[gentoo-commits] linux-patches r2327 - in genpatches-2.6/trunk: 3.0 3.2 3.4

[Tom Wijsman (tomwij)]

Author: tomwij
Date: 2013-03-31 21:28:05 +0000 (Sun, 31 Mar 2013)
New Revision: 2327

Added:
   genpatches-2.6/trunk/3.0/1070_linux-3.0.71.patch
   genpatches-2.6/trunk/3.2/1041_linux-3.2.42.patch
   genpatches-2.6/trunk/3.4/1037_linux-3.4.38.patch
Modified:
   genpatches-2.6/trunk/3.0/0000_README
   genpatches-2.6/trunk/3.2/0000_README
   genpatches-2.6/trunk/3.4/0000_README
Log:
Linux patches 3.0.71, 3.2.42 and 3.4.38.

Modified: genpatches-2.6/trunk/3.0/0000_README
===================================================================
--- genpatches-2.6/trunk/3.0/0000_README	2013-03-30 11:08:52 UTC (rev 2326)
+++ genpatches-2.6/trunk/3.0/0000_README	2013-03-31 21:28:05 UTC (rev 2327)
@@ -315,6 +315,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.0.70
 
+Patch:  1070_linux-3.0.71.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.0.71
+
 Patch:  1800_fix-zcache-build.patch
 From:   http://bugs.gentoo.org/show_bug.cgi?id=376325
 Desc:   Fix zcache build error

Added: genpatches-2.6/trunk/3.0/1070_linux-3.0.71.patch
===================================================================
--- genpatches-2.6/trunk/3.0/1070_linux-3.0.71.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.0/1070_linux-3.0.71.patch	2013-03-31 21:28:05 UTC (rev 2327)
@@ -0,0 +1,1817 @@
+diff --git a/Makefile b/Makefile
+index 6754172..fbba8bc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 0
+-SUBLEVEL = 70
++SUBLEVEL = 71
+ EXTRAVERSION =
+ NAME = Sneaky Weasel
+ 
+diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
+index b7c2849..554b7b5 100644
+--- a/arch/x86/lib/usercopy_64.c
++++ b/arch/x86/lib/usercopy_64.c
+@@ -169,10 +169,10 @@ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
+ 	char c;
+ 	unsigned zero_len;
+ 
+-	for (; len; --len) {
++	for (; len; --len, to++) {
+ 		if (__get_user_nocheck(c, from++, sizeof(char)))
+ 			break;
+-		if (__put_user_nocheck(c, to++, sizeof(char)))
++		if (__put_user_nocheck(c, to, sizeof(char)))
+ 			break;
+ 	}
+ 
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index a303b61..b4d7898 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -841,7 +841,7 @@ static struct drm_display_mode *drm_mode_detailed(struct drm_device *dev,
+ 	unsigned vblank = (pt->vactive_vblank_hi & 0xf) << 8 | pt->vblank_lo;
+ 	unsigned hsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc0) << 2 | pt->hsync_offset_lo;
+ 	unsigned hsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 0x30) << 4 | pt->hsync_pulse_width_lo;
+-	unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) >> 2 | pt->vsync_offset_pulse_width_lo >> 4;
++	unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) << 2 | pt->vsync_offset_pulse_width_lo >> 4;
+ 	unsigned vsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 0x3) << 4 | (pt->vsync_offset_pulse_width_lo & 0xf);
+ 
+ 	/* ignore tiny modes */
+diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
+index e36efdc..19bab81 100644
+--- a/drivers/gpu/drm/i915/i915_debugfs.c
++++ b/drivers/gpu/drm/i915/i915_debugfs.c
+@@ -119,7 +119,7 @@ static const char *cache_level_str(int type)
+ static void
+ describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
+ {
+-	seq_printf(m, "%p: %s%s %8zd %04x %04x %d %d%s%s%s",
++	seq_printf(m, "%pK: %s%s %8zd %04x %04x %d %d%s%s%s",
+ 		   &obj->base,
+ 		   get_pin_flag(obj),
+ 		   get_tiling_flag(obj),
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index 490ab6b..1ca53ff 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -888,15 +888,20 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
+ 		   int count)
+ {
+ 	int i;
++	int relocs_total = 0;
++	int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
+ 
+ 	for (i = 0; i < count; i++) {
+ 		char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
+ 		int length; /* limited by fault_in_pages_readable() */
+ 
+-		/* First check for malicious input causing overflow */
+-		if (exec[i].relocation_count >
+-		    INT_MAX / sizeof(struct drm_i915_gem_relocation_entry))
++		/* First check for malicious input causing overflow in
++		 * the worst case where we need to allocate the entire
++		 * relocation tree as a single array.
++		 */
++		if (exec[i].relocation_count > relocs_max - relocs_total)
+ 			return -EINVAL;
++		relocs_total += exec[i].relocation_count;
+ 
+ 		length = exec[i].relocation_count *
+ 			sizeof(struct drm_i915_gem_relocation_entry);
+diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
+index d2c7104..e7a97b5 100644
+--- a/drivers/gpu/drm/i915/intel_opregion.c
++++ b/drivers/gpu/drm/i915/intel_opregion.c
+@@ -413,6 +413,25 @@ blind_set:
+ 	goto end;
+ }
+ 
++static void intel_setup_cadls(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++	struct intel_opregion *opregion = &dev_priv->opregion;
++	int i = 0;
++	u32 disp_id;
++
++	/* Initialize the CADL field by duplicating the DIDL values.
++	 * Technically, this is not always correct as display outputs may exist,
++	 * but not active. This initialization is necessary for some Clevo
++	 * laptops that check this field before processing the brightness and
++	 * display switching hotkeys. Just like DIDL, CADL is NULL-terminated if
++	 * there are less than eight devices. */
++	do {
++		disp_id = ioread32(&opregion->acpi->didl[i]);
++		iowrite32(disp_id, &opregion->acpi->cadl[i]);
++	} while (++i < 8 && disp_id != 0);
++}
++
+ void intel_opregion_init(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -422,8 +441,10 @@ void intel_opregion_init(struct drm_device *dev)
+ 		return;
+ 
+ 	if (opregion->acpi) {
+-		if (drm_core_check_feature(dev, DRIVER_MODESET))
++		if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+ 			intel_didl_outputs(dev);
++			intel_setup_cadls(dev);
++		}
+ 
+ 		/* Notify BIOS we are ready to handle ACPI video ext notifs.
+ 		 * Right now, all the events are handled by the ACPI video module.
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index 39913a0..073acdf 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -753,9 +753,13 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
+ 		if (++priv->tx_outstanding == ipoib_sendq_size) {
+ 			ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n",
+ 				  tx->qp->qp_num);
+-			if (ib_req_notify_cq(priv->send_cq, IB_CQ_NEXT_COMP))
+-				ipoib_warn(priv, "request notify on send CQ failed\n");
+ 			netif_stop_queue(dev);
++			rc = ib_req_notify_cq(priv->send_cq,
++				IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS);
++			if (rc < 0)
++				ipoib_warn(priv, "request notify on send CQ failed\n");
++			else if (rc)
++				ipoib_send_comp_handler(priv->send_cq, dev);
+ 		}
+ 	}
+ }
+diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
+index 4309296..8824dd4 100644
+--- a/drivers/net/netconsole.c
++++ b/drivers/net/netconsole.c
+@@ -630,6 +630,7 @@ static int netconsole_netdev_event(struct notifier_block *this,
+ 		goto done;
+ 
+ 	spin_lock_irqsave(&target_list_lock, flags);
++restart:
+ 	list_for_each_entry(nt, &target_list, list) {
+ 		netconsole_target_get(nt);
+ 		if (nt->np.dev == dev) {
+@@ -642,20 +643,17 @@ static int netconsole_netdev_event(struct notifier_block *this,
+ 			case NETDEV_UNREGISTER:
+ 				/*
+ 				 * rtnl_lock already held
++				 * we might sleep in __netpoll_cleanup()
+ 				 */
+-				if (nt->np.dev) {
+-					spin_unlock_irqrestore(
+-							      &target_list_lock,
+-							      flags);
+-					__netpoll_cleanup(&nt->np);
+-					spin_lock_irqsave(&target_list_lock,
+-							  flags);
+-					dev_put(nt->np.dev);
+-					nt->np.dev = NULL;
+-				}
++				spin_unlock_irqrestore(&target_list_lock, flags);
++				__netpoll_cleanup(&nt->np);
++				spin_lock_irqsave(&target_list_lock, flags);
++				dev_put(nt->np.dev);
++				nt->np.dev = NULL;
+ 				nt->enabled = 0;
+ 				stopped = true;
+-				break;
++				netconsole_target_put(nt);
++				goto restart;
+ 			}
+ 		}
+ 		netconsole_target_put(nt);
+diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
+index be3cade..07e526d 100644
+--- a/drivers/net/sfc/efx.c
++++ b/drivers/net/sfc/efx.c
+@@ -651,25 +651,30 @@ static void efx_fini_channels(struct efx_nic *efx)
+ 	struct efx_channel *channel;
+ 	struct efx_tx_queue *tx_queue;
+ 	struct efx_rx_queue *rx_queue;
++	struct pci_dev *dev = efx->pci_dev;
+ 	int rc;
+ 
+ 	EFX_ASSERT_RESET_SERIALISED(efx);
+ 	BUG_ON(efx->port_enabled);
+ 
+-	rc = efx_nic_flush_queues(efx);
+-	if (rc && EFX_WORKAROUND_7803(efx)) {
+-		/* Schedule a reset to recover from the flush failure. The
+-		 * descriptor caches reference memory we're about to free,
+-		 * but falcon_reconfigure_mac_wrapper() won't reconnect
+-		 * the MACs because of the pending reset. */
+-		netif_err(efx, drv, efx->net_dev,
+-			  "Resetting to recover from flush failure\n");
+-		efx_schedule_reset(efx, RESET_TYPE_ALL);
+-	} else if (rc) {
+-		netif_err(efx, drv, efx->net_dev, "failed to flush queues\n");
+-	} else {
+-		netif_dbg(efx, drv, efx->net_dev,
+-			  "successfully flushed all queues\n");
++	/* Only perform flush if dma is enabled */
++	if (dev->is_busmaster) {
++		rc = efx_nic_flush_queues(efx);
++
++		if (rc && EFX_WORKAROUND_7803(efx)) {
++			/* Schedule a reset to recover from the flush failure. The
++			 * descriptor caches reference memory we're about to free,
++			 * but falcon_reconfigure_mac_wrapper() won't reconnect
++			 * the MACs because of the pending reset. */
++			netif_err(efx, drv, efx->net_dev,
++				  "Resetting to recover from flush failure\n");
++			efx_schedule_reset(efx, RESET_TYPE_ALL);
++		} else if (rc) {
++			netif_err(efx, drv, efx->net_dev, "failed to flush queues\n");
++		} else {
++			netif_dbg(efx, drv, efx->net_dev,
++				  "successfully flushed all queues\n");
++		}
+ 	}
+ 
+ 	efx_for_each_channel(channel, efx) {
+@@ -715,6 +720,7 @@ efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries)
+ 	unsigned i;
+ 	int rc;
+ 
++	efx_device_detach_sync(efx);
+ 	efx_stop_all(efx);
+ 	efx_fini_channels(efx);
+ 
+@@ -758,6 +764,7 @@ out:
+ 
+ 	efx_init_channels(efx);
+ 	efx_start_all(efx);
++	netif_device_attach(efx->net_dev);
+ 	return rc;
+ 
+ rollback:
+@@ -1525,8 +1532,12 @@ static void efx_stop_all(struct efx_nic *efx)
+ 	/* Flush efx_mac_work(), refill_workqueue, monitor_work */
+ 	efx_flush_all(efx);
+ 
+-	/* Stop the kernel transmit interface late, so the watchdog
+-	 * timer isn't ticking over the flush */
++	/* Stop the kernel transmit interface.  This is only valid if
++	 * the device is stopped or detached; otherwise the watchdog
++	 * may fire immediately.
++	 */
++	WARN_ON(netif_running(efx->net_dev) &&
++		netif_device_present(efx->net_dev));
+ 	if (efx_dev_registered(efx)) {
+ 		netif_tx_stop_all_queues(efx->net_dev);
+ 		netif_tx_lock_bh(efx->net_dev);
+@@ -1796,10 +1807,11 @@ static int efx_change_mtu(struct net_device *net_dev, int new_mtu)
+ 	if (new_mtu > EFX_MAX_MTU)
+ 		return -EINVAL;
+ 
+-	efx_stop_all(efx);
+-
+ 	netif_dbg(efx, drv, efx->net_dev, "changing MTU to %d\n", new_mtu);
+ 
++	efx_device_detach_sync(efx);
++	efx_stop_all(efx);
++
+ 	efx_fini_channels(efx);
+ 
+ 	mutex_lock(&efx->mac_lock);
+@@ -1812,6 +1824,7 @@ static int efx_change_mtu(struct net_device *net_dev, int new_mtu)
+ 	efx_init_channels(efx);
+ 
+ 	efx_start_all(efx);
++	netif_device_attach(efx->net_dev);
+ 	return rc;
+ }
+ 
+@@ -2101,7 +2114,7 @@ int efx_reset(struct efx_nic *efx, enum reset_type method)
+ 	netif_info(efx, drv, efx->net_dev, "resetting (%s)\n",
+ 		   RESET_TYPE(method));
+ 
+-	netif_device_detach(efx->net_dev);
++	efx_device_detach_sync(efx);
+ 	efx_reset_down(efx, method);
+ 
+ 	rc = efx->type->reset(efx, method);
+@@ -2560,7 +2573,7 @@ static int efx_pm_freeze(struct device *dev)
+ 
+ 	efx->state = STATE_FINI;
+ 
+-	netif_device_detach(efx->net_dev);
++	efx_device_detach_sync(efx);
+ 
+ 	efx_stop_all(efx);
+ 	efx_fini_channels(efx);
+diff --git a/drivers/net/sfc/efx.h b/drivers/net/sfc/efx.h
+index a5d1c60d..76e891e 100644
+--- a/drivers/net/sfc/efx.h
++++ b/drivers/net/sfc/efx.h
+@@ -150,4 +150,17 @@ extern void efx_link_status_changed(struct efx_nic *efx);
+ extern void efx_link_set_advertising(struct efx_nic *efx, u32);
+ extern void efx_link_set_wanted_fc(struct efx_nic *efx, u8);
+ 
++static inline void efx_device_detach_sync(struct efx_nic *efx)
++{
++	struct net_device *dev = efx->net_dev;
++
++	/* Lock/freeze all TX queues so that we can be sure the
++	 * TX scheduler is stopped when we're done and before
++	 * netif_device_present() becomes false.
++	 */
++	netif_tx_lock_bh(dev);
++	netif_device_detach(dev);
++	netif_tx_unlock_bh(dev);
++}
++
+ #endif /* EFX_EFX_H */
+diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
+index 60176e8..19b996b3 100644
+--- a/drivers/net/sfc/falcon.c
++++ b/drivers/net/sfc/falcon.c
+@@ -1714,6 +1714,7 @@ const struct efx_nic_type falcon_a1_nic_type = {
+ 	.remove_port = falcon_remove_port,
+ 	.handle_global_event = falcon_handle_global_event,
+ 	.prepare_flush = falcon_prepare_flush,
++	.finish_flush = efx_port_dummy_op_void,
+ 	.update_stats = falcon_update_nic_stats,
+ 	.start_stats = falcon_start_nic_stats,
+ 	.stop_stats = falcon_stop_nic_stats,
+@@ -1755,6 +1756,7 @@ const struct efx_nic_type falcon_b0_nic_type = {
+ 	.remove_port = falcon_remove_port,
+ 	.handle_global_event = falcon_handle_global_event,
+ 	.prepare_flush = falcon_prepare_flush,
++	.finish_flush = efx_port_dummy_op_void,
+ 	.update_stats = falcon_update_nic_stats,
+ 	.start_stats = falcon_start_nic_stats,
+ 	.stop_stats = falcon_stop_nic_stats,
+diff --git a/drivers/net/sfc/filter.c b/drivers/net/sfc/filter.c
+index 95a980f..08addc9 100644
+--- a/drivers/net/sfc/filter.c
++++ b/drivers/net/sfc/filter.c
+@@ -335,28 +335,35 @@ static int efx_filter_search(struct efx_filter_table *table,
+ 			     bool for_insert, int *depth_required)
+ {
+ 	unsigned hash, incr, filter_idx, depth, depth_max;
+-	struct efx_filter_spec *cmp;
+ 
+ 	hash = efx_filter_hash(key);
+ 	incr = efx_filter_increment(key);
+-	depth_max = (spec->priority <= EFX_FILTER_PRI_HINT ?
+-		     FILTER_CTL_SRCH_HINT_MAX : FILTER_CTL_SRCH_MAX);
+-
+-	for (depth = 1, filter_idx = hash & (table->size - 1);
+-	     depth <= depth_max && test_bit(filter_idx, table->used_bitmap);
+-	     ++depth) {
+-		cmp = &table->spec[filter_idx];
+-		if (efx_filter_equal(spec, cmp))
+-			goto found;
++
++	filter_idx = hash & (table->size - 1);
++	depth = 1;
++	depth_max = (for_insert ?
++		     (spec->priority <= EFX_FILTER_PRI_HINT ?
++		      FILTER_CTL_SRCH_HINT_MAX : FILTER_CTL_SRCH_MAX) :
++		     table->search_depth[spec->type]);
++
++	for (;;) {
++		/* Return success if entry is used and matches this spec
++		 * or entry is unused and we are trying to insert.
++		 */
++		if (test_bit(filter_idx, table->used_bitmap) ?
++		    efx_filter_equal(spec, &table->spec[filter_idx]) :
++		    for_insert) {
++			*depth_required = depth;
++			return filter_idx;
++		}
++
++		/* Return failure if we reached the maximum search depth */
++		if (depth == depth_max)
++			return for_insert ? -EBUSY : -ENOENT;
++
+ 		filter_idx = (filter_idx + incr) & (table->size - 1);
++		++depth;
+ 	}
+-	if (!for_insert)
+-		return -ENOENT;
+-	if (depth > depth_max)
+-		return -EBUSY;
+-found:
+-	*depth_required = depth;
+-	return filter_idx;
+ }
+ 
+ /* Construct/deconstruct external filter IDs */
+diff --git a/drivers/net/sfc/mcdi.c b/drivers/net/sfc/mcdi.c
+index 81a4253..c1000ce 100644
+--- a/drivers/net/sfc/mcdi.c
++++ b/drivers/net/sfc/mcdi.c
+@@ -30,7 +30,7 @@
+ #define REBOOT_FLAG_PORT0 0x3f8
+ #define REBOOT_FLAG_PORT1 0x3fc
+ 
+-#define MCDI_RPC_TIMEOUT       10 /*seconds */
++#define MCDI_RPC_TIMEOUT       (10 * HZ)
+ 
+ #define MCDI_PDU(efx)							\
+ 	(efx_port_num(efx) ? CMD_PDU_PORT1 : CMD_PDU_PORT0)
+@@ -120,7 +120,7 @@ static void efx_mcdi_copyout(struct efx_nic *efx, u8 *outbuf, size_t outlen)
+ static int efx_mcdi_poll(struct efx_nic *efx)
+ {
+ 	struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
+-	unsigned int time, finish;
++	unsigned long time, finish;
+ 	unsigned int respseq, respcmd, error;
+ 	unsigned int pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
+ 	unsigned int rc, spins;
+@@ -136,7 +136,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
+ 	 * and poll once a jiffy (approximately)
+ 	 */
+ 	spins = TICK_USEC;
+-	finish = get_seconds() + MCDI_RPC_TIMEOUT;
++	finish = jiffies + MCDI_RPC_TIMEOUT;
+ 
+ 	while (1) {
+ 		if (spins != 0) {
+@@ -146,7 +146,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
+ 			schedule_timeout_uninterruptible(1);
+ 		}
+ 
+-		time = get_seconds();
++		time = jiffies;
+ 
+ 		rmb();
+ 		efx_readd(efx, &reg, pdu);
+@@ -158,7 +158,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
+ 		    EFX_DWORD_FIELD(reg, MCDI_HEADER_RESPONSE))
+ 			break;
+ 
+-		if (time >= finish)
++		if (time_after(time, finish))
+ 			return -ETIMEDOUT;
+ 	}
+ 
+@@ -250,7 +250,7 @@ static int efx_mcdi_await_completion(struct efx_nic *efx)
+ 	if (wait_event_timeout(
+ 		    mcdi->wq,
+ 		    atomic_read(&mcdi->state) == MCDI_STATE_COMPLETED,
+-		    msecs_to_jiffies(MCDI_RPC_TIMEOUT * 1000)) == 0)
++		    MCDI_RPC_TIMEOUT) == 0)
+ 		return -ETIMEDOUT;
+ 
+ 	/* Check if efx_mcdi_set_mode() switched us back to polled completions.
+@@ -666,9 +666,8 @@ int efx_mcdi_get_board_cfg(struct efx_nic *efx, u8 *mac_address,
+ 			   u16 *fw_subtype_list)
+ {
+ 	uint8_t outbuf[MC_CMD_GET_BOARD_CFG_OUT_LEN];
+-	size_t outlen;
++	size_t outlen, offset, i;
+ 	int port_num = efx_port_num(efx);
+-	int offset;
+ 	int rc;
+ 
+ 	BUILD_BUG_ON(MC_CMD_GET_BOARD_CFG_IN_LEN != 0);
+@@ -688,10 +687,16 @@ int efx_mcdi_get_board_cfg(struct efx_nic *efx, u8 *mac_address,
+ 		: MC_CMD_GET_BOARD_CFG_OUT_MAC_ADDR_BASE_PORT0_OFST;
+ 	if (mac_address)
+ 		memcpy(mac_address, outbuf + offset, ETH_ALEN);
+-	if (fw_subtype_list)
+-		memcpy(fw_subtype_list,
+-		       outbuf + MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_OFST,
+-		       MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_LEN);
++	if (fw_subtype_list) {
++		offset = MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_OFST;
++		for (i = 0;
++		     i < MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_LEN / 2;
++		     i++) {
++			fw_subtype_list[i] =
++				le16_to_cpup((__le16 *)(outbuf + offset));
++			offset += 2;
++		}
++	}
+ 
+ 	return 0;
+ 
+diff --git a/drivers/net/sfc/mcdi.h b/drivers/net/sfc/mcdi.h
+index aced2a7..b61eea0 100644
+--- a/drivers/net/sfc/mcdi.h
++++ b/drivers/net/sfc/mcdi.h
+@@ -126,5 +126,6 @@ extern int efx_mcdi_wol_filter_set_magic(struct efx_nic *efx,
+ extern int efx_mcdi_wol_filter_get_magic(struct efx_nic *efx, int *id_out);
+ extern int efx_mcdi_wol_filter_remove(struct efx_nic *efx, int id);
+ extern int efx_mcdi_wol_filter_reset(struct efx_nic *efx);
++extern int efx_mcdi_set_mac(struct efx_nic *efx);
+ 
+ #endif /* EFX_MCDI_H */
+diff --git a/drivers/net/sfc/mcdi_mac.c b/drivers/net/sfc/mcdi_mac.c
+index 50c2077..da269d7 100644
+--- a/drivers/net/sfc/mcdi_mac.c
++++ b/drivers/net/sfc/mcdi_mac.c
+@@ -13,7 +13,7 @@
+ #include "mcdi.h"
+ #include "mcdi_pcol.h"
+ 
+-static int efx_mcdi_set_mac(struct efx_nic *efx)
++int efx_mcdi_set_mac(struct efx_nic *efx)
+ {
+ 	u32 reject, fcntl;
+ 	u8 cmdbytes[MC_CMD_SET_MAC_IN_LEN];
+@@ -45,6 +45,8 @@ static int efx_mcdi_set_mac(struct efx_nic *efx)
+ 	}
+ 	if (efx->wanted_fc & EFX_FC_AUTO)
+ 		fcntl = MC_CMD_FCNTL_AUTO;
++	if (efx->fc_disable)
++		fcntl = MC_CMD_FCNTL_OFF;
+ 
+ 	MCDI_SET_DWORD(cmdbytes, SET_MAC_IN_FCNTL, fcntl);
+ 
+diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
+index e8d5f03..2f932c5 100644
+--- a/drivers/net/sfc/net_driver.h
++++ b/drivers/net/sfc/net_driver.h
+@@ -214,6 +214,7 @@ struct efx_tx_queue {
+  *	If both this and page are %NULL, the buffer slot is currently free.
+  * @page: The associated page buffer, if any.
+  *	If both this and skb are %NULL, the buffer slot is currently free.
++ * @page_offset: Offset within page. Valid iff @flags & %EFX_RX_BUF_PAGE.
+  * @len: Buffer length, in bytes.
+  * @is_page: Indicates if @page is valid. If false, @skb is valid.
+  */
+@@ -223,7 +224,8 @@ struct efx_rx_buffer {
+ 		struct sk_buff *skb;
+ 		struct page *page;
+ 	} u;
+-	unsigned int len;
++	u16 page_offset;
++	u16 len;
+ 	bool is_page;
+ };
+ 
+@@ -690,6 +692,9 @@ struct efx_filter_state;
+  * @promiscuous: Promiscuous flag. Protected by netif_tx_lock.
+  * @multicast_hash: Multicast hash table
+  * @wanted_fc: Wanted flow control flags
++ * @fc_disable: When non-zero flow control is disabled. Typically used to
++ *	ensure that network back pressure doesn't delay dma queue flushes.
++ *	Serialised by the rtnl lock.
+  * @mac_work: Work item for changing MAC promiscuity and multicast hash
+  * @loopback_mode: Loopback status
+  * @loopback_modes: Supported loopback mode bitmask
+@@ -783,6 +788,7 @@ struct efx_nic {
+ 	bool promiscuous;
+ 	union efx_multicast_hash multicast_hash;
+ 	u8 wanted_fc;
++	unsigned fc_disable;
+ 
+ 	atomic_t rx_reset;
+ 	enum efx_loopback_mode loopback_mode;
+@@ -834,6 +840,7 @@ static inline unsigned int efx_port_num(struct efx_nic *efx)
+  * @remove_port: Free resources allocated by probe_port()
+  * @handle_global_event: Handle a "global" event (may be %NULL)
+  * @prepare_flush: Prepare the hardware for flushing the DMA queues
++ * @finish_flush: Clean up after flushing the DMA queues
+  * @update_stats: Update statistics not provided by event handling
+  * @start_stats: Start the regular fetching of statistics
+  * @stop_stats: Stop the regular fetching of statistics
+@@ -879,6 +886,7 @@ struct efx_nic_type {
+ 	void (*remove_port)(struct efx_nic *efx);
+ 	bool (*handle_global_event)(struct efx_channel *channel, efx_qword_t *);
+ 	void (*prepare_flush)(struct efx_nic *efx);
++	void (*finish_flush)(struct efx_nic *efx);
+ 	void (*update_stats)(struct efx_nic *efx);
+ 	void (*start_stats)(struct efx_nic *efx);
+ 	void (*stop_stats)(struct efx_nic *efx);
+diff --git a/drivers/net/sfc/nic.c b/drivers/net/sfc/nic.c
+index 5ac9fa2..4949004 100644
+--- a/drivers/net/sfc/nic.c
++++ b/drivers/net/sfc/nic.c
+@@ -370,7 +370,8 @@ efx_may_push_tx_desc(struct efx_tx_queue *tx_queue, unsigned int write_count)
+ 		return false;
+ 
+ 	tx_queue->empty_read_count = 0;
+-	return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0;
++	return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0
++		&& tx_queue->write_count - write_count == 1;
+ }
+ 
+ /* For each entry inserted into the software descriptor ring, create a
+@@ -1260,13 +1261,27 @@ int efx_nic_flush_queues(struct efx_nic *efx)
+ 			}
+ 			efx_for_each_possible_channel_tx_queue(tx_queue, channel) {
+ 				if (tx_queue->initialised &&
+-				    tx_queue->flushed != FLUSH_DONE)
+-					++tx_pending;
++				    tx_queue->flushed != FLUSH_DONE) {
++					efx_oword_t txd_ptr_tbl;
++
++					efx_reado_table(efx, &txd_ptr_tbl,
++							FR_BZ_TX_DESC_PTR_TBL,
++							tx_queue->queue);
++					if (EFX_OWORD_FIELD(txd_ptr_tbl,
++							    FRF_AZ_TX_DESCQ_FLUSH) ||
++					    EFX_OWORD_FIELD(txd_ptr_tbl,
++							    FRF_AZ_TX_DESCQ_EN))
++						++tx_pending;
++					else
++						tx_queue->flushed = FLUSH_DONE;
++				}
+ 			}
+ 		}
+ 
+-		if (rx_pending == 0 && tx_pending == 0)
++		if (rx_pending == 0 && tx_pending == 0) {
++			efx->type->finish_flush(efx);
+ 			return 0;
++		}
+ 
+ 		msleep(EFX_FLUSH_INTERVAL);
+ 		efx_poll_flush_events(efx);
+@@ -1292,6 +1307,7 @@ int efx_nic_flush_queues(struct efx_nic *efx)
+ 		}
+ 	}
+ 
++	efx->type->finish_flush(efx);
+ 	return -ETIMEDOUT;
+ }
+ 
+diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
+index d2405ce..8a2c4f5 100644
+--- a/drivers/net/sfc/nic.h
++++ b/drivers/net/sfc/nic.h
+@@ -211,6 +211,8 @@ extern void falcon_irq_ack_a1(struct efx_nic *efx);
+ 
+ /* Global Resources */
+ extern int efx_nic_flush_queues(struct efx_nic *efx);
++extern void siena_prepare_flush(struct efx_nic *efx);
++extern void siena_finish_flush(struct efx_nic *efx);
+ extern void falcon_start_nic_stats(struct efx_nic *efx);
+ extern void falcon_stop_nic_stats(struct efx_nic *efx);
+ extern void falcon_setup_xaui(struct efx_nic *efx);
+diff --git a/drivers/net/sfc/rx.c b/drivers/net/sfc/rx.c
+index 4004fc2..d429f0a 100644
+--- a/drivers/net/sfc/rx.c
++++ b/drivers/net/sfc/rx.c
+@@ -94,11 +94,7 @@ static unsigned int rx_refill_limit = 95;
+ static inline unsigned int efx_rx_buf_offset(struct efx_nic *efx,
+ 					     struct efx_rx_buffer *buf)
+ {
+-	/* Offset is always within one page, so we don't need to consider
+-	 * the page order.
+-	 */
+-	return (((__force unsigned long) buf->dma_addr & (PAGE_SIZE - 1)) +
+-		efx->type->rx_buffer_hash_size);
++	return buf->page_offset + efx->type->rx_buffer_hash_size;
+ }
+ static inline unsigned int efx_rx_buf_size(struct efx_nic *efx)
+ {
+@@ -193,6 +189,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
+ 	struct efx_rx_buffer *rx_buf;
+ 	struct page *page;
+ 	void *page_addr;
++	unsigned int page_offset;
+ 	struct efx_rx_page_state *state;
+ 	dma_addr_t dma_addr;
+ 	unsigned index, count;
+@@ -219,12 +216,14 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
+ 
+ 		page_addr += sizeof(struct efx_rx_page_state);
+ 		dma_addr += sizeof(struct efx_rx_page_state);
++		page_offset = sizeof(struct efx_rx_page_state);
+ 
+ 	split:
+ 		index = rx_queue->added_count & rx_queue->ptr_mask;
+ 		rx_buf = efx_rx_buffer(rx_queue, index);
+ 		rx_buf->dma_addr = dma_addr + EFX_PAGE_IP_ALIGN;
+ 		rx_buf->u.page = page;
++		rx_buf->page_offset = page_offset + EFX_PAGE_IP_ALIGN;
+ 		rx_buf->len = efx->rx_buffer_len - EFX_PAGE_IP_ALIGN;
+ 		rx_buf->is_page = true;
+ 		++rx_queue->added_count;
+@@ -236,6 +235,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
+ 			get_page(page);
+ 			dma_addr += (PAGE_SIZE >> 1);
+ 			page_addr += (PAGE_SIZE >> 1);
++			page_offset += (PAGE_SIZE >> 1);
+ 			++count;
+ 			goto split;
+ 		}
+@@ -245,7 +245,8 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
+ }
+ 
+ static void efx_unmap_rx_buffer(struct efx_nic *efx,
+-				struct efx_rx_buffer *rx_buf)
++				struct efx_rx_buffer *rx_buf,
++				unsigned int used_len)
+ {
+ 	if (rx_buf->is_page && rx_buf->u.page) {
+ 		struct efx_rx_page_state *state;
+@@ -256,6 +257,10 @@ static void efx_unmap_rx_buffer(struct efx_nic *efx,
+ 				       state->dma_addr,
+ 				       efx_rx_buf_size(efx),
+ 				       PCI_DMA_FROMDEVICE);
++		} else if (used_len) {
++			dma_sync_single_for_cpu(&efx->pci_dev->dev,
++						rx_buf->dma_addr, used_len,
++						DMA_FROM_DEVICE);
+ 		}
+ 	} else if (!rx_buf->is_page && rx_buf->u.skb) {
+ 		pci_unmap_single(efx->pci_dev, rx_buf->dma_addr,
+@@ -278,7 +283,7 @@ static void efx_free_rx_buffer(struct efx_nic *efx,
+ static void efx_fini_rx_buffer(struct efx_rx_queue *rx_queue,
+ 			       struct efx_rx_buffer *rx_buf)
+ {
+-	efx_unmap_rx_buffer(rx_queue->efx, rx_buf);
++	efx_unmap_rx_buffer(rx_queue->efx, rx_buf, 0);
+ 	efx_free_rx_buffer(rx_queue->efx, rx_buf);
+ }
+ 
+@@ -549,10 +554,10 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
+ 		goto out;
+ 	}
+ 
+-	/* Release card resources - assumes all RX buffers consumed in-order
+-	 * per RX queue
++	/* Release and/or sync DMA mapping - assumes all RX buffers
++	 * consumed in-order per RX queue
+ 	 */
+-	efx_unmap_rx_buffer(efx, rx_buf);
++	efx_unmap_rx_buffer(efx, rx_buf, len);
+ 
+ 	/* Prefetch nice and early so data will (hopefully) be in cache by
+ 	 * the time we look at it.
+diff --git a/drivers/net/sfc/selftest.c b/drivers/net/sfc/selftest.c
+index 822f6c2..4907885 100644
+--- a/drivers/net/sfc/selftest.c
++++ b/drivers/net/sfc/selftest.c
+@@ -698,7 +698,7 @@ int efx_selftest(struct efx_nic *efx, struct efx_self_tests *tests,
+ 	/* Detach the device so the kernel doesn't transmit during the
+ 	 * loopback test and the watchdog timeout doesn't fire.
+ 	 */
+-	netif_device_detach(efx->net_dev);
++	efx_device_detach_sync(efx);
+ 
+ 	mutex_lock(&efx->mac_lock);
+ 	if (efx->loopback_modes) {
+diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
+index ceac1c9..062494a 100644
+--- a/drivers/net/sfc/siena.c
++++ b/drivers/net/sfc/siena.c
+@@ -135,6 +135,18 @@ static void siena_remove_port(struct efx_nic *efx)
+ 	efx_nic_free_buffer(efx, &efx->stats_buffer);
+ }
+ 
++void siena_prepare_flush(struct efx_nic *efx)
++{
++	if (efx->fc_disable++ == 0)
++		efx_mcdi_set_mac(efx);
++}
++
++void siena_finish_flush(struct efx_nic *efx)
++{
++	if (--efx->fc_disable == 0)
++		efx_mcdi_set_mac(efx);
++}
++
+ static const struct efx_nic_register_test siena_register_tests[] = {
+ 	{ FR_AZ_ADR_REGION,
+ 	  EFX_OWORD32(0x0003FFFF, 0x0003FFFF, 0x0003FFFF, 0x0003FFFF) },
+@@ -372,14 +384,13 @@ static void siena_remove_nic(struct efx_nic *efx)
+ 	efx->nic_data = NULL;
+ }
+ 
+-#define STATS_GENERATION_INVALID ((u64)(-1))
++#define STATS_GENERATION_INVALID ((__force __le64)(-1))
+ 
+ static int siena_try_update_nic_stats(struct efx_nic *efx)
+ {
+-	u64 *dma_stats;
++	__le64 *dma_stats;
+ 	struct efx_mac_stats *mac_stats;
+-	u64 generation_start;
+-	u64 generation_end;
++	__le64 generation_start, generation_end;
+ 
+ 	mac_stats = &efx->mac_stats;
+ 	dma_stats = (u64 *)efx->stats_buffer.addr;
+@@ -390,7 +401,7 @@ static int siena_try_update_nic_stats(struct efx_nic *efx)
+ 	rmb();
+ 
+ #define MAC_STAT(M, D) \
+-	mac_stats->M = dma_stats[MC_CMD_MAC_ ## D]
++	mac_stats->M = le64_to_cpu(dma_stats[MC_CMD_MAC_ ## D])
+ 
+ 	MAC_STAT(tx_bytes, TX_BYTES);
+ 	MAC_STAT(tx_bad_bytes, TX_BAD_BYTES);
+@@ -460,7 +471,8 @@ static int siena_try_update_nic_stats(struct efx_nic *efx)
+ 	MAC_STAT(rx_internal_error, RX_INTERNAL_ERROR_PKTS);
+ 	mac_stats->rx_good_lt64 = 0;
+ 
+-	efx->n_rx_nodesc_drop_cnt = dma_stats[MC_CMD_MAC_RX_NODESC_DROPS];
++	efx->n_rx_nodesc_drop_cnt =
++		le64_to_cpu(dma_stats[MC_CMD_MAC_RX_NODESC_DROPS]);
+ 
+ #undef MAC_STAT
+ 
+@@ -489,7 +501,7 @@ static void siena_update_nic_stats(struct efx_nic *efx)
+ 
+ static void siena_start_nic_stats(struct efx_nic *efx)
+ {
+-	u64 *dma_stats = (u64 *)efx->stats_buffer.addr;
++	__le64 *dma_stats = efx->stats_buffer.addr;
+ 
+ 	dma_stats[MC_CMD_MAC_GENERATION_END] = STATS_GENERATION_INVALID;
+ 
+@@ -590,7 +602,8 @@ const struct efx_nic_type siena_a0_nic_type = {
+ 	.reset = siena_reset_hw,
+ 	.probe_port = siena_probe_port,
+ 	.remove_port = siena_remove_port,
+-	.prepare_flush = efx_port_dummy_op_void,
++	.prepare_flush = siena_prepare_flush,
++	.finish_flush = siena_finish_flush,
+ 	.update_stats = siena_update_nic_stats,
+ 	.start_stats = siena_start_nic_stats,
+ 	.stop_stats = siena_stop_nic_stats,
+diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
+index 5eab3dc..890841a 100644
+--- a/drivers/net/wireless/mwifiex/join.c
++++ b/drivers/net/wireless/mwifiex/join.c
+@@ -1102,10 +1102,9 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mwifiex_private *priv,
+ 				adhoc_join->bss_descriptor.bssid,
+ 				adhoc_join->bss_descriptor.ssid);
+ 
+-	for (i = 0; bss_desc->supported_rates[i] &&
+-			i < MWIFIEX_SUPPORTED_RATES;
+-			i++)
+-			;
++	for (i = 0; i < MWIFIEX_SUPPORTED_RATES &&
++		    bss_desc->supported_rates[i]; i++)
++		;
+ 	rates_size = i;
+ 
+ 	/* Copy Data Rates from the Rates recorded in scan response */
+diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
+index 5bd2c55..031aa2b 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+@@ -1113,7 +1113,9 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
+ 		rt2x00dev->hw->wiphy->interface_modes |=
+ 		    BIT(NL80211_IFTYPE_ADHOC) |
+ 		    BIT(NL80211_IFTYPE_AP) |
++#ifdef CONFIG_MAC80211_MESH
+ 		    BIT(NL80211_IFTYPE_MESH_POINT) |
++#endif
+ 		    BIT(NL80211_IFTYPE_WDS);
+ 
+ 	/*
+diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
+index 26f7f01..f0bf9c2 100644
+--- a/drivers/platform/x86/asus-laptop.c
++++ b/drivers/platform/x86/asus-laptop.c
+@@ -643,8 +643,10 @@ static ssize_t show_infos(struct device *dev,
+ 	/*
+ 	 * The HWRS method return informations about the hardware.
+ 	 * 0x80 bit is for WLAN, 0x100 for Bluetooth.
++	 * 0x40 for WWAN, 0x10 for WIMAX.
+ 	 * The significance of others is yet to be found.
+-	 * If we don't find the method, we assume the device are present.
++	 * We don't currently use this for device detection, and it
++	 * takes several seconds to run on some systems.
+ 	 */
+ 	rv = acpi_evaluate_integer(asus->handle, "HWRS", NULL, &temp);
+ 	if (!ACPI_FAILURE(rv))
+@@ -1271,7 +1273,7 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
+ {
+ 	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+ 	union acpi_object *model = NULL;
+-	unsigned long long bsts_result, hwrs_result;
++	unsigned long long bsts_result;
+ 	char *string = NULL;
+ 	acpi_status status;
+ 
+@@ -1333,17 +1335,6 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
+ 	if (*string)
+ 		pr_notice("  %s model detected\n", string);
+ 
+-	/*
+-	 * The HWRS method return informations about the hardware.
+-	 * 0x80 bit is for WLAN, 0x100 for Bluetooth,
+-	 * 0x40 for WWAN, 0x10 for WIMAX.
+-	 * The significance of others is yet to be found.
+-	 */
+-	status =
+-	    acpi_evaluate_integer(asus->handle, "HWRS", NULL, &hwrs_result);
+-	if (!ACPI_FAILURE(status))
+-		pr_notice("  HWRS returned %x", (int)hwrs_result);
+-
+ 	if (!acpi_check_handle(asus->handle, METHOD_WL_STATUS, NULL))
+ 		asus->have_rsts = true;
+ 
+diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
+index 92aa545..bf583fa 100644
+--- a/drivers/tty/serial/sunsu.c
++++ b/drivers/tty/serial/sunsu.c
+@@ -968,6 +968,7 @@ static struct uart_ops sunsu_pops = {
+ #define UART_NR	4
+ 
+ static struct uart_sunsu_port sunsu_ports[UART_NR];
++static int nr_inst; /* Number of already registered ports */
+ 
+ #ifdef CONFIG_SERIO
+ 
+@@ -1337,13 +1338,8 @@ static int __init sunsu_console_setup(struct console *co, char *options)
+ 	printk("Console: ttyS%d (SU)\n",
+ 	       (sunsu_reg.minor - 64) + co->index);
+ 
+-	/*
+-	 * Check whether an invalid uart number has been specified, and
+-	 * if so, search for the first available port that does have
+-	 * console support.
+-	 */
+-	if (co->index >= UART_NR)
+-		co->index = 0;
++	if (co->index > nr_inst)
++		return -ENODEV;
+ 	port = &sunsu_ports[co->index].port;
+ 
+ 	/*
+@@ -1408,7 +1404,6 @@ static enum su_type __devinit su_get_type(struct device_node *dp)
+ 
+ static int __devinit su_probe(struct platform_device *op)
+ {
+-	static int inst;
+ 	struct device_node *dp = op->dev.of_node;
+ 	struct uart_sunsu_port *up;
+ 	struct resource *rp;
+@@ -1418,16 +1413,16 @@ static int __devinit su_probe(struct platform_device *op)
+ 
+ 	type = su_get_type(dp);
+ 	if (type == SU_PORT_PORT) {
+-		if (inst >= UART_NR)
++		if (nr_inst >= UART_NR)
+ 			return -EINVAL;
+-		up = &sunsu_ports[inst];
++		up = &sunsu_ports[nr_inst];
+ 	} else {
+ 		up = kzalloc(sizeof(*up), GFP_KERNEL);
+ 		if (!up)
+ 			return -ENOMEM;
+ 	}
+ 
+-	up->port.line = inst;
++	up->port.line = nr_inst;
+ 
+ 	spin_lock_init(&up->port.lock);
+ 
+@@ -1461,6 +1456,8 @@ static int __devinit su_probe(struct platform_device *op)
+ 		}
+ 		dev_set_drvdata(&op->dev, up);
+ 
++		nr_inst++;
++
+ 		return 0;
+ 	}
+ 
+@@ -1488,7 +1485,7 @@ static int __devinit su_probe(struct platform_device *op)
+ 
+ 	dev_set_drvdata(&op->dev, up);
+ 
+-	inst++;
++	nr_inst++;
+ 
+ 	return 0;
+ 
+diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
+index a54c380..923153c 100644
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -137,7 +137,7 @@ qh_refresh (struct ehci_hcd *ehci, struct ehci_qh *qh)
+ 		 * qtd is updated in qh_completions(). Update the QH
+ 		 * overlay here.
+ 		 */
+-		if (qh->hw->hw_token & ACTIVE_BIT(ehci)) {
++		if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current) {
+ 			qh->hw->hw_qtd_next = qtd->hw_next;
+ 			qtd = NULL;
+ 		}
+@@ -450,19 +450,11 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
+ 			else if (last_status == -EINPROGRESS && !urb->unlinked)
+ 				continue;
+ 
+-			/*
+-			 * If this was the active qtd when the qh was unlinked
+-			 * and the overlay's token is active, then the overlay
+-			 * hasn't been written back to the qtd yet so use its
+-			 * token instead of the qtd's.  After the qtd is
+-			 * processed and removed, the overlay won't be valid
+-			 * any more.
+-			 */
+-			if (state == QH_STATE_IDLE &&
+-					qh->qtd_list.next == &qtd->qtd_list &&
+-					(hw->hw_token & ACTIVE_BIT(ehci))) {
++			/* qh unlinked; token in overlay may be most current */
++			if (state == QH_STATE_IDLE
++					&& cpu_to_hc32(ehci, qtd->qtd_dma)
++						== hw->hw_current) {
+ 				token = hc32_to_cpu(ehci, hw->hw_token);
+-				hw->hw_token &= ~ACTIVE_BIT(ehci);
+ 
+ 				/* An unlink may leave an incomplete
+ 				 * async transaction in the TT buffer.
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 1d72895..8b94412 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -206,8 +206,8 @@ struct xhci_op_regs {
+ /* bits 12:31 are reserved (and should be preserved on writes). */
+ 
+ /* IMAN - Interrupt Management Register */
+-#define IMAN_IP		(1 << 1)
+-#define IMAN_IE		(1 << 0)
++#define IMAN_IE		(1 << 1)
++#define IMAN_IP		(1 << 0)
+ 
+ /* USBSTS - USB status - status bitmasks */
+ /* HC not running - set to 1 when run/stop bit is cleared. */
+diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
+index b0a7a9e..51b22c3 100644
+--- a/drivers/usb/serial/garmin_gps.c
++++ b/drivers/usb/serial/garmin_gps.c
+@@ -973,10 +973,7 @@ static void garmin_close(struct usb_serial_port *port)
+ 	if (!serial)
+ 		return;
+ 
+-	mutex_lock(&port->serial->disc_mutex);
+-
+-	if (!port->serial->disconnected)
+-		garmin_clear(garmin_data_p);
++	garmin_clear(garmin_data_p);
+ 
+ 	/* shutdown our urbs */
+ 	usb_kill_urb(port->read_urb);
+@@ -985,8 +982,6 @@ static void garmin_close(struct usb_serial_port *port)
+ 	/* keep reset state so we know that we must start a new session */
+ 	if (garmin_data_p->state != STATE_RESET)
+ 		garmin_data_p->state = STATE_DISCONNECTED;
+-
+-	mutex_unlock(&port->serial->disc_mutex);
+ }
+ 
+ 
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index 8a90d58..bdb44fc 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -2793,6 +2793,7 @@ static struct usb_serial_driver edgeport_2port_device = {
+ 	.set_termios		= edge_set_termios,
+ 	.tiocmget		= edge_tiocmget,
+ 	.tiocmset		= edge_tiocmset,
++	.get_icount		= edge_get_icount,
+ 	.write			= edge_write,
+ 	.write_room		= edge_write_room,
+ 	.chars_in_buffer	= edge_chars_in_buffer,
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index 637dfa4..f678532 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -168,6 +168,7 @@ static void destroy_serial(struct kref *kref)
+ 		}
+ 	}
+ 
++	usb_put_intf(serial->interface);
+ 	usb_put_dev(serial->dev);
+ 	kfree(serial);
+ }
+@@ -624,7 +625,7 @@ static struct usb_serial *create_serial(struct usb_device *dev,
+ 	}
+ 	serial->dev = usb_get_dev(dev);
+ 	serial->type = driver;
+-	serial->interface = interface;
++	serial->interface = usb_get_intf(interface);
+ 	kref_init(&serial->kref);
+ 	mutex_init(&serial->disc_mutex);
+ 	serial->minor = SERIAL_TTY_NO_MINOR;
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index fa8a1b2..7b8d564 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -488,6 +488,13 @@ UNUSUAL_DEV(  0x04e8, 0x5122, 0x0000, 0x9999,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_MAX_SECTORS_64 | US_FL_BULK_IGNORE_TAG),
+ 
++/* Added by Dmitry Artamonow <mad_soft@×××××.ru> */
++UNUSUAL_DEV(  0x04e8, 0x5136, 0x0000, 0x9999,
++		"Samsung",
++		"YP-Z3",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_MAX_SECTORS_64),
++
+ /* Entry and supporting patch by Theodore Kilgore <kilgota@××××××.edu>.
+  * Device uses standards-violating 32-byte Bulk Command Block Wrappers and
+  * reports itself as "Proprietary SCSI Bulk." Cf. device entry 0x084d:0x0011.
+diff --git a/fs/binfmt_em86.c b/fs/binfmt_em86.c
+index b8e8b0a..4a1b984 100644
+--- a/fs/binfmt_em86.c
++++ b/fs/binfmt_em86.c
+@@ -42,7 +42,6 @@ static int load_em86(struct linux_binprm *bprm,struct pt_regs *regs)
+ 			return -ENOEXEC;
+ 	}
+ 
+-	bprm->recursion_depth++; /* Well, the bang-shell is implicit... */
+ 	allow_write_access(bprm->file);
+ 	fput(bprm->file);
+ 	bprm->file = NULL;
+diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
+index 5463952..b2497d4 100644
+--- a/fs/binfmt_misc.c
++++ b/fs/binfmt_misc.c
+@@ -116,10 +116,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ 	if (!enabled)
+ 		goto _ret;
+ 
+-	retval = -ENOEXEC;
+-	if (bprm->recursion_depth > BINPRM_MAX_RECURSION)
+-		goto _ret;
+-
+ 	/* to keep locking time low, we copy the interpreter string */
+ 	read_lock(&entries_lock);
+ 	fmt = check_file(bprm);
+@@ -200,8 +196,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ 	if (retval < 0)
+ 		goto _error;
+ 
+-	bprm->recursion_depth++;
+-
+ 	retval = search_binary_handler (bprm, regs);
+ 	if (retval < 0)
+ 		goto _error;
+diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
+index e39c18a..211ede0 100644
+--- a/fs/binfmt_script.c
++++ b/fs/binfmt_script.c
+@@ -22,15 +22,13 @@ static int load_script(struct linux_binprm *bprm,struct pt_regs *regs)
+ 	char interp[BINPRM_BUF_SIZE];
+ 	int retval;
+ 
+-	if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!') ||
+-	    (bprm->recursion_depth > BINPRM_MAX_RECURSION))
++	if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!'))
+ 		return -ENOEXEC;
+ 	/*
+ 	 * This section does the #! interpretation.
+ 	 * Sorta complicated, but hopefully it will work.  -TYT
+ 	 */
+ 
+-	bprm->recursion_depth++;
+ 	allow_write_access(bprm->file);
+ 	fput(bprm->file);
+ 	bprm->file = NULL;
+diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
+index cfd1ce3..1d36db1 100644
+--- a/fs/cifs/asn1.c
++++ b/fs/cifs/asn1.c
+@@ -614,53 +614,10 @@ decode_negTokenInit(unsigned char *security_blob, int length,
+ 		}
+ 	}
+ 
+-	/* mechlistMIC */
+-	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-		/* Check if we have reached the end of the blob, but with
+-		   no mechListMic (e.g. NTLMSSP instead of KRB5) */
+-		if (ctx.error == ASN1_ERR_DEC_EMPTY)
+-			goto decode_negtoken_exit;
+-		cFYI(1, "Error decoding last part negTokenInit exit3");
+-		return 0;
+-	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
+-		/* tag = 3 indicating mechListMIC */
+-		cFYI(1, "Exit 4 cls = %d con = %d tag = %d end = %p (%d)",
+-			cls, con, tag, end, *end);
+-		return 0;
+-	}
+-
+-	/* sequence */
+-	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-		cFYI(1, "Error decoding last part negTokenInit exit5");
+-		return 0;
+-	} else if ((cls != ASN1_UNI) || (con != ASN1_CON)
+-		   || (tag != ASN1_SEQ)) {
+-		cFYI(1, "cls = %d con = %d tag = %d end = %p (%d)",
+-			cls, con, tag, end, *end);
+-	}
+-
+-	/* sequence of */
+-	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-		cFYI(1, "Error decoding last part negTokenInit exit 7");
+-		return 0;
+-	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
+-		cFYI(1, "Exit 8 cls = %d con = %d tag = %d end = %p (%d)",
+-			cls, con, tag, end, *end);
+-		return 0;
+-	}
+-
+-	/* general string */
+-	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-		cFYI(1, "Error decoding last part negTokenInit exit9");
+-		return 0;
+-	} else if ((cls != ASN1_UNI) || (con != ASN1_PRI)
+-		   || (tag != ASN1_GENSTR)) {
+-		cFYI(1, "Exit10 cls = %d con = %d tag = %d end = %p (%d)",
+-			cls, con, tag, end, *end);
+-		return 0;
+-	}
+-	cFYI(1, "Need to call asn1_octets_decode() function for %s",
+-		ctx.pointer);	/* is this UTF-8 or ASCII? */
+-decode_negtoken_exit:
++	/*
++	 * We currently ignore anything at the end of the SPNEGO blob after
++	 * the mechTypes have been parsed, since none of that info is
++	 * used at the moment.
++	 */
+ 	return 1;
+ }
+diff --git a/fs/compat.c b/fs/compat.c
+index e5358c2..f77a963 100644
+--- a/fs/compat.c
++++ b/fs/compat.c
+@@ -576,6 +576,10 @@ ssize_t compat_rw_copy_check_uvector(int type,
+ 	}
+ 	*ret_pointer = iov;
+ 
++	ret = -EFAULT;
++	if (!access_ok(VERIFY_READ, uvector, nr_segs*sizeof(*uvector)))
++		goto out;
++
+ 	/*
+ 	 * Single unix specification:
+ 	 * We should -EINVAL if an element length is not >= 0 and fitting an
+@@ -1106,17 +1110,12 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
+ 	if (!file->f_op)
+ 		goto out;
+ 
+-	ret = -EFAULT;
+-	if (!access_ok(VERIFY_READ, uvector, nr_segs*sizeof(*uvector)))
+-		goto out;
+-
+-	tot_len = compat_rw_copy_check_uvector(type, uvector, nr_segs,
++	ret = compat_rw_copy_check_uvector(type, uvector, nr_segs,
+ 					       UIO_FASTIOV, iovstack, &iov);
+-	if (tot_len == 0) {
+-		ret = 0;
++	if (ret <= 0)
+ 		goto out;
+-	}
+ 
++	tot_len = ret;
+ 	ret = rw_verify_area(type, file, pos, tot_len);
+ 	if (ret < 0)
+ 		goto out;
+diff --git a/fs/exec.c b/fs/exec.c
+index 08f3e4e..3801daf 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1369,6 +1369,10 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+ 	int try,retval;
+ 	struct linux_binfmt *fmt;
+ 
++	/* This allows 4 levels of binfmt rewrites before failing hard. */
++	if (depth > 5)
++		return -ELOOP;
++
+ 	retval = security_bprm_check(bprm);
+ 	if (retval)
+ 		return retval;
+@@ -1387,12 +1391,8 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+ 			if (!try_module_get(fmt->module))
+ 				continue;
+ 			read_unlock(&binfmt_lock);
++			bprm->recursion_depth = depth + 1;
+ 			retval = fn(bprm, regs);
+-			/*
+-			 * Restore the depth counter to its starting value
+-			 * in this call, so we don't have to rely on every
+-			 * load_binary function to restore it on return.
+-			 */
+ 			bprm->recursion_depth = depth;
+ 			if (retval >= 0) {
+ 				if (depth == 0)
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 680df5d..354ba48 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -2901,6 +2901,7 @@ static int ext4_split_extent(handle_t *handle,
+ 	int err = 0;
+ 	int uninitialized;
+ 	int split_flag1, flags1;
++	int allocated = map->m_len;
+ 
+ 	depth = ext_depth(inode);
+ 	ex = path[depth].p_ext;
+@@ -2919,6 +2920,8 @@ static int ext4_split_extent(handle_t *handle,
+ 				map->m_lblk + map->m_len, split_flag1, flags1);
+ 		if (err)
+ 			goto out;
++	} else {
++		allocated = ee_len - (map->m_lblk - ee_block);
+ 	}
+ 
+ 	ext4_ext_drop_refs(path);
+@@ -2941,7 +2944,7 @@ static int ext4_split_extent(handle_t *handle,
+ 
+ 	ext4_ext_show_leaf(inode, path);
+ out:
+-	return err ? err : map->m_len;
++	return err ? err : allocated;
+ }
+ 
+ #define EXT4_EXT_ZERO_LEN 7
+@@ -3309,6 +3312,7 @@ out:
+ 					allocated - map->m_len);
+ 		allocated = map->m_len;
+ 	}
++	map->m_len = allocated;
+ 
+ 	/*
+ 	 * If we have done fallocate with the offset that is already
+diff --git a/fs/isofs/export.c b/fs/isofs/export.c
+index 516eb21..fd88add 100644
+--- a/fs/isofs/export.c
++++ b/fs/isofs/export.c
+@@ -135,6 +135,7 @@ isofs_export_encode_fh(struct dentry *dentry,
+ 	len = 3;
+ 	fh32[0] = ei->i_iget5_block;
+  	fh16[2] = (__u16)ei->i_iget5_offset;  /* fh16 [sic] */
++	fh16[3] = 0;  /* avoid leaking uninitialized data */
+ 	fh32[2] = inode->i_generation;
+ 	if (connectable && !S_ISDIR(inode->i_mode)) {
+ 		struct inode *parent;
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index f1dce84..d8c1bb5 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -1297,6 +1297,7 @@ static int udf_encode_fh(struct dentry *de, __u32 *fh, int *lenp,
+ 	*lenp = 3;
+ 	fid->udf.block = location.logicalBlockNum;
+ 	fid->udf.partref = location.partitionReferenceNum;
++	fid->udf.parent_partref = 0;
+ 	fid->udf.generation = inode->i_generation;
+ 
+ 	if (connectable && !S_ISDIR(inode->i_mode)) {
+diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
+index 4858c19..54706dc 100644
+--- a/fs/udf/udf_sb.h
++++ b/fs/udf/udf_sb.h
+@@ -79,7 +79,7 @@ struct udf_virtual_data {
+ struct udf_bitmap {
+ 	__u32			s_extLength;
+ 	__u32			s_extPosition;
+-	__u16			s_nr_groups;
++	int			s_nr_groups;
+ 	struct buffer_head 	**s_block_bitmap;
+ };
+ 
+diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
+index 384e37f..718eb0b 100644
+--- a/include/linux/binfmts.h
++++ b/include/linux/binfmts.h
+@@ -67,8 +67,6 @@ struct linux_binprm {
+ #define BINPRM_FLAGS_EXECFD_BIT 1
+ #define BINPRM_FLAGS_EXECFD (1 << BINPRM_FLAGS_EXECFD_BIT)
+ 
+-#define BINPRM_MAX_RECURSION 4
+-
+ /* Function parameter for binfmt->coredump */
+ struct coredump_params {
+ 	long signr;
+diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
+index 16ff29a..b289bd2 100644
+--- a/include/net/inet_frag.h
++++ b/include/net/inet_frag.h
+@@ -33,6 +33,13 @@ struct inet_frag_queue {
+ 
+ #define INETFRAGS_HASHSZ		64
+ 
++/* averaged:
++ * max_depth = default ipfrag_high_thresh / INETFRAGS_HASHSZ /
++ *	       rounded up (SKB_TRUELEN(0) + sizeof(struct ipq or
++ *	       struct frag_queue))
++ */
++#define INETFRAGS_MAXDEPTH		128
++
+ struct inet_frags {
+ 	struct hlist_head	hash[INETFRAGS_HASHSZ];
+ 	rwlock_t		lock;
+@@ -64,6 +71,8 @@ int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f);
+ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
+ 		struct inet_frags *f, void *key, unsigned int hash)
+ 	__releases(&f->lock);
++void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q,
++				   const char *prefix);
+ 
+ static inline void inet_frag_put(struct inet_frag_queue *q, struct inet_frags *f)
+ {
+diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
+index 10422ef..2124004 100644
+--- a/include/net/ip_fib.h
++++ b/include/net/ip_fib.h
+@@ -129,18 +129,16 @@ struct fib_result_nl {
+ };
+ 
+ #ifdef CONFIG_IP_ROUTE_MULTIPATH
+-
+ #define FIB_RES_NH(res)		((res).fi->fib_nh[(res).nh_sel])
+-
+-#define FIB_TABLE_HASHSZ 2
+-
+ #else /* CONFIG_IP_ROUTE_MULTIPATH */
+-
+ #define FIB_RES_NH(res)		((res).fi->fib_nh[0])
++#endif /* CONFIG_IP_ROUTE_MULTIPATH */
+ 
++#ifdef CONFIG_IP_MULTIPLE_TABLES
+ #define FIB_TABLE_HASHSZ 256
+-
+-#endif /* CONFIG_IP_ROUTE_MULTIPATH */
++#else
++#define FIB_TABLE_HASHSZ 2
++#endif
+ 
+ extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
+ 
+diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
+index 7a90d02..9e40370 100644
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -66,7 +66,8 @@ static void tick_broadcast_start_periodic(struct clock_event_device *bc)
+  */
+ int tick_check_broadcast_device(struct clock_event_device *dev)
+ {
+-	if ((tick_broadcast_device.evtdev &&
++	if ((dev->features & CLOCK_EVT_FEAT_DUMMY) ||
++	    (tick_broadcast_device.evtdev &&
+ 	     tick_broadcast_device.evtdev->rating >= dev->rating) ||
+ 	     (dev->features & CLOCK_EVT_FEAT_C3STOP))
+ 		return 0;
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 86fd417..b2ca34a 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2709,8 +2709,8 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
+ 					continue;
+ 			}
+ 
+-			hlist_del(&entry->node);
+-			call_rcu(&entry->rcu, ftrace_free_entry_rcu);
++			hlist_del_rcu(&entry->node);
++			call_rcu_sched(&entry->rcu, ftrace_free_entry_rcu);
+ 		}
+ 	}
+ 	__disable_ftrace_function_probe();
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 672a749..97bf540 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -649,7 +649,7 @@ __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
+ void
+ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
+ {
+-	struct ring_buffer *buf = tr->buffer;
++	struct ring_buffer *buf;
+ 
+ 	if (trace_stop_count)
+ 		return;
+@@ -661,6 +661,7 @@ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
+ 	}
+ 	arch_spin_lock(&ftrace_max_lock);
+ 
++	buf = tr->buffer;
+ 	tr->buffer = max_tr.buffer;
+ 	max_tr.buffer = buf;
+ 
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 037f077..2c56a53 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2006,8 +2006,12 @@ int hugetlb_report_node_meminfo(int nid, char *buf)
+ /* Return the number pages of memory we physically have, in PAGE_SIZE units. */
+ unsigned long hugetlb_total_pages(void)
+ {
+-	struct hstate *h = &default_hstate;
+-	return h->nr_huge_pages * pages_per_huge_page(h);
++	struct hstate *h;
++	unsigned long nr_total_pages = 0;
++
++	for_each_hstate(h)
++		nr_total_pages += h->nr_huge_pages * pages_per_huge_page(h);
++	return nr_total_pages;
+ }
+ 
+ static int hugetlb_acct_memory(struct hstate *h, long delta)
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 222312e..81c16d3 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -2011,7 +2011,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 		struct rtattr *attr = (void *)nlh + NLMSG_ALIGN(min_len);
+ 
+ 		while (RTA_OK(attr, attrlen)) {
+-			unsigned flavor = attr->rta_type;
++			unsigned int flavor = attr->rta_type & NLA_TYPE_MASK;
+ 			if (flavor) {
+ 				if (flavor > rta_max[sz_idx])
+ 					return -EINVAL;
+diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
+index 5ff2a51..210b710 100644
+--- a/net/ipv4/inet_fragment.c
++++ b/net/ipv4/inet_fragment.c
+@@ -21,6 +21,7 @@
+ #include <linux/rtnetlink.h>
+ #include <linux/slab.h>
+ 
++#include <net/sock.h>
+ #include <net/inet_frag.h>
+ 
+ static void inet_frag_secret_rebuild(unsigned long dummy)
+@@ -271,6 +272,7 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
+ {
+ 	struct inet_frag_queue *q;
+ 	struct hlist_node *n;
++	int depth = 0;
+ 
+ 	hlist_for_each_entry(q, n, &f->hash[hash], list) {
+ 		if (q->net == nf && f->match(q, key)) {
+@@ -278,9 +280,25 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
+ 			read_unlock(&f->lock);
+ 			return q;
+ 		}
++		depth++;
+ 	}
+ 	read_unlock(&f->lock);
+ 
+-	return inet_frag_create(nf, f, key);
++	if (depth <= INETFRAGS_MAXDEPTH)
++		return inet_frag_create(nf, f, key);
++	else
++		return ERR_PTR(-ENOBUFS);
+ }
+ EXPORT_SYMBOL(inet_frag_find);
++
++void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q,
++				   const char *prefix)
++{
++	static const char msg[] = "inet_frag_find: Fragment hash bucket"
++		" list length grew over limit " __stringify(INETFRAGS_MAXDEPTH)
++		". Dropping fragment.\n";
++
++	if (PTR_ERR(q) == -ENOBUFS)
++		LIMIT_NETDEBUG(KERN_WARNING "%s%s", prefix, msg);
++}
++EXPORT_SYMBOL(inet_frag_maybe_warn_overflow);
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index 0ad6035..da38472 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -20,6 +20,8 @@
+  *		Patrick McHardy :	LRU queue of frag heads for evictor.
+  */
+ 
++#define pr_fmt(fmt) "IPv4: " fmt
++
+ #include <linux/compiler.h>
+ #include <linux/module.h>
+ #include <linux/types.h>
+@@ -292,14 +294,12 @@ static inline struct ipq *ip_find(struct net *net, struct iphdr *iph, u32 user)
+ 	hash = ipqhashfn(iph->id, iph->saddr, iph->daddr, iph->protocol);
+ 
+ 	q = inet_frag_find(&net->ipv4.frags, &ip4_frags, &arg, hash);
+-	if (q == NULL)
+-		goto out_nomem;
++	if (IS_ERR_OR_NULL(q)) {
++		inet_frag_maybe_warn_overflow(q, pr_fmt());
++		return NULL;
++	}
+ 
+ 	return container_of(q, struct ipq, q);
+-
+-out_nomem:
+-	LIMIT_NETDEBUG(KERN_ERR "ip_frag_create: no memory left !\n");
+-	return NULL;
+ }
+ 
+ /* Is the fragment too far ahead to be part of ipq? */
+diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
+index 42dd1a9..40eb4fc 100644
+--- a/net/ipv4/ip_options.c
++++ b/net/ipv4/ip_options.c
+@@ -358,7 +358,6 @@ int ip_options_compile(struct net *net,
+ 				}
+ 				switch (optptr[3]&0xF) {
+ 				      case IPOPT_TS_TSONLY:
+-					opt->ts = optptr - iph;
+ 					if (skb)
+ 						timeptr = &optptr[optptr[2]-1];
+ 					opt->ts_needtime = 1;
+@@ -369,7 +368,6 @@ int ip_options_compile(struct net *net,
+ 						pp_ptr = optptr + 2;
+ 						goto error;
+ 					}
+-					opt->ts = optptr - iph;
+ 					if (rt)  {
+ 						memcpy(&optptr[optptr[2]-1], &rt->rt_spec_dst, 4);
+ 						timeptr = &optptr[optptr[2]+3];
+@@ -383,7 +381,6 @@ int ip_options_compile(struct net *net,
+ 						pp_ptr = optptr + 2;
+ 						goto error;
+ 					}
+-					opt->ts = optptr - iph;
+ 					{
+ 						__be32 addr;
+ 						memcpy(&addr, &optptr[optptr[2]-1], 4);
+@@ -416,12 +413,12 @@ int ip_options_compile(struct net *net,
+ 					pp_ptr = optptr + 3;
+ 					goto error;
+ 				}
+-				opt->ts = optptr - iph;
+ 				if (skb) {
+ 					optptr[3] = (optptr[3]&0xF)|((overflow+1)<<4);
+ 					opt->is_changed = 1;
+ 				}
+ 			}
++			opt->ts = optptr - iph;
+ 			break;
+ 		      case IPOPT_RA:
+ 			if (optlen < 4) {
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index 0857272..afc7530 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -14,6 +14,8 @@
+  * 2 of the License, or (at your option) any later version.
+  */
+ 
++#define pr_fmt(fmt) "IPv6-nf: " fmt
++
+ #include <linux/errno.h>
+ #include <linux/types.h>
+ #include <linux/string.h>
+@@ -176,14 +178,12 @@ fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst)
+ 
+ 	q = inet_frag_find(&nf_init_frags, &nf_frags, &arg, hash);
+ 	local_bh_enable();
+-	if (q == NULL)
+-		goto oom;
++	if (IS_ERR_OR_NULL(q)) {
++		inet_frag_maybe_warn_overflow(q, pr_fmt());
++		return NULL;
++	}
+ 
+ 	return container_of(q, struct nf_ct_frag6_queue, q);
+-
+-oom:
+-	pr_debug("Can't alloc new queue\n");
+-	return NULL;
+ }
+ 
+ 
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index 7b954e2..43f8fc9 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -26,6 +26,9 @@
+  *	YOSHIFUJI,H. @USAGI	Always remove fragment header to
+  *				calculate ICV correctly.
+  */
++
++#define pr_fmt(fmt) "IPv6: " fmt
++
+ #include <linux/errno.h>
+ #include <linux/types.h>
+ #include <linux/string.h>
+@@ -239,9 +242,10 @@ fq_find(struct net *net, __be32 id, const struct in6_addr *src, const struct in6
+ 	hash = inet6_hash_frag(id, src, dst, ip6_frags.rnd);
+ 
+ 	q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);
+-	if (q == NULL)
++	if (IS_ERR_OR_NULL(q)) {
++		inet_frag_maybe_warn_overflow(q, pr_fmt());
+ 		return NULL;
+-
++	}
+ 	return container_of(q, struct frag_queue, q);
+ }
+ 
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index 17a6e65..6c8c8da 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1043,7 +1043,7 @@ struct sctp_transport *sctp_assoc_lookup_tsn(struct sctp_association *asoc,
+ 			transports) {
+ 
+ 		if (transport == active)
+-			break;
++			continue;
+ 		list_for_each_entry(chunk, &transport->transmitted,
+ 				transmitted_list) {
+ 			if (key == chunk->subh.data_hdr->tsn) {
+diff --git a/security/keys/compat.c b/security/keys/compat.c
+index 338b510..10a6e4c 100644
+--- a/security/keys/compat.c
++++ b/security/keys/compat.c
+@@ -40,12 +40,12 @@ long compat_keyctl_instantiate_key_iov(
+ 					   ARRAY_SIZE(iovstack),
+ 					   iovstack, &iov);
+ 	if (ret < 0)
+-		return ret;
++		goto err;
+ 	if (ret == 0)
+ 		goto no_payload_free;
+ 
+ 	ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
+-
++err:
+ 	if (iov != iovstack)
+ 		kfree(iov);
+ 	return ret;
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index eca5191..9f9cc3a 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -1067,12 +1067,12 @@ long keyctl_instantiate_key_iov(key_serial_t id,
+ 	ret = rw_copy_check_uvector(WRITE, _payload_iov, ioc,
+ 				    ARRAY_SIZE(iovstack), iovstack, &iov);
+ 	if (ret < 0)
+-		return ret;
++		goto err;
+ 	if (ret == 0)
+ 		goto no_payload_free;
+ 
+ 	ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
+-
++err:
+ 	if (iov != iovstack)
+ 		kfree(iov);
+ 	return ret;
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 39e1a6a..7b747af 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2625,7 +2625,7 @@ static unsigned int convert_to_spdif_status(unsigned short val)
+ 	if (val & AC_DIG1_PROFESSIONAL)
+ 		sbits |= IEC958_AES0_PROFESSIONAL;
+ 	if (sbits & IEC958_AES0_PROFESSIONAL) {
+-		if (sbits & AC_DIG1_EMPHASIS)
++		if (val & AC_DIG1_EMPHASIS)
+ 			sbits |= IEC958_AES0_PRO_EMPHASIS_5015;
+ 	} else {
+ 		if (val & AC_DIG1_EMPHASIS)
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 4d68f90..0957e1c 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -711,8 +711,9 @@ static int check_input_term(struct mixer_build *state, int id, struct usb_audio_
+ 		case UAC2_CLOCK_SELECTOR: {
+ 			struct uac_selector_unit_descriptor *d = p1;
+ 			/* call recursively to retrieve the channel info */
+-			if (check_input_term(state, d->baSourceID[0], term) < 0)
+-				return -ENODEV;
++			err = check_input_term(state, d->baSourceID[0], term);
++			if (err < 0)
++				return err;
+ 			term->type = d->bDescriptorSubtype << 16; /* virtual type */
+ 			term->id = id;
+ 			term->name = uac_selector_unit_iSelector(d);
+@@ -1262,8 +1263,9 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void
+ 		return err;
+ 
+ 	/* determine the input source type and name */
+-	if (check_input_term(state, hdr->bSourceID, &iterm) < 0)
+-		return -EINVAL;
++	err = check_input_term(state, hdr->bSourceID, &iterm);
++	if (err < 0)
++		return err;
+ 
+ 	master_bits = snd_usb_combine_bytes(bmaControls, csize);
+ 	/* master configuration quirks */
+@@ -2024,7 +2026,7 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
+ 			state.oterm.type = le16_to_cpu(desc->wTerminalType);
+ 			state.oterm.name = desc->iTerminal;
+ 			err = parse_audio_unit(&state, desc->bSourceID);
+-			if (err < 0)
++			if (err < 0 && err != -EINVAL)
+ 				return err;
+ 		} else { /* UAC_VERSION_2 */
+ 			struct uac2_output_terminal_descriptor *desc = p;
+@@ -2036,12 +2038,12 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
+ 			state.oterm.type = le16_to_cpu(desc->wTerminalType);
+ 			state.oterm.name = desc->iTerminal;
+ 			err = parse_audio_unit(&state, desc->bSourceID);
+-			if (err < 0)
++			if (err < 0 && err != -EINVAL)
+ 				return err;
+ 
+ 			/* for UAC2, use the same approach to also add the clock selectors */
+ 			err = parse_audio_unit(&state, desc->bCSourceID);
+-			if (err < 0)
++			if (err < 0 && err != -EINVAL)
+ 				return err;
+ 		}
+ 	}

Modified: genpatches-2.6/trunk/3.2/0000_README
===================================================================
--- genpatches-2.6/trunk/3.2/0000_README	2013-03-30 11:08:52 UTC (rev 2326)
+++ genpatches-2.6/trunk/3.2/0000_README	2013-03-31 21:28:05 UTC (rev 2327)
@@ -204,6 +204,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.2.41
 
+Patch:  1041_linux-3.2.42.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.2.42
+
 Patch:  2300_per-pci-device-msi-irq-listing.patch
 From:   http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=da8d1c8ba4dcb16d60be54b233deca9a7cac98dc
 Desc:   Add a per-pci-device subdirectory in sysfs

Added: genpatches-2.6/trunk/3.2/1041_linux-3.2.42.patch
===================================================================
--- genpatches-2.6/trunk/3.2/1041_linux-3.2.42.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.2/1041_linux-3.2.42.patch	2013-03-31 21:28:05 UTC (rev 2327)
@@ -0,0 +1,3602 @@
+diff --git a/Makefile b/Makefile
+index 95e6220..d44f009 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 41
++SUBLEVEL = 42
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/include/asm/signal.h b/arch/arm/include/asm/signal.h
+index 43ba0fb..559ee24 100644
+--- a/arch/arm/include/asm/signal.h
++++ b/arch/arm/include/asm/signal.h
+@@ -127,6 +127,7 @@ struct sigaction {
+ 	__sigrestore_t sa_restorer;
+ 	sigset_t sa_mask;		/* mask last for extensibility */
+ };
++#define __ARCH_HAS_SA_RESTORER
+ 
+ struct k_sigaction {
+ 	struct sigaction sa;
+diff --git a/arch/avr32/include/asm/signal.h b/arch/avr32/include/asm/signal.h
+index 8790dfc..e6952a0 100644
+--- a/arch/avr32/include/asm/signal.h
++++ b/arch/avr32/include/asm/signal.h
+@@ -128,6 +128,7 @@ struct sigaction {
+ 	__sigrestore_t sa_restorer;
+ 	sigset_t sa_mask;		/* mask last for extensibility */
+ };
++#define __ARCH_HAS_SA_RESTORER
+ 
+ struct k_sigaction {
+ 	struct sigaction sa;
+diff --git a/arch/cris/include/asm/signal.h b/arch/cris/include/asm/signal.h
+index ea6af9a..057fea2 100644
+--- a/arch/cris/include/asm/signal.h
++++ b/arch/cris/include/asm/signal.h
+@@ -122,6 +122,7 @@ struct sigaction {
+ 	void (*sa_restorer)(void);
+ 	sigset_t sa_mask;		/* mask last for extensibility */
+ };
++#define __ARCH_HAS_SA_RESTORER
+ 
+ struct k_sigaction {
+ 	struct sigaction sa;
+diff --git a/arch/h8300/include/asm/signal.h b/arch/h8300/include/asm/signal.h
+index fd8b66e..8695707 100644
+--- a/arch/h8300/include/asm/signal.h
++++ b/arch/h8300/include/asm/signal.h
+@@ -121,6 +121,7 @@ struct sigaction {
+ 	void (*sa_restorer)(void);
+ 	sigset_t sa_mask;		/* mask last for extensibility */
+ };
++#define __ARCH_HAS_SA_RESTORER
+ 
+ struct k_sigaction {
+ 	struct sigaction sa;
+diff --git a/arch/m32r/include/asm/signal.h b/arch/m32r/include/asm/signal.h
+index b2eeb0d..802d561 100644
+--- a/arch/m32r/include/asm/signal.h
++++ b/arch/m32r/include/asm/signal.h
+@@ -123,6 +123,7 @@ struct sigaction {
+ 	__sigrestore_t sa_restorer;
+ 	sigset_t sa_mask;		/* mask last for extensibility */
+ };
++#define __ARCH_HAS_SA_RESTORER
+ 
+ struct k_sigaction {
+ 	struct sigaction sa;
+diff --git a/arch/m68k/include/asm/signal.h b/arch/m68k/include/asm/signal.h
+index 93fe83e..a20ae63 100644
+--- a/arch/m68k/include/asm/signal.h
++++ b/arch/m68k/include/asm/signal.h
+@@ -119,6 +119,7 @@ struct sigaction {
+ 	__sigrestore_t sa_restorer;
+ 	sigset_t sa_mask;		/* mask last for extensibility */
+ };
++#define __ARCH_HAS_SA_RESTORER
+ 
+ struct k_sigaction {
+ 	struct sigaction sa;
+diff --git a/arch/mn10300/include/asm/signal.h b/arch/mn10300/include/asm/signal.h
+index 1865d72..eecaa76 100644
+--- a/arch/mn10300/include/asm/signal.h
++++ b/arch/mn10300/include/asm/signal.h
+@@ -131,6 +131,7 @@ struct sigaction {
+ 	__sigrestore_t sa_restorer;
+ 	sigset_t sa_mask;		/* mask last for extensibility */
+ };
++#define __ARCH_HAS_SA_RESTORER
+ 
+ struct k_sigaction {
+ 	struct sigaction sa;
+diff --git a/arch/powerpc/include/asm/signal.h b/arch/powerpc/include/asm/signal.h
+index 3eb13be..ec63a0a 100644
+--- a/arch/powerpc/include/asm/signal.h
++++ b/arch/powerpc/include/asm/signal.h
+@@ -109,6 +109,7 @@ struct sigaction {
+ 	__sigrestore_t sa_restorer;
+ 	sigset_t sa_mask;		/* mask last for extensibility */
+ };
++#define __ARCH_HAS_SA_RESTORER
+ 
+ struct k_sigaction {
+ 	struct sigaction sa;
+diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
+index edae5bb..b92b756 100644
+--- a/arch/powerpc/kernel/cputable.c
++++ b/arch/powerpc/kernel/cputable.c
+@@ -268,7 +268,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ 		.cpu_features		= CPU_FTRS_PPC970,
+ 		.cpu_user_features	= COMMON_USER_POWER4 |
+ 			PPC_FEATURE_HAS_ALTIVEC_COMP,
+-		.mmu_features		= MMU_FTR_HPTE_TABLE,
++		.mmu_features		= MMU_FTRS_PPC970,
+ 		.icache_bsize		= 128,
+ 		.dcache_bsize		= 128,
+ 		.num_pmcs		= 8,
+diff --git a/arch/s390/include/asm/signal.h b/arch/s390/include/asm/signal.h
+index cdf5cb2..c872626 100644
+--- a/arch/s390/include/asm/signal.h
++++ b/arch/s390/include/asm/signal.h
+@@ -131,6 +131,7 @@ struct sigaction {
+         void (*sa_restorer)(void);
+         sigset_t sa_mask;               /* mask last for extensibility */
+ };
++#define __ARCH_HAS_SA_RESTORER
+ 
+ struct k_sigaction {
+         struct sigaction sa;
+diff --git a/arch/s390/include/asm/tlbflush.h b/arch/s390/include/asm/tlbflush.h
+index 1d8648c..8743029 100644
+--- a/arch/s390/include/asm/tlbflush.h
++++ b/arch/s390/include/asm/tlbflush.h
+@@ -74,8 +74,6 @@ static inline void __tlb_flush_idte(unsigned long asce)
+ 
+ static inline void __tlb_flush_mm(struct mm_struct * mm)
+ {
+-	if (unlikely(cpumask_empty(mm_cpumask(mm))))
+-		return;
+ 	/*
+ 	 * If the machine has IDTE we prefer to do a per mm flush
+ 	 * on all cpus instead of doing a local flush if the mm
+diff --git a/arch/sparc/include/asm/signal.h b/arch/sparc/include/asm/signal.h
+index e49b828..4929431 100644
+--- a/arch/sparc/include/asm/signal.h
++++ b/arch/sparc/include/asm/signal.h
+@@ -191,6 +191,7 @@ struct __old_sigaction {
+ 	unsigned long		sa_flags;
+ 	void			(*sa_restorer)(void);  /* not used by Linux/SPARC yet */
+ };
++#define __ARCH_HAS_SA_RESTORER
+ 
+ typedef struct sigaltstack {
+ 	void			__user *ss_sp;
+diff --git a/arch/x86/include/asm/signal.h b/arch/x86/include/asm/signal.h
+index 598457c..6cbc795 100644
+--- a/arch/x86/include/asm/signal.h
++++ b/arch/x86/include/asm/signal.h
+@@ -125,6 +125,8 @@ typedef unsigned long sigset_t;
+ extern void do_notify_resume(struct pt_regs *, void *, __u32);
+ # endif /* __KERNEL__ */
+ 
++#define __ARCH_HAS_SA_RESTORER
++
+ #ifdef __i386__
+ # ifdef __KERNEL__
+ struct old_sigaction {
+diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
+index 73da6b6..2d4e76b 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
+@@ -736,3 +736,13 @@ void intel_ds_init(void)
+ 		}
+ 	}
+ }
++
++void perf_restore_debug_store(void)
++{
++	struct debug_store *ds = __this_cpu_read(cpu_hw_events.ds);
++
++	if (!x86_pmu.bts && !x86_pmu.pebs)
++		return;
++
++	wrmsrl(MSR_IA32_DS_AREA, (unsigned long)ds);
++}
+diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
+index b7c2849..554b7b5 100644
+--- a/arch/x86/lib/usercopy_64.c
++++ b/arch/x86/lib/usercopy_64.c
+@@ -169,10 +169,10 @@ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
+ 	char c;
+ 	unsigned zero_len;
+ 
+-	for (; len; --len) {
++	for (; len; --len, to++) {
+ 		if (__get_user_nocheck(c, from++, sizeof(char)))
+ 			break;
+-		if (__put_user_nocheck(c, to++, sizeof(char)))
++		if (__put_user_nocheck(c, to, sizeof(char)))
+ 			break;
+ 	}
+ 
+diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
+index f10c0af..43c9f6a 100644
+--- a/arch/x86/power/cpu.c
++++ b/arch/x86/power/cpu.c
+@@ -11,6 +11,7 @@
+ #include <linux/suspend.h>
+ #include <linux/export.h>
+ #include <linux/smp.h>
++#include <linux/perf_event.h>
+ 
+ #include <asm/pgtable.h>
+ #include <asm/proto.h>
+@@ -225,6 +226,7 @@ static void __restore_processor_state(struct saved_context *ctxt)
+ 
+ 	do_fpu_end();
+ 	mtrr_bp_restore();
++	perf_restore_debug_store();
+ }
+ 
+ /* Needed by apm.c */
+diff --git a/arch/xtensa/include/asm/signal.h b/arch/xtensa/include/asm/signal.h
+index 633ba73..75edf8a 100644
+--- a/arch/xtensa/include/asm/signal.h
++++ b/arch/xtensa/include/asm/signal.h
+@@ -133,6 +133,7 @@ struct sigaction {
+ 	void (*sa_restorer)(void);
+ 	sigset_t sa_mask;		/* mask last for extensibility */
+ };
++#define __ARCH_HAS_SA_RESTORER
+ 
+ struct k_sigaction {
+ 	struct sigaction sa;
+diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
+index efba163..bf4d6e2 100644
+--- a/drivers/firmware/Kconfig
++++ b/drivers/firmware/Kconfig
+@@ -53,6 +53,24 @@ config EFI_VARS
+ 	  Subsequent efibootmgr releases may be found at:
+ 	  <http://linux.dell.com/efibootmgr>
+ 
++config EFI_VARS_PSTORE
++	bool "Register efivars backend for pstore"
++	depends on EFI_VARS && PSTORE
++	default y
++	help
++	  Say Y here to enable use efivars as a backend to pstore. This
++	  will allow writing console messages, crash dumps, or anything
++	  else supported by pstore to EFI variables.
++
++config EFI_VARS_PSTORE_DEFAULT_DISABLE
++	bool "Disable using efivars as a pstore backend by default"
++	depends on EFI_VARS_PSTORE
++	default n
++	help
++	  Saying Y here will disable the use of efivars as a storage
++	  backend for pstore by default. This setting can be overridden
++	  using the efivars module's pstore_disable parameter.
++
+ config EFI_PCDP
+ 	bool "Console device selection via EFI PCDP or HCDP table"
+ 	depends on ACPI && EFI && IA64
+diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
+index 81346ae..b15c0aa 100644
+--- a/drivers/firmware/efivars.c
++++ b/drivers/firmware/efivars.c
+@@ -92,6 +92,11 @@ MODULE_VERSION(EFIVARS_VERSION);
+ 
+ #define DUMP_NAME_LEN 52
+ 
++static bool efivars_pstore_disable =
++	IS_ENABLED(CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE);
++
++module_param_named(pstore_disable, efivars_pstore_disable, bool, 0644);
++
+ /*
+  * The maximum size of VariableName + Data = 1024
+  * Therefore, it's reasonable to save that much
+@@ -122,6 +127,8 @@ struct efivar_attribute {
+ 	ssize_t (*store)(struct efivar_entry *entry, const char *buf, size_t count);
+ };
+ 
++static struct efivars __efivars;
++
+ #define PSTORE_EFI_ATTRIBUTES \
+ 	(EFI_VARIABLE_NON_VOLATILE | \
+ 	 EFI_VARIABLE_BOOTSERVICE_ACCESS | \
+@@ -146,6 +153,14 @@ efivar_create_sysfs_entry(struct efivars *efivars,
+ 			  efi_char16_t *variable_name,
+ 			  efi_guid_t *vendor_guid);
+ 
++/*
++ * Prototype for workqueue functions updating sysfs entry
++ */
++
++static void efivar_update_sysfs_entries(struct work_struct *);
++static DECLARE_WORK(efivar_work, efivar_update_sysfs_entries);
++static bool efivar_wq_enabled = true;
++
+ /* Return the number of unicode characters in data */
+ static unsigned long
+ utf16_strnlen(efi_char16_t *s, size_t maxlength)
+@@ -659,8 +674,6 @@ static struct kobj_type efivar_ktype = {
+ 	.default_attrs = def_attrs,
+ };
+ 
+-static struct pstore_info efi_pstore_info;
+-
+ static inline void
+ efivar_unregister(struct efivar_entry *var)
+ {
+@@ -697,7 +710,7 @@ static int efi_status_to_err(efi_status_t status)
+ 	return err;
+ }
+ 
+-#ifdef CONFIG_PSTORE
++#ifdef CONFIG_EFI_VARS_PSTORE
+ 
+ static int efi_pstore_open(struct pstore_info *psi)
+ {
+@@ -774,19 +787,21 @@ static int efi_pstore_write(enum pstore_type_id type, u64 *id,
+ 
+ 	spin_lock_irqsave(&efivars->lock, flags);
+ 
+-	/*
+-	 * Check if there is a space enough to log.
+-	 * size: a size of logging data
+-	 * DUMP_NAME_LEN * 2: a maximum size of variable name
+-	 */
++	if (size) {
++		/*
++		 * Check if there is a space enough to log.
++		 * size: a size of logging data
++		 * DUMP_NAME_LEN * 2: a maximum size of variable name
++		 */
+ 
+-	status = check_var_size_locked(efivars, PSTORE_EFI_ATTRIBUTES,
+-					 size + DUMP_NAME_LEN * 2);
++		status = check_var_size_locked(efivars, PSTORE_EFI_ATTRIBUTES,
++					       size + DUMP_NAME_LEN * 2);
+ 
+-	if (status) {
+-		spin_unlock_irqrestore(&efivars->lock, flags);
+-		*id = part;
+-		return -ENOSPC;
++		if (status) {
++			spin_unlock_irqrestore(&efivars->lock, flags);
++			*id = part;
++			return -ENOSPC;
++		}
+ 	}
+ 
+ 	for (i = 0; i < DUMP_NAME_LEN; i++)
+@@ -830,11 +845,8 @@ static int efi_pstore_write(enum pstore_type_id type, u64 *id,
+ 	if (found)
+ 		efivar_unregister(found);
+ 
+-	if (size)
+-		ret = efivar_create_sysfs_entry(efivars,
+-					  utf16_strsize(efi_name,
+-							DUMP_NAME_LEN * 2),
+-					  efi_name, &vendor);
++	if (efivar_wq_enabled)
++		schedule_work(&efivar_work);
+ 
+ 	*id = part;
+ 	return ret;
+@@ -847,36 +859,6 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id,
+ 
+ 	return 0;
+ }
+-#else
+-static int efi_pstore_open(struct pstore_info *psi)
+-{
+-	return 0;
+-}
+-
+-static int efi_pstore_close(struct pstore_info *psi)
+-{
+-	return 0;
+-}
+-
+-static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
+-			       struct timespec *timespec,
+-			       char **buf, struct pstore_info *psi)
+-{
+-	return -1;
+-}
+-
+-static int efi_pstore_write(enum pstore_type_id type, u64 *id,
+-		unsigned int part, size_t size, struct pstore_info *psi)
+-{
+-	return 0;
+-}
+-
+-static int efi_pstore_erase(enum pstore_type_id type, u64 id,
+-			    struct pstore_info *psi)
+-{
+-	return 0;
+-}
+-#endif
+ 
+ static struct pstore_info efi_pstore_info = {
+ 	.owner		= THIS_MODULE,
+@@ -888,6 +870,24 @@ static struct pstore_info efi_pstore_info = {
+ 	.erase		= efi_pstore_erase,
+ };
+ 
++static void efivar_pstore_register(struct efivars *efivars)
++{
++	efivars->efi_pstore_info = efi_pstore_info;
++	efivars->efi_pstore_info.buf = kmalloc(4096, GFP_KERNEL);
++	if (efivars->efi_pstore_info.buf) {
++		efivars->efi_pstore_info.bufsize = 1024;
++		efivars->efi_pstore_info.data = efivars;
++		spin_lock_init(&efivars->efi_pstore_info.buf_lock);
++		pstore_register(&efivars->efi_pstore_info);
++	}
++}
++#else
++static void efivar_pstore_register(struct efivars *efivars)
++{
++	return;
++}
++#endif
++
+ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
+ 			     struct bin_attribute *bin_attr,
+ 			     char *buf, loff_t pos, size_t count)
+@@ -1025,6 +1025,103 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
+ 	return count;
+ }
+ 
++static bool variable_is_present(efi_char16_t *variable_name, efi_guid_t *vendor)
++{
++	struct efivar_entry *entry, *n;
++	struct efivars *efivars = &__efivars;
++	unsigned long strsize1, strsize2;
++	bool found = false;
++
++	strsize1 = utf16_strsize(variable_name, 1024);
++	list_for_each_entry_safe(entry, n, &efivars->list, list) {
++		strsize2 = utf16_strsize(entry->var.VariableName, 1024);
++		if (strsize1 == strsize2 &&
++			!memcmp(variable_name, &(entry->var.VariableName),
++				strsize2) &&
++			!efi_guidcmp(entry->var.VendorGuid,
++				*vendor)) {
++			found = true;
++			break;
++		}
++	}
++	return found;
++}
++
++/*
++ * Returns the size of variable_name, in bytes, including the
++ * terminating NULL character, or variable_name_size if no NULL
++ * character is found among the first variable_name_size bytes.
++ */
++static unsigned long var_name_strnsize(efi_char16_t *variable_name,
++				       unsigned long variable_name_size)
++{
++	unsigned long len;
++	efi_char16_t c;
++
++	/*
++	 * The variable name is, by definition, a NULL-terminated
++	 * string, so make absolutely sure that variable_name_size is
++	 * the value we expect it to be. If not, return the real size.
++	 */
++	for (len = 2; len <= variable_name_size; len += sizeof(c)) {
++		c = variable_name[(len / sizeof(c)) - 1];
++		if (!c)
++			break;
++	}
++
++	return min(len, variable_name_size);
++}
++
++static void efivar_update_sysfs_entries(struct work_struct *work)
++{
++	struct efivars *efivars = &__efivars;
++	efi_guid_t vendor;
++	efi_char16_t *variable_name;
++	unsigned long variable_name_size = 1024;
++	efi_status_t status = EFI_NOT_FOUND;
++	bool found;
++
++	/* Add new sysfs entries */
++	while (1) {
++		variable_name = kzalloc(variable_name_size, GFP_KERNEL);
++		if (!variable_name) {
++			pr_err("efivars: Memory allocation failed.\n");
++			return;
++		}
++
++		spin_lock_irq(&efivars->lock);
++		found = false;
++		while (1) {
++			variable_name_size = 1024;
++			status = efivars->ops->get_next_variable(
++							&variable_name_size,
++							variable_name,
++							&vendor);
++			if (status != EFI_SUCCESS) {
++				break;
++			} else {
++				if (!variable_is_present(variable_name,
++				    &vendor)) {
++					found = true;
++					break;
++				}
++			}
++		}
++		spin_unlock_irq(&efivars->lock);
++
++		if (!found) {
++			kfree(variable_name);
++			break;
++		} else {
++			variable_name_size = var_name_strnsize(variable_name,
++							       variable_name_size);
++			efivar_create_sysfs_entry(efivars,
++						  variable_name_size,
++						  variable_name, &vendor);
++		}
++	}
++}
++
+ /*
+  * Let's not leave out systab information that snuck into
+  * the efivars driver
+@@ -1212,6 +1309,35 @@ void unregister_efivars(struct efivars *efivars)
+ }
+ EXPORT_SYMBOL_GPL(unregister_efivars);
+ 
++/*
++ * Print a warning when duplicate EFI variables are encountered and
++ * disable the sysfs workqueue since the firmware is buggy.
++ */
++static void dup_variable_bug(efi_char16_t *s16, efi_guid_t *vendor_guid,
++			     unsigned long len16)
++{
++	size_t i, len8 = len16 / sizeof(efi_char16_t);
++	char *s8;
++
++	/*
++	 * Disable the workqueue since the algorithm it uses for
++	 * detecting new variables won't work with this buggy
++	 * implementation of GetNextVariableName().
++	 */
++	efivar_wq_enabled = false;
++
++	s8 = kzalloc(len8, GFP_KERNEL);
++	if (!s8)
++		return;
++
++	for (i = 0; i < len8; i++)
++		s8[i] = s16[i];
++
++	printk(KERN_WARNING "efivars: duplicate variable: %s-%pUl\n",
++	       s8, vendor_guid);
++	kfree(s8);
++}
++
+ int register_efivars(struct efivars *efivars,
+ 		     const struct efivar_operations *ops,
+ 		     struct kobject *parent_kobj)
+@@ -1252,6 +1378,24 @@ int register_efivars(struct efivars *efivars,
+ 						&vendor_guid);
+ 		switch (status) {
+ 		case EFI_SUCCESS:
++			variable_name_size = var_name_strnsize(variable_name,
++							       variable_name_size);
++
++			/*
++			 * Some firmware implementations return the
++			 * same variable name on multiple calls to
++			 * get_next_variable(). Terminate the loop
++			 * immediately as there is no guarantee that
++			 * we'll ever see a different variable name,
++			 * and may end up looping here forever.
++			 */
++			if (variable_is_present(variable_name, &vendor_guid)) {
++				dup_variable_bug(variable_name, &vendor_guid,
++						 variable_name_size);
++				status = EFI_NOT_FOUND;
++				break;
++			}
++
+ 			efivar_create_sysfs_entry(efivars,
+ 						  variable_name_size,
+ 						  variable_name,
+@@ -1271,15 +1415,8 @@ int register_efivars(struct efivars *efivars,
+ 	if (error)
+ 		unregister_efivars(efivars);
+ 
+-	efivars->efi_pstore_info = efi_pstore_info;
+-
+-	efivars->efi_pstore_info.buf = kmalloc(4096, GFP_KERNEL);
+-	if (efivars->efi_pstore_info.buf) {
+-		efivars->efi_pstore_info.bufsize = 1024;
+-		efivars->efi_pstore_info.data = efivars;
+-		spin_lock_init(&efivars->efi_pstore_info.buf_lock);
+-		pstore_register(&efivars->efi_pstore_info);
+-	}
++	if (!efivars_pstore_disable)
++		efivar_pstore_register(efivars);
+ 
+ out:
+ 	kfree(variable_name);
+@@ -1288,7 +1425,6 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(register_efivars);
+ 
+-static struct efivars __efivars;
+ static struct efivar_operations ops;
+ 
+ /*
+@@ -1346,6 +1482,8 @@ err_put:
+ static void __exit
+ efivars_exit(void)
+ {
++	cancel_work_sync(&efivar_work);
++
+ 	if (efi_enabled(EFI_RUNTIME_SERVICES)) {
+ 		unregister_efivars(&__efivars);
+ 		kobject_put(efi_kobj);
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 9080eb7..7211f67 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -852,7 +852,7 @@ static struct drm_display_mode *drm_mode_detailed(struct drm_device *dev,
+ 	unsigned vblank = (pt->vactive_vblank_hi & 0xf) << 8 | pt->vblank_lo;
+ 	unsigned hsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc0) << 2 | pt->hsync_offset_lo;
+ 	unsigned hsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 0x30) << 4 | pt->hsync_pulse_width_lo;
+-	unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) >> 2 | pt->vsync_offset_pulse_width_lo >> 4;
++	unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) << 2 | pt->vsync_offset_pulse_width_lo >> 4;
+ 	unsigned vsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 0x3) << 4 | (pt->vsync_offset_pulse_width_lo & 0xf);
+ 
+ 	/* ignore tiny modes */
+@@ -933,6 +933,7 @@ set_size:
+ 	}
+ 
+ 	mode->type = DRM_MODE_TYPE_DRIVER;
++	mode->vrefresh = drm_mode_vrefresh(mode);
+ 	drm_mode_set_name(mode);
+ 
+ 	return mode;
+diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
+index 5620192..9b4e5c6 100644
+--- a/drivers/gpu/drm/i915/i915_debugfs.c
++++ b/drivers/gpu/drm/i915/i915_debugfs.c
+@@ -122,7 +122,7 @@ static const char *cache_level_str(int type)
+ static void
+ describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
+ {
+-	seq_printf(m, "%p: %s%s %8zd %04x %04x %d %d%s%s%s",
++	seq_printf(m, "%pK: %s%s %8zd %04x %04x %d %d%s%s%s",
+ 		   &obj->base,
+ 		   get_pin_flag(obj),
+ 		   get_tiling_flag(obj),
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index 878b989..b1bb734 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -907,15 +907,20 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
+ 		   int count)
+ {
+ 	int i;
++	int relocs_total = 0;
++	int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
+ 
+ 	for (i = 0; i < count; i++) {
+ 		char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
+ 		int length; /* limited by fault_in_pages_readable() */
+ 
+-		/* First check for malicious input causing overflow */
+-		if (exec[i].relocation_count >
+-		    INT_MAX / sizeof(struct drm_i915_gem_relocation_entry))
++		/* First check for malicious input causing overflow in
++		 * the worst case where we need to allocate the entire
++		 * relocation tree as a single array.
++		 */
++		if (exec[i].relocation_count > relocs_max - relocs_total)
+ 			return -EINVAL;
++		relocs_total += exec[i].relocation_count;
+ 
+ 		length = exec[i].relocation_count *
+ 			sizeof(struct drm_i915_gem_relocation_entry);
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 4591582..17961df 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -8059,7 +8059,7 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv)
+ 	I915_WRITE(GEN6_RC_SLEEP, 0);
+ 	I915_WRITE(GEN6_RC1e_THRESHOLD, 1000);
+ 	I915_WRITE(GEN6_RC6_THRESHOLD, 50000);
+-	I915_WRITE(GEN6_RC6p_THRESHOLD, 100000);
++	I915_WRITE(GEN6_RC6p_THRESHOLD, 150000);
+ 	I915_WRITE(GEN6_RC6pp_THRESHOLD, 64000); /* unused */
+ 
+ 	if (intel_enable_rc6(dev_priv->dev))
+diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
+index 289140b..cffb007 100644
+--- a/drivers/gpu/drm/i915/intel_opregion.c
++++ b/drivers/gpu/drm/i915/intel_opregion.c
+@@ -419,6 +419,25 @@ blind_set:
+ 	goto end;
+ }
+ 
++static void intel_setup_cadls(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++	struct intel_opregion *opregion = &dev_priv->opregion;
++	int i = 0;
++	u32 disp_id;
++
++	/* Initialize the CADL field by duplicating the DIDL values.
++	 * Technically, this is not always correct as display outputs may exist,
++	 * but not active. This initialization is necessary for some Clevo
++	 * laptops that check this field before processing the brightness and
++	 * display switching hotkeys. Just like DIDL, CADL is NULL-terminated if
++	 * there are less than eight devices. */
++	do {
++		disp_id = ioread32(&opregion->acpi->didl[i]);
++		iowrite32(disp_id, &opregion->acpi->cadl[i]);
++	} while (++i < 8 && disp_id != 0);
++}
++
+ void intel_opregion_init(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -428,8 +447,10 @@ void intel_opregion_init(struct drm_device *dev)
+ 		return;
+ 
+ 	if (opregion->acpi) {
+-		if (drm_core_check_feature(dev, DRIVER_MODESET))
++		if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+ 			intel_didl_outputs(dev);
++			intel_setup_cadls(dev);
++		}
+ 
+ 		/* Notify BIOS we are ready to handle ACPI video ext notifs.
+ 		 * Right now, all the events are handled by the ACPI video module.
+diff --git a/drivers/gpu/drm/radeon/radeon_benchmark.c b/drivers/gpu/drm/radeon/radeon_benchmark.c
+index 17e1a9b..441de38 100644
+--- a/drivers/gpu/drm/radeon/radeon_benchmark.c
++++ b/drivers/gpu/drm/radeon/radeon_benchmark.c
+@@ -139,13 +139,15 @@ static void radeon_benchmark_move(struct radeon_device *rdev, unsigned size,
+ 						     sdomain, ddomain, "dma");
+ 	}
+ 
+-	time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
+-					RADEON_BENCHMARK_COPY_BLIT, n);
+-	if (time < 0)
+-		goto out_cleanup;
+-	if (time > 0)
+-		radeon_benchmark_log_results(n, size, time,
+-					     sdomain, ddomain, "blit");
++	if (rdev->asic->copy_blit) {
++		time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
++						RADEON_BENCHMARK_COPY_BLIT, n);
++		if (time < 0)
++			goto out_cleanup;
++		if (time > 0)
++			radeon_benchmark_log_results(n, size, time,
++						     sdomain, ddomain, "blit");
++	}
+ 
+ out_cleanup:
+ 	if (sobj) {
+diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
+index 3d7885a..3056ea4 100644
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -341,7 +341,11 @@ static int tegra_i2c_init(struct tegra_i2c_dev *i2c_dev)
+ 	u32 val;
+ 	int err = 0;
+ 
+-	clk_enable(i2c_dev->clk);
++	err = clk_enable(i2c_dev->clk);
++	if (err < 0) {
++		dev_err(i2c_dev->dev, "Clock enable failed %d\n", err);
++		return err;
++	}
+ 
+ 	tegra_periph_reset_assert(i2c_dev->clk);
+ 	udelay(2);
+@@ -536,7 +540,12 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
+ 	if (i2c_dev->is_suspended)
+ 		return -EBUSY;
+ 
+-	clk_enable(i2c_dev->clk);
++	ret = clk_enable(i2c_dev->clk);
++	if (ret < 0) {
++		dev_err(i2c_dev->dev, "Clock enable failed %d\n", ret);
++		return ret;
++	}
++
+ 	for (i = 0; i < num; i++) {
+ 		int stop = (i == (num - 1)) ? 1  : 0;
+ 		ret = tegra_i2c_xfer_msg(i2c_dev, &msgs[i], stop);
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index da4d299..2c9dd2c 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2212,7 +2212,7 @@ static struct target_type pool_target = {
+ 	.name = "thin-pool",
+ 	.features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
+ 		    DM_TARGET_IMMUTABLE,
+-	.version = {1, 0, 1},
++	.version = {1, 0, 2},
+ 	.module = THIS_MODULE,
+ 	.ctr = pool_ctr,
+ 	.dtr = pool_dtr,
+@@ -2428,7 +2428,7 @@ static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
+ 
+ static struct target_type thin_target = {
+ 	.name = "thin",
+-	.version = {1, 0, 1},
++	.version = {1, 0, 2},
+ 	.module	= THIS_MODULE,
+ 	.ctr = thin_ctr,
+ 	.dtr = thin_dtr,
+diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
+index e6cdfde..1de0f5f 100644
+--- a/drivers/md/persistent-data/dm-btree-remove.c
++++ b/drivers/md/persistent-data/dm-btree-remove.c
+@@ -139,15 +139,8 @@ struct child {
+ 	struct btree_node *n;
+ };
+ 
+-static struct dm_btree_value_type le64_type = {
+-	.context = NULL,
+-	.size = sizeof(__le64),
+-	.inc = NULL,
+-	.dec = NULL,
+-	.equal = NULL
+-};
+-
+-static int init_child(struct dm_btree_info *info, struct btree_node *parent,
++static int init_child(struct dm_btree_info *info, struct dm_btree_value_type *vt,
++		      struct btree_node *parent,
+ 		      unsigned index, struct child *result)
+ {
+ 	int r, inc;
+@@ -164,7 +157,7 @@ static int init_child(struct dm_btree_info *info, struct btree_node *parent,
+ 	result->n = dm_block_data(result->block);
+ 
+ 	if (inc)
+-		inc_children(info->tm, result->n, &le64_type);
++		inc_children(info->tm, result->n, vt);
+ 
+ 	*((__le64 *) value_ptr(parent, index, sizeof(__le64))) =
+ 		cpu_to_le64(dm_block_location(result->block));
+@@ -236,7 +229,7 @@ static void __rebalance2(struct dm_btree_info *info, struct btree_node *parent,
+ }
+ 
+ static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info,
+-		      unsigned left_index)
++		      struct dm_btree_value_type *vt, unsigned left_index)
+ {
+ 	int r;
+ 	struct btree_node *parent;
+@@ -244,11 +237,11 @@ static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info,
+ 
+ 	parent = dm_block_data(shadow_current(s));
+ 
+-	r = init_child(info, parent, left_index, &left);
++	r = init_child(info, vt, parent, left_index, &left);
+ 	if (r)
+ 		return r;
+ 
+-	r = init_child(info, parent, left_index + 1, &right);
++	r = init_child(info, vt, parent, left_index + 1, &right);
+ 	if (r) {
+ 		exit_child(info, &left);
+ 		return r;
+@@ -368,7 +361,7 @@ static void __rebalance3(struct dm_btree_info *info, struct btree_node *parent,
+ }
+ 
+ static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info,
+-		      unsigned left_index)
++		      struct dm_btree_value_type *vt, unsigned left_index)
+ {
+ 	int r;
+ 	struct btree_node *parent = dm_block_data(shadow_current(s));
+@@ -377,17 +370,17 @@ static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info,
+ 	/*
+ 	 * FIXME: fill out an array?
+ 	 */
+-	r = init_child(info, parent, left_index, &left);
++	r = init_child(info, vt, parent, left_index, &left);
+ 	if (r)
+ 		return r;
+ 
+-	r = init_child(info, parent, left_index + 1, &center);
++	r = init_child(info, vt, parent, left_index + 1, &center);
+ 	if (r) {
+ 		exit_child(info, &left);
+ 		return r;
+ 	}
+ 
+-	r = init_child(info, parent, left_index + 2, &right);
++	r = init_child(info, vt, parent, left_index + 2, &right);
+ 	if (r) {
+ 		exit_child(info, &left);
+ 		exit_child(info, &center);
+@@ -434,7 +427,8 @@ static int get_nr_entries(struct dm_transaction_manager *tm,
+ }
+ 
+ static int rebalance_children(struct shadow_spine *s,
+-			      struct dm_btree_info *info, uint64_t key)
++			      struct dm_btree_info *info,
++			      struct dm_btree_value_type *vt, uint64_t key)
+ {
+ 	int i, r, has_left_sibling, has_right_sibling;
+ 	uint32_t child_entries;
+@@ -472,13 +466,13 @@ static int rebalance_children(struct shadow_spine *s,
+ 	has_right_sibling = i < (le32_to_cpu(n->header.nr_entries) - 1);
+ 
+ 	if (!has_left_sibling)
+-		r = rebalance2(s, info, i);
++		r = rebalance2(s, info, vt, i);
+ 
+ 	else if (!has_right_sibling)
+-		r = rebalance2(s, info, i - 1);
++		r = rebalance2(s, info, vt, i - 1);
+ 
+ 	else
+-		r = rebalance3(s, info, i - 1);
++		r = rebalance3(s, info, vt, i - 1);
+ 
+ 	return r;
+ }
+@@ -529,7 +523,7 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info,
+ 		if (le32_to_cpu(n->header.flags) & LEAF_NODE)
+ 			return do_leaf(n, key, index);
+ 
+-		r = rebalance_children(s, info, key);
++		r = rebalance_children(s, info, vt, key);
+ 		if (r)
+ 			break;
+ 
+@@ -550,6 +544,14 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info,
+ 	return r;
+ }
+ 
++static struct dm_btree_value_type le64_type = {
++	.context = NULL,
++	.size = sizeof(__le64),
++	.inc = NULL,
++	.dec = NULL,
++	.equal = NULL
++};
++
+ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
+ 		    uint64_t *keys, dm_block_t *new_root)
+ {
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 202ae34..63e3c47 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1715,6 +1715,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ 
+ 	bond_compute_features(bond);
+ 
++	bond_update_speed_duplex(new_slave);
++
+ 	read_lock(&bond->lock);
+ 
+ 	new_slave->last_arp_rx = jiffies;
+@@ -1758,8 +1760,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ 		new_slave->link  = BOND_LINK_DOWN;
+ 	}
+ 
+-	bond_update_speed_duplex(new_slave);
+-
+ 	if (USES_PRIMARY(bond->params.mode) && bond->params.primary[0]) {
+ 		/* if there is a primary slave, remember it */
+ 		if (strcmp(bond->params.primary, new_slave->dev->name) == 0) {
+@@ -2437,8 +2437,6 @@ static void bond_miimon_commit(struct bonding *bond)
+ 				bond_set_backup_slave(slave);
+ 			}
+ 
+-			bond_update_speed_duplex(slave);
+-
+ 			pr_info("%s: link status definitely up for interface %s, %u Mbps %s duplex.\n",
+ 				bond->dev->name, slave->dev->name,
+ 				slave->speed, slave->duplex ? "full" : "half");
+diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
+index a6611f1..5d5a05f 100644
+--- a/drivers/net/ethernet/sfc/efx.c
++++ b/drivers/net/ethernet/sfc/efx.c
+@@ -650,25 +650,30 @@ static void efx_fini_channels(struct efx_nic *efx)
+ 	struct efx_channel *channel;
+ 	struct efx_tx_queue *tx_queue;
+ 	struct efx_rx_queue *rx_queue;
++	struct pci_dev *dev = efx->pci_dev;
+ 	int rc;
+ 
+ 	EFX_ASSERT_RESET_SERIALISED(efx);
+ 	BUG_ON(efx->port_enabled);
+ 
+-	rc = efx_nic_flush_queues(efx);
+-	if (rc && EFX_WORKAROUND_7803(efx)) {
+-		/* Schedule a reset to recover from the flush failure. The
+-		 * descriptor caches reference memory we're about to free,
+-		 * but falcon_reconfigure_mac_wrapper() won't reconnect
+-		 * the MACs because of the pending reset. */
+-		netif_err(efx, drv, efx->net_dev,
+-			  "Resetting to recover from flush failure\n");
+-		efx_schedule_reset(efx, RESET_TYPE_ALL);
+-	} else if (rc) {
+-		netif_err(efx, drv, efx->net_dev, "failed to flush queues\n");
+-	} else {
+-		netif_dbg(efx, drv, efx->net_dev,
+-			  "successfully flushed all queues\n");
++	/* Only perform flush if dma is enabled */
++	if (dev->is_busmaster) {
++		rc = efx_nic_flush_queues(efx);
++
++		if (rc && EFX_WORKAROUND_7803(efx)) {
++			/* Schedule a reset to recover from the flush failure. The
++			 * descriptor caches reference memory we're about to free,
++			 * but falcon_reconfigure_mac_wrapper() won't reconnect
++			 * the MACs because of the pending reset. */
++			netif_err(efx, drv, efx->net_dev,
++				  "Resetting to recover from flush failure\n");
++			efx_schedule_reset(efx, RESET_TYPE_ALL);
++		} else if (rc) {
++			netif_err(efx, drv, efx->net_dev, "failed to flush queues\n");
++		} else {
++			netif_dbg(efx, drv, efx->net_dev,
++				  "successfully flushed all queues\n");
++		}
+ 	}
+ 
+ 	efx_for_each_channel(channel, efx) {
+@@ -714,6 +719,7 @@ efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries)
+ 	unsigned i;
+ 	int rc;
+ 
++	efx_device_detach_sync(efx);
+ 	efx_stop_all(efx);
+ 	efx_fini_channels(efx);
+ 
+@@ -757,6 +763,7 @@ out:
+ 
+ 	efx_init_channels(efx);
+ 	efx_start_all(efx);
++	netif_device_attach(efx->net_dev);
+ 	return rc;
+ 
+ rollback:
+@@ -1525,8 +1532,12 @@ static void efx_stop_all(struct efx_nic *efx)
+ 	/* Flush efx_mac_work(), refill_workqueue, monitor_work */
+ 	efx_flush_all(efx);
+ 
+-	/* Stop the kernel transmit interface late, so the watchdog
+-	 * timer isn't ticking over the flush */
++	/* Stop the kernel transmit interface.  This is only valid if
++	 * the device is stopped or detached; otherwise the watchdog
++	 * may fire immediately.
++	 */
++	WARN_ON(netif_running(efx->net_dev) &&
++		netif_device_present(efx->net_dev));
+ 	if (efx_dev_registered(efx)) {
+ 		netif_tx_stop_all_queues(efx->net_dev);
+ 		netif_tx_lock_bh(efx->net_dev);
+@@ -1827,10 +1838,11 @@ static int efx_change_mtu(struct net_device *net_dev, int new_mtu)
+ 	if (new_mtu > EFX_MAX_MTU)
+ 		return -EINVAL;
+ 
+-	efx_stop_all(efx);
+-
+ 	netif_dbg(efx, drv, efx->net_dev, "changing MTU to %d\n", new_mtu);
+ 
++	efx_device_detach_sync(efx);
++	efx_stop_all(efx);
++
+ 	efx_fini_channels(efx);
+ 
+ 	mutex_lock(&efx->mac_lock);
+@@ -1843,6 +1855,7 @@ static int efx_change_mtu(struct net_device *net_dev, int new_mtu)
+ 	efx_init_channels(efx);
+ 
+ 	efx_start_all(efx);
++	netif_device_attach(efx->net_dev);
+ 	return rc;
+ }
+ 
+@@ -2132,7 +2145,7 @@ int efx_reset(struct efx_nic *efx, enum reset_type method)
+ 	netif_info(efx, drv, efx->net_dev, "resetting (%s)\n",
+ 		   RESET_TYPE(method));
+ 
+-	netif_device_detach(efx->net_dev);
++	efx_device_detach_sync(efx);
+ 	efx_reset_down(efx, method);
+ 
+ 	rc = efx->type->reset(efx, method);
+@@ -2580,7 +2593,7 @@ static int efx_pm_freeze(struct device *dev)
+ 
+ 	efx->state = STATE_FINI;
+ 
+-	netif_device_detach(efx->net_dev);
++	efx_device_detach_sync(efx);
+ 
+ 	efx_stop_all(efx);
+ 	efx_fini_channels(efx);
+diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h
+index 1355245..9668d29 100644
+--- a/drivers/net/ethernet/sfc/efx.h
++++ b/drivers/net/ethernet/sfc/efx.h
+@@ -149,4 +149,17 @@ extern void efx_link_status_changed(struct efx_nic *efx);
+ extern void efx_link_set_advertising(struct efx_nic *efx, u32);
+ extern void efx_link_set_wanted_fc(struct efx_nic *efx, u8);
+ 
++static inline void efx_device_detach_sync(struct efx_nic *efx)
++{
++	struct net_device *dev = efx->net_dev;
++
++	/* Lock/freeze all TX queues so that we can be sure the
++	 * TX scheduler is stopped when we're done and before
++	 * netif_device_present() becomes false.
++	 */
++	netif_tx_lock_bh(dev);
++	netif_device_detach(dev);
++	netif_tx_unlock_bh(dev);
++}
++
+ #endif /* EFX_EFX_H */
+diff --git a/drivers/net/ethernet/sfc/falcon.c b/drivers/net/ethernet/sfc/falcon.c
+index 97b606b..26cd6c0 100644
+--- a/drivers/net/ethernet/sfc/falcon.c
++++ b/drivers/net/ethernet/sfc/falcon.c
+@@ -1762,6 +1762,7 @@ const struct efx_nic_type falcon_a1_nic_type = {
+ 	.remove_port = falcon_remove_port,
+ 	.handle_global_event = falcon_handle_global_event,
+ 	.prepare_flush = falcon_prepare_flush,
++	.finish_flush = efx_port_dummy_op_void,
+ 	.update_stats = falcon_update_nic_stats,
+ 	.start_stats = falcon_start_nic_stats,
+ 	.stop_stats = falcon_stop_nic_stats,
+@@ -1804,6 +1805,7 @@ const struct efx_nic_type falcon_b0_nic_type = {
+ 	.remove_port = falcon_remove_port,
+ 	.handle_global_event = falcon_handle_global_event,
+ 	.prepare_flush = falcon_prepare_flush,
++	.finish_flush = efx_port_dummy_op_void,
+ 	.update_stats = falcon_update_nic_stats,
+ 	.start_stats = falcon_start_nic_stats,
+ 	.stop_stats = falcon_stop_nic_stats,
+diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
+index 81a4253..c1000ce 100644
+--- a/drivers/net/ethernet/sfc/mcdi.c
++++ b/drivers/net/ethernet/sfc/mcdi.c
+@@ -30,7 +30,7 @@
+ #define REBOOT_FLAG_PORT0 0x3f8
+ #define REBOOT_FLAG_PORT1 0x3fc
+ 
+-#define MCDI_RPC_TIMEOUT       10 /*seconds */
++#define MCDI_RPC_TIMEOUT       (10 * HZ)
+ 
+ #define MCDI_PDU(efx)							\
+ 	(efx_port_num(efx) ? CMD_PDU_PORT1 : CMD_PDU_PORT0)
+@@ -120,7 +120,7 @@ static void efx_mcdi_copyout(struct efx_nic *efx, u8 *outbuf, size_t outlen)
+ static int efx_mcdi_poll(struct efx_nic *efx)
+ {
+ 	struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
+-	unsigned int time, finish;
++	unsigned long time, finish;
+ 	unsigned int respseq, respcmd, error;
+ 	unsigned int pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
+ 	unsigned int rc, spins;
+@@ -136,7 +136,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
+ 	 * and poll once a jiffy (approximately)
+ 	 */
+ 	spins = TICK_USEC;
+-	finish = get_seconds() + MCDI_RPC_TIMEOUT;
++	finish = jiffies + MCDI_RPC_TIMEOUT;
+ 
+ 	while (1) {
+ 		if (spins != 0) {
+@@ -146,7 +146,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
+ 			schedule_timeout_uninterruptible(1);
+ 		}
+ 
+-		time = get_seconds();
++		time = jiffies;
+ 
+ 		rmb();
+ 		efx_readd(efx, &reg, pdu);
+@@ -158,7 +158,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
+ 		    EFX_DWORD_FIELD(reg, MCDI_HEADER_RESPONSE))
+ 			break;
+ 
+-		if (time >= finish)
++		if (time_after(time, finish))
+ 			return -ETIMEDOUT;
+ 	}
+ 
+@@ -250,7 +250,7 @@ static int efx_mcdi_await_completion(struct efx_nic *efx)
+ 	if (wait_event_timeout(
+ 		    mcdi->wq,
+ 		    atomic_read(&mcdi->state) == MCDI_STATE_COMPLETED,
+-		    msecs_to_jiffies(MCDI_RPC_TIMEOUT * 1000)) == 0)
++		    MCDI_RPC_TIMEOUT) == 0)
+ 		return -ETIMEDOUT;
+ 
+ 	/* Check if efx_mcdi_set_mode() switched us back to polled completions.
+@@ -666,9 +666,8 @@ int efx_mcdi_get_board_cfg(struct efx_nic *efx, u8 *mac_address,
+ 			   u16 *fw_subtype_list)
+ {
+ 	uint8_t outbuf[MC_CMD_GET_BOARD_CFG_OUT_LEN];
+-	size_t outlen;
++	size_t outlen, offset, i;
+ 	int port_num = efx_port_num(efx);
+-	int offset;
+ 	int rc;
+ 
+ 	BUILD_BUG_ON(MC_CMD_GET_BOARD_CFG_IN_LEN != 0);
+@@ -688,10 +687,16 @@ int efx_mcdi_get_board_cfg(struct efx_nic *efx, u8 *mac_address,
+ 		: MC_CMD_GET_BOARD_CFG_OUT_MAC_ADDR_BASE_PORT0_OFST;
+ 	if (mac_address)
+ 		memcpy(mac_address, outbuf + offset, ETH_ALEN);
+-	if (fw_subtype_list)
+-		memcpy(fw_subtype_list,
+-		       outbuf + MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_OFST,
+-		       MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_LEN);
++	if (fw_subtype_list) {
++		offset = MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_OFST;
++		for (i = 0;
++		     i < MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_LEN / 2;
++		     i++) {
++			fw_subtype_list[i] =
++				le16_to_cpup((__le16 *)(outbuf + offset));
++			offset += 2;
++		}
++	}
+ 
+ 	return 0;
+ 
+diff --git a/drivers/net/ethernet/sfc/mcdi.h b/drivers/net/ethernet/sfc/mcdi.h
+index aced2a7..b61eea0 100644
+--- a/drivers/net/ethernet/sfc/mcdi.h
++++ b/drivers/net/ethernet/sfc/mcdi.h
+@@ -126,5 +126,6 @@ extern int efx_mcdi_wol_filter_set_magic(struct efx_nic *efx,
+ extern int efx_mcdi_wol_filter_get_magic(struct efx_nic *efx, int *id_out);
+ extern int efx_mcdi_wol_filter_remove(struct efx_nic *efx, int id);
+ extern int efx_mcdi_wol_filter_reset(struct efx_nic *efx);
++extern int efx_mcdi_set_mac(struct efx_nic *efx);
+ 
+ #endif /* EFX_MCDI_H */
+diff --git a/drivers/net/ethernet/sfc/mcdi_mac.c b/drivers/net/ethernet/sfc/mcdi_mac.c
+index 50c2077..da269d7 100644
+--- a/drivers/net/ethernet/sfc/mcdi_mac.c
++++ b/drivers/net/ethernet/sfc/mcdi_mac.c
+@@ -13,7 +13,7 @@
+ #include "mcdi.h"
+ #include "mcdi_pcol.h"
+ 
+-static int efx_mcdi_set_mac(struct efx_nic *efx)
++int efx_mcdi_set_mac(struct efx_nic *efx)
+ {
+ 	u32 reject, fcntl;
+ 	u8 cmdbytes[MC_CMD_SET_MAC_IN_LEN];
+@@ -45,6 +45,8 @@ static int efx_mcdi_set_mac(struct efx_nic *efx)
+ 	}
+ 	if (efx->wanted_fc & EFX_FC_AUTO)
+ 		fcntl = MC_CMD_FCNTL_AUTO;
++	if (efx->fc_disable)
++		fcntl = MC_CMD_FCNTL_OFF;
+ 
+ 	MCDI_SET_DWORD(cmdbytes, SET_MAC_IN_FCNTL, fcntl);
+ 
+diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
+index b8e251a..8bcb8fd 100644
+--- a/drivers/net/ethernet/sfc/net_driver.h
++++ b/drivers/net/ethernet/sfc/net_driver.h
+@@ -213,6 +213,7 @@ struct efx_tx_queue {
+  *	If both this and page are %NULL, the buffer slot is currently free.
+  * @page: The associated page buffer, if any.
+  *	If both this and skb are %NULL, the buffer slot is currently free.
++ * @page_offset: Offset within page. Valid iff @flags & %EFX_RX_BUF_PAGE.
+  * @len: Buffer length, in bytes.
+  * @is_page: Indicates if @page is valid. If false, @skb is valid.
+  */
+@@ -222,7 +223,8 @@ struct efx_rx_buffer {
+ 		struct sk_buff *skb;
+ 		struct page *page;
+ 	} u;
+-	unsigned int len;
++	u16 page_offset;
++	u16 len;
+ 	bool is_page;
+ };
+ 
+@@ -689,6 +691,9 @@ struct efx_filter_state;
+  * @promiscuous: Promiscuous flag. Protected by netif_tx_lock.
+  * @multicast_hash: Multicast hash table
+  * @wanted_fc: Wanted flow control flags
++ * @fc_disable: When non-zero flow control is disabled. Typically used to
++ *	ensure that network back pressure doesn't delay dma queue flushes.
++ *	Serialised by the rtnl lock.
+  * @mac_work: Work item for changing MAC promiscuity and multicast hash
+  * @loopback_mode: Loopback status
+  * @loopback_modes: Supported loopback mode bitmask
+@@ -782,6 +787,7 @@ struct efx_nic {
+ 	bool promiscuous;
+ 	union efx_multicast_hash multicast_hash;
+ 	u8 wanted_fc;
++	unsigned fc_disable;
+ 
+ 	atomic_t rx_reset;
+ 	enum efx_loopback_mode loopback_mode;
+@@ -835,6 +841,7 @@ static inline unsigned int efx_port_num(struct efx_nic *efx)
+  * @remove_port: Free resources allocated by probe_port()
+  * @handle_global_event: Handle a "global" event (may be %NULL)
+  * @prepare_flush: Prepare the hardware for flushing the DMA queues
++ * @finish_flush: Clean up after flushing the DMA queues
+  * @update_stats: Update statistics not provided by event handling
+  * @start_stats: Start the regular fetching of statistics
+  * @stop_stats: Stop the regular fetching of statistics
+@@ -880,6 +887,7 @@ struct efx_nic_type {
+ 	void (*remove_port)(struct efx_nic *efx);
+ 	bool (*handle_global_event)(struct efx_channel *channel, efx_qword_t *);
+ 	void (*prepare_flush)(struct efx_nic *efx);
++	void (*finish_flush)(struct efx_nic *efx);
+ 	void (*update_stats)(struct efx_nic *efx);
+ 	void (*start_stats)(struct efx_nic *efx);
+ 	void (*stop_stats)(struct efx_nic *efx);
+diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c
+index 3edfbaf..2e9ca10 100644
+--- a/drivers/net/ethernet/sfc/nic.c
++++ b/drivers/net/ethernet/sfc/nic.c
+@@ -371,7 +371,8 @@ efx_may_push_tx_desc(struct efx_tx_queue *tx_queue, unsigned int write_count)
+ 		return false;
+ 
+ 	tx_queue->empty_read_count = 0;
+-	return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0;
++	return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0
++		&& tx_queue->write_count - write_count == 1;
+ }
+ 
+ /* For each entry inserted into the software descriptor ring, create a
+@@ -1261,13 +1262,27 @@ int efx_nic_flush_queues(struct efx_nic *efx)
+ 			}
+ 			efx_for_each_possible_channel_tx_queue(tx_queue, channel) {
+ 				if (tx_queue->initialised &&
+-				    tx_queue->flushed != FLUSH_DONE)
+-					++tx_pending;
++				    tx_queue->flushed != FLUSH_DONE) {
++					efx_oword_t txd_ptr_tbl;
++
++					efx_reado_table(efx, &txd_ptr_tbl,
++							FR_BZ_TX_DESC_PTR_TBL,
++							tx_queue->queue);
++					if (EFX_OWORD_FIELD(txd_ptr_tbl,
++							    FRF_AZ_TX_DESCQ_FLUSH) ||
++					    EFX_OWORD_FIELD(txd_ptr_tbl,
++							    FRF_AZ_TX_DESCQ_EN))
++						++tx_pending;
++					else
++						tx_queue->flushed = FLUSH_DONE;
++				}
+ 			}
+ 		}
+ 
+-		if (rx_pending == 0 && tx_pending == 0)
++		if (rx_pending == 0 && tx_pending == 0) {
++			efx->type->finish_flush(efx);
+ 			return 0;
++		}
+ 
+ 		msleep(EFX_FLUSH_INTERVAL);
+ 		efx_poll_flush_events(efx);
+@@ -1293,6 +1308,7 @@ int efx_nic_flush_queues(struct efx_nic *efx)
+ 		}
+ 	}
+ 
++	efx->type->finish_flush(efx);
+ 	return -ETIMEDOUT;
+ }
+ 
+diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
+index 66ece48..58302a2 100644
+--- a/drivers/net/ethernet/sfc/nic.h
++++ b/drivers/net/ethernet/sfc/nic.h
+@@ -210,6 +210,8 @@ extern void falcon_irq_ack_a1(struct efx_nic *efx);
+ 
+ /* Global Resources */
+ extern int efx_nic_flush_queues(struct efx_nic *efx);
++extern void siena_prepare_flush(struct efx_nic *efx);
++extern void siena_finish_flush(struct efx_nic *efx);
+ extern void falcon_start_nic_stats(struct efx_nic *efx);
+ extern void falcon_stop_nic_stats(struct efx_nic *efx);
+ extern void falcon_setup_xaui(struct efx_nic *efx);
+diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
+index 5ef4cc0..9ce8665 100644
+--- a/drivers/net/ethernet/sfc/rx.c
++++ b/drivers/net/ethernet/sfc/rx.c
+@@ -95,11 +95,7 @@ static unsigned int rx_refill_limit = 95;
+ static inline unsigned int efx_rx_buf_offset(struct efx_nic *efx,
+ 					     struct efx_rx_buffer *buf)
+ {
+-	/* Offset is always within one page, so we don't need to consider
+-	 * the page order.
+-	 */
+-	return (((__force unsigned long) buf->dma_addr & (PAGE_SIZE - 1)) +
+-		efx->type->rx_buffer_hash_size);
++	return buf->page_offset + efx->type->rx_buffer_hash_size;
+ }
+ static inline unsigned int efx_rx_buf_size(struct efx_nic *efx)
+ {
+@@ -194,6 +190,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
+ 	struct efx_rx_buffer *rx_buf;
+ 	struct page *page;
+ 	void *page_addr;
++	unsigned int page_offset;
+ 	struct efx_rx_page_state *state;
+ 	dma_addr_t dma_addr;
+ 	unsigned index, count;
+@@ -220,12 +217,14 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
+ 
+ 		page_addr += sizeof(struct efx_rx_page_state);
+ 		dma_addr += sizeof(struct efx_rx_page_state);
++		page_offset = sizeof(struct efx_rx_page_state);
+ 
+ 	split:
+ 		index = rx_queue->added_count & rx_queue->ptr_mask;
+ 		rx_buf = efx_rx_buffer(rx_queue, index);
+ 		rx_buf->dma_addr = dma_addr + EFX_PAGE_IP_ALIGN;
+ 		rx_buf->u.page = page;
++		rx_buf->page_offset = page_offset + EFX_PAGE_IP_ALIGN;
+ 		rx_buf->len = efx->rx_buffer_len - EFX_PAGE_IP_ALIGN;
+ 		rx_buf->is_page = true;
+ 		++rx_queue->added_count;
+@@ -237,6 +236,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
+ 			get_page(page);
+ 			dma_addr += (PAGE_SIZE >> 1);
+ 			page_addr += (PAGE_SIZE >> 1);
++			page_offset += (PAGE_SIZE >> 1);
+ 			++count;
+ 			goto split;
+ 		}
+@@ -246,7 +246,8 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
+ }
+ 
+ static void efx_unmap_rx_buffer(struct efx_nic *efx,
+-				struct efx_rx_buffer *rx_buf)
++				struct efx_rx_buffer *rx_buf,
++				unsigned int used_len)
+ {
+ 	if (rx_buf->is_page && rx_buf->u.page) {
+ 		struct efx_rx_page_state *state;
+@@ -257,6 +258,10 @@ static void efx_unmap_rx_buffer(struct efx_nic *efx,
+ 				       state->dma_addr,
+ 				       efx_rx_buf_size(efx),
+ 				       PCI_DMA_FROMDEVICE);
++		} else if (used_len) {
++			dma_sync_single_for_cpu(&efx->pci_dev->dev,
++						rx_buf->dma_addr, used_len,
++						DMA_FROM_DEVICE);
+ 		}
+ 	} else if (!rx_buf->is_page && rx_buf->u.skb) {
+ 		pci_unmap_single(efx->pci_dev, rx_buf->dma_addr,
+@@ -279,7 +284,7 @@ static void efx_free_rx_buffer(struct efx_nic *efx,
+ static void efx_fini_rx_buffer(struct efx_rx_queue *rx_queue,
+ 			       struct efx_rx_buffer *rx_buf)
+ {
+-	efx_unmap_rx_buffer(rx_queue->efx, rx_buf);
++	efx_unmap_rx_buffer(rx_queue->efx, rx_buf, 0);
+ 	efx_free_rx_buffer(rx_queue->efx, rx_buf);
+ }
+ 
+@@ -550,10 +555,10 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
+ 		goto out;
+ 	}
+ 
+-	/* Release card resources - assumes all RX buffers consumed in-order
+-	 * per RX queue
++	/* Release and/or sync DMA mapping - assumes all RX buffers
++	 * consumed in-order per RX queue
+ 	 */
+-	efx_unmap_rx_buffer(efx, rx_buf);
++	efx_unmap_rx_buffer(efx, rx_buf, len);
+ 
+ 	/* Prefetch nice and early so data will (hopefully) be in cache by
+ 	 * the time we look at it.
+diff --git a/drivers/net/ethernet/sfc/selftest.c b/drivers/net/ethernet/sfc/selftest.c
+index 822f6c2..4907885 100644
+--- a/drivers/net/ethernet/sfc/selftest.c
++++ b/drivers/net/ethernet/sfc/selftest.c
+@@ -698,7 +698,7 @@ int efx_selftest(struct efx_nic *efx, struct efx_self_tests *tests,
+ 	/* Detach the device so the kernel doesn't transmit during the
+ 	 * loopback test and the watchdog timeout doesn't fire.
+ 	 */
+-	netif_device_detach(efx->net_dev);
++	efx_device_detach_sync(efx);
+ 
+ 	mutex_lock(&efx->mac_lock);
+ 	if (efx->loopback_modes) {
+diff --git a/drivers/net/ethernet/sfc/siena.c b/drivers/net/ethernet/sfc/siena.c
+index cc2549c..c58b973 100644
+--- a/drivers/net/ethernet/sfc/siena.c
++++ b/drivers/net/ethernet/sfc/siena.c
+@@ -137,6 +137,18 @@ static void siena_remove_port(struct efx_nic *efx)
+ 	efx_nic_free_buffer(efx, &efx->stats_buffer);
+ }
+ 
++void siena_prepare_flush(struct efx_nic *efx)
++{
++	if (efx->fc_disable++ == 0)
++		efx_mcdi_set_mac(efx);
++}
++
++void siena_finish_flush(struct efx_nic *efx)
++{
++	if (--efx->fc_disable == 0)
++		efx_mcdi_set_mac(efx);
++}
++
+ static const struct efx_nic_register_test siena_register_tests[] = {
+ 	{ FR_AZ_ADR_REGION,
+ 	  EFX_OWORD32(0x0003FFFF, 0x0003FFFF, 0x0003FFFF, 0x0003FFFF) },
+@@ -624,7 +636,8 @@ const struct efx_nic_type siena_a0_nic_type = {
+ 	.reset = siena_reset_hw,
+ 	.probe_port = siena_probe_port,
+ 	.remove_port = siena_remove_port,
+-	.prepare_flush = efx_port_dummy_op_void,
++	.prepare_flush = siena_prepare_flush,
++	.finish_flush = siena_finish_flush,
+ 	.update_stats = siena_update_nic_stats,
+ 	.start_stats = siena_start_nic_stats,
+ 	.stop_stats = siena_stop_nic_stats,
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 97f342e..544ac06 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -585,6 +585,7 @@ void macvlan_common_setup(struct net_device *dev)
+ 	ether_setup(dev);
+ 
+ 	dev->priv_flags	       &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
++	dev->priv_flags	       |= IFF_UNICAST_FLT;
+ 	dev->netdev_ops		= &macvlan_netdev_ops;
+ 	dev->destructor		= free_netdev;
+ 	dev->header_ops		= &macvlan_hard_header_ops,
+diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
+index 01b104e..bff6908 100644
+--- a/drivers/net/netconsole.c
++++ b/drivers/net/netconsole.c
+@@ -630,6 +630,7 @@ static int netconsole_netdev_event(struct notifier_block *this,
+ 		goto done;
+ 
+ 	spin_lock_irqsave(&target_list_lock, flags);
++restart:
+ 	list_for_each_entry(nt, &target_list, list) {
+ 		netconsole_target_get(nt);
+ 		if (nt->np.dev == dev) {
+@@ -642,20 +643,17 @@ static int netconsole_netdev_event(struct notifier_block *this,
+ 			case NETDEV_UNREGISTER:
+ 				/*
+ 				 * rtnl_lock already held
++				 * we might sleep in __netpoll_cleanup()
+ 				 */
+-				if (nt->np.dev) {
+-					spin_unlock_irqrestore(
+-							      &target_list_lock,
+-							      flags);
+-					__netpoll_cleanup(&nt->np);
+-					spin_lock_irqsave(&target_list_lock,
+-							  flags);
+-					dev_put(nt->np.dev);
+-					nt->np.dev = NULL;
+-				}
++				spin_unlock_irqrestore(&target_list_lock, flags);
++				__netpoll_cleanup(&nt->np);
++				spin_lock_irqsave(&target_list_lock, flags);
++				dev_put(nt->np.dev);
++				nt->np.dev = NULL;
+ 				nt->enabled = 0;
+ 				stopped = true;
+-				break;
++				netconsole_target_put(nt);
++				goto restart;
+ 			}
+ 		}
+ 		netconsole_target_put(nt);
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index a12c9bf..f4c5de6 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -417,6 +417,8 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	 * for indefinite time. */
+ 	skb_orphan(skb);
+ 
++	nf_reset(skb);
++
+ 	/* Enqueue packet */
+ 	skb_queue_tail(&tun->socket.sk->sk_receive_queue, skb);
+ 
+diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
+index 62b4c29..d48dfb7 100644
+--- a/drivers/net/wireless/mwifiex/join.c
++++ b/drivers/net/wireless/mwifiex/join.c
+@@ -1062,10 +1062,9 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mwifiex_private *priv,
+ 				adhoc_join->bss_descriptor.bssid,
+ 				adhoc_join->bss_descriptor.ssid);
+ 
+-	for (i = 0; bss_desc->supported_rates[i] &&
+-			i < MWIFIEX_SUPPORTED_RATES;
+-			i++)
+-			;
++	for (i = 0; i < MWIFIEX_SUPPORTED_RATES &&
++		    bss_desc->supported_rates[i]; i++)
++		;
+ 	rates_size = i;
+ 
+ 	/* Copy Data Rates from the Rates recorded in scan response */
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+index 814c05d..d3920da 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+@@ -1557,74 +1557,57 @@ void rtl92cu_card_disable(struct ieee80211_hw *hw)
+ 
+ void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid)
+ {
+-	/* dummy routine needed for callback from rtl_op_configure_filter() */
+-}
+-
+-/*========================================================================== */
+-
+-static void _rtl92cu_set_check_bssid(struct ieee80211_hw *hw,
+-			      enum nl80211_iftype type)
+-{
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+-	u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
+ 	struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
+-	struct rtl_phy *rtlphy = &(rtlpriv->phy);
+-	u8 filterout_non_associated_bssid = false;
++	u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
+ 
+-	switch (type) {
+-	case NL80211_IFTYPE_ADHOC:
+-	case NL80211_IFTYPE_STATION:
+-		filterout_non_associated_bssid = true;
+-		break;
+-	case NL80211_IFTYPE_UNSPECIFIED:
+-	case NL80211_IFTYPE_AP:
+-	default:
+-		break;
+-	}
+-	if (filterout_non_associated_bssid) {
++	if (rtlpriv->psc.rfpwr_state != ERFON)
++		return;
++
++	if (check_bssid) {
++		u8 tmp;
+ 		if (IS_NORMAL_CHIP(rtlhal->version)) {
+-			switch (rtlphy->current_io_type) {
+-			case IO_CMD_RESUME_DM_BY_SCAN:
+-				reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
+-				rtlpriv->cfg->ops->set_hw_reg(hw,
+-						 HW_VAR_RCR, (u8 *)(&reg_rcr));
+-				/* enable update TSF */
+-				_rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4));
+-				break;
+-			case IO_CMD_PAUSE_DM_BY_SCAN:
+-				reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
+-				rtlpriv->cfg->ops->set_hw_reg(hw,
+-						 HW_VAR_RCR, (u8 *)(&reg_rcr));
+-				/* disable update TSF */
+-				_rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
+-				break;
+-			}
++			reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
++			tmp = BIT(4);
+ 		} else {
+-			reg_rcr |= (RCR_CBSSID);
+-			rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+-						      (u8 *)(&reg_rcr));
+-			_rtl92cu_set_bcn_ctrl_reg(hw, 0, (BIT(4)|BIT(5)));
++			reg_rcr |= RCR_CBSSID;
++			tmp = BIT(4) | BIT(5);
+ 		}
+-	} else if (filterout_non_associated_bssid == false) {
++		rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
++					      (u8 *) (&reg_rcr));
++		_rtl92cu_set_bcn_ctrl_reg(hw, 0, tmp);
++	} else {
++		u8 tmp;
+ 		if (IS_NORMAL_CHIP(rtlhal->version)) {
+-			reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
+-			rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+-						      (u8 *)(&reg_rcr));
+-			_rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
++			reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
++			tmp = BIT(4);
+ 		} else {
+-			reg_rcr &= (~RCR_CBSSID);
+-			rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+-						      (u8 *)(&reg_rcr));
+-			_rtl92cu_set_bcn_ctrl_reg(hw, (BIT(4)|BIT(5)), 0);
++			reg_rcr &= ~RCR_CBSSID;
++			tmp = BIT(4) | BIT(5);
+ 		}
++		reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
++		rtlpriv->cfg->ops->set_hw_reg(hw,
++					      HW_VAR_RCR, (u8 *) (&reg_rcr));
++		_rtl92cu_set_bcn_ctrl_reg(hw, tmp, 0);
+ 	}
+ }
+ 
++/*========================================================================== */
++
+ int rtl92cu_set_network_type(struct ieee80211_hw *hw, enum nl80211_iftype type)
+ {
++	struct rtl_priv *rtlpriv = rtl_priv(hw);
++
+ 	if (_rtl92cu_set_media_status(hw, type))
+ 		return -EOPNOTSUPP;
+-	_rtl92cu_set_check_bssid(hw, type);
++
++	if (rtlpriv->mac80211.link_state == MAC80211_LINKED) {
++		if (type != NL80211_IFTYPE_AP)
++			rtl92cu_set_check_bssid(hw, true);
++	} else {
++		rtl92cu_set_check_bssid(hw, false);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -2238,8 +2221,6 @@ void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
+ 			       (shortgi_rate << 4) | (shortgi_rate);
+ 	}
+ 	rtl_write_dword(rtlpriv, REG_ARFR0 + ratr_index * 4, ratr_value);
+-	RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, ("%x\n", rtl_read_dword(rtlpriv,
+-		 REG_ARFR0)));
+ }
+ 
+ void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index e18604b..d19b879 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -49,7 +49,6 @@ static void pty_close(struct tty_struct *tty, struct file *filp)
+ 	tty->packet = 0;
+ 	if (!tty->link)
+ 		return;
+-	tty->link->packet = 0;
+ 	set_bit(TTY_OTHER_CLOSED, &tty->link->flags);
+ 	wake_up_interruptible(&tty->link->read_wait);
+ 	wake_up_interruptible(&tty->link->write_wait);
+diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
+index ad0f8f5..2dc4d9b 100644
+--- a/drivers/tty/serial/sunsu.c
++++ b/drivers/tty/serial/sunsu.c
+@@ -968,6 +968,7 @@ static struct uart_ops sunsu_pops = {
+ #define UART_NR	4
+ 
+ static struct uart_sunsu_port sunsu_ports[UART_NR];
++static int nr_inst; /* Number of already registered ports */
+ 
+ #ifdef CONFIG_SERIO
+ 
+@@ -1337,13 +1338,8 @@ static int __init sunsu_console_setup(struct console *co, char *options)
+ 	printk("Console: ttyS%d (SU)\n",
+ 	       (sunsu_reg.minor - 64) + co->index);
+ 
+-	/*
+-	 * Check whether an invalid uart number has been specified, and
+-	 * if so, search for the first available port that does have
+-	 * console support.
+-	 */
+-	if (co->index >= UART_NR)
+-		co->index = 0;
++	if (co->index > nr_inst)
++		return -ENODEV;
+ 	port = &sunsu_ports[co->index].port;
+ 
+ 	/*
+@@ -1408,7 +1404,6 @@ static enum su_type __devinit su_get_type(struct device_node *dp)
+ 
+ static int __devinit su_probe(struct platform_device *op)
+ {
+-	static int inst;
+ 	struct device_node *dp = op->dev.of_node;
+ 	struct uart_sunsu_port *up;
+ 	struct resource *rp;
+@@ -1418,16 +1413,16 @@ static int __devinit su_probe(struct platform_device *op)
+ 
+ 	type = su_get_type(dp);
+ 	if (type == SU_PORT_PORT) {
+-		if (inst >= UART_NR)
++		if (nr_inst >= UART_NR)
+ 			return -EINVAL;
+-		up = &sunsu_ports[inst];
++		up = &sunsu_ports[nr_inst];
+ 	} else {
+ 		up = kzalloc(sizeof(*up), GFP_KERNEL);
+ 		if (!up)
+ 			return -ENOMEM;
+ 	}
+ 
+-	up->port.line = inst;
++	up->port.line = nr_inst;
+ 
+ 	spin_lock_init(&up->port.lock);
+ 
+@@ -1461,6 +1456,8 @@ static int __devinit su_probe(struct platform_device *op)
+ 		}
+ 		dev_set_drvdata(&op->dev, up);
+ 
++		nr_inst++;
++
+ 		return 0;
+ 	}
+ 
+@@ -1488,7 +1485,7 @@ static int __devinit su_probe(struct platform_device *op)
+ 
+ 	dev_set_drvdata(&op->dev, up);
+ 
+-	inst++;
++	nr_inst++;
+ 
+ 	return 0;
+ 
+diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
+index 61d08dd..76be3ba 100644
+--- a/drivers/usb/core/hcd-pci.c
++++ b/drivers/usb/core/hcd-pci.c
+@@ -173,6 +173,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 	struct hc_driver	*driver;
+ 	struct usb_hcd		*hcd;
+ 	int			retval;
++	int			hcd_irq = 0;
+ 
+ 	if (usb_disabled())
+ 		return -ENODEV;
+@@ -187,15 +188,19 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 		return -ENODEV;
+ 	dev->current_state = PCI_D0;
+ 
+-	/* The xHCI driver supports MSI and MSI-X,
+-	 * so don't fail if the BIOS doesn't provide a legacy IRQ.
++	/*
++	 * The xHCI driver has its own irq management
++	 * make sure irq setup is not touched for xhci in generic hcd code
+ 	 */
+-	if (!dev->irq && (driver->flags & HCD_MASK) != HCD_USB3) {
+-		dev_err(&dev->dev,
+-			"Found HC with no IRQ.  Check BIOS/PCI %s setup!\n",
+-			pci_name(dev));
+-		retval = -ENODEV;
+-		goto disable_pci;
++	if ((driver->flags & HCD_MASK) != HCD_USB3) {
++		if (!dev->irq) {
++			dev_err(&dev->dev,
++			"Found HC with no IRQ. Check BIOS/PCI %s setup!\n",
++				pci_name(dev));
++			retval = -ENODEV;
++			goto disable_pci;
++		}
++		hcd_irq = dev->irq;
+ 	}
+ 
+ 	hcd = usb_create_hcd(driver, &dev->dev, pci_name(dev));
+@@ -245,7 +250,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 
+ 	pci_set_master(dev);
+ 
+-	retval = usb_add_hcd(hcd, dev->irq, IRQF_SHARED);
++	retval = usb_add_hcd(hcd, hcd_irq, IRQF_SHARED);
+ 	if (retval != 0)
+ 		goto unmap_registers;
+ 	set_hs_companion(dev, hcd);
+diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
+index 901924a..d433fdf 100644
+--- a/drivers/usb/gadget/udc-core.c
++++ b/drivers/usb/gadget/udc-core.c
+@@ -213,7 +213,7 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
+ 		udc->driver->disconnect(udc->gadget);
+ 		usb_gadget_disconnect(udc->gadget);
+ 		udc->driver->unbind(udc->gadget);
+-		usb_gadget_udc_stop(udc->gadget, udc->driver);
++		usb_gadget_udc_stop(udc->gadget, NULL);
+ 	} else {
+ 		usb_gadget_stop(udc->gadget, udc->driver);
+ 	}
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 53c8be1..2c0350f 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -342,7 +342,7 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
+ 	 * generate interrupts.  Don't even try to enable MSI.
+ 	 */
+ 	if (xhci->quirks & XHCI_BROKEN_MSI)
+-		return 0;
++		goto legacy_irq;
+ 
+ 	/* unregister the legacy interrupt */
+ 	if (hcd->irq)
+@@ -363,6 +363,7 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
+ 		return -EINVAL;
+ 	}
+ 
++ legacy_irq:
+ 	/* fall back to legacy interrupt*/
+ 	ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
+ 			hcd->irq_descr, hcd);
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index cc368c2..c519a31 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -206,8 +206,8 @@ struct xhci_op_regs {
+ /* bits 12:31 are reserved (and should be preserved on writes). */
+ 
+ /* IMAN - Interrupt Management Register */
+-#define IMAN_IP		(1 << 1)
+-#define IMAN_IE		(1 << 0)
++#define IMAN_IE		(1 << 1)
++#define IMAN_IP		(1 << 0)
+ 
+ /* USBSTS - USB status - status bitmasks */
+ /* HC not running - set to 1 when run/stop bit is cleared. */
+diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
+index 1a49ca9..e664bac 100644
+--- a/drivers/usb/serial/garmin_gps.c
++++ b/drivers/usb/serial/garmin_gps.c
+@@ -973,10 +973,7 @@ static void garmin_close(struct usb_serial_port *port)
+ 	if (!serial)
+ 		return;
+ 
+-	mutex_lock(&port->serial->disc_mutex);
+-
+-	if (!port->serial->disconnected)
+-		garmin_clear(garmin_data_p);
++	garmin_clear(garmin_data_p);
+ 
+ 	/* shutdown our urbs */
+ 	usb_kill_urb(port->read_urb);
+@@ -985,8 +982,6 @@ static void garmin_close(struct usb_serial_port *port)
+ 	/* keep reset state so we know that we must start a new session */
+ 	if (garmin_data_p->state != STATE_RESET)
+ 		garmin_data_p->state = STATE_DISCONNECTED;
+-
+-	mutex_unlock(&port->serial->disc_mutex);
+ }
+ 
+ 
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index 3de751d..1f145bf 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -2796,6 +2796,7 @@ static struct usb_serial_driver edgeport_2port_device = {
+ 	.set_termios		= edge_set_termios,
+ 	.tiocmget		= edge_tiocmget,
+ 	.tiocmset		= edge_tiocmset,
++	.get_icount		= edge_get_icount,
+ 	.write			= edge_write,
+ 	.write_room		= edge_write_room,
+ 	.chars_in_buffer	= edge_chars_in_buffer,
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index dc1ce62..2482d5e 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -168,6 +168,7 @@ static void destroy_serial(struct kref *kref)
+ 		}
+ 	}
+ 
++	usb_put_intf(serial->interface);
+ 	usb_put_dev(serial->dev);
+ 	kfree(serial);
+ }
+@@ -624,7 +625,7 @@ static struct usb_serial *create_serial(struct usb_device *dev,
+ 	}
+ 	serial->dev = usb_get_dev(dev);
+ 	serial->type = driver;
+-	serial->interface = interface;
++	serial->interface = usb_get_intf(interface);
+ 	kref_init(&serial->kref);
+ 	mutex_init(&serial->disc_mutex);
+ 	serial->minor = SERIAL_TTY_NO_MINOR;
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index fa8a1b2..7b8d564 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -488,6 +488,13 @@ UNUSUAL_DEV(  0x04e8, 0x5122, 0x0000, 0x9999,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_MAX_SECTORS_64 | US_FL_BULK_IGNORE_TAG),
+ 
++/* Added by Dmitry Artamonow <mad_soft@×××××.ru> */
++UNUSUAL_DEV(  0x04e8, 0x5136, 0x0000, 0x9999,
++		"Samsung",
++		"YP-Z3",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_MAX_SECTORS_64),
++
+ /* Entry and supporting patch by Theodore Kilgore <kilgota@××××××.edu>.
+  * Device uses standards-violating 32-byte Bulk Command Block Wrappers and
+  * reports itself as "Proprietary SCSI Bulk." Cf. device entry 0x084d:0x0011.
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index b76071e..5c58128 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -234,7 +234,8 @@ static void handle_tx(struct vhost_net *net)
+ 				msg.msg_controllen = 0;
+ 				ubufs = NULL;
+ 			} else {
+-				struct ubuf_info *ubuf = &vq->ubuf_info[head];
++				struct ubuf_info *ubuf;
++				ubuf = vq->ubuf_info + vq->upend_idx;
+ 
+ 				vq->heads[vq->upend_idx].len = len;
+ 				ubuf->callback = vhost_zerocopy_callback;
+diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
+index cfd1ce3..1d36db1 100644
+--- a/fs/cifs/asn1.c
++++ b/fs/cifs/asn1.c
+@@ -614,53 +614,10 @@ decode_negTokenInit(unsigned char *security_blob, int length,
+ 		}
+ 	}
+ 
+-	/* mechlistMIC */
+-	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-		/* Check if we have reached the end of the blob, but with
+-		   no mechListMic (e.g. NTLMSSP instead of KRB5) */
+-		if (ctx.error == ASN1_ERR_DEC_EMPTY)
+-			goto decode_negtoken_exit;
+-		cFYI(1, "Error decoding last part negTokenInit exit3");
+-		return 0;
+-	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
+-		/* tag = 3 indicating mechListMIC */
+-		cFYI(1, "Exit 4 cls = %d con = %d tag = %d end = %p (%d)",
+-			cls, con, tag, end, *end);
+-		return 0;
+-	}
+-
+-	/* sequence */
+-	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-		cFYI(1, "Error decoding last part negTokenInit exit5");
+-		return 0;
+-	} else if ((cls != ASN1_UNI) || (con != ASN1_CON)
+-		   || (tag != ASN1_SEQ)) {
+-		cFYI(1, "cls = %d con = %d tag = %d end = %p (%d)",
+-			cls, con, tag, end, *end);
+-	}
+-
+-	/* sequence of */
+-	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-		cFYI(1, "Error decoding last part negTokenInit exit 7");
+-		return 0;
+-	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
+-		cFYI(1, "Exit 8 cls = %d con = %d tag = %d end = %p (%d)",
+-			cls, con, tag, end, *end);
+-		return 0;
+-	}
+-
+-	/* general string */
+-	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-		cFYI(1, "Error decoding last part negTokenInit exit9");
+-		return 0;
+-	} else if ((cls != ASN1_UNI) || (con != ASN1_PRI)
+-		   || (tag != ASN1_GENSTR)) {
+-		cFYI(1, "Exit10 cls = %d con = %d tag = %d end = %p (%d)",
+-			cls, con, tag, end, *end);
+-		return 0;
+-	}
+-	cFYI(1, "Need to call asn1_octets_decode() function for %s",
+-		ctx.pointer);	/* is this UTF-8 or ASCII? */
+-decode_negtoken_exit:
++	/*
++	 * We currently ignore anything at the end of the SPNEGO blob after
++	 * the mechTypes have been parsed, since none of that info is
++	 * used at the moment.
++	 */
+ 	return 1;
+ }
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index b3a2a40..25bb97f 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -90,6 +90,30 @@ extern mempool_t *cifs_sm_req_poolp;
+ extern mempool_t *cifs_req_poolp;
+ extern mempool_t *cifs_mid_poolp;
+ 
++/*
++ * Bumps refcount for cifs super block.
++ * Note that it should be only called if a referece to VFS super block is
++ * already held, e.g. in open-type syscalls context. Otherwise it can race with
++ * atomic_dec_and_test in deactivate_locked_super.
++ */
++void
++cifs_sb_active(struct super_block *sb)
++{
++	struct cifs_sb_info *server = CIFS_SB(sb);
++
++	if (atomic_inc_return(&server->active) == 1)
++		atomic_inc(&sb->s_active);
++}
++
++void
++cifs_sb_deactive(struct super_block *sb)
++{
++	struct cifs_sb_info *server = CIFS_SB(sb);
++
++	if (atomic_dec_and_test(&server->active))
++		deactivate_super(sb);
++}
++
+ static int
+ cifs_read_super(struct super_block *sb)
+ {
+diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
+index 30ff560..c91ea81 100644
+--- a/fs/cifs/cifsfs.h
++++ b/fs/cifs/cifsfs.h
+@@ -41,6 +41,10 @@ extern struct file_system_type cifs_fs_type;
+ extern const struct address_space_operations cifs_addr_ops;
+ extern const struct address_space_operations cifs_addr_ops_smallbuf;
+ 
++/* Functions related to super block operations */
++extern void cifs_sb_active(struct super_block *sb);
++extern void cifs_sb_deactive(struct super_block *sb);
++
+ /* Functions related to inodes */
+ extern const struct inode_operations cifs_dir_inode_ops;
+ extern struct inode *cifs_root_iget(struct super_block *);
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 51574d4..c55808e 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -265,6 +265,8 @@ cifs_new_fileinfo(__u16 fileHandle, struct file *file,
+ 	mutex_init(&pCifsFile->fh_mutex);
+ 	INIT_WORK(&pCifsFile->oplock_break, cifs_oplock_break);
+ 
++	cifs_sb_active(inode->i_sb);
++
+ 	spin_lock(&cifs_file_list_lock);
+ 	list_add(&pCifsFile->tlist, &(tlink_tcon(tlink)->openFileList));
+ 	/* if readable file instance put first in list*/
+@@ -293,7 +295,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
+ 	struct inode *inode = cifs_file->dentry->d_inode;
+ 	struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink);
+ 	struct cifsInodeInfo *cifsi = CIFS_I(inode);
+-	struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
++	struct super_block *sb = inode->i_sb;
++	struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
+ 	struct cifsLockInfo *li, *tmp;
+ 
+ 	spin_lock(&cifs_file_list_lock);
+@@ -345,6 +348,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
+ 
+ 	cifs_put_tlink(cifs_file->tlink);
+ 	dput(cifs_file->dentry);
++	cifs_sb_deactive(sb);
+ 	kfree(cifs_file);
+ }
+ 
+diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
+index 484ffee..2845a1f 100644
+--- a/fs/ext4/balloc.c
++++ b/fs/ext4/balloc.c
+@@ -571,7 +571,7 @@ ext4_fsblk_t ext4_count_free_clusters(struct super_block *sb)
+ 	brelse(bitmap_bh);
+ 	printk(KERN_DEBUG "ext4_count_free_clusters: stored = %llu"
+ 	       ", computed = %llu, %llu\n",
+-	       EXT4_B2C(EXT4_SB(sb), ext4_free_blocks_count(es)),
++	       EXT4_NUM_B2C(EXT4_SB(sb), ext4_free_blocks_count(es)),
+ 	       desc_count, bitmap_count);
+ 	return bitmap_count;
+ #else
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 8cb184c..60b6ca5 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -309,9 +309,9 @@ struct ext4_group_desc
+  */
+ 
+ struct flex_groups {
+-	atomic_t free_inodes;
+-	atomic_t free_clusters;
+-	atomic_t used_dirs;
++	atomic64_t	free_clusters;
++	atomic_t	free_inodes;
++	atomic_t	used_dirs;
+ };
+ 
+ #define EXT4_BG_INODE_UNINIT	0x0001 /* Inode table/bitmap not in use */
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index b48e0dc..ce0bc25 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -2960,6 +2960,7 @@ static int ext4_split_extent(handle_t *handle,
+ 	int err = 0;
+ 	int uninitialized;
+ 	int split_flag1, flags1;
++	int allocated = map->m_len;
+ 
+ 	depth = ext_depth(inode);
+ 	ex = path[depth].p_ext;
+@@ -2979,6 +2980,8 @@ static int ext4_split_extent(handle_t *handle,
+ 				map->m_lblk + map->m_len, split_flag1, flags1);
+ 		if (err)
+ 			goto out;
++	} else {
++		allocated = ee_len - (map->m_lblk - ee_block);
+ 	}
+ 
+ 	ext4_ext_drop_refs(path);
+@@ -3001,7 +3004,7 @@ static int ext4_split_extent(handle_t *handle,
+ 
+ 	ext4_ext_show_leaf(inode, path);
+ out:
+-	return err ? err : map->m_len;
++	return err ? err : allocated;
+ }
+ 
+ #define EXT4_EXT_ZERO_LEN 7
+@@ -3663,6 +3666,7 @@ out:
+ 					allocated - map->m_len);
+ 		allocated = map->m_len;
+ 	}
++	map->m_len = allocated;
+ 
+ 	/*
+ 	 * If we have done fallocate with the offset that is already
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 6266799..6d1f577 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -294,8 +294,8 @@ error_return:
+ }
+ 
+ struct orlov_stats {
++	__u64 free_clusters;
+ 	__u32 free_inodes;
+-	__u32 free_clusters;
+ 	__u32 used_dirs;
+ };
+ 
+@@ -312,7 +312,7 @@ static void get_orlov_stats(struct super_block *sb, ext4_group_t g,
+ 
+ 	if (flex_size > 1) {
+ 		stats->free_inodes = atomic_read(&flex_group[g].free_inodes);
+-		stats->free_clusters = atomic_read(&flex_group[g].free_clusters);
++		stats->free_clusters = atomic64_read(&flex_group[g].free_clusters);
+ 		stats->used_dirs = atomic_read(&flex_group[g].used_dirs);
+ 		return;
+ 	}
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 4b2bb75..3270ffd 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -142,7 +142,8 @@ void ext4_evict_inode(struct inode *inode)
+ 		 * don't use page cache.
+ 		 */
+ 		if (ext4_should_journal_data(inode) &&
+-		    (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode))) {
++		    (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode)) &&
++		    inode->i_ino != EXT4_JOURNAL_INO) {
+ 			journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
+ 			tid_t commit_tid = EXT4_I(inode)->i_datasync_tid;
+ 
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 553ff71..7b18563 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -2866,8 +2866,8 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
+ 	if (sbi->s_log_groups_per_flex) {
+ 		ext4_group_t flex_group = ext4_flex_group(sbi,
+ 							  ac->ac_b_ex.fe_group);
+-		atomic_sub(ac->ac_b_ex.fe_len,
+-			   &sbi->s_flex_groups[flex_group].free_clusters);
++		atomic64_sub(ac->ac_b_ex.fe_len,
++			     &sbi->s_flex_groups[flex_group].free_clusters);
+ 	}
+ 
+ 	err = ext4_handle_dirty_metadata(handle, NULL, bitmap_bh);
+@@ -3485,7 +3485,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
+ 			win = offs;
+ 
+ 		ac->ac_b_ex.fe_logical = ac->ac_o_ex.fe_logical -
+-			EXT4_B2C(sbi, win);
++			EXT4_NUM_B2C(sbi, win);
+ 		BUG_ON(ac->ac_o_ex.fe_logical < ac->ac_b_ex.fe_logical);
+ 		BUG_ON(ac->ac_o_ex.fe_len > ac->ac_b_ex.fe_len);
+ 	}
+@@ -4634,7 +4634,7 @@ do_more:
+ 			EXT4_BLOCKS_PER_GROUP(sb);
+ 		count -= overflow;
+ 	}
+-	count_clusters = EXT4_B2C(sbi, count);
++	count_clusters = EXT4_NUM_B2C(sbi, count);
+ 	bitmap_bh = ext4_read_block_bitmap(sb, block_group);
+ 	if (!bitmap_bh) {
+ 		err = -EIO;
+@@ -4724,8 +4724,8 @@ do_more:
+ 
+ 	if (sbi->s_log_groups_per_flex) {
+ 		ext4_group_t flex_group = ext4_flex_group(sbi, block_group);
+-		atomic_add(count_clusters,
+-			   &sbi->s_flex_groups[flex_group].free_clusters);
++		atomic64_add(count_clusters,
++			     &sbi->s_flex_groups[flex_group].free_clusters);
+ 	}
+ 
+ 	ext4_mb_unload_buddy(&e4b);
+@@ -4865,12 +4865,12 @@ int ext4_group_add_blocks(handle_t *handle, struct super_block *sb,
+ 	desc->bg_checksum = ext4_group_desc_csum(sbi, block_group, desc);
+ 	ext4_unlock_group(sb, block_group);
+ 	percpu_counter_add(&sbi->s_freeclusters_counter,
+-			   EXT4_B2C(sbi, blocks_freed));
++			   EXT4_NUM_B2C(sbi, blocks_freed));
+ 
+ 	if (sbi->s_log_groups_per_flex) {
+ 		ext4_group_t flex_group = ext4_flex_group(sbi, block_group);
+-		atomic_add(EXT4_B2C(sbi, blocks_freed),
+-			   &sbi->s_flex_groups[flex_group].free_clusters);
++		atomic64_add(EXT4_NUM_B2C(sbi, blocks_freed),
++			     &sbi->s_flex_groups[flex_group].free_clusters);
+ 	}
+ 
+ 	ext4_mb_unload_buddy(&e4b);
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 33129c0..6e67b97 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -938,7 +938,7 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
+ 
+ 	/* Update the free space counts */
+ 	percpu_counter_add(&sbi->s_freeclusters_counter,
+-			   EXT4_B2C(sbi, input->free_blocks_count));
++			   EXT4_NUM_B2C(sbi, input->free_blocks_count));
+ 	percpu_counter_add(&sbi->s_freeinodes_counter,
+ 			   EXT4_INODES_PER_GROUP(sb));
+ 
+@@ -946,8 +946,8 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
+ 	    sbi->s_log_groups_per_flex) {
+ 		ext4_group_t flex_group;
+ 		flex_group = ext4_flex_group(sbi, input->group);
+-		atomic_add(EXT4_B2C(sbi, input->free_blocks_count),
+-			   &sbi->s_flex_groups[flex_group].free_clusters);
++		atomic64_add(EXT4_NUM_B2C(sbi, input->free_blocks_count),
++			     &sbi->s_flex_groups[flex_group].free_clusters);
+ 		atomic_add(EXT4_INODES_PER_GROUP(sb),
+ 			   &sbi->s_flex_groups[flex_group].free_inodes);
+ 	}
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 24ac7a2..cc386b2 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2047,8 +2047,8 @@ static int ext4_fill_flex_info(struct super_block *sb)
+ 		flex_group = ext4_flex_group(sbi, i);
+ 		atomic_add(ext4_free_inodes_count(sb, gdp),
+ 			   &sbi->s_flex_groups[flex_group].free_inodes);
+-		atomic_add(ext4_free_group_clusters(sb, gdp),
+-			   &sbi->s_flex_groups[flex_group].free_clusters);
++		atomic64_add(ext4_free_group_clusters(sb, gdp),
++			     &sbi->s_flex_groups[flex_group].free_clusters);
+ 		atomic_add(ext4_used_dirs_count(sb, gdp),
+ 			   &sbi->s_flex_groups[flex_group].used_dirs);
+ 	}
+diff --git a/fs/isofs/export.c b/fs/isofs/export.c
+index 516eb21..fd88add 100644
+--- a/fs/isofs/export.c
++++ b/fs/isofs/export.c
+@@ -135,6 +135,7 @@ isofs_export_encode_fh(struct dentry *dentry,
+ 	len = 3;
+ 	fh32[0] = ei->i_iget5_block;
+  	fh16[2] = (__u16)ei->i_iget5_offset;  /* fh16 [sic] */
++	fh16[3] = 0;  /* avoid leaking uninitialized data */
+ 	fh32[2] = inode->i_generation;
+ 	if (connectable && !S_ISDIR(inode->i_mode)) {
+ 		struct inode *parent;
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index d7dd774..6ac5bb1 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1016,9 +1016,12 @@ out:
+ void jbd2_journal_set_triggers(struct buffer_head *bh,
+ 			       struct jbd2_buffer_trigger_type *type)
+ {
+-	struct journal_head *jh = bh2jh(bh);
++	struct journal_head *jh = jbd2_journal_grab_journal_head(bh);
+ 
++	if (WARN_ON(!jh))
++		return;
+ 	jh->b_triggers = type;
++	jbd2_journal_put_journal_head(jh);
+ }
+ 
+ void jbd2_buffer_frozen_trigger(struct journal_head *jh, void *mapped_data,
+@@ -1070,17 +1073,18 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
+ {
+ 	transaction_t *transaction = handle->h_transaction;
+ 	journal_t *journal = transaction->t_journal;
+-	struct journal_head *jh = bh2jh(bh);
++	struct journal_head *jh;
+ 	int ret = 0;
+ 
+-	jbd_debug(5, "journal_head %p\n", jh);
+-	JBUFFER_TRACE(jh, "entry");
+ 	if (is_handle_aborted(handle))
+ 		goto out;
+-	if (!buffer_jbd(bh)) {
++	jh = jbd2_journal_grab_journal_head(bh);
++	if (!jh) {
+ 		ret = -EUCLEAN;
+ 		goto out;
+ 	}
++	jbd_debug(5, "journal_head %p\n", jh);
++	JBUFFER_TRACE(jh, "entry");
+ 
+ 	jbd_lock_bh_state(bh);
+ 
+@@ -1171,6 +1175,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
+ 	spin_unlock(&journal->j_list_lock);
+ out_unlock_bh:
+ 	jbd_unlock_bh_state(bh);
++	jbd2_journal_put_journal_head(jh);
+ out:
+ 	JBUFFER_TRACE(jh, "exit");
+ 	WARN_ON(ret);	/* All errors are bugs, so dump the stack */
+diff --git a/fs/proc/inode.c b/fs/proc/inode.c
+index 7737c54..00f08b3 100644
+--- a/fs/proc/inode.c
++++ b/fs/proc/inode.c
+@@ -427,12 +427,10 @@ static const struct file_operations proc_reg_file_ops_no_compat = {
+ 
+ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
+ {
+-	struct inode * inode;
++	struct inode *inode = new_inode_pseudo(sb);
+ 
+-	inode = iget_locked(sb, de->low_ino);
+-	if (!inode)
+-		return NULL;
+-	if (inode->i_state & I_NEW) {
++	if (inode) {
++		inode->i_ino = de->low_ino;
+ 		inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
+ 		PROC_I(inode)->fd = 0;
+ 		PROC_I(inode)->pde = de;
+@@ -461,9 +459,7 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
+ 				inode->i_fop = de->proc_fops;
+ 			}
+ 		}
+-		unlock_new_inode(inode);
+-	} else
+-	       pde_put(de);
++	}
+ 	return inode;
+ }			
+ 
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index 4639e13..71c97fb 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -1293,6 +1293,7 @@ static int udf_encode_fh(struct dentry *de, __u32 *fh, int *lenp,
+ 	*lenp = 3;
+ 	fid->udf.block = location.logicalBlockNum;
+ 	fid->udf.partref = location.partitionReferenceNum;
++	fid->udf.parent_partref = 0;
+ 	fid->udf.generation = inode->i_generation;
+ 
+ 	if (connectable && !S_ISDIR(inode->i_mode)) {
+diff --git a/include/asm-generic/signal.h b/include/asm-generic/signal.h
+index 555c0ae..743f7a5 100644
+--- a/include/asm-generic/signal.h
++++ b/include/asm-generic/signal.h
+@@ -99,6 +99,10 @@ typedef unsigned long old_sigset_t;
+ 
+ #include <asm-generic/signal-defs.h>
+ 
++#ifdef SA_RESTORER
++#define __ARCH_HAS_SA_RESTORER
++#endif
++
+ struct sigaction {
+ 	__sighandler_t sa_handler;
+ 	unsigned long sa_flags;
+diff --git a/include/linux/efi.h b/include/linux/efi.h
+index ce95a4b..8469f3f 100644
+--- a/include/linux/efi.h
++++ b/include/linux/efi.h
+@@ -484,7 +484,8 @@ struct efivars {
+ 	 * 1) ->list - adds, removals, reads, writes
+ 	 * 2) ops.[gs]et_variable() calls.
+ 	 * It must not be held when creating sysfs entries or calling kmalloc.
+-	 * ops.get_next_variable() is only called from register_efivars(),
++	 * ops.get_next_variable() is only called from register_efivars()
++	 * or efivar_update_sysfs_entries(),
+ 	 * which is protected by the BKL, so that path is safe.
+ 	 */
+ 	spinlock_t lock;
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index b669be6..9b9b2aa 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -1186,6 +1186,12 @@ static inline void perf_event_disable(struct perf_event *event)		{ }
+ static inline void perf_event_task_tick(void)				{ }
+ #endif
+ 
++#if defined(CONFIG_PERF_EVENTS) && defined(CONFIG_CPU_SUP_INTEL)
++extern void perf_restore_debug_store(void);
++#else
++static inline void perf_restore_debug_store(void)			{ }
++#endif
++
+ #define perf_output_put(handle, x) perf_output_copy((handle), &(x), sizeof(x))
+ 
+ /*
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 53dc7e7..da65890 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -455,7 +455,7 @@ struct sk_buff {
+ 	union {
+ 		__u32		mark;
+ 		__u32		dropcount;
+-		__u32		avail_size;
++		__u32		reserved_tailroom;
+ 	};
+ 
+ 	__u16			vlan_tci;
+@@ -1332,7 +1332,10 @@ static inline int skb_tailroom(const struct sk_buff *skb)
+  */
+ static inline int skb_availroom(const struct sk_buff *skb)
+ {
+-	return skb_is_nonlinear(skb) ? 0 : skb->avail_size - skb->len;
++	if (skb_is_nonlinear(skb))
++		return 0;
++
++	return skb->end - skb->tail - skb->reserved_tailroom;
+ }
+ 
+ /**
+diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
+index 16ff29a..b289bd2 100644
+--- a/include/net/inet_frag.h
++++ b/include/net/inet_frag.h
+@@ -33,6 +33,13 @@ struct inet_frag_queue {
+ 
+ #define INETFRAGS_HASHSZ		64
+ 
++/* averaged:
++ * max_depth = default ipfrag_high_thresh / INETFRAGS_HASHSZ /
++ *	       rounded up (SKB_TRUELEN(0) + sizeof(struct ipq or
++ *	       struct frag_queue))
++ */
++#define INETFRAGS_MAXDEPTH		128
++
+ struct inet_frags {
+ 	struct hlist_head	hash[INETFRAGS_HASHSZ];
+ 	rwlock_t		lock;
+@@ -64,6 +71,8 @@ int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f);
+ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
+ 		struct inet_frags *f, void *key, unsigned int hash)
+ 	__releases(&f->lock);
++void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q,
++				   const char *prefix);
+ 
+ static inline void inet_frag_put(struct inet_frag_queue *q, struct inet_frags *f)
+ {
+diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
+index 10422ef..2124004 100644
+--- a/include/net/ip_fib.h
++++ b/include/net/ip_fib.h
+@@ -129,18 +129,16 @@ struct fib_result_nl {
+ };
+ 
+ #ifdef CONFIG_IP_ROUTE_MULTIPATH
+-
+ #define FIB_RES_NH(res)		((res).fi->fib_nh[(res).nh_sel])
+-
+-#define FIB_TABLE_HASHSZ 2
+-
+ #else /* CONFIG_IP_ROUTE_MULTIPATH */
+-
+ #define FIB_RES_NH(res)		((res).fi->fib_nh[0])
++#endif /* CONFIG_IP_ROUTE_MULTIPATH */
+ 
++#ifdef CONFIG_IP_MULTIPLE_TABLES
+ #define FIB_TABLE_HASHSZ 256
+-
+-#endif /* CONFIG_IP_ROUTE_MULTIPATH */
++#else
++#define FIB_TABLE_HASHSZ 2
++#endif
+ 
+ extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
+ 
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 71e1816..ea76d30 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -481,7 +481,7 @@ flush_signal_handlers(struct task_struct *t, int force_default)
+ 		if (force_default || ka->sa.sa_handler != SIG_IGN)
+ 			ka->sa.sa_handler = SIG_DFL;
+ 		ka->sa.sa_flags = 0;
+-#ifdef SA_RESTORER
++#ifdef __ARCH_HAS_SA_RESTORER
+ 		ka->sa.sa_restorer = NULL;
+ #endif
+ 		sigemptyset(&ka->sa.sa_mask);
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 6c880e8..0943d2a 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2725,8 +2725,8 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
+ 					continue;
+ 			}
+ 
+-			hlist_del(&entry->node);
+-			call_rcu(&entry->rcu, ftrace_free_entry_rcu);
++			hlist_del_rcu(&entry->node);
++			call_rcu_sched(&entry->rcu, ftrace_free_entry_rcu);
+ 		}
+ 	}
+ 	__disable_ftrace_function_probe();
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 5638104..17edb14 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -652,7 +652,7 @@ __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
+ void
+ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
+ {
+-	struct ring_buffer *buf = tr->buffer;
++	struct ring_buffer *buf;
+ 
+ 	if (trace_stop_count)
+ 		return;
+@@ -664,6 +664,7 @@ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
+ 	}
+ 	arch_spin_lock(&ftrace_max_lock);
+ 
++	buf = tr->buffer;
+ 	tr->buffer = max_tr.buffer;
+ 	max_tr.buffer = buf;
+ 
+@@ -2635,11 +2636,25 @@ static int set_tracer_option(struct tracer *trace, char *cmp, int neg)
+ 	return -EINVAL;
+ }
+ 
+-static void set_tracer_flags(unsigned int mask, int enabled)
++/* Some tracers require overwrite to stay enabled */
++int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
++{
++	if (tracer->enabled && (mask & TRACE_ITER_OVERWRITE) && !set)
++		return -1;
++
++	return 0;
++}
++
++int set_tracer_flag(unsigned int mask, int enabled)
+ {
+ 	/* do nothing if flag is already set */
+ 	if (!!(trace_flags & mask) == !!enabled)
+-		return;
++		return 0;
++
++	/* Give the tracer a chance to approve the change */
++	if (current_trace->flag_changed)
++		if (current_trace->flag_changed(current_trace, mask, !!enabled))
++			return -EINVAL;
+ 
+ 	if (enabled)
+ 		trace_flags |= mask;
+@@ -2649,8 +2664,14 @@ static void set_tracer_flags(unsigned int mask, int enabled)
+ 	if (mask == TRACE_ITER_RECORD_CMD)
+ 		trace_event_enable_cmd_record(enabled);
+ 
+-	if (mask == TRACE_ITER_OVERWRITE)
++	if (mask == TRACE_ITER_OVERWRITE) {
+ 		ring_buffer_change_overwrite(global_trace.buffer, enabled);
++#ifdef CONFIG_TRACER_MAX_TRACE
++		ring_buffer_change_overwrite(max_tr.buffer, enabled);
++#endif
++	}
++
++	return 0;
+ }
+ 
+ static ssize_t
+@@ -2660,7 +2681,7 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf,
+ 	char buf[64];
+ 	char *cmp;
+ 	int neg = 0;
+-	int ret;
++	int ret = 0;
+ 	int i;
+ 
+ 	if (cnt >= sizeof(buf))
+@@ -2677,21 +2698,23 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf,
+ 		cmp += 2;
+ 	}
+ 
++	mutex_lock(&trace_types_lock);
++
+ 	for (i = 0; trace_options[i]; i++) {
+ 		if (strcmp(cmp, trace_options[i]) == 0) {
+-			set_tracer_flags(1 << i, !neg);
++			ret = set_tracer_flag(1 << i, !neg);
+ 			break;
+ 		}
+ 	}
+ 
+ 	/* If no option could be set, test the specific tracer options */
+-	if (!trace_options[i]) {
+-		mutex_lock(&trace_types_lock);
++	if (!trace_options[i])
+ 		ret = set_tracer_option(current_trace, cmp, neg);
+-		mutex_unlock(&trace_types_lock);
+-		if (ret)
+-			return ret;
+-	}
++
++	mutex_unlock(&trace_types_lock);
++
++	if (ret)
++		return ret;
+ 
+ 	*ppos += cnt;
+ 
+@@ -3015,6 +3038,9 @@ static int tracing_set_tracer(const char *buf)
+ 		goto out;
+ 
+ 	trace_branch_disable();
++
++	current_trace->enabled = false;
++
+ 	if (current_trace && current_trace->reset)
+ 		current_trace->reset(tr);
+ 	if (current_trace && current_trace->use_max_tr) {
+@@ -3044,6 +3070,7 @@ static int tracing_set_tracer(const char *buf)
+ 			goto out;
+ 	}
+ 
++	current_trace->enabled = true;
+ 	trace_branch_enable(tr);
+  out:
+ 	mutex_unlock(&trace_types_lock);
+@@ -4378,7 +4405,13 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt,
+ 
+ 	if (val != 0 && val != 1)
+ 		return -EINVAL;
+-	set_tracer_flags(1 << index, val);
++
++	mutex_lock(&trace_types_lock);
++	ret = set_tracer_flag(1 << index, val);
++	mutex_unlock(&trace_types_lock);
++
++	if (ret < 0)
++		return ret;
+ 
+ 	*ppos += cnt;
+ 
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index 092e1f8..c3c3f6b 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -271,10 +271,14 @@ struct tracer {
+ 	enum print_line_t	(*print_line)(struct trace_iterator *iter);
+ 	/* If you handled the flag setting, return 0 */
+ 	int			(*set_flag)(u32 old_flags, u32 bit, int set);
++	/* Return 0 if OK with change, else return non-zero */
++	int			(*flag_changed)(struct tracer *tracer,
++						u32 mask, int set);
+ 	struct tracer		*next;
+ 	struct tracer_flags	*flags;
+ 	int			print_max;
+ 	int			use_max_tr;
++	bool			enabled;
+ };
+ 
+ 
+@@ -815,6 +819,9 @@ extern struct list_head ftrace_events;
+ extern const char *__start___trace_bprintk_fmt[];
+ extern const char *__stop___trace_bprintk_fmt[];
+ 
++int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set);
++int set_tracer_flag(unsigned int mask, int enabled);
++
+ #undef FTRACE_ENTRY
+ #define FTRACE_ENTRY(call, struct_name, id, tstruct, print)		\
+ 	extern struct ftrace_event_call					\
+diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
+index 20dad0d..1626e1a 100644
+--- a/kernel/trace/trace_irqsoff.c
++++ b/kernel/trace/trace_irqsoff.c
+@@ -32,7 +32,7 @@ enum {
+ 
+ static int trace_type __read_mostly;
+ 
+-static int save_lat_flag;
++static int save_flags;
+ 
+ static void stop_irqsoff_tracer(struct trace_array *tr, int graph);
+ static int start_irqsoff_tracer(struct trace_array *tr, int graph);
+@@ -546,8 +546,11 @@ static void stop_irqsoff_tracer(struct trace_array *tr, int graph)
+ 
+ static void __irqsoff_tracer_init(struct trace_array *tr)
+ {
+-	save_lat_flag = trace_flags & TRACE_ITER_LATENCY_FMT;
+-	trace_flags |= TRACE_ITER_LATENCY_FMT;
++	save_flags = trace_flags;
++
++	/* non overwrite screws up the latency tracers */
++	set_tracer_flag(TRACE_ITER_OVERWRITE, 1);
++	set_tracer_flag(TRACE_ITER_LATENCY_FMT, 1);
+ 
+ 	tracing_max_latency = 0;
+ 	irqsoff_trace = tr;
+@@ -561,10 +564,13 @@ static void __irqsoff_tracer_init(struct trace_array *tr)
+ 
+ static void irqsoff_tracer_reset(struct trace_array *tr)
+ {
++	int lat_flag = save_flags & TRACE_ITER_LATENCY_FMT;
++	int overwrite_flag = save_flags & TRACE_ITER_OVERWRITE;
++
+ 	stop_irqsoff_tracer(tr, is_graph());
+ 
+-	if (!save_lat_flag)
+-		trace_flags &= ~TRACE_ITER_LATENCY_FMT;
++	set_tracer_flag(TRACE_ITER_LATENCY_FMT, lat_flag);
++	set_tracer_flag(TRACE_ITER_OVERWRITE, overwrite_flag);
+ }
+ 
+ static void irqsoff_tracer_start(struct trace_array *tr)
+@@ -597,6 +603,7 @@ static struct tracer irqsoff_tracer __read_mostly =
+ 	.print_line     = irqsoff_print_line,
+ 	.flags		= &tracer_flags,
+ 	.set_flag	= irqsoff_set_flag,
++	.flag_changed	= trace_keep_overwrite,
+ #ifdef CONFIG_FTRACE_SELFTEST
+ 	.selftest    = trace_selftest_startup_irqsoff,
+ #endif
+@@ -630,6 +637,7 @@ static struct tracer preemptoff_tracer __read_mostly =
+ 	.print_line     = irqsoff_print_line,
+ 	.flags		= &tracer_flags,
+ 	.set_flag	= irqsoff_set_flag,
++	.flag_changed	= trace_keep_overwrite,
+ #ifdef CONFIG_FTRACE_SELFTEST
+ 	.selftest    = trace_selftest_startup_preemptoff,
+ #endif
+@@ -665,6 +673,7 @@ static struct tracer preemptirqsoff_tracer __read_mostly =
+ 	.print_line     = irqsoff_print_line,
+ 	.flags		= &tracer_flags,
+ 	.set_flag	= irqsoff_set_flag,
++	.flag_changed	= trace_keep_overwrite,
+ #ifdef CONFIG_FTRACE_SELFTEST
+ 	.selftest    = trace_selftest_startup_preemptirqsoff,
+ #endif
+diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
+index e4a70c0..6857e0c 100644
+--- a/kernel/trace/trace_sched_wakeup.c
++++ b/kernel/trace/trace_sched_wakeup.c
+@@ -36,7 +36,7 @@ static void __wakeup_reset(struct trace_array *tr);
+ static int wakeup_graph_entry(struct ftrace_graph_ent *trace);
+ static void wakeup_graph_return(struct ftrace_graph_ret *trace);
+ 
+-static int save_lat_flag;
++static int save_flags;
+ 
+ #define TRACE_DISPLAY_GRAPH     1
+ 
+@@ -528,8 +528,11 @@ static void stop_wakeup_tracer(struct trace_array *tr)
+ 
+ static int __wakeup_tracer_init(struct trace_array *tr)
+ {
+-	save_lat_flag = trace_flags & TRACE_ITER_LATENCY_FMT;
+-	trace_flags |= TRACE_ITER_LATENCY_FMT;
++	save_flags = trace_flags;
++
++	/* non overwrite screws up the latency tracers */
++	set_tracer_flag(TRACE_ITER_OVERWRITE, 1);
++	set_tracer_flag(TRACE_ITER_LATENCY_FMT, 1);
+ 
+ 	tracing_max_latency = 0;
+ 	wakeup_trace = tr;
+@@ -551,12 +554,15 @@ static int wakeup_rt_tracer_init(struct trace_array *tr)
+ 
+ static void wakeup_tracer_reset(struct trace_array *tr)
+ {
++	int lat_flag = save_flags & TRACE_ITER_LATENCY_FMT;
++	int overwrite_flag = save_flags & TRACE_ITER_OVERWRITE;
++
+ 	stop_wakeup_tracer(tr);
+ 	/* make sure we put back any tasks we are tracing */
+ 	wakeup_reset(tr);
+ 
+-	if (!save_lat_flag)
+-		trace_flags &= ~TRACE_ITER_LATENCY_FMT;
++	set_tracer_flag(TRACE_ITER_LATENCY_FMT, lat_flag);
++	set_tracer_flag(TRACE_ITER_OVERWRITE, overwrite_flag);
+ }
+ 
+ static void wakeup_tracer_start(struct trace_array *tr)
+@@ -582,6 +588,7 @@ static struct tracer wakeup_tracer __read_mostly =
+ 	.print_line	= wakeup_print_line,
+ 	.flags		= &tracer_flags,
+ 	.set_flag	= wakeup_set_flag,
++	.flag_changed	= trace_keep_overwrite,
+ #ifdef CONFIG_FTRACE_SELFTEST
+ 	.selftest    = trace_selftest_startup_wakeup,
+ #endif
+@@ -603,6 +610,7 @@ static struct tracer wakeup_rt_tracer __read_mostly =
+ 	.print_line	= wakeup_print_line,
+ 	.flags		= &tracer_flags,
+ 	.set_flag	= wakeup_set_flag,
++	.flag_changed	= trace_keep_overwrite,
+ #ifdef CONFIG_FTRACE_SELFTEST
+ 	.selftest    = trace_selftest_startup_wakeup,
+ #endif
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index d6c0fdf..4c7d42a 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2092,8 +2092,12 @@ int hugetlb_report_node_meminfo(int nid, char *buf)
+ /* Return the number pages of memory we physically have, in PAGE_SIZE units. */
+ unsigned long hugetlb_total_pages(void)
+ {
+-	struct hstate *h = &default_hstate;
+-	return h->nr_huge_pages * pages_per_huge_page(h);
++	struct hstate *h;
++	unsigned long nr_total_pages = 0;
++
++	for_each_hstate(h)
++		nr_total_pages += h->nr_huge_pages * pages_per_huge_page(h);
++	return nr_total_pages;
+ }
+ 
+ static int hugetlb_acct_memory(struct hstate *h, long delta)
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 2aac4ec..b23bbbf 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3299,6 +3299,7 @@ ncls:
+ 		}
+ 		switch (rx_handler(&skb)) {
+ 		case RX_HANDLER_CONSUMED:
++			ret = NET_RX_SUCCESS;
+ 			goto out;
+ 		case RX_HANDLER_ANOTHER:
+ 			goto another_round;
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 5229c7f..3b5e680 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -973,6 +973,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
+ 			 * report anything.
+ 			 */
+ 			ivi.spoofchk = -1;
++			memset(ivi.mac, 0, sizeof(ivi.mac));
+ 			if (dev->netdev_ops->ndo_get_vf_config(dev, i, &ivi))
+ 				break;
+ 			vf_mac.vf =
+@@ -2041,7 +2042,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 		struct rtattr *attr = (void *)nlh + NLMSG_ALIGN(min_len);
+ 
+ 		while (RTA_OK(attr, attrlen)) {
+-			unsigned flavor = attr->rta_type;
++			unsigned int flavor = attr->rta_type & NLA_TYPE_MASK;
+ 			if (flavor) {
+ 				if (flavor > rta_max[sz_idx])
+ 					return -EINVAL;
+diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
+index d860530..2f9517d 100644
+--- a/net/dcb/dcbnl.c
++++ b/net/dcb/dcbnl.c
+@@ -336,6 +336,7 @@ static int dcbnl_getperm_hwaddr(struct net_device *netdev, struct nlattr **tb,
+ 	dcb->dcb_family = AF_UNSPEC;
+ 	dcb->cmd = DCB_CMD_GPERM_HWADDR;
+ 
++	memset(perm_addr, 0, sizeof(perm_addr));
+ 	netdev->dcbnl_ops->getpermhwaddr(netdev, perm_addr);
+ 
+ 	ret = nla_put(dcbnl_skb, DCB_ATTR_PERM_HWADDR, sizeof(perm_addr),
+@@ -1238,6 +1239,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
+ 
+ 	if (ops->ieee_getets) {
+ 		struct ieee_ets ets;
++		memset(&ets, 0, sizeof(ets));
+ 		err = ops->ieee_getets(netdev, &ets);
+ 		if (!err)
+ 			NLA_PUT(skb, DCB_ATTR_IEEE_ETS, sizeof(ets), &ets);
+@@ -1245,6 +1247,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
+ 
+ 	if (ops->ieee_getpfc) {
+ 		struct ieee_pfc pfc;
++		memset(&pfc, 0, sizeof(pfc));
+ 		err = ops->ieee_getpfc(netdev, &pfc);
+ 		if (!err)
+ 			NLA_PUT(skb, DCB_ATTR_IEEE_PFC, sizeof(pfc), &pfc);
+@@ -1277,6 +1280,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
+ 	/* get peer info if available */
+ 	if (ops->ieee_peer_getets) {
+ 		struct ieee_ets ets;
++		memset(&ets, 0, sizeof(ets));
+ 		err = ops->ieee_peer_getets(netdev, &ets);
+ 		if (!err)
+ 			NLA_PUT(skb, DCB_ATTR_IEEE_PEER_ETS, sizeof(ets), &ets);
+@@ -1284,6 +1288,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
+ 
+ 	if (ops->ieee_peer_getpfc) {
+ 		struct ieee_pfc pfc;
++		memset(&pfc, 0, sizeof(pfc));
+ 		err = ops->ieee_peer_getpfc(netdev, &pfc);
+ 		if (!err)
+ 			NLA_PUT(skb, DCB_ATTR_IEEE_PEER_PFC, sizeof(pfc), &pfc);
+@@ -1463,6 +1468,7 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
+ 	/* peer info if available */
+ 	if (ops->cee_peer_getpg) {
+ 		struct cee_pg pg;
++		memset(&pg, 0, sizeof(pg));
+ 		err = ops->cee_peer_getpg(netdev, &pg);
+ 		if (!err)
+ 			NLA_PUT(skb, DCB_ATTR_CEE_PEER_PG, sizeof(pg), &pg);
+@@ -1470,6 +1476,7 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
+ 
+ 	if (ops->cee_peer_getpfc) {
+ 		struct cee_pfc pfc;
++		memset(&pfc, 0, sizeof(pfc));
+ 		err = ops->cee_peer_getpfc(netdev, &pfc);
+ 		if (!err)
+ 			NLA_PUT(skb, DCB_ATTR_CEE_PEER_PFC, sizeof(pfc), &pfc);
+diff --git a/net/ieee802154/6lowpan.h b/net/ieee802154/6lowpan.h
+index 5d8cf80..8b0866f 100644
+--- a/net/ieee802154/6lowpan.h
++++ b/net/ieee802154/6lowpan.h
+@@ -87,7 +87,7 @@
+ 	(memcmp(addr1, addr2, length >> 3) == 0)
+ 
+ /* local link, i.e. FE80::/10 */
+-#define is_addr_link_local(a) (((a)->s6_addr16[0]) == 0x80FE)
++#define is_addr_link_local(a) (((a)->s6_addr16[0]) == htons(0xFE80))
+ 
+ /*
+  * check whether we can compress the IID to 16 bits,
+diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
+index 5ff2a51..210b710 100644
+--- a/net/ipv4/inet_fragment.c
++++ b/net/ipv4/inet_fragment.c
+@@ -21,6 +21,7 @@
+ #include <linux/rtnetlink.h>
+ #include <linux/slab.h>
+ 
++#include <net/sock.h>
+ #include <net/inet_frag.h>
+ 
+ static void inet_frag_secret_rebuild(unsigned long dummy)
+@@ -271,6 +272,7 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
+ {
+ 	struct inet_frag_queue *q;
+ 	struct hlist_node *n;
++	int depth = 0;
+ 
+ 	hlist_for_each_entry(q, n, &f->hash[hash], list) {
+ 		if (q->net == nf && f->match(q, key)) {
+@@ -278,9 +280,25 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
+ 			read_unlock(&f->lock);
+ 			return q;
+ 		}
++		depth++;
+ 	}
+ 	read_unlock(&f->lock);
+ 
+-	return inet_frag_create(nf, f, key);
++	if (depth <= INETFRAGS_MAXDEPTH)
++		return inet_frag_create(nf, f, key);
++	else
++		return ERR_PTR(-ENOBUFS);
+ }
+ EXPORT_SYMBOL(inet_frag_find);
++
++void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q,
++				   const char *prefix)
++{
++	static const char msg[] = "inet_frag_find: Fragment hash bucket"
++		" list length grew over limit " __stringify(INETFRAGS_MAXDEPTH)
++		". Dropping fragment.\n";
++
++	if (PTR_ERR(q) == -ENOBUFS)
++		LIMIT_NETDEBUG(KERN_WARNING "%s%s", prefix, msg);
++}
++EXPORT_SYMBOL(inet_frag_maybe_warn_overflow);
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index a4e7131..b2cfe83 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -20,6 +20,8 @@
+  *		Patrick McHardy :	LRU queue of frag heads for evictor.
+  */
+ 
++#define pr_fmt(fmt) "IPv4: " fmt
++
+ #include <linux/compiler.h>
+ #include <linux/module.h>
+ #include <linux/types.h>
+@@ -293,14 +295,12 @@ static inline struct ipq *ip_find(struct net *net, struct iphdr *iph, u32 user)
+ 	hash = ipqhashfn(iph->id, iph->saddr, iph->daddr, iph->protocol);
+ 
+ 	q = inet_frag_find(&net->ipv4.frags, &ip4_frags, &arg, hash);
+-	if (q == NULL)
+-		goto out_nomem;
++	if (IS_ERR_OR_NULL(q)) {
++		inet_frag_maybe_warn_overflow(q, pr_fmt());
++		return NULL;
++	}
+ 
+ 	return container_of(q, struct ipq, q);
+-
+-out_nomem:
+-	LIMIT_NETDEBUG(KERN_ERR "ip_frag_create: no memory left !\n");
+-	return NULL;
+ }
+ 
+ /* Is the fragment too far ahead to be part of ipq? */
+diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
+index 42dd1a9..40eb4fc 100644
+--- a/net/ipv4/ip_options.c
++++ b/net/ipv4/ip_options.c
+@@ -358,7 +358,6 @@ int ip_options_compile(struct net *net,
+ 				}
+ 				switch (optptr[3]&0xF) {
+ 				      case IPOPT_TS_TSONLY:
+-					opt->ts = optptr - iph;
+ 					if (skb)
+ 						timeptr = &optptr[optptr[2]-1];
+ 					opt->ts_needtime = 1;
+@@ -369,7 +368,6 @@ int ip_options_compile(struct net *net,
+ 						pp_ptr = optptr + 2;
+ 						goto error;
+ 					}
+-					opt->ts = optptr - iph;
+ 					if (rt)  {
+ 						memcpy(&optptr[optptr[2]-1], &rt->rt_spec_dst, 4);
+ 						timeptr = &optptr[optptr[2]+3];
+@@ -383,7 +381,6 @@ int ip_options_compile(struct net *net,
+ 						pp_ptr = optptr + 2;
+ 						goto error;
+ 					}
+-					opt->ts = optptr - iph;
+ 					{
+ 						__be32 addr;
+ 						memcpy(&addr, &optptr[optptr[2]-1], 4);
+@@ -416,12 +413,12 @@ int ip_options_compile(struct net *net,
+ 					pp_ptr = optptr + 3;
+ 					goto error;
+ 				}
+-				opt->ts = optptr - iph;
+ 				if (skb) {
+ 					optptr[3] = (optptr[3]&0xF)|((overflow+1)<<4);
+ 					opt->is_changed = 1;
+ 				}
+ 			}
++			opt->ts = optptr - iph;
+ 			break;
+ 		      case IPOPT_RA:
+ 			if (optlen < 4) {
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 52edbb8..fe381c2 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -704,7 +704,7 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
+ 			 * Make sure that we have exactly size bytes
+ 			 * available to the caller, no more, no less.
+ 			 */
+-			skb->avail_size = size;
++			skb->reserved_tailroom = skb->end - skb->tail - size;
+ 			return skb;
+ 		}
+ 		__kfree_skb(skb);
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index e865ed1..1b1f7af 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -5494,6 +5494,9 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
+ 				if (tcp_checksum_complete_user(sk, skb))
+ 					goto csum_error;
+ 
++				if ((int)skb->truesize > sk->sk_forward_alloc)
++					goto step5;
++
+ 				/* Predicted packet is in window by definition.
+ 				 * seq == rcv_nxt and rcv_wup <= rcv_nxt.
+ 				 * Hence, check seq<=rcv_wup reduces to:
+@@ -5505,9 +5508,6 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
+ 
+ 				tcp_rcv_rtt_measure_ts(sk, skb);
+ 
+-				if ((int)skb->truesize > sk->sk_forward_alloc)
+-					goto step5;
+-
+ 				NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPHPHITS);
+ 
+ 				/* Bulk data transfer: receiver */
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 921cbac..9bb7400 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1096,7 +1096,6 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
+ 	eat = min_t(int, len, skb_headlen(skb));
+ 	if (eat) {
+ 		__skb_pull(skb, eat);
+-		skb->avail_size -= eat;
+ 		len -= eat;
+ 		if (!len)
+ 			return;
+diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
+index a46c64e..f8d24dd 100644
+--- a/net/ipv6/ip6_input.c
++++ b/net/ipv6/ip6_input.c
+@@ -265,7 +265,8 @@ int ip6_mc_input(struct sk_buff *skb)
+ 	 *      IPv6 multicast router mode is now supported ;)
+ 	 */
+ 	if (dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding &&
+-	    !(ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) &&
++	    !(ipv6_addr_type(&hdr->daddr) &
++	      (IPV6_ADDR_LOOPBACK|IPV6_ADDR_LINKLOCAL)) &&
+ 	    likely(!(IP6CB(skb)->flags & IP6SKB_FORWARDED))) {
+ 		/*
+ 		 * Okay, we try to forward - split and duplicate
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index 38f00b0..52e2f65 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -14,6 +14,8 @@
+  * 2 of the License, or (at your option) any later version.
+  */
+ 
++#define pr_fmt(fmt) "IPv6-nf: " fmt
++
+ #include <linux/errno.h>
+ #include <linux/types.h>
+ #include <linux/string.h>
+@@ -176,13 +178,12 @@ fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst)
+ 
+ 	q = inet_frag_find(&nf_init_frags, &nf_frags, &arg, hash);
+ 	local_bh_enable();
+-	if (q == NULL)
+-		goto oom;
++	if (IS_ERR_OR_NULL(q)) {
++		inet_frag_maybe_warn_overflow(q, pr_fmt());
++		return NULL;
++	}
+ 
+ 	return container_of(q, struct nf_ct_frag6_queue, q);
+-
+-oom:
+-	return NULL;
+ }
+ 
+ 
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index dfb164e..2b0a4ca 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -26,6 +26,9 @@
+  *	YOSHIFUJI,H. @USAGI	Always remove fragment header to
+  *				calculate ICV correctly.
+  */
++
++#define pr_fmt(fmt) "IPv6: " fmt
++
+ #include <linux/errno.h>
+ #include <linux/types.h>
+ #include <linux/string.h>
+@@ -240,9 +243,10 @@ fq_find(struct net *net, __be32 id, const struct in6_addr *src, const struct in6
+ 	hash = inet6_hash_frag(id, src, dst, ip6_frags.rnd);
+ 
+ 	q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);
+-	if (q == NULL)
++	if (IS_ERR_OR_NULL(q)) {
++		inet_frag_maybe_warn_overflow(q, pr_fmt());
+ 		return NULL;
+-
++	}
+ 	return container_of(q, struct frag_queue, q);
+ }
+ 
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 791c1fa..18ea73c 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1920,7 +1920,8 @@ void rt6_purge_dflt_routers(struct net *net)
+ restart:
+ 	read_lock_bh(&table->tb6_lock);
+ 	for (rt = table->tb6_root.leaf; rt; rt = rt->dst.rt6_next) {
+-		if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) {
++		if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF) &&
++		    (!rt->rt6i_idev || rt->rt6i_idev->cnf.accept_ra != 2)) {
+ 			dst_hold(&rt->dst);
+ 			read_unlock_bh(&table->tb6_lock);
+ 			ip6_del_rt(rt);
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index b1bd16f..6f60175 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -360,6 +360,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
+ 	l2tp_xmit_skb(session, skb, session->hdr_len);
+ 
+ 	sock_put(ps->tunnel_sock);
++	sock_put(sk);
+ 
+ 	return error;
+ 
+diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
+index d463f5a..23267b3 100644
+--- a/net/netlabel/netlabel_unlabeled.c
++++ b/net/netlabel/netlabel_unlabeled.c
+@@ -1189,8 +1189,6 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
+ 	struct netlbl_unlhsh_walk_arg cb_arg;
+ 	u32 skip_bkt = cb->args[0];
+ 	u32 skip_chain = cb->args[1];
+-	u32 skip_addr4 = cb->args[2];
+-	u32 skip_addr6 = cb->args[3];
+ 	u32 iter_bkt;
+ 	u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
+ 	struct netlbl_unlhsh_iface *iface;
+@@ -1215,7 +1213,7 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
+ 				continue;
+ 			netlbl_af4list_foreach_rcu(addr4,
+ 						   &iface->addr4_list) {
+-				if (iter_addr4++ < skip_addr4)
++				if (iter_addr4++ < cb->args[2])
+ 					continue;
+ 				if (netlbl_unlabel_staticlist_gen(
+ 					      NLBL_UNLABEL_C_STATICLIST,
+@@ -1231,7 +1229,7 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
+ #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+ 			netlbl_af6list_foreach_rcu(addr6,
+ 						   &iface->addr6_list) {
+-				if (iter_addr6++ < skip_addr6)
++				if (iter_addr6++ < cb->args[3])
+ 					continue;
+ 				if (netlbl_unlabel_staticlist_gen(
+ 					      NLBL_UNLABEL_C_STATICLIST,
+@@ -1250,10 +1248,10 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
+ 
+ unlabel_staticlist_return:
+ 	rcu_read_unlock();
+-	cb->args[0] = skip_bkt;
+-	cb->args[1] = skip_chain;
+-	cb->args[2] = skip_addr4;
+-	cb->args[3] = skip_addr6;
++	cb->args[0] = iter_bkt;
++	cb->args[1] = iter_chain;
++	cb->args[2] = iter_addr4;
++	cb->args[3] = iter_addr6;
+ 	return skb->len;
+ }
+ 
+@@ -1273,12 +1271,9 @@ static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
+ {
+ 	struct netlbl_unlhsh_walk_arg cb_arg;
+ 	struct netlbl_unlhsh_iface *iface;
+-	u32 skip_addr4 = cb->args[0];
+-	u32 skip_addr6 = cb->args[1];
+-	u32 iter_addr4 = 0;
++	u32 iter_addr4 = 0, iter_addr6 = 0;
+ 	struct netlbl_af4list *addr4;
+ #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+-	u32 iter_addr6 = 0;
+ 	struct netlbl_af6list *addr6;
+ #endif
+ 
+@@ -1292,7 +1287,7 @@ static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
+ 		goto unlabel_staticlistdef_return;
+ 
+ 	netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) {
+-		if (iter_addr4++ < skip_addr4)
++		if (iter_addr4++ < cb->args[0])
+ 			continue;
+ 		if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
+ 					      iface,
+@@ -1305,7 +1300,7 @@ static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
+ 	}
+ #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+ 	netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) {
+-		if (iter_addr6++ < skip_addr6)
++		if (iter_addr6++ < cb->args[1])
+ 			continue;
+ 		if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
+ 					      iface,
+@@ -1320,8 +1315,8 @@ static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
+ 
+ unlabel_staticlistdef_return:
+ 	rcu_read_unlock();
+-	cb->args[0] = skip_addr4;
+-	cb->args[1] = skip_addr6;
++	cb->args[0] = iter_addr4;
++	cb->args[1] = iter_addr6;
+ 	return skb->len;
+ }
+ 
+diff --git a/net/rds/message.c b/net/rds/message.c
+index f0a4658..aff589c 100644
+--- a/net/rds/message.c
++++ b/net/rds/message.c
+@@ -197,6 +197,9 @@ struct rds_message *rds_message_alloc(unsigned int extra_len, gfp_t gfp)
+ {
+ 	struct rds_message *rm;
+ 
++	if (extra_len > KMALLOC_MAX_SIZE - sizeof(struct rds_message))
++		return NULL;
++
+ 	rm = kzalloc(sizeof(struct rds_message) + extra_len, gfp);
+ 	if (!rm)
+ 		goto out;
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index acd2edb..3c04692 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1050,7 +1050,7 @@ struct sctp_transport *sctp_assoc_lookup_tsn(struct sctp_association *asoc,
+ 			transports) {
+ 
+ 		if (transport == active)
+-			break;
++			continue;
+ 		list_for_each_entry(chunk, &transport->transmitted,
+ 				transmitted_list) {
+ 			if (key == chunk->subh.data_hdr->tsn) {
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 891f5db..cb1c430 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -2044,7 +2044,7 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
+ 	}
+ 
+ 	/* Delete the tempory new association. */
+-	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
++	sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC, SCTP_ASOC(new_asoc));
+ 	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
+ 
+ 	/* Restore association pointer to provide SCTP command interpeter
+diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
+index 48665ec..8ab2951 100644
+--- a/security/selinux/xfrm.c
++++ b/security/selinux/xfrm.c
+@@ -310,7 +310,7 @@ int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
+ 
+ 	if (old_ctx) {
+ 		new_ctx = kmalloc(sizeof(*old_ctx) + old_ctx->ctx_len,
+-				  GFP_KERNEL);
++				  GFP_ATOMIC);
+ 		if (!new_ctx)
+ 			return -ENOMEM;
+ 
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index b0187e7..7747d26 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2771,7 +2771,7 @@ static unsigned int convert_to_spdif_status(unsigned short val)
+ 	if (val & AC_DIG1_PROFESSIONAL)
+ 		sbits |= IEC958_AES0_PROFESSIONAL;
+ 	if (sbits & IEC958_AES0_PROFESSIONAL) {
+-		if (sbits & AC_DIG1_EMPHASIS)
++		if (val & AC_DIG1_EMPHASIS)
+ 			sbits |= IEC958_AES0_PRO_EMPHASIS_5015;
+ 	} else {
+ 		if (val & AC_DIG1_EMPHASIS)
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index c9269ce..984b5b1 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1236,7 +1236,7 @@ static int patch_cxt5045(struct hda_codec *codec)
+ 	}
+ 
+ 	if (spec->beep_amp)
+-		snd_hda_attach_beep_device(codec, spec->beep_amp);
++		snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
+ 
+ 	return 0;
+ }
+@@ -2027,7 +2027,7 @@ static int patch_cxt5051(struct hda_codec *codec)
+ 	}
+ 
+ 	if (spec->beep_amp)
+-		snd_hda_attach_beep_device(codec, spec->beep_amp);
++		snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
+ 
+ 	conexant_init_jacks(codec);
+ 	if (spec->auto_mic & AUTO_MIC_PORTB)
+@@ -3225,7 +3225,7 @@ static int patch_cxt5066(struct hda_codec *codec)
+ 	}
+ 
+ 	if (spec->beep_amp)
+-		snd_hda_attach_beep_device(codec, spec->beep_amp);
++		snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
+ 
+ 	return 0;
+ }
+@@ -4556,7 +4556,7 @@ static int patch_conexant_auto(struct hda_codec *codec)
+ 	spec->capture_stream = &cx_auto_pcm_analog_capture;
+ 	codec->patch_ops = cx_auto_patch_ops;
+ 	if (spec->beep_amp)
+-		snd_hda_attach_beep_device(codec, spec->beep_amp);
++		snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
+ 	return 0;
+ }
+ 
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 9121dee..f4540bf 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -711,8 +711,9 @@ static int check_input_term(struct mixer_build *state, int id, struct usb_audio_
+ 		case UAC2_CLOCK_SELECTOR: {
+ 			struct uac_selector_unit_descriptor *d = p1;
+ 			/* call recursively to retrieve the channel info */
+-			if (check_input_term(state, d->baSourceID[0], term) < 0)
+-				return -ENODEV;
++			err = check_input_term(state, d->baSourceID[0], term);
++			if (err < 0)
++				return err;
+ 			term->type = d->bDescriptorSubtype << 16; /* virtual type */
+ 			term->id = id;
+ 			term->name = uac_selector_unit_iSelector(d);
+@@ -1263,8 +1264,9 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void
+ 		return err;
+ 
+ 	/* determine the input source type and name */
+-	if (check_input_term(state, hdr->bSourceID, &iterm) < 0)
+-		return -EINVAL;
++	err = check_input_term(state, hdr->bSourceID, &iterm);
++	if (err < 0)
++		return err;
+ 
+ 	master_bits = snd_usb_combine_bytes(bmaControls, csize);
+ 	/* master configuration quirks */
+@@ -2018,7 +2020,7 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
+ 			state.oterm.type = le16_to_cpu(desc->wTerminalType);
+ 			state.oterm.name = desc->iTerminal;
+ 			err = parse_audio_unit(&state, desc->bSourceID);
+-			if (err < 0)
++			if (err < 0 && err != -EINVAL)
+ 				return err;
+ 		} else { /* UAC_VERSION_2 */
+ 			struct uac2_output_terminal_descriptor *desc = p;
+@@ -2030,12 +2032,12 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
+ 			state.oterm.type = le16_to_cpu(desc->wTerminalType);
+ 			state.oterm.name = desc->iTerminal;
+ 			err = parse_audio_unit(&state, desc->bSourceID);
+-			if (err < 0)
++			if (err < 0 && err != -EINVAL)
+ 				return err;
+ 
+ 			/* for UAC2, use the same approach to also add the clock selectors */
+ 			err = parse_audio_unit(&state, desc->bCSourceID);
+-			if (err < 0)
++			if (err < 0 && err != -EINVAL)
+ 				return err;
+ 		}
+ 	}
+diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
+index 0961d88..5e19410 100644
+--- a/tools/hv/hv_kvp_daemon.c
++++ b/tools/hv/hv_kvp_daemon.c
+@@ -393,13 +393,19 @@ int main(void)
+ 		len = recvfrom(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0,
+ 				addr_p, &addr_l);
+ 
+-		if (len < 0 || addr.nl_pid) {
++		if (len < 0) {
+ 			syslog(LOG_ERR, "recvfrom failed; pid:%u error:%d %s",
+ 					addr.nl_pid, errno, strerror(errno));
+ 			close(fd);
+ 			return -1;
+ 		}
+ 
++		if (addr.nl_pid) {
++			syslog(LOG_WARNING, "Received packet from untrusted pid:%u",
++					addr.nl_pid);
++			continue;
++		}
++
+ 		incoming_msg = (struct nlmsghdr *)kvp_recv_buffer;
+ 		incoming_cn_msg = (struct cn_msg *)NLMSG_DATA(incoming_msg);
+ 
+diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
+index bf54c48..6c164dc 100644
+--- a/tools/perf/util/trace-event-parse.c
++++ b/tools/perf/util/trace-event-parse.c
+@@ -1582,8 +1582,6 @@ process_symbols(struct event *event, struct print_arg *arg, char **tok)
+ 	field = malloc_or_die(sizeof(*field));
+ 
+ 	type = process_arg(event, field, &token);
+-	while (type == EVENT_OP)
+-		type = process_op(event, field, &token);
+ 	if (test_type_token(type, token, EVENT_DELIM, ","))
+ 		goto out_free;
+ 

Modified: genpatches-2.6/trunk/3.4/0000_README
===================================================================
--- genpatches-2.6/trunk/3.4/0000_README	2013-03-30 11:08:52 UTC (rev 2326)
+++ genpatches-2.6/trunk/3.4/0000_README	2013-03-31 21:28:05 UTC (rev 2327)
@@ -187,6 +187,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.4.37
 
+Patch:  1037_linux-3.4.38.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.4.38
+
 Patch:  1700_correct-bnx2-firware-ver-mips.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=424609
 Desc:   Correct firmware version for bnx2 on mips

Added: genpatches-2.6/trunk/3.4/1037_linux-3.4.38.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1037_linux-3.4.38.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.4/1037_linux-3.4.38.patch	2013-03-31 21:28:05 UTC (rev 2327)
@@ -0,0 +1,2688 @@
+diff --git a/Makefile b/Makefile
+index a9e4d61..255e00b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 37
++SUBLEVEL = 38
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
+index 0d0326f..d70b9a5 100644
+--- a/arch/x86/lib/usercopy_64.c
++++ b/arch/x86/lib/usercopy_64.c
+@@ -120,10 +120,10 @@ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
+ 	char c;
+ 	unsigned zero_len;
+ 
+-	for (; len; --len) {
++	for (; len; --len, to++) {
+ 		if (__get_user_nocheck(c, from++, sizeof(char)))
+ 			break;
+-		if (__put_user_nocheck(c, to++, sizeof(char)))
++		if (__put_user_nocheck(c, to, sizeof(char)))
+ 			break;
+ 	}
+ 
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 384edc6..8b77fd3 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -836,7 +836,7 @@ static struct drm_display_mode *drm_mode_detailed(struct drm_device *dev,
+ 	unsigned vblank = (pt->vactive_vblank_hi & 0xf) << 8 | pt->vblank_lo;
+ 	unsigned hsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc0) << 2 | pt->hsync_offset_lo;
+ 	unsigned hsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 0x30) << 4 | pt->hsync_pulse_width_lo;
+-	unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) >> 2 | pt->vsync_offset_pulse_width_lo >> 4;
++	unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) << 2 | pt->vsync_offset_pulse_width_lo >> 4;
+ 	unsigned vsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 0x3) << 4 | (pt->vsync_offset_pulse_width_lo & 0xf);
+ 
+ 	/* ignore tiny modes */
+@@ -917,6 +917,7 @@ set_size:
+ 	}
+ 
+ 	mode->type = DRM_MODE_TYPE_DRIVER;
++	mode->vrefresh = drm_mode_vrefresh(mode);
+ 	drm_mode_set_name(mode);
+ 
+ 	return mode;
+diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
+index e6162a1..34791fb 100644
+--- a/drivers/gpu/drm/i915/i915_debugfs.c
++++ b/drivers/gpu/drm/i915/i915_debugfs.c
+@@ -122,7 +122,7 @@ static const char *cache_level_str(int type)
+ static void
+ describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
+ {
+-	seq_printf(m, "%p: %s%s %8zdKiB %04x %04x %d %d%s%s%s",
++	seq_printf(m, "%pK: %s%s %8zdKiB %04x %04x %d %d%s%s%s",
+ 		   &obj->base,
+ 		   get_pin_flag(obj),
+ 		   get_tiling_flag(obj),
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index d4417e3..e97ed61 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -957,15 +957,20 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
+ 		   int count)
+ {
+ 	int i;
++	int relocs_total = 0;
++	int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
+ 
+ 	for (i = 0; i < count; i++) {
+ 		char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
+ 		int length; /* limited by fault_in_pages_readable() */
+ 
+-		/* First check for malicious input causing overflow */
+-		if (exec[i].relocation_count >
+-		    INT_MAX / sizeof(struct drm_i915_gem_relocation_entry))
++		/* First check for malicious input causing overflow in
++		 * the worst case where we need to allocate the entire
++		 * relocation tree as a single array.
++		 */
++		if (exec[i].relocation_count > relocs_max - relocs_total)
+ 			return -EINVAL;
++		relocs_total += exec[i].relocation_count;
+ 
+ 		length = exec[i].relocation_count *
+ 			sizeof(struct drm_i915_gem_relocation_entry);
+diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
+index 289140b..cffb007 100644
+--- a/drivers/gpu/drm/i915/intel_opregion.c
++++ b/drivers/gpu/drm/i915/intel_opregion.c
+@@ -419,6 +419,25 @@ blind_set:
+ 	goto end;
+ }
+ 
++static void intel_setup_cadls(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++	struct intel_opregion *opregion = &dev_priv->opregion;
++	int i = 0;
++	u32 disp_id;
++
++	/* Initialize the CADL field by duplicating the DIDL values.
++	 * Technically, this is not always correct as display outputs may exist,
++	 * but not active. This initialization is necessary for some Clevo
++	 * laptops that check this field before processing the brightness and
++	 * display switching hotkeys. Just like DIDL, CADL is NULL-terminated if
++	 * there are less than eight devices. */
++	do {
++		disp_id = ioread32(&opregion->acpi->didl[i]);
++		iowrite32(disp_id, &opregion->acpi->cadl[i]);
++	} while (++i < 8 && disp_id != 0);
++}
++
+ void intel_opregion_init(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -428,8 +447,10 @@ void intel_opregion_init(struct drm_device *dev)
+ 		return;
+ 
+ 	if (opregion->acpi) {
+-		if (drm_core_check_feature(dev, DRIVER_MODESET))
++		if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+ 			intel_didl_outputs(dev);
++			intel_setup_cadls(dev);
++		}
+ 
+ 		/* Notify BIOS we are ready to handle ACPI video ext notifs.
+ 		 * Right now, all the events are handled by the ACPI video module.
+diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
+index 9934c9d..7dffc57 100644
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -663,13 +663,19 @@ static void cayman_gpu_init(struct radeon_device *rdev)
+ 		    (rdev->pdev->device == 0x9907) ||
+ 		    (rdev->pdev->device == 0x9908) ||
+ 		    (rdev->pdev->device == 0x9909) ||
++		    (rdev->pdev->device == 0x990B) ||
++		    (rdev->pdev->device == 0x990C) ||
++		    (rdev->pdev->device == 0x990F) ||
+ 		    (rdev->pdev->device == 0x9910) ||
+-		    (rdev->pdev->device == 0x9917)) {
++		    (rdev->pdev->device == 0x9917) ||
++		    (rdev->pdev->device == 0x9999)) {
+ 			rdev->config.cayman.max_simds_per_se = 6;
+ 			rdev->config.cayman.max_backends_per_se = 2;
+ 		} else if ((rdev->pdev->device == 0x9903) ||
+ 			   (rdev->pdev->device == 0x9904) ||
+ 			   (rdev->pdev->device == 0x990A) ||
++			   (rdev->pdev->device == 0x990D) ||
++			   (rdev->pdev->device == 0x990E) ||
+ 			   (rdev->pdev->device == 0x9913) ||
+ 			   (rdev->pdev->device == 0x9918)) {
+ 			rdev->config.cayman.max_simds_per_se = 4;
+@@ -678,6 +684,9 @@ static void cayman_gpu_init(struct radeon_device *rdev)
+ 			   (rdev->pdev->device == 0x9990) ||
+ 			   (rdev->pdev->device == 0x9991) ||
+ 			   (rdev->pdev->device == 0x9994) ||
++			   (rdev->pdev->device == 0x9995) ||
++			   (rdev->pdev->device == 0x9996) ||
++			   (rdev->pdev->device == 0x999A) ||
+ 			   (rdev->pdev->device == 0x99A0)) {
+ 			rdev->config.cayman.max_simds_per_se = 3;
+ 			rdev->config.cayman.max_backends_per_se = 1;
+diff --git a/drivers/gpu/drm/radeon/radeon_benchmark.c b/drivers/gpu/drm/radeon/radeon_benchmark.c
+index fef7b72..89a0eec 100644
+--- a/drivers/gpu/drm/radeon/radeon_benchmark.c
++++ b/drivers/gpu/drm/radeon/radeon_benchmark.c
+@@ -141,13 +141,15 @@ static void radeon_benchmark_move(struct radeon_device *rdev, unsigned size,
+ 						     sdomain, ddomain, "dma");
+ 	}
+ 
+-	time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
+-					RADEON_BENCHMARK_COPY_BLIT, n);
+-	if (time < 0)
+-		goto out_cleanup;
+-	if (time > 0)
+-		radeon_benchmark_log_results(n, size, time,
+-					     sdomain, ddomain, "blit");
++	if (rdev->asic->copy.blit) {
++		time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
++						RADEON_BENCHMARK_COPY_BLIT, n);
++		if (time < 0)
++			goto out_cleanup;
++		if (time > 0)
++			radeon_benchmark_log_results(n, size, time,
++						     sdomain, ddomain, "blit");
++	}
+ 
+ out_cleanup:
+ 	if (sobj) {
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index 014504d..3767853 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -755,9 +755,13 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
+ 		if (++priv->tx_outstanding == ipoib_sendq_size) {
+ 			ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n",
+ 				  tx->qp->qp_num);
+-			if (ib_req_notify_cq(priv->send_cq, IB_CQ_NEXT_COMP))
+-				ipoib_warn(priv, "request notify on send CQ failed\n");
+ 			netif_stop_queue(dev);
++			rc = ib_req_notify_cq(priv->send_cq,
++				IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS);
++			if (rc < 0)
++				ipoib_warn(priv, "request notify on send CQ failed\n");
++			else if (rc)
++				ipoib_send_comp_handler(priv->send_cq, dev);
+ 		}
+ 	}
+ }
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 6df52c9..dadf337 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1737,6 +1737,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ 
+ 	bond_compute_features(bond);
+ 
++	bond_update_speed_duplex(new_slave);
++
+ 	read_lock(&bond->lock);
+ 
+ 	new_slave->last_arp_rx = jiffies;
+@@ -1780,8 +1782,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ 		new_slave->link  = BOND_LINK_DOWN;
+ 	}
+ 
+-	bond_update_speed_duplex(new_slave);
+-
+ 	if (USES_PRIMARY(bond->params.mode) && bond->params.primary[0]) {
+ 		/* if there is a primary slave, remember it */
+ 		if (strcmp(bond->params.primary, new_slave->dev->name) == 0) {
+@@ -2462,8 +2462,6 @@ static void bond_miimon_commit(struct bonding *bond)
+ 				bond_set_backup_slave(slave);
+ 			}
+ 
+-			bond_update_speed_duplex(slave);
+-
+ 			pr_info("%s: link status definitely up for interface %s, %u Mbps %s duplex.\n",
+ 				bond->dev->name, slave->dev->name,
+ 				slave->speed, slave->duplex ? "full" : "half");
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
+index 2b46e1e..5905caa 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
+@@ -439,8 +439,9 @@ struct bnx2x_fw_port_stats_old {
+ 
+ #define UPDATE_QSTAT(s, t) \
+ 	do { \
+-		qstats->t##_hi = qstats_old->t##_hi + le32_to_cpu(s.hi); \
+ 		qstats->t##_lo = qstats_old->t##_lo + le32_to_cpu(s.lo); \
++		qstats->t##_hi = qstats_old->t##_hi + le32_to_cpu(s.hi) \
++			+ ((qstats->t##_lo < qstats_old->t##_lo) ? 1 : 0); \
+ 	} while (0)
+ 
+ #define UPDATE_QSTAT_OLD(f) \
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index e143d8c..15ed91f 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -3946,6 +3946,14 @@ static void tg3_phy_copper_begin(struct tg3 *tp)
+ 		tp->link_config.active_speed = tp->link_config.speed;
+ 		tp->link_config.active_duplex = tp->link_config.duplex;
+ 
++		if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5714) {
++			/* With autoneg disabled, 5715 only links up when the
++			 * advertisement register has the configured speed
++			 * enabled.
++			 */
++			tg3_writephy(tp, MII_ADVERTISE, ADVERTISE_ALL);
++		}
++
+ 		bmcr = 0;
+ 		switch (tp->link_config.speed) {
+ 		default:
+diff --git a/drivers/net/ethernet/sfc/bitfield.h b/drivers/net/ethernet/sfc/bitfield.h
+index b26a954..5400a33 100644
+--- a/drivers/net/ethernet/sfc/bitfield.h
++++ b/drivers/net/ethernet/sfc/bitfield.h
+@@ -120,10 +120,10 @@ typedef union efx_oword {
+  * [0,high-low), with garbage in bits [high-low+1,...).
+  */
+ #define EFX_EXTRACT_NATIVE(native_element, min, max, low, high)		\
+-	(((low > max) || (high < min)) ? 0 :				\
+-	 ((low > min) ?							\
+-	  ((native_element) >> (low - min)) :				\
+-	  ((native_element) << (min - low))))
++	((low) > (max) || (high) < (min) ? 0 :				\
++	 (low) > (min) ?						\
++	 (native_element) >> ((low) - (min)) :				\
++	 (native_element) << ((min) - (low)))
+ 
+ /*
+  * Extract bit field portion [low,high) from the 64-bit little-endian
+@@ -142,27 +142,27 @@ typedef union efx_oword {
+ #define EFX_EXTRACT_OWORD64(oword, low, high)				\
+ 	((EFX_EXTRACT64((oword).u64[0], 0, 63, low, high) |		\
+ 	  EFX_EXTRACT64((oword).u64[1], 64, 127, low, high)) &		\
+-	 EFX_MASK64(high + 1 - low))
++	 EFX_MASK64((high) + 1 - (low)))
+ 
+ #define EFX_EXTRACT_QWORD64(qword, low, high)				\
+ 	(EFX_EXTRACT64((qword).u64[0], 0, 63, low, high) &		\
+-	 EFX_MASK64(high + 1 - low))
++	 EFX_MASK64((high) + 1 - (low)))
+ 
+ #define EFX_EXTRACT_OWORD32(oword, low, high)				\
+ 	((EFX_EXTRACT32((oword).u32[0], 0, 31, low, high) |		\
+ 	  EFX_EXTRACT32((oword).u32[1], 32, 63, low, high) |		\
+ 	  EFX_EXTRACT32((oword).u32[2], 64, 95, low, high) |		\
+ 	  EFX_EXTRACT32((oword).u32[3], 96, 127, low, high)) &		\
+-	 EFX_MASK32(high + 1 - low))
++	 EFX_MASK32((high) + 1 - (low)))
+ 
+ #define EFX_EXTRACT_QWORD32(qword, low, high)				\
+ 	((EFX_EXTRACT32((qword).u32[0], 0, 31, low, high) |		\
+ 	  EFX_EXTRACT32((qword).u32[1], 32, 63, low, high)) &		\
+-	 EFX_MASK32(high + 1 - low))
++	 EFX_MASK32((high) + 1 - (low)))
+ 
+ #define EFX_EXTRACT_DWORD(dword, low, high)			\
+ 	(EFX_EXTRACT32((dword).u32[0], 0, 31, low, high) &	\
+-	 EFX_MASK32(high + 1 - low))
++	 EFX_MASK32((high) + 1 - (low)))
+ 
+ #define EFX_OWORD_FIELD64(oword, field)				\
+ 	EFX_EXTRACT_OWORD64(oword, EFX_LOW_BIT(field),		\
+@@ -442,10 +442,10 @@ typedef union efx_oword {
+ 	cpu_to_le32(EFX_INSERT_NATIVE(min, max, low, high, value))
+ 
+ #define EFX_INPLACE_MASK64(min, max, low, high)				\
+-	EFX_INSERT64(min, max, low, high, EFX_MASK64(high + 1 - low))
++	EFX_INSERT64(min, max, low, high, EFX_MASK64((high) + 1 - (low)))
+ 
+ #define EFX_INPLACE_MASK32(min, max, low, high)				\
+-	EFX_INSERT32(min, max, low, high, EFX_MASK32(high + 1 - low))
++	EFX_INSERT32(min, max, low, high, EFX_MASK32((high) + 1 - (low)))
+ 
+ #define EFX_SET_OWORD64(oword, low, high, value) do {			\
+ 	(oword).u64[0] = (((oword).u64[0]				\
+diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
+index 954b885..a87f351 100644
+--- a/drivers/net/ethernet/sfc/efx.c
++++ b/drivers/net/ethernet/sfc/efx.c
+@@ -656,25 +656,30 @@ static void efx_stop_datapath(struct efx_nic *efx)
+ 	struct efx_channel *channel;
+ 	struct efx_tx_queue *tx_queue;
+ 	struct efx_rx_queue *rx_queue;
++	struct pci_dev *dev = efx->pci_dev;
+ 	int rc;
+ 
+ 	EFX_ASSERT_RESET_SERIALISED(efx);
+ 	BUG_ON(efx->port_enabled);
+ 
+-	rc = efx_nic_flush_queues(efx);
+-	if (rc && EFX_WORKAROUND_7803(efx)) {
+-		/* Schedule a reset to recover from the flush failure. The
+-		 * descriptor caches reference memory we're about to free,
+-		 * but falcon_reconfigure_mac_wrapper() won't reconnect
+-		 * the MACs because of the pending reset. */
+-		netif_err(efx, drv, efx->net_dev,
+-			  "Resetting to recover from flush failure\n");
+-		efx_schedule_reset(efx, RESET_TYPE_ALL);
+-	} else if (rc) {
+-		netif_err(efx, drv, efx->net_dev, "failed to flush queues\n");
+-	} else {
+-		netif_dbg(efx, drv, efx->net_dev,
+-			  "successfully flushed all queues\n");
++	/* Only perform flush if dma is enabled */
++	if (dev->is_busmaster) {
++		rc = efx_nic_flush_queues(efx);
++
++		if (rc && EFX_WORKAROUND_7803(efx)) {
++			/* Schedule a reset to recover from the flush failure. The
++			 * descriptor caches reference memory we're about to free,
++			 * but falcon_reconfigure_mac_wrapper() won't reconnect
++			 * the MACs because of the pending reset. */
++			netif_err(efx, drv, efx->net_dev,
++				  "Resetting to recover from flush failure\n");
++			efx_schedule_reset(efx, RESET_TYPE_ALL);
++		} else if (rc) {
++			netif_err(efx, drv, efx->net_dev, "failed to flush queues\n");
++		} else {
++			netif_dbg(efx, drv, efx->net_dev,
++				  "successfully flushed all queues\n");
++		}
+ 	}
+ 
+ 	efx_for_each_channel(channel, efx) {
+@@ -749,6 +754,7 @@ efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries)
+ 						tx_queue->txd.entries);
+ 	}
+ 
++	efx_device_detach_sync(efx);
+ 	efx_stop_all(efx);
+ 	efx_stop_interrupts(efx, true);
+ 
+@@ -802,6 +808,7 @@ out:
+ 
+ 	efx_start_interrupts(efx, true);
+ 	efx_start_all(efx);
++	netif_device_attach(efx->net_dev);
+ 	return rc;
+ 
+ rollback:
+@@ -1596,8 +1603,12 @@ static void efx_stop_all(struct efx_nic *efx)
+ 	/* Flush efx_mac_work(), refill_workqueue, monitor_work */
+ 	efx_flush_all(efx);
+ 
+-	/* Stop the kernel transmit interface late, so the watchdog
+-	 * timer isn't ticking over the flush */
++	/* Stop the kernel transmit interface.  This is only valid if
++	 * the device is stopped or detached; otherwise the watchdog
++	 * may fire immediately.
++	 */
++	WARN_ON(netif_running(efx->net_dev) &&
++		netif_device_present(efx->net_dev));
+ 	netif_tx_disable(efx->net_dev);
+ 
+ 	efx_stop_datapath(efx);
+@@ -1916,10 +1927,11 @@ static int efx_change_mtu(struct net_device *net_dev, int new_mtu)
+ 	if (new_mtu > EFX_MAX_MTU)
+ 		return -EINVAL;
+ 
+-	efx_stop_all(efx);
+-
+ 	netif_dbg(efx, drv, efx->net_dev, "changing MTU to %d\n", new_mtu);
+ 
++	efx_device_detach_sync(efx);
++	efx_stop_all(efx);
++
+ 	mutex_lock(&efx->mac_lock);
+ 	/* Reconfigure the MAC before enabling the dma queues so that
+ 	 * the RX buffers don't overflow */
+@@ -1928,6 +1940,7 @@ static int efx_change_mtu(struct net_device *net_dev, int new_mtu)
+ 	mutex_unlock(&efx->mac_lock);
+ 
+ 	efx_start_all(efx);
++	netif_device_attach(efx->net_dev);
+ 	return 0;
+ }
+ 
+@@ -2219,7 +2232,7 @@ int efx_reset(struct efx_nic *efx, enum reset_type method)
+ 	netif_info(efx, drv, efx->net_dev, "resetting (%s)\n",
+ 		   RESET_TYPE(method));
+ 
+-	netif_device_detach(efx->net_dev);
++	efx_device_detach_sync(efx);
+ 	efx_reset_down(efx, method);
+ 
+ 	rc = efx->type->reset(efx, method);
+@@ -2713,7 +2726,7 @@ static int efx_pm_freeze(struct device *dev)
+ 
+ 	efx->state = STATE_FINI;
+ 
+-	netif_device_detach(efx->net_dev);
++	efx_device_detach_sync(efx);
+ 
+ 	efx_stop_all(efx);
+ 	efx_stop_interrupts(efx, false);
+diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h
+index 70755c9..7db0e5b 100644
+--- a/drivers/net/ethernet/sfc/efx.h
++++ b/drivers/net/ethernet/sfc/efx.h
+@@ -162,4 +162,17 @@ extern void efx_link_status_changed(struct efx_nic *efx);
+ extern void efx_link_set_advertising(struct efx_nic *efx, u32);
+ extern void efx_link_set_wanted_fc(struct efx_nic *efx, u8);
+ 
++static inline void efx_device_detach_sync(struct efx_nic *efx)
++{
++	struct net_device *dev = efx->net_dev;
++
++	/* Lock/freeze all TX queues so that we can be sure the
++	 * TX scheduler is stopped when we're done and before
++	 * netif_device_present() becomes false.
++	 */
++	netif_tx_lock_bh(dev);
++	netif_device_detach(dev);
++	netif_tx_unlock_bh(dev);
++}
++
+ #endif /* EFX_EFX_H */
+diff --git a/drivers/net/ethernet/sfc/falcon.c b/drivers/net/ethernet/sfc/falcon.c
+index 3a1ca2b..49bcd19 100644
+--- a/drivers/net/ethernet/sfc/falcon.c
++++ b/drivers/net/ethernet/sfc/falcon.c
+@@ -25,9 +25,12 @@
+ #include "io.h"
+ #include "phy.h"
+ #include "workarounds.h"
++#include "selftest.h"
+ 
+ /* Hardware control for SFC4000 (aka Falcon). */
+ 
++static int falcon_reset_hw(struct efx_nic *efx, enum reset_type method);
++
+ static const unsigned int
+ /* "Large" EEPROM device: Atmel AT25640 or similar
+  * 8 KB, 16-bit address, 32 B write block */
+@@ -1034,10 +1037,34 @@ static const struct efx_nic_register_test falcon_b0_register_tests[] = {
+ 	  EFX_OWORD32(0x0003FF0F, 0x00000000, 0x00000000, 0x00000000) },
+ };
+ 
+-static int falcon_b0_test_registers(struct efx_nic *efx)
++static int
++falcon_b0_test_chip(struct efx_nic *efx, struct efx_self_tests *tests)
+ {
+-	return efx_nic_test_registers(efx, falcon_b0_register_tests,
+-				      ARRAY_SIZE(falcon_b0_register_tests));
++	enum reset_type reset_method = RESET_TYPE_INVISIBLE;
++	int rc, rc2;
++
++	mutex_lock(&efx->mac_lock);
++	if (efx->loopback_modes) {
++		/* We need the 312 clock from the PHY to test the XMAC
++		 * registers, so move into XGMII loopback if available */
++		if (efx->loopback_modes & (1 << LOOPBACK_XGMII))
++			efx->loopback_mode = LOOPBACK_XGMII;
++		else
++			efx->loopback_mode = __ffs(efx->loopback_modes);
++	}
++	__efx_reconfigure_port(efx);
++	mutex_unlock(&efx->mac_lock);
++
++	efx_reset_down(efx, reset_method);
++
++	tests->registers =
++		efx_nic_test_registers(efx, falcon_b0_register_tests,
++				       ARRAY_SIZE(falcon_b0_register_tests))
++		? -1 : 1;
++
++	rc = falcon_reset_hw(efx, reset_method);
++	rc2 = efx_reset_up(efx, reset_method, rc == 0);
++	return rc ? rc : rc2;
+ }
+ 
+ /**************************************************************************
+@@ -1765,6 +1792,7 @@ const struct efx_nic_type falcon_a1_nic_type = {
+ 	.remove_port = falcon_remove_port,
+ 	.handle_global_event = falcon_handle_global_event,
+ 	.prepare_flush = falcon_prepare_flush,
++	.finish_flush = efx_port_dummy_op_void,
+ 	.update_stats = falcon_update_nic_stats,
+ 	.start_stats = falcon_start_nic_stats,
+ 	.stop_stats = falcon_stop_nic_stats,
+@@ -1807,6 +1835,7 @@ const struct efx_nic_type falcon_b0_nic_type = {
+ 	.remove_port = falcon_remove_port,
+ 	.handle_global_event = falcon_handle_global_event,
+ 	.prepare_flush = falcon_prepare_flush,
++	.finish_flush = efx_port_dummy_op_void,
+ 	.update_stats = falcon_update_nic_stats,
+ 	.start_stats = falcon_start_nic_stats,
+ 	.stop_stats = falcon_stop_nic_stats,
+@@ -1818,7 +1847,7 @@ const struct efx_nic_type falcon_b0_nic_type = {
+ 	.get_wol = falcon_get_wol,
+ 	.set_wol = falcon_set_wol,
+ 	.resume_wol = efx_port_dummy_op_void,
+-	.test_registers = falcon_b0_test_registers,
++	.test_chip = falcon_b0_test_chip,
+ 	.test_nvram = falcon_test_nvram,
+ 
+ 	.revision = EFX_REV_FALCON_B0,
+diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
+index 17b6463..eb85217 100644
+--- a/drivers/net/ethernet/sfc/mcdi.c
++++ b/drivers/net/ethernet/sfc/mcdi.c
+@@ -22,7 +22,7 @@
+  **************************************************************************
+  */
+ 
+-#define MCDI_RPC_TIMEOUT       10 /*seconds */
++#define MCDI_RPC_TIMEOUT       (10 * HZ)
+ 
+ #define MCDI_PDU(efx)							\
+ 	(efx_port_num(efx) ? MC_SMEM_P1_PDU_OFST : MC_SMEM_P0_PDU_OFST)
+@@ -120,7 +120,7 @@ static void efx_mcdi_copyout(struct efx_nic *efx, u8 *outbuf, size_t outlen)
+ static int efx_mcdi_poll(struct efx_nic *efx)
+ {
+ 	struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
+-	unsigned int time, finish;
++	unsigned long time, finish;
+ 	unsigned int respseq, respcmd, error;
+ 	unsigned int pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
+ 	unsigned int rc, spins;
+@@ -136,7 +136,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
+ 	 * and poll once a jiffy (approximately)
+ 	 */
+ 	spins = TICK_USEC;
+-	finish = get_seconds() + MCDI_RPC_TIMEOUT;
++	finish = jiffies + MCDI_RPC_TIMEOUT;
+ 
+ 	while (1) {
+ 		if (spins != 0) {
+@@ -146,7 +146,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
+ 			schedule_timeout_uninterruptible(1);
+ 		}
+ 
+-		time = get_seconds();
++		time = jiffies;
+ 
+ 		rmb();
+ 		efx_readd(efx, &reg, pdu);
+@@ -158,7 +158,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
+ 		    EFX_DWORD_FIELD(reg, MCDI_HEADER_RESPONSE))
+ 			break;
+ 
+-		if (time >= finish)
++		if (time_after(time, finish))
+ 			return -ETIMEDOUT;
+ 	}
+ 
+@@ -250,7 +250,7 @@ static int efx_mcdi_await_completion(struct efx_nic *efx)
+ 	if (wait_event_timeout(
+ 		    mcdi->wq,
+ 		    atomic_read(&mcdi->state) == MCDI_STATE_COMPLETED,
+-		    msecs_to_jiffies(MCDI_RPC_TIMEOUT * 1000)) == 0)
++		    MCDI_RPC_TIMEOUT) == 0)
+ 		return -ETIMEDOUT;
+ 
+ 	/* Check if efx_mcdi_set_mode() switched us back to polled completions.
+@@ -641,9 +641,8 @@ int efx_mcdi_get_board_cfg(struct efx_nic *efx, u8 *mac_address,
+ 			   u16 *fw_subtype_list, u32 *capabilities)
+ {
+ 	uint8_t outbuf[MC_CMD_GET_BOARD_CFG_OUT_LENMIN];
+-	size_t outlen;
++	size_t outlen, offset, i;
+ 	int port_num = efx_port_num(efx);
+-	int offset;
+ 	int rc;
+ 
+ 	BUILD_BUG_ON(MC_CMD_GET_BOARD_CFG_IN_LEN != 0);
+@@ -663,11 +662,16 @@ int efx_mcdi_get_board_cfg(struct efx_nic *efx, u8 *mac_address,
+ 		: MC_CMD_GET_BOARD_CFG_OUT_MAC_ADDR_BASE_PORT0_OFST;
+ 	if (mac_address)
+ 		memcpy(mac_address, outbuf + offset, ETH_ALEN);
+-	if (fw_subtype_list)
+-		memcpy(fw_subtype_list,
+-		       outbuf + MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_OFST,
+-		       MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_MINNUM *
+-		       sizeof(fw_subtype_list[0]));
++	if (fw_subtype_list) {
++		offset = MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_OFST;
++		for (i = 0;
++		     i < MC_CMD_GET_BOARD_CFG_OUT_FW_SUBTYPE_LIST_MINNUM;
++		     i++) {
++			fw_subtype_list[i] =
++				le16_to_cpup((__le16 *)(outbuf + offset));
++			offset += 2;
++		}
++	}
+ 	if (capabilities) {
+ 		if (port_num)
+ 			*capabilities = MCDI_DWORD(outbuf,
+@@ -1164,6 +1168,9 @@ int efx_mcdi_flush_rxqs(struct efx_nic *efx)
+ 	__le32 *qid;
+ 	int rc, count;
+ 
++	BUILD_BUG_ON(EFX_MAX_CHANNELS >
++		     MC_CMD_FLUSH_RX_QUEUES_IN_QID_OFST_MAXNUM);
++
+ 	qid = kmalloc(EFX_MAX_CHANNELS * sizeof(*qid), GFP_KERNEL);
+ 	if (qid == NULL)
+ 		return -ENOMEM;
+diff --git a/drivers/net/ethernet/sfc/mcdi.h b/drivers/net/ethernet/sfc/mcdi.h
+index 0bdf3e3..96f43d2 100644
+--- a/drivers/net/ethernet/sfc/mcdi.h
++++ b/drivers/net/ethernet/sfc/mcdi.h
+@@ -107,11 +107,13 @@ extern void efx_mcdi_sensor_event(struct efx_nic *efx, efx_qword_t *ev);
+ #define MCDI_EVENT_FIELD(_ev, _field)			\
+ 	EFX_QWORD_FIELD(_ev, MCDI_EVENT_ ## _field)
+ #define MCDI_ARRAY_FIELD(_buf, _field1, _type, _index, _field2)		\
+-	EFX_DWORD_FIELD(						\
++	EFX_EXTRACT_DWORD(						\
+ 		*((efx_dword_t *)					\
+ 		  (MCDI_ARRAY_PTR(_buf, _field1, _type, _index) +	\
+ 		   (MC_CMD_ ## _type ## _TYPEDEF_ ## _field2 ## _OFST & ~3))), \
+-		MC_CMD_ ## _type ## _TYPEDEF_ ## _field2)
++		MC_CMD_ ## _type ## _TYPEDEF_ ## _field2 ## _LBN & 0x1f, \
++		(MC_CMD_ ## _type ## _TYPEDEF_ ## _field2 ## _LBN & 0x1f) + \
++		MC_CMD_ ## _type ## _TYPEDEF_ ## _field2 ## _WIDTH - 1)
+ 
+ extern void efx_mcdi_print_fwver(struct efx_nic *efx, char *buf, size_t len);
+ extern int efx_mcdi_drv_attach(struct efx_nic *efx, bool driver_operating,
+diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
+index f0385e1..b71ef14 100644
+--- a/drivers/net/ethernet/sfc/net_driver.h
++++ b/drivers/net/ethernet/sfc/net_driver.h
+@@ -68,6 +68,8 @@
+ #define EFX_TXQ_TYPES		4
+ #define EFX_MAX_TX_QUEUES	(EFX_TXQ_TYPES * EFX_MAX_CHANNELS)
+ 
++struct efx_self_tests;
++
+ /**
+  * struct efx_special_buffer - An Efx special buffer
+  * @addr: CPU base address of the buffer
+@@ -194,6 +196,7 @@ struct efx_tx_queue {
+ 	/* Members shared between paths and sometimes updated */
+ 	unsigned int empty_read_count ____cacheline_aligned_in_smp;
+ #define EFX_EMPTY_COUNT_VALID 0x80000000
++	atomic_t flush_outstanding;
+ };
+ 
+ /**
+@@ -203,6 +206,7 @@ struct efx_tx_queue {
+  *	Will be %NULL if the buffer slot is currently free.
+  * @page: The associated page buffer. Valif iff @flags & %EFX_RX_BUF_PAGE.
+  *	Will be %NULL if the buffer slot is currently free.
++ * @page_offset: Offset within page. Valid iff @flags & %EFX_RX_BUF_PAGE.
+  * @len: Buffer length, in bytes.
+  * @flags: Flags for buffer and packet state.
+  */
+@@ -212,7 +216,8 @@ struct efx_rx_buffer {
+ 		struct sk_buff *skb;
+ 		struct page *page;
+ 	} u;
+-	unsigned int len;
++	u16 page_offset;
++	u16 len;
+ 	u16 flags;
+ };
+ #define EFX_RX_BUF_PAGE		0x0001
+@@ -887,6 +892,7 @@ static inline unsigned int efx_port_num(struct efx_nic *efx)
+  * @remove_port: Free resources allocated by probe_port()
+  * @handle_global_event: Handle a "global" event (may be %NULL)
+  * @prepare_flush: Prepare the hardware for flushing the DMA queues
++ * @finish_flush: Clean up after flushing the DMA queues
+  * @update_stats: Update statistics not provided by event handling
+  * @start_stats: Start the regular fetching of statistics
+  * @stop_stats: Stop the regular fetching of statistics
+@@ -899,7 +905,8 @@ static inline unsigned int efx_port_num(struct efx_nic *efx)
+  * @get_wol: Get WoL configuration from driver state
+  * @set_wol: Push WoL configuration to the NIC
+  * @resume_wol: Synchronise WoL state between driver and MC (e.g. after resume)
+- * @test_registers: Test read/write functionality of control registers
++ * @test_chip: Test registers.  Should use efx_nic_test_registers(), and is
++ *	expected to reset the NIC.
+  * @test_nvram: Test validity of NVRAM contents
+  * @revision: Hardware architecture revision
+  * @mem_map_size: Memory BAR mapped size
+@@ -933,6 +940,7 @@ struct efx_nic_type {
+ 	void (*remove_port)(struct efx_nic *efx);
+ 	bool (*handle_global_event)(struct efx_channel *channel, efx_qword_t *);
+ 	void (*prepare_flush)(struct efx_nic *efx);
++	void (*finish_flush)(struct efx_nic *efx);
+ 	void (*update_stats)(struct efx_nic *efx);
+ 	void (*start_stats)(struct efx_nic *efx);
+ 	void (*stop_stats)(struct efx_nic *efx);
+@@ -944,7 +952,7 @@ struct efx_nic_type {
+ 	void (*get_wol)(struct efx_nic *efx, struct ethtool_wolinfo *wol);
+ 	int (*set_wol)(struct efx_nic *efx, u32 type);
+ 	void (*resume_wol)(struct efx_nic *efx);
+-	int (*test_registers)(struct efx_nic *efx);
++	int (*test_chip)(struct efx_nic *efx, struct efx_self_tests *tests);
+ 	int (*test_nvram)(struct efx_nic *efx);
+ 
+ 	int revision;
+diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c
+index 4a9a5be..578e52a6 100644
+--- a/drivers/net/ethernet/sfc/nic.c
++++ b/drivers/net/ethernet/sfc/nic.c
+@@ -73,6 +73,8 @@
+ 	_EFX_CHANNEL_MAGIC(_EFX_CHANNEL_MAGIC_TX_DRAIN,			\
+ 			   (_tx_queue)->queue)
+ 
++static void efx_magic_event(struct efx_channel *channel, u32 magic);
++
+ /**************************************************************************
+  *
+  * Solarstorm hardware access
+@@ -124,9 +126,6 @@ int efx_nic_test_registers(struct efx_nic *efx,
+ 	unsigned address = 0, i, j;
+ 	efx_oword_t mask, imask, original, reg, buf;
+ 
+-	/* Falcon should be in loopback to isolate the XMAC from the PHY */
+-	WARN_ON(!LOOPBACK_INTERNAL(efx));
+-
+ 	for (i = 0; i < n_regs; ++i) {
+ 		address = regs[i].address;
+ 		mask = imask = regs[i].mask;
+@@ -380,7 +379,8 @@ efx_may_push_tx_desc(struct efx_tx_queue *tx_queue, unsigned int write_count)
+ 		return false;
+ 
+ 	tx_queue->empty_read_count = 0;
+-	return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0;
++	return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0
++		&& tx_queue->write_count - write_count == 1;
+ }
+ 
+ /* For each entry inserted into the software descriptor ring, create a
+@@ -495,6 +495,9 @@ static void efx_flush_tx_queue(struct efx_tx_queue *tx_queue)
+ 	struct efx_nic *efx = tx_queue->efx;
+ 	efx_oword_t tx_flush_descq;
+ 
++	WARN_ON(atomic_read(&tx_queue->flush_outstanding));
++	atomic_set(&tx_queue->flush_outstanding, 1);
++
+ 	EFX_POPULATE_OWORD_2(tx_flush_descq,
+ 			     FRF_AZ_TX_FLUSH_DESCQ_CMD, 1,
+ 			     FRF_AZ_TX_FLUSH_DESCQ, tx_queue->queue);
+@@ -670,6 +673,47 @@ static bool efx_flush_wake(struct efx_nic *efx)
+ 		 && atomic_read(&efx->rxq_flush_pending) > 0));
+ }
+ 
++static bool efx_check_tx_flush_complete(struct efx_nic *efx)
++{
++	bool i = true;
++	efx_oword_t txd_ptr_tbl;
++	struct efx_channel *channel;
++	struct efx_tx_queue *tx_queue;
++
++	efx_for_each_channel(channel, efx) {
++		efx_for_each_channel_tx_queue(tx_queue, channel) {
++			efx_reado_table(efx, &txd_ptr_tbl,
++					FR_BZ_TX_DESC_PTR_TBL, tx_queue->queue);
++			if (EFX_OWORD_FIELD(txd_ptr_tbl,
++					    FRF_AZ_TX_DESCQ_FLUSH) ||
++			    EFX_OWORD_FIELD(txd_ptr_tbl,
++					    FRF_AZ_TX_DESCQ_EN)) {
++				netif_dbg(efx, hw, efx->net_dev,
++					  "flush did not complete on TXQ %d\n",
++					  tx_queue->queue);
++				i = false;
++			} else if (atomic_cmpxchg(&tx_queue->flush_outstanding,
++						  1, 0)) {
++				/* The flush is complete, but we didn't
++				 * receive a flush completion event
++				 */
++				netif_dbg(efx, hw, efx->net_dev,
++					  "flush complete on TXQ %d, so drain "
++					  "the queue\n", tx_queue->queue);
++				/* Don't need to increment drain_pending as it
++				 * has already been incremented for the queues
++				 * which did not drain
++				 */
++				efx_magic_event(channel,
++						EFX_CHANNEL_MAGIC_TX_DRAIN(
++							tx_queue));
++			}
++		}
++	}
++
++	return i;
++}
++
+ /* Flush all the transmit queues, and continue flushing receive queues until
+  * they're all flushed. Wait for the DRAIN events to be recieved so that there
+  * are no more RX and TX events left on any channel. */
+@@ -681,7 +725,6 @@ int efx_nic_flush_queues(struct efx_nic *efx)
+ 	struct efx_tx_queue *tx_queue;
+ 	int rc = 0;
+ 
+-	efx->fc_disable++;
+ 	efx->type->prepare_flush(efx);
+ 
+ 	efx_for_each_channel(channel, efx) {
+@@ -731,7 +774,8 @@ int efx_nic_flush_queues(struct efx_nic *efx)
+ 					     timeout);
+ 	}
+ 
+-	if (atomic_read(&efx->drain_pending)) {
++	if (atomic_read(&efx->drain_pending) &&
++	    !efx_check_tx_flush_complete(efx)) {
+ 		netif_err(efx, hw, efx->net_dev, "failed to flush %d queues "
+ 			  "(rx %d+%d)\n", atomic_read(&efx->drain_pending),
+ 			  atomic_read(&efx->rxq_flush_outstanding),
+@@ -743,7 +787,7 @@ int efx_nic_flush_queues(struct efx_nic *efx)
+ 		atomic_set(&efx->rxq_flush_outstanding, 0);
+ 	}
+ 
+-	efx->fc_disable--;
++	efx->type->finish_flush(efx);
+ 
+ 	return rc;
+ }
+@@ -1018,9 +1062,10 @@ efx_handle_tx_flush_done(struct efx_nic *efx, efx_qword_t *event)
+ 	if (qid < EFX_TXQ_TYPES * efx->n_tx_channels) {
+ 		tx_queue = efx_get_tx_queue(efx, qid / EFX_TXQ_TYPES,
+ 					    qid % EFX_TXQ_TYPES);
+-
+-		efx_magic_event(tx_queue->channel,
+-				EFX_CHANNEL_MAGIC_TX_DRAIN(tx_queue));
++		if (atomic_cmpxchg(&tx_queue->flush_outstanding, 1, 0)) {
++			efx_magic_event(tx_queue->channel,
++					EFX_CHANNEL_MAGIC_TX_DRAIN(tx_queue));
++		}
+ 	}
+ }
+ 
+diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
+index f48ccf6..bbdfcd6 100644
+--- a/drivers/net/ethernet/sfc/nic.h
++++ b/drivers/net/ethernet/sfc/nic.h
+@@ -316,6 +316,8 @@ static inline int efx_nic_irq_test_irq_cpu(struct efx_nic *efx)
+ 
+ /* Global Resources */
+ extern int efx_nic_flush_queues(struct efx_nic *efx);
++extern void siena_prepare_flush(struct efx_nic *efx);
++extern void siena_finish_flush(struct efx_nic *efx);
+ extern void falcon_start_nic_stats(struct efx_nic *efx);
+ extern void falcon_stop_nic_stats(struct efx_nic *efx);
+ extern void falcon_setup_xaui(struct efx_nic *efx);
+diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
+index 763fa2f..7b3c068 100644
+--- a/drivers/net/ethernet/sfc/rx.c
++++ b/drivers/net/ethernet/sfc/rx.c
+@@ -95,11 +95,7 @@ static unsigned int rx_refill_limit = 95;
+ static inline unsigned int efx_rx_buf_offset(struct efx_nic *efx,
+ 					     struct efx_rx_buffer *buf)
+ {
+-	/* Offset is always within one page, so we don't need to consider
+-	 * the page order.
+-	 */
+-	return ((unsigned int) buf->dma_addr & (PAGE_SIZE - 1)) +
+-		efx->type->rx_buffer_hash_size;
++	return buf->page_offset + efx->type->rx_buffer_hash_size;
+ }
+ static inline unsigned int efx_rx_buf_size(struct efx_nic *efx)
+ {
+@@ -193,6 +189,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
+ 	struct efx_rx_buffer *rx_buf;
+ 	struct page *page;
+ 	void *page_addr;
++	unsigned int page_offset;
+ 	struct efx_rx_page_state *state;
+ 	dma_addr_t dma_addr;
+ 	unsigned index, count;
+@@ -219,12 +216,14 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
+ 
+ 		page_addr += sizeof(struct efx_rx_page_state);
+ 		dma_addr += sizeof(struct efx_rx_page_state);
++		page_offset = sizeof(struct efx_rx_page_state);
+ 
+ 	split:
+ 		index = rx_queue->added_count & rx_queue->ptr_mask;
+ 		rx_buf = efx_rx_buffer(rx_queue, index);
+ 		rx_buf->dma_addr = dma_addr + EFX_PAGE_IP_ALIGN;
+ 		rx_buf->u.page = page;
++		rx_buf->page_offset = page_offset + EFX_PAGE_IP_ALIGN;
+ 		rx_buf->len = efx->rx_buffer_len - EFX_PAGE_IP_ALIGN;
+ 		rx_buf->flags = EFX_RX_BUF_PAGE;
+ 		++rx_queue->added_count;
+@@ -236,6 +235,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
+ 			get_page(page);
+ 			dma_addr += (PAGE_SIZE >> 1);
+ 			page_addr += (PAGE_SIZE >> 1);
++			page_offset += (PAGE_SIZE >> 1);
+ 			++count;
+ 			goto split;
+ 		}
+@@ -245,7 +245,8 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
+ }
+ 
+ static void efx_unmap_rx_buffer(struct efx_nic *efx,
+-				struct efx_rx_buffer *rx_buf)
++				struct efx_rx_buffer *rx_buf,
++				unsigned int used_len)
+ {
+ 	if ((rx_buf->flags & EFX_RX_BUF_PAGE) && rx_buf->u.page) {
+ 		struct efx_rx_page_state *state;
+@@ -256,6 +257,10 @@ static void efx_unmap_rx_buffer(struct efx_nic *efx,
+ 				       state->dma_addr,
+ 				       efx_rx_buf_size(efx),
+ 				       PCI_DMA_FROMDEVICE);
++		} else if (used_len) {
++			dma_sync_single_for_cpu(&efx->pci_dev->dev,
++						rx_buf->dma_addr, used_len,
++						DMA_FROM_DEVICE);
+ 		}
+ 	} else if (!(rx_buf->flags & EFX_RX_BUF_PAGE) && rx_buf->u.skb) {
+ 		pci_unmap_single(efx->pci_dev, rx_buf->dma_addr,
+@@ -278,7 +283,7 @@ static void efx_free_rx_buffer(struct efx_nic *efx,
+ static void efx_fini_rx_buffer(struct efx_rx_queue *rx_queue,
+ 			       struct efx_rx_buffer *rx_buf)
+ {
+-	efx_unmap_rx_buffer(rx_queue->efx, rx_buf);
++	efx_unmap_rx_buffer(rx_queue->efx, rx_buf, 0);
+ 	efx_free_rx_buffer(rx_queue->efx, rx_buf);
+ }
+ 
+@@ -544,10 +549,10 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
+ 		goto out;
+ 	}
+ 
+-	/* Release card resources - assumes all RX buffers consumed in-order
+-	 * per RX queue
++	/* Release and/or sync DMA mapping - assumes all RX buffers
++	 * consumed in-order per RX queue
+ 	 */
+-	efx_unmap_rx_buffer(efx, rx_buf);
++	efx_unmap_rx_buffer(efx, rx_buf, len);
+ 
+ 	/* Prefetch nice and early so data will (hopefully) be in cache by
+ 	 * the time we look at it.
+diff --git a/drivers/net/ethernet/sfc/selftest.c b/drivers/net/ethernet/sfc/selftest.c
+index de4c006..4a51ea3 100644
+--- a/drivers/net/ethernet/sfc/selftest.c
++++ b/drivers/net/ethernet/sfc/selftest.c
+@@ -120,19 +120,6 @@ static int efx_test_nvram(struct efx_nic *efx, struct efx_self_tests *tests)
+ 	return rc;
+ }
+ 
+-static int efx_test_chip(struct efx_nic *efx, struct efx_self_tests *tests)
+-{
+-	int rc = 0;
+-
+-	/* Test register access */
+-	if (efx->type->test_registers) {
+-		rc = efx->type->test_registers(efx);
+-		tests->registers = rc ? -1 : 1;
+-	}
+-
+-	return rc;
+-}
+-
+ /**************************************************************************
+  *
+  * Interrupt and event queue testing
+@@ -699,8 +686,7 @@ int efx_selftest(struct efx_nic *efx, struct efx_self_tests *tests,
+ {
+ 	enum efx_loopback_mode loopback_mode = efx->loopback_mode;
+ 	int phy_mode = efx->phy_mode;
+-	enum reset_type reset_method = RESET_TYPE_INVISIBLE;
+-	int rc_test = 0, rc_reset = 0, rc;
++	int rc_test = 0, rc_reset, rc;
+ 
+ 	efx_selftest_async_cancel(efx);
+ 
+@@ -735,46 +721,28 @@ int efx_selftest(struct efx_nic *efx, struct efx_self_tests *tests,
+ 	/* Detach the device so the kernel doesn't transmit during the
+ 	 * loopback test and the watchdog timeout doesn't fire.
+ 	 */
+-	netif_device_detach(efx->net_dev);
++	efx_device_detach_sync(efx);
++
++	if (efx->type->test_chip) {
++		rc_reset = efx->type->test_chip(efx, tests);
++		if (rc_reset) {
++			netif_err(efx, hw, efx->net_dev,
++				  "Unable to recover from chip test\n");
++			efx_schedule_reset(efx, RESET_TYPE_DISABLE);
++			return rc_reset;
++		}
+ 
+-	mutex_lock(&efx->mac_lock);
+-	if (efx->loopback_modes) {
+-		/* We need the 312 clock from the PHY to test the XMAC
+-		 * registers, so move into XGMII loopback if available */
+-		if (efx->loopback_modes & (1 << LOOPBACK_XGMII))
+-			efx->loopback_mode = LOOPBACK_XGMII;
+-		else
+-			efx->loopback_mode = __ffs(efx->loopback_modes);
++		if ((tests->registers < 0) && !rc_test)
++			rc_test = -EIO;
+ 	}
+ 
+-	__efx_reconfigure_port(efx);
+-	mutex_unlock(&efx->mac_lock);
+-
+-	/* free up all consumers of SRAM (including all the queues) */
+-	efx_reset_down(efx, reset_method);
+-
+-	rc = efx_test_chip(efx, tests);
+-	if (rc && !rc_test)
+-		rc_test = rc;
+-
+-	/* reset the chip to recover from the register test */
+-	rc_reset = efx->type->reset(efx, reset_method);
+-
+ 	/* Ensure that the phy is powered and out of loopback
+ 	 * for the bist and loopback tests */
++	mutex_lock(&efx->mac_lock);
+ 	efx->phy_mode &= ~PHY_MODE_LOW_POWER;
+ 	efx->loopback_mode = LOOPBACK_NONE;
+-
+-	rc = efx_reset_up(efx, reset_method, rc_reset == 0);
+-	if (rc && !rc_reset)
+-		rc_reset = rc;
+-
+-	if (rc_reset) {
+-		netif_err(efx, drv, efx->net_dev,
+-			  "Unable to recover from chip test\n");
+-		efx_schedule_reset(efx, RESET_TYPE_DISABLE);
+-		return rc_reset;
+-	}
++	__efx_reconfigure_port(efx);
++	mutex_unlock(&efx->mac_lock);
+ 
+ 	rc = efx_test_phy(efx, tests, flags);
+ 	if (rc && !rc_test)
+diff --git a/drivers/net/ethernet/sfc/siena.c b/drivers/net/ethernet/sfc/siena.c
+index 9f8d7ce..b09ff79 100644
+--- a/drivers/net/ethernet/sfc/siena.c
++++ b/drivers/net/ethernet/sfc/siena.c
+@@ -25,10 +25,12 @@
+ #include "workarounds.h"
+ #include "mcdi.h"
+ #include "mcdi_pcol.h"
++#include "selftest.h"
+ 
+ /* Hardware control for SFC9000 family including SFL9021 (aka Siena). */
+ 
+ static void siena_init_wol(struct efx_nic *efx);
++static int siena_reset_hw(struct efx_nic *efx, enum reset_type method);
+ 
+ 
+ static void siena_push_irq_moderation(struct efx_channel *channel)
+@@ -125,6 +127,18 @@ static void siena_remove_port(struct efx_nic *efx)
+ 	efx_nic_free_buffer(efx, &efx->stats_buffer);
+ }
+ 
++void siena_prepare_flush(struct efx_nic *efx)
++{
++	if (efx->fc_disable++ == 0)
++		efx_mcdi_set_mac(efx);
++}
++
++void siena_finish_flush(struct efx_nic *efx)
++{
++	if (--efx->fc_disable == 0)
++		efx_mcdi_set_mac(efx);
++}
++
+ static const struct efx_nic_register_test siena_register_tests[] = {
+ 	{ FR_AZ_ADR_REGION,
+ 	  EFX_OWORD32(0x0003FFFF, 0x0003FFFF, 0x0003FFFF, 0x0003FFFF) },
+@@ -154,10 +168,29 @@ static const struct efx_nic_register_test siena_register_tests[] = {
+ 	  EFX_OWORD32(0xFFFFFFFF, 0xFFFFFFFF, 0x00000007, 0x00000000) },
+ };
+ 
+-static int siena_test_registers(struct efx_nic *efx)
++static int siena_test_chip(struct efx_nic *efx, struct efx_self_tests *tests)
+ {
+-	return efx_nic_test_registers(efx, siena_register_tests,
+-				      ARRAY_SIZE(siena_register_tests));
++	enum reset_type reset_method = RESET_TYPE_ALL;
++	int rc, rc2;
++
++	efx_reset_down(efx, reset_method);
++
++	/* Reset the chip immediately so that it is completely
++	 * quiescent regardless of what any VF driver does.
++	 */
++	rc = siena_reset_hw(efx, reset_method);
++	if (rc)
++		goto out;
++
++	tests->registers =
++		efx_nic_test_registers(efx, siena_register_tests,
++				       ARRAY_SIZE(siena_register_tests))
++		? -1 : 1;
++
++	rc = siena_reset_hw(efx, reset_method);
++out:
++	rc2 = efx_reset_up(efx, reset_method, rc == 0);
++	return rc ? rc : rc2;
+ }
+ 
+ /**************************************************************************
+@@ -637,7 +670,8 @@ const struct efx_nic_type siena_a0_nic_type = {
+ 	.reset = siena_reset_hw,
+ 	.probe_port = siena_probe_port,
+ 	.remove_port = siena_remove_port,
+-	.prepare_flush = efx_port_dummy_op_void,
++	.prepare_flush = siena_prepare_flush,
++	.finish_flush = siena_finish_flush,
+ 	.update_stats = siena_update_nic_stats,
+ 	.start_stats = siena_start_nic_stats,
+ 	.stop_stats = siena_stop_nic_stats,
+@@ -649,7 +683,7 @@ const struct efx_nic_type siena_a0_nic_type = {
+ 	.get_wol = siena_get_wol,
+ 	.set_wol = siena_set_wol,
+ 	.resume_wol = siena_init_wol,
+-	.test_registers = siena_test_registers,
++	.test_chip = siena_test_chip,
+ 	.test_nvram = efx_mcdi_nvram_test_all,
+ 
+ 	.revision = EFX_REV_SIENA_A0,
+diff --git a/drivers/net/ethernet/sfc/siena_sriov.c b/drivers/net/ethernet/sfc/siena_sriov.c
+index 9cb3b84..4ad8082 100644
+--- a/drivers/net/ethernet/sfc/siena_sriov.c
++++ b/drivers/net/ethernet/sfc/siena_sriov.c
+@@ -21,6 +21,9 @@
+ /* Number of longs required to track all the VIs in a VF */
+ #define VI_MASK_LENGTH BITS_TO_LONGS(1 << EFX_VI_SCALE_MAX)
+ 
++/* Maximum number of RX queues supported */
++#define VF_MAX_RX_QUEUES 63
++
+ /**
+  * enum efx_vf_tx_filter_mode - TX MAC filtering behaviour
+  * @VF_TX_FILTER_OFF: Disabled
+@@ -578,6 +581,7 @@ static int efx_vfdi_init_rxq(struct efx_vf *vf)
+ 	efx_oword_t reg;
+ 
+ 	if (bad_vf_index(efx, vf_evq) || bad_vf_index(efx, vf_rxq) ||
++	    vf_rxq >= VF_MAX_RX_QUEUES ||
+ 	    bad_buf_count(buf_count, EFX_MAX_DMAQ_SIZE)) {
+ 		if (net_ratelimit())
+ 			netif_err(efx, hw, efx->net_dev,
+@@ -683,13 +687,15 @@ static int efx_vfdi_fini_all_queues(struct efx_vf *vf)
+ 	__le32 *rxqs;
+ 	int rc;
+ 
++	BUILD_BUG_ON(VF_MAX_RX_QUEUES >
++		     MC_CMD_FLUSH_RX_QUEUES_IN_QID_OFST_MAXNUM);
++
+ 	rxqs = kmalloc(count * sizeof(*rxqs), GFP_KERNEL);
+ 	if (rxqs == NULL)
+ 		return VFDI_RC_ENOMEM;
+ 
+ 	rtnl_lock();
+-	if (efx->fc_disable++ == 0)
+-		efx_mcdi_set_mac(efx);
++	siena_prepare_flush(efx);
+ 	rtnl_unlock();
+ 
+ 	/* Flush all the initialized queues */
+@@ -726,8 +732,7 @@ static int efx_vfdi_fini_all_queues(struct efx_vf *vf)
+ 	}
+ 
+ 	rtnl_lock();
+-	if (--efx->fc_disable == 0)
+-		efx_mcdi_set_mac(efx);
++	siena_finish_flush(efx);
+ 	rtnl_unlock();
+ 
+ 	/* Irrespective of success/failure, fini the queues */
+diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
+index 63ffbdf..dfffe8d 100644
+--- a/drivers/net/netconsole.c
++++ b/drivers/net/netconsole.c
+@@ -626,6 +626,7 @@ static int netconsole_netdev_event(struct notifier_block *this,
+ 		goto done;
+ 
+ 	spin_lock_irqsave(&target_list_lock, flags);
++restart:
+ 	list_for_each_entry(nt, &target_list, list) {
+ 		netconsole_target_get(nt);
+ 		if (nt->np.dev == dev) {
+@@ -637,21 +638,18 @@ static int netconsole_netdev_event(struct notifier_block *this,
+ 			case NETDEV_JOIN:
+ 			case NETDEV_UNREGISTER:
+ 				/*
++				 * we might sleep in __netpoll_cleanup()
+ 				 * rtnl_lock already held
+ 				 */
+-				if (nt->np.dev) {
+-					spin_unlock_irqrestore(
+-							      &target_list_lock,
+-							      flags);
+-					__netpoll_cleanup(&nt->np);
+-					spin_lock_irqsave(&target_list_lock,
+-							  flags);
+-					dev_put(nt->np.dev);
+-					nt->np.dev = NULL;
+-				}
++				spin_unlock_irqrestore(&target_list_lock, flags);
++				__netpoll_cleanup(&nt->np);
++				spin_lock_irqsave(&target_list_lock, flags);
++				dev_put(nt->np.dev);
++				nt->np.dev = NULL;
+ 				nt->enabled = 0;
+ 				stopped = true;
+-				break;
++				netconsole_target_put(nt);
++				goto restart;
+ 			}
+ 		}
+ 		netconsole_target_put(nt);
+diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
+index 8f9382b..b968b35 100644
+--- a/drivers/net/wireless/mwifiex/join.c
++++ b/drivers/net/wireless/mwifiex/join.c
+@@ -1049,10 +1049,9 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mwifiex_private *priv,
+ 		adhoc_join->bss_descriptor.bssid,
+ 		adhoc_join->bss_descriptor.ssid);
+ 
+-	for (i = 0; bss_desc->supported_rates[i] &&
+-			i < MWIFIEX_SUPPORTED_RATES;
+-			i++)
+-			;
++	for (i = 0; i < MWIFIEX_SUPPORTED_RATES &&
++		    bss_desc->supported_rates[i]; i++)
++		;
+ 	rates_size = i;
+ 
+ 	/* Copy Data Rates from the Rates recorded in scan response */
+diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
+index 12b1ff5..8f2c88e 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+@@ -1157,7 +1157,9 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
+ 		rt2x00dev->hw->wiphy->interface_modes |=
+ 		    BIT(NL80211_IFTYPE_ADHOC) |
+ 		    BIT(NL80211_IFTYPE_AP) |
++#ifdef CONFIG_MAC80211_MESH
+ 		    BIT(NL80211_IFTYPE_MESH_POINT) |
++#endif
+ 		    BIT(NL80211_IFTYPE_WDS);
+ 
+ 	/*
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+index 0c74d4f..91d2e28 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+@@ -1377,74 +1377,57 @@ void rtl92cu_card_disable(struct ieee80211_hw *hw)
+ 
+ void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid)
+ {
+-	/* dummy routine needed for callback from rtl_op_configure_filter() */
+-}
+-
+-/*========================================================================== */
+-
+-static void _rtl92cu_set_check_bssid(struct ieee80211_hw *hw,
+-			      enum nl80211_iftype type)
+-{
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+-	u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
+ 	struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
+-	struct rtl_phy *rtlphy = &(rtlpriv->phy);
+-	u8 filterout_non_associated_bssid = false;
++	u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
+ 
+-	switch (type) {
+-	case NL80211_IFTYPE_ADHOC:
+-	case NL80211_IFTYPE_STATION:
+-		filterout_non_associated_bssid = true;
+-		break;
+-	case NL80211_IFTYPE_UNSPECIFIED:
+-	case NL80211_IFTYPE_AP:
+-	default:
+-		break;
+-	}
+-	if (filterout_non_associated_bssid) {
++	if (rtlpriv->psc.rfpwr_state != ERFON)
++		return;
++
++	if (check_bssid) {
++		u8 tmp;
+ 		if (IS_NORMAL_CHIP(rtlhal->version)) {
+-			switch (rtlphy->current_io_type) {
+-			case IO_CMD_RESUME_DM_BY_SCAN:
+-				reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
+-				rtlpriv->cfg->ops->set_hw_reg(hw,
+-						 HW_VAR_RCR, (u8 *)(&reg_rcr));
+-				/* enable update TSF */
+-				_rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4));
+-				break;
+-			case IO_CMD_PAUSE_DM_BY_SCAN:
+-				reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
+-				rtlpriv->cfg->ops->set_hw_reg(hw,
+-						 HW_VAR_RCR, (u8 *)(&reg_rcr));
+-				/* disable update TSF */
+-				_rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
+-				break;
+-			}
++			reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
++			tmp = BIT(4);
+ 		} else {
+-			reg_rcr |= (RCR_CBSSID);
+-			rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+-						      (u8 *)(&reg_rcr));
+-			_rtl92cu_set_bcn_ctrl_reg(hw, 0, (BIT(4)|BIT(5)));
++			reg_rcr |= RCR_CBSSID;
++			tmp = BIT(4) | BIT(5);
+ 		}
+-	} else if (filterout_non_associated_bssid == false) {
++		rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
++					      (u8 *) (&reg_rcr));
++		_rtl92cu_set_bcn_ctrl_reg(hw, 0, tmp);
++	} else {
++		u8 tmp;
+ 		if (IS_NORMAL_CHIP(rtlhal->version)) {
+-			reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
+-			rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+-						      (u8 *)(&reg_rcr));
+-			_rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
++			reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
++			tmp = BIT(4);
+ 		} else {
+-			reg_rcr &= (~RCR_CBSSID);
+-			rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+-						      (u8 *)(&reg_rcr));
+-			_rtl92cu_set_bcn_ctrl_reg(hw, (BIT(4)|BIT(5)), 0);
++			reg_rcr &= ~RCR_CBSSID;
++			tmp = BIT(4) | BIT(5);
+ 		}
++		reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
++		rtlpriv->cfg->ops->set_hw_reg(hw,
++					      HW_VAR_RCR, (u8 *) (&reg_rcr));
++		_rtl92cu_set_bcn_ctrl_reg(hw, tmp, 0);
+ 	}
+ }
+ 
++/*========================================================================== */
++
+ int rtl92cu_set_network_type(struct ieee80211_hw *hw, enum nl80211_iftype type)
+ {
++	struct rtl_priv *rtlpriv = rtl_priv(hw);
++
+ 	if (_rtl92cu_set_media_status(hw, type))
+ 		return -EOPNOTSUPP;
+-	_rtl92cu_set_check_bssid(hw, type);
++
++	if (rtlpriv->mac80211.link_state == MAC80211_LINKED) {
++		if (type != NL80211_IFTYPE_AP)
++			rtl92cu_set_check_bssid(hw, true);
++	} else {
++		rtl92cu_set_check_bssid(hw, false);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -2059,8 +2042,6 @@ void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
+ 			       (shortgi_rate << 4) | (shortgi_rate);
+ 	}
+ 	rtl_write_dword(rtlpriv, REG_ARFR0 + ratr_index * 4, ratr_value);
+-	RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, "%x\n",
+-		 rtl_read_dword(rtlpriv, REG_ARFR0));
+ }
+ 
+ void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
+diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
+index 110c777..12da810 100644
+--- a/drivers/platform/x86/asus-laptop.c
++++ b/drivers/platform/x86/asus-laptop.c
+@@ -860,8 +860,10 @@ static ssize_t show_infos(struct device *dev,
+ 	/*
+ 	 * The HWRS method return informations about the hardware.
+ 	 * 0x80 bit is for WLAN, 0x100 for Bluetooth.
++	 * 0x40 for WWAN, 0x10 for WIMAX.
+ 	 * The significance of others is yet to be found.
+-	 * If we don't find the method, we assume the device are present.
++	 * We don't currently use this for device detection, and it
++	 * takes several seconds to run on some systems.
+ 	 */
+ 	rv = acpi_evaluate_integer(asus->handle, "HWRS", NULL, &temp);
+ 	if (!ACPI_FAILURE(rv))
+@@ -1682,7 +1684,7 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
+ {
+ 	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+ 	union acpi_object *model = NULL;
+-	unsigned long long bsts_result, hwrs_result;
++	unsigned long long bsts_result;
+ 	char *string = NULL;
+ 	acpi_status status;
+ 
+@@ -1744,17 +1746,6 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
+ 	if (*string)
+ 		pr_notice("  %s model detected\n", string);
+ 
+-	/*
+-	 * The HWRS method return informations about the hardware.
+-	 * 0x80 bit is for WLAN, 0x100 for Bluetooth,
+-	 * 0x40 for WWAN, 0x10 for WIMAX.
+-	 * The significance of others is yet to be found.
+-	 */
+-	status =
+-	    acpi_evaluate_integer(asus->handle, "HWRS", NULL, &hwrs_result);
+-	if (!ACPI_FAILURE(status))
+-		pr_notice("  HWRS returned %x", (int)hwrs_result);
+-
+ 	if (!acpi_check_handle(asus->handle, METHOD_WL_STATUS, NULL))
+ 		asus->have_rsts = true;
+ 
+diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
+index db0cf7c..a0fc7b9 100644
+--- a/drivers/target/iscsi/iscsi_target_auth.c
++++ b/drivers/target/iscsi/iscsi_target_auth.c
+@@ -166,6 +166,7 @@ static int chap_server_compute_md5(
+ {
+ 	char *endptr;
+ 	unsigned long id;
++	unsigned char id_as_uchar;
+ 	unsigned char digest[MD5_SIGNATURE_SIZE];
+ 	unsigned char type, response[MD5_SIGNATURE_SIZE * 2 + 2];
+ 	unsigned char identifier[10], *challenge = NULL;
+@@ -355,7 +356,9 @@ static int chap_server_compute_md5(
+ 		goto out;
+ 	}
+ 
+-	sg_init_one(&sg, &id, 1);
++	/* To handle both endiannesses */
++	id_as_uchar = id;
++	sg_init_one(&sg, &id_as_uchar, 1);
+ 	ret = crypto_hash_update(&desc, &sg, 1);
+ 	if (ret < 0) {
+ 		pr_err("crypto_hash_update() failed for id\n");
+diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
+index 675303b..76fa1fa 100644
+--- a/drivers/tty/serial/sunsu.c
++++ b/drivers/tty/serial/sunsu.c
+@@ -968,6 +968,7 @@ static struct uart_ops sunsu_pops = {
+ #define UART_NR	4
+ 
+ static struct uart_sunsu_port sunsu_ports[UART_NR];
++static int nr_inst; /* Number of already registered ports */
+ 
+ #ifdef CONFIG_SERIO
+ 
+@@ -1337,13 +1338,8 @@ static int __init sunsu_console_setup(struct console *co, char *options)
+ 	printk("Console: ttyS%d (SU)\n",
+ 	       (sunsu_reg.minor - 64) + co->index);
+ 
+-	/*
+-	 * Check whether an invalid uart number has been specified, and
+-	 * if so, search for the first available port that does have
+-	 * console support.
+-	 */
+-	if (co->index >= UART_NR)
+-		co->index = 0;
++	if (co->index > nr_inst)
++		return -ENODEV;
+ 	port = &sunsu_ports[co->index].port;
+ 
+ 	/*
+@@ -1408,7 +1404,6 @@ static enum su_type __devinit su_get_type(struct device_node *dp)
+ 
+ static int __devinit su_probe(struct platform_device *op)
+ {
+-	static int inst;
+ 	struct device_node *dp = op->dev.of_node;
+ 	struct uart_sunsu_port *up;
+ 	struct resource *rp;
+@@ -1418,16 +1413,16 @@ static int __devinit su_probe(struct platform_device *op)
+ 
+ 	type = su_get_type(dp);
+ 	if (type == SU_PORT_PORT) {
+-		if (inst >= UART_NR)
++		if (nr_inst >= UART_NR)
+ 			return -EINVAL;
+-		up = &sunsu_ports[inst];
++		up = &sunsu_ports[nr_inst];
+ 	} else {
+ 		up = kzalloc(sizeof(*up), GFP_KERNEL);
+ 		if (!up)
+ 			return -ENOMEM;
+ 	}
+ 
+-	up->port.line = inst;
++	up->port.line = nr_inst;
+ 
+ 	spin_lock_init(&up->port.lock);
+ 
+@@ -1461,6 +1456,8 @@ static int __devinit su_probe(struct platform_device *op)
+ 		}
+ 		dev_set_drvdata(&op->dev, up);
+ 
++		nr_inst++;
++
+ 		return 0;
+ 	}
+ 
+@@ -1488,7 +1485,7 @@ static int __devinit su_probe(struct platform_device *op)
+ 
+ 	dev_set_drvdata(&op->dev, up);
+ 
+-	inst++;
++	nr_inst++;
+ 
+ 	return 0;
+ 
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 3a7a950..e411f18 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -601,7 +601,6 @@ static void acm_port_destruct(struct tty_port *port)
+ 
+ 	dev_dbg(&acm->control->dev, "%s\n", __func__);
+ 
+-	tty_unregister_device(acm_tty_driver, acm->minor);
+ 	acm_release_minor(acm);
+ 	usb_put_intf(acm->control);
+ 	kfree(acm->country_codes);
+@@ -1418,6 +1417,8 @@ static void acm_disconnect(struct usb_interface *intf)
+ 
+ 	stop_data_traffic(acm);
+ 
++	tty_unregister_device(acm_tty_driver, acm->minor);
++
+ 	usb_free_urb(acm->ctrlurb);
+ 	for (i = 0; i < ACM_NW; i++)
+ 		usb_free_urb(acm->wb[i].urb);
+diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
+index 622b4a4..2b487d4 100644
+--- a/drivers/usb/core/hcd-pci.c
++++ b/drivers/usb/core/hcd-pci.c
+@@ -173,6 +173,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 	struct hc_driver	*driver;
+ 	struct usb_hcd		*hcd;
+ 	int			retval;
++	int			hcd_irq = 0;
+ 
+ 	if (usb_disabled())
+ 		return -ENODEV;
+@@ -187,15 +188,19 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 		return -ENODEV;
+ 	dev->current_state = PCI_D0;
+ 
+-	/* The xHCI driver supports MSI and MSI-X,
+-	 * so don't fail if the BIOS doesn't provide a legacy IRQ.
++	/*
++	 * The xHCI driver has its own irq management
++	 * make sure irq setup is not touched for xhci in generic hcd code
+ 	 */
+-	if (!dev->irq && (driver->flags & HCD_MASK) != HCD_USB3) {
+-		dev_err(&dev->dev,
+-			"Found HC with no IRQ.  Check BIOS/PCI %s setup!\n",
+-			pci_name(dev));
+-		retval = -ENODEV;
+-		goto disable_pci;
++	if ((driver->flags & HCD_MASK) != HCD_USB3) {
++		if (!dev->irq) {
++			dev_err(&dev->dev,
++			"Found HC with no IRQ. Check BIOS/PCI %s setup!\n",
++				pci_name(dev));
++			retval = -ENODEV;
++			goto disable_pci;
++		}
++		hcd_irq = dev->irq;
+ 	}
+ 
+ 	hcd = usb_create_hcd(driver, &dev->dev, pci_name(dev));
+@@ -245,7 +250,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 
+ 	pci_set_master(dev);
+ 
+-	retval = usb_add_hcd(hcd, dev->irq, IRQF_SHARED);
++	retval = usb_add_hcd(hcd, hcd_irq, IRQF_SHARED);
+ 	if (retval != 0)
+ 		goto unmap_registers;
+ 	set_hs_companion(dev, hcd);
+diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
+index e305689..7261e8f 100644
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -135,7 +135,7 @@ qh_refresh (struct ehci_hcd *ehci, struct ehci_qh *qh)
+ 		 * qtd is updated in qh_completions(). Update the QH
+ 		 * overlay here.
+ 		 */
+-		if (qh->hw->hw_token & ACTIVE_BIT(ehci)) {
++		if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current) {
+ 			qh->hw->hw_qtd_next = qtd->hw_next;
+ 			qtd = NULL;
+ 		}
+@@ -459,19 +459,11 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
+ 			else if (last_status == -EINPROGRESS && !urb->unlinked)
+ 				continue;
+ 
+-			/*
+-			 * If this was the active qtd when the qh was unlinked
+-			 * and the overlay's token is active, then the overlay
+-			 * hasn't been written back to the qtd yet so use its
+-			 * token instead of the qtd's.  After the qtd is
+-			 * processed and removed, the overlay won't be valid
+-			 * any more.
+-			 */
+-			if (state == QH_STATE_IDLE &&
+-					qh->qtd_list.next == &qtd->qtd_list &&
+-					(hw->hw_token & ACTIVE_BIT(ehci))) {
++			/* qh unlinked; token in overlay may be most current */
++			if (state == QH_STATE_IDLE
++					&& cpu_to_hc32(ehci, qtd->qtd_dma)
++						== hw->hw_current) {
+ 				token = hc32_to_cpu(ehci, hw->hw_token);
+-				hw->hw_token &= ~ACTIVE_BIT(ehci);
+ 
+ 				/* An unlink may leave an incomplete
+ 				 * async transaction in the TT buffer.
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index b04134a..ec2c89f 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -350,7 +350,7 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
+ 	 * generate interrupts.  Don't even try to enable MSI.
+ 	 */
+ 	if (xhci->quirks & XHCI_BROKEN_MSI)
+-		return 0;
++		goto legacy_irq;
+ 
+ 	/* unregister the legacy interrupt */
+ 	if (hcd->irq)
+@@ -371,6 +371,7 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
+ 		return -EINVAL;
+ 	}
+ 
++ legacy_irq:
+ 	/* fall back to legacy interrupt*/
+ 	ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
+ 			hcd->irq_descr, hcd);
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 5361fd8..81d839f 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -206,8 +206,8 @@ struct xhci_op_regs {
+ /* bits 12:31 are reserved (and should be preserved on writes). */
+ 
+ /* IMAN - Interrupt Management Register */
+-#define IMAN_IP		(1 << 1)
+-#define IMAN_IE		(1 << 0)
++#define IMAN_IE		(1 << 1)
++#define IMAN_IP		(1 << 0)
+ 
+ /* USBSTS - USB status - status bitmasks */
+ /* HC not running - set to 1 when run/stop bit is cleared. */
+diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
+index e8eb634..ba5b527 100644
+--- a/drivers/usb/serial/garmin_gps.c
++++ b/drivers/usb/serial/garmin_gps.c
+@@ -971,10 +971,7 @@ static void garmin_close(struct usb_serial_port *port)
+ 	if (!serial)
+ 		return;
+ 
+-	mutex_lock(&port->serial->disc_mutex);
+-
+-	if (!port->serial->disconnected)
+-		garmin_clear(garmin_data_p);
++	garmin_clear(garmin_data_p);
+ 
+ 	/* shutdown our urbs */
+ 	usb_kill_urb(port->read_urb);
+@@ -983,8 +980,6 @@ static void garmin_close(struct usb_serial_port *port)
+ 	/* keep reset state so we know that we must start a new session */
+ 	if (garmin_data_p->state != STATE_RESET)
+ 		garmin_data_p->state = STATE_DISCONNECTED;
+-
+-	mutex_unlock(&port->serial->disc_mutex);
+ }
+ 
+ 
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index 40a95a7..7e8bb8f 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -2770,6 +2770,7 @@ static struct usb_serial_driver edgeport_2port_device = {
+ 	.set_termios		= edge_set_termios,
+ 	.tiocmget		= edge_tiocmget,
+ 	.tiocmset		= edge_tiocmset,
++	.get_icount		= edge_get_icount,
+ 	.write			= edge_write,
+ 	.write_room		= edge_write_room,
+ 	.chars_in_buffer	= edge_chars_in_buffer,
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index e4b199c..810695b 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -168,6 +168,7 @@ static void destroy_serial(struct kref *kref)
+ 		}
+ 	}
+ 
++	usb_put_intf(serial->interface);
+ 	usb_put_dev(serial->dev);
+ 	kfree(serial);
+ }
+@@ -625,7 +626,7 @@ static struct usb_serial *create_serial(struct usb_device *dev,
+ 	}
+ 	serial->dev = usb_get_dev(dev);
+ 	serial->type = driver;
+-	serial->interface = interface;
++	serial->interface = usb_get_intf(interface);
+ 	kref_init(&serial->kref);
+ 	mutex_init(&serial->disc_mutex);
+ 	serial->minor = SERIAL_TTY_NO_MINOR;
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 5ffa116..8ee632c 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -488,6 +488,13 @@ UNUSUAL_DEV(  0x04e8, 0x5122, 0x0000, 0x9999,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_MAX_SECTORS_64 | US_FL_BULK_IGNORE_TAG),
+ 
++/* Added by Dmitry Artamonow <mad_soft@×××××.ru> */
++UNUSUAL_DEV(  0x04e8, 0x5136, 0x0000, 0x9999,
++		"Samsung",
++		"YP-Z3",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_MAX_SECTORS_64),
++
+ /* Entry and supporting patch by Theodore Kilgore <kilgota@××××××.edu>.
+  * Device uses standards-violating 32-byte Bulk Command Block Wrappers and
+  * reports itself as "Proprietary SCSI Bulk." Cf. device entry 0x084d:0x0011.
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index 4134e53..50a3cb5 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -235,7 +235,8 @@ static void handle_tx(struct vhost_net *net)
+ 				msg.msg_controllen = 0;
+ 				ubufs = NULL;
+ 			} else {
+-				struct ubuf_info *ubuf = &vq->ubuf_info[head];
++				struct ubuf_info *ubuf;
++				ubuf = vq->ubuf_info + vq->upend_idx;
+ 
+ 				vq->heads[vq->upend_idx].len = len;
+ 				ubuf->callback = vhost_zerocopy_callback;
+diff --git a/fs/binfmt_em86.c b/fs/binfmt_em86.c
+index 2790c7e..575796a 100644
+--- a/fs/binfmt_em86.c
++++ b/fs/binfmt_em86.c
+@@ -42,7 +42,6 @@ static int load_em86(struct linux_binprm *bprm,struct pt_regs *regs)
+ 			return -ENOEXEC;
+ 	}
+ 
+-	bprm->recursion_depth++; /* Well, the bang-shell is implicit... */
+ 	allow_write_access(bprm->file);
+ 	fput(bprm->file);
+ 	bprm->file = NULL;
+diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
+index e172439..87fa90d 100644
+--- a/fs/binfmt_misc.c
++++ b/fs/binfmt_misc.c
+@@ -117,10 +117,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ 	if (!enabled)
+ 		goto _ret;
+ 
+-	retval = -ENOEXEC;
+-	if (bprm->recursion_depth > BINPRM_MAX_RECURSION)
+-		goto _ret;
+-
+ 	/* to keep locking time low, we copy the interpreter string */
+ 	read_lock(&entries_lock);
+ 	fmt = check_file(bprm);
+@@ -200,8 +196,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ 	if (retval < 0)
+ 		goto _error;
+ 
+-	bprm->recursion_depth++;
+-
+ 	retval = search_binary_handler (bprm, regs);
+ 	if (retval < 0)
+ 		goto _error;
+diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
+index df49d48..8ae4be1 100644
+--- a/fs/binfmt_script.c
++++ b/fs/binfmt_script.c
+@@ -22,15 +22,13 @@ static int load_script(struct linux_binprm *bprm,struct pt_regs *regs)
+ 	char interp[BINPRM_BUF_SIZE];
+ 	int retval;
+ 
+-	if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!') ||
+-	    (bprm->recursion_depth > BINPRM_MAX_RECURSION))
++	if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!'))
+ 		return -ENOEXEC;
+ 	/*
+ 	 * This section does the #! interpretation.
+ 	 * Sorta complicated, but hopefully it will work.  -TYT
+ 	 */
+ 
+-	bprm->recursion_depth++;
+ 	allow_write_access(bprm->file);
+ 	fput(bprm->file);
+ 	bprm->file = NULL;
+diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
+index cfd1ce3..1d36db1 100644
+--- a/fs/cifs/asn1.c
++++ b/fs/cifs/asn1.c
+@@ -614,53 +614,10 @@ decode_negTokenInit(unsigned char *security_blob, int length,
+ 		}
+ 	}
+ 
+-	/* mechlistMIC */
+-	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-		/* Check if we have reached the end of the blob, but with
+-		   no mechListMic (e.g. NTLMSSP instead of KRB5) */
+-		if (ctx.error == ASN1_ERR_DEC_EMPTY)
+-			goto decode_negtoken_exit;
+-		cFYI(1, "Error decoding last part negTokenInit exit3");
+-		return 0;
+-	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
+-		/* tag = 3 indicating mechListMIC */
+-		cFYI(1, "Exit 4 cls = %d con = %d tag = %d end = %p (%d)",
+-			cls, con, tag, end, *end);
+-		return 0;
+-	}
+-
+-	/* sequence */
+-	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-		cFYI(1, "Error decoding last part negTokenInit exit5");
+-		return 0;
+-	} else if ((cls != ASN1_UNI) || (con != ASN1_CON)
+-		   || (tag != ASN1_SEQ)) {
+-		cFYI(1, "cls = %d con = %d tag = %d end = %p (%d)",
+-			cls, con, tag, end, *end);
+-	}
+-
+-	/* sequence of */
+-	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-		cFYI(1, "Error decoding last part negTokenInit exit 7");
+-		return 0;
+-	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
+-		cFYI(1, "Exit 8 cls = %d con = %d tag = %d end = %p (%d)",
+-			cls, con, tag, end, *end);
+-		return 0;
+-	}
+-
+-	/* general string */
+-	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-		cFYI(1, "Error decoding last part negTokenInit exit9");
+-		return 0;
+-	} else if ((cls != ASN1_UNI) || (con != ASN1_PRI)
+-		   || (tag != ASN1_GENSTR)) {
+-		cFYI(1, "Exit10 cls = %d con = %d tag = %d end = %p (%d)",
+-			cls, con, tag, end, *end);
+-		return 0;
+-	}
+-	cFYI(1, "Need to call asn1_octets_decode() function for %s",
+-		ctx.pointer);	/* is this UTF-8 or ASCII? */
+-decode_negtoken_exit:
++	/*
++	 * We currently ignore anything at the end of the SPNEGO blob after
++	 * the mechTypes have been parsed, since none of that info is
++	 * used at the moment.
++	 */
+ 	return 1;
+ }
+diff --git a/fs/exec.c b/fs/exec.c
+index 51d8629..e3a7e36d 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1389,6 +1389,10 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+ 	struct linux_binfmt *fmt;
+ 	pid_t old_pid, old_vpid;
+ 
++	/* This allows 4 levels of binfmt rewrites before failing hard. */
++	if (depth > 5)
++		return -ELOOP;
++
+ 	retval = security_bprm_check(bprm);
+ 	if (retval)
+ 		return retval;
+@@ -1413,12 +1417,8 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+ 			if (!try_module_get(fmt->module))
+ 				continue;
+ 			read_unlock(&binfmt_lock);
++			bprm->recursion_depth = depth + 1;
+ 			retval = fn(bprm, regs);
+-			/*
+-			 * Restore the depth counter to its starting value
+-			 * in this call, so we don't have to rely on every
+-			 * load_binary function to restore it on return.
+-			 */
+ 			bprm->recursion_depth = depth;
+ 			if (retval >= 0) {
+ 				if (depth == 0) {
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 852d4c2..0efff1e 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -2959,6 +2959,7 @@ static int ext4_split_extent(handle_t *handle,
+ 	int err = 0;
+ 	int uninitialized;
+ 	int split_flag1, flags1;
++	int allocated = map->m_len;
+ 
+ 	depth = ext_depth(inode);
+ 	ex = path[depth].p_ext;
+@@ -2978,6 +2979,8 @@ static int ext4_split_extent(handle_t *handle,
+ 				map->m_lblk + map->m_len, split_flag1, flags1);
+ 		if (err)
+ 			goto out;
++	} else {
++		allocated = ee_len - (map->m_lblk - ee_block);
+ 	}
+ 
+ 	ext4_ext_drop_refs(path);
+@@ -3000,7 +3003,7 @@ static int ext4_split_extent(handle_t *handle,
+ 
+ 	ext4_ext_show_leaf(inode, path);
+ out:
+-	return err ? err : map->m_len;
++	return err ? err : allocated;
+ }
+ 
+ #define EXT4_EXT_ZERO_LEN 7
+@@ -3668,6 +3671,7 @@ out:
+ 					allocated - map->m_len);
+ 		allocated = map->m_len;
+ 	}
++	map->m_len = allocated;
+ 
+ 	/*
+ 	 * If we have done fallocate with the offset that is already
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index a0d7e26..2857e5b 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -144,7 +144,8 @@ void ext4_evict_inode(struct inode *inode)
+ 		 * don't use page cache.
+ 		 */
+ 		if (ext4_should_journal_data(inode) &&
+-		    (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode))) {
++		    (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode)) &&
++		    inode->i_ino != EXT4_JOURNAL_INO) {
+ 			journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
+ 			tid_t commit_tid = EXT4_I(inode)->i_datasync_tid;
+ 
+diff --git a/fs/isofs/export.c b/fs/isofs/export.c
+index 516eb21..fd88add 100644
+--- a/fs/isofs/export.c
++++ b/fs/isofs/export.c
+@@ -135,6 +135,7 @@ isofs_export_encode_fh(struct dentry *dentry,
+ 	len = 3;
+ 	fh32[0] = ei->i_iget5_block;
+  	fh16[2] = (__u16)ei->i_iget5_offset;  /* fh16 [sic] */
++	fh16[3] = 0;  /* avoid leaking uninitialized data */
+ 	fh32[2] = inode->i_generation;
+ 	if (connectable && !S_ISDIR(inode->i_mode)) {
+ 		struct inode *parent;
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index de8b4cb..6075ac03 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1047,9 +1047,12 @@ out:
+ void jbd2_journal_set_triggers(struct buffer_head *bh,
+ 			       struct jbd2_buffer_trigger_type *type)
+ {
+-	struct journal_head *jh = bh2jh(bh);
++	struct journal_head *jh = jbd2_journal_grab_journal_head(bh);
+ 
++	if (WARN_ON(!jh))
++		return;
+ 	jh->b_triggers = type;
++	jbd2_journal_put_journal_head(jh);
+ }
+ 
+ void jbd2_buffer_frozen_trigger(struct journal_head *jh, void *mapped_data,
+@@ -1101,17 +1104,18 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
+ {
+ 	transaction_t *transaction = handle->h_transaction;
+ 	journal_t *journal = transaction->t_journal;
+-	struct journal_head *jh = bh2jh(bh);
++	struct journal_head *jh;
+ 	int ret = 0;
+ 
+-	jbd_debug(5, "journal_head %p\n", jh);
+-	JBUFFER_TRACE(jh, "entry");
+ 	if (is_handle_aborted(handle))
+ 		goto out;
+-	if (!buffer_jbd(bh)) {
++	jh = jbd2_journal_grab_journal_head(bh);
++	if (!jh) {
+ 		ret = -EUCLEAN;
+ 		goto out;
+ 	}
++	jbd_debug(5, "journal_head %p\n", jh);
++	JBUFFER_TRACE(jh, "entry");
+ 
+ 	jbd_lock_bh_state(bh);
+ 
+@@ -1202,6 +1206,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
+ 	spin_unlock(&journal->j_list_lock);
+ out_unlock_bh:
+ 	jbd_unlock_bh_state(bh);
++	jbd2_journal_put_journal_head(jh);
+ out:
+ 	JBUFFER_TRACE(jh, "exit");
+ 	WARN_ON(ret);	/* All errors are bugs, so dump the stack */
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index 38de8f2..78bff11 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -1280,6 +1280,7 @@ static int udf_encode_fh(struct dentry *de, __u32 *fh, int *lenp,
+ 	*lenp = 3;
+ 	fid->udf.block = location.logicalBlockNum;
+ 	fid->udf.partref = location.partitionReferenceNum;
++	fid->udf.parent_partref = 0;
+ 	fid->udf.generation = inode->i_generation;
+ 
+ 	if (connectable && !S_ISDIR(inode->i_mode)) {
+diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
+index 42ad69a..9e8e08e 100644
+--- a/fs/udf/udf_sb.h
++++ b/fs/udf/udf_sb.h
+@@ -82,7 +82,7 @@ struct udf_virtual_data {
+ struct udf_bitmap {
+ 	__u32			s_extLength;
+ 	__u32			s_extPosition;
+-	__u16			s_nr_groups;
++	int			s_nr_groups;
+ 	struct buffer_head 	**s_block_bitmap;
+ };
+ 
+diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
+index 7207a99..d9928c1 100644
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -572,7 +572,11 @@
+ 	{0x1002, 0x9908, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x9909, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x990A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+-	{0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++	{0x1002, 0x990B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++	{0x1002, 0x990C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++	{0x1002, 0x990D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++	{0x1002, 0x990E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++	{0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x9910, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x9913, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x9917, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+@@ -583,6 +587,13 @@
+ 	{0x1002, 0x9992, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x9993, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x9994, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++	{0x1002, 0x9995, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++	{0x1002, 0x9996, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++	{0x1002, 0x9997, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++	{0x1002, 0x9998, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++	{0x1002, 0x9999, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++	{0x1002, 0x999A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++	{0x1002, 0x999B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x99A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x99A2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x99A4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
+index eb53e15..5bab59b 100644
+--- a/include/linux/binfmts.h
++++ b/include/linux/binfmts.h
+@@ -68,8 +68,6 @@ struct linux_binprm {
+ #define BINPRM_FLAGS_EXECFD_BIT 1
+ #define BINPRM_FLAGS_EXECFD (1 << BINPRM_FLAGS_EXECFD_BIT)
+ 
+-#define BINPRM_MAX_RECURSION 4
+-
+ /* Function parameter for binfmt->coredump */
+ struct coredump_params {
+ 	long signr;
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index c1bae8d..4aea870 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -479,7 +479,7 @@ struct sk_buff {
+ 	union {
+ 		__u32		mark;
+ 		__u32		dropcount;
+-		__u32		avail_size;
++		__u32		reserved_tailroom;
+ 	};
+ 
+ 	sk_buff_data_t		transport_header;
+@@ -1373,7 +1373,10 @@ static inline int skb_tailroom(const struct sk_buff *skb)
+  */
+ static inline int skb_availroom(const struct sk_buff *skb)
+ {
+-	return skb_is_nonlinear(skb) ? 0 : skb->avail_size - skb->len;
++	if (skb_is_nonlinear(skb))
++		return 0;
++
++	return skb->end - skb->tail - skb->reserved_tailroom;
+ }
+ 
+ /**
+diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
+index 16ff29a..b289bd2 100644
+--- a/include/net/inet_frag.h
++++ b/include/net/inet_frag.h
+@@ -33,6 +33,13 @@ struct inet_frag_queue {
+ 
+ #define INETFRAGS_HASHSZ		64
+ 
++/* averaged:
++ * max_depth = default ipfrag_high_thresh / INETFRAGS_HASHSZ /
++ *	       rounded up (SKB_TRUELEN(0) + sizeof(struct ipq or
++ *	       struct frag_queue))
++ */
++#define INETFRAGS_MAXDEPTH		128
++
+ struct inet_frags {
+ 	struct hlist_head	hash[INETFRAGS_HASHSZ];
+ 	rwlock_t		lock;
+@@ -64,6 +71,8 @@ int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f);
+ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
+ 		struct inet_frags *f, void *key, unsigned int hash)
+ 	__releases(&f->lock);
++void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q,
++				   const char *prefix);
+ 
+ static inline void inet_frag_put(struct inet_frag_queue *q, struct inet_frags *f)
+ {
+diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
+index 10422ef..2124004 100644
+--- a/include/net/ip_fib.h
++++ b/include/net/ip_fib.h
+@@ -129,18 +129,16 @@ struct fib_result_nl {
+ };
+ 
+ #ifdef CONFIG_IP_ROUTE_MULTIPATH
+-
+ #define FIB_RES_NH(res)		((res).fi->fib_nh[(res).nh_sel])
+-
+-#define FIB_TABLE_HASHSZ 2
+-
+ #else /* CONFIG_IP_ROUTE_MULTIPATH */
+-
+ #define FIB_RES_NH(res)		((res).fi->fib_nh[0])
++#endif /* CONFIG_IP_ROUTE_MULTIPATH */
+ 
++#ifdef CONFIG_IP_MULTIPLE_TABLES
+ #define FIB_TABLE_HASHSZ 256
+-
+-#endif /* CONFIG_IP_ROUTE_MULTIPATH */
++#else
++#define FIB_TABLE_HASHSZ 2
++#endif
+ 
+ extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
+ 
+diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
+index f113755..a13987a 100644
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -66,7 +66,8 @@ static void tick_broadcast_start_periodic(struct clock_event_device *bc)
+  */
+ int tick_check_broadcast_device(struct clock_event_device *dev)
+ {
+-	if ((tick_broadcast_device.evtdev &&
++	if ((dev->features & CLOCK_EVT_FEAT_DUMMY) ||
++	    (tick_broadcast_device.evtdev &&
+ 	     tick_broadcast_device.evtdev->rating >= dev->rating) ||
+ 	     (dev->features & CLOCK_EVT_FEAT_C3STOP))
+ 		return 0;
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index e603477..01d8e62 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -496,12 +496,17 @@ void tick_nohz_idle_enter(void)
+  */
+ void tick_nohz_irq_exit(void)
+ {
++	unsigned long flags;
+ 	struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
+ 
+ 	if (!ts->inidle)
+ 		return;
+ 
++	local_irq_save(flags);
++
+ 	tick_nohz_stop_sched_tick(ts);
++
++	local_irq_restore(flags);
+ }
+ 
+ /**
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 4a86e64..62f3751 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -3034,8 +3034,8 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
+ 					continue;
+ 			}
+ 
+-			hlist_del(&entry->node);
+-			call_rcu(&entry->rcu, ftrace_free_entry_rcu);
++			hlist_del_rcu(&entry->node);
++			call_rcu_sched(&entry->rcu, ftrace_free_entry_rcu);
+ 		}
+ 	}
+ 	__disable_ftrace_function_probe();
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 55e4d4c..681a759 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -708,7 +708,7 @@ __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
+ void
+ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
+ {
+-	struct ring_buffer *buf = tr->buffer;
++	struct ring_buffer *buf;
+ 
+ 	if (trace_stop_count)
+ 		return;
+@@ -720,6 +720,7 @@ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
+ 	}
+ 	arch_spin_lock(&ftrace_max_lock);
+ 
++	buf = tr->buffer;
+ 	tr->buffer = max_tr.buffer;
+ 	max_tr.buffer = buf;
+ 
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index c384e09..e427969 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2096,8 +2096,12 @@ int hugetlb_report_node_meminfo(int nid, char *buf)
+ /* Return the number pages of memory we physically have, in PAGE_SIZE units. */
+ unsigned long hugetlb_total_pages(void)
+ {
+-	struct hstate *h = &default_hstate;
+-	return h->nr_huge_pages * pages_per_huge_page(h);
++	struct hstate *h;
++	unsigned long nr_total_pages = 0;
++
++	for_each_hstate(h)
++		nr_total_pages += h->nr_huge_pages * pages_per_huge_page(h);
++	return nr_total_pages;
+ }
+ 
+ static int hugetlb_acct_memory(struct hstate *h, long delta)
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index da7b3a5..3db960c 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -2050,7 +2050,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 		struct rtattr *attr = (void *)nlh + NLMSG_ALIGN(min_len);
+ 
+ 		while (RTA_OK(attr, attrlen)) {
+-			unsigned flavor = attr->rta_type;
++			unsigned int flavor = attr->rta_type & NLA_TYPE_MASK;
+ 			if (flavor) {
+ 				if (flavor > rta_max[sz_idx])
+ 					return -EINVAL;
+diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
+index 5ff2a51..210b710 100644
+--- a/net/ipv4/inet_fragment.c
++++ b/net/ipv4/inet_fragment.c
+@@ -21,6 +21,7 @@
+ #include <linux/rtnetlink.h>
+ #include <linux/slab.h>
+ 
++#include <net/sock.h>
+ #include <net/inet_frag.h>
+ 
+ static void inet_frag_secret_rebuild(unsigned long dummy)
+@@ -271,6 +272,7 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
+ {
+ 	struct inet_frag_queue *q;
+ 	struct hlist_node *n;
++	int depth = 0;
+ 
+ 	hlist_for_each_entry(q, n, &f->hash[hash], list) {
+ 		if (q->net == nf && f->match(q, key)) {
+@@ -278,9 +280,25 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
+ 			read_unlock(&f->lock);
+ 			return q;
+ 		}
++		depth++;
+ 	}
+ 	read_unlock(&f->lock);
+ 
+-	return inet_frag_create(nf, f, key);
++	if (depth <= INETFRAGS_MAXDEPTH)
++		return inet_frag_create(nf, f, key);
++	else
++		return ERR_PTR(-ENOBUFS);
+ }
+ EXPORT_SYMBOL(inet_frag_find);
++
++void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q,
++				   const char *prefix)
++{
++	static const char msg[] = "inet_frag_find: Fragment hash bucket"
++		" list length grew over limit " __stringify(INETFRAGS_MAXDEPTH)
++		". Dropping fragment.\n";
++
++	if (PTR_ERR(q) == -ENOBUFS)
++		LIMIT_NETDEBUG(KERN_WARNING "%s%s", prefix, msg);
++}
++EXPORT_SYMBOL(inet_frag_maybe_warn_overflow);
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index b7bf6e3..8e28871 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -295,14 +295,11 @@ static inline struct ipq *ip_find(struct net *net, struct iphdr *iph, u32 user)
+ 	hash = ipqhashfn(iph->id, iph->saddr, iph->daddr, iph->protocol);
+ 
+ 	q = inet_frag_find(&net->ipv4.frags, &ip4_frags, &arg, hash);
+-	if (q == NULL)
+-		goto out_nomem;
+-
++	if (IS_ERR_OR_NULL(q)) {
++		inet_frag_maybe_warn_overflow(q, pr_fmt());
++		return NULL;
++	}
+ 	return container_of(q, struct ipq, q);
+-
+-out_nomem:
+-	LIMIT_NETDEBUG(KERN_ERR pr_fmt("ip_frag_create: no memory left !\n"));
+-	return NULL;
+ }
+ 
+ /* Is the fragment too far ahead to be part of ipq? */
+diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
+index a0d0d9d..b69a370 100644
+--- a/net/ipv4/ip_options.c
++++ b/net/ipv4/ip_options.c
+@@ -360,7 +360,6 @@ int ip_options_compile(struct net *net,
+ 				}
+ 				switch (optptr[3]&0xF) {
+ 				      case IPOPT_TS_TSONLY:
+-					opt->ts = optptr - iph;
+ 					if (skb)
+ 						timeptr = &optptr[optptr[2]-1];
+ 					opt->ts_needtime = 1;
+@@ -371,7 +370,6 @@ int ip_options_compile(struct net *net,
+ 						pp_ptr = optptr + 2;
+ 						goto error;
+ 					}
+-					opt->ts = optptr - iph;
+ 					if (rt)  {
+ 						memcpy(&optptr[optptr[2]-1], &rt->rt_spec_dst, 4);
+ 						timeptr = &optptr[optptr[2]+3];
+@@ -385,7 +383,6 @@ int ip_options_compile(struct net *net,
+ 						pp_ptr = optptr + 2;
+ 						goto error;
+ 					}
+-					opt->ts = optptr - iph;
+ 					{
+ 						__be32 addr;
+ 						memcpy(&addr, &optptr[optptr[2]-1], 4);
+@@ -418,12 +415,12 @@ int ip_options_compile(struct net *net,
+ 					pp_ptr = optptr + 3;
+ 					goto error;
+ 				}
+-				opt->ts = optptr - iph;
+ 				if (skb) {
+ 					optptr[3] = (optptr[3]&0xF)|((overflow+1)<<4);
+ 					opt->is_changed = 1;
+ 				}
+ 			}
++			opt->ts = optptr - iph;
+ 			break;
+ 		      case IPOPT_RA:
+ 			if (optlen < 4) {
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 01870bd..dcb19f5 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -704,7 +704,7 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
+ 			 * Make sure that we have exactly size bytes
+ 			 * available to the caller, no more, no less.
+ 			 */
+-			skb->avail_size = size;
++			skb->reserved_tailroom = skb->end - skb->tail - size;
+ 			return skb;
+ 		}
+ 		__kfree_skb(skb);
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 2d27e1a..952f7dd 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1096,7 +1096,6 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
+ 	eat = min_t(int, len, skb_headlen(skb));
+ 	if (eat) {
+ 		__skb_pull(skb, eat);
+-		skb->avail_size -= eat;
+ 		len -= eat;
+ 		if (!len)
+ 			return;
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index 38f00b0..52e2f65 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -14,6 +14,8 @@
+  * 2 of the License, or (at your option) any later version.
+  */
+ 
++#define pr_fmt(fmt) "IPv6-nf: " fmt
++
+ #include <linux/errno.h>
+ #include <linux/types.h>
+ #include <linux/string.h>
+@@ -176,13 +178,12 @@ fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst)
+ 
+ 	q = inet_frag_find(&nf_init_frags, &nf_frags, &arg, hash);
+ 	local_bh_enable();
+-	if (q == NULL)
+-		goto oom;
++	if (IS_ERR_OR_NULL(q)) {
++		inet_frag_maybe_warn_overflow(q, pr_fmt());
++		return NULL;
++	}
+ 
+ 	return container_of(q, struct nf_ct_frag6_queue, q);
+-
+-oom:
+-	return NULL;
+ }
+ 
+ 
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index 9447bd6..5ff412f 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -26,6 +26,9 @@
+  *	YOSHIFUJI,H. @USAGI	Always remove fragment header to
+  *				calculate ICV correctly.
+  */
++
++#define pr_fmt(fmt) "IPv6: " fmt
++
+ #include <linux/errno.h>
+ #include <linux/types.h>
+ #include <linux/string.h>
+@@ -240,9 +243,10 @@ fq_find(struct net *net, __be32 id, const struct in6_addr *src, const struct in6
+ 	hash = inet6_hash_frag(id, src, dst, ip6_frags.rnd);
+ 
+ 	q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);
+-	if (q == NULL)
++	if (IS_ERR_OR_NULL(q)) {
++		inet_frag_maybe_warn_overflow(q, pr_fmt());
+ 		return NULL;
+-
++	}
+ 	return container_of(q, struct frag_queue, q);
+ }
+ 
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index acd2edb..3c04692 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1050,7 +1050,7 @@ struct sctp_transport *sctp_assoc_lookup_tsn(struct sctp_association *asoc,
+ 			transports) {
+ 
+ 		if (transport == active)
+-			break;
++			continue;
+ 		list_for_each_entry(chunk, &transport->transmitted,
+ 				transmitted_list) {
+ 			if (key == chunk->subh.data_hdr->tsn) {
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 891f5db..cb1c430 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -2044,7 +2044,7 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
+ 	}
+ 
+ 	/* Delete the tempory new association. */
+-	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
++	sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC, SCTP_ASOC(new_asoc));
+ 	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
+ 
+ 	/* Restore association pointer to provide SCTP command interpeter
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index fb767c6..dfc8c22 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -1081,12 +1081,12 @@ long keyctl_instantiate_key_iov(key_serial_t id,
+ 	ret = rw_copy_check_uvector(WRITE, _payload_iov, ioc,
+ 				    ARRAY_SIZE(iovstack), iovstack, &iov, 1);
+ 	if (ret < 0)
+-		return ret;
++		goto err;
+ 	if (ret == 0)
+ 		goto no_payload_free;
+ 
+ 	ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
+-
++err:
+ 	if (iov != iovstack)
+ 		kfree(iov);
+ 	return ret;
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index cec7479..28e070a 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2910,7 +2910,7 @@ static unsigned int convert_to_spdif_status(unsigned short val)
+ 	if (val & AC_DIG1_PROFESSIONAL)
+ 		sbits |= IEC958_AES0_PROFESSIONAL;
+ 	if (sbits & IEC958_AES0_PROFESSIONAL) {
+-		if (sbits & AC_DIG1_EMPHASIS)
++		if (val & AC_DIG1_EMPHASIS)
+ 			sbits |= IEC958_AES0_PRO_EMPHASIS_5015;
+ 	} else {
+ 		if (val & AC_DIG1_EMPHASIS)
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 3897027..033c4c5 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1177,7 +1177,7 @@ static int patch_cxt5045(struct hda_codec *codec)
+ 	}
+ 
+ 	if (spec->beep_amp)
+-		snd_hda_attach_beep_device(codec, spec->beep_amp);
++		snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
+ 
+ 	return 0;
+ }
+@@ -1960,7 +1960,7 @@ static int patch_cxt5051(struct hda_codec *codec)
+ 	}
+ 
+ 	if (spec->beep_amp)
+-		snd_hda_attach_beep_device(codec, spec->beep_amp);
++		snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
+ 
+ 	return 0;
+ }
+@@ -3151,7 +3151,7 @@ static int patch_cxt5066(struct hda_codec *codec)
+ 	}
+ 
+ 	if (spec->beep_amp)
+-		snd_hda_attach_beep_device(codec, spec->beep_amp);
++		snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
+ 
+ 	return 0;
+ }
+@@ -4501,7 +4501,7 @@ static int patch_conexant_auto(struct hda_codec *codec)
+ 	spec->capture_stream = &cx_auto_pcm_analog_capture;
+ 	codec->patch_ops = cx_auto_patch_ops;
+ 	if (spec->beep_amp)
+-		snd_hda_attach_beep_device(codec, spec->beep_amp);
++		snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
+ 
+ 	/* Some laptops with Conexant chips show stalls in S3 resume,
+ 	 * which falls into the single-cmd mode.
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 15b0712..f008fc7 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -711,8 +711,9 @@ static int check_input_term(struct mixer_build *state, int id, struct usb_audio_
+ 		case UAC2_CLOCK_SELECTOR: {
+ 			struct uac_selector_unit_descriptor *d = p1;
+ 			/* call recursively to retrieve the channel info */
+-			if (check_input_term(state, d->baSourceID[0], term) < 0)
+-				return -ENODEV;
++			err = check_input_term(state, d->baSourceID[0], term);
++			if (err < 0)
++				return err;
+ 			term->type = d->bDescriptorSubtype << 16; /* virtual type */
+ 			term->id = id;
+ 			term->name = uac_selector_unit_iSelector(d);
+@@ -1263,8 +1264,9 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void
+ 		return err;
+ 
+ 	/* determine the input source type and name */
+-	if (check_input_term(state, hdr->bSourceID, &iterm) < 0)
+-		return -EINVAL;
++	err = check_input_term(state, hdr->bSourceID, &iterm);
++	if (err < 0)
++		return err;
+ 
+ 	master_bits = snd_usb_combine_bytes(bmaControls, csize);
+ 	/* master configuration quirks */
+@@ -2025,7 +2027,7 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
+ 			state.oterm.type = le16_to_cpu(desc->wTerminalType);
+ 			state.oterm.name = desc->iTerminal;
+ 			err = parse_audio_unit(&state, desc->bSourceID);
+-			if (err < 0)
++			if (err < 0 && err != -EINVAL)
+ 				return err;
+ 		} else { /* UAC_VERSION_2 */
+ 			struct uac2_output_terminal_descriptor *desc = p;
+@@ -2037,12 +2039,12 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
+ 			state.oterm.type = le16_to_cpu(desc->wTerminalType);
+ 			state.oterm.name = desc->iTerminal;
+ 			err = parse_audio_unit(&state, desc->bSourceID);
+-			if (err < 0)
++			if (err < 0 && err != -EINVAL)
+ 				return err;
+ 
+ 			/* for UAC2, use the same approach to also add the clock selectors */
+ 			err = parse_audio_unit(&state, desc->bCSourceID);
+-			if (err < 0)
++			if (err < 0 && err != -EINVAL)
+ 				return err;
+ 		}
+ 	}
+diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
+index 2984ffb..60a8e29 100644
+--- a/tools/hv/hv_kvp_daemon.c
++++ b/tools/hv/hv_kvp_daemon.c
+@@ -727,13 +727,19 @@ int main(void)
+ 		len = recvfrom(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0,
+ 				addr_p, &addr_l);
+ 
+-		if (len < 0 || addr.nl_pid) {
++		if (len < 0) {
+ 			syslog(LOG_ERR, "recvfrom failed; pid:%u error:%d %s",
+ 					addr.nl_pid, errno, strerror(errno));
+ 			close(fd);
+ 			return -1;
+ 		}
+ 
++		if (addr.nl_pid) {
++			syslog(LOG_WARNING, "Received packet from untrusted pid:%u",
++					addr.nl_pid);
++			continue;
++		}
++
+ 		incoming_msg = (struct nlmsghdr *)kvp_recv_buffer;
+ 		incoming_cn_msg = (struct cn_msg *)NLMSG_DATA(incoming_msg);
+ 		hv_msg = (struct hv_kvp_msg *)incoming_cn_msg->data;