Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-mcore/patches-2.6.36-r2/0100-2.6.36.1-all-fixes.patch

    Annotation of /trunk/kernel26-mcore/patches-2.6.36-r2/0100-2.6.36.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1218 - (hide annotations) (download)
    Sat Dec 4 13:29:50 2010 UTC (13 years, 5 months ago) by niro
    File size: 65138 byte(s) 
    2.6.36-mcore-r2: updated to linux-2.6.36.1
    1 niro 1218 diff --git a/arch/arm/include/asm/kgdb.h b/arch/arm/include/asm/kgdb.h
    2     index 0826599..48066ce 100644
    3     --- a/arch/arm/include/asm/kgdb.h
    4     +++ b/arch/arm/include/asm/kgdb.h
    5     @@ -70,7 +70,8 @@ extern int kgdb_fault_expected;
    6     #define _GP_REGS 16
    7     #define _FP_REGS 8
    8     #define _EXTRA_REGS 2
    9     -#define DBG_MAX_REG_NUM (_GP_REGS + (_FP_REGS * 3) + _EXTRA_REGS)
    10     +#define GDB_MAX_REGS (_GP_REGS + (_FP_REGS * 3) + _EXTRA_REGS)
    11     +#define DBG_MAX_REG_NUM (_GP_REGS + _FP_REGS + _EXTRA_REGS)
    12    
    13     #define KGDB_MAX_NO_CPUS 1
    14     #define BUFMAX 400
    15     @@ -93,7 +94,7 @@ extern int kgdb_fault_expected;
    16     #define _SPT 13
    17     #define _LR 14
    18     #define _PC 15
    19     -#define _CPSR (DBG_MAX_REG_NUM - 1)
    20     +#define _CPSR (GDB_MAX_REGS - 1)
    21    
    22     /*
    23     * So that we can denote the end of a frame for tracing,
    24     diff --git a/arch/arm/kernel/kgdb.c b/arch/arm/kernel/kgdb.c
    25     index d6e8b4d..778c2f7 100644
    26     --- a/arch/arm/kernel/kgdb.c
    27     +++ b/arch/arm/kernel/kgdb.c
    28     @@ -79,7 +79,7 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
    29     return;
    30    
    31     /* Initialize to zero */
    32     - for (regno = 0; regno < DBG_MAX_REG_NUM; regno++)
    33     + for (regno = 0; regno < GDB_MAX_REGS; regno++)
    34     gdb_regs[regno] = 0;
    35    
    36     /* Otherwise, we have only some registers from switch_to() */
    37     diff --git a/arch/arm/mach-cns3xxx/include/mach/debug-macro.S b/arch/arm/mach-cns3xxx/include/mach/debug-macro.S
    38     index d16ce7e..9b50442 100644
    39     --- a/arch/arm/mach-cns3xxx/include/mach/debug-macro.S
    40     +++ b/arch/arm/mach-cns3xxx/include/mach/debug-macro.S
    41     @@ -10,7 +10,7 @@
    42     * published by the Free Software Foundation.
    43     */
    44    
    45     - .macro addruart,rx
    46     + .macro addruart,rx,rtmp
    47     mrc p15, 0, \rx, c1, c0
    48     tst \rx, #1 @ MMU enabled?
    49     moveq \rx, #0x10000000
    50     diff --git a/arch/powerpc/kernel/ppc970-pmu.c b/arch/powerpc/kernel/ppc970-pmu.c
    51     index 8eff48e..3fee685 100644
    52     --- a/arch/powerpc/kernel/ppc970-pmu.c
    53     +++ b/arch/powerpc/kernel/ppc970-pmu.c
    54     @@ -169,9 +169,11 @@ static int p970_marked_instr_event(u64 event)
    55     switch (unit) {
    56     case PM_VPU:
    57     mask = 0x4c; /* byte 0 bits 2,3,6 */
    58     + break;
    59     case PM_LSU0:
    60     /* byte 2 bits 0,2,3,4,6; all of byte 1 */
    61     mask = 0x085dff00;
    62     + break;
    63     case PM_LSU1L:
    64     mask = 0x50 << 24; /* byte 3 bits 4,6 */
    65     break;
    66     diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
    67     index 3f76523..f857bd3 100644
    68     --- a/arch/x86/include/asm/cpufeature.h
    69     +++ b/arch/x86/include/asm/cpufeature.h
    70     @@ -152,7 +152,7 @@
    71     #define X86_FEATURE_3DNOWPREFETCH (6*32+ 8) /* 3DNow prefetch instructions */
    72     #define X86_FEATURE_OSVW (6*32+ 9) /* OS Visible Workaround */
    73     #define X86_FEATURE_IBS (6*32+10) /* Instruction Based Sampling */
    74     -#define X86_FEATURE_SSE5 (6*32+11) /* SSE-5 */
    75     +#define X86_FEATURE_XOP (6*32+11) /* extended AVX instructions */
    76     #define X86_FEATURE_SKINIT (6*32+12) /* SKINIT/STGI instructions */
    77     #define X86_FEATURE_WDT (6*32+13) /* Watchdog timer */
    78     #define X86_FEATURE_NODEID_MSR (6*32+19) /* NodeId MSR */
    79     diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
    80     index 30a3e97..6a45ec4 100644
    81     --- a/arch/x86/include/asm/io.h
    82     +++ b/arch/x86/include/asm/io.h
    83     @@ -206,6 +206,7 @@ static inline void __iomem *ioremap(resource_size_t offset, unsigned long size)
    84    
    85     extern void iounmap(volatile void __iomem *addr);
    86    
    87     +extern void set_iounmap_nonlazy(void);
    88    
    89     #ifdef __KERNEL__
    90    
    91     diff --git a/arch/x86/include/asm/mrst.h b/arch/x86/include/asm/mrst.h
    92     index 1635074..33fc296 100644
    93     --- a/arch/x86/include/asm/mrst.h
    94     +++ b/arch/x86/include/asm/mrst.h
    95     @@ -26,7 +26,7 @@ enum mrst_cpu_type {
    96     };
    97    
    98     extern enum mrst_cpu_type __mrst_cpu_chip;
    99     -static enum mrst_cpu_type mrst_identify_cpu(void)
    100     +static inline enum mrst_cpu_type mrst_identify_cpu(void)
    101     {
    102     return __mrst_cpu_chip;
    103     }
    104     diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
    105     index 4cfc908..4c2f63c 100644
    106     --- a/arch/x86/include/asm/smp.h
    107     +++ b/arch/x86/include/asm/smp.h
    108     @@ -50,7 +50,7 @@ struct smp_ops {
    109     void (*smp_prepare_cpus)(unsigned max_cpus);
    110     void (*smp_cpus_done)(unsigned max_cpus);
    111    
    112     - void (*smp_send_stop)(void);
    113     + void (*stop_other_cpus)(int wait);
    114     void (*smp_send_reschedule)(int cpu);
    115    
    116     int (*cpu_up)(unsigned cpu);
    117     @@ -73,7 +73,12 @@ extern struct smp_ops smp_ops;
    118    
    119     static inline void smp_send_stop(void)
    120     {
    121     - smp_ops.smp_send_stop();
    122     + smp_ops.stop_other_cpus(0);
    123     +}
    124     +
    125     +static inline void stop_other_cpus(void)
    126     +{
    127     + smp_ops.stop_other_cpus(1);
    128     }
    129    
    130     static inline void smp_prepare_boot_cpu(void)
    131     diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
    132     index 5c5b8f3..ad1515d 100644
    133     --- a/arch/x86/kernel/apic/io_apic.c
    134     +++ b/arch/x86/kernel/apic/io_apic.c
    135     @@ -1397,6 +1397,7 @@ int setup_ioapic_entry(int apic_id, int irq,
    136     irte.dlvry_mode = apic->irq_delivery_mode;
    137     irte.vector = vector;
    138     irte.dest_id = IRTE_DEST(destination);
    139     + irte.redir_hint = 1;
    140    
    141     /* Set source-id of interrupt request */
    142     set_ioapic_sid(&irte, apic_id);
    143     @@ -3348,6 +3349,7 @@ static int msi_compose_msg(struct pci_dev *pdev, unsigned int irq,
    144     irte.dlvry_mode = apic->irq_delivery_mode;
    145     irte.vector = cfg->vector;
    146     irte.dest_id = IRTE_DEST(dest);
    147     + irte.redir_hint = 1;
    148    
    149     /* Set source-id of interrupt request */
    150     if (pdev)
    151     diff --git a/arch/x86/kernel/cpu/mtrr/cleanup.c b/arch/x86/kernel/cpu/mtrr/cleanup.c
    152     index c5f59d0..ac140c7 100644
    153     --- a/arch/x86/kernel/cpu/mtrr/cleanup.c
    154     +++ b/arch/x86/kernel/cpu/mtrr/cleanup.c
    155     @@ -827,7 +827,7 @@ int __init amd_special_default_mtrr(void)
    156    
    157     if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD)
    158     return 0;
    159     - if (boot_cpu_data.x86 < 0xf || boot_cpu_data.x86 > 0x11)
    160     + if (boot_cpu_data.x86 < 0xf)
    161     return 0;
    162     /* In case some hypervisor doesn't pass SYSCFG through: */
    163     if (rdmsr_safe(MSR_K8_SYSCFG, &l, &h) < 0)
    164     diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
    165     index c2897b7..46d5844 100644
    166     --- a/arch/x86/kernel/cpu/perf_event_amd.c
    167     +++ b/arch/x86/kernel/cpu/perf_event_amd.c
    168     @@ -52,7 +52,7 @@ static __initconst const u64 amd_hw_cache_event_ids
    169     [ C(DTLB) ] = {
    170     [ C(OP_READ) ] = {
    171     [ C(RESULT_ACCESS) ] = 0x0040, /* Data Cache Accesses */
    172     - [ C(RESULT_MISS) ] = 0x0046, /* L1 DTLB and L2 DLTB Miss */
    173     + [ C(RESULT_MISS) ] = 0x0746, /* L1_DTLB_AND_L2_DLTB_MISS.ALL */
    174     },
    175     [ C(OP_WRITE) ] = {
    176     [ C(RESULT_ACCESS) ] = 0,
    177     @@ -66,7 +66,7 @@ static __initconst const u64 amd_hw_cache_event_ids
    178     [ C(ITLB) ] = {
    179     [ C(OP_READ) ] = {
    180     [ C(RESULT_ACCESS) ] = 0x0080, /* Instruction fecthes */
    181     - [ C(RESULT_MISS) ] = 0x0085, /* Instr. fetch ITLB misses */
    182     + [ C(RESULT_MISS) ] = 0x0385, /* L1_ITLB_AND_L2_ITLB_MISS.ALL */
    183     },
    184     [ C(OP_WRITE) ] = {
    185     [ C(RESULT_ACCESS) ] = -1,
    186     diff --git a/arch/x86/kernel/crash_dump_64.c b/arch/x86/kernel/crash_dump_64.c
    187     index 045b36c..9948288 100644
    188     --- a/arch/x86/kernel/crash_dump_64.c
    189     +++ b/arch/x86/kernel/crash_dump_64.c
    190     @@ -34,7 +34,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
    191     if (!csize)
    192     return 0;
    193    
    194     - vaddr = ioremap(pfn << PAGE_SHIFT, PAGE_SIZE);
    195     + vaddr = ioremap_cache(pfn << PAGE_SHIFT, PAGE_SIZE);
    196     if (!vaddr)
    197     return -ENOMEM;
    198    
    199     @@ -46,6 +46,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
    200     } else
    201     memcpy(buf, vaddr + offset, csize);
    202    
    203     + set_iounmap_nonlazy();
    204     iounmap(vaddr);
    205     return csize;
    206     }
    207     diff --git a/arch/x86/kernel/olpc.c b/arch/x86/kernel/olpc.c
    208     index 0e0cdde..a2bd899 100644
    209     --- a/arch/x86/kernel/olpc.c
    210     +++ b/arch/x86/kernel/olpc.c
    211     @@ -114,6 +114,7 @@ int olpc_ec_cmd(unsigned char cmd, unsigned char *inbuf, size_t inlen,
    212     unsigned long flags;
    213     int ret = -EIO;
    214     int i;
    215     + int restarts = 0;
    216    
    217     spin_lock_irqsave(&ec_lock, flags);
    218    
    219     @@ -169,7 +170,9 @@ restart:
    220     if (wait_on_obf(0x6c, 1)) {
    221     printk(KERN_ERR "olpc-ec: timeout waiting for"
    222     " EC to provide data!\n");
    223     - goto restart;
    224     + if (restarts++ < 10)
    225     + goto restart;
    226     + goto err;
    227     }
    228     outbuf[i] = inb(0x68);
    229     pr_devel("olpc-ec: received 0x%x\n", outbuf[i]);
    230     diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
    231     index e3af342..76a0d71 100644
    232     --- a/arch/x86/kernel/reboot.c
    233     +++ b/arch/x86/kernel/reboot.c
    234     @@ -641,7 +641,7 @@ void native_machine_shutdown(void)
    235     /* O.K Now that I'm on the appropriate processor,
    236     * stop all of the others.
    237     */
    238     - smp_send_stop();
    239     + stop_other_cpus();
    240     #endif
    241    
    242     lapic_shutdown();
    243     diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c
    244     index d801210..513deac 100644
    245     --- a/arch/x86/kernel/smp.c
    246     +++ b/arch/x86/kernel/smp.c
    247     @@ -159,10 +159,10 @@ asmlinkage void smp_reboot_interrupt(void)
    248     irq_exit();
    249     }
    250    
    251     -static void native_smp_send_stop(void)
    252     +static void native_stop_other_cpus(int wait)
    253     {
    254     unsigned long flags;
    255     - unsigned long wait;
    256     + unsigned long timeout;
    257    
    258     if (reboot_force)
    259     return;
    260     @@ -179,9 +179,12 @@ static void native_smp_send_stop(void)
    261     if (num_online_cpus() > 1) {
    262     apic->send_IPI_allbutself(REBOOT_VECTOR);
    263    
    264     - /* Don't wait longer than a second */
    265     - wait = USEC_PER_SEC;
    266     - while (num_online_cpus() > 1 && wait--)
    267     + /*
    268     + * Don't wait longer than a second if the caller
    269     + * didn't ask us to wait.
    270     + */
    271     + timeout = USEC_PER_SEC;
    272     + while (num_online_cpus() > 1 && (wait || timeout--))
    273     udelay(1);
    274     }
    275    
    276     @@ -227,7 +230,7 @@ struct smp_ops smp_ops = {
    277     .smp_prepare_cpus = native_smp_prepare_cpus,
    278     .smp_cpus_done = native_smp_cpus_done,
    279    
    280     - .smp_send_stop = native_smp_send_stop,
    281     + .stop_other_cpus = native_stop_other_cpus,
    282     .smp_send_reschedule = native_smp_send_reschedule,
    283    
    284     .cpu_up = native_cpu_up,
    285     diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
    286     index 60788de..9f4edeb 100644
    287     --- a/arch/x86/kernel/traps.c
    288     +++ b/arch/x86/kernel/traps.c
    289     @@ -575,6 +575,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
    290     if (regs->flags & X86_VM_MASK) {
    291     handle_vm86_trap((struct kernel_vm86_regs *) regs,
    292     error_code, 1);
    293     + preempt_conditional_cli(regs);
    294     return;
    295     }
    296    
    297     diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
    298     index 5ffb562..61fb985 100644
    299     --- a/arch/x86/kernel/vm86_32.c
    300     +++ b/arch/x86/kernel/vm86_32.c
    301     @@ -551,8 +551,14 @@ cannot_handle:
    302     int handle_vm86_trap(struct kernel_vm86_regs *regs, long error_code, int trapno)
    303     {
    304     if (VMPI.is_vm86pus) {
    305     - if ((trapno == 3) || (trapno == 1))
    306     - return_to_32bit(regs, VM86_TRAP + (trapno << 8));
    307     + if ((trapno == 3) || (trapno == 1)) {
    308     + KVM86->regs32->ax = VM86_TRAP + (trapno << 8);
    309     + /* setting this flag forces the code in entry_32.S to
    310     + call save_v86_state() and change the stack pointer
    311     + to KVM86->regs32 */
    312     + set_thread_flag(TIF_IRET);
    313     + return 0;
    314     + }
    315     do_int(regs, trapno, (unsigned char __user *) (regs->pt.ss << 4), SP(regs));
    316     return 0;
    317     }
    318     diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
    319     index 8a3f9f6..2a02a65 100644
    320     --- a/arch/x86/kvm/svm.c
    321     +++ b/arch/x86/kvm/svm.c
    322     @@ -88,6 +88,14 @@ struct nested_state {
    323     /* A VMEXIT is required but not yet emulated */
    324     bool exit_required;
    325    
    326     + /*
    327     + * If we vmexit during an instruction emulation we need this to restore
    328     + * the l1 guest rip after the emulation
    329     + */
    330     + unsigned long vmexit_rip;
    331     + unsigned long vmexit_rsp;
    332     + unsigned long vmexit_rax;
    333     +
    334     /* cache for intercepts of the guest */
    335     u16 intercept_cr_read;
    336     u16 intercept_cr_write;
    337     @@ -1206,8 +1214,12 @@ static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
    338     if (old == new) {
    339     /* cr0 write with ts and mp unchanged */
    340     svm->vmcb->control.exit_code = SVM_EXIT_CR0_SEL_WRITE;
    341     - if (nested_svm_exit_handled(svm) == NESTED_EXIT_DONE)
    342     + if (nested_svm_exit_handled(svm) == NESTED_EXIT_DONE) {
    343     + svm->nested.vmexit_rip = kvm_rip_read(vcpu);
    344     + svm->nested.vmexit_rsp = kvm_register_read(vcpu, VCPU_REGS_RSP);
    345     + svm->nested.vmexit_rax = kvm_register_read(vcpu, VCPU_REGS_RAX);
    346     return;
    347     + }
    348     }
    349     }
    350    
    351     @@ -2399,6 +2411,23 @@ static int emulate_on_interception(struct vcpu_svm *svm)
    352     return emulate_instruction(&svm->vcpu, 0, 0, 0) == EMULATE_DONE;
    353     }
    354    
    355     +static int cr0_write_interception(struct vcpu_svm *svm)
    356     +{
    357     + struct kvm_vcpu *vcpu = &svm->vcpu;
    358     + int r;
    359     +
    360     + r = emulate_instruction(&svm->vcpu, 0, 0, 0);
    361     +
    362     + if (svm->nested.vmexit_rip) {
    363     + kvm_register_write(vcpu, VCPU_REGS_RIP, svm->nested.vmexit_rip);
    364     + kvm_register_write(vcpu, VCPU_REGS_RSP, svm->nested.vmexit_rsp);
    365     + kvm_register_write(vcpu, VCPU_REGS_RAX, svm->nested.vmexit_rax);
    366     + svm->nested.vmexit_rip = 0;
    367     + }
    368     +
    369     + return r == EMULATE_DONE;
    370     +}
    371     +
    372     static int cr8_write_interception(struct vcpu_svm *svm)
    373     {
    374     struct kvm_run *kvm_run = svm->vcpu.run;
    375     @@ -2672,7 +2701,7 @@ static int (*svm_exit_handlers[])(struct vcpu_svm *svm) = {
    376     [SVM_EXIT_READ_CR4] = emulate_on_interception,
    377     [SVM_EXIT_READ_CR8] = emulate_on_interception,
    378     [SVM_EXIT_CR0_SEL_WRITE] = emulate_on_interception,
    379     - [SVM_EXIT_WRITE_CR0] = emulate_on_interception,
    380     + [SVM_EXIT_WRITE_CR0] = cr0_write_interception,
    381     [SVM_EXIT_WRITE_CR3] = emulate_on_interception,
    382     [SVM_EXIT_WRITE_CR4] = emulate_on_interception,
    383     [SVM_EXIT_WRITE_CR8] = cr8_write_interception,
    384     @@ -3354,6 +3383,10 @@ static void svm_cpuid_update(struct kvm_vcpu *vcpu)
    385     static void svm_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
    386     {
    387     switch (func) {
    388     + case 0x80000001:
    389     + if (nested)
    390     + entry->ecx |= (1 << 2); /* Set SVM bit */
    391     + break;
    392     case 0x8000000A:
    393     entry->eax = 1; /* SVM revision 1 */
    394     entry->ebx = 8; /* Lets support 8 ASIDs in case we add proper
    395     diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    396     index 3a09c62..a4a427b 100644
    397     --- a/arch/x86/kvm/x86.c
    398     +++ b/arch/x86/kvm/x86.c
    399     @@ -1994,9 +1994,9 @@ static void do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
    400     0 /* Reserved, AES */ | F(XSAVE) | 0 /* OSXSAVE */ | F(AVX);
    401     /* cpuid 0x80000001.ecx */
    402     const u32 kvm_supported_word6_x86_features =
    403     - F(LAHF_LM) | F(CMP_LEGACY) | F(SVM) | 0 /* ExtApicSpace */ |
    404     + F(LAHF_LM) | F(CMP_LEGACY) | 0 /*SVM*/ | 0 /* ExtApicSpace */ |
    405     F(CR8_LEGACY) | F(ABM) | F(SSE4A) | F(MISALIGNSSE) |
    406     - F(3DNOWPREFETCH) | 0 /* OSVW */ | 0 /* IBS */ | F(SSE5) |
    407     + F(3DNOWPREFETCH) | 0 /* OSVW */ | 0 /* IBS */ | F(XOP) |
    408     0 /* SKINIT */ | 0 /* WDT */;
    409    
    410     /* all calls to cpuid_count() should be made on the same cpu */
    411     diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
    412     index 7d46c84..44f8086 100644
    413     --- a/arch/x86/xen/enlighten.c
    414     +++ b/arch/x86/xen/enlighten.c
    415     @@ -1018,7 +1018,7 @@ static void xen_reboot(int reason)
    416     struct sched_shutdown r = { .reason = reason };
    417    
    418     #ifdef CONFIG_SMP
    419     - smp_send_stop();
    420     + stop_other_cpus();
    421     #endif
    422    
    423     if (HYPERVISOR_sched_op(SCHEDOP_shutdown, &r))
    424     diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
    425     index 25f232b..f4d0100 100644
    426     --- a/arch/x86/xen/smp.c
    427     +++ b/arch/x86/xen/smp.c
    428     @@ -400,9 +400,9 @@ static void stop_self(void *v)
    429     BUG();
    430     }
    431    
    432     -static void xen_smp_send_stop(void)
    433     +static void xen_stop_other_cpus(int wait)
    434     {
    435     - smp_call_function(stop_self, NULL, 0);
    436     + smp_call_function(stop_self, NULL, wait);
    437     }
    438    
    439     static void xen_smp_send_reschedule(int cpu)
    440     @@ -470,7 +470,7 @@ static const struct smp_ops xen_smp_ops __initdata = {
    441     .cpu_disable = xen_cpu_disable,
    442     .play_dead = xen_play_dead,
    443    
    444     - .smp_send_stop = xen_smp_send_stop,
    445     + .stop_other_cpus = xen_stop_other_cpus,
    446     .smp_send_reschedule = xen_smp_send_reschedule,
    447    
    448     .send_call_func_ipi = xen_smp_send_call_function_ipi,
    449     diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
    450     index e5fdeeb..d1a0f5b 100644
    451     --- a/drivers/ata/ahci.h
    452     +++ b/drivers/ata/ahci.h
    453     @@ -72,6 +72,7 @@ enum {
    454     AHCI_CMD_RESET = (1 << 8),
    455     AHCI_CMD_CLR_BUSY = (1 << 10),
    456    
    457     + RX_FIS_PIO_SETUP = 0x20, /* offset of PIO Setup FIS data */
    458     RX_FIS_D2H_REG = 0x40, /* offset of D2H Register FIS data */
    459     RX_FIS_SDB = 0x58, /* offset of SDB FIS data */
    460     RX_FIS_UNK = 0x60, /* offset of Unknown FIS data */
    461     diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
    462     index 8eea309..137514d 100644
    463     --- a/drivers/ata/libahci.c
    464     +++ b/drivers/ata/libahci.c
    465     @@ -1830,12 +1830,24 @@ static unsigned int ahci_qc_issue(struct ata_queued_cmd *qc)
    466     static bool ahci_qc_fill_rtf(struct ata_queued_cmd *qc)
    467     {
    468     struct ahci_port_priv *pp = qc->ap->private_data;
    469     - u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
    470     + u8 *rx_fis = pp->rx_fis;
    471    
    472     if (pp->fbs_enabled)
    473     - d2h_fis += qc->dev->link->pmp * AHCI_RX_FIS_SZ;
    474     + rx_fis += qc->dev->link->pmp * AHCI_RX_FIS_SZ;
    475     +
    476     + /*
    477     + * After a successful execution of an ATA PIO data-in command,
    478     + * the device doesn't send D2H Reg FIS to update the TF and
    479     + * the host should take TF and E_Status from the preceding PIO
    480     + * Setup FIS.
    481     + */
    482     + if (qc->tf.protocol == ATA_PROT_PIO && qc->dma_dir == DMA_FROM_DEVICE &&
    483     + !(qc->flags & ATA_QCFLAG_FAILED)) {
    484     + ata_tf_from_fis(rx_fis + RX_FIS_PIO_SETUP, &qc->result_tf);
    485     + qc->result_tf.command = (rx_fis + RX_FIS_PIO_SETUP)[15];
    486     + } else
    487     + ata_tf_from_fis(rx_fis + RX_FIS_D2H_REG, &qc->result_tf);
    488    
    489     - ata_tf_from_fis(d2h_fis, &qc->result_tf);
    490     return true;
    491     }
    492    
    493     diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
    494     index 998833d..17361ba 100644
    495     --- a/drivers/bluetooth/hci_ldisc.c
    496     +++ b/drivers/bluetooth/hci_ldisc.c
    497     @@ -256,9 +256,16 @@ static int hci_uart_tty_open(struct tty_struct *tty)
    498    
    499     BT_DBG("tty %p", tty);
    500    
    501     + /* FIXME: This btw is bogus, nothing requires the old ldisc to clear
    502     + the pointer */
    503     if (hu)
    504     return -EEXIST;
    505    
    506     + /* Error if the tty has no write op instead of leaving an exploitable
    507     + hole */
    508     + if (tty->ops->write == NULL)
    509     + return -EOPNOTSUPP;
    510     +
    511     if (!(hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL))) {
    512     BT_ERR("Can't allocate control structure");
    513     return -ENFILE;
    514     diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
    515     index 9ecd6be..45f9fad 100644
    516     --- a/drivers/char/pcmcia/synclink_cs.c
    517     +++ b/drivers/char/pcmcia/synclink_cs.c
    518     @@ -4127,6 +4127,8 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
    519     if (cmd != SIOCWANDEV)
    520     return hdlc_ioctl(dev, ifr, cmd);
    521    
    522     + memset(&new_line, 0, size);
    523     +
    524     switch(ifr->ifr_settings.type) {
    525     case IF_GET_IFACE: /* return current sync_serial_settings */
    526    
    527     diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
    528     index c37ef64..cf88588 100644
    529     --- a/drivers/idle/intel_idle.c
    530     +++ b/drivers/idle/intel_idle.c
    531     @@ -276,7 +276,7 @@ static int intel_idle_probe(void)
    532    
    533     case 0x1C: /* 28 - Atom Processor */
    534     case 0x26: /* 38 - Lincroft Atom Processor */
    535     - lapic_timer_reliable_states = (1 << 2) | (1 << 1); /* C2, C1 */
    536     + lapic_timer_reliable_states = (1 << 1); /* C1 */
    537     cpuidle_state_table = atom_cstates;
    538     break;
    539     #ifdef FUTURE_USE
    540     diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
    541     index 1f59ee2..17bbacb 100644
    542     --- a/drivers/misc/sgi-xp/xpc_uv.c
    543     +++ b/drivers/misc/sgi-xp/xpc_uv.c
    544     @@ -417,6 +417,7 @@ xpc_process_activate_IRQ_rcvd_uv(void)
    545     static void
    546     xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
    547     struct xpc_activate_mq_msghdr_uv *msg_hdr,
    548     + int part_setup,
    549     int *wakeup_hb_checker)
    550     {
    551     unsigned long irq_flags;
    552     @@ -481,6 +482,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
    553     case XPC_ACTIVATE_MQ_MSG_CHCTL_CLOSEREQUEST_UV: {
    554     struct xpc_activate_mq_msg_chctl_closerequest_uv *msg;
    555    
    556     + if (!part_setup)
    557     + break;
    558     +
    559     msg = container_of(msg_hdr, struct
    560     xpc_activate_mq_msg_chctl_closerequest_uv,
    561     hdr);
    562     @@ -497,6 +501,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
    563     case XPC_ACTIVATE_MQ_MSG_CHCTL_CLOSEREPLY_UV: {
    564     struct xpc_activate_mq_msg_chctl_closereply_uv *msg;
    565    
    566     + if (!part_setup)
    567     + break;
    568     +
    569     msg = container_of(msg_hdr, struct
    570     xpc_activate_mq_msg_chctl_closereply_uv,
    571     hdr);
    572     @@ -511,6 +518,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
    573     case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENREQUEST_UV: {
    574     struct xpc_activate_mq_msg_chctl_openrequest_uv *msg;
    575    
    576     + if (!part_setup)
    577     + break;
    578     +
    579     msg = container_of(msg_hdr, struct
    580     xpc_activate_mq_msg_chctl_openrequest_uv,
    581     hdr);
    582     @@ -528,6 +538,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
    583     case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENREPLY_UV: {
    584     struct xpc_activate_mq_msg_chctl_openreply_uv *msg;
    585    
    586     + if (!part_setup)
    587     + break;
    588     +
    589     msg = container_of(msg_hdr, struct
    590     xpc_activate_mq_msg_chctl_openreply_uv, hdr);
    591     args = &part->remote_openclose_args[msg->ch_number];
    592     @@ -545,6 +558,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
    593     case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENCOMPLETE_UV: {
    594     struct xpc_activate_mq_msg_chctl_opencomplete_uv *msg;
    595    
    596     + if (!part_setup)
    597     + break;
    598     +
    599     msg = container_of(msg_hdr, struct
    600     xpc_activate_mq_msg_chctl_opencomplete_uv, hdr);
    601     spin_lock_irqsave(&part->chctl_lock, irq_flags);
    602     @@ -621,6 +637,7 @@ xpc_handle_activate_IRQ_uv(int irq, void *dev_id)
    603    
    604     part_referenced = xpc_part_ref(part);
    605     xpc_handle_activate_mq_msg_uv(part, msg_hdr,
    606     + part_referenced,
    607     &wakeup_hb_checker);
    608     if (part_referenced)
    609     xpc_part_deref(part);
    610     diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
    611     index 78347041..0a7ce37 100644
    612     --- a/drivers/net/wireless/p54/eeprom.c
    613     +++ b/drivers/net/wireless/p54/eeprom.c
    614     @@ -260,8 +260,10 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
    615     list->max_entries = max_channel_num;
    616     list->channels = kzalloc(sizeof(struct p54_channel_entry) *
    617     max_channel_num, GFP_KERNEL);
    618     - if (!list->channels)
    619     + if (!list->channels) {
    620     + ret = -ENOMEM;
    621     goto free;
    622     + }
    623    
    624     for (i = 0; i < max_channel_num; i++) {
    625     if (i < priv->iq_autocal_len) {
    626     diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
    627     index ad59595..d5bc21e 100644
    628     --- a/drivers/net/wireless/p54/p54usb.c
    629     +++ b/drivers/net/wireless/p54/p54usb.c
    630     @@ -33,8 +33,17 @@ MODULE_ALIAS("prism54usb");
    631     MODULE_FIRMWARE("isl3886usb");
    632     MODULE_FIRMWARE("isl3887usb");
    633    
    634     +/*
    635     + * Note:
    636     + *
    637     + * Always update our wiki's device list (located at:
    638     + * http://wireless.kernel.org/en/users/Drivers/p54/devices ),
    639     + * whenever you add a new device.
    640     + */
    641     +
    642     static struct usb_device_id p54u_table[] __devinitdata = {
    643     /* Version 1 devices (pci chip + net2280) */
    644     + {USB_DEVICE(0x045e, 0x00c2)}, /* Microsoft MN-710 */
    645     {USB_DEVICE(0x0506, 0x0a11)}, /* 3COM 3CRWE254G72 */
    646     {USB_DEVICE(0x06b9, 0x0120)}, /* Thomson SpeedTouch 120g */
    647     {USB_DEVICE(0x0707, 0xee06)}, /* SMC 2862W-G */
    648     @@ -47,7 +56,9 @@ static struct usb_device_id p54u_table[] __devinitdata = {
    649     {USB_DEVICE(0x0846, 0x4220)}, /* Netgear WG111 */
    650     {USB_DEVICE(0x09aa, 0x1000)}, /* Spinnaker Proto board */
    651     {USB_DEVICE(0x0cde, 0x0006)}, /* Medion 40900, Roper Europe */
    652     + {USB_DEVICE(0x107b, 0x55f2)}, /* Gateway WGU-210 (Gemtek) */
    653     {USB_DEVICE(0x124a, 0x4023)}, /* Shuttle PN15, Airvast WM168g, IOGear GWU513 */
    654     + {USB_DEVICE(0x1630, 0x0005)}, /* 2Wire 802.11g USB (v1) / Z-Com */
    655     {USB_DEVICE(0x1915, 0x2234)}, /* Linksys WUSB54G OEM */
    656     {USB_DEVICE(0x1915, 0x2235)}, /* Linksys WUSB54G Portable OEM */
    657     {USB_DEVICE(0x2001, 0x3701)}, /* DLink DWL-G120 Spinnaker */
    658     @@ -60,6 +71,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
    659     {USB_DEVICE(0x050d, 0x7050)}, /* Belkin F5D7050 ver 1000 */
    660     {USB_DEVICE(0x0572, 0x2000)}, /* Cohiba Proto board */
    661     {USB_DEVICE(0x0572, 0x2002)}, /* Cohiba Proto board */
    662     + {USB_DEVICE(0x06a9, 0x000e)}, /* Westell 802.11g USB (A90-211WG-01) */
    663     {USB_DEVICE(0x06b9, 0x0121)}, /* Thomson SpeedTouch 121g */
    664     {USB_DEVICE(0x0707, 0xee13)}, /* SMC 2862W-G version 2 */
    665     {USB_DEVICE(0x083a, 0x4521)}, /* Siemens Gigaset USB Adapter 54 version 2 */
    666     @@ -80,6 +92,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
    667     {USB_DEVICE(0x13B1, 0x000C)}, /* Linksys WUSB54AG */
    668     {USB_DEVICE(0x1413, 0x5400)}, /* Telsey 802.11g USB2.0 Adapter */
    669     {USB_DEVICE(0x1435, 0x0427)}, /* Inventel UR054G */
    670     + {USB_DEVICE(0x1668, 0x1050)}, /* Actiontec 802UIG-1 */
    671     {USB_DEVICE(0x2001, 0x3704)}, /* DLink DWL-G122 rev A2 */
    672     {USB_DEVICE(0x413c, 0x5513)}, /* Dell WLA3310 USB Wireless Adapter */
    673     {USB_DEVICE(0x413c, 0x8102)}, /* Spinnaker DUT */
    674     @@ -930,8 +943,8 @@ static int __devinit p54u_probe(struct usb_interface *intf,
    675     #ifdef CONFIG_PM
    676     /* ISL3887 needs a full reset on resume */
    677     udev->reset_resume = 1;
    678     +#endif /* CONFIG_PM */
    679     err = p54u_device_reset(dev);
    680     -#endif
    681    
    682     priv->hw_type = P54U_3887;
    683     dev->extra_tx_headroom += sizeof(struct lm87_tx_hdr);
    684     diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
    685     index b756e07..e8acb1c 100644
    686     --- a/drivers/platform/x86/asus-laptop.c
    687     +++ b/drivers/platform/x86/asus-laptop.c
    688     @@ -1065,9 +1065,9 @@ static ssize_t store_gps(struct device *dev, struct device_attribute *attr,
    689     */
    690     static int asus_gps_rfkill_set(void *data, bool blocked)
    691     {
    692     - acpi_handle handle = data;
    693     + struct asus_laptop *asus = data;
    694    
    695     - return asus_gps_switch(handle, !blocked);
    696     + return asus_gps_switch(asus, !blocked);
    697     }
    698    
    699     static const struct rfkill_ops asus_gps_rfkill_ops = {
    700     @@ -1094,7 +1094,7 @@ static int asus_rfkill_init(struct asus_laptop *asus)
    701    
    702     asus->gps_rfkill = rfkill_alloc("asus-gps", &asus->platform_device->dev,
    703     RFKILL_TYPE_GPS,
    704     - &asus_gps_rfkill_ops, NULL);
    705     + &asus_gps_rfkill_ops, asus);
    706     if (!asus->gps_rfkill)
    707     return -EINVAL;
    708    
    709     diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
    710     index b860d65..4cf7ffa 100644
    711     --- a/drivers/scsi/gdth.c
    712     +++ b/drivers/scsi/gdth.c
    713     @@ -4175,6 +4175,14 @@ static int ioc_general(void __user *arg, char *cmnd)
    714     ha = gdth_find_ha(gen.ionode);
    715     if (!ha)
    716     return -EFAULT;
    717     +
    718     + if (gen.data_len > INT_MAX)
    719     + return -EINVAL;
    720     + if (gen.sense_len > INT_MAX)
    721     + return -EINVAL;
    722     + if (gen.data_len + gen.sense_len > INT_MAX)
    723     + return -EINVAL;
    724     +
    725     if (gen.data_len + gen.sense_len != 0) {
    726     if (!(buf = gdth_ioctl_alloc(ha, gen.data_len + gen.sense_len,
    727     FALSE, &paddr)))
    728     diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
    729     index 042153c..ddbade7 100644
    730     --- a/drivers/scsi/libsas/sas_ata.c
    731     +++ b/drivers/scsi/libsas/sas_ata.c
    732     @@ -347,6 +347,7 @@ static int sas_ata_scr_read(struct ata_link *link, unsigned int sc_reg_in,
    733     static struct ata_port_operations sas_sata_ops = {
    734     .phy_reset = sas_ata_phy_reset,
    735     .post_internal_cmd = sas_ata_post_internal,
    736     + .qc_defer = ata_std_qc_defer,
    737     .qc_prep = ata_noop_qc_prep,
    738     .qc_issue = sas_ata_qc_issue,
    739     .qc_fill_rtf = sas_ata_qc_fill_rtf,
    740     diff --git a/drivers/scsi/pmcraid.h b/drivers/scsi/pmcraid.h
    741     index 6cfa014..dd78f9e 100644
    742     --- a/drivers/scsi/pmcraid.h
    743     +++ b/drivers/scsi/pmcraid.h
    744     @@ -568,7 +568,6 @@ struct pmcraid_cmd {
    745     struct pmcraid_control_block *ioa_cb;
    746     dma_addr_t ioa_cb_bus_addr;
    747     dma_addr_t dma_handle;
    748     - u8 *sense_buffer;
    749    
    750     /* pointer to mid layer structure of SCSI commands */
    751     struct scsi_cmnd *scsi_cmd;
    752     diff --git a/drivers/scsi/qla4xxx/ql4_nx.c b/drivers/scsi/qla4xxx/ql4_nx.c
    753     index 5d4a382..449256f 100644
    754     --- a/drivers/scsi/qla4xxx/ql4_nx.c
    755     +++ b/drivers/scsi/qla4xxx/ql4_nx.c
    756     @@ -5,6 +5,7 @@
    757     * See LICENSE.qla4xxx for copyright and licensing details.
    758     */
    759     #include <linux/delay.h>
    760     +#include <linux/io.h>
    761     #include <linux/pci.h>
    762     #include "ql4_def.h"
    763     #include "ql4_glbl.h"
    764     diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
    765     index ee02d38..71c4cf7 100644
    766     --- a/drivers/scsi/scsi_lib.c
    767     +++ b/drivers/scsi/scsi_lib.c
    768     @@ -2428,7 +2428,8 @@ scsi_internal_device_unblock(struct scsi_device *sdev)
    769     sdev->sdev_state = SDEV_RUNNING;
    770     else if (sdev->sdev_state == SDEV_CREATED_BLOCK)
    771     sdev->sdev_state = SDEV_CREATED;
    772     - else
    773     + else if (sdev->sdev_state != SDEV_CANCEL &&
    774     + sdev->sdev_state != SDEV_OFFLINE)
    775     return -EINVAL;
    776    
    777     spin_lock_irqsave(q->queue_lock, flags);
    778     diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
    779     index c3f6737..7a0ca6f 100644
    780     --- a/drivers/scsi/scsi_sysfs.c
    781     +++ b/drivers/scsi/scsi_sysfs.c
    782     @@ -962,10 +962,11 @@ static void __scsi_remove_target(struct scsi_target *starget)
    783     list_for_each_entry(sdev, &shost->__devices, siblings) {
    784     if (sdev->channel != starget->channel ||
    785     sdev->id != starget->id ||
    786     - sdev->sdev_state == SDEV_DEL)
    787     + scsi_device_get(sdev))
    788     continue;
    789     spin_unlock_irqrestore(shost->host_lock, flags);
    790     scsi_remove_device(sdev);
    791     + scsi_device_put(sdev);
    792     spin_lock_irqsave(shost->host_lock, flags);
    793     goto restart;
    794     }
    795     diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
    796     index ffa0689..0eb0af5 100644
    797     --- a/drivers/scsi/sd.c
    798     +++ b/drivers/scsi/sd.c
    799     @@ -2252,11 +2252,10 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
    800     index = sdkp->index;
    801     dev = &sdp->sdev_gendev;
    802    
    803     - if (index < SD_MAX_DISKS) {
    804     - gd->major = sd_major((index & 0xf0) >> 4);
    805     - gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);
    806     - gd->minors = SD_MINORS;
    807     - }
    808     + gd->major = sd_major((index & 0xf0) >> 4);
    809     + gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);
    810     + gd->minors = SD_MINORS;
    811     +
    812     gd->fops = &sd_fops;
    813     gd->private_data = &sdkp->driver;
    814     gd->queue = sdkp->device->request_queue;
    815     @@ -2346,6 +2345,12 @@ static int sd_probe(struct device *dev)
    816     if (error)
    817     goto out_put;
    818    
    819     + if (index >= SD_MAX_DISKS) {
    820     + error = -ENODEV;
    821     + sdev_printk(KERN_WARNING, sdp, "SCSI disk (sd) name space exhausted.\n");
    822     + goto out_free_index;
    823     + }
    824     +
    825     error = sd_format_disk_name("sd", index, gd->disk_name, DISK_NAME_LEN);
    826     if (error)
    827     goto out_free_index;
    828     diff --git a/drivers/staging/phison/phison.c b/drivers/staging/phison/phison.c
    829     index 42783d7..6771520 100644
    830     --- a/drivers/staging/phison/phison.c
    831     +++ b/drivers/staging/phison/phison.c
    832     @@ -62,7 +62,7 @@ static int phison_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
    833     };
    834     const struct ata_port_info *ppi[] = { &info, NULL };
    835    
    836     - ret = ata_pci_sff_init_one(pdev, ppi, &phison_sht, NULL, 0);
    837     + ret = ata_pci_bmdma_init_one(pdev, ppi, &phison_sht, NULL, 0);
    838    
    839     dev_dbg(&pdev->dev, "phison_init_one(), ret = %x\n", ret);
    840    
    841     diff --git a/drivers/staging/usbip/usbip_event.c b/drivers/staging/usbip/usbip_event.c
    842     index a2566f1..af3832b 100644
    843     --- a/drivers/staging/usbip/usbip_event.c
    844     +++ b/drivers/staging/usbip/usbip_event.c
    845     @@ -38,21 +38,13 @@ static int event_handler(struct usbip_device *ud)
    846     ud->eh_ops.shutdown(ud);
    847    
    848     ud->event &= ~USBIP_EH_SHUTDOWN;
    849     -
    850     - break;
    851     }
    852    
    853     - /* Stop the error handler. */
    854     - if (ud->event & USBIP_EH_BYE)
    855     - return -1;
    856     -
    857     /* Reset the device. */
    858     if (ud->event & USBIP_EH_RESET) {
    859     ud->eh_ops.reset(ud);
    860    
    861     ud->event &= ~USBIP_EH_RESET;
    862     -
    863     - break;
    864     }
    865    
    866     /* Mark the device as unusable. */
    867     @@ -60,13 +52,11 @@ static int event_handler(struct usbip_device *ud)
    868     ud->eh_ops.unusable(ud);
    869    
    870     ud->event &= ~USBIP_EH_UNUSABLE;
    871     -
    872     - break;
    873     }
    874    
    875     - /* NOTREACHED */
    876     - printk(KERN_ERR "%s: unknown event\n", __func__);
    877     - return -1;
    878     + /* Stop the error handler. */
    879     + if (ud->event & USBIP_EH_BYE)
    880     + return -1;
    881     }
    882    
    883     return 0;
    884     diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
    885     index 0574d84..832608d 100644
    886     --- a/drivers/staging/usbip/vhci_hcd.c
    887     +++ b/drivers/staging/usbip/vhci_hcd.c
    888     @@ -164,6 +164,8 @@ void rh_port_disconnect(int rhport)
    889     * spin_unlock(&vdev->ud.lock); */
    890    
    891     spin_unlock_irqrestore(&the_controller->lock, flags);
    892     +
    893     + usb_hcd_poll_rh_status(vhci_to_hcd(the_controller));
    894     }
    895    
    896    
    897     diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    898     index 84c18971..566c183 100644
    899     --- a/drivers/usb/core/hub.c
    900     +++ b/drivers/usb/core/hub.c
    901     @@ -2860,13 +2860,16 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
    902     else
    903     i = udev->descriptor.bMaxPacketSize0;
    904     if (le16_to_cpu(udev->ep0.desc.wMaxPacketSize) != i) {
    905     - if (udev->speed != USB_SPEED_FULL ||
    906     + if (udev->speed == USB_SPEED_LOW ||
    907     !(i == 8 || i == 16 || i == 32 || i == 64)) {
    908     - dev_err(&udev->dev, "ep0 maxpacket = %d\n", i);
    909     + dev_err(&udev->dev, "Invalid ep0 maxpacket: %d\n", i);
    910     retval = -EMSGSIZE;
    911     goto fail;
    912     }
    913     - dev_dbg(&udev->dev, "ep0 maxpacket = %d\n", i);
    914     + if (udev->speed == USB_SPEED_FULL)
    915     + dev_dbg(&udev->dev, "ep0 maxpacket = %d\n", i);
    916     + else
    917     + dev_warn(&udev->dev, "Using ep0 maxpacket: %d\n", i);
    918     udev->ep0.desc.wMaxPacketSize = cpu_to_le16(i);
    919     usb_ep0_reinit(udev);
    920     }
    921     diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
    922     index 9f0ce7d..d6e3e41 100644
    923     --- a/drivers/usb/core/message.c
    924     +++ b/drivers/usb/core/message.c
    925     @@ -1140,13 +1140,6 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
    926     {
    927     int i;
    928    
    929     - dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
    930     - skip_ep0 ? "non-ep0" : "all");
    931     - for (i = skip_ep0; i < 16; ++i) {
    932     - usb_disable_endpoint(dev, i, true);
    933     - usb_disable_endpoint(dev, i + USB_DIR_IN, true);
    934     - }
    935     -
    936     /* getting rid of interfaces will disconnect
    937     * any drivers bound to them (a key side effect)
    938     */
    939     @@ -1176,6 +1169,13 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
    940     if (dev->state == USB_STATE_CONFIGURED)
    941     usb_set_device_state(dev, USB_STATE_ADDRESS);
    942     }
    943     +
    944     + dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
    945     + skip_ep0 ? "non-ep0" : "all");
    946     + for (i = skip_ep0; i < 16; ++i) {
    947     + usb_disable_endpoint(dev, i, true);
    948     + usb_disable_endpoint(dev, i + USB_DIR_IN, true);
    949     + }
    950     }
    951    
    952     /**
    953     diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
    954     index d623c7b..959f062 100644
    955     --- a/drivers/usb/gadget/atmel_usba_udc.c
    956     +++ b/drivers/usb/gadget/atmel_usba_udc.c
    957     @@ -2014,6 +2014,9 @@ static int __init usba_udc_probe(struct platform_device *pdev)
    958     } else {
    959     disable_irq(gpio_to_irq(udc->vbus_pin));
    960     }
    961     + } else {
    962     + /* gpio_request fail so use -EINVAL for gpio_is_valid */
    963     + ubc->vbus_pin = -EINVAL;
    964     }
    965     }
    966    
    967     diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
    968     index 1160c55..9a98c38 100644
    969     --- a/drivers/usb/gadget/composite.c
    970     +++ b/drivers/usb/gadget/composite.c
    971     @@ -901,7 +901,8 @@ unknown:
    972     */
    973     switch (ctrl->bRequestType & USB_RECIP_MASK) {
    974     case USB_RECIP_INTERFACE:
    975     - f = cdev->config->interface[intf];
    976     + if (cdev->config)
    977     + f = cdev->config->interface[intf];
    978     break;
    979    
    980     case USB_RECIP_ENDPOINT:
    981     diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c
    982     index d47a123..bd6226c 100644
    983     --- a/drivers/usb/gadget/f_acm.c
    984     +++ b/drivers/usb/gadget/f_acm.c
    985     @@ -111,7 +111,7 @@ acm_iad_descriptor = {
    986     .bInterfaceCount = 2, // control + data
    987     .bFunctionClass = USB_CLASS_COMM,
    988     .bFunctionSubClass = USB_CDC_SUBCLASS_ACM,
    989     - .bFunctionProtocol = USB_CDC_PROTO_NONE,
    990     + .bFunctionProtocol = USB_CDC_ACM_PROTO_AT_V25TER,
    991     /* .iFunction = DYNAMIC */
    992     };
    993    
    994     diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
    995     index a9474f8..3c2f0a4 100644
    996     --- a/drivers/usb/gadget/g_ffs.c
    997     +++ b/drivers/usb/gadget/g_ffs.c
    998     @@ -53,8 +53,8 @@ MODULE_AUTHOR("Michal Nazarewicz");
    999     MODULE_LICENSE("GPL");
    1000    
    1001    
    1002     -static unsigned short gfs_vendor_id = 0x0525; /* XXX NetChip */
    1003     -static unsigned short gfs_product_id = 0xa4ac; /* XXX */
    1004     +static unsigned short gfs_vendor_id = 0x1d6b; /* Linux Foundation */
    1005     +static unsigned short gfs_product_id = 0x0105; /* FunctionFS Gadget */
    1006    
    1007     static struct usb_device_descriptor gfs_dev_desc = {
    1008     .bLength = sizeof gfs_dev_desc,
    1009     diff --git a/drivers/usb/gadget/multi.c b/drivers/usb/gadget/multi.c
    1010     index 795d762..36d67a3 100644
    1011     --- a/drivers/usb/gadget/multi.c
    1012     +++ b/drivers/usb/gadget/multi.c
    1013     @@ -74,8 +74,8 @@ MODULE_LICENSE("GPL");
    1014    
    1015     /***************************** Device Descriptor ****************************/
    1016    
    1017     -#define MULTI_VENDOR_NUM 0x0525 /* XXX NetChip */
    1018     -#define MULTI_PRODUCT_NUM 0xa4ab /* XXX */
    1019     +#define MULTI_VENDOR_NUM 0x1d6b /* Linux Foundation */
    1020     +#define MULTI_PRODUCT_NUM 0x0104 /* Multifunction Composite Gadget */
    1021    
    1022    
    1023     enum {
    1024     diff --git a/drivers/usb/host/r8a66597.h b/drivers/usb/host/r8a66597.h
    1025     index 95d0f5a..25563e9 100644
    1026     --- a/drivers/usb/host/r8a66597.h
    1027     +++ b/drivers/usb/host/r8a66597.h
    1028     @@ -227,7 +227,7 @@ static inline void r8a66597_write_fifo(struct r8a66597 *r8a66597,
    1029     int odd = len & 0x0001;
    1030    
    1031     len = len / 2;
    1032     - ioread16_rep(fifoaddr, buf, len);
    1033     + iowrite16_rep(fifoaddr, buf, len);
    1034     if (unlikely(odd)) {
    1035     buf = &buf[len];
    1036     iowrite8((unsigned char)*buf, fifoaddr);
    1037     diff --git a/drivers/usb/musb/blackfin.c b/drivers/usb/musb/blackfin.c
    1038     index b611420..611a9d2 100644
    1039     --- a/drivers/usb/musb/blackfin.c
    1040     +++ b/drivers/usb/musb/blackfin.c
    1041     @@ -342,8 +342,10 @@ int __init musb_platform_init(struct musb *musb, void *board_data)
    1042    
    1043     usb_nop_xceiv_register();
    1044     musb->xceiv = otg_get_transceiver();
    1045     - if (!musb->xceiv)
    1046     + if (!musb->xceiv) {
    1047     + gpio_free(musb->config->gpio_vrsel);
    1048     return -ENODEV;
    1049     + }
    1050    
    1051     if (ANOMALY_05000346) {
    1052     bfin_write_USB_APHY_CALIB(ANOMALY_05000346_value);
    1053     @@ -394,8 +396,9 @@ int __init musb_platform_init(struct musb *musb, void *board_data)
    1054    
    1055     int musb_platform_exit(struct musb *musb)
    1056     {
    1057     -
    1058     gpio_free(musb->config->gpio_vrsel);
    1059    
    1060     + otg_put_transceiver(musb->xceiv);
    1061     + usb_nop_xceiv_unregister();
    1062     return 0;
    1063     }
    1064     diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
    1065     index 5762436..6e67629 100644
    1066     --- a/drivers/usb/musb/davinci.c
    1067     +++ b/drivers/usb/musb/davinci.c
    1068     @@ -446,6 +446,7 @@ int __init musb_platform_init(struct musb *musb, void *board_data)
    1069     fail:
    1070     clk_disable(musb->clock);
    1071    
    1072     + otg_put_transceiver(musb->xceiv);
    1073     usb_nop_xceiv_unregister();
    1074     return -ENODEV;
    1075     }
    1076     @@ -496,6 +497,7 @@ int musb_platform_exit(struct musb *musb)
    1077    
    1078     clk_disable(musb->clock);
    1079    
    1080     + otg_put_transceiver(musb->xceiv);
    1081     usb_nop_xceiv_unregister();
    1082    
    1083     return 0;
    1084     diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
    1085     index 540c766..513d6bd 100644
    1086     --- a/drivers/usb/musb/musb_core.c
    1087     +++ b/drivers/usb/musb/musb_core.c
    1088     @@ -1921,10 +1921,6 @@ static void musb_free(struct musb *musb)
    1089     dma_controller_destroy(c);
    1090     }
    1091    
    1092     -#ifdef CONFIG_USB_MUSB_OTG
    1093     - put_device(musb->xceiv->dev);
    1094     -#endif
    1095     -
    1096     #ifdef CONFIG_USB_MUSB_HDRC_HCD
    1097     usb_put_hcd(musb_to_hcd(musb));
    1098     #else
    1099     diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
    1100     index 2111a24..ed618bd 100644
    1101     --- a/drivers/usb/musb/omap2430.c
    1102     +++ b/drivers/usb/musb/omap2430.c
    1103     @@ -320,5 +320,6 @@ int musb_platform_exit(struct musb *musb)
    1104    
    1105     musb_platform_suspend(musb);
    1106    
    1107     + otg_put_transceiver(musb->xceiv);
    1108     return 0;
    1109     }
    1110     diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
    1111     index 3c48e77..bde40ef 100644
    1112     --- a/drivers/usb/musb/tusb6010.c
    1113     +++ b/drivers/usb/musb/tusb6010.c
    1114     @@ -1152,6 +1152,8 @@ done:
    1115     if (ret < 0) {
    1116     if (sync)
    1117     iounmap(sync);
    1118     +
    1119     + otg_put_transceiver(musb->xceiv);
    1120     usb_nop_xceiv_unregister();
    1121     }
    1122     return ret;
    1123     @@ -1166,6 +1168,8 @@ int musb_platform_exit(struct musb *musb)
    1124     musb->board_set_power(0);
    1125    
    1126     iounmap(musb->sync_va);
    1127     +
    1128     + otg_put_transceiver(musb->xceiv);
    1129     usb_nop_xceiv_unregister();
    1130     return 0;
    1131     }
    1132     diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    1133     index 4f1744c..8d7731d 100644
    1134     --- a/drivers/usb/serial/cp210x.c
    1135     +++ b/drivers/usb/serial/cp210x.c
    1136     @@ -54,6 +54,7 @@ static int cp210x_carrier_raised(struct usb_serial_port *p);
    1137     static int debug;
    1138    
    1139     static const struct usb_device_id id_table[] = {
    1140     + { USB_DEVICE(0x045B, 0x0053) }, /* Renesas RX610 RX-Stick */
    1141     { USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */
    1142     { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
    1143     { USB_DEVICE(0x0489, 0xE003) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
    1144     @@ -132,6 +133,7 @@ static const struct usb_device_id id_table[] = {
    1145     { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
    1146     { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
    1147     { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
    1148     + { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
    1149     { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
    1150     { } /* Terminating Entry */
    1151     };
    1152     diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    1153     index 97cc87d..01ba740 100644
    1154     --- a/drivers/usb/serial/ftdi_sio.c
    1155     +++ b/drivers/usb/serial/ftdi_sio.c
    1156     @@ -177,6 +177,7 @@ static struct usb_device_id id_table_combined [] = {
    1157     { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_SNIFFER_PID) },
    1158     { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_THROTTLE_PID) },
    1159     { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GATEWAY_PID) },
    1160     + { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_PID) },
    1161     { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
    1162     { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
    1163     { USB_DEVICE(FTDI_VID, FTDI_SPROG_II) },
    1164     @@ -674,7 +675,6 @@ static struct usb_device_id id_table_combined [] = {
    1165     { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
    1166     { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
    1167     { USB_DEVICE(ICOM_ID1_VID, ICOM_ID1_PID) },
    1168     - { USB_DEVICE(PAPOUCH_VID, PAPOUCH_TMU_PID) },
    1169     { USB_DEVICE(FTDI_VID, FTDI_ACG_HFDUAL_PID) },
    1170     { USB_DEVICE(FTDI_VID, FTDI_YEI_SERVOCENTER31_PID) },
    1171     { USB_DEVICE(FTDI_VID, FTDI_THORLABS_PID) },
    1172     @@ -715,8 +715,37 @@ static struct usb_device_id id_table_combined [] = {
    1173     .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    1174     { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
    1175     { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
    1176     +
    1177     + /* Papouch devices based on FTDI chip */
    1178     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB485_PID) },
    1179     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_AP485_PID) },
    1180     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB422_PID) },
    1181     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB485_2_PID) },
    1182     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_AP485_2_PID) },
    1183     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB422_2_PID) },
    1184     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB485S_PID) },
    1185     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB485C_PID) },
    1186     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_LEC_PID) },
    1187     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB232_PID) },
    1188     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_TMU_PID) },
    1189     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_IRAMP_PID) },
    1190     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_DRAK5_PID) },
    1191     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO8x8_PID) },
    1192     { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO4x4_PID) },
    1193     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO2x2_PID) },
    1194     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO10x1_PID) },
    1195     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO30x3_PID) },
    1196     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO60x3_PID) },
    1197     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO2x16_PID) },
    1198     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO3x32_PID) },
    1199     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_DRAK6_PID) },
    1200     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_UPSUSB_PID) },
    1201     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_MU_PID) },
    1202     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SIMUKEY_PID) },
    1203     { USB_DEVICE(PAPOUCH_VID, PAPOUCH_AD4USB_PID) },
    1204     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_GMUX_PID) },
    1205     + { USB_DEVICE(PAPOUCH_VID, PAPOUCH_GMSR_PID) },
    1206     +
    1207     { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DGQG_PID) },
    1208     { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DUSB_PID) },
    1209     { USB_DEVICE(ALTI2_VID, ALTI2_N3_PID) },
    1210     @@ -751,6 +780,7 @@ static struct usb_device_id id_table_combined [] = {
    1211     { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH4_PID),
    1212     .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    1213     { USB_DEVICE(FTDI_VID, SEGWAY_RMP200_PID) },
    1214     + { USB_DEVICE(FTDI_VID, ACCESIO_COM4SM_PID) },
    1215     { USB_DEVICE(IONICS_VID, IONICS_PLUGCOMPUTER_PID),
    1216     .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    1217     { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_24_MASTER_WING_PID) },
    1218     @@ -761,6 +791,9 @@ static struct usb_device_id id_table_combined [] = {
    1219     { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_MAXI_WING_PID) },
    1220     { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_MEDIA_WING_PID) },
    1221     { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_WING_PID) },
    1222     + { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LOGBOOKML_PID) },
    1223     + { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LS_LOGBOOK_PID) },
    1224     + { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_HS_LOGBOOK_PID) },
    1225     { }, /* Optional parameter entry */
    1226     { } /* Terminating entry */
    1227     };
    1228     @@ -2028,8 +2061,6 @@ static void ftdi_set_termios(struct tty_struct *tty,
    1229     "urb failed to set to rts/cts flow control\n");
    1230     }
    1231    
    1232     - /* raise DTR/RTS */
    1233     - set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
    1234     } else {
    1235     /*
    1236     * Xon/Xoff code
    1237     @@ -2077,8 +2108,6 @@ static void ftdi_set_termios(struct tty_struct *tty,
    1238     }
    1239     }
    1240    
    1241     - /* lower DTR/RTS */
    1242     - clear_mctrl(port, TIOCM_DTR | TIOCM_RTS);
    1243     }
    1244     return;
    1245     }
    1246     diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
    1247     index 15a4583..cf1aea1b 100644
    1248     --- a/drivers/usb/serial/ftdi_sio_ids.h
    1249     +++ b/drivers/usb/serial/ftdi_sio_ids.h
    1250     @@ -61,6 +61,7 @@
    1251     #define FTDI_OPENDCC_SNIFFER_PID 0xBFD9
    1252     #define FTDI_OPENDCC_THROTTLE_PID 0xBFDA
    1253     #define FTDI_OPENDCC_GATEWAY_PID 0xBFDB
    1254     +#define FTDI_OPENDCC_GBM_PID 0xBFDC
    1255    
    1256     /*
    1257     * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com)
    1258     @@ -1022,9 +1023,34 @@
    1259     */
    1260    
    1261     #define PAPOUCH_VID 0x5050 /* Vendor ID */
    1262     +#define PAPOUCH_SB485_PID 0x0100 /* Papouch SB485 USB-485/422 Converter */
    1263     +#define PAPOUCH_AP485_PID 0x0101 /* AP485 USB-RS485 Converter */
    1264     +#define PAPOUCH_SB422_PID 0x0102 /* Papouch SB422 USB-RS422 Converter */
    1265     +#define PAPOUCH_SB485_2_PID 0x0103 /* Papouch SB485 USB-485/422 Converter */
    1266     +#define PAPOUCH_AP485_2_PID 0x0104 /* AP485 USB-RS485 Converter */
    1267     +#define PAPOUCH_SB422_2_PID 0x0105 /* Papouch SB422 USB-RS422 Converter */
    1268     +#define PAPOUCH_SB485S_PID 0x0106 /* Papouch SB485S USB-485/422 Converter */
    1269     +#define PAPOUCH_SB485C_PID 0x0107 /* Papouch SB485C USB-485/422 Converter */
    1270     +#define PAPOUCH_LEC_PID 0x0300 /* LEC USB Converter */
    1271     +#define PAPOUCH_SB232_PID 0x0301 /* Papouch SB232 USB-RS232 Converter */
    1272     #define PAPOUCH_TMU_PID 0x0400 /* TMU USB Thermometer */
    1273     -#define PAPOUCH_QUIDO4x4_PID 0x0900 /* Quido 4/4 Module */
    1274     +#define PAPOUCH_IRAMP_PID 0x0500 /* Papouch IRAmp Duplex */
    1275     +#define PAPOUCH_DRAK5_PID 0x0700 /* Papouch DRAK5 */
    1276     +#define PAPOUCH_QUIDO8x8_PID 0x0800 /* Papouch Quido 8/8 Module */
    1277     +#define PAPOUCH_QUIDO4x4_PID 0x0900 /* Papouch Quido 4/4 Module */
    1278     +#define PAPOUCH_QUIDO2x2_PID 0x0a00 /* Papouch Quido 2/2 Module */
    1279     +#define PAPOUCH_QUIDO10x1_PID 0x0b00 /* Papouch Quido 10/1 Module */
    1280     +#define PAPOUCH_QUIDO30x3_PID 0x0c00 /* Papouch Quido 30/3 Module */
    1281     +#define PAPOUCH_QUIDO60x3_PID 0x0d00 /* Papouch Quido 60(100)/3 Module */
    1282     +#define PAPOUCH_QUIDO2x16_PID 0x0e00 /* Papouch Quido 2/16 Module */
    1283     +#define PAPOUCH_QUIDO3x32_PID 0x0f00 /* Papouch Quido 3/32 Module */
    1284     +#define PAPOUCH_DRAK6_PID 0x1000 /* Papouch DRAK6 */
    1285     +#define PAPOUCH_UPSUSB_PID 0x8000 /* Papouch UPS-USB adapter */
    1286     +#define PAPOUCH_MU_PID 0x8001 /* MU controller */
    1287     +#define PAPOUCH_SIMUKEY_PID 0x8002 /* Papouch SimuKey */
    1288     #define PAPOUCH_AD4USB_PID 0x8003 /* AD4USB Measurement Module */
    1289     +#define PAPOUCH_GMUX_PID 0x8004 /* Papouch GOLIATH MUX */
    1290     +#define PAPOUCH_GMSR_PID 0x8005 /* Papouch GOLIATH MSR */
    1291    
    1292     /*
    1293     * Marvell SheevaPlug
    1294     @@ -1063,3 +1089,14 @@
    1295     * Submitted by John G. Rogers
    1296     */
    1297     #define SEGWAY_RMP200_PID 0xe729
    1298     +
    1299     +
    1300     +/*
    1301     + * Accesio USB Data Acquisition products (http://www.accesio.com/)
    1302     + */
    1303     +#define ACCESIO_COM4SM_PID 0xD578
    1304     +
    1305     +/* www.sciencescope.co.uk educational dataloggers */
    1306     +#define FTDI_SCIENCESCOPE_LOGBOOKML_PID 0xFF18
    1307     +#define FTDI_SCIENCESCOPE_LS_LOGBOOK_PID 0xFF1C
    1308     +#define FTDI_SCIENCESCOPE_HS_LOGBOOK_PID 0xFF1D
    1309     diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
    1310     index 7aa01b9..2849f8c 100644
    1311     --- a/drivers/usb/serial/mct_u232.c
    1312     +++ b/drivers/usb/serial/mct_u232.c
    1313     @@ -549,9 +549,12 @@ static void mct_u232_close(struct usb_serial_port *port)
    1314     {
    1315     dbg("%s port %d", __func__, port->number);
    1316    
    1317     - usb_serial_generic_close(port);
    1318     - if (port->serial->dev)
    1319     + if (port->serial->dev) {
    1320     + /* shutdown our urbs */
    1321     + usb_kill_urb(port->write_urb);
    1322     + usb_kill_urb(port->read_urb);
    1323     usb_kill_urb(port->interrupt_in_urb);
    1324     + }
    1325     } /* mct_u232_close */
    1326    
    1327    
    1328     diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
    1329     index ed01f3b..9ff19c8 100644
    1330     --- a/drivers/usb/serial/opticon.c
    1331     +++ b/drivers/usb/serial/opticon.c
    1332     @@ -96,8 +96,8 @@ static void opticon_bulk_callback(struct urb *urb)
    1333     /* real data, send it to the tty layer */
    1334     tty = tty_port_tty_get(&port->port);
    1335     if (tty) {
    1336     - tty_insert_flip_string(tty, data,
    1337     - data_length);
    1338     + tty_insert_flip_string(tty, data + 2,
    1339     + data_length);
    1340     tty_flip_buffer_push(tty);
    1341     tty_kref_put(tty);
    1342     }
    1343     @@ -130,7 +130,7 @@ exit:
    1344     priv->bulk_address),
    1345     priv->bulk_in_buffer, priv->buffer_size,
    1346     opticon_bulk_callback, priv);
    1347     - result = usb_submit_urb(port->read_urb, GFP_ATOMIC);
    1348     + result = usb_submit_urb(priv->bulk_read_urb, GFP_ATOMIC);
    1349     if (result)
    1350     dev_err(&port->dev,
    1351     "%s - failed resubmitting read urb, error %d\n",
    1352     diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    1353     index c46911a..51de0dd 100644
    1354     --- a/drivers/usb/serial/option.c
    1355     +++ b/drivers/usb/serial/option.c
    1356     @@ -622,6 +622,7 @@ static const struct usb_device_id option_ids[] = {
    1357     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0011, 0xff, 0xff, 0xff) },
    1358     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0012, 0xff, 0xff, 0xff) },
    1359     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0013, 0xff, 0xff, 0xff) },
    1360     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) },
    1361     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628, 0xff, 0xff, 0xff) },
    1362     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0016, 0xff, 0xff, 0xff) },
    1363     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff) },
    1364     @@ -633,38 +634,52 @@ static const struct usb_device_id option_ids[] = {
    1365     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0023, 0xff, 0xff, 0xff) },
    1366     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0024, 0xff, 0xff, 0xff) },
    1367     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0025, 0xff, 0xff, 0xff) },
    1368     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0026, 0xff, 0xff, 0xff) },
    1369     + /* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0026, 0xff, 0xff, 0xff) }, */
    1370     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0028, 0xff, 0xff, 0xff) },
    1371     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0029, 0xff, 0xff, 0xff) },
    1372     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0030, 0xff, 0xff, 0xff) },
    1373     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626, 0xff, 0xff, 0xff) },
    1374     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0032, 0xff, 0xff, 0xff) },
    1375     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0033, 0xff, 0xff, 0xff) },
    1376     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0034, 0xff, 0xff, 0xff) },
    1377     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0037, 0xff, 0xff, 0xff) },
    1378     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0038, 0xff, 0xff, 0xff) },
    1379     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0039, 0xff, 0xff, 0xff) },
    1380     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0040, 0xff, 0xff, 0xff) },
    1381     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0042, 0xff, 0xff, 0xff) },
    1382     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0043, 0xff, 0xff, 0xff) },
    1383     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0044, 0xff, 0xff, 0xff) },
    1384     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0048, 0xff, 0xff, 0xff) },
    1385     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0049, 0xff, 0xff, 0xff) },
    1386     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0050, 0xff, 0xff, 0xff) },
    1387     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0051, 0xff, 0xff, 0xff) },
    1388     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0052, 0xff, 0xff, 0xff) },
    1389     + /* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0053, 0xff, 0xff, 0xff) }, */
    1390     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0054, 0xff, 0xff, 0xff) },
    1391     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0055, 0xff, 0xff, 0xff) },
    1392     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0056, 0xff, 0xff, 0xff) },
    1393     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0057, 0xff, 0xff, 0xff) },
    1394     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0058, 0xff, 0xff, 0xff) },
    1395     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
    1396     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0061, 0xff, 0xff, 0xff) },
    1397     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0062, 0xff, 0xff, 0xff) },
    1398     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0063, 0xff, 0xff, 0xff) },
    1399     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0064, 0xff, 0xff, 0xff) },
    1400     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0065, 0xff, 0xff, 0xff) },
    1401     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0066, 0xff, 0xff, 0xff) },
    1402     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0067, 0xff, 0xff, 0xff) },
    1403     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0069, 0xff, 0xff, 0xff) },
    1404     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
    1405     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0076, 0xff, 0xff, 0xff) },
    1406     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0077, 0xff, 0xff, 0xff) },
    1407     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0078, 0xff, 0xff, 0xff) },
    1408     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0079, 0xff, 0xff, 0xff) },
    1409     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0082, 0xff, 0xff, 0xff) },
    1410     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0083, 0xff, 0xff, 0xff) },
    1411     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0086, 0xff, 0xff, 0xff) },
    1412     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) },
    1413     - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
    1414     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0087, 0xff, 0xff, 0xff) },
    1415     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff) },
    1416     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0105, 0xff, 0xff, 0xff) },
    1417     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0106, 0xff, 0xff, 0xff) },
    1418     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0108, 0xff, 0xff, 0xff) },
    1419     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff) },
    1420     @@ -880,6 +895,8 @@ static const struct usb_device_id option_ids[] = {
    1421     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
    1422     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
    1423     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
    1424     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) },
    1425     + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
    1426     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
    1427     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
    1428     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
    1429     diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
    1430     index eb76aae..15a5d89 100644
    1431     --- a/drivers/usb/serial/visor.c
    1432     +++ b/drivers/usb/serial/visor.c
    1433     @@ -606,6 +606,10 @@ static int treo_attach(struct usb_serial *serial)
    1434    
    1435     static int clie_5_attach(struct usb_serial *serial)
    1436     {
    1437     + struct usb_serial_port *port;
    1438     + unsigned int pipe;
    1439     + int j;
    1440     +
    1441     dbg("%s", __func__);
    1442    
    1443     /* TH55 registers 2 ports.
    1444     @@ -621,9 +625,14 @@ static int clie_5_attach(struct usb_serial *serial)
    1445     return -1;
    1446    
    1447     /* port 0 now uses the modified endpoint Address */
    1448     - serial->port[0]->bulk_out_endpointAddress =
    1449     + port = serial->port[0];
    1450     + port->bulk_out_endpointAddress =
    1451     serial->port[1]->bulk_out_endpointAddress;
    1452    
    1453     + pipe = usb_sndbulkpipe(serial->dev, port->bulk_out_endpointAddress);
    1454     + for (j = 0; j < ARRAY_SIZE(port->write_urbs); ++j)
    1455     + port->write_urbs[j]->pipe = pipe;
    1456     +
    1457     return 0;
    1458     }
    1459    
    1460     diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
    1461     index 1d60c65..f110e0e 100644
    1462     --- a/fs/cifs/cifsproto.h
    1463     +++ b/fs/cifs/cifsproto.h
    1464     @@ -107,7 +107,8 @@ extern struct timespec cnvrtDosUnixTm(__le16 le_date, __le16 le_time,
    1465    
    1466     extern struct cifsFileInfo *cifs_new_fileinfo(struct inode *newinode,
    1467     __u16 fileHandle, struct file *file,
    1468     - struct vfsmount *mnt, unsigned int oflags);
    1469     + struct vfsmount *mnt, unsigned int oflags,
    1470     + __u32 oplock);
    1471     extern int cifs_posix_open(char *full_path, struct inode **pinode,
    1472     struct super_block *sb,
    1473     int mode, int oflags,
    1474     diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
    1475     index f9ed075..0f947bf 100644
    1476     --- a/fs/cifs/dir.c
    1477     +++ b/fs/cifs/dir.c
    1478     @@ -132,9 +132,9 @@ cifs_bp_rename_retry:
    1479    
    1480     struct cifsFileInfo *
    1481     cifs_new_fileinfo(struct inode *newinode, __u16 fileHandle,
    1482     - struct file *file, struct vfsmount *mnt, unsigned int oflags)
    1483     + struct file *file, struct vfsmount *mnt, unsigned int oflags,
    1484     + __u32 oplock)
    1485     {
    1486     - int oplock = 0;
    1487     struct cifsFileInfo *pCifsFile;
    1488     struct cifsInodeInfo *pCifsInode;
    1489     struct cifs_sb_info *cifs_sb = CIFS_SB(mnt->mnt_sb);
    1490     @@ -143,9 +143,6 @@ cifs_new_fileinfo(struct inode *newinode, __u16 fileHandle,
    1491     if (pCifsFile == NULL)
    1492     return pCifsFile;
    1493    
    1494     - if (oplockEnabled)
    1495     - oplock = REQ_OPLOCK;
    1496     -
    1497     pCifsFile->netfid = fileHandle;
    1498     pCifsFile->pid = current->tgid;
    1499     pCifsFile->pInode = igrab(newinode);
    1500     @@ -468,7 +465,7 @@ cifs_create_set_dentry:
    1501     }
    1502    
    1503     pfile_info = cifs_new_fileinfo(newinode, fileHandle, filp,
    1504     - nd->path.mnt, oflags);
    1505     + nd->path.mnt, oflags, oplock);
    1506     if (pfile_info == NULL) {
    1507     fput(filp);
    1508     CIFSSMBClose(xid, tcon, fileHandle);
    1509     @@ -729,7 +726,8 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
    1510    
    1511     cfile = cifs_new_fileinfo(newInode, fileHandle, filp,
    1512     nd->path.mnt,
    1513     - nd->intent.open.flags);
    1514     + nd->intent.open.flags,
    1515     + oplock);
    1516     if (cfile == NULL) {
    1517     fput(filp);
    1518     CIFSSMBClose(xid, pTcon, fileHandle);
    1519     diff --git a/fs/cifs/file.c b/fs/cifs/file.c
    1520     index de748c6..681761c 100644
    1521     --- a/fs/cifs/file.c
    1522     +++ b/fs/cifs/file.c
    1523     @@ -277,7 +277,7 @@ int cifs_open(struct inode *inode, struct file *file)
    1524    
    1525     pCifsFile = cifs_new_fileinfo(inode, netfid, file,
    1526     file->f_path.mnt,
    1527     - oflags);
    1528     + oflags, oplock);
    1529     if (pCifsFile == NULL) {
    1530     CIFSSMBClose(xid, tcon, netfid);
    1531     rc = -ENOMEM;
    1532     @@ -370,7 +370,7 @@ int cifs_open(struct inode *inode, struct file *file)
    1533     goto out;
    1534    
    1535     pCifsFile = cifs_new_fileinfo(inode, netfid, file, file->f_path.mnt,
    1536     - file->f_flags);
    1537     + file->f_flags, oplock);
    1538     if (pCifsFile == NULL) {
    1539     rc = -ENOMEM;
    1540     goto out;
    1541     diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
    1542     index 064a809..84d3c8b 100644
    1543     --- a/fs/nfs/direct.c
    1544     +++ b/fs/nfs/direct.c
    1545     @@ -873,7 +873,7 @@ static ssize_t nfs_direct_write(struct kiocb *iocb, const struct iovec *iov,
    1546     dreq->inode = inode;
    1547     dreq->ctx = get_nfs_open_context(nfs_file_open_context(iocb->ki_filp));
    1548     dreq->l_ctx = nfs_get_lock_context(dreq->ctx);
    1549     - if (dreq->l_ctx != NULL)
    1550     + if (dreq->l_ctx == NULL)
    1551     goto out_release;
    1552     if (!is_sync_kiocb(iocb))
    1553     dreq->iocb = iocb;
    1554     diff --git a/fs/pipe.c b/fs/pipe.c
    1555     index 279eef9..37eb1eb 100644
    1556     --- a/fs/pipe.c
    1557     +++ b/fs/pipe.c
    1558     @@ -382,7 +382,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
    1559     error = ops->confirm(pipe, buf);
    1560     if (error) {
    1561     if (!ret)
    1562     - error = ret;
    1563     + ret = error;
    1564     break;
    1565     }
    1566    
    1567     diff --git a/kernel/futex.c b/kernel/futex.c
    1568     index 6a3a5fa..e328f57 100644
    1569     --- a/kernel/futex.c
    1570     +++ b/kernel/futex.c
    1571     @@ -1363,7 +1363,6 @@ static inline struct futex_hash_bucket *queue_lock(struct futex_q *q)
    1572     {
    1573     struct futex_hash_bucket *hb;
    1574    
    1575     - get_futex_key_refs(&q->key);
    1576     hb = hash_futex(&q->key);
    1577     q->lock_ptr = &hb->lock;
    1578    
    1579     @@ -1375,7 +1374,6 @@ static inline void
    1580     queue_unlock(struct futex_q *q, struct futex_hash_bucket *hb)
    1581     {
    1582     spin_unlock(&hb->lock);
    1583     - drop_futex_key_refs(&q->key);
    1584     }
    1585    
    1586     /**
    1587     @@ -1480,8 +1478,6 @@ static void unqueue_me_pi(struct futex_q *q)
    1588     q->pi_state = NULL;
    1589    
    1590     spin_unlock(q->lock_ptr);
    1591     -
    1592     - drop_futex_key_refs(&q->key);
    1593     }
    1594    
    1595     /*
    1596     @@ -1812,7 +1808,10 @@ static int futex_wait(u32 __user *uaddr, int fshared,
    1597     }
    1598    
    1599     retry:
    1600     - /* Prepare to wait on uaddr. */
    1601     + /*
    1602     + * Prepare to wait on uaddr. On success, holds hb lock and increments
    1603     + * q.key refs.
    1604     + */
    1605     ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
    1606     if (ret)
    1607     goto out;
    1608     @@ -1822,24 +1821,23 @@ retry:
    1609    
    1610     /* If we were woken (and unqueued), we succeeded, whatever. */
    1611     ret = 0;
    1612     + /* unqueue_me() drops q.key ref */
    1613     if (!unqueue_me(&q))
    1614     - goto out_put_key;
    1615     + goto out;
    1616     ret = -ETIMEDOUT;
    1617     if (to && !to->task)
    1618     - goto out_put_key;
    1619     + goto out;
    1620    
    1621     /*
    1622     * We expect signal_pending(current), but we might be the
    1623     * victim of a spurious wakeup as well.
    1624     */
    1625     - if (!signal_pending(current)) {
    1626     - put_futex_key(fshared, &q.key);
    1627     + if (!signal_pending(current))
    1628     goto retry;
    1629     - }
    1630    
    1631     ret = -ERESTARTSYS;
    1632     if (!abs_time)
    1633     - goto out_put_key;
    1634     + goto out;
    1635    
    1636     restart = &current_thread_info()->restart_block;
    1637     restart->fn = futex_wait_restart;
    1638     @@ -1856,8 +1854,6 @@ retry:
    1639    
    1640     ret = -ERESTART_RESTARTBLOCK;
    1641    
    1642     -out_put_key:
    1643     - put_futex_key(fshared, &q.key);
    1644     out:
    1645     if (to) {
    1646     hrtimer_cancel(&to->timer);
    1647     @@ -2236,7 +2232,10 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
    1648     q.rt_waiter = &rt_waiter;
    1649     q.requeue_pi_key = &key2;
    1650    
    1651     - /* Prepare to wait on uaddr. */
    1652     + /*
    1653     + * Prepare to wait on uaddr. On success, increments q.key (key1) ref
    1654     + * count.
    1655     + */
    1656     ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
    1657     if (ret)
    1658     goto out_key2;
    1659     @@ -2254,7 +2253,9 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
    1660     * In order for us to be here, we know our q.key == key2, and since
    1661     * we took the hb->lock above, we also know that futex_requeue() has
    1662     * completed and we no longer have to concern ourselves with a wakeup
    1663     - * race with the atomic proxy lock acquition by the requeue code.
    1664     + * race with the atomic proxy lock acquisition by the requeue code. The
    1665     + * futex_requeue dropped our key1 reference and incremented our key2
    1666     + * reference count.
    1667     */
    1668    
    1669     /* Check if the requeue code acquired the second futex for us. */
    1670     diff --git a/kernel/perf_event.c b/kernel/perf_event.c
    1671     index b98bed3..03bb897 100644
    1672     --- a/kernel/perf_event.c
    1673     +++ b/kernel/perf_event.c
    1674     @@ -1773,7 +1773,13 @@ static u64 perf_event_read(struct perf_event *event)
    1675     unsigned long flags;
    1676    
    1677     raw_spin_lock_irqsave(&ctx->lock, flags);
    1678     - update_context_time(ctx);
    1679     + /*
    1680     + * may read while context is not active
    1681     + * (e.g., thread is blocked), in that case
    1682     + * we cannot update context time
    1683     + */
    1684     + if (ctx->is_active)
    1685     + update_context_time(ctx);
    1686     update_event_times(event);
    1687     raw_spin_unlock_irqrestore(&ctx->lock, flags);
    1688     }
    1689     diff --git a/kernel/sched.c b/kernel/sched.c
    1690     index dc85ceb..3fd774c 100644
    1691     --- a/kernel/sched.c
    1692     +++ b/kernel/sched.c
    1693     @@ -723,7 +723,7 @@ sched_feat_write(struct file *filp, const char __user *ubuf,
    1694     size_t cnt, loff_t *ppos)
    1695     {
    1696     char buf[64];
    1697     - char *cmp = buf;
    1698     + char *cmp;
    1699     int neg = 0;
    1700     int i;
    1701    
    1702     @@ -734,6 +734,7 @@ sched_feat_write(struct file *filp, const char __user *ubuf,
    1703     return -EFAULT;
    1704    
    1705     buf[cnt] = 0;
    1706     + cmp = strstrip(buf);
    1707    
    1708     if (strncmp(buf, "NO_", 3) == 0) {
    1709     neg = 1;
    1710     @@ -741,9 +742,7 @@ sched_feat_write(struct file *filp, const char __user *ubuf,
    1711     }
    1712    
    1713     for (i = 0; sched_feat_names[i]; i++) {
    1714     - int len = strlen(sched_feat_names[i]);
    1715     -
    1716     - if (strncmp(cmp, sched_feat_names[i], len) == 0) {
    1717     + if (strcmp(cmp, sched_feat_names[i]) == 0) {
    1718     if (neg)
    1719     sysctl_sched_features &= ~(1UL << i);
    1720     else
    1721     @@ -1858,12 +1857,6 @@ static void dec_nr_running(struct rq *rq)
    1722    
    1723     static void set_load_weight(struct task_struct *p)
    1724     {
    1725     - if (task_has_rt_policy(p)) {
    1726     - p->se.load.weight = 0;
    1727     - p->se.load.inv_weight = WMULT_CONST;
    1728     - return;
    1729     - }
    1730     -
    1731     /*
    1732     * SCHED_IDLE tasks get minimal weight:
    1733     */
    1734     diff --git a/mm/vmalloc.c b/mm/vmalloc.c
    1735     index 6b8889d..d8087f0 100644
    1736     --- a/mm/vmalloc.c
    1737     +++ b/mm/vmalloc.c
    1738     @@ -517,6 +517,15 @@ static atomic_t vmap_lazy_nr = ATOMIC_INIT(0);
    1739     static void purge_fragmented_blocks_allcpus(void);
    1740    
    1741     /*
    1742     + * called before a call to iounmap() if the caller wants vm_area_struct's
    1743     + * immediately freed.
    1744     + */
    1745     +void set_iounmap_nonlazy(void)
    1746     +{
    1747     + atomic_set(&vmap_lazy_nr, lazy_max_pages()+1);
    1748     +}
    1749     +
    1750     +/*
    1751     * Purges all lazily-freed vmap areas.
    1752     *
    1753     * If sync is 0 then don't purge if there is already a purge in progress.
    1754     diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
    1755     index 0b54b7d..dc60205 100644
    1756     --- a/net/bluetooth/l2cap.c
    1757     +++ b/net/bluetooth/l2cap.c
    1758     @@ -2891,7 +2891,7 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
    1759     struct l2cap_chan_list *list = &conn->chan_list;
    1760     struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
    1761     struct l2cap_conn_rsp rsp;
    1762     - struct sock *parent, *uninitialized_var(sk);
    1763     + struct sock *parent, *sk = NULL;
    1764     int result, status = L2CAP_CS_NO_INFO;
    1765    
    1766     u16 dcid = 0, scid = __le16_to_cpu(req->scid);
    1767     @@ -3000,7 +3000,7 @@ sendresp:
    1768     L2CAP_INFO_REQ, sizeof(info), &info);
    1769     }
    1770    
    1771     - if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT) &&
    1772     + if (sk && !(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT) &&
    1773     result == L2CAP_CR_SUCCESS) {
    1774     u8 buf[128];
    1775     l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
    1776     diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
    1777     index 23b2d6c..364ad16 100644
    1778     --- a/net/netfilter/xt_SECMARK.c
    1779     +++ b/net/netfilter/xt_SECMARK.c
    1780     @@ -101,7 +101,7 @@ static int secmark_tg_check(const struct xt_tgchk_param *par)
    1781     switch (info->mode) {
    1782     case SECMARK_MODE_SEL:
    1783     err = checkentry_selinux(info);
    1784     - if (err <= 0)
    1785     + if (err)
    1786     return err;
    1787     break;
    1788