Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-magellan/patches-2.6.24-r5/0100-2.6.24.1-all-fixes.patch

    Annotation of /trunk/kernel26-magellan/patches-2.6.24-r5/0100-2.6.24.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 574 - (hide annotations) (download)
    Mon Apr 21 17:56:37 2008 UTC (16 years, 6 months ago) by niro
    File size: 62467 byte(s) 
    - 2.6.24-magellan-r5: updated to linux-2.6.24.5
    1 niro 574 diff --git a/Documentation/video4linux/CARDLIST.cx23885 b/Documentation/video4linux/CARDLIST.cx23885
    2     index 00cb646..986ea57 100644
    3     --- a/Documentation/video4linux/CARDLIST.cx23885
    4     +++ b/Documentation/video4linux/CARDLIST.cx23885
    5     @@ -1,5 +1,5 @@
    6     0 -> UNKNOWN/GENERIC [0070:3400]
    7     1 -> Hauppauge WinTV-HVR1800lp [0070:7600]
    8     - 2 -> Hauppauge WinTV-HVR1800 [0070:7800,0070:7801]
    9     + 2 -> Hauppauge WinTV-HVR1800 [0070:7800,0070:7801,0070:7809]
    10     3 -> Hauppauge WinTV-HVR1250 [0070:7911]
    11     4 -> DViCO FusionHDTV5 Express [18ac:d500]
    12     diff --git a/arch/x86/kernel/Makefile_32 b/arch/x86/kernel/Makefile_32
    13     index a7bc93c..5e48bd2 100644
    14     --- a/arch/x86/kernel/Makefile_32
    15     +++ b/arch/x86/kernel/Makefile_32
    16     @@ -19,7 +19,8 @@ obj-$(CONFIG_X86_MSR) += msr.o
    17     obj-$(CONFIG_X86_CPUID) += cpuid.o
    18     obj-$(CONFIG_MICROCODE) += microcode.o
    19     obj-$(CONFIG_PCI) += early-quirks.o
    20     -obj-$(CONFIG_APM) += apm_32.o
    21     +apm-y := apm_32.o
    22     +obj-$(CONFIG_APM) += apm.o
    23     obj-$(CONFIG_X86_SMP) += smp_32.o smpboot_32.o tsc_sync.o
    24     obj-$(CONFIG_SMP) += smpcommon_32.o
    25     obj-$(CONFIG_X86_TRAMPOLINE) += trampoline_32.o
    26     diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
    27     index 8809654..bd12c8e 100644
    28     --- a/drivers/acpi/blacklist.c
    29     +++ b/drivers/acpi/blacklist.c
    30     @@ -208,24 +208,24 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
    31     * Disable OSI(Linux) warnings on all "Acer, inc."
    32     *
    33     * _OSI(Linux) disables the latest Windows BIOS code:
    34     + * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 3100"),
    35     * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5050"),
    36     + * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5100"),
    37     * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5580"),
    38     * DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 3010"),
    39     * _OSI(Linux) effect unknown:
    40     * DMI_MATCH(DMI_PRODUCT_NAME, "Ferrari 5000"),
    41     */
    42     - {
    43     - .callback = dmi_disable_osi_linux,
    44     - .ident = "Acer, inc.",
    45     - .matches = {
    46     - DMI_MATCH(DMI_SYS_VENDOR, "Acer, inc."),
    47     - },
    48     - },
    49     + /*
    50     + * note that dmi_check_system() uses strstr()
    51     + * to match sub-strings rather than !strcmp(),
    52     + * so "Acer" below matches "Acer, inc." above.
    53     + */
    54     /*
    55     * Disable OSI(Linux) warnings on all "Acer"
    56     *
    57     * _OSI(Linux) effect unknown:
    58     - * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5100"),
    59     + * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5315"),
    60     * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5610"),
    61     * DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7720Z"),
    62     * DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 5520"),
    63     @@ -300,7 +300,7 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
    64     DMI_MATCH(DMI_BIOS_VENDOR, "COMPAL"),
    65     },
    66     },
    67     - { /* OSI(Linux) touches USB, breaks suspend to disk */
    68     + { /* OSI(Linux) touches USB, unknown side-effect */
    69     .callback = dmi_disable_osi_linux,
    70     .ident = "Dell Dimension 5150",
    71     .matches = {
    72     @@ -474,6 +474,11 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
    73     *
    74     * _OSI(Linux) confirmed to be a NOP:
    75     * DMI_MATCH(DMI_PRODUCT_NAME, "P1-J150B"),
    76     + * with DMI_MATCH(DMI_BOARD_NAME, "ROCKY"),
    77     + *
    78     + * unknown:
    79     + * DMI_MATCH(DMI_PRODUCT_NAME, "S1-MDGDG"),
    80     + * with DMI_MATCH(DMI_BOARD_NAME, "ROCKY"),
    81     */
    82     {
    83     .callback = dmi_disable_osi_linux,
    84     diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
    85     index e53fb51..fde7ac8 100644
    86     --- a/drivers/acpi/osl.c
    87     +++ b/drivers/acpi/osl.c
    88     @@ -120,7 +120,7 @@ static char osi_additional_string[OSI_STRING_LENGTH_MAX];
    89     */
    90     #define OSI_LINUX_ENABLE 0
    91    
    92     -struct osi_linux {
    93     +static struct osi_linux {
    94     unsigned int enable:1;
    95     unsigned int dmi:1;
    96     unsigned int cmdline:1;
    97     @@ -1213,24 +1213,24 @@ acpi_status acpi_os_release_object(acpi_cache_t * cache, void *object)
    98     *
    99     * Returns 0 on success
    100     */
    101     -int acpi_dmi_dump(void)
    102     +static int acpi_dmi_dump(void)
    103     {
    104    
    105     if (!dmi_available)
    106     return -1;
    107    
    108     printk(KERN_NOTICE PREFIX "DMI System Vendor: %s\n",
    109     - dmi_get_slot(DMI_SYS_VENDOR));
    110     + dmi_get_system_info(DMI_SYS_VENDOR));
    111     printk(KERN_NOTICE PREFIX "DMI Product Name: %s\n",
    112     - dmi_get_slot(DMI_PRODUCT_NAME));
    113     + dmi_get_system_info(DMI_PRODUCT_NAME));
    114     printk(KERN_NOTICE PREFIX "DMI Product Version: %s\n",
    115     - dmi_get_slot(DMI_PRODUCT_VERSION));
    116     + dmi_get_system_info(DMI_PRODUCT_VERSION));
    117     printk(KERN_NOTICE PREFIX "DMI Board Name: %s\n",
    118     - dmi_get_slot(DMI_BOARD_NAME));
    119     + dmi_get_system_info(DMI_BOARD_NAME));
    120     printk(KERN_NOTICE PREFIX "DMI BIOS Vendor: %s\n",
    121     - dmi_get_slot(DMI_BIOS_VENDOR));
    122     + dmi_get_system_info(DMI_BIOS_VENDOR));
    123     printk(KERN_NOTICE PREFIX "DMI BIOS Date: %s\n",
    124     - dmi_get_slot(DMI_BIOS_DATE));
    125     + dmi_get_system_info(DMI_BIOS_DATE));
    126    
    127     return 0;
    128     }
    129     diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
    130     index 0295855..4a1b9bf 100644
    131     --- a/drivers/base/firmware_class.c
    132     +++ b/drivers/base/firmware_class.c
    133     @@ -292,7 +292,8 @@ firmware_class_timeout(u_long data)
    134    
    135     static inline void fw_setup_device_id(struct device *f_dev, struct device *dev)
    136     {
    137     - snprintf(f_dev->bus_id, BUS_ID_SIZE, "firmware-%s", dev->bus_id);
    138     + /* XXX warning we should watch out for name collisions */
    139     + strlcpy(f_dev->bus_id, dev->bus_id, BUS_ID_SIZE);
    140     }
    141    
    142     static int fw_register_device(struct device **dev_p, const char *fw_name,
    143     diff --git a/drivers/char/drm/drm_stub.c b/drivers/char/drm/drm_stub.c
    144     index ee83ff9..a157ee5 100644
    145     --- a/drivers/char/drm/drm_stub.c
    146     +++ b/drivers/char/drm/drm_stub.c
    147     @@ -218,6 +218,7 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
    148     if (ret)
    149     goto err_g1;
    150    
    151     + pci_set_master(pdev);
    152     if ((ret = drm_fill_in_dev(dev, pdev, ent, driver))) {
    153     printk(KERN_ERR "DRM: Fill_in_dev failed.\n");
    154     goto err_g2;
    155     diff --git a/drivers/char/drm/drm_vm.c b/drivers/char/drm/drm_vm.c
    156     index e8d50af..ef5e6b1 100644
    157     --- a/drivers/char/drm/drm_vm.c
    158     +++ b/drivers/char/drm/drm_vm.c
    159     @@ -506,6 +506,7 @@ static int drm_mmap_dma(struct file *filp, struct vm_area_struct *vma)
    160     vma->vm_ops = &drm_vm_dma_ops;
    161    
    162     vma->vm_flags |= VM_RESERVED; /* Don't swap */
    163     + vma->vm_flags |= VM_DONTEXPAND;
    164    
    165     vma->vm_file = filp; /* Needed for drm_vm_open() */
    166     drm_vm_open_locked(vma);
    167     @@ -655,6 +656,7 @@ static int drm_mmap_locked(struct file *filp, struct vm_area_struct *vma)
    168     return -EINVAL; /* This should never happen. */
    169     }
    170     vma->vm_flags |= VM_RESERVED; /* Don't swap */
    171     + vma->vm_flags |= VM_DONTEXPAND;
    172    
    173     vma->vm_file = filp; /* Needed for drm_vm_open() */
    174     drm_vm_open_locked(vma);
    175     diff --git a/drivers/char/mspec.c b/drivers/char/mspec.c
    176     index 82f2e27..ff146c2 100644
    177     --- a/drivers/char/mspec.c
    178     +++ b/drivers/char/mspec.c
    179     @@ -283,7 +283,7 @@ mspec_mmap(struct file *file, struct vm_area_struct *vma,
    180     vdata->refcnt = ATOMIC_INIT(1);
    181     vma->vm_private_data = vdata;
    182    
    183     - vma->vm_flags |= (VM_IO | VM_RESERVED | VM_PFNMAP);
    184     + vma->vm_flags |= (VM_IO | VM_RESERVED | VM_PFNMAP | VM_DONTEXPAND);
    185     if (vdata->type == MSPEC_FETCHOP || vdata->type == MSPEC_UNCACHED)
    186     vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
    187     vma->vm_ops = &mspec_vm_ops;
    188     diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
    189     index 5e596a7..b2fb6ba 100644
    190     --- a/drivers/firmware/dmi_scan.c
    191     +++ b/drivers/firmware/dmi_scan.c
    192     @@ -469,12 +469,3 @@ int dmi_get_year(int field)
    193    
    194     return year;
    195     }
    196     -
    197     -/**
    198     - * dmi_get_slot - return dmi_ident[slot]
    199     - * @slot: index into dmi_ident[]
    200     - */
    201     -char *dmi_get_slot(int slot)
    202     -{
    203     - return(dmi_ident[slot]);
    204     -}
    205     diff --git a/drivers/media/video/cx23885/cx23885-cards.c b/drivers/media/video/cx23885/cx23885-cards.c
    206     index b9012ac..db00193 100644
    207     --- a/drivers/media/video/cx23885/cx23885-cards.c
    208     +++ b/drivers/media/video/cx23885/cx23885-cards.c
    209     @@ -138,6 +138,10 @@ struct cx23885_subid cx23885_subids[] = {
    210     .card = CX23885_BOARD_HAUPPAUGE_HVR1800,
    211     },{
    212     .subvendor = 0x0070,
    213     + .subdevice = 0x7809,
    214     + .card = CX23885_BOARD_HAUPPAUGE_HVR1800,
    215     + },{
    216     + .subvendor = 0x0070,
    217     .subdevice = 0x7911,
    218     .card = CX23885_BOARD_HAUPPAUGE_HVR1250,
    219     },{
    220     diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
    221     index f84c752..399592d 100644
    222     --- a/drivers/net/forcedeth.c
    223     +++ b/drivers/net/forcedeth.c
    224     @@ -5593,35 +5593,35 @@ static struct pci_device_id pci_tbl[] = {
    225     },
    226     { /* MCP77 Ethernet Controller */
    227     PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_32),
    228     - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    229     + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    230     },
    231     { /* MCP77 Ethernet Controller */
    232     PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_33),
    233     - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    234     + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    235     },
    236     { /* MCP77 Ethernet Controller */
    237     PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_34),
    238     - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    239     + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    240     },
    241     { /* MCP77 Ethernet Controller */
    242     PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_35),
    243     - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    244     + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    245     },
    246     { /* MCP79 Ethernet Controller */
    247     PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_36),
    248     - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    249     + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    250     },
    251     { /* MCP79 Ethernet Controller */
    252     PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_37),
    253     - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    254     + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    255     },
    256     { /* MCP79 Ethernet Controller */
    257     PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_38),
    258     - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    259     + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    260     },
    261     { /* MCP79 Ethernet Controller */
    262     PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_39),
    263     - .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
    264     + .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
    265     },
    266     {0,},
    267     };
    268     diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
    269     index bc15940..962e28b 100644
    270     --- a/drivers/net/sky2.c
    271     +++ b/drivers/net/sky2.c
    272     @@ -621,6 +621,7 @@ static void sky2_phy_power(struct sky2_hw *hw, unsigned port, int onoff)
    273     static const u32 phy_power[] = { PCI_Y2_PHY1_POWD, PCI_Y2_PHY2_POWD };
    274     static const u32 coma_mode[] = { PCI_Y2_PHY1_COMA, PCI_Y2_PHY2_COMA };
    275    
    276     + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
    277     reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
    278     /* Turn on/off phy power saving */
    279     if (onoff)
    280     @@ -632,7 +633,8 @@ static void sky2_phy_power(struct sky2_hw *hw, unsigned port, int onoff)
    281     reg1 |= coma_mode[port];
    282    
    283     sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
    284     - reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
    285     + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
    286     + sky2_pci_read32(hw, PCI_DEV_REG1);
    287    
    288     udelay(100);
    289     }
    290     @@ -1412,6 +1414,7 @@ static int sky2_up(struct net_device *dev)
    291     imask |= portirq_msk[port];
    292     sky2_write32(hw, B0_IMSK, imask);
    293    
    294     + sky2_set_multicast(dev);
    295     return 0;
    296    
    297     err_out:
    298     @@ -2426,6 +2429,7 @@ static void sky2_hw_intr(struct sky2_hw *hw)
    299     if (status & (Y2_IS_MST_ERR | Y2_IS_IRQ_STAT)) {
    300     u16 pci_err;
    301    
    302     + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
    303     pci_err = sky2_pci_read16(hw, PCI_STATUS);
    304     if (net_ratelimit())
    305     dev_err(&pdev->dev, "PCI hardware error (0x%x)\n",
    306     @@ -2433,12 +2437,14 @@ static void sky2_hw_intr(struct sky2_hw *hw)
    307    
    308     sky2_pci_write16(hw, PCI_STATUS,
    309     pci_err | PCI_STATUS_ERROR_BITS);
    310     + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
    311     }
    312    
    313     if (status & Y2_IS_PCI_EXP) {
    314     /* PCI-Express uncorrectable Error occurred */
    315     u32 err;
    316    
    317     + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
    318     err = sky2_read32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS);
    319     sky2_write32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS,
    320     0xfffffffful);
    321     @@ -2446,6 +2452,7 @@ static void sky2_hw_intr(struct sky2_hw *hw)
    322     dev_err(&pdev->dev, "PCI Express error (0x%x)\n", err);
    323    
    324     sky2_read32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS);
    325     + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
    326     }
    327    
    328     if (status & Y2_HWE_L1_MASK)
    329     @@ -2811,6 +2818,7 @@ static void sky2_reset(struct sky2_hw *hw)
    330     }
    331    
    332     sky2_power_on(hw);
    333     + sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
    334    
    335     for (i = 0; i < hw->ports; i++) {
    336     sky2_write8(hw, SK_REG(i, GMAC_LINK_CTRL), GMLC_RST_SET);
    337     @@ -3533,8 +3541,6 @@ static int sky2_set_ringparam(struct net_device *dev,
    338     err = sky2_up(dev);
    339     if (err)
    340     dev_close(dev);
    341     - else
    342     - sky2_set_multicast(dev);
    343     }
    344    
    345     return err;
    346     @@ -4368,8 +4374,6 @@ static int sky2_resume(struct pci_dev *pdev)
    347     dev_close(dev);
    348     goto out;
    349     }
    350     -
    351     - sky2_set_multicast(dev);
    352     }
    353     }
    354    
    355     diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
    356     index 5e8f8ac..559a9a9 100644
    357     --- a/drivers/net/wireless/b43/dma.c
    358     +++ b/drivers/net/wireless/b43/dma.c
    359     @@ -1106,7 +1106,7 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
    360     {
    361     const struct b43_dma_ops *ops = ring->ops;
    362     u8 *header;
    363     - int slot;
    364     + int slot, old_top_slot, old_used_slots;
    365     int err;
    366     struct b43_dmadesc_generic *desc;
    367     struct b43_dmadesc_meta *meta;
    368     @@ -1116,20 +1116,31 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
    369     #define SLOTS_PER_PACKET 2
    370     B43_WARN_ON(skb_shinfo(skb)->nr_frags);
    371    
    372     + old_top_slot = ring->current_slot;
    373     + old_used_slots = ring->used_slots;
    374     +
    375     /* Get a slot for the header. */
    376     slot = request_slot(ring);
    377     desc = ops->idx2desc(ring, slot, &meta_hdr);
    378     memset(meta_hdr, 0, sizeof(*meta_hdr));
    379    
    380     header = &(ring->txhdr_cache[slot * sizeof(struct b43_txhdr_fw4)]);
    381     - b43_generate_txhdr(ring->dev, header,
    382     + err = b43_generate_txhdr(ring->dev, header,
    383     skb->data, skb->len, ctl,
    384     generate_cookie(ring, slot));
    385     + if (unlikely(err)) {
    386     + ring->current_slot = old_top_slot;
    387     + ring->used_slots = old_used_slots;
    388     + return err;
    389     + }
    390    
    391     meta_hdr->dmaaddr = map_descbuffer(ring, (unsigned char *)header,
    392     sizeof(struct b43_txhdr_fw4), 1);
    393     - if (dma_mapping_error(meta_hdr->dmaaddr))
    394     + if (dma_mapping_error(meta_hdr->dmaaddr)) {
    395     + ring->current_slot = old_top_slot;
    396     + ring->used_slots = old_used_slots;
    397     return -EIO;
    398     + }
    399     ops->fill_descriptor(ring, desc, meta_hdr->dmaaddr,
    400     sizeof(struct b43_txhdr_fw4), 1, 0, 0);
    401    
    402     @@ -1147,6 +1158,8 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
    403     if (dma_mapping_error(meta->dmaaddr)) {
    404     bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
    405     if (!bounce_skb) {
    406     + ring->current_slot = old_top_slot;
    407     + ring->used_slots = old_used_slots;
    408     err = -ENOMEM;
    409     goto out_unmap_hdr;
    410     }
    411     @@ -1157,6 +1170,8 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
    412     meta->skb = skb;
    413     meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
    414     if (dma_mapping_error(meta->dmaaddr)) {
    415     + ring->current_slot = old_top_slot;
    416     + ring->used_slots = old_used_slots;
    417     err = -EIO;
    418     goto out_free_bounce;
    419     }
    420     @@ -1219,6 +1234,13 @@ int b43_dma_tx(struct b43_wldev *dev,
    421     B43_WARN_ON(ring->stopped);
    422    
    423     err = dma_tx_fragment(ring, skb, ctl);
    424     + if (unlikely(err == -ENOKEY)) {
    425     + /* Drop this packet, as we don't have the encryption key
    426     + * anymore and must not transmit it unencrypted. */
    427     + dev_kfree_skb_any(skb);
    428     + err = 0;
    429     + goto out_unlock;
    430     + }
    431     if (unlikely(err)) {
    432     b43err(dev->wl, "DMA tx mapping failure\n");
    433     goto out_unlock;
    434     diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
    435     index 1c93b4f..69795fd 100644
    436     --- a/drivers/net/wireless/b43/main.c
    437     +++ b/drivers/net/wireless/b43/main.c
    438     @@ -1800,6 +1800,18 @@ static int b43_upload_microcode(struct b43_wldev *dev)
    439     err = -EOPNOTSUPP;
    440     goto out;
    441     }
    442     + if (fwrev > 351) {
    443     + b43err(dev->wl, "YOUR FIRMWARE IS TOO NEW. Please downgrade your "
    444     + "firmware.\n");
    445     + b43err(dev->wl, "Use this firmware tarball: "
    446     + "http://downloads.openwrt.org/sources/broadcom-wl-4.80.53.0.tar.bz2\n");
    447     + b43err(dev->wl, "Use this b43-fwcutter tarball: "
    448     + "http://bu3sch.de/b43/fwcutter/b43-fwcutter-009.tar.bz2\n");
    449     + b43err(dev->wl, "Read, understand and _do_ what this message says, please.\n");
    450     + b43_write32(dev, B43_MMIO_MACCTL, 0);
    451     + err = -EOPNOTSUPP;
    452     + goto out;
    453     + }
    454     b43dbg(dev->wl, "Loading firmware version %u.%u "
    455     "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
    456     fwrev, fwpatch,
    457     @@ -3395,8 +3407,6 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
    458     b43_bluetooth_coext_enable(dev);
    459    
    460     ssb_bus_powerup(bus, 1); /* Enable dynamic PCTL */
    461     - memset(wl->bssid, 0, ETH_ALEN);
    462     - memset(wl->mac_addr, 0, ETH_ALEN);
    463     b43_upload_card_macaddress(dev);
    464     b43_security_init(dev);
    465     b43_rng_init(wl);
    466     @@ -3493,6 +3503,13 @@ static int b43_start(struct ieee80211_hw *hw)
    467     int did_init = 0;
    468     int err = 0;
    469    
    470     + /* Kill all old instance specific information to make sure
    471     + * the card won't use it in the short timeframe between start
    472     + * and mac80211 reconfiguring it. */
    473     + memset(wl->bssid, 0, ETH_ALEN);
    474     + memset(wl->mac_addr, 0, ETH_ALEN);
    475     + wl->filter_flags = 0;
    476     +
    477     /* First register RFkill.
    478     * LEDs that are registered later depend on it. */
    479     b43_rfkill_init(dev);
    480     diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
    481     index 3307ba1..a856b9f 100644
    482     --- a/drivers/net/wireless/b43/xmit.c
    483     +++ b/drivers/net/wireless/b43/xmit.c
    484     @@ -177,7 +177,7 @@ static u8 b43_calc_fallback_rate(u8 bitrate)
    485     return 0;
    486     }
    487    
    488     -static void generate_txhdr_fw4(struct b43_wldev *dev,
    489     +static int generate_txhdr_fw4(struct b43_wldev *dev,
    490     struct b43_txhdr_fw4 *txhdr,
    491     const unsigned char *fragment_data,
    492     unsigned int fragment_len,
    493     @@ -235,7 +235,15 @@ static void generate_txhdr_fw4(struct b43_wldev *dev,
    494    
    495     B43_WARN_ON(key_idx >= dev->max_nr_keys);
    496     key = &(dev->key[key_idx]);
    497     - B43_WARN_ON(!key->keyconf);
    498     +
    499     + if (unlikely(!key->keyconf)) {
    500     + /* This key is invalid. This might only happen
    501     + * in a short timeframe after machine resume before
    502     + * we were able to reconfigure keys.
    503     + * Drop this packet completely. Do not transmit it
    504     + * unencrypted to avoid leaking information. */
    505     + return -ENOKEY;
    506     + }
    507    
    508     /* Hardware appends ICV. */
    509     plcp_fragment_len += txctl->icv_len;
    510     @@ -352,16 +360,18 @@ static void generate_txhdr_fw4(struct b43_wldev *dev,
    511     txhdr->mac_ctl = cpu_to_le32(mac_ctl);
    512     txhdr->phy_ctl = cpu_to_le16(phy_ctl);
    513     txhdr->extra_ft = extra_ft;
    514     +
    515     + return 0;
    516     }
    517    
    518     -void b43_generate_txhdr(struct b43_wldev *dev,
    519     +int b43_generate_txhdr(struct b43_wldev *dev,
    520     u8 * txhdr,
    521     const unsigned char *fragment_data,
    522     unsigned int fragment_len,
    523     const struct ieee80211_tx_control *txctl, u16 cookie)
    524     {
    525     - generate_txhdr_fw4(dev, (struct b43_txhdr_fw4 *)txhdr,
    526     - fragment_data, fragment_len, txctl, cookie);
    527     + return generate_txhdr_fw4(dev, (struct b43_txhdr_fw4 *)txhdr,
    528     + fragment_data, fragment_len, txctl, cookie);
    529     }
    530    
    531     static s8 b43_rssi_postprocess(struct b43_wldev *dev,
    532     diff --git a/drivers/net/wireless/b43/xmit.h b/drivers/net/wireless/b43/xmit.h
    533     index 6dc0793..e3bac08 100644
    534     --- a/drivers/net/wireless/b43/xmit.h
    535     +++ b/drivers/net/wireless/b43/xmit.h
    536     @@ -82,7 +82,7 @@ struct b43_txhdr_fw4 {
    537     #define B43_TX4_PHY_ANT1 0x0100 /* Use antenna 1 */
    538     #define B43_TX4_PHY_ANTLAST 0x0300 /* Use last used antenna */
    539    
    540     -void b43_generate_txhdr(struct b43_wldev *dev,
    541     +int b43_generate_txhdr(struct b43_wldev *dev,
    542     u8 * txhdr,
    543     const unsigned char *fragment_data,
    544     unsigned int fragment_len,
    545     diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
    546     index 83161d9..6e08405 100644
    547     --- a/drivers/net/wireless/b43legacy/dma.c
    548     +++ b/drivers/net/wireless/b43legacy/dma.c
    549     @@ -1164,7 +1164,7 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
    550     {
    551     const struct b43legacy_dma_ops *ops = ring->ops;
    552     u8 *header;
    553     - int slot;
    554     + int slot, old_top_slot, old_used_slots;
    555     int err;
    556     struct b43legacy_dmadesc_generic *desc;
    557     struct b43legacy_dmadesc_meta *meta;
    558     @@ -1174,6 +1174,9 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
    559     #define SLOTS_PER_PACKET 2
    560     B43legacy_WARN_ON(skb_shinfo(skb)->nr_frags != 0);
    561    
    562     + old_top_slot = ring->current_slot;
    563     + old_used_slots = ring->used_slots;
    564     +
    565     /* Get a slot for the header. */
    566     slot = request_slot(ring);
    567     desc = ops->idx2desc(ring, slot, &meta_hdr);
    568     @@ -1181,9 +1184,14 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
    569    
    570     header = &(ring->txhdr_cache[slot * sizeof(
    571     struct b43legacy_txhdr_fw3)]);
    572     - b43legacy_generate_txhdr(ring->dev, header,
    573     + err = b43legacy_generate_txhdr(ring->dev, header,
    574     skb->data, skb->len, ctl,
    575     generate_cookie(ring, slot));
    576     + if (unlikely(err)) {
    577     + ring->current_slot = old_top_slot;
    578     + ring->used_slots = old_used_slots;
    579     + return err;
    580     + }
    581    
    582     meta_hdr->dmaaddr = map_descbuffer(ring, (unsigned char *)header,
    583     sizeof(struct b43legacy_txhdr_fw3), 1);
    584     @@ -1206,6 +1214,8 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
    585     if (dma_mapping_error(meta->dmaaddr)) {
    586     bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
    587     if (!bounce_skb) {
    588     + ring->current_slot = old_top_slot;
    589     + ring->used_slots = old_used_slots;
    590     err = -ENOMEM;
    591     goto out_unmap_hdr;
    592     }
    593     @@ -1216,6 +1226,8 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
    594     meta->skb = skb;
    595     meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
    596     if (dma_mapping_error(meta->dmaaddr)) {
    597     + ring->current_slot = old_top_slot;
    598     + ring->used_slots = old_used_slots;
    599     err = -EIO;
    600     goto out_free_bounce;
    601     }
    602     @@ -1282,6 +1294,13 @@ int b43legacy_dma_tx(struct b43legacy_wldev *dev,
    603     B43legacy_BUG_ON(ring->stopped);
    604    
    605     err = dma_tx_fragment(ring, skb, ctl);
    606     + if (unlikely(err == -ENOKEY)) {
    607     + /* Drop this packet, as we don't have the encryption key
    608     + * anymore and must not transmit it unencrypted. */
    609     + dev_kfree_skb_any(skb);
    610     + err = 0;
    611     + goto out_unlock;
    612     + }
    613     if (unlikely(err)) {
    614     b43legacyerr(dev->wl, "DMA tx mapping failure\n");
    615     goto out_unlock;
    616     diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
    617     index 32d5e17..cdb0497 100644
    618     --- a/drivers/net/wireless/b43legacy/main.c
    619     +++ b/drivers/net/wireless/b43legacy/main.c
    620     @@ -3215,8 +3215,6 @@ static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev)
    621     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, 0x0414, 0x01F4);
    622    
    623     ssb_bus_powerup(bus, 1); /* Enable dynamic PCTL */
    624     - memset(wl->bssid, 0, ETH_ALEN);
    625     - memset(wl->mac_addr, 0, ETH_ALEN);
    626     b43legacy_upload_card_macaddress(dev);
    627     b43legacy_security_init(dev);
    628     b43legacy_rng_init(wl);
    629     @@ -3311,6 +3309,13 @@ static int b43legacy_start(struct ieee80211_hw *hw)
    630     int did_init = 0;
    631     int err = 0;
    632    
    633     + /* Kill all old instance specific information to make sure
    634     + * the card won't use it in the short timeframe between start
    635     + * and mac80211 reconfiguring it. */
    636     + memset(wl->bssid, 0, ETH_ALEN);
    637     + memset(wl->mac_addr, 0, ETH_ALEN);
    638     + wl->filter_flags = 0;
    639     +
    640     mutex_lock(&wl->mutex);
    641    
    642     if (b43legacy_status(dev) < B43legacy_STAT_INITIALIZED) {
    643     diff --git a/drivers/net/wireless/b43legacy/pio.c b/drivers/net/wireless/b43legacy/pio.c
    644     index de843ac..3034503 100644
    645     --- a/drivers/net/wireless/b43legacy/pio.c
    646     +++ b/drivers/net/wireless/b43legacy/pio.c
    647     @@ -181,7 +181,7 @@ union txhdr_union {
    648     struct b43legacy_txhdr_fw3 txhdr_fw3;
    649     };
    650    
    651     -static void pio_tx_write_fragment(struct b43legacy_pioqueue *queue,
    652     +static int pio_tx_write_fragment(struct b43legacy_pioqueue *queue,
    653     struct sk_buff *skb,
    654     struct b43legacy_pio_txpacket *packet,
    655     size_t txhdr_size)
    656     @@ -189,14 +189,17 @@ static void pio_tx_write_fragment(struct b43legacy_pioqueue *queue,
    657     union txhdr_union txhdr_data;
    658     u8 *txhdr = NULL;
    659     unsigned int octets;
    660     + int err;
    661    
    662     txhdr = (u8 *)(&txhdr_data.txhdr_fw3);
    663    
    664     B43legacy_WARN_ON(skb_shinfo(skb)->nr_frags != 0);
    665     - b43legacy_generate_txhdr(queue->dev,
    666     + err = b43legacy_generate_txhdr(queue->dev,
    667     txhdr, skb->data, skb->len,
    668     &packet->txstat.control,
    669     generate_cookie(queue, packet));
    670     + if (err)
    671     + return err;
    672    
    673     tx_start(queue);
    674     octets = skb->len + txhdr_size;
    675     @@ -204,6 +207,8 @@ static void pio_tx_write_fragment(struct b43legacy_pioqueue *queue,
    676     octets--;
    677     tx_data(queue, txhdr, (u8 *)skb->data, octets);
    678     tx_complete(queue, skb);
    679     +
    680     + return 0;
    681     }
    682    
    683     static void free_txpacket(struct b43legacy_pio_txpacket *packet,
    684     @@ -226,6 +231,7 @@ static int pio_tx_packet(struct b43legacy_pio_txpacket *packet)
    685     struct b43legacy_pioqueue *queue = packet->queue;
    686     struct sk_buff *skb = packet->skb;
    687     u16 octets;
    688     + int err;
    689    
    690     octets = (u16)skb->len + sizeof(struct b43legacy_txhdr_fw3);
    691     if (queue->tx_devq_size < octets) {
    692     @@ -247,8 +253,14 @@ static int pio_tx_packet(struct b43legacy_pio_txpacket *packet)
    693     if (queue->tx_devq_used + octets > queue->tx_devq_size)
    694     return -EBUSY;
    695     /* Now poke the device. */
    696     - pio_tx_write_fragment(queue, skb, packet,
    697     + err = pio_tx_write_fragment(queue, skb, packet,
    698     sizeof(struct b43legacy_txhdr_fw3));
    699     + if (unlikely(err == -ENOKEY)) {
    700     + /* Drop this packet, as we don't have the encryption key
    701     + * anymore and must not transmit it unencrypted. */
    702     + free_txpacket(packet, 1);
    703     + return 0;
    704     + }
    705    
    706     /* Account for the packet size.
    707     * (We must not overflow the device TX queue)
    708     @@ -486,6 +498,9 @@ void b43legacy_pio_handle_txstatus(struct b43legacy_wldev *dev,
    709     queue = parse_cookie(dev, status->cookie, &packet);
    710     B43legacy_WARN_ON(!queue);
    711    
    712     + if (!packet->skb)
    713     + return;
    714     +
    715     queue->tx_devq_packets--;
    716     queue->tx_devq_used -= (packet->skb->len +
    717     sizeof(struct b43legacy_txhdr_fw3));
    718     diff --git a/drivers/net/wireless/b43legacy/xmit.c b/drivers/net/wireless/b43legacy/xmit.c
    719     index fa1e656..f10d637 100644
    720     --- a/drivers/net/wireless/b43legacy/xmit.c
    721     +++ b/drivers/net/wireless/b43legacy/xmit.c
    722     @@ -181,7 +181,7 @@ static u8 b43legacy_calc_fallback_rate(u8 bitrate)
    723     return 0;
    724     }
    725    
    726     -static void generate_txhdr_fw3(struct b43legacy_wldev *dev,
    727     +static int generate_txhdr_fw3(struct b43legacy_wldev *dev,
    728     struct b43legacy_txhdr_fw3 *txhdr,
    729     const unsigned char *fragment_data,
    730     unsigned int fragment_len,
    731     @@ -252,6 +252,13 @@ static void generate_txhdr_fw3(struct b43legacy_wldev *dev,
    732     iv_len = min((size_t)txctl->iv_len,
    733     ARRAY_SIZE(txhdr->iv));
    734     memcpy(txhdr->iv, ((u8 *)wlhdr) + wlhdr_len, iv_len);
    735     + } else {
    736     + /* This key is invalid. This might only happen
    737     + * in a short timeframe after machine resume before
    738     + * we were able to reconfigure keys.
    739     + * Drop this packet completely. Do not transmit it
    740     + * unencrypted to avoid leaking information. */
    741     + return -ENOKEY;
    742     }
    743     }
    744     b43legacy_generate_plcp_hdr((struct b43legacy_plcp_hdr4 *)
    745     @@ -344,16 +351,18 @@ static void generate_txhdr_fw3(struct b43legacy_wldev *dev,
    746     /* Apply the bitfields */
    747     txhdr->mac_ctl = cpu_to_le32(mac_ctl);
    748     txhdr->phy_ctl = cpu_to_le16(phy_ctl);
    749     +
    750     + return 0;
    751     }
    752    
    753     -void b43legacy_generate_txhdr(struct b43legacy_wldev *dev,
    754     +int b43legacy_generate_txhdr(struct b43legacy_wldev *dev,
    755     u8 *txhdr,
    756     const unsigned char *fragment_data,
    757     unsigned int fragment_len,
    758     const struct ieee80211_tx_control *txctl,
    759     u16 cookie)
    760     {
    761     - generate_txhdr_fw3(dev, (struct b43legacy_txhdr_fw3 *)txhdr,
    762     + return generate_txhdr_fw3(dev, (struct b43legacy_txhdr_fw3 *)txhdr,
    763     fragment_data, fragment_len,
    764     txctl, cookie);
    765     }
    766     diff --git a/drivers/net/wireless/b43legacy/xmit.h b/drivers/net/wireless/b43legacy/xmit.h
    767     index 8a155d0..bab4792 100644
    768     --- a/drivers/net/wireless/b43legacy/xmit.h
    769     +++ b/drivers/net/wireless/b43legacy/xmit.h
    770     @@ -76,7 +76,7 @@ struct b43legacy_txhdr_fw3 {
    771    
    772    
    773    
    774     -void b43legacy_generate_txhdr(struct b43legacy_wldev *dev,
    775     +int b43legacy_generate_txhdr(struct b43legacy_wldev *dev,
    776     u8 *txhdr,
    777     const unsigned char *fragment_data,
    778     unsigned int fragment_len,
    779     diff --git a/drivers/pci/hotplug/fakephp.c b/drivers/pci/hotplug/fakephp.c
    780     index d7a293e..94b6401 100644
    781     --- a/drivers/pci/hotplug/fakephp.c
    782     +++ b/drivers/pci/hotplug/fakephp.c
    783     @@ -39,6 +39,7 @@
    784     #include <linux/init.h>
    785     #include <linux/string.h>
    786     #include <linux/slab.h>
    787     +#include <linux/workqueue.h>
    788     #include "../pci.h"
    789    
    790     #if !defined(MODULE)
    791     @@ -63,10 +64,16 @@ struct dummy_slot {
    792     struct list_head node;
    793     struct hotplug_slot *slot;
    794     struct pci_dev *dev;
    795     + struct work_struct remove_work;
    796     + unsigned long removed;
    797     };
    798    
    799     static int debug;
    800     static LIST_HEAD(slot_list);
    801     +static struct workqueue_struct *dummyphp_wq;
    802     +
    803     +static void pci_rescan_worker(struct work_struct *work);
    804     +static DECLARE_WORK(pci_rescan_work, pci_rescan_worker);
    805    
    806     static int enable_slot (struct hotplug_slot *slot);
    807     static int disable_slot (struct hotplug_slot *slot);
    808     @@ -109,7 +116,7 @@ static int add_slot(struct pci_dev *dev)
    809     slot->name = &dev->dev.bus_id[0];
    810     dbg("slot->name = %s\n", slot->name);
    811    
    812     - dslot = kmalloc(sizeof(struct dummy_slot), GFP_KERNEL);
    813     + dslot = kzalloc(sizeof(struct dummy_slot), GFP_KERNEL);
    814     if (!dslot)
    815     goto error_info;
    816    
    817     @@ -164,6 +171,14 @@ static void remove_slot(struct dummy_slot *dslot)
    818     err("Problem unregistering a slot %s\n", dslot->slot->name);
    819     }
    820    
    821     +/* called from the single-threaded workqueue handler to remove a slot */
    822     +static void remove_slot_worker(struct work_struct *work)
    823     +{
    824     + struct dummy_slot *dslot =
    825     + container_of(work, struct dummy_slot, remove_work);
    826     + remove_slot(dslot);
    827     +}
    828     +
    829     /**
    830     * pci_rescan_slot - Rescan slot
    831     * @temp: Device template. Should be set: bus and devfn.
    832     @@ -267,11 +282,17 @@ static inline void pci_rescan(void) {
    833     pci_rescan_buses(&pci_root_buses);
    834     }
    835    
    836     +/* called from the single-threaded workqueue handler to rescan all pci buses */
    837     +static void pci_rescan_worker(struct work_struct *work)
    838     +{
    839     + pci_rescan();
    840     +}
    841    
    842     static int enable_slot(struct hotplug_slot *hotplug_slot)
    843     {
    844     /* mis-use enable_slot for rescanning of the pci bus */
    845     - pci_rescan();
    846     + cancel_work_sync(&pci_rescan_work);
    847     + queue_work(dummyphp_wq, &pci_rescan_work);
    848     return -ENODEV;
    849     }
    850    
    851     @@ -306,6 +327,10 @@ static int disable_slot(struct hotplug_slot *slot)
    852     err("Can't remove PCI devices with other PCI devices behind it yet.\n");
    853     return -ENODEV;
    854     }
    855     + if (test_and_set_bit(0, &dslot->removed)) {
    856     + dbg("Slot already scheduled for removal\n");
    857     + return -ENODEV;
    858     + }
    859     /* search for subfunctions and disable them first */
    860     if (!(dslot->dev->devfn & 7)) {
    861     for (func = 1; func < 8; func++) {
    862     @@ -328,8 +353,9 @@ static int disable_slot(struct hotplug_slot *slot)
    863     /* remove the device from the pci core */
    864     pci_remove_bus_device(dslot->dev);
    865    
    866     - /* blow away this sysfs entry and other parts. */
    867     - remove_slot(dslot);
    868     + /* queue work item to blow away this sysfs entry and other parts. */
    869     + INIT_WORK(&dslot->remove_work, remove_slot_worker);
    870     + queue_work(dummyphp_wq, &dslot->remove_work);
    871    
    872     return 0;
    873     }
    874     @@ -340,6 +366,7 @@ static void cleanup_slots (void)
    875     struct list_head *next;
    876     struct dummy_slot *dslot;
    877    
    878     + destroy_workqueue(dummyphp_wq);
    879     list_for_each_safe (tmp, next, &slot_list) {
    880     dslot = list_entry (tmp, struct dummy_slot, node);
    881     remove_slot(dslot);
    882     @@ -351,6 +378,10 @@ static int __init dummyphp_init(void)
    883     {
    884     info(DRIVER_DESC "\n");
    885    
    886     + dummyphp_wq = create_singlethread_workqueue(MY_NAME);
    887     + if (!dummyphp_wq)
    888     + return -ENOMEM;
    889     +
    890     return pci_scan_buses();
    891     }
    892    
    893     diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
    894     index c51f8e9..b469718 100644
    895     --- a/drivers/usb/core/driver.c
    896     +++ b/drivers/usb/core/driver.c
    897     @@ -534,8 +534,8 @@ const struct usb_device_id *usb_match_id(struct usb_interface *interface,
    898     id->driver_info is the way to create an entry that
    899     indicates that the driver want to examine every
    900     device and interface. */
    901     - for (; id->idVendor || id->bDeviceClass || id->bInterfaceClass ||
    902     - id->driver_info; id++) {
    903     + for (; id->idVendor || id->idProduct || id->bDeviceClass ||
    904     + id->bInterfaceClass || id->driver_info; id++) {
    905     if (usb_match_one_id(interface, id))
    906     return id;
    907     }
    908     diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    909     index b04d232..1b17f63 100644
    910     --- a/drivers/usb/core/hub.c
    911     +++ b/drivers/usb/core/hub.c
    912     @@ -2946,7 +2946,7 @@ static int config_descriptors_changed(struct usb_device *udev)
    913     if (len < le16_to_cpu(udev->config[index].desc.wTotalLength))
    914     len = le16_to_cpu(udev->config[index].desc.wTotalLength);
    915     }
    916     - buf = kmalloc (len, GFP_KERNEL);
    917     + buf = kmalloc(len, GFP_NOIO);
    918     if (buf == NULL) {
    919     dev_err(&udev->dev, "no mem to re-read configs after reset\n");
    920     /* assume the worst */
    921     diff --git a/drivers/usb/gadget/fsl_usb2_udc.c b/drivers/usb/gadget/fsl_usb2_udc.c
    922     index 038e7d7..d59eb92 100644
    923     --- a/drivers/usb/gadget/fsl_usb2_udc.c
    924     +++ b/drivers/usb/gadget/fsl_usb2_udc.c
    925     @@ -776,7 +776,7 @@ fsl_ep_queue(struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
    926     VDBG("%s, bad params\n", __FUNCTION__);
    927     return -EINVAL;
    928     }
    929     - if (!_ep || (!ep->desc && ep_index(ep))) {
    930     + if (unlikely(!_ep || !ep->desc)) {
    931     VDBG("%s, bad ep\n", __FUNCTION__);
    932     return -EINVAL;
    933     }
    934     diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
    935     index ea31621..81755d0 100644
    936     --- a/drivers/usb/misc/usbtest.c
    937     +++ b/drivers/usb/misc/usbtest.c
    938     @@ -1151,6 +1151,7 @@ static int verify_halted (int ep, struct urb *urb)
    939     dbg ("ep %02x couldn't get halt status, %d", ep, retval);
    940     return retval;
    941     }
    942     + le16_to_cpus(&status);
    943     if (status != 1) {
    944     dbg ("ep %02x bogus status: %04x != 1", ep, status);
    945     return -EINVAL;
    946     diff --git a/drivers/usb/serial/cp2101.c b/drivers/usb/serial/cp2101.c
    947     index 2283358..cd5f71b 100644
    948     --- a/drivers/usb/serial/cp2101.c
    949     +++ b/drivers/usb/serial/cp2101.c
    950     @@ -59,6 +59,7 @@ static struct usb_device_id id_table [] = {
    951     { USB_DEVICE(0x10A6, 0xAA26) }, /* Knock-off DCU-11 cable */
    952     { USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */
    953     { USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */
    954     + { USB_DEVICE(0x10C4, 0x800A) }, /* SPORTident BSM7-D-USB main station */
    955     { USB_DEVICE(0x10C4, 0x803B) }, /* Pololu USB-serial converter */
    956     { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */
    957     { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */
    958     @@ -76,8 +77,13 @@ static struct usb_device_id id_table [] = {
    959     { USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */
    960     { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
    961     { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
    962     + { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */
    963     + { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */
    964     + { USB_DEVICE(0x10C4, 0xF003) }, /* Elan Digital Systems USBpulse100 */
    965     + { USB_DEVICE(0x10C4, 0xF004) }, /* Elan Digital Systems USBcount50 */
    966     { USB_DEVICE(0x10C5, 0xEA61) }, /* Silicon Labs MobiData GPRS USB Modem */
    967     { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */
    968     + { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */
    969     { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
    970     { } /* Terminating Entry */
    971     };
    972     diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    973     index c40e77d..1382af9 100644
    974     --- a/drivers/usb/serial/ftdi_sio.c
    975     +++ b/drivers/usb/serial/ftdi_sio.c
    976     @@ -471,30 +471,28 @@ static struct usb_device_id id_table_combined [] = {
    977     { USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) },
    978     { USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) },
    979     /*
    980     - * These will probably use user-space drivers. Uncomment them if
    981     - * you need them or use the user-specified vendor/product module
    982     - * parameters (see ftdi_sio.h for the numbers). Make a fuss if
    983     - * you think the driver should recognize any of them by default.
    984     + * Due to many user requests for multiple ELV devices we enable
    985     + * them by default.
    986     */
    987     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_CLI7000_PID) }, */
    988     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_PPS7330_PID) }, */
    989     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_TFM100_PID) }, */
    990     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_UDF77_PID) }, */
    991     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_UIO88_PID) }, */
    992     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_UAD8_PID) }, */
    993     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_UDA7_PID) }, */
    994     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_USI2_PID) }, */
    995     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_T1100_PID) }, */
    996     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_PCD200_PID) }, */
    997     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_ULA200_PID) }, */
    998     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_CSI8_PID) }, */
    999     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_EM1000DL_PID) }, */
    1000     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_PCK100_PID) }, */
    1001     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_RFP500_PID) }, */
    1002     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_FS20SIG_PID) }, */
    1003     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_WS300PC_PID) }, */
    1004     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_FHZ1300PC_PID) }, */
    1005     - /* { USB_DEVICE(FTDI_VID, FTDI_ELV_WS500_PID) }, */
    1006     + { USB_DEVICE(FTDI_VID, FTDI_ELV_CLI7000_PID) },
    1007     + { USB_DEVICE(FTDI_VID, FTDI_ELV_PPS7330_PID) },
    1008     + { USB_DEVICE(FTDI_VID, FTDI_ELV_TFM100_PID) },
    1009     + { USB_DEVICE(FTDI_VID, FTDI_ELV_UDF77_PID) },
    1010     + { USB_DEVICE(FTDI_VID, FTDI_ELV_UIO88_PID) },
    1011     + { USB_DEVICE(FTDI_VID, FTDI_ELV_UAD8_PID) },
    1012     + { USB_DEVICE(FTDI_VID, FTDI_ELV_UDA7_PID) },
    1013     + { USB_DEVICE(FTDI_VID, FTDI_ELV_USI2_PID) },
    1014     + { USB_DEVICE(FTDI_VID, FTDI_ELV_T1100_PID) },
    1015     + { USB_DEVICE(FTDI_VID, FTDI_ELV_PCD200_PID) },
    1016     + { USB_DEVICE(FTDI_VID, FTDI_ELV_ULA200_PID) },
    1017     + { USB_DEVICE(FTDI_VID, FTDI_ELV_CSI8_PID) },
    1018     + { USB_DEVICE(FTDI_VID, FTDI_ELV_EM1000DL_PID) },
    1019     + { USB_DEVICE(FTDI_VID, FTDI_ELV_PCK100_PID) },
    1020     + { USB_DEVICE(FTDI_VID, FTDI_ELV_RFP500_PID) },
    1021     + { USB_DEVICE(FTDI_VID, FTDI_ELV_FS20SIG_PID) },
    1022     + { USB_DEVICE(FTDI_VID, FTDI_ELV_WS300PC_PID) },
    1023     + { USB_DEVICE(FTDI_VID, FTDI_ELV_FHZ1300PC_PID) },
    1024     + { USB_DEVICE(FTDI_VID, FTDI_ELV_WS500_PID) },
    1025     { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
    1026     { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
    1027     { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
    1028     @@ -545,6 +543,7 @@ static struct usb_device_id id_table_combined [] = {
    1029     { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16C_PID) },
    1030     { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16HR_PID) },
    1031     { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16HRC_PID) },
    1032     + { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16IC_PID) },
    1033     { USB_DEVICE(KOBIL_VID, KOBIL_CONV_B1_PID) },
    1034     { USB_DEVICE(KOBIL_VID, KOBIL_CONV_KAAN_PID) },
    1035     { USB_DEVICE(POSIFLEX_VID, POSIFLEX_PP7000_PID) },
    1036     @@ -569,6 +568,7 @@ static struct usb_device_id id_table_combined [] = {
    1037     { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
    1038     { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
    1039     { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
    1040     + { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) },
    1041     { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
    1042     .driver_info = (kernel_ulong_t)&ftdi_olimex_quirk },
    1043     { }, /* Optional parameter entry */
    1044     diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
    1045     index b51cbb0..f6053da 100644
    1046     --- a/drivers/usb/serial/ftdi_sio.h
    1047     +++ b/drivers/usb/serial/ftdi_sio.h
    1048     @@ -245,6 +245,7 @@
    1049     #define FTDI_ELV_WS300PC_PID 0xE0F6 /* PC-Wetterstation (WS 300 PC) */
    1050     #define FTDI_ELV_FHZ1300PC_PID 0xE0E8 /* FHZ 1300 PC */
    1051     #define FTDI_ELV_WS500_PID 0xE0E9 /* PC-Wetterstation (WS 500) */
    1052     +#define FTDI_ELV_EM1010PC_PID 0xE0EF /* Engery monitor EM 1010 PC */
    1053    
    1054     /*
    1055     * Definitions for ID TECH (www.idt-net.com) devices
    1056     @@ -278,6 +279,7 @@
    1057     #define FTDI_ATIK_ATK16C_PID 0xDF32 /* ATIK ATK-16C Colour Camera */
    1058     #define FTDI_ATIK_ATK16HR_PID 0xDF31 /* ATIK ATK-16HR Grayscale Camera */
    1059     #define FTDI_ATIK_ATK16HRC_PID 0xDF33 /* ATIK ATK-16HRC Colour Camera */
    1060     +#define FTDI_ATIK_ATK16IC_PID 0xDF35 /* ATIK ATK-16IC Grayscale Camera */
    1061    
    1062     /*
    1063     * Protego product ids
    1064     @@ -534,6 +536,8 @@
    1065     #define OLIMEX_VID 0x15BA
    1066     #define OLIMEX_ARM_USB_OCD_PID 0x0003
    1067    
    1068     +/* www.elsterelectricity.com Elster Unicom III Optical Probe */
    1069     +#define FTDI_ELSTER_UNICOM_PID 0xE700 /* Product Id */
    1070    
    1071     /*
    1072     * The Mobility Lab (TML)
    1073     diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
    1074     index 7c069a0..ea7bba6 100644
    1075     --- a/drivers/usb/serial/keyspan.c
    1076     +++ b/drivers/usb/serial/keyspan.c
    1077     @@ -838,7 +838,7 @@ static void usa49_indat_callback(struct urb *urb)
    1078    
    1079     port = (struct usb_serial_port *) urb->context;
    1080     tty = port->tty;
    1081     - if (urb->actual_length) {
    1082     + if (tty && urb->actual_length) {
    1083     /* 0x80 bit is error flag */
    1084     if ((data[0] & 0x80) == 0) {
    1085     /* no error on any byte */
    1086     diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
    1087     index aee4502..17b3bae 100644
    1088     --- a/drivers/usb/serial/kobil_sct.c
    1089     +++ b/drivers/usb/serial/kobil_sct.c
    1090     @@ -114,6 +114,7 @@ static struct usb_serial_driver kobil_device = {
    1091     .usb_driver = &kobil_driver,
    1092     .id_table = id_table,
    1093     .num_interrupt_in = NUM_DONT_CARE,
    1094     + .num_interrupt_out = NUM_DONT_CARE,
    1095     .num_bulk_in = 0,
    1096     .num_bulk_out = 0,
    1097     .num_ports = 1,
    1098     diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    1099     index d1185f5..bbbe1b9 100644
    1100     --- a/drivers/usb/serial/option.c
    1101     +++ b/drivers/usb/serial/option.c
    1102     @@ -180,6 +180,7 @@ static struct usb_device_id option_ids[] = {
    1103     { USB_DEVICE(DELL_VENDOR_ID, 0x8117) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO ExpressCard == Novatel Merlin XV620 CDMA/EV-DO */
    1104     { USB_DEVICE(DELL_VENDOR_ID, 0x8118) }, /* Dell Wireless 5510 Mobile Broadband HSDPA ExpressCard == Novatel Merlin XU870 HSDPA/3G */
    1105     { USB_DEVICE(DELL_VENDOR_ID, 0x8128) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite E720 CDMA/EV-DO */
    1106     + { USB_DEVICE(DELL_VENDOR_ID, 0x8136) }, /* Dell Wireless HSDPA 5520 == Novatel Expedite EU860D */
    1107     { USB_DEVICE(DELL_VENDOR_ID, 0x8137) }, /* Dell Wireless HSDPA 5520 */
    1108     { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },
    1109     { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
    1110     diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
    1111     index 0da1df9..b7da8b5 100644
    1112     --- a/drivers/usb/serial/pl2303.c
    1113     +++ b/drivers/usb/serial/pl2303.c
    1114     @@ -65,6 +65,7 @@ static struct usb_device_id id_table [] = {
    1115     { USB_DEVICE(ITEGNO_VENDOR_ID, ITEGNO_PRODUCT_ID_2080) },
    1116     { USB_DEVICE(MA620_VENDOR_ID, MA620_PRODUCT_ID) },
    1117     { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID) },
    1118     + { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
    1119     { USB_DEVICE(TRIPP_VENDOR_ID, TRIPP_PRODUCT_ID) },
    1120     { USB_DEVICE(RADIOSHACK_VENDOR_ID, RADIOSHACK_PRODUCT_ID) },
    1121     { USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) },
    1122     @@ -84,9 +85,10 @@ static struct usb_device_id id_table [] = {
    1123     { USB_DEVICE(DATAPILOT_U2_VENDOR_ID, DATAPILOT_U2_PRODUCT_ID) },
    1124     { USB_DEVICE(BELKIN_VENDOR_ID, BELKIN_PRODUCT_ID) },
    1125     { USB_DEVICE(ALCOR_VENDOR_ID, ALCOR_PRODUCT_ID) },
    1126     - { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ID) },
    1127     { USB_DEVICE(WS002IN_VENDOR_ID, WS002IN_PRODUCT_ID) },
    1128     { USB_DEVICE(COREGA_VENDOR_ID, COREGA_PRODUCT_ID) },
    1129     + { USB_DEVICE(HL340_VENDOR_ID, HL340_PRODUCT_ID) },
    1130     + { USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
    1131     { } /* Terminating entry */
    1132     };
    1133    
    1134     diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
    1135     index d31f5d2..237a41f 100644
    1136     --- a/drivers/usb/serial/pl2303.h
    1137     +++ b/drivers/usb/serial/pl2303.h
    1138     @@ -35,6 +35,7 @@
    1139    
    1140     #define RATOC_VENDOR_ID 0x0584
    1141     #define RATOC_PRODUCT_ID 0xb000
    1142     +#define RATOC_PRODUCT_ID_USB60F 0xb020
    1143    
    1144     #define TRIPP_VENDOR_ID 0x2478
    1145     #define TRIPP_PRODUCT_ID 0x2008
    1146     @@ -96,10 +97,6 @@
    1147     #define ALCOR_VENDOR_ID 0x058F
    1148     #define ALCOR_PRODUCT_ID 0x9720
    1149    
    1150     -/* Huawei E620 UMTS/HSDPA card (ID: 12d1:1001) */
    1151     -#define HUAWEI_VENDOR_ID 0x12d1
    1152     -#define HUAWEI_PRODUCT_ID 0x1001
    1153     -
    1154     /* Willcom WS002IN Data Driver (by NetIndex Inc.) */
    1155     #define WS002IN_VENDOR_ID 0x11f6
    1156     #define WS002IN_PRODUCT_ID 0x2001
    1157     @@ -107,3 +104,11 @@
    1158     /* Corega CG-USBRS232R Serial Adapter */
    1159     #define COREGA_VENDOR_ID 0x07aa
    1160     #define COREGA_PRODUCT_ID 0x002a
    1161     +
    1162     +/* HL HL-340 (ID: 4348:5523) */
    1163     +#define HL340_VENDOR_ID 0x4348
    1164     +#define HL340_PRODUCT_ID 0x5523
    1165     +
    1166     +/* Y.C. Cable U.S.A., Inc - USB to RS-232 */
    1167     +#define YCCABLE_VENDOR_ID 0x05ad
    1168     +#define YCCABLE_PRODUCT_ID 0x0fba
    1169     diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
    1170     index c295d04..b4d7ac9 100644
    1171     --- a/drivers/usb/serial/sierra.c
    1172     +++ b/drivers/usb/serial/sierra.c
    1173     @@ -104,6 +104,7 @@ static struct usb_device_id id_table [] = {
    1174     { USB_DEVICE(0x1199, 0x0019) }, /* Sierra Wireless AirCard 595 */
    1175     { USB_DEVICE(0x1199, 0x0021) }, /* Sierra Wireless AirCard 597E */
    1176     { USB_DEVICE(0x1199, 0x0120) }, /* Sierra Wireless USB Dongle 595U */
    1177     + { USB_DEVICE(0x1199, 0x0023) }, /* Sierra Wireless AirCard */
    1178    
    1179     { USB_DEVICE(0x1199, 0x6802) }, /* Sierra Wireless MC8755 */
    1180     { USB_DEVICE(0x1199, 0x6804) }, /* Sierra Wireless MC8755 */
    1181     @@ -117,9 +118,15 @@ static struct usb_device_id id_table [] = {
    1182     { USB_DEVICE(0x1199, 0x6851) }, /* Sierra Wireless AirCard 881 */
    1183     { USB_DEVICE(0x1199, 0x6852) }, /* Sierra Wireless AirCard 880 E */
    1184     { USB_DEVICE(0x1199, 0x6853) }, /* Sierra Wireless AirCard 881 E */
    1185     + { USB_DEVICE(0x1199, 0x6855) }, /* Sierra Wireless AirCard 880 U */
    1186     + { USB_DEVICE(0x1199, 0x6856) }, /* Sierra Wireless AirCard 881 U */
    1187     +
    1188     + { USB_DEVICE(0x1199, 0x6468) }, /* Sierra Wireless MP3G - EVDO */
    1189     + { USB_DEVICE(0x1199, 0x6469) }, /* Sierra Wireless MP3G - UMTS/HSPA */
    1190    
    1191     { USB_DEVICE(0x1199, 0x0112), .driver_info = DEVICE_1_PORT }, /* Sierra Wireless AirCard 580 */
    1192     { USB_DEVICE(0x0F3D, 0x0112), .driver_info = DEVICE_1_PORT }, /* Airprime/Sierra PC 5220 */
    1193     + { USB_DEVICE(0x05C6, 0x6613), .driver_info = DEVICE_1_PORT }, /* Onda H600/ZTE MF330 */
    1194    
    1195     { USB_DEVICE(0x1199, 0x0FFF), .driver_info = DEVICE_INSTALLER},
    1196     { }
    1197     @@ -129,6 +136,7 @@ MODULE_DEVICE_TABLE(usb, id_table);
    1198     static struct usb_device_id id_table_1port [] = {
    1199     { USB_DEVICE(0x1199, 0x0112) }, /* Sierra Wireless AirCard 580 */
    1200     { USB_DEVICE(0x0F3D, 0x0112) }, /* AirPrime/Sierra PC 5220 */
    1201     + { USB_DEVICE(0x05C6, 0x6613) }, /* Onda H600/ZTE MF330 */
    1202     { }
    1203     };
    1204    
    1205     @@ -142,6 +150,7 @@ static struct usb_device_id id_table_3port [] = {
    1206     { USB_DEVICE(0x1199, 0x0019) }, /* Sierra Wireless AirCard 595 */
    1207     { USB_DEVICE(0x1199, 0x0021) }, /* Sierra Wireless AirCard 597E */
    1208     { USB_DEVICE(0x1199, 0x0120) }, /* Sierra Wireless USB Dongle 595U*/
    1209     + { USB_DEVICE(0x1199, 0x0023) }, /* Sierra Wireless AirCard */
    1210    
    1211     { USB_DEVICE(0x1199, 0x6802) }, /* Sierra Wireless MC8755 */
    1212     { USB_DEVICE(0x1199, 0x6804) }, /* Sierra Wireless MC8755 */
    1213     @@ -155,6 +164,10 @@ static struct usb_device_id id_table_3port [] = {
    1214     { USB_DEVICE(0x1199, 0x6851) }, /* Sierra Wireless AirCard 881 */
    1215     { USB_DEVICE(0x1199, 0x6852) }, /* Sierra Wireless AirCard 880E */
    1216     { USB_DEVICE(0x1199, 0x6853) }, /* Sierra Wireless AirCard 881E */
    1217     + { USB_DEVICE(0x1199, 0x6855) }, /* Sierra Wireless AirCard 880 U */
    1218     + { USB_DEVICE(0x1199, 0x6856) }, /* Sierra Wireless AirCard 881U */
    1219     + { USB_DEVICE(0x1199, 0x6468) }, /* Sierra Wireless MP3G - EVDO */
    1220     + { USB_DEVICE(0x1199, 0x6469) }, /* Sierra Wireless MP3G - UMTS/HSPA */
    1221     { }
    1222     };
    1223    
    1224     diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    1225     index 6d6108b..fe12737 100644
    1226     --- a/drivers/usb/storage/unusual_devs.h
    1227     +++ b/drivers/usb/storage/unusual_devs.h
    1228     @@ -86,6 +86,14 @@ UNUSUAL_DEV( 0x03f0, 0x0307, 0x0001, 0x0001,
    1229     US_SC_8070, US_PR_USBAT, init_usbat_cd, 0),
    1230     #endif
    1231    
    1232     +/* Reported by Grant Grundler <grundler@parisc-linux.org>
    1233     + * HP r707 camera in "Disk" mode with 2.00.23 or 2.00.24 firmware.
    1234     + */
    1235     +UNUSUAL_DEV( 0x03f0, 0x4002, 0x0001, 0x0001,
    1236     + "HP",
    1237     + "PhotoSmart R707",
    1238     + US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_FIX_CAPACITY),
    1239     +
    1240     /* Reported by Sebastian Kapfer <sebastian_kapfer@gmx.net>
    1241     * and Olaf Hering <olh@suse.de> (different bcd's, same vendor/product)
    1242     * for USB floppies that need the SINGLE_LUN enforcement.
    1243     diff --git a/fs/eventpoll.c b/fs/eventpoll.c
    1244     index 34f68f3..0a98389 100644
    1245     --- a/fs/eventpoll.c
    1246     +++ b/fs/eventpoll.c
    1247     @@ -353,7 +353,7 @@ static void ep_poll_safewake(struct poll_safewake *psw, wait_queue_head_t *wq)
    1248     spin_unlock_irqrestore(&psw->lock, flags);
    1249    
    1250     /* Do really wake up now */
    1251     - wake_up(wq);
    1252     + wake_up_nested(wq, 1 + wake_nests);
    1253    
    1254     /* Remove the current task from the list */
    1255     spin_lock_irqsave(&psw->lock, flags);
    1256     diff --git a/fs/ncpfs/mmap.c b/fs/ncpfs/mmap.c
    1257     index a94473d..5d8dcb9 100644
    1258     --- a/fs/ncpfs/mmap.c
    1259     +++ b/fs/ncpfs/mmap.c
    1260     @@ -50,10 +50,6 @@ static int ncp_file_mmap_fault(struct vm_area_struct *area,
    1261     pos = vmf->pgoff << PAGE_SHIFT;
    1262    
    1263     count = PAGE_SIZE;
    1264     - if ((unsigned long)vmf->virtual_address + PAGE_SIZE > area->vm_end) {
    1265     - WARN_ON(1); /* shouldn't happen? */
    1266     - count = area->vm_end - (unsigned long)vmf->virtual_address;
    1267     - }
    1268     /* what we can read in one go */
    1269     bufsize = NCP_SERVER(inode)->buffer_size;
    1270    
    1271     diff --git a/fs/splice.c b/fs/splice.c
    1272     index 6bdcb61..36fdc61 100644
    1273     --- a/fs/splice.c
    1274     +++ b/fs/splice.c
    1275     @@ -1184,6 +1184,9 @@ static int copy_from_user_mmap_sem(void *dst, const void __user *src, size_t n)
    1276     {
    1277     int partial;
    1278    
    1279     + if (!access_ok(VERIFY_READ, src, n))
    1280     + return -EFAULT;
    1281     +
    1282     pagefault_disable();
    1283     partial = __copy_from_user_inatomic(dst, src, n);
    1284     pagefault_enable();
    1285     @@ -1392,6 +1395,11 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
    1286     break;
    1287     }
    1288    
    1289     + if (unlikely(!access_ok(VERIFY_WRITE, base, len))) {
    1290     + error = -EFAULT;
    1291     + break;
    1292     + }
    1293     +
    1294     sd.len = 0;
    1295     sd.total_len = len;
    1296     sd.flags = flags;
    1297     diff --git a/include/linux/dmi.h b/include/linux/dmi.h
    1298     index 5b42a65..b1251b2 100644
    1299     --- a/include/linux/dmi.h
    1300     +++ b/include/linux/dmi.h
    1301     @@ -79,7 +79,6 @@ extern void dmi_scan_machine(void);
    1302     extern int dmi_get_year(int field);
    1303     extern int dmi_name_in_vendors(const char *str);
    1304     extern int dmi_available;
    1305     -extern char *dmi_get_slot(int slot);
    1306    
    1307     #else
    1308    
    1309     @@ -90,7 +89,6 @@ static inline const struct dmi_device * dmi_find_device(int type, const char *na
    1310     static inline int dmi_get_year(int year) { return 0; }
    1311     static inline int dmi_name_in_vendors(const char *s) { return 0; }
    1312     #define dmi_available 0
    1313     -static inline char *dmi_get_slot(int slot) { return NULL; }
    1314    
    1315     #endif
    1316    
    1317     diff --git a/include/linux/wait.h b/include/linux/wait.h
    1318     index 0e68628..8eb6420 100644
    1319     --- a/include/linux/wait.h
    1320     +++ b/include/linux/wait.h
    1321     @@ -161,6 +161,22 @@ wait_queue_head_t *FASTCALL(bit_waitqueue(void *, int));
    1322     #define wake_up_locked(x) __wake_up_locked((x), TASK_UNINTERRUPTIBLE | TASK_INTERRUPTIBLE)
    1323     #define wake_up_interruptible_sync(x) __wake_up_sync((x),TASK_INTERRUPTIBLE, 1)
    1324    
    1325     +#ifdef CONFIG_DEBUG_LOCK_ALLOC
    1326     +/*
    1327     + * macro to avoid include hell
    1328     + */
    1329     +#define wake_up_nested(x, s) \
    1330     +do { \
    1331     + unsigned long flags; \
    1332     + \
    1333     + spin_lock_irqsave_nested(&(x)->lock, flags, (s)); \
    1334     + wake_up_locked(x); \
    1335     + spin_unlock_irqrestore(&(x)->lock, flags); \
    1336     +} while (0)
    1337     +#else
    1338     +#define wake_up_nested(x, s) wake_up(x)
    1339     +#endif
    1340     +
    1341     #define __wait_event(wq, condition) \
    1342     do { \
    1343     DEFINE_WAIT(__wait); \
    1344     diff --git a/kernel/relay.c b/kernel/relay.c
    1345     index 61134eb..7c03733 100644
    1346     --- a/kernel/relay.c
    1347     +++ b/kernel/relay.c
    1348     @@ -92,6 +92,7 @@ static int relay_mmap_buf(struct rchan_buf *buf, struct vm_area_struct *vma)
    1349     return -EINVAL;
    1350    
    1351     vma->vm_ops = &relay_file_mmap_ops;
    1352     + vma->vm_flags |= VM_DONTEXPAND;
    1353     vma->vm_private_data = buf;
    1354     buf->chan->cb->buf_mapped(buf, filp);
    1355    
    1356     diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
    1357     index da7c061..2288ad8 100644
    1358     --- a/kernel/sched_fair.c
    1359     +++ b/kernel/sched_fair.c
    1360     @@ -511,7 +511,7 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial)
    1361    
    1362     if (!initial) {
    1363     /* sleeps upto a single latency don't count. */
    1364     - if (sched_feat(NEW_FAIR_SLEEPERS) && entity_is_task(se))
    1365     + if (sched_feat(NEW_FAIR_SLEEPERS))
    1366     vruntime -= sysctl_sched_latency;
    1367    
    1368     /* ensure we never gain time by being placed backwards. */
    1369     @@ -867,7 +867,11 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p)
    1370     }
    1371    
    1372     gran = sysctl_sched_wakeup_granularity;
    1373     - if (unlikely(se->load.weight != NICE_0_LOAD))
    1374     + /*
    1375     + * More easily preempt - nice tasks, while not making
    1376     + * it harder for + nice tasks.
    1377     + */
    1378     + if (unlikely(se->load.weight > NICE_0_LOAD))
    1379     gran = calc_delta_fair(gran, &se->load);
    1380    
    1381     if (pse->vruntime + gran < se->vruntime)
    1382     diff --git a/mm/filemap.c b/mm/filemap.c
    1383     index f4d0cde..69430d2 100644
    1384     --- a/mm/filemap.c
    1385     +++ b/mm/filemap.c
    1386     @@ -1733,7 +1733,11 @@ static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
    1387     const struct iovec *iov = i->iov;
    1388     size_t base = i->iov_offset;
    1389    
    1390     - while (bytes) {
    1391     + /*
    1392     + * The !iov->iov_len check ensures we skip over unlikely
    1393     + * zero-length segments.
    1394     + */
    1395     + while (bytes || !iov->iov_len) {
    1396     int copy = min(bytes, iov->iov_len - base);
    1397    
    1398     bytes -= copy;
    1399     @@ -2251,6 +2255,7 @@ again:
    1400    
    1401     cond_resched();
    1402    
    1403     + iov_iter_advance(i, copied);
    1404     if (unlikely(copied == 0)) {
    1405     /*
    1406     * If we were unable to copy any data at all, we must
    1407     @@ -2264,7 +2269,6 @@ again:
    1408     iov_iter_single_seg_count(i));
    1409     goto again;
    1410     }
    1411     - iov_iter_advance(i, copied);
    1412     pos += copied;
    1413     written += copied;
    1414    
    1415     diff --git a/mm/fremap.c b/mm/fremap.c
    1416     index 14bd3bf..69a37c2 100644
    1417     --- a/mm/fremap.c
    1418     +++ b/mm/fremap.c
    1419     @@ -190,10 +190,13 @@ asmlinkage long sys_remap_file_pages(unsigned long start, unsigned long size,
    1420     */
    1421     if (mapping_cap_account_dirty(mapping)) {
    1422     unsigned long addr;
    1423     + struct file *file = vma->vm_file;
    1424    
    1425     flags &= MAP_NONBLOCK;
    1426     - addr = mmap_region(vma->vm_file, start, size,
    1427     + get_file(file);
    1428     + addr = mmap_region(file, start, size,
    1429     flags, vma->vm_flags, pgoff, 1);
    1430     + fput(file);
    1431     if (IS_ERR_VALUE(addr)) {
    1432     err = addr;
    1433     } else {
    1434     diff --git a/mm/mmap.c b/mm/mmap.c
    1435     index 15678aa..555b3e7 100644
    1436     --- a/mm/mmap.c
    1437     +++ b/mm/mmap.c
    1438     @@ -2215,7 +2215,7 @@ int install_special_mapping(struct mm_struct *mm,
    1439     vma->vm_start = addr;
    1440     vma->vm_end = addr + len;
    1441    
    1442     - vma->vm_flags = vm_flags | mm->def_flags;
    1443     + vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
    1444     vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
    1445    
    1446     vma->vm_ops = &special_mapping_vmops;
    1447     diff --git a/mm/slab.c b/mm/slab.c
    1448     index b03b2e4..ff31261 100644
    1449     --- a/mm/slab.c
    1450     +++ b/mm/slab.c
    1451     @@ -304,11 +304,11 @@ struct kmem_list3 {
    1452     /*
    1453     * Need this for bootstrapping a per node allocator.
    1454     */
    1455     -#define NUM_INIT_LISTS (2 * MAX_NUMNODES + 1)
    1456     +#define NUM_INIT_LISTS (3 * MAX_NUMNODES)
    1457     struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
    1458     #define CACHE_CACHE 0
    1459     -#define SIZE_AC 1
    1460     -#define SIZE_L3 (1 + MAX_NUMNODES)
    1461     +#define SIZE_AC MAX_NUMNODES
    1462     +#define SIZE_L3 (2 * MAX_NUMNODES)
    1463    
    1464     static int drain_freelist(struct kmem_cache *cache,
    1465     struct kmem_list3 *l3, int tofree);
    1466     @@ -1410,6 +1410,22 @@ static void init_list(struct kmem_cache *cachep, struct kmem_list3 *list,
    1467     }
    1468    
    1469     /*
    1470     + * For setting up all the kmem_list3s for cache whose buffer_size is same as
    1471     + * size of kmem_list3.
    1472     + */
    1473     +static void __init set_up_list3s(struct kmem_cache *cachep, int index)
    1474     +{
    1475     + int node;
    1476     +
    1477     + for_each_online_node(node) {
    1478     + cachep->nodelists[node] = &initkmem_list3[index + node];
    1479     + cachep->nodelists[node]->next_reap = jiffies +
    1480     + REAPTIMEOUT_LIST3 +
    1481     + ((unsigned long)cachep) % REAPTIMEOUT_LIST3;
    1482     + }
    1483     +}
    1484     +
    1485     +/*
    1486     * Initialisation. Called after the page allocator have been initialised and
    1487     * before smp_init().
    1488     */
    1489     @@ -1432,6 +1448,7 @@ void __init kmem_cache_init(void)
    1490     if (i < MAX_NUMNODES)
    1491     cache_cache.nodelists[i] = NULL;
    1492     }
    1493     + set_up_list3s(&cache_cache, CACHE_CACHE);
    1494    
    1495     /*
    1496     * Fragmentation resistance on low memory - only use bigger
    1497     @@ -1587,10 +1604,9 @@ void __init kmem_cache_init(void)
    1498     {
    1499     int nid;
    1500    
    1501     - /* Replace the static kmem_list3 structures for the boot cpu */
    1502     - init_list(&cache_cache, &initkmem_list3[CACHE_CACHE], node);
    1503     -
    1504     for_each_online_node(nid) {
    1505     + init_list(&cache_cache, &initkmem_list3[CACHE_CACHE], nid);
    1506     +
    1507     init_list(malloc_sizes[INDEX_AC].cs_cachep,
    1508     &initkmem_list3[SIZE_AC + nid], nid);
    1509    
    1510     @@ -1960,22 +1976,6 @@ static void slab_destroy(struct kmem_cache *cachep, struct slab *slabp)
    1511     }
    1512     }
    1513    
    1514     -/*
    1515     - * For setting up all the kmem_list3s for cache whose buffer_size is same as
    1516     - * size of kmem_list3.
    1517     - */
    1518     -static void __init set_up_list3s(struct kmem_cache *cachep, int index)
    1519     -{
    1520     - int node;
    1521     -
    1522     - for_each_online_node(node) {
    1523     - cachep->nodelists[node] = &initkmem_list3[index + node];
    1524     - cachep->nodelists[node]->next_reap = jiffies +
    1525     - REAPTIMEOUT_LIST3 +
    1526     - ((unsigned long)cachep) % REAPTIMEOUT_LIST3;
    1527     - }
    1528     -}
    1529     -
    1530     static void __kmem_cache_destroy(struct kmem_cache *cachep)
    1531     {
    1532     int i;
    1533     @@ -2099,7 +2099,7 @@ static int __init_refok setup_cpu_cache(struct kmem_cache *cachep)
    1534     g_cpucache_up = PARTIAL_L3;
    1535     } else {
    1536     int node;
    1537     - for_each_node_state(node, N_NORMAL_MEMORY) {
    1538     + for_each_online_node(node) {
    1539     cachep->nodelists[node] =
    1540     kmalloc_node(sizeof(struct kmem_list3),
    1541     GFP_KERNEL, node);
    1542     diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
    1543     index d802b5a..9ddf944 100644
    1544     --- a/scripts/mod/file2alias.c
    1545     +++ b/scripts/mod/file2alias.c
    1546     @@ -155,7 +155,7 @@ static void do_usb_entry_multi(struct usb_device_id *id, struct module *mod)
    1547     * Some modules (visor) have empty slots as placeholder for
    1548     * run-time specification that results in catch-all alias
    1549     */
    1550     - if (!(id->idVendor | id->bDeviceClass | id->bInterfaceClass))
    1551     + if (!(id->idVendor | id->idProduct | id->bDeviceClass | id->bInterfaceClass))
    1552     return;
    1553    
    1554     /* Convert numeric bcdDevice range into fnmatch-able pattern(s) */
    1555     diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
    1556     index f83b19d..4bf715d 100644
    1557     --- a/security/selinux/ss/services.c
    1558     +++ b/security/selinux/ss/services.c
    1559     @@ -1744,6 +1744,9 @@ int security_genfs_sid(const char *fstype,
    1560     struct ocontext *c;
    1561     int rc = 0, cmp = 0;
    1562    
    1563     + while (path[0] == '/' && path[1] == '/')
    1564     + path++;
    1565     +
    1566     POLICY_RDLOCK;
    1567    
    1568     for (genfs = policydb.genfs; genfs; genfs = genfs->next) {
    1569     diff --git a/sound/oss/via82cxxx_audio.c b/sound/oss/via82cxxx_audio.c
    1570     index 5d3c037..f95aa09 100644
    1571     --- a/sound/oss/via82cxxx_audio.c
    1572     +++ b/sound/oss/via82cxxx_audio.c
    1573     @@ -2104,6 +2104,7 @@ static struct page * via_mm_nopage (struct vm_area_struct * vma,
    1574     {
    1575     struct via_info *card = vma->vm_private_data;
    1576     struct via_channel *chan = &card->ch_out;
    1577     + unsigned long max_bufs;
    1578     struct page *dmapage;
    1579     unsigned long pgoff;
    1580     int rd, wr;
    1581     @@ -2127,14 +2128,11 @@ static struct page * via_mm_nopage (struct vm_area_struct * vma,
    1582     rd = card->ch_in.is_mapped;
    1583     wr = card->ch_out.is_mapped;
    1584    
    1585     -#ifndef VIA_NDEBUG
    1586     - {
    1587     - unsigned long max_bufs = chan->frag_number;
    1588     - if (rd && wr) max_bufs *= 2;
    1589     - /* via_dsp_mmap() should ensure this */
    1590     - assert (pgoff < max_bufs);
    1591     - }
    1592     -#endif
    1593     + max_bufs = chan->frag_number;
    1594     + if (rd && wr)
    1595     + max_bufs *= 2;
    1596     + if (pgoff >= max_bufs)
    1597     + return NOPAGE_SIGBUS;
    1598    
    1599     /* if full-duplex (read+write) and we have two sets of bufs,
    1600     * then the playback buffers come first, sez soundcard.c */
    1601     diff --git a/sound/usb/usx2y/usX2Yhwdep.c b/sound/usb/usx2y/usX2Yhwdep.c
    1602     index b76b3dd..e617d7e 100644
    1603     --- a/sound/usb/usx2y/usX2Yhwdep.c
    1604     +++ b/sound/usb/usx2y/usX2Yhwdep.c
    1605     @@ -88,7 +88,7 @@ static int snd_us428ctls_mmap(struct snd_hwdep * hw, struct file *filp, struct v
    1606     us428->us428ctls_sharedmem->CtlSnapShotLast = -2;
    1607     }
    1608     area->vm_ops = &us428ctls_vm_ops;
    1609     - area->vm_flags |= VM_RESERVED;
    1610     + area->vm_flags |= VM_RESERVED | VM_DONTEXPAND;
    1611     area->vm_private_data = hw->private_data;
    1612     return 0;
    1613     }
    1614     diff --git a/sound/usb/usx2y/usx2yhwdeppcm.c b/sound/usb/usx2y/usx2yhwdeppcm.c
    1615     index a5e7bcd..6e70520 100644
    1616     --- a/sound/usb/usx2y/usx2yhwdeppcm.c
    1617     +++ b/sound/usb/usx2y/usx2yhwdeppcm.c
    1618     @@ -728,7 +728,7 @@ static int snd_usX2Y_hwdep_pcm_mmap(struct snd_hwdep * hw, struct file *filp, st
    1619     return -ENODEV;
    1620     }
    1621     area->vm_ops = &snd_usX2Y_hwdep_pcm_vm_ops;
    1622     - area->vm_flags |= VM_RESERVED;
    1623     + area->vm_flags |= VM_RESERVED | VM_DONTEXPAND;
    1624     area->vm_private_data = hw->private_data;
    1625     return 0;
    1626     }