xs_error_report(struct sock *sk)
    4439     -{
    4440     - struct rpc_xprt *xprt;
    4441     -
    4442     - read_lock_bh(&sk->sk_callback_lock);
    4443     - if (!(xprt = xprt_from_sock(sk)))
    4444     - goto out;
    4445     - dprintk("RPC: %s client %p...\n"
    4446     - "RPC: error %d\n",
    4447     - __func__, xprt, sk->sk_err);
    4448     - xprt_wake_pending_tasks(xprt, -EAGAIN);
    4449     -out:
    4450     - read_unlock_bh(&sk->sk_callback_lock);
    4451     -}
    4452     -
    4453     static void xs_write_space(struct sock *sk)
    4454     {
    4455     struct socket *sock;
    4456     @@ -1867,7 +1851,6 @@ static int xs_local_finish_connecting(struct rpc_xprt *xprt,
    4457     sk->sk_user_data = xprt;
    4458     sk->sk_data_ready = xs_local_data_ready;
    4459     sk->sk_write_space = xs_udp_write_space;
    4460     - sk->sk_error_report = xs_error_report;
    4461     sk->sk_allocation = GFP_ATOMIC;
    4462    
    4463     xprt_clear_connected(xprt);
    4464     @@ -1995,7 +1978,6 @@ static void xs_udp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
    4465     sk->sk_user_data = xprt;
    4466     sk->sk_data_ready = xs_udp_data_ready;
    4467     sk->sk_write_space = xs_udp_write_space;
    4468     - sk->sk_error_report = xs_error_report;
    4469     sk->sk_no_check = UDP_CSUM_NORCV;
    4470     sk->sk_allocation = GFP_ATOMIC;
    4471    
    4472     @@ -2065,10 +2047,8 @@ static void xs_abort_connection(struct sock_xprt *transport)
    4473     any.sa_family = AF_UNSPEC;
    4474     result = kernel_connect(transport->sock, &any, sizeof(any), 0);
    4475     if (!result)
    4476     - xs_sock_mark_closed(&transport->xprt);
    4477     - else
    4478     - dprintk("RPC: AF_UNSPEC connect return code %d\n",
    4479     - result);
    4480     + xs_sock_reset_connection_flags(&transport->xprt);
    4481     + dprintk("RPC: AF_UNSPEC connect return code %d\n", result);
    4482     }
    4483    
    4484     static void xs_tcp_reuse_connection(struct sock_xprt *transport)
    4485     @@ -2113,7 +2093,6 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
    4486     sk->sk_data_ready = xs_tcp_data_ready;
    4487     sk->sk_state_change = xs_tcp_state_change;
    4488     sk->sk_write_space = xs_tcp_write_space;
    4489     - sk->sk_error_report = xs_error_report;
    4490     sk->sk_allocation = GFP_ATOMIC;
    4491    
    4492     /* socket options */
    4493     diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
    4494     index 1cdb1d5..9ea174f 100644
    4495     --- a/net/wireless/mlme.c
    4496     +++ b/net/wireless/mlme.c
    4497     @@ -457,20 +457,14 @@ int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
    4498     .reason_code = reason,
    4499     .ie = ie,
    4500     .ie_len = ie_len,
    4501     + .local_state_change = local_state_change,
    4502     };
    4503    
    4504     ASSERT_WDEV_LOCK(wdev);
    4505    
    4506     - if (local_state_change) {
    4507     - if (wdev->current_bss &&
    4508     - ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
    4509     - cfg80211_unhold_bss(wdev->current_bss);
    4510     - cfg80211_put_bss(&wdev->current_bss->pub);
    4511     - wdev->current_bss = NULL;
    4512     - }
    4513     -
    4514     + if (local_state_change && (!wdev->current_bss ||
    4515     + !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
    4516     return 0;
    4517     - }
    4518    
    4519     return rdev->ops->deauth(&rdev->wiphy, dev, &req);
    4520     }
    4521     diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    4522     index 155cbd2..70ce60f 100644
    4523     --- a/sound/pci/hda/patch_realtek.c
    4524     +++ b/sound/pci/hda/patch_realtek.c
    4525     @@ -5704,6 +5704,7 @@ static const struct hda_verb alc268_beep_init_verbs[] = {
    4526    
    4527     enum {
    4528     ALC268_FIXUP_INV_DMIC,
    4529     + ALC268_FIXUP_HP_EAPD,
    4530     };
    4531    
    4532     static const struct alc_fixup alc268_fixups[] = {
    4533     @@ -5711,10 +5712,26 @@ static const struct alc_fixup alc268_fixups[] = {
    4534     .type = ALC_FIXUP_FUNC,
    4535     .v.func = alc_fixup_inv_dmic_0x12,
    4536     },
    4537     + [ALC268_FIXUP_HP_EAPD] = {
    4538     + .type = ALC_FIXUP_VERBS,
    4539     + .v.verbs = (const struct hda_verb[]) {
    4540     + {0x15, AC_VERB_SET_EAPD_BTLENABLE, 0},
    4541     + {}
    4542     + }
    4543     + },
    4544     };
    4545    
    4546     static const struct alc_model_fixup alc268_fixup_models[] = {
    4547     {.id = ALC268_FIXUP_INV_DMIC, .name = "inv-dmic"},
    4548     + {.id = ALC268_FIXUP_HP_EAPD, .name = "hp-eapd"},
    4549     + {}
    4550     +};
    4551     +
    4552     +static const struct snd_pci_quirk alc268_fixup_tbl[] = {
    4553     + /* below is codec SSID since multiple Toshiba laptops have the
    4554     + * same PCI SSID 1179:ff00
    4555     + */
    4556     + SND_PCI_QUIRK(0x1179, 0xff06, "Toshiba P200", ALC268_FIXUP_HP_EAPD),
    4557     {}
    4558     };
    4559    
    4560     @@ -5749,7 +5766,7 @@ static int patch_alc268(struct hda_codec *codec)
    4561    
    4562     spec = codec->spec;
    4563    
    4564     - alc_pick_fixup(codec, alc268_fixup_models, NULL, alc268_fixups);
    4565     + alc_pick_fixup(codec, alc268_fixup_models, alc268_fixup_tbl, alc268_fixups);
    4566     alc_apply_fixup(codec, ALC_FIXUP_ACT_PRE_PROBE);
    4567    
    4568     /* automatic parse from the BIOS config */
    4569     @@ -6214,6 +6231,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
    4570     SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE),
    4571     SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK),
    4572     SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK),
    4573     + SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK),
    4574     SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK),
    4575     SND_PCI_QUIRK(0x17aa, 0x2203, "Thinkpad X230 Tablet", ALC269_FIXUP_LENOVO_DOCK),
    4576     SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
    4577     diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c
    4578     index af0f22f..aca6edc 100644
    4579     --- a/usr/gen_init_cpio.c
    4580     +++ b/usr/gen_init_cpio.c
    4581     @@ -303,7 +303,7 @@ static int cpio_mkfile(const char *name, const char *location,
    4582     int retval;
    4583     int rc = -1;
    4584     int namesize;
    4585     - int i;
    4586     + unsigned int i;
    4587    
    4588     mode |= S_IFREG;
    4589    
    4590     @@ -381,25 +381,28 @@ error:
    4591    
    4592     static char *cpio_replace_env(char *new_location)
    4593     {
    4594     - char expanded[PATH_MAX + 1];
    4595     - char env_var[PATH_MAX + 1];
    4596     - char *start;
    4597     - char *end;
    4598     -
    4599     - for (start = NULL; (start = strstr(new_location, "${")); ) {
    4600     - end = strchr(start, '}');
    4601     - if (start < end) {
    4602     - *env_var = *expanded = '\0';
    4603     - strncat(env_var, start + 2, end - start - 2);
    4604     - strncat(expanded, new_location, start - new_location);
    4605     - strncat(expanded, getenv(env_var), PATH_MAX);
    4606     - strncat(expanded, end + 1, PATH_MAX);
    4607     - strncpy(new_location, expanded, PATH_MAX);
    4608     - } else
    4609     - break;
    4610     - }
    4611     -
    4612     - return new_location;
    4613     + char expanded[PATH_MAX + 1];
    4614     + char env_var[PATH_MAX + 1];
    4615     + char *start;
    4616     + char *end;
    4617     +
    4618     + for (start = NULL; (start = strstr(new_location, "${")); ) {
    4619     + end = strchr(start, '}');
    4620     + if (start < end) {
    4621     + *env_var = *expanded = '\0';
    4622     + strncat(env_var, start + 2, end - start - 2);
    4623     + strncat(expanded, new_location, start - new_location);
    4624     + strncat(expanded, getenv(env_var),
    4625     + PATH_MAX - strlen(expanded));
    4626     + strncat(expanded, end + 1,
    4627     + PATH_MAX - strlen(expanded));
    4628     + strncpy(new_location, expanded, PATH_MAX);
    4629     + new_location[PATH_MAX] = 0;
    4630     + } else
    4631     + break;
    4632     + }
    4633     +
    4634     + return new_location;
    4635     }
    4636    
    4637