[gentoo-commits] linux-patches r1721 - genpatches-2.6/trunk/2.6.33

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2010-07-05 23:09:19 +0000 (Mon, 05 Jul 2010)
New Revision: 1721

Added:
   genpatches-2.6/trunk/2.6.33/1003_linux-2.6.33.4.patch
   genpatches-2.6/trunk/2.6.33/1004_linux-2.6.33.5.patch
   genpatches-2.6/trunk/2.6.33/1005_linux-2.6.33.6.patch
Removed:
   genpatches-2.6/trunk/2.6.33/1002_linux-2.6.33.4.patch
   genpatches-2.6/trunk/2.6.33/1003_linux-2.6.33.5.patch
Modified:
   genpatches-2.6/trunk/2.6.33/0000_README
Log:
Reordering of patchsets and adding linux 2.6.33.6

Modified: genpatches-2.6/trunk/2.6.33/0000_README
===================================================================
--- genpatches-2.6/trunk/2.6.33/0000_README	2010-07-05 22:42:35 UTC (rev 1720)
+++ genpatches-2.6/trunk/2.6.33/0000_README	2010-07-05 23:09:19 UTC (rev 1721)
@@ -47,6 +47,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 2.6.33.2
 
+Patch:  1002_linux-2.6.33.3.patch
+From:   http://www.kernel.org
+Desc:   Linux 2.6.33.3
+
 Patch:  1003_linux-2.6.33.4.patch
 From:   http://www.kernel.org
 Desc:   Linux 2.6.33.4
@@ -55,9 +59,9 @@
 From:   http://www.kernel.org
 Desc:   Linux 2.6.33.5
 
-Patch:  1002_linux-2.6.33.3.patch
+Patch:  1005_linux-2.6.33.6.patch
 From:   http://www.kernel.org
-Desc:   Linux 2.6.33.3
+Desc:   Linux 2.6.33.6
 
 Patch:  2700_vbfb-section-cleanup.patch
 From:   http://lkml.org/lkml/2010/6/25/271

Deleted: genpatches-2.6/trunk/2.6.33/1002_linux-2.6.33.4.patch
===================================================================
--- genpatches-2.6/trunk/2.6.33/1002_linux-2.6.33.4.patch	2010-07-05 22:42:35 UTC (rev 1720)
+++ genpatches-2.6/trunk/2.6.33/1002_linux-2.6.33.4.patch	2010-07-05 23:09:19 UTC (rev 1721)
@@ -1,4010 +0,0 @@
-diff --git a/arch/arm/mach-pxa/include/mach/colibri.h b/arch/arm/mach-pxa/include/mach/colibri.h
-index 811743c..5f2ba8d 100644
---- a/arch/arm/mach-pxa/include/mach/colibri.h
-+++ b/arch/arm/mach-pxa/include/mach/colibri.h
-@@ -2,6 +2,7 @@
- #define _COLIBRI_H_
- 
- #include <net/ax88796.h>
-+#include <mach/mfp.h>
- 
- /*
-  * common settings for all modules
-diff --git a/arch/mips/include/asm/mach-sibyte/war.h b/arch/mips/include/asm/mach-sibyte/war.h
-index 7950ef4..743385d 100644
---- a/arch/mips/include/asm/mach-sibyte/war.h
-+++ b/arch/mips/include/asm/mach-sibyte/war.h
-@@ -16,7 +16,11 @@
- #if defined(CONFIG_SB1_PASS_1_WORKAROUNDS) || \
-     defined(CONFIG_SB1_PASS_2_WORKAROUNDS)
- 
--#define BCM1250_M3_WAR	1
-+#ifndef __ASSEMBLY__
-+extern int sb1250_m3_workaround_needed(void);
-+#endif
-+
-+#define BCM1250_M3_WAR	sb1250_m3_workaround_needed()
- #define SIBYTE_1956_WAR	1
- 
- #else
-diff --git a/arch/mips/sibyte/sb1250/setup.c b/arch/mips/sibyte/sb1250/setup.c
-index 0444da1..92da315 100644
---- a/arch/mips/sibyte/sb1250/setup.c
-+++ b/arch/mips/sibyte/sb1250/setup.c
-@@ -87,6 +87,21 @@ static int __init setup_bcm1250(void)
- 	return ret;
- }
- 
-+int sb1250_m3_workaround_needed(void)
-+{
-+	switch (soc_type) {
-+	case K_SYS_SOC_TYPE_BCM1250:
-+	case K_SYS_SOC_TYPE_BCM1250_ALT:
-+	case K_SYS_SOC_TYPE_BCM1250_ALT2:
-+	case K_SYS_SOC_TYPE_BCM1125:
-+	case K_SYS_SOC_TYPE_BCM1125H:
-+		return soc_pass < K_SYS_REVISION_BCM1250_C0;
-+
-+	default:
-+		return 0;
-+	}
-+}
-+
- static int __init setup_bcm112x(void)
- {
- 	int ret = 0;
-diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
-index 9258074..567cd57 100644
---- a/arch/powerpc/kernel/head_64.S
-+++ b/arch/powerpc/kernel/head_64.S
-@@ -615,6 +615,17 @@ _GLOBAL(start_secondary_prolog)
- 	std	r3,0(r1)		/* Zero the stack frame pointer	*/
- 	bl	.start_secondary
- 	b	.
-+/*
-+ * Reset stack pointer and call start_secondary
-+ * to continue with online operation when woken up
-+ * from cede in cpu offline.
-+ */
-+_GLOBAL(start_secondary_resume)
-+	ld	r1,PACAKSAVE(r13)	/* Reload kernel stack pointer */
-+	li	r3,0
-+	std	r3,0(r1)		/* Zero the stack frame pointer	*/
-+	bl	.start_secondary
-+	b	.
- #endif
- 
- /*
-diff --git a/arch/powerpc/mm/fsl_booke_mmu.c b/arch/powerpc/mm/fsl_booke_mmu.c
-index c539472..1ce9dd5 100644
---- a/arch/powerpc/mm/fsl_booke_mmu.c
-+++ b/arch/powerpc/mm/fsl_booke_mmu.c
-@@ -155,15 +155,10 @@ static void settlbcam(int index, unsigned long virt, phys_addr_t phys,
- 	if (cur_cpu_spec->cpu_features & MMU_FTR_BIG_PHYS)
- 		TLBCAM[index].MAS7 = (u64)phys >> 32;
- 
--#ifndef CONFIG_KGDB /* want user access for breakpoints */
- 	if (flags & _PAGE_USER) {
- 	   TLBCAM[index].MAS3 |= MAS3_UX | MAS3_UR;
- 	   TLBCAM[index].MAS3 |= ((flags & _PAGE_RW) ? MAS3_UW : 0);
- 	}
--#else
--	TLBCAM[index].MAS3 |= MAS3_UX | MAS3_UR;
--	TLBCAM[index].MAS3 |= ((flags & _PAGE_RW) ? MAS3_UW : 0);
--#endif
- 
- 	tlbcam_addrs[index].start = virt;
- 	tlbcam_addrs[index].limit = virt + size - 1;
-diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
-index 6ea4698..b842378 100644
---- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
-+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
-@@ -122,44 +122,32 @@ static void pseries_mach_cpu_die(void)
- 		if (!get_lppaca()->shared_proc)
- 			get_lppaca()->donate_dedicated_cpu = 1;
- 
--		printk(KERN_INFO
--			"cpu %u (hwid %u) ceding for offline with hint %d\n",
--			cpu, hwcpu, cede_latency_hint);
- 		while (get_preferred_offline_state(cpu) == CPU_STATE_INACTIVE) {
- 			extended_cede_processor(cede_latency_hint);
--			printk(KERN_INFO "cpu %u (hwid %u) returned from cede.\n",
--				cpu, hwcpu);
--			printk(KERN_INFO
--			"Decrementer value = %x Timebase value = %llx\n",
--			get_dec(), get_tb());
- 		}
- 
--		printk(KERN_INFO "cpu %u (hwid %u) got prodded to go online\n",
--			cpu, hwcpu);
--
- 		if (!get_lppaca()->shared_proc)
- 			get_lppaca()->donate_dedicated_cpu = 0;
- 		get_lppaca()->idle = 0;
--	}
- 
--	if (get_preferred_offline_state(cpu) == CPU_STATE_ONLINE) {
--		unregister_slb_shadow(hwcpu, __pa(get_slb_shadow()));
-+		if (get_preferred_offline_state(cpu) == CPU_STATE_ONLINE) {
-+			unregister_slb_shadow(hwcpu, __pa(get_slb_shadow()));
- 
--		/*
--		 * NOTE: Calling start_secondary() here for now to
--		 * start new context.
--		 * However, need to do it cleanly by resetting the
--		 * stack pointer.
--		 */
--		start_secondary();
-+			/*
-+			 * Call to start_secondary_resume() will not return.
-+			 * Kernel stack will be reset and start_secondary()
-+			 * will be called to continue the online operation.
-+			 */
-+			start_secondary_resume();
-+		}
-+	}
- 
--	} else if (get_preferred_offline_state(cpu) == CPU_STATE_OFFLINE) {
-+	/* Requested state is CPU_STATE_OFFLINE at this point */
-+	WARN_ON(get_preferred_offline_state(cpu) != CPU_STATE_OFFLINE);
- 
--		set_cpu_current_state(cpu, CPU_STATE_OFFLINE);
--		unregister_slb_shadow(hard_smp_processor_id(),
--					__pa(get_slb_shadow()));
--		rtas_stop_self();
--	}
-+	set_cpu_current_state(cpu, CPU_STATE_OFFLINE);
-+	unregister_slb_shadow(hwcpu, __pa(get_slb_shadow()));
-+	rtas_stop_self();
- 
- 	/* Should never get here... */
- 	BUG();
-diff --git a/arch/powerpc/platforms/pseries/offline_states.h b/arch/powerpc/platforms/pseries/offline_states.h
-index 202d869..75a6f48 100644
---- a/arch/powerpc/platforms/pseries/offline_states.h
-+++ b/arch/powerpc/platforms/pseries/offline_states.h
-@@ -35,4 +35,5 @@ static inline void set_default_offline_state(int cpu)
- 
- extern enum cpu_state_vals get_preferred_offline_state(int cpu);
- extern int start_secondary(void);
-+extern void start_secondary_resume(void);
- #endif
-diff --git a/arch/sparc/include/asm/irqflags_64.h b/arch/sparc/include/asm/irqflags_64.h
-index 8b49bf9..bfa1ea4 100644
---- a/arch/sparc/include/asm/irqflags_64.h
-+++ b/arch/sparc/include/asm/irqflags_64.h
-@@ -76,9 +76,26 @@ static inline int raw_irqs_disabled(void)
-  */
- static inline unsigned long __raw_local_irq_save(void)
- {
--	unsigned long flags = __raw_local_save_flags();
--
--	raw_local_irq_disable();
-+	unsigned long flags, tmp;
-+
-+	/* Disable interrupts to PIL_NORMAL_MAX unless we already
-+	 * are using PIL_NMI, in which case PIL_NMI is retained.
-+	 *
-+	 * The only values we ever program into the %pil are 0,
-+	 * PIL_NORMAL_MAX and PIL_NMI.
-+	 *
-+	 * Since PIL_NMI is the largest %pil value and all bits are
-+	 * set in it (0xf), it doesn't matter what PIL_NORMAL_MAX
-+	 * actually is.
-+	 */
-+	__asm__ __volatile__(
-+		"rdpr	%%pil, %0\n\t"
-+		"or	%0, %2, %1\n\t"
-+		"wrpr	%1, 0x0, %%pil"
-+		: "=r" (flags), "=r" (tmp)
-+		: "i" (PIL_NORMAL_MAX)
-+		: "memory"
-+	);
- 
- 	return flags;
- }
-diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
-index 39be9f2..3df02de 100644
---- a/arch/sparc/include/asm/thread_info_64.h
-+++ b/arch/sparc/include/asm/thread_info_64.h
-@@ -121,7 +121,7 @@ struct thread_info {
- #define THREAD_SHIFT PAGE_SHIFT
- #endif /* PAGE_SHIFT == 13 */
- 
--#define PREEMPT_ACTIVE		0x4000000
-+#define PREEMPT_ACTIVE		0x10000000
- 
- /*
-  * macros/functions for gaining access to the thread information structure
-diff --git a/arch/sparc/kernel/pci_common.c b/arch/sparc/kernel/pci_common.c
-index b775658..8a00058 100644
---- a/arch/sparc/kernel/pci_common.c
-+++ b/arch/sparc/kernel/pci_common.c
-@@ -371,14 +371,19 @@ static void pci_register_iommu_region(struct pci_pbm_info *pbm)
- 		struct resource *rp = kzalloc(sizeof(*rp), GFP_KERNEL);
- 
- 		if (!rp) {
--			prom_printf("Cannot allocate IOMMU resource.\n");
--			prom_halt();
-+			pr_info("%s: Cannot allocate IOMMU resource.\n",
-+				pbm->name);
-+			return;
- 		}
- 		rp->name = "IOMMU";
- 		rp->start = pbm->mem_space.start + (unsigned long) vdma[0];
- 		rp->end = rp->start + (unsigned long) vdma[1] - 1UL;
- 		rp->flags = IORESOURCE_BUSY;
--		request_resource(&pbm->mem_space, rp);
-+		if (request_resource(&pbm->mem_space, rp)) {
-+			pr_info("%s: Unable to request IOMMU resource.\n",
-+				pbm->name);
-+			kfree(rp);
-+		}
- 	}
- }
- 
-diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
-index fd3cee4..c720f0c 100644
---- a/arch/sparc/kernel/rtrap_64.S
-+++ b/arch/sparc/kernel/rtrap_64.S
-@@ -172,7 +172,17 @@ rtrap_xcall:
- 		 nop
- 		call			trace_hardirqs_on
- 		 nop
--		wrpr			%l4, %pil
-+		/* Do not actually set the %pil here.  We will do that
-+		 * below after we clear PSTATE_IE in the %pstate register.
-+		 * If we re-enable interrupts here, we can recurse down
-+		 * the hardirq stack potentially endlessly, causing a
-+		 * stack overflow.
-+		 *
-+		 * It is tempting to put this test and trace_hardirqs_on
-+		 * call at the 'rt_continue' label, but that will not work
-+		 * as that path hits unconditionally and we do not want to
-+		 * execute this in NMI return paths, for example.
-+		 */
- #endif
- rtrap_no_irq_enable:
- 		andcc			%l1, TSTATE_PRIV, %l3
-diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
-index 10f7bb9..22cd475 100644
---- a/arch/sparc/kernel/traps_64.c
-+++ b/arch/sparc/kernel/traps_64.c
-@@ -2202,27 +2202,6 @@ void dump_stack(void)
- 
- EXPORT_SYMBOL(dump_stack);
- 
--static inline int is_kernel_stack(struct task_struct *task,
--				  struct reg_window *rw)
--{
--	unsigned long rw_addr = (unsigned long) rw;
--	unsigned long thread_base, thread_end;
--
--	if (rw_addr < PAGE_OFFSET) {
--		if (task != &init_task)
--			return 0;
--	}
--
--	thread_base = (unsigned long) task_stack_page(task);
--	thread_end = thread_base + sizeof(union thread_union);
--	if (rw_addr >= thread_base &&
--	    rw_addr < thread_end &&
--	    !(rw_addr & 0x7UL))
--		return 1;
--
--	return 0;
--}
--
- static inline struct reg_window *kernel_stack_up(struct reg_window *rw)
- {
- 	unsigned long fp = rw->ins[6];
-@@ -2251,6 +2230,7 @@ void die_if_kernel(char *str, struct pt_regs *regs)
- 	show_regs(regs);
- 	add_taint(TAINT_DIE);
- 	if (regs->tstate & TSTATE_PRIV) {
-+		struct thread_info *tp = current_thread_info();
- 		struct reg_window *rw = (struct reg_window *)
- 			(regs->u_regs[UREG_FP] + STACK_BIAS);
- 
-@@ -2258,8 +2238,8 @@ void die_if_kernel(char *str, struct pt_regs *regs)
- 		 * find some badly aligned kernel stack.
- 		 */
- 		while (rw &&
--		       count++ < 30&&
--		       is_kernel_stack(current, rw)) {
-+		       count++ < 30 &&
-+		       kstack_valid(tp, (unsigned long) rw)) {
- 			printk("Caller[%016lx]: %pS\n", rw->ins[7],
- 			       (void *) rw->ins[7]);
- 
-diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
-index 378ca82..95a8e9a 100644
---- a/arch/sparc/kernel/unaligned_64.c
-+++ b/arch/sparc/kernel/unaligned_64.c
-@@ -49,7 +49,7 @@ static inline enum direction decode_direction(unsigned int insn)
- }
- 
- /* 16 = double-word, 8 = extra-word, 4 = word, 2 = half-word */
--static inline int decode_access_size(unsigned int insn)
-+static inline int decode_access_size(struct pt_regs *regs, unsigned int insn)
- {
- 	unsigned int tmp;
- 
-@@ -65,7 +65,7 @@ static inline int decode_access_size(unsigned int insn)
- 		return 2;
- 	else {
- 		printk("Impossible unaligned trap. insn=%08x\n", insn);
--		die_if_kernel("Byte sized unaligned access?!?!", current_thread_info()->kregs);
-+		die_if_kernel("Byte sized unaligned access?!?!", regs);
- 
- 		/* GCC should never warn that control reaches the end
- 		 * of this function without returning a value because
-@@ -289,7 +289,7 @@ static void log_unaligned(struct pt_regs *regs)
- asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn)
- {
- 	enum direction dir = decode_direction(insn);
--	int size = decode_access_size(insn);
-+	int size = decode_access_size(regs, insn);
- 	int orig_asi, asi;
- 
- 	current_thread_info()->kern_una_regs = regs;
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index eb40925..ddb52b8 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -627,7 +627,7 @@ config GART_IOMMU
- 	bool "GART IOMMU support" if EMBEDDED
- 	default y
- 	select SWIOTLB
--	depends on X86_64 && PCI
-+	depends on X86_64 && PCI && K8_NB
- 	---help---
- 	  Support for full DMA access of devices with 32bit memory access only
- 	  on systems with more than 3GB. This is usually needed for USB,
-@@ -2026,7 +2026,7 @@ endif # X86_32
- 
- config K8_NB
- 	def_bool y
--	depends on AGP_AMD64 || (X86_64 && (GART_IOMMU || (PCI && NUMA)))
-+	depends on CPU_SUP_AMD && PCI
- 
- source "drivers/pcmcia/Kconfig"
- 
-diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
-index be37059..b35c160 100644
---- a/arch/x86/kernel/apic/io_apic.c
-+++ b/arch/x86/kernel/apic/io_apic.c
-@@ -2539,6 +2539,9 @@ void irq_force_complete_move(int irq)
- 	struct irq_desc *desc = irq_to_desc(irq);
- 	struct irq_cfg *cfg = desc->chip_data;
- 
-+	if (!cfg)
-+		return;
-+
- 	__irq_complete_move(&desc, cfg->vector);
- }
- #else
-diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
-index 6e44519..3b5ea38 100644
---- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
-+++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
-@@ -929,7 +929,8 @@ static int fill_powernow_table_pstate(struct powernow_k8_data *data,
- 		powernow_table[i].index = index;
- 
- 		/* Frequency may be rounded for these */
--		if (boot_cpu_data.x86 == 0x10 || boot_cpu_data.x86 == 0x11) {
-+		if ((boot_cpu_data.x86 == 0x10 && boot_cpu_data.x86_model < 10)
-+				 || boot_cpu_data.x86 == 0x11) {
- 			powernow_table[i].frequency =
- 				freq_from_fid_did(lo & 0x3f, (lo >> 6) & 7);
- 		} else
-diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
-index 7e1cca1..1366c7c 100644
---- a/arch/x86/kernel/cpu/intel.c
-+++ b/arch/x86/kernel/cpu/intel.c
-@@ -47,6 +47,27 @@ static void __cpuinit early_init_intel(struct cpuinfo_x86 *c)
- 		(c->x86 == 0x6 && c->x86_model >= 0x0e))
- 		set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
- 
-+	/*
-+	 * Atom erratum AAE44/AAF40/AAG38/AAH41:
-+	 *
-+	 * A race condition between speculative fetches and invalidating
-+	 * a large page.  This is worked around in microcode, but we
-+	 * need the microcode to have already been loaded... so if it is
-+	 * not, recommend a BIOS update and disable large pages.
-+	 */
-+	if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_mask <= 2) {
-+		u32 ucode, junk;
-+
-+		wrmsr(MSR_IA32_UCODE_REV, 0, 0);
-+		sync_core();
-+		rdmsr(MSR_IA32_UCODE_REV, junk, ucode);
-+
-+		if (ucode < 0x20e) {
-+			printk(KERN_WARNING "Atom PSE erratum detected, BIOS microcode update recommended\n");
-+			clear_cpu_cap(c, X86_FEATURE_PSE);
-+		}
-+	}
-+
- #ifdef CONFIG_X86_64
- 	set_cpu_cap(c, X86_FEATURE_SYSENTER32);
- #else
-diff --git a/arch/x86/kernel/k8.c b/arch/x86/kernel/k8.c
-index cbc4332..9b89546 100644
---- a/arch/x86/kernel/k8.c
-+++ b/arch/x86/kernel/k8.c
-@@ -121,3 +121,17 @@ void k8_flush_garts(void)
- }
- EXPORT_SYMBOL_GPL(k8_flush_garts);
- 
-+static __init int init_k8_nbs(void)
-+{
-+	int err = 0;
-+
-+	err = cache_k8_northbridges();
-+
-+	if (err < 0)
-+		printk(KERN_NOTICE "K8 NB: Cannot enumerate AMD northbridges.\n");
-+
-+	return err;
-+}
-+
-+/* This has to go after the PCI subsystem */
-+fs_initcall(init_k8_nbs);
-diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
-index 4f41b29..0ae24d9 100644
---- a/arch/x86/kernel/pci-gart_64.c
-+++ b/arch/x86/kernel/pci-gart_64.c
-@@ -738,7 +738,7 @@ int __init gart_iommu_init(void)
- 	unsigned long scratch;
- 	long i;
- 
--	if (cache_k8_northbridges() < 0 || num_k8_northbridges == 0)
-+	if (num_k8_northbridges == 0)
- 		return 0;
- 
- #ifndef CONFIG_AGP_AMD64
-diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
-index 126f0b4..11d0702 100644
---- a/arch/x86/kernel/process_64.c
-+++ b/arch/x86/kernel/process_64.c
-@@ -282,12 +282,12 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
- 
- 	set_tsk_thread_flag(p, TIF_FORK);
- 
--	p->thread.fs = me->thread.fs;
--	p->thread.gs = me->thread.gs;
- 	p->thread.io_bitmap_ptr = NULL;
- 
- 	savesegment(gs, p->thread.gsindex);
-+	p->thread.gs = p->thread.gsindex ? 0 : me->thread.gs;
- 	savesegment(fs, p->thread.fsindex);
-+	p->thread.fs = p->thread.fsindex ? 0 : me->thread.fs;
- 	savesegment(es, p->thread.es);
- 	savesegment(ds, p->thread.ds);
- 
-diff --git a/block/blk-timeout.c b/block/blk-timeout.c
-index 1ba7e0a..4f0c06c 100644
---- a/block/blk-timeout.c
-+++ b/block/blk-timeout.c
-@@ -109,6 +109,7 @@ void blk_rq_timed_out_timer(unsigned long data)
- 	struct request_queue *q = (struct request_queue *) data;
- 	unsigned long flags, next = 0;
- 	struct request *rq, *tmp;
-+	int next_set = 0;
- 
- 	spin_lock_irqsave(q->queue_lock, flags);
- 
-@@ -122,16 +123,13 @@ void blk_rq_timed_out_timer(unsigned long data)
- 			if (blk_mark_rq_complete(rq))
- 				continue;
- 			blk_rq_timed_out(rq);
--		} else if (!next || time_after(next, rq->deadline))
-+		} else if (!next_set || time_after(next, rq->deadline)) {
- 			next = rq->deadline;
-+			next_set = 1;
-+		}
- 	}
- 
--	/*
--	 * next can never be 0 here with the list non-empty, since we always
--	 * bump ->deadline to 1 so we can detect if the timer was ever added
--	 * or not. See comment in blk_add_timer()
--	 */
--	if (next)
-+	if (next_set)
- 		mod_timer(&q->timeout, round_jiffies_up(next));
- 
- 	spin_unlock_irqrestore(q->queue_lock, flags);
-diff --git a/crypto/async_tx/async_raid6_recov.c b/crypto/async_tx/async_raid6_recov.c
-index 943f2ab..ce038d8 100644
---- a/crypto/async_tx/async_raid6_recov.c
-+++ b/crypto/async_tx/async_raid6_recov.c
-@@ -324,6 +324,7 @@ struct dma_async_tx_descriptor *
- async_raid6_2data_recov(int disks, size_t bytes, int faila, int failb,
- 			struct page **blocks, struct async_submit_ctl *submit)
- {
-+	void *scribble = submit->scribble;
- 	int non_zero_srcs, i;
- 
- 	BUG_ON(faila == failb);
-@@ -332,11 +333,13 @@ async_raid6_2data_recov(int disks, size_t bytes, int faila, int failb,
- 
- 	pr_debug("%s: disks: %d len: %zu\n", __func__, disks, bytes);
- 
--	/* we need to preserve the contents of 'blocks' for the async
--	 * case, so punt to synchronous if a scribble buffer is not available
-+	/* if a dma resource is not available or a scribble buffer is not
-+	 * available punt to the synchronous path.  In the 'dma not
-+	 * available' case be sure to use the scribble buffer to
-+	 * preserve the content of 'blocks' as the caller intended.
- 	 */
--	if (!submit->scribble) {
--		void **ptrs = (void **) blocks;
-+	if (!async_dma_find_channel(DMA_PQ) || !scribble) {
-+		void **ptrs = scribble ? scribble : (void **) blocks;
- 
- 		async_tx_quiesce(&submit->depend_tx);
- 		for (i = 0; i < disks; i++)
-@@ -406,11 +409,13 @@ async_raid6_datap_recov(int disks, size_t bytes, int faila,
- 
- 	pr_debug("%s: disks: %d len: %zu\n", __func__, disks, bytes);
- 
--	/* we need to preserve the contents of 'blocks' for the async
--	 * case, so punt to synchronous if a scribble buffer is not available
-+	/* if a dma resource is not available or a scribble buffer is not
-+	 * available punt to the synchronous path.  In the 'dma not
-+	 * available' case be sure to use the scribble buffer to
-+	 * preserve the content of 'blocks' as the caller intended.
- 	 */
--	if (!scribble) {
--		void **ptrs = (void **) blocks;
-+	if (!async_dma_find_channel(DMA_PQ) || !scribble) {
-+		void **ptrs = scribble ? scribble : (void **) blocks;
- 
- 		async_tx_quiesce(&submit->depend_tx);
- 		for (i = 0; i < disks; i++)
-diff --git a/drivers/Makefile b/drivers/Makefile
-index 6ee53c7..8b0b948 100644
---- a/drivers/Makefile
-+++ b/drivers/Makefile
-@@ -17,6 +17,7 @@ obj-$(CONFIG_SFI)		+= sfi/
- obj-$(CONFIG_PNP)		+= pnp/
- obj-$(CONFIG_ARM_AMBA)		+= amba/
- 
-+obj-$(CONFIG_VIRTIO)		+= virtio/
- obj-$(CONFIG_XEN)		+= xen/
- 
- # regulators early, since some subsystems rely on them to initialize
-@@ -106,7 +107,6 @@ obj-$(CONFIG_HID)		+= hid/
- obj-$(CONFIG_PPC_PS3)		+= ps3/
- obj-$(CONFIG_OF)		+= of/
- obj-$(CONFIG_SSB)		+= ssb/
--obj-$(CONFIG_VIRTIO)		+= virtio/
- obj-$(CONFIG_VLYNQ)		+= vlynq/
- obj-$(CONFIG_STAGING)		+= staging/
- obj-y				+= platform/
-diff --git a/drivers/acpi/power_meter.c b/drivers/acpi/power_meter.c
-index dc4ffad..e02d93c 100644
---- a/drivers/acpi/power_meter.c
-+++ b/drivers/acpi/power_meter.c
-@@ -34,7 +34,7 @@
- #define ACPI_POWER_METER_NAME		"power_meter"
- ACPI_MODULE_NAME(ACPI_POWER_METER_NAME);
- #define ACPI_POWER_METER_DEVICE_NAME	"Power Meter"
--#define ACPI_POWER_METER_CLASS		"power_meter_resource"
-+#define ACPI_POWER_METER_CLASS		"pwr_meter_resource"
- 
- #define NUM_SENSORS			17
- 
-diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
-index 79d33d9..7c85265 100644
---- a/drivers/acpi/sleep.c
-+++ b/drivers/acpi/sleep.c
-@@ -450,6 +450,126 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
- 		},
- 	},
- 	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad T410",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad T510",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad W510",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad X201",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad X201",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad T410",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad T510",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad W510",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad X201",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad X201",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad T410",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad T510",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad W510",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad X201",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Lenovo ThinkPad X201",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
-+		},
-+	},
-+	{
- 	.callback = init_old_suspend_ordering,
- 	.ident = "Panasonic CF51-2L",
- 	.matches = {
-@@ -458,6 +578,30 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
- 		DMI_MATCH(DMI_BOARD_NAME, "CF51-2L"),
- 		},
- 	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Dell Studio 1558",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-+		DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1558"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Dell Studio 1557",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-+		DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1557"),
-+		},
-+	},
-+	{
-+	.callback = init_set_sci_en_on_resume,
-+	.ident = "Dell Studio 1555",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-+		DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1555"),
-+		},
-+	},
- 	{},
- };
- #endif /* CONFIG_SUSPEND */
-diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
-index 9f6cfac..228740f 100644
---- a/drivers/ata/libata-eh.c
-+++ b/drivers/ata/libata-eh.c
-@@ -879,6 +879,8 @@ static void ata_eh_set_pending(struct ata_port *ap, int fastdrain)
- void ata_qc_schedule_eh(struct ata_queued_cmd *qc)
- {
- 	struct ata_port *ap = qc->ap;
-+	struct request_queue *q = qc->scsicmd->device->request_queue;
-+	unsigned long flags;
- 
- 	WARN_ON(!ap->ops->error_handler);
- 
-@@ -890,7 +892,9 @@ void ata_qc_schedule_eh(struct ata_queued_cmd *qc)
- 	 * Note that ATA_QCFLAG_FAILED is unconditionally set after
- 	 * this function completes.
- 	 */
-+	spin_lock_irqsave(q->queue_lock, flags);
- 	blk_abort_request(qc->scsicmd->request);
-+	spin_unlock_irqrestore(q->queue_lock, flags);
- }
- 
- /**
-@@ -1624,6 +1628,7 @@ void ata_eh_analyze_ncq_error(struct ata_link *link)
- 	}
- 
- 	/* okay, this error is ours */
-+	memset(&tf, 0, sizeof(tf));
- 	rc = ata_eh_read_log_10h(dev, &tag, &tf);
- 	if (rc) {
- 		ata_link_printk(link, KERN_ERR, "failed to read log page 10h "
-diff --git a/drivers/base/memory.c b/drivers/base/memory.c
-index bd02505..d7d77d4 100644
---- a/drivers/base/memory.c
-+++ b/drivers/base/memory.c
-@@ -311,7 +311,7 @@ static SYSDEV_ATTR(removable, 0444, show_mem_removable, NULL);
- static ssize_t
- print_block_size(struct class *class, char *buf)
- {
--	return sprintf(buf, "%#lx\n", (unsigned long)PAGES_PER_SECTION * PAGE_SIZE);
-+	return sprintf(buf, "%lx\n", (unsigned long)PAGES_PER_SECTION * PAGE_SIZE);
- }
- 
- static CLASS_ATTR(block_size_bytes, 0444, print_block_size, NULL);
-diff --git a/drivers/char/agp/Kconfig b/drivers/char/agp/Kconfig
-index 2fb3a48..4b66c69 100644
---- a/drivers/char/agp/Kconfig
-+++ b/drivers/char/agp/Kconfig
-@@ -57,7 +57,7 @@ config AGP_AMD
- 
- config AGP_AMD64
- 	tristate "AMD Opteron/Athlon64 on-CPU GART support"
--	depends on AGP && X86
-+	depends on AGP && X86 && K8_NB
- 	help
- 	  This option gives you AGP support for the GLX component of
- 	  X using the on-CPU northbridge of the AMD Athlon64/Opteron CPUs.
-diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
-index 73655ae..f8e57c6 100644
---- a/drivers/cpuidle/governors/menu.c
-+++ b/drivers/cpuidle/governors/menu.c
-@@ -101,7 +101,6 @@ struct menu_device {
- 
- 	unsigned int	expected_us;
- 	u64		predicted_us;
--	unsigned int	measured_us;
- 	unsigned int	exit_us;
- 	unsigned int	bucket;
- 	u64		correction_factor[BUCKETS];
-@@ -187,14 +186,14 @@ static int menu_select(struct cpuidle_device *dev)
- 	int i;
- 	int multiplier;
- 
--	data->last_state_idx = 0;
--	data->exit_us = 0;
--
- 	if (data->needs_update) {
- 		menu_update(dev);
- 		data->needs_update = 0;
- 	}
- 
-+	data->last_state_idx = 0;
-+	data->exit_us = 0;
-+
- 	/* Special case when user has set very strict latency requirement */
- 	if (unlikely(latency_req == 0))
- 		return 0;
-@@ -294,7 +293,7 @@ static void menu_update(struct cpuidle_device *dev)
- 	new_factor = data->correction_factor[data->bucket]
- 			* (DECAY - 1) / DECAY;
- 
--	if (data->expected_us > 0 && data->measured_us < MAX_INTERESTING)
-+	if (data->expected_us > 0 && measured_us < MAX_INTERESTING)
- 		new_factor += RESOLUTION * measured_us / data->expected_us;
- 	else
- 		/*
-diff --git a/drivers/edac/edac_mce_amd.c b/drivers/edac/edac_mce_amd.c
-index f5b6d9f..97e64bc 100644
---- a/drivers/edac/edac_mce_amd.c
-+++ b/drivers/edac/edac_mce_amd.c
-@@ -294,7 +294,6 @@ wrong_ls_mce:
- void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
- {
- 	u32 ec  = ERROR_CODE(regs->nbsl);
--	u32 xec = EXT_ERROR_CODE(regs->nbsl);
- 
- 	if (!handle_errors)
- 		return;
-@@ -324,7 +323,7 @@ void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
- 		pr_cont("\n");
- 	}
- 
--	pr_emerg("%s.\n", EXT_ERR_MSG(xec));
-+	pr_emerg("%s.\n", EXT_ERR_MSG(regs->nbsl));
- 
- 	if (BUS_ERROR(ec) && nb_bus_decoder)
- 		nb_bus_decoder(node_id, regs);
-@@ -374,7 +373,7 @@ static int amd_decode_mce(struct notifier_block *nb, unsigned long val,
- 		 ((m->status & MCI_STATUS_PCC) ? "yes" : "no"));
- 
- 	/* do the two bits[14:13] together */
--	ecc = m->status & (3ULL << 45);
-+	ecc = (m->status >> 45) & 0x3;
- 	if (ecc)
- 		pr_cont(", %sECC Error", ((ecc == 2) ? "C" : "U"));
- 
-diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
-index a894ade..1372796 100644
---- a/drivers/gpu/drm/i915/i915_debugfs.c
-+++ b/drivers/gpu/drm/i915/i915_debugfs.c
-@@ -162,7 +162,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
- 	struct drm_device *dev = node->minor->dev;
- 	drm_i915_private_t *dev_priv = dev->dev_private;
- 
--	if (!IS_IRONLAKE(dev)) {
-+	if (!HAS_PCH_SPLIT(dev)) {
- 		seq_printf(m, "Interrupt enable:    %08x\n",
- 			   I915_READ(IER));
- 		seq_printf(m, "Interrupt identity:  %08x\n",
-diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
-index 2307f98..d642efd 100644
---- a/drivers/gpu/drm/i915/i915_dma.c
-+++ b/drivers/gpu/drm/i915/i915_dma.c
-@@ -978,15 +978,21 @@ static int i915_probe_agp(struct drm_device *dev, uint32_t *aperture_size,
- 	 * Some of the preallocated space is taken by the GTT
- 	 * and popup.  GTT is 1K per MB of aperture size, and popup is 4K.
- 	 */
--	if (IS_G4X(dev) || IS_PINEVIEW(dev) || IS_IRONLAKE(dev))
-+	if (IS_G4X(dev) || IS_PINEVIEW(dev) || IS_IRONLAKE(dev) || IS_GEN6(dev))
- 		overhead = 4096;
- 	else
- 		overhead = (*aperture_size / 1024) + 4096;
- 
- 	switch (tmp & INTEL_GMCH_GMS_MASK) {
- 	case INTEL_855_GMCH_GMS_DISABLED:
--		DRM_ERROR("video memory is disabled\n");
--		return -1;
-+		/* XXX: This is what my A1 silicon has. */
-+		if (IS_GEN6(dev)) {
-+			stolen = 64 * 1024 * 1024;
-+		} else {
-+			DRM_ERROR("video memory is disabled\n");
-+			return -1;
-+		}
-+		break;
- 	case INTEL_855_GMCH_GMS_STOLEN_1M:
- 		stolen = 1 * 1024 * 1024;
- 		break;
-@@ -1064,7 +1070,7 @@ static unsigned long i915_gtt_to_phys(struct drm_device *dev,
- 	int gtt_offset, gtt_size;
- 
- 	if (IS_I965G(dev)) {
--		if (IS_G4X(dev) || IS_IRONLAKE(dev)) {
-+		if (IS_G4X(dev) || IS_IRONLAKE(dev) || IS_GEN6(dev)) {
- 			gtt_offset = 2*1024*1024;
- 			gtt_size = 2*1024*1024;
- 		} else {
-@@ -1445,7 +1451,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
- 
- 	dev->driver->get_vblank_counter = i915_get_vblank_counter;
- 	dev->max_vblank_count = 0xffffff; /* only 24 bits of frame count */
--	if (IS_G4X(dev) || IS_IRONLAKE(dev)) {
-+	if (IS_G4X(dev) || IS_IRONLAKE(dev) || IS_GEN6(dev)) {
- 		dev->max_vblank_count = 0xffffffff; /* full 32 bit counter */
- 		dev->driver->get_vblank_counter = gm45_get_vblank_counter;
- 	}
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index b99b6a8..16ce3ba 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -1026,7 +1026,7 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
- #define IS_845G(dev)		((dev)->pci_device == 0x2562)
- #define IS_I85X(dev)		((dev)->pci_device == 0x3582)
- #define IS_I865G(dev)		((dev)->pci_device == 0x2572)
--#define IS_I8XX(dev)		(INTEL_INFO(dev)->is_i8xx)
-+#define IS_GEN2(dev)		(INTEL_INFO(dev)->is_i8xx)
- #define IS_I915G(dev)		(INTEL_INFO(dev)->is_i915g)
- #define IS_I915GM(dev)		((dev)->pci_device == 0x2592)
- #define IS_I945G(dev)		((dev)->pci_device == 0x2772)
-@@ -1045,8 +1045,29 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
- #define IS_I9XX(dev)		(INTEL_INFO(dev)->is_i9xx)
- #define IS_MOBILE(dev)		(INTEL_INFO(dev)->is_mobile)
- 
-+#define IS_GEN3(dev)	(IS_I915G(dev) ||			\
-+			 IS_I915GM(dev) ||			\
-+			 IS_I945G(dev) ||			\
-+			 IS_I945GM(dev) ||			\
-+			 IS_G33(dev) || \
-+			 IS_PINEVIEW(dev))
-+#define IS_GEN4(dev)	((dev)->pci_device == 0x2972 ||		\
-+			 (dev)->pci_device == 0x2982 ||		\
-+			 (dev)->pci_device == 0x2992 ||		\
-+			 (dev)->pci_device == 0x29A2 ||		\
-+			 (dev)->pci_device == 0x2A02 ||		\
-+			 (dev)->pci_device == 0x2A12 ||		\
-+			 (dev)->pci_device == 0x2E02 ||		\
-+			 (dev)->pci_device == 0x2E12 ||		\
-+			 (dev)->pci_device == 0x2E22 ||		\
-+			 (dev)->pci_device == 0x2E32 ||		\
-+			 (dev)->pci_device == 0x2A42 ||		\
-+			 (dev)->pci_device == 0x2E42)
-+
- #define I915_NEED_GFX_HWS(dev)	(INTEL_INFO(dev)->need_gfx_hws)
- 
-+#define IS_GEN6(dev)	((dev)->pci_device == 0x0102)
-+
- /* With the 945 and later, Y tiling got adjusted so that it was 32 128-byte
-  * rows, which changed the alignment requirements and fence programming.
-  */
-@@ -1067,6 +1088,9 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
- #define I915_HAS_FBC(dev) (INTEL_INFO(dev)->has_fbc)
- #define I915_HAS_RC6(dev) (INTEL_INFO(dev)->has_rc6)
- 
-+#define HAS_PCH_SPLIT(dev) (IS_IRONLAKE(dev) ||	\
-+			    IS_GEN6(dev))
-+
- #define PRIMARY_RINGBUFFER_SIZE         (128*1024)
- 
- #endif
-diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
-index fd099a1..6458400 100644
---- a/drivers/gpu/drm/i915/i915_gem.c
-+++ b/drivers/gpu/drm/i915/i915_gem.c
-@@ -1819,7 +1819,7 @@ i915_do_wait_request(struct drm_device *dev, uint32_t seqno, int interruptible)
- 		return -EIO;
- 
- 	if (!i915_seqno_passed(i915_get_gem_seqno(dev), seqno)) {
--		if (IS_IRONLAKE(dev))
-+		if (HAS_PCH_SPLIT(dev))
- 			ier = I915_READ(DEIER) | I915_READ(GTIER);
- 		else
- 			ier = I915_READ(IER);
-@@ -2316,6 +2316,12 @@ static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
- 	pitch_val = obj_priv->stride / tile_width;
- 	pitch_val = ffs(pitch_val) - 1;
- 
-+	if (obj_priv->tiling_mode == I915_TILING_Y &&
-+	    HAS_128_BYTE_Y_TILING(dev))
-+		WARN_ON(pitch_val > I830_FENCE_MAX_PITCH_VAL);
-+	else
-+		WARN_ON(pitch_val > I915_FENCE_MAX_PITCH_VAL);
-+
- 	val = obj_priv->gtt_offset;
- 	if (obj_priv->tiling_mode == I915_TILING_Y)
- 		val |= 1 << I830_FENCE_TILING_Y_SHIFT;
-diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
-index df278b2..040e80c 100644
---- a/drivers/gpu/drm/i915/i915_gem_tiling.c
-+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
-@@ -209,7 +209,7 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
- 	uint32_t swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
- 	bool need_disable;
- 
--	if (IS_IRONLAKE(dev)) {
-+	if (IS_IRONLAKE(dev) || IS_GEN6(dev)) {
- 		/* On Ironlake whatever DRAM config, GPU always do
- 		 * same swizzling setup.
- 		 */
-@@ -357,21 +357,17 @@ i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
- 		 * reg, so dont bother to check the size */
- 		if (stride / 128 > I965_FENCE_MAX_PITCH_VAL)
- 			return false;
--	} else if (IS_I9XX(dev)) {
--		uint32_t pitch_val = ffs(stride / tile_width) - 1;
--
--		/* XXX: For Y tiling, FENCE_MAX_PITCH_VAL is actually 6 (8KB)
--		 * instead of 4 (2KB) on 945s.
--		 */
--		if (pitch_val > I915_FENCE_MAX_PITCH_VAL ||
--		    size > (I830_FENCE_MAX_SIZE_VAL << 20))
-+	} else if (IS_GEN3(dev) || IS_GEN2(dev)) {
-+		if (stride > 8192)
- 			return false;
--	} else {
--		uint32_t pitch_val = ffs(stride / tile_width) - 1;
- 
--		if (pitch_val > I830_FENCE_MAX_PITCH_VAL ||
--		    size > (I830_FENCE_MAX_SIZE_VAL << 19))
--			return false;
-+		if (IS_GEN3(dev)) {
-+			if (size > I830_FENCE_MAX_SIZE_VAL << 20)
-+				return false;
-+		} else {
-+			if (size > I830_FENCE_MAX_SIZE_VAL << 19)
-+				return false;
-+		}
- 	}
- 
- 	/* 965+ just needs multiples of tile width */
-diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index a17d6bd..032f667 100644
---- a/drivers/gpu/drm/i915/i915_irq.c
-+++ b/drivers/gpu/drm/i915/i915_irq.c
-@@ -576,7 +576,7 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
- 
- 	atomic_inc(&dev_priv->irq_received);
- 
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		return ironlake_irq_handler(dev);
- 
- 	iir = I915_READ(IIR);
-@@ -737,7 +737,7 @@ void i915_user_irq_get(struct drm_device *dev)
- 
- 	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
- 	if (dev->irq_enabled && (++dev_priv->user_irq_refcount == 1)) {
--		if (IS_IRONLAKE(dev))
-+		if (HAS_PCH_SPLIT(dev))
- 			ironlake_enable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
- 		else
- 			i915_enable_irq(dev_priv, I915_USER_INTERRUPT);
-@@ -753,7 +753,7 @@ void i915_user_irq_put(struct drm_device *dev)
- 	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
- 	BUG_ON(dev->irq_enabled && dev_priv->user_irq_refcount <= 0);
- 	if (dev->irq_enabled && (--dev_priv->user_irq_refcount == 0)) {
--		if (IS_IRONLAKE(dev))
-+		if (HAS_PCH_SPLIT(dev))
- 			ironlake_disable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
- 		else
- 			i915_disable_irq(dev_priv, I915_USER_INTERRUPT);
-@@ -861,7 +861,7 @@ int i915_enable_vblank(struct drm_device *dev, int pipe)
- 		return -EINVAL;
- 
- 	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		ironlake_enable_display_irq(dev_priv, (pipe == 0) ? 
- 					    DE_PIPEA_VBLANK: DE_PIPEB_VBLANK);
- 	else if (IS_I965G(dev))
-@@ -883,7 +883,7 @@ void i915_disable_vblank(struct drm_device *dev, int pipe)
- 	unsigned long irqflags;
- 
- 	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		ironlake_disable_display_irq(dev_priv, (pipe == 0) ? 
- 					     DE_PIPEA_VBLANK: DE_PIPEB_VBLANK);
- 	else
-@@ -897,7 +897,7 @@ void i915_enable_interrupt (struct drm_device *dev)
- {
- 	struct drm_i915_private *dev_priv = dev->dev_private;
- 
--	if (!IS_IRONLAKE(dev))
-+	if (!HAS_PCH_SPLIT(dev))
- 		opregion_enable_asle(dev);
- 	dev_priv->irq_enabled = 1;
- }
-@@ -1076,7 +1076,7 @@ void i915_driver_irq_preinstall(struct drm_device * dev)
- 	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
- 	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
- 
--	if (IS_IRONLAKE(dev)) {
-+	if (HAS_PCH_SPLIT(dev)) {
- 		ironlake_irq_preinstall(dev);
- 		return;
- 	}
-@@ -1108,7 +1108,7 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
- 
- 	dev_priv->vblank_pipe = DRM_I915_VBLANK_PIPE_A | DRM_I915_VBLANK_PIPE_B;
- 
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		return ironlake_irq_postinstall(dev);
- 
- 	/* Unmask the interrupts that we always want on. */
-@@ -1196,7 +1196,7 @@ void i915_driver_irq_uninstall(struct drm_device * dev)
- 
- 	dev_priv->vblank_pipe = 0;
- 
--	if (IS_IRONLAKE(dev)) {
-+	if (HAS_PCH_SPLIT(dev)) {
- 		ironlake_irq_uninstall(dev);
- 		return;
- 	}
-diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
-index ab1bd2d..fd95bdf 100644
---- a/drivers/gpu/drm/i915/i915_reg.h
-+++ b/drivers/gpu/drm/i915/i915_reg.h
-@@ -221,7 +221,7 @@
- #define   I830_FENCE_SIZE_BITS(size)	((ffs((size) >> 19) - 1) << 8)
- #define   I830_FENCE_PITCH_SHIFT	4
- #define   I830_FENCE_REG_VALID		(1<<0)
--#define   I915_FENCE_MAX_PITCH_VAL	0x10
-+#define   I915_FENCE_MAX_PITCH_VAL	4
- #define   I830_FENCE_MAX_PITCH_VAL	6
- #define   I830_FENCE_MAX_SIZE_VAL	(1<<8)
- 
-diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
-index 15fbc1b..70c9d4b 100644
---- a/drivers/gpu/drm/i915/intel_bios.c
-+++ b/drivers/gpu/drm/i915/intel_bios.c
-@@ -247,6 +247,7 @@ static void
- parse_general_features(struct drm_i915_private *dev_priv,
- 		       struct bdb_header *bdb)
- {
-+	struct drm_device *dev = dev_priv->dev;
- 	struct bdb_general_features *general;
- 
- 	/* Set sensible defaults in case we can't find the general block */
-@@ -263,7 +264,7 @@ parse_general_features(struct drm_i915_private *dev_priv,
- 			if (IS_I85X(dev_priv->dev))
- 				dev_priv->lvds_ssc_freq =
- 					general->ssc_freq ? 66 : 48;
--			else if (IS_IRONLAKE(dev_priv->dev))
-+			else if (IS_IRONLAKE(dev_priv->dev) || IS_GEN6(dev))
- 				dev_priv->lvds_ssc_freq =
- 					general->ssc_freq ? 100 : 120;
- 			else
-diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
-index 79dd402..fccf074 100644
---- a/drivers/gpu/drm/i915/intel_crt.c
-+++ b/drivers/gpu/drm/i915/intel_crt.c
-@@ -39,7 +39,7 @@ static void intel_crt_dpms(struct drm_encoder *encoder, int mode)
- 	struct drm_i915_private *dev_priv = dev->dev_private;
- 	u32 temp, reg;
- 
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		reg = PCH_ADPA;
- 	else
- 		reg = ADPA;
-@@ -113,7 +113,7 @@ static void intel_crt_mode_set(struct drm_encoder *encoder,
- 	else
- 		dpll_md_reg = DPLL_B_MD;
- 
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		adpa_reg = PCH_ADPA;
- 	else
- 		adpa_reg = ADPA;
-@@ -122,7 +122,7 @@ static void intel_crt_mode_set(struct drm_encoder *encoder,
- 	 * Disable separate mode multiplier used when cloning SDVO to CRT
- 	 * XXX this needs to be adjusted when we really are cloning
- 	 */
--	if (IS_I965G(dev) && !IS_IRONLAKE(dev)) {
-+	if (IS_I965G(dev) && !HAS_PCH_SPLIT(dev)) {
- 		dpll_md = I915_READ(dpll_md_reg);
- 		I915_WRITE(dpll_md_reg,
- 			   dpll_md & ~DPLL_MD_UDI_MULTIPLIER_MASK);
-@@ -136,11 +136,11 @@ static void intel_crt_mode_set(struct drm_encoder *encoder,
- 
- 	if (intel_crtc->pipe == 0) {
- 		adpa |= ADPA_PIPE_A_SELECT;
--		if (!IS_IRONLAKE(dev))
-+		if (!HAS_PCH_SPLIT(dev))
- 			I915_WRITE(BCLRPAT_A, 0);
- 	} else {
- 		adpa |= ADPA_PIPE_B_SELECT;
--		if (!IS_IRONLAKE(dev))
-+		if (!HAS_PCH_SPLIT(dev))
- 			I915_WRITE(BCLRPAT_B, 0);
- 	}
- 
-@@ -202,7 +202,7 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
- 	u32 hotplug_en;
- 	int i, tries = 0;
- 
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		return intel_ironlake_crt_detect_hotplug(connector);
- 
- 	/*
-@@ -524,7 +524,7 @@ void intel_crt_init(struct drm_device *dev)
- 					  &intel_output->enc);
- 
- 	/* Set up the DDC bus. */
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		i2c_reg = PCH_GPIOA;
- 	else {
- 		i2c_reg = GPIOA;
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index b27202d..4b2458d 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -232,7 +232,7 @@ struct intel_limit {
- #define G4X_P2_DISPLAY_PORT_FAST           10
- #define G4X_P2_DISPLAY_PORT_LIMIT          0
- 
--/* Ironlake */
-+/* Ironlake / Sandybridge */
- /* as we calculate clock using (register_value + 2) for
-    N/M1/M2, so here the range value for them is (actual_value-2).
-  */
-@@ -690,7 +690,7 @@ static const intel_limit_t *intel_limit(struct drm_crtc *crtc)
- 	struct drm_device *dev = crtc->dev;
- 	const intel_limit_t *limit;
- 
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		limit = intel_ironlake_limit(crtc);
- 	else if (IS_G4X(dev)) {
- 		limit = intel_g4x_limit(crtc);
-@@ -1366,7 +1366,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
- 			dspcntr &= ~DISPPLANE_TILED;
- 	}
- 
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		/* must disable */
- 		dspcntr |= DISPPLANE_TRICKLE_FEED_DISABLE;
- 
-@@ -1427,7 +1427,7 @@ static void i915_disable_vga (struct drm_device *dev)
- 	u8 sr1;
- 	u32 vga_reg;
- 
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		vga_reg = CPU_VGACNTRL;
- 	else
- 		vga_reg = VGACNTRL;
-@@ -2111,7 +2111,7 @@ static bool intel_crtc_mode_fixup(struct drm_crtc *crtc,
- 				  struct drm_display_mode *adjusted_mode)
- {
- 	struct drm_device *dev = crtc->dev;
--	if (IS_IRONLAKE(dev)) {
-+	if (HAS_PCH_SPLIT(dev)) {
- 		/* FDI link clock is fixed at 2.7G */
- 		if (mode->clock * 3 > 27000 * 4)
- 			return MODE_CLOCK_HIGH;
-@@ -2967,7 +2967,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
- 					refclk / 1000);
- 	} else if (IS_I9XX(dev)) {
- 		refclk = 96000;
--		if (IS_IRONLAKE(dev))
-+		if (HAS_PCH_SPLIT(dev))
- 			refclk = 120000; /* 120Mhz refclk */
- 	} else {
- 		refclk = 48000;
-@@ -3025,7 +3025,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
- 	}
- 
- 	/* FDI link */
--	if (IS_IRONLAKE(dev)) {
-+	if (HAS_PCH_SPLIT(dev)) {
- 		int lane, link_bw, bpp;
- 		/* eDP doesn't require FDI link, so just set DP M/N
- 		   according to current link config */
-@@ -3102,7 +3102,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
- 	 * PCH B stepping, previous chipset stepping should be
- 	 * ignoring this setting.
- 	 */
--	if (IS_IRONLAKE(dev)) {
-+	if (HAS_PCH_SPLIT(dev)) {
- 		temp = I915_READ(PCH_DREF_CONTROL);
- 		/* Always enable nonspread source */
- 		temp &= ~DREF_NONSPREAD_SOURCE_MASK;
-@@ -3149,7 +3149,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
- 				reduced_clock.m2;
- 	}
- 
--	if (!IS_IRONLAKE(dev))
-+	if (!HAS_PCH_SPLIT(dev))
- 		dpll = DPLL_VGA_MODE_DIS;
- 
- 	if (IS_I9XX(dev)) {
-@@ -3162,7 +3162,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
- 			sdvo_pixel_multiply = adjusted_mode->clock / mode->clock;
- 			if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
- 				dpll |= (sdvo_pixel_multiply - 1) << SDVO_MULTIPLIER_SHIFT_HIRES;
--			else if (IS_IRONLAKE(dev))
-+			else if (HAS_PCH_SPLIT(dev))
- 				dpll |= (sdvo_pixel_multiply - 1) << PLL_REF_SDVO_HDMI_MULTIPLIER_SHIFT;
- 		}
- 		if (is_dp)
-@@ -3174,7 +3174,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
- 		else {
- 			dpll |= (1 << (clock.p1 - 1)) << DPLL_FPA01_P1_POST_DIV_SHIFT;
- 			/* also FPA1 */
--			if (IS_IRONLAKE(dev))
-+			if (HAS_PCH_SPLIT(dev))
- 				dpll |= (1 << (clock.p1 - 1)) << DPLL_FPA1_P1_POST_DIV_SHIFT;
- 			if (IS_G4X(dev) && has_reduced_clock)
- 				dpll |= (1 << (reduced_clock.p1 - 1)) << DPLL_FPA1_P1_POST_DIV_SHIFT;
-@@ -3193,7 +3193,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
- 			dpll |= DPLLB_LVDS_P2_CLOCK_DIV_14;
- 			break;
- 		}
--		if (IS_I965G(dev) && !IS_IRONLAKE(dev))
-+		if (IS_I965G(dev) && !HAS_PCH_SPLIT(dev))
- 			dpll |= (6 << PLL_LOAD_PULSE_PHASE_SHIFT);
- 	} else {
- 		if (is_lvds) {
-@@ -3227,7 +3227,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
- 
- 	/* Ironlake's plane is forced to pipe, bit 24 is to
- 	   enable color space conversion */
--	if (!IS_IRONLAKE(dev)) {
-+	if (!HAS_PCH_SPLIT(dev)) {
- 		if (pipe == 0)
- 			dspcntr &= ~DISPPLANE_SEL_PIPE_MASK;
- 		else
-@@ -3254,14 +3254,14 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
- 
- 
- 	/* Disable the panel fitter if it was on our pipe */
--	if (!IS_IRONLAKE(dev) && intel_panel_fitter_pipe(dev) == pipe)
-+	if (!HAS_PCH_SPLIT(dev) && intel_panel_fitter_pipe(dev) == pipe)
- 		I915_WRITE(PFIT_CONTROL, 0);
- 
- 	DRM_DEBUG_KMS("Mode for pipe %c:\n", pipe == 0 ? 'A' : 'B');
- 	drm_mode_debug_printmodeline(mode);
- 
- 	/* assign to Ironlake registers */
--	if (IS_IRONLAKE(dev)) {
-+	if (HAS_PCH_SPLIT(dev)) {
- 		fp_reg = pch_fp_reg;
- 		dpll_reg = pch_dpll_reg;
- 	}
-@@ -3282,7 +3282,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
- 	if (is_lvds) {
- 		u32 lvds;
- 
--		if (IS_IRONLAKE(dev))
-+		if (HAS_PCH_SPLIT(dev))
- 			lvds_reg = PCH_LVDS;
- 
- 		lvds = I915_READ(lvds_reg);
-@@ -3328,7 +3328,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
- 		/* Wait for the clocks to stabilize. */
- 		udelay(150);
- 
--		if (IS_I965G(dev) && !IS_IRONLAKE(dev)) {
-+		if (IS_I965G(dev) && !HAS_PCH_SPLIT(dev)) {
- 			if (is_sdvo) {
- 				sdvo_pixel_multiply = adjusted_mode->clock / mode->clock;
- 				I915_WRITE(dpll_md_reg, (0 << DPLL_MD_UDI_DIVIDER_SHIFT) |
-@@ -3375,14 +3375,14 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
- 	/* pipesrc and dspsize control the size that is scaled from, which should
- 	 * always be the user's requested size.
- 	 */
--	if (!IS_IRONLAKE(dev)) {
-+	if (!HAS_PCH_SPLIT(dev)) {
- 		I915_WRITE(dspsize_reg, ((mode->vdisplay - 1) << 16) |
- 				(mode->hdisplay - 1));
- 		I915_WRITE(dsppos_reg, 0);
- 	}
- 	I915_WRITE(pipesrc_reg, ((mode->hdisplay - 1) << 16) | (mode->vdisplay - 1));
- 
--	if (IS_IRONLAKE(dev)) {
-+	if (HAS_PCH_SPLIT(dev)) {
- 		I915_WRITE(data_m1_reg, TU_SIZE(m_n.tu) | m_n.gmch_m);
- 		I915_WRITE(data_n1_reg, TU_SIZE(m_n.tu) | m_n.gmch_n);
- 		I915_WRITE(link_m1_reg, m_n.link_m);
-@@ -3403,7 +3403,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
- 
- 	intel_wait_for_vblank(dev);
- 
--	if (IS_IRONLAKE(dev)) {
-+	if (HAS_PCH_SPLIT(dev)) {
- 		/* enable address swizzle for tiling buffer */
- 		temp = I915_READ(DISP_ARB_CTL);
- 		I915_WRITE(DISP_ARB_CTL, temp | DISP_TILE_SURFACE_SWIZZLING);
-@@ -3438,7 +3438,7 @@ void intel_crtc_load_lut(struct drm_crtc *crtc)
- 		return;
- 
- 	/* use legacy palette for Ironlake */
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		palreg = (intel_crtc->pipe == 0) ? LGC_PALETTE_A :
- 						   LGC_PALETTE_B;
- 
-@@ -3922,7 +3922,7 @@ static void intel_increase_pllclock(struct drm_crtc *crtc, bool schedule)
- 	int dpll_reg = (pipe == 0) ? DPLL_A : DPLL_B;
- 	int dpll = I915_READ(dpll_reg);
- 
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		return;
- 
- 	if (!dev_priv->lvds_downclock_avail)
-@@ -3961,7 +3961,7 @@ static void intel_decrease_pllclock(struct drm_crtc *crtc)
- 	int dpll_reg = (pipe == 0) ? DPLL_A : DPLL_B;
- 	int dpll = I915_READ(dpll_reg);
- 
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		return;
- 
- 	if (!dev_priv->lvds_downclock_avail)
-@@ -4382,7 +4382,7 @@ static void intel_setup_outputs(struct drm_device *dev)
- 	if (IS_MOBILE(dev) && !IS_I830(dev))
- 		intel_lvds_init(dev);
- 
--	if (IS_IRONLAKE(dev)) {
-+	if (HAS_PCH_SPLIT(dev)) {
- 		int found;
- 
- 		if (IS_MOBILE(dev) && (I915_READ(DP_A) & DP_DETECTED))
-@@ -4451,7 +4451,7 @@ static void intel_setup_outputs(struct drm_device *dev)
- 			DRM_DEBUG_KMS("probing DP_D\n");
- 			intel_dp_init(dev, DP_D);
- 		}
--	} else if (IS_I8XX(dev))
-+	} else if (IS_GEN2(dev))
- 		intel_dvo_init(dev);
- 
- 	if (SUPPORTS_TV(dev))
-@@ -4599,7 +4599,7 @@ void intel_init_clock_gating(struct drm_device *dev)
- 	 * Disable clock gating reported to work incorrectly according to the
- 	 * specs, but enable as much else as we can.
- 	 */
--	if (IS_IRONLAKE(dev)) {
-+	if (HAS_PCH_SPLIT(dev)) {
- 		return;
- 	} else if (IS_G4X(dev)) {
- 		uint32_t dspclk_gate;
-@@ -4672,7 +4672,7 @@ static void intel_init_display(struct drm_device *dev)
- 	struct drm_i915_private *dev_priv = dev->dev_private;
- 
- 	/* We always want a DPMS function */
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		dev_priv->display.dpms = ironlake_crtc_dpms;
- 	else
- 		dev_priv->display.dpms = i9xx_crtc_dpms;
-@@ -4715,7 +4715,7 @@ static void intel_init_display(struct drm_device *dev)
- 			i830_get_display_clock_speed;
- 
- 	/* For FIFO watermark updates */
--	if (IS_IRONLAKE(dev))
-+	if (HAS_PCH_SPLIT(dev))
- 		dev_priv->display.update_wm = NULL;
- 	else if (IS_G4X(dev))
- 		dev_priv->display.update_wm = g4x_update_wm;
-diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
-index 1238bc9..66df0c3 100644
---- a/drivers/gpu/drm/i915/intel_lvds.c
-+++ b/drivers/gpu/drm/i915/intel_lvds.c
-@@ -661,7 +661,7 @@ static enum drm_connector_status intel_lvds_detect(struct drm_connector *connect
- 	/* ACPI lid methods were generally unreliable in this generation, so
- 	 * don't even bother.
- 	 */
--	if (IS_I8XX(dev))
-+	if (IS_GEN2(dev))
- 		return connector_status_connected;
- 
- 	if (!dmi_check_system(bad_lid_status) && !acpi_lid_open())
-diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
-index 63f569b..6b89042 100644
---- a/drivers/gpu/drm/i915/intel_overlay.c
-+++ b/drivers/gpu/drm/i915/intel_overlay.c
-@@ -172,7 +172,7 @@ struct overlay_registers {
- #define OFC_UPDATE		0x1
- 
- #define OVERLAY_NONPHYSICAL(dev) (IS_G33(dev) || IS_I965G(dev))
--#define OVERLAY_EXISTS(dev) (!IS_G4X(dev) && !IS_IRONLAKE(dev))
-+#define OVERLAY_EXISTS(dev) (!IS_G4X(dev) && !IS_IRONLAKE(dev) && !IS_GEN6(dev))
- 
- 
- static struct overlay_registers *intel_overlay_map_regs_atomic(struct intel_overlay *overlay)
-diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
-index 10be7b5..855911e 100644
---- a/drivers/i2c/i2c-core.c
-+++ b/drivers/i2c/i2c-core.c
-@@ -1210,12 +1210,23 @@ static int i2c_detect_address(struct i2c_client *temp_client,
- 		return 0;
- 
- 	/* Make sure there is something at this address */
--	if (i2c_smbus_xfer(adapter, addr, 0, 0, 0, I2C_SMBUS_QUICK, NULL) < 0)
--		return 0;
-+	if (addr == 0x73 && (adapter->class & I2C_CLASS_HWMON)) {
-+		/* Special probe for FSC hwmon chips */
-+		union i2c_smbus_data dummy;
- 
--	/* Prevent 24RF08 corruption */
--	if ((addr & ~0x0f) == 0x50)
--		i2c_smbus_xfer(adapter, addr, 0, 0, 0, I2C_SMBUS_QUICK, NULL);
-+		if (i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_READ, 0,
-+				   I2C_SMBUS_BYTE_DATA, &dummy) < 0)
-+			return 0;
-+	} else {
-+		if (i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_WRITE, 0,
-+				   I2C_SMBUS_QUICK, NULL) < 0)
-+			return 0;
-+
-+		/* Prevent 24RF08 corruption */
-+		if ((addr & ~0x0f) == 0x50)
-+			i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_WRITE, 0,
-+				       I2C_SMBUS_QUICK, NULL);
-+	}
- 
- 	/* Finally call the custom detection function */
- 	memset(&info, 0, sizeof(struct i2c_board_info));
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index a20a71e..2ecd1d5 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -2108,12 +2108,18 @@ repeat:
- 		if (!mddev->in_sync || mddev->recovery_cp != MaxSector) { /* not clean */
- 			/* .. if the array isn't clean, an 'even' event must also go
- 			 * to spares. */
--			if ((mddev->events&1)==0)
-+			if ((mddev->events&1)==0) {
- 				nospares = 0;
-+				sync_req = 2; /* force a second update to get the
-+					       * even/odd in sync */
-+			}
- 		} else {
- 			/* otherwise an 'odd' event must go to spares */
--			if ((mddev->events&1))
-+			if ((mddev->events&1)) {
- 				nospares = 0;
-+				sync_req = 2; /* force a second update to get the
-+					       * even/odd in sync */
-+			}
- 		}
- 	}
- 
-diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index ceb24af..0468f5b 100644
---- a/drivers/md/raid5.c
-+++ b/drivers/md/raid5.c
-@@ -1526,7 +1526,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
- 
- 		clear_bit(R5_UPTODATE, &sh->dev[i].flags);
- 		atomic_inc(&rdev->read_errors);
--		if (conf->mddev->degraded)
-+		if (conf->mddev->degraded >= conf->max_degraded)
- 			printk_rl(KERN_WARNING
- 				  "raid5:%s: read error not correctable "
- 				  "(sector %llu on %s).\n",
-@@ -1649,8 +1649,8 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
- 				     int previous, int *dd_idx,
- 				     struct stripe_head *sh)
- {
--	long stripe;
--	unsigned long chunk_number;
-+	sector_t stripe, stripe2;
-+	sector_t chunk_number;
- 	unsigned int chunk_offset;
- 	int pd_idx, qd_idx;
- 	int ddf_layout = 0;
-@@ -1670,18 +1670,13 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
- 	 */
- 	chunk_offset = sector_div(r_sector, sectors_per_chunk);
- 	chunk_number = r_sector;
--	BUG_ON(r_sector != chunk_number);
- 
- 	/*
- 	 * Compute the stripe number
- 	 */
--	stripe = chunk_number / data_disks;
--
--	/*
--	 * Compute the data disk and parity disk indexes inside the stripe
--	 */
--	*dd_idx = chunk_number % data_disks;
--
-+	stripe = chunk_number;
-+	*dd_idx = sector_div(stripe, data_disks);
-+	stripe2 = stripe;
- 	/*
- 	 * Select the parity disk based on the user selected algorithm.
- 	 */
-@@ -1693,21 +1688,21 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
- 	case 5:
- 		switch (algorithm) {
- 		case ALGORITHM_LEFT_ASYMMETRIC:
--			pd_idx = data_disks - stripe % raid_disks;
-+			pd_idx = data_disks - sector_div(stripe2, raid_disks);
- 			if (*dd_idx >= pd_idx)
- 				(*dd_idx)++;
- 			break;
- 		case ALGORITHM_RIGHT_ASYMMETRIC:
--			pd_idx = stripe % raid_disks;
-+			pd_idx = sector_div(stripe2, raid_disks);
- 			if (*dd_idx >= pd_idx)
- 				(*dd_idx)++;
- 			break;
- 		case ALGORITHM_LEFT_SYMMETRIC:
--			pd_idx = data_disks - stripe % raid_disks;
-+			pd_idx = data_disks - sector_div(stripe2, raid_disks);
- 			*dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
- 			break;
- 		case ALGORITHM_RIGHT_SYMMETRIC:
--			pd_idx = stripe % raid_disks;
-+			pd_idx = sector_div(stripe2, raid_disks);
- 			*dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
- 			break;
- 		case ALGORITHM_PARITY_0:
-@@ -1727,7 +1722,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
- 
- 		switch (algorithm) {
- 		case ALGORITHM_LEFT_ASYMMETRIC:
--			pd_idx = raid_disks - 1 - (stripe % raid_disks);
-+			pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
- 			qd_idx = pd_idx + 1;
- 			if (pd_idx == raid_disks-1) {
- 				(*dd_idx)++;	/* Q D D D P */
-@@ -1736,7 +1731,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
- 				(*dd_idx) += 2; /* D D P Q D */
- 			break;
- 		case ALGORITHM_RIGHT_ASYMMETRIC:
--			pd_idx = stripe % raid_disks;
-+			pd_idx = sector_div(stripe2, raid_disks);
- 			qd_idx = pd_idx + 1;
- 			if (pd_idx == raid_disks-1) {
- 				(*dd_idx)++;	/* Q D D D P */
-@@ -1745,12 +1740,12 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
- 				(*dd_idx) += 2; /* D D P Q D */
- 			break;
- 		case ALGORITHM_LEFT_SYMMETRIC:
--			pd_idx = raid_disks - 1 - (stripe % raid_disks);
-+			pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
- 			qd_idx = (pd_idx + 1) % raid_disks;
- 			*dd_idx = (pd_idx + 2 + *dd_idx) % raid_disks;
- 			break;
- 		case ALGORITHM_RIGHT_SYMMETRIC:
--			pd_idx = stripe % raid_disks;
-+			pd_idx = sector_div(stripe2, raid_disks);
- 			qd_idx = (pd_idx + 1) % raid_disks;
- 			*dd_idx = (pd_idx + 2 + *dd_idx) % raid_disks;
- 			break;
-@@ -1769,7 +1764,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
- 			/* Exactly the same as RIGHT_ASYMMETRIC, but or
- 			 * of blocks for computing Q is different.
- 			 */
--			pd_idx = stripe % raid_disks;
-+			pd_idx = sector_div(stripe2, raid_disks);
- 			qd_idx = pd_idx + 1;
- 			if (pd_idx == raid_disks-1) {
- 				(*dd_idx)++;	/* Q D D D P */
-@@ -1784,7 +1779,8 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
- 			 * D D D P Q  rather than
- 			 * Q D D D P
- 			 */
--			pd_idx = raid_disks - 1 - ((stripe + 1) % raid_disks);
-+			stripe2 += 1;
-+			pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
- 			qd_idx = pd_idx + 1;
- 			if (pd_idx == raid_disks-1) {
- 				(*dd_idx)++;	/* Q D D D P */
-@@ -1796,7 +1792,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
- 
- 		case ALGORITHM_ROTATING_N_CONTINUE:
- 			/* Same as left_symmetric but Q is before P */
--			pd_idx = raid_disks - 1 - (stripe % raid_disks);
-+			pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
- 			qd_idx = (pd_idx + raid_disks - 1) % raid_disks;
- 			*dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
- 			ddf_layout = 1;
-@@ -1804,27 +1800,27 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
- 
- 		case ALGORITHM_LEFT_ASYMMETRIC_6:
- 			/* RAID5 left_asymmetric, with Q on last device */
--			pd_idx = data_disks - stripe % (raid_disks-1);
-+			pd_idx = data_disks - sector_div(stripe2, raid_disks-1);
- 			if (*dd_idx >= pd_idx)
- 				(*dd_idx)++;
- 			qd_idx = raid_disks - 1;
- 			break;
- 
- 		case ALGORITHM_RIGHT_ASYMMETRIC_6:
--			pd_idx = stripe % (raid_disks-1);
-+			pd_idx = sector_div(stripe2, raid_disks-1);
- 			if (*dd_idx >= pd_idx)
- 				(*dd_idx)++;
- 			qd_idx = raid_disks - 1;
- 			break;
- 
- 		case ALGORITHM_LEFT_SYMMETRIC_6:
--			pd_idx = data_disks - stripe % (raid_disks-1);
-+			pd_idx = data_disks - sector_div(stripe2, raid_disks-1);
- 			*dd_idx = (pd_idx + 1 + *dd_idx) % (raid_disks-1);
- 			qd_idx = raid_disks - 1;
- 			break;
- 
- 		case ALGORITHM_RIGHT_SYMMETRIC_6:
--			pd_idx = stripe % (raid_disks-1);
-+			pd_idx = sector_div(stripe2, raid_disks-1);
- 			*dd_idx = (pd_idx + 1 + *dd_idx) % (raid_disks-1);
- 			qd_idx = raid_disks - 1;
- 			break;
-@@ -1869,14 +1865,14 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
- 				 : conf->algorithm;
- 	sector_t stripe;
- 	int chunk_offset;
--	int chunk_number, dummy1, dd_idx = i;
-+	sector_t chunk_number;
-+	int dummy1, dd_idx = i;
- 	sector_t r_sector;
- 	struct stripe_head sh2;
- 
- 
- 	chunk_offset = sector_div(new_sector, sectors_per_chunk);
- 	stripe = new_sector;
--	BUG_ON(new_sector != stripe);
- 
- 	if (i == sh->pd_idx)
- 		return 0;
-@@ -1969,7 +1965,7 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
- 	}
- 
- 	chunk_number = stripe * data_disks + i;
--	r_sector = (sector_t)chunk_number * sectors_per_chunk + chunk_offset;
-+	r_sector = chunk_number * sectors_per_chunk + chunk_offset;
- 
- 	check = raid5_compute_sector(conf, r_sector,
- 				     previous, &dummy1, &sh2);
-diff --git a/drivers/media/dvb/ttpci/budget.c b/drivers/media/dvb/ttpci/budget.c
-index e48380c..95a463c 100644
---- a/drivers/media/dvb/ttpci/budget.c
-+++ b/drivers/media/dvb/ttpci/budget.c
-@@ -643,9 +643,6 @@ static void frontend_init(struct budget *budget)
- 					&budget->i2c_adap,
- 					&tt1600_isl6423_config);
- 
--			} else {
--				dvb_frontend_detach(budget->dvb_frontend);
--				budget->dvb_frontend = NULL;
- 			}
- 		}
- 		break;
-diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
-index 65df1de..a555c90 100644
---- a/drivers/net/bnx2.c
-+++ b/drivers/net/bnx2.c
-@@ -4772,8 +4772,12 @@ bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
- 		rc = bnx2_alloc_bad_rbuf(bp);
- 	}
- 
--	if (bp->flags & BNX2_FLAG_USING_MSIX)
-+	if (bp->flags & BNX2_FLAG_USING_MSIX) {
- 		bnx2_setup_msix_tbl(bp);
-+		/* Prevent MSIX table reads and write from timing out */
-+		REG_WR(bp, BNX2_MISC_ECO_HW_CTL,
-+			BNX2_MISC_ECO_HW_CTL_LARGE_GRC_TMOUT_EN);
-+	}
- 
- 	return rc;
- }
-diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index 3db85da..787befc 100644
---- a/drivers/net/r8169.c
-+++ b/drivers/net/r8169.c
-@@ -2832,8 +2832,13 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
- 	spin_lock_irq(&tp->lock);
- 
- 	RTL_W8(Cfg9346, Cfg9346_Unlock);
--	RTL_W32(MAC0, low);
-+
- 	RTL_W32(MAC4, high);
-+	RTL_R32(MAC4);
-+
-+	RTL_W32(MAC0, low);
-+	RTL_R32(MAC0);
-+
- 	RTL_W8(Cfg9346, Cfg9346_Lock);
- 
- 	spin_unlock_irq(&tp->lock);
-@@ -4316,7 +4321,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
- 
- 	tp->cur_tx += frags + 1;
- 
--	smp_wmb();
-+	wmb();
- 
- 	RTL_W8(TxPoll, NPQ);	/* set polling bit */
- 
-@@ -4675,7 +4680,7 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
- 		 * until it does.
- 		 */
- 		tp->intr_mask = 0xffff;
--		smp_wmb();
-+		wmb();
- 		RTL_W16(IntrMask, tp->intr_event);
- 	}
- 
-@@ -4813,8 +4818,8 @@ static void rtl_set_rx_mode(struct net_device *dev)
- 		mc_filter[1] = swab32(data);
- 	}
- 
--	RTL_W32(MAR0 + 0, mc_filter[0]);
- 	RTL_W32(MAR0 + 4, mc_filter[1]);
-+	RTL_W32(MAR0 + 0, mc_filter[0]);
- 
- 	RTL_W32(RxConfig, tmp);
- 
-diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
-index 46997e1..fb52e47 100644
---- a/drivers/net/sfc/efx.c
-+++ b/drivers/net/sfc/efx.c
-@@ -1862,6 +1862,7 @@ out:
- 	}
- 
- 	if (disabled) {
-+		dev_close(efx->net_dev);
- 		EFX_ERR(efx, "has been disabled\n");
- 		efx->state = STATE_DISABLED;
- 	} else {
-@@ -1885,8 +1886,7 @@ static void efx_reset_work(struct work_struct *data)
- 	}
- 
- 	rtnl_lock();
--	if (efx_reset(efx, efx->reset_pending))
--		dev_close(efx->net_dev);
-+	(void)efx_reset(efx, efx->reset_pending);
- 	rtnl_unlock();
- }
- 
-diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
-index 9d009c4..e20a824 100644
---- a/drivers/net/sfc/falcon.c
-+++ b/drivers/net/sfc/falcon.c
-@@ -1317,7 +1317,9 @@ static int falcon_probe_nvconfig(struct efx_nic *efx)
- 
- 	EFX_LOG(efx, "PHY is %d phy_id %d\n", efx->phy_type, efx->mdio.prtad);
- 
--	falcon_probe_board(efx, board_rev);
-+	rc = falcon_probe_board(efx, board_rev);
-+	if (rc)
-+		goto fail2;
- 
- 	kfree(nvconfig);
- 	return 0;
-diff --git a/drivers/net/sfc/falcon_boards.c b/drivers/net/sfc/falcon_boards.c
-index 5712fdd..c7a933a 100644
---- a/drivers/net/sfc/falcon_boards.c
-+++ b/drivers/net/sfc/falcon_boards.c
-@@ -728,15 +728,7 @@ static const struct falcon_board_type board_types[] = {
- 	},
- };
- 
--static const struct falcon_board_type falcon_dummy_board = {
--	.init		= efx_port_dummy_op_int,
--	.init_phy	= efx_port_dummy_op_void,
--	.fini		= efx_port_dummy_op_void,
--	.set_id_led	= efx_port_dummy_op_set_id_led,
--	.monitor	= efx_port_dummy_op_int,
--};
--
--void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
-+int falcon_probe_board(struct efx_nic *efx, u16 revision_info)
- {
- 	struct falcon_board *board = falcon_board(efx);
- 	u8 type_id = FALCON_BOARD_TYPE(revision_info);
-@@ -754,8 +746,9 @@ void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
- 			 (efx->pci_dev->subsystem_vendor == EFX_VENDID_SFC)
- 			 ? board->type->ref_model : board->type->gen_type,
- 			 'A' + board->major, board->minor);
-+		return 0;
- 	} else {
- 		EFX_ERR(efx, "unknown board type %d\n", type_id);
--		board->type = &falcon_dummy_board;
-+		return -ENODEV;
- 	}
- }
-diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
-index 9351c03..3166baf 100644
---- a/drivers/net/sfc/nic.h
-+++ b/drivers/net/sfc/nic.h
-@@ -156,7 +156,7 @@ extern struct efx_nic_type siena_a0_nic_type;
-  **************************************************************************
-  */
- 
--extern void falcon_probe_board(struct efx_nic *efx, u16 revision_info);
-+extern int falcon_probe_board(struct efx_nic *efx, u16 revision_info);
- 
- /* TX data path */
- extern int efx_nic_probe_tx(struct efx_tx_queue *tx_queue);
-diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
-index f8c6771..afbac2d 100644
---- a/drivers/net/sfc/siena.c
-+++ b/drivers/net/sfc/siena.c
-@@ -454,8 +454,17 @@ static int siena_try_update_nic_stats(struct efx_nic *efx)
- 
- static void siena_update_nic_stats(struct efx_nic *efx)
- {
--	while (siena_try_update_nic_stats(efx) == -EAGAIN)
--		cpu_relax();
-+	int retry;
-+
-+	/* If we're unlucky enough to read statistics wduring the DMA, wait
-+	 * up to 10ms for it to finish (typically takes <500us) */
-+	for (retry = 0; retry < 100; ++retry) {
-+		if (siena_try_update_nic_stats(efx) == 0)
-+			return;
-+		udelay(100);
-+	}
-+
-+	/* Use the old values instead */
- }
- 
- static void siena_start_nic_stats(struct efx_nic *efx)
-diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
-index 17d1493..8405fb8 100644
---- a/drivers/net/tg3.c
-+++ b/drivers/net/tg3.c
-@@ -8572,6 +8572,7 @@ static int tg3_test_msi(struct tg3 *tp)
- 	pci_disable_msi(tp->pdev);
- 
- 	tp->tg3_flags2 &= ~TG3_FLG2_USING_MSI;
-+	tp->napi[0].irq_vec = tp->pdev->irq;
- 
- 	err = tg3_request_irq(tp, 0);
- 	if (err)
-diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index 2834a01..909b73d 100644
---- a/drivers/net/tun.c
-+++ b/drivers/net/tun.c
-@@ -380,6 +380,10 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
- 		}
- 	}
- 
-+	/* Orphan the skb - required as we might hang on to it
-+	 * for indefinite time. */
-+	skb_orphan(skb);
-+
- 	/* Enqueue packet */
- 	skb_queue_tail(&tun->socket.sk->sk_receive_queue, skb);
- 	dev->trans_start = jiffies;
-diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
-index 5f3b9ea..8a6e027 100644
---- a/drivers/net/usb/cdc_ether.c
-+++ b/drivers/net/usb/cdc_ether.c
-@@ -433,6 +433,7 @@ static const struct driver_info mbm_info = {
- 	.bind = 	cdc_bind,
- 	.unbind =	usbnet_cdc_unbind,
- 	.status =	cdc_status,
-+	.manage_power =	cdc_manage_power,
- };
- 
- /*-------------------------------------------------------------------------*/
-diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
-index 3d406f9..c60625b 100644
---- a/drivers/net/usb/dm9601.c
-+++ b/drivers/net/usb/dm9601.c
-@@ -238,7 +238,7 @@ static int dm_write_shared_word(struct usbnet *dev, int phy, u8 reg, __le16 valu
- 		goto out;
- 
- 	dm_write_reg(dev, DM_SHARED_ADDR, phy ? (reg | 0x40) : reg);
--	dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1c : 0x14);
-+	dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1a : 0x12);
- 
- 	for (i = 0; i < DM_TIMEOUT; i++) {
- 		u8 tmp;
-diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
-index b9b9d6b..941f053 100644
---- a/drivers/net/wan/hdlc_ppp.c
-+++ b/drivers/net/wan/hdlc_ppp.c
-@@ -628,9 +628,15 @@ static void ppp_stop(struct net_device *dev)
- 	ppp_cp_event(dev, PID_LCP, STOP, 0, 0, 0, NULL);
- }
- 
-+static void ppp_close(struct net_device *dev)
-+{
-+	ppp_tx_flush();
-+}
-+
- static struct hdlc_proto proto = {
- 	.start		= ppp_start,
- 	.stop		= ppp_stop,
-+	.close		= ppp_close,
- 	.type_trans	= ppp_type_trans,
- 	.ioctl		= ppp_ioctl,
- 	.netif_rx	= ppp_rx,
-diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
-index 7b1eab4..e55f718 100644
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1358,9 +1358,9 @@ void ath_cleanup(struct ath_softc *sc)
- 	free_irq(sc->irq, sc);
- 	ath_bus_cleanup(common);
- 	kfree(sc->sec_wiphy);
--	ieee80211_free_hw(sc->hw);
- 
- 	ath9k_uninit_hw(sc);
-+	ieee80211_free_hw(sc->hw);
- }
- 
- static int ath9k_reg_notifier(struct wiphy *wiphy,
-diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
-index 4bf4c21..41d33cd 100644
---- a/drivers/net/wireless/p54/p54pci.c
-+++ b/drivers/net/wireless/p54/p54pci.c
-@@ -245,7 +245,7 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
- 	u32 idx, i;
- 
- 	i = (*index) % ring_limit;
--	(*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
-+	(*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
- 	idx %= ring_limit;
- 
- 	while (i != idx) {
-diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
-index 8742640..b3c4fbd 100644
---- a/drivers/net/wireless/p54/p54usb.c
-+++ b/drivers/net/wireless/p54/p54usb.c
-@@ -36,6 +36,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
- 	/* Version 1 devices (pci chip + net2280) */
- 	{USB_DEVICE(0x0506, 0x0a11)},	/* 3COM 3CRWE254G72 */
- 	{USB_DEVICE(0x0707, 0xee06)},	/* SMC 2862W-G */
-+	{USB_DEVICE(0x07aa, 0x001c)},	/* Corega CG-WLUSB2GT */
- 	{USB_DEVICE(0x083a, 0x4501)},	/* Accton 802.11g WN4501 USB */
- 	{USB_DEVICE(0x083a, 0x4502)},	/* Siemens Gigaset USB Adapter */
- 	{USB_DEVICE(0x083a, 0x5501)},	/* Phillips CPWUA054 */
-diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
-index b6dda2b..9d147de 100644
---- a/drivers/net/wireless/p54/txrx.c
-+++ b/drivers/net/wireless/p54/txrx.c
-@@ -186,7 +186,7 @@ static int p54_tx_qos_accounting_alloc(struct p54_common *priv,
- 	struct ieee80211_tx_queue_stats *queue;
- 	unsigned long flags;
- 
--	if (WARN_ON(p54_queue > P54_QUEUE_NUM))
-+	if (WARN_ON(p54_queue >= P54_QUEUE_NUM))
- 		return -EINVAL;
- 
- 	queue = &priv->tx_stats[p54_queue];
-diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
-index c4fead1..b8eb5e7 100644
---- a/drivers/pci/pci.c
-+++ b/drivers/pci/pci.c
-@@ -624,7 +624,7 @@ static void __pci_start_power_transition(struct pci_dev *dev, pci_power_t state)
-  */
- int __pci_complete_power_transition(struct pci_dev *dev, pci_power_t state)
- {
--	return state > PCI_D0 ?
-+	return state >= PCI_D0 ?
- 			pci_platform_power_transition(dev, state) : -EINVAL;
- }
- EXPORT_SYMBOL_GPL(__pci_complete_power_transition);
-@@ -661,10 +661,6 @@ int pci_set_power_state(struct pci_dev *dev, pci_power_t state)
- 		 */
- 		return 0;
- 
--	/* Check if we're already there */
--	if (dev->current_state == state)
--		return 0;
--
- 	__pci_start_power_transition(dev, state);
- 
- 	/* This device is quirked not to be put into D3, so
-diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
-index e6b67f2..741672f 100644
---- a/drivers/scsi/libiscsi.c
-+++ b/drivers/scsi/libiscsi.c
-@@ -470,12 +470,12 @@ static int iscsi_prep_scsi_cmd_pdu(struct iscsi_task *task)
- 
- 	WARN_ON(hdrlength >= 256);
- 	hdr->hlength = hdrlength & 0xFF;
-+	hdr->cmdsn = task->cmdsn = cpu_to_be32(session->cmdsn);
- 
- 	if (session->tt->init_task && session->tt->init_task(task))
- 		return -EIO;
- 
- 	task->state = ISCSI_TASK_RUNNING;
--	hdr->cmdsn = task->cmdsn = cpu_to_be32(session->cmdsn);
- 	session->cmdsn++;
- 
- 	conn->scsicmd_pdus_cnt++;
-diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
-index e155011..816ab97 100644
---- a/drivers/scsi/libsas/sas_ata.c
-+++ b/drivers/scsi/libsas/sas_ata.c
-@@ -394,11 +394,15 @@ int sas_ata_init_host_and_port(struct domain_device *found_dev,
- void sas_ata_task_abort(struct sas_task *task)
- {
- 	struct ata_queued_cmd *qc = task->uldd_task;
-+	struct request_queue *q = qc->scsicmd->device->request_queue;
- 	struct completion *waiting;
-+	unsigned long flags;
- 
- 	/* Bounce SCSI-initiated commands to the SCSI EH */
- 	if (qc->scsicmd) {
-+		spin_lock_irqsave(q->queue_lock, flags);
- 		blk_abort_request(qc->scsicmd->request);
-+		spin_unlock_irqrestore(q->queue_lock, flags);
- 		scsi_schedule_eh(qc->scsicmd->device->host);
- 		return;
- 	}
-diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
-index 14b1319..b672d10 100644
---- a/drivers/scsi/libsas/sas_scsi_host.c
-+++ b/drivers/scsi/libsas/sas_scsi_host.c
-@@ -1029,6 +1029,8 @@ int __sas_task_abort(struct sas_task *task)
- void sas_task_abort(struct sas_task *task)
- {
- 	struct scsi_cmnd *sc = task->uldd_task;
-+	struct request_queue *q = sc->device->request_queue;
-+	unsigned long flags;
- 
- 	/* Escape for libsas internal commands */
- 	if (!sc) {
-@@ -1043,7 +1045,9 @@ void sas_task_abort(struct sas_task *task)
- 		return;
- 	}
- 
-+	spin_lock_irqsave(q->queue_lock, flags);
- 	blk_abort_request(sc->request);
-+	spin_unlock_irqrestore(q->queue_lock, flags);
- 	scsi_schedule_eh(sc->device->host);
- }
- 
-diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
-index 0b575c8..aa2a2dc 100644
---- a/drivers/scsi/scsi_debug.c
-+++ b/drivers/scsi/scsi_debug.c
-@@ -956,7 +956,8 @@ static int resp_start_stop(struct scsi_cmnd * scp,
- static sector_t get_sdebug_capacity(void)
- {
- 	if (scsi_debug_virtual_gb > 0)
--		return 2048 * 1024 * (sector_t)scsi_debug_virtual_gb;
-+		return (sector_t)scsi_debug_virtual_gb *
-+			(1073741824 / scsi_debug_sector_size);
- 	else
- 		return sdebug_store_sectors;
- }
-diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
-index 08ed506..e46155b 100644
---- a/drivers/scsi/scsi_error.c
-+++ b/drivers/scsi/scsi_error.c
-@@ -301,7 +301,20 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
- 		if (scmd->device->allow_restart &&
- 		    (sshdr.asc == 0x04) && (sshdr.ascq == 0x02))
- 			return FAILED;
--		return SUCCESS;
-+
-+		if (blk_barrier_rq(scmd->request))
-+			/*
-+			 * barrier requests should always retry on UA
-+			 * otherwise block will get a spurious error
-+			 */
-+			return NEEDS_RETRY;
-+		else
-+			/*
-+			 * for normal (non barrier) commands, pass the
-+			 * UA upwards for a determination in the
-+			 * completion functions
-+			 */
-+			return SUCCESS;
- 
- 		/* these three are not supported */
- 	case COPY_ABORTED:
-diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index c664242..5697709 100644
---- a/drivers/scsi/scsi_lib.c
-+++ b/drivers/scsi/scsi_lib.c
-@@ -773,8 +773,14 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
- 	 * we already took a copy of the original into rq->errors which
- 	 * is what gets returned to the user
- 	 */
--	if (sense_valid && sshdr.sense_key == RECOVERED_ERROR) {
--		if (!(req->cmd_flags & REQ_QUIET))
-+	if (sense_valid && (sshdr.sense_key == RECOVERED_ERROR)) {
-+		/* if ATA PASS-THROUGH INFORMATION AVAILABLE skip
-+		 * print since caller wants ATA registers. Only occurs on
-+		 * SCSI ATA PASS_THROUGH commands when CK_COND=1
-+		 */
-+		if ((sshdr.asc == 0x0) && (sshdr.ascq == 0x1d))
-+			;
-+		else if (!(req->cmd_flags & REQ_QUIET))
- 			scsi_print_sense("", cmd);
- 		result = 0;
- 		/* BLOCK_PC may have set error */
-diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
-index 255da53..bf15920 100644
---- a/drivers/scsi/sd.c
-+++ b/drivers/scsi/sd.c
-@@ -1039,6 +1039,7 @@ static void sd_prepare_flush(struct request_queue *q, struct request *rq)
- {
- 	rq->cmd_type = REQ_TYPE_BLOCK_PC;
- 	rq->timeout = SD_TIMEOUT;
-+	rq->retries = SD_MAX_RETRIES;
- 	rq->cmd[0] = SYNCHRONIZE_CACHE;
- 	rq->cmd_len = 10;
- }
-diff --git a/drivers/serial/8250_pnp.c b/drivers/serial/8250_pnp.c
-index 24485cc..4822cb5 100644
---- a/drivers/serial/8250_pnp.c
-+++ b/drivers/serial/8250_pnp.c
-@@ -348,6 +348,8 @@ static const struct pnp_device_id pnp_dev_table[] = {
- 	{	"FUJ02E6",		0	},
- 	/* Fujitsu Wacom 2FGT Tablet PC device */
- 	{	"FUJ02E7",		0	},
-+	/* Fujitsu Wacom 1FGT Tablet PC device */
-+	{	"FUJ02E9",		0	},
- 	/*
- 	 * LG C1 EXPRESS DUAL (C1-PB11A3) touch screen (actually a FUJ02E6 in
- 	 * disguise)
-diff --git a/drivers/staging/hv/Hv.c b/drivers/staging/hv/Hv.c
-index c2809f2..b12237f 100644
---- a/drivers/staging/hv/Hv.c
-+++ b/drivers/staging/hv/Hv.c
-@@ -306,9 +306,9 @@ void HvCleanup(void)
- 	DPRINT_ENTER(VMBUS);
- 
- 	if (gHvContext.SignalEventBuffer) {
-+		kfree(gHvContext.SignalEventBuffer);
- 		gHvContext.SignalEventBuffer = NULL;
- 		gHvContext.SignalEventParam = NULL;
--		kfree(gHvContext.SignalEventBuffer);
- 	}
- 
- 	if (gHvContext.GuestId == HV_LINUX_GUEST_ID) {
-diff --git a/drivers/staging/hv/RndisFilter.c b/drivers/staging/hv/RndisFilter.c
-index 26d7997..f05f4e1 100644
---- a/drivers/staging/hv/RndisFilter.c
-+++ b/drivers/staging/hv/RndisFilter.c
-@@ -756,6 +756,7 @@ static int RndisFilterOpenDevice(struct rndis_device *Device)
- 
- 	ret = RndisFilterSetPacketFilter(Device,
- 					 NDIS_PACKET_TYPE_BROADCAST |
-+					 NDIS_PACKET_TYPE_ALL_MULTICAST |
- 					 NDIS_PACKET_TYPE_DIRECTED);
- 	if (ret == 0)
- 		Device->State = RNDIS_DEV_DATAINITIALIZED;
-diff --git a/drivers/staging/hv/netvsc_drv.c b/drivers/staging/hv/netvsc_drv.c
-index 0d7459e..4c3c8bc 100644
---- a/drivers/staging/hv/netvsc_drv.c
-+++ b/drivers/staging/hv/netvsc_drv.c
-@@ -413,8 +413,7 @@ static int netvsc_probe(struct device *device)
- 	if (!net_drv_obj->Base.OnDeviceAdd)
- 		return -1;
- 
--	net = alloc_netdev(sizeof(struct net_device_context), "seth%d",
--			   ether_setup);
-+	net = alloc_etherdev(sizeof(struct net_device_context));
- 	if (!net)
- 		return -1;
- 
-diff --git a/drivers/staging/usbip/usbip_event.c b/drivers/staging/usbip/usbip_event.c
-index 6da1021..a2566f1 100644
---- a/drivers/staging/usbip/usbip_event.c
-+++ b/drivers/staging/usbip/usbip_event.c
-@@ -117,6 +117,9 @@ void usbip_stop_eh(struct usbip_device *ud)
- {
- 	struct usbip_task *eh = &ud->eh;
- 
-+	if (eh->thread == current)
-+		return; /* do not wait for myself */
-+
- 	wait_for_completion(&eh->thread_done);
- 	usbip_dbg_eh("usbip_eh has finished\n");
- }
-diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
-index ca479a7..d9d0bf5 100644
---- a/drivers/usb/core/driver.c
-+++ b/drivers/usb/core/driver.c
-@@ -1255,9 +1255,8 @@ static int usb_suspend_both(struct usb_device *udev, pm_message_t msg)
- 			udev->state == USB_STATE_SUSPENDED)
- 		goto done;
- 
--	udev->do_remote_wakeup = device_may_wakeup(&udev->dev);
--
- 	if (msg.event & PM_EVENT_AUTO) {
-+		udev->do_remote_wakeup = device_may_wakeup(&udev->dev);
- 		status = autosuspend_check(udev, 0);
- 		if (status < 0)
- 			goto done;
-@@ -1789,6 +1788,34 @@ int usb_external_resume_device(struct usb_device *udev, pm_message_t msg)
- 	return status;
- }
- 
-+static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
-+{
-+	int			w, i;
-+	struct usb_interface	*intf;
-+
-+	/* Remote wakeup is needed only when we actually go to sleep.
-+	 * For things like FREEZE and QUIESCE, if the device is already
-+	 * autosuspended then its current wakeup setting is okay.
-+	 */
-+	if (msg.event == PM_EVENT_FREEZE || msg.event == PM_EVENT_QUIESCE) {
-+		udev->do_remote_wakeup = 0;
-+		return;
-+	}
-+
-+	/* If remote wakeup is permitted, see whether any interface drivers
-+	 * actually want it.
-+	 */
-+	w = 0;
-+	if (device_may_wakeup(&udev->dev) && udev->actconfig) {
-+		for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
-+			intf = udev->actconfig->interface[i];
-+			w |= intf->needs_remote_wakeup;
-+		}
-+	}
-+
-+	udev->do_remote_wakeup = w;
-+}
-+
- int usb_suspend(struct device *dev, pm_message_t msg)
- {
- 	struct usb_device	*udev;
-@@ -1808,6 +1835,7 @@ int usb_suspend(struct device *dev, pm_message_t msg)
- 	}
- 
- 	udev->skip_sys_resume = 0;
-+	choose_wakeup(udev, msg);
- 	return usb_external_suspend_device(udev, msg);
- }
- 
-diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
-index bdf87a8..2c95153 100644
---- a/drivers/usb/core/generic.c
-+++ b/drivers/usb/core/generic.c
-@@ -120,7 +120,7 @@ int usb_choose_configuration(struct usb_device *udev)
- 		 * than a vendor-specific driver. */
- 		else if (udev->descriptor.bDeviceClass !=
- 						USB_CLASS_VENDOR_SPEC &&
--				(!desc || desc->bInterfaceClass !=
-+				(desc && desc->bInterfaceClass !=
- 						USB_CLASS_VENDOR_SPEC)) {
- 			best = c;
- 			break;
-diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
-index 97b40ce..4a6366a 100644
---- a/drivers/usb/core/inode.c
-+++ b/drivers/usb/core/inode.c
-@@ -515,13 +515,13 @@ static int fs_create_by_name (const char *name, mode_t mode,
- 	*dentry = NULL;
- 	mutex_lock(&parent->d_inode->i_mutex);
- 	*dentry = lookup_one_len(name, parent, strlen(name));
--	if (!IS_ERR(dentry)) {
-+	if (!IS_ERR(*dentry)) {
- 		if ((mode & S_IFMT) == S_IFDIR)
- 			error = usbfs_mkdir (parent->d_inode, *dentry, mode);
- 		else 
- 			error = usbfs_create (parent->d_inode, *dentry, mode);
- 	} else
--		error = PTR_ERR(dentry);
-+		error = PTR_ERR(*dentry);
- 	mutex_unlock(&parent->d_inode->i_mutex);
- 
- 	return error;
-diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
-index 9bc95fe..1a48aac 100644
---- a/drivers/usb/core/message.c
-+++ b/drivers/usb/core/message.c
-@@ -1471,7 +1471,7 @@ int usb_reset_configuration(struct usb_device *dev)
- 	/* If not, reinstate the old alternate settings */
- 	if (retval < 0) {
- reset_old_alts:
--		for (; i >= 0; i--) {
-+		for (i--; i >= 0; i--) {
- 			struct usb_interface *intf = config->interface[i];
- 			struct usb_host_interface *alt;
- 
-diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
-index 9c90b67..efa0372 100644
---- a/drivers/usb/host/ehci-hcd.c
-+++ b/drivers/usb/host/ehci-hcd.c
-@@ -543,6 +543,7 @@ static int ehci_init(struct usb_hcd *hcd)
- 	 */
- 	ehci->periodic_size = DEFAULT_I_TDPS;
- 	INIT_LIST_HEAD(&ehci->cached_itd_list);
-+	INIT_LIST_HEAD(&ehci->cached_sitd_list);
- 	if ((retval = ehci_mem_init(ehci, GFP_KERNEL)) < 0)
- 		return retval;
- 
-diff --git a/drivers/usb/host/ehci-mem.c b/drivers/usb/host/ehci-mem.c
-index aeda96e..1f3f01e 100644
---- a/drivers/usb/host/ehci-mem.c
-+++ b/drivers/usb/host/ehci-mem.c
-@@ -136,7 +136,7 @@ static inline void qh_put (struct ehci_qh *qh)
- 
- static void ehci_mem_cleanup (struct ehci_hcd *ehci)
- {
--	free_cached_itd_list(ehci);
-+	free_cached_lists(ehci);
- 	if (ehci->async)
- 		qh_put (ehci->async);
- 	ehci->async = NULL;
-diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
-index df533ce..2064045 100644
---- a/drivers/usb/host/ehci-sched.c
-+++ b/drivers/usb/host/ehci-sched.c
-@@ -2137,13 +2137,27 @@ sitd_complete (
- 			(stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out");
- 	}
- 	iso_stream_put (ehci, stream);
--	/* OK to recycle this SITD now that its completion callback ran. */
-+
- done:
- 	sitd->urb = NULL;
--	sitd->stream = NULL;
--	list_move(&sitd->sitd_list, &stream->free_list);
--	iso_stream_put(ehci, stream);
--
-+	if (ehci->clock_frame != sitd->frame) {
-+		/* OK to recycle this SITD now. */
-+		sitd->stream = NULL;
-+		list_move(&sitd->sitd_list, &stream->free_list);
-+		iso_stream_put(ehci, stream);
-+	} else {
-+		/* HW might remember this SITD, so we can't recycle it yet.
-+		 * Move it to a safe place until a new frame starts.
-+		 */
-+		list_move(&sitd->sitd_list, &ehci->cached_sitd_list);
-+		if (stream->refcount == 2) {
-+			/* If iso_stream_put() were called here, stream
-+			 * would be freed.  Instead, just prevent reuse.
-+			 */
-+			stream->ep->hcpriv = NULL;
-+			stream->ep = NULL;
-+		}
-+	}
- 	return retval;
- }
- 
-@@ -2209,9 +2223,10 @@ done:
- 
- /*-------------------------------------------------------------------------*/
- 
--static void free_cached_itd_list(struct ehci_hcd *ehci)
-+static void free_cached_lists(struct ehci_hcd *ehci)
- {
- 	struct ehci_itd *itd, *n;
-+	struct ehci_sitd *sitd, *sn;
- 
- 	list_for_each_entry_safe(itd, n, &ehci->cached_itd_list, itd_list) {
- 		struct ehci_iso_stream	*stream = itd->stream;
-@@ -2219,6 +2234,13 @@ static void free_cached_itd_list(struct ehci_hcd *ehci)
- 		list_move(&itd->itd_list, &stream->free_list);
- 		iso_stream_put(ehci, stream);
- 	}
-+
-+	list_for_each_entry_safe(sitd, sn, &ehci->cached_sitd_list, sitd_list) {
-+		struct ehci_iso_stream	*stream = sitd->stream;
-+		sitd->stream = NULL;
-+		list_move(&sitd->sitd_list, &stream->free_list);
-+		iso_stream_put(ehci, stream);
-+	}
- }
- 
- /*-------------------------------------------------------------------------*/
-@@ -2245,7 +2267,7 @@ scan_periodic (struct ehci_hcd *ehci)
- 		clock_frame = -1;
- 	}
- 	if (ehci->clock_frame != clock_frame) {
--		free_cached_itd_list(ehci);
-+		free_cached_lists(ehci);
- 		ehci->clock_frame = clock_frame;
- 	}
- 	clock %= mod;
-@@ -2408,7 +2430,7 @@ restart:
- 			clock = now;
- 			clock_frame = clock >> 3;
- 			if (ehci->clock_frame != clock_frame) {
--				free_cached_itd_list(ehci);
-+				free_cached_lists(ehci);
- 				ehci->clock_frame = clock_frame;
- 			}
- 		} else {
-diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
-index b1dce96..556c0b4 100644
---- a/drivers/usb/host/ehci.h
-+++ b/drivers/usb/host/ehci.h
-@@ -87,8 +87,9 @@ struct ehci_hcd {			/* one per controller */
- 	int			next_uframe;	/* scan periodic, start here */
- 	unsigned		periodic_sched;	/* periodic activity count */
- 
--	/* list of itds completed while clock_frame was still active */
-+	/* list of itds & sitds completed while clock_frame was still active */
- 	struct list_head	cached_itd_list;
-+	struct list_head	cached_sitd_list;
- 	unsigned		clock_frame;
- 
- 	/* per root hub port */
-@@ -195,7 +196,7 @@ timer_action_done (struct ehci_hcd *ehci, enum ehci_timer_action action)
- 	clear_bit (action, &ehci->actions);
- }
- 
--static void free_cached_itd_list(struct ehci_hcd *ehci);
-+static void free_cached_lists(struct ehci_hcd *ehci);
- 
- /*-------------------------------------------------------------------------*/
- 
-diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
-index 32bbce9..65cac8c 100644
---- a/drivers/usb/host/ohci-hub.c
-+++ b/drivers/usb/host/ohci-hub.c
-@@ -697,7 +697,7 @@ static int ohci_hub_control (
- 	u16		wLength
- ) {
- 	struct ohci_hcd	*ohci = hcd_to_ohci (hcd);
--	int		ports = hcd_to_bus (hcd)->root_hub->maxchild;
-+	int		ports = ohci->num_ports;
- 	u32		temp;
- 	int		retval = 0;
- 
-diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
-index bffcef7..6c1f673 100644
---- a/drivers/usb/host/xhci-mem.c
-+++ b/drivers/usb/host/xhci-mem.c
-@@ -549,6 +549,19 @@ static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
- 	return EP_INTERVAL(interval);
- }
- 
-+/* The "Mult" field in the endpoint context is only set for SuperSpeed devices.
-+ * High speed endpoint descriptors can define "the number of additional
-+ * transaction opportunities per microframe", but that goes in the Max Burst
-+ * endpoint context field.
-+ */
-+static inline u32 xhci_get_endpoint_mult(struct usb_device *udev,
-+		struct usb_host_endpoint *ep)
-+{
-+	if (udev->speed != USB_SPEED_SUPER || !ep->ss_ep_comp)
-+		return 0;
-+	return ep->ss_ep_comp->desc.bmAttributes;
-+}
-+
- static inline u32 xhci_get_endpoint_type(struct usb_device *udev,
- 		struct usb_host_endpoint *ep)
- {
-@@ -579,6 +592,36 @@ static inline u32 xhci_get_endpoint_type(struct usb_device *udev,
- 	return type;
- }
- 
-+/* Return the maximum endpoint service interval time (ESIT) payload.
-+ * Basically, this is the maxpacket size, multiplied by the burst size
-+ * and mult size.
-+ */
-+static inline u32 xhci_get_max_esit_payload(struct xhci_hcd *xhci,
-+		struct usb_device *udev,
-+		struct usb_host_endpoint *ep)
-+{
-+	int max_burst;
-+	int max_packet;
-+
-+	/* Only applies for interrupt or isochronous endpoints */
-+	if (usb_endpoint_xfer_control(&ep->desc) ||
-+			usb_endpoint_xfer_bulk(&ep->desc))
-+		return 0;
-+
-+	if (udev->speed == USB_SPEED_SUPER) {
-+		if (ep->ss_ep_comp)
-+			return ep->ss_ep_comp->desc.wBytesPerInterval;
-+		xhci_warn(xhci, "WARN no SS endpoint companion descriptor.\n");
-+		/* Assume no bursts, no multiple opportunities to send. */
-+		return ep->desc.wMaxPacketSize;
-+	}
-+
-+	max_packet = ep->desc.wMaxPacketSize & 0x3ff;
-+	max_burst = (ep->desc.wMaxPacketSize & 0x1800) >> 11;
-+	/* A 0 in max burst means 1 transfer per ESIT */
-+	return max_packet * (max_burst + 1);
-+}
-+
- int xhci_endpoint_init(struct xhci_hcd *xhci,
- 		struct xhci_virt_device *virt_dev,
- 		struct usb_device *udev,
-@@ -590,6 +633,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
- 	struct xhci_ring *ep_ring;
- 	unsigned int max_packet;
- 	unsigned int max_burst;
-+	u32 max_esit_payload;
- 
- 	ep_index = xhci_get_endpoint_index(&ep->desc);
- 	ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
-@@ -611,6 +655,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
- 	ep_ctx->deq = ep_ring->first_seg->dma | ep_ring->cycle_state;
- 
- 	ep_ctx->ep_info = xhci_get_endpoint_interval(udev, ep);
-+	ep_ctx->ep_info |= EP_MULT(xhci_get_endpoint_mult(udev, ep));
- 
- 	/* FIXME dig Mult and streams info out of ep companion desc */
- 
-@@ -656,6 +701,26 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
- 	default:
- 		BUG();
- 	}
-+	max_esit_payload = xhci_get_max_esit_payload(xhci, udev, ep);
-+	ep_ctx->tx_info = MAX_ESIT_PAYLOAD_FOR_EP(max_esit_payload);
-+
-+	/*
-+	 * XXX no idea how to calculate the average TRB buffer length for bulk
-+	 * endpoints, as the driver gives us no clue how big each scatter gather
-+	 * list entry (or buffer) is going to be.
-+	 *
-+	 * For isochronous and interrupt endpoints, we set it to the max
-+	 * available, until we have new API in the USB core to allow drivers to
-+	 * declare how much bandwidth they actually need.
-+	 *
-+	 * Normally, it would be calculated by taking the total of the buffer
-+	 * lengths in the TD and then dividing by the number of TRBs in a TD,
-+	 * including link TRBs, No-op TRBs, and Event data TRBs.  Since we don't
-+	 * use Event Data TRBs, and we don't chain in a link TRB on short
-+	 * transfers, we're basically dividing by 1.
-+	 */
-+	ep_ctx->tx_info |= AVG_TRB_LENGTH_FOR_EP(max_esit_payload);
-+
- 	/* FIXME Debug endpoint context */
- 	return 0;
- }
-diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
-index 8778135..9e904a6 100644
---- a/drivers/usb/host/xhci.h
-+++ b/drivers/usb/host/xhci.h
-@@ -609,6 +609,10 @@ struct xhci_ep_ctx {
- #define MAX_PACKET_MASK		(0xffff << 16)
- #define MAX_PACKET_DECODED(p)	(((p) >> 16) & 0xffff)
- 
-+/* tx_info bitmasks */
-+#define AVG_TRB_LENGTH_FOR_EP(p)	((p) & 0xffff)
-+#define MAX_ESIT_PAYLOAD_FOR_EP(p)	(((p) & 0xffff) << 16)
-+
- 
- /**
-  * struct xhci_input_control_context
-diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
-index 0cfd621..a442989 100644
---- a/drivers/usb/serial/sierra.c
-+++ b/drivers/usb/serial/sierra.c
-@@ -229,6 +229,7 @@ static const struct sierra_iface_info direct_ip_interface_blacklist = {
- static struct usb_device_id id_table [] = {
- 	{ USB_DEVICE(0x0F3D, 0x0112) }, /* Airprime/Sierra PC 5220 */
- 	{ USB_DEVICE(0x03F0, 0x1B1D) },	/* HP ev2200 a.k.a MC5720 */
-+	{ USB_DEVICE(0x03F0, 0x211D) }, /* HP ev2210 a.k.a MC5725 */
- 	{ USB_DEVICE(0x03F0, 0x1E1D) },	/* HP hs2300 a.k.a MC8775 */
- 
- 	{ USB_DEVICE(0x1199, 0x0017) },	/* Sierra Wireless EM5625 */
-diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
-index 1ed3d55..17726a0 100644
---- a/drivers/w1/slaves/w1_therm.c
-+++ b/drivers/w1/slaves/w1_therm.c
-@@ -115,9 +115,8 @@ static struct w1_therm_family_converter w1_therm_families[] = {
- 
- static inline int w1_DS18B20_convert_temp(u8 rom[9])
- {
--	int t = ((s16)rom[1] << 8) | rom[0];
--	t = t*1000/16;
--	return t;
-+	s16 t = le16_to_cpup((__le16 *)rom);
-+	return t*1000/16;
- }
- 
- static inline int w1_DS18S20_convert_temp(u8 rom[9])
-diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
-index c568779..cae75c1 100644
---- a/fs/ext4/extents.c
-+++ b/fs/ext4/extents.c
-@@ -3767,7 +3767,6 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
- 		__u64 start, __u64 len)
- {
- 	ext4_lblk_t start_blk;
--	ext4_lblk_t len_blks;
- 	int error = 0;
- 
- 	/* fallback to generic here if not in extents fmt */
-@@ -3781,8 +3780,14 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
- 	if (fieinfo->fi_flags & FIEMAP_FLAG_XATTR) {
- 		error = ext4_xattr_fiemap(inode, fieinfo);
- 	} else {
-+		ext4_lblk_t len_blks;
-+		__u64 last_blk;
-+
- 		start_blk = start >> inode->i_sb->s_blocksize_bits;
--		len_blks = len >> inode->i_sb->s_blocksize_bits;
-+		last_blk = (start + len - 1) >> inode->i_sb->s_blocksize_bits;
-+		if (last_blk >= EXT_MAX_BLOCK)
-+			last_blk = EXT_MAX_BLOCK-1;
-+		len_blks = ((ext4_lblk_t) last_blk) - start_blk + 1;
- 
- 		/*
- 		 * Walk the extent tree gathering extent information.
-diff --git a/fs/jfs/resize.c b/fs/jfs/resize.c
-index 7f24a0b..1aba003 100644
---- a/fs/jfs/resize.c
-+++ b/fs/jfs/resize.c
-@@ -81,6 +81,7 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
- 	struct inode *iplist[1];
- 	struct jfs_superblock *j_sb, *j_sb2;
- 	uint old_agsize;
-+	int agsizechanged = 0;
- 	struct buffer_head *bh, *bh2;
- 
- 	/* If the volume hasn't grown, get out now */
-@@ -333,6 +334,9 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
- 	 */
- 	if ((rc = dbExtendFS(ipbmap, XAddress, nblocks)))
- 		goto error_out;
-+
-+	agsizechanged |= (bmp->db_agsize != old_agsize);
-+
- 	/*
- 	 * the map now has extended to cover additional nblocks:
- 	 * dn_mapsize = oldMapsize + nblocks;
-@@ -432,7 +436,7 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
- 	 * will correctly identify the new ag);
- 	 */
- 	/* if new AG size the same as old AG size, done! */
--	if (bmp->db_agsize != old_agsize) {
-+	if (agsizechanged) {
- 		if ((rc = diExtendFS(ipimap, ipbmap)))
- 			goto error_out;
- 
-diff --git a/fs/nfs/client.c b/fs/nfs/client.c
-index bd39abc..37d555c 100644
---- a/fs/nfs/client.c
-+++ b/fs/nfs/client.c
-@@ -965,6 +965,8 @@ out_error:
- static void nfs_server_copy_userdata(struct nfs_server *target, struct nfs_server *source)
- {
- 	target->flags = source->flags;
-+	target->rsize = source->rsize;
-+	target->wsize = source->wsize;
- 	target->acregmin = source->acregmin;
- 	target->acregmax = source->acregmax;
- 	target->acdirmin = source->acdirmin;
-diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
-index af6948d..b5d55d3 100644
---- a/fs/nfs/dir.c
-+++ b/fs/nfs/dir.c
-@@ -837,6 +837,8 @@ out_zap_parent:
- 		/* If we have submounts, don't unhash ! */
- 		if (have_submounts(dentry))
- 			goto out_valid;
-+		if (dentry->d_flags & DCACHE_DISCONNECTED)
-+			goto out_valid;
- 		shrink_dcache_parent(dentry);
- 	}
- 	d_drop(dentry);
-diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
-index bbf72d8..718f3fb 100644
---- a/fs/nfsd/nfs4xdr.c
-+++ b/fs/nfsd/nfs4xdr.c
-@@ -160,10 +160,10 @@ static __be32 *read_buf(struct nfsd4_compoundargs *argp, u32 nbytes)
- 	argp->p = page_address(argp->pagelist[0]);
- 	argp->pagelist++;
- 	if (argp->pagelen < PAGE_SIZE) {
--		argp->end = p + (argp->pagelen>>2);
-+		argp->end = argp->p + (argp->pagelen>>2);
- 		argp->pagelen = 0;
- 	} else {
--		argp->end = p + (PAGE_SIZE>>2);
-+		argp->end = argp->p + (PAGE_SIZE>>2);
- 		argp->pagelen -= PAGE_SIZE;
- 	}
- 	memcpy(((char*)p)+avail, argp->p, (nbytes - avail));
-@@ -1425,10 +1425,10 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
- 			argp->p = page_address(argp->pagelist[0]);
- 			argp->pagelist++;
- 			if (argp->pagelen < PAGE_SIZE) {
--				argp->end = p + (argp->pagelen>>2);
-+				argp->end = argp->p + (argp->pagelen>>2);
- 				argp->pagelen = 0;
- 			} else {
--				argp->end = p + (PAGE_SIZE>>2);
-+				argp->end = argp->p + (PAGE_SIZE>>2);
- 				argp->pagelen -= PAGE_SIZE;
- 			}
- 		}
-diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
-index 21c808f..b18c6d6 100644
---- a/fs/ocfs2/buffer_head_io.c
-+++ b/fs/ocfs2/buffer_head_io.c
-@@ -407,6 +407,7 @@ int ocfs2_write_super_or_backup(struct ocfs2_super *osb,
- 				struct buffer_head *bh)
- {
- 	int ret = 0;
-+	struct ocfs2_dinode *di = (struct ocfs2_dinode *)bh->b_data;
- 
- 	mlog_entry_void();
- 
-@@ -426,6 +427,7 @@ int ocfs2_write_super_or_backup(struct ocfs2_super *osb,
- 
- 	get_bh(bh); /* for end_buffer_write_sync() */
- 	bh->b_end_io = end_buffer_write_sync;
-+	ocfs2_compute_meta_ecc(osb->sb, bh->b_data, &di->i_check);
- 	submit_bh(WRITE, bh);
- 
- 	wait_on_buffer(bh);
-diff --git a/fs/ocfs2/dlm/dlmfs.c b/fs/ocfs2/dlm/dlmfs.c
-index 02bf178..18bc101 100644
---- a/fs/ocfs2/dlm/dlmfs.c
-+++ b/fs/ocfs2/dlm/dlmfs.c
-@@ -205,7 +205,7 @@ static ssize_t dlmfs_file_read(struct file *filp,
- 	if ((count + *ppos) > i_size_read(inode))
- 		readlen = i_size_read(inode) - *ppos;
- 	else
--		readlen = count - *ppos;
-+		readlen = count;
- 
- 	lvb_buf = kmalloc(readlen, GFP_NOFS);
- 	if (!lvb_buf)
-diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
-index 88459bd..ec4d97f 100644
---- a/fs/ocfs2/inode.c
-+++ b/fs/ocfs2/inode.c
-@@ -559,6 +559,7 @@ static int ocfs2_truncate_for_delete(struct ocfs2_super *osb,
- 		handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
- 		if (IS_ERR(handle)) {
- 			status = PTR_ERR(handle);
-+			handle = NULL;
- 			mlog_errno(status);
- 			goto out;
- 		}
-diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
-index 8ae65c9..a8e8572 100644
---- a/fs/ocfs2/refcounttree.c
-+++ b/fs/ocfs2/refcounttree.c
-@@ -4083,6 +4083,9 @@ static int ocfs2_complete_reflink(struct inode *s_inode,
- 	di->i_attr = s_di->i_attr;
- 
- 	if (preserve) {
-+		t_inode->i_uid = s_inode->i_uid;
-+		t_inode->i_gid = s_inode->i_gid;
-+		t_inode->i_mode = s_inode->i_mode;
- 		di->i_uid = s_di->i_uid;
- 		di->i_gid = s_di->i_gid;
- 		di->i_mode = s_di->i_mode;
-diff --git a/fs/proc/base.c b/fs/proc/base.c
-index 3cd449d..8dce96c 100644
---- a/fs/proc/base.c
-+++ b/fs/proc/base.c
-@@ -2910,7 +2910,7 @@ out_no_task:
-  */
- static const struct pid_entry tid_base_stuff[] = {
- 	DIR("fd",        S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations),
--	DIR("fdinfo",    S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fd_operations),
-+	DIR("fdinfo",    S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fdinfo_operations),
- 	REG("environ",   S_IRUSR, proc_environ_operations),
- 	INF("auxv",      S_IRUSR, proc_pid_auxv),
- 	ONE("status",    S_IRUGO, proc_pid_status),
-diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
-index c094f58..1e686ee 100644
---- a/fs/reiserfs/dir.c
-+++ b/fs/reiserfs/dir.c
-@@ -45,8 +45,6 @@ static inline bool is_privroot_deh(struct dentry *dir,
- 				   struct reiserfs_de_head *deh)
- {
- 	struct dentry *privroot = REISERFS_SB(dir->d_sb)->priv_root;
--	if (reiserfs_expose_privroot(dir->d_sb))
--		return 0;
- 	return (dir == dir->d_parent && privroot->d_inode &&
- 	        deh->deh_objectid == INODE_PKEY(privroot->d_inode)->k_objectid);
- }
-diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
-index 81f09fa..0392e82 100644
---- a/fs/reiserfs/xattr.c
-+++ b/fs/reiserfs/xattr.c
-@@ -557,7 +557,7 @@ reiserfs_xattr_set_handle(struct reiserfs_transaction_handle *th,
- 	if (!err && new_size < i_size_read(dentry->d_inode)) {
- 		struct iattr newattrs = {
- 			.ia_ctime = current_fs_time(inode->i_sb),
--			.ia_size = buffer_size,
-+			.ia_size = new_size,
- 			.ia_valid = ATTR_SIZE | ATTR_CTIME,
- 		};
- 
-@@ -976,21 +976,13 @@ int reiserfs_permission(struct inode *inode, int mask)
- 	return generic_permission(inode, mask, NULL);
- }
- 
--/* This will catch lookups from the fs root to .reiserfs_priv */
--static int
--xattr_lookup_poison(struct dentry *dentry, struct qstr *q1, struct qstr *name)
-+static int xattr_hide_revalidate(struct dentry *dentry, struct nameidata *nd)
- {
--	struct dentry *priv_root = REISERFS_SB(dentry->d_sb)->priv_root;
--	if (container_of(q1, struct dentry, d_name) == priv_root)
--		return -ENOENT;
--	if (q1->len == name->len &&
--		   !memcmp(q1->name, name->name, name->len))
--		return 0;
--	return 1;
-+	return -EPERM;
- }
- 
- static const struct dentry_operations xattr_lookup_poison_ops = {
--	.d_compare = xattr_lookup_poison,
-+	.d_revalidate = xattr_hide_revalidate,
- };
- 
- int reiserfs_lookup_privroot(struct super_block *s)
-@@ -1004,8 +996,7 @@ int reiserfs_lookup_privroot(struct super_block *s)
- 				strlen(PRIVROOT_NAME));
- 	if (!IS_ERR(dentry)) {
- 		REISERFS_SB(s)->priv_root = dentry;
--		if (!reiserfs_expose_privroot(s))
--			s->s_root->d_op = &xattr_lookup_poison_ops;
-+		dentry->d_op = &xattr_lookup_poison_ops;
- 		if (dentry->d_inode)
- 			dentry->d_inode->i_flags |= S_PRIVATE;
- 	} else
-diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
-index 77414db..146d491 100644
---- a/fs/xfs/linux-2.6/xfs_super.c
-+++ b/fs/xfs/linux-2.6/xfs_super.c
-@@ -1160,6 +1160,7 @@ xfs_fs_put_super(
- 
- 	xfs_unmountfs(mp);
- 	xfs_freesb(mp);
-+	xfs_inode_shrinker_unregister(mp);
- 	xfs_icsb_destroy_counters(mp);
- 	xfs_close_devices(mp);
- 	xfs_dmops_put(mp);
-@@ -1523,6 +1524,8 @@ xfs_fs_fill_super(
- 	if (error)
- 		goto fail_vnrele;
- 
-+	xfs_inode_shrinker_register(mp);
-+
- 	kfree(mtpt);
- 	return 0;
- 
-@@ -1767,6 +1770,7 @@ init_xfs_fs(void)
- 		goto out_cleanup_procfs;
- 
- 	vfs_initquota();
-+	xfs_inode_shrinker_init();
- 
- 	error = register_filesystem(&xfs_fs_type);
- 	if (error)
-@@ -1794,6 +1798,7 @@ exit_xfs_fs(void)
- {
- 	vfs_exitquota();
- 	unregister_filesystem(&xfs_fs_type);
-+	xfs_inode_shrinker_destroy();
- 	xfs_sysctl_unregister();
- 	xfs_cleanup_procfs();
- 	xfs_buf_terminate();
-diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
-index 6b6b394..57adf2d 100644
---- a/fs/xfs/linux-2.6/xfs_sync.c
-+++ b/fs/xfs/linux-2.6/xfs_sync.c
-@@ -95,7 +95,8 @@ xfs_inode_ag_walk(
- 					   struct xfs_perag *pag, int flags),
- 	int			flags,
- 	int			tag,
--	int			exclusive)
-+	int			exclusive,
-+	int			*nr_to_scan)
- {
- 	struct xfs_perag	*pag = &mp->m_perag[ag];
- 	uint32_t		first_index;
-@@ -135,7 +136,7 @@ restart:
- 		if (error == EFSCORRUPTED)
- 			break;
- 
--	} while (1);
-+	} while ((*nr_to_scan)--);
- 
- 	if (skipped) {
- 		delay(1);
-@@ -153,23 +154,30 @@ xfs_inode_ag_iterator(
- 					   struct xfs_perag *pag, int flags),
- 	int			flags,
- 	int			tag,
--	int			exclusive)
-+	int			exclusive,
-+	int			*nr_to_scan)
- {
- 	int			error = 0;
- 	int			last_error = 0;
- 	xfs_agnumber_t		ag;
-+	int			nr;
- 
-+	nr = nr_to_scan ? *nr_to_scan : INT_MAX;
- 	for (ag = 0; ag < mp->m_sb.sb_agcount; ag++) {
- 		if (!mp->m_perag[ag].pag_ici_init)
- 			continue;
- 		error = xfs_inode_ag_walk(mp, ag, execute, flags, tag,
--						exclusive);
-+						exclusive, &nr);
- 		if (error) {
- 			last_error = error;
- 			if (error == EFSCORRUPTED)
- 				break;
- 		}
-+		if (nr <= 0)
-+			break;
- 	}
-+	if (nr_to_scan)
-+		*nr_to_scan = nr;
- 	return XFS_ERROR(last_error);
- }
- 
-@@ -289,7 +297,7 @@ xfs_sync_data(
- 	ASSERT((flags & ~(SYNC_TRYLOCK|SYNC_WAIT)) == 0);
- 
- 	error = xfs_inode_ag_iterator(mp, xfs_sync_inode_data, flags,
--				      XFS_ICI_NO_TAG, 0);
-+				      XFS_ICI_NO_TAG, 0, NULL);
- 	if (error)
- 		return XFS_ERROR(error);
- 
-@@ -311,7 +319,7 @@ xfs_sync_attr(
- 	ASSERT((flags & ~SYNC_WAIT) == 0);
- 
- 	return xfs_inode_ag_iterator(mp, xfs_sync_inode_attr, flags,
--				     XFS_ICI_NO_TAG, 0);
-+				     XFS_ICI_NO_TAG, 0, NULL);
- }
- 
- STATIC int
-@@ -679,6 +687,7 @@ __xfs_inode_set_reclaim_tag(
- 	radix_tree_tag_set(&pag->pag_ici_root,
- 			   XFS_INO_TO_AGINO(ip->i_mount, ip->i_ino),
- 			   XFS_ICI_RECLAIM_TAG);
-+	pag->pag_ici_reclaimable++;
- }
- 
- /*
-@@ -710,6 +719,7 @@ __xfs_inode_clear_reclaim_tag(
- {
- 	radix_tree_tag_clear(&pag->pag_ici_root,
- 			XFS_INO_TO_AGINO(mp, ip->i_ino), XFS_ICI_RECLAIM_TAG);
-+	pag->pag_ici_reclaimable--;
- }
- 
- STATIC int
-@@ -770,5 +780,88 @@ xfs_reclaim_inodes(
- 	int		mode)
- {
- 	return xfs_inode_ag_iterator(mp, xfs_reclaim_inode, mode,
--					XFS_ICI_RECLAIM_TAG, 1);
-+					XFS_ICI_RECLAIM_TAG, 1, NULL);
-+}
-+
-+/*
-+ * Shrinker infrastructure.
-+ *
-+ * This is all far more complex than it needs to be. It adds a global list of
-+ * mounts because the shrinkers can only call a global context. We need to make
-+ * the shrinkers pass a context to avoid the need for global state.
-+ */
-+static LIST_HEAD(xfs_mount_list);
-+static struct rw_semaphore xfs_mount_list_lock;
-+
-+static int
-+xfs_reclaim_inode_shrink(
-+	int		nr_to_scan,
-+	gfp_t		gfp_mask)
-+{
-+	struct xfs_mount *mp;
-+	xfs_agnumber_t	ag;
-+	int		reclaimable = 0;
-+
-+	if (nr_to_scan) {
-+		if (!(gfp_mask & __GFP_FS))
-+			return -1;
-+
-+		down_read(&xfs_mount_list_lock);
-+		list_for_each_entry(mp, &xfs_mount_list, m_mplist) {
-+			xfs_inode_ag_iterator(mp, xfs_reclaim_inode, 0,
-+					XFS_ICI_RECLAIM_TAG, 1, &nr_to_scan);
-+			if (nr_to_scan <= 0)
-+				break;
-+		}
-+		up_read(&xfs_mount_list_lock);
-+	}
-+
-+	down_read(&xfs_mount_list_lock);
-+	list_for_each_entry(mp, &xfs_mount_list, m_mplist) {
-+		for (ag = 0; ag < mp->m_sb.sb_agcount; ag++) {
-+
-+			if (!mp->m_perag[ag].pag_ici_init)
-+				continue;
-+			reclaimable += mp->m_perag[ag].pag_ici_reclaimable;
-+		}
-+	}
-+	up_read(&xfs_mount_list_lock);
-+	return reclaimable;
-+}
-+
-+static struct shrinker xfs_inode_shrinker = {
-+	.shrink = xfs_reclaim_inode_shrink,
-+	.seeks = DEFAULT_SEEKS,
-+};
-+
-+void __init
-+xfs_inode_shrinker_init(void)
-+{
-+	init_rwsem(&xfs_mount_list_lock);
-+	register_shrinker(&xfs_inode_shrinker);
-+}
-+
-+void
-+xfs_inode_shrinker_destroy(void)
-+{
-+	ASSERT(list_empty(&xfs_mount_list));
-+	unregister_shrinker(&xfs_inode_shrinker);
-+}
-+
-+void
-+xfs_inode_shrinker_register(
-+	struct xfs_mount	*mp)
-+{
-+	down_write(&xfs_mount_list_lock);
-+	list_add_tail(&mp->m_mplist, &xfs_mount_list);
-+	up_write(&xfs_mount_list_lock);
-+}
-+
-+void
-+xfs_inode_shrinker_unregister(
-+	struct xfs_mount	*mp)
-+{
-+	down_write(&xfs_mount_list_lock);
-+	list_del(&mp->m_mplist);
-+	up_write(&xfs_mount_list_lock);
- }
-diff --git a/fs/xfs/linux-2.6/xfs_sync.h b/fs/xfs/linux-2.6/xfs_sync.h
-index ea932b4..0b28c13 100644
---- a/fs/xfs/linux-2.6/xfs_sync.h
-+++ b/fs/xfs/linux-2.6/xfs_sync.h
-@@ -54,6 +54,11 @@ void __xfs_inode_clear_reclaim_tag(struct xfs_mount *mp, struct xfs_perag *pag,
- int xfs_sync_inode_valid(struct xfs_inode *ip, struct xfs_perag *pag);
- int xfs_inode_ag_iterator(struct xfs_mount *mp,
- 	int (*execute)(struct xfs_inode *ip, struct xfs_perag *pag, int flags),
--	int flags, int tag, int write_lock);
-+	int flags, int tag, int write_lock, int *nr_to_scan);
-+
-+void xfs_inode_shrinker_init(void);
-+void xfs_inode_shrinker_destroy(void);
-+void xfs_inode_shrinker_register(struct xfs_mount *mp);
-+void xfs_inode_shrinker_unregister(struct xfs_mount *mp);
- 
- #endif
-diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
-index 873e07e..145f596 100644
---- a/fs/xfs/quota/xfs_qm_syscalls.c
-+++ b/fs/xfs/quota/xfs_qm_syscalls.c
-@@ -891,7 +891,8 @@ xfs_qm_dqrele_all_inodes(
- 	uint		 flags)
- {
- 	ASSERT(mp->m_quotainfo);
--	xfs_inode_ag_iterator(mp, xfs_dqrele_inode, flags, XFS_ICI_NO_TAG, 0);
-+	xfs_inode_ag_iterator(mp, xfs_dqrele_inode, flags,
-+				XFS_ICI_NO_TAG, 0, NULL);
- }
- 
- /*------------------------------------------------------------------------*/
-diff --git a/fs/xfs/xfs_ag.h b/fs/xfs/xfs_ag.h
-index 6702bd8..1182604 100644
---- a/fs/xfs/xfs_ag.h
-+++ b/fs/xfs/xfs_ag.h
-@@ -229,6 +229,7 @@ typedef struct xfs_perag
- 	int		pag_ici_init;	/* incore inode cache initialised */
- 	rwlock_t	pag_ici_lock;	/* incore inode lock */
- 	struct radix_tree_root pag_ici_root;	/* incore inode cache root */
-+	int		pag_ici_reclaimable;	/* reclaimable inodes */
- #endif
- } xfs_perag_t;
- 
-diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
-index 1df7e45..c95f81a 100644
---- a/fs/xfs/xfs_mount.h
-+++ b/fs/xfs/xfs_mount.h
-@@ -257,6 +257,7 @@ typedef struct xfs_mount {
- 	wait_queue_head_t	m_wait_single_sync_task;
- 	__int64_t		m_update_flags;	/* sb flags we need to update
- 						   on the next remount,rw */
-+	struct list_head	m_mplist;	/* inode shrinker mount list */
- } xfs_mount_t;
- 
- /*
-diff --git a/include/linux/ata.h b/include/linux/ata.h
-index 20f3156..f8bd0f9 100644
---- a/include/linux/ata.h
-+++ b/include/linux/ata.h
-@@ -1024,8 +1024,8 @@ static inline int ata_ok(u8 status)
- 
- static inline int lba_28_ok(u64 block, u32 n_block)
- {
--	/* check the ending block number */
--	return ((block + n_block) < ((u64)1 << 28)) && (n_block <= 256);
-+	/* check the ending block number: must be LESS THAN 0x0fffffff */
-+	return ((block + n_block) < ((1 << 28) - 1)) && (n_block <= 256);
- }
- 
- static inline int lba_48_ok(u64 block, u32 n_block)
-diff --git a/include/linux/poison.h b/include/linux/poison.h
-index 2110a81..34066ff 100644
---- a/include/linux/poison.h
-+++ b/include/linux/poison.h
-@@ -48,6 +48,15 @@
- #define POISON_FREE	0x6b	/* for use-after-free poisoning */
- #define	POISON_END	0xa5	/* end-byte of poisoning */
- 
-+/********** mm/hugetlb.c **********/
-+/*
-+ * Private mappings of hugetlb pages use this poisoned value for
-+ * page->mapping. The core VM should not be doing anything with this mapping
-+ * but futex requires the existence of some page->mapping value even though it
-+ * is unused if PAGE_MAPPING_ANON is set.
-+ */
-+#define HUGETLB_POISON	((void *)(0x00300300 + POISON_POINTER_DELTA + PAGE_MAPPING_ANON))
-+
- /********** arch/$ARCH/mm/init.c **********/
- #define POISON_FREE_INITMEM	0xcc
- 
-diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
-index 8be5135..2c55a7e 100644
---- a/include/net/sctp/command.h
-+++ b/include/net/sctp/command.h
-@@ -107,6 +107,7 @@ typedef enum {
- 	SCTP_CMD_T1_RETRAN,	 /* Mark for retransmission after T1 timeout  */
- 	SCTP_CMD_UPDATE_INITTAG, /* Update peer inittag */
- 	SCTP_CMD_SEND_MSG,	 /* Send the whole use message */
-+	SCTP_CMD_SEND_NEXT_ASCONF, /* Send the next ASCONF after ACK */
- 	SCTP_CMD_LAST
- } sctp_verb_t;
- 
-diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
-index 78740ec..fa6cde5 100644
---- a/include/net/sctp/sctp.h
-+++ b/include/net/sctp/sctp.h
-@@ -128,6 +128,7 @@ extern int sctp_register_pf(struct sctp_pf *, sa_family_t);
- int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb);
- int sctp_inet_listen(struct socket *sock, int backlog);
- void sctp_write_space(struct sock *sk);
-+void sctp_data_ready(struct sock *sk, int len);
- unsigned int sctp_poll(struct file *file, struct socket *sock,
- 		poll_table *wait);
- void sctp_sock_rfree(struct sk_buff *skb);
-diff --git a/init/initramfs.c b/init/initramfs.c
-index b37d34b..b27d045 100644
---- a/init/initramfs.c
-+++ b/init/initramfs.c
-@@ -457,7 +457,8 @@ static char * __init unpack_to_rootfs(char *buf, unsigned len)
- 					 compress_name);
- 				message = msg_buf;
- 			}
--		}
-+		} else
-+			error("junk in compressed archive");
- 		if (state != Reset)
- 			error("junk in compressed archive");
- 		this_header = saved_offset + my_inptr;
-diff --git a/kernel/cred.c b/kernel/cred.c
-index 1ed8ca1..099f5e6 100644
---- a/kernel/cred.c
-+++ b/kernel/cred.c
-@@ -786,8 +786,6 @@ bool creds_are_invalid(const struct cred *cred)
- {
- 	if (cred->magic != CRED_MAGIC)
- 		return true;
--	if (atomic_read(&cred->usage) < atomic_read(&cred->subscribers))
--		return true;
- #ifdef CONFIG_SECURITY_SELINUX
- 	if (selinux_is_enabled()) {
- 		if ((unsigned long) cred->security < PAGE_SIZE)
-diff --git a/kernel/perf_event.c b/kernel/perf_event.c
-index 32d0ae2..e928e1a 100644
---- a/kernel/perf_event.c
-+++ b/kernel/perf_event.c
-@@ -4811,7 +4811,7 @@ err_fput_free_put_context:
- 
- err_free_put_context:
- 	if (err < 0)
--		kfree(event);
-+		free_event(event);
- 
- err_put_context:
- 	if (err < 0)
-diff --git a/lib/flex_array.c b/lib/flex_array.c
-index 66eef2e..41b1804 100644
---- a/lib/flex_array.c
-+++ b/lib/flex_array.c
-@@ -99,7 +99,7 @@ struct flex_array *flex_array_alloc(int element_size, unsigned int total,
- 	ret->element_size = element_size;
- 	ret->total_nr_elements = total;
- 	if (elements_fit_in_base(ret) && !(flags & __GFP_ZERO))
--		memset(ret->parts[0], FLEX_ARRAY_FREE,
-+		memset(&ret->parts[0], FLEX_ARRAY_FREE,
- 						FLEX_ARRAY_BASE_BYTES_LEFT);
- 	return ret;
- }
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 2d16fa6..fd9ba95 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -546,6 +546,7 @@ static void free_huge_page(struct page *page)
- 
- 	mapping = (struct address_space *) page_private(page);
- 	set_page_private(page, 0);
-+	page->mapping = NULL;
- 	BUG_ON(page_count(page));
- 	INIT_LIST_HEAD(&page->lru);
- 
-@@ -2447,8 +2448,10 @@ retry:
- 			spin_lock(&inode->i_lock);
- 			inode->i_blocks += blocks_per_huge_page(h);
- 			spin_unlock(&inode->i_lock);
--		} else
-+		} else {
- 			lock_page(page);
-+			page->mapping = HUGETLB_POISON;
-+		}
- 	}
- 
- 	/*
-diff --git a/mm/memcontrol.c b/mm/memcontrol.c
-index 954032b..dff3379 100644
---- a/mm/memcontrol.c
-+++ b/mm/memcontrol.c
-@@ -2215,12 +2215,12 @@ int mem_cgroup_prepare_migration(struct page *page, struct mem_cgroup **ptr)
- 	}
- 	unlock_page_cgroup(pc);
- 
-+	*ptr = mem;
- 	if (mem) {
--		ret = __mem_cgroup_try_charge(NULL, GFP_KERNEL, &mem, false,
-+		ret = __mem_cgroup_try_charge(NULL, GFP_KERNEL, ptr, false,
- 						page);
- 		css_put(&mem->css);
- 	}
--	*ptr = mem;
- 	return ret;
- }
- 
-diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
-index bad1c49..72340dd 100644
---- a/net/ieee802154/af_ieee802154.c
-+++ b/net/ieee802154/af_ieee802154.c
-@@ -147,6 +147,9 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
- 	dev_load(sock_net(sk), ifr.ifr_name);
- 	dev = dev_get_by_name(sock_net(sk), ifr.ifr_name);
- 
-+	if (!dev)
-+		return -ENODEV;
-+
- 	if (dev->type == ARPHRD_IEEE802154 && dev->netdev_ops->ndo_do_ioctl)
- 		ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, cmd);
- 
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index 564a0f8..03c55ac 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -1368,6 +1368,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
- 		sk_eat_skb(sk, skb, 0);
- 		if (!desc->count)
- 			break;
-+		tp->copied_seq = seq;
- 	}
- 	tp->copied_seq = seq;
- 
-diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 112c611..16190ca 100644
---- a/net/ipv4/udp.c
-+++ b/net/ipv4/udp.c
-@@ -471,8 +471,8 @@ static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
- 			if (hslot->count < hslot2->count)
- 				goto begin;
- 
--			result = udp4_lib_lookup2(net, INADDR_ANY, sport,
--						  daddr, hnum, dif,
-+			result = udp4_lib_lookup2(net, saddr, sport,
-+						  INADDR_ANY, hnum, dif,
- 						  hslot2, slot2);
- 		}
- 		rcu_read_unlock();
-diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 548a06e..d2ef3a3 100644
---- a/net/ipv6/tcp_ipv6.c
-+++ b/net/ipv6/tcp_ipv6.c
-@@ -1006,7 +1006,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
- 	skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
- 
- 	t1 = (struct tcphdr *) skb_push(buff, tot_len);
--	skb_reset_transport_header(skb);
-+	skb_reset_transport_header(buff);
- 
- 	/* Swap the send and the receive. */
- 	memset(t1, 0, sizeof(*t1));
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index d9714d2..4f57cd2 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -258,8 +258,8 @@ static struct sock *__udp6_lib_lookup(struct net *net,
- 			if (hslot->count < hslot2->count)
- 				goto begin;
- 
--			result = udp6_lib_lookup2(net, &in6addr_any, sport,
--						  daddr, hnum, dif,
-+			result = udp6_lib_lookup2(net, saddr, sport,
-+						  &in6addr_any, hnum, dif,
- 						  hslot2, slot2);
- 		}
- 		rcu_read_unlock();
-diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
-index 304b0b6..dfdc138 100644
---- a/net/mac80211/agg-tx.c
-+++ b/net/mac80211/agg-tx.c
-@@ -183,7 +183,6 @@ static void sta_addba_resp_timer_expired(unsigned long data)
- 		       HT_AGG_STATE_REQ_STOP_BA_MSK)) !=
- 						HT_ADDBA_REQUESTED_MSK) {
- 		spin_unlock_bh(&sta->lock);
--		*state = HT_AGG_STATE_IDLE;
- #ifdef CONFIG_MAC80211_HT_DEBUG
- 		printk(KERN_DEBUG "timer expired on tid %d but we are not "
- 				"(or no longer) expecting addBA response there",
-diff --git a/net/sctp/associola.c b/net/sctp/associola.c
-index df5abbf..99c93ee 100644
---- a/net/sctp/associola.c
-+++ b/net/sctp/associola.c
-@@ -1194,8 +1194,10 @@ void sctp_assoc_update(struct sctp_association *asoc,
- 	/* Remove any peer addresses not present in the new association. */
- 	list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
- 		trans = list_entry(pos, struct sctp_transport, transports);
--		if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr))
--			sctp_assoc_del_peer(asoc, &trans->ipaddr);
-+		if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr)) {
-+			sctp_assoc_rm_peer(asoc, trans);
-+			continue;
-+		}
- 
- 		if (asoc->state >= SCTP_STATE_ESTABLISHED)
- 			sctp_transport_reset(trans);
-diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
-index 905fda5..7ec09ba 100644
---- a/net/sctp/endpointola.c
-+++ b/net/sctp/endpointola.c
-@@ -144,6 +144,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
- 	/* Use SCTP specific send buffer space queues.  */
- 	ep->sndbuf_policy = sctp_sndbuf_policy;
- 
-+	sk->sk_data_ready = sctp_data_ready;
- 	sk->sk_write_space = sctp_write_space;
- 	sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
- 
-diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
-index 9e73291..224db01 100644
---- a/net/sctp/sm_make_chunk.c
-+++ b/net/sctp/sm_make_chunk.c
-@@ -207,7 +207,8 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
- 	sp = sctp_sk(asoc->base.sk);
- 	num_types = sp->pf->supported_addrs(sp, types);
- 
--	chunksize = sizeof(init) + addrs_len + SCTP_SAT_LEN(num_types);
-+	chunksize = sizeof(init) + addrs_len;
-+	chunksize += WORD_ROUND(SCTP_SAT_LEN(num_types));
- 	chunksize += sizeof(ecap_param);
- 
- 	if (sctp_prsctp_enable)
-@@ -237,14 +238,14 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
- 		/* Add HMACS parameter length if any were defined */
- 		auth_hmacs = (sctp_paramhdr_t *)asoc->c.auth_hmacs;
- 		if (auth_hmacs->length)
--			chunksize += ntohs(auth_hmacs->length);
-+			chunksize += WORD_ROUND(ntohs(auth_hmacs->length));
- 		else
- 			auth_hmacs = NULL;
- 
- 		/* Add CHUNKS parameter length */
- 		auth_chunks = (sctp_paramhdr_t *)asoc->c.auth_chunks;
- 		if (auth_chunks->length)
--			chunksize += ntohs(auth_chunks->length);
-+			chunksize += WORD_ROUND(ntohs(auth_chunks->length));
- 		else
- 			auth_chunks = NULL;
- 
-@@ -254,7 +255,8 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
- 
- 	/* If we have any extensions to report, account for that */
- 	if (num_ext)
--		chunksize += sizeof(sctp_supported_ext_param_t) + num_ext;
-+		chunksize += WORD_ROUND(sizeof(sctp_supported_ext_param_t) +
-+					num_ext);
- 
- 	/* RFC 2960 3.3.2 Initiation (INIT) (1)
- 	 *
-@@ -396,13 +398,13 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
- 
- 		auth_hmacs = (sctp_paramhdr_t *)asoc->c.auth_hmacs;
- 		if (auth_hmacs->length)
--			chunksize += ntohs(auth_hmacs->length);
-+			chunksize += WORD_ROUND(ntohs(auth_hmacs->length));
- 		else
- 			auth_hmacs = NULL;
- 
- 		auth_chunks = (sctp_paramhdr_t *)asoc->c.auth_chunks;
- 		if (auth_chunks->length)
--			chunksize += ntohs(auth_chunks->length);
-+			chunksize += WORD_ROUND(ntohs(auth_chunks->length));
- 		else
- 			auth_chunks = NULL;
- 
-@@ -411,7 +413,8 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
- 	}
- 
- 	if (num_ext)
--		chunksize += sizeof(sctp_supported_ext_param_t) + num_ext;
-+		chunksize += WORD_ROUND(sizeof(sctp_supported_ext_param_t) +
-+					num_ext);
- 
- 	/* Now allocate and fill out the chunk.  */
- 	retval = sctp_make_chunk(asoc, SCTP_CID_INIT_ACK, 0, chunksize);
-@@ -3314,21 +3317,6 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
- 	sctp_chunk_free(asconf);
- 	asoc->addip_last_asconf = NULL;
- 
--	/* Send the next asconf chunk from the addip chunk queue. */
--	if (!list_empty(&asoc->addip_chunk_list)) {
--		struct list_head *entry = asoc->addip_chunk_list.next;
--		asconf = list_entry(entry, struct sctp_chunk, list);
--
--		list_del_init(entry);
--
--		/* Hold the chunk until an ASCONF_ACK is received. */
--		sctp_chunk_hold(asconf);
--		if (sctp_primitive_ASCONF(asoc, asconf))
--			sctp_chunk_free(asconf);
--		else
--			asoc->addip_last_asconf = asconf;
--	}
--
- 	return retval;
- }
- 
-diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
-index 4e4ca65..42bbb24 100644
---- a/net/sctp/sm_sideeffect.c
-+++ b/net/sctp/sm_sideeffect.c
-@@ -961,6 +961,29 @@ static int sctp_cmd_send_msg(struct sctp_association *asoc,
- }
- 
- 
-+/* Sent the next ASCONF packet currently stored in the association.
-+ * This happens after the ASCONF_ACK was succeffully processed.
-+ */
-+static void sctp_cmd_send_asconf(struct sctp_association *asoc)
-+{
-+	/* Send the next asconf chunk from the addip chunk
-+	 * queue.
-+	 */
-+	if (!list_empty(&asoc->addip_chunk_list)) {
-+		struct list_head *entry = asoc->addip_chunk_list.next;
-+		struct sctp_chunk *asconf = list_entry(entry,
-+						struct sctp_chunk, list);
-+		list_del_init(entry);
-+
-+		/* Hold the chunk until an ASCONF_ACK is received. */
-+		sctp_chunk_hold(asconf);
-+		if (sctp_primitive_ASCONF(asoc, asconf))
-+			sctp_chunk_free(asconf);
-+		else
-+			asoc->addip_last_asconf = asconf;
-+	}
-+}
-+
- 
- /* These three macros allow us to pull the debugging code out of the
-  * main flow of sctp_do_sm() to keep attention focused on the real
-@@ -1616,6 +1639,9 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
- 			}
- 			error = sctp_cmd_send_msg(asoc, cmd->obj.msg);
- 			break;
-+		case SCTP_CMD_SEND_NEXT_ASCONF:
-+			sctp_cmd_send_asconf(asoc);
-+			break;
- 		default:
- 			printk(KERN_WARNING "Impossible command: %u, %p\n",
- 			       cmd->verb, cmd->obj.ptr);
-diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
-index 47bc20d..c3f75e7 100644
---- a/net/sctp/sm_statefuns.c
-+++ b/net/sctp/sm_statefuns.c
-@@ -3675,8 +3675,14 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
- 				SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
- 
- 		if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
--					     asconf_ack))
-+					     asconf_ack)) {
-+			/* Successfully processed ASCONF_ACK.  We can
-+			 * release the next asconf if we have one.
-+			 */
-+			sctp_add_cmd_sf(commands, SCTP_CMD_SEND_NEXT_ASCONF,
-+					SCTP_NULL());
- 			return SCTP_DISPOSITION_CONSUME;
-+		}
- 
- 		abort = sctp_make_abort(asoc, asconf_ack,
- 					sizeof(sctp_errhdr_t));
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 9bd9d82..aa3ba60 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -3718,12 +3718,12 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
- 	sp->hmac = NULL;
- 
- 	SCTP_DBG_OBJCNT_INC(sock);
--	percpu_counter_inc(&sctp_sockets_allocated);
- 
- 	/* Set socket backlog limit. */
- 	sk->sk_backlog.limit = sysctl_sctp_rmem[1];
- 
- 	local_bh_disable();
-+	percpu_counter_inc(&sctp_sockets_allocated);
- 	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
- 	local_bh_enable();
- 
-@@ -3740,8 +3740,8 @@ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
- 	/* Release our hold on the endpoint. */
- 	ep = sctp_sk(sk)->ep;
- 	sctp_endpoint_free(ep);
--	percpu_counter_dec(&sctp_sockets_allocated);
- 	local_bh_disable();
-+	percpu_counter_dec(&sctp_sockets_allocated);
- 	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
- 	local_bh_enable();
- }
-@@ -6188,6 +6188,16 @@ do_nonblock:
- 	goto out;
- }
- 
-+void sctp_data_ready(struct sock *sk, int len)
-+{
-+	read_lock_bh(&sk->sk_callback_lock);
-+	if (sk_has_sleeper(sk))
-+		wake_up_interruptible_sync_poll(sk->sk_sleep, POLLIN |
-+						POLLRDNORM | POLLRDBAND);
-+	sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
-+	read_unlock_bh(&sk->sk_callback_lock);
-+}
-+
- /* If socket sndbuf has changed, wake up all per association waiters.  */
- void sctp_write_space(struct sock *sk)
- {
-diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
-index 327011f..7809137 100644
---- a/net/tipc/bearer.c
-+++ b/net/tipc/bearer.c
-@@ -45,10 +45,10 @@
- 
- #define MAX_ADDR_STR 32
- 
--static struct media *media_list = NULL;
-+static struct media media_list[MAX_MEDIA];
- static u32 media_count = 0;
- 
--struct bearer *tipc_bearers = NULL;
-+struct bearer tipc_bearers[MAX_BEARERS];
- 
- /**
-  * media_name_valid - validate media name
-@@ -108,9 +108,11 @@ int  tipc_register_media(u32 media_type,
- 	int res = -EINVAL;
- 
- 	write_lock_bh(&tipc_net_lock);
--	if (!media_list)
--		goto exit;
- 
-+	if (tipc_mode != TIPC_NET_MODE) {
-+		warn("Media <%s> rejected, not in networked mode yet\n", name);
-+		goto exit;
-+	}
- 	if (!media_name_valid(name)) {
- 		warn("Media <%s> rejected, illegal name\n", name);
- 		goto exit;
-@@ -660,33 +662,10 @@ int tipc_disable_bearer(const char *name)
- 
- 
- 
--int tipc_bearer_init(void)
--{
--	int res;
--
--	write_lock_bh(&tipc_net_lock);
--	tipc_bearers = kcalloc(MAX_BEARERS, sizeof(struct bearer), GFP_ATOMIC);
--	media_list = kcalloc(MAX_MEDIA, sizeof(struct media), GFP_ATOMIC);
--	if (tipc_bearers && media_list) {
--		res = 0;
--	} else {
--		kfree(tipc_bearers);
--		kfree(media_list);
--		tipc_bearers = NULL;
--		media_list = NULL;
--		res = -ENOMEM;
--	}
--	write_unlock_bh(&tipc_net_lock);
--	return res;
--}
--
- void tipc_bearer_stop(void)
- {
- 	u32 i;
- 
--	if (!tipc_bearers)
--		return;
--
- 	for (i = 0; i < MAX_BEARERS; i++) {
- 		if (tipc_bearers[i].active)
- 			tipc_bearers[i].publ.blocked = 1;
-@@ -695,10 +674,6 @@ void tipc_bearer_stop(void)
- 		if (tipc_bearers[i].active)
- 			bearer_disable(tipc_bearers[i].publ.name);
- 	}
--	kfree(tipc_bearers);
--	kfree(media_list);
--	tipc_bearers = NULL;
--	media_list = NULL;
- 	media_count = 0;
- }
- 
-diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
-index ca57348..000228e 100644
---- a/net/tipc/bearer.h
-+++ b/net/tipc/bearer.h
-@@ -114,7 +114,7 @@ struct bearer_name {
- 
- struct link;
- 
--extern struct bearer *tipc_bearers;
-+extern struct bearer tipc_bearers[];
- 
- void tipc_media_addr_printf(struct print_buf *pb, struct tipc_media_addr *a);
- struct sk_buff *tipc_media_get_names(void);
-diff --git a/net/tipc/net.c b/net/tipc/net.c
-index 7906608..f25b1cd 100644
---- a/net/tipc/net.c
-+++ b/net/tipc/net.c
-@@ -116,7 +116,8 @@
- */
- 
- DEFINE_RWLOCK(tipc_net_lock);
--struct network tipc_net = { NULL };
-+struct _zone *tipc_zones[256] = { NULL, };
-+struct network tipc_net = { tipc_zones };
- 
- struct tipc_node *tipc_net_select_remote_node(u32 addr, u32 ref)
- {
-@@ -158,28 +159,12 @@ void tipc_net_send_external_routes(u32 dest)
- 	}
- }
- 
--static int net_init(void)
--{
--	memset(&tipc_net, 0, sizeof(tipc_net));
--	tipc_net.zones = kcalloc(tipc_max_zones + 1, sizeof(struct _zone *), GFP_ATOMIC);
--	if (!tipc_net.zones) {
--		return -ENOMEM;
--	}
--	return 0;
--}
--
- static void net_stop(void)
- {
- 	u32 z_num;
- 
--	if (!tipc_net.zones)
--		return;
--
--	for (z_num = 1; z_num <= tipc_max_zones; z_num++) {
-+	for (z_num = 1; z_num <= tipc_max_zones; z_num++)
- 		tipc_zone_delete(tipc_net.zones[z_num]);
--	}
--	kfree(tipc_net.zones);
--	tipc_net.zones = NULL;
- }
- 
- static void net_route_named_msg(struct sk_buff *buf)
-@@ -282,9 +267,7 @@ int tipc_net_start(u32 addr)
- 	tipc_named_reinit();
- 	tipc_port_reinit();
- 
--	if ((res = tipc_bearer_init()) ||
--	    (res = net_init()) ||
--	    (res = tipc_cltr_init()) ||
-+	if ((res = tipc_cltr_init()) ||
- 	    (res = tipc_bclink_init())) {
- 		return res;
- 	}
-diff --git a/security/inode.c b/security/inode.c
-index c3a7938..1c812e8 100644
---- a/security/inode.c
-+++ b/security/inode.c
-@@ -161,13 +161,13 @@ static int create_by_name(const char *name, mode_t mode,
- 
- 	mutex_lock(&parent->d_inode->i_mutex);
- 	*dentry = lookup_one_len(name, parent, strlen(name));
--	if (!IS_ERR(dentry)) {
-+	if (!IS_ERR(*dentry)) {
- 		if ((mode & S_IFMT) == S_IFDIR)
- 			error = mkdir(parent->d_inode, *dentry, mode);
- 		else
- 			error = create(parent->d_inode, *dentry, mode);
- 	} else
--		error = PTR_ERR(dentry);
-+		error = PTR_ERR(*dentry);
- 	mutex_unlock(&parent->d_inode->i_mutex);
- 
- 	return error;
-diff --git a/security/keys/request_key.c b/security/keys/request_key.c
-index 03fe63e..9ac7bfd 100644
---- a/security/keys/request_key.c
-+++ b/security/keys/request_key.c
-@@ -336,8 +336,10 @@ static int construct_alloc_key(struct key_type *type,
- 
- key_already_present:
- 	mutex_unlock(&key_construction_mutex);
--	if (dest_keyring)
-+	if (dest_keyring) {
-+		__key_link(dest_keyring, key_ref_to_ptr(key_ref));
- 		up_write(&dest_keyring->sem);
-+	}
- 	mutex_unlock(&user->cons_lock);
- 	key_put(key);
- 	*_key = key = key_ref_to_ptr(key_ref);
-@@ -428,6 +430,11 @@ struct key *request_key_and_link(struct key_type *type,
- 
- 	if (!IS_ERR(key_ref)) {
- 		key = key_ref_to_ptr(key_ref);
-+		if (dest_keyring) {
-+			construct_get_dest_keyring(&dest_keyring);
-+			key_link(dest_keyring, key);
-+			key_put(dest_keyring);
-+		}
- 	} else if (PTR_ERR(key_ref) != -EAGAIN) {
- 		key = ERR_CAST(key_ref);
- 	} else  {
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index 062a8b0..fd831bd 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -2273,6 +2273,7 @@ static struct snd_pci_quirk position_fix_list[] __devinitdata = {
- 	SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB),
- 	SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB),
- 	SND_PCI_QUIRK(0x1565, 0x8218, "Biostar Microtech", POS_FIX_LPIB),
-+	SND_PCI_QUIRK(0x8086, 0x2503, "DG965OT AAD63733-203", POS_FIX_LPIB),
- 	SND_PCI_QUIRK(0x8086, 0xd601, "eMachines T5212", POS_FIX_LPIB),
- 	{}
- };
-diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
-index 71b7a96..1a97c81 100644
---- a/sound/pci/hda/patch_conexant.c
-+++ b/sound/pci/hda/patch_conexant.c
-@@ -1174,9 +1174,10 @@ static int patch_cxt5045(struct hda_codec *codec)
- 
- 	switch (codec->subsystem_id >> 16) {
- 	case 0x103c:
-+	case 0x1631:
- 	case 0x1734:
--		/* HP & Fujitsu-Siemens laptops have really bad sound over 0dB
--		 * on NID 0x17. Fix max PCM level to 0 dB
-+		/* HP, Packard Bell, & Fujitsu-Siemens laptops have really bad
-+		 * sound over 0dB on NID 0x17. Fix max PCM level to 0 dB
- 		 * (originally it has 0x2b steps with 0dB offset 0x14)
- 		 */
- 		snd_hda_override_amp_caps(codec, 0x17, HDA_INPUT,
-@@ -2471,6 +2472,8 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
- 		      CXT5066_DELL_LAPTOP),
- 	SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT5066_OLPC_XO_1_5),
- 	SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTO),
-+	SND_PCI_QUIRK(0x1179, 0xff50, "Toshiba Satellite P500-PSPGSC-01800T", CXT5066_OLPC_XO_1_5),
-+	SND_PCI_QUIRK(0x1179, 0xffe0, "Toshiba Satellite Pro T130-15F", CXT5066_OLPC_XO_1_5),
- 	{}
- };
- 
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index bd8a567..b486daa 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -4033,7 +4033,7 @@ static struct snd_pci_quirk alc880_cfg_tbl[] = {
- 	SND_PCI_QUIRK(0x1695, 0x4012, "EPox EP-5LDA", ALC880_5ST_DIG),
- 	SND_PCI_QUIRK(0x1734, 0x107c, "FSC F1734", ALC880_F1734),
- 	SND_PCI_QUIRK(0x1734, 0x1094, "FSC Amilo M1451G", ALC880_FUJITSU),
--	SND_PCI_QUIRK(0x1734, 0x10ac, "FSC", ALC880_UNIWILL),
-+	SND_PCI_QUIRK(0x1734, 0x10ac, "FSC AMILO Xi 1526", ALC880_F1734),
- 	SND_PCI_QUIRK(0x1734, 0x10b0, "Fujitsu", ALC880_FUJITSU),
- 	SND_PCI_QUIRK(0x1854, 0x0018, "LG LW20", ALC880_LG_LW),
- 	SND_PCI_QUIRK(0x1854, 0x003b, "LG", ALC880_LG),
-diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
-index 799ba25..ac2d528 100644
---- a/sound/pci/hda/patch_sigmatel.c
-+++ b/sound/pci/hda/patch_sigmatel.c
-@@ -1602,6 +1602,10 @@ static struct snd_pci_quirk stac92hd73xx_cfg_tbl[] = {
- 				"Dell Studio 1555", STAC_DELL_M6_DMIC),
- 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02bd,
- 				"Dell Studio 1557", STAC_DELL_M6_DMIC),
-+	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02fe,
-+				"Dell Studio XPS 1645", STAC_DELL_M6_BOTH),
-+	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0413,
-+				"Dell Studio 1558", STAC_DELL_M6_BOTH),
- 	{} /* terminator */
- };
- 
-@@ -1725,6 +1729,8 @@ static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = {
- 		      "HP HDX", STAC_HP_HDX),  /* HDX16 */
- 	SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x3620,
- 		      "HP dv6", STAC_HP_DV5),
-+	SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3061,
-+		      "HP dv6", STAC_HP_DV5), /* HP dv6-1110ax */
- 	SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x7010,
- 		      "HP", STAC_HP_DV5),
- 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0233,
-diff --git a/sound/pci/maestro3.c b/sound/pci/maestro3.c
-index 75283fb..c2311f8 100644
---- a/sound/pci/maestro3.c
-+++ b/sound/pci/maestro3.c
-@@ -849,6 +849,7 @@ struct snd_m3 {
- 	struct snd_kcontrol *master_switch;
- 	struct snd_kcontrol *master_volume;
- 	struct tasklet_struct hwvol_tq;
-+	unsigned int in_suspend;
- 
- #ifdef CONFIG_PM
- 	u16 *suspend_mem;
-@@ -884,6 +885,7 @@ static struct pci_device_id snd_m3_ids[] = {
- MODULE_DEVICE_TABLE(pci, snd_m3_ids);
- 
- static struct snd_pci_quirk m3_amp_quirk_list[] __devinitdata = {
-+	SND_PCI_QUIRK(0x0E11, 0x0094, "Compaq Evo N600c", 0x0c),
- 	SND_PCI_QUIRK(0x10f7, 0x833e, "Panasonic CF-28", 0x0d),
- 	SND_PCI_QUIRK(0x10f7, 0x833d, "Panasonic CF-72", 0x0d),
- 	SND_PCI_QUIRK(0x1033, 0x80f1, "NEC LM800J/7", 0x03),
-@@ -1613,6 +1615,11 @@ static void snd_m3_update_hw_volume(unsigned long private_data)
- 	outb(0x88, chip->iobase + SHADOW_MIX_REG_MASTER);
- 	outb(0x88, chip->iobase + HW_VOL_COUNTER_MASTER);
- 
-+	/* Ignore spurious HV interrupts during suspend / resume, this avoids
-+	   mistaking them for a mute button press. */
-+	if (chip->in_suspend)
-+		return;
-+
- 	if (!chip->master_switch || !chip->master_volume)
- 		return;
- 
-@@ -2424,6 +2431,7 @@ static int m3_suspend(struct pci_dev *pci, pm_message_t state)
- 	if (chip->suspend_mem == NULL)
- 		return 0;
- 
-+	chip->in_suspend = 1;
- 	snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
- 	snd_pcm_suspend_all(chip->pcm);
- 	snd_ac97_suspend(chip->ac97);
-@@ -2497,6 +2505,7 @@ static int m3_resume(struct pci_dev *pci)
- 	snd_m3_hv_init(chip);
- 
- 	snd_power_change_state(card, SNDRV_CTL_POWER_D0);
-+	chip->in_suspend = 0;
- 	return 0;
- }
- #endif /* CONFIG_PM */

Added: genpatches-2.6/trunk/2.6.33/1003_linux-2.6.33.4.patch
===================================================================
--- genpatches-2.6/trunk/2.6.33/1003_linux-2.6.33.4.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.33/1003_linux-2.6.33.4.patch	2010-07-05 23:09:19 UTC (rev 1721)
@@ -0,0 +1,4010 @@
+diff --git a/arch/arm/mach-pxa/include/mach/colibri.h b/arch/arm/mach-pxa/include/mach/colibri.h
+index 811743c..5f2ba8d 100644
+--- a/arch/arm/mach-pxa/include/mach/colibri.h
++++ b/arch/arm/mach-pxa/include/mach/colibri.h
+@@ -2,6 +2,7 @@
+ #define _COLIBRI_H_
+ 
+ #include <net/ax88796.h>
++#include <mach/mfp.h>
+ 
+ /*
+  * common settings for all modules
+diff --git a/arch/mips/include/asm/mach-sibyte/war.h b/arch/mips/include/asm/mach-sibyte/war.h
+index 7950ef4..743385d 100644
+--- a/arch/mips/include/asm/mach-sibyte/war.h
++++ b/arch/mips/include/asm/mach-sibyte/war.h
+@@ -16,7 +16,11 @@
+ #if defined(CONFIG_SB1_PASS_1_WORKAROUNDS) || \
+     defined(CONFIG_SB1_PASS_2_WORKAROUNDS)
+ 
+-#define BCM1250_M3_WAR	1
++#ifndef __ASSEMBLY__
++extern int sb1250_m3_workaround_needed(void);
++#endif
++
++#define BCM1250_M3_WAR	sb1250_m3_workaround_needed()
+ #define SIBYTE_1956_WAR	1
+ 
+ #else
+diff --git a/arch/mips/sibyte/sb1250/setup.c b/arch/mips/sibyte/sb1250/setup.c
+index 0444da1..92da315 100644
+--- a/arch/mips/sibyte/sb1250/setup.c
++++ b/arch/mips/sibyte/sb1250/setup.c
+@@ -87,6 +87,21 @@ static int __init setup_bcm1250(void)
+ 	return ret;
+ }
+ 
++int sb1250_m3_workaround_needed(void)
++{
++	switch (soc_type) {
++	case K_SYS_SOC_TYPE_BCM1250:
++	case K_SYS_SOC_TYPE_BCM1250_ALT:
++	case K_SYS_SOC_TYPE_BCM1250_ALT2:
++	case K_SYS_SOC_TYPE_BCM1125:
++	case K_SYS_SOC_TYPE_BCM1125H:
++		return soc_pass < K_SYS_REVISION_BCM1250_C0;
++
++	default:
++		return 0;
++	}
++}
++
+ static int __init setup_bcm112x(void)
+ {
+ 	int ret = 0;
+diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
+index 9258074..567cd57 100644
+--- a/arch/powerpc/kernel/head_64.S
++++ b/arch/powerpc/kernel/head_64.S
+@@ -615,6 +615,17 @@ _GLOBAL(start_secondary_prolog)
+ 	std	r3,0(r1)		/* Zero the stack frame pointer	*/
+ 	bl	.start_secondary
+ 	b	.
++/*
++ * Reset stack pointer and call start_secondary
++ * to continue with online operation when woken up
++ * from cede in cpu offline.
++ */
++_GLOBAL(start_secondary_resume)
++	ld	r1,PACAKSAVE(r13)	/* Reload kernel stack pointer */
++	li	r3,0
++	std	r3,0(r1)		/* Zero the stack frame pointer	*/
++	bl	.start_secondary
++	b	.
+ #endif
+ 
+ /*
+diff --git a/arch/powerpc/mm/fsl_booke_mmu.c b/arch/powerpc/mm/fsl_booke_mmu.c
+index c539472..1ce9dd5 100644
+--- a/arch/powerpc/mm/fsl_booke_mmu.c
++++ b/arch/powerpc/mm/fsl_booke_mmu.c
+@@ -155,15 +155,10 @@ static void settlbcam(int index, unsigned long virt, phys_addr_t phys,
+ 	if (cur_cpu_spec->cpu_features & MMU_FTR_BIG_PHYS)
+ 		TLBCAM[index].MAS7 = (u64)phys >> 32;
+ 
+-#ifndef CONFIG_KGDB /* want user access for breakpoints */
+ 	if (flags & _PAGE_USER) {
+ 	   TLBCAM[index].MAS3 |= MAS3_UX | MAS3_UR;
+ 	   TLBCAM[index].MAS3 |= ((flags & _PAGE_RW) ? MAS3_UW : 0);
+ 	}
+-#else
+-	TLBCAM[index].MAS3 |= MAS3_UX | MAS3_UR;
+-	TLBCAM[index].MAS3 |= ((flags & _PAGE_RW) ? MAS3_UW : 0);
+-#endif
+ 
+ 	tlbcam_addrs[index].start = virt;
+ 	tlbcam_addrs[index].limit = virt + size - 1;
+diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+index 6ea4698..b842378 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -122,44 +122,32 @@ static void pseries_mach_cpu_die(void)
+ 		if (!get_lppaca()->shared_proc)
+ 			get_lppaca()->donate_dedicated_cpu = 1;
+ 
+-		printk(KERN_INFO
+-			"cpu %u (hwid %u) ceding for offline with hint %d\n",
+-			cpu, hwcpu, cede_latency_hint);
+ 		while (get_preferred_offline_state(cpu) == CPU_STATE_INACTIVE) {
+ 			extended_cede_processor(cede_latency_hint);
+-			printk(KERN_INFO "cpu %u (hwid %u) returned from cede.\n",
+-				cpu, hwcpu);
+-			printk(KERN_INFO
+-			"Decrementer value = %x Timebase value = %llx\n",
+-			get_dec(), get_tb());
+ 		}
+ 
+-		printk(KERN_INFO "cpu %u (hwid %u) got prodded to go online\n",
+-			cpu, hwcpu);
+-
+ 		if (!get_lppaca()->shared_proc)
+ 			get_lppaca()->donate_dedicated_cpu = 0;
+ 		get_lppaca()->idle = 0;
+-	}
+ 
+-	if (get_preferred_offline_state(cpu) == CPU_STATE_ONLINE) {
+-		unregister_slb_shadow(hwcpu, __pa(get_slb_shadow()));
++		if (get_preferred_offline_state(cpu) == CPU_STATE_ONLINE) {
++			unregister_slb_shadow(hwcpu, __pa(get_slb_shadow()));
+ 
+-		/*
+-		 * NOTE: Calling start_secondary() here for now to
+-		 * start new context.
+-		 * However, need to do it cleanly by resetting the
+-		 * stack pointer.
+-		 */
+-		start_secondary();
++			/*
++			 * Call to start_secondary_resume() will not return.
++			 * Kernel stack will be reset and start_secondary()
++			 * will be called to continue the online operation.
++			 */
++			start_secondary_resume();
++		}
++	}
+ 
+-	} else if (get_preferred_offline_state(cpu) == CPU_STATE_OFFLINE) {
++	/* Requested state is CPU_STATE_OFFLINE at this point */
++	WARN_ON(get_preferred_offline_state(cpu) != CPU_STATE_OFFLINE);
+ 
+-		set_cpu_current_state(cpu, CPU_STATE_OFFLINE);
+-		unregister_slb_shadow(hard_smp_processor_id(),
+-					__pa(get_slb_shadow()));
+-		rtas_stop_self();
+-	}
++	set_cpu_current_state(cpu, CPU_STATE_OFFLINE);
++	unregister_slb_shadow(hwcpu, __pa(get_slb_shadow()));
++	rtas_stop_self();
+ 
+ 	/* Should never get here... */
+ 	BUG();
+diff --git a/arch/powerpc/platforms/pseries/offline_states.h b/arch/powerpc/platforms/pseries/offline_states.h
+index 202d869..75a6f48 100644
+--- a/arch/powerpc/platforms/pseries/offline_states.h
++++ b/arch/powerpc/platforms/pseries/offline_states.h
+@@ -35,4 +35,5 @@ static inline void set_default_offline_state(int cpu)
+ 
+ extern enum cpu_state_vals get_preferred_offline_state(int cpu);
+ extern int start_secondary(void);
++extern void start_secondary_resume(void);
+ #endif
+diff --git a/arch/sparc/include/asm/irqflags_64.h b/arch/sparc/include/asm/irqflags_64.h
+index 8b49bf9..bfa1ea4 100644
+--- a/arch/sparc/include/asm/irqflags_64.h
++++ b/arch/sparc/include/asm/irqflags_64.h
+@@ -76,9 +76,26 @@ static inline int raw_irqs_disabled(void)
+  */
+ static inline unsigned long __raw_local_irq_save(void)
+ {
+-	unsigned long flags = __raw_local_save_flags();
+-
+-	raw_local_irq_disable();
++	unsigned long flags, tmp;
++
++	/* Disable interrupts to PIL_NORMAL_MAX unless we already
++	 * are using PIL_NMI, in which case PIL_NMI is retained.
++	 *
++	 * The only values we ever program into the %pil are 0,
++	 * PIL_NORMAL_MAX and PIL_NMI.
++	 *
++	 * Since PIL_NMI is the largest %pil value and all bits are
++	 * set in it (0xf), it doesn't matter what PIL_NORMAL_MAX
++	 * actually is.
++	 */
++	__asm__ __volatile__(
++		"rdpr	%%pil, %0\n\t"
++		"or	%0, %2, %1\n\t"
++		"wrpr	%1, 0x0, %%pil"
++		: "=r" (flags), "=r" (tmp)
++		: "i" (PIL_NORMAL_MAX)
++		: "memory"
++	);
+ 
+ 	return flags;
+ }
+diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
+index 39be9f2..3df02de 100644
+--- a/arch/sparc/include/asm/thread_info_64.h
++++ b/arch/sparc/include/asm/thread_info_64.h
+@@ -121,7 +121,7 @@ struct thread_info {
+ #define THREAD_SHIFT PAGE_SHIFT
+ #endif /* PAGE_SHIFT == 13 */
+ 
+-#define PREEMPT_ACTIVE		0x4000000
++#define PREEMPT_ACTIVE		0x10000000
+ 
+ /*
+  * macros/functions for gaining access to the thread information structure
+diff --git a/arch/sparc/kernel/pci_common.c b/arch/sparc/kernel/pci_common.c
+index b775658..8a00058 100644
+--- a/arch/sparc/kernel/pci_common.c
++++ b/arch/sparc/kernel/pci_common.c
+@@ -371,14 +371,19 @@ static void pci_register_iommu_region(struct pci_pbm_info *pbm)
+ 		struct resource *rp = kzalloc(sizeof(*rp), GFP_KERNEL);
+ 
+ 		if (!rp) {
+-			prom_printf("Cannot allocate IOMMU resource.\n");
+-			prom_halt();
++			pr_info("%s: Cannot allocate IOMMU resource.\n",
++				pbm->name);
++			return;
+ 		}
+ 		rp->name = "IOMMU";
+ 		rp->start = pbm->mem_space.start + (unsigned long) vdma[0];
+ 		rp->end = rp->start + (unsigned long) vdma[1] - 1UL;
+ 		rp->flags = IORESOURCE_BUSY;
+-		request_resource(&pbm->mem_space, rp);
++		if (request_resource(&pbm->mem_space, rp)) {
++			pr_info("%s: Unable to request IOMMU resource.\n",
++				pbm->name);
++			kfree(rp);
++		}
+ 	}
+ }
+ 
+diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
+index fd3cee4..c720f0c 100644
+--- a/arch/sparc/kernel/rtrap_64.S
++++ b/arch/sparc/kernel/rtrap_64.S
+@@ -172,7 +172,17 @@ rtrap_xcall:
+ 		 nop
+ 		call			trace_hardirqs_on
+ 		 nop
+-		wrpr			%l4, %pil
++		/* Do not actually set the %pil here.  We will do that
++		 * below after we clear PSTATE_IE in the %pstate register.
++		 * If we re-enable interrupts here, we can recurse down
++		 * the hardirq stack potentially endlessly, causing a
++		 * stack overflow.
++		 *
++		 * It is tempting to put this test and trace_hardirqs_on
++		 * call at the 'rt_continue' label, but that will not work
++		 * as that path hits unconditionally and we do not want to
++		 * execute this in NMI return paths, for example.
++		 */
+ #endif
+ rtrap_no_irq_enable:
+ 		andcc			%l1, TSTATE_PRIV, %l3
+diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
+index 10f7bb9..22cd475 100644
+--- a/arch/sparc/kernel/traps_64.c
++++ b/arch/sparc/kernel/traps_64.c
+@@ -2202,27 +2202,6 @@ void dump_stack(void)
+ 
+ EXPORT_SYMBOL(dump_stack);
+ 
+-static inline int is_kernel_stack(struct task_struct *task,
+-				  struct reg_window *rw)
+-{
+-	unsigned long rw_addr = (unsigned long) rw;
+-	unsigned long thread_base, thread_end;
+-
+-	if (rw_addr < PAGE_OFFSET) {
+-		if (task != &init_task)
+-			return 0;
+-	}
+-
+-	thread_base = (unsigned long) task_stack_page(task);
+-	thread_end = thread_base + sizeof(union thread_union);
+-	if (rw_addr >= thread_base &&
+-	    rw_addr < thread_end &&
+-	    !(rw_addr & 0x7UL))
+-		return 1;
+-
+-	return 0;
+-}
+-
+ static inline struct reg_window *kernel_stack_up(struct reg_window *rw)
+ {
+ 	unsigned long fp = rw->ins[6];
+@@ -2251,6 +2230,7 @@ void die_if_kernel(char *str, struct pt_regs *regs)
+ 	show_regs(regs);
+ 	add_taint(TAINT_DIE);
+ 	if (regs->tstate & TSTATE_PRIV) {
++		struct thread_info *tp = current_thread_info();
+ 		struct reg_window *rw = (struct reg_window *)
+ 			(regs->u_regs[UREG_FP] + STACK_BIAS);
+ 
+@@ -2258,8 +2238,8 @@ void die_if_kernel(char *str, struct pt_regs *regs)
+ 		 * find some badly aligned kernel stack.
+ 		 */
+ 		while (rw &&
+-		       count++ < 30&&
+-		       is_kernel_stack(current, rw)) {
++		       count++ < 30 &&
++		       kstack_valid(tp, (unsigned long) rw)) {
+ 			printk("Caller[%016lx]: %pS\n", rw->ins[7],
+ 			       (void *) rw->ins[7]);
+ 
+diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
+index 378ca82..95a8e9a 100644
+--- a/arch/sparc/kernel/unaligned_64.c
++++ b/arch/sparc/kernel/unaligned_64.c
+@@ -49,7 +49,7 @@ static inline enum direction decode_direction(unsigned int insn)
+ }
+ 
+ /* 16 = double-word, 8 = extra-word, 4 = word, 2 = half-word */
+-static inline int decode_access_size(unsigned int insn)
++static inline int decode_access_size(struct pt_regs *regs, unsigned int insn)
+ {
+ 	unsigned int tmp;
+ 
+@@ -65,7 +65,7 @@ static inline int decode_access_size(unsigned int insn)
+ 		return 2;
+ 	else {
+ 		printk("Impossible unaligned trap. insn=%08x\n", insn);
+-		die_if_kernel("Byte sized unaligned access?!?!", current_thread_info()->kregs);
++		die_if_kernel("Byte sized unaligned access?!?!", regs);
+ 
+ 		/* GCC should never warn that control reaches the end
+ 		 * of this function without returning a value because
+@@ -289,7 +289,7 @@ static void log_unaligned(struct pt_regs *regs)
+ asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn)
+ {
+ 	enum direction dir = decode_direction(insn);
+-	int size = decode_access_size(insn);
++	int size = decode_access_size(regs, insn);
+ 	int orig_asi, asi;
+ 
+ 	current_thread_info()->kern_una_regs = regs;
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index eb40925..ddb52b8 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -627,7 +627,7 @@ config GART_IOMMU
+ 	bool "GART IOMMU support" if EMBEDDED
+ 	default y
+ 	select SWIOTLB
+-	depends on X86_64 && PCI
++	depends on X86_64 && PCI && K8_NB
+ 	---help---
+ 	  Support for full DMA access of devices with 32bit memory access only
+ 	  on systems with more than 3GB. This is usually needed for USB,
+@@ -2026,7 +2026,7 @@ endif # X86_32
+ 
+ config K8_NB
+ 	def_bool y
+-	depends on AGP_AMD64 || (X86_64 && (GART_IOMMU || (PCI && NUMA)))
++	depends on CPU_SUP_AMD && PCI
+ 
+ source "drivers/pcmcia/Kconfig"
+ 
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index be37059..b35c160 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -2539,6 +2539,9 @@ void irq_force_complete_move(int irq)
+ 	struct irq_desc *desc = irq_to_desc(irq);
+ 	struct irq_cfg *cfg = desc->chip_data;
+ 
++	if (!cfg)
++		return;
++
+ 	__irq_complete_move(&desc, cfg->vector);
+ }
+ #else
+diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+index 6e44519..3b5ea38 100644
+--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
++++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+@@ -929,7 +929,8 @@ static int fill_powernow_table_pstate(struct powernow_k8_data *data,
+ 		powernow_table[i].index = index;
+ 
+ 		/* Frequency may be rounded for these */
+-		if (boot_cpu_data.x86 == 0x10 || boot_cpu_data.x86 == 0x11) {
++		if ((boot_cpu_data.x86 == 0x10 && boot_cpu_data.x86_model < 10)
++				 || boot_cpu_data.x86 == 0x11) {
+ 			powernow_table[i].frequency =
+ 				freq_from_fid_did(lo & 0x3f, (lo >> 6) & 7);
+ 		} else
+diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
+index 7e1cca1..1366c7c 100644
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -47,6 +47,27 @@ static void __cpuinit early_init_intel(struct cpuinfo_x86 *c)
+ 		(c->x86 == 0x6 && c->x86_model >= 0x0e))
+ 		set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
+ 
++	/*
++	 * Atom erratum AAE44/AAF40/AAG38/AAH41:
++	 *
++	 * A race condition between speculative fetches and invalidating
++	 * a large page.  This is worked around in microcode, but we
++	 * need the microcode to have already been loaded... so if it is
++	 * not, recommend a BIOS update and disable large pages.
++	 */
++	if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_mask <= 2) {
++		u32 ucode, junk;
++
++		wrmsr(MSR_IA32_UCODE_REV, 0, 0);
++		sync_core();
++		rdmsr(MSR_IA32_UCODE_REV, junk, ucode);
++
++		if (ucode < 0x20e) {
++			printk(KERN_WARNING "Atom PSE erratum detected, BIOS microcode update recommended\n");
++			clear_cpu_cap(c, X86_FEATURE_PSE);
++		}
++	}
++
+ #ifdef CONFIG_X86_64
+ 	set_cpu_cap(c, X86_FEATURE_SYSENTER32);
+ #else
+diff --git a/arch/x86/kernel/k8.c b/arch/x86/kernel/k8.c
+index cbc4332..9b89546 100644
+--- a/arch/x86/kernel/k8.c
++++ b/arch/x86/kernel/k8.c
+@@ -121,3 +121,17 @@ void k8_flush_garts(void)
+ }
+ EXPORT_SYMBOL_GPL(k8_flush_garts);
+ 
++static __init int init_k8_nbs(void)
++{
++	int err = 0;
++
++	err = cache_k8_northbridges();
++
++	if (err < 0)
++		printk(KERN_NOTICE "K8 NB: Cannot enumerate AMD northbridges.\n");
++
++	return err;
++}
++
++/* This has to go after the PCI subsystem */
++fs_initcall(init_k8_nbs);
+diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
+index 4f41b29..0ae24d9 100644
+--- a/arch/x86/kernel/pci-gart_64.c
++++ b/arch/x86/kernel/pci-gart_64.c
+@@ -738,7 +738,7 @@ int __init gart_iommu_init(void)
+ 	unsigned long scratch;
+ 	long i;
+ 
+-	if (cache_k8_northbridges() < 0 || num_k8_northbridges == 0)
++	if (num_k8_northbridges == 0)
+ 		return 0;
+ 
+ #ifndef CONFIG_AGP_AMD64
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index 126f0b4..11d0702 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -282,12 +282,12 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
+ 
+ 	set_tsk_thread_flag(p, TIF_FORK);
+ 
+-	p->thread.fs = me->thread.fs;
+-	p->thread.gs = me->thread.gs;
+ 	p->thread.io_bitmap_ptr = NULL;
+ 
+ 	savesegment(gs, p->thread.gsindex);
++	p->thread.gs = p->thread.gsindex ? 0 : me->thread.gs;
+ 	savesegment(fs, p->thread.fsindex);
++	p->thread.fs = p->thread.fsindex ? 0 : me->thread.fs;
+ 	savesegment(es, p->thread.es);
+ 	savesegment(ds, p->thread.ds);
+ 
+diff --git a/block/blk-timeout.c b/block/blk-timeout.c
+index 1ba7e0a..4f0c06c 100644
+--- a/block/blk-timeout.c
++++ b/block/blk-timeout.c
+@@ -109,6 +109,7 @@ void blk_rq_timed_out_timer(unsigned long data)
+ 	struct request_queue *q = (struct request_queue *) data;
+ 	unsigned long flags, next = 0;
+ 	struct request *rq, *tmp;
++	int next_set = 0;
+ 
+ 	spin_lock_irqsave(q->queue_lock, flags);
+ 
+@@ -122,16 +123,13 @@ void blk_rq_timed_out_timer(unsigned long data)
+ 			if (blk_mark_rq_complete(rq))
+ 				continue;
+ 			blk_rq_timed_out(rq);
+-		} else if (!next || time_after(next, rq->deadline))
++		} else if (!next_set || time_after(next, rq->deadline)) {
+ 			next = rq->deadline;
++			next_set = 1;
++		}
+ 	}
+ 
+-	/*
+-	 * next can never be 0 here with the list non-empty, since we always
+-	 * bump ->deadline to 1 so we can detect if the timer was ever added
+-	 * or not. See comment in blk_add_timer()
+-	 */
+-	if (next)
++	if (next_set)
+ 		mod_timer(&q->timeout, round_jiffies_up(next));
+ 
+ 	spin_unlock_irqrestore(q->queue_lock, flags);
+diff --git a/crypto/async_tx/async_raid6_recov.c b/crypto/async_tx/async_raid6_recov.c
+index 943f2ab..ce038d8 100644
+--- a/crypto/async_tx/async_raid6_recov.c
++++ b/crypto/async_tx/async_raid6_recov.c
+@@ -324,6 +324,7 @@ struct dma_async_tx_descriptor *
+ async_raid6_2data_recov(int disks, size_t bytes, int faila, int failb,
+ 			struct page **blocks, struct async_submit_ctl *submit)
+ {
++	void *scribble = submit->scribble;
+ 	int non_zero_srcs, i;
+ 
+ 	BUG_ON(faila == failb);
+@@ -332,11 +333,13 @@ async_raid6_2data_recov(int disks, size_t bytes, int faila, int failb,
+ 
+ 	pr_debug("%s: disks: %d len: %zu\n", __func__, disks, bytes);
+ 
+-	/* we need to preserve the contents of 'blocks' for the async
+-	 * case, so punt to synchronous if a scribble buffer is not available
++	/* if a dma resource is not available or a scribble buffer is not
++	 * available punt to the synchronous path.  In the 'dma not
++	 * available' case be sure to use the scribble buffer to
++	 * preserve the content of 'blocks' as the caller intended.
+ 	 */
+-	if (!submit->scribble) {
+-		void **ptrs = (void **) blocks;
++	if (!async_dma_find_channel(DMA_PQ) || !scribble) {
++		void **ptrs = scribble ? scribble : (void **) blocks;
+ 
+ 		async_tx_quiesce(&submit->depend_tx);
+ 		for (i = 0; i < disks; i++)
+@@ -406,11 +409,13 @@ async_raid6_datap_recov(int disks, size_t bytes, int faila,
+ 
+ 	pr_debug("%s: disks: %d len: %zu\n", __func__, disks, bytes);
+ 
+-	/* we need to preserve the contents of 'blocks' for the async
+-	 * case, so punt to synchronous if a scribble buffer is not available
++	/* if a dma resource is not available or a scribble buffer is not
++	 * available punt to the synchronous path.  In the 'dma not
++	 * available' case be sure to use the scribble buffer to
++	 * preserve the content of 'blocks' as the caller intended.
+ 	 */
+-	if (!scribble) {
+-		void **ptrs = (void **) blocks;
++	if (!async_dma_find_channel(DMA_PQ) || !scribble) {
++		void **ptrs = scribble ? scribble : (void **) blocks;
+ 
+ 		async_tx_quiesce(&submit->depend_tx);
+ 		for (i = 0; i < disks; i++)
+diff --git a/drivers/Makefile b/drivers/Makefile
+index 6ee53c7..8b0b948 100644
+--- a/drivers/Makefile
++++ b/drivers/Makefile
+@@ -17,6 +17,7 @@ obj-$(CONFIG_SFI)		+= sfi/
+ obj-$(CONFIG_PNP)		+= pnp/
+ obj-$(CONFIG_ARM_AMBA)		+= amba/
+ 
++obj-$(CONFIG_VIRTIO)		+= virtio/
+ obj-$(CONFIG_XEN)		+= xen/
+ 
+ # regulators early, since some subsystems rely on them to initialize
+@@ -106,7 +107,6 @@ obj-$(CONFIG_HID)		+= hid/
+ obj-$(CONFIG_PPC_PS3)		+= ps3/
+ obj-$(CONFIG_OF)		+= of/
+ obj-$(CONFIG_SSB)		+= ssb/
+-obj-$(CONFIG_VIRTIO)		+= virtio/
+ obj-$(CONFIG_VLYNQ)		+= vlynq/
+ obj-$(CONFIG_STAGING)		+= staging/
+ obj-y				+= platform/
+diff --git a/drivers/acpi/power_meter.c b/drivers/acpi/power_meter.c
+index dc4ffad..e02d93c 100644
+--- a/drivers/acpi/power_meter.c
++++ b/drivers/acpi/power_meter.c
+@@ -34,7 +34,7 @@
+ #define ACPI_POWER_METER_NAME		"power_meter"
+ ACPI_MODULE_NAME(ACPI_POWER_METER_NAME);
+ #define ACPI_POWER_METER_DEVICE_NAME	"Power Meter"
+-#define ACPI_POWER_METER_CLASS		"power_meter_resource"
++#define ACPI_POWER_METER_CLASS		"pwr_meter_resource"
+ 
+ #define NUM_SENSORS			17
+ 
+diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
+index 79d33d9..7c85265 100644
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -450,6 +450,126 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
+ 		},
+ 	},
+ 	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad T410",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad T510",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad W510",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad X201",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad X201",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad T410",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad T510",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad W510",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad X201",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad X201",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad T410",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad T510",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad W510",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad X201",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Lenovo ThinkPad X201",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
++		},
++	},
++	{
+ 	.callback = init_old_suspend_ordering,
+ 	.ident = "Panasonic CF51-2L",
+ 	.matches = {
+@@ -458,6 +578,30 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
+ 		DMI_MATCH(DMI_BOARD_NAME, "CF51-2L"),
+ 		},
+ 	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Dell Studio 1558",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++		DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1558"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Dell Studio 1557",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++		DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1557"),
++		},
++	},
++	{
++	.callback = init_set_sci_en_on_resume,
++	.ident = "Dell Studio 1555",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++		DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1555"),
++		},
++	},
+ 	{},
+ };
+ #endif /* CONFIG_SUSPEND */
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 9f6cfac..228740f 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -879,6 +879,8 @@ static void ata_eh_set_pending(struct ata_port *ap, int fastdrain)
+ void ata_qc_schedule_eh(struct ata_queued_cmd *qc)
+ {
+ 	struct ata_port *ap = qc->ap;
++	struct request_queue *q = qc->scsicmd->device->request_queue;
++	unsigned long flags;
+ 
+ 	WARN_ON(!ap->ops->error_handler);
+ 
+@@ -890,7 +892,9 @@ void ata_qc_schedule_eh(struct ata_queued_cmd *qc)
+ 	 * Note that ATA_QCFLAG_FAILED is unconditionally set after
+ 	 * this function completes.
+ 	 */
++	spin_lock_irqsave(q->queue_lock, flags);
+ 	blk_abort_request(qc->scsicmd->request);
++	spin_unlock_irqrestore(q->queue_lock, flags);
+ }
+ 
+ /**
+@@ -1624,6 +1628,7 @@ void ata_eh_analyze_ncq_error(struct ata_link *link)
+ 	}
+ 
+ 	/* okay, this error is ours */
++	memset(&tf, 0, sizeof(tf));
+ 	rc = ata_eh_read_log_10h(dev, &tag, &tf);
+ 	if (rc) {
+ 		ata_link_printk(link, KERN_ERR, "failed to read log page 10h "
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index bd02505..d7d77d4 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -311,7 +311,7 @@ static SYSDEV_ATTR(removable, 0444, show_mem_removable, NULL);
+ static ssize_t
+ print_block_size(struct class *class, char *buf)
+ {
+-	return sprintf(buf, "%#lx\n", (unsigned long)PAGES_PER_SECTION * PAGE_SIZE);
++	return sprintf(buf, "%lx\n", (unsigned long)PAGES_PER_SECTION * PAGE_SIZE);
+ }
+ 
+ static CLASS_ATTR(block_size_bytes, 0444, print_block_size, NULL);
+diff --git a/drivers/char/agp/Kconfig b/drivers/char/agp/Kconfig
+index 2fb3a48..4b66c69 100644
+--- a/drivers/char/agp/Kconfig
++++ b/drivers/char/agp/Kconfig
+@@ -57,7 +57,7 @@ config AGP_AMD
+ 
+ config AGP_AMD64
+ 	tristate "AMD Opteron/Athlon64 on-CPU GART support"
+-	depends on AGP && X86
++	depends on AGP && X86 && K8_NB
+ 	help
+ 	  This option gives you AGP support for the GLX component of
+ 	  X using the on-CPU northbridge of the AMD Athlon64/Opteron CPUs.
+diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
+index 73655ae..f8e57c6 100644
+--- a/drivers/cpuidle/governors/menu.c
++++ b/drivers/cpuidle/governors/menu.c
+@@ -101,7 +101,6 @@ struct menu_device {
+ 
+ 	unsigned int	expected_us;
+ 	u64		predicted_us;
+-	unsigned int	measured_us;
+ 	unsigned int	exit_us;
+ 	unsigned int	bucket;
+ 	u64		correction_factor[BUCKETS];
+@@ -187,14 +186,14 @@ static int menu_select(struct cpuidle_device *dev)
+ 	int i;
+ 	int multiplier;
+ 
+-	data->last_state_idx = 0;
+-	data->exit_us = 0;
+-
+ 	if (data->needs_update) {
+ 		menu_update(dev);
+ 		data->needs_update = 0;
+ 	}
+ 
++	data->last_state_idx = 0;
++	data->exit_us = 0;
++
+ 	/* Special case when user has set very strict latency requirement */
+ 	if (unlikely(latency_req == 0))
+ 		return 0;
+@@ -294,7 +293,7 @@ static void menu_update(struct cpuidle_device *dev)
+ 	new_factor = data->correction_factor[data->bucket]
+ 			* (DECAY - 1) / DECAY;
+ 
+-	if (data->expected_us > 0 && data->measured_us < MAX_INTERESTING)
++	if (data->expected_us > 0 && measured_us < MAX_INTERESTING)
+ 		new_factor += RESOLUTION * measured_us / data->expected_us;
+ 	else
+ 		/*
+diff --git a/drivers/edac/edac_mce_amd.c b/drivers/edac/edac_mce_amd.c
+index f5b6d9f..97e64bc 100644
+--- a/drivers/edac/edac_mce_amd.c
++++ b/drivers/edac/edac_mce_amd.c
+@@ -294,7 +294,6 @@ wrong_ls_mce:
+ void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
+ {
+ 	u32 ec  = ERROR_CODE(regs->nbsl);
+-	u32 xec = EXT_ERROR_CODE(regs->nbsl);
+ 
+ 	if (!handle_errors)
+ 		return;
+@@ -324,7 +323,7 @@ void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
+ 		pr_cont("\n");
+ 	}
+ 
+-	pr_emerg("%s.\n", EXT_ERR_MSG(xec));
++	pr_emerg("%s.\n", EXT_ERR_MSG(regs->nbsl));
+ 
+ 	if (BUS_ERROR(ec) && nb_bus_decoder)
+ 		nb_bus_decoder(node_id, regs);
+@@ -374,7 +373,7 @@ static int amd_decode_mce(struct notifier_block *nb, unsigned long val,
+ 		 ((m->status & MCI_STATUS_PCC) ? "yes" : "no"));
+ 
+ 	/* do the two bits[14:13] together */
+-	ecc = m->status & (3ULL << 45);
++	ecc = (m->status >> 45) & 0x3;
+ 	if (ecc)
+ 		pr_cont(", %sECC Error", ((ecc == 2) ? "C" : "U"));
+ 
+diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
+index a894ade..1372796 100644
+--- a/drivers/gpu/drm/i915/i915_debugfs.c
++++ b/drivers/gpu/drm/i915/i915_debugfs.c
+@@ -162,7 +162,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
+ 	struct drm_device *dev = node->minor->dev;
+ 	drm_i915_private_t *dev_priv = dev->dev_private;
+ 
+-	if (!IS_IRONLAKE(dev)) {
++	if (!HAS_PCH_SPLIT(dev)) {
+ 		seq_printf(m, "Interrupt enable:    %08x\n",
+ 			   I915_READ(IER));
+ 		seq_printf(m, "Interrupt identity:  %08x\n",
+diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
+index 2307f98..d642efd 100644
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -978,15 +978,21 @@ static int i915_probe_agp(struct drm_device *dev, uint32_t *aperture_size,
+ 	 * Some of the preallocated space is taken by the GTT
+ 	 * and popup.  GTT is 1K per MB of aperture size, and popup is 4K.
+ 	 */
+-	if (IS_G4X(dev) || IS_PINEVIEW(dev) || IS_IRONLAKE(dev))
++	if (IS_G4X(dev) || IS_PINEVIEW(dev) || IS_IRONLAKE(dev) || IS_GEN6(dev))
+ 		overhead = 4096;
+ 	else
+ 		overhead = (*aperture_size / 1024) + 4096;
+ 
+ 	switch (tmp & INTEL_GMCH_GMS_MASK) {
+ 	case INTEL_855_GMCH_GMS_DISABLED:
+-		DRM_ERROR("video memory is disabled\n");
+-		return -1;
++		/* XXX: This is what my A1 silicon has. */
++		if (IS_GEN6(dev)) {
++			stolen = 64 * 1024 * 1024;
++		} else {
++			DRM_ERROR("video memory is disabled\n");
++			return -1;
++		}
++		break;
+ 	case INTEL_855_GMCH_GMS_STOLEN_1M:
+ 		stolen = 1 * 1024 * 1024;
+ 		break;
+@@ -1064,7 +1070,7 @@ static unsigned long i915_gtt_to_phys(struct drm_device *dev,
+ 	int gtt_offset, gtt_size;
+ 
+ 	if (IS_I965G(dev)) {
+-		if (IS_G4X(dev) || IS_IRONLAKE(dev)) {
++		if (IS_G4X(dev) || IS_IRONLAKE(dev) || IS_GEN6(dev)) {
+ 			gtt_offset = 2*1024*1024;
+ 			gtt_size = 2*1024*1024;
+ 		} else {
+@@ -1445,7 +1451,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
+ 
+ 	dev->driver->get_vblank_counter = i915_get_vblank_counter;
+ 	dev->max_vblank_count = 0xffffff; /* only 24 bits of frame count */
+-	if (IS_G4X(dev) || IS_IRONLAKE(dev)) {
++	if (IS_G4X(dev) || IS_IRONLAKE(dev) || IS_GEN6(dev)) {
+ 		dev->max_vblank_count = 0xffffffff; /* full 32 bit counter */
+ 		dev->driver->get_vblank_counter = gm45_get_vblank_counter;
+ 	}
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index b99b6a8..16ce3ba 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -1026,7 +1026,7 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
+ #define IS_845G(dev)		((dev)->pci_device == 0x2562)
+ #define IS_I85X(dev)		((dev)->pci_device == 0x3582)
+ #define IS_I865G(dev)		((dev)->pci_device == 0x2572)
+-#define IS_I8XX(dev)		(INTEL_INFO(dev)->is_i8xx)
++#define IS_GEN2(dev)		(INTEL_INFO(dev)->is_i8xx)
+ #define IS_I915G(dev)		(INTEL_INFO(dev)->is_i915g)
+ #define IS_I915GM(dev)		((dev)->pci_device == 0x2592)
+ #define IS_I945G(dev)		((dev)->pci_device == 0x2772)
+@@ -1045,8 +1045,29 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
+ #define IS_I9XX(dev)		(INTEL_INFO(dev)->is_i9xx)
+ #define IS_MOBILE(dev)		(INTEL_INFO(dev)->is_mobile)
+ 
++#define IS_GEN3(dev)	(IS_I915G(dev) ||			\
++			 IS_I915GM(dev) ||			\
++			 IS_I945G(dev) ||			\
++			 IS_I945GM(dev) ||			\
++			 IS_G33(dev) || \
++			 IS_PINEVIEW(dev))
++#define IS_GEN4(dev)	((dev)->pci_device == 0x2972 ||		\
++			 (dev)->pci_device == 0x2982 ||		\
++			 (dev)->pci_device == 0x2992 ||		\
++			 (dev)->pci_device == 0x29A2 ||		\
++			 (dev)->pci_device == 0x2A02 ||		\
++			 (dev)->pci_device == 0x2A12 ||		\
++			 (dev)->pci_device == 0x2E02 ||		\
++			 (dev)->pci_device == 0x2E12 ||		\
++			 (dev)->pci_device == 0x2E22 ||		\
++			 (dev)->pci_device == 0x2E32 ||		\
++			 (dev)->pci_device == 0x2A42 ||		\
++			 (dev)->pci_device == 0x2E42)
++
+ #define I915_NEED_GFX_HWS(dev)	(INTEL_INFO(dev)->need_gfx_hws)
+ 
++#define IS_GEN6(dev)	((dev)->pci_device == 0x0102)
++
+ /* With the 945 and later, Y tiling got adjusted so that it was 32 128-byte
+  * rows, which changed the alignment requirements and fence programming.
+  */
+@@ -1067,6 +1088,9 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
+ #define I915_HAS_FBC(dev) (INTEL_INFO(dev)->has_fbc)
+ #define I915_HAS_RC6(dev) (INTEL_INFO(dev)->has_rc6)
+ 
++#define HAS_PCH_SPLIT(dev) (IS_IRONLAKE(dev) ||	\
++			    IS_GEN6(dev))
++
+ #define PRIMARY_RINGBUFFER_SIZE         (128*1024)
+ 
+ #endif
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index fd099a1..6458400 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1819,7 +1819,7 @@ i915_do_wait_request(struct drm_device *dev, uint32_t seqno, int interruptible)
+ 		return -EIO;
+ 
+ 	if (!i915_seqno_passed(i915_get_gem_seqno(dev), seqno)) {
+-		if (IS_IRONLAKE(dev))
++		if (HAS_PCH_SPLIT(dev))
+ 			ier = I915_READ(DEIER) | I915_READ(GTIER);
+ 		else
+ 			ier = I915_READ(IER);
+@@ -2316,6 +2316,12 @@ static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
+ 	pitch_val = obj_priv->stride / tile_width;
+ 	pitch_val = ffs(pitch_val) - 1;
+ 
++	if (obj_priv->tiling_mode == I915_TILING_Y &&
++	    HAS_128_BYTE_Y_TILING(dev))
++		WARN_ON(pitch_val > I830_FENCE_MAX_PITCH_VAL);
++	else
++		WARN_ON(pitch_val > I915_FENCE_MAX_PITCH_VAL);
++
+ 	val = obj_priv->gtt_offset;
+ 	if (obj_priv->tiling_mode == I915_TILING_Y)
+ 		val |= 1 << I830_FENCE_TILING_Y_SHIFT;
+diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
+index df278b2..040e80c 100644
+--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
++++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
+@@ -209,7 +209,7 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
+ 	uint32_t swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
+ 	bool need_disable;
+ 
+-	if (IS_IRONLAKE(dev)) {
++	if (IS_IRONLAKE(dev) || IS_GEN6(dev)) {
+ 		/* On Ironlake whatever DRAM config, GPU always do
+ 		 * same swizzling setup.
+ 		 */
+@@ -357,21 +357,17 @@ i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
+ 		 * reg, so dont bother to check the size */
+ 		if (stride / 128 > I965_FENCE_MAX_PITCH_VAL)
+ 			return false;
+-	} else if (IS_I9XX(dev)) {
+-		uint32_t pitch_val = ffs(stride / tile_width) - 1;
+-
+-		/* XXX: For Y tiling, FENCE_MAX_PITCH_VAL is actually 6 (8KB)
+-		 * instead of 4 (2KB) on 945s.
+-		 */
+-		if (pitch_val > I915_FENCE_MAX_PITCH_VAL ||
+-		    size > (I830_FENCE_MAX_SIZE_VAL << 20))
++	} else if (IS_GEN3(dev) || IS_GEN2(dev)) {
++		if (stride > 8192)
+ 			return false;
+-	} else {
+-		uint32_t pitch_val = ffs(stride / tile_width) - 1;
+ 
+-		if (pitch_val > I830_FENCE_MAX_PITCH_VAL ||
+-		    size > (I830_FENCE_MAX_SIZE_VAL << 19))
+-			return false;
++		if (IS_GEN3(dev)) {
++			if (size > I830_FENCE_MAX_SIZE_VAL << 20)
++				return false;
++		} else {
++			if (size > I830_FENCE_MAX_SIZE_VAL << 19)
++				return false;
++		}
+ 	}
+ 
+ 	/* 965+ just needs multiples of tile width */
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index a17d6bd..032f667 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -576,7 +576,7 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
+ 
+ 	atomic_inc(&dev_priv->irq_received);
+ 
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		return ironlake_irq_handler(dev);
+ 
+ 	iir = I915_READ(IIR);
+@@ -737,7 +737,7 @@ void i915_user_irq_get(struct drm_device *dev)
+ 
+ 	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
+ 	if (dev->irq_enabled && (++dev_priv->user_irq_refcount == 1)) {
+-		if (IS_IRONLAKE(dev))
++		if (HAS_PCH_SPLIT(dev))
+ 			ironlake_enable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
+ 		else
+ 			i915_enable_irq(dev_priv, I915_USER_INTERRUPT);
+@@ -753,7 +753,7 @@ void i915_user_irq_put(struct drm_device *dev)
+ 	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
+ 	BUG_ON(dev->irq_enabled && dev_priv->user_irq_refcount <= 0);
+ 	if (dev->irq_enabled && (--dev_priv->user_irq_refcount == 0)) {
+-		if (IS_IRONLAKE(dev))
++		if (HAS_PCH_SPLIT(dev))
+ 			ironlake_disable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
+ 		else
+ 			i915_disable_irq(dev_priv, I915_USER_INTERRUPT);
+@@ -861,7 +861,7 @@ int i915_enable_vblank(struct drm_device *dev, int pipe)
+ 		return -EINVAL;
+ 
+ 	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		ironlake_enable_display_irq(dev_priv, (pipe == 0) ? 
+ 					    DE_PIPEA_VBLANK: DE_PIPEB_VBLANK);
+ 	else if (IS_I965G(dev))
+@@ -883,7 +883,7 @@ void i915_disable_vblank(struct drm_device *dev, int pipe)
+ 	unsigned long irqflags;
+ 
+ 	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		ironlake_disable_display_irq(dev_priv, (pipe == 0) ? 
+ 					     DE_PIPEA_VBLANK: DE_PIPEB_VBLANK);
+ 	else
+@@ -897,7 +897,7 @@ void i915_enable_interrupt (struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 
+-	if (!IS_IRONLAKE(dev))
++	if (!HAS_PCH_SPLIT(dev))
+ 		opregion_enable_asle(dev);
+ 	dev_priv->irq_enabled = 1;
+ }
+@@ -1076,7 +1076,7 @@ void i915_driver_irq_preinstall(struct drm_device * dev)
+ 	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
+ 	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
+ 
+-	if (IS_IRONLAKE(dev)) {
++	if (HAS_PCH_SPLIT(dev)) {
+ 		ironlake_irq_preinstall(dev);
+ 		return;
+ 	}
+@@ -1108,7 +1108,7 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
+ 
+ 	dev_priv->vblank_pipe = DRM_I915_VBLANK_PIPE_A | DRM_I915_VBLANK_PIPE_B;
+ 
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		return ironlake_irq_postinstall(dev);
+ 
+ 	/* Unmask the interrupts that we always want on. */
+@@ -1196,7 +1196,7 @@ void i915_driver_irq_uninstall(struct drm_device * dev)
+ 
+ 	dev_priv->vblank_pipe = 0;
+ 
+-	if (IS_IRONLAKE(dev)) {
++	if (HAS_PCH_SPLIT(dev)) {
+ 		ironlake_irq_uninstall(dev);
+ 		return;
+ 	}
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index ab1bd2d..fd95bdf 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -221,7 +221,7 @@
+ #define   I830_FENCE_SIZE_BITS(size)	((ffs((size) >> 19) - 1) << 8)
+ #define   I830_FENCE_PITCH_SHIFT	4
+ #define   I830_FENCE_REG_VALID		(1<<0)
+-#define   I915_FENCE_MAX_PITCH_VAL	0x10
++#define   I915_FENCE_MAX_PITCH_VAL	4
+ #define   I830_FENCE_MAX_PITCH_VAL	6
+ #define   I830_FENCE_MAX_SIZE_VAL	(1<<8)
+ 
+diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
+index 15fbc1b..70c9d4b 100644
+--- a/drivers/gpu/drm/i915/intel_bios.c
++++ b/drivers/gpu/drm/i915/intel_bios.c
+@@ -247,6 +247,7 @@ static void
+ parse_general_features(struct drm_i915_private *dev_priv,
+ 		       struct bdb_header *bdb)
+ {
++	struct drm_device *dev = dev_priv->dev;
+ 	struct bdb_general_features *general;
+ 
+ 	/* Set sensible defaults in case we can't find the general block */
+@@ -263,7 +264,7 @@ parse_general_features(struct drm_i915_private *dev_priv,
+ 			if (IS_I85X(dev_priv->dev))
+ 				dev_priv->lvds_ssc_freq =
+ 					general->ssc_freq ? 66 : 48;
+-			else if (IS_IRONLAKE(dev_priv->dev))
++			else if (IS_IRONLAKE(dev_priv->dev) || IS_GEN6(dev))
+ 				dev_priv->lvds_ssc_freq =
+ 					general->ssc_freq ? 100 : 120;
+ 			else
+diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
+index 79dd402..fccf074 100644
+--- a/drivers/gpu/drm/i915/intel_crt.c
++++ b/drivers/gpu/drm/i915/intel_crt.c
+@@ -39,7 +39,7 @@ static void intel_crt_dpms(struct drm_encoder *encoder, int mode)
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 	u32 temp, reg;
+ 
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		reg = PCH_ADPA;
+ 	else
+ 		reg = ADPA;
+@@ -113,7 +113,7 @@ static void intel_crt_mode_set(struct drm_encoder *encoder,
+ 	else
+ 		dpll_md_reg = DPLL_B_MD;
+ 
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		adpa_reg = PCH_ADPA;
+ 	else
+ 		adpa_reg = ADPA;
+@@ -122,7 +122,7 @@ static void intel_crt_mode_set(struct drm_encoder *encoder,
+ 	 * Disable separate mode multiplier used when cloning SDVO to CRT
+ 	 * XXX this needs to be adjusted when we really are cloning
+ 	 */
+-	if (IS_I965G(dev) && !IS_IRONLAKE(dev)) {
++	if (IS_I965G(dev) && !HAS_PCH_SPLIT(dev)) {
+ 		dpll_md = I915_READ(dpll_md_reg);
+ 		I915_WRITE(dpll_md_reg,
+ 			   dpll_md & ~DPLL_MD_UDI_MULTIPLIER_MASK);
+@@ -136,11 +136,11 @@ static void intel_crt_mode_set(struct drm_encoder *encoder,
+ 
+ 	if (intel_crtc->pipe == 0) {
+ 		adpa |= ADPA_PIPE_A_SELECT;
+-		if (!IS_IRONLAKE(dev))
++		if (!HAS_PCH_SPLIT(dev))
+ 			I915_WRITE(BCLRPAT_A, 0);
+ 	} else {
+ 		adpa |= ADPA_PIPE_B_SELECT;
+-		if (!IS_IRONLAKE(dev))
++		if (!HAS_PCH_SPLIT(dev))
+ 			I915_WRITE(BCLRPAT_B, 0);
+ 	}
+ 
+@@ -202,7 +202,7 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
+ 	u32 hotplug_en;
+ 	int i, tries = 0;
+ 
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		return intel_ironlake_crt_detect_hotplug(connector);
+ 
+ 	/*
+@@ -524,7 +524,7 @@ void intel_crt_init(struct drm_device *dev)
+ 					  &intel_output->enc);
+ 
+ 	/* Set up the DDC bus. */
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		i2c_reg = PCH_GPIOA;
+ 	else {
+ 		i2c_reg = GPIOA;
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index b27202d..4b2458d 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -232,7 +232,7 @@ struct intel_limit {
+ #define G4X_P2_DISPLAY_PORT_FAST           10
+ #define G4X_P2_DISPLAY_PORT_LIMIT          0
+ 
+-/* Ironlake */
++/* Ironlake / Sandybridge */
+ /* as we calculate clock using (register_value + 2) for
+    N/M1/M2, so here the range value for them is (actual_value-2).
+  */
+@@ -690,7 +690,7 @@ static const intel_limit_t *intel_limit(struct drm_crtc *crtc)
+ 	struct drm_device *dev = crtc->dev;
+ 	const intel_limit_t *limit;
+ 
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		limit = intel_ironlake_limit(crtc);
+ 	else if (IS_G4X(dev)) {
+ 		limit = intel_g4x_limit(crtc);
+@@ -1366,7 +1366,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
+ 			dspcntr &= ~DISPPLANE_TILED;
+ 	}
+ 
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		/* must disable */
+ 		dspcntr |= DISPPLANE_TRICKLE_FEED_DISABLE;
+ 
+@@ -1427,7 +1427,7 @@ static void i915_disable_vga (struct drm_device *dev)
+ 	u8 sr1;
+ 	u32 vga_reg;
+ 
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		vga_reg = CPU_VGACNTRL;
+ 	else
+ 		vga_reg = VGACNTRL;
+@@ -2111,7 +2111,7 @@ static bool intel_crtc_mode_fixup(struct drm_crtc *crtc,
+ 				  struct drm_display_mode *adjusted_mode)
+ {
+ 	struct drm_device *dev = crtc->dev;
+-	if (IS_IRONLAKE(dev)) {
++	if (HAS_PCH_SPLIT(dev)) {
+ 		/* FDI link clock is fixed at 2.7G */
+ 		if (mode->clock * 3 > 27000 * 4)
+ 			return MODE_CLOCK_HIGH;
+@@ -2967,7 +2967,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
+ 					refclk / 1000);
+ 	} else if (IS_I9XX(dev)) {
+ 		refclk = 96000;
+-		if (IS_IRONLAKE(dev))
++		if (HAS_PCH_SPLIT(dev))
+ 			refclk = 120000; /* 120Mhz refclk */
+ 	} else {
+ 		refclk = 48000;
+@@ -3025,7 +3025,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
+ 	}
+ 
+ 	/* FDI link */
+-	if (IS_IRONLAKE(dev)) {
++	if (HAS_PCH_SPLIT(dev)) {
+ 		int lane, link_bw, bpp;
+ 		/* eDP doesn't require FDI link, so just set DP M/N
+ 		   according to current link config */
+@@ -3102,7 +3102,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
+ 	 * PCH B stepping, previous chipset stepping should be
+ 	 * ignoring this setting.
+ 	 */
+-	if (IS_IRONLAKE(dev)) {
++	if (HAS_PCH_SPLIT(dev)) {
+ 		temp = I915_READ(PCH_DREF_CONTROL);
+ 		/* Always enable nonspread source */
+ 		temp &= ~DREF_NONSPREAD_SOURCE_MASK;
+@@ -3149,7 +3149,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
+ 				reduced_clock.m2;
+ 	}
+ 
+-	if (!IS_IRONLAKE(dev))
++	if (!HAS_PCH_SPLIT(dev))
+ 		dpll = DPLL_VGA_MODE_DIS;
+ 
+ 	if (IS_I9XX(dev)) {
+@@ -3162,7 +3162,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
+ 			sdvo_pixel_multiply = adjusted_mode->clock / mode->clock;
+ 			if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
+ 				dpll |= (sdvo_pixel_multiply - 1) << SDVO_MULTIPLIER_SHIFT_HIRES;
+-			else if (IS_IRONLAKE(dev))
++			else if (HAS_PCH_SPLIT(dev))
+ 				dpll |= (sdvo_pixel_multiply - 1) << PLL_REF_SDVO_HDMI_MULTIPLIER_SHIFT;
+ 		}
+ 		if (is_dp)
+@@ -3174,7 +3174,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
+ 		else {
+ 			dpll |= (1 << (clock.p1 - 1)) << DPLL_FPA01_P1_POST_DIV_SHIFT;
+ 			/* also FPA1 */
+-			if (IS_IRONLAKE(dev))
++			if (HAS_PCH_SPLIT(dev))
+ 				dpll |= (1 << (clock.p1 - 1)) << DPLL_FPA1_P1_POST_DIV_SHIFT;
+ 			if (IS_G4X(dev) && has_reduced_clock)
+ 				dpll |= (1 << (reduced_clock.p1 - 1)) << DPLL_FPA1_P1_POST_DIV_SHIFT;
+@@ -3193,7 +3193,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
+ 			dpll |= DPLLB_LVDS_P2_CLOCK_DIV_14;
+ 			break;
+ 		}
+-		if (IS_I965G(dev) && !IS_IRONLAKE(dev))
++		if (IS_I965G(dev) && !HAS_PCH_SPLIT(dev))
+ 			dpll |= (6 << PLL_LOAD_PULSE_PHASE_SHIFT);
+ 	} else {
+ 		if (is_lvds) {
+@@ -3227,7 +3227,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
+ 
+ 	/* Ironlake's plane is forced to pipe, bit 24 is to
+ 	   enable color space conversion */
+-	if (!IS_IRONLAKE(dev)) {
++	if (!HAS_PCH_SPLIT(dev)) {
+ 		if (pipe == 0)
+ 			dspcntr &= ~DISPPLANE_SEL_PIPE_MASK;
+ 		else
+@@ -3254,14 +3254,14 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
+ 
+ 
+ 	/* Disable the panel fitter if it was on our pipe */
+-	if (!IS_IRONLAKE(dev) && intel_panel_fitter_pipe(dev) == pipe)
++	if (!HAS_PCH_SPLIT(dev) && intel_panel_fitter_pipe(dev) == pipe)
+ 		I915_WRITE(PFIT_CONTROL, 0);
+ 
+ 	DRM_DEBUG_KMS("Mode for pipe %c:\n", pipe == 0 ? 'A' : 'B');
+ 	drm_mode_debug_printmodeline(mode);
+ 
+ 	/* assign to Ironlake registers */
+-	if (IS_IRONLAKE(dev)) {
++	if (HAS_PCH_SPLIT(dev)) {
+ 		fp_reg = pch_fp_reg;
+ 		dpll_reg = pch_dpll_reg;
+ 	}
+@@ -3282,7 +3282,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
+ 	if (is_lvds) {
+ 		u32 lvds;
+ 
+-		if (IS_IRONLAKE(dev))
++		if (HAS_PCH_SPLIT(dev))
+ 			lvds_reg = PCH_LVDS;
+ 
+ 		lvds = I915_READ(lvds_reg);
+@@ -3328,7 +3328,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
+ 		/* Wait for the clocks to stabilize. */
+ 		udelay(150);
+ 
+-		if (IS_I965G(dev) && !IS_IRONLAKE(dev)) {
++		if (IS_I965G(dev) && !HAS_PCH_SPLIT(dev)) {
+ 			if (is_sdvo) {
+ 				sdvo_pixel_multiply = adjusted_mode->clock / mode->clock;
+ 				I915_WRITE(dpll_md_reg, (0 << DPLL_MD_UDI_DIVIDER_SHIFT) |
+@@ -3375,14 +3375,14 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
+ 	/* pipesrc and dspsize control the size that is scaled from, which should
+ 	 * always be the user's requested size.
+ 	 */
+-	if (!IS_IRONLAKE(dev)) {
++	if (!HAS_PCH_SPLIT(dev)) {
+ 		I915_WRITE(dspsize_reg, ((mode->vdisplay - 1) << 16) |
+ 				(mode->hdisplay - 1));
+ 		I915_WRITE(dsppos_reg, 0);
+ 	}
+ 	I915_WRITE(pipesrc_reg, ((mode->hdisplay - 1) << 16) | (mode->vdisplay - 1));
+ 
+-	if (IS_IRONLAKE(dev)) {
++	if (HAS_PCH_SPLIT(dev)) {
+ 		I915_WRITE(data_m1_reg, TU_SIZE(m_n.tu) | m_n.gmch_m);
+ 		I915_WRITE(data_n1_reg, TU_SIZE(m_n.tu) | m_n.gmch_n);
+ 		I915_WRITE(link_m1_reg, m_n.link_m);
+@@ -3403,7 +3403,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
+ 
+ 	intel_wait_for_vblank(dev);
+ 
+-	if (IS_IRONLAKE(dev)) {
++	if (HAS_PCH_SPLIT(dev)) {
+ 		/* enable address swizzle for tiling buffer */
+ 		temp = I915_READ(DISP_ARB_CTL);
+ 		I915_WRITE(DISP_ARB_CTL, temp | DISP_TILE_SURFACE_SWIZZLING);
+@@ -3438,7 +3438,7 @@ void intel_crtc_load_lut(struct drm_crtc *crtc)
+ 		return;
+ 
+ 	/* use legacy palette for Ironlake */
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		palreg = (intel_crtc->pipe == 0) ? LGC_PALETTE_A :
+ 						   LGC_PALETTE_B;
+ 
+@@ -3922,7 +3922,7 @@ static void intel_increase_pllclock(struct drm_crtc *crtc, bool schedule)
+ 	int dpll_reg = (pipe == 0) ? DPLL_A : DPLL_B;
+ 	int dpll = I915_READ(dpll_reg);
+ 
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		return;
+ 
+ 	if (!dev_priv->lvds_downclock_avail)
+@@ -3961,7 +3961,7 @@ static void intel_decrease_pllclock(struct drm_crtc *crtc)
+ 	int dpll_reg = (pipe == 0) ? DPLL_A : DPLL_B;
+ 	int dpll = I915_READ(dpll_reg);
+ 
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		return;
+ 
+ 	if (!dev_priv->lvds_downclock_avail)
+@@ -4382,7 +4382,7 @@ static void intel_setup_outputs(struct drm_device *dev)
+ 	if (IS_MOBILE(dev) && !IS_I830(dev))
+ 		intel_lvds_init(dev);
+ 
+-	if (IS_IRONLAKE(dev)) {
++	if (HAS_PCH_SPLIT(dev)) {
+ 		int found;
+ 
+ 		if (IS_MOBILE(dev) && (I915_READ(DP_A) & DP_DETECTED))
+@@ -4451,7 +4451,7 @@ static void intel_setup_outputs(struct drm_device *dev)
+ 			DRM_DEBUG_KMS("probing DP_D\n");
+ 			intel_dp_init(dev, DP_D);
+ 		}
+-	} else if (IS_I8XX(dev))
++	} else if (IS_GEN2(dev))
+ 		intel_dvo_init(dev);
+ 
+ 	if (SUPPORTS_TV(dev))
+@@ -4599,7 +4599,7 @@ void intel_init_clock_gating(struct drm_device *dev)
+ 	 * Disable clock gating reported to work incorrectly according to the
+ 	 * specs, but enable as much else as we can.
+ 	 */
+-	if (IS_IRONLAKE(dev)) {
++	if (HAS_PCH_SPLIT(dev)) {
+ 		return;
+ 	} else if (IS_G4X(dev)) {
+ 		uint32_t dspclk_gate;
+@@ -4672,7 +4672,7 @@ static void intel_init_display(struct drm_device *dev)
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 
+ 	/* We always want a DPMS function */
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		dev_priv->display.dpms = ironlake_crtc_dpms;
+ 	else
+ 		dev_priv->display.dpms = i9xx_crtc_dpms;
+@@ -4715,7 +4715,7 @@ static void intel_init_display(struct drm_device *dev)
+ 			i830_get_display_clock_speed;
+ 
+ 	/* For FIFO watermark updates */
+-	if (IS_IRONLAKE(dev))
++	if (HAS_PCH_SPLIT(dev))
+ 		dev_priv->display.update_wm = NULL;
+ 	else if (IS_G4X(dev))
+ 		dev_priv->display.update_wm = g4x_update_wm;
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index 1238bc9..66df0c3 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -661,7 +661,7 @@ static enum drm_connector_status intel_lvds_detect(struct drm_connector *connect
+ 	/* ACPI lid methods were generally unreliable in this generation, so
+ 	 * don't even bother.
+ 	 */
+-	if (IS_I8XX(dev))
++	if (IS_GEN2(dev))
+ 		return connector_status_connected;
+ 
+ 	if (!dmi_check_system(bad_lid_status) && !acpi_lid_open())
+diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
+index 63f569b..6b89042 100644
+--- a/drivers/gpu/drm/i915/intel_overlay.c
++++ b/drivers/gpu/drm/i915/intel_overlay.c
+@@ -172,7 +172,7 @@ struct overlay_registers {
+ #define OFC_UPDATE		0x1
+ 
+ #define OVERLAY_NONPHYSICAL(dev) (IS_G33(dev) || IS_I965G(dev))
+-#define OVERLAY_EXISTS(dev) (!IS_G4X(dev) && !IS_IRONLAKE(dev))
++#define OVERLAY_EXISTS(dev) (!IS_G4X(dev) && !IS_IRONLAKE(dev) && !IS_GEN6(dev))
+ 
+ 
+ static struct overlay_registers *intel_overlay_map_regs_atomic(struct intel_overlay *overlay)
+diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
+index 10be7b5..855911e 100644
+--- a/drivers/i2c/i2c-core.c
++++ b/drivers/i2c/i2c-core.c
+@@ -1210,12 +1210,23 @@ static int i2c_detect_address(struct i2c_client *temp_client,
+ 		return 0;
+ 
+ 	/* Make sure there is something at this address */
+-	if (i2c_smbus_xfer(adapter, addr, 0, 0, 0, I2C_SMBUS_QUICK, NULL) < 0)
+-		return 0;
++	if (addr == 0x73 && (adapter->class & I2C_CLASS_HWMON)) {
++		/* Special probe for FSC hwmon chips */
++		union i2c_smbus_data dummy;
+ 
+-	/* Prevent 24RF08 corruption */
+-	if ((addr & ~0x0f) == 0x50)
+-		i2c_smbus_xfer(adapter, addr, 0, 0, 0, I2C_SMBUS_QUICK, NULL);
++		if (i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_READ, 0,
++				   I2C_SMBUS_BYTE_DATA, &dummy) < 0)
++			return 0;
++	} else {
++		if (i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_WRITE, 0,
++				   I2C_SMBUS_QUICK, NULL) < 0)
++			return 0;
++
++		/* Prevent 24RF08 corruption */
++		if ((addr & ~0x0f) == 0x50)
++			i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_WRITE, 0,
++				       I2C_SMBUS_QUICK, NULL);
++	}
+ 
+ 	/* Finally call the custom detection function */
+ 	memset(&info, 0, sizeof(struct i2c_board_info));
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index a20a71e..2ecd1d5 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2108,12 +2108,18 @@ repeat:
+ 		if (!mddev->in_sync || mddev->recovery_cp != MaxSector) { /* not clean */
+ 			/* .. if the array isn't clean, an 'even' event must also go
+ 			 * to spares. */
+-			if ((mddev->events&1)==0)
++			if ((mddev->events&1)==0) {
+ 				nospares = 0;
++				sync_req = 2; /* force a second update to get the
++					       * even/odd in sync */
++			}
+ 		} else {
+ 			/* otherwise an 'odd' event must go to spares */
+-			if ((mddev->events&1))
++			if ((mddev->events&1)) {
+ 				nospares = 0;
++				sync_req = 2; /* force a second update to get the
++					       * even/odd in sync */
++			}
+ 		}
+ 	}
+ 
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index ceb24af..0468f5b 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -1526,7 +1526,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
+ 
+ 		clear_bit(R5_UPTODATE, &sh->dev[i].flags);
+ 		atomic_inc(&rdev->read_errors);
+-		if (conf->mddev->degraded)
++		if (conf->mddev->degraded >= conf->max_degraded)
+ 			printk_rl(KERN_WARNING
+ 				  "raid5:%s: read error not correctable "
+ 				  "(sector %llu on %s).\n",
+@@ -1649,8 +1649,8 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
+ 				     int previous, int *dd_idx,
+ 				     struct stripe_head *sh)
+ {
+-	long stripe;
+-	unsigned long chunk_number;
++	sector_t stripe, stripe2;
++	sector_t chunk_number;
+ 	unsigned int chunk_offset;
+ 	int pd_idx, qd_idx;
+ 	int ddf_layout = 0;
+@@ -1670,18 +1670,13 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
+ 	 */
+ 	chunk_offset = sector_div(r_sector, sectors_per_chunk);
+ 	chunk_number = r_sector;
+-	BUG_ON(r_sector != chunk_number);
+ 
+ 	/*
+ 	 * Compute the stripe number
+ 	 */
+-	stripe = chunk_number / data_disks;
+-
+-	/*
+-	 * Compute the data disk and parity disk indexes inside the stripe
+-	 */
+-	*dd_idx = chunk_number % data_disks;
+-
++	stripe = chunk_number;
++	*dd_idx = sector_div(stripe, data_disks);
++	stripe2 = stripe;
+ 	/*
+ 	 * Select the parity disk based on the user selected algorithm.
+ 	 */
+@@ -1693,21 +1688,21 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
+ 	case 5:
+ 		switch (algorithm) {
+ 		case ALGORITHM_LEFT_ASYMMETRIC:
+-			pd_idx = data_disks - stripe % raid_disks;
++			pd_idx = data_disks - sector_div(stripe2, raid_disks);
+ 			if (*dd_idx >= pd_idx)
+ 				(*dd_idx)++;
+ 			break;
+ 		case ALGORITHM_RIGHT_ASYMMETRIC:
+-			pd_idx = stripe % raid_disks;
++			pd_idx = sector_div(stripe2, raid_disks);
+ 			if (*dd_idx >= pd_idx)
+ 				(*dd_idx)++;
+ 			break;
+ 		case ALGORITHM_LEFT_SYMMETRIC:
+-			pd_idx = data_disks - stripe % raid_disks;
++			pd_idx = data_disks - sector_div(stripe2, raid_disks);
+ 			*dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
+ 			break;
+ 		case ALGORITHM_RIGHT_SYMMETRIC:
+-			pd_idx = stripe % raid_disks;
++			pd_idx = sector_div(stripe2, raid_disks);
+ 			*dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
+ 			break;
+ 		case ALGORITHM_PARITY_0:
+@@ -1727,7 +1722,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
+ 
+ 		switch (algorithm) {
+ 		case ALGORITHM_LEFT_ASYMMETRIC:
+-			pd_idx = raid_disks - 1 - (stripe % raid_disks);
++			pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
+ 			qd_idx = pd_idx + 1;
+ 			if (pd_idx == raid_disks-1) {
+ 				(*dd_idx)++;	/* Q D D D P */
+@@ -1736,7 +1731,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
+ 				(*dd_idx) += 2; /* D D P Q D */
+ 			break;
+ 		case ALGORITHM_RIGHT_ASYMMETRIC:
+-			pd_idx = stripe % raid_disks;
++			pd_idx = sector_div(stripe2, raid_disks);
+ 			qd_idx = pd_idx + 1;
+ 			if (pd_idx == raid_disks-1) {
+ 				(*dd_idx)++;	/* Q D D D P */
+@@ -1745,12 +1740,12 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
+ 				(*dd_idx) += 2; /* D D P Q D */
+ 			break;
+ 		case ALGORITHM_LEFT_SYMMETRIC:
+-			pd_idx = raid_disks - 1 - (stripe % raid_disks);
++			pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
+ 			qd_idx = (pd_idx + 1) % raid_disks;
+ 			*dd_idx = (pd_idx + 2 + *dd_idx) % raid_disks;
+ 			break;
+ 		case ALGORITHM_RIGHT_SYMMETRIC:
+-			pd_idx = stripe % raid_disks;
++			pd_idx = sector_div(stripe2, raid_disks);
+ 			qd_idx = (pd_idx + 1) % raid_disks;
+ 			*dd_idx = (pd_idx + 2 + *dd_idx) % raid_disks;
+ 			break;
+@@ -1769,7 +1764,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
+ 			/* Exactly the same as RIGHT_ASYMMETRIC, but or
+ 			 * of blocks for computing Q is different.
+ 			 */
+-			pd_idx = stripe % raid_disks;
++			pd_idx = sector_div(stripe2, raid_disks);
+ 			qd_idx = pd_idx + 1;
+ 			if (pd_idx == raid_disks-1) {
+ 				(*dd_idx)++;	/* Q D D D P */
+@@ -1784,7 +1779,8 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
+ 			 * D D D P Q  rather than
+ 			 * Q D D D P
+ 			 */
+-			pd_idx = raid_disks - 1 - ((stripe + 1) % raid_disks);
++			stripe2 += 1;
++			pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
+ 			qd_idx = pd_idx + 1;
+ 			if (pd_idx == raid_disks-1) {
+ 				(*dd_idx)++;	/* Q D D D P */
+@@ -1796,7 +1792,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
+ 
+ 		case ALGORITHM_ROTATING_N_CONTINUE:
+ 			/* Same as left_symmetric but Q is before P */
+-			pd_idx = raid_disks - 1 - (stripe % raid_disks);
++			pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
+ 			qd_idx = (pd_idx + raid_disks - 1) % raid_disks;
+ 			*dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
+ 			ddf_layout = 1;
+@@ -1804,27 +1800,27 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
+ 
+ 		case ALGORITHM_LEFT_ASYMMETRIC_6:
+ 			/* RAID5 left_asymmetric, with Q on last device */
+-			pd_idx = data_disks - stripe % (raid_disks-1);
++			pd_idx = data_disks - sector_div(stripe2, raid_disks-1);
+ 			if (*dd_idx >= pd_idx)
+ 				(*dd_idx)++;
+ 			qd_idx = raid_disks - 1;
+ 			break;
+ 
+ 		case ALGORITHM_RIGHT_ASYMMETRIC_6:
+-			pd_idx = stripe % (raid_disks-1);
++			pd_idx = sector_div(stripe2, raid_disks-1);
+ 			if (*dd_idx >= pd_idx)
+ 				(*dd_idx)++;
+ 			qd_idx = raid_disks - 1;
+ 			break;
+ 
+ 		case ALGORITHM_LEFT_SYMMETRIC_6:
+-			pd_idx = data_disks - stripe % (raid_disks-1);
++			pd_idx = data_disks - sector_div(stripe2, raid_disks-1);
+ 			*dd_idx = (pd_idx + 1 + *dd_idx) % (raid_disks-1);
+ 			qd_idx = raid_disks - 1;
+ 			break;
+ 
+ 		case ALGORITHM_RIGHT_SYMMETRIC_6:
+-			pd_idx = stripe % (raid_disks-1);
++			pd_idx = sector_div(stripe2, raid_disks-1);
+ 			*dd_idx = (pd_idx + 1 + *dd_idx) % (raid_disks-1);
+ 			qd_idx = raid_disks - 1;
+ 			break;
+@@ -1869,14 +1865,14 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
+ 				 : conf->algorithm;
+ 	sector_t stripe;
+ 	int chunk_offset;
+-	int chunk_number, dummy1, dd_idx = i;
++	sector_t chunk_number;
++	int dummy1, dd_idx = i;
+ 	sector_t r_sector;
+ 	struct stripe_head sh2;
+ 
+ 
+ 	chunk_offset = sector_div(new_sector, sectors_per_chunk);
+ 	stripe = new_sector;
+-	BUG_ON(new_sector != stripe);
+ 
+ 	if (i == sh->pd_idx)
+ 		return 0;
+@@ -1969,7 +1965,7 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
+ 	}
+ 
+ 	chunk_number = stripe * data_disks + i;
+-	r_sector = (sector_t)chunk_number * sectors_per_chunk + chunk_offset;
++	r_sector = chunk_number * sectors_per_chunk + chunk_offset;
+ 
+ 	check = raid5_compute_sector(conf, r_sector,
+ 				     previous, &dummy1, &sh2);
+diff --git a/drivers/media/dvb/ttpci/budget.c b/drivers/media/dvb/ttpci/budget.c
+index e48380c..95a463c 100644
+--- a/drivers/media/dvb/ttpci/budget.c
++++ b/drivers/media/dvb/ttpci/budget.c
+@@ -643,9 +643,6 @@ static void frontend_init(struct budget *budget)
+ 					&budget->i2c_adap,
+ 					&tt1600_isl6423_config);
+ 
+-			} else {
+-				dvb_frontend_detach(budget->dvb_frontend);
+-				budget->dvb_frontend = NULL;
+ 			}
+ 		}
+ 		break;
+diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
+index 65df1de..a555c90 100644
+--- a/drivers/net/bnx2.c
++++ b/drivers/net/bnx2.c
+@@ -4772,8 +4772,12 @@ bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
+ 		rc = bnx2_alloc_bad_rbuf(bp);
+ 	}
+ 
+-	if (bp->flags & BNX2_FLAG_USING_MSIX)
++	if (bp->flags & BNX2_FLAG_USING_MSIX) {
+ 		bnx2_setup_msix_tbl(bp);
++		/* Prevent MSIX table reads and write from timing out */
++		REG_WR(bp, BNX2_MISC_ECO_HW_CTL,
++			BNX2_MISC_ECO_HW_CTL_LARGE_GRC_TMOUT_EN);
++	}
+ 
+ 	return rc;
+ }
+diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
+index 3db85da..787befc 100644
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -2832,8 +2832,13 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
+ 	spin_lock_irq(&tp->lock);
+ 
+ 	RTL_W8(Cfg9346, Cfg9346_Unlock);
+-	RTL_W32(MAC0, low);
++
+ 	RTL_W32(MAC4, high);
++	RTL_R32(MAC4);
++
++	RTL_W32(MAC0, low);
++	RTL_R32(MAC0);
++
+ 	RTL_W8(Cfg9346, Cfg9346_Lock);
+ 
+ 	spin_unlock_irq(&tp->lock);
+@@ -4316,7 +4321,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
+ 
+ 	tp->cur_tx += frags + 1;
+ 
+-	smp_wmb();
++	wmb();
+ 
+ 	RTL_W8(TxPoll, NPQ);	/* set polling bit */
+ 
+@@ -4675,7 +4680,7 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
+ 		 * until it does.
+ 		 */
+ 		tp->intr_mask = 0xffff;
+-		smp_wmb();
++		wmb();
+ 		RTL_W16(IntrMask, tp->intr_event);
+ 	}
+ 
+@@ -4813,8 +4818,8 @@ static void rtl_set_rx_mode(struct net_device *dev)
+ 		mc_filter[1] = swab32(data);
+ 	}
+ 
+-	RTL_W32(MAR0 + 0, mc_filter[0]);
+ 	RTL_W32(MAR0 + 4, mc_filter[1]);
++	RTL_W32(MAR0 + 0, mc_filter[0]);
+ 
+ 	RTL_W32(RxConfig, tmp);
+ 
+diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
+index 46997e1..fb52e47 100644
+--- a/drivers/net/sfc/efx.c
++++ b/drivers/net/sfc/efx.c
+@@ -1862,6 +1862,7 @@ out:
+ 	}
+ 
+ 	if (disabled) {
++		dev_close(efx->net_dev);
+ 		EFX_ERR(efx, "has been disabled\n");
+ 		efx->state = STATE_DISABLED;
+ 	} else {
+@@ -1885,8 +1886,7 @@ static void efx_reset_work(struct work_struct *data)
+ 	}
+ 
+ 	rtnl_lock();
+-	if (efx_reset(efx, efx->reset_pending))
+-		dev_close(efx->net_dev);
++	(void)efx_reset(efx, efx->reset_pending);
+ 	rtnl_unlock();
+ }
+ 
+diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
+index 9d009c4..e20a824 100644
+--- a/drivers/net/sfc/falcon.c
++++ b/drivers/net/sfc/falcon.c
+@@ -1317,7 +1317,9 @@ static int falcon_probe_nvconfig(struct efx_nic *efx)
+ 
+ 	EFX_LOG(efx, "PHY is %d phy_id %d\n", efx->phy_type, efx->mdio.prtad);
+ 
+-	falcon_probe_board(efx, board_rev);
++	rc = falcon_probe_board(efx, board_rev);
++	if (rc)
++		goto fail2;
+ 
+ 	kfree(nvconfig);
+ 	return 0;
+diff --git a/drivers/net/sfc/falcon_boards.c b/drivers/net/sfc/falcon_boards.c
+index 5712fdd..c7a933a 100644
+--- a/drivers/net/sfc/falcon_boards.c
++++ b/drivers/net/sfc/falcon_boards.c
+@@ -728,15 +728,7 @@ static const struct falcon_board_type board_types[] = {
+ 	},
+ };
+ 
+-static const struct falcon_board_type falcon_dummy_board = {
+-	.init		= efx_port_dummy_op_int,
+-	.init_phy	= efx_port_dummy_op_void,
+-	.fini		= efx_port_dummy_op_void,
+-	.set_id_led	= efx_port_dummy_op_set_id_led,
+-	.monitor	= efx_port_dummy_op_int,
+-};
+-
+-void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
++int falcon_probe_board(struct efx_nic *efx, u16 revision_info)
+ {
+ 	struct falcon_board *board = falcon_board(efx);
+ 	u8 type_id = FALCON_BOARD_TYPE(revision_info);
+@@ -754,8 +746,9 @@ void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
+ 			 (efx->pci_dev->subsystem_vendor == EFX_VENDID_SFC)
+ 			 ? board->type->ref_model : board->type->gen_type,
+ 			 'A' + board->major, board->minor);
++		return 0;
+ 	} else {
+ 		EFX_ERR(efx, "unknown board type %d\n", type_id);
+-		board->type = &falcon_dummy_board;
++		return -ENODEV;
+ 	}
+ }
+diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
+index 9351c03..3166baf 100644
+--- a/drivers/net/sfc/nic.h
++++ b/drivers/net/sfc/nic.h
+@@ -156,7 +156,7 @@ extern struct efx_nic_type siena_a0_nic_type;
+  **************************************************************************
+  */
+ 
+-extern void falcon_probe_board(struct efx_nic *efx, u16 revision_info);
++extern int falcon_probe_board(struct efx_nic *efx, u16 revision_info);
+ 
+ /* TX data path */
+ extern int efx_nic_probe_tx(struct efx_tx_queue *tx_queue);
+diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
+index f8c6771..afbac2d 100644
+--- a/drivers/net/sfc/siena.c
++++ b/drivers/net/sfc/siena.c
+@@ -454,8 +454,17 @@ static int siena_try_update_nic_stats(struct efx_nic *efx)
+ 
+ static void siena_update_nic_stats(struct efx_nic *efx)
+ {
+-	while (siena_try_update_nic_stats(efx) == -EAGAIN)
+-		cpu_relax();
++	int retry;
++
++	/* If we're unlucky enough to read statistics wduring the DMA, wait
++	 * up to 10ms for it to finish (typically takes <500us) */
++	for (retry = 0; retry < 100; ++retry) {
++		if (siena_try_update_nic_stats(efx) == 0)
++			return;
++		udelay(100);
++	}
++
++	/* Use the old values instead */
+ }
+ 
+ static void siena_start_nic_stats(struct efx_nic *efx)
+diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
+index 17d1493..8405fb8 100644
+--- a/drivers/net/tg3.c
++++ b/drivers/net/tg3.c
+@@ -8572,6 +8572,7 @@ static int tg3_test_msi(struct tg3 *tp)
+ 	pci_disable_msi(tp->pdev);
+ 
+ 	tp->tg3_flags2 &= ~TG3_FLG2_USING_MSI;
++	tp->napi[0].irq_vec = tp->pdev->irq;
+ 
+ 	err = tg3_request_irq(tp, 0);
+ 	if (err)
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 2834a01..909b73d 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -380,6 +380,10 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
+ 		}
+ 	}
+ 
++	/* Orphan the skb - required as we might hang on to it
++	 * for indefinite time. */
++	skb_orphan(skb);
++
+ 	/* Enqueue packet */
+ 	skb_queue_tail(&tun->socket.sk->sk_receive_queue, skb);
+ 	dev->trans_start = jiffies;
+diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
+index 5f3b9ea..8a6e027 100644
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -433,6 +433,7 @@ static const struct driver_info mbm_info = {
+ 	.bind = 	cdc_bind,
+ 	.unbind =	usbnet_cdc_unbind,
+ 	.status =	cdc_status,
++	.manage_power =	cdc_manage_power,
+ };
+ 
+ /*-------------------------------------------------------------------------*/
+diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
+index 3d406f9..c60625b 100644
+--- a/drivers/net/usb/dm9601.c
++++ b/drivers/net/usb/dm9601.c
+@@ -238,7 +238,7 @@ static int dm_write_shared_word(struct usbnet *dev, int phy, u8 reg, __le16 valu
+ 		goto out;
+ 
+ 	dm_write_reg(dev, DM_SHARED_ADDR, phy ? (reg | 0x40) : reg);
+-	dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1c : 0x14);
++	dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1a : 0x12);
+ 
+ 	for (i = 0; i < DM_TIMEOUT; i++) {
+ 		u8 tmp;
+diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
+index b9b9d6b..941f053 100644
+--- a/drivers/net/wan/hdlc_ppp.c
++++ b/drivers/net/wan/hdlc_ppp.c
+@@ -628,9 +628,15 @@ static void ppp_stop(struct net_device *dev)
+ 	ppp_cp_event(dev, PID_LCP, STOP, 0, 0, 0, NULL);
+ }
+ 
++static void ppp_close(struct net_device *dev)
++{
++	ppp_tx_flush();
++}
++
+ static struct hdlc_proto proto = {
+ 	.start		= ppp_start,
+ 	.stop		= ppp_stop,
++	.close		= ppp_close,
+ 	.type_trans	= ppp_type_trans,
+ 	.ioctl		= ppp_ioctl,
+ 	.netif_rx	= ppp_rx,
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 7b1eab4..e55f718 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1358,9 +1358,9 @@ void ath_cleanup(struct ath_softc *sc)
+ 	free_irq(sc->irq, sc);
+ 	ath_bus_cleanup(common);
+ 	kfree(sc->sec_wiphy);
+-	ieee80211_free_hw(sc->hw);
+ 
+ 	ath9k_uninit_hw(sc);
++	ieee80211_free_hw(sc->hw);
+ }
+ 
+ static int ath9k_reg_notifier(struct wiphy *wiphy,
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index 4bf4c21..41d33cd 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -245,7 +245,7 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+ 	u32 idx, i;
+ 
+ 	i = (*index) % ring_limit;
+-	(*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
++	(*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
+ 	idx %= ring_limit;
+ 
+ 	while (i != idx) {
+diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
+index 8742640..b3c4fbd 100644
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -36,6 +36,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
+ 	/* Version 1 devices (pci chip + net2280) */
+ 	{USB_DEVICE(0x0506, 0x0a11)},	/* 3COM 3CRWE254G72 */
+ 	{USB_DEVICE(0x0707, 0xee06)},	/* SMC 2862W-G */
++	{USB_DEVICE(0x07aa, 0x001c)},	/* Corega CG-WLUSB2GT */
+ 	{USB_DEVICE(0x083a, 0x4501)},	/* Accton 802.11g WN4501 USB */
+ 	{USB_DEVICE(0x083a, 0x4502)},	/* Siemens Gigaset USB Adapter */
+ 	{USB_DEVICE(0x083a, 0x5501)},	/* Phillips CPWUA054 */
+diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
+index b6dda2b..9d147de 100644
+--- a/drivers/net/wireless/p54/txrx.c
++++ b/drivers/net/wireless/p54/txrx.c
+@@ -186,7 +186,7 @@ static int p54_tx_qos_accounting_alloc(struct p54_common *priv,
+ 	struct ieee80211_tx_queue_stats *queue;
+ 	unsigned long flags;
+ 
+-	if (WARN_ON(p54_queue > P54_QUEUE_NUM))
++	if (WARN_ON(p54_queue >= P54_QUEUE_NUM))
+ 		return -EINVAL;
+ 
+ 	queue = &priv->tx_stats[p54_queue];
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index c4fead1..b8eb5e7 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -624,7 +624,7 @@ static void __pci_start_power_transition(struct pci_dev *dev, pci_power_t state)
+  */
+ int __pci_complete_power_transition(struct pci_dev *dev, pci_power_t state)
+ {
+-	return state > PCI_D0 ?
++	return state >= PCI_D0 ?
+ 			pci_platform_power_transition(dev, state) : -EINVAL;
+ }
+ EXPORT_SYMBOL_GPL(__pci_complete_power_transition);
+@@ -661,10 +661,6 @@ int pci_set_power_state(struct pci_dev *dev, pci_power_t state)
+ 		 */
+ 		return 0;
+ 
+-	/* Check if we're already there */
+-	if (dev->current_state == state)
+-		return 0;
+-
+ 	__pci_start_power_transition(dev, state);
+ 
+ 	/* This device is quirked not to be put into D3, so
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index e6b67f2..741672f 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -470,12 +470,12 @@ static int iscsi_prep_scsi_cmd_pdu(struct iscsi_task *task)
+ 
+ 	WARN_ON(hdrlength >= 256);
+ 	hdr->hlength = hdrlength & 0xFF;
++	hdr->cmdsn = task->cmdsn = cpu_to_be32(session->cmdsn);
+ 
+ 	if (session->tt->init_task && session->tt->init_task(task))
+ 		return -EIO;
+ 
+ 	task->state = ISCSI_TASK_RUNNING;
+-	hdr->cmdsn = task->cmdsn = cpu_to_be32(session->cmdsn);
+ 	session->cmdsn++;
+ 
+ 	conn->scsicmd_pdus_cnt++;
+diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
+index e155011..816ab97 100644
+--- a/drivers/scsi/libsas/sas_ata.c
++++ b/drivers/scsi/libsas/sas_ata.c
+@@ -394,11 +394,15 @@ int sas_ata_init_host_and_port(struct domain_device *found_dev,
+ void sas_ata_task_abort(struct sas_task *task)
+ {
+ 	struct ata_queued_cmd *qc = task->uldd_task;
++	struct request_queue *q = qc->scsicmd->device->request_queue;
+ 	struct completion *waiting;
++	unsigned long flags;
+ 
+ 	/* Bounce SCSI-initiated commands to the SCSI EH */
+ 	if (qc->scsicmd) {
++		spin_lock_irqsave(q->queue_lock, flags);
+ 		blk_abort_request(qc->scsicmd->request);
++		spin_unlock_irqrestore(q->queue_lock, flags);
+ 		scsi_schedule_eh(qc->scsicmd->device->host);
+ 		return;
+ 	}
+diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
+index 14b1319..b672d10 100644
+--- a/drivers/scsi/libsas/sas_scsi_host.c
++++ b/drivers/scsi/libsas/sas_scsi_host.c
+@@ -1029,6 +1029,8 @@ int __sas_task_abort(struct sas_task *task)
+ void sas_task_abort(struct sas_task *task)
+ {
+ 	struct scsi_cmnd *sc = task->uldd_task;
++	struct request_queue *q = sc->device->request_queue;
++	unsigned long flags;
+ 
+ 	/* Escape for libsas internal commands */
+ 	if (!sc) {
+@@ -1043,7 +1045,9 @@ void sas_task_abort(struct sas_task *task)
+ 		return;
+ 	}
+ 
++	spin_lock_irqsave(q->queue_lock, flags);
+ 	blk_abort_request(sc->request);
++	spin_unlock_irqrestore(q->queue_lock, flags);
+ 	scsi_schedule_eh(sc->device->host);
+ }
+ 
+diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
+index 0b575c8..aa2a2dc 100644
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -956,7 +956,8 @@ static int resp_start_stop(struct scsi_cmnd * scp,
+ static sector_t get_sdebug_capacity(void)
+ {
+ 	if (scsi_debug_virtual_gb > 0)
+-		return 2048 * 1024 * (sector_t)scsi_debug_virtual_gb;
++		return (sector_t)scsi_debug_virtual_gb *
++			(1073741824 / scsi_debug_sector_size);
+ 	else
+ 		return sdebug_store_sectors;
+ }
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index 08ed506..e46155b 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -301,7 +301,20 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
+ 		if (scmd->device->allow_restart &&
+ 		    (sshdr.asc == 0x04) && (sshdr.ascq == 0x02))
+ 			return FAILED;
+-		return SUCCESS;
++
++		if (blk_barrier_rq(scmd->request))
++			/*
++			 * barrier requests should always retry on UA
++			 * otherwise block will get a spurious error
++			 */
++			return NEEDS_RETRY;
++		else
++			/*
++			 * for normal (non barrier) commands, pass the
++			 * UA upwards for a determination in the
++			 * completion functions
++			 */
++			return SUCCESS;
+ 
+ 		/* these three are not supported */
+ 	case COPY_ABORTED:
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index c664242..5697709 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -773,8 +773,14 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
+ 	 * we already took a copy of the original into rq->errors which
+ 	 * is what gets returned to the user
+ 	 */
+-	if (sense_valid && sshdr.sense_key == RECOVERED_ERROR) {
+-		if (!(req->cmd_flags & REQ_QUIET))
++	if (sense_valid && (sshdr.sense_key == RECOVERED_ERROR)) {
++		/* if ATA PASS-THROUGH INFORMATION AVAILABLE skip
++		 * print since caller wants ATA registers. Only occurs on
++		 * SCSI ATA PASS_THROUGH commands when CK_COND=1
++		 */
++		if ((sshdr.asc == 0x0) && (sshdr.ascq == 0x1d))
++			;
++		else if (!(req->cmd_flags & REQ_QUIET))
+ 			scsi_print_sense("", cmd);
+ 		result = 0;
+ 		/* BLOCK_PC may have set error */
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 255da53..bf15920 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1039,6 +1039,7 @@ static void sd_prepare_flush(struct request_queue *q, struct request *rq)
+ {
+ 	rq->cmd_type = REQ_TYPE_BLOCK_PC;
+ 	rq->timeout = SD_TIMEOUT;
++	rq->retries = SD_MAX_RETRIES;
+ 	rq->cmd[0] = SYNCHRONIZE_CACHE;
+ 	rq->cmd_len = 10;
+ }
+diff --git a/drivers/serial/8250_pnp.c b/drivers/serial/8250_pnp.c
+index 24485cc..4822cb5 100644
+--- a/drivers/serial/8250_pnp.c
++++ b/drivers/serial/8250_pnp.c
+@@ -348,6 +348,8 @@ static const struct pnp_device_id pnp_dev_table[] = {
+ 	{	"FUJ02E6",		0	},
+ 	/* Fujitsu Wacom 2FGT Tablet PC device */
+ 	{	"FUJ02E7",		0	},
++	/* Fujitsu Wacom 1FGT Tablet PC device */
++	{	"FUJ02E9",		0	},
+ 	/*
+ 	 * LG C1 EXPRESS DUAL (C1-PB11A3) touch screen (actually a FUJ02E6 in
+ 	 * disguise)
+diff --git a/drivers/staging/hv/Hv.c b/drivers/staging/hv/Hv.c
+index c2809f2..b12237f 100644
+--- a/drivers/staging/hv/Hv.c
++++ b/drivers/staging/hv/Hv.c
+@@ -306,9 +306,9 @@ void HvCleanup(void)
+ 	DPRINT_ENTER(VMBUS);
+ 
+ 	if (gHvContext.SignalEventBuffer) {
++		kfree(gHvContext.SignalEventBuffer);
+ 		gHvContext.SignalEventBuffer = NULL;
+ 		gHvContext.SignalEventParam = NULL;
+-		kfree(gHvContext.SignalEventBuffer);
+ 	}
+ 
+ 	if (gHvContext.GuestId == HV_LINUX_GUEST_ID) {
+diff --git a/drivers/staging/hv/RndisFilter.c b/drivers/staging/hv/RndisFilter.c
+index 26d7997..f05f4e1 100644
+--- a/drivers/staging/hv/RndisFilter.c
++++ b/drivers/staging/hv/RndisFilter.c
+@@ -756,6 +756,7 @@ static int RndisFilterOpenDevice(struct rndis_device *Device)
+ 
+ 	ret = RndisFilterSetPacketFilter(Device,
+ 					 NDIS_PACKET_TYPE_BROADCAST |
++					 NDIS_PACKET_TYPE_ALL_MULTICAST |
+ 					 NDIS_PACKET_TYPE_DIRECTED);
+ 	if (ret == 0)
+ 		Device->State = RNDIS_DEV_DATAINITIALIZED;
+diff --git a/drivers/staging/hv/netvsc_drv.c b/drivers/staging/hv/netvsc_drv.c
+index 0d7459e..4c3c8bc 100644
+--- a/drivers/staging/hv/netvsc_drv.c
++++ b/drivers/staging/hv/netvsc_drv.c
+@@ -413,8 +413,7 @@ static int netvsc_probe(struct device *device)
+ 	if (!net_drv_obj->Base.OnDeviceAdd)
+ 		return -1;
+ 
+-	net = alloc_netdev(sizeof(struct net_device_context), "seth%d",
+-			   ether_setup);
++	net = alloc_etherdev(sizeof(struct net_device_context));
+ 	if (!net)
+ 		return -1;
+ 
+diff --git a/drivers/staging/usbip/usbip_event.c b/drivers/staging/usbip/usbip_event.c
+index 6da1021..a2566f1 100644
+--- a/drivers/staging/usbip/usbip_event.c
++++ b/drivers/staging/usbip/usbip_event.c
+@@ -117,6 +117,9 @@ void usbip_stop_eh(struct usbip_device *ud)
+ {
+ 	struct usbip_task *eh = &ud->eh;
+ 
++	if (eh->thread == current)
++		return; /* do not wait for myself */
++
+ 	wait_for_completion(&eh->thread_done);
+ 	usbip_dbg_eh("usbip_eh has finished\n");
+ }
+diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
+index ca479a7..d9d0bf5 100644
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -1255,9 +1255,8 @@ static int usb_suspend_both(struct usb_device *udev, pm_message_t msg)
+ 			udev->state == USB_STATE_SUSPENDED)
+ 		goto done;
+ 
+-	udev->do_remote_wakeup = device_may_wakeup(&udev->dev);
+-
+ 	if (msg.event & PM_EVENT_AUTO) {
++		udev->do_remote_wakeup = device_may_wakeup(&udev->dev);
+ 		status = autosuspend_check(udev, 0);
+ 		if (status < 0)
+ 			goto done;
+@@ -1789,6 +1788,34 @@ int usb_external_resume_device(struct usb_device *udev, pm_message_t msg)
+ 	return status;
+ }
+ 
++static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
++{
++	int			w, i;
++	struct usb_interface	*intf;
++
++	/* Remote wakeup is needed only when we actually go to sleep.
++	 * For things like FREEZE and QUIESCE, if the device is already
++	 * autosuspended then its current wakeup setting is okay.
++	 */
++	if (msg.event == PM_EVENT_FREEZE || msg.event == PM_EVENT_QUIESCE) {
++		udev->do_remote_wakeup = 0;
++		return;
++	}
++
++	/* If remote wakeup is permitted, see whether any interface drivers
++	 * actually want it.
++	 */
++	w = 0;
++	if (device_may_wakeup(&udev->dev) && udev->actconfig) {
++		for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
++			intf = udev->actconfig->interface[i];
++			w |= intf->needs_remote_wakeup;
++		}
++	}
++
++	udev->do_remote_wakeup = w;
++}
++
+ int usb_suspend(struct device *dev, pm_message_t msg)
+ {
+ 	struct usb_device	*udev;
+@@ -1808,6 +1835,7 @@ int usb_suspend(struct device *dev, pm_message_t msg)
+ 	}
+ 
+ 	udev->skip_sys_resume = 0;
++	choose_wakeup(udev, msg);
+ 	return usb_external_suspend_device(udev, msg);
+ }
+ 
+diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
+index bdf87a8..2c95153 100644
+--- a/drivers/usb/core/generic.c
++++ b/drivers/usb/core/generic.c
+@@ -120,7 +120,7 @@ int usb_choose_configuration(struct usb_device *udev)
+ 		 * than a vendor-specific driver. */
+ 		else if (udev->descriptor.bDeviceClass !=
+ 						USB_CLASS_VENDOR_SPEC &&
+-				(!desc || desc->bInterfaceClass !=
++				(desc && desc->bInterfaceClass !=
+ 						USB_CLASS_VENDOR_SPEC)) {
+ 			best = c;
+ 			break;
+diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
+index 97b40ce..4a6366a 100644
+--- a/drivers/usb/core/inode.c
++++ b/drivers/usb/core/inode.c
+@@ -515,13 +515,13 @@ static int fs_create_by_name (const char *name, mode_t mode,
+ 	*dentry = NULL;
+ 	mutex_lock(&parent->d_inode->i_mutex);
+ 	*dentry = lookup_one_len(name, parent, strlen(name));
+-	if (!IS_ERR(dentry)) {
++	if (!IS_ERR(*dentry)) {
+ 		if ((mode & S_IFMT) == S_IFDIR)
+ 			error = usbfs_mkdir (parent->d_inode, *dentry, mode);
+ 		else 
+ 			error = usbfs_create (parent->d_inode, *dentry, mode);
+ 	} else
+-		error = PTR_ERR(dentry);
++		error = PTR_ERR(*dentry);
+ 	mutex_unlock(&parent->d_inode->i_mutex);
+ 
+ 	return error;
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index 9bc95fe..1a48aac 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1471,7 +1471,7 @@ int usb_reset_configuration(struct usb_device *dev)
+ 	/* If not, reinstate the old alternate settings */
+ 	if (retval < 0) {
+ reset_old_alts:
+-		for (; i >= 0; i--) {
++		for (i--; i >= 0; i--) {
+ 			struct usb_interface *intf = config->interface[i];
+ 			struct usb_host_interface *alt;
+ 
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index 9c90b67..efa0372 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -543,6 +543,7 @@ static int ehci_init(struct usb_hcd *hcd)
+ 	 */
+ 	ehci->periodic_size = DEFAULT_I_TDPS;
+ 	INIT_LIST_HEAD(&ehci->cached_itd_list);
++	INIT_LIST_HEAD(&ehci->cached_sitd_list);
+ 	if ((retval = ehci_mem_init(ehci, GFP_KERNEL)) < 0)
+ 		return retval;
+ 
+diff --git a/drivers/usb/host/ehci-mem.c b/drivers/usb/host/ehci-mem.c
+index aeda96e..1f3f01e 100644
+--- a/drivers/usb/host/ehci-mem.c
++++ b/drivers/usb/host/ehci-mem.c
+@@ -136,7 +136,7 @@ static inline void qh_put (struct ehci_qh *qh)
+ 
+ static void ehci_mem_cleanup (struct ehci_hcd *ehci)
+ {
+-	free_cached_itd_list(ehci);
++	free_cached_lists(ehci);
+ 	if (ehci->async)
+ 		qh_put (ehci->async);
+ 	ehci->async = NULL;
+diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
+index df533ce..2064045 100644
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -2137,13 +2137,27 @@ sitd_complete (
+ 			(stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out");
+ 	}
+ 	iso_stream_put (ehci, stream);
+-	/* OK to recycle this SITD now that its completion callback ran. */
++
+ done:
+ 	sitd->urb = NULL;
+-	sitd->stream = NULL;
+-	list_move(&sitd->sitd_list, &stream->free_list);
+-	iso_stream_put(ehci, stream);
+-
++	if (ehci->clock_frame != sitd->frame) {
++		/* OK to recycle this SITD now. */
++		sitd->stream = NULL;
++		list_move(&sitd->sitd_list, &stream->free_list);
++		iso_stream_put(ehci, stream);
++	} else {
++		/* HW might remember this SITD, so we can't recycle it yet.
++		 * Move it to a safe place until a new frame starts.
++		 */
++		list_move(&sitd->sitd_list, &ehci->cached_sitd_list);
++		if (stream->refcount == 2) {
++			/* If iso_stream_put() were called here, stream
++			 * would be freed.  Instead, just prevent reuse.
++			 */
++			stream->ep->hcpriv = NULL;
++			stream->ep = NULL;
++		}
++	}
+ 	return retval;
+ }
+ 
+@@ -2209,9 +2223,10 @@ done:
+ 
+ /*-------------------------------------------------------------------------*/
+ 
+-static void free_cached_itd_list(struct ehci_hcd *ehci)
++static void free_cached_lists(struct ehci_hcd *ehci)
+ {
+ 	struct ehci_itd *itd, *n;
++	struct ehci_sitd *sitd, *sn;
+ 
+ 	list_for_each_entry_safe(itd, n, &ehci->cached_itd_list, itd_list) {
+ 		struct ehci_iso_stream	*stream = itd->stream;
+@@ -2219,6 +2234,13 @@ static void free_cached_itd_list(struct ehci_hcd *ehci)
+ 		list_move(&itd->itd_list, &stream->free_list);
+ 		iso_stream_put(ehci, stream);
+ 	}
++
++	list_for_each_entry_safe(sitd, sn, &ehci->cached_sitd_list, sitd_list) {
++		struct ehci_iso_stream	*stream = sitd->stream;
++		sitd->stream = NULL;
++		list_move(&sitd->sitd_list, &stream->free_list);
++		iso_stream_put(ehci, stream);
++	}
+ }
+ 
+ /*-------------------------------------------------------------------------*/
+@@ -2245,7 +2267,7 @@ scan_periodic (struct ehci_hcd *ehci)
+ 		clock_frame = -1;
+ 	}
+ 	if (ehci->clock_frame != clock_frame) {
+-		free_cached_itd_list(ehci);
++		free_cached_lists(ehci);
+ 		ehci->clock_frame = clock_frame;
+ 	}
+ 	clock %= mod;
+@@ -2408,7 +2430,7 @@ restart:
+ 			clock = now;
+ 			clock_frame = clock >> 3;
+ 			if (ehci->clock_frame != clock_frame) {
+-				free_cached_itd_list(ehci);
++				free_cached_lists(ehci);
+ 				ehci->clock_frame = clock_frame;
+ 			}
+ 		} else {
+diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
+index b1dce96..556c0b4 100644
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -87,8 +87,9 @@ struct ehci_hcd {			/* one per controller */
+ 	int			next_uframe;	/* scan periodic, start here */
+ 	unsigned		periodic_sched;	/* periodic activity count */
+ 
+-	/* list of itds completed while clock_frame was still active */
++	/* list of itds & sitds completed while clock_frame was still active */
+ 	struct list_head	cached_itd_list;
++	struct list_head	cached_sitd_list;
+ 	unsigned		clock_frame;
+ 
+ 	/* per root hub port */
+@@ -195,7 +196,7 @@ timer_action_done (struct ehci_hcd *ehci, enum ehci_timer_action action)
+ 	clear_bit (action, &ehci->actions);
+ }
+ 
+-static void free_cached_itd_list(struct ehci_hcd *ehci);
++static void free_cached_lists(struct ehci_hcd *ehci);
+ 
+ /*-------------------------------------------------------------------------*/
+ 
+diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
+index 32bbce9..65cac8c 100644
+--- a/drivers/usb/host/ohci-hub.c
++++ b/drivers/usb/host/ohci-hub.c
+@@ -697,7 +697,7 @@ static int ohci_hub_control (
+ 	u16		wLength
+ ) {
+ 	struct ohci_hcd	*ohci = hcd_to_ohci (hcd);
+-	int		ports = hcd_to_bus (hcd)->root_hub->maxchild;
++	int		ports = ohci->num_ports;
+ 	u32		temp;
+ 	int		retval = 0;
+ 
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index bffcef7..6c1f673 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -549,6 +549,19 @@ static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
+ 	return EP_INTERVAL(interval);
+ }
+ 
++/* The "Mult" field in the endpoint context is only set for SuperSpeed devices.
++ * High speed endpoint descriptors can define "the number of additional
++ * transaction opportunities per microframe", but that goes in the Max Burst
++ * endpoint context field.
++ */
++static inline u32 xhci_get_endpoint_mult(struct usb_device *udev,
++		struct usb_host_endpoint *ep)
++{
++	if (udev->speed != USB_SPEED_SUPER || !ep->ss_ep_comp)
++		return 0;
++	return ep->ss_ep_comp->desc.bmAttributes;
++}
++
+ static inline u32 xhci_get_endpoint_type(struct usb_device *udev,
+ 		struct usb_host_endpoint *ep)
+ {
+@@ -579,6 +592,36 @@ static inline u32 xhci_get_endpoint_type(struct usb_device *udev,
+ 	return type;
+ }
+ 
++/* Return the maximum endpoint service interval time (ESIT) payload.
++ * Basically, this is the maxpacket size, multiplied by the burst size
++ * and mult size.
++ */
++static inline u32 xhci_get_max_esit_payload(struct xhci_hcd *xhci,
++		struct usb_device *udev,
++		struct usb_host_endpoint *ep)
++{
++	int max_burst;
++	int max_packet;
++
++	/* Only applies for interrupt or isochronous endpoints */
++	if (usb_endpoint_xfer_control(&ep->desc) ||
++			usb_endpoint_xfer_bulk(&ep->desc))
++		return 0;
++
++	if (udev->speed == USB_SPEED_SUPER) {
++		if (ep->ss_ep_comp)
++			return ep->ss_ep_comp->desc.wBytesPerInterval;
++		xhci_warn(xhci, "WARN no SS endpoint companion descriptor.\n");
++		/* Assume no bursts, no multiple opportunities to send. */
++		return ep->desc.wMaxPacketSize;
++	}
++
++	max_packet = ep->desc.wMaxPacketSize & 0x3ff;
++	max_burst = (ep->desc.wMaxPacketSize & 0x1800) >> 11;
++	/* A 0 in max burst means 1 transfer per ESIT */
++	return max_packet * (max_burst + 1);
++}
++
+ int xhci_endpoint_init(struct xhci_hcd *xhci,
+ 		struct xhci_virt_device *virt_dev,
+ 		struct usb_device *udev,
+@@ -590,6 +633,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
+ 	struct xhci_ring *ep_ring;
+ 	unsigned int max_packet;
+ 	unsigned int max_burst;
++	u32 max_esit_payload;
+ 
+ 	ep_index = xhci_get_endpoint_index(&ep->desc);
+ 	ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
+@@ -611,6 +655,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
+ 	ep_ctx->deq = ep_ring->first_seg->dma | ep_ring->cycle_state;
+ 
+ 	ep_ctx->ep_info = xhci_get_endpoint_interval(udev, ep);
++	ep_ctx->ep_info |= EP_MULT(xhci_get_endpoint_mult(udev, ep));
+ 
+ 	/* FIXME dig Mult and streams info out of ep companion desc */
+ 
+@@ -656,6 +701,26 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
+ 	default:
+ 		BUG();
+ 	}
++	max_esit_payload = xhci_get_max_esit_payload(xhci, udev, ep);
++	ep_ctx->tx_info = MAX_ESIT_PAYLOAD_FOR_EP(max_esit_payload);
++
++	/*
++	 * XXX no idea how to calculate the average TRB buffer length for bulk
++	 * endpoints, as the driver gives us no clue how big each scatter gather
++	 * list entry (or buffer) is going to be.
++	 *
++	 * For isochronous and interrupt endpoints, we set it to the max
++	 * available, until we have new API in the USB core to allow drivers to
++	 * declare how much bandwidth they actually need.
++	 *
++	 * Normally, it would be calculated by taking the total of the buffer
++	 * lengths in the TD and then dividing by the number of TRBs in a TD,
++	 * including link TRBs, No-op TRBs, and Event data TRBs.  Since we don't
++	 * use Event Data TRBs, and we don't chain in a link TRB on short
++	 * transfers, we're basically dividing by 1.
++	 */
++	ep_ctx->tx_info |= AVG_TRB_LENGTH_FOR_EP(max_esit_payload);
++
+ 	/* FIXME Debug endpoint context */
+ 	return 0;
+ }
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 8778135..9e904a6 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -609,6 +609,10 @@ struct xhci_ep_ctx {
+ #define MAX_PACKET_MASK		(0xffff << 16)
+ #define MAX_PACKET_DECODED(p)	(((p) >> 16) & 0xffff)
+ 
++/* tx_info bitmasks */
++#define AVG_TRB_LENGTH_FOR_EP(p)	((p) & 0xffff)
++#define MAX_ESIT_PAYLOAD_FOR_EP(p)	(((p) & 0xffff) << 16)
++
+ 
+ /**
+  * struct xhci_input_control_context
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index 0cfd621..a442989 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -229,6 +229,7 @@ static const struct sierra_iface_info direct_ip_interface_blacklist = {
+ static struct usb_device_id id_table [] = {
+ 	{ USB_DEVICE(0x0F3D, 0x0112) }, /* Airprime/Sierra PC 5220 */
+ 	{ USB_DEVICE(0x03F0, 0x1B1D) },	/* HP ev2200 a.k.a MC5720 */
++	{ USB_DEVICE(0x03F0, 0x211D) }, /* HP ev2210 a.k.a MC5725 */
+ 	{ USB_DEVICE(0x03F0, 0x1E1D) },	/* HP hs2300 a.k.a MC8775 */
+ 
+ 	{ USB_DEVICE(0x1199, 0x0017) },	/* Sierra Wireless EM5625 */
+diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
+index 1ed3d55..17726a0 100644
+--- a/drivers/w1/slaves/w1_therm.c
++++ b/drivers/w1/slaves/w1_therm.c
+@@ -115,9 +115,8 @@ static struct w1_therm_family_converter w1_therm_families[] = {
+ 
+ static inline int w1_DS18B20_convert_temp(u8 rom[9])
+ {
+-	int t = ((s16)rom[1] << 8) | rom[0];
+-	t = t*1000/16;
+-	return t;
++	s16 t = le16_to_cpup((__le16 *)rom);
++	return t*1000/16;
+ }
+ 
+ static inline int w1_DS18S20_convert_temp(u8 rom[9])
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index c568779..cae75c1 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -3767,7 +3767,6 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ 		__u64 start, __u64 len)
+ {
+ 	ext4_lblk_t start_blk;
+-	ext4_lblk_t len_blks;
+ 	int error = 0;
+ 
+ 	/* fallback to generic here if not in extents fmt */
+@@ -3781,8 +3780,14 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ 	if (fieinfo->fi_flags & FIEMAP_FLAG_XATTR) {
+ 		error = ext4_xattr_fiemap(inode, fieinfo);
+ 	} else {
++		ext4_lblk_t len_blks;
++		__u64 last_blk;
++
+ 		start_blk = start >> inode->i_sb->s_blocksize_bits;
+-		len_blks = len >> inode->i_sb->s_blocksize_bits;
++		last_blk = (start + len - 1) >> inode->i_sb->s_blocksize_bits;
++		if (last_blk >= EXT_MAX_BLOCK)
++			last_blk = EXT_MAX_BLOCK-1;
++		len_blks = ((ext4_lblk_t) last_blk) - start_blk + 1;
+ 
+ 		/*
+ 		 * Walk the extent tree gathering extent information.
+diff --git a/fs/jfs/resize.c b/fs/jfs/resize.c
+index 7f24a0b..1aba003 100644
+--- a/fs/jfs/resize.c
++++ b/fs/jfs/resize.c
+@@ -81,6 +81,7 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
+ 	struct inode *iplist[1];
+ 	struct jfs_superblock *j_sb, *j_sb2;
+ 	uint old_agsize;
++	int agsizechanged = 0;
+ 	struct buffer_head *bh, *bh2;
+ 
+ 	/* If the volume hasn't grown, get out now */
+@@ -333,6 +334,9 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
+ 	 */
+ 	if ((rc = dbExtendFS(ipbmap, XAddress, nblocks)))
+ 		goto error_out;
++
++	agsizechanged |= (bmp->db_agsize != old_agsize);
++
+ 	/*
+ 	 * the map now has extended to cover additional nblocks:
+ 	 * dn_mapsize = oldMapsize + nblocks;
+@@ -432,7 +436,7 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
+ 	 * will correctly identify the new ag);
+ 	 */
+ 	/* if new AG size the same as old AG size, done! */
+-	if (bmp->db_agsize != old_agsize) {
++	if (agsizechanged) {
+ 		if ((rc = diExtendFS(ipimap, ipbmap)))
+ 			goto error_out;
+ 
+diff --git a/fs/nfs/client.c b/fs/nfs/client.c
+index bd39abc..37d555c 100644
+--- a/fs/nfs/client.c
++++ b/fs/nfs/client.c
+@@ -965,6 +965,8 @@ out_error:
+ static void nfs_server_copy_userdata(struct nfs_server *target, struct nfs_server *source)
+ {
+ 	target->flags = source->flags;
++	target->rsize = source->rsize;
++	target->wsize = source->wsize;
+ 	target->acregmin = source->acregmin;
+ 	target->acregmax = source->acregmax;
+ 	target->acdirmin = source->acdirmin;
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index af6948d..b5d55d3 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -837,6 +837,8 @@ out_zap_parent:
+ 		/* If we have submounts, don't unhash ! */
+ 		if (have_submounts(dentry))
+ 			goto out_valid;
++		if (dentry->d_flags & DCACHE_DISCONNECTED)
++			goto out_valid;
+ 		shrink_dcache_parent(dentry);
+ 	}
+ 	d_drop(dentry);
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index bbf72d8..718f3fb 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -160,10 +160,10 @@ static __be32 *read_buf(struct nfsd4_compoundargs *argp, u32 nbytes)
+ 	argp->p = page_address(argp->pagelist[0]);
+ 	argp->pagelist++;
+ 	if (argp->pagelen < PAGE_SIZE) {
+-		argp->end = p + (argp->pagelen>>2);
++		argp->end = argp->p + (argp->pagelen>>2);
+ 		argp->pagelen = 0;
+ 	} else {
+-		argp->end = p + (PAGE_SIZE>>2);
++		argp->end = argp->p + (PAGE_SIZE>>2);
+ 		argp->pagelen -= PAGE_SIZE;
+ 	}
+ 	memcpy(((char*)p)+avail, argp->p, (nbytes - avail));
+@@ -1425,10 +1425,10 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
+ 			argp->p = page_address(argp->pagelist[0]);
+ 			argp->pagelist++;
+ 			if (argp->pagelen < PAGE_SIZE) {
+-				argp->end = p + (argp->pagelen>>2);
++				argp->end = argp->p + (argp->pagelen>>2);
+ 				argp->pagelen = 0;
+ 			} else {
+-				argp->end = p + (PAGE_SIZE>>2);
++				argp->end = argp->p + (PAGE_SIZE>>2);
+ 				argp->pagelen -= PAGE_SIZE;
+ 			}
+ 		}
+diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
+index 21c808f..b18c6d6 100644
+--- a/fs/ocfs2/buffer_head_io.c
++++ b/fs/ocfs2/buffer_head_io.c
+@@ -407,6 +407,7 @@ int ocfs2_write_super_or_backup(struct ocfs2_super *osb,
+ 				struct buffer_head *bh)
+ {
+ 	int ret = 0;
++	struct ocfs2_dinode *di = (struct ocfs2_dinode *)bh->b_data;
+ 
+ 	mlog_entry_void();
+ 
+@@ -426,6 +427,7 @@ int ocfs2_write_super_or_backup(struct ocfs2_super *osb,
+ 
+ 	get_bh(bh); /* for end_buffer_write_sync() */
+ 	bh->b_end_io = end_buffer_write_sync;
++	ocfs2_compute_meta_ecc(osb->sb, bh->b_data, &di->i_check);
+ 	submit_bh(WRITE, bh);
+ 
+ 	wait_on_buffer(bh);
+diff --git a/fs/ocfs2/dlm/dlmfs.c b/fs/ocfs2/dlm/dlmfs.c
+index 02bf178..18bc101 100644
+--- a/fs/ocfs2/dlm/dlmfs.c
++++ b/fs/ocfs2/dlm/dlmfs.c
+@@ -205,7 +205,7 @@ static ssize_t dlmfs_file_read(struct file *filp,
+ 	if ((count + *ppos) > i_size_read(inode))
+ 		readlen = i_size_read(inode) - *ppos;
+ 	else
+-		readlen = count - *ppos;
++		readlen = count;
+ 
+ 	lvb_buf = kmalloc(readlen, GFP_NOFS);
+ 	if (!lvb_buf)
+diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
+index 88459bd..ec4d97f 100644
+--- a/fs/ocfs2/inode.c
++++ b/fs/ocfs2/inode.c
+@@ -559,6 +559,7 @@ static int ocfs2_truncate_for_delete(struct ocfs2_super *osb,
+ 		handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
+ 		if (IS_ERR(handle)) {
+ 			status = PTR_ERR(handle);
++			handle = NULL;
+ 			mlog_errno(status);
+ 			goto out;
+ 		}
+diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
+index 8ae65c9..a8e8572 100644
+--- a/fs/ocfs2/refcounttree.c
++++ b/fs/ocfs2/refcounttree.c
+@@ -4083,6 +4083,9 @@ static int ocfs2_complete_reflink(struct inode *s_inode,
+ 	di->i_attr = s_di->i_attr;
+ 
+ 	if (preserve) {
++		t_inode->i_uid = s_inode->i_uid;
++		t_inode->i_gid = s_inode->i_gid;
++		t_inode->i_mode = s_inode->i_mode;
+ 		di->i_uid = s_di->i_uid;
+ 		di->i_gid = s_di->i_gid;
+ 		di->i_mode = s_di->i_mode;
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 3cd449d..8dce96c 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -2910,7 +2910,7 @@ out_no_task:
+  */
+ static const struct pid_entry tid_base_stuff[] = {
+ 	DIR("fd",        S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations),
+-	DIR("fdinfo",    S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fd_operations),
++	DIR("fdinfo",    S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fdinfo_operations),
+ 	REG("environ",   S_IRUSR, proc_environ_operations),
+ 	INF("auxv",      S_IRUSR, proc_pid_auxv),
+ 	ONE("status",    S_IRUGO, proc_pid_status),
+diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
+index c094f58..1e686ee 100644
+--- a/fs/reiserfs/dir.c
++++ b/fs/reiserfs/dir.c
+@@ -45,8 +45,6 @@ static inline bool is_privroot_deh(struct dentry *dir,
+ 				   struct reiserfs_de_head *deh)
+ {
+ 	struct dentry *privroot = REISERFS_SB(dir->d_sb)->priv_root;
+-	if (reiserfs_expose_privroot(dir->d_sb))
+-		return 0;
+ 	return (dir == dir->d_parent && privroot->d_inode &&
+ 	        deh->deh_objectid == INODE_PKEY(privroot->d_inode)->k_objectid);
+ }
+diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
+index 81f09fa..0392e82 100644
+--- a/fs/reiserfs/xattr.c
++++ b/fs/reiserfs/xattr.c
+@@ -557,7 +557,7 @@ reiserfs_xattr_set_handle(struct reiserfs_transaction_handle *th,
+ 	if (!err && new_size < i_size_read(dentry->d_inode)) {
+ 		struct iattr newattrs = {
+ 			.ia_ctime = current_fs_time(inode->i_sb),
+-			.ia_size = buffer_size,
++			.ia_size = new_size,
+ 			.ia_valid = ATTR_SIZE | ATTR_CTIME,
+ 		};
+ 
+@@ -976,21 +976,13 @@ int reiserfs_permission(struct inode *inode, int mask)
+ 	return generic_permission(inode, mask, NULL);
+ }
+ 
+-/* This will catch lookups from the fs root to .reiserfs_priv */
+-static int
+-xattr_lookup_poison(struct dentry *dentry, struct qstr *q1, struct qstr *name)
++static int xattr_hide_revalidate(struct dentry *dentry, struct nameidata *nd)
+ {
+-	struct dentry *priv_root = REISERFS_SB(dentry->d_sb)->priv_root;
+-	if (container_of(q1, struct dentry, d_name) == priv_root)
+-		return -ENOENT;
+-	if (q1->len == name->len &&
+-		   !memcmp(q1->name, name->name, name->len))
+-		return 0;
+-	return 1;
++	return -EPERM;
+ }
+ 
+ static const struct dentry_operations xattr_lookup_poison_ops = {
+-	.d_compare = xattr_lookup_poison,
++	.d_revalidate = xattr_hide_revalidate,
+ };
+ 
+ int reiserfs_lookup_privroot(struct super_block *s)
+@@ -1004,8 +996,7 @@ int reiserfs_lookup_privroot(struct super_block *s)
+ 				strlen(PRIVROOT_NAME));
+ 	if (!IS_ERR(dentry)) {
+ 		REISERFS_SB(s)->priv_root = dentry;
+-		if (!reiserfs_expose_privroot(s))
+-			s->s_root->d_op = &xattr_lookup_poison_ops;
++		dentry->d_op = &xattr_lookup_poison_ops;
+ 		if (dentry->d_inode)
+ 			dentry->d_inode->i_flags |= S_PRIVATE;
+ 	} else
+diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
+index 77414db..146d491 100644
+--- a/fs/xfs/linux-2.6/xfs_super.c
++++ b/fs/xfs/linux-2.6/xfs_super.c
+@@ -1160,6 +1160,7 @@ xfs_fs_put_super(
+ 
+ 	xfs_unmountfs(mp);
+ 	xfs_freesb(mp);
++	xfs_inode_shrinker_unregister(mp);
+ 	xfs_icsb_destroy_counters(mp);
+ 	xfs_close_devices(mp);
+ 	xfs_dmops_put(mp);
+@@ -1523,6 +1524,8 @@ xfs_fs_fill_super(
+ 	if (error)
+ 		goto fail_vnrele;
+ 
++	xfs_inode_shrinker_register(mp);
++
+ 	kfree(mtpt);
+ 	return 0;
+ 
+@@ -1767,6 +1770,7 @@ init_xfs_fs(void)
+ 		goto out_cleanup_procfs;
+ 
+ 	vfs_initquota();
++	xfs_inode_shrinker_init();
+ 
+ 	error = register_filesystem(&xfs_fs_type);
+ 	if (error)
+@@ -1794,6 +1798,7 @@ exit_xfs_fs(void)
+ {
+ 	vfs_exitquota();
+ 	unregister_filesystem(&xfs_fs_type);
++	xfs_inode_shrinker_destroy();
+ 	xfs_sysctl_unregister();
+ 	xfs_cleanup_procfs();
+ 	xfs_buf_terminate();
+diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
+index 6b6b394..57adf2d 100644
+--- a/fs/xfs/linux-2.6/xfs_sync.c
++++ b/fs/xfs/linux-2.6/xfs_sync.c
+@@ -95,7 +95,8 @@ xfs_inode_ag_walk(
+ 					   struct xfs_perag *pag, int flags),
+ 	int			flags,
+ 	int			tag,
+-	int			exclusive)
++	int			exclusive,
++	int			*nr_to_scan)
+ {
+ 	struct xfs_perag	*pag = &mp->m_perag[ag];
+ 	uint32_t		first_index;
+@@ -135,7 +136,7 @@ restart:
+ 		if (error == EFSCORRUPTED)
+ 			break;
+ 
+-	} while (1);
++	} while ((*nr_to_scan)--);
+ 
+ 	if (skipped) {
+ 		delay(1);
+@@ -153,23 +154,30 @@ xfs_inode_ag_iterator(
+ 					   struct xfs_perag *pag, int flags),
+ 	int			flags,
+ 	int			tag,
+-	int			exclusive)
++	int			exclusive,
++	int			*nr_to_scan)
+ {
+ 	int			error = 0;
+ 	int			last_error = 0;
+ 	xfs_agnumber_t		ag;
++	int			nr;
+ 
++	nr = nr_to_scan ? *nr_to_scan : INT_MAX;
+ 	for (ag = 0; ag < mp->m_sb.sb_agcount; ag++) {
+ 		if (!mp->m_perag[ag].pag_ici_init)
+ 			continue;
+ 		error = xfs_inode_ag_walk(mp, ag, execute, flags, tag,
+-						exclusive);
++						exclusive, &nr);
+ 		if (error) {
+ 			last_error = error;
+ 			if (error == EFSCORRUPTED)
+ 				break;
+ 		}
++		if (nr <= 0)
++			break;
+ 	}
++	if (nr_to_scan)
++		*nr_to_scan = nr;
+ 	return XFS_ERROR(last_error);
+ }
+ 
+@@ -289,7 +297,7 @@ xfs_sync_data(
+ 	ASSERT((flags & ~(SYNC_TRYLOCK|SYNC_WAIT)) == 0);
+ 
+ 	error = xfs_inode_ag_iterator(mp, xfs_sync_inode_data, flags,
+-				      XFS_ICI_NO_TAG, 0);
++				      XFS_ICI_NO_TAG, 0, NULL);
+ 	if (error)
+ 		return XFS_ERROR(error);
+ 
+@@ -311,7 +319,7 @@ xfs_sync_attr(
+ 	ASSERT((flags & ~SYNC_WAIT) == 0);
+ 
+ 	return xfs_inode_ag_iterator(mp, xfs_sync_inode_attr, flags,
+-				     XFS_ICI_NO_TAG, 0);
++				     XFS_ICI_NO_TAG, 0, NULL);
+ }
+ 
+ STATIC int
+@@ -679,6 +687,7 @@ __xfs_inode_set_reclaim_tag(
+ 	radix_tree_tag_set(&pag->pag_ici_root,
+ 			   XFS_INO_TO_AGINO(ip->i_mount, ip->i_ino),
+ 			   XFS_ICI_RECLAIM_TAG);
++	pag->pag_ici_reclaimable++;
+ }
+ 
+ /*
+@@ -710,6 +719,7 @@ __xfs_inode_clear_reclaim_tag(
+ {
+ 	radix_tree_tag_clear(&pag->pag_ici_root,
+ 			XFS_INO_TO_AGINO(mp, ip->i_ino), XFS_ICI_RECLAIM_TAG);
++	pag->pag_ici_reclaimable--;
+ }
+ 
+ STATIC int
+@@ -770,5 +780,88 @@ xfs_reclaim_inodes(
+ 	int		mode)
+ {
+ 	return xfs_inode_ag_iterator(mp, xfs_reclaim_inode, mode,
+-					XFS_ICI_RECLAIM_TAG, 1);
++					XFS_ICI_RECLAIM_TAG, 1, NULL);
++}
++
++/*
++ * Shrinker infrastructure.
++ *
++ * This is all far more complex than it needs to be. It adds a global list of
++ * mounts because the shrinkers can only call a global context. We need to make
++ * the shrinkers pass a context to avoid the need for global state.
++ */
++static LIST_HEAD(xfs_mount_list);
++static struct rw_semaphore xfs_mount_list_lock;
++
++static int
++xfs_reclaim_inode_shrink(
++	int		nr_to_scan,
++	gfp_t		gfp_mask)
++{
++	struct xfs_mount *mp;
++	xfs_agnumber_t	ag;
++	int		reclaimable = 0;
++
++	if (nr_to_scan) {
++		if (!(gfp_mask & __GFP_FS))
++			return -1;
++
++		down_read(&xfs_mount_list_lock);
++		list_for_each_entry(mp, &xfs_mount_list, m_mplist) {
++			xfs_inode_ag_iterator(mp, xfs_reclaim_inode, 0,
++					XFS_ICI_RECLAIM_TAG, 1, &nr_to_scan);
++			if (nr_to_scan <= 0)
++				break;
++		}
++		up_read(&xfs_mount_list_lock);
++	}
++
++	down_read(&xfs_mount_list_lock);
++	list_for_each_entry(mp, &xfs_mount_list, m_mplist) {
++		for (ag = 0; ag < mp->m_sb.sb_agcount; ag++) {
++
++			if (!mp->m_perag[ag].pag_ici_init)
++				continue;
++			reclaimable += mp->m_perag[ag].pag_ici_reclaimable;
++		}
++	}
++	up_read(&xfs_mount_list_lock);
++	return reclaimable;
++}
++
++static struct shrinker xfs_inode_shrinker = {
++	.shrink = xfs_reclaim_inode_shrink,
++	.seeks = DEFAULT_SEEKS,
++};
++
++void __init
++xfs_inode_shrinker_init(void)
++{
++	init_rwsem(&xfs_mount_list_lock);
++	register_shrinker(&xfs_inode_shrinker);
++}
++
++void
++xfs_inode_shrinker_destroy(void)
++{
++	ASSERT(list_empty(&xfs_mount_list));
++	unregister_shrinker(&xfs_inode_shrinker);
++}
++
++void
++xfs_inode_shrinker_register(
++	struct xfs_mount	*mp)
++{
++	down_write(&xfs_mount_list_lock);
++	list_add_tail(&mp->m_mplist, &xfs_mount_list);
++	up_write(&xfs_mount_list_lock);
++}
++
++void
++xfs_inode_shrinker_unregister(
++	struct xfs_mount	*mp)
++{
++	down_write(&xfs_mount_list_lock);
++	list_del(&mp->m_mplist);
++	up_write(&xfs_mount_list_lock);
+ }
+diff --git a/fs/xfs/linux-2.6/xfs_sync.h b/fs/xfs/linux-2.6/xfs_sync.h
+index ea932b4..0b28c13 100644
+--- a/fs/xfs/linux-2.6/xfs_sync.h
++++ b/fs/xfs/linux-2.6/xfs_sync.h
+@@ -54,6 +54,11 @@ void __xfs_inode_clear_reclaim_tag(struct xfs_mount *mp, struct xfs_perag *pag,
+ int xfs_sync_inode_valid(struct xfs_inode *ip, struct xfs_perag *pag);
+ int xfs_inode_ag_iterator(struct xfs_mount *mp,
+ 	int (*execute)(struct xfs_inode *ip, struct xfs_perag *pag, int flags),
+-	int flags, int tag, int write_lock);
++	int flags, int tag, int write_lock, int *nr_to_scan);
++
++void xfs_inode_shrinker_init(void);
++void xfs_inode_shrinker_destroy(void);
++void xfs_inode_shrinker_register(struct xfs_mount *mp);
++void xfs_inode_shrinker_unregister(struct xfs_mount *mp);
+ 
+ #endif
+diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
+index 873e07e..145f596 100644
+--- a/fs/xfs/quota/xfs_qm_syscalls.c
++++ b/fs/xfs/quota/xfs_qm_syscalls.c
+@@ -891,7 +891,8 @@ xfs_qm_dqrele_all_inodes(
+ 	uint		 flags)
+ {
+ 	ASSERT(mp->m_quotainfo);
+-	xfs_inode_ag_iterator(mp, xfs_dqrele_inode, flags, XFS_ICI_NO_TAG, 0);
++	xfs_inode_ag_iterator(mp, xfs_dqrele_inode, flags,
++				XFS_ICI_NO_TAG, 0, NULL);
+ }
+ 
+ /*------------------------------------------------------------------------*/
+diff --git a/fs/xfs/xfs_ag.h b/fs/xfs/xfs_ag.h
+index 6702bd8..1182604 100644
+--- a/fs/xfs/xfs_ag.h
++++ b/fs/xfs/xfs_ag.h
+@@ -229,6 +229,7 @@ typedef struct xfs_perag
+ 	int		pag_ici_init;	/* incore inode cache initialised */
+ 	rwlock_t	pag_ici_lock;	/* incore inode lock */
+ 	struct radix_tree_root pag_ici_root;	/* incore inode cache root */
++	int		pag_ici_reclaimable;	/* reclaimable inodes */
+ #endif
+ } xfs_perag_t;
+ 
+diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
+index 1df7e45..c95f81a 100644
+--- a/fs/xfs/xfs_mount.h
++++ b/fs/xfs/xfs_mount.h
+@@ -257,6 +257,7 @@ typedef struct xfs_mount {
+ 	wait_queue_head_t	m_wait_single_sync_task;
+ 	__int64_t		m_update_flags;	/* sb flags we need to update
+ 						   on the next remount,rw */
++	struct list_head	m_mplist;	/* inode shrinker mount list */
+ } xfs_mount_t;
+ 
+ /*
+diff --git a/include/linux/ata.h b/include/linux/ata.h
+index 20f3156..f8bd0f9 100644
+--- a/include/linux/ata.h
++++ b/include/linux/ata.h
+@@ -1024,8 +1024,8 @@ static inline int ata_ok(u8 status)
+ 
+ static inline int lba_28_ok(u64 block, u32 n_block)
+ {
+-	/* check the ending block number */
+-	return ((block + n_block) < ((u64)1 << 28)) && (n_block <= 256);
++	/* check the ending block number: must be LESS THAN 0x0fffffff */
++	return ((block + n_block) < ((1 << 28) - 1)) && (n_block <= 256);
+ }
+ 
+ static inline int lba_48_ok(u64 block, u32 n_block)
+diff --git a/include/linux/poison.h b/include/linux/poison.h
+index 2110a81..34066ff 100644
+--- a/include/linux/poison.h
++++ b/include/linux/poison.h
+@@ -48,6 +48,15 @@
+ #define POISON_FREE	0x6b	/* for use-after-free poisoning */
+ #define	POISON_END	0xa5	/* end-byte of poisoning */
+ 
++/********** mm/hugetlb.c **********/
++/*
++ * Private mappings of hugetlb pages use this poisoned value for
++ * page->mapping. The core VM should not be doing anything with this mapping
++ * but futex requires the existence of some page->mapping value even though it
++ * is unused if PAGE_MAPPING_ANON is set.
++ */
++#define HUGETLB_POISON	((void *)(0x00300300 + POISON_POINTER_DELTA + PAGE_MAPPING_ANON))
++
+ /********** arch/$ARCH/mm/init.c **********/
+ #define POISON_FREE_INITMEM	0xcc
+ 
+diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
+index 8be5135..2c55a7e 100644
+--- a/include/net/sctp/command.h
++++ b/include/net/sctp/command.h
+@@ -107,6 +107,7 @@ typedef enum {
+ 	SCTP_CMD_T1_RETRAN,	 /* Mark for retransmission after T1 timeout  */
+ 	SCTP_CMD_UPDATE_INITTAG, /* Update peer inittag */
+ 	SCTP_CMD_SEND_MSG,	 /* Send the whole use message */
++	SCTP_CMD_SEND_NEXT_ASCONF, /* Send the next ASCONF after ACK */
+ 	SCTP_CMD_LAST
+ } sctp_verb_t;
+ 
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index 78740ec..fa6cde5 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -128,6 +128,7 @@ extern int sctp_register_pf(struct sctp_pf *, sa_family_t);
+ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb);
+ int sctp_inet_listen(struct socket *sock, int backlog);
+ void sctp_write_space(struct sock *sk);
++void sctp_data_ready(struct sock *sk, int len);
+ unsigned int sctp_poll(struct file *file, struct socket *sock,
+ 		poll_table *wait);
+ void sctp_sock_rfree(struct sk_buff *skb);
+diff --git a/init/initramfs.c b/init/initramfs.c
+index b37d34b..b27d045 100644
+--- a/init/initramfs.c
++++ b/init/initramfs.c
+@@ -457,7 +457,8 @@ static char * __init unpack_to_rootfs(char *buf, unsigned len)
+ 					 compress_name);
+ 				message = msg_buf;
+ 			}
+-		}
++		} else
++			error("junk in compressed archive");
+ 		if (state != Reset)
+ 			error("junk in compressed archive");
+ 		this_header = saved_offset + my_inptr;
+diff --git a/kernel/cred.c b/kernel/cred.c
+index 1ed8ca1..099f5e6 100644
+--- a/kernel/cred.c
++++ b/kernel/cred.c
+@@ -786,8 +786,6 @@ bool creds_are_invalid(const struct cred *cred)
+ {
+ 	if (cred->magic != CRED_MAGIC)
+ 		return true;
+-	if (atomic_read(&cred->usage) < atomic_read(&cred->subscribers))
+-		return true;
+ #ifdef CONFIG_SECURITY_SELINUX
+ 	if (selinux_is_enabled()) {
+ 		if ((unsigned long) cred->security < PAGE_SIZE)
+diff --git a/kernel/perf_event.c b/kernel/perf_event.c
+index 32d0ae2..e928e1a 100644
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -4811,7 +4811,7 @@ err_fput_free_put_context:
+ 
+ err_free_put_context:
+ 	if (err < 0)
+-		kfree(event);
++		free_event(event);
+ 
+ err_put_context:
+ 	if (err < 0)
+diff --git a/lib/flex_array.c b/lib/flex_array.c
+index 66eef2e..41b1804 100644
+--- a/lib/flex_array.c
++++ b/lib/flex_array.c
+@@ -99,7 +99,7 @@ struct flex_array *flex_array_alloc(int element_size, unsigned int total,
+ 	ret->element_size = element_size;
+ 	ret->total_nr_elements = total;
+ 	if (elements_fit_in_base(ret) && !(flags & __GFP_ZERO))
+-		memset(ret->parts[0], FLEX_ARRAY_FREE,
++		memset(&ret->parts[0], FLEX_ARRAY_FREE,
+ 						FLEX_ARRAY_BASE_BYTES_LEFT);
+ 	return ret;
+ }
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 2d16fa6..fd9ba95 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -546,6 +546,7 @@ static void free_huge_page(struct page *page)
+ 
+ 	mapping = (struct address_space *) page_private(page);
+ 	set_page_private(page, 0);
++	page->mapping = NULL;
+ 	BUG_ON(page_count(page));
+ 	INIT_LIST_HEAD(&page->lru);
+ 
+@@ -2447,8 +2448,10 @@ retry:
+ 			spin_lock(&inode->i_lock);
+ 			inode->i_blocks += blocks_per_huge_page(h);
+ 			spin_unlock(&inode->i_lock);
+-		} else
++		} else {
+ 			lock_page(page);
++			page->mapping = HUGETLB_POISON;
++		}
+ 	}
+ 
+ 	/*
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 954032b..dff3379 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -2215,12 +2215,12 @@ int mem_cgroup_prepare_migration(struct page *page, struct mem_cgroup **ptr)
+ 	}
+ 	unlock_page_cgroup(pc);
+ 
++	*ptr = mem;
+ 	if (mem) {
+-		ret = __mem_cgroup_try_charge(NULL, GFP_KERNEL, &mem, false,
++		ret = __mem_cgroup_try_charge(NULL, GFP_KERNEL, ptr, false,
+ 						page);
+ 		css_put(&mem->css);
+ 	}
+-	*ptr = mem;
+ 	return ret;
+ }
+ 
+diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
+index bad1c49..72340dd 100644
+--- a/net/ieee802154/af_ieee802154.c
++++ b/net/ieee802154/af_ieee802154.c
+@@ -147,6 +147,9 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
+ 	dev_load(sock_net(sk), ifr.ifr_name);
+ 	dev = dev_get_by_name(sock_net(sk), ifr.ifr_name);
+ 
++	if (!dev)
++		return -ENODEV;
++
+ 	if (dev->type == ARPHRD_IEEE802154 && dev->netdev_ops->ndo_do_ioctl)
+ 		ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, cmd);
+ 
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 564a0f8..03c55ac 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -1368,6 +1368,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
+ 		sk_eat_skb(sk, skb, 0);
+ 		if (!desc->count)
+ 			break;
++		tp->copied_seq = seq;
+ 	}
+ 	tp->copied_seq = seq;
+ 
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 112c611..16190ca 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -471,8 +471,8 @@ static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
+ 			if (hslot->count < hslot2->count)
+ 				goto begin;
+ 
+-			result = udp4_lib_lookup2(net, INADDR_ANY, sport,
+-						  daddr, hnum, dif,
++			result = udp4_lib_lookup2(net, saddr, sport,
++						  INADDR_ANY, hnum, dif,
+ 						  hslot2, slot2);
+ 		}
+ 		rcu_read_unlock();
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 548a06e..d2ef3a3 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1006,7 +1006,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
+ 	skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
+ 
+ 	t1 = (struct tcphdr *) skb_push(buff, tot_len);
+-	skb_reset_transport_header(skb);
++	skb_reset_transport_header(buff);
+ 
+ 	/* Swap the send and the receive. */
+ 	memset(t1, 0, sizeof(*t1));
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index d9714d2..4f57cd2 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -258,8 +258,8 @@ static struct sock *__udp6_lib_lookup(struct net *net,
+ 			if (hslot->count < hslot2->count)
+ 				goto begin;
+ 
+-			result = udp6_lib_lookup2(net, &in6addr_any, sport,
+-						  daddr, hnum, dif,
++			result = udp6_lib_lookup2(net, saddr, sport,
++						  &in6addr_any, hnum, dif,
+ 						  hslot2, slot2);
+ 		}
+ 		rcu_read_unlock();
+diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
+index 304b0b6..dfdc138 100644
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -183,7 +183,6 @@ static void sta_addba_resp_timer_expired(unsigned long data)
+ 		       HT_AGG_STATE_REQ_STOP_BA_MSK)) !=
+ 						HT_ADDBA_REQUESTED_MSK) {
+ 		spin_unlock_bh(&sta->lock);
+-		*state = HT_AGG_STATE_IDLE;
+ #ifdef CONFIG_MAC80211_HT_DEBUG
+ 		printk(KERN_DEBUG "timer expired on tid %d but we are not "
+ 				"(or no longer) expecting addBA response there",
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index df5abbf..99c93ee 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1194,8 +1194,10 @@ void sctp_assoc_update(struct sctp_association *asoc,
+ 	/* Remove any peer addresses not present in the new association. */
+ 	list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
+ 		trans = list_entry(pos, struct sctp_transport, transports);
+-		if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr))
+-			sctp_assoc_del_peer(asoc, &trans->ipaddr);
++		if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr)) {
++			sctp_assoc_rm_peer(asoc, trans);
++			continue;
++		}
+ 
+ 		if (asoc->state >= SCTP_STATE_ESTABLISHED)
+ 			sctp_transport_reset(trans);
+diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
+index 905fda5..7ec09ba 100644
+--- a/net/sctp/endpointola.c
++++ b/net/sctp/endpointola.c
+@@ -144,6 +144,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
+ 	/* Use SCTP specific send buffer space queues.  */
+ 	ep->sndbuf_policy = sctp_sndbuf_policy;
+ 
++	sk->sk_data_ready = sctp_data_ready;
+ 	sk->sk_write_space = sctp_write_space;
+ 	sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
+ 
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index 9e73291..224db01 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -207,7 +207,8 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
+ 	sp = sctp_sk(asoc->base.sk);
+ 	num_types = sp->pf->supported_addrs(sp, types);
+ 
+-	chunksize = sizeof(init) + addrs_len + SCTP_SAT_LEN(num_types);
++	chunksize = sizeof(init) + addrs_len;
++	chunksize += WORD_ROUND(SCTP_SAT_LEN(num_types));
+ 	chunksize += sizeof(ecap_param);
+ 
+ 	if (sctp_prsctp_enable)
+@@ -237,14 +238,14 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
+ 		/* Add HMACS parameter length if any were defined */
+ 		auth_hmacs = (sctp_paramhdr_t *)asoc->c.auth_hmacs;
+ 		if (auth_hmacs->length)
+-			chunksize += ntohs(auth_hmacs->length);
++			chunksize += WORD_ROUND(ntohs(auth_hmacs->length));
+ 		else
+ 			auth_hmacs = NULL;
+ 
+ 		/* Add CHUNKS parameter length */
+ 		auth_chunks = (sctp_paramhdr_t *)asoc->c.auth_chunks;
+ 		if (auth_chunks->length)
+-			chunksize += ntohs(auth_chunks->length);
++			chunksize += WORD_ROUND(ntohs(auth_chunks->length));
+ 		else
+ 			auth_chunks = NULL;
+ 
+@@ -254,7 +255,8 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
+ 
+ 	/* If we have any extensions to report, account for that */
+ 	if (num_ext)
+-		chunksize += sizeof(sctp_supported_ext_param_t) + num_ext;
++		chunksize += WORD_ROUND(sizeof(sctp_supported_ext_param_t) +
++					num_ext);
+ 
+ 	/* RFC 2960 3.3.2 Initiation (INIT) (1)
+ 	 *
+@@ -396,13 +398,13 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
+ 
+ 		auth_hmacs = (sctp_paramhdr_t *)asoc->c.auth_hmacs;
+ 		if (auth_hmacs->length)
+-			chunksize += ntohs(auth_hmacs->length);
++			chunksize += WORD_ROUND(ntohs(auth_hmacs->length));
+ 		else
+ 			auth_hmacs = NULL;
+ 
+ 		auth_chunks = (sctp_paramhdr_t *)asoc->c.auth_chunks;
+ 		if (auth_chunks->length)
+-			chunksize += ntohs(auth_chunks->length);
++			chunksize += WORD_ROUND(ntohs(auth_chunks->length));
+ 		else
+ 			auth_chunks = NULL;
+ 
+@@ -411,7 +413,8 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
+ 	}
+ 
+ 	if (num_ext)
+-		chunksize += sizeof(sctp_supported_ext_param_t) + num_ext;
++		chunksize += WORD_ROUND(sizeof(sctp_supported_ext_param_t) +
++					num_ext);
+ 
+ 	/* Now allocate and fill out the chunk.  */
+ 	retval = sctp_make_chunk(asoc, SCTP_CID_INIT_ACK, 0, chunksize);
+@@ -3314,21 +3317,6 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
+ 	sctp_chunk_free(asconf);
+ 	asoc->addip_last_asconf = NULL;
+ 
+-	/* Send the next asconf chunk from the addip chunk queue. */
+-	if (!list_empty(&asoc->addip_chunk_list)) {
+-		struct list_head *entry = asoc->addip_chunk_list.next;
+-		asconf = list_entry(entry, struct sctp_chunk, list);
+-
+-		list_del_init(entry);
+-
+-		/* Hold the chunk until an ASCONF_ACK is received. */
+-		sctp_chunk_hold(asconf);
+-		if (sctp_primitive_ASCONF(asoc, asconf))
+-			sctp_chunk_free(asconf);
+-		else
+-			asoc->addip_last_asconf = asconf;
+-	}
+-
+ 	return retval;
+ }
+ 
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 4e4ca65..42bbb24 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -961,6 +961,29 @@ static int sctp_cmd_send_msg(struct sctp_association *asoc,
+ }
+ 
+ 
++/* Sent the next ASCONF packet currently stored in the association.
++ * This happens after the ASCONF_ACK was succeffully processed.
++ */
++static void sctp_cmd_send_asconf(struct sctp_association *asoc)
++{
++	/* Send the next asconf chunk from the addip chunk
++	 * queue.
++	 */
++	if (!list_empty(&asoc->addip_chunk_list)) {
++		struct list_head *entry = asoc->addip_chunk_list.next;
++		struct sctp_chunk *asconf = list_entry(entry,
++						struct sctp_chunk, list);
++		list_del_init(entry);
++
++		/* Hold the chunk until an ASCONF_ACK is received. */
++		sctp_chunk_hold(asconf);
++		if (sctp_primitive_ASCONF(asoc, asconf))
++			sctp_chunk_free(asconf);
++		else
++			asoc->addip_last_asconf = asconf;
++	}
++}
++
+ 
+ /* These three macros allow us to pull the debugging code out of the
+  * main flow of sctp_do_sm() to keep attention focused on the real
+@@ -1616,6 +1639,9 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
+ 			}
+ 			error = sctp_cmd_send_msg(asoc, cmd->obj.msg);
+ 			break;
++		case SCTP_CMD_SEND_NEXT_ASCONF:
++			sctp_cmd_send_asconf(asoc);
++			break;
+ 		default:
+ 			printk(KERN_WARNING "Impossible command: %u, %p\n",
+ 			       cmd->verb, cmd->obj.ptr);
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 47bc20d..c3f75e7 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -3675,8 +3675,14 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
+ 				SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
+ 
+ 		if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
+-					     asconf_ack))
++					     asconf_ack)) {
++			/* Successfully processed ASCONF_ACK.  We can
++			 * release the next asconf if we have one.
++			 */
++			sctp_add_cmd_sf(commands, SCTP_CMD_SEND_NEXT_ASCONF,
++					SCTP_NULL());
+ 			return SCTP_DISPOSITION_CONSUME;
++		}
+ 
+ 		abort = sctp_make_abort(asoc, asconf_ack,
+ 					sizeof(sctp_errhdr_t));
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 9bd9d82..aa3ba60 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -3718,12 +3718,12 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
+ 	sp->hmac = NULL;
+ 
+ 	SCTP_DBG_OBJCNT_INC(sock);
+-	percpu_counter_inc(&sctp_sockets_allocated);
+ 
+ 	/* Set socket backlog limit. */
+ 	sk->sk_backlog.limit = sysctl_sctp_rmem[1];
+ 
+ 	local_bh_disable();
++	percpu_counter_inc(&sctp_sockets_allocated);
+ 	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+ 	local_bh_enable();
+ 
+@@ -3740,8 +3740,8 @@ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
+ 	/* Release our hold on the endpoint. */
+ 	ep = sctp_sk(sk)->ep;
+ 	sctp_endpoint_free(ep);
+-	percpu_counter_dec(&sctp_sockets_allocated);
+ 	local_bh_disable();
++	percpu_counter_dec(&sctp_sockets_allocated);
+ 	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
+ 	local_bh_enable();
+ }
+@@ -6188,6 +6188,16 @@ do_nonblock:
+ 	goto out;
+ }
+ 
++void sctp_data_ready(struct sock *sk, int len)
++{
++	read_lock_bh(&sk->sk_callback_lock);
++	if (sk_has_sleeper(sk))
++		wake_up_interruptible_sync_poll(sk->sk_sleep, POLLIN |
++						POLLRDNORM | POLLRDBAND);
++	sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
++	read_unlock_bh(&sk->sk_callback_lock);
++}
++
+ /* If socket sndbuf has changed, wake up all per association waiters.  */
+ void sctp_write_space(struct sock *sk)
+ {
+diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
+index 327011f..7809137 100644
+--- a/net/tipc/bearer.c
++++ b/net/tipc/bearer.c
+@@ -45,10 +45,10 @@
+ 
+ #define MAX_ADDR_STR 32
+ 
+-static struct media *media_list = NULL;
++static struct media media_list[MAX_MEDIA];
+ static u32 media_count = 0;
+ 
+-struct bearer *tipc_bearers = NULL;
++struct bearer tipc_bearers[MAX_BEARERS];
+ 
+ /**
+  * media_name_valid - validate media name
+@@ -108,9 +108,11 @@ int  tipc_register_media(u32 media_type,
+ 	int res = -EINVAL;
+ 
+ 	write_lock_bh(&tipc_net_lock);
+-	if (!media_list)
+-		goto exit;
+ 
++	if (tipc_mode != TIPC_NET_MODE) {
++		warn("Media <%s> rejected, not in networked mode yet\n", name);
++		goto exit;
++	}
+ 	if (!media_name_valid(name)) {
+ 		warn("Media <%s> rejected, illegal name\n", name);
+ 		goto exit;
+@@ -660,33 +662,10 @@ int tipc_disable_bearer(const char *name)
+ 
+ 
+ 
+-int tipc_bearer_init(void)
+-{
+-	int res;
+-
+-	write_lock_bh(&tipc_net_lock);
+-	tipc_bearers = kcalloc(MAX_BEARERS, sizeof(struct bearer), GFP_ATOMIC);
+-	media_list = kcalloc(MAX_MEDIA, sizeof(struct media), GFP_ATOMIC);
+-	if (tipc_bearers && media_list) {
+-		res = 0;
+-	} else {
+-		kfree(tipc_bearers);
+-		kfree(media_list);
+-		tipc_bearers = NULL;
+-		media_list = NULL;
+-		res = -ENOMEM;
+-	}
+-	write_unlock_bh(&tipc_net_lock);
+-	return res;
+-}
+-
+ void tipc_bearer_stop(void)
+ {
+ 	u32 i;
+ 
+-	if (!tipc_bearers)
+-		return;
+-
+ 	for (i = 0; i < MAX_BEARERS; i++) {
+ 		if (tipc_bearers[i].active)
+ 			tipc_bearers[i].publ.blocked = 1;
+@@ -695,10 +674,6 @@ void tipc_bearer_stop(void)
+ 		if (tipc_bearers[i].active)
+ 			bearer_disable(tipc_bearers[i].publ.name);
+ 	}
+-	kfree(tipc_bearers);
+-	kfree(media_list);
+-	tipc_bearers = NULL;
+-	media_list = NULL;
+ 	media_count = 0;
+ }
+ 
+diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
+index ca57348..000228e 100644
+--- a/net/tipc/bearer.h
++++ b/net/tipc/bearer.h
+@@ -114,7 +114,7 @@ struct bearer_name {
+ 
+ struct link;
+ 
+-extern struct bearer *tipc_bearers;
++extern struct bearer tipc_bearers[];
+ 
+ void tipc_media_addr_printf(struct print_buf *pb, struct tipc_media_addr *a);
+ struct sk_buff *tipc_media_get_names(void);
+diff --git a/net/tipc/net.c b/net/tipc/net.c
+index 7906608..f25b1cd 100644
+--- a/net/tipc/net.c
++++ b/net/tipc/net.c
+@@ -116,7 +116,8 @@
+ */
+ 
+ DEFINE_RWLOCK(tipc_net_lock);
+-struct network tipc_net = { NULL };
++struct _zone *tipc_zones[256] = { NULL, };
++struct network tipc_net = { tipc_zones };
+ 
+ struct tipc_node *tipc_net_select_remote_node(u32 addr, u32 ref)
+ {
+@@ -158,28 +159,12 @@ void tipc_net_send_external_routes(u32 dest)
+ 	}
+ }
+ 
+-static int net_init(void)
+-{
+-	memset(&tipc_net, 0, sizeof(tipc_net));
+-	tipc_net.zones = kcalloc(tipc_max_zones + 1, sizeof(struct _zone *), GFP_ATOMIC);
+-	if (!tipc_net.zones) {
+-		return -ENOMEM;
+-	}
+-	return 0;
+-}
+-
+ static void net_stop(void)
+ {
+ 	u32 z_num;
+ 
+-	if (!tipc_net.zones)
+-		return;
+-
+-	for (z_num = 1; z_num <= tipc_max_zones; z_num++) {
++	for (z_num = 1; z_num <= tipc_max_zones; z_num++)
+ 		tipc_zone_delete(tipc_net.zones[z_num]);
+-	}
+-	kfree(tipc_net.zones);
+-	tipc_net.zones = NULL;
+ }
+ 
+ static void net_route_named_msg(struct sk_buff *buf)
+@@ -282,9 +267,7 @@ int tipc_net_start(u32 addr)
+ 	tipc_named_reinit();
+ 	tipc_port_reinit();
+ 
+-	if ((res = tipc_bearer_init()) ||
+-	    (res = net_init()) ||
+-	    (res = tipc_cltr_init()) ||
++	if ((res = tipc_cltr_init()) ||
+ 	    (res = tipc_bclink_init())) {
+ 		return res;
+ 	}
+diff --git a/security/inode.c b/security/inode.c
+index c3a7938..1c812e8 100644
+--- a/security/inode.c
++++ b/security/inode.c
+@@ -161,13 +161,13 @@ static int create_by_name(const char *name, mode_t mode,
+ 
+ 	mutex_lock(&parent->d_inode->i_mutex);
+ 	*dentry = lookup_one_len(name, parent, strlen(name));
+-	if (!IS_ERR(dentry)) {
++	if (!IS_ERR(*dentry)) {
+ 		if ((mode & S_IFMT) == S_IFDIR)
+ 			error = mkdir(parent->d_inode, *dentry, mode);
+ 		else
+ 			error = create(parent->d_inode, *dentry, mode);
+ 	} else
+-		error = PTR_ERR(dentry);
++		error = PTR_ERR(*dentry);
+ 	mutex_unlock(&parent->d_inode->i_mutex);
+ 
+ 	return error;
+diff --git a/security/keys/request_key.c b/security/keys/request_key.c
+index 03fe63e..9ac7bfd 100644
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -336,8 +336,10 @@ static int construct_alloc_key(struct key_type *type,
+ 
+ key_already_present:
+ 	mutex_unlock(&key_construction_mutex);
+-	if (dest_keyring)
++	if (dest_keyring) {
++		__key_link(dest_keyring, key_ref_to_ptr(key_ref));
+ 		up_write(&dest_keyring->sem);
++	}
+ 	mutex_unlock(&user->cons_lock);
+ 	key_put(key);
+ 	*_key = key = key_ref_to_ptr(key_ref);
+@@ -428,6 +430,11 @@ struct key *request_key_and_link(struct key_type *type,
+ 
+ 	if (!IS_ERR(key_ref)) {
+ 		key = key_ref_to_ptr(key_ref);
++		if (dest_keyring) {
++			construct_get_dest_keyring(&dest_keyring);
++			key_link(dest_keyring, key);
++			key_put(dest_keyring);
++		}
+ 	} else if (PTR_ERR(key_ref) != -EAGAIN) {
+ 		key = ERR_CAST(key_ref);
+ 	} else  {
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 062a8b0..fd831bd 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2273,6 +2273,7 @@ static struct snd_pci_quirk position_fix_list[] __devinitdata = {
+ 	SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x1565, 0x8218, "Biostar Microtech", POS_FIX_LPIB),
++	SND_PCI_QUIRK(0x8086, 0x2503, "DG965OT AAD63733-203", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x8086, 0xd601, "eMachines T5212", POS_FIX_LPIB),
+ 	{}
+ };
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 71b7a96..1a97c81 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1174,9 +1174,10 @@ static int patch_cxt5045(struct hda_codec *codec)
+ 
+ 	switch (codec->subsystem_id >> 16) {
+ 	case 0x103c:
++	case 0x1631:
+ 	case 0x1734:
+-		/* HP & Fujitsu-Siemens laptops have really bad sound over 0dB
+-		 * on NID 0x17. Fix max PCM level to 0 dB
++		/* HP, Packard Bell, & Fujitsu-Siemens laptops have really bad
++		 * sound over 0dB on NID 0x17. Fix max PCM level to 0 dB
+ 		 * (originally it has 0x2b steps with 0dB offset 0x14)
+ 		 */
+ 		snd_hda_override_amp_caps(codec, 0x17, HDA_INPUT,
+@@ -2471,6 +2472,8 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
+ 		      CXT5066_DELL_LAPTOP),
+ 	SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT5066_OLPC_XO_1_5),
+ 	SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTO),
++	SND_PCI_QUIRK(0x1179, 0xff50, "Toshiba Satellite P500-PSPGSC-01800T", CXT5066_OLPC_XO_1_5),
++	SND_PCI_QUIRK(0x1179, 0xffe0, "Toshiba Satellite Pro T130-15F", CXT5066_OLPC_XO_1_5),
+ 	{}
+ };
+ 
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index bd8a567..b486daa 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4033,7 +4033,7 @@ static struct snd_pci_quirk alc880_cfg_tbl[] = {
+ 	SND_PCI_QUIRK(0x1695, 0x4012, "EPox EP-5LDA", ALC880_5ST_DIG),
+ 	SND_PCI_QUIRK(0x1734, 0x107c, "FSC F1734", ALC880_F1734),
+ 	SND_PCI_QUIRK(0x1734, 0x1094, "FSC Amilo M1451G", ALC880_FUJITSU),
+-	SND_PCI_QUIRK(0x1734, 0x10ac, "FSC", ALC880_UNIWILL),
++	SND_PCI_QUIRK(0x1734, 0x10ac, "FSC AMILO Xi 1526", ALC880_F1734),
+ 	SND_PCI_QUIRK(0x1734, 0x10b0, "Fujitsu", ALC880_FUJITSU),
+ 	SND_PCI_QUIRK(0x1854, 0x0018, "LG LW20", ALC880_LG_LW),
+ 	SND_PCI_QUIRK(0x1854, 0x003b, "LG", ALC880_LG),
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 799ba25..ac2d528 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1602,6 +1602,10 @@ static struct snd_pci_quirk stac92hd73xx_cfg_tbl[] = {
+ 				"Dell Studio 1555", STAC_DELL_M6_DMIC),
+ 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02bd,
+ 				"Dell Studio 1557", STAC_DELL_M6_DMIC),
++	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02fe,
++				"Dell Studio XPS 1645", STAC_DELL_M6_BOTH),
++	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0413,
++				"Dell Studio 1558", STAC_DELL_M6_BOTH),
+ 	{} /* terminator */
+ };
+ 
+@@ -1725,6 +1729,8 @@ static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = {
+ 		      "HP HDX", STAC_HP_HDX),  /* HDX16 */
+ 	SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x3620,
+ 		      "HP dv6", STAC_HP_DV5),
++	SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3061,
++		      "HP dv6", STAC_HP_DV5), /* HP dv6-1110ax */
+ 	SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x7010,
+ 		      "HP", STAC_HP_DV5),
+ 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0233,
+diff --git a/sound/pci/maestro3.c b/sound/pci/maestro3.c
+index 75283fb..c2311f8 100644
+--- a/sound/pci/maestro3.c
++++ b/sound/pci/maestro3.c
+@@ -849,6 +849,7 @@ struct snd_m3 {
+ 	struct snd_kcontrol *master_switch;
+ 	struct snd_kcontrol *master_volume;
+ 	struct tasklet_struct hwvol_tq;
++	unsigned int in_suspend;
+ 
+ #ifdef CONFIG_PM
+ 	u16 *suspend_mem;
+@@ -884,6 +885,7 @@ static struct pci_device_id snd_m3_ids[] = {
+ MODULE_DEVICE_TABLE(pci, snd_m3_ids);
+ 
+ static struct snd_pci_quirk m3_amp_quirk_list[] __devinitdata = {
++	SND_PCI_QUIRK(0x0E11, 0x0094, "Compaq Evo N600c", 0x0c),
+ 	SND_PCI_QUIRK(0x10f7, 0x833e, "Panasonic CF-28", 0x0d),
+ 	SND_PCI_QUIRK(0x10f7, 0x833d, "Panasonic CF-72", 0x0d),
+ 	SND_PCI_QUIRK(0x1033, 0x80f1, "NEC LM800J/7", 0x03),
+@@ -1613,6 +1615,11 @@ static void snd_m3_update_hw_volume(unsigned long private_data)
+ 	outb(0x88, chip->iobase + SHADOW_MIX_REG_MASTER);
+ 	outb(0x88, chip->iobase + HW_VOL_COUNTER_MASTER);
+ 
++	/* Ignore spurious HV interrupts during suspend / resume, this avoids
++	   mistaking them for a mute button press. */
++	if (chip->in_suspend)
++		return;
++
+ 	if (!chip->master_switch || !chip->master_volume)
+ 		return;
+ 
+@@ -2424,6 +2431,7 @@ static int m3_suspend(struct pci_dev *pci, pm_message_t state)
+ 	if (chip->suspend_mem == NULL)
+ 		return 0;
+ 
++	chip->in_suspend = 1;
+ 	snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
+ 	snd_pcm_suspend_all(chip->pcm);
+ 	snd_ac97_suspend(chip->ac97);
+@@ -2497,6 +2505,7 @@ static int m3_resume(struct pci_dev *pci)
+ 	snd_m3_hv_init(chip);
+ 
+ 	snd_power_change_state(card, SNDRV_CTL_POWER_D0);
++	chip->in_suspend = 0;
+ 	return 0;
+ }
+ #endif /* CONFIG_PM */

Deleted: genpatches-2.6/trunk/2.6.33/1003_linux-2.6.33.5.patch
===================================================================
--- genpatches-2.6/trunk/2.6.33/1003_linux-2.6.33.5.patch	2010-07-05 22:42:35 UTC (rev 1720)
+++ genpatches-2.6/trunk/2.6.33/1003_linux-2.6.33.5.patch	2010-07-05 23:09:19 UTC (rev 1721)
@@ -1,1623 +0,0 @@
-diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
-index 0d07513..bf241be 100644
---- a/Documentation/filesystems/proc.txt
-+++ b/Documentation/filesystems/proc.txt
-@@ -308,7 +308,7 @@ address           perms offset  dev   inode      pathname
- 08049000-0804a000 rw-p 00001000 03:00 8312       /opt/test
- 0804a000-0806b000 rw-p 00000000 00:00 0          [heap]
- a7cb1000-a7cb2000 ---p 00000000 00:00 0
--a7cb2000-a7eb2000 rw-p 00000000 00:00 0          [threadstack:001ff4b4]
-+a7cb2000-a7eb2000 rw-p 00000000 00:00 0
- a7eb2000-a7eb3000 ---p 00000000 00:00 0
- a7eb3000-a7ed5000 rw-p 00000000 00:00 0
- a7ed5000-a8008000 r-xp 00000000 03:00 4222       /lib/libc.so.6
-@@ -344,7 +344,6 @@ is not associated with a file:
-  [stack]                  = the stack of the main process
-  [vdso]                   = the "virtual dynamic shared object",
-                             the kernel system call handler
-- [threadstack:xxxxxxxx]   = the stack of the thread, xxxxxxxx is the stack size
- 
-  or if empty, the mapping is anonymous.
- 
-diff --git a/arch/powerpc/include/asm/hw_irq.h b/arch/powerpc/include/asm/hw_irq.h
-index 9f4c9d4..bd100fc 100644
---- a/arch/powerpc/include/asm/hw_irq.h
-+++ b/arch/powerpc/include/asm/hw_irq.h
-@@ -130,43 +130,5 @@ static inline int irqs_disabled_flags(unsigned long flags)
-  */
- struct irq_chip;
- 
--#ifdef CONFIG_PERF_EVENTS
--
--#ifdef CONFIG_PPC64
--static inline unsigned long test_perf_event_pending(void)
--{
--	unsigned long x;
--
--	asm volatile("lbz %0,%1(13)"
--		: "=r" (x)
--		: "i" (offsetof(struct paca_struct, perf_event_pending)));
--	return x;
--}
--
--static inline void set_perf_event_pending(void)
--{
--	asm volatile("stb %0,%1(13)" : :
--		"r" (1),
--		"i" (offsetof(struct paca_struct, perf_event_pending)));
--}
--
--static inline void clear_perf_event_pending(void)
--{
--	asm volatile("stb %0,%1(13)" : :
--		"r" (0),
--		"i" (offsetof(struct paca_struct, perf_event_pending)));
--}
--#endif /* CONFIG_PPC64 */
--
--#else  /* CONFIG_PERF_EVENTS */
--
--static inline unsigned long test_perf_event_pending(void)
--{
--	return 0;
--}
--
--static inline void clear_perf_event_pending(void) {}
--#endif /* CONFIG_PERF_EVENTS */
--
- #endif	/* __KERNEL__ */
- #endif	/* _ASM_POWERPC_HW_IRQ_H */
-diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
-index a6c2b63..11d0668 100644
---- a/arch/powerpc/kernel/asm-offsets.c
-+++ b/arch/powerpc/kernel/asm-offsets.c
-@@ -133,7 +133,6 @@ int main(void)
- 	DEFINE(PACAKMSR, offsetof(struct paca_struct, kernel_msr));
- 	DEFINE(PACASOFTIRQEN, offsetof(struct paca_struct, soft_enabled));
- 	DEFINE(PACAHARDIRQEN, offsetof(struct paca_struct, hard_enabled));
--	DEFINE(PACAPERFPEND, offsetof(struct paca_struct, perf_event_pending));
- 	DEFINE(PACACONTEXTID, offsetof(struct paca_struct, context.id));
- #ifdef CONFIG_PPC_MM_SLICES
- 	DEFINE(PACALOWSLICESPSIZE, offsetof(struct paca_struct,
-diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
-index bdcb557..afbf400 100644
---- a/arch/powerpc/kernel/entry_64.S
-+++ b/arch/powerpc/kernel/entry_64.S
-@@ -556,15 +556,6 @@ ALT_FW_FTR_SECTION_END_IFCLR(FW_FEATURE_ISERIES)
- 2:
- 	TRACE_AND_RESTORE_IRQ(r5);
- 
--#ifdef CONFIG_PERF_EVENTS
--	/* check paca->perf_event_pending if we're enabling ints */
--	lbz	r3,PACAPERFPEND(r13)
--	and.	r3,r3,r5
--	beq	27f
--	bl	.perf_event_do_pending
--27:
--#endif /* CONFIG_PERF_EVENTS */
--
- 	/* extract EE bit and use it to restore paca->hard_enabled */
- 	ld	r3,_MSR(r1)
- 	rldicl	r4,r3,49,63		/* r0 = (r3 >> 15) & 1 */
-diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
-index 9040330..dee83b8 100644
---- a/arch/powerpc/kernel/irq.c
-+++ b/arch/powerpc/kernel/irq.c
-@@ -53,7 +53,6 @@
- #include <linux/bootmem.h>
- #include <linux/pci.h>
- #include <linux/debugfs.h>
--#include <linux/perf_event.h>
- 
- #include <asm/uaccess.h>
- #include <asm/system.h>
-@@ -143,11 +142,6 @@ notrace void raw_local_irq_restore(unsigned long en)
- 	}
- #endif /* CONFIG_PPC_STD_MMU_64 */
- 
--	if (test_perf_event_pending()) {
--		clear_perf_event_pending();
--		perf_event_do_pending();
--	}
--
- 	/*
- 	 * if (get_paca()->hard_enabled) return;
- 	 * But again we need to take care that gcc gets hard_enabled directly
-diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
-index 6c6093d..6f174e7 100644
---- a/arch/powerpc/kernel/time.c
-+++ b/arch/powerpc/kernel/time.c
-@@ -532,25 +532,60 @@ void __init iSeries_time_init_early(void)
- }
- #endif /* CONFIG_PPC_ISERIES */
- 
--#if defined(CONFIG_PERF_EVENTS) && defined(CONFIG_PPC32)
--DEFINE_PER_CPU(u8, perf_event_pending);
-+#ifdef CONFIG_PERF_EVENTS
- 
--void set_perf_event_pending(void)
-+/*
-+ * 64-bit uses a byte in the PACA, 32-bit uses a per-cpu variable...
-+ */
-+#ifdef CONFIG_PPC64
-+static inline unsigned long test_perf_event_pending(void)
- {
--	get_cpu_var(perf_event_pending) = 1;
--	set_dec(1);
--	put_cpu_var(perf_event_pending);
-+	unsigned long x;
-+
-+	asm volatile("lbz %0,%1(13)"
-+		: "=r" (x)
-+		: "i" (offsetof(struct paca_struct, perf_event_pending)));
-+	return x;
- }
- 
-+static inline void set_perf_event_pending_flag(void)
-+{
-+	asm volatile("stb %0,%1(13)" : :
-+		"r" (1),
-+		"i" (offsetof(struct paca_struct, perf_event_pending)));
-+}
-+
-+static inline void clear_perf_event_pending(void)
-+{
-+	asm volatile("stb %0,%1(13)" : :
-+		"r" (0),
-+		"i" (offsetof(struct paca_struct, perf_event_pending)));
-+}
-+
-+#else /* 32-bit */
-+
-+DEFINE_PER_CPU(u8, perf_event_pending);
-+
-+#define set_perf_event_pending_flag()	__get_cpu_var(perf_event_pending) = 1
- #define test_perf_event_pending()	__get_cpu_var(perf_event_pending)
- #define clear_perf_event_pending()	__get_cpu_var(perf_event_pending) = 0
- 
--#else  /* CONFIG_PERF_EVENTS && CONFIG_PPC32 */
-+#endif /* 32 vs 64 bit */
-+
-+void set_perf_event_pending(void)
-+{
-+	preempt_disable();
-+	set_perf_event_pending_flag();
-+	set_dec(1);
-+	preempt_enable();
-+}
-+
-+#else  /* CONFIG_PERF_EVENTS */
- 
- #define test_perf_event_pending()	0
- #define clear_perf_event_pending()
- 
--#endif /* CONFIG_PERF_EVENTS && CONFIG_PPC32 */
-+#endif /* CONFIG_PERF_EVENTS */
- 
- /*
-  * For iSeries shared processors, we have to let the hypervisor
-@@ -580,10 +615,6 @@ void timer_interrupt(struct pt_regs * regs)
- 	set_dec(DECREMENTER_MAX);
- 
- #ifdef CONFIG_PPC32
--	if (test_perf_event_pending()) {
--		clear_perf_event_pending();
--		perf_event_do_pending();
--	}
- 	if (atomic_read(&ppc_n_lost_interrupts) != 0)
- 		do_IRQ(regs);
- #endif
-@@ -602,6 +633,11 @@ void timer_interrupt(struct pt_regs * regs)
- 
- 	calculate_steal_time();
- 
-+	if (test_perf_event_pending()) {
-+		clear_perf_event_pending();
-+		perf_event_do_pending();
-+	}
-+
- #ifdef CONFIG_PPC_ISERIES
- 	if (firmware_has_feature(FW_FEATURE_ISERIES))
- 		get_lppaca()->int_dword.fields.decr_int = 0;
-diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
-index 7cf4642..11e94de 100644
---- a/arch/s390/kernel/ptrace.c
-+++ b/arch/s390/kernel/ptrace.c
-@@ -640,7 +640,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
- 
- asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
- {
--	long ret;
-+	long ret = 0;
- 
- 	/* Do the secure computing check first. */
- 	secure_computing(regs->gprs[2]);
-@@ -649,7 +649,6 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
- 	 * The sysc_tracesys code in entry.S stored the system
- 	 * call number to gprs[2].
- 	 */
--	ret = regs->gprs[2];
- 	if (test_thread_flag(TIF_SYSCALL_TRACE) &&
- 	    (tracehook_report_syscall_entry(regs) ||
- 	     regs->gprs[2] >= NR_syscalls)) {
-@@ -671,7 +670,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
- 				    regs->gprs[2], regs->orig_gpr2,
- 				    regs->gprs[3], regs->gprs[4],
- 				    regs->gprs[5]);
--	return ret;
-+	return ret ?: regs->gprs[2];
- }
- 
- asmlinkage void do_syscall_trace_exit(struct pt_regs *regs)
-diff --git a/arch/x86/include/asm/k8.h b/arch/x86/include/asm/k8.h
-index f70e600..af00bd1 100644
---- a/arch/x86/include/asm/k8.h
-+++ b/arch/x86/include/asm/k8.h
-@@ -16,11 +16,16 @@ extern int k8_numa_init(unsigned long start_pfn, unsigned long end_pfn);
- extern int k8_scan_nodes(void);
- 
- #ifdef CONFIG_K8_NB
-+extern int num_k8_northbridges;
-+
- static inline struct pci_dev *node_to_k8_nb_misc(int node)
- {
- 	return (node < num_k8_northbridges) ? k8_northbridges[node] : NULL;
- }
-+
- #else
-+#define num_k8_northbridges 0
-+
- static inline struct pci_dev *node_to_k8_nb_misc(int node)
- {
- 	return NULL;
-diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
-index d440123..581924b 100644
---- a/arch/x86/kernel/cpu/intel_cacheinfo.c
-+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
-@@ -338,6 +338,10 @@ amd_check_l3_disable(int index, struct _cpuid4_info_regs *this_leaf)
- 	     (boot_cpu_data.x86_mask  < 0x1)))
- 		return;
- 
-+	/* not in virtualized environments */
-+	if (num_k8_northbridges == 0)
-+		return;
-+
- 	this_leaf->can_disable = true;
- 	this_leaf->l3_indices  = amd_calc_l3_indices();
- }
-diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
-index 999c8a6..0571b72 100644
---- a/arch/x86/kernel/process.c
-+++ b/arch/x86/kernel/process.c
-@@ -539,11 +539,13 @@ static int __cpuinit check_c1e_idle(const struct cpuinfo_x86 *c)
- 		 * check OSVW bit for CPUs that are not affected
- 		 * by erratum #400
- 		 */
--		rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, val);
--		if (val >= 2) {
--			rdmsrl(MSR_AMD64_OSVW_STATUS, val);
--			if (!(val & BIT(1)))
--				goto no_c1e_idle;
-+		if (cpu_has(c, X86_FEATURE_OSVW)) {
-+			rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, val);
-+			if (val >= 2) {
-+				rdmsrl(MSR_AMD64_OSVW_STATUS, val);
-+				if (!(val & BIT(1)))
-+					goto no_c1e_idle;
-+			}
- 		}
- 		return 1;
- 	}
-diff --git a/crypto/authenc.c b/crypto/authenc.c
-index 4d6f49a..0d54de9 100644
---- a/crypto/authenc.c
-+++ b/crypto/authenc.c
-@@ -46,6 +46,12 @@ struct authenc_request_ctx {
- 	char tail[];
- };
- 
-+static void authenc_request_complete(struct aead_request *req, int err)
-+{
-+	if (err != -EINPROGRESS)
-+		aead_request_complete(req, err);
-+}
-+
- static int crypto_authenc_setkey(struct crypto_aead *authenc, const u8 *key,
- 				 unsigned int keylen)
- {
-@@ -142,7 +148,7 @@ static void authenc_geniv_ahash_update_done(struct crypto_async_request *areq,
- 				 crypto_aead_authsize(authenc), 1);
- 
- out:
--	aead_request_complete(req, err);
-+	authenc_request_complete(req, err);
- }
- 
- static void authenc_geniv_ahash_done(struct crypto_async_request *areq, int err)
-@@ -208,7 +214,7 @@ static void authenc_verify_ahash_update_done(struct crypto_async_request *areq,
- 	err = crypto_ablkcipher_decrypt(abreq);
- 
- out:
--	aead_request_complete(req, err);
-+	authenc_request_complete(req, err);
- }
- 
- static void authenc_verify_ahash_done(struct crypto_async_request *areq,
-@@ -245,7 +251,7 @@ static void authenc_verify_ahash_done(struct crypto_async_request *areq,
- 	err = crypto_ablkcipher_decrypt(abreq);
- 
- out:
--	aead_request_complete(req, err);
-+	authenc_request_complete(req, err);
- }
- 
- static u8 *crypto_authenc_ahash_fb(struct aead_request *req, unsigned int flags)
-@@ -379,7 +385,7 @@ static void crypto_authenc_encrypt_done(struct crypto_async_request *req,
- 		err = crypto_authenc_genicv(areq, iv, 0);
- 	}
- 
--	aead_request_complete(areq, err);
-+	authenc_request_complete(areq, err);
- }
- 
- static int crypto_authenc_encrypt(struct aead_request *req)
-@@ -418,7 +424,7 @@ static void crypto_authenc_givencrypt_done(struct crypto_async_request *req,
- 		err = crypto_authenc_genicv(areq, greq->giv, 0);
- 	}
- 
--	aead_request_complete(areq, err);
-+	authenc_request_complete(areq, err);
- }
- 
- static int crypto_authenc_givencrypt(struct aead_givcrypt_request *req)
-diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
-index 7c85265..9ed9292 100644
---- a/drivers/acpi/sleep.c
-+++ b/drivers/acpi/sleep.c
-@@ -475,101 +475,13 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
- 	},
- 	{
- 	.callback = init_set_sci_en_on_resume,
--	.ident = "Lenovo ThinkPad X201",
-+	.ident = "Lenovo ThinkPad X201[s]",
- 	.matches = {
- 		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
- 		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
- 		},
- 	},
- 	{
--	.callback = init_set_sci_en_on_resume,
--	.ident = "Lenovo ThinkPad X201",
--	.matches = {
--		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
--		},
--	},
--	{
--	.callback = init_set_sci_en_on_resume,
--	.ident = "Lenovo ThinkPad T410",
--	.matches = {
--		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
--		},
--	},
--	{
--	.callback = init_set_sci_en_on_resume,
--	.ident = "Lenovo ThinkPad T510",
--	.matches = {
--		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
--		},
--	},
--	{
--	.callback = init_set_sci_en_on_resume,
--	.ident = "Lenovo ThinkPad W510",
--	.matches = {
--		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
--		},
--	},
--	{
--	.callback = init_set_sci_en_on_resume,
--	.ident = "Lenovo ThinkPad X201",
--	.matches = {
--		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
--		},
--	},
--	{
--	.callback = init_set_sci_en_on_resume,
--	.ident = "Lenovo ThinkPad X201",
--	.matches = {
--		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
--		},
--	},
--	{
--	.callback = init_set_sci_en_on_resume,
--	.ident = "Lenovo ThinkPad T410",
--	.matches = {
--		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
--		},
--	},
--	{
--	.callback = init_set_sci_en_on_resume,
--	.ident = "Lenovo ThinkPad T510",
--	.matches = {
--		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
--		},
--	},
--	{
--	.callback = init_set_sci_en_on_resume,
--	.ident = "Lenovo ThinkPad W510",
--	.matches = {
--		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
--		},
--	},
--	{
--	.callback = init_set_sci_en_on_resume,
--	.ident = "Lenovo ThinkPad X201",
--	.matches = {
--		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
--		},
--	},
--	{
--	.callback = init_set_sci_en_on_resume,
--	.ident = "Lenovo ThinkPad X201",
--	.matches = {
--		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
--		},
--	},
--	{
- 	.callback = init_old_suspend_ordering,
- 	.ident = "Panasonic CF51-2L",
- 	.matches = {
-diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
-index 76253cf..9af6766 100644
---- a/drivers/char/tty_io.c
-+++ b/drivers/char/tty_io.c
-@@ -1875,6 +1875,7 @@ got_driver:
- 		 */
- 		if (filp->f_op == &hung_up_tty_fops)
- 			filp->f_op = &tty_fops;
-+		unlock_kernel();
- 		goto retry_open;
- 	}
- 	unlock_kernel();
-diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
-index cf4cb3e..4746bfe 100644
---- a/drivers/gpu/drm/i915/i915_drv.c
-+++ b/drivers/gpu/drm/i915/i915_drv.c
-@@ -79,14 +79,14 @@ const static struct intel_device_info intel_i915g_info = {
- 	.is_i915g = 1, .is_i9xx = 1, .cursor_needs_physical = 1,
- };
- const static struct intel_device_info intel_i915gm_info = {
--	.is_i9xx = 1,  .is_mobile = 1, .has_fbc = 1,
-+	.is_i9xx = 1,  .is_mobile = 1,
- 	.cursor_needs_physical = 1,
- };
- const static struct intel_device_info intel_i945g_info = {
- 	.is_i9xx = 1, .has_hotplug = 1, .cursor_needs_physical = 1,
- };
- const static struct intel_device_info intel_i945gm_info = {
--	.is_i945gm = 1, .is_i9xx = 1, .is_mobile = 1, .has_fbc = 1,
-+	.is_i945gm = 1, .is_i9xx = 1, .is_mobile = 1,
- 	.has_hotplug = 1, .cursor_needs_physical = 1,
- };
- 
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 16ce3ba..0b33757 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -206,11 +206,14 @@ typedef struct drm_i915_private {
- 
- 	drm_dma_handle_t *status_page_dmah;
- 	void *hw_status_page;
-+	void *seqno_page;
- 	dma_addr_t dma_status_page;
- 	uint32_t counter;
- 	unsigned int status_gfx_addr;
-+	unsigned int seqno_gfx_addr;
- 	drm_local_map_t hws_map;
- 	struct drm_gem_object *hws_obj;
-+	struct drm_gem_object *seqno_obj;
- 	struct drm_gem_object *pwrctx;
- 
- 	struct resource mch_res;
-@@ -1090,6 +1093,7 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
- 
- #define HAS_PCH_SPLIT(dev) (IS_IRONLAKE(dev) ||	\
- 			    IS_GEN6(dev))
-+#define HAS_PIPE_CONTROL(dev) (IS_IRONLAKE(dev) || IS_GEN6(dev))
- 
- #define PRIMARY_RINGBUFFER_SIZE         (128*1024)
- 
-diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
-index 6458400..c00c978 100644
---- a/drivers/gpu/drm/i915/i915_gem.c
-+++ b/drivers/gpu/drm/i915/i915_gem.c
-@@ -1559,6 +1559,13 @@ i915_gem_object_move_to_inactive(struct drm_gem_object *obj)
- 	i915_verify_inactive(dev, __FILE__, __LINE__);
- }
- 
-+#define PIPE_CONTROL_FLUSH(addr)					\
-+	OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |		\
-+		 PIPE_CONTROL_DEPTH_STALL);				\
-+	OUT_RING(addr | PIPE_CONTROL_GLOBAL_GTT);			\
-+	OUT_RING(0);							\
-+	OUT_RING(0);							\
-+
- /**
-  * Creates a new sequence number, emitting a write of it to the status page
-  * plus an interrupt, which will trigger i915_user_interrupt_handler.
-@@ -1593,13 +1600,47 @@ i915_add_request(struct drm_device *dev, struct drm_file *file_priv,
- 	if (dev_priv->mm.next_gem_seqno == 0)
- 		dev_priv->mm.next_gem_seqno++;
- 
--	BEGIN_LP_RING(4);
--	OUT_RING(MI_STORE_DWORD_INDEX);
--	OUT_RING(I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
--	OUT_RING(seqno);
-+	if (HAS_PIPE_CONTROL(dev)) {
-+		u32 scratch_addr = dev_priv->seqno_gfx_addr + 128;
- 
--	OUT_RING(MI_USER_INTERRUPT);
--	ADVANCE_LP_RING();
-+		/*
-+		 * Workaround qword write incoherence by flushing the
-+		 * PIPE_NOTIFY buffers out to memory before requesting
-+		 * an interrupt.
-+		 */
-+		BEGIN_LP_RING(32);
-+		OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |
-+			 PIPE_CONTROL_WC_FLUSH | PIPE_CONTROL_TC_FLUSH);
-+		OUT_RING(dev_priv->seqno_gfx_addr | PIPE_CONTROL_GLOBAL_GTT);
-+		OUT_RING(seqno);
-+		OUT_RING(0);
-+		PIPE_CONTROL_FLUSH(scratch_addr);
-+		scratch_addr += 128; /* write to separate cachelines */
-+		PIPE_CONTROL_FLUSH(scratch_addr);
-+		scratch_addr += 128;
-+		PIPE_CONTROL_FLUSH(scratch_addr);
-+		scratch_addr += 128;
-+		PIPE_CONTROL_FLUSH(scratch_addr);
-+		scratch_addr += 128;
-+		PIPE_CONTROL_FLUSH(scratch_addr);
-+		scratch_addr += 128;
-+		PIPE_CONTROL_FLUSH(scratch_addr);
-+		OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |
-+			 PIPE_CONTROL_WC_FLUSH | PIPE_CONTROL_TC_FLUSH |
-+			 PIPE_CONTROL_NOTIFY);
-+		OUT_RING(dev_priv->seqno_gfx_addr | PIPE_CONTROL_GLOBAL_GTT);
-+		OUT_RING(seqno);
-+		OUT_RING(0);
-+		ADVANCE_LP_RING();
-+	} else {
-+		BEGIN_LP_RING(4);
-+		OUT_RING(MI_STORE_DWORD_INDEX);
-+		OUT_RING(I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
-+		OUT_RING(seqno);
-+
-+		OUT_RING(MI_USER_INTERRUPT);
-+		ADVANCE_LP_RING();
-+	}
- 
- 	DRM_DEBUG_DRIVER("%d\n", seqno);
- 
-@@ -1744,7 +1785,10 @@ i915_get_gem_seqno(struct drm_device *dev)
- {
- 	drm_i915_private_t *dev_priv = dev->dev_private;
- 
--	return READ_HWSP(dev_priv, I915_GEM_HWS_INDEX);
-+	if (HAS_PIPE_CONTROL(dev))
-+		return ((volatile u32 *)(dev_priv->seqno_page))[0];
-+	else
-+		return READ_HWSP(dev_priv, I915_GEM_HWS_INDEX);
- }
- 
- /**
-@@ -4576,6 +4620,49 @@ i915_gem_idle(struct drm_device *dev)
- 	return 0;
- }
- 
-+/*
-+ * 965+ support PIPE_CONTROL commands, which provide finer grained control
-+ * over cache flushing.
-+ */
-+static int
-+i915_gem_init_pipe_control(struct drm_device *dev)
-+{
-+	drm_i915_private_t *dev_priv = dev->dev_private;
-+	struct drm_gem_object *obj;
-+	struct drm_i915_gem_object *obj_priv;
-+	int ret;
-+
-+	obj = drm_gem_object_alloc(dev, 4096);
-+	if (obj == NULL) {
-+		DRM_ERROR("Failed to allocate seqno page\n");
-+		ret = -ENOMEM;
-+		goto err;
-+	}
-+	obj_priv = obj->driver_private;
-+	obj_priv->agp_type = AGP_USER_CACHED_MEMORY;
-+
-+	ret = i915_gem_object_pin(obj, 4096);
-+	if (ret)
-+		goto err_unref;
-+
-+	dev_priv->seqno_gfx_addr = obj_priv->gtt_offset;
-+	dev_priv->seqno_page =  kmap(obj_priv->pages[0]);
-+	if (dev_priv->seqno_page == NULL)
-+		goto err_unpin;
-+
-+	dev_priv->seqno_obj = obj;
-+	memset(dev_priv->seqno_page, 0, PAGE_SIZE);
-+
-+	return 0;
-+
-+err_unpin:
-+	i915_gem_object_unpin(obj);
-+err_unref:
-+	drm_gem_object_unreference(obj);
-+err:
-+	return ret;
-+}
-+
- static int
- i915_gem_init_hws(struct drm_device *dev)
- {
-@@ -4593,7 +4680,8 @@ i915_gem_init_hws(struct drm_device *dev)
- 	obj = drm_gem_object_alloc(dev, 4096);
- 	if (obj == NULL) {
- 		DRM_ERROR("Failed to allocate status page\n");
--		return -ENOMEM;
-+		ret = -ENOMEM;
-+		goto err;
- 	}
- 	obj_priv = obj->driver_private;
- 	obj_priv->agp_type = AGP_USER_CACHED_MEMORY;
-@@ -4601,7 +4689,7 @@ i915_gem_init_hws(struct drm_device *dev)
- 	ret = i915_gem_object_pin(obj, 4096);
- 	if (ret != 0) {
- 		drm_gem_object_unreference(obj);
--		return ret;
-+		goto err_unref;
- 	}
- 
- 	dev_priv->status_gfx_addr = obj_priv->gtt_offset;
-@@ -4610,10 +4698,16 @@ i915_gem_init_hws(struct drm_device *dev)
- 	if (dev_priv->hw_status_page == NULL) {
- 		DRM_ERROR("Failed to map status page.\n");
- 		memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
--		i915_gem_object_unpin(obj);
--		drm_gem_object_unreference(obj);
--		return -EINVAL;
-+		ret = -EINVAL;
-+		goto err_unpin;
- 	}
-+
-+	if (HAS_PIPE_CONTROL(dev)) {
-+		ret = i915_gem_init_pipe_control(dev);
-+		if (ret)
-+			goto err_unpin;
-+	}
-+
- 	dev_priv->hws_obj = obj;
- 	memset(dev_priv->hw_status_page, 0, PAGE_SIZE);
- 	I915_WRITE(HWS_PGA, dev_priv->status_gfx_addr);
-@@ -4621,6 +4715,30 @@ i915_gem_init_hws(struct drm_device *dev)
- 	DRM_DEBUG_DRIVER("hws offset: 0x%08x\n", dev_priv->status_gfx_addr);
- 
- 	return 0;
-+
-+err_unpin:
-+	i915_gem_object_unpin(obj);
-+err_unref:
-+	drm_gem_object_unreference(obj);
-+err:
-+	return 0;
-+}
-+
-+static void
-+i915_gem_cleanup_pipe_control(struct drm_device *dev)
-+{
-+	drm_i915_private_t *dev_priv = dev->dev_private;
-+	struct drm_gem_object *obj;
-+	struct drm_i915_gem_object *obj_priv;
-+
-+	obj = dev_priv->seqno_obj;
-+	obj_priv = obj->driver_private;
-+	kunmap(obj_priv->pages[0]);
-+	i915_gem_object_unpin(obj);
-+	drm_gem_object_unreference(obj);
-+	dev_priv->seqno_obj = NULL;
-+
-+	dev_priv->seqno_page = NULL;
- }
- 
- static void
-@@ -4644,6 +4762,9 @@ i915_gem_cleanup_hws(struct drm_device *dev)
- 	memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
- 	dev_priv->hw_status_page = NULL;
- 
-+	if (HAS_PIPE_CONTROL(dev))
-+		i915_gem_cleanup_pipe_control(dev);
-+
- 	/* Write high address into HWS_PGA when disabling. */
- 	I915_WRITE(HWS_PGA, 0x1ffff000);
- }
-diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index 032f667..d6466d5 100644
---- a/drivers/gpu/drm/i915/i915_irq.c
-+++ b/drivers/gpu/drm/i915/i915_irq.c
-@@ -297,7 +297,7 @@ irqreturn_t ironlake_irq_handler(struct drm_device *dev)
- 				READ_BREADCRUMB(dev_priv);
- 	}
- 
--	if (gt_iir & GT_USER_INTERRUPT) {
-+	if (gt_iir & GT_PIPE_NOTIFY) {
- 		u32 seqno = i915_get_gem_seqno(dev);
- 		dev_priv->mm.irq_gem_seqno = seqno;
- 		trace_i915_gem_request_complete(dev, seqno);
-@@ -738,7 +738,7 @@ void i915_user_irq_get(struct drm_device *dev)
- 	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
- 	if (dev->irq_enabled && (++dev_priv->user_irq_refcount == 1)) {
- 		if (HAS_PCH_SPLIT(dev))
--			ironlake_enable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
-+			ironlake_enable_graphics_irq(dev_priv, GT_PIPE_NOTIFY);
- 		else
- 			i915_enable_irq(dev_priv, I915_USER_INTERRUPT);
- 	}
-@@ -754,7 +754,7 @@ void i915_user_irq_put(struct drm_device *dev)
- 	BUG_ON(dev->irq_enabled && dev_priv->user_irq_refcount <= 0);
- 	if (dev->irq_enabled && (--dev_priv->user_irq_refcount == 0)) {
- 		if (HAS_PCH_SPLIT(dev))
--			ironlake_disable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
-+			ironlake_disable_graphics_irq(dev_priv, GT_PIPE_NOTIFY);
- 		else
- 			i915_disable_irq(dev_priv, I915_USER_INTERRUPT);
- 	}
-@@ -1034,7 +1034,7 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
- 	/* enable kind of interrupts always enabled */
- 	u32 display_mask = DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT |
- 			   DE_PLANEA_FLIP_DONE | DE_PLANEB_FLIP_DONE;
--	u32 render_mask = GT_USER_INTERRUPT;
-+	u32 render_mask = GT_PIPE_NOTIFY;
- 	u32 hotplug_mask = SDE_CRT_HOTPLUG | SDE_PORTB_HOTPLUG |
- 			   SDE_PORTC_HOTPLUG | SDE_PORTD_HOTPLUG;
- 
-diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
-index fd95bdf..30a2322 100644
---- a/drivers/gpu/drm/i915/i915_reg.h
-+++ b/drivers/gpu/drm/i915/i915_reg.h
-@@ -210,6 +210,16 @@
- #define   ASYNC_FLIP                (1<<22)
- #define   DISPLAY_PLANE_A           (0<<20)
- #define   DISPLAY_PLANE_B           (1<<20)
-+#define GFX_OP_PIPE_CONTROL	((0x3<<29)|(0x3<<27)|(0x2<<24)|2)
-+#define   PIPE_CONTROL_QW_WRITE	(1<<14)
-+#define   PIPE_CONTROL_DEPTH_STALL (1<<13)
-+#define   PIPE_CONTROL_WC_FLUSH	(1<<12)
-+#define   PIPE_CONTROL_IS_FLUSH	(1<<11) /* MBZ on Ironlake */
-+#define   PIPE_CONTROL_TC_FLUSH (1<<10) /* GM45+ only */
-+#define   PIPE_CONTROL_ISP_DIS	(1<<9)
-+#define   PIPE_CONTROL_NOTIFY	(1<<8)
-+#define   PIPE_CONTROL_GLOBAL_GTT (1<<2) /* in addr dword */
-+#define   PIPE_CONTROL_STALL_EN	(1<<1) /* in addr word, Ironlake+ only */
- 
- /*
-  * Fence registers
-@@ -2111,6 +2121,7 @@
- #define DEIER   0x4400c
- 
- /* GT interrupt */
-+#define GT_PIPE_NOTIFY		(1 << 4)
- #define GT_SYNC_STATUS          (1 << 2)
- #define GT_USER_INTERRUPT       (1 << 0)
- 
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 4b2458d..3f00902 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -4683,7 +4683,7 @@ static void intel_init_display(struct drm_device *dev)
- 			dev_priv->display.fbc_enabled = g4x_fbc_enabled;
- 			dev_priv->display.enable_fbc = g4x_enable_fbc;
- 			dev_priv->display.disable_fbc = g4x_disable_fbc;
--		} else if (IS_I965GM(dev) || IS_I945GM(dev) || IS_I915GM(dev)) {
-+		} else if (IS_I965GM(dev)) {
- 			dev_priv->display.fbc_enabled = i8xx_fbc_enabled;
- 			dev_priv->display.enable_fbc = i8xx_enable_fbc;
- 			dev_priv->display.disable_fbc = i8xx_disable_fbc;
-diff --git a/drivers/hwmon/hp_accel.c b/drivers/hwmon/hp_accel.c
-index be475e8..f16d60f 100644
---- a/drivers/hwmon/hp_accel.c
-+++ b/drivers/hwmon/hp_accel.c
-@@ -324,8 +324,8 @@ static int lis3lv02d_remove(struct acpi_device *device, int type)
- 	lis3lv02d_joystick_disable();
- 	lis3lv02d_poweroff(&lis3_dev);
- 
--	flush_work(&hpled_led.work);
- 	led_classdev_unregister(&hpled_led.led_classdev);
-+	flush_work(&hpled_led.work);
- 
- 	return lis3lv02d_remove_fs(&lis3_dev);
- }
-diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
-index 8072128..ee337df 100644
---- a/drivers/mmc/host/atmel-mci.c
-+++ b/drivers/mmc/host/atmel-mci.c
-@@ -568,9 +568,10 @@ static void atmci_dma_cleanup(struct atmel_mci *host)
- {
- 	struct mmc_data			*data = host->data;
- 
--	dma_unmap_sg(&host->pdev->dev, data->sg, data->sg_len,
--		     ((data->flags & MMC_DATA_WRITE)
--		      ? DMA_TO_DEVICE : DMA_FROM_DEVICE));
-+	if (data)
-+		dma_unmap_sg(&host->pdev->dev, data->sg, data->sg_len,
-+			     ((data->flags & MMC_DATA_WRITE)
-+			      ? DMA_TO_DEVICE : DMA_FROM_DEVICE));
- }
- 
- static void atmci_stop_dma(struct atmel_mci *host)
-@@ -1098,8 +1099,8 @@ static void atmci_command_complete(struct atmel_mci *host,
- 			"command error: status=0x%08x\n", status);
- 
- 		if (cmd->data) {
--			host->data = NULL;
- 			atmci_stop_dma(host);
-+			host->data = NULL;
- 			mci_writel(host, IDR, MCI_NOTBUSY
- 					| MCI_TXRDY | MCI_RXRDY
- 					| ATMCI_DATA_ERROR_FLAGS);
-@@ -1292,6 +1293,7 @@ static void atmci_tasklet_func(unsigned long priv)
- 			} else {
- 				data->bytes_xfered = data->blocks * data->blksz;
- 				data->error = 0;
-+				mci_writel(host, IDR, ATMCI_DATA_ERROR_FLAGS);
- 			}
- 
- 			if (!data->stop) {
-@@ -1750,13 +1752,13 @@ static int __init atmci_probe(struct platform_device *pdev)
- 	ret = -ENODEV;
- 	if (pdata->slot[0].bus_width) {
- 		ret = atmci_init_slot(host, &pdata->slot[0],
--				MCI_SDCSEL_SLOT_A, 0);
-+				0, MCI_SDCSEL_SLOT_A);
- 		if (!ret)
- 			nr_slots++;
- 	}
- 	if (pdata->slot[1].bus_width) {
- 		ret = atmci_init_slot(host, &pdata->slot[1],
--				MCI_SDCSEL_SLOT_B, 1);
-+				1, MCI_SDCSEL_SLOT_B);
- 		if (!ret)
- 			nr_slots++;
- 	}
-diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
-index c3ce920..8b7c267 100644
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -2244,7 +2244,7 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
- 		if (ATH_TXQ_SETUP(sc, i)) {
- 			txq = &sc->tx.txq[i];
- 
--			spin_lock_bh(&txq->axq_lock);
-+			spin_lock(&txq->axq_lock);
- 
- 			list_for_each_entry_safe(ac,
- 					ac_tmp, &txq->axq_acq, list) {
-@@ -2265,7 +2265,7 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
- 				}
- 			}
- 
--			spin_unlock_bh(&txq->axq_lock);
-+			spin_unlock(&txq->axq_lock);
- 		}
- 	}
- }
-diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
-index 3b4c5a4..82c1d2e 100644
---- a/drivers/net/wireless/iwlwifi/iwl-4965.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
-@@ -581,6 +581,11 @@ static int iwl4965_alive_notify(struct iwl_priv *priv)
- 
- 	iwl4965_set_wr_ptrs(priv, IWL_CMD_QUEUE_NUM, 0);
- 
-+	/* make sure all queue are not stopped */
-+	memset(&priv->queue_stopped[0], 0, sizeof(priv->queue_stopped));
-+	for (i = 0; i < 4; i++)
-+		atomic_set(&priv->queue_stop_count[i], 0);
-+
- 	/* reset to 0 to enable all the queue first */
- 	priv->txq_ctx_active_msk = 0;
- 	/* Map each Tx/cmd queue to its corresponding fifo */
-diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
-index c610e5f..f7d41c7 100644
---- a/drivers/net/wireless/iwlwifi/iwl-5000.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
-@@ -657,6 +657,11 @@ int iwl5000_alive_notify(struct iwl_priv *priv)
- 
- 	iwl5000_set_wr_ptrs(priv, IWL_CMD_QUEUE_NUM, 0);
- 
-+	/* make sure all queue are not stopped */
-+	memset(&priv->queue_stopped[0], 0, sizeof(priv->queue_stopped));
-+	for (i = 0; i < 4; i++)
-+		atomic_set(&priv->queue_stop_count[i], 0);
-+
- 	/* reset to 0 to enable all the queue first */
- 	priv->txq_ctx_active_msk = 0;
- 	/* map qos queues to fifos one-to-one */
-diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
-index b93e491..3534d86 100644
---- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
-@@ -298,10 +298,23 @@ static void rs_tl_turn_on_agg_for_tid(struct iwl_priv *priv,
- 				      struct iwl_lq_sta *lq_data, u8 tid,
- 				      struct ieee80211_sta *sta)
- {
-+	int ret;
-+
- 	if (rs_tl_get_load(lq_data, tid) > IWL_AGG_LOAD_THRESHOLD) {
- 		IWL_DEBUG_HT(priv, "Starting Tx agg: STA: %pM tid: %d\n",
- 				sta->addr, tid);
--		ieee80211_start_tx_ba_session(sta, tid);
-+		ret = ieee80211_start_tx_ba_session(sta, tid);
-+		if (ret == -EAGAIN) {
-+			/*
-+			 * driver and mac80211 is out of sync
-+			 * this might be cause by reloading firmware
-+			 * stop the tx ba session here
-+			 */
-+			IWL_DEBUG_HT(priv, "Fail start Tx agg on tid: %d\n",
-+				tid);
-+			ret = ieee80211_stop_tx_ba_session(sta, tid,
-+						WLAN_BACK_INITIATOR);
-+		}
- 	}
- }
- 
-diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
-index 88470fb..e0ce039 100644
---- a/drivers/net/wireless/iwlwifi/iwl-tx.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
-@@ -821,8 +821,10 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
- 		hdr->seq_ctrl |= cpu_to_le16(seq_number);
- 		seq_number += 0x10;
- 		/* aggregation is on for this <sta,tid> */
--		if (info->flags & IEEE80211_TX_CTL_AMPDU)
-+		if (info->flags & IEEE80211_TX_CTL_AMPDU &&
-+		    priv->stations[sta_id].tid[tid].agg.state == IWL_AGG_ON) {
- 			txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
-+		}
- 	}
- 
- 	txq = &priv->txq[txq_id];
-@@ -1347,7 +1349,7 @@ int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
- {
- 	int tx_fifo_id, txq_id, sta_id, ssn = -1;
- 	struct iwl_tid_data *tid_data;
--	int ret, write_ptr, read_ptr;
-+	int write_ptr, read_ptr;
- 	unsigned long flags;
- 
- 	if (!ra) {
-@@ -1399,13 +1401,17 @@ int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
- 	priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
- 
- 	spin_lock_irqsave(&priv->lock, flags);
--	ret = priv->cfg->ops->lib->txq_agg_disable(priv, txq_id, ssn,
-+	/*
-+	 * the only reason this call can fail is queue number out of range,
-+	 * which can happen if uCode is reloaded and all the station
-+	 * information are lost. if it is outside the range, there is no need
-+	 * to deactivate the uCode queue, just return "success" to allow
-+	 *  mac80211 to clean up it own data.
-+	 */
-+	priv->cfg->ops->lib->txq_agg_disable(priv, txq_id, ssn,
- 						   tx_fifo_id);
- 	spin_unlock_irqrestore(&priv->lock, flags);
- 
--	if (ret)
--		return ret;
--
- 	ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, ra, tid);
- 
- 	return 0;
-diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
-index 5905936..e4bd795 100644
---- a/drivers/s390/block/dasd.c
-+++ b/drivers/s390/block/dasd.c
-@@ -35,6 +35,9 @@
-  */
- #define DASD_CHANQ_MAX_SIZE 4
- 
-+#define DASD_SLEEPON_START_TAG	(void *) 1
-+#define DASD_SLEEPON_END_TAG	(void *) 2
-+
- /*
-  * SECTION: exported variables of dasd.c
-  */
-@@ -1460,7 +1463,10 @@ void dasd_add_request_tail(struct dasd_ccw_req *cqr)
-  */
- static void dasd_wakeup_cb(struct dasd_ccw_req *cqr, void *data)
- {
--	wake_up((wait_queue_head_t *) data);
-+	spin_lock_irq(get_ccwdev_lock(cqr->startdev->cdev));
-+	cqr->callback_data = DASD_SLEEPON_END_TAG;
-+	spin_unlock_irq(get_ccwdev_lock(cqr->startdev->cdev));
-+	wake_up(&generic_waitq);
- }
- 
- static inline int _wait_for_wakeup(struct dasd_ccw_req *cqr)
-@@ -1470,10 +1476,7 @@ static inline int _wait_for_wakeup(struct dasd_ccw_req *cqr)
- 
- 	device = cqr->startdev;
- 	spin_lock_irq(get_ccwdev_lock(device->cdev));
--	rc = ((cqr->status == DASD_CQR_DONE ||
--	       cqr->status == DASD_CQR_NEED_ERP ||
--	       cqr->status == DASD_CQR_TERMINATED) &&
--	      list_empty(&cqr->devlist));
-+	rc = (cqr->callback_data == DASD_SLEEPON_END_TAG);
- 	spin_unlock_irq(get_ccwdev_lock(device->cdev));
- 	return rc;
- }
-@@ -1561,7 +1564,7 @@ static int _dasd_sleep_on(struct dasd_ccw_req *maincqr, int interruptible)
- 			wait_event(generic_waitq, !(device->stopped));
- 
- 		cqr->callback = dasd_wakeup_cb;
--		cqr->callback_data = (void *) &generic_waitq;
-+		cqr->callback_data = DASD_SLEEPON_START_TAG;
- 		dasd_add_request_tail(cqr);
- 		if (interruptible) {
- 			rc = wait_event_interruptible(
-@@ -1640,7 +1643,7 @@ int dasd_sleep_on_immediatly(struct dasd_ccw_req *cqr)
- 	}
- 
- 	cqr->callback = dasd_wakeup_cb;
--	cqr->callback_data = (void *) &generic_waitq;
-+	cqr->callback_data = DASD_SLEEPON_START_TAG;
- 	cqr->status = DASD_CQR_QUEUED;
- 	list_add(&cqr->devlist, &device->ccw_queue);
- 
-diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
-index d00fcf8..fd6b135 100644
---- a/drivers/serial/imx.c
-+++ b/drivers/serial/imx.c
-@@ -119,7 +119,8 @@
- #define  MX2_UCR3_RXDMUXSEL	 (1<<2)  /* RXD Muxed Input Select, on mx2/mx3 */
- #define  UCR3_INVT  	 (1<<1)  /* Inverted Infrared transmission */
- #define  UCR3_BPEN  	 (1<<0)  /* Preset registers enable */
--#define  UCR4_CTSTL_32   (32<<10) /* CTS trigger level (32 chars) */
-+#define  UCR4_CTSTL_SHF  10      /* CTS trigger level shift */
-+#define  UCR4_CTSTL_MASK 0x3F    /* CTS trigger is 6 bits wide */
- #define  UCR4_INVR  	 (1<<9)  /* Inverted infrared reception */
- #define  UCR4_ENIRI 	 (1<<8)  /* Serial infrared interrupt enable */
- #define  UCR4_WKEN  	 (1<<7)  /* Wake interrupt enable */
-@@ -590,6 +591,9 @@ static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
- 	return 0;
- }
- 
-+/* half the RX buffer size */
-+#define CTSTL 16
-+
- static int imx_startup(struct uart_port *port)
- {
- 	struct imx_port *sport = (struct imx_port *)port;
-@@ -606,6 +610,10 @@ static int imx_startup(struct uart_port *port)
- 	if (USE_IRDA(sport))
- 		temp |= UCR4_IRSC;
- 
-+	/* set the trigger level for CTS */
-+	temp &= ~(UCR4_CTSTL_MASK<<  UCR4_CTSTL_SHF);
-+	temp |= CTSTL<<  UCR4_CTSTL_SHF;
-+
- 	writel(temp & ~UCR4_DREN, sport->port.membase + UCR4);
- 
- 	if (USE_IRDA(sport)) {
-diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/bfin-t350mcqb-fb.c
-index 2549c53..6c8b6b6 100644
---- a/drivers/video/bfin-t350mcqb-fb.c
-+++ b/drivers/video/bfin-t350mcqb-fb.c
-@@ -515,9 +515,9 @@ static int __devinit bfin_t350mcqb_probe(struct platform_device *pdev)
- 	fbinfo->fbops = &bfin_t350mcqb_fb_ops;
- 	fbinfo->flags = FBINFO_FLAG_DEFAULT;
- 
--	info->fb_buffer =
--	    dma_alloc_coherent(NULL, fbinfo->fix.smem_len, &info->dma_handle,
--			       GFP_KERNEL);
-+	info->fb_buffer = dma_alloc_coherent(NULL, fbinfo->fix.smem_len +
-+				ACTIVE_VIDEO_MEM_OFFSET,
-+				&info->dma_handle, GFP_KERNEL);
- 
- 	if (NULL == info->fb_buffer) {
- 		printk(KERN_ERR DRIVER_NAME
-@@ -587,8 +587,8 @@ out7:
- out6:
- 	fb_dealloc_cmap(&fbinfo->cmap);
- out4:
--	dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
--			  info->dma_handle);
-+	dma_free_coherent(NULL, fbinfo->fix.smem_len + ACTIVE_VIDEO_MEM_OFFSET,
-+			 info->fb_buffer, info->dma_handle);
- out3:
- 	framebuffer_release(fbinfo);
- out2:
-@@ -611,8 +611,9 @@ static int __devexit bfin_t350mcqb_remove(struct platform_device *pdev)
- 	free_irq(info->irq, info);
- 
- 	if (info->fb_buffer != NULL)
--		dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
--				  info->dma_handle);
-+		dma_free_coherent(NULL, fbinfo->fix.smem_len +
-+			ACTIVE_VIDEO_MEM_OFFSET, info->fb_buffer,
-+			info->dma_handle);
- 
- 	fb_dealloc_cmap(&fbinfo->cmap);
- 
-diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 645a179..2c6ee6a 100644
---- a/fs/btrfs/ioctl.c
-+++ b/fs/btrfs/ioctl.c
-@@ -964,12 +964,17 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
- 		ret = -EBADF;
- 		goto out_drop_write;
- 	}
-+
- 	src = src_file->f_dentry->d_inode;
- 
- 	ret = -EINVAL;
- 	if (src == inode)
- 		goto out_fput;
- 
-+	/* the src must be open for reading */
-+	if (!(src_file->f_mode & FMODE_READ))
-+		goto out_fput;
-+
- 	ret = -EISDIR;
- 	if (S_ISDIR(src->i_mode) || S_ISDIR(inode->i_mode))
- 		goto out_fput;
-diff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c
-index b5808cd..039b501 100644
---- a/fs/cachefiles/security.c
-+++ b/fs/cachefiles/security.c
-@@ -77,6 +77,8 @@ static int cachefiles_check_cache_dir(struct cachefiles_cache *cache,
- /*
-  * check the security details of the on-disk cache
-  * - must be called with security override in force
-+ * - must return with a security override in force - even in the case of an
-+ *   error
-  */
- int cachefiles_determine_cache_security(struct cachefiles_cache *cache,
- 					struct dentry *root,
-@@ -99,6 +101,8 @@ int cachefiles_determine_cache_security(struct cachefiles_cache *cache,
- 	 * which create files */
- 	ret = set_create_files_as(new, root->d_inode);
- 	if (ret < 0) {
-+		abort_creds(new);
-+		cachefiles_begin_secure(cache, _saved_cred);
- 		_leave(" = %d [cfa]", ret);
- 		return ret;
- 	}
-diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
-index ed751bb..2568889 100644
---- a/fs/cifs/cifsglob.h
-+++ b/fs/cifs/cifsglob.h
-@@ -500,6 +500,7 @@ struct dfs_info3_param {
- #define CIFS_FATTR_DFS_REFERRAL		0x1
- #define CIFS_FATTR_DELETE_PENDING	0x2
- #define CIFS_FATTR_NEED_REVAL		0x4
-+#define CIFS_FATTR_INO_COLLISION	0x8
- 
- struct cifs_fattr {
- 	u32		cf_flags;
-diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
-index e3fda97..7ec8555 100644
---- a/fs/cifs/inode.c
-+++ b/fs/cifs/inode.c
-@@ -610,6 +610,16 @@ cifs_find_inode(struct inode *inode, void *opaque)
- 	if (CIFS_I(inode)->uniqueid != fattr->cf_uniqueid)
- 		return 0;
- 
-+	/*
-+	 * uh oh -- it's a directory. We can't use it since hardlinked dirs are
-+	 * verboten. Disable serverino and return it as if it were found, the
-+	 * caller can discard it, generate a uniqueid and retry the find
-+	 */
-+	if (S_ISDIR(inode->i_mode) && !list_empty(&inode->i_dentry)) {
-+		fattr->cf_flags |= CIFS_FATTR_INO_COLLISION;
-+		cifs_autodisable_serverino(CIFS_SB(inode->i_sb));
-+	}
-+
- 	return 1;
- }
- 
-@@ -629,15 +639,22 @@ cifs_iget(struct super_block *sb, struct cifs_fattr *fattr)
- 	unsigned long hash;
- 	struct inode *inode;
- 
-+retry_iget5_locked:
- 	cFYI(1, ("looking for uniqueid=%llu", fattr->cf_uniqueid));
- 
- 	/* hash down to 32-bits on 32-bit arch */
- 	hash = cifs_uniqueid_to_ino_t(fattr->cf_uniqueid);
- 
- 	inode = iget5_locked(sb, hash, cifs_find_inode, cifs_init_inode, fattr);
--
--	/* we have fattrs in hand, update the inode */
- 	if (inode) {
-+		/* was there a problematic inode number collision? */
-+		if (fattr->cf_flags & CIFS_FATTR_INO_COLLISION) {
-+			iput(inode);
-+			fattr->cf_uniqueid = iunique(sb, ROOT_I);
-+			fattr->cf_flags &= ~CIFS_FATTR_INO_COLLISION;
-+			goto retry_iget5_locked;
-+		}
-+
- 		cifs_fattr_to_inode(inode, fattr);
- 		if (sb->s_flags & MS_NOATIME)
- 			inode->i_flags |= S_NOATIME | S_NOCMTIME;
-diff --git a/fs/compat.c b/fs/compat.c
-index 00d90c2..514b623 100644
---- a/fs/compat.c
-+++ b/fs/compat.c
-@@ -1530,8 +1530,6 @@ int compat_do_execve(char * filename,
- 	if (retval < 0)
- 		goto out;
- 
--	current->stack_start = current->mm->start_stack;
--
- 	/* execve succeeded */
- 	current->fs->in_exec = 0;
- 	current->in_execve = 0;
-diff --git a/fs/exec.c b/fs/exec.c
-index 9071360..332f781 100644
---- a/fs/exec.c
-+++ b/fs/exec.c
-@@ -1386,8 +1386,6 @@ int do_execve(char * filename,
- 	if (retval < 0)
- 		goto out;
- 
--	current->stack_start = current->mm->start_stack;
--
- 	/* execve succeeded */
- 	current->fs->in_exec = 0;
- 	current->in_execve = 0;
-diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
-index 8173fae..4d3ddcc 100644
---- a/fs/nilfs2/super.c
-+++ b/fs/nilfs2/super.c
-@@ -746,6 +746,7 @@ nilfs_fill_super(struct super_block *sb, void *data, int silent,
- 	sb->s_export_op = &nilfs_export_ops;
- 	sb->s_root = NULL;
- 	sb->s_time_gran = 1;
-+	sb->s_bdi = nilfs->ns_bdi;
- 
- 	err = load_nilfs(nilfs, sbi);
- 	if (err)
-diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
-index 1afb0a1..e27960c 100644
---- a/fs/notify/inotify/inotify_fsnotify.c
-+++ b/fs/notify/inotify/inotify_fsnotify.c
-@@ -28,6 +28,7 @@
- #include <linux/path.h> /* struct path */
- #include <linux/slab.h> /* kmem_* */
- #include <linux/types.h>
-+#include <linux/sched.h>
- 
- #include "inotify.h"
- 
-@@ -146,6 +147,7 @@ static void inotify_free_group_priv(struct fsnotify_group *group)
- 	idr_for_each(&group->inotify_data.idr, idr_callback, group);
- 	idr_remove_all(&group->inotify_data.idr);
- 	idr_destroy(&group->inotify_data.idr);
-+	free_uid(group->inotify_data.user);
- }
- 
- void inotify_free_event_priv(struct fsnotify_event_private_data *fsn_event_priv)
-diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
-index a94e8bd..75aa15a 100644
---- a/fs/notify/inotify/inotify_user.c
-+++ b/fs/notify/inotify/inotify_user.c
-@@ -550,21 +550,24 @@ retry:
- 	if (unlikely(!idr_pre_get(&group->inotify_data.idr, GFP_KERNEL)))
- 		goto out_err;
- 
-+	/* we are putting the mark on the idr, take a reference */
-+	fsnotify_get_mark(&tmp_ientry->fsn_entry);
-+
- 	spin_lock(&group->inotify_data.idr_lock);
- 	ret = idr_get_new_above(&group->inotify_data.idr, &tmp_ientry->fsn_entry,
- 				group->inotify_data.last_wd+1,
- 				&tmp_ientry->wd);
- 	spin_unlock(&group->inotify_data.idr_lock);
- 	if (ret) {
-+		/* we didn't get on the idr, drop the idr reference */
-+		fsnotify_put_mark(&tmp_ientry->fsn_entry);
-+
- 		/* idr was out of memory allocate and try again */
- 		if (ret == -EAGAIN)
- 			goto retry;
- 		goto out_err;
- 	}
- 
--	/* we put the mark on the idr, take a reference */
--	fsnotify_get_mark(&tmp_ientry->fsn_entry);
--
- 	/* we are on the idr, now get on the inode */
- 	ret = fsnotify_add_mark(&tmp_ientry->fsn_entry, group, inode);
- 	if (ret) {
-diff --git a/fs/proc/array.c b/fs/proc/array.c
-index 13b5d07..69eb4c4 100644
---- a/fs/proc/array.c
-+++ b/fs/proc/array.c
-@@ -82,7 +82,6 @@
- #include <linux/pid_namespace.h>
- #include <linux/ptrace.h>
- #include <linux/tracehook.h>
--#include <linux/swapops.h>
- 
- #include <asm/pgtable.h>
- #include <asm/processor.h>
-@@ -494,7 +493,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- 		rsslim,
- 		mm ? mm->start_code : 0,
- 		mm ? mm->end_code : 0,
--		(permitted && mm) ? task->stack_start : 0,
-+		(permitted && mm) ? mm->start_stack : 0,
- 		esp,
- 		eip,
- 		/* The signal information here is obsolete.
-diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index f277c4a..9df34a5 100644
---- a/fs/proc/task_mmu.c
-+++ b/fs/proc/task_mmu.c
-@@ -243,25 +243,6 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- 				} else if (vma->vm_start <= mm->start_stack &&
- 					   vma->vm_end >= mm->start_stack) {
- 					name = "[stack]";
--				} else {
--					unsigned long stack_start;
--					struct proc_maps_private *pmp;
--
--					pmp = m->private;
--					stack_start = pmp->task->stack_start;
--
--					if (vma->vm_start <= stack_start &&
--					    vma->vm_end >= stack_start) {
--						pad_len_spaces(m, len);
--						seq_printf(m,
--						 "[threadstack:%08lx]",
--#ifdef CONFIG_STACK_GROWSUP
--						 vma->vm_end - stack_start
--#else
--						 stack_start - vma->vm_start
--#endif
--						);
--					}
- 				}
- 			} else {
- 				name = "[vdso]";
-diff --git a/include/asm-generic/dma-mapping-common.h b/include/asm-generic/dma-mapping-common.h
-index e694263..6920695 100644
---- a/include/asm-generic/dma-mapping-common.h
-+++ b/include/asm-generic/dma-mapping-common.h
-@@ -131,7 +131,7 @@ static inline void dma_sync_single_range_for_cpu(struct device *dev,
- 		debug_dma_sync_single_range_for_cpu(dev, addr, offset, size, dir);
- 
- 	} else
--		dma_sync_single_for_cpu(dev, addr, size, dir);
-+		dma_sync_single_for_cpu(dev, addr + offset, size, dir);
- }
- 
- static inline void dma_sync_single_range_for_device(struct device *dev,
-@@ -148,7 +148,7 @@ static inline void dma_sync_single_range_for_device(struct device *dev,
- 		debug_dma_sync_single_range_for_device(dev, addr, offset, size, dir);
- 
- 	} else
--		dma_sync_single_for_device(dev, addr, size, dir);
-+		dma_sync_single_for_device(dev, addr + offset, size, dir);
- }
- 
- static inline void
-diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 1f5fa53..db821a4 100644
---- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -1560,7 +1560,6 @@ struct task_struct {
- 	/* bitmask of trace recursion */
- 	unsigned long trace_recursion;
- #endif /* CONFIG_TRACING */
--	unsigned long stack_start;
- #ifdef CONFIG_CGROUP_MEM_RES_CTLR /* memcg uses this to do batch job */
- 	struct memcg_batch_info {
- 		int do_batch;	/* incremented when batch uncharge started */
-diff --git a/kernel/fork.c b/kernel/fork.c
-index f88bd98..0ea67a3 100644
---- a/kernel/fork.c
-+++ b/kernel/fork.c
-@@ -1134,8 +1134,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- 
- 	p->bts = NULL;
- 
--	p->stack_start = stack_start;
--
- 	/* Perform scheduler related setup. Assign this task to a CPU. */
- 	sched_fork(p, clone_flags);
- 
-diff --git a/kernel/profile.c b/kernel/profile.c
-index a55d3a3..dfadc5b 100644
---- a/kernel/profile.c
-+++ b/kernel/profile.c
-@@ -127,8 +127,10 @@ int __ref profile_init(void)
- 		return 0;
- 
- 	prof_buffer = vmalloc(buffer_bytes);
--	if (prof_buffer)
-+	if (prof_buffer) {
-+		memset(prof_buffer, 0, buffer_bytes);
- 		return 0;
-+	}
- 
- 	free_cpumask_var(prof_cpu_mask);
- 	return -ENOMEM;
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index fd9ba95..e8d9544 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -1039,7 +1039,7 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma,
- 		page = alloc_buddy_huge_page(h, vma, addr);
- 		if (!page) {
- 			hugetlb_put_quota(inode->i_mapping, chg);
--			return ERR_PTR(-VM_FAULT_OOM);
-+			return ERR_PTR(-VM_FAULT_SIGBUS);
- 		}
- 	}
- 
-diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 16190ca..955f0b2 100644
---- a/net/ipv4/udp.c
-+++ b/net/ipv4/udp.c
-@@ -1527,6 +1527,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
- 
- 	uh   = udp_hdr(skb);
- 	ulen = ntohs(uh->len);
-+	saddr = ip_hdr(skb)->saddr;
-+	daddr = ip_hdr(skb)->daddr;
-+
- 	if (ulen > skb->len)
- 		goto short_packet;
- 
-@@ -1540,9 +1543,6 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
- 	if (udp4_csum_init(skb, uh, proto))
- 		goto csum_error;
- 
--	saddr = ip_hdr(skb)->saddr;
--	daddr = ip_hdr(skb)->daddr;
--
- 	if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
- 		return __udp4_lib_mcast_deliver(net, skb, uh,
- 				saddr, daddr, udptable);
-diff --git a/security/min_addr.c b/security/min_addr.c
-index e86f297..f728728 100644
---- a/security/min_addr.c
-+++ b/security/min_addr.c
-@@ -33,7 +33,7 @@ int mmap_min_addr_handler(struct ctl_table *table, int write,
- {
- 	int ret;
- 
--	if (!capable(CAP_SYS_RAWIO))
-+	if (write && !capable(CAP_SYS_RAWIO))
- 		return -EPERM;
- 
- 	ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index fd831bd..a747871 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -2718,6 +2718,7 @@ static struct pci_device_id azx_ids[] = {
- 	{ PCI_DEVICE(0x8086, 0x3a6e), .driver_data = AZX_DRIVER_ICH },
- 	/* PCH */
- 	{ PCI_DEVICE(0x8086, 0x3b56), .driver_data = AZX_DRIVER_ICH },
-+	{ PCI_DEVICE(0x8086, 0x3b57), .driver_data = AZX_DRIVER_ICH },
- 	/* CPT */
- 	{ PCI_DEVICE(0x8086, 0x1c20), .driver_data = AZX_DRIVER_PCH },
- 	/* SCH */
-diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
-index 1a97c81..a978645 100644
---- a/sound/pci/hda/patch_conexant.c
-+++ b/sound/pci/hda/patch_conexant.c
-@@ -1176,9 +1176,10 @@ static int patch_cxt5045(struct hda_codec *codec)
- 	case 0x103c:
- 	case 0x1631:
- 	case 0x1734:
--		/* HP, Packard Bell, & Fujitsu-Siemens laptops have really bad
--		 * sound over 0dB on NID 0x17. Fix max PCM level to 0 dB
--		 * (originally it has 0x2b steps with 0dB offset 0x14)
-+	case 0x17aa:
-+		/* HP, Packard Bell, Fujitsu-Siemens & Lenovo laptops have
-+		 * really bad sound over 0dB on NID 0x17. Fix max PCM level to
-+		 * 0 dB (originally it has 0x2b steps with 0dB offset 0x14)
- 		 */
- 		snd_hda_override_amp_caps(codec, 0x17, HDA_INPUT,
- 					  (0x14 << AC_AMPCAP_OFFSET_SHIFT) |
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index b486daa..abfc558 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -17348,7 +17348,6 @@ static struct snd_pci_quirk alc662_cfg_tbl[] = {
- 					ALC662_3ST_6ch_DIG),
- 	SND_PCI_QUIRK_MASK(0x1854, 0xf000, 0x2000, "ASUS H13-200x",
- 			   ALC663_ASUS_H13),
--	SND_PCI_QUIRK(0x8086, 0xd604, "Intel mobo", ALC662_3ST_2ch_DIG),
- 	{}
- };
- 
-diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
-index ac2d528..cb474c0 100644
---- a/sound/pci/hda/patch_sigmatel.c
-+++ b/sound/pci/hda/patch_sigmatel.c
-@@ -1539,11 +1539,9 @@ static unsigned int alienware_m17x_pin_configs[13] = {
- 	0x904601b0,
- };
- 
--static unsigned int intel_dg45id_pin_configs[14] = {
-+static unsigned int intel_dg45id_pin_configs[13] = {
- 	0x02214230, 0x02A19240, 0x01013214, 0x01014210,
--	0x01A19250, 0x01011212, 0x01016211, 0x40f000f0,
--	0x40f000f0, 0x40f000f0, 0x40f000f0, 0x014510A0,
--	0x074510B0, 0x40f000f0
-+	0x01A19250, 0x01011212, 0x01016211
- };
- 
- static unsigned int *stac92hd73xx_brd_tbl[STAC_92HD73XX_MODELS] = {
-diff --git a/sound/pci/ice1712/maya44.c b/sound/pci/ice1712/maya44.c
-index 3e1c20a..726fd4b 100644
---- a/sound/pci/ice1712/maya44.c
-+++ b/sound/pci/ice1712/maya44.c
-@@ -347,7 +347,7 @@ static int maya_gpio_sw_put(struct snd_kcontrol *kcontrol,
- 
- /* known working input slots (0-4) */
- #define MAYA_LINE_IN	1	/* in-2 */
--#define MAYA_MIC_IN	4	/* in-5 */
-+#define MAYA_MIC_IN	3	/* in-4 */
- 
- static void wm8776_select_input(struct snd_maya44 *chip, int idx, int line)
- {
-@@ -393,8 +393,8 @@ static int maya_rec_src_put(struct snd_kcontrol *kcontrol,
- 	int changed;
- 
- 	mutex_lock(&chip->mutex);
--	changed = maya_set_gpio_bits(chip->ice, GPIO_MIC_RELAY,
--				     sel ? GPIO_MIC_RELAY : 0);
-+	changed = maya_set_gpio_bits(chip->ice, 1 << GPIO_MIC_RELAY,
-+				     sel ? (1 << GPIO_MIC_RELAY) : 0);
- 	wm8776_select_input(chip, 0, sel ? MAYA_MIC_IN : MAYA_LINE_IN);
- 	mutex_unlock(&chip->mutex);
- 	return changed;
-diff --git a/sound/pci/oxygen/xonar_cs43xx.c b/sound/pci/oxygen/xonar_cs43xx.c
-index 16c226b..7c4986b 100644
---- a/sound/pci/oxygen/xonar_cs43xx.c
-+++ b/sound/pci/oxygen/xonar_cs43xx.c
-@@ -56,6 +56,7 @@
- #include <sound/pcm_params.h>
- #include <sound/tlv.h>
- #include "xonar.h"
-+#include "cm9780.h"
- #include "cs4398.h"
- #include "cs4362a.h"
- 
-@@ -172,6 +173,8 @@ static void xonar_d1_init(struct oxygen *chip)
- 	oxygen_clear_bits16(chip, OXYGEN_GPIO_DATA,
- 			    GPIO_D1_FRONT_PANEL | GPIO_D1_INPUT_ROUTE);
- 
-+	oxygen_ac97_set_bits(chip, 0, CM9780_JACK, CM9780_FMIC2MIC);
-+
- 	xonar_init_cs53x1(chip);
- 	xonar_enable_output(chip);
- 

Added: genpatches-2.6/trunk/2.6.33/1004_linux-2.6.33.5.patch
===================================================================
--- genpatches-2.6/trunk/2.6.33/1004_linux-2.6.33.5.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.33/1004_linux-2.6.33.5.patch	2010-07-05 23:09:19 UTC (rev 1721)
@@ -0,0 +1,1623 @@
+diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
+index 0d07513..bf241be 100644
+--- a/Documentation/filesystems/proc.txt
++++ b/Documentation/filesystems/proc.txt
+@@ -308,7 +308,7 @@ address           perms offset  dev   inode      pathname
+ 08049000-0804a000 rw-p 00001000 03:00 8312       /opt/test
+ 0804a000-0806b000 rw-p 00000000 00:00 0          [heap]
+ a7cb1000-a7cb2000 ---p 00000000 00:00 0
+-a7cb2000-a7eb2000 rw-p 00000000 00:00 0          [threadstack:001ff4b4]
++a7cb2000-a7eb2000 rw-p 00000000 00:00 0
+ a7eb2000-a7eb3000 ---p 00000000 00:00 0
+ a7eb3000-a7ed5000 rw-p 00000000 00:00 0
+ a7ed5000-a8008000 r-xp 00000000 03:00 4222       /lib/libc.so.6
+@@ -344,7 +344,6 @@ is not associated with a file:
+  [stack]                  = the stack of the main process
+  [vdso]                   = the "virtual dynamic shared object",
+                             the kernel system call handler
+- [threadstack:xxxxxxxx]   = the stack of the thread, xxxxxxxx is the stack size
+ 
+  or if empty, the mapping is anonymous.
+ 
+diff --git a/arch/powerpc/include/asm/hw_irq.h b/arch/powerpc/include/asm/hw_irq.h
+index 9f4c9d4..bd100fc 100644
+--- a/arch/powerpc/include/asm/hw_irq.h
++++ b/arch/powerpc/include/asm/hw_irq.h
+@@ -130,43 +130,5 @@ static inline int irqs_disabled_flags(unsigned long flags)
+  */
+ struct irq_chip;
+ 
+-#ifdef CONFIG_PERF_EVENTS
+-
+-#ifdef CONFIG_PPC64
+-static inline unsigned long test_perf_event_pending(void)
+-{
+-	unsigned long x;
+-
+-	asm volatile("lbz %0,%1(13)"
+-		: "=r" (x)
+-		: "i" (offsetof(struct paca_struct, perf_event_pending)));
+-	return x;
+-}
+-
+-static inline void set_perf_event_pending(void)
+-{
+-	asm volatile("stb %0,%1(13)" : :
+-		"r" (1),
+-		"i" (offsetof(struct paca_struct, perf_event_pending)));
+-}
+-
+-static inline void clear_perf_event_pending(void)
+-{
+-	asm volatile("stb %0,%1(13)" : :
+-		"r" (0),
+-		"i" (offsetof(struct paca_struct, perf_event_pending)));
+-}
+-#endif /* CONFIG_PPC64 */
+-
+-#else  /* CONFIG_PERF_EVENTS */
+-
+-static inline unsigned long test_perf_event_pending(void)
+-{
+-	return 0;
+-}
+-
+-static inline void clear_perf_event_pending(void) {}
+-#endif /* CONFIG_PERF_EVENTS */
+-
+ #endif	/* __KERNEL__ */
+ #endif	/* _ASM_POWERPC_HW_IRQ_H */
+diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
+index a6c2b63..11d0668 100644
+--- a/arch/powerpc/kernel/asm-offsets.c
++++ b/arch/powerpc/kernel/asm-offsets.c
+@@ -133,7 +133,6 @@ int main(void)
+ 	DEFINE(PACAKMSR, offsetof(struct paca_struct, kernel_msr));
+ 	DEFINE(PACASOFTIRQEN, offsetof(struct paca_struct, soft_enabled));
+ 	DEFINE(PACAHARDIRQEN, offsetof(struct paca_struct, hard_enabled));
+-	DEFINE(PACAPERFPEND, offsetof(struct paca_struct, perf_event_pending));
+ 	DEFINE(PACACONTEXTID, offsetof(struct paca_struct, context.id));
+ #ifdef CONFIG_PPC_MM_SLICES
+ 	DEFINE(PACALOWSLICESPSIZE, offsetof(struct paca_struct,
+diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
+index bdcb557..afbf400 100644
+--- a/arch/powerpc/kernel/entry_64.S
++++ b/arch/powerpc/kernel/entry_64.S
+@@ -556,15 +556,6 @@ ALT_FW_FTR_SECTION_END_IFCLR(FW_FEATURE_ISERIES)
+ 2:
+ 	TRACE_AND_RESTORE_IRQ(r5);
+ 
+-#ifdef CONFIG_PERF_EVENTS
+-	/* check paca->perf_event_pending if we're enabling ints */
+-	lbz	r3,PACAPERFPEND(r13)
+-	and.	r3,r3,r5
+-	beq	27f
+-	bl	.perf_event_do_pending
+-27:
+-#endif /* CONFIG_PERF_EVENTS */
+-
+ 	/* extract EE bit and use it to restore paca->hard_enabled */
+ 	ld	r3,_MSR(r1)
+ 	rldicl	r4,r3,49,63		/* r0 = (r3 >> 15) & 1 */
+diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
+index 9040330..dee83b8 100644
+--- a/arch/powerpc/kernel/irq.c
++++ b/arch/powerpc/kernel/irq.c
+@@ -53,7 +53,6 @@
+ #include <linux/bootmem.h>
+ #include <linux/pci.h>
+ #include <linux/debugfs.h>
+-#include <linux/perf_event.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/system.h>
+@@ -143,11 +142,6 @@ notrace void raw_local_irq_restore(unsigned long en)
+ 	}
+ #endif /* CONFIG_PPC_STD_MMU_64 */
+ 
+-	if (test_perf_event_pending()) {
+-		clear_perf_event_pending();
+-		perf_event_do_pending();
+-	}
+-
+ 	/*
+ 	 * if (get_paca()->hard_enabled) return;
+ 	 * But again we need to take care that gcc gets hard_enabled directly
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index 6c6093d..6f174e7 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -532,25 +532,60 @@ void __init iSeries_time_init_early(void)
+ }
+ #endif /* CONFIG_PPC_ISERIES */
+ 
+-#if defined(CONFIG_PERF_EVENTS) && defined(CONFIG_PPC32)
+-DEFINE_PER_CPU(u8, perf_event_pending);
++#ifdef CONFIG_PERF_EVENTS
+ 
+-void set_perf_event_pending(void)
++/*
++ * 64-bit uses a byte in the PACA, 32-bit uses a per-cpu variable...
++ */
++#ifdef CONFIG_PPC64
++static inline unsigned long test_perf_event_pending(void)
+ {
+-	get_cpu_var(perf_event_pending) = 1;
+-	set_dec(1);
+-	put_cpu_var(perf_event_pending);
++	unsigned long x;
++
++	asm volatile("lbz %0,%1(13)"
++		: "=r" (x)
++		: "i" (offsetof(struct paca_struct, perf_event_pending)));
++	return x;
+ }
+ 
++static inline void set_perf_event_pending_flag(void)
++{
++	asm volatile("stb %0,%1(13)" : :
++		"r" (1),
++		"i" (offsetof(struct paca_struct, perf_event_pending)));
++}
++
++static inline void clear_perf_event_pending(void)
++{
++	asm volatile("stb %0,%1(13)" : :
++		"r" (0),
++		"i" (offsetof(struct paca_struct, perf_event_pending)));
++}
++
++#else /* 32-bit */
++
++DEFINE_PER_CPU(u8, perf_event_pending);
++
++#define set_perf_event_pending_flag()	__get_cpu_var(perf_event_pending) = 1
+ #define test_perf_event_pending()	__get_cpu_var(perf_event_pending)
+ #define clear_perf_event_pending()	__get_cpu_var(perf_event_pending) = 0
+ 
+-#else  /* CONFIG_PERF_EVENTS && CONFIG_PPC32 */
++#endif /* 32 vs 64 bit */
++
++void set_perf_event_pending(void)
++{
++	preempt_disable();
++	set_perf_event_pending_flag();
++	set_dec(1);
++	preempt_enable();
++}
++
++#else  /* CONFIG_PERF_EVENTS */
+ 
+ #define test_perf_event_pending()	0
+ #define clear_perf_event_pending()
+ 
+-#endif /* CONFIG_PERF_EVENTS && CONFIG_PPC32 */
++#endif /* CONFIG_PERF_EVENTS */
+ 
+ /*
+  * For iSeries shared processors, we have to let the hypervisor
+@@ -580,10 +615,6 @@ void timer_interrupt(struct pt_regs * regs)
+ 	set_dec(DECREMENTER_MAX);
+ 
+ #ifdef CONFIG_PPC32
+-	if (test_perf_event_pending()) {
+-		clear_perf_event_pending();
+-		perf_event_do_pending();
+-	}
+ 	if (atomic_read(&ppc_n_lost_interrupts) != 0)
+ 		do_IRQ(regs);
+ #endif
+@@ -602,6 +633,11 @@ void timer_interrupt(struct pt_regs * regs)
+ 
+ 	calculate_steal_time();
+ 
++	if (test_perf_event_pending()) {
++		clear_perf_event_pending();
++		perf_event_do_pending();
++	}
++
+ #ifdef CONFIG_PPC_ISERIES
+ 	if (firmware_has_feature(FW_FEATURE_ISERIES))
+ 		get_lppaca()->int_dword.fields.decr_int = 0;
+diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
+index 7cf4642..11e94de 100644
+--- a/arch/s390/kernel/ptrace.c
++++ b/arch/s390/kernel/ptrace.c
+@@ -640,7 +640,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
+ 
+ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
+ {
+-	long ret;
++	long ret = 0;
+ 
+ 	/* Do the secure computing check first. */
+ 	secure_computing(regs->gprs[2]);
+@@ -649,7 +649,6 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
+ 	 * The sysc_tracesys code in entry.S stored the system
+ 	 * call number to gprs[2].
+ 	 */
+-	ret = regs->gprs[2];
+ 	if (test_thread_flag(TIF_SYSCALL_TRACE) &&
+ 	    (tracehook_report_syscall_entry(regs) ||
+ 	     regs->gprs[2] >= NR_syscalls)) {
+@@ -671,7 +670,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
+ 				    regs->gprs[2], regs->orig_gpr2,
+ 				    regs->gprs[3], regs->gprs[4],
+ 				    regs->gprs[5]);
+-	return ret;
++	return ret ?: regs->gprs[2];
+ }
+ 
+ asmlinkage void do_syscall_trace_exit(struct pt_regs *regs)
+diff --git a/arch/x86/include/asm/k8.h b/arch/x86/include/asm/k8.h
+index f70e600..af00bd1 100644
+--- a/arch/x86/include/asm/k8.h
++++ b/arch/x86/include/asm/k8.h
+@@ -16,11 +16,16 @@ extern int k8_numa_init(unsigned long start_pfn, unsigned long end_pfn);
+ extern int k8_scan_nodes(void);
+ 
+ #ifdef CONFIG_K8_NB
++extern int num_k8_northbridges;
++
+ static inline struct pci_dev *node_to_k8_nb_misc(int node)
+ {
+ 	return (node < num_k8_northbridges) ? k8_northbridges[node] : NULL;
+ }
++
+ #else
++#define num_k8_northbridges 0
++
+ static inline struct pci_dev *node_to_k8_nb_misc(int node)
+ {
+ 	return NULL;
+diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
+index d440123..581924b 100644
+--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
+@@ -338,6 +338,10 @@ amd_check_l3_disable(int index, struct _cpuid4_info_regs *this_leaf)
+ 	     (boot_cpu_data.x86_mask  < 0x1)))
+ 		return;
+ 
++	/* not in virtualized environments */
++	if (num_k8_northbridges == 0)
++		return;
++
+ 	this_leaf->can_disable = true;
+ 	this_leaf->l3_indices  = amd_calc_l3_indices();
+ }
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 999c8a6..0571b72 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -539,11 +539,13 @@ static int __cpuinit check_c1e_idle(const struct cpuinfo_x86 *c)
+ 		 * check OSVW bit for CPUs that are not affected
+ 		 * by erratum #400
+ 		 */
+-		rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, val);
+-		if (val >= 2) {
+-			rdmsrl(MSR_AMD64_OSVW_STATUS, val);
+-			if (!(val & BIT(1)))
+-				goto no_c1e_idle;
++		if (cpu_has(c, X86_FEATURE_OSVW)) {
++			rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, val);
++			if (val >= 2) {
++				rdmsrl(MSR_AMD64_OSVW_STATUS, val);
++				if (!(val & BIT(1)))
++					goto no_c1e_idle;
++			}
+ 		}
+ 		return 1;
+ 	}
+diff --git a/crypto/authenc.c b/crypto/authenc.c
+index 4d6f49a..0d54de9 100644
+--- a/crypto/authenc.c
++++ b/crypto/authenc.c
+@@ -46,6 +46,12 @@ struct authenc_request_ctx {
+ 	char tail[];
+ };
+ 
++static void authenc_request_complete(struct aead_request *req, int err)
++{
++	if (err != -EINPROGRESS)
++		aead_request_complete(req, err);
++}
++
+ static int crypto_authenc_setkey(struct crypto_aead *authenc, const u8 *key,
+ 				 unsigned int keylen)
+ {
+@@ -142,7 +148,7 @@ static void authenc_geniv_ahash_update_done(struct crypto_async_request *areq,
+ 				 crypto_aead_authsize(authenc), 1);
+ 
+ out:
+-	aead_request_complete(req, err);
++	authenc_request_complete(req, err);
+ }
+ 
+ static void authenc_geniv_ahash_done(struct crypto_async_request *areq, int err)
+@@ -208,7 +214,7 @@ static void authenc_verify_ahash_update_done(struct crypto_async_request *areq,
+ 	err = crypto_ablkcipher_decrypt(abreq);
+ 
+ out:
+-	aead_request_complete(req, err);
++	authenc_request_complete(req, err);
+ }
+ 
+ static void authenc_verify_ahash_done(struct crypto_async_request *areq,
+@@ -245,7 +251,7 @@ static void authenc_verify_ahash_done(struct crypto_async_request *areq,
+ 	err = crypto_ablkcipher_decrypt(abreq);
+ 
+ out:
+-	aead_request_complete(req, err);
++	authenc_request_complete(req, err);
+ }
+ 
+ static u8 *crypto_authenc_ahash_fb(struct aead_request *req, unsigned int flags)
+@@ -379,7 +385,7 @@ static void crypto_authenc_encrypt_done(struct crypto_async_request *req,
+ 		err = crypto_authenc_genicv(areq, iv, 0);
+ 	}
+ 
+-	aead_request_complete(areq, err);
++	authenc_request_complete(areq, err);
+ }
+ 
+ static int crypto_authenc_encrypt(struct aead_request *req)
+@@ -418,7 +424,7 @@ static void crypto_authenc_givencrypt_done(struct crypto_async_request *req,
+ 		err = crypto_authenc_genicv(areq, greq->giv, 0);
+ 	}
+ 
+-	aead_request_complete(areq, err);
++	authenc_request_complete(areq, err);
+ }
+ 
+ static int crypto_authenc_givencrypt(struct aead_givcrypt_request *req)
+diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
+index 7c85265..9ed9292 100644
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -475,101 +475,13 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
+ 	},
+ 	{
+ 	.callback = init_set_sci_en_on_resume,
+-	.ident = "Lenovo ThinkPad X201",
++	.ident = "Lenovo ThinkPad X201[s]",
+ 	.matches = {
+ 		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ 		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
+ 		},
+ 	},
+ 	{
+-	.callback = init_set_sci_en_on_resume,
+-	.ident = "Lenovo ThinkPad X201",
+-	.matches = {
+-		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
+-		},
+-	},
+-	{
+-	.callback = init_set_sci_en_on_resume,
+-	.ident = "Lenovo ThinkPad T410",
+-	.matches = {
+-		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
+-		},
+-	},
+-	{
+-	.callback = init_set_sci_en_on_resume,
+-	.ident = "Lenovo ThinkPad T510",
+-	.matches = {
+-		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
+-		},
+-	},
+-	{
+-	.callback = init_set_sci_en_on_resume,
+-	.ident = "Lenovo ThinkPad W510",
+-	.matches = {
+-		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
+-		},
+-	},
+-	{
+-	.callback = init_set_sci_en_on_resume,
+-	.ident = "Lenovo ThinkPad X201",
+-	.matches = {
+-		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
+-		},
+-	},
+-	{
+-	.callback = init_set_sci_en_on_resume,
+-	.ident = "Lenovo ThinkPad X201",
+-	.matches = {
+-		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
+-		},
+-	},
+-	{
+-	.callback = init_set_sci_en_on_resume,
+-	.ident = "Lenovo ThinkPad T410",
+-	.matches = {
+-		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
+-		},
+-	},
+-	{
+-	.callback = init_set_sci_en_on_resume,
+-	.ident = "Lenovo ThinkPad T510",
+-	.matches = {
+-		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
+-		},
+-	},
+-	{
+-	.callback = init_set_sci_en_on_resume,
+-	.ident = "Lenovo ThinkPad W510",
+-	.matches = {
+-		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
+-		},
+-	},
+-	{
+-	.callback = init_set_sci_en_on_resume,
+-	.ident = "Lenovo ThinkPad X201",
+-	.matches = {
+-		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
+-		},
+-	},
+-	{
+-	.callback = init_set_sci_en_on_resume,
+-	.ident = "Lenovo ThinkPad X201",
+-	.matches = {
+-		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
+-		},
+-	},
+-	{
+ 	.callback = init_old_suspend_ordering,
+ 	.ident = "Panasonic CF51-2L",
+ 	.matches = {
+diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
+index 76253cf..9af6766 100644
+--- a/drivers/char/tty_io.c
++++ b/drivers/char/tty_io.c
+@@ -1875,6 +1875,7 @@ got_driver:
+ 		 */
+ 		if (filp->f_op == &hung_up_tty_fops)
+ 			filp->f_op = &tty_fops;
++		unlock_kernel();
+ 		goto retry_open;
+ 	}
+ 	unlock_kernel();
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index cf4cb3e..4746bfe 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -79,14 +79,14 @@ const static struct intel_device_info intel_i915g_info = {
+ 	.is_i915g = 1, .is_i9xx = 1, .cursor_needs_physical = 1,
+ };
+ const static struct intel_device_info intel_i915gm_info = {
+-	.is_i9xx = 1,  .is_mobile = 1, .has_fbc = 1,
++	.is_i9xx = 1,  .is_mobile = 1,
+ 	.cursor_needs_physical = 1,
+ };
+ const static struct intel_device_info intel_i945g_info = {
+ 	.is_i9xx = 1, .has_hotplug = 1, .cursor_needs_physical = 1,
+ };
+ const static struct intel_device_info intel_i945gm_info = {
+-	.is_i945gm = 1, .is_i9xx = 1, .is_mobile = 1, .has_fbc = 1,
++	.is_i945gm = 1, .is_i9xx = 1, .is_mobile = 1,
+ 	.has_hotplug = 1, .cursor_needs_physical = 1,
+ };
+ 
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 16ce3ba..0b33757 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -206,11 +206,14 @@ typedef struct drm_i915_private {
+ 
+ 	drm_dma_handle_t *status_page_dmah;
+ 	void *hw_status_page;
++	void *seqno_page;
+ 	dma_addr_t dma_status_page;
+ 	uint32_t counter;
+ 	unsigned int status_gfx_addr;
++	unsigned int seqno_gfx_addr;
+ 	drm_local_map_t hws_map;
+ 	struct drm_gem_object *hws_obj;
++	struct drm_gem_object *seqno_obj;
+ 	struct drm_gem_object *pwrctx;
+ 
+ 	struct resource mch_res;
+@@ -1090,6 +1093,7 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
+ 
+ #define HAS_PCH_SPLIT(dev) (IS_IRONLAKE(dev) ||	\
+ 			    IS_GEN6(dev))
++#define HAS_PIPE_CONTROL(dev) (IS_IRONLAKE(dev) || IS_GEN6(dev))
+ 
+ #define PRIMARY_RINGBUFFER_SIZE         (128*1024)
+ 
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 6458400..c00c978 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1559,6 +1559,13 @@ i915_gem_object_move_to_inactive(struct drm_gem_object *obj)
+ 	i915_verify_inactive(dev, __FILE__, __LINE__);
+ }
+ 
++#define PIPE_CONTROL_FLUSH(addr)					\
++	OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |		\
++		 PIPE_CONTROL_DEPTH_STALL);				\
++	OUT_RING(addr | PIPE_CONTROL_GLOBAL_GTT);			\
++	OUT_RING(0);							\
++	OUT_RING(0);							\
++
+ /**
+  * Creates a new sequence number, emitting a write of it to the status page
+  * plus an interrupt, which will trigger i915_user_interrupt_handler.
+@@ -1593,13 +1600,47 @@ i915_add_request(struct drm_device *dev, struct drm_file *file_priv,
+ 	if (dev_priv->mm.next_gem_seqno == 0)
+ 		dev_priv->mm.next_gem_seqno++;
+ 
+-	BEGIN_LP_RING(4);
+-	OUT_RING(MI_STORE_DWORD_INDEX);
+-	OUT_RING(I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
+-	OUT_RING(seqno);
++	if (HAS_PIPE_CONTROL(dev)) {
++		u32 scratch_addr = dev_priv->seqno_gfx_addr + 128;
+ 
+-	OUT_RING(MI_USER_INTERRUPT);
+-	ADVANCE_LP_RING();
++		/*
++		 * Workaround qword write incoherence by flushing the
++		 * PIPE_NOTIFY buffers out to memory before requesting
++		 * an interrupt.
++		 */
++		BEGIN_LP_RING(32);
++		OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |
++			 PIPE_CONTROL_WC_FLUSH | PIPE_CONTROL_TC_FLUSH);
++		OUT_RING(dev_priv->seqno_gfx_addr | PIPE_CONTROL_GLOBAL_GTT);
++		OUT_RING(seqno);
++		OUT_RING(0);
++		PIPE_CONTROL_FLUSH(scratch_addr);
++		scratch_addr += 128; /* write to separate cachelines */
++		PIPE_CONTROL_FLUSH(scratch_addr);
++		scratch_addr += 128;
++		PIPE_CONTROL_FLUSH(scratch_addr);
++		scratch_addr += 128;
++		PIPE_CONTROL_FLUSH(scratch_addr);
++		scratch_addr += 128;
++		PIPE_CONTROL_FLUSH(scratch_addr);
++		scratch_addr += 128;
++		PIPE_CONTROL_FLUSH(scratch_addr);
++		OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |
++			 PIPE_CONTROL_WC_FLUSH | PIPE_CONTROL_TC_FLUSH |
++			 PIPE_CONTROL_NOTIFY);
++		OUT_RING(dev_priv->seqno_gfx_addr | PIPE_CONTROL_GLOBAL_GTT);
++		OUT_RING(seqno);
++		OUT_RING(0);
++		ADVANCE_LP_RING();
++	} else {
++		BEGIN_LP_RING(4);
++		OUT_RING(MI_STORE_DWORD_INDEX);
++		OUT_RING(I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
++		OUT_RING(seqno);
++
++		OUT_RING(MI_USER_INTERRUPT);
++		ADVANCE_LP_RING();
++	}
+ 
+ 	DRM_DEBUG_DRIVER("%d\n", seqno);
+ 
+@@ -1744,7 +1785,10 @@ i915_get_gem_seqno(struct drm_device *dev)
+ {
+ 	drm_i915_private_t *dev_priv = dev->dev_private;
+ 
+-	return READ_HWSP(dev_priv, I915_GEM_HWS_INDEX);
++	if (HAS_PIPE_CONTROL(dev))
++		return ((volatile u32 *)(dev_priv->seqno_page))[0];
++	else
++		return READ_HWSP(dev_priv, I915_GEM_HWS_INDEX);
+ }
+ 
+ /**
+@@ -4576,6 +4620,49 @@ i915_gem_idle(struct drm_device *dev)
+ 	return 0;
+ }
+ 
++/*
++ * 965+ support PIPE_CONTROL commands, which provide finer grained control
++ * over cache flushing.
++ */
++static int
++i915_gem_init_pipe_control(struct drm_device *dev)
++{
++	drm_i915_private_t *dev_priv = dev->dev_private;
++	struct drm_gem_object *obj;
++	struct drm_i915_gem_object *obj_priv;
++	int ret;
++
++	obj = drm_gem_object_alloc(dev, 4096);
++	if (obj == NULL) {
++		DRM_ERROR("Failed to allocate seqno page\n");
++		ret = -ENOMEM;
++		goto err;
++	}
++	obj_priv = obj->driver_private;
++	obj_priv->agp_type = AGP_USER_CACHED_MEMORY;
++
++	ret = i915_gem_object_pin(obj, 4096);
++	if (ret)
++		goto err_unref;
++
++	dev_priv->seqno_gfx_addr = obj_priv->gtt_offset;
++	dev_priv->seqno_page =  kmap(obj_priv->pages[0]);
++	if (dev_priv->seqno_page == NULL)
++		goto err_unpin;
++
++	dev_priv->seqno_obj = obj;
++	memset(dev_priv->seqno_page, 0, PAGE_SIZE);
++
++	return 0;
++
++err_unpin:
++	i915_gem_object_unpin(obj);
++err_unref:
++	drm_gem_object_unreference(obj);
++err:
++	return ret;
++}
++
+ static int
+ i915_gem_init_hws(struct drm_device *dev)
+ {
+@@ -4593,7 +4680,8 @@ i915_gem_init_hws(struct drm_device *dev)
+ 	obj = drm_gem_object_alloc(dev, 4096);
+ 	if (obj == NULL) {
+ 		DRM_ERROR("Failed to allocate status page\n");
+-		return -ENOMEM;
++		ret = -ENOMEM;
++		goto err;
+ 	}
+ 	obj_priv = obj->driver_private;
+ 	obj_priv->agp_type = AGP_USER_CACHED_MEMORY;
+@@ -4601,7 +4689,7 @@ i915_gem_init_hws(struct drm_device *dev)
+ 	ret = i915_gem_object_pin(obj, 4096);
+ 	if (ret != 0) {
+ 		drm_gem_object_unreference(obj);
+-		return ret;
++		goto err_unref;
+ 	}
+ 
+ 	dev_priv->status_gfx_addr = obj_priv->gtt_offset;
+@@ -4610,10 +4698,16 @@ i915_gem_init_hws(struct drm_device *dev)
+ 	if (dev_priv->hw_status_page == NULL) {
+ 		DRM_ERROR("Failed to map status page.\n");
+ 		memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
+-		i915_gem_object_unpin(obj);
+-		drm_gem_object_unreference(obj);
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto err_unpin;
+ 	}
++
++	if (HAS_PIPE_CONTROL(dev)) {
++		ret = i915_gem_init_pipe_control(dev);
++		if (ret)
++			goto err_unpin;
++	}
++
+ 	dev_priv->hws_obj = obj;
+ 	memset(dev_priv->hw_status_page, 0, PAGE_SIZE);
+ 	I915_WRITE(HWS_PGA, dev_priv->status_gfx_addr);
+@@ -4621,6 +4715,30 @@ i915_gem_init_hws(struct drm_device *dev)
+ 	DRM_DEBUG_DRIVER("hws offset: 0x%08x\n", dev_priv->status_gfx_addr);
+ 
+ 	return 0;
++
++err_unpin:
++	i915_gem_object_unpin(obj);
++err_unref:
++	drm_gem_object_unreference(obj);
++err:
++	return 0;
++}
++
++static void
++i915_gem_cleanup_pipe_control(struct drm_device *dev)
++{
++	drm_i915_private_t *dev_priv = dev->dev_private;
++	struct drm_gem_object *obj;
++	struct drm_i915_gem_object *obj_priv;
++
++	obj = dev_priv->seqno_obj;
++	obj_priv = obj->driver_private;
++	kunmap(obj_priv->pages[0]);
++	i915_gem_object_unpin(obj);
++	drm_gem_object_unreference(obj);
++	dev_priv->seqno_obj = NULL;
++
++	dev_priv->seqno_page = NULL;
+ }
+ 
+ static void
+@@ -4644,6 +4762,9 @@ i915_gem_cleanup_hws(struct drm_device *dev)
+ 	memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
+ 	dev_priv->hw_status_page = NULL;
+ 
++	if (HAS_PIPE_CONTROL(dev))
++		i915_gem_cleanup_pipe_control(dev);
++
+ 	/* Write high address into HWS_PGA when disabling. */
+ 	I915_WRITE(HWS_PGA, 0x1ffff000);
+ }
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index 032f667..d6466d5 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -297,7 +297,7 @@ irqreturn_t ironlake_irq_handler(struct drm_device *dev)
+ 				READ_BREADCRUMB(dev_priv);
+ 	}
+ 
+-	if (gt_iir & GT_USER_INTERRUPT) {
++	if (gt_iir & GT_PIPE_NOTIFY) {
+ 		u32 seqno = i915_get_gem_seqno(dev);
+ 		dev_priv->mm.irq_gem_seqno = seqno;
+ 		trace_i915_gem_request_complete(dev, seqno);
+@@ -738,7 +738,7 @@ void i915_user_irq_get(struct drm_device *dev)
+ 	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
+ 	if (dev->irq_enabled && (++dev_priv->user_irq_refcount == 1)) {
+ 		if (HAS_PCH_SPLIT(dev))
+-			ironlake_enable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
++			ironlake_enable_graphics_irq(dev_priv, GT_PIPE_NOTIFY);
+ 		else
+ 			i915_enable_irq(dev_priv, I915_USER_INTERRUPT);
+ 	}
+@@ -754,7 +754,7 @@ void i915_user_irq_put(struct drm_device *dev)
+ 	BUG_ON(dev->irq_enabled && dev_priv->user_irq_refcount <= 0);
+ 	if (dev->irq_enabled && (--dev_priv->user_irq_refcount == 0)) {
+ 		if (HAS_PCH_SPLIT(dev))
+-			ironlake_disable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
++			ironlake_disable_graphics_irq(dev_priv, GT_PIPE_NOTIFY);
+ 		else
+ 			i915_disable_irq(dev_priv, I915_USER_INTERRUPT);
+ 	}
+@@ -1034,7 +1034,7 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
+ 	/* enable kind of interrupts always enabled */
+ 	u32 display_mask = DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT |
+ 			   DE_PLANEA_FLIP_DONE | DE_PLANEB_FLIP_DONE;
+-	u32 render_mask = GT_USER_INTERRUPT;
++	u32 render_mask = GT_PIPE_NOTIFY;
+ 	u32 hotplug_mask = SDE_CRT_HOTPLUG | SDE_PORTB_HOTPLUG |
+ 			   SDE_PORTC_HOTPLUG | SDE_PORTD_HOTPLUG;
+ 
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index fd95bdf..30a2322 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -210,6 +210,16 @@
+ #define   ASYNC_FLIP                (1<<22)
+ #define   DISPLAY_PLANE_A           (0<<20)
+ #define   DISPLAY_PLANE_B           (1<<20)
++#define GFX_OP_PIPE_CONTROL	((0x3<<29)|(0x3<<27)|(0x2<<24)|2)
++#define   PIPE_CONTROL_QW_WRITE	(1<<14)
++#define   PIPE_CONTROL_DEPTH_STALL (1<<13)
++#define   PIPE_CONTROL_WC_FLUSH	(1<<12)
++#define   PIPE_CONTROL_IS_FLUSH	(1<<11) /* MBZ on Ironlake */
++#define   PIPE_CONTROL_TC_FLUSH (1<<10) /* GM45+ only */
++#define   PIPE_CONTROL_ISP_DIS	(1<<9)
++#define   PIPE_CONTROL_NOTIFY	(1<<8)
++#define   PIPE_CONTROL_GLOBAL_GTT (1<<2) /* in addr dword */
++#define   PIPE_CONTROL_STALL_EN	(1<<1) /* in addr word, Ironlake+ only */
+ 
+ /*
+  * Fence registers
+@@ -2111,6 +2121,7 @@
+ #define DEIER   0x4400c
+ 
+ /* GT interrupt */
++#define GT_PIPE_NOTIFY		(1 << 4)
+ #define GT_SYNC_STATUS          (1 << 2)
+ #define GT_USER_INTERRUPT       (1 << 0)
+ 
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 4b2458d..3f00902 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4683,7 +4683,7 @@ static void intel_init_display(struct drm_device *dev)
+ 			dev_priv->display.fbc_enabled = g4x_fbc_enabled;
+ 			dev_priv->display.enable_fbc = g4x_enable_fbc;
+ 			dev_priv->display.disable_fbc = g4x_disable_fbc;
+-		} else if (IS_I965GM(dev) || IS_I945GM(dev) || IS_I915GM(dev)) {
++		} else if (IS_I965GM(dev)) {
+ 			dev_priv->display.fbc_enabled = i8xx_fbc_enabled;
+ 			dev_priv->display.enable_fbc = i8xx_enable_fbc;
+ 			dev_priv->display.disable_fbc = i8xx_disable_fbc;
+diff --git a/drivers/hwmon/hp_accel.c b/drivers/hwmon/hp_accel.c
+index be475e8..f16d60f 100644
+--- a/drivers/hwmon/hp_accel.c
++++ b/drivers/hwmon/hp_accel.c
+@@ -324,8 +324,8 @@ static int lis3lv02d_remove(struct acpi_device *device, int type)
+ 	lis3lv02d_joystick_disable();
+ 	lis3lv02d_poweroff(&lis3_dev);
+ 
+-	flush_work(&hpled_led.work);
+ 	led_classdev_unregister(&hpled_led.led_classdev);
++	flush_work(&hpled_led.work);
+ 
+ 	return lis3lv02d_remove_fs(&lis3_dev);
+ }
+diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
+index 8072128..ee337df 100644
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -568,9 +568,10 @@ static void atmci_dma_cleanup(struct atmel_mci *host)
+ {
+ 	struct mmc_data			*data = host->data;
+ 
+-	dma_unmap_sg(&host->pdev->dev, data->sg, data->sg_len,
+-		     ((data->flags & MMC_DATA_WRITE)
+-		      ? DMA_TO_DEVICE : DMA_FROM_DEVICE));
++	if (data)
++		dma_unmap_sg(&host->pdev->dev, data->sg, data->sg_len,
++			     ((data->flags & MMC_DATA_WRITE)
++			      ? DMA_TO_DEVICE : DMA_FROM_DEVICE));
+ }
+ 
+ static void atmci_stop_dma(struct atmel_mci *host)
+@@ -1098,8 +1099,8 @@ static void atmci_command_complete(struct atmel_mci *host,
+ 			"command error: status=0x%08x\n", status);
+ 
+ 		if (cmd->data) {
+-			host->data = NULL;
+ 			atmci_stop_dma(host);
++			host->data = NULL;
+ 			mci_writel(host, IDR, MCI_NOTBUSY
+ 					| MCI_TXRDY | MCI_RXRDY
+ 					| ATMCI_DATA_ERROR_FLAGS);
+@@ -1292,6 +1293,7 @@ static void atmci_tasklet_func(unsigned long priv)
+ 			} else {
+ 				data->bytes_xfered = data->blocks * data->blksz;
+ 				data->error = 0;
++				mci_writel(host, IDR, ATMCI_DATA_ERROR_FLAGS);
+ 			}
+ 
+ 			if (!data->stop) {
+@@ -1750,13 +1752,13 @@ static int __init atmci_probe(struct platform_device *pdev)
+ 	ret = -ENODEV;
+ 	if (pdata->slot[0].bus_width) {
+ 		ret = atmci_init_slot(host, &pdata->slot[0],
+-				MCI_SDCSEL_SLOT_A, 0);
++				0, MCI_SDCSEL_SLOT_A);
+ 		if (!ret)
+ 			nr_slots++;
+ 	}
+ 	if (pdata->slot[1].bus_width) {
+ 		ret = atmci_init_slot(host, &pdata->slot[1],
+-				MCI_SDCSEL_SLOT_B, 1);
++				1, MCI_SDCSEL_SLOT_B);
+ 		if (!ret)
+ 			nr_slots++;
+ 	}
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index c3ce920..8b7c267 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2244,7 +2244,7 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
+ 		if (ATH_TXQ_SETUP(sc, i)) {
+ 			txq = &sc->tx.txq[i];
+ 
+-			spin_lock_bh(&txq->axq_lock);
++			spin_lock(&txq->axq_lock);
+ 
+ 			list_for_each_entry_safe(ac,
+ 					ac_tmp, &txq->axq_acq, list) {
+@@ -2265,7 +2265,7 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
+ 				}
+ 			}
+ 
+-			spin_unlock_bh(&txq->axq_lock);
++			spin_unlock(&txq->axq_lock);
+ 		}
+ 	}
+ }
+diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
+index 3b4c5a4..82c1d2e 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
++++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
+@@ -581,6 +581,11 @@ static int iwl4965_alive_notify(struct iwl_priv *priv)
+ 
+ 	iwl4965_set_wr_ptrs(priv, IWL_CMD_QUEUE_NUM, 0);
+ 
++	/* make sure all queue are not stopped */
++	memset(&priv->queue_stopped[0], 0, sizeof(priv->queue_stopped));
++	for (i = 0; i < 4; i++)
++		atomic_set(&priv->queue_stop_count[i], 0);
++
+ 	/* reset to 0 to enable all the queue first */
+ 	priv->txq_ctx_active_msk = 0;
+ 	/* Map each Tx/cmd queue to its corresponding fifo */
+diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
+index c610e5f..f7d41c7 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
+@@ -657,6 +657,11 @@ int iwl5000_alive_notify(struct iwl_priv *priv)
+ 
+ 	iwl5000_set_wr_ptrs(priv, IWL_CMD_QUEUE_NUM, 0);
+ 
++	/* make sure all queue are not stopped */
++	memset(&priv->queue_stopped[0], 0, sizeof(priv->queue_stopped));
++	for (i = 0; i < 4; i++)
++		atomic_set(&priv->queue_stop_count[i], 0);
++
+ 	/* reset to 0 to enable all the queue first */
+ 	priv->txq_ctx_active_msk = 0;
+ 	/* map qos queues to fifos one-to-one */
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+index b93e491..3534d86 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+@@ -298,10 +298,23 @@ static void rs_tl_turn_on_agg_for_tid(struct iwl_priv *priv,
+ 				      struct iwl_lq_sta *lq_data, u8 tid,
+ 				      struct ieee80211_sta *sta)
+ {
++	int ret;
++
+ 	if (rs_tl_get_load(lq_data, tid) > IWL_AGG_LOAD_THRESHOLD) {
+ 		IWL_DEBUG_HT(priv, "Starting Tx agg: STA: %pM tid: %d\n",
+ 				sta->addr, tid);
+-		ieee80211_start_tx_ba_session(sta, tid);
++		ret = ieee80211_start_tx_ba_session(sta, tid);
++		if (ret == -EAGAIN) {
++			/*
++			 * driver and mac80211 is out of sync
++			 * this might be cause by reloading firmware
++			 * stop the tx ba session here
++			 */
++			IWL_DEBUG_HT(priv, "Fail start Tx agg on tid: %d\n",
++				tid);
++			ret = ieee80211_stop_tx_ba_session(sta, tid,
++						WLAN_BACK_INITIATOR);
++		}
+ 	}
+ }
+ 
+diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
+index 88470fb..e0ce039 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
+@@ -821,8 +821,10 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
+ 		hdr->seq_ctrl |= cpu_to_le16(seq_number);
+ 		seq_number += 0x10;
+ 		/* aggregation is on for this <sta,tid> */
+-		if (info->flags & IEEE80211_TX_CTL_AMPDU)
++		if (info->flags & IEEE80211_TX_CTL_AMPDU &&
++		    priv->stations[sta_id].tid[tid].agg.state == IWL_AGG_ON) {
+ 			txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
++		}
+ 	}
+ 
+ 	txq = &priv->txq[txq_id];
+@@ -1347,7 +1349,7 @@ int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
+ {
+ 	int tx_fifo_id, txq_id, sta_id, ssn = -1;
+ 	struct iwl_tid_data *tid_data;
+-	int ret, write_ptr, read_ptr;
++	int write_ptr, read_ptr;
+ 	unsigned long flags;
+ 
+ 	if (!ra) {
+@@ -1399,13 +1401,17 @@ int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
+ 	priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
+ 
+ 	spin_lock_irqsave(&priv->lock, flags);
+-	ret = priv->cfg->ops->lib->txq_agg_disable(priv, txq_id, ssn,
++	/*
++	 * the only reason this call can fail is queue number out of range,
++	 * which can happen if uCode is reloaded and all the station
++	 * information are lost. if it is outside the range, there is no need
++	 * to deactivate the uCode queue, just return "success" to allow
++	 *  mac80211 to clean up it own data.
++	 */
++	priv->cfg->ops->lib->txq_agg_disable(priv, txq_id, ssn,
+ 						   tx_fifo_id);
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 
+-	if (ret)
+-		return ret;
+-
+ 	ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, ra, tid);
+ 
+ 	return 0;
+diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
+index 5905936..e4bd795 100644
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -35,6 +35,9 @@
+  */
+ #define DASD_CHANQ_MAX_SIZE 4
+ 
++#define DASD_SLEEPON_START_TAG	(void *) 1
++#define DASD_SLEEPON_END_TAG	(void *) 2
++
+ /*
+  * SECTION: exported variables of dasd.c
+  */
+@@ -1460,7 +1463,10 @@ void dasd_add_request_tail(struct dasd_ccw_req *cqr)
+  */
+ static void dasd_wakeup_cb(struct dasd_ccw_req *cqr, void *data)
+ {
+-	wake_up((wait_queue_head_t *) data);
++	spin_lock_irq(get_ccwdev_lock(cqr->startdev->cdev));
++	cqr->callback_data = DASD_SLEEPON_END_TAG;
++	spin_unlock_irq(get_ccwdev_lock(cqr->startdev->cdev));
++	wake_up(&generic_waitq);
+ }
+ 
+ static inline int _wait_for_wakeup(struct dasd_ccw_req *cqr)
+@@ -1470,10 +1476,7 @@ static inline int _wait_for_wakeup(struct dasd_ccw_req *cqr)
+ 
+ 	device = cqr->startdev;
+ 	spin_lock_irq(get_ccwdev_lock(device->cdev));
+-	rc = ((cqr->status == DASD_CQR_DONE ||
+-	       cqr->status == DASD_CQR_NEED_ERP ||
+-	       cqr->status == DASD_CQR_TERMINATED) &&
+-	      list_empty(&cqr->devlist));
++	rc = (cqr->callback_data == DASD_SLEEPON_END_TAG);
+ 	spin_unlock_irq(get_ccwdev_lock(device->cdev));
+ 	return rc;
+ }
+@@ -1561,7 +1564,7 @@ static int _dasd_sleep_on(struct dasd_ccw_req *maincqr, int interruptible)
+ 			wait_event(generic_waitq, !(device->stopped));
+ 
+ 		cqr->callback = dasd_wakeup_cb;
+-		cqr->callback_data = (void *) &generic_waitq;
++		cqr->callback_data = DASD_SLEEPON_START_TAG;
+ 		dasd_add_request_tail(cqr);
+ 		if (interruptible) {
+ 			rc = wait_event_interruptible(
+@@ -1640,7 +1643,7 @@ int dasd_sleep_on_immediatly(struct dasd_ccw_req *cqr)
+ 	}
+ 
+ 	cqr->callback = dasd_wakeup_cb;
+-	cqr->callback_data = (void *) &generic_waitq;
++	cqr->callback_data = DASD_SLEEPON_START_TAG;
+ 	cqr->status = DASD_CQR_QUEUED;
+ 	list_add(&cqr->devlist, &device->ccw_queue);
+ 
+diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
+index d00fcf8..fd6b135 100644
+--- a/drivers/serial/imx.c
++++ b/drivers/serial/imx.c
+@@ -119,7 +119,8 @@
+ #define  MX2_UCR3_RXDMUXSEL	 (1<<2)  /* RXD Muxed Input Select, on mx2/mx3 */
+ #define  UCR3_INVT  	 (1<<1)  /* Inverted Infrared transmission */
+ #define  UCR3_BPEN  	 (1<<0)  /* Preset registers enable */
+-#define  UCR4_CTSTL_32   (32<<10) /* CTS trigger level (32 chars) */
++#define  UCR4_CTSTL_SHF  10      /* CTS trigger level shift */
++#define  UCR4_CTSTL_MASK 0x3F    /* CTS trigger is 6 bits wide */
+ #define  UCR4_INVR  	 (1<<9)  /* Inverted infrared reception */
+ #define  UCR4_ENIRI 	 (1<<8)  /* Serial infrared interrupt enable */
+ #define  UCR4_WKEN  	 (1<<7)  /* Wake interrupt enable */
+@@ -590,6 +591,9 @@ static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
+ 	return 0;
+ }
+ 
++/* half the RX buffer size */
++#define CTSTL 16
++
+ static int imx_startup(struct uart_port *port)
+ {
+ 	struct imx_port *sport = (struct imx_port *)port;
+@@ -606,6 +610,10 @@ static int imx_startup(struct uart_port *port)
+ 	if (USE_IRDA(sport))
+ 		temp |= UCR4_IRSC;
+ 
++	/* set the trigger level for CTS */
++	temp &= ~(UCR4_CTSTL_MASK<<  UCR4_CTSTL_SHF);
++	temp |= CTSTL<<  UCR4_CTSTL_SHF;
++
+ 	writel(temp & ~UCR4_DREN, sport->port.membase + UCR4);
+ 
+ 	if (USE_IRDA(sport)) {
+diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/bfin-t350mcqb-fb.c
+index 2549c53..6c8b6b6 100644
+--- a/drivers/video/bfin-t350mcqb-fb.c
++++ b/drivers/video/bfin-t350mcqb-fb.c
+@@ -515,9 +515,9 @@ static int __devinit bfin_t350mcqb_probe(struct platform_device *pdev)
+ 	fbinfo->fbops = &bfin_t350mcqb_fb_ops;
+ 	fbinfo->flags = FBINFO_FLAG_DEFAULT;
+ 
+-	info->fb_buffer =
+-	    dma_alloc_coherent(NULL, fbinfo->fix.smem_len, &info->dma_handle,
+-			       GFP_KERNEL);
++	info->fb_buffer = dma_alloc_coherent(NULL, fbinfo->fix.smem_len +
++				ACTIVE_VIDEO_MEM_OFFSET,
++				&info->dma_handle, GFP_KERNEL);
+ 
+ 	if (NULL == info->fb_buffer) {
+ 		printk(KERN_ERR DRIVER_NAME
+@@ -587,8 +587,8 @@ out7:
+ out6:
+ 	fb_dealloc_cmap(&fbinfo->cmap);
+ out4:
+-	dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
+-			  info->dma_handle);
++	dma_free_coherent(NULL, fbinfo->fix.smem_len + ACTIVE_VIDEO_MEM_OFFSET,
++			 info->fb_buffer, info->dma_handle);
+ out3:
+ 	framebuffer_release(fbinfo);
+ out2:
+@@ -611,8 +611,9 @@ static int __devexit bfin_t350mcqb_remove(struct platform_device *pdev)
+ 	free_irq(info->irq, info);
+ 
+ 	if (info->fb_buffer != NULL)
+-		dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
+-				  info->dma_handle);
++		dma_free_coherent(NULL, fbinfo->fix.smem_len +
++			ACTIVE_VIDEO_MEM_OFFSET, info->fb_buffer,
++			info->dma_handle);
+ 
+ 	fb_dealloc_cmap(&fbinfo->cmap);
+ 
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 645a179..2c6ee6a 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -964,12 +964,17 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
+ 		ret = -EBADF;
+ 		goto out_drop_write;
+ 	}
++
+ 	src = src_file->f_dentry->d_inode;
+ 
+ 	ret = -EINVAL;
+ 	if (src == inode)
+ 		goto out_fput;
+ 
++	/* the src must be open for reading */
++	if (!(src_file->f_mode & FMODE_READ))
++		goto out_fput;
++
+ 	ret = -EISDIR;
+ 	if (S_ISDIR(src->i_mode) || S_ISDIR(inode->i_mode))
+ 		goto out_fput;
+diff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c
+index b5808cd..039b501 100644
+--- a/fs/cachefiles/security.c
++++ b/fs/cachefiles/security.c
+@@ -77,6 +77,8 @@ static int cachefiles_check_cache_dir(struct cachefiles_cache *cache,
+ /*
+  * check the security details of the on-disk cache
+  * - must be called with security override in force
++ * - must return with a security override in force - even in the case of an
++ *   error
+  */
+ int cachefiles_determine_cache_security(struct cachefiles_cache *cache,
+ 					struct dentry *root,
+@@ -99,6 +101,8 @@ int cachefiles_determine_cache_security(struct cachefiles_cache *cache,
+ 	 * which create files */
+ 	ret = set_create_files_as(new, root->d_inode);
+ 	if (ret < 0) {
++		abort_creds(new);
++		cachefiles_begin_secure(cache, _saved_cred);
+ 		_leave(" = %d [cfa]", ret);
+ 		return ret;
+ 	}
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index ed751bb..2568889 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -500,6 +500,7 @@ struct dfs_info3_param {
+ #define CIFS_FATTR_DFS_REFERRAL		0x1
+ #define CIFS_FATTR_DELETE_PENDING	0x2
+ #define CIFS_FATTR_NEED_REVAL		0x4
++#define CIFS_FATTR_INO_COLLISION	0x8
+ 
+ struct cifs_fattr {
+ 	u32		cf_flags;
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index e3fda97..7ec8555 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -610,6 +610,16 @@ cifs_find_inode(struct inode *inode, void *opaque)
+ 	if (CIFS_I(inode)->uniqueid != fattr->cf_uniqueid)
+ 		return 0;
+ 
++	/*
++	 * uh oh -- it's a directory. We can't use it since hardlinked dirs are
++	 * verboten. Disable serverino and return it as if it were found, the
++	 * caller can discard it, generate a uniqueid and retry the find
++	 */
++	if (S_ISDIR(inode->i_mode) && !list_empty(&inode->i_dentry)) {
++		fattr->cf_flags |= CIFS_FATTR_INO_COLLISION;
++		cifs_autodisable_serverino(CIFS_SB(inode->i_sb));
++	}
++
+ 	return 1;
+ }
+ 
+@@ -629,15 +639,22 @@ cifs_iget(struct super_block *sb, struct cifs_fattr *fattr)
+ 	unsigned long hash;
+ 	struct inode *inode;
+ 
++retry_iget5_locked:
+ 	cFYI(1, ("looking for uniqueid=%llu", fattr->cf_uniqueid));
+ 
+ 	/* hash down to 32-bits on 32-bit arch */
+ 	hash = cifs_uniqueid_to_ino_t(fattr->cf_uniqueid);
+ 
+ 	inode = iget5_locked(sb, hash, cifs_find_inode, cifs_init_inode, fattr);
+-
+-	/* we have fattrs in hand, update the inode */
+ 	if (inode) {
++		/* was there a problematic inode number collision? */
++		if (fattr->cf_flags & CIFS_FATTR_INO_COLLISION) {
++			iput(inode);
++			fattr->cf_uniqueid = iunique(sb, ROOT_I);
++			fattr->cf_flags &= ~CIFS_FATTR_INO_COLLISION;
++			goto retry_iget5_locked;
++		}
++
+ 		cifs_fattr_to_inode(inode, fattr);
+ 		if (sb->s_flags & MS_NOATIME)
+ 			inode->i_flags |= S_NOATIME | S_NOCMTIME;
+diff --git a/fs/compat.c b/fs/compat.c
+index 00d90c2..514b623 100644
+--- a/fs/compat.c
++++ b/fs/compat.c
+@@ -1530,8 +1530,6 @@ int compat_do_execve(char * filename,
+ 	if (retval < 0)
+ 		goto out;
+ 
+-	current->stack_start = current->mm->start_stack;
+-
+ 	/* execve succeeded */
+ 	current->fs->in_exec = 0;
+ 	current->in_execve = 0;
+diff --git a/fs/exec.c b/fs/exec.c
+index 9071360..332f781 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1386,8 +1386,6 @@ int do_execve(char * filename,
+ 	if (retval < 0)
+ 		goto out;
+ 
+-	current->stack_start = current->mm->start_stack;
+-
+ 	/* execve succeeded */
+ 	current->fs->in_exec = 0;
+ 	current->in_execve = 0;
+diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
+index 8173fae..4d3ddcc 100644
+--- a/fs/nilfs2/super.c
++++ b/fs/nilfs2/super.c
+@@ -746,6 +746,7 @@ nilfs_fill_super(struct super_block *sb, void *data, int silent,
+ 	sb->s_export_op = &nilfs_export_ops;
+ 	sb->s_root = NULL;
+ 	sb->s_time_gran = 1;
++	sb->s_bdi = nilfs->ns_bdi;
+ 
+ 	err = load_nilfs(nilfs, sbi);
+ 	if (err)
+diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
+index 1afb0a1..e27960c 100644
+--- a/fs/notify/inotify/inotify_fsnotify.c
++++ b/fs/notify/inotify/inotify_fsnotify.c
+@@ -28,6 +28,7 @@
+ #include <linux/path.h> /* struct path */
+ #include <linux/slab.h> /* kmem_* */
+ #include <linux/types.h>
++#include <linux/sched.h>
+ 
+ #include "inotify.h"
+ 
+@@ -146,6 +147,7 @@ static void inotify_free_group_priv(struct fsnotify_group *group)
+ 	idr_for_each(&group->inotify_data.idr, idr_callback, group);
+ 	idr_remove_all(&group->inotify_data.idr);
+ 	idr_destroy(&group->inotify_data.idr);
++	free_uid(group->inotify_data.user);
+ }
+ 
+ void inotify_free_event_priv(struct fsnotify_event_private_data *fsn_event_priv)
+diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
+index a94e8bd..75aa15a 100644
+--- a/fs/notify/inotify/inotify_user.c
++++ b/fs/notify/inotify/inotify_user.c
+@@ -550,21 +550,24 @@ retry:
+ 	if (unlikely(!idr_pre_get(&group->inotify_data.idr, GFP_KERNEL)))
+ 		goto out_err;
+ 
++	/* we are putting the mark on the idr, take a reference */
++	fsnotify_get_mark(&tmp_ientry->fsn_entry);
++
+ 	spin_lock(&group->inotify_data.idr_lock);
+ 	ret = idr_get_new_above(&group->inotify_data.idr, &tmp_ientry->fsn_entry,
+ 				group->inotify_data.last_wd+1,
+ 				&tmp_ientry->wd);
+ 	spin_unlock(&group->inotify_data.idr_lock);
+ 	if (ret) {
++		/* we didn't get on the idr, drop the idr reference */
++		fsnotify_put_mark(&tmp_ientry->fsn_entry);
++
+ 		/* idr was out of memory allocate and try again */
+ 		if (ret == -EAGAIN)
+ 			goto retry;
+ 		goto out_err;
+ 	}
+ 
+-	/* we put the mark on the idr, take a reference */
+-	fsnotify_get_mark(&tmp_ientry->fsn_entry);
+-
+ 	/* we are on the idr, now get on the inode */
+ 	ret = fsnotify_add_mark(&tmp_ientry->fsn_entry, group, inode);
+ 	if (ret) {
+diff --git a/fs/proc/array.c b/fs/proc/array.c
+index 13b5d07..69eb4c4 100644
+--- a/fs/proc/array.c
++++ b/fs/proc/array.c
+@@ -82,7 +82,6 @@
+ #include <linux/pid_namespace.h>
+ #include <linux/ptrace.h>
+ #include <linux/tracehook.h>
+-#include <linux/swapops.h>
+ 
+ #include <asm/pgtable.h>
+ #include <asm/processor.h>
+@@ -494,7 +493,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+ 		rsslim,
+ 		mm ? mm->start_code : 0,
+ 		mm ? mm->end_code : 0,
+-		(permitted && mm) ? task->stack_start : 0,
++		(permitted && mm) ? mm->start_stack : 0,
+ 		esp,
+ 		eip,
+ 		/* The signal information here is obsolete.
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index f277c4a..9df34a5 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -243,25 +243,6 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
+ 				} else if (vma->vm_start <= mm->start_stack &&
+ 					   vma->vm_end >= mm->start_stack) {
+ 					name = "[stack]";
+-				} else {
+-					unsigned long stack_start;
+-					struct proc_maps_private *pmp;
+-
+-					pmp = m->private;
+-					stack_start = pmp->task->stack_start;
+-
+-					if (vma->vm_start <= stack_start &&
+-					    vma->vm_end >= stack_start) {
+-						pad_len_spaces(m, len);
+-						seq_printf(m,
+-						 "[threadstack:%08lx]",
+-#ifdef CONFIG_STACK_GROWSUP
+-						 vma->vm_end - stack_start
+-#else
+-						 stack_start - vma->vm_start
+-#endif
+-						);
+-					}
+ 				}
+ 			} else {
+ 				name = "[vdso]";
+diff --git a/include/asm-generic/dma-mapping-common.h b/include/asm-generic/dma-mapping-common.h
+index e694263..6920695 100644
+--- a/include/asm-generic/dma-mapping-common.h
++++ b/include/asm-generic/dma-mapping-common.h
+@@ -131,7 +131,7 @@ static inline void dma_sync_single_range_for_cpu(struct device *dev,
+ 		debug_dma_sync_single_range_for_cpu(dev, addr, offset, size, dir);
+ 
+ 	} else
+-		dma_sync_single_for_cpu(dev, addr, size, dir);
++		dma_sync_single_for_cpu(dev, addr + offset, size, dir);
+ }
+ 
+ static inline void dma_sync_single_range_for_device(struct device *dev,
+@@ -148,7 +148,7 @@ static inline void dma_sync_single_range_for_device(struct device *dev,
+ 		debug_dma_sync_single_range_for_device(dev, addr, offset, size, dir);
+ 
+ 	} else
+-		dma_sync_single_for_device(dev, addr, size, dir);
++		dma_sync_single_for_device(dev, addr + offset, size, dir);
+ }
+ 
+ static inline void
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 1f5fa53..db821a4 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1560,7 +1560,6 @@ struct task_struct {
+ 	/* bitmask of trace recursion */
+ 	unsigned long trace_recursion;
+ #endif /* CONFIG_TRACING */
+-	unsigned long stack_start;
+ #ifdef CONFIG_CGROUP_MEM_RES_CTLR /* memcg uses this to do batch job */
+ 	struct memcg_batch_info {
+ 		int do_batch;	/* incremented when batch uncharge started */
+diff --git a/kernel/fork.c b/kernel/fork.c
+index f88bd98..0ea67a3 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1134,8 +1134,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ 
+ 	p->bts = NULL;
+ 
+-	p->stack_start = stack_start;
+-
+ 	/* Perform scheduler related setup. Assign this task to a CPU. */
+ 	sched_fork(p, clone_flags);
+ 
+diff --git a/kernel/profile.c b/kernel/profile.c
+index a55d3a3..dfadc5b 100644
+--- a/kernel/profile.c
++++ b/kernel/profile.c
+@@ -127,8 +127,10 @@ int __ref profile_init(void)
+ 		return 0;
+ 
+ 	prof_buffer = vmalloc(buffer_bytes);
+-	if (prof_buffer)
++	if (prof_buffer) {
++		memset(prof_buffer, 0, buffer_bytes);
+ 		return 0;
++	}
+ 
+ 	free_cpumask_var(prof_cpu_mask);
+ 	return -ENOMEM;
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index fd9ba95..e8d9544 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1039,7 +1039,7 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma,
+ 		page = alloc_buddy_huge_page(h, vma, addr);
+ 		if (!page) {
+ 			hugetlb_put_quota(inode->i_mapping, chg);
+-			return ERR_PTR(-VM_FAULT_OOM);
++			return ERR_PTR(-VM_FAULT_SIGBUS);
+ 		}
+ 	}
+ 
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 16190ca..955f0b2 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1527,6 +1527,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ 
+ 	uh   = udp_hdr(skb);
+ 	ulen = ntohs(uh->len);
++	saddr = ip_hdr(skb)->saddr;
++	daddr = ip_hdr(skb)->daddr;
++
+ 	if (ulen > skb->len)
+ 		goto short_packet;
+ 
+@@ -1540,9 +1543,6 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ 	if (udp4_csum_init(skb, uh, proto))
+ 		goto csum_error;
+ 
+-	saddr = ip_hdr(skb)->saddr;
+-	daddr = ip_hdr(skb)->daddr;
+-
+ 	if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
+ 		return __udp4_lib_mcast_deliver(net, skb, uh,
+ 				saddr, daddr, udptable);
+diff --git a/security/min_addr.c b/security/min_addr.c
+index e86f297..f728728 100644
+--- a/security/min_addr.c
++++ b/security/min_addr.c
+@@ -33,7 +33,7 @@ int mmap_min_addr_handler(struct ctl_table *table, int write,
+ {
+ 	int ret;
+ 
+-	if (!capable(CAP_SYS_RAWIO))
++	if (write && !capable(CAP_SYS_RAWIO))
+ 		return -EPERM;
+ 
+ 	ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index fd831bd..a747871 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2718,6 +2718,7 @@ static struct pci_device_id azx_ids[] = {
+ 	{ PCI_DEVICE(0x8086, 0x3a6e), .driver_data = AZX_DRIVER_ICH },
+ 	/* PCH */
+ 	{ PCI_DEVICE(0x8086, 0x3b56), .driver_data = AZX_DRIVER_ICH },
++	{ PCI_DEVICE(0x8086, 0x3b57), .driver_data = AZX_DRIVER_ICH },
+ 	/* CPT */
+ 	{ PCI_DEVICE(0x8086, 0x1c20), .driver_data = AZX_DRIVER_PCH },
+ 	/* SCH */
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 1a97c81..a978645 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1176,9 +1176,10 @@ static int patch_cxt5045(struct hda_codec *codec)
+ 	case 0x103c:
+ 	case 0x1631:
+ 	case 0x1734:
+-		/* HP, Packard Bell, & Fujitsu-Siemens laptops have really bad
+-		 * sound over 0dB on NID 0x17. Fix max PCM level to 0 dB
+-		 * (originally it has 0x2b steps with 0dB offset 0x14)
++	case 0x17aa:
++		/* HP, Packard Bell, Fujitsu-Siemens & Lenovo laptops have
++		 * really bad sound over 0dB on NID 0x17. Fix max PCM level to
++		 * 0 dB (originally it has 0x2b steps with 0dB offset 0x14)
+ 		 */
+ 		snd_hda_override_amp_caps(codec, 0x17, HDA_INPUT,
+ 					  (0x14 << AC_AMPCAP_OFFSET_SHIFT) |
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index b486daa..abfc558 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -17348,7 +17348,6 @@ static struct snd_pci_quirk alc662_cfg_tbl[] = {
+ 					ALC662_3ST_6ch_DIG),
+ 	SND_PCI_QUIRK_MASK(0x1854, 0xf000, 0x2000, "ASUS H13-200x",
+ 			   ALC663_ASUS_H13),
+-	SND_PCI_QUIRK(0x8086, 0xd604, "Intel mobo", ALC662_3ST_2ch_DIG),
+ 	{}
+ };
+ 
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index ac2d528..cb474c0 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1539,11 +1539,9 @@ static unsigned int alienware_m17x_pin_configs[13] = {
+ 	0x904601b0,
+ };
+ 
+-static unsigned int intel_dg45id_pin_configs[14] = {
++static unsigned int intel_dg45id_pin_configs[13] = {
+ 	0x02214230, 0x02A19240, 0x01013214, 0x01014210,
+-	0x01A19250, 0x01011212, 0x01016211, 0x40f000f0,
+-	0x40f000f0, 0x40f000f0, 0x40f000f0, 0x014510A0,
+-	0x074510B0, 0x40f000f0
++	0x01A19250, 0x01011212, 0x01016211
+ };
+ 
+ static unsigned int *stac92hd73xx_brd_tbl[STAC_92HD73XX_MODELS] = {
+diff --git a/sound/pci/ice1712/maya44.c b/sound/pci/ice1712/maya44.c
+index 3e1c20a..726fd4b 100644
+--- a/sound/pci/ice1712/maya44.c
++++ b/sound/pci/ice1712/maya44.c
+@@ -347,7 +347,7 @@ static int maya_gpio_sw_put(struct snd_kcontrol *kcontrol,
+ 
+ /* known working input slots (0-4) */
+ #define MAYA_LINE_IN	1	/* in-2 */
+-#define MAYA_MIC_IN	4	/* in-5 */
++#define MAYA_MIC_IN	3	/* in-4 */
+ 
+ static void wm8776_select_input(struct snd_maya44 *chip, int idx, int line)
+ {
+@@ -393,8 +393,8 @@ static int maya_rec_src_put(struct snd_kcontrol *kcontrol,
+ 	int changed;
+ 
+ 	mutex_lock(&chip->mutex);
+-	changed = maya_set_gpio_bits(chip->ice, GPIO_MIC_RELAY,
+-				     sel ? GPIO_MIC_RELAY : 0);
++	changed = maya_set_gpio_bits(chip->ice, 1 << GPIO_MIC_RELAY,
++				     sel ? (1 << GPIO_MIC_RELAY) : 0);
+ 	wm8776_select_input(chip, 0, sel ? MAYA_MIC_IN : MAYA_LINE_IN);
+ 	mutex_unlock(&chip->mutex);
+ 	return changed;
+diff --git a/sound/pci/oxygen/xonar_cs43xx.c b/sound/pci/oxygen/xonar_cs43xx.c
+index 16c226b..7c4986b 100644
+--- a/sound/pci/oxygen/xonar_cs43xx.c
++++ b/sound/pci/oxygen/xonar_cs43xx.c
+@@ -56,6 +56,7 @@
+ #include <sound/pcm_params.h>
+ #include <sound/tlv.h>
+ #include "xonar.h"
++#include "cm9780.h"
+ #include "cs4398.h"
+ #include "cs4362a.h"
+ 
+@@ -172,6 +173,8 @@ static void xonar_d1_init(struct oxygen *chip)
+ 	oxygen_clear_bits16(chip, OXYGEN_GPIO_DATA,
+ 			    GPIO_D1_FRONT_PANEL | GPIO_D1_INPUT_ROUTE);
+ 
++	oxygen_ac97_set_bits(chip, 0, CM9780_JACK, CM9780_FMIC2MIC);
++
+ 	xonar_init_cs53x1(chip);
+ 	xonar_enable_output(chip);
+ 

Added: genpatches-2.6/trunk/2.6.33/1005_linux-2.6.33.6.patch
===================================================================
--- genpatches-2.6/trunk/2.6.33/1005_linux-2.6.33.6.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.33/1005_linux-2.6.33.6.patch	2010-07-05 23:09:19 UTC (rev 1721)
@@ -0,0 +1,5360 @@
+diff --git a/Documentation/hwmon/ltc4245 b/Documentation/hwmon/ltc4245
+index 02838a4..86b5880 100644
+--- a/Documentation/hwmon/ltc4245
++++ b/Documentation/hwmon/ltc4245
+@@ -72,9 +72,7 @@ in6_min_alarm		5v  output undervoltage alarm
+ in7_min_alarm		3v  output undervoltage alarm
+ in8_min_alarm		Vee (-12v) output undervoltage alarm
+ 
+-in9_input		GPIO #1 voltage data
+-in10_input		GPIO #2 voltage data
+-in11_input		GPIO #3 voltage data
++in9_input		GPIO voltage data
+ 
+ power1_input		12v power usage (mW)
+ power2_input		5v  power usage (mW)
+diff --git a/arch/arm/common/sa1111.c b/arch/arm/common/sa1111.c
+index 8ba7044..b07bfee 100644
+--- a/arch/arm/common/sa1111.c
++++ b/arch/arm/common/sa1111.c
+@@ -887,8 +887,6 @@ static int sa1111_resume(struct platform_device *dev)
+ 	if (!save)
+ 		return 0;
+ 
+-	spin_lock_irqsave(&sachip->lock, flags);
+-
+ 	/*
+ 	 * Ensure that the SA1111 is still here.
+ 	 * FIXME: shouldn't do this here.
+@@ -905,6 +903,13 @@ static int sa1111_resume(struct platform_device *dev)
+ 	 * First of all, wake up the chip.
+ 	 */
+ 	sa1111_wake(sachip);
++
++	/*
++	 * Only lock for write ops. Also, sa1111_wake must be called with
++	 * released spinlock!
++	 */
++	spin_lock_irqsave(&sachip->lock, flags);
++
+ 	sa1111_writel(0, sachip->base + SA1111_INTC + SA1111_INTEN0);
+ 	sa1111_writel(0, sachip->base + SA1111_INTC + SA1111_INTEN1);
+ 
+diff --git a/arch/arm/mm/copypage-feroceon.c b/arch/arm/mm/copypage-feroceon.c
+index 70997d5..dd9598b 100644
+--- a/arch/arm/mm/copypage-feroceon.c
++++ b/arch/arm/mm/copypage-feroceon.c
+@@ -18,7 +18,7 @@ feroceon_copy_user_page(void *kto, const void *kfrom)
+ {
+ 	asm("\
+ 	stmfd	sp!, {r4-r9, lr}		\n\
+-	mov	ip, %0				\n\
++	mov	ip, %2				\n\
+ 1:	mov	lr, r1				\n\
+ 	ldmia	r1!, {r2 - r9}			\n\
+ 	pld	[lr, #32]			\n\
+@@ -64,7 +64,7 @@ feroceon_copy_user_page(void *kto, const void *kfrom)
+ 	mcr	p15, 0, ip, c7, c10, 4		@ drain WB\n\
+ 	ldmfd	sp!, {r4-r9, pc}"
+ 	:
+-	: "I" (PAGE_SIZE));
++	: "r" (kto), "r" (kfrom), "I" (PAGE_SIZE));
+ }
+ 
+ void feroceon_copy_user_highpage(struct page *to, struct page *from,
+diff --git a/arch/arm/mm/copypage-v4wb.c b/arch/arm/mm/copypage-v4wb.c
+index 9ab0984..7bc0ac7 100644
+--- a/arch/arm/mm/copypage-v4wb.c
++++ b/arch/arm/mm/copypage-v4wb.c
+@@ -27,7 +27,7 @@ v4wb_copy_user_page(void *kto, const void *kfrom)
+ {
+ 	asm("\
+ 	stmfd	sp!, {r4, lr}			@ 2\n\
+-	mov	r2, %0				@ 1\n\
++	mov	r2, %2				@ 1\n\
+ 	ldmia	r1!, {r3, r4, ip, lr}		@ 4\n\
+ 1:	mcr	p15, 0, r0, c7, c6, 1		@ 1   invalidate D line\n\
+ 	stmia	r0!, {r3, r4, ip, lr}		@ 4\n\
+@@ -44,7 +44,7 @@ v4wb_copy_user_page(void *kto, const void *kfrom)
+ 	mcr	p15, 0, r1, c7, c10, 4		@ 1   drain WB\n\
+ 	ldmfd	 sp!, {r4, pc}			@ 3"
+ 	:
+-	: "I" (PAGE_SIZE / 64));
++	: "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64));
+ }
+ 
+ void v4wb_copy_user_highpage(struct page *to, struct page *from,
+diff --git a/arch/arm/mm/copypage-v4wt.c b/arch/arm/mm/copypage-v4wt.c
+index 300efaf..35bf609 100644
+--- a/arch/arm/mm/copypage-v4wt.c
++++ b/arch/arm/mm/copypage-v4wt.c
+@@ -25,7 +25,7 @@ v4wt_copy_user_page(void *kto, const void *kfrom)
+ {
+ 	asm("\
+ 	stmfd	sp!, {r4, lr}			@ 2\n\
+-	mov	r2, %0				@ 1\n\
++	mov	r2, %2				@ 1\n\
+ 	ldmia	r1!, {r3, r4, ip, lr}		@ 4\n\
+ 1:	stmia	r0!, {r3, r4, ip, lr}		@ 4\n\
+ 	ldmia	r1!, {r3, r4, ip, lr}		@ 4+1\n\
+@@ -40,7 +40,7 @@ v4wt_copy_user_page(void *kto, const void *kfrom)
+ 	mcr	p15, 0, r2, c7, c7, 0		@ flush ID cache\n\
+ 	ldmfd	sp!, {r4, pc}			@ 3"
+ 	:
+-	: "I" (PAGE_SIZE / 64));
++	: "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64));
+ }
+ 
+ void v4wt_copy_user_highpage(struct page *to, struct page *from,
+diff --git a/arch/arm/mm/copypage-xsc3.c b/arch/arm/mm/copypage-xsc3.c
+index bc4525f..27dc363 100644
+--- a/arch/arm/mm/copypage-xsc3.c
++++ b/arch/arm/mm/copypage-xsc3.c
+@@ -34,7 +34,7 @@ xsc3_mc_copy_user_page(void *kto, const void *kfrom)
+ {
+ 	asm("\
+ 	stmfd	sp!, {r4, r5, lr}		\n\
+-	mov	lr, %0				\n\
++	mov	lr, %2				\n\
+ 						\n\
+ 	pld	[r1, #0]			\n\
+ 	pld	[r1, #32]			\n\
+@@ -67,7 +67,7 @@ xsc3_mc_copy_user_page(void *kto, const void *kfrom)
+ 						\n\
+ 	ldmfd	sp!, {r4, r5, pc}"
+ 	:
+-	: "I" (PAGE_SIZE / 64 - 1));
++	: "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64 - 1));
+ }
+ 
+ void xsc3_mc_copy_user_highpage(struct page *to, struct page *from,
+diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
+index 10e0680..3191cd6 100644
+--- a/arch/arm/mm/fault.c
++++ b/arch/arm/mm/fault.c
+@@ -386,6 +386,9 @@ do_translation_fault(unsigned long addr, unsigned int fsr,
+ 	if (addr < TASK_SIZE)
+ 		return do_page_fault(addr, fsr, regs);
+ 
++	if (user_mode(regs))
++		goto bad_area;
++
+ 	index = pgd_index(addr);
+ 
+ 	/*
+diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
+index a04ffbb..3cbdd5c 100644
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -632,10 +632,10 @@ void __init mem_init(void)
+ void free_initmem(void)
+ {
+ #ifdef CONFIG_HAVE_TCM
+-	extern char *__tcm_start, *__tcm_end;
++	extern char __tcm_start, __tcm_end;
+ 
+-	totalram_pages += free_area(__phys_to_pfn(__pa(__tcm_start)),
+-				    __phys_to_pfn(__pa(__tcm_end)),
++	totalram_pages += free_area(__phys_to_pfn(__pa(&__tcm_start)),
++				    __phys_to_pfn(__pa(&__tcm_end)),
+ 				    "TCM link");
+ #endif
+ 
+diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
+index 66dc2d0..d66cead 100644
+--- a/arch/arm/vfp/vfphw.S
++++ b/arch/arm/vfp/vfphw.S
+@@ -277,7 +277,7 @@ ENTRY(vfp_put_double)
+ #ifdef CONFIG_VFPv3
+ 	@ d16 - d31 registers
+ 	.irp	dr,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
+-1:	mcrr	p11, 3, r1, r2, c\dr	@ fmdrr	r1, r2, d\dr
++1:	mcrr	p11, 3, r0, r1, c\dr	@ fmdrr	r0, r1, d\dr
+ 	mov	pc, lr
+ 	.org	1b + 8
+ 	.endr
+diff --git a/arch/blackfin/include/asm/cache.h b/arch/blackfin/include/asm/cache.h
+index 8542bc3..93f6c63 100644
+--- a/arch/blackfin/include/asm/cache.h
++++ b/arch/blackfin/include/asm/cache.h
+@@ -15,6 +15,8 @@
+ #define L1_CACHE_BYTES	(1 << L1_CACHE_SHIFT)
+ #define SMP_CACHE_BYTES	L1_CACHE_BYTES
+ 
++#define ARCH_KMALLOC_MINALIGN	L1_CACHE_BYTES
++
+ #ifdef CONFIG_SMP
+ #define __cacheline_aligned
+ #else
+diff --git a/arch/frv/include/asm/cache.h b/arch/frv/include/asm/cache.h
+index 2797163..7dc0f0f 100644
+--- a/arch/frv/include/asm/cache.h
++++ b/arch/frv/include/asm/cache.h
+@@ -17,6 +17,8 @@
+ #define L1_CACHE_SHIFT		(CONFIG_FRV_L1_CACHE_SHIFT)
+ #define L1_CACHE_BYTES		(1 << L1_CACHE_SHIFT)
+ 
++#define ARCH_KMALLOC_MINALIGN	L1_CACHE_BYTES
++
+ #define __cacheline_aligned	__attribute__((aligned(L1_CACHE_BYTES)))
+ #define ____cacheline_aligned	__attribute__((aligned(L1_CACHE_BYTES)))
+ 
+diff --git a/arch/m68k/include/asm/cache.h b/arch/m68k/include/asm/cache.h
+index fed3fd3..ecafbe1 100644
+--- a/arch/m68k/include/asm/cache.h
++++ b/arch/m68k/include/asm/cache.h
+@@ -8,4 +8,6 @@
+ #define        L1_CACHE_SHIFT  4
+ #define        L1_CACHE_BYTES  (1<< L1_CACHE_SHIFT)
+ 
++#define ARCH_KMALLOC_MINALIGN	L1_CACHE_BYTES
++
+ #endif
+diff --git a/arch/mn10300/include/asm/cache.h b/arch/mn10300/include/asm/cache.h
+index e03cfa2..6e2fe28 100644
+--- a/arch/mn10300/include/asm/cache.h
++++ b/arch/mn10300/include/asm/cache.h
+@@ -21,6 +21,8 @@
+ #define L1_CACHE_DISPARITY	L1_CACHE_NENTRIES * L1_CACHE_BYTES
+ #endif
+ 
++#define ARCH_KMALLOC_MINALIGN	L1_CACHE_BYTES
++
+ /* data cache purge registers
+  * - read from the register to unconditionally purge that cache line
+  * - write address & 0xffffff00 to conditionally purge that cache line
+diff --git a/arch/parisc/math-emu/decode_exc.c b/arch/parisc/math-emu/decode_exc.c
+index 3ca1c61..27a7492 100644
+--- a/arch/parisc/math-emu/decode_exc.c
++++ b/arch/parisc/math-emu/decode_exc.c
+@@ -342,6 +342,7 @@ decode_fpu(unsigned int Fpu_register[], unsigned int trap_counts[])
+ 		return SIGNALCODE(SIGFPE, FPE_FLTINV);
+ 	  case DIVISIONBYZEROEXCEPTION:
+ 		update_trap_counts(Fpu_register, aflags, bflags, trap_counts);
++		Clear_excp_register(exception_index);
+ 	  	return SIGNALCODE(SIGFPE, FPE_FLTDIV);
+ 	  case INEXACTEXCEPTION:
+ 		update_trap_counts(Fpu_register, aflags, bflags, trap_counts);
+diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c
+index e6dc595..0ca0b99 100644
+--- a/arch/powerpc/kvm/book3s.c
++++ b/arch/powerpc/kvm/book3s.c
+@@ -766,6 +766,8 @@ int kvm_arch_vcpu_ioctl_get_sregs(struct kvm_vcpu *vcpu,
+ 	struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu);
+ 	int i;
+ 
++	vcpu_load(vcpu);
++
+ 	sregs->pvr = vcpu->arch.pvr;
+ 
+ 	sregs->u.s.sdr1 = to_book3s(vcpu)->sdr1;
+@@ -784,6 +786,9 @@ int kvm_arch_vcpu_ioctl_get_sregs(struct kvm_vcpu *vcpu,
+ 			sregs->u.s.ppc32.dbat[i] = vcpu3s->dbat[i].raw;
+ 		}
+ 	}
++
++	vcpu_put(vcpu);
++
+ 	return 0;
+ }
+ 
+@@ -793,6 +798,8 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
+ 	struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu);
+ 	int i;
+ 
++	vcpu_load(vcpu);
++
+ 	kvmppc_set_pvr(vcpu, sregs->pvr);
+ 
+ 	vcpu3s->sdr1 = sregs->u.s.sdr1;
+@@ -819,6 +826,9 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
+ 
+ 	/* Flush the MMU after messing with the segments */
+ 	kvmppc_mmu_pte_flush(vcpu, 0, 0);
++
++	vcpu_put(vcpu);
++
+ 	return 0;
+ }
+ 
+diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c
+index 06f5a9e..0a5263e 100644
+--- a/arch/powerpc/kvm/booke.c
++++ b/arch/powerpc/kvm/booke.c
+@@ -443,6 +443,8 @@ int kvm_arch_vcpu_ioctl_get_regs(struct kvm_vcpu *vcpu, struct kvm_regs *regs)
+ {
+ 	int i;
+ 
++	vcpu_load(vcpu);
++
+ 	regs->pc = vcpu->arch.pc;
+ 	regs->cr = vcpu->arch.cr;
+ 	regs->ctr = vcpu->arch.ctr;
+@@ -463,6 +465,8 @@ int kvm_arch_vcpu_ioctl_get_regs(struct kvm_vcpu *vcpu, struct kvm_regs *regs)
+ 	for (i = 0; i < ARRAY_SIZE(regs->gpr); i++)
+ 		regs->gpr[i] = vcpu->arch.gpr[i];
+ 
++	vcpu_put(vcpu);
++
+ 	return 0;
+ }
+ 
+@@ -470,6 +474,8 @@ int kvm_arch_vcpu_ioctl_set_regs(struct kvm_vcpu *vcpu, struct kvm_regs *regs)
+ {
+ 	int i;
+ 
++	vcpu_load(vcpu);
++
+ 	vcpu->arch.pc = regs->pc;
+ 	vcpu->arch.cr = regs->cr;
+ 	vcpu->arch.ctr = regs->ctr;
+@@ -489,6 +495,8 @@ int kvm_arch_vcpu_ioctl_set_regs(struct kvm_vcpu *vcpu, struct kvm_regs *regs)
+ 	for (i = 0; i < ARRAY_SIZE(vcpu->arch.gpr); i++)
+ 		vcpu->arch.gpr[i] = regs->gpr[i];
+ 
++	vcpu_put(vcpu);
++
+ 	return 0;
+ }
+ 
+@@ -517,7 +525,12 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
+ int kvm_arch_vcpu_ioctl_translate(struct kvm_vcpu *vcpu,
+                                   struct kvm_translation *tr)
+ {
+-	return kvmppc_core_vcpu_translate(vcpu, tr);
++	int r;
++
++	vcpu_load(vcpu);
++	r = kvmppc_core_vcpu_translate(vcpu, tr);
++	vcpu_put(vcpu);
++	return r;
+ }
+ 
+ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm, struct kvm_dirty_log *log)
+diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
+index f06cf93..82098ae 100644
+--- a/arch/powerpc/kvm/powerpc.c
++++ b/arch/powerpc/kvm/powerpc.c
+@@ -181,7 +181,8 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id)
+ {
+ 	struct kvm_vcpu *vcpu;
+ 	vcpu = kvmppc_core_vcpu_create(kvm, id);
+-	kvmppc_create_vcpu_debugfs(vcpu, id);
++	if (!IS_ERR(vcpu))
++		kvmppc_create_vcpu_debugfs(vcpu, id);
+ 	return vcpu;
+ }
+ 
+diff --git a/arch/powerpc/lib/string.S b/arch/powerpc/lib/string.S
+index 64e2e49..3ac0cd3 100644
+--- a/arch/powerpc/lib/string.S
++++ b/arch/powerpc/lib/string.S
+@@ -71,7 +71,7 @@ _GLOBAL(strcmp)
+ 
+ _GLOBAL(strncmp)
+ 	PPC_LCMPI r5,0
+-	beqlr
++	ble-	2f
+ 	mtctr	r5
+ 	addi	r5,r3,-1
+ 	addi	r4,r4,-1
+@@ -82,6 +82,8 @@ _GLOBAL(strncmp)
+ 	beqlr	1
+ 	bdnzt	eq,1b
+ 	blr
++2:	li	r3,0
++	blr
+ 
+ _GLOBAL(strlen)
+ 	addi	r4,r3,-1
+diff --git a/arch/powerpc/oprofile/op_model_cell.c b/arch/powerpc/oprofile/op_model_cell.c
+index 2c9e522..7fd90d0 100644
+--- a/arch/powerpc/oprofile/op_model_cell.c
++++ b/arch/powerpc/oprofile/op_model_cell.c
+@@ -1077,7 +1077,7 @@ static int calculate_lfsr(int n)
+ 		index = ENTRIES-1;
+ 
+ 	/* make sure index is valid */
+-	if ((index > ENTRIES) || (index < 0))
++	if ((index >= ENTRIES) || (index < 0))
+ 		index = ENTRIES-1;
+ 
+ 	return initial_lfsr[index];
+diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+index b842378..da684a7 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -154,30 +154,6 @@ static void pseries_mach_cpu_die(void)
+ 	for(;;);
+ }
+ 
+-static int qcss_tok;	/* query-cpu-stopped-state token */
+-
+-/* Get state of physical CPU.
+- * Return codes:
+- *	0	- The processor is in the RTAS stopped state
+- *	1	- stop-self is in progress
+- *	2	- The processor is not in the RTAS stopped state
+- *	-1	- Hardware Error
+- *	-2	- Hardware Busy, Try again later.
+- */
+-static int query_cpu_stopped(unsigned int pcpu)
+-{
+-	int cpu_status, status;
+-
+-	status = rtas_call(qcss_tok, 1, 2, &cpu_status, pcpu);
+-	if (status != 0) {
+-		printk(KERN_ERR
+-		       "RTAS query-cpu-stopped-state failed: %i\n", status);
+-		return status;
+-	}
+-
+-	return cpu_status;
+-}
+-
+ static int pseries_cpu_disable(void)
+ {
+ 	int cpu = smp_processor_id();
+@@ -224,8 +200,9 @@ static void pseries_cpu_die(unsigned int cpu)
+ 	} else if (get_preferred_offline_state(cpu) == CPU_STATE_OFFLINE) {
+ 
+ 		for (tries = 0; tries < 25; tries++) {
+-			cpu_status = query_cpu_stopped(pcpu);
+-			if (cpu_status == 0 || cpu_status == -1)
++			cpu_status = smp_query_cpu_stopped(pcpu);
++			if (cpu_status == QCSS_STOPPED ||
++			    cpu_status == QCSS_HARDWARE_ERROR)
+ 				break;
+ 			cpu_relax();
+ 		}
+@@ -400,6 +377,7 @@ static int __init pseries_cpu_hotplug_init(void)
+ 	struct device_node *np;
+ 	const char *typep;
+ 	int cpu;
++	int qcss_tok;
+ 
+ 	for_each_node_by_name(np, "interrupt-controller") {
+ 		typep = of_get_property(np, "compatible", NULL);
+diff --git a/arch/powerpc/platforms/pseries/plpar_wrappers.h b/arch/powerpc/platforms/pseries/plpar_wrappers.h
+index 0603c91..e724ef8 100644
+--- a/arch/powerpc/platforms/pseries/plpar_wrappers.h
++++ b/arch/powerpc/platforms/pseries/plpar_wrappers.h
+@@ -4,6 +4,14 @@
+ #include <asm/hvcall.h>
+ #include <asm/page.h>
+ 
++/* Get state of physical CPU from query_cpu_stopped */
++int smp_query_cpu_stopped(unsigned int pcpu);
++#define QCSS_STOPPED 0
++#define QCSS_STOPPING 1
++#define QCSS_NOT_STOPPED 2
++#define QCSS_HARDWARE_ERROR -1
++#define QCSS_HARDWARE_BUSY -2
++
+ static inline long poll_pending(void)
+ {
+ 	return plpar_hcall_norets(H_POLL_PENDING);
+diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c
+index b488663..5530b4b 100644
+--- a/arch/powerpc/platforms/pseries/smp.c
++++ b/arch/powerpc/platforms/pseries/smp.c
+@@ -57,6 +57,28 @@
+  */
+ static cpumask_t of_spin_map;
+ 
++/* Query where a cpu is now.  Return codes #defined in plpar_wrappers.h */
++int smp_query_cpu_stopped(unsigned int pcpu)
++{
++	int cpu_status, status;
++	int qcss_tok = rtas_token("query-cpu-stopped-state");
++
++	if (qcss_tok == RTAS_UNKNOWN_SERVICE) {
++		printk(KERN_INFO "Firmware doesn't support "
++				"query-cpu-stopped-state\n");
++		return QCSS_HARDWARE_ERROR;
++	}
++
++	status = rtas_call(qcss_tok, 1, 2, &cpu_status, pcpu);
++	if (status != 0) {
++		printk(KERN_ERR
++		       "RTAS query-cpu-stopped-state failed: %i\n", status);
++		return status;
++	}
++
++	return cpu_status;
++}
++
+ /**
+  * smp_startup_cpu() - start the given cpu
+  *
+@@ -82,6 +104,12 @@ static inline int __devinit smp_startup_cpu(unsigned int lcpu)
+ 
+ 	pcpu = get_hard_smp_processor_id(lcpu);
+ 
++	/* Check to see if the CPU out of FW already for kexec */
++	if (smp_query_cpu_stopped(pcpu) == QCSS_NOT_STOPPED){
++		cpu_set(lcpu, of_spin_map);
++		return 1;
++	}
++
+ 	/* Fixup atomic count: it exited inside IRQ handler. */
+ 	task_thread_info(paca[lcpu].__current)->preempt_count	= 0;
+ 
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index f8bcaef..e06d18c 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -339,11 +339,13 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
+ 
+ 	rc = kvm_vcpu_init(vcpu, kvm, id);
+ 	if (rc)
+-		goto out_free_cpu;
++		goto out_free_sie_block;
+ 	VM_EVENT(kvm, 3, "create cpu %d at %p, sie block at %p", id, vcpu,
+ 		 vcpu->arch.sie_block);
+ 
+ 	return vcpu;
++out_free_sie_block:
++	free_page((unsigned long)(vcpu->arch.sie_block));
+ out_free_cpu:
+ 	kfree(vcpu);
+ out_nomem:
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 4f865e8..e62b4b9 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -193,6 +193,7 @@ union kvm_mmu_page_role {
+ 		unsigned invalid:1;
+ 		unsigned cr4_pge:1;
+ 		unsigned nxe:1;
++		unsigned cr0_wp:1;
+ 	};
+ };
+ 
+@@ -533,6 +534,8 @@ struct kvm_x86_ops {
+ 	u64 (*get_mt_mask)(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio);
+ 	bool (*gb_page_enable)(void);
+ 
++	void (*set_supported_cpuid)(u32 func, struct kvm_cpuid_entry2 *entry);
++
+ 	const struct trace_print_flags *exit_reasons_str;
+ };
+ 
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 4604e6a..d86da72 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -199,8 +199,9 @@
+ #define MSR_IA32_EBL_CR_POWERON		0x0000002a
+ #define MSR_IA32_FEATURE_CONTROL        0x0000003a
+ 
+-#define FEATURE_CONTROL_LOCKED		(1<<0)
+-#define FEATURE_CONTROL_VMXON_ENABLED	(1<<2)
++#define FEATURE_CONTROL_LOCKED				(1<<0)
++#define FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX	(1<<1)
++#define FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX	(1<<2)
+ 
+ #define MSR_IA32_APICBASE		0x0000001b
+ #define MSR_IA32_APICBASE_BSP		(1<<8)
+diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
+index 2e77516..ca15b93 100644
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -1419,6 +1419,7 @@ static int __attach_device(struct device *dev,
+ 			   struct protection_domain *domain)
+ {
+ 	struct iommu_dev_data *dev_data, *alias_data;
++	int ret;
+ 
+ 	dev_data   = get_dev_data(dev);
+ 	alias_data = get_dev_data(dev_data->alias);
+@@ -1430,13 +1431,14 @@ static int __attach_device(struct device *dev,
+ 	spin_lock(&domain->lock);
+ 
+ 	/* Some sanity checks */
++	ret = -EBUSY;
+ 	if (alias_data->domain != NULL &&
+ 	    alias_data->domain != domain)
+-		return -EBUSY;
++		goto out_unlock;
+ 
+ 	if (dev_data->domain != NULL &&
+ 	    dev_data->domain != domain)
+-		return -EBUSY;
++		goto out_unlock;
+ 
+ 	/* Do real assignment */
+ 	if (dev_data->alias != dev) {
+@@ -1452,10 +1454,14 @@ static int __attach_device(struct device *dev,
+ 
+ 	atomic_inc(&dev_data->bind);
+ 
++	ret = 0;
++
++out_unlock:
++
+ 	/* ready */
+ 	spin_unlock(&domain->lock);
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ /*
+@@ -2256,10 +2262,6 @@ int __init amd_iommu_init_dma_ops(void)
+ 
+ 	iommu_detected = 1;
+ 	swiotlb = 0;
+-#ifdef CONFIG_GART_IOMMU
+-	gart_iommu_aperture_disabled = 1;
+-	gart_iommu_aperture = 0;
+-#endif
+ 
+ 	/* Make the driver finally visible to the drivers */
+ 	dma_ops = &amd_iommu_dma_ops;
+diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c
+index 883d619..86a5a11 100644
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -286,8 +286,12 @@ static u8 * __init iommu_map_mmio_space(u64 address)
+ {
+ 	u8 *ret;
+ 
+-	if (!request_mem_region(address, MMIO_REGION_LENGTH, "amd_iommu"))
++	if (!request_mem_region(address, MMIO_REGION_LENGTH, "amd_iommu")) {
++		pr_err("AMD-Vi: Can not reserve memory region %llx for mmio\n",
++			address);
++		pr_err("AMD-Vi: This is a BIOS bug. Please contact your hardware vendor\n");
+ 		return NULL;
++	}
+ 
+ 	ret = ioremap_nocache(address, MMIO_REGION_LENGTH);
+ 	if (ret != NULL)
+@@ -1296,7 +1300,7 @@ static int __init amd_iommu_init(void)
+ 		ret = amd_iommu_init_dma_ops();
+ 
+ 	if (ret)
+-		goto free;
++		goto free_disable;
+ 
+ 	amd_iommu_init_api();
+ 
+@@ -1314,9 +1318,10 @@ static int __init amd_iommu_init(void)
+ out:
+ 	return ret;
+ 
+-free:
++free_disable:
+ 	disable_iommus();
+ 
++free:
+ 	amd_iommu_uninit_devices();
+ 
+ 	free_pages((unsigned long)amd_iommu_pd_alloc_bitmap,
+@@ -1335,6 +1340,15 @@ free:
+ 
+ 	free_unity_maps();
+ 
++#ifdef CONFIG_GART_IOMMU
++	/*
++	 * We failed to initialize the AMD IOMMU - try fallback to GART
++	 * if possible.
++	 */
++	gart_iommu_init();
++
++#endif
++
+ 	goto out;
+ }
+ 
+diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
+index c7ca8e2..16307ff 100644
+--- a/arch/x86/kernel/cpu/perf_event.c
++++ b/arch/x86/kernel/cpu/perf_event.c
+@@ -1060,8 +1060,11 @@ static int __hw_perf_event_init(struct perf_event *event)
+ 		if (atomic_read(&active_events) == 0) {
+ 			if (!reserve_pmc_hardware())
+ 				err = -EBUSY;
+-			else
++			else {
+ 				err = reserve_bts_hardware();
++				if (err)
++					release_pmc_hardware();
++			}
+ 		}
+ 		if (!err)
+ 			atomic_inc(&active_events);
+diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
+index 03801f2..dfdfe46 100644
+--- a/arch/x86/kernel/pvclock.c
++++ b/arch/x86/kernel/pvclock.c
+@@ -109,11 +109,14 @@ unsigned long pvclock_tsc_khz(struct pvclock_vcpu_time_info *src)
+ 	return pv_tsc_khz;
+ }
+ 
++static atomic64_t last_value = ATOMIC64_INIT(0);
++
+ cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
+ {
+ 	struct pvclock_shadow_time shadow;
+ 	unsigned version;
+ 	cycle_t ret, offset;
++	u64 last;
+ 
+ 	do {
+ 		version = pvclock_get_time_values(&shadow, src);
+@@ -123,6 +126,27 @@ cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
+ 		barrier();
+ 	} while (version != src->version);
+ 
++	/*
++	 * Assumption here is that last_value, a global accumulator, always goes
++	 * forward. If we are less than that, we should not be much smaller.
++	 * We assume there is an error marging we're inside, and then the correction
++	 * does not sacrifice accuracy.
++	 *
++	 * For reads: global may have changed between test and return,
++	 * but this means someone else updated poked the clock at a later time.
++	 * We just need to make sure we are not seeing a backwards event.
++	 *
++	 * For updates: last_value = ret is not enough, since two vcpus could be
++	 * updating at the same time, and one of them could be slightly behind,
++	 * making the assumption that last_value always go forward fail to hold.
++	 */
++	last = atomic64_read(&last_value);
++	do {
++		if (ret < last)
++			return last;
++		last = atomic64_cmpxchg(&last_value, last, ret);
++	} while (unlikely(last != ret));
++
+ 	return ret;
+ }
+ 
+diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
+index 5d9e40c..4772a9f 100644
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -663,6 +663,17 @@ static struct dmi_system_id __initdata bad_bios_dmi_table[] = {
+ 			DMI_MATCH(DMI_BOARD_NAME, "DG45FC"),
+ 		},
+ 	},
++	/*
++	 * The Dell Inspiron Mini 1012 has DMI_BIOS_VENDOR = "Dell Inc.", so
++	 * match on the product name.
++	 */
++	{
++		.callback = dmi_low_memory_corruption,
++		.ident = "Phoenix BIOS",
++		.matches = {
++			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1012"),
++		},
++	},
+ #endif
+ 	{}
+ };
+diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
+index 86c9f91..46b8277 100644
+--- a/arch/x86/kernel/tboot.c
++++ b/arch/x86/kernel/tboot.c
+@@ -46,6 +46,7 @@
+ 
+ /* Global pointer to shared data; NULL means no measured launch. */
+ struct tboot *tboot __read_mostly;
++EXPORT_SYMBOL(tboot);
+ 
+ /* timeout for APs (in secs) to enter wait-for-SIPI state during shutdown */
+ #define AP_WAIT_TIMEOUT		1
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 28c3d81..8822021 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -227,7 +227,7 @@ void kvm_mmu_set_mask_ptes(u64 user_mask, u64 accessed_mask,
+ }
+ EXPORT_SYMBOL_GPL(kvm_mmu_set_mask_ptes);
+ 
+-static int is_write_protection(struct kvm_vcpu *vcpu)
++static bool is_write_protection(struct kvm_vcpu *vcpu)
+ {
+ 	return vcpu->arch.cr0 & X86_CR0_WP;
+ }
+@@ -2097,11 +2097,14 @@ static int mmu_alloc_roots(struct kvm_vcpu *vcpu)
+ 			direct = 1;
+ 		if (mmu_check_root(vcpu, root_gfn))
+ 			return 1;
++
++		spin_lock(&vcpu->kvm->mmu_lock);
+ 		sp = kvm_mmu_get_page(vcpu, root_gfn, 0,
+ 				      PT64_ROOT_LEVEL, direct,
+ 				      ACC_ALL, NULL);
+ 		root = __pa(sp->spt);
+ 		++sp->root_count;
++		spin_unlock(&vcpu->kvm->mmu_lock);
+ 		vcpu->arch.mmu.root_hpa = root;
+ 		return 0;
+ 	}
+@@ -2123,11 +2126,15 @@ static int mmu_alloc_roots(struct kvm_vcpu *vcpu)
+ 			root_gfn = 0;
+ 		if (mmu_check_root(vcpu, root_gfn))
+ 			return 1;
++
++		spin_lock(&vcpu->kvm->mmu_lock);
+ 		sp = kvm_mmu_get_page(vcpu, root_gfn, i << 30,
+ 				      PT32_ROOT_LEVEL, direct,
+ 				      ACC_ALL, NULL);
+ 		root = __pa(sp->spt);
+ 		++sp->root_count;
++		spin_unlock(&vcpu->kvm->mmu_lock);
++
+ 		vcpu->arch.mmu.pae_root[i] = root | PT_PRESENT_MASK;
+ 	}
+ 	vcpu->arch.mmu.root_hpa = __pa(vcpu->arch.mmu.pae_root);
+@@ -2448,6 +2455,7 @@ static int init_kvm_softmmu(struct kvm_vcpu *vcpu)
+ 		r = paging32_init_context(vcpu);
+ 
+ 	vcpu->arch.mmu.base_role.glevels = vcpu->arch.mmu.root_level;
++	vcpu->arch.mmu.base_role.cr0_wp = is_write_protection(vcpu);
+ 
+ 	return r;
+ }
+@@ -2487,7 +2495,9 @@ int kvm_mmu_load(struct kvm_vcpu *vcpu)
+ 		goto out;
+ 	spin_lock(&vcpu->kvm->mmu_lock);
+ 	kvm_mmu_free_some_pages(vcpu);
++	spin_unlock(&vcpu->kvm->mmu_lock);
+ 	r = mmu_alloc_roots(vcpu);
++	spin_lock(&vcpu->kvm->mmu_lock);
+ 	mmu_sync_roots(vcpu);
+ 	spin_unlock(&vcpu->kvm->mmu_lock);
+ 	if (r)
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index d42e191..a2f839c 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -128,6 +128,7 @@ static void svm_flush_tlb(struct kvm_vcpu *vcpu);
+ static void svm_complete_interrupts(struct vcpu_svm *svm);
+ 
+ static int nested_svm_exit_handled(struct vcpu_svm *svm);
++static int nested_svm_intercept(struct vcpu_svm *svm);
+ static int nested_svm_vmexit(struct vcpu_svm *svm);
+ static int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr,
+ 				      bool has_error_code, u32 error_code);
+@@ -1359,6 +1360,8 @@ static int nested_svm_check_permissions(struct vcpu_svm *svm)
+ static int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr,
+ 				      bool has_error_code, u32 error_code)
+ {
++	int vmexit;
++
+ 	if (!is_nested(svm))
+ 		return 0;
+ 
+@@ -1367,19 +1370,24 @@ static int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr,
+ 	svm->vmcb->control.exit_info_1 = error_code;
+ 	svm->vmcb->control.exit_info_2 = svm->vcpu.arch.cr2;
+ 
+-	return nested_svm_exit_handled(svm);
++	vmexit = nested_svm_intercept(svm);
++	if (vmexit == NESTED_EXIT_DONE)
++		svm->nested.exit_required = true;
++
++	return vmexit;
+ }
+ 
+-static inline int nested_svm_intr(struct vcpu_svm *svm)
++/* This function returns true if it is save to enable the irq window */
++static inline bool nested_svm_intr(struct vcpu_svm *svm)
+ {
+ 	if (!is_nested(svm))
+-		return 0;
++		return true;
+ 
+ 	if (!(svm->vcpu.arch.hflags & HF_VINTR_MASK))
+-		return 0;
++		return true;
+ 
+ 	if (!(svm->vcpu.arch.hflags & HF_HIF_MASK))
+-		return 0;
++		return false;
+ 
+ 	svm->vmcb->control.exit_code = SVM_EXIT_INTR;
+ 
+@@ -1392,13 +1400,13 @@ static inline int nested_svm_intr(struct vcpu_svm *svm)
+ 		 */
+ 		svm->nested.exit_required = true;
+ 		trace_kvm_nested_intr_vmexit(svm->vmcb->save.rip);
+-		return 1;
++		return false;
+ 	}
+ 
+-	return 0;
++	return true;
+ }
+ 
+-static void *nested_svm_map(struct vcpu_svm *svm, u64 gpa, enum km_type idx)
++static void *nested_svm_map(struct vcpu_svm *svm, u64 gpa, struct page **_page)
+ {
+ 	struct page *page;
+ 
+@@ -1406,7 +1414,9 @@ static void *nested_svm_map(struct vcpu_svm *svm, u64 gpa, enum km_type idx)
+ 	if (is_error_page(page))
+ 		goto error;
+ 
+-	return kmap_atomic(page, idx);
++	*_page = page;
++
++	return kmap(page);
+ 
+ error:
+ 	kvm_release_page_clean(page);
+@@ -1415,16 +1425,9 @@ error:
+ 	return NULL;
+ }
+ 
+-static void nested_svm_unmap(void *addr, enum km_type idx)
++static void nested_svm_unmap(struct page *page)
+ {
+-	struct page *page;
+-
+-	if (!addr)
+-		return;
+-
+-	page = kmap_atomic_to_page(addr);
+-
+-	kunmap_atomic(addr, idx);
++	kunmap(page);
+ 	kvm_release_page_dirty(page);
+ }
+ 
+@@ -1434,16 +1437,11 @@ static bool nested_svm_exit_handled_msr(struct vcpu_svm *svm)
+ 	u32 msr = svm->vcpu.arch.regs[VCPU_REGS_RCX];
+ 	bool ret = false;
+ 	u32 t0, t1;
+-	u8 *msrpm;
++	u8 val;
+ 
+ 	if (!(svm->nested.intercept & (1ULL << INTERCEPT_MSR_PROT)))
+ 		return false;
+ 
+-	msrpm = nested_svm_map(svm, svm->nested.vmcb_msrpm, KM_USER0);
+-
+-	if (!msrpm)
+-		goto out;
+-
+ 	switch (msr) {
+ 	case 0 ... 0x1fff:
+ 		t0 = (msr * 2) % 8;
+@@ -1464,11 +1462,10 @@ static bool nested_svm_exit_handled_msr(struct vcpu_svm *svm)
+ 		goto out;
+ 	}
+ 
+-	ret = msrpm[t1] & ((1 << param) << t0);
++	if (!kvm_read_guest(svm->vcpu.kvm, svm->nested.vmcb_msrpm + t1, &val, 1))
++		ret = val & ((1 << param) << t0);
+ 
+ out:
+-	nested_svm_unmap(msrpm, KM_USER0);
+-
+ 	return ret;
+ }
+ 
+@@ -1500,7 +1497,7 @@ static int nested_svm_exit_special(struct vcpu_svm *svm)
+ /*
+  * If this function returns true, this #vmexit was already handled
+  */
+-static int nested_svm_exit_handled(struct vcpu_svm *svm)
++static int nested_svm_intercept(struct vcpu_svm *svm)
+ {
+ 	u32 exit_code = svm->vmcb->control.exit_code;
+ 	int vmexit = NESTED_EXIT_HOST;
+@@ -1546,9 +1543,17 @@ static int nested_svm_exit_handled(struct vcpu_svm *svm)
+ 	}
+ 	}
+ 
+-	if (vmexit == NESTED_EXIT_DONE) {
++	return vmexit;
++}
++
++static int nested_svm_exit_handled(struct vcpu_svm *svm)
++{
++	int vmexit;
++
++	vmexit = nested_svm_intercept(svm);
++
++	if (vmexit == NESTED_EXIT_DONE)
+ 		nested_svm_vmexit(svm);
+-	}
+ 
+ 	return vmexit;
+ }
+@@ -1590,6 +1595,7 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)
+ 	struct vmcb *nested_vmcb;
+ 	struct vmcb *hsave = svm->nested.hsave;
+ 	struct vmcb *vmcb = svm->vmcb;
++	struct page *page;
+ 
+ 	trace_kvm_nested_vmexit_inject(vmcb->control.exit_code,
+ 				       vmcb->control.exit_info_1,
+@@ -1597,7 +1603,7 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)
+ 				       vmcb->control.exit_int_info,
+ 				       vmcb->control.exit_int_info_err);
+ 
+-	nested_vmcb = nested_svm_map(svm, svm->nested.vmcb, KM_USER0);
++	nested_vmcb = nested_svm_map(svm, svm->nested.vmcb, &page);
+ 	if (!nested_vmcb)
+ 		return 1;
+ 
+@@ -1610,9 +1616,13 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)
+ 	nested_vmcb->save.ds     = vmcb->save.ds;
+ 	nested_vmcb->save.gdtr   = vmcb->save.gdtr;
+ 	nested_vmcb->save.idtr   = vmcb->save.idtr;
++	nested_vmcb->save.cr0    = svm->vcpu.arch.cr0;
+ 	if (npt_enabled)
+ 		nested_vmcb->save.cr3    = vmcb->save.cr3;
++	else
++		nested_vmcb->save.cr3    = svm->vcpu.arch.cr3;
+ 	nested_vmcb->save.cr2    = vmcb->save.cr2;
++	nested_vmcb->save.cr4    = svm->vcpu.arch.cr4;
+ 	nested_vmcb->save.rflags = vmcb->save.rflags;
+ 	nested_vmcb->save.rip    = vmcb->save.rip;
+ 	nested_vmcb->save.rsp    = vmcb->save.rsp;
+@@ -1687,7 +1697,7 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)
+ 	/* Exit nested SVM mode */
+ 	svm->nested.vmcb = 0;
+ 
+-	nested_svm_unmap(nested_vmcb, KM_USER0);
++	nested_svm_unmap(page);
+ 
+ 	kvm_mmu_reset_context(&svm->vcpu);
+ 	kvm_mmu_load(&svm->vcpu);
+@@ -1698,9 +1708,10 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)
+ static bool nested_svm_vmrun_msrpm(struct vcpu_svm *svm)
+ {
+ 	u32 *nested_msrpm;
++	struct page *page;
+ 	int i;
+ 
+-	nested_msrpm = nested_svm_map(svm, svm->nested.vmcb_msrpm, KM_USER0);
++	nested_msrpm = nested_svm_map(svm, svm->nested.vmcb_msrpm, &page);
+ 	if (!nested_msrpm)
+ 		return false;
+ 
+@@ -1709,7 +1720,7 @@ static bool nested_svm_vmrun_msrpm(struct vcpu_svm *svm)
+ 
+ 	svm->vmcb->control.msrpm_base_pa = __pa(svm->nested.msrpm);
+ 
+-	nested_svm_unmap(nested_msrpm, KM_USER0);
++	nested_svm_unmap(page);
+ 
+ 	return true;
+ }
+@@ -1719,8 +1730,9 @@ static bool nested_svm_vmrun(struct vcpu_svm *svm)
+ 	struct vmcb *nested_vmcb;
+ 	struct vmcb *hsave = svm->nested.hsave;
+ 	struct vmcb *vmcb = svm->vmcb;
++	struct page *page;
+ 
+-	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, KM_USER0);
++	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);
+ 	if (!nested_vmcb)
+ 		return false;
+ 
+@@ -1794,21 +1806,6 @@ static bool nested_svm_vmrun(struct vcpu_svm *svm)
+ 	svm->vmcb->save.dr6 = nested_vmcb->save.dr6;
+ 	svm->vmcb->save.cpl = nested_vmcb->save.cpl;
+ 
+-	/* We don't want a nested guest to be more powerful than the guest,
+-	   so all intercepts are ORed */
+-	svm->vmcb->control.intercept_cr_read |=
+-		nested_vmcb->control.intercept_cr_read;
+-	svm->vmcb->control.intercept_cr_write |=
+-		nested_vmcb->control.intercept_cr_write;
+-	svm->vmcb->control.intercept_dr_read |=
+-		nested_vmcb->control.intercept_dr_read;
+-	svm->vmcb->control.intercept_dr_write |=
+-		nested_vmcb->control.intercept_dr_write;
+-	svm->vmcb->control.intercept_exceptions |=
+-		nested_vmcb->control.intercept_exceptions;
+-
+-	svm->vmcb->control.intercept |= nested_vmcb->control.intercept;
+-
+ 	svm->nested.vmcb_msrpm = nested_vmcb->control.msrpm_base_pa;
+ 
+ 	/* cache intercepts */
+@@ -1826,13 +1823,40 @@ static bool nested_svm_vmrun(struct vcpu_svm *svm)
+ 	else
+ 		svm->vcpu.arch.hflags &= ~HF_VINTR_MASK;
+ 
++	if (svm->vcpu.arch.hflags & HF_VINTR_MASK) {
++		/* We only want the cr8 intercept bits of the guest */
++		svm->vmcb->control.intercept_cr_read &= ~INTERCEPT_CR8_MASK;
++		svm->vmcb->control.intercept_cr_write &= ~INTERCEPT_CR8_MASK;
++	}
++
++	/* We don't want to see VMMCALLs from a nested guest */
++	svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMMCALL);
++
++	/*
++	 * We don't want a nested guest to be more powerful than the guest, so
++	 * all intercepts are ORed
++	 */
++	svm->vmcb->control.intercept_cr_read |=
++		nested_vmcb->control.intercept_cr_read;
++	svm->vmcb->control.intercept_cr_write |=
++		nested_vmcb->control.intercept_cr_write;
++	svm->vmcb->control.intercept_dr_read |=
++		nested_vmcb->control.intercept_dr_read;
++	svm->vmcb->control.intercept_dr_write |=
++		nested_vmcb->control.intercept_dr_write;
++	svm->vmcb->control.intercept_exceptions |=
++		nested_vmcb->control.intercept_exceptions;
++
++	svm->vmcb->control.intercept |= nested_vmcb->control.intercept;
++
++	svm->vmcb->control.lbr_ctl = nested_vmcb->control.lbr_ctl;
+ 	svm->vmcb->control.int_vector = nested_vmcb->control.int_vector;
+ 	svm->vmcb->control.int_state = nested_vmcb->control.int_state;
+ 	svm->vmcb->control.tsc_offset += nested_vmcb->control.tsc_offset;
+ 	svm->vmcb->control.event_inj = nested_vmcb->control.event_inj;
+ 	svm->vmcb->control.event_inj_err = nested_vmcb->control.event_inj_err;
+ 
+-	nested_svm_unmap(nested_vmcb, KM_USER0);
++	nested_svm_unmap(page);
+ 
+ 	enable_gif(svm);
+ 
+@@ -1858,6 +1882,7 @@ static void nested_svm_vmloadsave(struct vmcb *from_vmcb, struct vmcb *to_vmcb)
+ static int vmload_interception(struct vcpu_svm *svm)
+ {
+ 	struct vmcb *nested_vmcb;
++	struct page *page;
+ 
+ 	if (nested_svm_check_permissions(svm))
+ 		return 1;
+@@ -1865,12 +1890,12 @@ static int vmload_interception(struct vcpu_svm *svm)
+ 	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
+ 	skip_emulated_instruction(&svm->vcpu);
+ 
+-	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, KM_USER0);
++	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);
+ 	if (!nested_vmcb)
+ 		return 1;
+ 
+ 	nested_svm_vmloadsave(nested_vmcb, svm->vmcb);
+-	nested_svm_unmap(nested_vmcb, KM_USER0);
++	nested_svm_unmap(page);
+ 
+ 	return 1;
+ }
+@@ -1878,6 +1903,7 @@ static int vmload_interception(struct vcpu_svm *svm)
+ static int vmsave_interception(struct vcpu_svm *svm)
+ {
+ 	struct vmcb *nested_vmcb;
++	struct page *page;
+ 
+ 	if (nested_svm_check_permissions(svm))
+ 		return 1;
+@@ -1885,12 +1911,12 @@ static int vmsave_interception(struct vcpu_svm *svm)
+ 	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
+ 	skip_emulated_instruction(&svm->vcpu);
+ 
+-	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, KM_USER0);
++	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);
+ 	if (!nested_vmcb)
+ 		return 1;
+ 
+ 	nested_svm_vmloadsave(svm->vmcb, nested_vmcb);
+-	nested_svm_unmap(nested_vmcb, KM_USER0);
++	nested_svm_unmap(page);
+ 
+ 	return 1;
+ }
+@@ -2487,6 +2513,9 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
+ {
+ 	struct vcpu_svm *svm = to_svm(vcpu);
+ 
++	if (is_nested(svm) && (vcpu->arch.hflags & HF_VINTR_MASK))
++		return;
++
+ 	if (irr == -1)
+ 		return;
+ 
+@@ -2544,13 +2573,11 @@ static void enable_irq_window(struct kvm_vcpu *vcpu)
+ {
+ 	struct vcpu_svm *svm = to_svm(vcpu);
+ 
+-	nested_svm_intr(svm);
+-
+ 	/* In case GIF=0 we can't rely on the CPU to tell us when
+ 	 * GIF becomes 1, because that's a separate STGI/VMRUN intercept.
+ 	 * The next time we get that intercept, this function will be
+ 	 * called again though and we'll get the vintr intercept. */
+-	if (gif_set(svm)) {
++	if (gif_set(svm) && nested_svm_intr(svm)) {
+ 		svm_set_vintr(svm);
+ 		svm_inject_irq(svm, 0x0);
+ 	}
+@@ -2590,6 +2617,9 @@ static inline void sync_cr8_to_lapic(struct kvm_vcpu *vcpu)
+ {
+ 	struct vcpu_svm *svm = to_svm(vcpu);
+ 
++	if (is_nested(svm) && (vcpu->arch.hflags & HF_VINTR_MASK))
++		return;
++
+ 	if (!(svm->vmcb->control.intercept_cr_write & INTERCEPT_CR8_MASK)) {
+ 		int cr8 = svm->vmcb->control.int_ctl & V_TPR_MASK;
+ 		kvm_set_cr8(vcpu, cr8);
+@@ -2601,6 +2631,9 @@ static inline void sync_lapic_to_cr8(struct kvm_vcpu *vcpu)
+ 	struct vcpu_svm *svm = to_svm(vcpu);
+ 	u64 cr8;
+ 
++	if (is_nested(svm) && (vcpu->arch.hflags & HF_VINTR_MASK))
++		return;
++
+ 	cr8 = kvm_get_cr8(vcpu);
+ 	svm->vmcb->control.int_ctl &= ~V_TPR_MASK;
+ 	svm->vmcb->control.int_ctl |= cr8 & V_TPR_MASK;
+@@ -2857,6 +2890,20 @@ static u64 svm_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
+ 	return 0;
+ }
+ 
++static void svm_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
++{
++	switch (func) {
++	case 0x8000000A:
++		entry->eax = 1; /* SVM revision 1 */
++		entry->ebx = 8; /* Lets support 8 ASIDs in case we add proper
++				   ASID emulation to nested SVM */
++		entry->ecx = 0; /* Reserved */
++		entry->edx = 0; /* Do not support any additional features */
++
++		break;
++	}
++}
++
+ static const struct trace_print_flags svm_exit_reasons_str[] = {
+ 	{ SVM_EXIT_READ_CR0,           		"read_cr0" },
+ 	{ SVM_EXIT_READ_CR3,	      		"read_cr3" },
+@@ -2981,6 +3028,7 @@ static struct kvm_x86_ops svm_x86_ops = {
+ 
+ 	.exit_reasons_str = svm_exit_reasons_str,
+ 	.gb_page_enable = svm_gb_page_enable,
++	.set_supported_cpuid = svm_set_supported_cpuid,
+ };
+ 
+ static int __init svm_init(void)
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 3acbe19..2840568 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -26,6 +26,7 @@
+ #include <linux/sched.h>
+ #include <linux/moduleparam.h>
+ #include <linux/ftrace_event.h>
++#include <linux/tboot.h>
+ #include "kvm_cache_regs.h"
+ #include "x86.h"
+ 
+@@ -1125,9 +1126,16 @@ static __init int vmx_disabled_by_bios(void)
+ 	u64 msr;
+ 
+ 	rdmsrl(MSR_IA32_FEATURE_CONTROL, msr);
+-	return (msr & (FEATURE_CONTROL_LOCKED |
+-		       FEATURE_CONTROL_VMXON_ENABLED))
+-	    == FEATURE_CONTROL_LOCKED;
++	if (msr & FEATURE_CONTROL_LOCKED) {
++		if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX)
++			&& tboot_enabled())
++			return 1;
++		if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
++			&& !tboot_enabled())
++			return 1;
++	}
++
++	return 0;
+ 	/* locked but not enabled */
+ }
+ 
+@@ -1135,21 +1143,23 @@ static int hardware_enable(void *garbage)
+ {
+ 	int cpu = raw_smp_processor_id();
+ 	u64 phys_addr = __pa(per_cpu(vmxarea, cpu));
+-	u64 old;
++	u64 old, test_bits;
+ 
+ 	if (read_cr4() & X86_CR4_VMXE)
+ 		return -EBUSY;
+ 
+ 	INIT_LIST_HEAD(&per_cpu(vcpus_on_cpu, cpu));
+ 	rdmsrl(MSR_IA32_FEATURE_CONTROL, old);
+-	if ((old & (FEATURE_CONTROL_LOCKED |
+-		    FEATURE_CONTROL_VMXON_ENABLED))
+-	    != (FEATURE_CONTROL_LOCKED |
+-		FEATURE_CONTROL_VMXON_ENABLED))
++
++	test_bits = FEATURE_CONTROL_LOCKED;
++	test_bits |= FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
++	if (tboot_enabled())
++		test_bits |= FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX;
++
++	if ((old & test_bits) != test_bits) {
+ 		/* enable and lock */
+-		wrmsrl(MSR_IA32_FEATURE_CONTROL, old |
+-		       FEATURE_CONTROL_LOCKED |
+-		       FEATURE_CONTROL_VMXON_ENABLED);
++		wrmsrl(MSR_IA32_FEATURE_CONTROL, old | test_bits);
++	}
+ 	write_cr4(read_cr4() | X86_CR4_VMXE); /* FIXME: not cpu hotplug safe */
+ 	asm volatile (ASM_VMX_VMXON_RAX
+ 		      : : "a"(&phys_addr), "m"(phys_addr)
+@@ -3993,6 +4003,10 @@ static bool vmx_gb_page_enable(void)
+ 	return false;
+ }
+ 
++static void vmx_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
++{
++}
++
+ static struct kvm_x86_ops vmx_x86_ops = {
+ 	.cpu_has_kvm_support = cpu_has_kvm_support,
+ 	.disabled_by_bios = vmx_disabled_by_bios,
+@@ -4057,6 +4071,7 @@ static struct kvm_x86_ops vmx_x86_ops = {
+ 
+ 	.exit_reasons_str = vmx_exit_reasons_str,
+ 	.gb_page_enable = vmx_gb_page_enable,
++	.set_supported_cpuid = vmx_set_supported_cpuid,
+ };
+ 
+ static int __init vmx_init(void)
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index dd78927..07750de 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -432,7 +432,7 @@ EXPORT_SYMBOL_GPL(kvm_set_cr0);
+ 
+ void kvm_lmsw(struct kvm_vcpu *vcpu, unsigned long msw)
+ {
+-	kvm_set_cr0(vcpu, (vcpu->arch.cr0 & ~0x0ful) | (msw & 0x0f));
++	kvm_set_cr0(vcpu, (vcpu->arch.cr0 & ~0x0eul) | (msw & 0x0f));
+ }
+ EXPORT_SYMBOL_GPL(kvm_lmsw);
+ 
+@@ -570,48 +570,42 @@ static u32 emulated_msrs[] = {
+ 	MSR_IA32_MISC_ENABLE,
+ };
+ 
+-static void set_efer(struct kvm_vcpu *vcpu, u64 efer)
++static int set_efer(struct kvm_vcpu *vcpu, u64 efer)
+ {
+-	if (efer & efer_reserved_bits) {
+-		kvm_inject_gp(vcpu, 0);
+-		return;
+-	}
++	if (efer & efer_reserved_bits)
++		return 1;
+ 
+ 	if (is_paging(vcpu)
+-	    && (vcpu->arch.shadow_efer & EFER_LME) != (efer & EFER_LME)) {
+-		kvm_inject_gp(vcpu, 0);
+-		return;
+-	}
++	    && (vcpu->arch.shadow_efer & EFER_LME) != (efer & EFER_LME))
++		return 1;
+ 
+ 	if (efer & EFER_FFXSR) {
+ 		struct kvm_cpuid_entry2 *feat;
+ 
+ 		feat = kvm_find_cpuid_entry(vcpu, 0x80000001, 0);
+-		if (!feat || !(feat->edx & bit(X86_FEATURE_FXSR_OPT))) {
+-			kvm_inject_gp(vcpu, 0);
+-			return;
+-		}
++		if (!feat || !(feat->edx & bit(X86_FEATURE_FXSR_OPT)))
++			return 1;
+ 	}
+ 
+ 	if (efer & EFER_SVME) {
+ 		struct kvm_cpuid_entry2 *feat;
+ 
+ 		feat = kvm_find_cpuid_entry(vcpu, 0x80000001, 0);
+-		if (!feat || !(feat->ecx & bit(X86_FEATURE_SVM))) {
+-			kvm_inject_gp(vcpu, 0);
+-			return;
+-		}
++		if (!feat || !(feat->ecx & bit(X86_FEATURE_SVM)))
++			return 1;
+ 	}
+ 
+-	kvm_x86_ops->set_efer(vcpu, efer);
+-
+ 	efer &= ~EFER_LMA;
+ 	efer |= vcpu->arch.shadow_efer & EFER_LMA;
+ 
++	kvm_x86_ops->set_efer(vcpu, efer);
++
+ 	vcpu->arch.shadow_efer = efer;
+ 
+ 	vcpu->arch.mmu.base_role.nxe = (efer & EFER_NX) && !tdp_enabled;
+ 	kvm_mmu_reset_context(vcpu);
++
++	return 0;
+ }
+ 
+ void kvm_enable_efer_bits(u64 mask)
+@@ -641,14 +635,22 @@ static int do_set_msr(struct kvm_vcpu *vcpu, unsigned index, u64 *data)
+ 
+ static void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock)
+ {
+-	static int version;
++	int version;
++	int r;
+ 	struct pvclock_wall_clock wc;
+ 	struct timespec boot;
+ 
+ 	if (!wall_clock)
+ 		return;
+ 
+-	version++;
++	r = kvm_read_guest(kvm, wall_clock, &version, sizeof(version));
++	if (r)
++		return;
++
++	if (version & 1)
++		++version;  /* first time write, random junk */
++
++	++version;
+ 
+ 	kvm_write_guest(kvm, wall_clock, &version, sizeof(version));
+ 
+@@ -938,8 +940,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
+ {
+ 	switch (msr) {
+ 	case MSR_EFER:
+-		set_efer(vcpu, data);
+-		break;
++		return set_efer(vcpu, data);
+ 	case MSR_K7_HWCR:
+ 		data &= ~(u64)0x40;	/* ignore flush filter disable */
+ 		if (data != 0) {
+@@ -1542,6 +1543,7 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
+ {
+ 	int r;
+ 
++	vcpu_load(vcpu);
+ 	r = -E2BIG;
+ 	if (cpuid->nent < vcpu->arch.cpuid_nent)
+ 		goto out;
+@@ -1553,6 +1555,7 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
+ 
+ out:
+ 	cpuid->nent = vcpu->arch.cpuid_nent;
++	vcpu_put(vcpu);
+ 	return r;
+ }
+ 
+@@ -1688,6 +1691,9 @@ static void do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
+ 		entry->ecx &= kvm_supported_word6_x86_features;
+ 		break;
+ 	}
++
++	kvm_x86_ops->set_supported_cpuid(function, entry);
++
+ 	put_cpu();
+ }
+ 
+@@ -1802,6 +1808,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce(struct kvm_vcpu *vcpu,
+ 	int r;
+ 	unsigned bank_num = mcg_cap & 0xff, bank;
+ 
++	vcpu_load(vcpu);
+ 	r = -EINVAL;
+ 	if (!bank_num || bank_num >= KVM_MAX_MCE_BANKS)
+ 		goto out;
+@@ -1816,6 +1823,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce(struct kvm_vcpu *vcpu,
+ 	for (bank = 0; bank < bank_num; bank++)
+ 		vcpu->arch.mce_banks[bank*4] = ~(u64)0;
+ out:
++	vcpu_put(vcpu);
+ 	return r;
+ }
+ 
+@@ -2083,7 +2091,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
+ 		r = -EFAULT;
+ 		if (copy_from_user(&mce, argp, sizeof mce))
+ 			goto out;
++		vcpu_load(vcpu);
+ 		r = kvm_vcpu_ioctl_x86_set_mce(vcpu, &mce);
++		vcpu_put(vcpu);
+ 		break;
+ 	}
+ 	case KVM_GET_VCPU_EVENTS: {
+diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
+index 2c505ee..f1fb411 100644
+--- a/arch/x86/oprofile/nmi_int.c
++++ b/arch/x86/oprofile/nmi_int.c
+@@ -95,7 +95,10 @@ static void nmi_cpu_save_registers(struct op_msrs *msrs)
+ static void nmi_cpu_start(void *dummy)
+ {
+ 	struct op_msrs const *msrs = &__get_cpu_var(cpu_msrs);
+-	model->start(msrs);
++	if (!msrs->controls)
++		WARN_ON_ONCE(1);
++	else
++		model->start(msrs);
+ }
+ 
+ static int nmi_start(void)
+@@ -107,7 +110,10 @@ static int nmi_start(void)
+ static void nmi_cpu_stop(void *dummy)
+ {
+ 	struct op_msrs const *msrs = &__get_cpu_var(cpu_msrs);
+-	model->stop(msrs);
++	if (!msrs->controls)
++		WARN_ON_ONCE(1);
++	else
++		model->stop(msrs);
+ }
+ 
+ static void nmi_stop(void)
+diff --git a/arch/x86/xen/suspend.c b/arch/x86/xen/suspend.c
+index 987267f..a9c6611 100644
+--- a/arch/x86/xen/suspend.c
++++ b/arch/x86/xen/suspend.c
+@@ -60,6 +60,6 @@ static void xen_vcpu_notify_restore(void *data)
+ 
+ void xen_arch_resume(void)
+ {
+-	smp_call_function(xen_vcpu_notify_restore,
+-			       (void *)CLOCK_EVT_NOTIFY_RESUME, 1);
++	on_each_cpu(xen_vcpu_notify_restore,
++		    (void *)CLOCK_EVT_NOTIFY_RESUME, 1);
+ }
+diff --git a/arch/xtensa/include/asm/cache.h b/arch/xtensa/include/asm/cache.h
+index f04c989..ed8cd3c 100644
+--- a/arch/xtensa/include/asm/cache.h
++++ b/arch/xtensa/include/asm/cache.h
+@@ -29,5 +29,6 @@
+ # define CACHE_WAY_SIZE ICACHE_WAY_SIZE
+ #endif
+ 
++#define ARCH_KMALLOC_MINALIGN	L1_CACHE_BYTES
+ 
+ #endif	/* _XTENSA_CACHE_H */
+diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
+index 023f4e6..d0f8146 100644
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -2481,15 +2481,10 @@ static void cfq_free_io_context(struct io_context *ioc)
+ 	__call_for_each_cic(ioc, cic_free_func);
+ }
+ 
+-static void cfq_exit_cfqq(struct cfq_data *cfqd, struct cfq_queue *cfqq)
++static void cfq_put_cooperator(struct cfq_queue *cfqq)
+ {
+ 	struct cfq_queue *__cfqq, *next;
+ 
+-	if (unlikely(cfqq == cfqd->active_queue)) {
+-		__cfq_slice_expired(cfqd, cfqq, 0);
+-		cfq_schedule_dispatch(cfqd);
+-	}
+-
+ 	/*
+ 	 * If this queue was scheduled to merge with another queue, be
+ 	 * sure to drop the reference taken on that queue (and others in
+@@ -2505,6 +2500,16 @@ static void cfq_exit_cfqq(struct cfq_data *cfqd, struct cfq_queue *cfqq)
+ 		cfq_put_queue(__cfqq);
+ 		__cfqq = next;
+ 	}
++}
++
++static void cfq_exit_cfqq(struct cfq_data *cfqd, struct cfq_queue *cfqq)
++{
++	if (unlikely(cfqq == cfqd->active_queue)) {
++		__cfq_slice_expired(cfqd, cfqq, 0);
++		cfq_schedule_dispatch(cfqd);
++	}
++
++	cfq_put_cooperator(cfqq);
+ 
+ 	cfq_put_queue(cfqq);
+ }
+@@ -3459,6 +3464,9 @@ split_cfqq(struct cfq_io_context *cic, struct cfq_queue *cfqq)
+ 	}
+ 
+ 	cic_set_cfqq(cic, NULL, 1);
++
++	cfq_put_cooperator(cfqq);
++
+ 	cfq_put_queue(cfqq);
+ 	return NULL;
+ }
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index fc2f26b..c5fef01 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -250,7 +250,7 @@ static int __init acpi_backlight(char *str)
+ 				ACPI_VIDEO_BACKLIGHT_FORCE_VENDOR;
+ 		if (!strcmp("video", str))
+ 			acpi_video_support |=
+-				ACPI_VIDEO_OUTPUT_SWITCHING_FORCE_VIDEO;
++				ACPI_VIDEO_BACKLIGHT_FORCE_VIDEO;
+ 	}
+ 	return 1;
+ }
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 2401c9c..8e9b132 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -159,6 +159,10 @@ int libata_allow_tpm = 0;
+ module_param_named(allow_tpm, libata_allow_tpm, int, 0444);
+ MODULE_PARM_DESC(allow_tpm, "Permit the use of TPM commands (0=off [default], 1=on)");
+ 
++static int atapi_an;
++module_param(atapi_an, int, 0444);
++MODULE_PARM_DESC(atapi_an, "Enable ATAPI AN media presence notification (0=0ff [default], 1=on)");
++
+ MODULE_AUTHOR("Jeff Garzik");
+ MODULE_DESCRIPTION("Library module for ATA devices");
+ MODULE_LICENSE("GPL");
+@@ -2570,7 +2574,8 @@ int ata_dev_configure(struct ata_device *dev)
+ 		 * to enable ATAPI AN to discern between PHY status
+ 		 * changed notifications and ATAPI ANs.
+ 		 */
+-		if ((ap->flags & ATA_FLAG_AN) && ata_id_has_atapi_AN(id) &&
++		if (atapi_an &&
++		    (ap->flags & ATA_FLAG_AN) && ata_id_has_atapi_AN(id) &&
+ 		    (!sata_pmp_attached(ap) ||
+ 		     sata_scr_read(&ap->link, SCR_NOTIFICATION, &sntf) == 0)) {
+ 			unsigned int err_mask;
+diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
+index 730ef3c..06e7204 100644
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -893,7 +893,7 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
+ 				       do_write);
+ 	}
+ 
+-	if (!do_write)
++	if (!do_write && !PageSlab(page))
+ 		flush_dcache_page(page);
+ 
+ 	qc->curbytes += qc->sect_size;
+diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
+index 0c82d33..952641e 100644
+--- a/drivers/ata/sata_nv.c
++++ b/drivers/ata/sata_nv.c
+@@ -1673,7 +1673,6 @@ static void nv_mcp55_freeze(struct ata_port *ap)
+ 	mask = readl(mmio_base + NV_INT_ENABLE_MCP55);
+ 	mask &= ~(NV_INT_ALL_MCP55 << shift);
+ 	writel(mask, mmio_base + NV_INT_ENABLE_MCP55);
+-	ata_sff_freeze(ap);
+ }
+ 
+ static void nv_mcp55_thaw(struct ata_port *ap)
+@@ -1687,7 +1686,6 @@ static void nv_mcp55_thaw(struct ata_port *ap)
+ 	mask = readl(mmio_base + NV_INT_ENABLE_MCP55);
+ 	mask |= (NV_INT_MASK_MCP55 << shift);
+ 	writel(mask, mmio_base + NV_INT_ENABLE_MCP55);
+-	ata_sff_thaw(ap);
+ }
+ 
+ static void nv_adma_error_handler(struct ata_port *ap)
+@@ -2478,8 +2476,7 @@ static int nv_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	}
+ 
+ 	pci_set_master(pdev);
+-	return ata_host_activate(host, pdev->irq, ipriv->irq_handler,
+-				 IRQF_SHARED, ipriv->sht);
++	return ata_pci_sff_activate_host(host, ipriv->irq_handler, ipriv->sht);
+ }
+ 
+ #ifdef CONFIG_PM
+diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
+index 02efd9a..e35596b 100644
+--- a/drivers/ata/sata_via.c
++++ b/drivers/ata/sata_via.c
+@@ -558,6 +558,19 @@ static void svia_configure(struct pci_dev *pdev)
+ 		tmp8 |= NATIVE_MODE_ALL;
+ 		pci_write_config_byte(pdev, SATA_NATIVE_MODE, tmp8);
+ 	}
++
++	/*
++	 * vt6421 has problems talking to some drives.  The following
++	 * is the magic fix from Joseph Chan <JosephChan@×××××××.tw>.
++	 * Please add proper documentation if possible.
++	 *
++	 * https://bugzilla.kernel.org/show_bug.cgi?id=15173
++	 */
++	if (pdev->device == 0x3249) {
++		pci_read_config_byte(pdev, 0x52, &tmp8);
++		tmp8 |= 1 << 2;
++		pci_write_config_byte(pdev, 0x52, tmp8);
++	}
+ }
+ 
+ static int svia_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
+index 958bd15..7b71a15 100644
+--- a/drivers/base/cpu.c
++++ b/drivers/base/cpu.c
+@@ -183,7 +183,7 @@ static ssize_t print_cpus_offline(struct sysdev_class *class, char *buf)
+ 	/* display offline cpus < nr_cpu_ids */
+ 	if (!alloc_cpumask_var(&offline, GFP_KERNEL))
+ 		return -ENOMEM;
+-	cpumask_complement(offline, cpu_online_mask);
++	cpumask_andnot(offline, cpu_possible_mask, cpu_online_mask);
+ 	n = cpulist_scnprintf(buf, len, offline);
+ 	free_cpumask_var(offline);
+ 
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index 176f175..aa79cfd 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -311,9 +311,14 @@ static void deliver_recv_msg(struct smi_info *smi_info,
+ {
+ 	/* Deliver the message to the upper layer with the lock
+ 	   released. */
+-	spin_unlock(&(smi_info->si_lock));
+-	ipmi_smi_msg_received(smi_info->intf, msg);
+-	spin_lock(&(smi_info->si_lock));
++
++	if (smi_info->run_to_completion) {
++		ipmi_smi_msg_received(smi_info->intf, msg);
++	} else {
++		spin_unlock(&(smi_info->si_lock));
++		ipmi_smi_msg_received(smi_info->intf, msg);
++		spin_lock(&(smi_info->si_lock));
++	}
+ }
+ 
+ static void return_hosed_msg(struct smi_info *smi_info, int cCode)
+diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
+index 6fe4f77..234d9f6 100644
+--- a/drivers/clocksource/sh_cmt.c
++++ b/drivers/clocksource/sh_cmt.c
+@@ -413,18 +413,10 @@ static cycle_t sh_cmt_clocksource_read(struct clocksource *cs)
+ static int sh_cmt_clocksource_enable(struct clocksource *cs)
+ {
+ 	struct sh_cmt_priv *p = cs_to_sh_cmt(cs);
+-	int ret;
+ 
+ 	p->total_cycles = 0;
+ 
+-	ret = sh_cmt_start(p, FLAG_CLOCKSOURCE);
+-	if (ret)
+-		return ret;
+-
+-	/* TODO: calculate good shift from rate and counter bit width */
+-	cs->shift = 0;
+-	cs->mult = clocksource_hz2mult(p->rate, cs->shift);
+-	return 0;
++	return sh_cmt_start(p, FLAG_CLOCKSOURCE);
+ }
+ 
+ static void sh_cmt_clocksource_disable(struct clocksource *cs)
+@@ -444,7 +436,18 @@ static int sh_cmt_register_clocksource(struct sh_cmt_priv *p,
+ 	cs->disable = sh_cmt_clocksource_disable;
+ 	cs->mask = CLOCKSOURCE_MASK(sizeof(unsigned long) * 8);
+ 	cs->flags = CLOCK_SOURCE_IS_CONTINUOUS;
++
++	/* clk_get_rate() needs an enabled clock */
++	clk_enable(p->clk);
++	p->rate = clk_get_rate(p->clk) / (p->width == 16) ? 512 : 8;
++	clk_disable(p->clk);
++
++	/* TODO: calculate good shift from rate and counter bit width */
++	cs->shift = 10;
++	cs->mult = clocksource_hz2mult(p->rate, cs->shift);
++
+ 	pr_info("sh_cmt: %s used as clock source\n", cs->name);
++
+ 	clocksource_register(cs);
+ 	return 0;
+ }
+diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
+index 961f5b5..c073246 100644
+--- a/drivers/clocksource/sh_tmu.c
++++ b/drivers/clocksource/sh_tmu.c
+@@ -199,16 +199,8 @@ static cycle_t sh_tmu_clocksource_read(struct clocksource *cs)
+ static int sh_tmu_clocksource_enable(struct clocksource *cs)
+ {
+ 	struct sh_tmu_priv *p = cs_to_sh_tmu(cs);
+-	int ret;
+-
+-	ret = sh_tmu_enable(p);
+-	if (ret)
+-		return ret;
+ 
+-	/* TODO: calculate good shift from rate and counter bit width */
+-	cs->shift = 10;
+-	cs->mult = clocksource_hz2mult(p->rate, cs->shift);
+-	return 0;
++	return sh_tmu_enable(p);
+ }
+ 
+ static void sh_tmu_clocksource_disable(struct clocksource *cs)
+@@ -228,6 +220,16 @@ static int sh_tmu_register_clocksource(struct sh_tmu_priv *p,
+ 	cs->disable = sh_tmu_clocksource_disable;
+ 	cs->mask = CLOCKSOURCE_MASK(32);
+ 	cs->flags = CLOCK_SOURCE_IS_CONTINUOUS;
++
++	/* clk_get_rate() needs an enabled clock */
++	clk_enable(p->clk);
++	/* channel will be configured at parent clock / 4 */
++	p->rate = clk_get_rate(p->clk) / 4;
++	clk_disable(p->clk);
++	/* TODO: calculate good shift from rate and counter bit width */
++	cs->shift = 10;
++	cs->mult = clocksource_hz2mult(p->rate, cs->shift);
++
+ 	pr_info("sh_tmu: %s used as clock source\n", cs->name);
+ 	clocksource_register(cs);
+ 	return 0;
+diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
+index 5045156..991447b 100644
+--- a/drivers/firewire/core-card.c
++++ b/drivers/firewire/core-card.c
+@@ -231,7 +231,7 @@ void fw_schedule_bm_work(struct fw_card *card, unsigned long delay)
+ static void fw_card_bm_work(struct work_struct *work)
+ {
+ 	struct fw_card *card = container_of(work, struct fw_card, work.work);
+-	struct fw_device *root_device;
++	struct fw_device *root_device, *irm_device;
+ 	struct fw_node *root_node;
+ 	unsigned long flags;
+ 	int root_id, new_root_id, irm_id, local_id;
+@@ -239,6 +239,7 @@ static void fw_card_bm_work(struct work_struct *work)
+ 	bool do_reset = false;
+ 	bool root_device_is_running;
+ 	bool root_device_is_cmc;
++	bool irm_is_1394_1995_only;
+ 
+ 	spin_lock_irqsave(&card->lock, flags);
+ 
+@@ -248,12 +249,18 @@ static void fw_card_bm_work(struct work_struct *work)
+ 	}
+ 
+ 	generation = card->generation;
++
+ 	root_node = card->root_node;
+ 	fw_node_get(root_node);
+ 	root_device = root_node->data;
+ 	root_device_is_running = root_device &&
+ 			atomic_read(&root_device->state) == FW_DEVICE_RUNNING;
+ 	root_device_is_cmc = root_device && root_device->cmc;
++
++	irm_device = card->irm_node->data;
++	irm_is_1394_1995_only = irm_device && irm_device->config_rom &&
++			(irm_device->config_rom[2] & 0x000000f0) == 0;
++
+ 	root_id  = root_node->node_id;
+ 	irm_id   = card->irm_node->node_id;
+ 	local_id = card->local_node->node_id;
+@@ -276,8 +283,15 @@ static void fw_card_bm_work(struct work_struct *work)
+ 
+ 		if (!card->irm_node->link_on) {
+ 			new_root_id = local_id;
+-			fw_notify("IRM has link off, making local node (%02x) root.\n",
+-				  new_root_id);
++			fw_notify("%s, making local node (%02x) root.\n",
++				  "IRM has link off", new_root_id);
++			goto pick_me;
++		}
++
++		if (irm_is_1394_1995_only) {
++			new_root_id = local_id;
++			fw_notify("%s, making local node (%02x) root.\n",
++				  "IRM is not 1394a compliant", new_root_id);
+ 			goto pick_me;
+ 		}
+ 
+@@ -316,8 +330,8 @@ static void fw_card_bm_work(struct work_struct *work)
+ 			 * root, and thus, IRM.
+ 			 */
+ 			new_root_id = local_id;
+-			fw_notify("BM lock failed, making local node (%02x) root.\n",
+-				  new_root_id);
++			fw_notify("%s, making local node (%02x) root.\n",
++				  "BM lock failed", new_root_id);
+ 			goto pick_me;
+ 		}
+ 	} else if (card->bm_generation != generation) {
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index bfd0e4a..48b07ef 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -334,7 +334,7 @@ static struct drm_display_mode drm_dmt_modes[] = {
+ 		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+ 	/* 1024x768@85Hz */
+ 	{ DRM_MODE("1024x768", DRM_MODE_TYPE_DRIVER, 94500, 1024, 1072,
+-		   1072, 1376, 0, 768, 769, 772, 808, 0,
++		   1168, 1376, 0, 768, 769, 772, 808, 0,
+ 		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+ 	/* 1152x864@75Hz */
+ 	{ DRM_MODE("1152x864", DRM_MODE_TYPE_DRIVER, 108000, 1152, 1216,
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index 4746bfe..930664c 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -68,7 +68,8 @@ const static struct intel_device_info intel_845g_info = {
+ };
+ 
+ const static struct intel_device_info intel_i85x_info = {
+-	.is_i8xx = 1, .is_mobile = 1, .cursor_needs_physical = 1,
++	.is_i8xx = 1, .is_i85x = 1, .is_mobile = 1,
++	.cursor_needs_physical = 1,
+ };
+ 
+ const static struct intel_device_info intel_i865g_info = {
+@@ -140,7 +141,7 @@ const static struct pci_device_id pciidlist[] = {
+ 	INTEL_VGA_DEVICE(0x3577, &intel_i830_info),
+ 	INTEL_VGA_DEVICE(0x2562, &intel_845g_info),
+ 	INTEL_VGA_DEVICE(0x3582, &intel_i85x_info),
+-	INTEL_VGA_DEVICE(0x35e8, &intel_i85x_info),
++	INTEL_VGA_DEVICE(0x358e, &intel_i85x_info),
+ 	INTEL_VGA_DEVICE(0x2572, &intel_i865g_info),
+ 	INTEL_VGA_DEVICE(0x2582, &intel_i915g_info),
+ 	INTEL_VGA_DEVICE(0x258a, &intel_i915g_info),
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 0b33757..6679741 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -175,6 +175,7 @@ struct intel_overlay;
+ struct intel_device_info {
+ 	u8 is_mobile : 1;
+ 	u8 is_i8xx : 1;
++	u8 is_i85x : 1;
+ 	u8 is_i915g : 1;
+ 	u8 is_i9xx : 1;
+ 	u8 is_i945gm : 1;
+@@ -1027,7 +1028,7 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
+ 
+ #define IS_I830(dev)		((dev)->pci_device == 0x3577)
+ #define IS_845G(dev)		((dev)->pci_device == 0x2562)
+-#define IS_I85X(dev)		((dev)->pci_device == 0x3582)
++#define IS_I85X(dev)		(INTEL_INFO(dev)->is_i85x)
+ #define IS_I865G(dev)		((dev)->pci_device == 0x2572)
+ #define IS_GEN2(dev)		(INTEL_INFO(dev)->is_i8xx)
+ #define IS_I915G(dev)		(INTEL_INFO(dev)->is_i915g)
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index c00c978..4a44de4 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -2641,6 +2641,14 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
+ 		return -EINVAL;
+ 	}
+ 
++	/* If the object is bigger than the entire aperture, reject it early
++	 * before evicting everything in a vain attempt to find space.
++	 */
++	if (obj->size > dev->gtt_total) {
++		DRM_ERROR("Attempting to bind an object larger than the aperture\n");
++		return -E2BIG;
++	}
++
+  search_free:
+ 	free_space = drm_mm_search_free(&dev_priv->mm.gtt_space,
+ 					obj->size, alignment, 0);
+@@ -4175,6 +4183,17 @@ i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
+ 	int ret;
+ 
+ 	i915_verify_inactive(dev, __FILE__, __LINE__);
++
++	if (obj_priv->gtt_space != NULL) {
++		if (alignment == 0)
++			alignment = i915_gem_get_gtt_alignment(obj);
++		if (obj_priv->gtt_offset & (alignment - 1)) {
++			ret = i915_gem_object_unbind(obj);
++			if (ret)
++				return ret;
++		}
++	}
++
+ 	if (obj_priv->gtt_space == NULL) {
+ 		ret = i915_gem_object_bind_to_gtt(obj, alignment);
+ 		if (ret)
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index 4d88315..ff02664 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -514,6 +514,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
+ 			}
+ 
+ 			/* look up gpio for ddc, hpd */
++			ddc_bus.valid = false;
++			hpd.hpd = RADEON_HPD_NONE;
+ 			if ((le16_to_cpu(path->usDeviceTag) &
+ 			     (ATOM_DEVICE_TV_SUPPORT | ATOM_DEVICE_CV_SUPPORT)) == 0) {
+ 				for (j = 0; j < con_obj->ucNumberOfObjects; j++) {
+@@ -569,9 +571,6 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
+ 						break;
+ 					}
+ 				}
+-			} else {
+-				hpd.hpd = RADEON_HPD_NONE;
+-				ddc_bus.valid = false;
+ 			}
+ 
+ 			conn_id = le16_to_cpu(path->usConnObjectId);
+@@ -1137,7 +1136,7 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct
+ 		lvds->native_mode.vtotal = lvds->native_mode.vdisplay +
+ 			le16_to_cpu(lvds_info->info.sLCDTiming.usVBlanking_Time);
+ 		lvds->native_mode.vsync_start = lvds->native_mode.vdisplay +
+-			le16_to_cpu(lvds_info->info.sLCDTiming.usVSyncWidth);
++			le16_to_cpu(lvds_info->info.sLCDTiming.usVSyncOffset);
+ 		lvds->native_mode.vsync_end = lvds->native_mode.vsync_start +
+ 			le16_to_cpu(lvds_info->info.sLCDTiming.usVSyncWidth);
+ 		lvds->panel_pwr_delay =
+diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
+index f129bbb..419630d 100644
+--- a/drivers/gpu/drm/radeon/radeon_cp.c
++++ b/drivers/gpu/drm/radeon/radeon_cp.c
+@@ -1646,6 +1646,7 @@ static int radeon_do_resume_cp(struct drm_device *dev, struct drm_file *file_pri
+ 	radeon_cp_load_microcode(dev_priv);
+ 	radeon_cp_init_ring_buffer(dev, dev_priv, file_priv);
+ 
++	dev_priv->have_z_offset = 0;
+ 	radeon_do_engine_reset(dev);
+ 	radeon_irq_set_state(dev, RADEON_SW_INT_ENABLE, 1);
+ 
+diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
+index c57ad60..ebaee61 100644
+--- a/drivers/gpu/drm/radeon/radeon_drv.h
++++ b/drivers/gpu/drm/radeon/radeon_drv.h
+@@ -268,6 +268,8 @@ typedef struct drm_radeon_private {
+ 
+ 	u32 scratch_ages[5];
+ 
++	int have_z_offset;
++
+ 	/* starting from here on, data is preserved accross an open */
+ 	uint32_t flags;		/* see radeon_chip_flags */
+ 	resource_size_t fb_aper_offset;
+diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
+index 067167c..16436bb 100644
+--- a/drivers/gpu/drm/radeon/radeon_state.c
++++ b/drivers/gpu/drm/radeon/radeon_state.c
+@@ -101,6 +101,7 @@ static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
+ 			DRM_ERROR("Invalid depth buffer offset\n");
+ 			return -EINVAL;
+ 		}
++		dev_priv->have_z_offset = 1;
+ 		break;
+ 
+ 	case RADEON_EMIT_PP_CNTL:
+@@ -876,6 +877,12 @@ static void radeon_cp_dispatch_clear(struct drm_device * dev,
+ 		if (tmp & RADEON_BACK)
+ 			flags |= RADEON_FRONT;
+ 	}
++	if (flags & (RADEON_DEPTH|RADEON_STENCIL)) {
++		if (!dev_priv->have_z_offset) {
++			printk_once(KERN_ERR "radeon: illegal depth clear request. Buggy mesa detected - please update.\n");
++			flags &= ~(RADEON_DEPTH | RADEON_STENCIL);
++		}
++	}
+ 
+ 	if (flags & (RADEON_FRONT | RADEON_BACK)) {
+ 
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 8455f3d..0a404db 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1305,6 +1305,7 @@ static const struct hid_device_id hid_blacklist[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, 0x0012) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_3) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
+diff --git a/drivers/hid/hid-gyration.c b/drivers/hid/hid-gyration.c
+index 62416e6..3975e03 100644
+--- a/drivers/hid/hid-gyration.c
++++ b/drivers/hid/hid-gyration.c
+@@ -73,6 +73,7 @@ static int gyration_event(struct hid_device *hdev, struct hid_field *field,
+ static const struct hid_device_id gyration_devices[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_3) },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(hid, gyration_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 793691f..5ec8a79 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -256,6 +256,7 @@
+ #define USB_VENDOR_ID_GYRATION		0x0c16
+ #define USB_DEVICE_ID_GYRATION_REMOTE	0x0002
+ #define USB_DEVICE_ID_GYRATION_REMOTE_2 0x0003
++#define USB_DEVICE_ID_GYRATION_REMOTE_3 0x0008
+ 
+ #define USB_VENDOR_ID_HAPP		0x078b
+ #define USB_DEVICE_ID_UGCI_DRIVING	0x0010
+diff --git a/drivers/hwmon/ltc4245.c b/drivers/hwmon/ltc4245.c
+index 65c232a..21d201b 100644
+--- a/drivers/hwmon/ltc4245.c
++++ b/drivers/hwmon/ltc4245.c
+@@ -45,9 +45,7 @@ enum ltc4245_cmd {
+ 	LTC4245_VEEIN			= 0x19,
+ 	LTC4245_VEESENSE		= 0x1a,
+ 	LTC4245_VEEOUT			= 0x1b,
+-	LTC4245_GPIOADC1		= 0x1c,
+-	LTC4245_GPIOADC2		= 0x1d,
+-	LTC4245_GPIOADC3		= 0x1e,
++	LTC4245_GPIOADC			= 0x1c,
+ };
+ 
+ struct ltc4245_data {
+@@ -61,7 +59,7 @@ struct ltc4245_data {
+ 	u8 cregs[0x08];
+ 
+ 	/* Voltage registers */
+-	u8 vregs[0x0f];
++	u8 vregs[0x0d];
+ };
+ 
+ static struct ltc4245_data *ltc4245_update_device(struct device *dev)
+@@ -86,7 +84,7 @@ static struct ltc4245_data *ltc4245_update_device(struct device *dev)
+ 				data->cregs[i] = val;
+ 		}
+ 
+-		/* Read voltage registers -- 0x10 to 0x1f */
++		/* Read voltage registers -- 0x10 to 0x1c */
+ 		for (i = 0; i < ARRAY_SIZE(data->vregs); i++) {
+ 			val = i2c_smbus_read_byte_data(client, i+0x10);
+ 			if (unlikely(val < 0))
+@@ -128,9 +126,7 @@ static int ltc4245_get_voltage(struct device *dev, u8 reg)
+ 	case LTC4245_VEEOUT:
+ 		voltage = regval * -55;
+ 		break;
+-	case LTC4245_GPIOADC1:
+-	case LTC4245_GPIOADC2:
+-	case LTC4245_GPIOADC3:
++	case LTC4245_GPIOADC:
+ 		voltage = regval * 10;
+ 		break;
+ 	default:
+@@ -297,9 +293,7 @@ LTC4245_ALARM(in7_min_alarm,	(1 << 2),	LTC4245_FAULT2);
+ LTC4245_ALARM(in8_min_alarm,	(1 << 3),	LTC4245_FAULT2);
+ 
+ /* GPIO voltages */
+-LTC4245_VOLTAGE(in9_input,			LTC4245_GPIOADC1);
+-LTC4245_VOLTAGE(in10_input,			LTC4245_GPIOADC2);
+-LTC4245_VOLTAGE(in11_input,			LTC4245_GPIOADC3);
++LTC4245_VOLTAGE(in9_input,			LTC4245_GPIOADC);
+ 
+ /* Power Consumption (virtual) */
+ LTC4245_POWER(power1_input,			LTC4245_12VSENSE);
+@@ -342,8 +336,6 @@ static struct attribute *ltc4245_attributes[] = {
+ 	&sensor_dev_attr_in8_min_alarm.dev_attr.attr,
+ 
+ 	&sensor_dev_attr_in9_input.dev_attr.attr,
+-	&sensor_dev_attr_in10_input.dev_attr.attr,
+-	&sensor_dev_attr_in11_input.dev_attr.attr,
+ 
+ 	&sensor_dev_attr_power1_input.dev_attr.attr,
+ 	&sensor_dev_attr_power2_input.dev_attr.attr,
+diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
+index d8c0c8d..6cda023 100644
+--- a/drivers/input/mouse/psmouse-base.c
++++ b/drivers/input/mouse/psmouse-base.c
+@@ -1382,6 +1382,7 @@ static int psmouse_reconnect(struct serio *serio)
+ 	struct psmouse *psmouse = serio_get_drvdata(serio);
+ 	struct psmouse *parent = NULL;
+ 	struct serio_driver *drv = serio->drv;
++	unsigned char type;
+ 	int rc = -1;
+ 
+ 	if (!drv || !psmouse) {
+@@ -1401,10 +1402,15 @@ static int psmouse_reconnect(struct serio *serio)
+ 	if (psmouse->reconnect) {
+ 		if (psmouse->reconnect(psmouse))
+ 			goto out;
+-	} else if (psmouse_probe(psmouse) < 0 ||
+-		   psmouse->type != psmouse_extensions(psmouse,
+-						psmouse_max_proto, false)) {
+-		goto out;
++	} else {
++		psmouse_reset(psmouse);
++
++		if (psmouse_probe(psmouse) < 0)
++			goto out;
++
++		type = psmouse_extensions(psmouse, psmouse_max_proto, false);
++		if (psmouse->type != type)
++			goto out;
+ 	}
+ 
+ 	/* ok, the device type (and capabilities) match the old one,
+diff --git a/drivers/md/linear.c b/drivers/md/linear.c
+index 001317b..12f4acb 100644
+--- a/drivers/md/linear.c
++++ b/drivers/md/linear.c
+@@ -281,6 +281,7 @@ static int linear_stop (mddev_t *mddev)
+ 	rcu_barrier();
+ 	blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
+ 	kfree(conf);
++	mddev->private = NULL;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 2ecd1d5..ec10d74 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -507,9 +507,36 @@ static inline int mddev_trylock(mddev_t * mddev)
+ 	return mutex_trylock(&mddev->reconfig_mutex);
+ }
+ 
+-static inline void mddev_unlock(mddev_t * mddev)
+-{
+-	mutex_unlock(&mddev->reconfig_mutex);
++static struct attribute_group md_redundancy_group;
++
++static void mddev_unlock(mddev_t * mddev)
++{
++	if (mddev->to_remove) {
++		/* These cannot be removed under reconfig_mutex as
++		 * an access to the files will try to take reconfig_mutex
++		 * while holding the file unremovable, which leads to
++		 * a deadlock.
++		 * So hold open_mutex instead - we are allowed to take
++		 * it while holding reconfig_mutex, and md_run can
++		 * use it to wait for the remove to complete.
++		 */
++		struct attribute_group *to_remove = mddev->to_remove;
++		mddev->to_remove = NULL;
++		mutex_lock(&mddev->open_mutex);
++		mutex_unlock(&mddev->reconfig_mutex);
++
++		if (to_remove != &md_redundancy_group)
++			sysfs_remove_group(&mddev->kobj, to_remove);
++		if (mddev->pers == NULL ||
++		    mddev->pers->sync_request == NULL) {
++			sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
++			if (mddev->sysfs_action)
++				sysfs_put(mddev->sysfs_action);
++			mddev->sysfs_action = NULL;
++		}
++		mutex_unlock(&mddev->open_mutex);
++	} else
++		mutex_unlock(&mddev->reconfig_mutex);
+ 
+ 	md_wakeup_thread(mddev->thread);
+ }
+@@ -2979,6 +3006,23 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
+ 	/* Looks like we have a winner */
+ 	mddev_suspend(mddev);
+ 	mddev->pers->stop(mddev);
++
++	if (mddev->pers->sync_request == NULL &&
++	    pers->sync_request != NULL) {
++		/* need to add the md_redundancy_group */
++		if (sysfs_create_group(&mddev->kobj, &md_redundancy_group))
++			printk(KERN_WARNING
++			       "md: cannot register extra attributes for %s\n",
++			       mdname(mddev));
++		mddev->sysfs_action = sysfs_get_dirent(mddev->kobj.sd, "sync_action");
++	}
++	if (mddev->pers->sync_request != NULL &&
++	    pers->sync_request == NULL) {
++		/* need to remove the md_redundancy_group */
++		if (mddev->to_remove == NULL)
++			mddev->to_remove = &md_redundancy_group;
++	}
++
+ 	module_put(mddev->pers->owner);
+ 	/* Invalidate devices that are now superfluous */
+ 	list_for_each_entry(rdev, &mddev->disks, same_set)
+@@ -4081,15 +4125,6 @@ static void mddev_delayed_delete(struct work_struct *ws)
+ {
+ 	mddev_t *mddev = container_of(ws, mddev_t, del_work);
+ 
+-	if (mddev->private) {
+-		sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
+-		if (mddev->private != (void*)1)
+-			sysfs_remove_group(&mddev->kobj, mddev->private);
+-		if (mddev->sysfs_action)
+-			sysfs_put(mddev->sysfs_action);
+-		mddev->sysfs_action = NULL;
+-		mddev->private = NULL;
+-	}
+ 	sysfs_remove_group(&mddev->kobj, &md_bitmap_group);
+ 	kobject_del(&mddev->kobj);
+ 	kobject_put(&mddev->kobj);
+@@ -4247,6 +4282,13 @@ static int do_md_run(mddev_t * mddev)
+ 	if (mddev->pers)
+ 		return -EBUSY;
+ 
++	/* These two calls synchronise us with the
++	 * sysfs_remove_group calls in mddev_unlock,
++	 * so they must have completed.
++	 */
++	mutex_lock(&mddev->open_mutex);
++	mutex_unlock(&mddev->open_mutex);
++
+ 	/*
+ 	 * Analyze all RAID superblock(s)
+ 	 */
+@@ -4535,8 +4577,8 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
+ 			mddev->queue->unplug_fn = NULL;
+ 			mddev->queue->backing_dev_info.congested_fn = NULL;
+ 			module_put(mddev->pers->owner);
+-			if (mddev->pers->sync_request && mddev->private == NULL)
+-				mddev->private = (void*)1;
++			if (mddev->pers->sync_request && mddev->to_remove == NULL)
++				mddev->to_remove = &md_redundancy_group;
+ 			mddev->pers = NULL;
+ 			/* tell userspace to handle 'inactive' */
+ 			sysfs_notify_dirent(mddev->sysfs_state);
+@@ -5495,6 +5537,7 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,
+ 	int err = 0;
+ 	void __user *argp = (void __user *)arg;
+ 	mddev_t *mddev = NULL;
++	int ro;
+ 
+ 	if (!capable(CAP_SYS_ADMIN))
+ 		return -EACCES;
+@@ -5630,6 +5673,34 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,
+ 			err = do_md_stop(mddev, 1, 1);
+ 			goto done_unlock;
+ 
++		case BLKROSET:
++			if (get_user(ro, (int __user *)(arg))) {
++				err = -EFAULT;
++				goto done_unlock;
++			}
++			err = -EINVAL;
++
++			/* if the bdev is going readonly the value of mddev->ro
++			 * does not matter, no writes are coming
++			 */
++			if (ro)
++				goto done_unlock;
++
++			/* are we are already prepared for writes? */
++			if (mddev->ro != 1)
++				goto done_unlock;
++
++			/* transitioning to readauto need only happen for
++			 * arrays that call md_write_start
++			 */
++			if (mddev->pers) {
++				err = restart_array(mddev);
++				if (err == 0) {
++					mddev->ro = 2;
++					set_disk_ro(mddev->gendisk, 0);
++				}
++			}
++			goto done_unlock;
+ 	}
+ 
+ 	/*
+diff --git a/drivers/md/md.h b/drivers/md/md.h
+index 8e4c75c..722f5df 100644
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -305,6 +305,7 @@ struct mddev_s
+ 	atomic_t 			max_corr_read_errors; /* max read retries */
+ 	struct list_head		all_mddevs;
+ 
++	struct attribute_group		*to_remove;
+ 	/* Generic barrier handling.
+ 	 * If there is a pending barrier request, all other
+ 	 * writes are blocked while the devices are flushed.
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 859bd3f..db2de5a 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -417,7 +417,7 @@ static void raid1_end_write_request(struct bio *bio, int error)
+  */
+ static int read_balance(conf_t *conf, r1bio_t *r1_bio)
+ {
+-	const unsigned long this_sector = r1_bio->sector;
++	const sector_t this_sector = r1_bio->sector;
+ 	int new_disk = conf->last_used, disk = new_disk;
+ 	int wonly_disk = -1;
+ 	const int sectors = r1_bio->sectors;
+@@ -433,7 +433,7 @@ static int read_balance(conf_t *conf, r1bio_t *r1_bio)
+  retry:
+ 	if (conf->mddev->recovery_cp < MaxSector &&
+ 	    (this_sector + sectors >= conf->next_resync)) {
+-		/* Choose the first operation device, for consistancy */
++		/* Choose the first operational device, for consistancy */
+ 		new_disk = 0;
+ 
+ 		for (rdev = rcu_dereference(conf->mirrors[new_disk].rdev);
+@@ -911,9 +911,10 @@ static int make_request(struct request_queue *q, struct bio * bio)
+ 			if (test_bit(Faulty, &rdev->flags)) {
+ 				rdev_dec_pending(rdev, mddev);
+ 				r1_bio->bios[i] = NULL;
+-			} else
++			} else {
+ 				r1_bio->bios[i] = bio;
+-			targets++;
++				targets++;
++			}
+ 		} else
+ 			r1_bio->bios[i] = NULL;
+ 	}
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 047c468..5fb1ad6 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -493,7 +493,7 @@ static int raid10_mergeable_bvec(struct request_queue *q,
+  */
+ static int read_balance(conf_t *conf, r10bio_t *r10_bio)
+ {
+-	const unsigned long this_sector = r10_bio->sector;
++	const sector_t this_sector = r10_bio->sector;
+ 	int disk, slot, nslot;
+ 	const int sectors = r10_bio->sectors;
+ 	sector_t new_distance, current_distance;
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 0468f5b..105a3dc 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -5086,7 +5086,9 @@ static int run(mddev_t *mddev)
+ 	}
+ 
+ 	/* Ok, everything is just fine now */
+-	if (sysfs_create_group(&mddev->kobj, &raid5_attrs_group))
++	if (mddev->to_remove == &raid5_attrs_group)
++		mddev->to_remove = NULL;
++	else if (sysfs_create_group(&mddev->kobj, &raid5_attrs_group))
+ 		printk(KERN_WARNING
+ 		       "raid5: failed to create sysfs attributes for %s\n",
+ 		       mdname(mddev));
+@@ -5133,7 +5135,8 @@ static int stop(mddev_t *mddev)
+ 	mddev->queue->backing_dev_info.congested_fn = NULL;
+ 	blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
+ 	free_conf(conf);
+-	mddev->private = &raid5_attrs_group;
++	mddev->private = NULL;
++	mddev->to_remove = &raid5_attrs_group;
+ 	return 0;
+ }
+ 
+diff --git a/drivers/media/video/gspca/stv06xx/stv06xx.c b/drivers/media/video/gspca/stv06xx/stv06xx.c
+index 5d0241b..06e0e86 100644
+--- a/drivers/media/video/gspca/stv06xx/stv06xx.c
++++ b/drivers/media/video/gspca/stv06xx/stv06xx.c
+@@ -496,8 +496,6 @@ static const __devinitdata struct usb_device_id device_table[] = {
+ 	{USB_DEVICE(0x046D, 0x08F5), .driver_info = BRIDGE_ST6422 },
+ 	/* QuickCam Messenger (new) */
+ 	{USB_DEVICE(0x046D, 0x08F6), .driver_info = BRIDGE_ST6422 },
+-	/* QuickCam Messenger (new) */
+-	{USB_DEVICE(0x046D, 0x08DA), .driver_info = BRIDGE_ST6422 },
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(usb, device_table);
+diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
+index dbf4de3..69698e5 100644
+--- a/drivers/net/arcnet/com20020-pci.c
++++ b/drivers/net/arcnet/com20020-pci.c
+@@ -165,8 +165,8 @@ static struct pci_device_id com20020pci_id_table[] = {
+ 	{ 0x1571, 0xa204, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT },
+ 	{ 0x1571, 0xa205, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT },
+ 	{ 0x1571, 0xa206, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT },
+-	{ 0x10B5, 0x9030, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT },
+-	{ 0x10B5, 0x9050, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT },
++	{ 0x10B5, 0x9030, 0x10B5,     0x2978,     0, 0, ARC_CAN_10MBIT },
++	{ 0x10B5, 0x9050, 0x10B5,     0x2273,     0, 0, ARC_CAN_10MBIT },
+ 	{ 0x14BA, 0x6000, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT },
+ 	{ 0x10B5, 0x2200, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT },
+ 	{0,}
+diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
+index 542a4f7..2ee19d1 100644
+--- a/drivers/net/can/sja1000/sja1000.c
++++ b/drivers/net/can/sja1000/sja1000.c
+@@ -84,6 +84,20 @@ static struct can_bittiming_const sja1000_bittiming_const = {
+ 	.brp_inc = 1,
+ };
+ 
++static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val)
++{
++	unsigned long flags;
++
++	/*
++	 * The command register needs some locking and time to settle
++	 * the write_reg() operation - especially on SMP systems.
++	 */
++	spin_lock_irqsave(&priv->cmdreg_lock, flags);
++	priv->write_reg(priv, REG_CMR, val);
++	priv->read_reg(priv, REG_SR);
++	spin_unlock_irqrestore(&priv->cmdreg_lock, flags);
++}
++
+ static int sja1000_probe_chip(struct net_device *dev)
+ {
+ 	struct sja1000_priv *priv = netdev_priv(dev);
+@@ -279,7 +293,7 @@ static netdev_tx_t sja1000_start_xmit(struct sk_buff *skb,
+ 
+ 	can_put_echo_skb(skb, dev, 0);
+ 
+-	priv->write_reg(priv, REG_CMR, CMD_TR);
++	sja1000_write_cmdreg(priv, CMD_TR);
+ 
+ 	return NETDEV_TX_OK;
+ }
+@@ -328,7 +342,7 @@ static void sja1000_rx(struct net_device *dev)
+ 	cf->can_id = id;
+ 
+ 	/* release receive buffer */
+-	priv->write_reg(priv, REG_CMR, CMD_RRB);
++	sja1000_write_cmdreg(priv, CMD_RRB);
+ 
+ 	netif_rx(skb);
+ 
+@@ -356,7 +370,7 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status)
+ 		cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
+ 		stats->rx_over_errors++;
+ 		stats->rx_errors++;
+-		priv->write_reg(priv, REG_CMR, CMD_CDO);	/* clear bit */
++		sja1000_write_cmdreg(priv, CMD_CDO);	/* clear bit */
+ 	}
+ 
+ 	if (isrc & IRQ_EI) {
+diff --git a/drivers/net/can/sja1000/sja1000.h b/drivers/net/can/sja1000/sja1000.h
+index 97a622b..de8e778 100644
+--- a/drivers/net/can/sja1000/sja1000.h
++++ b/drivers/net/can/sja1000/sja1000.h
+@@ -167,6 +167,7 @@ struct sja1000_priv {
+ 
+ 	void __iomem *reg_base;	 /* ioremap'ed address to registers */
+ 	unsigned long irq_flags; /* for request_irq() */
++	spinlock_t cmdreg_lock;  /* lock for concurrent cmd register writes */
+ 
+ 	u16 flags;		/* custom mode flags */
+ 	u8 ocr;			/* output control register */
+diff --git a/drivers/net/mlx4/icm.c b/drivers/net/mlx4/icm.c
+index 04b382f..83eef8e 100644
+--- a/drivers/net/mlx4/icm.c
++++ b/drivers/net/mlx4/icm.c
+@@ -174,9 +174,10 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
+ 
+ 				if (chunk->nsg <= 0)
+ 					goto fail;
++			}
+ 
++			if (chunk->npages == MLX4_ICM_CHUNK_LEN)
+ 				chunk = NULL;
+-			}
+ 
+ 			npages -= 1 << cur_order;
+ 		} else {
+diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
+index 449a982..8015310 100644
+--- a/drivers/net/pppol2tp.c
++++ b/drivers/net/pppol2tp.c
+@@ -977,7 +977,8 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
+ 	/* Calculate UDP checksum if configured to do so */
+ 	if (sk_tun->sk_no_check == UDP_CSUM_NOXMIT)
+ 		skb->ip_summed = CHECKSUM_NONE;
+-	else if (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM)) {
++	else if ((skb_dst(skb) && skb_dst(skb)->dev) &&
++		 (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) {
+ 		skb->ip_summed = CHECKSUM_COMPLETE;
+ 		csum = skb_checksum(skb, 0, udp_len, 0);
+ 		uh->check = csum_tcpudp_magic(inet->inet_saddr,
+diff --git a/drivers/net/wireless/ath/ar9170/hw.h b/drivers/net/wireless/ath/ar9170/hw.h
+index 701ddb7..5e7e1bd 100644
+--- a/drivers/net/wireless/ath/ar9170/hw.h
++++ b/drivers/net/wireless/ath/ar9170/hw.h
+@@ -424,5 +424,6 @@ enum ar9170_txq {
+ 
+ #define AR9170_TXQ_DEPTH	32
+ #define AR9170_TX_MAX_PENDING	128
++#define AR9170_RX_STREAM_MAX_SIZE 65535
+ 
+ #endif /* __AR9170_HW_H */
+diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
+index f9d6db8..9ea9845 100644
+--- a/drivers/net/wireless/ath/ar9170/main.c
++++ b/drivers/net/wireless/ath/ar9170/main.c
+@@ -2538,7 +2538,7 @@ void *ar9170_alloc(size_t priv_size)
+ 	 * tends to split the streams into seperate rx descriptors.
+ 	 */
+ 
+-	skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL);
++	skb = __dev_alloc_skb(AR9170_RX_STREAM_MAX_SIZE, GFP_KERNEL);
+ 	if (!skb)
+ 		goto err_nomem;
+ 
+diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
+index 0387658..db541d4 100644
+--- a/drivers/net/wireless/ath/ar9170/usb.c
++++ b/drivers/net/wireless/ath/ar9170/usb.c
+@@ -66,18 +66,28 @@ static struct usb_device_id ar9170_usb_ids[] = {
+ 	{ USB_DEVICE(0x0cf3, 0x1001) },
+ 	/* TP-Link TL-WN821N v2 */
+ 	{ USB_DEVICE(0x0cf3, 0x1002) },
++	/* 3Com Dual Band 802.11n USB Adapter */
++	{ USB_DEVICE(0x0cf3, 0x1010) },
++	/* H3C Dual Band 802.11n USB Adapter */
++	{ USB_DEVICE(0x0cf3, 0x1011) },
+ 	/* Cace Airpcap NX */
+ 	{ USB_DEVICE(0xcace, 0x0300) },
+ 	/* D-Link DWA 160 A1 */
+ 	{ USB_DEVICE(0x07d1, 0x3c10) },
+ 	/* D-Link DWA 160 A2 */
+ 	{ USB_DEVICE(0x07d1, 0x3a09) },
++	/* Netgear WNA1000 */
++	{ USB_DEVICE(0x0846, 0x9040) },
+ 	/* Netgear WNDA3100 */
+ 	{ USB_DEVICE(0x0846, 0x9010) },
+ 	/* Netgear WN111 v2 */
+ 	{ USB_DEVICE(0x0846, 0x9001) },
+ 	/* Zydas ZD1221 */
+ 	{ USB_DEVICE(0x0ace, 0x1221) },
++	/* Proxim ORiNOCO 802.11n USB */
++	{ USB_DEVICE(0x1435, 0x0804) },
++	/* WNC Generic 11n USB Dongle */
++	{ USB_DEVICE(0x1435, 0x0326) },
+ 	/* ZyXEL NWD271N */
+ 	{ USB_DEVICE(0x0586, 0x3417) },
+ 	/* Z-Com UB81 BG */
+diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
+index ced648b..d377809 100644
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -1210,6 +1210,7 @@ ath5k_rxbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
+ 	struct ath5k_hw *ah = sc->ah;
+ 	struct sk_buff *skb = bf->skb;
+ 	struct ath5k_desc *ds;
++	int ret;
+ 
+ 	if (!skb) {
+ 		skb = ath5k_rx_skb_alloc(sc, &bf->skbaddr);
+@@ -1236,9 +1237,9 @@ ath5k_rxbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
+ 	ds = bf->desc;
+ 	ds->ds_link = bf->daddr;	/* link to self */
+ 	ds->ds_data = bf->skbaddr;
+-	ah->ah_setup_rx_desc(ah, ds,
+-		skb_tailroom(skb),	/* buffer size */
+-		0);
++	ret = ah->ah_setup_rx_desc(ah, ds, ah->common.rx_bufsize, 0);
++	if (ret)
++		return ret;
+ 
+ 	if (sc->rxlink != NULL)
+ 		*sc->rxlink = bf->daddr;
+@@ -2996,13 +2997,15 @@ static void ath5k_configure_filter(struct ieee80211_hw *hw,
+ 
+ 	if (changed_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS)) {
+ 		if (*new_flags & FIF_PROMISC_IN_BSS) {
+-			rfilt |= AR5K_RX_FILTER_PROM;
+ 			__set_bit(ATH_STAT_PROMISC, sc->status);
+ 		} else {
+ 			__clear_bit(ATH_STAT_PROMISC, sc->status);
+ 		}
+ 	}
+ 
++	if (test_bit(ATH_STAT_PROMISC, sc->status))
++		rfilt |= AR5K_RX_FILTER_PROM;
++
+ 	/* Note, AR5K_RX_FILTER_MCAST is already enabled */
+ 	if (*new_flags & FIF_ALLMULTI) {
+ 		mfilt[0] =  ~0;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+index 3534d86..2423068 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+@@ -2083,10 +2083,12 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
+ 	}
+ 	/* Else we have enough samples; calculate estimate of
+ 	 * actual average throughput */
+-
+-	/* Sanity-check TPT calculations */
+-	BUG_ON(window->average_tpt != ((window->success_ratio *
+-			tbl->expected_tpt[index] + 64) / 128));
++	if (window->average_tpt != ((window->success_ratio *
++			tbl->expected_tpt[index] + 64) / 128)) {
++		IWL_ERR(priv, "expected_tpt should have been calculated by now\n");
++		window->average_tpt = ((window->success_ratio *
++					tbl->expected_tpt[index] + 64) / 128);
++	}
+ 
+ 	/* If we are searching for better modulation mode, check success. */
+ 	if (lq_sta->search_better_tbl &&
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
+index 5622a55..664dcd5 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -3365,6 +3365,14 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	 */
+ 	spin_lock_init(&priv->reg_lock);
+ 	spin_lock_init(&priv->lock);
++
++	/*
++	 * stop and reset the on-board processor just in case it is in a
++	 * strange state ... like being left stranded by a primary kernel
++	 * and this is now the kdump kernel trying to start up
++	 */
++	iwl_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
++
+ 	iwl_hw_detect(priv);
+ 	IWL_INFO(priv, "Detected Intel Wireless WiFi Link %s REV=0x%X\n",
+ 		priv->cfg->name, priv->hw_rev);
+diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+index adbb3ea..ca0fb8b 100644
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -4022,6 +4022,13 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
+ 	spin_lock_init(&priv->reg_lock);
+ 	spin_lock_init(&priv->lock);
+ 
++	/*
++	 * stop and reset the on-board processor just in case it is in a
++	 * strange state ... like being left stranded by a primary kernel
++	 * and this is now the kdump kernel trying to start up
++	 */
++	iwl_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
++
+ 	/***********************
+ 	 * 4. Read EEPROM
+ 	 * ********************/
+diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
+index b3c4fbd..805284d 100644
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -78,6 +78,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
+ 	{USB_DEVICE(0x1413, 0x5400)},   /* Telsey 802.11g USB2.0 Adapter */
+ 	{USB_DEVICE(0x1435, 0x0427)},	/* Inventel UR054G */
+ 	{USB_DEVICE(0x2001, 0x3704)},	/* DLink DWL-G122 rev A2 */
++	{USB_DEVICE(0x413c, 0x5513)},	/* Dell WLA3310 USB Wireless Adapter */
+ 	{USB_DEVICE(0x413c, 0x8102)},	/* Spinnaker DUT */
+ 	{USB_DEVICE(0x413c, 0x8104)},	/* Cohiba Proto board */
+ 	{}
+diff --git a/drivers/net/wireless/rtl818x/rtl8180_dev.c b/drivers/net/wireless/rtl818x/rtl8180_dev.c
+index 8a40a14..77b7657 100644
+--- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
++++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
+@@ -189,6 +189,7 @@ static void rtl8180_handle_tx(struct ieee80211_hw *dev, unsigned int prio)
+ 			info->flags |= IEEE80211_TX_STAT_ACK;
+ 
+ 		info->status.rates[0].count = (flags & 0xFF) + 1;
++		info->status.rates[1].idx = -1;
+ 
+ 		ieee80211_tx_status_irqsafe(dev, skb);
+ 		if (ring->entries - skb_queue_len(&ring->queue) == 2)
+diff --git a/drivers/net/wireless/wl12xx/wl1251_sdio.c b/drivers/net/wireless/wl12xx/wl1251_sdio.c
+index 9423f22..d74b89b 100644
+--- a/drivers/net/wireless/wl12xx/wl1251_sdio.c
++++ b/drivers/net/wireless/wl12xx/wl1251_sdio.c
+@@ -160,6 +160,7 @@ disable:
+ 	sdio_disable_func(func);
+ release:
+ 	sdio_release_host(func);
++	wl1251_free_hw(wl);
+ 	return ret;
+ }
+ 
+diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c
+index 166b67e..de82183 100644
+--- a/drivers/oprofile/cpu_buffer.c
++++ b/drivers/oprofile/cpu_buffer.c
+@@ -30,23 +30,7 @@
+ 
+ #define OP_BUFFER_FLAGS	0
+ 
+-/*
+- * Read and write access is using spin locking. Thus, writing to the
+- * buffer by NMI handler (x86) could occur also during critical
+- * sections when reading the buffer. To avoid this, there are 2
+- * buffers for independent read and write access. Read access is in
+- * process context only, write access only in the NMI handler. If the
+- * read buffer runs empty, both buffers are swapped atomically. There
+- * is potentially a small window during swapping where the buffers are
+- * disabled and samples could be lost.
+- *
+- * Using 2 buffers is a little bit overhead, but the solution is clear
+- * and does not require changes in the ring buffer implementation. It
+- * can be changed to a single buffer solution when the ring buffer
+- * access is implemented as non-locking atomic code.
+- */
+-static struct ring_buffer *op_ring_buffer_read;
+-static struct ring_buffer *op_ring_buffer_write;
++static struct ring_buffer *op_ring_buffer;
+ DEFINE_PER_CPU(struct oprofile_cpu_buffer, op_cpu_buffer);
+ 
+ static void wq_sync_buffer(struct work_struct *work);
+@@ -68,12 +52,9 @@ void oprofile_cpu_buffer_inc_smpl_lost(void)
+ 
+ void free_cpu_buffers(void)
+ {
+-	if (op_ring_buffer_read)
+-		ring_buffer_free(op_ring_buffer_read);
+-	op_ring_buffer_read = NULL;
+-	if (op_ring_buffer_write)
+-		ring_buffer_free(op_ring_buffer_write);
+-	op_ring_buffer_write = NULL;
++	if (op_ring_buffer)
++		ring_buffer_free(op_ring_buffer);
++	op_ring_buffer = NULL;
+ }
+ 
+ #define RB_EVENT_HDR_SIZE 4
+@@ -86,11 +67,8 @@ int alloc_cpu_buffers(void)
+ 	unsigned long byte_size = buffer_size * (sizeof(struct op_sample) +
+ 						 RB_EVENT_HDR_SIZE);
+ 
+-	op_ring_buffer_read = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS);
+-	if (!op_ring_buffer_read)
+-		goto fail;
+-	op_ring_buffer_write = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS);
+-	if (!op_ring_buffer_write)
++	op_ring_buffer = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS);
++	if (!op_ring_buffer)
+ 		goto fail;
+ 
+ 	for_each_possible_cpu(i) {
+@@ -162,16 +140,11 @@ struct op_sample
+ *op_cpu_buffer_write_reserve(struct op_entry *entry, unsigned long size)
+ {
+ 	entry->event = ring_buffer_lock_reserve
+-		(op_ring_buffer_write, sizeof(struct op_sample) +
++		(op_ring_buffer, sizeof(struct op_sample) +
+ 		 size * sizeof(entry->sample->data[0]));
+-	if (entry->event)
+-		entry->sample = ring_buffer_event_data(entry->event);
+-	else
+-		entry->sample = NULL;
+-
+-	if (!entry->sample)
++	if (!entry->event)
+ 		return NULL;
+-
++	entry->sample = ring_buffer_event_data(entry->event);
+ 	entry->size = size;
+ 	entry->data = entry->sample->data;
+ 
+@@ -180,25 +153,16 @@ struct op_sample
+ 
+ int op_cpu_buffer_write_commit(struct op_entry *entry)
+ {
+-	return ring_buffer_unlock_commit(op_ring_buffer_write, entry->event);
++	return ring_buffer_unlock_commit(op_ring_buffer, entry->event);
+ }
+ 
+ struct op_sample *op_cpu_buffer_read_entry(struct op_entry *entry, int cpu)
+ {
+ 	struct ring_buffer_event *e;
+-	e = ring_buffer_consume(op_ring_buffer_read, cpu, NULL);
+-	if (e)
+-		goto event;
+-	if (ring_buffer_swap_cpu(op_ring_buffer_read,
+-				 op_ring_buffer_write,
+-				 cpu))
++	e = ring_buffer_consume(op_ring_buffer, cpu, NULL);
++	if (!e)
+ 		return NULL;
+-	e = ring_buffer_consume(op_ring_buffer_read, cpu, NULL);
+-	if (e)
+-		goto event;
+-	return NULL;
+ 
+-event:
+ 	entry->event = e;
+ 	entry->sample = ring_buffer_event_data(e);
+ 	entry->size = (ring_buffer_event_length(e) - sizeof(struct op_sample))
+@@ -209,8 +173,7 @@ event:
+ 
+ unsigned long op_cpu_buffer_entries(int cpu)
+ {
+-	return ring_buffer_entries_cpu(op_ring_buffer_read, cpu)
+-		+ ring_buffer_entries_cpu(op_ring_buffer_write, cpu);
++	return ring_buffer_entries_cpu(op_ring_buffer, cpu);
+ }
+ 
+ static int
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 456c265..197e38f 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1461,7 +1461,8 @@ static void quirk_jmicron_ata(struct pci_dev *pdev)
+ 	conf5 &= ~(1 << 24);  /* Clear bit 24 */
+ 
+ 	switch (pdev->device) {
+-	case PCI_DEVICE_ID_JMICRON_JMB360:
++	case PCI_DEVICE_ID_JMICRON_JMB360: /* SATA single port */
++	case PCI_DEVICE_ID_JMICRON_JMB362: /* SATA dual ports */
+ 		/* The controller should be in single function ahci mode */
+ 		conf1 |= 0x0002A100; /* Set 8, 13, 15, 17 */
+ 		break;
+@@ -1497,12 +1498,14 @@ static void quirk_jmicron_ata(struct pci_dev *pdev)
+ }
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB360, quirk_jmicron_ata);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, quirk_jmicron_ata);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB362, quirk_jmicron_ata);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, quirk_jmicron_ata);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, quirk_jmicron_ata);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, quirk_jmicron_ata);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368, quirk_jmicron_ata);
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB360, quirk_jmicron_ata);
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, quirk_jmicron_ata);
++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB362, quirk_jmicron_ata);
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, quirk_jmicron_ata);
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, quirk_jmicron_ata);
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, quirk_jmicron_ata);
+@@ -2113,6 +2116,8 @@ static void __devinit quirk_disable_msi(struct pci_dev *dev)
+ 	}
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi);
+ 
+ /* Go through the list of Hypertransport capabilities and
+  * return 1 if a HT MSI capability is found and enabled */
+@@ -2204,15 +2209,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SERVERWORKS,
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8132_BRIDGE,
+ 			 ht_enable_msi_mapping);
+ 
+-/* The P5N32-SLI Premium motherboard from Asus has a problem with msi
++/* The P5N32-SLI motherboards from Asus have a problem with msi
+  * for the MCP55 NIC. It is not yet determined whether the msi problem
+  * also affects other devices. As for now, turn off msi for this device.
+  */
+ static void __devinit nvenet_msi_disable(struct pci_dev *dev)
+ {
+-	if (dmi_name_in_vendors("P5N32-SLI PREMIUM")) {
++	if (dmi_name_in_vendors("P5N32-SLI PREMIUM") ||
++	    dmi_name_in_vendors("P5N32-E SLI")) {
+ 		dev_info(&dev->dev,
+-			 "Disabling msi for MCP55 NIC on P5N32-SLI Premium\n");
++			 "Disabling msi for MCP55 NIC on P5N32-SLI\n");
+ 		dev->no_msi = 1;
+ 	}
+ }
+diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
+index 6a47bb7..9a844ca 100644
+--- a/drivers/platform/x86/eeepc-laptop.c
++++ b/drivers/platform/x86/eeepc-laptop.c
+@@ -578,6 +578,8 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc)
+ 	struct pci_dev *dev;
+ 	struct pci_bus *bus;
+ 	bool blocked = eeepc_wlan_rfkill_blocked(eeepc);
++	bool absent;
++	u32 l;
+ 
+ 	if (eeepc->wlan_rfkill)
+ 		rfkill_set_sw_state(eeepc->wlan_rfkill, blocked);
+@@ -591,6 +593,22 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc)
+ 			goto out_unlock;
+ 		}
+ 
++		if (pci_bus_read_config_dword(bus, 0, PCI_VENDOR_ID, &l)) {
++			pr_err("Unable to read PCI config space?\n");
++			goto out_unlock;
++		}
++		absent = (l == 0xffffffff);
++
++		if (blocked != absent) {
++			pr_warning("BIOS says wireless lan is %s, "
++					"but the pci device is %s\n",
++				blocked ? "blocked" : "unblocked",
++				absent ? "absent" : "present");
++			pr_warning("skipped wireless hotplug as probably "
++					"inappropriate for this model\n");
++			goto out_unlock;
++		}
++
+ 		if (!blocked) {
+ 			dev = pci_get_slot(bus, 0);
+ 			if (dev) {
+diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
+index e9aa814..aa13875 100644
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -719,6 +719,9 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
+ 		}
+ 	}
+ 
++	cmos_rtc.dev = dev;
++	dev_set_drvdata(dev, &cmos_rtc);
++
+ 	cmos_rtc.rtc = rtc_device_register(driver_name, dev,
+ 				&cmos_rtc_ops, THIS_MODULE);
+ 	if (IS_ERR(cmos_rtc.rtc)) {
+@@ -726,8 +729,6 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
+ 		goto cleanup0;
+ 	}
+ 
+-	cmos_rtc.dev = dev;
+-	dev_set_drvdata(dev, &cmos_rtc);
+ 	rename_region(ports, dev_name(&cmos_rtc.rtc->dev));
+ 
+ 	spin_lock_irq(&rtc_lock);
+diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
+index e0d7b99..43bfffe 100644
+--- a/drivers/rtc/rtc-s3c.c
++++ b/drivers/rtc/rtc-s3c.c
+@@ -456,8 +456,6 @@ static int __devinit s3c_rtc_probe(struct platform_device *pdev)
+  	pr_debug("s3c2410_rtc: RTCCON=%02x\n",
+ 		 readb(s3c_rtc_base + S3C2410_RTCCON));
+ 
+-	s3c_rtc_setfreq(&pdev->dev, 1);
+-
+ 	device_init_wakeup(&pdev->dev, 1);
+ 
+ 	/* register RTC and exit */
+@@ -474,6 +472,9 @@ static int __devinit s3c_rtc_probe(struct platform_device *pdev)
+ 	rtc->max_user_freq = 128;
+ 
+ 	platform_set_drvdata(pdev, rtc);
++
++	s3c_rtc_setfreq(&pdev->dev, 1);
++
+ 	return 0;
+ 
+  err_nortc:
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index 6fc63b9..40807e4 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -2169,30 +2169,28 @@ qla2x00_request_irqs(struct qla_hw_data *ha, struct rsp_que *rsp)
+ 
+ 	/* If possible, enable MSI-X. */
+ 	if (!IS_QLA2432(ha) && !IS_QLA2532(ha) &&
+-	    !IS_QLA8432(ha) && !IS_QLA8001(ha))
+-		goto skip_msix;
++		!IS_QLA8432(ha) && !IS_QLA8001(ha))
++		goto skip_msi;
++
++	if (ha->pdev->subsystem_vendor == PCI_VENDOR_ID_HP &&
++		(ha->pdev->subsystem_device == 0x7040 ||
++		ha->pdev->subsystem_device == 0x7041 ||
++		ha->pdev->subsystem_device == 0x1705)) {
++		DEBUG2(qla_printk(KERN_WARNING, ha,
++			"MSI-X: Unsupported ISP2432 SSVID/SSDID (0x%X,0x%X).\n",
++			ha->pdev->subsystem_vendor,
++			ha->pdev->subsystem_device));
++		goto skip_msi;
++	}
+ 
+ 	if (IS_QLA2432(ha) && (ha->pdev->revision < QLA_MSIX_CHIP_REV_24XX ||
+ 		!QLA_MSIX_FW_MODE_1(ha->fw_attributes))) {
+ 		DEBUG2(qla_printk(KERN_WARNING, ha,
+ 		"MSI-X: Unsupported ISP2432 (0x%X, 0x%X).\n",
+ 			ha->pdev->revision, ha->fw_attributes));
+-
+ 		goto skip_msix;
+ 	}
+ 
+-	if (ha->pdev->subsystem_vendor == PCI_VENDOR_ID_HP &&
+-	    (ha->pdev->subsystem_device == 0x7040 ||
+-		ha->pdev->subsystem_device == 0x7041 ||
+-		ha->pdev->subsystem_device == 0x1705)) {
+-		DEBUG2(qla_printk(KERN_WARNING, ha,
+-		    "MSI-X: Unsupported ISP2432 SSVID/SSDID (0x%X, 0x%X).\n",
+-		    ha->pdev->subsystem_vendor,
+-		    ha->pdev->subsystem_device));
+-
+-		goto skip_msi;
+-	}
+-
+ 	ret = qla24xx_enable_msix(ha, rsp);
+ 	if (!ret) {
+ 		DEBUG2(qla_printk(KERN_INFO, ha,
+diff --git a/drivers/staging/comedi/drivers/ni_mio_cs.c b/drivers/staging/comedi/drivers/ni_mio_cs.c
+index dc4849a..9855608 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_cs.c
++++ b/drivers/staging/comedi/drivers/ni_mio_cs.c
+@@ -123,7 +123,7 @@ static const struct ni_board_struct ni_boards[] = {
+ 	 .adbits = 12,
+ 	 .ai_fifo_depth = 1024,
+ 	 .alwaysdither = 0,
+-	 .gainlkup = ai_gain_16,
++	 .gainlkup = ai_gain_4,
+ 	 .ai_speed = 5000,
+ 	 .n_aochan = 2,
+ 	 .aobits = 12,
+diff --git a/drivers/staging/rt2860/usb_main_dev.c b/drivers/staging/rt2860/usb_main_dev.c
+index 925a236..2ebc599 100644
+--- a/drivers/staging/rt2860/usb_main_dev.c
++++ b/drivers/staging/rt2860/usb_main_dev.c
+@@ -97,6 +97,7 @@ struct usb_device_id rtusb_usb_id[] = {
+ 	{USB_DEVICE(0x5A57, 0x0282)},	/* Zinwell */
+ 	{USB_DEVICE(0x7392, 0x7718)},
+ 	{USB_DEVICE(0x7392, 0x7717)},
++	{USB_DEVICE(0x0411, 0x016f)},	/* MelCo.,Inc. WLI-UC-G301N */
+ 	{USB_DEVICE(0x1737, 0x0070)},	/* Linksys WUSB100 */
+ 	{USB_DEVICE(0x1737, 0x0071)},	/* Linksys WUSB600N */
+ 	{USB_DEVICE(0x0411, 0x00e8)},	/* Buffalo WLI-UC-G300N */
+diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
+index ccb9d5b..55337c8 100644
+--- a/drivers/staging/rtl8192su/r8192U_core.c
++++ b/drivers/staging/rtl8192su/r8192U_core.c
+@@ -120,6 +120,7 @@ static struct usb_device_id rtl8192_usb_id_tbl[] = {
+ 	{USB_DEVICE(0x050d, 0x805E)},
+ 	/* Sitecom */
+ 	{USB_DEVICE(0x0df6, 0x0031)},
++	{USB_DEVICE(0x0df6, 0x004b)},	/* WL-349 */
+ 	/* EnGenius */
+ 	{USB_DEVICE(0x1740, 0x9201)},
+ 	/* Dlink */
+diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
+index 0db8d7b..433c403 100644
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -1089,11 +1089,13 @@ device_found1(struct pci_dev *pcid, const struct pci_device_id *ent)
+     }
+ //2008-07-21-01<Add>by MikeLiu
+ //register wpadev
++#if 0
+    if(wpa_set_wpadev(pDevice, 1)!=0) {
+      printk("Fail to Register WPADEV?\n");
+         unregister_netdev(pDevice->dev);
+         free_netdev(dev);
+    }
++#endif
+     device_print_info(pDevice);
+     pci_set_drvdata(pcid, pDevice);
+     return 0;
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index db6b071..d1c2108 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1201,7 +1201,7 @@ made_compressed_probe:
+ 		if (rcv->urb == NULL) {
+ 			dev_dbg(&intf->dev,
+ 				"out of memory (read urbs usb_alloc_urb)\n");
+-			goto alloc_fail7;
++			goto alloc_fail6;
+ 		}
+ 
+ 		rcv->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+@@ -1225,7 +1225,7 @@ made_compressed_probe:
+ 		if (snd->urb == NULL) {
+ 			dev_dbg(&intf->dev,
+ 				"out of memory (write urbs usb_alloc_urb)");
+-			goto alloc_fail7;
++			goto alloc_fail8;
+ 		}
+ 
+ 		if (usb_endpoint_xfer_int(epwrite))
+@@ -1264,6 +1264,7 @@ made_compressed_probe:
+ 		i = device_create_file(&intf->dev,
+ 						&dev_attr_iCountryCodeRelDate);
+ 		if (i < 0) {
++			device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
+ 			kfree(acm->country_codes);
+ 			goto skip_countries;
+ 		}
+@@ -1300,6 +1301,7 @@ alloc_fail8:
+ 		usb_free_urb(acm->wb[i].urb);
+ alloc_fail7:
+ 	acm_read_buffers_free(acm);
++alloc_fail6:
+ 	for (i = 0; i < num_rx_buf; i++)
+ 		usb_free_urb(acm->ru[i].urb);
+ 	usb_free_urb(acm->ctrlurb);
+diff --git a/drivers/usb/gadget/fsl_udc_core.c b/drivers/usb/gadget/fsl_udc_core.c
+index fa3d142..08a9a62 100644
+--- a/drivers/usb/gadget/fsl_udc_core.c
++++ b/drivers/usb/gadget/fsl_udc_core.c
+@@ -489,7 +489,7 @@ static int fsl_ep_enable(struct usb_ep *_ep,
+ 	case USB_ENDPOINT_XFER_ISOC:
+ 		/* Calculate transactions needed for high bandwidth iso */
+ 		mult = (unsigned char)(1 + ((max >> 11) & 0x03));
+-		max = max & 0x8ff;	/* bit 0~10 */
++		max = max & 0x7ff;	/* bit 0~10 */
+ 		/* 3 transactions at most */
+ 		if (mult > 3)
+ 			goto en_done;
+diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
+index 1937267..ec45293 100644
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -294,6 +294,16 @@ static int ehci_bus_resume (struct usb_hcd *hcd)
+ 	/* manually resume the ports we suspended during bus_suspend() */
+ 	i = HCS_N_PORTS (ehci->hcs_params);
+ 	while (i--) {
++		/* clear phy low power mode before resume */
++		if (ehci->has_hostpc) {
++			u32 __iomem	*hostpc_reg =
++				(u32 __iomem *)((u8 *)ehci->regs
++				+ HOSTPC0 + 4 * (i & 0xff));
++			temp = ehci_readl(ehci, hostpc_reg);
++			ehci_writel(ehci, temp & ~HOSTPC_PHCD,
++				hostpc_reg);
++			mdelay(5);
++		}
+ 		temp = ehci_readl(ehci, &ehci->regs->port_status [i]);
+ 		temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS);
+ 		if (test_bit(i, &ehci->bus_suspended) &&
+@@ -678,6 +688,13 @@ static int ehci_hub_control (
+ 			if (temp & PORT_SUSPEND) {
+ 				if ((temp & PORT_PE) == 0)
+ 					goto error;
++				/* clear phy low power mode before resume */
++				if (hostpc_reg) {
++					temp1 = ehci_readl(ehci, hostpc_reg);
++					ehci_writel(ehci, temp1 & ~HOSTPC_PHCD,
++						hostpc_reg);
++					mdelay(5);
++				}
+ 				/* resume signaling for 20 msec */
+ 				temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS);
+ 				ehci_writel(ehci, temp | PORT_RESUME,
+diff --git a/drivers/usb/host/fhci.h b/drivers/usb/host/fhci.h
+index 72dae1c..3b6e864 100644
+--- a/drivers/usb/host/fhci.h
++++ b/drivers/usb/host/fhci.h
+@@ -20,6 +20,7 @@
+ 
+ #include <linux/kernel.h>
+ #include <linux/types.h>
++#include <linux/bug.h>
+ #include <linux/spinlock.h>
+ #include <linux/interrupt.h>
+ #include <linux/kfifo.h>
+@@ -515,9 +516,13 @@ static inline int cq_put(struct kfifo *kfifo, void *p)
+ 
+ static inline void *cq_get(struct kfifo *kfifo)
+ {
+-	void *p = NULL;
++	unsigned int sz;
++	void *p;
++
++	sz = kfifo_out(kfifo, (void *)&p, sizeof(p));
++	if (sz != sizeof(p))
++		return NULL;
+ 
+-	kfifo_out(kfifo, (void *)&p, sizeof(p));
+ 	return p;
+ }
+ 
+diff --git a/drivers/usb/host/xhci-hcd.c b/drivers/usb/host/xhci-hcd.c
+index fa920c7..53d90ca 100644
+--- a/drivers/usb/host/xhci-hcd.c
++++ b/drivers/usb/host/xhci-hcd.c
+@@ -104,6 +104,33 @@ int xhci_halt(struct xhci_hcd *xhci)
+ }
+ 
+ /*
++ * Set the run bit and wait for the host to be running.
++ */
++int xhci_start(struct xhci_hcd *xhci)
++{
++	u32 temp;
++	int ret;
++
++	temp = xhci_readl(xhci, &xhci->op_regs->command);
++	temp |= (CMD_RUN);
++	xhci_dbg(xhci, "// Turn on HC, cmd = 0x%x.\n",
++			temp);
++	xhci_writel(xhci, temp, &xhci->op_regs->command);
++
++	/*
++	 * Wait for the HCHalted Status bit to be 0 to indicate the host is
++	 * running.
++	 */
++	ret = handshake(xhci, &xhci->op_regs->status,
++			STS_HALT, 0, XHCI_MAX_HALT_USEC);
++	if (ret == -ETIMEDOUT)
++		xhci_err(xhci, "Host took too long to start, "
++				"waited %u microseconds.\n",
++				XHCI_MAX_HALT_USEC);
++	return ret;
++}
++
++/*
+  * Reset a halted HC, and set the internal HC state to HC_STATE_HALT.
+  *
+  * This resets pipelines, timers, counters, state machines, etc.
+@@ -114,6 +141,7 @@ int xhci_reset(struct xhci_hcd *xhci)
+ {
+ 	u32 command;
+ 	u32 state;
++	int ret;
+ 
+ 	state = xhci_readl(xhci, &xhci->op_regs->status);
+ 	if ((state & STS_HALT) == 0) {
+@@ -128,7 +156,17 @@ int xhci_reset(struct xhci_hcd *xhci)
+ 	/* XXX: Why does EHCI set this here?  Shouldn't other code do this? */
+ 	xhci_to_hcd(xhci)->state = HC_STATE_HALT;
+ 
+-	return handshake(xhci, &xhci->op_regs->command, CMD_RESET, 0, 250 * 1000);
++	ret = handshake(xhci, &xhci->op_regs->command,
++			CMD_RESET, 0, 250 * 1000);
++	if (ret)
++		return ret;
++
++	xhci_dbg(xhci, "Wait for controller to be ready for doorbell rings\n");
++	/*
++	 * xHCI cannot write to any doorbells or operational registers other
++	 * than status until the "Controller Not Ready" flag is cleared.
++	 */
++	return handshake(xhci, &xhci->op_regs->status, STS_CNR, 0, 250 * 1000);
+ }
+ 
+ 
+@@ -451,13 +489,11 @@ int xhci_run(struct usb_hcd *hcd)
+ 	if (NUM_TEST_NOOPS > 0)
+ 		doorbell = xhci_setup_one_noop(xhci);
+ 
+-	temp = xhci_readl(xhci, &xhci->op_regs->command);
+-	temp |= (CMD_RUN);
+-	xhci_dbg(xhci, "// Turn on HC, cmd = 0x%x.\n",
+-			temp);
+-	xhci_writel(xhci, temp, &xhci->op_regs->command);
+-	/* Flush PCI posted writes */
+-	temp = xhci_readl(xhci, &xhci->op_regs->command);
++	if (xhci_start(xhci)) {
++		xhci_halt(xhci);
++		return -ENODEV;
++	}
++
+ 	xhci_dbg(xhci, "// @%p = 0x%x\n", &xhci->op_regs->command, temp);
+ 	if (doorbell)
+ 		(*doorbell)(xhci);
+@@ -1452,6 +1488,8 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
+ 		kfree(virt_ep->stopped_td);
+ 		xhci_ring_cmd_db(xhci);
+ 	}
++	virt_ep->stopped_td = NULL;
++	virt_ep->stopped_trb = NULL;
+ 	spin_unlock_irqrestore(&xhci->lock, flags);
+ 
+ 	if (ret)
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index e097008..4361b2d 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -54,7 +54,7 @@ static int xhci_pci_setup(struct usb_hcd *hcd)
+ 	struct pci_dev		*pdev = to_pci_dev(hcd->self.controller);
+ 	int			retval;
+ 
+-	hcd->self.sg_tablesize = TRBS_PER_SEGMENT - 1;
++	hcd->self.sg_tablesize = TRBS_PER_SEGMENT - 2;
+ 
+ 	xhci->cap_regs = hcd->regs;
+ 	xhci->op_regs = hcd->regs +
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index ee7bc7e..2b26b5e 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -241,10 +241,27 @@ static int room_on_ring(struct xhci_hcd *xhci, struct xhci_ring *ring,
+ 	int i;
+ 	union xhci_trb *enq = ring->enqueue;
+ 	struct xhci_segment *enq_seg = ring->enq_seg;
++	struct xhci_segment *cur_seg;
++	unsigned int left_on_ring;
+ 
+ 	/* Check if ring is empty */
+-	if (enq == ring->dequeue)
++	if (enq == ring->dequeue) {
++		/* Can't use link trbs */
++		left_on_ring = TRBS_PER_SEGMENT - 1;
++		for (cur_seg = enq_seg->next; cur_seg != enq_seg;
++				cur_seg = cur_seg->next)
++			left_on_ring += TRBS_PER_SEGMENT - 1;
++
++		/* Always need one TRB free in the ring. */
++		left_on_ring -= 1;
++		if (num_trbs > left_on_ring) {
++			xhci_warn(xhci, "Not enough room on ring; "
++					"need %u TRBs, %u TRBs left\n",
++					num_trbs, left_on_ring);
++			return 0;
++		}
+ 		return 1;
++	}
+ 	/* Make sure there's an extra empty TRB available */
+ 	for (i = 0; i <= num_trbs; ++i) {
+ 		if (enq == ring->dequeue)
+@@ -333,7 +350,8 @@ static struct xhci_segment *find_trb_seg(
+ 	while (cur_seg->trbs > trb ||
+ 			&cur_seg->trbs[TRBS_PER_SEGMENT - 1] < trb) {
+ 		generic_trb = &cur_seg->trbs[TRBS_PER_SEGMENT - 1].generic;
+-		if (TRB_TYPE(generic_trb->field[3]) == TRB_LINK &&
++		if ((generic_trb->field[3] & TRB_TYPE_BITMASK) ==
++				TRB_TYPE(TRB_LINK) &&
+ 				(generic_trb->field[3] & LINK_TOGGLE))
+ 			*cycle_state = ~(*cycle_state) & 0x1;
+ 		cur_seg = cur_seg->next;
+@@ -389,7 +407,7 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
+ 		BUG();
+ 
+ 	trb = &state->new_deq_ptr->generic;
+-	if (TRB_TYPE(trb->field[3]) == TRB_LINK &&
++	if ((trb->field[3] & TRB_TYPE_BITMASK) == TRB_TYPE(TRB_LINK) &&
+ 				(trb->field[3] & LINK_TOGGLE))
+ 		state->new_cycle_state = ~(state->new_cycle_state) & 0x1;
+ 	next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr);
+@@ -577,6 +595,8 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
+ 		/* Otherwise just ring the doorbell to restart the ring */
+ 		ring_ep_doorbell(xhci, slot_id, ep_index);
+ 	}
++	ep->stopped_td = NULL;
++	ep->stopped_trb = NULL;
+ 
+ 	/*
+ 	 * Drop the lock and complete the URBs in the cancelled TD list.
+@@ -1049,8 +1069,13 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
+ 	ep->ep_state |= EP_HALTED;
+ 	ep->stopped_td = td;
+ 	ep->stopped_trb = event_trb;
++
+ 	xhci_queue_reset_ep(xhci, slot_id, ep_index);
+ 	xhci_cleanup_stalled_ring(xhci, td->urb->dev, ep_index);
++
++	ep->stopped_td = NULL;
++	ep->stopped_trb = NULL;
++
+ 	xhci_ring_cmd_db(xhci);
+ }
+ 
+@@ -1370,8 +1395,10 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ 			for (cur_trb = ep_ring->dequeue, cur_seg = ep_ring->deq_seg;
+ 					cur_trb != event_trb;
+ 					next_trb(xhci, ep_ring, &cur_seg, &cur_trb)) {
+-				if (TRB_TYPE(cur_trb->generic.field[3]) != TRB_TR_NOOP &&
+-						TRB_TYPE(cur_trb->generic.field[3]) != TRB_LINK)
++				if ((cur_trb->generic.field[3] &
++				 TRB_TYPE_BITMASK) != TRB_TYPE(TRB_TR_NOOP) &&
++				    (cur_trb->generic.field[3] &
++				 TRB_TYPE_BITMASK) != TRB_TYPE(TRB_LINK))
+ 					td->urb->actual_length +=
+ 						TRB_LEN(cur_trb->generic.field[2]);
+ 			}
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 7d920f2..e3e087e 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -61,6 +61,8 @@ static struct usb_device_id id_table [] = {
+ 	{ USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */
+ 	{ USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
+ 	{ USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
++	{ USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
++	{ USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */
+ 	{ USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
+ 	{ USB_DEVICE(0x0FCF, 0x1004) }, /* Dynastream ANT2USB */
+ 	{ USB_DEVICE(0x0FCF, 0x1006) }, /* Dynastream ANT development board */
+@@ -72,9 +74,12 @@ static struct usb_device_id id_table [] = {
+ 	{ USB_DEVICE(0x10C4, 0x1601) }, /* Arkham Technology DS101 Adapter */
+ 	{ USB_DEVICE(0x10C4, 0x800A) }, /* SPORTident BSM7-D-USB main station */
+ 	{ USB_DEVICE(0x10C4, 0x803B) }, /* Pololu USB-serial converter */
++	{ USB_DEVICE(0x10C4, 0x8044) }, /* Cygnal Debug Adapter */
++	{ USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME build-in converter */
+ 	{ USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */
+ 	{ USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */
+ 	{ USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */
++	{ USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */
+ 	{ USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */
+ 	{ USB_DEVICE(0x10C4, 0x80CA) }, /* Degree Controls Inc */
+ 	{ USB_DEVICE(0x10C4, 0x80DD) }, /* Tracient RFID */
+@@ -82,12 +87,15 @@ static struct usb_device_id id_table [] = {
+ 	{ USB_DEVICE(0x10C4, 0x8115) }, /* Arygon NFC/Mifare Reader */
+ 	{ USB_DEVICE(0x10C4, 0x813D) }, /* Burnside Telecom Deskmobile */
+ 	{ USB_DEVICE(0x10C4, 0x813F) }, /* Tams Master Easy Control */
++	{ USB_DEVICE(0x10C4, 0x8149) }, /* West Mountain Radio Computerized Battery Analyzer */
+ 	{ USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */
+ 	{ USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */
+ 	{ USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */
++	{ USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */
+ 	{ USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */
+ 	{ USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */
+ 	{ USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */
++	{ USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */
+ 	{ USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
+ 	{ USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */
+ 	{ USB_DEVICE(0x10C4, 0x81E7) }, /* Aerocomm Radio */
+@@ -105,6 +113,7 @@ static struct usb_device_id id_table [] = {
+ 	{ USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
+ 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ 	{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
++	{ USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */
+ 	{ USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */
+ 	{ USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */
+ 	{ USB_DEVICE(0x10C4, 0xF003) }, /* Elan Digital Systems USBpulse100 */
+@@ -115,6 +124,8 @@ static struct usb_device_id id_table [] = {
+ 	{ USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */
+ 	{ USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */
+ 	{ USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
++	{ USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
++	{ USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ 	{ USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+ 	{ USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
+ 	{ } /* Terminating Entry */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index ca9e3ba..8c19ad5 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -2312,6 +2312,8 @@ static void ftdi_set_termios(struct tty_struct *tty,
+ 				"urb failed to set to rts/cts flow control\n");
+ 		}
+ 
++		/* raise DTR/RTS */
++		set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
+ 	} else {
+ 		/*
+ 		 * Xon/Xoff code
+@@ -2359,6 +2361,8 @@ static void ftdi_set_termios(struct tty_struct *tty,
+ 			}
+ 		}
+ 
++		/* lower DTR/RTS */
++		clear_mctrl(port, TIOCM_DTR | TIOCM_RTS);
+ 	}
+ 	return;
+ }
+diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c
+index 95d8d26..2e0497b 100644
+--- a/drivers/usb/serial/ir-usb.c
++++ b/drivers/usb/serial/ir-usb.c
+@@ -312,6 +312,7 @@ static int ir_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 		kfree(port->read_urb->transfer_buffer);
+ 		port->read_urb->transfer_buffer = buffer;
+ 		port->read_urb->transfer_buffer_length = buffer_size;
++		port->bulk_in_buffer = buffer;
+ 
+ 		buffer = kmalloc(buffer_size, GFP_KERNEL);
+ 		if (!buffer) {
+@@ -321,6 +322,7 @@ static int ir_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 		kfree(port->write_urb->transfer_buffer);
+ 		port->write_urb->transfer_buffer = buffer;
+ 		port->write_urb->transfer_buffer_length = buffer_size;
++		port->bulk_out_buffer = buffer;
+ 		port->bulk_out_size = buffer_size;
+ 	}
+ 
+diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
+index 3a78738..6825082 100644
+--- a/drivers/usb/serial/kl5kusb105.c
++++ b/drivers/usb/serial/kl5kusb105.c
+@@ -310,6 +310,7 @@ err_cleanup:
+ 				usb_free_urb(priv->write_urb_pool[j]);
+ 			}
+ 		}
++		kfree(priv);
+ 		usb_set_serial_port_data(serial->port[i], NULL);
+ 	}
+ 	return -ENOMEM;
+diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
+index 45ea694..9d99e68 100644
+--- a/drivers/usb/serial/kobil_sct.c
++++ b/drivers/usb/serial/kobil_sct.c
+@@ -345,7 +345,8 @@ static void kobil_close(struct usb_serial_port *port)
+ 
+ 	/* FIXME: Add rts/dtr methods */
+ 	if (port->write_urb) {
+-		usb_kill_urb(port->write_urb);
++		usb_poison_urb(port->write_urb);
++		kfree(port->write_urb->transfer_buffer);
+ 		usb_free_urb(port->write_urb);
+ 		port->write_urb = NULL;
+ 	}
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index 2cfe245..fb472dd 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -717,7 +717,6 @@ static void mos7840_bulk_in_callback(struct urb *urb)
+ 	mos7840_port = urb->context;
+ 	if (!mos7840_port) {
+ 		dbg("%s", "NULL mos7840_port pointer");
+-		mos7840_port->read_urb_busy = false;
+ 		return;
+ 	}
+ 
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index d93283d..64b50f6 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -334,6 +334,24 @@ static int  option_resume(struct usb_serial *serial);
+ #define ALCATEL_VENDOR_ID			0x1bbb
+ #define ALCATEL_PRODUCT_X060S			0x0000
+ 
++#define PIRELLI_VENDOR_ID			0x1266
++#define PIRELLI_PRODUCT_C100_1			0x1002
++#define PIRELLI_PRODUCT_C100_2			0x1003
++#define PIRELLI_PRODUCT_1004			0x1004
++#define PIRELLI_PRODUCT_1005			0x1005
++#define PIRELLI_PRODUCT_1006			0x1006
++#define PIRELLI_PRODUCT_1007			0x1007
++#define PIRELLI_PRODUCT_1008			0x1008
++#define PIRELLI_PRODUCT_1009			0x1009
++#define PIRELLI_PRODUCT_100A			0x100a
++#define PIRELLI_PRODUCT_100B			0x100b
++#define PIRELLI_PRODUCT_100C			0x100c
++#define PIRELLI_PRODUCT_100D			0x100d
++#define PIRELLI_PRODUCT_100E			0x100e
++#define PIRELLI_PRODUCT_100F			0x100f
++#define PIRELLI_PRODUCT_1011			0x1011
++#define PIRELLI_PRODUCT_1012			0x1012
++
+ /* Airplus products */
+ #define AIRPLUS_VENDOR_ID			0x1011
+ #define AIRPLUS_PRODUCT_MCD650			0x3198
+@@ -346,6 +364,12 @@ static int  option_resume(struct usb_serial *serial);
+ #define HAIER_VENDOR_ID				0x201e
+ #define HAIER_PRODUCT_CE100			0x2009
+ 
++#define CINTERION_VENDOR_ID			0x0681
++
++/* Olivetti products */
++#define OLIVETTI_VENDOR_ID			0x0b3c
++#define OLIVETTI_PRODUCT_OLICARD100		0xc000
++
+ static struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
+ 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
+@@ -621,6 +645,180 @@ static struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1060, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1061, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1062, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1063, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1064, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1065, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1066, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1067, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1068, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1069, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1070, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1071, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1072, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1073, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1074, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1075, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1076, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1077, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1078, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1079, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1080, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1081, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1082, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1083, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1084, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1085, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1086, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1087, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1088, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1089, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1090, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1091, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1092, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1093, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1094, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1095, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1096, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1097, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1098, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1099, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1100, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1101, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1102, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1103, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1104, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1105, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1106, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1107, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1108, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1109, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1110, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1111, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1112, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1113, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1114, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1115, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1116, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1117, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1118, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1119, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1120, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1121, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1122, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1123, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1124, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1125, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1126, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1127, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1128, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1129, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1130, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1131, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1132, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1133, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1134, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1135, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1136, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1137, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1138, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1139, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1140, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1141, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1142, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1143, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1144, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1145, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1146, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1147, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1148, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1149, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1150, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1151, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1152, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1153, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1154, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1155, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1156, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1157, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1158, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1159, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1160, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1161, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1162, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1163, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1164, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1165, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1166, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1167, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1168, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1169, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1170, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1244, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1245, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1246, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1247, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1248, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1249, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1250, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1251, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1252, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1253, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1254, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1255, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1256, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1257, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1258, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1259, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1260, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1261, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1262, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1263, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1264, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1265, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1266, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1267, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1268, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1269, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1271, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1274, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1275, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1276, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1277, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1278, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1279, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1280, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1281, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1282, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1283, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1284, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1285, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1286, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1287, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1288, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1289, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1290, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1291, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1292, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1293, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1294, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1295, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1296, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1297, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
+@@ -649,6 +847,27 @@ static struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
+ 	{ USB_DEVICE(FOUR_G_SYSTEMS_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14) },
+ 	{ USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
++	/* Pirelli  */
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1)},
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_2)},
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1004)},
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1005)},
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1006)},
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1007)},
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1008)},
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1009)},
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100A)},
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100B) },
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100C) },
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100D) },
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100E) },
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100F) },
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)},
++	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)},
++
++	{ USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) },
++
++	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
+ 	{ } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+@@ -771,12 +990,19 @@ static int option_probe(struct usb_serial *serial,
+ 			const struct usb_device_id *id)
+ {
+ 	struct option_intf_private *data;
++
+ 	/* D-Link DWM 652 still exposes CD-Rom emulation interface in modem mode */
+ 	if (serial->dev->descriptor.idVendor == DLINK_VENDOR_ID &&
+ 		serial->dev->descriptor.idProduct == DLINK_PRODUCT_DWM_652 &&
+ 		serial->interface->cur_altsetting->desc.bInterfaceClass == 0x8)
+ 		return -ENODEV;
+ 
++	/* Bandrich modem and AT command interface is 0xff */
++	if ((serial->dev->descriptor.idVendor == BANDRICH_VENDOR_ID ||
++		serial->dev->descriptor.idVendor == PIRELLI_VENDOR_ID) &&
++		serial->interface->cur_altsetting->desc.bInterfaceClass != 0xff)
++		return -ENODEV;
++
+ 	data = serial->private = kzalloc(sizeof(struct option_intf_private), GFP_KERNEL);
+ 	if (!data)
+ 		return -ENOMEM;
+diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
+index ad1f923..c140870 100644
+--- a/drivers/usb/serial/visor.c
++++ b/drivers/usb/serial/visor.c
+@@ -249,6 +249,7 @@ static struct usb_serial_driver clie_3_5_device = {
+ 	.throttle =		visor_throttle,
+ 	.unthrottle =		visor_unthrottle,
+ 	.attach =		clie_3_5_startup,
++	.release =		visor_release,
+ 	.write =		visor_write,
+ 	.write_room =		visor_write_room,
+ 	.write_bulk_callback =	visor_write_bulk_callback,
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 98b549b..b6e0e0e 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1858,6 +1858,21 @@ UNUSUAL_DEV(  0x1652, 0x6600, 0x0201, 0x0201,
+ 		US_SC_DEVICE, US_PR_DEVICE, NULL,
+ 		US_FL_IGNORE_RESIDUE ),
+ 
++/* Reported by Hans de Goede <hdegoede@××××××.com>
++ * These Appotech controllers are found in Picture Frames, they provide a
++ * (buggy) emulation of a cdrom drive which contains the windows software
++ * Uploading of pictures happens over the corresponding /dev/sg device. */
++UNUSUAL_DEV( 0x1908, 0x1315, 0x0000, 0x0000,
++		"BUILDWIN",
++		"Photo Frame",
++		US_SC_DEVICE, US_PR_DEVICE, NULL,
++		US_FL_BAD_SENSE ),
++UNUSUAL_DEV( 0x1908, 0x1320, 0x0000, 0x0000,
++		"BUILDWIN",
++		"Photo Frame",
++		US_SC_DEVICE, US_PR_DEVICE, NULL,
++		US_FL_BAD_SENSE ),
++
+ UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001,
+ 		"ST",
+ 		"2A",
+diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
+index eab33f1..7b547f5 100644
+--- a/drivers/xen/xenbus/xenbus_xs.c
++++ b/drivers/xen/xenbus/xenbus_xs.c
+@@ -499,7 +499,7 @@ int xenbus_printf(struct xenbus_transaction t,
+ #define PRINTF_BUFFER_SIZE 4096
+ 	char *printf_buffer;
+ 
+-	printf_buffer = kmalloc(PRINTF_BUFFER_SIZE, GFP_KERNEL);
++	printf_buffer = kmalloc(PRINTF_BUFFER_SIZE, GFP_NOIO | __GFP_HIGH);
+ 	if (printf_buffer == NULL)
+ 		return -ENOMEM;
+ 
+diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
+index 6df6d6e..9be949a 100644
+--- a/fs/btrfs/acl.c
++++ b/fs/btrfs/acl.c
+@@ -159,6 +159,9 @@ static int btrfs_xattr_acl_set(struct dentry *dentry, const char *name,
+ 	int ret;
+ 	struct posix_acl *acl = NULL;
+ 
++	if (!is_owner_or_cap(dentry->d_inode))
++		return -EPERM;
++
+ 	if (value) {
+ 		acl = posix_acl_from_xattr(value, size);
+ 		if (acl == NULL) {
+diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
+index 5646727..05a9b77 100644
+--- a/fs/cifs/cifsproto.h
++++ b/fs/cifs/cifsproto.h
+@@ -95,8 +95,10 @@ extern struct cifsFileInfo *cifs_new_fileinfo(struct inode *newinode,
+ 				__u16 fileHandle, struct file *file,
+ 				struct vfsmount *mnt, unsigned int oflags);
+ extern int cifs_posix_open(char *full_path, struct inode **pinode,
+-			   struct vfsmount *mnt, int mode, int oflags,
+-			   __u32 *poplock, __u16 *pnetfid, int xid);
++				struct vfsmount *mnt,
++				struct super_block *sb,
++				int mode, int oflags,
++				__u32 *poplock, __u16 *pnetfid, int xid);
+ extern void cifs_unix_basic_to_fattr(struct cifs_fattr *fattr,
+ 				     FILE_UNIX_BASIC_INFO *info,
+ 				     struct cifs_sb_info *cifs_sb);
+diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
+index 6ccf726..9e9d48f 100644
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -183,13 +183,14 @@ cifs_new_fileinfo(struct inode *newinode, __u16 fileHandle,
+ }
+ 
+ int cifs_posix_open(char *full_path, struct inode **pinode,
+-		    struct vfsmount *mnt, int mode, int oflags,
+-		    __u32 *poplock, __u16 *pnetfid, int xid)
++			struct vfsmount *mnt, struct super_block *sb,
++			int mode, int oflags,
++			__u32 *poplock, __u16 *pnetfid, int xid)
+ {
+ 	int rc;
+ 	FILE_UNIX_BASIC_INFO *presp_data;
+ 	__u32 posix_flags = 0;
+-	struct cifs_sb_info *cifs_sb = CIFS_SB(mnt->mnt_sb);
++	struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
+ 	struct cifs_fattr fattr;
+ 
+ 	cFYI(1, ("posix open %s", full_path));
+@@ -242,7 +243,7 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
+ 
+ 	/* get new inode and set it up */
+ 	if (*pinode == NULL) {
+-		*pinode = cifs_iget(mnt->mnt_sb, &fattr);
++		*pinode = cifs_iget(sb, &fattr);
+ 		if (!*pinode) {
+ 			rc = -ENOMEM;
+ 			goto posix_open_ret;
+@@ -251,7 +252,8 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
+ 		cifs_fattr_to_inode(*pinode, &fattr);
+ 	}
+ 
+-	cifs_new_fileinfo(*pinode, *pnetfid, NULL, mnt, oflags);
++	if (mnt)
++		cifs_new_fileinfo(*pinode, *pnetfid, NULL, mnt, oflags);
+ 
+ posix_open_ret:
+ 	kfree(presp_data);
+@@ -315,13 +317,14 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
+ 	if (nd && (nd->flags & LOOKUP_OPEN))
+ 		oflags = nd->intent.open.flags;
+ 	else
+-		oflags = FMODE_READ;
++		oflags = FMODE_READ | SMB_O_CREAT;
+ 
+ 	if (tcon->unix_ext && (tcon->ses->capabilities & CAP_UNIX) &&
+ 	    (CIFS_UNIX_POSIX_PATH_OPS_CAP &
+ 			le64_to_cpu(tcon->fsUnixInfo.Capability))) {
+-		rc = cifs_posix_open(full_path, &newinode, nd->path.mnt,
+-				     mode, oflags, &oplock, &fileHandle, xid);
++		rc = cifs_posix_open(full_path, &newinode,
++			nd ? nd->path.mnt : NULL,
++			inode->i_sb, mode, oflags, &oplock, &fileHandle, xid);
+ 		/* EIO could indicate that (posix open) operation is not
+ 		   supported, despite what server claimed in capability
+ 		   negotation.  EREMOTE indicates DFS junction, which is not
+@@ -678,6 +681,7 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
+ 		     (nd->flags & LOOKUP_OPEN) && !pTcon->broken_posix_open &&
+ 		     (nd->intent.open.flags & O_CREAT)) {
+ 			rc = cifs_posix_open(full_path, &newInode, nd->path.mnt,
++					parent_dir_inode->i_sb,
+ 					nd->intent.open.create_mode,
+ 					nd->intent.open.flags, &oplock,
+ 					&fileHandle, xid);
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 057e1da..8639dd7 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -297,10 +297,12 @@ int cifs_open(struct inode *inode, struct file *file)
+ 	    (CIFS_UNIX_POSIX_PATH_OPS_CAP &
+ 			le64_to_cpu(tcon->fsUnixInfo.Capability))) {
+ 		int oflags = (int) cifs_posix_convert_flags(file->f_flags);
++		oflags |= SMB_O_CREAT;
+ 		/* can not refresh inode info since size could be stale */
+ 		rc = cifs_posix_open(full_path, &inode, file->f_path.mnt,
+-				     cifs_sb->mnt_file_mode /* ignored */,
+-				     oflags, &oplock, &netfid, xid);
++				inode->i_sb,
++				cifs_sb->mnt_file_mode /* ignored */,
++				oflags, &oplock, &netfid, xid);
+ 		if (rc == 0) {
+ 			cFYI(1, ("posix open succeeded"));
+ 			/* no need for special case handling of setting mode
+@@ -512,8 +514,9 @@ reopen_error_exit:
+ 		int oflags = (int) cifs_posix_convert_flags(file->f_flags);
+ 		/* can not refresh inode info since size could be stale */
+ 		rc = cifs_posix_open(full_path, NULL, file->f_path.mnt,
+-				     cifs_sb->mnt_file_mode /* ignored */,
+-				     oflags, &oplock, &netfid, xid);
++				inode->i_sb,
++				cifs_sb->mnt_file_mode /* ignored */,
++				oflags, &oplock, &netfid, xid);
+ 		if (rc == 0) {
+ 			cFYI(1, ("posix reopen succeeded"));
+ 			goto reopen_success;
+diff --git a/fs/exofs/dir.c b/fs/exofs/dir.c
+index 4cfab1c..d91e9d8 100644
+--- a/fs/exofs/dir.c
++++ b/fs/exofs/dir.c
+@@ -608,7 +608,7 @@ int exofs_make_empty(struct inode *inode, struct inode *parent)
+ 	de->inode_no = cpu_to_le64(parent->i_ino);
+ 	memcpy(de->name, PARENT_DIR, sizeof(PARENT_DIR));
+ 	exofs_set_de_type(de, inode);
+-	kunmap_atomic(page, KM_USER0);
++	kunmap_atomic(kaddr, KM_USER0);
+ 	err = exofs_commit_chunk(page, 0, chunk_size);
+ fail:
+ 	page_cache_release(page);
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index 82c415b..e86f91e 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -964,6 +964,9 @@ mext_check_arguments(struct inode *orig_inode,
+ 		return -EINVAL;
+ 	}
+ 
++	if (IS_IMMUTABLE(donor_inode) || IS_APPEND(donor_inode))
++		return -EPERM;
++
+ 	/* Ext4 move extent does not support swapfile */
+ 	if (IS_SWAPFILE(orig_inode) || IS_SWAPFILE(donor_inode)) {
+ 		ext4_debug("ext4 move extent: The argument files should "
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 3b2c554..433ea27 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -930,7 +930,8 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
+ 	percpu_counter_add(&sbi->s_freeinodes_counter,
+ 			   EXT4_INODES_PER_GROUP(sb));
+ 
+-	if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG)) {
++	if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG) &&
++	    sbi->s_log_groups_per_flex) {
+ 		ext4_group_t flex_group;
+ 		flex_group = ext4_flex_group(sbi, input->group);
+ 		atomic_add(input->free_blocks_count,
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 1a7c42c..e7fb19c 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -834,6 +834,12 @@ static long wb_check_old_data_flush(struct bdi_writeback *wb)
+ 	unsigned long expired;
+ 	long nr_pages;
+ 
++	/*
++	 * When set to zero, disable periodic writeback
++	 */
++	if (!dirty_writeback_interval)
++		return 0;
++
+ 	expired = wb->last_old_flush +
+ 			msecs_to_jiffies(dirty_writeback_interval * 10);
+ 	if (time_before(jiffies, expired))
+@@ -929,8 +935,12 @@ int bdi_writeback_task(struct bdi_writeback *wb)
+ 				break;
+ 		}
+ 
+-		wait_jiffies = msecs_to_jiffies(dirty_writeback_interval * 10);
+-		schedule_timeout_interruptible(wait_jiffies);
++		if (dirty_writeback_interval) {
++			wait_jiffies = msecs_to_jiffies(dirty_writeback_interval * 10);
++			schedule_timeout_interruptible(wait_jiffies);
++		} else
++			schedule();
++
+ 		try_to_freeze();
+ 	}
+ 
+diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
+index e6dd2ae..b20bfcc 100644
+--- a/fs/gfs2/file.c
++++ b/fs/gfs2/file.c
+@@ -218,6 +218,11 @@ static int do_gfs2_set_flags(struct file *filp, u32 reqflags, u32 mask)
+ 	if (error)
+ 		goto out_drop_write;
+ 
++	error = -EACCES;
++	if (!is_owner_or_cap(inode))
++		goto out;
++
++	error = 0;
+ 	flags = ip->i_diskflags;
+ 	new_flags = (flags & ~mask) | (reqflags & mask);
+ 	if ((new_flags ^ flags) == 0)
+@@ -275,8 +280,10 @@ static int gfs2_set_flags(struct file *filp, u32 __user *ptr)
+ {
+ 	struct inode *inode = filp->f_path.dentry->d_inode;
+ 	u32 fsflags, gfsflags;
++
+ 	if (get_user(fsflags, ptr))
+ 		return -EFAULT;
++
+ 	gfsflags = fsflags_cvt(fsflags_to_gfs2, fsflags);
+ 	if (!S_ISDIR(inode->i_mode)) {
+ 		if (gfsflags & GFS2_DIF_INHERIT_JDATA)
+diff --git a/fs/libfs.c b/fs/libfs.c
+index 6e8d17e..9e0fc76 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -415,7 +415,8 @@ int simple_write_end(struct file *file, struct address_space *mapping,
+  * unique inode values later for this filesystem, then you must take care
+  * to pass it an appropriate max_reserved value to avoid collisions.
+  */
+-int simple_fill_super(struct super_block *s, int magic, struct tree_descr *files)
++int simple_fill_super(struct super_block *s, unsigned long magic,
++		      struct tree_descr *files)
+ {
+ 	struct inode *inode;
+ 	struct dentry *root;
+diff --git a/fs/namespace.c b/fs/namespace.c
+index c768f73..bf6b6fe 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1121,8 +1121,15 @@ SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
+ {
+ 	struct path path;
+ 	int retval;
++	int lookup_flags = 0;
+ 
+-	retval = user_path(name, &path);
++	if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
++		return -EINVAL;
++
++	if (!(flags & UMOUNT_NOFOLLOW))
++		lookup_flags |= LOOKUP_FOLLOW;
++
++	retval = user_path_at(AT_FDCWD, name, lookup_flags, &path);
+ 	if (retval)
+ 		goto out;
+ 	retval = -EINVAL;
+diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
+index 171699e..06b2a26 100644
+--- a/fs/nfsd/nfssvc.c
++++ b/fs/nfsd/nfssvc.c
+@@ -120,7 +120,7 @@ u32 nfsd_supported_minorversion;
+ int nfsd_vers(int vers, enum vers_op change)
+ {
+ 	if (vers < NFSD_MINVERS || vers >= NFSD_NRVERS)
+-		return -1;
++		return 0;
+ 	switch(change) {
+ 	case NFSD_SET:
+ 		nfsd_versions[vers] = nfsd_version[vers];
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 66b0705..899a4d6 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -1308,6 +1308,8 @@ extern int send_sigurg(struct fown_struct *fown);
+ #define MNT_FORCE	0x00000001	/* Attempt to forcibily umount */
+ #define MNT_DETACH	0x00000002	/* Just detach from the tree */
+ #define MNT_EXPIRE	0x00000004	/* Mark for expiry */
++#define UMOUNT_NOFOLLOW	0x00000008	/* Don't follow symlink on umount */
++#define UMOUNT_UNUSED	0x80000000	/* Flag guaranteed to be unused */
+ 
+ extern struct list_head super_blocks;
+ extern spinlock_t sb_lock;
+@@ -2359,7 +2361,7 @@ extern const struct file_operations simple_dir_operations;
+ extern const struct inode_operations simple_dir_inode_operations;
+ struct tree_descr { char *name; const struct file_operations *ops; int mode; };
+ struct dentry *d_alloc_name(struct dentry *, const char *);
+-extern int simple_fill_super(struct super_block *, int, struct tree_descr *);
++extern int simple_fill_super(struct super_block *, unsigned long, struct tree_descr *);
+ extern int simple_pin_fs(struct file_system_type *, struct vfsmount **mount, int *count);
+ extern void simple_release_fs(struct vfsmount **mount, int *count);
+ 
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index 0be8243..be29806 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -2322,6 +2322,7 @@
+ #define PCI_VENDOR_ID_JMICRON		0x197B
+ #define PCI_DEVICE_ID_JMICRON_JMB360	0x2360
+ #define PCI_DEVICE_ID_JMICRON_JMB361	0x2361
++#define PCI_DEVICE_ID_JMICRON_JMB362	0x2362
+ #define PCI_DEVICE_ID_JMICRON_JMB363	0x2363
+ #define PCI_DEVICE_ID_JMICRON_JMB365	0x2365
+ #define PCI_DEVICE_ID_JMICRON_JMB366	0x2366
+diff --git a/include/linux/swap.h b/include/linux/swap.h
+index a2602a8..d8029c2 100644
+--- a/include/linux/swap.h
++++ b/include/linux/swap.h
+@@ -223,21 +223,11 @@ static inline void lru_cache_add_anon(struct page *page)
+ 	__lru_cache_add(page, LRU_INACTIVE_ANON);
+ }
+ 
+-static inline void lru_cache_add_active_anon(struct page *page)
+-{
+-	__lru_cache_add(page, LRU_ACTIVE_ANON);
+-}
+-
+ static inline void lru_cache_add_file(struct page *page)
+ {
+ 	__lru_cache_add(page, LRU_INACTIVE_FILE);
+ }
+ 
+-static inline void lru_cache_add_active_file(struct page *page)
+-{
+-	__lru_cache_add(page, LRU_ACTIVE_FILE);
+-}
+-
+ /* linux/mm/vmscan.c */
+ extern unsigned long try_to_free_pages(struct zonelist *zonelist, int order,
+ 					gfp_t gfp_mask, nodemask_t *mask);
+diff --git a/include/linux/tboot.h b/include/linux/tboot.h
+index bf2a0c7..1dba6ee 100644
+--- a/include/linux/tboot.h
++++ b/include/linux/tboot.h
+@@ -150,6 +150,7 @@ extern int tboot_force_iommu(void);
+ 
+ #else
+ 
++#define tboot_enabled()			0
+ #define tboot_probe()			do { } while (0)
+ #define tboot_shutdown(shutdown_type)	do { } while (0)
+ #define tboot_sleep(sleep_state, pm1a_control, pm1b_control)	\
+diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
+index ff30177..597f8e2 100644
+--- a/include/net/sctp/structs.h
++++ b/include/net/sctp/structs.h
+@@ -778,6 +778,7 @@ int sctp_user_addto_chunk(struct sctp_chunk *chunk, int off, int len,
+ 			  struct iovec *data);
+ void sctp_chunk_free(struct sctp_chunk *);
+ void  *sctp_addto_chunk(struct sctp_chunk *, int len, const void *data);
++void  *sctp_addto_chunk_fixed(struct sctp_chunk *, int len, const void *data);
+ struct sctp_chunk *sctp_chunkify(struct sk_buff *,
+ 				 const struct sctp_association *,
+ 				 struct sock *);
+diff --git a/include/trace/events/signal.h b/include/trace/events/signal.h
+index a510b75..32c0697 100644
+--- a/include/trace/events/signal.h
++++ b/include/trace/events/signal.h
+@@ -10,7 +10,8 @@
+ 
+ #define TP_STORE_SIGINFO(__entry, info)				\
+ 	do {							\
+-		if (info == SEND_SIG_NOINFO) {			\
++		if (info == SEND_SIG_NOINFO ||			\
++		    info == SEND_SIG_FORCED) {			\
+ 			__entry->errno	= 0;			\
+ 			__entry->code	= SI_USER;		\
+ 		} else if (info == SEND_SIG_PRIV) {		\
+diff --git a/kernel/compat.c b/kernel/compat.c
+index f6c204f..180d188 100644
+--- a/kernel/compat.c
++++ b/kernel/compat.c
+@@ -494,29 +494,26 @@ asmlinkage long compat_sys_sched_getaffinity(compat_pid_t pid, unsigned int len,
+ {
+ 	int ret;
+ 	cpumask_var_t mask;
+-	unsigned long *k;
+-	unsigned int min_length = cpumask_size();
+-
+-	if (nr_cpu_ids <= BITS_PER_COMPAT_LONG)
+-		min_length = sizeof(compat_ulong_t);
+ 
+-	if (len < min_length)
++	if ((len * BITS_PER_BYTE) < nr_cpu_ids)
++		return -EINVAL;
++	if (len & (sizeof(compat_ulong_t)-1))
+ 		return -EINVAL;
+ 
+ 	if (!alloc_cpumask_var(&mask, GFP_KERNEL))
+ 		return -ENOMEM;
+ 
+ 	ret = sched_getaffinity(pid, mask);
+-	if (ret < 0)
+-		goto out;
++	if (ret == 0) {
++		size_t retlen = min_t(size_t, len, cpumask_size());
+ 
+-	k = cpumask_bits(mask);
+-	ret = compat_put_bitmap(user_mask_ptr, k, min_length * 8);
+-	if (ret == 0)
+-		ret = min_length;
+-
+-out:
++		if (compat_put_bitmap(user_mask_ptr, cpumask_bits(mask), retlen * 8))
++			ret = -EFAULT;
++		else
++			ret = retlen;
++	}
+ 	free_cpumask_var(mask);
++
+ 	return ret;
+ }
+ 
+diff --git a/kernel/mutex.c b/kernel/mutex.c
+index 632f04c..4c0b7b3 100644
+--- a/kernel/mutex.c
++++ b/kernel/mutex.c
+@@ -172,6 +172,13 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ 		struct thread_info *owner;
+ 
+ 		/*
++		 * If we own the BKL, then don't spin. The owner of
++		 * the mutex might be waiting on us to release the BKL.
++		 */
++		if (unlikely(current->lock_depth >= 0))
++			break;
++
++		/*
+ 		 * If there's an owner, wait for it to either
+ 		 * release the lock or go to sleep.
+ 		 */
+diff --git a/kernel/perf_event.c b/kernel/perf_event.c
+index e928e1a..fbbe79b 100644
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -1417,13 +1417,16 @@ do {					\
+ 		divisor = nsec * frequency;
+ 	}
+ 
++	if (!divisor)
++		return dividend;
++
+ 	return div64_u64(dividend, divisor);
+ }
+ 
+ static void perf_adjust_period(struct perf_event *event, u64 nsec, u64 count)
+ {
+ 	struct hw_perf_event *hwc = &event->hw;
+-	u64 period, sample_period;
++	s64 period, sample_period;
+ 	s64 delta;
+ 
+ 	period = perf_calculate_period(event, nsec, count);
+@@ -4712,8 +4715,8 @@ SYSCALL_DEFINE5(perf_event_open,
+ 	struct perf_event_context *ctx;
+ 	struct file *event_file = NULL;
+ 	struct file *group_file = NULL;
++	int event_fd;
+ 	int fput_needed = 0;
+-	int fput_needed2 = 0;
+ 	int err;
+ 
+ 	/* for future expandability... */
+@@ -4734,12 +4737,18 @@ SYSCALL_DEFINE5(perf_event_open,
+ 			return -EINVAL;
+ 	}
+ 
++	event_fd = get_unused_fd_flags(O_RDWR);
++	if (event_fd < 0)
++		return event_fd;
++
+ 	/*
+ 	 * Get the target context (task or percpu):
+ 	 */
+ 	ctx = find_get_context(pid, cpu);
+-	if (IS_ERR(ctx))
+-		return PTR_ERR(ctx);
++	if (IS_ERR(ctx)) {
++		err = PTR_ERR(ctx);
++		goto err_fd;
++	}
+ 
+ 	/*
+ 	 * Look up the group leader (we will attach this event to it):
+@@ -4779,13 +4788,11 @@ SYSCALL_DEFINE5(perf_event_open,
+ 	if (IS_ERR(event))
+ 		goto err_put_context;
+ 
+-	err = anon_inode_getfd("[perf_event]", &perf_fops, event, O_RDWR);
+-	if (err < 0)
+-		goto err_free_put_context;
+-
+-	event_file = fget_light(err, &fput_needed2);
+-	if (!event_file)
++	event_file = anon_inode_getfile("[perf_event]", &perf_fops, event, O_RDWR);
++	if (IS_ERR(event_file)) {
++		err = PTR_ERR(event_file);
+ 		goto err_free_put_context;
++	}
+ 
+ 	if (flags & PERF_FLAG_FD_OUTPUT) {
+ 		err = perf_event_set_output(event, group_fd);
+@@ -4806,19 +4813,19 @@ SYSCALL_DEFINE5(perf_event_open,
+ 	list_add_tail(&event->owner_entry, &current->perf_event_list);
+ 	mutex_unlock(&current->perf_event_mutex);
+ 
+-err_fput_free_put_context:
+-	fput_light(event_file, fput_needed2);
++	fput_light(group_file, fput_needed);
++	fd_install(event_fd, event_file);
++	return event_fd;
+ 
++err_fput_free_put_context:
++	fput(event_file);
+ err_free_put_context:
+-	if (err < 0)
+-		free_event(event);
+-
++	free_event(event);
+ err_put_context:
+-	if (err < 0)
+-		put_ctx(ctx);
+-
+ 	fput_light(group_file, fput_needed);
+-
++	put_ctx(ctx);
++err_fd:
++	put_unused_fd(event_fd);
+ 	return err;
+ }
+ 
+diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
+index 4954407..5e76d22 100644
+--- a/kernel/posix-timers.c
++++ b/kernel/posix-timers.c
+@@ -559,14 +559,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock,
+ 	new_timer->it_id = (timer_t) new_timer_id;
+ 	new_timer->it_clock = which_clock;
+ 	new_timer->it_overrun = -1;
+-	error = CLOCK_DISPATCH(which_clock, timer_create, (new_timer));
+-	if (error)
+-		goto out;
+ 
+-	/*
+-	 * return the timer_id now.  The next step is hard to
+-	 * back out if there is an error.
+-	 */
+ 	if (copy_to_user(created_timer_id,
+ 			 &new_timer_id, sizeof (new_timer_id))) {
+ 		error = -EFAULT;
+@@ -597,6 +590,10 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock,
+ 	new_timer->sigq->info.si_tid   = new_timer->it_id;
+ 	new_timer->sigq->info.si_code  = SI_TIMER;
+ 
++	error = CLOCK_DISPATCH(which_clock, timer_create, (new_timer));
++	if (error)
++		goto out;
++
+ 	spin_lock_irq(&current->sighand->siglock);
+ 	new_timer->it_signal = current->signal;
+ 	list_add(&new_timer->list, &current->signal->posix_timers);
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 934ae5e..6ca731b 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -625,7 +625,7 @@ static inline bool si_fromuser(const struct siginfo *info)
+ static int check_kill_permission(int sig, struct siginfo *info,
+ 				 struct task_struct *t)
+ {
+-	const struct cred *cred = current_cred(), *tcred;
++	const struct cred *cred, *tcred;
+ 	struct pid *sid;
+ 	int error;
+ 
+@@ -639,8 +639,10 @@ static int check_kill_permission(int sig, struct siginfo *info,
+ 	if (error)
+ 		return error;
+ 
++	cred = current_cred();
+ 	tcred = __task_cred(t);
+-	if ((cred->euid ^ tcred->suid) &&
++	if (!same_thread_group(current, t) &&
++	    (cred->euid ^ tcred->suid) &&
+ 	    (cred->euid ^ tcred->uid) &&
+ 	    (cred->uid  ^ tcred->suid) &&
+ 	    (cred->uid  ^ tcred->uid) &&
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 45cfb6d..7d12c17 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -32,6 +32,7 @@
+ #include <linux/splice.h>
+ #include <linux/kdebug.h>
+ #include <linux/string.h>
++#include <linux/rwsem.h>
+ #include <linux/ctype.h>
+ #include <linux/init.h>
+ #include <linux/poll.h>
+@@ -102,9 +103,6 @@ static inline void ftrace_enable_cpu(void)
+ 
+ static cpumask_var_t __read_mostly	tracing_buffer_mask;
+ 
+-/* Define which cpu buffers are currently read in trace_pipe */
+-static cpumask_var_t			tracing_reader_cpumask;
+-
+ #define for_each_tracing_cpu(cpu)	\
+ 	for_each_cpu(cpu, tracing_buffer_mask)
+ 
+@@ -243,12 +241,91 @@ static struct tracer		*current_trace __read_mostly;
+ 
+ /*
+  * trace_types_lock is used to protect the trace_types list.
+- * This lock is also used to keep user access serialized.
+- * Accesses from userspace will grab this lock while userspace
+- * activities happen inside the kernel.
+  */
+ static DEFINE_MUTEX(trace_types_lock);
+ 
++/*
++ * serialize the access of the ring buffer
++ *
++ * ring buffer serializes readers, but it is low level protection.
++ * The validity of the events (which returns by ring_buffer_peek() ..etc)
++ * are not protected by ring buffer.
++ *
++ * The content of events may become garbage if we allow other process consumes
++ * these events concurrently:
++ *   A) the page of the consumed events may become a normal page
++ *      (not reader page) in ring buffer, and this page will be rewrited
++ *      by events producer.
++ *   B) The page of the consumed events may become a page for splice_read,
++ *      and this page will be returned to system.
++ *
++ * These primitives allow multi process access to different cpu ring buffer
++ * concurrently.
++ *
++ * These primitives don't distinguish read-only and read-consume access.
++ * Multi read-only access are also serialized.
++ */
++
++#ifdef CONFIG_SMP
++static DECLARE_RWSEM(all_cpu_access_lock);
++static DEFINE_PER_CPU(struct mutex, cpu_access_lock);
++
++static inline void trace_access_lock(int cpu)
++{
++	if (cpu == TRACE_PIPE_ALL_CPU) {
++		/* gain it for accessing the whole ring buffer. */
++		down_write(&all_cpu_access_lock);
++	} else {
++		/* gain it for accessing a cpu ring buffer. */
++
++		/* Firstly block other trace_access_lock(TRACE_PIPE_ALL_CPU). */
++		down_read(&all_cpu_access_lock);
++
++		/* Secondly block other access to this @cpu ring buffer. */
++		mutex_lock(&per_cpu(cpu_access_lock, cpu));
++	}
++}
++
++static inline void trace_access_unlock(int cpu)
++{
++	if (cpu == TRACE_PIPE_ALL_CPU) {
++		up_write(&all_cpu_access_lock);
++	} else {
++		mutex_unlock(&per_cpu(cpu_access_lock, cpu));
++		up_read(&all_cpu_access_lock);
++	}
++}
++
++static inline void trace_access_lock_init(void)
++{
++	int cpu;
++
++	for_each_possible_cpu(cpu)
++		mutex_init(&per_cpu(cpu_access_lock, cpu));
++}
++
++#else
++
++static DEFINE_MUTEX(access_lock);
++
++static inline void trace_access_lock(int cpu)
++{
++	(void)cpu;
++	mutex_lock(&access_lock);
++}
++
++static inline void trace_access_unlock(int cpu)
++{
++	(void)cpu;
++	mutex_unlock(&access_lock);
++}
++
++static inline void trace_access_lock_init(void)
++{
++}
++
++#endif
++
+ /* trace_wait is a waitqueue for tasks blocked on trace_poll */
+ static DECLARE_WAIT_QUEUE_HEAD(trace_wait);
+ 
+@@ -1601,12 +1678,6 @@ static void tracing_iter_reset(struct trace_iterator *iter, int cpu)
+ }
+ 
+ /*
+- * No necessary locking here. The worst thing which can
+- * happen is loosing events consumed at the same time
+- * by a trace_pipe reader.
+- * Other than that, we don't risk to crash the ring buffer
+- * because it serializes the readers.
+- *
+  * The current tracer is copied to avoid a global locking
+  * all around.
+  */
+@@ -1662,12 +1733,16 @@ static void *s_start(struct seq_file *m, loff_t *pos)
+ 	}
+ 
+ 	trace_event_read_lock();
++	trace_access_lock(cpu_file);
+ 	return p;
+ }
+ 
+ static void s_stop(struct seq_file *m, void *p)
+ {
++	struct trace_iterator *iter = m->private;
++
+ 	atomic_dec(&trace_record_cmdline_disabled);
++	trace_access_unlock(iter->cpu_file);
+ 	trace_event_read_unlock();
+ }
+ 
+@@ -2858,22 +2933,6 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp)
+ 
+ 	mutex_lock(&trace_types_lock);
+ 
+-	/* We only allow one reader per cpu */
+-	if (cpu_file == TRACE_PIPE_ALL_CPU) {
+-		if (!cpumask_empty(tracing_reader_cpumask)) {
+-			ret = -EBUSY;
+-			goto out;
+-		}
+-		cpumask_setall(tracing_reader_cpumask);
+-	} else {
+-		if (!cpumask_test_cpu(cpu_file, tracing_reader_cpumask))
+-			cpumask_set_cpu(cpu_file, tracing_reader_cpumask);
+-		else {
+-			ret = -EBUSY;
+-			goto out;
+-		}
+-	}
+-
+ 	/* create a buffer to store the information to pass to userspace */
+ 	iter = kzalloc(sizeof(*iter), GFP_KERNEL);
+ 	if (!iter) {
+@@ -2929,12 +2988,6 @@ static int tracing_release_pipe(struct inode *inode, struct file *file)
+ 
+ 	mutex_lock(&trace_types_lock);
+ 
+-	if (iter->cpu_file == TRACE_PIPE_ALL_CPU)
+-		cpumask_clear(tracing_reader_cpumask);
+-	else
+-		cpumask_clear_cpu(iter->cpu_file, tracing_reader_cpumask);
+-
+-
+ 	if (iter->trace->pipe_close)
+ 		iter->trace->pipe_close(iter);
+ 
+@@ -3096,6 +3149,7 @@ waitagain:
+ 	iter->pos = -1;
+ 
+ 	trace_event_read_lock();
++	trace_access_lock(iter->cpu_file);
+ 	while (find_next_entry_inc(iter) != NULL) {
+ 		enum print_line_t ret;
+ 		int len = iter->seq.len;
+@@ -3112,6 +3166,7 @@ waitagain:
+ 		if (iter->seq.len >= cnt)
+ 			break;
+ 	}
++	trace_access_unlock(iter->cpu_file);
+ 	trace_event_read_unlock();
+ 
+ 	/* Now copy what we have to the user */
+@@ -3237,6 +3292,7 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
+ 	}
+ 
+ 	trace_event_read_lock();
++	trace_access_lock(iter->cpu_file);
+ 
+ 	/* Fill as many pages as possible. */
+ 	for (i = 0, rem = len; i < PIPE_BUFFERS && rem; i++) {
+@@ -3260,6 +3316,7 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
+ 		trace_seq_init(&iter->seq);
+ 	}
+ 
++	trace_access_unlock(iter->cpu_file);
+ 	trace_event_read_unlock();
+ 	mutex_unlock(&iter->mutex);
+ 
+@@ -3561,10 +3618,12 @@ tracing_buffers_read(struct file *filp, char __user *ubuf,
+ 
+ 	info->read = 0;
+ 
++	trace_access_lock(info->cpu);
+ 	ret = ring_buffer_read_page(info->tr->buffer,
+ 				    &info->spare,
+ 				    count,
+ 				    info->cpu, 0);
++	trace_access_unlock(info->cpu);
+ 	if (ret < 0)
+ 		return 0;
+ 
+@@ -3692,6 +3751,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
+ 		len &= PAGE_MASK;
+ 	}
+ 
++	trace_access_lock(info->cpu);
+ 	entries = ring_buffer_entries_cpu(info->tr->buffer, info->cpu);
+ 
+ 	for (i = 0; i < PIPE_BUFFERS && len && entries; i++, len -= PAGE_SIZE) {
+@@ -3739,6 +3799,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
+ 		entries = ring_buffer_entries_cpu(info->tr->buffer, info->cpu);
+ 	}
+ 
++	trace_access_unlock(info->cpu);
+ 	spd.nr_pages = i;
+ 
+ 	/* did we read anything? */
+@@ -4175,6 +4236,8 @@ static __init int tracer_init_debugfs(void)
+ 	struct dentry *d_tracer;
+ 	int cpu;
+ 
++	trace_access_lock_init();
++
+ 	d_tracer = tracing_init_dentry();
+ 
+ 	trace_create_file("tracing_enabled", 0644, d_tracer,
+@@ -4409,9 +4472,6 @@ __init static int tracer_alloc_buffers(void)
+ 	if (!alloc_cpumask_var(&tracing_cpumask, GFP_KERNEL))
+ 		goto out_free_buffer_mask;
+ 
+-	if (!zalloc_cpumask_var(&tracing_reader_cpumask, GFP_KERNEL))
+-		goto out_free_tracing_cpumask;
+-
+ 	/* To save memory, keep the ring buffer size to its minimum */
+ 	if (ring_buffer_expanded)
+ 		ring_buf_size = trace_buf_size;
+@@ -4469,8 +4529,6 @@ __init static int tracer_alloc_buffers(void)
+ 	return 0;
+ 
+ out_free_cpumask:
+-	free_cpumask_var(tracing_reader_cpumask);
+-out_free_tracing_cpumask:
+ 	free_cpumask_var(tracing_cpumask);
+ out_free_buffer_mask:
+ 	free_cpumask_var(tracing_buffer_mask);
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 698ea80..96398d3 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -441,7 +441,7 @@ int add_to_page_cache_lru(struct page *page, struct address_space *mapping,
+ 	/*
+ 	 * Splice_read and readahead add shmem/tmpfs pages into the page cache
+ 	 * before shmem_readpage has a chance to mark them as SwapBacked: they
+-	 * need to go on the active_anon lru below, and mem_cgroup_cache_charge
++	 * need to go on the anon lru below, and mem_cgroup_cache_charge
+ 	 * (called in add_to_page_cache) needs to know where they're going too.
+ 	 */
+ 	if (mapping_cap_swap_backed(mapping))
+@@ -452,7 +452,7 @@ int add_to_page_cache_lru(struct page *page, struct address_space *mapping,
+ 		if (page_is_file_cache(page))
+ 			lru_cache_add_file(page);
+ 		else
+-			lru_cache_add_active_anon(page);
++			lru_cache_add_anon(page);
+ 	}
+ 	return ret;
+ }
+@@ -1099,6 +1099,12 @@ page_not_up_to_date_locked:
+ 		}
+ 
+ readpage:
++		/*
++		 * A previous I/O error may have been due to temporary
++		 * failures, eg. multipath errors.
++		 * PG_error will be set again if readpage fails.
++		 */
++		ClearPageError(page);
+ 		/* Start the actual read. The read will unlock the page. */
+ 		error = mapping->a_ops->readpage(filp, page);
+ 
+diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
+index a10d508..9f6f8d3 100644
+--- a/net/mac80211/Kconfig
++++ b/net/mac80211/Kconfig
+@@ -15,8 +15,12 @@ comment "CFG80211 needs to be enabled for MAC80211"
+ 
+ if MAC80211 != n
+ 
++config MAC80211_HAS_RC
++	def_bool n
++
+ config MAC80211_RC_PID
+ 	bool "PID controller based rate control algorithm" if EMBEDDED
++	select MAC80211_HAS_RC
+ 	---help---
+ 	  This option enables a TX rate control algorithm for
+ 	  mac80211 that uses a PID controller to select the TX
+@@ -24,12 +28,14 @@ config MAC80211_RC_PID
+ 
+ config MAC80211_RC_MINSTREL
+ 	bool "Minstrel" if EMBEDDED
++	select MAC80211_HAS_RC
+ 	default y
+ 	---help---
+ 	  This option enables the 'minstrel' TX rate control algorithm
+ 
+ choice
+ 	prompt "Default rate control algorithm"
++	depends on MAC80211_HAS_RC
+ 	default MAC80211_RC_DEFAULT_MINSTREL
+ 	---help---
+ 	  This option selects the default rate control algorithm
+@@ -62,6 +68,9 @@ config MAC80211_RC_DEFAULT
+ 
+ endif
+ 
++comment "Some wireless drivers require a rate control algorithm"
++	depends on MAC80211_HAS_RC=n
++
+ config MAC80211_MESH
+ 	bool "Enable mac80211 mesh networking (pre-802.11s) support"
+ 	depends on MAC80211 && EXPERIMENTAL
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 9ae1a47..e2b4345 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -98,9 +98,6 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
+ 					    params->mesh_id_len,
+ 					    params->mesh_id);
+ 
+-	if (sdata->vif.type != NL80211_IFTYPE_MONITOR || !flags)
+-		return 0;
+-
+ 	if (type == NL80211_IFTYPE_AP_VLAN &&
+ 	    params && params->use_4addr == 0)
+ 		rcu_assign_pointer(sdata->u.vlan.sta, NULL);
+@@ -108,7 +105,9 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
+ 		 params && params->use_4addr >= 0)
+ 		sdata->u.mgd.use_4addr = params->use_4addr;
+ 
+-	sdata->u.mntr_flags = *flags;
++	if (sdata->vif.type == NL80211_IFTYPE_MONITOR && flags)
++		sdata->u.mntr_flags = *flags;
++
+ 	return 0;
+ }
+ 
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index edfa036..48d8fdf 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1399,7 +1399,8 @@ ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
+ 		     (rx->key || rx->sdata->drop_unencrypted)))
+ 		return -EACCES;
+ 	if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
+-		if (unlikely(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
++		if (unlikely(!ieee80211_has_protected(fc) &&
++			     ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
+ 			     rx->key))
+ 			return -EACCES;
+ 		/* BIP does not use Protected field, so need to check MMIE */
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 1fdc0a5..9b50183 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -501,7 +501,8 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
+ 	struct ieee80211_hdr *hdr = (void *)tx->skb->data;
+ 	struct ieee80211_supported_band *sband;
+ 	struct ieee80211_rate *rate;
+-	int i, len;
++	int i;
++	u32 len;
+ 	bool inval = false, rts = false, short_preamble = false;
+ 	struct ieee80211_tx_rate_control txrc;
+ 	u32 sta_flags;
+@@ -510,7 +511,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
+ 
+ 	sband = tx->local->hw.wiphy->bands[tx->channel->band];
+ 
+-	len = min_t(int, tx->skb->len + FCS_LEN,
++	len = min_t(u32, tx->skb->len + FCS_LEN,
+ 			 tx->local->hw.wiphy->frag_threshold);
+ 
+ 	/* set up the tx rate control struct we give the RC algo */
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index 224db01..35fa684 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -107,7 +107,7 @@ static const struct sctp_paramhdr prsctp_param = {
+ 	cpu_to_be16(sizeof(struct sctp_paramhdr)),
+ };
+ 
+-/* A helper to initialize to initialize an op error inside a
++/* A helper to initialize an op error inside a
+  * provided chunk, as most cause codes will be embedded inside an
+  * abort chunk.
+  */
+@@ -124,6 +124,29 @@ void  sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
+ 	chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err);
+ }
+ 
++/* A helper to initialize an op error inside a
++ * provided chunk, as most cause codes will be embedded inside an
++ * abort chunk.  Differs from sctp_init_cause in that it won't oops
++ * if there isn't enough space in the op error chunk
++ */
++int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
++		      size_t paylen)
++{
++	sctp_errhdr_t err;
++	__u16 len;
++
++	/* Cause code constants are now defined in network order.  */
++	err.cause = cause_code;
++	len = sizeof(sctp_errhdr_t) + paylen;
++	err.length  = htons(len);
++
++	if (skb_tailroom(chunk->skb) < len)
++		return -ENOSPC;
++	chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
++						     sizeof(sctp_errhdr_t),
++						     &err);
++	return 0;
++}
+ /* 3.3.2 Initiation (INIT) (1)
+  *
+  * This chunk is used to initiate a SCTP association between two
+@@ -1131,6 +1154,24 @@ nodata:
+ 	return retval;
+ }
+ 
++/* Create an Operation Error chunk of a fixed size,
++ * specifically, max(asoc->pathmtu, SCTP_DEFAULT_MAXSEGMENT)
++ * This is a helper function to allocate an error chunk for
++ * for those invalid parameter codes in which we may not want
++ * to report all the errors, if the incomming chunk is large
++ */
++static inline struct sctp_chunk *sctp_make_op_error_fixed(
++	const struct sctp_association *asoc,
++	const struct sctp_chunk *chunk)
++{
++	size_t size = asoc ? asoc->pathmtu : 0;
++
++	if (!size)
++		size = SCTP_DEFAULT_MAXSEGMENT;
++
++	return sctp_make_op_error_space(asoc, chunk, size);
++}
++
+ /* Create an Operation Error chunk.  */
+ struct sctp_chunk *sctp_make_op_error(const struct sctp_association *asoc,
+ 				 const struct sctp_chunk *chunk,
+@@ -1373,6 +1414,18 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
+ 	return target;
+ }
+ 
++/* Append bytes to the end of a chunk. Returns NULL if there isn't sufficient
++ * space in the chunk
++ */
++void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
++			     int len, const void *data)
++{
++	if (skb_tailroom(chunk->skb) >= len)
++		return sctp_addto_chunk(chunk, len, data);
++	else
++		return NULL;
++}
++
+ /* Append bytes from user space to the end of a chunk.  Will panic if
+  * chunk is not big enough.
+  * Returns a kernel err value.
+@@ -1976,13 +2029,12 @@ static sctp_ierror_t sctp_process_unk_param(const struct sctp_association *asoc,
+ 		 * returning multiple unknown parameters.
+ 		 */
+ 		if (NULL == *errp)
+-			*errp = sctp_make_op_error_space(asoc, chunk,
+-					ntohs(chunk->chunk_hdr->length));
++			*errp = sctp_make_op_error_fixed(asoc, chunk);
+ 
+ 		if (*errp) {
+-			sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM,
++			sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM,
+ 					WORD_ROUND(ntohs(param.p->length)));
+-			sctp_addto_chunk(*errp,
++			sctp_addto_chunk_fixed(*errp,
+ 					WORD_ROUND(ntohs(param.p->length)),
+ 					param.v);
+ 		} else {
+diff --git a/net/wireless/core.h b/net/wireless/core.h
+index 4ef3efc..35b7121 100644
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -378,6 +378,8 @@ int rdev_set_freq(struct cfg80211_registered_device *rdev,
+ 		  struct wireless_dev *for_wdev,
+ 		  int freq, enum nl80211_channel_type channel_type);
+ 
++u16 cfg80211_calculate_bitrate(struct rate_info *rate);
++
+ #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
+ #define CFG80211_DEV_WARN_ON(cond)	WARN_ON(cond)
+ #else
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index a602843..7cb0d64 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -1637,39 +1637,6 @@ static int parse_station_flags(struct genl_info *info,
+ 	return 0;
+ }
+ 
+-static u16 nl80211_calculate_bitrate(struct rate_info *rate)
+-{
+-	int modulation, streams, bitrate;
+-
+-	if (!(rate->flags & RATE_INFO_FLAGS_MCS))
+-		return rate->legacy;
+-
+-	/* the formula below does only work for MCS values smaller than 32 */
+-	if (rate->mcs >= 32)
+-		return 0;
+-
+-	modulation = rate->mcs & 7;
+-	streams = (rate->mcs >> 3) + 1;
+-
+-	bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
+-			13500000 : 6500000;
+-
+-	if (modulation < 4)
+-		bitrate *= (modulation + 1);
+-	else if (modulation == 4)
+-		bitrate *= (modulation + 2);
+-	else
+-		bitrate *= (modulation + 3);
+-
+-	bitrate *= streams;
+-
+-	if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
+-		bitrate = (bitrate / 9) * 10;
+-
+-	/* do NOT round down here */
+-	return (bitrate + 50000) / 100000;
+-}
+-
+ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
+ 				int flags, struct net_device *dev,
+ 				u8 *mac_addr, struct station_info *sinfo)
+@@ -1716,8 +1683,8 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
+ 		if (!txrate)
+ 			goto nla_put_failure;
+ 
+-		/* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
+-		bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
++		/* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
++		bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
+ 		if (bitrate > 0)
+ 			NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
+ 
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 59361fd..a3c841a 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -720,3 +720,36 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
+ 
+ 	return err;
+ }
++
++u16 cfg80211_calculate_bitrate(struct rate_info *rate)
++{
++	int modulation, streams, bitrate;
++
++	if (!(rate->flags & RATE_INFO_FLAGS_MCS))
++		return rate->legacy;
++
++	/* the formula below does only work for MCS values smaller than 32 */
++	if (rate->mcs >= 32)
++		return 0;
++
++	modulation = rate->mcs & 7;
++	streams = (rate->mcs >> 3) + 1;
++
++	bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
++			13500000 : 6500000;
++
++	if (modulation < 4)
++		bitrate *= (modulation + 1);
++	else if (modulation == 4)
++		bitrate *= (modulation + 2);
++	else
++		bitrate *= (modulation + 3);
++
++	bitrate *= streams;
++
++	if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
++		bitrate = (bitrate / 9) * 10;
++
++	/* do NOT round down here */
++	return (bitrate + 50000) / 100000;
++}
+diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
+index 54face3..4198243 100644
+--- a/net/wireless/wext-compat.c
++++ b/net/wireless/wext-compat.c
+@@ -1257,10 +1257,7 @@ int cfg80211_wext_giwrate(struct net_device *dev,
+ 	if (!(sinfo.filled & STATION_INFO_TX_BITRATE))
+ 		return -EOPNOTSUPP;
+ 
+-	rate->value = 0;
+-
+-	if (!(sinfo.txrate.flags & RATE_INFO_FLAGS_MCS))
+-		rate->value = 100000 * sinfo.txrate.legacy;
++	rate->value = 100000 * cfg80211_calculate_bitrate(&sinfo.txrate);
+ 
+ 	return 0;
+ }
+diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
+index 999e8a7..25a5183 100644
+--- a/scripts/kconfig/Makefile
++++ b/scripts/kconfig/Makefile
+@@ -198,7 +198,7 @@ HOSTCFLAGS_zconf.tab.o	:= -I$(src)
+ HOSTLOADLIBES_qconf	= $(KC_QT_LIBS) -ldl
+ HOSTCXXFLAGS_qconf.o	= $(KC_QT_CFLAGS) -D LKC_DIRECT_LINK
+ 
+-HOSTLOADLIBES_gconf	= `pkg-config --libs gtk+-2.0 gmodule-2.0 libglade-2.0`
++HOSTLOADLIBES_gconf	= `pkg-config --libs gtk+-2.0 gmodule-2.0 libglade-2.0` -ldl
+ HOSTCFLAGS_gconf.o	= `pkg-config --cflags gtk+-2.0 gmodule-2.0 libglade-2.0` \
+                           -D LKC_DIRECT_LINK
+ 
+diff --git a/security/keys/keyring.c b/security/keys/keyring.c
+index 8ec0274..e031952 100644
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -524,9 +524,8 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
+ 	struct key *keyring;
+ 	int bucket;
+ 
+-	keyring = ERR_PTR(-EINVAL);
+ 	if (!name)
+-		goto error;
++		return ERR_PTR(-EINVAL);
+ 
+ 	bucket = keyring_hash(name);
+ 
+@@ -553,17 +552,18 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
+ 					   KEY_SEARCH) < 0)
+ 				continue;
+ 
+-			/* we've got a match */
+-			atomic_inc(&keyring->usage);
+-			read_unlock(&keyring_name_lock);
+-			goto error;
++			/* we've got a match but we might end up racing with
++			 * key_cleanup() if the keyring is currently 'dead'
++			 * (ie. it has a zero usage count) */
++			if (!atomic_inc_not_zero(&keyring->usage))
++				continue;
++			goto out;
+ 		}
+ 	}
+ 
+-	read_unlock(&keyring_name_lock);
+ 	keyring = ERR_PTR(-ENOKEY);
+-
+- error:
++out:
++	read_unlock(&keyring_name_lock);
+ 	return keyring;
+ 
+ } /* end find_keyring_by_name() */
+diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
+index 5c23afb..931cfda 100644
+--- a/security/keys/process_keys.c
++++ b/security/keys/process_keys.c
+@@ -509,7 +509,7 @@ try_again:
+ 
+ 			ret = install_thread_keyring();
+ 			if (ret < 0) {
+-				key = ERR_PTR(ret);
++				key_ref = ERR_PTR(ret);
+ 				goto error;
+ 			}
+ 			goto reget_creds;
+@@ -527,7 +527,7 @@ try_again:
+ 
+ 			ret = install_process_keyring();
+ 			if (ret < 0) {
+-				key = ERR_PTR(ret);
++				key_ref = ERR_PTR(ret);
+ 				goto error;
+ 			}
+ 			goto reget_creds;
+@@ -586,7 +586,7 @@ try_again:
+ 
+ 	case KEY_SPEC_GROUP_KEYRING:
+ 		/* group keyrings are not yet supported */
+-		key = ERR_PTR(-EINVAL);
++		key_ref = ERR_PTR(-EINVAL);
+ 		goto error;
+ 
+ 	case KEY_SPEC_REQKEY_AUTH_KEY:
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index a747871..0dc3418 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2263,16 +2263,23 @@ static int azx_dev_free(struct snd_device *device)
+  * white/black-listing for position_fix
+  */
+ static struct snd_pci_quirk position_fix_list[] __devinitdata = {
++	SND_PCI_QUIRK(0x1025, 0x009f, "Acer Aspire 5110", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB),
+-	SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
++	SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB),
++	SND_PCI_QUIRK(0x1043, 0x81e7, "ASUS M2V", POS_FIX_LPIB),
++	SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB),
++	SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB),
++	SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB),
++	SND_PCI_QUIRK(0x1297, 0x3166, "Shuttle", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x1565, 0x8218, "Biostar Microtech", POS_FIX_LPIB),
++	SND_PCI_QUIRK(0x1849, 0x0888, "775Dual-VSTA", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x8086, 0x2503, "DG965OT AAD63733-203", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x8086, 0xd601, "eMachines T5212", POS_FIX_LPIB),
+ 	{}
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index abfc558..187a467 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9116,6 +9116,7 @@ static struct snd_pci_quirk alc882_ssid_cfg_tbl[] = {
+ 	SND_PCI_QUIRK(0x106b, 0x1000, "iMac 24", ALC885_IMAC24),
+ 	SND_PCI_QUIRK(0x106b, 0x2800, "AppleTV", ALC885_IMAC24),
+ 	SND_PCI_QUIRK(0x106b, 0x2c00, "MacbookPro rev3", ALC885_MBP3),
++	SND_PCI_QUIRK(0x106b, 0x3000, "iMac", ALC889A_MB31),
+ 	SND_PCI_QUIRK(0x106b, 0x3600, "Macbook 3,1", ALC889A_MB31),
+ 	SND_PCI_QUIRK(0x106b, 0x3800, "MacbookPro 4,1", ALC885_MBP3),
+ 	SND_PCI_QUIRK(0x106b, 0x3e00, "iMac 24 Aluminum", ALC885_IMAC24),
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index cb474c0..256ad3a 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -2070,12 +2070,12 @@ static struct snd_pci_quirk stac927x_cfg_tbl[] = {
+ 	SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_INTEL, 0xff00, 0x2000,
+ 			   "Intel D965", STAC_D965_3ST),
+ 	/* Dell 3 stack systems */
+-	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x01f7, "Dell XPS M1730", STAC_DELL_3ST),
+ 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x01dd, "Dell Dimension E520", STAC_DELL_3ST),
+ 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x01ed, "Dell     ", STAC_DELL_3ST),
+ 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x01f4, "Dell     ", STAC_DELL_3ST),
+ 	/* Dell 3 stack systems with verb table in BIOS */
+ 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x01f3, "Dell Inspiron 1420", STAC_DELL_BIOS),
++	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x01f7, "Dell XPS M1730", STAC_DELL_BIOS),
+ 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x0227, "Dell Vostro 1400  ", STAC_DELL_BIOS),
+ 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x022e, "Dell     ", STAC_DELL_BIOS),
+ 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x022f, "Dell Inspiron 1525", STAC_DELL_BIOS),
+diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c
+index 718ef91..b1be92a 100644
+--- a/sound/soc/codecs/wm8350.c
++++ b/sound/soc/codecs/wm8350.c
+@@ -423,8 +423,8 @@ static const struct soc_enum wm8350_enum[] = {
+ 	SOC_ENUM_SINGLE(WM8350_INPUT_MIXER_VOLUME, 15, 2, wm8350_lr),
+ };
+ 
+-static DECLARE_TLV_DB_LINEAR(pre_amp_tlv, -1200, 3525);
+-static DECLARE_TLV_DB_LINEAR(out_pga_tlv, -5700, 600);
++static DECLARE_TLV_DB_SCALE(pre_amp_tlv, -1200, 3525, 0);
++static DECLARE_TLV_DB_SCALE(out_pga_tlv, -5700, 600, 0);
+ static DECLARE_TLV_DB_SCALE(dac_pcm_tlv, -7163, 36, 1);
+ static DECLARE_TLV_DB_SCALE(adc_pcm_tlv, -12700, 50, 1);
+ static DECLARE_TLV_DB_SCALE(out_mix_tlv, -1500, 300, 1);
+diff --git a/sound/soc/codecs/wm8400.c b/sound/soc/codecs/wm8400.c
+index b432f4d..6390ffe 100644
+--- a/sound/soc/codecs/wm8400.c
++++ b/sound/soc/codecs/wm8400.c
+@@ -106,21 +106,21 @@ static void wm8400_codec_reset(struct snd_soc_codec *codec)
+ 	wm8400_reset_codec_reg_cache(wm8400->wm8400);
+ }
+ 
+-static const DECLARE_TLV_DB_LINEAR(rec_mix_tlv, -1500, 600);
++static const DECLARE_TLV_DB_SCALE(rec_mix_tlv, -1500, 600, 0);
+ 
+-static const DECLARE_TLV_DB_LINEAR(in_pga_tlv, -1650, 3000);
++static const DECLARE_TLV_DB_SCALE(in_pga_tlv, -1650, 3000, 0);
+ 
+-static const DECLARE_TLV_DB_LINEAR(out_mix_tlv, -2100, 0);
++static const DECLARE_TLV_DB_SCALE(out_mix_tlv, -2100, 0, 0);
+ 
+-static const DECLARE_TLV_DB_LINEAR(out_pga_tlv, -7300, 600);
++static const DECLARE_TLV_DB_SCALE(out_pga_tlv, -7300, 600, 0);
+ 
+-static const DECLARE_TLV_DB_LINEAR(out_omix_tlv, -600, 0);
++static const DECLARE_TLV_DB_SCALE(out_omix_tlv, -600, 0, 0);
+ 
+-static const DECLARE_TLV_DB_LINEAR(out_dac_tlv, -7163, 0);
++static const DECLARE_TLV_DB_SCALE(out_dac_tlv, -7163, 0, 0);
+ 
+-static const DECLARE_TLV_DB_LINEAR(in_adc_tlv, -7163, 1763);
++static const DECLARE_TLV_DB_SCALE(in_adc_tlv, -7163, 1763, 0);
+ 
+-static const DECLARE_TLV_DB_LINEAR(out_sidetone_tlv, -3600, 0);
++static const DECLARE_TLV_DB_SCALE(out_sidetone_tlv, -3600, 0, 0);
+ 
+ static int wm8400_outpga_put_volsw_vu(struct snd_kcontrol *kcontrol,
+         struct snd_ctl_elem_value *ucontrol)
+@@ -439,7 +439,7 @@ static int outmixer_event (struct snd_soc_dapm_widget *w,
+ /* INMIX dB values */
+ static const unsigned int in_mix_tlv[] = {
+ 	TLV_DB_RANGE_HEAD(1),
+-	0,7, TLV_DB_LINEAR_ITEM(-1200, 600),
++	0,7, TLV_DB_SCALE_ITEM(-1200, 600, 0),
+ };
+ 
+ /* Left In PGA Connections */
+diff --git a/sound/soc/codecs/wm8990.c b/sound/soc/codecs/wm8990.c
+index 341481e..2f76f4d 100644
+--- a/sound/soc/codecs/wm8990.c
++++ b/sound/soc/codecs/wm8990.c
+@@ -110,21 +110,21 @@ static const u16 wm8990_reg[] = {
+ 
+ #define wm8990_reset(c) snd_soc_write(c, WM8990_RESET, 0)
+ 
+-static const DECLARE_TLV_DB_LINEAR(rec_mix_tlv, -1500, 600);
++static const DECLARE_TLV_DB_SCALE(rec_mix_tlv, -1500, 600, 0);
+ 
+-static const DECLARE_TLV_DB_LINEAR(in_pga_tlv, -1650, 3000);
++static const DECLARE_TLV_DB_SCALE(in_pga_tlv, -1650, 3000, 0);
+ 
+-static const DECLARE_TLV_DB_LINEAR(out_mix_tlv, 0, -2100);
++static const DECLARE_TLV_DB_SCALE(out_mix_tlv, 0, -2100, 0);
+ 
+-static const DECLARE_TLV_DB_LINEAR(out_pga_tlv, -7300, 600);
++static const DECLARE_TLV_DB_SCALE(out_pga_tlv, -7300, 600, 0);
+ 
+-static const DECLARE_TLV_DB_LINEAR(out_omix_tlv, -600, 0);
++static const DECLARE_TLV_DB_SCALE(out_omix_tlv, -600, 0, 0);
+ 
+-static const DECLARE_TLV_DB_LINEAR(out_dac_tlv, -7163, 0);
++static const DECLARE_TLV_DB_SCALE(out_dac_tlv, -7163, 0, 0);
+ 
+-static const DECLARE_TLV_DB_LINEAR(in_adc_tlv, -7163, 1763);
++static const DECLARE_TLV_DB_SCALE(in_adc_tlv, -7163, 1763, 0);
+ 
+-static const DECLARE_TLV_DB_LINEAR(out_sidetone_tlv, -3600, 0);
++static const DECLARE_TLV_DB_SCALE(out_sidetone_tlv, -3600, 0, 0);
+ 
+ static int wm899x_outpga_put_volsw_vu(struct snd_kcontrol *kcontrol,
+ 	struct snd_ctl_elem_value *ucontrol)
+@@ -450,7 +450,7 @@ static int outmixer_event(struct snd_soc_dapm_widget *w,
+ /* INMIX dB values */
+ static const unsigned int in_mix_tlv[] = {
+ 	TLV_DB_RANGE_HEAD(1),
+-	0, 7, TLV_DB_LINEAR_ITEM(-1200, 600),
++	0, 7, TLV_DB_SCALE_ITEM(-1200, 600, 0),
+ };
+ 
+ /* Left In PGA Connections */