Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-magellan/patches-2.6.24-r3/0100-2.6.24.1-all-fixes.patch

    Contents of /trunk/kernel26-magellan/patches-2.6.24-r3/0100-2.6.24.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 500 - (show annotations) (download)
    Sat Mar 15 12:32:27 2008 UTC (16 years, 1 month ago) by niro
    File size: 62467 byte(s) 
    kernel-2.6.24-magellan-r3:
- updated to linux-2.6.24.3
    1 diff --git a/Documentation/video4linux/CARDLIST.cx23885 b/Documentation/video4linux/CARDLIST.cx23885
    2 index 00cb646..986ea57 100644
    3 --- a/Documentation/video4linux/CARDLIST.cx23885
    4 +++ b/Documentation/video4linux/CARDLIST.cx23885
    5 @@ -1,5 +1,5 @@
    6 0 -> UNKNOWN/GENERIC [0070:3400]
    7 1 -> Hauppauge WinTV-HVR1800lp [0070:7600]
    8 - 2 -> Hauppauge WinTV-HVR1800 [0070:7800,0070:7801]
    9 + 2 -> Hauppauge WinTV-HVR1800 [0070:7800,0070:7801,0070:7809]
    10 3 -> Hauppauge WinTV-HVR1250 [0070:7911]
    11 4 -> DViCO FusionHDTV5 Express [18ac:d500]
    12 diff --git a/arch/x86/kernel/Makefile_32 b/arch/x86/kernel/Makefile_32
    13 index a7bc93c..5e48bd2 100644
    14 --- a/arch/x86/kernel/Makefile_32
    15 +++ b/arch/x86/kernel/Makefile_32
    16 @@ -19,7 +19,8 @@ obj-$(CONFIG_X86_MSR) += msr.o
    17 obj-$(CONFIG_X86_CPUID) += cpuid.o
    18 obj-$(CONFIG_MICROCODE) += microcode.o
    19 obj-$(CONFIG_PCI) += early-quirks.o
    20 -obj-$(CONFIG_APM) += apm_32.o
    21 +apm-y := apm_32.o
    22 +obj-$(CONFIG_APM) += apm.o
    23 obj-$(CONFIG_X86_SMP) += smp_32.o smpboot_32.o tsc_sync.o
    24 obj-$(CONFIG_SMP) += smpcommon_32.o
    25 obj-$(CONFIG_X86_TRAMPOLINE) += trampoline_32.o
    26 diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
    27 index 8809654..bd12c8e 100644
    28 --- a/drivers/acpi/blacklist.c
    29 +++ b/drivers/acpi/blacklist.c
    30 @@ -208,24 +208,24 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
    31 * Disable OSI(Linux) warnings on all "Acer, inc."
    32 *
    33 * _OSI(Linux) disables the latest Windows BIOS code:
    34 + * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 3100"),
    35 * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5050"),
    36 + * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5100"),
    37 * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5580"),
    38 * DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 3010"),
    39 * _OSI(Linux) effect unknown:
    40 * DMI_MATCH(DMI_PRODUCT_NAME, "Ferrari 5000"),
    41 */
    42 - {
    43 - .callback = dmi_disable_osi_linux,
    44 - .ident = "Acer, inc.",
    45 - .matches = {
    46 - DMI_MATCH(DMI_SYS_VENDOR, "Acer, inc."),
    47 - },
    48 - },
    49 + /*
    50 + * note that dmi_check_system() uses strstr()
    51 + * to match sub-strings rather than !strcmp(),
    52 + * so "Acer" below matches "Acer, inc." above.
    53 + */
    54 /*
    55 * Disable OSI(Linux) warnings on all "Acer"
    56 *
    57 * _OSI(Linux) effect unknown:
    58 - * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5100"),
    59 + * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5315"),
    60 * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5610"),
    61 * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7720Z"),
    62 * DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 5520"),
    63 @@ -300,7 +300,7 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
    64 DMI_MATCH(DMI_BIOS_VENDOR, "COMPAL"),
    65 },
    66 },
    67 - { /* OSI(Linux) touches USB, breaks suspend to disk */
    68 + { /* OSI(Linux) touches USB, unknown side-effect */
    69 .callback = dmi_disable_osi_linux,
    70 .ident = "Dell Dimension 5150",
    71 .matches = {
    72 @@ -474,6 +474,11 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
    73 *
    74 * _OSI(Linux) confirmed to be a NOP:
    75 * DMI_MATCH(DMI_PRODUCT_NAME, "P1-J150B"),
    76 + * with DMI_MATCH(DMI_BOARD_NAME, "ROCKY"),
    77 + *
    78 + * unknown:
    79 + * DMI_MATCH(DMI_PRODUCT_NAME, "S1-MDGDG"),
    80 + * with DMI_MATCH(DMI_BOARD_NAME, "ROCKY"),
    81 */
    82 {
    83 .callback = dmi_disable_osi_linux,
    84 diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
    85 index e53fb51..fde7ac8 100644
    86 --- a/drivers/acpi/osl.c
    87 +++ b/drivers/acpi/osl.c
    88 @@ -120,7 +120,7 @@ static char osi_additional_string[OSI_STRING_LENGTH_MAX];
    89 */
    90 #define OSI_LINUX_ENABLE 0
    91
    92 -struct osi_linux {
    93 +static struct osi_linux {
    94 unsigned int enable:1;
    95 unsigned int dmi:1;
    96 unsigned int cmdline:1;
    97 @@ -1213,24 +1213,24 @@ acpi_status acpi_os_release_object(acpi_cache_t * cache, void *object)
    98 *
    99 * Returns 0 on success
    100 */
    101 -int acpi_dmi_dump(void)
    102 +static int acpi_dmi_dump(void)
    103 {
    104
    105 if (!dmi_available)
    106 return -1;
    107
    108 printk(KERN_NOTICE PREFIX "DMI System Vendor: %s\n",
    109 - dmi_get_slot(DMI_SYS_VENDOR));
    110 + dmi_get_system_info(DMI_SYS_VENDOR));
    111 printk(KERN_NOTICE PREFIX "DMI Product Name: %s\n",
    112 - dmi_get_slot(DMI_PRODUCT_NAME));
    113 + dmi_get_system_info(DMI_PRODUCT_NAME));
    114 printk(KERN_NOTICE PREFIX "DMI Product Version: %s\n",
    115 - dmi_get_slot(DMI_PRODUCT_VERSION));
    116 + dmi_get_system_info(DMI_PRODUCT_VERSION));
    117 printk(KERN_NOTICE PREFIX "DMI Board Name: %s\n",
    118 - dmi_get_slot(DMI_BOARD_NAME));
    119 + dmi_get_system_info(DMI_BOARD_NAME));
    120 printk(KERN_NOTICE PREFIX "DMI BIOS Vendor: %s\n",
    121 - dmi_get_slot(DMI_BIOS_VENDOR));
    122 + dmi_get_system_info(DMI_BIOS_VENDOR));
    123 printk(KERN_NOTICE PREFIX "DMI BIOS Date: %s\n",
    124 - dmi_get_slot(DMI_BIOS_DATE));
    125 + dmi_get_system_info(DMI_BIOS_DATE));
    126
    127 return 0;
    128 }
    129 diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
    130 index 0295855..4a1b9bf 100644
    131 --- a/drivers/base/firmware_class.c
    132 +++ b/drivers/base/firmware_class.c
    133 @@ -292,7 +292,8 @@ firmware_class_timeout(u_long data)
    134
    135 static inline void fw_setup_device_id(struct device *f_dev, struct device *dev)
    136 {
    137 - snprintf(f_dev->bus_id, BUS_ID_SIZE, "firmware-%s", dev->bus_id);
    138 + /* XXX warning we should watch out for name collisions */
    139 + strlcpy(f_dev->bus_id, dev->bus_id, BUS_ID_SIZE);
    140 }
    141
    142 static int fw_register_device(struct device **dev_p, const char *fw_name,
    143 diff --git a/drivers/char/drm/drm_stub.c b/drivers/char/drm/drm_stub.c
    144 index ee83ff9..a157ee5 100644
    145 --- a/drivers/char/drm/drm_stub.c
    146 +++ b/drivers/char/drm/drm_stub.c
    147 @@ -218,6 +218,7 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
    148 if (ret)
    149 goto err_g1;
    150
    151 + pci_set_master(pdev);
    152 if ((ret = drm_fill_in_dev(dev, pdev, ent, driver))) {
    153 printk(KERN_ERR "DRM: Fill_in_dev failed.\n");
    154 goto err_g2;
    155 diff --git a/drivers/char/drm/drm_vm.c b/drivers/char/drm/drm_vm.c
    156 index e8d50af..ef5e6b1 100644
    157 --- a/drivers/char/drm/drm_vm.c
    158 +++ b/drivers/char/drm/drm_vm.c
    159 @@ -506,6 +506,7 @@ static int drm_mmap_dma(struct file *filp, struct vm_area_struct *vma)
    160 vma->vm_ops = &drm_vm_dma_ops;
    161
    162 vma->vm_flags |= VM_RESERVED; /* Don't swap */
    163 + vma->vm_flags |= VM_DONTEXPAND;
    164
    165 vma->vm_file = filp; /* Needed for drm_vm_open() */
    166 drm_vm_open_locked(vma);
    167 @@ -655,6 +656,7 @@ static int drm_mmap_locked(struct file *filp, struct vm_area_struct *vma)
    168 return -EINVAL; /* This should never happen. */
    169 }
    170 vma->vm_flags |= VM_RESERVED; /* Don't swap */
    171 + vma->vm_flags |= VM_DONTEXPAND;
    172
    173 vma->vm_file = filp; /* Needed for drm_vm_open() */
    174 drm_vm_open_locked(vma);
    175 diff --git a/drivers/char/mspec.c b/drivers/char/mspec.c
    176 index 82f2e27..ff146c2 100644
    177 --- a/drivers/char/mspec.c
    178 +++ b/drivers/char/mspec.c
    179 @@ -283,7 +283,7 @@ mspec_mmap(struct file *file, struct vm_area_struct *vma,
    180 vdata->refcnt = ATOMIC_INIT(1);
    181 vma->vm_private_data = vdata;
    182
    183 - vma->vm_flags |= (VM_IO | VM_RESERVED | VM_PFNMAP);
    184 + vma->vm_flags |= (VM_IO | VM_RESERVED | VM_PFNMAP | VM_DONTEXPAND);
    185 if (vdata->type == MSPEC_FETCHOP || vdata->type == MSPEC_UNCACHED)
    186 vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
    187 vma->vm_ops = &mspec_vm_ops;
    188 diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
    189 index 5e596a7..b2fb6ba 100644
    190 --- a/drivers/firmware/dmi_scan.c
    191 +++ b/drivers/firmware/dmi_scan.c
    192 @@ -469,12 +469,3 @@ int dmi_get_year(int field)
    193
    194 return year;
    195 }
    196 -
    197 -/**
    198 - * dmi_get_slot - return dmi_ident[slot]
    199 - * @slot: index into dmi_ident[]
    200 - */
    201 -char *dmi_get_slot(int slot)
    202 -{
    203 - return(dmi_ident[slot]);
    204 -}
    205 diff --git a/drivers/media/video/cx23885/cx23885-cards.c b/drivers/media/video/cx23885/cx23885-cards.c
    206 index b9012ac..db00193 100644
    207 --- a/drivers/media/video/cx23885/cx23885-cards.c
    208 +++ b/drivers/media/video/cx23885/cx23885-cards.c
    209 @@ -138,6 +138,10 @@ struct cx23885_subid cx23885_subids[] = {
    210 .card = CX23885_BOARD_HAUPPAUGE_HVR1800,
    211 },{
    212 .subvendor = 0x0070,
    213 + .subdevice = 0x7809,
    214 + .card = CX23885_BOARD_HAUPPAUGE_HVR1800,
    215 + },{
    216 + .subvendor = 0x0070,
    217 .subdevice = 0x7911,
    218 .card = CX23885_BOARD_HAUPPAUGE_HVR1250,
    219 },{
    220 diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
    221 index f84c752..399592d 100644
    222 --- a/drivers/net/forcedeth.c
    223 +++ b/drivers/net/forcedeth.c
    224 @@ -5593,35 +5593,35 @@ static struct pci_device_id pci_tbl[] = {
    225 },
    226 { /* MCP77 Ethernet Controller */
    227 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_32),
    228 - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    229 + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    230 },
    231 { /* MCP77 Ethernet Controller */
    232 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_33),
    233 - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    234 + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    235 },
    236 { /* MCP77 Ethernet Controller */
    237 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_34),
    238 - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    239 + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    240 },
    241 { /* MCP77 Ethernet Controller */
    242 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_35),
    243 - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    244 + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    245 },
    246 { /* MCP79 Ethernet Controller */
    247 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_36),
    248 - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    249 + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    250 },
    251 { /* MCP79 Ethernet Controller */
    252 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_37),
    253 - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    254 + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    255 },
    256 { /* MCP79 Ethernet Controller */
    257 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_38),
    258 - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    259 + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    260 },
    261 { /* MCP79 Ethernet Controller */
    262 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_39),
    263 - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    264 + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    265 },
    266 {0,},
    267 };
    268 diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
    269 index bc15940..962e28b 100644
    270 --- a/drivers/net/sky2.c
    271 +++ b/drivers/net/sky2.c
    272 @@ -621,6 +621,7 @@ static void sky2_phy_power(struct sky2_hw *hw, unsigned port, int onoff)
    273 static const u32 phy_power[] = { PCI_Y2_PHY1_POWD, PCI_Y2_PHY2_POWD };
    274 static const u32 coma_mode[] = { PCI_Y2_PHY1_COMA, PCI_Y2_PHY2_COMA };
    275
    276 + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
    277 reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
    278 /* Turn on/off phy power saving */
    279 if (onoff)
    280 @@ -632,7 +633,8 @@ static void sky2_phy_power(struct sky2_hw *hw, unsigned port, int onoff)
    281 reg1 |= coma_mode[port];
    282
    283 sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
    284 - reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
    285 + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
    286 + sky2_pci_read32(hw, PCI_DEV_REG1);
    287
    288 udelay(100);
    289 }
    290 @@ -1412,6 +1414,7 @@ static int sky2_up(struct net_device *dev)
    291 imask |= portirq_msk[port];
    292 sky2_write32(hw, B0_IMSK, imask);
    293
    294 + sky2_set_multicast(dev);
    295 return 0;
    296
    297 err_out:
    298 @@ -2426,6 +2429,7 @@ static void sky2_hw_intr(struct sky2_hw *hw)
    299 if (status & (Y2_IS_MST_ERR | Y2_IS_IRQ_STAT)) {
    300 u16 pci_err;
    301
    302 + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
    303 pci_err = sky2_pci_read16(hw, PCI_STATUS);
    304 if (net_ratelimit())
    305 dev_err(&pdev->dev, "PCI hardware error (0x%x)\n",
    306 @@ -2433,12 +2437,14 @@ static void sky2_hw_intr(struct sky2_hw *hw)
    307
    308 sky2_pci_write16(hw, PCI_STATUS,
    309 pci_err | PCI_STATUS_ERROR_BITS);
    310 + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
    311 }
    312
    313 if (status & Y2_IS_PCI_EXP) {
    314 /* PCI-Express uncorrectable Error occurred */
    315 u32 err;
    316
    317 + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
    318 err = sky2_read32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS);
    319 sky2_write32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS,
    320 0xfffffffful);
    321 @@ -2446,6 +2452,7 @@ static void sky2_hw_intr(struct sky2_hw *hw)
    322 dev_err(&pdev->dev, "PCI Express error (0x%x)\n", err);
    323
    324 sky2_read32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS);
    325 + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
    326 }
    327
    328 if (status & Y2_HWE_L1_MASK)
    329 @@ -2811,6 +2818,7 @@ static void sky2_reset(struct sky2_hw *hw)
    330 }
    331
    332 sky2_power_on(hw);
    333 + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
    334
    335 for (i = 0; i < hw->ports; i++) {
    336 sky2_write8(hw, SK_REG(i, GMAC_LINK_CTRL), GMLC_RST_SET);
    337 @@ -3533,8 +3541,6 @@ static int sky2_set_ringparam(struct net_device *dev,
    338 err = sky2_up(dev);
    339 if (err)
    340 dev_close(dev);
    341 - else
    342 - sky2_set_multicast(dev);
    343 }
    344
    345 return err;
    346 @@ -4368,8 +4374,6 @@ static int sky2_resume(struct pci_dev *pdev)
    347 dev_close(dev);
    348 goto out;
    349 }
    350 -
    351 - sky2_set_multicast(dev);
    352 }
    353 }
    354
    355 diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
    356 index 5e8f8ac..559a9a9 100644
    357 --- a/drivers/net/wireless/b43/dma.c
    358 +++ b/drivers/net/wireless/b43/dma.c
    359 @@ -1106,7 +1106,7 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
    360 {
    361 const struct b43_dma_ops *ops = ring->ops;
    362 u8 *header;
    363 - int slot;
    364 + int slot, old_top_slot, old_used_slots;
    365 int err;
    366 struct b43_dmadesc_generic *desc;
    367 struct b43_dmadesc_meta *meta;
    368 @@ -1116,20 +1116,31 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
    369 #define SLOTS_PER_PACKET 2
    370 B43_WARN_ON(skb_shinfo(skb)->nr_frags);
    371
    372 + old_top_slot = ring->current_slot;
    373 + old_used_slots = ring->used_slots;
    374 +
    375 /* Get a slot for the header. */
    376 slot = request_slot(ring);
    377 desc = ops->idx2desc(ring, slot, &meta_hdr);
    378 memset(meta_hdr, 0, sizeof(*meta_hdr));
    379
    380 header = &(ring->txhdr_cache[slot * sizeof(struct b43_txhdr_fw4)]);
    381 - b43_generate_txhdr(ring->dev, header,
    382 + err = b43_generate_txhdr(ring->dev, header,
    383 skb->data, skb->len, ctl,
    384 generate_cookie(ring, slot));
    385 + if (unlikely(err)) {
    386 + ring->current_slot = old_top_slot;
    387 + ring->used_slots = old_used_slots;
    388 + return err;
    389 + }
    390
    391 meta_hdr->dmaaddr = map_descbuffer(ring, (unsigned char *)header,
    392 sizeof(struct b43_txhdr_fw4), 1);
    393 - if (dma_mapping_error(meta_hdr->dmaaddr))
    394 + if (dma_mapping_error(meta_hdr->dmaaddr)) {
    395 + ring->current_slot = old_top_slot;
    396 + ring->used_slots = old_used_slots;
    397 return -EIO;
    398 + }
    399 ops->fill_descriptor(ring, desc, meta_hdr->dmaaddr,
    400 sizeof(struct b43_txhdr_fw4), 1, 0, 0);
    401
    402 @@ -1147,6 +1158,8 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
    403 if (dma_mapping_error(meta->dmaaddr)) {
    404 bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
    405 if (!bounce_skb) {
    406 + ring->current_slot = old_top_slot;
    407 + ring->used_slots = old_used_slots;
    408 err = -ENOMEM;
    409 goto out_unmap_hdr;
    410 }
    411 @@ -1157,6 +1170,8 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
    412 meta->skb = skb;
    413 meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
    414 if (dma_mapping_error(meta->dmaaddr)) {
    415 + ring->current_slot = old_top_slot;
    416 + ring->used_slots = old_used_slots;
    417 err = -EIO;
    418 goto out_free_bounce;
    419 }
    420 @@ -1219,6 +1234,13 @@ int b43_dma_tx(struct b43_wldev *dev,
    421 B43_WARN_ON(ring->stopped);
    422
    423 err = dma_tx_fragment(ring, skb, ctl);
    424 + if (unlikely(err == -ENOKEY)) {
    425 + /* Drop this packet, as we don't have the encryption key
    426 + * anymore and must not transmit it unencrypted. */
    427 + dev_kfree_skb_any(skb);
    428 + err = 0;
    429 + goto out_unlock;
    430 + }
    431 if (unlikely(err)) {
    432 b43err(dev->wl, "DMA tx mapping failure\n");
    433 goto out_unlock;
    434 diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
    435 index 1c93b4f..69795fd 100644
    436 --- a/drivers/net/wireless/b43/main.c
    437 +++ b/drivers/net/wireless/b43/main.c
    438 @@ -1800,6 +1800,18 @@ static int b43_upload_microcode(struct b43_wldev *dev)
    439 err = -EOPNOTSUPP;
    440 goto out;
    441 }
    442 + if (fwrev > 351) {
    443 + b43err(dev->wl, "YOUR FIRMWARE IS TOO NEW. Please downgrade your "
    444 + "firmware.\n");
    445 + b43err(dev->wl, "Use this firmware tarball: "
    446 + "http://downloads.openwrt.org/sources/broadcom-wl-4.80.53.0.tar.bz2\n");
    447 + b43err(dev->wl, "Use this b43-fwcutter tarball: "
    448 + "http://bu3sch.de/b43/fwcutter/b43-fwcutter-009.tar.bz2\n");
    449 + b43err(dev->wl, "Read, understand and _do_ what this message says, please.\n");
    450 + b43_write32(dev, B43_MMIO_MACCTL, 0);
    451 + err = -EOPNOTSUPP;
    452 + goto out;
    453 + }
    454 b43dbg(dev->wl, "Loading firmware version %u.%u "
    455 "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
    456 fwrev, fwpatch,
    457 @@ -3395,8 +3407,6 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
    458 b43_bluetooth_coext_enable(dev);
    459
    460 ssb_bus_powerup(bus, 1); /* Enable dynamic PCTL */
    461 - memset(wl->bssid, 0, ETH_ALEN);
    462 - memset(wl->mac_addr, 0, ETH_ALEN);
    463 b43_upload_card_macaddress(dev);
    464 b43_security_init(dev);
    465 b43_rng_init(wl);
    466 @@ -3493,6 +3503,13 @@ static int b43_start(struct ieee80211_hw *hw)
    467 int did_init = 0;
    468 int err = 0;
    469
    470 + /* Kill all old instance specific information to make sure
    471 + * the card won't use it in the short timeframe between start
    472 + * and mac80211 reconfiguring it. */
    473 + memset(wl->bssid, 0, ETH_ALEN);
    474 + memset(wl->mac_addr, 0, ETH_ALEN);
    475 + wl->filter_flags = 0;
    476 +
    477 /* First register RFkill.
    478 * LEDs that are registered later depend on it. */
    479 b43_rfkill_init(dev);
    480 diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
    481 index 3307ba1..a856b9f 100644
    482 --- a/drivers/net/wireless/b43/xmit.c
    483 +++ b/drivers/net/wireless/b43/xmit.c
    484 @@ -177,7 +177,7 @@ static u8 b43_calc_fallback_rate(u8 bitrate)
    485 return 0;
    486 }
    487
    488 -static void generate_txhdr_fw4(struct b43_wldev *dev,
    489 +static int generate_txhdr_fw4(struct b43_wldev *dev,
    490 struct b43_txhdr_fw4 *txhdr,
    491 const unsigned char *fragment_data,
    492 unsigned int fragment_len,
    493 @@ -235,7 +235,15 @@ static void generate_txhdr_fw4(struct b43_wldev *dev,
    494
    495 B43_WARN_ON(key_idx >= dev->max_nr_keys);
    496 key = &(dev->key[key_idx]);
    497 - B43_WARN_ON(!key->keyconf);
    498 +
    499 + if (unlikely(!key->keyconf)) {
    500 + /* This key is invalid. This might only happen
    501 + * in a short timeframe after machine resume before
    502 + * we were able to reconfigure keys.
    503 + * Drop this packet completely. Do not transmit it
    504 + * unencrypted to avoid leaking information. */
    505 + return -ENOKEY;
    506 + }
    507
    508 /* Hardware appends ICV. */
    509 plcp_fragment_len += txctl->icv_len;
    510 @@ -352,16 +360,18 @@ static void generate_txhdr_fw4(struct b43_wldev *dev,
    511 txhdr->mac_ctl = cpu_to_le32(mac_ctl);
    512 txhdr->phy_ctl = cpu_to_le16(phy_ctl);
    513 txhdr->extra_ft = extra_ft;
    514 +
    515 + return 0;
    516 }
    517
    518 -void b43_generate_txhdr(struct b43_wldev *dev,
    519 +int b43_generate_txhdr(struct b43_wldev *dev,
    520 u8 * txhdr,
    521 const unsigned char *fragment_data,
    522 unsigned int fragment_len,
    523 const struct ieee80211_tx_control *txctl, u16 cookie)
    524 {
    525 - generate_txhdr_fw4(dev, (struct b43_txhdr_fw4 *)txhdr,
    526 - fragment_data, fragment_len, txctl, cookie);
    527 + return generate_txhdr_fw4(dev, (struct b43_txhdr_fw4 *)txhdr,
    528 + fragment_data, fragment_len, txctl, cookie);
    529 }
    530
    531 static s8 b43_rssi_postprocess(struct b43_wldev *dev,
    532 diff --git a/drivers/net/wireless/b43/xmit.h b/drivers/net/wireless/b43/xmit.h
    533 index 6dc0793..e3bac08 100644
    534 --- a/drivers/net/wireless/b43/xmit.h
    535 +++ b/drivers/net/wireless/b43/xmit.h
    536 @@ -82,7 +82,7 @@ struct b43_txhdr_fw4 {
    537 #define B43_TX4_PHY_ANT1 0x0100 /* Use antenna 1 */
    538 #define B43_TX4_PHY_ANTLAST 0x0300 /* Use last used antenna */
    539
    540 -void b43_generate_txhdr(struct b43_wldev *dev,
    541 +int b43_generate_txhdr(struct b43_wldev *dev,
    542 u8 * txhdr,
    543 const unsigned char *fragment_data,
    544 unsigned int fragment_len,
    545 diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
    546 index 83161d9..6e08405 100644
    547 --- a/drivers/net/wireless/b43legacy/dma.c
    548 +++ b/drivers/net/wireless/b43legacy/dma.c
    549 @@ -1164,7 +1164,7 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
    550 {
    551 const struct b43legacy_dma_ops *ops = ring->ops;
    552 u8 *header;
    553 - int slot;
    554 + int slot, old_top_slot, old_used_slots;
    555 int err;
    556 struct b43legacy_dmadesc_generic *desc;
    557 struct b43legacy_dmadesc_meta *meta;
    558 @@ -1174,6 +1174,9 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
    559 #define SLOTS_PER_PACKET 2
    560 B43legacy_WARN_ON(skb_shinfo(skb)->nr_frags != 0);
    561
    562 + old_top_slot = ring->current_slot;
    563 + old_used_slots = ring->used_slots;
    564 +
    565 /* Get a slot for the header. */
    566 slot = request_slot(ring);
    567 desc = ops->idx2desc(ring, slot, &meta_hdr);
    568 @@ -1181,9 +1184,14 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
    569
    570 header = &(ring->txhdr_cache[slot * sizeof(
    571 struct b43legacy_txhdr_fw3)]);
    572 - b43legacy_generate_txhdr(ring->dev, header,
    573 + err = b43legacy_generate_txhdr(ring->dev, header,
    574 skb->data, skb->len, ctl,
    575 generate_cookie(ring, slot));
    576 + if (unlikely(err)) {
    577 + ring->current_slot = old_top_slot;
    578 + ring->used_slots = old_used_slots;
    579 + return err;
    580 + }
    581
    582 meta_hdr->dmaaddr = map_descbuffer(ring, (unsigned char *)header,
    583 sizeof(struct b43legacy_txhdr_fw3), 1);
    584 @@ -1206,6 +1214,8 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
    585 if (dma_mapping_error(meta->dmaaddr)) {
    586 bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
    587 if (!bounce_skb) {
    588 + ring->current_slot = old_top_slot;
    589 + ring->used_slots = old_used_slots;
    590 err = -ENOMEM;
    591 goto out_unmap_hdr;
    592 }
    593 @@ -1216,6 +1226,8 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
    594 meta->skb = skb;
    595 meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
    596 if (dma_mapping_error(meta->dmaaddr)) {
    597 + ring->current_slot = old_top_slot;
    598 + ring->used_slots = old_used_slots;
    599 err = -EIO;
    600 goto out_free_bounce;
    601 }
    602 @@ -1282,6 +1294,13 @@ int b43legacy_dma_tx(struct b43legacy_wldev *dev,
    603 B43legacy_BUG_ON(ring->stopped);
    604
    605 err = dma_tx_fragment(ring, skb, ctl);
    606 + if (unlikely(err == -ENOKEY)) {
    607 + /* Drop this packet, as we don't have the encryption key
    608 + * anymore and must not transmit it unencrypted. */
    609 + dev_kfree_skb_any(skb);
    610 + err = 0;
    611 + goto out_unlock;
    612 + }
    613 if (unlikely(err)) {
    614 b43legacyerr(dev->wl, "DMA tx mapping failure\n");
    615 goto out_unlock;
    616 diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
    617 index 32d5e17..cdb0497 100644
    618 --- a/drivers/net/wireless/b43legacy/main.c
    619 +++ b/drivers/net/wireless/b43legacy/main.c
    620 @@ -3215,8 +3215,6 @@ static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev)
    621 b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, 0x0414, 0x01F4);
    622
    623 ssb_bus_powerup(bus, 1); /* Enable dynamic PCTL */
    624 - memset(wl->bssid, 0, ETH_ALEN);
    625 - memset(wl->mac_addr, 0, ETH_ALEN);
    626 b43legacy_upload_card_macaddress(dev);
    627 b43legacy_security_init(dev);
    628 b43legacy_rng_init(wl);
    629 @@ -3311,6 +3309,13 @@ static int b43legacy_start(struct ieee80211_hw *hw)
    630 int did_init = 0;
    631 int err = 0;
    632
    633 + /* Kill all old instance specific information to make sure
    634 + * the card won't use it in the short timeframe between start
    635 + * and mac80211 reconfiguring it. */
    636 + memset(wl->bssid, 0, ETH_ALEN);
    637 + memset(wl->mac_addr, 0, ETH_ALEN);
    638 + wl->filter_flags = 0;
    639 +
    640 mutex_lock(&wl->mutex);
    641
    642 if (b43legacy_status(dev) < B43legacy_STAT_INITIALIZED) {
    643 diff --git a/drivers/net/wireless/b43legacy/pio.c b/drivers/net/wireless/b43legacy/pio.c
    644 index de843ac..3034503 100644
    645 --- a/drivers/net/wireless/b43legacy/pio.c
    646 +++ b/drivers/net/wireless/b43legacy/pio.c
    647 @@ -181,7 +181,7 @@ union txhdr_union {
    648 struct b43legacy_txhdr_fw3 txhdr_fw3;
    649 };
    650
    651 -static void pio_tx_write_fragment(struct b43legacy_pioqueue *queue,
    652 +static int pio_tx_write_fragment(struct b43legacy_pioqueue *queue,
    653 struct sk_buff *skb,
    654 struct b43legacy_pio_txpacket *packet,
    655 size_t txhdr_size)
    656 @@ -189,14 +189,17 @@ static void pio_tx_write_fragment(struct b43legacy_pioqueue *queue,
    657 union txhdr_union txhdr_data;
    658 u8 *txhdr = NULL;
    659 unsigned int octets;
    660 + int err;
    661
    662 txhdr = (u8 *)(&txhdr_data.txhdr_fw3);
    663
    664 B43legacy_WARN_ON(skb_shinfo(skb)->nr_frags != 0);
    665 - b43legacy_generate_txhdr(queue->dev,
    666 + err = b43legacy_generate_txhdr(queue->dev,
    667 txhdr, skb->data, skb->len,
    668 &packet->txstat.control,
    669 generate_cookie(queue, packet));
    670 + if (err)
    671 + return err;
    672
    673 tx_start(queue);
    674 octets = skb->len + txhdr_size;
    675 @@ -204,6 +207,8 @@ static void pio_tx_write_fragment(struct b43legacy_pioqueue *queue,
    676 octets--;
    677 tx_data(queue, txhdr, (u8 *)skb->data, octets);
    678 tx_complete(queue, skb);
    679 +
    680 + return 0;
    681 }
    682
    683 static void free_txpacket(struct b43legacy_pio_txpacket *packet,
    684 @@ -226,6 +231,7 @@ static int pio_tx_packet(struct b43legacy_pio_txpacket *packet)
    685 struct b43legacy_pioqueue *queue = packet->queue;
    686 struct sk_buff *skb = packet->skb;
    687 u16 octets;
    688 + int err;
    689
    690 octets = (u16)skb->len + sizeof(struct b43legacy_txhdr_fw3);
    691 if (queue->tx_devq_size < octets) {
    692 @@ -247,8 +253,14 @@ static int pio_tx_packet(struct b43legacy_pio_txpacket *packet)
    693 if (queue->tx_devq_used + octets > queue->tx_devq_size)
    694 return -EBUSY;
    695 /* Now poke the device. */
    696 - pio_tx_write_fragment(queue, skb, packet,
    697 + err = pio_tx_write_fragment(queue, skb, packet,
    698 sizeof(struct b43legacy_txhdr_fw3));
    699 + if (unlikely(err == -ENOKEY)) {
    700 + /* Drop this packet, as we don't have the encryption key
    701 + * anymore and must not transmit it unencrypted. */
    702 + free_txpacket(packet, 1);
    703 + return 0;
    704 + }
    705
    706 /* Account for the packet size.
    707 * (We must not overflow the device TX queue)
    708 @@ -486,6 +498,9 @@ void b43legacy_pio_handle_txstatus(struct b43legacy_wldev *dev,
    709 queue = parse_cookie(dev, status->cookie, &packet);
    710 B43legacy_WARN_ON(!queue);
    711
    712 + if (!packet->skb)
    713 + return;
    714 +
    715 queue->tx_devq_packets--;
    716 queue->tx_devq_used -= (packet->skb->len +
    717 sizeof(struct b43legacy_txhdr_fw3));
    718 diff --git a/drivers/net/wireless/b43legacy/xmit.c b/drivers/net/wireless/b43legacy/xmit.c
    719 index fa1e656..f10d637 100644
    720 --- a/drivers/net/wireless/b43legacy/xmit.c
    721 +++ b/drivers/net/wireless/b43legacy/xmit.c
    722 @@ -181,7 +181,7 @@ static u8 b43legacy_calc_fallback_rate(u8 bitrate)
    723 return 0;
    724 }
    725
    726 -static void generate_txhdr_fw3(struct b43legacy_wldev *dev,
    727 +static int generate_txhdr_fw3(struct b43legacy_wldev *dev,
    728 struct b43legacy_txhdr_fw3 *txhdr,
    729 const unsigned char *fragment_data,
    730 unsigned int fragment_len,
    731 @@ -252,6 +252,13 @@ static void generate_txhdr_fw3(struct b43legacy_wldev *dev,
    732 iv_len = min((size_t)txctl->iv_len,
    733 ARRAY_SIZE(txhdr->iv));
    734 memcpy(txhdr->iv, ((u8 *)wlhdr) + wlhdr_len, iv_len);
    735 + } else {
    736 + /* This key is invalid. This might only happen
    737 + * in a short timeframe after machine resume before
    738 + * we were able to reconfigure keys.
    739 + * Drop this packet completely. Do not transmit it
    740 + * unencrypted to avoid leaking information. */
    741 + return -ENOKEY;
    742 }
    743 }
    744 b43legacy_generate_plcp_hdr((struct b43legacy_plcp_hdr4 *)
    745 @@ -344,16 +351,18 @@ static void generate_txhdr_fw3(struct b43legacy_wldev *dev,
    746 /* Apply the bitfields */
    747 txhdr->mac_ctl = cpu_to_le32(mac_ctl);
    748 txhdr->phy_ctl = cpu_to_le16(phy_ctl);
    749 +
    750 + return 0;
    751 }
    752
    753 -void b43legacy_generate_txhdr(struct b43legacy_wldev *dev,
    754 +int b43legacy_generate_txhdr(struct b43legacy_wldev *dev,
    755 u8 *txhdr,
    756 const unsigned char *fragment_data,
    757 unsigned int fragment_len,
    758 const struct ieee80211_tx_control *txctl,
    759 u16 cookie)
    760 {
    761 - generate_txhdr_fw3(dev, (struct b43legacy_txhdr_fw3 *)txhdr,
    762 + return generate_txhdr_fw3(dev, (struct b43legacy_txhdr_fw3 *)txhdr,
    763 fragment_data, fragment_len,
    764 txctl, cookie);
    765 }
    766 diff --git a/drivers/net/wireless/b43legacy/xmit.h b/drivers/net/wireless/b43legacy/xmit.h
    767 index 8a155d0..bab4792 100644
    768 --- a/drivers/net/wireless/b43legacy/xmit.h
    769 +++ b/drivers/net/wireless/b43legacy/xmit.h
    770 @@ -76,7 +76,7 @@ struct b43legacy_txhdr_fw3 {
    771
    772
    773
    774 -void b43legacy_generate_txhdr(struct b43legacy_wldev *dev,
    775 +int b43legacy_generate_txhdr(struct b43legacy_wldev *dev,
    776 u8 *txhdr,
    777 const unsigned char *fragment_data,
    778 unsigned int fragment_len,
    779 diff --git a/drivers/pci/hotplug/fakephp.c b/drivers/pci/hotplug/fakephp.c
    780 index d7a293e..94b6401 100644
    781 --- a/drivers/pci/hotplug/fakephp.c
    782 +++ b/drivers/pci/hotplug/fakephp.c
    783 @@ -39,6 +39,7 @@
    784 #include <linux/init.h>
    785 #include <linux/string.h>
    786 #include <linux/slab.h>
    787 +#include <linux/workqueue.h>
    788 #include "../pci.h"
    789
    790 #if !defined(MODULE)
    791 @@ -63,10 +64,16 @@ struct dummy_slot {
    792 struct list_head node;
    793 struct hotplug_slot *slot;
    794 struct pci_dev *dev;
    795 + struct work_struct remove_work;
    796 + unsigned long removed;
    797 };
    798
    799 static int debug;
    800 static LIST_HEAD(slot_list);
    801 +static struct workqueue_struct *dummyphp_wq;
    802 +
    803 +static void pci_rescan_worker(struct work_struct *work);
    804 +static DECLARE_WORK(pci_rescan_work, pci_rescan_worker);
    805
    806 static int enable_slot (struct hotplug_slot *slot);
    807 static int disable_slot (struct hotplug_slot *slot);
    808 @@ -109,7 +116,7 @@ static int add_slot(struct pci_dev *dev)
    809 slot->name = &dev->dev.bus_id[0];
    810 dbg("slot->name = %s\n", slot->name);
    811
    812 - dslot = kmalloc(sizeof(struct dummy_slot), GFP_KERNEL);
    813 + dslot = kzalloc(sizeof(struct dummy_slot), GFP_KERNEL);
    814 if (!dslot)
    815 goto error_info;
    816
    817 @@ -164,6 +171,14 @@ static void remove_slot(struct dummy_slot *dslot)
    818 err("Problem unregistering a slot %s\n", dslot->slot->name);
    819 }
    820
    821 +/* called from the single-threaded workqueue handler to remove a slot */
    822 +static void remove_slot_worker(struct work_struct *work)
    823 +{
    824 + struct dummy_slot *dslot =
    825 + container_of(work, struct dummy_slot, remove_work);
    826 + remove_slot(dslot);
    827 +}
    828 +
    829 /**
    830 * pci_rescan_slot - Rescan slot
    831 * @temp: Device template. Should be set: bus and devfn.
    832 @@ -267,11 +282,17 @@ static inline void pci_rescan(void) {
    833 pci_rescan_buses(&pci_root_buses);
    834 }
    835
    836 +/* called from the single-threaded workqueue handler to rescan all pci buses */
    837 +static void pci_rescan_worker(struct work_struct *work)
    838 +{
    839 + pci_rescan();
    840 +}
    841
    842 static int enable_slot(struct hotplug_slot *hotplug_slot)
    843 {
    844 /* mis-use enable_slot for rescanning of the pci bus */
    845 - pci_rescan();
    846 + cancel_work_sync(&pci_rescan_work);
    847 + queue_work(dummyphp_wq, &pci_rescan_work);
    848 return -ENODEV;
    849 }
    850
    851 @@ -306,6 +327,10 @@ static int disable_slot(struct hotplug_slot *slot)
    852 err("Can't remove PCI devices with other PCI devices behind it yet.\n");
    853 return -ENODEV;
    854 }
    855 + if (test_and_set_bit(0, &dslot->removed)) {
    856 + dbg("Slot already scheduled for removal\n");
    857 + return -ENODEV;
    858 + }
    859 /* search for subfunctions and disable them first */
    860 if (!(dslot->dev->devfn & 7)) {
    861 for (func = 1; func < 8; func++) {
    862 @@ -328,8 +353,9 @@ static int disable_slot(struct hotplug_slot *slot)
    863 /* remove the device from the pci core */
    864 pci_remove_bus_device(dslot->dev);
    865
    866 - /* blow away this sysfs entry and other parts. */
    867 - remove_slot(dslot);
    868 + /* queue work item to blow away this sysfs entry and other parts. */
    869 + INIT_WORK(&dslot->remove_work, remove_slot_worker);
    870 + queue_work(dummyphp_wq, &dslot->remove_work);
    871
    872 return 0;
    873 }
    874 @@ -340,6 +366,7 @@ static void cleanup_slots (void)
    875 struct list_head *next;
    876 struct dummy_slot *dslot;
    877
    878 + destroy_workqueue(dummyphp_wq);
    879 list_for_each_safe (tmp, next, &slot_list) {
    880 dslot = list_entry (tmp, struct dummy_slot, node);
    881 remove_slot(dslot);
    882 @@ -351,6 +378,10 @@ static int __init dummyphp_init(void)
    883 {
    884 info(DRIVER_DESC "\n");
    885
    886 + dummyphp_wq = create_singlethread_workqueue(MY_NAME);
    887 + if (!dummyphp_wq)
    888 + return -ENOMEM;
    889 +
    890 return pci_scan_buses();
    891 }
    892
    893 diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
    894 index c51f8e9..b469718 100644
    895 --- a/drivers/usb/core/driver.c
    896 +++ b/drivers/usb/core/driver.c
    897 @@ -534,8 +534,8 @@ const struct usb_device_id *usb_match_id(struct usb_interface *interface,
    898 id->driver_info is the way to create an entry that
    899 indicates that the driver want to examine every
    900 device and interface. */
    901 - for (; id->idVendor || id->bDeviceClass || id->bInterfaceClass ||
    902 - id->driver_info; id++) {
    903 + for (; id->idVendor || id->idProduct || id->bDeviceClass ||
    904 + id->bInterfaceClass || id->driver_info; id++) {
    905 if (usb_match_one_id(interface, id))
    906 return id;
    907 }
    908 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    909 index b04d232..1b17f63 100644
    910 --- a/drivers/usb/core/hub.c
    911 +++ b/drivers/usb/core/hub.c
    912 @@ -2946,7 +2946,7 @@ static int config_descriptors_changed(struct usb_device *udev)
    913 if (len < le16_to_cpu(udev->config[index].desc.wTotalLength))
    914 len = le16_to_cpu(udev->config[index].desc.wTotalLength);
    915 }
    916 - buf = kmalloc (len, GFP_KERNEL);
    917 + buf = kmalloc(len, GFP_NOIO);
    918 if (buf == NULL) {
    919 dev_err(&udev->dev, "no mem to re-read configs after reset\n");
    920 /* assume the worst */
    921 diff --git a/drivers/usb/gadget/fsl_usb2_udc.c b/drivers/usb/gadget/fsl_usb2_udc.c
    922 index 038e7d7..d59eb92 100644
    923 --- a/drivers/usb/gadget/fsl_usb2_udc.c
    924 +++ b/drivers/usb/gadget/fsl_usb2_udc.c
    925 @@ -776,7 +776,7 @@ fsl_ep_queue(struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
    926 VDBG("%s, bad params\n", __FUNCTION__);
    927 return -EINVAL;
    928 }
    929 - if (!_ep || (!ep->desc && ep_index(ep))) {
    930 + if (unlikely(!_ep || !ep->desc)) {
    931 VDBG("%s, bad ep\n", __FUNCTION__);
    932 return -EINVAL;
    933 }
    934 diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
    935 index ea31621..81755d0 100644
    936 --- a/drivers/usb/misc/usbtest.c
    937 +++ b/drivers/usb/misc/usbtest.c
    938 @@ -1151,6 +1151,7 @@ static int verify_halted (int ep, struct urb *urb)
    939 dbg ("ep %02x couldn't get halt status, %d", ep, retval);
    940 return retval;
    941 }
    942 + le16_to_cpus(&status);
    943 if (status != 1) {
    944 dbg ("ep %02x bogus status: %04x != 1", ep, status);
    945 return -EINVAL;
    946 diff --git a/drivers/usb/serial/cp2101.c b/drivers/usb/serial/cp2101.c
    947 index 2283358..cd5f71b 100644
    948 --- a/drivers/usb/serial/cp2101.c
    949 +++ b/drivers/usb/serial/cp2101.c
    950 @@ -59,6 +59,7 @@ static struct usb_device_id id_table [] = {
    951 { USB_DEVICE(0x10A6, 0xAA26) }, /* Knock-off DCU-11 cable */
    952 { USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */
    953 { USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */
    954 + { USB_DEVICE(0x10C4, 0x800A) }, /* SPORTident BSM7-D-USB main station */
    955 { USB_DEVICE(0x10C4, 0x803B) }, /* Pololu USB-serial converter */
    956 { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */
    957 { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */
    958 @@ -76,8 +77,13 @@ static struct usb_device_id id_table [] = {
    959 { USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */
    960 { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
    961 { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
    962 + { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */
    963 + { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */
    964 + { USB_DEVICE(0x10C4, 0xF003) }, /* Elan Digital Systems USBpulse100 */
    965 + { USB_DEVICE(0x10C4, 0xF004) }, /* Elan Digital Systems USBcount50 */
    966 { USB_DEVICE(0x10C5, 0xEA61) }, /* Silicon Labs MobiData GPRS USB Modem */
    967 { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */
    968 + { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */
    969 { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
    970 { } /* Terminating Entry */
    971 };
    972 diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    973 index c40e77d..1382af9 100644
    974 --- a/drivers/usb/serial/ftdi_sio.c
    975 +++ b/drivers/usb/serial/ftdi_sio.c
    976 @@ -471,30 +471,28 @@ static struct usb_device_id id_table_combined [] = {
    977 { USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) },
    978 { USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) },
    979 /*
    980 - * These will probably use user-space drivers. Uncomment them if
    981 - * you need them or use the user-specified vendor/product module
    982 - * parameters (see ftdi_sio.h for the numbers). Make a fuss if
    983 - * you think the driver should recognize any of them by default.
    984 + * Due to many user requests for multiple ELV devices we enable
    985 + * them by default.
    986 */
    987 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_CLI7000_PID) }, */
    988 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_PPS7330_PID) }, */
    989 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_TFM100_PID) }, */
    990 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_UDF77_PID) }, */
    991 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_UIO88_PID) }, */
    992 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_UAD8_PID) }, */
    993 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_UDA7_PID) }, */
    994 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_USI2_PID) }, */
    995 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_T1100_PID) }, */
    996 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_PCD200_PID) }, */
    997 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_ULA200_PID) }, */
    998 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_CSI8_PID) }, */
    999 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_EM1000DL_PID) }, */
    1000 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_PCK100_PID) }, */
    1001 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_RFP500_PID) }, */
    1002 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_FS20SIG_PID) }, */
    1003 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_WS300PC_PID) }, */
    1004 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_FHZ1300PC_PID) }, */
    1005 - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_WS500_PID) }, */
    1006 + { USB_DEVICE(FTDI_VID, FTDI_ELV_CLI7000_PID) },
    1007 + { USB_DEVICE(FTDI_VID, FTDI_ELV_PPS7330_PID) },
    1008 + { USB_DEVICE(FTDI_VID, FTDI_ELV_TFM100_PID) },
    1009 + { USB_DEVICE(FTDI_VID, FTDI_ELV_UDF77_PID) },
    1010 + { USB_DEVICE(FTDI_VID, FTDI_ELV_UIO88_PID) },
    1011 + { USB_DEVICE(FTDI_VID, FTDI_ELV_UAD8_PID) },
    1012 + { USB_DEVICE(FTDI_VID, FTDI_ELV_UDA7_PID) },
    1013 + { USB_DEVICE(FTDI_VID, FTDI_ELV_USI2_PID) },
    1014 + { USB_DEVICE(FTDI_VID, FTDI_ELV_T1100_PID) },
    1015 + { USB_DEVICE(FTDI_VID, FTDI_ELV_PCD200_PID) },
    1016 + { USB_DEVICE(FTDI_VID, FTDI_ELV_ULA200_PID) },
    1017 + { USB_DEVICE(FTDI_VID, FTDI_ELV_CSI8_PID) },
    1018 + { USB_DEVICE(FTDI_VID, FTDI_ELV_EM1000DL_PID) },
    1019 + { USB_DEVICE(FTDI_VID, FTDI_ELV_PCK100_PID) },
    1020 + { USB_DEVICE(FTDI_VID, FTDI_ELV_RFP500_PID) },
    1021 + { USB_DEVICE(FTDI_VID, FTDI_ELV_FS20SIG_PID) },
    1022 + { USB_DEVICE(FTDI_VID, FTDI_ELV_WS300PC_PID) },
    1023 + { USB_DEVICE(FTDI_VID, FTDI_ELV_FHZ1300PC_PID) },
    1024 + { USB_DEVICE(FTDI_VID, FTDI_ELV_WS500_PID) },
    1025 { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
    1026 { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
    1027 { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
    1028 @@ -545,6 +543,7 @@ static struct usb_device_id id_table_combined [] = {
    1029 { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16C_PID) },
    1030 { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16HR_PID) },
    1031 { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16HRC_PID) },
    1032 + { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16IC_PID) },
    1033 { USB_DEVICE(KOBIL_VID, KOBIL_CONV_B1_PID) },
    1034 { USB_DEVICE(KOBIL_VID, KOBIL_CONV_KAAN_PID) },
    1035 { USB_DEVICE(POSIFLEX_VID, POSIFLEX_PP7000_PID) },
    1036 @@ -569,6 +568,7 @@ static struct usb_device_id id_table_combined [] = {
    1037 { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
    1038 { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
    1039 { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
    1040 + { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) },
    1041 { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
    1042 .driver_info = (kernel_ulong_t)&ftdi_olimex_quirk },
    1043 { }, /* Optional parameter entry */
    1044 diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
    1045 index b51cbb0..f6053da 100644
    1046 --- a/drivers/usb/serial/ftdi_sio.h
    1047 +++ b/drivers/usb/serial/ftdi_sio.h
    1048 @@ -245,6 +245,7 @@
    1049 #define FTDI_ELV_WS300PC_PID 0xE0F6 /* PC-Wetterstation (WS 300 PC) */
    1050 #define FTDI_ELV_FHZ1300PC_PID 0xE0E8 /* FHZ 1300 PC */
    1051 #define FTDI_ELV_WS500_PID 0xE0E9 /* PC-Wetterstation (WS 500) */
    1052 +#define FTDI_ELV_EM1010PC_PID 0xE0EF /* Engery monitor EM 1010 PC */
    1053
    1054 /*
    1055 * Definitions for ID TECH (www.idt-net.com) devices
    1056 @@ -278,6 +279,7 @@
    1057 #define FTDI_ATIK_ATK16C_PID 0xDF32 /* ATIK ATK-16C Colour Camera */
    1058 #define FTDI_ATIK_ATK16HR_PID 0xDF31 /* ATIK ATK-16HR Grayscale Camera */
    1059 #define FTDI_ATIK_ATK16HRC_PID 0xDF33 /* ATIK ATK-16HRC Colour Camera */
    1060 +#define FTDI_ATIK_ATK16IC_PID 0xDF35 /* ATIK ATK-16IC Grayscale Camera */
    1061
    1062 /*
    1063 * Protego product ids
    1064 @@ -534,6 +536,8 @@
    1065 #define OLIMEX_VID 0x15BA
    1066 #define OLIMEX_ARM_USB_OCD_PID 0x0003
    1067
    1068 +/* www.elsterelectricity.com Elster Unicom III Optical Probe */
    1069 +#define FTDI_ELSTER_UNICOM_PID 0xE700 /* Product Id */
    1070
    1071 /*
    1072 * The Mobility Lab (TML)
    1073 diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
    1074 index 7c069a0..ea7bba6 100644
    1075 --- a/drivers/usb/serial/keyspan.c
    1076 +++ b/drivers/usb/serial/keyspan.c
    1077 @@ -838,7 +838,7 @@ static void usa49_indat_callback(struct urb *urb)
    1078
    1079 port = (struct usb_serial_port *) urb->context;
    1080 tty = port->tty;
    1081 - if (urb->actual_length) {
    1082 + if (tty && urb->actual_length) {
    1083 /* 0x80 bit is error flag */
    1084 if ((data[0] & 0x80) == 0) {
    1085 /* no error on any byte */
    1086 diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
    1087 index aee4502..17b3bae 100644
    1088 --- a/drivers/usb/serial/kobil_sct.c
    1089 +++ b/drivers/usb/serial/kobil_sct.c
    1090 @@ -114,6 +114,7 @@ static struct usb_serial_driver kobil_device = {
    1091 .usb_driver = &kobil_driver,
    1092 .id_table = id_table,
    1093 .num_interrupt_in = NUM_DONT_CARE,
    1094 + .num_interrupt_out = NUM_DONT_CARE,
    1095 .num_bulk_in = 0,
    1096 .num_bulk_out = 0,
    1097 .num_ports = 1,
    1098 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    1099 index d1185f5..bbbe1b9 100644
    1100 --- a/drivers/usb/serial/option.c
    1101 +++ b/drivers/usb/serial/option.c
    1102 @@ -180,6 +180,7 @@ static struct usb_device_id option_ids[] = {
    1103 { USB_DEVICE(DELL_VENDOR_ID, 0x8117) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO ExpressCard == Novatel Merlin XV620 CDMA/EV-DO */
    1104 { USB_DEVICE(DELL_VENDOR_ID, 0x8118) }, /* Dell Wireless 5510 Mobile Broadband HSDPA ExpressCard == Novatel Merlin XU870 HSDPA/3G */
    1105 { USB_DEVICE(DELL_VENDOR_ID, 0x8128) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite E720 CDMA/EV-DO */
    1106 + { USB_DEVICE(DELL_VENDOR_ID, 0x8136) }, /* Dell Wireless HSDPA 5520 == Novatel Expedite EU860D */
    1107 { USB_DEVICE(DELL_VENDOR_ID, 0x8137) }, /* Dell Wireless HSDPA 5520 */
    1108 { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },
    1109 { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
    1110 diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
    1111 index 0da1df9..b7da8b5 100644
    1112 --- a/drivers/usb/serial/pl2303.c
    1113 +++ b/drivers/usb/serial/pl2303.c
    1114 @@ -65,6 +65,7 @@ static struct usb_device_id id_table [] = {
    1115 { USB_DEVICE(ITEGNO_VENDOR_ID, ITEGNO_PRODUCT_ID_2080) },
    1116 { USB_DEVICE(MA620_VENDOR_ID, MA620_PRODUCT_ID) },
    1117 { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID) },
    1118 + { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
    1119 { USB_DEVICE(TRIPP_VENDOR_ID, TRIPP_PRODUCT_ID) },
    1120 { USB_DEVICE(RADIOSHACK_VENDOR_ID, RADIOSHACK_PRODUCT_ID) },
    1121 { USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) },
    1122 @@ -84,9 +85,10 @@ static struct usb_device_id id_table [] = {
    1123 { USB_DEVICE(DATAPILOT_U2_VENDOR_ID, DATAPILOT_U2_PRODUCT_ID) },
    1124 { USB_DEVICE(BELKIN_VENDOR_ID, BELKIN_PRODUCT_ID) },
    1125 { USB_DEVICE(ALCOR_VENDOR_ID, ALCOR_PRODUCT_ID) },
    1126 - { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ID) },
    1127 { USB_DEVICE(WS002IN_VENDOR_ID, WS002IN_PRODUCT_ID) },
    1128 { USB_DEVICE(COREGA_VENDOR_ID, COREGA_PRODUCT_ID) },
    1129 + { USB_DEVICE(HL340_VENDOR_ID, HL340_PRODUCT_ID) },
    1130 + { USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
    1131 { } /* Terminating entry */
    1132 };
    1133
    1134 diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
    1135 index d31f5d2..237a41f 100644
    1136 --- a/drivers/usb/serial/pl2303.h
    1137 +++ b/drivers/usb/serial/pl2303.h
    1138 @@ -35,6 +35,7 @@
    1139
    1140 #define RATOC_VENDOR_ID 0x0584
    1141 #define RATOC_PRODUCT_ID 0xb000
    1142 +#define RATOC_PRODUCT_ID_USB60F 0xb020
    1143
    1144 #define TRIPP_VENDOR_ID 0x2478
    1145 #define TRIPP_PRODUCT_ID 0x2008
    1146 @@ -96,10 +97,6 @@
    1147 #define ALCOR_VENDOR_ID 0x058F
    1148 #define ALCOR_PRODUCT_ID 0x9720
    1149
    1150 -/* Huawei E620 UMTS/HSDPA card (ID: 12d1:1001) */
    1151 -#define HUAWEI_VENDOR_ID 0x12d1
    1152 -#define HUAWEI_PRODUCT_ID 0x1001
    1153 -
    1154 /* Willcom WS002IN Data Driver (by NetIndex Inc.) */
    1155 #define WS002IN_VENDOR_ID 0x11f6
    1156 #define WS002IN_PRODUCT_ID 0x2001
    1157 @@ -107,3 +104,11 @@
    1158 /* Corega CG-USBRS232R Serial Adapter */
    1159 #define COREGA_VENDOR_ID 0x07aa
    1160 #define COREGA_PRODUCT_ID 0x002a
    1161 +
    1162 +/* HL HL-340 (ID: 4348:5523) */
    1163 +#define HL340_VENDOR_ID 0x4348
    1164 +#define HL340_PRODUCT_ID 0x5523
    1165 +
    1166 +/* Y.C. Cable U.S.A., Inc - USB to RS-232 */
    1167 +#define YCCABLE_VENDOR_ID 0x05ad
    1168 +#define YCCABLE_PRODUCT_ID 0x0fba
    1169 diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
    1170 index c295d04..b4d7ac9 100644
    1171 --- a/drivers/usb/serial/sierra.c
    1172 +++ b/drivers/usb/serial/sierra.c
    1173 @@ -104,6 +104,7 @@ static struct usb_device_id id_table [] = {
    1174 { USB_DEVICE(0x1199, 0x0019) }, /* Sierra Wireless AirCard 595 */
    1175 { USB_DEVICE(0x1199, 0x0021) }, /* Sierra Wireless AirCard 597E */
    1176 { USB_DEVICE(0x1199, 0x0120) }, /* Sierra Wireless USB Dongle 595U */
    1177 + { USB_DEVICE(0x1199, 0x0023) }, /* Sierra Wireless AirCard */
    1178
    1179 { USB_DEVICE(0x1199, 0x6802) }, /* Sierra Wireless MC8755 */
    1180 { USB_DEVICE(0x1199, 0x6804) }, /* Sierra Wireless MC8755 */
    1181 @@ -117,9 +118,15 @@ static struct usb_device_id id_table [] = {
    1182 { USB_DEVICE(0x1199, 0x6851) }, /* Sierra Wireless AirCard 881 */
    1183 { USB_DEVICE(0x1199, 0x6852) }, /* Sierra Wireless AirCard 880 E */
    1184 { USB_DEVICE(0x1199, 0x6853) }, /* Sierra Wireless AirCard 881 E */
    1185 + { USB_DEVICE(0x1199, 0x6855) }, /* Sierra Wireless AirCard 880 U */
    1186 + { USB_DEVICE(0x1199, 0x6856) }, /* Sierra Wireless AirCard 881 U */
    1187 +
    1188 + { USB_DEVICE(0x1199, 0x6468) }, /* Sierra Wireless MP3G - EVDO */
    1189 + { USB_DEVICE(0x1199, 0x6469) }, /* Sierra Wireless MP3G - UMTS/HSPA */
    1190
    1191 { USB_DEVICE(0x1199, 0x0112), .driver_info = DEVICE_1_PORT }, /* Sierra Wireless AirCard 580 */
    1192 { USB_DEVICE(0x0F3D, 0x0112), .driver_info = DEVICE_1_PORT }, /* Airprime/Sierra PC 5220 */
    1193 + { USB_DEVICE(0x05C6, 0x6613), .driver_info = DEVICE_1_PORT }, /* Onda H600/ZTE MF330 */
    1194
    1195 { USB_DEVICE(0x1199, 0x0FFF), .driver_info = DEVICE_INSTALLER},
    1196 { }
    1197 @@ -129,6 +136,7 @@ MODULE_DEVICE_TABLE(usb, id_table);
    1198 static struct usb_device_id id_table_1port [] = {
    1199 { USB_DEVICE(0x1199, 0x0112) }, /* Sierra Wireless AirCard 580 */
    1200 { USB_DEVICE(0x0F3D, 0x0112) }, /* AirPrime/Sierra PC 5220 */
    1201 + { USB_DEVICE(0x05C6, 0x6613) }, /* Onda H600/ZTE MF330 */
    1202 { }
    1203 };
    1204
    1205 @@ -142,6 +150,7 @@ static struct usb_device_id id_table_3port [] = {
    1206 { USB_DEVICE(0x1199, 0x0019) }, /* Sierra Wireless AirCard 595 */
    1207 { USB_DEVICE(0x1199, 0x0021) }, /* Sierra Wireless AirCard 597E */
    1208 { USB_DEVICE(0x1199, 0x0120) }, /* Sierra Wireless USB Dongle 595U*/
    1209 + { USB_DEVICE(0x1199, 0x0023) }, /* Sierra Wireless AirCard */
    1210
    1211 { USB_DEVICE(0x1199, 0x6802) }, /* Sierra Wireless MC8755 */
    1212 { USB_DEVICE(0x1199, 0x6804) }, /* Sierra Wireless MC8755 */
    1213 @@ -155,6 +164,10 @@ static struct usb_device_id id_table_3port [] = {
    1214 { USB_DEVICE(0x1199, 0x6851) }, /* Sierra Wireless AirCard 881 */
    1215 { USB_DEVICE(0x1199, 0x6852) }, /* Sierra Wireless AirCard 880E */
    1216 { USB_DEVICE(0x1199, 0x6853) }, /* Sierra Wireless AirCard 881E */
    1217 + { USB_DEVICE(0x1199, 0x6855) }, /* Sierra Wireless AirCard 880 U */
    1218 + { USB_DEVICE(0x1199, 0x6856) }, /* Sierra Wireless AirCard 881U */
    1219 + { USB_DEVICE(0x1199, 0x6468) }, /* Sierra Wireless MP3G - EVDO */
    1220 + { USB_DEVICE(0x1199, 0x6469) }, /* Sierra Wireless MP3G - UMTS/HSPA */
    1221 { }
    1222 };
    1223
    1224 diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    1225 index 6d6108b..fe12737 100644
    1226 --- a/drivers/usb/storage/unusual_devs.h
    1227 +++ b/drivers/usb/storage/unusual_devs.h
    1228 @@ -86,6 +86,14 @@ UNUSUAL_DEV( 0x03f0, 0x0307, 0x0001, 0x0001,
    1229 US_SC_8070, US_PR_USBAT, init_usbat_cd, 0),
    1230 #endif
    1231
    1232 +/* Reported by Grant Grundler <grundler@parisc-linux.org>
    1233 + * HP r707 camera in "Disk" mode with 2.00.23 or 2.00.24 firmware.
    1234 + */
    1235 +UNUSUAL_DEV( 0x03f0, 0x4002, 0x0001, 0x0001,
    1236 + "HP",
    1237 + "PhotoSmart R707",
    1238 + US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_FIX_CAPACITY),
    1239 +
    1240 /* Reported by Sebastian Kapfer <sebastian_kapfer@gmx.net>
    1241 * and Olaf Hering <olh@suse.de> (different bcd's, same vendor/product)
    1242 * for USB floppies that need the SINGLE_LUN enforcement.
    1243 diff --git a/fs/eventpoll.c b/fs/eventpoll.c
    1244 index 34f68f3..0a98389 100644
    1245 --- a/fs/eventpoll.c
    1246 +++ b/fs/eventpoll.c
    1247 @@ -353,7 +353,7 @@ static void ep_poll_safewake(struct poll_safewake *psw, wait_queue_head_t *wq)
    1248 spin_unlock_irqrestore(&psw->lock, flags);
    1249
    1250 /* Do really wake up now */
    1251 - wake_up(wq);
    1252 + wake_up_nested(wq, 1 + wake_nests);
    1253
    1254 /* Remove the current task from the list */
    1255 spin_lock_irqsave(&psw->lock, flags);
    1256 diff --git a/fs/ncpfs/mmap.c b/fs/ncpfs/mmap.c
    1257 index a94473d..5d8dcb9 100644
    1258 --- a/fs/ncpfs/mmap.c
    1259 +++ b/fs/ncpfs/mmap.c
    1260 @@ -50,10 +50,6 @@ static int ncp_file_mmap_fault(struct vm_area_struct *area,
    1261 pos = vmf->pgoff << PAGE_SHIFT;
    1262
    1263 count = PAGE_SIZE;
    1264 - if ((unsigned long)vmf->virtual_address + PAGE_SIZE > area->vm_end) {
    1265 - WARN_ON(1); /* shouldn't happen? */
    1266 - count = area->vm_end - (unsigned long)vmf->virtual_address;
    1267 - }
    1268 /* what we can read in one go */
    1269 bufsize = NCP_SERVER(inode)->buffer_size;
    1270
    1271 diff --git a/fs/splice.c b/fs/splice.c
    1272 index 6bdcb61..36fdc61 100644
    1273 --- a/fs/splice.c
    1274 +++ b/fs/splice.c
    1275 @@ -1184,6 +1184,9 @@ static int copy_from_user_mmap_sem(void *dst, const void __user *src, size_t n)
    1276 {
    1277 int partial;
    1278
    1279 + if (!access_ok(VERIFY_READ, src, n))
    1280 + return -EFAULT;
    1281 +
    1282 pagefault_disable();
    1283 partial = __copy_from_user_inatomic(dst, src, n);
    1284 pagefault_enable();
    1285 @@ -1392,6 +1395,11 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
    1286 break;
    1287 }
    1288
    1289 + if (unlikely(!access_ok(VERIFY_WRITE, base, len))) {
    1290 + error = -EFAULT;
    1291 + break;
    1292 + }
    1293 +
    1294 sd.len = 0;
    1295 sd.total_len = len;
    1296 sd.flags = flags;
    1297 diff --git a/include/linux/dmi.h b/include/linux/dmi.h
    1298 index 5b42a65..b1251b2 100644
    1299 --- a/include/linux/dmi.h
    1300 +++ b/include/linux/dmi.h
    1301 @@ -79,7 +79,6 @@ extern void dmi_scan_machine(void);
    1302 extern int dmi_get_year(int field);
    1303 extern int dmi_name_in_vendors(const char *str);
    1304 extern int dmi_available;
    1305 -extern char *dmi_get_slot(int slot);
    1306
    1307 #else
    1308
    1309 @@ -90,7 +89,6 @@ static inline const struct dmi_device * dmi_find_device(int type, const char *na
    1310 static inline int dmi_get_year(int year) { return 0; }
    1311 static inline int dmi_name_in_vendors(const char *s) { return 0; }
    1312 #define dmi_available 0
    1313 -static inline char *dmi_get_slot(int slot) { return NULL; }
    1314
    1315 #endif
    1316
    1317 diff --git a/include/linux/wait.h b/include/linux/wait.h
    1318 index 0e68628..8eb6420 100644
    1319 --- a/include/linux/wait.h
    1320 +++ b/include/linux/wait.h
    1321 @@ -161,6 +161,22 @@ wait_queue_head_t *FASTCALL(bit_waitqueue(void *, int));
    1322 #define wake_up_locked(x) __wake_up_locked((x), TASK_UNINTERRUPTIBLE | TASK_INTERRUPTIBLE)
    1323 #define wake_up_interruptible_sync(x) __wake_up_sync((x),TASK_INTERRUPTIBLE, 1)
    1324
    1325 +#ifdef CONFIG_DEBUG_LOCK_ALLOC
    1326 +/*
    1327 + * macro to avoid include hell
    1328 + */
    1329 +#define wake_up_nested(x, s) \
    1330 +do { \
    1331 + unsigned long flags; \
    1332 + \
    1333 + spin_lock_irqsave_nested(&(x)->lock, flags, (s)); \
    1334 + wake_up_locked(x); \
    1335 + spin_unlock_irqrestore(&(x)->lock, flags); \
    1336 +} while (0)
    1337 +#else
    1338 +#define wake_up_nested(x, s) wake_up(x)
    1339 +#endif
    1340 +
    1341 #define __wait_event(wq, condition) \
    1342 do { \
    1343 DEFINE_WAIT(__wait); \
    1344 diff --git a/kernel/relay.c b/kernel/relay.c
    1345 index 61134eb..7c03733 100644
    1346 --- a/kernel/relay.c
    1347 +++ b/kernel/relay.c
    1348 @@ -92,6 +92,7 @@ static int relay_mmap_buf(struct rchan_buf *buf, struct vm_area_struct *vma)
    1349 return -EINVAL;
    1350
    1351 vma->vm_ops = &relay_file_mmap_ops;
    1352 + vma->vm_flags |= VM_DONTEXPAND;
    1353 vma->vm_private_data = buf;
    1354 buf->chan->cb->buf_mapped(buf, filp);
    1355
    1356 diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
    1357 index da7c061..2288ad8 100644
    1358 --- a/kernel/sched_fair.c
    1359 +++ b/kernel/sched_fair.c
    1360 @@ -511,7 +511,7 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial)
    1361
    1362 if (!initial) {
    1363 /* sleeps upto a single latency don't count. */
    1364 - if (sched_feat(NEW_FAIR_SLEEPERS) && entity_is_task(se))
    1365 + if (sched_feat(NEW_FAIR_SLEEPERS))
    1366 vruntime -= sysctl_sched_latency;
    1367
    1368 /* ensure we never gain time by being placed backwards. */
    1369 @@ -867,7 +867,11 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p)
    1370 }
    1371
    1372 gran = sysctl_sched_wakeup_granularity;
    1373 - if (unlikely(se->load.weight != NICE_0_LOAD))
    1374 + /*
    1375 + * More easily preempt - nice tasks, while not making
    1376 + * it harder for + nice tasks.
    1377 + */
    1378 + if (unlikely(se->load.weight > NICE_0_LOAD))
    1379 gran = calc_delta_fair(gran, &se->load);
    1380
    1381 if (pse->vruntime + gran < se->vruntime)
    1382 diff --git a/mm/filemap.c b/mm/filemap.c
    1383 index f4d0cde..69430d2 100644
    1384 --- a/mm/filemap.c
    1385 +++ b/mm/filemap.c
    1386 @@ -1733,7 +1733,11 @@ static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
    1387 const struct iovec *iov = i->iov;
    1388 size_t base = i->iov_offset;
    1389
    1390 - while (bytes) {
    1391 + /*
    1392 + * The !iov->iov_len check ensures we skip over unlikely
    1393 + * zero-length segments.
    1394 + */
    1395 + while (bytes || !iov->iov_len) {
    1396 int copy = min(bytes, iov->iov_len - base);
    1397
    1398 bytes -= copy;
    1399 @@ -2251,6 +2255,7 @@ again:
    1400
    1401 cond_resched();
    1402
    1403 + iov_iter_advance(i, copied);
    1404 if (unlikely(copied == 0)) {
    1405 /*
    1406 * If we were unable to copy any data at all, we must
    1407 @@ -2264,7 +2269,6 @@ again:
    1408 iov_iter_single_seg_count(i));
    1409 goto again;
    1410 }
    1411 - iov_iter_advance(i, copied);
    1412 pos += copied;
    1413 written += copied;
    1414
    1415 diff --git a/mm/fremap.c b/mm/fremap.c
    1416 index 14bd3bf..69a37c2 100644
    1417 --- a/mm/fremap.c
    1418 +++ b/mm/fremap.c
    1419 @@ -190,10 +190,13 @@ asmlinkage long sys_remap_file_pages(unsigned long start, unsigned long size,
    1420 */
    1421 if (mapping_cap_account_dirty(mapping)) {
    1422 unsigned long addr;
    1423 + struct file *file = vma->vm_file;
    1424
    1425 flags &= MAP_NONBLOCK;
    1426 - addr = mmap_region(vma->vm_file, start, size,
    1427 + get_file(file);
    1428 + addr = mmap_region(file, start, size,
    1429 flags, vma->vm_flags, pgoff, 1);
    1430 + fput(file);
    1431 if (IS_ERR_VALUE(addr)) {
    1432 err = addr;
    1433 } else {
    1434 diff --git a/mm/mmap.c b/mm/mmap.c
    1435 index 15678aa..555b3e7 100644
    1436 --- a/mm/mmap.c
    1437 +++ b/mm/mmap.c
    1438 @@ -2215,7 +2215,7 @@ int install_special_mapping(struct mm_struct *mm,
    1439 vma->vm_start = addr;
    1440 vma->vm_end = addr + len;
    1441
    1442 - vma->vm_flags = vm_flags | mm->def_flags;
    1443 + vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
    1444 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
    1445
    1446 vma->vm_ops = &special_mapping_vmops;
    1447 diff --git a/mm/slab.c b/mm/slab.c
    1448 index b03b2e4..ff31261 100644
    1449 --- a/mm/slab.c
    1450 +++ b/mm/slab.c
    1451 @@ -304,11 +304,11 @@ struct kmem_list3 {
    1452 /*
    1453 * Need this for bootstrapping a per node allocator.
    1454 */
    1455 -#define NUM_INIT_LISTS (2 * MAX_NUMNODES + 1)
    1456 +#define NUM_INIT_LISTS (3 * MAX_NUMNODES)
    1457 struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
    1458 #define CACHE_CACHE 0
    1459 -#define SIZE_AC 1
    1460 -#define SIZE_L3 (1 + MAX_NUMNODES)
    1461 +#define SIZE_AC MAX_NUMNODES
    1462 +#define SIZE_L3 (2 * MAX_NUMNODES)
    1463
    1464 static int drain_freelist(struct kmem_cache *cache,
    1465 struct kmem_list3 *l3, int tofree);
    1466 @@ -1410,6 +1410,22 @@ static void init_list(struct kmem_cache *cachep, struct kmem_list3 *list,
    1467 }
    1468
    1469 /*
    1470 + * For setting up all the kmem_list3s for cache whose buffer_size is same as
    1471 + * size of kmem_list3.
    1472 + */
    1473 +static void __init set_up_list3s(struct kmem_cache *cachep, int index)
    1474 +{
    1475 + int node;
    1476 +
    1477 + for_each_online_node(node) {
    1478 + cachep->nodelists[node] = &initkmem_list3[index + node];
    1479 + cachep->nodelists[node]->next_reap = jiffies +
    1480 + REAPTIMEOUT_LIST3 +
    1481 + ((unsigned long)cachep) % REAPTIMEOUT_LIST3;
    1482 + }
    1483 +}
    1484 +
    1485 +/*
    1486 * Initialisation. Called after the page allocator have been initialised and
    1487 * before smp_init().
    1488 */
    1489 @@ -1432,6 +1448,7 @@ void __init kmem_cache_init(void)
    1490 if (i < MAX_NUMNODES)
    1491 cache_cache.nodelists[i] = NULL;
    1492 }
    1493 + set_up_list3s(&cache_cache, CACHE_CACHE);
    1494
    1495 /*
    1496 * Fragmentation resistance on low memory - only use bigger
    1497 @@ -1587,10 +1604,9 @@ void __init kmem_cache_init(void)
    1498 {
    1499 int nid;
    1500
    1501 - /* Replace the static kmem_list3 structures for the boot cpu */
    1502 - init_list(&cache_cache, &initkmem_list3[CACHE_CACHE], node);
    1503 -
    1504 for_each_online_node(nid) {
    1505 + init_list(&cache_cache, &initkmem_list3[CACHE_CACHE], nid);
    1506 +
    1507 init_list(malloc_sizes[INDEX_AC].cs_cachep,
    1508 &initkmem_list3[SIZE_AC + nid], nid);
    1509
    1510 @@ -1960,22 +1976,6 @@ static void slab_destroy(struct kmem_cache *cachep, struct slab *slabp)
    1511 }
    1512 }
    1513
    1514 -/*
    1515 - * For setting up all the kmem_list3s for cache whose buffer_size is same as
    1516 - * size of kmem_list3.
    1517 - */
    1518 -static void __init set_up_list3s(struct kmem_cache *cachep, int index)
    1519 -{
    1520 - int node;
    1521 -
    1522 - for_each_online_node(node) {
    1523 - cachep->nodelists[node] = &initkmem_list3[index + node];
    1524 - cachep->nodelists[node]->next_reap = jiffies +
    1525 - REAPTIMEOUT_LIST3 +
    1526 - ((unsigned long)cachep) % REAPTIMEOUT_LIST3;
    1527 - }
    1528 -}
    1529 -
    1530 static void __kmem_cache_destroy(struct kmem_cache *cachep)
    1531 {
    1532 int i;
    1533 @@ -2099,7 +2099,7 @@ static int __init_refok setup_cpu_cache(struct kmem_cache *cachep)
    1534 g_cpucache_up = PARTIAL_L3;
    1535 } else {
    1536 int node;
    1537 - for_each_node_state(node, N_NORMAL_MEMORY) {
    1538 + for_each_online_node(node) {
    1539 cachep->nodelists[node] =
    1540 kmalloc_node(sizeof(struct kmem_list3),
    1541 GFP_KERNEL, node);
    1542 diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
    1543 index d802b5a..9ddf944 100644
    1544 --- a/scripts/mod/file2alias.c
    1545 +++ b/scripts/mod/file2alias.c
    1546 @@ -155,7 +155,7 @@ static void do_usb_entry_multi(struct usb_device_id *id, struct module *mod)
    1547 * Some modules (visor) have empty slots as placeholder for
    1548 * run-time specification that results in catch-all alias
    1549 */
    1550 - if (!(id->idVendor | id->bDeviceClass | id->bInterfaceClass))
    1551 + if (!(id->idVendor | id->idProduct | id->bDeviceClass | id->bInterfaceClass))
    1552 return;
    1553
    1554 /* Convert numeric bcdDevice range into fnmatch-able pattern(s) */
    1555 diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
    1556 index f83b19d..4bf715d 100644
    1557 --- a/security/selinux/ss/services.c
    1558 +++ b/security/selinux/ss/services.c
    1559 @@ -1744,6 +1744,9 @@ int security_genfs_sid(const char *fstype,
    1560 struct ocontext *c;
    1561 int rc = 0, cmp = 0;
    1562
    1563 + while (path[0] == '/' && path[1] == '/')
    1564 + path++;
    1565 +
    1566 POLICY_RDLOCK;
    1567
    1568 for (genfs = policydb.genfs; genfs; genfs = genfs->next) {
    1569 diff --git a/sound/oss/via82cxxx_audio.c b/sound/oss/via82cxxx_audio.c
    1570 index 5d3c037..f95aa09 100644
    1571 --- a/sound/oss/via82cxxx_audio.c
    1572 +++ b/sound/oss/via82cxxx_audio.c
    1573 @@ -2104,6 +2104,7 @@ static struct page * via_mm_nopage (struct vm_area_struct * vma,
    1574 {
    1575 struct via_info *card = vma->vm_private_data;
    1576 struct via_channel *chan = &card->ch_out;
    1577 + unsigned long max_bufs;
    1578 struct page *dmapage;
    1579 unsigned long pgoff;
    1580 int rd, wr;
    1581 @@ -2127,14 +2128,11 @@ static struct page * via_mm_nopage (struct vm_area_struct * vma,
    1582 rd = card->ch_in.is_mapped;
    1583 wr = card->ch_out.is_mapped;
    1584
    1585 -#ifndef VIA_NDEBUG
    1586 - {
    1587 - unsigned long max_bufs = chan->frag_number;
    1588 - if (rd && wr) max_bufs *= 2;
    1589 - /* via_dsp_mmap() should ensure this */
    1590 - assert (pgoff < max_bufs);
    1591 - }
    1592 -#endif
    1593 + max_bufs = chan->frag_number;
    1594 + if (rd && wr)
    1595 + max_bufs *= 2;
    1596 + if (pgoff >= max_bufs)
    1597 + return NOPAGE_SIGBUS;
    1598
    1599 /* if full-duplex (read+write) and we have two sets of bufs,
    1600 * then the playback buffers come first, sez soundcard.c */
    1601 diff --git a/sound/usb/usx2y/usX2Yhwdep.c b/sound/usb/usx2y/usX2Yhwdep.c
    1602 index b76b3dd..e617d7e 100644
    1603 --- a/sound/usb/usx2y/usX2Yhwdep.c
    1604 +++ b/sound/usb/usx2y/usX2Yhwdep.c
    1605 @@ -88,7 +88,7 @@ static int snd_us428ctls_mmap(struct snd_hwdep * hw, struct file *filp, struct v
    1606 us428->us428ctls_sharedmem->CtlSnapShotLast = -2;
    1607 }
    1608 area->vm_ops = &us428ctls_vm_ops;
    1609 - area->vm_flags |= VM_RESERVED;
    1610 + area->vm_flags |= VM_RESERVED | VM_DONTEXPAND;
    1611 area->vm_private_data = hw->private_data;
    1612 return 0;
    1613 }
    1614 diff --git a/sound/usb/usx2y/usx2yhwdeppcm.c b/sound/usb/usx2y/usx2yhwdeppcm.c
    1615 index a5e7bcd..6e70520 100644
    1616 --- a/sound/usb/usx2y/usx2yhwdeppcm.c
    1617 +++ b/sound/usb/usx2y/usx2yhwdeppcm.c
    1618 @@ -728,7 +728,7 @@ static int snd_usX2Y_hwdep_pcm_mmap(struct snd_hwdep * hw, struct file *filp, st
    1619 return -ENODEV;
    1620 }
    1621 area->vm_ops = &snd_usX2Y_hwdep_pcm_vm_ops;
    1622 - area->vm_flags |= VM_RESERVED;
    1623 + area->vm_flags |= VM_RESERVED | VM_DONTEXPAND;
    1624 area->vm_private_data = hw->private_data;
    1625 return 0;
    1626 }