[gentoo-commits] linux-patches r2595 - in genpatches-2.6/trunk: . 3.10 3.11 3.12 3.2 3.4

[Tom Wijsman (tomwij)]

Author: tomwij
Date: 2013-11-29 23:44:29 +0000 (Fri, 29 Nov 2013)
New Revision: 2595

Added:
   genpatches-2.6/trunk/3.10/1020_linux-3.10.21.patch
   genpatches-2.6/trunk/3.11/1009_linux-3.11.10.patch
   genpatches-2.6/trunk/3.12/1001_linux-3.12.2.patch
   genpatches-2.6/trunk/3.2/
   genpatches-2.6/trunk/3.2/1051_linux-3.2.52.patch
   genpatches-2.6/trunk/3.4/1070_linux-3.4.71.patch
Modified:
   genpatches-2.6/trunk/3.10/0000_README
   genpatches-2.6/trunk/3.11/0000_README
   genpatches-2.6/trunk/3.12/0000_README
   genpatches-2.6/trunk/3.2/0000_README
   genpatches-2.6/trunk/3.4/0000_README
Log:
Added back 3.2 branch as it is still long term. Linux patches 3.2.52, 3.4.71, 3.10.21, 3.11.10 and 3.12.2.

Modified: genpatches-2.6/trunk/3.10/0000_README
===================================================================
--- genpatches-2.6/trunk/3.10/0000_README	2013-11-26 00:34:31 UTC (rev 2594)
+++ genpatches-2.6/trunk/3.10/0000_README	2013-11-29 23:44:29 UTC (rev 2595)
@@ -122,6 +122,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.10.20
 
+Patch:  1020_linux-3.10.21.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.21
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.10/1020_linux-3.10.21.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1020_linux-3.10.21.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10/1020_linux-3.10.21.patch	2013-11-29 23:44:29 UTC (rev 2595)
@@ -0,0 +1,2728 @@
+diff --git a/Makefile b/Makefile
+index ba784b7b0f51..c0635fbab87f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 20
++SUBLEVEL = 21
+ EXTRAVERSION =
+ NAME = TOSSUG Baby Fish
+ 
+diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
+index 84ba67b982c0..e04613906f1b 100644
+--- a/arch/arm/kvm/mmu.c
++++ b/arch/arm/kvm/mmu.c
+@@ -313,6 +313,17 @@ out:
+ 	return err;
+ }
+ 
++static phys_addr_t kvm_kaddr_to_phys(void *kaddr)
++{
++	if (!is_vmalloc_addr(kaddr)) {
++		BUG_ON(!virt_addr_valid(kaddr));
++		return __pa(kaddr);
++	} else {
++		return page_to_phys(vmalloc_to_page(kaddr)) +
++		       offset_in_page(kaddr);
++	}
++}
++
+ /**
+  * create_hyp_mappings - duplicate a kernel virtual address range in Hyp mode
+  * @from:	The virtual kernel start address of the range
+@@ -324,16 +335,27 @@ out:
+  */
+ int create_hyp_mappings(void *from, void *to)
+ {
+-	unsigned long phys_addr = virt_to_phys(from);
++	phys_addr_t phys_addr;
++	unsigned long virt_addr;
+ 	unsigned long start = KERN_TO_HYP((unsigned long)from);
+ 	unsigned long end = KERN_TO_HYP((unsigned long)to);
+ 
+-	/* Check for a valid kernel memory mapping */
+-	if (!virt_addr_valid(from) || !virt_addr_valid(to - 1))
+-		return -EINVAL;
++	start = start & PAGE_MASK;
++	end = PAGE_ALIGN(end);
+ 
+-	return __create_hyp_mappings(hyp_pgd, start, end,
+-				     __phys_to_pfn(phys_addr), PAGE_HYP);
++	for (virt_addr = start; virt_addr < end; virt_addr += PAGE_SIZE) {
++		int err;
++
++		phys_addr = kvm_kaddr_to_phys(from + virt_addr - start);
++		err = __create_hyp_mappings(hyp_pgd, virt_addr,
++					    virt_addr + PAGE_SIZE,
++					    __phys_to_pfn(phys_addr),
++					    PAGE_HYP);
++		if (err)
++			return err;
++	}
++
++	return 0;
+ }
+ 
+ /**
+diff --git a/arch/cris/include/asm/io.h b/arch/cris/include/asm/io.h
+index ac12ae2b9286..db9a16c704f3 100644
+--- a/arch/cris/include/asm/io.h
++++ b/arch/cris/include/asm/io.h
+@@ -3,6 +3,7 @@
+ 
+ #include <asm/page.h>   /* for __va, __pa */
+ #include <arch/io.h>
++#include <asm-generic/iomap.h>
+ #include <linux/kernel.h>
+ 
+ struct cris_io_operations
+diff --git a/arch/ia64/include/asm/processor.h b/arch/ia64/include/asm/processor.h
+index e0a899a1a8a6..5a84b3a50741 100644
+--- a/arch/ia64/include/asm/processor.h
++++ b/arch/ia64/include/asm/processor.h
+@@ -319,7 +319,7 @@ struct thread_struct {
+ 	regs->loadrs = 0;									\
+ 	regs->r8 = get_dumpable(current->mm);	/* set "don't zap registers" flag */		\
+ 	regs->r12 = new_sp - 16;	/* allocate 16 byte scratch area */			\
+-	if (unlikely(!get_dumpable(current->mm))) {							\
++	if (unlikely(get_dumpable(current->mm) != SUID_DUMP_USER)) {	\
+ 		/*										\
+ 		 * Zap scratch regs to avoid leaking bits between processes with different	\
+ 		 * uid/privileges.								\
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
+index 0f83122e6676..323309963cd3 100644
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -454,7 +454,15 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
+ 		if (copy_vsx_to_user(&frame->mc_vsregs, current))
+ 			return 1;
+ 		msr |= MSR_VSX;
+-	}
++	} else if (!ctx_has_vsx_region)
++		/*
++		 * With a small context structure we can't hold the VSX
++		 * registers, hence clear the MSR value to indicate the state
++		 * was not saved.
++		 */
++		msr &= ~MSR_VSX;
++
++
+ #endif /* CONFIG_VSX */
+ #ifdef CONFIG_SPE
+ 	/* save spe registers */
+diff --git a/arch/powerpc/kernel/vio.c b/arch/powerpc/kernel/vio.c
+index 2d845d8199fc..56d2e72c85de 100644
+--- a/arch/powerpc/kernel/vio.c
++++ b/arch/powerpc/kernel/vio.c
+@@ -1530,12 +1530,12 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
+ 
+ 	dn = dev->of_node;
+ 	if (!dn) {
+-		strcat(buf, "\n");
++		strcpy(buf, "\n");
+ 		return strlen(buf);
+ 	}
+ 	cp = of_get_property(dn, "compatible", NULL);
+ 	if (!cp) {
+-		strcat(buf, "\n");
++		strcpy(buf, "\n");
+ 		return strlen(buf);
+ 	}
+ 
+diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
+index 3e99c149271a..7ce9cf3b6988 100644
+--- a/arch/powerpc/mm/slice.c
++++ b/arch/powerpc/mm/slice.c
+@@ -258,7 +258,7 @@ static bool slice_scan_available(unsigned long addr,
+ 		slice = GET_HIGH_SLICE_INDEX(addr);
+ 		*boundary_addr = (slice + end) ?
+ 			((slice + end) << SLICE_HIGH_SHIFT) : SLICE_LOW_TOP;
+-		return !!(available.high_slices & (1u << slice));
++		return !!(available.high_slices & (1ul << slice));
+ 	}
+ }
+ 
+diff --git a/arch/powerpc/platforms/52xx/Kconfig b/arch/powerpc/platforms/52xx/Kconfig
+index 90f4496017e4..af54174801f7 100644
+--- a/arch/powerpc/platforms/52xx/Kconfig
++++ b/arch/powerpc/platforms/52xx/Kconfig
+@@ -57,5 +57,5 @@ config PPC_MPC5200_BUGFIX
+ 
+ config PPC_MPC5200_LPBFIFO
+ 	tristate "MPC5200 LocalPlus bus FIFO driver"
+-	depends on PPC_MPC52xx
++	depends on PPC_MPC52xx && PPC_BESTCOMM
+ 	select PPC_BESTCOMM_GEN_BD
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 7816beff1db8..f75607c93e8a 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -151,13 +151,23 @@ static int pnv_ioda_configure_pe(struct pnv_phb *phb, struct pnv_ioda_pe *pe)
+ 		rid_end = pe->rid + 1;
+ 	}
+ 
+-	/* Associate PE in PELT */
++	/*
++	 * Associate PE in PELT. We need add the PE into the
++	 * corresponding PELT-V as well. Otherwise, the error
++	 * originated from the PE might contribute to other
++	 * PEs.
++	 */
+ 	rc = opal_pci_set_pe(phb->opal_id, pe->pe_number, pe->rid,
+ 			     bcomp, dcomp, fcomp, OPAL_MAP_PE);
+ 	if (rc) {
+ 		pe_err(pe, "OPAL error %ld trying to setup PELT table\n", rc);
+ 		return -ENXIO;
+ 	}
++
++	rc = opal_pci_set_peltv(phb->opal_id, pe->pe_number,
++				pe->pe_number, OPAL_ADD_PE_TO_DOMAIN);
++	if (rc)
++		pe_warn(pe, "OPAL error %d adding self to PELTV\n", rc);
+ 	opal_pci_eeh_freeze_clear(phb->opal_id, pe->pe_number,
+ 				  OPAL_EEH_ACTION_CLEAR_FREEZE_ALL);
+ 
+diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
+index b4dbade8ca24..2e4b5be31a1b 100644
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -35,7 +35,6 @@ static u8 *ctrblk;
+ static char keylen_flag;
+ 
+ struct s390_aes_ctx {
+-	u8 iv[AES_BLOCK_SIZE];
+ 	u8 key[AES_MAX_KEY_SIZE];
+ 	long enc;
+ 	long dec;
+@@ -441,30 +440,36 @@ static int cbc_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
+ 	return aes_set_key(tfm, in_key, key_len);
+ }
+ 
+-static int cbc_aes_crypt(struct blkcipher_desc *desc, long func, void *param,
++static int cbc_aes_crypt(struct blkcipher_desc *desc, long func,
+ 			 struct blkcipher_walk *walk)
+ {
++	struct s390_aes_ctx *sctx = crypto_blkcipher_ctx(desc->tfm);
+ 	int ret = blkcipher_walk_virt(desc, walk);
+ 	unsigned int nbytes = walk->nbytes;
++	struct {
++		u8 iv[AES_BLOCK_SIZE];
++		u8 key[AES_MAX_KEY_SIZE];
++	} param;
+ 
+ 	if (!nbytes)
+ 		goto out;
+ 
+-	memcpy(param, walk->iv, AES_BLOCK_SIZE);
++	memcpy(param.iv, walk->iv, AES_BLOCK_SIZE);
++	memcpy(param.key, sctx->key, sctx->key_len);
+ 	do {
+ 		/* only use complete blocks */
+ 		unsigned int n = nbytes & ~(AES_BLOCK_SIZE - 1);
+ 		u8 *out = walk->dst.virt.addr;
+ 		u8 *in = walk->src.virt.addr;
+ 
+-		ret = crypt_s390_kmc(func, param, out, in, n);
++		ret = crypt_s390_kmc(func, &param, out, in, n);
+ 		if (ret < 0 || ret != n)
+ 			return -EIO;
+ 
+ 		nbytes &= AES_BLOCK_SIZE - 1;
+ 		ret = blkcipher_walk_done(desc, walk, nbytes);
+ 	} while ((nbytes = walk->nbytes));
+-	memcpy(walk->iv, param, AES_BLOCK_SIZE);
++	memcpy(walk->iv, param.iv, AES_BLOCK_SIZE);
+ 
+ out:
+ 	return ret;
+@@ -481,7 +486,7 @@ static int cbc_aes_encrypt(struct blkcipher_desc *desc,
+ 		return fallback_blk_enc(desc, dst, src, nbytes);
+ 
+ 	blkcipher_walk_init(&walk, dst, src, nbytes);
+-	return cbc_aes_crypt(desc, sctx->enc, sctx->iv, &walk);
++	return cbc_aes_crypt(desc, sctx->enc, &walk);
+ }
+ 
+ static int cbc_aes_decrypt(struct blkcipher_desc *desc,
+@@ -495,7 +500,7 @@ static int cbc_aes_decrypt(struct blkcipher_desc *desc,
+ 		return fallback_blk_dec(desc, dst, src, nbytes);
+ 
+ 	blkcipher_walk_init(&walk, dst, src, nbytes);
+-	return cbc_aes_crypt(desc, sctx->dec, sctx->iv, &walk);
++	return cbc_aes_crypt(desc, sctx->dec, &walk);
+ }
+ 
+ static struct crypto_alg cbc_aes_alg = {
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index 4f977d0d25c2..14647fe09d0c 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -933,7 +933,7 @@ static ssize_t show_idle_count(struct device *dev,
+ 		idle_count = ACCESS_ONCE(idle->idle_count);
+ 		if (ACCESS_ONCE(idle->clock_idle_enter))
+ 			idle_count++;
+-	} while ((sequence & 1) || (idle->sequence != sequence));
++	} while ((sequence & 1) || (ACCESS_ONCE(idle->sequence) != sequence));
+ 	return sprintf(buf, "%llu\n", idle_count);
+ }
+ static DEVICE_ATTR(idle_count, 0444, show_idle_count, NULL);
+@@ -951,7 +951,7 @@ static ssize_t show_idle_time(struct device *dev,
+ 		idle_time = ACCESS_ONCE(idle->idle_time);
+ 		idle_enter = ACCESS_ONCE(idle->clock_idle_enter);
+ 		idle_exit = ACCESS_ONCE(idle->clock_idle_exit);
+-	} while ((sequence & 1) || (idle->sequence != sequence));
++	} while ((sequence & 1) || (ACCESS_ONCE(idle->sequence) != sequence));
+ 	idle_time += idle_enter ? ((idle_exit ? : now) - idle_enter) : 0;
+ 	return sprintf(buf, "%llu\n", idle_time >> 12);
+ }
+diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
+index 3fb09359eda6..737d50caa4fe 100644
+--- a/arch/s390/kernel/vtime.c
++++ b/arch/s390/kernel/vtime.c
+@@ -190,7 +190,7 @@ cputime64_t s390_get_idle_time(int cpu)
+ 		sequence = ACCESS_ONCE(idle->sequence);
+ 		idle_enter = ACCESS_ONCE(idle->clock_idle_enter);
+ 		idle_exit = ACCESS_ONCE(idle->clock_idle_exit);
+-	} while ((sequence & 1) || (idle->sequence != sequence));
++	} while ((sequence & 1) || (ACCESS_ONCE(idle->sequence) != sequence));
+ 	return idle_enter ? ((idle_exit ?: now) - idle_enter) : 0;
+ }
+ 
+diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
+index 42a392a9fd02..d4bdd253fea7 100644
+--- a/arch/x86/kernel/ftrace.c
++++ b/arch/x86/kernel/ftrace.c
+@@ -248,6 +248,15 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
+ 	return ret;
+ }
+ 
++static int is_ftrace_caller(unsigned long ip)
++{
++	if (ip == (unsigned long)(&ftrace_call) ||
++		ip == (unsigned long)(&ftrace_regs_call))
++		return 1;
++
++	return 0;
++}
++
+ /*
+  * A breakpoint was added to the code address we are about to
+  * modify, and this is the handle that will just skip over it.
+@@ -257,10 +266,13 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
+  */
+ int ftrace_int3_handler(struct pt_regs *regs)
+ {
++	unsigned long ip;
++
+ 	if (WARN_ON_ONCE(!regs))
+ 		return 0;
+ 
+-	if (!ftrace_location(regs->ip - 1))
++	ip = regs->ip - 1;
++	if (!ftrace_location(ip) && !is_ftrace_caller(ip))
+ 		return 0;
+ 
+ 	regs->ip += MCOUNT_INSN_SIZE - 1;
+diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
+index efdec7cd8e01..b516dfb411ec 100644
+--- a/arch/x86/kernel/microcode_amd.c
++++ b/arch/x86/kernel/microcode_amd.c
+@@ -430,7 +430,7 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device,
+ 		snprintf(fw_name, sizeof(fw_name), "amd-ucode/microcode_amd_fam%.2xh.bin", c->x86);
+ 
+ 	if (request_firmware(&fw, (const char *)fw_name, device)) {
+-		pr_err("failed to load file %s\n", fw_name);
++		pr_debug("failed to load file %s\n", fw_name);
+ 		goto out;
+ 	}
+ 
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 81a5f5e8f142..59b90379cb6a 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -391,9 +391,9 @@ static void amd_e400_idle(void)
+ 		 * The switch back from broadcast mode needs to be
+ 		 * called with interrupts disabled.
+ 		 */
+-		 local_irq_disable();
+-		 clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_EXIT, &cpu);
+-		 local_irq_enable();
++		local_irq_disable();
++		clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_EXIT, &cpu);
++		local_irq_enable();
+ 	} else
+ 		default_idle();
+ }
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 5953dcea752d..5484d54582ca 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -4207,7 +4207,10 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
+ 	case OpMem8:
+ 		ctxt->memop.bytes = 1;
+ 		if (ctxt->memop.type == OP_REG) {
+-			ctxt->memop.addr.reg = decode_register(ctxt, ctxt->modrm_rm, 1);
++			int highbyte_regs = ctxt->rex_prefix == 0;
++
++			ctxt->memop.addr.reg = decode_register(ctxt, ctxt->modrm_rm,
++					       highbyte_regs);
+ 			fetch_register_operand(&ctxt->memop);
+ 		}
+ 		goto mem_common;
+diff --git a/block/blk-core.c b/block/blk-core.c
+index d5745b5833c9..45f3a51f6b56 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -2229,6 +2229,7 @@ void blk_start_request(struct request *req)
+ 	if (unlikely(blk_bidi_rq(req)))
+ 		req->next_rq->resid_len = blk_rq_bytes(req->next_rq);
+ 
++	BUG_ON(test_bit(REQ_ATOM_COMPLETE, &req->atomic_flags));
+ 	blk_add_timer(req);
+ }
+ EXPORT_SYMBOL(blk_start_request);
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index c50ecf0ea3b1..53309333c2f0 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -144,6 +144,7 @@ void blk_set_stacking_limits(struct queue_limits *lim)
+ 	lim->discard_zeroes_data = 1;
+ 	lim->max_segments = USHRT_MAX;
+ 	lim->max_hw_sectors = UINT_MAX;
++	lim->max_segment_size = UINT_MAX;
+ 	lim->max_sectors = UINT_MAX;
+ 	lim->max_write_same_sectors = UINT_MAX;
+ }
+diff --git a/block/blk-timeout.c b/block/blk-timeout.c
+index 6e4744cbfb56..5a6296ef9a81 100644
+--- a/block/blk-timeout.c
++++ b/block/blk-timeout.c
+@@ -90,8 +90,8 @@ static void blk_rq_timed_out(struct request *req)
+ 		__blk_complete_request(req);
+ 		break;
+ 	case BLK_EH_RESET_TIMER:
+-		blk_clear_rq_complete(req);
+ 		blk_add_timer(req);
++		blk_clear_rq_complete(req);
+ 		break;
+ 	case BLK_EH_NOT_HANDLED:
+ 		/*
+@@ -173,7 +173,6 @@ void blk_add_timer(struct request *req)
+ 		return;
+ 
+ 	BUG_ON(!list_empty(&req->timeout_list));
+-	BUG_ON(test_bit(REQ_ATOM_COMPLETE, &req->atomic_flags));
+ 
+ 	/*
+ 	 * Some LLDs, like scsi, peek at the timeout to prevent a
+diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
+index c0bb3778f1ae..666f1962a160 100644
+--- a/crypto/ansi_cprng.c
++++ b/crypto/ansi_cprng.c
+@@ -230,11 +230,11 @@ remainder:
+ 	 */
+ 	if (byte_count < DEFAULT_BLK_SZ) {
+ empty_rbuf:
+-		for (; ctx->rand_data_valid < DEFAULT_BLK_SZ;
+-			ctx->rand_data_valid++) {
++		while (ctx->rand_data_valid < DEFAULT_BLK_SZ) {
+ 			*ptr = ctx->rand_data[ctx->rand_data_valid];
+ 			ptr++;
+ 			byte_count--;
++			ctx->rand_data_valid++;
+ 			if (byte_count == 0)
+ 				goto done;
+ 		}
+diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c
+index b60c877f5906..c3241b188434 100644
+--- a/drivers/acpi/acpica/exoparg1.c
++++ b/drivers/acpi/acpica/exoparg1.c
+@@ -963,10 +963,17 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state)
+ 					 */
+ 					return_desc =
+ 					    *(operand[0]->reference.where);
+-					if (return_desc) {
+-						acpi_ut_add_reference
+-						    (return_desc);
++					if (!return_desc) {
++						/*
++						 * Element is NULL, do not allow the dereference.
++						 * This provides compatibility with other ACPI
++						 * implementations.
++						 */
++						return_ACPI_STATUS
++						    (AE_AML_UNINITIALIZED_ELEMENT);
+ 					}
++
++					acpi_ut_add_reference(return_desc);
+ 					break;
+ 
+ 				default:
+@@ -991,11 +998,40 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state)
+ 									 acpi_namespace_node
+ 									 *)
+ 									return_desc);
+-				}
++					if (!return_desc) {
++						break;
++					}
+ 
+-				/* Add another reference to the object! */
++					/*
++					 * June 2013:
++					 * buffer_fields/field_units require additional resolution
++					 */
++					switch (return_desc->common.type) {
++					case ACPI_TYPE_BUFFER_FIELD:
++					case ACPI_TYPE_LOCAL_REGION_FIELD:
++					case ACPI_TYPE_LOCAL_BANK_FIELD:
++					case ACPI_TYPE_LOCAL_INDEX_FIELD:
+ 
+-				acpi_ut_add_reference(return_desc);
++						status =
++						    acpi_ex_read_data_from_field
++						    (walk_state, return_desc,
++						     &temp_desc);
++						if (ACPI_FAILURE(status)) {
++							goto cleanup;
++						}
++
++						return_desc = temp_desc;
++						break;
++
++					default:
++
++						/* Add another reference to the object */
++
++						acpi_ut_add_reference
++						    (return_desc);
++						break;
++					}
++				}
+ 				break;
+ 
+ 			default:
+diff --git a/drivers/acpi/acpica/exstore.c b/drivers/acpi/acpica/exstore.c
+index 93c6049c2d75..b1ad39443cb6 100644
+--- a/drivers/acpi/acpica/exstore.c
++++ b/drivers/acpi/acpica/exstore.c
+@@ -57,6 +57,11 @@ acpi_ex_store_object_to_index(union acpi_operand_object *val_desc,
+ 			      union acpi_operand_object *dest_desc,
+ 			      struct acpi_walk_state *walk_state);
+ 
++static acpi_status
++acpi_ex_store_direct_to_node(union acpi_operand_object *source_desc,
++			     struct acpi_namespace_node *node,
++			     struct acpi_walk_state *walk_state);
++
+ /*******************************************************************************
+  *
+  * FUNCTION:    acpi_ex_store
+@@ -376,7 +381,11 @@ acpi_ex_store_object_to_index(union acpi_operand_object *source_desc,
+  *              When storing into an object the data is converted to the
+  *              target object type then stored in the object. This means
+  *              that the target object type (for an initialized target) will
+- *              not be changed by a store operation.
++ *              not be changed by a store operation. A copy_object can change
++ *              the target type, however.
++ *
++ *              The implicit_conversion flag is set to NO/FALSE only when
++ *              storing to an arg_x -- as per the rules of the ACPI spec.
+  *
+  *              Assumes parameters are already validated.
+  *
+@@ -400,7 +409,7 @@ acpi_ex_store_object_to_node(union acpi_operand_object *source_desc,
+ 	target_type = acpi_ns_get_type(node);
+ 	target_desc = acpi_ns_get_attached_object(node);
+ 
+-	ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "Storing %p(%s) into node %p(%s)\n",
++	ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "Storing %p (%s) to node %p (%s)\n",
+ 			  source_desc,
+ 			  acpi_ut_get_object_type_name(source_desc), node,
+ 			  acpi_ut_get_type_name(target_type)));
+@@ -414,46 +423,31 @@ acpi_ex_store_object_to_node(union acpi_operand_object *source_desc,
+ 		return_ACPI_STATUS(status);
+ 	}
+ 
+-	/* If no implicit conversion, drop into the default case below */
+-
+-	if ((!implicit_conversion) ||
+-	    ((walk_state->opcode == AML_COPY_OP) &&
+-	     (target_type != ACPI_TYPE_LOCAL_REGION_FIELD) &&
+-	     (target_type != ACPI_TYPE_LOCAL_BANK_FIELD) &&
+-	     (target_type != ACPI_TYPE_LOCAL_INDEX_FIELD))) {
+-		/*
+-		 * Force execution of default (no implicit conversion). Note:
+-		 * copy_object does not perform an implicit conversion, as per the ACPI
+-		 * spec -- except in case of region/bank/index fields -- because these
+-		 * objects must retain their original type permanently.
+-		 */
+-		target_type = ACPI_TYPE_ANY;
+-	}
+-
+ 	/* Do the actual store operation */
+ 
+ 	switch (target_type) {
+-	case ACPI_TYPE_BUFFER_FIELD:
+-	case ACPI_TYPE_LOCAL_REGION_FIELD:
+-	case ACPI_TYPE_LOCAL_BANK_FIELD:
+-	case ACPI_TYPE_LOCAL_INDEX_FIELD:
+-
+-		/* For fields, copy the source data to the target field. */
+-
+-		status = acpi_ex_write_data_to_field(source_desc, target_desc,
+-						     &walk_state->result_obj);
+-		break;
+-
+ 	case ACPI_TYPE_INTEGER:
+ 	case ACPI_TYPE_STRING:
+ 	case ACPI_TYPE_BUFFER:
+ 
+ 		/*
+-		 * These target types are all of type Integer/String/Buffer, and
+-		 * therefore support implicit conversion before the store.
+-		 *
+-		 * Copy and/or convert the source object to a new target object
++		 * The simple data types all support implicit source operand
++		 * conversion before the store.
+ 		 */
++
++		if ((walk_state->opcode == AML_COPY_OP) || !implicit_conversion) {
++			/*
++			 * However, copy_object and Stores to arg_x do not perform
++			 * an implicit conversion, as per the ACPI specification.
++			 * A direct store is performed instead.
++			 */
++			status = acpi_ex_store_direct_to_node(source_desc, node,
++							      walk_state);
++			break;
++		}
++
++		/* Store with implicit source operand conversion support */
++
+ 		status =
+ 		    acpi_ex_store_object_to_object(source_desc, target_desc,
+ 						   &new_desc, walk_state);
+@@ -467,13 +461,12 @@ acpi_ex_store_object_to_node(union acpi_operand_object *source_desc,
+ 			 * the Name's type to that of the value being stored in it.
+ 			 * source_desc reference count is incremented by attach_object.
+ 			 *
+-			 * Note: This may change the type of the node if an explicit store
+-			 * has been performed such that the node/object type has been
+-			 * changed.
++			 * Note: This may change the type of the node if an explicit
++			 * store has been performed such that the node/object type
++			 * has been changed.
+ 			 */
+-			status =
+-			    acpi_ns_attach_object(node, new_desc,
+-						  new_desc->common.type);
++			status = acpi_ns_attach_object(node, new_desc,
++						       new_desc->common.type);
+ 
+ 			ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
+ 					  "Store %s into %s via Convert/Attach\n",
+@@ -484,38 +477,83 @@ acpi_ex_store_object_to_node(union acpi_operand_object *source_desc,
+ 		}
+ 		break;
+ 
+-	default:
+-
+-		ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
+-				  "Storing [%s] (%p) directly into node [%s] (%p)"
+-				  " with no implicit conversion\n",
+-				  acpi_ut_get_object_type_name(source_desc),
+-				  source_desc,
+-				  acpi_ut_get_object_type_name(target_desc),
+-				  node));
++	case ACPI_TYPE_BUFFER_FIELD:
++	case ACPI_TYPE_LOCAL_REGION_FIELD:
++	case ACPI_TYPE_LOCAL_BANK_FIELD:
++	case ACPI_TYPE_LOCAL_INDEX_FIELD:
++		/*
++		 * For all fields, always write the source data to the target
++		 * field. Any required implicit source operand conversion is
++		 * performed in the function below as necessary. Note, field
++		 * objects must retain their original type permanently.
++		 */
++		status = acpi_ex_write_data_to_field(source_desc, target_desc,
++						     &walk_state->result_obj);
++		break;
+ 
++	default:
+ 		/*
+ 		 * No conversions for all other types. Directly store a copy of
+-		 * the source object. NOTE: This is a departure from the ACPI
+-		 * spec, which states "If conversion is impossible, abort the
+-		 * running control method".
++		 * the source object. This is the ACPI spec-defined behavior for
++		 * the copy_object operator.
+ 		 *
+-		 * This code implements "If conversion is impossible, treat the
+-		 * Store operation as a CopyObject".
++		 * NOTE: For the Store operator, this is a departure from the
++		 * ACPI spec, which states "If conversion is impossible, abort
++		 * the running control method". Instead, this code implements
++		 * "If conversion is impossible, treat the Store operation as
++		 * a CopyObject".
+ 		 */
+-		status =
+-		    acpi_ut_copy_iobject_to_iobject(source_desc, &new_desc,
+-						    walk_state);
+-		if (ACPI_FAILURE(status)) {
+-			return_ACPI_STATUS(status);
+-		}
+-
+-		status =
+-		    acpi_ns_attach_object(node, new_desc,
+-					  new_desc->common.type);
+-		acpi_ut_remove_reference(new_desc);
++		status = acpi_ex_store_direct_to_node(source_desc, node,
++						      walk_state);
+ 		break;
+ 	}
+ 
+ 	return_ACPI_STATUS(status);
+ }
++
++/*******************************************************************************
++ *
++ * FUNCTION:    acpi_ex_store_direct_to_node
++ *
++ * PARAMETERS:  source_desc             - Value to be stored
++ *              node                    - Named object to receive the value
++ *              walk_state              - Current walk state
++ *
++ * RETURN:      Status
++ *
++ * DESCRIPTION: "Store" an object directly to a node. This involves a copy
++ *              and an attach.
++ *
++ ******************************************************************************/
++
++static acpi_status
++acpi_ex_store_direct_to_node(union acpi_operand_object *source_desc,
++			     struct acpi_namespace_node *node,
++			     struct acpi_walk_state *walk_state)
++{
++	acpi_status status;
++	union acpi_operand_object *new_desc;
++
++	ACPI_FUNCTION_TRACE(ex_store_direct_to_node);
++
++	ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
++			  "Storing [%s] (%p) directly into node [%s] (%p)"
++			  " with no implicit conversion\n",
++			  acpi_ut_get_object_type_name(source_desc),
++			  source_desc, acpi_ut_get_type_name(node->type),
++			  node));
++
++	/* Copy the source object to a new object */
++
++	status =
++	    acpi_ut_copy_iobject_to_iobject(source_desc, &new_desc, walk_state);
++	if (ACPI_FAILURE(status)) {
++		return_ACPI_STATUS(status);
++	}
++
++	/* Attach the new object to the node */
++
++	status = acpi_ns_attach_object(node, new_desc, new_desc->common.type);
++	acpi_ut_remove_reference(new_desc);
++	return_ACPI_STATUS(status);
++}
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 45af90a1ec1b..1ad5a4f9e0c3 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -175,9 +175,10 @@ static void start_transaction(struct acpi_ec *ec)
+ static void advance_transaction(struct acpi_ec *ec, u8 status)
+ {
+ 	unsigned long flags;
+-	struct transaction *t = ec->curr;
++	struct transaction *t;
+ 
+ 	spin_lock_irqsave(&ec->lock, flags);
++	t = ec->curr;
+ 	if (!t)
+ 		goto unlock;
+ 	if (t->wlen > t->wi) {
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index e427dc516c76..e36842b9e1fa 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -614,9 +614,12 @@ static void handle_root_bridge_removal(struct acpi_device *device)
+ 	ej_event->device = device;
+ 	ej_event->event = ACPI_NOTIFY_EJECT_REQUEST;
+ 
++	get_device(&device->dev);
+ 	status = acpi_os_hotplug_execute(acpi_bus_hot_remove_device, ej_event);
+-	if (ACPI_FAILURE(status))
++	if (ACPI_FAILURE(status)) {
++		put_device(&device->dev);
+ 		kfree(ej_event);
++	}
+ }
+ 
+ static void _handle_hotplug_event_root(struct work_struct *work)
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index eb133c77aadb..4056d3175178 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -121,17 +121,10 @@ static struct dmi_system_id __cpuinitdata processor_power_dmi_table[] = {
+  */
+ static void acpi_safe_halt(void)
+ {
+-	current_thread_info()->status &= ~TS_POLLING;
+-	/*
+-	 * TS_POLLING-cleared state must be visible before we
+-	 * test NEED_RESCHED:
+-	 */
+-	smp_mb();
+-	if (!need_resched()) {
++	if (!tif_need_resched()) {
+ 		safe_halt();
+ 		local_irq_disable();
+ 	}
+-	current_thread_info()->status |= TS_POLLING;
+ }
+ 
+ #ifdef ARCH_APICTIMER_STOPS_ON_C3
+@@ -739,6 +732,11 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
+ 	if (unlikely(!pr))
+ 		return -EINVAL;
+ 
++	if (cx->entry_method == ACPI_CSTATE_FFH) {
++		if (current_set_polling_and_test())
++			return -EINVAL;
++	}
++
+ 	lapic_timer_state_broadcast(pr, cx, 1);
+ 	acpi_idle_do_entry(cx);
+ 
+@@ -792,18 +790,9 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
+ 	if (unlikely(!pr))
+ 		return -EINVAL;
+ 
+-	if (cx->entry_method != ACPI_CSTATE_FFH) {
+-		current_thread_info()->status &= ~TS_POLLING;
+-		/*
+-		 * TS_POLLING-cleared state must be visible before we test
+-		 * NEED_RESCHED:
+-		 */
+-		smp_mb();
+-
+-		if (unlikely(need_resched())) {
+-			current_thread_info()->status |= TS_POLLING;
++	if (cx->entry_method == ACPI_CSTATE_FFH) {
++		if (current_set_polling_and_test())
+ 			return -EINVAL;
+-		}
+ 	}
+ 
+ 	/*
+@@ -821,9 +810,6 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
+ 
+ 	sched_clock_idle_wakeup_event(0);
+ 
+-	if (cx->entry_method != ACPI_CSTATE_FFH)
+-		current_thread_info()->status |= TS_POLLING;
+-
+ 	lapic_timer_state_broadcast(pr, cx, 0);
+ 	return index;
+ }
+@@ -860,18 +846,9 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
+ 		}
+ 	}
+ 
+-	if (cx->entry_method != ACPI_CSTATE_FFH) {
+-		current_thread_info()->status &= ~TS_POLLING;
+-		/*
+-		 * TS_POLLING-cleared state must be visible before we test
+-		 * NEED_RESCHED:
+-		 */
+-		smp_mb();
+-
+-		if (unlikely(need_resched())) {
+-			current_thread_info()->status |= TS_POLLING;
++	if (cx->entry_method == ACPI_CSTATE_FFH) {
++		if (current_set_polling_and_test())
+ 			return -EINVAL;
+-		}
+ 	}
+ 
+ 	acpi_unlazy_tlb(smp_processor_id());
+@@ -917,9 +894,6 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
+ 
+ 	sched_clock_idle_wakeup_event(0);
+ 
+-	if (cx->entry_method != ACPI_CSTATE_FFH)
+-		current_thread_info()->status |= TS_POLLING;
+-
+ 	lapic_timer_state_broadcast(pr, cx, 0);
+ 	return index;
+ }
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index af658b2ff279..362f0c2aa1ea 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -244,8 +244,6 @@ static void acpi_scan_bus_device_check(acpi_handle handle, u32 ost_source)
+ 			goto out;
+ 		}
+ 	}
+-	acpi_evaluate_hotplug_ost(handle, ost_source,
+-				  ACPI_OST_SC_INSERT_IN_PROGRESS, NULL);
+ 	error = acpi_bus_scan(handle);
+ 	if (error) {
+ 		acpi_handle_warn(handle, "Namespace scan failure\n");
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index 0e4b96b62c75..055dfdfd7348 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -846,7 +846,7 @@ acpi_video_init_brightness(struct acpi_video_device *device)
+ 		for (i = 2; i < br->count; i++)
+ 			if (level_old == br->levels[i])
+ 				break;
+-		if (i == br->count)
++		if (i == br->count || !level)
+ 			level = max_level;
+ 	}
+ 
+diff --git a/drivers/block/brd.c b/drivers/block/brd.c
+index 9bf4371755f2..d91f1a56e861 100644
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -545,7 +545,7 @@ static struct kobject *brd_probe(dev_t dev, int *part, void *data)
+ 
+ 	mutex_lock(&brd_devices_mutex);
+ 	brd = brd_init_one(MINOR(dev) >> part_shift);
+-	kobj = brd ? get_disk(brd->brd_disk) : ERR_PTR(-ENOMEM);
++	kobj = brd ? get_disk(brd->brd_disk) : NULL;
+ 	mutex_unlock(&brd_devices_mutex);
+ 
+ 	*part = 0;
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index d92d50fd84b7..00559736cee4 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1741,7 +1741,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data)
+ 	if (err < 0)
+ 		err = loop_add(&lo, MINOR(dev) >> part_shift);
+ 	if (err < 0)
+-		kobj = ERR_PTR(err);
++		kobj = NULL;
+ 	else
+ 		kobj = get_disk(lo->lo_disk);
+ 	mutex_unlock(&loop_index_mutex);
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index b95159b33c39..eb760a218da4 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -551,9 +551,15 @@ static bool dmi_matches(const struct dmi_system_id *dmi)
+ 		int s = dmi->matches[i].slot;
+ 		if (s == DMI_NONE)
+ 			break;
+-		if (dmi_ident[s]
+-		    && strstr(dmi_ident[s], dmi->matches[i].substr))
+-			continue;
++		if (dmi_ident[s]) {
++			if (!dmi->matches[i].exact_match &&
++			    strstr(dmi_ident[s], dmi->matches[i].substr))
++				continue;
++			else if (dmi->matches[i].exact_match &&
++				 !strcmp(dmi_ident[s], dmi->matches[i].substr))
++				continue;
++		}
++
+ 		/* No match */
+ 		return false;
+ 	}
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index 29412cc89c7a..f77d42f74427 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -869,6 +869,30 @@ static const struct dmi_system_id intel_no_lvds[] = {
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "ESPRIMO Q900"),
+ 		},
+ 	},
++	{
++		.callback = intel_no_lvds_dmi_callback,
++		.ident = "Intel D410PT",
++		.matches = {
++			DMI_MATCH(DMI_BOARD_VENDOR, "Intel"),
++			DMI_MATCH(DMI_BOARD_NAME, "D410PT"),
++		},
++	},
++	{
++		.callback = intel_no_lvds_dmi_callback,
++		.ident = "Intel D425KT",
++		.matches = {
++			DMI_MATCH(DMI_BOARD_VENDOR, "Intel"),
++			DMI_EXACT_MATCH(DMI_BOARD_NAME, "D425KT"),
++		},
++	},
++	{
++		.callback = intel_no_lvds_dmi_callback,
++		.ident = "Intel D510MO",
++		.matches = {
++			DMI_MATCH(DMI_BOARD_VENDOR, "Intel"),
++			DMI_EXACT_MATCH(DMI_BOARD_NAME, "D510MO"),
++		},
++	},
+ 
+ 	{ }	/* terminating entry */
+ };
+diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c b/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c
+index 373dbcc523b2..a19e7d79b847 100644
+--- a/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c
++++ b/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c
+@@ -36,6 +36,8 @@ nva3_hda_eld(struct nv50_disp_priv *priv, int or, u8 *data, u32 size)
+ 	if (data && data[0]) {
+ 		for (i = 0; i < size; i++)
+ 			nv_wr32(priv, 0x61c440 + soff, (i << 8) | data[i]);
++		for (; i < 0x60; i++)
++			nv_wr32(priv, 0x61c440 + soff, (i << 8));
+ 		nv_mask(priv, 0x61c448 + soff, 0x80000003, 0x80000003);
+ 	} else
+ 	if (data) {
+diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c b/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c
+index dc57e24fc1df..717639386ced 100644
+--- a/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c
++++ b/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c
+@@ -41,6 +41,8 @@ nvd0_hda_eld(struct nv50_disp_priv *priv, int or, u8 *data, u32 size)
+ 	if (data && data[0]) {
+ 		for (i = 0; i < size; i++)
+ 			nv_wr32(priv, 0x10ec00 + soff, (i << 8) | data[i]);
++		for (; i < 0x60; i++)
++			nv_wr32(priv, 0x10ec00 + soff, (i << 8));
+ 		nv_mask(priv, 0x10ec10 + soff, 0x80000003, 0x80000003);
+ 	} else
+ 	if (data) {
+diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
+index ab1e918469a8..526b75242899 100644
+--- a/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
++++ b/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
+@@ -47,14 +47,8 @@ int
+ nv50_sor_mthd(struct nouveau_object *object, u32 mthd, void *args, u32 size)
+ {
+ 	struct nv50_disp_priv *priv = (void *)object->engine;
+-	struct nouveau_bios *bios = nouveau_bios(priv);
+-	const u16 type = (mthd & NV50_DISP_SOR_MTHD_TYPE) >> 12;
+ 	const u8  head = (mthd & NV50_DISP_SOR_MTHD_HEAD) >> 3;
+-	const u8  link = (mthd & NV50_DISP_SOR_MTHD_LINK) >> 2;
+ 	const u8    or = (mthd & NV50_DISP_SOR_MTHD_OR);
+-	const u16 mask = (0x0100 << head) | (0x0040 << link) | (0x0001 << or);
+-	struct dcb_output outp;
+-	u8  ver, hdr;
+ 	u32 data;
+ 	int ret = -EINVAL;
+ 
+@@ -62,8 +56,6 @@ nv50_sor_mthd(struct nouveau_object *object, u32 mthd, void *args, u32 size)
+ 		return -EINVAL;
+ 	data = *(u32 *)args;
+ 
+-	if (type && !dcb_outp_match(bios, type, mask, &ver, &hdr, &outp))
+-		return -ENODEV;
+ 
+ 	switch (mthd & ~0x3f) {
+ 	case NV50_DISP_SOR_PWR:
+diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
+index 8eeb141c85ac..74813130d211 100644
+--- a/drivers/hwmon/lm90.c
++++ b/drivers/hwmon/lm90.c
+@@ -278,7 +278,7 @@ static const struct lm90_params lm90_params[] = {
+ 	[max6696] = {
+ 		.flags = LM90_HAVE_EMERGENCY
+ 		  | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3,
+-		.alert_alarms = 0x187c,
++		.alert_alarms = 0x1c7c,
+ 		.max_convrate = 6,
+ 		.reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+ 	},
+@@ -1500,19 +1500,22 @@ static void lm90_alert(struct i2c_client *client, unsigned int flag)
+ 	if ((alarms & 0x7f) == 0 && (alarms2 & 0xfe) == 0) {
+ 		dev_info(&client->dev, "Everything OK\n");
+ 	} else {
+-		if (alarms & 0x61)
++		if ((alarms & 0x61) || (alarms2 & 0x80))
+ 			dev_warn(&client->dev,
+ 				 "temp%d out of range, please check!\n", 1);
+-		if (alarms & 0x1a)
++		if ((alarms & 0x1a) || (alarms2 & 0x20))
+ 			dev_warn(&client->dev,
+ 				 "temp%d out of range, please check!\n", 2);
+ 		if (alarms & 0x04)
+ 			dev_warn(&client->dev,
+ 				 "temp%d diode open, please check!\n", 2);
+ 
+-		if (alarms2 & 0x18)
++		if (alarms2 & 0x5a)
+ 			dev_warn(&client->dev,
+ 				 "temp%d out of range, please check!\n", 3);
++		if (alarms2 & 0x04)
++			dev_warn(&client->dev,
++				 "temp%d diode open, please check!\n", 3);
+ 
+ 		/*
+ 		 * Disable ALERT# output, because these chips don't implement
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index fa6964d8681a..f116d664b473 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -359,7 +359,7 @@ static int intel_idle(struct cpuidle_device *dev,
+ 	if (!(lapic_timer_reliable_states & (1 << (cstate))))
+ 		clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &cpu);
+ 
+-	if (!need_resched()) {
++	if (!current_set_polling_and_test()) {
+ 
+ 		__monitor((void *)&current_thread_info()->flags, 0, 0);
+ 		smp_mb();
+diff --git a/drivers/misc/mei/nfc.c b/drivers/misc/mei/nfc.c
+index d0c6907dfd92..994ca4aff1a3 100644
+--- a/drivers/misc/mei/nfc.c
++++ b/drivers/misc/mei/nfc.c
+@@ -485,8 +485,11 @@ int mei_nfc_host_init(struct mei_device *dev)
+ 	if (ndev->cl_info)
+ 		return 0;
+ 
+-	cl_info = mei_cl_allocate(dev);
+-	cl = mei_cl_allocate(dev);
++	ndev->cl_info = mei_cl_allocate(dev);
++	ndev->cl = mei_cl_allocate(dev);
++
++	cl = ndev->cl;
++	cl_info = ndev->cl_info;
+ 
+ 	if (!cl || !cl_info) {
+ 		ret = -ENOMEM;
+@@ -527,10 +530,9 @@ int mei_nfc_host_init(struct mei_device *dev)
+ 
+ 	cl->device_uuid = mei_nfc_guid;
+ 
++
+ 	list_add_tail(&cl->device_link, &dev->device_list);
+ 
+-	ndev->cl_info = cl_info;
+-	ndev->cl = cl;
+ 	ndev->req_id = 1;
+ 
+ 	INIT_WORK(&ndev->init_work, mei_nfc_init);
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index a668cd491cb3..e3fc07cf2f62 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -814,9 +814,6 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota)
+ 			msg_ctrl_save = priv->read_reg(priv,
+ 					C_CAN_IFACE(MSGCTRL_REG, 0));
+ 
+-			if (msg_ctrl_save & IF_MCONT_EOB)
+-				return num_rx_pkts;
+-
+ 			if (msg_ctrl_save & IF_MCONT_MSGLST) {
+ 				c_can_handle_lost_msg_obj(dev, 0, msg_obj);
+ 				num_rx_pkts++;
+@@ -824,6 +821,9 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota)
+ 				continue;
+ 			}
+ 
++			if (msg_ctrl_save & IF_MCONT_EOB)
++				return num_rx_pkts;
++
+ 			if (!(msg_ctrl_save & IF_MCONT_NEWDAT))
+ 				continue;
+ 
+diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
+index 3b9546588240..4b2d5ed62b11 100644
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -1544,9 +1544,9 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
+ 	return 0;
+ }
+ 
+-static void kvaser_usb_get_endpoints(const struct usb_interface *intf,
+-				     struct usb_endpoint_descriptor **in,
+-				     struct usb_endpoint_descriptor **out)
++static int kvaser_usb_get_endpoints(const struct usb_interface *intf,
++				    struct usb_endpoint_descriptor **in,
++				    struct usb_endpoint_descriptor **out)
+ {
+ 	const struct usb_host_interface *iface_desc;
+ 	struct usb_endpoint_descriptor *endpoint;
+@@ -1557,12 +1557,18 @@ static void kvaser_usb_get_endpoints(const struct usb_interface *intf,
+ 	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
+ 		endpoint = &iface_desc->endpoint[i].desc;
+ 
+-		if (usb_endpoint_is_bulk_in(endpoint))
++		if (!*in && usb_endpoint_is_bulk_in(endpoint))
+ 			*in = endpoint;
+ 
+-		if (usb_endpoint_is_bulk_out(endpoint))
++		if (!*out && usb_endpoint_is_bulk_out(endpoint))
+ 			*out = endpoint;
++
++		/* use first bulk endpoint for in and out */
++		if (*in && *out)
++			return 0;
+ 	}
++
++	return -ENODEV;
+ }
+ 
+ static int kvaser_usb_probe(struct usb_interface *intf,
+@@ -1576,8 +1582,8 @@ static int kvaser_usb_probe(struct usb_interface *intf,
+ 	if (!dev)
+ 		return -ENOMEM;
+ 
+-	kvaser_usb_get_endpoints(intf, &dev->bulk_in, &dev->bulk_out);
+-	if (!dev->bulk_in || !dev->bulk_out) {
++	err = kvaser_usb_get_endpoints(intf, &dev->bulk_in, &dev->bulk_out);
++	if (err) {
+ 		dev_err(&intf->dev, "Cannot get usb endpoint(s)");
+ 		return err;
+ 	}
+diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
+index 668dd27616a0..cc6a0a586f0b 100644
+--- a/drivers/net/wireless/libertas/debugfs.c
++++ b/drivers/net/wireless/libertas/debugfs.c
+@@ -913,7 +913,10 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
+ 	char *p2;
+ 	struct debug_data *d = f->private_data;
+ 
+-	pdata = kmalloc(cnt, GFP_KERNEL);
++	if (cnt == 0)
++		return 0;
++
++	pdata = kmalloc(cnt + 1, GFP_KERNEL);
+ 	if (pdata == NULL)
+ 		return 0;
+ 
+@@ -922,6 +925,7 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
+ 		kfree(pdata);
+ 		return 0;
+ 	}
++	pdata[cnt] = '\0';
+ 
+ 	p0 = pdata;
+ 	for (i = 0; i < num_of_items; i++) {
+diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
+index f281971919f5..12652d204f7e 100644
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -3400,10 +3400,13 @@ void rt2800_link_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual,
+ 
+ 	vgc = rt2800_get_default_vgc(rt2x00dev);
+ 
+-	if (rt2x00_rt(rt2x00dev, RT5592) && qual->rssi > -65)
+-		vgc += 0x20;
+-	else if (qual->rssi > -80)
+-		vgc += 0x10;
++	if (rt2x00_rt(rt2x00dev, RT5592)) {
++		if (qual->rssi > -65)
++			vgc += 0x20;
++	} else {
++		if (qual->rssi > -80)
++			vgc += 0x10;
++	}
+ 
+ 	rt2800_set_vgc(rt2x00dev, qual, vgc);
+ }
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index ac854d75bd6c..9ef0711a5cc1 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -148,6 +148,8 @@ static bool rt2800usb_txstatus_timeout(struct rt2x00_dev *rt2x00dev)
+ 	return false;
+ }
+ 
++#define TXSTATUS_READ_INTERVAL 1000000
++
+ static bool rt2800usb_tx_sta_fifo_read_completed(struct rt2x00_dev *rt2x00dev,
+ 						 int urb_status, u32 tx_status)
+ {
+@@ -176,8 +178,9 @@ static bool rt2800usb_tx_sta_fifo_read_completed(struct rt2x00_dev *rt2x00dev,
+ 		queue_work(rt2x00dev->workqueue, &rt2x00dev->txdone_work);
+ 
+ 	if (rt2800usb_txstatus_pending(rt2x00dev)) {
+-		/* Read register after 250 us */
+-		hrtimer_start(&rt2x00dev->txstatus_timer, ktime_set(0, 250000),
++		/* Read register after 1 ms */
++		hrtimer_start(&rt2x00dev->txstatus_timer,
++			      ktime_set(0, TXSTATUS_READ_INTERVAL),
+ 			      HRTIMER_MODE_REL);
+ 		return false;
+ 	}
+@@ -202,8 +205,9 @@ static void rt2800usb_async_read_tx_status(struct rt2x00_dev *rt2x00dev)
+ 	if (test_and_set_bit(TX_STATUS_READING, &rt2x00dev->flags))
+ 		return;
+ 
+-	/* Read TX_STA_FIFO register after 500 us */
+-	hrtimer_start(&rt2x00dev->txstatus_timer, ktime_set(0, 500000),
++	/* Read TX_STA_FIFO register after 2 ms */
++	hrtimer_start(&rt2x00dev->txstatus_timer,
++		      ktime_set(0, 2*TXSTATUS_READ_INTERVAL),
+ 		      HRTIMER_MODE_REL);
+ }
+ 
+diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
+index 90dc14336980..a2889d1cfe37 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+@@ -181,6 +181,7 @@ static void rt2x00lib_autowakeup(struct work_struct *work)
+ static void rt2x00lib_bc_buffer_iter(void *data, u8 *mac,
+ 				     struct ieee80211_vif *vif)
+ {
++	struct ieee80211_tx_control control = {};
+ 	struct rt2x00_dev *rt2x00dev = data;
+ 	struct sk_buff *skb;
+ 
+@@ -195,7 +196,7 @@ static void rt2x00lib_bc_buffer_iter(void *data, u8 *mac,
+ 	 */
+ 	skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif);
+ 	while (skb) {
+-		rt2x00mac_tx(rt2x00dev->hw, NULL, skb);
++		rt2x00mac_tx(rt2x00dev->hw, &control, skb);
+ 		skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif);
+ 	}
+ }
+diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
+index a0935987fa3a..7f40ab8e1bd8 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
++++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
+@@ -146,7 +146,7 @@ void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length);
+  * @local: frame is not from mac80211
+  */
+ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
+-			       bool local);
++			       struct ieee80211_sta *sta, bool local);
+ 
+ /**
+  * rt2x00queue_update_beacon - Send new beacon from mac80211
+diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
+index f883802f3505..f8cff1f0b6b7 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
+@@ -90,7 +90,7 @@ static int rt2x00mac_tx_rts_cts(struct rt2x00_dev *rt2x00dev,
+ 				  frag_skb->data, data_length, tx_info,
+ 				  (struct ieee80211_rts *)(skb->data));
+ 
+-	retval = rt2x00queue_write_tx_frame(queue, skb, true);
++	retval = rt2x00queue_write_tx_frame(queue, skb, NULL, true);
+ 	if (retval) {
+ 		dev_kfree_skb_any(skb);
+ 		rt2x00_warn(rt2x00dev, "Failed to send RTS/CTS frame\n");
+@@ -151,7 +151,7 @@ void rt2x00mac_tx(struct ieee80211_hw *hw,
+ 			goto exit_fail;
+ 	}
+ 
+-	if (unlikely(rt2x00queue_write_tx_frame(queue, skb, false)))
++	if (unlikely(rt2x00queue_write_tx_frame(queue, skb, control->sta, false)))
+ 		goto exit_fail;
+ 
+ 	/*
+@@ -754,6 +754,9 @@ void rt2x00mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+ 	struct rt2x00_dev *rt2x00dev = hw->priv;
+ 	struct data_queue *queue;
+ 
++	if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
++		return;
++
+ 	tx_queue_for_each(rt2x00dev, queue)
+ 		rt2x00queue_flush_queue(queue, drop);
+ }
+diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
+index d955741e48ff..1f17f5b64625 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
+@@ -635,7 +635,7 @@ static void rt2x00queue_bar_check(struct queue_entry *entry)
+ }
+ 
+ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
+-			       bool local)
++			       struct ieee80211_sta *sta, bool local)
+ {
+ 	struct ieee80211_tx_info *tx_info;
+ 	struct queue_entry *entry;
+@@ -649,7 +649,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
+ 	 * after that we are free to use the skb->cb array
+ 	 * for our information.
+ 	 */
+-	rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc, NULL);
++	rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc, sta);
+ 
+ 	/*
+ 	 * All information is retrieved from the skb->cb array,
+diff --git a/drivers/pci/access.c b/drivers/pci/access.c
+index 1cc23661f79b..061da8c3ab4b 100644
+--- a/drivers/pci/access.c
++++ b/drivers/pci/access.c
+@@ -484,28 +484,29 @@ static inline bool pcie_cap_has_lnkctl(const struct pci_dev *dev)
+ {
+ 	int type = pci_pcie_type(dev);
+ 
+-	return pcie_cap_version(dev) > 1 ||
++	return type == PCI_EXP_TYPE_ENDPOINT ||
++	       type == PCI_EXP_TYPE_LEG_END ||
+ 	       type == PCI_EXP_TYPE_ROOT_PORT ||
+-	       type == PCI_EXP_TYPE_ENDPOINT ||
+-	       type == PCI_EXP_TYPE_LEG_END;
++	       type == PCI_EXP_TYPE_UPSTREAM ||
++	       type == PCI_EXP_TYPE_DOWNSTREAM ||
++	       type == PCI_EXP_TYPE_PCI_BRIDGE ||
++	       type == PCI_EXP_TYPE_PCIE_BRIDGE;
+ }
+ 
+ static inline bool pcie_cap_has_sltctl(const struct pci_dev *dev)
+ {
+ 	int type = pci_pcie_type(dev);
+ 
+-	return pcie_cap_version(dev) > 1 ||
+-	       type == PCI_EXP_TYPE_ROOT_PORT ||
+-	       (type == PCI_EXP_TYPE_DOWNSTREAM &&
+-		pcie_caps_reg(dev) & PCI_EXP_FLAGS_SLOT);
++	return (type == PCI_EXP_TYPE_ROOT_PORT ||
++		type == PCI_EXP_TYPE_DOWNSTREAM) &&
++	       pcie_caps_reg(dev) & PCI_EXP_FLAGS_SLOT;
+ }
+ 
+ static inline bool pcie_cap_has_rtctl(const struct pci_dev *dev)
+ {
+ 	int type = pci_pcie_type(dev);
+ 
+-	return pcie_cap_version(dev) > 1 ||
+-	       type == PCI_EXP_TYPE_ROOT_PORT ||
++	return type == PCI_EXP_TYPE_ROOT_PORT ||
+ 	       type == PCI_EXP_TYPE_RC_EC;
+ }
+ 
+diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
+index 1ef041bc60c8..ee6caddd978c 100644
+--- a/drivers/scsi/aacraid/commctrl.c
++++ b/drivers/scsi/aacraid/commctrl.c
+@@ -510,7 +510,8 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
+ 		goto cleanup;
+ 	}
+ 
+-	if (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr))) {
++	if ((fibsize < (sizeof(struct user_aac_srb) - sizeof(struct user_sgentry))) ||
++	    (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr)))) {
+ 		rcode = -EINVAL;
+ 		goto cleanup;
+ 	}
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index c8b9fa0e9275..1424a8988849 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1129,6 +1129,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ 			usb_clear_port_feature(hub->hdev, port1,
+ 					USB_PORT_FEAT_C_ENABLE);
+ 		}
++		if (portchange & USB_PORT_STAT_C_RESET) {
++			need_debounce_delay = true;
++			usb_clear_port_feature(hub->hdev, port1,
++					USB_PORT_FEAT_C_RESET);
++		}
+ 		if ((portchange & USB_PORT_STAT_C_BH_RESET) &&
+ 				hub_is_superspeed(hub->hdev)) {
+ 			need_debounce_delay = true;
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index 2c1749da1f7e..8b3d0abe7e14 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -1593,7 +1593,11 @@ static int mos7840_tiocmget(struct tty_struct *tty)
+ 		return -ENODEV;
+ 
+ 	status = mos7840_get_uart_reg(port, MODEM_STATUS_REGISTER, &msr);
++	if (status != 1)
++		return -EIO;
+ 	status = mos7840_get_uart_reg(port, MODEM_CONTROL_REGISTER, &mcr);
++	if (status != 1)
++		return -EIO;
+ 	result = ((mcr & MCR_DTR) ? TIOCM_DTR : 0)
+ 	    | ((mcr & MCR_RTS) ? TIOCM_RTS : 0)
+ 	    | ((mcr & MCR_LOOPBACK) ? TIOCM_LOOP : 0)
+diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
+index 7aabc6ad4e9b..fa38d076697d 100644
+--- a/fs/configfs/dir.c
++++ b/fs/configfs/dir.c
+@@ -56,10 +56,19 @@ static void configfs_d_iput(struct dentry * dentry,
+ 	struct configfs_dirent *sd = dentry->d_fsdata;
+ 
+ 	if (sd) {
+-		BUG_ON(sd->s_dentry != dentry);
+ 		/* Coordinate with configfs_readdir */
+ 		spin_lock(&configfs_dirent_lock);
+-		sd->s_dentry = NULL;
++		/* Coordinate with configfs_attach_attr where will increase
++		 * sd->s_count and update sd->s_dentry to new allocated one.
++		 * Only set sd->dentry to null when this dentry is the only
++		 * sd owner.
++		 * If not do so, configfs_d_iput may run just after
++		 * configfs_attach_attr and set sd->s_dentry to null
++		 * even it's still in use.
++		 */
++		if (atomic_read(&sd->s_count) <= 2)
++			sd->s_dentry = NULL;
++
+ 		spin_unlock(&configfs_dirent_lock);
+ 		configfs_put(sd);
+ 	}
+@@ -426,8 +435,11 @@ static int configfs_attach_attr(struct configfs_dirent * sd, struct dentry * den
+ 	struct configfs_attribute * attr = sd->s_element;
+ 	int error;
+ 
++	spin_lock(&configfs_dirent_lock);
+ 	dentry->d_fsdata = configfs_get(sd);
+ 	sd->s_dentry = dentry;
++	spin_unlock(&configfs_dirent_lock);
++
+ 	error = configfs_create(dentry, (attr->ca_mode & S_IALLUGO) | S_IFREG,
+ 				configfs_init_file);
+ 	if (error) {
+diff --git a/fs/exec.c b/fs/exec.c
+index 1f446705636b..bb60cda5ee30 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1669,6 +1669,12 @@ int __get_dumpable(unsigned long mm_flags)
+ 	return (ret > SUID_DUMP_USER) ? SUID_DUMP_ROOT : ret;
+ }
+ 
++/*
++ * This returns the actual value of the suid_dumpable flag. For things
++ * that are using this for checking for privilege transitions, it must
++ * test against SUID_DUMP_USER rather than treating it as a boolean
++ * value.
++ */
+ int get_dumpable(struct mm_struct *mm)
+ {
+ 	return __get_dumpable(mm->flags);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index d7ba5616989c..e78b8c2656ee 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1160,29 +1160,24 @@ _nfs4_opendata_reclaim_to_nfs4_state(struct nfs4_opendata *data)
+ 	int ret;
+ 
+ 	if (!data->rpc_done) {
+-		ret = data->rpc_status;
+-		goto err;
++		if (data->rpc_status) {
++			ret = data->rpc_status;
++			goto err;
++		}
++		/* cached opens have already been processed */
++		goto update;
+ 	}
+ 
+-	ret = -ESTALE;
+-	if (!(data->f_attr.valid & NFS_ATTR_FATTR_TYPE) ||
+-	    !(data->f_attr.valid & NFS_ATTR_FATTR_FILEID) ||
+-	    !(data->f_attr.valid & NFS_ATTR_FATTR_CHANGE))
+-		goto err;
+-
+-	ret = -ENOMEM;
+-	state = nfs4_get_open_state(inode, data->owner);
+-	if (state == NULL)
+-		goto err;
+-
+ 	ret = nfs_refresh_inode(inode, &data->f_attr);
+ 	if (ret)
+ 		goto err;
+ 
+ 	if (data->o_res.delegation_type != 0)
+ 		nfs4_opendata_check_deleg(data, state);
++update:
+ 	update_open_stateid(state, &data->o_res.stateid, NULL,
+ 			    data->o_arg.fmode);
++	atomic_inc(&state->count);
+ 
+ 	return state;
+ err:
+@@ -4572,6 +4567,7 @@ static int _nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock
+ 			status = 0;
+ 	}
+ 	request->fl_ops->fl_release_private(request);
++	request->fl_ops = NULL;
+ out:
+ 	return status;
+ }
+diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
+index 5f38ea36e266..af51cf9bf2e3 100644
+--- a/fs/nfsd/export.c
++++ b/fs/nfsd/export.c
+@@ -536,16 +536,12 @@ static int svc_export_parse(struct cache_detail *cd, char *mesg, int mlen)
+ 		if (err)
+ 			goto out3;
+ 		exp.ex_anon_uid= make_kuid(&init_user_ns, an_int);
+-		if (!uid_valid(exp.ex_anon_uid))
+-			goto out3;
+ 
+ 		/* anon gid */
+ 		err = get_int(&mesg, &an_int);
+ 		if (err)
+ 			goto out3;
+ 		exp.ex_anon_gid= make_kgid(&init_user_ns, an_int);
+-		if (!gid_valid(exp.ex_anon_gid))
+-			goto out3;
+ 
+ 		/* fsid */
+ 		err = get_int(&mesg, &an_int);
+@@ -583,6 +579,17 @@ static int svc_export_parse(struct cache_detail *cd, char *mesg, int mlen)
+ 				   exp.ex_uuid);
+ 		if (err)
+ 			goto out4;
++		/*
++		 * For some reason exportfs has been passing down an
++		 * invalid (-1) uid & gid on the "dummy" export which it
++		 * uses to test export support.  To make sure exportfs
++		 * sees errors from check_export we therefore need to
++		 * delay these checks till after check_export:
++		 */
++		if (!uid_valid(exp.ex_anon_uid))
++			goto out4;
++		if (!gid_valid(exp.ex_anon_gid))
++			goto out4;
+ 	}
+ 
+ 	expp = svc_export_lookup(&exp);
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index baf149a85263..62fd6616801d 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -297,41 +297,12 @@ commit_metadata(struct svc_fh *fhp)
+ }
+ 
+ /*
+- * Set various file attributes.
+- * N.B. After this call fhp needs an fh_put
++ * Go over the attributes and take care of the small differences between
++ * NFS semantics and what Linux expects.
+  */
+-__be32
+-nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+-	     int check_guard, time_t guardtime)
++static void
++nfsd_sanitize_attrs(struct inode *inode, struct iattr *iap)
+ {
+-	struct dentry	*dentry;
+-	struct inode	*inode;
+-	int		accmode = NFSD_MAY_SATTR;
+-	umode_t		ftype = 0;
+-	__be32		err;
+-	int		host_err;
+-	int		size_change = 0;
+-
+-	if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
+-		accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
+-	if (iap->ia_valid & ATTR_SIZE)
+-		ftype = S_IFREG;
+-
+-	/* Get inode */
+-	err = fh_verify(rqstp, fhp, ftype, accmode);
+-	if (err)
+-		goto out;
+-
+-	dentry = fhp->fh_dentry;
+-	inode = dentry->d_inode;
+-
+-	/* Ignore any mode updates on symlinks */
+-	if (S_ISLNK(inode->i_mode))
+-		iap->ia_valid &= ~ATTR_MODE;
+-
+-	if (!iap->ia_valid)
+-		goto out;
+-
+ 	/*
+ 	 * NFSv2 does not differentiate between "set-[ac]time-to-now"
+ 	 * which only requires access, and "set-[ac]time-to-X" which
+@@ -341,8 +312,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+ 	 * convert to "set to now" instead of "set to explicit time"
+ 	 *
+ 	 * We only call inode_change_ok as the last test as technically
+-	 * it is not an interface that we should be using.  It is only
+-	 * valid if the filesystem does not define it's own i_op->setattr.
++	 * it is not an interface that we should be using.
+ 	 */
+ #define BOTH_TIME_SET (ATTR_ATIME_SET | ATTR_MTIME_SET)
+ #define	MAX_TOUCH_TIME_ERROR (30*60)
+@@ -368,30 +338,6 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+ 			iap->ia_valid &= ~BOTH_TIME_SET;
+ 		}
+ 	}
+-	    
+-	/*
+-	 * The size case is special.
+-	 * It changes the file as well as the attributes.
+-	 */
+-	if (iap->ia_valid & ATTR_SIZE) {
+-		if (iap->ia_size < inode->i_size) {
+-			err = nfsd_permission(rqstp, fhp->fh_export, dentry,
+-					NFSD_MAY_TRUNC|NFSD_MAY_OWNER_OVERRIDE);
+-			if (err)
+-				goto out;
+-		}
+-
+-		host_err = get_write_access(inode);
+-		if (host_err)
+-			goto out_nfserr;
+-
+-		size_change = 1;
+-		host_err = locks_verify_truncate(inode, NULL, iap->ia_size);
+-		if (host_err) {
+-			put_write_access(inode);
+-			goto out_nfserr;
+-		}
+-	}
+ 
+ 	/* sanitize the mode change */
+ 	if (iap->ia_valid & ATTR_MODE) {
+@@ -414,32 +360,111 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+ 			iap->ia_valid |= (ATTR_KILL_SUID | ATTR_KILL_SGID);
+ 		}
+ 	}
++}
+ 
+-	/* Change the attributes. */
++static __be32
++nfsd_get_write_access(struct svc_rqst *rqstp, struct svc_fh *fhp,
++		struct iattr *iap)
++{
++	struct inode *inode = fhp->fh_dentry->d_inode;
++	int host_err;
+ 
+-	iap->ia_valid |= ATTR_CTIME;
++	if (iap->ia_size < inode->i_size) {
++		__be32 err;
+ 
+-	err = nfserr_notsync;
+-	if (!check_guard || guardtime == inode->i_ctime.tv_sec) {
+-		host_err = nfsd_break_lease(inode);
+-		if (host_err)
+-			goto out_nfserr;
+-		fh_lock(fhp);
++		err = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
++				NFSD_MAY_TRUNC | NFSD_MAY_OWNER_OVERRIDE);
++		if (err)
++			return err;
++	}
+ 
+-		host_err = notify_change(dentry, iap);
+-		err = nfserrno(host_err);
+-		fh_unlock(fhp);
++	host_err = get_write_access(inode);
++	if (host_err)
++		goto out_nfserrno;
++
++	host_err = locks_verify_truncate(inode, NULL, iap->ia_size);
++	if (host_err)
++		goto out_put_write_access;
++	return 0;
++
++out_put_write_access:
++	put_write_access(inode);
++out_nfserrno:
++	return nfserrno(host_err);
++}
++
++/*
++ * Set various file attributes.  After this call fhp needs an fh_put.
++ */
++__be32
++nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
++	     int check_guard, time_t guardtime)
++{
++	struct dentry	*dentry;
++	struct inode	*inode;
++	int		accmode = NFSD_MAY_SATTR;
++	umode_t		ftype = 0;
++	__be32		err;
++	int		host_err;
++	int		size_change = 0;
++
++	if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
++		accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
++	if (iap->ia_valid & ATTR_SIZE)
++		ftype = S_IFREG;
++
++	/* Get inode */
++	err = fh_verify(rqstp, fhp, ftype, accmode);
++	if (err)
++		goto out;
++
++	dentry = fhp->fh_dentry;
++	inode = dentry->d_inode;
++
++	/* Ignore any mode updates on symlinks */
++	if (S_ISLNK(inode->i_mode))
++		iap->ia_valid &= ~ATTR_MODE;
++
++	if (!iap->ia_valid)
++		goto out;
++
++	nfsd_sanitize_attrs(inode, iap);
++
++	/*
++	 * The size case is special, it changes the file in addition to the
++	 * attributes.
++	 */
++	if (iap->ia_valid & ATTR_SIZE) {
++		err = nfsd_get_write_access(rqstp, fhp, iap);
++		if (err)
++			goto out;
++		size_change = 1;
+ 	}
++
++	iap->ia_valid |= ATTR_CTIME;
++
++	if (check_guard && guardtime != inode->i_ctime.tv_sec) {
++		err = nfserr_notsync;
++		goto out_put_write_access;
++	}
++
++	host_err = nfsd_break_lease(inode);
++	if (host_err)
++		goto out_put_write_access_nfserror;
++
++	fh_lock(fhp);
++	host_err = notify_change(dentry, iap);
++	fh_unlock(fhp);
++
++out_put_write_access_nfserror:
++	err = nfserrno(host_err);
++out_put_write_access:
+ 	if (size_change)
+ 		put_write_access(inode);
+ 	if (!err)
+ 		commit_metadata(fhp);
+ out:
+ 	return err;
+-
+-out_nfserr:
+-	err = nfserrno(host_err);
+-	goto out;
+ }
+ 
+ #if defined(CONFIG_NFSD_V2_ACL) || \
+diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
+index 70cf138690e9..df97ca4aae52 100644
+--- a/include/linux/binfmts.h
++++ b/include/linux/binfmts.h
+@@ -99,9 +99,6 @@ extern void setup_new_exec(struct linux_binprm * bprm);
+ extern void would_dump(struct linux_binprm *, struct file *);
+ 
+ extern int suid_dumpable;
+-#define SUID_DUMP_DISABLE	0	/* No setuid dumping */
+-#define SUID_DUMP_USER		1	/* Dump as user of process */
+-#define SUID_DUMP_ROOT		2	/* Dump as root */
+ 
+ /* Stack area protections */
+ #define EXSTACK_DEFAULT   0	/* Whatever the arch defaults to */
+diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
+index b508016fb76d..b3bd7e737e8b 100644
+--- a/include/linux/mod_devicetable.h
++++ b/include/linux/mod_devicetable.h
+@@ -456,7 +456,8 @@ enum dmi_field {
+ };
+ 
+ struct dmi_strmatch {
+-	unsigned char slot;
++	unsigned char slot:7;
++	unsigned char exact_match:1;
+ 	char substr[79];
+ };
+ 
+@@ -474,7 +475,8 @@ struct dmi_system_id {
+  */
+ #define dmi_device_id dmi_system_id
+ 
+-#define DMI_MATCH(a, b)	{ a, b }
++#define DMI_MATCH(a, b)	{ .slot = a, .substr = b }
++#define DMI_EXACT_MATCH(a, b)	{ .slot = a, .substr = b, .exact_match = 1 }
+ 
+ #define PLATFORM_NAME_SIZE	20
+ #define PLATFORM_MODULE_PREFIX	"platform:"
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 178a8d909f14..597c8ab005a0 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -332,6 +332,10 @@ static inline void arch_pick_mmap_layout(struct mm_struct *mm) {}
+ extern void set_dumpable(struct mm_struct *mm, int value);
+ extern int get_dumpable(struct mm_struct *mm);
+ 
++#define SUID_DUMP_DISABLE	0	/* No setuid dumping */
++#define SUID_DUMP_USER		1	/* Dump as user of process */
++#define SUID_DUMP_ROOT		2	/* Dump as root */
++
+ /* mm flags */
+ /* dumpable bits */
+ #define MMF_DUMPABLE      0  /* core dump is permitted */
+@@ -2469,34 +2473,98 @@ static inline int tsk_is_polling(struct task_struct *p)
+ {
+ 	return task_thread_info(p)->status & TS_POLLING;
+ }
+-static inline void current_set_polling(void)
++static inline void __current_set_polling(void)
+ {
+ 	current_thread_info()->status |= TS_POLLING;
+ }
+ 
+-static inline void current_clr_polling(void)
++static inline bool __must_check current_set_polling_and_test(void)
++{
++	__current_set_polling();
++
++	/*
++	 * Polling state must be visible before we test NEED_RESCHED,
++	 * paired by resched_task()
++	 */
++	smp_mb();
++
++	return unlikely(tif_need_resched());
++}
++
++static inline void __current_clr_polling(void)
+ {
+ 	current_thread_info()->status &= ~TS_POLLING;
+-	smp_mb__after_clear_bit();
++}
++
++static inline bool __must_check current_clr_polling_and_test(void)
++{
++	__current_clr_polling();
++
++	/*
++	 * Polling state must be visible before we test NEED_RESCHED,
++	 * paired by resched_task()
++	 */
++	smp_mb();
++
++	return unlikely(tif_need_resched());
+ }
+ #elif defined(TIF_POLLING_NRFLAG)
+ static inline int tsk_is_polling(struct task_struct *p)
+ {
+ 	return test_tsk_thread_flag(p, TIF_POLLING_NRFLAG);
+ }
+-static inline void current_set_polling(void)
++
++static inline void __current_set_polling(void)
+ {
+ 	set_thread_flag(TIF_POLLING_NRFLAG);
+ }
+ 
+-static inline void current_clr_polling(void)
++static inline bool __must_check current_set_polling_and_test(void)
++{
++	__current_set_polling();
++
++	/*
++	 * Polling state must be visible before we test NEED_RESCHED,
++	 * paired by resched_task()
++	 *
++	 * XXX: assumes set/clear bit are identical barrier wise.
++	 */
++	smp_mb__after_clear_bit();
++
++	return unlikely(tif_need_resched());
++}
++
++static inline void __current_clr_polling(void)
+ {
+ 	clear_thread_flag(TIF_POLLING_NRFLAG);
+ }
++
++static inline bool __must_check current_clr_polling_and_test(void)
++{
++	__current_clr_polling();
++
++	/*
++	 * Polling state must be visible before we test NEED_RESCHED,
++	 * paired by resched_task()
++	 */
++	smp_mb__after_clear_bit();
++
++	return unlikely(tif_need_resched());
++}
++
+ #else
+ static inline int tsk_is_polling(struct task_struct *p) { return 0; }
+-static inline void current_set_polling(void) { }
+-static inline void current_clr_polling(void) { }
++static inline void __current_set_polling(void) { }
++static inline void __current_clr_polling(void) { }
++
++static inline bool __must_check current_set_polling_and_test(void)
++{
++	return unlikely(tif_need_resched());
++}
++static inline bool __must_check current_clr_polling_and_test(void)
++{
++	return unlikely(tif_need_resched());
++}
+ #endif
+ 
+ /*
+diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
+index e7e04736802f..4ae6f32c8033 100644
+--- a/include/linux/thread_info.h
++++ b/include/linux/thread_info.h
+@@ -107,6 +107,8 @@ static inline int test_ti_thread_flag(struct thread_info *ti, int flag)
+ #define set_need_resched()	set_thread_flag(TIF_NEED_RESCHED)
+ #define clear_need_resched()	clear_thread_flag(TIF_NEED_RESCHED)
+ 
++#define tif_need_resched() test_thread_flag(TIF_NEED_RESCHED)
++
+ #if defined TIF_RESTORE_SIGMASK && !defined HAVE_SET_RESTORE_SIGMASK
+ /*
+  * An arch can define its own version of set_restore_sigmask() to get the
+diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h
+index 9031a26249b5..ae6c3b8ed2f5 100644
+--- a/include/sound/compress_driver.h
++++ b/include/sound/compress_driver.h
+@@ -171,4 +171,13 @@ static inline void snd_compr_fragment_elapsed(struct snd_compr_stream *stream)
+ 	wake_up(&stream->runtime->sleep);
+ }
+ 
++static inline void snd_compr_drain_notify(struct snd_compr_stream *stream)
++{
++	if (snd_BUG_ON(!stream))
++		return;
++
++	stream->runtime->state = SNDRV_PCM_STATE_SETUP;
++	wake_up(&stream->runtime->sleep);
++}
++
+ #endif
+diff --git a/ipc/shm.c b/ipc/shm.c
+index 7b87bea5245b..6dc55af8a29b 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -208,15 +208,18 @@ static void shm_open(struct vm_area_struct *vma)
+  */
+ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
+ {
++	struct file *shm_file;
++
++	shm_file = shp->shm_file;
++	shp->shm_file = NULL;
+ 	ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ 	shm_rmid(ns, shp);
+ 	shm_unlock(shp);
+-	if (!is_file_hugepages(shp->shm_file))
+-		shmem_lock(shp->shm_file, 0, shp->mlock_user);
++	if (!is_file_hugepages(shm_file))
++		shmem_lock(shm_file, 0, shp->mlock_user);
+ 	else if (shp->mlock_user)
+-		user_shm_unlock(file_inode(shp->shm_file)->i_size,
+-						shp->mlock_user);
+-	fput (shp->shm_file);
++		user_shm_unlock(file_inode(shm_file)->i_size, shp->mlock_user);
++	fput(shm_file);
+ 	ipc_rcu_putref(shp, shm_rcu_free);
+ }
+ 
+@@ -974,15 +977,25 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
+ 		ipc_lock_object(&shp->shm_perm);
+ 		if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {
+ 			kuid_t euid = current_euid();
+-			err = -EPERM;
+ 			if (!uid_eq(euid, shp->shm_perm.uid) &&
+-			    !uid_eq(euid, shp->shm_perm.cuid))
++			    !uid_eq(euid, shp->shm_perm.cuid)) {
++				err = -EPERM;
+ 				goto out_unlock0;
+-			if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK))
++			}
++			if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK)) {
++				err = -EPERM;
+ 				goto out_unlock0;
++			}
+ 		}
+ 
+ 		shm_file = shp->shm_file;
++
++		/* check if shm_destroy() is tearing down shp */
++		if (shm_file == NULL) {
++			err = -EIDRM;
++			goto out_unlock0;
++		}
++
+ 		if (is_file_hugepages(shm_file))
+ 			goto out_unlock0;
+ 
+@@ -1101,6 +1114,14 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
+ 		goto out_unlock;
+ 
+ 	ipc_lock_object(&shp->shm_perm);
++
++	/* check if shm_destroy() is tearing down shp */
++	if (shp->shm_file == NULL) {
++		ipc_unlock_object(&shp->shm_perm);
++		err = -EIDRM;
++		goto out_unlock;
++	}
++
+ 	path = shp->shm_file->f_path;
+ 	path_get(&path);
+ 	shp->shm_nattch++;
+diff --git a/kernel/cpu/idle.c b/kernel/cpu/idle.c
+index e695c0a0bcb5..c261409500e4 100644
+--- a/kernel/cpu/idle.c
++++ b/kernel/cpu/idle.c
+@@ -44,7 +44,7 @@ static inline int cpu_idle_poll(void)
+ 	rcu_idle_enter();
+ 	trace_cpu_idle_rcuidle(0, smp_processor_id());
+ 	local_irq_enable();
+-	while (!need_resched())
++	while (!tif_need_resched())
+ 		cpu_relax();
+ 	trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id());
+ 	rcu_idle_exit();
+@@ -92,8 +92,7 @@ static void cpu_idle_loop(void)
+ 			if (cpu_idle_force_poll || tick_check_broadcast_expired()) {
+ 				cpu_idle_poll();
+ 			} else {
+-				current_clr_polling();
+-				if (!need_resched()) {
++				if (!current_clr_polling_and_test()) {
+ 					stop_critical_timings();
+ 					rcu_idle_enter();
+ 					arch_cpu_idle();
+@@ -103,7 +102,7 @@ static void cpu_idle_loop(void)
+ 				} else {
+ 					local_irq_enable();
+ 				}
+-				current_set_polling();
++				__current_set_polling();
+ 			}
+ 			arch_cpu_idle_exit();
+ 		}
+@@ -129,7 +128,7 @@ void cpu_startup_entry(enum cpuhp_state state)
+ 	 */
+ 	boot_init_stack_canary();
+ #endif
+-	current_set_polling();
++	__current_set_polling();
+ 	arch_cpu_idle_prepare();
+ 	cpu_idle_loop();
+ }
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index 335a7ae697f5..afadcf7b4a22 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -257,7 +257,8 @@ ok:
+ 	if (task->mm)
+ 		dumpable = get_dumpable(task->mm);
+ 	rcu_read_lock();
+-	if (!dumpable && !ptrace_has_cap(__task_cred(task)->user_ns, mode)) {
++	if (dumpable != SUID_DUMP_USER &&
++	    !ptrace_has_cap(__task_cred(task)->user_ns, mode)) {
+ 		rcu_read_unlock();
+ 		return -EPERM;
+ 	}
+diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
+index 84b1e045faba..8354dc81ae64 100644
+--- a/kernel/trace/trace_event_perf.c
++++ b/kernel/trace/trace_event_perf.c
+@@ -26,7 +26,7 @@ static int perf_trace_event_perm(struct ftrace_event_call *tp_event,
+ {
+ 	/* The ftrace function trace is allowed only for root. */
+ 	if (ftrace_event_is_function(tp_event) &&
+-	    perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
++	    perf_paranoid_tracepoint_raw() && !capable(CAP_SYS_ADMIN))
+ 		return -EPERM;
+ 
+ 	/* No tracing, just counting, so no obvious leak */
+diff --git a/mm/slub.c b/mm/slub.c
+index 57707f01bcfb..c34bd44e8be9 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1201,8 +1201,8 @@ static unsigned long kmem_cache_flags(unsigned long object_size,
+ 	/*
+ 	 * Enable debugging if selected on the kernel commandline.
+ 	 */
+-	if (slub_debug && (!slub_debug_slabs ||
+-		!strncmp(slub_debug_slabs, name, strlen(slub_debug_slabs))))
++	if (slub_debug && (!slub_debug_slabs || (name &&
++		!strncmp(slub_debug_slabs, name, strlen(slub_debug_slabs)))))
+ 		flags |= slub_debug;
+ 
+ 	return flags;
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 426f8fcc4c6c..5b1bf7b530f1 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1407,9 +1407,9 @@ call_refreshresult(struct rpc_task *task)
+ 		return;
+ 	case -ETIMEDOUT:
+ 		rpc_delay(task, 3*HZ);
+-	case -EKEYEXPIRED:
+ 	case -EAGAIN:
+ 		status = -EACCES;
++	case -EKEYEXPIRED:
+ 		if (!task->tk_cred_retry)
+ 			break;
+ 		task->tk_cred_retry--;
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index ffd50348a509..8a0e04d0928a 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -391,8 +391,10 @@ static int xs_send_kvec(struct socket *sock, struct sockaddr *addr, int addrlen,
+ 	return kernel_sendmsg(sock, &msg, NULL, 0, 0);
+ }
+ 
+-static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned int base, int more)
++static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned int base, int more, bool zerocopy)
+ {
++	ssize_t (*do_sendpage)(struct socket *sock, struct page *page,
++			int offset, size_t size, int flags);
+ 	struct page **ppage;
+ 	unsigned int remainder;
+ 	int err, sent = 0;
+@@ -401,6 +403,9 @@ static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned i
+ 	base += xdr->page_base;
+ 	ppage = xdr->pages + (base >> PAGE_SHIFT);
+ 	base &= ~PAGE_MASK;
++	do_sendpage = sock->ops->sendpage;
++	if (!zerocopy)
++		do_sendpage = sock_no_sendpage;
+ 	for(;;) {
+ 		unsigned int len = min_t(unsigned int, PAGE_SIZE - base, remainder);
+ 		int flags = XS_SENDMSG_FLAGS;
+@@ -408,7 +413,7 @@ static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned i
+ 		remainder -= len;
+ 		if (remainder != 0 || more)
+ 			flags |= MSG_MORE;
+-		err = sock->ops->sendpage(sock, *ppage, base, len, flags);
++		err = do_sendpage(sock, *ppage, base, len, flags);
+ 		if (remainder == 0 || err != len)
+ 			break;
+ 		sent += err;
+@@ -429,9 +434,10 @@ static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned i
+  * @addrlen: UDP only -- length of destination address
+  * @xdr: buffer containing this request
+  * @base: starting position in the buffer
++ * @zerocopy: true if it is safe to use sendpage()
+  *
+  */
+-static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen, struct xdr_buf *xdr, unsigned int base)
++static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen, struct xdr_buf *xdr, unsigned int base, bool zerocopy)
+ {
+ 	unsigned int remainder = xdr->len - base;
+ 	int err, sent = 0;
+@@ -459,7 +465,7 @@ static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen,
+ 	if (base < xdr->page_len) {
+ 		unsigned int len = xdr->page_len - base;
+ 		remainder -= len;
+-		err = xs_send_pagedata(sock, xdr, base, remainder != 0);
++		err = xs_send_pagedata(sock, xdr, base, remainder != 0, zerocopy);
+ 		if (remainder == 0 || err != len)
+ 			goto out;
+ 		sent += err;
+@@ -562,7 +568,7 @@ static int xs_local_send_request(struct rpc_task *task)
+ 			req->rq_svec->iov_base, req->rq_svec->iov_len);
+ 
+ 	status = xs_sendpages(transport->sock, NULL, 0,
+-						xdr, req->rq_bytes_sent);
++						xdr, req->rq_bytes_sent, true);
+ 	dprintk("RPC:       %s(%u) = %d\n",
+ 			__func__, xdr->len - req->rq_bytes_sent, status);
+ 	if (likely(status >= 0)) {
+@@ -618,7 +624,7 @@ static int xs_udp_send_request(struct rpc_task *task)
+ 	status = xs_sendpages(transport->sock,
+ 			      xs_addr(xprt),
+ 			      xprt->addrlen, xdr,
+-			      req->rq_bytes_sent);
++			      req->rq_bytes_sent, true);
+ 
+ 	dprintk("RPC:       xs_udp_send_request(%u) = %d\n",
+ 			xdr->len - req->rq_bytes_sent, status);
+@@ -689,6 +695,7 @@ static int xs_tcp_send_request(struct rpc_task *task)
+ 	struct rpc_xprt *xprt = req->rq_xprt;
+ 	struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+ 	struct xdr_buf *xdr = &req->rq_snd_buf;
++	bool zerocopy = true;
+ 	int status;
+ 
+ 	xs_encode_stream_record_marker(&req->rq_snd_buf);
+@@ -696,13 +703,20 @@ static int xs_tcp_send_request(struct rpc_task *task)
+ 	xs_pktdump("packet data:",
+ 				req->rq_svec->iov_base,
+ 				req->rq_svec->iov_len);
++	/* Don't use zero copy if this is a resend. If the RPC call
++	 * completes while the socket holds a reference to the pages,
++	 * then we may end up resending corrupted data.
++	 */
++	if (task->tk_flags & RPC_TASK_SENT)
++		zerocopy = false;
+ 
+ 	/* Continue transmitting the packet/record. We must be careful
+ 	 * to cope with writespace callbacks arriving _after_ we have
+ 	 * called sendmsg(). */
+ 	while (1) {
+ 		status = xs_sendpages(transport->sock,
+-					NULL, 0, xdr, req->rq_bytes_sent);
++					NULL, 0, xdr, req->rq_bytes_sent,
++					zerocopy);
+ 
+ 		dprintk("RPC:       xs_tcp_send_request(%u) = %d\n",
+ 				xdr->len - req->rq_bytes_sent, status);
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index 399433ad614e..a9c3d3cd1990 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -73,7 +73,6 @@ static struct ima_rule_entry default_rules[] = {
+ 	{.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
+-	{.action = DONT_MEASURE,.fsmagic = RAMFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = DEVPTS_SUPER_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = BINFMTFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 5863ba6dd12b..19799931c51d 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -668,14 +668,48 @@ static int snd_compr_stop(struct snd_compr_stream *stream)
+ 		return -EPERM;
+ 	retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_STOP);
+ 	if (!retval) {
+-		stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+-		wake_up(&stream->runtime->sleep);
++		snd_compr_drain_notify(stream);
+ 		stream->runtime->total_bytes_available = 0;
+ 		stream->runtime->total_bytes_transferred = 0;
+ 	}
+ 	return retval;
+ }
+ 
++static int snd_compress_wait_for_drain(struct snd_compr_stream *stream)
++{
++	int ret;
++
++	/*
++	 * We are called with lock held. So drop the lock while we wait for
++	 * drain complete notfication from the driver
++	 *
++	 * It is expected that driver will notify the drain completion and then
++	 * stream will be moved to SETUP state, even if draining resulted in an
++	 * error. We can trigger next track after this.
++	 */
++	stream->runtime->state = SNDRV_PCM_STATE_DRAINING;
++	mutex_unlock(&stream->device->lock);
++
++	/* we wait for drain to complete here, drain can return when
++	 * interruption occurred, wait returned error or success.
++	 * For the first two cases we don't do anything different here and
++	 * return after waking up
++	 */
++
++	ret = wait_event_interruptible(stream->runtime->sleep,
++			(stream->runtime->state != SNDRV_PCM_STATE_DRAINING));
++	if (ret == -ERESTARTSYS)
++		pr_debug("wait aborted by a signal");
++	else if (ret)
++		pr_debug("wait for drain failed with %d\n", ret);
++
++
++	wake_up(&stream->runtime->sleep);
++	mutex_lock(&stream->device->lock);
++
++	return ret;
++}
++
+ static int snd_compr_drain(struct snd_compr_stream *stream)
+ {
+ 	int retval;
+@@ -683,12 +717,15 @@ static int snd_compr_drain(struct snd_compr_stream *stream)
+ 	if (stream->runtime->state == SNDRV_PCM_STATE_PREPARED ||
+ 			stream->runtime->state == SNDRV_PCM_STATE_SETUP)
+ 		return -EPERM;
++
+ 	retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_DRAIN);
+-	if (!retval) {
+-		stream->runtime->state = SNDRV_PCM_STATE_DRAINING;
++	if (retval) {
++		pr_debug("SND_COMPR_TRIGGER_DRAIN failed %d\n", retval);
+ 		wake_up(&stream->runtime->sleep);
++		return retval;
+ 	}
+-	return retval;
++
++	return snd_compress_wait_for_drain(stream);
+ }
+ 
+ static int snd_compr_next_track(struct snd_compr_stream *stream)
+@@ -724,9 +761,14 @@ static int snd_compr_partial_drain(struct snd_compr_stream *stream)
+ 		return -EPERM;
+ 
+ 	retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_PARTIAL_DRAIN);
++	if (retval) {
++		pr_debug("Partial drain returned failure\n");
++		wake_up(&stream->runtime->sleep);
++		return retval;
++	}
+ 
+ 	stream->next_track = false;
+-	return retval;
++	return snd_compress_wait_for_drain(stream);
+ }
+ 
+ static long snd_compr_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+diff --git a/sound/isa/msnd/msnd_pinnacle.c b/sound/isa/msnd/msnd_pinnacle.c
+index ddabb406b14c..3a7946ebbe23 100644
+--- a/sound/isa/msnd/msnd_pinnacle.c
++++ b/sound/isa/msnd/msnd_pinnacle.c
+@@ -73,9 +73,11 @@
+ #ifdef MSND_CLASSIC
+ #  include "msnd_classic.h"
+ #  define LOGNAME			"msnd_classic"
++#  define DEV_NAME			"msnd-classic"
+ #else
+ #  include "msnd_pinnacle.h"
+ #  define LOGNAME			"snd_msnd_pinnacle"
++#  define DEV_NAME			"msnd-pinnacle"
+ #endif
+ 
+ static void set_default_audio_parameters(struct snd_msnd *chip)
+@@ -1068,8 +1070,6 @@ static int snd_msnd_isa_remove(struct device *pdev, unsigned int dev)
+ 	return 0;
+ }
+ 
+-#define DEV_NAME "msnd-pinnacle"
+-
+ static struct isa_driver snd_msnd_driver = {
+ 	.match		= snd_msnd_isa_match,
+ 	.probe		= snd_msnd_isa_probe,
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 31461ba32d3c..aeefec74a061 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2517,9 +2517,6 @@ int snd_hda_codec_reset(struct hda_codec *codec)
+ 	cancel_delayed_work_sync(&codec->jackpoll_work);
+ #ifdef CONFIG_PM
+ 	cancel_delayed_work_sync(&codec->power_work);
+-	codec->power_on = 0;
+-	codec->power_transition = 0;
+-	codec->power_jiffies = jiffies;
+ 	flush_workqueue(bus->workq);
+ #endif
+ 	snd_hda_ctls_clear(codec);
+@@ -3927,6 +3924,10 @@ static void hda_call_codec_resume(struct hda_codec *codec)
+ 	 * in the resume / power-save sequence
+ 	 */
+ 	hda_keep_power_on(codec);
++	if (codec->pm_down_notified) {
++		codec->pm_down_notified = 0;
++		hda_call_pm_notify(codec->bus, true);
++	}
+ 	hda_set_power_state(codec, AC_PWRST_D0);
+ 	restore_shutup_pins(codec);
+ 	hda_exec_init_verbs(codec);
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index d0cc796f778a..26ed56f00b7c 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -786,10 +786,10 @@ static void set_pin_eapd(struct hda_codec *codec, hda_nid_t pin, bool enable)
+ 	if (spec->own_eapd_ctl ||
+ 	    !(snd_hda_query_pin_caps(codec, pin) & AC_PINCAP_EAPD))
+ 		return;
+-	if (codec->inv_eapd)
+-		enable = !enable;
+ 	if (spec->keep_eapd_on && !enable)
+ 		return;
++	if (codec->inv_eapd)
++		enable = !enable;
+ 	snd_hda_codec_update_cache(codec, pin, 0,
+ 				   AC_VERB_SET_EAPD_BTLENABLE,
+ 				   enable ? 0x02 : 0x00);
+diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
+index d97f0d61a15b..e17b55a95bc5 100644
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -1197,8 +1197,12 @@ static int alloc_ad_spec(struct hda_codec *codec)
+ static void ad_fixup_inv_jack_detect(struct hda_codec *codec,
+ 				     const struct hda_fixup *fix, int action)
+ {
+-	if (action == HDA_FIXUP_ACT_PRE_PROBE)
++	struct ad198x_spec *spec = codec->spec;
++
++	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ 		codec->inv_jack_detect = 1;
++		spec->gen.keep_eapd_on = 1;
++	}
+ }
+ 
+ enum {
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index c96e1945059d..1868d3a6e310 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -3491,6 +3491,8 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = {
+ 	  .patch = patch_conexant_auto },
+ 	{ .id = 0x14f15115, .name = "CX20757",
+ 	  .patch = patch_conexant_auto },
++	{ .id = 0x14f151d7, .name = "CX20952",
++	  .patch = patch_conexant_auto },
+ 	{} /* terminator */
+ };
+ 
+@@ -3517,6 +3519,7 @@ MODULE_ALIAS("snd-hda-codec-id:14f15111");
+ MODULE_ALIAS("snd-hda-codec-id:14f15113");
+ MODULE_ALIAS("snd-hda-codec-id:14f15114");
+ MODULE_ALIAS("snd-hda-codec-id:14f15115");
++MODULE_ALIAS("snd-hda-codec-id:14f151d7");
+ 
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Conexant HD-audio codec");
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 4496e0ab693d..8bce044583ed 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1037,6 +1037,7 @@ enum {
+ 	ALC880_FIXUP_UNIWILL,
+ 	ALC880_FIXUP_UNIWILL_DIG,
+ 	ALC880_FIXUP_Z71V,
++	ALC880_FIXUP_ASUS_W5A,
+ 	ALC880_FIXUP_3ST_BASE,
+ 	ALC880_FIXUP_3ST,
+ 	ALC880_FIXUP_3ST_DIG,
+@@ -1207,6 +1208,26 @@ static const struct hda_fixup alc880_fixups[] = {
+ 			{ }
+ 		}
+ 	},
++	[ALC880_FIXUP_ASUS_W5A] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			/* set up the whole pins as BIOS is utterly broken */
++			{ 0x14, 0x0121411f }, /* HP */
++			{ 0x15, 0x411111f0 }, /* N/A */
++			{ 0x16, 0x411111f0 }, /* N/A */
++			{ 0x17, 0x411111f0 }, /* N/A */
++			{ 0x18, 0x90a60160 }, /* mic */
++			{ 0x19, 0x411111f0 }, /* N/A */
++			{ 0x1a, 0x411111f0 }, /* N/A */
++			{ 0x1b, 0x411111f0 }, /* N/A */
++			{ 0x1c, 0x411111f0 }, /* N/A */
++			{ 0x1d, 0x411111f0 }, /* N/A */
++			{ 0x1e, 0xb743111e }, /* SPDIF out */
++			{ }
++		},
++		.chained = true,
++		.chain_id = ALC880_FIXUP_GPIO1,
++	},
+ 	[ALC880_FIXUP_3ST_BASE] = {
+ 		.type = HDA_FIXUP_PINS,
+ 		.v.pins = (const struct hda_pintbl[]) {
+@@ -1328,6 +1349,7 @@ static const struct hda_fixup alc880_fixups[] = {
+ 
+ static const struct snd_pci_quirk alc880_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1019, 0x0f69, "Coeus G610P", ALC880_FIXUP_W810),
++	SND_PCI_QUIRK(0x1043, 0x10c3, "ASUS W5A", ALC880_FIXUP_ASUS_W5A),
+ 	SND_PCI_QUIRK(0x1043, 0x1964, "ASUS Z71V", ALC880_FIXUP_Z71V),
+ 	SND_PCI_QUIRK_VENDOR(0x1043, "ASUS", ALC880_FIXUP_GPIO1),
+ 	SND_PCI_QUIRK(0x1558, 0x5401, "Clevo GPIO2", ALC880_FIXUP_GPIO2),
+@@ -1473,6 +1495,7 @@ enum {
+ 	ALC260_FIXUP_KN1,
+ 	ALC260_FIXUP_FSC_S7020,
+ 	ALC260_FIXUP_FSC_S7020_JWSE,
++	ALC260_FIXUP_VAIO_PINS,
+ };
+ 
+ static void alc260_gpio1_automute(struct hda_codec *codec)
+@@ -1613,6 +1636,24 @@ static const struct hda_fixup alc260_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = ALC260_FIXUP_FSC_S7020,
+ 	},
++	[ALC260_FIXUP_VAIO_PINS] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			/* Pin configs are missing completely on some VAIOs */
++			{ 0x0f, 0x01211020 },
++			{ 0x10, 0x0001003f },
++			{ 0x11, 0x411111f0 },
++			{ 0x12, 0x01a15930 },
++			{ 0x13, 0x411111f0 },
++			{ 0x14, 0x411111f0 },
++			{ 0x15, 0x411111f0 },
++			{ 0x16, 0x411111f0 },
++			{ 0x17, 0x411111f0 },
++			{ 0x18, 0x411111f0 },
++			{ 0x19, 0x411111f0 },
++			{ }
++		}
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc260_fixup_tbl[] = {
+@@ -1621,6 +1662,8 @@ static const struct snd_pci_quirk alc260_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1025, 0x008f, "Acer", ALC260_FIXUP_GPIO1),
+ 	SND_PCI_QUIRK(0x103c, 0x280a, "HP dc5750", ALC260_FIXUP_HP_DC5750),
+ 	SND_PCI_QUIRK(0x103c, 0x30ba, "HP Presario B1900", ALC260_FIXUP_HP_B1900),
++	SND_PCI_QUIRK(0x104d, 0x81bb, "Sony VAIO", ALC260_FIXUP_VAIO_PINS),
++	SND_PCI_QUIRK(0x104d, 0x81e2, "Sony VAIO TX", ALC260_FIXUP_HP_PIN_0F),
+ 	SND_PCI_QUIRK(0x10cf, 0x1326, "FSC LifeBook S7020", ALC260_FIXUP_FSC_S7020),
+ 	SND_PCI_QUIRK(0x1509, 0x4540, "Favorit 100XS", ALC260_FIXUP_GPIO1),
+ 	SND_PCI_QUIRK(0x152d, 0x0729, "Quanta KN1", ALC260_FIXUP_KN1),
+@@ -2380,6 +2423,7 @@ static const struct hda_verb alc268_beep_init_verbs[] = {
+ enum {
+ 	ALC268_FIXUP_INV_DMIC,
+ 	ALC268_FIXUP_HP_EAPD,
++	ALC268_FIXUP_SPDIF,
+ };
+ 
+ static const struct hda_fixup alc268_fixups[] = {
+@@ -2394,6 +2438,13 @@ static const struct hda_fixup alc268_fixups[] = {
+ 			{}
+ 		}
+ 	},
++	[ALC268_FIXUP_SPDIF] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{ 0x1e, 0x014b1180 }, /* enable SPDIF out */
++			{}
++		}
++	},
+ };
+ 
+ static const struct hda_model_fixup alc268_fixup_models[] = {
+@@ -2403,6 +2454,7 @@ static const struct hda_model_fixup alc268_fixup_models[] = {
+ };
+ 
+ static const struct snd_pci_quirk alc268_fixup_tbl[] = {
++	SND_PCI_QUIRK(0x1025, 0x0139, "Acer TravelMate 6293", ALC268_FIXUP_SPDIF),
+ 	SND_PCI_QUIRK(0x1025, 0x015b, "Acer AOA 150 (ZG5)", ALC268_FIXUP_INV_DMIC),
+ 	/* below is codec SSID since multiple Toshiba laptops have the
+ 	 * same PCI SSID 1179:ff00
+@@ -2531,6 +2583,7 @@ enum {
+ 	ALC269_TYPE_ALC282,
+ 	ALC269_TYPE_ALC284,
+ 	ALC269_TYPE_ALC286,
++	ALC269_TYPE_ALC255,
+ };
+ 
+ /*
+@@ -2555,6 +2608,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
+ 	case ALC269_TYPE_ALC269VD:
+ 	case ALC269_TYPE_ALC282:
+ 	case ALC269_TYPE_ALC286:
++	case ALC269_TYPE_ALC255:
+ 		ssids = alc269_ssids;
+ 		break;
+ 	default:
+@@ -2754,6 +2808,23 @@ static void alc269_fixup_mic_mute_hook(void *private_data, int enabled)
+ 		snd_hda_set_pin_ctl_cache(codec, spec->mute_led_nid, pinval);
+ }
+ 
++/* Make sure the led works even in runtime suspend */
++static unsigned int led_power_filter(struct hda_codec *codec,
++						  hda_nid_t nid,
++						  unsigned int power_state)
++{
++	struct alc_spec *spec = codec->spec;
++
++	if (power_state != AC_PWRST_D3 || nid != spec->mute_led_nid)
++		return power_state;
++
++	/* Set pin ctl again, it might have just been set to 0 */
++	snd_hda_set_pin_ctl(codec, nid,
++			    snd_hda_codec_get_pin_target(codec, nid));
++
++	return AC_PWRST_D0;
++}
++
+ static void alc269_fixup_hp_mute_led(struct hda_codec *codec,
+ 				     const struct hda_fixup *fix, int action)
+ {
+@@ -2773,6 +2844,7 @@ static void alc269_fixup_hp_mute_led(struct hda_codec *codec,
+ 		spec->mute_led_nid = pin - 0x0a + 0x18;
+ 		spec->gen.vmaster_mute.hook = alc269_fixup_mic_mute_hook;
+ 		spec->gen.vmaster_mute_enum = 1;
++		codec->power_filter = led_power_filter;
+ 		snd_printd("Detected mute LED for %x:%d\n", spec->mute_led_nid,
+ 			   spec->mute_led_polarity);
+ 		break;
+@@ -2788,6 +2860,7 @@ static void alc269_fixup_hp_mute_led_mic1(struct hda_codec *codec,
+ 		spec->mute_led_nid = 0x18;
+ 		spec->gen.vmaster_mute.hook = alc269_fixup_mic_mute_hook;
+ 		spec->gen.vmaster_mute_enum = 1;
++		codec->power_filter = led_power_filter;
+ 	}
+ }
+ 
+@@ -2800,6 +2873,7 @@ static void alc269_fixup_hp_mute_led_mic2(struct hda_codec *codec,
+ 		spec->mute_led_nid = 0x19;
+ 		spec->gen.vmaster_mute.hook = alc269_fixup_mic_mute_hook;
+ 		spec->gen.vmaster_mute_enum = 1;
++		codec->power_filter = led_power_filter;
+ 	}
+ }
+ 
+@@ -3040,8 +3114,10 @@ static void alc_update_headset_mode(struct hda_codec *codec)
+ 	else
+ 		new_headset_mode = ALC_HEADSET_MODE_HEADPHONE;
+ 
+-	if (new_headset_mode == spec->current_headset_mode)
++	if (new_headset_mode == spec->current_headset_mode) {
++		snd_hda_gen_update_outputs(codec);
+ 		return;
++	}
+ 
+ 	switch (new_headset_mode) {
+ 	case ALC_HEADSET_MODE_UNPLUGGED:
+@@ -3545,6 +3621,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1028, 0x0608, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x0609, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x0613, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
++	SND_PCI_QUIRK(0x1028, 0x0614, "Dell Inspiron 3135", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x0616, "Dell Vostro 5470", ALC290_FIXUP_MONO_SPEAKERS),
+ 	SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
+ 	SND_PCI_QUIRK(0x103c, 0x18e6, "HP", ALC269_FIXUP_HP_GPIO_LED),
+@@ -3765,6 +3842,9 @@ static int patch_alc269(struct hda_codec *codec)
+ 	case 0x10ec0286:
+ 		spec->codec_variant = ALC269_TYPE_ALC286;
+ 		break;
++	case 0x10ec0255:
++		spec->codec_variant = ALC269_TYPE_ALC255;
++		break;
+ 	}
+ 
+ 	/* automatic parse from the BIOS config */
+@@ -4472,6 +4552,7 @@ static int patch_alc680(struct hda_codec *codec)
+ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
+ 	{ .id = 0x10ec0221, .name = "ALC221", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0233, .name = "ALC233", .patch = patch_alc269 },
++	{ .id = 0x10ec0255, .name = "ALC255", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0260, .name = "ALC260", .patch = patch_alc260 },
+ 	{ .id = 0x10ec0262, .name = "ALC262", .patch = patch_alc262 },
+ 	{ .id = 0x10ec0267, .name = "ALC267", .patch = patch_alc268 },
+diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c
+index 4394ae796356..0716ba691398 100644
+--- a/sound/usb/6fire/chip.c
++++ b/sound/usb/6fire/chip.c
+@@ -101,7 +101,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf,
+ 			usb_set_intfdata(intf, chips[i]);
+ 			mutex_unlock(&register_mutex);
+ 			return 0;
+-		} else if (regidx < 0)
++		} else if (!devices[i] && regidx < 0)
+ 			regidx = i;
+ 	}
+ 	if (regidx < 0) {
+diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
+index 72a130bc448a..c329c8fc57f4 100644
+--- a/virt/kvm/iommu.c
++++ b/virt/kvm/iommu.c
+@@ -103,6 +103,10 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
+ 		while ((gfn << PAGE_SHIFT) & (page_size - 1))
+ 			page_size >>= 1;
+ 
++		/* Make sure hva is aligned to the page size we want to map */
++		while (__gfn_to_hva_memslot(slot, gfn) & (page_size - 1))
++			page_size >>= 1;
++
+ 		/*
+ 		 * Pin all pages we are about to map in memory. This is
+ 		 * important because we unmap and unpin in 4kb steps later.

Modified: genpatches-2.6/trunk/3.11/0000_README
===================================================================
--- genpatches-2.6/trunk/3.11/0000_README	2013-11-26 00:34:31 UTC (rev 2594)
+++ genpatches-2.6/trunk/3.11/0000_README	2013-11-29 23:44:29 UTC (rev 2595)
@@ -78,6 +78,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.11.9
 
+Patch:  1009_linux-3.11.10.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.11.10
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.11/1009_linux-3.11.10.patch
===================================================================
--- genpatches-2.6/trunk/3.11/1009_linux-3.11.10.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.11/1009_linux-3.11.10.patch	2013-11-29 23:44:29 UTC (rev 2595)
@@ -0,0 +1,1424 @@
+diff --git a/Makefile b/Makefile
+index 06379bd78b64..7feb3ad77387 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 11
+-SUBLEVEL = 9
++SUBLEVEL = 10
+ EXTRAVERSION =
+ NAME = Linux for Workgroups
+ 
+diff --git a/arch/ia64/include/asm/processor.h b/arch/ia64/include/asm/processor.h
+index e0a899a1a8a6..5a84b3a50741 100644
+--- a/arch/ia64/include/asm/processor.h
++++ b/arch/ia64/include/asm/processor.h
+@@ -319,7 +319,7 @@ struct thread_struct {
+ 	regs->loadrs = 0;									\
+ 	regs->r8 = get_dumpable(current->mm);	/* set "don't zap registers" flag */		\
+ 	regs->r12 = new_sp - 16;	/* allocate 16 byte scratch area */			\
+-	if (unlikely(!get_dumpable(current->mm))) {							\
++	if (unlikely(get_dumpable(current->mm) != SUID_DUMP_USER)) {	\
+ 		/*										\
+ 		 * Zap scratch regs to avoid leaking bits between processes with different	\
+ 		 * uid/privileges.								\
+diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
+index b4dbade8ca24..2e4b5be31a1b 100644
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -35,7 +35,6 @@ static u8 *ctrblk;
+ static char keylen_flag;
+ 
+ struct s390_aes_ctx {
+-	u8 iv[AES_BLOCK_SIZE];
+ 	u8 key[AES_MAX_KEY_SIZE];
+ 	long enc;
+ 	long dec;
+@@ -441,30 +440,36 @@ static int cbc_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
+ 	return aes_set_key(tfm, in_key, key_len);
+ }
+ 
+-static int cbc_aes_crypt(struct blkcipher_desc *desc, long func, void *param,
++static int cbc_aes_crypt(struct blkcipher_desc *desc, long func,
+ 			 struct blkcipher_walk *walk)
+ {
++	struct s390_aes_ctx *sctx = crypto_blkcipher_ctx(desc->tfm);
+ 	int ret = blkcipher_walk_virt(desc, walk);
+ 	unsigned int nbytes = walk->nbytes;
++	struct {
++		u8 iv[AES_BLOCK_SIZE];
++		u8 key[AES_MAX_KEY_SIZE];
++	} param;
+ 
+ 	if (!nbytes)
+ 		goto out;
+ 
+-	memcpy(param, walk->iv, AES_BLOCK_SIZE);
++	memcpy(param.iv, walk->iv, AES_BLOCK_SIZE);
++	memcpy(param.key, sctx->key, sctx->key_len);
+ 	do {
+ 		/* only use complete blocks */
+ 		unsigned int n = nbytes & ~(AES_BLOCK_SIZE - 1);
+ 		u8 *out = walk->dst.virt.addr;
+ 		u8 *in = walk->src.virt.addr;
+ 
+-		ret = crypt_s390_kmc(func, param, out, in, n);
++		ret = crypt_s390_kmc(func, &param, out, in, n);
+ 		if (ret < 0 || ret != n)
+ 			return -EIO;
+ 
+ 		nbytes &= AES_BLOCK_SIZE - 1;
+ 		ret = blkcipher_walk_done(desc, walk, nbytes);
+ 	} while ((nbytes = walk->nbytes));
+-	memcpy(walk->iv, param, AES_BLOCK_SIZE);
++	memcpy(walk->iv, param.iv, AES_BLOCK_SIZE);
+ 
+ out:
+ 	return ret;
+@@ -481,7 +486,7 @@ static int cbc_aes_encrypt(struct blkcipher_desc *desc,
+ 		return fallback_blk_enc(desc, dst, src, nbytes);
+ 
+ 	blkcipher_walk_init(&walk, dst, src, nbytes);
+-	return cbc_aes_crypt(desc, sctx->enc, sctx->iv, &walk);
++	return cbc_aes_crypt(desc, sctx->enc, &walk);
+ }
+ 
+ static int cbc_aes_decrypt(struct blkcipher_desc *desc,
+@@ -495,7 +500,7 @@ static int cbc_aes_decrypt(struct blkcipher_desc *desc,
+ 		return fallback_blk_dec(desc, dst, src, nbytes);
+ 
+ 	blkcipher_walk_init(&walk, dst, src, nbytes);
+-	return cbc_aes_crypt(desc, sctx->dec, sctx->iv, &walk);
++	return cbc_aes_crypt(desc, sctx->dec, &walk);
+ }
+ 
+ static struct crypto_alg cbc_aes_alg = {
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 83369e5a1d27..0b586c0ef7c3 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -391,9 +391,9 @@ static void amd_e400_idle(void)
+ 		 * The switch back from broadcast mode needs to be
+ 		 * called with interrupts disabled.
+ 		 */
+-		 local_irq_disable();
+-		 clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_EXIT, &cpu);
+-		 local_irq_enable();
++		local_irq_disable();
++		clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_EXIT, &cpu);
++		local_irq_enable();
+ 	} else
+ 		default_idle();
+ }
+diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
+index c0bb3778f1ae..666f1962a160 100644
+--- a/crypto/ansi_cprng.c
++++ b/crypto/ansi_cprng.c
+@@ -230,11 +230,11 @@ remainder:
+ 	 */
+ 	if (byte_count < DEFAULT_BLK_SZ) {
+ empty_rbuf:
+-		for (; ctx->rand_data_valid < DEFAULT_BLK_SZ;
+-			ctx->rand_data_valid++) {
++		while (ctx->rand_data_valid < DEFAULT_BLK_SZ) {
+ 			*ptr = ctx->rand_data[ctx->rand_data_valid];
+ 			ptr++;
+ 			byte_count--;
++			ctx->rand_data_valid++;
+ 			if (byte_count == 0)
+ 				goto done;
+ 		}
+diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c
+index 814b4a3d656a..2cdd41d8ade6 100644
+--- a/drivers/acpi/acpica/exoparg1.c
++++ b/drivers/acpi/acpica/exoparg1.c
+@@ -962,10 +962,17 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state)
+ 					 */
+ 					return_desc =
+ 					    *(operand[0]->reference.where);
+-					if (return_desc) {
+-						acpi_ut_add_reference
+-						    (return_desc);
++					if (!return_desc) {
++						/*
++						 * Element is NULL, do not allow the dereference.
++						 * This provides compatibility with other ACPI
++						 * implementations.
++						 */
++						return_ACPI_STATUS
++						    (AE_AML_UNINITIALIZED_ELEMENT);
+ 					}
++
++					acpi_ut_add_reference(return_desc);
+ 					break;
+ 
+ 				default:
+@@ -990,11 +997,40 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state)
+ 									 acpi_namespace_node
+ 									 *)
+ 									return_desc);
+-				}
++					if (!return_desc) {
++						break;
++					}
+ 
+-				/* Add another reference to the object! */
++					/*
++					 * June 2013:
++					 * buffer_fields/field_units require additional resolution
++					 */
++					switch (return_desc->common.type) {
++					case ACPI_TYPE_BUFFER_FIELD:
++					case ACPI_TYPE_LOCAL_REGION_FIELD:
++					case ACPI_TYPE_LOCAL_BANK_FIELD:
++					case ACPI_TYPE_LOCAL_INDEX_FIELD:
+ 
+-				acpi_ut_add_reference(return_desc);
++						status =
++						    acpi_ex_read_data_from_field
++						    (walk_state, return_desc,
++						     &temp_desc);
++						if (ACPI_FAILURE(status)) {
++							goto cleanup;
++						}
++
++						return_desc = temp_desc;
++						break;
++
++					default:
++
++						/* Add another reference to the object */
++
++						acpi_ut_add_reference
++						    (return_desc);
++						break;
++					}
++				}
+ 				break;
+ 
+ 			default:
+diff --git a/drivers/acpi/acpica/exstore.c b/drivers/acpi/acpica/exstore.c
+index 2bdba6f7d762..f0b09bf9887d 100644
+--- a/drivers/acpi/acpica/exstore.c
++++ b/drivers/acpi/acpica/exstore.c
+@@ -57,6 +57,11 @@ acpi_ex_store_object_to_index(union acpi_operand_object *val_desc,
+ 			      union acpi_operand_object *dest_desc,
+ 			      struct acpi_walk_state *walk_state);
+ 
++static acpi_status
++acpi_ex_store_direct_to_node(union acpi_operand_object *source_desc,
++			     struct acpi_namespace_node *node,
++			     struct acpi_walk_state *walk_state);
++
+ /*******************************************************************************
+  *
+  * FUNCTION:    acpi_ex_store
+@@ -375,7 +380,11 @@ acpi_ex_store_object_to_index(union acpi_operand_object *source_desc,
+  *              When storing into an object the data is converted to the
+  *              target object type then stored in the object. This means
+  *              that the target object type (for an initialized target) will
+- *              not be changed by a store operation.
++ *              not be changed by a store operation. A copy_object can change
++ *              the target type, however.
++ *
++ *              The implicit_conversion flag is set to NO/FALSE only when
++ *              storing to an arg_x -- as per the rules of the ACPI spec.
+  *
+  *              Assumes parameters are already validated.
+  *
+@@ -399,7 +408,7 @@ acpi_ex_store_object_to_node(union acpi_operand_object *source_desc,
+ 	target_type = acpi_ns_get_type(node);
+ 	target_desc = acpi_ns_get_attached_object(node);
+ 
+-	ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "Storing %p(%s) into node %p(%s)\n",
++	ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "Storing %p (%s) to node %p (%s)\n",
+ 			  source_desc,
+ 			  acpi_ut_get_object_type_name(source_desc), node,
+ 			  acpi_ut_get_type_name(target_type)));
+@@ -413,45 +422,30 @@ acpi_ex_store_object_to_node(union acpi_operand_object *source_desc,
+ 		return_ACPI_STATUS(status);
+ 	}
+ 
+-	/* If no implicit conversion, drop into the default case below */
+-
+-	if ((!implicit_conversion) ||
+-	    ((walk_state->opcode == AML_COPY_OP) &&
+-	     (target_type != ACPI_TYPE_LOCAL_REGION_FIELD) &&
+-	     (target_type != ACPI_TYPE_LOCAL_BANK_FIELD) &&
+-	     (target_type != ACPI_TYPE_LOCAL_INDEX_FIELD))) {
+-		/*
+-		 * Force execution of default (no implicit conversion). Note:
+-		 * copy_object does not perform an implicit conversion, as per the ACPI
+-		 * spec -- except in case of region/bank/index fields -- because these
+-		 * objects must retain their original type permanently.
+-		 */
+-		target_type = ACPI_TYPE_ANY;
+-	}
+-
+ 	/* Do the actual store operation */
+ 
+ 	switch (target_type) {
+-	case ACPI_TYPE_BUFFER_FIELD:
+-	case ACPI_TYPE_LOCAL_REGION_FIELD:
+-	case ACPI_TYPE_LOCAL_BANK_FIELD:
+-	case ACPI_TYPE_LOCAL_INDEX_FIELD:
+-
+-		/* For fields, copy the source data to the target field. */
+-
+-		status = acpi_ex_write_data_to_field(source_desc, target_desc,
+-						     &walk_state->result_obj);
+-		break;
+-
+ 	case ACPI_TYPE_INTEGER:
+ 	case ACPI_TYPE_STRING:
+ 	case ACPI_TYPE_BUFFER:
+ 		/*
+-		 * These target types are all of type Integer/String/Buffer, and
+-		 * therefore support implicit conversion before the store.
+-		 *
+-		 * Copy and/or convert the source object to a new target object
++		 * The simple data types all support implicit source operand
++		 * conversion before the store.
+ 		 */
++
++		if ((walk_state->opcode == AML_COPY_OP) || !implicit_conversion) {
++			/*
++			 * However, copy_object and Stores to arg_x do not perform
++			 * an implicit conversion, as per the ACPI specification.
++			 * A direct store is performed instead.
++			 */
++			status = acpi_ex_store_direct_to_node(source_desc, node,
++							      walk_state);
++			break;
++		}
++
++		/* Store with implicit source operand conversion support */
++
+ 		status =
+ 		    acpi_ex_store_object_to_object(source_desc, target_desc,
+ 						   &new_desc, walk_state);
+@@ -465,13 +459,12 @@ acpi_ex_store_object_to_node(union acpi_operand_object *source_desc,
+ 			 * the Name's type to that of the value being stored in it.
+ 			 * source_desc reference count is incremented by attach_object.
+ 			 *
+-			 * Note: This may change the type of the node if an explicit store
+-			 * has been performed such that the node/object type has been
+-			 * changed.
++			 * Note: This may change the type of the node if an explicit
++			 * store has been performed such that the node/object type
++			 * has been changed.
+ 			 */
+-			status =
+-			    acpi_ns_attach_object(node, new_desc,
+-						  new_desc->common.type);
++			status = acpi_ns_attach_object(node, new_desc,
++						       new_desc->common.type);
+ 
+ 			ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
+ 					  "Store %s into %s via Convert/Attach\n",
+@@ -482,38 +475,83 @@ acpi_ex_store_object_to_node(union acpi_operand_object *source_desc,
+ 		}
+ 		break;
+ 
+-	default:
+-
+-		ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
+-				  "Storing [%s] (%p) directly into node [%s] (%p)"
+-				  " with no implicit conversion\n",
+-				  acpi_ut_get_object_type_name(source_desc),
+-				  source_desc,
+-				  acpi_ut_get_object_type_name(target_desc),
+-				  node));
++	case ACPI_TYPE_BUFFER_FIELD:
++	case ACPI_TYPE_LOCAL_REGION_FIELD:
++	case ACPI_TYPE_LOCAL_BANK_FIELD:
++	case ACPI_TYPE_LOCAL_INDEX_FIELD:
++		/*
++		 * For all fields, always write the source data to the target
++		 * field. Any required implicit source operand conversion is
++		 * performed in the function below as necessary. Note, field
++		 * objects must retain their original type permanently.
++		 */
++		status = acpi_ex_write_data_to_field(source_desc, target_desc,
++						     &walk_state->result_obj);
++		break;
+ 
++	default:
+ 		/*
+ 		 * No conversions for all other types. Directly store a copy of
+-		 * the source object. NOTE: This is a departure from the ACPI
+-		 * spec, which states "If conversion is impossible, abort the
+-		 * running control method".
++		 * the source object. This is the ACPI spec-defined behavior for
++		 * the copy_object operator.
+ 		 *
+-		 * This code implements "If conversion is impossible, treat the
+-		 * Store operation as a CopyObject".
++		 * NOTE: For the Store operator, this is a departure from the
++		 * ACPI spec, which states "If conversion is impossible, abort
++		 * the running control method". Instead, this code implements
++		 * "If conversion is impossible, treat the Store operation as
++		 * a CopyObject".
+ 		 */
+-		status =
+-		    acpi_ut_copy_iobject_to_iobject(source_desc, &new_desc,
+-						    walk_state);
+-		if (ACPI_FAILURE(status)) {
+-			return_ACPI_STATUS(status);
+-		}
+-
+-		status =
+-		    acpi_ns_attach_object(node, new_desc,
+-					  new_desc->common.type);
+-		acpi_ut_remove_reference(new_desc);
++		status = acpi_ex_store_direct_to_node(source_desc, node,
++						      walk_state);
+ 		break;
+ 	}
+ 
+ 	return_ACPI_STATUS(status);
+ }
++
++/*******************************************************************************
++ *
++ * FUNCTION:    acpi_ex_store_direct_to_node
++ *
++ * PARAMETERS:  source_desc             - Value to be stored
++ *              node                    - Named object to receive the value
++ *              walk_state              - Current walk state
++ *
++ * RETURN:      Status
++ *
++ * DESCRIPTION: "Store" an object directly to a node. This involves a copy
++ *              and an attach.
++ *
++ ******************************************************************************/
++
++static acpi_status
++acpi_ex_store_direct_to_node(union acpi_operand_object *source_desc,
++			     struct acpi_namespace_node *node,
++			     struct acpi_walk_state *walk_state)
++{
++	acpi_status status;
++	union acpi_operand_object *new_desc;
++
++	ACPI_FUNCTION_TRACE(ex_store_direct_to_node);
++
++	ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
++			  "Storing [%s] (%p) directly into node [%s] (%p)"
++			  " with no implicit conversion\n",
++			  acpi_ut_get_object_type_name(source_desc),
++			  source_desc, acpi_ut_get_type_name(node->type),
++			  node));
++
++	/* Copy the source object to a new object */
++
++	status =
++	    acpi_ut_copy_iobject_to_iobject(source_desc, &new_desc, walk_state);
++	if (ACPI_FAILURE(status)) {
++		return_ACPI_STATUS(status);
++	}
++
++	/* Attach the new object to the node */
++
++	status = acpi_ns_attach_object(node, new_desc, new_desc->common.type);
++	acpi_ut_remove_reference(new_desc);
++	return_ACPI_STATUS(status);
++}
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 45af90a1ec1b..1ad5a4f9e0c3 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -175,9 +175,10 @@ static void start_transaction(struct acpi_ec *ec)
+ static void advance_transaction(struct acpi_ec *ec, u8 status)
+ {
+ 	unsigned long flags;
+-	struct transaction *t = ec->curr;
++	struct transaction *t;
+ 
+ 	spin_lock_irqsave(&ec->lock, flags);
++	t = ec->curr;
+ 	if (!t)
+ 		goto unlock;
+ 	if (t->wlen > t->wi) {
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index a67853e3c419..7dbe92cb7cb8 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -611,9 +611,12 @@ static void handle_root_bridge_removal(struct acpi_device *device)
+ 	ej_event->device = device;
+ 	ej_event->event = ACPI_NOTIFY_EJECT_REQUEST;
+ 
++	get_device(&device->dev);
+ 	status = acpi_os_hotplug_execute(acpi_bus_hot_remove_device, ej_event);
+-	if (ACPI_FAILURE(status))
++	if (ACPI_FAILURE(status)) {
++		put_device(&device->dev);
+ 		kfree(ej_event);
++	}
+ }
+ 
+ static void _handle_hotplug_event_root(struct work_struct *work)
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index f98dd00b51a9..c7414a545a4f 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -119,17 +119,10 @@ static struct dmi_system_id processor_power_dmi_table[] = {
+  */
+ static void acpi_safe_halt(void)
+ {
+-	current_thread_info()->status &= ~TS_POLLING;
+-	/*
+-	 * TS_POLLING-cleared state must be visible before we
+-	 * test NEED_RESCHED:
+-	 */
+-	smp_mb();
+-	if (!need_resched()) {
++	if (!tif_need_resched()) {
+ 		safe_halt();
+ 		local_irq_disable();
+ 	}
+-	current_thread_info()->status |= TS_POLLING;
+ }
+ 
+ #ifdef ARCH_APICTIMER_STOPS_ON_C3
+@@ -737,6 +730,11 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
+ 	if (unlikely(!pr))
+ 		return -EINVAL;
+ 
++	if (cx->entry_method == ACPI_CSTATE_FFH) {
++		if (current_set_polling_and_test())
++			return -EINVAL;
++	}
++
+ 	lapic_timer_state_broadcast(pr, cx, 1);
+ 	acpi_idle_do_entry(cx);
+ 
+@@ -790,18 +788,9 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
+ 	if (unlikely(!pr))
+ 		return -EINVAL;
+ 
+-	if (cx->entry_method != ACPI_CSTATE_FFH) {
+-		current_thread_info()->status &= ~TS_POLLING;
+-		/*
+-		 * TS_POLLING-cleared state must be visible before we test
+-		 * NEED_RESCHED:
+-		 */
+-		smp_mb();
+-
+-		if (unlikely(need_resched())) {
+-			current_thread_info()->status |= TS_POLLING;
++	if (cx->entry_method == ACPI_CSTATE_FFH) {
++		if (current_set_polling_and_test())
+ 			return -EINVAL;
+-		}
+ 	}
+ 
+ 	/*
+@@ -819,9 +808,6 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
+ 
+ 	sched_clock_idle_wakeup_event(0);
+ 
+-	if (cx->entry_method != ACPI_CSTATE_FFH)
+-		current_thread_info()->status |= TS_POLLING;
+-
+ 	lapic_timer_state_broadcast(pr, cx, 0);
+ 	return index;
+ }
+@@ -858,18 +844,9 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
+ 		}
+ 	}
+ 
+-	if (cx->entry_method != ACPI_CSTATE_FFH) {
+-		current_thread_info()->status &= ~TS_POLLING;
+-		/*
+-		 * TS_POLLING-cleared state must be visible before we test
+-		 * NEED_RESCHED:
+-		 */
+-		smp_mb();
+-
+-		if (unlikely(need_resched())) {
+-			current_thread_info()->status |= TS_POLLING;
++	if (cx->entry_method == ACPI_CSTATE_FFH) {
++		if (current_set_polling_and_test())
+ 			return -EINVAL;
+-		}
+ 	}
+ 
+ 	acpi_unlazy_tlb(smp_processor_id());
+@@ -915,9 +892,6 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
+ 
+ 	sched_clock_idle_wakeup_event(0);
+ 
+-	if (cx->entry_method != ACPI_CSTATE_FFH)
+-		current_thread_info()->status |= TS_POLLING;
+-
+ 	lapic_timer_state_broadcast(pr, cx, 0);
+ 	return index;
+ }
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 8a46c924effd..0ebb955bc03a 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -359,8 +359,6 @@ static void acpi_scan_bus_device_check(acpi_handle handle, u32 ost_source)
+ 			goto out;
+ 		}
+ 	}
+-	acpi_evaluate_hotplug_ost(handle, ost_source,
+-				  ACPI_OST_SC_INSERT_IN_PROGRESS, NULL);
+ 	error = acpi_bus_scan(handle);
+ 	if (error) {
+ 		acpi_handle_warn(handle, "Namespace scan failure\n");
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index 3270d3c8ba4e..28e5184b565b 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -848,7 +848,7 @@ acpi_video_init_brightness(struct acpi_video_device *device)
+ 		for (i = 2; i < br->count; i++)
+ 			if (level_old == br->levels[i])
+ 				break;
+-		if (i == br->count)
++		if (i == br->count || !level)
+ 			level = max_level;
+ 	}
+ 
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 3221a55dddad..58491f1b2799 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1625,7 +1625,6 @@ static struct usb_driver btusb_driver = {
+ #ifdef CONFIG_PM
+ 	.suspend	= btusb_suspend,
+ 	.resume		= btusb_resume,
+-	.reset_resume	= btusb_resume,
+ #endif
+ 	.id_table	= btusb_table,
+ 	.supports_autosuspend = 1,
+diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvc1.c b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvc1.c
+index e5be3ee7f172..71b4283f7fad 100644
+--- a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvc1.c
++++ b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvc1.c
+@@ -587,6 +587,7 @@ nvc1_grctx_init_unk58xx[] = {
+ 	{ 0x405870,   4, 0x04, 0x00000001 },
+ 	{ 0x405a00,   2, 0x04, 0x00000000 },
+ 	{ 0x405a18,   1, 0x04, 0x00000000 },
++	{}
+ };
+ 
+ static struct nvc0_graph_init
+@@ -598,6 +599,7 @@ nvc1_grctx_init_rop[] = {
+ 	{ 0x408904,   1, 0x04, 0x62000001 },
+ 	{ 0x408908,   1, 0x04, 0x00c80929 },
+ 	{ 0x408980,   1, 0x04, 0x0000011d },
++	{}
+ };
+ 
+ static struct nvc0_graph_init
+@@ -671,6 +673,7 @@ nvc1_grctx_init_gpc_0[] = {
+ 	{ 0x419000,   1, 0x04, 0x00000780 },
+ 	{ 0x419004,   2, 0x04, 0x00000000 },
+ 	{ 0x419014,   1, 0x04, 0x00000004 },
++	{}
+ };
+ 
+ static struct nvc0_graph_init
+@@ -717,6 +720,7 @@ nvc1_grctx_init_tpc[] = {
+ 	{ 0x419e98,   1, 0x04, 0x00000000 },
+ 	{ 0x419ee0,   1, 0x04, 0x00011110 },
+ 	{ 0x419f30,  11, 0x04, 0x00000000 },
++	{}
+ };
+ 
+ void
+diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd7.c b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd7.c
+index 438e78410808..c4740d528532 100644
+--- a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd7.c
++++ b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd7.c
+@@ -258,6 +258,7 @@ nvd7_grctx_init_hub[] = {
+ 	nvc0_grctx_init_unk78xx,
+ 	nvc0_grctx_init_unk80xx,
+ 	nvd9_grctx_init_rop,
++	NULL
+ };
+ 
+ struct nvc0_graph_init *
+diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd9.c b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd9.c
+index 818a4751df46..a1102cbf2fdc 100644
+--- a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd9.c
++++ b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd9.c
+@@ -466,6 +466,7 @@ nvd9_grctx_init_hub[] = {
+ 	nvc0_grctx_init_unk78xx,
+ 	nvc0_grctx_init_unk80xx,
+ 	nvd9_grctx_init_rop,
++	NULL
+ };
+ 
+ struct nvc0_graph_init *
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 461f47b6691e..6f1b5e6b44a0 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -172,7 +172,8 @@ static void vmbus_process_rescind_offer(struct work_struct *work)
+ 	struct vmbus_channel *primary_channel;
+ 	struct vmbus_channel_relid_released msg;
+ 
+-	vmbus_device_unregister(channel->device_obj);
++	if (channel->device_obj)
++		vmbus_device_unregister(channel->device_obj);
+ 	memset(&msg, 0, sizeof(struct vmbus_channel_relid_released));
+ 	msg.child_relid = channel->offermsg.child_relid;
+ 	msg.header.msgtype = CHANNELMSG_RELID_RELEASED;
+@@ -185,7 +186,7 @@ static void vmbus_process_rescind_offer(struct work_struct *work)
+ 	} else {
+ 		primary_channel = channel->primary_channel;
+ 		spin_lock_irqsave(&primary_channel->sc_lock, flags);
+-		list_del(&channel->listentry);
++		list_del(&channel->sc_list);
+ 		spin_unlock_irqrestore(&primary_channel->sc_lock, flags);
+ 	}
+ 	free_channel(channel);
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index fa6964d8681a..f116d664b473 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -359,7 +359,7 @@ static int intel_idle(struct cpuidle_device *dev,
+ 	if (!(lapic_timer_reliable_states & (1 << (cstate))))
+ 		clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &cpu);
+ 
+-	if (!need_resched()) {
++	if (!current_set_polling_and_test()) {
+ 
+ 		__monitor((void *)&current_thread_info()->flags, 0, 0);
+ 		smp_mb();
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index a668cd491cb3..e3fc07cf2f62 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -814,9 +814,6 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota)
+ 			msg_ctrl_save = priv->read_reg(priv,
+ 					C_CAN_IFACE(MSGCTRL_REG, 0));
+ 
+-			if (msg_ctrl_save & IF_MCONT_EOB)
+-				return num_rx_pkts;
+-
+ 			if (msg_ctrl_save & IF_MCONT_MSGLST) {
+ 				c_can_handle_lost_msg_obj(dev, 0, msg_obj);
+ 				num_rx_pkts++;
+@@ -824,6 +821,9 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota)
+ 				continue;
+ 			}
+ 
++			if (msg_ctrl_save & IF_MCONT_EOB)
++				return num_rx_pkts;
++
+ 			if (!(msg_ctrl_save & IF_MCONT_NEWDAT))
+ 				continue;
+ 
+diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
+index 3b9546588240..4b2d5ed62b11 100644
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -1544,9 +1544,9 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
+ 	return 0;
+ }
+ 
+-static void kvaser_usb_get_endpoints(const struct usb_interface *intf,
+-				     struct usb_endpoint_descriptor **in,
+-				     struct usb_endpoint_descriptor **out)
++static int kvaser_usb_get_endpoints(const struct usb_interface *intf,
++				    struct usb_endpoint_descriptor **in,
++				    struct usb_endpoint_descriptor **out)
+ {
+ 	const struct usb_host_interface *iface_desc;
+ 	struct usb_endpoint_descriptor *endpoint;
+@@ -1557,12 +1557,18 @@ static void kvaser_usb_get_endpoints(const struct usb_interface *intf,
+ 	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
+ 		endpoint = &iface_desc->endpoint[i].desc;
+ 
+-		if (usb_endpoint_is_bulk_in(endpoint))
++		if (!*in && usb_endpoint_is_bulk_in(endpoint))
+ 			*in = endpoint;
+ 
+-		if (usb_endpoint_is_bulk_out(endpoint))
++		if (!*out && usb_endpoint_is_bulk_out(endpoint))
+ 			*out = endpoint;
++
++		/* use first bulk endpoint for in and out */
++		if (*in && *out)
++			return 0;
+ 	}
++
++	return -ENODEV;
+ }
+ 
+ static int kvaser_usb_probe(struct usb_interface *intf,
+@@ -1576,8 +1582,8 @@ static int kvaser_usb_probe(struct usb_interface *intf,
+ 	if (!dev)
+ 		return -ENOMEM;
+ 
+-	kvaser_usb_get_endpoints(intf, &dev->bulk_in, &dev->bulk_out);
+-	if (!dev->bulk_in || !dev->bulk_out) {
++	err = kvaser_usb_get_endpoints(intf, &dev->bulk_in, &dev->bulk_out);
++	if (err) {
+ 		dev_err(&intf->dev, "Cannot get usb endpoint(s)");
+ 		return err;
+ 	}
+diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
+index 027398ebbba6..934057d81f52 100644
+--- a/drivers/net/ethernet/atheros/alx/main.c
++++ b/drivers/net/ethernet/atheros/alx/main.c
+@@ -1394,6 +1394,9 @@ static int alx_resume(struct device *dev)
+ {
+ 	struct pci_dev *pdev = to_pci_dev(dev);
+ 	struct alx_priv *alx = pci_get_drvdata(pdev);
++	struct alx_hw *hw = &alx->hw;
++
++	alx_reset_phy(hw);
+ 
+ 	if (!netif_running(alx->dev))
+ 		return 0;
+diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
+index 668dd27616a0..cc6a0a586f0b 100644
+--- a/drivers/net/wireless/libertas/debugfs.c
++++ b/drivers/net/wireless/libertas/debugfs.c
+@@ -913,7 +913,10 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
+ 	char *p2;
+ 	struct debug_data *d = f->private_data;
+ 
+-	pdata = kmalloc(cnt, GFP_KERNEL);
++	if (cnt == 0)
++		return 0;
++
++	pdata = kmalloc(cnt + 1, GFP_KERNEL);
+ 	if (pdata == NULL)
+ 		return 0;
+ 
+@@ -922,6 +925,7 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
+ 		kfree(pdata);
+ 		return 0;
+ 	}
++	pdata[cnt] = '\0';
+ 
+ 	p0 = pdata;
+ 	for (i = 0; i < num_of_items; i++) {
+diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
+index 39d8863c7337..b389cba532e2 100644
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -3423,10 +3423,13 @@ void rt2800_link_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual,
+ 
+ 	vgc = rt2800_get_default_vgc(rt2x00dev);
+ 
+-	if (rt2x00_rt(rt2x00dev, RT5592) && qual->rssi > -65)
+-		vgc += 0x20;
+-	else if (qual->rssi > -80)
+-		vgc += 0x10;
++	if (rt2x00_rt(rt2x00dev, RT5592)) {
++		if (qual->rssi > -65)
++			vgc += 0x20;
++	} else {
++		if (qual->rssi > -80)
++			vgc += 0x10;
++	}
+ 
+ 	rt2800_set_vgc(rt2x00dev, qual, vgc);
+ }
+diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
+index b16521e6bf4a..e418d32882e8 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+@@ -181,6 +181,7 @@ static void rt2x00lib_autowakeup(struct work_struct *work)
+ static void rt2x00lib_bc_buffer_iter(void *data, u8 *mac,
+ 				     struct ieee80211_vif *vif)
+ {
++	struct ieee80211_tx_control control = {};
+ 	struct rt2x00_dev *rt2x00dev = data;
+ 	struct sk_buff *skb;
+ 
+@@ -195,7 +196,7 @@ static void rt2x00lib_bc_buffer_iter(void *data, u8 *mac,
+ 	 */
+ 	skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif);
+ 	while (skb) {
+-		rt2x00mac_tx(rt2x00dev->hw, NULL, skb);
++		rt2x00mac_tx(rt2x00dev->hw, &control, skb);
+ 		skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif);
+ 	}
+ }
+diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
+index a0935987fa3a..7f40ab8e1bd8 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
++++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
+@@ -146,7 +146,7 @@ void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length);
+  * @local: frame is not from mac80211
+  */
+ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
+-			       bool local);
++			       struct ieee80211_sta *sta, bool local);
+ 
+ /**
+  * rt2x00queue_update_beacon - Send new beacon from mac80211
+diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
+index f883802f3505..f8cff1f0b6b7 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
+@@ -90,7 +90,7 @@ static int rt2x00mac_tx_rts_cts(struct rt2x00_dev *rt2x00dev,
+ 				  frag_skb->data, data_length, tx_info,
+ 				  (struct ieee80211_rts *)(skb->data));
+ 
+-	retval = rt2x00queue_write_tx_frame(queue, skb, true);
++	retval = rt2x00queue_write_tx_frame(queue, skb, NULL, true);
+ 	if (retval) {
+ 		dev_kfree_skb_any(skb);
+ 		rt2x00_warn(rt2x00dev, "Failed to send RTS/CTS frame\n");
+@@ -151,7 +151,7 @@ void rt2x00mac_tx(struct ieee80211_hw *hw,
+ 			goto exit_fail;
+ 	}
+ 
+-	if (unlikely(rt2x00queue_write_tx_frame(queue, skb, false)))
++	if (unlikely(rt2x00queue_write_tx_frame(queue, skb, control->sta, false)))
+ 		goto exit_fail;
+ 
+ 	/*
+@@ -754,6 +754,9 @@ void rt2x00mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+ 	struct rt2x00_dev *rt2x00dev = hw->priv;
+ 	struct data_queue *queue;
+ 
++	if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
++		return;
++
+ 	tx_queue_for_each(rt2x00dev, queue)
+ 		rt2x00queue_flush_queue(queue, drop);
+ }
+diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
+index aa95c6cf3545..f541c92e4290 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
+@@ -635,7 +635,7 @@ static void rt2x00queue_bar_check(struct queue_entry *entry)
+ }
+ 
+ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
+-			       bool local)
++			       struct ieee80211_sta *sta, bool local)
+ {
+ 	struct ieee80211_tx_info *tx_info;
+ 	struct queue_entry *entry;
+@@ -649,7 +649,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
+ 	 * after that we are free to use the skb->cb array
+ 	 * for our information.
+ 	 */
+-	rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc, NULL);
++	rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc, sta);
+ 
+ 	/*
+ 	 * All information is retrieved from the skb->cb array,
+diff --git a/drivers/pci/access.c b/drivers/pci/access.c
+index 1cc23661f79b..061da8c3ab4b 100644
+--- a/drivers/pci/access.c
++++ b/drivers/pci/access.c
+@@ -484,28 +484,29 @@ static inline bool pcie_cap_has_lnkctl(const struct pci_dev *dev)
+ {
+ 	int type = pci_pcie_type(dev);
+ 
+-	return pcie_cap_version(dev) > 1 ||
++	return type == PCI_EXP_TYPE_ENDPOINT ||
++	       type == PCI_EXP_TYPE_LEG_END ||
+ 	       type == PCI_EXP_TYPE_ROOT_PORT ||
+-	       type == PCI_EXP_TYPE_ENDPOINT ||
+-	       type == PCI_EXP_TYPE_LEG_END;
++	       type == PCI_EXP_TYPE_UPSTREAM ||
++	       type == PCI_EXP_TYPE_DOWNSTREAM ||
++	       type == PCI_EXP_TYPE_PCI_BRIDGE ||
++	       type == PCI_EXP_TYPE_PCIE_BRIDGE;
+ }
+ 
+ static inline bool pcie_cap_has_sltctl(const struct pci_dev *dev)
+ {
+ 	int type = pci_pcie_type(dev);
+ 
+-	return pcie_cap_version(dev) > 1 ||
+-	       type == PCI_EXP_TYPE_ROOT_PORT ||
+-	       (type == PCI_EXP_TYPE_DOWNSTREAM &&
+-		pcie_caps_reg(dev) & PCI_EXP_FLAGS_SLOT);
++	return (type == PCI_EXP_TYPE_ROOT_PORT ||
++		type == PCI_EXP_TYPE_DOWNSTREAM) &&
++	       pcie_caps_reg(dev) & PCI_EXP_FLAGS_SLOT;
+ }
+ 
+ static inline bool pcie_cap_has_rtctl(const struct pci_dev *dev)
+ {
+ 	int type = pci_pcie_type(dev);
+ 
+-	return pcie_cap_version(dev) > 1 ||
+-	       type == PCI_EXP_TYPE_ROOT_PORT ||
++	return type == PCI_EXP_TYPE_ROOT_PORT ||
+ 	       type == PCI_EXP_TYPE_RC_EC;
+ }
+ 
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 54d31c0a9840..99eeaf40d641 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -6438,7 +6438,12 @@ static struct ibm_struct brightness_driver_data = {
+ #define TPACPI_ALSA_SHRTNAME "ThinkPad Console Audio Control"
+ #define TPACPI_ALSA_MIXERNAME TPACPI_ALSA_SHRTNAME
+ 
+-static int alsa_index = ~((1 << (SNDRV_CARDS - 3)) - 1); /* last three slots */
++#if SNDRV_CARDS <= 32
++#define DEFAULT_ALSA_IDX		~((1 << (SNDRV_CARDS - 3)) - 1)
++#else
++#define DEFAULT_ALSA_IDX		~((1 << (32 - 3)) - 1)
++#endif
++static int alsa_index = DEFAULT_ALSA_IDX; /* last three slots */
+ static char *alsa_id = "ThinkPadEC";
+ static bool alsa_enable = SNDRV_DEFAULT_ENABLE1;
+ 
+diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
+index d85ac1a9d2c0..fbcd48d0bfc3 100644
+--- a/drivers/scsi/aacraid/commctrl.c
++++ b/drivers/scsi/aacraid/commctrl.c
+@@ -511,7 +511,8 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
+ 		goto cleanup;
+ 	}
+ 
+-	if (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr))) {
++	if ((fibsize < (sizeof(struct user_aac_srb) - sizeof(struct user_sgentry))) ||
++	    (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr)))) {
+ 		rcode = -EINVAL;
+ 		goto cleanup;
+ 	}
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index f4a197b2d1fd..ea85f71eabfb 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -543,7 +543,7 @@ void *comedi_alloc_spriv(struct comedi_subdevice *s, size_t size)
+ {
+ 	s->private = kzalloc(size, GFP_KERNEL);
+ 	if (s->private)
+-		comedi_set_subdevice_runflags(s, ~0, SRF_FREE_SPRIV);
++		s->runflags |= SRF_FREE_SPRIV;
+ 	return s->private;
+ }
+ EXPORT_SYMBOL_GPL(comedi_alloc_spriv);
+@@ -1485,7 +1485,8 @@ static int do_cmd_ioctl(struct comedi_device *dev,
+ 	if (async->cmd.flags & TRIG_WAKE_EOS)
+ 		async->cb_mask |= COMEDI_CB_EOS;
+ 
+-	comedi_set_subdevice_runflags(s, ~0, SRF_USER | SRF_RUNNING);
++	comedi_set_subdevice_runflags(s, SRF_USER | SRF_ERROR | SRF_RUNNING,
++				      SRF_USER | SRF_RUNNING);
+ 
+ 	/* set s->busy _after_ setting SRF_RUNNING flag to avoid race with
+ 	 * comedi_read() or comedi_write() */
+diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
+index 8f54c503ea04..ee6b4356f222 100644
+--- a/drivers/staging/zram/zram_drv.c
++++ b/drivers/staging/zram/zram_drv.c
+@@ -647,6 +647,9 @@ static ssize_t reset_store(struct device *dev,
+ 	zram = dev_to_zram(dev);
+ 	bdev = bdget_disk(zram->disk, 0);
+ 
++	if (!bdev)
++		return -ENOMEM;
++
+ 	/* Do not reset an active device! */
+ 	if (bdev->bd_holders)
+ 		return -EBUSY;
+@@ -659,8 +662,7 @@ static ssize_t reset_store(struct device *dev,
+ 		return -EINVAL;
+ 
+ 	/* Make sure all pending I/O is finished */
+-	if (bdev)
+-		fsync_bdev(bdev);
++	fsync_bdev(bdev);
+ 
+ 	zram_reset_device(zram, true);
+ 	return len;
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index 3bac4693c038..23dc9d1dc99e 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -1580,7 +1580,11 @@ static int mos7840_tiocmget(struct tty_struct *tty)
+ 		return -ENODEV;
+ 
+ 	status = mos7840_get_uart_reg(port, MODEM_STATUS_REGISTER, &msr);
++	if (status != 1)
++		return -EIO;
+ 	status = mos7840_get_uart_reg(port, MODEM_CONTROL_REGISTER, &mcr);
++	if (status != 1)
++		return -EIO;
+ 	result = ((mcr & MCR_DTR) ? TIOCM_DTR : 0)
+ 	    | ((mcr & MCR_RTS) ? TIOCM_RTS : 0)
+ 	    | ((mcr & MCR_LOOPBACK) ? TIOCM_LOOP : 0)
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 4576c03a0912..3702d4503ea1 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -4462,6 +4462,7 @@ int btrfs_reloc_clone_csums(struct inode *inode, u64 file_pos, u64 len)
+ 	struct btrfs_root *root = BTRFS_I(inode)->root;
+ 	int ret;
+ 	u64 disk_bytenr;
++	u64 new_bytenr;
+ 	LIST_HEAD(list);
+ 
+ 	ordered = btrfs_lookup_ordered_extent(inode, file_pos);
+@@ -4473,13 +4474,24 @@ int btrfs_reloc_clone_csums(struct inode *inode, u64 file_pos, u64 len)
+ 	if (ret)
+ 		goto out;
+ 
+-	disk_bytenr = ordered->start;
+ 	while (!list_empty(&list)) {
+ 		sums = list_entry(list.next, struct btrfs_ordered_sum, list);
+ 		list_del_init(&sums->list);
+ 
+-		sums->bytenr = disk_bytenr;
+-		disk_bytenr += sums->len;
++		/*
++		 * We need to offset the new_bytenr based on where the csum is.
++		 * We need to do this because we will read in entire prealloc
++		 * extents but we may have written to say the middle of the
++		 * prealloc extent, so we need to make sure the csum goes with
++		 * the right disk offset.
++		 *
++		 * We can do this because the data reloc inode refers strictly
++		 * to the on disk bytes, so we don't have to worry about
++		 * disk_len vs real len like with real inodes since it's all
++		 * disk length.
++		 */
++		new_bytenr = ordered->start + (sums->bytenr - disk_bytenr);
++		sums->bytenr = new_bytenr;
+ 
+ 		btrfs_add_ordered_sum(inode, ordered, sums);
+ 	}
+diff --git a/fs/exec.c b/fs/exec.c
+index fd774c7cb483..e72f6bbbde2e 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1670,6 +1670,12 @@ int __get_dumpable(unsigned long mm_flags)
+ 	return (ret > SUID_DUMP_USER) ? SUID_DUMP_ROOT : ret;
+ }
+ 
++/*
++ * This returns the actual value of the suid_dumpable flag. For things
++ * that are using this for checking for privilege transitions, it must
++ * test against SUID_DUMP_USER rather than treating it as a boolean
++ * value.
++ */
+ int get_dumpable(struct mm_struct *mm)
+ {
+ 	return __get_dumpable(mm->flags);
+diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
+index 70cf138690e9..df97ca4aae52 100644
+--- a/include/linux/binfmts.h
++++ b/include/linux/binfmts.h
+@@ -99,9 +99,6 @@ extern void setup_new_exec(struct linux_binprm * bprm);
+ extern void would_dump(struct linux_binprm *, struct file *);
+ 
+ extern int suid_dumpable;
+-#define SUID_DUMP_DISABLE	0	/* No setuid dumping */
+-#define SUID_DUMP_USER		1	/* Dump as user of process */
+-#define SUID_DUMP_ROOT		2	/* Dump as root */
+ 
+ /* Stack area protections */
+ #define EXSTACK_DEFAULT   0	/* Whatever the arch defaults to */
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 078066daffd4..e057ea09c851 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -330,6 +330,10 @@ static inline void arch_pick_mmap_layout(struct mm_struct *mm) {}
+ extern void set_dumpable(struct mm_struct *mm, int value);
+ extern int get_dumpable(struct mm_struct *mm);
+ 
++#define SUID_DUMP_DISABLE	0	/* No setuid dumping */
++#define SUID_DUMP_USER		1	/* Dump as user of process */
++#define SUID_DUMP_ROOT		2	/* Dump as root */
++
+ /* mm flags */
+ /* dumpable bits */
+ #define MMF_DUMPABLE      0  /* core dump is permitted */
+@@ -2473,34 +2477,98 @@ static inline int tsk_is_polling(struct task_struct *p)
+ {
+ 	return task_thread_info(p)->status & TS_POLLING;
+ }
+-static inline void current_set_polling(void)
++static inline void __current_set_polling(void)
+ {
+ 	current_thread_info()->status |= TS_POLLING;
+ }
+ 
+-static inline void current_clr_polling(void)
++static inline bool __must_check current_set_polling_and_test(void)
++{
++	__current_set_polling();
++
++	/*
++	 * Polling state must be visible before we test NEED_RESCHED,
++	 * paired by resched_task()
++	 */
++	smp_mb();
++
++	return unlikely(tif_need_resched());
++}
++
++static inline void __current_clr_polling(void)
+ {
+ 	current_thread_info()->status &= ~TS_POLLING;
+-	smp_mb__after_clear_bit();
++}
++
++static inline bool __must_check current_clr_polling_and_test(void)
++{
++	__current_clr_polling();
++
++	/*
++	 * Polling state must be visible before we test NEED_RESCHED,
++	 * paired by resched_task()
++	 */
++	smp_mb();
++
++	return unlikely(tif_need_resched());
+ }
+ #elif defined(TIF_POLLING_NRFLAG)
+ static inline int tsk_is_polling(struct task_struct *p)
+ {
+ 	return test_tsk_thread_flag(p, TIF_POLLING_NRFLAG);
+ }
+-static inline void current_set_polling(void)
++
++static inline void __current_set_polling(void)
+ {
+ 	set_thread_flag(TIF_POLLING_NRFLAG);
+ }
+ 
+-static inline void current_clr_polling(void)
++static inline bool __must_check current_set_polling_and_test(void)
++{
++	__current_set_polling();
++
++	/*
++	 * Polling state must be visible before we test NEED_RESCHED,
++	 * paired by resched_task()
++	 *
++	 * XXX: assumes set/clear bit are identical barrier wise.
++	 */
++	smp_mb__after_clear_bit();
++
++	return unlikely(tif_need_resched());
++}
++
++static inline void __current_clr_polling(void)
+ {
+ 	clear_thread_flag(TIF_POLLING_NRFLAG);
+ }
++
++static inline bool __must_check current_clr_polling_and_test(void)
++{
++	__current_clr_polling();
++
++	/*
++	 * Polling state must be visible before we test NEED_RESCHED,
++	 * paired by resched_task()
++	 */
++	smp_mb__after_clear_bit();
++
++	return unlikely(tif_need_resched());
++}
++
+ #else
+ static inline int tsk_is_polling(struct task_struct *p) { return 0; }
+-static inline void current_set_polling(void) { }
+-static inline void current_clr_polling(void) { }
++static inline void __current_set_polling(void) { }
++static inline void __current_clr_polling(void) { }
++
++static inline bool __must_check current_set_polling_and_test(void)
++{
++	return unlikely(tif_need_resched());
++}
++static inline bool __must_check current_clr_polling_and_test(void)
++{
++	return unlikely(tif_need_resched());
++}
+ #endif
+ 
+ /*
+diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
+index e7e04736802f..4ae6f32c8033 100644
+--- a/include/linux/thread_info.h
++++ b/include/linux/thread_info.h
+@@ -107,6 +107,8 @@ static inline int test_ti_thread_flag(struct thread_info *ti, int flag)
+ #define set_need_resched()	set_thread_flag(TIF_NEED_RESCHED)
+ #define clear_need_resched()	clear_thread_flag(TIF_NEED_RESCHED)
+ 
++#define tif_need_resched() test_thread_flag(TIF_NEED_RESCHED)
++
+ #if defined TIF_RESTORE_SIGMASK && !defined HAVE_SET_RESTORE_SIGMASK
+ /*
+  * An arch can define its own version of set_restore_sigmask() to get the
+diff --git a/ipc/shm.c b/ipc/shm.c
+index d69739610fd4..7a51443a51d6 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -208,15 +208,18 @@ static void shm_open(struct vm_area_struct *vma)
+  */
+ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
+ {
++	struct file *shm_file;
++
++	shm_file = shp->shm_file;
++	shp->shm_file = NULL;
+ 	ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ 	shm_rmid(ns, shp);
+ 	shm_unlock(shp);
+-	if (!is_file_hugepages(shp->shm_file))
+-		shmem_lock(shp->shm_file, 0, shp->mlock_user);
++	if (!is_file_hugepages(shm_file))
++		shmem_lock(shm_file, 0, shp->mlock_user);
+ 	else if (shp->mlock_user)
+-		user_shm_unlock(file_inode(shp->shm_file)->i_size,
+-						shp->mlock_user);
+-	fput (shp->shm_file);
++		user_shm_unlock(file_inode(shm_file)->i_size, shp->mlock_user);
++	fput(shm_file);
+ 	ipc_rcu_putref(shp, shm_rcu_free);
+ }
+ 
+@@ -974,15 +977,25 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
+ 		ipc_lock_object(&shp->shm_perm);
+ 		if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {
+ 			kuid_t euid = current_euid();
+-			err = -EPERM;
+ 			if (!uid_eq(euid, shp->shm_perm.uid) &&
+-			    !uid_eq(euid, shp->shm_perm.cuid))
++			    !uid_eq(euid, shp->shm_perm.cuid)) {
++				err = -EPERM;
+ 				goto out_unlock0;
+-			if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK))
++			}
++			if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK)) {
++				err = -EPERM;
+ 				goto out_unlock0;
++			}
+ 		}
+ 
+ 		shm_file = shp->shm_file;
++
++		/* check if shm_destroy() is tearing down shp */
++		if (shm_file == NULL) {
++			err = -EIDRM;
++			goto out_unlock0;
++		}
++
+ 		if (is_file_hugepages(shm_file))
+ 			goto out_unlock0;
+ 
+@@ -1101,6 +1114,14 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
+ 		goto out_unlock;
+ 
+ 	ipc_lock_object(&shp->shm_perm);
++
++	/* check if shm_destroy() is tearing down shp */
++	if (shp->shm_file == NULL) {
++		ipc_unlock_object(&shp->shm_perm);
++		err = -EIDRM;
++		goto out_unlock;
++	}
++
+ 	path = shp->shm_file->f_path;
+ 	path_get(&path);
+ 	shp->shm_nattch++;
+diff --git a/kernel/cpu/idle.c b/kernel/cpu/idle.c
+index e695c0a0bcb5..c261409500e4 100644
+--- a/kernel/cpu/idle.c
++++ b/kernel/cpu/idle.c
+@@ -44,7 +44,7 @@ static inline int cpu_idle_poll(void)
+ 	rcu_idle_enter();
+ 	trace_cpu_idle_rcuidle(0, smp_processor_id());
+ 	local_irq_enable();
+-	while (!need_resched())
++	while (!tif_need_resched())
+ 		cpu_relax();
+ 	trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id());
+ 	rcu_idle_exit();
+@@ -92,8 +92,7 @@ static void cpu_idle_loop(void)
+ 			if (cpu_idle_force_poll || tick_check_broadcast_expired()) {
+ 				cpu_idle_poll();
+ 			} else {
+-				current_clr_polling();
+-				if (!need_resched()) {
++				if (!current_clr_polling_and_test()) {
+ 					stop_critical_timings();
+ 					rcu_idle_enter();
+ 					arch_cpu_idle();
+@@ -103,7 +102,7 @@ static void cpu_idle_loop(void)
+ 				} else {
+ 					local_irq_enable();
+ 				}
+-				current_set_polling();
++				__current_set_polling();
+ 			}
+ 			arch_cpu_idle_exit();
+ 		}
+@@ -129,7 +128,7 @@ void cpu_startup_entry(enum cpuhp_state state)
+ 	 */
+ 	boot_init_stack_canary();
+ #endif
+-	current_set_polling();
++	__current_set_polling();
+ 	arch_cpu_idle_prepare();
+ 	cpu_idle_loop();
+ }
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index a146ee327f6a..cf021a03019c 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -257,7 +257,8 @@ ok:
+ 	if (task->mm)
+ 		dumpable = get_dumpable(task->mm);
+ 	rcu_read_lock();
+-	if (!dumpable && !ptrace_has_cap(__task_cred(task)->user_ns, mode)) {
++	if (dumpable != SUID_DUMP_USER &&
++	    !ptrace_has_cap(__task_cred(task)->user_ns, mode)) {
+ 		rcu_read_unlock();
+ 		return -EPERM;
+ 	}
+diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
+index 80c36bcf66e8..78e27e3b52ac 100644
+--- a/kernel/trace/trace_event_perf.c
++++ b/kernel/trace/trace_event_perf.c
+@@ -26,7 +26,7 @@ static int perf_trace_event_perm(struct ftrace_event_call *tp_event,
+ {
+ 	/* The ftrace function trace is allowed only for root. */
+ 	if (ftrace_event_is_function(tp_event) &&
+-	    perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
++	    perf_paranoid_tracepoint_raw() && !capable(CAP_SYS_ADMIN))
+ 		return -EPERM;
+ 
+ 	/* No tracing, just counting, so no obvious leak */
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index ecbc4e3d83ad..b5449656a383 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1423,9 +1423,9 @@ call_refreshresult(struct rpc_task *task)
+ 		return;
+ 	case -ETIMEDOUT:
+ 		rpc_delay(task, 3*HZ);
+-	case -EKEYEXPIRED:
+ 	case -EAGAIN:
+ 		status = -EACCES;
++	case -EKEYEXPIRED:
+ 		if (!task->tk_cred_retry)
+ 			break;
+ 		task->tk_cred_retry--;
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index 399433ad614e..a9c3d3cd1990 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -73,7 +73,6 @@ static struct ima_rule_entry default_rules[] = {
+ 	{.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
+-	{.action = DONT_MEASURE,.fsmagic = RAMFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = DEVPTS_SUPER_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = BINFMTFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},

Modified: genpatches-2.6/trunk/3.12/0000_README
===================================================================
--- genpatches-2.6/trunk/3.12/0000_README	2013-11-26 00:34:31 UTC (rev 2594)
+++ genpatches-2.6/trunk/3.12/0000_README	2013-11-29 23:44:29 UTC (rev 2595)
@@ -46,6 +46,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.12.1
 
+Patch:  1001_linux-3.12.2.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.12.2
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.12/1001_linux-3.12.2.patch
===================================================================
--- genpatches-2.6/trunk/3.12/1001_linux-3.12.2.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.12/1001_linux-3.12.2.patch	2013-11-29 23:44:29 UTC (rev 2595)
@@ -0,0 +1,3790 @@
+diff --git a/Makefile b/Makefile
+index eb29ec754a9e..e6e72b629da7 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 12
+-SUBLEVEL = 1
++SUBLEVEL = 2
+ EXTRAVERSION =
+ NAME = One Giant Leap for Frogkind
+ 
+diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
+index b0de86b56c13..cb79a5dd6d96 100644
+--- a/arch/arm/kvm/mmu.c
++++ b/arch/arm/kvm/mmu.c
+@@ -307,6 +307,17 @@ out:
+ 	return err;
+ }
+ 
++static phys_addr_t kvm_kaddr_to_phys(void *kaddr)
++{
++	if (!is_vmalloc_addr(kaddr)) {
++		BUG_ON(!virt_addr_valid(kaddr));
++		return __pa(kaddr);
++	} else {
++		return page_to_phys(vmalloc_to_page(kaddr)) +
++		       offset_in_page(kaddr);
++	}
++}
++
+ /**
+  * create_hyp_mappings - duplicate a kernel virtual address range in Hyp mode
+  * @from:	The virtual kernel start address of the range
+@@ -318,16 +329,27 @@ out:
+  */
+ int create_hyp_mappings(void *from, void *to)
+ {
+-	unsigned long phys_addr = virt_to_phys(from);
++	phys_addr_t phys_addr;
++	unsigned long virt_addr;
+ 	unsigned long start = KERN_TO_HYP((unsigned long)from);
+ 	unsigned long end = KERN_TO_HYP((unsigned long)to);
+ 
+-	/* Check for a valid kernel memory mapping */
+-	if (!virt_addr_valid(from) || !virt_addr_valid(to - 1))
+-		return -EINVAL;
++	start = start & PAGE_MASK;
++	end = PAGE_ALIGN(end);
+ 
+-	return __create_hyp_mappings(hyp_pgd, start, end,
+-				     __phys_to_pfn(phys_addr), PAGE_HYP);
++	for (virt_addr = start; virt_addr < end; virt_addr += PAGE_SIZE) {
++		int err;
++
++		phys_addr = kvm_kaddr_to_phys(from + virt_addr - start);
++		err = __create_hyp_mappings(hyp_pgd, virt_addr,
++					    virt_addr + PAGE_SIZE,
++					    __phys_to_pfn(phys_addr),
++					    PAGE_HYP);
++		if (err)
++			return err;
++	}
++
++	return 0;
+ }
+ 
+ /**
+diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
+index d9ee0ff094d4..3d5db8c83b3c 100644
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -2361,21 +2361,23 @@ static struct device_node *of_dev_hwmod_lookup(struct device_node *np,
+  * Cache the virtual address used by the MPU to access this IP block's
+  * registers.  This address is needed early so the OCP registers that
+  * are part of the device's address space can be ioremapped properly.
+- * No return value.
++ *
++ * Returns 0 on success, -EINVAL if an invalid hwmod is passed, and
++ * -ENXIO on absent or invalid register target address space.
+  */
+-static void __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data)
++static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data)
+ {
+ 	struct omap_hwmod_addr_space *mem;
+ 	void __iomem *va_start = NULL;
+ 	struct device_node *np;
+ 
+ 	if (!oh)
+-		return;
++		return -EINVAL;
+ 
+ 	_save_mpu_port_index(oh);
+ 
+ 	if (oh->_int_flags & _HWMOD_NO_MPU_PORT)
+-		return;
++		return -ENXIO;
+ 
+ 	mem = _find_mpu_rt_addr_space(oh);
+ 	if (!mem) {
+@@ -2384,7 +2386,7 @@ static void __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data)
+ 
+ 		/* Extract the IO space from device tree blob */
+ 		if (!of_have_populated_dt())
+-			return;
++			return -ENXIO;
+ 
+ 		np = of_dev_hwmod_lookup(of_find_node_by_name(NULL, "ocp"), oh);
+ 		if (np)
+@@ -2395,13 +2397,14 @@ static void __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data)
+ 
+ 	if (!va_start) {
+ 		pr_err("omap_hwmod: %s: Could not ioremap\n", oh->name);
+-		return;
++		return -ENXIO;
+ 	}
+ 
+ 	pr_debug("omap_hwmod: %s: MPU register target at va %p\n",
+ 		 oh->name, va_start);
+ 
+ 	oh->_mpu_rt_va = va_start;
++	return 0;
+ }
+ 
+ /**
+@@ -2414,8 +2417,8 @@ static void __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data)
+  * registered at this point.  This is the first of two phases for
+  * hwmod initialization.  Code called here does not touch any hardware
+  * registers, it simply prepares internal data structures.  Returns 0
+- * upon success or if the hwmod isn't registered, or -EINVAL upon
+- * failure.
++ * upon success or if the hwmod isn't registered or if the hwmod's
++ * address space is not defined, or -EINVAL upon failure.
+  */
+ static int __init _init(struct omap_hwmod *oh, void *data)
+ {
+@@ -2424,8 +2427,14 @@ static int __init _init(struct omap_hwmod *oh, void *data)
+ 	if (oh->_state != _HWMOD_STATE_REGISTERED)
+ 		return 0;
+ 
+-	if (oh->class->sysc)
+-		_init_mpu_rt_base(oh, NULL);
++	if (oh->class->sysc) {
++		r = _init_mpu_rt_base(oh, NULL);
++		if (r < 0) {
++			WARN(1, "omap_hwmod: %s: doesn't have mpu register target base\n",
++			     oh->name);
++			return 0;
++		}
++	}
+ 
+ 	r = _init_clocks(oh, NULL);
+ 	if (r < 0) {
+diff --git a/arch/cris/include/asm/io.h b/arch/cris/include/asm/io.h
+index 5d3047e5563b..4353cf239a13 100644
+--- a/arch/cris/include/asm/io.h
++++ b/arch/cris/include/asm/io.h
+@@ -3,6 +3,7 @@
+ 
+ #include <asm/page.h>   /* for __va, __pa */
+ #include <arch/io.h>
++#include <asm-generic/iomap.h>
+ #include <linux/kernel.h>
+ 
+ struct cris_io_operations
+diff --git a/arch/ia64/include/asm/processor.h b/arch/ia64/include/asm/processor.h
+index e0a899a1a8a6..5a84b3a50741 100644
+--- a/arch/ia64/include/asm/processor.h
++++ b/arch/ia64/include/asm/processor.h
+@@ -319,7 +319,7 @@ struct thread_struct {
+ 	regs->loadrs = 0;									\
+ 	regs->r8 = get_dumpable(current->mm);	/* set "don't zap registers" flag */		\
+ 	regs->r12 = new_sp - 16;	/* allocate 16 byte scratch area */			\
+-	if (unlikely(!get_dumpable(current->mm))) {							\
++	if (unlikely(get_dumpable(current->mm) != SUID_DUMP_USER)) {	\
+ 		/*										\
+ 		 * Zap scratch regs to avoid leaking bits between processes with different	\
+ 		 * uid/privileges.								\
+diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
+index 55593ee2d5aa..c766cf575520 100644
+--- a/arch/powerpc/kernel/eeh.c
++++ b/arch/powerpc/kernel/eeh.c
+@@ -687,6 +687,15 @@ void eeh_save_bars(struct eeh_dev *edev)
+ 
+ 	for (i = 0; i < 16; i++)
+ 		eeh_ops->read_config(dn, i * 4, 4, &edev->config_space[i]);
++
++	/*
++	 * For PCI bridges including root port, we need enable bus
++	 * master explicitly. Otherwise, it can't fetch IODA table
++	 * entries correctly. So we cache the bit in advance so that
++	 * we can restore it after reset, either PHB range or PE range.
++	 */
++	if (edev->mode & EEH_DEV_BRIDGE)
++		edev->config_space[1] |= PCI_COMMAND_MASTER;
+ }
+ 
+ /**
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
+index bebdf1a1a540..36d49e6b7c4c 100644
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -457,7 +457,15 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
+ 		if (copy_vsx_to_user(&frame->mc_vsregs, current))
+ 			return 1;
+ 		msr |= MSR_VSX;
+-	}
++	} else if (!ctx_has_vsx_region)
++		/*
++		 * With a small context structure we can't hold the VSX
++		 * registers, hence clear the MSR value to indicate the state
++		 * was not saved.
++		 */
++		msr &= ~MSR_VSX;
++
++
+ #endif /* CONFIG_VSX */
+ #ifdef CONFIG_SPE
+ 	/* save spe registers */
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index 192b051df97e..b3b144121cc9 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -213,8 +213,6 @@ static u64 scan_dispatch_log(u64 stop_tb)
+ 	if (i == be64_to_cpu(vpa->dtl_idx))
+ 		return 0;
+ 	while (i < be64_to_cpu(vpa->dtl_idx)) {
+-		if (dtl_consumer)
+-			dtl_consumer(dtl, i);
+ 		dtb = be64_to_cpu(dtl->timebase);
+ 		tb_delta = be32_to_cpu(dtl->enqueue_to_dispatch_time) +
+ 			be32_to_cpu(dtl->ready_to_enqueue_time);
+@@ -227,6 +225,8 @@ static u64 scan_dispatch_log(u64 stop_tb)
+ 		}
+ 		if (dtb > stop_tb)
+ 			break;
++		if (dtl_consumer)
++			dtl_consumer(dtl, i);
+ 		stolen += tb_delta;
+ 		++i;
+ 		++dtl;
+diff --git a/arch/powerpc/kernel/vio.c b/arch/powerpc/kernel/vio.c
+index d38cc08b16c7..cb92d8204ec7 100644
+--- a/arch/powerpc/kernel/vio.c
++++ b/arch/powerpc/kernel/vio.c
+@@ -1531,12 +1531,12 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
+ 
+ 	dn = dev->of_node;
+ 	if (!dn) {
+-		strcat(buf, "\n");
++		strcpy(buf, "\n");
+ 		return strlen(buf);
+ 	}
+ 	cp = of_get_property(dn, "compatible", NULL);
+ 	if (!cp) {
+-		strcat(buf, "\n");
++		strcpy(buf, "\n");
+ 		return strlen(buf);
+ 	}
+ 
+diff --git a/arch/powerpc/mm/gup.c b/arch/powerpc/mm/gup.c
+index 6936547018b8..c5f734e20b0f 100644
+--- a/arch/powerpc/mm/gup.c
++++ b/arch/powerpc/mm/gup.c
+@@ -123,6 +123,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
+ 	struct mm_struct *mm = current->mm;
+ 	unsigned long addr, len, end;
+ 	unsigned long next;
++	unsigned long flags;
+ 	pgd_t *pgdp;
+ 	int nr = 0;
+ 
+@@ -156,7 +157,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
+ 	 * So long as we atomically load page table pointers versus teardown,
+ 	 * we can follow the address down to the the page and take a ref on it.
+ 	 */
+-	local_irq_disable();
++	local_irq_save(flags);
+ 
+ 	pgdp = pgd_offset(mm, addr);
+ 	do {
+@@ -179,7 +180,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
+ 			break;
+ 	} while (pgdp++, addr = next, addr != end);
+ 
+-	local_irq_enable();
++	local_irq_restore(flags);
+ 
+ 	return nr;
+ }
+diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
+index 3e99c149271a..7ce9cf3b6988 100644
+--- a/arch/powerpc/mm/slice.c
++++ b/arch/powerpc/mm/slice.c
+@@ -258,7 +258,7 @@ static bool slice_scan_available(unsigned long addr,
+ 		slice = GET_HIGH_SLICE_INDEX(addr);
+ 		*boundary_addr = (slice + end) ?
+ 			((slice + end) << SLICE_HIGH_SHIFT) : SLICE_LOW_TOP;
+-		return !!(available.high_slices & (1u << slice));
++		return !!(available.high_slices & (1ul << slice));
+ 	}
+ }
+ 
+diff --git a/arch/powerpc/platforms/512x/mpc512x_shared.c b/arch/powerpc/platforms/512x/mpc512x_shared.c
+index a82a41b4fd91..1a7b1d0f41df 100644
+--- a/arch/powerpc/platforms/512x/mpc512x_shared.c
++++ b/arch/powerpc/platforms/512x/mpc512x_shared.c
+@@ -303,6 +303,9 @@ void __init mpc512x_setup_diu(void)
+ 	diu_ops.release_bootmem		= mpc512x_release_bootmem;
+ }
+ 
++#else
++void __init mpc512x_setup_diu(void) { /* EMPTY */ }
++void __init mpc512x_init_diu(void) { /* EMPTY */ }
+ #endif
+ 
+ void __init mpc512x_init_IRQ(void)
+diff --git a/arch/powerpc/platforms/52xx/Kconfig b/arch/powerpc/platforms/52xx/Kconfig
+index 90f4496017e4..af54174801f7 100644
+--- a/arch/powerpc/platforms/52xx/Kconfig
++++ b/arch/powerpc/platforms/52xx/Kconfig
+@@ -57,5 +57,5 @@ config PPC_MPC5200_BUGFIX
+ 
+ config PPC_MPC5200_LPBFIFO
+ 	tristate "MPC5200 LocalPlus bus FIFO driver"
+-	depends on PPC_MPC52xx
++	depends on PPC_MPC52xx && PPC_BESTCOMM
+ 	select PPC_BESTCOMM_GEN_BD
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 74a5a5773b1f..930e1fe78214 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -153,13 +153,23 @@ static int pnv_ioda_configure_pe(struct pnv_phb *phb, struct pnv_ioda_pe *pe)
+ 		rid_end = pe->rid + 1;
+ 	}
+ 
+-	/* Associate PE in PELT */
++	/*
++	 * Associate PE in PELT. We need add the PE into the
++	 * corresponding PELT-V as well. Otherwise, the error
++	 * originated from the PE might contribute to other
++	 * PEs.
++	 */
+ 	rc = opal_pci_set_pe(phb->opal_id, pe->pe_number, pe->rid,
+ 			     bcomp, dcomp, fcomp, OPAL_MAP_PE);
+ 	if (rc) {
+ 		pe_err(pe, "OPAL error %ld trying to setup PELT table\n", rc);
+ 		return -ENXIO;
+ 	}
++
++	rc = opal_pci_set_peltv(phb->opal_id, pe->pe_number,
++				pe->pe_number, OPAL_ADD_PE_TO_DOMAIN);
++	if (rc)
++		pe_warn(pe, "OPAL error %d adding self to PELTV\n", rc);
+ 	opal_pci_eeh_freeze_clear(phb->opal_id, pe->pe_number,
+ 				  OPAL_EEH_ACTION_CLEAR_FREEZE_ALL);
+ 
+diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
+index b4dbade8ca24..2e4b5be31a1b 100644
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -35,7 +35,6 @@ static u8 *ctrblk;
+ static char keylen_flag;
+ 
+ struct s390_aes_ctx {
+-	u8 iv[AES_BLOCK_SIZE];
+ 	u8 key[AES_MAX_KEY_SIZE];
+ 	long enc;
+ 	long dec;
+@@ -441,30 +440,36 @@ static int cbc_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
+ 	return aes_set_key(tfm, in_key, key_len);
+ }
+ 
+-static int cbc_aes_crypt(struct blkcipher_desc *desc, long func, void *param,
++static int cbc_aes_crypt(struct blkcipher_desc *desc, long func,
+ 			 struct blkcipher_walk *walk)
+ {
++	struct s390_aes_ctx *sctx = crypto_blkcipher_ctx(desc->tfm);
+ 	int ret = blkcipher_walk_virt(desc, walk);
+ 	unsigned int nbytes = walk->nbytes;
++	struct {
++		u8 iv[AES_BLOCK_SIZE];
++		u8 key[AES_MAX_KEY_SIZE];
++	} param;
+ 
+ 	if (!nbytes)
+ 		goto out;
+ 
+-	memcpy(param, walk->iv, AES_BLOCK_SIZE);
++	memcpy(param.iv, walk->iv, AES_BLOCK_SIZE);
++	memcpy(param.key, sctx->key, sctx->key_len);
+ 	do {
+ 		/* only use complete blocks */
+ 		unsigned int n = nbytes & ~(AES_BLOCK_SIZE - 1);
+ 		u8 *out = walk->dst.virt.addr;
+ 		u8 *in = walk->src.virt.addr;
+ 
+-		ret = crypt_s390_kmc(func, param, out, in, n);
++		ret = crypt_s390_kmc(func, &param, out, in, n);
+ 		if (ret < 0 || ret != n)
+ 			return -EIO;
+ 
+ 		nbytes &= AES_BLOCK_SIZE - 1;
+ 		ret = blkcipher_walk_done(desc, walk, nbytes);
+ 	} while ((nbytes = walk->nbytes));
+-	memcpy(walk->iv, param, AES_BLOCK_SIZE);
++	memcpy(walk->iv, param.iv, AES_BLOCK_SIZE);
+ 
+ out:
+ 	return ret;
+@@ -481,7 +486,7 @@ static int cbc_aes_encrypt(struct blkcipher_desc *desc,
+ 		return fallback_blk_enc(desc, dst, src, nbytes);
+ 
+ 	blkcipher_walk_init(&walk, dst, src, nbytes);
+-	return cbc_aes_crypt(desc, sctx->enc, sctx->iv, &walk);
++	return cbc_aes_crypt(desc, sctx->enc, &walk);
+ }
+ 
+ static int cbc_aes_decrypt(struct blkcipher_desc *desc,
+@@ -495,7 +500,7 @@ static int cbc_aes_decrypt(struct blkcipher_desc *desc,
+ 		return fallback_blk_dec(desc, dst, src, nbytes);
+ 
+ 	blkcipher_walk_init(&walk, dst, src, nbytes);
+-	return cbc_aes_crypt(desc, sctx->dec, sctx->iv, &walk);
++	return cbc_aes_crypt(desc, sctx->dec, &walk);
+ }
+ 
+ static struct crypto_alg cbc_aes_alg = {
+diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
+index 819b94d22720..8beee1cceba4 100644
+--- a/arch/s390/include/asm/timex.h
++++ b/arch/s390/include/asm/timex.h
+@@ -71,9 +71,11 @@ static inline void local_tick_enable(unsigned long long comp)
+ 
+ typedef unsigned long long cycles_t;
+ 
+-static inline void get_tod_clock_ext(char *clk)
++static inline void get_tod_clock_ext(char clk[16])
+ {
+-	asm volatile("stcke %0" : "=Q" (*clk) : : "cc");
++	typedef struct { char _[sizeof(clk)]; } addrtype;
++
++	asm volatile("stcke %0" : "=Q" (*(addrtype *) clk) : : "cc");
+ }
+ 
+ static inline unsigned long long get_tod_clock(void)
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index 1a4313a1b60f..93439cd04406 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -929,7 +929,7 @@ static ssize_t show_idle_count(struct device *dev,
+ 		idle_count = ACCESS_ONCE(idle->idle_count);
+ 		if (ACCESS_ONCE(idle->clock_idle_enter))
+ 			idle_count++;
+-	} while ((sequence & 1) || (idle->sequence != sequence));
++	} while ((sequence & 1) || (ACCESS_ONCE(idle->sequence) != sequence));
+ 	return sprintf(buf, "%llu\n", idle_count);
+ }
+ static DEVICE_ATTR(idle_count, 0444, show_idle_count, NULL);
+@@ -947,7 +947,7 @@ static ssize_t show_idle_time(struct device *dev,
+ 		idle_time = ACCESS_ONCE(idle->idle_time);
+ 		idle_enter = ACCESS_ONCE(idle->clock_idle_enter);
+ 		idle_exit = ACCESS_ONCE(idle->clock_idle_exit);
+-	} while ((sequence & 1) || (idle->sequence != sequence));
++	} while ((sequence & 1) || (ACCESS_ONCE(idle->sequence) != sequence));
+ 	idle_time += idle_enter ? ((idle_exit ? : now) - idle_enter) : 0;
+ 	return sprintf(buf, "%llu\n", idle_time >> 12);
+ }
+diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
+index abcfab55f99b..bb06a76040bf 100644
+--- a/arch/s390/kernel/vtime.c
++++ b/arch/s390/kernel/vtime.c
+@@ -191,7 +191,7 @@ cputime64_t s390_get_idle_time(int cpu)
+ 		sequence = ACCESS_ONCE(idle->sequence);
+ 		idle_enter = ACCESS_ONCE(idle->clock_idle_enter);
+ 		idle_exit = ACCESS_ONCE(idle->clock_idle_exit);
+-	} while ((sequence & 1) || (idle->sequence != sequence));
++	} while ((sequence & 1) || (ACCESS_ONCE(idle->sequence) != sequence));
+ 	return idle_enter ? ((idle_exit ?: now) - idle_enter) : 0;
+ }
+ 
+diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
+index e0e0841eef45..18677a90d6a3 100644
+--- a/arch/x86/kernel/crash.c
++++ b/arch/x86/kernel/crash.c
+@@ -127,12 +127,12 @@ void native_machine_crash_shutdown(struct pt_regs *regs)
+ 	cpu_emergency_vmxoff();
+ 	cpu_emergency_svm_disable();
+ 
+-	lapic_shutdown();
+ #ifdef CONFIG_X86_IO_APIC
+ 	/* Prevent crash_kexec() from deadlocking on ioapic_lock. */
+ 	ioapic_zap_locks();
+ 	disable_IO_APIC();
+ #endif
++	lapic_shutdown();
+ #ifdef CONFIG_HPET_TIMER
+ 	hpet_disable();
+ #endif
+diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
+index 42a392a9fd02..d4bdd253fea7 100644
+--- a/arch/x86/kernel/ftrace.c
++++ b/arch/x86/kernel/ftrace.c
+@@ -248,6 +248,15 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
+ 	return ret;
+ }
+ 
++static int is_ftrace_caller(unsigned long ip)
++{
++	if (ip == (unsigned long)(&ftrace_call) ||
++		ip == (unsigned long)(&ftrace_regs_call))
++		return 1;
++
++	return 0;
++}
++
+ /*
+  * A breakpoint was added to the code address we are about to
+  * modify, and this is the handle that will just skip over it.
+@@ -257,10 +266,13 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
+  */
+ int ftrace_int3_handler(struct pt_regs *regs)
+ {
++	unsigned long ip;
++
+ 	if (WARN_ON_ONCE(!regs))
+ 		return 0;
+ 
+-	if (!ftrace_location(regs->ip - 1))
++	ip = regs->ip - 1;
++	if (!ftrace_location(ip) && !is_ftrace_caller(ip))
+ 		return 0;
+ 
+ 	regs->ip += MCOUNT_INSN_SIZE - 1;
+diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
+index af99f71aeb7f..c3d4cc972eca 100644
+--- a/arch/x86/kernel/microcode_amd.c
++++ b/arch/x86/kernel/microcode_amd.c
+@@ -431,7 +431,7 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device,
+ 		snprintf(fw_name, sizeof(fw_name), "amd-ucode/microcode_amd_fam%.2xh.bin", c->x86);
+ 
+ 	if (request_firmware(&fw, (const char *)fw_name, device)) {
+-		pr_err("failed to load file %s\n", fw_name);
++		pr_debug("failed to load file %s\n", fw_name);
+ 		goto out;
+ 	}
+ 
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index c83516be1052..3fb8d95ab8b5 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -391,9 +391,9 @@ static void amd_e400_idle(void)
+ 		 * The switch back from broadcast mode needs to be
+ 		 * called with interrupts disabled.
+ 		 */
+-		 local_irq_disable();
+-		 clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_EXIT, &cpu);
+-		 local_irq_enable();
++		local_irq_disable();
++		clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_EXIT, &cpu);
++		local_irq_enable();
+ 	} else
+ 		default_idle();
+ }
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index 7e920bff99a3..618ce264b237 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -550,6 +550,10 @@ static void native_machine_emergency_restart(void)
+ void native_machine_shutdown(void)
+ {
+ 	/* Stop the cpus and apics */
++#ifdef CONFIG_X86_IO_APIC
++	disable_IO_APIC();
++#endif
++
+ #ifdef CONFIG_SMP
+ 	/*
+ 	 * Stop all of the others. Also disable the local irq to
+@@ -562,10 +566,6 @@ void native_machine_shutdown(void)
+ 
+ 	lapic_shutdown();
+ 
+-#ifdef CONFIG_X86_IO_APIC
+-	disable_IO_APIC();
+-#endif
+-
+ #ifdef CONFIG_HPET_TIMER
+ 	hpet_disable();
+ #endif
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index ddc3f3d2afdb..92e6f4a8ba0e 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -4040,7 +4040,10 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
+ 	case OpMem8:
+ 		ctxt->memop.bytes = 1;
+ 		if (ctxt->memop.type == OP_REG) {
+-			ctxt->memop.addr.reg = decode_register(ctxt, ctxt->modrm_rm, 1);
++			int highbyte_regs = ctxt->rex_prefix == 0;
++
++			ctxt->memop.addr.reg = decode_register(ctxt, ctxt->modrm_rm,
++					       highbyte_regs);
+ 			fetch_register_operand(&ctxt->memop);
+ 		}
+ 		goto mem_common;
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 0a00e4ecf87c..5e00b5a58f6a 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -2227,6 +2227,7 @@ void blk_start_request(struct request *req)
+ 	if (unlikely(blk_bidi_rq(req)))
+ 		req->next_rq->resid_len = blk_rq_bytes(req->next_rq);
+ 
++	BUG_ON(test_bit(REQ_ATOM_COMPLETE, &req->atomic_flags));
+ 	blk_add_timer(req);
+ }
+ EXPORT_SYMBOL(blk_start_request);
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index c50ecf0ea3b1..53309333c2f0 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -144,6 +144,7 @@ void blk_set_stacking_limits(struct queue_limits *lim)
+ 	lim->discard_zeroes_data = 1;
+ 	lim->max_segments = USHRT_MAX;
+ 	lim->max_hw_sectors = UINT_MAX;
++	lim->max_segment_size = UINT_MAX;
+ 	lim->max_sectors = UINT_MAX;
+ 	lim->max_write_same_sectors = UINT_MAX;
+ }
+diff --git a/block/blk-timeout.c b/block/blk-timeout.c
+index 65f103563969..655ba909cd6a 100644
+--- a/block/blk-timeout.c
++++ b/block/blk-timeout.c
+@@ -91,8 +91,8 @@ static void blk_rq_timed_out(struct request *req)
+ 		__blk_complete_request(req);
+ 		break;
+ 	case BLK_EH_RESET_TIMER:
+-		blk_clear_rq_complete(req);
+ 		blk_add_timer(req);
++		blk_clear_rq_complete(req);
+ 		break;
+ 	case BLK_EH_NOT_HANDLED:
+ 		/*
+@@ -174,7 +174,6 @@ void blk_add_timer(struct request *req)
+ 		return;
+ 
+ 	BUG_ON(!list_empty(&req->timeout_list));
+-	BUG_ON(test_bit(REQ_ATOM_COMPLETE, &req->atomic_flags));
+ 
+ 	/*
+ 	 * Some LLDs, like scsi, peek at the timeout to prevent a
+diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
+index c0bb3778f1ae..666f1962a160 100644
+--- a/crypto/ansi_cprng.c
++++ b/crypto/ansi_cprng.c
+@@ -230,11 +230,11 @@ remainder:
+ 	 */
+ 	if (byte_count < DEFAULT_BLK_SZ) {
+ empty_rbuf:
+-		for (; ctx->rand_data_valid < DEFAULT_BLK_SZ;
+-			ctx->rand_data_valid++) {
++		while (ctx->rand_data_valid < DEFAULT_BLK_SZ) {
+ 			*ptr = ctx->rand_data[ctx->rand_data_valid];
+ 			ptr++;
+ 			byte_count--;
++			ctx->rand_data_valid++;
+ 			if (byte_count == 0)
+ 				goto done;
+ 		}
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index a06d98374705..15986f32009e 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -175,9 +175,10 @@ static void start_transaction(struct acpi_ec *ec)
+ static void advance_transaction(struct acpi_ec *ec, u8 status)
+ {
+ 	unsigned long flags;
+-	struct transaction *t = ec->curr;
++	struct transaction *t;
+ 
+ 	spin_lock_irqsave(&ec->lock, flags);
++	t = ec->curr;
+ 	if (!t)
+ 		goto unlock;
+ 	if (t->wlen > t->wi) {
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index d3874f425653..d7e53ea53d6c 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -608,9 +608,12 @@ static void handle_root_bridge_removal(struct acpi_device *device)
+ 	ej_event->device = device;
+ 	ej_event->event = ACPI_NOTIFY_EJECT_REQUEST;
+ 
++	get_device(&device->dev);
+ 	status = acpi_os_hotplug_execute(acpi_bus_hot_remove_device, ej_event);
+-	if (ACPI_FAILURE(status))
++	if (ACPI_FAILURE(status)) {
++		put_device(&device->dev);
+ 		kfree(ej_event);
++	}
+ }
+ 
+ static void _handle_hotplug_event_root(struct work_struct *work)
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index f98dd00b51a9..c7414a545a4f 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -119,17 +119,10 @@ static struct dmi_system_id processor_power_dmi_table[] = {
+  */
+ static void acpi_safe_halt(void)
+ {
+-	current_thread_info()->status &= ~TS_POLLING;
+-	/*
+-	 * TS_POLLING-cleared state must be visible before we
+-	 * test NEED_RESCHED:
+-	 */
+-	smp_mb();
+-	if (!need_resched()) {
++	if (!tif_need_resched()) {
+ 		safe_halt();
+ 		local_irq_disable();
+ 	}
+-	current_thread_info()->status |= TS_POLLING;
+ }
+ 
+ #ifdef ARCH_APICTIMER_STOPS_ON_C3
+@@ -737,6 +730,11 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
+ 	if (unlikely(!pr))
+ 		return -EINVAL;
+ 
++	if (cx->entry_method == ACPI_CSTATE_FFH) {
++		if (current_set_polling_and_test())
++			return -EINVAL;
++	}
++
+ 	lapic_timer_state_broadcast(pr, cx, 1);
+ 	acpi_idle_do_entry(cx);
+ 
+@@ -790,18 +788,9 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
+ 	if (unlikely(!pr))
+ 		return -EINVAL;
+ 
+-	if (cx->entry_method != ACPI_CSTATE_FFH) {
+-		current_thread_info()->status &= ~TS_POLLING;
+-		/*
+-		 * TS_POLLING-cleared state must be visible before we test
+-		 * NEED_RESCHED:
+-		 */
+-		smp_mb();
+-
+-		if (unlikely(need_resched())) {
+-			current_thread_info()->status |= TS_POLLING;
++	if (cx->entry_method == ACPI_CSTATE_FFH) {
++		if (current_set_polling_and_test())
+ 			return -EINVAL;
+-		}
+ 	}
+ 
+ 	/*
+@@ -819,9 +808,6 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
+ 
+ 	sched_clock_idle_wakeup_event(0);
+ 
+-	if (cx->entry_method != ACPI_CSTATE_FFH)
+-		current_thread_info()->status |= TS_POLLING;
+-
+ 	lapic_timer_state_broadcast(pr, cx, 0);
+ 	return index;
+ }
+@@ -858,18 +844,9 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
+ 		}
+ 	}
+ 
+-	if (cx->entry_method != ACPI_CSTATE_FFH) {
+-		current_thread_info()->status &= ~TS_POLLING;
+-		/*
+-		 * TS_POLLING-cleared state must be visible before we test
+-		 * NEED_RESCHED:
+-		 */
+-		smp_mb();
+-
+-		if (unlikely(need_resched())) {
+-			current_thread_info()->status |= TS_POLLING;
++	if (cx->entry_method == ACPI_CSTATE_FFH) {
++		if (current_set_polling_and_test())
+ 			return -EINVAL;
+-		}
+ 	}
+ 
+ 	acpi_unlazy_tlb(smp_processor_id());
+@@ -915,9 +892,6 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
+ 
+ 	sched_clock_idle_wakeup_event(0);
+ 
+-	if (cx->entry_method != ACPI_CSTATE_FFH)
+-		current_thread_info()->status |= TS_POLLING;
+-
+ 	lapic_timer_state_broadcast(pr, cx, 0);
+ 	return index;
+ }
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index fee8a297c7d9..3601738ef6f4 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -331,8 +331,6 @@ static void acpi_scan_bus_device_check(acpi_handle handle, u32 ost_source)
+ 			goto out;
+ 		}
+ 	}
+-	acpi_evaluate_hotplug_ost(handle, ost_source,
+-				  ACPI_OST_SC_INSERT_IN_PROGRESS, NULL);
+ 	error = acpi_bus_scan(handle);
+ 	if (error) {
+ 		acpi_handle_warn(handle, "Namespace scan failure\n");
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index aebcf6355df4..f193285968f8 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -832,7 +832,7 @@ acpi_video_init_brightness(struct acpi_video_device *device)
+ 		for (i = 2; i < br->count; i++)
+ 			if (level_old == br->levels[i])
+ 				break;
+-		if (i == br->count)
++		if (i == br->count || !level)
+ 			level = max_level;
+ 	}
+ 
+diff --git a/drivers/block/brd.c b/drivers/block/brd.c
+index 9bf4371755f2..d91f1a56e861 100644
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -545,7 +545,7 @@ static struct kobject *brd_probe(dev_t dev, int *part, void *data)
+ 
+ 	mutex_lock(&brd_devices_mutex);
+ 	brd = brd_init_one(MINOR(dev) >> part_shift);
+-	kobj = brd ? get_disk(brd->brd_disk) : ERR_PTR(-ENOMEM);
++	kobj = brd ? get_disk(brd->brd_disk) : NULL;
+ 	mutex_unlock(&brd_devices_mutex);
+ 
+ 	*part = 0;
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 40e715531aa6..2f036ca4b6ee 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1741,7 +1741,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data)
+ 	if (err < 0)
+ 		err = loop_add(&lo, MINOR(dev) >> part_shift);
+ 	if (err < 0)
+-		kobj = ERR_PTR(err);
++		kobj = NULL;
+ 	else
+ 		kobj = get_disk(lo->lo_disk);
+ 	mutex_unlock(&loop_index_mutex);
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index f3dfc0a88fdc..d593c99121c3 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1628,7 +1628,6 @@ static struct usb_driver btusb_driver = {
+ #ifdef CONFIG_PM
+ 	.suspend	= btusb_suspend,
+ 	.resume		= btusb_resume,
+-	.reset_resume	= btusb_resume,
+ #endif
+ 	.id_table	= btusb_table,
+ 	.supports_autosuspend = 1,
+diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvc1.c b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvc1.c
+index e5be3ee7f172..71b4283f7fad 100644
+--- a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvc1.c
++++ b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvc1.c
+@@ -587,6 +587,7 @@ nvc1_grctx_init_unk58xx[] = {
+ 	{ 0x405870,   4, 0x04, 0x00000001 },
+ 	{ 0x405a00,   2, 0x04, 0x00000000 },
+ 	{ 0x405a18,   1, 0x04, 0x00000000 },
++	{}
+ };
+ 
+ static struct nvc0_graph_init
+@@ -598,6 +599,7 @@ nvc1_grctx_init_rop[] = {
+ 	{ 0x408904,   1, 0x04, 0x62000001 },
+ 	{ 0x408908,   1, 0x04, 0x00c80929 },
+ 	{ 0x408980,   1, 0x04, 0x0000011d },
++	{}
+ };
+ 
+ static struct nvc0_graph_init
+@@ -671,6 +673,7 @@ nvc1_grctx_init_gpc_0[] = {
+ 	{ 0x419000,   1, 0x04, 0x00000780 },
+ 	{ 0x419004,   2, 0x04, 0x00000000 },
+ 	{ 0x419014,   1, 0x04, 0x00000004 },
++	{}
+ };
+ 
+ static struct nvc0_graph_init
+@@ -717,6 +720,7 @@ nvc1_grctx_init_tpc[] = {
+ 	{ 0x419e98,   1, 0x04, 0x00000000 },
+ 	{ 0x419ee0,   1, 0x04, 0x00011110 },
+ 	{ 0x419f30,  11, 0x04, 0x00000000 },
++	{}
+ };
+ 
+ void
+diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd7.c b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd7.c
+index 438e78410808..c4740d528532 100644
+--- a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd7.c
++++ b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd7.c
+@@ -258,6 +258,7 @@ nvd7_grctx_init_hub[] = {
+ 	nvc0_grctx_init_unk78xx,
+ 	nvc0_grctx_init_unk80xx,
+ 	nvd9_grctx_init_rop,
++	NULL
+ };
+ 
+ struct nvc0_graph_init *
+diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd9.c b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd9.c
+index 818a4751df46..a1102cbf2fdc 100644
+--- a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd9.c
++++ b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnvd9.c
+@@ -466,6 +466,7 @@ nvd9_grctx_init_hub[] = {
+ 	nvc0_grctx_init_unk78xx,
+ 	nvc0_grctx_init_unk80xx,
+ 	nvd9_grctx_init_rop,
++	NULL
+ };
+ 
+ struct nvc0_graph_init *
+diff --git a/drivers/gpu/drm/shmobile/Kconfig b/drivers/gpu/drm/shmobile/Kconfig
+index ca498d151a76..5240690b96c3 100644
+--- a/drivers/gpu/drm/shmobile/Kconfig
++++ b/drivers/gpu/drm/shmobile/Kconfig
+@@ -1,6 +1,7 @@
+ config DRM_SHMOBILE
+ 	tristate "DRM Support for SH Mobile"
+ 	depends on DRM && (ARM || SUPERH)
++	select BACKLIGHT_CLASS_DEVICE
+ 	select DRM_KMS_HELPER
+ 	select DRM_KMS_CMA_HELPER
+ 	select DRM_GEM_CMA_HELPER
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index bbff5f200bef..fa920469bf10 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -203,7 +203,8 @@ static void vmbus_process_rescind_offer(struct work_struct *work)
+ 	struct vmbus_channel *primary_channel;
+ 	struct vmbus_channel_relid_released msg;
+ 
+-	vmbus_device_unregister(channel->device_obj);
++	if (channel->device_obj)
++		vmbus_device_unregister(channel->device_obj);
+ 	memset(&msg, 0, sizeof(struct vmbus_channel_relid_released));
+ 	msg.child_relid = channel->offermsg.child_relid;
+ 	msg.header.msgtype = CHANNELMSG_RELID_RELEASED;
+@@ -216,7 +217,7 @@ static void vmbus_process_rescind_offer(struct work_struct *work)
+ 	} else {
+ 		primary_channel = channel->primary_channel;
+ 		spin_lock_irqsave(&primary_channel->sc_lock, flags);
+-		list_del(&channel->listentry);
++		list_del(&channel->sc_list);
+ 		spin_unlock_irqrestore(&primary_channel->sc_lock, flags);
+ 	}
+ 	free_channel(channel);
+diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
+index cdff74282955..14e36c114d61 100644
+--- a/drivers/hwmon/lm90.c
++++ b/drivers/hwmon/lm90.c
+@@ -278,7 +278,7 @@ static const struct lm90_params lm90_params[] = {
+ 	[max6696] = {
+ 		.flags = LM90_HAVE_EMERGENCY
+ 		  | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3,
+-		.alert_alarms = 0x187c,
++		.alert_alarms = 0x1c7c,
+ 		.max_convrate = 6,
+ 		.reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+ 	},
+@@ -1500,19 +1500,22 @@ static void lm90_alert(struct i2c_client *client, unsigned int flag)
+ 	if ((alarms & 0x7f) == 0 && (alarms2 & 0xfe) == 0) {
+ 		dev_info(&client->dev, "Everything OK\n");
+ 	} else {
+-		if (alarms & 0x61)
++		if ((alarms & 0x61) || (alarms2 & 0x80))
+ 			dev_warn(&client->dev,
+ 				 "temp%d out of range, please check!\n", 1);
+-		if (alarms & 0x1a)
++		if ((alarms & 0x1a) || (alarms2 & 0x20))
+ 			dev_warn(&client->dev,
+ 				 "temp%d out of range, please check!\n", 2);
+ 		if (alarms & 0x04)
+ 			dev_warn(&client->dev,
+ 				 "temp%d diode open, please check!\n", 2);
+ 
+-		if (alarms2 & 0x18)
++		if (alarms2 & 0x5a)
+ 			dev_warn(&client->dev,
+ 				 "temp%d out of range, please check!\n", 3);
++		if (alarms2 & 0x04)
++			dev_warn(&client->dev,
++				 "temp%d diode open, please check!\n", 3);
+ 
+ 		/*
+ 		 * Disable ALERT# output, because these chips don't implement
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index fa6964d8681a..f116d664b473 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -359,7 +359,7 @@ static int intel_idle(struct cpuidle_device *dev,
+ 	if (!(lapic_timer_reliable_states & (1 << (cstate))))
+ 		clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &cpu);
+ 
+-	if (!need_resched()) {
++	if (!current_set_polling_and_test()) {
+ 
+ 		__monitor((void *)&current_thread_info()->flags, 0, 0);
+ 		smp_mb();
+diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
+index 08e70232062f..9188ef5d677e 100644
+--- a/drivers/memstick/core/ms_block.c
++++ b/drivers/memstick/core/ms_block.c
+@@ -401,7 +401,7 @@ again:
+ 			sizeof(struct ms_status_register)))
+ 			return 0;
+ 
+-		msb->state = MSB_RP_RECEIVE_OOB_READ;
++		msb->state = MSB_RP_RECIVE_STATUS_REG;
+ 		return 0;
+ 
+ 	case MSB_RP_RECIVE_STATUS_REG:
+diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
+index 2fc0586ce3bb..9cbd0370ca44 100644
+--- a/drivers/misc/lkdtm.c
++++ b/drivers/misc/lkdtm.c
+@@ -297,6 +297,14 @@ static void do_nothing(void)
+ 	return;
+ }
+ 
++static noinline void corrupt_stack(void)
++{
++	/* Use default char array length that triggers stack protection. */
++	char data[8];
++
++	memset((void *)data, 0, 64);
++}
++
+ static void execute_location(void *dst)
+ {
+ 	void (*func)(void) = dst;
+@@ -327,13 +335,9 @@ static void lkdtm_do_action(enum ctype which)
+ 	case CT_OVERFLOW:
+ 		(void) recursive_loop(0);
+ 		break;
+-	case CT_CORRUPT_STACK: {
+-		/* Make sure the compiler creates and uses an 8 char array. */
+-		volatile char data[8];
+-
+-		memset((void *)data, 0, 64);
++	case CT_CORRUPT_STACK:
++		corrupt_stack();
+ 		break;
+-	}
+ 	case CT_UNALIGNED_LOAD_STORE_WRITE: {
+ 		static u8 data[5] __attribute__((aligned(4))) = {1, 2,
+ 				3, 4, 5};
+diff --git a/drivers/misc/mei/nfc.c b/drivers/misc/mei/nfc.c
+index d0c6907dfd92..994ca4aff1a3 100644
+--- a/drivers/misc/mei/nfc.c
++++ b/drivers/misc/mei/nfc.c
+@@ -485,8 +485,11 @@ int mei_nfc_host_init(struct mei_device *dev)
+ 	if (ndev->cl_info)
+ 		return 0;
+ 
+-	cl_info = mei_cl_allocate(dev);
+-	cl = mei_cl_allocate(dev);
++	ndev->cl_info = mei_cl_allocate(dev);
++	ndev->cl = mei_cl_allocate(dev);
++
++	cl = ndev->cl;
++	cl_info = ndev->cl_info;
+ 
+ 	if (!cl || !cl_info) {
+ 		ret = -ENOMEM;
+@@ -527,10 +530,9 @@ int mei_nfc_host_init(struct mei_device *dev)
+ 
+ 	cl->device_uuid = mei_nfc_guid;
+ 
++
+ 	list_add_tail(&cl->device_link, &dev->device_list);
+ 
+-	ndev->cl_info = cl_info;
+-	ndev->cl = cl;
+ 	ndev->req_id = 1;
+ 
+ 	INIT_WORK(&ndev->init_work, mei_nfc_init);
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index a668cd491cb3..e3fc07cf2f62 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -814,9 +814,6 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota)
+ 			msg_ctrl_save = priv->read_reg(priv,
+ 					C_CAN_IFACE(MSGCTRL_REG, 0));
+ 
+-			if (msg_ctrl_save & IF_MCONT_EOB)
+-				return num_rx_pkts;
+-
+ 			if (msg_ctrl_save & IF_MCONT_MSGLST) {
+ 				c_can_handle_lost_msg_obj(dev, 0, msg_obj);
+ 				num_rx_pkts++;
+@@ -824,6 +821,9 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota)
+ 				continue;
+ 			}
+ 
++			if (msg_ctrl_save & IF_MCONT_EOB)
++				return num_rx_pkts;
++
+ 			if (!(msg_ctrl_save & IF_MCONT_NEWDAT))
+ 				continue;
+ 
+diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
+index 3b9546588240..4b2d5ed62b11 100644
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -1544,9 +1544,9 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
+ 	return 0;
+ }
+ 
+-static void kvaser_usb_get_endpoints(const struct usb_interface *intf,
+-				     struct usb_endpoint_descriptor **in,
+-				     struct usb_endpoint_descriptor **out)
++static int kvaser_usb_get_endpoints(const struct usb_interface *intf,
++				    struct usb_endpoint_descriptor **in,
++				    struct usb_endpoint_descriptor **out)
+ {
+ 	const struct usb_host_interface *iface_desc;
+ 	struct usb_endpoint_descriptor *endpoint;
+@@ -1557,12 +1557,18 @@ static void kvaser_usb_get_endpoints(const struct usb_interface *intf,
+ 	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
+ 		endpoint = &iface_desc->endpoint[i].desc;
+ 
+-		if (usb_endpoint_is_bulk_in(endpoint))
++		if (!*in && usb_endpoint_is_bulk_in(endpoint))
+ 			*in = endpoint;
+ 
+-		if (usb_endpoint_is_bulk_out(endpoint))
++		if (!*out && usb_endpoint_is_bulk_out(endpoint))
+ 			*out = endpoint;
++
++		/* use first bulk endpoint for in and out */
++		if (*in && *out)
++			return 0;
+ 	}
++
++	return -ENODEV;
+ }
+ 
+ static int kvaser_usb_probe(struct usb_interface *intf,
+@@ -1576,8 +1582,8 @@ static int kvaser_usb_probe(struct usb_interface *intf,
+ 	if (!dev)
+ 		return -ENOMEM;
+ 
+-	kvaser_usb_get_endpoints(intf, &dev->bulk_in, &dev->bulk_out);
+-	if (!dev->bulk_in || !dev->bulk_out) {
++	err = kvaser_usb_get_endpoints(intf, &dev->bulk_in, &dev->bulk_out);
++	if (err) {
+ 		dev_err(&intf->dev, "Cannot get usb endpoint(s)");
+ 		return err;
+ 	}
+diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
+index fc95b235e210..6305a5d29db2 100644
+--- a/drivers/net/ethernet/atheros/alx/main.c
++++ b/drivers/net/ethernet/atheros/alx/main.c
+@@ -1389,6 +1389,9 @@ static int alx_resume(struct device *dev)
+ {
+ 	struct pci_dev *pdev = to_pci_dev(dev);
+ 	struct alx_priv *alx = pci_get_drvdata(pdev);
++	struct alx_hw *hw = &alx->hw;
++
++	alx_reset_phy(hw);
+ 
+ 	if (!netif_running(alx->dev))
+ 		return 0;
+diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
+index 668dd27616a0..cc6a0a586f0b 100644
+--- a/drivers/net/wireless/libertas/debugfs.c
++++ b/drivers/net/wireless/libertas/debugfs.c
+@@ -913,7 +913,10 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
+ 	char *p2;
+ 	struct debug_data *d = f->private_data;
+ 
+-	pdata = kmalloc(cnt, GFP_KERNEL);
++	if (cnt == 0)
++		return 0;
++
++	pdata = kmalloc(cnt + 1, GFP_KERNEL);
+ 	if (pdata == NULL)
+ 		return 0;
+ 
+@@ -922,6 +925,7 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
+ 		kfree(pdata);
+ 		return 0;
+ 	}
++	pdata[cnt] = '\0';
+ 
+ 	p0 = pdata;
+ 	for (i = 0; i < num_of_items; i++) {
+diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
+index 88ce656f96cd..14007870302b 100644
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -4461,10 +4461,13 @@ void rt2800_link_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual,
+ 
+ 	vgc = rt2800_get_default_vgc(rt2x00dev);
+ 
+-	if (rt2x00_rt(rt2x00dev, RT5592) && qual->rssi > -65)
+-		vgc += 0x20;
+-	else if (qual->rssi > -80)
+-		vgc += 0x10;
++	if (rt2x00_rt(rt2x00dev, RT5592)) {
++		if (qual->rssi > -65)
++			vgc += 0x20;
++	} else {
++		if (qual->rssi > -80)
++			vgc += 0x10;
++	}
+ 
+ 	rt2800_set_vgc(rt2x00dev, qual, vgc);
+ }
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index 96961b9a395c..4feb35aef990 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -148,6 +148,8 @@ static bool rt2800usb_txstatus_timeout(struct rt2x00_dev *rt2x00dev)
+ 	return false;
+ }
+ 
++#define TXSTATUS_READ_INTERVAL 1000000
++
+ static bool rt2800usb_tx_sta_fifo_read_completed(struct rt2x00_dev *rt2x00dev,
+ 						 int urb_status, u32 tx_status)
+ {
+@@ -176,8 +178,9 @@ static bool rt2800usb_tx_sta_fifo_read_completed(struct rt2x00_dev *rt2x00dev,
+ 		queue_work(rt2x00dev->workqueue, &rt2x00dev->txdone_work);
+ 
+ 	if (rt2800usb_txstatus_pending(rt2x00dev)) {
+-		/* Read register after 250 us */
+-		hrtimer_start(&rt2x00dev->txstatus_timer, ktime_set(0, 250000),
++		/* Read register after 1 ms */
++		hrtimer_start(&rt2x00dev->txstatus_timer,
++			      ktime_set(0, TXSTATUS_READ_INTERVAL),
+ 			      HRTIMER_MODE_REL);
+ 		return false;
+ 	}
+@@ -202,8 +205,9 @@ static void rt2800usb_async_read_tx_status(struct rt2x00_dev *rt2x00dev)
+ 	if (test_and_set_bit(TX_STATUS_READING, &rt2x00dev->flags))
+ 		return;
+ 
+-	/* Read TX_STA_FIFO register after 500 us */
+-	hrtimer_start(&rt2x00dev->txstatus_timer, ktime_set(0, 500000),
++	/* Read TX_STA_FIFO register after 2 ms */
++	hrtimer_start(&rt2x00dev->txstatus_timer,
++		      ktime_set(0, 2*TXSTATUS_READ_INTERVAL),
+ 		      HRTIMER_MODE_REL);
+ }
+ 
+diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
+index 712eea9d398f..f12e909cbb48 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+@@ -181,6 +181,7 @@ static void rt2x00lib_autowakeup(struct work_struct *work)
+ static void rt2x00lib_bc_buffer_iter(void *data, u8 *mac,
+ 				     struct ieee80211_vif *vif)
+ {
++	struct ieee80211_tx_control control = {};
+ 	struct rt2x00_dev *rt2x00dev = data;
+ 	struct sk_buff *skb;
+ 
+@@ -195,7 +196,7 @@ static void rt2x00lib_bc_buffer_iter(void *data, u8 *mac,
+ 	 */
+ 	skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif);
+ 	while (skb) {
+-		rt2x00mac_tx(rt2x00dev->hw, NULL, skb);
++		rt2x00mac_tx(rt2x00dev->hw, &control, skb);
+ 		skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif);
+ 	}
+ }
+diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
+index a0935987fa3a..7f40ab8e1bd8 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
++++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
+@@ -146,7 +146,7 @@ void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length);
+  * @local: frame is not from mac80211
+  */
+ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
+-			       bool local);
++			       struct ieee80211_sta *sta, bool local);
+ 
+ /**
+  * rt2x00queue_update_beacon - Send new beacon from mac80211
+diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
+index f883802f3505..f8cff1f0b6b7 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
+@@ -90,7 +90,7 @@ static int rt2x00mac_tx_rts_cts(struct rt2x00_dev *rt2x00dev,
+ 				  frag_skb->data, data_length, tx_info,
+ 				  (struct ieee80211_rts *)(skb->data));
+ 
+-	retval = rt2x00queue_write_tx_frame(queue, skb, true);
++	retval = rt2x00queue_write_tx_frame(queue, skb, NULL, true);
+ 	if (retval) {
+ 		dev_kfree_skb_any(skb);
+ 		rt2x00_warn(rt2x00dev, "Failed to send RTS/CTS frame\n");
+@@ -151,7 +151,7 @@ void rt2x00mac_tx(struct ieee80211_hw *hw,
+ 			goto exit_fail;
+ 	}
+ 
+-	if (unlikely(rt2x00queue_write_tx_frame(queue, skb, false)))
++	if (unlikely(rt2x00queue_write_tx_frame(queue, skb, control->sta, false)))
+ 		goto exit_fail;
+ 
+ 	/*
+@@ -754,6 +754,9 @@ void rt2x00mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+ 	struct rt2x00_dev *rt2x00dev = hw->priv;
+ 	struct data_queue *queue;
+ 
++	if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
++		return;
++
+ 	tx_queue_for_each(rt2x00dev, queue)
+ 		rt2x00queue_flush_queue(queue, drop);
+ }
+diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
+index 6c8a33b6ee22..66a2db8c260d 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
+@@ -635,7 +635,7 @@ static void rt2x00queue_bar_check(struct queue_entry *entry)
+ }
+ 
+ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
+-			       bool local)
++			       struct ieee80211_sta *sta, bool local)
+ {
+ 	struct ieee80211_tx_info *tx_info;
+ 	struct queue_entry *entry;
+@@ -649,7 +649,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
+ 	 * after that we are free to use the skb->cb array
+ 	 * for our information.
+ 	 */
+-	rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc, NULL);
++	rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc, sta);
+ 
+ 	/*
+ 	 * All information is retrieved from the skb->cb array,
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 03ca6c139f1a..4e86e9767ba6 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -6420,7 +6420,12 @@ static struct ibm_struct brightness_driver_data = {
+ #define TPACPI_ALSA_SHRTNAME "ThinkPad Console Audio Control"
+ #define TPACPI_ALSA_MIXERNAME TPACPI_ALSA_SHRTNAME
+ 
+-static int alsa_index = ~((1 << (SNDRV_CARDS - 3)) - 1); /* last three slots */
++#if SNDRV_CARDS <= 32
++#define DEFAULT_ALSA_IDX		~((1 << (SNDRV_CARDS - 3)) - 1)
++#else
++#define DEFAULT_ALSA_IDX		~((1 << (32 - 3)) - 1)
++#endif
++static int alsa_index = DEFAULT_ALSA_IDX; /* last three slots */
+ static char *alsa_id = "ThinkPadEC";
+ static bool alsa_enable = SNDRV_DEFAULT_ENABLE1;
+ 
+diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
+index d85ac1a9d2c0..fbcd48d0bfc3 100644
+--- a/drivers/scsi/aacraid/commctrl.c
++++ b/drivers/scsi/aacraid/commctrl.c
+@@ -511,7 +511,8 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
+ 		goto cleanup;
+ 	}
+ 
+-	if (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr))) {
++	if ((fibsize < (sizeof(struct user_aac_srb) - sizeof(struct user_sgentry))) ||
++	    (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr)))) {
+ 		rcode = -EINVAL;
+ 		goto cleanup;
+ 	}
+diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
+index 8e76ddca0999..5a5e9c915c25 100644
+--- a/drivers/staging/android/ashmem.c
++++ b/drivers/staging/android/ashmem.c
+@@ -706,7 +706,7 @@ static long ashmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 				.gfp_mask = GFP_KERNEL,
+ 				.nr_to_scan = LONG_MAX,
+ 			};
+-
++			ret = ashmem_shrink_count(&ashmem_shrinker, &sc);
+ 			nodes_setall(sc.nodes_to_scan);
+ 			ashmem_shrink_scan(&ashmem_shrinker, &sc);
+ 		}
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index 1636c7ca57e2..a3af4699eb4d 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -543,7 +543,7 @@ void *comedi_alloc_spriv(struct comedi_subdevice *s, size_t size)
+ {
+ 	s->private = kzalloc(size, GFP_KERNEL);
+ 	if (s->private)
+-		comedi_set_subdevice_runflags(s, ~0, SRF_FREE_SPRIV);
++		s->runflags |= SRF_FREE_SPRIV;
+ 	return s->private;
+ }
+ EXPORT_SYMBOL_GPL(comedi_alloc_spriv);
+@@ -1485,7 +1485,8 @@ static int do_cmd_ioctl(struct comedi_device *dev,
+ 	if (async->cmd.flags & TRIG_WAKE_EOS)
+ 		async->cb_mask |= COMEDI_CB_EOS;
+ 
+-	comedi_set_subdevice_runflags(s, ~0, SRF_USER | SRF_RUNNING);
++	comedi_set_subdevice_runflags(s, SRF_USER | SRF_ERROR | SRF_RUNNING,
++				      SRF_USER | SRF_RUNNING);
+ 
+ 	/* set s->busy _after_ setting SRF_RUNNING flag to avoid race with
+ 	 * comedi_read() or comedi_write() */
+diff --git a/drivers/staging/rtl8188eu/os_dep/os_intfs.c b/drivers/staging/rtl8188eu/os_dep/os_intfs.c
+index 63bc913eba6d..8b2b4a8d1f08 100644
+--- a/drivers/staging/rtl8188eu/os_dep/os_intfs.c
++++ b/drivers/staging/rtl8188eu/os_dep/os_intfs.c
+@@ -707,6 +707,10 @@ int rtw_init_netdev_name(struct net_device *pnetdev, const char *ifname)
+ 	return 0;
+ }
+ 
++static const struct device_type wlan_type = {
++	.name = "wlan",
++};
++
+ struct net_device *rtw_init_netdev(struct adapter *old_padapter)
+ {
+ 	struct adapter *padapter;
+@@ -722,6 +726,7 @@ struct net_device *rtw_init_netdev(struct adapter *old_padapter)
+ 	if (!pnetdev)
+ 		return NULL;
+ 
++	pnetdev->dev.type = &wlan_type;
+ 	padapter = rtw_netdev_priv(pnetdev);
+ 	padapter->pnetdev = pnetdev;
+ 	DBG_88E("register rtw_netdev_ops to netdev_ops\n");
+diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
+index 2c4ed52ca849..012ba15ec490 100644
+--- a/drivers/staging/zram/zram_drv.c
++++ b/drivers/staging/zram/zram_drv.c
+@@ -648,6 +648,9 @@ static ssize_t reset_store(struct device *dev,
+ 	zram = dev_to_zram(dev);
+ 	bdev = bdget_disk(zram->disk, 0);
+ 
++	if (!bdev)
++		return -ENOMEM;
++
+ 	/* Do not reset an active device! */
+ 	if (bdev->bd_holders)
+ 		return -EBUSY;
+@@ -660,8 +663,7 @@ static ssize_t reset_store(struct device *dev,
+ 		return -EINVAL;
+ 
+ 	/* Make sure all pending I/O is finished */
+-	if (bdev)
+-		fsync_bdev(bdev);
++	fsync_bdev(bdev);
+ 
+ 	zram_reset_device(zram, true);
+ 	return len;
+diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
+index f7841d44feda..689433cdef25 100644
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -1790,6 +1790,9 @@ int usb_set_usb2_hardware_lpm(struct usb_device *udev, int enable)
+ 	struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+ 	int ret = -EPERM;
+ 
++	if (enable && !udev->usb2_hw_lpm_allowed)
++		return 0;
++
+ 	if (hcd->driver->set_usb2_hw_lpm) {
+ 		ret = hcd->driver->set_usb2_hw_lpm(hcd, udev, enable);
+ 		if (!ret)
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 879651cb6b45..243c6729c320 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1135,6 +1135,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ 			usb_clear_port_feature(hub->hdev, port1,
+ 					USB_PORT_FEAT_C_ENABLE);
+ 		}
++		if (portchange & USB_PORT_STAT_C_RESET) {
++			need_debounce_delay = true;
++			usb_clear_port_feature(hub->hdev, port1,
++					USB_PORT_FEAT_C_RESET);
++		}
+ 		if ((portchange & USB_PORT_STAT_C_BH_RESET) &&
+ 				hub_is_superspeed(hub->hdev)) {
+ 			need_debounce_delay = true;
+@@ -3954,6 +3959,32 @@ static int hub_set_address(struct usb_device *udev, int devnum)
+ 	return retval;
+ }
+ 
++/*
++ * There are reports of USB 3.0 devices that say they support USB 2.0 Link PM
++ * when they're plugged into a USB 2.0 port, but they don't work when LPM is
++ * enabled.
++ *
++ * Only enable USB 2.0 Link PM if the port is internal (hardwired), or the
++ * device says it supports the new USB 2.0 Link PM errata by setting the BESL
++ * support bit in the BOS descriptor.
++ */
++static void hub_set_initial_usb2_lpm_policy(struct usb_device *udev)
++{
++	int connect_type;
++
++	if (!udev->usb2_hw_lpm_capable)
++		return;
++
++	connect_type = usb_get_hub_port_connect_type(udev->parent,
++			udev->portnum);
++
++	if ((udev->bos->ext_cap->bmAttributes & USB_BESL_SUPPORT) ||
++			connect_type == USB_PORT_CONNECT_TYPE_HARD_WIRED) {
++		udev->usb2_hw_lpm_allowed = 1;
++		usb_set_usb2_hardware_lpm(udev, 1);
++	}
++}
++
+ /* Reset device, (re)assign address, get device descriptor.
+  * Device connection must be stable, no more debouncing needed.
+  * Returns device in USB_STATE_ADDRESS, except on error.
+@@ -4247,6 +4278,7 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
+ 	/* notify HCD that we have a device connected and addressed */
+ 	if (hcd->driver->update_device)
+ 		hcd->driver->update_device(hcd, udev);
++	hub_set_initial_usb2_lpm_policy(udev);
+ fail:
+ 	if (retval) {
+ 		hub_port_disable(hub, port1, 0);
+@@ -5091,6 +5123,12 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
+ 	}
+ 	parent_hub = usb_hub_to_struct_hub(parent_hdev);
+ 
++	/* Disable USB2 hardware LPM.
++	 * It will be re-enabled by the enumeration process.
++	 */
++	if (udev->usb2_hw_lpm_enabled == 1)
++		usb_set_usb2_hardware_lpm(udev, 0);
++
+ 	bos = udev->bos;
+ 	udev->bos = NULL;
+ 
+@@ -5198,6 +5236,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
+ 
+ done:
+ 	/* Now that the alt settings are re-installed, enable LTM and LPM. */
++	usb_set_usb2_hardware_lpm(udev, 1);
+ 	usb_unlocked_enable_lpm(udev);
+ 	usb_enable_ltm(udev);
+ 	usb_release_bos_descriptor(udev);
+diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
+index 6d2c8edb1ffe..ca516ac0f234 100644
+--- a/drivers/usb/core/sysfs.c
++++ b/drivers/usb/core/sysfs.c
+@@ -449,7 +449,7 @@ static ssize_t usb2_hardware_lpm_show(struct device *dev,
+ 	struct usb_device *udev = to_usb_device(dev);
+ 	const char *p;
+ 
+-	if (udev->usb2_hw_lpm_enabled == 1)
++	if (udev->usb2_hw_lpm_allowed == 1)
+ 		p = "enabled";
+ 	else
+ 		p = "disabled";
+@@ -469,8 +469,10 @@ static ssize_t usb2_hardware_lpm_store(struct device *dev,
+ 
+ 	ret = strtobool(buf, &value);
+ 
+-	if (!ret)
++	if (!ret) {
++		udev->usb2_hw_lpm_allowed = value;
+ 		ret = usb_set_usb2_hardware_lpm(udev, value);
++	}
+ 
+ 	usb_unlock_device(udev);
+ 
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 83bcd13622c3..49b8bd063fab 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1693,9 +1693,7 @@ void xhci_free_command(struct xhci_hcd *xhci,
+ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ {
+ 	struct pci_dev	*pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+-	struct dev_info	*dev_info, *next;
+ 	struct xhci_cd  *cur_cd, *next_cd;
+-	unsigned long	flags;
+ 	int size;
+ 	int i, j, num_ports;
+ 
+@@ -1756,13 +1754,6 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ 
+ 	scratchpad_free(xhci);
+ 
+-	spin_lock_irqsave(&xhci->lock, flags);
+-	list_for_each_entry_safe(dev_info, next, &xhci->lpm_failed_devs, list) {
+-		list_del(&dev_info->list);
+-		kfree(dev_info);
+-	}
+-	spin_unlock_irqrestore(&xhci->lock, flags);
+-
+ 	if (!xhci->rh_bw)
+ 		goto no_bw;
+ 
+@@ -2231,7 +2222,6 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
+ 	u32 page_size, temp;
+ 	int i;
+ 
+-	INIT_LIST_HEAD(&xhci->lpm_failed_devs);
+ 	INIT_LIST_HEAD(&xhci->cancel_cmd_list);
+ 
+ 	page_size = xhci_readl(xhci, &xhci->op_regs->page_size);
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 6e0d886bcce5..ed6c186a5393 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4025,133 +4025,6 @@ static int xhci_calculate_usb2_hw_lpm_params(struct usb_device *udev)
+ 	return PORT_BESLD(besld) | PORT_L1_TIMEOUT(l1) | PORT_HIRDM(hirdm);
+ }
+ 
+-static int xhci_usb2_software_lpm_test(struct usb_hcd *hcd,
+-					struct usb_device *udev)
+-{
+-	struct xhci_hcd	*xhci = hcd_to_xhci(hcd);
+-	struct dev_info	*dev_info;
+-	__le32 __iomem	**port_array;
+-	__le32 __iomem	*addr, *pm_addr;
+-	u32		temp, dev_id;
+-	unsigned int	port_num;
+-	unsigned long	flags;
+-	int		hird;
+-	int		ret;
+-
+-	if (hcd->speed == HCD_USB3 || !xhci->sw_lpm_support ||
+-			!udev->lpm_capable)
+-		return -EINVAL;
+-
+-	/* we only support lpm for non-hub device connected to root hub yet */
+-	if (!udev->parent || udev->parent->parent ||
+-			udev->descriptor.bDeviceClass == USB_CLASS_HUB)
+-		return -EINVAL;
+-
+-	spin_lock_irqsave(&xhci->lock, flags);
+-
+-	/* Look for devices in lpm_failed_devs list */
+-	dev_id = le16_to_cpu(udev->descriptor.idVendor) << 16 |
+-			le16_to_cpu(udev->descriptor.idProduct);
+-	list_for_each_entry(dev_info, &xhci->lpm_failed_devs, list) {
+-		if (dev_info->dev_id == dev_id) {
+-			ret = -EINVAL;
+-			goto finish;
+-		}
+-	}
+-
+-	port_array = xhci->usb2_ports;
+-	port_num = udev->portnum - 1;
+-
+-	if (port_num > HCS_MAX_PORTS(xhci->hcs_params1)) {
+-		xhci_dbg(xhci, "invalid port number %d\n", udev->portnum);
+-		ret = -EINVAL;
+-		goto finish;
+-	}
+-
+-	/*
+-	 * Test USB 2.0 software LPM.
+-	 * FIXME: some xHCI 1.0 hosts may implement a new register to set up
+-	 * hardware-controlled USB 2.0 LPM. See section 5.4.11 and 4.23.5.1.1.1
+-	 * in the June 2011 errata release.
+-	 */
+-	xhci_dbg(xhci, "test port %d software LPM\n", port_num);
+-	/*
+-	 * Set L1 Device Slot and HIRD/BESL.
+-	 * Check device's USB 2.0 extension descriptor to determine whether
+-	 * HIRD or BESL shoule be used. See USB2.0 LPM errata.
+-	 */
+-	pm_addr = port_array[port_num] + PORTPMSC;
+-	hird = xhci_calculate_hird_besl(xhci, udev);
+-	temp = PORT_L1DS(udev->slot_id) | PORT_HIRD(hird);
+-	xhci_writel(xhci, temp, pm_addr);
+-
+-	/* Set port link state to U2(L1) */
+-	addr = port_array[port_num];
+-	xhci_set_link_state(xhci, port_array, port_num, XDEV_U2);
+-
+-	/* wait for ACK */
+-	spin_unlock_irqrestore(&xhci->lock, flags);
+-	msleep(10);
+-	spin_lock_irqsave(&xhci->lock, flags);
+-
+-	/* Check L1 Status */
+-	ret = xhci_handshake(xhci, pm_addr,
+-			PORT_L1S_MASK, PORT_L1S_SUCCESS, 125);
+-	if (ret != -ETIMEDOUT) {
+-		/* enter L1 successfully */
+-		temp = xhci_readl(xhci, addr);
+-		xhci_dbg(xhci, "port %d entered L1 state, port status 0x%x\n",
+-				port_num, temp);
+-		ret = 0;
+-	} else {
+-		temp = xhci_readl(xhci, pm_addr);
+-		xhci_dbg(xhci, "port %d software lpm failed, L1 status %d\n",
+-				port_num, temp & PORT_L1S_MASK);
+-		ret = -EINVAL;
+-	}
+-
+-	/* Resume the port */
+-	xhci_set_link_state(xhci, port_array, port_num, XDEV_U0);
+-
+-	spin_unlock_irqrestore(&xhci->lock, flags);
+-	msleep(10);
+-	spin_lock_irqsave(&xhci->lock, flags);
+-
+-	/* Clear PLC */
+-	xhci_test_and_clear_bit(xhci, port_array, port_num, PORT_PLC);
+-
+-	/* Check PORTSC to make sure the device is in the right state */
+-	if (!ret) {
+-		temp = xhci_readl(xhci, addr);
+-		xhci_dbg(xhci, "resumed port %d status 0x%x\n",	port_num, temp);
+-		if (!(temp & PORT_CONNECT) || !(temp & PORT_PE) ||
+-				(temp & PORT_PLS_MASK) != XDEV_U0) {
+-			xhci_dbg(xhci, "port L1 resume fail\n");
+-			ret = -EINVAL;
+-		}
+-	}
+-
+-	if (ret) {
+-		/* Insert dev to lpm_failed_devs list */
+-		xhci_warn(xhci, "device LPM test failed, may disconnect and "
+-				"re-enumerate\n");
+-		dev_info = kzalloc(sizeof(struct dev_info), GFP_ATOMIC);
+-		if (!dev_info) {
+-			ret = -ENOMEM;
+-			goto finish;
+-		}
+-		dev_info->dev_id = dev_id;
+-		INIT_LIST_HEAD(&dev_info->list);
+-		list_add(&dev_info->list, &xhci->lpm_failed_devs);
+-	} else {
+-		xhci_ring_device(xhci, udev->slot_id);
+-	}
+-
+-finish:
+-	spin_unlock_irqrestore(&xhci->lock, flags);
+-	return ret;
+-}
+-
+ int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd,
+ 			struct usb_device *udev, int enable)
+ {
+@@ -4228,7 +4101,7 @@ int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd,
+ 		}
+ 
+ 		pm_val &= ~PORT_HIRD_MASK;
+-		pm_val |= PORT_HIRD(hird) | PORT_RWE;
++		pm_val |= PORT_HIRD(hird) | PORT_RWE | PORT_L1DS(udev->slot_id);
+ 		xhci_writel(xhci, pm_val, pm_addr);
+ 		pm_val = xhci_readl(xhci, pm_addr);
+ 		pm_val |= PORT_HLE;
+@@ -4236,7 +4109,7 @@ int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd,
+ 		/* flush write */
+ 		xhci_readl(xhci, pm_addr);
+ 	} else {
+-		pm_val &= ~(PORT_HLE | PORT_RWE | PORT_HIRD_MASK);
++		pm_val &= ~(PORT_HLE | PORT_RWE | PORT_HIRD_MASK | PORT_L1DS_MASK);
+ 		xhci_writel(xhci, pm_val, pm_addr);
+ 		/* flush write */
+ 		xhci_readl(xhci, pm_addr);
+@@ -4279,24 +4152,26 @@ static int xhci_check_usb2_port_capability(struct xhci_hcd *xhci, int port,
+ int xhci_update_device(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ 	struct xhci_hcd	*xhci = hcd_to_xhci(hcd);
+-	int		ret;
+ 	int		portnum = udev->portnum - 1;
+ 
+-	ret = xhci_usb2_software_lpm_test(hcd, udev);
+-	if (!ret) {
+-		xhci_dbg(xhci, "software LPM test succeed\n");
+-		if (xhci->hw_lpm_support == 1 &&
+-		    xhci_check_usb2_port_capability(xhci, portnum, XHCI_HLC)) {
+-			udev->usb2_hw_lpm_capable = 1;
+-			udev->l1_params.timeout = XHCI_L1_TIMEOUT;
+-			udev->l1_params.besl = XHCI_DEFAULT_BESL;
+-			if (xhci_check_usb2_port_capability(xhci, portnum,
+-							    XHCI_BLC))
+-				udev->usb2_hw_lpm_besl_capable = 1;
+-			ret = xhci_set_usb2_hardware_lpm(hcd, udev, 1);
+-			if (!ret)
+-				udev->usb2_hw_lpm_enabled = 1;
+-		}
++	if (hcd->speed == HCD_USB3 || !xhci->sw_lpm_support ||
++			!udev->lpm_capable)
++		return 0;
++
++	/* we only support lpm for non-hub device connected to root hub yet */
++	if (!udev->parent || udev->parent->parent ||
++			udev->descriptor.bDeviceClass == USB_CLASS_HUB)
++		return 0;
++
++	if (xhci->hw_lpm_support == 1 &&
++			xhci_check_usb2_port_capability(
++				xhci, portnum, XHCI_HLC)) {
++		udev->usb2_hw_lpm_capable = 1;
++		udev->l1_params.timeout = XHCI_L1_TIMEOUT;
++		udev->l1_params.besl = XHCI_DEFAULT_BESL;
++		if (xhci_check_usb2_port_capability(xhci, portnum,
++					XHCI_BLC))
++			udev->usb2_hw_lpm_besl_capable = 1;
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 941d5f59e4dc..ed3a425de8ce 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -383,6 +383,7 @@ struct xhci_op_regs {
+ #define	PORT_RWE		(1 << 3)
+ #define	PORT_HIRD(p)		(((p) & 0xf) << 4)
+ #define	PORT_HIRD_MASK		(0xf << 4)
++#define	PORT_L1DS_MASK		(0xff << 8)
+ #define	PORT_L1DS(p)		(((p) & 0xff) << 8)
+ #define	PORT_HLE		(1 << 16)
+ 
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index cd70cc886171..0d0d11880968 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -1809,6 +1809,7 @@ static void musb_free(struct musb *musb)
+ 			disable_irq_wake(musb->nIrq);
+ 		free_irq(musb->nIrq, musb);
+ 	}
++	cancel_work_sync(&musb->irq_work);
+ 	if (musb->dma_controller)
+ 		dma_controller_destroy(musb->dma_controller);
+ 
+@@ -1946,6 +1947,8 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
+ 		if (status < 0)
+ 			goto fail3;
+ 		status = musb_gadget_setup(musb);
++		if (status)
++			musb_host_cleanup(musb);
+ 		break;
+ 	default:
+ 		dev_err(dev, "unsupported port mode %d\n", musb->port_mode);
+@@ -1972,6 +1975,7 @@ fail5:
+ 
+ fail4:
+ 	musb_gadget_cleanup(musb);
++	musb_host_cleanup(musb);
+ 
+ fail3:
+ 	if (musb->dma_controller)
+diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
+index bd4138d80a48..1edee7906b73 100644
+--- a/drivers/usb/musb/musb_dsps.c
++++ b/drivers/usb/musb/musb_dsps.c
+@@ -121,6 +121,7 @@ struct dsps_glue {
+ 	unsigned long last_timer;    /* last timer data for each instance */
+ };
+ 
++static void dsps_musb_try_idle(struct musb *musb, unsigned long timeout);
+ /**
+  * dsps_musb_enable - enable interrupts
+  */
+@@ -143,6 +144,7 @@ static void dsps_musb_enable(struct musb *musb)
+ 	/* Force the DRVVBUS IRQ so we can start polling for ID change. */
+ 	dsps_writel(reg_base, wrp->coreintr_set,
+ 		    (1 << wrp->drvvbus) << wrp->usb_shift);
++	dsps_musb_try_idle(musb, 0);
+ }
+ 
+ /**
+@@ -171,6 +173,7 @@ static void otg_timer(unsigned long _musb)
+ 	const struct dsps_musb_wrapper *wrp = glue->wrp;
+ 	u8 devctl;
+ 	unsigned long flags;
++	int skip_session = 0;
+ 
+ 	/*
+ 	 * We poll because DSPS IP's won't expose several OTG-critical
+@@ -183,10 +186,12 @@ static void otg_timer(unsigned long _musb)
+ 	spin_lock_irqsave(&musb->lock, flags);
+ 	switch (musb->xceiv->state) {
+ 	case OTG_STATE_A_WAIT_BCON:
+-		devctl &= ~MUSB_DEVCTL_SESSION;
+-		dsps_writeb(musb->mregs, MUSB_DEVCTL, devctl);
++		dsps_writeb(musb->mregs, MUSB_DEVCTL, 0);
++		skip_session = 1;
++		/* fall */
+ 
+-		devctl = dsps_readb(musb->mregs, MUSB_DEVCTL);
++	case OTG_STATE_A_IDLE:
++	case OTG_STATE_B_IDLE:
+ 		if (devctl & MUSB_DEVCTL_BDEVICE) {
+ 			musb->xceiv->state = OTG_STATE_B_IDLE;
+ 			MUSB_DEV_MODE(musb);
+@@ -194,20 +199,15 @@ static void otg_timer(unsigned long _musb)
+ 			musb->xceiv->state = OTG_STATE_A_IDLE;
+ 			MUSB_HST_MODE(musb);
+ 		}
++		if (!(devctl & MUSB_DEVCTL_SESSION) && !skip_session)
++			dsps_writeb(mregs, MUSB_DEVCTL, MUSB_DEVCTL_SESSION);
++		mod_timer(&glue->timer, jiffies + wrp->poll_seconds * HZ);
+ 		break;
+ 	case OTG_STATE_A_WAIT_VFALL:
+ 		musb->xceiv->state = OTG_STATE_A_WAIT_VRISE;
+ 		dsps_writel(musb->ctrl_base, wrp->coreintr_set,
+ 			    MUSB_INTR_VBUSERROR << wrp->usb_shift);
+ 		break;
+-	case OTG_STATE_B_IDLE:
+-		devctl = dsps_readb(mregs, MUSB_DEVCTL);
+-		if (devctl & MUSB_DEVCTL_BDEVICE)
+-			mod_timer(&glue->timer,
+-					jiffies + wrp->poll_seconds * HZ);
+-		else
+-			musb->xceiv->state = OTG_STATE_A_IDLE;
+-		break;
+ 	default:
+ 		break;
+ 	}
+@@ -234,6 +234,9 @@ static void dsps_musb_try_idle(struct musb *musb, unsigned long timeout)
+ 	if (musb->port_mode == MUSB_PORT_MODE_HOST)
+ 		return;
+ 
++	if (!musb->g.dev.driver)
++		return;
++
+ 	if (time_after(glue->last_timer, timeout) &&
+ 				timer_pending(&glue->timer)) {
+ 		dev_dbg(musb->controller,
+diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
+index d1d6b83aabca..9af6bba5eac9 100644
+--- a/drivers/usb/musb/musb_virthub.c
++++ b/drivers/usb/musb/musb_virthub.c
+@@ -220,6 +220,23 @@ int musb_hub_status_data(struct usb_hcd *hcd, char *buf)
+ 	return retval;
+ }
+ 
++static int musb_has_gadget(struct musb *musb)
++{
++	/*
++	 * In host-only mode we start a connection right away. In OTG mode
++	 * we have to wait until we loaded a gadget. We don't really need a
++	 * gadget if we operate as a host but we should not start a session
++	 * as a device without a gadget or else we explode.
++	 */
++#ifdef CONFIG_USB_MUSB_HOST
++	return 1;
++#else
++	if (musb->port_mode == MUSB_PORT_MODE_HOST)
++		return 1;
++	return musb->g.dev.driver != NULL;
++#endif
++}
++
+ int musb_hub_control(
+ 	struct usb_hcd	*hcd,
+ 	u16		typeReq,
+@@ -362,7 +379,7 @@ int musb_hub_control(
+ 			 * initialization logic, e.g. for OTG, or change any
+ 			 * logic relating to VBUS power-up.
+ 			 */
+-			if (!hcd->self.is_b_host)
++			if (!hcd->self.is_b_host && musb_has_gadget(musb))
+ 				musb_start(musb);
+ 			break;
+ 		case USB_PORT_FEAT_RESET:
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index fdf953539c62..e5bdd987b9e8 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -1532,7 +1532,11 @@ static int mos7840_tiocmget(struct tty_struct *tty)
+ 		return -ENODEV;
+ 
+ 	status = mos7840_get_uart_reg(port, MODEM_STATUS_REGISTER, &msr);
++	if (status != 1)
++		return -EIO;
+ 	status = mos7840_get_uart_reg(port, MODEM_CONTROL_REGISTER, &mcr);
++	if (status != 1)
++		return -EIO;
+ 	result = ((mcr & MCR_DTR) ? TIOCM_DTR : 0)
+ 	    | ((mcr & MCR_RTS) ? TIOCM_RTS : 0)
+ 	    | ((mcr & MCR_LOOPBACK) ? TIOCM_LOOP : 0)
+diff --git a/drivers/usb/wusbcore/wa-rpipe.c b/drivers/usb/wusbcore/wa-rpipe.c
+index fd4f1ce6256a..b5e4fc19dec0 100644
+--- a/drivers/usb/wusbcore/wa-rpipe.c
++++ b/drivers/usb/wusbcore/wa-rpipe.c
+@@ -333,7 +333,10 @@ static int rpipe_aim(struct wa_rpipe *rpipe, struct wahc *wa,
+ 	/* FIXME: compute so seg_size > ep->maxpktsize */
+ 	rpipe->descr.wBlocks = cpu_to_le16(16);		/* given */
+ 	/* ep0 maxpktsize is 0x200 (WUSB1.0[4.8.1]) */
+-	rpipe->descr.wMaxPacketSize = cpu_to_le16(ep->desc.wMaxPacketSize);
++	if (usb_endpoint_xfer_isoc(&ep->desc))
++		rpipe->descr.wMaxPacketSize = epcd->wOverTheAirPacketSize;
++	else
++		rpipe->descr.wMaxPacketSize = ep->desc.wMaxPacketSize;
+ 
+ 	rpipe->descr.hwa_bMaxBurst = max(min_t(unsigned int,
+ 				epcd->bMaxBurst, 16U), 1U);
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 4a355726151e..26450d850f14 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -4481,6 +4481,7 @@ int btrfs_reloc_clone_csums(struct inode *inode, u64 file_pos, u64 len)
+ 	struct btrfs_root *root = BTRFS_I(inode)->root;
+ 	int ret;
+ 	u64 disk_bytenr;
++	u64 new_bytenr;
+ 	LIST_HEAD(list);
+ 
+ 	ordered = btrfs_lookup_ordered_extent(inode, file_pos);
+@@ -4492,13 +4493,24 @@ int btrfs_reloc_clone_csums(struct inode *inode, u64 file_pos, u64 len)
+ 	if (ret)
+ 		goto out;
+ 
+-	disk_bytenr = ordered->start;
+ 	while (!list_empty(&list)) {
+ 		sums = list_entry(list.next, struct btrfs_ordered_sum, list);
+ 		list_del_init(&sums->list);
+ 
+-		sums->bytenr = disk_bytenr;
+-		disk_bytenr += sums->len;
++		/*
++		 * We need to offset the new_bytenr based on where the csum is.
++		 * We need to do this because we will read in entire prealloc
++		 * extents but we may have written to say the middle of the
++		 * prealloc extent, so we need to make sure the csum goes with
++		 * the right disk offset.
++		 *
++		 * We can do this because the data reloc inode refers strictly
++		 * to the on disk bytes, so we don't have to worry about
++		 * disk_len vs real len like with real inodes since it's all
++		 * disk length.
++		 */
++		new_bytenr = ordered->start + (sums->bytenr - disk_bytenr);
++		sums->bytenr = new_bytenr;
+ 
+ 		btrfs_add_ordered_sum(inode, ordered, sums);
+ 	}
+diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
+index 277bd1be21fd..511d41546791 100644
+--- a/fs/configfs/dir.c
++++ b/fs/configfs/dir.c
+@@ -56,10 +56,19 @@ static void configfs_d_iput(struct dentry * dentry,
+ 	struct configfs_dirent *sd = dentry->d_fsdata;
+ 
+ 	if (sd) {
+-		BUG_ON(sd->s_dentry != dentry);
+ 		/* Coordinate with configfs_readdir */
+ 		spin_lock(&configfs_dirent_lock);
+-		sd->s_dentry = NULL;
++		/* Coordinate with configfs_attach_attr where will increase
++		 * sd->s_count and update sd->s_dentry to new allocated one.
++		 * Only set sd->dentry to null when this dentry is the only
++		 * sd owner.
++		 * If not do so, configfs_d_iput may run just after
++		 * configfs_attach_attr and set sd->s_dentry to null
++		 * even it's still in use.
++		 */
++		if (atomic_read(&sd->s_count) <= 2)
++			sd->s_dentry = NULL;
++
+ 		spin_unlock(&configfs_dirent_lock);
+ 		configfs_put(sd);
+ 	}
+@@ -426,8 +435,11 @@ static int configfs_attach_attr(struct configfs_dirent * sd, struct dentry * den
+ 	struct configfs_attribute * attr = sd->s_element;
+ 	int error;
+ 
++	spin_lock(&configfs_dirent_lock);
+ 	dentry->d_fsdata = configfs_get(sd);
+ 	sd->s_dentry = dentry;
++	spin_unlock(&configfs_dirent_lock);
++
+ 	error = configfs_create(dentry, (attr->ca_mode & S_IALLUGO) | S_IFREG,
+ 				configfs_init_file);
+ 	if (error) {
+diff --git a/fs/dcache.c b/fs/dcache.c
+index ae6ebb88ceff..89f96719a29b 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -2881,9 +2881,9 @@ static int prepend_path(const struct path *path,
+ 			const struct path *root,
+ 			char **buffer, int *buflen)
+ {
+-	struct dentry *dentry = path->dentry;
+-	struct vfsmount *vfsmnt = path->mnt;
+-	struct mount *mnt = real_mount(vfsmnt);
++	struct dentry *dentry;
++	struct vfsmount *vfsmnt;
++	struct mount *mnt;
+ 	int error = 0;
+ 	unsigned seq = 0;
+ 	char *bptr;
+@@ -2893,6 +2893,9 @@ static int prepend_path(const struct path *path,
+ restart:
+ 	bptr = *buffer;
+ 	blen = *buflen;
++	dentry = path->dentry;
++	vfsmnt = path->mnt;
++	mnt = real_mount(vfsmnt);
+ 	read_seqbegin_or_lock(&rename_lock, &seq);
+ 	while (dentry != root->dentry || vfsmnt != root->mnt) {
+ 		struct dentry * parent;
+diff --git a/fs/exec.c b/fs/exec.c
+index 8875dd10ae7a..bb8afc1d1df4 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1668,6 +1668,12 @@ int __get_dumpable(unsigned long mm_flags)
+ 	return (ret > SUID_DUMP_USER) ? SUID_DUMP_ROOT : ret;
+ }
+ 
++/*
++ * This returns the actual value of the suid_dumpable flag. For things
++ * that are using this for checking for privilege transitions, it must
++ * test against SUID_DUMP_USER rather than treating it as a boolean
++ * value.
++ */
+ int get_dumpable(struct mm_struct *mm)
+ {
+ 	return __get_dumpable(mm->flags);
+diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
+index ced3257f06e8..968d4c56e5eb 100644
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -584,17 +584,17 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
+ 	if (!IS_ERR(inode)) {
+ 		d = d_splice_alias(inode, dentry);
+ 		error = 0;
+-		if (file && !IS_ERR(d)) {
+-			if (d == NULL)
+-				d = dentry;
+-			if (S_ISREG(inode->i_mode))
+-				error = finish_open(file, d, gfs2_open_common, opened);
+-			else
++		if (file) {
++			if (S_ISREG(inode->i_mode)) {
++				WARN_ON(d != NULL);
++				error = finish_open(file, dentry, gfs2_open_common, opened);
++			} else {
+ 				error = finish_no_open(file, d);
++			}
++		} else {
++			dput(d);
+ 		}
+ 		gfs2_glock_dq_uninit(ghs);
+-		if (IS_ERR(d))
+-			return PTR_ERR(d);
+ 		return error;
+ 	} else if (error != -ENOENT) {
+ 		goto fail_gunlock;
+@@ -781,8 +781,10 @@ static struct dentry *__gfs2_lookup(struct inode *dir, struct dentry *dentry,
+ 		error = finish_open(file, dentry, gfs2_open_common, opened);
+ 
+ 	gfs2_glock_dq_uninit(&gh);
+-	if (error)
++	if (error) {
++		dput(d);
+ 		return ERR_PTR(error);
++	}
+ 	return d;
+ }
+ 
+@@ -1163,14 +1165,16 @@ static int gfs2_atomic_open(struct inode *dir, struct dentry *dentry,
+ 	d = __gfs2_lookup(dir, dentry, file, opened);
+ 	if (IS_ERR(d))
+ 		return PTR_ERR(d);
+-	if (d == NULL)
+-		d = dentry;
+-	if (d->d_inode) {
++	if (d != NULL)
++		dentry = d;
++	if (dentry->d_inode) {
+ 		if (!(*opened & FILE_OPENED))
+-			return finish_no_open(file, d);
++			return finish_no_open(file, dentry);
++		dput(d);
+ 		return 0;
+ 	}
+ 
++	BUG_ON(d != NULL);
+ 	if (!(flags & O_CREAT))
+ 		return -ENOENT;
+ 
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index d53d6785cba2..3b115653d422 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1318,21 +1318,14 @@ _nfs4_opendata_reclaim_to_nfs4_state(struct nfs4_opendata *data)
+ 	int ret;
+ 
+ 	if (!data->rpc_done) {
+-		ret = data->rpc_status;
+-		goto err;
++		if (data->rpc_status) {
++			ret = data->rpc_status;
++			goto err;
++		}
++		/* cached opens have already been processed */
++		goto update;
+ 	}
+ 
+-	ret = -ESTALE;
+-	if (!(data->f_attr.valid & NFS_ATTR_FATTR_TYPE) ||
+-	    !(data->f_attr.valid & NFS_ATTR_FATTR_FILEID) ||
+-	    !(data->f_attr.valid & NFS_ATTR_FATTR_CHANGE))
+-		goto err;
+-
+-	ret = -ENOMEM;
+-	state = nfs4_get_open_state(inode, data->owner);
+-	if (state == NULL)
+-		goto err;
+-
+ 	ret = nfs_refresh_inode(inode, &data->f_attr);
+ 	if (ret)
+ 		goto err;
+@@ -1341,8 +1334,10 @@ _nfs4_opendata_reclaim_to_nfs4_state(struct nfs4_opendata *data)
+ 
+ 	if (data->o_res.delegation_type != 0)
+ 		nfs4_opendata_check_deleg(data, state);
++update:
+ 	update_open_stateid(state, &data->o_res.stateid, NULL,
+ 			    data->o_arg.fmode);
++	atomic_inc(&state->count);
+ 
+ 	return state;
+ err:
+@@ -4575,7 +4570,7 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf,
+ 	struct nfs4_label label = {0, 0, buflen, buf};
+ 
+ 	u32 bitmask[3] = { 0, 0, FATTR4_WORD2_SECURITY_LABEL };
+-	struct nfs4_getattr_arg args = {
++	struct nfs4_getattr_arg arg = {
+ 		.fh		= NFS_FH(inode),
+ 		.bitmask	= bitmask,
+ 	};
+@@ -4586,14 +4581,14 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf,
+ 	};
+ 	struct rpc_message msg = {
+ 		.rpc_proc	= &nfs4_procedures[NFSPROC4_CLNT_GETATTR],
+-		.rpc_argp	= &args,
++		.rpc_argp	= &arg,
+ 		.rpc_resp	= &res,
+ 	};
+ 	int ret;
+ 
+ 	nfs_fattr_init(&fattr);
+ 
+-	ret = rpc_call_sync(server->client, &msg, 0);
++	ret = nfs4_call_sync(server->client, server, &msg, &arg.seq_args, &res.seq_res, 0);
+ 	if (ret)
+ 		return ret;
+ 	if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL))
+@@ -4630,7 +4625,7 @@ static int _nfs4_do_set_security_label(struct inode *inode,
+ 	struct iattr sattr = {0};
+ 	struct nfs_server *server = NFS_SERVER(inode);
+ 	const u32 bitmask[3] = { 0, 0, FATTR4_WORD2_SECURITY_LABEL };
+-	struct nfs_setattrargs args = {
++	struct nfs_setattrargs arg = {
+ 		.fh             = NFS_FH(inode),
+ 		.iap            = &sattr,
+ 		.server		= server,
+@@ -4644,14 +4639,14 @@ static int _nfs4_do_set_security_label(struct inode *inode,
+ 	};
+ 	struct rpc_message msg = {
+ 		.rpc_proc       = &nfs4_procedures[NFSPROC4_CLNT_SETATTR],
+-		.rpc_argp       = &args,
++		.rpc_argp       = &arg,
+ 		.rpc_resp       = &res,
+ 	};
+ 	int status;
+ 
+-	nfs4_stateid_copy(&args.stateid, &zero_stateid);
++	nfs4_stateid_copy(&arg.stateid, &zero_stateid);
+ 
+-	status = rpc_call_sync(server->client, &msg, 0);
++	status = nfs4_call_sync(server->client, server, &msg, &arg.seq_args, &res.seq_res, 1);
+ 	if (status)
+ 		dprintk("%s failed: %d\n", __func__, status);
+ 
+@@ -5106,6 +5101,7 @@ static int _nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock
+ 			status = 0;
+ 	}
+ 	request->fl_ops->fl_release_private(request);
++	request->fl_ops = NULL;
+ out:
+ 	return status;
+ }
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index cc14cbb78b73..ebced8d71157 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1422,7 +1422,7 @@ restart:
+ 		if (status >= 0) {
+ 			status = nfs4_reclaim_locks(state, ops);
+ 			if (status >= 0) {
+-				if (test_bit(NFS_DELEGATED_STATE, &state->flags) != 0) {
++				if (!test_bit(NFS_DELEGATED_STATE, &state->flags)) {
+ 					spin_lock(&state->state_lock);
+ 					list_for_each_entry(lock, &state->lock_states, ls_locks) {
+ 						if (!test_bit(NFS_LOCK_INITIALIZED, &lock->ls_flags))
+@@ -1881,10 +1881,15 @@ again:
+ 			nfs4_root_machine_cred(clp);
+ 			goto again;
+ 		}
+-		if (i > 2)
++		if (clnt->cl_auth->au_flavor == RPC_AUTH_UNIX)
+ 			break;
+ 	case -NFS4ERR_CLID_INUSE:
+ 	case -NFS4ERR_WRONGSEC:
++		/* No point in retrying if we already used RPC_AUTH_UNIX */
++		if (clnt->cl_auth->au_flavor == RPC_AUTH_UNIX) {
++			status = -EPERM;
++			break;
++		}
+ 		clnt = rpc_clone_client_set_auth(clnt, RPC_AUTH_UNIX);
+ 		if (IS_ERR(clnt)) {
+ 			status = PTR_ERR(clnt);
+diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
+index 5f38ea36e266..af51cf9bf2e3 100644
+--- a/fs/nfsd/export.c
++++ b/fs/nfsd/export.c
+@@ -536,16 +536,12 @@ static int svc_export_parse(struct cache_detail *cd, char *mesg, int mlen)
+ 		if (err)
+ 			goto out3;
+ 		exp.ex_anon_uid= make_kuid(&init_user_ns, an_int);
+-		if (!uid_valid(exp.ex_anon_uid))
+-			goto out3;
+ 
+ 		/* anon gid */
+ 		err = get_int(&mesg, &an_int);
+ 		if (err)
+ 			goto out3;
+ 		exp.ex_anon_gid= make_kgid(&init_user_ns, an_int);
+-		if (!gid_valid(exp.ex_anon_gid))
+-			goto out3;
+ 
+ 		/* fsid */
+ 		err = get_int(&mesg, &an_int);
+@@ -583,6 +579,17 @@ static int svc_export_parse(struct cache_detail *cd, char *mesg, int mlen)
+ 				   exp.ex_uuid);
+ 		if (err)
+ 			goto out4;
++		/*
++		 * For some reason exportfs has been passing down an
++		 * invalid (-1) uid & gid on the "dummy" export which it
++		 * uses to test export support.  To make sure exportfs
++		 * sees errors from check_export we therefore need to
++		 * delay these checks till after check_export:
++		 */
++		if (!uid_valid(exp.ex_anon_uid))
++			goto out4;
++		if (!gid_valid(exp.ex_anon_gid))
++			goto out4;
+ 	}
+ 
+ 	expp = svc_export_lookup(&exp);
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index d9454fe5653f..ecc735e30bea 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -141,8 +141,8 @@ xdr_error:					\
+ 
+ static void next_decode_page(struct nfsd4_compoundargs *argp)
+ {
+-	argp->pagelist++;
+ 	argp->p = page_address(argp->pagelist[0]);
++	argp->pagelist++;
+ 	if (argp->pagelen < PAGE_SIZE) {
+ 		argp->end = argp->p + (argp->pagelen>>2);
+ 		argp->pagelen = 0;
+@@ -411,6 +411,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
+ 		label->data = kzalloc(dummy32 + 1, GFP_KERNEL);
+ 		if (!label->data)
+ 			return nfserr_jukebox;
++		label->len = dummy32;
+ 		defer_free(argp, kfree, label->data);
+ 		memcpy(label->data, buf, dummy32);
+ 	}
+@@ -1208,6 +1209,7 @@ nfsd4_decode_write(struct nfsd4_compoundargs *argp, struct nfsd4_write *write)
+ 		len -= pages * PAGE_SIZE;
+ 
+ 		argp->p = (__be32 *)page_address(argp->pagelist[0]);
++		argp->pagelist++;
+ 		argp->end = argp->p + XDR_QUADLEN(PAGE_SIZE);
+ 	}
+ 	argp->p += XDR_QUADLEN(len);
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index c827acb0e943..72cb28e73ca0 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -298,41 +298,12 @@ commit_metadata(struct svc_fh *fhp)
+ }
+ 
+ /*
+- * Set various file attributes.
+- * N.B. After this call fhp needs an fh_put
++ * Go over the attributes and take care of the small differences between
++ * NFS semantics and what Linux expects.
+  */
+-__be32
+-nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+-	     int check_guard, time_t guardtime)
++static void
++nfsd_sanitize_attrs(struct inode *inode, struct iattr *iap)
+ {
+-	struct dentry	*dentry;
+-	struct inode	*inode;
+-	int		accmode = NFSD_MAY_SATTR;
+-	umode_t		ftype = 0;
+-	__be32		err;
+-	int		host_err;
+-	int		size_change = 0;
+-
+-	if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
+-		accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
+-	if (iap->ia_valid & ATTR_SIZE)
+-		ftype = S_IFREG;
+-
+-	/* Get inode */
+-	err = fh_verify(rqstp, fhp, ftype, accmode);
+-	if (err)
+-		goto out;
+-
+-	dentry = fhp->fh_dentry;
+-	inode = dentry->d_inode;
+-
+-	/* Ignore any mode updates on symlinks */
+-	if (S_ISLNK(inode->i_mode))
+-		iap->ia_valid &= ~ATTR_MODE;
+-
+-	if (!iap->ia_valid)
+-		goto out;
+-
+ 	/*
+ 	 * NFSv2 does not differentiate between "set-[ac]time-to-now"
+ 	 * which only requires access, and "set-[ac]time-to-X" which
+@@ -342,8 +313,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+ 	 * convert to "set to now" instead of "set to explicit time"
+ 	 *
+ 	 * We only call inode_change_ok as the last test as technically
+-	 * it is not an interface that we should be using.  It is only
+-	 * valid if the filesystem does not define it's own i_op->setattr.
++	 * it is not an interface that we should be using.
+ 	 */
+ #define BOTH_TIME_SET (ATTR_ATIME_SET | ATTR_MTIME_SET)
+ #define	MAX_TOUCH_TIME_ERROR (30*60)
+@@ -369,30 +339,6 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+ 			iap->ia_valid &= ~BOTH_TIME_SET;
+ 		}
+ 	}
+-	    
+-	/*
+-	 * The size case is special.
+-	 * It changes the file as well as the attributes.
+-	 */
+-	if (iap->ia_valid & ATTR_SIZE) {
+-		if (iap->ia_size < inode->i_size) {
+-			err = nfsd_permission(rqstp, fhp->fh_export, dentry,
+-					NFSD_MAY_TRUNC|NFSD_MAY_OWNER_OVERRIDE);
+-			if (err)
+-				goto out;
+-		}
+-
+-		host_err = get_write_access(inode);
+-		if (host_err)
+-			goto out_nfserr;
+-
+-		size_change = 1;
+-		host_err = locks_verify_truncate(inode, NULL, iap->ia_size);
+-		if (host_err) {
+-			put_write_access(inode);
+-			goto out_nfserr;
+-		}
+-	}
+ 
+ 	/* sanitize the mode change */
+ 	if (iap->ia_valid & ATTR_MODE) {
+@@ -415,32 +361,111 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+ 			iap->ia_valid |= (ATTR_KILL_SUID | ATTR_KILL_SGID);
+ 		}
+ 	}
++}
+ 
+-	/* Change the attributes. */
++static __be32
++nfsd_get_write_access(struct svc_rqst *rqstp, struct svc_fh *fhp,
++		struct iattr *iap)
++{
++	struct inode *inode = fhp->fh_dentry->d_inode;
++	int host_err;
+ 
+-	iap->ia_valid |= ATTR_CTIME;
++	if (iap->ia_size < inode->i_size) {
++		__be32 err;
+ 
+-	err = nfserr_notsync;
+-	if (!check_guard || guardtime == inode->i_ctime.tv_sec) {
+-		host_err = nfsd_break_lease(inode);
+-		if (host_err)
+-			goto out_nfserr;
+-		fh_lock(fhp);
++		err = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
++				NFSD_MAY_TRUNC | NFSD_MAY_OWNER_OVERRIDE);
++		if (err)
++			return err;
++	}
+ 
+-		host_err = notify_change(dentry, iap);
+-		err = nfserrno(host_err);
+-		fh_unlock(fhp);
++	host_err = get_write_access(inode);
++	if (host_err)
++		goto out_nfserrno;
++
++	host_err = locks_verify_truncate(inode, NULL, iap->ia_size);
++	if (host_err)
++		goto out_put_write_access;
++	return 0;
++
++out_put_write_access:
++	put_write_access(inode);
++out_nfserrno:
++	return nfserrno(host_err);
++}
++
++/*
++ * Set various file attributes.  After this call fhp needs an fh_put.
++ */
++__be32
++nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
++	     int check_guard, time_t guardtime)
++{
++	struct dentry	*dentry;
++	struct inode	*inode;
++	int		accmode = NFSD_MAY_SATTR;
++	umode_t		ftype = 0;
++	__be32		err;
++	int		host_err;
++	int		size_change = 0;
++
++	if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
++		accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
++	if (iap->ia_valid & ATTR_SIZE)
++		ftype = S_IFREG;
++
++	/* Get inode */
++	err = fh_verify(rqstp, fhp, ftype, accmode);
++	if (err)
++		goto out;
++
++	dentry = fhp->fh_dentry;
++	inode = dentry->d_inode;
++
++	/* Ignore any mode updates on symlinks */
++	if (S_ISLNK(inode->i_mode))
++		iap->ia_valid &= ~ATTR_MODE;
++
++	if (!iap->ia_valid)
++		goto out;
++
++	nfsd_sanitize_attrs(inode, iap);
++
++	/*
++	 * The size case is special, it changes the file in addition to the
++	 * attributes.
++	 */
++	if (iap->ia_valid & ATTR_SIZE) {
++		err = nfsd_get_write_access(rqstp, fhp, iap);
++		if (err)
++			goto out;
++		size_change = 1;
+ 	}
++
++	iap->ia_valid |= ATTR_CTIME;
++
++	if (check_guard && guardtime != inode->i_ctime.tv_sec) {
++		err = nfserr_notsync;
++		goto out_put_write_access;
++	}
++
++	host_err = nfsd_break_lease(inode);
++	if (host_err)
++		goto out_put_write_access_nfserror;
++
++	fh_lock(fhp);
++	host_err = notify_change(dentry, iap);
++	fh_unlock(fhp);
++
++out_put_write_access_nfserror:
++	err = nfserrno(host_err);
++out_put_write_access:
+ 	if (size_change)
+ 		put_write_access(inode);
+ 	if (!err)
+ 		commit_metadata(fhp);
+ out:
+ 	return err;
+-
+-out_nfserr:
+-	err = nfserrno(host_err);
+-	goto out;
+ }
+ 
+ #if defined(CONFIG_NFSD_V2_ACL) || \
+diff --git a/fs/xfs/xfs_sb.c b/fs/xfs/xfs_sb.c
+index a5b59d92eb70..039708122038 100644
+--- a/fs/xfs/xfs_sb.c
++++ b/fs/xfs/xfs_sb.c
+@@ -596,6 +596,11 @@ xfs_sb_verify(
+  * single bit error could clear the feature bit and unused parts of the
+  * superblock are supposed to be zero. Hence a non-null crc field indicates that
+  * we've potentially lost a feature bit and we should check it anyway.
++ *
++ * However, past bugs (i.e. in growfs) left non-zeroed regions beyond the
++ * last field in V4 secondary superblocks.  So for secondary superblocks,
++ * we are more forgiving, and ignore CRC failures if the primary doesn't
++ * indicate that the fs version is V5.
+  */
+ static void
+ xfs_sb_read_verify(
+@@ -616,8 +621,12 @@ xfs_sb_read_verify(
+ 
+ 		if (!xfs_verify_cksum(bp->b_addr, be16_to_cpu(dsb->sb_sectsize),
+ 				      offsetof(struct xfs_sb, sb_crc))) {
+-			error = EFSCORRUPTED;
+-			goto out_error;
++			/* Only fail bad secondaries on a known V5 filesystem */
++			if (bp->b_bn != XFS_SB_DADDR &&
++			    xfs_sb_version_hascrc(&mp->m_sb)) {
++				error = EFSCORRUPTED;
++				goto out_error;
++			}
+ 		}
+ 	}
+ 	error = xfs_sb_verify(bp, true);
+diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
+index e8112ae50531..7554fd410bcc 100644
+--- a/include/linux/binfmts.h
++++ b/include/linux/binfmts.h
+@@ -99,9 +99,6 @@ extern void setup_new_exec(struct linux_binprm * bprm);
+ extern void would_dump(struct linux_binprm *, struct file *);
+ 
+ extern int suid_dumpable;
+-#define SUID_DUMP_DISABLE	0	/* No setuid dumping */
+-#define SUID_DUMP_USER		1	/* Dump as user of process */
+-#define SUID_DUMP_ROOT		2	/* Dump as root */
+ 
+ /* Stack area protections */
+ #define EXSTACK_DEFAULT   0	/* Whatever the arch defaults to */
+diff --git a/include/linux/nfs4.h b/include/linux/nfs4.h
+index e36dee52f224..3859ddbecb5f 100644
+--- a/include/linux/nfs4.h
++++ b/include/linux/nfs4.h
+@@ -395,7 +395,7 @@ enum lock_type4 {
+ #define FATTR4_WORD1_FS_LAYOUT_TYPES    (1UL << 30)
+ #define FATTR4_WORD2_LAYOUT_BLKSIZE     (1UL << 1)
+ #define FATTR4_WORD2_MDSTHRESHOLD       (1UL << 4)
+-#define FATTR4_WORD2_SECURITY_LABEL     (1UL << 17)
++#define FATTR4_WORD2_SECURITY_LABEL     (1UL << 16)
+ 
+ /* MDS threshold bitmap bits */
+ #define THRESHOLD_RD                    (1UL << 0)
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index e27baeeda3f4..b1e963efbde8 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -322,6 +322,10 @@ static inline void arch_pick_mmap_layout(struct mm_struct *mm) {}
+ extern void set_dumpable(struct mm_struct *mm, int value);
+ extern int get_dumpable(struct mm_struct *mm);
+ 
++#define SUID_DUMP_DISABLE	0	/* No setuid dumping */
++#define SUID_DUMP_USER		1	/* Dump as user of process */
++#define SUID_DUMP_ROOT		2	/* Dump as root */
++
+ /* mm flags */
+ /* dumpable bits */
+ #define MMF_DUMPABLE      0  /* core dump is permitted */
+@@ -2474,34 +2478,98 @@ static inline int tsk_is_polling(struct task_struct *p)
+ {
+ 	return task_thread_info(p)->status & TS_POLLING;
+ }
+-static inline void current_set_polling(void)
++static inline void __current_set_polling(void)
+ {
+ 	current_thread_info()->status |= TS_POLLING;
+ }
+ 
+-static inline void current_clr_polling(void)
++static inline bool __must_check current_set_polling_and_test(void)
++{
++	__current_set_polling();
++
++	/*
++	 * Polling state must be visible before we test NEED_RESCHED,
++	 * paired by resched_task()
++	 */
++	smp_mb();
++
++	return unlikely(tif_need_resched());
++}
++
++static inline void __current_clr_polling(void)
+ {
+ 	current_thread_info()->status &= ~TS_POLLING;
+-	smp_mb__after_clear_bit();
++}
++
++static inline bool __must_check current_clr_polling_and_test(void)
++{
++	__current_clr_polling();
++
++	/*
++	 * Polling state must be visible before we test NEED_RESCHED,
++	 * paired by resched_task()
++	 */
++	smp_mb();
++
++	return unlikely(tif_need_resched());
+ }
+ #elif defined(TIF_POLLING_NRFLAG)
+ static inline int tsk_is_polling(struct task_struct *p)
+ {
+ 	return test_tsk_thread_flag(p, TIF_POLLING_NRFLAG);
+ }
+-static inline void current_set_polling(void)
++
++static inline void __current_set_polling(void)
+ {
+ 	set_thread_flag(TIF_POLLING_NRFLAG);
+ }
+ 
+-static inline void current_clr_polling(void)
++static inline bool __must_check current_set_polling_and_test(void)
++{
++	__current_set_polling();
++
++	/*
++	 * Polling state must be visible before we test NEED_RESCHED,
++	 * paired by resched_task()
++	 *
++	 * XXX: assumes set/clear bit are identical barrier wise.
++	 */
++	smp_mb__after_clear_bit();
++
++	return unlikely(tif_need_resched());
++}
++
++static inline void __current_clr_polling(void)
+ {
+ 	clear_thread_flag(TIF_POLLING_NRFLAG);
+ }
++
++static inline bool __must_check current_clr_polling_and_test(void)
++{
++	__current_clr_polling();
++
++	/*
++	 * Polling state must be visible before we test NEED_RESCHED,
++	 * paired by resched_task()
++	 */
++	smp_mb__after_clear_bit();
++
++	return unlikely(tif_need_resched());
++}
++
+ #else
+ static inline int tsk_is_polling(struct task_struct *p) { return 0; }
+-static inline void current_set_polling(void) { }
+-static inline void current_clr_polling(void) { }
++static inline void __current_set_polling(void) { }
++static inline void __current_clr_polling(void) { }
++
++static inline bool __must_check current_set_polling_and_test(void)
++{
++	return unlikely(tif_need_resched());
++}
++static inline bool __must_check current_clr_polling_and_test(void)
++{
++	return unlikely(tif_need_resched());
++}
+ #endif
+ 
+ /*
+diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
+index e7e04736802f..4ae6f32c8033 100644
+--- a/include/linux/thread_info.h
++++ b/include/linux/thread_info.h
+@@ -107,6 +107,8 @@ static inline int test_ti_thread_flag(struct thread_info *ti, int flag)
+ #define set_need_resched()	set_thread_flag(TIF_NEED_RESCHED)
+ #define clear_need_resched()	clear_thread_flag(TIF_NEED_RESCHED)
+ 
++#define tif_need_resched() test_thread_flag(TIF_NEED_RESCHED)
++
+ #if defined TIF_RESTORE_SIGMASK && !defined HAVE_SET_RESTORE_SIGMASK
+ /*
+  * An arch can define its own version of set_restore_sigmask() to get the
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 001629cd1a97..39cfa0aca91f 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -475,7 +475,8 @@ struct usb3_lpm_parameters {
+  * @lpm_capable: device supports LPM
+  * @usb2_hw_lpm_capable: device can perform USB2 hardware LPM
+  * @usb2_hw_lpm_besl_capable: device can perform USB2 hardware BESL LPM
+- * @usb2_hw_lpm_enabled: USB2 hardware LPM enabled
++ * @usb2_hw_lpm_enabled: USB2 hardware LPM is enabled
++ * @usb2_hw_lpm_allowed: Userspace allows USB 2.0 LPM to be enabled
+  * @usb3_lpm_enabled: USB3 hardware LPM enabled
+  * @string_langid: language ID for strings
+  * @product: iProduct string, if present (static)
+@@ -548,6 +549,7 @@ struct usb_device {
+ 	unsigned usb2_hw_lpm_capable:1;
+ 	unsigned usb2_hw_lpm_besl_capable:1;
+ 	unsigned usb2_hw_lpm_enabled:1;
++	unsigned usb2_hw_lpm_allowed:1;
+ 	unsigned usb3_lpm_enabled:1;
+ 	int string_langid;
+ 
+diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h
+index 9031a26249b5..ae6c3b8ed2f5 100644
+--- a/include/sound/compress_driver.h
++++ b/include/sound/compress_driver.h
+@@ -171,4 +171,13 @@ static inline void snd_compr_fragment_elapsed(struct snd_compr_stream *stream)
+ 	wake_up(&stream->runtime->sleep);
+ }
+ 
++static inline void snd_compr_drain_notify(struct snd_compr_stream *stream)
++{
++	if (snd_BUG_ON(!stream))
++		return;
++
++	stream->runtime->state = SNDRV_PCM_STATE_SETUP;
++	wake_up(&stream->runtime->sleep);
++}
++
+ #endif
+diff --git a/ipc/shm.c b/ipc/shm.c
+index d69739610fd4..7a51443a51d6 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -208,15 +208,18 @@ static void shm_open(struct vm_area_struct *vma)
+  */
+ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
+ {
++	struct file *shm_file;
++
++	shm_file = shp->shm_file;
++	shp->shm_file = NULL;
+ 	ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ 	shm_rmid(ns, shp);
+ 	shm_unlock(shp);
+-	if (!is_file_hugepages(shp->shm_file))
+-		shmem_lock(shp->shm_file, 0, shp->mlock_user);
++	if (!is_file_hugepages(shm_file))
++		shmem_lock(shm_file, 0, shp->mlock_user);
+ 	else if (shp->mlock_user)
+-		user_shm_unlock(file_inode(shp->shm_file)->i_size,
+-						shp->mlock_user);
+-	fput (shp->shm_file);
++		user_shm_unlock(file_inode(shm_file)->i_size, shp->mlock_user);
++	fput(shm_file);
+ 	ipc_rcu_putref(shp, shm_rcu_free);
+ }
+ 
+@@ -974,15 +977,25 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
+ 		ipc_lock_object(&shp->shm_perm);
+ 		if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {
+ 			kuid_t euid = current_euid();
+-			err = -EPERM;
+ 			if (!uid_eq(euid, shp->shm_perm.uid) &&
+-			    !uid_eq(euid, shp->shm_perm.cuid))
++			    !uid_eq(euid, shp->shm_perm.cuid)) {
++				err = -EPERM;
+ 				goto out_unlock0;
+-			if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK))
++			}
++			if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK)) {
++				err = -EPERM;
+ 				goto out_unlock0;
++			}
+ 		}
+ 
+ 		shm_file = shp->shm_file;
++
++		/* check if shm_destroy() is tearing down shp */
++		if (shm_file == NULL) {
++			err = -EIDRM;
++			goto out_unlock0;
++		}
++
+ 		if (is_file_hugepages(shm_file))
+ 			goto out_unlock0;
+ 
+@@ -1101,6 +1114,14 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
+ 		goto out_unlock;
+ 
+ 	ipc_lock_object(&shp->shm_perm);
++
++	/* check if shm_destroy() is tearing down shp */
++	if (shp->shm_file == NULL) {
++		ipc_unlock_object(&shp->shm_perm);
++		err = -EIDRM;
++		goto out_unlock;
++	}
++
+ 	path = shp->shm_file->f_path;
+ 	path_get(&path);
+ 	shp->shm_nattch++;
+diff --git a/kernel/cpu/idle.c b/kernel/cpu/idle.c
+index e695c0a0bcb5..c261409500e4 100644
+--- a/kernel/cpu/idle.c
++++ b/kernel/cpu/idle.c
+@@ -44,7 +44,7 @@ static inline int cpu_idle_poll(void)
+ 	rcu_idle_enter();
+ 	trace_cpu_idle_rcuidle(0, smp_processor_id());
+ 	local_irq_enable();
+-	while (!need_resched())
++	while (!tif_need_resched())
+ 		cpu_relax();
+ 	trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id());
+ 	rcu_idle_exit();
+@@ -92,8 +92,7 @@ static void cpu_idle_loop(void)
+ 			if (cpu_idle_force_poll || tick_check_broadcast_expired()) {
+ 				cpu_idle_poll();
+ 			} else {
+-				current_clr_polling();
+-				if (!need_resched()) {
++				if (!current_clr_polling_and_test()) {
+ 					stop_critical_timings();
+ 					rcu_idle_enter();
+ 					arch_cpu_idle();
+@@ -103,7 +102,7 @@ static void cpu_idle_loop(void)
+ 				} else {
+ 					local_irq_enable();
+ 				}
+-				current_set_polling();
++				__current_set_polling();
+ 			}
+ 			arch_cpu_idle_exit();
+ 		}
+@@ -129,7 +128,7 @@ void cpu_startup_entry(enum cpuhp_state state)
+ 	 */
+ 	boot_init_stack_canary();
+ #endif
+-	current_set_polling();
++	__current_set_polling();
+ 	arch_cpu_idle_prepare();
+ 	cpu_idle_loop();
+ }
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index dd562e9aa2c8..1f4bcb3cc21c 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -257,7 +257,8 @@ ok:
+ 	if (task->mm)
+ 		dumpable = get_dumpable(task->mm);
+ 	rcu_read_lock();
+-	if (!dumpable && !ptrace_has_cap(__task_cred(task)->user_ns, mode)) {
++	if (dumpable != SUID_DUMP_USER &&
++	    !ptrace_has_cap(__task_cred(task)->user_ns, mode)) {
+ 		rcu_read_unlock();
+ 		return -EPERM;
+ 	}
+diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
+index 80c36bcf66e8..78e27e3b52ac 100644
+--- a/kernel/trace/trace_event_perf.c
++++ b/kernel/trace/trace_event_perf.c
+@@ -26,7 +26,7 @@ static int perf_trace_event_perm(struct ftrace_event_call *tp_event,
+ {
+ 	/* The ftrace function trace is allowed only for root. */
+ 	if (ftrace_event_is_function(tp_event) &&
+-	    perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
++	    perf_paranoid_tracepoint_raw() && !capable(CAP_SYS_ADMIN))
+ 		return -EPERM;
+ 
+ 	/* No tracing, just counting, so no obvious leak */
+diff --git a/mm/slub.c b/mm/slub.c
+index c3eb3d3ca835..96f21691b67c 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1217,8 +1217,8 @@ static unsigned long kmem_cache_flags(unsigned long object_size,
+ 	/*
+ 	 * Enable debugging if selected on the kernel commandline.
+ 	 */
+-	if (slub_debug && (!slub_debug_slabs ||
+-		!strncmp(slub_debug_slabs, name, strlen(slub_debug_slabs))))
++	if (slub_debug && (!slub_debug_slabs || (name &&
++		!strncmp(slub_debug_slabs, name, strlen(slub_debug_slabs)))))
+ 		flags |= slub_debug;
+ 
+ 	return flags;
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index 084656671d6e..cc24323d3045 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -482,6 +482,7 @@ gss_alloc_msg(struct gss_auth *gss_auth,
+ 	switch (vers) {
+ 	case 0:
+ 		gss_encode_v0_msg(gss_msg);
++		break;
+ 	default:
+ 		gss_encode_v1_msg(gss_msg, service_name, gss_auth->target_name);
+ 	};
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 77479606a971..941d19f8c999 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -656,14 +656,16 @@ EXPORT_SYMBOL_GPL(rpc_shutdown_client);
+ /*
+  * Free an RPC client
+  */
+-static void
++static struct rpc_clnt *
+ rpc_free_client(struct rpc_clnt *clnt)
+ {
++	struct rpc_clnt *parent = NULL;
++
+ 	dprintk_rcu("RPC:       destroying %s client for %s\n",
+ 			clnt->cl_program->name,
+ 			rcu_dereference(clnt->cl_xprt)->servername);
+ 	if (clnt->cl_parent != clnt)
+-		rpc_release_client(clnt->cl_parent);
++		parent = clnt->cl_parent;
+ 	rpc_clnt_remove_pipedir(clnt);
+ 	rpc_unregister_client(clnt);
+ 	rpc_free_iostats(clnt->cl_metrics);
+@@ -672,18 +674,17 @@ rpc_free_client(struct rpc_clnt *clnt)
+ 	rpciod_down();
+ 	rpc_free_clid(clnt);
+ 	kfree(clnt);
++	return parent;
+ }
+ 
+ /*
+  * Free an RPC client
+  */
+-static void
++static struct rpc_clnt *
+ rpc_free_auth(struct rpc_clnt *clnt)
+ {
+-	if (clnt->cl_auth == NULL) {
+-		rpc_free_client(clnt);
+-		return;
+-	}
++	if (clnt->cl_auth == NULL)
++		return rpc_free_client(clnt);
+ 
+ 	/*
+ 	 * Note: RPCSEC_GSS may need to send NULL RPC calls in order to
+@@ -694,7 +695,8 @@ rpc_free_auth(struct rpc_clnt *clnt)
+ 	rpcauth_release(clnt->cl_auth);
+ 	clnt->cl_auth = NULL;
+ 	if (atomic_dec_and_test(&clnt->cl_count))
+-		rpc_free_client(clnt);
++		return rpc_free_client(clnt);
++	return NULL;
+ }
+ 
+ /*
+@@ -705,10 +707,13 @@ rpc_release_client(struct rpc_clnt *clnt)
+ {
+ 	dprintk("RPC:       rpc_release_client(%p)\n", clnt);
+ 
+-	if (list_empty(&clnt->cl_tasks))
+-		wake_up(&destroy_wait);
+-	if (atomic_dec_and_test(&clnt->cl_count))
+-		rpc_free_auth(clnt);
++	do {
++		if (list_empty(&clnt->cl_tasks))
++			wake_up(&destroy_wait);
++		if (!atomic_dec_and_test(&clnt->cl_count))
++			break;
++		clnt = rpc_free_auth(clnt);
++	} while (clnt != NULL);
+ }
+ EXPORT_SYMBOL_GPL(rpc_release_client);
+ 
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index ee03d35677d9..b752e1de2e7d 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -393,8 +393,10 @@ static int xs_send_kvec(struct socket *sock, struct sockaddr *addr, int addrlen,
+ 	return kernel_sendmsg(sock, &msg, NULL, 0, 0);
+ }
+ 
+-static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned int base, int more)
++static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned int base, int more, bool zerocopy)
+ {
++	ssize_t (*do_sendpage)(struct socket *sock, struct page *page,
++			int offset, size_t size, int flags);
+ 	struct page **ppage;
+ 	unsigned int remainder;
+ 	int err, sent = 0;
+@@ -403,6 +405,9 @@ static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned i
+ 	base += xdr->page_base;
+ 	ppage = xdr->pages + (base >> PAGE_SHIFT);
+ 	base &= ~PAGE_MASK;
++	do_sendpage = sock->ops->sendpage;
++	if (!zerocopy)
++		do_sendpage = sock_no_sendpage;
+ 	for(;;) {
+ 		unsigned int len = min_t(unsigned int, PAGE_SIZE - base, remainder);
+ 		int flags = XS_SENDMSG_FLAGS;
+@@ -410,7 +415,7 @@ static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned i
+ 		remainder -= len;
+ 		if (remainder != 0 || more)
+ 			flags |= MSG_MORE;
+-		err = sock->ops->sendpage(sock, *ppage, base, len, flags);
++		err = do_sendpage(sock, *ppage, base, len, flags);
+ 		if (remainder == 0 || err != len)
+ 			break;
+ 		sent += err;
+@@ -431,9 +436,10 @@ static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned i
+  * @addrlen: UDP only -- length of destination address
+  * @xdr: buffer containing this request
+  * @base: starting position in the buffer
++ * @zerocopy: true if it is safe to use sendpage()
+  *
+  */
+-static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen, struct xdr_buf *xdr, unsigned int base)
++static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen, struct xdr_buf *xdr, unsigned int base, bool zerocopy)
+ {
+ 	unsigned int remainder = xdr->len - base;
+ 	int err, sent = 0;
+@@ -461,7 +467,7 @@ static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen,
+ 	if (base < xdr->page_len) {
+ 		unsigned int len = xdr->page_len - base;
+ 		remainder -= len;
+-		err = xs_send_pagedata(sock, xdr, base, remainder != 0);
++		err = xs_send_pagedata(sock, xdr, base, remainder != 0, zerocopy);
+ 		if (remainder == 0 || err != len)
+ 			goto out;
+ 		sent += err;
+@@ -564,7 +570,7 @@ static int xs_local_send_request(struct rpc_task *task)
+ 			req->rq_svec->iov_base, req->rq_svec->iov_len);
+ 
+ 	status = xs_sendpages(transport->sock, NULL, 0,
+-						xdr, req->rq_bytes_sent);
++						xdr, req->rq_bytes_sent, true);
+ 	dprintk("RPC:       %s(%u) = %d\n",
+ 			__func__, xdr->len - req->rq_bytes_sent, status);
+ 	if (likely(status >= 0)) {
+@@ -620,7 +626,7 @@ static int xs_udp_send_request(struct rpc_task *task)
+ 	status = xs_sendpages(transport->sock,
+ 			      xs_addr(xprt),
+ 			      xprt->addrlen, xdr,
+-			      req->rq_bytes_sent);
++			      req->rq_bytes_sent, true);
+ 
+ 	dprintk("RPC:       xs_udp_send_request(%u) = %d\n",
+ 			xdr->len - req->rq_bytes_sent, status);
+@@ -693,6 +699,7 @@ static int xs_tcp_send_request(struct rpc_task *task)
+ 	struct rpc_xprt *xprt = req->rq_xprt;
+ 	struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+ 	struct xdr_buf *xdr = &req->rq_snd_buf;
++	bool zerocopy = true;
+ 	int status;
+ 
+ 	xs_encode_stream_record_marker(&req->rq_snd_buf);
+@@ -700,13 +707,20 @@ static int xs_tcp_send_request(struct rpc_task *task)
+ 	xs_pktdump("packet data:",
+ 				req->rq_svec->iov_base,
+ 				req->rq_svec->iov_len);
++	/* Don't use zero copy if this is a resend. If the RPC call
++	 * completes while the socket holds a reference to the pages,
++	 * then we may end up resending corrupted data.
++	 */
++	if (task->tk_flags & RPC_TASK_SENT)
++		zerocopy = false;
+ 
+ 	/* Continue transmitting the packet/record. We must be careful
+ 	 * to cope with writespace callbacks arriving _after_ we have
+ 	 * called sendmsg(). */
+ 	while (1) {
+ 		status = xs_sendpages(transport->sock,
+-					NULL, 0, xdr, req->rq_bytes_sent);
++					NULL, 0, xdr, req->rq_bytes_sent,
++					zerocopy);
+ 
+ 		dprintk("RPC:       xs_tcp_send_request(%u) = %d\n",
+ 				xdr->len - req->rq_bytes_sent, status);
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index 399433ad614e..a9c3d3cd1990 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -73,7 +73,6 @@ static struct ima_rule_entry default_rules[] = {
+ 	{.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
+-	{.action = DONT_MEASURE,.fsmagic = RAMFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = DEVPTS_SUPER_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = BINFMTFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index bea523a5d852..d9af6387f37c 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -680,14 +680,48 @@ static int snd_compr_stop(struct snd_compr_stream *stream)
+ 		return -EPERM;
+ 	retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_STOP);
+ 	if (!retval) {
+-		stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+-		wake_up(&stream->runtime->sleep);
++		snd_compr_drain_notify(stream);
+ 		stream->runtime->total_bytes_available = 0;
+ 		stream->runtime->total_bytes_transferred = 0;
+ 	}
+ 	return retval;
+ }
+ 
++static int snd_compress_wait_for_drain(struct snd_compr_stream *stream)
++{
++	int ret;
++
++	/*
++	 * We are called with lock held. So drop the lock while we wait for
++	 * drain complete notfication from the driver
++	 *
++	 * It is expected that driver will notify the drain completion and then
++	 * stream will be moved to SETUP state, even if draining resulted in an
++	 * error. We can trigger next track after this.
++	 */
++	stream->runtime->state = SNDRV_PCM_STATE_DRAINING;
++	mutex_unlock(&stream->device->lock);
++
++	/* we wait for drain to complete here, drain can return when
++	 * interruption occurred, wait returned error or success.
++	 * For the first two cases we don't do anything different here and
++	 * return after waking up
++	 */
++
++	ret = wait_event_interruptible(stream->runtime->sleep,
++			(stream->runtime->state != SNDRV_PCM_STATE_DRAINING));
++	if (ret == -ERESTARTSYS)
++		pr_debug("wait aborted by a signal");
++	else if (ret)
++		pr_debug("wait for drain failed with %d\n", ret);
++
++
++	wake_up(&stream->runtime->sleep);
++	mutex_lock(&stream->device->lock);
++
++	return ret;
++}
++
+ static int snd_compr_drain(struct snd_compr_stream *stream)
+ {
+ 	int retval;
+@@ -695,12 +729,15 @@ static int snd_compr_drain(struct snd_compr_stream *stream)
+ 	if (stream->runtime->state == SNDRV_PCM_STATE_PREPARED ||
+ 			stream->runtime->state == SNDRV_PCM_STATE_SETUP)
+ 		return -EPERM;
++
+ 	retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_DRAIN);
+-	if (!retval) {
+-		stream->runtime->state = SNDRV_PCM_STATE_DRAINING;
++	if (retval) {
++		pr_debug("SND_COMPR_TRIGGER_DRAIN failed %d\n", retval);
+ 		wake_up(&stream->runtime->sleep);
++		return retval;
+ 	}
+-	return retval;
++
++	return snd_compress_wait_for_drain(stream);
+ }
+ 
+ static int snd_compr_next_track(struct snd_compr_stream *stream)
+@@ -736,9 +773,14 @@ static int snd_compr_partial_drain(struct snd_compr_stream *stream)
+ 		return -EPERM;
+ 
+ 	retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_PARTIAL_DRAIN);
++	if (retval) {
++		pr_debug("Partial drain returned failure\n");
++		wake_up(&stream->runtime->sleep);
++		return retval;
++	}
+ 
+ 	stream->next_track = false;
+-	return retval;
++	return snd_compress_wait_for_drain(stream);
+ }
+ 
+ static long snd_compr_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+diff --git a/sound/drivers/pcsp/pcsp.c b/sound/drivers/pcsp/pcsp.c
+index 1c19cd7ad26e..83b8a9a9163e 100644
+--- a/sound/drivers/pcsp/pcsp.c
++++ b/sound/drivers/pcsp/pcsp.c
+@@ -187,8 +187,8 @@ static int pcsp_probe(struct platform_device *dev)
+ static int pcsp_remove(struct platform_device *dev)
+ {
+ 	struct snd_pcsp *chip = platform_get_drvdata(dev);
+-	alsa_card_pcsp_exit(chip);
+ 	pcspkr_input_remove(chip->input_dev);
++	alsa_card_pcsp_exit(chip);
+ 	return 0;
+ }
+ 
+diff --git a/sound/isa/msnd/msnd_pinnacle.c b/sound/isa/msnd/msnd_pinnacle.c
+index 81aeb934261a..0a90bd6ae232 100644
+--- a/sound/isa/msnd/msnd_pinnacle.c
++++ b/sound/isa/msnd/msnd_pinnacle.c
+@@ -73,9 +73,11 @@
+ #ifdef MSND_CLASSIC
+ #  include "msnd_classic.h"
+ #  define LOGNAME			"msnd_classic"
++#  define DEV_NAME			"msnd-classic"
+ #else
+ #  include "msnd_pinnacle.h"
+ #  define LOGNAME			"snd_msnd_pinnacle"
++#  define DEV_NAME			"msnd-pinnacle"
+ #endif
+ 
+ static void set_default_audio_parameters(struct snd_msnd *chip)
+@@ -1067,8 +1069,6 @@ static int snd_msnd_isa_remove(struct device *pdev, unsigned int dev)
+ 	return 0;
+ }
+ 
+-#define DEV_NAME "msnd-pinnacle"
+-
+ static struct isa_driver snd_msnd_driver = {
+ 	.match		= snd_msnd_isa_match,
+ 	.probe		= snd_msnd_isa_probe,
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 748c6a941963..e938a68625ea 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2579,9 +2579,6 @@ int snd_hda_codec_reset(struct hda_codec *codec)
+ 	cancel_delayed_work_sync(&codec->jackpoll_work);
+ #ifdef CONFIG_PM
+ 	cancel_delayed_work_sync(&codec->power_work);
+-	codec->power_on = 0;
+-	codec->power_transition = 0;
+-	codec->power_jiffies = jiffies;
+ 	flush_workqueue(bus->workq);
+ #endif
+ 	snd_hda_ctls_clear(codec);
+@@ -3991,6 +3988,10 @@ static void hda_call_codec_resume(struct hda_codec *codec)
+ 	 * in the resume / power-save sequence
+ 	 */
+ 	hda_keep_power_on(codec);
++	if (codec->pm_down_notified) {
++		codec->pm_down_notified = 0;
++		hda_call_pm_notify(codec->bus, true);
++	}
+ 	hda_set_power_state(codec, AC_PWRST_D0);
+ 	restore_shutup_pins(codec);
+ 	hda_exec_init_verbs(codec);
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index b7c89dff7066..3067ed4fe3b2 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -549,11 +549,15 @@ static hda_nid_t look_for_out_mute_nid(struct hda_codec *codec,
+ static hda_nid_t look_for_out_vol_nid(struct hda_codec *codec,
+ 				      struct nid_path *path)
+ {
++	struct hda_gen_spec *spec = codec->spec;
+ 	int i;
+ 
+ 	for (i = path->depth - 1; i >= 0; i--) {
+-		if (nid_has_volume(codec, path->path[i], HDA_OUTPUT))
+-			return path->path[i];
++		hda_nid_t nid = path->path[i];
++		if ((spec->out_vol_mask >> nid) & 1)
++			continue;
++		if (nid_has_volume(codec, nid, HDA_OUTPUT))
++			return nid;
+ 	}
+ 	return 0;
+ }
+@@ -792,10 +796,10 @@ static void set_pin_eapd(struct hda_codec *codec, hda_nid_t pin, bool enable)
+ 	if (spec->own_eapd_ctl ||
+ 	    !(snd_hda_query_pin_caps(codec, pin) & AC_PINCAP_EAPD))
+ 		return;
+-	if (codec->inv_eapd)
+-		enable = !enable;
+ 	if (spec->keep_eapd_on && !enable)
+ 		return;
++	if (codec->inv_eapd)
++		enable = !enable;
+ 	snd_hda_codec_update_cache(codec, pin, 0,
+ 				   AC_VERB_SET_EAPD_BTLENABLE,
+ 				   enable ? 0x02 : 0x00);
+diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h
+index 48d44026705b..7e45cb44d151 100644
+--- a/sound/pci/hda/hda_generic.h
++++ b/sound/pci/hda/hda_generic.h
+@@ -242,6 +242,9 @@ struct hda_gen_spec {
+ 	/* additional mute flags (only effective with auto_mute_via_amp=1) */
+ 	u64 mute_bits;
+ 
++	/* bitmask for skipping volume controls */
++	u64 out_vol_mask;
++
+ 	/* badness tables for output path evaluations */
+ 	const struct badness_table *main_out_badness;
+ 	const struct badness_table *extra_out_badness;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 6e61a019aa5e..a63aff2ca594 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -612,6 +612,11 @@ enum {
+ #define AZX_DCAPS_INTEL_PCH \
+ 	(AZX_DCAPS_INTEL_PCH_NOPM | AZX_DCAPS_PM_RUNTIME)
+ 
++#define AZX_DCAPS_INTEL_HASWELL \
++	(AZX_DCAPS_SCH_SNOOP | AZX_DCAPS_ALIGN_BUFSIZE | \
++	 AZX_DCAPS_COUNT_LPIB_DELAY | AZX_DCAPS_PM_RUNTIME | \
++	 AZX_DCAPS_I915_POWERWELL)
++
+ /* quirks for ATI SB / AMD Hudson */
+ #define AZX_DCAPS_PRESET_ATI_SB \
+ 	(AZX_DCAPS_ATI_SNOOP | AZX_DCAPS_NO_TCSEL | \
+@@ -3987,14 +3992,11 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
+ 	  .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+ 	/* Haswell */
+ 	{ PCI_DEVICE(0x8086, 0x0a0c),
+-	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH |
+-	  AZX_DCAPS_I915_POWERWELL },
++	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_HASWELL },
+ 	{ PCI_DEVICE(0x8086, 0x0c0c),
+-	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH |
+-	  AZX_DCAPS_I915_POWERWELL },
++	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_HASWELL },
+ 	{ PCI_DEVICE(0x8086, 0x0d0c),
+-	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH |
+-	  AZX_DCAPS_I915_POWERWELL },
++	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_HASWELL },
+ 	/* 5 Series/3400 */
+ 	{ PCI_DEVICE(0x8086, 0x3b56),
+ 	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM },
+diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
+index 2aa2f579b4d6..a52d2a1a5e83 100644
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -219,8 +219,12 @@ static int alloc_ad_spec(struct hda_codec *codec)
+ static void ad_fixup_inv_jack_detect(struct hda_codec *codec,
+ 				     const struct hda_fixup *fix, int action)
+ {
+-	if (action == HDA_FIXUP_ACT_PRE_PROBE)
++	struct ad198x_spec *spec = codec->spec;
++
++	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ 		codec->inv_jack_detect = 1;
++		spec->gen.keep_eapd_on = 1;
++	}
+ }
+ 
+ enum {
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index 18d972501585..072755c8289c 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -597,6 +597,7 @@ static int patch_cs420x(struct hda_codec *codec)
+  * Its layout is no longer compatible with CS4206/CS4207
+  */
+ enum {
++	CS4208_MAC_AUTO,
+ 	CS4208_MBA6,
+ 	CS4208_GPIO0,
+ };
+@@ -608,7 +609,12 @@ static const struct hda_model_fixup cs4208_models[] = {
+ };
+ 
+ static const struct snd_pci_quirk cs4208_fixup_tbl[] = {
+-	/* codec SSID */
++	SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS4208_MAC_AUTO),
++	{} /* terminator */
++};
++
++/* codec SSID matching */
++static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6),
+ 	SND_PCI_QUIRK(0x106b, 0x7200, "MacBookAir 6,2", CS4208_MBA6),
+ 	{} /* terminator */
+@@ -626,6 +632,20 @@ static void cs4208_fixup_gpio0(struct hda_codec *codec,
+ 	}
+ }
+ 
++static const struct hda_fixup cs4208_fixups[];
++
++/* remap the fixup from codec SSID and apply it */
++static void cs4208_fixup_mac(struct hda_codec *codec,
++			     const struct hda_fixup *fix, int action)
++{
++	if (action != HDA_FIXUP_ACT_PRE_PROBE)
++		return;
++	snd_hda_pick_fixup(codec, NULL, cs4208_mac_fixup_tbl, cs4208_fixups);
++	if (codec->fixup_id < 0 || codec->fixup_id == CS4208_MAC_AUTO)
++		codec->fixup_id = CS4208_GPIO0; /* default fixup */
++	snd_hda_apply_fixup(codec, action);
++}
++
+ static const struct hda_fixup cs4208_fixups[] = {
+ 	[CS4208_MBA6] = {
+ 		.type = HDA_FIXUP_PINS,
+@@ -637,6 +657,10 @@ static const struct hda_fixup cs4208_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = cs4208_fixup_gpio0,
+ 	},
++	[CS4208_MAC_AUTO] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = cs4208_fixup_mac,
++	},
+ };
+ 
+ /* correct the 0dB offset of input pins */
+@@ -660,6 +684,8 @@ static int patch_cs4208(struct hda_codec *codec)
+ 		return -ENOMEM;
+ 
+ 	spec->gen.automute_hook = cs_automute;
++	/* exclude NID 0x10 (HP) from output volumes due to different steps */
++	spec->gen.out_vol_mask = 1ULL << 0x10;
+ 
+ 	snd_hda_pick_fixup(codec, cs4208_models, cs4208_fixup_tbl,
+ 			   cs4208_fixups);
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index ec68eaea0336..96f07ce56603 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -3568,6 +3568,8 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = {
+ 	  .patch = patch_conexant_auto },
+ 	{ .id = 0x14f15115, .name = "CX20757",
+ 	  .patch = patch_conexant_auto },
++	{ .id = 0x14f151d7, .name = "CX20952",
++	  .patch = patch_conexant_auto },
+ 	{} /* terminator */
+ };
+ 
+@@ -3594,6 +3596,7 @@ MODULE_ALIAS("snd-hda-codec-id:14f15111");
+ MODULE_ALIAS("snd-hda-codec-id:14f15113");
+ MODULE_ALIAS("snd-hda-codec-id:14f15114");
+ MODULE_ALIAS("snd-hda-codec-id:14f15115");
++MODULE_ALIAS("snd-hda-codec-id:14f151d7");
+ 
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Conexant HD-audio codec");
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 8ad554312b69..2f39631f54c8 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1043,6 +1043,7 @@ enum {
+ 	ALC880_FIXUP_UNIWILL,
+ 	ALC880_FIXUP_UNIWILL_DIG,
+ 	ALC880_FIXUP_Z71V,
++	ALC880_FIXUP_ASUS_W5A,
+ 	ALC880_FIXUP_3ST_BASE,
+ 	ALC880_FIXUP_3ST,
+ 	ALC880_FIXUP_3ST_DIG,
+@@ -1213,6 +1214,26 @@ static const struct hda_fixup alc880_fixups[] = {
+ 			{ }
+ 		}
+ 	},
++	[ALC880_FIXUP_ASUS_W5A] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			/* set up the whole pins as BIOS is utterly broken */
++			{ 0x14, 0x0121411f }, /* HP */
++			{ 0x15, 0x411111f0 }, /* N/A */
++			{ 0x16, 0x411111f0 }, /* N/A */
++			{ 0x17, 0x411111f0 }, /* N/A */
++			{ 0x18, 0x90a60160 }, /* mic */
++			{ 0x19, 0x411111f0 }, /* N/A */
++			{ 0x1a, 0x411111f0 }, /* N/A */
++			{ 0x1b, 0x411111f0 }, /* N/A */
++			{ 0x1c, 0x411111f0 }, /* N/A */
++			{ 0x1d, 0x411111f0 }, /* N/A */
++			{ 0x1e, 0xb743111e }, /* SPDIF out */
++			{ }
++		},
++		.chained = true,
++		.chain_id = ALC880_FIXUP_GPIO1,
++	},
+ 	[ALC880_FIXUP_3ST_BASE] = {
+ 		.type = HDA_FIXUP_PINS,
+ 		.v.pins = (const struct hda_pintbl[]) {
+@@ -1334,6 +1355,7 @@ static const struct hda_fixup alc880_fixups[] = {
+ 
+ static const struct snd_pci_quirk alc880_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1019, 0x0f69, "Coeus G610P", ALC880_FIXUP_W810),
++	SND_PCI_QUIRK(0x1043, 0x10c3, "ASUS W5A", ALC880_FIXUP_ASUS_W5A),
+ 	SND_PCI_QUIRK(0x1043, 0x1964, "ASUS Z71V", ALC880_FIXUP_Z71V),
+ 	SND_PCI_QUIRK_VENDOR(0x1043, "ASUS", ALC880_FIXUP_GPIO1),
+ 	SND_PCI_QUIRK(0x1558, 0x5401, "Clevo GPIO2", ALC880_FIXUP_GPIO2),
+@@ -1479,6 +1501,7 @@ enum {
+ 	ALC260_FIXUP_KN1,
+ 	ALC260_FIXUP_FSC_S7020,
+ 	ALC260_FIXUP_FSC_S7020_JWSE,
++	ALC260_FIXUP_VAIO_PINS,
+ };
+ 
+ static void alc260_gpio1_automute(struct hda_codec *codec)
+@@ -1619,6 +1642,24 @@ static const struct hda_fixup alc260_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = ALC260_FIXUP_FSC_S7020,
+ 	},
++	[ALC260_FIXUP_VAIO_PINS] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			/* Pin configs are missing completely on some VAIOs */
++			{ 0x0f, 0x01211020 },
++			{ 0x10, 0x0001003f },
++			{ 0x11, 0x411111f0 },
++			{ 0x12, 0x01a15930 },
++			{ 0x13, 0x411111f0 },
++			{ 0x14, 0x411111f0 },
++			{ 0x15, 0x411111f0 },
++			{ 0x16, 0x411111f0 },
++			{ 0x17, 0x411111f0 },
++			{ 0x18, 0x411111f0 },
++			{ 0x19, 0x411111f0 },
++			{ }
++		}
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc260_fixup_tbl[] = {
+@@ -1627,6 +1668,8 @@ static const struct snd_pci_quirk alc260_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1025, 0x008f, "Acer", ALC260_FIXUP_GPIO1),
+ 	SND_PCI_QUIRK(0x103c, 0x280a, "HP dc5750", ALC260_FIXUP_HP_DC5750),
+ 	SND_PCI_QUIRK(0x103c, 0x30ba, "HP Presario B1900", ALC260_FIXUP_HP_B1900),
++	SND_PCI_QUIRK(0x104d, 0x81bb, "Sony VAIO", ALC260_FIXUP_VAIO_PINS),
++	SND_PCI_QUIRK(0x104d, 0x81e2, "Sony VAIO TX", ALC260_FIXUP_HP_PIN_0F),
+ 	SND_PCI_QUIRK(0x10cf, 0x1326, "FSC LifeBook S7020", ALC260_FIXUP_FSC_S7020),
+ 	SND_PCI_QUIRK(0x1509, 0x4540, "Favorit 100XS", ALC260_FIXUP_GPIO1),
+ 	SND_PCI_QUIRK(0x152d, 0x0729, "Quanta KN1", ALC260_FIXUP_KN1),
+@@ -2388,6 +2431,7 @@ static const struct hda_verb alc268_beep_init_verbs[] = {
+ enum {
+ 	ALC268_FIXUP_INV_DMIC,
+ 	ALC268_FIXUP_HP_EAPD,
++	ALC268_FIXUP_SPDIF,
+ };
+ 
+ static const struct hda_fixup alc268_fixups[] = {
+@@ -2402,6 +2446,13 @@ static const struct hda_fixup alc268_fixups[] = {
+ 			{}
+ 		}
+ 	},
++	[ALC268_FIXUP_SPDIF] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{ 0x1e, 0x014b1180 }, /* enable SPDIF out */
++			{}
++		}
++	},
+ };
+ 
+ static const struct hda_model_fixup alc268_fixup_models[] = {
+@@ -2411,6 +2462,7 @@ static const struct hda_model_fixup alc268_fixup_models[] = {
+ };
+ 
+ static const struct snd_pci_quirk alc268_fixup_tbl[] = {
++	SND_PCI_QUIRK(0x1025, 0x0139, "Acer TravelMate 6293", ALC268_FIXUP_SPDIF),
+ 	SND_PCI_QUIRK(0x1025, 0x015b, "Acer AOA 150 (ZG5)", ALC268_FIXUP_INV_DMIC),
+ 	/* below is codec SSID since multiple Toshiba laptops have the
+ 	 * same PCI SSID 1179:ff00
+@@ -2540,6 +2592,7 @@ enum {
+ 	ALC269_TYPE_ALC283,
+ 	ALC269_TYPE_ALC284,
+ 	ALC269_TYPE_ALC286,
++	ALC269_TYPE_ALC255,
+ };
+ 
+ /*
+@@ -2565,6 +2618,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
+ 	case ALC269_TYPE_ALC282:
+ 	case ALC269_TYPE_ALC283:
+ 	case ALC269_TYPE_ALC286:
++	case ALC269_TYPE_ALC255:
+ 		ssids = alc269_ssids;
+ 		break;
+ 	default:
+@@ -2944,6 +2998,23 @@ static void alc269_fixup_mic_mute_hook(void *private_data, int enabled)
+ 		snd_hda_set_pin_ctl_cache(codec, spec->mute_led_nid, pinval);
+ }
+ 
++/* Make sure the led works even in runtime suspend */
++static unsigned int led_power_filter(struct hda_codec *codec,
++						  hda_nid_t nid,
++						  unsigned int power_state)
++{
++	struct alc_spec *spec = codec->spec;
++
++	if (power_state != AC_PWRST_D3 || nid != spec->mute_led_nid)
++		return power_state;
++
++	/* Set pin ctl again, it might have just been set to 0 */
++	snd_hda_set_pin_ctl(codec, nid,
++			    snd_hda_codec_get_pin_target(codec, nid));
++
++	return AC_PWRST_D0;
++}
++
+ static void alc269_fixup_hp_mute_led(struct hda_codec *codec,
+ 				     const struct hda_fixup *fix, int action)
+ {
+@@ -2963,6 +3034,7 @@ static void alc269_fixup_hp_mute_led(struct hda_codec *codec,
+ 		spec->mute_led_nid = pin - 0x0a + 0x18;
+ 		spec->gen.vmaster_mute.hook = alc269_fixup_mic_mute_hook;
+ 		spec->gen.vmaster_mute_enum = 1;
++		codec->power_filter = led_power_filter;
+ 		snd_printd("Detected mute LED for %x:%d\n", spec->mute_led_nid,
+ 			   spec->mute_led_polarity);
+ 		break;
+@@ -2978,6 +3050,7 @@ static void alc269_fixup_hp_mute_led_mic1(struct hda_codec *codec,
+ 		spec->mute_led_nid = 0x18;
+ 		spec->gen.vmaster_mute.hook = alc269_fixup_mic_mute_hook;
+ 		spec->gen.vmaster_mute_enum = 1;
++		codec->power_filter = led_power_filter;
+ 	}
+ }
+ 
+@@ -2990,6 +3063,7 @@ static void alc269_fixup_hp_mute_led_mic2(struct hda_codec *codec,
+ 		spec->mute_led_nid = 0x19;
+ 		spec->gen.vmaster_mute.hook = alc269_fixup_mic_mute_hook;
+ 		spec->gen.vmaster_mute_enum = 1;
++		codec->power_filter = led_power_filter;
+ 	}
+ }
+ 
+@@ -3230,8 +3304,10 @@ static void alc_update_headset_mode(struct hda_codec *codec)
+ 	else
+ 		new_headset_mode = ALC_HEADSET_MODE_HEADPHONE;
+ 
+-	if (new_headset_mode == spec->current_headset_mode)
++	if (new_headset_mode == spec->current_headset_mode) {
++		snd_hda_gen_update_outputs(codec);
+ 		return;
++	}
+ 
+ 	switch (new_headset_mode) {
+ 	case ALC_HEADSET_MODE_UNPLUGGED:
+@@ -3895,6 +3971,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1028, 0x0608, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x0609, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x0613, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
++	SND_PCI_QUIRK(0x1028, 0x0614, "Dell Inspiron 3135", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x0616, "Dell Vostro 5470", ALC290_FIXUP_MONO_SPEAKERS),
+ 	SND_PCI_QUIRK(0x1028, 0x15cc, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x15cd, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
+@@ -4128,6 +4205,9 @@ static int patch_alc269(struct hda_codec *codec)
+ 	case 0x10ec0286:
+ 		spec->codec_variant = ALC269_TYPE_ALC286;
+ 		break;
++	case 0x10ec0255:
++		spec->codec_variant = ALC269_TYPE_ALC255;
++		break;
+ 	}
+ 
+ 	if (snd_hda_codec_read(codec, 0x51, 0, AC_VERB_PARAMETERS, 0) == 0x10ec5505) {
+@@ -4842,6 +4922,7 @@ static int patch_alc680(struct hda_codec *codec)
+ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
+ 	{ .id = 0x10ec0221, .name = "ALC221", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0233, .name = "ALC233", .patch = patch_alc269 },
++	{ .id = 0x10ec0255, .name = "ALC255", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0260, .name = "ALC260", .patch = patch_alc260 },
+ 	{ .id = 0x10ec0262, .name = "ALC262", .patch = patch_alc262 },
+ 	{ .id = 0x10ec0267, .name = "ALC267", .patch = patch_alc268 },
+diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c
+index c39c77978468..66edc4a7917f 100644
+--- a/sound/usb/6fire/chip.c
++++ b/sound/usb/6fire/chip.c
+@@ -101,7 +101,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf,
+ 			usb_set_intfdata(intf, chips[i]);
+ 			mutex_unlock(&register_mutex);
+ 			return 0;
+-		} else if (regidx < 0)
++		} else if (!devices[i] && regidx < 0)
+ 			regidx = i;
+ 	}
+ 	if (regidx < 0) {
+diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
+index 72a130bc448a..c329c8fc57f4 100644
+--- a/virt/kvm/iommu.c
++++ b/virt/kvm/iommu.c
+@@ -103,6 +103,10 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
+ 		while ((gfn << PAGE_SHIFT) & (page_size - 1))
+ 			page_size >>= 1;
+ 
++		/* Make sure hva is aligned to the page size we want to map */
++		while (__gfn_to_hva_memslot(slot, gfn) & (page_size - 1))
++			page_size >>= 1;
++
+ 		/*
+ 		 * Pin all pages we are about to map in memory. This is
+ 		 * important because we unmap and unpin in 4kb steps later.

Modified: genpatches-2.6/trunk/3.2/0000_README
===================================================================
--- genpatches-2.6/trunk/3.2/0000_README	2013-11-14 16:37:35 UTC (rev 2581)
+++ genpatches-2.6/trunk/3.2/0000_README	2013-11-29 23:44:29 UTC (rev 2595)
@@ -244,6 +244,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.2.51
 
+Patch:  1051_linux-3.2.52.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.2.52
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.2/1051_linux-3.2.52.patch
===================================================================
--- genpatches-2.6/trunk/3.2/1051_linux-3.2.52.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.2/1051_linux-3.2.52.patch	2013-11-29 23:44:29 UTC (rev 2595)
@@ -0,0 +1,5221 @@
+diff --git a/Makefile b/Makefile
+index 0f1193666ddb..1dd2c094a3d3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 51
++SUBLEVEL = 52
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
+index c898deb3ada0..189ed0069dee 100644
+--- a/arch/arm/mach-versatile/pci.c
++++ b/arch/arm/mach-versatile/pci.c
+@@ -43,9 +43,9 @@
+ #define PCI_IMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x0)
+ #define PCI_IMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x4)
+ #define PCI_IMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x8)
+-#define PCI_SMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x10)
+-#define PCI_SMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
+-#define PCI_SMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
++#define PCI_SMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x1c)
+ #define PCI_SELFID		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0xc)
+ 
+ #define DEVICE_ID_OFFSET		0x00
+diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
+index fbdd12ea3a58..cc3f35dc102a 100644
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -98,6 +98,9 @@ void show_mem(unsigned int filter)
+ 	printk("Mem-info:\n");
+ 	show_free_areas(filter);
+ 
++	if (filter & SHOW_MEM_FILTER_PAGE_COUNT)
++		return;
++
+ 	for_each_bank (i, mi) {
+ 		struct membank *bank = &mi->bank[i];
+ 		unsigned int pfn1, pfn2;
+diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c
+index f114a3b14c6a..ce6e7a80945e 100644
+--- a/arch/ia64/mm/contig.c
++++ b/arch/ia64/mm/contig.c
+@@ -46,6 +46,8 @@ void show_mem(unsigned int filter)
+ 	printk(KERN_INFO "Mem-info:\n");
+ 	show_free_areas(filter);
+ 	printk(KERN_INFO "Node memory in pages:\n");
++	if (filter & SHOW_MEM_FILTER_PAGE_COUNT)
++		return;
+ 	for_each_online_pgdat(pgdat) {
+ 		unsigned long present;
+ 		unsigned long flags;
+diff --git a/arch/ia64/mm/discontig.c b/arch/ia64/mm/discontig.c
+index c641333cd997..2230817b4e93 100644
+--- a/arch/ia64/mm/discontig.c
++++ b/arch/ia64/mm/discontig.c
+@@ -623,6 +623,8 @@ void show_mem(unsigned int filter)
+ 
+ 	printk(KERN_INFO "Mem-info:\n");
+ 	show_free_areas(filter);
++	if (filter & SHOW_MEM_FILTER_PAGE_COUNT)
++		return;
+ 	printk(KERN_INFO "Node memory in pages:\n");
+ 	for_each_online_pgdat(pgdat) {
+ 		unsigned long present;
+diff --git a/arch/m68k/kernel/vmlinux-nommu.lds b/arch/m68k/kernel/vmlinux-nommu.lds
+new file mode 100644
+index 000000000000..40e02d9c38b4
+--- /dev/null
++++ b/arch/m68k/kernel/vmlinux-nommu.lds
+@@ -0,0 +1,93 @@
++/*
++ *	vmlinux.lds.S -- master linker script for m68knommu arch
++ *
++ *	(C) Copyright 2002-2012, Greg Ungerer <gerg@××××××××.com>
++ *
++ *	This linker script is equipped to build either ROM loaded or RAM
++ *	run kernels.
++ */
++
++#if defined(CONFIG_RAMKERNEL)
++#define	KTEXT_ADDR	CONFIG_KERNELBASE
++#endif
++#if defined(CONFIG_ROMKERNEL)
++#define	KTEXT_ADDR	CONFIG_ROMSTART
++#define	KDATA_ADDR	CONFIG_KERNELBASE
++#define	LOAD_OFFSET	KDATA_ADDR + (ADDR(.text) + SIZEOF(.text))
++#endif
++
++#include <asm/page.h>
++#include <asm/thread_info.h>
++#include <asm-generic/vmlinux.lds.h>
++
++OUTPUT_ARCH(m68k)
++ENTRY(_start)
++
++jiffies = jiffies_64 + 4;
++
++SECTIONS {
++
++#ifdef CONFIG_ROMVEC
++	. = CONFIG_ROMVEC;
++	.romvec : {
++		__rom_start = .;
++		_romvec = .;
++		*(.romvec)
++		*(.data..initvect)
++	}
++#endif
++
++	. = KTEXT_ADDR;
++
++	_text = .;
++	_stext = .;
++	.text : {
++		HEAD_TEXT
++		TEXT_TEXT
++		SCHED_TEXT
++		LOCK_TEXT
++		*(.fixup)
++		. = ALIGN(16);
++	}
++	_etext = .;
++
++#ifdef KDATA_ADDR
++	. = KDATA_ADDR;
++#endif
++
++	_sdata = .;
++	RO_DATA_SECTION(PAGE_SIZE)
++	RW_DATA_SECTION(16, PAGE_SIZE, THREAD_SIZE)
++	_edata = .;
++
++	EXCEPTION_TABLE(16)
++	NOTES
++
++	. = ALIGN(PAGE_SIZE);
++	__init_begin = .;
++	INIT_TEXT_SECTION(PAGE_SIZE)
++	INIT_DATA_SECTION(16)
++	PERCPU_SECTION(16)
++	.m68k_fixup : {
++		__start_fixup = .;
++		*(.m68k_fixup)
++		__stop_fixup = .;
++	}
++	.init.data : {
++		. = ALIGN(PAGE_SIZE);
++		__init_end = .;
++	}
++
++	_sbss = .;
++	BSS_SECTION(0, 0, 0)
++	_ebss = .;
++
++	_end = .;
++
++	STABS_DEBUG
++	.comment 0 : { *(.comment) }
++
++	/* Sections to be discarded */
++	DISCARDS
++}
++
+diff --git a/arch/m68k/kernel/vmlinux.lds.S b/arch/m68k/kernel/vmlinux.lds.S
+index 030dabf0bc53..69ec79638870 100644
+--- a/arch/m68k/kernel/vmlinux.lds.S
++++ b/arch/m68k/kernel/vmlinux.lds.S
+@@ -1,5 +1,14 @@
+-#ifdef CONFIG_MMU
+-#include "vmlinux.lds_mm.S"
++#if defined(CONFIG_MMU) && !defined(CONFIG_COLDFIRE)
++PHDRS
++{
++  text PT_LOAD FILEHDR PHDRS FLAGS (7);
++  data PT_LOAD FLAGS (7);
++}
++#ifdef CONFIG_SUN3
++#include "vmlinux-sun3.lds"
+ #else
+-#include "vmlinux.lds_no.S"
++#include "vmlinux-std.lds"
++#endif
++#else
++#include "vmlinux-nommu.lds"
+ #endif
+diff --git a/arch/m68k/kernel/vmlinux.lds_mm.S b/arch/m68k/kernel/vmlinux.lds_mm.S
+deleted file mode 100644
+index 99ba315bd0a8..000000000000
+--- a/arch/m68k/kernel/vmlinux.lds_mm.S
++++ /dev/null
+@@ -1,10 +0,0 @@
+-PHDRS
+-{
+-  text PT_LOAD FILEHDR PHDRS FLAGS (7);
+-  data PT_LOAD FLAGS (7);
+-}
+-#ifdef CONFIG_SUN3
+-#include "vmlinux-sun3.lds"
+-#else
+-#include "vmlinux-std.lds"
+-#endif
+diff --git a/arch/m68k/kernel/vmlinux.lds_no.S b/arch/m68k/kernel/vmlinux.lds_no.S
+deleted file mode 100644
+index 4e2389340837..000000000000
+--- a/arch/m68k/kernel/vmlinux.lds_no.S
++++ /dev/null
+@@ -1,187 +0,0 @@
+-/*
+- *	vmlinux.lds.S -- master linker script for m68knommu arch
+- *
+- *	(C) Copyright 2002-2006, Greg Ungerer <gerg@××××××××.com>
+- *
+- *	This linker script is equipped to build either ROM loaded or RAM
+- *	run kernels.
+- */
+-
+-#include <asm-generic/vmlinux.lds.h>
+-#include <asm/page.h>
+-#include <asm/thread_info.h>
+-
+-#if defined(CONFIG_RAMKERNEL)
+-#define	RAM_START	CONFIG_KERNELBASE
+-#define	RAM_LENGTH	(CONFIG_RAMBASE + CONFIG_RAMSIZE - CONFIG_KERNELBASE)
+-#define	TEXT		ram
+-#define	DATA		ram
+-#define	INIT		ram
+-#define	BSSS		ram
+-#endif
+-#if defined(CONFIG_ROMKERNEL) || defined(CONFIG_HIMEMKERNEL)
+-#define	RAM_START	CONFIG_RAMBASE
+-#define	RAM_LENGTH	CONFIG_RAMSIZE
+-#define	ROMVEC_START	CONFIG_ROMVEC
+-#define	ROMVEC_LENGTH	CONFIG_ROMVECSIZE
+-#define	ROM_START	CONFIG_ROMSTART
+-#define	ROM_LENGTH	CONFIG_ROMSIZE
+-#define	TEXT		rom
+-#define	DATA		ram
+-#define	INIT		ram
+-#define	BSSS		ram
+-#endif
+-
+-#ifndef DATA_ADDR
+-#define	DATA_ADDR
+-#endif
+-
+-
+-OUTPUT_ARCH(m68k)
+-ENTRY(_start)
+-
+-MEMORY {
+-	ram	: ORIGIN = RAM_START, LENGTH = RAM_LENGTH
+-#ifdef ROM_START
+-	romvec	: ORIGIN = ROMVEC_START, LENGTH = ROMVEC_LENGTH
+-	rom	: ORIGIN = ROM_START, LENGTH = ROM_LENGTH
+-#endif
+-}
+-
+-jiffies = jiffies_64 + 4;
+-
+-SECTIONS {
+-
+-#ifdef ROMVEC_START
+-	. = ROMVEC_START ;
+-	.romvec : {
+-		__rom_start = . ;
+-		_romvec = .;
+-		*(.data..initvect)
+-	} > romvec
+-#endif
+-
+-	.text : {
+-		_text = .;
+-		_stext = . ;
+-		HEAD_TEXT
+-		TEXT_TEXT
+-		SCHED_TEXT
+-		LOCK_TEXT
+-		*(.text..lock)
+-
+-		. = ALIGN(16);          /* Exception table              */
+-		__start___ex_table = .;
+-		*(__ex_table)
+-		__stop___ex_table = .;
+-
+-		*(.rodata) *(.rodata.*)
+-		*(__vermagic)		/* Kernel version magic */
+-		*(.rodata1)
+-		*(.rodata.str1.1)
+-
+-		/* Kernel symbol table: Normal symbols */
+-		. = ALIGN(4);
+-		__start___ksymtab = .;
+-		*(SORT(___ksymtab+*))
+-		__stop___ksymtab = .;
+-
+-		/* Kernel symbol table: GPL-only symbols */
+-		__start___ksymtab_gpl = .;
+-		*(SORT(___ksymtab_gpl+*))
+-		__stop___ksymtab_gpl = .;
+-
+-		/* Kernel symbol table: Normal unused symbols */
+-		__start___ksymtab_unused = .;
+-		*(SORT(___ksymtab_unused+*))
+-		__stop___ksymtab_unused = .;
+-
+-		/* Kernel symbol table: GPL-only unused symbols */
+-		__start___ksymtab_unused_gpl = .;
+-		*(SORT(___ksymtab_unused_gpl+*))
+-		__stop___ksymtab_unused_gpl = .;
+-
+-		/* Kernel symbol table: GPL-future symbols */
+-		__start___ksymtab_gpl_future = .;
+-		*(SORT(___ksymtab_gpl_future+*))
+-		__stop___ksymtab_gpl_future = .;
+-
+-		/* Kernel symbol table: Normal symbols */
+-		__start___kcrctab = .;
+-		*(SORT(___kcrctab+*))
+-		__stop___kcrctab = .;
+-
+-		/* Kernel symbol table: GPL-only symbols */
+-		__start___kcrctab_gpl = .;
+-		*(SORT(___kcrctab_gpl+*))
+-		__stop___kcrctab_gpl = .;
+-
+-		/* Kernel symbol table: Normal unused symbols */
+-		__start___kcrctab_unused = .;
+-		*(SORT(___kcrctab_unused+*))
+-		__stop___kcrctab_unused = .;
+-
+-		/* Kernel symbol table: GPL-only unused symbols */
+-		__start___kcrctab_unused_gpl = .;
+-		*(SORT(___kcrctab_unused_gpl+*))
+-		__stop___kcrctab_unused_gpl = .;
+-
+-		/* Kernel symbol table: GPL-future symbols */
+-		__start___kcrctab_gpl_future = .;
+-		*(SORT(___kcrctab_gpl_future+*))
+-		__stop___kcrctab_gpl_future = .;
+-
+-		/* Kernel symbol table: strings */
+-		*(__ksymtab_strings)
+-
+-		/* Built-in module parameters */
+-		. = ALIGN(4) ;
+-		__start___param = .;
+-		*(__param)
+-		__stop___param = .;
+-
+-		/* Built-in module versions */
+-		. = ALIGN(4) ;
+-		__start___modver = .;
+-		*(__modver)
+-		__stop___modver = .;
+-
+-		. = ALIGN(4) ;
+-		_etext = . ;
+-	} > TEXT
+-
+-	.data DATA_ADDR : {
+-		. = ALIGN(4);
+-		_sdata = . ;
+-		DATA_DATA
+-		CACHELINE_ALIGNED_DATA(32)
+-		PAGE_ALIGNED_DATA(PAGE_SIZE)
+-		*(.data..shared_aligned)
+-		INIT_TASK_DATA(THREAD_SIZE)
+-		_edata = . ;
+-	} > DATA
+-
+-	.init.text : {
+-		. = ALIGN(PAGE_SIZE);
+-		__init_begin = .;
+-	} > INIT
+-	INIT_TEXT_SECTION(PAGE_SIZE) > INIT
+-	INIT_DATA_SECTION(16) > INIT
+-	.init.data : {
+-		. = ALIGN(PAGE_SIZE);
+-		__init_end = .;
+-	} > INIT
+-
+-	.bss : {
+-		. = ALIGN(4);
+-		_sbss = . ;
+-		*(.bss)
+-		*(COMMON)
+-		. = ALIGN(4) ;
+-		_ebss = . ;
+-	 	_end = . ;
+-	} > BSSS
+-
+-	DISCARDS
+-}
+-
+diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
+index 82f364e209fc..0b621625a6fb 100644
+--- a/arch/parisc/mm/init.c
++++ b/arch/parisc/mm/init.c
+@@ -685,6 +685,8 @@ void show_mem(unsigned int filter)
+ 
+ 	printk(KERN_INFO "Mem-info:\n");
+ 	show_free_areas(filter);
++	if (filter & SHOW_MEM_FILTER_PAGE_COUNT)
++		return;
+ #ifndef CONFIG_DISCONTIGMEM
+ 	i = max_mapnr;
+ 	while (i-- > 0) {
+diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
+index 8184ee97e484..3fcbae0fa4a0 100644
+--- a/arch/powerpc/kernel/align.c
++++ b/arch/powerpc/kernel/align.c
+@@ -764,6 +764,16 @@ int fix_alignment(struct pt_regs *regs)
+ 	nb = aligninfo[instr].len;
+ 	flags = aligninfo[instr].flags;
+ 
++	/* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */
++	if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) {
++		nb = 8;
++		flags = LD+SW;
++	} else if (IS_XFORM(instruction) &&
++		   ((instruction >> 1) & 0x3ff) == 660) {
++		nb = 8;
++		flags = ST+SW;
++	}
++
+ 	/* Byteswap little endian loads and stores */
+ 	swiz = 0;
+ 	if (regs->msr & MSR_LE) {
+diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
+index 0cfcf98aafca..d0b205cd1126 100644
+--- a/arch/powerpc/kernel/iommu.c
++++ b/arch/powerpc/kernel/iommu.c
+@@ -495,7 +495,7 @@ struct iommu_table *iommu_init_table(struct iommu_table *tbl, int nid)
+ 	/* number of bytes needed for the bitmap */
+ 	sz = (tbl->it_size + 7) >> 3;
+ 
+-	page = alloc_pages_node(nid, GFP_ATOMIC, get_order(sz));
++	page = alloc_pages_node(nid, GFP_KERNEL, get_order(sz));
+ 	if (!page)
+ 		panic("iommu_init_table: Can't allocate %ld bytes\n", sz);
+ 	tbl->it_map = page_address(page);
+diff --git a/arch/powerpc/kernel/lparcfg.c b/arch/powerpc/kernel/lparcfg.c
+index 826681dc342a..26af24bbaed4 100644
+--- a/arch/powerpc/kernel/lparcfg.c
++++ b/arch/powerpc/kernel/lparcfg.c
+@@ -375,6 +375,7 @@ static void parse_system_parameter_string(struct seq_file *m)
+ 				__pa(rtas_data_buf),
+ 				RTAS_DATA_BUF_SIZE);
+ 	memcpy(local_buffer, rtas_data_buf, SPLPAR_MAXLENGTH);
++	local_buffer[SPLPAR_MAXLENGTH - 1] = '\0';
+ 	spin_unlock(&rtas_data_buf_lock);
+ 
+ 	if (call_status != 0) {
+diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
+index 55be64db0ae0..ca683a18943b 100644
+--- a/arch/powerpc/kernel/sysfs.c
++++ b/arch/powerpc/kernel/sysfs.c
+@@ -18,6 +18,7 @@
+ #include <asm/machdep.h>
+ #include <asm/smp.h>
+ #include <asm/pmc.h>
++#include <asm/firmware.h>
+ 
+ #include "cacheinfo.h"
+ 
+@@ -178,14 +179,24 @@ SYSFS_PMCSETUP(purr, SPRN_PURR);
+ SYSFS_PMCSETUP(spurr, SPRN_SPURR);
+ SYSFS_PMCSETUP(dscr, SPRN_DSCR);
+ 
++/*
++  Lets only enable read for phyp resources and
++  enable write when needed with a separate function.
++  Lets be conservative and default to pseries.
++*/
+ static SYSDEV_ATTR(mmcra, 0600, show_mmcra, store_mmcra);
+ static SYSDEV_ATTR(spurr, 0600, show_spurr, NULL);
+ static SYSDEV_ATTR(dscr, 0600, show_dscr, store_dscr);
+-static SYSDEV_ATTR(purr, 0600, show_purr, store_purr);
++static SYSDEV_ATTR(purr, 0400, show_purr, store_purr);
+ 
+ unsigned long dscr_default = 0;
+ EXPORT_SYMBOL(dscr_default);
+ 
++static void add_write_permission_dev_attr(struct sysdev_attribute *attr)
++{
++	attr->attr.mode |= 0200;
++}
++
+ static ssize_t show_dscr_default(struct sysdev_class *class,
+ 		struct sysdev_class_attribute *attr, char *buf)
+ {
+@@ -394,8 +405,11 @@ static void __cpuinit register_cpu_online(unsigned int cpu)
+ 	if (cpu_has_feature(CPU_FTR_MMCRA))
+ 		sysdev_create_file(s, &attr_mmcra);
+ 
+-	if (cpu_has_feature(CPU_FTR_PURR))
++	if (cpu_has_feature(CPU_FTR_PURR)) {
++		if (!firmware_has_feature(FW_FEATURE_LPAR))
++			add_write_permission_dev_attr(&attr_purr);
+ 		sysdev_create_file(s, &attr_purr);
++	}
+ 
+ 	if (cpu_has_feature(CPU_FTR_SPURR))
+ 		sysdev_create_file(s, &attr_spurr);
+diff --git a/arch/powerpc/lib/checksum_64.S b/arch/powerpc/lib/checksum_64.S
+index 18245af38aea..3cdbc648d979 100644
+--- a/arch/powerpc/lib/checksum_64.S
++++ b/arch/powerpc/lib/checksum_64.S
+@@ -229,19 +229,35 @@ _GLOBAL(csum_partial)
+ 	blr
+ 
+ 
+-	.macro source
++	.macro srcnr
+ 100:
+ 	.section __ex_table,"a"
+ 	.align 3
+-	.llong 100b,.Lsrc_error
++	.llong 100b,.Lsrc_error_nr
+ 	.previous
+ 	.endm
+ 
+-	.macro dest
++	.macro source
++150:
++	.section __ex_table,"a"
++	.align 3
++	.llong 150b,.Lsrc_error
++	.previous
++	.endm
++
++	.macro dstnr
+ 200:
+ 	.section __ex_table,"a"
+ 	.align 3
+-	.llong 200b,.Ldest_error
++	.llong 200b,.Ldest_error_nr
++	.previous
++	.endm
++
++	.macro dest
++250:
++	.section __ex_table,"a"
++	.align 3
++	.llong 250b,.Ldest_error
+ 	.previous
+ 	.endm
+ 
+@@ -272,16 +288,16 @@ _GLOBAL(csum_partial_copy_generic)
+ 	rldicl. r6,r3,64-1,64-2		/* r6 = (r3 & 0x3) >> 1 */
+ 	beq	.Lcopy_aligned
+ 
+-	li	r7,4
+-	sub	r6,r7,r6
++	li	r9,4
++	sub	r6,r9,r6
+ 	mtctr	r6
+ 
+ 1:
+-source;	lhz	r6,0(r3)		/* align to doubleword */
++srcnr;	lhz	r6,0(r3)		/* align to doubleword */
+ 	subi	r5,r5,2
+ 	addi	r3,r3,2
+ 	adde	r0,r0,r6
+-dest;	sth	r6,0(r4)
++dstnr;	sth	r6,0(r4)
+ 	addi	r4,r4,2
+ 	bdnz	1b
+ 
+@@ -395,10 +411,10 @@ dest;	std	r16,56(r4)
+ 
+ 	mtctr	r6
+ 3:
+-source;	ld	r6,0(r3)
++srcnr;	ld	r6,0(r3)
+ 	addi	r3,r3,8
+ 	adde	r0,r0,r6
+-dest;	std	r6,0(r4)
++dstnr;	std	r6,0(r4)
+ 	addi	r4,r4,8
+ 	bdnz	3b
+ 
+@@ -408,10 +424,10 @@ dest;	std	r6,0(r4)
+ 	srdi.	r6,r5,2
+ 	beq	.Lcopy_tail_halfword
+ 
+-source;	lwz	r6,0(r3)
++srcnr;	lwz	r6,0(r3)
+ 	addi	r3,r3,4
+ 	adde	r0,r0,r6
+-dest;	stw	r6,0(r4)
++dstnr;	stw	r6,0(r4)
+ 	addi	r4,r4,4
+ 	subi	r5,r5,4
+ 
+@@ -419,10 +435,10 @@ dest;	stw	r6,0(r4)
+ 	srdi.	r6,r5,1
+ 	beq	.Lcopy_tail_byte
+ 
+-source;	lhz	r6,0(r3)
++srcnr;	lhz	r6,0(r3)
+ 	addi	r3,r3,2
+ 	adde	r0,r0,r6
+-dest;	sth	r6,0(r4)
++dstnr;	sth	r6,0(r4)
+ 	addi	r4,r4,2
+ 	subi	r5,r5,2
+ 
+@@ -430,10 +446,10 @@ dest;	sth	r6,0(r4)
+ 	andi.	r6,r5,1
+ 	beq	.Lcopy_finish
+ 
+-source;	lbz	r6,0(r3)
++srcnr;	lbz	r6,0(r3)
+ 	sldi	r9,r6,8			/* Pad the byte out to 16 bits */
+ 	adde	r0,r0,r9
+-dest;	stb	r6,0(r4)
++dstnr;	stb	r6,0(r4)
+ 
+ .Lcopy_finish:
+ 	addze	r0,r0			/* add in final carry */
+@@ -443,6 +459,11 @@ dest;	stb	r6,0(r4)
+ 	blr
+ 
+ .Lsrc_error:
++	ld	r14,STK_REG(r14)(r1)
++	ld	r15,STK_REG(r15)(r1)
++	ld	r16,STK_REG(r16)(r1)
++	addi	r1,r1,STACKFRAMESIZE
++.Lsrc_error_nr:
+ 	cmpdi	0,r7,0
+ 	beqlr
+ 	li	r6,-EFAULT
+@@ -450,6 +471,11 @@ dest;	stb	r6,0(r4)
+ 	blr
+ 
+ .Ldest_error:
++	ld	r14,STK_REG(r14)(r1)
++	ld	r15,STK_REG(r15)(r1)
++	ld	r16,STK_REG(r16)(r1)
++	addi	r1,r1,STACKFRAMESIZE
++.Ldest_error_nr:
+ 	cmpdi	0,r8,0
+ 	beqlr
+ 	li	r6,-EFAULT
+diff --git a/arch/sparc/kernel/entry.S b/arch/sparc/kernel/entry.S
+index f445e98463e6..cfabc3d8821e 100644
+--- a/arch/sparc/kernel/entry.S
++++ b/arch/sparc/kernel/entry.S
+@@ -1177,7 +1177,7 @@ sys_sigreturn:
+ 	 nop
+ 
+ 	call	syscall_trace
+-	 nop
++	 mov	1, %o1
+ 
+ 1:
+ 	/* We don't want to muck with user registers like a
+diff --git a/arch/sparc/kernel/ktlb.S b/arch/sparc/kernel/ktlb.S
+index 79f310364849..7c0073500173 100644
+--- a/arch/sparc/kernel/ktlb.S
++++ b/arch/sparc/kernel/ktlb.S
+@@ -25,11 +25,10 @@ kvmap_itlb:
+ 	 */
+ kvmap_itlb_4v:
+ 
+-kvmap_itlb_nonlinear:
+ 	/* Catch kernel NULL pointer calls.  */
+ 	sethi		%hi(PAGE_SIZE), %g5
+ 	cmp		%g4, %g5
+-	bleu,pn		%xcc, kvmap_dtlb_longpath
++	blu,pn		%xcc, kvmap_itlb_longpath
+ 	 nop
+ 
+ 	KERN_TSB_LOOKUP_TL1(%g4, %g6, %g5, %g1, %g2, %g3, kvmap_itlb_load)
+diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
+index 7f5f65d0b3fd..817187d42777 100644
+--- a/arch/sparc/kernel/syscalls.S
++++ b/arch/sparc/kernel/syscalls.S
+@@ -147,7 +147,7 @@ linux_syscall_trace32:
+ 	srl	%i4, 0, %o4
+ 	srl	%i1, 0, %o1
+ 	srl	%i2, 0, %o2
+-	ba,pt	%xcc, 2f
++	ba,pt	%xcc, 5f
+ 	 srl	%i3, 0, %o3
+ 
+ linux_syscall_trace:
+@@ -177,13 +177,13 @@ linux_sparc_syscall32:
+ 	srl	%i1, 0, %o1				! IEU0	Group
+ 	ldx	[%g6 + TI_FLAGS], %l0		! Load
+ 
+-	srl	%i5, 0, %o5				! IEU1
++	srl	%i3, 0, %o3				! IEU0
+ 	srl	%i2, 0, %o2				! IEU0	Group
+ 	andcc	%l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %g0
+ 	bne,pn	%icc, linux_syscall_trace32		! CTI
+ 	 mov	%i0, %l5				! IEU1
+-	call	%l7					! CTI	Group brk forced
+-	 srl	%i3, 0, %o3				! IEU0
++5:	call	%l7					! CTI	Group brk forced
++	 srl	%i5, 0, %o5				! IEU1
+ 	ba,a,pt	%xcc, 3f
+ 
+ 	/* Linux native system calls enter here... */
+diff --git a/arch/sparc/kernel/trampoline_64.S b/arch/sparc/kernel/trampoline_64.S
+index da1b781b5e65..8fa84a3897cb 100644
+--- a/arch/sparc/kernel/trampoline_64.S
++++ b/arch/sparc/kernel/trampoline_64.S
+@@ -131,7 +131,6 @@ startup_continue:
+ 	clr		%l5
+ 	sethi		%hi(num_kernel_image_mappings), %l6
+ 	lduw		[%l6 + %lo(num_kernel_image_mappings)], %l6
+-	add		%l6, 1, %l6
+ 
+ 	mov		15, %l7
+ 	BRANCH_IF_ANY_CHEETAH(g1,g5,2f)
+@@ -224,7 +223,6 @@ niagara_lock_tlb:
+ 	clr		%l5
+ 	sethi		%hi(num_kernel_image_mappings), %l6
+ 	lduw		[%l6 + %lo(num_kernel_image_mappings)], %l6
+-	add		%l6, 1, %l6
+ 
+ 1:
+ 	mov		HV_FAST_MMU_MAP_PERM_ADDR, %o5
+diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
+index 1b30bb3bfdb1..fbb800533032 100644
+--- a/arch/sparc/lib/ksyms.c
++++ b/arch/sparc/lib/ksyms.c
+@@ -131,15 +131,6 @@ EXPORT_SYMBOL(___copy_from_user);
+ EXPORT_SYMBOL(___copy_in_user);
+ EXPORT_SYMBOL(__clear_user);
+ 
+-/* RW semaphores */
+-EXPORT_SYMBOL(__down_read);
+-EXPORT_SYMBOL(__down_read_trylock);
+-EXPORT_SYMBOL(__down_write);
+-EXPORT_SYMBOL(__down_write_trylock);
+-EXPORT_SYMBOL(__up_read);
+-EXPORT_SYMBOL(__up_write);
+-EXPORT_SYMBOL(__downgrade_write);
+-
+ /* Atomic counter implementation. */
+ EXPORT_SYMBOL(atomic_add);
+ EXPORT_SYMBOL(atomic_add_ret);
+diff --git a/arch/unicore32/mm/init.c b/arch/unicore32/mm/init.c
+index 3b379cddbc64..d1af4ed5694d 100644
+--- a/arch/unicore32/mm/init.c
++++ b/arch/unicore32/mm/init.c
+@@ -65,6 +65,9 @@ void show_mem(unsigned int filter)
+ 	printk(KERN_DEFAULT "Mem-info:\n");
+ 	show_free_areas(filter);
+ 
++	if (filter & SHOW_MEM_FILTER_PAGE_COUNT)
++		return;
++
+ 	for_each_bank(i, mi) {
+ 		struct membank *bank = &mi->bank[i];
+ 		unsigned int pfn1, pfn2;
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index 47f4e5ff55ac..a4e1b4bd4953 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -468,6 +468,22 @@ static struct dmi_system_id __initdata pci_reboot_dmi_table[] = {
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Precision M6600"),
+ 		},
+ 	},
++	{	/* Handle problems with rebooting on the Dell PowerEdge C6100. */
++		.callback = set_pci_reboot,
++		.ident = "Dell PowerEdge C6100",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "C6100"),
++		},
++	},
++	{	/* Some C6100 machines were shipped with vendor being 'Dell'. */
++		.callback = set_pci_reboot,
++		.ident = "Dell PowerEdge C6100",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "C6100"),
++		},
++	},
+ 	{ }
+ };
+ 
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index f9537e3044ff..a18d20d52740 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -703,10 +703,13 @@ void __init efi_enter_virtual_mode(void)
+ 
+ 	for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
+ 		md = p;
+-		if (!(md->attribute & EFI_MEMORY_RUNTIME) &&
+-		    md->type != EFI_BOOT_SERVICES_CODE &&
+-		    md->type != EFI_BOOT_SERVICES_DATA)
+-			continue;
++		if (!(md->attribute & EFI_MEMORY_RUNTIME)) {
++#ifdef CONFIG_X86_64
++			if (md->type != EFI_BOOT_SERVICES_CODE &&
++			    md->type != EFI_BOOT_SERVICES_DATA)
++#endif
++				continue;
++		}
+ 
+ 		size = md->num_pages << EFI_PAGE_SHIFT;
+ 		end = md->phys_addr + size;
+diff --git a/crypto/api.c b/crypto/api.c
+index 033a7147e5eb..cea3cf6c9897 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -34,6 +34,8 @@ EXPORT_SYMBOL_GPL(crypto_alg_sem);
+ BLOCKING_NOTIFIER_HEAD(crypto_chain);
+ EXPORT_SYMBOL_GPL(crypto_chain);
+ 
++static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg);
++
+ static inline struct crypto_alg *crypto_alg_get(struct crypto_alg *alg)
+ {
+ 	atomic_inc(&alg->cra_refcnt);
+@@ -150,8 +152,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,
+ 	}
+ 	up_write(&crypto_alg_sem);
+ 
+-	if (alg != &larval->alg)
++	if (alg != &larval->alg) {
+ 		kfree(larval);
++		if (crypto_is_larval(alg))
++			alg = crypto_larval_wait(alg);
++	}
+ 
+ 	return alg;
+ }
+diff --git a/drivers/acpi/acpi_ipmi.c b/drivers/acpi/acpi_ipmi.c
+index f40acef80269..a6977e12d574 100644
+--- a/drivers/acpi/acpi_ipmi.c
++++ b/drivers/acpi/acpi_ipmi.c
+@@ -39,6 +39,7 @@
+ #include <linux/ipmi.h>
+ #include <linux/device.h>
+ #include <linux/pnp.h>
++#include <linux/spinlock.h>
+ 
+ MODULE_AUTHOR("Zhao Yakui");
+ MODULE_DESCRIPTION("ACPI IPMI Opregion driver");
+@@ -57,7 +58,7 @@ struct acpi_ipmi_device {
+ 	struct list_head head;
+ 	/* the IPMI request message list */
+ 	struct list_head tx_msg_list;
+-	struct mutex	tx_msg_lock;
++	spinlock_t	tx_msg_lock;
+ 	acpi_handle handle;
+ 	struct pnp_dev *pnp_dev;
+ 	ipmi_user_t	user_interface;
+@@ -147,6 +148,7 @@ static void acpi_format_ipmi_msg(struct acpi_ipmi_msg *tx_msg,
+ 	struct kernel_ipmi_msg *msg;
+ 	struct acpi_ipmi_buffer *buffer;
+ 	struct acpi_ipmi_device *device;
++	unsigned long flags;
+ 
+ 	msg = &tx_msg->tx_message;
+ 	/*
+@@ -177,10 +179,10 @@ static void acpi_format_ipmi_msg(struct acpi_ipmi_msg *tx_msg,
+ 
+ 	/* Get the msgid */
+ 	device = tx_msg->device;
+-	mutex_lock(&device->tx_msg_lock);
++	spin_lock_irqsave(&device->tx_msg_lock, flags);
+ 	device->curr_msgid++;
+ 	tx_msg->tx_msgid = device->curr_msgid;
+-	mutex_unlock(&device->tx_msg_lock);
++	spin_unlock_irqrestore(&device->tx_msg_lock, flags);
+ }
+ 
+ static void acpi_format_ipmi_response(struct acpi_ipmi_msg *msg,
+@@ -242,6 +244,7 @@ static void ipmi_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data)
+ 	int msg_found = 0;
+ 	struct acpi_ipmi_msg *tx_msg;
+ 	struct pnp_dev *pnp_dev = ipmi_device->pnp_dev;
++	unsigned long flags;
+ 
+ 	if (msg->user != ipmi_device->user_interface) {
+ 		dev_warn(&pnp_dev->dev, "Unexpected response is returned. "
+@@ -250,7 +253,7 @@ static void ipmi_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data)
+ 		ipmi_free_recv_msg(msg);
+ 		return;
+ 	}
+-	mutex_lock(&ipmi_device->tx_msg_lock);
++	spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
+ 	list_for_each_entry(tx_msg, &ipmi_device->tx_msg_list, head) {
+ 		if (msg->msgid == tx_msg->tx_msgid) {
+ 			msg_found = 1;
+@@ -258,7 +261,7 @@ static void ipmi_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data)
+ 		}
+ 	}
+ 
+-	mutex_unlock(&ipmi_device->tx_msg_lock);
++	spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
+ 	if (!msg_found) {
+ 		dev_warn(&pnp_dev->dev, "Unexpected response (msg id %ld) is "
+ 			"returned.\n", msg->msgid);
+@@ -378,6 +381,7 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
+ 	struct acpi_ipmi_device *ipmi_device = handler_context;
+ 	int err, rem_time;
+ 	acpi_status status;
++	unsigned long flags;
+ 	/*
+ 	 * IPMI opregion message.
+ 	 * IPMI message is firstly written to the BMC and system software
+@@ -395,9 +399,9 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
+ 		return AE_NO_MEMORY;
+ 
+ 	acpi_format_ipmi_msg(tx_msg, address, value);
+-	mutex_lock(&ipmi_device->tx_msg_lock);
++	spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
+ 	list_add_tail(&tx_msg->head, &ipmi_device->tx_msg_list);
+-	mutex_unlock(&ipmi_device->tx_msg_lock);
++	spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
+ 	err = ipmi_request_settime(ipmi_device->user_interface,
+ 					&tx_msg->addr,
+ 					tx_msg->tx_msgid,
+@@ -413,9 +417,9 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
+ 	status = AE_OK;
+ 
+ end_label:
+-	mutex_lock(&ipmi_device->tx_msg_lock);
++	spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
+ 	list_del(&tx_msg->head);
+-	mutex_unlock(&ipmi_device->tx_msg_lock);
++	spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
+ 	kfree(tx_msg);
+ 	return status;
+ }
+@@ -457,7 +461,7 @@ static void acpi_add_ipmi_device(struct acpi_ipmi_device *ipmi_device)
+ 
+ 	INIT_LIST_HEAD(&ipmi_device->head);
+ 
+-	mutex_init(&ipmi_device->tx_msg_lock);
++	spin_lock_init(&ipmi_device->tx_msg_lock);
+ 	INIT_LIST_HEAD(&ipmi_device->tx_msg_list);
+ 	ipmi_install_space_handler(ipmi_device);
+ 
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 51de186a8bfd..8176b82b2e4c 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -964,6 +964,10 @@ static struct dmi_system_id __initdata ec_dmi_table[] = {
+ 	ec_enlarge_storm_threshold, "CLEVO hardware", {
+ 	DMI_MATCH(DMI_SYS_VENDOR, "CLEVO Co."),
+ 	DMI_MATCH(DMI_PRODUCT_NAME, "M720T/M730T"),}, NULL},
++	{
++	ec_validate_ecdt, "ASUS hardware", {
++	DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek Computer Inc."),
++	DMI_MATCH(DMI_PRODUCT_NAME, "L4R"),}, NULL},
+ 	{},
+ };
+ 
+diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
+index d3446f628d54..d7ad86536b3e 100644
+--- a/drivers/block/cciss.c
++++ b/drivers/block/cciss.c
+@@ -1186,6 +1186,7 @@ static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
+ 	int err;
+ 	u32 cp;
+ 
++	memset(&arg64, 0, sizeof(arg64));
+ 	err = 0;
+ 	err |=
+ 	    copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
+diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
+index 9125bbeacd4d..504bc16e4506 100644
+--- a/drivers/block/cpqarray.c
++++ b/drivers/block/cpqarray.c
+@@ -1195,6 +1195,7 @@ out_passthru:
+ 		ida_pci_info_struct pciinfo;
+ 
+ 		if (!arg) return -EINVAL;
++		memset(&pciinfo, 0, sizeof(pciinfo));
+ 		pciinfo.bus = host->pci_dev->bus->number;
+ 		pciinfo.dev_fn = host->pci_dev->devfn;
+ 		pciinfo.board_id = host->board_id;
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index bde72f714789..3539f9b1e002 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -84,6 +84,7 @@ static struct usb_device_id ath3k_table[] = {
+ 	{ USB_DEVICE(0x04CA, 0x3008) },
+ 	{ USB_DEVICE(0x13d3, 0x3362) },
+ 	{ USB_DEVICE(0x0CF3, 0xE004) },
++	{ USB_DEVICE(0x0CF3, 0xE005) },
+ 	{ USB_DEVICE(0x0930, 0x0219) },
+ 	{ USB_DEVICE(0x0489, 0xe057) },
+ 	{ USB_DEVICE(0x13d3, 0x3393) },
+@@ -125,6 +126,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ 	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 1bd3924c332a..f18b5a28f10c 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -108,6 +108,7 @@ static struct usb_device_id btusb_table[] = {
+ 
+ 	/* Broadcom BCM20702A0 */
+ 	{ USB_DEVICE(0x0b05, 0x17b5) },
++	{ USB_DEVICE(0x0b05, 0x17cb) },
+ 	{ USB_DEVICE(0x04ca, 0x2003) },
+ 	{ USB_DEVICE(0x0489, 0xe042) },
+ 	{ USB_DEVICE(0x413c, 0x8197) },
+@@ -154,6 +155,7 @@ static struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 7211f67d5bf4..72f460e22b76 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -125,6 +125,9 @@ static struct edid_quirk {
+ 
+ 	/* ViewSonic VA2026w */
+ 	{ "VSC", 5020, EDID_QUIRK_FORCE_REDUCED_BLANKING },
++
++	/* Medion MD 30217 PG */
++	{ "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
+ };
+ 
+ /*** DDC fetch and block validation ***/
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index a07ccab34016..72163e87f0da 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -621,7 +621,18 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
+ 			DRM_DEBUG_KMS("aux_ch native nack\n");
+ 			return -EREMOTEIO;
+ 		case AUX_NATIVE_REPLY_DEFER:
+-			udelay(100);
++			/*
++			 * For now, just give more slack to branch devices. We
++			 * could check the DPCD for I2C bit rate capabilities,
++			 * and if available, adjust the interval. We could also
++			 * be more careful with DP-to-Legacy adapters where a
++			 * long legacy cable may force very low I2C bit rates.
++			 */
++			if (intel_dp->dpcd[DP_DOWNSTREAMPORT_PRESENT] &
++			    DP_DWN_STRM_PORT_PRESENT)
++				usleep_range(500, 600);
++			else
++				usleep_range(300, 400);
+ 			continue;
+ 		default:
+ 			DRM_ERROR("aux_ch invalid native reply 0x%02x\n",
+diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
+index cffb0071f877..356a252e6861 100644
+--- a/drivers/gpu/drm/i915/intel_opregion.c
++++ b/drivers/gpu/drm/i915/intel_opregion.c
+@@ -161,7 +161,7 @@ static u32 asle_set_backlight(struct drm_device *dev, u32 bclp)
+ 
+ 	max = intel_panel_get_max_backlight(dev);
+ 	intel_panel_set_backlight(dev, bclp * max / 255);
+-	asle->cblv = (bclp*0x64)/0xff | ASLE_CBLV_VALID;
++	asle->cblv = DIV_ROUND_UP(bclp * 100, 255) | ASLE_CBLV_VALID;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index f0dc04b3c70b..317129406451 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -1385,8 +1385,12 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
+ 			atombios_dig_encoder_setup(encoder, ATOM_ENABLE, 0);
+ 			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0);
+ 			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
+-			/* some early dce3.2 boards have a bug in their transmitter control table */
+-			if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730))
++			/* some dce3.x boards have a bug in their transmitter control table.
++			 * ACTION_ENABLE_OUTPUT can probably be dropped since ACTION_ENABLE
++			 * does the same thing and more.
++			 */
++			if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730) &&
++			    (rdev->family != CHIP_RS880))
+ 				atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
+ 		}
+ 		if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index f5962a0832f9..a68057a03c6d 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -501,7 +501,8 @@ static u32 evergreen_line_buffer_adjust(struct radeon_device *rdev,
+ 					struct drm_display_mode *mode,
+ 					struct drm_display_mode *other_mode)
+ {
+-	u32 tmp;
++	u32 tmp, buffer_alloc, i;
++	u32 pipe_offset = radeon_crtc->crtc_id * 0x20;
+ 	/*
+ 	 * Line Buffer Setup
+ 	 * There are 3 line buffers, each one shared by 2 display controllers.
+@@ -524,18 +525,34 @@ static u32 evergreen_line_buffer_adjust(struct radeon_device *rdev,
+ 	 * non-linked crtcs for maximum line buffer allocation.
+ 	 */
+ 	if (radeon_crtc->base.enabled && mode) {
+-		if (other_mode)
++		if (other_mode) {
+ 			tmp = 0; /* 1/2 */
+-		else
++			buffer_alloc = 1;
++		} else {
+ 			tmp = 2; /* whole */
+-	} else
++			buffer_alloc = 2;
++		}
++	} else {
+ 		tmp = 0;
++		buffer_alloc = 0;
++	}
+ 
+ 	/* second controller of the pair uses second half of the lb */
+ 	if (radeon_crtc->crtc_id % 2)
+ 		tmp += 4;
+ 	WREG32(DC_LB_MEMORY_SPLIT + radeon_crtc->crtc_offset, tmp);
+ 
++	if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
++		WREG32(PIPE0_DMIF_BUFFER_CONTROL + pipe_offset,
++		       DMIF_BUFFERS_ALLOCATED(buffer_alloc));
++		for (i = 0; i < rdev->usec_timeout; i++) {
++			if (RREG32(PIPE0_DMIF_BUFFER_CONTROL + pipe_offset) &
++			    DMIF_BUFFERS_ALLOCATED_COMPLETED)
++				break;
++			udelay(1);
++		}
++	}
++
+ 	if (radeon_crtc->base.enabled && mode) {
+ 		switch (tmp) {
+ 		case 0:
+diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
+index fe44a953bac9..47f3bd2753f7 100644
+--- a/drivers/gpu/drm/radeon/evergreend.h
++++ b/drivers/gpu/drm/radeon/evergreend.h
+@@ -459,6 +459,10 @@
+ #       define LATENCY_LOW_WATERMARK(x)                   ((x) << 0)
+ #       define LATENCY_HIGH_WATERMARK(x)                  ((x) << 16)
+ 
++#define	PIPE0_DMIF_BUFFER_CONTROL			  0x0ca0
++#       define DMIF_BUFFERS_ALLOCATED(x)                  ((x) << 0)
++#       define DMIF_BUFFERS_ALLOCATED_COMPLETED           (1 << 4)
++
+ #define IH_RB_CNTL                                        0x3e00
+ #       define IH_RB_ENABLE                               (1 << 0)
+ #       define IH_IB_SIZE(x)                              ((x) << 1) /* log2 */
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index 383b38ebb048..cda89c6b74f8 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -709,13 +709,16 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
+ 								(ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT *)
+ 								(ctx->bios + data_offset +
+ 								 le16_to_cpu(router_obj->asObjects[k].usSrcDstTableOffset));
++							u8 *num_dst_objs = (u8 *)
++								((u8 *)router_src_dst_table + 1 +
++								 (router_src_dst_table->ucNumberOfSrc * 2));
++							u16 *dst_objs = (u16 *)(num_dst_objs + 1);
+ 							int enum_id;
+ 
+ 							router.router_id = router_obj_id;
+-							for (enum_id = 0; enum_id < router_src_dst_table->ucNumberOfDst;
+-							     enum_id++) {
++							for (enum_id = 0; enum_id < (*num_dst_objs); enum_id++) {
+ 								if (le16_to_cpu(path->usConnObjectId) ==
+-								    le16_to_cpu(router_src_dst_table->usDstObjectID[enum_id]))
++								    le16_to_cpu(dst_objs[enum_id]))
+ 									break;
+ 							}
+ 
+@@ -1616,7 +1619,9 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct
+ 								kfree(edid);
+ 						}
+ 					}
+-					record += sizeof(ATOM_FAKE_EDID_PATCH_RECORD);
++					record += fake_edid_record->ucFakeEDIDLength ?
++						fake_edid_record->ucFakeEDIDLength + 2 :
++						sizeof(ATOM_FAKE_EDID_PATCH_RECORD);
+ 					break;
+ 				case LCD_PANEL_RESOLUTION_RECORD_TYPE:
+ 					panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index 6fd53b644dfc..b101843bff73 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -1387,6 +1387,24 @@ struct drm_connector_funcs radeon_dp_connector_funcs = {
+ 	.force = radeon_dvi_force,
+ };
+ 
++static const struct drm_connector_funcs radeon_edp_connector_funcs = {
++	.dpms = drm_helper_connector_dpms,
++	.detect = radeon_dp_detect,
++	.fill_modes = drm_helper_probe_single_connector_modes,
++	.set_property = radeon_lvds_set_property,
++	.destroy = radeon_dp_connector_destroy,
++	.force = radeon_dvi_force,
++};
++
++static const struct drm_connector_funcs radeon_lvds_bridge_connector_funcs = {
++	.dpms = drm_helper_connector_dpms,
++	.detect = radeon_dp_detect,
++	.fill_modes = drm_helper_probe_single_connector_modes,
++	.set_property = radeon_lvds_set_property,
++	.destroy = radeon_dp_connector_destroy,
++	.force = radeon_dvi_force,
++};
++
+ void
+ radeon_add_atom_connector(struct drm_device *dev,
+ 			  uint32_t connector_id,
+@@ -1478,8 +1496,6 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 			goto failed;
+ 		radeon_dig_connector->igp_lane_info = igp_lane_info;
+ 		radeon_connector->con_priv = radeon_dig_connector;
+-		drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type);
+-		drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs);
+ 		if (i2c_bus->valid) {
+ 			/* add DP i2c bus */
+ 			if (connector_type == DRM_MODE_CONNECTOR_eDP)
+@@ -1496,6 +1512,10 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 		case DRM_MODE_CONNECTOR_VGA:
+ 		case DRM_MODE_CONNECTOR_DVIA:
+ 		default:
++			drm_connector_init(dev, &radeon_connector->base,
++					   &radeon_dp_connector_funcs, connector_type);
++			drm_connector_helper_add(&radeon_connector->base,
++						 &radeon_dp_connector_helper_funcs);
+ 			connector->interlace_allowed = true;
+ 			connector->doublescan_allowed = true;
+ 			radeon_connector->dac_load_detect = true;
+@@ -1508,6 +1528,10 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 		case DRM_MODE_CONNECTOR_HDMIA:
+ 		case DRM_MODE_CONNECTOR_HDMIB:
+ 		case DRM_MODE_CONNECTOR_DisplayPort:
++			drm_connector_init(dev, &radeon_connector->base,
++					   &radeon_dp_connector_funcs, connector_type);
++			drm_connector_helper_add(&radeon_connector->base,
++						 &radeon_dp_connector_helper_funcs);
+ 			drm_connector_attach_property(&radeon_connector->base,
+ 						      rdev->mode_info.underscan_property,
+ 						      UNDERSCAN_OFF);
+@@ -1532,6 +1556,10 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 			break;
+ 		case DRM_MODE_CONNECTOR_LVDS:
+ 		case DRM_MODE_CONNECTOR_eDP:
++			drm_connector_init(dev, &radeon_connector->base,
++					   &radeon_lvds_bridge_connector_funcs, connector_type);
++			drm_connector_helper_add(&radeon_connector->base,
++						 &radeon_dp_connector_helper_funcs);
+ 			drm_connector_attach_property(&radeon_connector->base,
+ 						      dev->mode_config.scaling_mode_property,
+ 						      DRM_MODE_SCALE_FULLSCREEN);
+@@ -1695,7 +1723,7 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 				goto failed;
+ 			radeon_dig_connector->igp_lane_info = igp_lane_info;
+ 			radeon_connector->con_priv = radeon_dig_connector;
+-			drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type);
++			drm_connector_init(dev, &radeon_connector->base, &radeon_edp_connector_funcs, connector_type);
+ 			drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs);
+ 			if (i2c_bus->valid) {
+ 				/* add DP i2c bus */
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index cd94abb1d776..8cde84b666d5 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -818,10 +818,16 @@ int radeon_device_init(struct radeon_device *rdev,
+ 			return r;
+ 	}
+ 	if (radeon_testing) {
+-		radeon_test_moves(rdev);
++		if (rdev->accel_working)
++			radeon_test_moves(rdev);
++		else
++			DRM_INFO("radeon: acceleration disabled, skipping move tests\n");
+ 	}
+ 	if (radeon_benchmarking) {
+-		radeon_benchmark(rdev, radeon_benchmarking);
++		if (rdev->accel_working)
++			radeon_benchmark(rdev, radeon_benchmarking);
++		else
++			DRM_INFO("radeon: acceleration disabled, skipping benchmarks\n");
+ 	}
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
+index 4dd9512fcc5d..c0874341b1a0 100644
+--- a/drivers/gpu/drm/radeon/rs400.c
++++ b/drivers/gpu/drm/radeon/rs400.c
+@@ -174,10 +174,13 @@ int rs400_gart_enable(struct radeon_device *rdev)
+ 	/* FIXME: according to doc we should set HIDE_MMCFG_BAR=0,
+ 	 * AGPMODE30=0 & AGP30ENHANCED=0 in NB_CNTL */
+ 	if ((rdev->family == CHIP_RS690) || (rdev->family == CHIP_RS740)) {
+-		WREG32_MC(RS480_MC_MISC_CNTL,
+-			  (RS480_GART_INDEX_REG_EN | RS690_BLOCK_GFX_D3_EN));
++		tmp = RREG32_MC(RS480_MC_MISC_CNTL);
++		tmp |= RS480_GART_INDEX_REG_EN | RS690_BLOCK_GFX_D3_EN;
++		WREG32_MC(RS480_MC_MISC_CNTL, tmp);
+ 	} else {
+-		WREG32_MC(RS480_MC_MISC_CNTL, RS480_GART_INDEX_REG_EN);
++		tmp = RREG32_MC(RS480_MC_MISC_CNTL);
++		tmp |= RS480_GART_INDEX_REG_EN;
++		WREG32_MC(RS480_MC_MISC_CNTL, tmp);
+ 	}
+ 	/* Enable gart */
+ 	WREG32_MC(RS480_AGP_ADDRESS_SPACE_SIZE, (RS480_GART_EN | size_reg));
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 611aafc20f90..9ac4389ecfa2 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -59,6 +59,8 @@ struct hid_report *hid_register_report(struct hid_device *device, unsigned type,
+ 	struct hid_report_enum *report_enum = device->report_enum + type;
+ 	struct hid_report *report;
+ 
++	if (id >= HID_MAX_IDS)
++		return NULL;
+ 	if (report_enum->report_id_hash[id])
+ 		return report_enum->report_id_hash[id];
+ 
+@@ -216,9 +218,9 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
+ {
+ 	struct hid_report *report;
+ 	struct hid_field *field;
+-	int usages;
++	unsigned usages;
+ 	unsigned offset;
+-	int i;
++	unsigned i;
+ 
+ 	report = hid_register_report(parser->device, report_type, parser->global.report_id);
+ 	if (!report) {
+@@ -237,7 +239,8 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
+ 	if (!parser->local.usage_index) /* Ignore padding fields */
+ 		return 0;
+ 
+-	usages = max_t(int, parser->local.usage_index, parser->global.report_count);
++	usages = max_t(unsigned, parser->local.usage_index,
++				 parser->global.report_count);
+ 
+ 	field = hid_register_field(report, usages, parser->global.report_count);
+ 	if (!field)
+@@ -248,7 +251,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
+ 	field->application = hid_lookup_collection(parser, HID_COLLECTION_APPLICATION);
+ 
+ 	for (i = 0; i < usages; i++) {
+-		int j = i;
++		unsigned j = i;
+ 		/* Duplicate the last usage we parsed if we have excess values */
+ 		if (i >= parser->local.usage_index)
+ 			j = parser->local.usage_index - 1;
+@@ -380,8 +383,10 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
+ 
+ 	case HID_GLOBAL_ITEM_TAG_REPORT_ID:
+ 		parser->global.report_id = item_udata(item);
+-		if (parser->global.report_id == 0) {
+-			dbg_hid("report_id 0 is invalid\n");
++		if (parser->global.report_id == 0 ||
++		    parser->global.report_id >= HID_MAX_IDS) {
++			dbg_hid("report_id %u is invalid\n",
++				parser->global.report_id);
+ 			return -1;
+ 		}
+ 		return 0;
+@@ -552,7 +557,7 @@ static void hid_device_release(struct device *dev)
+ 	for (i = 0; i < HID_REPORT_TYPES; i++) {
+ 		struct hid_report_enum *report_enum = device->report_enum + i;
+ 
+-		for (j = 0; j < 256; j++) {
++		for (j = 0; j < HID_MAX_IDS; j++) {
+ 			struct hid_report *report = report_enum->report_id_hash[j];
+ 			if (report)
+ 				hid_free_report(report);
+@@ -710,6 +715,64 @@ err:
+ }
+ EXPORT_SYMBOL_GPL(hid_parse_report);
+ 
++static const char * const hid_report_names[] = {
++	"HID_INPUT_REPORT",
++	"HID_OUTPUT_REPORT",
++	"HID_FEATURE_REPORT",
++};
++/**
++ * hid_validate_values - validate existing device report's value indexes
++ *
++ * @device: hid device
++ * @type: which report type to examine
++ * @id: which report ID to examine (0 for first)
++ * @field_index: which report field to examine
++ * @report_counts: expected number of values
++ *
++ * Validate the number of values in a given field of a given report, after
++ * parsing.
++ */
++struct hid_report *hid_validate_values(struct hid_device *hid,
++				       unsigned int type, unsigned int id,
++				       unsigned int field_index,
++				       unsigned int report_counts)
++{
++	struct hid_report *report;
++
++	if (type > HID_FEATURE_REPORT) {
++		hid_err(hid, "invalid HID report type %u\n", type);
++		return NULL;
++	}
++
++	if (id >= HID_MAX_IDS) {
++		hid_err(hid, "invalid HID report id %u\n", id);
++		return NULL;
++	}
++
++	/*
++	 * Explicitly not using hid_get_report() here since it depends on
++	 * ->numbered being checked, which may not always be the case when
++	 * drivers go to access report values.
++	 */
++	report = hid->report_enum[type].report_id_hash[id];
++	if (!report) {
++		hid_err(hid, "missing %s %u\n", hid_report_names[type], id);
++		return NULL;
++	}
++	if (report->maxfield <= field_index) {
++		hid_err(hid, "not enough fields in %s %u\n",
++			hid_report_names[type], id);
++		return NULL;
++	}
++	if (report->field[field_index]->report_count < report_counts) {
++		hid_err(hid, "not enough values in %s %u field %u\n",
++			hid_report_names[type], id, field_index);
++		return NULL;
++	}
++	return report;
++}
++EXPORT_SYMBOL_GPL(hid_validate_values);
++
+ /*
+  * Convert a signed n-bit integer to signed 32-bit integer. Common
+  * cases are done through the compiler, the screwed things has to be
+@@ -990,7 +1053,12 @@ EXPORT_SYMBOL_GPL(hid_output_report);
+ 
+ int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
+ {
+-	unsigned size = field->report_size;
++	unsigned size;
++
++	if (!field)
++		return -1;
++
++	size = field->report_size;
+ 
+ 	hid_dump_input(field->report->device, field->usage + offset, value);
+ 
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 08075f274339..ca2b3e6c4e9f 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -581,6 +581,7 @@
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16   0x0012
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17   0x0013
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18   0x0014
++#define USB_DEVICE_ID_NTRIG_DUOSENSE 0x1500
+ 
+ #define USB_VENDOR_ID_ONTRAK		0x0a07
+ #define USB_DEVICE_ID_ONTRAK_ADU100	0x0064
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index f333139d1a48..95c79a365c98 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -284,6 +284,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
+ 	if (field->flags & HID_MAIN_ITEM_CONSTANT)
+ 		goto ignore;
+ 
++	/* Ignore if report count is out of bounds. */
++	if (field->report_count < 1)
++		goto ignore;
++
+ 	/* only LED usages are supported in output fields */
+ 	if (field->report_type == HID_OUTPUT_REPORT &&
+ 			(usage->hid & HID_USAGE_PAGE) != HID_UP_LED) {
+@@ -887,10 +891,15 @@ static void report_features(struct hid_device *hid)
+ 
+ 	rep_enum = &hid->report_enum[HID_FEATURE_REPORT];
+ 	list_for_each_entry(rep, &rep_enum->report_list, list)
+-		for (i = 0; i < rep->maxfield; i++)
++		for (i = 0; i < rep->maxfield; i++) {
++			/* Ignore if report count is out of bounds. */
++			if (rep->field[i]->report_count < 1)
++				continue;
++
+ 			for (j = 0; j < rep->field[i]->maxusage; j++)
+ 				drv->feature_mapping(hid, rep->field[i],
+ 						     rep->field[i]->usage + j);
++		}
+ }
+ 
+ /*
+diff --git a/drivers/hid/hid-lg2ff.c b/drivers/hid/hid-lg2ff.c
+index 3c31bc650e5d..128f0117c7a7 100644
+--- a/drivers/hid/hid-lg2ff.c
++++ b/drivers/hid/hid-lg2ff.c
+@@ -66,26 +66,13 @@ int lg2ff_init(struct hid_device *hid)
+ 	struct hid_report *report;
+ 	struct hid_input *hidinput = list_entry(hid->inputs.next,
+ 						struct hid_input, list);
+-	struct list_head *report_list =
+-			&hid->report_enum[HID_OUTPUT_REPORT].report_list;
+ 	struct input_dev *dev = hidinput->input;
+ 	int error;
+ 
+-	if (list_empty(report_list)) {
+-		hid_err(hid, "no output report found\n");
++	/* Check that the report looks ok */
++	report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7);
++	if (!report)
+ 		return -ENODEV;
+-	}
+-
+-	report = list_entry(report_list->next, struct hid_report, list);
+-
+-	if (report->maxfield < 1) {
+-		hid_err(hid, "output report is empty\n");
+-		return -ENODEV;
+-	}
+-	if (report->field[0]->report_count < 7) {
+-		hid_err(hid, "not enough values in the field\n");
+-		return -ENODEV;
+-	}
+ 
+ 	lg2ff = kmalloc(sizeof(struct lg2ff_device), GFP_KERNEL);
+ 	if (!lg2ff)
+diff --git a/drivers/hid/hid-lg3ff.c b/drivers/hid/hid-lg3ff.c
+index f98644c26c1d..91f981ff5601 100644
+--- a/drivers/hid/hid-lg3ff.c
++++ b/drivers/hid/hid-lg3ff.c
+@@ -68,10 +68,11 @@ static int hid_lg3ff_play(struct input_dev *dev, void *data,
+ 	int x, y;
+ 
+ /*
+- * Maxusage should always be 63 (maximum fields)
+- * likely a better way to ensure this data is clean
++ * Available values in the field should always be 63, but we only use up to
++ * 35. Instead, clear the entire area, however big it is.
+  */
+-	memset(report->field[0]->value, 0, sizeof(__s32)*report->field[0]->maxusage);
++	memset(report->field[0]->value, 0,
++	       sizeof(__s32) * report->field[0]->report_count);
+ 
+ 	switch (effect->type) {
+ 	case FF_CONSTANT:
+@@ -131,32 +132,14 @@ static const signed short ff3_joystick_ac[] = {
+ int lg3ff_init(struct hid_device *hid)
+ {
+ 	struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+-	struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
+ 	struct input_dev *dev = hidinput->input;
+-	struct hid_report *report;
+-	struct hid_field *field;
+ 	const signed short *ff_bits = ff3_joystick_ac;
+ 	int error;
+ 	int i;
+ 
+-	/* Find the report to use */
+-	if (list_empty(report_list)) {
+-		hid_err(hid, "No output report found\n");
+-		return -1;
+-	}
+-
+ 	/* Check that the report looks ok */
+-	report = list_entry(report_list->next, struct hid_report, list);
+-	if (!report) {
+-		hid_err(hid, "NULL output report\n");
+-		return -1;
+-	}
+-
+-	field = report->field[0];
+-	if (!field) {
+-		hid_err(hid, "NULL field\n");
+-		return -1;
+-	}
++	if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 35))
++		return -ENODEV;
+ 
+ 	/* Assume single fixed device G940 */
+ 	for (i = 0; ff_bits[i] >= 0; i++)
+diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
+index 103f30d93f76..5c6bf4b5c533 100644
+--- a/drivers/hid/hid-lg4ff.c
++++ b/drivers/hid/hid-lg4ff.c
+@@ -339,33 +339,15 @@ static ssize_t lg4ff_range_store(struct device *dev, struct device_attribute *at
+ int lg4ff_init(struct hid_device *hid)
+ {
+ 	struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+-	struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
+ 	struct input_dev *dev = hidinput->input;
+-	struct hid_report *report;
+-	struct hid_field *field;
+ 	struct lg4ff_device_entry *entry;
+ 	struct usb_device_descriptor *udesc;
+ 	int error, i, j;
+ 	__u16 bcdDevice, rev_maj, rev_min;
+ 
+-	/* Find the report to use */
+-	if (list_empty(report_list)) {
+-		hid_err(hid, "No output report found\n");
+-		return -1;
+-	}
+-
+ 	/* Check that the report looks ok */
+-	report = list_entry(report_list->next, struct hid_report, list);
+-	if (!report) {
+-		hid_err(hid, "NULL output report\n");
++	if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7))
+ 		return -1;
+-	}
+-
+-	field = report->field[0];
+-	if (!field) {
+-		hid_err(hid, "NULL field\n");
+-		return -1;
+-	}
+ 
+ 	/* Check what wheel has been connected */
+ 	for (i = 0; i < ARRAY_SIZE(lg4ff_devices); i++) {
+diff --git a/drivers/hid/hid-lgff.c b/drivers/hid/hid-lgff.c
+index 27bc54f92f44..1d978daa70d7 100644
+--- a/drivers/hid/hid-lgff.c
++++ b/drivers/hid/hid-lgff.c
+@@ -130,27 +130,14 @@ static void hid_lgff_set_autocenter(struct input_dev *dev, u16 magnitude)
+ int lgff_init(struct hid_device* hid)
+ {
+ 	struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+-	struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
+ 	struct input_dev *dev = hidinput->input;
+-	struct hid_report *report;
+-	struct hid_field *field;
+ 	const signed short *ff_bits = ff_joystick;
+ 	int error;
+ 	int i;
+ 
+-	/* Find the report to use */
+-	if (list_empty(report_list)) {
+-		hid_err(hid, "No output report found\n");
+-		return -1;
+-	}
+-
+ 	/* Check that the report looks ok */
+-	report = list_entry(report_list->next, struct hid_report, list);
+-	field = report->field[0];
+-	if (!field) {
+-		hid_err(hid, "NULL field\n");
+-		return -1;
+-	}
++	if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7))
++		return -ENODEV;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(devices); i++) {
+ 		if (dev->id.vendor == devices[i].idVendor &&
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index 8821ecc9751f..828a0dd2a5ab 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -791,6 +791,12 @@ static int logi_dj_probe(struct hid_device *hdev,
+ 		goto hid_parse_fail;
+ 	}
+ 
++	if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, REPORT_ID_DJ_SHORT,
++				 0, DJREPORT_SHORT_LENGTH - 1)) {
++		retval = -ENODEV;
++		goto hid_parse_fail;
++	}
++
+ 	/* Starts the usb device and connects to upper interfaces hiddev and
+ 	 * hidraw */
+ 	retval = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index 9fae2ebdd758..48cba8570469 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev)
+ 	struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT].
+ 				    report_id_hash[0x0d];
+ 
+-	if (!report)
++	if (!report || report->maxfield < 1 ||
++	    report->field[0]->report_count < 1)
+ 		return -EINVAL;
+ 
+ 	usbhid_submit_report(hdev, report, USB_DIR_IN);
+diff --git a/drivers/hid/hid-picolcd.c b/drivers/hid/hid-picolcd.c
+index 01e7d2cd7c26..1daeacabc832 100644
+--- a/drivers/hid/hid-picolcd.c
++++ b/drivers/hid/hid-picolcd.c
+@@ -1424,7 +1424,7 @@ static ssize_t picolcd_operation_mode_store(struct device *dev,
+ 		buf += 10;
+ 		cnt -= 10;
+ 	}
+-	if (!report)
++	if (!report || report->maxfield != 1)
+ 		return -EINVAL;
+ 
+ 	while (cnt > 0 && (buf[cnt-1] == '\n' || buf[cnt-1] == '\r'))
+diff --git a/drivers/hid/hid-pl.c b/drivers/hid/hid-pl.c
+index 070f93a5c11b..12786cdcbedd 100644
+--- a/drivers/hid/hid-pl.c
++++ b/drivers/hid/hid-pl.c
+@@ -129,8 +129,14 @@ static int plff_init(struct hid_device *hid)
+ 			strong = &report->field[0]->value[2];
+ 			weak = &report->field[0]->value[3];
+ 			debug("detected single-field device");
+-		} else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 &&
+-				report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) {
++		} else if (report->field[0]->maxusage == 1 &&
++			   report->field[0]->usage[0].hid ==
++				(HID_UP_LED | 0x43) &&
++			   report->maxfield >= 4 &&
++			   report->field[0]->report_count >= 1 &&
++			   report->field[1]->report_count >= 1 &&
++			   report->field[2]->report_count >= 1 &&
++			   report->field[3]->report_count >= 1) {
+ 			report->field[0]->value[0] = 0x00;
+ 			report->field[1]->value[0] = 0x00;
+ 			strong = &report->field[2]->value[0];
+diff --git a/drivers/hid/hid-speedlink.c b/drivers/hid/hid-speedlink.c
+index 602013741718..2b03c9baac35 100644
+--- a/drivers/hid/hid-speedlink.c
++++ b/drivers/hid/hid-speedlink.c
+@@ -3,7 +3,7 @@
+  *  Fixes "jumpy" cursor and removes nonexistent keyboard LEDS from
+  *  the HID descriptor.
+  *
+- *  Copyright (c) 2011 Stefan Kriwanek <mail@××××××××××××××.de>
++ *  Copyright (c) 2011, 2013 Stefan Kriwanek <dev@××××××××××××××.de>
+  */
+ 
+ /*
+@@ -48,8 +48,13 @@ static int speedlink_event(struct hid_device *hdev, struct hid_field *field,
+ 		struct hid_usage *usage, __s32 value)
+ {
+ 	/* No other conditions due to usage_table. */
+-	/* Fix "jumpy" cursor (invalid events sent by device). */
+-	if (value == 256)
++
++	/* This fixes the "jumpy" cursor occuring due to invalid events sent
++	 * by the device. Some devices only send them with value==+256, others
++	 * don't. However, catching abs(value)>=256 is restrictive enough not
++	 * to interfere with devices that were bug-free (has been tested).
++	 */
++	if (abs(value) >= 256)
+ 		return 1;
+ 	/* Drop useless distance 0 events (on button clicks etc.) as well */
+ 	if (value == 0)
+diff --git a/drivers/hid/hid-zpff.c b/drivers/hid/hid-zpff.c
+index f6ba81df71bd..f348f7f6526b 100644
+--- a/drivers/hid/hid-zpff.c
++++ b/drivers/hid/hid-zpff.c
+@@ -70,21 +70,13 @@ static int zpff_init(struct hid_device *hid)
+ 	struct hid_report *report;
+ 	struct hid_input *hidinput = list_entry(hid->inputs.next,
+ 						struct hid_input, list);
+-	struct list_head *report_list =
+-			&hid->report_enum[HID_OUTPUT_REPORT].report_list;
+ 	struct input_dev *dev = hidinput->input;
+-	int error;
++	int i, error;
+ 
+-	if (list_empty(report_list)) {
+-		hid_err(hid, "no output report found\n");
+-		return -ENODEV;
+-	}
+-
+-	report = list_entry(report_list->next, struct hid_report, list);
+-
+-	if (report->maxfield < 4) {
+-		hid_err(hid, "not enough fields in report\n");
+-		return -ENODEV;
++	for (i = 0; i < 4; i++) {
++		report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, i, 1);
++		if (!report)
++			return -ENODEV;
+ 	}
+ 
+ 	zpff = kzalloc(sizeof(struct zpff_device), GFP_KERNEL);
+diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
+index 17d15bb610d1..9e50f61933c4 100644
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -42,7 +42,6 @@ static struct cdev hidraw_cdev;
+ static struct class *hidraw_class;
+ static struct hidraw *hidraw_table[HIDRAW_MAX_DEVICES];
+ static DEFINE_MUTEX(minors_lock);
+-static void drop_ref(struct hidraw *hid, int exists_bit);
+ 
+ static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
+ {
+@@ -296,14 +295,37 @@ out:
+ 
+ }
+ 
++static void drop_ref(struct hidraw *hidraw, int exists_bit)
++{
++	if (exists_bit) {
++		hid_hw_close(hidraw->hid);
++		hidraw->exist = 0;
++		if (hidraw->open)
++			wake_up_interruptible(&hidraw->wait);
++	} else {
++		--hidraw->open;
++	}
++
++	if (!hidraw->open && !hidraw->exist) {
++		device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
++		hidraw_table[hidraw->minor] = NULL;
++		kfree(hidraw);
++	}
++}
++
+ static int hidraw_release(struct inode * inode, struct file * file)
+ {
+ 	unsigned int minor = iminor(inode);
+ 	struct hidraw_list *list = file->private_data;
+ 
+-	drop_ref(hidraw_table[minor], 0);
++	mutex_lock(&minors_lock);
++
+ 	list_del(&list->node);
+ 	kfree(list);
++
++	drop_ref(hidraw_table[minor], 0);
++
++	mutex_unlock(&minors_lock);
+ 	return 0;
+ }
+ 
+@@ -506,7 +528,12 @@ EXPORT_SYMBOL_GPL(hidraw_connect);
+ void hidraw_disconnect(struct hid_device *hid)
+ {
+ 	struct hidraw *hidraw = hid->hidraw;
++
++	mutex_lock(&minors_lock);
++
+ 	drop_ref(hidraw, 1);
++
++	mutex_unlock(&minors_lock);
+ }
+ EXPORT_SYMBOL_GPL(hidraw_disconnect);
+ 
+@@ -555,23 +582,3 @@ void hidraw_exit(void)
+ 	unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
+ 
+ }
+-
+-static void drop_ref(struct hidraw *hidraw, int exists_bit)
+-{
+-	mutex_lock(&minors_lock);
+-	if (exists_bit) {
+-		hid_hw_close(hidraw->hid);
+-		hidraw->exist = 0;
+-		if (hidraw->open)
+-			wake_up_interruptible(&hidraw->wait);
+-	} else {
+-		--hidraw->open;
+-	}
+-
+-	if (!hidraw->open && !hidraw->exist) {
+-		device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
+-		hidraw_table[hidraw->minor] = NULL;
+-		kfree(hidraw);
+-	}
+-	mutex_unlock(&minors_lock);
+-}
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 96a1e0f70724..f98fbad966e7 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -99,6 +99,8 @@ static const struct hid_blacklist {
+ 	{ USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_MULTI_TOUCH, HID_QUIRK_MULTI_INPUT },
+ 	{ USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS, HID_QUIRK_MULTI_INPUT },
+ 	{ USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
++	{ USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
++
+ 	{ 0, 0 }
+ };
+ 
+diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
+index d99aa8484777..30cac58422b7 100644
+--- a/drivers/hwmon/applesmc.c
++++ b/drivers/hwmon/applesmc.c
+@@ -344,8 +344,10 @@ static int applesmc_get_lower_bound(unsigned int *lo, const char *key)
+ 	while (begin != end) {
+ 		int middle = begin + (end - begin) / 2;
+ 		entry = applesmc_get_entry_by_index(middle);
+-		if (IS_ERR(entry))
++		if (IS_ERR(entry)) {
++			*lo = 0;
+ 			return PTR_ERR(entry);
++		}
+ 		if (strcmp(entry->key, key) < 0)
+ 			begin = middle + 1;
+ 		else
+@@ -364,8 +366,10 @@ static int applesmc_get_upper_bound(unsigned int *hi, const char *key)
+ 	while (begin != end) {
+ 		int middle = begin + (end - begin) / 2;
+ 		entry = applesmc_get_entry_by_index(middle);
+-		if (IS_ERR(entry))
++		if (IS_ERR(entry)) {
++			*hi = smcreg.key_count;
+ 			return PTR_ERR(entry);
++		}
+ 		if (strcmp(key, entry->key) < 0)
+ 			end = middle;
+ 		else
+@@ -485,16 +489,25 @@ static int applesmc_init_smcreg_try(void)
+ {
+ 	struct applesmc_registers *s = &smcreg;
+ 	bool left_light_sensor, right_light_sensor;
++	unsigned int count;
+ 	u8 tmp[1];
+ 	int ret;
+ 
+ 	if (s->init_complete)
+ 		return 0;
+ 
+-	ret = read_register_count(&s->key_count);
++	ret = read_register_count(&count);
+ 	if (ret)
+ 		return ret;
+ 
++	if (s->cache && s->key_count != count) {
++		pr_warn("key count changed from %d to %d\n",
++			s->key_count, count);
++		kfree(s->cache);
++		s->cache = NULL;
++	}
++	s->key_count = count;
++
+ 	if (!s->cache)
+ 		s->cache = kcalloc(s->key_count, sizeof(*s->cache), GFP_KERNEL);
+ 	if (!s->cache)
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index f44a06740a6e..b4a4aaf81793 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -861,56 +861,54 @@ static int dma_pte_clear_range(struct dmar_domain *domain,
+ 	return order;
+ }
+ 
++static void dma_pte_free_level(struct dmar_domain *domain, int level,
++			       struct dma_pte *pte, unsigned long pfn,
++			       unsigned long start_pfn, unsigned long last_pfn)
++{
++	pfn = max(start_pfn, pfn);
++	pte = &pte[pfn_level_offset(pfn, level)];
++
++	do {
++		unsigned long level_pfn;
++		struct dma_pte *level_pte;
++
++		if (!dma_pte_present(pte) || dma_pte_superpage(pte))
++			goto next;
++
++		level_pfn = pfn & level_mask(level - 1);
++		level_pte = phys_to_virt(dma_pte_addr(pte));
++
++		if (level > 2)
++			dma_pte_free_level(domain, level - 1, level_pte,
++					   level_pfn, start_pfn, last_pfn);
++
++		/* If range covers entire pagetable, free it */
++		if (!(start_pfn > level_pfn ||
++		      last_pfn < level_pfn + level_size(level))) {
++			dma_clear_pte(pte);
++			domain_flush_cache(domain, pte, sizeof(*pte));
++			free_pgtable_page(level_pte);
++		}
++next:
++		pfn += level_size(level);
++	} while (!first_pte_in_page(++pte) && pfn <= last_pfn);
++}
++
+ /* free page table pages. last level pte should already be cleared */
+ static void dma_pte_free_pagetable(struct dmar_domain *domain,
+ 				   unsigned long start_pfn,
+ 				   unsigned long last_pfn)
+ {
+ 	int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
+-	struct dma_pte *first_pte, *pte;
+-	int total = agaw_to_level(domain->agaw);
+-	int level;
+-	unsigned long tmp;
+-	int large_page = 2;
+ 
+ 	BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
+ 	BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width);
+ 	BUG_ON(start_pfn > last_pfn);
+ 
+ 	/* We don't need lock here; nobody else touches the iova range */
+-	level = 2;
+-	while (level <= total) {
+-		tmp = align_to_level(start_pfn, level);
+-
+-		/* If we can't even clear one PTE at this level, we're done */
+-		if (tmp + level_size(level) - 1 > last_pfn)
+-			return;
+-
+-		do {
+-			large_page = level;
+-			first_pte = pte = dma_pfn_level_pte(domain, tmp, level, &large_page);
+-			if (large_page > level)
+-				level = large_page + 1;
+-			if (!pte) {
+-				tmp = align_to_level(tmp + 1, level + 1);
+-				continue;
+-			}
+-			do {
+-				if (dma_pte_present(pte)) {
+-					free_pgtable_page(phys_to_virt(dma_pte_addr(pte)));
+-					dma_clear_pte(pte);
+-				}
+-				pte++;
+-				tmp += level_size(level);
+-			} while (!first_pte_in_page(pte) &&
+-				 tmp + level_size(level) - 1 <= last_pfn);
++	dma_pte_free_level(domain, agaw_to_level(domain->agaw),
++			   domain->pgd, 0, start_pfn, last_pfn);
+ 
+-			domain_flush_cache(domain, first_pte,
+-					   (void *)pte - (void *)first_pte);
+-			
+-		} while (tmp && tmp + level_size(level) - 1 <= last_pfn);
+-		level++;
+-	}
+ 	/* free pgd */
+ 	if (start_pfn == 0 && last_pfn == DOMAIN_MAX_PFN(domain->gaw)) {
+ 		free_pgtable_page(domain->pgd);
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index b4aaa7bf98a3..5c303168157a 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -721,17 +721,16 @@ static int calc_max_buckets(void)
+  */
+ static int init_hash_tables(struct dm_snapshot *s)
+ {
+-	sector_t hash_size, cow_dev_size, origin_dev_size, max_buckets;
++	sector_t hash_size, cow_dev_size, max_buckets;
+ 
+ 	/*
+ 	 * Calculate based on the size of the original volume or
+ 	 * the COW volume...
+ 	 */
+ 	cow_dev_size = get_dev_size(s->cow->bdev);
+-	origin_dev_size = get_dev_size(s->origin->bdev);
+ 	max_buckets = calc_max_buckets();
+ 
+-	hash_size = min(origin_dev_size, cow_dev_size) >> s->store->chunk_shift;
++	hash_size = cow_dev_size >> s->store->chunk_shift;
+ 	hash_size = min(hash_size, max_buckets);
+ 
+ 	if (hash_size < 64)
+diff --git a/drivers/media/video/hdpvr/hdpvr-core.c b/drivers/media/video/hdpvr/hdpvr-core.c
+index 441dacf642bb..060353eac9bb 100644
+--- a/drivers/media/video/hdpvr/hdpvr-core.c
++++ b/drivers/media/video/hdpvr/hdpvr-core.c
+@@ -297,6 +297,11 @@ static int hdpvr_probe(struct usb_interface *interface,
+ 
+ 	dev->workqueue = 0;
+ 
++	/* init video transfer queues first of all */
++	/* to prevent oops in hdpvr_delete() on error paths */
++	INIT_LIST_HEAD(&dev->free_buff_list);
++	INIT_LIST_HEAD(&dev->rec_buff_list);
++
+ 	/* register v4l2_device early so it can be used for printks */
+ 	if (v4l2_device_register(&interface->dev, &dev->v4l2_dev)) {
+ 		err("v4l2_device_register failed");
+@@ -319,10 +324,6 @@ static int hdpvr_probe(struct usb_interface *interface,
+ 	if (!dev->workqueue)
+ 		goto error;
+ 
+-	/* init video transfer queues */
+-	INIT_LIST_HEAD(&dev->free_buff_list);
+-	INIT_LIST_HEAD(&dev->rec_buff_list);
+-
+ 	dev->options = hdpvr_default_options;
+ 
+ 	if (default_video_input < HDPVR_VIDEO_INPUTS)
+@@ -373,12 +374,6 @@ static int hdpvr_probe(struct usb_interface *interface,
+ 	}
+ 	mutex_unlock(&dev->io_mutex);
+ 
+-	if (hdpvr_register_videodev(dev, &interface->dev,
+-				    video_nr[atomic_inc_return(&dev_nr)])) {
+-		v4l2_err(&dev->v4l2_dev, "registering videodev failed\n");
+-		goto error;
+-	}
+-
+ #if defined(CONFIG_I2C) || defined(CONFIG_I2C_MODULE)
+ 	retval = hdpvr_register_i2c_adapter(dev);
+ 	if (retval < 0) {
+@@ -399,6 +394,13 @@ static int hdpvr_probe(struct usb_interface *interface,
+ 	}
+ #endif
+ 
++	retval = hdpvr_register_videodev(dev, &interface->dev,
++				    video_nr[atomic_inc_return(&dev_nr)]);
++	if (retval < 0) {
++		v4l2_err(&dev->v4l2_dev, "registering videodev failed\n");
++		goto reg_fail;
++	}
++
+ 	/* let the user know what node this device is now attached to */
+ 	v4l2_info(&dev->v4l2_dev, "device now attached to %s\n",
+ 		  video_device_node_name(dev->video_dev));
+diff --git a/drivers/mmc/host/tmio_mmc_dma.c b/drivers/mmc/host/tmio_mmc_dma.c
+index 86f259cdfcbc..be9e74d687b9 100644
+--- a/drivers/mmc/host/tmio_mmc_dma.c
++++ b/drivers/mmc/host/tmio_mmc_dma.c
+@@ -92,6 +92,7 @@ static void tmio_mmc_start_dma_rx(struct tmio_mmc_host *host)
+ pio:
+ 	if (!desc) {
+ 		/* DMA failed, fall back to PIO */
++		tmio_mmc_enable_dma(host, false);
+ 		if (ret >= 0)
+ 			ret = -EIO;
+ 		host->chan_rx = NULL;
+@@ -104,7 +105,6 @@ pio:
+ 		}
+ 		dev_warn(&host->pdev->dev,
+ 			 "DMA failed: %d, falling back to PIO\n", ret);
+-		tmio_mmc_enable_dma(host, false);
+ 	}
+ 
+ 	dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d, sg[%d]\n", __func__,
+@@ -173,6 +173,7 @@ static void tmio_mmc_start_dma_tx(struct tmio_mmc_host *host)
+ pio:
+ 	if (!desc) {
+ 		/* DMA failed, fall back to PIO */
++		tmio_mmc_enable_dma(host, false);
+ 		if (ret >= 0)
+ 			ret = -EIO;
+ 		host->chan_tx = NULL;
+@@ -185,7 +186,6 @@ pio:
+ 		}
+ 		dev_warn(&host->pdev->dev,
+ 			 "DMA failed: %d, falling back to PIO\n", ret);
+-		tmio_mmc_enable_dma(host, false);
+ 	}
+ 
+ 	dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d\n", __func__,
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index b436b84de123..1bf36ac44a10 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1911,6 +1911,7 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
+ 	struct bonding *bond = netdev_priv(bond_dev);
+ 	struct slave *slave, *oldcurrent;
+ 	struct sockaddr addr;
++	int old_flags = bond_dev->flags;
+ 	u32 old_features = bond_dev->features;
+ 
+ 	/* slave is not a slave or master is not master of this slave */
+@@ -2041,12 +2042,18 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
+ 	 * already taken care of above when we detached the slave
+ 	 */
+ 	if (!USES_PRIMARY(bond->params.mode)) {
+-		/* unset promiscuity level from slave */
+-		if (bond_dev->flags & IFF_PROMISC)
++		/* unset promiscuity level from slave
++		 * NOTE: The NETDEV_CHANGEADDR call above may change the value
++		 * of the IFF_PROMISC flag in the bond_dev, but we need the
++		 * value of that flag before that change, as that was the value
++		 * when this slave was attached, so we cache at the start of the
++		 * function and use it here. Same goes for ALLMULTI below
++		 */
++		if (old_flags & IFF_PROMISC)
+ 			dev_set_promiscuity(slave_dev, -1);
+ 
+ 		/* unset allmulti level from slave */
+-		if (bond_dev->flags & IFF_ALLMULTI)
++		if (old_flags & IFF_ALLMULTI)
+ 			dev_set_allmulti(slave_dev, -1);
+ 
+ 		/* flush master's mc_list from slave */
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index e59d006e98e1..bb828c24ce6f 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -60,7 +60,7 @@
+ #define FLEXCAN_MCR_BCC			BIT(16)
+ #define FLEXCAN_MCR_LPRIO_EN		BIT(13)
+ #define FLEXCAN_MCR_AEN			BIT(12)
+-#define FLEXCAN_MCR_MAXMB(x)		((x) & 0xf)
++#define FLEXCAN_MCR_MAXMB(x)		((x) & 0x1f)
+ #define FLEXCAN_MCR_IDAM_A		(0 << 8)
+ #define FLEXCAN_MCR_IDAM_B		(1 << 8)
+ #define FLEXCAN_MCR_IDAM_C		(2 << 8)
+@@ -666,7 +666,6 @@ static int flexcan_chip_start(struct net_device *dev)
+ {
+ 	struct flexcan_priv *priv = netdev_priv(dev);
+ 	struct flexcan_regs __iomem *regs = priv->base;
+-	unsigned int i;
+ 	int err;
+ 	u32 reg_mcr, reg_ctrl;
+ 
+@@ -700,9 +699,11 @@ static int flexcan_chip_start(struct net_device *dev)
+ 	 *
+ 	 */
+ 	reg_mcr = flexcan_read(&regs->mcr);
++	reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff);
+ 	reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_FEN | FLEXCAN_MCR_HALT |
+ 		FLEXCAN_MCR_SUPV | FLEXCAN_MCR_WRN_EN |
+-		FLEXCAN_MCR_IDAM_C;
++		FLEXCAN_MCR_IDAM_C |
++		FLEXCAN_MCR_MAXMB(FLEXCAN_TX_BUF_ID);
+ 	dev_dbg(dev->dev.parent, "%s: writing mcr=0x%08x", __func__, reg_mcr);
+ 	flexcan_write(reg_mcr, &regs->mcr);
+ 
+@@ -732,16 +733,9 @@ static int flexcan_chip_start(struct net_device *dev)
+ 	dev_dbg(dev->dev.parent, "%s: writing ctrl=0x%08x", __func__, reg_ctrl);
+ 	flexcan_write(reg_ctrl, &regs->ctrl);
+ 
+-	for (i = 0; i < ARRAY_SIZE(regs->cantxfg); i++) {
+-		flexcan_write(0, &regs->cantxfg[i].can_ctrl);
+-		flexcan_write(0, &regs->cantxfg[i].can_id);
+-		flexcan_write(0, &regs->cantxfg[i].data[0]);
+-		flexcan_write(0, &regs->cantxfg[i].data[1]);
+-
+-		/* put MB into rx queue */
+-		flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
+-			&regs->cantxfg[i].can_ctrl);
+-	}
++	/* Abort any pending TX, mark Mailbox as INACTIVE */
++	flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
++		      &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
+ 
+ 	/* acceptance mask/acceptance code (accept everything) */
+ 	flexcan_write(0x0, &regs->rxgmask);
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index d0722a7d480b..fb9e7d34bcf2 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -397,7 +397,13 @@ static void gfar_init_mac(struct net_device *ndev)
+ 	if (ndev->features & NETIF_F_IP_CSUM)
+ 		tctrl |= TCTRL_INIT_CSUM;
+ 
+-	tctrl |= TCTRL_TXSCHED_PRIO;
++	if (priv->prio_sched_en)
++		tctrl |= TCTRL_TXSCHED_PRIO;
++	else {
++		tctrl |= TCTRL_TXSCHED_WRRS;
++		gfar_write(&regs->tr03wt, DEFAULT_WRRS_WEIGHT);
++		gfar_write(&regs->tr47wt, DEFAULT_WRRS_WEIGHT);
++	}
+ 
+ 	gfar_write(&regs->tctrl, tctrl);
+ 
+@@ -1157,6 +1163,9 @@ static int gfar_probe(struct platform_device *ofdev)
+ 	priv->rx_filer_enable = 1;
+ 	/* Enable most messages by default */
+ 	priv->msg_enable = (NETIF_MSG_IFUP << 1 ) - 1;
++	/* use pritority h/w tx queue scheduling for single queue devices */
++	if (priv->num_tx_queues == 1)
++		priv->prio_sched_en = 1;
+ 
+ 	/* Carrier starts down, phylib will bring it up */
+ 	netif_carrier_off(dev);
+diff --git a/drivers/net/ethernet/freescale/gianfar.h b/drivers/net/ethernet/freescale/gianfar.h
+index 9aa43773e8e3..abeb79a67aee 100644
+--- a/drivers/net/ethernet/freescale/gianfar.h
++++ b/drivers/net/ethernet/freescale/gianfar.h
+@@ -304,8 +304,16 @@ extern const char gfar_driver_version[];
+ #define TCTRL_TFCPAUSE		0x00000008
+ #define TCTRL_TXSCHED_MASK	0x00000006
+ #define TCTRL_TXSCHED_INIT	0x00000000
++/* priority scheduling */
+ #define TCTRL_TXSCHED_PRIO	0x00000002
++/* weighted round-robin scheduling (WRRS) */
+ #define TCTRL_TXSCHED_WRRS	0x00000004
++/* default WRRS weight and policy setting,
++ * tailored to the tr03wt and tr47wt registers:
++ * equal weight for all Tx Qs, measured in 64byte units
++ */
++#define DEFAULT_WRRS_WEIGHT	0x18181818
++
+ #define TCTRL_INIT_CSUM		(TCTRL_TUCSEN | TCTRL_IPCSEN)
+ 
+ #define IEVENT_INIT_CLEAR	0xffffffff
+@@ -1101,7 +1109,8 @@ struct gfar_private {
+ 		extended_hash:1,
+ 		bd_stash_en:1,
+ 		rx_filer_enable:1,
+-		wol_en:1; /* Wake-on-LAN enabled */
++		wol_en:1, /* Wake-on-LAN enabled */
++		prio_sched_en:1; /* Enable priorty based Tx scheduling in Hw */
+ 	unsigned short padding;
+ 
+ 	/* PHY stuff */
+diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
+index 8f47907fd270..4236b82f9e35 100644
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -478,7 +478,7 @@ rx_status_loop:
+ 
+ 	while (1) {
+ 		u32 status, len;
+-		dma_addr_t mapping;
++		dma_addr_t mapping, new_mapping;
+ 		struct sk_buff *skb, *new_skb;
+ 		struct cp_desc *desc;
+ 		const unsigned buflen = cp->rx_buf_sz;
+@@ -520,6 +520,14 @@ rx_status_loop:
+ 			goto rx_next;
+ 		}
+ 
++		new_mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
++					 PCI_DMA_FROMDEVICE);
++		if (dma_mapping_error(&cp->pdev->dev, new_mapping)) {
++			dev->stats.rx_dropped++;
++			kfree_skb(new_skb);
++			goto rx_next;
++		}
++
+ 		dma_unmap_single(&cp->pdev->dev, mapping,
+ 				 buflen, PCI_DMA_FROMDEVICE);
+ 
+@@ -531,12 +539,11 @@ rx_status_loop:
+ 
+ 		skb_put(skb, len);
+ 
+-		mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
+-					 PCI_DMA_FROMDEVICE);
+ 		cp->rx_skb[rx_tail] = new_skb;
+ 
+ 		cp_rx_skb(cp, skb, desc);
+ 		rx++;
++		mapping = new_mapping;
+ 
+ rx_next:
+ 		cp->rx_ring[rx_tail].opts2 = 0;
+@@ -704,6 +711,22 @@ static inline u32 cp_tx_vlan_tag(struct sk_buff *skb)
+ 		TxVlanTag | swab16(vlan_tx_tag_get(skb)) : 0x00;
+ }
+ 
++static void unwind_tx_frag_mapping(struct cp_private *cp, struct sk_buff *skb,
++				   int first, int entry_last)
++{
++	int frag, index;
++	struct cp_desc *txd;
++	skb_frag_t *this_frag;
++	for (frag = 0; frag+first < entry_last; frag++) {
++		index = first+frag;
++		cp->tx_skb[index] = NULL;
++		txd = &cp->tx_ring[index];
++		this_frag = &skb_shinfo(skb)->frags[frag];
++		dma_unmap_single(&cp->pdev->dev, le64_to_cpu(txd->addr),
++				 skb_frag_size(this_frag), PCI_DMA_TODEVICE);
++	}
++}
++
+ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ 					struct net_device *dev)
+ {
+@@ -737,6 +760,9 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ 
+ 		len = skb->len;
+ 		mapping = dma_map_single(&cp->pdev->dev, skb->data, len, PCI_DMA_TODEVICE);
++		if (dma_mapping_error(&cp->pdev->dev, mapping))
++			goto out_dma_error;
++
+ 		txd->opts2 = opts2;
+ 		txd->addr = cpu_to_le64(mapping);
+ 		wmb();
+@@ -774,6 +800,9 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ 		first_len = skb_headlen(skb);
+ 		first_mapping = dma_map_single(&cp->pdev->dev, skb->data,
+ 					       first_len, PCI_DMA_TODEVICE);
++		if (dma_mapping_error(&cp->pdev->dev, first_mapping))
++			goto out_dma_error;
++
+ 		cp->tx_skb[entry] = skb;
+ 		entry = NEXT_TX(entry);
+ 
+@@ -787,6 +816,11 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ 			mapping = dma_map_single(&cp->pdev->dev,
+ 						 skb_frag_address(this_frag),
+ 						 len, PCI_DMA_TODEVICE);
++			if (dma_mapping_error(&cp->pdev->dev, mapping)) {
++				unwind_tx_frag_mapping(cp, skb, first_entry, entry);
++				goto out_dma_error;
++			}
++
+ 			eor = (entry == (CP_TX_RING_SIZE - 1)) ? RingEnd : 0;
+ 
+ 			ctrl = eor | len | DescOwn;
+@@ -845,11 +879,16 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ 	if (TX_BUFFS_AVAIL(cp) <= (MAX_SKB_FRAGS + 1))
+ 		netif_stop_queue(dev);
+ 
++out_unlock:
+ 	spin_unlock_irqrestore(&cp->lock, intr_flags);
+ 
+ 	cpw8(TxPoll, NormalTxPoll);
+ 
+ 	return NETDEV_TX_OK;
++out_dma_error:
++	kfree_skb(skb);
++	cp->dev->stats.tx_dropped++;
++	goto out_unlock;
+ }
+ 
+ /* Set or clear the multicast filter for this adaptor.
+@@ -1023,6 +1062,10 @@ static int cp_refill_rx(struct cp_private *cp)
+ 
+ 		mapping = dma_map_single(&cp->pdev->dev, skb->data,
+ 					 cp->rx_buf_sz, PCI_DMA_FROMDEVICE);
++		if (dma_mapping_error(&cp->pdev->dev, mapping)) {
++			kfree_skb(skb);
++			goto err_out;
++		}
+ 		cp->rx_skb[i] = skb;
+ 
+ 		cp->rx_ring[i].opts2 = 0;
+diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
+index 9ce8665b53bf..c231b3f67b2b 100644
+--- a/drivers/net/ethernet/sfc/rx.c
++++ b/drivers/net/ethernet/sfc/rx.c
+@@ -312,8 +312,9 @@ static void efx_resurrect_rx_buffer(struct efx_rx_queue *rx_queue,
+ 
+ 	index = rx_queue->added_count & rx_queue->ptr_mask;
+ 	new_buf = efx_rx_buffer(rx_queue, index);
+-	new_buf->dma_addr = rx_buf->dma_addr ^ (PAGE_SIZE >> 1);
+ 	new_buf->u.page = rx_buf->u.page;
++	new_buf->page_offset = rx_buf->page_offset ^ (PAGE_SIZE >> 1);
++	new_buf->dma_addr = state->dma_addr + new_buf->page_offset;
+ 	new_buf->len = rx_buf->len;
+ 	new_buf->is_page = true;
+ 	++rx_queue->added_count;
+diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
+index f34dd99fe579..f37e0aee27c6 100644
+--- a/drivers/net/ethernet/via/via-rhine.c
++++ b/drivers/net/ethernet/via/via-rhine.c
+@@ -32,7 +32,7 @@
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+ 
+ #define DRV_NAME	"via-rhine"
+-#define DRV_VERSION	"1.5.0"
++#define DRV_VERSION	"1.5.1"
+ #define DRV_RELDATE	"2010-10-09"
+ 
+ 
+@@ -1518,7 +1518,12 @@ static netdev_tx_t rhine_start_tx(struct sk_buff *skb,
+ 		cpu_to_le32(TXDESC | (skb->len >= ETH_ZLEN ? skb->len : ETH_ZLEN));
+ 
+ 	if (unlikely(vlan_tx_tag_present(skb))) {
+-		rp->tx_ring[entry].tx_status = cpu_to_le32((vlan_tx_tag_get(skb)) << 16);
++		u16 vid_pcp = vlan_tx_tag_get(skb);
++
++		/* drop CFI/DEI bit, register needs VID and PCP */
++		vid_pcp = (vid_pcp & VLAN_VID_MASK) |
++			  ((vid_pcp & VLAN_PRIO_MASK) >> 1);
++		rp->tx_ring[entry].tx_status = cpu_to_le32((vid_pcp) << 16);
+ 		/* request tagging */
+ 		rp->tx_ring[entry].desc_length |= cpu_to_le32(0x020000);
+ 	}
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
+index 2681b53820ee..e26945d9dea4 100644
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -308,6 +308,12 @@ static int temac_dma_bd_init(struct net_device *ndev)
+ 		       lp->rx_bd_p + (sizeof(*lp->rx_bd_v) * (RX_BD_NUM - 1)));
+ 	lp->dma_out(lp, TX_CURDESC_PTR, lp->tx_bd_p);
+ 
++	/* Init descriptor indexes */
++	lp->tx_bd_ci = 0;
++	lp->tx_bd_next = 0;
++	lp->tx_bd_tail = 0;
++	lp->rx_bd_ci = 0;
++
+ 	return 0;
+ 
+ out:
+diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
+index 96b9e3c93ce1..b0f901518b76 100644
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -641,6 +641,28 @@ static int macvtap_skb_to_vnet_hdr(const struct sk_buff *skb,
+ 	return 0;
+ }
+ 
++static unsigned long iov_pages(const struct iovec *iv, int offset,
++			       unsigned long nr_segs)
++{
++	unsigned long seg, base;
++	int pages = 0, len, size;
++
++	while (nr_segs && (offset >= iv->iov_len)) {
++		offset -= iv->iov_len;
++		++iv;
++		--nr_segs;
++	}
++
++	for (seg = 0; seg < nr_segs; seg++) {
++		base = (unsigned long)iv[seg].iov_base + offset;
++		len = iv[seg].iov_len - offset;
++		size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
++		pages += size;
++		offset = 0;
++	}
++
++	return pages;
++}
+ 
+ /* Get packet from user space buffer */
+ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+@@ -687,31 +709,15 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+ 	if (unlikely(count > UIO_MAXIOV))
+ 		goto err;
+ 
+-	if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY))
+-		zerocopy = true;
+-
+-	if (zerocopy) {
+-		/* Userspace may produce vectors with count greater than
+-		 * MAX_SKB_FRAGS, so we need to linearize parts of the skb
+-		 * to let the rest of data to be fit in the frags.
+-		 */
+-		if (count > MAX_SKB_FRAGS) {
+-			copylen = iov_length(iv, count - MAX_SKB_FRAGS);
+-			if (copylen < vnet_hdr_len)
+-				copylen = 0;
+-			else
+-				copylen -= vnet_hdr_len;
+-		}
+-		/* There are 256 bytes to be copied in skb, so there is enough
+-		 * room for skb expand head in case it is used.
+-		 * The rest buffer is mapped from userspace.
+-		 */
+-		if (copylen < vnet_hdr.hdr_len)
+-			copylen = vnet_hdr.hdr_len;
+-		if (!copylen)
+-			copylen = GOODCOPY_LEN;
++	if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY)) {
++		copylen = vnet_hdr.hdr_len ? vnet_hdr.hdr_len : GOODCOPY_LEN;
+ 		linear = copylen;
+-	} else {
++		if (iov_pages(iv, vnet_hdr_len + copylen, count)
++		    <= MAX_SKB_FRAGS)
++			zerocopy = true;
++	}
++
++	if (!zerocopy) {
+ 		copylen = len;
+ 		linear = vnet_hdr.hdr_len;
+ 	}
+@@ -723,9 +729,15 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+ 
+ 	if (zerocopy)
+ 		err = zerocopy_sg_from_iovec(skb, iv, vnet_hdr_len, count);
+-	else
++	else {
+ 		err = skb_copy_datagram_from_iovec(skb, 0, iv, vnet_hdr_len,
+ 						   len);
++		if (!err && m && m->msg_control) {
++			struct ubuf_info *uarg = m->msg_control;
++			uarg->callback(uarg);
++		}
++	}
++
+ 	if (err)
+ 		goto err_kfree;
+ 
+diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
+index ad6a9d91dfdd..2b349d3355f4 100644
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -281,7 +281,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ 	nf_reset(skb);
+ 
+ 	skb->ip_summed = CHECKSUM_NONE;
+-	ip_select_ident(iph, &rt->dst, NULL);
++	ip_select_ident(skb, &rt->dst, NULL);
+ 	ip_send_check(iph);
+ 
+ 	ip_local_out(skb);
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index f4c5de6e3ed0..ee1aab0805d1 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -614,8 +614,9 @@ static ssize_t tun_get_user(struct tun_struct *tun,
+ 	int offset = 0;
+ 
+ 	if (!(tun->flags & TUN_NO_PI)) {
+-		if ((len -= sizeof(pi)) > count)
++		if (len < sizeof(pi))
+ 			return -EINVAL;
++		len -= sizeof(pi);
+ 
+ 		if (memcpy_fromiovecend((void *)&pi, iv, 0, sizeof(pi)))
+ 			return -EFAULT;
+@@ -623,8 +624,9 @@ static ssize_t tun_get_user(struct tun_struct *tun,
+ 	}
+ 
+ 	if (tun->flags & TUN_VNET_HDR) {
+-		if ((len -= tun->vnet_hdr_sz) > count)
++		if (len < tun->vnet_hdr_sz)
+ 			return -EINVAL;
++		len -= tun->vnet_hdr_sz;
+ 
+ 		if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso)))
+ 			return -EFAULT;
+diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
+index 2ba40cf85251..43aa06b3f7c6 100644
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -615,6 +615,11 @@ static const struct usb_device_id	products [] = {
+ 	.bInterfaceProtocol	= USB_CDC_PROTO_NONE,
+ 	.driver_info = (unsigned long)&wwan_info,
+ }, {
++	/* Telit modules */
++	USB_VENDOR_AND_INTERFACE_INFO(0x1bc7, USB_CLASS_COMM,
++			USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
++	.driver_info = (kernel_ulong_t) &wwan_info,
++}, {
+ 	USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
+ 			USB_CDC_PROTO_NONE),
+ 	.driver_info = (unsigned long) &cdc_info,
+diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
+index fbc0e4def767..136ecf32a5d5 100644
+--- a/drivers/net/usb/dm9601.c
++++ b/drivers/net/usb/dm9601.c
+@@ -384,7 +384,7 @@ static void dm9601_set_multicast(struct net_device *net)
+ 		rx_ctl |= 0x02;
+ 	} else if (net->flags & IFF_ALLMULTI ||
+ 		   netdev_mc_count(net) > DM_MAX_MCAST) {
+-		rx_ctl |= 0x04;
++		rx_ctl |= 0x08;
+ 	} else if (!netdev_mc_empty(net)) {
+ 		struct netdev_hw_addr *ha;
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+index 73be7ff149f9..f146824e676d 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -1016,6 +1016,10 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah,
+ 		 * is_on == 0 means MRC CCK is OFF (more noise imm)
+ 		 */
+ 		bool is_on = param ? 1 : 0;
++
++		if (ah->caps.rx_chainmask == 1)
++			break;
++
+ 		REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+ 			      AR_PHY_MRC_CCK_ENABLE, is_on);
+ 		REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index 1c269f50822b..7c70cf2b5d1a 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -77,10 +77,6 @@ struct ath_config {
+ 		       sizeof(struct ath_buf_state));		\
+ 	} while (0)
+ 
+-#define ATH_RXBUF_RESET(_bf) do {		\
+-		(_bf)->bf_stale = false;	\
+-	} while (0)
+-
+ /**
+  * enum buffer_type - Buffer type flags
+  *
+@@ -308,6 +304,7 @@ struct ath_rx {
+ 	struct ath_buf *rx_bufptr;
+ 	struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
+ 
++	struct ath_buf *buf_hold;
+ 	struct sk_buff *frag;
+ };
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
+index d171a7242e4a..8326c1402ea7 100644
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -78,8 +78,6 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+ 	struct ath_desc *ds;
+ 	struct sk_buff *skb;
+ 
+-	ATH_RXBUF_RESET(bf);
+-
+ 	ds = bf->bf_desc;
+ 	ds->ds_link = 0; /* link to null */
+ 	ds->ds_data = bf->bf_buf_addr;
+@@ -106,6 +104,14 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+ 	sc->rx.rxlink = &ds->ds_link;
+ }
+ 
++static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
++{
++	if (sc->rx.buf_hold)
++		ath_rx_buf_link(sc, sc->rx.buf_hold);
++
++	sc->rx.buf_hold = bf;
++}
++
+ static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
+ {
+ 	/* XXX block beacon interrupts */
+@@ -153,7 +159,6 @@ static bool ath_rx_edma_buf_link(struct ath_softc *sc,
+ 
+ 	skb = bf->bf_mpdu;
+ 
+-	ATH_RXBUF_RESET(bf);
+ 	memset(skb->data, 0, ah->caps.rx_status_len);
+ 	dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+ 				ah->caps.rx_status_len, DMA_TO_DEVICE);
+@@ -492,6 +497,7 @@ int ath_startrecv(struct ath_softc *sc)
+ 	if (list_empty(&sc->rx.rxbuf))
+ 		goto start_recv;
+ 
++	sc->rx.buf_hold = NULL;
+ 	sc->rx.rxlink = NULL;
+ 	list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
+ 		ath_rx_buf_link(sc, bf);
+@@ -742,6 +748,9 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
+ 	}
+ 
+ 	bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
++	if (bf == sc->rx.buf_hold)
++		return NULL;
++
+ 	ds = bf->bf_desc;
+ 
+ 	/*
+@@ -1974,7 +1983,7 @@ requeue:
+ 		if (edma) {
+ 			ath_rx_edma_buf_link(sc, qtype);
+ 		} else {
+-			ath_rx_buf_link(sc, bf);
++			ath_rx_buf_relink(sc, bf);
+ 			ath9k_hw_rxena(ah);
+ 		}
+ 	} while (1);
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 18da10047712..126ed31affe1 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2423,6 +2423,7 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
+ 	for (acno = 0, ac = &an->ac[acno];
+ 	     acno < WME_NUM_AC; acno++, ac++) {
+ 		ac->sched    = false;
++		ac->clear_ps_filter = true;
+ 		ac->txq = sc->tx.txq_map[acno];
+ 		INIT_LIST_HEAD(&ac->tid_q);
+ 	}
+diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
+index 564218ca4853..078449385882 100644
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -83,6 +83,7 @@ static struct usb_device_id p54u_table[] = {
+ 	{USB_DEVICE(0x06a9, 0x000e)},	/* Westell 802.11g USB (A90-211WG-01) */
+ 	{USB_DEVICE(0x06b9, 0x0121)},	/* Thomson SpeedTouch 121g */
+ 	{USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
++	{USB_DEVICE(0x07aa, 0x0020)},	/* Corega WLUSB2GTST USB */
+ 	{USB_DEVICE(0x0803, 0x4310)},	/* Zoom 4410a */
+ 	{USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
+ 	{USB_DEVICE(0x083a, 0x4531)},	/* T-Com Sinus 154 data II */
+diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
+index 67cbe5a1a928..8fb8c9e75688 100644
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -2067,6 +2067,13 @@ static int rt2800_get_gain_calibration_delta(struct rt2x00_dev *rt2x00dev)
+ 	int i;
+ 
+ 	/*
++	 * First check if temperature compensation is supported.
++	 */
++	rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1, &eeprom);
++	if (!rt2x00_get_field16(eeprom, EEPROM_NIC_CONF1_EXTERNAL_TX_ALC))
++		return 0;
++
++	/*
+ 	 * Read TSSI boundaries for temperature compensation from
+ 	 * the EEPROM.
+ 	 *
+diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
+index deb87e959e02..82baaa25dc41 100644
+--- a/drivers/net/wireless/rtlwifi/wifi.h
++++ b/drivers/net/wireless/rtlwifi/wifi.h
+@@ -1630,7 +1630,7 @@ struct rtl_priv {
+ 	   that it points to the data allocated
+ 	   beyond  this structure like:
+ 	   rtl_pci_priv or rtl_usb_priv */
+-	u8 priv[0];
++	u8 priv[0] __aligned(sizeof(void *));
+ };
+ 
+ #define rtl_priv(hw)		(((struct rtl_priv *)(hw)->priv))
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 9b6588ef0673..37639a644563 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1189,6 +1189,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
+ 		ap = dt_alloc(sizeof(*ap) + len + 1, 4);
+ 		if (!ap)
+ 			continue;
++		memset(ap, 0, sizeof(*ap) + len + 1);
+ 		ap->alias = start;
+ 		of_alias_add(ap, np, id, start, len);
+ 	}
+diff --git a/drivers/scsi/esp_scsi.c b/drivers/scsi/esp_scsi.c
+index 394ed9e79fd4..4aa30d86ca99 100644
+--- a/drivers/scsi/esp_scsi.c
++++ b/drivers/scsi/esp_scsi.c
+@@ -530,7 +530,7 @@ static int esp_need_to_nego_sync(struct esp_target_data *tp)
+ static int esp_alloc_lun_tag(struct esp_cmd_entry *ent,
+ 			     struct esp_lun_data *lp)
+ {
+-	if (!ent->tag[0]) {
++	if (!ent->orig_tag[0]) {
+ 		/* Non-tagged, slot already taken?  */
+ 		if (lp->non_tagged_cmd)
+ 			return -EBUSY;
+@@ -564,9 +564,9 @@ static int esp_alloc_lun_tag(struct esp_cmd_entry *ent,
+ 			return -EBUSY;
+ 	}
+ 
+-	BUG_ON(lp->tagged_cmds[ent->tag[1]]);
++	BUG_ON(lp->tagged_cmds[ent->orig_tag[1]]);
+ 
+-	lp->tagged_cmds[ent->tag[1]] = ent;
++	lp->tagged_cmds[ent->orig_tag[1]] = ent;
+ 	lp->num_tagged++;
+ 
+ 	return 0;
+@@ -575,9 +575,9 @@ static int esp_alloc_lun_tag(struct esp_cmd_entry *ent,
+ static void esp_free_lun_tag(struct esp_cmd_entry *ent,
+ 			     struct esp_lun_data *lp)
+ {
+-	if (ent->tag[0]) {
+-		BUG_ON(lp->tagged_cmds[ent->tag[1]] != ent);
+-		lp->tagged_cmds[ent->tag[1]] = NULL;
++	if (ent->orig_tag[0]) {
++		BUG_ON(lp->tagged_cmds[ent->orig_tag[1]] != ent);
++		lp->tagged_cmds[ent->orig_tag[1]] = NULL;
+ 		lp->num_tagged--;
+ 	} else {
+ 		BUG_ON(lp->non_tagged_cmd != ent);
+@@ -667,6 +667,8 @@ static struct esp_cmd_entry *find_and_prep_issuable_command(struct esp *esp)
+ 			ent->tag[0] = 0;
+ 			ent->tag[1] = 0;
+ 		}
++		ent->orig_tag[0] = ent->tag[0];
++		ent->orig_tag[1] = ent->tag[1];
+ 
+ 		if (esp_alloc_lun_tag(ent, lp) < 0)
+ 			continue;
+diff --git a/drivers/scsi/esp_scsi.h b/drivers/scsi/esp_scsi.h
+index 28e22acf87ea..cd68805e8d78 100644
+--- a/drivers/scsi/esp_scsi.h
++++ b/drivers/scsi/esp_scsi.h
+@@ -271,6 +271,7 @@ struct esp_cmd_entry {
+ #define ESP_CMD_FLAG_AUTOSENSE	0x04 /* Doing automatic REQUEST_SENSE */
+ 
+ 	u8			tag[2];
++	u8			orig_tag[2];
+ 
+ 	u8			status;
+ 	u8			message;
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 96029e6d027f..c8744588e6b7 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2105,7 +2105,7 @@ iscsi_if_rx(struct sk_buff *skb)
+ 				break;
+ 			err = iscsi_if_send_reply(group, nlh->nlmsg_seq,
+ 				nlh->nlmsg_type, 0, 0, ev, sizeof(*ev));
+-		} while (err < 0 && err != -ECONNREFUSED);
++		} while (err < 0 && err != -ECONNREFUSED && err != -ESRCH);
+ 		skb_pull(skb, rlen);
+ 	}
+ 	mutex_unlock(&rx_queue_mutex);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 17603daf9b57..f6d2b62ec005 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2136,14 +2136,9 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
+ 			}
+ 		}
+ 
+-		if (modepage == 0x3F) {
+-			sd_printk(KERN_ERR, sdkp, "No Caching mode page "
+-				  "present\n");
+-			goto defaults;
+-		} else if ((buffer[offset] & 0x3f) != modepage) {
+-			sd_printk(KERN_ERR, sdkp, "Got wrong page\n");
+-			goto defaults;
+-		}
++		sd_printk(KERN_ERR, sdkp, "No Caching mode page found\n");
++		goto defaults;
++
+ 	Page_found:
+ 		if (modepage == 8) {
+ 			sdkp->WCE = ((buffer[offset + 2] & 0x04) != 0);
+diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c
+index 95ebc267bb74..e3adb382d721 100644
+--- a/drivers/staging/comedi/drivers/dt282x.c
++++ b/drivers/staging/comedi/drivers/dt282x.c
+@@ -407,8 +407,9 @@ struct dt282x_private {
+ 			}					\
+ 			udelay(5);				\
+ 		}						\
+-		if (_i)						\
++		if (_i) {					\
+ 			b					\
++		}						\
+ 	} while (0)
+ 
+ static int dt282x_attach(struct comedi_device *dev,
+diff --git a/drivers/staging/comedi/drivers/ni_65xx.c b/drivers/staging/comedi/drivers/ni_65xx.c
+index 403fc0997d37..8b564ad17319 100644
+--- a/drivers/staging/comedi/drivers/ni_65xx.c
++++ b/drivers/staging/comedi/drivers/ni_65xx.c
+@@ -411,29 +411,25 @@ static int ni_65xx_dio_insn_bits(struct comedi_device *dev,
+ 				 struct comedi_subdevice *s,
+ 				 struct comedi_insn *insn, unsigned int *data)
+ {
+-	unsigned base_bitfield_channel;
+-	const unsigned max_ports_per_bitfield = 5;
++	int base_bitfield_channel;
+ 	unsigned read_bits = 0;
+-	unsigned j;
++	int last_port_offset = ni_65xx_port_by_channel(s->n_chan - 1);
++	int port_offset;
++
+ 	if (insn->n != 2)
+ 		return -EINVAL;
+ 	base_bitfield_channel = CR_CHAN(insn->chanspec);
+-	for (j = 0; j < max_ports_per_bitfield; ++j) {
+-		const unsigned port_offset =
+-			ni_65xx_port_by_channel(base_bitfield_channel) + j;
+-		const unsigned port =
+-			sprivate(s)->base_port + port_offset;
+-		unsigned base_port_channel;
++	for (port_offset = ni_65xx_port_by_channel(base_bitfield_channel);
++	     port_offset <= last_port_offset; port_offset++) {
++		unsigned port = sprivate(s)->base_port + port_offset;
++		int base_port_channel = port_offset * ni_65xx_channels_per_port;
+ 		unsigned port_mask, port_data, port_read_bits;
+-		int bitshift;
+-		if (port >= ni_65xx_total_num_ports(board(dev)))
++		int bitshift = base_port_channel - base_bitfield_channel;
++
++		if (bitshift >= 32)
+ 			break;
+-		base_port_channel = port_offset * ni_65xx_channels_per_port;
+ 		port_mask = data[0];
+ 		port_data = data[1];
+-		bitshift = base_port_channel - base_bitfield_channel;
+-		if (bitshift >= 32 || bitshift <= -32)
+-			break;
+ 		if (bitshift > 0) {
+ 			port_mask >>= bitshift;
+ 			port_data >>= bitshift;
+diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
+index 754d54e8d4a8..f680766ae1e7 100644
+--- a/drivers/staging/vt6656/main_usb.c
++++ b/drivers/staging/vt6656/main_usb.c
+@@ -1221,6 +1221,8 @@ device_release_WPADEV(pDevice);
+     memset(pMgmt->abyCurrBSSID, 0, 6);
+     pMgmt->eCurrState = WMAC_STATE_IDLE;
+ 
++	pDevice->flags &= ~DEVICE_FLAGS_OPENED;
++
+     device_free_tx_bufs(pDevice);
+     device_free_rx_bufs(pDevice);
+     device_free_int_bufs(pDevice);
+@@ -1232,7 +1234,6 @@ device_release_WPADEV(pDevice);
+     usb_free_urb(pDevice->pInterruptURB);
+ 
+     BSSvClearNodeDBTable(pDevice, 0);
+-    pDevice->flags &=(~DEVICE_FLAGS_OPENED);
+ 
+     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "device_close2 \n");
+ 
+diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
+index 926d483139b8..d197b3ecfbb4 100644
+--- a/drivers/staging/zram/zram_drv.c
++++ b/drivers/staging/zram/zram_drv.c
+@@ -709,9 +709,7 @@ static void zram_slot_free_notify(struct block_device *bdev,
+ 	struct zram *zram;
+ 
+ 	zram = bdev->bd_disk->private_data;
+-	down_write(&zram->lock);
+ 	zram_free_page(zram, index);
+-	up_write(&zram->lock);
+ 	zram_stat64_inc(zram, &zram->stats.notify_free);
+ }
+ 
+diff --git a/drivers/staging/zram/zram_drv.h b/drivers/staging/zram/zram_drv.h
+index 87f2fec1bc94..e5cd2469b6a0 100644
+--- a/drivers/staging/zram/zram_drv.h
++++ b/drivers/staging/zram/zram_drv.h
+@@ -107,9 +107,8 @@ struct zram {
+ 	void *compress_buffer;
+ 	struct table *table;
+ 	spinlock_t stat64_lock;	/* protect 64-bit stats */
+-	struct rw_semaphore lock; /* protect compression buffers, table,
+-				   * 32bit stat counters against concurrent
+-				   * notifications, reads and writes */
++	struct rw_semaphore lock; /* protect compression buffers and table
++				   * against concurrent read and writes */
+ 	struct request_queue *queue;
+ 	struct gendisk *disk;
+ 	int init_done;
+diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
+index c0b487284d9b..f5440a7da589 100644
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -552,11 +552,12 @@ static int dma_push_rx(struct eg20t_port *priv, int size)
+ 		dev_warn(port->dev, "Rx overrun: dropping %u bytes\n",
+ 			 size - room);
+ 	if (!room)
+-		return room;
++		goto out;
+ 
+ 	tty_insert_flip_string(tty, sg_virt(&priv->sg_rx), size);
+ 
+ 	port->icount.rx += room;
++out:
+ 	tty_kref_put(tty);
+ 
+ 	return room;
+@@ -970,6 +971,8 @@ static void pch_uart_err_ir(struct eg20t_port *priv, unsigned int lsr)
+ 	if (tty == NULL) {
+ 		for (i = 0; error_msg[i] != NULL; i++)
+ 			dev_err(&priv->pdev->dev, error_msg[i]);
++	} else {
++		tty_kref_put(tty);
+ 	}
+ }
+ 
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index fe8c04b739be..06dfb4fb331f 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -187,6 +187,7 @@ skip_error:
+ static void wdm_int_callback(struct urb *urb)
+ {
+ 	int rv = 0;
++	int responding;
+ 	int status = urb->status;
+ 	struct wdm_device *desc;
+ 	struct usb_ctrlrequest *req;
+@@ -260,8 +261,8 @@ static void wdm_int_callback(struct urb *urb)
+ 	desc->response->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+ 	spin_lock(&desc->iuspin);
+ 	clear_bit(WDM_READ, &desc->flags);
+-	set_bit(WDM_RESPONDING, &desc->flags);
+-	if (!test_bit(WDM_DISCONNECTING, &desc->flags)
++	responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
++	if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags)
+ 		&& !test_bit(WDM_SUSPENDING, &desc->flags)) {
+ 		rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+ 		dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
+@@ -658,16 +659,20 @@ static void wdm_rxwork(struct work_struct *work)
+ {
+ 	struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);
+ 	unsigned long flags;
+-	int rv;
++	int rv = 0;
++	int responding;
+ 
+ 	spin_lock_irqsave(&desc->iuspin, flags);
+ 	if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+ 		spin_unlock_irqrestore(&desc->iuspin, flags);
+ 	} else {
++		responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
+ 		spin_unlock_irqrestore(&desc->iuspin, flags);
+-		rv = usb_submit_urb(desc->response, GFP_KERNEL);
++		if (!responding)
++			rv = usb_submit_urb(desc->response, GFP_KERNEL);
+ 		if (rv < 0 && rv != -EPERM) {
+ 			spin_lock_irqsave(&desc->iuspin, flags);
++			clear_bit(WDM_RESPONDING, &desc->flags);
+ 			if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+ 				schedule_work(&desc->rxwork);
+ 			spin_unlock_irqrestore(&desc->iuspin, flags);
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index f4bdd0ce8d56..78609d302625 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -424,7 +424,8 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
+ 
+ 	memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+ 	if (config->desc.bDescriptorType != USB_DT_CONFIG ||
+-	    config->desc.bLength < USB_DT_CONFIG_SIZE) {
++	    config->desc.bLength < USB_DT_CONFIG_SIZE ||
++	    config->desc.bLength > size) {
+ 		dev_err(ddev, "invalid descriptor for config index %d: "
+ 		    "type = 0x%X, length = %d\n", cfgidx,
+ 		    config->desc.bDescriptorType, config->desc.bLength);
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 22f770abc399..49257b3053da 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -646,6 +646,22 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype,
+ 		if ((index & ~USB_DIR_IN) == 0)
+ 			return 0;
+ 		ret = findintfep(ps->dev, index);
++		if (ret < 0) {
++			/*
++			 * Some not fully compliant Win apps seem to get
++			 * index wrong and have the endpoint number here
++			 * rather than the endpoint address (with the
++			 * correct direction). Win does let this through,
++			 * so we'll not reject it here but leave it to
++			 * the device to not break KVM. But we warn.
++			 */
++			ret = findintfep(ps->dev, index ^ 0x80);
++			if (ret >= 0)
++				dev_info(&ps->dev->dev,
++					"%s: process %i (%s) requesting ep %02x but needs %02x\n",
++					__func__, task_pid_nr(current),
++					current->comm, index, index ^ 0x80);
++		}
+ 		if (ret >= 0)
+ 			ret = checkintf(ps, ret);
+ 		break;
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 2768a7e7cf2e..a5ea85ff5c0d 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3749,7 +3749,8 @@ static void hub_events(void)
+ 					hub->hdev->children[i - 1];
+ 
+ 				dev_dbg(hub_dev, "warm reset port %d\n", i);
+-				if (!udev) {
++				if (!udev || !(portstatus &
++						USB_PORT_STAT_CONNECTION)) {
+ 					status = hub_port_reset(hub, i,
+ 							NULL, HUB_BH_RESET_TIME,
+ 							true);
+@@ -3759,8 +3760,8 @@ static void hub_events(void)
+ 					usb_lock_device(udev);
+ 					status = usb_reset_device(udev);
+ 					usb_unlock_device(udev);
++					connect_change = 0;
+ 				}
+-				connect_change = 0;
+ 			}
+ 
+ 			if (connect_change)
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index f77c00042685..9edc582b7679 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -45,6 +45,8 @@
+ /* FIXME define these in <linux/pci_ids.h> */
+ #define PCI_VENDOR_ID_SYNOPSYS		0x16c3
+ #define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3	0xabcd
++#define PCI_DEVICE_ID_INTEL_BYT		0x0f37
++#define PCI_DEVICE_ID_INTEL_MRFLD	0x119e
+ 
+ #define DWC3_PCI_DEVS_POSSIBLE	32
+ 
+@@ -191,6 +193,8 @@ static DEFINE_PCI_DEVICE_TABLE(dwc3_pci_id_table) = {
+ 		PCI_DEVICE(PCI_VENDOR_ID_SYNOPSYS,
+ 				PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3),
+ 	},
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BYT), },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_MRFLD), },
+ 	{  }	/* Terminating Entry */
+ };
+ MODULE_DEVICE_TABLE(pci, dwc3_pci_id_table);
+diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
+index 55978fcfa4b2..08744737c5ab 100644
+--- a/drivers/usb/host/ehci-mxc.c
++++ b/drivers/usb/host/ehci-mxc.c
+@@ -296,7 +296,7 @@ static int __exit ehci_mxc_drv_remove(struct platform_device *pdev)
+ 	if (pdata && pdata->exit)
+ 		pdata->exit(pdev);
+ 
+-	if (pdata->otg)
++	if (pdata && pdata->otg)
+ 		otg_shutdown(pdata->otg);
+ 
+ 	usb_remove_hcd(hcd);
+diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
+index b71e22e73263..29c042111714 100644
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -543,7 +543,7 @@ static struct pci_driver ehci_pci_driver = {
+ 	.remove =	usb_hcd_pci_remove,
+ 	.shutdown = 	usb_hcd_pci_shutdown,
+ 
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_PM
+ 	.driver =	{
+ 		.pm =	&usb_hcd_pci_pm_ops
+ 	},
+diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
+index bc01b064585a..839cb648d248 100644
+--- a/drivers/usb/host/ohci-pci.c
++++ b/drivers/usb/host/ohci-pci.c
+@@ -413,7 +413,7 @@ static struct pci_driver ohci_pci_driver = {
+ 	.remove =	usb_hcd_pci_remove,
+ 	.shutdown =	usb_hcd_pci_shutdown,
+ 
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_PM
+ 	.driver =	{
+ 		.pm =	&usb_hcd_pci_pm_ops
+ 	},
+diff --git a/drivers/usb/host/uhci-pci.c b/drivers/usb/host/uhci-pci.c
+index c300bd2f7d1c..0f228c46eeda 100644
+--- a/drivers/usb/host/uhci-pci.c
++++ b/drivers/usb/host/uhci-pci.c
+@@ -293,7 +293,7 @@ static struct pci_driver uhci_pci_driver = {
+ 	.remove =	usb_hcd_pci_remove,
+ 	.shutdown =	uhci_shutdown,
+ 
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_PM
+ 	.driver =	{
+ 		.pm =	&usb_hcd_pci_pm_ops
+ 	},
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 79d27209c563..61b06688c916 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -330,7 +330,7 @@ static struct pci_driver xhci_pci_driver = {
+ 	/* suspend and resume implemented later */
+ 
+ 	.shutdown = 	usb_hcd_pci_shutdown,
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_PM
+ 	.driver = {
+ 		.pm = &usb_hcd_pci_pm_ops
+ 	},
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 633476e25bbc..2b4f42bac98f 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -879,8 +879,12 @@ remove_finished_td:
+ 		/* Otherwise ring the doorbell(s) to restart queued transfers */
+ 		ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
+ 	}
+-	ep->stopped_td = NULL;
+-	ep->stopped_trb = NULL;
++
++	/* Clear stopped_td and stopped_trb if endpoint is not halted */
++	if (!(ep->ep_state & EP_HALTED)) {
++		ep->stopped_td = NULL;
++		ep->stopped_trb = NULL;
++	}
+ 
+ 	/*
+ 	 * Drop the lock and complete the URBs in the cancelled TD list.
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 6e1c92a11eb0..629aa743e45b 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3484,10 +3484,21 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ 	struct xhci_virt_device *virt_dev;
++	struct device *dev = hcd->self.controller;
+ 	unsigned long flags;
+ 	u32 state;
+ 	int i, ret;
+ 
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++	/*
++	 * We called pm_runtime_get_noresume when the device was attached.
++	 * Decrement the counter here to allow controller to runtime suspend
++	 * if no devices remain.
++	 */
++	if (xhci->quirks & XHCI_RESET_ON_RESUME)
++		pm_runtime_put_noidle(dev);
++#endif
++
+ 	ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
+ 	/* If the host is halted due to driver unload, we still need to free the
+ 	 * device.
+@@ -3559,6 +3570,7 @@ static int xhci_reserve_host_control_ep_resources(struct xhci_hcd *xhci)
+ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++	struct device *dev = hcd->self.controller;
+ 	unsigned long flags;
+ 	int timeleft;
+ 	int ret;
+@@ -3611,6 +3623,16 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ 		goto disable_slot;
+ 	}
+ 	udev->slot_id = xhci->slot_id;
++
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++	/*
++	 * If resetting upon resume, we can't put the controller into runtime
++	 * suspend if there is a device attached.
++	 */
++	if (xhci->quirks & XHCI_RESET_ON_RESUME)
++		pm_runtime_get_noresume(dev);
++#endif
++
+ 	/* Is this a LS or FS device under a HS hub? */
+ 	/* Hub or peripherial? */
+ 	return 1;
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index 9270d5c919cf..8e02ff2b7d7f 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -383,7 +383,7 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ 		kfree(urbtrack);
+ 		return -ENOMEM;
+ 	}
+-	urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
++	urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_ATOMIC);
+ 	if (!urbtrack->setup) {
+ 		usb_free_urb(urbtrack->urb);
+ 		kfree(urbtrack);
+@@ -391,8 +391,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ 	}
+ 	urbtrack->setup->bRequestType = (__u8)0x40;
+ 	urbtrack->setup->bRequest = (__u8)0x0e;
+-	urbtrack->setup->wValue = get_reg_value(reg, dummy);
+-	urbtrack->setup->wIndex = get_reg_index(reg);
++	urbtrack->setup->wValue = cpu_to_le16(get_reg_value(reg, dummy));
++	urbtrack->setup->wIndex = cpu_to_le16(get_reg_index(reg));
+ 	urbtrack->setup->wLength = 0;
+ 	usb_fill_control_urb(urbtrack->urb, usbdev,
+ 			     usb_sndctrlpipe(usbdev, 0),
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index c2103f404b3c..536c4ad2f5b7 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -81,6 +81,7 @@ static void option_instat_callback(struct urb *urb);
+ 
+ #define HUAWEI_VENDOR_ID			0x12D1
+ #define HUAWEI_PRODUCT_E173			0x140C
++#define HUAWEI_PRODUCT_E1750			0x1406
+ #define HUAWEI_PRODUCT_K4505			0x1464
+ #define HUAWEI_PRODUCT_K3765			0x1465
+ #define HUAWEI_PRODUCT_K4605			0x14C6
+@@ -581,6 +582,8 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff),
+ 		.driver_info = (kernel_ulong_t) &net_intf1_blacklist },
++	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1750, 0xff, 0xff, 0xff),
++		.driver_info = (kernel_ulong_t) &net_intf2_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1441, USB_CLASS_COMM, 0x02, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1442, USB_CLASS_COMM, 0x02, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff),
+diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
+index bf1c094f4ebf..b657de614a06 100644
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -355,9 +355,18 @@ void gnttab_request_free_callback(struct gnttab_free_callback *callback,
+ 				  void (*fn)(void *), void *arg, u16 count)
+ {
+ 	unsigned long flags;
++	struct gnttab_free_callback *cb;
++
+ 	spin_lock_irqsave(&gnttab_list_lock, flags);
+-	if (callback->next)
+-		goto out;
++
++	/* Check if the callback is already on the list */
++	cb = gnttab_free_callback_list;
++	while (cb) {
++		if (cb == callback)
++			goto out;
++		cb = cb->next;
++	}
++
+ 	callback->fn = fn;
+ 	callback->arg = arg;
+ 	callback->count = count;
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index f3a257d7a985..fb001cde0af3 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -380,8 +380,7 @@ EXPORT_SYMBOL_GPL(debugfs_remove);
+  */
+ void debugfs_remove_recursive(struct dentry *dentry)
+ {
+-	struct dentry *child;
+-	struct dentry *parent;
++	struct dentry *child, *next, *parent;
+ 
+ 	if (!dentry)
+ 		return;
+@@ -391,61 +390,37 @@ void debugfs_remove_recursive(struct dentry *dentry)
+ 		return;
+ 
+ 	parent = dentry;
++ down:
+ 	mutex_lock(&parent->d_inode->i_mutex);
++	list_for_each_entry_safe(child, next, &parent->d_subdirs, d_u.d_child) {
++		if (!debugfs_positive(child))
++			continue;
+ 
+-	while (1) {
+-		/*
+-		 * When all dentries under "parent" has been removed,
+-		 * walk up the tree until we reach our starting point.
+-		 */
+-		if (list_empty(&parent->d_subdirs)) {
+-			mutex_unlock(&parent->d_inode->i_mutex);
+-			if (parent == dentry)
+-				break;
+-			parent = parent->d_parent;
+-			mutex_lock(&parent->d_inode->i_mutex);
+-		}
+-		child = list_entry(parent->d_subdirs.next, struct dentry,
+-				d_u.d_child);
+- next_sibling:
+-
+-		/*
+-		 * If "child" isn't empty, walk down the tree and
+-		 * remove all its descendants first.
+-		 */
++		/* perhaps simple_empty(child) makes more sense */
+ 		if (!list_empty(&child->d_subdirs)) {
+ 			mutex_unlock(&parent->d_inode->i_mutex);
+ 			parent = child;
+-			mutex_lock(&parent->d_inode->i_mutex);
+-			continue;
+-		}
+-		__debugfs_remove(child, parent);
+-		if (parent->d_subdirs.next == &child->d_u.d_child) {
+-			/*
+-			 * Try the next sibling.
+-			 */
+-			if (child->d_u.d_child.next != &parent->d_subdirs) {
+-				child = list_entry(child->d_u.d_child.next,
+-						   struct dentry,
+-						   d_u.d_child);
+-				goto next_sibling;
+-			}
+-
+-			/*
+-			 * Avoid infinite loop if we fail to remove
+-			 * one dentry.
+-			 */
+-			mutex_unlock(&parent->d_inode->i_mutex);
+-			break;
++			goto down;
+ 		}
+-		simple_release_fs(&debugfs_mount, &debugfs_mount_count);
++ up:
++		if (!__debugfs_remove(child, parent))
++			simple_release_fs(&debugfs_mount, &debugfs_mount_count);
+ 	}
+ 
+-	parent = dentry->d_parent;
++	mutex_unlock(&parent->d_inode->i_mutex);
++	child = parent;
++	parent = parent->d_parent;
+ 	mutex_lock(&parent->d_inode->i_mutex);
+-	__debugfs_remove(dentry, parent);
++
++	if (child != dentry) {
++		next = list_entry(child->d_u.d_child.next, struct dentry,
++					d_u.d_child);
++		goto up;
++	}
++
++	if (!__debugfs_remove(child, parent))
++		simple_release_fs(&debugfs_mount, &debugfs_mount_count);
+ 	mutex_unlock(&parent->d_inode->i_mutex);
+-	simple_release_fs(&debugfs_mount, &debugfs_mount_count);
+ }
+ EXPORT_SYMBOL_GPL(debugfs_remove_recursive);
+ 
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 3ca3b7fabb1b..2e0e34f957cc 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -2054,7 +2054,8 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
+ 	int err = 0;
+ 
+ 	/* ext4_handle_valid() assumes a valid handle_t pointer */
+-	if (handle && !ext4_handle_valid(handle))
++	if (handle && !ext4_handle_valid(handle) &&
++	    !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS))
+ 		return 0;
+ 
+ 	mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock);
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 5ef7afb9cf3e..06e2f73e64a8 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1063,6 +1063,8 @@ static int parse_dirfile(char *buf, size_t nbytes, struct file *file,
+ 			return -EIO;
+ 		if (reclen > nbytes)
+ 			break;
++		if (memchr(dirent->name, '/', dirent->namelen) != NULL)
++			return -EIO;
+ 
+ 		over = filldir(dstbuf, dirent->name, dirent->namelen,
+ 			       file->f_pos, dirent->ino, dirent->type);
+@@ -1282,6 +1284,7 @@ static int fuse_do_setattr(struct dentry *entry, struct iattr *attr,
+ {
+ 	struct inode *inode = entry->d_inode;
+ 	struct fuse_conn *fc = get_fuse_conn(inode);
++	struct fuse_inode *fi = get_fuse_inode(inode);
+ 	struct fuse_req *req;
+ 	struct fuse_setattr_in inarg;
+ 	struct fuse_attr_out outarg;
+@@ -1312,8 +1315,10 @@ static int fuse_do_setattr(struct dentry *entry, struct iattr *attr,
+ 	if (IS_ERR(req))
+ 		return PTR_ERR(req);
+ 
+-	if (is_truncate)
++	if (is_truncate) {
+ 		fuse_set_nowrite(inode);
++		set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
++	}
+ 
+ 	memset(&inarg, 0, sizeof(inarg));
+ 	memset(&outarg, 0, sizeof(outarg));
+@@ -1375,12 +1380,14 @@ static int fuse_do_setattr(struct dentry *entry, struct iattr *attr,
+ 		invalidate_inode_pages2(inode->i_mapping);
+ 	}
+ 
++	clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ 	return 0;
+ 
+ error:
+ 	if (is_truncate)
+ 		fuse_release_nowrite(inode);
+ 
++	clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ 	return err;
+ }
+ 
+@@ -1439,6 +1446,8 @@ static int fuse_setxattr(struct dentry *entry, const char *name,
+ 		fc->no_setxattr = 1;
+ 		err = -EOPNOTSUPP;
+ 	}
++	if (!err)
++		fuse_invalidate_attr(inode);
+ 	return err;
+ }
+ 
+@@ -1568,6 +1577,8 @@ static int fuse_removexattr(struct dentry *entry, const char *name)
+ 		fc->no_removexattr = 1;
+ 		err = -EOPNOTSUPP;
+ 	}
++	if (!err)
++		fuse_invalidate_attr(inode);
+ 	return err;
+ }
+ 
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 5242006b9515..510d4aa26686 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -519,7 +519,8 @@ static void fuse_read_update_size(struct inode *inode, loff_t size,
+ 	struct fuse_inode *fi = get_fuse_inode(inode);
+ 
+ 	spin_lock(&fc->lock);
+-	if (attr_ver == fi->attr_version && size < inode->i_size) {
++	if (attr_ver == fi->attr_version && size < inode->i_size &&
++	    !test_bit(FUSE_I_SIZE_UNSTABLE, &fi->state)) {
+ 		fi->attr_version = ++fc->attr_version;
+ 		i_size_write(inode, size);
+ 	}
+@@ -881,12 +882,16 @@ static ssize_t fuse_perform_write(struct file *file,
+ {
+ 	struct inode *inode = mapping->host;
+ 	struct fuse_conn *fc = get_fuse_conn(inode);
++	struct fuse_inode *fi = get_fuse_inode(inode);
+ 	int err = 0;
+ 	ssize_t res = 0;
+ 
+ 	if (is_bad_inode(inode))
+ 		return -EIO;
+ 
++	if (inode->i_size < pos + iov_iter_count(ii))
++		set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
++
+ 	do {
+ 		struct fuse_req *req;
+ 		ssize_t count;
+@@ -921,6 +926,7 @@ static ssize_t fuse_perform_write(struct file *file,
+ 	if (res > 0)
+ 		fuse_write_update_size(inode, pos);
+ 
++	clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ 	fuse_invalidate_attr(inode);
+ 
+ 	return res > 0 ? res : err;
+@@ -1251,7 +1257,6 @@ static int fuse_writepage_locked(struct page *page)
+ 
+ 	inc_bdi_stat(mapping->backing_dev_info, BDI_WRITEBACK);
+ 	inc_zone_page_state(tmp_page, NR_WRITEBACK_TEMP);
+-	end_page_writeback(page);
+ 
+ 	spin_lock(&fc->lock);
+ 	list_add(&req->writepages_entry, &fi->writepages);
+@@ -1259,6 +1264,8 @@ static int fuse_writepage_locked(struct page *page)
+ 	fuse_flush_writepages(inode);
+ 	spin_unlock(&fc->lock);
+ 
++	end_page_writeback(page);
++
+ 	return 0;
+ 
+ err_free:
+diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
+index 89c4a58bc364..52ffd2496fb5 100644
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -103,6 +103,15 @@ struct fuse_inode {
+ 
+ 	/** List of writepage requestst (pending or sent) */
+ 	struct list_head writepages;
++
++	/** Miscellaneous bits describing inode state */
++	unsigned long state;
++};
++
++/** FUSE inode state bits */
++enum {
++	/** An operation changing file size is in progress  */
++	FUSE_I_SIZE_UNSTABLE,
+ };
+ 
+ struct fuse_conn;
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index 1f82d953305c..912c250b314a 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -92,6 +92,7 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)
+ 	fi->attr_version = 0;
+ 	fi->writectr = 0;
+ 	fi->orig_ino = 0;
++	fi->state = 0;
+ 	INIT_LIST_HEAD(&fi->write_files);
+ 	INIT_LIST_HEAD(&fi->queued_writes);
+ 	INIT_LIST_HEAD(&fi->writepages);
+@@ -200,7 +201,8 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,
+ 	loff_t oldsize;
+ 
+ 	spin_lock(&fc->lock);
+-	if (attr_version != 0 && fi->attr_version > attr_version) {
++	if ((attr_version != 0 && fi->attr_version > attr_version) ||
++	    test_bit(FUSE_I_SIZE_UNSTABLE, &fi->state)) {
+ 		spin_unlock(&fc->lock);
+ 		return;
+ 	}
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index f950059525fc..a5f25a70c015 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -120,8 +120,8 @@ static void destroy_inodecache(void)
+ 
+ static int isofs_remount(struct super_block *sb, int *flags, char *data)
+ {
+-	/* we probably want a lot more here */
+-	*flags |= MS_RDONLY;
++	if (!(*flags & MS_RDONLY))
++		return -EROFS;
+ 	return 0;
+ }
+ 
+@@ -770,15 +770,6 @@ root_found:
+ 	 */
+ 	s->s_maxbytes = 0x80000000000LL;
+ 
+-	/*
+-	 * The CDROM is read-only, has no nodes (devices) on it, and since
+-	 * all of the files appear to be owned by root, we really do not want
+-	 * to allow suid.  (suid or devices will not show up unless we have
+-	 * Rock Ridge extensions)
+-	 */
+-
+-	s->s_flags |= MS_RDONLY /* | MS_NODEV | MS_NOSUID */;
+-
+ 	/* Set this for reference. Its not currently used except on write
+ 	   which we don't have .. */
+ 
+@@ -1535,6 +1526,9 @@ struct inode *isofs_iget(struct super_block *sb,
+ static struct dentry *isofs_mount(struct file_system_type *fs_type,
+ 	int flags, const char *dev_name, void *data)
+ {
++	/* We don't support read-write mounts */
++	if (!(flags & MS_RDONLY))
++		return ERR_PTR(-EACCES);
+ 	return mount_bdev(fs_type, flags, dev_name, data, isofs_fill_super);
+ }
+ 
+diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
+index 65221a04c6f0..16eacece560f 100644
+--- a/fs/nilfs2/page.c
++++ b/fs/nilfs2/page.c
+@@ -94,6 +94,7 @@ void nilfs_forget_buffer(struct buffer_head *bh)
+ 	clear_buffer_nilfs_volatile(bh);
+ 	clear_buffer_nilfs_checked(bh);
+ 	clear_buffer_nilfs_redirected(bh);
++	clear_buffer_async_write(bh);
+ 	clear_buffer_dirty(bh);
+ 	if (nilfs_page_buffers_clean(page))
+ 		__nilfs_clear_page_dirty(page);
+@@ -390,6 +391,7 @@ void nilfs_clear_dirty_pages(struct address_space *mapping)
+ 			bh = head = page_buffers(page);
+ 			do {
+ 				lock_buffer(bh);
++				clear_buffer_async_write(bh);
+ 				clear_buffer_dirty(bh);
+ 				clear_buffer_nilfs_volatile(bh);
+ 				clear_buffer_nilfs_checked(bh);
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index 6f24e67162c0..233d3ed264fa 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -662,7 +662,7 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode,
+ 
+ 		bh = head = page_buffers(page);
+ 		do {
+-			if (!buffer_dirty(bh))
++			if (!buffer_dirty(bh) || buffer_async_write(bh))
+ 				continue;
+ 			get_bh(bh);
+ 			list_add_tail(&bh->b_assoc_buffers, listp);
+@@ -696,7 +696,8 @@ static void nilfs_lookup_dirty_node_buffers(struct inode *inode,
+ 		for (i = 0; i < pagevec_count(&pvec); i++) {
+ 			bh = head = page_buffers(pvec.pages[i]);
+ 			do {
+-				if (buffer_dirty(bh)) {
++				if (buffer_dirty(bh) &&
++						!buffer_async_write(bh)) {
+ 					get_bh(bh);
+ 					list_add_tail(&bh->b_assoc_buffers,
+ 						      listp);
+@@ -1576,6 +1577,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
+ 
+ 		list_for_each_entry(bh, &segbuf->sb_segsum_buffers,
+ 				    b_assoc_buffers) {
++			set_buffer_async_write(bh);
+ 			if (bh->b_page != bd_page) {
+ 				if (bd_page) {
+ 					lock_page(bd_page);
+@@ -1589,6 +1591,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
+ 
+ 		list_for_each_entry(bh, &segbuf->sb_payload_buffers,
+ 				    b_assoc_buffers) {
++			set_buffer_async_write(bh);
+ 			if (bh == segbuf->sb_super_root) {
+ 				if (bh->b_page != bd_page) {
+ 					lock_page(bd_page);
+@@ -1674,6 +1677,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
+ 	list_for_each_entry(segbuf, logs, sb_list) {
+ 		list_for_each_entry(bh, &segbuf->sb_segsum_buffers,
+ 				    b_assoc_buffers) {
++			clear_buffer_async_write(bh);
+ 			if (bh->b_page != bd_page) {
+ 				if (bd_page)
+ 					end_page_writeback(bd_page);
+@@ -1683,6 +1687,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
+ 
+ 		list_for_each_entry(bh, &segbuf->sb_payload_buffers,
+ 				    b_assoc_buffers) {
++			clear_buffer_async_write(bh);
+ 			if (bh == segbuf->sb_super_root) {
+ 				if (bh->b_page != bd_page) {
+ 					end_page_writeback(bd_page);
+@@ -1752,6 +1757,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
+ 				    b_assoc_buffers) {
+ 			set_buffer_uptodate(bh);
+ 			clear_buffer_dirty(bh);
++			clear_buffer_async_write(bh);
+ 			if (bh->b_page != bd_page) {
+ 				if (bd_page)
+ 					end_page_writeback(bd_page);
+@@ -1773,6 +1779,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
+ 				    b_assoc_buffers) {
+ 			set_buffer_uptodate(bh);
+ 			clear_buffer_dirty(bh);
++			clear_buffer_async_write(bh);
+ 			clear_buffer_delay(bh);
+ 			clear_buffer_nilfs_volatile(bh);
+ 			clear_buffer_nilfs_redirected(bh);
+diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
+index a50636025364..0c2f9122b262 100644
+--- a/fs/notify/fanotify/fanotify.c
++++ b/fs/notify/fanotify/fanotify.c
+@@ -18,6 +18,12 @@ static bool should_merge(struct fsnotify_event *old, struct fsnotify_event *new)
+ 	    old->tgid == new->tgid) {
+ 		switch (old->data_type) {
+ 		case (FSNOTIFY_EVENT_PATH):
++#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
++			/* dont merge two permission events */
++			if ((old->mask & FAN_ALL_PERM_EVENTS) &&
++			    (new->mask & FAN_ALL_PERM_EVENTS))
++				return false;
++#endif
+ 			if ((old->path.mnt == new->path.mnt) &&
+ 			    (old->path.dentry == new->path.dentry))
+ 				return true;
+diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
+index 7eb1c0c7c166..cf228479879d 100644
+--- a/fs/ocfs2/extent_map.c
++++ b/fs/ocfs2/extent_map.c
+@@ -782,7 +782,6 @@ int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ 	cpos = map_start >> osb->s_clustersize_bits;
+ 	mapping_end = ocfs2_clusters_for_bytes(inode->i_sb,
+ 					       map_start + map_len);
+-	mapping_end -= cpos;
+ 	is_last = 0;
+ 	while (cpos < mapping_end && !is_last) {
+ 		u32 fe_flags;
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 331e2ef7eaa5..19fe719ace3e 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -416,10 +416,12 @@ struct hid_report {
+ 	struct hid_device *device;			/* associated device */
+ };
+ 
++#define HID_MAX_IDS 256
++
+ struct hid_report_enum {
+ 	unsigned numbered;
+ 	struct list_head report_list;
+-	struct hid_report *report_id_hash[256];
++	struct hid_report *report_id_hash[HID_MAX_IDS];
+ };
+ 
+ #define HID_REPORT_TYPES 3
+@@ -716,6 +718,10 @@ void hid_output_report(struct hid_report *report, __u8 *data);
+ struct hid_device *hid_allocate_device(void);
+ struct hid_report *hid_register_report(struct hid_device *device, unsigned type, unsigned id);
+ int hid_parse_report(struct hid_device *hid, __u8 *start, unsigned size);
++struct hid_report *hid_validate_values(struct hid_device *hid,
++				       unsigned int type, unsigned int id,
++				       unsigned int field_index,
++				       unsigned int report_counts);
+ int hid_check_keys_pressed(struct hid_device *hid);
+ int hid_connect(struct hid_device *hid, unsigned int connect_mask);
+ void hid_disconnect(struct hid_device *hid);
+diff --git a/include/linux/icmpv6.h b/include/linux/icmpv6.h
+index ba45e6bc0764..f5a21d0a22ba 100644
+--- a/include/linux/icmpv6.h
++++ b/include/linux/icmpv6.h
+@@ -123,6 +123,8 @@ static inline struct icmp6hdr *icmp6_hdr(const struct sk_buff *skb)
+ #define ICMPV6_NOT_NEIGHBOUR		2
+ #define ICMPV6_ADDR_UNREACH		3
+ #define ICMPV6_PORT_UNREACH		4
++#define ICMPV6_POLICY_FAIL		5
++#define ICMPV6_REJECT_ROUTE		6
+ 
+ /*
+  *	Codes for Time Exceeded
+diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
+index 0c997767429a..84b1447481b5 100644
+--- a/include/linux/ipv6.h
++++ b/include/linux/ipv6.h
+@@ -255,6 +255,7 @@ struct inet6_skb_parm {
+ #define IP6SKB_XFRM_TRANSFORMED	1
+ #define IP6SKB_FORWARDED	2
+ #define IP6SKB_REROUTED		4
++#define IP6SKB_FRAGMENTED      16
+ };
+ 
+ #define IP6CB(skb)	((struct inet6_skb_parm*)((skb)->cb))
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index d0493f6064f3..305fd756fc4f 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -865,7 +865,8 @@ extern void pagefault_out_of_memory(void);
+  * Flags passed to show_mem() and show_free_areas() to suppress output in
+  * various contexts.
+  */
+-#define SHOW_MEM_FILTER_NODES	(0x0001u)	/* filter disallowed nodes */
++#define SHOW_MEM_FILTER_NODES		(0x0001u)	/* disallowed nodes */
++#define SHOW_MEM_FILTER_PAGE_COUNT	(0x0002u)	/* page type count */
+ 
+ extern void show_free_areas(unsigned int flags);
+ extern bool skip_free_areas_node(unsigned int flags, int nid);
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index 3cfcfea6bfc9..eeb6a29ee1e1 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -927,7 +927,7 @@ struct perf_cpu_context {
+ 	int				exclusive;
+ 	struct list_head		rotation_list;
+ 	int				jiffies_interval;
+-	struct pmu			*active_pmu;
++	struct pmu			*unique_pmu;
+ 	struct perf_cgroup		*cgrp;
+ };
+ 
+diff --git a/include/linux/rculist.h b/include/linux/rculist.h
+index 6f95e241ed68..3863352656e7 100644
+--- a/include/linux/rculist.h
++++ b/include/linux/rculist.h
+@@ -254,8 +254,9 @@ static inline void list_splice_init_rcu(struct list_head *list,
+  */
+ #define list_first_or_null_rcu(ptr, type, member) \
+ 	({struct list_head *__ptr = (ptr); \
+-	  struct list_head __rcu *__next = list_next_rcu(__ptr); \
+-	  likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \
++	  struct list_head *__next = ACCESS_ONCE(__ptr->next); \
++	  likely(__ptr != __next) ? \
++		list_entry_rcu(__next, type, member) : NULL; \
+ 	})
+ 
+ /**
+diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
+index 03354d557b79..0daa46b82043 100644
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -395,7 +395,7 @@ extern int usb_hcd_pci_probe(struct pci_dev *dev,
+ extern void usb_hcd_pci_remove(struct pci_dev *dev);
+ extern void usb_hcd_pci_shutdown(struct pci_dev *dev);
+ 
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_PM
+ extern const struct dev_pm_ops usb_hcd_pci_pm_ops;
+ #endif
+ #endif /* CONFIG_PCI */
+diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
+index e9ff3fc5e688..34b06dadca05 100644
+--- a/include/net/inetpeer.h
++++ b/include/net/inetpeer.h
+@@ -41,6 +41,10 @@ struct inet_peer {
+ 	u32			pmtu_orig;
+ 	u32			pmtu_learned;
+ 	struct inetpeer_addr_base redirect_learned;
++	union {
++		struct list_head	gc_list;
++		struct rcu_head     gc_rcu;
++	};
+ 	/*
+ 	 * Once inet_peer is queued for deletion (refcnt == -1), following fields
+ 	 * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
+@@ -96,6 +100,8 @@ static inline struct inet_peer *inet_getpeer_v6(const struct in6_addr *v6daddr,
+ extern void inet_putpeer(struct inet_peer *p);
+ extern bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout);
+ 
++extern void inetpeer_invalidate_tree(int family);
++
+ /*
+  * temporary check to make sure we dont access rid, ip_id_count, tcp_ts,
+  * tcp_ts_stamp if no refcount is taken on inet_peer
+diff --git a/include/net/ip.h b/include/net/ip.h
+index eca0ef7a495e..06aed72023f7 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -266,9 +266,11 @@ int ip_dont_fragment(struct sock *sk, struct dst_entry *dst)
+ 
+ extern void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more);
+ 
+-static inline void ip_select_ident(struct iphdr *iph, struct dst_entry *dst, struct sock *sk)
++static inline void ip_select_ident(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk)
+ {
+-	if (iph->frag_off & htons(IP_DF)) {
++	struct iphdr *iph = ip_hdr(skb);
++
++	if ((iph->frag_off & htons(IP_DF)) && !skb->local_df) {
+ 		/* This is only to work around buggy Windows95/2000
+ 		 * VJ compression implementations.  If the ID field
+ 		 * does not change, they drop every other packet in
+@@ -280,9 +282,11 @@ static inline void ip_select_ident(struct iphdr *iph, struct dst_entry *dst, str
+ 		__ip_select_ident(iph, dst, 0);
+ }
+ 
+-static inline void ip_select_ident_more(struct iphdr *iph, struct dst_entry *dst, struct sock *sk, int more)
++static inline void ip_select_ident_more(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk, int more)
+ {
+-	if (iph->frag_off & htons(IP_DF)) {
++	struct iphdr *iph = ip_hdr(skb);
++
++	if ((iph->frag_off & htons(IP_DF)) && !skb->local_df) {
+ 		if (sk && inet_sk(sk)->inet_daddr) {
+ 			iph->id = htons(inet_sk(sk)->inet_id);
+ 			inet_sk(sk)->inet_id += 1 + more;
+diff --git a/include/net/ipip.h b/include/net/ipip.h
+index a32654d52730..4dccfe3bf731 100644
+--- a/include/net/ipip.h
++++ b/include/net/ipip.h
+@@ -50,7 +50,7 @@ struct ip_tunnel_prl_entry {
+ 	int pkt_len = skb->len - skb_transport_offset(skb);		\
+ 									\
+ 	skb->ip_summed = CHECKSUM_NONE;					\
+-	ip_select_ident(iph, &rt->dst, NULL);				\
++	ip_select_ident(skb, &rt->dst, NULL);				\
+ 									\
+ 	err = ip_local_out(skb);					\
+ 	if (likely(net_xmit_eval(err) == 0)) {				\
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index d2a01fee0d42..2a1ffb7b1915 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -3504,6 +3504,7 @@ static int cgroup_write_event_control(struct cgroup *cgrp, struct cftype *cft,
+ 				      const char *buffer)
+ {
+ 	struct cgroup_event *event = NULL;
++	struct cgroup *cgrp_cfile;
+ 	unsigned int efd, cfd;
+ 	struct file *efile = NULL;
+ 	struct file *cfile = NULL;
+@@ -3559,6 +3560,16 @@ static int cgroup_write_event_control(struct cgroup *cgrp, struct cftype *cft,
+ 		goto fail;
+ 	}
+ 
++	/*
++	 * The file to be monitored must be in the same cgroup as
++	 * cgroup.event_control is.
++	 */
++	cgrp_cfile = __d_cgrp(cfile->f_dentry->d_parent);
++	if (cgrp_cfile != cgrp) {
++		ret = -EINVAL;
++		goto fail;
++	}
++
+ 	if (!event->cft->register_event || !event->cft->unregister_event) {
+ 		ret = -EINVAL;
+ 		goto fail;
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 5bbe443b0177..83d5621b7d90 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -242,9 +242,9 @@ perf_cgroup_match(struct perf_event *event)
+ 	return !event->cgrp || event->cgrp == cpuctx->cgrp;
+ }
+ 
+-static inline void perf_get_cgroup(struct perf_event *event)
++static inline bool perf_tryget_cgroup(struct perf_event *event)
+ {
+-	css_get(&event->cgrp->css);
++	return css_tryget(&event->cgrp->css);
+ }
+ 
+ static inline void perf_put_cgroup(struct perf_event *event)
+@@ -360,6 +360,8 @@ void perf_cgroup_switch(struct task_struct *task, int mode)
+ 
+ 	list_for_each_entry_rcu(pmu, &pmus, entry) {
+ 		cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
++		if (cpuctx->unique_pmu != pmu)
++			continue; /* ensure we process each cpuctx once */
+ 
+ 		/*
+ 		 * perf_cgroup_events says at least one
+@@ -383,9 +385,10 @@ void perf_cgroup_switch(struct task_struct *task, int mode)
+ 
+ 			if (mode & PERF_CGROUP_SWIN) {
+ 				WARN_ON_ONCE(cpuctx->cgrp);
+-				/* set cgrp before ctxsw in to
+-				 * allow event_filter_match() to not
+-				 * have to pass task around
++				/*
++				 * set cgrp before ctxsw in to allow
++				 * event_filter_match() to not have to pass
++				 * task around
+ 				 */
+ 				cpuctx->cgrp = perf_cgroup_from_task(task);
+ 				cpu_ctx_sched_in(cpuctx, EVENT_ALL, task);
+@@ -473,7 +476,11 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,
+ 	event->cgrp = cgrp;
+ 
+ 	/* must be done before we fput() the file */
+-	perf_get_cgroup(event);
++	if (!perf_tryget_cgroup(event)) {
++		event->cgrp = NULL;
++		ret = -ENOENT;
++		goto out;
++	}
+ 
+ 	/*
+ 	 * all events in a group must monitor
+@@ -4377,7 +4384,7 @@ static void perf_event_task_event(struct perf_task_event *task_event)
+ 	rcu_read_lock();
+ 	list_for_each_entry_rcu(pmu, &pmus, entry) {
+ 		cpuctx = get_cpu_ptr(pmu->pmu_cpu_context);
+-		if (cpuctx->active_pmu != pmu)
++		if (cpuctx->unique_pmu != pmu)
+ 			goto next;
+ 		perf_event_task_ctx(&cpuctx->ctx, task_event);
+ 
+@@ -4523,7 +4530,7 @@ static void perf_event_comm_event(struct perf_comm_event *comm_event)
+ 	rcu_read_lock();
+ 	list_for_each_entry_rcu(pmu, &pmus, entry) {
+ 		cpuctx = get_cpu_ptr(pmu->pmu_cpu_context);
+-		if (cpuctx->active_pmu != pmu)
++		if (cpuctx->unique_pmu != pmu)
+ 			goto next;
+ 		perf_event_comm_ctx(&cpuctx->ctx, comm_event);
+ 
+@@ -4719,7 +4726,7 @@ got_name:
+ 	rcu_read_lock();
+ 	list_for_each_entry_rcu(pmu, &pmus, entry) {
+ 		cpuctx = get_cpu_ptr(pmu->pmu_cpu_context);
+-		if (cpuctx->active_pmu != pmu)
++		if (cpuctx->unique_pmu != pmu)
+ 			goto next;
+ 		perf_event_mmap_ctx(&cpuctx->ctx, mmap_event,
+ 					vma->vm_flags & VM_EXEC);
+@@ -5741,8 +5748,8 @@ static void update_pmu_context(struct pmu *pmu, struct pmu *old_pmu)
+ 
+ 		cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
+ 
+-		if (cpuctx->active_pmu == old_pmu)
+-			cpuctx->active_pmu = pmu;
++		if (cpuctx->unique_pmu == old_pmu)
++			cpuctx->unique_pmu = pmu;
+ 	}
+ }
+ 
+@@ -5877,7 +5884,7 @@ skip_type:
+ 		cpuctx->ctx.pmu = pmu;
+ 		cpuctx->jiffies_interval = 1;
+ 		INIT_LIST_HEAD(&cpuctx->rotation_list);
+-		cpuctx->active_pmu = pmu;
++		cpuctx->unique_pmu = pmu;
+ 	}
+ 
+ got_cpu_context:
+diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
+index 59474c5ecf6c..c261da7ddc71 100644
+--- a/kernel/sched_fair.c
++++ b/kernel/sched_fair.c
+@@ -4890,11 +4890,15 @@ static void task_fork_fair(struct task_struct *p)
+ 
+ 	update_rq_clock(rq);
+ 
+-	if (unlikely(task_cpu(p) != this_cpu)) {
+-		rcu_read_lock();
+-		__set_task_cpu(p, this_cpu);
+-		rcu_read_unlock();
+-	}
++	/*
++	 * Not only the cpu but also the task_group of the parent might have
++	 * been changed after parent->se.parent,cfs_rq were copied to
++	 * child->se.parent,cfs_rq. So call __set_task_cpu() to make those
++	 * of child point to valid ones.
++	 */
++	rcu_read_lock();
++	__set_task_cpu(p, this_cpu);
++	rcu_read_unlock();
+ 
+ 	update_curr(cfs_rq);
+ 
+diff --git a/lib/show_mem.c b/lib/show_mem.c
+index 4407f8c9b1f7..b7c72311ad0c 100644
+--- a/lib/show_mem.c
++++ b/lib/show_mem.c
+@@ -18,6 +18,9 @@ void show_mem(unsigned int filter)
+ 	printk("Mem-Info:\n");
+ 	show_free_areas(filter);
+ 
++	if (filter & SHOW_MEM_FILTER_PAGE_COUNT)
++		return;
++
+ 	for_each_online_pgdat(pgdat) {
+ 		unsigned long i, flags;
+ 
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index d80ac4bb0971..ed0ed8a41fba 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1882,6 +1882,8 @@ static void collapse_huge_page(struct mm_struct *mm,
+ 		goto out;
+ 
+ 	vma = find_vma(mm, address);
++	if (!vma)
++		goto out;
+ 	hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ 	hend = vma->vm_end & HPAGE_PMD_MASK;
+ 	if (address < hstart || address + HPAGE_PMD_SIZE > hend)
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index d027a2489a9f..204de6ab6292 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -4385,7 +4385,13 @@ static int compare_thresholds(const void *a, const void *b)
+ 	const struct mem_cgroup_threshold *_a = a;
+ 	const struct mem_cgroup_threshold *_b = b;
+ 
+-	return _a->threshold - _b->threshold;
++	if (_a->threshold > _b->threshold)
++		return 1;
++
++	if (_a->threshold < _b->threshold)
++		return -1;
++
++	return 0;
+ }
+ 
+ static int mem_cgroup_oom_notify_cb(struct mem_cgroup *memcg)
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index b5afea28cf83..d8762b234d2a 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1760,6 +1760,13 @@ void warn_alloc_failed(gfp_t gfp_mask, int order, const char *fmt, ...)
+ 		return;
+ 
+ 	/*
++	 * Walking all memory to count page types is very expensive and should
++	 * be inhibited in non-blockable contexts.
++	 */
++	if (!(gfp_mask & __GFP_WAIT))
++		filter |= SHOW_MEM_FILTER_PAGE_COUNT;
++
++	/*
+ 	 * This documents exceptions given to allocations in certain
+ 	 * contexts that are allowed to allocate outside current's set
+ 	 * of allowed nodes.
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index b81500c680af..a06deca97f0e 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1155,7 +1155,8 @@ static int br_ip6_multicast_query(struct net_bridge *br,
+ 		mld2q = (struct mld2_query *)icmp6_hdr(skb);
+ 		if (!mld2q->mld2q_nsrcs)
+ 			group = &mld2q->mld2q_mca;
+-		max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(mld2q->mld2q_mrc) : 1;
++
++		max_delay = max(msecs_to_jiffies(MLDV2_MRC(ntohs(mld2q->mld2q_mrc))), 1UL);
+ 	}
+ 
+ 	if (!group)
+diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
+index dd147d78a588..8ac946f32f9a 100644
+--- a/net/bridge/br_stp.c
++++ b/net/bridge/br_stp.c
+@@ -189,7 +189,7 @@ static void br_record_config_information(struct net_bridge_port *p,
+ 	p->designated_age = jiffies + bpdu->message_age;
+ 
+ 	mod_timer(&p->message_age_timer, jiffies
+-		  + (p->br->max_age - bpdu->message_age));
++		  + (bpdu->max_age - bpdu->message_age));
+ }
+ 
+ /* called under bridge lock */
+diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
+index 5cf52225692e..84efbe4aa06a 100644
+--- a/net/caif/cfctrl.c
++++ b/net/caif/cfctrl.c
+@@ -288,9 +288,10 @@ int cfctrl_linkup_request(struct cflayer *layer,
+ 
+ 		count = cfctrl_cancel_req(&cfctrl->serv.layer,
+ 						user_layer);
+-		if (count != 1)
++		if (count != 1) {
+ 			pr_err("Could not remove request (%d)", count);
+ 			return -ENODEV;
++		}
+ 	}
+ 	return 0;
+ }
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index f4f3f58f5234..a70f426c6d6f 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -1719,6 +1719,8 @@ int ceph_osdc_start_request(struct ceph_osd_client *osdc,
+ 				dout("osdc_start_request failed map, "
+ 				     " will retry %lld\n", req->r_tid);
+ 				rc = 0;
++			} else {
++				__unregister_request(osdc, req);
+ 			}
+ 			goto out_unlock;
+ 		}
+diff --git a/net/core/netpoll.c b/net/core/netpoll.c
+index db4bb7a9ca78..9649cead0028 100644
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -923,15 +923,14 @@ EXPORT_SYMBOL_GPL(__netpoll_cleanup);
+ 
+ void netpoll_cleanup(struct netpoll *np)
+ {
+-	if (!np->dev)
+-		return;
+-
+ 	rtnl_lock();
++	if (!np->dev)
++		goto out;
+ 	__netpoll_cleanup(np);
+-	rtnl_unlock();
+-
+ 	dev_put(np->dev);
+ 	np->dev = NULL;
++out:
++	rtnl_unlock();
+ }
+ EXPORT_SYMBOL(netpoll_cleanup);
+ 
+diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
+index 77a65f031488..f0bdd36f207e 100644
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -19,6 +19,9 @@
+ #include <net/sock.h>
+ #include <net/net_ratelimit.h>
+ 
++static int zero = 0;
++static int ushort_max = USHRT_MAX;
++
+ #ifdef CONFIG_RPS
+ static int rps_sock_flow_sysctl(ctl_table *table, int write,
+ 				void __user *buffer, size_t *lenp, loff_t *ppos)
+@@ -192,7 +195,9 @@ static struct ctl_table netns_core_table[] = {
+ 		.data		= &init_net.core.sysctl_somaxconn,
+ 		.maxlen		= sizeof(int),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec
++		.extra1		= &zero,
++		.extra2		= &ushort_max,
++		.proc_handler	= proc_dointvec_minmax
+ 	},
+ 	{ }
+ };
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index cd2d639541bc..c7c6724c0d6e 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -72,7 +72,6 @@
+ #include <linux/init.h>
+ #include <linux/list.h>
+ #include <linux/slab.h>
+-#include <linux/prefetch.h>
+ #include <linux/export.h>
+ #include <net/net_namespace.h>
+ #include <net/ip.h>
+@@ -1773,10 +1772,8 @@ static struct leaf *leaf_walk_rcu(struct tnode *p, struct rt_trie_node *c)
+ 			if (!c)
+ 				continue;
+ 
+-			if (IS_LEAF(c)) {
+-				prefetch(rcu_dereference_rtnl(p->child[idx]));
++			if (IS_LEAF(c))
+ 				return (struct leaf *) c;
+-			}
+ 
+ 			/* Rescan start scanning in new node */
+ 			p = (struct tnode *) c;
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index c8989a71bbd9..75b086029ec9 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -342,7 +342,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
+ 	pip->saddr    = fl4.saddr;
+ 	pip->protocol = IPPROTO_IGMP;
+ 	pip->tot_len  = 0;	/* filled in later */
+-	ip_select_ident(pip, &rt->dst, NULL);
++	ip_select_ident(skb, &rt->dst, NULL);
+ 	((u8*)&pip[1])[0] = IPOPT_RA;
+ 	((u8*)&pip[1])[1] = 4;
+ 	((u8*)&pip[1])[2] = 0;
+@@ -683,7 +683,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
+ 	iph->daddr    = dst;
+ 	iph->saddr    = fl4.saddr;
+ 	iph->protocol = IPPROTO_IGMP;
+-	ip_select_ident(iph, &rt->dst, NULL);
++	ip_select_ident(skb, &rt->dst, NULL);
+ 	((u8*)&iph[1])[0] = IPOPT_RA;
+ 	((u8*)&iph[1])[1] = 4;
+ 	((u8*)&iph[1])[2] = 0;
+@@ -705,7 +705,7 @@ static void igmp_gq_timer_expire(unsigned long data)
+ 
+ 	in_dev->mr_gq_running = 0;
+ 	igmpv3_send_report(in_dev, NULL);
+-	__in_dev_put(in_dev);
++	in_dev_put(in_dev);
+ }
+ 
+ static void igmp_ifc_timer_expire(unsigned long data)
+@@ -717,7 +717,7 @@ static void igmp_ifc_timer_expire(unsigned long data)
+ 		in_dev->mr_ifc_count--;
+ 		igmp_ifc_start_timer(in_dev, IGMP_Unsolicited_Report_Interval);
+ 	}
+-	__in_dev_put(in_dev);
++	in_dev_put(in_dev);
+ }
+ 
+ static void igmp_ifc_event(struct in_device *in_dev)
+diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
+index 86f13c67ea85..58c4e696a6a7 100644
+--- a/net/ipv4/inetpeer.c
++++ b/net/ipv4/inetpeer.c
+@@ -17,6 +17,7 @@
+ #include <linux/kernel.h>
+ #include <linux/mm.h>
+ #include <linux/net.h>
++#include <linux/workqueue.h>
+ #include <net/ip.h>
+ #include <net/inetpeer.h>
+ #include <net/secure_seq.h>
+@@ -31,8 +32,8 @@
+  *  At the moment of writing this notes identifier of IP packets is generated
+  *  to be unpredictable using this code only for packets subjected
+  *  (actually or potentially) to defragmentation.  I.e. DF packets less than
+- *  PMTU in size uses a constant ID and do not use this code (see
+- *  ip_select_ident() in include/net/ip.h).
++ *  PMTU in size when local fragmentation is disabled use a constant ID and do
++ *  not use this code (see ip_select_ident() in include/net/ip.h).
+  *
+  *  Route cache entries hold references to our nodes.
+  *  New cache entries get references via lookup by destination IP address in
+@@ -66,6 +67,11 @@
+ 
+ static struct kmem_cache *peer_cachep __read_mostly;
+ 
++static LIST_HEAD(gc_list);
++static const int gc_delay = 60 * HZ;
++static struct delayed_work gc_work;
++static DEFINE_SPINLOCK(gc_lock);
++
+ #define node_height(x) x->avl_height
+ 
+ #define peer_avl_empty ((struct inet_peer *)&peer_fake_node)
+@@ -102,6 +108,50 @@ int inet_peer_threshold __read_mostly = 65536 + 128;	/* start to throw entries m
+ int inet_peer_minttl __read_mostly = 120 * HZ;	/* TTL under high load: 120 sec */
+ int inet_peer_maxttl __read_mostly = 10 * 60 * HZ;	/* usual time to live: 10 min */
+ 
++static void inetpeer_gc_worker(struct work_struct *work)
++{
++	struct inet_peer *p, *n;
++	LIST_HEAD(list);
++
++	spin_lock_bh(&gc_lock);
++	list_replace_init(&gc_list, &list);
++	spin_unlock_bh(&gc_lock);
++
++	if (list_empty(&list))
++		return;
++
++	list_for_each_entry_safe(p, n, &list, gc_list) {
++
++		if(need_resched())
++			cond_resched();
++
++		if (p->avl_left != peer_avl_empty) {
++			list_add_tail(&p->avl_left->gc_list, &list);
++			p->avl_left = peer_avl_empty;
++		}
++
++		if (p->avl_right != peer_avl_empty) {
++			list_add_tail(&p->avl_right->gc_list, &list);
++			p->avl_right = peer_avl_empty;
++		}
++
++		n = list_entry(p->gc_list.next, struct inet_peer, gc_list);
++
++		if (!atomic_read(&p->refcnt)) {
++			list_del(&p->gc_list);
++			kmem_cache_free(peer_cachep, p);
++		}
++	}
++
++	if (list_empty(&list))
++		return;
++
++	spin_lock_bh(&gc_lock);
++	list_splice(&list, &gc_list);
++	spin_unlock_bh(&gc_lock);
++
++	schedule_delayed_work(&gc_work, gc_delay);
++}
+ 
+ /* Called from ip_output.c:ip_init  */
+ void __init inet_initpeers(void)
+@@ -126,6 +176,7 @@ void __init inet_initpeers(void)
+ 			0, SLAB_HWCACHE_ALIGN | SLAB_PANIC,
+ 			NULL);
+ 
++	INIT_DELAYED_WORK_DEFERRABLE(&gc_work, inetpeer_gc_worker);
+ }
+ 
+ static int addr_compare(const struct inetpeer_addr *a,
+@@ -448,7 +499,7 @@ relookup:
+ 		p->pmtu_expires = 0;
+ 		p->pmtu_orig = 0;
+ 		memset(&p->redirect_learned, 0, sizeof(p->redirect_learned));
+-
++		INIT_LIST_HEAD(&p->gc_list);
+ 
+ 		/* Link the node. */
+ 		link_to_pool(p, base);
+@@ -508,3 +559,38 @@ bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout)
+ 	return rc;
+ }
+ EXPORT_SYMBOL(inet_peer_xrlim_allow);
++
++static void inetpeer_inval_rcu(struct rcu_head *head)
++{
++	struct inet_peer *p = container_of(head, struct inet_peer, gc_rcu);
++
++	spin_lock_bh(&gc_lock);
++	list_add_tail(&p->gc_list, &gc_list);
++	spin_unlock_bh(&gc_lock);
++
++	schedule_delayed_work(&gc_work, gc_delay);
++}
++
++void inetpeer_invalidate_tree(int family)
++{
++	struct inet_peer *old, *new, *prev;
++	struct inet_peer_base *base = family_to_base(family);
++
++	write_seqlock_bh(&base->lock);
++
++	old = base->root;
++	if (old == peer_avl_empty_rcu)
++		goto out;
++
++	new = peer_avl_empty_rcu;
++
++	prev = cmpxchg(&base->root, old, new);
++	if (prev == old) {
++		base->total = 0;
++		call_rcu(&prev->gc_rcu, inetpeer_inval_rcu);
++	}
++
++out:
++	write_sequnlock_bh(&base->lock);
++}
++EXPORT_SYMBOL(inetpeer_invalidate_tree);
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 0bc95f3977d2..daf408e8633c 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -162,7 +162,7 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
+ 	iph->daddr    = (opt && opt->opt.srr ? opt->opt.faddr : daddr);
+ 	iph->saddr    = saddr;
+ 	iph->protocol = sk->sk_protocol;
+-	ip_select_ident(iph, &rt->dst, sk);
++	ip_select_ident(skb, &rt->dst, sk);
+ 
+ 	if (opt && opt->opt.optlen) {
+ 		iph->ihl += opt->opt.optlen>>2;
+@@ -390,7 +390,7 @@ packet_routed:
+ 		ip_options_build(skb, &inet_opt->opt, inet->inet_daddr, rt, 0);
+ 	}
+ 
+-	ip_select_ident_more(iph, &rt->dst, sk,
++	ip_select_ident_more(skb, &rt->dst, sk,
+ 			     (skb_shinfo(skb)->gso_segs ?: 1) - 1);
+ 
+ 	skb->priority = sk->sk_priority;
+@@ -1334,7 +1334,7 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
+ 	iph->ihl = 5;
+ 	iph->tos = inet->tos;
+ 	iph->frag_off = df;
+-	ip_select_ident(iph, &rt->dst, sk);
++	ip_select_ident(skb, &rt->dst, sk);
+ 	iph->ttl = ttl;
+ 	iph->protocol = sk->sk_protocol;
+ 	iph->saddr = fl4->saddr;
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 006439403213..b5e64e4c0646 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1576,7 +1576,7 @@ static void ip_encap(struct sk_buff *skb, __be32 saddr, __be32 daddr)
+ 	iph->protocol	=	IPPROTO_IPIP;
+ 	iph->ihl	=	5;
+ 	iph->tot_len	=	htons(skb->len);
+-	ip_select_ident(iph, skb_dst(skb), NULL);
++	ip_select_ident(skb, skb_dst(skb), NULL);
+ 	ip_send_check(iph);
+ 
+ 	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
+diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
+index e1d4f30bb718..28150145ce02 100644
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -380,7 +380,7 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,
+ 		iph->check   = 0;
+ 		iph->tot_len = htons(length);
+ 		if (!iph->id)
+-			ip_select_ident(iph, &rt->dst, NULL);
++			ip_select_ident(skb, &rt->dst, NULL);
+ 
+ 		iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
+ 	}
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 94cdbc55ca7e..c45a155a3296 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -939,6 +939,7 @@ static void rt_cache_invalidate(struct net *net)
+ 	get_random_bytes(&shuffle, sizeof(shuffle));
+ 	atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
+ 	redirect_genid++;
++	inetpeer_invalidate_tree(AF_INET);
+ }
+ 
+ /*
+diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
+index f376b05cca81..b78eac2b7079 100644
+--- a/net/ipv4/tcp_cubic.c
++++ b/net/ipv4/tcp_cubic.c
+@@ -204,8 +204,8 @@ static u32 cubic_root(u64 a)
+  */
+ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
+ {
+-	u64 offs;
+-	u32 delta, t, bic_target, max_cnt;
++	u32 delta, bic_target, max_cnt;
++	u64 offs, t;
+ 
+ 	ca->ack_cnt++;	/* count the number of ACKs */
+ 
+@@ -248,9 +248,11 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
+ 	 * if the cwnd < 1 million packets !!!
+ 	 */
+ 
++	t = (s32)(tcp_time_stamp - ca->epoch_start);
++	t += msecs_to_jiffies(ca->delay_min >> 3);
+ 	/* change the unit from HZ to bictcp_HZ */
+-	t = ((tcp_time_stamp + msecs_to_jiffies(ca->delay_min>>3)
+-	      - ca->epoch_start) << BICTCP_HZ) / HZ;
++	t <<= BICTCP_HZ;
++	do_div(t, HZ);
+ 
+ 	if (t < ca->bic_K)		/* t - K */
+ 		offs = ca->bic_K - t;
+@@ -412,7 +414,7 @@ static void bictcp_acked(struct sock *sk, u32 cnt, s32 rtt_us)
+ 		return;
+ 
+ 	/* Discard delay samples right after fast recovery */
+-	if ((s32)(tcp_time_stamp - ca->epoch_start) < HZ)
++	if (ca->epoch_start && (s32)(tcp_time_stamp - ca->epoch_start) < HZ)
+ 		return;
+ 
+ 	delay = (rtt_us << 3) / USEC_PER_MSEC;
+diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
+index ed4bf11ef9f4..938553efbf8e 100644
+--- a/net/ipv4/xfrm4_mode_tunnel.c
++++ b/net/ipv4/xfrm4_mode_tunnel.c
+@@ -54,7 +54,7 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
+ 
+ 	top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
+ 		0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
+-	ip_select_ident(top_iph, dst->child, NULL);
++	ip_select_ident(skb, dst->child, NULL);
+ 
+ 	top_iph->ttl = ip4_dst_hoplimit(dst->child);
+ 
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 314bda227495..5d41293a6005 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -913,12 +913,10 @@ retry:
+ 	if (ifp->flags & IFA_F_OPTIMISTIC)
+ 		addr_flags |= IFA_F_OPTIMISTIC;
+ 
+-	ift = !max_addresses ||
+-	      ipv6_count_addresses(idev) < max_addresses ?
+-		ipv6_add_addr(idev, &addr, tmp_plen,
+-			      ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK,
+-			      addr_flags) : NULL;
+-	if (!ift || IS_ERR(ift)) {
++	ift = ipv6_add_addr(idev, &addr, tmp_plen,
++			    ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK,
++			    addr_flags);
++	if (IS_ERR(ift)) {
+ 		in6_ifa_put(ifp);
+ 		in6_dev_put(idev);
+ 		printk(KERN_INFO
+diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
+index 90868fb42757..d50545371b55 100644
+--- a/net/ipv6/icmp.c
++++ b/net/ipv6/icmp.c
+@@ -911,6 +911,14 @@ static const struct icmp6_err {
+ 		.err	= ECONNREFUSED,
+ 		.fatal	= 1,
+ 	},
++	{	/* POLICY_FAIL */
++		.err	= EACCES,
++		.fatal	= 1,
++	},
++	{	/* REJECT_ROUTE	*/
++		.err	= EACCES,
++		.fatal	= 1,
++	},
+ };
+ 
+ int icmpv6_err_convert(u8 type, u8 code, int *err)
+@@ -922,7 +930,7 @@ int icmpv6_err_convert(u8 type, u8 code, int *err)
+ 	switch (type) {
+ 	case ICMPV6_DEST_UNREACH:
+ 		fatal = 1;
+-		if (code <= ICMPV6_PORT_UNREACH) {
++		if (code < ARRAY_SIZE(tab_unreach)) {
+ 			*err  = tab_unreach[code].err;
+ 			fatal = tab_unreach[code].fatal;
+ 		}
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index 93718f3db79b..443724f54724 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -862,14 +862,22 @@ static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
+ 
+ 			if (ipv6_prefix_equal(&key->addr, args->addr, key->plen)) {
+ #ifdef CONFIG_IPV6_SUBTREES
+-				if (fn->subtree)
+-					fn = fib6_lookup_1(fn->subtree, args + 1);
++				if (fn->subtree) {
++					struct fib6_node *sfn;
++					sfn = fib6_lookup_1(fn->subtree,
++							    args + 1);
++					if (!sfn)
++						goto backtrack;
++					fn = sfn;
++				}
+ #endif
+-				if (!fn || fn->fn_flags & RTN_RTINFO)
++				if (fn->fn_flags & RTN_RTINFO)
+ 					return fn;
+ 			}
+ 		}
+-
++#ifdef CONFIG_IPV6_SUBTREES
++backtrack:
++#endif
+ 		if (fn->fn_flags & RTN_ROOT)
+ 			break;
+ 
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index db6004364313..91d0711caec6 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1125,6 +1125,8 @@ static inline int ip6_ufo_append_data(struct sock *sk,
+ 	 * udp datagram
+ 	 */
+ 	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
++		struct frag_hdr fhdr;
++
+ 		skb = sock_alloc_send_skb(sk,
+ 			hh_len + fragheaderlen + transhdrlen + 20,
+ 			(flags & MSG_DONTWAIT), &err);
+@@ -1145,12 +1147,6 @@ static inline int ip6_ufo_append_data(struct sock *sk,
+ 
+ 		skb->ip_summed = CHECKSUM_PARTIAL;
+ 		skb->csum = 0;
+-	}
+-
+-	err = skb_append_datato_frags(sk,skb, getfrag, from,
+-				      (length - transhdrlen));
+-	if (!err) {
+-		struct frag_hdr fhdr;
+ 
+ 		/* Specify the length of each IPv6 datagram fragment.
+ 		 * It has to be a multiple of 8.
+@@ -1161,15 +1157,10 @@ static inline int ip6_ufo_append_data(struct sock *sk,
+ 		ipv6_select_ident(&fhdr, rt);
+ 		skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
+ 		__skb_queue_tail(&sk->sk_write_queue, skb);
+-
+-		return 0;
+ 	}
+-	/* There is not enough support do UPD LSO,
+-	 * so follow normal path
+-	 */
+-	kfree_skb(skb);
+ 
+-	return err;
++	return skb_append_datato_frags(sk, skb, getfrag, from,
++				       (length - transhdrlen));
+ }
+ 
+ static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
+@@ -1342,27 +1333,27 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+ 	 * --yoshfuji
+ 	 */
+ 
+-	cork->length += length;
+-	if (length > mtu) {
+-		int proto = sk->sk_protocol;
+-		if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
+-			ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
+-			return -EMSGSIZE;
+-		}
+-
+-		if (proto == IPPROTO_UDP &&
+-		    (rt->dst.dev->features & NETIF_F_UFO)) {
++	if ((length > mtu) && dontfrag && (sk->sk_protocol == IPPROTO_UDP ||
++					   sk->sk_protocol == IPPROTO_RAW)) {
++		ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
++		return -EMSGSIZE;
++	}
+ 
+-			err = ip6_ufo_append_data(sk, getfrag, from, length,
+-						  hh_len, fragheaderlen,
+-						  transhdrlen, mtu, flags, rt);
+-			if (err)
+-				goto error;
+-			return 0;
+-		}
++	skb = skb_peek_tail(&sk->sk_write_queue);
++	cork->length += length;
++	if (((length > mtu) ||
++	     (skb && skb_is_gso(skb))) &&
++	    (sk->sk_protocol == IPPROTO_UDP) &&
++	    (rt->dst.dev->features & NETIF_F_UFO)) {
++		err = ip6_ufo_append_data(sk, getfrag, from, length,
++					  hh_len, fragheaderlen,
++					  transhdrlen, mtu, flags, rt);
++		if (err)
++			goto error;
++		return 0;
+ 	}
+ 
+-	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
++	if (!skb)
+ 		goto alloc_new_skb;
+ 
+ 	while (length > 0) {
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index c7ec4bb0c0f5..d20a9be8334e 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -2159,7 +2159,7 @@ static void mld_gq_timer_expire(unsigned long data)
+ 
+ 	idev->mc_gq_running = 0;
+ 	mld_send_report(idev, NULL);
+-	__in6_dev_put(idev);
++	in6_dev_put(idev);
+ }
+ 
+ static void mld_ifc_timer_expire(unsigned long data)
+@@ -2172,7 +2172,7 @@ static void mld_ifc_timer_expire(unsigned long data)
+ 		if (idev->mc_ifc_count)
+ 			mld_ifc_start_timer(idev, idev->mc_maxdelay);
+ 	}
+-	__in6_dev_put(idev);
++	in6_dev_put(idev);
+ }
+ 
+ static void mld_ifc_event(struct inet6_dev *idev)
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
+index 9ffc37f600a4..bc55358fc789 100644
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -447,7 +447,6 @@ struct sk_buff *ndisc_build_skb(struct net_device *dev,
+ 	struct sk_buff *skb;
+ 	struct icmp6hdr *hdr;
+ 	int len;
+-	int err;
+ 	u8 *opt;
+ 
+ 	if (!dev->addr_len)
+@@ -457,14 +456,12 @@ struct sk_buff *ndisc_build_skb(struct net_device *dev,
+ 	if (llinfo)
+ 		len += ndisc_opt_addr_space(dev);
+ 
+-	skb = sock_alloc_send_skb(sk,
+-				  (MAX_HEADER + sizeof(struct ipv6hdr) +
+-				   len + LL_ALLOCATED_SPACE(dev)),
+-				  1, &err);
++	skb = alloc_skb((MAX_HEADER + sizeof(struct ipv6hdr) +
++			 len + LL_ALLOCATED_SPACE(dev)), GFP_ATOMIC);
+ 	if (!skb) {
+ 		ND_PRINTK0(KERN_ERR
+-			   "ICMPv6 ND: %s() failed to allocate an skb, err=%d.\n",
+-			   __func__, err);
++			   "ICMPv6 ND: %s() failed to allocate an skb.\n",
++			   __func__);
+ 		return NULL;
+ 	}
+ 
+@@ -492,6 +489,11 @@ struct sk_buff *ndisc_build_skb(struct net_device *dev,
+ 					   csum_partial(hdr,
+ 							len, 0));
+ 
++	/* Manually assign socket ownership as we avoid calling
++	 * sock_alloc_send_pskb() to bypass wmem buffer limits
++	 */
++	skb_set_owner_w(skb, sk);
++
+ 	return skb;
+ }
+ 
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index 411fe2ceb9bb..eba5deb79fe3 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -517,6 +517,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
+ 	head->tstamp = fq->q.stamp;
+ 	ipv6_hdr(head)->payload_len = htons(payload_len);
+ 	IP6CB(head)->nhoff = nhoff;
++	IP6CB(head)->flags |= IP6SKB_FRAGMENTED;
+ 
+ 	/* Yes, and fold redundant checksum back. 8) */
+ 	if (head->ip_summed == CHECKSUM_COMPLETE)
+@@ -552,6 +553,9 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
+ 	const struct ipv6hdr *hdr = ipv6_hdr(skb);
+ 	struct net *net = dev_net(skb_dst(skb)->dev);
+ 
++	if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED)
++		goto fail_hdr;
++
+ 	IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMREQDS);
+ 
+ 	/* Jumbo payload inhibits frag. header */
+@@ -572,6 +576,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
+ 				 ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMOKS);
+ 
+ 		IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
++		IP6CB(skb)->flags |= IP6SKB_FRAGMENTED;
+ 		return 1;
+ 	}
+ 
+diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
+index aa2d7206ee8a..38c08136baa2 100644
+--- a/net/netfilter/ipvs/ip_vs_xmit.c
++++ b/net/netfilter/ipvs/ip_vs_xmit.c
+@@ -853,7 +853,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+ 	iph->daddr		=	cp->daddr.ip;
+ 	iph->saddr		=	saddr;
+ 	iph->ttl		=	old_iph->ttl;
+-	ip_select_ident(iph, &rt->dst, NULL);
++	ip_select_ident(skb, &rt->dst, NULL);
+ 
+ 	/* Another hack: avoid icmp_send in ip_fragment */
+ 	skb->local_df = 1;
+diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
+index f08b9166119b..caa5affa4b29 100644
+--- a/net/sched/sch_htb.c
++++ b/net/sched/sch_htb.c
+@@ -86,7 +86,7 @@ struct htb_class {
+ 	unsigned int children;
+ 	struct htb_class *parent;	/* parent class */
+ 
+-	int prio;		/* these two are used only by leaves... */
++	u32 prio;		/* these two are used only by leaves... */
+ 	int quantum;		/* but stored for parent-to-leaf return */
+ 
+ 	union {
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index 810427833bcd..0b6a3913ef53 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -205,45 +205,24 @@ out:
+ 		in6_dev_put(idev);
+ }
+ 
+-/* Based on tcp_v6_xmit() in tcp_ipv6.c. */
+ static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
+ {
+ 	struct sock *sk = skb->sk;
+ 	struct ipv6_pinfo *np = inet6_sk(sk);
+-	struct flowi6 fl6;
+-
+-	memset(&fl6, 0, sizeof(fl6));
+-
+-	fl6.flowi6_proto = sk->sk_protocol;
+-
+-	/* Fill in the dest address from the route entry passed with the skb
+-	 * and the source address from the transport.
+-	 */
+-	ipv6_addr_copy(&fl6.daddr, &transport->ipaddr.v6.sin6_addr);
+-	ipv6_addr_copy(&fl6.saddr, &transport->saddr.v6.sin6_addr);
+-
+-	fl6.flowlabel = np->flow_label;
+-	IP6_ECN_flow_xmit(sk, fl6.flowlabel);
+-	if (ipv6_addr_type(&fl6.saddr) & IPV6_ADDR_LINKLOCAL)
+-		fl6.flowi6_oif = transport->saddr.v6.sin6_scope_id;
+-	else
+-		fl6.flowi6_oif = sk->sk_bound_dev_if;
+-
+-	if (np->opt && np->opt->srcrt) {
+-		struct rt0_hdr *rt0 = (struct rt0_hdr *) np->opt->srcrt;
+-		ipv6_addr_copy(&fl6.daddr, rt0->addr);
+-	}
++	struct flowi6 *fl6 = &transport->fl.u.ip6;
+ 
+ 	SCTP_DEBUG_PRINTK("%s: skb:%p, len:%d, src:%pI6 dst:%pI6\n",
+ 			  __func__, skb, skb->len,
+-			  &fl6.saddr, &fl6.daddr);
++			  &fl6->saddr, &fl6->daddr);
+ 
+-	SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
++	IP6_ECN_flow_xmit(sk, fl6->flowlabel);
+ 
+ 	if (!(transport->param_flags & SPP_PMTUD_ENABLE))
+ 		skb->local_df = 1;
+ 
+-	return ip6_xmit(sk, skb, &fl6, np->opt, np->tclass);
++	SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
++
++	return ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
+ }
+ 
+ /* Returns the dst cache entry for the given source and destination ip
+@@ -256,10 +235,12 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ 	struct dst_entry *dst = NULL;
+ 	struct flowi6 *fl6 = &fl->u.ip6;
+ 	struct sctp_bind_addr *bp;
++	struct ipv6_pinfo *np = inet6_sk(sk);
+ 	struct sctp_sockaddr_entry *laddr;
+ 	union sctp_addr *baddr = NULL;
+ 	union sctp_addr *daddr = &t->ipaddr;
+ 	union sctp_addr dst_saddr;
++	struct in6_addr *final_p, final;
+ 	__u8 matchlen = 0;
+ 	__u8 bmatchlen;
+ 	sctp_scope_t scope;
+@@ -282,7 +263,8 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ 		SCTP_DEBUG_PRINTK("SRC=%pI6 - ", &fl6->saddr);
+ 	}
+ 
+-	dst = ip6_dst_lookup_flow(sk, fl6, NULL, false);
++	final_p = fl6_update_dst(fl6, np->opt, &final);
++	dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
+ 	if (!asoc || saddr)
+ 		goto out;
+ 
+@@ -333,10 +315,12 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ 		}
+ 	}
+ 	rcu_read_unlock();
++
+ 	if (baddr) {
+ 		ipv6_addr_copy(&fl6->saddr, &baddr->v6.sin6_addr);
+ 		fl6->fl6_sport = baddr->v6.sin6_port;
+-		dst = ip6_dst_lookup_flow(sk, fl6, NULL, false);
++		final_p = fl6_update_dst(fl6, np->opt, &final);
++		dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
+ 	}
+ 
+ out:
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 9032d5001a9e..76388b083f28 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -1604,9 +1604,8 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
+ 					asoc->outqueue.outstanding_bytes;
+ 			sackh.num_gap_ack_blocks = 0;
+ 			sackh.num_dup_tsns = 0;
+-			chunk->subh.sack_hdr = &sackh;
+ 			sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK,
+-					SCTP_CHUNK(chunk));
++					SCTP_SACKH(&sackh));
+ 			break;
+ 
+ 		case SCTP_CMD_DISCARD_PACKET:
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index ba0108f8b833..c53d01e0a2cf 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -814,6 +814,9 @@ static int sctp_send_asconf_del_ip(struct sock		*sk,
+ 			goto skip_mkasconf;
+ 		}
+ 
++		if (laddr == NULL)
++			return -EINVAL;
++
+ 		/* We do not need RCU protection throughout this loop
+ 		 * because this is done under a socket lock from the
+ 		 * setsockopt call.
+diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
+index e728d4ce2a1b..a224a38f0218 100644
+--- a/net/tipc/eth_media.c
++++ b/net/tipc/eth_media.c
+@@ -53,6 +53,7 @@ struct eth_bearer {
+ 	struct tipc_bearer *bearer;
+ 	struct net_device *dev;
+ 	struct packet_type tipc_packet_type;
++	struct work_struct setup;
+ };
+ 
+ static struct eth_bearer eth_bearers[MAX_ETH_BEARERS];
+@@ -121,6 +122,17 @@ static int recv_msg(struct sk_buff *buf, struct net_device *dev,
+ }
+ 
+ /**
++ * setup_bearer - setup association between Ethernet bearer and interface
++ */
++static void setup_bearer(struct work_struct *work)
++{
++	struct eth_bearer *eb_ptr =
++		container_of(work, struct eth_bearer, setup);
++
++	dev_add_pack(&eb_ptr->tipc_packet_type);
++}
++
++/**
+  * enable_bearer - attach TIPC bearer to an Ethernet interface
+  */
+ 
+@@ -164,7 +176,8 @@ static int enable_bearer(struct tipc_bearer *tb_ptr)
+ 	eb_ptr->tipc_packet_type.func = recv_msg;
+ 	eb_ptr->tipc_packet_type.af_packet_priv = eb_ptr;
+ 	INIT_LIST_HEAD(&(eb_ptr->tipc_packet_type.list));
+-	dev_add_pack(&eb_ptr->tipc_packet_type);
++	INIT_WORK(&eb_ptr->setup, setup_bearer);
++	schedule_work(&eb_ptr->setup);
+ 
+ 	/* Associate TIPC bearer with Ethernet bearer */
+ 
+diff --git a/scripts/kernel-doc b/scripts/kernel-doc
+index d793001929cf..ba3d9dfada52 100755
+--- a/scripts/kernel-doc
++++ b/scripts/kernel-doc
+@@ -2044,6 +2044,9 @@ sub process_file($) {
+ 
+     $section_counter = 0;
+     while (<IN>) {
++	while (s/\\\s*$//) {
++	    $_ .= <IN>;
++	}
+ 	if ($state == 0) {
+ 	    if (/$doc_start/o) {
+ 		$state = 1;		# next line is always the function name
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index a166a857956a..7ebe4b772fe4 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2621,6 +2621,7 @@ static struct snd_pci_quirk msi_black_list[] __devinitdata = {
+ 	SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
+ 	SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
+ 	SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
++	SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */
+ 	SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */
+ 	SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */
+ 	{}
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 55d9b302ef41..05f097a67a69 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -512,6 +512,17 @@ static int hdmi_channel_allocation(struct hdmi_eld *eld, int channels)
+ 		}
+ 	}
+ 
++	if (!ca) {
++		/* if there was no match, select the regular ALSA channel
++		 * allocation with the matching number of channels */
++		for (i = 0; i < ARRAY_SIZE(channel_allocations); i++) {
++			if (channels == channel_allocations[i].channels) {
++				ca = channel_allocations[i].ca_index;
++				break;
++			}
++		}
++	}
++
+ 	snd_print_channel_allocation(eld->spk_alloc, buf, sizeof(buf));
+ 	snd_printdd("HDMI: select CA 0x%x for %d-channel allocation: %s\n",
+ 		    ca, channels, buf);
+diff --git a/sound/soc/codecs/88pm860x-codec.c b/sound/soc/codecs/88pm860x-codec.c
+index 5ca122e51183..290f4d361ecc 100644
+--- a/sound/soc/codecs/88pm860x-codec.c
++++ b/sound/soc/codecs/88pm860x-codec.c
+@@ -351,6 +351,9 @@ static int snd_soc_put_volsw_2r_st(struct snd_kcontrol *kcontrol,
+ 	val = ucontrol->value.integer.value[0];
+ 	val2 = ucontrol->value.integer.value[1];
+ 
++	if (val >= ARRAY_SIZE(st_table) || val2 >= ARRAY_SIZE(st_table))
++		return -EINVAL;
++
+ 	err = snd_soc_update_bits(codec, reg, 0x3f, st_table[val].m);
+ 	if (err < 0)
+ 		return err;
+diff --git a/sound/soc/codecs/max98095.c b/sound/soc/codecs/max98095.c
+index 26d7b089fb9c..a52c15bcb778 100644
+--- a/sound/soc/codecs/max98095.c
++++ b/sound/soc/codecs/max98095.c
+@@ -1861,7 +1861,7 @@ static int max98095_put_eq_enum(struct snd_kcontrol *kcontrol,
+ 	struct max98095_pdata *pdata = max98095->pdata;
+ 	int channel = max98095_get_eq_channel(kcontrol->id.name);
+ 	struct max98095_cdata *cdata;
+-	int sel = ucontrol->value.integer.value[0];
++	unsigned int sel = ucontrol->value.integer.value[0];
+ 	struct max98095_eq_cfg *coef_set;
+ 	int fs, best, best_val, i;
+ 	int regmask, regsave;
+@@ -2014,7 +2014,7 @@ static int max98095_put_bq_enum(struct snd_kcontrol *kcontrol,
+ 	struct max98095_pdata *pdata = max98095->pdata;
+ 	int channel = max98095_get_bq_channel(codec, kcontrol->id.name);
+ 	struct max98095_cdata *cdata;
+-	int sel = ucontrol->value.integer.value[0];
++	unsigned int sel = ucontrol->value.integer.value[0];
+ 	struct max98095_biquad_cfg *coef_set;
+ 	int fs, best, best_val, i;
+ 	int regmask, regsave;
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 2df253c18568..ef96ca6bfbe1 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -805,9 +805,9 @@ static int wm8960_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
+ 	if (pll_div.k) {
+ 		reg |= 0x20;
+ 
+-		snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 18) & 0x3f);
+-		snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 9) & 0x1ff);
+-		snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0x1ff);
++		snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 16) & 0xff);
++		snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 8) & 0xff);
++		snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0xff);
+ 	}
+ 	snd_soc_write(codec, WM8960_PLL1, reg);
+ 
+diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
+index 42dffa07f819..f7a7b9d1d4c0 100644
+--- a/tools/perf/util/map.c
++++ b/tools/perf/util/map.c
+@@ -16,6 +16,7 @@ const char *map_type__name[MAP__NR_TYPES] = {
+ static inline int is_anon_memory(const char *filename)
+ {
+ 	return !strcmp(filename, "//anon") ||
++	       !strcmp(filename, "/dev/zero (deleted)") ||
+ 	       !strcmp(filename, "/anon_hugepage (deleted)");
+ }
+ 

Modified: genpatches-2.6/trunk/3.4/0000_README
===================================================================
--- genpatches-2.6/trunk/3.4/0000_README	2013-11-26 00:34:31 UTC (rev 2594)
+++ genpatches-2.6/trunk/3.4/0000_README	2013-11-29 23:44:29 UTC (rev 2595)
@@ -319,6 +319,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.4.70
 
+Patch:  1070_linux-3.4.71.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.4.71
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.4/1070_linux-3.4.71.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1070_linux-3.4.71.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.4/1070_linux-3.4.71.patch	2013-11-29 23:44:29 UTC (rev 2595)
@@ -0,0 +1,1738 @@
+diff --git a/Makefile b/Makefile
+index d7c0a3833a2b..05ace57061d6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 70
++SUBLEVEL = 71
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/cris/include/asm/io.h b/arch/cris/include/asm/io.h
+index ac12ae2b9286..db9a16c704f3 100644
+--- a/arch/cris/include/asm/io.h
++++ b/arch/cris/include/asm/io.h
+@@ -3,6 +3,7 @@
+ 
+ #include <asm/page.h>   /* for __va, __pa */
+ #include <arch/io.h>
++#include <asm-generic/iomap.h>
+ #include <linux/kernel.h>
+ 
+ struct cris_io_operations
+diff --git a/arch/ia64/include/asm/processor.h b/arch/ia64/include/asm/processor.h
+index 483f6c6a4238..2d0cb8e8eedd 100644
+--- a/arch/ia64/include/asm/processor.h
++++ b/arch/ia64/include/asm/processor.h
+@@ -322,7 +322,7 @@ struct thread_struct {
+ 	regs->loadrs = 0;									\
+ 	regs->r8 = get_dumpable(current->mm);	/* set "don't zap registers" flag */		\
+ 	regs->r12 = new_sp - 16;	/* allocate 16 byte scratch area */			\
+-	if (unlikely(!get_dumpable(current->mm))) {							\
++	if (unlikely(get_dumpable(current->mm) != SUID_DUMP_USER)) {	\
+ 		/*										\
+ 		 * Zap scratch regs to avoid leaking bits between processes with different	\
+ 		 * uid/privileges.								\
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
+index 45eb998557f8..e6de787956ce 100644
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -459,7 +459,15 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
+ 		if (copy_vsx_to_user(&frame->mc_vsregs, current))
+ 			return 1;
+ 		msr |= MSR_VSX;
+-	}
++	} else if (!ctx_has_vsx_region)
++		/*
++		 * With a small context structure we can't hold the VSX
++		 * registers, hence clear the MSR value to indicate the state
++		 * was not saved.
++		 */
++		msr &= ~MSR_VSX;
++
++
+ #endif /* CONFIG_VSX */
+ #ifdef CONFIG_SPE
+ 	/* save spe registers */
+diff --git a/arch/powerpc/kernel/vio.c b/arch/powerpc/kernel/vio.c
+index cfe0069bcfc8..fcf89bff1177 100644
+--- a/arch/powerpc/kernel/vio.c
++++ b/arch/powerpc/kernel/vio.c
+@@ -1342,12 +1342,12 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
+ 
+ 	dn = dev->of_node;
+ 	if (!dn) {
+-		strcat(buf, "\n");
++		strcpy(buf, "\n");
+ 		return strlen(buf);
+ 	}
+ 	cp = of_get_property(dn, "compatible", NULL);
+ 	if (!cp) {
+-		strcat(buf, "\n");
++		strcpy(buf, "\n");
+ 		return strlen(buf);
+ 	}
+ 
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index fbdd74dac3ac..5da8e8df5922 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -613,13 +613,23 @@ static int __devinit pnv_ioda_configure_pe(struct pnv_phb *phb,
+ 		rid_end = pe->rid + 1;
+ 	}
+ 
+-	/* Associate PE in PELT */
++	/*
++	 * Associate PE in PELT. We need add the PE into the
++	 * corresponding PELT-V as well. Otherwise, the error
++	 * originated from the PE might contribute to other
++	 * PEs.
++	 */
+ 	rc = opal_pci_set_pe(phb->opal_id, pe->pe_number, pe->rid,
+ 			     bcomp, dcomp, fcomp, OPAL_MAP_PE);
+ 	if (rc) {
+ 		pe_err(pe, "OPAL error %ld trying to setup PELT table\n", rc);
+ 		return -ENXIO;
+ 	}
++
++	rc = opal_pci_set_peltv(phb->opal_id, pe->pe_number,
++				pe->pe_number, OPAL_ADD_PE_TO_DOMAIN);
++	if (rc)
++		pe_warn(pe, "OPAL error %d adding self to PELTV\n", rc);
+ 	opal_pci_eeh_freeze_clear(phb->opal_id, pe->pe_number,
+ 				  OPAL_EEH_ACTION_CLEAR_FREEZE_ALL);
+ 
+diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
+index 5d8cf0d6796c..b316ffe8ab59 100644
+--- a/arch/x86/kernel/microcode_amd.c
++++ b/arch/x86/kernel/microcode_amd.c
+@@ -338,7 +338,7 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device)
+ 		snprintf(fw_name, sizeof(fw_name), "amd-ucode/microcode_amd_fam%.2xh.bin", c->x86);
+ 
+ 	if (request_firmware(&fw, (const char *)fw_name, device)) {
+-		pr_err("failed to load file %s\n", fw_name);
++		pr_debug("failed to load file %s\n", fw_name);
+ 		goto out;
+ 	}
+ 
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 85fd41003434..a02cfb7e4123 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -2041,6 +2041,7 @@ void blk_start_request(struct request *req)
+ 	if (unlikely(blk_bidi_rq(req)))
+ 		req->next_rq->resid_len = blk_rq_bytes(req->next_rq);
+ 
++	BUG_ON(test_bit(REQ_ATOM_COMPLETE, &req->atomic_flags));
+ 	blk_add_timer(req);
+ }
+ EXPORT_SYMBOL(blk_start_request);
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index d3234fc494ad..b74cc58bc038 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -143,6 +143,7 @@ void blk_set_stacking_limits(struct queue_limits *lim)
+ 	lim->discard_zeroes_data = 1;
+ 	lim->max_segments = USHRT_MAX;
+ 	lim->max_hw_sectors = UINT_MAX;
++	lim->max_segment_size = UINT_MAX;
+ 
+ 	lim->max_sectors = BLK_DEF_MAX_SECTORS;
+ }
+diff --git a/block/blk-timeout.c b/block/blk-timeout.c
+index 780354888958..b1182ea52427 100644
+--- a/block/blk-timeout.c
++++ b/block/blk-timeout.c
+@@ -90,8 +90,8 @@ static void blk_rq_timed_out(struct request *req)
+ 		__blk_complete_request(req);
+ 		break;
+ 	case BLK_EH_RESET_TIMER:
+-		blk_clear_rq_complete(req);
+ 		blk_add_timer(req);
++		blk_clear_rq_complete(req);
+ 		break;
+ 	case BLK_EH_NOT_HANDLED:
+ 		/*
+@@ -173,7 +173,6 @@ void blk_add_timer(struct request *req)
+ 		return;
+ 
+ 	BUG_ON(!list_empty(&req->timeout_list));
+-	BUG_ON(test_bit(REQ_ATOM_COMPLETE, &req->atomic_flags));
+ 
+ 	/*
+ 	 * Some LLDs, like scsi, peek at the timeout to prevent a
+diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
+index 6ddd99e6114b..c21f761b65b5 100644
+--- a/crypto/ansi_cprng.c
++++ b/crypto/ansi_cprng.c
+@@ -230,11 +230,11 @@ remainder:
+ 	 */
+ 	if (byte_count < DEFAULT_BLK_SZ) {
+ empty_rbuf:
+-		for (; ctx->rand_data_valid < DEFAULT_BLK_SZ;
+-			ctx->rand_data_valid++) {
++		while (ctx->rand_data_valid < DEFAULT_BLK_SZ) {
+ 			*ptr = ctx->rand_data[ctx->rand_data_valid];
+ 			ptr++;
+ 			byte_count--;
++			ctx->rand_data_valid++;
+ 			if (byte_count == 0)
+ 				goto done;
+ 		}
+diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c
+index 9ba8c73cea16..fe2f9d95d0f8 100644
+--- a/drivers/acpi/acpica/exoparg1.c
++++ b/drivers/acpi/acpica/exoparg1.c
+@@ -970,10 +970,17 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state)
+ 					 */
+ 					return_desc =
+ 					    *(operand[0]->reference.where);
+-					if (return_desc) {
+-						acpi_ut_add_reference
+-						    (return_desc);
++					if (!return_desc) {
++						/*
++						 * Element is NULL, do not allow the dereference.
++						 * This provides compatibility with other ACPI
++						 * implementations.
++						 */
++						return_ACPI_STATUS
++						    (AE_AML_UNINITIALIZED_ELEMENT);
+ 					}
++
++					acpi_ut_add_reference(return_desc);
+ 					break;
+ 
+ 				default:
+@@ -998,11 +1005,40 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state)
+ 									 acpi_namespace_node
+ 									 *)
+ 									return_desc);
+-				}
++					if (!return_desc) {
++						break;
++					}
+ 
+-				/* Add another reference to the object! */
++					/*
++					 * June 2013:
++					 * buffer_fields/field_units require additional resolution
++					 */
++					switch (return_desc->common.type) {
++					case ACPI_TYPE_BUFFER_FIELD:
++					case ACPI_TYPE_LOCAL_REGION_FIELD:
++					case ACPI_TYPE_LOCAL_BANK_FIELD:
++					case ACPI_TYPE_LOCAL_INDEX_FIELD:
+ 
+-				acpi_ut_add_reference(return_desc);
++						status =
++						    acpi_ex_read_data_from_field
++						    (walk_state, return_desc,
++						     &temp_desc);
++						if (ACPI_FAILURE(status)) {
++							goto cleanup;
++						}
++
++						return_desc = temp_desc;
++						break;
++
++					default:
++
++						/* Add another reference to the object */
++
++						acpi_ut_add_reference
++						    (return_desc);
++						break;
++					}
++				}
+ 				break;
+ 
+ 			default:
+diff --git a/drivers/acpi/acpica/exstore.c b/drivers/acpi/acpica/exstore.c
+index c6cf843cc4c9..9806f4be7b88 100644
+--- a/drivers/acpi/acpica/exstore.c
++++ b/drivers/acpi/acpica/exstore.c
+@@ -57,6 +57,11 @@ acpi_ex_store_object_to_index(union acpi_operand_object *val_desc,
+ 			      union acpi_operand_object *dest_desc,
+ 			      struct acpi_walk_state *walk_state);
+ 
++static acpi_status
++acpi_ex_store_direct_to_node(union acpi_operand_object *source_desc,
++			     struct acpi_namespace_node *node,
++			     struct acpi_walk_state *walk_state);
++
+ /*******************************************************************************
+  *
+  * FUNCTION:    acpi_ex_store
+@@ -376,7 +381,11 @@ acpi_ex_store_object_to_index(union acpi_operand_object *source_desc,
+  *              When storing into an object the data is converted to the
+  *              target object type then stored in the object.  This means
+  *              that the target object type (for an initialized target) will
+- *              not be changed by a store operation.
++ *              not be changed by a store operation. A copy_object can change
++ *              the target type, however.
++ *
++ *              The implicit_conversion flag is set to NO/FALSE only when
++ *              storing to an arg_x -- as per the rules of the ACPI spec.
+  *
+  *              Assumes parameters are already validated.
+  *
+@@ -400,7 +409,7 @@ acpi_ex_store_object_to_node(union acpi_operand_object *source_desc,
+ 	target_type = acpi_ns_get_type(node);
+ 	target_desc = acpi_ns_get_attached_object(node);
+ 
+-	ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "Storing %p(%s) into node %p(%s)\n",
++	ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "Storing %p (%s) to node %p (%s)\n",
+ 			  source_desc,
+ 			  acpi_ut_get_object_type_name(source_desc), node,
+ 			  acpi_ut_get_type_name(target_type)));
+@@ -414,46 +423,31 @@ acpi_ex_store_object_to_node(union acpi_operand_object *source_desc,
+ 		return_ACPI_STATUS(status);
+ 	}
+ 
+-	/* If no implicit conversion, drop into the default case below */
+-
+-	if ((!implicit_conversion) ||
+-	    ((walk_state->opcode == AML_COPY_OP) &&
+-	     (target_type != ACPI_TYPE_LOCAL_REGION_FIELD) &&
+-	     (target_type != ACPI_TYPE_LOCAL_BANK_FIELD) &&
+-	     (target_type != ACPI_TYPE_LOCAL_INDEX_FIELD))) {
+-		/*
+-		 * Force execution of default (no implicit conversion). Note:
+-		 * copy_object does not perform an implicit conversion, as per the ACPI
+-		 * spec -- except in case of region/bank/index fields -- because these
+-		 * objects must retain their original type permanently.
+-		 */
+-		target_type = ACPI_TYPE_ANY;
+-	}
+-
+ 	/* Do the actual store operation */
+ 
+ 	switch (target_type) {
+-	case ACPI_TYPE_BUFFER_FIELD:
+-	case ACPI_TYPE_LOCAL_REGION_FIELD:
+-	case ACPI_TYPE_LOCAL_BANK_FIELD:
+-	case ACPI_TYPE_LOCAL_INDEX_FIELD:
+-
+-		/* For fields, copy the source data to the target field. */
+-
+-		status = acpi_ex_write_data_to_field(source_desc, target_desc,
+-						     &walk_state->result_obj);
+-		break;
+-
+ 	case ACPI_TYPE_INTEGER:
+ 	case ACPI_TYPE_STRING:
+ 	case ACPI_TYPE_BUFFER:
+ 
+ 		/*
+-		 * These target types are all of type Integer/String/Buffer, and
+-		 * therefore support implicit conversion before the store.
+-		 *
+-		 * Copy and/or convert the source object to a new target object
++		 * The simple data types all support implicit source operand
++		 * conversion before the store.
+ 		 */
++
++		if ((walk_state->opcode == AML_COPY_OP) || !implicit_conversion) {
++			/*
++			 * However, copy_object and Stores to arg_x do not perform
++			 * an implicit conversion, as per the ACPI specification.
++			 * A direct store is performed instead.
++			 */
++			status = acpi_ex_store_direct_to_node(source_desc, node,
++							      walk_state);
++			break;
++		}
++
++		/* Store with implicit source operand conversion support */
++
+ 		status =
+ 		    acpi_ex_store_object_to_object(source_desc, target_desc,
+ 						   &new_desc, walk_state);
+@@ -467,13 +461,12 @@ acpi_ex_store_object_to_node(union acpi_operand_object *source_desc,
+ 			 * the Name's type to that of the value being stored in it.
+ 			 * source_desc reference count is incremented by attach_object.
+ 			 *
+-			 * Note: This may change the type of the node if an explicit store
+-			 * has been performed such that the node/object type has been
+-			 * changed.
++			 * Note: This may change the type of the node if an explicit
++			 * store has been performed such that the node/object type
++			 * has been changed.
+ 			 */
+-			status =
+-			    acpi_ns_attach_object(node, new_desc,
+-						  new_desc->common.type);
++			status = acpi_ns_attach_object(node, new_desc,
++						       new_desc->common.type);
+ 
+ 			ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
+ 					  "Store %s into %s via Convert/Attach\n",
+@@ -484,19 +477,83 @@ acpi_ex_store_object_to_node(union acpi_operand_object *source_desc,
+ 		}
+ 		break;
+ 
++	case ACPI_TYPE_BUFFER_FIELD:
++	case ACPI_TYPE_LOCAL_REGION_FIELD:
++	case ACPI_TYPE_LOCAL_BANK_FIELD:
++	case ACPI_TYPE_LOCAL_INDEX_FIELD:
++		/*
++		 * For all fields, always write the source data to the target
++		 * field. Any required implicit source operand conversion is
++		 * performed in the function below as necessary. Note, field
++		 * objects must retain their original type permanently.
++		 */
++		status = acpi_ex_write_data_to_field(source_desc, target_desc,
++						     &walk_state->result_obj);
++		break;
++
+ 	default:
++		/*
++		 * No conversions for all other types. Directly store a copy of
++		 * the source object. This is the ACPI spec-defined behavior for
++		 * the copy_object operator.
++		 *
++		 * NOTE: For the Store operator, this is a departure from the
++		 * ACPI spec, which states "If conversion is impossible, abort
++		 * the running control method". Instead, this code implements
++		 * "If conversion is impossible, treat the Store operation as
++		 * a CopyObject".
++		 */
++		status = acpi_ex_store_direct_to_node(source_desc, node,
++						      walk_state);
++		break;
++	}
+ 
+-		ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
+-				  "Storing %s (%p) directly into node (%p) with no implicit conversion\n",
+-				  acpi_ut_get_object_type_name(source_desc),
+-				  source_desc, node));
++	return_ACPI_STATUS(status);
++}
+ 
+-		/* No conversions for all other types.  Just attach the source object */
++/*******************************************************************************
++ *
++ * FUNCTION:    acpi_ex_store_direct_to_node
++ *
++ * PARAMETERS:  source_desc             - Value to be stored
++ *              node                    - Named object to receive the value
++ *              walk_state              - Current walk state
++ *
++ * RETURN:      Status
++ *
++ * DESCRIPTION: "Store" an object directly to a node. This involves a copy
++ *              and an attach.
++ *
++ ******************************************************************************/
+ 
+-		status = acpi_ns_attach_object(node, source_desc,
+-					       source_desc->common.type);
+-		break;
++static acpi_status
++acpi_ex_store_direct_to_node(union acpi_operand_object *source_desc,
++			     struct acpi_namespace_node *node,
++			     struct acpi_walk_state *walk_state)
++{
++	acpi_status status;
++	union acpi_operand_object *new_desc;
++
++	ACPI_FUNCTION_TRACE(ex_store_direct_to_node);
++
++	ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
++			  "Storing [%s] (%p) directly into node [%s] (%p)"
++			  " with no implicit conversion\n",
++			  acpi_ut_get_object_type_name(source_desc),
++			  source_desc, acpi_ut_get_type_name(node->type),
++			  node));
++
++	/* Copy the source object to a new object */
++
++	status =
++	    acpi_ut_copy_iobject_to_iobject(source_desc, &new_desc, walk_state);
++	if (ACPI_FAILURE(status)) {
++		return_ACPI_STATUS(status);
+ 	}
+ 
++	/* Attach the new object to the node */
++
++	status = acpi_ns_attach_object(node, new_desc, new_desc->common.type);
++	acpi_ut_remove_reference(new_desc);
+ 	return_ACPI_STATUS(status);
+ }
+diff --git a/drivers/block/brd.c b/drivers/block/brd.c
+index 4e8213aa02fd..a7d70e2a8d74 100644
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -546,7 +546,7 @@ static struct kobject *brd_probe(dev_t dev, int *part, void *data)
+ 
+ 	mutex_lock(&brd_devices_mutex);
+ 	brd = brd_init_one(MINOR(dev) >> part_shift);
+-	kobj = brd ? get_disk(brd->brd_disk) : ERR_PTR(-ENOMEM);
++	kobj = brd ? get_disk(brd->brd_disk) : NULL;
+ 	mutex_unlock(&brd_devices_mutex);
+ 
+ 	*part = 0;
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 179b5b408cb3..a4ddbae2e100 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1743,7 +1743,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data)
+ 	if (err < 0)
+ 		err = loop_add(&lo, MINOR(dev) >> part_shift);
+ 	if (err < 0)
+-		kobj = ERR_PTR(err);
++		kobj = NULL;
+ 	else
+ 		kobj = get_disk(lo->lo_disk);
+ 	mutex_unlock(&loop_index_mutex);
+diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
+index 22b14a68e35e..1f4f94103c55 100644
+--- a/drivers/hwmon/lm90.c
++++ b/drivers/hwmon/lm90.c
+@@ -278,7 +278,7 @@ static const struct lm90_params lm90_params[] = {
+ 	[max6696] = {
+ 		.flags = LM90_HAVE_EMERGENCY
+ 		  | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3,
+-		.alert_alarms = 0x187c,
++		.alert_alarms = 0x1c7c,
+ 		.max_convrate = 6,
+ 		.reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+ 	},
+@@ -1504,19 +1504,22 @@ static void lm90_alert(struct i2c_client *client, unsigned int flag)
+ 	if ((alarms & 0x7f) == 0 && (alarms2 & 0xfe) == 0) {
+ 		dev_info(&client->dev, "Everything OK\n");
+ 	} else {
+-		if (alarms & 0x61)
++		if ((alarms & 0x61) || (alarms2 & 0x80))
+ 			dev_warn(&client->dev,
+ 				 "temp%d out of range, please check!\n", 1);
+-		if (alarms & 0x1a)
++		if ((alarms & 0x1a) || (alarms2 & 0x20))
+ 			dev_warn(&client->dev,
+ 				 "temp%d out of range, please check!\n", 2);
+ 		if (alarms & 0x04)
+ 			dev_warn(&client->dev,
+ 				 "temp%d diode open, please check!\n", 2);
+ 
+-		if (alarms2 & 0x18)
++		if (alarms2 & 0x5a)
+ 			dev_warn(&client->dev,
+ 				 "temp%d out of range, please check!\n", 3);
++		if (alarms2 & 0x04)
++			dev_warn(&client->dev,
++				 "temp%d diode open, please check!\n", 3);
+ 
+ 		/*
+ 		 * Disable ALERT# output, because these chips don't implement
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 21a3d77ea7e2..77405b4e8636 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -760,9 +760,6 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota)
+ 			msg_ctrl_save = priv->read_reg(priv,
+ 					&priv->regs->ifregs[0].msg_cntrl);
+ 
+-			if (msg_ctrl_save & IF_MCONT_EOB)
+-				return num_rx_pkts;
+-
+ 			if (msg_ctrl_save & IF_MCONT_MSGLST) {
+ 				c_can_handle_lost_msg_obj(dev, 0, msg_obj);
+ 				num_rx_pkts++;
+@@ -770,6 +767,9 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota)
+ 				continue;
+ 			}
+ 
++			if (msg_ctrl_save & IF_MCONT_EOB)
++				return num_rx_pkts;
++
+ 			if (!(msg_ctrl_save & IF_MCONT_NEWDAT))
+ 				continue;
+ 
+diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
+index 1b4404725b8c..effb3b71ce75 100644
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -1232,6 +1232,7 @@ static void cp_tx_timeout(struct net_device *dev)
+ 	cp_clean_rings(cp);
+ 	rc = cp_init_rings(cp);
+ 	cp_start_hw(cp);
++	cp_enable_irq(cp);
+ 
+ 	netif_wake_queue(dev);
+ 
+diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
+index a06cc283e23d..0b48430d6ad0 100644
+--- a/drivers/net/wireless/libertas/debugfs.c
++++ b/drivers/net/wireless/libertas/debugfs.c
+@@ -913,7 +913,10 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
+ 	char *p2;
+ 	struct debug_data *d = f->private_data;
+ 
+-	pdata = kmalloc(cnt, GFP_KERNEL);
++	if (cnt == 0)
++		return 0;
++
++	pdata = kmalloc(cnt + 1, GFP_KERNEL);
+ 	if (pdata == NULL)
+ 		return 0;
+ 
+@@ -922,6 +925,7 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
+ 		kfree(pdata);
+ 		return 0;
+ 	}
++	pdata[cnt] = '\0';
+ 
+ 	p0 = pdata;
+ 	for (i = 0; i < num_of_items; i++) {
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index 65cb4250259f..6eec862fea28 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -143,6 +143,8 @@ static bool rt2800usb_txstatus_timeout(struct rt2x00_dev *rt2x00dev)
+ 	return false;
+ }
+ 
++#define TXSTATUS_READ_INTERVAL 1000000
++
+ static bool rt2800usb_tx_sta_fifo_read_completed(struct rt2x00_dev *rt2x00dev,
+ 						 int urb_status, u32 tx_status)
+ {
+@@ -170,8 +172,9 @@ static bool rt2800usb_tx_sta_fifo_read_completed(struct rt2x00_dev *rt2x00dev,
+ 		queue_work(rt2x00dev->workqueue, &rt2x00dev->txdone_work);
+ 
+ 	if (rt2800usb_txstatus_pending(rt2x00dev)) {
+-		/* Read register after 250 us */
+-		hrtimer_start(&rt2x00dev->txstatus_timer, ktime_set(0, 250000),
++		/* Read register after 1 ms */
++		hrtimer_start(&rt2x00dev->txstatus_timer,
++			      ktime_set(0, TXSTATUS_READ_INTERVAL),
+ 			      HRTIMER_MODE_REL);
+ 		return false;
+ 	}
+@@ -196,8 +199,9 @@ static void rt2800usb_async_read_tx_status(struct rt2x00_dev *rt2x00dev)
+ 	if (test_and_set_bit(TX_STATUS_READING, &rt2x00dev->flags))
+ 		return;
+ 
+-	/* Read TX_STA_FIFO register after 500 us */
+-	hrtimer_start(&rt2x00dev->txstatus_timer, ktime_set(0, 500000),
++	/* Read TX_STA_FIFO register after 2 ms */
++	hrtimer_start(&rt2x00dev->txstatus_timer,
++		      ktime_set(0, 2*TXSTATUS_READ_INTERVAL),
+ 		      HRTIMER_MODE_REL);
+ }
+ 
+diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
+index a8885f060060..6701f2d71274 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
+@@ -771,6 +771,9 @@ void rt2x00mac_flush(struct ieee80211_hw *hw, bool drop)
+ 	struct rt2x00_dev *rt2x00dev = hw->priv;
+ 	struct data_queue *queue;
+ 
++	if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
++		return;
++
+ 	tx_queue_for_each(rt2x00dev, queue)
+ 		rt2x00queue_flush_queue(queue, drop);
+ }
+diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
+index 0bd38da4ada0..05fbc3ded9b5 100644
+--- a/drivers/scsi/aacraid/commctrl.c
++++ b/drivers/scsi/aacraid/commctrl.c
+@@ -508,7 +508,8 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
+ 		goto cleanup;
+ 	}
+ 
+-	if (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr))) {
++	if ((fibsize < (sizeof(struct user_aac_srb) - sizeof(struct user_sgentry))) ||
++	    (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr)))) {
+ 		rcode = -EINVAL;
+ 		goto cleanup;
+ 	}
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index a783d533a1a6..715075291834 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -650,16 +650,30 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
+ {
+ 	struct uio_device *idev = vma->vm_private_data;
+ 	int mi = uio_find_mem_index(vma);
++	struct uio_mem *mem;
+ 	if (mi < 0)
+ 		return -EINVAL;
++	mem = idev->info->mem + mi;
++
++	if (vma->vm_end - vma->vm_start > mem->size)
++		return -EINVAL;
+ 
+ 	vma->vm_flags |= VM_IO | VM_RESERVED;
+ 
+ 	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ 
++	/*
++	 * We cannot use the vm_iomap_memory() helper here,
++	 * because vma->vm_pgoff is the map index we looked
++	 * up above in uio_find_mem_index(), rather than an
++	 * actual page offset into the mmap.
++	 *
++	 * So we just do the physical mmap without a page
++	 * offset.
++	 */
+ 	return remap_pfn_range(vma,
+ 			       vma->vm_start,
+-			       idev->info->mem[mi].addr >> PAGE_SHIFT,
++			       mem->addr >> PAGE_SHIFT,
+ 			       vma->vm_end - vma->vm_start,
+ 			       vma->vm_page_prot);
+ }
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index c8542356898b..91293b68df5a 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -1664,7 +1664,11 @@ static int mos7840_tiocmget(struct tty_struct *tty)
+ 		return -ENODEV;
+ 
+ 	status = mos7840_get_uart_reg(port, MODEM_STATUS_REGISTER, &msr);
++	if (status != 1)
++		return -EIO;
+ 	status = mos7840_get_uart_reg(port, MODEM_CONTROL_REGISTER, &mcr);
++	if (status != 1)
++		return -EIO;
+ 	result = ((mcr & MCR_DTR) ? TIOCM_DTR : 0)
+ 	    | ((mcr & MCR_RTS) ? TIOCM_RTS : 0)
+ 	    | ((mcr & MCR_LOOPBACK) ? TIOCM_LOOP : 0)
+diff --git a/drivers/video/au1100fb.c b/drivers/video/au1100fb.c
+index ffbce4525468..612c1c7cb31b 100644
+--- a/drivers/video/au1100fb.c
++++ b/drivers/video/au1100fb.c
+@@ -375,39 +375,15 @@ void au1100fb_fb_rotate(struct fb_info *fbi, int angle)
+ int au1100fb_fb_mmap(struct fb_info *fbi, struct vm_area_struct *vma)
+ {
+ 	struct au1100fb_device *fbdev;
+-	unsigned int len;
+-	unsigned long start=0, off;
+ 
+ 	fbdev = to_au1100fb_device(fbi);
+ 
+-	if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) {
+-		return -EINVAL;
+-	}
+-
+-	start = fbdev->fb_phys & PAGE_MASK;
+-	len = PAGE_ALIGN((start & ~PAGE_MASK) + fbdev->fb_len);
+-
+-	off = vma->vm_pgoff << PAGE_SHIFT;
+-
+-	if ((vma->vm_end - vma->vm_start + off) > len) {
+-		return -EINVAL;
+-	}
+-
+-	off += start;
+-	vma->vm_pgoff = off >> PAGE_SHIFT;
+-
+ 	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ 	pgprot_val(vma->vm_page_prot) |= (6 << 9); //CCA=6
+ 
+ 	vma->vm_flags |= VM_IO;
+ 
+-	if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
+-				vma->vm_end - vma->vm_start,
+-				vma->vm_page_prot)) {
+-		return -EAGAIN;
+-	}
+-
+-	return 0;
++	return vm_iomap_memory(vma, fbdev->fb_phys, fbdev->fb_len);
+ }
+ 
+ static struct fb_ops au1100fb_ops =
+diff --git a/drivers/video/au1200fb.c b/drivers/video/au1200fb.c
+index 7ca79f02056e..117be3d9b854 100644
+--- a/drivers/video/au1200fb.c
++++ b/drivers/video/au1200fb.c
+@@ -1233,36 +1233,15 @@ static int au1200fb_fb_blank(int blank_mode, struct fb_info *fbi)
+  * method mainly to allow the use of the TLB streaming flag (CCA=6)
+  */
+ static int au1200fb_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
+-
+ {
+-	unsigned int len;
+-	unsigned long start=0, off;
+ 	struct au1200fb_device *fbdev = info->par;
+ 
+-	if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) {
+-		return -EINVAL;
+-	}
+-
+-	start = fbdev->fb_phys & PAGE_MASK;
+-	len = PAGE_ALIGN((start & ~PAGE_MASK) + fbdev->fb_len);
+-
+-	off = vma->vm_pgoff << PAGE_SHIFT;
+-
+-	if ((vma->vm_end - vma->vm_start + off) > len) {
+-		return -EINVAL;
+-	}
+-
+-	off += start;
+-	vma->vm_pgoff = off >> PAGE_SHIFT;
+-
+ 	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ 	pgprot_val(vma->vm_page_prot) |= _CACHE_MASK; /* CCA=7 */
+ 
+ 	vma->vm_flags |= VM_IO;
+ 
+-	return io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
+-				  vma->vm_end - vma->vm_start,
+-				  vma->vm_page_prot);
++	return vm_iomap_memory(vma, fbdev->fb_phys, fbdev->fb_len);
+ 
+ 	return 0;
+ }
+diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
+index 7e6c52d8a207..c91f6d1bf64f 100644
+--- a/fs/configfs/dir.c
++++ b/fs/configfs/dir.c
+@@ -56,10 +56,19 @@ static void configfs_d_iput(struct dentry * dentry,
+ 	struct configfs_dirent *sd = dentry->d_fsdata;
+ 
+ 	if (sd) {
+-		BUG_ON(sd->s_dentry != dentry);
+ 		/* Coordinate with configfs_readdir */
+ 		spin_lock(&configfs_dirent_lock);
+-		sd->s_dentry = NULL;
++		/* Coordinate with configfs_attach_attr where will increase
++		 * sd->s_count and update sd->s_dentry to new allocated one.
++		 * Only set sd->dentry to null when this dentry is the only
++		 * sd owner.
++		 * If not do so, configfs_d_iput may run just after
++		 * configfs_attach_attr and set sd->s_dentry to null
++		 * even it's still in use.
++		 */
++		if (atomic_read(&sd->s_count) <= 2)
++			sd->s_dentry = NULL;
++
+ 		spin_unlock(&configfs_dirent_lock);
+ 		configfs_put(sd);
+ 	}
+@@ -426,8 +435,11 @@ static int configfs_attach_attr(struct configfs_dirent * sd, struct dentry * den
+ 	struct configfs_attribute * attr = sd->s_element;
+ 	int error;
+ 
++	spin_lock(&configfs_dirent_lock);
+ 	dentry->d_fsdata = configfs_get(sd);
+ 	sd->s_dentry = dentry;
++	spin_unlock(&configfs_dirent_lock);
++
+ 	error = configfs_create(dentry, (attr->ca_mode & S_IALLUGO) | S_IFREG,
+ 				configfs_init_file);
+ 	if (error) {
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 9d39de40909d..09e2eda55c57 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -2513,7 +2513,6 @@ static int prepend_path(const struct path *path,
+ 	bool slash = false;
+ 	int error = 0;
+ 
+-	br_read_lock(vfsmount_lock);
+ 	while (dentry != root->dentry || vfsmnt != root->mnt) {
+ 		struct dentry * parent;
+ 
+@@ -2543,8 +2542,6 @@ static int prepend_path(const struct path *path,
+ 	if (!error && !slash)
+ 		error = prepend(buffer, buflen, "/", 1);
+ 
+-out:
+-	br_read_unlock(vfsmount_lock);
+ 	return error;
+ 
+ global_root:
+@@ -2561,7 +2558,7 @@ global_root:
+ 		error = prepend(buffer, buflen, "/", 1);
+ 	if (!error)
+ 		error = real_mount(vfsmnt)->mnt_ns ? 1 : 2;
+-	goto out;
++	return error;
+ }
+ 
+ /**
+@@ -2588,9 +2585,11 @@ char *__d_path(const struct path *path,
+ 	int error;
+ 
+ 	prepend(&res, &buflen, "\0", 1);
++	br_read_lock(vfsmount_lock);
+ 	write_seqlock(&rename_lock);
+ 	error = prepend_path(path, root, &res, &buflen);
+ 	write_sequnlock(&rename_lock);
++	br_read_unlock(vfsmount_lock);
+ 
+ 	if (error < 0)
+ 		return ERR_PTR(error);
+@@ -2607,9 +2606,11 @@ char *d_absolute_path(const struct path *path,
+ 	int error;
+ 
+ 	prepend(&res, &buflen, "\0", 1);
++	br_read_lock(vfsmount_lock);
+ 	write_seqlock(&rename_lock);
+ 	error = prepend_path(path, &root, &res, &buflen);
+ 	write_sequnlock(&rename_lock);
++	br_read_unlock(vfsmount_lock);
+ 
+ 	if (error > 1)
+ 		error = -EINVAL;
+@@ -2673,11 +2674,13 @@ char *d_path(const struct path *path, char *buf, int buflen)
+ 		return path->dentry->d_op->d_dname(path->dentry, buf, buflen);
+ 
+ 	get_fs_root(current->fs, &root);
++	br_read_lock(vfsmount_lock);
+ 	write_seqlock(&rename_lock);
+ 	error = path_with_deleted(path, &root, &res, &buflen);
++	write_sequnlock(&rename_lock);
++	br_read_unlock(vfsmount_lock);
+ 	if (error < 0)
+ 		res = ERR_PTR(error);
+-	write_sequnlock(&rename_lock);
+ 	path_put(&root);
+ 	return res;
+ }
+@@ -2832,6 +2835,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
+ 	get_fs_root_and_pwd(current->fs, &root, &pwd);
+ 
+ 	error = -ENOENT;
++	br_read_lock(vfsmount_lock);
+ 	write_seqlock(&rename_lock);
+ 	if (!d_unlinked(pwd.dentry)) {
+ 		unsigned long len;
+@@ -2841,6 +2845,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
+ 		prepend(&cwd, &buflen, "\0", 1);
+ 		error = prepend_path(&pwd, &root, &cwd, &buflen);
+ 		write_sequnlock(&rename_lock);
++		br_read_unlock(vfsmount_lock);
+ 
+ 		if (error < 0)
+ 			goto out;
+@@ -2861,6 +2866,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
+ 		}
+ 	} else {
+ 		write_sequnlock(&rename_lock);
++		br_read_unlock(vfsmount_lock);
+ 	}
+ 
+ out:
+diff --git a/fs/exec.c b/fs/exec.c
+index 0ea0b4c476d8..5b9dfbe84b19 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -909,11 +909,13 @@ static int de_thread(struct task_struct *tsk)
+ 
+ 		sig->notify_count = -1;	/* for exit_notify() */
+ 		for (;;) {
++			threadgroup_change_begin(tsk);
+ 			write_lock_irq(&tasklist_lock);
+ 			if (likely(leader->exit_state))
+ 				break;
+ 			__set_current_state(TASK_UNINTERRUPTIBLE);
+ 			write_unlock_irq(&tasklist_lock);
++			threadgroup_change_end(tsk);
+ 			schedule();
+ 		}
+ 
+@@ -969,6 +971,7 @@ static int de_thread(struct task_struct *tsk)
+ 		if (unlikely(leader->ptrace))
+ 			__wake_up_parent(leader, leader->parent);
+ 		write_unlock_irq(&tasklist_lock);
++		threadgroup_change_end(tsk);
+ 
+ 		release_task(leader);
+ 	}
+@@ -2024,6 +2027,12 @@ static int __get_dumpable(unsigned long mm_flags)
+ 	return (ret >= 2) ? 2 : ret;
+ }
+ 
++/*
++ * This returns the actual value of the suid_dumpable flag. For things
++ * that are using this for checking for privilege transitions, it must
++ * test against SUID_DUMP_USER rather than treating it as a boolean
++ * value.
++ */
+ int get_dumpable(struct mm_struct *mm)
+ {
+ 	return __get_dumpable(mm->flags);
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index edf411988bf3..9bb4e5c541b0 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -224,6 +224,8 @@ nfs_find_actor(struct inode *inode, void *opaque)
+ 
+ 	if (NFS_FILEID(inode) != fattr->fileid)
+ 		return 0;
++	if ((S_IFMT & inode->i_mode) != (S_IFMT & fattr->mode))
++		return 0;
+ 	if (nfs_compare_fh(NFS_FH(inode), fh))
+ 		return 0;
+ 	if (is_bad_inode(inode) || NFS_STALE(inode))
+diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
+index a7a043d272da..51017baa67af 100644
+--- a/fs/nfs/nfs3proc.c
++++ b/fs/nfs/nfs3proc.c
+@@ -24,14 +24,14 @@
+ 
+ #define NFSDBG_FACILITY		NFSDBG_PROC
+ 
+-/* A wrapper to handle the EJUKEBOX and EKEYEXPIRED error messages */
++/* A wrapper to handle the EJUKEBOX error messages */
+ static int
+ nfs3_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
+ {
+ 	int res;
+ 	do {
+ 		res = rpc_call_sync(clnt, msg, flags);
+-		if (res != -EJUKEBOX && res != -EKEYEXPIRED)
++		if (res != -EJUKEBOX)
+ 			break;
+ 		freezable_schedule_timeout_killable(NFS_JUKEBOX_RETRY_TIME);
+ 		res = -ERESTARTSYS;
+@@ -44,7 +44,7 @@ nfs3_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
+ static int
+ nfs3_async_handle_jukebox(struct rpc_task *task, struct inode *inode)
+ {
+-	if (task->tk_status != -EJUKEBOX && task->tk_status != -EKEYEXPIRED)
++	if (task->tk_status != -EJUKEBOX)
+ 		return 0;
+ 	if (task->tk_status == -EJUKEBOX)
+ 		nfs_inc_stats(inode, NFSIOS_DELAY);
+diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
+index 5acfd9ea8a31..4d64d5b85e56 100644
+--- a/fs/nfs/nfs4filelayout.c
++++ b/fs/nfs/nfs4filelayout.c
+@@ -122,7 +122,6 @@ static int filelayout_async_handle_error(struct rpc_task *task,
+ 		break;
+ 	case -NFS4ERR_DELAY:
+ 	case -NFS4ERR_GRACE:
+-	case -EKEYEXPIRED:
+ 		rpc_delay(task, FILELAYOUT_POLL_RETRY_MAX);
+ 		break;
+ 	case -NFS4ERR_RETRY_UNCACHED_REP:
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index d121c67f87d0..cabddb5da071 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -319,7 +319,6 @@ static int nfs4_handle_exception(struct nfs_server *server, int errorcode, struc
+ 			}
+ 		case -NFS4ERR_GRACE:
+ 		case -NFS4ERR_DELAY:
+-		case -EKEYEXPIRED:
+ 			ret = nfs4_delay(server->client, &exception->timeout);
+ 			if (ret != 0)
+ 				break;
+@@ -1352,13 +1351,6 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state
+ 				nfs_inode_find_state_and_recover(state->inode,
+ 						stateid);
+ 				nfs4_schedule_stateid_recovery(server, state);
+-			case -EKEYEXPIRED:
+-				/*
+-				 * User RPCSEC_GSS context has expired.
+-				 * We cannot recover this stateid now, so
+-				 * skip it and allow recovery thread to
+-				 * proceed.
+-				 */
+ 			case -ENOMEM:
+ 				err = 0;
+ 				goto out;
+@@ -3924,7 +3916,6 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
+ 		case -NFS4ERR_DELAY:
+ 			nfs_inc_server_stats(server, NFSIOS_DELAY);
+ 		case -NFS4ERR_GRACE:
+-		case -EKEYEXPIRED:
+ 			rpc_delay(task, NFS4_POLL_RETRY_MAX);
+ 			task->tk_status = 0;
+ 			return -EAGAIN;
+@@ -4216,6 +4207,7 @@ static int _nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock
+ 			status = 0;
+ 	}
+ 	request->fl_ops->fl_release_private(request);
++	request->fl_ops = NULL;
+ out:
+ 	return status;
+ }
+@@ -4871,15 +4863,6 @@ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
+ 				nfs4_schedule_stateid_recovery(server, state);
+ 				err = 0;
+ 				goto out;
+-			case -EKEYEXPIRED:
+-				/*
+-				 * User RPCSEC_GSS context has expired.
+-				 * We cannot recover this stateid now, so
+-				 * skip it and allow recovery thread to
+-				 * proceed.
+-				 */
+-				err = 0;
+-				goto out;
+ 			case -ENOMEM:
+ 			case -NFS4ERR_DENIED:
+ 				/* kill_proc(fl->fl_pid, SIGLOST, 1); */
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 7f0fcfc1fe9d..e46579471ccc 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1298,14 +1298,6 @@ restart:
+ 				/* Mark the file as being 'closed' */
+ 				state->state = 0;
+ 				break;
+-			case -EKEYEXPIRED:
+-				/*
+-				 * User RPCSEC_GSS context has expired.
+-				 * We cannot recover this stateid now, so
+-				 * skip it and allow recovery thread to
+-				 * proceed.
+-				 */
+-				break;
+ 			case -NFS4ERR_ADMIN_REVOKED:
+ 			case -NFS4ERR_STALE_STATEID:
+ 			case -NFS4ERR_BAD_STATEID:
+@@ -1458,14 +1450,6 @@ static void nfs4_state_start_reclaim_nograce(struct nfs_client *clp)
+ 	nfs4_state_mark_reclaim_helper(clp, nfs4_state_mark_reclaim_nograce);
+ }
+ 
+-static void nfs4_warn_keyexpired(const char *s)
+-{
+-	printk_ratelimited(KERN_WARNING "Error: state manager"
+-			" encountered RPCSEC_GSS session"
+-			" expired against NFSv4 server %s.\n",
+-			s);
+-}
+-
+ static int nfs4_recovery_handle_error(struct nfs_client *clp, int error)
+ {
+ 	switch (error) {
+@@ -1497,10 +1481,6 @@ static int nfs4_recovery_handle_error(struct nfs_client *clp, int error)
+ 			set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
+ 			/* Zero session reset errors */
+ 			break;
+-		case -EKEYEXPIRED:
+-			/* Nothing we can do */
+-			nfs4_warn_keyexpired(clp->cl_hostname);
+-			break;
+ 		default:
+ 			return error;
+ 	}
+@@ -1745,7 +1725,6 @@ static void nfs4_set_lease_expired(struct nfs_client *clp, int status)
+ 		break;
+ 
+ 	case -EKEYEXPIRED:
+-		nfs4_warn_keyexpired(clp->cl_hostname);
+ 	case -NFS4ERR_NOT_SAME: /* FixMe: implement recovery
+ 				 * in nfs4_exchange_id */
+ 	default:
+diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
+index b63b6f4d14fb..af9947e35fcb 100644
+--- a/fs/nfs/proc.c
++++ b/fs/nfs/proc.c
+@@ -47,39 +47,6 @@
+ #define NFSDBG_FACILITY		NFSDBG_PROC
+ 
+ /*
+- * wrapper to handle the -EKEYEXPIRED error message. This should generally
+- * only happen if using krb5 auth and a user's TGT expires. NFSv2 doesn't
+- * support the NFSERR_JUKEBOX error code, but we handle this situation in the
+- * same way that we handle that error with NFSv3.
+- */
+-static int
+-nfs_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
+-{
+-	int res;
+-	do {
+-		res = rpc_call_sync(clnt, msg, flags);
+-		if (res != -EKEYEXPIRED)
+-			break;
+-		freezable_schedule_timeout_killable(NFS_JUKEBOX_RETRY_TIME);
+-		res = -ERESTARTSYS;
+-	} while (!fatal_signal_pending(current));
+-	return res;
+-}
+-
+-#define rpc_call_sync(clnt, msg, flags)	nfs_rpc_wrapper(clnt, msg, flags)
+-
+-static int
+-nfs_async_handle_expired_key(struct rpc_task *task)
+-{
+-	if (task->tk_status != -EKEYEXPIRED)
+-		return 0;
+-	task->tk_status = 0;
+-	rpc_restart_call(task);
+-	rpc_delay(task, NFS_JUKEBOX_RETRY_TIME);
+-	return 1;
+-}
+-
+-/*
+  * Bare-bones access to getattr: this is for nfs_read_super.
+  */
+ static int
+@@ -365,8 +332,6 @@ static void nfs_proc_unlink_rpc_prepare(struct rpc_task *task, struct nfs_unlink
+ 
+ static int nfs_proc_unlink_done(struct rpc_task *task, struct inode *dir)
+ {
+-	if (nfs_async_handle_expired_key(task))
+-		return 0;
+ 	nfs_mark_for_revalidate(dir);
+ 	return 1;
+ }
+@@ -386,8 +351,6 @@ static int
+ nfs_proc_rename_done(struct rpc_task *task, struct inode *old_dir,
+ 		     struct inode *new_dir)
+ {
+-	if (nfs_async_handle_expired_key(task))
+-		return 0;
+ 	nfs_mark_for_revalidate(old_dir);
+ 	nfs_mark_for_revalidate(new_dir);
+ 	return 1;
+@@ -641,9 +604,6 @@ nfs_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle,
+ 
+ static int nfs_read_done(struct rpc_task *task, struct nfs_read_data *data)
+ {
+-	if (nfs_async_handle_expired_key(task))
+-		return -EAGAIN;
+-
+ 	nfs_invalidate_atime(data->inode);
+ 	if (task->tk_status >= 0) {
+ 		nfs_refresh_inode(data->inode, data->res.fattr);
+@@ -668,9 +628,6 @@ static void nfs_proc_read_rpc_prepare(struct rpc_task *task, struct nfs_read_dat
+ 
+ static int nfs_write_done(struct rpc_task *task, struct nfs_write_data *data)
+ {
+-	if (nfs_async_handle_expired_key(task))
+-		return -EAGAIN;
+-
+ 	if (task->tk_status >= 0)
+ 		nfs_post_op_update_inode_force_wcc(data->inode, data->res.fattr);
+ 	return 0;
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index f03160106b95..026a873e3f6c 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -297,41 +297,12 @@ commit_metadata(struct svc_fh *fhp)
+ }
+ 
+ /*
+- * Set various file attributes.
+- * N.B. After this call fhp needs an fh_put
++ * Go over the attributes and take care of the small differences between
++ * NFS semantics and what Linux expects.
+  */
+-__be32
+-nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+-	     int check_guard, time_t guardtime)
++static void
++nfsd_sanitize_attrs(struct inode *inode, struct iattr *iap)
+ {
+-	struct dentry	*dentry;
+-	struct inode	*inode;
+-	int		accmode = NFSD_MAY_SATTR;
+-	umode_t		ftype = 0;
+-	__be32		err;
+-	int		host_err;
+-	int		size_change = 0;
+-
+-	if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
+-		accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
+-	if (iap->ia_valid & ATTR_SIZE)
+-		ftype = S_IFREG;
+-
+-	/* Get inode */
+-	err = fh_verify(rqstp, fhp, ftype, accmode);
+-	if (err)
+-		goto out;
+-
+-	dentry = fhp->fh_dentry;
+-	inode = dentry->d_inode;
+-
+-	/* Ignore any mode updates on symlinks */
+-	if (S_ISLNK(inode->i_mode))
+-		iap->ia_valid &= ~ATTR_MODE;
+-
+-	if (!iap->ia_valid)
+-		goto out;
+-
+ 	/*
+ 	 * NFSv2 does not differentiate between "set-[ac]time-to-now"
+ 	 * which only requires access, and "set-[ac]time-to-X" which
+@@ -341,8 +312,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+ 	 * convert to "set to now" instead of "set to explicit time"
+ 	 *
+ 	 * We only call inode_change_ok as the last test as technically
+-	 * it is not an interface that we should be using.  It is only
+-	 * valid if the filesystem does not define it's own i_op->setattr.
++	 * it is not an interface that we should be using.
+ 	 */
+ #define BOTH_TIME_SET (ATTR_ATIME_SET | ATTR_MTIME_SET)
+ #define	MAX_TOUCH_TIME_ERROR (30*60)
+@@ -368,30 +338,6 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+ 			iap->ia_valid &= ~BOTH_TIME_SET;
+ 		}
+ 	}
+-	    
+-	/*
+-	 * The size case is special.
+-	 * It changes the file as well as the attributes.
+-	 */
+-	if (iap->ia_valid & ATTR_SIZE) {
+-		if (iap->ia_size < inode->i_size) {
+-			err = nfsd_permission(rqstp, fhp->fh_export, dentry,
+-					NFSD_MAY_TRUNC|NFSD_MAY_OWNER_OVERRIDE);
+-			if (err)
+-				goto out;
+-		}
+-
+-		host_err = get_write_access(inode);
+-		if (host_err)
+-			goto out_nfserr;
+-
+-		size_change = 1;
+-		host_err = locks_verify_truncate(inode, NULL, iap->ia_size);
+-		if (host_err) {
+-			put_write_access(inode);
+-			goto out_nfserr;
+-		}
+-	}
+ 
+ 	/* sanitize the mode change */
+ 	if (iap->ia_valid & ATTR_MODE) {
+@@ -414,32 +360,111 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+ 			iap->ia_valid |= (ATTR_KILL_SUID | ATTR_KILL_SGID);
+ 		}
+ 	}
++}
+ 
+-	/* Change the attributes. */
++static __be32
++nfsd_get_write_access(struct svc_rqst *rqstp, struct svc_fh *fhp,
++		struct iattr *iap)
++{
++	struct inode *inode = fhp->fh_dentry->d_inode;
++	int host_err;
+ 
+-	iap->ia_valid |= ATTR_CTIME;
++	if (iap->ia_size < inode->i_size) {
++		__be32 err;
+ 
+-	err = nfserr_notsync;
+-	if (!check_guard || guardtime == inode->i_ctime.tv_sec) {
+-		host_err = nfsd_break_lease(inode);
+-		if (host_err)
+-			goto out_nfserr;
+-		fh_lock(fhp);
++		err = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
++				NFSD_MAY_TRUNC | NFSD_MAY_OWNER_OVERRIDE);
++		if (err)
++			return err;
++	}
+ 
+-		host_err = notify_change(dentry, iap);
+-		err = nfserrno(host_err);
+-		fh_unlock(fhp);
++	host_err = get_write_access(inode);
++	if (host_err)
++		goto out_nfserrno;
++
++	host_err = locks_verify_truncate(inode, NULL, iap->ia_size);
++	if (host_err)
++		goto out_put_write_access;
++	return 0;
++
++out_put_write_access:
++	put_write_access(inode);
++out_nfserrno:
++	return nfserrno(host_err);
++}
++
++/*
++ * Set various file attributes.  After this call fhp needs an fh_put.
++ */
++__be32
++nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
++	     int check_guard, time_t guardtime)
++{
++	struct dentry	*dentry;
++	struct inode	*inode;
++	int		accmode = NFSD_MAY_SATTR;
++	umode_t		ftype = 0;
++	__be32		err;
++	int		host_err;
++	int		size_change = 0;
++
++	if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
++		accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
++	if (iap->ia_valid & ATTR_SIZE)
++		ftype = S_IFREG;
++
++	/* Get inode */
++	err = fh_verify(rqstp, fhp, ftype, accmode);
++	if (err)
++		goto out;
++
++	dentry = fhp->fh_dentry;
++	inode = dentry->d_inode;
++
++	/* Ignore any mode updates on symlinks */
++	if (S_ISLNK(inode->i_mode))
++		iap->ia_valid &= ~ATTR_MODE;
++
++	if (!iap->ia_valid)
++		goto out;
++
++	nfsd_sanitize_attrs(inode, iap);
++
++	/*
++	 * The size case is special, it changes the file in addition to the
++	 * attributes.
++	 */
++	if (iap->ia_valid & ATTR_SIZE) {
++		err = nfsd_get_write_access(rqstp, fhp, iap);
++		if (err)
++			goto out;
++		size_change = 1;
+ 	}
++
++	iap->ia_valid |= ATTR_CTIME;
++
++	if (check_guard && guardtime != inode->i_ctime.tv_sec) {
++		err = nfserr_notsync;
++		goto out_put_write_access;
++	}
++
++	host_err = nfsd_break_lease(inode);
++	if (host_err)
++		goto out_put_write_access_nfserror;
++
++	fh_lock(fhp);
++	host_err = notify_change(dentry, iap);
++	fh_unlock(fhp);
++
++out_put_write_access_nfserror:
++	err = nfserrno(host_err);
++out_put_write_access:
+ 	if (size_change)
+ 		put_write_access(inode);
+ 	if (!err)
+ 		commit_metadata(fhp);
+ out:
+ 	return err;
+-
+-out_nfserr:
+-	err = nfserrno(host_err);
+-	goto out;
+ }
+ 
+ #if defined(CONFIG_NFSD_V2_ACL) || \
+diff --git a/fs/proc/inode.c b/fs/proc/inode.c
+index 205c92280838..6c61f119f608 100644
+--- a/fs/proc/inode.c
++++ b/fs/proc/inode.c
+@@ -443,12 +443,10 @@ static const struct file_operations proc_reg_file_ops_no_compat = {
+ 
+ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
+ {
+-	struct inode * inode;
++	struct inode *inode = new_inode_pseudo(sb);
+ 
+-	inode = iget_locked(sb, de->low_ino);
+-	if (!inode)
+-		return NULL;
+-	if (inode->i_state & I_NEW) {
++	if (inode) {
++		inode->i_ino = de->low_ino;
+ 		inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
+ 		PROC_I(inode)->fd = 0;
+ 		PROC_I(inode)->pde = de;
+@@ -477,9 +475,7 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
+ 				inode->i_fop = de->proc_fops;
+ 			}
+ 		}
+-		unlock_new_inode(inode);
+-	} else
+-	       pde_put(de);
++	}
+ 	return inode;
+ }			
+ 
+diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
+index 5bab59b1034e..424b381c96f1 100644
+--- a/include/linux/binfmts.h
++++ b/include/linux/binfmts.h
+@@ -113,9 +113,6 @@ extern void setup_new_exec(struct linux_binprm * bprm);
+ extern void would_dump(struct linux_binprm *, struct file *);
+ 
+ extern int suid_dumpable;
+-#define SUID_DUMP_DISABLE	0	/* No setuid dumping */
+-#define SUID_DUMP_USER		1	/* Dump as user of process */
+-#define SUID_DUMP_ROOT		2	/* Dump as root */
+ 
+ /* Stack area protections */
+ #define EXSTACK_DEFAULT   0	/* Whatever the arch defaults to */
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 25c40b9f848a..210c347425e8 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -915,9 +915,11 @@ static inline loff_t i_size_read(const struct inode *inode)
+ static inline void i_size_write(struct inode *inode, loff_t i_size)
+ {
+ #if BITS_PER_LONG==32 && defined(CONFIG_SMP)
++	preempt_disable();
+ 	write_seqcount_begin(&inode->i_size_seqcount);
+ 	inode->i_size = i_size;
+ 	write_seqcount_end(&inode->i_size_seqcount);
++	preempt_enable();
+ #elif BITS_PER_LONG==32 && defined(CONFIG_PREEMPT)
+ 	preempt_disable();
+ 	inode->i_size = i_size;
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 3dd0efbb70f2..e132a2d24740 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -404,6 +404,10 @@ static inline void arch_pick_mmap_layout(struct mm_struct *mm) {}
+ extern void set_dumpable(struct mm_struct *mm, int value);
+ extern int get_dumpable(struct mm_struct *mm);
+ 
++#define SUID_DUMP_DISABLE	0	/* No setuid dumping */
++#define SUID_DUMP_USER		1	/* Dump as user of process */
++#define SUID_DUMP_ROOT		2	/* Dump as root */
++
+ /* mm flags */
+ /* dumpable bits */
+ #define MMF_DUMPABLE      0  /* core dump is permitted */
+@@ -2466,27 +2470,18 @@ static inline void threadgroup_change_end(struct task_struct *tsk)
+  *
+  * Lock the threadgroup @tsk belongs to.  No new task is allowed to enter
+  * and member tasks aren't allowed to exit (as indicated by PF_EXITING) or
+- * perform exec.  This is useful for cases where the threadgroup needs to
+- * stay stable across blockable operations.
++ * change ->group_leader/pid.  This is useful for cases where the threadgroup
++ * needs to stay stable across blockable operations.
+  *
+  * fork and exit paths explicitly call threadgroup_change_{begin|end}() for
+  * synchronization.  While held, no new task will be added to threadgroup
+  * and no existing live task will have its PF_EXITING set.
+  *
+- * During exec, a task goes and puts its thread group through unusual
+- * changes.  After de-threading, exclusive access is assumed to resources
+- * which are usually shared by tasks in the same group - e.g. sighand may
+- * be replaced with a new one.  Also, the exec'ing task takes over group
+- * leader role including its pid.  Exclude these changes while locked by
+- * grabbing cred_guard_mutex which is used to synchronize exec path.
++ * de_thread() does threadgroup_change_{begin|end}() when a non-leader
++ * sub-thread becomes a new leader.
+  */
+ static inline void threadgroup_lock(struct task_struct *tsk)
+ {
+-	/*
+-	 * exec uses exit for de-threading nesting group_rwsem inside
+-	 * cred_guard_mutex. Grab cred_guard_mutex first.
+-	 */
+-	mutex_lock(&tsk->signal->cred_guard_mutex);
+ 	down_write(&tsk->signal->group_rwsem);
+ }
+ 
+@@ -2499,7 +2494,6 @@ static inline void threadgroup_lock(struct task_struct *tsk)
+ static inline void threadgroup_unlock(struct task_struct *tsk)
+ {
+ 	up_write(&tsk->signal->group_rwsem);
+-	mutex_unlock(&tsk->signal->cred_guard_mutex);
+ }
+ #else
+ static inline void threadgroup_change_begin(struct task_struct *tsk) {}
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index daf4394d1aba..a1432369be50 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -254,7 +254,8 @@ ok:
+ 	smp_rmb();
+ 	if (task->mm)
+ 		dumpable = get_dumpable(task->mm);
+-	if (!dumpable  && !ptrace_has_cap(task_user_ns(task), mode))
++	if (dumpable != SUID_DUMP_USER &&
++	    !ptrace_has_cap(task_user_ns(task), mode))
+ 		return -EPERM;
+ 
+ 	return security_ptrace_access_check(task, mode);
+diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
+index fee3752ae8f6..d01adb77449c 100644
+--- a/kernel/trace/trace_event_perf.c
++++ b/kernel/trace/trace_event_perf.c
+@@ -26,7 +26,7 @@ static int perf_trace_event_perm(struct ftrace_event_call *tp_event,
+ {
+ 	/* The ftrace function trace is allowed only for root. */
+ 	if (ftrace_event_is_function(tp_event) &&
+-	    perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
++	    perf_paranoid_tracepoint_raw() && !capable(CAP_SYS_ADMIN))
+ 		return -EPERM;
+ 
+ 	/* No tracing, just counting, so no obvious leak */
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index a28a2111297e..f21486a2ac48 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1338,6 +1338,7 @@ call_refreshresult(struct rpc_task *task)
+ 		rpc_delay(task, 3*HZ);
+ 	case -EAGAIN:
+ 		status = -EACCES;
++	case -EKEYEXPIRED:
+ 		if (!task->tk_cred_retry)
+ 			break;
+ 		task->tk_cred_retry--;
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 79064471cd01..31f981d700a3 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -390,8 +390,10 @@ static int xs_send_kvec(struct socket *sock, struct sockaddr *addr, int addrlen,
+ 	return kernel_sendmsg(sock, &msg, NULL, 0, 0);
+ }
+ 
+-static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned int base, int more)
++static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned int base, int more, bool zerocopy)
+ {
++	ssize_t (*do_sendpage)(struct socket *sock, struct page *page,
++			int offset, size_t size, int flags);
+ 	struct page **ppage;
+ 	unsigned int remainder;
+ 	int err, sent = 0;
+@@ -400,6 +402,9 @@ static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned i
+ 	base += xdr->page_base;
+ 	ppage = xdr->pages + (base >> PAGE_SHIFT);
+ 	base &= ~PAGE_MASK;
++	do_sendpage = sock->ops->sendpage;
++	if (!zerocopy)
++		do_sendpage = sock_no_sendpage;
+ 	for(;;) {
+ 		unsigned int len = min_t(unsigned int, PAGE_SIZE - base, remainder);
+ 		int flags = XS_SENDMSG_FLAGS;
+@@ -407,7 +412,7 @@ static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned i
+ 		remainder -= len;
+ 		if (remainder != 0 || more)
+ 			flags |= MSG_MORE;
+-		err = sock->ops->sendpage(sock, *ppage, base, len, flags);
++		err = do_sendpage(sock, *ppage, base, len, flags);
+ 		if (remainder == 0 || err != len)
+ 			break;
+ 		sent += err;
+@@ -428,9 +433,10 @@ static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned i
+  * @addrlen: UDP only -- length of destination address
+  * @xdr: buffer containing this request
+  * @base: starting position in the buffer
++ * @zerocopy: true if it is safe to use sendpage()
+  *
+  */
+-static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen, struct xdr_buf *xdr, unsigned int base)
++static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen, struct xdr_buf *xdr, unsigned int base, bool zerocopy)
+ {
+ 	unsigned int remainder = xdr->len - base;
+ 	int err, sent = 0;
+@@ -458,7 +464,7 @@ static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen,
+ 	if (base < xdr->page_len) {
+ 		unsigned int len = xdr->page_len - base;
+ 		remainder -= len;
+-		err = xs_send_pagedata(sock, xdr, base, remainder != 0);
++		err = xs_send_pagedata(sock, xdr, base, remainder != 0, zerocopy);
+ 		if (remainder == 0 || err != len)
+ 			goto out;
+ 		sent += err;
+@@ -561,7 +567,7 @@ static int xs_local_send_request(struct rpc_task *task)
+ 			req->rq_svec->iov_base, req->rq_svec->iov_len);
+ 
+ 	status = xs_sendpages(transport->sock, NULL, 0,
+-						xdr, req->rq_bytes_sent);
++						xdr, req->rq_bytes_sent, true);
+ 	dprintk("RPC:       %s(%u) = %d\n",
+ 			__func__, xdr->len - req->rq_bytes_sent, status);
+ 	if (likely(status >= 0)) {
+@@ -617,7 +623,7 @@ static int xs_udp_send_request(struct rpc_task *task)
+ 	status = xs_sendpages(transport->sock,
+ 			      xs_addr(xprt),
+ 			      xprt->addrlen, xdr,
+-			      req->rq_bytes_sent);
++			      req->rq_bytes_sent, true);
+ 
+ 	dprintk("RPC:       xs_udp_send_request(%u) = %d\n",
+ 			xdr->len - req->rq_bytes_sent, status);
+@@ -688,6 +694,7 @@ static int xs_tcp_send_request(struct rpc_task *task)
+ 	struct rpc_xprt *xprt = req->rq_xprt;
+ 	struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+ 	struct xdr_buf *xdr = &req->rq_snd_buf;
++	bool zerocopy = true;
+ 	int status;
+ 
+ 	xs_encode_stream_record_marker(&req->rq_snd_buf);
+@@ -695,13 +702,20 @@ static int xs_tcp_send_request(struct rpc_task *task)
+ 	xs_pktdump("packet data:",
+ 				req->rq_svec->iov_base,
+ 				req->rq_svec->iov_len);
++	/* Don't use zero copy if this is a resend. If the RPC call
++	 * completes while the socket holds a reference to the pages,
++	 * then we may end up resending corrupted data.
++	 */
++	if (task->tk_flags & RPC_TASK_SENT)
++		zerocopy = false;
+ 
+ 	/* Continue transmitting the packet/record. We must be careful
+ 	 * to cope with writespace callbacks arriving _after_ we have
+ 	 * called sendmsg(). */
+ 	while (1) {
+ 		status = xs_sendpages(transport->sock,
+-					NULL, 0, xdr, req->rq_bytes_sent);
++					NULL, 0, xdr, req->rq_bytes_sent,
++					zerocopy);
+ 
+ 		dprintk("RPC:       xs_tcp_send_request(%u) = %d\n",
+ 				xdr->len - req->rq_bytes_sent, status);
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index d8edff209bf3..d6aab27c8584 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -62,7 +62,6 @@ static struct ima_measure_rule_entry default_rules[] = {
+ 	{.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
+-	{.action = DONT_MEASURE,.fsmagic = RAMFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = DONT_MEASURE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC},
+ 	{.action = MEASURE,.func = FILE_MMAP,.mask = MAY_EXEC,
+diff --git a/sound/isa/msnd/msnd_pinnacle.c b/sound/isa/msnd/msnd_pinnacle.c
+index 29cc8e162b02..a7d6a52a4f81 100644
+--- a/sound/isa/msnd/msnd_pinnacle.c
++++ b/sound/isa/msnd/msnd_pinnacle.c
+@@ -73,9 +73,11 @@
+ #ifdef MSND_CLASSIC
+ #  include "msnd_classic.h"
+ #  define LOGNAME			"msnd_classic"
++#  define DEV_NAME			"msnd-classic"
+ #else
+ #  include "msnd_pinnacle.h"
+ #  define LOGNAME			"snd_msnd_pinnacle"
++#  define DEV_NAME			"msnd-pinnacle"
+ #endif
+ 
+ static void __devinit set_default_audio_parameters(struct snd_msnd *chip)
+@@ -1068,8 +1070,6 @@ static int __devexit snd_msnd_isa_remove(struct device *pdev, unsigned int dev)
+ 	return 0;
+ }
+ 
+-#define DEV_NAME "msnd-pinnacle"
+-
+ static struct isa_driver snd_msnd_driver = {
+ 	.match		= snd_msnd_isa_match,
+ 	.probe		= snd_msnd_isa_probe,
+diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c
+index fc8cc823e438..f8033485db93 100644
+--- a/sound/usb/6fire/chip.c
++++ b/sound/usb/6fire/chip.c
+@@ -101,7 +101,7 @@ static int __devinit usb6fire_chip_probe(struct usb_interface *intf,
+ 			usb_set_intfdata(intf, chips[i]);
+ 			mutex_unlock(&register_mutex);
+ 			return 0;
+-		} else if (regidx < 0)
++		} else if (!devices[i] && regidx < 0)
+ 			regidx = i;
+ 	}
+ 	if (regidx < 0) {