Gentoo Archives: gentoo-commits

From: "Mike Pagano (mpagano)" <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] linux-patches r2099 - genpatches-2.6/trunk/3.2
Date: Thu, 01 Mar 2012 14:05:39
Message-Id: 20120301140527.6D8E82004B@flycatcher.gentoo.org
1 Author: mpagano
2 Date: 2012-03-01 14:05:26 +0000 (Thu, 01 Mar 2012)
3 New Revision: 2099
4
5 Added:
6 genpatches-2.6/trunk/3.2/1008_linux-3.2.9.patch
7 Modified:
8 genpatches-2.6/trunk/3.2/0000_README
9 Log:
10 Linux patch 3.2.9
11
12 Modified: genpatches-2.6/trunk/3.2/0000_README
13 ===================================================================
14 --- genpatches-2.6/trunk/3.2/0000_README 2012-03-01 00:10:15 UTC (rev 2098)
15 +++ genpatches-2.6/trunk/3.2/0000_README 2012-03-01 14:05:26 UTC (rev 2099)
16 @@ -72,6 +72,10 @@
17 From: http://www.kernel.org
18 Desc: Linux 3.2.8
19
20 +Patch: 1008_linux-3.2.9.patch
21 +From: http://www.kernel.org
22 +Desc: Linux 3.2.9
23 +
24 Patch: 2300_per-pci-device-msi-irq-listing.patch
25 From: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=da8d1c8ba4dcb16d60be54b233deca9a7cac98dc
26 Desc: Add a per-pci-device subdirectory in sysfs
27
28 Added: genpatches-2.6/trunk/3.2/1008_linux-3.2.9.patch
29 ===================================================================
30 --- genpatches-2.6/trunk/3.2/1008_linux-3.2.9.patch (rev 0)
31 +++ genpatches-2.6/trunk/3.2/1008_linux-3.2.9.patch 2012-03-01 14:05:26 UTC (rev 2099)
32 @@ -0,0 +1,3675 @@
33 +diff --git a/Makefile b/Makefile
34 +index 7df8a84..5f1739b 100644
35 +--- a/Makefile
36 ++++ b/Makefile
37 +@@ -1,6 +1,6 @@
38 + VERSION = 3
39 + PATCHLEVEL = 2
40 +-SUBLEVEL = 8
41 ++SUBLEVEL = 9
42 + EXTRAVERSION =
43 + NAME = Saber-toothed Squirrel
44 +
45 +diff --git a/arch/arm/common/pl330.c b/arch/arm/common/pl330.c
46 +index 8d8df74..67abef5 100644
47 +--- a/arch/arm/common/pl330.c
48 ++++ b/arch/arm/common/pl330.c
49 +@@ -1496,12 +1496,13 @@ int pl330_chan_ctrl(void *ch_id, enum pl330_chan_op op)
50 + struct pl330_thread *thrd = ch_id;
51 + struct pl330_dmac *pl330;
52 + unsigned long flags;
53 +- int ret = 0, active = thrd->req_running;
54 ++ int ret = 0, active;
55 +
56 + if (!thrd || thrd->free || thrd->dmac->state == DYING)
57 + return -EINVAL;
58 +
59 + pl330 = thrd->dmac;
60 ++ active = thrd->req_running;
61 +
62 + spin_lock_irqsave(&pl330->lock, flags);
63 +
64 +diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
65 +index 29035e8..7bb8bf9 100644
66 +--- a/arch/arm/include/asm/assembler.h
67 ++++ b/arch/arm/include/asm/assembler.h
68 +@@ -137,6 +137,11 @@
69 + disable_irq
70 + .endm
71 +
72 ++ .macro save_and_disable_irqs_notrace, oldcpsr
73 ++ mrs \oldcpsr, cpsr
74 ++ disable_irq_notrace
75 ++ .endm
76 ++
77 + /*
78 + * Restore interrupt state previously stored in a register. We don't
79 + * guarantee that this will preserve the flags.
80 +diff --git a/arch/arm/mach-at91/at91rm9200_devices.c b/arch/arm/mach-at91/at91rm9200_devices.c
81 +index ad93068..143eebb 100644
82 +--- a/arch/arm/mach-at91/at91rm9200_devices.c
83 ++++ b/arch/arm/mach-at91/at91rm9200_devices.c
84 +@@ -83,7 +83,7 @@ void __init at91_add_device_usbh(struct at91_usbh_data *data) {}
85 + * USB Device (Gadget)
86 + * -------------------------------------------------------------------- */
87 +
88 +-#ifdef CONFIG_USB_AT91
89 ++#if defined(CONFIG_USB_AT91) || defined(CONFIG_USB_AT91_MODULE)
90 + static struct at91_udc_data udc_data;
91 +
92 + static struct resource udc_resources[] = {
93 +diff --git a/arch/arm/mach-at91/at91sam9260_devices.c b/arch/arm/mach-at91/at91sam9260_devices.c
94 +index 629fa97..2590988 100644
95 +--- a/arch/arm/mach-at91/at91sam9260_devices.c
96 ++++ b/arch/arm/mach-at91/at91sam9260_devices.c
97 +@@ -84,7 +84,7 @@ void __init at91_add_device_usbh(struct at91_usbh_data *data) {}
98 + * USB Device (Gadget)
99 + * -------------------------------------------------------------------- */
100 +
101 +-#ifdef CONFIG_USB_AT91
102 ++#if defined(CONFIG_USB_AT91) || defined(CONFIG_USB_AT91_MODULE)
103 + static struct at91_udc_data udc_data;
104 +
105 + static struct resource udc_resources[] = {
106 +diff --git a/arch/arm/mach-at91/at91sam9261_devices.c b/arch/arm/mach-at91/at91sam9261_devices.c
107 +index a178b58..daf3e66 100644
108 +--- a/arch/arm/mach-at91/at91sam9261_devices.c
109 ++++ b/arch/arm/mach-at91/at91sam9261_devices.c
110 +@@ -87,7 +87,7 @@ void __init at91_add_device_usbh(struct at91_usbh_data *data) {}
111 + * USB Device (Gadget)
112 + * -------------------------------------------------------------------- */
113 +
114 +-#ifdef CONFIG_USB_AT91
115 ++#if defined(CONFIG_USB_AT91) || defined(CONFIG_USB_AT91_MODULE)
116 + static struct at91_udc_data udc_data;
117 +
118 + static struct resource udc_resources[] = {
119 +diff --git a/arch/arm/mach-at91/at91sam9263_devices.c b/arch/arm/mach-at91/at91sam9263_devices.c
120 +index d5fbac9..32a7e43 100644
121 +--- a/arch/arm/mach-at91/at91sam9263_devices.c
122 ++++ b/arch/arm/mach-at91/at91sam9263_devices.c
123 +@@ -92,7 +92,7 @@ void __init at91_add_device_usbh(struct at91_usbh_data *data) {}
124 + * USB Device (Gadget)
125 + * -------------------------------------------------------------------- */
126 +
127 +-#ifdef CONFIG_USB_AT91
128 ++#if defined(CONFIG_USB_AT91) || defined(CONFIG_USB_AT91_MODULE)
129 + static struct at91_udc_data udc_data;
130 +
131 + static struct resource udc_resources[] = {
132 +diff --git a/arch/arm/mach-omap2/vp.c b/arch/arm/mach-omap2/vp.c
133 +index 66bd700..3b52027 100644
134 +--- a/arch/arm/mach-omap2/vp.c
135 ++++ b/arch/arm/mach-omap2/vp.c
136 +@@ -41,6 +41,11 @@ void __init omap_vp_init(struct voltagedomain *voltdm)
137 + u32 val, sys_clk_rate, timeout, waittime;
138 + u32 vddmin, vddmax, vstepmin, vstepmax;
139 +
140 ++ if (!voltdm->pmic || !voltdm->pmic->uv_to_vsel) {
141 ++ pr_err("%s: No PMIC info for vdd_%s\n", __func__, voltdm->name);
142 ++ return;
143 ++ }
144 ++
145 + if (!voltdm->read || !voltdm->write) {
146 + pr_err("%s: No read/write API for accessing vdd_%s regs\n",
147 + __func__, voltdm->name);
148 +diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
149 +index 07c4bc8..a655d3d 100644
150 +--- a/arch/arm/mm/cache-v7.S
151 ++++ b/arch/arm/mm/cache-v7.S
152 +@@ -54,9 +54,15 @@ loop1:
153 + and r1, r1, #7 @ mask of the bits for current cache only
154 + cmp r1, #2 @ see what cache we have at this level
155 + blt skip @ skip if no cache, or just i-cache
156 ++#ifdef CONFIG_PREEMPT
157 ++ save_and_disable_irqs_notrace r9 @ make cssr&csidr read atomic
158 ++#endif
159 + mcr p15, 2, r10, c0, c0, 0 @ select current cache level in cssr
160 + isb @ isb to sych the new cssr&csidr
161 + mrc p15, 1, r1, c0, c0, 0 @ read the new csidr
162 ++#ifdef CONFIG_PREEMPT
163 ++ restore_irqs_notrace r9
164 ++#endif
165 + and r2, r1, #7 @ extract the length of the cache lines
166 + add r2, r2, #4 @ add 4 (line length offset)
167 + ldr r4, =0x3ff
168 +diff --git a/arch/powerpc/kernel/perf_event.c b/arch/powerpc/kernel/perf_event.c
169 +index 10a140f..64483fd 100644
170 +--- a/arch/powerpc/kernel/perf_event.c
171 ++++ b/arch/powerpc/kernel/perf_event.c
172 +@@ -865,6 +865,7 @@ static void power_pmu_start(struct perf_event *event, int ef_flags)
173 + {
174 + unsigned long flags;
175 + s64 left;
176 ++ unsigned long val;
177 +
178 + if (!event->hw.idx || !event->hw.sample_period)
179 + return;
180 +@@ -880,7 +881,12 @@ static void power_pmu_start(struct perf_event *event, int ef_flags)
181 +
182 + event->hw.state = 0;
183 + left = local64_read(&event->hw.period_left);
184 +- write_pmc(event->hw.idx, left);
185 ++
186 ++ val = 0;
187 ++ if (left < 0x80000000L)
188 ++ val = 0x80000000L - left;
189 ++
190 ++ write_pmc(event->hw.idx, val);
191 +
192 + perf_event_update_userpage(event);
193 + perf_pmu_enable(event->pmu);
194 +diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
195 +index ebbfab3..e03c555 100644
196 +--- a/arch/s390/kernel/time.c
197 ++++ b/arch/s390/kernel/time.c
198 +@@ -113,11 +113,14 @@ static void fixup_clock_comparator(unsigned long long delta)
199 + static int s390_next_ktime(ktime_t expires,
200 + struct clock_event_device *evt)
201 + {
202 ++ struct timespec ts;
203 + u64 nsecs;
204 +
205 +- nsecs = ktime_to_ns(ktime_sub(expires, ktime_get_monotonic_offset()));
206 ++ ts.tv_sec = ts.tv_nsec = 0;
207 ++ monotonic_to_bootbased(&ts);
208 ++ nsecs = ktime_to_ns(ktime_add(timespec_to_ktime(ts), expires));
209 + do_div(nsecs, 125);
210 +- S390_lowcore.clock_comparator = TOD_UNIX_EPOCH + (nsecs << 9);
211 ++ S390_lowcore.clock_comparator = sched_clock_base_cc + (nsecs << 9);
212 + set_clock_comparator(S390_lowcore.clock_comparator);
213 + return 0;
214 + }
215 +diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
216 +index a3b0811..0e89635 100644
217 +--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
218 ++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
219 +@@ -326,8 +326,7 @@ static void __cpuinit amd_calc_l3_indices(struct amd_northbridge *nb)
220 + l3->indices = (max(max3(sc0, sc1, sc2), sc3) << 10) - 1;
221 + }
222 +
223 +-static void __cpuinit amd_init_l3_cache(struct _cpuid4_info_regs *this_leaf,
224 +- int index)
225 ++static void __cpuinit amd_init_l3_cache(struct _cpuid4_info_regs *this_leaf, int index)
226 + {
227 + int node;
228 +
229 +@@ -725,14 +724,16 @@ static DEFINE_PER_CPU(struct _cpuid4_info *, ici_cpuid4_info);
230 + #define CPUID4_INFO_IDX(x, y) (&((per_cpu(ici_cpuid4_info, x))[y]))
231 +
232 + #ifdef CONFIG_SMP
233 +-static void __cpuinit cache_shared_cpu_map_setup(unsigned int cpu, int index)
234 ++
235 ++static int __cpuinit cache_shared_amd_cpu_map_setup(unsigned int cpu, int index)
236 + {
237 +- struct _cpuid4_info *this_leaf, *sibling_leaf;
238 +- unsigned long num_threads_sharing;
239 +- int index_msb, i, sibling;
240 ++ struct _cpuid4_info *this_leaf;
241 ++ int ret, i, sibling;
242 + struct cpuinfo_x86 *c = &cpu_data(cpu);
243 +
244 +- if ((index == 3) && (c->x86_vendor == X86_VENDOR_AMD)) {
245 ++ ret = 0;
246 ++ if (index == 3) {
247 ++ ret = 1;
248 + for_each_cpu(i, cpu_llc_shared_mask(cpu)) {
249 + if (!per_cpu(ici_cpuid4_info, i))
250 + continue;
251 +@@ -743,8 +744,35 @@ static void __cpuinit cache_shared_cpu_map_setup(unsigned int cpu, int index)
252 + set_bit(sibling, this_leaf->shared_cpu_map);
253 + }
254 + }
255 +- return;
256 ++ } else if ((c->x86 == 0x15) && ((index == 1) || (index == 2))) {
257 ++ ret = 1;
258 ++ for_each_cpu(i, cpu_sibling_mask(cpu)) {
259 ++ if (!per_cpu(ici_cpuid4_info, i))
260 ++ continue;
261 ++ this_leaf = CPUID4_INFO_IDX(i, index);
262 ++ for_each_cpu(sibling, cpu_sibling_mask(cpu)) {
263 ++ if (!cpu_online(sibling))
264 ++ continue;
265 ++ set_bit(sibling, this_leaf->shared_cpu_map);
266 ++ }
267 ++ }
268 + }
269 ++
270 ++ return ret;
271 ++}
272 ++
273 ++static void __cpuinit cache_shared_cpu_map_setup(unsigned int cpu, int index)
274 ++{
275 ++ struct _cpuid4_info *this_leaf, *sibling_leaf;
276 ++ unsigned long num_threads_sharing;
277 ++ int index_msb, i;
278 ++ struct cpuinfo_x86 *c = &cpu_data(cpu);
279 ++
280 ++ if (c->x86_vendor == X86_VENDOR_AMD) {
281 ++ if (cache_shared_amd_cpu_map_setup(cpu, index))
282 ++ return;
283 ++ }
284 ++
285 + this_leaf = CPUID4_INFO_IDX(cpu, index);
286 + num_threads_sharing = 1 + this_leaf->base.eax.split.num_threads_sharing;
287 +
288 +diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
289 +index 666f6f5..64004b0 100644
290 +--- a/drivers/base/regmap/regcache.c
291 ++++ b/drivers/base/regmap/regcache.c
292 +@@ -54,7 +54,7 @@ static int regcache_hw_init(struct regmap *map)
293 + for (count = 0, i = 0; i < map->num_reg_defaults_raw; i++) {
294 + val = regcache_get_val(map->reg_defaults_raw,
295 + i, map->cache_word_size);
296 +- if (!val)
297 ++ if (regmap_volatile(map, i))
298 + continue;
299 + count++;
300 + }
301 +@@ -69,7 +69,7 @@ static int regcache_hw_init(struct regmap *map)
302 + for (i = 0, j = 0; i < map->num_reg_defaults_raw; i++) {
303 + val = regcache_get_val(map->reg_defaults_raw,
304 + i, map->cache_word_size);
305 +- if (!val)
306 ++ if (regmap_volatile(map, i))
307 + continue;
308 + map->reg_defaults[j].reg = i;
309 + map->reg_defaults[j].def = val;
310 +diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
311 +index cedb231..2678b6f 100644
312 +--- a/drivers/cdrom/cdrom.c
313 ++++ b/drivers/cdrom/cdrom.c
314 +@@ -2120,11 +2120,6 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
315 + if (!nr)
316 + return -ENOMEM;
317 +
318 +- if (!access_ok(VERIFY_WRITE, ubuf, nframes * CD_FRAMESIZE_RAW)) {
319 +- ret = -EFAULT;
320 +- goto out;
321 +- }
322 +-
323 + cgc.data_direction = CGC_DATA_READ;
324 + while (nframes > 0) {
325 + if (nr > nframes)
326 +@@ -2133,7 +2128,7 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
327 + ret = cdrom_read_block(cdi, &cgc, lba, nr, 1, CD_FRAMESIZE_RAW);
328 + if (ret)
329 + break;
330 +- if (__copy_to_user(ubuf, cgc.buffer, CD_FRAMESIZE_RAW * nr)) {
331 ++ if (copy_to_user(ubuf, cgc.buffer, CD_FRAMESIZE_RAW * nr)) {
332 + ret = -EFAULT;
333 + break;
334 + }
335 +@@ -2141,7 +2136,6 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
336 + nframes -= nr;
337 + lba += nr;
338 + }
339 +-out:
340 + kfree(cgc.buffer);
341 + return ret;
342 + }
343 +diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
344 +index 31b0d1a..fad7cd1 100644
345 +--- a/drivers/gpu/drm/radeon/r100.c
346 ++++ b/drivers/gpu/drm/radeon/r100.c
347 +@@ -789,9 +789,7 @@ int r100_irq_process(struct radeon_device *rdev)
348 + WREG32(RADEON_AIC_CNTL, msi_rearm | RS400_MSI_REARM);
349 + break;
350 + default:
351 +- msi_rearm = RREG32(RADEON_MSI_REARM_EN) & ~RV370_MSI_REARM_EN;
352 +- WREG32(RADEON_MSI_REARM_EN, msi_rearm);
353 +- WREG32(RADEON_MSI_REARM_EN, msi_rearm | RV370_MSI_REARM_EN);
354 ++ WREG32(RADEON_MSI_REARM_EN, RV370_MSI_REARM_EN);
355 + break;
356 + }
357 + }
358 +diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
359 +index c259e21..ee898e9 100644
360 +--- a/drivers/gpu/drm/radeon/rs600.c
361 ++++ b/drivers/gpu/drm/radeon/rs600.c
362 +@@ -693,9 +693,7 @@ int rs600_irq_process(struct radeon_device *rdev)
363 + WREG32(RADEON_BUS_CNTL, msi_rearm | RS600_MSI_REARM);
364 + break;
365 + default:
366 +- msi_rearm = RREG32(RADEON_MSI_REARM_EN) & ~RV370_MSI_REARM_EN;
367 +- WREG32(RADEON_MSI_REARM_EN, msi_rearm);
368 +- WREG32(RADEON_MSI_REARM_EN, msi_rearm | RV370_MSI_REARM_EN);
369 ++ WREG32(RADEON_MSI_REARM_EN, RV370_MSI_REARM_EN);
370 + break;
371 + }
372 + }
373 +diff --git a/drivers/hwmon/ads1015.c b/drivers/hwmon/ads1015.c
374 +index eedca3c..dd87ae9 100644
375 +--- a/drivers/hwmon/ads1015.c
376 ++++ b/drivers/hwmon/ads1015.c
377 +@@ -271,7 +271,7 @@ static int ads1015_probe(struct i2c_client *client,
378 + continue;
379 + err = device_create_file(&client->dev, &ads1015_in[k].dev_attr);
380 + if (err)
381 +- goto exit_free;
382 ++ goto exit_remove;
383 + }
384 +
385 + data->hwmon_dev = hwmon_device_register(&client->dev);
386 +@@ -285,7 +285,6 @@ static int ads1015_probe(struct i2c_client *client,
387 + exit_remove:
388 + for (k = 0; k < ADS1015_CHANNELS; ++k)
389 + device_remove_file(&client->dev, &ads1015_in[k].dev_attr);
390 +-exit_free:
391 + kfree(data);
392 + exit:
393 + return err;
394 +diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
395 +index e4ab491..040a820 100644
396 +--- a/drivers/hwmon/f75375s.c
397 ++++ b/drivers/hwmon/f75375s.c
398 +@@ -304,8 +304,6 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
399 + case 0: /* Full speed */
400 + fanmode |= (3 << FAN_CTRL_MODE(nr));
401 + data->pwm[nr] = 255;
402 +- f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
403 +- data->pwm[nr]);
404 + break;
405 + case 1: /* PWM */
406 + fanmode |= (3 << FAN_CTRL_MODE(nr));
407 +@@ -318,6 +316,9 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
408 + }
409 + f75375_write8(client, F75375_REG_FAN_TIMER, fanmode);
410 + data->pwm_enable[nr] = val;
411 ++ if (val == 0)
412 ++ f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
413 ++ data->pwm[nr]);
414 + return 0;
415 + }
416 +
417 +diff --git a/drivers/hwmon/max6639.c b/drivers/hwmon/max6639.c
418 +index f20d997..8c3df04 100644
419 +--- a/drivers/hwmon/max6639.c
420 ++++ b/drivers/hwmon/max6639.c
421 +@@ -72,8 +72,8 @@ static unsigned short normal_i2c[] = { 0x2c, 0x2e, 0x2f, I2C_CLIENT_END };
422 +
423 + static const int rpm_ranges[] = { 2000, 4000, 8000, 16000 };
424 +
425 +-#define FAN_FROM_REG(val, div, rpm_range) ((val) == 0 ? -1 : \
426 +- (val) == 255 ? 0 : (rpm_ranges[rpm_range] * 30) / ((div + 1) * (val)))
427 ++#define FAN_FROM_REG(val, rpm_range) ((val) == 0 || (val) == 255 ? \
428 ++ 0 : (rpm_ranges[rpm_range] * 30) / (val))
429 + #define TEMP_LIMIT_TO_REG(val) SENSORS_LIMIT((val) / 1000, 0, 255)
430 +
431 + /*
432 +@@ -333,7 +333,7 @@ static ssize_t show_fan_input(struct device *dev,
433 + return PTR_ERR(data);
434 +
435 + return sprintf(buf, "%d\n", FAN_FROM_REG(data->fan[attr->index],
436 +- data->ppr, data->rpm_range));
437 ++ data->rpm_range));
438 + }
439 +
440 + static ssize_t show_alarm(struct device *dev,
441 +@@ -429,9 +429,9 @@ static int max6639_init_client(struct i2c_client *client)
442 + struct max6639_data *data = i2c_get_clientdata(client);
443 + struct max6639_platform_data *max6639_info =
444 + client->dev.platform_data;
445 +- int i = 0;
446 ++ int i;
447 + int rpm_range = 1; /* default: 4000 RPM */
448 +- int err = 0;
449 ++ int err;
450 +
451 + /* Reset chip to default values, see below for GCONFIG setup */
452 + err = i2c_smbus_write_byte_data(client, MAX6639_REG_GCONFIG,
453 +@@ -446,11 +446,6 @@ static int max6639_init_client(struct i2c_client *client)
454 + else
455 + data->ppr = 2;
456 + data->ppr -= 1;
457 +- err = i2c_smbus_write_byte_data(client,
458 +- MAX6639_REG_FAN_PPR(i),
459 +- data->ppr << 5);
460 +- if (err)
461 +- goto exit;
462 +
463 + if (max6639_info)
464 + rpm_range = rpm_range_to_reg(max6639_info->rpm_range);
465 +@@ -458,6 +453,13 @@ static int max6639_init_client(struct i2c_client *client)
466 +
467 + for (i = 0; i < 2; i++) {
468 +
469 ++ /* Set Fan pulse per revolution */
470 ++ err = i2c_smbus_write_byte_data(client,
471 ++ MAX6639_REG_FAN_PPR(i),
472 ++ data->ppr << 6);
473 ++ if (err)
474 ++ goto exit;
475 ++
476 + /* Fans config PWM, RPM */
477 + err = i2c_smbus_write_byte_data(client,
478 + MAX6639_REG_FAN_CONFIG1(i),
479 +diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
480 +index b3cc1e0..86df632 100644
481 +--- a/drivers/infiniband/ulp/ipoib/ipoib.h
482 ++++ b/drivers/infiniband/ulp/ipoib/ipoib.h
483 +@@ -44,6 +44,7 @@
484 + #include <linux/mutex.h>
485 +
486 + #include <net/neighbour.h>
487 ++#include <net/sch_generic.h>
488 +
489 + #include <linux/atomic.h>
490 +
491 +@@ -117,8 +118,9 @@ struct ipoib_header {
492 + u16 reserved;
493 + };
494 +
495 +-struct ipoib_pseudoheader {
496 +- u8 hwaddr[INFINIBAND_ALEN];
497 ++struct ipoib_cb {
498 ++ struct qdisc_skb_cb qdisc_cb;
499 ++ u8 hwaddr[INFINIBAND_ALEN];
500 + };
501 +
502 + /* Used for all multicast joins (broadcast, IPv4 mcast and IPv6 mcast) */
503 +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
504 +index 83695b4..fe2fdbb 100644
505 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
506 ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
507 +@@ -658,7 +658,7 @@ static void ipoib_path_lookup(struct sk_buff *skb, struct net_device *dev)
508 + }
509 +
510 + static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
511 +- struct ipoib_pseudoheader *phdr)
512 ++ struct ipoib_cb *cb)
513 + {
514 + struct ipoib_dev_priv *priv = netdev_priv(dev);
515 + struct ipoib_path *path;
516 +@@ -666,17 +666,15 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
517 +
518 + spin_lock_irqsave(&priv->lock, flags);
519 +
520 +- path = __path_find(dev, phdr->hwaddr + 4);
521 ++ path = __path_find(dev, cb->hwaddr + 4);
522 + if (!path || !path->valid) {
523 + int new_path = 0;
524 +
525 + if (!path) {
526 +- path = path_rec_create(dev, phdr->hwaddr + 4);
527 ++ path = path_rec_create(dev, cb->hwaddr + 4);
528 + new_path = 1;
529 + }
530 + if (path) {
531 +- /* put pseudoheader back on for next time */
532 +- skb_push(skb, sizeof *phdr);
533 + __skb_queue_tail(&path->queue, skb);
534 +
535 + if (!path->query && path_rec_start(dev, path)) {
536 +@@ -700,12 +698,10 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
537 + be16_to_cpu(path->pathrec.dlid));
538 +
539 + spin_unlock_irqrestore(&priv->lock, flags);
540 +- ipoib_send(dev, skb, path->ah, IPOIB_QPN(phdr->hwaddr));
541 ++ ipoib_send(dev, skb, path->ah, IPOIB_QPN(cb->hwaddr));
542 + return;
543 + } else if ((path->query || !path_rec_start(dev, path)) &&
544 + skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
545 +- /* put pseudoheader back on for next time */
546 +- skb_push(skb, sizeof *phdr);
547 + __skb_queue_tail(&path->queue, skb);
548 + } else {
549 + ++dev->stats.tx_dropped;
550 +@@ -774,16 +770,14 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
551 + dev_kfree_skb_any(skb);
552 + }
553 + } else {
554 +- struct ipoib_pseudoheader *phdr =
555 +- (struct ipoib_pseudoheader *) skb->data;
556 +- skb_pull(skb, sizeof *phdr);
557 ++ struct ipoib_cb *cb = (struct ipoib_cb *) skb->cb;
558 +
559 +- if (phdr->hwaddr[4] == 0xff) {
560 ++ if (cb->hwaddr[4] == 0xff) {
561 + /* Add in the P_Key for multicast*/
562 +- phdr->hwaddr[8] = (priv->pkey >> 8) & 0xff;
563 +- phdr->hwaddr[9] = priv->pkey & 0xff;
564 ++ cb->hwaddr[8] = (priv->pkey >> 8) & 0xff;
565 ++ cb->hwaddr[9] = priv->pkey & 0xff;
566 +
567 +- ipoib_mcast_send(dev, phdr->hwaddr + 4, skb);
568 ++ ipoib_mcast_send(dev, cb->hwaddr + 4, skb);
569 + } else {
570 + /* unicast GID -- should be ARP or RARP reply */
571 +
572 +@@ -792,14 +786,14 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
573 + ipoib_warn(priv, "Unicast, no %s: type %04x, QPN %06x %pI6\n",
574 + skb_dst(skb) ? "neigh" : "dst",
575 + be16_to_cpup((__be16 *) skb->data),
576 +- IPOIB_QPN(phdr->hwaddr),
577 +- phdr->hwaddr + 4);
578 ++ IPOIB_QPN(cb->hwaddr),
579 ++ cb->hwaddr + 4);
580 + dev_kfree_skb_any(skb);
581 + ++dev->stats.tx_dropped;
582 + goto unlock;
583 + }
584 +
585 +- unicast_arp_send(skb, dev, phdr);
586 ++ unicast_arp_send(skb, dev, cb);
587 + }
588 + }
589 + unlock:
590 +@@ -825,8 +819,6 @@ static int ipoib_hard_header(struct sk_buff *skb,
591 + const void *daddr, const void *saddr, unsigned len)
592 + {
593 + struct ipoib_header *header;
594 +- struct dst_entry *dst;
595 +- struct neighbour *n;
596 +
597 + header = (struct ipoib_header *) skb_push(skb, sizeof *header);
598 +
599 +@@ -834,18 +826,13 @@ static int ipoib_hard_header(struct sk_buff *skb,
600 + header->reserved = 0;
601 +
602 + /*
603 +- * If we don't have a neighbour structure, stuff the
604 +- * destination address onto the front of the skb so we can
605 +- * figure out where to send the packet later.
606 ++ * If we don't have a dst_entry structure, stuff the
607 ++ * destination address into skb->cb so we can figure out where
608 ++ * to send the packet later.
609 + */
610 +- dst = skb_dst(skb);
611 +- n = NULL;
612 +- if (dst)
613 +- n = dst_get_neighbour_raw(dst);
614 +- if ((!dst || !n) && daddr) {
615 +- struct ipoib_pseudoheader *phdr =
616 +- (struct ipoib_pseudoheader *) skb_push(skb, sizeof *phdr);
617 +- memcpy(phdr->hwaddr, daddr, INFINIBAND_ALEN);
618 ++ if (!skb_dst(skb)) {
619 ++ struct ipoib_cb *cb = (struct ipoib_cb *) skb->cb;
620 ++ memcpy(cb->hwaddr, daddr, INFINIBAND_ALEN);
621 + }
622 +
623 + return 0;
624 +@@ -1021,11 +1008,7 @@ static void ipoib_setup(struct net_device *dev)
625 +
626 + dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
627 +
628 +- /*
629 +- * We add in INFINIBAND_ALEN to allow for the destination
630 +- * address "pseudoheader" for skbs without neighbour struct.
631 +- */
632 +- dev->hard_header_len = IPOIB_ENCAP_LEN + INFINIBAND_ALEN;
633 ++ dev->hard_header_len = IPOIB_ENCAP_LEN;
634 + dev->addr_len = INFINIBAND_ALEN;
635 + dev->type = ARPHRD_INFINIBAND;
636 + dev->tx_queue_len = ipoib_sendq_size * 2;
637 +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
638 +index 873bff9..e5069b4 100644
639 +--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
640 ++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
641 +@@ -262,21 +262,14 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
642 + netif_tx_lock_bh(dev);
643 + while (!skb_queue_empty(&mcast->pkt_queue)) {
644 + struct sk_buff *skb = skb_dequeue(&mcast->pkt_queue);
645 +- struct dst_entry *dst = skb_dst(skb);
646 +- struct neighbour *n = NULL;
647 +
648 + netif_tx_unlock_bh(dev);
649 +
650 + skb->dev = dev;
651 +- if (dst)
652 +- n = dst_get_neighbour_raw(dst);
653 +- if (!dst || !n) {
654 +- /* put pseudoheader back on for next time */
655 +- skb_push(skb, sizeof (struct ipoib_pseudoheader));
656 +- }
657 +
658 + if (dev_queue_xmit(skb))
659 + ipoib_warn(priv, "dev_queue_xmit failed to requeue packet\n");
660 ++
661 + netif_tx_lock_bh(dev);
662 + }
663 + netif_tx_unlock_bh(dev);
664 +diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
665 +index 6ed9646..3f175eb 100644
666 +--- a/drivers/media/rc/imon.c
667 ++++ b/drivers/media/rc/imon.c
668 +@@ -47,7 +47,7 @@
669 + #define MOD_AUTHOR "Jarod Wilson <jarod@××××××××.com>"
670 + #define MOD_DESC "Driver for SoundGraph iMON MultiMedia IR/Display"
671 + #define MOD_NAME "imon"
672 +-#define MOD_VERSION "0.9.3"
673 ++#define MOD_VERSION "0.9.4"
674 +
675 + #define DISPLAY_MINOR_BASE 144
676 + #define DEVICE_NAME "lcd%d"
677 +@@ -1658,9 +1658,17 @@ static void usb_rx_callback_intf0(struct urb *urb)
678 + return;
679 +
680 + ictx = (struct imon_context *)urb->context;
681 +- if (!ictx || !ictx->dev_present_intf0)
682 ++ if (!ictx)
683 + return;
684 +
685 ++ /*
686 ++ * if we get a callback before we're done configuring the hardware, we
687 ++ * can't yet process the data, as there's nowhere to send it, but we
688 ++ * still need to submit a new rx URB to avoid wedging the hardware
689 ++ */
690 ++ if (!ictx->dev_present_intf0)
691 ++ goto out;
692 ++
693 + switch (urb->status) {
694 + case -ENOENT: /* usbcore unlink successful! */
695 + return;
696 +@@ -1678,6 +1686,7 @@ static void usb_rx_callback_intf0(struct urb *urb)
697 + break;
698 + }
699 +
700 ++out:
701 + usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC);
702 + }
703 +
704 +@@ -1690,9 +1699,17 @@ static void usb_rx_callback_intf1(struct urb *urb)
705 + return;
706 +
707 + ictx = (struct imon_context *)urb->context;
708 +- if (!ictx || !ictx->dev_present_intf1)
709 ++ if (!ictx)
710 + return;
711 +
712 ++ /*
713 ++ * if we get a callback before we're done configuring the hardware, we
714 ++ * can't yet process the data, as there's nowhere to send it, but we
715 ++ * still need to submit a new rx URB to avoid wedging the hardware
716 ++ */
717 ++ if (!ictx->dev_present_intf1)
718 ++ goto out;
719 ++
720 + switch (urb->status) {
721 + case -ENOENT: /* usbcore unlink successful! */
722 + return;
723 +@@ -1710,6 +1727,7 @@ static void usb_rx_callback_intf1(struct urb *urb)
724 + break;
725 + }
726 +
727 ++out:
728 + usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC);
729 + }
730 +
731 +@@ -2242,7 +2260,7 @@ find_endpoint_failed:
732 + mutex_unlock(&ictx->lock);
733 + usb_free_urb(rx_urb);
734 + rx_urb_alloc_failed:
735 +- dev_err(ictx->dev, "unable to initialize intf0, err %d\n", ret);
736 ++ dev_err(ictx->dev, "unable to initialize intf1, err %d\n", ret);
737 +
738 + return NULL;
739 + }
740 +diff --git a/drivers/media/video/hdpvr/hdpvr-video.c b/drivers/media/video/hdpvr/hdpvr-video.c
741 +index 087f7c0..41fd57b 100644
742 +--- a/drivers/media/video/hdpvr/hdpvr-video.c
743 ++++ b/drivers/media/video/hdpvr/hdpvr-video.c
744 +@@ -283,12 +283,13 @@ static int hdpvr_start_streaming(struct hdpvr_device *dev)
745 +
746 + hdpvr_config_call(dev, CTRL_START_STREAMING_VALUE, 0x00);
747 +
748 ++ dev->status = STATUS_STREAMING;
749 ++
750 + INIT_WORK(&dev->worker, hdpvr_transmit_buffers);
751 + queue_work(dev->workqueue, &dev->worker);
752 +
753 + v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev,
754 + "streaming started\n");
755 +- dev->status = STATUS_STREAMING;
756 +
757 + return 0;
758 + }
759 +diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
760 +index 1e0e27c..e15e47d 100644
761 +--- a/drivers/mmc/card/block.c
762 ++++ b/drivers/mmc/card/block.c
763 +@@ -266,6 +266,9 @@ static struct mmc_blk_ioc_data *mmc_blk_ioctl_copy_from_user(
764 + goto idata_err;
765 + }
766 +
767 ++ if (!idata->buf_bytes)
768 ++ return idata;
769 ++
770 + idata->buf = kzalloc(idata->buf_bytes, GFP_KERNEL);
771 + if (!idata->buf) {
772 + err = -ENOMEM;
773 +@@ -312,25 +315,6 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev,
774 + if (IS_ERR(idata))
775 + return PTR_ERR(idata);
776 +
777 +- cmd.opcode = idata->ic.opcode;
778 +- cmd.arg = idata->ic.arg;
779 +- cmd.flags = idata->ic.flags;
780 +-
781 +- data.sg = &sg;
782 +- data.sg_len = 1;
783 +- data.blksz = idata->ic.blksz;
784 +- data.blocks = idata->ic.blocks;
785 +-
786 +- sg_init_one(data.sg, idata->buf, idata->buf_bytes);
787 +-
788 +- if (idata->ic.write_flag)
789 +- data.flags = MMC_DATA_WRITE;
790 +- else
791 +- data.flags = MMC_DATA_READ;
792 +-
793 +- mrq.cmd = &cmd;
794 +- mrq.data = &data;
795 +-
796 + md = mmc_blk_get(bdev->bd_disk);
797 + if (!md) {
798 + err = -EINVAL;
799 +@@ -343,6 +327,48 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev,
800 + goto cmd_done;
801 + }
802 +
803 ++ cmd.opcode = idata->ic.opcode;
804 ++ cmd.arg = idata->ic.arg;
805 ++ cmd.flags = idata->ic.flags;
806 ++
807 ++ if (idata->buf_bytes) {
808 ++ data.sg = &sg;
809 ++ data.sg_len = 1;
810 ++ data.blksz = idata->ic.blksz;
811 ++ data.blocks = idata->ic.blocks;
812 ++
813 ++ sg_init_one(data.sg, idata->buf, idata->buf_bytes);
814 ++
815 ++ if (idata->ic.write_flag)
816 ++ data.flags = MMC_DATA_WRITE;
817 ++ else
818 ++ data.flags = MMC_DATA_READ;
819 ++
820 ++ /* data.flags must already be set before doing this. */
821 ++ mmc_set_data_timeout(&data, card);
822 ++
823 ++ /* Allow overriding the timeout_ns for empirical tuning. */
824 ++ if (idata->ic.data_timeout_ns)
825 ++ data.timeout_ns = idata->ic.data_timeout_ns;
826 ++
827 ++ if ((cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B) {
828 ++ /*
829 ++ * Pretend this is a data transfer and rely on the
830 ++ * host driver to compute timeout. When all host
831 ++ * drivers support cmd.cmd_timeout for R1B, this
832 ++ * can be changed to:
833 ++ *
834 ++ * mrq.data = NULL;
835 ++ * cmd.cmd_timeout = idata->ic.cmd_timeout_ms;
836 ++ */
837 ++ data.timeout_ns = idata->ic.cmd_timeout_ms * 1000000;
838 ++ }
839 ++
840 ++ mrq.data = &data;
841 ++ }
842 ++
843 ++ mrq.cmd = &cmd;
844 ++
845 + mmc_claim_host(card->host);
846 +
847 + if (idata->ic.is_acmd) {
848 +@@ -351,24 +377,6 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev,
849 + goto cmd_rel_host;
850 + }
851 +
852 +- /* data.flags must already be set before doing this. */
853 +- mmc_set_data_timeout(&data, card);
854 +- /* Allow overriding the timeout_ns for empirical tuning. */
855 +- if (idata->ic.data_timeout_ns)
856 +- data.timeout_ns = idata->ic.data_timeout_ns;
857 +-
858 +- if ((cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B) {
859 +- /*
860 +- * Pretend this is a data transfer and rely on the host driver
861 +- * to compute timeout. When all host drivers support
862 +- * cmd.cmd_timeout for R1B, this can be changed to:
863 +- *
864 +- * mrq.data = NULL;
865 +- * cmd.cmd_timeout = idata->ic.cmd_timeout_ms;
866 +- */
867 +- data.timeout_ns = idata->ic.cmd_timeout_ms * 1000000;
868 +- }
869 +-
870 + mmc_wait_for_req(card->host, &mrq);
871 +
872 + if (cmd.error) {
873 +diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
874 +index 04a3f1b..192b0d1 100644
875 +--- a/drivers/net/can/sja1000/sja1000.c
876 ++++ b/drivers/net/can/sja1000/sja1000.c
877 +@@ -95,11 +95,16 @@ static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val)
878 + spin_unlock_irqrestore(&priv->cmdreg_lock, flags);
879 + }
880 +
881 ++static int sja1000_is_absent(struct sja1000_priv *priv)
882 ++{
883 ++ return (priv->read_reg(priv, REG_MOD) == 0xFF);
884 ++}
885 ++
886 + static int sja1000_probe_chip(struct net_device *dev)
887 + {
888 + struct sja1000_priv *priv = netdev_priv(dev);
889 +
890 +- if (priv->reg_base && (priv->read_reg(priv, 0) == 0xFF)) {
891 ++ if (priv->reg_base && sja1000_is_absent(priv)) {
892 + printk(KERN_INFO "%s: probing @0x%lX failed\n",
893 + DRV_NAME, dev->base_addr);
894 + return 0;
895 +@@ -493,6 +498,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
896 + while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
897 + n++;
898 + status = priv->read_reg(priv, REG_SR);
899 ++ /* check for absent controller due to hw unplug */
900 ++ if (status == 0xFF && sja1000_is_absent(priv))
901 ++ return IRQ_NONE;
902 +
903 + if (isrc & IRQ_WUI)
904 + dev_warn(dev->dev.parent, "wakeup interrupt\n");
905 +@@ -509,6 +517,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
906 + while (status & SR_RBS) {
907 + sja1000_rx(dev);
908 + status = priv->read_reg(priv, REG_SR);
909 ++ /* check for absent controller */
910 ++ if (status == 0xFF && sja1000_is_absent(priv))
911 ++ return IRQ_NONE;
912 + }
913 + }
914 + if (isrc & (IRQ_DOI | IRQ_EI | IRQ_BEI | IRQ_EPI | IRQ_ALI)) {
915 +diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
916 +index b42c06b..e0c5529 100644
917 +--- a/drivers/net/ethernet/3com/3c59x.c
918 ++++ b/drivers/net/ethernet/3com/3c59x.c
919 +@@ -1842,7 +1842,7 @@ vortex_timer(unsigned long data)
920 + ok = 1;
921 + }
922 +
923 +- if (!netif_carrier_ok(dev))
924 ++ if (dev->flags & IFF_SLAVE || !netif_carrier_ok(dev))
925 + next_tick = 5*HZ;
926 +
927 + if (vp->medialock)
928 +diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
929 +index 76b8457..ab784e0 100644
930 +--- a/drivers/net/ethernet/jme.c
931 ++++ b/drivers/net/ethernet/jme.c
932 +@@ -2328,19 +2328,11 @@ jme_change_mtu(struct net_device *netdev, int new_mtu)
933 + ((new_mtu) < IPV6_MIN_MTU))
934 + return -EINVAL;
935 +
936 +- if (new_mtu > 4000) {
937 +- jme->reg_rxcs &= ~RXCS_FIFOTHNP;
938 +- jme->reg_rxcs |= RXCS_FIFOTHNP_64QW;
939 +- jme_restart_rx_engine(jme);
940 +- } else {
941 +- jme->reg_rxcs &= ~RXCS_FIFOTHNP;
942 +- jme->reg_rxcs |= RXCS_FIFOTHNP_128QW;
943 +- jme_restart_rx_engine(jme);
944 +- }
945 +
946 + netdev->mtu = new_mtu;
947 + netdev_update_features(netdev);
948 +
949 ++ jme_restart_rx_engine(jme);
950 + jme_reset_link(jme);
951 +
952 + return 0;
953 +diff --git a/drivers/net/ethernet/jme.h b/drivers/net/ethernet/jme.h
954 +index 4304072..3efc897 100644
955 +--- a/drivers/net/ethernet/jme.h
956 ++++ b/drivers/net/ethernet/jme.h
957 +@@ -730,7 +730,7 @@ enum jme_rxcs_values {
958 + RXCS_RETRYCNT_60 = 0x00000F00,
959 +
960 + RXCS_DEFAULT = RXCS_FIFOTHTP_128T |
961 +- RXCS_FIFOTHNP_128QW |
962 ++ RXCS_FIFOTHNP_16QW |
963 + RXCS_DMAREQSZ_128B |
964 + RXCS_RETRYGAP_256ns |
965 + RXCS_RETRYCNT_32,
966 +diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
967 +index 815c797..22f2788 100644
968 +--- a/drivers/net/ethernet/ti/davinci_emac.c
969 ++++ b/drivers/net/ethernet/ti/davinci_emac.c
970 +@@ -1007,7 +1007,7 @@ static void emac_rx_handler(void *token, int len, int status)
971 + int ret;
972 +
973 + /* free and bail if we are shutting down */
974 +- if (unlikely(!netif_running(ndev) || !netif_carrier_ok(ndev))) {
975 ++ if (unlikely(!netif_running(ndev))) {
976 + dev_kfree_skb_any(skb);
977 + return;
978 + }
979 +@@ -1036,7 +1036,9 @@ static void emac_rx_handler(void *token, int len, int status)
980 + recycle:
981 + ret = cpdma_chan_submit(priv->rxchan, skb, skb->data,
982 + skb_tailroom(skb), GFP_KERNEL);
983 +- if (WARN_ON(ret < 0))
984 ++
985 ++ WARN_ON(ret == -ENOMEM);
986 ++ if (unlikely(ret < 0))
987 + dev_kfree_skb_any(skb);
988 + }
989 +
990 +diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
991 +index 4535d7c..e015a57 100644
992 +--- a/drivers/net/ethernet/via/via-velocity.c
993 ++++ b/drivers/net/ethernet/via/via-velocity.c
994 +@@ -2489,9 +2489,6 @@ static int velocity_close(struct net_device *dev)
995 + if (dev->irq != 0)
996 + free_irq(dev->irq, dev);
997 +
998 +- /* Power down the chip */
999 +- pci_set_power_state(vptr->pdev, PCI_D3hot);
1000 +-
1001 + velocity_free_rings(vptr);
1002 +
1003 + vptr->flags &= (~VELOCITY_FLAGS_OPENED);
1004 +diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
1005 +index 13c1f04..ad96164 100644
1006 +--- a/drivers/net/usb/ipheth.c
1007 ++++ b/drivers/net/usb/ipheth.c
1008 +@@ -60,6 +60,7 @@
1009 + #define USB_PRODUCT_IPHONE_3GS 0x1294
1010 + #define USB_PRODUCT_IPHONE_4 0x1297
1011 + #define USB_PRODUCT_IPHONE_4_VZW 0x129c
1012 ++#define USB_PRODUCT_IPHONE_4S 0x12a0
1013 +
1014 + #define IPHETH_USBINTF_CLASS 255
1015 + #define IPHETH_USBINTF_SUBCLASS 253
1016 +@@ -103,6 +104,10 @@ static struct usb_device_id ipheth_table[] = {
1017 + USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4_VZW,
1018 + IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
1019 + IPHETH_USBINTF_PROTO) },
1020 ++ { USB_DEVICE_AND_INTERFACE_INFO(
1021 ++ USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4S,
1022 ++ IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
1023 ++ IPHETH_USBINTF_PROTO) },
1024 + { }
1025 + };
1026 + MODULE_DEVICE_TABLE(usb, ipheth_table);
1027 +diff --git a/drivers/net/veth.c b/drivers/net/veth.c
1028 +index ef883e9..b907398 100644
1029 +--- a/drivers/net/veth.c
1030 ++++ b/drivers/net/veth.c
1031 +@@ -423,7 +423,9 @@ static void veth_dellink(struct net_device *dev, struct list_head *head)
1032 + unregister_netdevice_queue(peer, head);
1033 + }
1034 +
1035 +-static const struct nla_policy veth_policy[VETH_INFO_MAX + 1];
1036 ++static const struct nla_policy veth_policy[VETH_INFO_MAX + 1] = {
1037 ++ [VETH_INFO_PEER] = { .len = sizeof(struct ifinfomsg) },
1038 ++};
1039 +
1040 + static struct rtnl_link_ops veth_link_ops = {
1041 + .kind = DRV_NAME,
1042 +diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
1043 +index 528d5f3..64af11f 100644
1044 +--- a/drivers/net/wireless/ath/ath9k/rc.c
1045 ++++ b/drivers/net/wireless/ath/ath9k/rc.c
1046 +@@ -1347,7 +1347,7 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
1047 + fc = hdr->frame_control;
1048 + for (i = 0; i < sc->hw->max_rates; i++) {
1049 + struct ieee80211_tx_rate *rate = &tx_info->status.rates[i];
1050 +- if (!rate->count)
1051 ++ if (rate->idx < 0 || !rate->count)
1052 + break;
1053 +
1054 + final_ts_idx = i;
1055 +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
1056 +index 04e74f4..dfee1b3 100644
1057 +--- a/drivers/pci/probe.c
1058 ++++ b/drivers/pci/probe.c
1059 +@@ -651,6 +651,11 @@ int __devinit pci_scan_bridge(struct pci_bus *bus, struct pci_dev *dev, int max,
1060 + dev_dbg(&dev->dev, "scanning [bus %02x-%02x] behind bridge, pass %d\n",
1061 + secondary, subordinate, pass);
1062 +
1063 ++ if (!primary && (primary != bus->number) && secondary && subordinate) {
1064 ++ dev_warn(&dev->dev, "Primary bus is hard wired to 0\n");
1065 ++ primary = bus->number;
1066 ++ }
1067 ++
1068 + /* Check if setup is sensible at all */
1069 + if (!pass &&
1070 + (primary != bus->number || secondary <= bus->number)) {
1071 +diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c
1072 +index d329f8b..2aeaf5c 100644
1073 +--- a/drivers/scsi/scsi_pm.c
1074 ++++ b/drivers/scsi/scsi_pm.c
1075 +@@ -7,6 +7,7 @@
1076 +
1077 + #include <linux/pm_runtime.h>
1078 + #include <linux/export.h>
1079 ++#include <linux/async.h>
1080 +
1081 + #include <scsi/scsi.h>
1082 + #include <scsi/scsi_device.h>
1083 +@@ -69,6 +70,19 @@ static int scsi_bus_resume_common(struct device *dev)
1084 + return err;
1085 + }
1086 +
1087 ++static int scsi_bus_prepare(struct device *dev)
1088 ++{
1089 ++ if (scsi_is_sdev_device(dev)) {
1090 ++ /* sd probing uses async_schedule. Wait until it finishes. */
1091 ++ async_synchronize_full();
1092 ++
1093 ++ } else if (scsi_is_host_device(dev)) {
1094 ++ /* Wait until async scanning is finished */
1095 ++ scsi_complete_async_scans();
1096 ++ }
1097 ++ return 0;
1098 ++}
1099 ++
1100 + static int scsi_bus_suspend(struct device *dev)
1101 + {
1102 + return scsi_bus_suspend_common(dev, PMSG_SUSPEND);
1103 +@@ -87,6 +101,7 @@ static int scsi_bus_poweroff(struct device *dev)
1104 + #else /* CONFIG_PM_SLEEP */
1105 +
1106 + #define scsi_bus_resume_common NULL
1107 ++#define scsi_bus_prepare NULL
1108 + #define scsi_bus_suspend NULL
1109 + #define scsi_bus_freeze NULL
1110 + #define scsi_bus_poweroff NULL
1111 +@@ -195,6 +210,7 @@ void scsi_autopm_put_host(struct Scsi_Host *shost)
1112 + #endif /* CONFIG_PM_RUNTIME */
1113 +
1114 + const struct dev_pm_ops scsi_bus_pm_ops = {
1115 ++ .prepare = scsi_bus_prepare,
1116 + .suspend = scsi_bus_suspend,
1117 + .resume = scsi_bus_resume_common,
1118 + .freeze = scsi_bus_freeze,
1119 +diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h
1120 +index 2a58895..5b475d0 100644
1121 +--- a/drivers/scsi/scsi_priv.h
1122 ++++ b/drivers/scsi/scsi_priv.h
1123 +@@ -110,6 +110,7 @@ extern void scsi_exit_procfs(void);
1124 + #endif /* CONFIG_PROC_FS */
1125 +
1126 + /* scsi_scan.c */
1127 ++extern int scsi_complete_async_scans(void);
1128 + extern int scsi_scan_host_selected(struct Scsi_Host *, unsigned int,
1129 + unsigned int, unsigned int, int);
1130 + extern void scsi_forget_host(struct Scsi_Host *);
1131 +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
1132 +index b3c6d95..6e7ea4a 100644
1133 +--- a/drivers/scsi/scsi_scan.c
1134 ++++ b/drivers/scsi/scsi_scan.c
1135 +@@ -1815,6 +1815,7 @@ static void scsi_finish_async_scan(struct async_scan_data *data)
1136 + }
1137 + spin_unlock(&async_scan_lock);
1138 +
1139 ++ scsi_autopm_put_host(shost);
1140 + scsi_host_put(shost);
1141 + kfree(data);
1142 + }
1143 +@@ -1841,7 +1842,6 @@ static int do_scan_async(void *_data)
1144 +
1145 + do_scsi_scan_host(shost);
1146 + scsi_finish_async_scan(data);
1147 +- scsi_autopm_put_host(shost);
1148 + return 0;
1149 + }
1150 +
1151 +@@ -1869,7 +1869,7 @@ void scsi_scan_host(struct Scsi_Host *shost)
1152 + p = kthread_run(do_scan_async, data, "scsi_scan_%d", shost->host_no);
1153 + if (IS_ERR(p))
1154 + do_scan_async(data);
1155 +- /* scsi_autopm_put_host(shost) is called in do_scan_async() */
1156 ++ /* scsi_autopm_put_host(shost) is called in scsi_finish_async_scan() */
1157 + }
1158 + EXPORT_SYMBOL(scsi_scan_host);
1159 +
1160 +diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
1161 +index 1dcbef4..1d24512 100644
1162 +--- a/drivers/target/target_core_alua.c
1163 ++++ b/drivers/target/target_core_alua.c
1164 +@@ -79,7 +79,7 @@ int target_emulate_report_target_port_groups(struct se_task *task)
1165 + return -EINVAL;
1166 + }
1167 +
1168 +- buf = transport_kmap_first_data_page(cmd);
1169 ++ buf = transport_kmap_data_sg(cmd);
1170 +
1171 + spin_lock(&su_dev->t10_alua.tg_pt_gps_lock);
1172 + list_for_each_entry(tg_pt_gp, &su_dev->t10_alua.tg_pt_gps_list,
1173 +@@ -164,7 +164,7 @@ int target_emulate_report_target_port_groups(struct se_task *task)
1174 + buf[2] = ((rd_len >> 8) & 0xff);
1175 + buf[3] = (rd_len & 0xff);
1176 +
1177 +- transport_kunmap_first_data_page(cmd);
1178 ++ transport_kunmap_data_sg(cmd);
1179 +
1180 + task->task_scsi_status = GOOD;
1181 + transport_complete_task(task, 1);
1182 +@@ -195,7 +195,7 @@ int target_emulate_set_target_port_groups(struct se_task *task)
1183 + cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
1184 + return -EINVAL;
1185 + }
1186 +- buf = transport_kmap_first_data_page(cmd);
1187 ++ buf = transport_kmap_data_sg(cmd);
1188 +
1189 + /*
1190 + * Determine if explict ALUA via SET_TARGET_PORT_GROUPS is allowed
1191 +@@ -352,7 +352,7 @@ int target_emulate_set_target_port_groups(struct se_task *task)
1192 + }
1193 +
1194 + out:
1195 +- transport_kunmap_first_data_page(cmd);
1196 ++ transport_kunmap_data_sg(cmd);
1197 + task->task_scsi_status = GOOD;
1198 + transport_complete_task(task, 1);
1199 + return 0;
1200 +diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
1201 +index 251e48f..8facd33 100644
1202 +--- a/drivers/target/target_core_cdb.c
1203 ++++ b/drivers/target/target_core_cdb.c
1204 +@@ -82,7 +82,7 @@ target_emulate_inquiry_std(struct se_cmd *cmd)
1205 + return -EINVAL;
1206 + }
1207 +
1208 +- buf = transport_kmap_first_data_page(cmd);
1209 ++ buf = transport_kmap_data_sg(cmd);
1210 +
1211 + if (dev == tpg->tpg_virt_lun0.lun_se_dev) {
1212 + buf[0] = 0x3f; /* Not connected */
1213 +@@ -135,7 +135,7 @@ target_emulate_inquiry_std(struct se_cmd *cmd)
1214 + buf[4] = 31; /* Set additional length to 31 */
1215 +
1216 + out:
1217 +- transport_kunmap_first_data_page(cmd);
1218 ++ transport_kunmap_data_sg(cmd);
1219 + return 0;
1220 + }
1221 +
1222 +@@ -726,7 +726,7 @@ int target_emulate_inquiry(struct se_task *task)
1223 + return -EINVAL;
1224 + }
1225 +
1226 +- buf = transport_kmap_first_data_page(cmd);
1227 ++ buf = transport_kmap_data_sg(cmd);
1228 +
1229 + buf[0] = dev->transport->get_device_type(dev);
1230 +
1231 +@@ -743,7 +743,7 @@ int target_emulate_inquiry(struct se_task *task)
1232 + ret = -EINVAL;
1233 +
1234 + out_unmap:
1235 +- transport_kunmap_first_data_page(cmd);
1236 ++ transport_kunmap_data_sg(cmd);
1237 + out:
1238 + if (!ret) {
1239 + task->task_scsi_status = GOOD;
1240 +@@ -765,7 +765,7 @@ int target_emulate_readcapacity(struct se_task *task)
1241 + else
1242 + blocks = (u32)blocks_long;
1243 +
1244 +- buf = transport_kmap_first_data_page(cmd);
1245 ++ buf = transport_kmap_data_sg(cmd);
1246 +
1247 + buf[0] = (blocks >> 24) & 0xff;
1248 + buf[1] = (blocks >> 16) & 0xff;
1249 +@@ -781,7 +781,7 @@ int target_emulate_readcapacity(struct se_task *task)
1250 + if (dev->se_sub_dev->se_dev_attrib.emulate_tpu || dev->se_sub_dev->se_dev_attrib.emulate_tpws)
1251 + put_unaligned_be32(0xFFFFFFFF, &buf[0]);
1252 +
1253 +- transport_kunmap_first_data_page(cmd);
1254 ++ transport_kunmap_data_sg(cmd);
1255 +
1256 + task->task_scsi_status = GOOD;
1257 + transport_complete_task(task, 1);
1258 +@@ -795,7 +795,7 @@ int target_emulate_readcapacity_16(struct se_task *task)
1259 + unsigned char *buf;
1260 + unsigned long long blocks = dev->transport->get_blocks(dev);
1261 +
1262 +- buf = transport_kmap_first_data_page(cmd);
1263 ++ buf = transport_kmap_data_sg(cmd);
1264 +
1265 + buf[0] = (blocks >> 56) & 0xff;
1266 + buf[1] = (blocks >> 48) & 0xff;
1267 +@@ -816,7 +816,7 @@ int target_emulate_readcapacity_16(struct se_task *task)
1268 + if (dev->se_sub_dev->se_dev_attrib.emulate_tpu || dev->se_sub_dev->se_dev_attrib.emulate_tpws)
1269 + buf[14] = 0x80;
1270 +
1271 +- transport_kunmap_first_data_page(cmd);
1272 ++ transport_kunmap_data_sg(cmd);
1273 +
1274 + task->task_scsi_status = GOOD;
1275 + transport_complete_task(task, 1);
1276 +@@ -1029,9 +1029,9 @@ int target_emulate_modesense(struct se_task *task)
1277 + offset = cmd->data_length;
1278 + }
1279 +
1280 +- rbuf = transport_kmap_first_data_page(cmd);
1281 ++ rbuf = transport_kmap_data_sg(cmd);
1282 + memcpy(rbuf, buf, offset);
1283 +- transport_kunmap_first_data_page(cmd);
1284 ++ transport_kunmap_data_sg(cmd);
1285 +
1286 + task->task_scsi_status = GOOD;
1287 + transport_complete_task(task, 1);
1288 +@@ -1053,7 +1053,7 @@ int target_emulate_request_sense(struct se_task *task)
1289 + return -ENOSYS;
1290 + }
1291 +
1292 +- buf = transport_kmap_first_data_page(cmd);
1293 ++ buf = transport_kmap_data_sg(cmd);
1294 +
1295 + if (!core_scsi3_ua_clear_for_request_sense(cmd, &ua_asc, &ua_ascq)) {
1296 + /*
1297 +@@ -1099,7 +1099,7 @@ int target_emulate_request_sense(struct se_task *task)
1298 + }
1299 +
1300 + end:
1301 +- transport_kunmap_first_data_page(cmd);
1302 ++ transport_kunmap_data_sg(cmd);
1303 + task->task_scsi_status = GOOD;
1304 + transport_complete_task(task, 1);
1305 + return 0;
1306 +@@ -1133,7 +1133,7 @@ int target_emulate_unmap(struct se_task *task)
1307 + dl = get_unaligned_be16(&cdb[0]);
1308 + bd_dl = get_unaligned_be16(&cdb[2]);
1309 +
1310 +- buf = transport_kmap_first_data_page(cmd);
1311 ++ buf = transport_kmap_data_sg(cmd);
1312 +
1313 + ptr = &buf[offset];
1314 + pr_debug("UNMAP: Sub: %s Using dl: %hu bd_dl: %hu size: %hu"
1315 +@@ -1157,7 +1157,7 @@ int target_emulate_unmap(struct se_task *task)
1316 + }
1317 +
1318 + err:
1319 +- transport_kunmap_first_data_page(cmd);
1320 ++ transport_kunmap_data_sg(cmd);
1321 + if (!ret) {
1322 + task->task_scsi_status = GOOD;
1323 + transport_complete_task(task, 1);
1324 +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
1325 +index 9b86394..19f8aca 100644
1326 +--- a/drivers/target/target_core_device.c
1327 ++++ b/drivers/target/target_core_device.c
1328 +@@ -658,7 +658,7 @@ int target_report_luns(struct se_task *se_task)
1329 + unsigned char *buf;
1330 + u32 cdb_offset = 0, lun_count = 0, offset = 8, i;
1331 +
1332 +- buf = transport_kmap_first_data_page(se_cmd);
1333 ++ buf = (unsigned char *) transport_kmap_data_sg(se_cmd);
1334 +
1335 + /*
1336 + * If no struct se_session pointer is present, this struct se_cmd is
1337 +@@ -696,7 +696,7 @@ int target_report_luns(struct se_task *se_task)
1338 + * See SPC3 r07, page 159.
1339 + */
1340 + done:
1341 +- transport_kunmap_first_data_page(se_cmd);
1342 ++ transport_kunmap_data_sg(se_cmd);
1343 + lun_count *= 8;
1344 + buf[0] = ((lun_count >> 24) & 0xff);
1345 + buf[1] = ((lun_count >> 16) & 0xff);
1346 +diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
1347 +index 9119d92..778c1a6 100644
1348 +--- a/drivers/target/target_core_pr.c
1349 ++++ b/drivers/target/target_core_pr.c
1350 +@@ -1538,7 +1538,7 @@ static int core_scsi3_decode_spec_i_port(
1351 + tidh_new->dest_local_nexus = 1;
1352 + list_add_tail(&tidh_new->dest_list, &tid_dest_list);
1353 +
1354 +- buf = transport_kmap_first_data_page(cmd);
1355 ++ buf = transport_kmap_data_sg(cmd);
1356 + /*
1357 + * For a PERSISTENT RESERVE OUT specify initiator ports payload,
1358 + * first extract TransportID Parameter Data Length, and make sure
1359 +@@ -1789,7 +1789,7 @@ static int core_scsi3_decode_spec_i_port(
1360 +
1361 + }
1362 +
1363 +- transport_kunmap_first_data_page(cmd);
1364 ++ transport_kunmap_data_sg(cmd);
1365 +
1366 + /*
1367 + * Go ahead and create a registrations from tid_dest_list for the
1368 +@@ -1837,7 +1837,7 @@ static int core_scsi3_decode_spec_i_port(
1369 +
1370 + return 0;
1371 + out:
1372 +- transport_kunmap_first_data_page(cmd);
1373 ++ transport_kunmap_data_sg(cmd);
1374 + /*
1375 + * For the failure case, release everything from tid_dest_list
1376 + * including *dest_pr_reg and the configfs dependances..
1377 +@@ -3429,14 +3429,14 @@ static int core_scsi3_emulate_pro_register_and_move(
1378 + * will be moved to for the TransportID containing SCSI initiator WWN
1379 + * information.
1380 + */
1381 +- buf = transport_kmap_first_data_page(cmd);
1382 ++ buf = transport_kmap_data_sg(cmd);
1383 + rtpi = (buf[18] & 0xff) << 8;
1384 + rtpi |= buf[19] & 0xff;
1385 + tid_len = (buf[20] & 0xff) << 24;
1386 + tid_len |= (buf[21] & 0xff) << 16;
1387 + tid_len |= (buf[22] & 0xff) << 8;
1388 + tid_len |= buf[23] & 0xff;
1389 +- transport_kunmap_first_data_page(cmd);
1390 ++ transport_kunmap_data_sg(cmd);
1391 + buf = NULL;
1392 +
1393 + if ((tid_len + 24) != cmd->data_length) {
1394 +@@ -3488,7 +3488,7 @@ static int core_scsi3_emulate_pro_register_and_move(
1395 + return -EINVAL;
1396 + }
1397 +
1398 +- buf = transport_kmap_first_data_page(cmd);
1399 ++ buf = transport_kmap_data_sg(cmd);
1400 + proto_ident = (buf[24] & 0x0f);
1401 + #if 0
1402 + pr_debug("SPC-3 PR REGISTER_AND_MOVE: Extracted Protocol Identifier:"
1403 +@@ -3522,7 +3522,7 @@ static int core_scsi3_emulate_pro_register_and_move(
1404 + goto out;
1405 + }
1406 +
1407 +- transport_kunmap_first_data_page(cmd);
1408 ++ transport_kunmap_data_sg(cmd);
1409 + buf = NULL;
1410 +
1411 + pr_debug("SPC-3 PR [%s] Extracted initiator %s identifier: %s"
1412 +@@ -3787,13 +3787,13 @@ after_iport_check:
1413 + " REGISTER_AND_MOVE\n");
1414 + }
1415 +
1416 +- transport_kunmap_first_data_page(cmd);
1417 ++ transport_kunmap_data_sg(cmd);
1418 +
1419 + core_scsi3_put_pr_reg(dest_pr_reg);
1420 + return 0;
1421 + out:
1422 + if (buf)
1423 +- transport_kunmap_first_data_page(cmd);
1424 ++ transport_kunmap_data_sg(cmd);
1425 + if (dest_se_deve)
1426 + core_scsi3_lunacl_undepend_item(dest_se_deve);
1427 + if (dest_node_acl)
1428 +@@ -3867,7 +3867,7 @@ int target_scsi3_emulate_pr_out(struct se_task *task)
1429 + scope = (cdb[2] & 0xf0);
1430 + type = (cdb[2] & 0x0f);
1431 +
1432 +- buf = transport_kmap_first_data_page(cmd);
1433 ++ buf = transport_kmap_data_sg(cmd);
1434 + /*
1435 + * From PERSISTENT_RESERVE_OUT parameter list (payload)
1436 + */
1437 +@@ -3885,7 +3885,7 @@ int target_scsi3_emulate_pr_out(struct se_task *task)
1438 + aptpl = (buf[17] & 0x01);
1439 + unreg = (buf[17] & 0x02);
1440 + }
1441 +- transport_kunmap_first_data_page(cmd);
1442 ++ transport_kunmap_data_sg(cmd);
1443 + buf = NULL;
1444 +
1445 + /*
1446 +@@ -3985,7 +3985,7 @@ static int core_scsi3_pri_read_keys(struct se_cmd *cmd)
1447 + return -EINVAL;
1448 + }
1449 +
1450 +- buf = transport_kmap_first_data_page(cmd);
1451 ++ buf = transport_kmap_data_sg(cmd);
1452 + buf[0] = ((su_dev->t10_pr.pr_generation >> 24) & 0xff);
1453 + buf[1] = ((su_dev->t10_pr.pr_generation >> 16) & 0xff);
1454 + buf[2] = ((su_dev->t10_pr.pr_generation >> 8) & 0xff);
1455 +@@ -4019,7 +4019,7 @@ static int core_scsi3_pri_read_keys(struct se_cmd *cmd)
1456 + buf[6] = ((add_len >> 8) & 0xff);
1457 + buf[7] = (add_len & 0xff);
1458 +
1459 +- transport_kunmap_first_data_page(cmd);
1460 ++ transport_kunmap_data_sg(cmd);
1461 +
1462 + return 0;
1463 + }
1464 +@@ -4045,7 +4045,7 @@ static int core_scsi3_pri_read_reservation(struct se_cmd *cmd)
1465 + return -EINVAL;
1466 + }
1467 +
1468 +- buf = transport_kmap_first_data_page(cmd);
1469 ++ buf = transport_kmap_data_sg(cmd);
1470 + buf[0] = ((su_dev->t10_pr.pr_generation >> 24) & 0xff);
1471 + buf[1] = ((su_dev->t10_pr.pr_generation >> 16) & 0xff);
1472 + buf[2] = ((su_dev->t10_pr.pr_generation >> 8) & 0xff);
1473 +@@ -4104,7 +4104,7 @@ static int core_scsi3_pri_read_reservation(struct se_cmd *cmd)
1474 +
1475 + err:
1476 + spin_unlock(&se_dev->dev_reservation_lock);
1477 +- transport_kunmap_first_data_page(cmd);
1478 ++ transport_kunmap_data_sg(cmd);
1479 +
1480 + return 0;
1481 + }
1482 +@@ -4128,7 +4128,7 @@ static int core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
1483 + return -EINVAL;
1484 + }
1485 +
1486 +- buf = transport_kmap_first_data_page(cmd);
1487 ++ buf = transport_kmap_data_sg(cmd);
1488 +
1489 + buf[0] = ((add_len << 8) & 0xff);
1490 + buf[1] = (add_len & 0xff);
1491 +@@ -4160,7 +4160,7 @@ static int core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
1492 + buf[4] |= 0x02; /* PR_TYPE_WRITE_EXCLUSIVE */
1493 + buf[5] |= 0x01; /* PR_TYPE_EXCLUSIVE_ACCESS_ALLREG */
1494 +
1495 +- transport_kunmap_first_data_page(cmd);
1496 ++ transport_kunmap_data_sg(cmd);
1497 +
1498 + return 0;
1499 + }
1500 +@@ -4190,7 +4190,7 @@ static int core_scsi3_pri_read_full_status(struct se_cmd *cmd)
1501 + return -EINVAL;
1502 + }
1503 +
1504 +- buf = transport_kmap_first_data_page(cmd);
1505 ++ buf = transport_kmap_data_sg(cmd);
1506 +
1507 + buf[0] = ((su_dev->t10_pr.pr_generation >> 24) & 0xff);
1508 + buf[1] = ((su_dev->t10_pr.pr_generation >> 16) & 0xff);
1509 +@@ -4311,7 +4311,7 @@ static int core_scsi3_pri_read_full_status(struct se_cmd *cmd)
1510 + buf[6] = ((add_len >> 8) & 0xff);
1511 + buf[7] = (add_len & 0xff);
1512 +
1513 +- transport_kunmap_first_data_page(cmd);
1514 ++ transport_kunmap_data_sg(cmd);
1515 +
1516 + return 0;
1517 + }
1518 +diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
1519 +index 8b15e56..5c12137 100644
1520 +--- a/drivers/target/target_core_pscsi.c
1521 ++++ b/drivers/target/target_core_pscsi.c
1522 +@@ -695,7 +695,7 @@ static int pscsi_transport_complete(struct se_task *task)
1523 +
1524 + if (task->task_se_cmd->se_deve->lun_flags &
1525 + TRANSPORT_LUNFLAGS_READ_ONLY) {
1526 +- unsigned char *buf = transport_kmap_first_data_page(task->task_se_cmd);
1527 ++ unsigned char *buf = transport_kmap_data_sg(task->task_se_cmd);
1528 +
1529 + if (cdb[0] == MODE_SENSE_10) {
1530 + if (!(buf[3] & 0x80))
1531 +@@ -705,7 +705,7 @@ static int pscsi_transport_complete(struct se_task *task)
1532 + buf[2] |= 0x80;
1533 + }
1534 +
1535 +- transport_kunmap_first_data_page(task->task_se_cmd);
1536 ++ transport_kunmap_data_sg(task->task_se_cmd);
1537 + }
1538 + }
1539 + after_mode_sense:
1540 +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
1541 +index 861628e..e4ddb93 100644
1542 +--- a/drivers/target/target_core_transport.c
1543 ++++ b/drivers/target/target_core_transport.c
1544 +@@ -3053,11 +3053,6 @@ static int transport_generic_cmd_sequencer(
1545 + (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB)))
1546 + goto out_unsupported_cdb;
1547 +
1548 +- /* Let's limit control cdbs to a page, for simplicity's sake. */
1549 +- if ((cmd->se_cmd_flags & SCF_SCSI_CONTROL_SG_IO_CDB) &&
1550 +- size > PAGE_SIZE)
1551 +- goto out_invalid_cdb_field;
1552 +-
1553 + transport_set_supported_SAM_opcode(cmd);
1554 + return ret;
1555 +
1556 +@@ -3435,9 +3430,11 @@ int transport_generic_map_mem_to_cmd(
1557 + }
1558 + EXPORT_SYMBOL(transport_generic_map_mem_to_cmd);
1559 +
1560 +-void *transport_kmap_first_data_page(struct se_cmd *cmd)
1561 ++void *transport_kmap_data_sg(struct se_cmd *cmd)
1562 + {
1563 + struct scatterlist *sg = cmd->t_data_sg;
1564 ++ struct page **pages;
1565 ++ int i;
1566 +
1567 + BUG_ON(!sg);
1568 + /*
1569 +@@ -3445,15 +3442,41 @@ void *transport_kmap_first_data_page(struct se_cmd *cmd)
1570 + * tcm_loop who may be using a contig buffer from the SCSI midlayer for
1571 + * control CDBs passed as SGLs via transport_generic_map_mem_to_cmd()
1572 + */
1573 +- return kmap(sg_page(sg)) + sg->offset;
1574 ++ if (!cmd->t_data_nents)
1575 ++ return NULL;
1576 ++ else if (cmd->t_data_nents == 1)
1577 ++ return kmap(sg_page(sg)) + sg->offset;
1578 ++
1579 ++ /* >1 page. use vmap */
1580 ++ pages = kmalloc(sizeof(*pages) * cmd->t_data_nents, GFP_KERNEL);
1581 ++ if (!pages)
1582 ++ return NULL;
1583 ++
1584 ++ /* convert sg[] to pages[] */
1585 ++ for_each_sg(cmd->t_data_sg, sg, cmd->t_data_nents, i) {
1586 ++ pages[i] = sg_page(sg);
1587 ++ }
1588 ++
1589 ++ cmd->t_data_vmap = vmap(pages, cmd->t_data_nents, VM_MAP, PAGE_KERNEL);
1590 ++ kfree(pages);
1591 ++ if (!cmd->t_data_vmap)
1592 ++ return NULL;
1593 ++
1594 ++ return cmd->t_data_vmap + cmd->t_data_sg[0].offset;
1595 + }
1596 +-EXPORT_SYMBOL(transport_kmap_first_data_page);
1597 ++EXPORT_SYMBOL(transport_kmap_data_sg);
1598 +
1599 +-void transport_kunmap_first_data_page(struct se_cmd *cmd)
1600 ++void transport_kunmap_data_sg(struct se_cmd *cmd)
1601 + {
1602 +- kunmap(sg_page(cmd->t_data_sg));
1603 ++ if (!cmd->t_data_nents)
1604 ++ return;
1605 ++ else if (cmd->t_data_nents == 1)
1606 ++ kunmap(sg_page(cmd->t_data_sg));
1607 ++
1608 ++ vunmap(cmd->t_data_vmap);
1609 ++ cmd->t_data_vmap = NULL;
1610 + }
1611 +-EXPORT_SYMBOL(transport_kunmap_first_data_page);
1612 ++EXPORT_SYMBOL(transport_kunmap_data_sg);
1613 +
1614 + static int
1615 + transport_generic_get_mem(struct se_cmd *cmd)
1616 +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
1617 +index a004db3..61d08dd 100644
1618 +--- a/drivers/usb/core/hcd-pci.c
1619 ++++ b/drivers/usb/core/hcd-pci.c
1620 +@@ -187,7 +187,10 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
1621 + return -ENODEV;
1622 + dev->current_state = PCI_D0;
1623 +
1624 +- if (!dev->irq) {
1625 ++ /* The xHCI driver supports MSI and MSI-X,
1626 ++ * so don't fail if the BIOS doesn't provide a legacy IRQ.
1627 ++ */
1628 ++ if (!dev->irq && (driver->flags & HCD_MASK) != HCD_USB3) {
1629 + dev_err(&dev->dev,
1630 + "Found HC with no IRQ. Check BIOS/PCI %s setup!\n",
1631 + pci_name(dev));
1632 +diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
1633 +index 179e364..8cb9304 100644
1634 +--- a/drivers/usb/core/hcd.c
1635 ++++ b/drivers/usb/core/hcd.c
1636 +@@ -2465,8 +2465,10 @@ int usb_add_hcd(struct usb_hcd *hcd,
1637 + && device_can_wakeup(&hcd->self.root_hub->dev))
1638 + dev_dbg(hcd->self.controller, "supports USB remote wakeup\n");
1639 +
1640 +- /* enable irqs just before we start the controller */
1641 +- if (usb_hcd_is_primary_hcd(hcd)) {
1642 ++ /* enable irqs just before we start the controller,
1643 ++ * if the BIOS provides legacy PCI irqs.
1644 ++ */
1645 ++ if (usb_hcd_is_primary_hcd(hcd) && irqnum) {
1646 + retval = usb_hcd_request_irqs(hcd, irqnum, irqflags);
1647 + if (retval)
1648 + goto err_request_irq;
1649 +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
1650 +index 7978146..bc06a8f 100644
1651 +--- a/drivers/usb/core/hub.c
1652 ++++ b/drivers/usb/core/hub.c
1653 +@@ -705,10 +705,26 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
1654 + if (type == HUB_INIT3)
1655 + goto init3;
1656 +
1657 +- /* After a resume, port power should still be on.
1658 ++ /* The superspeed hub except for root hub has to use Hub Depth
1659 ++ * value as an offset into the route string to locate the bits
1660 ++ * it uses to determine the downstream port number. So hub driver
1661 ++ * should send a set hub depth request to superspeed hub after
1662 ++ * the superspeed hub is set configuration in initialization or
1663 ++ * reset procedure.
1664 ++ *
1665 ++ * After a resume, port power should still be on.
1666 + * For any other type of activation, turn it on.
1667 + */
1668 + if (type != HUB_RESUME) {
1669 ++ if (hdev->parent && hub_is_superspeed(hdev)) {
1670 ++ ret = usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
1671 ++ HUB_SET_DEPTH, USB_RT_HUB,
1672 ++ hdev->level - 1, 0, NULL, 0,
1673 ++ USB_CTRL_SET_TIMEOUT);
1674 ++ if (ret < 0)
1675 ++ dev_err(hub->intfdev,
1676 ++ "set hub depth failed\n");
1677 ++ }
1678 +
1679 + /* Speed up system boot by using a delayed_work for the
1680 + * hub's initial power-up delays. This is pretty awkward
1681 +@@ -987,18 +1003,6 @@ static int hub_configure(struct usb_hub *hub,
1682 + goto fail;
1683 + }
1684 +
1685 +- if (hub_is_superspeed(hdev) && (hdev->parent != NULL)) {
1686 +- ret = usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
1687 +- HUB_SET_DEPTH, USB_RT_HUB,
1688 +- hdev->level - 1, 0, NULL, 0,
1689 +- USB_CTRL_SET_TIMEOUT);
1690 +-
1691 +- if (ret < 0) {
1692 +- message = "can't set hub depth";
1693 +- goto fail;
1694 +- }
1695 +- }
1696 +-
1697 + /* Request the entire hub descriptor.
1698 + * hub->descriptor can handle USB_MAXCHILDREN ports,
1699 + * but the hub can/will return fewer bytes here.
1700 +diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
1701 +index ac53a66..7732d69 100644
1702 +--- a/drivers/usb/host/pci-quirks.c
1703 ++++ b/drivers/usb/host/pci-quirks.c
1704 +@@ -872,7 +872,17 @@ static void __devinit quirk_usb_early_handoff(struct pci_dev *pdev)
1705 + */
1706 + if (pdev->vendor == 0x184e) /* vendor Netlogic */
1707 + return;
1708 ++ if (pdev->class != PCI_CLASS_SERIAL_USB_UHCI &&
1709 ++ pdev->class != PCI_CLASS_SERIAL_USB_OHCI &&
1710 ++ pdev->class != PCI_CLASS_SERIAL_USB_EHCI &&
1711 ++ pdev->class != PCI_CLASS_SERIAL_USB_XHCI)
1712 ++ return;
1713 +
1714 ++ if (pci_enable_device(pdev) < 0) {
1715 ++ dev_warn(&pdev->dev, "Can't enable PCI device, "
1716 ++ "BIOS handoff failed.\n");
1717 ++ return;
1718 ++ }
1719 + if (pdev->class == PCI_CLASS_SERIAL_USB_UHCI)
1720 + quirk_usb_handoff_uhci(pdev);
1721 + else if (pdev->class == PCI_CLASS_SERIAL_USB_OHCI)
1722 +@@ -881,5 +891,6 @@ static void __devinit quirk_usb_early_handoff(struct pci_dev *pdev)
1723 + quirk_usb_disable_ehci(pdev);
1724 + else if (pdev->class == PCI_CLASS_SERIAL_USB_XHCI)
1725 + quirk_usb_handoff_xhci(pdev);
1726 ++ pci_disable_device(pdev);
1727 + }
1728 + DECLARE_PCI_FIXUP_FINAL(PCI_ANY_ID, PCI_ANY_ID, quirk_usb_early_handoff);
1729 +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
1730 +index 430e88f..a8b2980 100644
1731 +--- a/drivers/usb/host/xhci-hub.c
1732 ++++ b/drivers/usb/host/xhci-hub.c
1733 +@@ -95,7 +95,7 @@ static void xhci_usb2_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci,
1734 + */
1735 + memset(port_removable, 0, sizeof(port_removable));
1736 + for (i = 0; i < ports; i++) {
1737 +- portsc = xhci_readl(xhci, xhci->usb3_ports[i]);
1738 ++ portsc = xhci_readl(xhci, xhci->usb2_ports[i]);
1739 + /* If a device is removable, PORTSC reports a 0, same as in the
1740 + * hub descriptor DeviceRemovable bits.
1741 + */
1742 +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
1743 +index 0e4b25f..c69cf54 100644
1744 +--- a/drivers/usb/host/xhci-mem.c
1745 ++++ b/drivers/usb/host/xhci-mem.c
1746 +@@ -1140,26 +1140,42 @@ static unsigned int xhci_parse_exponent_interval(struct usb_device *udev,
1747 + }
1748 +
1749 + /*
1750 +- * Convert bInterval expressed in frames (in 1-255 range) to exponent of
1751 ++ * Convert bInterval expressed in microframes (in 1-255 range) to exponent of
1752 + * microframes, rounded down to nearest power of 2.
1753 + */
1754 +-static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
1755 +- struct usb_host_endpoint *ep)
1756 ++static unsigned int xhci_microframes_to_exponent(struct usb_device *udev,
1757 ++ struct usb_host_endpoint *ep, unsigned int desc_interval,
1758 ++ unsigned int min_exponent, unsigned int max_exponent)
1759 + {
1760 + unsigned int interval;
1761 +
1762 +- interval = fls(8 * ep->desc.bInterval) - 1;
1763 +- interval = clamp_val(interval, 3, 10);
1764 +- if ((1 << interval) != 8 * ep->desc.bInterval)
1765 ++ interval = fls(desc_interval) - 1;
1766 ++ interval = clamp_val(interval, min_exponent, max_exponent);
1767 ++ if ((1 << interval) != desc_interval)
1768 + dev_warn(&udev->dev,
1769 + "ep %#x - rounding interval to %d microframes, ep desc says %d microframes\n",
1770 + ep->desc.bEndpointAddress,
1771 + 1 << interval,
1772 +- 8 * ep->desc.bInterval);
1773 ++ desc_interval);
1774 +
1775 + return interval;
1776 + }
1777 +
1778 ++static unsigned int xhci_parse_microframe_interval(struct usb_device *udev,
1779 ++ struct usb_host_endpoint *ep)
1780 ++{
1781 ++ return xhci_microframes_to_exponent(udev, ep,
1782 ++ ep->desc.bInterval, 0, 15);
1783 ++}
1784 ++
1785 ++
1786 ++static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
1787 ++ struct usb_host_endpoint *ep)
1788 ++{
1789 ++ return xhci_microframes_to_exponent(udev, ep,
1790 ++ ep->desc.bInterval * 8, 3, 10);
1791 ++}
1792 ++
1793 + /* Return the polling or NAK interval.
1794 + *
1795 + * The polling interval is expressed in "microframes". If xHCI's Interval field
1796 +@@ -1178,7 +1194,7 @@ static unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
1797 + /* Max NAK rate */
1798 + if (usb_endpoint_xfer_control(&ep->desc) ||
1799 + usb_endpoint_xfer_bulk(&ep->desc)) {
1800 +- interval = ep->desc.bInterval;
1801 ++ interval = xhci_parse_microframe_interval(udev, ep);
1802 + break;
1803 + }
1804 + /* Fall through - SS and HS isoc/int have same decoding */
1805 +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
1806 +index b33f059..034f554 100644
1807 +--- a/drivers/usb/host/xhci.c
1808 ++++ b/drivers/usb/host/xhci.c
1809 +@@ -352,6 +352,11 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
1810 + /* hcd->irq is -1, we have MSI */
1811 + return 0;
1812 +
1813 ++ if (!pdev->irq) {
1814 ++ xhci_err(xhci, "No msi-x/msi found and no IRQ in BIOS\n");
1815 ++ return -EINVAL;
1816 ++ }
1817 ++
1818 + /* fall back to legacy interrupt*/
1819 + ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
1820 + hcd->irq_descr, hcd);
1821 +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
1822 +index a515237..33d25d4 100644
1823 +--- a/drivers/usb/serial/cp210x.c
1824 ++++ b/drivers/usb/serial/cp210x.c
1825 +@@ -136,6 +136,8 @@ static const struct usb_device_id id_table[] = {
1826 + { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
1827 + { USB_DEVICE(0x16DC, 0x0012) }, /* W-IE-NE-R Plein & Baus GmbH MPOD Multi Channel Power Supply */
1828 + { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Control, Monitoring and Data Logger */
1829 ++ { USB_DEVICE(0x17A8, 0x0001) }, /* Kamstrup Optical Eye/3-wire */
1830 ++ { USB_DEVICE(0x17A8, 0x0005) }, /* Kamstrup M-Bus Master MultiPort 250D */
1831 + { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
1832 + { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
1833 + { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
1834 +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
1835 +index 338d082..68fa8c7 100644
1836 +--- a/drivers/usb/serial/option.c
1837 ++++ b/drivers/usb/serial/option.c
1838 +@@ -788,7 +788,6 @@ static const struct usb_device_id option_ids[] = {
1839 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0012, 0xff, 0xff, 0xff),
1840 + .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
1841 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0013, 0xff, 0xff, 0xff) },
1842 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) },
1843 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628, 0xff, 0xff, 0xff) },
1844 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0016, 0xff, 0xff, 0xff) },
1845 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff),
1846 +@@ -803,7 +802,6 @@ static const struct usb_device_id option_ids[] = {
1847 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0024, 0xff, 0xff, 0xff) },
1848 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0025, 0xff, 0xff, 0xff),
1849 + .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
1850 +- /* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0026, 0xff, 0xff, 0xff) }, */
1851 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0028, 0xff, 0xff, 0xff) },
1852 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0029, 0xff, 0xff, 0xff) },
1853 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0030, 0xff, 0xff, 0xff) },
1854 +@@ -828,7 +826,6 @@ static const struct usb_device_id option_ids[] = {
1855 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0051, 0xff, 0xff, 0xff) },
1856 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0052, 0xff, 0xff, 0xff),
1857 + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
1858 +- /* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0053, 0xff, 0xff, 0xff) }, */
1859 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0054, 0xff, 0xff, 0xff) },
1860 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0055, 0xff, 0xff, 0xff),
1861 + .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
1862 +@@ -836,7 +833,6 @@ static const struct usb_device_id option_ids[] = {
1863 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0057, 0xff, 0xff, 0xff) },
1864 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0058, 0xff, 0xff, 0xff),
1865 + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
1866 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
1867 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0061, 0xff, 0xff, 0xff) },
1868 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0062, 0xff, 0xff, 0xff) },
1869 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0063, 0xff, 0xff, 0xff),
1870 +@@ -846,7 +842,6 @@ static const struct usb_device_id option_ids[] = {
1871 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0066, 0xff, 0xff, 0xff) },
1872 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0067, 0xff, 0xff, 0xff) },
1873 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0069, 0xff, 0xff, 0xff) },
1874 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
1875 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0076, 0xff, 0xff, 0xff) },
1876 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0077, 0xff, 0xff, 0xff) },
1877 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0078, 0xff, 0xff, 0xff) },
1878 +@@ -865,8 +860,6 @@ static const struct usb_device_id option_ids[] = {
1879 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0095, 0xff, 0xff, 0xff) },
1880 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0096, 0xff, 0xff, 0xff) },
1881 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0097, 0xff, 0xff, 0xff) },
1882 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0098, 0xff, 0xff, 0xff) },
1883 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0099, 0xff, 0xff, 0xff) },
1884 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff),
1885 + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
1886 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0105, 0xff, 0xff, 0xff) },
1887 +@@ -887,28 +880,18 @@ static const struct usb_device_id option_ids[] = {
1888 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) },
1889 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0144, 0xff, 0xff, 0xff) },
1890 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0145, 0xff, 0xff, 0xff) },
1891 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0146, 0xff, 0xff, 0xff) },
1892 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) },
1893 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0148, 0xff, 0xff, 0xff) },
1894 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0149, 0xff, 0xff, 0xff) },
1895 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0150, 0xff, 0xff, 0xff) },
1896 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0151, 0xff, 0xff, 0xff) },
1897 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
1898 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0153, 0xff, 0xff, 0xff) },
1899 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) },
1900 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) },
1901 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff) },
1902 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) },
1903 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) },
1904 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) },
1905 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) },
1906 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) },
1907 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0164, 0xff, 0xff, 0xff) },
1908 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) },
1909 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff) },
1910 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) },
1911 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff) },
1912 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff) },
1913 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff) },
1914 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff) },
1915 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
1916 +@@ -1083,127 +1066,27 @@ static const struct usb_device_id option_ids[] = {
1917 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) },
1918 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) },
1919 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) },
1920 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1401, 0xff, 0xff, 0xff) },
1921 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1402, 0xff, 0xff, 0xff) },
1922 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1403, 0xff, 0xff, 0xff) },
1923 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1404, 0xff, 0xff, 0xff) },
1924 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1405, 0xff, 0xff, 0xff) },
1925 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1406, 0xff, 0xff, 0xff) },
1926 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1407, 0xff, 0xff, 0xff) },
1927 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1408, 0xff, 0xff, 0xff) },
1928 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1409, 0xff, 0xff, 0xff) },
1929 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1410, 0xff, 0xff, 0xff) },
1930 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1411, 0xff, 0xff, 0xff) },
1931 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1412, 0xff, 0xff, 0xff) },
1932 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1413, 0xff, 0xff, 0xff) },
1933 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1414, 0xff, 0xff, 0xff) },
1934 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1415, 0xff, 0xff, 0xff) },
1935 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1416, 0xff, 0xff, 0xff) },
1936 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1417, 0xff, 0xff, 0xff) },
1937 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1418, 0xff, 0xff, 0xff) },
1938 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1419, 0xff, 0xff, 0xff) },
1939 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1420, 0xff, 0xff, 0xff) },
1940 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1421, 0xff, 0xff, 0xff) },
1941 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1422, 0xff, 0xff, 0xff) },
1942 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1423, 0xff, 0xff, 0xff) },
1943 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1424, 0xff, 0xff, 0xff) },
1944 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1425, 0xff, 0xff, 0xff) },
1945 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff) },
1946 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1427, 0xff, 0xff, 0xff) },
1947 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff) },
1948 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1429, 0xff, 0xff, 0xff) },
1949 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1430, 0xff, 0xff, 0xff) },
1950 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1431, 0xff, 0xff, 0xff) },
1951 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1432, 0xff, 0xff, 0xff) },
1952 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1433, 0xff, 0xff, 0xff) },
1953 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1434, 0xff, 0xff, 0xff) },
1954 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1435, 0xff, 0xff, 0xff) },
1955 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1436, 0xff, 0xff, 0xff) },
1956 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1437, 0xff, 0xff, 0xff) },
1957 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1438, 0xff, 0xff, 0xff) },
1958 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1439, 0xff, 0xff, 0xff) },
1959 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1440, 0xff, 0xff, 0xff) },
1960 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1441, 0xff, 0xff, 0xff) },
1961 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1442, 0xff, 0xff, 0xff) },
1962 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1443, 0xff, 0xff, 0xff) },
1963 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1444, 0xff, 0xff, 0xff) },
1964 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1445, 0xff, 0xff, 0xff) },
1965 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1446, 0xff, 0xff, 0xff) },
1966 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1447, 0xff, 0xff, 0xff) },
1967 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1448, 0xff, 0xff, 0xff) },
1968 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1449, 0xff, 0xff, 0xff) },
1969 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1450, 0xff, 0xff, 0xff) },
1970 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1451, 0xff, 0xff, 0xff) },
1971 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1452, 0xff, 0xff, 0xff) },
1972 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1453, 0xff, 0xff, 0xff) },
1973 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1454, 0xff, 0xff, 0xff) },
1974 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1455, 0xff, 0xff, 0xff) },
1975 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1456, 0xff, 0xff, 0xff) },
1976 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1457, 0xff, 0xff, 0xff) },
1977 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1458, 0xff, 0xff, 0xff) },
1978 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1459, 0xff, 0xff, 0xff) },
1979 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1460, 0xff, 0xff, 0xff) },
1980 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1461, 0xff, 0xff, 0xff) },
1981 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1462, 0xff, 0xff, 0xff) },
1982 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1463, 0xff, 0xff, 0xff) },
1983 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1464, 0xff, 0xff, 0xff) },
1984 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1465, 0xff, 0xff, 0xff) },
1985 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1466, 0xff, 0xff, 0xff) },
1986 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1467, 0xff, 0xff, 0xff) },
1987 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1468, 0xff, 0xff, 0xff) },
1988 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1469, 0xff, 0xff, 0xff) },
1989 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1470, 0xff, 0xff, 0xff) },
1990 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1471, 0xff, 0xff, 0xff) },
1991 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1472, 0xff, 0xff, 0xff) },
1992 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1473, 0xff, 0xff, 0xff) },
1993 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1474, 0xff, 0xff, 0xff) },
1994 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1475, 0xff, 0xff, 0xff) },
1995 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1476, 0xff, 0xff, 0xff) },
1996 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1477, 0xff, 0xff, 0xff) },
1997 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1478, 0xff, 0xff, 0xff) },
1998 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1479, 0xff, 0xff, 0xff) },
1999 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1480, 0xff, 0xff, 0xff) },
2000 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0xff, 0xff) },
2001 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1482, 0xff, 0xff, 0xff) },
2002 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1483, 0xff, 0xff, 0xff) },
2003 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1484, 0xff, 0xff, 0xff) },
2004 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1485, 0xff, 0xff, 0xff) },
2005 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1486, 0xff, 0xff, 0xff) },
2006 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1487, 0xff, 0xff, 0xff) },
2007 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1488, 0xff, 0xff, 0xff) },
2008 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1489, 0xff, 0xff, 0xff) },
2009 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1490, 0xff, 0xff, 0xff) },
2010 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1491, 0xff, 0xff, 0xff) },
2011 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1492, 0xff, 0xff, 0xff) },
2012 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1493, 0xff, 0xff, 0xff) },
2013 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1494, 0xff, 0xff, 0xff) },
2014 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1495, 0xff, 0xff, 0xff) },
2015 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1496, 0xff, 0xff, 0xff) },
2016 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1497, 0xff, 0xff, 0xff) },
2017 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1498, 0xff, 0xff, 0xff) },
2018 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1499, 0xff, 0xff, 0xff) },
2019 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1500, 0xff, 0xff, 0xff) },
2020 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1501, 0xff, 0xff, 0xff) },
2021 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1502, 0xff, 0xff, 0xff) },
2022 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1503, 0xff, 0xff, 0xff) },
2023 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1504, 0xff, 0xff, 0xff) },
2024 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1505, 0xff, 0xff, 0xff) },
2025 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1506, 0xff, 0xff, 0xff) },
2026 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1507, 0xff, 0xff, 0xff) },
2027 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1508, 0xff, 0xff, 0xff) },
2028 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1509, 0xff, 0xff, 0xff) },
2029 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1510, 0xff, 0xff, 0xff) },
2030 ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
2031 ++ 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
2032 ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
2033 ++
2034 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */
2035 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) },
2036 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
2037 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) },
2038 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
2039 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
2040 ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) },
2041 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
2042 ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff) },
2043 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
2044 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
2045 +- 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
2046 +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
2047 ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) },
2048 ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
2049 ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff) },
2050 ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) },
2051 ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff) },
2052 ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff) },
2053 ++
2054 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
2055 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
2056 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
2057 +diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
2058 +index ea84456..21c82b0 100644
2059 +--- a/drivers/usb/serial/ti_usb_3410_5052.c
2060 ++++ b/drivers/usb/serial/ti_usb_3410_5052.c
2061 +@@ -165,7 +165,7 @@ static unsigned int product_5052_count;
2062 + /* the array dimension is the number of default entries plus */
2063 + /* TI_EXTRA_VID_PID_COUNT user defined entries plus 1 terminating */
2064 + /* null entry */
2065 +-static struct usb_device_id ti_id_table_3410[13+TI_EXTRA_VID_PID_COUNT+1] = {
2066 ++static struct usb_device_id ti_id_table_3410[14+TI_EXTRA_VID_PID_COUNT+1] = {
2067 + { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
2068 + { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
2069 + { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
2070 +@@ -179,6 +179,7 @@ static struct usb_device_id ti_id_table_3410[13+TI_EXTRA_VID_PID_COUNT+1] = {
2071 + { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
2072 + { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
2073 + { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
2074 ++ { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
2075 + };
2076 +
2077 + static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
2078 +@@ -188,7 +189,7 @@ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
2079 + { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
2080 + };
2081 +
2082 +-static struct usb_device_id ti_id_table_combined[17+2*TI_EXTRA_VID_PID_COUNT+1] = {
2083 ++static struct usb_device_id ti_id_table_combined[18+2*TI_EXTRA_VID_PID_COUNT+1] = {
2084 + { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
2085 + { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
2086 + { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
2087 +@@ -206,6 +207,7 @@ static struct usb_device_id ti_id_table_combined[17+2*TI_EXTRA_VID_PID_COUNT+1]
2088 + { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
2089 + { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
2090 + { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
2091 ++ { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
2092 + { }
2093 + };
2094 +
2095 +diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
2096 +index 2aac195..f140f1b 100644
2097 +--- a/drivers/usb/serial/ti_usb_3410_5052.h
2098 ++++ b/drivers/usb/serial/ti_usb_3410_5052.h
2099 +@@ -49,6 +49,10 @@
2100 + #define MTS_MT9234ZBA_PRODUCT_ID 0xF115
2101 + #define MTS_MT9234ZBAOLD_PRODUCT_ID 0x0319
2102 +
2103 ++/* Abbott Diabetics vendor and product ids */
2104 ++#define ABBOTT_VENDOR_ID 0x1a61
2105 ++#define ABBOTT_PRODUCT_ID 0x3410
2106 ++
2107 + /* Commands */
2108 + #define TI_GET_VERSION 0x01
2109 + #define TI_GET_PORT_STATUS 0x02
2110 +diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
2111 +index 9e069ef..db51ba1 100644
2112 +--- a/drivers/usb/storage/usb.c
2113 ++++ b/drivers/usb/storage/usb.c
2114 +@@ -788,15 +788,19 @@ static void quiesce_and_remove_host(struct us_data *us)
2115 + struct Scsi_Host *host = us_to_host(us);
2116 +
2117 + /* If the device is really gone, cut short reset delays */
2118 +- if (us->pusb_dev->state == USB_STATE_NOTATTACHED)
2119 ++ if (us->pusb_dev->state == USB_STATE_NOTATTACHED) {
2120 + set_bit(US_FLIDX_DISCONNECTING, &us->dflags);
2121 ++ wake_up(&us->delay_wait);
2122 ++ }
2123 +
2124 +- /* Prevent SCSI-scanning (if it hasn't started yet)
2125 +- * and wait for the SCSI-scanning thread to stop.
2126 ++ /* Prevent SCSI scanning (if it hasn't started yet)
2127 ++ * or wait for the SCSI-scanning routine to stop.
2128 + */
2129 +- set_bit(US_FLIDX_DONT_SCAN, &us->dflags);
2130 +- wake_up(&us->delay_wait);
2131 +- wait_for_completion(&us->scanning_done);
2132 ++ cancel_delayed_work_sync(&us->scan_dwork);
2133 ++
2134 ++ /* Balance autopm calls if scanning was cancelled */
2135 ++ if (test_bit(US_FLIDX_SCAN_PENDING, &us->dflags))
2136 ++ usb_autopm_put_interface_no_suspend(us->pusb_intf);
2137 +
2138 + /* Removing the host will perform an orderly shutdown: caches
2139 + * synchronized, disks spun down, etc.
2140 +@@ -823,52 +827,28 @@ static void release_everything(struct us_data *us)
2141 + scsi_host_put(us_to_host(us));
2142 + }
2143 +
2144 +-/* Thread to carry out delayed SCSI-device scanning */
2145 +-static int usb_stor_scan_thread(void * __us)
2146 ++/* Delayed-work routine to carry out SCSI-device scanning */
2147 ++static void usb_stor_scan_dwork(struct work_struct *work)
2148 + {
2149 +- struct us_data *us = (struct us_data *)__us;
2150 ++ struct us_data *us = container_of(work, struct us_data,
2151 ++ scan_dwork.work);
2152 + struct device *dev = &us->pusb_intf->dev;
2153 +
2154 +- dev_dbg(dev, "device found\n");
2155 ++ dev_dbg(dev, "starting scan\n");
2156 +
2157 +- set_freezable_with_signal();
2158 +- /*
2159 +- * Wait for the timeout to expire or for a disconnect
2160 +- *
2161 +- * We can't freeze in this thread or we risk causing khubd to
2162 +- * fail to freeze, but we can't be non-freezable either. Nor can
2163 +- * khubd freeze while waiting for scanning to complete as it may
2164 +- * hold the device lock, causing a hang when suspending devices.
2165 +- * So we request a fake signal when freezing and use
2166 +- * interruptible sleep to kick us out of our wait early when
2167 +- * freezing happens.
2168 +- */
2169 +- if (delay_use > 0) {
2170 +- dev_dbg(dev, "waiting for device to settle "
2171 +- "before scanning\n");
2172 +- wait_event_interruptible_timeout(us->delay_wait,
2173 +- test_bit(US_FLIDX_DONT_SCAN, &us->dflags),
2174 +- delay_use * HZ);
2175 ++ /* For bulk-only devices, determine the max LUN value */
2176 ++ if (us->protocol == USB_PR_BULK && !(us->fflags & US_FL_SINGLE_LUN)) {
2177 ++ mutex_lock(&us->dev_mutex);
2178 ++ us->max_lun = usb_stor_Bulk_max_lun(us);
2179 ++ mutex_unlock(&us->dev_mutex);
2180 + }
2181 ++ scsi_scan_host(us_to_host(us));
2182 ++ dev_dbg(dev, "scan complete\n");
2183 +
2184 +- /* If the device is still connected, perform the scanning */
2185 +- if (!test_bit(US_FLIDX_DONT_SCAN, &us->dflags)) {
2186 +-
2187 +- /* For bulk-only devices, determine the max LUN value */
2188 +- if (us->protocol == USB_PR_BULK &&
2189 +- !(us->fflags & US_FL_SINGLE_LUN)) {
2190 +- mutex_lock(&us->dev_mutex);
2191 +- us->max_lun = usb_stor_Bulk_max_lun(us);
2192 +- mutex_unlock(&us->dev_mutex);
2193 +- }
2194 +- scsi_scan_host(us_to_host(us));
2195 +- dev_dbg(dev, "scan complete\n");
2196 +-
2197 +- /* Should we unbind if no devices were detected? */
2198 +- }
2199 ++ /* Should we unbind if no devices were detected? */
2200 +
2201 + usb_autopm_put_interface(us->pusb_intf);
2202 +- complete_and_exit(&us->scanning_done, 0);
2203 ++ clear_bit(US_FLIDX_SCAN_PENDING, &us->dflags);
2204 + }
2205 +
2206 + static unsigned int usb_stor_sg_tablesize(struct usb_interface *intf)
2207 +@@ -915,7 +895,7 @@ int usb_stor_probe1(struct us_data **pus,
2208 + init_completion(&us->cmnd_ready);
2209 + init_completion(&(us->notify));
2210 + init_waitqueue_head(&us->delay_wait);
2211 +- init_completion(&us->scanning_done);
2212 ++ INIT_DELAYED_WORK(&us->scan_dwork, usb_stor_scan_dwork);
2213 +
2214 + /* Associate the us_data structure with the USB device */
2215 + result = associate_dev(us, intf);
2216 +@@ -946,7 +926,6 @@ EXPORT_SYMBOL_GPL(usb_stor_probe1);
2217 + /* Second part of general USB mass-storage probing */
2218 + int usb_stor_probe2(struct us_data *us)
2219 + {
2220 +- struct task_struct *th;
2221 + int result;
2222 + struct device *dev = &us->pusb_intf->dev;
2223 +
2224 +@@ -987,20 +966,14 @@ int usb_stor_probe2(struct us_data *us)
2225 + goto BadDevice;
2226 + }
2227 +
2228 +- /* Start up the thread for delayed SCSI-device scanning */
2229 +- th = kthread_create(usb_stor_scan_thread, us, "usb-stor-scan");
2230 +- if (IS_ERR(th)) {
2231 +- dev_warn(dev,
2232 +- "Unable to start the device-scanning thread\n");
2233 +- complete(&us->scanning_done);
2234 +- quiesce_and_remove_host(us);
2235 +- result = PTR_ERR(th);
2236 +- goto BadDevice;
2237 +- }
2238 +-
2239 ++ /* Submit the delayed_work for SCSI-device scanning */
2240 + usb_autopm_get_interface_no_resume(us->pusb_intf);
2241 +- wake_up_process(th);
2242 ++ set_bit(US_FLIDX_SCAN_PENDING, &us->dflags);
2243 +
2244 ++ if (delay_use > 0)
2245 ++ dev_dbg(dev, "waiting for device to settle before scanning\n");
2246 ++ queue_delayed_work(system_freezable_wq, &us->scan_dwork,
2247 ++ delay_use * HZ);
2248 + return 0;
2249 +
2250 + /* We come here if there are any problems */
2251 +diff --git a/drivers/usb/storage/usb.h b/drivers/usb/storage/usb.h
2252 +index 7b0f211..75f70f0 100644
2253 +--- a/drivers/usb/storage/usb.h
2254 ++++ b/drivers/usb/storage/usb.h
2255 +@@ -47,6 +47,7 @@
2256 + #include <linux/blkdev.h>
2257 + #include <linux/completion.h>
2258 + #include <linux/mutex.h>
2259 ++#include <linux/workqueue.h>
2260 + #include <scsi/scsi_host.h>
2261 +
2262 + struct us_data;
2263 +@@ -72,7 +73,7 @@ struct us_unusual_dev {
2264 + #define US_FLIDX_DISCONNECTING 3 /* disconnect in progress */
2265 + #define US_FLIDX_RESETTING 4 /* device reset in progress */
2266 + #define US_FLIDX_TIMED_OUT 5 /* SCSI midlayer timed out */
2267 +-#define US_FLIDX_DONT_SCAN 6 /* don't scan (disconnect) */
2268 ++#define US_FLIDX_SCAN_PENDING 6 /* scanning not yet done */
2269 + #define US_FLIDX_REDO_READ10 7 /* redo READ(10) command */
2270 + #define US_FLIDX_READ10_WORKED 8 /* previous READ(10) succeeded */
2271 +
2272 +@@ -147,8 +148,8 @@ struct us_data {
2273 + /* mutual exclusion and synchronization structures */
2274 + struct completion cmnd_ready; /* to sleep thread on */
2275 + struct completion notify; /* thread begin/end */
2276 +- wait_queue_head_t delay_wait; /* wait during scan, reset */
2277 +- struct completion scanning_done; /* wait for scan thread */
2278 ++ wait_queue_head_t delay_wait; /* wait during reset */
2279 ++ struct delayed_work scan_dwork; /* for async scanning */
2280 +
2281 + /* subdriver information */
2282 + void *extra; /* Any extra data */
2283 +diff --git a/drivers/video/omap2/dss/dpi.c b/drivers/video/omap2/dss/dpi.c
2284 +index 976ac23..c04205c 100644
2285 +--- a/drivers/video/omap2/dss/dpi.c
2286 ++++ b/drivers/video/omap2/dss/dpi.c
2287 +@@ -180,6 +180,11 @@ int omapdss_dpi_display_enable(struct omap_dss_device *dssdev)
2288 + {
2289 + int r;
2290 +
2291 ++ if (cpu_is_omap34xx() && !dpi.vdds_dsi_reg) {
2292 ++ DSSERR("no VDSS_DSI regulator\n");
2293 ++ return -ENODEV;
2294 ++ }
2295 ++
2296 + if (dssdev->manager == NULL) {
2297 + DSSERR("failed to enable display: no manager\n");
2298 + return -ENODEV;
2299 +diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
2300 +index d2039ca..af11098 100644
2301 +--- a/fs/ecryptfs/inode.c
2302 ++++ b/fs/ecryptfs/inode.c
2303 +@@ -1104,6 +1104,8 @@ ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
2304 + }
2305 +
2306 + rc = vfs_setxattr(lower_dentry, name, value, size, flags);
2307 ++ if (!rc)
2308 ++ fsstack_copy_attr_all(dentry->d_inode, lower_dentry->d_inode);
2309 + out:
2310 + return rc;
2311 + }
2312 +diff --git a/fs/eventpoll.c b/fs/eventpoll.c
2313 +index 828e750..ea54cde 100644
2314 +--- a/fs/eventpoll.c
2315 ++++ b/fs/eventpoll.c
2316 +@@ -197,6 +197,12 @@ struct eventpoll {
2317 +
2318 + /* The user that created the eventpoll descriptor */
2319 + struct user_struct *user;
2320 ++
2321 ++ struct file *file;
2322 ++
2323 ++ /* used to optimize loop detection check */
2324 ++ int visited;
2325 ++ struct list_head visited_list_link;
2326 + };
2327 +
2328 + /* Wait structure used by the poll hooks */
2329 +@@ -255,6 +261,15 @@ static struct kmem_cache *epi_cache __read_mostly;
2330 + /* Slab cache used to allocate "struct eppoll_entry" */
2331 + static struct kmem_cache *pwq_cache __read_mostly;
2332 +
2333 ++/* Visited nodes during ep_loop_check(), so we can unset them when we finish */
2334 ++static LIST_HEAD(visited_list);
2335 ++
2336 ++/*
2337 ++ * List of files with newly added links, where we may need to limit the number
2338 ++ * of emanating paths. Protected by the epmutex.
2339 ++ */
2340 ++static LIST_HEAD(tfile_check_list);
2341 ++
2342 + #ifdef CONFIG_SYSCTL
2343 +
2344 + #include <linux/sysctl.h>
2345 +@@ -276,6 +291,12 @@ ctl_table epoll_table[] = {
2346 + };
2347 + #endif /* CONFIG_SYSCTL */
2348 +
2349 ++static const struct file_operations eventpoll_fops;
2350 ++
2351 ++static inline int is_file_epoll(struct file *f)
2352 ++{
2353 ++ return f->f_op == &eventpoll_fops;
2354 ++}
2355 +
2356 + /* Setup the structure that is used as key for the RB tree */
2357 + static inline void ep_set_ffd(struct epoll_filefd *ffd,
2358 +@@ -299,6 +320,11 @@ static inline int ep_is_linked(struct list_head *p)
2359 + return !list_empty(p);
2360 + }
2361 +
2362 ++static inline struct eppoll_entry *ep_pwq_from_wait(wait_queue_t *p)
2363 ++{
2364 ++ return container_of(p, struct eppoll_entry, wait);
2365 ++}
2366 ++
2367 + /* Get the "struct epitem" from a wait queue pointer */
2368 + static inline struct epitem *ep_item_from_wait(wait_queue_t *p)
2369 + {
2370 +@@ -446,6 +472,18 @@ static void ep_poll_safewake(wait_queue_head_t *wq)
2371 + put_cpu();
2372 + }
2373 +
2374 ++static void ep_remove_wait_queue(struct eppoll_entry *pwq)
2375 ++{
2376 ++ wait_queue_head_t *whead;
2377 ++
2378 ++ rcu_read_lock();
2379 ++ /* If it is cleared by POLLFREE, it should be rcu-safe */
2380 ++ whead = rcu_dereference(pwq->whead);
2381 ++ if (whead)
2382 ++ remove_wait_queue(whead, &pwq->wait);
2383 ++ rcu_read_unlock();
2384 ++}
2385 ++
2386 + /*
2387 + * This function unregisters poll callbacks from the associated file
2388 + * descriptor. Must be called with "mtx" held (or "epmutex" if called from
2389 +@@ -460,7 +498,7 @@ static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
2390 + pwq = list_first_entry(lsthead, struct eppoll_entry, llink);
2391 +
2392 + list_del(&pwq->llink);
2393 +- remove_wait_queue(pwq->whead, &pwq->wait);
2394 ++ ep_remove_wait_queue(pwq);
2395 + kmem_cache_free(pwq_cache, pwq);
2396 + }
2397 + }
2398 +@@ -711,12 +749,6 @@ static const struct file_operations eventpoll_fops = {
2399 + .llseek = noop_llseek,
2400 + };
2401 +
2402 +-/* Fast test to see if the file is an eventpoll file */
2403 +-static inline int is_file_epoll(struct file *f)
2404 +-{
2405 +- return f->f_op == &eventpoll_fops;
2406 +-}
2407 +-
2408 + /*
2409 + * This is called from eventpoll_release() to unlink files from the eventpoll
2410 + * interface. We need to have this facility to cleanup correctly files that are
2411 +@@ -827,6 +859,17 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k
2412 + struct epitem *epi = ep_item_from_wait(wait);
2413 + struct eventpoll *ep = epi->ep;
2414 +
2415 ++ if ((unsigned long)key & POLLFREE) {
2416 ++ ep_pwq_from_wait(wait)->whead = NULL;
2417 ++ /*
2418 ++ * whead = NULL above can race with ep_remove_wait_queue()
2419 ++ * which can do another remove_wait_queue() after us, so we
2420 ++ * can't use __remove_wait_queue(). whead->lock is held by
2421 ++ * the caller.
2422 ++ */
2423 ++ list_del_init(&wait->task_list);
2424 ++ }
2425 ++
2426 + spin_lock_irqsave(&ep->lock, flags);
2427 +
2428 + /*
2429 +@@ -926,6 +969,99 @@ static void ep_rbtree_insert(struct eventpoll *ep, struct epitem *epi)
2430 + rb_insert_color(&epi->rbn, &ep->rbr);
2431 + }
2432 +
2433 ++
2434 ++
2435 ++#define PATH_ARR_SIZE 5
2436 ++/*
2437 ++ * These are the number paths of length 1 to 5, that we are allowing to emanate
2438 ++ * from a single file of interest. For example, we allow 1000 paths of length
2439 ++ * 1, to emanate from each file of interest. This essentially represents the
2440 ++ * potential wakeup paths, which need to be limited in order to avoid massive
2441 ++ * uncontrolled wakeup storms. The common use case should be a single ep which
2442 ++ * is connected to n file sources. In this case each file source has 1 path
2443 ++ * of length 1. Thus, the numbers below should be more than sufficient. These
2444 ++ * path limits are enforced during an EPOLL_CTL_ADD operation, since a modify
2445 ++ * and delete can't add additional paths. Protected by the epmutex.
2446 ++ */
2447 ++static const int path_limits[PATH_ARR_SIZE] = { 1000, 500, 100, 50, 10 };
2448 ++static int path_count[PATH_ARR_SIZE];
2449 ++
2450 ++static int path_count_inc(int nests)
2451 ++{
2452 ++ if (++path_count[nests] > path_limits[nests])
2453 ++ return -1;
2454 ++ return 0;
2455 ++}
2456 ++
2457 ++static void path_count_init(void)
2458 ++{
2459 ++ int i;
2460 ++
2461 ++ for (i = 0; i < PATH_ARR_SIZE; i++)
2462 ++ path_count[i] = 0;
2463 ++}
2464 ++
2465 ++static int reverse_path_check_proc(void *priv, void *cookie, int call_nests)
2466 ++{
2467 ++ int error = 0;
2468 ++ struct file *file = priv;
2469 ++ struct file *child_file;
2470 ++ struct epitem *epi;
2471 ++
2472 ++ list_for_each_entry(epi, &file->f_ep_links, fllink) {
2473 ++ child_file = epi->ep->file;
2474 ++ if (is_file_epoll(child_file)) {
2475 ++ if (list_empty(&child_file->f_ep_links)) {
2476 ++ if (path_count_inc(call_nests)) {
2477 ++ error = -1;
2478 ++ break;
2479 ++ }
2480 ++ } else {
2481 ++ error = ep_call_nested(&poll_loop_ncalls,
2482 ++ EP_MAX_NESTS,
2483 ++ reverse_path_check_proc,
2484 ++ child_file, child_file,
2485 ++ current);
2486 ++ }
2487 ++ if (error != 0)
2488 ++ break;
2489 ++ } else {
2490 ++ printk(KERN_ERR "reverse_path_check_proc: "
2491 ++ "file is not an ep!\n");
2492 ++ }
2493 ++ }
2494 ++ return error;
2495 ++}
2496 ++
2497 ++/**
2498 ++ * reverse_path_check - The tfile_check_list is list of file *, which have
2499 ++ * links that are proposed to be newly added. We need to
2500 ++ * make sure that those added links don't add too many
2501 ++ * paths such that we will spend all our time waking up
2502 ++ * eventpoll objects.
2503 ++ *
2504 ++ * Returns: Returns zero if the proposed links don't create too many paths,
2505 ++ * -1 otherwise.
2506 ++ */
2507 ++static int reverse_path_check(void)
2508 ++{
2509 ++ int length = 0;
2510 ++ int error = 0;
2511 ++ struct file *current_file;
2512 ++
2513 ++ /* let's call this for all tfiles */
2514 ++ list_for_each_entry(current_file, &tfile_check_list, f_tfile_llink) {
2515 ++ length++;
2516 ++ path_count_init();
2517 ++ error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
2518 ++ reverse_path_check_proc, current_file,
2519 ++ current_file, current);
2520 ++ if (error)
2521 ++ break;
2522 ++ }
2523 ++ return error;
2524 ++}
2525 ++
2526 + /*
2527 + * Must be called with "mtx" held.
2528 + */
2529 +@@ -987,6 +1123,11 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
2530 + */
2531 + ep_rbtree_insert(ep, epi);
2532 +
2533 ++ /* now check if we've created too many backpaths */
2534 ++ error = -EINVAL;
2535 ++ if (reverse_path_check())
2536 ++ goto error_remove_epi;
2537 ++
2538 + /* We have to drop the new item inside our item list to keep track of it */
2539 + spin_lock_irqsave(&ep->lock, flags);
2540 +
2541 +@@ -1011,6 +1152,14 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
2542 +
2543 + return 0;
2544 +
2545 ++error_remove_epi:
2546 ++ spin_lock(&tfile->f_lock);
2547 ++ if (ep_is_linked(&epi->fllink))
2548 ++ list_del_init(&epi->fllink);
2549 ++ spin_unlock(&tfile->f_lock);
2550 ++
2551 ++ rb_erase(&epi->rbn, &ep->rbr);
2552 ++
2553 + error_unregister:
2554 + ep_unregister_pollwait(ep, epi);
2555 +
2556 +@@ -1275,18 +1424,36 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
2557 + int error = 0;
2558 + struct file *file = priv;
2559 + struct eventpoll *ep = file->private_data;
2560 ++ struct eventpoll *ep_tovisit;
2561 + struct rb_node *rbp;
2562 + struct epitem *epi;
2563 +
2564 + mutex_lock_nested(&ep->mtx, call_nests + 1);
2565 ++ ep->visited = 1;
2566 ++ list_add(&ep->visited_list_link, &visited_list);
2567 + for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) {
2568 + epi = rb_entry(rbp, struct epitem, rbn);
2569 + if (unlikely(is_file_epoll(epi->ffd.file))) {
2570 ++ ep_tovisit = epi->ffd.file->private_data;
2571 ++ if (ep_tovisit->visited)
2572 ++ continue;
2573 + error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
2574 +- ep_loop_check_proc, epi->ffd.file,
2575 +- epi->ffd.file->private_data, current);
2576 ++ ep_loop_check_proc, epi->ffd.file,
2577 ++ ep_tovisit, current);
2578 + if (error != 0)
2579 + break;
2580 ++ } else {
2581 ++ /*
2582 ++ * If we've reached a file that is not associated with
2583 ++ * an ep, then we need to check if the newly added
2584 ++ * links are going to add too many wakeup paths. We do
2585 ++ * this by adding it to the tfile_check_list, if it's
2586 ++ * not already there, and calling reverse_path_check()
2587 ++ * during ep_insert().
2588 ++ */
2589 ++ if (list_empty(&epi->ffd.file->f_tfile_llink))
2590 ++ list_add(&epi->ffd.file->f_tfile_llink,
2591 ++ &tfile_check_list);
2592 + }
2593 + }
2594 + mutex_unlock(&ep->mtx);
2595 +@@ -1307,8 +1474,31 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
2596 + */
2597 + static int ep_loop_check(struct eventpoll *ep, struct file *file)
2598 + {
2599 +- return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
2600 ++ int ret;
2601 ++ struct eventpoll *ep_cur, *ep_next;
2602 ++
2603 ++ ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
2604 + ep_loop_check_proc, file, ep, current);
2605 ++ /* clear visited list */
2606 ++ list_for_each_entry_safe(ep_cur, ep_next, &visited_list,
2607 ++ visited_list_link) {
2608 ++ ep_cur->visited = 0;
2609 ++ list_del(&ep_cur->visited_list_link);
2610 ++ }
2611 ++ return ret;
2612 ++}
2613 ++
2614 ++static void clear_tfile_check_list(void)
2615 ++{
2616 ++ struct file *file;
2617 ++
2618 ++ /* first clear the tfile_check_list */
2619 ++ while (!list_empty(&tfile_check_list)) {
2620 ++ file = list_first_entry(&tfile_check_list, struct file,
2621 ++ f_tfile_llink);
2622 ++ list_del_init(&file->f_tfile_llink);
2623 ++ }
2624 ++ INIT_LIST_HEAD(&tfile_check_list);
2625 + }
2626 +
2627 + /*
2628 +@@ -1316,8 +1506,9 @@ static int ep_loop_check(struct eventpoll *ep, struct file *file)
2629 + */
2630 + SYSCALL_DEFINE1(epoll_create1, int, flags)
2631 + {
2632 +- int error;
2633 ++ int error, fd;
2634 + struct eventpoll *ep = NULL;
2635 ++ struct file *file;
2636 +
2637 + /* Check the EPOLL_* constant for consistency. */
2638 + BUILD_BUG_ON(EPOLL_CLOEXEC != O_CLOEXEC);
2639 +@@ -1334,11 +1525,25 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
2640 + * Creates all the items needed to setup an eventpoll file. That is,
2641 + * a file structure and a free file descriptor.
2642 + */
2643 +- error = anon_inode_getfd("[eventpoll]", &eventpoll_fops, ep,
2644 ++ fd = get_unused_fd_flags(O_RDWR | (flags & O_CLOEXEC));
2645 ++ if (fd < 0) {
2646 ++ error = fd;
2647 ++ goto out_free_ep;
2648 ++ }
2649 ++ file = anon_inode_getfile("[eventpoll]", &eventpoll_fops, ep,
2650 + O_RDWR | (flags & O_CLOEXEC));
2651 +- if (error < 0)
2652 +- ep_free(ep);
2653 +-
2654 ++ if (IS_ERR(file)) {
2655 ++ error = PTR_ERR(file);
2656 ++ goto out_free_fd;
2657 ++ }
2658 ++ fd_install(fd, file);
2659 ++ ep->file = file;
2660 ++ return fd;
2661 ++
2662 ++out_free_fd:
2663 ++ put_unused_fd(fd);
2664 ++out_free_ep:
2665 ++ ep_free(ep);
2666 + return error;
2667 + }
2668 +
2669 +@@ -1404,21 +1609,27 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
2670 + /*
2671 + * When we insert an epoll file descriptor, inside another epoll file
2672 + * descriptor, there is the change of creating closed loops, which are
2673 +- * better be handled here, than in more critical paths.
2674 ++ * better be handled here, than in more critical paths. While we are
2675 ++ * checking for loops we also determine the list of files reachable
2676 ++ * and hang them on the tfile_check_list, so we can check that we
2677 ++ * haven't created too many possible wakeup paths.
2678 + *
2679 +- * We hold epmutex across the loop check and the insert in this case, in
2680 +- * order to prevent two separate inserts from racing and each doing the
2681 +- * insert "at the same time" such that ep_loop_check passes on both
2682 +- * before either one does the insert, thereby creating a cycle.
2683 ++ * We need to hold the epmutex across both ep_insert and ep_remove
2684 ++ * b/c we want to make sure we are looking at a coherent view of
2685 ++ * epoll network.
2686 + */
2687 +- if (unlikely(is_file_epoll(tfile) && op == EPOLL_CTL_ADD)) {
2688 ++ if (op == EPOLL_CTL_ADD || op == EPOLL_CTL_DEL) {
2689 + mutex_lock(&epmutex);
2690 + did_lock_epmutex = 1;
2691 +- error = -ELOOP;
2692 +- if (ep_loop_check(ep, tfile) != 0)
2693 +- goto error_tgt_fput;
2694 + }
2695 +-
2696 ++ if (op == EPOLL_CTL_ADD) {
2697 ++ if (is_file_epoll(tfile)) {
2698 ++ error = -ELOOP;
2699 ++ if (ep_loop_check(ep, tfile) != 0)
2700 ++ goto error_tgt_fput;
2701 ++ } else
2702 ++ list_add(&tfile->f_tfile_llink, &tfile_check_list);
2703 ++ }
2704 +
2705 + mutex_lock_nested(&ep->mtx, 0);
2706 +
2707 +@@ -1437,6 +1648,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
2708 + error = ep_insert(ep, &epds, tfile, fd);
2709 + } else
2710 + error = -EEXIST;
2711 ++ clear_tfile_check_list();
2712 + break;
2713 + case EPOLL_CTL_DEL:
2714 + if (epi)
2715 +@@ -1455,7 +1667,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
2716 + mutex_unlock(&ep->mtx);
2717 +
2718 + error_tgt_fput:
2719 +- if (unlikely(did_lock_epmutex))
2720 ++ if (did_lock_epmutex)
2721 + mutex_unlock(&epmutex);
2722 +
2723 + fput(tfile);
2724 +diff --git a/fs/namei.c b/fs/namei.c
2725 +index 5008f01..744e942 100644
2726 +--- a/fs/namei.c
2727 ++++ b/fs/namei.c
2728 +@@ -1094,8 +1094,10 @@ static struct dentry *d_inode_lookup(struct dentry *parent, struct dentry *dentr
2729 + struct dentry *old;
2730 +
2731 + /* Don't create child dentry for a dead directory. */
2732 +- if (unlikely(IS_DEADDIR(inode)))
2733 ++ if (unlikely(IS_DEADDIR(inode))) {
2734 ++ dput(dentry);
2735 + return ERR_PTR(-ENOENT);
2736 ++ }
2737 +
2738 + old = inode->i_op->lookup(inode, dentry, nd);
2739 + if (unlikely(old)) {
2740 +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
2741 +index 055d702..e527030 100644
2742 +--- a/fs/nfs/nfs4proc.c
2743 ++++ b/fs/nfs/nfs4proc.c
2744 +@@ -3568,8 +3568,8 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
2745 + }
2746 + if (npages > 1) {
2747 + /* for decoding across pages */
2748 +- args.acl_scratch = alloc_page(GFP_KERNEL);
2749 +- if (!args.acl_scratch)
2750 ++ res.acl_scratch = alloc_page(GFP_KERNEL);
2751 ++ if (!res.acl_scratch)
2752 + goto out_free;
2753 + }
2754 + args.acl_len = npages * PAGE_SIZE;
2755 +@@ -3605,8 +3605,8 @@ out_free:
2756 + for (i = 0; i < npages; i++)
2757 + if (pages[i])
2758 + __free_page(pages[i]);
2759 +- if (args.acl_scratch)
2760 +- __free_page(args.acl_scratch);
2761 ++ if (res.acl_scratch)
2762 ++ __free_page(res.acl_scratch);
2763 + return ret;
2764 + }
2765 +
2766 +@@ -4876,8 +4876,10 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
2767 + clp->cl_rpcclient->cl_auth->au_flavor);
2768 +
2769 + res.server_scope = kzalloc(sizeof(struct server_scope), GFP_KERNEL);
2770 +- if (unlikely(!res.server_scope))
2771 +- return -ENOMEM;
2772 ++ if (unlikely(!res.server_scope)) {
2773 ++ status = -ENOMEM;
2774 ++ goto out;
2775 ++ }
2776 +
2777 + status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
2778 + if (!status)
2779 +@@ -4894,12 +4896,13 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
2780 + clp->server_scope = NULL;
2781 + }
2782 +
2783 +- if (!clp->server_scope)
2784 ++ if (!clp->server_scope) {
2785 + clp->server_scope = res.server_scope;
2786 +- else
2787 +- kfree(res.server_scope);
2788 ++ goto out;
2789 ++ }
2790 + }
2791 +-
2792 ++ kfree(res.server_scope);
2793 ++out:
2794 + dprintk("<-- %s status= %d\n", __func__, status);
2795 + return status;
2796 + }
2797 +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
2798 +index 6a7107a..a58eed7 100644
2799 +--- a/fs/nfs/nfs4state.c
2800 ++++ b/fs/nfs/nfs4state.c
2801 +@@ -1071,6 +1071,8 @@ void nfs4_schedule_stateid_recovery(const struct nfs_server *server, struct nfs4
2802 + {
2803 + struct nfs_client *clp = server->nfs_client;
2804 +
2805 ++ if (test_and_clear_bit(NFS_DELEGATED_STATE, &state->flags))
2806 ++ nfs_async_inode_return_delegation(state->inode, &state->stateid);
2807 + nfs4_state_mark_reclaim_nograce(clp, state);
2808 + nfs4_schedule_state_manager(clp);
2809 + }
2810 +diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
2811 +index dcaf693..68adab4 100644
2812 +--- a/fs/nfs/nfs4xdr.c
2813 ++++ b/fs/nfs/nfs4xdr.c
2814 +@@ -2522,7 +2522,6 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr,
2815 +
2816 + xdr_inline_pages(&req->rq_rcv_buf, replen << 2,
2817 + args->acl_pages, args->acl_pgbase, args->acl_len);
2818 +- xdr_set_scratch_buffer(xdr, page_address(args->acl_scratch), PAGE_SIZE);
2819 +
2820 + encode_nops(&hdr);
2821 + }
2822 +@@ -6034,6 +6033,10 @@ nfs4_xdr_dec_getacl(struct rpc_rqst *rqstp, struct xdr_stream *xdr,
2823 + struct compound_hdr hdr;
2824 + int status;
2825 +
2826 ++ if (res->acl_scratch != NULL) {
2827 ++ void *p = page_address(res->acl_scratch);
2828 ++ xdr_set_scratch_buffer(xdr, p, PAGE_SIZE);
2829 ++ }
2830 + status = decode_compound_hdr(xdr, &hdr);
2831 + if (status)
2832 + goto out;
2833 +diff --git a/fs/signalfd.c b/fs/signalfd.c
2834 +index 492465b..7ae2a57 100644
2835 +--- a/fs/signalfd.c
2836 ++++ b/fs/signalfd.c
2837 +@@ -30,6 +30,21 @@
2838 + #include <linux/signalfd.h>
2839 + #include <linux/syscalls.h>
2840 +
2841 ++void signalfd_cleanup(struct sighand_struct *sighand)
2842 ++{
2843 ++ wait_queue_head_t *wqh = &sighand->signalfd_wqh;
2844 ++ /*
2845 ++ * The lockless check can race with remove_wait_queue() in progress,
2846 ++ * but in this case its caller should run under rcu_read_lock() and
2847 ++ * sighand_cachep is SLAB_DESTROY_BY_RCU, we can safely return.
2848 ++ */
2849 ++ if (likely(!waitqueue_active(wqh)))
2850 ++ return;
2851 ++
2852 ++ /* wait_queue_t->func(POLLFREE) should do remove_wait_queue() */
2853 ++ wake_up_poll(wqh, POLLHUP | POLLFREE);
2854 ++}
2855 ++
2856 + struct signalfd_ctx {
2857 + sigset_t sigmask;
2858 + };
2859 +diff --git a/include/asm-generic/poll.h b/include/asm-generic/poll.h
2860 +index 44bce83..9ce7f44 100644
2861 +--- a/include/asm-generic/poll.h
2862 ++++ b/include/asm-generic/poll.h
2863 +@@ -28,6 +28,8 @@
2864 + #define POLLRDHUP 0x2000
2865 + #endif
2866 +
2867 ++#define POLLFREE 0x4000 /* currently only for epoll */
2868 ++
2869 + struct pollfd {
2870 + int fd;
2871 + short events;
2872 +diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h
2873 +index f362733..657ab55 100644
2874 +--- a/include/linux/eventpoll.h
2875 ++++ b/include/linux/eventpoll.h
2876 +@@ -61,6 +61,7 @@ struct file;
2877 + static inline void eventpoll_init_file(struct file *file)
2878 + {
2879 + INIT_LIST_HEAD(&file->f_ep_links);
2880 ++ INIT_LIST_HEAD(&file->f_tfile_llink);
2881 + }
2882 +
2883 +
2884 +diff --git a/include/linux/fs.h b/include/linux/fs.h
2885 +index e0bc4ff..10b2288 100644
2886 +--- a/include/linux/fs.h
2887 ++++ b/include/linux/fs.h
2888 +@@ -1001,6 +1001,7 @@ struct file {
2889 + #ifdef CONFIG_EPOLL
2890 + /* Used by fs/eventpoll.c to link all the hooks to this file */
2891 + struct list_head f_ep_links;
2892 ++ struct list_head f_tfile_llink;
2893 + #endif /* #ifdef CONFIG_EPOLL */
2894 + struct address_space *f_mapping;
2895 + #ifdef CONFIG_DEBUG_WRITECOUNT
2896 +diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
2897 +index 6c898af..41116ab 100644
2898 +--- a/include/linux/nfs_xdr.h
2899 ++++ b/include/linux/nfs_xdr.h
2900 +@@ -602,7 +602,6 @@ struct nfs_getaclargs {
2901 + size_t acl_len;
2902 + unsigned int acl_pgbase;
2903 + struct page ** acl_pages;
2904 +- struct page * acl_scratch;
2905 + struct nfs4_sequence_args seq_args;
2906 + };
2907 +
2908 +@@ -612,6 +611,7 @@ struct nfs_getaclres {
2909 + size_t acl_len;
2910 + size_t acl_data_offset;
2911 + int acl_flags;
2912 ++ struct page * acl_scratch;
2913 + struct nfs4_sequence_res seq_res;
2914 + };
2915 +
2916 +diff --git a/include/linux/signalfd.h b/include/linux/signalfd.h
2917 +index 3ff4961..247399b 100644
2918 +--- a/include/linux/signalfd.h
2919 ++++ b/include/linux/signalfd.h
2920 +@@ -61,13 +61,16 @@ static inline void signalfd_notify(struct task_struct *tsk, int sig)
2921 + wake_up(&tsk->sighand->signalfd_wqh);
2922 + }
2923 +
2924 ++extern void signalfd_cleanup(struct sighand_struct *sighand);
2925 ++
2926 + #else /* CONFIG_SIGNALFD */
2927 +
2928 + static inline void signalfd_notify(struct task_struct *tsk, int sig) { }
2929 +
2930 ++static inline void signalfd_cleanup(struct sighand_struct *sighand) { }
2931 ++
2932 + #endif /* CONFIG_SIGNALFD */
2933 +
2934 + #endif /* __KERNEL__ */
2935 +
2936 + #endif /* _LINUX_SIGNALFD_H */
2937 +-
2938 +diff --git a/include/linux/usb/ch11.h b/include/linux/usb/ch11.h
2939 +index 4ebaf08..1eb735b 100644
2940 +--- a/include/linux/usb/ch11.h
2941 ++++ b/include/linux/usb/ch11.h
2942 +@@ -62,12 +62,6 @@
2943 + #define USB_PORT_FEAT_TEST 21
2944 + #define USB_PORT_FEAT_INDICATOR 22
2945 + #define USB_PORT_FEAT_C_PORT_L1 23
2946 +-#define USB_PORT_FEAT_C_PORT_LINK_STATE 25
2947 +-#define USB_PORT_FEAT_C_PORT_CONFIG_ERROR 26
2948 +-#define USB_PORT_FEAT_PORT_REMOTE_WAKE_MASK 27
2949 +-#define USB_PORT_FEAT_BH_PORT_RESET 28
2950 +-#define USB_PORT_FEAT_C_BH_PORT_RESET 29
2951 +-#define USB_PORT_FEAT_FORCE_LINKPM_ACCEPT 30
2952 +
2953 + /*
2954 + * Port feature selectors added by USB 3.0 spec.
2955 +@@ -76,8 +70,8 @@
2956 + #define USB_PORT_FEAT_LINK_STATE 5
2957 + #define USB_PORT_FEAT_U1_TIMEOUT 23
2958 + #define USB_PORT_FEAT_U2_TIMEOUT 24
2959 +-#define USB_PORT_FEAT_C_LINK_STATE 25
2960 +-#define USB_PORT_FEAT_C_CONFIG_ERR 26
2961 ++#define USB_PORT_FEAT_C_PORT_LINK_STATE 25
2962 ++#define USB_PORT_FEAT_C_PORT_CONFIG_ERROR 26
2963 + #define USB_PORT_FEAT_REMOTE_WAKE_MASK 27
2964 + #define USB_PORT_FEAT_BH_PORT_RESET 28
2965 + #define USB_PORT_FEAT_C_BH_PORT_RESET 29
2966 +diff --git a/include/net/flow.h b/include/net/flow.h
2967 +index 57f15a7..2a7eefd 100644
2968 +--- a/include/net/flow.h
2969 ++++ b/include/net/flow.h
2970 +@@ -90,6 +90,16 @@ static inline void flowi4_init_output(struct flowi4 *fl4, int oif,
2971 + fl4->fl4_dport = dport;
2972 + fl4->fl4_sport = sport;
2973 + }
2974 ++
2975 ++/* Reset some input parameters after previous lookup */
2976 ++static inline void flowi4_update_output(struct flowi4 *fl4, int oif, __u8 tos,
2977 ++ __be32 daddr, __be32 saddr)
2978 ++{
2979 ++ fl4->flowi4_oif = oif;
2980 ++ fl4->flowi4_tos = tos;
2981 ++ fl4->daddr = daddr;
2982 ++ fl4->saddr = saddr;
2983 ++}
2984 +
2985 +
2986 + struct flowi6 {
2987 +diff --git a/include/net/route.h b/include/net/route.h
2988 +index 91855d1..b1c0d5b 100644
2989 +--- a/include/net/route.h
2990 ++++ b/include/net/route.h
2991 +@@ -270,6 +270,7 @@ static inline struct rtable *ip_route_connect(struct flowi4 *fl4,
2992 + if (IS_ERR(rt))
2993 + return rt;
2994 + ip_rt_put(rt);
2995 ++ flowi4_update_output(fl4, oif, tos, fl4->daddr, fl4->saddr);
2996 + }
2997 + security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
2998 + return ip_route_output_flow(net, fl4, sk);
2999 +@@ -284,6 +285,9 @@ static inline struct rtable *ip_route_newports(struct flowi4 *fl4, struct rtable
3000 + fl4->fl4_dport = dport;
3001 + fl4->fl4_sport = sport;
3002 + ip_rt_put(rt);
3003 ++ flowi4_update_output(fl4, sk->sk_bound_dev_if,
3004 ++ RT_CONN_FLAGS(sk), fl4->daddr,
3005 ++ fl4->saddr);
3006 + security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
3007 + return ip_route_output_flow(sock_net(sk), fl4, sk);
3008 + }
3009 +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
3010 +index f6bb08b..55ce96b 100644
3011 +--- a/include/net/sch_generic.h
3012 ++++ b/include/net/sch_generic.h
3013 +@@ -220,9 +220,16 @@ struct tcf_proto {
3014 +
3015 + struct qdisc_skb_cb {
3016 + unsigned int pkt_len;
3017 +- long data[];
3018 ++ unsigned char data[24];
3019 + };
3020 +
3021 ++static inline void qdisc_cb_private_validate(const struct sk_buff *skb, int sz)
3022 ++{
3023 ++ struct qdisc_skb_cb *qcb;
3024 ++ BUILD_BUG_ON(sizeof(skb->cb) < sizeof(unsigned int) + sz);
3025 ++ BUILD_BUG_ON(sizeof(qcb->data) < sz);
3026 ++}
3027 ++
3028 + static inline int qdisc_qlen(const struct Qdisc *q)
3029 + {
3030 + return q->q.qlen;
3031 +diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
3032 +index a79886c..94bbec3 100644
3033 +--- a/include/target/target_core_base.h
3034 ++++ b/include/target/target_core_base.h
3035 +@@ -486,6 +486,7 @@ struct se_cmd {
3036 +
3037 + struct scatterlist *t_data_sg;
3038 + unsigned int t_data_nents;
3039 ++ void *t_data_vmap;
3040 + struct scatterlist *t_bidi_data_sg;
3041 + unsigned int t_bidi_data_nents;
3042 +
3043 +diff --git a/include/target/target_core_transport.h b/include/target/target_core_transport.h
3044 +index dac4f2d..72751e8 100644
3045 +--- a/include/target/target_core_transport.h
3046 ++++ b/include/target/target_core_transport.h
3047 +@@ -129,8 +129,8 @@ extern void transport_init_se_cmd(struct se_cmd *,
3048 + struct target_core_fabric_ops *,
3049 + struct se_session *, u32, int, int,
3050 + unsigned char *);
3051 +-void *transport_kmap_first_data_page(struct se_cmd *cmd);
3052 +-void transport_kunmap_first_data_page(struct se_cmd *cmd);
3053 ++void *transport_kmap_data_sg(struct se_cmd *);
3054 ++void transport_kunmap_data_sg(struct se_cmd *);
3055 + extern int transport_generic_allocate_tasks(struct se_cmd *, unsigned char *);
3056 + extern int transport_handle_cdb_direct(struct se_cmd *);
3057 + extern int transport_generic_handle_cdb_map(struct se_cmd *);
3058 +diff --git a/kernel/fork.c b/kernel/fork.c
3059 +index da4a6a1..0acf42c0 100644
3060 +--- a/kernel/fork.c
3061 ++++ b/kernel/fork.c
3062 +@@ -66,6 +66,7 @@
3063 + #include <linux/user-return-notifier.h>
3064 + #include <linux/oom.h>
3065 + #include <linux/khugepaged.h>
3066 ++#include <linux/signalfd.h>
3067 +
3068 + #include <asm/pgtable.h>
3069 + #include <asm/pgalloc.h>
3070 +@@ -910,8 +911,10 @@ static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
3071 +
3072 + void __cleanup_sighand(struct sighand_struct *sighand)
3073 + {
3074 +- if (atomic_dec_and_test(&sighand->count))
3075 ++ if (atomic_dec_and_test(&sighand->count)) {
3076 ++ signalfd_cleanup(sighand);
3077 + kmem_cache_free(sighand_cachep, sighand);
3078 ++ }
3079 + }
3080 +
3081 +
3082 +diff --git a/kernel/irq/autoprobe.c b/kernel/irq/autoprobe.c
3083 +index 342d8f4..0119b9d 100644
3084 +--- a/kernel/irq/autoprobe.c
3085 ++++ b/kernel/irq/autoprobe.c
3086 +@@ -53,7 +53,7 @@ unsigned long probe_irq_on(void)
3087 + if (desc->irq_data.chip->irq_set_type)
3088 + desc->irq_data.chip->irq_set_type(&desc->irq_data,
3089 + IRQ_TYPE_PROBE);
3090 +- irq_startup(desc);
3091 ++ irq_startup(desc, false);
3092 + }
3093 + raw_spin_unlock_irq(&desc->lock);
3094 + }
3095 +@@ -70,7 +70,7 @@ unsigned long probe_irq_on(void)
3096 + raw_spin_lock_irq(&desc->lock);
3097 + if (!desc->action && irq_settings_can_probe(desc)) {
3098 + desc->istate |= IRQS_AUTODETECT | IRQS_WAITING;
3099 +- if (irq_startup(desc))
3100 ++ if (irq_startup(desc, false))
3101 + desc->istate |= IRQS_PENDING;
3102 + }
3103 + raw_spin_unlock_irq(&desc->lock);
3104 +diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
3105 +index f7c543a..fb7db75 100644
3106 +--- a/kernel/irq/chip.c
3107 ++++ b/kernel/irq/chip.c
3108 +@@ -157,19 +157,22 @@ static void irq_state_set_masked(struct irq_desc *desc)
3109 + irqd_set(&desc->irq_data, IRQD_IRQ_MASKED);
3110 + }
3111 +
3112 +-int irq_startup(struct irq_desc *desc)
3113 ++int irq_startup(struct irq_desc *desc, bool resend)
3114 + {
3115 ++ int ret = 0;
3116 ++
3117 + irq_state_clr_disabled(desc);
3118 + desc->depth = 0;
3119 +
3120 + if (desc->irq_data.chip->irq_startup) {
3121 +- int ret = desc->irq_data.chip->irq_startup(&desc->irq_data);
3122 ++ ret = desc->irq_data.chip->irq_startup(&desc->irq_data);
3123 + irq_state_clr_masked(desc);
3124 +- return ret;
3125 ++ } else {
3126 ++ irq_enable(desc);
3127 + }
3128 +-
3129 +- irq_enable(desc);
3130 +- return 0;
3131 ++ if (resend)
3132 ++ check_irq_resend(desc, desc->irq_data.irq);
3133 ++ return ret;
3134 + }
3135 +
3136 + void irq_shutdown(struct irq_desc *desc)
3137 +@@ -330,6 +333,24 @@ out_unlock:
3138 + }
3139 + EXPORT_SYMBOL_GPL(handle_simple_irq);
3140 +
3141 ++/*
3142 ++ * Called unconditionally from handle_level_irq() and only for oneshot
3143 ++ * interrupts from handle_fasteoi_irq()
3144 ++ */
3145 ++static void cond_unmask_irq(struct irq_desc *desc)
3146 ++{
3147 ++ /*
3148 ++ * We need to unmask in the following cases:
3149 ++ * - Standard level irq (IRQF_ONESHOT is not set)
3150 ++ * - Oneshot irq which did not wake the thread (caused by a
3151 ++ * spurious interrupt or a primary handler handling it
3152 ++ * completely).
3153 ++ */
3154 ++ if (!irqd_irq_disabled(&desc->irq_data) &&
3155 ++ irqd_irq_masked(&desc->irq_data) && !desc->threads_oneshot)
3156 ++ unmask_irq(desc);
3157 ++}
3158 ++
3159 + /**
3160 + * handle_level_irq - Level type irq handler
3161 + * @irq: the interrupt number
3162 +@@ -362,8 +383,8 @@ handle_level_irq(unsigned int irq, struct irq_desc *desc)
3163 +
3164 + handle_irq_event(desc);
3165 +
3166 +- if (!irqd_irq_disabled(&desc->irq_data) && !(desc->istate & IRQS_ONESHOT))
3167 +- unmask_irq(desc);
3168 ++ cond_unmask_irq(desc);
3169 ++
3170 + out_unlock:
3171 + raw_spin_unlock(&desc->lock);
3172 + }
3173 +@@ -417,6 +438,9 @@ handle_fasteoi_irq(unsigned int irq, struct irq_desc *desc)
3174 + preflow_handler(desc);
3175 + handle_irq_event(desc);
3176 +
3177 ++ if (desc->istate & IRQS_ONESHOT)
3178 ++ cond_unmask_irq(desc);
3179 ++
3180 + out_eoi:
3181 + desc->irq_data.chip->irq_eoi(&desc->irq_data);
3182 + out_unlock:
3183 +@@ -625,7 +649,7 @@ __irq_set_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained,
3184 + irq_settings_set_noprobe(desc);
3185 + irq_settings_set_norequest(desc);
3186 + irq_settings_set_nothread(desc);
3187 +- irq_startup(desc);
3188 ++ irq_startup(desc, true);
3189 + }
3190 + out:
3191 + irq_put_desc_busunlock(desc, flags);
3192 +diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
3193 +index a73dd6c..e1a8b64 100644
3194 +--- a/kernel/irq/internals.h
3195 ++++ b/kernel/irq/internals.h
3196 +@@ -67,7 +67,7 @@ extern int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
3197 + extern void __disable_irq(struct irq_desc *desc, unsigned int irq, bool susp);
3198 + extern void __enable_irq(struct irq_desc *desc, unsigned int irq, bool resume);
3199 +
3200 +-extern int irq_startup(struct irq_desc *desc);
3201 ++extern int irq_startup(struct irq_desc *desc, bool resend);
3202 + extern void irq_shutdown(struct irq_desc *desc);
3203 + extern void irq_enable(struct irq_desc *desc);
3204 + extern void irq_disable(struct irq_desc *desc);
3205 +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
3206 +index 1da999f..cf2d7ae 100644
3207 +--- a/kernel/irq/manage.c
3208 ++++ b/kernel/irq/manage.c
3209 +@@ -1027,7 +1027,7 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
3210 + desc->istate |= IRQS_ONESHOT;
3211 +
3212 + if (irq_settings_can_autoenable(desc))
3213 +- irq_startup(desc);
3214 ++ irq_startup(desc, true);
3215 + else
3216 + /* Undo nested disables: */
3217 + desc->depth = 1;
3218 +diff --git a/mm/nommu.c b/mm/nommu.c
3219 +index b982290..ee7e57e 100644
3220 +--- a/mm/nommu.c
3221 ++++ b/mm/nommu.c
3222 +@@ -696,9 +696,11 @@ static void add_vma_to_mm(struct mm_struct *mm, struct vm_area_struct *vma)
3223 + if (vma->vm_file) {
3224 + mapping = vma->vm_file->f_mapping;
3225 +
3226 ++ mutex_lock(&mapping->i_mmap_mutex);
3227 + flush_dcache_mmap_lock(mapping);
3228 + vma_prio_tree_insert(vma, &mapping->i_mmap);
3229 + flush_dcache_mmap_unlock(mapping);
3230 ++ mutex_unlock(&mapping->i_mmap_mutex);
3231 + }
3232 +
3233 + /* add the VMA to the tree */
3234 +@@ -760,9 +762,11 @@ static void delete_vma_from_mm(struct vm_area_struct *vma)
3235 + if (vma->vm_file) {
3236 + mapping = vma->vm_file->f_mapping;
3237 +
3238 ++ mutex_lock(&mapping->i_mmap_mutex);
3239 + flush_dcache_mmap_lock(mapping);
3240 + vma_prio_tree_remove(vma, &mapping->i_mmap);
3241 + flush_dcache_mmap_unlock(mapping);
3242 ++ mutex_unlock(&mapping->i_mmap_mutex);
3243 + }
3244 +
3245 + /* remove from the MM's tree and list */
3246 +@@ -2052,6 +2056,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
3247 + high = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
3248 +
3249 + down_write(&nommu_region_sem);
3250 ++ mutex_lock(&inode->i_mapping->i_mmap_mutex);
3251 +
3252 + /* search for VMAs that fall within the dead zone */
3253 + vma_prio_tree_foreach(vma, &iter, &inode->i_mapping->i_mmap,
3254 +@@ -2059,6 +2064,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
3255 + /* found one - only interested if it's shared out of the page
3256 + * cache */
3257 + if (vma->vm_flags & VM_SHARED) {
3258 ++ mutex_unlock(&inode->i_mapping->i_mmap_mutex);
3259 + up_write(&nommu_region_sem);
3260 + return -ETXTBSY; /* not quite true, but near enough */
3261 + }
3262 +@@ -2086,6 +2092,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
3263 + }
3264 + }
3265 +
3266 ++ mutex_unlock(&inode->i_mapping->i_mmap_mutex);
3267 + up_write(&nommu_region_sem);
3268 + return 0;
3269 + }
3270 +diff --git a/net/core/dev.c b/net/core/dev.c
3271 +index 5a13edf..c56cacf 100644
3272 +--- a/net/core/dev.c
3273 ++++ b/net/core/dev.c
3274 +@@ -3565,14 +3565,20 @@ static inline gro_result_t
3275 + __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
3276 + {
3277 + struct sk_buff *p;
3278 ++ unsigned int maclen = skb->dev->hard_header_len;
3279 +
3280 + for (p = napi->gro_list; p; p = p->next) {
3281 + unsigned long diffs;
3282 +
3283 + diffs = (unsigned long)p->dev ^ (unsigned long)skb->dev;
3284 + diffs |= p->vlan_tci ^ skb->vlan_tci;
3285 +- diffs |= compare_ether_header(skb_mac_header(p),
3286 +- skb_gro_mac_header(skb));
3287 ++ if (maclen == ETH_HLEN)
3288 ++ diffs |= compare_ether_header(skb_mac_header(p),
3289 ++ skb_gro_mac_header(skb));
3290 ++ else if (!diffs)
3291 ++ diffs = memcmp(skb_mac_header(p),
3292 ++ skb_gro_mac_header(skb),
3293 ++ maclen);
3294 + NAPI_GRO_CB(p)->same_flow = !diffs;
3295 + NAPI_GRO_CB(p)->flush = 0;
3296 + }
3297 +diff --git a/net/core/netpoll.c b/net/core/netpoll.c
3298 +index 5d4d896..ab0633f 100644
3299 +--- a/net/core/netpoll.c
3300 ++++ b/net/core/netpoll.c
3301 +@@ -194,7 +194,7 @@ static void netpoll_poll_dev(struct net_device *dev)
3302 +
3303 + poll_napi(dev);
3304 +
3305 +- if (dev->priv_flags & IFF_SLAVE) {
3306 ++ if (dev->flags & IFF_SLAVE) {
3307 + if (dev->npinfo) {
3308 + struct net_device *bond_dev = dev->master;
3309 + struct sk_buff *skb;
3310 +diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
3311 +index 96a164a..59a7041 100644
3312 +--- a/net/ipv4/arp.c
3313 ++++ b/net/ipv4/arp.c
3314 +@@ -867,7 +867,8 @@ static int arp_process(struct sk_buff *skb)
3315 + if (addr_type == RTN_UNICAST &&
3316 + (arp_fwd_proxy(in_dev, dev, rt) ||
3317 + arp_fwd_pvlan(in_dev, dev, rt, sip, tip) ||
3318 +- pneigh_lookup(&arp_tbl, net, &tip, dev, 0))) {
3319 ++ (rt->dst.dev != dev &&
3320 ++ pneigh_lookup(&arp_tbl, net, &tip, dev, 0)))) {
3321 + n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
3322 + if (n)
3323 + neigh_release(n);
3324 +diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
3325 +index 1e60f76..42dd1a9 100644
3326 +--- a/net/ipv4/ip_options.c
3327 ++++ b/net/ipv4/ip_options.c
3328 +@@ -573,8 +573,8 @@ void ip_forward_options(struct sk_buff *skb)
3329 + }
3330 + if (srrptr + 3 <= srrspace) {
3331 + opt->is_changed = 1;
3332 +- ip_rt_get_source(&optptr[srrptr-1], skb, rt);
3333 + ip_hdr(skb)->daddr = opt->nexthop;
3334 ++ ip_rt_get_source(&optptr[srrptr-1], skb, rt);
3335 + optptr[2] = srrptr+4;
3336 + } else if (net_ratelimit())
3337 + printk(KERN_CRIT "ip_forward(): Argh! Destination lost!\n");
3338 +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
3339 +index 52b5c2d..53113b9 100644
3340 +--- a/net/ipv4/tcp_input.c
3341 ++++ b/net/ipv4/tcp_input.c
3342 +@@ -1310,25 +1310,26 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
3343 + return in_sack;
3344 + }
3345 +
3346 +-static u8 tcp_sacktag_one(const struct sk_buff *skb, struct sock *sk,
3347 +- struct tcp_sacktag_state *state,
3348 ++/* Mark the given newly-SACKed range as such, adjusting counters and hints. */
3349 ++static u8 tcp_sacktag_one(struct sock *sk,
3350 ++ struct tcp_sacktag_state *state, u8 sacked,
3351 ++ u32 start_seq, u32 end_seq,
3352 + int dup_sack, int pcount)
3353 + {
3354 + struct tcp_sock *tp = tcp_sk(sk);
3355 +- u8 sacked = TCP_SKB_CB(skb)->sacked;
3356 + int fack_count = state->fack_count;
3357 +
3358 + /* Account D-SACK for retransmitted packet. */
3359 + if (dup_sack && (sacked & TCPCB_RETRANS)) {
3360 + if (tp->undo_marker && tp->undo_retrans &&
3361 +- after(TCP_SKB_CB(skb)->end_seq, tp->undo_marker))
3362 ++ after(end_seq, tp->undo_marker))
3363 + tp->undo_retrans--;
3364 + if (sacked & TCPCB_SACKED_ACKED)
3365 + state->reord = min(fack_count, state->reord);
3366 + }
3367 +
3368 + /* Nothing to do; acked frame is about to be dropped (was ACKed). */
3369 +- if (!after(TCP_SKB_CB(skb)->end_seq, tp->snd_una))
3370 ++ if (!after(end_seq, tp->snd_una))
3371 + return sacked;
3372 +
3373 + if (!(sacked & TCPCB_SACKED_ACKED)) {
3374 +@@ -1347,13 +1348,13 @@ static u8 tcp_sacktag_one(const struct sk_buff *skb, struct sock *sk,
3375 + /* New sack for not retransmitted frame,
3376 + * which was in hole. It is reordering.
3377 + */
3378 +- if (before(TCP_SKB_CB(skb)->seq,
3379 ++ if (before(start_seq,
3380 + tcp_highest_sack_seq(tp)))
3381 + state->reord = min(fack_count,
3382 + state->reord);
3383 +
3384 + /* SACK enhanced F-RTO (RFC4138; Appendix B) */
3385 +- if (!after(TCP_SKB_CB(skb)->end_seq, tp->frto_highmark))
3386 ++ if (!after(end_seq, tp->frto_highmark))
3387 + state->flag |= FLAG_ONLY_ORIG_SACKED;
3388 + }
3389 +
3390 +@@ -1371,8 +1372,7 @@ static u8 tcp_sacktag_one(const struct sk_buff *skb, struct sock *sk,
3391 +
3392 + /* Lost marker hint past SACKed? Tweak RFC3517 cnt */
3393 + if (!tcp_is_fack(tp) && (tp->lost_skb_hint != NULL) &&
3394 +- before(TCP_SKB_CB(skb)->seq,
3395 +- TCP_SKB_CB(tp->lost_skb_hint)->seq))
3396 ++ before(start_seq, TCP_SKB_CB(tp->lost_skb_hint)->seq))
3397 + tp->lost_cnt_hint += pcount;
3398 +
3399 + if (fack_count > tp->fackets_out)
3400 +@@ -1391,6 +1391,9 @@ static u8 tcp_sacktag_one(const struct sk_buff *skb, struct sock *sk,
3401 + return sacked;
3402 + }
3403 +
3404 ++/* Shift newly-SACKed bytes from this skb to the immediately previous
3405 ++ * already-SACKed sk_buff. Mark the newly-SACKed bytes as such.
3406 ++ */
3407 + static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
3408 + struct tcp_sacktag_state *state,
3409 + unsigned int pcount, int shifted, int mss,
3410 +@@ -1398,10 +1401,13 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
3411 + {
3412 + struct tcp_sock *tp = tcp_sk(sk);
3413 + struct sk_buff *prev = tcp_write_queue_prev(sk, skb);
3414 ++ u32 start_seq = TCP_SKB_CB(skb)->seq; /* start of newly-SACKed */
3415 ++ u32 end_seq = start_seq + shifted; /* end of newly-SACKed */
3416 +
3417 + BUG_ON(!pcount);
3418 +
3419 +- if (skb == tp->lost_skb_hint)
3420 ++ /* Adjust hint for FACK. Non-FACK is handled in tcp_sacktag_one(). */
3421 ++ if (tcp_is_fack(tp) && (skb == tp->lost_skb_hint))
3422 + tp->lost_cnt_hint += pcount;
3423 +
3424 + TCP_SKB_CB(prev)->end_seq += shifted;
3425 +@@ -1427,8 +1433,11 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
3426 + skb_shinfo(skb)->gso_type = 0;
3427 + }
3428 +
3429 +- /* We discard results */
3430 +- tcp_sacktag_one(skb, sk, state, dup_sack, pcount);
3431 ++ /* Adjust counters and hints for the newly sacked sequence range but
3432 ++ * discard the return value since prev is already marked.
3433 ++ */
3434 ++ tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
3435 ++ start_seq, end_seq, dup_sack, pcount);
3436 +
3437 + /* Difference in this won't matter, both ACKed by the same cumul. ACK */
3438 + TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS);
3439 +@@ -1667,10 +1676,14 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,
3440 + break;
3441 +
3442 + if (in_sack) {
3443 +- TCP_SKB_CB(skb)->sacked = tcp_sacktag_one(skb, sk,
3444 +- state,
3445 +- dup_sack,
3446 +- tcp_skb_pcount(skb));
3447 ++ TCP_SKB_CB(skb)->sacked =
3448 ++ tcp_sacktag_one(sk,
3449 ++ state,
3450 ++ TCP_SKB_CB(skb)->sacked,
3451 ++ TCP_SKB_CB(skb)->seq,
3452 ++ TCP_SKB_CB(skb)->end_seq,
3453 ++ dup_sack,
3454 ++ tcp_skb_pcount(skb));
3455 +
3456 + if (!before(TCP_SKB_CB(skb)->seq,
3457 + tcp_highest_sack_seq(tp)))
3458 +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
3459 +index c89e354..eb90aa8 100644
3460 +--- a/net/ipv4/tcp_ipv4.c
3461 ++++ b/net/ipv4/tcp_ipv4.c
3462 +@@ -650,6 +650,11 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
3463 + arg.iov[0].iov_len, IPPROTO_TCP, 0);
3464 + arg.csumoffset = offsetof(struct tcphdr, check) / 2;
3465 + arg.flags = (sk && inet_sk(sk)->transparent) ? IP_REPLY_ARG_NOSRCCHECK : 0;
3466 ++ /* When socket is gone, all binding information is lost.
3467 ++ * routing might fail in this case. using iif for oif to
3468 ++ * make sure we can deliver it
3469 ++ */
3470 ++ arg.bound_dev_if = sk ? sk->sk_bound_dev_if : inet_iif(skb);
3471 +
3472 + net = dev_net(skb_dst(skb)->dev);
3473 + arg.tos = ip_hdr(skb)->tos;
3474 +diff --git a/net/mac80211/main.c b/net/mac80211/main.c
3475 +index a7536fd..7d9b21d 100644
3476 +--- a/net/mac80211/main.c
3477 ++++ b/net/mac80211/main.c
3478 +@@ -885,6 +885,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
3479 + wiphy_debug(local->hw.wiphy, "Failed to initialize wep: %d\n",
3480 + result);
3481 +
3482 ++ ieee80211_led_init(local);
3483 ++
3484 + rtnl_lock();
3485 +
3486 + result = ieee80211_init_rate_ctrl_alg(local,
3487 +@@ -906,8 +908,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
3488 +
3489 + rtnl_unlock();
3490 +
3491 +- ieee80211_led_init(local);
3492 +-
3493 + local->network_latency_notifier.notifier_call =
3494 + ieee80211_max_network_latency;
3495 + result = pm_qos_add_notifier(PM_QOS_NETWORK_LATENCY,
3496 +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
3497 +index 093cc32..6dc7d7d 100644
3498 +--- a/net/netfilter/ipvs/ip_vs_core.c
3499 ++++ b/net/netfilter/ipvs/ip_vs_core.c
3500 +@@ -232,6 +232,7 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
3501 + __be16 dport = 0; /* destination port to forward */
3502 + unsigned int flags;
3503 + struct ip_vs_conn_param param;
3504 ++ const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
3505 + union nf_inet_addr snet; /* source network of the client,
3506 + after masking */
3507 +
3508 +@@ -267,7 +268,6 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
3509 + {
3510 + int protocol = iph.protocol;
3511 + const union nf_inet_addr *vaddr = &iph.daddr;
3512 +- const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
3513 + __be16 vport = 0;
3514 +
3515 + if (dst_port == svc->port) {
3516 +diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
3517 +index 3422b25..081ffb9 100644
3518 +--- a/net/sched/sch_choke.c
3519 ++++ b/net/sched/sch_choke.c
3520 +@@ -225,8 +225,7 @@ struct choke_skb_cb {
3521 +
3522 + static inline struct choke_skb_cb *choke_skb_cb(const struct sk_buff *skb)
3523 + {
3524 +- BUILD_BUG_ON(sizeof(skb->cb) <
3525 +- sizeof(struct qdisc_skb_cb) + sizeof(struct choke_skb_cb));
3526 ++ qdisc_cb_private_validate(skb, sizeof(struct choke_skb_cb));
3527 + return (struct choke_skb_cb *)qdisc_skb_cb(skb)->data;
3528 + }
3529 +
3530 +diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
3531 +index a4ab207..7801b15 100644
3532 +--- a/net/sched/sch_netem.c
3533 ++++ b/net/sched/sch_netem.c
3534 +@@ -118,8 +118,7 @@ struct netem_skb_cb {
3535 +
3536 + static inline struct netem_skb_cb *netem_skb_cb(struct sk_buff *skb)
3537 + {
3538 +- BUILD_BUG_ON(sizeof(skb->cb) <
3539 +- sizeof(struct qdisc_skb_cb) + sizeof(struct netem_skb_cb));
3540 ++ qdisc_cb_private_validate(skb, sizeof(struct netem_skb_cb));
3541 + return (struct netem_skb_cb *)qdisc_skb_cb(skb)->data;
3542 + }
3543 +
3544 +@@ -383,8 +382,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
3545 + q->counter = 0;
3546 +
3547 + __skb_queue_head(&q->qdisc->q, skb);
3548 +- q->qdisc->qstats.backlog += qdisc_pkt_len(skb);
3549 +- q->qdisc->qstats.requeues++;
3550 ++ sch->qstats.backlog += qdisc_pkt_len(skb);
3551 ++ sch->qstats.requeues++;
3552 + ret = NET_XMIT_SUCCESS;
3553 + }
3554 +
3555 +diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
3556 +index e83c272..17859ea 100644
3557 +--- a/net/sched/sch_sfb.c
3558 ++++ b/net/sched/sch_sfb.c
3559 +@@ -93,8 +93,7 @@ struct sfb_skb_cb {
3560 +
3561 + static inline struct sfb_skb_cb *sfb_skb_cb(const struct sk_buff *skb)
3562 + {
3563 +- BUILD_BUG_ON(sizeof(skb->cb) <
3564 +- sizeof(struct qdisc_skb_cb) + sizeof(struct sfb_skb_cb));
3565 ++ qdisc_cb_private_validate(skb, sizeof(struct sfb_skb_cb));
3566 + return (struct sfb_skb_cb *)qdisc_skb_cb(skb)->data;
3567 + }
3568 +
3569 +diff --git a/scripts/package/builddeb b/scripts/package/builddeb
3570 +index f6cbc3d..3c6c0b1 100644
3571 +--- a/scripts/package/builddeb
3572 ++++ b/scripts/package/builddeb
3573 +@@ -238,14 +238,14 @@ EOF
3574 + fi
3575 +
3576 + # Build header package
3577 +-(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > /tmp/files$$)
3578 +-(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> /tmp/files$$)
3579 +-(cd $objtree; find .config Module.symvers include scripts -type f >> /tmp/objfiles$$)
3580 ++(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > "$objtree/debian/hdrsrcfiles")
3581 ++(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> "$objtree/debian/hdrsrcfiles")
3582 ++(cd $objtree; find .config Module.symvers include scripts -type f >> "$objtree/debian/hdrobjfiles")
3583 + destdir=$kernel_headers_dir/usr/src/linux-headers-$version
3584 + mkdir -p "$destdir"
3585 +-(cd $srctree; tar -c -f - -T /tmp/files$$) | (cd $destdir; tar -xf -)
3586 +-(cd $objtree; tar -c -f - -T /tmp/objfiles$$) | (cd $destdir; tar -xf -)
3587 +-rm -f /tmp/files$$ /tmp/objfiles$$
3588 ++(cd $srctree; tar -c -f - -T "$objtree/debian/hdrsrcfiles") | (cd $destdir; tar -xf -)
3589 ++(cd $objtree; tar -c -f - -T "$objtree/debian/hdrobjfiles") | (cd $destdir; tar -xf -)
3590 ++rm -f "$objtree/debian/hdrsrcfiles" "$objtree/debian/hdrobjfiles"
3591 + arch=$(dpkg --print-architecture)
3592 +
3593 + cat <<EOF >> debian/control
3594 +diff --git a/security/tomoyo/.gitignore b/security/tomoyo/.gitignore
3595 +new file mode 100644
3596 +index 0000000..5caf1a6
3597 +--- /dev/null
3598 ++++ b/security/tomoyo/.gitignore
3599 +@@ -0,0 +1,2 @@
3600 ++builtin-policy.h
3601 ++policy/
3602 +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
3603 +index 7072251..08bad5b 100644
3604 +--- a/sound/pci/hda/patch_conexant.c
3605 ++++ b/sound/pci/hda/patch_conexant.c
3606 +@@ -1899,6 +1899,10 @@ static void cxt5051_init_mic_port(struct hda_codec *codec, hda_nid_t nid,
3607 + snd_hda_codec_write(codec, nid, 0,
3608 + AC_VERB_SET_UNSOLICITED_ENABLE,
3609 + AC_USRSP_EN | event);
3610 ++}
3611 ++
3612 ++static void cxt5051_init_mic_jack(struct hda_codec *codec, hda_nid_t nid)
3613 ++{
3614 + snd_hda_input_jack_add(codec, nid, SND_JACK_MICROPHONE, NULL);
3615 + snd_hda_input_jack_report(codec, nid);
3616 + }
3617 +@@ -1916,7 +1920,6 @@ static int cxt5051_init(struct hda_codec *codec)
3618 + struct conexant_spec *spec = codec->spec;
3619 +
3620 + conexant_init(codec);
3621 +- conexant_init_jacks(codec);
3622 +
3623 + if (spec->auto_mic & AUTO_MIC_PORTB)
3624 + cxt5051_init_mic_port(codec, 0x17, CXT5051_PORTB_EVENT);
3625 +@@ -2037,6 +2040,12 @@ static int patch_cxt5051(struct hda_codec *codec)
3626 + if (spec->beep_amp)
3627 + snd_hda_attach_beep_device(codec, spec->beep_amp);
3628 +
3629 ++ conexant_init_jacks(codec);
3630 ++ if (spec->auto_mic & AUTO_MIC_PORTB)
3631 ++ cxt5051_init_mic_jack(codec, 0x17);
3632 ++ if (spec->auto_mic & AUTO_MIC_PORTC)
3633 ++ cxt5051_init_mic_jack(codec, 0x18);
3634 ++
3635 + return 0;
3636 + }
3637 +
3638 +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
3639 +index 9c197d4..c4c8d78 100644
3640 +--- a/sound/pci/hda/patch_realtek.c
3641 ++++ b/sound/pci/hda/patch_realtek.c
3642 +@@ -79,6 +79,8 @@ enum {
3643 + ALC_AUTOMUTE_MIXER, /* mute/unmute mixer widget AMP */
3644 + };
3645 +
3646 ++#define MAX_VOL_NIDS 0x40
3647 ++
3648 + struct alc_spec {
3649 + /* codec parameterization */
3650 + const struct snd_kcontrol_new *mixers[5]; /* mixer arrays */
3651 +@@ -117,8 +119,8 @@ struct alc_spec {
3652 + const hda_nid_t *capsrc_nids;
3653 + hda_nid_t dig_in_nid; /* digital-in NID; optional */
3654 + hda_nid_t mixer_nid; /* analog-mixer NID */
3655 +- DECLARE_BITMAP(vol_ctls, 0x20 << 1);
3656 +- DECLARE_BITMAP(sw_ctls, 0x20 << 1);
3657 ++ DECLARE_BITMAP(vol_ctls, MAX_VOL_NIDS << 1);
3658 ++ DECLARE_BITMAP(sw_ctls, MAX_VOL_NIDS << 1);
3659 +
3660 + /* capture setup for dynamic dual-adc switch */
3661 + hda_nid_t cur_adc;
3662 +@@ -3068,7 +3070,10 @@ static int alc_auto_fill_dac_nids(struct hda_codec *codec)
3663 + static inline unsigned int get_ctl_pos(unsigned int data)
3664 + {
3665 + hda_nid_t nid = get_amp_nid_(data);
3666 +- unsigned int dir = get_amp_direction_(data);
3667 ++ unsigned int dir;
3668 ++ if (snd_BUG_ON(nid >= MAX_VOL_NIDS))
3669 ++ return 0;
3670 ++ dir = get_amp_direction_(data);
3671 + return (nid << 1) | dir;
3672 + }
3673 +
3674 +@@ -4224,12 +4229,20 @@ static void alc889_fixup_dac_route(struct hda_codec *codec,
3675 + const struct alc_fixup *fix, int action)
3676 + {
3677 + if (action == ALC_FIXUP_ACT_PRE_PROBE) {
3678 ++ /* fake the connections during parsing the tree */
3679 + hda_nid_t conn1[2] = { 0x0c, 0x0d };
3680 + hda_nid_t conn2[2] = { 0x0e, 0x0f };
3681 + snd_hda_override_conn_list(codec, 0x14, 2, conn1);
3682 + snd_hda_override_conn_list(codec, 0x15, 2, conn1);
3683 + snd_hda_override_conn_list(codec, 0x18, 2, conn2);
3684 + snd_hda_override_conn_list(codec, 0x1a, 2, conn2);
3685 ++ } else if (action == ALC_FIXUP_ACT_PROBE) {
3686 ++ /* restore the connections */
3687 ++ hda_nid_t conn[5] = { 0x0c, 0x0d, 0x0e, 0x0f, 0x26 };
3688 ++ snd_hda_override_conn_list(codec, 0x14, 5, conn);
3689 ++ snd_hda_override_conn_list(codec, 0x15, 5, conn);
3690 ++ snd_hda_override_conn_list(codec, 0x18, 5, conn);
3691 ++ snd_hda_override_conn_list(codec, 0x1a, 5, conn);
3692 + }
3693 + }
3694 +
3695 +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
3696 +index d795294..07dd7eb 100644
3697 +--- a/sound/soc/codecs/wm8962.c
3698 ++++ b/sound/soc/codecs/wm8962.c
3699 +@@ -2559,7 +2559,7 @@ static int dsp2_event(struct snd_soc_dapm_widget *w,
3700 + return 0;
3701 + }
3702 +
3703 +-static const char *st_text[] = { "None", "Right", "Left" };
3704 ++static const char *st_text[] = { "None", "Left", "Right" };
3705 +
3706 + static const struct soc_enum str_enum =
3707 + SOC_ENUM_SINGLE(WM8962_DAC_DSP_MIXING_1, 2, 3, st_text);