Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-lts/patches-3.4/0154-3.4.55-all-fixes.patch

    Contents of /trunk/kernel-lts/patches-3.4/0154-3.4.55-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2264 - (show annotations) (download)
    Mon Aug 19 09:33:43 2013 UTC (10 years, 8 months ago) by niro
    File size: 58209 byte(s) 
    -fixed patches
    1 diff --git a/arch/sparc/kernel/asm-offsets.c b/arch/sparc/kernel/asm-offsets.c
    2 index 68f7e11..ce48203 100644
    3 --- a/arch/sparc/kernel/asm-offsets.c
    4 +++ b/arch/sparc/kernel/asm-offsets.c
    5 @@ -34,6 +34,8 @@ int foo(void)
    6 DEFINE(AOFF_task_thread, offsetof(struct task_struct, thread));
    7 BLANK();
    8 DEFINE(AOFF_mm_context, offsetof(struct mm_struct, context));
    9 + BLANK();
    10 + DEFINE(VMA_VM_MM, offsetof(struct vm_area_struct, vm_mm));
    11
    12 /* DEFINE(NUM_USER_SEGMENTS, TASK_SIZE>>28); */
    13 return 0;
    14 diff --git a/arch/sparc/mm/hypersparc.S b/arch/sparc/mm/hypersparc.S
    15 index 44aad32..969f964 100644
    16 --- a/arch/sparc/mm/hypersparc.S
    17 +++ b/arch/sparc/mm/hypersparc.S
    18 @@ -74,7 +74,7 @@ hypersparc_flush_cache_mm_out:
    19
    20 /* The things we do for performance... */
    21 hypersparc_flush_cache_range:
    22 - ld [%o0 + 0x0], %o0 /* XXX vma->vm_mm, GROSS XXX */
    23 + ld [%o0 + VMA_VM_MM], %o0
    24 #ifndef CONFIG_SMP
    25 ld [%o0 + AOFF_mm_context], %g1
    26 cmp %g1, -1
    27 @@ -163,7 +163,7 @@ hypersparc_flush_cache_range_out:
    28 */
    29 /* Verified, my ass... */
    30 hypersparc_flush_cache_page:
    31 - ld [%o0 + 0x0], %o0 /* XXX vma->vm_mm, GROSS XXX */
    32 + ld [%o0 + VMA_VM_MM], %o0
    33 ld [%o0 + AOFF_mm_context], %g2
    34 #ifndef CONFIG_SMP
    35 cmp %g2, -1
    36 @@ -284,7 +284,7 @@ hypersparc_flush_tlb_mm_out:
    37 sta %g5, [%g1] ASI_M_MMUREGS
    38
    39 hypersparc_flush_tlb_range:
    40 - ld [%o0 + 0x00], %o0 /* XXX vma->vm_mm GROSS XXX */
    41 + ld [%o0 + VMA_VM_MM], %o0
    42 mov SRMMU_CTX_REG, %g1
    43 ld [%o0 + AOFF_mm_context], %o3
    44 lda [%g1] ASI_M_MMUREGS, %g5
    45 @@ -307,7 +307,7 @@ hypersparc_flush_tlb_range_out:
    46 sta %g5, [%g1] ASI_M_MMUREGS
    47
    48 hypersparc_flush_tlb_page:
    49 - ld [%o0 + 0x00], %o0 /* XXX vma->vm_mm GROSS XXX */
    50 + ld [%o0 + VMA_VM_MM], %o0
    51 mov SRMMU_CTX_REG, %g1
    52 ld [%o0 + AOFF_mm_context], %o3
    53 andn %o1, (PAGE_SIZE - 1), %o1
    54 diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
    55 index 0791618..7f8238f 100644
    56 --- a/arch/sparc/mm/init_64.c
    57 +++ b/arch/sparc/mm/init_64.c
    58 @@ -1067,7 +1067,14 @@ static int __init grab_mblocks(struct mdesc_handle *md)
    59 m->size = *val;
    60 val = mdesc_get_property(md, node,
    61 "address-congruence-offset", NULL);
    62 - m->offset = *val;
    63 +
    64 + /* The address-congruence-offset property is optional.
    65 + * Explicity zero it be identifty this.
    66 + */
    67 + if (val)
    68 + m->offset = *val;
    69 + else
    70 + m->offset = 0UL;
    71
    72 numadbg("MBLOCK[%d]: base[%llx] size[%llx] offset[%llx]\n",
    73 count - 1, m->base, m->size, m->offset);
    74 diff --git a/arch/sparc/mm/swift.S b/arch/sparc/mm/swift.S
    75 index c801c39..5d2b88d 100644
    76 --- a/arch/sparc/mm/swift.S
    77 +++ b/arch/sparc/mm/swift.S
    78 @@ -105,7 +105,7 @@ swift_flush_cache_mm_out:
    79
    80 .globl swift_flush_cache_range
    81 swift_flush_cache_range:
    82 - ld [%o0 + 0x0], %o0 /* XXX vma->vm_mm, GROSS XXX */
    83 + ld [%o0 + VMA_VM_MM], %o0
    84 sub %o2, %o1, %o2
    85 sethi %hi(4096), %o3
    86 cmp %o2, %o3
    87 @@ -116,7 +116,7 @@ swift_flush_cache_range:
    88
    89 .globl swift_flush_cache_page
    90 swift_flush_cache_page:
    91 - ld [%o0 + 0x0], %o0 /* XXX vma->vm_mm, GROSS XXX */
    92 + ld [%o0 + VMA_VM_MM], %o0
    93 70:
    94 ld [%o0 + AOFF_mm_context], %g2
    95 cmp %g2, -1
    96 @@ -219,7 +219,7 @@ swift_flush_sig_insns:
    97 .globl swift_flush_tlb_range
    98 .globl swift_flush_tlb_all
    99 swift_flush_tlb_range:
    100 - ld [%o0 + 0x00], %o0 /* XXX vma->vm_mm GROSS XXX */
    101 + ld [%o0 + VMA_VM_MM], %o0
    102 swift_flush_tlb_mm:
    103 ld [%o0 + AOFF_mm_context], %g2
    104 cmp %g2, -1
    105 @@ -233,7 +233,7 @@ swift_flush_tlb_all_out:
    106
    107 .globl swift_flush_tlb_page
    108 swift_flush_tlb_page:
    109 - ld [%o0 + 0x00], %o0 /* XXX vma->vm_mm GROSS XXX */
    110 + ld [%o0 + VMA_VM_MM], %o0
    111 mov SRMMU_CTX_REG, %g1
    112 ld [%o0 + AOFF_mm_context], %o3
    113 andn %o1, (PAGE_SIZE - 1), %o1
    114 diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
    115 index afd021e..072f553 100644
    116 --- a/arch/sparc/mm/tlb.c
    117 +++ b/arch/sparc/mm/tlb.c
    118 @@ -115,8 +115,8 @@ no_cache_flush:
    119 }
    120
    121 if (!tb->active) {
    122 - global_flush_tlb_page(mm, vaddr);
    123 flush_tsb_user_page(mm, vaddr);
    124 + global_flush_tlb_page(mm, vaddr);
    125 goto out;
    126 }
    127
    128 diff --git a/arch/sparc/mm/tsunami.S b/arch/sparc/mm/tsunami.S
    129 index 4e55e8f..bf10a34 100644
    130 --- a/arch/sparc/mm/tsunami.S
    131 +++ b/arch/sparc/mm/tsunami.S
    132 @@ -24,7 +24,7 @@
    133 /* Sliiick... */
    134 tsunami_flush_cache_page:
    135 tsunami_flush_cache_range:
    136 - ld [%o0 + 0x0], %o0 /* XXX vma->vm_mm, GROSS XXX */
    137 + ld [%o0 + VMA_VM_MM], %o0
    138 tsunami_flush_cache_mm:
    139 ld [%o0 + AOFF_mm_context], %g2
    140 cmp %g2, -1
    141 @@ -46,7 +46,7 @@ tsunami_flush_sig_insns:
    142
    143 /* More slick stuff... */
    144 tsunami_flush_tlb_range:
    145 - ld [%o0 + 0x00], %o0 /* XXX vma->vm_mm GROSS XXX */
    146 + ld [%o0 + VMA_VM_MM], %o0
    147 tsunami_flush_tlb_mm:
    148 ld [%o0 + AOFF_mm_context], %g2
    149 cmp %g2, -1
    150 @@ -65,7 +65,7 @@ tsunami_flush_tlb_out:
    151
    152 /* This one can be done in a fine grained manner... */
    153 tsunami_flush_tlb_page:
    154 - ld [%o0 + 0x00], %o0 /* XXX vma->vm_mm GROSS XXX */
    155 + ld [%o0 + VMA_VM_MM], %o0
    156 mov SRMMU_CTX_REG, %g1
    157 ld [%o0 + AOFF_mm_context], %o3
    158 andn %o1, (PAGE_SIZE - 1), %o1
    159 diff --git a/arch/sparc/mm/viking.S b/arch/sparc/mm/viking.S
    160 index 6dfcc13..a516372 100644
    161 --- a/arch/sparc/mm/viking.S
    162 +++ b/arch/sparc/mm/viking.S
    163 @@ -109,7 +109,7 @@ viking_mxcc_flush_page:
    164 viking_flush_cache_page:
    165 viking_flush_cache_range:
    166 #ifndef CONFIG_SMP
    167 - ld [%o0 + 0x0], %o0 /* XXX vma->vm_mm, GROSS XXX */
    168 + ld [%o0 + VMA_VM_MM], %o0
    169 #endif
    170 viking_flush_cache_mm:
    171 #ifndef CONFIG_SMP
    172 @@ -149,7 +149,7 @@ viking_flush_tlb_mm:
    173 #endif
    174
    175 viking_flush_tlb_range:
    176 - ld [%o0 + 0x00], %o0 /* XXX vma->vm_mm GROSS XXX */
    177 + ld [%o0 + VMA_VM_MM], %o0
    178 mov SRMMU_CTX_REG, %g1
    179 ld [%o0 + AOFF_mm_context], %o3
    180 lda [%g1] ASI_M_MMUREGS, %g5
    181 @@ -174,7 +174,7 @@ viking_flush_tlb_range:
    182 #endif
    183
    184 viking_flush_tlb_page:
    185 - ld [%o0 + 0x00], %o0 /* XXX vma->vm_mm GROSS XXX */
    186 + ld [%o0 + VMA_VM_MM], %o0
    187 mov SRMMU_CTX_REG, %g1
    188 ld [%o0 + AOFF_mm_context], %o3
    189 lda [%g1] ASI_M_MMUREGS, %g5
    190 @@ -240,7 +240,7 @@ sun4dsmp_flush_tlb_range:
    191 tst %g5
    192 bne 3f
    193 mov SRMMU_CTX_REG, %g1
    194 - ld [%o0 + 0x00], %o0 /* XXX vma->vm_mm GROSS XXX */
    195 + ld [%o0 + VMA_VM_MM], %o0
    196 ld [%o0 + AOFF_mm_context], %o3
    197 lda [%g1] ASI_M_MMUREGS, %g5
    198 sethi %hi(~((1 << SRMMU_PGDIR_SHIFT) - 1)), %o4
    199 @@ -266,7 +266,7 @@ sun4dsmp_flush_tlb_page:
    200 tst %g5
    201 bne 2f
    202 mov SRMMU_CTX_REG, %g1
    203 - ld [%o0 + 0x00], %o0 /* XXX vma->vm_mm GROSS XXX */
    204 + ld [%o0 + VMA_VM_MM], %o0
    205 ld [%o0 + AOFF_mm_context], %o3
    206 lda [%g1] ASI_M_MMUREGS, %g5
    207 and %o1, PAGE_MASK, %o1
    208 diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
    209 index af58f9b..45cc02b 100644
    210 --- a/drivers/ata/ata_piix.c
    211 +++ b/drivers/ata/ata_piix.c
    212 @@ -352,6 +352,8 @@ static const struct pci_device_id piix_pci_tbl[] = {
    213 /* SATA Controller IDE (BayTrail) */
    214 { 0x8086, 0x0F20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt },
    215 { 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt },
    216 + /* SATA Controller IDE (Coleto Creek) */
    217 + { 0x8086, 0x23a6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
    218
    219 { } /* terminate list */
    220 };
    221 diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
    222 index 21b80c5..f63a588 100644
    223 --- a/drivers/ata/libata-pmp.c
    224 +++ b/drivers/ata/libata-pmp.c
    225 @@ -389,9 +389,13 @@ static void sata_pmp_quirks(struct ata_port *ap)
    226 /* link reports offline after LPM */
    227 link->flags |= ATA_LFLAG_NO_LPM;
    228
    229 - /* Class code report is unreliable. */
    230 + /*
    231 + * Class code report is unreliable and SRST times
    232 + * out under certain configurations.
    233 + */
    234 if (link->pmp < 5)
    235 - link->flags |= ATA_LFLAG_ASSUME_ATA;
    236 + link->flags |= ATA_LFLAG_NO_SRST |
    237 + ATA_LFLAG_ASSUME_ATA;
    238
    239 /* port 5 is for SEMB device and it doesn't like SRST */
    240 if (link->pmp == 5)
    241 @@ -399,20 +403,17 @@ static void sata_pmp_quirks(struct ata_port *ap)
    242 ATA_LFLAG_ASSUME_SEMB;
    243 }
    244 } else if (vendor == 0x1095 && devid == 0x4723) {
    245 - /* sil4723 quirks */
    246 - ata_for_each_link(link, ap, EDGE) {
    247 - /* link reports offline after LPM */
    248 - link->flags |= ATA_LFLAG_NO_LPM;
    249 -
    250 - /* class code report is unreliable */
    251 - if (link->pmp < 2)
    252 - link->flags |= ATA_LFLAG_ASSUME_ATA;
    253 -
    254 - /* the config device at port 2 locks up on SRST */
    255 - if (link->pmp == 2)
    256 - link->flags |= ATA_LFLAG_NO_SRST |
    257 - ATA_LFLAG_ASSUME_ATA;
    258 - }
    259 + /*
    260 + * sil4723 quirks
    261 + *
    262 + * Link reports offline after LPM. Class code report is
    263 + * unreliable. SIMG PMPs never got SRST reliable and the
    264 + * config device at port 2 locks up on SRST.
    265 + */
    266 + ata_for_each_link(link, ap, EDGE)
    267 + link->flags |= ATA_LFLAG_NO_LPM |
    268 + ATA_LFLAG_NO_SRST |
    269 + ATA_LFLAG_ASSUME_ATA;
    270 } else if (vendor == 0x1095 && devid == 0x4726) {
    271 /* sil4726 quirks */
    272 ata_for_each_link(link, ap, EDGE) {
    273 diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
    274 index 99a8444..c0536ed 100644
    275 --- a/drivers/iommu/amd_iommu.c
    276 +++ b/drivers/iommu/amd_iommu.c
    277 @@ -1309,6 +1309,10 @@ static unsigned long iommu_unmap_page(struct protection_domain *dom,
    278
    279 /* Large PTE found which maps this address */
    280 unmap_size = PTE_PAGE_SIZE(*pte);
    281 +
    282 + /* Only unmap from the first pte in the page */
    283 + if ((unmap_size - 1) & bus_addr)
    284 + break;
    285 count = PAGE_SIZE_PTE_COUNT(unmap_size);
    286 for (i = 0; i < count; i++)
    287 pte[i] = 0ULL;
    288 @@ -1318,7 +1322,7 @@ static unsigned long iommu_unmap_page(struct protection_domain *dom,
    289 unmapped += unmap_size;
    290 }
    291
    292 - BUG_ON(!is_power_of_2(unmapped));
    293 + BUG_ON(unmapped && !is_power_of_2(unmapped));
    294
    295 return unmapped;
    296 }
    297 diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
    298 index bab0158..b33ad12 100644
    299 --- a/drivers/net/dummy.c
    300 +++ b/drivers/net/dummy.c
    301 @@ -186,6 +186,8 @@ static int __init dummy_init_module(void)
    302
    303 rtnl_lock();
    304 err = __rtnl_link_register(&dummy_link_ops);
    305 + if (err < 0)
    306 + goto out;
    307
    308 for (i = 0; i < numdummies && !err; i++) {
    309 err = dummy_init_one();
    310 @@ -193,6 +195,8 @@ static int __init dummy_init_module(void)
    311 }
    312 if (err < 0)
    313 __rtnl_link_unregister(&dummy_link_ops);
    314 +
    315 +out:
    316 rtnl_unlock();
    317
    318 return err;
    319 diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
    320 index d53509e..d4a747a 100644
    321 --- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
    322 +++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
    323 @@ -1688,8 +1688,8 @@ check_sum:
    324 return 0;
    325 }
    326
    327 -static void atl1e_tx_map(struct atl1e_adapter *adapter,
    328 - struct sk_buff *skb, struct atl1e_tpd_desc *tpd)
    329 +static int atl1e_tx_map(struct atl1e_adapter *adapter,
    330 + struct sk_buff *skb, struct atl1e_tpd_desc *tpd)
    331 {
    332 struct atl1e_tpd_desc *use_tpd = NULL;
    333 struct atl1e_tx_buffer *tx_buffer = NULL;
    334 @@ -1700,6 +1700,8 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
    335 u16 nr_frags;
    336 u16 f;
    337 int segment;
    338 + int ring_start = adapter->tx_ring.next_to_use;
    339 + int ring_end;
    340
    341 nr_frags = skb_shinfo(skb)->nr_frags;
    342 segment = (tpd->word3 >> TPD_SEGMENT_EN_SHIFT) & TPD_SEGMENT_EN_MASK;
    343 @@ -1712,6 +1714,9 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
    344 tx_buffer->length = map_len;
    345 tx_buffer->dma = pci_map_single(adapter->pdev,
    346 skb->data, hdr_len, PCI_DMA_TODEVICE);
    347 + if (dma_mapping_error(&adapter->pdev->dev, tx_buffer->dma))
    348 + return -ENOSPC;
    349 +
    350 ATL1E_SET_PCIMAP_TYPE(tx_buffer, ATL1E_TX_PCIMAP_SINGLE);
    351 mapped_len += map_len;
    352 use_tpd->buffer_addr = cpu_to_le64(tx_buffer->dma);
    353 @@ -1738,6 +1743,22 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
    354 tx_buffer->dma =
    355 pci_map_single(adapter->pdev, skb->data + mapped_len,
    356 map_len, PCI_DMA_TODEVICE);
    357 +
    358 + if (dma_mapping_error(&adapter->pdev->dev, tx_buffer->dma)) {
    359 + /* We need to unwind the mappings we've done */
    360 + ring_end = adapter->tx_ring.next_to_use;
    361 + adapter->tx_ring.next_to_use = ring_start;
    362 + while (adapter->tx_ring.next_to_use != ring_end) {
    363 + tpd = atl1e_get_tpd(adapter);
    364 + tx_buffer = atl1e_get_tx_buffer(adapter, tpd);
    365 + pci_unmap_single(adapter->pdev, tx_buffer->dma,
    366 + tx_buffer->length, PCI_DMA_TODEVICE);
    367 + }
    368 + /* Reset the tx rings next pointer */
    369 + adapter->tx_ring.next_to_use = ring_start;
    370 + return -ENOSPC;
    371 + }
    372 +
    373 ATL1E_SET_PCIMAP_TYPE(tx_buffer, ATL1E_TX_PCIMAP_SINGLE);
    374 mapped_len += map_len;
    375 use_tpd->buffer_addr = cpu_to_le64(tx_buffer->dma);
    376 @@ -1773,6 +1794,23 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
    377 (i * MAX_TX_BUF_LEN),
    378 tx_buffer->length,
    379 DMA_TO_DEVICE);
    380 +
    381 + if (dma_mapping_error(&adapter->pdev->dev, tx_buffer->dma)) {
    382 + /* We need to unwind the mappings we've done */
    383 + ring_end = adapter->tx_ring.next_to_use;
    384 + adapter->tx_ring.next_to_use = ring_start;
    385 + while (adapter->tx_ring.next_to_use != ring_end) {
    386 + tpd = atl1e_get_tpd(adapter);
    387 + tx_buffer = atl1e_get_tx_buffer(adapter, tpd);
    388 + dma_unmap_page(&adapter->pdev->dev, tx_buffer->dma,
    389 + tx_buffer->length, DMA_TO_DEVICE);
    390 + }
    391 +
    392 + /* Reset the ring next to use pointer */
    393 + adapter->tx_ring.next_to_use = ring_start;
    394 + return -ENOSPC;
    395 + }
    396 +
    397 ATL1E_SET_PCIMAP_TYPE(tx_buffer, ATL1E_TX_PCIMAP_PAGE);
    398 use_tpd->buffer_addr = cpu_to_le64(tx_buffer->dma);
    399 use_tpd->word2 = (use_tpd->word2 & (~TPD_BUFLEN_MASK)) |
    400 @@ -1790,6 +1828,7 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
    401 /* The last buffer info contain the skb address,
    402 so it will be free after unmap */
    403 tx_buffer->skb = skb;
    404 + return 0;
    405 }
    406
    407 static void atl1e_tx_queue(struct atl1e_adapter *adapter, u16 count,
    408 @@ -1857,10 +1896,15 @@ static netdev_tx_t atl1e_xmit_frame(struct sk_buff *skb,
    409 return NETDEV_TX_OK;
    410 }
    411
    412 - atl1e_tx_map(adapter, skb, tpd);
    413 + if (atl1e_tx_map(adapter, skb, tpd)) {
    414 + dev_kfree_skb_any(skb);
    415 + goto out;
    416 + }
    417 +
    418 atl1e_tx_queue(adapter, tpd_req, tpd);
    419
    420 netdev->trans_start = jiffies; /* NETIF_F_LLTX driver :( */
    421 +out:
    422 spin_unlock_irqrestore(&adapter->tx_lock, flags);
    423 return NETDEV_TX_OK;
    424 }
    425 diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
    426 index d63e09b..16caeba 100644
    427 --- a/drivers/net/ethernet/renesas/sh_eth.c
    428 +++ b/drivers/net/ethernet/renesas/sh_eth.c
    429 @@ -137,8 +137,9 @@ static struct sh_eth_cpu_data sh_eth_my_cpu_data = {
    430 .rmcr_value = 0x00000001,
    431
    432 .tx_check = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO,
    433 - .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RDE |
    434 - EESR_RFRMER | EESR_TFE | EESR_TDE | EESR_ECI,
    435 + .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
    436 + EESR_RDE | EESR_RFRMER | EESR_TFE | EESR_TDE |
    437 + EESR_ECI,
    438 .tx_error_check = EESR_TWB | EESR_TABT | EESR_TDE | EESR_TFE,
    439
    440 .apr = 1,
    441 @@ -252,9 +253,9 @@ static struct sh_eth_cpu_data sh_eth_my_cpu_data_giga = {
    442 .eesipr_value = DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff,
    443
    444 .tx_check = EESR_TC1 | EESR_FTC,
    445 - .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT | \
    446 - EESR_RDE | EESR_RFRMER | EESR_TFE | EESR_TDE | \
    447 - EESR_ECI,
    448 + .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT |
    449 + EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
    450 + EESR_TDE | EESR_ECI,
    451 .tx_error_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_TDE | \
    452 EESR_TFE,
    453 .fdr_value = 0x0000072f,
    454 @@ -361,9 +362,9 @@ static struct sh_eth_cpu_data sh_eth_my_cpu_data = {
    455 .eesipr_value = DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff,
    456
    457 .tx_check = EESR_TC1 | EESR_FTC,
    458 - .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT | \
    459 - EESR_RDE | EESR_RFRMER | EESR_TFE | EESR_TDE | \
    460 - EESR_ECI,
    461 + .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT |
    462 + EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
    463 + EESR_TDE | EESR_ECI,
    464 .tx_error_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_TDE | \
    465 EESR_TFE,
    466
    467 diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
    468 index 0fa14afc..c49097f 100644
    469 --- a/drivers/net/ethernet/renesas/sh_eth.h
    470 +++ b/drivers/net/ethernet/renesas/sh_eth.h
    471 @@ -467,7 +467,7 @@ enum EESR_BIT {
    472
    473 #define DEFAULT_TX_CHECK (EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | \
    474 EESR_RTO)
    475 -#define DEFAULT_EESR_ERR_CHECK (EESR_TWB | EESR_TABT | EESR_RABT | \
    476 +#define DEFAULT_EESR_ERR_CHECK (EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE | \
    477 EESR_RDE | EESR_RFRMER | EESR_ADE | \
    478 EESR_TFE | EESR_TDE | EESR_ECI)
    479 #define DEFAULT_TX_ERROR_CHECK (EESR_TWB | EESR_TABT | EESR_ADE | EESR_TDE | \
    480 diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
    481 index 38e3ae9..8e2ac64 100644
    482 --- a/drivers/net/ethernet/sun/sunvnet.c
    483 +++ b/drivers/net/ethernet/sun/sunvnet.c
    484 @@ -1243,6 +1243,8 @@ static int vnet_port_remove(struct vio_dev *vdev)
    485 dev_set_drvdata(&vdev->dev, NULL);
    486
    487 kfree(port);
    488 +
    489 + unregister_netdev(vp->dev);
    490 }
    491 return 0;
    492 }
    493 diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
    494 index 344dceb..635d01c 100644
    495 --- a/drivers/net/ifb.c
    496 +++ b/drivers/net/ifb.c
    497 @@ -290,11 +290,17 @@ static int __init ifb_init_module(void)
    498
    499 rtnl_lock();
    500 err = __rtnl_link_register(&ifb_link_ops);
    501 + if (err < 0)
    502 + goto out;
    503
    504 - for (i = 0; i < numifbs && !err; i++)
    505 + for (i = 0; i < numifbs && !err; i++) {
    506 err = ifb_init_one(i);
    507 + cond_resched();
    508 + }
    509 if (err)
    510 __rtnl_link_unregister(&ifb_link_ops);
    511 +
    512 +out:
    513 rtnl_unlock();
    514
    515 return err;
    516 diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
    517 index b99c418..5151f06 100644
    518 --- a/drivers/net/macvtap.c
    519 +++ b/drivers/net/macvtap.c
    520 @@ -534,8 +534,10 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
    521 return -EMSGSIZE;
    522 num_pages = get_user_pages_fast(base, size, 0, &page[i]);
    523 if (num_pages != size) {
    524 - for (i = 0; i < num_pages; i++)
    525 - put_page(page[i]);
    526 + int j;
    527 +
    528 + for (j = 0; j < num_pages; j++)
    529 + put_page(page[i + j]);
    530 }
    531 truesize = size * PAGE_SIZE;
    532 skb->data_len += len;
    533 @@ -654,6 +656,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
    534 int vnet_hdr_len = 0;
    535 int copylen = 0;
    536 bool zerocopy = false;
    537 + size_t linear;
    538
    539 if (q->flags & IFF_VNET_HDR) {
    540 vnet_hdr_len = q->vnet_hdr_sz;
    541 @@ -708,11 +711,14 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
    542 copylen = vnet_hdr.hdr_len;
    543 if (!copylen)
    544 copylen = GOODCOPY_LEN;
    545 - } else
    546 + linear = copylen;
    547 + } else {
    548 copylen = len;
    549 + linear = vnet_hdr.hdr_len;
    550 + }
    551
    552 skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen,
    553 - vnet_hdr.hdr_len, noblock, &err);
    554 + linear, noblock, &err);
    555 if (!skb)
    556 goto err;
    557
    558 diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
    559 index bbd249d..85e7453 100644
    560 --- a/drivers/net/wireless/ath/ath9k/calib.c
    561 +++ b/drivers/net/wireless/ath/ath9k/calib.c
    562 @@ -389,7 +389,6 @@ bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan)
    563
    564 if (!caldata) {
    565 chan->noisefloor = nf;
    566 - ah->noise = ath9k_hw_getchan_noise(ah, chan);
    567 return false;
    568 }
    569
    570 diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
    571 index 2ce6bf5..72cb121 100644
    572 --- a/drivers/net/wireless/rt2x00/rt2800lib.c
    573 +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
    574 @@ -4627,8 +4627,8 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
    575 default_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
    576
    577 for (i = 14; i < spec->num_channels; i++) {
    578 - info[i].default_power1 = default_power1[i];
    579 - info[i].default_power2 = default_power2[i];
    580 + info[i].default_power1 = default_power1[i - 14];
    581 + info[i].default_power2 = default_power2[i - 14];
    582 }
    583 }
    584
    585 diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
    586 index bdaba3f..0cb0eec 100644
    587 --- a/drivers/net/wireless/rt2x00/rt61pci.c
    588 +++ b/drivers/net/wireless/rt2x00/rt61pci.c
    589 @@ -2822,7 +2822,8 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
    590 tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
    591 for (i = 14; i < spec->num_channels; i++) {
    592 info[i].max_power = MAX_TXPOWER;
    593 - info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
    594 + info[i].default_power1 =
    595 + TXPOWER_FROM_DEV(tx_power[i - 14]);
    596 }
    597 }
    598
    599 diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
    600 index fda8671..ffdd32e 100644
    601 --- a/drivers/net/wireless/rt2x00/rt73usb.c
    602 +++ b/drivers/net/wireless/rt2x00/rt73usb.c
    603 @@ -2167,7 +2167,8 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
    604 tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
    605 for (i = 14; i < spec->num_channels; i++) {
    606 info[i].max_power = MAX_TXPOWER;
    607 - info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
    608 + info[i].default_power1 =
    609 + TXPOWER_FROM_DEV(tx_power[i - 14]);
    610 }
    611 }
    612
    613 diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
    614 index 2136fc2..5fdf70b 100644
    615 --- a/drivers/s390/scsi/zfcp_fsf.c
    616 +++ b/drivers/s390/scsi/zfcp_fsf.c
    617 @@ -563,6 +563,10 @@ static void zfcp_fsf_exchange_config_data_handler(struct zfcp_fsf_req *req)
    618 fc_host_port_type(shost) = FC_PORTTYPE_UNKNOWN;
    619 adapter->hydra_version = 0;
    620
    621 + /* avoids adapter shutdown to be able to recognize
    622 + * events such as LINK UP */
    623 + atomic_set_mask(ZFCP_STATUS_ADAPTER_XCONFIG_OK,
    624 + &adapter->status);
    625 zfcp_fsf_link_down_info_eval(req,
    626 &qtcb->header.fsf_status_qual.link_down_info);
    627 break;
    628 diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
    629 index b79576b..7b35364 100644
    630 --- a/drivers/s390/scsi/zfcp_scsi.c
    631 +++ b/drivers/s390/scsi/zfcp_scsi.c
    632 @@ -3,7 +3,7 @@
    633 *
    634 * Interface to Linux SCSI midlayer.
    635 *
    636 - * Copyright IBM Corporation 2002, 2010
    637 + * Copyright IBM Corp. 2002, 2013
    638 */
    639
    640 #define KMSG_COMPONENT "zfcp"
    641 @@ -311,8 +311,12 @@ static struct scsi_host_template zfcp_scsi_host_template = {
    642 .proc_name = "zfcp",
    643 .can_queue = 4096,
    644 .this_id = -1,
    645 - .sg_tablesize = 1, /* adjusted later */
    646 - .max_sectors = 8, /* adjusted later */
    647 + .sg_tablesize = (((QDIO_MAX_ELEMENTS_PER_BUFFER - 1)
    648 + * ZFCP_QDIO_MAX_SBALS_PER_REQ) - 2),
    649 + /* GCD, adjusted later */
    650 + .max_sectors = (((QDIO_MAX_ELEMENTS_PER_BUFFER - 1)
    651 + * ZFCP_QDIO_MAX_SBALS_PER_REQ) - 2) * 8,
    652 + /* GCD, adjusted later */
    653 .dma_boundary = ZFCP_QDIO_SBALE_LEN - 1,
    654 .cmd_per_lun = 1,
    655 .use_clustering = 1,
    656 diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
    657 index e897ce9..f8a2d12 100644
    658 --- a/drivers/scsi/bnx2fc/bnx2fc_io.c
    659 +++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
    660 @@ -1786,7 +1786,7 @@ static void bnx2fc_parse_fcp_rsp(struct bnx2fc_cmd *io_req,
    661 fcp_sns_len = SCSI_SENSE_BUFFERSIZE;
    662 }
    663
    664 - memset(sc_cmd->sense_buffer, 0, sizeof(sc_cmd->sense_buffer));
    665 + memset(sc_cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
    666 if (fcp_sns_len)
    667 memcpy(sc_cmd->sense_buffer, rq_data, fcp_sns_len);
    668
    669 diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
    670 index 6308a8d..073d5ad 100644
    671 --- a/drivers/scsi/megaraid/megaraid_sas_base.c
    672 +++ b/drivers/scsi/megaraid/megaraid_sas_base.c
    673 @@ -4817,10 +4817,12 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
    674 sense, sense_handle);
    675 }
    676
    677 - for (i = 0; i < ioc->sge_count && kbuff_arr[i]; i++) {
    678 - dma_free_coherent(&instance->pdev->dev,
    679 - kern_sge32[i].length,
    680 - kbuff_arr[i], kern_sge32[i].phys_addr);
    681 + for (i = 0; i < ioc->sge_count; i++) {
    682 + if (kbuff_arr[i])
    683 + dma_free_coherent(&instance->pdev->dev,
    684 + kern_sge32[i].length,
    685 + kbuff_arr[i],
    686 + kern_sge32[i].phys_addr);
    687 }
    688
    689 megasas_return_cmd(instance, cmd);
    690 diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
    691 index d953a57..35a05d1 100644
    692 --- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
    693 +++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
    694 @@ -3963,11 +3963,7 @@ _scsih_qcmd_lck(struct scsi_cmnd *scmd, void (*done)(struct scsi_cmnd *))
    695 else
    696 mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ;
    697 } else
    698 -/* MPI Revision I (UNIT = 0xA) - removed MPI2_SCSIIO_CONTROL_UNTAGGED */
    699 -/* mpi_control |= MPI2_SCSIIO_CONTROL_UNTAGGED;
    700 - */
    701 - mpi_control |= (0x500);
    702 -
    703 + mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ;
    704 } else
    705 mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ;
    706 /* Make sure Device is not raid volume.
    707 diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    708 index d9811e4..b53065b 100644
    709 --- a/drivers/usb/serial/cp210x.c
    710 +++ b/drivers/usb/serial/cp210x.c
    711 @@ -60,6 +60,7 @@ static const struct usb_device_id id_table[] = {
    712 { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
    713 { USB_DEVICE(0x0489, 0xE003) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
    714 { USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */
    715 + { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
    716 { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
    717 { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
    718 { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
    719 @@ -124,6 +125,8 @@ static const struct usb_device_id id_table[] = {
    720 { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
    721 { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
    722 { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
    723 + { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
    724 + { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
    725 { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
    726 { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
    727 { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
    728 @@ -154,6 +157,7 @@ static const struct usb_device_id id_table[] = {
    729 { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
    730 { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
    731 { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
    732 + { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
    733 { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
    734 { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
    735 { USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */
    736 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    737 index 33e20e4..a37f14c 100644
    738 --- a/drivers/usb/serial/option.c
    739 +++ b/drivers/usb/serial/option.c
    740 @@ -347,17 +347,12 @@ static void option_instat_callback(struct urb *urb);
    741 #define OLIVETTI_VENDOR_ID 0x0b3c
    742 #define OLIVETTI_PRODUCT_OLICARD100 0xc000
    743 #define OLIVETTI_PRODUCT_OLICARD145 0xc003
    744 +#define OLIVETTI_PRODUCT_OLICARD200 0xc005
    745
    746 /* Celot products */
    747 #define CELOT_VENDOR_ID 0x211f
    748 #define CELOT_PRODUCT_CT680M 0x6801
    749
    750 -/* ONDA Communication vendor id */
    751 -#define ONDA_VENDOR_ID 0x1ee8
    752 -
    753 -/* ONDA MT825UP HSDPA 14.2 modem */
    754 -#define ONDA_MT825UP 0x000b
    755 -
    756 /* Samsung products */
    757 #define SAMSUNG_VENDOR_ID 0x04e8
    758 #define SAMSUNG_PRODUCT_GT_B3730 0x6889
    759 @@ -450,7 +445,8 @@ static void option_instat_callback(struct urb *urb);
    760
    761 /* Hyundai Petatel Inc. products */
    762 #define PETATEL_VENDOR_ID 0x1ff4
    763 -#define PETATEL_PRODUCT_NP10T 0x600e
    764 +#define PETATEL_PRODUCT_NP10T_600A 0x600a
    765 +#define PETATEL_PRODUCT_NP10T_600E 0x600e
    766
    767 /* TP-LINK Incorporated products */
    768 #define TPLINK_VENDOR_ID 0x2357
    769 @@ -797,6 +793,7 @@ static const struct usb_device_id option_ids[] = {
    770 { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
    771 { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */
    772 { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
    773 + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
    774 { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
    775 { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
    776 { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
    777 @@ -832,7 +829,8 @@ static const struct usb_device_id option_ids[] = {
    778 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff),
    779 .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
    780 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0018, 0xff, 0xff, 0xff) },
    781 - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0019, 0xff, 0xff, 0xff) },
    782 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0019, 0xff, 0xff, 0xff),
    783 + .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
    784 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0020, 0xff, 0xff, 0xff) },
    785 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0021, 0xff, 0xff, 0xff),
    786 .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    787 @@ -1278,8 +1276,8 @@ static const struct usb_device_id option_ids[] = {
    788
    789 { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
    790 { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
    791 + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200) },
    792 { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
    793 - { USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
    794 { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
    795 { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
    796 { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM610) },
    797 @@ -1351,9 +1349,12 @@ static const struct usb_device_id option_ids[] = {
    798 { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) },
    799 { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) },
    800 { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
    801 - { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T) },
    802 + { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) },
    803 + { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) },
    804 { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
    805 .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    806 + { USB_DEVICE(TPLINK_VENDOR_ID, 0x9000), /* TP-Link MA260 */
    807 + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    808 { USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) },
    809 { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x02, 0x01) }, /* D-Link DWM-156 (variant) */
    810 { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x00, 0x00) }, /* D-Link DWM-156 (variant) */
    811 @@ -1361,6 +1362,8 @@ static const struct usb_device_id option_ids[] = {
    812 { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) },
    813 { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
    814 { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
    815 + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
    816 + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
    817 { } /* Terminating entry */
    818 };
    819 MODULE_DEVICE_TABLE(usb, option_ids);
    820 diff --git a/fs/block_dev.c b/fs/block_dev.c
    821 index 2f3879c..319d9c7 100644
    822 --- a/fs/block_dev.c
    823 +++ b/fs/block_dev.c
    824 @@ -57,17 +57,24 @@ static void bdev_inode_switch_bdi(struct inode *inode,
    825 struct backing_dev_info *dst)
    826 {
    827 struct backing_dev_info *old = inode->i_data.backing_dev_info;
    828 + bool wakeup_bdi = false;
    829
    830 if (unlikely(dst == old)) /* deadlock avoidance */
    831 return;
    832 bdi_lock_two(&old->wb, &dst->wb);
    833 spin_lock(&inode->i_lock);
    834 inode->i_data.backing_dev_info = dst;
    835 - if (inode->i_state & I_DIRTY)
    836 + if (inode->i_state & I_DIRTY) {
    837 + if (bdi_cap_writeback_dirty(dst) && !wb_has_dirty_io(&dst->wb))
    838 + wakeup_bdi = true;
    839 list_move(&inode->i_wb_list, &dst->wb.b_dirty);
    840 + }
    841 spin_unlock(&inode->i_lock);
    842 spin_unlock(&old->wb.list_lock);
    843 spin_unlock(&dst->wb.list_lock);
    844 +
    845 + if (wakeup_bdi)
    846 + bdi_wakeup_thread_delayed(dst);
    847 }
    848
    849 sector_t blkdev_max_block(struct block_device *bdev)
    850 diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
    851 index 0752817..aad0f39 100644
    852 --- a/fs/ext3/inode.c
    853 +++ b/fs/ext3/inode.c
    854 @@ -218,7 +218,8 @@ void ext3_evict_inode (struct inode *inode)
    855 */
    856 if (inode->i_nlink && ext3_should_journal_data(inode) &&
    857 EXT3_SB(inode->i_sb)->s_journal &&
    858 - (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode))) {
    859 + (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode)) &&
    860 + inode->i_ino != EXT3_JOURNAL_INO) {
    861 tid_t commit_tid = atomic_read(&ei->i_datasync_tid);
    862 journal_t *journal = EXT3_SB(inode->i_sb)->s_journal;
    863
    864 diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
    865 index e46353f..aff1c61 100644
    866 --- a/fs/lockd/svclock.c
    867 +++ b/fs/lockd/svclock.c
    868 @@ -941,6 +941,7 @@ nlmsvc_retry_blocked(void)
    869 unsigned long timeout = MAX_SCHEDULE_TIMEOUT;
    870 struct nlm_block *block;
    871
    872 + spin_lock(&nlm_blocked_lock);
    873 while (!list_empty(&nlm_blocked) && !kthread_should_stop()) {
    874 block = list_entry(nlm_blocked.next, struct nlm_block, b_list);
    875
    876 @@ -950,6 +951,7 @@ nlmsvc_retry_blocked(void)
    877 timeout = block->b_when - jiffies;
    878 break;
    879 }
    880 + spin_unlock(&nlm_blocked_lock);
    881
    882 dprintk("nlmsvc_retry_blocked(%p, when=%ld)\n",
    883 block, block->b_when);
    884 @@ -959,7 +961,9 @@ nlmsvc_retry_blocked(void)
    885 retry_deferred_block(block);
    886 } else
    887 nlmsvc_grant_blocked(block);
    888 + spin_lock(&nlm_blocked_lock);
    889 }
    890 + spin_unlock(&nlm_blocked_lock);
    891
    892 return timeout;
    893 }
    894 diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
    895 index b5f927f..732c962 100644
    896 --- a/include/linux/if_pppox.h
    897 +++ b/include/linux/if_pppox.h
    898 @@ -128,11 +128,11 @@ struct pppoe_tag {
    899
    900 struct pppoe_hdr {
    901 #if defined(__LITTLE_ENDIAN_BITFIELD)
    902 - __u8 ver : 4;
    903 __u8 type : 4;
    904 + __u8 ver : 4;
    905 #elif defined(__BIG_ENDIAN_BITFIELD)
    906 - __u8 type : 4;
    907 __u8 ver : 4;
    908 + __u8 type : 4;
    909 #else
    910 #error "Please fix <asm/byteorder.h>"
    911 #endif
    912 diff --git a/include/net/addrconf.h b/include/net/addrconf.h
    913 index 757a176..1a77dbb 100644
    914 --- a/include/net/addrconf.h
    915 +++ b/include/net/addrconf.h
    916 @@ -81,6 +81,9 @@ extern int ipv6_dev_get_saddr(struct net *net,
    917 const struct in6_addr *daddr,
    918 unsigned int srcprefs,
    919 struct in6_addr *saddr);
    920 +extern int __ipv6_get_lladdr(struct inet6_dev *idev,
    921 + struct in6_addr *addr,
    922 + unsigned char banned_flags);
    923 extern int ipv6_get_lladdr(struct net_device *dev,
    924 struct in6_addr *addr,
    925 unsigned char banned_flags);
    926 diff --git a/include/net/udp.h b/include/net/udp.h
    927 index 5d606d9..d0bf5b6 100644
    928 --- a/include/net/udp.h
    929 +++ b/include/net/udp.h
    930 @@ -181,6 +181,7 @@ extern int udp_get_port(struct sock *sk, unsigned short snum,
    931 extern void udp_err(struct sk_buff *, u32);
    932 extern int udp_sendmsg(struct kiocb *iocb, struct sock *sk,
    933 struct msghdr *msg, size_t len);
    934 +extern int udp_push_pending_frames(struct sock *sk);
    935 extern void udp_flush_pending_frames(struct sock *sk);
    936 extern int udp_rcv(struct sk_buff *skb);
    937 extern int udp_ioctl(struct sock *sk, int cmd, unsigned long arg);
    938 diff --git a/kernel/events/core.c b/kernel/events/core.c
    939 index 7ceb270..d074cf0 100644
    940 --- a/kernel/events/core.c
    941 +++ b/kernel/events/core.c
    942 @@ -719,8 +719,18 @@ perf_lock_task_context(struct task_struct *task, int ctxn, unsigned long *flags)
    943 {
    944 struct perf_event_context *ctx;
    945
    946 - rcu_read_lock();
    947 retry:
    948 + /*
    949 + * One of the few rules of preemptible RCU is that one cannot do
    950 + * rcu_read_unlock() while holding a scheduler (or nested) lock when
    951 + * part of the read side critical section was preemptible -- see
    952 + * rcu_read_unlock_special().
    953 + *
    954 + * Since ctx->lock nests under rq->lock we must ensure the entire read
    955 + * side critical section is non-preemptible.
    956 + */
    957 + preempt_disable();
    958 + rcu_read_lock();
    959 ctx = rcu_dereference(task->perf_event_ctxp[ctxn]);
    960 if (ctx) {
    961 /*
    962 @@ -736,6 +746,8 @@ retry:
    963 raw_spin_lock_irqsave(&ctx->lock, *flags);
    964 if (ctx != rcu_dereference(task->perf_event_ctxp[ctxn])) {
    965 raw_spin_unlock_irqrestore(&ctx->lock, *flags);
    966 + rcu_read_unlock();
    967 + preempt_enable();
    968 goto retry;
    969 }
    970
    971 @@ -745,6 +757,7 @@ retry:
    972 }
    973 }
    974 rcu_read_unlock();
    975 + preempt_enable();
    976 return ctx;
    977 }
    978
    979 @@ -1702,7 +1715,16 @@ static int __perf_event_enable(void *info)
    980 struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
    981 int err;
    982
    983 - if (WARN_ON_ONCE(!ctx->is_active))
    984 + /*
    985 + * There's a time window between 'ctx->is_active' check
    986 + * in perf_event_enable function and this place having:
    987 + * - IRQs on
    988 + * - ctx->lock unlocked
    989 + *
    990 + * where the task could be killed and 'ctx' deactivated
    991 + * by perf_event_exit_task.
    992 + */
    993 + if (!ctx->is_active)
    994 return -EINVAL;
    995
    996 raw_spin_lock(&ctx->lock);
    997 @@ -6933,7 +6955,7 @@ inherit_task_group(struct perf_event *event, struct task_struct *parent,
    998 * child.
    999 */
    1000
    1001 - child_ctx = alloc_perf_context(event->pmu, child);
    1002 + child_ctx = alloc_perf_context(parent_ctx->pmu, child);
    1003 if (!child_ctx)
    1004 return -ENOMEM;
    1005
    1006 diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
    1007 index 60f7e32..a57ef25 100644
    1008 --- a/kernel/hrtimer.c
    1009 +++ b/kernel/hrtimer.c
    1010 @@ -707,17 +707,20 @@ static int hrtimer_switch_to_hres(void)
    1011 return 1;
    1012 }
    1013
    1014 +static void clock_was_set_work(struct work_struct *work)
    1015 +{
    1016 + clock_was_set();
    1017 +}
    1018 +
    1019 +static DECLARE_WORK(hrtimer_work, clock_was_set_work);
    1020 +
    1021 /*
    1022 - * Called from timekeeping code to reprogramm the hrtimer interrupt
    1023 - * device. If called from the timer interrupt context we defer it to
    1024 - * softirq context.
    1025 + * Called from timekeeping and resume code to reprogramm the hrtimer
    1026 + * interrupt device on all cpus.
    1027 */
    1028 void clock_was_set_delayed(void)
    1029 {
    1030 - struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
    1031 -
    1032 - cpu_base->clock_was_set = 1;
    1033 - __raise_softirq_irqoff(HRTIMER_SOFTIRQ);
    1034 + schedule_work(&hrtimer_work);
    1035 }
    1036
    1037 #else
    1038 @@ -766,8 +769,10 @@ void hrtimers_resume(void)
    1039 WARN_ONCE(!irqs_disabled(),
    1040 KERN_INFO "hrtimers_resume() called with IRQs enabled!");
    1041
    1042 + /* Retrigger on the local CPU */
    1043 retrigger_next_event(NULL);
    1044 - timerfd_clock_was_set();
    1045 + /* And schedule a retrigger for all others */
    1046 + clock_was_set_delayed();
    1047 }
    1048
    1049 static inline void timer_stats_hrtimer_set_start_info(struct hrtimer *timer)
    1050 @@ -1416,13 +1421,6 @@ void hrtimer_peek_ahead_timers(void)
    1051
    1052 static void run_hrtimer_softirq(struct softirq_action *h)
    1053 {
    1054 - struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
    1055 -
    1056 - if (cpu_base->clock_was_set) {
    1057 - cpu_base->clock_was_set = 0;
    1058 - clock_was_set();
    1059 - }
    1060 -
    1061 hrtimer_peek_ahead_timers();
    1062 }
    1063
    1064 diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
    1065 index 239a323..f8961bf 100644
    1066 --- a/kernel/time/tick-broadcast.c
    1067 +++ b/kernel/time/tick-broadcast.c
    1068 @@ -400,7 +400,15 @@ void tick_check_oneshot_broadcast(int cpu)
    1069 if (cpumask_test_cpu(cpu, to_cpumask(tick_broadcast_oneshot_mask))) {
    1070 struct tick_device *td = &per_cpu(tick_cpu_device, cpu);
    1071
    1072 - clockevents_set_mode(td->evtdev, CLOCK_EVT_MODE_ONESHOT);
    1073 + /*
    1074 + * We might be in the middle of switching over from
    1075 + * periodic to oneshot. If the CPU has not yet
    1076 + * switched over, leave the device alone.
    1077 + */
    1078 + if (td->mode == TICKDEV_MODE_ONESHOT) {
    1079 + clockevents_set_mode(td->evtdev,
    1080 + CLOCK_EVT_MODE_ONESHOT);
    1081 + }
    1082 }
    1083 }
    1084
    1085 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
    1086 index 75c11bf..13cd224 100644
    1087 --- a/kernel/trace/trace.c
    1088 +++ b/kernel/trace/trace.c
    1089 @@ -687,7 +687,15 @@ __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
    1090
    1091 memcpy(max_data->comm, tsk->comm, TASK_COMM_LEN);
    1092 max_data->pid = tsk->pid;
    1093 - max_data->uid = task_uid(tsk);
    1094 + /*
    1095 + * If tsk == current, then use current_uid(), as that does not use
    1096 + * RCU. The irq tracer can be called out of RCU scope.
    1097 + */
    1098 + if (tsk == current)
    1099 + max_data->uid = current_uid();
    1100 + else
    1101 + max_data->uid = task_uid(tsk);
    1102 +
    1103 max_data->nice = tsk->static_prio - 20 - MAX_RT_PRIO;
    1104 max_data->policy = tsk->policy;
    1105 max_data->rt_priority = tsk->rt_priority;
    1106 diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
    1107 index 96fc733..e675182 100644
    1108 --- a/kernel/trace/trace_syscalls.c
    1109 +++ b/kernel/trace/trace_syscalls.c
    1110 @@ -305,6 +305,8 @@ void ftrace_syscall_enter(void *ignore, struct pt_regs *regs, long id)
    1111 struct ring_buffer *buffer;
    1112 int size;
    1113 int syscall_nr;
    1114 + unsigned long irq_flags;
    1115 + int pc;
    1116
    1117 syscall_nr = syscall_get_nr(current, regs);
    1118 if (syscall_nr < 0)
    1119 @@ -318,8 +320,11 @@ void ftrace_syscall_enter(void *ignore, struct pt_regs *regs, long id)
    1120
    1121 size = sizeof(*entry) + sizeof(unsigned long) * sys_data->nb_args;
    1122
    1123 + local_save_flags(irq_flags);
    1124 + pc = preempt_count();
    1125 +
    1126 event = trace_current_buffer_lock_reserve(&buffer,
    1127 - sys_data->enter_event->event.type, size, 0, 0);
    1128 + sys_data->enter_event->event.type, size, irq_flags, pc);
    1129 if (!event)
    1130 return;
    1131
    1132 @@ -329,7 +334,8 @@ void ftrace_syscall_enter(void *ignore, struct pt_regs *regs, long id)
    1133
    1134 if (!filter_current_check_discard(buffer, sys_data->enter_event,
    1135 entry, event))
    1136 - trace_current_buffer_unlock_commit(buffer, event, 0, 0);
    1137 + trace_current_buffer_unlock_commit(buffer, event,
    1138 + irq_flags, pc);
    1139 }
    1140
    1141 void ftrace_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
    1142 @@ -339,6 +345,8 @@ void ftrace_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
    1143 struct ring_buffer_event *event;
    1144 struct ring_buffer *buffer;
    1145 int syscall_nr;
    1146 + unsigned long irq_flags;
    1147 + int pc;
    1148
    1149 syscall_nr = syscall_get_nr(current, regs);
    1150 if (syscall_nr < 0)
    1151 @@ -351,7 +359,8 @@ void ftrace_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
    1152 return;
    1153
    1154 event = trace_current_buffer_lock_reserve(&buffer,
    1155 - sys_data->exit_event->event.type, sizeof(*entry), 0, 0);
    1156 + sys_data->exit_event->event.type, sizeof(*entry),
    1157 + irq_flags, pc);
    1158 if (!event)
    1159 return;
    1160
    1161 @@ -361,7 +370,8 @@ void ftrace_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
    1162
    1163 if (!filter_current_check_discard(buffer, sys_data->exit_event,
    1164 entry, event))
    1165 - trace_current_buffer_unlock_commit(buffer, event, 0, 0);
    1166 + trace_current_buffer_unlock_commit(buffer, event,
    1167 + irq_flags, pc);
    1168 }
    1169
    1170 int reg_event_syscall_enter(struct ftrace_event_call *call)
    1171 diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
    1172 index daeb19d..8f45392 100644
    1173 --- a/net/8021q/vlan_dev.c
    1174 +++ b/net/8021q/vlan_dev.c
    1175 @@ -73,6 +73,8 @@ vlan_dev_get_egress_qos_mask(struct net_device *dev, struct sk_buff *skb)
    1176 {
    1177 struct vlan_priority_tci_mapping *mp;
    1178
    1179 + smp_rmb(); /* coupled with smp_wmb() in vlan_dev_set_egress_priority() */
    1180 +
    1181 mp = vlan_dev_priv(dev)->egress_priority_map[(skb->priority & 0xF)];
    1182 while (mp) {
    1183 if (mp->priority == skb->priority) {
    1184 @@ -235,6 +237,11 @@ int vlan_dev_set_egress_priority(const struct net_device *dev,
    1185 np->next = mp;
    1186 np->priority = skb_prio;
    1187 np->vlan_qos = vlan_qos;
    1188 + /* Before inserting this element in hash table, make sure all its fields
    1189 + * are committed to memory.
    1190 + * coupled with smp_rmb() in vlan_dev_get_egress_qos_mask()
    1191 + */
    1192 + smp_wmb();
    1193 vlan->egress_priority_map[skb_prio & 0xF] = np;
    1194 if (vlan_qos)
    1195 vlan->nr_egress_mappings++;
    1196 diff --git a/net/9p/trans_common.c b/net/9p/trans_common.c
    1197 index de8df95..2ee3879 100644
    1198 --- a/net/9p/trans_common.c
    1199 +++ b/net/9p/trans_common.c
    1200 @@ -24,11 +24,11 @@
    1201 */
    1202 void p9_release_pages(struct page **pages, int nr_pages)
    1203 {
    1204 - int i = 0;
    1205 - while (pages[i] && nr_pages--) {
    1206 - put_page(pages[i]);
    1207 - i++;
    1208 - }
    1209 + int i;
    1210 +
    1211 + for (i = 0; i < nr_pages; i++)
    1212 + if (pages[i])
    1213 + put_page(pages[i]);
    1214 }
    1215 EXPORT_SYMBOL(p9_release_pages);
    1216
    1217 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
    1218 index 27ca25e..9069071 100644
    1219 --- a/net/bridge/br_multicast.c
    1220 +++ b/net/bridge/br_multicast.c
    1221 @@ -467,8 +467,9 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
    1222 skb_set_transport_header(skb, skb->len);
    1223 mldq = (struct mld_msg *) icmp6_hdr(skb);
    1224
    1225 - interval = ipv6_addr_any(group) ? br->multicast_last_member_interval :
    1226 - br->multicast_query_response_interval;
    1227 + interval = ipv6_addr_any(group) ?
    1228 + br->multicast_query_response_interval :
    1229 + br->multicast_last_member_interval;
    1230
    1231 mldq->mld_type = ICMPV6_MGM_QUERY;
    1232 mldq->mld_code = 0;
    1233 diff --git a/net/core/neighbour.c b/net/core/neighbour.c
    1234 index ac88107..69b7ca3 100644
    1235 --- a/net/core/neighbour.c
    1236 +++ b/net/core/neighbour.c
    1237 @@ -237,7 +237,7 @@ static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
    1238 we must kill timers etc. and move
    1239 it to safe state.
    1240 */
    1241 - skb_queue_purge(&n->arp_queue);
    1242 + __skb_queue_purge(&n->arp_queue);
    1243 n->arp_queue_len_bytes = 0;
    1244 n->output = neigh_blackhole;
    1245 if (n->nud_state & NUD_VALID)
    1246 @@ -300,7 +300,7 @@ static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device
    1247 if (!n)
    1248 goto out_entries;
    1249
    1250 - skb_queue_head_init(&n->arp_queue);
    1251 + __skb_queue_head_init(&n->arp_queue);
    1252 rwlock_init(&n->lock);
    1253 seqlock_init(&n->ha_lock);
    1254 n->updated = n->used = now;
    1255 @@ -721,7 +721,9 @@ void neigh_destroy(struct neighbour *neigh)
    1256 if (neigh_del_timer(neigh))
    1257 printk(KERN_WARNING "Impossible event.\n");
    1258
    1259 - skb_queue_purge(&neigh->arp_queue);
    1260 + write_lock_bh(&neigh->lock);
    1261 + __skb_queue_purge(&neigh->arp_queue);
    1262 + write_unlock_bh(&neigh->lock);
    1263 neigh->arp_queue_len_bytes = 0;
    1264
    1265 if (dev->netdev_ops->ndo_neigh_destroy)
    1266 @@ -867,7 +869,7 @@ static void neigh_invalidate(struct neighbour *neigh)
    1267 neigh->ops->error_report(neigh, skb);
    1268 write_lock(&neigh->lock);
    1269 }
    1270 - skb_queue_purge(&neigh->arp_queue);
    1271 + __skb_queue_purge(&neigh->arp_queue);
    1272 neigh->arp_queue_len_bytes = 0;
    1273 }
    1274
    1275 @@ -1206,7 +1208,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
    1276
    1277 write_lock_bh(&neigh->lock);
    1278 }
    1279 - skb_queue_purge(&neigh->arp_queue);
    1280 + __skb_queue_purge(&neigh->arp_queue);
    1281 neigh->arp_queue_len_bytes = 0;
    1282 }
    1283 out:
    1284 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
    1285 index 76f50e1..ae03b7b 100644
    1286 --- a/net/ipv4/tcp_ipv4.c
    1287 +++ b/net/ipv4/tcp_ipv4.c
    1288 @@ -974,7 +974,7 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
    1289 struct tcp_sock *tp = tcp_sk(sk);
    1290 struct tcp_md5sig_info *md5sig;
    1291
    1292 - key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&addr, AF_INET);
    1293 + key = tcp_md5_do_lookup(sk, addr, family);
    1294 if (key) {
    1295 /* Pre-existing entry - just update that one. */
    1296 memcpy(key->key, newkey, newkeylen);
    1297 @@ -1019,7 +1019,7 @@ int tcp_md5_do_del(struct sock *sk, const union tcp_md5_addr *addr, int family)
    1298 struct tcp_md5sig_key *key;
    1299 struct tcp_md5sig_info *md5sig;
    1300
    1301 - key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&addr, AF_INET);
    1302 + key = tcp_md5_do_lookup(sk, addr, family);
    1303 if (!key)
    1304 return -ENOENT;
    1305 hlist_del_rcu(&key->node);
    1306 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    1307 index fe14105..0b6136d 100644
    1308 --- a/net/ipv4/udp.c
    1309 +++ b/net/ipv4/udp.c
    1310 @@ -768,7 +768,7 @@ send:
    1311 /*
    1312 * Push out all pending data as one UDP datagram. Socket is locked.
    1313 */
    1314 -static int udp_push_pending_frames(struct sock *sk)
    1315 +int udp_push_pending_frames(struct sock *sk)
    1316 {
    1317 struct udp_sock *up = udp_sk(sk);
    1318 struct inet_sock *inet = inet_sk(sk);
    1319 @@ -787,6 +787,7 @@ out:
    1320 up->pending = 0;
    1321 return err;
    1322 }
    1323 +EXPORT_SYMBOL(udp_push_pending_frames);
    1324
    1325 int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
    1326 size_t len)
    1327 diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
    1328 index f4fe3c0..d427f1b 100644
    1329 --- a/net/ipv6/addrconf.c
    1330 +++ b/net/ipv6/addrconf.c
    1331 @@ -1233,6 +1233,23 @@ try_nextdev:
    1332 }
    1333 EXPORT_SYMBOL(ipv6_dev_get_saddr);
    1334
    1335 +int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
    1336 + unsigned char banned_flags)
    1337 +{
    1338 + struct inet6_ifaddr *ifp;
    1339 + int err = -EADDRNOTAVAIL;
    1340 +
    1341 + list_for_each_entry(ifp, &idev->addr_list, if_list) {
    1342 + if (ifp->scope == IFA_LINK &&
    1343 + !(ifp->flags & banned_flags)) {
    1344 + *addr = ifp->addr;
    1345 + err = 0;
    1346 + break;
    1347 + }
    1348 + }
    1349 + return err;
    1350 +}
    1351 +
    1352 int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
    1353 unsigned char banned_flags)
    1354 {
    1355 @@ -1242,17 +1259,8 @@ int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
    1356 rcu_read_lock();
    1357 idev = __in6_dev_get(dev);
    1358 if (idev) {
    1359 - struct inet6_ifaddr *ifp;
    1360 -
    1361 read_lock_bh(&idev->lock);
    1362 - list_for_each_entry(ifp, &idev->addr_list, if_list) {
    1363 - if (ifp->scope == IFA_LINK &&
    1364 - !(ifp->flags & banned_flags)) {
    1365 - *addr = ifp->addr;
    1366 - err = 0;
    1367 - break;
    1368 - }
    1369 - }
    1370 + err = __ipv6_get_lladdr(idev, addr, banned_flags);
    1371 read_unlock_bh(&idev->lock);
    1372 }
    1373 rcu_read_unlock();
    1374 @@ -2429,6 +2437,9 @@ static void init_loopback(struct net_device *dev)
    1375 if (sp_ifa->flags & (IFA_F_DADFAILED | IFA_F_TENTATIVE))
    1376 continue;
    1377
    1378 + if (sp_ifa->rt)
    1379 + continue;
    1380 +
    1381 sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
    1382
    1383 /* Failure cases are ignored */
    1384 diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    1385 index bf290ce..d6b9d56 100644
    1386 --- a/net/ipv6/ip6_output.c
    1387 +++ b/net/ipv6/ip6_output.c
    1388 @@ -912,11 +912,17 @@ static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
    1389 const struct flowi6 *fl6)
    1390 {
    1391 struct ipv6_pinfo *np = inet6_sk(sk);
    1392 - struct rt6_info *rt = (struct rt6_info *)dst;
    1393 + struct rt6_info *rt;
    1394
    1395 if (!dst)
    1396 goto out;
    1397
    1398 + if (dst->ops->family != AF_INET6) {
    1399 + dst_release(dst);
    1400 + return NULL;
    1401 + }
    1402 +
    1403 + rt = (struct rt6_info *)dst;
    1404 /* Yes, checking route validity in not connected
    1405 * case is not very simple. Take into account,
    1406 * that we do not support routing by source, TOS,
    1407 @@ -1181,11 +1187,12 @@ static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
    1408 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
    1409 }
    1410
    1411 -static void ip6_append_data_mtu(int *mtu,
    1412 +static void ip6_append_data_mtu(unsigned int *mtu,
    1413 int *maxfraglen,
    1414 unsigned int fragheaderlen,
    1415 struct sk_buff *skb,
    1416 - struct rt6_info *rt)
    1417 + struct rt6_info *rt,
    1418 + bool pmtuprobe)
    1419 {
    1420 if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
    1421 if (skb == NULL) {
    1422 @@ -1197,7 +1204,9 @@ static void ip6_append_data_mtu(int *mtu,
    1423 * this fragment is not first, the headers
    1424 * space is regarded as data space.
    1425 */
    1426 - *mtu = dst_mtu(rt->dst.path);
    1427 + *mtu = min(*mtu, pmtuprobe ?
    1428 + rt->dst.dev->mtu :
    1429 + dst_mtu(rt->dst.path));
    1430 }
    1431 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
    1432 + fragheaderlen - sizeof(struct frag_hdr);
    1433 @@ -1214,11 +1223,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
    1434 struct ipv6_pinfo *np = inet6_sk(sk);
    1435 struct inet_cork *cork;
    1436 struct sk_buff *skb, *skb_prev = NULL;
    1437 - unsigned int maxfraglen, fragheaderlen;
    1438 + unsigned int maxfraglen, fragheaderlen, mtu;
    1439 int exthdrlen;
    1440 int dst_exthdrlen;
    1441 int hh_len;
    1442 - int mtu;
    1443 int copy;
    1444 int err;
    1445 int offset = 0;
    1446 @@ -1381,7 +1389,9 @@ alloc_new_skb:
    1447 /* update mtu and maxfraglen if necessary */
    1448 if (skb == NULL || skb_prev == NULL)
    1449 ip6_append_data_mtu(&mtu, &maxfraglen,
    1450 - fragheaderlen, skb, rt);
    1451 + fragheaderlen, skb, rt,
    1452 + np->pmtudisc ==
    1453 + IPV6_PMTUDISC_PROBE);
    1454
    1455 skb_prev = skb;
    1456
    1457 diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
    1458 index b2869ca..6a4ab24 100644
    1459 --- a/net/ipv6/mcast.c
    1460 +++ b/net/ipv6/mcast.c
    1461 @@ -1334,8 +1334,9 @@ mld_scount(struct ifmcaddr6 *pmc, int type, int gdeleted, int sdeleted)
    1462 return scount;
    1463 }
    1464
    1465 -static struct sk_buff *mld_newpack(struct net_device *dev, int size)
    1466 +static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
    1467 {
    1468 + struct net_device *dev = idev->dev;
    1469 struct net *net = dev_net(dev);
    1470 struct sock *sk = net->ipv6.igmp_sk;
    1471 struct sk_buff *skb;
    1472 @@ -1360,7 +1361,7 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
    1473
    1474 skb_reserve(skb, hlen);
    1475
    1476 - if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
    1477 + if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
    1478 /* <draft-ietf-magma-mld-source-05.txt>:
    1479 * use unspecified address as the source address
    1480 * when a valid link-local address is not available.
    1481 @@ -1456,7 +1457,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
    1482 struct mld2_grec *pgr;
    1483
    1484 if (!skb)
    1485 - skb = mld_newpack(dev, dev->mtu);
    1486 + skb = mld_newpack(pmc->idev, dev->mtu);
    1487 if (!skb)
    1488 return NULL;
    1489 pgr = (struct mld2_grec *)skb_put(skb, sizeof(struct mld2_grec));
    1490 @@ -1476,7 +1477,8 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
    1491 static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
    1492 int type, int gdeleted, int sdeleted)
    1493 {
    1494 - struct net_device *dev = pmc->idev->dev;
    1495 + struct inet6_dev *idev = pmc->idev;
    1496 + struct net_device *dev = idev->dev;
    1497 struct mld2_report *pmr;
    1498 struct mld2_grec *pgr = NULL;
    1499 struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list;
    1500 @@ -1505,7 +1507,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
    1501 AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
    1502 if (skb)
    1503 mld_sendpack(skb);
    1504 - skb = mld_newpack(dev, dev->mtu);
    1505 + skb = mld_newpack(idev, dev->mtu);
    1506 }
    1507 }
    1508 first = 1;
    1509 @@ -1532,7 +1534,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
    1510 pgr->grec_nsrcs = htons(scount);
    1511 if (skb)
    1512 mld_sendpack(skb);
    1513 - skb = mld_newpack(dev, dev->mtu);
    1514 + skb = mld_newpack(idev, dev->mtu);
    1515 first = 1;
    1516 scount = 0;
    1517 }
    1518 @@ -1587,8 +1589,8 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
    1519 struct sk_buff *skb = NULL;
    1520 int type;
    1521
    1522 + read_lock_bh(&idev->lock);
    1523 if (!pmc) {
    1524 - read_lock_bh(&idev->lock);
    1525 for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
    1526 if (pmc->mca_flags & MAF_NOREPORT)
    1527 continue;
    1528 @@ -1600,7 +1602,6 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
    1529 skb = add_grec(skb, pmc, type, 0, 0);
    1530 spin_unlock_bh(&pmc->mca_lock);
    1531 }
    1532 - read_unlock_bh(&idev->lock);
    1533 } else {
    1534 spin_lock_bh(&pmc->mca_lock);
    1535 if (pmc->mca_sfcount[MCAST_EXCLUDE])
    1536 @@ -1610,6 +1611,7 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
    1537 skb = add_grec(skb, pmc, type, 0, 0);
    1538 spin_unlock_bh(&pmc->mca_lock);
    1539 }
    1540 + read_unlock_bh(&idev->lock);
    1541 if (skb)
    1542 mld_sendpack(skb);
    1543 }
    1544 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    1545 index 5a272c6..016ed7c 100644
    1546 --- a/net/ipv6/route.c
    1547 +++ b/net/ipv6/route.c
    1548 @@ -1032,10 +1032,13 @@ static void ip6_link_failure(struct sk_buff *skb)
    1549
    1550 rt = (struct rt6_info *) skb_dst(skb);
    1551 if (rt) {
    1552 - if (rt->rt6i_flags & RTF_CACHE)
    1553 - rt6_update_expires(rt, 0);
    1554 - else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT))
    1555 + if (rt->rt6i_flags & RTF_CACHE) {
    1556 + dst_hold(&rt->dst);
    1557 + if (ip6_del_rt(rt))
    1558 + dst_free(&rt->dst);
    1559 + } else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT)) {
    1560 rt->rt6i_node->fn_sernum = -1;
    1561 + }
    1562 }
    1563 }
    1564
    1565 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
    1566 index aa2f18b..f79bfdb 100644
    1567 --- a/net/ipv6/udp.c
    1568 +++ b/net/ipv6/udp.c
    1569 @@ -895,11 +895,16 @@ static int udp_v6_push_pending_frames(struct sock *sk)
    1570 struct udphdr *uh;
    1571 struct udp_sock *up = udp_sk(sk);
    1572 struct inet_sock *inet = inet_sk(sk);
    1573 - struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
    1574 + struct flowi6 *fl6;
    1575 int err = 0;
    1576 int is_udplite = IS_UDPLITE(sk);
    1577 __wsum csum = 0;
    1578
    1579 + if (up->pending == AF_INET)
    1580 + return udp_push_pending_frames(sk);
    1581 +
    1582 + fl6 = &inet->cork.fl.u.ip6;
    1583 +
    1584 /* Grab the skbuff where UDP header space exists. */
    1585 if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
    1586 goto out;
    1587 diff --git a/net/key/af_key.c b/net/key/af_key.c
    1588 index 7e5d927..5bbab6a 100644
    1589 --- a/net/key/af_key.c
    1590 +++ b/net/key/af_key.c
    1591 @@ -1705,6 +1705,7 @@ static int key_notify_sa_flush(const struct km_event *c)
    1592 hdr->sadb_msg_version = PF_KEY_V2;
    1593 hdr->sadb_msg_errno = (uint8_t) 0;
    1594 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
    1595 + hdr->sadb_msg_reserved = 0;
    1596
    1597 pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
    1598
    1599 @@ -2686,6 +2687,7 @@ static int key_notify_policy_flush(const struct km_event *c)
    1600 hdr->sadb_msg_version = PF_KEY_V2;
    1601 hdr->sadb_msg_errno = (uint8_t) 0;
    1602 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
    1603 + hdr->sadb_msg_reserved = 0;
    1604 pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
    1605 return 0;
    1606
    1607 diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
    1608 index c6dee80..b2982f4 100644
    1609 --- a/net/l2tp/l2tp_ppp.c
    1610 +++ b/net/l2tp/l2tp_ppp.c
    1611 @@ -1778,7 +1778,8 @@ static const struct proto_ops pppol2tp_ops = {
    1612
    1613 static const struct pppox_proto pppol2tp_proto = {
    1614 .create = pppol2tp_create,
    1615 - .ioctl = pppol2tp_ioctl
    1616 + .ioctl = pppol2tp_ioctl,
    1617 + .owner = THIS_MODULE,
    1618 };
    1619
    1620 #ifdef CONFIG_L2TP_V3
    1621 diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
    1622 index a306bc6..b943e3e 100644
    1623 --- a/net/x25/af_x25.c
    1624 +++ b/net/x25/af_x25.c
    1625 @@ -1586,11 +1586,11 @@ out_cud_release:
    1626 case SIOCX25CALLACCPTAPPRV: {
    1627 rc = -EINVAL;
    1628 lock_sock(sk);
    1629 - if (sk->sk_state != TCP_CLOSE)
    1630 - break;
    1631 - clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
    1632 + if (sk->sk_state == TCP_CLOSE) {
    1633 + clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
    1634 + rc = 0;
    1635 + }
    1636 release_sock(sk);
    1637 - rc = 0;
    1638 break;
    1639 }
    1640
    1641 @@ -1598,14 +1598,15 @@ out_cud_release:
    1642 rc = -EINVAL;
    1643 lock_sock(sk);
    1644 if (sk->sk_state != TCP_ESTABLISHED)
    1645 - break;
    1646 + goto out_sendcallaccpt_release;
    1647 /* must call accptapprv above */
    1648 if (test_bit(X25_ACCPT_APPRV_FLAG, &x25->flags))
    1649 - break;
    1650 + goto out_sendcallaccpt_release;
    1651 x25_write_internal(sk, X25_CALL_ACCEPTED);
    1652 x25->state = X25_STATE_3;
    1653 - release_sock(sk);
    1654 rc = 0;
    1655 +out_sendcallaccpt_release:
    1656 + release_sock(sk);
    1657 break;
    1658 }
    1659
    1660 diff --git a/sound/soc/codecs/sgtl5000.h b/sound/soc/codecs/sgtl5000.h
    1661 index 8a9f435..d3a68bb 100644
    1662 --- a/sound/soc/codecs/sgtl5000.h
    1663 +++ b/sound/soc/codecs/sgtl5000.h
    1664 @@ -347,7 +347,7 @@
    1665 #define SGTL5000_PLL_INT_DIV_MASK 0xf800
    1666 #define SGTL5000_PLL_INT_DIV_SHIFT 11
    1667 #define SGTL5000_PLL_INT_DIV_WIDTH 5
    1668 -#define SGTL5000_PLL_FRAC_DIV_MASK 0x0700
    1669 +#define SGTL5000_PLL_FRAC_DIV_MASK 0x07ff
    1670 #define SGTL5000_PLL_FRAC_DIV_SHIFT 0
    1671 #define SGTL5000_PLL_FRAC_DIV_WIDTH 11
    1672
    1673 diff --git a/sound/usb/6fire/pcm.c b/sound/usb/6fire/pcm.c
    1674 index c97d05f..4da9ca9 100644
    1675 --- a/sound/usb/6fire/pcm.c
    1676 +++ b/sound/usb/6fire/pcm.c
    1677 @@ -540,7 +540,7 @@ static snd_pcm_uframes_t usb6fire_pcm_pointer(
    1678 snd_pcm_uframes_t ret;
    1679
    1680 if (rt->panic || !sub)
    1681 - return SNDRV_PCM_STATE_XRUN;
    1682 + return SNDRV_PCM_POS_XRUN;
    1683
    1684 spin_lock_irqsave(&sub->lock, flags);
    1685 ret = sub->dma_off;