[gentoo-commits] linux-patches r2672 - genpatches-2.6/trunk/3.10

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2014-02-10 14:55:14 +0000 (Mon, 10 Feb 2014)
New Revision: 2672

Added:
   genpatches-2.6/trunk/3.10/1028_linux-3.10.29.patch
Modified:
   genpatches-2.6/trunk/3.10/0000_README
Log:
Linux patch 3.10.29

Modified: genpatches-2.6/trunk/3.10/0000_README
===================================================================
--- genpatches-2.6/trunk/3.10/0000_README	2014-02-09 21:08:39 UTC (rev 2671)
+++ genpatches-2.6/trunk/3.10/0000_README	2014-02-10 14:55:14 UTC (rev 2672)
@@ -154,6 +154,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.10.28
 
+Patch:  1028_linux-3.10.29.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.29
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.10/1028_linux-3.10.29.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1028_linux-3.10.29.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10/1028_linux-3.10.29.patch	2014-02-10 14:55:14 UTC (rev 2672)
@@ -0,0 +1,4044 @@
+diff --git a/Documentation/devicetree/bindings/ata/marvell.txt b/Documentation/devicetree/bindings/ata/marvell.txt
+index b5cdd20cde9c..1c8351604d38 100644
+--- a/Documentation/devicetree/bindings/ata/marvell.txt
++++ b/Documentation/devicetree/bindings/ata/marvell.txt
+@@ -1,7 +1,7 @@
+ * Marvell Orion SATA
+ 
+ Required Properties:
+-- compatibility : "marvell,orion-sata"
++- compatibility : "marvell,orion-sata" or "marvell,armada-370-sata"
+ - reg           : Address range of controller
+ - interrupts    : Interrupt controller is using
+ - nr-ports      : Number of SATA ports in use.
+diff --git a/Makefile b/Makefile
+index addf1b007fe3..db7691ddd67c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 28
++SUBLEVEL = 29
+ EXTRAVERSION =
+ NAME = TOSSUG Baby Fish
+ 
+diff --git a/arch/arm/mach-at91/sam9_smc.c b/arch/arm/mach-at91/sam9_smc.c
+index 99a0a1d2b7dc..b26156bf15db 100644
+--- a/arch/arm/mach-at91/sam9_smc.c
++++ b/arch/arm/mach-at91/sam9_smc.c
+@@ -101,7 +101,7 @@ static void sam9_smc_cs_read(void __iomem *base,
+ 	/* Pulse register */
+ 	val = __raw_readl(base + AT91_SMC_PULSE);
+ 
+-	config->nwe_setup = val & AT91_SMC_NWEPULSE;
++	config->nwe_pulse = val & AT91_SMC_NWEPULSE;
+ 	config->ncs_write_pulse = (val & AT91_SMC_NCS_WRPULSE) >> 8;
+ 	config->nrd_pulse = (val & AT91_SMC_NRDPULSE) >> 16;
+ 	config->ncs_read_pulse = (val & AT91_SMC_NCS_RDPULSE) >> 24;
+diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
+index 1a643ee8e082..6de423dbd385 100644
+--- a/arch/arm/net/bpf_jit_32.c
++++ b/arch/arm/net/bpf_jit_32.c
+@@ -637,10 +637,10 @@ load_ind:
+ 			emit(ARM_MUL(r_A, r_A, r_X), ctx);
+ 			break;
+ 		case BPF_S_ALU_DIV_K:
+-			/* current k == reciprocal_value(userspace k) */
++			if (k == 1)
++				break;
+ 			emit_mov_i(r_scratch, k, ctx);
+-			/* A = top 32 bits of the product */
+-			emit(ARM_UMULL(r_scratch, r_A, r_A, r_scratch), ctx);
++			emit_udiv(r_A, r_A, r_scratch, ctx);
+ 			break;
+ 		case BPF_S_ALU_DIV_X:
+ 			update_on_xread(ctx);
+diff --git a/arch/parisc/include/asm/cacheflush.h b/arch/parisc/include/asm/cacheflush.h
+index 2f9b751878ba..de65f66ea64e 100644
+--- a/arch/parisc/include/asm/cacheflush.h
++++ b/arch/parisc/include/asm/cacheflush.h
+@@ -132,7 +132,6 @@ void mark_rodata_ro(void);
+ static inline void *kmap(struct page *page)
+ {
+ 	might_sleep();
+-	flush_dcache_page(page);
+ 	return page_address(page);
+ }
+ 
+@@ -144,7 +143,6 @@ static inline void kunmap(struct page *page)
+ static inline void *kmap_atomic(struct page *page)
+ {
+ 	pagefault_disable();
+-	flush_dcache_page(page);
+ 	return page_address(page);
+ }
+ 
+diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h
+index c53fc63149e8..637fe031aa84 100644
+--- a/arch/parisc/include/asm/page.h
++++ b/arch/parisc/include/asm/page.h
+@@ -29,7 +29,8 @@ struct page;
+ void clear_page_asm(void *page);
+ void copy_page_asm(void *to, void *from);
+ #define clear_user_page(vto, vaddr, page) clear_page_asm(vto)
+-#define copy_user_page(vto, vfrom, vaddr, page) copy_page_asm(vto, vfrom)
++void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
++			struct page *pg);
+ 
+ /* #define CONFIG_PARISC_TMPALIAS */
+ 
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index a72545554a31..ac87a40502e6 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -388,6 +388,20 @@ void flush_kernel_dcache_page_addr(void *addr)
+ }
+ EXPORT_SYMBOL(flush_kernel_dcache_page_addr);
+ 
++void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
++	struct page *pg)
++{
++       /* Copy using kernel mapping.  No coherency is needed (all in
++	  kunmap) for the `to' page.  However, the `from' page needs to
++	  be flushed through a mapping equivalent to the user mapping
++	  before it can be accessed through the kernel mapping. */
++	preempt_disable();
++	flush_dcache_page_asm(__pa(vfrom), vaddr);
++	preempt_enable();
++	copy_page_asm(vto, vfrom);
++}
++EXPORT_SYMBOL(copy_user_page);
++
+ void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+ {
+ 	unsigned long flags;
+diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
+index 161ab662843b..884b001bafcb 100644
+--- a/arch/powerpc/include/asm/topology.h
++++ b/arch/powerpc/include/asm/topology.h
+@@ -22,7 +22,15 @@ struct device_node;
+ 
+ static inline int cpu_to_node(int cpu)
+ {
+-	return numa_cpu_lookup_table[cpu];
++	int nid;
++
++	nid = numa_cpu_lookup_table[cpu];
++
++	/*
++	 * During early boot, the numa-cpu lookup table might not have been
++	 * setup for all CPUs yet. In such cases, default to node 0.
++	 */
++	return (nid < 0) ? 0 : nid;
+ }
+ 
+ #define parent_node(node)	(node)
+diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
+index 92c6b008dd2b..b4437e8a7a8f 100644
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -788,6 +788,9 @@ static void remove_cache_dir(struct cache_dir *cache_dir)
+ {
+ 	remove_index_dirs(cache_dir);
+ 
++	/* Remove cache dir from sysfs */
++	kobject_del(cache_dir->kobj);
++
+ 	kobject_put(cache_dir->kobj);
+ 
+ 	kfree(cache_dir);
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 550f5928b394..102ad8a255f3 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -82,10 +82,13 @@ void kvmppc_fast_vcpu_kick(struct kvm_vcpu *vcpu)
+ 
+ 	/* CPU points to the first thread of the core */
+ 	if (cpu != me && cpu >= 0 && cpu < nr_cpu_ids) {
++#ifdef CONFIG_KVM_XICS
+ 		int real_cpu = cpu + vcpu->arch.ptid;
+ 		if (paca[real_cpu].kvm_hstate.xics_phys)
+ 			xics_wake_cpu(real_cpu);
+-		else if (cpu_online(cpu))
++		else
++#endif
++		if (cpu_online(cpu))
+ 			smp_send_reschedule(cpu);
+ 	}
+ 	put_cpu();
+@@ -1090,7 +1093,9 @@ static void kvmppc_start_thread(struct kvm_vcpu *vcpu)
+ 	smp_wmb();
+ #if defined(CONFIG_PPC_ICP_NATIVE) && defined(CONFIG_SMP)
+ 	if (vcpu->arch.ptid) {
++#ifdef CONFIG_KVM_XICS
+ 		xics_wake_cpu(cpu);
++#endif
+ 		++vc->n_woken;
+ 	}
+ #endif
+diff --git a/arch/powerpc/kvm/e500_mmu.c b/arch/powerpc/kvm/e500_mmu.c
+index 6d6f153b6c1d..c17600de7d59 100644
+--- a/arch/powerpc/kvm/e500_mmu.c
++++ b/arch/powerpc/kvm/e500_mmu.c
+@@ -127,7 +127,7 @@ static int kvmppc_e500_tlb_index(struct kvmppc_vcpu_e500 *vcpu_e500,
+ }
+ 
+ static inline void kvmppc_e500_deliver_tlb_miss(struct kvm_vcpu *vcpu,
+-		unsigned int eaddr, int as)
++		gva_t eaddr, int as)
+ {
+ 	struct kvmppc_vcpu_e500 *vcpu_e500 = to_e500(vcpu);
+ 	unsigned int victim, tsized;
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index cafad4017765..b7293bba0062 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -31,6 +31,8 @@
+ #include <asm/sparsemem.h>
+ #include <asm/prom.h>
+ #include <asm/smp.h>
++#include <asm/cputhreads.h>
++#include <asm/topology.h>
+ #include <asm/firmware.h>
+ #include <asm/paca.h>
+ #include <asm/hvcall.h>
+@@ -152,9 +154,22 @@ static void __init get_node_active_region(unsigned long pfn,
+ 	}
+ }
+ 
+-static void map_cpu_to_node(int cpu, int node)
++static void reset_numa_cpu_lookup_table(void)
++{
++	unsigned int cpu;
++
++	for_each_possible_cpu(cpu)
++		numa_cpu_lookup_table[cpu] = -1;
++}
++
++static void update_numa_cpu_lookup_table(unsigned int cpu, int node)
+ {
+ 	numa_cpu_lookup_table[cpu] = node;
++}
++
++static void map_cpu_to_node(int cpu, int node)
++{
++	update_numa_cpu_lookup_table(cpu, node);
+ 
+ 	dbg("adding cpu %d to node %d\n", cpu, node);
+ 
+@@ -519,11 +534,24 @@ static int of_drconf_to_nid_single(struct of_drconf_cell *drmem,
+  */
+ static int __cpuinit numa_setup_cpu(unsigned long lcpu)
+ {
+-	int nid = 0;
+-	struct device_node *cpu = of_get_cpu_node(lcpu, NULL);
++	int nid;
++	struct device_node *cpu;
++
++	/*
++	 * If a valid cpu-to-node mapping is already available, use it
++	 * directly instead of querying the firmware, since it represents
++	 * the most recent mapping notified to us by the platform (eg: VPHN).
++	 */
++	if ((nid = numa_cpu_lookup_table[lcpu]) >= 0) {
++		map_cpu_to_node(lcpu, nid);
++		return nid;
++	}
++
++	cpu = of_get_cpu_node(lcpu, NULL);
+ 
+ 	if (!cpu) {
+ 		WARN_ON(1);
++		nid = 0;
+ 		goto out;
+ 	}
+ 
+@@ -1066,6 +1094,7 @@ void __init do_init_bootmem(void)
+ 	 */
+ 	setup_node_to_cpumask_map();
+ 
++	reset_numa_cpu_lookup_table();
+ 	register_cpu_notifier(&ppc64_numa_nb);
+ 	cpu_numa_callback(&ppc64_numa_nb, CPU_UP_PREPARE,
+ 			  (void *)(unsigned long)boot_cpuid);
+@@ -1443,6 +1472,33 @@ static int update_cpu_topology(void *data)
+ 	return 0;
+ }
+ 
++static int update_lookup_table(void *data)
++{
++	struct topology_update_data *update;
++
++	if (!data)
++		return -EINVAL;
++
++	/*
++	 * Upon topology update, the numa-cpu lookup table needs to be updated
++	 * for all threads in the core, including offline CPUs, to ensure that
++	 * future hotplug operations respect the cpu-to-node associativity
++	 * properly.
++	 */
++	for (update = data; update; update = update->next) {
++		int nid, base, j;
++
++		nid = update->new_nid;
++		base = cpu_first_thread_sibling(update->cpu);
++
++		for (j = 0; j < threads_per_core; j++) {
++			update_numa_cpu_lookup_table(base + j, nid);
++		}
++	}
++
++	return 0;
++}
++
+ /*
+  * Update the node maps and sysfs entries for each cpu whose home node
+  * has changed. Returns 1 when the topology has changed, and 0 otherwise.
+@@ -1511,6 +1567,14 @@ int arch_update_cpu_topology(void)
+ 
+ 	stop_machine(update_cpu_topology, &updates[0], &updated_cpus);
+ 
++	/*
++	 * Update the numa-cpu lookup table with the new mappings, even for
++	 * offline CPUs. It is best to perform this update from the stop-
++	 * machine context.
++	 */
++	stop_machine(update_lookup_table, &updates[0],
++					cpumask_of(raw_smp_processor_id()));
++
+ 	for (ud = &updates[0]; ud; ud = ud->next) {
+ 		unregister_cpu_under_node(ud->cpu, ud->old_nid);
+ 		register_cpu_under_node(ud->cpu, ud->new_nid);
+diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
+index c427ae36374a..a012a9747cdd 100644
+--- a/arch/powerpc/net/bpf_jit_comp.c
++++ b/arch/powerpc/net/bpf_jit_comp.c
+@@ -209,10 +209,11 @@ static int bpf_jit_build_body(struct sk_filter *fp, u32 *image,
+ 			}
+ 			PPC_DIVWU(r_A, r_A, r_X);
+ 			break;
+-		case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K); */
++		case BPF_S_ALU_DIV_K: /* A /= K */
++			if (K == 1)
++				break;
+ 			PPC_LI32(r_scratch1, K);
+-			/* Top 32 bits of 64bit result -> A */
+-			PPC_MULHWU(r_A, r_A, r_scratch1);
++			PPC_DIVWU(r_A, r_A, r_scratch1);
+ 			break;
+ 		case BPF_S_ALU_AND_X:
+ 			ctx->seen |= SEEN_XREG;
+diff --git a/arch/s390/include/uapi/asm/statfs.h b/arch/s390/include/uapi/asm/statfs.h
+index a61d538756f2..471eb09184d4 100644
+--- a/arch/s390/include/uapi/asm/statfs.h
++++ b/arch/s390/include/uapi/asm/statfs.h
+@@ -35,11 +35,11 @@ struct statfs {
+ struct statfs64 {
+ 	unsigned int	f_type;
+ 	unsigned int	f_bsize;
+-	unsigned long	f_blocks;
+-	unsigned long	f_bfree;
+-	unsigned long	f_bavail;
+-	unsigned long	f_files;
+-	unsigned long	f_ffree;
++	unsigned long long f_blocks;
++	unsigned long long f_bfree;
++	unsigned long long f_bavail;
++	unsigned long long f_files;
++	unsigned long long f_ffree;
+ 	__kernel_fsid_t f_fsid;
+ 	unsigned int	f_namelen;
+ 	unsigned int	f_frsize;
+diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c
+index 1c01a9912989..6acb24d606fd 100644
+--- a/arch/s390/kvm/diag.c
++++ b/arch/s390/kvm/diag.c
+@@ -130,7 +130,7 @@ static int __diag_virtio_hypercall(struct kvm_vcpu *vcpu)
+ 
+ int kvm_s390_handle_diag(struct kvm_vcpu *vcpu)
+ {
+-	int code = (vcpu->arch.sie_block->ipb & 0xfff0000) >> 16;
++	int code = kvm_s390_get_base_disp_rs(vcpu) & 0xffff;
+ 
+ 	trace_kvm_s390_handle_diag(vcpu, code);
+ 	switch (code) {
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index 82f165f8078c..1919db6c0607 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -335,14 +335,16 @@ static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter,
+ 		EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
+ 		/* lhi %r4,0 */
+ 		EMIT4(0xa7480000);
+-		/* dr %r4,%r12 */
+-		EMIT2(0x1d4c);
++		/* dlr %r4,%r12 */
++		EMIT4(0xb997004c);
+ 		break;
+-	case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K) */
+-		/* m %r4,<d(K)>(%r13) */
+-		EMIT4_DISP(0x5c40d000, EMIT_CONST(K));
+-		/* lr %r5,%r4 */
+-		EMIT2(0x1854);
++	case BPF_S_ALU_DIV_K: /* A /= K */
++		if (K == 1)
++			break;
++		/* lhi %r4,0 */
++		EMIT4(0xa7480000);
++		/* dl %r4,<d(K)>(%r13) */
++		EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K));
+ 		break;
+ 	case BPF_S_ALU_MOD_X: /* A %= X */
+ 		jit->seen |= SEEN_XREG | SEEN_RET0;
+@@ -352,16 +354,21 @@ static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter,
+ 		EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
+ 		/* lhi %r4,0 */
+ 		EMIT4(0xa7480000);
+-		/* dr %r4,%r12 */
+-		EMIT2(0x1d4c);
++		/* dlr %r4,%r12 */
++		EMIT4(0xb997004c);
+ 		/* lr %r5,%r4 */
+ 		EMIT2(0x1854);
+ 		break;
+ 	case BPF_S_ALU_MOD_K: /* A %= K */
++		if (K == 1) {
++			/* lhi %r5,0 */
++			EMIT4(0xa7580000);
++			break;
++		}
+ 		/* lhi %r4,0 */
+ 		EMIT4(0xa7480000);
+-		/* d %r4,<d(K)>(%r13) */
+-		EMIT4_DISP(0x5d40d000, EMIT_CONST(K));
++		/* dl %r4,<d(K)>(%r13) */
++		EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K));
+ 		/* lr %r5,%r4 */
+ 		EMIT2(0x1854);
+ 		break;
+diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
+index d36a85ebb5e0..fd95862c65aa 100644
+--- a/arch/sparc/net/bpf_jit_comp.c
++++ b/arch/sparc/net/bpf_jit_comp.c
+@@ -497,9 +497,20 @@ void bpf_jit_compile(struct sk_filter *fp)
+ 			case BPF_S_ALU_MUL_K:	/* A *= K */
+ 				emit_alu_K(MUL, K);
+ 				break;
+-			case BPF_S_ALU_DIV_K:	/* A /= K */
+-				emit_alu_K(MUL, K);
+-				emit_read_y(r_A);
++			case BPF_S_ALU_DIV_K:	/* A /= K with K != 0*/
++				if (K == 1)
++					break;
++				emit_write_y(G0);
++#ifdef CONFIG_SPARC32
++				/* The Sparc v8 architecture requires
++				 * three instructions between a %y
++				 * register write and the first use.
++				 */
++				emit_nop();
++				emit_nop();
++				emit_nop();
++#endif
++				emit_alu_K(DIV, K);
+ 				break;
+ 			case BPF_S_ALU_DIV_X:	/* A /= X; */
+ 				emit_cmpi(r_X, 0);
+diff --git a/arch/x86/include/uapi/asm/msr-index.h b/arch/x86/include/uapi/asm/msr-index.h
+index 2af848dfa754..d3fd447ecbee 100644
+--- a/arch/x86/include/uapi/asm/msr-index.h
++++ b/arch/x86/include/uapi/asm/msr-index.h
+@@ -179,6 +179,7 @@
+ #define MSR_AMD64_PATCH_LOADER		0xc0010020
+ #define MSR_AMD64_OSVW_ID_LENGTH	0xc0010140
+ #define MSR_AMD64_OSVW_STATUS		0xc0010141
++#define MSR_AMD64_LS_CFG		0xc0011020
+ #define MSR_AMD64_DC_CFG		0xc0011022
+ #define MSR_AMD64_BU_CFG2		0xc001102a
+ #define MSR_AMD64_IBSFETCHCTL		0xc0011030
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 5013a48d1aff..ae177a014180 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -508,6 +508,16 @@ static void __cpuinit early_init_amd(struct cpuinfo_x86 *c)
+ 			set_cpu_cap(c, X86_FEATURE_EXTD_APICID);
+ 	}
+ #endif
++
++	/* F16h erratum 793, CVE-2013-6885 */
++	if (c->x86 == 0x16 && c->x86_model <= 0xf) {
++		u64 val;
++
++		rdmsrl(MSR_AMD64_LS_CFG, val);
++		if (!(val & BIT(15)))
++			wrmsrl(MSR_AMD64_LS_CFG, val | BIT(15));
++	}
++
+ }
+ 
+ static const int amd_erratum_383[];
+diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
+index 412a5aa0ef94..518d86471b76 100644
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -37,6 +37,7 @@
+ 
+ #include "irq.h"
+ #include "i8254.h"
++#include "x86.h"
+ 
+ #ifndef CONFIG_X86_64
+ #define mod_64(x, y) ((x) - (y) * div64_u64(x, y))
+@@ -349,6 +350,23 @@ static void create_pit_timer(struct kvm *kvm, u32 val, int is_period)
+ 	atomic_set(&ps->pending, 0);
+ 	ps->irq_ack = 1;
+ 
++	/*
++	 * Do not allow the guest to program periodic timers with small
++	 * interval, since the hrtimers are not throttled by the host
++	 * scheduler.
++	 */
++	if (ps->is_periodic) {
++		s64 min_period = min_timer_period_us * 1000LL;
++
++		if (ps->period < min_period) {
++			pr_info_ratelimited(
++			    "kvm: requested %lld ns "
++			    "i8254 timer period limited to %lld ns\n",
++			    ps->period, min_period);
++			ps->period = min_period;
++		}
++	}
++
+ 	hrtimer_start(&ps->timer, ktime_add_ns(ktime_get(), interval),
+ 		      HRTIMER_MODE_ABS);
+ }
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index d0a97e808828..61d9fed5eb31 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -71,9 +71,6 @@
+ #define VEC_POS(v) ((v) & (32 - 1))
+ #define REG_POS(v) (((v) >> 5) << 4)
+ 
+-static unsigned int min_timer_period_us = 500;
+-module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR);
+-
+ static inline void apic_set_reg(struct kvm_lapic *apic, int reg_off, u32 val)
+ {
+ 	*((u32 *) (apic->regs + reg_off)) = val;
+@@ -1369,7 +1366,7 @@ void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value)
+ 	vcpu->arch.apic_base = value;
+ 
+ 	/* update jump label if enable bit changes */
+-	if ((vcpu->arch.apic_base ^ value) & MSR_IA32_APICBASE_ENABLE) {
++	if ((old_value ^ value) & MSR_IA32_APICBASE_ENABLE) {
+ 		if (value & MSR_IA32_APICBASE_ENABLE)
+ 			static_key_slow_dec_deferred(&apic_hw_disabled);
+ 		else
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index ad6a01605aaa..1bd6ea07d7d3 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -94,6 +94,9 @@ EXPORT_SYMBOL_GPL(kvm_x86_ops);
+ static bool ignore_msrs = 0;
+ module_param(ignore_msrs, bool, S_IRUGO | S_IWUSR);
+ 
++unsigned int min_timer_period_us = 500;
++module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR);
++
+ bool kvm_has_tsc_control;
+ EXPORT_SYMBOL_GPL(kvm_has_tsc_control);
+ u32  kvm_max_guest_tsc_khz;
+diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
+index e224f7a671b6..3186542f2fa3 100644
+--- a/arch/x86/kvm/x86.h
++++ b/arch/x86/kvm/x86.h
+@@ -124,5 +124,7 @@ int kvm_write_guest_virt_system(struct x86_emulate_ctxt *ctxt,
+ 
+ extern u64 host_xcr0;
+ 
++extern unsigned int min_timer_period_us;
++
+ extern struct static_key kvm_no_apic_vcpu;
+ #endif
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index f66b54086ce5..0c966fecfb8c 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -324,15 +324,21 @@ void bpf_jit_compile(struct sk_filter *fp)
+ 				EMIT2(0x89, 0xd0);	/* mov %edx,%eax */
+ 				break;
+ 			case BPF_S_ALU_MOD_K: /* A %= K; */
++				if (K == 1) {
++					CLEAR_A();
++					break;
++				}
+ 				EMIT2(0x31, 0xd2);	/* xor %edx,%edx */
+ 				EMIT1(0xb9);EMIT(K, 4);	/* mov imm32,%ecx */
+ 				EMIT2(0xf7, 0xf1);	/* div %ecx */
+ 				EMIT2(0x89, 0xd0);	/* mov %edx,%eax */
+ 				break;
+-			case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K); */
+-				EMIT3(0x48, 0x69, 0xc0); /* imul imm32,%rax,%rax */
+-				EMIT(K, 4);
+-				EMIT4(0x48, 0xc1, 0xe8, 0x20); /* shr $0x20,%rax */
++			case BPF_S_ALU_DIV_K: /* A /= K */
++				if (K == 1)
++					break;
++				EMIT2(0x31, 0xd2);	/* xor %edx,%edx */
++				EMIT1(0xb9);EMIT(K, 4);	/* mov imm32,%ecx */
++				EMIT2(0xf7, 0xf1);	/* div %ecx */
+ 				break;
+ 			case BPF_S_ALU_AND_X:
+ 				seen |= SEEN_XREG;
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 3474a2ccd8b1..6033be9ff81a 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -438,7 +438,7 @@ void __init efi_reserve_boot_services(void)
+ 		 * - Not within any part of the kernel
+ 		 * - Not the bios reserved area
+ 		*/
+-		if ((start+size >= __pa_symbol(_text)
++		if ((start + size > __pa_symbol(_text)
+ 				&& start <= __pa_symbol(_end)) ||
+ 			!e820_all_mapped(start, start+size, E820_RAM) ||
+ 			memblock_is_region_reserved(start, size)) {
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 8cacd1693f03..15518fda2d2a 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2199,6 +2199,16 @@ int ata_dev_configure(struct ata_device *dev)
+ 	if (rc)
+ 		return rc;
+ 
++	/* some WD SATA-1 drives have issues with LPM, turn on NOLPM for them */
++	if ((dev->horkage & ATA_HORKAGE_WD_BROKEN_LPM) &&
++	    (id[ATA_ID_SATA_CAPABILITY] & 0xe) == 0x2)
++		dev->horkage |= ATA_HORKAGE_NOLPM;
++
++	if (dev->horkage & ATA_HORKAGE_NOLPM) {
++		ata_dev_warn(dev, "LPM support broken, forcing max_power\n");
++		dev->link->ap->target_lpm_policy = ATA_LPM_MAX_POWER;
++	}
++
+ 	/* let ACPI work its magic */
+ 	rc = ata_acpi_on_devcfg(dev);
+ 	if (rc)
+@@ -4189,6 +4199,23 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ 	{ "PIONEER DVD-RW  DVR-212D",	NULL,	ATA_HORKAGE_NOSETXFER },
+ 	{ "PIONEER DVD-RW  DVR-216D",	NULL,	ATA_HORKAGE_NOSETXFER },
+ 
++	/*
++	 * Some WD SATA-I drives spin up and down erratically when the link
++	 * is put into the slumber mode.  We don't have full list of the
++	 * affected devices.  Disable LPM if the device matches one of the
++	 * known prefixes and is SATA-1.  As a side effect LPM partial is
++	 * lost too.
++	 *
++	 * https://bugzilla.kernel.org/show_bug.cgi?id=57211
++	 */
++	{ "WDC WD800JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD1200JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD1600JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD2000JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD2500JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD3000JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD3200JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++
+ 	/* End Marker */
+ 	{ }
+ };
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 81a353590b8a..9933b4db7caf 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -112,12 +112,14 @@ static const char *ata_lpm_policy_names[] = {
+ 	[ATA_LPM_MIN_POWER]	= "min_power",
+ };
+ 
+-static ssize_t ata_scsi_lpm_store(struct device *dev,
++static ssize_t ata_scsi_lpm_store(struct device *device,
+ 				  struct device_attribute *attr,
+ 				  const char *buf, size_t count)
+ {
+-	struct Scsi_Host *shost = class_to_shost(dev);
++	struct Scsi_Host *shost = class_to_shost(device);
+ 	struct ata_port *ap = ata_shost_to_port(shost);
++	struct ata_link *link;
++	struct ata_device *dev;
+ 	enum ata_lpm_policy policy;
+ 	unsigned long flags;
+ 
+@@ -133,10 +135,20 @@ static ssize_t ata_scsi_lpm_store(struct device *dev,
+ 		return -EINVAL;
+ 
+ 	spin_lock_irqsave(ap->lock, flags);
++
++	ata_for_each_link(link, ap, EDGE) {
++		ata_for_each_dev(dev, &ap->link, ENABLED) {
++			if (dev->horkage & ATA_HORKAGE_NOLPM) {
++				count = -EOPNOTSUPP;
++				goto out_unlock;
++			}
++		}
++	}
++
+ 	ap->target_lpm_policy = policy;
+ 	ata_port_schedule_eh(ap);
++out_unlock:
+ 	spin_unlock_irqrestore(ap->lock, flags);
+-
+ 	return count;
+ }
+ 
+diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
+index 35c6b6d09c27..b256ff5b6579 100644
+--- a/drivers/ata/sata_mv.c
++++ b/drivers/ata/sata_mv.c
+@@ -304,6 +304,7 @@ enum {
+ 	MV5_LTMODE		= 0x30,
+ 	MV5_PHY_CTL		= 0x0C,
+ 	SATA_IFCFG		= 0x050,
++	LP_PHY_CTL		= 0x058,
+ 
+ 	MV_M2_PREAMP_MASK	= 0x7e0,
+ 
+@@ -431,6 +432,7 @@ enum {
+ 	MV_HP_CUT_THROUGH	= (1 << 10),	/* can use EDMA cut-through */
+ 	MV_HP_FLAG_SOC		= (1 << 11),	/* SystemOnChip, no PCI */
+ 	MV_HP_QUIRK_LED_BLINK_EN = (1 << 12),	/* is led blinking enabled? */
++	MV_HP_FIX_LP_PHY_CTL	= (1 << 13),	/* fix speed in LP_PHY_CTL ? */
+ 
+ 	/* Port private flags (pp_flags) */
+ 	MV_PP_FLAG_EDMA_EN	= (1 << 0),	/* is EDMA engine enabled? */
+@@ -1353,6 +1355,7 @@ static int mv_scr_write(struct ata_link *link, unsigned int sc_reg_in, u32 val)
+ 
+ 	if (ofs != 0xffffffffU) {
+ 		void __iomem *addr = mv_ap_base(link->ap) + ofs;
++		struct mv_host_priv *hpriv = link->ap->host->private_data;
+ 		if (sc_reg_in == SCR_CONTROL) {
+ 			/*
+ 			 * Workaround for 88SX60x1 FEr SATA#26:
+@@ -1369,6 +1372,18 @@ static int mv_scr_write(struct ata_link *link, unsigned int sc_reg_in, u32 val)
+ 			 */
+ 			if ((val & 0xf) == 1 || (readl(addr) & 0xf) == 1)
+ 				val |= 0xf000;
++
++			if (hpriv->hp_flags & MV_HP_FIX_LP_PHY_CTL) {
++				void __iomem *lp_phy_addr =
++					mv_ap_base(link->ap) + LP_PHY_CTL;
++				/*
++				 * Set PHY speed according to SControl speed.
++				 */
++				if ((val & 0xf0) == 0x10)
++					writelfl(0x7, lp_phy_addr);
++				else
++					writelfl(0x227, lp_phy_addr);
++			}
+ 		}
+ 		writelfl(val, addr);
+ 		return 0;
+@@ -4111,6 +4126,15 @@ static int mv_platform_probe(struct platform_device *pdev)
+ 	if (rc)
+ 		goto err;
+ 
++	/*
++	 * To allow disk hotplug on Armada 370/XP SoCs, the PHY speed must be
++	 * updated in the LP_PHY_CTL register.
++	 */
++	if (pdev->dev.of_node &&
++		of_device_is_compatible(pdev->dev.of_node,
++					"marvell,armada-370-sata"))
++		hpriv->hp_flags |= MV_HP_FIX_LP_PHY_CTL;
++
+ 	/* initialize adapter */
+ 	rc = mv_init_host(host);
+ 	if (rc)
+@@ -4216,6 +4240,7 @@ static int mv_platform_resume(struct platform_device *pdev)
+ 
+ #ifdef CONFIG_OF
+ static struct of_device_id mv_sata_dt_ids[] = {
++	{ .compatible = "marvell,armada-370-sata", },
+ 	{ .compatible = "marvell,orion-sata", },
+ 	{},
+ };
+diff --git a/drivers/char/tpm/tpm_i2c_stm_st33.c b/drivers/char/tpm/tpm_i2c_stm_st33.c
+index 5bb8e2ddd3b3..156bd3c72770 100644
+--- a/drivers/char/tpm/tpm_i2c_stm_st33.c
++++ b/drivers/char/tpm/tpm_i2c_stm_st33.c
+@@ -410,6 +410,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
+ 			     &chip->vendor.read_queue)
+ 	       == 0) {
+ 		burstcnt = get_burstcount(chip);
++		if (burstcnt < 0)
++			return burstcnt;
+ 		len = min_t(int, burstcnt, count - size);
+ 		I2C_READ_DATA(client, TPM_DATA_FIFO, buf + size, len);
+ 		size += len;
+@@ -451,7 +453,8 @@ static irqreturn_t tpm_ioserirq_handler(int irq, void *dev_id)
+ static int tpm_stm_i2c_send(struct tpm_chip *chip, unsigned char *buf,
+ 			    size_t len)
+ {
+-	u32 status, burstcnt = 0, i, size;
++	u32 status, i, size;
++	int burstcnt = 0;
+ 	int ret;
+ 	u8 data;
+ 	struct i2c_client *client;
+@@ -482,6 +485,8 @@ static int tpm_stm_i2c_send(struct tpm_chip *chip, unsigned char *buf,
+ 
+ 	for (i = 0; i < len - 1;) {
+ 		burstcnt = get_burstcount(chip);
++		if (burstcnt < 0)
++			return burstcnt;
+ 		size = min_t(int, len - i - 1, burstcnt);
+ 		ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf, size);
+ 		if (ret < 0)
+diff --git a/drivers/char/tpm/tpm_ppi.c b/drivers/char/tpm/tpm_ppi.c
+index 57a818b2b5f2..811ad1e4d802 100644
+--- a/drivers/char/tpm/tpm_ppi.c
++++ b/drivers/char/tpm/tpm_ppi.c
+@@ -172,7 +172,7 @@ static ssize_t tpm_store_ppi_request(struct device *dev,
+ 	 * is updated with function index from SUBREQ to SUBREQ2 since PPI
+ 	 * version 1.1
+ 	 */
+-	if (strcmp(version, "1.1") == -1)
++	if (strcmp(version, "1.1") < 0)
+ 		params[2].integer.value = TPM_PPI_FN_SUBREQ;
+ 	else
+ 		params[2].integer.value = TPM_PPI_FN_SUBREQ2;
+@@ -182,7 +182,7 @@ static ssize_t tpm_store_ppi_request(struct device *dev,
+ 	 * string/package type. For PPI version 1.0 and 1.1, use buffer type
+ 	 * for compatibility, and use package type since 1.2 according to spec.
+ 	 */
+-	if (strcmp(version, "1.2") == -1) {
++	if (strcmp(version, "1.2") < 0) {
+ 		params[3].type = ACPI_TYPE_BUFFER;
+ 		params[3].buffer.length = sizeof(req);
+ 		sscanf(buf, "%d", &req);
+@@ -248,7 +248,7 @@ static ssize_t tpm_show_ppi_transition_action(struct device *dev,
+ 	 * (e.g. Capella with PPI 1.0) need integer/string/buffer type, so for
+ 	 * compatibility, define params[3].type as buffer, if PPI version < 1.2
+ 	 */
+-	if (strcmp(version, "1.2") == -1) {
++	if (strcmp(version, "1.2") < 0) {
+ 		params[3].type = ACPI_TYPE_BUFFER;
+ 		params[3].buffer.length =  0;
+ 		params[3].buffer.pointer = NULL;
+@@ -390,7 +390,7 @@ static ssize_t show_ppi_operations(char *buf, u32 start, u32 end)
+ 	kfree(output.pointer);
+ 	output.length = ACPI_ALLOCATE_BUFFER;
+ 	output.pointer = NULL;
+-	if (strcmp(version, "1.2") == -1)
++	if (strcmp(version, "1.2") < 0)
+ 		return -EPERM;
+ 
+ 	params[2].integer.value = TPM_PPI_FN_GETOPR;
+diff --git a/drivers/edac/e752x_edac.c b/drivers/edac/e752x_edac.c
+index 644fec54681f..f1e9d7bd131f 100644
+--- a/drivers/edac/e752x_edac.c
++++ b/drivers/edac/e752x_edac.c
+@@ -1182,9 +1182,11 @@ static int e752x_get_devs(struct pci_dev *pdev, int dev_idx,
+ 	pvt->bridge_ck = pci_get_device(PCI_VENDOR_ID_INTEL,
+ 				pvt->dev_info->err_dev, pvt->bridge_ck);
+ 
+-	if (pvt->bridge_ck == NULL)
++	if (pvt->bridge_ck == NULL) {
+ 		pvt->bridge_ck = pci_scan_single_device(pdev->bus,
+ 							PCI_DEVFN(0, 1));
++		pci_dev_get(pvt->bridge_ck);
++	}
+ 
+ 	if (pvt->bridge_ck == NULL) {
+ 		e752x_printk(KERN_ERR, "error reporting device not found:"
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
+index 3044b07230db..c7bf974ed4a6 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
+@@ -366,13 +366,13 @@ static u16
+ init_script(struct nouveau_bios *bios, int index)
+ {
+ 	struct nvbios_init init = { .bios = bios };
+-	u16 data;
++	u16 bmp_ver = bmp_version(bios), data;
+ 
+-	if (bmp_version(bios) && bmp_version(bios) < 0x0510) {
+-		if (index > 1)
++	if (bmp_ver && bmp_ver < 0x0510) {
++		if (index > 1 || bmp_ver < 0x0100)
+ 			return 0x0000;
+ 
+-		data = bios->bmp_offset + (bios->version.major < 2 ? 14 : 18);
++		data = bios->bmp_offset + (bmp_ver < 0x0200 ? 14 : 18);
+ 		return nv_ro16(bios, data + (index * 2));
+ 	}
+ 
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index e633856370cf..9bcf175c4921 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -211,6 +211,7 @@ static DEFINE_PCI_DEVICE_TABLE(k10temp_id_table) = {
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ 	{}
+ };
+diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
+index 14032e8c7731..1b27cbd822e1 100644
+--- a/drivers/md/bcache/bset.c
++++ b/drivers/md/bcache/bset.c
+@@ -927,7 +927,7 @@ static void sort_key_next(struct btree_iter *iter,
+ 		*i = iter->data[--iter->used];
+ }
+ 
+-static void btree_sort_fixup(struct btree_iter *iter)
++static struct bkey *btree_sort_fixup(struct btree_iter *iter, struct bkey *tmp)
+ {
+ 	while (iter->used > 1) {
+ 		struct btree_iter_set *top = iter->data, *i = top + 1;
+@@ -955,9 +955,22 @@ static void btree_sort_fixup(struct btree_iter *iter)
+ 		} else {
+ 			/* can't happen because of comparison func */
+ 			BUG_ON(!bkey_cmp(&START_KEY(top->k), &START_KEY(i->k)));
+-			bch_cut_back(&START_KEY(i->k), top->k);
++
++			if (bkey_cmp(i->k, top->k) < 0) {
++				bkey_copy(tmp, top->k);
++
++				bch_cut_back(&START_KEY(i->k), tmp);
++				bch_cut_front(i->k, top->k);
++				heap_sift(iter, 0, btree_iter_cmp);
++
++				return tmp;
++			} else {
++				bch_cut_back(&START_KEY(i->k), top->k);
++			}
+ 		}
+ 	}
++
++	return NULL;
+ }
+ 
+ static void btree_mergesort(struct btree *b, struct bset *out,
+@@ -965,15 +978,20 @@ static void btree_mergesort(struct btree *b, struct bset *out,
+ 			    bool fixup, bool remove_stale)
+ {
+ 	struct bkey *k, *last = NULL;
++	BKEY_PADDED(k) tmp;
+ 	bool (*bad)(struct btree *, const struct bkey *) = remove_stale
+ 		? bch_ptr_bad
+ 		: bch_ptr_invalid;
+ 
+ 	while (!btree_iter_end(iter)) {
+ 		if (fixup && !b->level)
+-			btree_sort_fixup(iter);
++			k = btree_sort_fixup(iter, &tmp.k);
++		else
++			k = NULL;
++
++		if (!k)
++			k = bch_btree_iter_next(iter);
+ 
+-		k = bch_btree_iter_next(iter);
+ 		if (bad(b, k))
+ 			continue;
+ 
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 51422999fd08..740e3f42bef8 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -1893,6 +1893,7 @@ static void raid5_end_write_request(struct bio *bi, int error)
+ 			set_bit(R5_MadeGoodRepl, &sh->dev[i].flags);
+ 	} else {
+ 		if (!uptodate) {
++			set_bit(STRIPE_DEGRADED, &sh->state);
+ 			set_bit(WriteErrorSeen, &rdev->flags);
+ 			set_bit(R5_WriteError, &sh->dev[i].flags);
+ 			if (!test_and_set_bit(WantReplacement, &rdev->flags))
+diff --git a/drivers/mfd/max77686.c b/drivers/mfd/max77686.c
+index 1cbb17609c8b..8290c2382395 100644
+--- a/drivers/mfd/max77686.c
++++ b/drivers/mfd/max77686.c
+@@ -102,7 +102,7 @@ static int max77686_i2c_probe(struct i2c_client *i2c,
+ 	max77686->irq_gpio = pdata->irq_gpio;
+ 	max77686->irq = i2c->irq;
+ 
+-	max77686->regmap = regmap_init_i2c(i2c, &max77686_regmap_config);
++	max77686->regmap = devm_regmap_init_i2c(i2c, &max77686_regmap_config);
+ 	if (IS_ERR(max77686->regmap)) {
+ 		ret = PTR_ERR(max77686->regmap);
+ 		dev_err(max77686->dev, "Failed to allocate register map: %d\n",
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index 8c4babc0efbd..70be100feeb4 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -153,6 +153,7 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
+ 	struct sk_buff *skb = tx_buf->skb;
+ 	u16 bd_idx = TX_BD(tx_buf->first_bd), new_cons;
+ 	int nbd;
++	u16 split_bd_len = 0;
+ 
+ 	/* prefetch skb end pointer to speedup dev_kfree_skb() */
+ 	prefetch(&skb->end);
+@@ -160,10 +161,7 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
+ 	DP(NETIF_MSG_TX_DONE, "fp[%d]: pkt_idx %d  buff @(%p)->skb %p\n",
+ 	   txdata->txq_index, idx, tx_buf, skb);
+ 
+-	/* unmap first bd */
+ 	tx_start_bd = &txdata->tx_desc_ring[bd_idx].start_bd;
+-	dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
+-			 BD_UNMAP_LEN(tx_start_bd), DMA_TO_DEVICE);
+ 
+ 
+ 	nbd = le16_to_cpu(tx_start_bd->nbd) - 1;
+@@ -182,12 +180,19 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
+ 	--nbd;
+ 	bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
+ 
+-	/* ...and the TSO split header bd since they have no mapping */
++	/* TSO headers+data bds share a common mapping. See bnx2x_tx_split() */
+ 	if (tx_buf->flags & BNX2X_TSO_SPLIT_BD) {
++		tx_data_bd = &txdata->tx_desc_ring[bd_idx].reg_bd;
++		split_bd_len = BD_UNMAP_LEN(tx_data_bd);
+ 		--nbd;
+ 		bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
+ 	}
+ 
++	/* unmap first bd */
++	dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
++			 BD_UNMAP_LEN(tx_start_bd) + split_bd_len,
++			 DMA_TO_DEVICE);
++
+ 	/* now free frags */
+ 	while (nbd > 0) {
+ 
+diff --git a/drivers/net/ethernet/intel/e1000e/phy.c b/drivers/net/ethernet/intel/e1000e/phy.c
+index 59c76a6815a0..be4d7c1e3c14 100644
+--- a/drivers/net/ethernet/intel/e1000e/phy.c
++++ b/drivers/net/ethernet/intel/e1000e/phy.c
+@@ -1757,19 +1757,23 @@ s32 e1000e_phy_has_link_generic(struct e1000_hw *hw, u32 iterations,
+ 		 * it across the board.
+ 		 */
+ 		ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
+-		if (ret_val)
++		if (ret_val) {
+ 			/* If the first read fails, another entity may have
+ 			 * ownership of the resources, wait and try again to
+ 			 * see if they have relinquished the resources yet.
+ 			 */
+-			udelay(usec_interval);
++			if (usec_interval >= 1000)
++				msleep(usec_interval / 1000);
++			else
++				udelay(usec_interval);
++		}
+ 		ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
+ 		if (ret_val)
+ 			break;
+ 		if (phy_status & BMSR_LSTATUS)
+ 			break;
+ 		if (usec_interval >= 1000)
+-			mdelay(usec_interval / 1000);
++			msleep(usec_interval / 1000);
+ 		else
+ 			udelay(usec_interval);
+ 	}
+diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
+index 75b82b6e8c54..c879969e82fb 100644
+--- a/drivers/net/ethernet/via/via-rhine.c
++++ b/drivers/net/ethernet/via/via-rhine.c
+@@ -1611,6 +1611,7 @@ static void rhine_reset_task(struct work_struct *work)
+ 		goto out_unlock;
+ 
+ 	napi_disable(&rp->napi);
++	netif_tx_disable(dev);
+ 	spin_lock_bh(&rp->lock);
+ 
+ 	/* clear all descriptors */
+diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
+index 7f3d461f7e8d..54376fddfaf9 100644
+--- a/drivers/net/wireless/b43/b43.h
++++ b/drivers/net/wireless/b43/b43.h
+@@ -731,8 +731,6 @@ enum b43_firmware_file_type {
+ struct b43_request_fw_context {
+ 	/* The device we are requesting the fw for. */
+ 	struct b43_wldev *dev;
+-	/* a completion event structure needed if this call is asynchronous */
+-	struct completion fw_load_complete;
+ 	/* a pointer to the firmware object */
+ 	const struct firmware *blob;
+ 	/* The type of firmware to request. */
+@@ -809,6 +807,8 @@ enum {
+ struct b43_wldev {
+ 	struct b43_bus_dev *dev;
+ 	struct b43_wl *wl;
++	/* a completion event structure needed if this call is asynchronous */
++	struct completion fw_load_complete;
+ 
+ 	/* The device initialization status.
+ 	 * Use b43_status() to query. */
+diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
+index a95b77ab360e..0b7edd36cfa2 100644
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -2068,6 +2068,7 @@ void b43_do_release_fw(struct b43_firmware_file *fw)
+ 
+ static void b43_release_firmware(struct b43_wldev *dev)
+ {
++	complete(&dev->fw_load_complete);
+ 	b43_do_release_fw(&dev->fw.ucode);
+ 	b43_do_release_fw(&dev->fw.pcm);
+ 	b43_do_release_fw(&dev->fw.initvals);
+@@ -2093,7 +2094,7 @@ static void b43_fw_cb(const struct firmware *firmware, void *context)
+ 	struct b43_request_fw_context *ctx = context;
+ 
+ 	ctx->blob = firmware;
+-	complete(&ctx->fw_load_complete);
++	complete(&ctx->dev->fw_load_complete);
+ }
+ 
+ int b43_do_request_fw(struct b43_request_fw_context *ctx,
+@@ -2140,7 +2141,7 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
+ 	}
+ 	if (async) {
+ 		/* do this part asynchronously */
+-		init_completion(&ctx->fw_load_complete);
++		init_completion(&ctx->dev->fw_load_complete);
+ 		err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
+ 					      ctx->dev->dev->dev, GFP_KERNEL,
+ 					      ctx, b43_fw_cb);
+@@ -2148,12 +2149,11 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
+ 			pr_err("Unable to load firmware\n");
+ 			return err;
+ 		}
+-		/* stall here until fw ready */
+-		wait_for_completion(&ctx->fw_load_complete);
++		wait_for_completion(&ctx->dev->fw_load_complete);
+ 		if (ctx->blob)
+ 			goto fw_ready;
+ 	/* On some ARM systems, the async request will fail, but the next sync
+-	 * request works. For this reason, we dall through here
++	 * request works. For this reason, we fall through here
+ 	 */
+ 	}
+ 	err = request_firmware(&ctx->blob, ctx->fwname,
+@@ -2422,6 +2422,7 @@ error:
+ 
+ static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
+ static void b43_one_core_detach(struct b43_bus_dev *dev);
++static int b43_rng_init(struct b43_wl *wl);
+ 
+ static void b43_request_firmware(struct work_struct *work)
+ {
+@@ -2473,6 +2474,10 @@ start_ieee80211:
+ 		goto err_one_core_detach;
+ 	wl->hw_registred = true;
+ 	b43_leds_register(wl->current_dev);
++
++	/* Register HW RNG driver */
++	b43_rng_init(wl);
++
+ 	goto out;
+ 
+ err_one_core_detach:
+@@ -4634,9 +4639,6 @@ static void b43_wireless_core_exit(struct b43_wldev *dev)
+ 	if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
+ 		return;
+ 
+-	/* Unregister HW RNG driver */
+-	b43_rng_exit(dev->wl);
+-
+ 	b43_set_status(dev, B43_STAT_UNINIT);
+ 
+ 	/* Stop the microcode PSM. */
+@@ -4779,9 +4781,6 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
+ 
+ 	b43_set_status(dev, B43_STAT_INITIALIZED);
+ 
+-	/* Register HW RNG driver */
+-	b43_rng_init(dev->wl);
+-
+ out:
+ 	return err;
+ 
+@@ -5442,6 +5441,9 @@ static void b43_bcma_remove(struct bcma_device *core)
+ 
+ 	b43_one_core_detach(wldev->dev);
+ 
++	/* Unregister HW RNG driver */
++	b43_rng_exit(wl);
++
+ 	b43_leds_unregister(wl);
+ 
+ 	ieee80211_free_hw(wl->hw);
+@@ -5519,6 +5521,9 @@ static void b43_ssb_remove(struct ssb_device *sdev)
+ 
+ 	b43_one_core_detach(dev);
+ 
++	/* Unregister HW RNG driver */
++	b43_rng_exit(wl);
++
+ 	if (list_empty(&wl->devlist)) {
+ 		b43_leds_unregister(wl);
+ 		/* Last core on the chip unregistered.
+diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
+index 8cb206a89083..e85d34b76039 100644
+--- a/drivers/net/wireless/b43/xmit.c
++++ b/drivers/net/wireless/b43/xmit.c
+@@ -821,10 +821,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
+ 		 * channel number in b43. */
+ 		if (chanstat & B43_RX_CHAN_5GHZ) {
+ 			status.band = IEEE80211_BAND_5GHZ;
+-			status.freq = b43_freq_to_channel_5ghz(chanid);
++			status.freq = b43_channel_to_freq_5ghz(chanid);
+ 		} else {
+ 			status.band = IEEE80211_BAND_2GHZ;
+-			status.freq = b43_freq_to_channel_2ghz(chanid);
++			status.freq = b43_channel_to_freq_2ghz(chanid);
+ 		}
+ 		break;
+ 	default:
+diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
+index 572668821862..349c77605231 100644
+--- a/drivers/net/wireless/b43legacy/main.c
++++ b/drivers/net/wireless/b43legacy/main.c
+@@ -3919,6 +3919,7 @@ static void b43legacy_remove(struct ssb_device *dev)
+ 	 * as the ieee80211 unreg will destroy the workqueue. */
+ 	cancel_work_sync(&wldev->restart_work);
+ 	cancel_work_sync(&wl->firmware_load);
++	complete(&wldev->fw_load_complete);
+ 
+ 	B43legacy_WARN_ON(!wl);
+ 	if (!wldev->fw.ucode)
+diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
+index 822443c5a3b5..9fd01dc5146b 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
+@@ -131,6 +131,7 @@ const struct iwl_cfg iwl7260_2ac_cfg = {
+ 	.ht_params = &iwl7000_ht_params,
+ 	.nvm_ver = IWL7260_NVM_VERSION,
+ 	.nvm_calib_ver = IWL7260_TX_POWER_VERSION,
++	.host_interrupt_operation_mode = true,
+ };
+ 
+ const struct iwl_cfg iwl7260_2n_cfg = {
+@@ -140,6 +141,7 @@ const struct iwl_cfg iwl7260_2n_cfg = {
+ 	.ht_params = &iwl7000_ht_params,
+ 	.nvm_ver = IWL7260_NVM_VERSION,
+ 	.nvm_calib_ver = IWL7260_TX_POWER_VERSION,
++	.host_interrupt_operation_mode = true,
+ };
+ 
+ const struct iwl_cfg iwl7260_n_cfg = {
+@@ -149,6 +151,7 @@ const struct iwl_cfg iwl7260_n_cfg = {
+ 	.ht_params = &iwl7000_ht_params,
+ 	.nvm_ver = IWL7260_NVM_VERSION,
+ 	.nvm_calib_ver = IWL7260_TX_POWER_VERSION,
++	.host_interrupt_operation_mode = true,
+ };
+ 
+ const struct iwl_cfg iwl3160_2ac_cfg = {
+@@ -158,6 +161,7 @@ const struct iwl_cfg iwl3160_2ac_cfg = {
+ 	.ht_params = &iwl7000_ht_params,
+ 	.nvm_ver = IWL3160_NVM_VERSION,
+ 	.nvm_calib_ver = IWL3160_TX_POWER_VERSION,
++	.host_interrupt_operation_mode = true,
+ };
+ 
+ const struct iwl_cfg iwl3160_2n_cfg = {
+@@ -167,6 +171,7 @@ const struct iwl_cfg iwl3160_2n_cfg = {
+ 	.ht_params = &iwl7000_ht_params,
+ 	.nvm_ver = IWL3160_NVM_VERSION,
+ 	.nvm_calib_ver = IWL3160_TX_POWER_VERSION,
++	.host_interrupt_operation_mode = true,
+ };
+ 
+ const struct iwl_cfg iwl3160_n_cfg = {
+@@ -176,6 +181,7 @@ const struct iwl_cfg iwl3160_n_cfg = {
+ 	.ht_params = &iwl7000_ht_params,
+ 	.nvm_ver = IWL3160_NVM_VERSION,
+ 	.nvm_calib_ver = IWL3160_TX_POWER_VERSION,
++	.host_interrupt_operation_mode = true,
+ };
+ 
+ MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
+index 44e3370ce343..8ca006b12a32 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-config.h
++++ b/drivers/net/wireless/iwlwifi/iwl-config.h
+@@ -241,6 +241,8 @@ struct iwl_eeprom_params {
+  * @rx_with_siso_diversity: 1x1 device with rx antenna diversity
+  * @internal_wimax_coex: internal wifi/wimax combo device
+  * @temp_offset_v2: support v2 of temperature offset calibration
++ * @host_interrupt_operation_mode: device needs host interrupt operation
++ *	mode set
+  *
+  * We enable the driver to be backward compatible wrt. hardware features.
+  * API differences in uCode shouldn't be handled here but through TLVs
+@@ -273,6 +275,7 @@ struct iwl_cfg {
+ 	const bool rx_with_siso_diversity;
+ 	const bool internal_wimax_coex;
+ 	const bool temp_offset_v2;
++	const bool host_interrupt_operation_mode;
+ };
+ 
+ /*
+diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
+index 20e845d4da04..bba1af4d406c 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
++++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
+@@ -463,13 +463,10 @@
+  * the CSR_INT_COALESCING is an 8 bit register in 32-usec unit
+  *
+  * default interrupt coalescing timer is 64 x 32 = 2048 usecs
+- * default interrupt coalescing calibration timer is 16 x 32 = 512 usecs
+  */
+ #define IWL_HOST_INT_TIMEOUT_MAX	(0xFF)
+ #define IWL_HOST_INT_TIMEOUT_DEF	(0x40)
+ #define IWL_HOST_INT_TIMEOUT_MIN	(0x0)
+-#define IWL_HOST_INT_CALIB_TIMEOUT_MAX	(0xFF)
+-#define IWL_HOST_INT_CALIB_TIMEOUT_DEF	(0x10)
+-#define IWL_HOST_INT_CALIB_TIMEOUT_MIN	(0x0)
++#define IWL_HOST_INT_OPER_MODE		BIT(31)
+ 
+ #endif /* !__iwl_csr_h__ */
+diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
+index 386f2a7c87cb..c26a6dc21eef 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
++++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
+@@ -260,4 +260,8 @@ static inline unsigned int SCD_QUEUE_STATUS_BITS(unsigned int chnl)
+ 
+ /*********************** END TX SCHEDULER *************************************/
+ 
++/* Oscillator clock */
++#define OSC_CLK				(0xa04068)
++#define OSC_CLK_FORCE_CONTROL		(0x8)
++
+ #endif				/* __iwl_prph_h__ */
+diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
+index b29c31a41594..388c8a914960 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
++++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
+@@ -424,6 +424,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
+ 
+  out_unregister:
+ 	ieee80211_unregister_hw(mvm->hw);
++	iwl_mvm_leds_exit(mvm);
+  out_free:
+ 	iwl_phy_db_free(mvm->phy_db);
+ 	kfree(mvm->scan_cmd);
+diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
+index 567e67ad1f61..296026b08a0c 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
+@@ -489,6 +489,10 @@ static void iwl_pcie_rx_hw_init(struct iwl_trans *trans, struct iwl_rxq *rxq)
+ 
+ 	/* Set interrupt coalescing timer to default (2048 usecs) */
+ 	iwl_write8(trans, CSR_INT_COALESCING, IWL_HOST_INT_TIMEOUT_DEF);
++
++	/* W/A for interrupt coalescing bug in 7260 and 3160 */
++	if (trans->cfg->host_interrupt_operation_mode)
++		iwl_set_bit(trans, CSR_INT_COALESCING, IWL_HOST_INT_OPER_MODE);
+ }
+ 
+ int iwl_pcie_rx_init(struct iwl_trans *trans)
+diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
+index aeb70e13137a..4088dd5e9244 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -207,6 +207,22 @@ static int iwl_pcie_apm_init(struct iwl_trans *trans)
+ 	}
+ 
+ 	/*
++	 * Enable the oscillator to count wake up time for L1 exit. This
++	 * consumes slightly more power (100uA) - but allows to be sure
++	 * that we wake up from L1 on time.
++	 *
++	 * This looks weird: read twice the same register, discard the
++	 * value, set a bit, and yet again, read that same register
++	 * just to discard the value. But that's the way the hardware
++	 * seems to like it.
++	 */
++	iwl_read_prph(trans, OSC_CLK);
++	iwl_read_prph(trans, OSC_CLK);
++	iwl_set_bits_prph(trans, OSC_CLK, OSC_CLK_FORCE_CONTROL);
++	iwl_read_prph(trans, OSC_CLK);
++	iwl_read_prph(trans, OSC_CLK);
++
++	/*
+ 	 * Enable DMA clock and wait for it to stabilize.
+ 	 *
+ 	 * Write to "CLK_EN_REG"; "1" bits enable clocks, while "0" bits
+@@ -276,9 +292,6 @@ static int iwl_pcie_nic_init(struct iwl_trans *trans)
+ 	spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+ 	iwl_pcie_apm_init(trans);
+ 
+-	/* Set interrupt coalescing calibration timer to default (512 usecs) */
+-	iwl_write8(trans, CSR_INT_COALESCING, IWL_HOST_INT_CALIB_TIMEOUT_DEF);
+-
+ 	spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+ 
+ 	iwl_pcie_set_pwr(trans, false);
+diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
+index 1f7578d553ec..5400a1e58d79 100644
+--- a/drivers/net/wireless/mwifiex/fw.h
++++ b/drivers/net/wireless/mwifiex/fw.h
+@@ -228,7 +228,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
+ 
+ /* HW_SPEC fw_cap_info */
+ 
+-#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(13)|BIT(14)))
++#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(12)|BIT(13)))
+ 
+ #define GET_VHTCAP_CHWDSET(vht_cap_info)    ((vht_cap_info >> 2) & 0x3)
+ #define GET_VHTNSSMCS(mcs_mapset, nss) ((mcs_mapset >> (2 * (nss - 1))) & 0x3)
+diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
+index 9cf5d8f07df8..50b2fe53219d 100644
+--- a/drivers/net/wireless/mwifiex/scan.c
++++ b/drivers/net/wireless/mwifiex/scan.c
+@@ -1622,7 +1622,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
+ 		const u8 *ie_buf;
+ 		size_t ie_len;
+ 		u16 channel = 0;
+-		u64 fw_tsf = 0;
++		__le64 fw_tsf = 0;
+ 		u16 beacon_size = 0;
+ 		u32 curr_bcn_bytes;
+ 		u32 freq;
+@@ -1749,7 +1749,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
+ 					      ie_buf, ie_len, rssi, GFP_KERNEL);
+ 				bss_priv = (struct mwifiex_bss_priv *)bss->priv;
+ 				bss_priv->band = band;
+-				bss_priv->fw_tsf = fw_tsf;
++				bss_priv->fw_tsf = le64_to_cpu(fw_tsf);
+ 				if (priv->media_connected &&
+ 				    !memcmp(bssid,
+ 					    priv->curr_bss_params.bss_descriptor
+diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
+index 3698028c910d..6fc0853fd7f9 100644
+--- a/drivers/net/wireless/rtlwifi/base.c
++++ b/drivers/net/wireless/rtlwifi/base.c
+@@ -1427,7 +1427,8 @@ void rtl_watchdog_wq_callback(void *data)
+ 			/* if we can't recv beacon for 6s, we should
+ 			 * reconnect this AP
+ 			 */
+-			if (rtlpriv->link_info.roam_times >= 3) {
++			if ((rtlpriv->link_info.roam_times >= 3) &&
++			    !is_zero_ether_addr(rtlpriv->mac80211.bssid)) {
+ 				RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+ 					 "AP off, try to reconnect now\n");
+ 				rtlpriv->link_info.roam_times = 0;
+diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
+index ee84844be008..e2301970c85e 100644
+--- a/drivers/net/wireless/rtlwifi/core.c
++++ b/drivers/net/wireless/rtlwifi/core.c
+@@ -46,10 +46,20 @@ void rtl_fw_cb(const struct firmware *firmware, void *context)
+ 			 "Firmware callback routine entered!\n");
+ 	complete(&rtlpriv->firmware_loading_complete);
+ 	if (!firmware) {
++		if (rtlpriv->cfg->alt_fw_name) {
++			err = request_firmware(&firmware,
++					       rtlpriv->cfg->alt_fw_name,
++					       rtlpriv->io.dev);
++			pr_info("Loading alternative firmware %s\n",
++				rtlpriv->cfg->alt_fw_name);
++			if (!err)
++				goto found_alt;
++		}
+ 		pr_err("Firmware %s not available\n", rtlpriv->cfg->fw_name);
+ 		rtlpriv->max_fw_size = 0;
+ 		return;
+ 	}
++found_alt:
+ 	if (firmware->size > rtlpriv->max_fw_size) {
+ 		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+ 			 "Firmware is too big!\n");
+@@ -184,6 +194,7 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ 					rtlpriv->cfg->maps
+ 					[RTL_IBSS_INT_MASKS]);
+ 		}
++		mac->link_state = MAC80211_LINKED;
+ 		break;
+ 	case NL80211_IFTYPE_ADHOC:
+ 		RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
+index 21a5cf060677..a6184b6e1d57 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
+@@ -1078,7 +1078,7 @@ static void rtl88e_dm_txpower_tracking_callback_thermalmeter(struct ieee80211_hw
+ 				rtldm->swing_flag_ofdm = true;
+ 			}
+ 
+-			if (rtldm->swing_idx_cck != rtldm->swing_idx_cck) {
++			if (rtldm->swing_idx_cck_cur != rtldm->swing_idx_cck) {
+ 				rtldm->swing_idx_cck_cur = rtldm->swing_idx_cck;
+ 				rtldm->swing_flag_cck = true;
+ 			}
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+index d2d57a27a7c1..06cb94cf5085 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+@@ -158,6 +158,42 @@ static const u8 cckswing_table_ch14[CCK_TABLE_SIZE][8] = {
+ 	{0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}
+ };
+ 
++static u32 power_index_reg[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a};
++
++void dm_restorepowerindex(struct ieee80211_hw *hw)
++{
++	struct rtl_priv *rtlpriv = rtl_priv(hw);
++	u8	index;
++
++	for (index = 0; index < 6; index++)
++		rtl_write_byte(rtlpriv, power_index_reg[index],
++			       rtlpriv->dm.powerindex_backup[index]);
++}
++EXPORT_SYMBOL_GPL(dm_restorepowerindex);
++
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value)
++{
++	struct rtl_priv *rtlpriv = rtl_priv(hw);
++	u8 index;
++
++	for (index = 0; index < 6; index++)
++		rtl_write_byte(rtlpriv, power_index_reg[index], value);
++}
++EXPORT_SYMBOL_GPL(dm_writepowerindex);
++
++void dm_savepowerindex(struct ieee80211_hw *hw)
++{
++	struct rtl_priv *rtlpriv = rtl_priv(hw);
++	u8 index;
++	u8 tmp;
++
++	for (index = 0; index < 6; index++) {
++		tmp = rtl_read_byte(rtlpriv, power_index_reg[index]);
++		rtlpriv->dm.powerindex_backup[index] = tmp;
++	}
++}
++EXPORT_SYMBOL_GPL(dm_savepowerindex);
++
+ static void rtl92c_dm_diginit(struct ieee80211_hw *hw)
+ {
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
+index 518e208c0180..4f232a063636 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
+@@ -91,6 +91,17 @@
+ #define TX_POWER_NEAR_FIELD_THRESH_LVL2		74
+ #define TX_POWER_NEAR_FIELD_THRESH_LVL1		67
+ 
++#define DYNAMIC_FUNC_DISABLE			0x0
++#define DYNAMIC_FUNC_DIG			BIT(0)
++#define DYNAMIC_FUNC_HP				BIT(1)
++#define DYNAMIC_FUNC_SS				BIT(2) /*Tx Power Tracking*/
++#define DYNAMIC_FUNC_BT				BIT(3)
++#define DYNAMIC_FUNC_ANT_DIV			BIT(4)
++
++#define	RSSI_CCK				0
++#define	RSSI_OFDM				1
++#define	RSSI_DEFAULT				2
++
+ struct swat_t {
+ 	u8 failure_cnt;
+ 	u8 try_flag;
+@@ -167,5 +178,8 @@ void rtl92c_phy_lc_calibrate(struct ieee80211_hw *hw);
+ void rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw, bool recovery);
+ void rtl92c_dm_dynamic_txpower(struct ieee80211_hw *hw);
+ void rtl92c_dm_bt_coexist(struct ieee80211_hw *hw);
++void dm_savepowerindex(struct ieee80211_hw *hw);
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value);
++void dm_restorepowerindex(struct ieee80211_hw *hw);
+ 
+ #endif
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
+index 16a0b9e59acf..c16209a336ea 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
+@@ -101,6 +101,15 @@ void rtl92cu_dm_dynamic_txpower(struct ieee80211_hw *hw)
+ 			 "PHY_SetTxPowerLevel8192S() Channel = %d\n",
+ 			 rtlphy->current_channel);
+ 		rtl92c_phy_set_txpower_level(hw, rtlphy->current_channel);
++		if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++		    TXHIGHPWRLEVEL_NORMAL)
++			dm_restorepowerindex(hw);
++		else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++			 TXHIGHPWRLEVEL_LEVEL1)
++			dm_writepowerindex(hw, 0x14);
++		else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++			 TXHIGHPWRLEVEL_LEVEL2)
++			dm_writepowerindex(hw, 0x10);
+ 	}
+ 
+ 	rtlpriv->dm.last_dtp_lvl = rtlpriv->dm.dynamic_txhighpower_lvl;
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
+index d947e7d350bb..fafa6bac2a3f 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
+@@ -30,3 +30,6 @@
+ #include "../rtl8192ce/dm.h"
+ 
+ void rtl92cu_dm_dynamic_txpower(struct ieee80211_hw *hw);
++void dm_savepowerindex(struct ieee80211_hw *hw);
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value);
++void dm_restorepowerindex(struct ieee80211_hw *hw);
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+index 2119313a737b..b878d56d2f4d 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+@@ -85,17 +85,15 @@ void rtl92cu_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+ 	if (mac->act_scanning) {
+ 		tx_agc[RF90_PATH_A] = 0x3f3f3f3f;
+ 		tx_agc[RF90_PATH_B] = 0x3f3f3f3f;
+-		if (turbo_scanoff) {
+-			for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+-				tx_agc[idx1] = ppowerlevel[idx1] |
+-				    (ppowerlevel[idx1] << 8) |
+-				    (ppowerlevel[idx1] << 16) |
+-				    (ppowerlevel[idx1] << 24);
+-				if (rtlhal->interface == INTF_USB) {
+-					if (tx_agc[idx1] > 0x20 &&
+-					    rtlefuse->external_pa)
+-						tx_agc[idx1] = 0x20;
+-				}
++		for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
++			tx_agc[idx1] = ppowerlevel[idx1] |
++			    (ppowerlevel[idx1] << 8) |
++			    (ppowerlevel[idx1] << 16) |
++			    (ppowerlevel[idx1] << 24);
++			if (rtlhal->interface == INTF_USB) {
++				if (tx_agc[idx1] > 0x20 &&
++				    rtlefuse->external_pa)
++					tx_agc[idx1] = 0x20;
+ 			}
+ 		}
+ 	} else {
+@@ -107,7 +105,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+ 			   TXHIGHPWRLEVEL_LEVEL2) {
+ 			tx_agc[RF90_PATH_A] = 0x00000000;
+ 			tx_agc[RF90_PATH_B] = 0x00000000;
+-		} else{
++		} else {
+ 			for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+ 				tx_agc[idx1] = ppowerlevel[idx1] |
+ 				    (ppowerlevel[idx1] << 8) |
+@@ -373,7 +371,12 @@ static void _rtl92c_write_ofdm_power_reg(struct ieee80211_hw *hw,
+ 			    regoffset == RTXAGC_B_MCS07_MCS04)
+ 				regoffset = 0xc98;
+ 			for (i = 0; i < 3; i++) {
+-				writeVal = (writeVal > 6) ? (writeVal - 6) : 0;
++				if (i != 2)
++					writeVal = (writeVal > 8) ?
++						   (writeVal - 8) : 0;
++				else
++					writeVal = (writeVal > 6) ?
++						   (writeVal - 6) : 0;
+ 				rtl_write_byte(rtlpriv, (u32)(regoffset + i),
+ 					      (u8)writeVal);
+ 			}
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index 2bd598526217..8188dcb512f0 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -49,6 +49,9 @@ MODULE_AUTHOR("Larry Finger	<Larry.Finger@××××××××.net>");
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Realtek 8192C/8188C 802.11n USB wireless");
+ MODULE_FIRMWARE("rtlwifi/rtl8192cufw.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8192cufw_A.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8192cufw_B.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8192cufw_TMSC.bin");
+ 
+ static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
+ {
+@@ -68,14 +71,21 @@ static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
+ 			 "Can't alloc buffer for fw\n");
+ 		return 1;
+ 	}
+-
++	if (IS_VENDOR_UMC_A_CUT(rtlpriv->rtlhal.version) &&
++	    !IS_92C_SERIAL(rtlpriv->rtlhal.version)) {
++		rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_A.bin";
++	} else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlpriv->rtlhal.version)) {
++		rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_B.bin";
++	} else {
++		rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_TMSC.bin";
++	}
++	/* provide name of alternative file */
++	rtlpriv->cfg->alt_fw_name = "rtlwifi/rtl8192cufw.bin";
+ 	pr_info("Loading firmware %s\n", rtlpriv->cfg->fw_name);
+ 	rtlpriv->max_fw_size = 0x4000;
+ 	err = request_firmware_nowait(THIS_MODULE, 1,
+ 				      rtlpriv->cfg->fw_name, rtlpriv->io.dev,
+ 				      GFP_KERNEL, hw, rtl_fw_cb);
+-
+-
+ 	return err;
+ }
+ 
+@@ -306,6 +316,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ 	{RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
+ 	{RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ 	{RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
++	{RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
+ 	{RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+ 	{RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
+ 	/* HP - Lite-On ,8188CUS Slim Combo */
+diff --git a/drivers/net/wireless/rtlwifi/stats.c b/drivers/net/wireless/rtlwifi/stats.c
+index 8ed31744a054..4f083fc1d360 100644
+--- a/drivers/net/wireless/rtlwifi/stats.c
++++ b/drivers/net/wireless/rtlwifi/stats.c
+@@ -176,6 +176,7 @@ static void rtl_process_pwdb(struct ieee80211_hw *hw, struct rtl_stats *pstatus)
+ 	struct rtl_sta_info *drv_priv = NULL;
+ 	struct ieee80211_sta *sta = NULL;
+ 	long undec_sm_pwdb;
++	long undec_sm_cck;
+ 
+ 	rcu_read_lock();
+ 	if (rtlpriv->mac80211.opmode != NL80211_IFTYPE_STATION)
+@@ -185,12 +186,16 @@ static void rtl_process_pwdb(struct ieee80211_hw *hw, struct rtl_stats *pstatus)
+ 	if (sta) {
+ 		drv_priv = (struct rtl_sta_info *) sta->drv_priv;
+ 		undec_sm_pwdb = drv_priv->rssi_stat.undec_sm_pwdb;
++		undec_sm_cck = drv_priv->rssi_stat.undec_sm_cck;
+ 	} else {
+ 		undec_sm_pwdb = rtlpriv->dm.undec_sm_pwdb;
++		undec_sm_cck = rtlpriv->dm.undec_sm_cck;
+ 	}
+ 
+ 	if (undec_sm_pwdb < 0)
+ 		undec_sm_pwdb = pstatus->rx_pwdb_all;
++	if (undec_sm_cck < 0)
++		undec_sm_cck = pstatus->rx_pwdb_all;
+ 	if (pstatus->rx_pwdb_all > (u32) undec_sm_pwdb) {
+ 		undec_sm_pwdb = (((undec_sm_pwdb) *
+ 		      (RX_SMOOTH_FACTOR - 1)) +
+@@ -200,6 +205,15 @@ static void rtl_process_pwdb(struct ieee80211_hw *hw, struct rtl_stats *pstatus)
+ 		undec_sm_pwdb = (((undec_sm_pwdb) * (RX_SMOOTH_FACTOR - 1)) +
+ 		     (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
+ 	}
++	if (pstatus->rx_pwdb_all > (u32) undec_sm_cck) {
++		undec_sm_cck = (((undec_sm_pwdb) *
++		      (RX_SMOOTH_FACTOR - 1)) +
++		     (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
++		undec_sm_cck = undec_sm_cck + 1;
++	} else {
++		undec_sm_pwdb = (((undec_sm_cck) * (RX_SMOOTH_FACTOR - 1)) +
++		     (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
++	}
+ 
+ 	if (sta) {
+ 		drv_priv->rssi_stat.undec_sm_pwdb = undec_sm_pwdb;
+diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
+index 1feebdc92f41..57b12a5883a0 100644
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -477,6 +477,8 @@ static void _rtl_usb_rx_process_agg(struct ieee80211_hw *hw,
+ 			if (unicast)
+ 				rtlpriv->link_info.num_rx_inperiod++;
+ 		}
++		/* static bcn for roaming */
++		rtl_beacon_statistic(hw, skb);
+ 	}
+ }
+ 
+@@ -548,7 +550,7 @@ static void _rtl_rx_pre_process(struct ieee80211_hw *hw, struct sk_buff *skb)
+ 	}
+ }
+ 
+-#define __RX_SKB_MAX_QUEUED	32
++#define __RX_SKB_MAX_QUEUED	64
+ 
+ static void _rtl_rx_work(unsigned long param)
+ {
+diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
+index ad9c37a42709..e576a927fde7 100644
+--- a/drivers/net/wireless/rtlwifi/wifi.h
++++ b/drivers/net/wireless/rtlwifi/wifi.h
+@@ -1035,6 +1035,7 @@ struct rtl_ht_agg {
+ 
+ struct rssi_sta {
+ 	long undec_sm_pwdb;
++	long undec_sm_cck;
+ };
+ 
+ struct rtl_tid_data {
+@@ -1325,8 +1326,10 @@ struct fast_ant_training {
+ struct rtl_dm {
+ 	/*PHY status for Dynamic Management */
+ 	long entry_min_undec_sm_pwdb;
++	long undec_sm_cck;
+ 	long undec_sm_pwdb;	/*out dm */
+ 	long entry_max_undec_sm_pwdb;
++	s32 ofdm_pkt_cnt;
+ 	bool dm_initialgain_enable;
+ 	bool dynamic_txpower_enable;
+ 	bool current_turbo_edca;
+@@ -1341,6 +1344,7 @@ struct rtl_dm {
+ 	bool inform_fw_driverctrldm;
+ 	bool current_mrc_switch;
+ 	u8 txpowercount;
++	u8 powerindex_backup[6];
+ 
+ 	u8 thermalvalue_rxgain;
+ 	u8 thermalvalue_iqk;
+@@ -1352,7 +1356,9 @@ struct rtl_dm {
+ 	bool done_txpower;
+ 	u8 dynamic_txhighpower_lvl;	/*Tx high power level */
+ 	u8 dm_flag;		/*Indicate each dynamic mechanism's status. */
++	u8 dm_flag_tmp;
+ 	u8 dm_type;
++	u8 dm_rssi_sel;
+ 	u8 txpower_track_control;
+ 	bool interrupt_migration;
+ 	bool disable_tx_int;
+@@ -1806,6 +1812,7 @@ struct rtl_hal_cfg {
+ 	bool write_readback;
+ 	char *name;
+ 	char *fw_name;
++	char *alt_fw_name;
+ 	struct rtl_hal_ops *ops;
+ 	struct rtl_mod_params *mod_params;
+ 	struct rtl_hal_usbint_cfg *usb_interface_cfg;
+@@ -1950,6 +1957,7 @@ struct dig_t {
+ 	u8 pre_ccastate;
+ 	u8 cur_ccasate;
+ 	u8 large_fa_hit;
++	u8 dig_dynamic_min;
+ 	u8 forbidden_igi;
+ 	u8 dig_state;
+ 	u8 dig_highpwrstate;
+@@ -2030,22 +2038,15 @@ struct rtl_priv {
+ 	struct dig_t dm_digtable;
+ 	struct ps_t dm_pstable;
+ 
+-	/* section shared by individual drivers */
+-	union {
+-		struct {	/* data buffer pointer for USB reads */
+-			__le32 *usb_data;
+-			int usb_data_index;
+-			bool initialized;
+-		};
+-		struct {	/* section for 8723ae */
+-			bool reg_init;	/* true if regs saved */
+-			u32 reg_874;
+-			u32 reg_c70;
+-			u32 reg_85c;
+-			u32 reg_a74;
+-			bool bt_operation_on;
+-		};
+-	};
++	u32 reg_874;
++	u32 reg_c70;
++	u32 reg_85c;
++	u32 reg_a74;
++	bool reg_init;	/* true if regs saved */
++	bool bt_operation_on;
++	__le32 *usb_data;
++	int usb_data_index;
++	bool initialized;
+ 	bool enter_ps;	/* true when entering PS */
+ 	u8 rate_mask[5];
+ 
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 0c01b8e33fe1..82e0f1fd2254 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -107,6 +107,7 @@ struct netfront_info {
+ 	} tx_skbs[NET_TX_RING_SIZE];
+ 	grant_ref_t gref_tx_head;
+ 	grant_ref_t grant_tx_ref[NET_TX_RING_SIZE];
++	struct page *grant_tx_page[NET_TX_RING_SIZE];
+ 	unsigned tx_skb_freelist;
+ 
+ 	spinlock_t   rx_lock ____cacheline_aligned_in_smp;
+@@ -386,6 +387,7 @@ static void xennet_tx_buf_gc(struct net_device *dev)
+ 			gnttab_release_grant_reference(
+ 				&np->gref_tx_head, np->grant_tx_ref[id]);
+ 			np->grant_tx_ref[id] = GRANT_INVALID_REF;
++			np->grant_tx_page[id] = NULL;
+ 			add_id_to_freelist(&np->tx_skb_freelist, np->tx_skbs, id);
+ 			dev_kfree_skb_irq(skb);
+ 		}
+@@ -442,6 +444,7 @@ static void xennet_make_frags(struct sk_buff *skb, struct net_device *dev,
+ 		gnttab_grant_foreign_access_ref(ref, np->xbdev->otherend_id,
+ 						mfn, GNTMAP_readonly);
+ 
++		np->grant_tx_page[id] = virt_to_page(data);
+ 		tx->gref = np->grant_tx_ref[id] = ref;
+ 		tx->offset = offset;
+ 		tx->size = len;
+@@ -487,6 +490,7 @@ static void xennet_make_frags(struct sk_buff *skb, struct net_device *dev,
+ 							np->xbdev->otherend_id,
+ 							mfn, GNTMAP_readonly);
+ 
++			np->grant_tx_page[id] = page;
+ 			tx->gref = np->grant_tx_ref[id] = ref;
+ 			tx->offset = offset;
+ 			tx->size = bytes;
+@@ -586,6 +590,7 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	mfn = virt_to_mfn(data);
+ 	gnttab_grant_foreign_access_ref(
+ 		ref, np->xbdev->otherend_id, mfn, GNTMAP_readonly);
++	np->grant_tx_page[id] = virt_to_page(data);
+ 	tx->gref = np->grant_tx_ref[id] = ref;
+ 	tx->offset = offset;
+ 	tx->size = len;
+@@ -1115,10 +1120,11 @@ static void xennet_release_tx_bufs(struct netfront_info *np)
+ 			continue;
+ 
+ 		skb = np->tx_skbs[i].skb;
+-		gnttab_end_foreign_access_ref(np->grant_tx_ref[i],
+-					      GNTMAP_readonly);
+-		gnttab_release_grant_reference(&np->gref_tx_head,
+-					       np->grant_tx_ref[i]);
++		get_page(np->grant_tx_page[i]);
++		gnttab_end_foreign_access(np->grant_tx_ref[i],
++					  GNTMAP_readonly,
++					  (unsigned long)page_address(np->grant_tx_page[i]));
++		np->grant_tx_page[i] = NULL;
+ 		np->grant_tx_ref[i] = GRANT_INVALID_REF;
+ 		add_id_to_freelist(&np->tx_skb_freelist, np->tx_skbs, i);
+ 		dev_kfree_skb_irq(skb);
+@@ -1127,78 +1133,35 @@ static void xennet_release_tx_bufs(struct netfront_info *np)
+ 
+ static void xennet_release_rx_bufs(struct netfront_info *np)
+ {
+-	struct mmu_update      *mmu = np->rx_mmu;
+-	struct multicall_entry *mcl = np->rx_mcl;
+-	struct sk_buff_head free_list;
+-	struct sk_buff *skb;
+-	unsigned long mfn;
+-	int xfer = 0, noxfer = 0, unused = 0;
+ 	int id, ref;
+ 
+-	dev_warn(&np->netdev->dev, "%s: fix me for copying receiver.\n",
+-			 __func__);
+-	return;
+-
+-	skb_queue_head_init(&free_list);
+-
+ 	spin_lock_bh(&np->rx_lock);
+ 
+ 	for (id = 0; id < NET_RX_RING_SIZE; id++) {
+-		ref = np->grant_rx_ref[id];
+-		if (ref == GRANT_INVALID_REF) {
+-			unused++;
+-			continue;
+-		}
++		struct sk_buff *skb;
++		struct page *page;
+ 
+ 		skb = np->rx_skbs[id];
+-		mfn = gnttab_end_foreign_transfer_ref(ref);
+-		gnttab_release_grant_reference(&np->gref_rx_head, ref);
+-		np->grant_rx_ref[id] = GRANT_INVALID_REF;
+-
+-		if (0 == mfn) {
+-			skb_shinfo(skb)->nr_frags = 0;
+-			dev_kfree_skb(skb);
+-			noxfer++;
++		if (!skb)
+ 			continue;
+-		}
+ 
+-		if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+-			/* Remap the page. */
+-			const struct page *page =
+-				skb_frag_page(&skb_shinfo(skb)->frags[0]);
+-			unsigned long pfn = page_to_pfn(page);
+-			void *vaddr = page_address(page);
++		ref = np->grant_rx_ref[id];
++		if (ref == GRANT_INVALID_REF)
++			continue;
+ 
+-			MULTI_update_va_mapping(mcl, (unsigned long)vaddr,
+-						mfn_pte(mfn, PAGE_KERNEL),
+-						0);
+-			mcl++;
+-			mmu->ptr = ((u64)mfn << PAGE_SHIFT)
+-				| MMU_MACHPHYS_UPDATE;
+-			mmu->val = pfn;
+-			mmu++;
++		page = skb_frag_page(&skb_shinfo(skb)->frags[0]);
+ 
+-			set_phys_to_machine(pfn, mfn);
+-		}
+-		__skb_queue_tail(&free_list, skb);
+-		xfer++;
+-	}
+-
+-	dev_info(&np->netdev->dev, "%s: %d xfer, %d noxfer, %d unused\n",
+-		 __func__, xfer, noxfer, unused);
++		/* gnttab_end_foreign_access() needs a page ref until
++		 * foreign access is ended (which may be deferred).
++		 */
++		get_page(page);
++		gnttab_end_foreign_access(ref, 0,
++					  (unsigned long)page_address(page));
++		np->grant_rx_ref[id] = GRANT_INVALID_REF;
+ 
+-	if (xfer) {
+-		if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+-			/* Do all the remapping work and M2P updates. */
+-			MULTI_mmu_update(mcl, np->rx_mmu, mmu - np->rx_mmu,
+-					 NULL, DOMID_SELF);
+-			mcl++;
+-			HYPERVISOR_multicall(np->rx_mcl, mcl - np->rx_mcl);
+-		}
++		kfree_skb(skb);
+ 	}
+ 
+-	__skb_queue_purge(&free_list);
+-
+ 	spin_unlock_bh(&np->rx_lock);
+ }
+ 
+@@ -1333,6 +1296,7 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
+ 	for (i = 0; i < NET_RX_RING_SIZE; i++) {
+ 		np->rx_skbs[i] = NULL;
+ 		np->grant_rx_ref[i] = GRANT_INVALID_REF;
++		np->grant_tx_page[i] = NULL;
+ 	}
+ 
+ 	/* A grant for every tx ring slot */
+diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
+index 903e1285fda0..b0a0d5389f41 100644
+--- a/drivers/parport/parport_pc.c
++++ b/drivers/parport/parport_pc.c
+@@ -2596,8 +2596,6 @@ enum parport_pc_pci_cards {
+ 	syba_2p_epp,
+ 	syba_1p_ecp,
+ 	titan_010l,
+-	titan_1284p1,
+-	titan_1284p2,
+ 	avlab_1p,
+ 	avlab_2p,
+ 	oxsemi_952,
+@@ -2656,8 +2654,6 @@ static struct parport_pc_pci {
+ 	/* syba_2p_epp AP138B */	{ 2, { { 0, 0x078 }, { 0, 0x178 }, } },
+ 	/* syba_1p_ecp W83787 */	{ 1, { { 0, 0x078 }, } },
+ 	/* titan_010l */		{ 1, { { 3, -1 }, } },
+-	/* titan_1284p1 */              { 1, { { 0, 1 }, } },
+-	/* titan_1284p2 */		{ 2, { { 0, 1 }, { 2, 3 }, } },
+ 	/* avlab_1p		*/	{ 1, { { 0, 1}, } },
+ 	/* avlab_2p		*/	{ 2, { { 0, 1}, { 2, 3 },} },
+ 	/* The Oxford Semi cards are unusual: 954 doesn't support ECP,
+@@ -2673,8 +2669,8 @@ static struct parport_pc_pci {
+ 	/* netmos_9705 */               { 1, { { 0, -1 }, } },
+ 	/* netmos_9715 */               { 2, { { 0, 1 }, { 2, 3 },} },
+ 	/* netmos_9755 */               { 2, { { 0, 1 }, { 2, 3 },} },
+-	/* netmos_9805 */               { 1, { { 0, -1 }, } },
+-	/* netmos_9815 */               { 2, { { 0, -1 }, { 2, -1 }, } },
++	/* netmos_9805 */		{ 1, { { 0, 1 }, } },
++	/* netmos_9815 */		{ 2, { { 0, 1 }, { 2, 3 }, } },
+ 	/* netmos_9901 */               { 1, { { 0, -1 }, } },
+ 	/* netmos_9865 */               { 1, { { 0, -1 }, } },
+ 	/* quatech_sppxp100 */		{ 1, { { 0, 1 }, } },
+@@ -2718,8 +2714,6 @@ static const struct pci_device_id parport_pc_pci_tbl[] = {
+ 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, syba_1p_ecp },
+ 	{ PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_010L,
+ 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, titan_010l },
+-	{ 0x9710, 0x9805, 0x1000, 0x0010, 0, 0, titan_1284p1 },
+-	{ 0x9710, 0x9815, 0x1000, 0x0020, 0, 0, titan_1284p2 },
+ 	/* PCI_VENDOR_ID_AVLAB/Intek21 has another bunch of cards ...*/
+ 	/* AFAVLAB_TK9902 */
+ 	{ 0x14db, 0x2120, PCI_ANY_ID, PCI_ANY_ID, 0, 0, avlab_1p},
+diff --git a/drivers/pinctrl/pinctrl-sunxi.c b/drivers/pinctrl/pinctrl-sunxi.c
+index b7d8c890514c..876d7cc4d8a7 100644
+--- a/drivers/pinctrl/pinctrl-sunxi.c
++++ b/drivers/pinctrl/pinctrl-sunxi.c
+@@ -1754,12 +1754,6 @@ static int sunxi_pinctrl_gpio_get(struct gpio_chip *chip, unsigned offset)
+ 	return val;
+ }
+ 
+-static int sunxi_pinctrl_gpio_direction_output(struct gpio_chip *chip,
+-					unsigned offset, int value)
+-{
+-	return pinctrl_gpio_direction_output(chip->base + offset);
+-}
+-
+ static void sunxi_pinctrl_gpio_set(struct gpio_chip *chip,
+ 				unsigned offset, int value)
+ {
+@@ -1770,6 +1764,13 @@ static void sunxi_pinctrl_gpio_set(struct gpio_chip *chip,
+ 	writel((value & DATA_PINS_MASK) << index, pctl->membase + reg);
+ }
+ 
++static int sunxi_pinctrl_gpio_direction_output(struct gpio_chip *chip,
++					unsigned offset, int value)
++{
++	sunxi_pinctrl_gpio_set(chip, offset, value);
++	return pinctrl_gpio_direction_output(chip->base + offset);
++}
++
+ static int sunxi_pinctrl_gpio_of_xlate(struct gpio_chip *gc,
+ 				const struct of_phandle_args *gpiospec,
+ 				u32 *flags)
+diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
+index a8e43cf70fac..0ed96df20162 100644
+--- a/drivers/platform/x86/hp_accel.c
++++ b/drivers/platform/x86/hp_accel.c
+@@ -77,6 +77,7 @@ static inline void delayed_sysfs_set(struct led_classdev *led_cdev,
+ static struct acpi_device_id lis3lv02d_device_ids[] = {
+ 	{"HPQ0004", 0}, /* HP Mobile Data Protection System PNP */
+ 	{"HPQ6000", 0}, /* HP Mobile Data Protection System PNP */
++	{"HPQ6007", 0}, /* HP Mobile Data Protection System PNP */
+ 	{"", 0},
+ };
+ MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids);
+diff --git a/drivers/rtc/rtc-max8907.c b/drivers/rtc/rtc-max8907.c
+index 86afb797125d..5d0ce597ba83 100644
+--- a/drivers/rtc/rtc-max8907.c
++++ b/drivers/rtc/rtc-max8907.c
+@@ -51,7 +51,7 @@ static irqreturn_t max8907_irq_handler(int irq, void *data)
+ {
+ 	struct max8907_rtc *rtc = data;
+ 
+-	regmap_update_bits(rtc->regmap, MAX8907_REG_ALARM0_CNTL, 0x7f, 0);
++	regmap_write(rtc->regmap, MAX8907_REG_ALARM0_CNTL, 0);
+ 
+ 	rtc_update_irq(rtc->rtc_dev, 1, RTC_IRQF | RTC_AF);
+ 
+@@ -64,7 +64,7 @@ static void regs_to_tm(u8 *regs, struct rtc_time *tm)
+ 		bcd2bin(regs[RTC_YEAR1]) - 1900;
+ 	tm->tm_mon = bcd2bin(regs[RTC_MONTH] & 0x1f) - 1;
+ 	tm->tm_mday = bcd2bin(regs[RTC_DATE] & 0x3f);
+-	tm->tm_wday = (regs[RTC_WEEKDAY] & 0x07) - 1;
++	tm->tm_wday = (regs[RTC_WEEKDAY] & 0x07);
+ 	if (regs[RTC_HOUR] & HOUR_12) {
+ 		tm->tm_hour = bcd2bin(regs[RTC_HOUR] & 0x01f);
+ 		if (tm->tm_hour == 12)
+@@ -88,7 +88,7 @@ static void tm_to_regs(struct rtc_time *tm, u8 *regs)
+ 	regs[RTC_YEAR1] = bin2bcd(low);
+ 	regs[RTC_MONTH] = bin2bcd(tm->tm_mon + 1);
+ 	regs[RTC_DATE] = bin2bcd(tm->tm_mday);
+-	regs[RTC_WEEKDAY] = tm->tm_wday + 1;
++	regs[RTC_WEEKDAY] = tm->tm_wday;
+ 	regs[RTC_HOUR] = bin2bcd(tm->tm_hour);
+ 	regs[RTC_MIN] = bin2bcd(tm->tm_min);
+ 	regs[RTC_SEC] = bin2bcd(tm->tm_sec);
+@@ -153,7 +153,7 @@ static int max8907_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 	tm_to_regs(&alrm->time, regs);
+ 
+ 	/* Disable alarm while we update the target time */
+-	ret = regmap_update_bits(rtc->regmap, MAX8907_REG_ALARM0_CNTL, 0x7f, 0);
++	ret = regmap_write(rtc->regmap, MAX8907_REG_ALARM0_CNTL, 0);
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -163,8 +163,7 @@ static int max8907_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 		return ret;
+ 
+ 	if (alrm->enabled)
+-		ret = regmap_update_bits(rtc->regmap, MAX8907_REG_ALARM0_CNTL,
+-					 0x7f, 0x7f);
++		ret = regmap_write(rtc->regmap, MAX8907_REG_ALARM0_CNTL, 0x77);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c
+index a5f7690e819e..ae2564d3123b 100644
+--- a/drivers/scsi/bfa/bfad.c
++++ b/drivers/scsi/bfa/bfad.c
+@@ -1824,7 +1824,7 @@ out:
+ static u32 *
+ bfad_load_fwimg(struct pci_dev *pdev)
+ {
+-	if (pdev->device == BFA_PCI_DEVICE_ID_CT2) {
++	if (bfa_asic_id_ct2(pdev->device)) {
+ 		if (bfi_image_ct2_size == 0)
+ 			bfad_read_firmware(pdev, &bfi_image_ct2,
+ 				&bfi_image_ct2_size, BFAD_FW_FILE_CT2);
+@@ -1834,12 +1834,14 @@ bfad_load_fwimg(struct pci_dev *pdev)
+ 			bfad_read_firmware(pdev, &bfi_image_ct,
+ 				&bfi_image_ct_size, BFAD_FW_FILE_CT);
+ 		return bfi_image_ct;
+-	} else {
++	} else if (bfa_asic_id_cb(pdev->device)) {
+ 		if (bfi_image_cb_size == 0)
+ 			bfad_read_firmware(pdev, &bfi_image_cb,
+ 				&bfi_image_cb_size, BFAD_FW_FILE_CB);
+ 		return bfi_image_cb;
+ 	}
++
++	return NULL;
+ }
+ 
+ static void
+diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
+index 74b88efde6ad..b26f1a5cc0ec 100644
+--- a/drivers/scsi/virtio_scsi.c
++++ b/drivers/scsi/virtio_scsi.c
+@@ -957,6 +957,10 @@ static void virtscsi_remove(struct virtio_device *vdev)
+ #ifdef CONFIG_PM
+ static int virtscsi_freeze(struct virtio_device *vdev)
+ {
++	struct Scsi_Host *sh = virtio_scsi_host(vdev);
++	struct virtio_scsi *vscsi = shost_priv(sh);
++
++	unregister_hotcpu_notifier(&vscsi->nb);
+ 	virtscsi_remove_vqs(vdev);
+ 	return 0;
+ }
+@@ -965,8 +969,17 @@ static int virtscsi_restore(struct virtio_device *vdev)
+ {
+ 	struct Scsi_Host *sh = virtio_scsi_host(vdev);
+ 	struct virtio_scsi *vscsi = shost_priv(sh);
++	int err;
++
++	err = virtscsi_init(vdev, vscsi);
++	if (err)
++		return err;
++
++	err = register_hotcpu_notifier(&vscsi->nb);
++	if (err)
++		vdev->config->del_vqs(vdev);
+ 
+-	return virtscsi_init(vdev, vscsi);
++	return err;
+ }
+ #endif
+ 
+diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
+index c812d6c7dc31..e3a005da776b 100644
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -358,6 +358,10 @@ static u8 key_2char2num(u8 hch, u8 lch)
+ 	return (hex_to_bin(hch) << 4) | hex_to_bin(lch);
+ }
+ 
++static const struct device_type wlan_type = {
++	.name = "wlan",
++};
++
+ /*
+  * drv_init() - a device potentially for us
+  *
+@@ -393,6 +397,7 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
+ 	padapter->pusb_intf = pusb_intf;
+ 	usb_set_intfdata(pusb_intf, pnetdev);
+ 	SET_NETDEV_DEV(pnetdev, &pusb_intf->dev);
++	pnetdev->dev.type = &wlan_type;
+ 	/* step 2. */
+ 	padapter->dvobj_init = &r8712_usb_dvobj_init;
+ 	padapter->dvobj_deinit = &r8712_usb_dvobj_deinit;
+diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c
+index 3ff1126c9a53..55185336afe2 100644
+--- a/drivers/staging/vt6656/baseband.c
++++ b/drivers/staging/vt6656/baseband.c
+@@ -1466,7 +1466,6 @@ void BBvUpdatePreEDThreshold(struct vnt_private *pDevice, int bScanning)
+ 
+             if( bScanning )
+             {   // need Max sensitivity //RSSI -69, -70,....
+-                if(pDevice->byBBPreEDIndex == 0) break;
+                 pDevice->byBBPreEDIndex = 0;
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x30); //CR206(0xCE)
+@@ -1609,7 +1608,6 @@ void BBvUpdatePreEDThreshold(struct vnt_private *pDevice, int bScanning)
+ 
+             if( bScanning )
+             {   // need Max sensitivity  //RSSI -69, -70, ...
+-                if(pDevice->byBBPreEDIndex == 0) break;
+                 pDevice->byBBPreEDIndex = 0;
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x24); //CR206(0xCE)
+@@ -1761,7 +1759,6 @@ void BBvUpdatePreEDThreshold(struct vnt_private *pDevice, int bScanning)
+         case RF_VT3342A0: //RobertYu:20060627, testing table
+             if( bScanning )
+             {   // need Max sensitivity  //RSSI -67, -68, ...
+-                if(pDevice->byBBPreEDIndex == 0) break;
+                 pDevice->byBBPreEDIndex = 0;
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x38); //CR206(0xCE)
+diff --git a/drivers/staging/vt6656/card.c b/drivers/staging/vt6656/card.c
+index 24291aee58b5..0beb246af4ad 100644
+--- a/drivers/staging/vt6656/card.c
++++ b/drivers/staging/vt6656/card.c
+@@ -761,7 +761,7 @@ u64 CARDqGetNextTBTT(u64 qwTSF, u16 wBeaconInterval)
+ 
+     uBeaconInterval = wBeaconInterval * 1024;
+     // Next TBTT = ((local_current_TSF / beacon_interval) + 1 ) * beacon_interval
+-	uLowNextTBTT = ((qwTSF & 0xffffffffU) >> 10) << 10;
++	uLowNextTBTT = ((qwTSF & 0xffffffffULL) >> 10) << 10;
+ 	uLowRemain = (uLowNextTBTT) % uBeaconInterval;
+ 	uHighRemain = ((0x80000000 % uBeaconInterval) * 2 * (u32)(qwTSF >> 32))
+ 		% uBeaconInterval;
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index b71a69750607..5b07fd156bd7 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -54,7 +54,7 @@
+ static LIST_HEAD(g_tiqn_list);
+ static LIST_HEAD(g_np_list);
+ static DEFINE_SPINLOCK(tiqn_lock);
+-static DEFINE_SPINLOCK(np_lock);
++static DEFINE_MUTEX(np_lock);
+ 
+ static struct idr tiqn_idr;
+ struct idr sess_idr;
+@@ -303,6 +303,9 @@ bool iscsit_check_np_match(
+ 	return false;
+ }
+ 
++/*
++ * Called with mutex np_lock held
++ */
+ static struct iscsi_np *iscsit_get_np(
+ 	struct __kernel_sockaddr_storage *sockaddr,
+ 	int network_transport)
+@@ -310,11 +313,10 @@ static struct iscsi_np *iscsit_get_np(
+ 	struct iscsi_np *np;
+ 	bool match;
+ 
+-	spin_lock_bh(&np_lock);
+ 	list_for_each_entry(np, &g_np_list, np_list) {
+-		spin_lock(&np->np_thread_lock);
++		spin_lock_bh(&np->np_thread_lock);
+ 		if (np->np_thread_state != ISCSI_NP_THREAD_ACTIVE) {
+-			spin_unlock(&np->np_thread_lock);
++			spin_unlock_bh(&np->np_thread_lock);
+ 			continue;
+ 		}
+ 
+@@ -326,13 +328,11 @@ static struct iscsi_np *iscsit_get_np(
+ 			 * while iscsi_tpg_add_network_portal() is called.
+ 			 */
+ 			np->np_exports++;
+-			spin_unlock(&np->np_thread_lock);
+-			spin_unlock_bh(&np_lock);
++			spin_unlock_bh(&np->np_thread_lock);
+ 			return np;
+ 		}
+-		spin_unlock(&np->np_thread_lock);
++		spin_unlock_bh(&np->np_thread_lock);
+ 	}
+-	spin_unlock_bh(&np_lock);
+ 
+ 	return NULL;
+ }
+@@ -346,16 +346,22 @@ struct iscsi_np *iscsit_add_np(
+ 	struct sockaddr_in6 *sock_in6;
+ 	struct iscsi_np *np;
+ 	int ret;
++
++	mutex_lock(&np_lock);
++
+ 	/*
+ 	 * Locate the existing struct iscsi_np if already active..
+ 	 */
+ 	np = iscsit_get_np(sockaddr, network_transport);
+-	if (np)
++	if (np) {
++		mutex_unlock(&np_lock);
+ 		return np;
++	}
+ 
+ 	np = kzalloc(sizeof(struct iscsi_np), GFP_KERNEL);
+ 	if (!np) {
+ 		pr_err("Unable to allocate memory for struct iscsi_np\n");
++		mutex_unlock(&np_lock);
+ 		return ERR_PTR(-ENOMEM);
+ 	}
+ 
+@@ -378,6 +384,7 @@ struct iscsi_np *iscsit_add_np(
+ 	ret = iscsi_target_setup_login_socket(np, sockaddr);
+ 	if (ret != 0) {
+ 		kfree(np);
++		mutex_unlock(&np_lock);
+ 		return ERR_PTR(ret);
+ 	}
+ 
+@@ -386,6 +393,7 @@ struct iscsi_np *iscsit_add_np(
+ 		pr_err("Unable to create kthread: iscsi_np\n");
+ 		ret = PTR_ERR(np->np_thread);
+ 		kfree(np);
++		mutex_unlock(&np_lock);
+ 		return ERR_PTR(ret);
+ 	}
+ 	/*
+@@ -396,10 +404,10 @@ struct iscsi_np *iscsit_add_np(
+ 	 * point because iscsi_np has not been added to g_np_list yet.
+ 	 */
+ 	np->np_exports = 1;
++	np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
+ 
+-	spin_lock_bh(&np_lock);
+ 	list_add_tail(&np->np_list, &g_np_list);
+-	spin_unlock_bh(&np_lock);
++	mutex_unlock(&np_lock);
+ 
+ 	pr_debug("CORE[0] - Added Network Portal: %s:%hu on %s\n",
+ 		np->np_ip, np->np_port, np->np_transport->name);
+@@ -469,9 +477,9 @@ int iscsit_del_np(struct iscsi_np *np)
+ 
+ 	np->np_transport->iscsit_free_np(np);
+ 
+-	spin_lock_bh(&np_lock);
++	mutex_lock(&np_lock);
+ 	list_del(&np->np_list);
+-	spin_unlock_bh(&np_lock);
++	mutex_unlock(&np_lock);
+ 
+ 	pr_debug("CORE[0] - Removed Network Portal: %s:%hu on %s\n",
+ 		np->np_ip, np->np_port, np->np_transport->name);
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index 86c00b1c5583..d28d7afc128a 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -2670,6 +2670,10 @@ static void serial8250_config_port(struct uart_port *port, int flags)
+ 	if (port->type == PORT_16550A && port->iotype == UPIO_AU)
+ 		up->bugs |= UART_BUG_NOMSR;
+ 
++	/* HW bugs may trigger IRQ while IIR == NO_INT */
++	if (port->type == PORT_TEGRA)
++		up->bugs |= UART_BUG_NOMSR;
++
+ 	if (port->type != PORT_UNKNOWN && flags & UART_CONFIG_IRQ)
+ 		autoconfig_irq(up);
+ 
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index c52948b368d8..8d3c0b5e2878 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1260,10 +1260,10 @@ static int pci_quatech_init(struct pci_dev *dev)
+ 		unsigned long base = pci_resource_start(dev, 0);
+ 		if (base) {
+ 			u32 tmp;
+-			outl(inl(base + 0x38), base + 0x38);
++			outl(inl(base + 0x38) | 0x00002000, base + 0x38);
+ 			tmp = inl(base + 0x3c);
+ 			outl(tmp | 0x01000000, base + 0x3c);
+-			outl(tmp, base + 0x3c);
++			outl(tmp &= ~0x01000000, base + 0x3c);
+ 		}
+ 	}
+ 	return 0;
+@@ -1545,6 +1545,7 @@ pci_wch_ch353_setup(struct serial_private *priv,
+ #define PCI_DEVICE_ID_TITAN_800E	0xA014
+ #define PCI_DEVICE_ID_TITAN_200EI	0xA016
+ #define PCI_DEVICE_ID_TITAN_200EISI	0xA017
++#define PCI_DEVICE_ID_TITAN_200V3	0xA306
+ #define PCI_DEVICE_ID_TITAN_400V3	0xA310
+ #define PCI_DEVICE_ID_TITAN_410V3	0xA312
+ #define PCI_DEVICE_ID_TITAN_800V3	0xA314
+@@ -4139,6 +4140,9 @@ static struct pci_device_id serial_pci_tbl[] = {
+ 	{	PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200EISI,
+ 		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ 		pbn_oxsemi_2_4000000 },
++	{	PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200V3,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_b0_bt_2_921600 },
+ 	{	PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_400V3,
+ 		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ 		pbn_b0_4_921600 },
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 3467462869ce..82127ac26d6f 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -1022,12 +1022,24 @@ static int atmel_startup(struct uart_port *port)
+ static void atmel_shutdown(struct uart_port *port)
+ {
+ 	struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
++
+ 	/*
+-	 * Ensure everything is stopped.
++	 * Clear out any scheduled tasklets before
++	 * we destroy the buffers
++	 */
++	tasklet_kill(&atmel_port->tasklet);
++
++	/*
++	 * Ensure everything is stopped and
++	 * disable all interrupts, port and break condition.
+ 	 */
+ 	atmel_stop_rx(port);
+ 	atmel_stop_tx(port);
+ 
++	UART_PUT_CR(port, ATMEL_US_RSTSTA);
++	UART_PUT_IDR(port, -1);
++
++
+ 	/*
+ 	 * Shut-down the DMA.
+ 	 */
+@@ -1054,12 +1066,6 @@ static void atmel_shutdown(struct uart_port *port)
+ 	}
+ 
+ 	/*
+-	 * Disable all interrupts, port and break condition.
+-	 */
+-	UART_PUT_CR(port, ATMEL_US_RSTSTA);
+-	UART_PUT_IDR(port, -1);
+-
+-	/*
+ 	 * Free the interrupt
+ 	 */
+ 	free_irq(port->irq, port);
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index a6b2cabe7930..548d1996590f 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -651,10 +651,6 @@ void usb_destroy_configuration(struct usb_device *dev)
+  *
+  * hub-only!! ... and only in reset path, or usb_new_device()
+  * (used by real hubs and virtual root hubs)
+- *
+- * NOTE: if this is a WUSB device and is not authorized, we skip the
+- *       whole thing. A non-authorized USB device has no
+- *       configurations.
+  */
+ int usb_get_configuration(struct usb_device *dev)
+ {
+@@ -666,8 +662,6 @@ int usb_get_configuration(struct usb_device *dev)
+ 	struct usb_config_descriptor *desc;
+ 
+ 	cfgno = 0;
+-	if (dev->authorized == 0)	/* Not really an error */
+-		goto out_not_authorized;
+ 	result = -ENOMEM;
+ 	if (ncfg > USB_MAXCONFIG) {
+ 		dev_warn(ddev, "too many configurations: %d, "
+@@ -751,7 +745,6 @@ int usb_get_configuration(struct usb_device *dev)
+ 
+ err:
+ 	kfree(desc);
+-out_not_authorized:
+ 	dev->descriptor.bNumConfigurations = cfgno;
+ err2:
+ 	if (result == -ENOMEM)
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 4d25bff2dac1..e604645a1290 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1605,7 +1605,7 @@ static void hub_disconnect(struct usb_interface *intf)
+ {
+ 	struct usb_hub *hub = usb_get_intfdata(intf);
+ 	struct usb_device *hdev = interface_to_usbdev(intf);
+-	int i;
++	int port1;
+ 
+ 	/* Take the hub off the event list and don't let it be added again */
+ 	spin_lock_irq(&hub_event_lock);
+@@ -1620,11 +1620,15 @@ static void hub_disconnect(struct usb_interface *intf)
+ 	hub->error = 0;
+ 	hub_quiesce(hub, HUB_DISCONNECT);
+ 
+-	usb_set_intfdata (intf, NULL);
++	/* Avoid races with recursively_mark_NOTATTACHED() */
++	spin_lock_irq(&device_state_lock);
++	port1 = hdev->maxchild;
++	hdev->maxchild = 0;
++	usb_set_intfdata(intf, NULL);
++	spin_unlock_irq(&device_state_lock);
+ 
+-	for (i = 0; i < hdev->maxchild; i++)
+-		usb_hub_remove_port_device(hub, i + 1);
+-	hub->hdev->maxchild = 0;
++	for (; port1 > 0; --port1)
++		usb_hub_remove_port_device(hub, port1);
+ 
+ 	if (hub->hdev->speed == USB_SPEED_HIGH)
+ 		highspeed_hubs--;
+@@ -2227,18 +2231,13 @@ static int usb_enumerate_device(struct usb_device *udev)
+ 			return err;
+ 		}
+ 	}
+-	if (udev->wusb == 1 && udev->authorized == 0) {
+-		udev->product = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+-		udev->manufacturer = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+-		udev->serial = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+-	}
+-	else {
+-		/* read the standard strings and cache them if present */
+-		udev->product = usb_cache_string(udev, udev->descriptor.iProduct);
+-		udev->manufacturer = usb_cache_string(udev,
+-						      udev->descriptor.iManufacturer);
+-		udev->serial = usb_cache_string(udev, udev->descriptor.iSerialNumber);
+-	}
++
++	/* read the standard strings and cache them if present */
++	udev->product = usb_cache_string(udev, udev->descriptor.iProduct);
++	udev->manufacturer = usb_cache_string(udev,
++					      udev->descriptor.iManufacturer);
++	udev->serial = usb_cache_string(udev, udev->descriptor.iSerialNumber);
++
+ 	err = usb_enumerate_device_otg(udev);
+ 	if (err < 0)
+ 		return err;
+@@ -2417,16 +2416,6 @@ int usb_deauthorize_device(struct usb_device *usb_dev)
+ 	usb_dev->authorized = 0;
+ 	usb_set_configuration(usb_dev, -1);
+ 
+-	kfree(usb_dev->product);
+-	usb_dev->product = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+-	kfree(usb_dev->manufacturer);
+-	usb_dev->manufacturer = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+-	kfree(usb_dev->serial);
+-	usb_dev->serial = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+-
+-	usb_destroy_configuration(usb_dev);
+-	usb_dev->descriptor.bNumConfigurations = 0;
+-
+ out_unauthorized:
+ 	usb_unlock_device(usb_dev);
+ 	return 0;
+@@ -2454,17 +2443,7 @@ int usb_authorize_device(struct usb_device *usb_dev)
+ 		goto error_device_descriptor;
+ 	}
+ 
+-	kfree(usb_dev->product);
+-	usb_dev->product = NULL;
+-	kfree(usb_dev->manufacturer);
+-	usb_dev->manufacturer = NULL;
+-	kfree(usb_dev->serial);
+-	usb_dev->serial = NULL;
+-
+ 	usb_dev->authorized = 1;
+-	result = usb_enumerate_device(usb_dev);
+-	if (result < 0)
+-		goto error_enumerate;
+ 	/* Choose and set the configuration.  This registers the interfaces
+ 	 * with the driver core and lets interface drivers bind to them.
+ 	 */
+@@ -2480,7 +2459,6 @@ int usb_authorize_device(struct usb_device *usb_dev)
+ 	}
+ 	dev_info(&usb_dev->dev, "authorized to connect\n");
+ 
+-error_enumerate:
+ error_device_descriptor:
+ 	usb_autosuspend_device(usb_dev);
+ error_autoresume:
+diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
+index 7c978b23520d..03322d9c70dc 100644
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -200,6 +200,7 @@ struct ehci_hcd {			/* one per controller */
+ 	unsigned		has_synopsys_hc_bug:1; /* Synopsys HC */
+ 	unsigned		frame_index_bug:1; /* MosChip (AKA NetMos) */
+ 	unsigned		need_oc_pp_cycle:1; /* MPC834X port power */
++	unsigned		imx28_write_fix:1; /* For Freescale i.MX28 */
+ 
+ 	/* required for usb32 quirk */
+ 	#define OHCI_CTRL_HCFS          (3 << 6)
+@@ -675,6 +676,18 @@ static inline unsigned int ehci_readl(const struct ehci_hcd *ehci,
+ #endif
+ }
+ 
++#ifdef CONFIG_SOC_IMX28
++static inline void imx28_ehci_writel(const unsigned int val,
++		volatile __u32 __iomem *addr)
++{
++	__asm__ ("swp %0, %0, [%1]" : : "r"(val), "r"(addr));
++}
++#else
++static inline void imx28_ehci_writel(const unsigned int val,
++		volatile __u32 __iomem *addr)
++{
++}
++#endif
+ static inline void ehci_writel(const struct ehci_hcd *ehci,
+ 		const unsigned int val, __u32 __iomem *regs)
+ {
+@@ -683,7 +696,10 @@ static inline void ehci_writel(const struct ehci_hcd *ehci,
+ 		writel_be(val, regs) :
+ 		writel(val, regs);
+ #else
+-	writel(val, regs);
++	if (ehci->imx28_write_fix)
++		imx28_ehci_writel(val, regs);
++	else
++		writel(val, regs);
+ #endif
+ }
+ 
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 4a5251f3614c..a90819b83224 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -315,6 +315,9 @@ static void xhci_cleanup_msix(struct xhci_hcd *xhci)
+ 	struct usb_hcd *hcd = xhci_to_hcd(xhci);
+ 	struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
+ 
++	if (xhci->quirks & XHCI_PLAT)
++		return;
++
+ 	xhci_free_irq(xhci);
+ 
+ 	if (xhci->msix_entries) {
+diff --git a/drivers/usb/serial/cypress_m8.h b/drivers/usb/serial/cypress_m8.h
+index b461311a2ae7..ce13e61b7d55 100644
+--- a/drivers/usb/serial/cypress_m8.h
++++ b/drivers/usb/serial/cypress_m8.h
+@@ -63,7 +63,7 @@
+ #define UART_DSR	0x20	/* data set ready - flow control - device to host */
+ #define CONTROL_RTS	0x10	/* request to send - flow control - host to device */
+ #define UART_CTS	0x10	/* clear to send - flow control - device to host */
+-#define UART_RI		0x10	/* ring indicator - modem - device to host */
++#define UART_RI		0x80	/* ring indicator - modem - device to host */
+ #define UART_CD		0x40	/* carrier detect - modem - device to host */
+ #define CYP_ERROR	0x08	/* received from input report - device to host */
+ /* Note - the below has nothing to do with the "feature report" reset */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 92549cc4665f..089248c1d597 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -2132,10 +2132,20 @@ static void ftdi_set_termios(struct tty_struct *tty,
+ 	}
+ 
+ 	/*
+-	 * All FTDI UART chips are limited to CS7/8. We won't pretend to
++	 * All FTDI UART chips are limited to CS7/8. We shouldn't pretend to
+ 	 * support CS5/6 and revert the CSIZE setting instead.
++	 *
++	 * CS5 however is used to control some smartcard readers which abuse
++	 * this limitation to switch modes. Original FTDI chips fall back to
++	 * eight data bits.
++	 *
++	 * TODO: Implement a quirk to only allow this with mentioned
++	 *       readers. One I know of (Argolis Smartreader V1)
++	 *       returns "USB smartcard server" as iInterface string.
++	 *       The vendor didn't bother with a custom VID/PID of
++	 *       course.
+ 	 */
+-	if ((C_CSIZE(tty) != CS8) && (C_CSIZE(tty) != CS7)) {
++	if (C_CSIZE(tty) == CS6) {
+ 		dev_warn(ddev, "requested CSIZE setting not supported\n");
+ 
+ 		termios->c_cflag &= ~CSIZE;
+@@ -2182,6 +2192,9 @@ no_skip:
+ 		urb_value |= FTDI_SIO_SET_DATA_PARITY_NONE;
+ 	}
+ 	switch (cflag & CSIZE) {
++	case CS5:
++		dev_dbg(ddev, "Setting CS5 quirk\n");
++		break;
+ 	case CS7:
+ 		urb_value |= 7;
+ 		dev_dbg(ddev, "Setting CS7\n");
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index cc7a24154490..5c86f57e4afa 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -320,6 +320,9 @@ static void option_instat_callback(struct urb *urb);
+  * It seems to contain a Qualcomm QSC6240/6290 chipset            */
+ #define FOUR_G_SYSTEMS_PRODUCT_W14		0x9603
+ 
++/* iBall 3.5G connect wireless modem */
++#define IBALL_3_5G_CONNECT			0x9605
++
+ /* Zoom */
+ #define ZOOM_PRODUCT_4597			0x9607
+ 
+@@ -1447,6 +1450,17 @@ static const struct usb_device_id option_ids[] = {
+ 		.driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff),
+ 		.driver_info = (kernel_ulong_t)&net_intf3_blacklist },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8e, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8f, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff90, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff91, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) },
+ 
+ 	/* NOTE: most ZTE CDMA devices should be driven by zte_ev, not option */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff),
+@@ -1489,6 +1503,7 @@ static const struct usb_device_id option_ids[] = {
+   	  .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
+   	},
+ 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
++	{ USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
+ 	{ USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
+ 	/* Pirelli  */
+ 	{ USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1, 0xff) },
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 5e39f5c4941b..4471f464ca26 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -141,6 +141,8 @@ struct pl2303_private {
+ 	spinlock_t lock;
+ 	u8 line_control;
+ 	u8 line_status;
++
++	u8 line_settings[7];
+ };
+ 
+ static int pl2303_vendor_read(__u16 value, __u16 index,
+@@ -280,10 +282,6 @@ static void pl2303_set_termios(struct tty_struct *tty,
+ 	int baud_floor, baud_ceil;
+ 	int k;
+ 
+-	/* The PL2303 is reported to lose bytes if you change
+-	   serial settings even to the same values as before. Thus
+-	   we actually need to filter in this specific case */
+-
+ 	if (old_termios && !tty_termios_hw_change(&tty->termios, old_termios))
+ 		return;
+ 
+@@ -422,10 +420,29 @@ static void pl2303_set_termios(struct tty_struct *tty,
+ 		dev_dbg(&port->dev, "parity = none\n");
+ 	}
+ 
+-	i = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
+-			    SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE,
+-			    0, 0, buf, 7, 100);
+-	dev_dbg(&port->dev, "0x21:0x20:0:0  %d\n", i);
++	/*
++	 * Some PL2303 are known to lose bytes if you change serial settings
++	 * even to the same values as before. Thus we actually need to filter
++	 * in this specific case.
++	 *
++	 * Note that the tty_termios_hw_change check above is not sufficient
++	 * as a previously requested baud rate may differ from the one
++	 * actually used (and stored in old_termios).
++	 *
++	 * NOTE: No additional locking needed for line_settings as it is
++	 *       only used in set_termios, which is serialised against itself.
++	 */
++	if (!old_termios || memcmp(buf, priv->line_settings, 7)) {
++		i = usb_control_msg(serial->dev,
++				    usb_sndctrlpipe(serial->dev, 0),
++				    SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE,
++				    0, 0, buf, 7, 100);
++
++		dev_dbg(&port->dev, "0x21:0x20:0:0  %d\n", i);
++
++		if (i == 7)
++			memcpy(priv->line_settings, buf, 7);
++	}
+ 
+ 	/* change control lines if we are switching to or from B0 */
+ 	spin_lock_irqsave(&priv->lock, flags);
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index de32cfa5bfa6..ad06255c2ade 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -234,6 +234,13 @@ UNUSUAL_DEV(  0x0421, 0x0495, 0x0370, 0x0370,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_MAX_SECTORS_64 ),
+ 
++/* Patch submitted by Mikhail Zolotaryov <lebon@×××××××××.ua> */
++UNUSUAL_DEV(  0x0421, 0x06aa, 0x1110, 0x1110,
++		"Nokia",
++		"502",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_MAX_SECTORS_64 ),
++
+ #ifdef NO_SDDR09
+ UNUSUAL_DEV(  0x0436, 0x0005, 0x0100, 0x0100,
+ 		"Microtech",
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 3b6d20bc2388..bbafa05519da 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -7491,7 +7491,7 @@ out:
+ 	 */
+ 	if (root_dropped == false)
+ 		btrfs_add_dead_root(root);
+-	if (err)
++	if (err && err != -EAGAIN)
+ 		btrfs_std_error(root->fs_info, err);
+ 	return err;
+ }
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 145b2c75ab83..783906c687b5 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -1528,6 +1528,12 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
+ 			printk(KERN_INFO "btrfs: Snapshot src from "
+ 			       "another FS\n");
+ 			ret = -EINVAL;
++		} else if (!inode_owner_or_capable(src_inode)) {
++			/*
++			 * Subvolume creation is not restricted, but snapshots
++			 * are limited to own subvolumes only
++			 */
++			ret = -EPERM;
+ 		} else {
+ 			ret = btrfs_mksubvol(&file->f_path, name, namelen,
+ 					     BTRFS_I(src_inode)->root,
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 33331b4c2178..e350be6c7ac6 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1957,9 +1957,11 @@ void ext4_inline_data_truncate(struct inode *inode, int *has_inline)
+ 		}
+ 
+ 		/* Clear the content within i_blocks. */
+-		if (i_size < EXT4_MIN_INLINE_DATA_SIZE)
+-			memset(ext4_raw_inode(&is.iloc)->i_block + i_size, 0,
+-					EXT4_MIN_INLINE_DATA_SIZE - i_size);
++		if (i_size < EXT4_MIN_INLINE_DATA_SIZE) {
++			void *p = (void *) ext4_raw_inode(&is.iloc)->i_block;
++			memset(p + i_size, 0,
++			       EXT4_MIN_INLINE_DATA_SIZE - i_size);
++		}
+ 
+ 		EXT4_I(inode)->i_inline_size = i_size <
+ 					EXT4_MIN_INLINE_DATA_SIZE ?
+diff --git a/fs/mount.h b/fs/mount.h
+index 64a858143ff9..68d80bdcd081 100644
+--- a/fs/mount.h
++++ b/fs/mount.h
+@@ -73,7 +73,7 @@ static inline int mnt_has_parent(struct mount *mnt)
+ static inline int is_mounted(struct vfsmount *mnt)
+ {
+ 	/* neither detached nor internal? */
+-	return !IS_ERR_OR_NULL(real_mount(mnt));
++	return !IS_ERR_OR_NULL(real_mount(mnt)->mnt_ns);
+ }
+ 
+ extern struct mount *__lookup_mnt(struct vfsmount *, struct dentry *, int);
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index feaf0c7fb7d8..c8958f563116 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -31,6 +31,7 @@ struct hugepage_subpool *hugepage_new_subpool(long nr_blocks);
+ void hugepage_put_subpool(struct hugepage_subpool *spool);
+ 
+ int PageHuge(struct page *page);
++int PageHeadHuge(struct page *page_head);
+ 
+ void reset_vma_resv_huge_pages(struct vm_area_struct *vma);
+ int hugetlb_sysctl_handler(struct ctl_table *, int, void __user *, size_t *, loff_t *);
+@@ -98,6 +99,11 @@ static inline int PageHuge(struct page *page)
+ 	return 0;
+ }
+ 
++static inline int PageHeadHuge(struct page *page_head)
++{
++	return 0;
++}
++
+ static inline void reset_vma_resv_huge_pages(struct vm_area_struct *vma)
+ {
+ }
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 9a4c194ebc8a..f33619d8ac52 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -400,6 +400,8 @@ enum {
+ 	ATA_HORKAGE_DUMP_ID	= (1 << 16),	/* dump IDENTIFY data */
+ 	ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17),	/* Set max sects to 65535 */
+ 	ATA_HORKAGE_ATAPI_DMADIR = (1 << 18),	/* device requires dmadir */
++	ATA_HORKAGE_NOLPM	= (1 << 20),	/* don't use LPM */
++	ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21),	/* some WDs have broken LPM */
+ 
+ 	 /* DMA mask for user DMA control: User visible values; DO NOT
+ 	    renumber */
+diff --git a/lib/decompress_inflate.c b/lib/decompress_inflate.c
+index 19ff89e34eec..d619b28c456f 100644
+--- a/lib/decompress_inflate.c
++++ b/lib/decompress_inflate.c
+@@ -48,7 +48,7 @@ STATIC int INIT gunzip(unsigned char *buf, int len,
+ 		out_len = 0x8000; /* 32 K */
+ 		out_buf = malloc(out_len);
+ 	} else {
+-		out_len = 0x7fffffff; /* no limit */
++		out_len = ((size_t)~0) - (size_t)out_buf; /* no limit */
+ 	}
+ 	if (!out_buf) {
+ 		error("Out of memory while allocating output buffer");
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 7c5eb85ec645..40ad2c6e0ca9 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -690,6 +690,23 @@ int PageHuge(struct page *page)
+ }
+ EXPORT_SYMBOL_GPL(PageHuge);
+ 
++/*
++ * PageHeadHuge() only returns true for hugetlbfs head page, but not for
++ * normal or transparent huge pages.
++ */
++int PageHeadHuge(struct page *page_head)
++{
++	compound_page_dtor *dtor;
++
++	if (!PageHead(page_head))
++		return 0;
++
++	dtor = get_compound_page_dtor(page_head);
++
++	return dtor == free_huge_page;
++}
++EXPORT_SYMBOL_GPL(PageHeadHuge);
++
+ pgoff_t __basepage_index(struct page *page)
+ {
+ 	struct page *page_head = compound_head(page);
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 4baf12e534d1..6c2dace665aa 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2801,7 +2801,7 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol)
+ 	 */
+ 	VM_BUG_ON(maxlen < strlen("interleave") + strlen("relative") + 16);
+ 
+-	if (!pol || pol == &default_policy)
++	if (!pol || pol == &default_policy || (pol->flags & MPOL_F_MORON))
+ 		mode = MPOL_DEFAULT;
+ 	else
+ 		mode = pol->mode;
+diff --git a/mm/swap.c b/mm/swap.c
+index 9f2225f2b5b0..ea58dbde788e 100644
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -79,19 +79,6 @@ static void __put_compound_page(struct page *page)
+ 
+ static void put_compound_page(struct page *page)
+ {
+-	/*
+-	 * hugetlbfs pages cannot be split from under us.  If this is a
+-	 * hugetlbfs page, check refcount on head page and release the page if
+-	 * the refcount becomes zero.
+-	 */
+-	if (PageHuge(page)) {
+-		page = compound_head(page);
+-		if (put_page_testzero(page))
+-			__put_compound_page(page);
+-
+-		return;
+-	}
+-
+ 	if (unlikely(PageTail(page))) {
+ 		/* __split_huge_page_refcount can run under us */
+ 		struct page *page_head = compound_trans_head(page);
+@@ -108,14 +95,31 @@ static void put_compound_page(struct page *page)
+ 			 * still hot on arches that do not support
+ 			 * this_cpu_cmpxchg_double().
+ 			 */
+-			if (PageSlab(page_head)) {
+-				if (PageTail(page)) {
++			if (PageSlab(page_head) || PageHeadHuge(page_head)) {
++				if (likely(PageTail(page))) {
++					/*
++					 * __split_huge_page_refcount
++					 * cannot race here.
++					 */
++					VM_BUG_ON(!PageHead(page_head));
++					atomic_dec(&page->_mapcount);
+ 					if (put_page_testzero(page_head))
+ 						VM_BUG_ON(1);
+-
+-					atomic_dec(&page->_mapcount);
+-					goto skip_lock_tail;
++					if (put_page_testzero(page_head))
++						__put_compound_page(page_head);
++					return;
+ 				} else
++					/*
++					 * __split_huge_page_refcount
++					 * run before us, "page" was a
++					 * THP tail. The split
++					 * page_head has been freed
++					 * and reallocated as slab or
++					 * hugetlbfs page of smaller
++					 * order (only possible if
++					 * reallocated as slab on
++					 * x86).
++					 */
+ 					goto skip_lock;
+ 			}
+ 			/*
+@@ -129,8 +133,27 @@ static void put_compound_page(struct page *page)
+ 				/* __split_huge_page_refcount run before us */
+ 				compound_unlock_irqrestore(page_head, flags);
+ skip_lock:
+-				if (put_page_testzero(page_head))
+-					__put_single_page(page_head);
++				if (put_page_testzero(page_head)) {
++					/*
++					 * The head page may have been
++					 * freed and reallocated as a
++					 * compound page of smaller
++					 * order and then freed again.
++					 * All we know is that it
++					 * cannot have become: a THP
++					 * page, a compound page of
++					 * higher order, a tail page.
++					 * That is because we still
++					 * hold the refcount of the
++					 * split THP tail and
++					 * page_head was the THP head
++					 * before the split.
++					 */
++					if (PageHead(page_head))
++						__put_compound_page(page_head);
++					else
++						__put_single_page(page_head);
++				}
+ out_put_single:
+ 				if (put_page_testzero(page))
+ 					__put_single_page(page);
+@@ -152,7 +175,6 @@ out_put_single:
+ 			VM_BUG_ON(atomic_read(&page->_count) != 0);
+ 			compound_unlock_irqrestore(page_head, flags);
+ 
+-skip_lock_tail:
+ 			if (put_page_testzero(page_head)) {
+ 				if (PageHead(page_head))
+ 					__put_compound_page(page_head);
+@@ -195,51 +217,52 @@ bool __get_page_tail(struct page *page)
+ 	 * proper PT lock that already serializes against
+ 	 * split_huge_page().
+ 	 */
++	unsigned long flags;
+ 	bool got = false;
+-	struct page *page_head;
+-
+-	/*
+-	 * If this is a hugetlbfs page it cannot be split under us.  Simply
+-	 * increment refcount for the head page.
+-	 */
+-	if (PageHuge(page)) {
+-		page_head = compound_head(page);
+-		atomic_inc(&page_head->_count);
+-		got = true;
+-	} else {
+-		unsigned long flags;
++	struct page *page_head = compound_trans_head(page);
+ 
+-		page_head = compound_trans_head(page);
+-		if (likely(page != page_head &&
+-					get_page_unless_zero(page_head))) {
+-
+-			/* Ref to put_compound_page() comment. */
+-			if (PageSlab(page_head)) {
+-				if (likely(PageTail(page))) {
+-					__get_page_tail_foll(page, false);
+-					return true;
+-				} else {
+-					put_page(page_head);
+-					return false;
+-				}
+-			}
+-
+-			/*
+-			 * page_head wasn't a dangling pointer but it
+-			 * may not be a head page anymore by the time
+-			 * we obtain the lock. That is ok as long as it
+-			 * can't be freed from under us.
+-			 */
+-			flags = compound_lock_irqsave(page_head);
+-			/* here __split_huge_page_refcount won't run anymore */
++	if (likely(page != page_head && get_page_unless_zero(page_head))) {
++		/* Ref to put_compound_page() comment. */
++		if (PageSlab(page_head) || PageHeadHuge(page_head)) {
+ 			if (likely(PageTail(page))) {
++				/*
++				 * This is a hugetlbfs page or a slab
++				 * page. __split_huge_page_refcount
++				 * cannot race here.
++				 */
++				VM_BUG_ON(!PageHead(page_head));
+ 				__get_page_tail_foll(page, false);
+-				got = true;
+-			}
+-			compound_unlock_irqrestore(page_head, flags);
+-			if (unlikely(!got))
++				return true;
++			} else {
++				/*
++				 * __split_huge_page_refcount run
++				 * before us, "page" was a THP
++				 * tail. The split page_head has been
++				 * freed and reallocated as slab or
++				 * hugetlbfs page of smaller order
++				 * (only possible if reallocated as
++				 * slab on x86).
++				 */
+ 				put_page(page_head);
++				return false;
++			}
++		}
++
++		/*
++		 * page_head wasn't a dangling pointer but it
++		 * may not be a head page anymore by the time
++		 * we obtain the lock. That is ok as long as it
++		 * can't be freed from under us.
++		 */
++		flags = compound_lock_irqsave(page_head);
++		/* here __split_huge_page_refcount won't run anymore */
++		if (likely(PageTail(page))) {
++			__get_page_tail_foll(page, false);
++			got = true;
+ 		}
++		compound_unlock_irqrestore(page_head, flags);
++		if (unlikely(!got))
++			put_page(page_head);
+ 	}
+ 	return got;
+ }
+diff --git a/net/compat.c b/net/compat.c
+index dd32e34c1e2c..f50161fb812e 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -780,21 +780,16 @@ asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
+ 	if (flags & MSG_CMSG_COMPAT)
+ 		return -EINVAL;
+ 
+-	if (COMPAT_USE_64BIT_TIME)
+-		return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+-				      flags | MSG_CMSG_COMPAT,
+-				      (struct timespec *) timeout);
+-
+ 	if (timeout == NULL)
+ 		return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ 				      flags | MSG_CMSG_COMPAT, NULL);
+ 
+-	if (get_compat_timespec(&ktspec, timeout))
++	if (compat_get_timespec(&ktspec, timeout))
+ 		return -EFAULT;
+ 
+ 	datagrams = __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ 				   flags | MSG_CMSG_COMPAT, &ktspec);
+-	if (datagrams > 0 && put_compat_timespec(&ktspec, timeout))
++	if (datagrams > 0 && compat_put_timespec(&ktspec, timeout))
+ 		datagrams = -EFAULT;
+ 
+ 	return datagrams;
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 6438f29ff266..52f01229ee01 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -36,7 +36,6 @@
+ #include <asm/uaccess.h>
+ #include <asm/unaligned.h>
+ #include <linux/filter.h>
+-#include <linux/reciprocal_div.h>
+ #include <linux/ratelimit.h>
+ #include <linux/seccomp.h>
+ #include <linux/if_vlan.h>
+@@ -166,7 +165,7 @@ unsigned int sk_run_filter(const struct sk_buff *skb,
+ 			A /= X;
+ 			continue;
+ 		case BPF_S_ALU_DIV_K:
+-			A = reciprocal_divide(A, K);
++			A /= K;
+ 			continue;
+ 		case BPF_S_ALU_MOD_X:
+ 			if (X == 0)
+@@ -553,11 +552,6 @@ int sk_chk_filter(struct sock_filter *filter, unsigned int flen)
+ 		/* Some instructions need special checks */
+ 		switch (code) {
+ 		case BPF_S_ALU_DIV_K:
+-			/* check for division by zero */
+-			if (ftest->k == 0)
+-				return -EINVAL;
+-			ftest->k = reciprocal_value(ftest->k);
+-			break;
+ 		case BPF_S_ALU_MOD_K:
+ 			/* check for division by zero */
+ 			if (ftest->k == 0)
+@@ -853,27 +847,7 @@ void sk_decode_filter(struct sock_filter *filt, struct sock_filter *to)
+ 	to->code = decodes[code];
+ 	to->jt = filt->jt;
+ 	to->jf = filt->jf;
+-
+-	if (code == BPF_S_ALU_DIV_K) {
+-		/*
+-		 * When loaded this rule user gave us X, which was
+-		 * translated into R = r(X). Now we calculate the
+-		 * RR = r(R) and report it back. If next time this
+-		 * value is loaded and RRR = r(RR) is calculated
+-		 * then the R == RRR will be true.
+-		 *
+-		 * One exception. X == 1 translates into R == 0 and
+-		 * we can't calculate RR out of it with r().
+-		 */
+-
+-		if (filt->k == 0)
+-			to->k = 1;
+-		else
+-			to->k = reciprocal_value(filt->k);
+-
+-		BUG_ON(reciprocal_value(to->k) != filt->k);
+-	} else
+-		to->k = filt->k;
++	to->k = filt->k;
+ }
+ 
+ int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf, unsigned int len)
+diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
+index 22b1a7058fd3..4efd2375d7e1 100644
+--- a/net/ieee802154/nl-phy.c
++++ b/net/ieee802154/nl-phy.c
+@@ -224,8 +224,10 @@ static int ieee802154_add_iface(struct sk_buff *skb,
+ 
+ 	if (info->attrs[IEEE802154_ATTR_DEV_TYPE]) {
+ 		type = nla_get_u8(info->attrs[IEEE802154_ATTR_DEV_TYPE]);
+-		if (type >= __IEEE802154_DEV_MAX)
+-			return -EINVAL;
++		if (type >= __IEEE802154_DEV_MAX) {
++			rc = -EINVAL;
++			goto nla_put_failure;
++		}
+ 	}
+ 
+ 	dev = phy->add_iface(phy, devname, type);
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index c7629a209f9d..4556cd25acde 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -1049,6 +1049,8 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
+ 	}
+ 
+ 	in_dev = __in_dev_get_rtnl(dev);
++	if (!in_dev)
++		return NOTIFY_DONE;
+ 
+ 	switch (event) {
+ 	case NETDEV_UP:
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index 31cf54d18221..45dbdab915e2 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -961,7 +961,7 @@ next_normal:
+ 			++num;
+ 		}
+ 
+-		if (r->idiag_states & TCPF_TIME_WAIT) {
++		if (r->idiag_states & (TCPF_TIME_WAIT | TCPF_FIN_WAIT2)) {
+ 			struct inet_timewait_sock *tw;
+ 
+ 			inet_twsk_for_each(tw, node,
+@@ -971,6 +971,8 @@ next_normal:
+ 
+ 				if (num < s_num)
+ 					goto next_dying;
++				if (!(r->idiag_states & (1 << tw->tw_substate)))
++					goto next_dying;
+ 				if (r->sdiag_family != AF_UNSPEC &&
+ 						tw->tw_family != r->sdiag_family)
+ 					goto next_dying;
+diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
+index 15e3e683adec..0a22bb0ce1a8 100644
+--- a/net/ipv4/ip_input.c
++++ b/net/ipv4/ip_input.c
+@@ -313,7 +313,7 @@ static int ip_rcv_finish(struct sk_buff *skb)
+ 	const struct iphdr *iph = ip_hdr(skb);
+ 	struct rtable *rt;
+ 
+-	if (sysctl_ip_early_demux && !skb_dst(skb)) {
++	if (sysctl_ip_early_demux && !skb_dst(skb) && skb->sk == NULL) {
+ 		const struct net_protocol *ipprot;
+ 		int protocol = iph->protocol;
+ 
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 46dcf32c012e..fa6573264c8a 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -636,6 +636,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 				tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
+ 			tunnel->err_count--;
+ 
++			memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ 			dst_link_failure(skb);
+ 		} else
+ 			tunnel->err_count = 0;
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 2c581da1fcab..7dbad6835843 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -157,9 +157,12 @@ static struct mr_table *ipmr_get_table(struct net *net, u32 id)
+ static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4,
+ 			   struct mr_table **mrt)
+ {
+-	struct ipmr_result res;
+-	struct fib_lookup_arg arg = { .result = &res, };
+ 	int err;
++	struct ipmr_result res;
++	struct fib_lookup_arg arg = {
++		.result = &res,
++		.flags = FIB_LOOKUP_NOREF,
++	};
+ 
+ 	err = fib_rules_lookup(net->ipv4.mr_rules_ops,
+ 			       flowi4_to_flowi(flp4), 0, &arg);
+diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
+index 306dbd9a9441..b500d2ddc476 100644
+--- a/net/ipv4/tcp_metrics.c
++++ b/net/ipv4/tcp_metrics.c
+@@ -22,6 +22,9 @@
+ 
+ int sysctl_tcp_nometrics_save __read_mostly;
+ 
++static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *addr,
++						   struct net *net, unsigned int hash);
++
+ struct tcp_fastopen_metrics {
+ 	u16	mss;
+ 	u16	syn_loss:10;		/* Recurring Fast Open SYN losses */
+@@ -130,16 +133,41 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm, struct dst_entry *dst,
+ 	}
+ }
+ 
++#define TCP_METRICS_TIMEOUT		(60 * 60 * HZ)
++
++static void tcpm_check_stamp(struct tcp_metrics_block *tm, struct dst_entry *dst)
++{
++	if (tm && unlikely(time_after(jiffies, tm->tcpm_stamp + TCP_METRICS_TIMEOUT)))
++		tcpm_suck_dst(tm, dst, false);
++}
++
++#define TCP_METRICS_RECLAIM_DEPTH	5
++#define TCP_METRICS_RECLAIM_PTR		(struct tcp_metrics_block *) 0x1UL
++
+ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
+ 					  struct inetpeer_addr *addr,
+-					  unsigned int hash,
+-					  bool reclaim)
++					  unsigned int hash)
+ {
+ 	struct tcp_metrics_block *tm;
+ 	struct net *net;
++	bool reclaim = false;
+ 
+ 	spin_lock_bh(&tcp_metrics_lock);
+ 	net = dev_net(dst->dev);
++
++	/* While waiting for the spin-lock the cache might have been populated
++	 * with this entry and so we have to check again.
++	 */
++	tm = __tcp_get_metrics(addr, net, hash);
++	if (tm == TCP_METRICS_RECLAIM_PTR) {
++		reclaim = true;
++		tm = NULL;
++	}
++	if (tm) {
++		tcpm_check_stamp(tm, dst);
++		goto out_unlock;
++	}
++
+ 	if (unlikely(reclaim)) {
+ 		struct tcp_metrics_block *oldest;
+ 
+@@ -169,17 +197,6 @@ out_unlock:
+ 	return tm;
+ }
+ 
+-#define TCP_METRICS_TIMEOUT		(60 * 60 * HZ)
+-
+-static void tcpm_check_stamp(struct tcp_metrics_block *tm, struct dst_entry *dst)
+-{
+-	if (tm && unlikely(time_after(jiffies, tm->tcpm_stamp + TCP_METRICS_TIMEOUT)))
+-		tcpm_suck_dst(tm, dst, false);
+-}
+-
+-#define TCP_METRICS_RECLAIM_DEPTH	5
+-#define TCP_METRICS_RECLAIM_PTR		(struct tcp_metrics_block *) 0x1UL
+-
+ static struct tcp_metrics_block *tcp_get_encode(struct tcp_metrics_block *tm, int depth)
+ {
+ 	if (tm)
+@@ -280,7 +297,6 @@ static struct tcp_metrics_block *tcp_get_metrics(struct sock *sk,
+ 	struct inetpeer_addr addr;
+ 	unsigned int hash;
+ 	struct net *net;
+-	bool reclaim;
+ 
+ 	addr.family = sk->sk_family;
+ 	switch (addr.family) {
+@@ -300,13 +316,10 @@ static struct tcp_metrics_block *tcp_get_metrics(struct sock *sk,
+ 	hash = hash_32(hash, net->ipv4.tcp_metrics_hash_log);
+ 
+ 	tm = __tcp_get_metrics(&addr, net, hash);
+-	reclaim = false;
+-	if (tm == TCP_METRICS_RECLAIM_PTR) {
+-		reclaim = true;
++	if (tm == TCP_METRICS_RECLAIM_PTR)
+ 		tm = NULL;
+-	}
+ 	if (!tm && create)
+-		tm = tcpm_new(dst, &addr, hash, reclaim);
++		tm = tcpm_new(dst, &addr, hash);
+ 	else
+ 		tcpm_check_stamp(tm, dst);
+ 
+diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
+index 2bab2aa59745..774b09cb2920 100644
+--- a/net/ipv6/ip6_input.c
++++ b/net/ipv6/ip6_input.c
+@@ -49,7 +49,7 @@
+ 
+ int ip6_rcv_finish(struct sk_buff *skb)
+ {
+-	if (sysctl_ip_early_demux && !skb_dst(skb)) {
++	if (sysctl_ip_early_demux && !skb_dst(skb) && skb->sk == NULL) {
+ 		const struct inet6_protocol *ipprot;
+ 
+ 		ipprot = rcu_dereference(inet6_protos[ipv6_hdr(skb)->nexthdr]);
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 209bb4d6e188..f21cf476b00c 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1617,6 +1617,15 @@ static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
+ 	return ip6_tnl_update(t, &p);
+ }
+ 
++static void ip6_tnl_dellink(struct net_device *dev, struct list_head *head)
++{
++	struct net *net = dev_net(dev);
++	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
++
++	if (dev != ip6n->fb_tnl_dev)
++		unregister_netdevice_queue(dev, head);
++}
++
+ static size_t ip6_tnl_get_size(const struct net_device *dev)
+ {
+ 	return
+@@ -1681,6 +1690,7 @@ static struct rtnl_link_ops ip6_link_ops __read_mostly = {
+ 	.validate	= ip6_tnl_validate,
+ 	.newlink	= ip6_tnl_newlink,
+ 	.changelink	= ip6_tnl_changelink,
++	.dellink	= ip6_tnl_dellink,
+ 	.get_size	= ip6_tnl_get_size,
+ 	.fill_info	= ip6_tnl_fill_info,
+ };
+@@ -1711,6 +1721,8 @@ static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
+ 		}
+ 	}
+ 
++	t = rtnl_dereference(ip6n->tnls_wc[0]);
++	unregister_netdevice_queue(t->dev, &list);
+ 	unregister_netdevice_many(&list);
+ }
+ 
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index 4b421249532f..9f44ebc17759 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -141,9 +141,12 @@ static struct mr6_table *ip6mr_get_table(struct net *net, u32 id)
+ static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
+ 			    struct mr6_table **mrt)
+ {
+-	struct ip6mr_result res;
+-	struct fib_lookup_arg arg = { .result = &res, };
+ 	int err;
++	struct ip6mr_result res;
++	struct fib_lookup_arg arg = {
++		.result = &res,
++		.flags = FIB_LOOKUP_NOREF,
++	};
+ 
+ 	err = fib_rules_lookup(net->ipv6.mr6_rules_ops,
+ 			       flowi6_to_flowi(flp6), 0, &arg);
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 0491264b8bfc..620d326e8fdd 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1507,6 +1507,15 @@ static const struct nla_policy ipip6_policy[IFLA_IPTUN_MAX + 1] = {
+ #endif
+ };
+ 
++static void ipip6_dellink(struct net_device *dev, struct list_head *head)
++{
++	struct net *net = dev_net(dev);
++	struct sit_net *sitn = net_generic(net, sit_net_id);
++
++	if (dev != sitn->fb_tunnel_dev)
++		unregister_netdevice_queue(dev, head);
++}
++
+ static struct rtnl_link_ops sit_link_ops __read_mostly = {
+ 	.kind		= "sit",
+ 	.maxtype	= IFLA_IPTUN_MAX,
+@@ -1517,6 +1526,7 @@ static struct rtnl_link_ops sit_link_ops __read_mostly = {
+ 	.changelink	= ipip6_changelink,
+ 	.get_size	= ipip6_get_size,
+ 	.fill_info	= ipip6_fill_info,
++	.dellink	= ipip6_dellink,
+ };
+ 
+ static struct xfrm_tunnel sit_handler __read_mostly = {
+diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
+index 8eb9501e3d60..b7ebe23cdedf 100644
+--- a/net/rds/ib_recv.c
++++ b/net/rds/ib_recv.c
+@@ -421,8 +421,7 @@ static void rds_ib_recv_cache_put(struct list_head *new_item,
+ 				 struct rds_ib_refill_cache *cache)
+ {
+ 	unsigned long flags;
+-	struct list_head *old;
+-	struct list_head __percpu *chpfirst;
++	struct list_head *old, *chpfirst;
+ 
+ 	local_irq_save(flags);
+ 
+@@ -432,7 +431,7 @@ static void rds_ib_recv_cache_put(struct list_head *new_item,
+ 	else /* put on front */
+ 		list_add_tail(new_item, chpfirst);
+ 
+-	__this_cpu_write(chpfirst, new_item);
++	__this_cpu_write(cache->percpu->first, new_item);
+ 	__this_cpu_inc(cache->percpu->count);
+ 
+ 	if (__this_cpu_read(cache->percpu->count) < RDS_IB_RECYCLE_BATCH_COUNT)
+@@ -452,7 +451,7 @@ static void rds_ib_recv_cache_put(struct list_head *new_item,
+ 	} while (old);
+ 
+ 
+-	__this_cpu_write(chpfirst, NULL);
++	__this_cpu_write(cache->percpu->first, NULL);
+ 	__this_cpu_write(cache->percpu->count, 0);
+ end:
+ 	local_irq_restore(flags);
+diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig
+index fe6fa93a6262..daac7c7ebe9e 100644
+--- a/sound/pci/Kconfig
++++ b/sound/pci/Kconfig
+@@ -30,6 +30,7 @@ config SND_ALS300
+ 	select SND_PCM
+ 	select SND_AC97_CODEC
+ 	select SND_OPL3_LIB
++	select ZONE_DMA
+ 	help
+ 	  Say 'Y' or 'M' to include support for Avance Logic ALS300/ALS300+
+ 
+@@ -54,6 +55,7 @@ config SND_ALI5451
+ 	tristate "ALi M5451 PCI Audio Controller"
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for the integrated AC97 sound
+ 	  device on motherboards using the ALi M5451 Audio Controller
+@@ -158,6 +160,7 @@ config SND_AZT3328
+ 	select SND_PCM
+ 	select SND_RAWMIDI
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for Aztech AZF3328 (PCI168)
+ 	  soundcards.
+@@ -463,6 +466,7 @@ config SND_EMU10K1
+ 	select SND_HWDEP
+ 	select SND_RAWMIDI
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y to include support for Sound Blaster PCI 512, Live!,
+ 	  Audigy and E-mu APS (partially supported) soundcards.
+@@ -478,6 +482,7 @@ config SND_EMU10K1X
+ 	tristate "Emu10k1X (Dell OEM Version)"
+ 	select SND_AC97_CODEC
+ 	select SND_RAWMIDI
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for the Dell OEM version of the
+ 	  Sound Blaster Live!.
+@@ -511,6 +516,7 @@ config SND_ES1938
+ 	select SND_OPL3_LIB
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on ESS Solo-1
+ 	  (ES1938, ES1946, ES1969) chips.
+@@ -522,6 +528,7 @@ config SND_ES1968
+ 	tristate "ESS ES1968/1978 (Maestro-1/2/2E)"
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on ESS Maestro
+ 	  1/2/2E chips.
+@@ -603,6 +610,7 @@ config SND_ICE1712
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
+ 	select BITREVERSE
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on the
+ 	  ICE1712 (Envy24) chip.
+@@ -690,6 +698,7 @@ config SND_LX6464ES
+ config SND_MAESTRO3
+ 	tristate "ESS Allegro/Maestro3"
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on ESS Maestro 3
+ 	  (Allegro) chips.
+@@ -786,6 +795,7 @@ config SND_SIS7019
+ 	tristate "SiS 7019 Audio Accelerator"
+ 	depends on X86 && !X86_64
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for the SiS 7019 Audio Accelerator.
+ 
+@@ -797,6 +807,7 @@ config SND_SONICVIBES
+ 	select SND_OPL3_LIB
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on the S3
+ 	  SonicVibes chip.
+@@ -808,6 +819,7 @@ config SND_TRIDENT
+ 	tristate "Trident 4D-Wave DX/NX; SiS 7018"
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on Trident
+ 	  4D-Wave DX/NX or SiS 7018 chips.
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 8536266e4004..cb4d3700f330 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -2796,9 +2796,11 @@ static bool look_for_mix_leaf_ctls(struct hda_codec *codec, hda_nid_t mix_nid,
+ 	if (num_conns < idx)
+ 		return false;
+ 	nid = list[idx];
+-	if (!*mix_val && nid_has_volume(codec, nid, HDA_OUTPUT))
++	if (!*mix_val && nid_has_volume(codec, nid, HDA_OUTPUT) &&
++	    !is_ctl_associated(codec, nid, HDA_OUTPUT, 0, NID_PATH_VOL_CTL))
+ 		*mix_val = HDA_COMPOSE_AMP_VAL(nid, 3, 0, HDA_OUTPUT);
+-	if (!*mute_val && nid_has_mute(codec, nid, HDA_OUTPUT))
++	if (!*mute_val && nid_has_mute(codec, nid, HDA_OUTPUT) &&
++	    !is_ctl_associated(codec, nid, HDA_OUTPUT, 0, NID_PATH_MUTE_CTL))
+ 		*mute_val = HDA_COMPOSE_AMP_VAL(nid, 3, 0, HDA_OUTPUT);
+ 
+ 	return *mix_val || *mute_val;
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 8c1d1cf0c0cd..ba442d24257a 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -86,6 +86,9 @@ struct hdmi_spec {
+ 	unsigned int channels_max; /* max over all cvts */
+ 
+ 	struct hdmi_eld temp_eld;
++
++	bool dyn_pin_out;
++
+ 	/*
+ 	 * Non-generic ATI/NVIDIA specific
+ 	 */
+@@ -450,15 +453,25 @@ static void hdmi_write_dip_byte(struct hda_codec *codec, hda_nid_t pin_nid,
+ 
+ static void hdmi_init_pin(struct hda_codec *codec, hda_nid_t pin_nid)
+ {
++	struct hdmi_spec *spec = codec->spec;
++	int pin_out;
++
+ 	/* Unmute */
+ 	if (get_wcaps(codec, pin_nid) & AC_WCAP_OUT_AMP)
+ 		snd_hda_codec_write(codec, pin_nid, 0,
+ 				AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE);
+-	/* Enable pin out: some machines with GM965 gets broken output when
+-	 * the pin is disabled or changed while using with HDMI
+-	 */
++
++	if (spec->dyn_pin_out)
++		/* Disable pin out until stream is active */
++		pin_out = 0;
++	else
++		/* Enable pin out: some machines with GM965 gets broken output
++		 * when the pin is disabled or changed while using with HDMI
++		 */
++		pin_out = PIN_OUT;
++
+ 	snd_hda_codec_write(codec, pin_nid, 0,
+-			    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
++			    AC_VERB_SET_PIN_WIDGET_CONTROL, pin_out);
+ }
+ 
+ static int hdmi_get_channel_count(struct hda_codec *codec, hda_nid_t cvt_nid)
+@@ -1473,6 +1486,7 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
+ 	struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
+ 	hda_nid_t pin_nid = per_pin->pin_nid;
+ 	bool non_pcm;
++	int pinctl;
+ 
+ 	non_pcm = check_non_pcm_per_cvt(codec, cvt_nid);
+ 	per_pin->channels = substream->runtime->channels;
+@@ -1482,6 +1496,14 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
+ 
+ 	hdmi_setup_audio_infoframe(codec, per_pin, non_pcm);
+ 
++	if (spec->dyn_pin_out) {
++		pinctl = snd_hda_codec_read(codec, pin_nid, 0,
++					    AC_VERB_GET_PIN_WIDGET_CONTROL, 0);
++		snd_hda_codec_write(codec, pin_nid, 0,
++				    AC_VERB_SET_PIN_WIDGET_CONTROL,
++				    pinctl | PIN_OUT);
++	}
++
+ 	return hdmi_setup_stream(codec, cvt_nid, pin_nid, stream_tag, format);
+ }
+ 
+@@ -1501,6 +1523,7 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo,
+ 	int cvt_idx, pin_idx;
+ 	struct hdmi_spec_per_cvt *per_cvt;
+ 	struct hdmi_spec_per_pin *per_pin;
++	int pinctl;
+ 
+ 	if (hinfo->nid) {
+ 		cvt_idx = cvt_nid_to_cvt_index(spec, hinfo->nid);
+@@ -1517,6 +1540,14 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo,
+ 			return -EINVAL;
+ 		per_pin = get_pin(spec, pin_idx);
+ 
++		if (spec->dyn_pin_out) {
++			pinctl = snd_hda_codec_read(codec, per_pin->pin_nid, 0,
++					AC_VERB_GET_PIN_WIDGET_CONTROL, 0);
++			snd_hda_codec_write(codec, per_pin->pin_nid, 0,
++					    AC_VERB_SET_PIN_WIDGET_CONTROL,
++					    pinctl & ~PIN_OUT);
++		}
++
+ 		snd_hda_spdif_ctls_unassign(codec, pin_idx);
+ 		per_pin->chmap_set = false;
+ 		memset(per_pin->chmap, 0, sizeof(per_pin->chmap));
+@@ -2476,6 +2507,21 @@ static int patch_nvhdmi_8ch_7x(struct hda_codec *codec)
+ 	return 0;
+ }
+ 
++static int patch_nvhdmi(struct hda_codec *codec)
++{
++	struct hdmi_spec *spec;
++	int err;
++
++	err = patch_generic_hdmi(codec);
++	if (err)
++		return err;
++
++	spec = codec->spec;
++	spec->dyn_pin_out = true;
++
++	return 0;
++}
++
+ /*
+  * ATI-specific implementations
+  *
+@@ -2548,30 +2594,30 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
+ { .id = 0x10de0005, .name = "MCP77/78 HDMI",	.patch = patch_nvhdmi_8ch_7x },
+ { .id = 0x10de0006, .name = "MCP77/78 HDMI",	.patch = patch_nvhdmi_8ch_7x },
+ { .id = 0x10de0007, .name = "MCP79/7A HDMI",	.patch = patch_nvhdmi_8ch_7x },
+-{ .id = 0x10de000a, .name = "GPU 0a HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de000b, .name = "GPU 0b HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de000c, .name = "MCP89 HDMI",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de000d, .name = "GPU 0d HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0010, .name = "GPU 10 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0011, .name = "GPU 11 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0012, .name = "GPU 12 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0013, .name = "GPU 13 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0014, .name = "GPU 14 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0015, .name = "GPU 15 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0016, .name = "GPU 16 HDMI/DP",	.patch = patch_generic_hdmi },
++{ .id = 0x10de000a, .name = "GPU 0a HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de000b, .name = "GPU 0b HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de000c, .name = "MCP89 HDMI",	.patch = patch_nvhdmi },
++{ .id = 0x10de000d, .name = "GPU 0d HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0010, .name = "GPU 10 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0011, .name = "GPU 11 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0012, .name = "GPU 12 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0013, .name = "GPU 13 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0014, .name = "GPU 14 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0015, .name = "GPU 15 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0016, .name = "GPU 16 HDMI/DP",	.patch = patch_nvhdmi },
+ /* 17 is known to be absent */
+-{ .id = 0x10de0018, .name = "GPU 18 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0019, .name = "GPU 19 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de001a, .name = "GPU 1a HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de001b, .name = "GPU 1b HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de001c, .name = "GPU 1c HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0040, .name = "GPU 40 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0041, .name = "GPU 41 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0042, .name = "GPU 42 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0043, .name = "GPU 43 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0044, .name = "GPU 44 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0051, .name = "GPU 51 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0060, .name = "GPU 60 HDMI/DP",	.patch = patch_generic_hdmi },
++{ .id = 0x10de0018, .name = "GPU 18 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0019, .name = "GPU 19 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de001a, .name = "GPU 1a HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de001b, .name = "GPU 1b HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de001c, .name = "GPU 1c HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0040, .name = "GPU 40 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0041, .name = "GPU 41 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0042, .name = "GPU 42 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0043, .name = "GPU 43 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0044, .name = "GPU 44 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0051, .name = "GPU 51 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0060, .name = "GPU 60 HDMI/DP",	.patch = patch_nvhdmi },
+ { .id = 0x10de0067, .name = "MCP67 HDMI",	.patch = patch_nvhdmi_2ch },
+ { .id = 0x10de8001, .name = "MCP73 HDMI",	.patch = patch_nvhdmi_2ch },
+ { .id = 0x11069f80, .name = "VX900 HDMI/DP",	.patch = patch_via_hdmi },
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 937079a5265a..4b06e0a64392 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1763,6 +1763,7 @@ enum {
+ 	ALC889_FIXUP_DAC_ROUTE,
+ 	ALC889_FIXUP_MBP_VREF,
+ 	ALC889_FIXUP_IMAC91_VREF,
++	ALC889_FIXUP_MBA11_VREF,
+ 	ALC889_FIXUP_MBA21_VREF,
+ 	ALC882_FIXUP_INV_DMIC,
+ 	ALC882_FIXUP_NO_PRIMARY_HP,
+@@ -1892,6 +1893,16 @@ static void alc889_fixup_imac91_vref(struct hda_codec *codec,
+ 		alc889_fixup_mac_pins(codec, nids, ARRAY_SIZE(nids));
+ }
+ 
++/* Set VREF on speaker pins on mba11 */
++static void alc889_fixup_mba11_vref(struct hda_codec *codec,
++				    const struct hda_fixup *fix, int action)
++{
++	static hda_nid_t nids[1] = { 0x18 };
++
++	if (action == HDA_FIXUP_ACT_INIT)
++		alc889_fixup_mac_pins(codec, nids, ARRAY_SIZE(nids));
++}
++
+ /* Set VREF on speaker pins on mba21 */
+ static void alc889_fixup_mba21_vref(struct hda_codec *codec,
+ 				    const struct hda_fixup *fix, int action)
+@@ -2096,6 +2107,12 @@ static const struct hda_fixup alc882_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = ALC882_FIXUP_GPIO1,
+ 	},
++	[ALC889_FIXUP_MBA11_VREF] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc889_fixup_mba11_vref,
++		.chained = true,
++		.chain_id = ALC889_FIXUP_MBP_VREF,
++	},
+ 	[ALC889_FIXUP_MBA21_VREF] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc889_fixup_mba21_vref,
+@@ -2165,7 +2182,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x106b, 0x2c00, "MacbookPro rev3", ALC889_FIXUP_MBP_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x3000, "iMac", ALC889_FIXUP_MBP_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x3200, "iMac 7,1 Aluminum", ALC882_FIXUP_EAPD),
+-	SND_PCI_QUIRK(0x106b, 0x3400, "MacBookAir 1,1", ALC889_FIXUP_MBP_VREF),
++	SND_PCI_QUIRK(0x106b, 0x3400, "MacBookAir 1,1", ALC889_FIXUP_MBA11_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x3500, "MacBookAir 2,1", ALC889_FIXUP_MBA21_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x3600, "Macbook 3,1", ALC889_FIXUP_MBP_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x3800, "MacbookPro 4,1", ALC889_FIXUP_MBP_VREF),
+diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c
+index 773a67fff4cd..431bf6897dd6 100644
+--- a/sound/pci/rme9652/rme9652.c
++++ b/sound/pci/rme9652/rme9652.c
+@@ -285,7 +285,7 @@ static char channel_map_9636_ds[26] = {
+ 	/* ADAT channels are remapped */
+ 	1, 3, 5, 7, 9, 11, 13, 15,
+ 	/* channels 8 and 9 are S/PDIF */
+-	24, 25
++	24, 25,
+ 	/* others don't exist */
+ 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
+ };
+diff --git a/sound/soc/codecs/adau1701.c b/sound/soc/codecs/adau1701.c
+index dafdbe87edeb..0c499c638692 100644
+--- a/sound/soc/codecs/adau1701.c
++++ b/sound/soc/codecs/adau1701.c
+@@ -64,7 +64,7 @@
+ 
+ #define ADAU1701_SEROCTL_WORD_LEN_24	0x0000
+ #define ADAU1701_SEROCTL_WORD_LEN_20	0x0001
+-#define ADAU1701_SEROCTL_WORD_LEN_16	0x0010
++#define ADAU1701_SEROCTL_WORD_LEN_16	0x0002
+ #define ADAU1701_SEROCTL_WORD_LEN_MASK	0x0003
+ 
+ #define ADAU1701_AUXNPOW_VBPD		0x40
+diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
+index 866b9c657e15..3775394c9c8b 100644
+--- a/sound/soc/codecs/wm5110.c
++++ b/sound/soc/codecs/wm5110.c
+@@ -43,6 +43,54 @@ static const struct reg_default wm5110_sysclk_revd_patch[] = {
+ 	{ 0x3133, 0x1201 },
+ 	{ 0x3183, 0x1501 },
+ 	{ 0x31D3, 0x1401 },
++	{ 0x0049, 0x01ea },
++	{ 0x004a, 0x01f2 },
++	{ 0x0057, 0x01e7 },
++	{ 0x0058, 0x01fb },
++	{ 0x33ce, 0xc4f5 },
++	{ 0x33cf, 0x1361 },
++	{ 0x33d0, 0x0402 },
++	{ 0x33d1, 0x4700 },
++	{ 0x33d2, 0x026d },
++	{ 0x33d3, 0xff00 },
++	{ 0x33d4, 0x026d },
++	{ 0x33d5, 0x0101 },
++	{ 0x33d6, 0xc4f5 },
++	{ 0x33d7, 0x0361 },
++	{ 0x33d8, 0x0402 },
++	{ 0x33d9, 0x6701 },
++	{ 0x33da, 0xc4f5 },
++	{ 0x33db, 0x136f },
++	{ 0x33dc, 0xc4f5 },
++	{ 0x33dd, 0x134f },
++	{ 0x33de, 0xc4f5 },
++	{ 0x33df, 0x131f },
++	{ 0x33e0, 0x026d },
++	{ 0x33e1, 0x4f01 },
++	{ 0x33e2, 0x026d },
++	{ 0x33e3, 0xf100 },
++	{ 0x33e4, 0x026d },
++	{ 0x33e5, 0x0001 },
++	{ 0x33e6, 0xc4f5 },
++	{ 0x33e7, 0x0361 },
++	{ 0x33e8, 0x0402 },
++	{ 0x33e9, 0x6601 },
++	{ 0x33ea, 0xc4f5 },
++	{ 0x33eb, 0x136f },
++	{ 0x33ec, 0xc4f5 },
++	{ 0x33ed, 0x134f },
++	{ 0x33ee, 0xc4f5 },
++	{ 0x33ef, 0x131f },
++	{ 0x33f0, 0x026d },
++	{ 0x33f1, 0x4e01 },
++	{ 0x33f2, 0x026d },
++	{ 0x33f3, 0xf000 },
++	{ 0x33f6, 0xc4f5 },
++	{ 0x33f7, 0x1361 },
++	{ 0x33f8, 0x0402 },
++	{ 0x33f9, 0x4600 },
++	{ 0x33fa, 0x026d },
++	{ 0x33fb, 0xfe00 },
+ };
+ 
+ static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w,
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index cf1fe01b7e89..e392202b96bc 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -811,6 +811,7 @@ static struct machine *
+ 					       union perf_event *event)
+ {
+ 	const u8 cpumode = event->header.misc & PERF_RECORD_MISC_CPUMODE_MASK;
++	struct machine *machine;
+ 
+ 	if (perf_guest &&
+ 	    ((cpumode == PERF_RECORD_MISC_GUEST_KERNEL) ||
+@@ -822,7 +823,11 @@ static struct machine *
+ 		else
+ 			pid = event->ip.pid;
+ 
+-		return perf_session__findnew_machine(session, pid);
++		machine = perf_session__find_machine(session, pid);
++		if (!machine)
++			machine = perf_session__findnew_machine(session,
++						DEFAULT_GUEST_KERNEL_ID);
++		return machine;
+ 	}
+ 
+ 	return &session->machines.host;