diff options
Diffstat (limited to '3.2.70/1041_linux-3.2.42.patch')
| -rw-r--r-- | 3.2.70/1041_linux-3.2.42.patch | 3602 |
1 files changed, 3602 insertions, 0 deletions
diff --git a/3.2.70/1041_linux-3.2.42.patch b/3.2.70/1041_linux-3.2.42.patch new file mode 100644 index 0000000..77a08ed --- /dev/null +++ b/3.2.70/1041_linux-3.2.42.patch @@ -0,0 +1,3602 @@ +diff --git a/Makefile b/Makefile +index 95e6220..d44f009 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 2 +-SUBLEVEL = 41 ++SUBLEVEL = 42 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/arm/include/asm/signal.h b/arch/arm/include/asm/signal.h +index 43ba0fb..559ee24 100644 +--- a/arch/arm/include/asm/signal.h ++++ b/arch/arm/include/asm/signal.h +@@ -127,6 +127,7 @@ struct sigaction { + __sigrestore_t sa_restorer; + sigset_t sa_mask; /* mask last for extensibility */ + }; ++#define __ARCH_HAS_SA_RESTORER + + struct k_sigaction { + struct sigaction sa; +diff --git a/arch/avr32/include/asm/signal.h b/arch/avr32/include/asm/signal.h +index 8790dfc..e6952a0 100644 +--- a/arch/avr32/include/asm/signal.h ++++ b/arch/avr32/include/asm/signal.h +@@ -128,6 +128,7 @@ struct sigaction { + __sigrestore_t sa_restorer; + sigset_t sa_mask; /* mask last for extensibility */ + }; ++#define __ARCH_HAS_SA_RESTORER + + struct k_sigaction { + struct sigaction sa; +diff --git a/arch/cris/include/asm/signal.h b/arch/cris/include/asm/signal.h +index ea6af9a..057fea2 100644 +--- a/arch/cris/include/asm/signal.h ++++ b/arch/cris/include/asm/signal.h +@@ -122,6 +122,7 @@ struct sigaction { + void (*sa_restorer)(void); + sigset_t sa_mask; /* mask last for extensibility */ + }; ++#define __ARCH_HAS_SA_RESTORER + + struct k_sigaction { + struct sigaction sa; +diff --git a/arch/h8300/include/asm/signal.h b/arch/h8300/include/asm/signal.h +index fd8b66e..8695707 100644 +--- a/arch/h8300/include/asm/signal.h ++++ b/arch/h8300/include/asm/signal.h +@@ -121,6 +121,7 @@ struct sigaction { + void (*sa_restorer)(void); + sigset_t sa_mask; /* mask last for extensibility */ + }; ++#define __ARCH_HAS_SA_RESTORER + + struct k_sigaction { + struct sigaction sa; +diff --git a/arch/m32r/include/asm/signal.h b/arch/m32r/include/asm/signal.h +index b2eeb0d..802d561 100644 +--- a/arch/m32r/include/asm/signal.h ++++ b/arch/m32r/include/asm/signal.h +@@ -123,6 +123,7 @@ struct sigaction { + __sigrestore_t sa_restorer; + sigset_t sa_mask; /* mask last for extensibility */ + }; ++#define __ARCH_HAS_SA_RESTORER + + struct k_sigaction { + struct sigaction sa; +diff --git a/arch/m68k/include/asm/signal.h b/arch/m68k/include/asm/signal.h +index 93fe83e..a20ae63 100644 +--- a/arch/m68k/include/asm/signal.h ++++ b/arch/m68k/include/asm/signal.h +@@ -119,6 +119,7 @@ struct sigaction { + __sigrestore_t sa_restorer; + sigset_t sa_mask; /* mask last for extensibility */ + }; ++#define __ARCH_HAS_SA_RESTORER + + struct k_sigaction { + struct sigaction sa; +diff --git a/arch/mn10300/include/asm/signal.h b/arch/mn10300/include/asm/signal.h +index 1865d72..eecaa76 100644 +--- a/arch/mn10300/include/asm/signal.h ++++ b/arch/mn10300/include/asm/signal.h +@@ -131,6 +131,7 @@ struct sigaction { + __sigrestore_t sa_restorer; + sigset_t sa_mask; /* mask last for extensibility */ + }; ++#define __ARCH_HAS_SA_RESTORER + + struct k_sigaction { + struct sigaction sa; +diff --git a/arch/powerpc/include/asm/signal.h b/arch/powerpc/include/asm/signal.h +index 3eb13be..ec63a0a 100644 +--- a/arch/powerpc/include/asm/signal.h ++++ b/arch/powerpc/include/asm/signal.h +@@ -109,6 +109,7 @@ struct sigaction { + __sigrestore_t sa_restorer; + sigset_t sa_mask; /* mask last for extensibility */ + }; ++#define __ARCH_HAS_SA_RESTORER + + struct k_sigaction { + struct sigaction sa; +diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c +index edae5bb..b92b756 100644 +--- a/arch/powerpc/kernel/cputable.c ++++ b/arch/powerpc/kernel/cputable.c +@@ -268,7 +268,7 @@ static struct cpu_spec __initdata cpu_specs[] = { + .cpu_features = CPU_FTRS_PPC970, + .cpu_user_features = COMMON_USER_POWER4 | + PPC_FEATURE_HAS_ALTIVEC_COMP, +- .mmu_features = MMU_FTR_HPTE_TABLE, ++ .mmu_features = MMU_FTRS_PPC970, + .icache_bsize = 128, + .dcache_bsize = 128, + .num_pmcs = 8, +diff --git a/arch/s390/include/asm/signal.h b/arch/s390/include/asm/signal.h +index cdf5cb2..c872626 100644 +--- a/arch/s390/include/asm/signal.h ++++ b/arch/s390/include/asm/signal.h +@@ -131,6 +131,7 @@ struct sigaction { + void (*sa_restorer)(void); + sigset_t sa_mask; /* mask last for extensibility */ + }; ++#define __ARCH_HAS_SA_RESTORER + + struct k_sigaction { + struct sigaction sa; +diff --git a/arch/s390/include/asm/tlbflush.h b/arch/s390/include/asm/tlbflush.h +index 1d8648c..8743029 100644 +--- a/arch/s390/include/asm/tlbflush.h ++++ b/arch/s390/include/asm/tlbflush.h +@@ -74,8 +74,6 @@ static inline void __tlb_flush_idte(unsigned long asce) + + static inline void __tlb_flush_mm(struct mm_struct * mm) + { +- if (unlikely(cpumask_empty(mm_cpumask(mm)))) +- return; + /* + * If the machine has IDTE we prefer to do a per mm flush + * on all cpus instead of doing a local flush if the mm +diff --git a/arch/sparc/include/asm/signal.h b/arch/sparc/include/asm/signal.h +index e49b828..4929431 100644 +--- a/arch/sparc/include/asm/signal.h ++++ b/arch/sparc/include/asm/signal.h +@@ -191,6 +191,7 @@ struct __old_sigaction { + unsigned long sa_flags; + void (*sa_restorer)(void); /* not used by Linux/SPARC yet */ + }; ++#define __ARCH_HAS_SA_RESTORER + + typedef struct sigaltstack { + void __user *ss_sp; +diff --git a/arch/x86/include/asm/signal.h b/arch/x86/include/asm/signal.h +index 598457c..6cbc795 100644 +--- a/arch/x86/include/asm/signal.h ++++ b/arch/x86/include/asm/signal.h +@@ -125,6 +125,8 @@ typedef unsigned long sigset_t; + extern void do_notify_resume(struct pt_regs *, void *, __u32); + # endif /* __KERNEL__ */ + ++#define __ARCH_HAS_SA_RESTORER ++ + #ifdef __i386__ + # ifdef __KERNEL__ + struct old_sigaction { +diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c +index 73da6b6..2d4e76b 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c ++++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c +@@ -736,3 +736,13 @@ void intel_ds_init(void) + } + } + } ++ ++void perf_restore_debug_store(void) ++{ ++ struct debug_store *ds = __this_cpu_read(cpu_hw_events.ds); ++ ++ if (!x86_pmu.bts && !x86_pmu.pebs) ++ return; ++ ++ wrmsrl(MSR_IA32_DS_AREA, (unsigned long)ds); ++} +diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c +index b7c2849..554b7b5 100644 +--- a/arch/x86/lib/usercopy_64.c ++++ b/arch/x86/lib/usercopy_64.c +@@ -169,10 +169,10 @@ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest) + char c; + unsigned zero_len; + +- for (; len; --len) { ++ for (; len; --len, to++) { + if (__get_user_nocheck(c, from++, sizeof(char))) + break; +- if (__put_user_nocheck(c, to++, sizeof(char))) ++ if (__put_user_nocheck(c, to, sizeof(char))) + break; + } + +diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c +index f10c0af..43c9f6a 100644 +--- a/arch/x86/power/cpu.c ++++ b/arch/x86/power/cpu.c +@@ -11,6 +11,7 @@ + #include <linux/suspend.h> + #include <linux/export.h> + #include <linux/smp.h> ++#include <linux/perf_event.h> + + #include <asm/pgtable.h> + #include <asm/proto.h> +@@ -225,6 +226,7 @@ static void __restore_processor_state(struct saved_context *ctxt) + + do_fpu_end(); + mtrr_bp_restore(); ++ perf_restore_debug_store(); + } + + /* Needed by apm.c */ +diff --git a/arch/xtensa/include/asm/signal.h b/arch/xtensa/include/asm/signal.h +index 633ba73..75edf8a 100644 +--- a/arch/xtensa/include/asm/signal.h ++++ b/arch/xtensa/include/asm/signal.h +@@ -133,6 +133,7 @@ struct sigaction { + void (*sa_restorer)(void); + sigset_t sa_mask; /* mask last for extensibility */ + }; ++#define __ARCH_HAS_SA_RESTORER + + struct k_sigaction { + struct sigaction sa; +diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig +index efba163..bf4d6e2 100644 +--- a/drivers/firmware/Kconfig ++++ b/drivers/firmware/Kconfig +@@ -53,6 +53,24 @@ config EFI_VARS + Subsequent efibootmgr releases may be found at: + <http://linux.dell.com/efibootmgr> + ++config EFI_VARS_PSTORE ++ bool "Register efivars backend for pstore" ++ depends on EFI_VARS && PSTORE ++ default y ++ help ++ Say Y here to enable use efivars as a backend to pstore. This ++ will allow writing console messages, crash dumps, or anything ++ else supported by pstore to EFI variables. ++ ++config EFI_VARS_PSTORE_DEFAULT_DISABLE ++ bool "Disable using efivars as a pstore backend by default" ++ depends on EFI_VARS_PSTORE ++ default n ++ help ++ Saying Y here will disable the use of efivars as a storage ++ backend for pstore by default. This setting can be overridden ++ using the efivars module's pstore_disable parameter. ++ + config EFI_PCDP + bool "Console device selection via EFI PCDP or HCDP table" + depends on ACPI && EFI && IA64 +diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c +index 81346ae..b15c0aa 100644 +--- a/drivers/firmware/efivars.c ++++ b/drivers/firmware/efivars.c +@@ -92,6 +92,11 @@ MODULE_VERSION(EFIVARS_VERSION); + + #define DUMP_NAME_LEN 52 + ++static bool efivars_pstore_disable = ++ IS_ENABLED(CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE); ++ ++module_param_named(pstore_disable, efivars_pstore_disable, bool, 0644); ++ + /* + * The maximum size of VariableName + Data = 1024 + * Therefore, it's reasonable to save that much +@@ -122,6 +127,8 @@ struct efivar_attribute { + ssize_t (*store)(struct efivar_entry *entry, const char *buf, size_t count); + }; + ++static struct efivars __efivars; ++ + #define PSTORE_EFI_ATTRIBUTES \ + (EFI_VARIABLE_NON_VOLATILE | \ + EFI_VARIABLE_BOOTSERVICE_ACCESS | \ +@@ -146,6 +153,14 @@ efivar_create_sysfs_entry(struct efivars *efivars, + efi_char16_t *variable_name, + efi_guid_t *vendor_guid); + ++/* ++ * Prototype for workqueue functions updating sysfs entry ++ */ ++ ++static void efivar_update_sysfs_entries(struct work_struct *); ++static DECLARE_WORK(efivar_work, efivar_update_sysfs_entries); ++static bool efivar_wq_enabled = true; ++ + /* Return the number of unicode characters in data */ + static unsigned long + utf16_strnlen(efi_char16_t *s, size_t maxlength) +@@ -659,8 +674,6 @@ static struct kobj_type efivar_ktype = { + .default_attrs = def_attrs, + }; + +-static struct pstore_info efi_pstore_info; +- + static inline void + efivar_unregister(struct efivar_entry *var) + { +@@ -697,7 +710,7 @@ static int efi_status_to_err(efi_status_t status) + return err; + } + +-#ifdef CONFIG_PSTORE ++#ifdef CONFIG_EFI_VARS_PSTORE + + static int efi_pstore_open(struct pstore_info *psi) + { +@@ -774,19 +787,21 @@ static int efi_pstore_write(enum pstore_type_id type, u64 *id, + + spin_lock_irqsave(&efivars->lock, flags); + +- /* +- * Check if there is a space enough to log. +- * size: a size of logging data +- * DUMP_NAME_LEN * 2: a maximum size of variable name +- */ ++ if (size) { ++ /* ++ * Check if there is a space enough to log. ++ * size: a size of logging data ++ * DUMP_NAME_LEN * 2: a maximum size of variable name ++ */ + +- status = check_var_size_locked(efivars, PSTORE_EFI_ATTRIBUTES, +- size + DUMP_NAME_LEN * 2); ++ status = check_var_size_locked(efivars, PSTORE_EFI_ATTRIBUTES, ++ size + DUMP_NAME_LEN * 2); + +- if (status) { +- spin_unlock_irqrestore(&efivars->lock, flags); +- *id = part; +- return -ENOSPC; ++ if (status) { ++ spin_unlock_irqrestore(&efivars->lock, flags); ++ *id = part; ++ return -ENOSPC; ++ } + } + + for (i = 0; i < DUMP_NAME_LEN; i++) +@@ -830,11 +845,8 @@ static int efi_pstore_write(enum pstore_type_id type, u64 *id, + if (found) + efivar_unregister(found); + +- if (size) +- ret = efivar_create_sysfs_entry(efivars, +- utf16_strsize(efi_name, +- DUMP_NAME_LEN * 2), +- efi_name, &vendor); ++ if (efivar_wq_enabled) ++ schedule_work(&efivar_work); + + *id = part; + return ret; +@@ -847,36 +859,6 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, + + return 0; + } +-#else +-static int efi_pstore_open(struct pstore_info *psi) +-{ +- return 0; +-} +- +-static int efi_pstore_close(struct pstore_info *psi) +-{ +- return 0; +-} +- +-static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type, +- struct timespec *timespec, +- char **buf, struct pstore_info *psi) +-{ +- return -1; +-} +- +-static int efi_pstore_write(enum pstore_type_id type, u64 *id, +- unsigned int part, size_t size, struct pstore_info *psi) +-{ +- return 0; +-} +- +-static int efi_pstore_erase(enum pstore_type_id type, u64 id, +- struct pstore_info *psi) +-{ +- return 0; +-} +-#endif + + static struct pstore_info efi_pstore_info = { + .owner = THIS_MODULE, +@@ -888,6 +870,24 @@ static struct pstore_info efi_pstore_info = { + .erase = efi_pstore_erase, + }; + ++static void efivar_pstore_register(struct efivars *efivars) ++{ ++ efivars->efi_pstore_info = efi_pstore_info; ++ efivars->efi_pstore_info.buf = kmalloc(4096, GFP_KERNEL); ++ if (efivars->efi_pstore_info.buf) { ++ efivars->efi_pstore_info.bufsize = 1024; ++ efivars->efi_pstore_info.data = efivars; ++ spin_lock_init(&efivars->efi_pstore_info.buf_lock); ++ pstore_register(&efivars->efi_pstore_info); ++ } ++} ++#else ++static void efivar_pstore_register(struct efivars *efivars) ++{ ++ return; ++} ++#endif ++ + static ssize_t efivar_create(struct file *filp, struct kobject *kobj, + struct bin_attribute *bin_attr, + char *buf, loff_t pos, size_t count) +@@ -1025,6 +1025,103 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj, + return count; + } + ++static bool variable_is_present(efi_char16_t *variable_name, efi_guid_t *vendor) ++{ ++ struct efivar_entry *entry, *n; ++ struct efivars *efivars = &__efivars; ++ unsigned long strsize1, strsize2; ++ bool found = false; ++ ++ strsize1 = utf16_strsize(variable_name, 1024); ++ list_for_each_entry_safe(entry, n, &efivars->list, list) { ++ strsize2 = utf16_strsize(entry->var.VariableName, 1024); ++ if (strsize1 == strsize2 && ++ !memcmp(variable_name, &(entry->var.VariableName), ++ strsize2) && ++ !efi_guidcmp(entry->var.VendorGuid, ++ *vendor)) { ++ found = true; ++ break; ++ } ++ } ++ return found; ++} ++ ++/* ++ * Returns the size of variable_name, in bytes, including the ++ * terminating NULL character, or variable_name_size if no NULL ++ * character is found among the first variable_name_size bytes. ++ */ ++static unsigned long var_name_strnsize(efi_char16_t *variable_name, ++ unsigned long variable_name_size) ++{ ++ unsigned long len; ++ efi_char16_t c; ++ ++ /* ++ * The variable name is, by definition, a NULL-terminated ++ * string, so make absolutely sure that variable_name_size is ++ * the value we expect it to be. If not, return the real size. ++ */ ++ for (len = 2; len <= variable_name_size; len += sizeof(c)) { ++ c = variable_name[(len / sizeof(c)) - 1]; ++ if (!c) ++ break; ++ } ++ ++ return min(len, variable_name_size); ++} ++ ++static void efivar_update_sysfs_entries(struct work_struct *work) ++{ ++ struct efivars *efivars = &__efivars; ++ efi_guid_t vendor; ++ efi_char16_t *variable_name; ++ unsigned long variable_name_size = 1024; ++ efi_status_t status = EFI_NOT_FOUND; ++ bool found; ++ ++ /* Add new sysfs entries */ ++ while (1) { ++ variable_name = kzalloc(variable_name_size, GFP_KERNEL); ++ if (!variable_name) { ++ pr_err("efivars: Memory allocation failed.\n"); ++ return; ++ } ++ ++ spin_lock_irq(&efivars->lock); ++ found = false; ++ while (1) { ++ variable_name_size = 1024; ++ status = efivars->ops->get_next_variable( ++ &variable_name_size, ++ variable_name, ++ &vendor); ++ if (status != EFI_SUCCESS) { ++ break; ++ } else { ++ if (!variable_is_present(variable_name, ++ &vendor)) { ++ found = true; ++ break; ++ } ++ } ++ } ++ spin_unlock_irq(&efivars->lock); ++ ++ if (!found) { ++ kfree(variable_name); ++ break; ++ } else { ++ variable_name_size = var_name_strnsize(variable_name, ++ variable_name_size); ++ efivar_create_sysfs_entry(efivars, ++ variable_name_size, ++ variable_name, &vendor); ++ } ++ } ++} ++ + /* + * Let's not leave out systab information that snuck into + * the efivars driver +@@ -1212,6 +1309,35 @@ void unregister_efivars(struct efivars *efivars) + } + EXPORT_SYMBOL_GPL(unregister_efivars); + ++/* ++ * Print a warning when duplicate EFI variables are encountered and ++ * disable the sysfs workqueue since the firmware is buggy. ++ */ ++static void dup_variable_bug(efi_char16_t *s16, efi_guid_t *vendor_guid, ++ unsigned long len16) ++{ ++ size_t i, len8 = len16 / sizeof(efi_char16_t); ++ char *s8; ++ ++ /* ++ * Disable the workqueue since the algorithm it uses for ++ * detecting new variables won't work with this buggy ++ * implementation of GetNextVariableName(). ++ */ ++ efivar_wq_enabled = false; ++ ++ s8 = kzalloc(len8, GFP_KERNEL); ++ if (!s8) ++ return; ++ ++ for (i = 0; i < len8; i++) ++ s8[i] = s16[i]; ++ ++ printk(KERN_WARNING "efivars: duplicate variable: %s-%pUl\n", ++ s8, vendor_guid); ++ kfree(s8); ++} ++ + int register_efivars(struct efivars *efivars, + const struct efivar_operations *ops, + struct kobject *parent_kobj) +@@ -1252,6 +1378,24 @@ int register_efivars(struct efivars *efivars, + &vendor_guid); + switch (status) { + case EFI_SUCCESS: ++ variable_name_size = var_name_strnsize(variable_name, ++ variable_name_size); ++ ++ /* ++ * Some firmware implementations return the ++ * same variable name on multiple calls to ++ * get_next_variable(). Terminate the loop ++ * immediately as there is no guarantee that ++ * we'll ever see a different variable name, ++ * and may end up looping here forever. ++ */ ++ if (variable_is_present(variable_name, &vendor_guid)) { ++ dup_variable_bug(variable_name, &vendor_guid, ++ variable_name_size); ++ status = EFI_NOT_FOUND; ++ break; ++ } ++ + efivar_create_sysfs_entry(efivars, + variable_name_size, + variable_name, +@@ -1271,15 +1415,8 @@ int register_efivars(struct efivars *efivars, + if (error) + unregister_efivars(efivars); + +- efivars->efi_pstore_info = efi_pstore_info; +- +- efivars->efi_pstore_info.buf = kmalloc(4096, GFP_KERNEL); +- if (efivars->efi_pstore_info.buf) { +- efivars->efi_pstore_info.bufsize = 1024; +- efivars->efi_pstore_info.data = efivars; +- spin_lock_init(&efivars->efi_pstore_info.buf_lock); +- pstore_register(&efivars->efi_pstore_info); +- } ++ if (!efivars_pstore_disable) ++ efivar_pstore_register(efivars); + + out: + kfree(variable_name); +@@ -1288,7 +1425,6 @@ out: + } + EXPORT_SYMBOL_GPL(register_efivars); + +-static struct efivars __efivars; + static struct efivar_operations ops; + + /* +@@ -1346,6 +1482,8 @@ err_put: + static void __exit + efivars_exit(void) + { ++ cancel_work_sync(&efivar_work); ++ + if (efi_enabled(EFI_RUNTIME_SERVICES)) { + unregister_efivars(&__efivars); + kobject_put(efi_kobj); +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 9080eb7..7211f67 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -852,7 +852,7 @@ static struct drm_display_mode *drm_mode_detailed(struct drm_device *dev, + unsigned vblank = (pt->vactive_vblank_hi & 0xf) << 8 | pt->vblank_lo; + unsigned hsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc0) << 2 | pt->hsync_offset_lo; + unsigned hsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 0x30) << 4 | pt->hsync_pulse_width_lo; +- unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) >> 2 | pt->vsync_offset_pulse_width_lo >> 4; ++ unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) << 2 | pt->vsync_offset_pulse_width_lo >> 4; + unsigned vsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 0x3) << 4 | (pt->vsync_offset_pulse_width_lo & 0xf); + + /* ignore tiny modes */ +@@ -933,6 +933,7 @@ set_size: + } + + mode->type = DRM_MODE_TYPE_DRIVER; ++ mode->vrefresh = drm_mode_vrefresh(mode); + drm_mode_set_name(mode); + + return mode; +diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c +index 5620192..9b4e5c6 100644 +--- a/drivers/gpu/drm/i915/i915_debugfs.c ++++ b/drivers/gpu/drm/i915/i915_debugfs.c +@@ -122,7 +122,7 @@ static const char *cache_level_str(int type) + static void + describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj) + { +- seq_printf(m, "%p: %s%s %8zd %04x %04x %d %d%s%s%s", ++ seq_printf(m, "%pK: %s%s %8zd %04x %04x %d %d%s%s%s", + &obj->base, + get_pin_flag(obj), + get_tiling_flag(obj), +diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +index 878b989..b1bb734 100644 +--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +@@ -907,15 +907,20 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec, + int count) + { + int i; ++ int relocs_total = 0; ++ int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry); + + for (i = 0; i < count; i++) { + char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr; + int length; /* limited by fault_in_pages_readable() */ + +- /* First check for malicious input causing overflow */ +- if (exec[i].relocation_count > +- INT_MAX / sizeof(struct drm_i915_gem_relocation_entry)) ++ /* First check for malicious input causing overflow in ++ * the worst case where we need to allocate the entire ++ * relocation tree as a single array. ++ */ ++ if (exec[i].relocation_count > relocs_max - relocs_total) + return -EINVAL; ++ relocs_total += exec[i].relocation_count; + + length = exec[i].relocation_count * + sizeof(struct drm_i915_gem_relocation_entry); +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 4591582..17961df 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -8059,7 +8059,7 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv) + I915_WRITE(GEN6_RC_SLEEP, 0); + I915_WRITE(GEN6_RC1e_THRESHOLD, 1000); + I915_WRITE(GEN6_RC6_THRESHOLD, 50000); +- I915_WRITE(GEN6_RC6p_THRESHOLD, 100000); ++ I915_WRITE(GEN6_RC6p_THRESHOLD, 150000); + I915_WRITE(GEN6_RC6pp_THRESHOLD, 64000); /* unused */ + + if (intel_enable_rc6(dev_priv->dev)) +diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c +index 289140b..cffb007 100644 +--- a/drivers/gpu/drm/i915/intel_opregion.c ++++ b/drivers/gpu/drm/i915/intel_opregion.c +@@ -419,6 +419,25 @@ blind_set: + goto end; + } + ++static void intel_setup_cadls(struct drm_device *dev) ++{ ++ struct drm_i915_private *dev_priv = dev->dev_private; ++ struct intel_opregion *opregion = &dev_priv->opregion; ++ int i = 0; ++ u32 disp_id; ++ ++ /* Initialize the CADL field by duplicating the DIDL values. ++ * Technically, this is not always correct as display outputs may exist, ++ * but not active. This initialization is necessary for some Clevo ++ * laptops that check this field before processing the brightness and ++ * display switching hotkeys. Just like DIDL, CADL is NULL-terminated if ++ * there are less than eight devices. */ ++ do { ++ disp_id = ioread32(&opregion->acpi->didl[i]); ++ iowrite32(disp_id, &opregion->acpi->cadl[i]); ++ } while (++i < 8 && disp_id != 0); ++} ++ + void intel_opregion_init(struct drm_device *dev) + { + struct drm_i915_private *dev_priv = dev->dev_private; +@@ -428,8 +447,10 @@ void intel_opregion_init(struct drm_device *dev) + return; + + if (opregion->acpi) { +- if (drm_core_check_feature(dev, DRIVER_MODESET)) ++ if (drm_core_check_feature(dev, DRIVER_MODESET)) { + intel_didl_outputs(dev); ++ intel_setup_cadls(dev); ++ } + + /* Notify BIOS we are ready to handle ACPI video ext notifs. + * Right now, all the events are handled by the ACPI video module. +diff --git a/drivers/gpu/drm/radeon/radeon_benchmark.c b/drivers/gpu/drm/radeon/radeon_benchmark.c +index 17e1a9b..441de38 100644 +--- a/drivers/gpu/drm/radeon/radeon_benchmark.c ++++ b/drivers/gpu/drm/radeon/radeon_benchmark.c +@@ -139,13 +139,15 @@ static void radeon_benchmark_move(struct radeon_device *rdev, unsigned size, + sdomain, ddomain, "dma"); + } + +- time = radeon_benchmark_do_move(rdev, size, saddr, daddr, +- RADEON_BENCHMARK_COPY_BLIT, n); +- if (time < 0) +- goto out_cleanup; +- if (time > 0) +- radeon_benchmark_log_results(n, size, time, +- sdomain, ddomain, "blit"); ++ if (rdev->asic->copy_blit) { ++ time = radeon_benchmark_do_move(rdev, size, saddr, daddr, ++ RADEON_BENCHMARK_COPY_BLIT, n); ++ if (time < 0) ++ goto out_cleanup; ++ if (time > 0) ++ radeon_benchmark_log_results(n, size, time, ++ sdomain, ddomain, "blit"); ++ } + + out_cleanup: + if (sobj) { +diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c +index 3d7885a..3056ea4 100644 +--- a/drivers/i2c/busses/i2c-tegra.c ++++ b/drivers/i2c/busses/i2c-tegra.c +@@ -341,7 +341,11 @@ static int tegra_i2c_init(struct tegra_i2c_dev *i2c_dev) + u32 val; + int err = 0; + +- clk_enable(i2c_dev->clk); ++ err = clk_enable(i2c_dev->clk); ++ if (err < 0) { ++ dev_err(i2c_dev->dev, "Clock enable failed %d\n", err); ++ return err; ++ } + + tegra_periph_reset_assert(i2c_dev->clk); + udelay(2); +@@ -536,7 +540,12 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], + if (i2c_dev->is_suspended) + return -EBUSY; + +- clk_enable(i2c_dev->clk); ++ ret = clk_enable(i2c_dev->clk); ++ if (ret < 0) { ++ dev_err(i2c_dev->dev, "Clock enable failed %d\n", ret); ++ return ret; ++ } ++ + for (i = 0; i < num; i++) { + int stop = (i == (num - 1)) ? 1 : 0; + ret = tegra_i2c_xfer_msg(i2c_dev, &msgs[i], stop); +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index da4d299..2c9dd2c 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -2212,7 +2212,7 @@ static struct target_type pool_target = { + .name = "thin-pool", + .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE | + DM_TARGET_IMMUTABLE, +- .version = {1, 0, 1}, ++ .version = {1, 0, 2}, + .module = THIS_MODULE, + .ctr = pool_ctr, + .dtr = pool_dtr, +@@ -2428,7 +2428,7 @@ static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits) + + static struct target_type thin_target = { + .name = "thin", +- .version = {1, 0, 1}, ++ .version = {1, 0, 2}, + .module = THIS_MODULE, + .ctr = thin_ctr, + .dtr = thin_dtr, +diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c +index e6cdfde..1de0f5f 100644 +--- a/drivers/md/persistent-data/dm-btree-remove.c ++++ b/drivers/md/persistent-data/dm-btree-remove.c +@@ -139,15 +139,8 @@ struct child { + struct btree_node *n; + }; + +-static struct dm_btree_value_type le64_type = { +- .context = NULL, +- .size = sizeof(__le64), +- .inc = NULL, +- .dec = NULL, +- .equal = NULL +-}; +- +-static int init_child(struct dm_btree_info *info, struct btree_node *parent, ++static int init_child(struct dm_btree_info *info, struct dm_btree_value_type *vt, ++ struct btree_node *parent, + unsigned index, struct child *result) + { + int r, inc; +@@ -164,7 +157,7 @@ static int init_child(struct dm_btree_info *info, struct btree_node *parent, + result->n = dm_block_data(result->block); + + if (inc) +- inc_children(info->tm, result->n, &le64_type); ++ inc_children(info->tm, result->n, vt); + + *((__le64 *) value_ptr(parent, index, sizeof(__le64))) = + cpu_to_le64(dm_block_location(result->block)); +@@ -236,7 +229,7 @@ static void __rebalance2(struct dm_btree_info *info, struct btree_node *parent, + } + + static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info, +- unsigned left_index) ++ struct dm_btree_value_type *vt, unsigned left_index) + { + int r; + struct btree_node *parent; +@@ -244,11 +237,11 @@ static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info, + + parent = dm_block_data(shadow_current(s)); + +- r = init_child(info, parent, left_index, &left); ++ r = init_child(info, vt, parent, left_index, &left); + if (r) + return r; + +- r = init_child(info, parent, left_index + 1, &right); ++ r = init_child(info, vt, parent, left_index + 1, &right); + if (r) { + exit_child(info, &left); + return r; +@@ -368,7 +361,7 @@ static void __rebalance3(struct dm_btree_info *info, struct btree_node *parent, + } + + static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info, +- unsigned left_index) ++ struct dm_btree_value_type *vt, unsigned left_index) + { + int r; + struct btree_node *parent = dm_block_data(shadow_current(s)); +@@ -377,17 +370,17 @@ static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info, + /* + * FIXME: fill out an array? + */ +- r = init_child(info, parent, left_index, &left); ++ r = init_child(info, vt, parent, left_index, &left); + if (r) + return r; + +- r = init_child(info, parent, left_index + 1, ¢er); ++ r = init_child(info, vt, parent, left_index + 1, ¢er); + if (r) { + exit_child(info, &left); + return r; + } + +- r = init_child(info, parent, left_index + 2, &right); ++ r = init_child(info, vt, parent, left_index + 2, &right); + if (r) { + exit_child(info, &left); + exit_child(info, ¢er); +@@ -434,7 +427,8 @@ static int get_nr_entries(struct dm_transaction_manager *tm, + } + + static int rebalance_children(struct shadow_spine *s, +- struct dm_btree_info *info, uint64_t key) ++ struct dm_btree_info *info, ++ struct dm_btree_value_type *vt, uint64_t key) + { + int i, r, has_left_sibling, has_right_sibling; + uint32_t child_entries; +@@ -472,13 +466,13 @@ static int rebalance_children(struct shadow_spine *s, + has_right_sibling = i < (le32_to_cpu(n->header.nr_entries) - 1); + + if (!has_left_sibling) +- r = rebalance2(s, info, i); ++ r = rebalance2(s, info, vt, i); + + else if (!has_right_sibling) +- r = rebalance2(s, info, i - 1); ++ r = rebalance2(s, info, vt, i - 1); + + else +- r = rebalance3(s, info, i - 1); ++ r = rebalance3(s, info, vt, i - 1); + + return r; + } +@@ -529,7 +523,7 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info, + if (le32_to_cpu(n->header.flags) & LEAF_NODE) + return do_leaf(n, key, index); + +- r = rebalance_children(s, info, key); ++ r = rebalance_children(s, info, vt, key); + if (r) + break; + +@@ -550,6 +544,14 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info, + return r; + } + ++static struct dm_btree_value_type le64_type = { ++ .context = NULL, ++ .size = sizeof(__le64), ++ .inc = NULL, ++ .dec = NULL, ++ .equal = NULL ++}; ++ + int dm_btree_remove(struct dm_btree_info *info, dm_block_t root, + uint64_t *keys, dm_block_t *new_root) + { +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 202ae34..63e3c47 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1715,6 +1715,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + + bond_compute_features(bond); + ++ bond_update_speed_duplex(new_slave); ++ + read_lock(&bond->lock); + + new_slave->last_arp_rx = jiffies; +@@ -1758,8 +1760,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + new_slave->link = BOND_LINK_DOWN; + } + +- bond_update_speed_duplex(new_slave); +- + if (USES_PRIMARY(bond->params.mode) && bond->params.primary[0]) { + /* if there is a primary slave, remember it */ + if (strcmp(bond->params.primary, new_slave->dev->name) == 0) { +@@ -2437,8 +2437,6 @@ static void bond_miimon_commit(struct bonding *bond) + bond_set_backup_slave(slave); + } + +- bond_update_speed_duplex(slave); +- + pr_info("%s: link status definitely up for interface %s, %u Mbps %s duplex.\n", + bond->dev->name, slave->dev->name, + slave->speed, slave->duplex ? "full" : "half"); +diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c +index a6611f1..5d5a05f 100644 +--- a/drivers/net/ethernet/sfc/efx.c ++++ b/drivers/net/ethernet/sfc/efx.c +@@ -650,25 +650,30 @@ static void efx_fini_channels(struct efx_nic *efx) + struct efx_channel *channel; + struct efx_tx_queue *tx_queue; + struct efx_rx_queue *rx_queue; ++ struct pci_dev *dev = efx->pci_dev; + int rc; + + EFX_ASSERT_RESET_SERIALISED(efx); + BUG_ON(efx->port_enabled); + +- rc = efx_nic_flush_queues(efx); +- if (rc && EFX_WORKAROUND_7803(efx)) { +- /* Schedule a reset to recover from the flush failure. The +- * descriptor caches reference memory we're about to free, +- * but falcon_reconfigure_mac_wrapper() won't reconnect +- * the MACs because of the pending reset. */ +- netif_err(efx, drv, efx->net_dev, +- "Resetting to recover from flush failure\n"); +- efx_schedule_reset(efx, RESET_TYPE_ALL); +- } else if (rc) { +- netif_err(efx, drv, efx->net_dev, "failed to flush queues\n"); +- } else { +- netif_dbg(efx, drv, efx->net_dev, +- "successfully flushed all queues\n"); ++ /* Only perform flush if dma is enabled */ ++ if (dev->is_busmaster) { ++ rc = efx_nic_flush_queues(efx); ++ ++ if (rc && EFX_WORKAROUND_7803(efx)) { ++ /* Schedule a reset to recover from the flush failure. The ++ * descriptor caches reference memory we're about to free, ++ * but falcon_reconfigure_mac_wrapper() won't reconnect ++ * the MACs because of the pending reset. */ ++ netif_err(efx, drv, efx->net_dev, ++ "Resetting to recover from flush failure\n"); ++ efx_schedule_reset(efx, RESET_TYPE_ALL); ++ } else if (rc) { ++ netif_err(efx, drv, efx->net_dev, "failed to flush queues\n"); ++ } else { ++ netif_dbg(efx, drv, efx->net_dev, ++ "successfully flushed all queues\n"); ++ } + } + + efx_for_each_channel(channel, efx) { +@@ -714,6 +719,7 @@ efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries) + unsigned i; + int rc; + ++ efx_device_detach_sync(efx); + efx_stop_all(efx); + efx_fini_channels(efx); + +@@ -757,6 +763,7 @@ out: + + efx_init_channels(efx); + efx_start_all(efx); ++ netif_device_attach(efx->net_dev); + return rc; + + rollback: +@@ -1525,8 +1532,12 @@ static void efx_stop_all(struct efx_nic *efx) + /* Flush efx_mac_work(), refill_workqueue, monitor_work */ + efx_flush_all(efx); + +- /* Stop the kernel transmit interface late, so the watchdog +- * timer isn't ticking over the flush */ ++ /* Stop the kernel transmit interface. This is only valid if ++ * the device is stopped or detached; otherwise the watchdog ++ * may fire immediately. ++ */ ++ WARN_ON(netif_running(efx->net_dev) && ++ netif_device_present(efx->net_dev)); + if (efx_dev_registered(efx)) { + netif_tx_stop_all_queues(efx->net_dev); + netif_tx_lock_bh(efx->net_dev); +@@ -1827,10 +1838,11 @@ static int efx_change_mtu(struct net_device *net_dev, int new_mtu) + if (new_mtu > EFX_MAX_MTU) + return -EINVAL; + +- efx_stop_all(efx); +- + netif_dbg(efx, drv, efx->net_dev, "changing MTU to %d\n", new_mtu); + ++ efx_device_detach_sync(efx); ++ efx_stop_all(efx); ++ + efx_fini_channels(efx); + + mutex_lock(&efx->mac_lock); +@@ -1843,6 +1855,7 @@ static int efx_change_mtu(struct net_device *net_dev, int new_mtu) + efx_init_channels(efx); + + efx_start_all(efx); ++ netif_device_attach(efx->net_dev); + return rc; + } + +@@ -2132,7 +2145,7 @@ int efx_reset(struct efx_nic *efx, enum reset_type method) + netif_info(efx, drv, efx->net_dev, "resetting (%s)\n", + RESET_TYPE(method)); + +- netif_device_detach(efx->net_dev); ++ efx_device_detach_sync(efx); + efx_reset_down(efx, method); + + rc = efx->type->reset(efx, method); +@@ -2580,7 +2593,7 @@ static int efx_pm_freeze(struct device *dev) + + efx->state = STATE_FINI; + +- netif_device_detach(efx->net_dev); ++ efx_device_detach_sync(efx); + + efx_stop_all(efx); + efx_fini_channels(efx); +diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h +index 1355245..9668d29 100644 +--- a/drivers/net/ethernet/sfc/efx.h ++++ b/drivers/net/ethernet/sfc/efx.h +@@ -149,4 +149,17 @@ extern void efx_link_status_changed(struct efx_nic *efx); + extern void efx_link_set_advertising(struct efx_nic *efx, u32); + extern void efx_link_set_wanted_fc(struct efx_nic *efx, u8); + ++static inline void efx_device_detach_sync(struct efx_nic *efx) ++{ ++ struct net_device *dev = efx->net_dev; ++ ++ /* Lock/freeze all TX queues so that we can be sure the ++ * TX scheduler is stopped when we're done and before ++ * netif_device_present() becomes false. ++ */ ++ netif_tx_lock_bh(dev); ++ netif_device_detach(dev); ++ netif_tx_unlock_bh(dev); ++} ++ + #endif /* EFX_EFX_H */ +diff --git a/drivers/net/ethernet/sfc/falcon.c b/drivers/net/ethernet/sfc/falcon.c +index 97b606b..26cd6c0 100644 +--- a/drivers/net/ethernet/sfc/falcon.c ++++ b/drivers/net/ethernet/sfc/falcon.c +@@ -1762,6 +1762,7 @@ const struct efx_nic_type falcon_a1_nic_type = { + .remove_port = falcon_remove_port, + .handle_global_event = falcon_handle_global_event, + .prepare_flush = falcon_prepare_flush, ++ .finish_flush = efx_port_dummy_op_void, + .update_stats = falcon_update_nic_stats, + .start_stats = falcon_start_nic_stats, + .stop_stats = falcon_stop_nic_stats, +@@ -1804,6 +1805,7 @@ const struct efx_nic_type falcon_b0_nic_type = { + .remove_port = falcon_remove_port, + .handle_global_event = falcon_handle_global_event, + .prepare_flush = falcon_prepare_flush, ++ .finish_flush = efx_port_dummy_op_void, + .update_stats = falcon_update_nic_stats, + .start_stats = falcon_start_nic_stats, + .stop_stats = falcon_stop_nic_stats, +diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c +index 81a4253..c1000ce 100644 +--- a/drivers/net/ethernet/sfc/mcdi.c ++++ b/drivers/net/ethernet/sfc/mcdi.c +@@ -30,7 +30,7 @@ + #define REBOOT_FLAG_PORT0 0x3f8 + #define REBOOT_FLAG_PORT1 0x3fc + +-#define MCDI_RPC_TIMEOUT 10 /*seconds */ ++#define MCDI_RPC_TIMEOUT (10 * HZ) + + #define MCDI_PDU(efx) \ + (efx_port_num(efx) ? CMD_PDU_PORT1 : CMD_PDU_PORT0) +@@ -120,7 +120,7 @@ static void efx_mcdi_copyout(struct efx_nic *efx, u8 *outbuf, size_t outlen) + static int efx_mcdi_poll(struct efx_nic *efx) + { + struct efx_mcdi_iface *mcdi = efx_mcdi(efx); +- unsigned int time, finish; ++ unsigned long time, finish; + unsigned int respseq, respcmd, error; + unsigned int pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx); + unsigned int rc, spins; +@@ -136,7 +136,7 @@ static int efx_mcdi_poll(struct efx_nic *efx) + * and poll once a jiffy (approximately) + */ + spins = TICK_USEC; +- finish = get_seconds() + MCDI_RPC_TIMEOUT; ++ finish = jiffies + MCDI_RPC_TIMEOUT; + + while (1) { + if (spins != 0) { +@@ -146,7 +146,7 @@ static int efx_mcdi_poll(struct efx_nic *efx) + schedule_timeout_uninterruptible(1); + } + +- time = get_seconds(); ++ time = jiffies; + + rmb(); + efx_readd(efx, ®, pdu); +@@ -158,7 +158,7 @@ static int efx_mcdi_poll(struct efx_nic *efx) + EFX_DWORD_FIELD(reg, MCDI_HEADER_RESPONSE)) + break; + +- if (time >= finish) ++ if (time_after(time, finish)) + return -ETIMEDOUT; + } + +@@ -250,7 +250,7 @@ static int efx_mcdi_await_completion(struct efx_nic *efx) + if (wait_event_timeout( + mcdi->wq, + atomic_read(&mcdi->state) == MCDI_STATE_COMPLETED, +- msecs_to_jiffies(MCDI_RPC_TIMEOUT * 1000)) == 0) ++ MCDI_RPC_TIMEOUT) == 0) + return -ETIMEDOUT; + + /* Check if efx_mcdi_set_mode() switched us back to polled completions. +@@ -666,9 +666,8 @@ int efx_mcdi_get_board_cfg(struct efx_nic *efx, u8 *mac_address, + u16 *fw_subtype_list) + { + uint8_t outbuf[MC_CMD_GET_BOARD_CFG_OUT_LEN]; +- size_t outlen; ++ size_t outlen, offset, i; + int port_num = efx_port_num(efx); +- int offset; + int rc; + + BUILD_BUG_ON(MC_CMD_GET_BOARD_CFG_IN_LEN != 0); +@@ -688,10 +687,16 @@ int efx_mcdi_get_board_cfg(struct efx_nic *efx, u8 *mac_address, + : MC_CMD_GET_BOARD_CFG_OUT_MAC_ADDR_BASE_PORT0_OFST; + if (mac_address) + memcpy(mac_address, outbuf + offset, ETH_ALEN); +- if (fw_subtype_list) +- memcpy(fw_subtype_list, +- outbuf + MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_OFST, +- MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_LEN); ++ if (fw_subtype_list) { ++ offset = MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_OFST; ++ for (i = 0; ++ i < MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_LEN / 2; ++ i++) { ++ fw_subtype_list[i] = ++ le16_to_cpup((__le16 *)(outbuf + offset)); ++ offset += 2; ++ } ++ } + + return 0; + +diff --git a/drivers/net/ethernet/sfc/mcdi.h b/drivers/net/ethernet/sfc/mcdi.h +index aced2a7..b61eea0 100644 +--- a/drivers/net/ethernet/sfc/mcdi.h ++++ b/drivers/net/ethernet/sfc/mcdi.h +@@ -126,5 +126,6 @@ extern int efx_mcdi_wol_filter_set_magic(struct efx_nic *efx, + extern int efx_mcdi_wol_filter_get_magic(struct efx_nic *efx, int *id_out); + extern int efx_mcdi_wol_filter_remove(struct efx_nic *efx, int id); + extern int efx_mcdi_wol_filter_reset(struct efx_nic *efx); ++extern int efx_mcdi_set_mac(struct efx_nic *efx); + + #endif /* EFX_MCDI_H */ +diff --git a/drivers/net/ethernet/sfc/mcdi_mac.c b/drivers/net/ethernet/sfc/mcdi_mac.c +index 50c2077..da269d7 100644 +--- a/drivers/net/ethernet/sfc/mcdi_mac.c ++++ b/drivers/net/ethernet/sfc/mcdi_mac.c +@@ -13,7 +13,7 @@ + #include "mcdi.h" + #include "mcdi_pcol.h" + +-static int efx_mcdi_set_mac(struct efx_nic *efx) ++int efx_mcdi_set_mac(struct efx_nic *efx) + { + u32 reject, fcntl; + u8 cmdbytes[MC_CMD_SET_MAC_IN_LEN]; +@@ -45,6 +45,8 @@ static int efx_mcdi_set_mac(struct efx_nic *efx) + } + if (efx->wanted_fc & EFX_FC_AUTO) + fcntl = MC_CMD_FCNTL_AUTO; ++ if (efx->fc_disable) ++ fcntl = MC_CMD_FCNTL_OFF; + + MCDI_SET_DWORD(cmdbytes, SET_MAC_IN_FCNTL, fcntl); + +diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h +index b8e251a..8bcb8fd 100644 +--- a/drivers/net/ethernet/sfc/net_driver.h ++++ b/drivers/net/ethernet/sfc/net_driver.h +@@ -213,6 +213,7 @@ struct efx_tx_queue { + * If both this and page are %NULL, the buffer slot is currently free. + * @page: The associated page buffer, if any. + * If both this and skb are %NULL, the buffer slot is currently free. ++ * @page_offset: Offset within page. Valid iff @flags & %EFX_RX_BUF_PAGE. + * @len: Buffer length, in bytes. + * @is_page: Indicates if @page is valid. If false, @skb is valid. + */ +@@ -222,7 +223,8 @@ struct efx_rx_buffer { + struct sk_buff *skb; + struct page *page; + } u; +- unsigned int len; ++ u16 page_offset; ++ u16 len; + bool is_page; + }; + +@@ -689,6 +691,9 @@ struct efx_filter_state; + * @promiscuous: Promiscuous flag. Protected by netif_tx_lock. + * @multicast_hash: Multicast hash table + * @wanted_fc: Wanted flow control flags ++ * @fc_disable: When non-zero flow control is disabled. Typically used to ++ * ensure that network back pressure doesn't delay dma queue flushes. ++ * Serialised by the rtnl lock. + * @mac_work: Work item for changing MAC promiscuity and multicast hash + * @loopback_mode: Loopback status + * @loopback_modes: Supported loopback mode bitmask +@@ -782,6 +787,7 @@ struct efx_nic { + bool promiscuous; + union efx_multicast_hash multicast_hash; + u8 wanted_fc; ++ unsigned fc_disable; + + atomic_t rx_reset; + enum efx_loopback_mode loopback_mode; +@@ -835,6 +841,7 @@ static inline unsigned int efx_port_num(struct efx_nic *efx) + * @remove_port: Free resources allocated by probe_port() + * @handle_global_event: Handle a "global" event (may be %NULL) + * @prepare_flush: Prepare the hardware for flushing the DMA queues ++ * @finish_flush: Clean up after flushing the DMA queues + * @update_stats: Update statistics not provided by event handling + * @start_stats: Start the regular fetching of statistics + * @stop_stats: Stop the regular fetching of statistics +@@ -880,6 +887,7 @@ struct efx_nic_type { + void (*remove_port)(struct efx_nic *efx); + bool (*handle_global_event)(struct efx_channel *channel, efx_qword_t *); + void (*prepare_flush)(struct efx_nic *efx); ++ void (*finish_flush)(struct efx_nic *efx); + void (*update_stats)(struct efx_nic *efx); + void (*start_stats)(struct efx_nic *efx); + void (*stop_stats)(struct efx_nic *efx); +diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c +index 3edfbaf..2e9ca10 100644 +--- a/drivers/net/ethernet/sfc/nic.c ++++ b/drivers/net/ethernet/sfc/nic.c +@@ -371,7 +371,8 @@ efx_may_push_tx_desc(struct efx_tx_queue *tx_queue, unsigned int write_count) + return false; + + tx_queue->empty_read_count = 0; +- return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0; ++ return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0 ++ && tx_queue->write_count - write_count == 1; + } + + /* For each entry inserted into the software descriptor ring, create a +@@ -1261,13 +1262,27 @@ int efx_nic_flush_queues(struct efx_nic *efx) + } + efx_for_each_possible_channel_tx_queue(tx_queue, channel) { + if (tx_queue->initialised && +- tx_queue->flushed != FLUSH_DONE) +- ++tx_pending; ++ tx_queue->flushed != FLUSH_DONE) { ++ efx_oword_t txd_ptr_tbl; ++ ++ efx_reado_table(efx, &txd_ptr_tbl, ++ FR_BZ_TX_DESC_PTR_TBL, ++ tx_queue->queue); ++ if (EFX_OWORD_FIELD(txd_ptr_tbl, ++ FRF_AZ_TX_DESCQ_FLUSH) || ++ EFX_OWORD_FIELD(txd_ptr_tbl, ++ FRF_AZ_TX_DESCQ_EN)) ++ ++tx_pending; ++ else ++ tx_queue->flushed = FLUSH_DONE; ++ } + } + } + +- if (rx_pending == 0 && tx_pending == 0) ++ if (rx_pending == 0 && tx_pending == 0) { ++ efx->type->finish_flush(efx); + return 0; ++ } + + msleep(EFX_FLUSH_INTERVAL); + efx_poll_flush_events(efx); +@@ -1293,6 +1308,7 @@ int efx_nic_flush_queues(struct efx_nic *efx) + } + } + ++ efx->type->finish_flush(efx); + return -ETIMEDOUT; + } + +diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h +index 66ece48..58302a2 100644 +--- a/drivers/net/ethernet/sfc/nic.h ++++ b/drivers/net/ethernet/sfc/nic.h +@@ -210,6 +210,8 @@ extern void falcon_irq_ack_a1(struct efx_nic *efx); + + /* Global Resources */ + extern int efx_nic_flush_queues(struct efx_nic *efx); ++extern void siena_prepare_flush(struct efx_nic *efx); ++extern void siena_finish_flush(struct efx_nic *efx); + extern void falcon_start_nic_stats(struct efx_nic *efx); + extern void falcon_stop_nic_stats(struct efx_nic *efx); + extern void falcon_setup_xaui(struct efx_nic *efx); +diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c +index 5ef4cc0..9ce8665 100644 +--- a/drivers/net/ethernet/sfc/rx.c ++++ b/drivers/net/ethernet/sfc/rx.c +@@ -95,11 +95,7 @@ static unsigned int rx_refill_limit = 95; + static inline unsigned int efx_rx_buf_offset(struct efx_nic *efx, + struct efx_rx_buffer *buf) + { +- /* Offset is always within one page, so we don't need to consider +- * the page order. +- */ +- return (((__force unsigned long) buf->dma_addr & (PAGE_SIZE - 1)) + +- efx->type->rx_buffer_hash_size); ++ return buf->page_offset + efx->type->rx_buffer_hash_size; + } + static inline unsigned int efx_rx_buf_size(struct efx_nic *efx) + { +@@ -194,6 +190,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue) + struct efx_rx_buffer *rx_buf; + struct page *page; + void *page_addr; ++ unsigned int page_offset; + struct efx_rx_page_state *state; + dma_addr_t dma_addr; + unsigned index, count; +@@ -220,12 +217,14 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue) + + page_addr += sizeof(struct efx_rx_page_state); + dma_addr += sizeof(struct efx_rx_page_state); ++ page_offset = sizeof(struct efx_rx_page_state); + + split: + index = rx_queue->added_count & rx_queue->ptr_mask; + rx_buf = efx_rx_buffer(rx_queue, index); + rx_buf->dma_addr = dma_addr + EFX_PAGE_IP_ALIGN; + rx_buf->u.page = page; ++ rx_buf->page_offset = page_offset + EFX_PAGE_IP_ALIGN; + rx_buf->len = efx->rx_buffer_len - EFX_PAGE_IP_ALIGN; + rx_buf->is_page = true; + ++rx_queue->added_count; +@@ -237,6 +236,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue) + get_page(page); + dma_addr += (PAGE_SIZE >> 1); + page_addr += (PAGE_SIZE >> 1); ++ page_offset += (PAGE_SIZE >> 1); + ++count; + goto split; + } +@@ -246,7 +246,8 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue) + } + + static void efx_unmap_rx_buffer(struct efx_nic *efx, +- struct efx_rx_buffer *rx_buf) ++ struct efx_rx_buffer *rx_buf, ++ unsigned int used_len) + { + if (rx_buf->is_page && rx_buf->u.page) { + struct efx_rx_page_state *state; +@@ -257,6 +258,10 @@ static void efx_unmap_rx_buffer(struct efx_nic *efx, + state->dma_addr, + efx_rx_buf_size(efx), + PCI_DMA_FROMDEVICE); ++ } else if (used_len) { ++ dma_sync_single_for_cpu(&efx->pci_dev->dev, ++ rx_buf->dma_addr, used_len, ++ DMA_FROM_DEVICE); + } + } else if (!rx_buf->is_page && rx_buf->u.skb) { + pci_unmap_single(efx->pci_dev, rx_buf->dma_addr, +@@ -279,7 +284,7 @@ static void efx_free_rx_buffer(struct efx_nic *efx, + static void efx_fini_rx_buffer(struct efx_rx_queue *rx_queue, + struct efx_rx_buffer *rx_buf) + { +- efx_unmap_rx_buffer(rx_queue->efx, rx_buf); ++ efx_unmap_rx_buffer(rx_queue->efx, rx_buf, 0); + efx_free_rx_buffer(rx_queue->efx, rx_buf); + } + +@@ -550,10 +555,10 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index, + goto out; + } + +- /* Release card resources - assumes all RX buffers consumed in-order +- * per RX queue ++ /* Release and/or sync DMA mapping - assumes all RX buffers ++ * consumed in-order per RX queue + */ +- efx_unmap_rx_buffer(efx, rx_buf); ++ efx_unmap_rx_buffer(efx, rx_buf, len); + + /* Prefetch nice and early so data will (hopefully) be in cache by + * the time we look at it. +diff --git a/drivers/net/ethernet/sfc/selftest.c b/drivers/net/ethernet/sfc/selftest.c +index 822f6c2..4907885 100644 +--- a/drivers/net/ethernet/sfc/selftest.c ++++ b/drivers/net/ethernet/sfc/selftest.c +@@ -698,7 +698,7 @@ int efx_selftest(struct efx_nic *efx, struct efx_self_tests *tests, + /* Detach the device so the kernel doesn't transmit during the + * loopback test and the watchdog timeout doesn't fire. + */ +- netif_device_detach(efx->net_dev); ++ efx_device_detach_sync(efx); + + mutex_lock(&efx->mac_lock); + if (efx->loopback_modes) { +diff --git a/drivers/net/ethernet/sfc/siena.c b/drivers/net/ethernet/sfc/siena.c +index cc2549c..c58b973 100644 +--- a/drivers/net/ethernet/sfc/siena.c ++++ b/drivers/net/ethernet/sfc/siena.c +@@ -137,6 +137,18 @@ static void siena_remove_port(struct efx_nic *efx) + efx_nic_free_buffer(efx, &efx->stats_buffer); + } + ++void siena_prepare_flush(struct efx_nic *efx) ++{ ++ if (efx->fc_disable++ == 0) ++ efx_mcdi_set_mac(efx); ++} ++ ++void siena_finish_flush(struct efx_nic *efx) ++{ ++ if (--efx->fc_disable == 0) ++ efx_mcdi_set_mac(efx); ++} ++ + static const struct efx_nic_register_test siena_register_tests[] = { + { FR_AZ_ADR_REGION, + EFX_OWORD32(0x0003FFFF, 0x0003FFFF, 0x0003FFFF, 0x0003FFFF) }, +@@ -624,7 +636,8 @@ const struct efx_nic_type siena_a0_nic_type = { + .reset = siena_reset_hw, + .probe_port = siena_probe_port, + .remove_port = siena_remove_port, +- .prepare_flush = efx_port_dummy_op_void, ++ .prepare_flush = siena_prepare_flush, ++ .finish_flush = siena_finish_flush, + .update_stats = siena_update_nic_stats, + .start_stats = siena_start_nic_stats, + .stop_stats = siena_stop_nic_stats, +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 97f342e..544ac06 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -585,6 +585,7 @@ void macvlan_common_setup(struct net_device *dev) + ether_setup(dev); + + dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING); ++ dev->priv_flags |= IFF_UNICAST_FLT; + dev->netdev_ops = &macvlan_netdev_ops; + dev->destructor = free_netdev; + dev->header_ops = &macvlan_hard_header_ops, +diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c +index 01b104e..bff6908 100644 +--- a/drivers/net/netconsole.c ++++ b/drivers/net/netconsole.c +@@ -630,6 +630,7 @@ static int netconsole_netdev_event(struct notifier_block *this, + goto done; + + spin_lock_irqsave(&target_list_lock, flags); ++restart: + list_for_each_entry(nt, &target_list, list) { + netconsole_target_get(nt); + if (nt->np.dev == dev) { +@@ -642,20 +643,17 @@ static int netconsole_netdev_event(struct notifier_block *this, + case NETDEV_UNREGISTER: + /* + * rtnl_lock already held ++ * we might sleep in __netpoll_cleanup() + */ +- if (nt->np.dev) { +- spin_unlock_irqrestore( +- &target_list_lock, +- flags); +- __netpoll_cleanup(&nt->np); +- spin_lock_irqsave(&target_list_lock, +- flags); +- dev_put(nt->np.dev); +- nt->np.dev = NULL; +- } ++ spin_unlock_irqrestore(&target_list_lock, flags); ++ __netpoll_cleanup(&nt->np); ++ spin_lock_irqsave(&target_list_lock, flags); ++ dev_put(nt->np.dev); ++ nt->np.dev = NULL; + nt->enabled = 0; + stopped = true; +- break; ++ netconsole_target_put(nt); ++ goto restart; + } + } + netconsole_target_put(nt); +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index a12c9bf..f4c5de6 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -417,6 +417,8 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev) + * for indefinite time. */ + skb_orphan(skb); + ++ nf_reset(skb); ++ + /* Enqueue packet */ + skb_queue_tail(&tun->socket.sk->sk_receive_queue, skb); + +diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c +index 62b4c29..d48dfb7 100644 +--- a/drivers/net/wireless/mwifiex/join.c ++++ b/drivers/net/wireless/mwifiex/join.c +@@ -1062,10 +1062,9 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mwifiex_private *priv, + adhoc_join->bss_descriptor.bssid, + adhoc_join->bss_descriptor.ssid); + +- for (i = 0; bss_desc->supported_rates[i] && +- i < MWIFIEX_SUPPORTED_RATES; +- i++) +- ; ++ for (i = 0; i < MWIFIEX_SUPPORTED_RATES && ++ bss_desc->supported_rates[i]; i++) ++ ; + rates_size = i; + + /* Copy Data Rates from the Rates recorded in scan response */ +diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c +index 814c05d..d3920da 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c +@@ -1557,74 +1557,57 @@ void rtl92cu_card_disable(struct ieee80211_hw *hw) + + void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid) + { +- /* dummy routine needed for callback from rtl_op_configure_filter() */ +-} +- +-/*========================================================================== */ +- +-static void _rtl92cu_set_check_bssid(struct ieee80211_hw *hw, +- enum nl80211_iftype type) +-{ + struct rtl_priv *rtlpriv = rtl_priv(hw); +- u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR); + struct rtl_hal *rtlhal = rtl_hal(rtlpriv); +- struct rtl_phy *rtlphy = &(rtlpriv->phy); +- u8 filterout_non_associated_bssid = false; ++ u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR); + +- switch (type) { +- case NL80211_IFTYPE_ADHOC: +- case NL80211_IFTYPE_STATION: +- filterout_non_associated_bssid = true; +- break; +- case NL80211_IFTYPE_UNSPECIFIED: +- case NL80211_IFTYPE_AP: +- default: +- break; +- } +- if (filterout_non_associated_bssid) { ++ if (rtlpriv->psc.rfpwr_state != ERFON) ++ return; ++ ++ if (check_bssid) { ++ u8 tmp; + if (IS_NORMAL_CHIP(rtlhal->version)) { +- switch (rtlphy->current_io_type) { +- case IO_CMD_RESUME_DM_BY_SCAN: +- reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN); +- rtlpriv->cfg->ops->set_hw_reg(hw, +- HW_VAR_RCR, (u8 *)(®_rcr)); +- /* enable update TSF */ +- _rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4)); +- break; +- case IO_CMD_PAUSE_DM_BY_SCAN: +- reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN); +- rtlpriv->cfg->ops->set_hw_reg(hw, +- HW_VAR_RCR, (u8 *)(®_rcr)); +- /* disable update TSF */ +- _rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0); +- break; +- } ++ reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN); ++ tmp = BIT(4); + } else { +- reg_rcr |= (RCR_CBSSID); +- rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR, +- (u8 *)(®_rcr)); +- _rtl92cu_set_bcn_ctrl_reg(hw, 0, (BIT(4)|BIT(5))); ++ reg_rcr |= RCR_CBSSID; ++ tmp = BIT(4) | BIT(5); + } +- } else if (filterout_non_associated_bssid == false) { ++ rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR, ++ (u8 *) (®_rcr)); ++ _rtl92cu_set_bcn_ctrl_reg(hw, 0, tmp); ++ } else { ++ u8 tmp; + if (IS_NORMAL_CHIP(rtlhal->version)) { +- reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN)); +- rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR, +- (u8 *)(®_rcr)); +- _rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0); ++ reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN); ++ tmp = BIT(4); + } else { +- reg_rcr &= (~RCR_CBSSID); +- rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR, +- (u8 *)(®_rcr)); +- _rtl92cu_set_bcn_ctrl_reg(hw, (BIT(4)|BIT(5)), 0); ++ reg_rcr &= ~RCR_CBSSID; ++ tmp = BIT(4) | BIT(5); + } ++ reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN)); ++ rtlpriv->cfg->ops->set_hw_reg(hw, ++ HW_VAR_RCR, (u8 *) (®_rcr)); ++ _rtl92cu_set_bcn_ctrl_reg(hw, tmp, 0); + } + } + ++/*========================================================================== */ ++ + int rtl92cu_set_network_type(struct ieee80211_hw *hw, enum nl80211_iftype type) + { ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ + if (_rtl92cu_set_media_status(hw, type)) + return -EOPNOTSUPP; +- _rtl92cu_set_check_bssid(hw, type); ++ ++ if (rtlpriv->mac80211.link_state == MAC80211_LINKED) { ++ if (type != NL80211_IFTYPE_AP) ++ rtl92cu_set_check_bssid(hw, true); ++ } else { ++ rtl92cu_set_check_bssid(hw, false); ++ } ++ + return 0; + } + +@@ -2238,8 +2221,6 @@ void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw, + (shortgi_rate << 4) | (shortgi_rate); + } + rtl_write_dword(rtlpriv, REG_ARFR0 + ratr_index * 4, ratr_value); +- RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, ("%x\n", rtl_read_dword(rtlpriv, +- REG_ARFR0))); + } + + void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level) +diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c +index e18604b..d19b879 100644 +--- a/drivers/tty/pty.c ++++ b/drivers/tty/pty.c +@@ -49,7 +49,6 @@ static void pty_close(struct tty_struct *tty, struct file *filp) + tty->packet = 0; + if (!tty->link) + return; +- tty->link->packet = 0; + set_bit(TTY_OTHER_CLOSED, &tty->link->flags); + wake_up_interruptible(&tty->link->read_wait); + wake_up_interruptible(&tty->link->write_wait); +diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c +index ad0f8f5..2dc4d9b 100644 +--- a/drivers/tty/serial/sunsu.c ++++ b/drivers/tty/serial/sunsu.c +@@ -968,6 +968,7 @@ static struct uart_ops sunsu_pops = { + #define UART_NR 4 + + static struct uart_sunsu_port sunsu_ports[UART_NR]; ++static int nr_inst; /* Number of already registered ports */ + + #ifdef CONFIG_SERIO + +@@ -1337,13 +1338,8 @@ static int __init sunsu_console_setup(struct console *co, char *options) + printk("Console: ttyS%d (SU)\n", + (sunsu_reg.minor - 64) + co->index); + +- /* +- * Check whether an invalid uart number has been specified, and +- * if so, search for the first available port that does have +- * console support. +- */ +- if (co->index >= UART_NR) +- co->index = 0; ++ if (co->index > nr_inst) ++ return -ENODEV; + port = &sunsu_ports[co->index].port; + + /* +@@ -1408,7 +1404,6 @@ static enum su_type __devinit su_get_type(struct device_node *dp) + + static int __devinit su_probe(struct platform_device *op) + { +- static int inst; + struct device_node *dp = op->dev.of_node; + struct uart_sunsu_port *up; + struct resource *rp; +@@ -1418,16 +1413,16 @@ static int __devinit su_probe(struct platform_device *op) + + type = su_get_type(dp); + if (type == SU_PORT_PORT) { +- if (inst >= UART_NR) ++ if (nr_inst >= UART_NR) + return -EINVAL; +- up = &sunsu_ports[inst]; ++ up = &sunsu_ports[nr_inst]; + } else { + up = kzalloc(sizeof(*up), GFP_KERNEL); + if (!up) + return -ENOMEM; + } + +- up->port.line = inst; ++ up->port.line = nr_inst; + + spin_lock_init(&up->port.lock); + +@@ -1461,6 +1456,8 @@ static int __devinit su_probe(struct platform_device *op) + } + dev_set_drvdata(&op->dev, up); + ++ nr_inst++; ++ + return 0; + } + +@@ -1488,7 +1485,7 @@ static int __devinit su_probe(struct platform_device *op) + + dev_set_drvdata(&op->dev, up); + +- inst++; ++ nr_inst++; + + return 0; + +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c +index 61d08dd..76be3ba 100644 +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -173,6 +173,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) + struct hc_driver *driver; + struct usb_hcd *hcd; + int retval; ++ int hcd_irq = 0; + + if (usb_disabled()) + return -ENODEV; +@@ -187,15 +188,19 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) + return -ENODEV; + dev->current_state = PCI_D0; + +- /* The xHCI driver supports MSI and MSI-X, +- * so don't fail if the BIOS doesn't provide a legacy IRQ. ++ /* ++ * The xHCI driver has its own irq management ++ * make sure irq setup is not touched for xhci in generic hcd code + */ +- if (!dev->irq && (driver->flags & HCD_MASK) != HCD_USB3) { +- dev_err(&dev->dev, +- "Found HC with no IRQ. Check BIOS/PCI %s setup!\n", +- pci_name(dev)); +- retval = -ENODEV; +- goto disable_pci; ++ if ((driver->flags & HCD_MASK) != HCD_USB3) { ++ if (!dev->irq) { ++ dev_err(&dev->dev, ++ "Found HC with no IRQ. Check BIOS/PCI %s setup!\n", ++ pci_name(dev)); ++ retval = -ENODEV; ++ goto disable_pci; ++ } ++ hcd_irq = dev->irq; + } + + hcd = usb_create_hcd(driver, &dev->dev, pci_name(dev)); +@@ -245,7 +250,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) + + pci_set_master(dev); + +- retval = usb_add_hcd(hcd, dev->irq, IRQF_SHARED); ++ retval = usb_add_hcd(hcd, hcd_irq, IRQF_SHARED); + if (retval != 0) + goto unmap_registers; + set_hs_companion(dev, hcd); +diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c +index 901924a..d433fdf 100644 +--- a/drivers/usb/gadget/udc-core.c ++++ b/drivers/usb/gadget/udc-core.c +@@ -213,7 +213,7 @@ static void usb_gadget_remove_driver(struct usb_udc *udc) + udc->driver->disconnect(udc->gadget); + usb_gadget_disconnect(udc->gadget); + udc->driver->unbind(udc->gadget); +- usb_gadget_udc_stop(udc->gadget, udc->driver); ++ usb_gadget_udc_stop(udc->gadget, NULL); + } else { + usb_gadget_stop(udc->gadget, udc->driver); + } +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 53c8be1..2c0350f 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -342,7 +342,7 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd) + * generate interrupts. Don't even try to enable MSI. + */ + if (xhci->quirks & XHCI_BROKEN_MSI) +- return 0; ++ goto legacy_irq; + + /* unregister the legacy interrupt */ + if (hcd->irq) +@@ -363,6 +363,7 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd) + return -EINVAL; + } + ++ legacy_irq: + /* fall back to legacy interrupt*/ + ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED, + hcd->irq_descr, hcd); +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index cc368c2..c519a31 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -206,8 +206,8 @@ struct xhci_op_regs { + /* bits 12:31 are reserved (and should be preserved on writes). */ + + /* IMAN - Interrupt Management Register */ +-#define IMAN_IP (1 << 1) +-#define IMAN_IE (1 << 0) ++#define IMAN_IE (1 << 1) ++#define IMAN_IP (1 << 0) + + /* USBSTS - USB status - status bitmasks */ + /* HC not running - set to 1 when run/stop bit is cleared. */ +diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c +index 1a49ca9..e664bac 100644 +--- a/drivers/usb/serial/garmin_gps.c ++++ b/drivers/usb/serial/garmin_gps.c +@@ -973,10 +973,7 @@ static void garmin_close(struct usb_serial_port *port) + if (!serial) + return; + +- mutex_lock(&port->serial->disc_mutex); +- +- if (!port->serial->disconnected) +- garmin_clear(garmin_data_p); ++ garmin_clear(garmin_data_p); + + /* shutdown our urbs */ + usb_kill_urb(port->read_urb); +@@ -985,8 +982,6 @@ static void garmin_close(struct usb_serial_port *port) + /* keep reset state so we know that we must start a new session */ + if (garmin_data_p->state != STATE_RESET) + garmin_data_p->state = STATE_DISCONNECTED; +- +- mutex_unlock(&port->serial->disc_mutex); + } + + +diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c +index 3de751d..1f145bf 100644 +--- a/drivers/usb/serial/io_ti.c ++++ b/drivers/usb/serial/io_ti.c +@@ -2796,6 +2796,7 @@ static struct usb_serial_driver edgeport_2port_device = { + .set_termios = edge_set_termios, + .tiocmget = edge_tiocmget, + .tiocmset = edge_tiocmset, ++ .get_icount = edge_get_icount, + .write = edge_write, + .write_room = edge_write_room, + .chars_in_buffer = edge_chars_in_buffer, +diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c +index dc1ce62..2482d5e 100644 +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -168,6 +168,7 @@ static void destroy_serial(struct kref *kref) + } + } + ++ usb_put_intf(serial->interface); + usb_put_dev(serial->dev); + kfree(serial); + } +@@ -624,7 +625,7 @@ static struct usb_serial *create_serial(struct usb_device *dev, + } + serial->dev = usb_get_dev(dev); + serial->type = driver; +- serial->interface = interface; ++ serial->interface = usb_get_intf(interface); + kref_init(&serial->kref); + mutex_init(&serial->disc_mutex); + serial->minor = SERIAL_TTY_NO_MINOR; +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index fa8a1b2..7b8d564 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -488,6 +488,13 @@ UNUSUAL_DEV( 0x04e8, 0x5122, 0x0000, 0x9999, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_MAX_SECTORS_64 | US_FL_BULK_IGNORE_TAG), + ++/* Added by Dmitry Artamonow <mad_soft@inbox.ru> */ ++UNUSUAL_DEV( 0x04e8, 0x5136, 0x0000, 0x9999, ++ "Samsung", ++ "YP-Z3", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_MAX_SECTORS_64), ++ + /* Entry and supporting patch by Theodore Kilgore <kilgota@auburn.edu>. + * Device uses standards-violating 32-byte Bulk Command Block Wrappers and + * reports itself as "Proprietary SCSI Bulk." Cf. device entry 0x084d:0x0011. +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index b76071e..5c58128 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -234,7 +234,8 @@ static void handle_tx(struct vhost_net *net) + msg.msg_controllen = 0; + ubufs = NULL; + } else { +- struct ubuf_info *ubuf = &vq->ubuf_info[head]; ++ struct ubuf_info *ubuf; ++ ubuf = vq->ubuf_info + vq->upend_idx; + + vq->heads[vq->upend_idx].len = len; + ubuf->callback = vhost_zerocopy_callback; +diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c +index cfd1ce3..1d36db1 100644 +--- a/fs/cifs/asn1.c ++++ b/fs/cifs/asn1.c +@@ -614,53 +614,10 @@ decode_negTokenInit(unsigned char *security_blob, int length, + } + } + +- /* mechlistMIC */ +- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) { +- /* Check if we have reached the end of the blob, but with +- no mechListMic (e.g. NTLMSSP instead of KRB5) */ +- if (ctx.error == ASN1_ERR_DEC_EMPTY) +- goto decode_negtoken_exit; +- cFYI(1, "Error decoding last part negTokenInit exit3"); +- return 0; +- } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) { +- /* tag = 3 indicating mechListMIC */ +- cFYI(1, "Exit 4 cls = %d con = %d tag = %d end = %p (%d)", +- cls, con, tag, end, *end); +- return 0; +- } +- +- /* sequence */ +- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) { +- cFYI(1, "Error decoding last part negTokenInit exit5"); +- return 0; +- } else if ((cls != ASN1_UNI) || (con != ASN1_CON) +- || (tag != ASN1_SEQ)) { +- cFYI(1, "cls = %d con = %d tag = %d end = %p (%d)", +- cls, con, tag, end, *end); +- } +- +- /* sequence of */ +- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) { +- cFYI(1, "Error decoding last part negTokenInit exit 7"); +- return 0; +- } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) { +- cFYI(1, "Exit 8 cls = %d con = %d tag = %d end = %p (%d)", +- cls, con, tag, end, *end); +- return 0; +- } +- +- /* general string */ +- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) { +- cFYI(1, "Error decoding last part negTokenInit exit9"); +- return 0; +- } else if ((cls != ASN1_UNI) || (con != ASN1_PRI) +- || (tag != ASN1_GENSTR)) { +- cFYI(1, "Exit10 cls = %d con = %d tag = %d end = %p (%d)", +- cls, con, tag, end, *end); +- return 0; +- } +- cFYI(1, "Need to call asn1_octets_decode() function for %s", +- ctx.pointer); /* is this UTF-8 or ASCII? */ +-decode_negtoken_exit: ++ /* ++ * We currently ignore anything at the end of the SPNEGO blob after ++ * the mechTypes have been parsed, since none of that info is ++ * used at the moment. ++ */ + return 1; + } +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index b3a2a40..25bb97f 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -90,6 +90,30 @@ extern mempool_t *cifs_sm_req_poolp; + extern mempool_t *cifs_req_poolp; + extern mempool_t *cifs_mid_poolp; + ++/* ++ * Bumps refcount for cifs super block. ++ * Note that it should be only called if a referece to VFS super block is ++ * already held, e.g. in open-type syscalls context. Otherwise it can race with ++ * atomic_dec_and_test in deactivate_locked_super. ++ */ ++void ++cifs_sb_active(struct super_block *sb) ++{ ++ struct cifs_sb_info *server = CIFS_SB(sb); ++ ++ if (atomic_inc_return(&server->active) == 1) ++ atomic_inc(&sb->s_active); ++} ++ ++void ++cifs_sb_deactive(struct super_block *sb) ++{ ++ struct cifs_sb_info *server = CIFS_SB(sb); ++ ++ if (atomic_dec_and_test(&server->active)) ++ deactivate_super(sb); ++} ++ + static int + cifs_read_super(struct super_block *sb) + { +diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h +index 30ff560..c91ea81 100644 +--- a/fs/cifs/cifsfs.h ++++ b/fs/cifs/cifsfs.h +@@ -41,6 +41,10 @@ extern struct file_system_type cifs_fs_type; + extern const struct address_space_operations cifs_addr_ops; + extern const struct address_space_operations cifs_addr_ops_smallbuf; + ++/* Functions related to super block operations */ ++extern void cifs_sb_active(struct super_block *sb); ++extern void cifs_sb_deactive(struct super_block *sb); ++ + /* Functions related to inodes */ + extern const struct inode_operations cifs_dir_inode_ops; + extern struct inode *cifs_root_iget(struct super_block *); +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 51574d4..c55808e 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -265,6 +265,8 @@ cifs_new_fileinfo(__u16 fileHandle, struct file *file, + mutex_init(&pCifsFile->fh_mutex); + INIT_WORK(&pCifsFile->oplock_break, cifs_oplock_break); + ++ cifs_sb_active(inode->i_sb); ++ + spin_lock(&cifs_file_list_lock); + list_add(&pCifsFile->tlist, &(tlink_tcon(tlink)->openFileList)); + /* if readable file instance put first in list*/ +@@ -293,7 +295,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file) + struct inode *inode = cifs_file->dentry->d_inode; + struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink); + struct cifsInodeInfo *cifsi = CIFS_I(inode); +- struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); ++ struct super_block *sb = inode->i_sb; ++ struct cifs_sb_info *cifs_sb = CIFS_SB(sb); + struct cifsLockInfo *li, *tmp; + + spin_lock(&cifs_file_list_lock); +@@ -345,6 +348,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file) + + cifs_put_tlink(cifs_file->tlink); + dput(cifs_file->dentry); ++ cifs_sb_deactive(sb); + kfree(cifs_file); + } + +diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c +index 484ffee..2845a1f 100644 +--- a/fs/ext4/balloc.c ++++ b/fs/ext4/balloc.c +@@ -571,7 +571,7 @@ ext4_fsblk_t ext4_count_free_clusters(struct super_block *sb) + brelse(bitmap_bh); + printk(KERN_DEBUG "ext4_count_free_clusters: stored = %llu" + ", computed = %llu, %llu\n", +- EXT4_B2C(EXT4_SB(sb), ext4_free_blocks_count(es)), ++ EXT4_NUM_B2C(EXT4_SB(sb), ext4_free_blocks_count(es)), + desc_count, bitmap_count); + return bitmap_count; + #else +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 8cb184c..60b6ca5 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -309,9 +309,9 @@ struct ext4_group_desc + */ + + struct flex_groups { +- atomic_t free_inodes; +- atomic_t free_clusters; +- atomic_t used_dirs; ++ atomic64_t free_clusters; ++ atomic_t free_inodes; ++ atomic_t used_dirs; + }; + + #define EXT4_BG_INODE_UNINIT 0x0001 /* Inode table/bitmap not in use */ +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index b48e0dc..ce0bc25 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -2960,6 +2960,7 @@ static int ext4_split_extent(handle_t *handle, + int err = 0; + int uninitialized; + int split_flag1, flags1; ++ int allocated = map->m_len; + + depth = ext_depth(inode); + ex = path[depth].p_ext; +@@ -2979,6 +2980,8 @@ static int ext4_split_extent(handle_t *handle, + map->m_lblk + map->m_len, split_flag1, flags1); + if (err) + goto out; ++ } else { ++ allocated = ee_len - (map->m_lblk - ee_block); + } + + ext4_ext_drop_refs(path); +@@ -3001,7 +3004,7 @@ static int ext4_split_extent(handle_t *handle, + + ext4_ext_show_leaf(inode, path); + out: +- return err ? err : map->m_len; ++ return err ? err : allocated; + } + + #define EXT4_EXT_ZERO_LEN 7 +@@ -3663,6 +3666,7 @@ out: + allocated - map->m_len); + allocated = map->m_len; + } ++ map->m_len = allocated; + + /* + * If we have done fallocate with the offset that is already +diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c +index 6266799..6d1f577 100644 +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -294,8 +294,8 @@ error_return: + } + + struct orlov_stats { ++ __u64 free_clusters; + __u32 free_inodes; +- __u32 free_clusters; + __u32 used_dirs; + }; + +@@ -312,7 +312,7 @@ static void get_orlov_stats(struct super_block *sb, ext4_group_t g, + + if (flex_size > 1) { + stats->free_inodes = atomic_read(&flex_group[g].free_inodes); +- stats->free_clusters = atomic_read(&flex_group[g].free_clusters); ++ stats->free_clusters = atomic64_read(&flex_group[g].free_clusters); + stats->used_dirs = atomic_read(&flex_group[g].used_dirs); + return; + } +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 4b2bb75..3270ffd 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -142,7 +142,8 @@ void ext4_evict_inode(struct inode *inode) + * don't use page cache. + */ + if (ext4_should_journal_data(inode) && +- (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode))) { ++ (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode)) && ++ inode->i_ino != EXT4_JOURNAL_INO) { + journal_t *journal = EXT4_SB(inode->i_sb)->s_journal; + tid_t commit_tid = EXT4_I(inode)->i_datasync_tid; + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 553ff71..7b18563 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -2866,8 +2866,8 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac, + if (sbi->s_log_groups_per_flex) { + ext4_group_t flex_group = ext4_flex_group(sbi, + ac->ac_b_ex.fe_group); +- atomic_sub(ac->ac_b_ex.fe_len, +- &sbi->s_flex_groups[flex_group].free_clusters); ++ atomic64_sub(ac->ac_b_ex.fe_len, ++ &sbi->s_flex_groups[flex_group].free_clusters); + } + + err = ext4_handle_dirty_metadata(handle, NULL, bitmap_bh); +@@ -3485,7 +3485,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) + win = offs; + + ac->ac_b_ex.fe_logical = ac->ac_o_ex.fe_logical - +- EXT4_B2C(sbi, win); ++ EXT4_NUM_B2C(sbi, win); + BUG_ON(ac->ac_o_ex.fe_logical < ac->ac_b_ex.fe_logical); + BUG_ON(ac->ac_o_ex.fe_len > ac->ac_b_ex.fe_len); + } +@@ -4634,7 +4634,7 @@ do_more: + EXT4_BLOCKS_PER_GROUP(sb); + count -= overflow; + } +- count_clusters = EXT4_B2C(sbi, count); ++ count_clusters = EXT4_NUM_B2C(sbi, count); + bitmap_bh = ext4_read_block_bitmap(sb, block_group); + if (!bitmap_bh) { + err = -EIO; +@@ -4724,8 +4724,8 @@ do_more: + + if (sbi->s_log_groups_per_flex) { + ext4_group_t flex_group = ext4_flex_group(sbi, block_group); +- atomic_add(count_clusters, +- &sbi->s_flex_groups[flex_group].free_clusters); ++ atomic64_add(count_clusters, ++ &sbi->s_flex_groups[flex_group].free_clusters); + } + + ext4_mb_unload_buddy(&e4b); +@@ -4865,12 +4865,12 @@ int ext4_group_add_blocks(handle_t *handle, struct super_block *sb, + desc->bg_checksum = ext4_group_desc_csum(sbi, block_group, desc); + ext4_unlock_group(sb, block_group); + percpu_counter_add(&sbi->s_freeclusters_counter, +- EXT4_B2C(sbi, blocks_freed)); ++ EXT4_NUM_B2C(sbi, blocks_freed)); + + if (sbi->s_log_groups_per_flex) { + ext4_group_t flex_group = ext4_flex_group(sbi, block_group); +- atomic_add(EXT4_B2C(sbi, blocks_freed), +- &sbi->s_flex_groups[flex_group].free_clusters); ++ atomic64_add(EXT4_NUM_B2C(sbi, blocks_freed), ++ &sbi->s_flex_groups[flex_group].free_clusters); + } + + ext4_mb_unload_buddy(&e4b); +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index 33129c0..6e67b97 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -938,7 +938,7 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input) + + /* Update the free space counts */ + percpu_counter_add(&sbi->s_freeclusters_counter, +- EXT4_B2C(sbi, input->free_blocks_count)); ++ EXT4_NUM_B2C(sbi, input->free_blocks_count)); + percpu_counter_add(&sbi->s_freeinodes_counter, + EXT4_INODES_PER_GROUP(sb)); + +@@ -946,8 +946,8 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input) + sbi->s_log_groups_per_flex) { + ext4_group_t flex_group; + flex_group = ext4_flex_group(sbi, input->group); +- atomic_add(EXT4_B2C(sbi, input->free_blocks_count), +- &sbi->s_flex_groups[flex_group].free_clusters); ++ atomic64_add(EXT4_NUM_B2C(sbi, input->free_blocks_count), ++ &sbi->s_flex_groups[flex_group].free_clusters); + atomic_add(EXT4_INODES_PER_GROUP(sb), + &sbi->s_flex_groups[flex_group].free_inodes); + } +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 24ac7a2..cc386b2 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -2047,8 +2047,8 @@ static int ext4_fill_flex_info(struct super_block *sb) + flex_group = ext4_flex_group(sbi, i); + atomic_add(ext4_free_inodes_count(sb, gdp), + &sbi->s_flex_groups[flex_group].free_inodes); +- atomic_add(ext4_free_group_clusters(sb, gdp), +- &sbi->s_flex_groups[flex_group].free_clusters); ++ atomic64_add(ext4_free_group_clusters(sb, gdp), ++ &sbi->s_flex_groups[flex_group].free_clusters); + atomic_add(ext4_used_dirs_count(sb, gdp), + &sbi->s_flex_groups[flex_group].used_dirs); + } +diff --git a/fs/isofs/export.c b/fs/isofs/export.c +index 516eb21..fd88add 100644 +--- a/fs/isofs/export.c ++++ b/fs/isofs/export.c +@@ -135,6 +135,7 @@ isofs_export_encode_fh(struct dentry *dentry, + len = 3; + fh32[0] = ei->i_iget5_block; + fh16[2] = (__u16)ei->i_iget5_offset; /* fh16 [sic] */ ++ fh16[3] = 0; /* avoid leaking uninitialized data */ + fh32[2] = inode->i_generation; + if (connectable && !S_ISDIR(inode->i_mode)) { + struct inode *parent; +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index d7dd774..6ac5bb1 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1016,9 +1016,12 @@ out: + void jbd2_journal_set_triggers(struct buffer_head *bh, + struct jbd2_buffer_trigger_type *type) + { +- struct journal_head *jh = bh2jh(bh); ++ struct journal_head *jh = jbd2_journal_grab_journal_head(bh); + ++ if (WARN_ON(!jh)) ++ return; + jh->b_triggers = type; ++ jbd2_journal_put_journal_head(jh); + } + + void jbd2_buffer_frozen_trigger(struct journal_head *jh, void *mapped_data, +@@ -1070,17 +1073,18 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) + { + transaction_t *transaction = handle->h_transaction; + journal_t *journal = transaction->t_journal; +- struct journal_head *jh = bh2jh(bh); ++ struct journal_head *jh; + int ret = 0; + +- jbd_debug(5, "journal_head %p\n", jh); +- JBUFFER_TRACE(jh, "entry"); + if (is_handle_aborted(handle)) + goto out; +- if (!buffer_jbd(bh)) { ++ jh = jbd2_journal_grab_journal_head(bh); ++ if (!jh) { + ret = -EUCLEAN; + goto out; + } ++ jbd_debug(5, "journal_head %p\n", jh); ++ JBUFFER_TRACE(jh, "entry"); + + jbd_lock_bh_state(bh); + +@@ -1171,6 +1175,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) + spin_unlock(&journal->j_list_lock); + out_unlock_bh: + jbd_unlock_bh_state(bh); ++ jbd2_journal_put_journal_head(jh); + out: + JBUFFER_TRACE(jh, "exit"); + WARN_ON(ret); /* All errors are bugs, so dump the stack */ +diff --git a/fs/proc/inode.c b/fs/proc/inode.c +index 7737c54..00f08b3 100644 +--- a/fs/proc/inode.c ++++ b/fs/proc/inode.c +@@ -427,12 +427,10 @@ static const struct file_operations proc_reg_file_ops_no_compat = { + + struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) + { +- struct inode * inode; ++ struct inode *inode = new_inode_pseudo(sb); + +- inode = iget_locked(sb, de->low_ino); +- if (!inode) +- return NULL; +- if (inode->i_state & I_NEW) { ++ if (inode) { ++ inode->i_ino = de->low_ino; + inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME; + PROC_I(inode)->fd = 0; + PROC_I(inode)->pde = de; +@@ -461,9 +459,7 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) + inode->i_fop = de->proc_fops; + } + } +- unlock_new_inode(inode); +- } else +- pde_put(de); ++ } + return inode; + } + +diff --git a/fs/udf/namei.c b/fs/udf/namei.c +index 4639e13..71c97fb 100644 +--- a/fs/udf/namei.c ++++ b/fs/udf/namei.c +@@ -1293,6 +1293,7 @@ static int udf_encode_fh(struct dentry *de, __u32 *fh, int *lenp, + *lenp = 3; + fid->udf.block = location.logicalBlockNum; + fid->udf.partref = location.partitionReferenceNum; ++ fid->udf.parent_partref = 0; + fid->udf.generation = inode->i_generation; + + if (connectable && !S_ISDIR(inode->i_mode)) { +diff --git a/include/asm-generic/signal.h b/include/asm-generic/signal.h +index 555c0ae..743f7a5 100644 +--- a/include/asm-generic/signal.h ++++ b/include/asm-generic/signal.h +@@ -99,6 +99,10 @@ typedef unsigned long old_sigset_t; + + #include <asm-generic/signal-defs.h> + ++#ifdef SA_RESTORER ++#define __ARCH_HAS_SA_RESTORER ++#endif ++ + struct sigaction { + __sighandler_t sa_handler; + unsigned long sa_flags; +diff --git a/include/linux/efi.h b/include/linux/efi.h +index ce95a4b..8469f3f 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -484,7 +484,8 @@ struct efivars { + * 1) ->list - adds, removals, reads, writes + * 2) ops.[gs]et_variable() calls. + * It must not be held when creating sysfs entries or calling kmalloc. +- * ops.get_next_variable() is only called from register_efivars(), ++ * ops.get_next_variable() is only called from register_efivars() ++ * or efivar_update_sysfs_entries(), + * which is protected by the BKL, so that path is safe. + */ + spinlock_t lock; +diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h +index b669be6..9b9b2aa 100644 +--- a/include/linux/perf_event.h ++++ b/include/linux/perf_event.h +@@ -1186,6 +1186,12 @@ static inline void perf_event_disable(struct perf_event *event) { } + static inline void perf_event_task_tick(void) { } + #endif + ++#if defined(CONFIG_PERF_EVENTS) && defined(CONFIG_CPU_SUP_INTEL) ++extern void perf_restore_debug_store(void); ++#else ++static inline void perf_restore_debug_store(void) { } ++#endif ++ + #define perf_output_put(handle, x) perf_output_copy((handle), &(x), sizeof(x)) + + /* +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 53dc7e7..da65890 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -455,7 +455,7 @@ struct sk_buff { + union { + __u32 mark; + __u32 dropcount; +- __u32 avail_size; ++ __u32 reserved_tailroom; + }; + + __u16 vlan_tci; +@@ -1332,7 +1332,10 @@ static inline int skb_tailroom(const struct sk_buff *skb) + */ + static inline int skb_availroom(const struct sk_buff *skb) + { +- return skb_is_nonlinear(skb) ? 0 : skb->avail_size - skb->len; ++ if (skb_is_nonlinear(skb)) ++ return 0; ++ ++ return skb->end - skb->tail - skb->reserved_tailroom; + } + + /** +diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h +index 16ff29a..b289bd2 100644 +--- a/include/net/inet_frag.h ++++ b/include/net/inet_frag.h +@@ -33,6 +33,13 @@ struct inet_frag_queue { + + #define INETFRAGS_HASHSZ 64 + ++/* averaged: ++ * max_depth = default ipfrag_high_thresh / INETFRAGS_HASHSZ / ++ * rounded up (SKB_TRUELEN(0) + sizeof(struct ipq or ++ * struct frag_queue)) ++ */ ++#define INETFRAGS_MAXDEPTH 128 ++ + struct inet_frags { + struct hlist_head hash[INETFRAGS_HASHSZ]; + rwlock_t lock; +@@ -64,6 +71,8 @@ int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f); + struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, + struct inet_frags *f, void *key, unsigned int hash) + __releases(&f->lock); ++void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q, ++ const char *prefix); + + static inline void inet_frag_put(struct inet_frag_queue *q, struct inet_frags *f) + { +diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h +index 10422ef..2124004 100644 +--- a/include/net/ip_fib.h ++++ b/include/net/ip_fib.h +@@ -129,18 +129,16 @@ struct fib_result_nl { + }; + + #ifdef CONFIG_IP_ROUTE_MULTIPATH +- + #define FIB_RES_NH(res) ((res).fi->fib_nh[(res).nh_sel]) +- +-#define FIB_TABLE_HASHSZ 2 +- + #else /* CONFIG_IP_ROUTE_MULTIPATH */ +- + #define FIB_RES_NH(res) ((res).fi->fib_nh[0]) ++#endif /* CONFIG_IP_ROUTE_MULTIPATH */ + ++#ifdef CONFIG_IP_MULTIPLE_TABLES + #define FIB_TABLE_HASHSZ 256 +- +-#endif /* CONFIG_IP_ROUTE_MULTIPATH */ ++#else ++#define FIB_TABLE_HASHSZ 2 ++#endif + + extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh); + +diff --git a/kernel/signal.c b/kernel/signal.c +index 71e1816..ea76d30 100644 +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -481,7 +481,7 @@ flush_signal_handlers(struct task_struct *t, int force_default) + if (force_default || ka->sa.sa_handler != SIG_IGN) + ka->sa.sa_handler = SIG_DFL; + ka->sa.sa_flags = 0; +-#ifdef SA_RESTORER ++#ifdef __ARCH_HAS_SA_RESTORER + ka->sa.sa_restorer = NULL; + #endif + sigemptyset(&ka->sa.sa_mask); +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 6c880e8..0943d2a 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -2725,8 +2725,8 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, + continue; + } + +- hlist_del(&entry->node); +- call_rcu(&entry->rcu, ftrace_free_entry_rcu); ++ hlist_del_rcu(&entry->node); ++ call_rcu_sched(&entry->rcu, ftrace_free_entry_rcu); + } + } + __disable_ftrace_function_probe(); +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 5638104..17edb14 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -652,7 +652,7 @@ __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu) + void + update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu) + { +- struct ring_buffer *buf = tr->buffer; ++ struct ring_buffer *buf; + + if (trace_stop_count) + return; +@@ -664,6 +664,7 @@ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu) + } + arch_spin_lock(&ftrace_max_lock); + ++ buf = tr->buffer; + tr->buffer = max_tr.buffer; + max_tr.buffer = buf; + +@@ -2635,11 +2636,25 @@ static int set_tracer_option(struct tracer *trace, char *cmp, int neg) + return -EINVAL; + } + +-static void set_tracer_flags(unsigned int mask, int enabled) ++/* Some tracers require overwrite to stay enabled */ ++int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set) ++{ ++ if (tracer->enabled && (mask & TRACE_ITER_OVERWRITE) && !set) ++ return -1; ++ ++ return 0; ++} ++ ++int set_tracer_flag(unsigned int mask, int enabled) + { + /* do nothing if flag is already set */ + if (!!(trace_flags & mask) == !!enabled) +- return; ++ return 0; ++ ++ /* Give the tracer a chance to approve the change */ ++ if (current_trace->flag_changed) ++ if (current_trace->flag_changed(current_trace, mask, !!enabled)) ++ return -EINVAL; + + if (enabled) + trace_flags |= mask; +@@ -2649,8 +2664,14 @@ static void set_tracer_flags(unsigned int mask, int enabled) + if (mask == TRACE_ITER_RECORD_CMD) + trace_event_enable_cmd_record(enabled); + +- if (mask == TRACE_ITER_OVERWRITE) ++ if (mask == TRACE_ITER_OVERWRITE) { + ring_buffer_change_overwrite(global_trace.buffer, enabled); ++#ifdef CONFIG_TRACER_MAX_TRACE ++ ring_buffer_change_overwrite(max_tr.buffer, enabled); ++#endif ++ } ++ ++ return 0; + } + + static ssize_t +@@ -2660,7 +2681,7 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf, + char buf[64]; + char *cmp; + int neg = 0; +- int ret; ++ int ret = 0; + int i; + + if (cnt >= sizeof(buf)) +@@ -2677,21 +2698,23 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf, + cmp += 2; + } + ++ mutex_lock(&trace_types_lock); ++ + for (i = 0; trace_options[i]; i++) { + if (strcmp(cmp, trace_options[i]) == 0) { +- set_tracer_flags(1 << i, !neg); ++ ret = set_tracer_flag(1 << i, !neg); + break; + } + } + + /* If no option could be set, test the specific tracer options */ +- if (!trace_options[i]) { +- mutex_lock(&trace_types_lock); ++ if (!trace_options[i]) + ret = set_tracer_option(current_trace, cmp, neg); +- mutex_unlock(&trace_types_lock); +- if (ret) +- return ret; +- } ++ ++ mutex_unlock(&trace_types_lock); ++ ++ if (ret) ++ return ret; + + *ppos += cnt; + +@@ -3015,6 +3038,9 @@ static int tracing_set_tracer(const char *buf) + goto out; + + trace_branch_disable(); ++ ++ current_trace->enabled = false; ++ + if (current_trace && current_trace->reset) + current_trace->reset(tr); + if (current_trace && current_trace->use_max_tr) { +@@ -3044,6 +3070,7 @@ static int tracing_set_tracer(const char *buf) + goto out; + } + ++ current_trace->enabled = true; + trace_branch_enable(tr); + out: + mutex_unlock(&trace_types_lock); +@@ -4378,7 +4405,13 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt, + + if (val != 0 && val != 1) + return -EINVAL; +- set_tracer_flags(1 << index, val); ++ ++ mutex_lock(&trace_types_lock); ++ ret = set_tracer_flag(1 << index, val); ++ mutex_unlock(&trace_types_lock); ++ ++ if (ret < 0) ++ return ret; + + *ppos += cnt; + +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index 092e1f8..c3c3f6b 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -271,10 +271,14 @@ struct tracer { + enum print_line_t (*print_line)(struct trace_iterator *iter); + /* If you handled the flag setting, return 0 */ + int (*set_flag)(u32 old_flags, u32 bit, int set); ++ /* Return 0 if OK with change, else return non-zero */ ++ int (*flag_changed)(struct tracer *tracer, ++ u32 mask, int set); + struct tracer *next; + struct tracer_flags *flags; + int print_max; + int use_max_tr; ++ bool enabled; + }; + + +@@ -815,6 +819,9 @@ extern struct list_head ftrace_events; + extern const char *__start___trace_bprintk_fmt[]; + extern const char *__stop___trace_bprintk_fmt[]; + ++int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set); ++int set_tracer_flag(unsigned int mask, int enabled); ++ + #undef FTRACE_ENTRY + #define FTRACE_ENTRY(call, struct_name, id, tstruct, print) \ + extern struct ftrace_event_call \ +diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c +index 20dad0d..1626e1a 100644 +--- a/kernel/trace/trace_irqsoff.c ++++ b/kernel/trace/trace_irqsoff.c +@@ -32,7 +32,7 @@ enum { + + static int trace_type __read_mostly; + +-static int save_lat_flag; ++static int save_flags; + + static void stop_irqsoff_tracer(struct trace_array *tr, int graph); + static int start_irqsoff_tracer(struct trace_array *tr, int graph); +@@ -546,8 +546,11 @@ static void stop_irqsoff_tracer(struct trace_array *tr, int graph) + + static void __irqsoff_tracer_init(struct trace_array *tr) + { +- save_lat_flag = trace_flags & TRACE_ITER_LATENCY_FMT; +- trace_flags |= TRACE_ITER_LATENCY_FMT; ++ save_flags = trace_flags; ++ ++ /* non overwrite screws up the latency tracers */ ++ set_tracer_flag(TRACE_ITER_OVERWRITE, 1); ++ set_tracer_flag(TRACE_ITER_LATENCY_FMT, 1); + + tracing_max_latency = 0; + irqsoff_trace = tr; +@@ -561,10 +564,13 @@ static void __irqsoff_tracer_init(struct trace_array *tr) + + static void irqsoff_tracer_reset(struct trace_array *tr) + { ++ int lat_flag = save_flags & TRACE_ITER_LATENCY_FMT; ++ int overwrite_flag = save_flags & TRACE_ITER_OVERWRITE; ++ + stop_irqsoff_tracer(tr, is_graph()); + +- if (!save_lat_flag) +- trace_flags &= ~TRACE_ITER_LATENCY_FMT; ++ set_tracer_flag(TRACE_ITER_LATENCY_FMT, lat_flag); ++ set_tracer_flag(TRACE_ITER_OVERWRITE, overwrite_flag); + } + + static void irqsoff_tracer_start(struct trace_array *tr) +@@ -597,6 +603,7 @@ static struct tracer irqsoff_tracer __read_mostly = + .print_line = irqsoff_print_line, + .flags = &tracer_flags, + .set_flag = irqsoff_set_flag, ++ .flag_changed = trace_keep_overwrite, + #ifdef CONFIG_FTRACE_SELFTEST + .selftest = trace_selftest_startup_irqsoff, + #endif +@@ -630,6 +637,7 @@ static struct tracer preemptoff_tracer __read_mostly = + .print_line = irqsoff_print_line, + .flags = &tracer_flags, + .set_flag = irqsoff_set_flag, ++ .flag_changed = trace_keep_overwrite, + #ifdef CONFIG_FTRACE_SELFTEST + .selftest = trace_selftest_startup_preemptoff, + #endif +@@ -665,6 +673,7 @@ static struct tracer preemptirqsoff_tracer __read_mostly = + .print_line = irqsoff_print_line, + .flags = &tracer_flags, + .set_flag = irqsoff_set_flag, ++ .flag_changed = trace_keep_overwrite, + #ifdef CONFIG_FTRACE_SELFTEST + .selftest = trace_selftest_startup_preemptirqsoff, + #endif +diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c +index e4a70c0..6857e0c 100644 +--- a/kernel/trace/trace_sched_wakeup.c ++++ b/kernel/trace/trace_sched_wakeup.c +@@ -36,7 +36,7 @@ static void __wakeup_reset(struct trace_array *tr); + static int wakeup_graph_entry(struct ftrace_graph_ent *trace); + static void wakeup_graph_return(struct ftrace_graph_ret *trace); + +-static int save_lat_flag; ++static int save_flags; + + #define TRACE_DISPLAY_GRAPH 1 + +@@ -528,8 +528,11 @@ static void stop_wakeup_tracer(struct trace_array *tr) + + static int __wakeup_tracer_init(struct trace_array *tr) + { +- save_lat_flag = trace_flags & TRACE_ITER_LATENCY_FMT; +- trace_flags |= TRACE_ITER_LATENCY_FMT; ++ save_flags = trace_flags; ++ ++ /* non overwrite screws up the latency tracers */ ++ set_tracer_flag(TRACE_ITER_OVERWRITE, 1); ++ set_tracer_flag(TRACE_ITER_LATENCY_FMT, 1); + + tracing_max_latency = 0; + wakeup_trace = tr; +@@ -551,12 +554,15 @@ static int wakeup_rt_tracer_init(struct trace_array *tr) + + static void wakeup_tracer_reset(struct trace_array *tr) + { ++ int lat_flag = save_flags & TRACE_ITER_LATENCY_FMT; ++ int overwrite_flag = save_flags & TRACE_ITER_OVERWRITE; ++ + stop_wakeup_tracer(tr); + /* make sure we put back any tasks we are tracing */ + wakeup_reset(tr); + +- if (!save_lat_flag) +- trace_flags &= ~TRACE_ITER_LATENCY_FMT; ++ set_tracer_flag(TRACE_ITER_LATENCY_FMT, lat_flag); ++ set_tracer_flag(TRACE_ITER_OVERWRITE, overwrite_flag); + } + + static void wakeup_tracer_start(struct trace_array *tr) +@@ -582,6 +588,7 @@ static struct tracer wakeup_tracer __read_mostly = + .print_line = wakeup_print_line, + .flags = &tracer_flags, + .set_flag = wakeup_set_flag, ++ .flag_changed = trace_keep_overwrite, + #ifdef CONFIG_FTRACE_SELFTEST + .selftest = trace_selftest_startup_wakeup, + #endif +@@ -603,6 +610,7 @@ static struct tracer wakeup_rt_tracer __read_mostly = + .print_line = wakeup_print_line, + .flags = &tracer_flags, + .set_flag = wakeup_set_flag, ++ .flag_changed = trace_keep_overwrite, + #ifdef CONFIG_FTRACE_SELFTEST + .selftest = trace_selftest_startup_wakeup, + #endif +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index d6c0fdf..4c7d42a 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2092,8 +2092,12 @@ int hugetlb_report_node_meminfo(int nid, char *buf) + /* Return the number pages of memory we physically have, in PAGE_SIZE units. */ + unsigned long hugetlb_total_pages(void) + { +- struct hstate *h = &default_hstate; +- return h->nr_huge_pages * pages_per_huge_page(h); ++ struct hstate *h; ++ unsigned long nr_total_pages = 0; ++ ++ for_each_hstate(h) ++ nr_total_pages += h->nr_huge_pages * pages_per_huge_page(h); ++ return nr_total_pages; + } + + static int hugetlb_acct_memory(struct hstate *h, long delta) +diff --git a/net/core/dev.c b/net/core/dev.c +index 2aac4ec..b23bbbf 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3299,6 +3299,7 @@ ncls: + } + switch (rx_handler(&skb)) { + case RX_HANDLER_CONSUMED: ++ ret = NET_RX_SUCCESS; + goto out; + case RX_HANDLER_ANOTHER: + goto another_round; +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 5229c7f..3b5e680 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -973,6 +973,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev, + * report anything. + */ + ivi.spoofchk = -1; ++ memset(ivi.mac, 0, sizeof(ivi.mac)); + if (dev->netdev_ops->ndo_get_vf_config(dev, i, &ivi)) + break; + vf_mac.vf = +@@ -2041,7 +2042,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) + struct rtattr *attr = (void *)nlh + NLMSG_ALIGN(min_len); + + while (RTA_OK(attr, attrlen)) { +- unsigned flavor = attr->rta_type; ++ unsigned int flavor = attr->rta_type & NLA_TYPE_MASK; + if (flavor) { + if (flavor > rta_max[sz_idx]) + return -EINVAL; +diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c +index d860530..2f9517d 100644 +--- a/net/dcb/dcbnl.c ++++ b/net/dcb/dcbnl.c +@@ -336,6 +336,7 @@ static int dcbnl_getperm_hwaddr(struct net_device *netdev, struct nlattr **tb, + dcb->dcb_family = AF_UNSPEC; + dcb->cmd = DCB_CMD_GPERM_HWADDR; + ++ memset(perm_addr, 0, sizeof(perm_addr)); + netdev->dcbnl_ops->getpermhwaddr(netdev, perm_addr); + + ret = nla_put(dcbnl_skb, DCB_ATTR_PERM_HWADDR, sizeof(perm_addr), +@@ -1238,6 +1239,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev) + + if (ops->ieee_getets) { + struct ieee_ets ets; ++ memset(&ets, 0, sizeof(ets)); + err = ops->ieee_getets(netdev, &ets); + if (!err) + NLA_PUT(skb, DCB_ATTR_IEEE_ETS, sizeof(ets), &ets); +@@ -1245,6 +1247,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev) + + if (ops->ieee_getpfc) { + struct ieee_pfc pfc; ++ memset(&pfc, 0, sizeof(pfc)); + err = ops->ieee_getpfc(netdev, &pfc); + if (!err) + NLA_PUT(skb, DCB_ATTR_IEEE_PFC, sizeof(pfc), &pfc); +@@ -1277,6 +1280,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev) + /* get peer info if available */ + if (ops->ieee_peer_getets) { + struct ieee_ets ets; ++ memset(&ets, 0, sizeof(ets)); + err = ops->ieee_peer_getets(netdev, &ets); + if (!err) + NLA_PUT(skb, DCB_ATTR_IEEE_PEER_ETS, sizeof(ets), &ets); +@@ -1284,6 +1288,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev) + + if (ops->ieee_peer_getpfc) { + struct ieee_pfc pfc; ++ memset(&pfc, 0, sizeof(pfc)); + err = ops->ieee_peer_getpfc(netdev, &pfc); + if (!err) + NLA_PUT(skb, DCB_ATTR_IEEE_PEER_PFC, sizeof(pfc), &pfc); +@@ -1463,6 +1468,7 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev) + /* peer info if available */ + if (ops->cee_peer_getpg) { + struct cee_pg pg; ++ memset(&pg, 0, sizeof(pg)); + err = ops->cee_peer_getpg(netdev, &pg); + if (!err) + NLA_PUT(skb, DCB_ATTR_CEE_PEER_PG, sizeof(pg), &pg); +@@ -1470,6 +1476,7 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev) + + if (ops->cee_peer_getpfc) { + struct cee_pfc pfc; ++ memset(&pfc, 0, sizeof(pfc)); + err = ops->cee_peer_getpfc(netdev, &pfc); + if (!err) + NLA_PUT(skb, DCB_ATTR_CEE_PEER_PFC, sizeof(pfc), &pfc); +diff --git a/net/ieee802154/6lowpan.h b/net/ieee802154/6lowpan.h +index 5d8cf80..8b0866f 100644 +--- a/net/ieee802154/6lowpan.h ++++ b/net/ieee802154/6lowpan.h +@@ -87,7 +87,7 @@ + (memcmp(addr1, addr2, length >> 3) == 0) + + /* local link, i.e. FE80::/10 */ +-#define is_addr_link_local(a) (((a)->s6_addr16[0]) == 0x80FE) ++#define is_addr_link_local(a) (((a)->s6_addr16[0]) == htons(0xFE80)) + + /* + * check whether we can compress the IID to 16 bits, +diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c +index 5ff2a51..210b710 100644 +--- a/net/ipv4/inet_fragment.c ++++ b/net/ipv4/inet_fragment.c +@@ -21,6 +21,7 @@ + #include <linux/rtnetlink.h> + #include <linux/slab.h> + ++#include <net/sock.h> + #include <net/inet_frag.h> + + static void inet_frag_secret_rebuild(unsigned long dummy) +@@ -271,6 +272,7 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, + { + struct inet_frag_queue *q; + struct hlist_node *n; ++ int depth = 0; + + hlist_for_each_entry(q, n, &f->hash[hash], list) { + if (q->net == nf && f->match(q, key)) { +@@ -278,9 +280,25 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, + read_unlock(&f->lock); + return q; + } ++ depth++; + } + read_unlock(&f->lock); + +- return inet_frag_create(nf, f, key); ++ if (depth <= INETFRAGS_MAXDEPTH) ++ return inet_frag_create(nf, f, key); ++ else ++ return ERR_PTR(-ENOBUFS); + } + EXPORT_SYMBOL(inet_frag_find); ++ ++void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q, ++ const char *prefix) ++{ ++ static const char msg[] = "inet_frag_find: Fragment hash bucket" ++ " list length grew over limit " __stringify(INETFRAGS_MAXDEPTH) ++ ". Dropping fragment.\n"; ++ ++ if (PTR_ERR(q) == -ENOBUFS) ++ LIMIT_NETDEBUG(KERN_WARNING "%s%s", prefix, msg); ++} ++EXPORT_SYMBOL(inet_frag_maybe_warn_overflow); +diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c +index a4e7131..b2cfe83 100644 +--- a/net/ipv4/ip_fragment.c ++++ b/net/ipv4/ip_fragment.c +@@ -20,6 +20,8 @@ + * Patrick McHardy : LRU queue of frag heads for evictor. + */ + ++#define pr_fmt(fmt) "IPv4: " fmt ++ + #include <linux/compiler.h> + #include <linux/module.h> + #include <linux/types.h> +@@ -293,14 +295,12 @@ static inline struct ipq *ip_find(struct net *net, struct iphdr *iph, u32 user) + hash = ipqhashfn(iph->id, iph->saddr, iph->daddr, iph->protocol); + + q = inet_frag_find(&net->ipv4.frags, &ip4_frags, &arg, hash); +- if (q == NULL) +- goto out_nomem; ++ if (IS_ERR_OR_NULL(q)) { ++ inet_frag_maybe_warn_overflow(q, pr_fmt()); ++ return NULL; ++ } + + return container_of(q, struct ipq, q); +- +-out_nomem: +- LIMIT_NETDEBUG(KERN_ERR "ip_frag_create: no memory left !\n"); +- return NULL; + } + + /* Is the fragment too far ahead to be part of ipq? */ +diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c +index 42dd1a9..40eb4fc 100644 +--- a/net/ipv4/ip_options.c ++++ b/net/ipv4/ip_options.c +@@ -358,7 +358,6 @@ int ip_options_compile(struct net *net, + } + switch (optptr[3]&0xF) { + case IPOPT_TS_TSONLY: +- opt->ts = optptr - iph; + if (skb) + timeptr = &optptr[optptr[2]-1]; + opt->ts_needtime = 1; +@@ -369,7 +368,6 @@ int ip_options_compile(struct net *net, + pp_ptr = optptr + 2; + goto error; + } +- opt->ts = optptr - iph; + if (rt) { + memcpy(&optptr[optptr[2]-1], &rt->rt_spec_dst, 4); + timeptr = &optptr[optptr[2]+3]; +@@ -383,7 +381,6 @@ int ip_options_compile(struct net *net, + pp_ptr = optptr + 2; + goto error; + } +- opt->ts = optptr - iph; + { + __be32 addr; + memcpy(&addr, &optptr[optptr[2]-1], 4); +@@ -416,12 +413,12 @@ int ip_options_compile(struct net *net, + pp_ptr = optptr + 3; + goto error; + } +- opt->ts = optptr - iph; + if (skb) { + optptr[3] = (optptr[3]&0xF)|((overflow+1)<<4); + opt->is_changed = 1; + } + } ++ opt->ts = optptr - iph; + break; + case IPOPT_RA: + if (optlen < 4) { +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 52edbb8..fe381c2 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -704,7 +704,7 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp) + * Make sure that we have exactly size bytes + * available to the caller, no more, no less. + */ +- skb->avail_size = size; ++ skb->reserved_tailroom = skb->end - skb->tail - size; + return skb; + } + __kfree_skb(skb); +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index e865ed1..1b1f7af 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -5494,6 +5494,9 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb, + if (tcp_checksum_complete_user(sk, skb)) + goto csum_error; + ++ if ((int)skb->truesize > sk->sk_forward_alloc) ++ goto step5; ++ + /* Predicted packet is in window by definition. + * seq == rcv_nxt and rcv_wup <= rcv_nxt. + * Hence, check seq<=rcv_wup reduces to: +@@ -5505,9 +5508,6 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb, + + tcp_rcv_rtt_measure_ts(sk, skb); + +- if ((int)skb->truesize > sk->sk_forward_alloc) +- goto step5; +- + NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPHPHITS); + + /* Bulk data transfer: receiver */ +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 921cbac..9bb7400 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1096,7 +1096,6 @@ static void __pskb_trim_head(struct sk_buff *skb, int len) + eat = min_t(int, len, skb_headlen(skb)); + if (eat) { + __skb_pull(skb, eat); +- skb->avail_size -= eat; + len -= eat; + if (!len) + return; +diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c +index a46c64e..f8d24dd 100644 +--- a/net/ipv6/ip6_input.c ++++ b/net/ipv6/ip6_input.c +@@ -265,7 +265,8 @@ int ip6_mc_input(struct sk_buff *skb) + * IPv6 multicast router mode is now supported ;) + */ + if (dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding && +- !(ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) && ++ !(ipv6_addr_type(&hdr->daddr) & ++ (IPV6_ADDR_LOOPBACK|IPV6_ADDR_LINKLOCAL)) && + likely(!(IP6CB(skb)->flags & IP6SKB_FORWARDED))) { + /* + * Okay, we try to forward - split and duplicate +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c +index 38f00b0..52e2f65 100644 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -14,6 +14,8 @@ + * 2 of the License, or (at your option) any later version. + */ + ++#define pr_fmt(fmt) "IPv6-nf: " fmt ++ + #include <linux/errno.h> + #include <linux/types.h> + #include <linux/string.h> +@@ -176,13 +178,12 @@ fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst) + + q = inet_frag_find(&nf_init_frags, &nf_frags, &arg, hash); + local_bh_enable(); +- if (q == NULL) +- goto oom; ++ if (IS_ERR_OR_NULL(q)) { ++ inet_frag_maybe_warn_overflow(q, pr_fmt()); ++ return NULL; ++ } + + return container_of(q, struct nf_ct_frag6_queue, q); +- +-oom: +- return NULL; + } + + +diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c +index dfb164e..2b0a4ca 100644 +--- a/net/ipv6/reassembly.c ++++ b/net/ipv6/reassembly.c +@@ -26,6 +26,9 @@ + * YOSHIFUJI,H. @USAGI Always remove fragment header to + * calculate ICV correctly. + */ ++ ++#define pr_fmt(fmt) "IPv6: " fmt ++ + #include <linux/errno.h> + #include <linux/types.h> + #include <linux/string.h> +@@ -240,9 +243,10 @@ fq_find(struct net *net, __be32 id, const struct in6_addr *src, const struct in6 + hash = inet6_hash_frag(id, src, dst, ip6_frags.rnd); + + q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash); +- if (q == NULL) ++ if (IS_ERR_OR_NULL(q)) { ++ inet_frag_maybe_warn_overflow(q, pr_fmt()); + return NULL; +- ++ } + return container_of(q, struct frag_queue, q); + } + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 791c1fa..18ea73c 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1920,7 +1920,8 @@ void rt6_purge_dflt_routers(struct net *net) + restart: + read_lock_bh(&table->tb6_lock); + for (rt = table->tb6_root.leaf; rt; rt = rt->dst.rt6_next) { +- if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) { ++ if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF) && ++ (!rt->rt6i_idev || rt->rt6i_idev->cnf.accept_ra != 2)) { + dst_hold(&rt->dst); + read_unlock_bh(&table->tb6_lock); + ip6_del_rt(rt); +diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c +index b1bd16f..6f60175 100644 +--- a/net/l2tp/l2tp_ppp.c ++++ b/net/l2tp/l2tp_ppp.c +@@ -360,6 +360,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh + l2tp_xmit_skb(session, skb, session->hdr_len); + + sock_put(ps->tunnel_sock); ++ sock_put(sk); + + return error; + +diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c +index d463f5a..23267b3 100644 +--- a/net/netlabel/netlabel_unlabeled.c ++++ b/net/netlabel/netlabel_unlabeled.c +@@ -1189,8 +1189,6 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb, + struct netlbl_unlhsh_walk_arg cb_arg; + u32 skip_bkt = cb->args[0]; + u32 skip_chain = cb->args[1]; +- u32 skip_addr4 = cb->args[2]; +- u32 skip_addr6 = cb->args[3]; + u32 iter_bkt; + u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0; + struct netlbl_unlhsh_iface *iface; +@@ -1215,7 +1213,7 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb, + continue; + netlbl_af4list_foreach_rcu(addr4, + &iface->addr4_list) { +- if (iter_addr4++ < skip_addr4) ++ if (iter_addr4++ < cb->args[2]) + continue; + if (netlbl_unlabel_staticlist_gen( + NLBL_UNLABEL_C_STATICLIST, +@@ -1231,7 +1229,7 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb, + #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) + netlbl_af6list_foreach_rcu(addr6, + &iface->addr6_list) { +- if (iter_addr6++ < skip_addr6) ++ if (iter_addr6++ < cb->args[3]) + continue; + if (netlbl_unlabel_staticlist_gen( + NLBL_UNLABEL_C_STATICLIST, +@@ -1250,10 +1248,10 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb, + + unlabel_staticlist_return: + rcu_read_unlock(); +- cb->args[0] = skip_bkt; +- cb->args[1] = skip_chain; +- cb->args[2] = skip_addr4; +- cb->args[3] = skip_addr6; ++ cb->args[0] = iter_bkt; ++ cb->args[1] = iter_chain; ++ cb->args[2] = iter_addr4; ++ cb->args[3] = iter_addr6; + return skb->len; + } + +@@ -1273,12 +1271,9 @@ static int netlbl_unlabel_staticlistdef(struct sk_buff *skb, + { + struct netlbl_unlhsh_walk_arg cb_arg; + struct netlbl_unlhsh_iface *iface; +- u32 skip_addr4 = cb->args[0]; +- u32 skip_addr6 = cb->args[1]; +- u32 iter_addr4 = 0; ++ u32 iter_addr4 = 0, iter_addr6 = 0; + struct netlbl_af4list *addr4; + #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) +- u32 iter_addr6 = 0; + struct netlbl_af6list *addr6; + #endif + +@@ -1292,7 +1287,7 @@ static int netlbl_unlabel_staticlistdef(struct sk_buff *skb, + goto unlabel_staticlistdef_return; + + netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) { +- if (iter_addr4++ < skip_addr4) ++ if (iter_addr4++ < cb->args[0]) + continue; + if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF, + iface, +@@ -1305,7 +1300,7 @@ static int netlbl_unlabel_staticlistdef(struct sk_buff *skb, + } + #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) + netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) { +- if (iter_addr6++ < skip_addr6) ++ if (iter_addr6++ < cb->args[1]) + continue; + if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF, + iface, +@@ -1320,8 +1315,8 @@ static int netlbl_unlabel_staticlistdef(struct sk_buff *skb, + + unlabel_staticlistdef_return: + rcu_read_unlock(); +- cb->args[0] = skip_addr4; +- cb->args[1] = skip_addr6; ++ cb->args[0] = iter_addr4; ++ cb->args[1] = iter_addr6; + return skb->len; + } + +diff --git a/net/rds/message.c b/net/rds/message.c +index f0a4658..aff589c 100644 +--- a/net/rds/message.c ++++ b/net/rds/message.c +@@ -197,6 +197,9 @@ struct rds_message *rds_message_alloc(unsigned int extra_len, gfp_t gfp) + { + struct rds_message *rm; + ++ if (extra_len > KMALLOC_MAX_SIZE - sizeof(struct rds_message)) ++ return NULL; ++ + rm = kzalloc(sizeof(struct rds_message) + extra_len, gfp); + if (!rm) + goto out; +diff --git a/net/sctp/associola.c b/net/sctp/associola.c +index acd2edb..3c04692 100644 +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -1050,7 +1050,7 @@ struct sctp_transport *sctp_assoc_lookup_tsn(struct sctp_association *asoc, + transports) { + + if (transport == active) +- break; ++ continue; + list_for_each_entry(chunk, &transport->transmitted, + transmitted_list) { + if (key == chunk->subh.data_hdr->tsn) { +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 891f5db..cb1c430 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -2044,7 +2044,7 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep, + } + + /* Delete the tempory new association. */ +- sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc)); ++ sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC, SCTP_ASOC(new_asoc)); + sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL()); + + /* Restore association pointer to provide SCTP command interpeter +diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c +index 48665ec..8ab2951 100644 +--- a/security/selinux/xfrm.c ++++ b/security/selinux/xfrm.c +@@ -310,7 +310,7 @@ int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, + + if (old_ctx) { + new_ctx = kmalloc(sizeof(*old_ctx) + old_ctx->ctx_len, +- GFP_KERNEL); ++ GFP_ATOMIC); + if (!new_ctx) + return -ENOMEM; + +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index b0187e7..7747d26 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -2771,7 +2771,7 @@ static unsigned int convert_to_spdif_status(unsigned short val) + if (val & AC_DIG1_PROFESSIONAL) + sbits |= IEC958_AES0_PROFESSIONAL; + if (sbits & IEC958_AES0_PROFESSIONAL) { +- if (sbits & AC_DIG1_EMPHASIS) ++ if (val & AC_DIG1_EMPHASIS) + sbits |= IEC958_AES0_PRO_EMPHASIS_5015; + } else { + if (val & AC_DIG1_EMPHASIS) +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index c9269ce..984b5b1 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -1236,7 +1236,7 @@ static int patch_cxt5045(struct hda_codec *codec) + } + + if (spec->beep_amp) +- snd_hda_attach_beep_device(codec, spec->beep_amp); ++ snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp)); + + return 0; + } +@@ -2027,7 +2027,7 @@ static int patch_cxt5051(struct hda_codec *codec) + } + + if (spec->beep_amp) +- snd_hda_attach_beep_device(codec, spec->beep_amp); ++ snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp)); + + conexant_init_jacks(codec); + if (spec->auto_mic & AUTO_MIC_PORTB) +@@ -3225,7 +3225,7 @@ static int patch_cxt5066(struct hda_codec *codec) + } + + if (spec->beep_amp) +- snd_hda_attach_beep_device(codec, spec->beep_amp); ++ snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp)); + + return 0; + } +@@ -4556,7 +4556,7 @@ static int patch_conexant_auto(struct hda_codec *codec) + spec->capture_stream = &cx_auto_pcm_analog_capture; + codec->patch_ops = cx_auto_patch_ops; + if (spec->beep_amp) +- snd_hda_attach_beep_device(codec, spec->beep_amp); ++ snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp)); + return 0; + } + +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 9121dee..f4540bf 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -711,8 +711,9 @@ static int check_input_term(struct mixer_build *state, int id, struct usb_audio_ + case UAC2_CLOCK_SELECTOR: { + struct uac_selector_unit_descriptor *d = p1; + /* call recursively to retrieve the channel info */ +- if (check_input_term(state, d->baSourceID[0], term) < 0) +- return -ENODEV; ++ err = check_input_term(state, d->baSourceID[0], term); ++ if (err < 0) ++ return err; + term->type = d->bDescriptorSubtype << 16; /* virtual type */ + term->id = id; + term->name = uac_selector_unit_iSelector(d); +@@ -1263,8 +1264,9 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void + return err; + + /* determine the input source type and name */ +- if (check_input_term(state, hdr->bSourceID, &iterm) < 0) +- return -EINVAL; ++ err = check_input_term(state, hdr->bSourceID, &iterm); ++ if (err < 0) ++ return err; + + master_bits = snd_usb_combine_bytes(bmaControls, csize); + /* master configuration quirks */ +@@ -2018,7 +2020,7 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer) + state.oterm.type = le16_to_cpu(desc->wTerminalType); + state.oterm.name = desc->iTerminal; + err = parse_audio_unit(&state, desc->bSourceID); +- if (err < 0) ++ if (err < 0 && err != -EINVAL) + return err; + } else { /* UAC_VERSION_2 */ + struct uac2_output_terminal_descriptor *desc = p; +@@ -2030,12 +2032,12 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer) + state.oterm.type = le16_to_cpu(desc->wTerminalType); + state.oterm.name = desc->iTerminal; + err = parse_audio_unit(&state, desc->bSourceID); +- if (err < 0) ++ if (err < 0 && err != -EINVAL) + return err; + + /* for UAC2, use the same approach to also add the clock selectors */ + err = parse_audio_unit(&state, desc->bCSourceID); +- if (err < 0) ++ if (err < 0 && err != -EINVAL) + return err; + } + } +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index 0961d88..5e19410 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -393,13 +393,19 @@ int main(void) + len = recvfrom(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0, + addr_p, &addr_l); + +- if (len < 0 || addr.nl_pid) { ++ if (len < 0) { + syslog(LOG_ERR, "recvfrom failed; pid:%u error:%d %s", + addr.nl_pid, errno, strerror(errno)); + close(fd); + return -1; + } + ++ if (addr.nl_pid) { ++ syslog(LOG_WARNING, "Received packet from untrusted pid:%u", ++ addr.nl_pid); ++ continue; ++ } ++ + incoming_msg = (struct nlmsghdr *)kvp_recv_buffer; + incoming_cn_msg = (struct cn_msg *)NLMSG_DATA(incoming_msg); + +diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c +index bf54c48..6c164dc 100644 +--- a/tools/perf/util/trace-event-parse.c ++++ b/tools/perf/util/trace-event-parse.c +@@ -1582,8 +1582,6 @@ process_symbols(struct event *event, struct print_arg *arg, char **tok) + field = malloc_or_die(sizeof(*field)); + + type = process_arg(event, field, &token); +- while (type == EVENT_OP) +- type = process_op(event, field, &token); + if (test_type_token(type, token, EVENT_DELIM, ",")) + goto out_free; + |