Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-3.2/0111-3.2.12-all-fixes.patch

    Contents of /trunk/kernel-magellan/patches-3.2/0111-3.2.12-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1706 - (show annotations) (download)
    Thu Mar 22 12:46:31 2012 UTC (12 years, 1 month ago) by niro
    File size: 52103 byte(s) 
    -linux-3.2.12
    1 diff --git a/Documentation/hwmon/w83627ehf b/Documentation/hwmon/w83627ehf
    2 index 3f44dbd..75f3155 100644
    3 --- a/Documentation/hwmon/w83627ehf
    4 +++ b/Documentation/hwmon/w83627ehf
    5 @@ -50,7 +50,7 @@ W83627DHG, W83627DHG-P, W83627UHG, W83667HG, W83667HG-B, W83667HG-I
    6 (NCT6775F), and NCT6776F super I/O chips. We will refer to them collectively
    7 as Winbond chips.
    8
    9 -The chips implement 2 to 4 temperature sensors (9 for NCT6775F and NCT6776F),
    10 +The chips implement 3 to 4 temperature sensors (9 for NCT6775F and NCT6776F),
    11 2 to 5 fan rotation speed sensors, 8 to 10 analog voltage sensors, one VID
    12 (except for 627UHG), alarms with beep warnings (control unimplemented),
    13 and some automatic fan regulation strategies (plus manual fan control mode).
    14 diff --git a/Documentation/hwmon/zl6100 b/Documentation/hwmon/zl6100
    15 index 7617798..c5e1a5b 100644
    16 --- a/Documentation/hwmon/zl6100
    17 +++ b/Documentation/hwmon/zl6100
    18 @@ -73,14 +73,12 @@ Module parameters
    19 delay
    20 -----
    21
    22 -Some Intersil/Zilker Labs DC-DC controllers require a minimum interval between
    23 -I2C bus accesses. According to Intersil, the minimum interval is 2 ms, though
    24 -1 ms appears to be sufficient and has not caused any problems in testing.
    25 -The problem is known to affect ZL6100, ZL2105, and ZL2008. It is known not to
    26 -affect ZL2004 and ZL6105. The driver automatically sets the interval to 1 ms
    27 -except for ZL2004 and ZL6105. To enable manual override, the driver provides a
    28 -writeable module parameter, 'delay', which can be used to set the interval to
    29 -a value between 0 and 65,535 microseconds.
    30 +Intersil/Zilker Labs DC-DC controllers require a minimum interval between I2C
    31 +bus accesses. According to Intersil, the minimum interval is 2 ms, though 1 ms
    32 +appears to be sufficient and has not caused any problems in testing. The problem
    33 +is known to affect all currently supported chips. For manual override, the
    34 +driver provides a writeable module parameter, 'delay', which can be used to set
    35 +the interval to a value between 0 and 65,535 microseconds.
    36
    37
    38 Sysfs entries
    39 diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
    40 index ad1fb5d..eddcfb3 100644
    41 --- a/arch/sparc/Makefile
    42 +++ b/arch/sparc/Makefile
    43 @@ -31,7 +31,7 @@ UTS_MACHINE := sparc
    44
    45 #KBUILD_CFLAGS += -g -pipe -fcall-used-g5 -fcall-used-g7
    46 KBUILD_CFLAGS += -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7
    47 -KBUILD_AFLAGS += -m32
    48 +KBUILD_AFLAGS += -m32 -Wa,-Av8
    49
    50 #LDFLAGS_vmlinux = -N -Ttext 0xf0004000
    51 # Since 2.5.40, the first stage is left not btfix-ed.
    52 diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
    53 index 121f1be..957c216 100644
    54 --- a/arch/x86/kernel/cpu/perf_event_intel.c
    55 +++ b/arch/x86/kernel/cpu/perf_event_intel.c
    56 @@ -389,14 +389,15 @@ static __initconst const u64 westmere_hw_cache_event_ids
    57 #define NHM_LOCAL_DRAM (1 << 14)
    58 #define NHM_NON_DRAM (1 << 15)
    59
    60 -#define NHM_ALL_DRAM (NHM_REMOTE_DRAM|NHM_LOCAL_DRAM)
    61 +#define NHM_LOCAL (NHM_LOCAL_DRAM|NHM_REMOTE_CACHE_FWD)
    62 +#define NHM_REMOTE (NHM_REMOTE_DRAM)
    63
    64 #define NHM_DMND_READ (NHM_DMND_DATA_RD)
    65 #define NHM_DMND_WRITE (NHM_DMND_RFO|NHM_DMND_WB)
    66 #define NHM_DMND_PREFETCH (NHM_PF_DATA_RD|NHM_PF_DATA_RFO)
    67
    68 #define NHM_L3_HIT (NHM_UNCORE_HIT|NHM_OTHER_CORE_HIT_SNP|NHM_OTHER_CORE_HITM)
    69 -#define NHM_L3_MISS (NHM_NON_DRAM|NHM_ALL_DRAM|NHM_REMOTE_CACHE_FWD)
    70 +#define NHM_L3_MISS (NHM_NON_DRAM|NHM_LOCAL_DRAM|NHM_REMOTE_DRAM|NHM_REMOTE_CACHE_FWD)
    71 #define NHM_L3_ACCESS (NHM_L3_HIT|NHM_L3_MISS)
    72
    73 static __initconst const u64 nehalem_hw_cache_extra_regs
    74 @@ -420,16 +421,16 @@ static __initconst const u64 nehalem_hw_cache_extra_regs
    75 },
    76 [ C(NODE) ] = {
    77 [ C(OP_READ) ] = {
    78 - [ C(RESULT_ACCESS) ] = NHM_DMND_READ|NHM_ALL_DRAM,
    79 - [ C(RESULT_MISS) ] = NHM_DMND_READ|NHM_REMOTE_DRAM,
    80 + [ C(RESULT_ACCESS) ] = NHM_DMND_READ|NHM_LOCAL|NHM_REMOTE,
    81 + [ C(RESULT_MISS) ] = NHM_DMND_READ|NHM_REMOTE,
    82 },
    83 [ C(OP_WRITE) ] = {
    84 - [ C(RESULT_ACCESS) ] = NHM_DMND_WRITE|NHM_ALL_DRAM,
    85 - [ C(RESULT_MISS) ] = NHM_DMND_WRITE|NHM_REMOTE_DRAM,
    86 + [ C(RESULT_ACCESS) ] = NHM_DMND_WRITE|NHM_LOCAL|NHM_REMOTE,
    87 + [ C(RESULT_MISS) ] = NHM_DMND_WRITE|NHM_REMOTE,
    88 },
    89 [ C(OP_PREFETCH) ] = {
    90 - [ C(RESULT_ACCESS) ] = NHM_DMND_PREFETCH|NHM_ALL_DRAM,
    91 - [ C(RESULT_MISS) ] = NHM_DMND_PREFETCH|NHM_REMOTE_DRAM,
    92 + [ C(RESULT_ACCESS) ] = NHM_DMND_PREFETCH|NHM_LOCAL|NHM_REMOTE,
    93 + [ C(RESULT_MISS) ] = NHM_DMND_PREFETCH|NHM_REMOTE,
    94 },
    95 },
    96 };
    97 diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c
    98 index fc45ba8..e395693 100644
    99 --- a/arch/x86/lib/delay.c
    100 +++ b/arch/x86/lib/delay.c
    101 @@ -48,9 +48,9 @@ static void delay_loop(unsigned long loops)
    102 }
    103
    104 /* TSC based delay: */
    105 -static void delay_tsc(unsigned long loops)
    106 +static void delay_tsc(unsigned long __loops)
    107 {
    108 - unsigned long bclock, now;
    109 + u32 bclock, now, loops = __loops;
    110 int cpu;
    111
    112 preempt_disable();
    113 diff --git a/block/genhd.c b/block/genhd.c
    114 index 02e9fca..997afd6 100644
    115 --- a/block/genhd.c
    116 +++ b/block/genhd.c
    117 @@ -36,6 +36,7 @@ static DEFINE_IDR(ext_devt_idr);
    118
    119 static struct device_type disk_type;
    120
    121 +static void disk_alloc_events(struct gendisk *disk);
    122 static void disk_add_events(struct gendisk *disk);
    123 static void disk_del_events(struct gendisk *disk);
    124 static void disk_release_events(struct gendisk *disk);
    125 @@ -602,6 +603,8 @@ void add_disk(struct gendisk *disk)
    126 disk->major = MAJOR(devt);
    127 disk->first_minor = MINOR(devt);
    128
    129 + disk_alloc_events(disk);
    130 +
    131 /* Register BDI before referencing it from bdev */
    132 bdi = &disk->queue->backing_dev_info;
    133 bdi_register_dev(bdi, disk_devt(disk));
    134 @@ -1476,9 +1479,9 @@ static void __disk_unblock_events(struct gendisk *disk, bool check_now)
    135 intv = disk_events_poll_jiffies(disk);
    136 set_timer_slack(&ev->dwork.timer, intv / 4);
    137 if (check_now)
    138 - queue_delayed_work(system_nrt_wq, &ev->dwork, 0);
    139 + queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, 0);
    140 else if (intv)
    141 - queue_delayed_work(system_nrt_wq, &ev->dwork, intv);
    142 + queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, intv);
    143 out_unlock:
    144 spin_unlock_irqrestore(&ev->lock, flags);
    145 }
    146 @@ -1522,7 +1525,7 @@ void disk_flush_events(struct gendisk *disk, unsigned int mask)
    147 ev->clearing |= mask;
    148 if (!ev->block) {
    149 cancel_delayed_work(&ev->dwork);
    150 - queue_delayed_work(system_nrt_wq, &ev->dwork, 0);
    151 + queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, 0);
    152 }
    153 spin_unlock_irq(&ev->lock);
    154 }
    155 @@ -1559,7 +1562,7 @@ unsigned int disk_clear_events(struct gendisk *disk, unsigned int mask)
    156
    157 /* uncondtionally schedule event check and wait for it to finish */
    158 disk_block_events(disk);
    159 - queue_delayed_work(system_nrt_wq, &ev->dwork, 0);
    160 + queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, 0);
    161 flush_delayed_work(&ev->dwork);
    162 __disk_unblock_events(disk, false);
    163
    164 @@ -1596,7 +1599,7 @@ static void disk_events_workfn(struct work_struct *work)
    165
    166 intv = disk_events_poll_jiffies(disk);
    167 if (!ev->block && intv)
    168 - queue_delayed_work(system_nrt_wq, &ev->dwork, intv);
    169 + queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, intv);
    170
    171 spin_unlock_irq(&ev->lock);
    172
    173 @@ -1734,9 +1737,9 @@ module_param_cb(events_dfl_poll_msecs, &disk_events_dfl_poll_msecs_param_ops,
    174 &disk_events_dfl_poll_msecs, 0644);
    175
    176 /*
    177 - * disk_{add|del|release}_events - initialize and destroy disk_events.
    178 + * disk_{alloc|add|del|release}_events - initialize and destroy disk_events.
    179 */
    180 -static void disk_add_events(struct gendisk *disk)
    181 +static void disk_alloc_events(struct gendisk *disk)
    182 {
    183 struct disk_events *ev;
    184
    185 @@ -1749,16 +1752,6 @@ static void disk_add_events(struct gendisk *disk)
    186 return;
    187 }
    188
    189 - if (sysfs_create_files(&disk_to_dev(disk)->kobj,
    190 - disk_events_attrs) < 0) {
    191 - pr_warn("%s: failed to create sysfs files for events\n",
    192 - disk->disk_name);
    193 - kfree(ev);
    194 - return;
    195 - }
    196 -
    197 - disk->ev = ev;
    198 -
    199 INIT_LIST_HEAD(&ev->node);
    200 ev->disk = disk;
    201 spin_lock_init(&ev->lock);
    202 @@ -1767,8 +1760,21 @@ static void disk_add_events(struct gendisk *disk)
    203 ev->poll_msecs = -1;
    204 INIT_DELAYED_WORK(&ev->dwork, disk_events_workfn);
    205
    206 + disk->ev = ev;
    207 +}
    208 +
    209 +static void disk_add_events(struct gendisk *disk)
    210 +{
    211 + if (!disk->ev)
    212 + return;
    213 +
    214 + /* FIXME: error handling */
    215 + if (sysfs_create_files(&disk_to_dev(disk)->kobj, disk_events_attrs) < 0)
    216 + pr_warn("%s: failed to create sysfs files for events\n",
    217 + disk->disk_name);
    218 +
    219 mutex_lock(&disk_events_mutex);
    220 - list_add_tail(&ev->node, &disk_events);
    221 + list_add_tail(&disk->ev->node, &disk_events);
    222 mutex_unlock(&disk_events_mutex);
    223
    224 /*
    225 diff --git a/drivers/block/sx8.c b/drivers/block/sx8.c
    226 index b70f0fc..eec7b7a 100644
    227 --- a/drivers/block/sx8.c
    228 +++ b/drivers/block/sx8.c
    229 @@ -1116,7 +1116,7 @@ static inline void carm_handle_resp(struct carm_host *host,
    230 break;
    231 case MISC_GET_FW_VER: {
    232 struct carm_fw_ver *ver = (struct carm_fw_ver *)
    233 - mem + sizeof(struct carm_msg_get_fw_ver);
    234 + (mem + sizeof(struct carm_msg_get_fw_ver));
    235 if (!error) {
    236 host->fw_ver = le32_to_cpu(ver->version);
    237 host->flags |= (ver->features & FL_FW_VER_MASK);
    238 diff --git a/drivers/hwmon/pmbus/zl6100.c b/drivers/hwmon/pmbus/zl6100.c
    239 index ba296fd..5c5cdd2 100644
    240 --- a/drivers/hwmon/pmbus/zl6100.c
    241 +++ b/drivers/hwmon/pmbus/zl6100.c
    242 @@ -178,16 +178,11 @@ static int zl6100_probe(struct i2c_client *client,
    243 data->id = mid->driver_data;
    244
    245 /*
    246 - * ZL2008, ZL2105, and ZL6100 are known to require a wait time
    247 - * between I2C accesses. ZL2004 and ZL6105 are known to be safe.
    248 - *
    249 - * Only clear the wait time for chips known to be safe. The wait time
    250 - * can be cleared later for additional chips if tests show that it
    251 - * is not needed (in other words, better be safe than sorry).
    252 + * According to information from the chip vendor, all currently
    253 + * supported chips are known to require a wait time between I2C
    254 + * accesses.
    255 */
    256 data->delay = delay;
    257 - if (data->id == zl2004 || data->id == zl6105)
    258 - data->delay = 0;
    259
    260 /*
    261 * Since there was a direct I2C device access above, wait before
    262 diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
    263 index c25387d..ceaec92 100644
    264 --- a/drivers/hwmon/w83627ehf.c
    265 +++ b/drivers/hwmon/w83627ehf.c
    266 @@ -39,7 +39,7 @@
    267 0x8860 0xa1
    268 w83627dhg 9 5 4 3 0xa020 0xc1 0x5ca3
    269 w83627dhg-p 9 5 4 3 0xb070 0xc1 0x5ca3
    270 - w83627uhg 8 2 2 2 0xa230 0xc1 0x5ca3
    271 + w83627uhg 8 2 2 3 0xa230 0xc1 0x5ca3
    272 w83667hg 9 5 3 3 0xa510 0xc1 0x5ca3
    273 w83667hg-b 9 5 3 4 0xb350 0xc1 0x5ca3
    274 nct6775f 9 4 3 9 0xb470 0xc1 0x5ca3
    275 @@ -1607,7 +1607,7 @@ store_##reg(struct device *dev, struct device_attribute *attr, \
    276 val = step_time_to_reg(val, data->pwm_mode[nr]); \
    277 mutex_lock(&data->update_lock); \
    278 data->reg[nr] = val; \
    279 - w83627ehf_write_value(data, W83627EHF_REG_##REG[nr], val); \
    280 + w83627ehf_write_value(data, data->REG_##REG[nr], val); \
    281 mutex_unlock(&data->update_lock); \
    282 return count; \
    283 } \
    284 @@ -2004,7 +2004,8 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev)
    285 goto exit;
    286 }
    287
    288 - data = kzalloc(sizeof(struct w83627ehf_data), GFP_KERNEL);
    289 + data = devm_kzalloc(&pdev->dev, sizeof(struct w83627ehf_data),
    290 + GFP_KERNEL);
    291 if (!data) {
    292 err = -ENOMEM;
    293 goto exit_release;
    294 @@ -2157,16 +2158,16 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev)
    295 w83627ehf_set_temp_reg_ehf(data, 3);
    296
    297 /*
    298 - * Temperature sources for temp1 and temp2 are selected with
    299 + * Temperature sources for temp2 and temp3 are selected with
    300 * bank 0, registers 0x49 and 0x4a.
    301 */
    302 data->temp_src[0] = 0; /* SYSTIN */
    303 reg = w83627ehf_read_value(data, 0x49) & 0x07;
    304 /* Adjust to have the same mapping as other source registers */
    305 if (reg == 0)
    306 - data->temp_src[1]++;
    307 + data->temp_src[1] = 1;
    308 else if (reg >= 2 && reg <= 5)
    309 - data->temp_src[1] += 2;
    310 + data->temp_src[1] = reg + 2;
    311 else /* should never happen */
    312 data->have_temp &= ~(1 << 1);
    313 reg = w83627ehf_read_value(data, 0x4a);
    314 @@ -2498,9 +2499,8 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev)
    315
    316 exit_remove:
    317 w83627ehf_device_remove_files(dev);
    318 - kfree(data);
    319 - platform_set_drvdata(pdev, NULL);
    320 exit_release:
    321 + platform_set_drvdata(pdev, NULL);
    322 release_region(res->start, IOREGION_LENGTH);
    323 exit:
    324 return err;
    325 @@ -2514,7 +2514,6 @@ static int __devexit w83627ehf_remove(struct platform_device *pdev)
    326 w83627ehf_device_remove_files(&pdev->dev);
    327 release_region(data->addr, IOREGION_LENGTH);
    328 platform_set_drvdata(pdev, NULL);
    329 - kfree(data);
    330
    331 return 0;
    332 }
    333 diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
    334 index 525c734..24f94f4 100644
    335 --- a/drivers/i2c/algos/i2c-algo-bit.c
    336 +++ b/drivers/i2c/algos/i2c-algo-bit.c
    337 @@ -103,8 +103,14 @@ static int sclhi(struct i2c_algo_bit_data *adap)
    338 * chips may hold it low ("clock stretching") while they
    339 * are processing data internally.
    340 */
    341 - if (time_after(jiffies, start + adap->timeout))
    342 + if (time_after(jiffies, start + adap->timeout)) {
    343 + /* Test one last time, as we may have been preempted
    344 + * between last check and timeout test.
    345 + */
    346 + if (getscl(adap))
    347 + break;
    348 return -ETIMEDOUT;
    349 + }
    350 cond_resched();
    351 }
    352 #ifdef DEBUG
    353 diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
    354 index 54a4a3f..a319281 100644
    355 --- a/drivers/media/video/omap3isp/ispccdc.c
    356 +++ b/drivers/media/video/omap3isp/ispccdc.c
    357 @@ -1406,8 +1406,7 @@ static int __ccdc_handle_stopping(struct isp_ccdc_device *ccdc, u32 event)
    358
    359 static void ccdc_hs_vs_isr(struct isp_ccdc_device *ccdc)
    360 {
    361 - struct isp_pipeline *pipe =
    362 - to_isp_pipeline(&ccdc->video_out.video.entity);
    363 + struct isp_pipeline *pipe = to_isp_pipeline(&ccdc->subdev.entity);
    364 struct video_device *vdev = ccdc->subdev.devnode;
    365 struct v4l2_event event;
    366
    367 diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
    368 index 02c7ed8..eccdcff 100644
    369 --- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
    370 +++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
    371 @@ -2241,10 +2241,6 @@ static netdev_tx_t atl1c_xmit_frame(struct sk_buff *skb,
    372 dev_info(&adapter->pdev->dev, "tx locked\n");
    373 return NETDEV_TX_LOCKED;
    374 }
    375 - if (skb->mark == 0x01)
    376 - type = atl1c_trans_high;
    377 - else
    378 - type = atl1c_trans_normal;
    379
    380 if (atl1c_tpd_avail(adapter, type) < tpd_req) {
    381 /* no enough descriptor, just stop queue */
    382 diff --git a/drivers/net/ethernet/packetengines/Kconfig b/drivers/net/ethernet/packetengines/Kconfig
    383 index b97132d..8f29feb 100644
    384 --- a/drivers/net/ethernet/packetengines/Kconfig
    385 +++ b/drivers/net/ethernet/packetengines/Kconfig
    386 @@ -4,6 +4,7 @@
    387
    388 config NET_PACKET_ENGINE
    389 bool "Packet Engine devices"
    390 + default y
    391 depends on PCI
    392 ---help---
    393 If you have a network (Ethernet) card belonging to this class, say Y
    394 diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
    395 index c8f47f1..0cf2351 100644
    396 --- a/drivers/net/ethernet/realtek/r8169.c
    397 +++ b/drivers/net/ethernet/realtek/r8169.c
    398 @@ -3781,12 +3781,20 @@ static void rtl8169_init_ring_indexes(struct rtl8169_private *tp)
    399
    400 static void rtl_hw_jumbo_enable(struct rtl8169_private *tp)
    401 {
    402 + void __iomem *ioaddr = tp->mmio_addr;
    403 +
    404 + RTL_W8(Cfg9346, Cfg9346_Unlock);
    405 rtl_generic_op(tp, tp->jumbo_ops.enable);
    406 + RTL_W8(Cfg9346, Cfg9346_Lock);
    407 }
    408
    409 static void rtl_hw_jumbo_disable(struct rtl8169_private *tp)
    410 {
    411 + void __iomem *ioaddr = tp->mmio_addr;
    412 +
    413 + RTL_W8(Cfg9346, Cfg9346_Unlock);
    414 rtl_generic_op(tp, tp->jumbo_ops.disable);
    415 + RTL_W8(Cfg9346, Cfg9346_Lock);
    416 }
    417
    418 static void r8168c_hw_jumbo_enable(struct rtl8169_private *tp)
    419 diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
    420 index 752d521..5ef4cc0 100644
    421 --- a/drivers/net/ethernet/sfc/rx.c
    422 +++ b/drivers/net/ethernet/sfc/rx.c
    423 @@ -156,11 +156,10 @@ static int efx_init_rx_buffers_skb(struct efx_rx_queue *rx_queue)
    424 if (unlikely(!skb))
    425 return -ENOMEM;
    426
    427 - /* Adjust the SKB for padding and checksum */
    428 + /* Adjust the SKB for padding */
    429 skb_reserve(skb, NET_IP_ALIGN);
    430 rx_buf->len = skb_len - NET_IP_ALIGN;
    431 rx_buf->is_page = false;
    432 - skb->ip_summed = CHECKSUM_UNNECESSARY;
    433
    434 rx_buf->dma_addr = pci_map_single(efx->pci_dev,
    435 skb->data, rx_buf->len,
    436 @@ -499,6 +498,7 @@ static void efx_rx_packet_gro(struct efx_channel *channel,
    437
    438 EFX_BUG_ON_PARANOID(!checksummed);
    439 rx_buf->u.skb = NULL;
    440 + skb->ip_summed = CHECKSUM_UNNECESSARY;
    441
    442 gro_result = napi_gro_receive(napi, skb);
    443 }
    444 diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
    445 index edfa15d..486b404 100644
    446 --- a/drivers/net/ppp/ppp_generic.c
    447 +++ b/drivers/net/ppp/ppp_generic.c
    448 @@ -2024,14 +2024,22 @@ ppp_mp_reconstruct(struct ppp *ppp)
    449 continue;
    450 }
    451 if (PPP_MP_CB(p)->sequence != seq) {
    452 + u32 oldseq;
    453 /* Fragment `seq' is missing. If it is after
    454 minseq, it might arrive later, so stop here. */
    455 if (seq_after(seq, minseq))
    456 break;
    457 /* Fragment `seq' is lost, keep going. */
    458 lost = 1;
    459 + oldseq = seq;
    460 seq = seq_before(minseq, PPP_MP_CB(p)->sequence)?
    461 minseq + 1: PPP_MP_CB(p)->sequence;
    462 +
    463 + if (ppp->debug & 1)
    464 + netdev_printk(KERN_DEBUG, ppp->dev,
    465 + "lost frag %u..%u\n",
    466 + oldseq, seq-1);
    467 +
    468 goto again;
    469 }
    470
    471 @@ -2076,6 +2084,10 @@ ppp_mp_reconstruct(struct ppp *ppp)
    472 struct sk_buff *tmp2;
    473
    474 skb_queue_reverse_walk_from_safe(list, p, tmp2) {
    475 + if (ppp->debug & 1)
    476 + netdev_printk(KERN_DEBUG, ppp->dev,
    477 + "discarding frag %u\n",
    478 + PPP_MP_CB(p)->sequence);
    479 __skb_unlink(p, list);
    480 kfree_skb(p);
    481 }
    482 @@ -2091,6 +2103,17 @@ ppp_mp_reconstruct(struct ppp *ppp)
    483 /* If we have discarded any fragments,
    484 signal a receive error. */
    485 if (PPP_MP_CB(head)->sequence != ppp->nextseq) {
    486 + skb_queue_walk_safe(list, p, tmp) {
    487 + if (p == head)
    488 + break;
    489 + if (ppp->debug & 1)
    490 + netdev_printk(KERN_DEBUG, ppp->dev,
    491 + "discarding frag %u\n",
    492 + PPP_MP_CB(p)->sequence);
    493 + __skb_unlink(p, list);
    494 + kfree_skb(p);
    495 + }
    496 +
    497 if (ppp->debug & 1)
    498 netdev_printk(KERN_DEBUG, ppp->dev,
    499 " missed pkts %u..%u\n",
    500 diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
    501 index f5e063a..fda4be2 100644
    502 --- a/drivers/net/usb/asix.c
    503 +++ b/drivers/net/usb/asix.c
    504 @@ -1595,6 +1595,10 @@ static const struct usb_device_id products [] = {
    505 USB_DEVICE (0x6189, 0x182d),
    506 .driver_info = (unsigned long) &ax8817x_info,
    507 }, {
    508 + // Sitecom LN-031 "USB 2.0 10/100/1000 Ethernet adapter"
    509 + USB_DEVICE (0x0df6, 0x0056),
    510 + .driver_info = (unsigned long) &ax88178_info,
    511 +}, {
    512 // corega FEther USB2-TX
    513 USB_DEVICE (0x07aa, 0x0017),
    514 .driver_info = (unsigned long) &ax8817x_info,
    515 diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
    516 index d96bfb1..d426261 100644
    517 --- a/drivers/net/vmxnet3/vmxnet3_drv.c
    518 +++ b/drivers/net/vmxnet3/vmxnet3_drv.c
    519 @@ -830,13 +830,8 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
    520 ctx->l4_hdr_size = ((struct tcphdr *)
    521 skb_transport_header(skb))->doff * 4;
    522 else if (iph->protocol == IPPROTO_UDP)
    523 - /*
    524 - * Use tcp header size so that bytes to
    525 - * be copied are more than required by
    526 - * the device.
    527 - */
    528 ctx->l4_hdr_size =
    529 - sizeof(struct tcphdr);
    530 + sizeof(struct udphdr);
    531 else
    532 ctx->l4_hdr_size = 0;
    533 } else {
    534 diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
    535 index b18eac1..8df921b 100644
    536 --- a/drivers/net/vmxnet3/vmxnet3_int.h
    537 +++ b/drivers/net/vmxnet3/vmxnet3_int.h
    538 @@ -70,10 +70,10 @@
    539 /*
    540 * Version numbers
    541 */
    542 -#define VMXNET3_DRIVER_VERSION_STRING "1.1.18.0-k"
    543 +#define VMXNET3_DRIVER_VERSION_STRING "1.1.29.0-k"
    544
    545 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
    546 -#define VMXNET3_DRIVER_VERSION_NUM 0x01011200
    547 +#define VMXNET3_DRIVER_VERSION_NUM 0x01011D00
    548
    549 #if defined(CONFIG_PCI_MSI)
    550 /* RSS only makes sense if MSI-X is supported. */
    551 diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
    552 index edd317f..21b529b 100644
    553 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
    554 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
    555 @@ -426,10 +426,14 @@ void rt2x00lib_txdone(struct queue_entry *entry,
    556 /*
    557 * If the data queue was below the threshold before the txdone
    558 * handler we must make sure the packet queue in the mac80211 stack
    559 - * is reenabled when the txdone handler has finished.
    560 + * is reenabled when the txdone handler has finished. This has to be
    561 + * serialized with rt2x00mac_tx(), otherwise we can wake up queue
    562 + * before it was stopped.
    563 */
    564 + spin_lock_bh(&entry->queue->tx_lock);
    565 if (!rt2x00queue_threshold(entry->queue))
    566 rt2x00queue_unpause_queue(entry->queue);
    567 + spin_unlock_bh(&entry->queue->tx_lock);
    568 }
    569 EXPORT_SYMBOL_GPL(rt2x00lib_txdone);
    570
    571 diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
    572 index bf0acff..373dae1 100644
    573 --- a/drivers/net/wireless/rt2x00/rt2x00mac.c
    574 +++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
    575 @@ -152,13 +152,22 @@ void rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
    576 if (unlikely(rt2x00queue_write_tx_frame(queue, skb, false)))
    577 goto exit_fail;
    578
    579 + /*
    580 + * Pausing queue has to be serialized with rt2x00lib_txdone(). Note
    581 + * we should not use spin_lock_bh variant as bottom halve was already
    582 + * disabled before ieee80211_xmit() call.
    583 + */
    584 + spin_lock(&queue->tx_lock);
    585 if (rt2x00queue_threshold(queue))
    586 rt2x00queue_pause_queue(queue);
    587 + spin_unlock(&queue->tx_lock);
    588
    589 return;
    590
    591 exit_fail:
    592 + spin_lock(&queue->tx_lock);
    593 rt2x00queue_pause_queue(queue);
    594 + spin_unlock(&queue->tx_lock);
    595 exit_free_skb:
    596 dev_kfree_skb_any(skb);
    597 }
    598 diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
    599 index 5adfb3e..9b1b2b7 100644
    600 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c
    601 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
    602 @@ -619,6 +619,9 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
    603 else if (test_bit(REQUIRE_DMA, &queue->rt2x00dev->cap_flags))
    604 rt2x00queue_align_frame(skb);
    605
    606 + /*
    607 + * That function must be called with bh disabled.
    608 + */
    609 spin_lock(&queue->tx_lock);
    610
    611 if (unlikely(rt2x00queue_full(queue))) {
    612 diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
    613 index 1cfbf22..24f049e 100644
    614 --- a/drivers/pci/pcie/aspm.c
    615 +++ b/drivers/pci/pcie/aspm.c
    616 @@ -500,6 +500,9 @@ static int pcie_aspm_sanity_check(struct pci_dev *pdev)
    617 int pos;
    618 u32 reg32;
    619
    620 + if (aspm_disabled)
    621 + return 0;
    622 +
    623 /*
    624 * Some functions in a slot might not all be PCIe functions,
    625 * very strange. Disable ASPM for the whole slot
    626 diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
    627 index b848277..1e5290b 100644
    628 --- a/drivers/platform/x86/acer-wmi.c
    629 +++ b/drivers/platform/x86/acer-wmi.c
    630 @@ -679,6 +679,32 @@ static acpi_status AMW0_find_mailled(void)
    631 return AE_OK;
    632 }
    633
    634 +static int AMW0_set_cap_acpi_check_device_found;
    635 +
    636 +static acpi_status AMW0_set_cap_acpi_check_device_cb(acpi_handle handle,
    637 + u32 level, void *context, void **retval)
    638 +{
    639 + AMW0_set_cap_acpi_check_device_found = 1;
    640 + return AE_OK;
    641 +}
    642 +
    643 +static const struct acpi_device_id norfkill_ids[] = {
    644 + { "VPC2004", 0},
    645 + { "IBM0068", 0},
    646 + { "LEN0068", 0},
    647 + { "", 0},
    648 +};
    649 +
    650 +static int AMW0_set_cap_acpi_check_device(void)
    651 +{
    652 + const struct acpi_device_id *id;
    653 +
    654 + for (id = norfkill_ids; id->id[0]; id++)
    655 + acpi_get_devices(id->id, AMW0_set_cap_acpi_check_device_cb,
    656 + NULL, NULL);
    657 + return AMW0_set_cap_acpi_check_device_found;
    658 +}
    659 +
    660 static acpi_status AMW0_set_capabilities(void)
    661 {
    662 struct wmab_args args;
    663 @@ -692,7 +718,9 @@ static acpi_status AMW0_set_capabilities(void)
    664 * work.
    665 */
    666 if (wmi_has_guid(AMW0_GUID2)) {
    667 - interface->capability |= ACER_CAP_WIRELESS;
    668 + if ((quirks != &quirk_unknown) ||
    669 + !AMW0_set_cap_acpi_check_device())
    670 + interface->capability |= ACER_CAP_WIRELESS;
    671 return AE_OK;
    672 }
    673
    674 diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h
    675 index 822e54c..1c226b3 100644
    676 --- a/drivers/rapidio/devices/tsi721.h
    677 +++ b/drivers/rapidio/devices/tsi721.h
    678 @@ -118,34 +118,34 @@
    679
    680 #define TSI721_IDB_ENTRY_SIZE 64
    681
    682 -#define TSI721_IDQ_CTL(x) (0x20000 + (x) * 1000)
    683 +#define TSI721_IDQ_CTL(x) (0x20000 + (x) * 0x1000)
    684 #define TSI721_IDQ_SUSPEND 0x00000002
    685 #define TSI721_IDQ_INIT 0x00000001
    686
    687 -#define TSI721_IDQ_STS(x) (0x20004 + (x) * 1000)
    688 +#define TSI721_IDQ_STS(x) (0x20004 + (x) * 0x1000)
    689 #define TSI721_IDQ_RUN 0x00200000
    690
    691 -#define TSI721_IDQ_MASK(x) (0x20008 + (x) * 1000)
    692 +#define TSI721_IDQ_MASK(x) (0x20008 + (x) * 0x1000)
    693 #define TSI721_IDQ_MASK_MASK 0xffff0000
    694 #define TSI721_IDQ_MASK_PATT 0x0000ffff
    695
    696 -#define TSI721_IDQ_RP(x) (0x2000c + (x) * 1000)
    697 +#define TSI721_IDQ_RP(x) (0x2000c + (x) * 0x1000)
    698 #define TSI721_IDQ_RP_PTR 0x0007ffff
    699
    700 -#define TSI721_IDQ_WP(x) (0x20010 + (x) * 1000)
    701 +#define TSI721_IDQ_WP(x) (0x20010 + (x) * 0x1000)
    702 #define TSI721_IDQ_WP_PTR 0x0007ffff
    703
    704 -#define TSI721_IDQ_BASEL(x) (0x20014 + (x) * 1000)
    705 +#define TSI721_IDQ_BASEL(x) (0x20014 + (x) * 0x1000)
    706 #define TSI721_IDQ_BASEL_ADDR 0xffffffc0
    707 -#define TSI721_IDQ_BASEU(x) (0x20018 + (x) * 1000)
    708 -#define TSI721_IDQ_SIZE(x) (0x2001c + (x) * 1000)
    709 +#define TSI721_IDQ_BASEU(x) (0x20018 + (x) * 0x1000)
    710 +#define TSI721_IDQ_SIZE(x) (0x2001c + (x) * 0x1000)
    711 #define TSI721_IDQ_SIZE_VAL(size) (__fls(size) - 4)
    712 #define TSI721_IDQ_SIZE_MIN 512
    713 #define TSI721_IDQ_SIZE_MAX (512 * 1024)
    714
    715 -#define TSI721_SR_CHINT(x) (0x20040 + (x) * 1000)
    716 -#define TSI721_SR_CHINTE(x) (0x20044 + (x) * 1000)
    717 -#define TSI721_SR_CHINTSET(x) (0x20048 + (x) * 1000)
    718 +#define TSI721_SR_CHINT(x) (0x20040 + (x) * 0x1000)
    719 +#define TSI721_SR_CHINTE(x) (0x20044 + (x) * 0x1000)
    720 +#define TSI721_SR_CHINTSET(x) (0x20048 + (x) * 0x1000)
    721 #define TSI721_SR_CHINT_ODBOK 0x00000020
    722 #define TSI721_SR_CHINT_IDBQRCV 0x00000010
    723 #define TSI721_SR_CHINT_SUSP 0x00000008
    724 @@ -156,7 +156,7 @@
    725
    726 #define TSI721_IBWIN_NUM 8
    727
    728 -#define TSI721_IBWINLB(x) (0x29000 + (x) * 20)
    729 +#define TSI721_IBWINLB(x) (0x29000 + (x) * 0x20)
    730 #define TSI721_IBWINLB_BA 0xfffff000
    731 #define TSI721_IBWINLB_WEN 0x00000001
    732
    733 @@ -187,13 +187,13 @@
    734 */
    735 #define TSI721_OBWIN_NUM TSI721_PC2SR_WINS
    736
    737 -#define TSI721_OBWINLB(x) (0x40000 + (x) * 20)
    738 +#define TSI721_OBWINLB(x) (0x40000 + (x) * 0x20)
    739 #define TSI721_OBWINLB_BA 0xffff8000
    740 #define TSI721_OBWINLB_WEN 0x00000001
    741
    742 -#define TSI721_OBWINUB(x) (0x40004 + (x) * 20)
    743 +#define TSI721_OBWINUB(x) (0x40004 + (x) * 0x20)
    744
    745 -#define TSI721_OBWINSZ(x) (0x40008 + (x) * 20)
    746 +#define TSI721_OBWINSZ(x) (0x40008 + (x) * 0x20)
    747 #define TSI721_OBWINSZ_SIZE 0x00001f00
    748 #define TSI721_OBWIN_SIZE(size) (__fls(size) - 15)
    749
    750 diff --git a/drivers/regulator/tps6524x-regulator.c b/drivers/regulator/tps6524x-regulator.c
    751 index 9166aa0..229b6f4 100644
    752 --- a/drivers/regulator/tps6524x-regulator.c
    753 +++ b/drivers/regulator/tps6524x-regulator.c
    754 @@ -481,7 +481,7 @@ static int set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV,
    755 if (i >= info->n_voltages)
    756 i = info->n_voltages - 1;
    757
    758 - *selector = info->voltages[i];
    759 + *selector = i;
    760
    761 return write_field(hw, &info->voltage, i);
    762 }
    763 diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
    764 index 0c1d5c73..03d3528 100644
    765 --- a/drivers/target/iscsi/iscsi_target.c
    766 +++ b/drivers/target/iscsi/iscsi_target.c
    767 @@ -1029,7 +1029,7 @@ done:
    768 return iscsit_add_reject_from_cmd(
    769 ISCSI_REASON_BOOKMARK_NO_RESOURCES,
    770 1, 1, buf, cmd);
    771 - } else if (transport_ret == -EINVAL) {
    772 + } else if (transport_ret < 0) {
    773 /*
    774 * Unsupported SAM Opcode. CHECK_CONDITION will be sent
    775 * in iscsit_execute_cmd() during the CmdSN OOO Execution
    776 diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
    777 index 778c1a6..6cf6ff4 100644
    778 --- a/drivers/target/target_core_pr.c
    779 +++ b/drivers/target/target_core_pr.c
    780 @@ -120,7 +120,7 @@ static struct t10_pr_registration *core_scsi3_locate_pr_reg(struct se_device *,
    781 struct se_node_acl *, struct se_session *);
    782 static void core_scsi3_put_pr_reg(struct t10_pr_registration *);
    783
    784 -static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret)
    785 +static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd)
    786 {
    787 struct se_session *se_sess = cmd->se_sess;
    788 struct se_subsystem_dev *su_dev = cmd->se_dev->se_sub_dev;
    789 @@ -130,7 +130,7 @@ static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret)
    790 int conflict = 0;
    791
    792 if (!crh)
    793 - return false;
    794 + return -EINVAL;
    795
    796 pr_reg = core_scsi3_locate_pr_reg(cmd->se_dev, se_sess->se_node_acl,
    797 se_sess);
    798 @@ -158,16 +158,14 @@ static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret)
    799 */
    800 if (pr_reg->pr_res_holder) {
    801 core_scsi3_put_pr_reg(pr_reg);
    802 - *ret = 0;
    803 - return false;
    804 + return 1;
    805 }
    806 if ((pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY) ||
    807 (pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY) ||
    808 (pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG) ||
    809 (pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG)) {
    810 core_scsi3_put_pr_reg(pr_reg);
    811 - *ret = 0;
    812 - return true;
    813 + return 1;
    814 }
    815 core_scsi3_put_pr_reg(pr_reg);
    816 conflict = 1;
    817 @@ -192,10 +190,10 @@ static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret)
    818 " while active SPC-3 registrations exist,"
    819 " returning RESERVATION_CONFLICT\n");
    820 cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
    821 - return true;
    822 + return -EBUSY;
    823 }
    824
    825 - return false;
    826 + return 0;
    827 }
    828
    829 int target_scsi2_reservation_release(struct se_task *task)
    830 @@ -204,12 +202,18 @@ int target_scsi2_reservation_release(struct se_task *task)
    831 struct se_device *dev = cmd->se_dev;
    832 struct se_session *sess = cmd->se_sess;
    833 struct se_portal_group *tpg = sess->se_tpg;
    834 - int ret = 0;
    835 + int ret = 0, rc;
    836
    837 if (!sess || !tpg)
    838 goto out;
    839 - if (target_check_scsi2_reservation_conflict(cmd, &ret))
    840 + rc = target_check_scsi2_reservation_conflict(cmd);
    841 + if (rc == 1)
    842 + goto out;
    843 + else if (rc < 0) {
    844 + cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
    845 + ret = -EINVAL;
    846 goto out;
    847 + }
    848
    849 ret = 0;
    850 spin_lock(&dev->dev_reservation_lock);
    851 @@ -246,7 +250,7 @@ int target_scsi2_reservation_reserve(struct se_task *task)
    852 struct se_device *dev = cmd->se_dev;
    853 struct se_session *sess = cmd->se_sess;
    854 struct se_portal_group *tpg = sess->se_tpg;
    855 - int ret = 0;
    856 + int ret = 0, rc;
    857
    858 if ((cmd->t_task_cdb[1] & 0x01) &&
    859 (cmd->t_task_cdb[1] & 0x02)) {
    860 @@ -262,8 +266,14 @@ int target_scsi2_reservation_reserve(struct se_task *task)
    861 */
    862 if (!sess || !tpg)
    863 goto out;
    864 - if (target_check_scsi2_reservation_conflict(cmd, &ret))
    865 + rc = target_check_scsi2_reservation_conflict(cmd);
    866 + if (rc == 1)
    867 goto out;
    868 + else if (rc < 0) {
    869 + cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
    870 + ret = -EINVAL;
    871 + goto out;
    872 + }
    873
    874 ret = 0;
    875 spin_lock(&dev->dev_reservation_lock);
    876 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
    877 index e4ddb93..cdb774b 100644
    878 --- a/drivers/target/target_core_transport.c
    879 +++ b/drivers/target/target_core_transport.c
    880 @@ -2507,6 +2507,7 @@ static int transport_generic_cmd_sequencer(
    881 cmd, cdb, pr_reg_type) != 0) {
    882 cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
    883 cmd->se_cmd_flags |= SCF_SCSI_RESERVATION_CONFLICT;
    884 + cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT;
    885 cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
    886 return -EBUSY;
    887 }
    888 diff --git a/fs/aio.c b/fs/aio.c
    889 index 67e4b90..b9d64d8 100644
    890 --- a/fs/aio.c
    891 +++ b/fs/aio.c
    892 @@ -228,12 +228,6 @@ static void __put_ioctx(struct kioctx *ctx)
    893 call_rcu(&ctx->rcu_head, ctx_rcu_free);
    894 }
    895
    896 -static inline void get_ioctx(struct kioctx *kioctx)
    897 -{
    898 - BUG_ON(atomic_read(&kioctx->users) <= 0);
    899 - atomic_inc(&kioctx->users);
    900 -}
    901 -
    902 static inline int try_get_ioctx(struct kioctx *kioctx)
    903 {
    904 return atomic_inc_not_zero(&kioctx->users);
    905 @@ -273,7 +267,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
    906 mm = ctx->mm = current->mm;
    907 atomic_inc(&mm->mm_count);
    908
    909 - atomic_set(&ctx->users, 1);
    910 + atomic_set(&ctx->users, 2);
    911 spin_lock_init(&ctx->ctx_lock);
    912 spin_lock_init(&ctx->ring_info.ring_lock);
    913 init_waitqueue_head(&ctx->wait);
    914 @@ -609,11 +603,16 @@ static void aio_fput_routine(struct work_struct *data)
    915 fput(req->ki_filp);
    916
    917 /* Link the iocb into the context's free list */
    918 + rcu_read_lock();
    919 spin_lock_irq(&ctx->ctx_lock);
    920 really_put_req(ctx, req);
    921 + /*
    922 + * at that point ctx might've been killed, but actual
    923 + * freeing is RCU'd
    924 + */
    925 spin_unlock_irq(&ctx->ctx_lock);
    926 + rcu_read_unlock();
    927
    928 - put_ioctx(ctx);
    929 spin_lock_irq(&fput_lock);
    930 }
    931 spin_unlock_irq(&fput_lock);
    932 @@ -644,7 +643,6 @@ static int __aio_put_req(struct kioctx *ctx, struct kiocb *req)
    933 * this function will be executed w/out any aio kthread wakeup.
    934 */
    935 if (unlikely(!fput_atomic(req->ki_filp))) {
    936 - get_ioctx(ctx);
    937 spin_lock(&fput_lock);
    938 list_add(&req->ki_list, &fput_head);
    939 spin_unlock(&fput_lock);
    940 @@ -1338,10 +1336,10 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp)
    941 ret = PTR_ERR(ioctx);
    942 if (!IS_ERR(ioctx)) {
    943 ret = put_user(ioctx->user_id, ctxp);
    944 - if (!ret)
    945 + if (!ret) {
    946 + put_ioctx(ioctx);
    947 return 0;
    948 -
    949 - get_ioctx(ioctx); /* io_destroy() expects us to hold a ref */
    950 + }
    951 io_destroy(ioctx);
    952 }
    953
    954 diff --git a/fs/block_dev.c b/fs/block_dev.c
    955 index b07f1da..abe9b48 100644
    956 --- a/fs/block_dev.c
    957 +++ b/fs/block_dev.c
    958 @@ -1159,8 +1159,12 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
    959 * The latter is necessary to prevent ghost
    960 * partitions on a removed medium.
    961 */
    962 - if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM))
    963 - rescan_partitions(disk, bdev);
    964 + if (bdev->bd_invalidated) {
    965 + if (!ret)
    966 + rescan_partitions(disk, bdev);
    967 + else if (ret == -ENOMEDIUM)
    968 + invalidate_partitions(disk, bdev);
    969 + }
    970 if (ret)
    971 goto out_clear;
    972 } else {
    973 @@ -1190,8 +1194,12 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
    974 if (bdev->bd_disk->fops->open)
    975 ret = bdev->bd_disk->fops->open(bdev, mode);
    976 /* the same as first opener case, read comment there */
    977 - if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM))
    978 - rescan_partitions(bdev->bd_disk, bdev);
    979 + if (bdev->bd_invalidated) {
    980 + if (!ret)
    981 + rescan_partitions(bdev->bd_disk, bdev);
    982 + else if (ret == -ENOMEDIUM)
    983 + invalidate_partitions(bdev->bd_disk, bdev);
    984 + }
    985 if (ret)
    986 goto out_unlock_bdev;
    987 }
    988 diff --git a/fs/cifs/file.c b/fs/cifs/file.c
    989 index 4dd9283..5e64748 100644
    990 --- a/fs/cifs/file.c
    991 +++ b/fs/cifs/file.c
    992 @@ -920,16 +920,26 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
    993 for (lockp = &inode->i_flock; *lockp != NULL; \
    994 lockp = &(*lockp)->fl_next)
    995
    996 +struct lock_to_push {
    997 + struct list_head llist;
    998 + __u64 offset;
    999 + __u64 length;
    1000 + __u32 pid;
    1001 + __u16 netfid;
    1002 + __u8 type;
    1003 +};
    1004 +
    1005 static int
    1006 cifs_push_posix_locks(struct cifsFileInfo *cfile)
    1007 {
    1008 struct cifsInodeInfo *cinode = CIFS_I(cfile->dentry->d_inode);
    1009 struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
    1010 struct file_lock *flock, **before;
    1011 - struct cifsLockInfo *lck, *tmp;
    1012 + unsigned int count = 0, i = 0;
    1013 int rc = 0, xid, type;
    1014 + struct list_head locks_to_send, *el;
    1015 + struct lock_to_push *lck, *tmp;
    1016 __u64 length;
    1017 - struct list_head locks_to_send;
    1018
    1019 xid = GetXid();
    1020
    1021 @@ -940,29 +950,55 @@ cifs_push_posix_locks(struct cifsFileInfo *cfile)
    1022 return rc;
    1023 }
    1024
    1025 + lock_flocks();
    1026 + cifs_for_each_lock(cfile->dentry->d_inode, before) {
    1027 + if ((*before)->fl_flags & FL_POSIX)
    1028 + count++;
    1029 + }
    1030 + unlock_flocks();
    1031 +
    1032 INIT_LIST_HEAD(&locks_to_send);
    1033
    1034 + /*
    1035 + * Allocating count locks is enough because no locks can be added to
    1036 + * the list while we are holding cinode->lock_mutex that protects
    1037 + * locking operations of this inode.
    1038 + */
    1039 + for (; i < count; i++) {
    1040 + lck = kmalloc(sizeof(struct lock_to_push), GFP_KERNEL);
    1041 + if (!lck) {
    1042 + rc = -ENOMEM;
    1043 + goto err_out;
    1044 + }
    1045 + list_add_tail(&lck->llist, &locks_to_send);
    1046 + }
    1047 +
    1048 + i = 0;
    1049 + el = locks_to_send.next;
    1050 lock_flocks();
    1051 cifs_for_each_lock(cfile->dentry->d_inode, before) {
    1052 + if (el == &locks_to_send) {
    1053 + /* something is really wrong */
    1054 + cERROR(1, "Can't push all brlocks!");
    1055 + break;
    1056 + }
    1057 flock = *before;
    1058 + if ((flock->fl_flags & FL_POSIX) == 0)
    1059 + continue;
    1060 length = 1 + flock->fl_end - flock->fl_start;
    1061 if (flock->fl_type == F_RDLCK || flock->fl_type == F_SHLCK)
    1062 type = CIFS_RDLCK;
    1063 else
    1064 type = CIFS_WRLCK;
    1065 -
    1066 - lck = cifs_lock_init(flock->fl_start, length, type,
    1067 - cfile->netfid);
    1068 - if (!lck) {
    1069 - rc = -ENOMEM;
    1070 - goto send_locks;
    1071 - }
    1072 + lck = list_entry(el, struct lock_to_push, llist);
    1073 lck->pid = flock->fl_pid;
    1074 -
    1075 - list_add_tail(&lck->llist, &locks_to_send);
    1076 + lck->netfid = cfile->netfid;
    1077 + lck->length = length;
    1078 + lck->type = type;
    1079 + lck->offset = flock->fl_start;
    1080 + i++;
    1081 + el = el->next;
    1082 }
    1083 -
    1084 -send_locks:
    1085 unlock_flocks();
    1086
    1087 list_for_each_entry_safe(lck, tmp, &locks_to_send, llist) {
    1088 @@ -979,11 +1015,18 @@ send_locks:
    1089 kfree(lck);
    1090 }
    1091
    1092 +out:
    1093 cinode->can_cache_brlcks = false;
    1094 mutex_unlock(&cinode->lock_mutex);
    1095
    1096 FreeXid(xid);
    1097 return rc;
    1098 +err_out:
    1099 + list_for_each_entry_safe(lck, tmp, &locks_to_send, llist) {
    1100 + list_del(&lck->llist);
    1101 + kfree(lck);
    1102 + }
    1103 + goto out;
    1104 }
    1105
    1106 static int
    1107 diff --git a/fs/namei.c b/fs/namei.c
    1108 index 744e942..9680cef 100644
    1109 --- a/fs/namei.c
    1110 +++ b/fs/namei.c
    1111 @@ -2139,7 +2139,7 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
    1112 /* sayonara */
    1113 error = complete_walk(nd);
    1114 if (error)
    1115 - return ERR_PTR(-ECHILD);
    1116 + return ERR_PTR(error);
    1117
    1118 error = -ENOTDIR;
    1119 if (nd->flags & LOOKUP_DIRECTORY) {
    1120 @@ -2238,7 +2238,7 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
    1121 /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */
    1122 error = complete_walk(nd);
    1123 if (error)
    1124 - goto exit;
    1125 + return ERR_PTR(error);
    1126 error = -EISDIR;
    1127 if (S_ISDIR(nd->inode->i_mode))
    1128 goto exit;
    1129 diff --git a/fs/partitions/check.c b/fs/partitions/check.c
    1130 index e3c63d1..6b5fcc5 100644
    1131 --- a/fs/partitions/check.c
    1132 +++ b/fs/partitions/check.c
    1133 @@ -539,17 +539,11 @@ static bool disk_unlock_native_capacity(struct gendisk *disk)
    1134 }
    1135 }
    1136
    1137 -int rescan_partitions(struct gendisk *disk, struct block_device *bdev)
    1138 +static int drop_partitions(struct gendisk *disk, struct block_device *bdev)
    1139 {
    1140 - struct parsed_partitions *state = NULL;
    1141 struct disk_part_iter piter;
    1142 struct hd_struct *part;
    1143 - int p, highest, res;
    1144 -rescan:
    1145 - if (state && !IS_ERR(state)) {
    1146 - kfree(state);
    1147 - state = NULL;
    1148 - }
    1149 + int res;
    1150
    1151 if (bdev->bd_part_count)
    1152 return -EBUSY;
    1153 @@ -562,6 +556,24 @@ rescan:
    1154 delete_partition(disk, part->partno);
    1155 disk_part_iter_exit(&piter);
    1156
    1157 + return 0;
    1158 +}
    1159 +
    1160 +int rescan_partitions(struct gendisk *disk, struct block_device *bdev)
    1161 +{
    1162 + struct parsed_partitions *state = NULL;
    1163 + struct hd_struct *part;
    1164 + int p, highest, res;
    1165 +rescan:
    1166 + if (state && !IS_ERR(state)) {
    1167 + kfree(state);
    1168 + state = NULL;
    1169 + }
    1170 +
    1171 + res = drop_partitions(disk, bdev);
    1172 + if (res)
    1173 + return res;
    1174 +
    1175 if (disk->fops->revalidate_disk)
    1176 disk->fops->revalidate_disk(disk);
    1177 check_disk_size_change(disk, bdev);
    1178 @@ -665,6 +677,26 @@ rescan:
    1179 return 0;
    1180 }
    1181
    1182 +int invalidate_partitions(struct gendisk *disk, struct block_device *bdev)
    1183 +{
    1184 + int res;
    1185 +
    1186 + if (!bdev->bd_invalidated)
    1187 + return 0;
    1188 +
    1189 + res = drop_partitions(disk, bdev);
    1190 + if (res)
    1191 + return res;
    1192 +
    1193 + set_capacity(disk, 0);
    1194 + check_disk_size_change(disk, bdev);
    1195 + bdev->bd_invalidated = 0;
    1196 + /* tell userspace that the media / partition table may have changed */
    1197 + kobject_uevent(&disk_to_dev(disk)->kobj, KOBJ_CHANGE);
    1198 +
    1199 + return 0;
    1200 +}
    1201 +
    1202 unsigned char *read_dev_sector(struct block_device *bdev, sector_t n, Sector *p)
    1203 {
    1204 struct address_space *mapping = bdev->bd_inode->i_mapping;
    1205 diff --git a/include/linux/genhd.h b/include/linux/genhd.h
    1206 index 6d18f35..c6f7f6a 100644
    1207 --- a/include/linux/genhd.h
    1208 +++ b/include/linux/genhd.h
    1209 @@ -596,6 +596,7 @@ extern char *disk_name (struct gendisk *hd, int partno, char *buf);
    1210
    1211 extern int disk_expand_part_tbl(struct gendisk *disk, int target);
    1212 extern int rescan_partitions(struct gendisk *disk, struct block_device *bdev);
    1213 +extern int invalidate_partitions(struct gendisk *disk, struct block_device *bdev);
    1214 extern struct hd_struct * __must_check add_partition(struct gendisk *disk,
    1215 int partno, sector_t start,
    1216 sector_t len, int flags,
    1217 diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
    1218 index fe86488..6cf8b53 100644
    1219 --- a/include/linux/skbuff.h
    1220 +++ b/include/linux/skbuff.h
    1221 @@ -1453,6 +1453,16 @@ static inline void skb_set_mac_header(struct sk_buff *skb, const int offset)
    1222 }
    1223 #endif /* NET_SKBUFF_DATA_USES_OFFSET */
    1224
    1225 +static inline void skb_mac_header_rebuild(struct sk_buff *skb)
    1226 +{
    1227 + if (skb_mac_header_was_set(skb)) {
    1228 + const unsigned char *old_mac = skb_mac_header(skb);
    1229 +
    1230 + skb_set_mac_header(skb, -skb->mac_len);
    1231 + memmove(skb_mac_header(skb), old_mac, skb->mac_len);
    1232 + }
    1233 +}
    1234 +
    1235 static inline int skb_checksum_start_offset(const struct sk_buff *skb)
    1236 {
    1237 return skb->csum_start - skb_headroom(skb);
    1238 diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
    1239 index 0d556de..e228ca9 100644
    1240 --- a/include/linux/workqueue.h
    1241 +++ b/include/linux/workqueue.h
    1242 @@ -289,12 +289,16 @@ enum {
    1243 *
    1244 * system_freezable_wq is equivalent to system_wq except that it's
    1245 * freezable.
    1246 + *
    1247 + * system_nrt_freezable_wq is equivalent to system_nrt_wq except that
    1248 + * it's freezable.
    1249 */
    1250 extern struct workqueue_struct *system_wq;
    1251 extern struct workqueue_struct *system_long_wq;
    1252 extern struct workqueue_struct *system_nrt_wq;
    1253 extern struct workqueue_struct *system_unbound_wq;
    1254 extern struct workqueue_struct *system_freezable_wq;
    1255 +extern struct workqueue_struct *system_nrt_freezable_wq;
    1256
    1257 extern struct workqueue_struct *
    1258 __alloc_workqueue_key(const char *name, unsigned int flags, int max_active,
    1259 diff --git a/kernel/workqueue.c b/kernel/workqueue.c
    1260 index 42fa9ad..bb425b1 100644
    1261 --- a/kernel/workqueue.c
    1262 +++ b/kernel/workqueue.c
    1263 @@ -253,11 +253,13 @@ struct workqueue_struct *system_long_wq __read_mostly;
    1264 struct workqueue_struct *system_nrt_wq __read_mostly;
    1265 struct workqueue_struct *system_unbound_wq __read_mostly;
    1266 struct workqueue_struct *system_freezable_wq __read_mostly;
    1267 +struct workqueue_struct *system_nrt_freezable_wq __read_mostly;
    1268 EXPORT_SYMBOL_GPL(system_wq);
    1269 EXPORT_SYMBOL_GPL(system_long_wq);
    1270 EXPORT_SYMBOL_GPL(system_nrt_wq);
    1271 EXPORT_SYMBOL_GPL(system_unbound_wq);
    1272 EXPORT_SYMBOL_GPL(system_freezable_wq);
    1273 +EXPORT_SYMBOL_GPL(system_nrt_freezable_wq);
    1274
    1275 #define CREATE_TRACE_POINTS
    1276 #include <trace/events/workqueue.h>
    1277 @@ -3821,8 +3823,11 @@ static int __init init_workqueues(void)
    1278 WQ_UNBOUND_MAX_ACTIVE);
    1279 system_freezable_wq = alloc_workqueue("events_freezable",
    1280 WQ_FREEZABLE, 0);
    1281 + system_nrt_freezable_wq = alloc_workqueue("events_nrt_freezable",
    1282 + WQ_NON_REENTRANT | WQ_FREEZABLE, 0);
    1283 BUG_ON(!system_wq || !system_long_wq || !system_nrt_wq ||
    1284 - !system_unbound_wq || !system_freezable_wq);
    1285 + !system_unbound_wq || !system_freezable_wq ||
    1286 + !system_nrt_freezable_wq);
    1287 return 0;
    1288 }
    1289 early_initcall(init_workqueues);
    1290 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
    1291 index a5f4e57..8eb6b15 100644
    1292 --- a/net/bridge/br_multicast.c
    1293 +++ b/net/bridge/br_multicast.c
    1294 @@ -446,8 +446,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
    1295 ip6h->nexthdr = IPPROTO_HOPOPTS;
    1296 ip6h->hop_limit = 1;
    1297 ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
    1298 - ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
    1299 - &ip6h->saddr);
    1300 + if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
    1301 + &ip6h->saddr)) {
    1302 + kfree_skb(skb);
    1303 + return NULL;
    1304 + }
    1305 ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
    1306
    1307 hopopt = (u8 *)(ip6h + 1);
    1308 diff --git a/net/core/neighbour.c b/net/core/neighbour.c
    1309 index 5ac07d3..7aafaed 100644
    1310 --- a/net/core/neighbour.c
    1311 +++ b/net/core/neighbour.c
    1312 @@ -802,6 +802,8 @@ next_elt:
    1313 write_unlock_bh(&tbl->lock);
    1314 cond_resched();
    1315 write_lock_bh(&tbl->lock);
    1316 + nht = rcu_dereference_protected(tbl->nht,
    1317 + lockdep_is_held(&tbl->lock));
    1318 }
    1319 /* Cycle through all hash buckets every base_reachable_time/2 ticks.
    1320 * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
    1321 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    1322 index 53113b9..e4d1e4a 100644
    1323 --- a/net/ipv4/tcp_input.c
    1324 +++ b/net/ipv4/tcp_input.c
    1325 @@ -1406,8 +1406,16 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
    1326
    1327 BUG_ON(!pcount);
    1328
    1329 - /* Adjust hint for FACK. Non-FACK is handled in tcp_sacktag_one(). */
    1330 - if (tcp_is_fack(tp) && (skb == tp->lost_skb_hint))
    1331 + /* Adjust counters and hints for the newly sacked sequence
    1332 + * range but discard the return value since prev is already
    1333 + * marked. We must tag the range first because the seq
    1334 + * advancement below implicitly advances
    1335 + * tcp_highest_sack_seq() when skb is highest_sack.
    1336 + */
    1337 + tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
    1338 + start_seq, end_seq, dup_sack, pcount);
    1339 +
    1340 + if (skb == tp->lost_skb_hint)
    1341 tp->lost_cnt_hint += pcount;
    1342
    1343 TCP_SKB_CB(prev)->end_seq += shifted;
    1344 @@ -1433,12 +1441,6 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
    1345 skb_shinfo(skb)->gso_type = 0;
    1346 }
    1347
    1348 - /* Adjust counters and hints for the newly sacked sequence range but
    1349 - * discard the return value since prev is already marked.
    1350 - */
    1351 - tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
    1352 - start_seq, end_seq, dup_sack, pcount);
    1353 -
    1354 /* Difference in this won't matter, both ACKed by the same cumul. ACK */
    1355 TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS);
    1356
    1357 @@ -1586,6 +1588,10 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
    1358 }
    1359 }
    1360
    1361 + /* tcp_sacktag_one() won't SACK-tag ranges below snd_una */
    1362 + if (!after(TCP_SKB_CB(skb)->seq + len, tp->snd_una))
    1363 + goto fallback;
    1364 +
    1365 if (!skb_shift(prev, skb, len))
    1366 goto fallback;
    1367 if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack))
    1368 @@ -2569,6 +2575,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
    1369
    1370 if (cnt > packets) {
    1371 if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) ||
    1372 + (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) ||
    1373 (oldcnt >= packets))
    1374 break;
    1375
    1376 diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
    1377 index 6341818..e3db3f9 100644
    1378 --- a/net/ipv4/xfrm4_mode_beet.c
    1379 +++ b/net/ipv4/xfrm4_mode_beet.c
    1380 @@ -110,10 +110,7 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb)
    1381
    1382 skb_push(skb, sizeof(*iph));
    1383 skb_reset_network_header(skb);
    1384 -
    1385 - memmove(skb->data - skb->mac_len, skb_mac_header(skb),
    1386 - skb->mac_len);
    1387 - skb_set_mac_header(skb, -skb->mac_len);
    1388 + skb_mac_header_rebuild(skb);
    1389
    1390 xfrm4_beet_make_header(skb);
    1391
    1392 diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
    1393 index 534972e..ed4bf11 100644
    1394 --- a/net/ipv4/xfrm4_mode_tunnel.c
    1395 +++ b/net/ipv4/xfrm4_mode_tunnel.c
    1396 @@ -66,7 +66,6 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
    1397
    1398 static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
    1399 {
    1400 - const unsigned char *old_mac;
    1401 int err = -EINVAL;
    1402
    1403 if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP)
    1404 @@ -84,10 +83,9 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
    1405 if (!(x->props.flags & XFRM_STATE_NOECN))
    1406 ipip_ecn_decapsulate(skb);
    1407
    1408 - old_mac = skb_mac_header(skb);
    1409 - skb_set_mac_header(skb, -skb->mac_len);
    1410 - memmove(skb_mac_header(skb), old_mac, skb->mac_len);
    1411 skb_reset_network_header(skb);
    1412 + skb_mac_header_rebuild(skb);
    1413 +
    1414 err = 0;
    1415
    1416 out:
    1417 diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
    1418 index 836c4ea..a5521c5 100644
    1419 --- a/net/ipv6/addrconf.c
    1420 +++ b/net/ipv6/addrconf.c
    1421 @@ -434,6 +434,10 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
    1422 /* Join all-node multicast group */
    1423 ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
    1424
    1425 + /* Join all-router multicast group if forwarding is set */
    1426 + if (ndev->cnf.forwarding && dev && (dev->flags & IFF_MULTICAST))
    1427 + ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
    1428 +
    1429 return ndev;
    1430 }
    1431
    1432 diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
    1433 index 3437d7d..f37cba9 100644
    1434 --- a/net/ipv6/xfrm6_mode_beet.c
    1435 +++ b/net/ipv6/xfrm6_mode_beet.c
    1436 @@ -80,7 +80,6 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
    1437 static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
    1438 {
    1439 struct ipv6hdr *ip6h;
    1440 - const unsigned char *old_mac;
    1441 int size = sizeof(struct ipv6hdr);
    1442 int err;
    1443
    1444 @@ -90,10 +89,7 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
    1445
    1446 __skb_push(skb, size);
    1447 skb_reset_network_header(skb);
    1448 -
    1449 - old_mac = skb_mac_header(skb);
    1450 - skb_set_mac_header(skb, -skb->mac_len);
    1451 - memmove(skb_mac_header(skb), old_mac, skb->mac_len);
    1452 + skb_mac_header_rebuild(skb);
    1453
    1454 xfrm6_beet_make_header(skb);
    1455
    1456 diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
    1457 index 4d6edff..23ecd68 100644
    1458 --- a/net/ipv6/xfrm6_mode_tunnel.c
    1459 +++ b/net/ipv6/xfrm6_mode_tunnel.c
    1460 @@ -63,7 +63,6 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
    1461 static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
    1462 {
    1463 int err = -EINVAL;
    1464 - const unsigned char *old_mac;
    1465
    1466 if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6)
    1467 goto out;
    1468 @@ -80,10 +79,9 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
    1469 if (!(x->props.flags & XFRM_STATE_NOECN))
    1470 ipip6_ecn_decapsulate(skb);
    1471
    1472 - old_mac = skb_mac_header(skb);
    1473 - skb_set_mac_header(skb, -skb->mac_len);
    1474 - memmove(skb_mac_header(skb), old_mac, skb->mac_len);
    1475 skb_reset_network_header(skb);
    1476 + skb_mac_header_rebuild(skb);
    1477 +
    1478 err = 0;
    1479
    1480 out:
    1481 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1482 index 3d8fbf4..dc8a6fc 100644
    1483 --- a/sound/pci/hda/patch_realtek.c
    1484 +++ b/sound/pci/hda/patch_realtek.c
    1485 @@ -2063,12 +2063,16 @@ static int alc_build_controls(struct hda_codec *codec)
    1486 */
    1487
    1488 static void alc_init_special_input_src(struct hda_codec *codec);
    1489 +static int alc269_fill_coef(struct hda_codec *codec);
    1490
    1491 static int alc_init(struct hda_codec *codec)
    1492 {
    1493 struct alc_spec *spec = codec->spec;
    1494 unsigned int i;
    1495
    1496 + if (codec->vendor_id == 0x10ec0269)
    1497 + alc269_fill_coef(codec);
    1498 +
    1499 alc_fix_pll(codec);
    1500 alc_auto_init_amp(codec, spec->init_amp);
    1501
    1502 @@ -5110,8 +5114,12 @@ static const struct alc_model_fixup alc269_fixup_models[] = {
    1503
    1504 static int alc269_fill_coef(struct hda_codec *codec)
    1505 {
    1506 + struct alc_spec *spec = codec->spec;
    1507 int val;
    1508
    1509 + if (spec->codec_variant != ALC269_TYPE_ALC269VB)
    1510 + return 0;
    1511 +
    1512 if ((alc_get_coef0(codec) & 0x00ff) < 0x015) {
    1513 alc_write_coef_idx(codec, 0xf, 0x960b);
    1514 alc_write_coef_idx(codec, 0xe, 0x8817);
    1515 diff --git a/sound/soc/samsung/neo1973_wm8753.c b/sound/soc/samsung/neo1973_wm8753.c
    1516 index 7207189..2fba3f7 100644
    1517 --- a/sound/soc/samsung/neo1973_wm8753.c
    1518 +++ b/sound/soc/samsung/neo1973_wm8753.c
    1519 @@ -421,7 +421,7 @@ static struct snd_soc_dai_link neo1973_dai[] = {
    1520 .platform_name = "samsung-audio",
    1521 .cpu_dai_name = "s3c24xx-iis",
    1522 .codec_dai_name = "wm8753-hifi",
    1523 - .codec_name = "wm8753-codec.0-001a",
    1524 + .codec_name = "wm8753.0-001a",
    1525 .init = neo1973_wm8753_init,
    1526 .ops = &neo1973_hifi_ops,
    1527 },
    1528 @@ -430,7 +430,7 @@ static struct snd_soc_dai_link neo1973_dai[] = {
    1529 .stream_name = "Voice",
    1530 .cpu_dai_name = "dfbmcs320-pcm",
    1531 .codec_dai_name = "wm8753-voice",
    1532 - .codec_name = "wm8753-codec.0-001a",
    1533 + .codec_name = "wm8753.0-001a",
    1534 .ops = &neo1973_voice_ops,
    1535 },
    1536 };