/[linux-patches]/genpatches-2.6/tags/3.2-6/1000_linux-3.2.1.patch
Gentoo

Contents of /genpatches-2.6/tags/3.2-6/1000_linux-3.2.1.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 2076 - (show annotations) (download)
Thu Feb 2 11:46:07 2012 UTC (2 years, 2 months ago) by mpagano
File size: 59315 byte(s)
3.2-6 release
1 diff --git a/Documentation/HOWTO b/Documentation/HOWTO
2 index 81bc1a9..f7ade3b 100644
3 --- a/Documentation/HOWTO
4 +++ b/Documentation/HOWTO
5 @@ -275,8 +275,8 @@ versions.
6 If no 2.6.x.y kernel is available, then the highest numbered 2.6.x
7 kernel is the current stable kernel.
8
9 -2.6.x.y are maintained by the "stable" team <stable@kernel.org>, and are
10 -released as needs dictate. The normal release period is approximately
11 +2.6.x.y are maintained by the "stable" team <stable@vger.kernel.org>, and
12 +are released as needs dictate. The normal release period is approximately
13 two weeks, but it can be longer if there are no pressing problems. A
14 security-related problem, instead, can cause a release to happen almost
15 instantly.
16 diff --git a/Documentation/development-process/5.Posting b/Documentation/development-process/5.Posting
17 index 903a254..8a48c9b 100644
18 --- a/Documentation/development-process/5.Posting
19 +++ b/Documentation/development-process/5.Posting
20 @@ -271,10 +271,10 @@ copies should go to:
21 the linux-kernel list.
22
23 - If you are fixing a bug, think about whether the fix should go into the
24 - next stable update. If so, stable@kernel.org should get a copy of the
25 - patch. Also add a "Cc: stable@kernel.org" to the tags within the patch
26 - itself; that will cause the stable team to get a notification when your
27 - fix goes into the mainline.
28 + next stable update. If so, stable@vger.kernel.org should get a copy of
29 + the patch. Also add a "Cc: stable@vger.kernel.org" to the tags within
30 + the patch itself; that will cause the stable team to get a notification
31 + when your fix goes into the mainline.
32
33 When selecting recipients for a patch, it is good to have an idea of who
34 you think will eventually accept the patch and get it merged. While it
35 diff --git a/Documentation/usb/usbmon.txt b/Documentation/usb/usbmon.txt
36 index a4efa04..5335fa8 100644
37 --- a/Documentation/usb/usbmon.txt
38 +++ b/Documentation/usb/usbmon.txt
39 @@ -47,10 +47,11 @@ This allows to filter away annoying devices that talk continuously.
40
41 2. Find which bus connects to the desired device
42
43 -Run "cat /proc/bus/usb/devices", and find the T-line which corresponds to
44 -the device. Usually you do it by looking for the vendor string. If you have
45 -many similar devices, unplug one and compare two /proc/bus/usb/devices outputs.
46 -The T-line will have a bus number. Example:
47 +Run "cat /sys/kernel/debug/usb/devices", and find the T-line which corresponds
48 +to the device. Usually you do it by looking for the vendor string. If you have
49 +many similar devices, unplug one and compare the two
50 +/sys/kernel/debug/usb/devices outputs. The T-line will have a bus number.
51 +Example:
52
53 T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
54 D: Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
55 @@ -58,7 +59,10 @@ P: Vendor=0557 ProdID=2004 Rev= 1.00
56 S: Manufacturer=ATEN
57 S: Product=UC100KM V2.00
58
59 -Bus=03 means it's bus 3.
60 +"Bus=03" means it's bus 3. Alternatively, you can look at the output from
61 +"lsusb" and get the bus number from the appropriate line. Example:
62 +
63 +Bus 003 Device 002: ID 0557:2004 ATEN UC100KM V2.00
64
65 3. Start 'cat'
66
67 diff --git a/MAINTAINERS b/MAINTAINERS
68 index 62f1cd3..f986e7d 100644
69 --- a/MAINTAINERS
70 +++ b/MAINTAINERS
71 @@ -6258,7 +6258,7 @@ F: arch/alpha/kernel/srm_env.c
72
73 STABLE BRANCH
74 M: Greg Kroah-Hartman <greg@kroah.com>
75 -L: stable@kernel.org
76 +L: stable@vger.kernel.org
77 S: Maintained
78
79 STAGING SUBSYSTEM
80 diff --git a/Makefile b/Makefile
81 index adddd11..c5edffa 100644
82 --- a/Makefile
83 +++ b/Makefile
84 @@ -1,6 +1,6 @@
85 VERSION = 3
86 PATCHLEVEL = 2
87 -SUBLEVEL = 0
88 +SUBLEVEL = 1
89 EXTRAVERSION =
90 NAME = Saber-toothed Squirrel
91
92 diff --git a/arch/powerpc/include/asm/time.h b/arch/powerpc/include/asm/time.h
93 index fe6f7c2..bc3c745 100644
94 --- a/arch/powerpc/include/asm/time.h
95 +++ b/arch/powerpc/include/asm/time.h
96 @@ -219,5 +219,7 @@ DECLARE_PER_CPU(struct cpu_usage, cpu_usage_array);
97 extern void secondary_cpu_time_init(void);
98 extern void iSeries_time_init_early(void);
99
100 +extern void decrementer_check_overflow(void);
101 +
102 #endif /* __KERNEL__ */
103 #endif /* __POWERPC_TIME_H */
104 diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
105 index 5c3c469..745c1e7 100644
106 --- a/arch/powerpc/kernel/irq.c
107 +++ b/arch/powerpc/kernel/irq.c
108 @@ -164,16 +164,13 @@ notrace void arch_local_irq_restore(unsigned long en)
109 */
110 local_paca->hard_enabled = en;
111
112 -#ifndef CONFIG_BOOKE
113 - /* On server, re-trigger the decrementer if it went negative since
114 - * some processors only trigger on edge transitions of the sign bit.
115 - *
116 - * BookE has a level sensitive decrementer (latches in TSR) so we
117 - * don't need that
118 + /*
119 + * Trigger the decrementer if we have a pending event. Some processors
120 + * only trigger on edge transitions of the sign bit. We might also
121 + * have disabled interrupts long enough that the decrementer wrapped
122 + * to positive.
123 */
124 - if ((int)mfspr(SPRN_DEC) < 0)
125 - mtspr(SPRN_DEC, 1);
126 -#endif /* CONFIG_BOOKE */
127 + decrementer_check_overflow();
128
129 /*
130 * Force the delivery of pending soft-disabled interrupts on PS3.
131 diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
132 index 522bb1d..5db163c 100644
133 --- a/arch/powerpc/kernel/time.c
134 +++ b/arch/powerpc/kernel/time.c
135 @@ -889,6 +889,15 @@ static void __init clocksource_init(void)
136 clock->name, clock->mult, clock->shift);
137 }
138
139 +void decrementer_check_overflow(void)
140 +{
141 + u64 now = get_tb_or_rtc();
142 + struct decrementer_clock *decrementer = &__get_cpu_var(decrementers);
143 +
144 + if (now >= decrementer->next_tb)
145 + set_dec(1);
146 +}
147 +
148 static int decrementer_set_next_event(unsigned long evt,
149 struct clock_event_device *dev)
150 {
151 diff --git a/arch/powerpc/platforms/pseries/hvCall_inst.c b/arch/powerpc/platforms/pseries/hvCall_inst.c
152 index f106662..c9311cf 100644
153 --- a/arch/powerpc/platforms/pseries/hvCall_inst.c
154 +++ b/arch/powerpc/platforms/pseries/hvCall_inst.c
155 @@ -109,7 +109,7 @@ static void probe_hcall_entry(void *ignored, unsigned long opcode, unsigned long
156 if (opcode > MAX_HCALL_OPCODE)
157 return;
158
159 - h = &get_cpu_var(hcall_stats)[opcode / 4];
160 + h = &__get_cpu_var(hcall_stats)[opcode / 4];
161 h->tb_start = mftb();
162 h->purr_start = mfspr(SPRN_PURR);
163 }
164 @@ -126,8 +126,6 @@ static void probe_hcall_exit(void *ignored, unsigned long opcode, unsigned long
165 h->num_calls++;
166 h->tb_total += mftb() - h->tb_start;
167 h->purr_total += mfspr(SPRN_PURR) - h->purr_start;
168 -
169 - put_cpu_var(hcall_stats);
170 }
171
172 static int __init hcall_inst_init(void)
173 diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
174 index 27a4950..dc36ea6 100644
175 --- a/arch/powerpc/platforms/pseries/lpar.c
176 +++ b/arch/powerpc/platforms/pseries/lpar.c
177 @@ -554,6 +554,7 @@ void __trace_hcall_entry(unsigned long opcode, unsigned long *args)
178 goto out;
179
180 (*depth)++;
181 + preempt_disable();
182 trace_hcall_entry(opcode, args);
183 (*depth)--;
184
185 @@ -576,6 +577,7 @@ void __trace_hcall_exit(long opcode, unsigned long retval,
186
187 (*depth)++;
188 trace_hcall_exit(opcode, retval, retbuf);
189 + preempt_enable();
190 (*depth)--;
191
192 out:
193 diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
194 index 06ed6b4..3719c94 100644
195 --- a/drivers/base/firmware_class.c
196 +++ b/drivers/base/firmware_class.c
197 @@ -226,13 +226,13 @@ static ssize_t firmware_loading_store(struct device *dev,
198 int loading = simple_strtol(buf, NULL, 10);
199 int i;
200
201 + mutex_lock(&fw_lock);
202 +
203 + if (!fw_priv->fw)
204 + goto out;
205 +
206 switch (loading) {
207 case 1:
208 - mutex_lock(&fw_lock);
209 - if (!fw_priv->fw) {
210 - mutex_unlock(&fw_lock);
211 - break;
212 - }
213 firmware_free_data(fw_priv->fw);
214 memset(fw_priv->fw, 0, sizeof(struct firmware));
215 /* If the pages are not owned by 'struct firmware' */
216 @@ -243,7 +243,6 @@ static ssize_t firmware_loading_store(struct device *dev,
217 fw_priv->page_array_size = 0;
218 fw_priv->nr_pages = 0;
219 set_bit(FW_STATUS_LOADING, &fw_priv->status);
220 - mutex_unlock(&fw_lock);
221 break;
222 case 0:
223 if (test_bit(FW_STATUS_LOADING, &fw_priv->status)) {
224 @@ -274,7 +273,8 @@ static ssize_t firmware_loading_store(struct device *dev,
225 fw_load_abort(fw_priv);
226 break;
227 }
228 -
229 +out:
230 + mutex_unlock(&fw_lock);
231 return count;
232 }
233
234 diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
235 index 30a3085..fda56bd 100644
236 --- a/drivers/bcma/bcma_private.h
237 +++ b/drivers/bcma/bcma_private.h
238 @@ -18,6 +18,9 @@ void bcma_bus_unregister(struct bcma_bus *bus);
239 int __init bcma_bus_early_register(struct bcma_bus *bus,
240 struct bcma_device *core_cc,
241 struct bcma_device *core_mips);
242 +#ifdef CONFIG_PM
243 +int bcma_bus_resume(struct bcma_bus *bus);
244 +#endif
245
246 /* scan.c */
247 int bcma_bus_scan(struct bcma_bus *bus);
248 diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
249 index 1b51d8b..990f5a8 100644
250 --- a/drivers/bcma/host_pci.c
251 +++ b/drivers/bcma/host_pci.c
252 @@ -224,6 +224,41 @@ static void bcma_host_pci_remove(struct pci_dev *dev)
253 pci_set_drvdata(dev, NULL);
254 }
255
256 +#ifdef CONFIG_PM
257 +static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
258 +{
259 + /* Host specific */
260 + pci_save_state(dev);
261 + pci_disable_device(dev);
262 + pci_set_power_state(dev, pci_choose_state(dev, state));
263 +
264 + return 0;
265 +}
266 +
267 +static int bcma_host_pci_resume(struct pci_dev *dev)
268 +{
269 + struct bcma_bus *bus = pci_get_drvdata(dev);
270 + int err;
271 +
272 + /* Host specific */
273 + pci_set_power_state(dev, 0);
274 + err = pci_enable_device(dev);
275 + if (err)
276 + return err;
277 + pci_restore_state(dev);
278 +
279 + /* Bus specific */
280 + err = bcma_bus_resume(bus);
281 + if (err)
282 + return err;
283 +
284 + return 0;
285 +}
286 +#else /* CONFIG_PM */
287 +# define bcma_host_pci_suspend NULL
288 +# define bcma_host_pci_resume NULL
289 +#endif /* CONFIG_PM */
290 +
291 static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
292 { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
293 { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
294 @@ -239,6 +274,8 @@ static struct pci_driver bcma_pci_bridge_driver = {
295 .id_table = bcma_pci_bridge_tbl,
296 .probe = bcma_host_pci_probe,
297 .remove = bcma_host_pci_remove,
298 + .suspend = bcma_host_pci_suspend,
299 + .resume = bcma_host_pci_resume,
300 };
301
302 int __init bcma_host_pci_init(void)
303 diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
304 index 70c84b9..10f92b3 100644
305 --- a/drivers/bcma/main.c
306 +++ b/drivers/bcma/main.c
307 @@ -240,6 +240,22 @@ int __init bcma_bus_early_register(struct bcma_bus *bus,
308 return 0;
309 }
310
311 +#ifdef CONFIG_PM
312 +int bcma_bus_resume(struct bcma_bus *bus)
313 +{
314 + struct bcma_device *core;
315 +
316 + /* Init CC core */
317 + core = bcma_find_core(bus, BCMA_CORE_CHIPCOMMON);
318 + if (core) {
319 + bus->drv_cc.setup_done = false;
320 + bcma_core_chipcommon_init(&bus->drv_cc);
321 + }
322 +
323 + return 0;
324 +}
325 +#endif
326 +
327 int __bcma_driver_register(struct bcma_driver *drv, struct module *owner)
328 {
329 drv->drv.name = drv->name;
330 diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
331 index 0c048dd..d2d0a2a 100644
332 --- a/drivers/hv/vmbus_drv.c
333 +++ b/drivers/hv/vmbus_drv.c
334 @@ -62,6 +62,14 @@ struct hv_device_info {
335 struct hv_dev_port_info outbound;
336 };
337
338 +static int vmbus_exists(void)
339 +{
340 + if (hv_acpi_dev == NULL)
341 + return -ENODEV;
342 +
343 + return 0;
344 +}
345 +
346
347 static void get_channel_info(struct hv_device *device,
348 struct hv_device_info *info)
349 @@ -590,6 +598,10 @@ int __vmbus_driver_register(struct hv_driver *hv_driver, struct module *owner, c
350
351 pr_info("registering driver %s\n", hv_driver->name);
352
353 + ret = vmbus_exists();
354 + if (ret < 0)
355 + return ret;
356 +
357 hv_driver->driver.name = hv_driver->name;
358 hv_driver->driver.owner = owner;
359 hv_driver->driver.mod_name = mod_name;
360 @@ -614,8 +626,8 @@ void vmbus_driver_unregister(struct hv_driver *hv_driver)
361 {
362 pr_info("unregistering driver %s\n", hv_driver->name);
363
364 - driver_unregister(&hv_driver->driver);
365 -
366 + if (!vmbus_exists())
367 + driver_unregister(&hv_driver->driver);
368 }
369 EXPORT_SYMBOL_GPL(vmbus_driver_unregister);
370
371 @@ -776,6 +788,7 @@ static int __init hv_acpi_init(void)
372
373 cleanup:
374 acpi_bus_unregister_driver(&vmbus_acpi_driver);
375 + hv_acpi_dev = NULL;
376 return ret;
377 }
378
379 diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
380 index 254f164..e3db8ef 100644
381 --- a/drivers/infiniband/core/uverbs_cmd.c
382 +++ b/drivers/infiniband/core/uverbs_cmd.c
383 @@ -241,11 +241,24 @@ static struct ib_qp *idr_read_qp(int qp_handle, struct ib_ucontext *context)
384 return idr_read_obj(&ib_uverbs_qp_idr, qp_handle, context, 0);
385 }
386
387 +static struct ib_qp *idr_write_qp(int qp_handle, struct ib_ucontext *context)
388 +{
389 + struct ib_uobject *uobj;
390 +
391 + uobj = idr_write_uobj(&ib_uverbs_qp_idr, qp_handle, context);
392 + return uobj ? uobj->object : NULL;
393 +}
394 +
395 static void put_qp_read(struct ib_qp *qp)
396 {
397 put_uobj_read(qp->uobject);
398 }
399
400 +static void put_qp_write(struct ib_qp *qp)
401 +{
402 + put_uobj_write(qp->uobject);
403 +}
404 +
405 static struct ib_srq *idr_read_srq(int srq_handle, struct ib_ucontext *context)
406 {
407 return idr_read_obj(&ib_uverbs_srq_idr, srq_handle, context, 0);
408 @@ -2375,7 +2388,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
409 if (copy_from_user(&cmd, buf, sizeof cmd))
410 return -EFAULT;
411
412 - qp = idr_read_qp(cmd.qp_handle, file->ucontext);
413 + qp = idr_write_qp(cmd.qp_handle, file->ucontext);
414 if (!qp)
415 return -EINVAL;
416
417 @@ -2404,7 +2417,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
418 kfree(mcast);
419
420 out_put:
421 - put_qp_read(qp);
422 + put_qp_write(qp);
423
424 return ret ? ret : in_len;
425 }
426 @@ -2422,7 +2435,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
427 if (copy_from_user(&cmd, buf, sizeof cmd))
428 return -EFAULT;
429
430 - qp = idr_read_qp(cmd.qp_handle, file->ucontext);
431 + qp = idr_write_qp(cmd.qp_handle, file->ucontext);
432 if (!qp)
433 return -EINVAL;
434
435 @@ -2441,7 +2454,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
436 }
437
438 out_put:
439 - put_qp_read(qp);
440 + put_qp_write(qp);
441
442 return ret ? ret : in_len;
443 }
444 diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
445 index 781a802..4f18e2d 100644
446 --- a/drivers/infiniband/hw/qib/qib_iba6120.c
447 +++ b/drivers/infiniband/hw/qib/qib_iba6120.c
448 @@ -2076,9 +2076,11 @@ static void qib_6120_config_ctxts(struct qib_devdata *dd)
449 static void qib_update_6120_usrhead(struct qib_ctxtdata *rcd, u64 hd,
450 u32 updegr, u32 egrhd, u32 npkts)
451 {
452 - qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
453 if (updegr)
454 qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
455 + mmiowb();
456 + qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
457 + mmiowb();
458 }
459
460 static u32 qib_6120_hdrqempty(struct qib_ctxtdata *rcd)
461 diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
462 index 439d3c5..7ec4048 100644
463 --- a/drivers/infiniband/hw/qib/qib_iba7220.c
464 +++ b/drivers/infiniband/hw/qib/qib_iba7220.c
465 @@ -2725,9 +2725,11 @@ static int qib_7220_set_loopback(struct qib_pportdata *ppd, const char *what)
466 static void qib_update_7220_usrhead(struct qib_ctxtdata *rcd, u64 hd,
467 u32 updegr, u32 egrhd, u32 npkts)
468 {
469 - qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
470 if (updegr)
471 qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
472 + mmiowb();
473 + qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
474 + mmiowb();
475 }
476
477 static u32 qib_7220_hdrqempty(struct qib_ctxtdata *rcd)
478 diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
479 index 1d58959..5a070e8 100644
480 --- a/drivers/infiniband/hw/qib/qib_iba7322.c
481 +++ b/drivers/infiniband/hw/qib/qib_iba7322.c
482 @@ -4082,10 +4082,12 @@ static void qib_update_7322_usrhead(struct qib_ctxtdata *rcd, u64 hd,
483 */
484 if (hd >> IBA7322_HDRHEAD_PKTINT_SHIFT)
485 adjust_rcv_timeout(rcd, npkts);
486 - qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
487 - qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
488 if (updegr)
489 qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
490 + mmiowb();
491 + qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
492 + qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
493 + mmiowb();
494 }
495
496 static u32 qib_7322_hdrqempty(struct qib_ctxtdata *rcd)
497 diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
498 index 7f87568..e58aa2b 100644
499 --- a/drivers/net/bonding/bond_main.c
500 +++ b/drivers/net/bonding/bond_main.c
501 @@ -1822,7 +1822,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
502 "but new slave device does not support netpoll.\n",
503 bond_dev->name);
504 res = -EBUSY;
505 - goto err_close;
506 + goto err_detach;
507 }
508 }
509 #endif
510 @@ -1831,7 +1831,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
511
512 res = bond_create_slave_symlinks(bond_dev, slave_dev);
513 if (res)
514 - goto err_close;
515 + goto err_detach;
516
517 res = netdev_rx_handler_register(slave_dev, bond_handle_frame,
518 new_slave);
519 @@ -1852,6 +1852,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
520 err_dest_symlinks:
521 bond_destroy_slave_symlinks(bond_dev, slave_dev);
522
523 +err_detach:
524 + write_lock_bh(&bond->lock);
525 + bond_detach_slave(bond, new_slave);
526 + write_unlock_bh(&bond->lock);
527 +
528 err_close:
529 dev_close(slave_dev);
530
531 diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
532 index e95f0e6..dd2625a 100644
533 --- a/drivers/net/usb/asix.c
534 +++ b/drivers/net/usb/asix.c
535 @@ -376,7 +376,7 @@ static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
536
537 skb_pull(skb, (size + 1) & 0xfffe);
538
539 - if (skb->len == 0)
540 + if (skb->len < sizeof(header))
541 break;
542
543 head = (u8 *) skb->data;
544 diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
545 index 69d5f85..8b9ff28 100644
546 --- a/drivers/net/wireless/iwlwifi/iwl-commands.h
547 +++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
548 @@ -809,7 +809,7 @@ struct iwl_qosparam_cmd {
549 #define IWLAGN_STATION_COUNT 16
550
551 #define IWL_INVALID_STATION 255
552 -#define IWL_MAX_TID_COUNT 9
553 +#define IWL_MAX_TID_COUNT 8
554
555 #define STA_FLG_TX_RATE_MSK cpu_to_le32(1 << 2)
556 #define STA_FLG_PWR_SAVE_MSK cpu_to_le32(1 << 8)
557 diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
558 index 2b6756e..5c29281 100644
559 --- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
560 +++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
561 @@ -219,9 +219,7 @@ struct iwl_trans_pcie {
562
563 /* INT ICT Table */
564 __le32 *ict_tbl;
565 - void *ict_tbl_vir;
566 dma_addr_t ict_tbl_dma;
567 - dma_addr_t aligned_ict_tbl_dma;
568 int ict_index;
569 u32 inta;
570 bool use_ict;
571 diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
572 index 374c68c..1920237 100644
573 --- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
574 +++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
575 @@ -1136,7 +1136,11 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
576 * ICT functions
577 *
578 ******************************************************************************/
579 -#define ICT_COUNT (PAGE_SIZE/sizeof(u32))
580 +
581 +/* a device (PCI-E) page is 4096 bytes long */
582 +#define ICT_SHIFT 12
583 +#define ICT_SIZE (1 << ICT_SHIFT)
584 +#define ICT_COUNT (ICT_SIZE / sizeof(u32))
585
586 /* Free dram table */
587 void iwl_free_isr_ict(struct iwl_trans *trans)
588 @@ -1144,21 +1148,19 @@ void iwl_free_isr_ict(struct iwl_trans *trans)
589 struct iwl_trans_pcie *trans_pcie =
590 IWL_TRANS_GET_PCIE_TRANS(trans);
591
592 - if (trans_pcie->ict_tbl_vir) {
593 - dma_free_coherent(bus(trans)->dev,
594 - (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
595 - trans_pcie->ict_tbl_vir,
596 + if (trans_pcie->ict_tbl) {
597 + dma_free_coherent(bus(trans)->dev, ICT_SIZE,
598 + trans_pcie->ict_tbl,
599 trans_pcie->ict_tbl_dma);
600 - trans_pcie->ict_tbl_vir = NULL;
601 - memset(&trans_pcie->ict_tbl_dma, 0,
602 - sizeof(trans_pcie->ict_tbl_dma));
603 - memset(&trans_pcie->aligned_ict_tbl_dma, 0,
604 - sizeof(trans_pcie->aligned_ict_tbl_dma));
605 + trans_pcie->ict_tbl = NULL;
606 + trans_pcie->ict_tbl_dma = 0;
607 }
608 }
609
610
611 -/* allocate dram shared table it is a PAGE_SIZE aligned
612 +/*
613 + * allocate dram shared table, it is an aligned memory
614 + * block of ICT_SIZE.
615 * also reset all data related to ICT table interrupt.
616 */
617 int iwl_alloc_isr_ict(struct iwl_trans *trans)
618 @@ -1166,36 +1168,26 @@ int iwl_alloc_isr_ict(struct iwl_trans *trans)
619 struct iwl_trans_pcie *trans_pcie =
620 IWL_TRANS_GET_PCIE_TRANS(trans);
621
622 - /* allocate shrared data table */
623 - trans_pcie->ict_tbl_vir =
624 - dma_alloc_coherent(bus(trans)->dev,
625 - (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
626 - &trans_pcie->ict_tbl_dma, GFP_KERNEL);
627 - if (!trans_pcie->ict_tbl_vir)
628 + trans_pcie->ict_tbl =
629 + dma_alloc_coherent(bus(trans)->dev, ICT_SIZE,
630 + &trans_pcie->ict_tbl_dma,
631 + GFP_KERNEL);
632 + if (!trans_pcie->ict_tbl)
633 return -ENOMEM;
634
635 - /* align table to PAGE_SIZE boundary */
636 - trans_pcie->aligned_ict_tbl_dma =
637 - ALIGN(trans_pcie->ict_tbl_dma, PAGE_SIZE);
638 -
639 - IWL_DEBUG_ISR(trans, "ict dma addr %Lx dma aligned %Lx diff %d\n",
640 - (unsigned long long)trans_pcie->ict_tbl_dma,
641 - (unsigned long long)trans_pcie->aligned_ict_tbl_dma,
642 - (int)(trans_pcie->aligned_ict_tbl_dma -
643 - trans_pcie->ict_tbl_dma));
644 + /* just an API sanity check ... it is guaranteed to be aligned */
645 + if (WARN_ON(trans_pcie->ict_tbl_dma & (ICT_SIZE - 1))) {
646 + iwl_free_isr_ict(trans);
647 + return -EINVAL;
648 + }
649
650 - trans_pcie->ict_tbl = trans_pcie->ict_tbl_vir +
651 - (trans_pcie->aligned_ict_tbl_dma -
652 - trans_pcie->ict_tbl_dma);
653 + IWL_DEBUG_ISR(trans, "ict dma addr %Lx\n",
654 + (unsigned long long)trans_pcie->ict_tbl_dma);
655
656 - IWL_DEBUG_ISR(trans, "ict vir addr %p vir aligned %p diff %d\n",
657 - trans_pcie->ict_tbl, trans_pcie->ict_tbl_vir,
658 - (int)(trans_pcie->aligned_ict_tbl_dma -
659 - trans_pcie->ict_tbl_dma));
660 + IWL_DEBUG_ISR(trans, "ict vir addr %p\n", trans_pcie->ict_tbl);
661
662 /* reset table and index to all 0 */
663 - memset(trans_pcie->ict_tbl_vir, 0,
664 - (sizeof(u32) * ICT_COUNT) + PAGE_SIZE);
665 + memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
666 trans_pcie->ict_index = 0;
667
668 /* add periodic RX interrupt */
669 @@ -1213,23 +1205,20 @@ int iwl_reset_ict(struct iwl_trans *trans)
670 struct iwl_trans_pcie *trans_pcie =
671 IWL_TRANS_GET_PCIE_TRANS(trans);
672
673 - if (!trans_pcie->ict_tbl_vir)
674 + if (!trans_pcie->ict_tbl)
675 return 0;
676
677 spin_lock_irqsave(&trans->shrd->lock, flags);
678 iwl_disable_interrupts(trans);
679
680 - memset(&trans_pcie->ict_tbl[0], 0, sizeof(u32) * ICT_COUNT);
681 + memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
682
683 - val = trans_pcie->aligned_ict_tbl_dma >> PAGE_SHIFT;
684 + val = trans_pcie->ict_tbl_dma >> ICT_SHIFT;
685
686 val |= CSR_DRAM_INT_TBL_ENABLE;
687 val |= CSR_DRAM_INIT_TBL_WRAP_CHECK;
688
689 - IWL_DEBUG_ISR(trans, "CSR_DRAM_INT_TBL_REG =0x%X "
690 - "aligned dma address %Lx\n",
691 - val,
692 - (unsigned long long)trans_pcie->aligned_ict_tbl_dma);
693 + IWL_DEBUG_ISR(trans, "CSR_DRAM_INT_TBL_REG =0x%x\n", val);
694
695 iwl_write32(bus(trans), CSR_DRAM_INT_TBL_REG, val);
696 trans_pcie->use_ict = true;
697 diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
698 index a7f1ab2..db64ef1 100644
699 --- a/drivers/net/wireless/libertas/cfg.c
700 +++ b/drivers/net/wireless/libertas/cfg.c
701 @@ -728,9 +728,11 @@ static void lbs_scan_worker(struct work_struct *work)
702 le16_to_cpu(scan_cmd->hdr.size),
703 lbs_ret_scan, 0);
704
705 - if (priv->scan_channel >= priv->scan_req->n_channels)
706 + if (priv->scan_channel >= priv->scan_req->n_channels) {
707 /* Mark scan done */
708 + cancel_delayed_work(&priv->scan_work);
709 lbs_scan_done(priv);
710 + }
711
712 /* Restart network */
713 if (carrier)
714 @@ -759,12 +761,12 @@ static void _internal_start_scan(struct lbs_private *priv, bool internal,
715 request->n_ssids, request->n_channels, request->ie_len);
716
717 priv->scan_channel = 0;
718 - queue_delayed_work(priv->work_thread, &priv->scan_work,
719 - msecs_to_jiffies(50));
720 -
721 priv->scan_req = request;
722 priv->internal_scan = internal;
723
724 + queue_delayed_work(priv->work_thread, &priv->scan_work,
725 + msecs_to_jiffies(50));
726 +
727 lbs_deb_leave(LBS_DEB_CFG80211);
728 }
729
730 diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
731 index 3778763..3265b34 100644
732 --- a/drivers/net/wireless/rt2x00/rt2800usb.c
733 +++ b/drivers/net/wireless/rt2x00/rt2800usb.c
734 @@ -976,6 +976,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
735 { USB_DEVICE(0x13b1, 0x0031) },
736 { USB_DEVICE(0x1737, 0x0070) },
737 { USB_DEVICE(0x1737, 0x0071) },
738 + { USB_DEVICE(0x1737, 0x0077) },
739 /* Logitec */
740 { USB_DEVICE(0x0789, 0x0162) },
741 { USB_DEVICE(0x0789, 0x0163) },
742 @@ -1171,7 +1172,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
743 { USB_DEVICE(0x1740, 0x0605) },
744 { USB_DEVICE(0x1740, 0x0615) },
745 /* Linksys */
746 - { USB_DEVICE(0x1737, 0x0077) },
747 { USB_DEVICE(0x1737, 0x0078) },
748 /* Logitec */
749 { USB_DEVICE(0x0789, 0x0168) },
750 diff --git a/drivers/net/wireless/wl12xx/boot.c b/drivers/net/wireless/wl12xx/boot.c
751 index 6813379..a7b327d 100644
752 --- a/drivers/net/wireless/wl12xx/boot.c
753 +++ b/drivers/net/wireless/wl12xx/boot.c
754 @@ -347,6 +347,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
755 nvs_ptr += 3;
756
757 for (i = 0; i < burst_len; i++) {
758 + if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len)
759 + goto out_badnvs;
760 +
761 val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
762 | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
763
764 @@ -358,6 +361,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
765 nvs_ptr += 4;
766 dest_addr += 4;
767 }
768 +
769 + if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
770 + goto out_badnvs;
771 }
772
773 /*
774 @@ -369,6 +375,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
775 */
776 nvs_ptr = (u8 *)wl->nvs +
777 ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4);
778 +
779 + if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
780 + goto out_badnvs;
781 +
782 nvs_len -= nvs_ptr - (u8 *)wl->nvs;
783
784 /* Now we must set the partition correctly */
785 @@ -384,6 +394,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
786
787 kfree(nvs_aligned);
788 return 0;
789 +
790 +out_badnvs:
791 + wl1271_error("nvs data is malformed");
792 + return -EILSEQ;
793 }
794
795 static void wl1271_boot_enable_interrupts(struct wl1271 *wl)
796 diff --git a/drivers/net/wireless/wl12xx/cmd.c b/drivers/net/wireless/wl12xx/cmd.c
797 index a52299e..54a0d66 100644
798 --- a/drivers/net/wireless/wl12xx/cmd.c
799 +++ b/drivers/net/wireless/wl12xx/cmd.c
800 @@ -120,6 +120,11 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
801 if (!wl->nvs)
802 return -ENODEV;
803
804 + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
805 + wl1271_warning("FEM index from INI out of bounds");
806 + return -EINVAL;
807 + }
808 +
809 gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
810 if (!gen_parms)
811 return -ENOMEM;
812 @@ -143,6 +148,12 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
813 gp->tx_bip_fem_manufacturer =
814 gen_parms->general_params.tx_bip_fem_manufacturer;
815
816 + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
817 + wl1271_warning("FEM index from FW out of bounds");
818 + ret = -EINVAL;
819 + goto out;
820 + }
821 +
822 wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
823 answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
824
825 @@ -162,6 +173,11 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
826 if (!wl->nvs)
827 return -ENODEV;
828
829 + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
830 + wl1271_warning("FEM index from ini out of bounds");
831 + return -EINVAL;
832 + }
833 +
834 gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
835 if (!gen_parms)
836 return -ENOMEM;
837 @@ -186,6 +202,12 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
838 gp->tx_bip_fem_manufacturer =
839 gen_parms->general_params.tx_bip_fem_manufacturer;
840
841 + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
842 + wl1271_warning("FEM index from FW out of bounds");
843 + ret = -EINVAL;
844 + goto out;
845 + }
846 +
847 wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
848 answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
849
850 diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c
851 index 4ae8eff..abfb120 100644
852 --- a/drivers/net/wireless/wl12xx/testmode.c
853 +++ b/drivers/net/wireless/wl12xx/testmode.c
854 @@ -36,6 +36,7 @@ enum wl1271_tm_commands {
855 WL1271_TM_CMD_TEST,
856 WL1271_TM_CMD_INTERROGATE,
857 WL1271_TM_CMD_CONFIGURE,
858 + WL1271_TM_CMD_NVS_PUSH, /* Not in use. Keep to not break ABI */
859 WL1271_TM_CMD_SET_PLT_MODE,
860 WL1271_TM_CMD_RECOVER,
861
862 diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
863 index 4c823f3..90c8e3a 100644
864 --- a/drivers/tty/serial/atmel_serial.c
865 +++ b/drivers/tty/serial/atmel_serial.c
866 @@ -212,8 +212,9 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
867 {
868 struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
869 unsigned int mode;
870 + unsigned long flags;
871
872 - spin_lock(&port->lock);
873 + spin_lock_irqsave(&port->lock, flags);
874
875 /* Disable interrupts */
876 UART_PUT_IDR(port, atmel_port->tx_done_mask);
877 @@ -244,7 +245,7 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
878 /* Enable interrupts */
879 UART_PUT_IER(port, atmel_port->tx_done_mask);
880
881 - spin_unlock(&port->lock);
882 + spin_unlock_irqrestore(&port->lock, flags);
883
884 }
885
886 diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
887 index a8078d0..e61d9c4 100644
888 --- a/drivers/usb/class/cdc-acm.c
889 +++ b/drivers/usb/class/cdc-acm.c
890 @@ -554,10 +554,18 @@ static void acm_port_down(struct acm *acm)
891
892 static void acm_tty_hangup(struct tty_struct *tty)
893 {
894 - struct acm *acm = tty->driver_data;
895 - tty_port_hangup(&acm->port);
896 + struct acm *acm;
897 +
898 mutex_lock(&open_mutex);
899 + acm = tty->driver_data;
900 +
901 + if (!acm)
902 + goto out;
903 +
904 + tty_port_hangup(&acm->port);
905 acm_port_down(acm);
906 +
907 +out:
908 mutex_unlock(&open_mutex);
909 }
910
911 @@ -1183,6 +1191,8 @@ made_compressed_probe:
912 i = device_create_file(&intf->dev, &dev_attr_wCountryCodes);
913 if (i < 0) {
914 kfree(acm->country_codes);
915 + acm->country_codes = NULL;
916 + acm->country_code_size = 0;
917 goto skip_countries;
918 }
919
920 @@ -1191,6 +1201,8 @@ made_compressed_probe:
921 if (i < 0) {
922 device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
923 kfree(acm->country_codes);
924 + acm->country_codes = NULL;
925 + acm->country_code_size = 0;
926 goto skip_countries;
927 }
928 }
929 diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
930 index e3beaf2..7abf060 100644
931 --- a/drivers/usb/core/devio.c
932 +++ b/drivers/usb/core/devio.c
933 @@ -249,7 +249,8 @@ static struct async *alloc_async(unsigned int numisoframes)
934 static void free_async(struct async *as)
935 {
936 put_pid(as->pid);
937 - put_cred(as->cred);
938 + if (as->cred)
939 + put_cred(as->cred);
940 kfree(as->urb->transfer_buffer);
941 kfree(as->urb->setup_packet);
942 usb_free_urb(as->urb);
943 diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
944 index 13222d3..179e364 100644
945 --- a/drivers/usb/core/hcd.c
946 +++ b/drivers/usb/core/hcd.c
947 @@ -1412,11 +1412,10 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
948 ret = -EAGAIN;
949 else
950 urb->transfer_flags |= URB_DMA_MAP_SG;
951 - if (n != urb->num_sgs) {
952 - urb->num_sgs = n;
953 + urb->num_mapped_sgs = n;
954 + if (n != urb->num_sgs)
955 urb->transfer_flags |=
956 URB_DMA_SG_COMBINED;
957 - }
958 } else if (urb->sg) {
959 struct scatterlist *sg = urb->sg;
960 urb->transfer_dma = dma_map_page(
961 diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
962 index ecf12e1..4c65eb6 100644
963 --- a/drivers/usb/core/quirks.c
964 +++ b/drivers/usb/core/quirks.c
965 @@ -117,9 +117,12 @@ static const struct usb_device_id usb_quirk_list[] = {
966 { USB_DEVICE(0x06a3, 0x0006), .driver_info =
967 USB_QUIRK_CONFIG_INTF_STRINGS },
968
969 - /* Guillemot Webcam Hercules Dualpix Exchange*/
970 + /* Guillemot Webcam Hercules Dualpix Exchange (2nd ID) */
971 { USB_DEVICE(0x06f8, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME },
972
973 + /* Guillemot Webcam Hercules Dualpix Exchange*/
974 + { USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME },
975 +
976 /* M-Systems Flash Disk Pioneers */
977 { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
978
979 diff --git a/drivers/usb/host/ehci-pxa168.c b/drivers/usb/host/ehci-pxa168.c
980 index ac0c16e..8d0e7a2 100644
981 --- a/drivers/usb/host/ehci-pxa168.c
982 +++ b/drivers/usb/host/ehci-pxa168.c
983 @@ -299,7 +299,7 @@ static int __devinit ehci_pxa168_drv_probe(struct platform_device *pdev)
984 ehci = hcd_to_ehci(hcd);
985 ehci->caps = hcd->regs + 0x100;
986 ehci->regs = hcd->regs + 0x100 +
987 - HC_LENGTH(ehci_readl(ehci, &ehci->caps->hc_capbase));
988 + HC_LENGTH(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase));
989 ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
990 hcd->has_tt = 1;
991 ehci->sbrn = 0x20;
992 diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
993 index 4e4066c..fef1db3 100644
994 --- a/drivers/usb/host/ehci-q.c
995 +++ b/drivers/usb/host/ehci-q.c
996 @@ -647,7 +647,7 @@ qh_urb_transaction (
997 /*
998 * data transfer stage: buffer setup
999 */
1000 - i = urb->num_sgs;
1001 + i = urb->num_mapped_sgs;
1002 if (len > 0 && i > 0) {
1003 sg = urb->sg;
1004 buf = sg_dma_address(sg);
1005 diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
1006 index f6ca80e..d2c6f5a 100644
1007 --- a/drivers/usb/host/uhci-q.c
1008 +++ b/drivers/usb/host/uhci-q.c
1009 @@ -943,7 +943,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
1010 if (usb_pipein(urb->pipe))
1011 status |= TD_CTRL_SPD;
1012
1013 - i = urb->num_sgs;
1014 + i = urb->num_mapped_sgs;
1015 if (len > 0 && i > 0) {
1016 sg = urb->sg;
1017 data = sg_dma_address(sg);
1018 diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
1019 index a403b53..76083ae 100644
1020 --- a/drivers/usb/host/whci/qset.c
1021 +++ b/drivers/usb/host/whci/qset.c
1022 @@ -443,7 +443,7 @@ static int qset_add_urb_sg(struct whc *whc, struct whc_qset *qset, struct urb *u
1023
1024 remaining = urb->transfer_buffer_length;
1025
1026 - for_each_sg(urb->sg, sg, urb->num_sgs, i) {
1027 + for_each_sg(urb->sg, sg, urb->num_mapped_sgs, i) {
1028 dma_addr_t dma_addr;
1029 size_t dma_remaining;
1030 dma_addr_t sp, ep;
1031 @@ -561,7 +561,7 @@ static int qset_add_urb_sg_linearize(struct whc *whc, struct whc_qset *qset,
1032
1033 remaining = urb->transfer_buffer_length;
1034
1035 - for_each_sg(urb->sg, sg, urb->num_sgs, i) {
1036 + for_each_sg(urb->sg, sg, urb->num_mapped_sgs, i) {
1037 size_t len;
1038 size_t sg_remaining;
1039 void *orig;
1040 diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
1041 index 9f1d4b1..d28c586 100644
1042 --- a/drivers/usb/host/xhci-ring.c
1043 +++ b/drivers/usb/host/xhci-ring.c
1044 @@ -2561,7 +2561,7 @@ static unsigned int count_sg_trbs_needed(struct xhci_hcd *xhci, struct urb *urb)
1045 struct scatterlist *sg;
1046
1047 sg = NULL;
1048 - num_sgs = urb->num_sgs;
1049 + num_sgs = urb->num_mapped_sgs;
1050 temp = urb->transfer_buffer_length;
1051
1052 xhci_dbg(xhci, "count sg list trbs: \n");
1053 @@ -2745,7 +2745,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
1054 return -EINVAL;
1055
1056 num_trbs = count_sg_trbs_needed(xhci, urb);
1057 - num_sgs = urb->num_sgs;
1058 + num_sgs = urb->num_mapped_sgs;
1059 total_packet_count = roundup(urb->transfer_buffer_length,
1060 usb_endpoint_maxp(&urb->ep->desc));
1061
1062 diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
1063 index a1afb7c..b33f059 100644
1064 --- a/drivers/usb/host/xhci.c
1065 +++ b/drivers/usb/host/xhci.c
1066 @@ -1620,6 +1620,7 @@ static int xhci_configure_endpoint_result(struct xhci_hcd *xhci,
1067 /* FIXME: can we allocate more resources for the HC? */
1068 break;
1069 case COMP_BW_ERR:
1070 + case COMP_2ND_BW_ERR:
1071 dev_warn(&udev->dev, "Not enough bandwidth "
1072 "for new device state.\n");
1073 ret = -ENOSPC;
1074 @@ -2796,8 +2797,7 @@ static int xhci_calculate_streams_and_bitmask(struct xhci_hcd *xhci,
1075 if (ret < 0)
1076 return ret;
1077
1078 - max_streams = USB_SS_MAX_STREAMS(
1079 - eps[i]->ss_ep_comp.bmAttributes);
1080 + max_streams = usb_ss_max_streams(&eps[i]->ss_ep_comp);
1081 if (max_streams < (*num_streams - 1)) {
1082 xhci_dbg(xhci, "Ep 0x%x only supports %u stream IDs.\n",
1083 eps[i]->desc.bEndpointAddress,
1084 diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
1085 index 3c8fbd2..09eda3a 100644
1086 --- a/drivers/usb/host/xhci.h
1087 +++ b/drivers/usb/host/xhci.h
1088 @@ -1033,7 +1033,6 @@ struct xhci_transfer_event {
1089 /* Invalid Stream ID Error */
1090 #define COMP_STRID_ERR 34
1091 /* Secondary Bandwidth Error - may be returned by a Configure Endpoint cmd */
1092 -/* FIXME - check for this */
1093 #define COMP_2ND_BW_ERR 35
1094 /* Split Transaction Error */
1095 #define COMP_SPLIT_ERR 36
1096 diff --git a/drivers/usb/misc/isight_firmware.c b/drivers/usb/misc/isight_firmware.c
1097 index fe1d443..8f725f6 100644
1098 --- a/drivers/usb/misc/isight_firmware.c
1099 +++ b/drivers/usb/misc/isight_firmware.c
1100 @@ -55,8 +55,9 @@ static int isight_firmware_load(struct usb_interface *intf,
1101
1102 ptr = firmware->data;
1103
1104 + buf[0] = 0x01;
1105 if (usb_control_msg
1106 - (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\1", 1,
1107 + (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
1108 300) != 1) {
1109 printk(KERN_ERR
1110 "Failed to initialise isight firmware loader\n");
1111 @@ -100,8 +101,9 @@ static int isight_firmware_load(struct usb_interface *intf,
1112 }
1113 }
1114
1115 + buf[0] = 0x00;
1116 if (usb_control_msg
1117 - (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\0", 1,
1118 + (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
1119 300) != 1) {
1120 printk(KERN_ERR "isight firmware loading completion failed\n");
1121 ret = -ENODEV;
1122 diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
1123 index b63ab15..920f04e 100644
1124 --- a/drivers/usb/musb/musb_core.c
1125 +++ b/drivers/usb/musb/musb_core.c
1126 @@ -2012,8 +2012,6 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
1127 if (status < 0)
1128 goto fail3;
1129
1130 - pm_runtime_put(musb->controller);
1131 -
1132 status = musb_init_debugfs(musb);
1133 if (status < 0)
1134 goto fail4;
1135 diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
1136 index fd67cc5..a1a324b 100644
1137 --- a/drivers/usb/serial/cp210x.c
1138 +++ b/drivers/usb/serial/cp210x.c
1139 @@ -92,6 +92,7 @@ static const struct usb_device_id id_table[] = {
1140 { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */
1141 { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */
1142 { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */
1143 + { USB_DEVICE(0x10C4, 0x81A9) }, /* Multiplex RC Interface */
1144 { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */
1145 { USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */
1146 { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
1147 diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
1148 index 60f38d5..0a8c1e6 100644
1149 --- a/drivers/usb/serial/omninet.c
1150 +++ b/drivers/usb/serial/omninet.c
1151 @@ -315,7 +315,7 @@ static int omninet_write_room(struct tty_struct *tty)
1152 int room = 0; /* Default: no room */
1153
1154 /* FIXME: no consistent locking for write_urb_busy */
1155 - if (wport->write_urb_busy)
1156 + if (!wport->write_urb_busy)
1157 room = wport->bulk_out_size - OMNINET_HEADERLEN;
1158
1159 dbg("%s - returns %d", __func__, room);
1160 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
1161 index 6dd6453..c96b6b6 100644
1162 --- a/drivers/usb/serial/option.c
1163 +++ b/drivers/usb/serial/option.c
1164 @@ -476,6 +476,10 @@ static void option_instat_callback(struct urb *urb);
1165 #define VIETTEL_VENDOR_ID 0x2262
1166 #define VIETTEL_PRODUCT_VT1000 0x0002
1167
1168 +/* ZD Incorporated */
1169 +#define ZD_VENDOR_ID 0x0685
1170 +#define ZD_PRODUCT_7000 0x7000
1171 +
1172 /* some devices interfaces need special handling due to a number of reasons */
1173 enum option_blacklist_reason {
1174 OPTION_BLACKLIST_NONE = 0,
1175 @@ -1178,6 +1182,7 @@ static const struct usb_device_id option_ids[] = {
1176 { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU528) },
1177 { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) },
1178 { USB_DEVICE_AND_INTERFACE_INFO(VIETTEL_VENDOR_ID, VIETTEL_PRODUCT_VT1000, 0xff, 0xff, 0xff) },
1179 + { USB_DEVICE_AND_INTERFACE_INFO(ZD_VENDOR_ID, ZD_PRODUCT_7000, 0xff, 0xff, 0xff) },
1180 { } /* Terminating entry */
1181 };
1182 MODULE_DEVICE_TABLE(usb, option_ids);
1183 diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
1184 index c325e69..9e069ef 100644
1185 --- a/drivers/usb/storage/usb.c
1186 +++ b/drivers/usb/storage/usb.c
1187 @@ -1073,6 +1073,7 @@ static struct usb_driver usb_storage_driver = {
1188 .id_table = usb_storage_usb_ids,
1189 .supports_autosuspend = 1,
1190 .soft_unbind = 1,
1191 + .no_dynamic_id = 1,
1192 };
1193
1194 static int __init usb_stor_init(void)
1195 diff --git a/drivers/video/offb.c b/drivers/video/offb.c
1196 index cb163a5..3251a02 100644
1197 --- a/drivers/video/offb.c
1198 +++ b/drivers/video/offb.c
1199 @@ -100,36 +100,32 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
1200 u_int transp, struct fb_info *info)
1201 {
1202 struct offb_par *par = (struct offb_par *) info->par;
1203 - int i, depth;
1204 - u32 *pal = info->pseudo_palette;
1205 -
1206 - depth = info->var.bits_per_pixel;
1207 - if (depth == 16)
1208 - depth = (info->var.green.length == 5) ? 15 : 16;
1209 -
1210 - if (regno > 255 ||
1211 - (depth == 16 && regno > 63) ||
1212 - (depth == 15 && regno > 31))
1213 - return 1;
1214 -
1215 - if (regno < 16) {
1216 - switch (depth) {
1217 - case 15:
1218 - pal[regno] = (regno << 10) | (regno << 5) | regno;
1219 - break;
1220 - case 16:
1221 - pal[regno] = (regno << 11) | (regno << 5) | regno;
1222 - break;
1223 - case 24:
1224 - pal[regno] = (regno << 16) | (regno << 8) | regno;
1225 - break;
1226 - case 32:
1227 - i = (regno << 8) | regno;
1228 - pal[regno] = (i << 16) | i;
1229 - break;
1230 +
1231 + if (info->fix.visual == FB_VISUAL_TRUECOLOR) {
1232 + u32 *pal = info->pseudo_palette;
1233 + u32 cr = red >> (16 - info->var.red.length);
1234 + u32 cg = green >> (16 - info->var.green.length);
1235 + u32 cb = blue >> (16 - info->var.blue.length);
1236 + u32 value;
1237 +
1238 + if (regno >= 16)
1239 + return -EINVAL;
1240 +
1241 + value = (cr << info->var.red.offset) |
1242 + (cg << info->var.green.offset) |
1243 + (cb << info->var.blue.offset);
1244 + if (info->var.transp.length > 0) {
1245 + u32 mask = (1 << info->var.transp.length) - 1;
1246 + mask <<= info->var.transp.offset;
1247 + value |= mask;
1248 }
1249 + pal[regno] = value;
1250 + return 0;
1251 }
1252
1253 + if (regno > 255)
1254 + return -EINVAL;
1255 +
1256 red >>= 8;
1257 green >>= 8;
1258 blue >>= 8;
1259 @@ -381,7 +377,7 @@ static void __init offb_init_fb(const char *name, const char *full_name,
1260 int pitch, unsigned long address,
1261 int foreign_endian, struct device_node *dp)
1262 {
1263 - unsigned long res_size = pitch * height * (depth + 7) / 8;
1264 + unsigned long res_size = pitch * height;
1265 struct offb_par *par = &default_par;
1266 unsigned long res_start = address;
1267 struct fb_fix_screeninfo *fix;
1268 diff --git a/fs/Kconfig b/fs/Kconfig
1269 index 5f4c45d..6ad58a5 100644
1270 --- a/fs/Kconfig
1271 +++ b/fs/Kconfig
1272 @@ -218,6 +218,8 @@ source "fs/exofs/Kconfig"
1273
1274 endif # MISC_FILESYSTEMS
1275
1276 +source "fs/exofs/Kconfig.ore"
1277 +
1278 menuconfig NETWORK_FILESYSTEMS
1279 bool "Network File Systems"
1280 default y
1281 diff --git a/fs/exofs/Kconfig b/fs/exofs/Kconfig
1282 index da42f32..86194b2 100644
1283 --- a/fs/exofs/Kconfig
1284 +++ b/fs/exofs/Kconfig
1285 @@ -1,14 +1,3 @@
1286 -# Note ORE needs to "select ASYNC_XOR". So Not to force multiple selects
1287 -# for every ORE user we do it like this. Any user should add itself here
1288 -# at the "depends on EXOFS_FS || ..." with an ||. The dependencies are
1289 -# selected here, and we default to "ON". So in effect it is like been
1290 -# selected by any of the users.
1291 -config ORE
1292 - tristate
1293 - depends on EXOFS_FS || PNFS_OBJLAYOUT
1294 - select ASYNC_XOR
1295 - default SCSI_OSD_ULD
1296 -
1297 config EXOFS_FS
1298 tristate "exofs: OSD based file system support"
1299 depends on SCSI_OSD_ULD
1300 diff --git a/fs/exofs/Kconfig.ore b/fs/exofs/Kconfig.ore
1301 new file mode 100644
1302 index 0000000..1ca7fb7
1303 --- /dev/null
1304 +++ b/fs/exofs/Kconfig.ore
1305 @@ -0,0 +1,12 @@
1306 +# ORE - Objects Raid Engine (libore.ko)
1307 +#
1308 +# Note ORE needs to "select ASYNC_XOR". So Not to force multiple selects
1309 +# for every ORE user we do it like this. Any user should add itself here
1310 +# at the "depends on EXOFS_FS || ..." with an ||. The dependencies are
1311 +# selected here, and we default to "ON". So in effect it is like been
1312 +# selected by any of the users.
1313 +config ORE
1314 + tristate
1315 + depends on EXOFS_FS || PNFS_OBJLAYOUT
1316 + select ASYNC_XOR
1317 + default SCSI_OSD_ULD
1318 diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c
1319 index d271ad8..49cf230 100644
1320 --- a/fs/exofs/ore.c
1321 +++ b/fs/exofs/ore.c
1322 @@ -266,7 +266,7 @@ int ore_get_rw_state(struct ore_layout *layout, struct ore_components *oc,
1323
1324 /* first/last seg is split */
1325 num_raid_units += layout->group_width;
1326 - sgs_per_dev = div_u64(num_raid_units, data_devs);
1327 + sgs_per_dev = div_u64(num_raid_units, data_devs) + 2;
1328 } else {
1329 /* For Writes add parity pages array. */
1330 max_par_pages = num_raid_units * pages_in_unit *
1331 @@ -445,10 +445,10 @@ int ore_check_io(struct ore_io_state *ios, ore_on_dev_error on_dev_error)
1332 u64 residual = ios->reading ?
1333 or->in.residual : or->out.residual;
1334 u64 offset = (ios->offset + ios->length) - residual;
1335 - struct ore_dev *od = ios->oc->ods[
1336 - per_dev->dev - ios->oc->first_dev];
1337 + unsigned dev = per_dev->dev - ios->oc->first_dev;
1338 + struct ore_dev *od = ios->oc->ods[dev];
1339
1340 - on_dev_error(ios, od, per_dev->dev, osi.osd_err_pri,
1341 + on_dev_error(ios, od, dev, osi.osd_err_pri,
1342 offset, residual);
1343 }
1344 if (osi.osd_err_pri >= acumulated_osd_err) {
1345 diff --git a/fs/exofs/ore_raid.c b/fs/exofs/ore_raid.c
1346 index 29c47e5..d222c77 100644
1347 --- a/fs/exofs/ore_raid.c
1348 +++ b/fs/exofs/ore_raid.c
1349 @@ -328,8 +328,8 @@ static int _alloc_read_4_write(struct ore_io_state *ios)
1350 /* @si contains info of the to-be-inserted page. Update of @si should be
1351 * maintained by caller. Specificaly si->dev, si->obj_offset, ...
1352 */
1353 -static int _add_to_read_4_write(struct ore_io_state *ios,
1354 - struct ore_striping_info *si, struct page *page)
1355 +static int _add_to_r4w(struct ore_io_state *ios, struct ore_striping_info *si,
1356 + struct page *page, unsigned pg_len)
1357 {
1358 struct request_queue *q;
1359 struct ore_per_dev_state *per_dev;
1360 @@ -366,17 +366,60 @@ static int _add_to_read_4_write(struct ore_io_state *ios,
1361 _ore_add_sg_seg(per_dev, gap, true);
1362 }
1363 q = osd_request_queue(ore_comp_dev(read_ios->oc, per_dev->dev));
1364 - added_len = bio_add_pc_page(q, per_dev->bio, page, PAGE_SIZE, 0);
1365 - if (unlikely(added_len != PAGE_SIZE)) {
1366 + added_len = bio_add_pc_page(q, per_dev->bio, page, pg_len,
1367 + si->obj_offset % PAGE_SIZE);
1368 + if (unlikely(added_len != pg_len)) {
1369 ORE_DBGMSG("Failed to bio_add_pc_page bi_vcnt=%d\n",
1370 per_dev->bio->bi_vcnt);
1371 return -ENOMEM;
1372 }
1373
1374 - per_dev->length += PAGE_SIZE;
1375 + per_dev->length += pg_len;
1376 return 0;
1377 }
1378
1379 +/* read the beginning of an unaligned first page */
1380 +static int _add_to_r4w_first_page(struct ore_io_state *ios, struct page *page)
1381 +{
1382 + struct ore_striping_info si;
1383 + unsigned pg_len;
1384 +
1385 + ore_calc_stripe_info(ios->layout, ios->offset, 0, &si);
1386 +
1387 + pg_len = si.obj_offset % PAGE_SIZE;
1388 + si.obj_offset -= pg_len;
1389 +
1390 + ORE_DBGMSG("offset=0x%llx len=0x%x index=0x%lx dev=%x\n",
1391 + _LLU(si.obj_offset), pg_len, page->index, si.dev);
1392 +
1393 + return _add_to_r4w(ios, &si, page, pg_len);
1394 +}
1395 +
1396 +/* read the end of an incomplete last page */
1397 +static int _add_to_r4w_last_page(struct ore_io_state *ios, u64 *offset)
1398 +{
1399 + struct ore_striping_info si;
1400 + struct page *page;
1401 + unsigned pg_len, p, c;
1402 +
1403 + ore_calc_stripe_info(ios->layout, *offset, 0, &si);
1404 +
1405 + p = si.unit_off / PAGE_SIZE;
1406 + c = _dev_order(ios->layout->group_width * ios->layout->mirrors_p1,
1407 + ios->layout->mirrors_p1, si.par_dev, si.dev);
1408 + page = ios->sp2d->_1p_stripes[p].pages[c];
1409 +
1410 + pg_len = PAGE_SIZE - (si.unit_off % PAGE_SIZE);
1411 + *offset += pg_len;
1412 +
1413 + ORE_DBGMSG("p=%d, c=%d next-offset=0x%llx len=0x%x dev=%x par_dev=%d\n",
1414 + p, c, _LLU(*offset), pg_len, si.dev, si.par_dev);
1415 +
1416 + BUG_ON(!page);
1417 +
1418 + return _add_to_r4w(ios, &si, page, pg_len);
1419 +}
1420 +
1421 static void _mark_read4write_pages_uptodate(struct ore_io_state *ios, int ret)
1422 {
1423 struct bio_vec *bv;
1424 @@ -444,9 +487,13 @@ static int _read_4_write(struct ore_io_state *ios)
1425 struct page **pp = &_1ps->pages[c];
1426 bool uptodate;
1427
1428 - if (*pp)
1429 + if (*pp) {
1430 + if (ios->offset % PAGE_SIZE)
1431 + /* Read the remainder of the page */
1432 + _add_to_r4w_first_page(ios, *pp);
1433 /* to-be-written pages start here */
1434 goto read_last_stripe;
1435 + }
1436
1437 *pp = ios->r4w->get_page(ios->private, offset,
1438 &uptodate);
1439 @@ -454,7 +501,7 @@ static int _read_4_write(struct ore_io_state *ios)
1440 return -ENOMEM;
1441
1442 if (!uptodate)
1443 - _add_to_read_4_write(ios, &read_si, *pp);
1444 + _add_to_r4w(ios, &read_si, *pp, PAGE_SIZE);
1445
1446 /* Mark read-pages to be cache_released */
1447 _1ps->page_is_read[c] = true;
1448 @@ -465,8 +512,11 @@ static int _read_4_write(struct ore_io_state *ios)
1449 }
1450
1451 read_last_stripe:
1452 - offset = ios->offset + (ios->length + PAGE_SIZE - 1) /
1453 - PAGE_SIZE * PAGE_SIZE;
1454 + offset = ios->offset + ios->length;
1455 + if (offset % PAGE_SIZE)
1456 + _add_to_r4w_last_page(ios, &offset);
1457 + /* offset will be aligned to next page */
1458 +
1459 last_stripe_end = div_u64(offset + bytes_in_stripe - 1, bytes_in_stripe)
1460 * bytes_in_stripe;
1461 if (offset == last_stripe_end) /* Optimize for the aligned case */
1462 @@ -503,7 +553,7 @@ read_last_stripe:
1463 /* Mark read-pages to be cache_released */
1464 _1ps->page_is_read[c] = true;
1465 if (!uptodate)
1466 - _add_to_read_4_write(ios, &read_si, page);
1467 + _add_to_r4w(ios, &read_si, page, PAGE_SIZE);
1468 }
1469
1470 offset += PAGE_SIZE;
1471 @@ -551,7 +601,11 @@ int _ore_add_parity_unit(struct ore_io_state *ios,
1472 unsigned cur_len)
1473 {
1474 if (ios->reading) {
1475 - BUG_ON(per_dev->cur_sg >= ios->sgs_per_dev);
1476 + if (per_dev->cur_sg >= ios->sgs_per_dev) {
1477 + ORE_DBGMSG("cur_sg(%d) >= sgs_per_dev(%d)\n" ,
1478 + per_dev->cur_sg, ios->sgs_per_dev);
1479 + return -ENOMEM;
1480 + }
1481 _ore_add_sg_seg(per_dev, cur_len, true);
1482 } else {
1483 struct __stripe_pages_2d *sp2d = ios->sp2d;
1484 @@ -612,8 +666,6 @@ int _ore_post_alloc_raid_stuff(struct ore_io_state *ios)
1485 return -ENOMEM;
1486 }
1487
1488 - BUG_ON(ios->offset % PAGE_SIZE);
1489 -
1490 /* Round io down to last full strip */
1491 first_stripe = div_u64(ios->offset, stripe_size);
1492 last_stripe = div_u64(ios->offset + ios->length, stripe_size);
1493 diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
1494 index 85fe655..5b3f907 100644
1495 --- a/fs/ext3/inode.c
1496 +++ b/fs/ext3/inode.c
1497 @@ -1617,7 +1617,13 @@ static int ext3_ordered_writepage(struct page *page,
1498 int err;
1499
1500 J_ASSERT(PageLocked(page));
1501 - WARN_ON_ONCE(IS_RDONLY(inode));
1502 + /*
1503 + * We don't want to warn for emergency remount. The condition is
1504 + * ordered to avoid dereferencing inode->i_sb in non-error case to
1505 + * avoid slow-downs.
1506 + */
1507 + WARN_ON_ONCE(IS_RDONLY(inode) &&
1508 + !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
1509
1510 /*
1511 * We give up here if we're reentered, because it might be for a
1512 @@ -1692,7 +1698,13 @@ static int ext3_writeback_writepage(struct page *page,
1513 int err;
1514
1515 J_ASSERT(PageLocked(page));
1516 - WARN_ON_ONCE(IS_RDONLY(inode));
1517 + /*
1518 + * We don't want to warn for emergency remount. The condition is
1519 + * ordered to avoid dereferencing inode->i_sb in non-error case to
1520 + * avoid slow-downs.
1521 + */
1522 + WARN_ON_ONCE(IS_RDONLY(inode) &&
1523 + !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
1524
1525 if (ext3_journal_current_handle())
1526 goto out_fail;
1527 @@ -1735,7 +1747,13 @@ static int ext3_journalled_writepage(struct page *page,
1528 int err;
1529
1530 J_ASSERT(PageLocked(page));
1531 - WARN_ON_ONCE(IS_RDONLY(inode));
1532 + /*
1533 + * We don't want to warn for emergency remount. The condition is
1534 + * ordered to avoid dereferencing inode->i_sb in non-error case to
1535 + * avoid slow-downs.
1536 + */
1537 + WARN_ON_ONCE(IS_RDONLY(inode) &&
1538 + !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
1539
1540 if (ext3_journal_current_handle())
1541 goto no_write;
1542 diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
1543 index 14363b9..5e3527b 100644
1544 --- a/fs/reiserfs/super.c
1545 +++ b/fs/reiserfs/super.c
1546 @@ -453,16 +453,20 @@ int remove_save_link(struct inode *inode, int truncate)
1547 static void reiserfs_kill_sb(struct super_block *s)
1548 {
1549 if (REISERFS_SB(s)) {
1550 - if (REISERFS_SB(s)->xattr_root) {
1551 - d_invalidate(REISERFS_SB(s)->xattr_root);
1552 - dput(REISERFS_SB(s)->xattr_root);
1553 - REISERFS_SB(s)->xattr_root = NULL;
1554 - }
1555 - if (REISERFS_SB(s)->priv_root) {
1556 - d_invalidate(REISERFS_SB(s)->priv_root);
1557 - dput(REISERFS_SB(s)->priv_root);
1558 - REISERFS_SB(s)->priv_root = NULL;
1559 - }
1560 + /*
1561 + * Force any pending inode evictions to occur now. Any
1562 + * inodes to be removed that have extended attributes
1563 + * associated with them need to clean them up before
1564 + * we can release the extended attribute root dentries.
1565 + * shrink_dcache_for_umount will BUG if we don't release
1566 + * those before it's called so ->put_super is too late.
1567 + */
1568 + shrink_dcache_sb(s);
1569 +
1570 + dput(REISERFS_SB(s)->xattr_root);
1571 + REISERFS_SB(s)->xattr_root = NULL;
1572 + dput(REISERFS_SB(s)->priv_root);
1573 + REISERFS_SB(s)->priv_root = NULL;
1574 }
1575
1576 kill_block_super(s);
1577 @@ -1164,7 +1168,8 @@ static void handle_quota_files(struct super_block *s, char **qf_names,
1578 kfree(REISERFS_SB(s)->s_qf_names[i]);
1579 REISERFS_SB(s)->s_qf_names[i] = qf_names[i];
1580 }
1581 - REISERFS_SB(s)->s_jquota_fmt = *qfmt;
1582 + if (*qfmt)
1583 + REISERFS_SB(s)->s_jquota_fmt = *qfmt;
1584 }
1585 #endif
1586
1587 diff --git a/fs/udf/file.c b/fs/udf/file.c
1588 index d8ffa7c..dca0c38 100644
1589 --- a/fs/udf/file.c
1590 +++ b/fs/udf/file.c
1591 @@ -125,7 +125,6 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
1592 err = udf_expand_file_adinicb(inode);
1593 if (err) {
1594 udf_debug("udf_expand_adinicb: err=%d\n", err);
1595 - up_write(&iinfo->i_data_sem);
1596 return err;
1597 }
1598 } else {
1599 @@ -133,9 +132,10 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
1600 iinfo->i_lenAlloc = pos + count;
1601 else
1602 iinfo->i_lenAlloc = inode->i_size;
1603 + up_write(&iinfo->i_data_sem);
1604 }
1605 - }
1606 - up_write(&iinfo->i_data_sem);
1607 + } else
1608 + up_write(&iinfo->i_data_sem);
1609
1610 retval = generic_file_aio_write(iocb, iov, nr_segs, ppos);
1611 if (retval > 0)
1612 diff --git a/fs/udf/inode.c b/fs/udf/inode.c
1613 index 4fd1d80..e2787d0 100644
1614 --- a/fs/udf/inode.c
1615 +++ b/fs/udf/inode.c
1616 @@ -151,6 +151,12 @@ const struct address_space_operations udf_aops = {
1617 .bmap = udf_bmap,
1618 };
1619
1620 +/*
1621 + * Expand file stored in ICB to a normal one-block-file
1622 + *
1623 + * This function requires i_data_sem for writing and releases it.
1624 + * This function requires i_mutex held
1625 + */
1626 int udf_expand_file_adinicb(struct inode *inode)
1627 {
1628 struct page *page;
1629 @@ -169,9 +175,15 @@ int udf_expand_file_adinicb(struct inode *inode)
1630 iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
1631 /* from now on we have normal address_space methods */
1632 inode->i_data.a_ops = &udf_aops;
1633 + up_write(&iinfo->i_data_sem);
1634 mark_inode_dirty(inode);
1635 return 0;
1636 }
1637 + /*
1638 + * Release i_data_sem so that we can lock a page - page lock ranks
1639 + * above i_data_sem. i_mutex still protects us against file changes.
1640 + */
1641 + up_write(&iinfo->i_data_sem);
1642
1643 page = find_or_create_page(inode->i_mapping, 0, GFP_NOFS);
1644 if (!page)
1645 @@ -187,6 +199,7 @@ int udf_expand_file_adinicb(struct inode *inode)
1646 SetPageUptodate(page);
1647 kunmap(page);
1648 }
1649 + down_write(&iinfo->i_data_sem);
1650 memset(iinfo->i_ext.i_data + iinfo->i_lenEAttr, 0x00,
1651 iinfo->i_lenAlloc);
1652 iinfo->i_lenAlloc = 0;
1653 @@ -196,17 +209,20 @@ int udf_expand_file_adinicb(struct inode *inode)
1654 iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
1655 /* from now on we have normal address_space methods */
1656 inode->i_data.a_ops = &udf_aops;
1657 + up_write(&iinfo->i_data_sem);
1658 err = inode->i_data.a_ops->writepage(page, &udf_wbc);
1659 if (err) {
1660 /* Restore everything back so that we don't lose data... */
1661 lock_page(page);
1662 kaddr = kmap(page);
1663 + down_write(&iinfo->i_data_sem);
1664 memcpy(iinfo->i_ext.i_data + iinfo->i_lenEAttr, kaddr,
1665 inode->i_size);
1666 kunmap(page);
1667 unlock_page(page);
1668 iinfo->i_alloc_type = ICBTAG_FLAG_AD_IN_ICB;
1669 inode->i_data.a_ops = &udf_adinicb_aops;
1670 + up_write(&iinfo->i_data_sem);
1671 }
1672 page_cache_release(page);
1673 mark_inode_dirty(inode);
1674 @@ -1111,10 +1127,9 @@ int udf_setsize(struct inode *inode, loff_t newsize)
1675 if (bsize <
1676 (udf_file_entry_alloc_offset(inode) + newsize)) {
1677 err = udf_expand_file_adinicb(inode);
1678 - if (err) {
1679 - up_write(&iinfo->i_data_sem);
1680 + if (err)
1681 return err;
1682 - }
1683 + down_write(&iinfo->i_data_sem);
1684 } else
1685 iinfo->i_lenAlloc = newsize;
1686 }
1687 diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c
1688 index 76e4266..ac702a6 100644
1689 --- a/fs/xfs/xfs_acl.c
1690 +++ b/fs/xfs/xfs_acl.c
1691 @@ -39,7 +39,7 @@ xfs_acl_from_disk(struct xfs_acl *aclp)
1692 struct posix_acl_entry *acl_e;
1693 struct posix_acl *acl;
1694 struct xfs_acl_entry *ace;
1695 - int count, i;
1696 + unsigned int count, i;
1697
1698 count = be32_to_cpu(aclp->acl_cnt);
1699 if (count > XFS_ACL_MAX_ENTRIES)
1700 diff --git a/include/linux/usb.h b/include/linux/usb.h
1701 index d3d0c13..7503352 100644
1702 --- a/include/linux/usb.h
1703 +++ b/include/linux/usb.h
1704 @@ -1221,6 +1221,7 @@ struct urb {
1705 void *transfer_buffer; /* (in) associated data buffer */
1706 dma_addr_t transfer_dma; /* (in) dma addr for transfer_buffer */
1707 struct scatterlist *sg; /* (in) scatter gather buffer list */
1708 + int num_mapped_sgs; /* (internal) mapped sg entries */
1709 int num_sgs; /* (in) number of entries in the sg list */
1710 u32 transfer_buffer_length; /* (in) data buffer length */
1711 u32 actual_length; /* (return) actual transfer length */
1712 diff --git a/include/linux/usb/ch9.h b/include/linux/usb/ch9.h
1713 index d5da6c6..61b2905 100644
1714 --- a/include/linux/usb/ch9.h
1715 +++ b/include/linux/usb/ch9.h
1716 @@ -605,8 +605,26 @@ struct usb_ss_ep_comp_descriptor {
1717 } __attribute__ ((packed));
1718
1719 #define USB_DT_SS_EP_COMP_SIZE 6
1720 +
1721 /* Bits 4:0 of bmAttributes if this is a bulk endpoint */
1722 -#define USB_SS_MAX_STREAMS(p) (1 << ((p) & 0x1f))
1723 +static inline int
1724 +usb_ss_max_streams(const struct usb_ss_ep_comp_descriptor *comp)
1725 +{
1726 + int max_streams;
1727 +
1728 + if (!comp)
1729 + return 0;
1730 +
1731 + max_streams = comp->bmAttributes & 0x1f;
1732 +
1733 + if (!max_streams)
1734 + return 0;
1735 +
1736 + max_streams = 1 << max_streams;
1737 +
1738 + return max_streams;
1739 +}
1740 +
1741 /* Bits 1:0 of bmAttributes if this is an isoc endpoint */
1742 #define USB_SS_MULT(p) (1 + ((p) & 0x3))
1743
1744 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
1745 index a184470..cdc0354 100644
1746 --- a/kernel/cgroup.c
1747 +++ b/kernel/cgroup.c
1748 @@ -1175,10 +1175,10 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
1749
1750 /*
1751 * If the 'all' option was specified select all the subsystems,
1752 - * otherwise 'all, 'none' and a subsystem name options were not
1753 - * specified, let's default to 'all'
1754 + * otherwise if 'none', 'name=' and a subsystem name options
1755 + * were not specified, let's default to 'all'
1756 */
1757 - if (all_ss || (!all_ss && !one_ss && !opts->none)) {
1758 + if (all_ss || (!one_ss && !opts->none && !opts->name)) {
1759 for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
1760 struct cgroup_subsys *ss = subsys[i];
1761 if (ss == NULL)
1762 diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
1763 index b2ca095..c3cc64c 100644
1764 --- a/net/ipv4/igmp.c
1765 +++ b/net/ipv4/igmp.c
1766 @@ -875,6 +875,8 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
1767 * to be intended in a v3 query.
1768 */
1769 max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
1770 + if (!max_delay)
1771 + max_delay = 1; /* can't mod w/ 0 */
1772 } else { /* v3 */
1773 if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
1774 return;
1775 diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
1776 index 6c164dc..bf54c48 100644
1777 --- a/tools/perf/util/trace-event-parse.c
1778 +++ b/tools/perf/util/trace-event-parse.c
1779 @@ -1582,6 +1582,8 @@ process_symbols(struct event *event, struct print_arg *arg, char **tok)
1780 field = malloc_or_die(sizeof(*field));
1781
1782 type = process_arg(event, field, &token);
1783 + while (type == EVENT_OP)
1784 + type = process_op(event, field, &token);
1785 if (test_type_token(type, token, EVENT_DELIM, ","))
1786 goto out_free;
1787

  ViewVC Help
Powered by ViewVC 1.1.20