Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-2.6.27-r3/0104-2.6.27.5-all-fixes.patch

    Annotation of /trunk/kernel26-alx/patches-2.6.27-r3/0104-2.6.27.5-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1176 - (hide annotations) (download)
    Thu Oct 14 15:11:06 2010 UTC (13 years, 7 months ago) by niro
    File size: 82542 byte(s) 
    -2.6.27-alx-r3: new magellan 0.5.2 kernel
    1 niro 1176 diff --git a/Documentation/i2c/busses/i2c-sis96x b/Documentation/i2c/busses/i2c-sis96x
    2     index 266481f..70e6a0c 100644
    3     --- a/Documentation/i2c/busses/i2c-sis96x
    4     +++ b/Documentation/i2c/busses/i2c-sis96x
    5     @@ -42,7 +42,7 @@ I suspect that this driver could be made to work for the following SiS
    6     chipsets as well: 635, and 635T. If anyone owns a board with those chips
    7     AND is willing to risk crashing & burning an otherwise well-behaved kernel
    8     in the name of progress... please contact me at <mhoffman@lightlink.com> or
    9     -via the project's mailing list: <i2c@lm-sensors.org>. Please send bug
    10     +via the linux-i2c mailing list: <linux-i2c@vger.kernel.org>. Please send bug
    11     reports and/or success stories as well.
    12    
    13    
    14     diff --git a/MAINTAINERS b/MAINTAINERS
    15     index 8dae455..ff24d01 100644
    16     --- a/MAINTAINERS
    17     +++ b/MAINTAINERS
    18     @@ -360,7 +360,7 @@ S: Maintained
    19     ALI1563 I2C DRIVER
    20     P: Rudolf Marek
    21     M: r.marek@assembler.cz
    22     -L: i2c@lm-sensors.org
    23     +L: linux-i2c@vger.kernel.org
    24     S: Maintained
    25    
    26     ALPHA PORT
    27     @@ -1681,7 +1681,7 @@ FREESCALE I2C CPM DRIVER
    28     P: Jochen Friedrich
    29     M: jochen@scram.de
    30     L: linuxppc-dev@ozlabs.org
    31     -L: i2c@lm-sensors.org
    32     +L: linux-i2c@vger.kernel.org
    33     S: Maintained
    34    
    35     FREESCALE SOC FS_ENET DRIVER
    36     @@ -1982,7 +1982,7 @@ S: Maintained
    37     I2C/SMBUS STUB DRIVER
    38     P: Mark M. Hoffman
    39     M: mhoffman@lightlink.com
    40     -L: i2c@lm-sensors.org
    41     +L: linux-i2c@vger.kernel.org
    42     S: Maintained
    43    
    44     I2C SUBSYSTEM
    45     @@ -1990,14 +1990,14 @@ P: Jean Delvare (PC drivers, core)
    46     M: khali@linux-fr.org
    47     P: Ben Dooks (embedded platforms)
    48     M: ben-linux@fluff.org
    49     -L: i2c@lm-sensors.org
    50     +L: linux-i2c@vger.kernel.org
    51     T: quilt http://khali.linux-fr.org/devel/linux-2.6/jdelvare-i2c/
    52     S: Maintained
    53    
    54     I2C-TINY-USB DRIVER
    55     P: Till Harbaum
    56     M: till@harbaum.org
    57     -L: i2c@lm-sensors.org
    58     +L: linux-i2c@vger.kernel.org
    59     T: http://www.harbaum.org/till/i2c_tiny_usb
    60     S: Maintained
    61    
    62     @@ -3070,7 +3070,7 @@ S: Maintained
    63     OPENCORES I2C BUS DRIVER
    64     P: Peter Korsgaard
    65     M: jacmet@sunsite.dk
    66     -L: i2c@lm-sensors.org
    67     +L: linux-i2c@vger.kernel.org
    68     S: Maintained
    69    
    70     ORACLE CLUSTER FILESYSTEM 2 (OCFS2)
    71     @@ -3144,7 +3144,7 @@ S: Maintained
    72     PA SEMI SMBUS DRIVER
    73     P: Olof Johansson
    74     M: olof@lixom.net
    75     -L: i2c@lm-sensors.org
    76     +L: linux-i2c@vger.kernel.org
    77     S: Maintained
    78    
    79     PARALLEL PORT SUPPORT
    80     @@ -3280,7 +3280,7 @@ S: Maintained
    81     PNXxxxx I2C DRIVER
    82     P: Vitaly Wool
    83     M: vitalywool@gmail.com
    84     -L: i2c@lm-sensors.org
    85     +L: linux-i2c@vger.kernel.org
    86     S: Maintained
    87    
    88     PPP PROTOCOL DRIVERS AND COMPRESSORS
    89     @@ -3725,7 +3725,7 @@ S: Maintained
    90     SIS 96X I2C/SMBUS DRIVER
    91     P: Mark M. Hoffman
    92     M: mhoffman@lightlink.com
    93     -L: i2c@lm-sensors.org
    94     +L: linux-i2c@vger.kernel.org
    95     S: Maintained
    96    
    97     SIS FRAMEBUFFER DRIVER
    98     @@ -4445,7 +4445,7 @@ S: Maintained
    99     VIAPRO SMBUS DRIVER
    100     P: Jean Delvare
    101     M: khali@linux-fr.org
    102     -L: i2c@lm-sensors.org
    103     +L: linux-i2c@vger.kernel.org
    104     S: Maintained
    105    
    106     VIA VELOCITY NETWORK DRIVER
    107     diff --git a/arch/powerpc/configs/linkstation_defconfig b/arch/powerpc/configs/linkstation_defconfig
    108     index 6fc4c21..d0846ec 100644
    109     --- a/arch/powerpc/configs/linkstation_defconfig
    110     +++ b/arch/powerpc/configs/linkstation_defconfig
    111     @@ -1,7 +1,7 @@
    112     #
    113     # Automatically generated make config: don't edit
    114     -# Linux kernel version: 2.6.27-rc4
    115     -# Thu Aug 21 00:52:05 2008
    116     +# Linux kernel version: 2.6.27
    117     +# Fri Oct 24 00:42:39 2008
    118     #
    119     # CONFIG_PPC64 is not set
    120    
    121     @@ -934,7 +934,7 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4
    122     CONFIG_SERIAL_CORE=y
    123     CONFIG_SERIAL_CORE_CONSOLE=y
    124     # CONFIG_SERIAL_JSM is not set
    125     -CONFIG_SERIAL_OF_PLATFORM=y
    126     +# CONFIG_SERIAL_OF_PLATFORM is not set
    127     CONFIG_UNIX98_PTYS=y
    128     CONFIG_LEGACY_PTYS=y
    129     CONFIG_LEGACY_PTY_COUNT=256
    130     @@ -1211,7 +1211,6 @@ CONFIG_USB_STORAGE=m
    131     # CONFIG_USB_STORAGE_ALAUDA is not set
    132     # CONFIG_USB_STORAGE_ONETOUCH is not set
    133     # CONFIG_USB_STORAGE_KARMA is not set
    134     -# CONFIG_USB_STORAGE_SIERRA is not set
    135     # CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
    136     # CONFIG_USB_LIBUSUAL is not set
    137    
    138     diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
    139     index 8920eea..16319a5 100644
    140     --- a/arch/powerpc/mm/hash_utils_64.c
    141     +++ b/arch/powerpc/mm/hash_utils_64.c
    142     @@ -381,8 +381,10 @@ static int __init htab_dt_scan_hugepage_blocks(unsigned long node,
    143     printk(KERN_INFO "Huge page(16GB) memory: "
    144     "addr = 0x%lX size = 0x%lX pages = %d\n",
    145     phys_addr, block_size, expected_pages);
    146     - lmb_reserve(phys_addr, block_size * expected_pages);
    147     - add_gpage(phys_addr, block_size, expected_pages);
    148     + if (phys_addr + (16 * GB) <= lmb_end_of_DRAM()) {
    149     + lmb_reserve(phys_addr, block_size * expected_pages);
    150     + add_gpage(phys_addr, block_size, expected_pages);
    151     + }
    152     return 0;
    153     }
    154    
    155     diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
    156     index d9a1813..b5ae97e 100644
    157     --- a/arch/powerpc/mm/numa.c
    158     +++ b/arch/powerpc/mm/numa.c
    159     @@ -89,6 +89,48 @@ static int __cpuinit fake_numa_create_new_node(unsigned long end_pfn,
    160     return 0;
    161     }
    162    
    163     +/*
    164     + * get_active_region_work_fn - A helper function for get_node_active_region
    165     + * Returns datax set to the start_pfn and end_pfn if they contain
    166     + * the initial value of datax->start_pfn between them
    167     + * @start_pfn: start page(inclusive) of region to check
    168     + * @end_pfn: end page(exclusive) of region to check
    169     + * @datax: comes in with ->start_pfn set to value to search for and
    170     + * goes out with active range if it contains it
    171     + * Returns 1 if search value is in range else 0
    172     + */
    173     +static int __init get_active_region_work_fn(unsigned long start_pfn,
    174     + unsigned long end_pfn, void *datax)
    175     +{
    176     + struct node_active_region *data;
    177     + data = (struct node_active_region *)datax;
    178     +
    179     + if (start_pfn <= data->start_pfn && end_pfn > data->start_pfn) {
    180     + data->start_pfn = start_pfn;
    181     + data->end_pfn = end_pfn;
    182     + return 1;
    183     + }
    184     + return 0;
    185     +
    186     +}
    187     +
    188     +/*
    189     + * get_node_active_region - Return active region containing start_pfn
    190     + * Active range returned is empty if none found.
    191     + * @start_pfn: The page to return the region for.
    192     + * @node_ar: Returned set to the active region containing start_pfn
    193     + */
    194     +static void __init get_node_active_region(unsigned long start_pfn,
    195     + struct node_active_region *node_ar)
    196     +{
    197     + int nid = early_pfn_to_nid(start_pfn);
    198     +
    199     + node_ar->nid = nid;
    200     + node_ar->start_pfn = start_pfn;
    201     + node_ar->end_pfn = start_pfn;
    202     + work_with_active_regions(nid, get_active_region_work_fn, node_ar);
    203     +}
    204     +
    205     static void __cpuinit map_cpu_to_node(int cpu, int node)
    206     {
    207     numa_cpu_lookup_table[cpu] = node;
    208     @@ -837,38 +879,53 @@ void __init do_init_bootmem(void)
    209     start_pfn, end_pfn);
    210    
    211     free_bootmem_with_active_regions(nid, end_pfn);
    212     + }
    213    
    214     - /* Mark reserved regions on this node */
    215     - for (i = 0; i < lmb.reserved.cnt; i++) {
    216     - unsigned long physbase = lmb.reserved.region[i].base;
    217     - unsigned long size = lmb.reserved.region[i].size;
    218     - unsigned long start_paddr = start_pfn << PAGE_SHIFT;
    219     - unsigned long end_paddr = end_pfn << PAGE_SHIFT;
    220     -
    221     - if (early_pfn_to_nid(physbase >> PAGE_SHIFT) != nid &&
    222     - early_pfn_to_nid((physbase+size-1) >> PAGE_SHIFT) != nid)
    223     - continue;
    224     -
    225     - if (physbase < end_paddr &&
    226     - (physbase+size) > start_paddr) {
    227     - /* overlaps */
    228     - if (physbase < start_paddr) {
    229     - size -= start_paddr - physbase;
    230     - physbase = start_paddr;
    231     - }
    232     -
    233     - if (size > end_paddr - physbase)
    234     - size = end_paddr - physbase;
    235     -
    236     - dbg("reserve_bootmem %lx %lx\n", physbase,
    237     - size);
    238     - reserve_bootmem_node(NODE_DATA(nid), physbase,
    239     - size, BOOTMEM_DEFAULT);
    240     - }
    241     + /* Mark reserved regions */
    242     + for (i = 0; i < lmb.reserved.cnt; i++) {
    243     + unsigned long physbase = lmb.reserved.region[i].base;
    244     + unsigned long size = lmb.reserved.region[i].size;
    245     + unsigned long start_pfn = physbase >> PAGE_SHIFT;
    246     + unsigned long end_pfn = ((physbase + size) >> PAGE_SHIFT);
    247     + struct node_active_region node_ar;
    248     +
    249     + get_node_active_region(start_pfn, &node_ar);
    250     + while (start_pfn < end_pfn &&
    251     + node_ar.start_pfn < node_ar.end_pfn) {
    252     + unsigned long reserve_size = size;
    253     + /*
    254     + * if reserved region extends past active region
    255     + * then trim size to active region
    256     + */
    257     + if (end_pfn > node_ar.end_pfn)
    258     + reserve_size = (node_ar.end_pfn << PAGE_SHIFT)
    259     + - (start_pfn << PAGE_SHIFT);
    260     + dbg("reserve_bootmem %lx %lx nid=%d\n", physbase,
    261     + reserve_size, node_ar.nid);
    262     + reserve_bootmem_node(NODE_DATA(node_ar.nid), physbase,
    263     + reserve_size, BOOTMEM_DEFAULT);
    264     + /*
    265     + * if reserved region is contained in the active region
    266     + * then done.
    267     + */
    268     + if (end_pfn <= node_ar.end_pfn)
    269     + break;
    270     +
    271     + /*
    272     + * reserved region extends past the active region
    273     + * get next active region that contains this
    274     + * reserved region
    275     + */
    276     + start_pfn = node_ar.end_pfn;
    277     + physbase = start_pfn << PAGE_SHIFT;
    278     + size = size - reserve_size;
    279     + get_node_active_region(start_pfn, &node_ar);
    280     }
    281    
    282     - sparse_memory_present_with_active_regions(nid);
    283     }
    284     +
    285     + for_each_online_node(nid)
    286     + sparse_memory_present_with_active_regions(nid);
    287     }
    288    
    289     void __init paging_init(void)
    290     diff --git a/arch/powerpc/platforms/embedded6xx/linkstation.c b/arch/powerpc/platforms/embedded6xx/linkstation.c
    291     index eb5d74e..2ca7be6 100644
    292     --- a/arch/powerpc/platforms/embedded6xx/linkstation.c
    293     +++ b/arch/powerpc/platforms/embedded6xx/linkstation.c
    294     @@ -13,6 +13,7 @@
    295     #include <linux/kernel.h>
    296     #include <linux/initrd.h>
    297     #include <linux/mtd/physmap.h>
    298     +#include <linux/of_platform.h>
    299    
    300     #include <asm/time.h>
    301     #include <asm/prom.h>
    302     @@ -54,6 +55,19 @@ static struct mtd_partition linkstation_physmap_partitions[] = {
    303     },
    304     };
    305    
    306     +static __initdata struct of_device_id of_bus_ids[] = {
    307     + { .type = "soc", },
    308     + { .compatible = "simple-bus", },
    309     + {},
    310     +};
    311     +
    312     +static int __init declare_of_platform_devices(void)
    313     +{
    314     + of_platform_bus_probe(NULL, of_bus_ids, NULL);
    315     + return 0;
    316     +}
    317     +machine_device_initcall(linkstation, declare_of_platform_devices);
    318     +
    319     static int __init linkstation_add_bridge(struct device_node *dev)
    320     {
    321     #ifdef CONFIG_PCI
    322     diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
    323     index 00b9b4d..fdfca4f 100644
    324     --- a/arch/s390/kernel/smp.c
    325     +++ b/arch/s390/kernel/smp.c
    326     @@ -1117,9 +1117,7 @@ out:
    327     return rc;
    328     }
    329    
    330     -static ssize_t __ref rescan_store(struct sys_device *dev,
    331     - struct sysdev_attribute *attr,
    332     - const char *buf,
    333     +static ssize_t __ref rescan_store(struct sysdev_class *class, const char *buf,
    334     size_t count)
    335     {
    336     int rc;
    337     @@ -1127,12 +1125,10 @@ static ssize_t __ref rescan_store(struct sys_device *dev,
    338     rc = smp_rescan_cpus();
    339     return rc ? rc : count;
    340     }
    341     -static SYSDEV_ATTR(rescan, 0200, NULL, rescan_store);
    342     +static SYSDEV_CLASS_ATTR(rescan, 0200, NULL, rescan_store);
    343     #endif /* CONFIG_HOTPLUG_CPU */
    344    
    345     -static ssize_t dispatching_show(struct sys_device *dev,
    346     - struct sysdev_attribute *attr,
    347     - char *buf)
    348     +static ssize_t dispatching_show(struct sysdev_class *class, char *buf)
    349     {
    350     ssize_t count;
    351    
    352     @@ -1142,9 +1138,8 @@ static ssize_t dispatching_show(struct sys_device *dev,
    353     return count;
    354     }
    355    
    356     -static ssize_t dispatching_store(struct sys_device *dev,
    357     - struct sysdev_attribute *attr,
    358     - const char *buf, size_t count)
    359     +static ssize_t dispatching_store(struct sysdev_class *dev, const char *buf,
    360     + size_t count)
    361     {
    362     int val, rc;
    363     char delim;
    364     @@ -1166,7 +1161,8 @@ out:
    365     put_online_cpus();
    366     return rc ? rc : count;
    367     }
    368     -static SYSDEV_ATTR(dispatching, 0644, dispatching_show, dispatching_store);
    369     +static SYSDEV_CLASS_ATTR(dispatching, 0644, dispatching_show,
    370     + dispatching_store);
    371    
    372     static int __init topology_init(void)
    373     {
    374     @@ -1176,13 +1172,11 @@ static int __init topology_init(void)
    375     register_cpu_notifier(&smp_cpu_nb);
    376    
    377     #ifdef CONFIG_HOTPLUG_CPU
    378     - rc = sysfs_create_file(&cpu_sysdev_class.kset.kobj,
    379     - &attr_rescan.attr);
    380     + rc = sysdev_class_create_file(&cpu_sysdev_class, &attr_rescan);
    381     if (rc)
    382     return rc;
    383     #endif
    384     - rc = sysfs_create_file(&cpu_sysdev_class.kset.kobj,
    385     - &attr_dispatching.attr);
    386     + rc = sysdev_class_create_file(&cpu_sysdev_class, &attr_dispatching);
    387     if (rc)
    388     return rc;
    389     for_each_present_cpu(cpu) {
    390     diff --git a/arch/sparc64/kernel/trampoline.S b/arch/sparc64/kernel/trampoline.S
    391     index 704a3af..83abd5a 100644
    392     --- a/arch/sparc64/kernel/trampoline.S
    393     +++ b/arch/sparc64/kernel/trampoline.S
    394     @@ -328,6 +328,12 @@ after_lock_tlb:
    395    
    396     wrpr %g0, 0, %wstate
    397    
    398     + sethi %hi(prom_entry_lock), %g2
    399     +1: ldstub [%g2 + %lo(prom_entry_lock)], %g1
    400     + membar #StoreLoad | #StoreStore
    401     + brnz,pn %g1, 1b
    402     + nop
    403     +
    404     /* As a hack, put &init_thread_union into %g6.
    405     * prom_world() loads from here to restore the %asi
    406     * register.
    407     @@ -337,7 +343,7 @@ after_lock_tlb:
    408    
    409     sethi %hi(is_sun4v), %o0
    410     lduw [%o0 + %lo(is_sun4v)], %o0
    411     - brz,pt %o0, 1f
    412     + brz,pt %o0, 2f
    413     nop
    414    
    415     TRAP_LOAD_TRAP_BLOCK(%g2, %g3)
    416     @@ -369,10 +375,10 @@ after_lock_tlb:
    417     call %o1
    418     add %sp, (2047 + 128), %o0
    419    
    420     - ba,pt %xcc, 2f
    421     + ba,pt %xcc, 3f
    422     nop
    423    
    424     -1: sethi %hi(sparc64_ttable_tl0), %o0
    425     +2: sethi %hi(sparc64_ttable_tl0), %o0
    426     set prom_set_trap_table_name, %g2
    427     stx %g2, [%sp + 2047 + 128 + 0x00]
    428     mov 1, %g2
    429     @@ -386,7 +392,11 @@ after_lock_tlb:
    430     call %o1
    431     add %sp, (2047 + 128), %o0
    432    
    433     -2: ldx [%l0], %g6
    434     +3: sethi %hi(prom_entry_lock), %g2
    435     + stb %g0, [%g2 + %lo(prom_entry_lock)]
    436     + membar #StoreStore | #StoreLoad
    437     +
    438     + ldx [%l0], %g6
    439     ldx [%g6 + TI_TASK], %g4
    440    
    441     mov 1, %g5
    442     diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
    443     index e12e0e4..5a7c539 100644
    444     --- a/arch/x86/kernel/process_64.c
    445     +++ b/arch/x86/kernel/process_64.c
    446     @@ -729,12 +729,12 @@ unsigned long get_wchan(struct task_struct *p)
    447     if (!p || p == current || p->state==TASK_RUNNING)
    448     return 0;
    449     stack = (unsigned long)task_stack_page(p);
    450     - if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE)
    451     + if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
    452     return 0;
    453     fp = *(u64 *)(p->thread.sp);
    454     do {
    455     if (fp < (unsigned long)stack ||
    456     - fp > (unsigned long)stack+THREAD_SIZE)
    457     + fp >= (unsigned long)stack+THREAD_SIZE)
    458     return 0;
    459     ip = *(u64 *)(fp+8);
    460     if (!in_sched_functions(ip))
    461     diff --git a/arch/x86/kernel/rtc.c b/arch/x86/kernel/rtc.c
    462     index 05191bb..0a23b57 100644
    463     --- a/arch/x86/kernel/rtc.c
    464     +++ b/arch/x86/kernel/rtc.c
    465     @@ -223,11 +223,25 @@ static struct platform_device rtc_device = {
    466     static __init int add_rtc_cmos(void)
    467     {
    468     #ifdef CONFIG_PNP
    469     - if (!pnp_platform_devices)
    470     - platform_device_register(&rtc_device);
    471     -#else
    472     + static const char *ids[] __initconst =
    473     + { "PNP0b00", "PNP0b01", "PNP0b02", };
    474     + struct pnp_dev *dev;
    475     + struct pnp_id *id;
    476     + int i;
    477     +
    478     + pnp_for_each_dev(dev) {
    479     + for (id = dev->id; id; id = id->next) {
    480     + for (i = 0; i < ARRAY_SIZE(ids); i++) {
    481     + if (compare_pnp_id(id, ids[i]) != 0)
    482     + return 0;
    483     + }
    484     + }
    485     + }
    486     +#endif
    487     +
    488     platform_device_register(&rtc_device);
    489     -#endif /* CONFIG_PNP */
    490     + dev_info(&rtc_device.dev,
    491     + "registered platform RTC device (no PNP device found)\n");
    492     return 0;
    493     }
    494     device_initcall(add_rtc_cmos);
    495     diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
    496     index 2a50e0f..ac144c2 100644
    497     --- a/arch/x86/mm/pat.c
    498     +++ b/arch/x86/mm/pat.c
    499     @@ -403,12 +403,16 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
    500     return 1;
    501     }
    502     #else
    503     +/* This check is needed to avoid cache aliasing when PAT is enabled */
    504     static inline int range_is_allowed(unsigned long pfn, unsigned long size)
    505     {
    506     u64 from = ((u64)pfn) << PAGE_SHIFT;
    507     u64 to = from + size;
    508     u64 cursor = from;
    509    
    510     + if (!pat_enabled)
    511     + return 1;
    512     +
    513     while (cursor < to) {
    514     if (!devmem_is_allowed(pfn)) {
    515     printk(KERN_INFO
    516     diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
    517     index 1dfec41..59352d9 100644
    518     --- a/drivers/acpi/button.c
    519     +++ b/drivers/acpi/button.c
    520     @@ -262,6 +262,7 @@ static int acpi_lid_send_state(struct acpi_button *button)
    521     return -ENODEV;
    522     /* input layer checks if event is redundant */
    523     input_report_switch(button->input, SW_LID, !state);
    524     + input_sync(button->input);
    525     return 0;
    526     }
    527    
    528     @@ -285,8 +286,8 @@ static void acpi_button_notify(acpi_handle handle, u32 event, void *data)
    529     input_report_key(input, keycode, 1);
    530     input_sync(input);
    531     input_report_key(input, keycode, 0);
    532     + input_sync(input);
    533     }
    534     - input_sync(input);
    535    
    536     acpi_bus_generate_proc_event(button->device, event,
    537     ++button->pushed);
    538     diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
    539     index 13593f9..444cd9e 100644
    540     --- a/drivers/acpi/ec.c
    541     +++ b/drivers/acpi/ec.c
    542     @@ -1,7 +1,7 @@
    543     /*
    544     - * ec.c - ACPI Embedded Controller Driver (v2.0)
    545     + * ec.c - ACPI Embedded Controller Driver (v2.1)
    546     *
    547     - * Copyright (C) 2006, 2007 Alexey Starikovskiy <alexey.y.starikovskiy@intel.com>
    548     + * Copyright (C) 2006-2008 Alexey Starikovskiy <astarikovskiy@suse.de>
    549     * Copyright (C) 2006 Denis Sadykov <denis.m.sadykov@intel.com>
    550     * Copyright (C) 2004 Luming Yu <luming.yu@intel.com>
    551     * Copyright (C) 2001, 2002 Andy Grover <andrew.grover@intel.com>
    552     @@ -26,7 +26,7 @@
    553     * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    554     */
    555    
    556     -/* Uncomment next line to get verbose print outs*/
    557     +/* Uncomment next line to get verbose printout */
    558     /* #define DEBUG */
    559    
    560     #include <linux/kernel.h>
    561     @@ -38,6 +38,7 @@
    562     #include <linux/seq_file.h>
    563     #include <linux/interrupt.h>
    564     #include <linux/list.h>
    565     +#include <linux/spinlock.h>
    566     #include <asm/io.h>
    567     #include <acpi/acpi_bus.h>
    568     #include <acpi/acpi_drivers.h>
    569     @@ -65,22 +66,21 @@ enum ec_command {
    570     ACPI_EC_COMMAND_QUERY = 0x84,
    571     };
    572    
    573     -/* EC events */
    574     -enum ec_event {
    575     - ACPI_EC_EVENT_OBF_1 = 1, /* Output buffer full */
    576     - ACPI_EC_EVENT_IBF_0, /* Input buffer empty */
    577     -};
    578     -
    579     #define ACPI_EC_DELAY 500 /* Wait 500ms max. during EC ops */
    580     #define ACPI_EC_UDELAY_GLK 1000 /* Wait 1ms max. to get global lock */
    581     #define ACPI_EC_UDELAY 100 /* Wait 100us before polling EC again */
    582    
    583     +#define ACPI_EC_STORM_THRESHOLD 20 /* number of false interrupts
    584     + per one transaction */
    585     +
    586     enum {
    587     - EC_FLAGS_WAIT_GPE = 0, /* Don't check status until GPE arrives */
    588     EC_FLAGS_QUERY_PENDING, /* Query is pending */
    589     - EC_FLAGS_GPE_MODE, /* Expect GPE to be sent for status change */
    590     + EC_FLAGS_GPE_MODE, /* Expect GPE to be sent
    591     + * for status change */
    592     EC_FLAGS_NO_GPE, /* Don't use GPE mode */
    593     - EC_FLAGS_RESCHEDULE_POLL /* Re-schedule poll */
    594     + EC_FLAGS_GPE_STORM, /* GPE storm detected */
    595     + EC_FLAGS_HANDLERS_INSTALLED /* Handlers for GPE and
    596     + * OpReg are installed */
    597     };
    598    
    599     /* If we find an EC via the ECDT, we need to keep a ptr to its context */
    600     @@ -95,6 +95,15 @@ struct acpi_ec_query_handler {
    601     u8 query_bit;
    602     };
    603    
    604     +struct transaction {
    605     + const u8 *wdata;
    606     + u8 *rdata;
    607     + unsigned short irq_count;
    608     + u8 command;
    609     + u8 wlen;
    610     + u8 rlen;
    611     +};
    612     +
    613     static struct acpi_ec {
    614     acpi_handle handle;
    615     unsigned long gpe;
    616     @@ -105,9 +114,8 @@ static struct acpi_ec {
    617     struct mutex lock;
    618     wait_queue_head_t wait;
    619     struct list_head list;
    620     - struct delayed_work work;
    621     - atomic_t irq_count;
    622     - u8 handlers_installed;
    623     + struct transaction *curr;
    624     + spinlock_t curr_lock;
    625     } *boot_ec, *first_ec;
    626    
    627     /*
    628     @@ -150,7 +158,7 @@ static inline u8 acpi_ec_read_data(struct acpi_ec *ec)
    629     {
    630     u8 x = inb(ec->data_addr);
    631     pr_debug(PREFIX "---> data = 0x%2.2x\n", x);
    632     - return inb(ec->data_addr);
    633     + return x;
    634     }
    635    
    636     static inline void acpi_ec_write_cmd(struct acpi_ec *ec, u8 command)
    637     @@ -165,158 +173,172 @@ static inline void acpi_ec_write_data(struct acpi_ec *ec, u8 data)
    638     outb(data, ec->data_addr);
    639     }
    640    
    641     -static inline int acpi_ec_check_status(struct acpi_ec *ec, enum ec_event event)
    642     +static int ec_transaction_done(struct acpi_ec *ec)
    643     {
    644     - if (test_bit(EC_FLAGS_WAIT_GPE, &ec->flags))
    645     - return 0;
    646     - if (event == ACPI_EC_EVENT_OBF_1) {
    647     - if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_OBF)
    648     - return 1;
    649     - } else if (event == ACPI_EC_EVENT_IBF_0) {
    650     - if (!(acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF))
    651     - return 1;
    652     - }
    653     -
    654     - return 0;
    655     + unsigned long flags;
    656     + int ret = 0;
    657     + spin_lock_irqsave(&ec->curr_lock, flags);
    658     + if (!ec->curr || (!ec->curr->wlen && !ec->curr->rlen))
    659     + ret = 1;
    660     + spin_unlock_irqrestore(&ec->curr_lock, flags);
    661     + return ret;
    662     }
    663    
    664     -static void ec_schedule_ec_poll(struct acpi_ec *ec)
    665     +static void gpe_transaction(struct acpi_ec *ec, u8 status)
    666     {
    667     - if (test_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags))
    668     - schedule_delayed_work(&ec->work,
    669     - msecs_to_jiffies(ACPI_EC_DELAY));
    670     + unsigned long flags;
    671     + spin_lock_irqsave(&ec->curr_lock, flags);
    672     + if (!ec->curr)
    673     + goto unlock;
    674     + if (ec->curr->wlen > 0) {
    675     + if ((status & ACPI_EC_FLAG_IBF) == 0) {
    676     + acpi_ec_write_data(ec, *(ec->curr->wdata++));
    677     + --ec->curr->wlen;
    678     + } else
    679     + /* false interrupt, state didn't change */
    680     + ++ec->curr->irq_count;
    681     +
    682     + } else if (ec->curr->rlen > 0) {
    683     + if ((status & ACPI_EC_FLAG_OBF) == 1) {
    684     + *(ec->curr->rdata++) = acpi_ec_read_data(ec);
    685     + --ec->curr->rlen;
    686     + } else
    687     + /* false interrupt, state didn't change */
    688     + ++ec->curr->irq_count;
    689     + }
    690     +unlock:
    691     + spin_unlock_irqrestore(&ec->curr_lock, flags);
    692     }
    693    
    694     -static void ec_switch_to_poll_mode(struct acpi_ec *ec)
    695     +static int acpi_ec_wait(struct acpi_ec *ec)
    696     {
    697     + if (wait_event_timeout(ec->wait, ec_transaction_done(ec),
    698     + msecs_to_jiffies(ACPI_EC_DELAY)))
    699     + return 0;
    700     + /* missing GPEs, switch back to poll mode */
    701     + if (printk_ratelimit())
    702     + pr_info(PREFIX "missing confirmations, "
    703     + "switch off interrupt mode.\n");
    704     set_bit(EC_FLAGS_NO_GPE, &ec->flags);
    705     clear_bit(EC_FLAGS_GPE_MODE, &ec->flags);
    706     - acpi_disable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
    707     - set_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags);
    708     + return 1;
    709     }
    710    
    711     -static int acpi_ec_wait(struct acpi_ec *ec, enum ec_event event, int force_poll)
    712     +static void acpi_ec_gpe_query(void *ec_cxt);
    713     +
    714     +static int ec_check_sci(struct acpi_ec *ec, u8 state)
    715     {
    716     - atomic_set(&ec->irq_count, 0);
    717     - if (likely(test_bit(EC_FLAGS_GPE_MODE, &ec->flags)) &&
    718     - likely(!force_poll)) {
    719     - if (wait_event_timeout(ec->wait, acpi_ec_check_status(ec, event),
    720     - msecs_to_jiffies(ACPI_EC_DELAY)))
    721     - return 0;
    722     - clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
    723     - if (acpi_ec_check_status(ec, event)) {
    724     - /* missing GPEs, switch back to poll mode */
    725     - if (printk_ratelimit())
    726     - pr_info(PREFIX "missing confirmations, "
    727     - "switch off interrupt mode.\n");
    728     - ec_switch_to_poll_mode(ec);
    729     - ec_schedule_ec_poll(ec);
    730     - return 0;
    731     - }
    732     - } else {
    733     - unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY);
    734     - clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
    735     - while (time_before(jiffies, delay)) {
    736     - if (acpi_ec_check_status(ec, event))
    737     - return 0;
    738     - msleep(1);
    739     - }
    740     - if (acpi_ec_check_status(ec,event))
    741     + if (state & ACPI_EC_FLAG_SCI) {
    742     + if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
    743     + return acpi_os_execute(OSL_EC_BURST_HANDLER,
    744     + acpi_ec_gpe_query, ec);
    745     + }
    746     + return 0;
    747     +}
    748     +
    749     +static int ec_poll(struct acpi_ec *ec)
    750     +{
    751     + unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY);
    752     + msleep(1);
    753     + while (time_before(jiffies, delay)) {
    754     + gpe_transaction(ec, acpi_ec_read_status(ec));
    755     + msleep(1);
    756     + if (ec_transaction_done(ec))
    757     return 0;
    758     }
    759     - pr_err(PREFIX "acpi_ec_wait timeout, status = 0x%2.2x, event = %s\n",
    760     - acpi_ec_read_status(ec),
    761     - (event == ACPI_EC_EVENT_OBF_1) ? "\"b0=1\"" : "\"b1=0\"");
    762     return -ETIME;
    763     }
    764    
    765     -static int acpi_ec_transaction_unlocked(struct acpi_ec *ec, u8 command,
    766     - const u8 * wdata, unsigned wdata_len,
    767     - u8 * rdata, unsigned rdata_len,
    768     +static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,
    769     + struct transaction *t,
    770     int force_poll)
    771     {
    772     - int result = 0;
    773     - set_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
    774     + unsigned long tmp;
    775     + int ret = 0;
    776     pr_debug(PREFIX "transaction start\n");
    777     - acpi_ec_write_cmd(ec, command);
    778     - for (; wdata_len > 0; --wdata_len) {
    779     - result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, force_poll);
    780     - if (result) {
    781     - pr_err(PREFIX
    782     - "write_cmd timeout, command = %d\n", command);
    783     - goto end;
    784     - }
    785     - set_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
    786     - acpi_ec_write_data(ec, *(wdata++));
    787     + /* disable GPE during transaction if storm is detected */
    788     + if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
    789     + clear_bit(EC_FLAGS_GPE_MODE, &ec->flags);
    790     + acpi_disable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
    791     }
    792     -
    793     - if (!rdata_len) {
    794     - result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, force_poll);
    795     - if (result) {
    796     - pr_err(PREFIX
    797     - "finish-write timeout, command = %d\n", command);
    798     - goto end;
    799     - }
    800     - } else if (command == ACPI_EC_COMMAND_QUERY)
    801     + /* start transaction */
    802     + spin_lock_irqsave(&ec->curr_lock, tmp);
    803     + /* following two actions should be kept atomic */
    804     + t->irq_count = 0;
    805     + ec->curr = t;
    806     + acpi_ec_write_cmd(ec, ec->curr->command);
    807     + if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
    808     clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
    809     -
    810     - for (; rdata_len > 0; --rdata_len) {
    811     - result = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF_1, force_poll);
    812     - if (result) {
    813     - pr_err(PREFIX "read timeout, command = %d\n", command);
    814     - goto end;
    815     - }
    816     - /* Don't expect GPE after last read */
    817     - if (rdata_len > 1)
    818     - set_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
    819     - *(rdata++) = acpi_ec_read_data(ec);
    820     - }
    821     - end:
    822     + spin_unlock_irqrestore(&ec->curr_lock, tmp);
    823     + /* if we selected poll mode or failed in GPE-mode do a poll loop */
    824     + if (force_poll ||
    825     + !test_bit(EC_FLAGS_GPE_MODE, &ec->flags) ||
    826     + acpi_ec_wait(ec))
    827     + ret = ec_poll(ec);
    828     pr_debug(PREFIX "transaction end\n");
    829     - return result;
    830     + spin_lock_irqsave(&ec->curr_lock, tmp);
    831     + ec->curr = NULL;
    832     + spin_unlock_irqrestore(&ec->curr_lock, tmp);
    833     + if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
    834     + /* check if we received SCI during transaction */
    835     + ec_check_sci(ec, acpi_ec_read_status(ec));
    836     + /* it is safe to enable GPE outside of transaction */
    837     + acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
    838     + } else if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
    839     + t->irq_count > ACPI_EC_STORM_THRESHOLD) {
    840     + pr_debug(PREFIX "GPE storm detected\n");
    841     + set_bit(EC_FLAGS_GPE_STORM, &ec->flags);
    842     + }
    843     + return ret;
    844     +}
    845     +
    846     +static int ec_check_ibf0(struct acpi_ec *ec)
    847     +{
    848     + u8 status = acpi_ec_read_status(ec);
    849     + return (status & ACPI_EC_FLAG_IBF) == 0;
    850     }
    851    
    852     -static int acpi_ec_transaction(struct acpi_ec *ec, u8 command,
    853     - const u8 * wdata, unsigned wdata_len,
    854     - u8 * rdata, unsigned rdata_len,
    855     +static int ec_wait_ibf0(struct acpi_ec *ec)
    856     +{
    857     + unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY);
    858     + /* interrupt wait manually if GPE mode is not active */
    859     + unsigned long timeout = test_bit(EC_FLAGS_GPE_MODE, &ec->flags) ?
    860     + msecs_to_jiffies(ACPI_EC_DELAY) : msecs_to_jiffies(1);
    861     + while (time_before(jiffies, delay))
    862     + if (wait_event_timeout(ec->wait, ec_check_ibf0(ec), timeout))
    863     + return 0;
    864     + return -ETIME;
    865     +}
    866     +
    867     +static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t,
    868     int force_poll)
    869     {
    870     int status;
    871     u32 glk;
    872     -
    873     - if (!ec || (wdata_len && !wdata) || (rdata_len && !rdata))
    874     + if (!ec || (!t) || (t->wlen && !t->wdata) || (t->rlen && !t->rdata))
    875     return -EINVAL;
    876     -
    877     - if (rdata)
    878     - memset(rdata, 0, rdata_len);
    879     -
    880     + if (t->rdata)
    881     + memset(t->rdata, 0, t->rlen);
    882     mutex_lock(&ec->lock);
    883     if (ec->global_lock) {
    884     status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
    885     if (ACPI_FAILURE(status)) {
    886     - mutex_unlock(&ec->lock);
    887     - return -ENODEV;
    888     + status = -ENODEV;
    889     + goto unlock;
    890     }
    891     }
    892     -
    893     - status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, 0);
    894     - if (status) {
    895     + if (ec_wait_ibf0(ec)) {
    896     pr_err(PREFIX "input buffer is not empty, "
    897     "aborting transaction\n");
    898     + status = -ETIME;
    899     goto end;
    900     }
    901     -
    902     - status = acpi_ec_transaction_unlocked(ec, command,
    903     - wdata, wdata_len,
    904     - rdata, rdata_len,
    905     - force_poll);
    906     -
    907     - end:
    908     -
    909     + status = acpi_ec_transaction_unlocked(ec, t, force_poll);
    910     +end:
    911     if (ec->global_lock)
    912     acpi_release_global_lock(glk);
    913     +unlock:
    914     mutex_unlock(&ec->lock);
    915     -
    916     return status;
    917     }
    918    
    919     @@ -327,21 +349,32 @@ static int acpi_ec_transaction(struct acpi_ec *ec, u8 command,
    920     int acpi_ec_burst_enable(struct acpi_ec *ec)
    921     {
    922     u8 d;
    923     - return acpi_ec_transaction(ec, ACPI_EC_BURST_ENABLE, NULL, 0, &d, 1, 0);
    924     + struct transaction t = {.command = ACPI_EC_BURST_ENABLE,
    925     + .wdata = NULL, .rdata = &d,
    926     + .wlen = 0, .rlen = 1};
    927     +
    928     + return acpi_ec_transaction(ec, &t, 0);
    929     }
    930    
    931     int acpi_ec_burst_disable(struct acpi_ec *ec)
    932     {
    933     - return acpi_ec_transaction(ec, ACPI_EC_BURST_DISABLE, NULL, 0, NULL, 0, 0);
    934     + struct transaction t = {.command = ACPI_EC_BURST_DISABLE,
    935     + .wdata = NULL, .rdata = NULL,
    936     + .wlen = 0, .rlen = 0};
    937     +
    938     + return (acpi_ec_read_status(ec) & ACPI_EC_FLAG_BURST) ?
    939     + acpi_ec_transaction(ec, &t, 0) : 0;
    940     }
    941    
    942     static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 * data)
    943     {
    944     int result;
    945     u8 d;
    946     + struct transaction t = {.command = ACPI_EC_COMMAND_READ,
    947     + .wdata = &address, .rdata = &d,
    948     + .wlen = 1, .rlen = 1};
    949    
    950     - result = acpi_ec_transaction(ec, ACPI_EC_COMMAND_READ,
    951     - &address, 1, &d, 1, 0);
    952     + result = acpi_ec_transaction(ec, &t, 0);
    953     *data = d;
    954     return result;
    955     }
    956     @@ -349,8 +382,11 @@ static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 * data)
    957     static int acpi_ec_write(struct acpi_ec *ec, u8 address, u8 data)
    958     {
    959     u8 wdata[2] = { address, data };
    960     - return acpi_ec_transaction(ec, ACPI_EC_COMMAND_WRITE,
    961     - wdata, 2, NULL, 0, 0);
    962     + struct transaction t = {.command = ACPI_EC_COMMAND_WRITE,
    963     + .wdata = wdata, .rdata = NULL,
    964     + .wlen = 2, .rlen = 0};
    965     +
    966     + return acpi_ec_transaction(ec, &t, 0);
    967     }
    968    
    969     /*
    970     @@ -412,12 +448,13 @@ int ec_transaction(u8 command,
    971     u8 * rdata, unsigned rdata_len,
    972     int force_poll)
    973     {
    974     + struct transaction t = {.command = command,
    975     + .wdata = wdata, .rdata = rdata,
    976     + .wlen = wdata_len, .rlen = rdata_len};
    977     if (!first_ec)
    978     return -ENODEV;
    979    
    980     - return acpi_ec_transaction(first_ec, command, wdata,
    981     - wdata_len, rdata, rdata_len,
    982     - force_poll);
    983     + return acpi_ec_transaction(first_ec, &t, force_poll);
    984     }
    985    
    986     EXPORT_SYMBOL(ec_transaction);
    987     @@ -426,7 +463,9 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 * data)
    988     {
    989     int result;
    990     u8 d;
    991     -
    992     + struct transaction t = {.command = ACPI_EC_COMMAND_QUERY,
    993     + .wdata = NULL, .rdata = &d,
    994     + .wlen = 0, .rlen = 1};
    995     if (!ec || !data)
    996     return -EINVAL;
    997    
    998     @@ -436,7 +475,7 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 * data)
    999     * bit to be cleared (and thus clearing the interrupt source).
    1000     */
    1001    
    1002     - result = acpi_ec_transaction(ec, ACPI_EC_COMMAND_QUERY, NULL, 0, &d, 1, 0);
    1003     + result = acpi_ec_transaction(ec, &t, 0);
    1004     if (result)
    1005     return result;
    1006    
    1007     @@ -513,46 +552,26 @@ static void acpi_ec_gpe_query(void *ec_cxt)
    1008    
    1009     static u32 acpi_ec_gpe_handler(void *data)
    1010     {
    1011     - acpi_status status = AE_OK;
    1012     struct acpi_ec *ec = data;
    1013     - u8 state = acpi_ec_read_status(ec);
    1014     + u8 status;
    1015    
    1016     pr_debug(PREFIX "~~~> interrupt\n");
    1017     - atomic_inc(&ec->irq_count);
    1018     - if (atomic_read(&ec->irq_count) > 5) {
    1019     - pr_err(PREFIX "GPE storm detected, disabling EC GPE\n");
    1020     - ec_switch_to_poll_mode(ec);
    1021     - goto end;
    1022     - }
    1023     - clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
    1024     - if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags))
    1025     + status = acpi_ec_read_status(ec);
    1026     +
    1027     + gpe_transaction(ec, status);
    1028     + if (ec_transaction_done(ec) && (status & ACPI_EC_FLAG_IBF) == 0)
    1029     wake_up(&ec->wait);
    1030    
    1031     - if (state & ACPI_EC_FLAG_SCI) {
    1032     - if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
    1033     - status = acpi_os_execute(OSL_EC_BURST_HANDLER,
    1034     - acpi_ec_gpe_query, ec);
    1035     - } else if (!test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
    1036     - !test_bit(EC_FLAGS_NO_GPE, &ec->flags) &&
    1037     - in_interrupt()) {
    1038     + ec_check_sci(ec, status);
    1039     + if (!test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
    1040     + !test_bit(EC_FLAGS_NO_GPE, &ec->flags)) {
    1041     /* this is non-query, must be confirmation */
    1042     if (printk_ratelimit())
    1043     pr_info(PREFIX "non-query interrupt received,"
    1044     " switching to interrupt mode\n");
    1045     set_bit(EC_FLAGS_GPE_MODE, &ec->flags);
    1046     - clear_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags);
    1047     }
    1048     -end:
    1049     - ec_schedule_ec_poll(ec);
    1050     - return ACPI_SUCCESS(status) ?
    1051     - ACPI_INTERRUPT_HANDLED : ACPI_INTERRUPT_NOT_HANDLED;
    1052     -}
    1053     -
    1054     -static void do_ec_poll(struct work_struct *work)
    1055     -{
    1056     - struct acpi_ec *ec = container_of(work, struct acpi_ec, work.work);
    1057     - atomic_set(&ec->irq_count, 0);
    1058     - (void)acpi_ec_gpe_handler(ec);
    1059     + return ACPI_INTERRUPT_HANDLED;
    1060     }
    1061    
    1062     /* --------------------------------------------------------------------------
    1063     @@ -696,8 +715,7 @@ static struct acpi_ec *make_acpi_ec(void)
    1064     mutex_init(&ec->lock);
    1065     init_waitqueue_head(&ec->wait);
    1066     INIT_LIST_HEAD(&ec->list);
    1067     - INIT_DELAYED_WORK_DEFERRABLE(&ec->work, do_ec_poll);
    1068     - atomic_set(&ec->irq_count, 0);
    1069     + spin_lock_init(&ec->curr_lock);
    1070     return ec;
    1071     }
    1072    
    1073     @@ -736,22 +754,15 @@ ec_parse_device(acpi_handle handle, u32 Level, void *context, void **retval)
    1074     return AE_CTRL_TERMINATE;
    1075     }
    1076    
    1077     -static void ec_poll_stop(struct acpi_ec *ec)
    1078     -{
    1079     - clear_bit(EC_FLAGS_RESCHEDULE_POLL, &ec->flags);
    1080     - cancel_delayed_work(&ec->work);
    1081     -}
    1082     -
    1083     static void ec_remove_handlers(struct acpi_ec *ec)
    1084     {
    1085     - ec_poll_stop(ec);
    1086     if (ACPI_FAILURE(acpi_remove_address_space_handler(ec->handle,
    1087     ACPI_ADR_SPACE_EC, &acpi_ec_space_handler)))
    1088     pr_err(PREFIX "failed to remove space handler\n");
    1089     if (ACPI_FAILURE(acpi_remove_gpe_handler(NULL, ec->gpe,
    1090     &acpi_ec_gpe_handler)))
    1091     pr_err(PREFIX "failed to remove gpe handler\n");
    1092     - ec->handlers_installed = 0;
    1093     + clear_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags);
    1094     }
    1095    
    1096     static int acpi_ec_add(struct acpi_device *device)
    1097     @@ -846,17 +857,15 @@ ec_parse_io_ports(struct acpi_resource *resource, void *context)
    1098     static int ec_install_handlers(struct acpi_ec *ec)
    1099     {
    1100     acpi_status status;
    1101     - if (ec->handlers_installed)
    1102     + if (test_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags))
    1103     return 0;
    1104     status = acpi_install_gpe_handler(NULL, ec->gpe,
    1105     - ACPI_GPE_EDGE_TRIGGERED,
    1106     - &acpi_ec_gpe_handler, ec);
    1107     + ACPI_GPE_EDGE_TRIGGERED,
    1108     + &acpi_ec_gpe_handler, ec);
    1109     if (ACPI_FAILURE(status))
    1110     return -ENODEV;
    1111     -
    1112     acpi_set_gpe_type(NULL, ec->gpe, ACPI_GPE_TYPE_RUNTIME);
    1113     acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
    1114     -
    1115     status = acpi_install_address_space_handler(ec->handle,
    1116     ACPI_ADR_SPACE_EC,
    1117     &acpi_ec_space_handler,
    1118     @@ -866,7 +875,7 @@ static int ec_install_handlers(struct acpi_ec *ec)
    1119     return -ENODEV;
    1120     }
    1121    
    1122     - ec->handlers_installed = 1;
    1123     + set_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags);
    1124     return 0;
    1125     }
    1126    
    1127     @@ -887,7 +896,6 @@ static int acpi_ec_start(struct acpi_device *device)
    1128    
    1129     /* EC is fully operational, allow queries */
    1130     clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
    1131     - ec_schedule_ec_poll(ec);
    1132     return ret;
    1133     }
    1134    
    1135     @@ -906,7 +914,7 @@ static int acpi_ec_stop(struct acpi_device *device, int type)
    1136    
    1137     int __init acpi_boot_ec_enable(void)
    1138     {
    1139     - if (!boot_ec || boot_ec->handlers_installed)
    1140     + if (!boot_ec || test_bit(EC_FLAGS_HANDLERS_INSTALLED, &boot_ec->flags))
    1141     return 0;
    1142     if (!ec_install_handlers(boot_ec)) {
    1143     first_ec = boot_ec;
    1144     diff --git a/drivers/acpi/hardware/hwsleep.c b/drivers/acpi/hardware/hwsleep.c
    1145     index ecb6ace..25dccdf 100644
    1146     --- a/drivers/acpi/hardware/hwsleep.c
    1147     +++ b/drivers/acpi/hardware/hwsleep.c
    1148     @@ -612,6 +612,13 @@ acpi_status acpi_leave_sleep_state(u8 sleep_state)
    1149     }
    1150     /* TBD: _WAK "sometimes" returns stuff - do we want to look at it? */
    1151    
    1152     + /*
    1153     + * Some BIOSes assume that WAK_STS will be cleared on resume and use
    1154     + * it to determine whether the system is rebooting or resuming. Clear
    1155     + * it for compatibility.
    1156     + */
    1157     + acpi_set_register(ACPI_BITREG_WAKE_STATUS, 1);
    1158     +
    1159     acpi_gbl_system_awake_and_running = TRUE;
    1160    
    1161     /* Enable power button */
    1162     diff --git a/drivers/acpi/reboot.c b/drivers/acpi/reboot.c
    1163     index a6b662c..755baf2 100644
    1164     --- a/drivers/acpi/reboot.c
    1165     +++ b/drivers/acpi/reboot.c
    1166     @@ -15,9 +15,28 @@ void acpi_reboot(void)
    1167    
    1168     rr = &acpi_gbl_FADT.reset_register;
    1169    
    1170     - /* Is the reset register supported? */
    1171     - if (!(acpi_gbl_FADT.flags & ACPI_FADT_RESET_REGISTER) ||
    1172     - rr->bit_width != 8 || rr->bit_offset != 0)
    1173     + /*
    1174     + * Is the ACPI reset register supported?
    1175     + *
    1176     + * According to ACPI 3.0, FADT.flags.RESET_REG_SUP indicates
    1177     + * whether the ACPI reset mechanism is supported.
    1178     + *
    1179     + * However, some boxes have this bit clear, yet a valid
    1180     + * ACPI_RESET_REG & RESET_VALUE, and ACPI reboot is the only
    1181     + * mechanism that works for them after S3.
    1182     + *
    1183     + * This suggests that other operating systems may not be checking
    1184     + * the RESET_REG_SUP bit, and are using other means to decide
    1185     + * whether to use the ACPI reboot mechanism or not.
    1186     + *
    1187     + * So when acpi reboot is requested,
    1188     + * only the reset_register is checked. If the following
    1189     + * conditions are met, it indicates that the reset register is supported.
    1190     + * a. reset_register is not zero
    1191     + * b. the access width is eight
    1192     + * c. the bit_offset is zero
    1193     + */
    1194     + if (!(rr->address) || rr->bit_width != 8 || rr->bit_offset != 0)
    1195     return;
    1196    
    1197     reset_value = acpi_gbl_FADT.reset_value;
    1198     diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
    1199     index 79e3a8e..8228ae3 100644
    1200     --- a/drivers/ata/libata-core.c
    1201     +++ b/drivers/ata/libata-core.c
    1202     @@ -5259,6 +5259,8 @@ struct ata_port *ata_port_alloc(struct ata_host *host)
    1203    
    1204     #ifdef CONFIG_ATA_SFF
    1205     INIT_DELAYED_WORK(&ap->port_task, ata_pio_task);
    1206     +#else
    1207     + INIT_DELAYED_WORK(&ap->port_task, NULL);
    1208     #endif
    1209     INIT_DELAYED_WORK(&ap->hotplug_task, ata_scsi_hotplug);
    1210     INIT_WORK(&ap->scsi_rescan_task, ata_scsi_dev_rescan);
    1211     diff --git a/drivers/ata/pata_it821x.c b/drivers/ata/pata_it821x.c
    1212     index 0221c9a..35fd67d 100644
    1213     --- a/drivers/ata/pata_it821x.c
    1214     +++ b/drivers/ata/pata_it821x.c
    1215     @@ -557,9 +557,8 @@ static unsigned int it821x_read_id(struct ata_device *adev,
    1216     if (strstr(model_num, "Integrated Technology Express")) {
    1217     /* Set feature bits the firmware neglects */
    1218     id[49] |= 0x0300; /* LBA, DMA */
    1219     - id[82] |= 0x0400; /* LBA48 */
    1220     id[83] &= 0x7FFF;
    1221     - id[83] |= 0x4000; /* Word 83 is valid */
    1222     + id[83] |= 0x4400; /* Word 83 is valid and LBA48 */
    1223     id[86] |= 0x0400; /* LBA48 on */
    1224     id[ATA_ID_MAJOR_VER] |= 0x1F;
    1225     }
    1226     diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
    1227     index 14601dc..8714c36 100644
    1228     --- a/drivers/ata/sata_nv.c
    1229     +++ b/drivers/ata/sata_nv.c
    1230     @@ -307,10 +307,10 @@ static int nv_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val);
    1231    
    1232     static void nv_nf2_freeze(struct ata_port *ap);
    1233     static void nv_nf2_thaw(struct ata_port *ap);
    1234     +static int nv_nf2_hardreset(struct ata_link *link, unsigned int *class,
    1235     + unsigned long deadline);
    1236     static void nv_ck804_freeze(struct ata_port *ap);
    1237     static void nv_ck804_thaw(struct ata_port *ap);
    1238     -static int nv_hardreset(struct ata_link *link, unsigned int *class,
    1239     - unsigned long deadline);
    1240     static int nv_adma_slave_config(struct scsi_device *sdev);
    1241     static int nv_adma_check_atapi_dma(struct ata_queued_cmd *qc);
    1242     static void nv_adma_qc_prep(struct ata_queued_cmd *qc);
    1243     @@ -405,17 +405,8 @@ static struct scsi_host_template nv_swncq_sht = {
    1244     .slave_configure = nv_swncq_slave_config,
    1245     };
    1246    
    1247     -/* OSDL bz3352 reports that some nv controllers can't determine device
    1248     - * signature reliably and nv_hardreset is implemented to work around
    1249     - * the problem. This was reported on nf3 and it's unclear whether any
    1250     - * other controllers are affected. However, the workaround has been
    1251     - * applied to all variants and there isn't much to gain by trying to
    1252     - * find out exactly which ones are affected at this point especially
    1253     - * because NV has moved over to ahci for newer controllers.
    1254     - */
    1255     static struct ata_port_operations nv_common_ops = {
    1256     .inherits = &ata_bmdma_port_ops,
    1257     - .hardreset = nv_hardreset,
    1258     .scr_read = nv_scr_read,
    1259     .scr_write = nv_scr_write,
    1260     };
    1261     @@ -429,12 +420,22 @@ static struct ata_port_operations nv_generic_ops = {
    1262     .hardreset = ATA_OP_NULL,
    1263     };
    1264    
    1265     +/* OSDL bz3352 reports that nf2/3 controllers can't determine device
    1266     + * signature reliably. Also, the following thread reports detection
    1267     + * failure on cold boot with the standard debouncing timing.
    1268     + *
    1269     + * http://thread.gmane.org/gmane.linux.ide/34098
    1270     + *
    1271     + * Debounce with hotplug timing and request follow-up SRST.
    1272     + */
    1273     static struct ata_port_operations nv_nf2_ops = {
    1274     .inherits = &nv_common_ops,
    1275     .freeze = nv_nf2_freeze,
    1276     .thaw = nv_nf2_thaw,
    1277     + .hardreset = nv_nf2_hardreset,
    1278     };
    1279    
    1280     +/* CK804 finally gets hardreset right */
    1281     static struct ata_port_operations nv_ck804_ops = {
    1282     .inherits = &nv_common_ops,
    1283     .freeze = nv_ck804_freeze,
    1284     @@ -443,7 +444,7 @@ static struct ata_port_operations nv_ck804_ops = {
    1285     };
    1286    
    1287     static struct ata_port_operations nv_adma_ops = {
    1288     - .inherits = &nv_common_ops,
    1289     + .inherits = &nv_ck804_ops,
    1290    
    1291     .check_atapi_dma = nv_adma_check_atapi_dma,
    1292     .sff_tf_read = nv_adma_tf_read,
    1293     @@ -467,7 +468,7 @@ static struct ata_port_operations nv_adma_ops = {
    1294     };
    1295    
    1296     static struct ata_port_operations nv_swncq_ops = {
    1297     - .inherits = &nv_common_ops,
    1298     + .inherits = &nv_generic_ops,
    1299    
    1300     .qc_defer = ata_std_qc_defer,
    1301     .qc_prep = nv_swncq_qc_prep,
    1302     @@ -1553,6 +1554,17 @@ static void nv_nf2_thaw(struct ata_port *ap)
    1303     iowrite8(mask, scr_addr + NV_INT_ENABLE);
    1304     }
    1305    
    1306     +static int nv_nf2_hardreset(struct ata_link *link, unsigned int *class,
    1307     + unsigned long deadline)
    1308     +{
    1309     + bool online;
    1310     + int rc;
    1311     +
    1312     + rc = sata_link_hardreset(link, sata_deb_timing_hotplug, deadline,
    1313     + &online, NULL);
    1314     + return online ? -EAGAIN : rc;
    1315     +}
    1316     +
    1317     static void nv_ck804_freeze(struct ata_port *ap)
    1318     {
    1319     void __iomem *mmio_base = ap->host->iomap[NV_MMIO_BAR];
    1320     @@ -1605,21 +1617,6 @@ static void nv_mcp55_thaw(struct ata_port *ap)
    1321     ata_sff_thaw(ap);
    1322     }
    1323    
    1324     -static int nv_hardreset(struct ata_link *link, unsigned int *class,
    1325     - unsigned long deadline)
    1326     -{
    1327     - int rc;
    1328     -
    1329     - /* SATA hardreset fails to retrieve proper device signature on
    1330     - * some controllers. Request follow up SRST. For more info,
    1331     - * see http://bugzilla.kernel.org/show_bug.cgi?id=3352
    1332     - */
    1333     - rc = sata_sff_hardreset(link, class, deadline);
    1334     - if (rc)
    1335     - return rc;
    1336     - return -EAGAIN;
    1337     -}
    1338     -
    1339     static void nv_adma_error_handler(struct ata_port *ap)
    1340     {
    1341     struct nv_adma_port_priv *pp = ap->private_data;
    1342     diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
    1343     index 030665b..b26885f 100644
    1344     --- a/drivers/ata/sata_promise.c
    1345     +++ b/drivers/ata/sata_promise.c
    1346     @@ -153,6 +153,10 @@ static void pdc_freeze(struct ata_port *ap);
    1347     static void pdc_sata_freeze(struct ata_port *ap);
    1348     static void pdc_thaw(struct ata_port *ap);
    1349     static void pdc_sata_thaw(struct ata_port *ap);
    1350     +static int pdc_pata_softreset(struct ata_link *link, unsigned int *class,
    1351     + unsigned long deadline);
    1352     +static int pdc_sata_hardreset(struct ata_link *link, unsigned int *class,
    1353     + unsigned long deadline);
    1354     static void pdc_error_handler(struct ata_port *ap);
    1355     static void pdc_post_internal_cmd(struct ata_queued_cmd *qc);
    1356     static int pdc_pata_cable_detect(struct ata_port *ap);
    1357     @@ -186,6 +190,7 @@ static struct ata_port_operations pdc_sata_ops = {
    1358     .scr_read = pdc_sata_scr_read,
    1359     .scr_write = pdc_sata_scr_write,
    1360     .port_start = pdc_sata_port_start,
    1361     + .hardreset = pdc_sata_hardreset,
    1362     };
    1363    
    1364     /* First-generation chips need a more restrictive ->check_atapi_dma op */
    1365     @@ -200,6 +205,7 @@ static struct ata_port_operations pdc_pata_ops = {
    1366     .freeze = pdc_freeze,
    1367     .thaw = pdc_thaw,
    1368     .port_start = pdc_common_port_start,
    1369     + .softreset = pdc_pata_softreset,
    1370     };
    1371    
    1372     static const struct ata_port_info pdc_port_info[] = {
    1373     @@ -691,6 +697,20 @@ static void pdc_sata_thaw(struct ata_port *ap)
    1374     readl(host_mmio + hotplug_offset); /* flush */
    1375     }
    1376    
    1377     +static int pdc_pata_softreset(struct ata_link *link, unsigned int *class,
    1378     + unsigned long deadline)
    1379     +{
    1380     + pdc_reset_port(link->ap);
    1381     + return ata_sff_softreset(link, class, deadline);
    1382     +}
    1383     +
    1384     +static int pdc_sata_hardreset(struct ata_link *link, unsigned int *class,
    1385     + unsigned long deadline)
    1386     +{
    1387     + pdc_reset_port(link->ap);
    1388     + return sata_sff_hardreset(link, class, deadline);
    1389     +}
    1390     +
    1391     static void pdc_error_handler(struct ata_port *ap)
    1392     {
    1393     if (!(ap->pflags & ATA_PFLAG_FROZEN))
    1394     diff --git a/drivers/base/sys.c b/drivers/base/sys.c
    1395     index 75dd6e2..70499cb 100644
    1396     --- a/drivers/base/sys.c
    1397     +++ b/drivers/base/sys.c
    1398     @@ -488,7 +488,8 @@ ssize_t sysdev_store_ulong(struct sys_device *sysdev,
    1399     if (end == buf)
    1400     return -EINVAL;
    1401     *(unsigned long *)(ea->var) = new;
    1402     - return end - buf;
    1403     + /* Always return full write size even if we didn't consume all */
    1404     + return size;
    1405     }
    1406     EXPORT_SYMBOL_GPL(sysdev_store_ulong);
    1407    
    1408     @@ -511,7 +512,8 @@ ssize_t sysdev_store_int(struct sys_device *sysdev,
    1409     if (end == buf || new > INT_MAX || new < INT_MIN)
    1410     return -EINVAL;
    1411     *(int *)(ea->var) = new;
    1412     - return end - buf;
    1413     + /* Always return full write size even if we didn't consume all */
    1414     + return size;
    1415     }
    1416     EXPORT_SYMBOL_GPL(sysdev_store_int);
    1417    
    1418     diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
    1419     index 016fdf0..f1fe749 100644
    1420     --- a/drivers/char/agp/intel-agp.c
    1421     +++ b/drivers/char/agp/intel-agp.c
    1422     @@ -54,8 +54,7 @@
    1423     agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965Q_HB || \
    1424     agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965G_HB || \
    1425     agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GM_HB || \
    1426     - agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GME_HB || \
    1427     - agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB)
    1428     + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GME_HB)
    1429    
    1430     #define IS_G33 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G33_HB || \
    1431     agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q35_HB || \
    1432     @@ -63,7 +62,8 @@
    1433    
    1434     #define IS_G4X (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGD_E_HB || \
    1435     agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q45_HB || \
    1436     - agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB)
    1437     + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB || \
    1438     + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB)
    1439    
    1440     extern int agp_memory_reserved;
    1441    
    1442     @@ -525,8 +525,10 @@ static void intel_i830_init_gtt_entries(void)
    1443     size += 4;
    1444     } else if (IS_G4X) {
    1445     /* On 4 series hardware, GTT stolen is separate from graphics
    1446     - * stolen, ignore it in stolen gtt entries counting */
    1447     - size = 0;
    1448     + * stolen, ignore it in stolen gtt entries counting. However,
    1449     + * 4KB of the stolen memory doesn't get mapped to the GTT.
    1450     + */
    1451     + size = 4;
    1452     } else {
    1453     /* On previous hardware, the GTT size was just what was
    1454     * required to map the aperture.
    1455     diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
    1456     index 64e1c16..ecaf369 100644
    1457     --- a/drivers/char/ipmi/ipmi_devintf.c
    1458     +++ b/drivers/char/ipmi/ipmi_devintf.c
    1459     @@ -957,3 +957,4 @@ module_exit(cleanup_ipmi);
    1460     MODULE_LICENSE("GPL");
    1461     MODULE_AUTHOR("Corey Minyard <minyard@mvista.com>");
    1462     MODULE_DESCRIPTION("Linux device interface for the IPMI message handler.");
    1463     +MODULE_ALIAS("platform:ipmi_si");
    1464     diff --git a/drivers/firewire/fw-cdev.c b/drivers/firewire/fw-cdev.c
    1465     index 2e6d584..ed03234 100644
    1466     --- a/drivers/firewire/fw-cdev.c
    1467     +++ b/drivers/firewire/fw-cdev.c
    1468     @@ -720,8 +720,8 @@ static int ioctl_create_iso_context(struct client *client, void *buffer)
    1469     #define GET_PAYLOAD_LENGTH(v) ((v) & 0xffff)
    1470     #define GET_INTERRUPT(v) (((v) >> 16) & 0x01)
    1471     #define GET_SKIP(v) (((v) >> 17) & 0x01)
    1472     -#define GET_TAG(v) (((v) >> 18) & 0x02)
    1473     -#define GET_SY(v) (((v) >> 20) & 0x04)
    1474     +#define GET_TAG(v) (((v) >> 18) & 0x03)
    1475     +#define GET_SY(v) (((v) >> 20) & 0x0f)
    1476     #define GET_HEADER_LENGTH(v) (((v) >> 24) & 0xff)
    1477    
    1478     static int ioctl_queue_iso(struct client *client, void *buffer)
    1479     @@ -913,7 +913,7 @@ dispatch_ioctl(struct client *client, unsigned int cmd, void __user *arg)
    1480     return -EFAULT;
    1481     }
    1482    
    1483     - return 0;
    1484     + return retval;
    1485     }
    1486    
    1487     static long
    1488     diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
    1489     index aaff50e..4f73537 100644
    1490     --- a/drivers/firewire/fw-sbp2.c
    1491     +++ b/drivers/firewire/fw-sbp2.c
    1492     @@ -172,6 +172,9 @@ struct sbp2_target {
    1493     int blocked; /* ditto */
    1494     };
    1495    
    1496     +/* Impossible login_id, to detect logout attempt before successful login */
    1497     +#define INVALID_LOGIN_ID 0x10000
    1498     +
    1499     /*
    1500     * Per section 7.4.8 of the SBP-2 spec, a mgt_ORB_timeout value can be
    1501     * provided in the config rom. Most devices do provide a value, which
    1502     @@ -791,9 +794,20 @@ static void sbp2_release_target(struct kref *kref)
    1503     scsi_remove_device(sdev);
    1504     scsi_device_put(sdev);
    1505     }
    1506     - sbp2_send_management_orb(lu, tgt->node_id, lu->generation,
    1507     - SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
    1508     -
    1509     + if (lu->login_id != INVALID_LOGIN_ID) {
    1510     + int generation, node_id;
    1511     + /*
    1512     + * tgt->node_id may be obsolete here if we failed
    1513     + * during initial login or after a bus reset where
    1514     + * the topology changed.
    1515     + */
    1516     + generation = device->generation;
    1517     + smp_rmb(); /* node_id vs. generation */
    1518     + node_id = device->node_id;
    1519     + sbp2_send_management_orb(lu, node_id, generation,
    1520     + SBP2_LOGOUT_REQUEST,
    1521     + lu->login_id, NULL);
    1522     + }
    1523     fw_core_remove_address_handler(&lu->address_handler);
    1524     list_del(&lu->link);
    1525     kfree(lu);
    1526     @@ -808,19 +822,20 @@ static void sbp2_release_target(struct kref *kref)
    1527    
    1528     static struct workqueue_struct *sbp2_wq;
    1529    
    1530     +static void sbp2_target_put(struct sbp2_target *tgt)
    1531     +{
    1532     + kref_put(&tgt->kref, sbp2_release_target);
    1533     +}
    1534     +
    1535     /*
    1536     * Always get the target's kref when scheduling work on one its units.
    1537     * Each workqueue job is responsible to call sbp2_target_put() upon return.
    1538     */
    1539     static void sbp2_queue_work(struct sbp2_logical_unit *lu, unsigned long delay)
    1540     {
    1541     - if (queue_delayed_work(sbp2_wq, &lu->work, delay))
    1542     - kref_get(&lu->tgt->kref);
    1543     -}
    1544     -
    1545     -static void sbp2_target_put(struct sbp2_target *tgt)
    1546     -{
    1547     - kref_put(&tgt->kref, sbp2_release_target);
    1548     + kref_get(&lu->tgt->kref);
    1549     + if (!queue_delayed_work(sbp2_wq, &lu->work, delay))
    1550     + sbp2_target_put(lu->tgt);
    1551     }
    1552    
    1553     static void
    1554     @@ -993,6 +1008,7 @@ static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
    1555    
    1556     lu->tgt = tgt;
    1557     lu->lun = lun_entry & 0xffff;
    1558     + lu->login_id = INVALID_LOGIN_ID;
    1559     lu->retries = 0;
    1560     lu->has_sdev = false;
    1561     lu->blocked = false;
    1562     @@ -1158,7 +1174,7 @@ static int sbp2_probe(struct device *dev)
    1563    
    1564     /* Do the login in a workqueue so we can easily reschedule retries. */
    1565     list_for_each_entry(lu, &tgt->lu_list, link)
    1566     - sbp2_queue_work(lu, 0);
    1567     + sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
    1568     return 0;
    1569    
    1570     fail_tgt_put:
    1571     diff --git a/drivers/firewire/fw-topology.c b/drivers/firewire/fw-topology.c
    1572     index c1b8107..5e20471 100644
    1573     --- a/drivers/firewire/fw-topology.c
    1574     +++ b/drivers/firewire/fw-topology.c
    1575     @@ -413,7 +413,7 @@ static void
    1576     update_tree(struct fw_card *card, struct fw_node *root)
    1577     {
    1578     struct list_head list0, list1;
    1579     - struct fw_node *node0, *node1;
    1580     + struct fw_node *node0, *node1, *next1;
    1581     int i, event;
    1582    
    1583     INIT_LIST_HEAD(&list0);
    1584     @@ -485,7 +485,9 @@ update_tree(struct fw_card *card, struct fw_node *root)
    1585     }
    1586    
    1587     node0 = fw_node(node0->link.next);
    1588     - node1 = fw_node(node1->link.next);
    1589     + next1 = fw_node(node1->link.next);
    1590     + fw_node_put(node1);
    1591     + node1 = next1;
    1592     }
    1593     }
    1594    
    1595     diff --git a/drivers/firewire/fw-transaction.h b/drivers/firewire/fw-transaction.h
    1596     index 2ae1b0d..81b15ba 100644
    1597     --- a/drivers/firewire/fw-transaction.h
    1598     +++ b/drivers/firewire/fw-transaction.h
    1599     @@ -248,7 +248,7 @@ struct fw_card {
    1600     struct fw_node *local_node;
    1601     struct fw_node *root_node;
    1602     struct fw_node *irm_node;
    1603     - int color;
    1604     + u8 color; /* must be u8 to match the definition in struct fw_node */
    1605     int gap_count;
    1606     bool beta_repeaters_present;
    1607    
    1608     diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
    1609     index b15f882..49144cb 100644
    1610     --- a/drivers/hid/usbhid/hid-quirks.c
    1611     +++ b/drivers/hid/usbhid/hid-quirks.c
    1612     @@ -247,8 +247,6 @@
    1613     #define USB_DEVICE_ID_LD_MACHINETEST 0x2040
    1614    
    1615     #define USB_VENDOR_ID_LOGITECH 0x046d
    1616     -#define USB_DEVICE_ID_LOGITECH_LX3 0xc044
    1617     -#define USB_DEVICE_ID_LOGITECH_V150 0xc047
    1618     #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
    1619     #define USB_DEVICE_ID_LOGITECH_HARMONY 0xc110
    1620     #define USB_DEVICE_ID_LOGITECH_HARMONY_2 0xc111
    1621     @@ -603,8 +601,6 @@ static const struct hid_blacklist {
    1622    
    1623     { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_ELITE_KBD, HID_QUIRK_LOGITECH_IGNORE_DOUBLED_WHEEL | HID_QUIRK_LOGITECH_EXPANDED_KEYMAP },
    1624     { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500, HID_QUIRK_LOGITECH_IGNORE_DOUBLED_WHEEL | HID_QUIRK_LOGITECH_EXPANDED_KEYMAP },
    1625     - { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_LX3, HID_QUIRK_INVERT_HWHEEL },
    1626     - { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_V150, HID_QUIRK_INVERT_HWHEEL },
    1627    
    1628     { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K, HID_QUIRK_MICROSOFT_KEYS },
    1629     { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_LK6K, HID_QUIRK_MICROSOFT_KEYS },
    1630     diff --git a/drivers/i2c/busses/scx200_i2c.c b/drivers/i2c/busses/scx200_i2c.c
    1631     index c3022a0..e4c9853 100644
    1632     --- a/drivers/i2c/busses/scx200_i2c.c
    1633     +++ b/drivers/i2c/busses/scx200_i2c.c
    1634     @@ -81,6 +81,7 @@ static struct i2c_algo_bit_data scx200_i2c_data = {
    1635    
    1636     static struct i2c_adapter scx200_i2c_ops = {
    1637     .owner = THIS_MODULE,
    1638     + .class = I2C_CLASS_HWMON | I2C_CLASS_SPD,
    1639     .id = I2C_HW_B_SCX200,
    1640     .algo_data = &scx200_i2c_data,
    1641     .name = "NatSemi SCx200 I2C",
    1642     diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
    1643     index b1ce10f..e32c24d 100644
    1644     --- a/drivers/input/keyboard/atkbd.c
    1645     +++ b/drivers/input/keyboard/atkbd.c
    1646     @@ -834,10 +834,10 @@ static void atkbd_disconnect(struct serio *serio)
    1647     }
    1648    
    1649     /*
    1650     - * Most special keys (Fn+F?) on Dell Latitudes do not generate release
    1651     + * Most special keys (Fn+F?) on Dell laptops do not generate release
    1652     * events so we have to do it ourselves.
    1653     */
    1654     -static void atkbd_latitude_keymap_fixup(struct atkbd *atkbd)
    1655     +static void atkbd_dell_laptop_keymap_fixup(struct atkbd *atkbd)
    1656     {
    1657     const unsigned int forced_release_keys[] = {
    1658     0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93,
    1659     @@ -1461,13 +1461,13 @@ static int __init atkbd_setup_fixup(const struct dmi_system_id *id)
    1660    
    1661     static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
    1662     {
    1663     - .ident = "Dell Latitude series",
    1664     + .ident = "Dell Laptop",
    1665     .matches = {
    1666     DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
    1667     - DMI_MATCH(DMI_PRODUCT_NAME, "Latitude"),
    1668     + DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
    1669     },
    1670     .callback = atkbd_setup_fixup,
    1671     - .driver_data = atkbd_latitude_keymap_fixup,
    1672     + .driver_data = atkbd_dell_laptop_keymap_fixup,
    1673     },
    1674     {
    1675     .ident = "HP 2133",
    1676     diff --git a/drivers/media/dvb/frontends/s5h1411.c b/drivers/media/dvb/frontends/s5h1411.c
    1677     index 2da1a37..a92ee16 100644
    1678     --- a/drivers/media/dvb/frontends/s5h1411.c
    1679     +++ b/drivers/media/dvb/frontends/s5h1411.c
    1680     @@ -471,6 +471,20 @@ static int s5h1411_set_spectralinversion(struct dvb_frontend *fe, int inversion)
    1681     return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0x24, val);
    1682     }
    1683    
    1684     +static int s5h1411_set_serialmode(struct dvb_frontend *fe, int serial)
    1685     +{
    1686     + struct s5h1411_state *state = fe->demodulator_priv;
    1687     + u16 val;
    1688     +
    1689     + dprintk("%s(%d)\n", __func__, serial);
    1690     + val = s5h1411_readreg(state, S5H1411_I2C_TOP_ADDR, 0xbd) & ~0x100;
    1691     +
    1692     + if (serial == 1)
    1693     + val |= 0x100;
    1694     +
    1695     + return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, val);
    1696     +}
    1697     +
    1698     static int s5h1411_enable_modulation(struct dvb_frontend *fe,
    1699     fe_modulation_t m)
    1700     {
    1701     @@ -535,7 +549,7 @@ static int s5h1411_set_gpio(struct dvb_frontend *fe, int enable)
    1702     return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xe0, val);
    1703     }
    1704    
    1705     -static int s5h1411_sleep(struct dvb_frontend *fe, int enable)
    1706     +static int s5h1411_set_powerstate(struct dvb_frontend *fe, int enable)
    1707     {
    1708     struct s5h1411_state *state = fe->demodulator_priv;
    1709    
    1710     @@ -551,6 +565,11 @@ static int s5h1411_sleep(struct dvb_frontend *fe, int enable)
    1711     return 0;
    1712     }
    1713    
    1714     +static int s5h1411_sleep(struct dvb_frontend *fe)
    1715     +{
    1716     + return s5h1411_set_powerstate(fe, 1);
    1717     +}
    1718     +
    1719     static int s5h1411_register_reset(struct dvb_frontend *fe)
    1720     {
    1721     struct s5h1411_state *state = fe->demodulator_priv;
    1722     @@ -574,9 +593,6 @@ static int s5h1411_set_frontend(struct dvb_frontend *fe,
    1723    
    1724     s5h1411_enable_modulation(fe, p->u.vsb.modulation);
    1725    
    1726     - /* Allow the demod to settle */
    1727     - msleep(100);
    1728     -
    1729     if (fe->ops.tuner_ops.set_params) {
    1730     if (fe->ops.i2c_gate_ctrl)
    1731     fe->ops.i2c_gate_ctrl(fe, 1);
    1732     @@ -587,6 +603,10 @@ static int s5h1411_set_frontend(struct dvb_frontend *fe,
    1733     fe->ops.i2c_gate_ctrl(fe, 0);
    1734     }
    1735    
    1736     + /* Issue a reset to the demod so it knows to resync against the
    1737     + newly tuned frequency */
    1738     + s5h1411_softreset(fe);
    1739     +
    1740     return 0;
    1741     }
    1742    
    1743     @@ -599,7 +619,7 @@ static int s5h1411_init(struct dvb_frontend *fe)
    1744    
    1745     dprintk("%s()\n", __func__);
    1746    
    1747     - s5h1411_sleep(fe, 0);
    1748     + s5h1411_set_powerstate(fe, 0);
    1749     s5h1411_register_reset(fe);
    1750    
    1751     for (i = 0; i < ARRAY_SIZE(init_tab); i++)
    1752     @@ -612,10 +632,10 @@ static int s5h1411_init(struct dvb_frontend *fe)
    1753    
    1754     if (state->config->output_mode == S5H1411_SERIAL_OUTPUT)
    1755     /* Serial */
    1756     - s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, 0x1101);
    1757     + s5h1411_set_serialmode(fe, 1);
    1758     else
    1759     /* Parallel */
    1760     - s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, 0x1001);
    1761     + s5h1411_set_serialmode(fe, 0);
    1762    
    1763     s5h1411_set_spectralinversion(fe, state->config->inversion);
    1764     s5h1411_set_if_freq(fe, state->config->vsb_if);
    1765     @@ -863,6 +883,7 @@ static struct dvb_frontend_ops s5h1411_ops = {
    1766     },
    1767    
    1768     .init = s5h1411_init,
    1769     + .sleep = s5h1411_sleep,
    1770     .i2c_gate_ctrl = s5h1411_i2c_gate_ctrl,
    1771     .set_frontend = s5h1411_set_frontend,
    1772     .get_frontend = s5h1411_get_frontend,
    1773     diff --git a/drivers/media/video/pvrusb2/pvrusb2-encoder.c b/drivers/media/video/pvrusb2/pvrusb2-encoder.c
    1774     index a1252d6..273d2a1 100644
    1775     --- a/drivers/media/video/pvrusb2/pvrusb2-encoder.c
    1776     +++ b/drivers/media/video/pvrusb2/pvrusb2-encoder.c
    1777     @@ -402,6 +402,10 @@ static int pvr2_encoder_prep_config(struct pvr2_hdw *hdw)
    1778     ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4, 0,3,0,0);
    1779     ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4,15,0,0,0);
    1780    
    1781     + /* prevent the PTSs from slowly drifting away in the generated
    1782     + MPEG stream */
    1783     + ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC, 2, 4, 1);
    1784     +
    1785     return ret;
    1786     }
    1787    
    1788     diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
    1789     index e23ce77..b46e599 100644
    1790     --- a/drivers/net/atlx/atl1.c
    1791     +++ b/drivers/net/atlx/atl1.c
    1792     @@ -2317,7 +2317,8 @@ static void atl1_tx_queue(struct atl1_adapter *adapter, u16 count,
    1793     if (tpd != ptpd)
    1794     memcpy(tpd, ptpd, sizeof(struct tx_packet_desc));
    1795     tpd->buffer_addr = cpu_to_le64(buffer_info->dma);
    1796     - tpd->word2 = (cpu_to_le16(buffer_info->length) &
    1797     + tpd->word2 &= ~(TPD_BUFLEN_MASK << TPD_BUFLEN_SHIFT);
    1798     + tpd->word2 |= (cpu_to_le16(buffer_info->length) &
    1799     TPD_BUFLEN_MASK) << TPD_BUFLEN_SHIFT;
    1800    
    1801     /*
    1802     @@ -2426,8 +2427,8 @@ static int atl1_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
    1803     vlan_tag = (vlan_tag << 4) | (vlan_tag >> 13) |
    1804     ((vlan_tag >> 9) & 0x8);
    1805     ptpd->word3 |= 1 << TPD_INS_VL_TAG_SHIFT;
    1806     - ptpd->word3 |= (vlan_tag & TPD_VL_TAGGED_MASK) <<
    1807     - TPD_VL_TAGGED_SHIFT;
    1808     + ptpd->word2 |= (vlan_tag & TPD_VLANTAG_MASK) <<
    1809     + TPD_VLANTAG_SHIFT;
    1810     }
    1811    
    1812     tso = atl1_tso(adapter, skb, ptpd);
    1813     diff --git a/drivers/net/atlx/atl1.h b/drivers/net/atlx/atl1.h
    1814     index a5015b1..ffa73fc 100644
    1815     --- a/drivers/net/atlx/atl1.h
    1816     +++ b/drivers/net/atlx/atl1.h
    1817     @@ -504,7 +504,7 @@ struct rx_free_desc {
    1818     #define TPD_PKTNT_MASK 0x0001
    1819     #define TPD_PKTINT_SHIFT 15
    1820     #define TPD_VLANTAG_MASK 0xFFFF
    1821     -#define TPD_VLAN_SHIFT 16
    1822     +#define TPD_VLANTAG_SHIFT 16
    1823    
    1824     /* tpd word 3 bits 0:13 */
    1825     #define TPD_EOP_MASK 0x0001
    1826     diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
    1827     index b211486..4489e58 100644
    1828     --- a/drivers/net/bonding/bond_alb.c
    1829     +++ b/drivers/net/bonding/bond_alb.c
    1830     @@ -167,11 +167,14 @@ static void tlb_clear_slave(struct bonding *bond, struct slave *slave, int save_
    1831     /* clear slave from tx_hashtbl */
    1832     tx_hash_table = BOND_ALB_INFO(bond).tx_hashtbl;
    1833    
    1834     - index = SLAVE_TLB_INFO(slave).head;
    1835     - while (index != TLB_NULL_INDEX) {
    1836     - u32 next_index = tx_hash_table[index].next;
    1837     - tlb_init_table_entry(&tx_hash_table[index], save_load);
    1838     - index = next_index;
    1839     + /* skip this if we've already freed the tx hash table */
    1840     + if (tx_hash_table) {
    1841     + index = SLAVE_TLB_INFO(slave).head;
    1842     + while (index != TLB_NULL_INDEX) {
    1843     + u32 next_index = tx_hash_table[index].next;
    1844     + tlb_init_table_entry(&tx_hash_table[index], save_load);
    1845     + index = next_index;
    1846     + }
    1847     }
    1848    
    1849     tlb_init_slave(slave);
    1850     diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
    1851     index 4b27456..50927ea 100644
    1852     --- a/drivers/net/wireless/libertas/scan.c
    1853     +++ b/drivers/net/wireless/libertas/scan.c
    1854     @@ -598,8 +598,8 @@ static int lbs_process_bss(struct bss_descriptor *bss,
    1855    
    1856     switch (elem->id) {
    1857     case MFIE_TYPE_SSID:
    1858     - bss->ssid_len = elem->len;
    1859     - memcpy(bss->ssid, elem->data, elem->len);
    1860     + bss->ssid_len = min_t(int, 32, elem->len);
    1861     + memcpy(bss->ssid, elem->data, bss->ssid_len);
    1862     lbs_deb_scan("got SSID IE: '%s', len %u\n",
    1863     escape_essid(bss->ssid, bss->ssid_len),
    1864     bss->ssid_len);
    1865     diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
    1866     index 36698e5..bcafbd6 100644
    1867     --- a/drivers/pci/probe.c
    1868     +++ b/drivers/pci/probe.c
    1869     @@ -219,7 +219,7 @@ static inline enum pci_bar_type decode_bar(struct resource *res, u32 bar)
    1870    
    1871     res->flags = bar & ~PCI_BASE_ADDRESS_MEM_MASK;
    1872    
    1873     - if (res->flags == PCI_BASE_ADDRESS_MEM_TYPE_64)
    1874     + if (res->flags & PCI_BASE_ADDRESS_MEM_TYPE_64)
    1875     return pci_bar_mem64;
    1876     return pci_bar_mem32;
    1877     }
    1878     diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
    1879     index b184367..6ad46d7 100644
    1880     --- a/drivers/rtc/rtc-cmos.c
    1881     +++ b/drivers/rtc/rtc-cmos.c
    1882     @@ -1030,29 +1030,32 @@ static struct platform_driver cmos_platform_driver = {
    1883    
    1884     static int __init cmos_init(void)
    1885     {
    1886     + int retval = 0;
    1887     +
    1888     #ifdef CONFIG_PNP
    1889     - if (pnp_platform_devices)
    1890     - return pnp_register_driver(&cmos_pnp_driver);
    1891     - else
    1892     - return platform_driver_probe(&cmos_platform_driver,
    1893     - cmos_platform_probe);
    1894     -#else
    1895     - return platform_driver_probe(&cmos_platform_driver,
    1896     - cmos_platform_probe);
    1897     -#endif /* CONFIG_PNP */
    1898     + pnp_register_driver(&cmos_pnp_driver);
    1899     +#endif
    1900     +
    1901     + if (!cmos_rtc.dev)
    1902     + retval = platform_driver_probe(&cmos_platform_driver,
    1903     + cmos_platform_probe);
    1904     +
    1905     + if (retval == 0)
    1906     + return 0;
    1907     +
    1908     +#ifdef CONFIG_PNP
    1909     + pnp_unregister_driver(&cmos_pnp_driver);
    1910     +#endif
    1911     + return retval;
    1912     }
    1913     module_init(cmos_init);
    1914    
    1915     static void __exit cmos_exit(void)
    1916     {
    1917     #ifdef CONFIG_PNP
    1918     - if (pnp_platform_devices)
    1919     - pnp_unregister_driver(&cmos_pnp_driver);
    1920     - else
    1921     - platform_driver_unregister(&cmos_platform_driver);
    1922     -#else
    1923     + pnp_unregister_driver(&cmos_pnp_driver);
    1924     +#endif
    1925     platform_driver_unregister(&cmos_platform_driver);
    1926     -#endif /* CONFIG_PNP */
    1927     }
    1928     module_exit(cmos_exit);
    1929    
    1930     diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
    1931     index e5e7d78..b7ea69c 100644
    1932     --- a/drivers/scsi/sd.c
    1933     +++ b/drivers/scsi/sd.c
    1934     @@ -1047,7 +1047,6 @@ static int sd_done(struct scsi_cmnd *SCpnt)
    1935     good_bytes = sd_completed_bytes(SCpnt);
    1936     break;
    1937     case RECOVERED_ERROR:
    1938     - case NO_SENSE:
    1939     /* Inform the user, but make sure that it's not treated
    1940     * as a hard error.
    1941     */
    1942     @@ -1056,6 +1055,15 @@ static int sd_done(struct scsi_cmnd *SCpnt)
    1943     memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
    1944     good_bytes = scsi_bufflen(SCpnt);
    1945     break;
    1946     + case NO_SENSE:
    1947     + /* This indicates a false check condition, so ignore it. An
    1948     + * unknown amount of data was transferred so treat it as an
    1949     + * error.
    1950     + */
    1951     + scsi_print_sense("sd", SCpnt);
    1952     + SCpnt->result = 0;
    1953     + memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
    1954     + break;
    1955     case ABORTED_COMMAND:
    1956     if (sshdr.asc == 0x10) { /* DIF: Disk detected corruption */
    1957     scsi_print_result(SCpnt);
    1958     diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
    1959     index 706f3e6..7a4ccf5 100644
    1960     --- a/drivers/usb/core/hcd.c
    1961     +++ b/drivers/usb/core/hcd.c
    1962     @@ -106,6 +106,9 @@ static DEFINE_SPINLOCK(hcd_root_hub_lock);
    1963     /* used when updating an endpoint's URB list */
    1964     static DEFINE_SPINLOCK(hcd_urb_list_lock);
    1965    
    1966     +/* used to protect against unlinking URBs after the device is gone */
    1967     +static DEFINE_SPINLOCK(hcd_urb_unlink_lock);
    1968     +
    1969     /* wait queue for synchronous unlinks */
    1970     DECLARE_WAIT_QUEUE_HEAD(usb_kill_urb_queue);
    1971    
    1972     @@ -1377,10 +1380,25 @@ static int unlink1(struct usb_hcd *hcd, struct urb *urb, int status)
    1973     int usb_hcd_unlink_urb (struct urb *urb, int status)
    1974     {
    1975     struct usb_hcd *hcd;
    1976     - int retval;
    1977     + int retval = -EIDRM;
    1978     + unsigned long flags;
    1979    
    1980     - hcd = bus_to_hcd(urb->dev->bus);
    1981     - retval = unlink1(hcd, urb, status);
    1982     + /* Prevent the device and bus from going away while
    1983     + * the unlink is carried out. If they are already gone
    1984     + * then urb->use_count must be 0, since disconnected
    1985     + * devices can't have any active URBs.
    1986     + */
    1987     + spin_lock_irqsave(&hcd_urb_unlink_lock, flags);
    1988     + if (atomic_read(&urb->use_count) > 0) {
    1989     + retval = 0;
    1990     + usb_get_dev(urb->dev);
    1991     + }
    1992     + spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags);
    1993     + if (retval == 0) {
    1994     + hcd = bus_to_hcd(urb->dev->bus);
    1995     + retval = unlink1(hcd, urb, status);
    1996     + usb_put_dev(urb->dev);
    1997     + }
    1998    
    1999     if (retval == 0)
    2000     retval = -EINPROGRESS;
    2001     @@ -1529,6 +1547,17 @@ void usb_hcd_disable_endpoint(struct usb_device *udev,
    2002     hcd->driver->endpoint_disable(hcd, ep);
    2003     }
    2004    
    2005     +/* Protect against drivers that try to unlink URBs after the device
    2006     + * is gone, by waiting until all unlinks for @udev are finished.
    2007     + * Since we don't currently track URBs by device, simply wait until
    2008     + * nothing is running in the locked region of usb_hcd_unlink_urb().
    2009     + */
    2010     +void usb_hcd_synchronize_unlinks(struct usb_device *udev)
    2011     +{
    2012     + spin_lock_irq(&hcd_urb_unlink_lock);
    2013     + spin_unlock_irq(&hcd_urb_unlink_lock);
    2014     +}
    2015     +
    2016     /*-------------------------------------------------------------------------*/
    2017    
    2018     /* called in any context */
    2019     diff --git a/drivers/usb/core/hcd.h b/drivers/usb/core/hcd.h
    2020     index 2dcde61..9465e70 100644
    2021     --- a/drivers/usb/core/hcd.h
    2022     +++ b/drivers/usb/core/hcd.h
    2023     @@ -232,6 +232,7 @@ extern void usb_hcd_flush_endpoint(struct usb_device *udev,
    2024     struct usb_host_endpoint *ep);
    2025     extern void usb_hcd_disable_endpoint(struct usb_device *udev,
    2026     struct usb_host_endpoint *ep);
    2027     +extern void usb_hcd_synchronize_unlinks(struct usb_device *udev);
    2028     extern int usb_hcd_get_frame_number(struct usb_device *udev);
    2029    
    2030     extern struct usb_hcd *usb_create_hcd(const struct hc_driver *driver,
    2031     diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    2032     index 875de9a..769f80f 100644
    2033     --- a/drivers/usb/core/hub.c
    2034     +++ b/drivers/usb/core/hub.c
    2035     @@ -1349,6 +1349,7 @@ void usb_disconnect(struct usb_device **pdev)
    2036     */
    2037     dev_dbg (&udev->dev, "unregistering device\n");
    2038     usb_disable_device(udev, 0);
    2039     + usb_hcd_synchronize_unlinks(udev);
    2040    
    2041     usb_unlock_device(udev);
    2042    
    2043     diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
    2044     index 47111e8..db72269 100644
    2045     --- a/drivers/usb/core/urb.c
    2046     +++ b/drivers/usb/core/urb.c
    2047     @@ -465,6 +465,12 @@ EXPORT_SYMBOL_GPL(usb_submit_urb);
    2048     * indicating that the request has been canceled (rather than any other
    2049     * code).
    2050     *
    2051     + * Drivers should not call this routine or related routines, such as
    2052     + * usb_kill_urb() or usb_unlink_anchored_urbs(), after their disconnect
    2053     + * method has returned. The disconnect function should synchronize with
    2054     + * a driver's I/O routines to insure that all URB-related activity has
    2055     + * completed before it returns.
    2056     + *
    2057     * This request is always asynchronous. Success is indicated by
    2058     * returning -EINPROGRESS, at which time the URB will probably not yet
    2059     * have been given back to the device driver. When it is eventually
    2060     @@ -541,6 +547,9 @@ EXPORT_SYMBOL_GPL(usb_unlink_urb);
    2061     * This routine may not be used in an interrupt context (such as a bottom
    2062     * half or a completion handler), or when holding a spinlock, or in other
    2063     * situations where the caller can't schedule().
    2064     + *
    2065     + * This routine should not be called by a driver after its disconnect
    2066     + * method has returned.
    2067     */
    2068     void usb_kill_urb(struct urb *urb)
    2069     {
    2070     @@ -568,6 +577,9 @@ EXPORT_SYMBOL_GPL(usb_kill_urb);
    2071     *
    2072     * this allows all outstanding URBs to be killed starting
    2073     * from the back of the queue
    2074     + *
    2075     + * This routine should not be called by a driver after its disconnect
    2076     + * method has returned.
    2077     */
    2078     void usb_kill_anchored_urbs(struct usb_anchor *anchor)
    2079     {
    2080     @@ -597,6 +609,9 @@ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs);
    2081     * from the back of the queue. This function is asynchronous.
    2082     * The unlinking is just tiggered. It may happen after this
    2083     * function has returned.
    2084     + *
    2085     + * This routine should not be called by a driver after its disconnect
    2086     + * method has returned.
    2087     */
    2088     void usb_unlink_anchored_urbs(struct usb_anchor *anchor)
    2089     {
    2090     diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    2091     index cd15547..061df9b 100644
    2092     --- a/drivers/usb/storage/unusual_devs.h
    2093     +++ b/drivers/usb/storage/unusual_devs.h
    2094     @@ -1745,6 +1745,15 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201,
    2095     US_SC_DEVICE, US_PR_DEVICE, NULL,
    2096     US_FL_IGNORE_RESIDUE ),
    2097    
    2098     +/* Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>
    2099     + * JMicron responds to USN and several other SCSI ioctls with a
    2100     + * residue that causes subsequent I/O requests to fail. */
    2101     +UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x0100,
    2102     + "JMicron",
    2103     + "USB to ATA/ATAPI Bridge",
    2104     + US_SC_DEVICE, US_PR_DEVICE, NULL,
    2105     + US_FL_IGNORE_RESIDUE ),
    2106     +
    2107     /* Reported by Robert Schedel <r.schedel@yahoo.de>
    2108     * Note: this is a 'super top' device like the above 14cd/6600 device */
    2109     UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x0201,
    2110     diff --git a/fs/hfsplus/bitmap.c b/fs/hfsplus/bitmap.c
    2111     index d128a25..ea30afc 100644
    2112     --- a/fs/hfsplus/bitmap.c
    2113     +++ b/fs/hfsplus/bitmap.c
    2114     @@ -32,6 +32,10 @@ int hfsplus_block_allocate(struct super_block *sb, u32 size, u32 offset, u32 *ma
    2115     mutex_lock(&HFSPLUS_SB(sb).alloc_file->i_mutex);
    2116     mapping = HFSPLUS_SB(sb).alloc_file->i_mapping;
    2117     page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS, NULL);
    2118     + if (IS_ERR(page)) {
    2119     + start = size;
    2120     + goto out;
    2121     + }
    2122     pptr = kmap(page);
    2123     curr = pptr + (offset & (PAGE_CACHE_BITS - 1)) / 32;
    2124     i = offset % 32;
    2125     @@ -73,6 +77,10 @@ int hfsplus_block_allocate(struct super_block *sb, u32 size, u32 offset, u32 *ma
    2126     break;
    2127     page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS,
    2128     NULL);
    2129     + if (IS_ERR(page)) {
    2130     + start = size;
    2131     + goto out;
    2132     + }
    2133     curr = pptr = kmap(page);
    2134     if ((size ^ offset) / PAGE_CACHE_BITS)
    2135     end = pptr + PAGE_CACHE_BITS / 32;
    2136     @@ -120,6 +128,10 @@ found:
    2137     offset += PAGE_CACHE_BITS;
    2138     page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS,
    2139     NULL);
    2140     + if (IS_ERR(page)) {
    2141     + start = size;
    2142     + goto out;
    2143     + }
    2144     pptr = kmap(page);
    2145     curr = pptr;
    2146     end = pptr + PAGE_CACHE_BITS / 32;
    2147     diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
    2148     index ba117c4..f6874ac 100644
    2149     --- a/fs/hfsplus/catalog.c
    2150     +++ b/fs/hfsplus/catalog.c
    2151     @@ -168,6 +168,11 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
    2152     return -EIO;
    2153     }
    2154    
    2155     + if (be16_to_cpu(tmp.thread.nodeName.length) > 255) {
    2156     + printk(KERN_ERR "hfs: catalog name length corrupted\n");
    2157     + return -EIO;
    2158     + }
    2159     +
    2160     hfsplus_cat_build_key_uni(fd->search_key, be32_to_cpu(tmp.thread.parentID),
    2161     &tmp.thread.nodeName);
    2162     return hfs_brec_find(fd);
    2163     diff --git a/include/linux/sched.h b/include/linux/sched.h
    2164     index 3d9120c..6bfb849 100644
    2165     --- a/include/linux/sched.h
    2166     +++ b/include/linux/sched.h
    2167     @@ -1286,7 +1286,9 @@ struct task_struct {
    2168     atomic_t fs_excl; /* holding fs exclusive resources */
    2169     struct rcu_head rcu;
    2170    
    2171     - /*
    2172     + struct list_head *scm_work_list;
    2173     +
    2174     +/*
    2175     * cache last used pipe for splice
    2176     */
    2177     struct pipe_inode_info *splice_pipe;
    2178     diff --git a/include/math-emu/op-common.h b/include/math-emu/op-common.h
    2179     index bb46e76..408f743 100644
    2180     --- a/include/math-emu/op-common.h
    2181     +++ b/include/math-emu/op-common.h
    2182     @@ -139,18 +139,27 @@ do { \
    2183     if (X##_e <= _FP_WFRACBITS_##fs) \
    2184     { \
    2185     _FP_FRAC_SRS_##wc(X, X##_e, _FP_WFRACBITS_##fs); \
    2186     - _FP_ROUND(wc, X); \
    2187     if (_FP_FRAC_HIGH_##fs(X) \
    2188     & (_FP_OVERFLOW_##fs >> 1)) \
    2189     { \
    2190     X##_e = 1; \
    2191     _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \
    2192     - FP_SET_EXCEPTION(FP_EX_INEXACT); \
    2193     } \
    2194     else \
    2195     { \
    2196     - X##_e = 0; \
    2197     - _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \
    2198     + _FP_ROUND(wc, X); \
    2199     + if (_FP_FRAC_HIGH_##fs(X) \
    2200     + & (_FP_OVERFLOW_##fs >> 1)) \
    2201     + { \
    2202     + X##_e = 1; \
    2203     + _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \
    2204     + FP_SET_EXCEPTION(FP_EX_INEXACT); \
    2205     + } \
    2206     + else \
    2207     + { \
    2208     + X##_e = 0; \
    2209     + _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \
    2210     + } \
    2211     } \
    2212     if ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) || \
    2213     (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW)) \
    2214     diff --git a/include/net/scm.h b/include/net/scm.h
    2215     index 06df126..33e9986 100644
    2216     --- a/include/net/scm.h
    2217     +++ b/include/net/scm.h
    2218     @@ -14,8 +14,9 @@
    2219    
    2220     struct scm_fp_list
    2221     {
    2222     - int count;
    2223     - struct file *fp[SCM_MAX_FD];
    2224     + struct list_head list;
    2225     + int count;
    2226     + struct file *fp[SCM_MAX_FD];
    2227     };
    2228    
    2229     struct scm_cookie
    2230     diff --git a/kernel/sched_clock.c b/kernel/sched_clock.c
    2231     index e8ab096..8178724 100644
    2232     --- a/kernel/sched_clock.c
    2233     +++ b/kernel/sched_clock.c
    2234     @@ -118,13 +118,13 @@ static u64 __update_sched_clock(struct sched_clock_data *scd, u64 now)
    2235    
    2236     /*
    2237     * scd->clock = clamp(scd->tick_gtod + delta,
    2238     - * max(scd->tick_gtod, scd->clock),
    2239     - * scd->tick_gtod + TICK_NSEC);
    2240     + * max(scd->tick_gtod, scd->clock),
    2241     + * max(scd->clock, scd->tick_gtod + TICK_NSEC));
    2242     */
    2243    
    2244     clock = scd->tick_gtod + delta;
    2245     min_clock = wrap_max(scd->tick_gtod, scd->clock);
    2246     - max_clock = scd->tick_gtod + TICK_NSEC;
    2247     + max_clock = wrap_max(scd->clock, scd->tick_gtod + TICK_NSEC);
    2248    
    2249     clock = wrap_max(clock, min_clock);
    2250     clock = wrap_min(clock, max_clock);
    2251     diff --git a/kernel/sched_features.h b/kernel/sched_features.h
    2252     index 9353ca7..c4c88ae 100644
    2253     --- a/kernel/sched_features.h
    2254     +++ b/kernel/sched_features.h
    2255     @@ -5,7 +5,7 @@ SCHED_FEAT(START_DEBIT, 1)
    2256     SCHED_FEAT(AFFINE_WAKEUPS, 1)
    2257     SCHED_FEAT(CACHE_HOT_BUDDY, 1)
    2258     SCHED_FEAT(SYNC_WAKEUPS, 1)
    2259     -SCHED_FEAT(HRTICK, 1)
    2260     +SCHED_FEAT(HRTICK, 0)
    2261     SCHED_FEAT(DOUBLE_TICK, 0)
    2262     SCHED_FEAT(ASYM_GRAN, 1)
    2263     SCHED_FEAT(LB_BIAS, 1)
    2264     diff --git a/net/core/scm.c b/net/core/scm.c
    2265     index 10f5c65..ab242cc 100644
    2266     --- a/net/core/scm.c
    2267     +++ b/net/core/scm.c
    2268     @@ -75,6 +75,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
    2269     if (!fpl)
    2270     return -ENOMEM;
    2271     *fplp = fpl;
    2272     + INIT_LIST_HEAD(&fpl->list);
    2273     fpl->count = 0;
    2274     }
    2275     fpp = &fpl->fp[fpl->count];
    2276     @@ -106,9 +107,25 @@ void __scm_destroy(struct scm_cookie *scm)
    2277    
    2278     if (fpl) {
    2279     scm->fp = NULL;
    2280     - for (i=fpl->count-1; i>=0; i--)
    2281     - fput(fpl->fp[i]);
    2282     - kfree(fpl);
    2283     + if (current->scm_work_list) {
    2284     + list_add_tail(&fpl->list, current->scm_work_list);
    2285     + } else {
    2286     + LIST_HEAD(work_list);
    2287     +
    2288     + current->scm_work_list = &work_list;
    2289     +
    2290     + list_add(&fpl->list, &work_list);
    2291     + while (!list_empty(&work_list)) {
    2292     + fpl = list_first_entry(&work_list, struct scm_fp_list, list);
    2293     +
    2294     + list_del(&fpl->list);
    2295     + for (i=fpl->count-1; i>=0; i--)
    2296     + fput(fpl->fp[i]);
    2297     + kfree(fpl);
    2298     + }
    2299     +
    2300     + current->scm_work_list = NULL;
    2301     + }
    2302     }
    2303     }
    2304    
    2305     @@ -284,6 +301,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
    2306    
    2307     new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
    2308     if (new_fpl) {
    2309     + INIT_LIST_HEAD(&new_fpl->list);
    2310     for (i=fpl->count-1; i>=0; i--)
    2311     get_file(fpl->fp[i]);
    2312     memcpy(new_fpl, fpl, sizeof(*fpl));
    2313     diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    2314     index 8165f5a..d083f9a 100644
    2315     --- a/net/ipv4/tcp_output.c
    2316     +++ b/net/ipv4/tcp_output.c
    2317     @@ -357,6 +357,17 @@ struct tcp_out_options {
    2318     __u32 tsval, tsecr; /* need to include OPTION_TS */
    2319     };
    2320    
    2321     +/* Beware: Something in the Internet is very sensitive to the ordering of
    2322     + * TCP options, we learned this through the hard way, so be careful here.
    2323     + * Luckily we can at least blame others for their non-compliance but from
    2324     + * inter-operatibility perspective it seems that we're somewhat stuck with
    2325     + * the ordering which we have been using if we want to keep working with
    2326     + * those broken things (not that it currently hurts anybody as there isn't
    2327     + * particular reason why the ordering would need to be changed).
    2328     + *
    2329     + * At least SACK_PERM as the first option is known to lead to a disaster
    2330     + * (but it may well be that other scenarios fail similarly).
    2331     + */
    2332     static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
    2333     const struct tcp_out_options *opts,
    2334     __u8 **md5_hash) {
    2335     @@ -371,6 +382,12 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
    2336     *md5_hash = NULL;
    2337     }
    2338    
    2339     + if (unlikely(opts->mss)) {
    2340     + *ptr++ = htonl((TCPOPT_MSS << 24) |
    2341     + (TCPOLEN_MSS << 16) |
    2342     + opts->mss);
    2343     + }
    2344     +
    2345     if (likely(OPTION_TS & opts->options)) {
    2346     if (unlikely(OPTION_SACK_ADVERTISE & opts->options)) {
    2347     *ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
    2348     @@ -387,12 +404,6 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
    2349     *ptr++ = htonl(opts->tsecr);
    2350     }
    2351    
    2352     - if (unlikely(opts->mss)) {
    2353     - *ptr++ = htonl((TCPOPT_MSS << 24) |
    2354     - (TCPOLEN_MSS << 16) |
    2355     - opts->mss);
    2356     - }
    2357     -
    2358     if (unlikely(OPTION_SACK_ADVERTISE & opts->options &&
    2359     !(OPTION_TS & opts->options))) {
    2360     *ptr++ = htonl((TCPOPT_NOP << 24) |
    2361     @@ -2266,6 +2277,11 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
    2362     }
    2363    
    2364     memset(&opts, 0, sizeof(opts));
    2365     +#ifdef CONFIG_SYN_COOKIES
    2366     + if (unlikely(req->cookie_ts))
    2367     + TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
    2368     + else
    2369     +#endif
    2370     TCP_SKB_CB(skb)->when = tcp_time_stamp;
    2371     tcp_header_size = tcp_synack_options(sk, req,
    2372     dst_metric(dst, RTAX_ADVMSS),
    2373     @@ -2292,11 +2308,6 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
    2374    
    2375     /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
    2376     th->window = htons(min(req->rcv_wnd, 65535U));
    2377     -#ifdef CONFIG_SYN_COOKIES
    2378     - if (unlikely(req->cookie_ts))
    2379     - TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
    2380     - else
    2381     -#endif
    2382     tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
    2383     th->doff = (tcp_header_size >> 2);
    2384     TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
    2385     diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
    2386     index 10e22fd..245cbc5 100644
    2387     --- a/net/ipv6/tcp_ipv6.c
    2388     +++ b/net/ipv6/tcp_ipv6.c
    2389     @@ -1087,7 +1087,7 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
    2390     *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
    2391     (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
    2392     *topt++ = htonl(tcp_time_stamp);
    2393     - *topt = htonl(ts);
    2394     + *topt++ = htonl(ts);
    2395     }
    2396    
    2397     #ifdef CONFIG_TCP_MD5SIG
    2398     diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
    2399     index ec0a083..700ae9e 100644
    2400     --- a/net/sched/sch_generic.c
    2401     +++ b/net/sched/sch_generic.c
    2402     @@ -319,6 +319,7 @@ struct Qdisc_ops noop_qdisc_ops __read_mostly = {
    2403    
    2404     static struct netdev_queue noop_netdev_queue = {
    2405     .qdisc = &noop_qdisc,
    2406     + .qdisc_sleeping = &noop_qdisc,
    2407     };
    2408    
    2409     struct Qdisc noop_qdisc = {
    2410     @@ -344,6 +345,7 @@ static struct Qdisc_ops noqueue_qdisc_ops __read_mostly = {
    2411     static struct Qdisc noqueue_qdisc;
    2412     static struct netdev_queue noqueue_netdev_queue = {
    2413     .qdisc = &noqueue_qdisc,
    2414     + .qdisc_sleeping = &noqueue_qdisc,
    2415     };
    2416    
    2417     static struct Qdisc noqueue_qdisc = {
    2418     diff --git a/scripts/package/mkspec b/scripts/package/mkspec
    2419     index ffd61fe..62c5ffd 100755
    2420     --- a/scripts/package/mkspec
    2421     +++ b/scripts/package/mkspec
    2422     @@ -64,8 +64,10 @@ fi
    2423     echo "%install"
    2424     echo "%ifarch ia64"
    2425     echo 'mkdir -p $RPM_BUILD_ROOT/boot/efi $RPM_BUILD_ROOT/lib/modules'
    2426     +echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
    2427     echo "%else"
    2428     echo 'mkdir -p $RPM_BUILD_ROOT/boot $RPM_BUILD_ROOT/lib/modules'
    2429     +echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
    2430     echo "%endif"
    2431    
    2432     echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{_smp_mflags} modules_install'
    2433     @@ -92,5 +94,6 @@ echo "%files"
    2434     echo '%defattr (-, root, root)'
    2435     echo "%dir /lib/modules"
    2436     echo "/lib/modules/$KERNELRELEASE"
    2437     +echo "/lib/firmware"
    2438     echo "/boot/*"
    2439     echo ""
    2440     diff --git a/security/commoncap.c b/security/commoncap.c
    2441     index e4c4b3f..378172b 100644
    2442     --- a/security/commoncap.c
    2443     +++ b/security/commoncap.c
    2444     @@ -279,10 +279,10 @@ static int get_file_caps(struct linux_binprm *bprm)
    2445     struct vfs_cap_data vcaps;
    2446     struct inode *inode;
    2447    
    2448     - if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID) {
    2449     - bprm_clear_caps(bprm);
    2450     + bprm_clear_caps(bprm);
    2451     +
    2452     + if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
    2453     return 0;
    2454     - }
    2455    
    2456     dentry = dget(bprm->file->f_dentry);
    2457     inode = dentry->d_inode;
    2458     diff --git a/sound/core/control.c b/sound/core/control.c
    2459     index 281b2e2..236bbb1 100644
    2460     --- a/sound/core/control.c
    2461     +++ b/sound/core/control.c
    2462     @@ -1427,12 +1427,12 @@ static int snd_ctl_dev_disconnect(struct snd_device *device)
    2463     cardnum = card->number;
    2464     snd_assert(cardnum >= 0 && cardnum < SNDRV_CARDS, return -ENXIO);
    2465    
    2466     - down_read(&card->controls_rwsem);
    2467     + read_lock(&card->ctl_files_rwlock);
    2468     list_for_each_entry(ctl, &card->ctl_files, list) {
    2469     wake_up(&ctl->change_sleep);
    2470     kill_fasync(&ctl->fasync, SIGIO, POLL_ERR);
    2471     }
    2472     - up_read(&card->controls_rwsem);
    2473     + read_unlock(&card->ctl_files_rwlock);
    2474    
    2475     if ((err = snd_unregister_device(SNDRV_DEVICE_TYPE_CONTROL,
    2476     card, -1)) < 0)
    2477     diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
    2478     index 1c53e33..0f014b1 100644
    2479     --- a/sound/pci/hda/hda_intel.c
    2480     +++ b/sound/pci/hda/hda_intel.c
    2481     @@ -45,6 +45,7 @@
    2482     #include <linux/slab.h>
    2483     #include <linux/pci.h>
    2484     #include <linux/mutex.h>
    2485     +#include <linux/reboot.h>
    2486     #include <sound/core.h>
    2487     #include <sound/initval.h>
    2488     #include "hda_codec.h"
    2489     @@ -385,6 +386,9 @@ struct azx {
    2490    
    2491     /* for pending irqs */
    2492     struct work_struct irq_pending_work;
    2493     +
    2494     + /* reboot notifier (for mysterious hangup problem at power-down) */
    2495     + struct notifier_block reboot_notifier;
    2496     };
    2497    
    2498     /* driver types */
    2499     @@ -1890,12 +1894,36 @@ static int azx_resume(struct pci_dev *pci)
    2500    
    2501    
    2502     /*
    2503     + * reboot notifier for hang-up problem at power-down
    2504     + */
    2505     +static int azx_halt(struct notifier_block *nb, unsigned long event, void *buf)
    2506     +{
    2507     + struct azx *chip = container_of(nb, struct azx, reboot_notifier);
    2508     + azx_stop_chip(chip);
    2509     + return NOTIFY_OK;
    2510     +}
    2511     +
    2512     +static void azx_notifier_register(struct azx *chip)
    2513     +{
    2514     + chip->reboot_notifier.notifier_call = azx_halt;
    2515     + register_reboot_notifier(&chip->reboot_notifier);
    2516     +}
    2517     +
    2518     +static void azx_notifier_unregister(struct azx *chip)
    2519     +{
    2520     + if (chip->reboot_notifier.notifier_call)
    2521     + unregister_reboot_notifier(&chip->reboot_notifier);
    2522     +}
    2523     +
    2524     +/*
    2525     * destructor
    2526     */
    2527     static int azx_free(struct azx *chip)
    2528     {
    2529     int i;
    2530    
    2531     + azx_notifier_unregister(chip);
    2532     +
    2533     if (chip->initialized) {
    2534     azx_clear_irq_pending(chip);
    2535     for (i = 0; i < chip->num_streams; i++)
    2536     @@ -2250,6 +2278,7 @@ static int __devinit azx_probe(struct pci_dev *pci,
    2537     pci_set_drvdata(pci, card);
    2538     chip->running = 1;
    2539     power_down_all_codecs(chip);
    2540     + azx_notifier_register(chip);
    2541    
    2542     dev++;
    2543     return err;