64 files changed, 755 insertions, 265 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index 9de961bd1214..2b349ba4add4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3434,11 +3434,10 @@ L:	linuxppc-dev@ozlabs.org
 S:      Maintained
 LINUX FOR POWERPC EMBEDDED MPC5XXX
-P:      Sylvain Munaut
-M:      tnt@246tNt.com
 P:      Grant Likely
 M:      grant.likely@secretlab.ca
 L:      linuxppc-dev@ozlabs.org
+T:      git git://git.secretlab.ca/git/linux-2.6.git
 S:      Maintained
 LINUX FOR POWERPC EMBEDDED PPC4XX
@@ -3456,6 +3455,7 @@ P:	Grant Likely
 M:      grant.likely@secretlab.ca
 W:      http://wiki.secretlab.ca/index.php/Linux_on_Xilinx_Virtex
 L:      linuxppc-dev@ozlabs.org
+T:      git git://git.secretlab.ca/git/linux-2.6.git
 S:      Maintained
 LINUX FOR POWERPC EMBEDDED PPC8XX
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index cd1b687544f3..f9c40f869c6e 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -382,7 +382,8 @@ static struct cpu_spec __initdata cpu_specs[] = {
                .icache_bsize           = 128,
                .dcache_bsize           = 128,
                .machine_check          = machine_check_generic,
-                .oprofile_cpu_type      = "ppc64/compat-power5+",
+                .oprofile_cpu_type      = "ppc64/ibm-compat-v1",
+                .oprofile_type          = PPC_OPROFILE_POWER4,
                .platform               = "power5+",
        },
        {       /* Power6 */
@@ -416,7 +417,8 @@ static struct cpu_spec __initdata cpu_specs[] = {
                .icache_bsize           = 128,
                .dcache_bsize           = 128,
                .machine_check          = machine_check_generic,
-                .oprofile_cpu_type      = "ppc64/compat-power6",
+                .oprofile_cpu_type      = "ppc64/ibm-compat-v1",
+                .oprofile_type          = PPC_OPROFILE_POWER4,
                .platform               = "power6",
        },
        {       /* 2.06-compliant processor, i.e. Power7 "architected" mode */
@@ -429,7 +431,8 @@ static struct cpu_spec __initdata cpu_specs[] = {
                .icache_bsize           = 128,
                .dcache_bsize           = 128,
                .machine_check          = machine_check_generic,
-                .oprofile_cpu_type      = "ppc64/compat-power7",
+                .oprofile_type          = PPC_OPROFILE_POWER4,
+                .oprofile_cpu_type      = "ppc64/ibm-compat-v1",
                .platform               = "power7",
        },
        {       /* Power7 */
@@ -1833,8 +1836,10 @@ static void __init setup_cpu_spec(unsigned long offset, struct cpu_spec *s)
                 * and, in that case, keep the current value for
                 * oprofile_cpu_type.
                 */
-                if (old.oprofile_cpu_type == NULL)
+                if (old.oprofile_cpu_type == NULL) {
-                        t->oprofile_cpu_type = s->oprofile_cpu_type;
+                        t->oprofile_cpu_type = old.oprofile_cpu_type;
+                        t->oprofile_type = old.oprofile_type;
+                }
        }
        *PTRRELOC(&cur_cpu_spec) = &the_cpu_spec;
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index fe8041e619ea..b25e9b6516ae 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -254,6 +254,14 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
                brq.data.blocks = req->nr_sectors;
                /*
+                 * The block layer doesn't support all sector count
+                 * restrictions, so we need to be prepared for too big
+                 * requests.
+                 */
+                if (brq.data.blocks > card->host->max_blk_count)
+                        brq.data.blocks = card->host->max_blk_count;
+                /*
                 * After a read error, we redo the request one sector at a time
                 * in order to accurately determine which sectors can be read
                 * successfully.
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index fa073ab3fa34..264911732756 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -706,7 +706,7 @@ static void mmc_power_up(struct mmc_host *host)
         * This delay should be sufficient to allow the power supply
         * to reach the minimum voltage.
         */
-        mmc_delay(2);
+        mmc_delay(10);
        host->ios.clock = host->f_min;
        host->ios.power_mode = MMC_POWER_ON;
@@ -716,7 +716,7 @@ static void mmc_power_up(struct mmc_host *host)
         * This delay must be at least 74 clock sizes, or 1 ms, or the
         * time required to reach a stable voltage.
         */
-        mmc_delay(2);
+        mmc_delay(10);
 }
 static void mmc_power_off(struct mmc_host *host)
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index a663429b3d55..36875dcfa492 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -514,6 +514,7 @@ static int __devinit mmci_probe(struct amba_device *dev, void *id)
        }
        host = mmc_priv(mmc);
+        host->mmc = mmc;
        /* Bits 12 thru 19 is the designer */
        host->hw_designer = (dev->periphid >> 12) & 0xff;
        /* Bits 20 thru 23 is the revison */
@@ -545,7 +546,6 @@ static int __devinit mmci_probe(struct amba_device *dev, void *id)
                host->mclk = clk_get_rate(host->clk);
                DBG(host, "eventual mclk rate: %u Hz\n", host->mclk);
        }
-        host->mmc = mmc;
        host->base = ioremap(dev->res.start, SZ_4K);
        if (!host->base) {
                ret = -ENOMEM;
diff --git a/drivers/mmc/host/mvsdio.c b/drivers/mmc/host/mvsdio.c
index b5c375d94ab3..c643d0fe118f 100644
--- a/drivers/mmc/host/mvsdio.c
+++ b/drivers/mmc/host/mvsdio.c
@@ -825,24 +825,23 @@ static int __exit mvsd_remove(struct platform_device *pdev)
 }
 #ifdef CONFIG_PM
-static int mvsd_suspend(struct platform_device *dev, pm_message_t state,
+static int mvsd_suspend(struct platform_device *dev, pm_message_t state)
-                           u32 level)
 {
        struct mmc_host *mmc = platform_get_drvdata(dev);
        int ret = 0;
-        if (mmc && level == SUSPEND_DISABLE)
+        if (mmc)
                ret = mmc_suspend_host(mmc, state);
        return ret;
 }
-static int mvsd_resume(struct platform_device *dev, u32 level)
+static int mvsd_resume(struct platform_device *dev)
 {
-        struct mmc_host *mmc = platform_dev_get_drvdata(dev);
+        struct mmc_host *mmc = platform_get_drvdata(dev);
        int ret = 0;
-        if (mmc && level == RESUME_ENABLE)
+        if (mmc)
                ret = mmc_resume_host(mmc);
        return ret;
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index cd37962ec44f..65be27995d5c 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -522,8 +522,8 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
        host = sdhci_alloc_host(&pdev->dev, sizeof(struct sdhci_pci_slot));
        if (IS_ERR(host)) {
-                ret = PTR_ERR(host);
+                dev_err(&pdev->dev, "cannot allocate host\n");
-                goto unmap;
+                return ERR_PTR(PTR_ERR(host));
        }
        slot = sdhci_priv(host);
@@ -541,7 +541,7 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
        ret = pci_request_region(pdev, bar, mmc_hostname(host->mmc));
        if (ret) {
                dev_err(&pdev->dev, "cannot request region\n");
-                return ERR_PTR(ret);
+                goto free;
        }
        addr = pci_resource_start(pdev, bar);
@@ -572,6 +572,8 @@ unmap:
 release:
        pci_release_region(pdev, bar);
+free:
        sdhci_free_host(host);
        return ERR_PTR(ret);
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index f20a834f4309..65c6f996bbd3 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -125,7 +125,7 @@
 #define  SDHCI_INT_DATA_MASK    (SDHCI_INT_DATA_END | SDHCI_INT_DMA_END | \
                SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL | \
                SDHCI_INT_DATA_TIMEOUT | SDHCI_INT_DATA_CRC | \
-                SDHCI_INT_DATA_END_BIT)
+                SDHCI_INT_DATA_END_BIT | SDHCI_ADMA_ERROR)
 #define SDHCI_INT_ALL_MASK      ((unsigned int)-1)
 #define SDHCI_ACMD12_ERR        0x3C
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 553a89919778..46d312bedfb8 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1706,10 +1706,8 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
 * Called with RTNL
 */
 int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
-        __releases(&bond->curr_slave_lock)
-        __releases(&bond->lock)
        __acquires(&bond->lock)
-        __acquires(&bond->curr_slave_lock)
+        __releases(&bond->lock)
 {
        struct bonding *bond = netdev_priv(bond_dev);
        struct sockaddr *sa = addr;
@@ -1745,9 +1743,6 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
                }
        }
-        write_unlock_bh(&bond->curr_slave_lock);
-        read_unlock(&bond->lock);
        if (swap_slave) {
                alb_swap_mac_addr(bond, swap_slave, bond->curr_active_slave);
                alb_fasten_mac_swap(bond, swap_slave, bond->curr_active_slave);
@@ -1755,16 +1750,15 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
                alb_set_slave_mac_addr(bond->curr_active_slave, bond_dev->dev_addr,
                                       bond->alb_info.rlb_enabled);
+                read_lock(&bond->lock);
                alb_send_learning_packets(bond->curr_active_slave, bond_dev->dev_addr);
                if (bond->alb_info.rlb_enabled) {
                        /* inform clients mac address has changed */
                        rlb_req_update_slave_clients(bond, bond->curr_active_slave);
                }
+                read_unlock(&bond->lock);
        }
-        read_lock(&bond->lock);
-        write_lock_bh(&bond->curr_slave_lock);
        return 0;
 }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 63369b6b14d4..2188a96fc090 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2213,33 +2213,24 @@ static int bond_slave_info_query(struct net_device *bond_dev, struct ifslave *in
 {
        struct bonding *bond = netdev_priv(bond_dev);
        struct slave *slave;
-        int i, found = 0;
+        int i, res = -ENODEV;
-        if (info->slave_id < 0) {
-                return -ENODEV;
-        }
        read_lock(&bond->lock);
        bond_for_each_slave(bond, slave, i) {
                if (i == (int)info->slave_id) {
-                        found = 1;
+                        res = 0;
+                        strcpy(info->slave_name, slave->dev->name);
+                        info->link = slave->link;
+                        info->state = slave->state;
+                        info->link_failure_count = slave->link_failure_count;
                        break;
                }
        }
        read_unlock(&bond->lock);
-        if (found) {
+        return res;
-                strcpy(info->slave_name, slave->dev->name);
-                info->link = slave->link;
-                info->state = slave->state;
-                info->link_failure_count = slave->link_failure_count;
-        } else {
-                return -ENODEV;
-        }
-        return 0;
 }
 /*-------------------------------- Monitoring -------------------------------*/
@@ -5167,16 +5158,15 @@ int bond_create(char *name, struct bond_params *params)
        up_write(&bonding_rwsem);
        rtnl_unlock(); /* allows sysfs registration of net device */
        res = bond_create_sysfs_entry(netdev_priv(bond_dev));
-        if (res < 0) {
+        if (res < 0)
-                rtnl_lock();
+                goto out_unreg;
-                down_write(&bonding_rwsem);
-                bond_deinit(bond_dev);
-                unregister_netdevice(bond_dev);
-                goto out_rtnl;
-        }
        return 0;
+out_unreg:
+        rtnl_lock();
+        down_write(&bonding_rwsem);
+        unregister_netdevice(bond_dev);
 out_bond:
        bond_deinit(bond_dev);
 out_netdev:
diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
index e1bd690ff831..4f68aeb2679a 100644
--- a/drivers/net/cxgb3/t3_hw.c
+++ b/drivers/net/cxgb3/t3_hw.c
@@ -3779,7 +3779,7 @@ int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai,
        adapter->params.info = ai;
        adapter->params.nports = ai->nports0 + ai->nports1;
-        adapter->params.chan_map = !!ai->nports0 | (!!ai->nports1 << 1);
+        adapter->params.chan_map = (!!ai->nports0) | (!!ai->nports1 << 1);
        adapter->params.rev = t3_read_reg(adapter, A_PL_REV);
        /*
         * We used to only run the "adapter check task" once a second if
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 6a46ceed9436..b1419e21b46b 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3738,7 +3738,7 @@ static irqreturn_t e1000_intr(int irq, void *data)
        struct e1000_hw *hw = &adapter->hw;
        u32 rctl, icr = er32(ICR);
-        if (unlikely((!icr) || test_bit(__E1000_RESETTING, &adapter->flags)))
+        if (unlikely((!icr) || test_bit(__E1000_DOWN, &adapter->flags)))
                return IRQ_NONE;  /* Not our interrupt */
        /* IMS will not auto-mask if INT_ASSERTED is not set, and if it is
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 6e317caf429c..16a41389575a 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0100"
+#define DRV_VERSION     "EHEA_0101"
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 604c844d0769..b22dab9153f6 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -545,14 +545,17 @@ static inline struct sk_buff *get_skb_by_index(struct sk_buff **skb_array,
        x &= (arr_len - 1);
        pref = skb_array[x];
-        prefetchw(pref);
+        if (pref) {
-        prefetchw(pref + EHEA_CACHE_LINE);
+                prefetchw(pref);
+                prefetchw(pref + EHEA_CACHE_LINE);
-        pref = (skb_array[x]->data);
-        prefetch(pref);
+                pref = (skb_array[x]->data);
-        prefetch(pref + EHEA_CACHE_LINE);
+                prefetch(pref);
-        prefetch(pref + EHEA_CACHE_LINE * 2);
+                prefetch(pref + EHEA_CACHE_LINE);
-        prefetch(pref + EHEA_CACHE_LINE * 3);
+                prefetch(pref + EHEA_CACHE_LINE * 2);
+                prefetch(pref + EHEA_CACHE_LINE * 3);
+        }
        skb = skb_array[skb_index];
        skb_array[skb_index] = NULL;
        return skb;
@@ -569,12 +572,14 @@ static inline struct sk_buff *get_skb_by_index_ll(struct sk_buff **skb_array,
        x &= (arr_len - 1);
        pref = skb_array[x];
-        prefetchw(pref);
+        if (pref) {
-        prefetchw(pref + EHEA_CACHE_LINE);
+                prefetchw(pref);
+                prefetchw(pref + EHEA_CACHE_LINE);
-        pref = (skb_array[x]->data);
+                pref = (skb_array[x]->data);
-        prefetchw(pref);
+                prefetchw(pref);
-        prefetchw(pref + EHEA_CACHE_LINE);
+                prefetchw(pref + EHEA_CACHE_LINE);
+        }
        skb = skb_array[wqe_index];
        skb_array[wqe_index] = NULL;
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index b3185bf2c158..a400d7115f78 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -393,12 +393,12 @@ struct mv643xx_eth_private {
        struct work_struct tx_timeout_task;
        struct napi_struct napi;
+        u8 oom;
        u8 work_link;
        u8 work_tx;
        u8 work_tx_end;
        u8 work_rx;
        u8 work_rx_refill;
-        u8 work_rx_oom;
        int skb_size;
        struct sk_buff_head rx_recycle;
@@ -661,7 +661,7 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
                                            dma_get_cache_alignment() - 1);
                if (skb == NULL) {
-                        mp->work_rx_oom |= 1 << rxq->index;
+                        mp->oom = 1;
                        goto oom;
                }
@@ -1255,7 +1255,6 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
        spin_lock_bh(&mp->mib_counters_lock);
        p->good_octets_received += mib_read(mp, 0x00);
-        p->good_octets_received += (u64)mib_read(mp, 0x04) << 32;
        p->bad_octets_received += mib_read(mp, 0x08);
        p->internal_mac_transmit_err += mib_read(mp, 0x0c);
        p->good_frames_received += mib_read(mp, 0x10);
@@ -1269,7 +1268,6 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
        p->frames_512_to_1023_octets += mib_read(mp, 0x30);
        p->frames_1024_to_max_octets += mib_read(mp, 0x34);
        p->good_octets_sent += mib_read(mp, 0x38);
-        p->good_octets_sent += (u64)mib_read(mp, 0x3c) << 32;
        p->good_frames_sent += mib_read(mp, 0x40);
        p->excessive_collision += mib_read(mp, 0x44);
        p->multicast_frames_sent += mib_read(mp, 0x48);
@@ -2167,8 +2165,10 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
        mp = container_of(napi, struct mv643xx_eth_private, napi);
-        mp->work_rx_refill |= mp->work_rx_oom;
+        if (unlikely(mp->oom)) {
-        mp->work_rx_oom = 0;
+                mp->oom = 0;
+                del_timer(&mp->rx_oom);
+        }
        work_done = 0;
        while (work_done < budget) {
@@ -2182,8 +2182,10 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
                        continue;
                }
-                queue_mask = mp->work_tx | mp->work_tx_end |
+                queue_mask = mp->work_tx | mp->work_tx_end | mp->work_rx;
-                                mp->work_rx | mp->work_rx_refill;
+                if (likely(!mp->oom))
+                        queue_mask |= mp->work_rx_refill;
                if (!queue_mask) {
                        if (mv643xx_eth_collect_events(mp))
                                continue;
@@ -2204,7 +2206,7 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
                        txq_maybe_wake(mp->txq + queue);
                } else if (mp->work_rx & queue_mask) {
                        work_done += rxq_process(mp->rxq + queue, work_tbd);
-                } else if (mp->work_rx_refill & queue_mask) {
+                } else if (!mp->oom && (mp->work_rx_refill & queue_mask)) {
                        work_done += rxq_refill(mp->rxq + queue, work_tbd);
                } else {
                        BUG();
@@ -2212,7 +2214,7 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
        }
        if (work_done < budget) {
-                if (mp->work_rx_oom)
+                if (mp->oom)
                        mod_timer(&mp->rx_oom, jiffies + (HZ / 10));
                napi_complete(napi);
                wrlp(mp, INT_MASK, INT_TX_END | INT_RX | INT_EXT);
@@ -2372,7 +2374,7 @@ static int mv643xx_eth_open(struct net_device *dev)
                rxq_refill(mp->rxq + i, INT_MAX);
        }
-        if (mp->work_rx_oom) {
+        if (mp->oom) {
                mp->rx_oom.expires = jiffies + (HZ / 10);
                add_timer(&mp->rx_oom);
        }
diff --git a/drivers/net/ne2k-pci.c b/drivers/net/ne2k-pci.c
index eb66f658f9d1..7d83896b8c26 100644
--- a/drivers/net/ne2k-pci.c
+++ b/drivers/net/ne2k-pci.c
@@ -374,18 +374,17 @@ static int __devinit ne2k_pci_init_one (struct pci_dev *pdev,
        dev->ethtool_ops = &ne2k_pci_ethtool_ops;
        NS8390_init(dev, 0);
+        memcpy(dev->dev_addr, SA_prom, 6);
+        memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
        i = register_netdev(dev);
        if (i)
                goto err_out_free_netdev;
-        for(i = 0; i < 6; i++)
-                dev->dev_addr[i] = SA_prom[i];
        printk("%s: %s found at %#lx, IRQ %d, %pM.\n",
               dev->name, pci_clone_list[chip_idx].name, ioaddr, dev->irq,
               dev->dev_addr);
-        memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
        return 0;
 err_out_free_netdev:
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index eceadf787a67..bf4af5248cb7 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -664,7 +664,7 @@ static int netconsole_netdev_event(struct notifier_block *this,
        struct netconsole_target *nt;
        struct net_device *dev = ptr;
-        if (!(event == NETDEV_CHANGENAME))
+        if (!(event == NETDEV_CHANGENAME || event == NETDEV_UNREGISTER))
                goto done;
        spin_lock_irqsave(&target_list_lock, flags);
@@ -675,6 +675,15 @@ static int netconsole_netdev_event(struct notifier_block *this,
                        case NETDEV_CHANGENAME:
                                strlcpy(nt->np.dev_name, dev->name, IFNAMSIZ);
                                break;
+                        case NETDEV_UNREGISTER:
+                                if (!nt->enabled)
+                                        break;
+                                netpoll_cleanup(&nt->np);
+                                nt->enabled = 0;
+                                printk(KERN_INFO "netconsole: network logging stopped"
+                                        ", interface %s unregistered\n",
+                                        dev->name);
+                                break;
                        }
                }
                netconsole_target_put(nt);
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 8ee21030e9ac..dfc6cf765fbd 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -180,6 +180,20 @@ config USB_NET_CDCETHER
          IEEE 802 "local assignment" bit is set in the address, a "usbX"
          name is used instead.
+config USB_NET_CDC_EEM
+        tristate "CDC EEM support"
+        depends on USB_USBNET && EXPERIMENTAL
+        help
+          This option supports devices conforming to the Communication Device
+          Class (CDC) Ethernet Emulation Model, a specification that's easy to
+          implement in device firmware.  The CDC EEM specifications are available
+          from <http://www.usb.org/>.
+          This driver creates an interface named "ethX", where X depends on
+          what other networking devices you have in use.  However, if the
+          IEEE 802 "local assignment" bit is set in the address, a "usbX"
+          name is used instead.
 config USB_NET_DM9601
        tristate "Davicom DM9601 based USB 1.1 10/100 ethernet devices"
        depends on USB_USBNET
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 88a87eeb376a..c8aef62cf2b7 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_USB_RTL8150)	+= rtl8150.o
 obj-$(CONFIG_USB_HSO)           += hso.o
 obj-$(CONFIG_USB_NET_AX8817X)   += asix.o
 obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o
+obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
 obj-$(CONFIG_USB_NET_SMSC95XX)  += smsc95xx.o
 obj-$(CONFIG_USB_NET_GL620A)    += gl620a.o
diff --git a/drivers/net/usb/cdc_eem.c b/drivers/net/usb/cdc_eem.c
new file mode 100644
index 000000000000..80e01778dd3b
--- /dev/null
+++ b/drivers/net/usb/cdc_eem.c
@@ -0,0 +1,381 @@
+/*
+ * USB CDC EEM network interface driver
+ * Copyright (C) 2009 Oberthur Technologies
+ * by Omar Laazimani, Olivier Condemine
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ctype.h>
+#include <linux/ethtool.h>
+#include <linux/workqueue.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/cdc.h>
+#include <linux/usb/usbnet.h>
+/*
+ * This driver is an implementation of the CDC "Ethernet Emulation
+ * Model" (EEM) specification, which encapsulates Ethernet frames
+ * for transport over USB using a simpler USB device model than the
+ * previous CDC "Ethernet Control Model" (ECM, or "CDC Ethernet").
+ *
+ * For details, see www.usb.org/developers/devclass_docs/CDC_EEM10.pdf
+ *
+ * This version has been tested with GIGAntIC WuaoW SIM Smart Card on 2.6.24,
+ * 2.6.27 and 2.6.30rc2 kernel.
+ * It has also been validated on Openmoko Om 2008.12 (based on 2.6.24 kernel).
+ * build on 23-April-2009
+ */
+#define EEM_HEAD        2               /* 2 byte header */
+/*-------------------------------------------------------------------------*/
+static void eem_linkcmd_complete(struct urb *urb)
+{
+        dev_kfree_skb(urb->context);
+        usb_free_urb(urb);
+}
+static void eem_linkcmd(struct usbnet *dev, struct sk_buff *skb)
+{
+        struct urb              *urb;
+        int                     status;
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!urb)
+                goto fail;
+        usb_fill_bulk_urb(urb, dev->udev, dev->out,
+                        skb->data, skb->len, eem_linkcmd_complete, skb);
+        status = usb_submit_urb(urb, GFP_ATOMIC);
+        if (status) {
+                usb_free_urb(urb);
+fail:
+                dev_kfree_skb(skb);
+                devwarn(dev, "link cmd failure\n");
+                return;
+        }
+}
+static int eem_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int status = 0;
+        status = usbnet_get_endpoints(dev, intf);
+        if (status < 0) {
+                usb_set_intfdata(intf, NULL);
+                usb_driver_release_interface(driver_of(intf), intf);
+                return status;
+        }
+        /* no jumbogram (16K) support for now */
+        dev->net->hard_header_len += EEM_HEAD + ETH_FCS_LEN;
+        return 0;
+}
+/*
+ * EEM permits packing multiple Ethernet frames into USB transfers
+ * (a "bundle"), but for TX we don't try to do that.
+ */
+static struct sk_buff *eem_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                                       gfp_t flags)
+{
+        struct sk_buff  *skb2 = NULL;
+        u16             len = skb->len;
+        u32             crc = 0;
+        int             padlen = 0;
+        /* When ((len + EEM_HEAD + ETH_FCS_LEN) % dev->maxpacket) is
+         * zero, stick two bytes of zero length EEM packet on the end.
+         * Else the framework would add invalid single byte padding,
+         * since it can't know whether ZLPs will be handled right by
+         * all the relevant hardware and software.
+         */
+        if (!((len + EEM_HEAD + ETH_FCS_LEN) % dev->maxpacket))
+                padlen += 2;
+        if (!skb_cloned(skb)) {
+                int     headroom = skb_headroom(skb);
+                int     tailroom = skb_tailroom(skb);
+                if ((tailroom >= ETH_FCS_LEN + padlen)
+                                && (headroom >= EEM_HEAD))
+                        goto done;
+                if ((headroom + tailroom)
+                                > (EEM_HEAD + ETH_FCS_LEN + padlen)) {
+                        skb->data = memmove(skb->head +
+                                        EEM_HEAD,
+                                        skb->data,
+                                        skb->len);
+                        skb_set_tail_pointer(skb, len);
+                        goto done;
+                }
+        }
+        skb2 = skb_copy_expand(skb, EEM_HEAD, ETH_FCS_LEN + padlen, flags);
+        if (!skb2)
+                return NULL;
+        dev_kfree_skb_any(skb);
+        skb = skb2;
+done:
+        /* we don't use the "no Ethernet CRC" option */
+        crc = crc32_le(~0, skb->data, skb->len);
+        crc = ~crc;
+        put_unaligned_le32(crc, skb_put(skb, 4));
+        /* EEM packet header format:
+         * b0..13:      length of ethernet frame
+         * b14:         bmCRC (1 == valid Ethernet CRC)
+         * b15:         bmType (0 == data)
+         */
+        len = skb->len;
+        put_unaligned_le16(BIT(14) | len, skb_push(skb, 2));
+        /* Bundle a zero length EEM packet if needed */
+        if (padlen)
+                put_unaligned_le16(0, skb_put(skb, 2));
+        return skb;
+}
+static int eem_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        /*
+         * Our task here is to strip off framing, leaving skb with one
+         * data frame for the usbnet framework code to process.  But we
+         * may have received multiple EEM payloads, or command payloads.
+         * So we must process _everything_ as if it's a header, except
+         * maybe the last data payload
+         *
+         * REVISIT the framework needs updating so that when we consume
+         * all payloads (the last or only message was a command, or a
+         * zero length EEM packet) that is not accounted as an rx_error.
+         */
+        do {
+                struct sk_buff  *skb2 = NULL;
+                u16             header;
+                u16             len = 0;
+                /* incomplete EEM header? */
+                if (skb->len < EEM_HEAD)
+                        return 0;
+                /*
+                 * EEM packet header format:
+                 * b0..14:      EEM type dependant (Data or Command)
+                 * b15:         bmType
+                 */
+                header = get_unaligned_le16(skb->data);
+                skb_pull(skb, EEM_HEAD);
+                /*
+                 * The bmType bit helps to denote when EEM
+                 * packet is data or command :
+                 *      bmType = 0      : EEM data payload
+                 *      bmType = 1      : EEM (link) command
+                 */
+                if (header & BIT(15)) {
+                        u16     bmEEMCmd;
+                        /*
+                         * EEM (link) command packet:
+                         * b0..10:      bmEEMCmdParam
+                         * b11..13:     bmEEMCmd
+                         * b14:         bmReserved (must be 0)
+                         * b15:         1 (EEM command)
+                         */
+                        if (header & BIT(14)) {
+                                devdbg(dev, "reserved command %04x\n", header);
+                                continue;
+                        }
+                        bmEEMCmd = (header >> 11) & 0x7;
+                        switch (bmEEMCmd) {
+                        /* Responding to echo requests is mandatory. */
+                        case 0:         /* Echo command */
+                                len = header & 0x7FF;
+                                /* bogus command? */
+                                if (skb->len < len)
+                                        return 0;
+                                skb2 = skb_clone(skb, GFP_ATOMIC);
+                                if (unlikely(!skb2))
+                                        goto next;
+                                skb_trim(skb2, len);
+                                put_unaligned_le16(BIT(15) | (1 << 11) | len,
+                                                skb_push(skb2, 2));
+                                eem_linkcmd(dev, skb2);
+                                break;
+                        /*
+                         * Host may choose to ignore hints.
+                         *  - suspend: peripheral ready to suspend
+                         *  - response: suggest N millisec polling
+                         *  - response complete: suggest N sec polling
+                         */
+                        case 2:         /* Suspend hint */
+                        case 3:         /* Response hint */
+                        case 4:         /* Response complete hint */
+                                continue;
+                        /*
+                         * Hosts should never receive host-to-peripheral
+                         * or reserved command codes; or responses to an
+                         * echo command we didn't send.
+                         */
+                        case 1:         /* Echo response */
+                        case 5:         /* Tickle */
+                        default:        /* reserved */
+                                devwarn(dev, "unexpected link command %d\n",
+                                                bmEEMCmd);
+                                continue;
+                        }
+                } else {
+                        u32     crc, crc2;
+                        int     is_last;
+                        /* zero length EEM packet? */
+                        if (header == 0)
+                                continue;
+                        /*
+                         * EEM data packet header :
+                         * b0..13:      length of ethernet frame
+                         * b14:         bmCRC
+                         * b15:         0 (EEM data)
+                         */
+                        len = header & 0x3FFF;
+                        /* bogus EEM payload? */
+                        if (skb->len < len)
+                                return 0;
+                        /* bogus ethernet frame? */
+                        if (len < (ETH_HLEN + ETH_FCS_LEN))
+                                goto next;
+                        /*
+                         * Treat the last payload differently: framework
+                         * code expects our "fixup" to have stripped off
+                         * headers, so "skb" is a data packet (or error).
+                         * Else if it's not the last payload, keep "skb"
+                         * for further processing.
+                         */
+                        is_last = (len == skb->len);
+                        if (is_last)
+                                skb2 = skb;
+                        else {
+                                skb2 = skb_clone(skb, GFP_ATOMIC);
+                                if (unlikely(!skb2))
+                                        return 0;
+                        }
+                        crc = get_unaligned_le32(skb2->data
+                                        + len - ETH_FCS_LEN);
+                        skb_trim(skb2, len - ETH_FCS_LEN);
+                        /*
+                         * The bmCRC helps to denote when the CRC field in
+                         * the Ethernet frame contains a calculated CRC:
+                         *      bmCRC = 1       : CRC is calculated
+                         *      bmCRC = 0       : CRC = 0xDEADBEEF
+                         */
+                        if (header & BIT(14))
+                                crc2 = ~crc32_le(~0, skb2->data, len);
+                        else
+                                crc2 = 0xdeadbeef;
+                        if (is_last)
+                                return crc == crc2;
+                        if (unlikely(crc != crc2)) {
+                                dev->stats.rx_errors++;
+                                dev_kfree_skb_any(skb2);
+                        } else
+                                usbnet_skb_return(dev, skb2);
+                }
+next:
+                skb_pull(skb, len);
+        } while (skb->len);
+        return 1;
+}
+static const struct driver_info eem_info = {
+        .description =  "CDC EEM Device",
+        .flags =        FLAG_ETHER,
+        .bind =         eem_bind,
+        .rx_fixup =     eem_rx_fixup,
+        .tx_fixup =     eem_tx_fixup,
+};
+/*-------------------------------------------------------------------------*/
+static const struct usb_device_id products[] = {
+{
+        USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_EEM,
+                        USB_CDC_PROTO_EEM),
+        .driver_info = (unsigned long) &eem_info,
+},
+{
+        /* EMPTY == end of list */
+},
+};
+MODULE_DEVICE_TABLE(usb, products);
+static struct usb_driver eem_driver = {
+        .name =         "cdc_eem",
+        .id_table =     products,
+        .probe =        usbnet_probe,
+        .disconnect =   usbnet_disconnect,
+        .suspend =      usbnet_suspend,
+        .resume =       usbnet_resume,
+};
+static int __init eem_init(void)
+{
+        return usb_register(&eem_driver);
+}
+module_init(eem_init);
+static void __exit eem_exit(void)
+{
+        usb_deregister(&eem_driver);
+}
+module_exit(eem_exit);
+MODULE_AUTHOR("Omar Laazimani <omar.oberthur@gmail.com>");
+MODULE_DESCRIPTION("USB CDC EEM");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index dc1665326592..5a7283372b53 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -941,6 +941,16 @@ static int smsc95xx_reset(struct usbnet *dev)
        if (netif_msg_ifup(dev))
                devdbg(dev, "ID_REV = 0x%08x", read_buf);
+        /* Configure GPIO pins as LED outputs */
+        write_buf = LED_GPIO_CFG_SPD_LED | LED_GPIO_CFG_LNK_LED |
+                LED_GPIO_CFG_FDX_LED;
+        ret = smsc95xx_write_reg(dev, LED_GPIO_CFG, write_buf);
+        if (ret < 0) {
+                devwarn(dev, "Failed to write LED_GPIO_CFG register, ret=%d",
+                        ret);
+                return ret;
+        }
        /* Init Tx */
        write_buf = 0;
        ret = smsc95xx_write_reg(dev, FLOW, write_buf);
@@ -1231,6 +1241,11 @@ static const struct usb_device_id products[] = {
                USB_DEVICE(0x0424, 0x9500),
                .driver_info = (unsigned long) &smsc95xx_info,
        },
+        {
+                /* SMSC9512/9514 USB Hub & Ethernet Device */
+                USB_DEVICE(0x0424, 0xec00),
+                .driver_info = (unsigned long) &smsc95xx_info,
+        },
        { },            /* END */
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/usb/smsc95xx.h b/drivers/net/usb/smsc95xx.h
index 66b5c84f302e..86bc44977fbd 100644
--- a/drivers/net/usb/smsc95xx.h
+++ b/drivers/net/usb/smsc95xx.h
@@ -99,6 +99,9 @@
 #define PM_CTL_WUPS_MULTI_              (0x00000003)
 #define LED_GPIO_CFG                    (0x24)
+#define LED_GPIO_CFG_SPD_LED            (0x01000000)
+#define LED_GPIO_CFG_LNK_LED            (0x00100000)
+#define LED_GPIO_CFG_FDX_LED            (0x00010000)
 #define GPIO_CFG                        (0x28)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 9c82a39497e5..4d1d47953fc6 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -616,10 +616,11 @@ static int virtnet_open(struct net_device *dev)
 static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
                                 struct scatterlist *data, int out, int in)
 {
-        struct scatterlist sg[VIRTNET_SEND_COMMAND_SG_MAX + 2];
+        struct scatterlist *s, sg[VIRTNET_SEND_COMMAND_SG_MAX + 2];
        struct virtio_net_ctrl_hdr ctrl;
        virtio_net_ctrl_ack status = ~0;
        unsigned int tmp;
+        int i;
        if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ)) {
                BUG();  /* Caller should know better */
@@ -637,7 +638,8 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
        sg_init_table(sg, out + in);
        sg_set_buf(&sg[0], &ctrl, sizeof(ctrl));
-        memcpy(&sg[1], data, sizeof(struct scatterlist) * (out + in - 2));
+        for_each_sg(data, s, out + in - 2, i)
+                sg_set_buf(&sg[i + 1], sg_virt(s), s->length);
        sg_set_buf(&sg[out + in - 1], &status, sizeof(status));
        if (vi->cvq->vq_ops->add_buf(vi->cvq, sg, out, in, vi) != 0)
@@ -692,7 +694,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
        promisc = ((dev->flags & IFF_PROMISC) != 0);
        allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
-        sg_set_buf(sg, &promisc, sizeof(promisc));
+        sg_init_one(sg, &promisc, sizeof(promisc));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                  VIRTIO_NET_CTRL_RX_PROMISC,
@@ -700,7 +702,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
                dev_warn(&dev->dev, "Failed to %sable promisc mode.\n",
                         promisc ? "en" : "dis");
-        sg_set_buf(sg, &allmulti, sizeof(allmulti));
+        sg_init_one(sg, &allmulti, sizeof(allmulti));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                  VIRTIO_NET_CTRL_RX_ALLMULTI,
@@ -716,6 +718,8 @@ static void virtnet_set_rx_mode(struct net_device *dev)
                return;
        }
+        sg_init_table(sg, 2);
        /* Store the unicast list and count in the front of the buffer */
        mac_data->entries = dev->uc_count;
        addr = dev->uc_list;
@@ -744,24 +748,24 @@ static void virtnet_set_rx_mode(struct net_device *dev)
        kfree(buf);
 }
-static void virnet_vlan_rx_add_vid(struct net_device *dev, u16 vid)
+static void virtnet_vlan_rx_add_vid(struct net_device *dev, u16 vid)
 {
        struct virtnet_info *vi = netdev_priv(dev);
        struct scatterlist sg;
-        sg_set_buf(&sg, &vid, sizeof(vid));
+        sg_init_one(&sg, &vid, sizeof(vid));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
                                  VIRTIO_NET_CTRL_VLAN_ADD, &sg, 1, 0))
                dev_warn(&dev->dev, "Failed to add VLAN ID %d.\n", vid);
 }
-static void virnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
+static void virtnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
 {
        struct virtnet_info *vi = netdev_priv(dev);
        struct scatterlist sg;
-        sg_set_buf(&sg, &vid, sizeof(vid));
+        sg_init_one(&sg, &vid, sizeof(vid));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
                                  VIRTIO_NET_CTRL_VLAN_DEL, &sg, 1, 0))
@@ -794,8 +798,8 @@ static const struct net_device_ops virtnet_netdev = {
        .ndo_set_mac_address = virtnet_set_mac_address,
        .ndo_set_rx_mode     = virtnet_set_rx_mode,
        .ndo_change_mtu      = virtnet_change_mtu,
-        .ndo_vlan_rx_add_vid = virnet_vlan_rx_add_vid,
+        .ndo_vlan_rx_add_vid = virtnet_vlan_rx_add_vid,
-        .ndo_vlan_rx_kill_vid = virnet_vlan_rx_kill_vid,
+        .ndo_vlan_rx_kill_vid = virtnet_vlan_rx_kill_vid,
 #ifdef CONFIG_NET_POLL_CONTROLLER
        .ndo_poll_controller = virtnet_netpoll,
 #endif
diff --git a/drivers/net/wireless/ath5k/debug.c b/drivers/net/wireless/ath5k/debug.c
index 9770bb3d40f9..4904a07e4b59 100644
--- a/drivers/net/wireless/ath5k/debug.c
+++ b/drivers/net/wireless/ath5k/debug.c
@@ -424,7 +424,7 @@ ath5k_debug_dump_bands(struct ath5k_softc *sc)
        for (b = 0; b < IEEE80211_NUM_BANDS; b++) {
                struct ieee80211_supported_band *band = &sc->sbands[b];
-                char bname[5];
+                char bname[6];
                switch (band->band) {
                case IEEE80211_BAND_2GHZ:
                        strcpy(bname, "2 GHz");
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 23644cf884f1..e7c65c4f741b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -925,11 +925,11 @@ void iwl_bg_scan_completed(struct work_struct *work)
        IWL_DEBUG_SCAN(priv, "SCAN complete scan\n");
+        ieee80211_scan_completed(priv->hw, false);
        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                return;
-        ieee80211_scan_completed(priv->hw, false);
        /* Since setting the TXPOWER may have been deferred while
         * performing the scan, fire one off */
        mutex_lock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 617c4235d971..70a00c8ee42e 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -1694,7 +1694,6 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
        rxq->free_count = 0;
        spin_unlock_irqrestore(&rxq->lock, flags);
 }
-EXPORT_SYMBOL(iwl3945_rx_queue_reset);
 /*
 * this should be called while priv->lock is locked
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index db91db776508..bebf735cd4bd 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2558,6 +2558,11 @@ static int rndis_wext_bind(struct usbnet *usbdev, struct usb_interface *intf)
        mutex_init(&priv->command_lock);
        spin_lock_init(&priv->stats_lock);
+        /* because rndis_command() sleeps we need to use workqueue */
+        priv->workqueue = create_singlethread_workqueue("rndis_wlan");
+        INIT_WORK(&priv->work, rndis_wext_worker);
+        INIT_DELAYED_WORK(&priv->stats_work, rndis_update_wireless_stats);
        /* try bind rndis_host */
        retval = generic_rndis_bind(usbdev, intf, FLAG_RNDIS_PHYM_WIRELESS);
        if (retval < 0)
@@ -2603,16 +2608,17 @@ static int rndis_wext_bind(struct usbnet *usbdev, struct usb_interface *intf)
        disassociate(usbdev, 1);
        netif_carrier_off(usbdev->net);
-        /* because rndis_command() sleeps we need to use workqueue */
-        priv->workqueue = create_singlethread_workqueue("rndis_wlan");
-        INIT_DELAYED_WORK(&priv->stats_work, rndis_update_wireless_stats);
        queue_delayed_work(priv->workqueue, &priv->stats_work,
                round_jiffies_relative(STATS_UPDATE_JIFFIES));
-        INIT_WORK(&priv->work, rndis_wext_worker);
        return 0;
 fail:
+        cancel_delayed_work_sync(&priv->stats_work);
+        cancel_work_sync(&priv->work);
+        flush_workqueue(priv->workqueue);
+        destroy_workqueue(priv->workqueue);
        kfree(priv);
        return retval;
 }
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 5a97bcfe03e5..ec7e27d00bc6 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -517,10 +517,10 @@ static int nfs_vm_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
        ret = nfs_updatepage(filp, page, 0, pagelen);
 out_unlock:
+        if (!ret)
+                return VM_FAULT_LOCKED;
        unlock_page(page);
-        if (ret)
+        return VM_FAULT_SIGBUS;
-                ret = VM_FAULT_SIGBUS;
-        return ret;
 }
 static struct vm_operations_struct nfs_file_vm_ops = {
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 7e4877d9dcb5..725a650bbbb8 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -80,6 +80,7 @@
 #include <linux/delayacct.h>
 #include <linux/seq_file.h>
 #include <linux/pid_namespace.h>
+#include <linux/ptrace.h>
 #include <linux/tracehook.h>
 #include <asm/pgtable.h>
@@ -352,6 +353,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
        char state;
        pid_t ppid = 0, pgid = -1, sid = -1;
        int num_threads = 0;
+        int permitted;
        struct mm_struct *mm;
        unsigned long long start_time;
        unsigned long cmin_flt = 0, cmaj_flt = 0;
@@ -364,11 +366,14 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
        state = *get_task_state(task);
        vsize = eip = esp = 0;
+        permitted = ptrace_may_access(task, PTRACE_MODE_READ);
        mm = get_task_mm(task);
        if (mm) {
                vsize = task_vsize(mm);
-                eip = KSTK_EIP(task);
+                if (permitted) {
-                esp = KSTK_ESP(task);
+                        eip = KSTK_EIP(task);
+                        esp = KSTK_ESP(task);
+                }
        }
        get_task_comm(tcomm, task);
@@ -424,7 +429,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                unlock_task_sighand(task, &flags);
        }
-        if (!whole || num_threads < 2)
+        if (permitted && (!whole || num_threads < 2))
                wchan = get_wchan(task);
        if (!whole) {
                min_flt = task->min_flt;
@@ -476,7 +481,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                rsslim,
                mm ? mm->start_code : 0,
                mm ? mm->end_code : 0,
-                mm ? mm->start_stack : 0,
+                (permitted && mm) ? mm->start_stack : 0,
                esp,
                eip,
                /* The signal information here is obsolete.
diff --git a/fs/proc/base.c b/fs/proc/base.c
index aa763ab00777..fb45615943c2 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -322,7 +322,10 @@ static int proc_pid_wchan(struct task_struct *task, char *buffer)
        wchan = get_wchan(task);
        if (lookup_symbol_name(wchan, symname) < 0)
-                return sprintf(buffer, "%lu", wchan);
+                if (!ptrace_may_access(task, PTRACE_MODE_READ))
+                        return 0;
+                else
+                        return sprintf(buffer, "%lu", wchan);
        else
                return sprintf(buffer, "%s", symname);
 }
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 1b2e43502ef7..c9efe039dc57 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -472,7 +472,7 @@ static inline void xt_info_rdlock_bh(void)
        local_bh_disable();
        lock = &__get_cpu_var(xt_info_locks);
-        if (!lock->readers++)
+        if (likely(!lock->readers++))
                spin_lock(&lock->lock);
 }
@@ -480,7 +480,7 @@ static inline void xt_info_rdunlock_bh(void)
 {
        struct xt_info_lock *lock = &__get_cpu_var(xt_info_locks);
-        if (!--lock->readers)
+        if (likely(!--lock->readers))
                spin_unlock(&lock->lock);
        local_bh_enable();
 }
diff --git a/include/linux/usb/cdc.h b/include/linux/usb/cdc.h
index 3c86ed25a04c..c24124a42ce5 100644
--- a/include/linux/usb/cdc.h
+++ b/include/linux/usb/cdc.h
@@ -17,6 +17,7 @@
 #define USB_CDC_SUBCLASS_DMM                    0x09
 #define USB_CDC_SUBCLASS_MDLM                   0x0a
 #define USB_CDC_SUBCLASS_OBEX                   0x0b
+#define USB_CDC_SUBCLASS_EEM                    0x0c
 #define USB_CDC_PROTO_NONE                      0
@@ -28,6 +29,8 @@
 #define USB_CDC_ACM_PROTO_AT_CDMA               6
 #define USB_CDC_ACM_PROTO_VENDOR                0xff
+#define USB_CDC_PROTO_EEM                       7
 /*-------------------------------------------------------------------------*/
 /*
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index 242348bb3766..cec79adbe3ea 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -4,6 +4,7 @@
 * compatible drivers/servers. */
 #include <linux/types.h>
 #include <linux/virtio_config.h>
+#include <linux/if_ether.h>
 /* The ID for virtio_net */
 #define VIRTIO_ID_NET   1
diff --git a/include/net/9p/client.h b/include/net/9p/client.h
index 4012e07162e5..e26812274b75 100644
--- a/include/net/9p/client.h
+++ b/include/net/9p/client.h
@@ -98,7 +98,6 @@ enum p9_req_status_t {
 struct p9_req_t {
        int status;
        int t_err;
-        u16 flush_tag;
        wait_queue_head_t *wq;
        struct p9_fcall *tc;
        struct p9_fcall *rc;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index be5bd713d2c9..73aead222b32 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -457,6 +457,7 @@ int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count);
 int hci_register_sysfs(struct hci_dev *hdev);
 void hci_unregister_sysfs(struct hci_dev *hdev);
+void hci_conn_init_sysfs(struct hci_conn *conn);
 void hci_conn_add_sysfs(struct hci_conn *conn);
 void hci_conn_del_sysfs(struct hci_conn *conn);
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 1b94b9bfe2dc..646dbe3962ea 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -41,6 +41,7 @@
 #include <net/ip.h>
 #include <net/tcp_states.h>
 #include <net/inet_ecn.h>
+#include <net/dst.h>
 #include <linux/seq_file.h>
@@ -530,6 +531,17 @@ static inline void tcp_fast_path_check(struct sock *sk)
                tcp_fast_path_on(tp);
 }
+/* Compute the actual rto_min value */
+static inline u32 tcp_rto_min(struct sock *sk)
+{
+        struct dst_entry *dst = __sk_dst_get(sk);
+        u32 rto_min = TCP_RTO_MIN;
+        if (dst && dst_metric_locked(dst, RTAX_RTO_MIN))
+                rto_min = dst_metric_rtt(dst, RTAX_RTO_MIN);
+        return rto_min;
+}
 /* Compute the actual receive window we are currently advertising.
 * Rcv_nxt can be after the window if our peer push more data
 * than the offered window.
@@ -895,7 +907,7 @@ static inline int tcp_prequeue(struct sock *sk, struct sk_buff *skb)
                        wake_up_interruptible(sk->sk_sleep);
                        if (!inet_csk_ack_scheduled(sk))
                                inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
-                                                          (3 * TCP_RTO_MIN) / 4,
+                                                          (3 * tcp_rto_min(sk)) / 4,
                                                          TCP_RTO_MAX);
                }
                return 1;
diff --git a/net/9p/client.c b/net/9p/client.c
index 1eb580c38fbb..dd43a8289b0d 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -203,7 +203,6 @@ static struct p9_req_t *p9_tag_alloc(struct p9_client *c, u16 tag)
        p9pdu_reset(req->tc);
        p9pdu_reset(req->rc);
-        req->flush_tag = 0;
        req->tc->tag = tag-1;
        req->status = REQ_STATUS_ALLOC;
@@ -324,35 +323,9 @@ static void p9_free_req(struct p9_client *c, struct p9_req_t *r)
 */
 void p9_client_cb(struct p9_client *c, struct p9_req_t *req)
 {
-        struct p9_req_t *other_req;
-        unsigned long flags;
        P9_DPRINTK(P9_DEBUG_MUX, " tag %d\n", req->tc->tag);
+        wake_up(req->wq);
-        if (req->status == REQ_STATUS_ERROR)
+        P9_DPRINTK(P9_DEBUG_MUX, "wakeup: %d\n", req->tc->tag);
-                wake_up(req->wq);
-        if (req->flush_tag) {                   /* flush receive path */
-                P9_DPRINTK(P9_DEBUG_9P, "<<< RFLUSH %d\n", req->tc->tag);
-                spin_lock_irqsave(&c->lock, flags);
-                other_req = p9_tag_lookup(c, req->flush_tag);
-                if (other_req->status != REQ_STATUS_FLSH) /* stale flush */
-                        spin_unlock_irqrestore(&c->lock, flags);
-                else {
-                        other_req->status = REQ_STATUS_FLSHD;
-                        spin_unlock_irqrestore(&c->lock, flags);
-                        wake_up(other_req->wq);
-                }
-                p9_free_req(c, req);
-        } else {                                /* normal receive path */
-                P9_DPRINTK(P9_DEBUG_MUX, "normal: tag %d\n", req->tc->tag);
-                spin_lock_irqsave(&c->lock, flags);
-                if (req->status != REQ_STATUS_FLSHD)
-                        req->status = REQ_STATUS_RCVD;
-                spin_unlock_irqrestore(&c->lock, flags);
-                wake_up(req->wq);
-                P9_DPRINTK(P9_DEBUG_MUX, "wakeup: %d\n", req->tc->tag);
-        }
 }
 EXPORT_SYMBOL(p9_client_cb);
@@ -486,9 +459,15 @@ static int p9_client_flush(struct p9_client *c, struct p9_req_t *oldreq)
        if (IS_ERR(req))
                return PTR_ERR(req);
-        req->flush_tag = oldtag;
-        /* we don't free anything here because RPC isn't complete */
+        /* if we haven't received a response for oldreq,
+           remove it from the list. */
+        spin_lock(&c->lock);
+        if (oldreq->status == REQ_STATUS_FLSH)
+                list_del(&oldreq->req_list);
+        spin_unlock(&c->lock);
+        p9_free_req(c, req);
        return 0;
 }
@@ -509,7 +488,6 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...)
        struct p9_req_t *req;
        unsigned long flags;
        int sigpending;
-        int flushed = 0;
        P9_DPRINTK(P9_DEBUG_MUX, "client %p op %d\n", c, type);
@@ -546,42 +524,28 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...)
                goto reterr;
        }
-        /* if it was a flush we just transmitted, return our tag */
-        if (type == P9_TFLUSH)
-                return req;
-again:
        P9_DPRINTK(P9_DEBUG_MUX, "wait %p tag: %d\n", req->wq, tag);
        err = wait_event_interruptible(*req->wq,
                                                req->status >= REQ_STATUS_RCVD);
-        P9_DPRINTK(P9_DEBUG_MUX, "wait %p tag: %d returned %d (flushed=%d)\n",
+        P9_DPRINTK(P9_DEBUG_MUX, "wait %p tag: %d returned %d\n",
-                                                req->wq, tag, err, flushed);
+                                                req->wq, tag, err);
        if (req->status == REQ_STATUS_ERROR) {
                P9_DPRINTK(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);
                err = req->t_err;
-        } else if (err == -ERESTARTSYS && flushed) {
-                P9_DPRINTK(P9_DEBUG_MUX, "flushed - going again\n");
-                goto again;
-        } else if (req->status == REQ_STATUS_FLSHD) {
-                P9_DPRINTK(P9_DEBUG_MUX, "flushed - erestartsys\n");
-                err = -ERESTARTSYS;
        }
-        if ((err == -ERESTARTSYS) && (c->status == Connected) && (!flushed)) {
+        if ((err == -ERESTARTSYS) && (c->status == Connected)) {
                P9_DPRINTK(P9_DEBUG_MUX, "flushing\n");
-                spin_lock_irqsave(&c->lock, flags);
-                if (req->status == REQ_STATUS_SENT)
-                        req->status = REQ_STATUS_FLSH;
-                spin_unlock_irqrestore(&c->lock, flags);
                sigpending = 1;
-                flushed = 1;
                clear_thread_flag(TIF_SIGPENDING);
-                if (c->trans_mod->cancel(c, req)) {
+                if (c->trans_mod->cancel(c, req))
-                        err = p9_client_flush(c, req);
+                        p9_client_flush(c, req);
-                        if (err == 0)
-                                goto again;
+                /* if we received the response anyway, don't signal error */
-                }
+                if (req->status == REQ_STATUS_RCVD)
+                        err = 0;
        }
        if (sigpending) {
@@ -1244,19 +1208,53 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
                ret->name, ret->uid, ret->gid, ret->muid, ret->extension,
                ret->n_uid, ret->n_gid, ret->n_muid);
+        p9_free_req(clnt, req);
+        return ret;
 free_and_error:
        p9_free_req(clnt, req);
 error:
-        return ret;
+        kfree(ret);
+        return ERR_PTR(err);
 }
 EXPORT_SYMBOL(p9_client_stat);
+static int p9_client_statsize(struct p9_wstat *wst, int optional)
+{
+        int ret;
+        /* size[2] type[2] dev[4] qid[13] */
+        /* mode[4] atime[4] mtime[4] length[8]*/
+        /* name[s] uid[s] gid[s] muid[s] */
+        ret = 2+2+4+13+4+4+4+8+2+2+2+2;
+        if (wst->name)
+                ret += strlen(wst->name);
+        if (wst->uid)
+                ret += strlen(wst->uid);
+        if (wst->gid)
+                ret += strlen(wst->gid);
+        if (wst->muid)
+                ret += strlen(wst->muid);
+        if (optional) {
+                ret += 2+4+4+4; /* extension[s] n_uid[4] n_gid[4] n_muid[4] */
+                if (wst->extension)
+                        ret += strlen(wst->extension);
+        }
+        return ret;
+}
 int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
 {
        int err;
        struct p9_req_t *req;
        struct p9_client *clnt;
+        err = 0;
+        clnt = fid->clnt;
+        wst->size = p9_client_statsize(wst, clnt->dotu);
        P9_DPRINTK(P9_DEBUG_9P, ">>> TWSTAT fid %d\n", fid->fid);
        P9_DPRINTK(P9_DEBUG_9P,
                "     sz=%x type=%x dev=%x qid=%x.%llx.%x\n"
@@ -1268,10 +1266,8 @@ int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
                wst->atime, wst->mtime, (unsigned long long)wst->length,
                wst->name, wst->uid, wst->gid, wst->muid, wst->extension,
                wst->n_uid, wst->n_gid, wst->n_muid);
-        err = 0;
-        clnt = fid->clnt;
-        req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, 0, wst);
+        req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, wst->size, wst);
        if (IS_ERR(req)) {
                err = PTR_ERR(req);
                goto error;
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index c613ed08a5ee..a2a1814c7a8d 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -213,8 +213,8 @@ static void p9_conn_cancel(struct p9_conn *m, int err)
        spin_unlock_irqrestore(&m->client->lock, flags);
        list_for_each_entry_safe(req, rtmp, &cancel_list, req_list) {
-                list_del(&req->req_list);
                P9_DPRINTK(P9_DEBUG_ERROR, "call back req %p\n", req);
+                list_del(&req->req_list);
                p9_client_cb(m->client, req);
        }
 }
@@ -336,7 +336,8 @@ static void p9_read_work(struct work_struct *work)
                        "mux %p pkt: size: %d bytes tag: %d\n", m, n, tag);
                m->req = p9_tag_lookup(m->client, tag);
-                if (!m->req) {
+                if (!m->req || (m->req->status != REQ_STATUS_SENT &&
+                                        m->req->status != REQ_STATUS_FLSH)) {
                        P9_DPRINTK(P9_DEBUG_ERROR, "Unexpected packet tag %d\n",
                                                                 tag);
                        err = -EIO;
@@ -361,10 +362,11 @@ static void p9_read_work(struct work_struct *work)
        if ((m->req) && (m->rpos == m->rsize)) { /* packet is read in */
                P9_DPRINTK(P9_DEBUG_TRANS, "got new packet\n");
                spin_lock(&m->client->lock);
+                if (m->req->status != REQ_STATUS_ERROR)
+                        m->req->status = REQ_STATUS_RCVD;
                list_del(&m->req->req_list);
                spin_unlock(&m->client->lock);
                p9_client_cb(m->client, m->req);
                m->rbuf = NULL;
                m->rpos = 0;
                m->rsize = 0;
@@ -454,6 +456,7 @@ static void p9_write_work(struct work_struct *work)
                req = list_entry(m->unsent_req_list.next, struct p9_req_t,
                               req_list);
                req->status = REQ_STATUS_SENT;
+                P9_DPRINTK(P9_DEBUG_TRANS, "move req %p\n", req);
                list_move_tail(&req->req_list, &m->req_list);
                m->wbuf = req->tc->sdata;
@@ -683,12 +686,13 @@ static int p9_fd_cancel(struct p9_client *client, struct p9_req_t *req)
        P9_DPRINTK(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
        spin_lock(&client->lock);
-        list_del(&req->req_list);
        if (req->status == REQ_STATUS_UNSENT) {
+                list_del(&req->req_list);
                req->status = REQ_STATUS_FLSHD;
                ret = 0;
-        }
+        } else if (req->status == REQ_STATUS_SENT)
+                req->status = REQ_STATUS_FLSH;
        spin_unlock(&client->lock);
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 7fa0eb20b2f6..ac4990041ebb 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -295,6 +295,7 @@ handle_recv(struct p9_client *client, struct p9_trans_rdma *rdma,
                goto err_out;
        req->rc = c->rc;
+        req->status = REQ_STATUS_RCVD;
        p9_client_cb(client, req);
        return;
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 2d7781ec663b..bb8579a141a8 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -134,6 +134,7 @@ static void req_done(struct virtqueue *vq)
                P9_DPRINTK(P9_DEBUG_TRANS, ": rc %p\n", rc);
                P9_DPRINTK(P9_DEBUG_TRANS, ": lookup tag %d\n", rc->tag);
                req = p9_tag_lookup(chan->client, rc->tag);
+                req->status = REQ_STATUS_RCVD;
                p9_client_cb(chan->client, req);
        }
 }
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 334fcd4a4ea4..3100a8940afc 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -549,6 +549,7 @@ static void br2684_setup(struct net_device *netdev)
        struct br2684_dev *brdev = BRPRIV(netdev);
        ether_setup(netdev);
+        brdev->net_dev = netdev;
        netdev->netdev_ops = &br2684_netdev_ops;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 375f4b4f7f79..61309b26f271 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -248,6 +248,8 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
        if (hdev->notify)
                hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
+        hci_conn_init_sysfs(conn);
        tasklet_enable(&hdev->tx_task);
        return conn;
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index b7c51082ddeb..582d8877078c 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -9,7 +9,7 @@
 struct class *bt_class = NULL;
 EXPORT_SYMBOL_GPL(bt_class);
-static struct workqueue_struct *bluetooth;
+static struct workqueue_struct *bt_workq;
 static inline char *link_typetostr(int type)
 {
@@ -89,8 +89,8 @@ static void add_conn(struct work_struct *work)
 {
        struct hci_conn *conn = container_of(work, struct hci_conn, work_add);
-        /* ensure previous add/del is complete */
+        /* ensure previous del is complete */
-        flush_workqueue(bluetooth);
+        flush_work(&conn->work_del);
        if (device_add(&conn->dev) < 0) {
                BT_ERR("Failed to register connection device");
@@ -98,27 +98,6 @@ static void add_conn(struct work_struct *work)
        }
 }
-void hci_conn_add_sysfs(struct hci_conn *conn)
-{
-        struct hci_dev *hdev = conn->hdev;
-        BT_DBG("conn %p", conn);
-        conn->dev.type = &bt_link;
-        conn->dev.class = bt_class;
-        conn->dev.parent = &hdev->dev;
-        dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
-        dev_set_drvdata(&conn->dev, conn);
-        device_initialize(&conn->dev);
-        INIT_WORK(&conn->work_add, add_conn);
-        queue_work(bluetooth, &conn->work_add);
-}
 /*
 * The rfcomm tty device will possibly retain even when conn
 * is down, and sysfs doesn't support move zombie device,
@@ -134,8 +113,11 @@ static void del_conn(struct work_struct *work)
        struct hci_conn *conn = container_of(work, struct hci_conn, work_del);
        struct hci_dev *hdev = conn->hdev;
-        /* ensure previous add/del is complete */
+        /* ensure previous add is complete */
-        flush_workqueue(bluetooth);
+        flush_work(&conn->work_add);
+        if (!device_is_registered(&conn->dev))
+                return;
        while (1) {
                struct device *dev;
@@ -152,16 +134,40 @@ static void del_conn(struct work_struct *work)
        hci_dev_put(hdev);
 }
-void hci_conn_del_sysfs(struct hci_conn *conn)
+void hci_conn_init_sysfs(struct hci_conn *conn)
 {
+        struct hci_dev *hdev = conn->hdev;
        BT_DBG("conn %p", conn);
-        if (!device_is_registered(&conn->dev))
+        conn->dev.type = &bt_link;
-                return;
+        conn->dev.class = bt_class;
+        conn->dev.parent = &hdev->dev;
+        dev_set_drvdata(&conn->dev, conn);
+        device_initialize(&conn->dev);
+        INIT_WORK(&conn->work_add, add_conn);
        INIT_WORK(&conn->work_del, del_conn);
+}
+void hci_conn_add_sysfs(struct hci_conn *conn)
+{
+        struct hci_dev *hdev = conn->hdev;
+        BT_DBG("conn %p", conn);
+        dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
+        queue_work(bt_workq, &conn->work_add);
+}
+void hci_conn_del_sysfs(struct hci_conn *conn)
+{
+        BT_DBG("conn %p", conn);
-        queue_work(bluetooth, &conn->work_del);
+        queue_work(bt_workq, &conn->work_del);
 }
 static inline char *host_typetostr(int type)
@@ -438,13 +444,13 @@ void hci_unregister_sysfs(struct hci_dev *hdev)
 int __init bt_sysfs_init(void)
 {
-        bluetooth = create_singlethread_workqueue("bluetooth");
+        bt_workq = create_singlethread_workqueue("bluetooth");
-        if (!bluetooth)
+        if (!bt_workq)
                return -ENOMEM;
        bt_class = class_create(THIS_MODULE, "bluetooth");
        if (IS_ERR(bt_class)) {
-                destroy_workqueue(bluetooth);
+                destroy_workqueue(bt_workq);
                return PTR_ERR(bt_class);
        }
@@ -453,7 +459,7 @@ int __init bt_sysfs_init(void)
 void bt_sysfs_cleanup(void)
 {
-        destroy_workqueue(bluetooth);
+        destroy_workqueue(bt_workq);
        class_destroy(bt_class);
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 308a7d0c277f..e2e9e4af3ace 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1735,11 +1735,12 @@ u16 skb_tx_hash(const struct net_device *dev, const struct sk_buff *skb)
 {
        u32 hash;
-        if (skb_rx_queue_recorded(skb)) {
+        if (skb_rx_queue_recorded(skb))
-                hash = skb_get_rx_queue(skb);
+                return skb_get_rx_queue(skb) % dev->real_num_tx_queues;
-        } else if (skb->sk && skb->sk->sk_hash) {
+        if (skb->sk && skb->sk->sk_hash)
                hash = skb->sk->sk_hash;
-        } else
+        else
                hash = skb->protocol;
        hash = jhash_1word(hash, skb_tx_hashrnd);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index ce6356cd9f71..f091a5a845c1 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1365,9 +1365,8 @@ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
 static inline struct page *linear_to_page(struct page *page, unsigned int *len,
                                          unsigned int *offset,
-                                          struct sk_buff *skb)
+                                          struct sk_buff *skb, struct sock *sk)
 {
-        struct sock *sk = skb->sk;
        struct page *p = sk->sk_sndmsg_page;
        unsigned int off;
@@ -1405,13 +1404,14 @@ new_page:
 */
 static inline int spd_fill_page(struct splice_pipe_desc *spd, struct page *page,
                                unsigned int *len, unsigned int offset,
-                                struct sk_buff *skb, int linear)
+                                struct sk_buff *skb, int linear,
+                                struct sock *sk)
 {
        if (unlikely(spd->nr_pages == PIPE_BUFFERS))
                return 1;
        if (linear) {
-                page = linear_to_page(page, len, &offset, skb);
+                page = linear_to_page(page, len, &offset, skb, sk);
                if (!page)
                        return 1;
        } else
@@ -1442,7 +1442,8 @@ static inline void __segment_seek(struct page **page, unsigned int *poff,
 static inline int __splice_segment(struct page *page, unsigned int poff,
                                   unsigned int plen, unsigned int *off,
                                   unsigned int *len, struct sk_buff *skb,
-                                   struct splice_pipe_desc *spd, int linear)
+                                   struct splice_pipe_desc *spd, int linear,
+                                   struct sock *sk)
 {
        if (!*len)
                return 1;
@@ -1465,7 +1466,7 @@ static inline int __splice_segment(struct page *page, unsigned int poff,
                /* the linear region may spread across several pages  */
                flen = min_t(unsigned int, flen, PAGE_SIZE - poff);
-                if (spd_fill_page(spd, page, &flen, poff, skb, linear))
+                if (spd_fill_page(spd, page, &flen, poff, skb, linear, sk))
                        return 1;
                __segment_seek(&page, &poff, &plen, flen);
@@ -1481,8 +1482,8 @@ static inline int __splice_segment(struct page *page, unsigned int poff,
 * pipe is full or if we already spliced the requested length.
 */
 static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
-                      unsigned int *len,
+                             unsigned int *len, struct splice_pipe_desc *spd,
-                      struct splice_pipe_desc *spd)
+                             struct sock *sk)
 {
        int seg;
@@ -1492,7 +1493,7 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
        if (__splice_segment(virt_to_page(skb->data),
                             (unsigned long) skb->data & (PAGE_SIZE - 1),
                             skb_headlen(skb),
-                             offset, len, skb, spd, 1))
+                             offset, len, skb, spd, 1, sk))
                return 1;
        /*
@@ -1502,7 +1503,7 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
                const skb_frag_t *f = &skb_shinfo(skb)->frags[seg];
                if (__splice_segment(f->page, f->page_offset, f->size,
-                                     offset, len, skb, spd, 0))
+                                     offset, len, skb, spd, 0, sk))
                        return 1;
        }
@@ -1528,12 +1529,13 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
                .ops = &sock_pipe_buf_ops,
                .spd_release = sock_spd_release,
        };
+        struct sock *sk = skb->sk;
        /*
         * __skb_splice_bits() only fails if the output has no room left,
         * so no point in going over the frag_list for the error case.
         */
-        if (__skb_splice_bits(skb, &offset, &tlen, &spd))
+        if (__skb_splice_bits(skb, &offset, &tlen, &spd, sk))
                goto done;
        else if (!tlen)
                goto done;
@@ -1545,14 +1547,13 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
                struct sk_buff *list = skb_shinfo(skb)->frag_list;
                for (; list && tlen; list = list->next) {
-                        if (__skb_splice_bits(list, &offset, &tlen, &spd))
+                        if (__skb_splice_bits(list, &offset, &tlen, &spd, sk))
                                break;
                }
        }
 done:
        if (spd.nr_pages) {
-                struct sock *sk = skb->sk;
                int ret;
                /*
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c96a6bb25430..eec3e6f9956c 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -597,16 +597,6 @@ static void tcp_event_data_recv(struct sock *sk, struct sk_buff *skb)
                tcp_grow_window(sk, skb);
 }
-static u32 tcp_rto_min(struct sock *sk)
-{
-        struct dst_entry *dst = __sk_dst_get(sk);
-        u32 rto_min = TCP_RTO_MIN;
-        if (dst && dst_metric_locked(dst, RTAX_RTO_MIN))
-                rto_min = dst_metric_rtt(dst, RTAX_RTO_MIN);
-        return rto_min;
-}
 /* Called to compute a smoothed rtt estimate. The data fed to this
 * routine either comes from timestamps, or from segments that were
 * known _not_ to have been retransmitted [see Karn/Partridge
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index fbcbed6cad01..14134193cd17 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -757,6 +757,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
        local->hw.conf.long_frame_max_tx_count = 4;
        local->hw.conf.short_frame_max_tx_count = 7;
        local->hw.conf.radio_enabled = true;
+        local->user_power_level = -1;
        INIT_LIST_HEAD(&local->interfaces);
        mutex_init(&local->iflist_mtx);
@@ -909,6 +910,13 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        if (result < 0)
                goto fail_sta_info;
+        result = ieee80211_wep_init(local);
+        if (result < 0) {
+                printk(KERN_DEBUG "%s: Failed to initialize wep: %d\n",
+                       wiphy_name(local->hw.wiphy), result);
+                goto fail_wep;
+        }
        rtnl_lock();
        result = dev_alloc_name(local->mdev, local->mdev->name);
        if (result < 0)
@@ -930,14 +938,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                goto fail_rate;
        }
-        result = ieee80211_wep_init(local);
-        if (result < 0) {
-                printk(KERN_DEBUG "%s: Failed to initialize wep: %d\n",
-                       wiphy_name(local->hw.wiphy), result);
-                goto fail_wep;
-        }
        /* add one default STA interface if supported */
        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_STATION)) {
                result = ieee80211_if_add(local, "wlan%d", NULL,
@@ -967,13 +967,13 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        return 0;
-fail_wep:
-        rate_control_deinitialize(local);
 fail_rate:
        unregister_netdevice(local->mdev);
        local->mdev = NULL;
 fail_dev:
        rtnl_unlock();
+        ieee80211_wep_free(local);
+fail_wep:
        sta_info_stop(local);
 fail_sta_info:
        debugfs_hw_del(local);
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 881203c4a142..cb3ad741ebf8 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -837,6 +837,7 @@ config NETFILTER_XT_MATCH_SOCKET
        depends on NETFILTER_TPROXY
        depends on NETFILTER_XTABLES
        depends on NETFILTER_ADVANCED
+        depends on !NF_CONNTRACK || NF_CONNTRACK
        select NF_DEFRAG_IPV4
        help
          This option adds a `socket' match, which can be used to match
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 173fcc4b050d..0759f32e9dca 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -254,7 +254,7 @@ replay:
                }
                tp->ops = tp_ops;
                tp->protocol = protocol;
-                tp->prio = nprio ? : tcf_auto_prio(*back);
+                tp->prio = nprio ? : TC_H_MAJ(tcf_auto_prio(*back));
                tp->q = q;
                tp->classify = tp_ops->classify;
                tp->classid = parent;
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index ba808ef6babb..2fcad7c33eaf 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3153,7 +3153,7 @@ static int selinux_file_send_sigiotask(struct task_struct *tsk,
                                       struct fown_struct *fown, int signum)
 {
        struct file *file;
-        u32 sid = current_sid();
+        u32 sid = task_sid(tsk);
        u32 perm;
        struct file_security_struct *fsec;
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 63d088f2265f..a2a792c18c40 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -249,6 +249,12 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
                        new_hw_ptr = hw_base + pos;
                }
        }
+        /* Skip the jiffies check for hardwares with BATCH flag.
+         * Such hardware usually just increases the position at each IRQ,
+         * thus it can't give any strange position.
+         */
+        if (runtime->hw.info & SNDRV_PCM_INFO_BATCH)
+                goto no_jiffies_check;
        hdelta = new_hw_ptr - old_hw_ptr;
        jdelta = jiffies - runtime->hw_ptr_jiffies;
        if (((hdelta * HZ) / runtime->rate) > jdelta + HZ/100) {
@@ -272,6 +278,7 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
                hw_base -= hw_base % runtime->buffer_size;
                delta = 0;
        }
+ no_jiffies_check:
        if (delta > runtime->period_size + runtime->period_size / 2) {
                hw_ptr_error(substream,
                             "Lost interrupts? "
diff --git a/sound/isa/msnd/msnd.c b/sound/isa/msnd/msnd.c
index 906454413ed2..3a1526ae1729 100644
--- a/sound/isa/msnd/msnd.c
+++ b/sound/isa/msnd/msnd.c
@@ -438,7 +438,8 @@ static void snd_msnd_capture_reset_queue(struct snd_msnd *chip,
 static struct snd_pcm_hardware snd_msnd_playback = {
        .info =                 SNDRV_PCM_INFO_MMAP |
                                SNDRV_PCM_INFO_INTERLEAVED |
-                                SNDRV_PCM_INFO_MMAP_VALID,
+                                SNDRV_PCM_INFO_MMAP_VALID |
+                                SNDRV_PCM_INFO_BATCH,
        .formats =              SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE,
        .rates =                SNDRV_PCM_RATE_8000_48000,
        .rate_min =             8000,
@@ -456,7 +457,8 @@ static struct snd_pcm_hardware snd_msnd_playback = {
 static struct snd_pcm_hardware snd_msnd_capture = {
        .info =                 SNDRV_PCM_INFO_MMAP |
                                SNDRV_PCM_INFO_INTERLEAVED |
-                                SNDRV_PCM_INFO_MMAP_VALID,
+                                SNDRV_PCM_INFO_MMAP_VALID |
+                                SNDRV_PCM_INFO_BATCH,
        .formats =              SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE,
        .rates =                SNDRV_PCM_RATE_8000_48000,
        .rate_min =             8000,
diff --git a/sound/pci/bt87x.c b/sound/pci/bt87x.c
index a299340519df..ce3f2e90f4d7 100644
--- a/sound/pci/bt87x.c
+++ b/sound/pci/bt87x.c
@@ -349,7 +349,8 @@ static struct snd_pcm_hardware snd_bt87x_digital_hw = {
        .info = SNDRV_PCM_INFO_MMAP |
                SNDRV_PCM_INFO_INTERLEAVED |
                SNDRV_PCM_INFO_BLOCK_TRANSFER |
-                SNDRV_PCM_INFO_MMAP_VALID,
+                SNDRV_PCM_INFO_MMAP_VALID |
+                SNDRV_PCM_INFO_BATCH,
        .formats = SNDRV_PCM_FMTBIT_S16_LE,
        .rates = 0, /* set at runtime */
        .channels_min = 2,
@@ -365,7 +366,8 @@ static struct snd_pcm_hardware snd_bt87x_analog_hw = {
        .info = SNDRV_PCM_INFO_MMAP |
                SNDRV_PCM_INFO_INTERLEAVED |
                SNDRV_PCM_INFO_BLOCK_TRANSFER |
-                SNDRV_PCM_INFO_MMAP_VALID,
+                SNDRV_PCM_INFO_MMAP_VALID |
+                SNDRV_PCM_INFO_BATCH,
        .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S8,
        .rates = SNDRV_PCM_RATE_KNOT,
        .rate_min = ANALOG_CLOCK / CLOCK_DIV_MAX,
diff --git a/sound/pci/echoaudio/indigodjx.c b/sound/pci/echoaudio/indigodjx.c
index 3482ef69f491..2e44316530a2 100644
--- a/sound/pci/echoaudio/indigodjx.c
+++ b/sound/pci/echoaudio/indigodjx.c
@@ -88,6 +88,7 @@ static struct snd_pcm_hardware pcm_hardware_skel = {
        .rates =        SNDRV_PCM_RATE_32000 |
                        SNDRV_PCM_RATE_44100 |
                        SNDRV_PCM_RATE_48000 |
+                        SNDRV_PCM_RATE_64000 |
                        SNDRV_PCM_RATE_88200 |
                        SNDRV_PCM_RATE_96000,
        .rate_min = 32000,
diff --git a/sound/pci/echoaudio/indigoiox.c b/sound/pci/echoaudio/indigoiox.c
index aebee27a40ff..eb3819f9654a 100644
--- a/sound/pci/echoaudio/indigoiox.c
+++ b/sound/pci/echoaudio/indigoiox.c
@@ -89,6 +89,7 @@ static struct snd_pcm_hardware pcm_hardware_skel = {
        .rates =        SNDRV_PCM_RATE_32000 |
                        SNDRV_PCM_RATE_44100 |
                        SNDRV_PCM_RATE_48000 |
+                        SNDRV_PCM_RATE_64000 |
                        SNDRV_PCM_RATE_88200 |
                        SNDRV_PCM_RATE_96000,
        .rate_min = 32000,
diff --git a/sound/pci/korg1212/korg1212.c b/sound/pci/korg1212/korg1212.c
index 8b79969034be..7cc38a11e997 100644
--- a/sound/pci/korg1212/korg1212.c
+++ b/sound/pci/korg1212/korg1212.c
@@ -1238,7 +1238,8 @@ static struct snd_pcm_hardware snd_korg1212_playback_info =
 {
        .info =              (SNDRV_PCM_INFO_MMAP |
                              SNDRV_PCM_INFO_MMAP_VALID |
-                              SNDRV_PCM_INFO_INTERLEAVED),
+                              SNDRV_PCM_INFO_INTERLEAVED |
+                              SNDRV_PCM_INFO_BATCH),
        .formats =            SNDRV_PCM_FMTBIT_S16_LE,
        .rates =              (SNDRV_PCM_RATE_44100 |
                              SNDRV_PCM_RATE_48000),
@@ -1258,7 +1259,8 @@ static struct snd_pcm_hardware snd_korg1212_capture_info =
 {
        .info =              (SNDRV_PCM_INFO_MMAP |
                              SNDRV_PCM_INFO_MMAP_VALID |
-                              SNDRV_PCM_INFO_INTERLEAVED),
+                              SNDRV_PCM_INFO_INTERLEAVED |
+                              SNDRV_PCM_INFO_BATCH),
        .formats =            SNDRV_PCM_FMTBIT_S16_LE,
        .rates =              (SNDRV_PCM_RATE_44100 |
                              SNDRV_PCM_RATE_48000),
diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c b/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
index 01066c95580e..d057e6489643 100644
--- a/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
+++ b/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
@@ -240,7 +240,8 @@ static int pdacf_pcm_prepare(struct snd_pcm_substream *subs)
 static struct snd_pcm_hardware pdacf_pcm_capture_hw = {
        .info =                 (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
                                 SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME |
-                                 SNDRV_PCM_INFO_MMAP_VALID),
+                                 SNDRV_PCM_INFO_MMAP_VALID |
+                                 SNDRV_PCM_INFO_BATCH),
        .formats =              SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S16_BE |
                                SNDRV_PCM_FMTBIT_S24_3LE | SNDRV_PCM_FMTBIT_S24_3BE |
                                SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_S32_BE,
diff --git a/sound/soc/au1x/dbdma2.c b/sound/soc/au1x/dbdma2.c
index 30490a259148..594c6c5b7838 100644
--- a/sound/soc/au1x/dbdma2.c
+++ b/sound/soc/au1x/dbdma2.c
@@ -82,7 +82,7 @@ static struct au1xpsc_audio_dmadata *au1xpsc_audio_pcmdma[2];
 /* PCM hardware DMA capabilities - platform specific */
 static const struct snd_pcm_hardware au1xpsc_pcm_hardware = {
        .info             = SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID |
-                            SNDRV_PCM_INFO_INTERLEAVED,
+                            SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_BATCH,
        .formats          = AU1XPSC_PCM_FMTS,
        .period_bytes_min = AU1XPSC_PERIOD_MIN_BYTES,
        .period_bytes_max = 4096 * 1024 - 1,
diff --git a/sound/soc/codecs/twl4030.c b/sound/soc/codecs/twl4030.c
index 921b205de28a..df7c8c281d2f 100644
--- a/sound/soc/codecs/twl4030.c
+++ b/sound/soc/codecs/twl4030.c
@@ -836,6 +836,12 @@ static DECLARE_TLV_DB_SCALE(analog_tlv, -2400, 200, 0);
 static DECLARE_TLV_DB_SCALE(output_tvl, -1200, 600, 1);
 /*
+ * Gain control for earpiece amplifier
+ * 0 dB to 12 dB in 6 dB steps (mute instead of -6)
+ */
+static DECLARE_TLV_DB_SCALE(output_ear_tvl, -600, 600, 1);
+/*
 * Capture gain after the ADCs
 * from 0 dB to 31 dB in 1 dB steps
 */
@@ -900,7 +906,7 @@ static const struct snd_kcontrol_new twl4030_snd_controls[] = {
                4, 3, 0, output_tvl),
        SOC_SINGLE_TLV_TWL4030("Earpiece Playback Volume",
-                TWL4030_REG_EAR_CTL, 4, 3, 0, output_tvl),
+                TWL4030_REG_EAR_CTL, 4, 3, 0, output_ear_tvl),
        /* Common capture gain controls */
        SOC_DOUBLE_R_TLV("TX1 Digital Capture Volume",
diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c
index 3b1d0993bed9..0275321ff8ab 100644
--- a/sound/soc/codecs/wm8350.c
+++ b/sound/soc/codecs/wm8350.c
@@ -968,7 +968,7 @@ static int wm8350_pcm_trigger(struct snd_pcm_substream *substream,
         * required for LRC in master mode. The DACs or ADCs need a
         * valid audio path i.e. pin -> ADC or DAC -> pin before
         * the LRC will be enabled in master mode. */
-        if (!master && cmd != SNDRV_PCM_TRIGGER_START)
+        if (!master || cmd != SNDRV_PCM_TRIGGER_START)
                return 0;
        if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) {
diff --git a/sound/soc/fsl/mpc5200_psc_i2s.c b/sound/soc/fsl/mpc5200_psc_i2s.c
index 3aa729df27b5..1111c710118a 100644
--- a/sound/soc/fsl/mpc5200_psc_i2s.c
+++ b/sound/soc/fsl/mpc5200_psc_i2s.c
@@ -504,7 +504,8 @@ static struct snd_soc_dai psc_i2s_dai_template = {
 static const struct snd_pcm_hardware psc_i2s_pcm_hardware = {
        .info = SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID |
-                SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_BLOCK_TRANSFER,
+                SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_BLOCK_TRANSFER |
+                SNDRV_PCM_INFO_BATCH,
        .formats = SNDRV_PCM_FMTBIT_S8 | SNDRV_PCM_FMTBIT_S16_BE |
                   SNDRV_PCM_FMTBIT_S24_BE | SNDRV_PCM_FMTBIT_S32_BE,
        .rate_min = 8000,
diff --git a/sound/soc/sh/dma-sh7760.c b/sound/soc/sh/dma-sh7760.c
index 0dad3a0bb920..baddb1242c71 100644
--- a/sound/soc/sh/dma-sh7760.c
+++ b/sound/soc/sh/dma-sh7760.c
@@ -103,7 +103,8 @@ static struct snd_pcm_hardware camelot_pcm_hardware = {
        .info = (SNDRV_PCM_INFO_MMAP |
                SNDRV_PCM_INFO_INTERLEAVED |
                SNDRV_PCM_INFO_BLOCK_TRANSFER |
-                SNDRV_PCM_INFO_MMAP_VALID),
+                SNDRV_PCM_INFO_MMAP_VALID |
+                SNDRV_PCM_INFO_BATCH),
        .formats =      DMABRG_FMTS,
        .rates =        DMABRG_RATES,
        .rate_min =             8000,
diff --git a/sound/sparc/dbri.c b/sound/sparc/dbri.c
index af95ff1e126c..1d2e51b3f918 100644
--- a/sound/sparc/dbri.c
+++ b/sound/sparc/dbri.c
@@ -1975,7 +1975,8 @@ static struct snd_pcm_hardware snd_dbri_pcm_hw = {
        .info           = SNDRV_PCM_INFO_MMAP |
                          SNDRV_PCM_INFO_INTERLEAVED |
                          SNDRV_PCM_INFO_BLOCK_TRANSFER |
-                          SNDRV_PCM_INFO_MMAP_VALID,
+                          SNDRV_PCM_INFO_MMAP_VALID |
+                          SNDRV_PCM_INFO_BATCH,
        .formats        = SNDRV_PCM_FMTBIT_MU_LAW |
                          SNDRV_PCM_FMTBIT_A_LAW |
                          SNDRV_PCM_FMTBIT_U8 |
diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
index 9a608fa85155..dd1ab6177840 100644
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -870,7 +870,8 @@ static struct snd_pcm_hardware snd_usX2Y_2c =
 {
        .info =                 (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
                                 SNDRV_PCM_INFO_BLOCK_TRANSFER |
-                                 SNDRV_PCM_INFO_MMAP_VALID),
+                                 SNDRV_PCM_INFO_MMAP_VALID |
+                                 SNDRV_PCM_INFO_BATCH),
        .formats =                 SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_3LE,
        .rates =                   SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_48000,
        .rate_min =                44100,