[gentoo-commits] linux-patches r2386 - genpatches-2.6/trunk/3.10

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2013-05-21 00:44:32 +0000 (Tue, 21 May 2013)
New Revision: 2386

Removed:
   genpatches-2.6/trunk/3.10/1000_linux-3.9.1.patch
   genpatches-2.6/trunk/3.10/1001_linux-3.9.2.patch
   genpatches-2.6/trunk/3.10/1002_linux-3.9.3.patch
Modified:
   genpatches-2.6/trunk/3.10/0000_README
Log:
Remove 3.9 specific patches

Modified: genpatches-2.6/trunk/3.10/0000_README
===================================================================
--- genpatches-2.6/trunk/3.10/0000_README	2013-05-21 00:40:11 UTC (rev 2385)
+++ genpatches-2.6/trunk/3.10/0000_README	2013-05-21 00:44:32 UTC (rev 2386)
@@ -39,18 +39,6 @@
 
 Individual Patch Descriptions:
 --------------------------------------------------------------------------
-Patch:  1000_linux-3.9.1.patch
-From:   http://www.kernel.org
-Desc:   Linux 3.9.1
-
-Patch:  1001_linux-3.9.2.patch
-From:   http://www.kernel.org
-Desc:   Linux 3.9.2
-
-Patch:  1002_linux-3.9.3.patch
-From:   http://www.kernel.org
-Desc:   Linux 3.9.3
-
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Deleted: genpatches-2.6/trunk/3.10/1000_linux-3.9.1.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1000_linux-3.9.1.patch	2013-05-21 00:40:11 UTC (rev 2385)
+++ genpatches-2.6/trunk/3.10/1000_linux-3.9.1.patch	2013-05-21 00:44:32 UTC (rev 2386)
@@ -1,3415 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 8fe6991..5fcb591 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 9
--SUBLEVEL = 0
-+SUBLEVEL = 1
- EXTRAVERSION =
- NAME = Unicycling Gorilla
- 
-diff --git a/arch/arm/boot/dts/at91sam9260.dtsi b/arch/arm/boot/dts/at91sam9260.dtsi
-index cb7bcc5..02b70a4 100644
---- a/arch/arm/boot/dts/at91sam9260.dtsi
-+++ b/arch/arm/boot/dts/at91sam9260.dtsi
-@@ -158,8 +158,8 @@
- 				usart1 {
- 					pinctrl_usart1: usart1-0 {
- 						atmel,pins =
--							<2 6 0x1 0x1	/* PB6 periph A with pullup */
--							 2 7 0x1 0x0>;	/* PB7 periph A */
-+							<1 6 0x1 0x1	/* PB6 periph A with pullup */
-+							 1 7 0x1 0x0>;	/* PB7 periph A */
- 					};
- 
- 					pinctrl_usart1_rts: usart1_rts-0 {
-@@ -194,18 +194,18 @@
- 				usart3 {
- 					pinctrl_usart3: usart3-0 {
- 						atmel,pins =
--							<2 10 0x1 0x1	/* PB10 periph A with pullup */
--							 2 11 0x1 0x0>;	/* PB11 periph A */
-+							<1 10 0x1 0x1	/* PB10 periph A with pullup */
-+							 1 11 0x1 0x0>;	/* PB11 periph A */
- 					};
- 
- 					pinctrl_usart3_rts: usart3_rts-0 {
- 						atmel,pins =
--							<3 8 0x2 0x0>;	/* PB8 periph B */
-+							<2 8 0x2 0x0>;	/* PC8 periph B */
- 					};
- 
- 					pinctrl_usart3_cts: usart3_cts-0 {
- 						atmel,pins =
--							<3 10 0x2 0x0>;	/* PB10 periph B */
-+							<2 10 0x2 0x0>;	/* PC10 periph B */
- 					};
- 				};
- 
-@@ -220,8 +220,8 @@
- 				uart1 {
- 					pinctrl_uart1: uart1-0 {
- 						atmel,pins =
--							<2 12 0x1 0x1	/* PB12 periph A with pullup */
--							 2 13 0x1 0x0>;	/* PB13 periph A */
-+							<1 12 0x1 0x1	/* PB12 periph A with pullup */
-+							 1 13 0x1 0x0>;	/* PB13 periph A */
- 					};
- 				};
- 
-diff --git a/arch/arm/boot/dts/at91sam9g15.dtsi b/arch/arm/boot/dts/at91sam9g15.dtsi
-index fbe7a70..28467fd 100644
---- a/arch/arm/boot/dts/at91sam9g15.dtsi
-+++ b/arch/arm/boot/dts/at91sam9g15.dtsi
-@@ -10,7 +10,7 @@
- 
- / {
- 	model = "Atmel AT91SAM9G15 SoC";
--	compatible = "atmel, at91sam9g15, atmel,at91sam9x5";
-+	compatible = "atmel,at91sam9g15", "atmel,at91sam9x5";
- 
- 	ahb {
- 		apb {
-diff --git a/arch/arm/boot/dts/at91sam9g15ek.dts b/arch/arm/boot/dts/at91sam9g15ek.dts
-index 86dd3f6..5427b2d 100644
---- a/arch/arm/boot/dts/at91sam9g15ek.dts
-+++ b/arch/arm/boot/dts/at91sam9g15ek.dts
-@@ -11,6 +11,6 @@
- /include/ "at91sam9x5ek.dtsi"
- 
- / {
--	model = "Atmel AT91SAM9G25-EK";
-+	model = "Atmel AT91SAM9G15-EK";
- 	compatible = "atmel,at91sam9g15ek", "atmel,at91sam9x5ek", "atmel,at91sam9x5", "atmel,at91sam9";
- };
-diff --git a/arch/arm/boot/dts/at91sam9g25.dtsi b/arch/arm/boot/dts/at91sam9g25.dtsi
-index 05a718f..5fd32df 100644
---- a/arch/arm/boot/dts/at91sam9g25.dtsi
-+++ b/arch/arm/boot/dts/at91sam9g25.dtsi
-@@ -10,7 +10,7 @@
- 
- / {
- 	model = "Atmel AT91SAM9G25 SoC";
--	compatible = "atmel, at91sam9g25, atmel,at91sam9x5";
-+	compatible = "atmel,at91sam9g25", "atmel,at91sam9x5";
- 
- 	ahb {
- 		apb {
-diff --git a/arch/arm/boot/dts/at91sam9g35.dtsi b/arch/arm/boot/dts/at91sam9g35.dtsi
-index f9d14a7..d6fa8af 100644
---- a/arch/arm/boot/dts/at91sam9g35.dtsi
-+++ b/arch/arm/boot/dts/at91sam9g35.dtsi
-@@ -10,7 +10,7 @@
- 
- / {
- 	model = "Atmel AT91SAM9G35 SoC";
--	compatible = "atmel, at91sam9g35, atmel,at91sam9x5";
-+	compatible = "atmel,at91sam9g35", "atmel,at91sam9x5";
- 
- 	ahb {
- 		apb {
-diff --git a/arch/arm/boot/dts/at91sam9x25.dtsi b/arch/arm/boot/dts/at91sam9x25.dtsi
-index 54eb33b..9ac2bc2 100644
---- a/arch/arm/boot/dts/at91sam9x25.dtsi
-+++ b/arch/arm/boot/dts/at91sam9x25.dtsi
-@@ -10,7 +10,7 @@
- 
- / {
- 	model = "Atmel AT91SAM9X25 SoC";
--	compatible = "atmel, at91sam9x25, atmel,at91sam9x5";
-+	compatible = "atmel,at91sam9x25", "atmel,at91sam9x5";
- 
- 	ahb {
- 		apb {
-diff --git a/arch/arm/boot/dts/at91sam9x35.dtsi b/arch/arm/boot/dts/at91sam9x35.dtsi
-index fb102d6..ba67d83 100644
---- a/arch/arm/boot/dts/at91sam9x35.dtsi
-+++ b/arch/arm/boot/dts/at91sam9x35.dtsi
-@@ -10,7 +10,7 @@
- 
- / {
- 	model = "Atmel AT91SAM9X35 SoC";
--	compatible = "atmel, at91sam9x35, atmel,at91sam9x5";
-+	compatible = "atmel,at91sam9x35", "atmel,at91sam9x5";
- 
- 	ahb {
- 		apb {
-diff --git a/arch/arm/boot/dts/at91sam9x5ek.dtsi b/arch/arm/boot/dts/at91sam9x5ek.dtsi
-index 8a7cf1d..ccab256 100644
---- a/arch/arm/boot/dts/at91sam9x5ek.dtsi
-+++ b/arch/arm/boot/dts/at91sam9x5ek.dtsi
-@@ -13,7 +13,7 @@
- 	compatible = "atmel,at91sam9x5ek", "atmel,at91sam9x5", "atmel,at91sam9";
- 
- 	chosen {
--		bootargs = "128M console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=ubifs ubi.mtd=1 root=ubi0:rootfs";
-+		bootargs = "console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=ubifs ubi.mtd=1 root=ubi0:rootfs";
- 	};
- 
- 	ahb {
-diff --git a/arch/arm/configs/at91sam9g45_defconfig b/arch/arm/configs/at91sam9g45_defconfig
-index 606d48f..8aab786 100644
---- a/arch/arm/configs/at91sam9g45_defconfig
-+++ b/arch/arm/configs/at91sam9g45_defconfig
-@@ -173,7 +173,6 @@ CONFIG_MMC=y
- # CONFIG_MMC_BLOCK_BOUNCE is not set
- CONFIG_SDIO_UART=m
- CONFIG_MMC_ATMELMCI=y
--CONFIG_MMC_ATMELMCI_DMA=y
- CONFIG_LEDS_ATMEL_PWM=y
- CONFIG_LEDS_GPIO=y
- CONFIG_LEDS_TRIGGER_TIMER=y
-diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
-index 80d6fc4..9bcd262 100644
---- a/arch/arm/include/asm/pgtable.h
-+++ b/arch/arm/include/asm/pgtable.h
-@@ -61,6 +61,15 @@ extern void __pgd_error(const char *file, int line, pgd_t);
- #define FIRST_USER_ADDRESS	PAGE_SIZE
- 
- /*
-+ * Use TASK_SIZE as the ceiling argument for free_pgtables() and
-+ * free_pgd_range() to avoid freeing the modules pmd when LPAE is enabled (pmd
-+ * page shared between user and kernel).
-+ */
-+#ifdef CONFIG_ARM_LPAE
-+#define USER_PGTABLES_CEILING	TASK_SIZE
-+#endif
-+
-+/*
-  * The pgprot_* and protection_map entries will be fixed up in runtime
-  * to include the cachable and bufferable bits based on memory policy,
-  * as well as any architecture dependent bits like global/ASID and SMP
-diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c
-index 4b67847..6b4608d 100644
---- a/arch/arm/mach-at91/setup.c
-+++ b/arch/arm/mach-at91/setup.c
-@@ -333,7 +333,7 @@ static void at91_dt_rstc(void)
- 
- 	of_id = of_match_node(rstc_ids, np);
- 	if (!of_id)
--		panic("AT91: rtsc no restart function availlable\n");
-+		panic("AT91: rtsc no restart function available\n");
- 
- 	arm_pm_restart = of_id->data;
- 
-diff --git a/arch/arm/mach-omap2/cpuidle34xx.c b/arch/arm/mach-omap2/cpuidle34xx.c
-index 80392fc..4f67a5b 100644
---- a/arch/arm/mach-omap2/cpuidle34xx.c
-+++ b/arch/arm/mach-omap2/cpuidle34xx.c
-@@ -274,8 +274,9 @@ static int omap3_enter_idle_bm(struct cpuidle_device *dev,
- static DEFINE_PER_CPU(struct cpuidle_device, omap3_idle_dev);
- 
- static struct cpuidle_driver omap3_idle_driver = {
--	.name =		"omap3_idle",
--	.owner =	THIS_MODULE,
-+	.name             = "omap3_idle",
-+	.owner            = THIS_MODULE,
-+	.en_core_tk_irqen = 1,
- 	.states = {
- 		{
- 			.enter		  = omap3_enter_idle_bm,
-diff --git a/arch/arm/mach-u300/include/mach/u300-regs.h b/arch/arm/mach-u300/include/mach/u300-regs.h
-index 1e49d90..0320495 100644
---- a/arch/arm/mach-u300/include/mach/u300-regs.h
-+++ b/arch/arm/mach-u300/include/mach/u300-regs.h
-@@ -95,7 +95,7 @@
- #define U300_SPI_BASE			(U300_FAST_PER_PHYS_BASE+0x6000)
- 
- /* Fast UART1 on U335 only */
--#define U300_UART1_BASE			(U300_SLOW_PER_PHYS_BASE+0x7000)
-+#define U300_UART1_BASE			(U300_FAST_PER_PHYS_BASE+0x7000)
- 
- /*
-  * SLOW peripherals
-diff --git a/arch/avr32/configs/favr-32_defconfig b/arch/avr32/configs/favr-32_defconfig
-index 0421498..9791820 100644
---- a/arch/avr32/configs/favr-32_defconfig
-+++ b/arch/avr32/configs/favr-32_defconfig
-@@ -122,7 +122,6 @@ CONFIG_USB_G_SERIAL=m
- CONFIG_USB_CDC_COMPOSITE=m
- CONFIG_MMC=y
- CONFIG_MMC_ATMELMCI=y
--CONFIG_MMC_ATMELMCI_DMA=y
- CONFIG_NEW_LEDS=y
- CONFIG_LEDS_CLASS=y
- CONFIG_LEDS_ATMEL_PWM=m
-diff --git a/arch/avr32/configs/merisc_defconfig b/arch/avr32/configs/merisc_defconfig
-index 3befab9..65de443 100644
---- a/arch/avr32/configs/merisc_defconfig
-+++ b/arch/avr32/configs/merisc_defconfig
-@@ -102,7 +102,6 @@ CONFIG_FRAMEBUFFER_CONSOLE=y
- CONFIG_LOGO=y
- CONFIG_MMC=y
- CONFIG_MMC_ATMELMCI=y
--CONFIG_MMC_ATMELMCI_DMA=y
- CONFIG_NEW_LEDS=y
- CONFIG_LEDS_CLASS=y
- CONFIG_LEDS_ATMEL_PWM=y
-diff --git a/arch/ia64/include/asm/futex.h b/arch/ia64/include/asm/futex.h
-index d2bf1fd..76acbcd 100644
---- a/arch/ia64/include/asm/futex.h
-+++ b/arch/ia64/include/asm/futex.h
-@@ -106,16 +106,15 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
- 		return -EFAULT;
- 
- 	{
--		register unsigned long r8 __asm ("r8");
-+		register unsigned long r8 __asm ("r8") = 0;
- 		unsigned long prev;
- 		__asm__ __volatile__(
- 			"	mf;;					\n"
--			"	mov %0=r0				\n"
- 			"	mov ar.ccv=%4;;				\n"
- 			"[1:]	cmpxchg4.acq %1=[%2],%3,ar.ccv		\n"
- 			"	.xdata4 \"__ex_table\", 1b-., 2f-.	\n"
- 			"[2:]"
--			: "=r" (r8), "=r" (prev)
-+			: "+r" (r8), "=&r" (prev)
- 			: "r" (uaddr), "r" (newval),
- 			  "rO" ((long) (unsigned) oldval)
- 			: "memory");
-diff --git a/arch/ia64/include/asm/mca.h b/arch/ia64/include/asm/mca.h
-index 43f96ab..8c70961 100644
---- a/arch/ia64/include/asm/mca.h
-+++ b/arch/ia64/include/asm/mca.h
-@@ -143,6 +143,7 @@ extern unsigned long __per_cpu_mca[NR_CPUS];
- extern int cpe_vector;
- extern int ia64_cpe_irq;
- extern void ia64_mca_init(void);
-+extern void ia64_mca_irq_init(void);
- extern void ia64_mca_cpu_init(void *);
- extern void ia64_os_mca_dispatch(void);
- extern void ia64_os_mca_dispatch_end(void);
-diff --git a/arch/ia64/kernel/irq.c b/arch/ia64/kernel/irq.c
-index ad69606..f2c41828 100644
---- a/arch/ia64/kernel/irq.c
-+++ b/arch/ia64/kernel/irq.c
-@@ -23,6 +23,8 @@
- #include <linux/interrupt.h>
- #include <linux/kernel_stat.h>
- 
-+#include <asm/mca.h>
-+
- /*
-  * 'what should we do if we get a hw irq event on an illegal vector'.
-  * each architecture has to answer this themselves.
-@@ -83,6 +85,12 @@ bool is_affinity_mask_valid(const struct cpumask *cpumask)
- 
- #endif /* CONFIG_SMP */
- 
-+int __init arch_early_irq_init(void)
-+{
-+	ia64_mca_irq_init();
-+	return 0;
-+}
-+
- #ifdef CONFIG_HOTPLUG_CPU
- unsigned int vectors_in_migration[NR_IRQS];
- 
-diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c
-index 65bf9cd..d7396db 100644
---- a/arch/ia64/kernel/mca.c
-+++ b/arch/ia64/kernel/mca.c
-@@ -2074,22 +2074,16 @@ ia64_mca_init(void)
- 	printk(KERN_INFO "MCA related initialization done\n");
- }
- 
-+
- /*
-- * ia64_mca_late_init
-- *
-- *	Opportunity to setup things that require initialization later
-- *	than ia64_mca_init.  Setup a timer to poll for CPEs if the
-- *	platform doesn't support an interrupt driven mechanism.
-- *
-- *  Inputs  :   None
-- *  Outputs :   Status
-+ * These pieces cannot be done in ia64_mca_init() because it is called before
-+ * early_irq_init() which would wipe out our percpu irq registrations. But we
-+ * cannot leave them until ia64_mca_late_init() because by then all the other
-+ * processors have been brought online and have set their own CMC vectors to
-+ * point at a non-existant action. Called from arch_early_irq_init().
-  */
--static int __init
--ia64_mca_late_init(void)
-+void __init ia64_mca_irq_init(void)
- {
--	if (!mca_init)
--		return 0;
--
- 	/*
- 	 *  Configure the CMCI/P vector and handler. Interrupts for CMC are
- 	 *  per-processor, so AP CMC interrupts are setup in smp_callin() (smpboot.c).
-@@ -2108,6 +2102,23 @@ ia64_mca_late_init(void)
- 	/* Setup the CPEI/P handler */
- 	register_percpu_irq(IA64_CPEP_VECTOR, &mca_cpep_irqaction);
- #endif
-+}
-+
-+/*
-+ * ia64_mca_late_init
-+ *
-+ *	Opportunity to setup things that require initialization later
-+ *	than ia64_mca_init.  Setup a timer to poll for CPEs if the
-+ *	platform doesn't support an interrupt driven mechanism.
-+ *
-+ *  Inputs  :   None
-+ *  Outputs :   Status
-+ */
-+static int __init
-+ia64_mca_late_init(void)
-+{
-+	if (!mca_init)
-+		return 0;
- 
- 	register_hotcpu_notifier(&mca_cpu_notifier);
- 
-diff --git a/arch/ia64/kvm/vtlb.c b/arch/ia64/kvm/vtlb.c
-index 4332f7e..a7869f8 100644
---- a/arch/ia64/kvm/vtlb.c
-+++ b/arch/ia64/kvm/vtlb.c
-@@ -256,7 +256,7 @@ u64 guest_vhpt_lookup(u64 iha, u64 *pte)
- 			"srlz.d;;"
- 			"ssm psr.i;;"
- 			"srlz.d;;"
--			: "=r"(ret) : "r"(iha), "r"(pte):"memory");
-+			: "=&r"(ret) : "r"(iha), "r"(pte) : "memory");
- 
- 	return ret;
- }
-diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S
-index ea847ab..1167008 100644
---- a/arch/powerpc/kernel/cpu_setup_power.S
-+++ b/arch/powerpc/kernel/cpu_setup_power.S
-@@ -66,6 +66,7 @@ _GLOBAL(__restore_cpu_power8)
- 	bl	__init_FSCR
- 	mfmsr	r3
- 	rldicl.	r0,r3,4,63
-+	mtlr	r11
- 	beqlr
- 	li	r0,0
- 	mtspr	SPRN_LPID,r0
-diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
-index 56bd923..3bbe7ed 100644
---- a/arch/powerpc/kernel/exceptions-64s.S
-+++ b/arch/powerpc/kernel/exceptions-64s.S
-@@ -797,7 +797,7 @@ hardware_interrupt_relon_hv:
- 		_MASKABLE_RELON_EXCEPTION_PSERIES(0x502, hardware_interrupt, EXC_HV, SOFTEN_TEST_HV)
- 	FTR_SECTION_ELSE
- 		_MASKABLE_RELON_EXCEPTION_PSERIES(0x500, hardware_interrupt, EXC_STD, SOFTEN_TEST_PR)
--	ALT_FTR_SECTION_END_IFSET(CPU_FTR_ARCH_206)
-+	ALT_FTR_SECTION_END_IFSET(CPU_FTR_HVMODE)
- 	STD_RELON_EXCEPTION_PSERIES(0x4600, 0x600, alignment)
- 	STD_RELON_EXCEPTION_PSERIES(0x4700, 0x700, program_check)
- 	STD_RELON_EXCEPTION_PSERIES(0x4800, 0x800, fp_unavailable)
-diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
-index 0886ae6..b61363d 100644
---- a/arch/powerpc/kernel/head_64.S
-+++ b/arch/powerpc/kernel/head_64.S
-@@ -509,6 +509,7 @@ _GLOBAL(copy_and_flush)
- 	sync
- 	addi	r5,r5,8
- 	addi	r6,r6,8
-+	isync
- 	blr
- 
- .align 8
-diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
-index 3f3bb4c..35f77a4 100644
---- a/arch/powerpc/platforms/cell/spufs/inode.c
-+++ b/arch/powerpc/platforms/cell/spufs/inode.c
-@@ -99,6 +99,7 @@ spufs_new_inode(struct super_block *sb, umode_t mode)
- 	if (!inode)
- 		goto out;
- 
-+	inode->i_ino = get_next_ino();
- 	inode->i_mode = mode;
- 	inode->i_uid = current_fsuid();
- 	inode->i_gid = current_fsgid();
-diff --git a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
-index cf1a7ec..a59c643 100644
---- a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
-+++ b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
-@@ -42,6 +42,7 @@
-  * SOFTWARE.
-  */
- 
-+#include <asm/inst.h>
- #include <linux/linkage.h>
- 
- ## ISCSI CRC 32 Implementation with crc32 and pclmulqdq Instruction
-@@ -225,10 +226,10 @@ LABEL crc_ %i
- 	movdqa  (bufp), %xmm0			# 2 consts: K1:K2
- 
- 	movq    crc_init, %xmm1			# CRC for block 1
--	pclmulqdq $0x00,%xmm0,%xmm1		# Multiply by K2
-+	PCLMULQDQ 0x00,%xmm0,%xmm1		# Multiply by K2
- 
- 	movq    crc1, %xmm2			# CRC for block 2
--	pclmulqdq $0x10, %xmm0, %xmm2		# Multiply by K1
-+	PCLMULQDQ 0x10, %xmm0, %xmm2		# Multiply by K1
- 
- 	pxor    %xmm2,%xmm1
- 	movq    %xmm1, %rax
-diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
-index c5e403f..1c68ccb 100644
---- a/arch/x86/kernel/head64.c
-+++ b/arch/x86/kernel/head64.c
-@@ -34,6 +34,7 @@
- extern pgd_t early_level4_pgt[PTRS_PER_PGD];
- extern pmd_t early_dynamic_pgts[EARLY_DYNAMIC_PAGE_TABLES][PTRS_PER_PMD];
- static unsigned int __initdata next_early_pgt = 2;
-+pmdval_t __initdata early_pmd_flags = __PAGE_KERNEL_LARGE & ~(_PAGE_GLOBAL | _PAGE_NX);
- 
- /* Wipe all early page tables except for the kernel symbol map */
- static void __init reset_early_page_tables(void)
-@@ -99,7 +100,7 @@ again:
- 			pmd_p[i] = 0;
- 		*pud_p = (pudval_t)pmd_p - __START_KERNEL_map + phys_base + _KERNPG_TABLE;
- 	}
--	pmd = (physaddr & PMD_MASK) + (__PAGE_KERNEL_LARGE & ~_PAGE_GLOBAL);
-+	pmd = (physaddr & PMD_MASK) + early_pmd_flags;
- 	pmd_p[pmd_index(address)] = pmd;
- 
- 	return 0;
-diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
-index 6859e96..08f7e80 100644
---- a/arch/x86/kernel/head_64.S
-+++ b/arch/x86/kernel/head_64.S
-@@ -200,6 +200,7 @@ ENTRY(secondary_startup_64)
- 	btl	$20,%edi		/* No Execute supported? */
- 	jnc     1f
- 	btsl	$_EFER_NX, %eax
-+	btsq	$_PAGE_BIT_NX,early_pmd_flags(%rip)
- 1:	wrmsr				/* Make changes effective */
- 
- 	/* Setup cr0 */
-diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
-index e4595f1..84b7789 100644
---- a/arch/x86/kernel/irq.c
-+++ b/arch/x86/kernel/irq.c
-@@ -165,10 +165,6 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
- u64 arch_irq_stat(void)
- {
- 	u64 sum = atomic_read(&irq_err_count);
--
--#ifdef CONFIG_X86_IO_APIC
--	sum += atomic_read(&irq_mis_count);
--#endif
- 	return sum;
- }
- 
-diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index a335cc6..a9c9d3e 100644
---- a/arch/x86/kvm/emulate.c
-+++ b/arch/x86/kvm/emulate.c
-@@ -4162,6 +4162,10 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
- 		break;
- 	case OpMem8:
- 		ctxt->memop.bytes = 1;
-+		if (ctxt->memop.type == OP_REG) {
-+			ctxt->memop.addr.reg = decode_register(ctxt, ctxt->modrm_rm, 1);
-+			fetch_register_operand(&ctxt->memop);
-+		}
- 		goto mem_common;
- 	case OpMem16:
- 		ctxt->memop.bytes = 2;
-diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index c8e1c7b..2363127 100644
---- a/arch/x86/xen/enlighten.c
-+++ b/arch/x86/xen/enlighten.c
-@@ -1589,8 +1589,11 @@ static int __cpuinit xen_hvm_cpu_notify(struct notifier_block *self,
- 	switch (action) {
- 	case CPU_UP_PREPARE:
- 		xen_vcpu_setup(cpu);
--		if (xen_have_vector_callback)
-+		if (xen_have_vector_callback) {
- 			xen_init_lock_cpu(cpu);
-+			if (xen_feature(XENFEAT_hvm_safe_pvclock))
-+				xen_setup_timer(cpu);
-+		}
- 		break;
- 	default:
- 		break;
-diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
-index 09ea61d..22c800a 100644
---- a/arch/x86/xen/smp.c
-+++ b/arch/x86/xen/smp.c
-@@ -662,6 +662,8 @@ static void xen_hvm_cpu_die(unsigned int cpu)
- 	unbind_from_irqhandler(per_cpu(xen_debug_irq, cpu), NULL);
- 	unbind_from_irqhandler(per_cpu(xen_callfuncsingle_irq, cpu), NULL);
- 	unbind_from_irqhandler(per_cpu(xen_irq_work, cpu), NULL);
-+	xen_uninit_lock_cpu(cpu);
-+	xen_teardown_timer(cpu);
- 	native_cpu_die(cpu);
- }
- 
-diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
-index 0296a95..054cc01 100644
---- a/arch/x86/xen/time.c
-+++ b/arch/x86/xen/time.c
-@@ -497,7 +497,11 @@ static void xen_hvm_setup_cpu_clockevents(void)
- {
- 	int cpu = smp_processor_id();
- 	xen_setup_runstate_info(cpu);
--	xen_setup_timer(cpu);
-+	/*
-+	 * xen_setup_timer(cpu) - snprintf is bad in atomic context. Hence
-+	 * doing it xen_hvm_cpu_notify (which gets called by smp_init during
-+	 * early bootup and also during CPU hotplug events).
-+	 */
- 	xen_setup_cpu_clockevents();
- }
- 
-diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
-index 586e7e9..bcb7a3b 100644
---- a/drivers/acpi/osl.c
-+++ b/drivers/acpi/osl.c
-@@ -641,7 +641,7 @@ void __init acpi_initrd_override(void *data, size_t size)
- 	 * Both memblock_reserve and e820_add_region (via arch_reserve_mem_area)
- 	 * works fine.
- 	 */
--	memblock_reserve(acpi_tables_addr, acpi_tables_addr + all_tables_size);
-+	memblock_reserve(acpi_tables_addr, all_tables_size);
- 	arch_reserve_mem_area(acpi_tables_addr, all_tables_size);
- 
- 	p = early_ioremap(acpi_tables_addr, all_tables_size);
-diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
-index 6ae5e44..4241b8d 100644
---- a/drivers/acpi/pci_root.c
-+++ b/drivers/acpi/pci_root.c
-@@ -201,8 +201,8 @@ static acpi_status acpi_pci_query_osc(struct acpi_pci_root *root,
- 		*control &= OSC_PCI_CONTROL_MASKS;
- 		capbuf[OSC_CONTROL_TYPE] = *control | root->osc_control_set;
- 	} else {
--		/* Run _OSC query for all possible controls. */
--		capbuf[OSC_CONTROL_TYPE] = OSC_PCI_CONTROL_MASKS;
-+		/* Run _OSC query only with existing controls. */
-+		capbuf[OSC_CONTROL_TYPE] = root->osc_control_set;
- 	}
- 
- 	status = acpi_pci_run_osc(root->device->handle, capbuf, &result);
-diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
-index 8470771..a33821c 100644
---- a/drivers/acpi/thermal.c
-+++ b/drivers/acpi/thermal.c
-@@ -723,9 +723,19 @@ static int thermal_get_trend(struct thermal_zone_device *thermal,
- 		return -EINVAL;
- 
- 	if (type == THERMAL_TRIP_ACTIVE) {
--		/* aggressive active cooling */
--		*trend = THERMAL_TREND_RAISING;
--		return 0;
-+		unsigned long trip_temp;
-+		unsigned long temp = KELVIN_TO_MILLICELSIUS(tz->temperature,
-+							tz->kelvin_offset);
-+		if (thermal_get_trip_temp(thermal, trip, &trip_temp))
-+			return -EINVAL;
-+
-+		if (temp > trip_temp) {
-+			*trend = THERMAL_TREND_RAISING;
-+			return 0;
-+		} else {
-+			/* Fall back on default trend */
-+			return -EINVAL;
-+		}
- 	}
- 
- 	/*
-diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
-index 8a52dab..3badf18 100644
---- a/drivers/ata/libata-acpi.c
-+++ b/drivers/ata/libata-acpi.c
-@@ -61,7 +61,8 @@ acpi_handle ata_ap_acpi_handle(struct ata_port *ap)
- 	if (ap->flags & ATA_FLAG_ACPI_SATA)
- 		return NULL;
- 
--	return acpi_get_child(DEVICE_ACPI_HANDLE(ap->host->dev), ap->port_no);
-+	return ap->scsi_host ?
-+		DEVICE_ACPI_HANDLE(&ap->scsi_host->shost_gendev) : NULL;
- }
- EXPORT_SYMBOL(ata_ap_acpi_handle);
- 
-@@ -240,28 +241,15 @@ void ata_acpi_dissociate(struct ata_host *host)
- 	}
- }
- 
--/**
-- * ata_acpi_gtm - execute _GTM
-- * @ap: target ATA port
-- * @gtm: out parameter for _GTM result
-- *
-- * Evaluate _GTM and store the result in @gtm.
-- *
-- * LOCKING:
-- * EH context.
-- *
-- * RETURNS:
-- * 0 on success, -ENOENT if _GTM doesn't exist, -errno on failure.
-- */
--int ata_acpi_gtm(struct ata_port *ap, struct ata_acpi_gtm *gtm)
-+static int __ata_acpi_gtm(struct ata_port *ap, acpi_handle handle,
-+			  struct ata_acpi_gtm *gtm)
- {
- 	struct acpi_buffer output = { .length = ACPI_ALLOCATE_BUFFER };
- 	union acpi_object *out_obj;
- 	acpi_status status;
- 	int rc = 0;
- 
--	status = acpi_evaluate_object(ata_ap_acpi_handle(ap), "_GTM", NULL,
--				      &output);
-+	status = acpi_evaluate_object(handle, "_GTM", NULL, &output);
- 
- 	rc = -ENOENT;
- 	if (status == AE_NOT_FOUND)
-@@ -295,6 +283,27 @@ int ata_acpi_gtm(struct ata_port *ap, struct ata_acpi_gtm *gtm)
- 	return rc;
- }
- 
-+/**
-+ * ata_acpi_gtm - execute _GTM
-+ * @ap: target ATA port
-+ * @gtm: out parameter for _GTM result
-+ *
-+ * Evaluate _GTM and store the result in @gtm.
-+ *
-+ * LOCKING:
-+ * EH context.
-+ *
-+ * RETURNS:
-+ * 0 on success, -ENOENT if _GTM doesn't exist, -errno on failure.
-+ */
-+int ata_acpi_gtm(struct ata_port *ap, struct ata_acpi_gtm *gtm)
-+{
-+	if (ata_ap_acpi_handle(ap))
-+		return __ata_acpi_gtm(ap, ata_ap_acpi_handle(ap), gtm);
-+	else
-+		return -EINVAL;
-+}
-+
- EXPORT_SYMBOL_GPL(ata_acpi_gtm);
- 
- /**
-@@ -1080,7 +1089,7 @@ static int ata_acpi_bind_host(struct ata_port *ap, acpi_handle *handle)
- 	if (!*handle)
- 		return -ENODEV;
- 
--	if (ata_acpi_gtm(ap, &ap->__acpi_init_gtm) == 0)
-+	if (__ata_acpi_gtm(ap, *handle, &ap->__acpi_init_gtm) == 0)
- 		ap->pflags |= ATA_PFLAG_INIT_GTM_VALID;
- 
- 	return 0;
-diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c
-index 5dba77c..b1a664a 100644
---- a/drivers/ata/sata_highbank.c
-+++ b/drivers/ata/sata_highbank.c
-@@ -251,7 +251,7 @@ static const struct ata_port_info ahci_highbank_port_info = {
- };
- 
- static struct scsi_host_template ahci_highbank_platform_sht = {
--	AHCI_SHT("highbank-ahci"),
-+	AHCI_SHT("sata_highbank"),
- };
- 
- static const struct of_device_id ahci_of_match[] = {
-diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
-index 0d2e82f..7c3b3dc 100644
---- a/drivers/char/tpm/tpm.c
-+++ b/drivers/char/tpm/tpm.c
-@@ -1337,7 +1337,7 @@ int tpm_pm_suspend(struct device *dev)
- {
- 	struct tpm_chip *chip = dev_get_drvdata(dev);
- 	struct tpm_cmd_t cmd;
--	int rc;
-+	int rc, try;
- 
- 	u8 dummy_hash[TPM_DIGEST_SIZE] = { 0 };
- 
-@@ -1355,9 +1355,32 @@ int tpm_pm_suspend(struct device *dev)
- 	}
- 
- 	/* now do the actual savestate */
--	cmd.header.in = savestate_header;
--	rc = transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE,
--			  "sending savestate before suspend");
-+	for (try = 0; try < TPM_RETRY; try++) {
-+		cmd.header.in = savestate_header;
-+		rc = transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, NULL);
-+
-+		/*
-+		 * If the TPM indicates that it is too busy to respond to
-+		 * this command then retry before giving up.  It can take
-+		 * several seconds for this TPM to be ready.
-+		 *
-+		 * This can happen if the TPM has already been sent the
-+		 * SaveState command before the driver has loaded.  TCG 1.2
-+		 * specification states that any communication after SaveState
-+		 * may cause the TPM to invalidate previously saved state.
-+		 */
-+		if (rc != TPM_WARN_RETRY)
-+			break;
-+		msleep(TPM_TIMEOUT_RETRY);
-+	}
-+
-+	if (rc)
-+		dev_err(chip->dev,
-+			"Error (%d) sending savestate before suspend\n", rc);
-+	else if (try > 0)
-+		dev_warn(chip->dev, "TPM savestate took %dms\n",
-+			 try * TPM_TIMEOUT_RETRY);
-+
- 	return rc;
- }
- EXPORT_SYMBOL_GPL(tpm_pm_suspend);
-diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
-index 81b5201..0770d1d 100644
---- a/drivers/char/tpm/tpm.h
-+++ b/drivers/char/tpm/tpm.h
-@@ -32,10 +32,12 @@ enum tpm_const {
- 	TPM_MINOR = 224,	/* officially assigned */
- 	TPM_BUFSIZE = 4096,
- 	TPM_NUM_DEVICES = 256,
-+	TPM_RETRY = 50,		/* 5 seconds */
- };
- 
- enum tpm_timeout {
- 	TPM_TIMEOUT = 5,	/* msecs */
-+	TPM_TIMEOUT_RETRY = 100 /* msecs */
- };
- 
- /* TPM addresses */
-@@ -44,6 +46,7 @@ enum tpm_addr {
- 	TPM_ADDR = 0x4E,
- };
- 
-+#define TPM_WARN_RETRY          0x800
- #define TPM_WARN_DOING_SELFTEST 0x802
- #define TPM_ERR_DEACTIVATED     0x6
- #define TPM_ERR_DISABLED        0x7
-diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
-index cafa72f..d6fbb577 100644
---- a/drivers/hv/ring_buffer.c
-+++ b/drivers/hv/ring_buffer.c
-@@ -71,6 +71,7 @@ u32 hv_end_read(struct hv_ring_buffer_info *rbi)
- 
- static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi)
- {
-+	smp_mb();
- 	if (rbi->ring_buffer->interrupt_mask)
- 		return false;
- 
-diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
-index 332c720..3d0f052 100644
---- a/drivers/i2c/busses/i2c-xiic.c
-+++ b/drivers/i2c/busses/i2c-xiic.c
-@@ -312,10 +312,8 @@ static void xiic_fill_tx_fifo(struct xiic_i2c *i2c)
- 			/* last message in transfer -> STOP */
- 			data |= XIIC_TX_DYN_STOP_MASK;
- 			dev_dbg(i2c->adap.dev.parent, "%s TX STOP\n", __func__);
--
--			xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, data);
--		} else
--			xiic_setreg8(i2c, XIIC_DTR_REG_OFFSET, data);
-+		}
-+		xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, data);
- 	}
- }
- 
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index aeceedf..a4a93b9 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -1564,8 +1564,8 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
- 					     sector, count, 1) == 0)
- 				return -EINVAL;
- 		}
--	} else if (sb->bblog_offset == 0)
--		rdev->badblocks.shift = -1;
-+	} else if (sb->bblog_offset != 0)
-+		rdev->badblocks.shift = 0;
- 
- 	if (!refdev) {
- 		ret = 1;
-@@ -3221,7 +3221,7 @@ int md_rdev_init(struct md_rdev *rdev)
- 	 * be used - I wonder if that matters
- 	 */
- 	rdev->badblocks.count = 0;
--	rdev->badblocks.shift = 0;
-+	rdev->badblocks.shift = -1; /* disabled until explicitly enabled */
- 	rdev->badblocks.page = kmalloc(PAGE_SIZE, GFP_KERNEL);
- 	seqlock_init(&rdev->badblocks.lock);
- 	if (rdev->badblocks.page == NULL)
-@@ -3293,9 +3293,6 @@ static struct md_rdev *md_import_device(dev_t newdev, int super_format, int supe
- 			goto abort_free;
- 		}
- 	}
--	if (super_format == -1)
--		/* hot-add for 0.90, or non-persistent: so no badblocks */
--		rdev->badblocks.shift = -1;
- 
- 	return rdev;
- 
-diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index fd86b37..6af167f 100644
---- a/drivers/md/raid1.c
-+++ b/drivers/md/raid1.c
-@@ -981,7 +981,12 @@ static void raid1_unplug(struct blk_plug_cb *cb, bool from_schedule)
- 	while (bio) { /* submit pending writes */
- 		struct bio *next = bio->bi_next;
- 		bio->bi_next = NULL;
--		generic_make_request(bio);
-+		if (unlikely((bio->bi_rw & REQ_DISCARD) &&
-+		    !blk_queue_discard(bdev_get_queue(bio->bi_bdev))))
-+			/* Just ignore it */
-+			bio_endio(bio, 0);
-+		else
-+			generic_make_request(bio);
- 		bio = next;
- 	}
- 	kfree(plug);
-diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index 77b562d..46c14e5 100644
---- a/drivers/md/raid10.c
-+++ b/drivers/md/raid10.c
-@@ -1133,7 +1133,12 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule)
- 	while (bio) { /* submit pending writes */
- 		struct bio *next = bio->bi_next;
- 		bio->bi_next = NULL;
--		generic_make_request(bio);
-+		if (unlikely((bio->bi_rw & REQ_DISCARD) &&
-+		    !blk_queue_discard(bdev_get_queue(bio->bi_bdev))))
-+			/* Just ignore it */
-+			bio_endio(bio, 0);
-+		else
-+			generic_make_request(bio);
- 		bio = next;
- 	}
- 	kfree(plug);
-diff --git a/drivers/mfd/adp5520.c b/drivers/mfd/adp5520.c
-index 210dd03..6b40e0c 100644
---- a/drivers/mfd/adp5520.c
-+++ b/drivers/mfd/adp5520.c
-@@ -36,6 +36,7 @@ struct adp5520_chip {
- 	struct blocking_notifier_head notifier_list;
- 	int irq;
- 	unsigned long id;
-+	uint8_t mode;
- };
- 
- static int __adp5520_read(struct i2c_client *client,
-@@ -326,7 +327,10 @@ static int adp5520_suspend(struct device *dev)
- 	struct i2c_client *client = to_i2c_client(dev);
- 	struct adp5520_chip *chip = dev_get_drvdata(&client->dev);
- 
--	adp5520_clr_bits(chip->dev, ADP5520_MODE_STATUS, ADP5520_nSTNBY);
-+	adp5520_read(chip->dev, ADP5520_MODE_STATUS, &chip->mode);
-+	/* All other bits are W1C */
-+	chip->mode &= ADP5520_BL_EN | ADP5520_DIM_EN | ADP5520_nSTNBY;
-+	adp5520_write(chip->dev, ADP5520_MODE_STATUS, 0);
- 	return 0;
- }
- 
-@@ -335,7 +339,7 @@ static int adp5520_resume(struct device *dev)
- 	struct i2c_client *client = to_i2c_client(dev);
- 	struct adp5520_chip *chip = dev_get_drvdata(&client->dev);
- 
--	adp5520_set_bits(chip->dev, ADP5520_MODE_STATUS, ADP5520_nSTNBY);
-+	adp5520_write(chip->dev, ADP5520_MODE_STATUS, chip->mode);
- 	return 0;
- }
- #endif
-diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
-index c8f3d6e..8ac5101 100644
---- a/drivers/mmc/core/mmc.c
-+++ b/drivers/mmc/core/mmc.c
-@@ -368,13 +368,13 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
- 		ext_csd[EXT_CSD_SEC_FEATURE_SUPPORT];
- 	card->ext_csd.raw_trim_mult =
- 		ext_csd[EXT_CSD_TRIM_MULT];
-+	card->ext_csd.raw_partition_support = ext_csd[EXT_CSD_PARTITION_SUPPORT];
- 	if (card->ext_csd.rev >= 4) {
- 		/*
- 		 * Enhanced area feature support -- check whether the eMMC
- 		 * card has the Enhanced area enabled.  If so, export enhanced
- 		 * area offset and size to user by adding sysfs interface.
- 		 */
--		card->ext_csd.raw_partition_support = ext_csd[EXT_CSD_PARTITION_SUPPORT];
- 		if ((ext_csd[EXT_CSD_PARTITION_SUPPORT] & 0x2) &&
- 		    (ext_csd[EXT_CSD_PARTITION_ATTRIBUTE] & 0x1)) {
- 			hc_erase_grp_sz =
-diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
-index d88219e..9c581c2 100644
---- a/drivers/mmc/host/Kconfig
-+++ b/drivers/mmc/host/Kconfig
-@@ -300,16 +300,6 @@ config MMC_ATMELMCI
- 
- 	  If unsure, say N.
- 
--config MMC_ATMELMCI_DMA
--	bool "Atmel MCI DMA support"
--	depends on MMC_ATMELMCI && (AVR32 || ARCH_AT91SAM9G45) && DMA_ENGINE
--	help
--	  Say Y here to have the Atmel MCI driver use a DMA engine to
--	  do data transfers and thus increase the throughput and
--	  reduce the CPU utilization.
--
--	  If unsure, say N.
--
- config MMC_MSM
- 	tristate "Qualcomm SDCC Controller Support"
- 	depends on MMC && ARCH_MSM
-diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
-index 722af1d..e75774f 100644
---- a/drivers/mmc/host/atmel-mci.c
-+++ b/drivers/mmc/host/atmel-mci.c
-@@ -178,6 +178,7 @@ struct atmel_mci {
- 	void __iomem		*regs;
- 
- 	struct scatterlist	*sg;
-+	unsigned int		sg_len;
- 	unsigned int		pio_offset;
- 	unsigned int		*buffer;
- 	unsigned int		buf_size;
-@@ -892,6 +893,7 @@ static u32 atmci_prepare_data(struct atmel_mci *host, struct mmc_data *data)
- 	data->error = -EINPROGRESS;
- 
- 	host->sg = data->sg;
-+	host->sg_len = data->sg_len;
- 	host->data = data;
- 	host->data_chan = NULL;
- 
-@@ -1826,7 +1828,8 @@ static void atmci_read_data_pio(struct atmel_mci *host)
- 			if (offset == sg->length) {
- 				flush_dcache_page(sg_page(sg));
- 				host->sg = sg = sg_next(sg);
--				if (!sg)
-+				host->sg_len--;
-+				if (!sg || !host->sg_len)
- 					goto done;
- 
- 				offset = 0;
-@@ -1839,7 +1842,8 @@ static void atmci_read_data_pio(struct atmel_mci *host)
- 
- 			flush_dcache_page(sg_page(sg));
- 			host->sg = sg = sg_next(sg);
--			if (!sg)
-+			host->sg_len--;
-+			if (!sg || !host->sg_len)
- 				goto done;
- 
- 			offset = 4 - remaining;
-@@ -1890,7 +1894,8 @@ static void atmci_write_data_pio(struct atmel_mci *host)
- 			nbytes += 4;
- 			if (offset == sg->length) {
- 				host->sg = sg = sg_next(sg);
--				if (!sg)
-+				host->sg_len--;
-+				if (!sg || !host->sg_len)
- 					goto done;
- 
- 				offset = 0;
-@@ -1904,7 +1909,8 @@ static void atmci_write_data_pio(struct atmel_mci *host)
- 			nbytes += remaining;
- 
- 			host->sg = sg = sg_next(sg);
--			if (!sg) {
-+			host->sg_len--;
-+			if (!sg || !host->sg_len) {
- 				atmci_writel(host, ATMCI_TDR, value);
- 				goto done;
- 			}
-@@ -2487,10 +2493,8 @@ static int __exit atmci_remove(struct platform_device *pdev)
- 	atmci_readl(host, ATMCI_SR);
- 	clk_disable(host->mck);
- 
--#ifdef CONFIG_MMC_ATMELMCI_DMA
- 	if (host->dma.chan)
- 		dma_release_channel(host->dma.chan);
--#endif
- 
- 	free_irq(platform_get_irq(pdev, 0), host);
- 	iounmap(host->regs);
-diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
-index 2e5daee..a3f8a25 100644
---- a/drivers/net/ethernet/freescale/gianfar_ptp.c
-+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
-@@ -127,7 +127,6 @@ struct gianfar_ptp_registers {
- 
- #define DRIVER		"gianfar_ptp"
- #define DEFAULT_CKSEL	1
--#define N_ALARM		1 /* first alarm is used internally to reset fipers */
- #define N_EXT_TS	2
- #define REG_SIZE	sizeof(struct gianfar_ptp_registers)
- 
-@@ -410,7 +409,7 @@ static struct ptp_clock_info ptp_gianfar_caps = {
- 	.owner		= THIS_MODULE,
- 	.name		= "gianfar clock",
- 	.max_adj	= 512000,
--	.n_alarm	= N_ALARM,
-+	.n_alarm	= 0,
- 	.n_ext_ts	= N_EXT_TS,
- 	.n_per_out	= 0,
- 	.pps		= 1,
-diff --git a/drivers/net/ethernet/intel/e1000e/ptp.c b/drivers/net/ethernet/intel/e1000e/ptp.c
-index b477fa5..065f8c8 100644
---- a/drivers/net/ethernet/intel/e1000e/ptp.c
-+++ b/drivers/net/ethernet/intel/e1000e/ptp.c
-@@ -145,8 +145,7 @@ static int e1000e_phc_settime(struct ptp_clock_info *ptp,
- 	unsigned long flags;
- 	u64 ns;
- 
--	ns = ts->tv_sec * NSEC_PER_SEC;
--	ns += ts->tv_nsec;
-+	ns = timespec_to_ns(ts);
- 
- 	/* reset the timecounter */
- 	spin_lock_irqsave(&adapter->systim_lock, flags);
-diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
-index 79f4a26..a892efd 100644
---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
-+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
-@@ -2405,6 +2405,16 @@ static irqreturn_t ixgbe_msix_other(int irq, void *data)
- 	 * with the write to EICR.
- 	 */
- 	eicr = IXGBE_READ_REG(hw, IXGBE_EICS);
-+
-+	/* The lower 16bits of the EICR register are for the queue interrupts
-+	 * which should be masked here in order to not accidently clear them if
-+	 * the bits are high when ixgbe_msix_other is called. There is a race
-+	 * condition otherwise which results in possible performance loss
-+	 * especially if the ixgbe_msix_other interrupt is triggering
-+	 * consistently (as it would when PPS is turned on for the X540 device)
-+	 */
-+	eicr &= 0xFFFF0000;
-+
- 	IXGBE_WRITE_REG(hw, IXGBE_EICR, eicr);
- 
- 	if (eicr & IXGBE_EICR_LSC)
-diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
-index 20806ca..81d4071 100644
---- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
-+++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
-@@ -2237,15 +2237,15 @@ static ssize_t iwl_dbgfs_log_event_read(struct file *file,
- 					 size_t count, loff_t *ppos)
- {
- 	struct iwl_priv *priv = file->private_data;
--	char *buf;
--	int pos = 0;
--	ssize_t ret = -ENOMEM;
-+	char *buf = NULL;
-+	ssize_t ret;
- 
--	ret = pos = iwl_dump_nic_event_log(priv, true, &buf, true);
--	if (buf) {
--		ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
--		kfree(buf);
--	}
-+	ret = iwl_dump_nic_event_log(priv, true, &buf, true);
-+	if (ret < 0)
-+		goto err;
-+	ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
-+err:
-+	kfree(buf);
- 	return ret;
- }
- 
-diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
-index b775769..db183b4 100644
---- a/drivers/net/wireless/iwlwifi/dvm/sta.c
-+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
-@@ -695,6 +695,7 @@ void iwl_clear_ucode_stations(struct iwl_priv *priv,
- void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
- {
- 	struct iwl_addsta_cmd sta_cmd;
-+	static const struct iwl_link_quality_cmd zero_lq = {};
- 	struct iwl_link_quality_cmd lq;
- 	int i;
- 	bool found = false;
-@@ -733,7 +734,9 @@ void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
- 				else
- 					memcpy(&lq, priv->stations[i].lq,
- 					       sizeof(struct iwl_link_quality_cmd));
--				send_lq = true;
-+
-+				if (!memcmp(&lq, &zero_lq, sizeof(lq)))
-+					send_lq = true;
- 			}
- 			spin_unlock_bh(&priv->sta_lock);
- 			ret = iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
-diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
-index feb2046..f024fb0 100644
---- a/drivers/net/wireless/mwifiex/pcie.c
-+++ b/drivers/net/wireless/mwifiex/pcie.c
-@@ -2281,9 +2281,9 @@ static void mwifiex_pcie_cleanup(struct mwifiex_adapter *adapter)
- 	if (pdev) {
- 		pci_iounmap(pdev, card->pci_mmap);
- 		pci_iounmap(pdev, card->pci_mmap1);
--
--		pci_release_regions(pdev);
- 		pci_disable_device(pdev);
-+		pci_release_region(pdev, 2);
-+		pci_release_region(pdev, 0);
- 		pci_set_drvdata(pdev, NULL);
- 	}
- }
-diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
-index a658b4b..92849e5 100644
---- a/drivers/net/wireless/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-@@ -4436,6 +4436,8 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
- 
- 	if (!rt2x00_rt(rt2x00dev, RT5390) &&
- 	    !rt2x00_rt(rt2x00dev, RT5392)) {
-+		u8 min_gain = rt2x00_rt(rt2x00dev, RT3070) ? 1 : 2;
-+
- 		rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
- 		rt2x00_set_field8(&rfcsr, RFCSR17_TX_LO1_EN, 0);
- 		if (rt2x00_rt(rt2x00dev, RT3070) ||
-@@ -4446,8 +4448,10 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
- 				      &rt2x00dev->cap_flags))
- 				rt2x00_set_field8(&rfcsr, RFCSR17_R, 1);
- 		}
--		rt2x00_set_field8(&rfcsr, RFCSR17_TXMIXER_GAIN,
--				  drv_data->txmixer_gain_24g);
-+		if (drv_data->txmixer_gain_24g >= min_gain) {
-+			rt2x00_set_field8(&rfcsr, RFCSR17_TXMIXER_GAIN,
-+					  drv_data->txmixer_gain_24g);
-+		}
- 		rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
- 	}
- 
-diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
-index b099e00..fc9bd81 100644
---- a/drivers/pci/pci.c
-+++ b/drivers/pci/pci.c
-@@ -646,15 +646,11 @@ static int pci_platform_power_transition(struct pci_dev *dev, pci_power_t state)
- 		error = platform_pci_set_power_state(dev, state);
- 		if (!error)
- 			pci_update_current_state(dev, state);
--		/* Fall back to PCI_D0 if native PM is not supported */
--		if (!dev->pm_cap)
--			dev->current_state = PCI_D0;
--	} else {
-+	} else
- 		error = -ENODEV;
--		/* Fall back to PCI_D0 if native PM is not supported */
--		if (!dev->pm_cap)
--			dev->current_state = PCI_D0;
--	}
-+
-+	if (error && !dev->pm_cap) /* Fall back to PCI_D0 */
-+		dev->current_state = PCI_D0;
- 
- 	return error;
- }
-diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
-index 434ebc3..eebd8ac 100644
---- a/drivers/rtc/rtc-at91rm9200.c
-+++ b/drivers/rtc/rtc-at91rm9200.c
-@@ -297,7 +297,7 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
- 				"at91_rtc", pdev);
- 	if (ret) {
- 		dev_err(&pdev->dev, "IRQ %d already in use.\n", irq);
--		return ret;
-+		goto err_unmap;
- 	}
- 
- 	/* cpu init code should really have flagged this device as
-@@ -309,13 +309,20 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
- 	rtc = rtc_device_register(pdev->name, &pdev->dev,
- 				&at91_rtc_ops, THIS_MODULE);
- 	if (IS_ERR(rtc)) {
--		free_irq(irq, pdev);
--		return PTR_ERR(rtc);
-+		ret = PTR_ERR(rtc);
-+		goto err_free_irq;
- 	}
- 	platform_set_drvdata(pdev, rtc);
- 
- 	dev_info(&pdev->dev, "AT91 Real Time Clock driver.\n");
- 	return 0;
-+
-+err_free_irq:
-+	free_irq(irq, pdev);
-+err_unmap:
-+	iounmap(at91_rtc_regs);
-+
-+	return ret;
- }
- 
- /*
-@@ -332,6 +339,7 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
- 	free_irq(irq, pdev);
- 
- 	rtc_device_unregister(rtc);
-+	iounmap(at91_rtc_regs);
- 	platform_set_drvdata(pdev, NULL);
- 
- 	return 0;
-diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
-index af97c94..cc5bea9 100644
---- a/drivers/rtc/rtc-cmos.c
-+++ b/drivers/rtc/rtc-cmos.c
-@@ -804,9 +804,8 @@ static int cmos_suspend(struct device *dev)
- 			mask = RTC_IRQMASK;
- 		tmp &= ~mask;
- 		CMOS_WRITE(tmp, RTC_CONTROL);
-+		hpet_mask_rtc_irq_bit(mask);
- 
--		/* shut down hpet emulation - we don't need it for alarm */
--		hpet_mask_rtc_irq_bit(RTC_PIE|RTC_AIE|RTC_UIE);
- 		cmos_checkintr(cmos, tmp);
- 	}
- 	spin_unlock_irq(&rtc_lock);
-@@ -870,6 +869,7 @@ static int cmos_resume(struct device *dev)
- 			rtc_update_irq(cmos->rtc, 1, mask);
- 			tmp &= ~RTC_AIE;
- 			hpet_mask_rtc_irq_bit(RTC_AIE);
-+			hpet_rtc_timer_init();
- 		} while (mask & RTC_AIE);
- 		spin_unlock_irq(&rtc_lock);
- 	}
-diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
-index cd79838..178836e 100644
---- a/drivers/s390/char/sclp_cmd.c
-+++ b/drivers/s390/char/sclp_cmd.c
-@@ -561,6 +561,8 @@ static void __init sclp_add_standby_memory(void)
- 	add_memory_merged(0);
- }
- 
-+#define MEM_SCT_SIZE (1UL << SECTION_SIZE_BITS)
-+
- static void __init insert_increment(u16 rn, int standby, int assigned)
- {
- 	struct memory_increment *incr, *new_incr;
-@@ -573,7 +575,7 @@ static void __init insert_increment(u16 rn, int standby, int assigned)
- 	new_incr->rn = rn;
- 	new_incr->standby = standby;
- 	if (!standby)
--		new_incr->usecount = 1;
-+		new_incr->usecount = rzm > MEM_SCT_SIZE ? rzm/MEM_SCT_SIZE : 1;
- 	last_rn = 0;
- 	prev = &sclp_mem_list;
- 	list_for_each_entry(incr, &sclp_mem_list, list) {
-diff --git a/drivers/staging/zsmalloc/Kconfig b/drivers/staging/zsmalloc/Kconfig
-index 9084565..7fab032 100644
---- a/drivers/staging/zsmalloc/Kconfig
-+++ b/drivers/staging/zsmalloc/Kconfig
-@@ -1,5 +1,5 @@
- config ZSMALLOC
--	tristate "Memory allocator for compressed pages"
-+	bool "Memory allocator for compressed pages"
- 	default n
- 	help
- 	  zsmalloc is a slab-based memory allocator designed to store
-diff --git a/drivers/staging/zsmalloc/zsmalloc-main.c b/drivers/staging/zsmalloc/zsmalloc-main.c
-index e78d262..324e123 100644
---- a/drivers/staging/zsmalloc/zsmalloc-main.c
-+++ b/drivers/staging/zsmalloc/zsmalloc-main.c
-@@ -656,11 +656,8 @@ static inline void __zs_unmap_object(struct mapping_area *area,
- 				struct page *pages[2], int off, int size)
- {
- 	unsigned long addr = (unsigned long)area->vm_addr;
--	unsigned long end = addr + (PAGE_SIZE * 2);
- 
--	flush_cache_vunmap(addr, end);
--	unmap_kernel_range_noflush(addr, PAGE_SIZE * 2);
--	flush_tlb_kernel_range(addr, end);
-+	unmap_kernel_range(addr, PAGE_SIZE * 2);
- }
- 
- #else /* USE_PGTABLE_MAPPING */
-diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
-index c24b4db..125e0fd 100644
---- a/drivers/tty/pty.c
-+++ b/drivers/tty/pty.c
-@@ -682,6 +682,9 @@ static int ptmx_open(struct inode *inode, struct file *filp)
- 
- 	nonseekable_open(inode, filp);
- 
-+	/* We refuse fsnotify events on ptmx, since it's a shared resource */
-+	filp->f_mode |= FMODE_NONOTIFY;
-+
- 	retval = tty_alloc_file(filp);
- 	if (retval)
- 		return retval;
-diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
-index a400002..8fbb6d2 100644
---- a/drivers/tty/serial/serial_core.c
-+++ b/drivers/tty/serial/serial_core.c
-@@ -1941,6 +1941,8 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport)
- 		mutex_unlock(&port->mutex);
- 		return 0;
- 	}
-+	put_device(tty_dev);
-+
- 	if (console_suspend_enabled || !uart_console(uport))
- 		uport->suspended = 1;
- 
-@@ -2006,9 +2008,11 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport)
- 			disable_irq_wake(uport->irq);
- 			uport->irq_wake = 0;
- 		}
-+		put_device(tty_dev);
- 		mutex_unlock(&port->mutex);
- 		return 0;
- 	}
-+	put_device(tty_dev);
- 	uport->suspended = 0;
- 
- 	/*
-diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
-index b045268..a9cd0b9 100644
---- a/drivers/tty/tty_io.c
-+++ b/drivers/tty/tty_io.c
-@@ -941,10 +941,10 @@ void start_tty(struct tty_struct *tty)
- 
- EXPORT_SYMBOL(start_tty);
- 
-+/* We limit tty time update visibility to every 8 seconds or so. */
- static void tty_update_time(struct timespec *time)
- {
--	unsigned long sec = get_seconds();
--	sec -= sec % 60;
-+	unsigned long sec = get_seconds() & ~7;
- 	if ((long)(sec - time->tv_sec) > 0)
- 		time->tv_sec = sec;
- }
-diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
-index f64fbea..d86333b 100644
---- a/drivers/usb/chipidea/udc.c
-+++ b/drivers/usb/chipidea/udc.c
-@@ -461,6 +461,8 @@ static int _hardware_enqueue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq)
- 		mReq->ptr->page[i] =
- 			(mReq->req.dma + i * CI13XXX_PAGE_SIZE) & ~TD_RESERVED_MASK;
- 
-+	wmb();
-+
- 	if (!list_empty(&mEp->qh.queue)) {
- 		struct ci13xxx_req *mReqPrev;
- 		int n = hw_ep_bit(mEp->num, mEp->dir);
-@@ -561,6 +563,12 @@ __acquires(mEp->lock)
- 		struct ci13xxx_req *mReq = \
- 			list_entry(mEp->qh.queue.next,
- 				   struct ci13xxx_req, queue);
-+
-+		if (mReq->zptr) {
-+			dma_pool_free(mEp->td_pool, mReq->zptr, mReq->zdma);
-+			mReq->zptr = NULL;
-+		}
-+
- 		list_del_init(&mReq->queue);
- 		mReq->req.status = -ESHUTDOWN;
- 
-diff --git a/drivers/usb/chipidea/udc.h b/drivers/usb/chipidea/udc.h
-index 4ff2384d..d12e8b5 100644
---- a/drivers/usb/chipidea/udc.h
-+++ b/drivers/usb/chipidea/udc.h
-@@ -40,7 +40,7 @@ struct ci13xxx_td {
- #define TD_CURR_OFFSET        (0x0FFFUL <<  0)
- #define TD_FRAME_NUM          (0x07FFUL <<  0)
- #define TD_RESERVED_MASK      (0x0FFFUL <<  0)
--} __attribute__ ((packed));
-+} __attribute__ ((packed, aligned(4)));
- 
- /* DMA layout of queue heads */
- struct ci13xxx_qh {
-@@ -57,7 +57,7 @@ struct ci13xxx_qh {
- 	/* 9 */
- 	u32 RESERVED;
- 	struct usb_ctrlrequest   setup;
--} __attribute__ ((packed));
-+} __attribute__ ((packed, aligned(4)));
- 
- /**
-  * struct ci13xxx_req - usb request representation
-diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
-index 8823e98..caefc80 100644
---- a/drivers/usb/core/devio.c
-+++ b/drivers/usb/core/devio.c
-@@ -739,6 +739,8 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype,
- 	index &= 0xff;
- 	switch (requesttype & USB_RECIP_MASK) {
- 	case USB_RECIP_ENDPOINT:
-+		if ((index & ~USB_DIR_IN) == 0)
-+			return 0;
- 		ret = findintfep(ps->dev, index);
- 		if (ret >= 0)
- 			ret = checkintf(ps, ret);
-diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
-index 416a6dc..83b5a172 100644
---- a/drivers/usb/host/ehci-hcd.c
-+++ b/drivers/usb/host/ehci-hcd.c
-@@ -670,9 +670,6 @@ int ehci_setup(struct usb_hcd *hcd)
- 	if (retval)
- 		return retval;
- 
--	if (ehci_is_TDI(ehci))
--		tdi_reset(ehci);
--
- 	ehci_reset(ehci);
- 
- 	return 0;
-diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
-index 0fc6e5f..ba6a5d6 100644
---- a/drivers/usb/misc/appledisplay.c
-+++ b/drivers/usb/misc/appledisplay.c
-@@ -63,6 +63,7 @@ static const struct usb_device_id appledisplay_table[] = {
- 	{ APPLEDISPLAY_DEVICE(0x9219) },
- 	{ APPLEDISPLAY_DEVICE(0x921c) },
- 	{ APPLEDISPLAY_DEVICE(0x921d) },
-+	{ APPLEDISPLAY_DEVICE(0x9236) },
- 
- 	/* Terminating entry */
- 	{ }
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index 9886180..be2dcb0 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -189,6 +189,7 @@ static struct usb_device_id id_table_combined [] = {
- 	{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_THROTTLE_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GATEWAY_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_PID) },
-+	{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_BOOST_PID) },
- 	{ USB_DEVICE(NEWPORT_VID, NEWPORT_AGILIS_PID) },
- 	{ USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
- 	{ USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
-@@ -870,7 +871,9 @@ static struct usb_device_id id_table_combined [] = {
- 	{ USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) },
- 	{ USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID),
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
--	{ USB_DEVICE(ST_VID, ST_STMCLT1030_PID),
-+	{ USB_DEVICE(ST_VID, ST_STMCLT_2232_PID),
-+		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-+	{ USB_DEVICE(ST_VID, ST_STMCLT_4232_PID),
- 		.driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk },
- 	{ USB_DEVICE(FTDI_VID, FTDI_RF_R106) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID),
-@@ -1792,20 +1795,24 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)
- }
- 
- /*
-- * First and second port on STMCLiteadaptors is reserved for JTAG interface
-- * and the forth port for pio
-+ * First two ports on JTAG adaptors using an FT4232 such as STMicroelectronics's
-+ * ST Micro Connect Lite are reserved for JTAG or other non-UART interfaces and
-+ * can be accessed from userspace.
-+ * The next two ports are enabled as UARTs by default, where port 2 is
-+ * a conventional RS-232 UART.
-  */
- static int ftdi_stmclite_probe(struct usb_serial *serial)
- {
- 	struct usb_device *udev = serial->dev;
- 	struct usb_interface *interface = serial->interface;
- 
--	if (interface == udev->actconfig->interface[2])
--		return 0;
--
--	dev_info(&udev->dev, "Ignoring serial port reserved for JTAG\n");
-+	if (interface == udev->actconfig->interface[0] ||
-+	    interface == udev->actconfig->interface[1]) {
-+		dev_info(&udev->dev, "Ignoring serial port reserved for JTAG\n");
-+		return -ENODEV;
-+	}
- 
--	return -ENODEV;
-+	return 0;
- }
- 
- /*
-diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
-index e79861e..9852827 100644
---- a/drivers/usb/serial/ftdi_sio_ids.h
-+++ b/drivers/usb/serial/ftdi_sio_ids.h
-@@ -74,6 +74,7 @@
- #define FTDI_OPENDCC_THROTTLE_PID	0xBFDA
- #define FTDI_OPENDCC_GATEWAY_PID	0xBFDB
- #define FTDI_OPENDCC_GBM_PID	0xBFDC
-+#define FTDI_OPENDCC_GBM_BOOST_PID	0xBFDD
- 
- /* NZR SEM 16+ USB (http://www.nzr.de) */
- #define FTDI_NZR_SEM_USB_PID	0xC1E0	/* NZR SEM-LOG16+ */
-@@ -1150,7 +1151,8 @@
-  * STMicroelectonics
-  */
- #define ST_VID			0x0483
--#define ST_STMCLT1030_PID	0x3747 /* ST Micro Connect Lite STMCLT1030 */
-+#define ST_STMCLT_2232_PID	0x3746
-+#define ST_STMCLT_4232_PID	0x3747
- 
- /*
-  * Papouch products (http://www.papouch.com/)
-diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
-index 7777172..38f2489 100644
---- a/drivers/usb/serial/io_ti.c
-+++ b/drivers/usb/serial/io_ti.c
-@@ -2392,7 +2392,7 @@ static int get_serial_info(struct edgeport_port *edge_port,
- 
- 	cwait = edge_port->port->port.closing_wait;
- 	if (cwait != ASYNC_CLOSING_WAIT_NONE)
--		cwait = jiffies_to_msecs(closing_wait) / 10;
-+		cwait = jiffies_to_msecs(cwait) / 10;
- 
- 	memset(&tmp, 0, sizeof(tmp));
- 
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index 558adfc..bff059a 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -347,6 +347,7 @@ static void option_instat_callback(struct urb *urb);
- /* Olivetti products */
- #define OLIVETTI_VENDOR_ID			0x0b3c
- #define OLIVETTI_PRODUCT_OLICARD100		0xc000
-+#define OLIVETTI_PRODUCT_OLICARD145		0xc003
- 
- /* Celot products */
- #define CELOT_VENDOR_ID				0x211f
-@@ -1273,6 +1274,7 @@ static const struct usb_device_id option_ids[] = {
- 	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
- 
- 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
-+	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
- 	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
- 	{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
- 	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
-@@ -1350,6 +1352,12 @@ static const struct usb_device_id option_ids[] = {
- 	{ USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
- 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
- 	{ USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x02, 0x01) },	/* D-Link DWM-156 (variant) */
-+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x00, 0x00) },	/* D-Link DWM-156 (variant) */
-+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x02, 0x01) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
- 	{ } /* Terminating entry */
- };
- MODULE_DEVICE_TABLE(usb, option_ids);
-diff --git a/drivers/usb/storage/cypress_atacb.c b/drivers/usb/storage/cypress_atacb.c
-index 070b5c0..d944088 100644
---- a/drivers/usb/storage/cypress_atacb.c
-+++ b/drivers/usb/storage/cypress_atacb.c
-@@ -248,14 +248,26 @@ static int cypress_probe(struct usb_interface *intf,
- {
- 	struct us_data *us;
- 	int result;
-+	struct usb_device *device;
- 
- 	result = usb_stor_probe1(&us, intf, id,
- 			(id - cypress_usb_ids) + cypress_unusual_dev_list);
- 	if (result)
- 		return result;
- 
--	us->protocol_name = "Transparent SCSI with Cypress ATACB";
--	us->proto_handler = cypress_atacb_passthrough;
-+	/* Among CY7C68300 chips, the A revision does not support Cypress ATACB
-+	 * Filter out this revision from EEPROM default descriptor values
-+	 */
-+	device = interface_to_usbdev(intf);
-+	if (device->descriptor.iManufacturer != 0x38 ||
-+	    device->descriptor.iProduct != 0x4e ||
-+	    device->descriptor.iSerialNumber != 0x64) {
-+		us->protocol_name = "Transparent SCSI with Cypress ATACB";
-+		us->proto_handler = cypress_atacb_passthrough;
-+	} else {
-+		us->protocol_name = "Transparent SCSI";
-+		us->proto_handler = usb_stor_transparent_scsi_command;
-+	}
- 
- 	result = usb_stor_probe2(us);
- 	return result;
-diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
-index 3cd6759..a92783e 100644
---- a/drivers/video/console/fbcon.c
-+++ b/drivers/video/console/fbcon.c
-@@ -1228,6 +1228,8 @@ static void fbcon_deinit(struct vc_data *vc)
- finished:
- 
- 	fbcon_free_font(p, free_font);
-+	if (free_font)
-+		vc->vc_font.data = NULL;
- 
- 	if (!con_is_bound(&fb_con))
- 		fbcon_exit();
-diff --git a/fs/dcache.c b/fs/dcache.c
-index e8bc342..e689268 100644
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -1230,8 +1230,10 @@ void shrink_dcache_parent(struct dentry * parent)
- 	LIST_HEAD(dispose);
- 	int found;
- 
--	while ((found = select_parent(parent, &dispose)) != 0)
-+	while ((found = select_parent(parent, &dispose)) != 0) {
- 		shrink_dentry_list(&dispose);
-+		cond_resched();
-+	}
- }
- EXPORT_SYMBOL(shrink_dcache_parent);
- 
-diff --git a/fs/exec.c b/fs/exec.c
-index a96a488..6d56ff2 100644
---- a/fs/exec.c
-+++ b/fs/exec.c
-@@ -613,7 +613,7 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
- 		 * when the old and new regions overlap clear from new_end.
- 		 */
- 		free_pgd_range(&tlb, new_end, old_end, new_end,
--			vma->vm_next ? vma->vm_next->vm_start : 0);
-+			vma->vm_next ? vma->vm_next->vm_start : USER_PGTABLES_CEILING);
- 	} else {
- 		/*
- 		 * otherwise, clean from old_start; this is done to not touch
-@@ -622,7 +622,7 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
- 		 * for the others its just a little faster.
- 		 */
- 		free_pgd_range(&tlb, old_start, old_end, new_end,
--			vma->vm_next ? vma->vm_next->vm_start : 0);
-+			vma->vm_next ? vma->vm_next->vm_start : USER_PGTABLES_CEILING);
- 	}
- 	tlb_finish_mmu(&tlb, new_end, old_end);
- 
-@@ -898,11 +898,13 @@ static int de_thread(struct task_struct *tsk)
- 
- 		sig->notify_count = -1;	/* for exit_notify() */
- 		for (;;) {
-+			threadgroup_change_begin(tsk);
- 			write_lock_irq(&tasklist_lock);
- 			if (likely(leader->exit_state))
- 				break;
- 			__set_current_state(TASK_KILLABLE);
- 			write_unlock_irq(&tasklist_lock);
-+			threadgroup_change_end(tsk);
- 			schedule();
- 			if (unlikely(__fatal_signal_pending(tsk)))
- 				goto killed;
-@@ -960,6 +962,7 @@ static int de_thread(struct task_struct *tsk)
- 		if (unlikely(leader->ptrace))
- 			__wake_up_parent(leader, leader->parent);
- 		write_unlock_irq(&tasklist_lock);
-+		threadgroup_change_end(tsk);
- 
- 		release_task(leader);
- 	}
-diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig
-index 9873587..efea5d5 100644
---- a/fs/ext4/Kconfig
-+++ b/fs/ext4/Kconfig
-@@ -71,4 +71,5 @@ config EXT4_DEBUG
- 	  Enables run-time debugging support for the ext4 filesystem.
- 
- 	  If you select Y here, then you will be able to turn on debugging
--	  with a command such as "echo 1 > /sys/kernel/debug/ext4/mballoc-debug"
-+	  with a command such as:
-+		echo 1 > /sys/module/ext4/parameters/mballoc_debug
-diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
-index 4c216b1..aeed0ba 100644
---- a/fs/ext4/ext4_jbd2.h
-+++ b/fs/ext4/ext4_jbd2.h
-@@ -194,16 +194,20 @@ static inline void ext4_journal_callback_add(handle_t *handle,
-  * ext4_journal_callback_del: delete a registered callback
-  * @handle: active journal transaction handle on which callback was registered
-  * @jce: registered journal callback entry to unregister
-+ * Return true if object was sucessfully removed
-  */
--static inline void ext4_journal_callback_del(handle_t *handle,
-+static inline bool ext4_journal_callback_try_del(handle_t *handle,
- 					     struct ext4_journal_cb_entry *jce)
- {
-+	bool deleted;
- 	struct ext4_sb_info *sbi =
- 			EXT4_SB(handle->h_transaction->t_journal->j_private);
- 
- 	spin_lock(&sbi->s_md_lock);
-+	deleted = !list_empty(&jce->jce_list);
- 	list_del_init(&jce->jce_list);
- 	spin_unlock(&sbi->s_md_lock);
-+	return deleted;
- }
- 
- int
-diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
-index 3278e64..e0ba8a4 100644
---- a/fs/ext4/fsync.c
-+++ b/fs/ext4/fsync.c
-@@ -166,8 +166,7 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
- 	if (journal->j_flags & JBD2_BARRIER &&
- 	    !jbd2_trans_will_send_data_barrier(journal, commit_tid))
- 		needs_barrier = true;
--	jbd2_log_start_commit(journal, commit_tid);
--	ret = jbd2_log_wait_commit(journal, commit_tid);
-+	ret = jbd2_complete_transaction(journal, commit_tid);
- 	if (needs_barrier) {
- 		err = blkdev_issue_flush(inode->i_sb->s_bdev, GFP_KERNEL, NULL);
- 		if (!ret)
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index b3a5213..d69e954 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -55,21 +55,21 @@ static __u32 ext4_inode_csum(struct inode *inode, struct ext4_inode *raw,
- 	__u16 csum_hi = 0;
- 	__u32 csum;
- 
--	csum_lo = raw->i_checksum_lo;
-+	csum_lo = le16_to_cpu(raw->i_checksum_lo);
- 	raw->i_checksum_lo = 0;
- 	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE &&
- 	    EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) {
--		csum_hi = raw->i_checksum_hi;
-+		csum_hi = le16_to_cpu(raw->i_checksum_hi);
- 		raw->i_checksum_hi = 0;
- 	}
- 
- 	csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw,
- 			   EXT4_INODE_SIZE(inode->i_sb));
- 
--	raw->i_checksum_lo = csum_lo;
-+	raw->i_checksum_lo = cpu_to_le16(csum_lo);
- 	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE &&
- 	    EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi))
--		raw->i_checksum_hi = csum_hi;
-+		raw->i_checksum_hi = cpu_to_le16(csum_hi);
- 
- 	return csum;
- }
-@@ -210,8 +210,7 @@ void ext4_evict_inode(struct inode *inode)
- 			journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
- 			tid_t commit_tid = EXT4_I(inode)->i_datasync_tid;
- 
--			jbd2_log_start_commit(journal, commit_tid);
--			jbd2_log_wait_commit(journal, commit_tid);
-+			jbd2_complete_transaction(journal, commit_tid);
- 			filemap_write_and_wait(&inode->i_data);
- 		}
- 		truncate_inode_pages(&inode->i_data, 0);
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index ee6614b..cf3025c 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -4420,11 +4420,11 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,
- 	node = rb_prev(new_node);
- 	if (node) {
- 		entry = rb_entry(node, struct ext4_free_data, efd_node);
--		if (can_merge(entry, new_entry)) {
-+		if (can_merge(entry, new_entry) &&
-+		    ext4_journal_callback_try_del(handle, &entry->efd_jce)) {
- 			new_entry->efd_start_cluster = entry->efd_start_cluster;
- 			new_entry->efd_count += entry->efd_count;
- 			rb_erase(node, &(db->bb_free_root));
--			ext4_journal_callback_del(handle, &entry->efd_jce);
- 			kmem_cache_free(ext4_free_data_cachep, entry);
- 		}
- 	}
-@@ -4432,10 +4432,10 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,
- 	node = rb_next(new_node);
- 	if (node) {
- 		entry = rb_entry(node, struct ext4_free_data, efd_node);
--		if (can_merge(new_entry, entry)) {
-+		if (can_merge(new_entry, entry) &&
-+		    ext4_journal_callback_try_del(handle, &entry->efd_jce)) {
- 			new_entry->efd_count += entry->efd_count;
- 			rb_erase(node, &(db->bb_free_root));
--			ext4_journal_callback_del(handle, &entry->efd_jce);
- 			kmem_cache_free(ext4_free_data_cachep, entry);
- 		}
- 	}
-diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
-index f9b5515..b3b1f7d 100644
---- a/fs/ext4/mmp.c
-+++ b/fs/ext4/mmp.c
-@@ -7,7 +7,7 @@
- #include "ext4.h"
- 
- /* Checksumming functions */
--static __u32 ext4_mmp_csum(struct super_block *sb, struct mmp_struct *mmp)
-+static __le32 ext4_mmp_csum(struct super_block *sb, struct mmp_struct *mmp)
- {
- 	struct ext4_sb_info *sbi = EXT4_SB(sb);
- 	int offset = offsetof(struct mmp_struct, mmp_checksum);
-diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
-index c169477..1357260 100644
---- a/fs/ext4/resize.c
-+++ b/fs/ext4/resize.c
-@@ -1341,6 +1341,8 @@ static void ext4_update_super(struct super_block *sb,
- 
- 	/* Update the global fs size fields */
- 	sbi->s_groups_count += flex_gd->count;
-+	sbi->s_blockfile_groups = min_t(ext4_group_t, sbi->s_groups_count,
-+			(EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
- 
- 	/* Update the reserved block counts only once the new group is
- 	 * active. */
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 5d6d5357..febbe0e 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -353,10 +353,13 @@ static void ext4_journal_commit_callback(journal_t *journal, transaction_t *txn)
- 	struct super_block		*sb = journal->j_private;
- 	struct ext4_sb_info		*sbi = EXT4_SB(sb);
- 	int				error = is_journal_aborted(journal);
--	struct ext4_journal_cb_entry	*jce, *tmp;
-+	struct ext4_journal_cb_entry	*jce;
- 
-+	BUG_ON(txn->t_state == T_FINISHED);
- 	spin_lock(&sbi->s_md_lock);
--	list_for_each_entry_safe(jce, tmp, &txn->t_private_list, jce_list) {
-+	while (!list_empty(&txn->t_private_list)) {
-+		jce = list_entry(txn->t_private_list.next,
-+				 struct ext4_journal_cb_entry, jce_list);
- 		list_del_init(&jce->jce_list);
- 		spin_unlock(&sbi->s_md_lock);
- 		jce->jce_func(sb, jce, error);
-@@ -3698,6 +3701,9 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
- 	sbi->s_err_report.function = print_daily_error_info;
- 	sbi->s_err_report.data = (unsigned long) sb;
- 
-+	/* Register extent status tree shrinker */
-+	ext4_es_register_shrinker(sb);
-+
- 	err = percpu_counter_init(&sbi->s_freeclusters_counter,
- 			ext4_count_free_clusters(sb));
- 	if (!err) {
-@@ -3723,9 +3729,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
- 	sbi->s_max_writeback_mb_bump = 128;
- 	sbi->s_extent_max_zeroout_kb = 32;
- 
--	/* Register extent status tree shrinker */
--	ext4_es_register_shrinker(sb);
--
- 	/*
- 	 * set up enough so that it can read an inode
- 	 */
-@@ -4010,6 +4013,7 @@ failed_mount_wq:
- 		sbi->s_journal = NULL;
- 	}
- failed_mount3:
-+	ext4_es_unregister_shrinker(sb);
- 	del_timer(&sbi->s_err_report);
- 	if (sbi->s_flex_groups)
- 		ext4_kvfree(sbi->s_flex_groups);
-diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
-index 8179e8b..40d13c7 100644
---- a/fs/fscache/stats.c
-+++ b/fs/fscache/stats.c
-@@ -287,5 +287,5 @@ const struct file_operations fscache_stats_fops = {
- 	.open		= fscache_stats_open,
- 	.read		= seq_read,
- 	.llseek		= seq_lseek,
--	.release	= seq_release,
-+	.release        = single_release,
- };
-diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
-index 750c701..0f53946 100644
---- a/fs/jbd2/commit.c
-+++ b/fs/jbd2/commit.c
-@@ -382,7 +382,7 @@ void jbd2_journal_commit_transaction(journal_t *journal)
- 	int space_left = 0;
- 	int first_tag = 0;
- 	int tag_flag;
--	int i, to_free = 0;
-+	int i;
- 	int tag_bytes = journal_tag_bytes(journal);
- 	struct buffer_head *cbh = NULL; /* For transactional checksums */
- 	__u32 crc32_sum = ~0;
-@@ -1134,7 +1134,7 @@ restart_loop:
- 	journal->j_stats.run.rs_blocks_logged += stats.run.rs_blocks_logged;
- 	spin_unlock(&journal->j_history_lock);
- 
--	commit_transaction->t_state = T_FINISHED;
-+	commit_transaction->t_state = T_COMMIT_CALLBACK;
- 	J_ASSERT(commit_transaction == journal->j_committing_transaction);
- 	journal->j_commit_sequence = commit_transaction->t_tid;
- 	journal->j_committing_transaction = NULL;
-@@ -1149,38 +1149,44 @@ restart_loop:
- 				journal->j_average_commit_time*3) / 4;
- 	else
- 		journal->j_average_commit_time = commit_time;
-+
- 	write_unlock(&journal->j_state_lock);
- 
--	if (commit_transaction->t_checkpoint_list == NULL &&
--	    commit_transaction->t_checkpoint_io_list == NULL) {
--		__jbd2_journal_drop_transaction(journal, commit_transaction);
--		to_free = 1;
-+	if (journal->j_checkpoint_transactions == NULL) {
-+		journal->j_checkpoint_transactions = commit_transaction;
-+		commit_transaction->t_cpnext = commit_transaction;
-+		commit_transaction->t_cpprev = commit_transaction;
- 	} else {
--		if (journal->j_checkpoint_transactions == NULL) {
--			journal->j_checkpoint_transactions = commit_transaction;
--			commit_transaction->t_cpnext = commit_transaction;
--			commit_transaction->t_cpprev = commit_transaction;
--		} else {
--			commit_transaction->t_cpnext =
--				journal->j_checkpoint_transactions;
--			commit_transaction->t_cpprev =
--				commit_transaction->t_cpnext->t_cpprev;
--			commit_transaction->t_cpnext->t_cpprev =
--				commit_transaction;
--			commit_transaction->t_cpprev->t_cpnext =
-+		commit_transaction->t_cpnext =
-+			journal->j_checkpoint_transactions;
-+		commit_transaction->t_cpprev =
-+			commit_transaction->t_cpnext->t_cpprev;
-+		commit_transaction->t_cpnext->t_cpprev =
-+			commit_transaction;
-+		commit_transaction->t_cpprev->t_cpnext =
- 				commit_transaction;
--		}
- 	}
- 	spin_unlock(&journal->j_list_lock);
--
-+	/* Drop all spin_locks because commit_callback may be block.
-+	 * __journal_remove_checkpoint() can not destroy transaction
-+	 * under us because it is not marked as T_FINISHED yet */
- 	if (journal->j_commit_callback)
- 		journal->j_commit_callback(journal, commit_transaction);
- 
- 	trace_jbd2_end_commit(journal, commit_transaction);
- 	jbd_debug(1, "JBD2: commit %d complete, head %d\n",
- 		  journal->j_commit_sequence, journal->j_tail_sequence);
--	if (to_free)
--		jbd2_journal_free_transaction(commit_transaction);
- 
-+	write_lock(&journal->j_state_lock);
-+	spin_lock(&journal->j_list_lock);
-+	commit_transaction->t_state = T_FINISHED;
-+	/* Recheck checkpoint lists after j_list_lock was dropped */
-+	if (commit_transaction->t_checkpoint_list == NULL &&
-+	    commit_transaction->t_checkpoint_io_list == NULL) {
-+		__jbd2_journal_drop_transaction(journal, commit_transaction);
-+		jbd2_journal_free_transaction(commit_transaction);
-+	}
-+	spin_unlock(&journal->j_list_lock);
-+	write_unlock(&journal->j_state_lock);
- 	wake_up(&journal->j_wait_done_commit);
- }
-diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
-index ed10991..886ec2f 100644
---- a/fs/jbd2/journal.c
-+++ b/fs/jbd2/journal.c
-@@ -710,6 +710,37 @@ int jbd2_log_wait_commit(journal_t *journal, tid_t tid)
- }
- 
- /*
-+ * When this function returns the transaction corresponding to tid
-+ * will be completed.  If the transaction has currently running, start
-+ * committing that transaction before waiting for it to complete.  If
-+ * the transaction id is stale, it is by definition already completed,
-+ * so just return SUCCESS.
-+ */
-+int jbd2_complete_transaction(journal_t *journal, tid_t tid)
-+{
-+	int	need_to_wait = 1;
-+
-+	read_lock(&journal->j_state_lock);
-+	if (journal->j_running_transaction &&
-+	    journal->j_running_transaction->t_tid == tid) {
-+		if (journal->j_commit_request != tid) {
-+			/* transaction not yet started, so request it */
-+			read_unlock(&journal->j_state_lock);
-+			jbd2_log_start_commit(journal, tid);
-+			goto wait_commit;
-+		}
-+	} else if (!(journal->j_committing_transaction &&
-+		     journal->j_committing_transaction->t_tid == tid))
-+		need_to_wait = 0;
-+	read_unlock(&journal->j_state_lock);
-+	if (!need_to_wait)
-+		return 0;
-+wait_commit:
-+	return jbd2_log_wait_commit(journal, tid);
-+}
-+EXPORT_SYMBOL(jbd2_complete_transaction);
-+
-+/*
-  * Log buffer allocation routines:
-  */
- 
-diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
-index 0796c45..01bfe76 100644
---- a/fs/lockd/clntlock.c
-+++ b/fs/lockd/clntlock.c
-@@ -144,6 +144,9 @@ int nlmclnt_block(struct nlm_wait *block, struct nlm_rqst *req, long timeout)
- 			timeout);
- 	if (ret < 0)
- 		return -ERESTARTSYS;
-+	/* Reset the lock status after a server reboot so we resend */
-+	if (block->b_status == nlm_lck_denied_grace_period)
-+		block->b_status = nlm_lck_blocked;
- 	req->a_res.status = block->b_status;
- 	return 0;
- }
-diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
-index 7e529c3..9760ecb 100644
---- a/fs/lockd/clntproc.c
-+++ b/fs/lockd/clntproc.c
-@@ -550,9 +550,6 @@ again:
- 		status = nlmclnt_block(block, req, NLMCLNT_POLL_TIMEOUT);
- 		if (status < 0)
- 			break;
--		/* Resend the blocking lock request after a server reboot */
--		if (resp->status ==  nlm_lck_denied_grace_period)
--			continue;
- 		if (resp->status != nlm_lck_blocked)
- 			break;
- 	}
-diff --git a/fs/namespace.c b/fs/namespace.c
-index 341d3f5..e945b81 100644
---- a/fs/namespace.c
-+++ b/fs/namespace.c
-@@ -2238,12 +2238,11 @@ long do_mount(const char *dev_name, const char *dir_name,
- 
- 	retval = security_sb_mount(dev_name, &path,
- 				   type_page, flags, data_page);
-+	if (!retval && !may_mount())
-+		retval = -EPERM;
- 	if (retval)
- 		goto dput_out;
- 
--	if (!may_mount())
--		return -EPERM;
--
- 	/* Default to relatime unless overriden */
- 	if (!(flags & MS_NOATIME))
- 		mnt_flags |= MNT_RELATIME;
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 0ad025e..c7856a1 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -1380,6 +1380,12 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state
- 			case -ENOMEM:
- 				err = 0;
- 				goto out;
-+			case -NFS4ERR_DELAY:
-+			case -NFS4ERR_GRACE:
-+				set_bit(NFS_DELEGATED_STATE, &state->flags);
-+				ssleep(1);
-+				err = -EAGAIN;
-+				goto out;
- 		}
- 		set_bit(NFS_DELEGATED_STATE, &state->flags);
- 		err = nfs4_handle_exception(server, err, &exception);
-@@ -5025,6 +5031,12 @@ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
- 				nfs4_schedule_stateid_recovery(server, state);
- 				err = 0;
- 				goto out;
-+			case -NFS4ERR_DELAY:
-+			case -NFS4ERR_GRACE:
-+				set_bit(NFS_DELEGATED_STATE, &state->flags);
-+				ssleep(1);
-+				err = -EAGAIN;
-+				goto out;
- 			case -ENOMEM:
- 			case -NFS4ERR_DENIED:
- 				/* kill_proc(fl->fl_pid, SIGLOST, 1); */
-diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
-index ae73175..8288b08 100644
---- a/fs/nfsd/nfs4proc.c
-+++ b/fs/nfsd/nfs4proc.c
-@@ -931,14 +931,14 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- 	nfs4_lock_state();
- 	status = nfs4_preprocess_stateid_op(SVC_NET(rqstp),
- 					cstate, stateid, WR_STATE, &filp);
--	if (filp)
--		get_file(filp);
--	nfs4_unlock_state();
--
- 	if (status) {
-+		nfs4_unlock_state();
- 		dprintk("NFSD: nfsd4_write: couldn't process stateid!\n");
- 		return status;
- 	}
-+	if (filp)
-+		get_file(filp);
-+	nfs4_unlock_state();
- 
- 	cnt = write->wr_buflen;
- 	write->wr_how_written = write->wr_stable_how;
-diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
-index 2e27430..f9a5e62 100644
---- a/fs/nfsd/nfs4state.c
-+++ b/fs/nfsd/nfs4state.c
-@@ -210,13 +210,7 @@ static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
- {
- 	if (atomic_dec_and_test(&fp->fi_access[oflag])) {
- 		nfs4_file_put_fd(fp, oflag);
--		/*
--		 * It's also safe to get rid of the RDWR open *if*
--		 * we no longer have need of the other kind of access
--		 * or if we already have the other kind of open:
--		 */
--		if (fp->fi_fds[1-oflag]
--			|| atomic_read(&fp->fi_access[1 - oflag]) == 0)
-+		if (atomic_read(&fp->fi_access[1 - oflag]) == 0)
- 			nfs4_file_put_fd(fp, O_RDWR);
- 	}
- }
-@@ -267,7 +261,7 @@ kmem_cache *slab)
- 		min_stateid = 0;
- 	return stid;
- out_free:
--	kfree(stid);
-+	kmem_cache_free(slab, stid);
- 	return NULL;
- }
- 
-diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
-index a272007..6eb0dc5 100644
---- a/fs/nfsd/nfs4xdr.c
-+++ b/fs/nfsd/nfs4xdr.c
-@@ -344,10 +344,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
- 			   all 32 bits of 'nseconds'. */
- 			READ_BUF(12);
- 			len += 12;
--			READ32(dummy32);
--			if (dummy32)
--				return nfserr_inval;
--			READ32(iattr->ia_atime.tv_sec);
-+			READ64(iattr->ia_atime.tv_sec);
- 			READ32(iattr->ia_atime.tv_nsec);
- 			if (iattr->ia_atime.tv_nsec >= (u32)1000000000)
- 				return nfserr_inval;
-@@ -370,10 +367,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
- 			   all 32 bits of 'nseconds'. */
- 			READ_BUF(12);
- 			len += 12;
--			READ32(dummy32);
--			if (dummy32)
--				return nfserr_inval;
--			READ32(iattr->ia_mtime.tv_sec);
-+			READ64(iattr->ia_mtime.tv_sec);
- 			READ32(iattr->ia_mtime.tv_nsec);
- 			if (iattr->ia_mtime.tv_nsec >= (u32)1000000000)
- 				return nfserr_inval;
-@@ -2401,8 +2395,7 @@ out_acl:
- 	if (bmval1 & FATTR4_WORD1_TIME_ACCESS) {
- 		if ((buflen -= 12) < 0)
- 			goto out_resource;
--		WRITE32(0);
--		WRITE32(stat.atime.tv_sec);
-+		WRITE64((s64)stat.atime.tv_sec);
- 		WRITE32(stat.atime.tv_nsec);
- 	}
- 	if (bmval1 & FATTR4_WORD1_TIME_DELTA) {
-@@ -2415,15 +2408,13 @@ out_acl:
- 	if (bmval1 & FATTR4_WORD1_TIME_METADATA) {
- 		if ((buflen -= 12) < 0)
- 			goto out_resource;
--		WRITE32(0);
--		WRITE32(stat.ctime.tv_sec);
-+		WRITE64((s64)stat.ctime.tv_sec);
- 		WRITE32(stat.ctime.tv_nsec);
- 	}
- 	if (bmval1 & FATTR4_WORD1_TIME_MODIFY) {
- 		if ((buflen -= 12) < 0)
- 			goto out_resource;
--		WRITE32(0);
--		WRITE32(stat.mtime.tv_sec);
-+		WRITE64((s64)stat.mtime.tv_sec);
- 		WRITE32(stat.mtime.tv_nsec);
- 	}
- 	if (bmval1 & FATTR4_WORD1_MOUNTED_ON_FILEID) {
-diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
-index e0f7c12..5fe21d6 100644
---- a/fs/notify/inotify/inotify_user.c
-+++ b/fs/notify/inotify/inotify_user.c
-@@ -572,7 +572,6 @@ static int inotify_update_existing_watch(struct fsnotify_group *group,
- 	int add = (arg & IN_MASK_ADD);
- 	int ret;
- 
--	/* don't allow invalid bits: we don't want flags set */
- 	mask = inotify_arg_to_mask(arg);
- 
- 	fsn_mark = fsnotify_find_inode_mark(group, inode);
-@@ -623,7 +622,6 @@ static int inotify_new_watch(struct fsnotify_group *group,
- 	struct idr *idr = &group->inotify_data.idr;
- 	spinlock_t *idr_lock = &group->inotify_data.idr_lock;
- 
--	/* don't allow invalid bits: we don't want flags set */
- 	mask = inotify_arg_to_mask(arg);
- 
- 	tmp_i_mark = kmem_cache_alloc(inotify_inode_mark_cachep, GFP_KERNEL);
-@@ -751,6 +749,10 @@ SYSCALL_DEFINE3(inotify_add_watch, int, fd, const char __user *, pathname,
- 	int ret;
- 	unsigned flags = 0;
- 
-+	/* don't allow invalid bits: we don't want flags set */
-+	if (unlikely(!(mask & ALL_INOTIFY_BITS)))
-+		return -EINVAL;
-+
- 	f = fdget(fd);
- 	if (unlikely(!f.file))
- 		return -EBADF;
-diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
-index e145126..6f31590 100644
---- a/fs/sysfs/dir.c
-+++ b/fs/sysfs/dir.c
-@@ -1012,6 +1012,7 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
- 	enum kobj_ns_type type;
- 	const void *ns;
- 	ino_t ino;
-+	loff_t off;
- 
- 	type = sysfs_ns_type(parent_sd);
- 	ns = sysfs_info(dentry->d_sb)->ns[type];
-@@ -1034,6 +1035,7 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
- 			return 0;
- 	}
- 	mutex_lock(&sysfs_mutex);
-+	off = filp->f_pos;
- 	for (pos = sysfs_dir_pos(ns, parent_sd, filp->f_pos, pos);
- 	     pos;
- 	     pos = sysfs_dir_next_pos(ns, parent_sd, filp->f_pos, pos)) {
-@@ -1045,19 +1047,24 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
- 		len = strlen(name);
- 		ino = pos->s_ino;
- 		type = dt_type(pos);
--		filp->f_pos = pos->s_hash;
-+		off = filp->f_pos = pos->s_hash;
- 		filp->private_data = sysfs_get(pos);
- 
- 		mutex_unlock(&sysfs_mutex);
--		ret = filldir(dirent, name, len, filp->f_pos, ino, type);
-+		ret = filldir(dirent, name, len, off, ino, type);
- 		mutex_lock(&sysfs_mutex);
- 		if (ret < 0)
- 			break;
- 	}
- 	mutex_unlock(&sysfs_mutex);
--	if ((filp->f_pos > 1) && !pos) { /* EOF */
--		filp->f_pos = INT_MAX;
-+
-+	/* don't reference last entry if its refcount is dropped */
-+	if (!pos) {
- 		filp->private_data = NULL;
-+
-+		/* EOF and not changed as 0 or 1 in read/write path */
-+		if (off == filp->f_pos && off > 1)
-+			filp->f_pos = INT_MAX;
- 	}
- 	return 0;
- }
-diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
-index bfd8768..a59ff51 100644
---- a/include/asm-generic/pgtable.h
-+++ b/include/asm-generic/pgtable.h
-@@ -7,6 +7,16 @@
- #include <linux/mm_types.h>
- #include <linux/bug.h>
- 
-+/*
-+ * On almost all architectures and configurations, 0 can be used as the
-+ * upper ceiling to free_pgtables(): on many architectures it has the same
-+ * effect as using TASK_SIZE.  However, there is one configuration which
-+ * must impose a more careful limit, to avoid freeing kernel pgtables.
-+ */
-+#ifndef USER_PGTABLES_CEILING
-+#define USER_PGTABLES_CEILING	0UL
-+#endif
-+
- #ifndef __HAVE_ARCH_PTEP_SET_ACCESS_FLAGS
- extern int ptep_set_access_flags(struct vm_area_struct *vma,
- 				 unsigned long address, pte_t *ptep,
-diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
-index 900af59..16d4d09 100644
---- a/include/linux/cgroup.h
-+++ b/include/linux/cgroup.h
-@@ -304,9 +304,6 @@ struct cftype {
- 	/* CFTYPE_* flags */
- 	unsigned int flags;
- 
--	/* file xattrs */
--	struct simple_xattrs xattrs;
--
- 	int (*open)(struct inode *inode, struct file *file);
- 	ssize_t (*read)(struct cgroup *cgrp, struct cftype *cft,
- 			struct file *file,
-diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h
-index ae221a7..c4d870b 100644
---- a/include/linux/ipc_namespace.h
-+++ b/include/linux/ipc_namespace.h
-@@ -43,8 +43,8 @@ struct ipc_namespace {
- 
- 	size_t		shm_ctlmax;
- 	size_t		shm_ctlall;
-+	unsigned long	shm_tot;
- 	int		shm_ctlmni;
--	int		shm_tot;
- 	/*
- 	 * Defines whether IPC_RMID is forced for _all_ shm segments regardless
- 	 * of shmctl()
-diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
-index 50e5a5e..f9fe889 100644
---- a/include/linux/jbd2.h
-+++ b/include/linux/jbd2.h
-@@ -480,6 +480,7 @@ struct transaction_s
- 		T_COMMIT,
- 		T_COMMIT_DFLUSH,
- 		T_COMMIT_JFLUSH,
-+		T_COMMIT_CALLBACK,
- 		T_FINISHED
- 	}			t_state;
- 
-@@ -1200,6 +1201,7 @@ int __jbd2_log_start_commit(journal_t *journal, tid_t tid);
- int jbd2_journal_start_commit(journal_t *journal, tid_t *tid);
- int jbd2_journal_force_commit_nested(journal_t *journal);
- int jbd2_log_wait_commit(journal_t *journal, tid_t tid);
-+int jbd2_complete_transaction(journal_t *journal, tid_t tid);
- int jbd2_log_do_checkpoint(journal_t *journal);
- int jbd2_trans_will_send_data_barrier(journal_t *journal, tid_t tid);
- 
-diff --git a/include/linux/sched.h b/include/linux/sched.h
-index e692a02..be4e742 100644
---- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -2413,27 +2413,18 @@ static inline void threadgroup_change_end(struct task_struct *tsk)
-  *
-  * Lock the threadgroup @tsk belongs to.  No new task is allowed to enter
-  * and member tasks aren't allowed to exit (as indicated by PF_EXITING) or
-- * perform exec.  This is useful for cases where the threadgroup needs to
-- * stay stable across blockable operations.
-+ * change ->group_leader/pid.  This is useful for cases where the threadgroup
-+ * needs to stay stable across blockable operations.
-  *
-  * fork and exit paths explicitly call threadgroup_change_{begin|end}() for
-  * synchronization.  While held, no new task will be added to threadgroup
-  * and no existing live task will have its PF_EXITING set.
-  *
-- * During exec, a task goes and puts its thread group through unusual
-- * changes.  After de-threading, exclusive access is assumed to resources
-- * which are usually shared by tasks in the same group - e.g. sighand may
-- * be replaced with a new one.  Also, the exec'ing task takes over group
-- * leader role including its pid.  Exclude these changes while locked by
-- * grabbing cred_guard_mutex which is used to synchronize exec path.
-+ * de_thread() does threadgroup_change_{begin|end}() when a non-leader
-+ * sub-thread becomes a new leader.
-  */
- static inline void threadgroup_lock(struct task_struct *tsk)
- {
--	/*
--	 * exec uses exit for de-threading nesting group_rwsem inside
--	 * cred_guard_mutex. Grab cred_guard_mutex first.
--	 */
--	mutex_lock(&tsk->signal->cred_guard_mutex);
- 	down_write(&tsk->signal->group_rwsem);
- }
- 
-@@ -2446,7 +2437,6 @@ static inline void threadgroup_lock(struct task_struct *tsk)
- static inline void threadgroup_unlock(struct task_struct *tsk)
- {
- 	up_write(&tsk->signal->group_rwsem);
--	mutex_unlock(&tsk->signal->cred_guard_mutex);
- }
- #else
- static inline void threadgroup_change_begin(struct task_struct *tsk) {}
-diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h
-index f841ba4..dfb42ca 100644
---- a/include/sound/emu10k1.h
-+++ b/include/sound/emu10k1.h
-@@ -1787,6 +1787,7 @@ struct snd_emu10k1 {
- 	unsigned int next_free_voice;
- 
- 	const struct firmware *firmware;
-+	const struct firmware *dock_fw;
- 
- #ifdef CONFIG_PM_SLEEP
- 	unsigned int *saved_ptr;
-diff --git a/ipc/shm.c b/ipc/shm.c
-index cb858df..8247c49 100644
---- a/ipc/shm.c
-+++ b/ipc/shm.c
-@@ -462,7 +462,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
- 	size_t size = params->u.size;
- 	int error;
- 	struct shmid_kernel *shp;
--	int numpages = (size + PAGE_SIZE -1) >> PAGE_SHIFT;
-+	size_t numpages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
- 	struct file * file;
- 	char name[13];
- 	int id;
-diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index a32f943..ba1f977 100644
---- a/kernel/cgroup.c
-+++ b/kernel/cgroup.c
-@@ -162,6 +162,9 @@ struct cfent {
- 	struct list_head		node;
- 	struct dentry			*dentry;
- 	struct cftype			*type;
-+
-+	/* file xattrs */
-+	struct simple_xattrs		xattrs;
- };
- 
- /*
-@@ -910,13 +913,12 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
- 	} else {
- 		struct cfent *cfe = __d_cfe(dentry);
- 		struct cgroup *cgrp = dentry->d_parent->d_fsdata;
--		struct cftype *cft = cfe->type;
- 
- 		WARN_ONCE(!list_empty(&cfe->node) &&
- 			  cgrp != &cgrp->root->top_cgroup,
- 			  "cfe still linked for %s\n", cfe->type->name);
-+		simple_xattrs_free(&cfe->xattrs);
- 		kfree(cfe);
--		simple_xattrs_free(&cft->xattrs);
- 	}
- 	iput(inode);
- }
-@@ -2065,7 +2067,7 @@ static int cgroup_attach_proc(struct cgroup *cgrp, struct task_struct *leader)
- 	if (!group)
- 		return -ENOMEM;
- 	/* pre-allocate to guarantee space while iterating in rcu read-side. */
--	retval = flex_array_prealloc(group, 0, group_size - 1, GFP_KERNEL);
-+	retval = flex_array_prealloc(group, 0, group_size, GFP_KERNEL);
- 	if (retval)
- 		goto out_free_group_list;
- 
-@@ -2551,7 +2553,7 @@ static struct simple_xattrs *__d_xattrs(struct dentry *dentry)
- 	if (S_ISDIR(dentry->d_inode->i_mode))
- 		return &__d_cgrp(dentry)->xattrs;
- 	else
--		return &__d_cft(dentry)->xattrs;
-+		return &__d_cfe(dentry)->xattrs;
- }
- 
- static inline int xattr_enabled(struct dentry *dentry)
-@@ -2727,8 +2729,6 @@ static int cgroup_add_file(struct cgroup *cgrp, struct cgroup_subsys *subsys,
- 	umode_t mode;
- 	char name[MAX_CGROUP_TYPE_NAMELEN + MAX_CFTYPE_NAME + 2] = { 0 };
- 
--	simple_xattrs_init(&cft->xattrs);
--
- 	if (subsys && !test_bit(ROOT_NOPREFIX, &cgrp->root->flags)) {
- 		strcpy(name, subsys->name);
- 		strcat(name, ".");
-@@ -2753,6 +2753,7 @@ static int cgroup_add_file(struct cgroup *cgrp, struct cgroup_subsys *subsys,
- 		cfe->type = (void *)cft;
- 		cfe->dentry = dentry;
- 		dentry->d_fsdata = cfe;
-+		simple_xattrs_init(&cfe->xattrs);
- 		list_add_tail(&cfe->node, &parent->files);
- 		cfe = NULL;
- 	}
-diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
-index 14be27f..7ef5556 100644
---- a/kernel/hrtimer.c
-+++ b/kernel/hrtimer.c
-@@ -276,6 +276,10 @@ ktime_t ktime_add_ns(const ktime_t kt, u64 nsec)
- 	} else {
- 		unsigned long rem = do_div(nsec, NSEC_PER_SEC);
- 
-+		/* Make sure nsec fits into long */
-+		if (unlikely(nsec > KTIME_SEC_MAX))
-+			return (ktime_t){ .tv64 = KTIME_MAX };
-+
- 		tmp = ktime_set((long)nsec, rem);
- 	}
- 
-@@ -1310,6 +1314,8 @@ retry:
- 
- 				expires = ktime_sub(hrtimer_get_expires(timer),
- 						    base->offset);
-+				if (expires.tv64 < 0)
-+					expires.tv64 = KTIME_MAX;
- 				if (expires.tv64 < expires_next.tv64)
- 					expires_next = expires;
- 				break;
-diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
-index 0d095dc..93f8e8f 100644
---- a/kernel/rcutree_trace.c
-+++ b/kernel/rcutree_trace.c
-@@ -97,7 +97,7 @@ static const struct file_operations rcubarrier_fops = {
- 	.open = rcubarrier_open,
- 	.read = seq_read,
- 	.llseek = no_llseek,
--	.release = seq_release,
-+	.release = single_release,
- };
- 
- #ifdef CONFIG_RCU_BOOST
-@@ -208,7 +208,7 @@ static const struct file_operations rcuexp_fops = {
- 	.open = rcuexp_open,
- 	.read = seq_read,
- 	.llseek = no_llseek,
--	.release = seq_release,
-+	.release = single_release,
- };
- 
- #ifdef CONFIG_RCU_BOOST
-@@ -308,7 +308,7 @@ static const struct file_operations rcuhier_fops = {
- 	.open = rcuhier_open,
- 	.read = seq_read,
- 	.llseek = no_llseek,
--	.release = seq_release,
-+	.release = single_release,
- };
- 
- static void show_one_rcugp(struct seq_file *m, struct rcu_state *rsp)
-@@ -350,7 +350,7 @@ static const struct file_operations rcugp_fops = {
- 	.open = rcugp_open,
- 	.read = seq_read,
- 	.llseek = no_llseek,
--	.release = seq_release,
-+	.release = single_release,
- };
- 
- static void print_one_rcu_pending(struct seq_file *m, struct rcu_data *rdp)
-diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
-index 7f32fe0..90ad470 100644
---- a/kernel/time/tick-broadcast.c
-+++ b/kernel/time/tick-broadcast.c
-@@ -67,6 +67,8 @@ static void tick_broadcast_start_periodic(struct clock_event_device *bc)
-  */
- int tick_check_broadcast_device(struct clock_event_device *dev)
- {
-+	struct clock_event_device *cur = tick_broadcast_device.evtdev;
-+
- 	if ((dev->features & CLOCK_EVT_FEAT_DUMMY) ||
- 	    (tick_broadcast_device.evtdev &&
- 	     tick_broadcast_device.evtdev->rating >= dev->rating) ||
-@@ -74,6 +76,8 @@ int tick_check_broadcast_device(struct clock_event_device *dev)
- 		return 0;
- 
- 	clockevents_exchange_device(tick_broadcast_device.evtdev, dev);
-+	if (cur)
-+		cur->event_handler = clockevents_handle_noop;
- 	tick_broadcast_device.evtdev = dev;
- 	if (!cpumask_empty(tick_get_broadcast_mask()))
- 		tick_broadcast_start_periodic(dev);
-diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
-index b1600a6..7076b3f 100644
---- a/kernel/time/tick-common.c
-+++ b/kernel/time/tick-common.c
-@@ -323,6 +323,7 @@ static void tick_shutdown(unsigned int *cpup)
- 		 */
- 		dev->mode = CLOCK_EVT_MODE_UNUSED;
- 		clockevents_exchange_device(dev, NULL);
-+		dev->event_handler = clockevents_handle_noop;
- 		td->evtdev = NULL;
- 	}
- 	raw_spin_unlock_irqrestore(&tick_device_lock, flags);
-diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index b3fde6d..0a0e2a6 100644
---- a/kernel/trace/ftrace.c
-+++ b/kernel/trace/ftrace.c
-@@ -676,7 +676,7 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat)
- 
- 	pages = DIV_ROUND_UP(functions, PROFILES_PER_PAGE);
- 
--	for (i = 0; i < pages; i++) {
-+	for (i = 1; i < pages; i++) {
- 		pg->next = (void *)get_zeroed_page(GFP_KERNEL);
- 		if (!pg->next)
- 			goto out_free;
-@@ -3736,7 +3736,8 @@ out:
- 	if (fail)
- 		return -EINVAL;
- 
--	ftrace_graph_filter_enabled = 1;
-+	ftrace_graph_filter_enabled = !!(*idx);
-+
- 	return 0;
- }
- 
-diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index 66338c4..7713d1b 100644
---- a/kernel/trace/trace.c
-+++ b/kernel/trace/trace.c
-@@ -5028,6 +5028,8 @@ static __init int tracer_init_debugfs(void)
- 	trace_access_lock_init();
- 
- 	d_tracer = tracing_init_dentry();
-+	if (!d_tracer)
-+		return 0;
- 
- 	trace_create_file("trace_options", 0644, d_tracer,
- 			NULL, &tracing_iter_fops);
-diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
-index 83a8b5b..b20428c 100644
---- a/kernel/trace/trace_stack.c
-+++ b/kernel/trace/trace_stack.c
-@@ -20,13 +20,24 @@
- 
- #define STACK_TRACE_ENTRIES 500
- 
-+#ifdef CC_USING_FENTRY
-+# define fentry		1
-+#else
-+# define fentry		0
-+#endif
-+
- static unsigned long stack_dump_trace[STACK_TRACE_ENTRIES+1] =
- 	 { [0 ... (STACK_TRACE_ENTRIES)] = ULONG_MAX };
- static unsigned stack_dump_index[STACK_TRACE_ENTRIES];
- 
-+/*
-+ * Reserve one entry for the passed in ip. This will allow
-+ * us to remove most or all of the stack size overhead
-+ * added by the stack tracer itself.
-+ */
- static struct stack_trace max_stack_trace = {
--	.max_entries		= STACK_TRACE_ENTRIES,
--	.entries		= stack_dump_trace,
-+	.max_entries		= STACK_TRACE_ENTRIES - 1,
-+	.entries		= &stack_dump_trace[1],
- };
- 
- static unsigned long max_stack_size;
-@@ -39,25 +50,34 @@ static DEFINE_MUTEX(stack_sysctl_mutex);
- int stack_tracer_enabled;
- static int last_stack_tracer_enabled;
- 
--static inline void check_stack(void)
-+static inline void
-+check_stack(unsigned long ip, unsigned long *stack)
- {
- 	unsigned long this_size, flags;
- 	unsigned long *p, *top, *start;
-+	static int tracer_frame;
-+	int frame_size = ACCESS_ONCE(tracer_frame);
- 	int i;
- 
--	this_size = ((unsigned long)&this_size) & (THREAD_SIZE-1);
-+	this_size = ((unsigned long)stack) & (THREAD_SIZE-1);
- 	this_size = THREAD_SIZE - this_size;
-+	/* Remove the frame of the tracer */
-+	this_size -= frame_size;
- 
- 	if (this_size <= max_stack_size)
- 		return;
- 
- 	/* we do not handle interrupt stacks yet */
--	if (!object_is_on_stack(&this_size))
-+	if (!object_is_on_stack(stack))
- 		return;
- 
- 	local_irq_save(flags);
- 	arch_spin_lock(&max_stack_lock);
- 
-+	/* In case another CPU set the tracer_frame on us */
-+	if (unlikely(!frame_size))
-+		this_size -= tracer_frame;
-+
- 	/* a race could have already updated it */
- 	if (this_size <= max_stack_size)
- 		goto out;
-@@ -70,10 +90,18 @@ static inline void check_stack(void)
- 	save_stack_trace(&max_stack_trace);
- 
- 	/*
-+	 * Add the passed in ip from the function tracer.
-+	 * Searching for this on the stack will skip over
-+	 * most of the overhead from the stack tracer itself.
-+	 */
-+	stack_dump_trace[0] = ip;
-+	max_stack_trace.nr_entries++;
-+
-+	/*
- 	 * Now find where in the stack these are.
- 	 */
- 	i = 0;
--	start = &this_size;
-+	start = stack;
- 	top = (unsigned long *)
- 		(((unsigned long)start & ~(THREAD_SIZE-1)) + THREAD_SIZE);
- 
-@@ -97,6 +125,18 @@ static inline void check_stack(void)
- 				found = 1;
- 				/* Start the search from here */
- 				start = p + 1;
-+				/*
-+				 * We do not want to show the overhead
-+				 * of the stack tracer stack in the
-+				 * max stack. If we haven't figured
-+				 * out what that is, then figure it out
-+				 * now.
-+				 */
-+				if (unlikely(!tracer_frame) && i == 1) {
-+					tracer_frame = (p - stack) *
-+						sizeof(unsigned long);
-+					max_stack_size -= tracer_frame;
-+				}
- 			}
- 		}
- 
-@@ -113,6 +153,7 @@ static void
- stack_trace_call(unsigned long ip, unsigned long parent_ip,
- 		 struct ftrace_ops *op, struct pt_regs *pt_regs)
- {
-+	unsigned long stack;
- 	int cpu;
- 
- 	preempt_disable_notrace();
-@@ -122,7 +163,26 @@ stack_trace_call(unsigned long ip, unsigned long parent_ip,
- 	if (per_cpu(trace_active, cpu)++ != 0)
- 		goto out;
- 
--	check_stack();
-+	/*
-+	 * When fentry is used, the traced function does not get
-+	 * its stack frame set up, and we lose the parent.
-+	 * The ip is pretty useless because the function tracer
-+	 * was called before that function set up its stack frame.
-+	 * In this case, we use the parent ip.
-+	 *
-+	 * By adding the return address of either the parent ip
-+	 * or the current ip we can disregard most of the stack usage
-+	 * caused by the stack tracer itself.
-+	 *
-+	 * The function tracer always reports the address of where the
-+	 * mcount call was, but the stack will hold the return address.
-+	 */
-+	if (fentry)
-+		ip = parent_ip;
-+	else
-+		ip += MCOUNT_INSN_SIZE;
-+
-+	check_stack(ip, &stack);
- 
-  out:
- 	per_cpu(trace_active, cpu)--;
-@@ -371,6 +431,8 @@ static __init int stack_trace_init(void)
- 	struct dentry *d_tracer;
- 
- 	d_tracer = tracing_init_dentry();
-+	if (!d_tracer)
-+		return 0;
- 
- 	trace_create_file("stack_max_size", 0644, d_tracer,
- 			&max_stack_size, &stack_max_size_fops);
-diff --git a/kernel/trace/trace_stat.c b/kernel/trace/trace_stat.c
-index 96cffb2..847f88a 100644
---- a/kernel/trace/trace_stat.c
-+++ b/kernel/trace/trace_stat.c
-@@ -307,6 +307,8 @@ static int tracing_stat_init(void)
- 	struct dentry *d_tracing;
- 
- 	d_tracing = tracing_init_dentry();
-+	if (!d_tracing)
-+		return 0;
- 
- 	stat_dir = debugfs_create_dir("trace_stat", d_tracing);
- 	if (!stat_dir)
-diff --git a/lib/oid_registry.c b/lib/oid_registry.c
-index d8de11f..318f382 100644
---- a/lib/oid_registry.c
-+++ b/lib/oid_registry.c
-@@ -9,6 +9,7 @@
-  * 2 of the Licence, or (at your option) any later version.
-  */
- 
-+#include <linux/module.h>
- #include <linux/export.h>
- #include <linux/oid_registry.h>
- #include <linux/kernel.h>
-@@ -16,6 +17,10 @@
- #include <linux/bug.h>
- #include "oid_registry_data.c"
- 
-+MODULE_DESCRIPTION("OID Registry");
-+MODULE_AUTHOR("Red Hat, Inc.");
-+MODULE_LICENSE("GPL");
-+
- /**
-  * look_up_OID - Find an OID registration for the specified data
-  * @data: Binary representation of the OID
-diff --git a/mm/mmap.c b/mm/mmap.c
-index 0db0de1..033094b 100644
---- a/mm/mmap.c
-+++ b/mm/mmap.c
-@@ -2305,7 +2305,7 @@ static void unmap_region(struct mm_struct *mm,
- 	update_hiwater_rss(mm);
- 	unmap_vmas(&tlb, vma, start, end);
- 	free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS,
--				 next ? next->vm_start : 0);
-+				 next ? next->vm_start : USER_PGTABLES_CEILING);
- 	tlb_finish_mmu(&tlb, start, end);
- }
- 
-@@ -2685,7 +2685,7 @@ void exit_mmap(struct mm_struct *mm)
- 	/* Use -1 here to ensure all VMAs in the mm are unmapped */
- 	unmap_vmas(&tlb, vma, 0, -1);
- 
--	free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, 0);
-+	free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING);
- 	tlb_finish_mmu(&tlb, 0, -1);
- 
- 	/*
-diff --git a/mm/page_io.c b/mm/page_io.c
-index 78eee32..6182870 100644
---- a/mm/page_io.c
-+++ b/mm/page_io.c
-@@ -214,6 +214,7 @@ int swap_writepage(struct page *page, struct writeback_control *wbc)
- 		kiocb.ki_left = PAGE_SIZE;
- 		kiocb.ki_nbytes = PAGE_SIZE;
- 
-+		set_page_writeback(page);
- 		unlock_page(page);
- 		ret = mapping->a_ops->direct_IO(KERNEL_WRITE,
- 						&kiocb, &iov,
-@@ -222,7 +223,23 @@ int swap_writepage(struct page *page, struct writeback_control *wbc)
- 		if (ret == PAGE_SIZE) {
- 			count_vm_event(PSWPOUT);
- 			ret = 0;
-+		} else {
-+			/*
-+			 * In the case of swap-over-nfs, this can be a
-+			 * temporary failure if the system has limited
-+			 * memory for allocating transmit buffers.
-+			 * Mark the page dirty and avoid
-+			 * rotate_reclaimable_page but rate-limit the
-+			 * messages but do not flag PageError like
-+			 * the normal direct-to-bio case as it could
-+			 * be temporary.
-+			 */
-+			set_page_dirty(page);
-+			ClearPageReclaim(page);
-+			pr_err_ratelimited("Write error on dio swapfile (%Lu)\n",
-+				page_file_offset(page));
- 		}
-+		end_page_writeback(page);
- 		return ret;
- 	}
- 
-diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index a689360..843d8c4 100644
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -1034,6 +1034,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
- 	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
- 		sta_info_flush_defer(vlan);
- 	sta_info_flush_defer(sdata);
-+	synchronize_net();
- 	rcu_barrier();
- 	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
- 		sta_info_flush_cleanup(vlan);
-diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index 9ed49ad..d51ca9d 100644
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -844,11 +844,12 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
- 		 *
- 		 * sta_info_flush_cleanup() requires rcu_barrier()
- 		 * first to wait for the station call_rcu() calls
--		 * to complete, here we need at least sychronize_rcu()
--		 * it to wait for the RX path in case it is using the
-+		 * to complete, and we also need synchronize_rcu()
-+		 * to wait for the RX path in case it is using the
- 		 * interface and enqueuing frames at this very time on
- 		 * another CPU.
- 		 */
-+		synchronize_rcu();
- 		rcu_barrier();
- 		sta_info_flush_cleanup(sdata);
- 
-diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
-index d0275f3..835584c 100644
---- a/net/mac80211/pm.c
-+++ b/net/mac80211/pm.c
-@@ -53,8 +53,9 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
- 	ieee80211_stop_queues_by_reason(hw,
- 			IEEE80211_QUEUE_STOP_REASON_SUSPEND);
- 
--	/* flush out all packets */
-+	/* flush out all packets and station cleanup call_rcu()s */
- 	synchronize_net();
-+	rcu_barrier();
- 
- 	drv_flush(local, false);
- 
-diff --git a/net/wireless/reg.c b/net/wireless/reg.c
-index 98532c00..6dee0ad 100644
---- a/net/wireless/reg.c
-+++ b/net/wireless/reg.c
-@@ -855,7 +855,7 @@ static void handle_channel(struct wiphy *wiphy,
- 			return;
- 
- 		REG_DBG_PRINT("Disabling freq %d MHz\n", chan->center_freq);
--		chan->flags = IEEE80211_CHAN_DISABLED;
-+		chan->flags |= IEEE80211_CHAN_DISABLED;
- 		return;
- 	}
- 
-diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
-index 3368939..68b85e1 100644
---- a/scripts/kconfig/streamline_config.pl
-+++ b/scripts/kconfig/streamline_config.pl
-@@ -156,7 +156,6 @@ sub read_kconfig {
- 
-     my $state = "NONE";
-     my $config;
--    my @kconfigs;
- 
-     my $cont = 0;
-     my $line;
-@@ -190,7 +189,13 @@ sub read_kconfig {
- 
- 	# collect any Kconfig sources
- 	if (/^source\s*"(.*)"/) {
--	    $kconfigs[$#kconfigs+1] = $1;
-+	    my $kconfig = $1;
-+	    # prevent reading twice.
-+	    if (!defined($read_kconfigs{$kconfig})) {
-+		$read_kconfigs{$kconfig} = 1;
-+		read_kconfig($kconfig);
-+	    }
-+	    next;
- 	}
- 
- 	# configs found
-@@ -250,14 +255,6 @@ sub read_kconfig {
- 	}
-     }
-     close($kinfile);
--
--    # read in any configs that were found.
--    foreach my $kconfig (@kconfigs) {
--	if (!defined($read_kconfigs{$kconfig})) {
--	    $read_kconfigs{$kconfig} = 1;
--	    read_kconfig($kconfig);
--	}
--    }
- }
- 
- if ($kconfig) {
-diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
-index e6b0166..bdd888e 100644
---- a/sound/pci/emu10k1/emu10k1_main.c
-+++ b/sound/pci/emu10k1/emu10k1_main.c
-@@ -657,14 +657,14 @@ static int snd_emu10k1_cardbus_init(struct snd_emu10k1 *emu)
- 	return 0;
- }
- 
--static int snd_emu1010_load_firmware(struct snd_emu10k1 *emu)
-+static int snd_emu1010_load_firmware(struct snd_emu10k1 *emu,
-+				     const struct firmware *fw_entry)
- {
- 	int n, i;
- 	int reg;
- 	int value;
- 	unsigned int write_post;
- 	unsigned long flags;
--	const struct firmware *fw_entry = emu->firmware;
- 
- 	if (!fw_entry)
- 		return -EIO;
-@@ -725,9 +725,34 @@ static int emu1010_firmware_thread(void *data)
- 			/* Return to Audio Dock programming mode */
- 			snd_printk(KERN_INFO "emu1010: Loading Audio Dock Firmware\n");
- 			snd_emu1010_fpga_write(emu, EMU_HANA_FPGA_CONFIG, EMU_HANA_FPGA_CONFIG_AUDIODOCK);
--			err = snd_emu1010_load_firmware(emu);
--			if (err != 0)
--				continue;
-+
-+			if (!emu->dock_fw) {
-+				const char *filename = NULL;
-+				switch (emu->card_capabilities->emu_model) {
-+				case EMU_MODEL_EMU1010:
-+					filename = DOCK_FILENAME;
-+					break;
-+				case EMU_MODEL_EMU1010B:
-+					filename = MICRO_DOCK_FILENAME;
-+					break;
-+				case EMU_MODEL_EMU1616:
-+					filename = MICRO_DOCK_FILENAME;
-+					break;
-+				}
-+				if (filename) {
-+					err = request_firmware(&emu->dock_fw,
-+							       filename,
-+							       &emu->pci->dev);
-+					if (err)
-+						continue;
-+				}
-+			}
-+
-+			if (emu->dock_fw) {
-+				err = snd_emu1010_load_firmware(emu, emu->dock_fw);
-+				if (err)
-+					continue;
-+			}
- 
- 			snd_emu1010_fpga_write(emu, EMU_HANA_FPGA_CONFIG, 0);
- 			snd_emu1010_fpga_read(emu, EMU_HANA_IRQ_STATUS, &reg);
-@@ -862,7 +887,7 @@ static int snd_emu10k1_emu1010_init(struct snd_emu10k1 *emu)
- 			   filename, emu->firmware->size);
- 	}
- 
--	err = snd_emu1010_load_firmware(emu);
-+	err = snd_emu1010_load_firmware(emu, emu->firmware);
- 	if (err != 0) {
- 		snd_printk(KERN_INFO "emu1010: Loading Firmware failed\n");
- 		return err;
-@@ -1253,6 +1278,8 @@ static int snd_emu10k1_free(struct snd_emu10k1 *emu)
- 		kthread_stop(emu->emu1010.firmware_thread);
- 	if (emu->firmware)
- 		release_firmware(emu->firmware);
-+	if (emu->dock_fw)
-+		release_firmware(emu->dock_fw);
- 	if (emu->irq >= 0)
- 		free_irq(emu->irq, emu);
- 	/* remove reserved page */
-diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
-index 2dbe767..d74500b 100644
---- a/sound/pci/hda/hda_generic.c
-+++ b/sound/pci/hda/hda_generic.c
-@@ -2072,6 +2072,14 @@ get_multiio_path(struct hda_codec *codec, int idx)
- 
- static void update_automute_all(struct hda_codec *codec);
- 
-+/* Default value to be passed as aamix argument for snd_hda_activate_path();
-+ * used for output paths
-+ */
-+static bool aamix_default(struct hda_gen_spec *spec)
-+{
-+	return !spec->have_aamix_ctl || spec->aamix_mode;
-+}
-+
- static int set_multi_io(struct hda_codec *codec, int idx, bool output)
- {
- 	struct hda_gen_spec *spec = codec->spec;
-@@ -2087,11 +2095,11 @@ static int set_multi_io(struct hda_codec *codec, int idx, bool output)
- 
- 	if (output) {
- 		set_pin_target(codec, nid, PIN_OUT, true);
--		snd_hda_activate_path(codec, path, true, true);
-+		snd_hda_activate_path(codec, path, true, aamix_default(spec));
- 		set_pin_eapd(codec, nid, true);
- 	} else {
- 		set_pin_eapd(codec, nid, false);
--		snd_hda_activate_path(codec, path, false, true);
-+		snd_hda_activate_path(codec, path, false, aamix_default(spec));
- 		set_pin_target(codec, nid, spec->multi_io[idx].ctl_in, true);
- 		path_power_down_sync(codec, path);
- 	}
-@@ -2182,8 +2190,8 @@ static void update_aamix_paths(struct hda_codec *codec, bool do_mix,
- 		snd_hda_activate_path(codec, mix_path, true, true);
- 		path_power_down_sync(codec, nomix_path);
- 	} else {
--		snd_hda_activate_path(codec, mix_path, false, true);
--		snd_hda_activate_path(codec, nomix_path, true, true);
-+		snd_hda_activate_path(codec, mix_path, false, false);
-+		snd_hda_activate_path(codec, nomix_path, true, false);
- 		path_power_down_sync(codec, mix_path);
- 	}
- }
-@@ -4729,7 +4737,8 @@ static void set_output_and_unmute(struct hda_codec *codec, int path_idx)
- 		return;
- 	pin = path->path[path->depth - 1];
- 	restore_pin_ctl(codec, pin);
--	snd_hda_activate_path(codec, path, path->active, true);
-+	snd_hda_activate_path(codec, path, path->active,
-+			      aamix_default(codec->spec));
- 	set_pin_eapd(codec, pin, path->active);
- }
- 
-@@ -4779,7 +4788,8 @@ static void init_multi_io(struct hda_codec *codec)
- 		if (!spec->multi_io[i].ctl_in)
- 			spec->multi_io[i].ctl_in =
- 				snd_hda_codec_get_pin_target(codec, pin);
--		snd_hda_activate_path(codec, path, path->active, true);
-+		snd_hda_activate_path(codec, path, path->active,
-+				      aamix_default(spec));
- 	}
- }
- 
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index f15c36b..fd1970c 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -2515,6 +2515,7 @@ enum {
- 	ALC269_TYPE_ALC280,
- 	ALC269_TYPE_ALC282,
- 	ALC269_TYPE_ALC284,
-+	ALC269_TYPE_ALC286,
- };
- 
- /*
-@@ -2538,6 +2539,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
- 	case ALC269_TYPE_ALC269VB:
- 	case ALC269_TYPE_ALC269VD:
- 	case ALC269_TYPE_ALC282:
-+	case ALC269_TYPE_ALC286:
- 		ssids = alc269_ssids;
- 		break;
- 	default:
-@@ -3172,6 +3174,9 @@ static int patch_alc269(struct hda_codec *codec)
- 	case 0x10ec0292:
- 		spec->codec_variant = ALC269_TYPE_ALC284;
- 		break;
-+	case 0x10ec0286:
-+		spec->codec_variant = ALC269_TYPE_ALC286;
-+		break;
- 	}
- 
- 	/* automatic parse from the BIOS config */
-@@ -3878,6 +3883,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
- 	{ .id = 0x10ec0282, .name = "ALC282", .patch = patch_alc269 },
- 	{ .id = 0x10ec0283, .name = "ALC283", .patch = patch_alc269 },
- 	{ .id = 0x10ec0284, .name = "ALC284", .patch = patch_alc269 },
-+	{ .id = 0x10ec0286, .name = "ALC286", .patch = patch_alc269 },
- 	{ .id = 0x10ec0290, .name = "ALC290", .patch = patch_alc269 },
- 	{ .id = 0x10ec0292, .name = "ALC292", .patch = patch_alc269 },
- 	{ .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660",
-diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c
-index a4c16fd..5d36319 100644
---- a/sound/soc/codecs/max98088.c
-+++ b/sound/soc/codecs/max98088.c
-@@ -2006,7 +2006,7 @@ static int max98088_probe(struct snd_soc_codec *codec)
-                        ret);
-                goto err_access;
-        }
--       dev_info(codec->dev, "revision %c\n", ret + 'A');
-+       dev_info(codec->dev, "revision %c\n", ret - 0x40 + 'A');
- 
-        snd_soc_write(codec, M98088_REG_51_PWR_SYS, M98088_PWRSV);
- 
-diff --git a/sound/usb/6fire/pcm.c b/sound/usb/6fire/pcm.c
-index e2ca12f..40dd50a 100644
---- a/sound/usb/6fire/pcm.c
-+++ b/sound/usb/6fire/pcm.c
-@@ -575,7 +575,6 @@ static void usb6fire_pcm_init_urb(struct pcm_urb *urb,
- 	urb->instance.pipe = in ? usb_rcvisocpipe(chip->dev, ep)
- 			: usb_sndisocpipe(chip->dev, ep);
- 	urb->instance.interval = 1;
--	urb->instance.transfer_flags = URB_ISO_ASAP;
- 	urb->instance.complete = handler;
- 	urb->instance.context = urb;
- 	urb->instance.number_of_packets = PCM_N_PACKETS_PER_URB;
-diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
-index fde9a7a..b45e29b 100644
---- a/sound/usb/caiaq/audio.c
-+++ b/sound/usb/caiaq/audio.c
-@@ -670,7 +670,6 @@ static void read_completed(struct urb *urb)
- 
- 	if (send_it) {
- 		out->number_of_packets = outframe;
--		out->transfer_flags = URB_ISO_ASAP;
- 		usb_submit_urb(out, GFP_ATOMIC);
- 	} else {
- 		struct snd_usb_caiaq_cb_info *oinfo = out->context;
-@@ -686,7 +685,6 @@ requeue:
- 	}
- 
- 	urb->number_of_packets = FRAMES_PER_URB;
--	urb->transfer_flags = URB_ISO_ASAP;
- 	usb_submit_urb(urb, GFP_ATOMIC);
- }
- 
-@@ -751,7 +749,6 @@ static struct urb **alloc_urbs(struct snd_usb_caiaqdev *dev, int dir, int *ret)
- 						* BYTES_PER_FRAME;
- 		urbs[i]->context = &dev->data_cb_info[i];
- 		urbs[i]->interval = 1;
--		urbs[i]->transfer_flags = URB_ISO_ASAP;
- 		urbs[i]->number_of_packets = FRAMES_PER_URB;
- 		urbs[i]->complete = (dir == SNDRV_PCM_STREAM_CAPTURE) ?
- 					read_completed : write_completed;
-diff --git a/sound/usb/card.c b/sound/usb/card.c
-index 2da8ad7..b79b7dc 100644
---- a/sound/usb/card.c
-+++ b/sound/usb/card.c
-@@ -627,7 +627,9 @@ int snd_usb_autoresume(struct snd_usb_audio *chip)
- 	int err = -ENODEV;
- 
- 	down_read(&chip->shutdown_rwsem);
--	if (!chip->shutdown && !chip->probing)
-+	if (chip->probing)
-+		err = 0;
-+	else if (!chip->shutdown)
- 		err = usb_autopm_get_interface(chip->pm_intf);
- 	up_read(&chip->shutdown_rwsem);
- 
-diff --git a/sound/usb/card.h b/sound/usb/card.h
-index 8a751b4..d32ea41 100644
---- a/sound/usb/card.h
-+++ b/sound/usb/card.h
-@@ -116,6 +116,7 @@ struct snd_usb_substream {
- 	unsigned int altset_idx;     /* USB data format: index of alternate setting */
- 	unsigned int txfr_quirk:1;	/* allow sub-frame alignment */
- 	unsigned int fmt_type;		/* USB audio format type (1-3) */
-+	unsigned int pkt_offset_adj;	/* Bytes to drop from beginning of packets (for non-compliant devices) */
- 
- 	unsigned int running: 1;	/* running status */
- 
-diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
-index 21049b8..63cca3a 100644
---- a/sound/usb/endpoint.c
-+++ b/sound/usb/endpoint.c
-@@ -677,7 +677,7 @@ static int data_ep_set_params(struct snd_usb_endpoint *ep,
- 		if (!u->urb->transfer_buffer)
- 			goto out_of_memory;
- 		u->urb->pipe = ep->pipe;
--		u->urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
-+		u->urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
- 		u->urb->interval = 1 << ep->datainterval;
- 		u->urb->context = u;
- 		u->urb->complete = snd_complete_urb;
-@@ -716,8 +716,7 @@ static int sync_ep_set_params(struct snd_usb_endpoint *ep,
- 		u->urb->transfer_dma = ep->sync_dma + i * 4;
- 		u->urb->transfer_buffer_length = 4;
- 		u->urb->pipe = ep->pipe;
--		u->urb->transfer_flags = URB_ISO_ASAP |
--					 URB_NO_TRANSFER_DMA_MAP;
-+		u->urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
- 		u->urb->number_of_packets = 1;
- 		u->urb->interval = 1 << ep->syncinterval;
- 		u->urb->context = u;
-diff --git a/sound/usb/midi.c b/sound/usb/midi.c
-index 34b9bb7..e5fee18 100644
---- a/sound/usb/midi.c
-+++ b/sound/usb/midi.c
-@@ -126,7 +126,6 @@ struct snd_usb_midi {
- 		struct snd_usb_midi_in_endpoint *in;
- 	} endpoints[MIDI_MAX_ENDPOINTS];
- 	unsigned long input_triggered;
--	bool autopm_reference;
- 	unsigned int opened[2];
- 	unsigned char disconnected;
- 	unsigned char input_running;
-@@ -1040,7 +1039,6 @@ static int substream_open(struct snd_rawmidi_substream *substream, int dir,
- {
- 	struct snd_usb_midi* umidi = substream->rmidi->private_data;
- 	struct snd_kcontrol *ctl;
--	int err;
- 
- 	down_read(&umidi->disc_rwsem);
- 	if (umidi->disconnected) {
-@@ -1051,13 +1049,6 @@ static int substream_open(struct snd_rawmidi_substream *substream, int dir,
- 	mutex_lock(&umidi->mutex);
- 	if (open) {
- 		if (!umidi->opened[0] && !umidi->opened[1]) {
--			err = usb_autopm_get_interface(umidi->iface);
--			umidi->autopm_reference = err >= 0;
--			if (err < 0 && err != -EACCES) {
--				mutex_unlock(&umidi->mutex);
--				up_read(&umidi->disc_rwsem);
--				return -EIO;
--			}
- 			if (umidi->roland_load_ctl) {
- 				ctl = umidi->roland_load_ctl;
- 				ctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
-@@ -1080,8 +1071,6 @@ static int substream_open(struct snd_rawmidi_substream *substream, int dir,
- 				snd_ctl_notify(umidi->card,
- 				       SNDRV_CTL_EVENT_MASK_INFO, &ctl->id);
- 			}
--			if (umidi->autopm_reference)
--				usb_autopm_put_interface(umidi->iface);
- 		}
- 	}
- 	mutex_unlock(&umidi->mutex);
-@@ -2256,6 +2245,8 @@ int snd_usbmidi_create(struct snd_card *card,
- 		return err;
- 	}
- 
-+	usb_autopm_get_interface_no_resume(umidi->iface);
-+
- 	list_add_tail(&umidi->list, midi_list);
- 	return 0;
- }
-diff --git a/sound/usb/misc/ua101.c b/sound/usb/misc/ua101.c
-index 8b81cb5..6ad617b 100644
---- a/sound/usb/misc/ua101.c
-+++ b/sound/usb/misc/ua101.c
-@@ -1120,8 +1120,7 @@ static int alloc_stream_urbs(struct ua101 *ua, struct ua101_stream *stream,
- 			usb_init_urb(&urb->urb);
- 			urb->urb.dev = ua->dev;
- 			urb->urb.pipe = stream->usb_pipe;
--			urb->urb.transfer_flags = URB_ISO_ASAP |
--					URB_NO_TRANSFER_DMA_MAP;
-+			urb->urb.transfer_flags = URB_NO_TRANSFER_DMA_MAP;
- 			urb->urb.transfer_buffer = addr;
- 			urb->urb.transfer_dma = dma;
- 			urb->urb.transfer_buffer_length = max_packet_size;
-diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
-index f94397b..a481fea 100644
---- a/sound/usb/pcm.c
-+++ b/sound/usb/pcm.c
-@@ -1170,7 +1170,7 @@ static void retire_capture_urb(struct snd_usb_substream *subs,
- 	stride = runtime->frame_bits >> 3;
- 
- 	for (i = 0; i < urb->number_of_packets; i++) {
--		cp = (unsigned char *)urb->transfer_buffer + urb->iso_frame_desc[i].offset;
-+		cp = (unsigned char *)urb->transfer_buffer + urb->iso_frame_desc[i].offset + subs->pkt_offset_adj;
- 		if (urb->iso_frame_desc[i].status && printk_ratelimit()) {
- 			snd_printdd(KERN_ERR "frame %d active: %d\n", i, urb->iso_frame_desc[i].status);
- 			// continue;
-diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
-index 9c5ab22..0c7eb49 100644
---- a/sound/usb/quirks.c
-+++ b/sound/usb/quirks.c
-@@ -837,6 +837,7 @@ static void set_format_emu_quirk(struct snd_usb_substream *subs,
- 		break;
- 	}
- 	snd_emuusb_set_samplerate(subs->stream->chip, emu_samplerate_id);
-+	subs->pkt_offset_adj = (emu_samplerate_id >= EMU_QUIRK_SR_176400HZ) ? 4 : 0;
- }
- 
- void snd_usb_set_format_quirk(struct snd_usb_substream *subs,
-diff --git a/sound/usb/stream.c b/sound/usb/stream.c
-index ad181d5..cfc4d4e 100644
---- a/sound/usb/stream.c
-+++ b/sound/usb/stream.c
-@@ -94,6 +94,7 @@ static void snd_usb_init_substream(struct snd_usb_stream *as,
- 	subs->dev = as->chip->dev;
- 	subs->txfr_quirk = as->chip->txfr_quirk;
- 	subs->speed = snd_usb_get_speed(subs->dev);
-+	subs->pkt_offset_adj = 0;
- 
- 	snd_usb_set_pcm_ops(as->pcm, stream);
- 
-@@ -396,6 +397,14 @@ static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip,
- 	if (!csep && altsd->bNumEndpoints >= 2)
- 		csep = snd_usb_find_desc(alts->endpoint[1].extra, alts->endpoint[1].extralen, NULL, USB_DT_CS_ENDPOINT);
- 
-+	/*
-+	 * If we can't locate the USB_DT_CS_ENDPOINT descriptor in the extra
-+	 * bytes after the first endpoint, go search the entire interface.
-+	 * Some devices have it directly *before* the standard endpoint.
-+	 */
-+	if (!csep)
-+		csep = snd_usb_find_desc(alts->extra, alts->extralen, NULL, USB_DT_CS_ENDPOINT);
-+
- 	if (!csep || csep->bLength < 7 ||
- 	    csep->bDescriptorSubtype != UAC_EP_GENERAL) {
- 		snd_printk(KERN_WARNING "%d:%u:%d : no or invalid"
-diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c
-index 1e7a47a..bf618e1 100644
---- a/sound/usb/usx2y/usb_stream.c
-+++ b/sound/usb/usx2y/usb_stream.c
-@@ -69,7 +69,6 @@ static void init_pipe_urbs(struct usb_stream_kernel *sk, unsigned use_packsize,
- 	     ++u, transfer += transfer_length) {
- 		struct urb *urb = urbs[u];
- 		struct usb_iso_packet_descriptor *desc;
--		urb->transfer_flags = URB_ISO_ASAP;
- 		urb->transfer_buffer = transfer;
- 		urb->dev = dev;
- 		urb->pipe = pipe;
-diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
-index 520ef96..b376532 100644
---- a/sound/usb/usx2y/usbusx2yaudio.c
-+++ b/sound/usb/usx2y/usbusx2yaudio.c
-@@ -503,7 +503,6 @@ static int usX2Y_urbs_start(struct snd_usX2Y_substream *subs)
- 			if (0 == i)
- 				atomic_set(&subs->state, state_STARTING3);
- 			urb->dev = usX2Y->dev;
--			urb->transfer_flags = URB_ISO_ASAP;
- 			for (pack = 0; pack < nr_of_packs(); pack++) {
- 				urb->iso_frame_desc[pack].offset = subs->maxpacksize * pack;
- 				urb->iso_frame_desc[pack].length = subs->maxpacksize;
-diff --git a/sound/usb/usx2y/usx2yhwdeppcm.c b/sound/usb/usx2y/usx2yhwdeppcm.c
-index cc56007..f2a1acd 100644
---- a/sound/usb/usx2y/usx2yhwdeppcm.c
-+++ b/sound/usb/usx2y/usx2yhwdeppcm.c
-@@ -443,7 +443,6 @@ static int usX2Y_usbpcm_urbs_start(struct snd_usX2Y_substream *subs)
- 					if (0 == u)
- 						atomic_set(&subs->state, state_STARTING3);
- 					urb->dev = usX2Y->dev;
--					urb->transfer_flags = URB_ISO_ASAP;
- 					for (pack = 0; pack < nr_of_packs(); pack++) {
- 						urb->iso_frame_desc[pack].offset = subs->maxpacksize * (pack + u * nr_of_packs());
- 						urb->iso_frame_desc[pack].length = subs->maxpacksize;

Deleted: genpatches-2.6/trunk/3.10/1001_linux-3.9.2.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1001_linux-3.9.2.patch	2013-05-21 00:40:11 UTC (rev 2385)
+++ genpatches-2.6/trunk/3.10/1001_linux-3.9.2.patch	2013-05-21 00:44:32 UTC (rev 2386)
@@ -1,2950 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 5fcb591..3e71511 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 9
--SUBLEVEL = 1
-+SUBLEVEL = 2
- EXTRAVERSION =
- NAME = Unicycling Gorilla
- 
-diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
-index 8dc0605..99ce189 100644
---- a/arch/arm/xen/enlighten.c
-+++ b/arch/arm/xen/enlighten.c
-@@ -239,7 +239,7 @@ static int __init xen_init_events(void)
- 	xen_init_IRQ();
- 
- 	if (request_percpu_irq(xen_events_irq, xen_arm_callback,
--			"events", xen_vcpu)) {
-+			"events", &xen_vcpu)) {
- 		pr_err("Error requesting IRQ %d\n", xen_events_irq);
- 		return -EINVAL;
- 	}
-diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
-index afadae6..0782eaf 100644
---- a/arch/arm64/mm/fault.c
-+++ b/arch/arm64/mm/fault.c
-@@ -148,6 +148,7 @@ void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *regs)
- #define VM_FAULT_BADACCESS	0x020000
- 
- #define ESR_WRITE		(1 << 6)
-+#define ESR_CM			(1 << 8)
- #define ESR_LNX_EXEC		(1 << 24)
- 
- /*
-@@ -206,7 +207,7 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
- 	struct task_struct *tsk;
- 	struct mm_struct *mm;
- 	int fault, sig, code;
--	int write = esr & ESR_WRITE;
-+	bool write = (esr & ESR_WRITE) && !(esr & ESR_CM);
- 	unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
- 		(write ? FAULT_FLAG_WRITE : 0);
- 
-diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
-index 8752bc8..8cbc6e5 100644
---- a/arch/powerpc/include/asm/ppc-opcode.h
-+++ b/arch/powerpc/include/asm/ppc-opcode.h
-@@ -113,6 +113,10 @@
- #define PPC_INST_MFSPR_DSCR_MASK	0xfc1fffff
- #define PPC_INST_MTSPR_DSCR		0x7c1103a6
- #define PPC_INST_MTSPR_DSCR_MASK	0xfc1fffff
-+#define PPC_INST_MFSPR_DSCR_USER	0x7c0302a6
-+#define PPC_INST_MFSPR_DSCR_USER_MASK	0xfc1fffff
-+#define PPC_INST_MTSPR_DSCR_USER	0x7c0303a6
-+#define PPC_INST_MTSPR_DSCR_USER_MASK	0xfc1fffff
- #define PPC_INST_SLBFEE			0x7c0007a7
- 
- #define PPC_INST_STRING			0x7c00042a
-diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
-index 37cc40e..83efa2f 100644
---- a/arch/powerpc/kernel/traps.c
-+++ b/arch/powerpc/kernel/traps.c
-@@ -970,7 +970,10 @@ static int emulate_instruction(struct pt_regs *regs)
- 
- #ifdef CONFIG_PPC64
- 	/* Emulate the mfspr rD, DSCR. */
--	if (((instword & PPC_INST_MFSPR_DSCR_MASK) == PPC_INST_MFSPR_DSCR) &&
-+	if ((((instword & PPC_INST_MFSPR_DSCR_USER_MASK) ==
-+		PPC_INST_MFSPR_DSCR_USER) ||
-+	     ((instword & PPC_INST_MFSPR_DSCR_MASK) ==
-+		PPC_INST_MFSPR_DSCR)) &&
- 			cpu_has_feature(CPU_FTR_DSCR)) {
- 		PPC_WARN_EMULATED(mfdscr, regs);
- 		rd = (instword >> 21) & 0x1f;
-@@ -978,7 +981,10 @@ static int emulate_instruction(struct pt_regs *regs)
- 		return 0;
- 	}
- 	/* Emulate the mtspr DSCR, rD. */
--	if (((instword & PPC_INST_MTSPR_DSCR_MASK) == PPC_INST_MTSPR_DSCR) &&
-+	if ((((instword & PPC_INST_MTSPR_DSCR_USER_MASK) ==
-+		PPC_INST_MTSPR_DSCR_USER) ||
-+	     ((instword & PPC_INST_MTSPR_DSCR_MASK) ==
-+		PPC_INST_MTSPR_DSCR)) &&
- 			cpu_has_feature(CPU_FTR_DSCR)) {
- 		PPC_WARN_EMULATED(mtdscr, regs);
- 		rd = (instword >> 21) & 0x1f;
-diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
-index f410c3e..b75c52f 100644
---- a/arch/powerpc/mm/hash_utils_64.c
-+++ b/arch/powerpc/mm/hash_utils_64.c
-@@ -1191,6 +1191,7 @@ void flush_hash_page(unsigned long vpn, real_pte_t pte, int psize, int ssize,
- 	 * unmapping it first, it may see the speculated version.
- 	 */
- 	if (local && cpu_has_feature(CPU_FTR_TM) &&
-+	    current->thread.regs &&
- 	    MSR_TM_ACTIVE(current->thread.regs->msr)) {
- 		tm_enable();
- 		tm_abort(TM_CAUSE_TLBI);
-diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
-index bba87ca..6a252c4 100644
---- a/arch/powerpc/mm/numa.c
-+++ b/arch/powerpc/mm/numa.c
-@@ -201,7 +201,7 @@ int __node_distance(int a, int b)
- 	int distance = LOCAL_DISTANCE;
- 
- 	if (!form1_affinity)
--		return distance;
-+		return ((a == b) ? LOCAL_DISTANCE : REMOTE_DISTANCE);
- 
- 	for (i = 0; i < distance_ref_points_depth; i++) {
- 		if (distance_lookup_table[a][i] == distance_lookup_table[b][i])
-diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
-index cc45deb..4a0a462 100644
---- a/arch/x86/kernel/cpu/perf_event_intel.c
-+++ b/arch/x86/kernel/cpu/perf_event_intel.c
-@@ -125,10 +125,15 @@ static struct event_constraint intel_ivb_event_constraints[] __read_mostly =
- 	INTEL_UEVENT_CONSTRAINT(0x08a3, 0x4), /* CYCLE_ACTIVITY.CYCLES_L1D_PENDING */
- 	INTEL_UEVENT_CONSTRAINT(0x0ca3, 0x4), /* CYCLE_ACTIVITY.STALLS_L1D_PENDING */
- 	INTEL_UEVENT_CONSTRAINT(0x01c0, 0x2), /* INST_RETIRED.PREC_DIST */
--	INTEL_EVENT_CONSTRAINT(0xd0, 0xf), /* MEM_UOPS_RETIRED.* */
--	INTEL_EVENT_CONSTRAINT(0xd1, 0xf), /* MEM_LOAD_UOPS_RETIRED.* */
--	INTEL_EVENT_CONSTRAINT(0xd2, 0xf), /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
--	INTEL_EVENT_CONSTRAINT(0xd3, 0xf), /*  MEM_LOAD_UOPS_LLC_MISS_RETIRED.* */
-+	/*
-+	 * Errata BV98 -- MEM_*_RETIRED events can leak between counters of SMT
-+	 * siblings; disable these events because they can corrupt unrelated
-+	 * counters.
-+	 */
-+	INTEL_EVENT_CONSTRAINT(0xd0, 0x0), /* MEM_UOPS_RETIRED.* */
-+	INTEL_EVENT_CONSTRAINT(0xd1, 0x0), /* MEM_LOAD_UOPS_RETIRED.* */
-+	INTEL_EVENT_CONSTRAINT(0xd2, 0x0), /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
-+	INTEL_EVENT_CONSTRAINT(0xd3, 0x0), /* MEM_LOAD_UOPS_LLC_MISS_RETIRED.* */
- 	EVENT_CONSTRAINT_END
- };
- 
-diff --git a/arch/x86/kernel/cpu/perf_event_intel_lbr.c b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
-index da02e9c..d978353 100644
---- a/arch/x86/kernel/cpu/perf_event_intel_lbr.c
-+++ b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
-@@ -310,7 +310,7 @@ void intel_pmu_lbr_read(void)
-  * - in case there is no HW filter
-  * - in case the HW filter has errata or limitations
-  */
--static void intel_pmu_setup_sw_lbr_filter(struct perf_event *event)
-+static int intel_pmu_setup_sw_lbr_filter(struct perf_event *event)
- {
- 	u64 br_type = event->attr.branch_sample_type;
- 	int mask = 0;
-@@ -318,8 +318,11 @@ static void intel_pmu_setup_sw_lbr_filter(struct perf_event *event)
- 	if (br_type & PERF_SAMPLE_BRANCH_USER)
- 		mask |= X86_BR_USER;
- 
--	if (br_type & PERF_SAMPLE_BRANCH_KERNEL)
-+	if (br_type & PERF_SAMPLE_BRANCH_KERNEL) {
-+		if (perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
-+			return -EACCES;
- 		mask |= X86_BR_KERNEL;
-+	}
- 
- 	/* we ignore BRANCH_HV here */
- 
-@@ -339,6 +342,8 @@ static void intel_pmu_setup_sw_lbr_filter(struct perf_event *event)
- 	 * be used by fixup code for some CPU
- 	 */
- 	event->hw.branch_reg.reg = mask;
-+
-+	return 0;
- }
- 
- /*
-@@ -386,7 +391,9 @@ int intel_pmu_setup_lbr_filter(struct perf_event *event)
- 	/*
- 	 * setup SW LBR filter
- 	 */
--	intel_pmu_setup_sw_lbr_filter(event);
-+	ret = intel_pmu_setup_sw_lbr_filter(event);
-+	if (ret)
-+		return ret;
- 
- 	/*
- 	 * setup HW LBR filter, if any
-@@ -442,8 +449,18 @@ static int branch_type(unsigned long from, unsigned long to)
- 			return X86_BR_NONE;
- 
- 		addr = buf;
--	} else
--		addr = (void *)from;
-+	} else {
-+		/*
-+		 * The LBR logs any address in the IP, even if the IP just
-+		 * faulted. This means userspace can control the from address.
-+		 * Ensure we don't blindy read any address by validating it is
-+		 * a known text address.
-+		 */
-+		if (kernel_text_address(from))
-+			addr = (void *)from;
-+		else
-+			return X86_BR_NONE;
-+	}
- 
- 	/*
- 	 * decoder needs to know the ABI especially
-diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
-index b43200d..3e091f0 100644
---- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
-+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
-@@ -2428,7 +2428,7 @@ static void __init uncore_types_exit(struct intel_uncore_type **types)
- static int __init uncore_type_init(struct intel_uncore_type *type)
- {
- 	struct intel_uncore_pmu *pmus;
--	struct attribute_group *events_group;
-+	struct attribute_group *attr_group;
- 	struct attribute **attrs;
- 	int i, j;
- 
-@@ -2455,19 +2455,19 @@ static int __init uncore_type_init(struct intel_uncore_type *type)
- 		while (type->event_descs[i].attr.attr.name)
- 			i++;
- 
--		events_group = kzalloc(sizeof(struct attribute *) * (i + 1) +
--					sizeof(*events_group), GFP_KERNEL);
--		if (!events_group)
-+		attr_group = kzalloc(sizeof(struct attribute *) * (i + 1) +
-+					sizeof(*attr_group), GFP_KERNEL);
-+		if (!attr_group)
- 			goto fail;
- 
--		attrs = (struct attribute **)(events_group + 1);
--		events_group->name = "events";
--		events_group->attrs = attrs;
-+		attrs = (struct attribute **)(attr_group + 1);
-+		attr_group->name = "events";
-+		attr_group->attrs = attrs;
- 
- 		for (j = 0; j < i; j++)
- 			attrs[j] = &type->event_descs[j].attr.attr;
- 
--		type->events_group = events_group;
-+		type->events_group = attr_group;
- 	}
- 
- 	type->pmu_group = &uncore_pmu_attr_group;
-@@ -2853,6 +2853,7 @@ static int __init uncore_cpu_init(void)
- 		msr_uncores = nhm_msr_uncores;
- 		break;
- 	case 42: /* Sandy Bridge */
-+	case 58: /* Ivy Bridge */
- 		if (snb_uncore_cbox.num_boxes > max_cores)
- 			snb_uncore_cbox.num_boxes = max_cores;
- 		msr_uncores = snb_msr_uncores;
-diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
-index b2b9837..e8918ff 100644
---- a/block/blk-cgroup.c
-+++ b/block/blk-cgroup.c
-@@ -972,10 +972,10 @@ int blkcg_activate_policy(struct request_queue *q,
- 	if (!new_blkg)
- 		return -ENOMEM;
- 
--	preloaded = !radix_tree_preload(GFP_KERNEL);
--
- 	blk_queue_bypass_start(q);
- 
-+	preloaded = !radix_tree_preload(GFP_KERNEL);
-+
- 	/*
- 	 * Make sure the root blkg exists and count the existing blkgs.  As
- 	 * @q is bypassing at this point, blkg_lookup_create() can't be
-diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
-index 5899a76..769d92e 100644
---- a/drivers/edac/edac_mc_sysfs.c
-+++ b/drivers/edac/edac_mc_sysfs.c
-@@ -327,17 +327,17 @@ static struct device_attribute *dynamic_csrow_dimm_attr[] = {
- };
- 
- /* possible dynamic channel ce_count attribute files */
--DEVICE_CHANNEL(ch0_ce_count, S_IRUGO | S_IWUSR,
-+DEVICE_CHANNEL(ch0_ce_count, S_IRUGO,
- 		   channel_ce_count_show, NULL, 0);
--DEVICE_CHANNEL(ch1_ce_count, S_IRUGO | S_IWUSR,
-+DEVICE_CHANNEL(ch1_ce_count, S_IRUGO,
- 		   channel_ce_count_show, NULL, 1);
--DEVICE_CHANNEL(ch2_ce_count, S_IRUGO | S_IWUSR,
-+DEVICE_CHANNEL(ch2_ce_count, S_IRUGO,
- 		   channel_ce_count_show, NULL, 2);
--DEVICE_CHANNEL(ch3_ce_count, S_IRUGO | S_IWUSR,
-+DEVICE_CHANNEL(ch3_ce_count, S_IRUGO,
- 		   channel_ce_count_show, NULL, 3);
--DEVICE_CHANNEL(ch4_ce_count, S_IRUGO | S_IWUSR,
-+DEVICE_CHANNEL(ch4_ce_count, S_IRUGO,
- 		   channel_ce_count_show, NULL, 4);
--DEVICE_CHANNEL(ch5_ce_count, S_IRUGO | S_IWUSR,
-+DEVICE_CHANNEL(ch5_ce_count, S_IRUGO,
- 		   channel_ce_count_show, NULL, 5);
- 
- /* Total possible dynamic ce_count attribute file table */
-diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h
-index 5284292..02e52d5 100644
---- a/drivers/gpu/drm/ast/ast_drv.h
-+++ b/drivers/gpu/drm/ast/ast_drv.h
-@@ -241,6 +241,8 @@ struct ast_fbdev {
- 	void *sysram;
- 	int size;
- 	struct ttm_bo_kmap_obj mapping;
-+	int x1, y1, x2, y2; /* dirty rect */
-+	spinlock_t dirty_lock;
- };
- 
- #define to_ast_crtc(x) container_of(x, struct ast_crtc, base)
-diff --git a/drivers/gpu/drm/ast/ast_fb.c b/drivers/gpu/drm/ast/ast_fb.c
-index 34931fe..fbc0823 100644
---- a/drivers/gpu/drm/ast/ast_fb.c
-+++ b/drivers/gpu/drm/ast/ast_fb.c
-@@ -53,16 +53,52 @@ static void ast_dirty_update(struct ast_fbdev *afbdev,
- 	int bpp = (afbdev->afb.base.bits_per_pixel + 7)/8;
- 	int ret;
- 	bool unmap = false;
-+	bool store_for_later = false;
-+	int x2, y2;
-+	unsigned long flags;
- 
- 	obj = afbdev->afb.obj;
- 	bo = gem_to_ast_bo(obj);
- 
-+	/*
-+	 * try and reserve the BO, if we fail with busy
-+	 * then the BO is being moved and we should
-+	 * store up the damage until later.
-+	 */
- 	ret = ast_bo_reserve(bo, true);
- 	if (ret) {
--		DRM_ERROR("failed to reserve fb bo\n");
-+		if (ret != -EBUSY)
-+			return;
-+
-+		store_for_later = true;
-+	}
-+
-+	x2 = x + width - 1;
-+	y2 = y + height - 1;
-+	spin_lock_irqsave(&afbdev->dirty_lock, flags);
-+
-+	if (afbdev->y1 < y)
-+		y = afbdev->y1;
-+	if (afbdev->y2 > y2)
-+		y2 = afbdev->y2;
-+	if (afbdev->x1 < x)
-+		x = afbdev->x1;
-+	if (afbdev->x2 > x2)
-+		x2 = afbdev->x2;
-+
-+	if (store_for_later) {
-+		afbdev->x1 = x;
-+		afbdev->x2 = x2;
-+		afbdev->y1 = y;
-+		afbdev->y2 = y2;
-+		spin_unlock_irqrestore(&afbdev->dirty_lock, flags);
- 		return;
- 	}
- 
-+	afbdev->x1 = afbdev->y1 = INT_MAX;
-+	afbdev->x2 = afbdev->y2 = 0;
-+	spin_unlock_irqrestore(&afbdev->dirty_lock, flags);
-+
- 	if (!bo->kmap.virtual) {
- 		ret = ttm_bo_kmap(&bo->bo, 0, bo->bo.num_pages, &bo->kmap);
- 		if (ret) {
-@@ -72,10 +108,10 @@ static void ast_dirty_update(struct ast_fbdev *afbdev,
- 		}
- 		unmap = true;
- 	}
--	for (i = y; i < y + height; i++) {
-+	for (i = y; i <= y2; i++) {
- 		/* assume equal stride for now */
- 		src_offset = dst_offset = i * afbdev->afb.base.pitches[0] + (x * bpp);
--		memcpy_toio(bo->kmap.virtual + src_offset, afbdev->sysram + src_offset, width * bpp);
-+		memcpy_toio(bo->kmap.virtual + src_offset, afbdev->sysram + src_offset, (x2 - x + 1) * bpp);
- 
- 	}
- 	if (unmap)
-@@ -292,6 +328,7 @@ int ast_fbdev_init(struct drm_device *dev)
- 
- 	ast->fbdev = afbdev;
- 	afbdev->helper.funcs = &ast_fb_helper_funcs;
-+	spin_lock_init(&afbdev->dirty_lock);
- 	ret = drm_fb_helper_init(dev, &afbdev->helper,
- 				 1, 1);
- 	if (ret) {
-diff --git a/drivers/gpu/drm/ast/ast_ttm.c b/drivers/gpu/drm/ast/ast_ttm.c
-index 3602731..09da339 100644
---- a/drivers/gpu/drm/ast/ast_ttm.c
-+++ b/drivers/gpu/drm/ast/ast_ttm.c
-@@ -316,7 +316,7 @@ int ast_bo_reserve(struct ast_bo *bo, bool no_wait)
- 
- 	ret = ttm_bo_reserve(&bo->bo, true, no_wait, false, 0);
- 	if (ret) {
--		if (ret != -ERESTARTSYS)
-+		if (ret != -ERESTARTSYS && ret != -EBUSY)
- 			DRM_ERROR("reserve failed %p\n", bo);
- 		return ret;
- 	}
-diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.h b/drivers/gpu/drm/cirrus/cirrus_drv.h
-index 6e0cc72..7ca0595 100644
---- a/drivers/gpu/drm/cirrus/cirrus_drv.h
-+++ b/drivers/gpu/drm/cirrus/cirrus_drv.h
-@@ -154,6 +154,8 @@ struct cirrus_fbdev {
- 	struct list_head fbdev_list;
- 	void *sysram;
- 	int size;
-+	int x1, y1, x2, y2; /* dirty rect */
-+	spinlock_t dirty_lock;
- };
- 
- struct cirrus_bo {
-diff --git a/drivers/gpu/drm/cirrus/cirrus_fbdev.c b/drivers/gpu/drm/cirrus/cirrus_fbdev.c
-index e25afcc..3541b56 100644
---- a/drivers/gpu/drm/cirrus/cirrus_fbdev.c
-+++ b/drivers/gpu/drm/cirrus/cirrus_fbdev.c
-@@ -27,16 +27,51 @@ static void cirrus_dirty_update(struct cirrus_fbdev *afbdev,
- 	int bpp = (afbdev->gfb.base.bits_per_pixel + 7)/8;
- 	int ret;
- 	bool unmap = false;
-+	bool store_for_later = false;
-+	int x2, y2;
-+	unsigned long flags;
- 
- 	obj = afbdev->gfb.obj;
- 	bo = gem_to_cirrus_bo(obj);
- 
-+	/*
-+	 * try and reserve the BO, if we fail with busy
-+	 * then the BO is being moved and we should
-+	 * store up the damage until later.
-+	 */
- 	ret = cirrus_bo_reserve(bo, true);
- 	if (ret) {
--		DRM_ERROR("failed to reserve fb bo\n");
-+		if (ret != -EBUSY)
-+			return;
-+		store_for_later = true;
-+	}
-+
-+	x2 = x + width - 1;
-+	y2 = y + height - 1;
-+	spin_lock_irqsave(&afbdev->dirty_lock, flags);
-+
-+	if (afbdev->y1 < y)
-+		y = afbdev->y1;
-+	if (afbdev->y2 > y2)
-+		y2 = afbdev->y2;
-+	if (afbdev->x1 < x)
-+		x = afbdev->x1;
-+	if (afbdev->x2 > x2)
-+		x2 = afbdev->x2;
-+
-+	if (store_for_later) {
-+		afbdev->x1 = x;
-+		afbdev->x2 = x2;
-+		afbdev->y1 = y;
-+		afbdev->y2 = y2;
-+		spin_unlock_irqrestore(&afbdev->dirty_lock, flags);
- 		return;
- 	}
- 
-+	afbdev->x1 = afbdev->y1 = INT_MAX;
-+	afbdev->x2 = afbdev->y2 = 0;
-+	spin_unlock_irqrestore(&afbdev->dirty_lock, flags);
-+
- 	if (!bo->kmap.virtual) {
- 		ret = ttm_bo_kmap(&bo->bo, 0, bo->bo.num_pages, &bo->kmap);
- 		if (ret) {
-@@ -268,6 +303,7 @@ int cirrus_fbdev_init(struct cirrus_device *cdev)
- 
- 	cdev->mode_info.gfbdev = gfbdev;
- 	gfbdev->helper.funcs = &cirrus_fb_helper_funcs;
-+	spin_lock_init(&gfbdev->dirty_lock);
- 
- 	ret = drm_fb_helper_init(cdev->dev, &gfbdev->helper,
- 				 cdev->num_crtc, CIRRUSFB_CONN_LIMIT);
-diff --git a/drivers/gpu/drm/cirrus/cirrus_ttm.c b/drivers/gpu/drm/cirrus/cirrus_ttm.c
-index 1413a26..2ed8cfc 100644
---- a/drivers/gpu/drm/cirrus/cirrus_ttm.c
-+++ b/drivers/gpu/drm/cirrus/cirrus_ttm.c
-@@ -321,7 +321,7 @@ int cirrus_bo_reserve(struct cirrus_bo *bo, bool no_wait)
- 
- 	ret = ttm_bo_reserve(&bo->bo, true, no_wait, false, 0);
- 	if (ret) {
--		if (ret != -ERESTARTSYS)
-+		if (ret != -ERESTARTSYS && ret != -EBUSY)
- 			DRM_ERROR("reserve failed %p\n", bo);
- 		return ret;
- 	}
-diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
-index af779ae..cf919e3 100644
---- a/drivers/gpu/drm/drm_gem.c
-+++ b/drivers/gpu/drm/drm_gem.c
-@@ -205,11 +205,11 @@ static void
- drm_gem_remove_prime_handles(struct drm_gem_object *obj, struct drm_file *filp)
- {
- 	if (obj->import_attach) {
--		drm_prime_remove_imported_buf_handle(&filp->prime,
-+		drm_prime_remove_buf_handle(&filp->prime,
- 				obj->import_attach->dmabuf);
- 	}
- 	if (obj->export_dma_buf) {
--		drm_prime_remove_imported_buf_handle(&filp->prime,
-+		drm_prime_remove_buf_handle(&filp->prime,
- 				obj->export_dma_buf);
- 	}
- }
-diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
-index 366910d..db767ca 100644
---- a/drivers/gpu/drm/drm_prime.c
-+++ b/drivers/gpu/drm/drm_prime.c
-@@ -62,6 +62,7 @@ struct drm_prime_member {
- 	struct dma_buf *dma_buf;
- 	uint32_t handle;
- };
-+static int drm_prime_add_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf, uint32_t handle);
- 
- static struct sg_table *drm_gem_map_dma_buf(struct dma_buf_attachment *attach,
- 		enum dma_data_direction dir)
-@@ -200,7 +201,8 @@ int drm_gem_prime_handle_to_fd(struct drm_device *dev,
- {
- 	struct drm_gem_object *obj;
- 	void *buf;
--	int ret;
-+	int ret = 0;
-+	struct dma_buf *dmabuf;
- 
- 	obj = drm_gem_object_lookup(dev, file_priv, handle);
- 	if (!obj)
-@@ -209,43 +211,44 @@ int drm_gem_prime_handle_to_fd(struct drm_device *dev,
- 	mutex_lock(&file_priv->prime.lock);
- 	/* re-export the original imported object */
- 	if (obj->import_attach) {
--		get_dma_buf(obj->import_attach->dmabuf);
--		*prime_fd = dma_buf_fd(obj->import_attach->dmabuf, flags);
--		drm_gem_object_unreference_unlocked(obj);
--		mutex_unlock(&file_priv->prime.lock);
--		return 0;
-+		dmabuf = obj->import_attach->dmabuf;
-+		goto out_have_obj;
- 	}
- 
- 	if (obj->export_dma_buf) {
--		get_dma_buf(obj->export_dma_buf);
--		*prime_fd = dma_buf_fd(obj->export_dma_buf, flags);
--		drm_gem_object_unreference_unlocked(obj);
--	} else {
--		buf = dev->driver->gem_prime_export(dev, obj, flags);
--		if (IS_ERR(buf)) {
--			/* normally the created dma-buf takes ownership of the ref,
--			 * but if that fails then drop the ref
--			 */
--			drm_gem_object_unreference_unlocked(obj);
--			mutex_unlock(&file_priv->prime.lock);
--			return PTR_ERR(buf);
--		}
--		obj->export_dma_buf = buf;
--		*prime_fd = dma_buf_fd(buf, flags);
-+		dmabuf = obj->export_dma_buf;
-+		goto out_have_obj;
- 	}
-+
-+	buf = dev->driver->gem_prime_export(dev, obj, flags);
-+	if (IS_ERR(buf)) {
-+		/* normally the created dma-buf takes ownership of the ref,
-+		 * but if that fails then drop the ref
-+		 */
-+		ret = PTR_ERR(buf);
-+		goto out;
-+	}
-+	obj->export_dma_buf = buf;
-+
- 	/* if we've exported this buffer the cheat and add it to the import list
- 	 * so we get the correct handle back
- 	 */
--	ret = drm_prime_add_imported_buf_handle(&file_priv->prime,
--			obj->export_dma_buf, handle);
--	if (ret) {
--		drm_gem_object_unreference_unlocked(obj);
--		mutex_unlock(&file_priv->prime.lock);
--		return ret;
--	}
-+	ret = drm_prime_add_buf_handle(&file_priv->prime,
-+				       obj->export_dma_buf, handle);
-+	if (ret)
-+		goto out;
- 
-+	*prime_fd = dma_buf_fd(buf, flags);
- 	mutex_unlock(&file_priv->prime.lock);
- 	return 0;
-+
-+out_have_obj:
-+	get_dma_buf(dmabuf);
-+	*prime_fd = dma_buf_fd(dmabuf, flags);
-+out:
-+	drm_gem_object_unreference_unlocked(obj);
-+	mutex_unlock(&file_priv->prime.lock);
-+	return ret;
- }
- EXPORT_SYMBOL(drm_gem_prime_handle_to_fd);
- 
-@@ -268,7 +271,6 @@ struct drm_gem_object *drm_gem_prime_import(struct drm_device *dev,
- 			 * refcount on gem itself instead of f_count of dmabuf.
- 			 */
- 			drm_gem_object_reference(obj);
--			dma_buf_put(dma_buf);
- 			return obj;
- 		}
- 	}
-@@ -277,6 +279,8 @@ struct drm_gem_object *drm_gem_prime_import(struct drm_device *dev,
- 	if (IS_ERR(attach))
- 		return ERR_PTR(PTR_ERR(attach));
- 
-+	get_dma_buf(dma_buf);
-+
- 	sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL);
- 	if (IS_ERR_OR_NULL(sgt)) {
- 		ret = PTR_ERR(sgt);
-@@ -297,6 +301,8 @@ fail_unmap:
- 	dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL);
- fail_detach:
- 	dma_buf_detach(dma_buf, attach);
-+	dma_buf_put(dma_buf);
-+
- 	return ERR_PTR(ret);
- }
- EXPORT_SYMBOL(drm_gem_prime_import);
-@@ -314,7 +320,7 @@ int drm_gem_prime_fd_to_handle(struct drm_device *dev,
- 
- 	mutex_lock(&file_priv->prime.lock);
- 
--	ret = drm_prime_lookup_imported_buf_handle(&file_priv->prime,
-+	ret = drm_prime_lookup_buf_handle(&file_priv->prime,
- 			dma_buf, handle);
- 	if (!ret) {
- 		ret = 0;
-@@ -333,12 +339,15 @@ int drm_gem_prime_fd_to_handle(struct drm_device *dev,
- 	if (ret)
- 		goto out_put;
- 
--	ret = drm_prime_add_imported_buf_handle(&file_priv->prime,
-+	ret = drm_prime_add_buf_handle(&file_priv->prime,
- 			dma_buf, *handle);
- 	if (ret)
- 		goto fail;
- 
- 	mutex_unlock(&file_priv->prime.lock);
-+
-+	dma_buf_put(dma_buf);
-+
- 	return 0;
- 
- fail:
-@@ -491,7 +500,7 @@ void drm_prime_destroy_file_private(struct drm_prime_file_private *prime_fpriv)
- }
- EXPORT_SYMBOL(drm_prime_destroy_file_private);
- 
--int drm_prime_add_imported_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf, uint32_t handle)
-+static int drm_prime_add_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf, uint32_t handle)
- {
- 	struct drm_prime_member *member;
- 
-@@ -499,14 +508,14 @@ int drm_prime_add_imported_buf_handle(struct drm_prime_file_private *prime_fpriv
- 	if (!member)
- 		return -ENOMEM;
- 
-+	get_dma_buf(dma_buf);
- 	member->dma_buf = dma_buf;
- 	member->handle = handle;
- 	list_add(&member->entry, &prime_fpriv->head);
- 	return 0;
- }
--EXPORT_SYMBOL(drm_prime_add_imported_buf_handle);
- 
--int drm_prime_lookup_imported_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf, uint32_t *handle)
-+int drm_prime_lookup_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf, uint32_t *handle)
- {
- 	struct drm_prime_member *member;
- 
-@@ -518,19 +527,20 @@ int drm_prime_lookup_imported_buf_handle(struct drm_prime_file_private *prime_fp
- 	}
- 	return -ENOENT;
- }
--EXPORT_SYMBOL(drm_prime_lookup_imported_buf_handle);
-+EXPORT_SYMBOL(drm_prime_lookup_buf_handle);
- 
--void drm_prime_remove_imported_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf)
-+void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf)
- {
- 	struct drm_prime_member *member, *safe;
- 
- 	mutex_lock(&prime_fpriv->lock);
- 	list_for_each_entry_safe(member, safe, &prime_fpriv->head, entry) {
- 		if (member->dma_buf == dma_buf) {
-+			dma_buf_put(dma_buf);
- 			list_del(&member->entry);
- 			kfree(member);
- 		}
- 	}
- 	mutex_unlock(&prime_fpriv->lock);
- }
--EXPORT_SYMBOL(drm_prime_remove_imported_buf_handle);
-+EXPORT_SYMBOL(drm_prime_remove_buf_handle);
-diff --git a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
-index ba0a3aa..ff7f2a8 100644
---- a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
-+++ b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
-@@ -235,7 +235,6 @@ struct drm_gem_object *exynos_dmabuf_prime_import(struct drm_device *drm_dev,
- 			 * refcount on gem itself instead of f_count of dmabuf.
- 			 */
- 			drm_gem_object_reference(obj);
--			dma_buf_put(dma_buf);
- 			return obj;
- 		}
- 	}
-@@ -244,6 +243,7 @@ struct drm_gem_object *exynos_dmabuf_prime_import(struct drm_device *drm_dev,
- 	if (IS_ERR(attach))
- 		return ERR_PTR(-EINVAL);
- 
-+	get_dma_buf(dma_buf);
- 
- 	sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL);
- 	if (IS_ERR_OR_NULL(sgt)) {
-@@ -298,6 +298,8 @@ err_unmap_attach:
- 	dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL);
- err_buf_detach:
- 	dma_buf_detach(dma_buf, attach);
-+	dma_buf_put(dma_buf);
-+
- 	return ERR_PTR(ret);
- }
- 
-diff --git a/drivers/gpu/drm/gma500/psb_irq.c b/drivers/gpu/drm/gma500/psb_irq.c
-index 8652cdf..029eccf 100644
---- a/drivers/gpu/drm/gma500/psb_irq.c
-+++ b/drivers/gpu/drm/gma500/psb_irq.c
-@@ -211,7 +211,7 @@ irqreturn_t psb_irq_handler(DRM_IRQ_ARGS)
- 
- 	vdc_stat = PSB_RVDC32(PSB_INT_IDENTITY_R);
- 
--	if (vdc_stat & _PSB_PIPE_EVENT_FLAG)
-+	if (vdc_stat & (_PSB_PIPE_EVENT_FLAG|_PSB_IRQ_ASLE))
- 		dsp_int = 1;
- 
- 	/* FIXME: Handle Medfield
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 01769e2..ef99b1c 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -941,6 +941,7 @@ typedef struct drm_i915_private {
- 	unsigned int int_crt_support:1;
- 	unsigned int lvds_use_ssc:1;
- 	unsigned int display_clock_mode:1;
-+	unsigned int fdi_rx_polarity_inverted:1;
- 	int lvds_ssc_freq;
- 	unsigned int bios_lvds_val; /* initial [PCH_]LVDS reg val in VBIOS */
- 	struct {
-diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
-index 0e207e6..73cb479 100644
---- a/drivers/gpu/drm/i915/i915_gem.c
-+++ b/drivers/gpu/drm/i915/i915_gem.c
-@@ -2678,17 +2678,35 @@ static inline int fence_number(struct drm_i915_private *dev_priv,
- 	return fence - dev_priv->fence_regs;
- }
- 
-+static void i915_gem_write_fence__ipi(void *data)
-+{
-+	wbinvd();
-+}
-+
- static void i915_gem_object_update_fence(struct drm_i915_gem_object *obj,
- 					 struct drm_i915_fence_reg *fence,
- 					 bool enable)
- {
--	struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
--	int reg = fence_number(dev_priv, fence);
--
--	i915_gem_write_fence(obj->base.dev, reg, enable ? obj : NULL);
-+	struct drm_device *dev = obj->base.dev;
-+	struct drm_i915_private *dev_priv = dev->dev_private;
-+	int fence_reg = fence_number(dev_priv, fence);
-+
-+	/* In order to fully serialize access to the fenced region and
-+	 * the update to the fence register we need to take extreme
-+	 * measures on SNB+. In theory, the write to the fence register
-+	 * flushes all memory transactions before, and coupled with the
-+	 * mb() placed around the register write we serialise all memory
-+	 * operations with respect to the changes in the tiler. Yet, on
-+	 * SNB+ we need to take a step further and emit an explicit wbinvd()
-+	 * on each processor in order to manually flush all memory
-+	 * transactions before updating the fence register.
-+	 */
-+	if (HAS_LLC(obj->base.dev))
-+		on_each_cpu(i915_gem_write_fence__ipi, NULL, 1);
-+	i915_gem_write_fence(dev, fence_reg, enable ? obj : NULL);
- 
- 	if (enable) {
--		obj->fence_reg = reg;
-+		obj->fence_reg = fence_reg;
- 		fence->obj = obj;
- 		list_move_tail(&fence->lru_list, &dev_priv->mm.fence_list);
- 	} else {
-diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
-index 94d873a..a1e8ecb 100644
---- a/drivers/gpu/drm/i915/i915_gem_context.c
-+++ b/drivers/gpu/drm/i915/i915_gem_context.c
-@@ -152,6 +152,13 @@ create_hw_context(struct drm_device *dev,
- 		return ERR_PTR(-ENOMEM);
- 	}
- 
-+	if (INTEL_INFO(dev)->gen >= 7) {
-+		ret = i915_gem_object_set_cache_level(ctx->obj,
-+						      I915_CACHE_LLC_MLC);
-+		if (ret)
-+			goto err_out;
-+	}
-+
- 	/* The ring associated with the context object is handled by the normal
- 	 * object tracking code. We give an initial ring value simple to pass an
- 	 * assertion in the context switch code.
-diff --git a/drivers/gpu/drm/i915/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
-index 6a5af68..c303de1 100644
---- a/drivers/gpu/drm/i915/i915_gem_dmabuf.c
-+++ b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
-@@ -271,7 +271,6 @@ struct drm_gem_object *i915_gem_prime_import(struct drm_device *dev,
- 			 * refcount on gem itself instead of f_count of dmabuf.
- 			 */
- 			drm_gem_object_reference(&obj->base);
--			dma_buf_put(dma_buf);
- 			return &obj->base;
- 		}
- 	}
-@@ -281,6 +280,8 @@ struct drm_gem_object *i915_gem_prime_import(struct drm_device *dev,
- 	if (IS_ERR(attach))
- 		return ERR_CAST(attach);
- 
-+	get_dma_buf(dma_buf);
-+
- 	obj = i915_gem_object_alloc(dev);
- 	if (obj == NULL) {
- 		ret = -ENOMEM;
-@@ -300,5 +301,7 @@ struct drm_gem_object *i915_gem_prime_import(struct drm_device *dev,
- 
- fail_detach:
- 	dma_buf_detach(dma_buf, attach);
-+	dma_buf_put(dma_buf);
-+
- 	return ERR_PTR(ret);
- }
-diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
-index 926a1e2..193c8d1 100644
---- a/drivers/gpu/drm/i915/i915_gem_gtt.c
-+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
-@@ -182,8 +182,7 @@ static int gen6_ppgtt_init(struct i915_hw_ppgtt *ppgtt)
- 	/* ppgtt PDEs reside in the global gtt pagetable, which has 512*1024
- 	 * entries. For aliasing ppgtt support we just steal them at the end for
- 	 * now. */
--	first_pd_entry_in_global_pt =
--		gtt_total_entries(dev_priv->gtt) - I915_PPGTT_PD_ENTRIES;
-+       first_pd_entry_in_global_pt = gtt_total_entries(dev_priv->gtt);
- 
- 	ppgtt->num_pd_entries = I915_PPGTT_PD_ENTRIES;
- 	ppgtt->clear_range = gen6_ppgtt_clear_range;
-diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
-index 848992f..c91124f 100644
---- a/drivers/gpu/drm/i915/i915_reg.h
-+++ b/drivers/gpu/drm/i915/i915_reg.h
-@@ -3827,7 +3827,7 @@
- #define _TRANSB_CHICKEN2	 0xf1064
- #define TRANS_CHICKEN2(pipe) _PIPE(pipe, _TRANSA_CHICKEN2, _TRANSB_CHICKEN2)
- #define  TRANS_CHICKEN2_TIMING_OVERRIDE		(1<<31)
--
-+#define  TRANS_CHICKEN2_FDI_POLARITY_REVERSED	(1<<29)
- 
- #define SOUTH_CHICKEN1		0xc2000
- #define  FDIA_PHASE_SYNC_SHIFT_OVR	19
-diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
-index 55ffba1..bd83391 100644
---- a/drivers/gpu/drm/i915/intel_bios.c
-+++ b/drivers/gpu/drm/i915/intel_bios.c
-@@ -351,12 +351,14 @@ parse_general_features(struct drm_i915_private *dev_priv,
- 		dev_priv->lvds_ssc_freq =
- 			intel_bios_ssc_frequency(dev, general->ssc_freq);
- 		dev_priv->display_clock_mode = general->display_clock_mode;
--		DRM_DEBUG_KMS("BDB_GENERAL_FEATURES int_tv_support %d int_crt_support %d lvds_use_ssc %d lvds_ssc_freq %d display_clock_mode %d\n",
-+		dev_priv->fdi_rx_polarity_inverted = general->fdi_rx_polarity_inverted;
-+		DRM_DEBUG_KMS("BDB_GENERAL_FEATURES int_tv_support %d int_crt_support %d lvds_use_ssc %d lvds_ssc_freq %d display_clock_mode %d fdi_rx_polarity_inverted %d\n",
- 			      dev_priv->int_tv_support,
- 			      dev_priv->int_crt_support,
- 			      dev_priv->lvds_use_ssc,
- 			      dev_priv->lvds_ssc_freq,
--			      dev_priv->display_clock_mode);
-+			      dev_priv->display_clock_mode,
-+			      dev_priv->fdi_rx_polarity_inverted);
- 	}
- }
- 
-diff --git a/drivers/gpu/drm/i915/intel_bios.h b/drivers/gpu/drm/i915/intel_bios.h
-index 36e57f9..e088d6f 100644
---- a/drivers/gpu/drm/i915/intel_bios.h
-+++ b/drivers/gpu/drm/i915/intel_bios.h
-@@ -127,7 +127,9 @@ struct bdb_general_features {
-         /* bits 3 */
- 	u8 disable_smooth_vision:1;
- 	u8 single_dvi:1;
--	u8 rsvd9:6; /* finish byte */
-+	u8 rsvd9:1;
-+	u8 fdi_rx_polarity_inverted:1;
-+	u8 rsvd10:4; /* finish byte */
- 
-         /* bits 4 */
- 	u8 legacy_monitor_detect;
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index b20d501..c2d173a 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -7589,22 +7589,25 @@ intel_modeset_affected_pipes(struct drm_crtc *crtc, unsigned *modeset_pipes,
- 	if (crtc->enabled)
- 		*prepare_pipes |= 1 << intel_crtc->pipe;
- 
--	/* We only support modeset on one single crtc, hence we need to do that
--	 * only for the passed in crtc iff we change anything else than just
--	 * disable crtcs.
--	 *
--	 * This is actually not true, to be fully compatible with the old crtc
--	 * helper we automatically disable _any_ output (i.e. doesn't need to be
--	 * connected to the crtc we're modesetting on) if it's disconnected.
--	 * Which is a rather nutty api (since changed the output configuration
--	 * without userspace's explicit request can lead to confusion), but
--	 * alas. Hence we currently need to modeset on all pipes we prepare. */
-+	/*
-+	 * For simplicity do a full modeset on any pipe where the output routing
-+	 * changed. We could be more clever, but that would require us to be
-+	 * more careful with calling the relevant encoder->mode_set functions.
-+	 */
- 	if (*prepare_pipes)
- 		*modeset_pipes = *prepare_pipes;
- 
- 	/* ... and mask these out. */
- 	*modeset_pipes &= ~(*disable_pipes);
- 	*prepare_pipes &= ~(*disable_pipes);
-+
-+	/*
-+	 * HACK: We don't (yet) fully support global modesets. intel_set_config
-+	 * obies this rule, but the modeset restore mode of
-+	 * intel_modeset_setup_hw_state does not.
-+	 */
-+	*modeset_pipes &= 1 << intel_crtc->pipe;
-+	*prepare_pipes &= 1 << intel_crtc->pipe;
- }
- 
- static bool intel_crtc_in_use(struct drm_crtc *crtc)
-@@ -7771,9 +7774,9 @@ intel_modeset_check_state(struct drm_device *dev)
- 	}
- }
- 
--int intel_set_mode(struct drm_crtc *crtc,
--		   struct drm_display_mode *mode,
--		   int x, int y, struct drm_framebuffer *fb)
-+static int __intel_set_mode(struct drm_crtc *crtc,
-+			    struct drm_display_mode *mode,
-+			    int x, int y, struct drm_framebuffer *fb)
- {
- 	struct drm_device *dev = crtc->dev;
- 	drm_i915_private_t *dev_priv = dev->dev_private;
-@@ -7863,8 +7866,6 @@ done:
- 	if (ret && crtc->enabled) {
- 		crtc->hwmode = *saved_hwmode;
- 		crtc->mode = *saved_mode;
--	} else {
--		intel_modeset_check_state(dev);
- 	}
- 
- out:
-@@ -7872,6 +7873,20 @@ out:
- 	return ret;
- }
- 
-+int intel_set_mode(struct drm_crtc *crtc,
-+		     struct drm_display_mode *mode,
-+		     int x, int y, struct drm_framebuffer *fb)
-+{
-+	int ret;
-+
-+	ret = __intel_set_mode(crtc, mode, x, y, fb);
-+
-+	if (ret == 0)
-+		intel_modeset_check_state(crtc->dev);
-+
-+	return ret;
-+}
-+
- void intel_crtc_restore_mode(struct drm_crtc *crtc)
- {
- 	intel_set_mode(crtc, &crtc->mode, crtc->x, crtc->y, crtc->fb);
-@@ -8314,7 +8329,7 @@ static void intel_setup_outputs(struct drm_device *dev)
- 		I915_WRITE(PFIT_CONTROL, 0);
- 	}
- 
--	if (!(HAS_DDI(dev) && (I915_READ(DDI_BUF_CTL(PORT_A)) & DDI_A_4_LANES)))
-+	if (!IS_ULT(dev))
- 		intel_crt_init(dev);
- 
- 	if (HAS_DDI(dev)) {
-@@ -9172,8 +9187,16 @@ void intel_modeset_setup_hw_state(struct drm_device *dev,
- 	}
- 
- 	if (force_restore) {
-+		/*
-+		 * We need to use raw interfaces for restoring state to avoid
-+		 * checking (bogus) intermediate states.
-+		 */
- 		for_each_pipe(pipe) {
--			intel_crtc_restore_mode(dev_priv->pipe_to_crtc_mapping[pipe]);
-+ 			struct drm_crtc *crtc =
-+ 				dev_priv->pipe_to_crtc_mapping[pipe];
-+
-+			__intel_set_mode(crtc, &crtc->mode, crtc->x, crtc->y,
-+					 crtc->fb);
- 		}
- 
- 		i915_redisable_vga(dev);
-@@ -9236,6 +9259,9 @@ void intel_modeset_cleanup(struct drm_device *dev)
- 	/* flush any delayed tasks or pending work */
- 	flush_scheduled_work();
- 
-+	/* destroy backlight, if any, before the connectors */
-+	intel_panel_destroy_backlight(dev);
-+
- 	drm_mode_config_cleanup(dev);
- 
- 	intel_cleanup_overlay(dev);
-diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
-index 8fc93f9..b8e17e5 100644
---- a/drivers/gpu/drm/i915/intel_dp.c
-+++ b/drivers/gpu/drm/i915/intel_dp.c
-@@ -2538,17 +2538,14 @@ done:
- static void
- intel_dp_destroy(struct drm_connector *connector)
- {
--	struct drm_device *dev = connector->dev;
- 	struct intel_dp *intel_dp = intel_attached_dp(connector);
- 	struct intel_connector *intel_connector = to_intel_connector(connector);
- 
- 	if (!IS_ERR_OR_NULL(intel_connector->edid))
- 		kfree(intel_connector->edid);
- 
--	if (is_edp(intel_dp)) {
--		intel_panel_destroy_backlight(dev);
-+	if (is_edp(intel_dp))
- 		intel_panel_fini(&intel_connector->panel);
--	}
- 
- 	drm_sysfs_connector_remove(connector);
- 	drm_connector_cleanup(connector);
-diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
-index 00e70db..cc70b16 100644
---- a/drivers/gpu/drm/i915/intel_dvo.c
-+++ b/drivers/gpu/drm/i915/intel_dvo.c
-@@ -448,6 +448,7 @@ void intel_dvo_init(struct drm_device *dev)
- 		const struct intel_dvo_device *dvo = &intel_dvo_devices[i];
- 		struct i2c_adapter *i2c;
- 		int gpio;
-+		bool dvoinit;
- 
- 		/* Allow the I2C driver info to specify the GPIO to be used in
- 		 * special cases, but otherwise default to what's defined
-@@ -467,7 +468,17 @@ void intel_dvo_init(struct drm_device *dev)
- 		i2c = intel_gmbus_get_adapter(dev_priv, gpio);
- 
- 		intel_dvo->dev = *dvo;
--		if (!dvo->dev_ops->init(&intel_dvo->dev, i2c))
-+
-+		/* GMBUS NAK handling seems to be unstable, hence let the
-+		 * transmitter detection run in bit banging mode for now.
-+		 */
-+		intel_gmbus_force_bit(i2c, true);
-+
-+		dvoinit = dvo->dev_ops->init(&intel_dvo->dev, i2c);
-+
-+		intel_gmbus_force_bit(i2c, false);
-+
-+		if (!dvoinit)
- 			continue;
- 
- 		intel_encoder->type = INTEL_OUTPUT_DVO;
-diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
-index 3d1d974..e0d6985 100644
---- a/drivers/gpu/drm/i915/intel_lvds.c
-+++ b/drivers/gpu/drm/i915/intel_lvds.c
-@@ -618,7 +618,6 @@ static void intel_lvds_destroy(struct drm_connector *connector)
- 	if (!IS_ERR_OR_NULL(lvds_connector->base.edid))
- 		kfree(lvds_connector->base.edid);
- 
--	intel_panel_destroy_backlight(connector->dev);
- 	intel_panel_fini(&lvds_connector->base.panel);
- 
- 	drm_sysfs_connector_remove(connector);
-@@ -850,6 +849,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
- 			DMI_MATCH(DMI_PRODUCT_NAME, "X7SPA-H"),
- 		},
- 	},
-+	{
-+		.callback = intel_no_lvds_dmi_callback,
-+		.ident = "Fujitsu Esprimo Q900",
-+		.matches = {
-+			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
-+			DMI_MATCH(DMI_PRODUCT_NAME, "ESPRIMO Q900"),
-+		},
-+	},
- 
- 	{ }	/* terminating entry */
- };
-diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
-index bee8cb6..94d895b 100644
---- a/drivers/gpu/drm/i915/intel_panel.c
-+++ b/drivers/gpu/drm/i915/intel_panel.c
-@@ -422,6 +422,9 @@ int intel_panel_setup_backlight(struct drm_connector *connector)
- 
- 	intel_panel_init_backlight(dev);
- 
-+	if (WARN_ON(dev_priv->backlight))
-+		return -ENODEV;
-+
- 	memset(&props, 0, sizeof(props));
- 	props.type = BACKLIGHT_RAW;
- 	props.max_brightness = _intel_panel_get_max_backlight(dev);
-@@ -447,8 +450,10 @@ int intel_panel_setup_backlight(struct drm_connector *connector)
- void intel_panel_destroy_backlight(struct drm_device *dev)
- {
- 	struct drm_i915_private *dev_priv = dev->dev_private;
--	if (dev_priv->backlight)
-+	if (dev_priv->backlight) {
- 		backlight_device_unregister(dev_priv->backlight);
-+		dev_priv->backlight = NULL;
-+	}
- }
- #else
- int intel_panel_setup_backlight(struct drm_connector *connector)
-diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
-index adca007..332b29e 100644
---- a/drivers/gpu/drm/i915/intel_pm.c
-+++ b/drivers/gpu/drm/i915/intel_pm.c
-@@ -3562,6 +3562,7 @@ static void cpt_init_clock_gating(struct drm_device *dev)
- {
- 	struct drm_i915_private *dev_priv = dev->dev_private;
- 	int pipe;
-+	uint32_t val;
- 
- 	/*
- 	 * On Ibex Peak and Cougar Point, we need to disable clock
-@@ -3574,8 +3575,12 @@ static void cpt_init_clock_gating(struct drm_device *dev)
- 	/* The below fixes the weird display corruption, a few pixels shifted
- 	 * downward, on (only) LVDS of some HP laptops with IVY.
- 	 */
--	for_each_pipe(pipe)
--		I915_WRITE(TRANS_CHICKEN2(pipe), TRANS_CHICKEN2_TIMING_OVERRIDE);
-+	for_each_pipe(pipe) {
-+		val = TRANS_CHICKEN2_TIMING_OVERRIDE;
-+		if (dev_priv->fdi_rx_polarity_inverted)
-+			val |= TRANS_CHICKEN2_FDI_POLARITY_REVERSED;
-+		I915_WRITE(TRANS_CHICKEN2(pipe), val);
-+	}
- 	/* WADP0ClockGatingDisable */
- 	for_each_pipe(pipe) {
- 		I915_WRITE(TRANS_CHICKEN1(pipe),
-diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
-index d07a8cd..d6df786 100644
---- a/drivers/gpu/drm/i915/intel_sdvo.c
-+++ b/drivers/gpu/drm/i915/intel_sdvo.c
-@@ -1235,11 +1235,13 @@ static bool intel_sdvo_get_hw_state(struct intel_encoder *encoder,
- 	struct drm_device *dev = encoder->base.dev;
- 	struct drm_i915_private *dev_priv = dev->dev_private;
- 	struct intel_sdvo *intel_sdvo = to_intel_sdvo(&encoder->base);
-+	u16 active_outputs;
- 	u32 tmp;
- 
- 	tmp = I915_READ(intel_sdvo->sdvo_reg);
-+	intel_sdvo_get_active_outputs(intel_sdvo, &active_outputs);
- 
--	if (!(tmp & SDVO_ENABLE))
-+	if (!(tmp & SDVO_ENABLE) && (active_outputs == 0))
- 		return false;
- 
- 	if (HAS_PCH_CPT(dev))
-@@ -2739,7 +2741,6 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
- 	struct intel_sdvo *intel_sdvo;
- 	u32 hotplug_mask;
- 	int i;
--
- 	intel_sdvo = kzalloc(sizeof(struct intel_sdvo), GFP_KERNEL);
- 	if (!intel_sdvo)
- 		return false;
-diff --git a/drivers/gpu/drm/mgag200/mgag200_drv.h b/drivers/gpu/drm/mgag200/mgag200_drv.h
-index 4d932c4..8065919 100644
---- a/drivers/gpu/drm/mgag200/mgag200_drv.h
-+++ b/drivers/gpu/drm/mgag200/mgag200_drv.h
-@@ -115,6 +115,8 @@ struct mga_fbdev {
- 	void *sysram;
- 	int size;
- 	struct ttm_bo_kmap_obj mapping;
-+	int x1, y1, x2, y2; /* dirty rect */
-+	spinlock_t dirty_lock;
- };
- 
- struct mga_crtc {
-diff --git a/drivers/gpu/drm/mgag200/mgag200_fb.c b/drivers/gpu/drm/mgag200/mgag200_fb.c
-index d2253f6..b0dad27 100644
---- a/drivers/gpu/drm/mgag200/mgag200_fb.c
-+++ b/drivers/gpu/drm/mgag200/mgag200_fb.c
-@@ -29,16 +29,52 @@ static void mga_dirty_update(struct mga_fbdev *mfbdev,
- 	int bpp = (mfbdev->mfb.base.bits_per_pixel + 7)/8;
- 	int ret;
- 	bool unmap = false;
-+	bool store_for_later = false;
-+	int x2, y2;
-+	unsigned long flags;
- 
- 	obj = mfbdev->mfb.obj;
- 	bo = gem_to_mga_bo(obj);
- 
-+	/*
-+	 * try and reserve the BO, if we fail with busy
-+	 * then the BO is being moved and we should
-+	 * store up the damage until later.
-+	 */
- 	ret = mgag200_bo_reserve(bo, true);
- 	if (ret) {
--		DRM_ERROR("failed to reserve fb bo\n");
-+		if (ret != -EBUSY)
-+			return;
-+
-+		store_for_later = true;
-+	}
-+
-+	x2 = x + width - 1;
-+	y2 = y + height - 1;
-+	spin_lock_irqsave(&mfbdev->dirty_lock, flags);
-+
-+	if (mfbdev->y1 < y)
-+		y = mfbdev->y1;
-+	if (mfbdev->y2 > y2)
-+		y2 = mfbdev->y2;
-+	if (mfbdev->x1 < x)
-+		x = mfbdev->x1;
-+	if (mfbdev->x2 > x2)
-+		x2 = mfbdev->x2;
-+
-+	if (store_for_later) {
-+		mfbdev->x1 = x;
-+		mfbdev->x2 = x2;
-+		mfbdev->y1 = y;
-+		mfbdev->y2 = y2;
-+		spin_unlock_irqrestore(&mfbdev->dirty_lock, flags);
- 		return;
- 	}
- 
-+	mfbdev->x1 = mfbdev->y1 = INT_MAX;
-+	mfbdev->x2 = mfbdev->y2 = 0;
-+	spin_unlock_irqrestore(&mfbdev->dirty_lock, flags);
-+
- 	if (!bo->kmap.virtual) {
- 		ret = ttm_bo_kmap(&bo->bo, 0, bo->bo.num_pages, &bo->kmap);
- 		if (ret) {
-@@ -48,10 +84,10 @@ static void mga_dirty_update(struct mga_fbdev *mfbdev,
- 		}
- 		unmap = true;
- 	}
--	for (i = y; i < y + height; i++) {
-+	for (i = y; i <= y2; i++) {
- 		/* assume equal stride for now */
- 		src_offset = dst_offset = i * mfbdev->mfb.base.pitches[0] + (x * bpp);
--		memcpy_toio(bo->kmap.virtual + src_offset, mfbdev->sysram + src_offset, width * bpp);
-+		memcpy_toio(bo->kmap.virtual + src_offset, mfbdev->sysram + src_offset, (x2 - x + 1) * bpp);
- 
- 	}
- 	if (unmap)
-@@ -255,6 +291,7 @@ int mgag200_fbdev_init(struct mga_device *mdev)
- 
- 	mdev->mfbdev = mfbdev;
- 	mfbdev->helper.funcs = &mga_fb_helper_funcs;
-+	spin_lock_init(&mfbdev->dirty_lock);
- 
- 	ret = drm_fb_helper_init(mdev->dev, &mfbdev->helper,
- 				 mdev->num_crtc, MGAG200FB_CONN_LIMIT);
-diff --git a/drivers/gpu/drm/mgag200/mgag200_ttm.c b/drivers/gpu/drm/mgag200/mgag200_ttm.c
-index 8fc9d92..401c989 100644
---- a/drivers/gpu/drm/mgag200/mgag200_ttm.c
-+++ b/drivers/gpu/drm/mgag200/mgag200_ttm.c
-@@ -315,8 +315,8 @@ int mgag200_bo_reserve(struct mgag200_bo *bo, bool no_wait)
- 
- 	ret = ttm_bo_reserve(&bo->bo, true, no_wait, false, 0);
- 	if (ret) {
--		if (ret != -ERESTARTSYS)
--			DRM_ERROR("reserve failed %p\n", bo);
-+		if (ret != -ERESTARTSYS && ret != -EBUSY)
-+			DRM_ERROR("reserve failed %p %d\n", bo, ret);
- 		return ret;
- 	}
- 	return 0;
-diff --git a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
-index ac74d1b..1bdf7e1 100644
---- a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
-+++ b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
-@@ -212,7 +212,6 @@ struct drm_gem_object *omap_gem_prime_import(struct drm_device *dev,
- 			 * refcount on gem itself instead of f_count of dmabuf.
- 			 */
- 			drm_gem_object_reference(obj);
--			dma_buf_put(buffer);
- 			return obj;
- 		}
- 	}
-diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
-index 46a9c37..fb441a7 100644
---- a/drivers/gpu/drm/radeon/atom.c
-+++ b/drivers/gpu/drm/radeon/atom.c
-@@ -1394,10 +1394,10 @@ int atom_allocate_fb_scratch(struct atom_context *ctx)
- 		firmware_usage = (struct _ATOM_VRAM_USAGE_BY_FIRMWARE *)(ctx->bios + data_offset);
- 
- 		DRM_DEBUG("atom firmware requested %08x %dkb\n",
--			  firmware_usage->asFirmwareVramReserveInfo[0].ulStartAddrUsedByFirmware,
--			  firmware_usage->asFirmwareVramReserveInfo[0].usFirmwareUseInKb);
-+			  le32_to_cpu(firmware_usage->asFirmwareVramReserveInfo[0].ulStartAddrUsedByFirmware),
-+			  le16_to_cpu(firmware_usage->asFirmwareVramReserveInfo[0].usFirmwareUseInKb));
- 
--		usage_bytes = firmware_usage->asFirmwareVramReserveInfo[0].usFirmwareUseInKb * 1024;
-+		usage_bytes = le16_to_cpu(firmware_usage->asFirmwareVramReserveInfo[0].usFirmwareUseInKb) * 1024;
- 	}
- 	ctx->scratch_size_bytes = 0;
- 	if (usage_bytes == 0)
-diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
-index 21a892c..6d6fdb3 100644
---- a/drivers/gpu/drm/radeon/atombios_crtc.c
-+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
-@@ -557,6 +557,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
- 		/* use frac fb div on APUs */
- 		if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev))
- 			radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
-+		/* use frac fb div on RS780/RS880 */
-+		if ((rdev->family == CHIP_RS780) || (rdev->family == CHIP_RS880))
-+			radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
- 		if (ASIC_IS_DCE32(rdev) && mode->clock > 165000)
- 			radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
- 	} else {
-diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
-index 305a657..aeaa386 100644
---- a/drivers/gpu/drm/radeon/evergreen.c
-+++ b/drivers/gpu/drm/radeon/evergreen.c
-@@ -105,6 +105,27 @@ void evergreen_fix_pci_max_read_req_size(struct radeon_device *rdev)
- 	}
- }
- 
-+static bool dce4_is_in_vblank(struct radeon_device *rdev, int crtc)
-+{
-+	if (RREG32(EVERGREEN_CRTC_STATUS + crtc_offsets[crtc]) & EVERGREEN_CRTC_V_BLANK)
-+		return true;
-+	else
-+		return false;
-+}
-+
-+static bool dce4_is_counter_moving(struct radeon_device *rdev, int crtc)
-+{
-+	u32 pos1, pos2;
-+
-+	pos1 = RREG32(EVERGREEN_CRTC_STATUS_POSITION + crtc_offsets[crtc]);
-+	pos2 = RREG32(EVERGREEN_CRTC_STATUS_POSITION + crtc_offsets[crtc]);
-+
-+	if (pos1 != pos2)
-+		return true;
-+	else
-+		return false;
-+}
-+
- /**
-  * dce4_wait_for_vblank - vblank wait asic callback.
-  *
-@@ -115,21 +136,28 @@ void evergreen_fix_pci_max_read_req_size(struct radeon_device *rdev)
-  */
- void dce4_wait_for_vblank(struct radeon_device *rdev, int crtc)
- {
--	int i;
-+	unsigned i = 0;
- 
- 	if (crtc >= rdev->num_crtc)
- 		return;
- 
--	if (RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[crtc]) & EVERGREEN_CRTC_MASTER_EN) {
--		for (i = 0; i < rdev->usec_timeout; i++) {
--			if (!(RREG32(EVERGREEN_CRTC_STATUS + crtc_offsets[crtc]) & EVERGREEN_CRTC_V_BLANK))
-+	if (!(RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[crtc]) & EVERGREEN_CRTC_MASTER_EN))
-+		return;
-+
-+	/* depending on when we hit vblank, we may be close to active; if so,
-+	 * wait for another frame.
-+	 */
-+	while (dce4_is_in_vblank(rdev, crtc)) {
-+		if (i++ % 100 == 0) {
-+			if (!dce4_is_counter_moving(rdev, crtc))
- 				break;
--			udelay(1);
- 		}
--		for (i = 0; i < rdev->usec_timeout; i++) {
--			if (RREG32(EVERGREEN_CRTC_STATUS + crtc_offsets[crtc]) & EVERGREEN_CRTC_V_BLANK)
-+	}
-+
-+	while (!dce4_is_in_vblank(rdev, crtc)) {
-+		if (i++ % 100 == 0) {
-+			if (!dce4_is_counter_moving(rdev, crtc))
- 				break;
--			udelay(1);
- 		}
- 	}
- }
-@@ -608,6 +636,16 @@ void evergreen_hpd_init(struct radeon_device *rdev)
- 
- 	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
- 		struct radeon_connector *radeon_connector = to_radeon_connector(connector);
-+
-+		if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
-+		    connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
-+			/* don't try to enable hpd on eDP or LVDS avoid breaking the
-+			 * aux dp channel on imac and help (but not completely fix)
-+			 * https://bugzilla.redhat.com/show_bug.cgi?id=726143
-+			 * also avoid interrupt storms during dpms.
-+			 */
-+			continue;
-+		}
- 		switch (radeon_connector->hpd.hpd) {
- 		case RADEON_HPD_1:
- 			WREG32(DC_HPD1_CONTROL, tmp);
-@@ -1325,17 +1363,16 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
- 				tmp = RREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i]);
- 				if (!(tmp & EVERGREEN_CRTC_BLANK_DATA_EN)) {
- 					radeon_wait_for_vblank(rdev, i);
--					tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
- 					WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
-+					tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
- 					WREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i], tmp);
--					WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
- 				}
- 			} else {
- 				tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
- 				if (!(tmp & EVERGREEN_CRTC_DISP_READ_REQUEST_DISABLE)) {
- 					radeon_wait_for_vblank(rdev, i);
--					tmp |= EVERGREEN_CRTC_DISP_READ_REQUEST_DISABLE;
- 					WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
-+					tmp |= EVERGREEN_CRTC_DISP_READ_REQUEST_DISABLE;
- 					WREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i], tmp);
- 					WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
- 				}
-@@ -1347,6 +1384,15 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
- 					break;
- 				udelay(1);
- 			}
-+
-+			/* XXX this is a hack to avoid strange behavior with EFI on certain systems */
-+			WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
-+			tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
-+			tmp &= ~EVERGREEN_CRTC_MASTER_EN;
-+			WREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i], tmp);
-+			WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
-+			save->crtc_enabled[i] = false;
-+			/* ***** */
- 		} else {
- 			save->crtc_enabled[i] = false;
- 		}
-@@ -1364,6 +1410,22 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
- 	}
- 	/* wait for the MC to settle */
- 	udelay(100);
-+
-+	/* lock double buffered regs */
-+	for (i = 0; i < rdev->num_crtc; i++) {
-+		if (save->crtc_enabled[i]) {
-+			tmp = RREG32(EVERGREEN_GRPH_UPDATE + crtc_offsets[i]);
-+			if (!(tmp & EVERGREEN_GRPH_UPDATE_LOCK)) {
-+				tmp |= EVERGREEN_GRPH_UPDATE_LOCK;
-+				WREG32(EVERGREEN_GRPH_UPDATE + crtc_offsets[i], tmp);
-+			}
-+			tmp = RREG32(EVERGREEN_MASTER_UPDATE_LOCK + crtc_offsets[i]);
-+			if (!(tmp & 1)) {
-+				tmp |= 1;
-+				WREG32(EVERGREEN_MASTER_UPDATE_LOCK + crtc_offsets[i], tmp);
-+			}
-+		}
-+	}
- }
- 
- void evergreen_mc_resume(struct radeon_device *rdev, struct evergreen_mc_save *save)
-@@ -1385,6 +1447,33 @@ void evergreen_mc_resume(struct radeon_device *rdev, struct evergreen_mc_save *s
- 	WREG32(EVERGREEN_VGA_MEMORY_BASE_ADDRESS_HIGH, upper_32_bits(rdev->mc.vram_start));
- 	WREG32(EVERGREEN_VGA_MEMORY_BASE_ADDRESS, (u32)rdev->mc.vram_start);
- 
-+	/* unlock regs and wait for update */
-+	for (i = 0; i < rdev->num_crtc; i++) {
-+		if (save->crtc_enabled[i]) {
-+			tmp = RREG32(EVERGREEN_MASTER_UPDATE_MODE + crtc_offsets[i]);
-+			if ((tmp & 0x3) != 0) {
-+				tmp &= ~0x3;
-+				WREG32(EVERGREEN_MASTER_UPDATE_MODE + crtc_offsets[i], tmp);
-+			}
-+			tmp = RREG32(EVERGREEN_GRPH_UPDATE + crtc_offsets[i]);
-+			if (tmp & EVERGREEN_GRPH_UPDATE_LOCK) {
-+				tmp &= ~EVERGREEN_GRPH_UPDATE_LOCK;
-+				WREG32(EVERGREEN_GRPH_UPDATE + crtc_offsets[i], tmp);
-+			}
-+			tmp = RREG32(EVERGREEN_MASTER_UPDATE_LOCK + crtc_offsets[i]);
-+			if (tmp & 1) {
-+				tmp &= ~1;
-+				WREG32(EVERGREEN_MASTER_UPDATE_LOCK + crtc_offsets[i], tmp);
-+			}
-+			for (j = 0; j < rdev->usec_timeout; j++) {
-+				tmp = RREG32(EVERGREEN_GRPH_UPDATE + crtc_offsets[i]);
-+				if ((tmp & EVERGREEN_GRPH_SURFACE_UPDATE_PENDING) == 0)
-+					break;
-+				udelay(1);
-+			}
-+		}
-+	}
-+
- 	/* unblackout the MC */
- 	tmp = RREG32(MC_SHARED_BLACKOUT_CNTL);
- 	tmp &= ~BLACKOUT_MODE_MASK;
-diff --git a/drivers/gpu/drm/radeon/evergreen_reg.h b/drivers/gpu/drm/radeon/evergreen_reg.h
-index f585be1..881aba2 100644
---- a/drivers/gpu/drm/radeon/evergreen_reg.h
-+++ b/drivers/gpu/drm/radeon/evergreen_reg.h
-@@ -226,6 +226,8 @@
- #define EVERGREEN_CRTC_STATUS_HV_COUNT                  0x6ea0
- #define EVERGREEN_MASTER_UPDATE_MODE                    0x6ef8
- #define EVERGREEN_CRTC_UPDATE_LOCK                      0x6ed4
-+#define EVERGREEN_MASTER_UPDATE_LOCK                    0x6ef4
-+#define EVERGREEN_MASTER_UPDATE_MODE                    0x6ef8
- 
- #define EVERGREEN_DC_GPIO_HPD_MASK                      0x64b0
- #define EVERGREEN_DC_GPIO_HPD_A                         0x64b4
-diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
-index 27769e7..0a32d89 100644
---- a/drivers/gpu/drm/radeon/ni.c
-+++ b/drivers/gpu/drm/radeon/ni.c
-@@ -473,7 +473,8 @@ static void cayman_gpu_init(struct radeon_device *rdev)
- 		    (rdev->pdev->device == 0x990F) ||
- 		    (rdev->pdev->device == 0x9910) ||
- 		    (rdev->pdev->device == 0x9917) ||
--		    (rdev->pdev->device == 0x9999)) {
-+		    (rdev->pdev->device == 0x9999) ||
-+		    (rdev->pdev->device == 0x999C)) {
- 			rdev->config.cayman.max_simds_per_se = 6;
- 			rdev->config.cayman.max_backends_per_se = 2;
- 		} else if ((rdev->pdev->device == 0x9903) ||
-@@ -482,7 +483,8 @@ static void cayman_gpu_init(struct radeon_device *rdev)
- 			   (rdev->pdev->device == 0x990D) ||
- 			   (rdev->pdev->device == 0x990E) ||
- 			   (rdev->pdev->device == 0x9913) ||
--			   (rdev->pdev->device == 0x9918)) {
-+			   (rdev->pdev->device == 0x9918) ||
-+			   (rdev->pdev->device == 0x999D)) {
- 			rdev->config.cayman.max_simds_per_se = 4;
- 			rdev->config.cayman.max_backends_per_se = 2;
- 		} else if ((rdev->pdev->device == 0x9919) ||
-@@ -621,6 +623,8 @@ static void cayman_gpu_init(struct radeon_device *rdev)
- 
- 	WREG32(GB_ADDR_CONFIG, gb_addr_config);
- 	WREG32(DMIF_ADDR_CONFIG, gb_addr_config);
-+	if (ASIC_IS_DCE6(rdev))
-+		WREG32(DMIF_ADDR_CALC, gb_addr_config);
- 	WREG32(HDP_ADDR_CONFIG, gb_addr_config);
- 	WREG32(DMA_TILING_CONFIG + DMA0_REGISTER_OFFSET, gb_addr_config);
- 	WREG32(DMA_TILING_CONFIG + DMA1_REGISTER_OFFSET, gb_addr_config);
-diff --git a/drivers/gpu/drm/radeon/nid.h b/drivers/gpu/drm/radeon/nid.h
-index 079dee2..445b235 100644
---- a/drivers/gpu/drm/radeon/nid.h
-+++ b/drivers/gpu/drm/radeon/nid.h
-@@ -45,6 +45,10 @@
- #define ARUBA_GB_ADDR_CONFIG_GOLDEN        0x12010001
- 
- #define DMIF_ADDR_CONFIG  				0xBD4
-+
-+/* DCE6 only */
-+#define DMIF_ADDR_CALC  				0xC00
-+
- #define	SRBM_GFX_CNTL				        0x0E44
- #define		RINGID(x)					(((x) & 0x3) << 0)
- #define		VMID(x)						(((x) & 0x7) << 0)
-diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
-index 9db5853..4973bff 100644
---- a/drivers/gpu/drm/radeon/r100.c
-+++ b/drivers/gpu/drm/radeon/r100.c
-@@ -69,6 +69,38 @@ MODULE_FIRMWARE(FIRMWARE_R520);
-  * and others in some cases.
-  */
- 
-+static bool r100_is_in_vblank(struct radeon_device *rdev, int crtc)
-+{
-+	if (crtc == 0) {
-+		if (RREG32(RADEON_CRTC_STATUS) & RADEON_CRTC_VBLANK_CUR)
-+			return true;
-+		else
-+			return false;
-+	} else {
-+		if (RREG32(RADEON_CRTC2_STATUS) & RADEON_CRTC2_VBLANK_CUR)
-+			return true;
-+		else
-+			return false;
-+	}
-+}
-+
-+static bool r100_is_counter_moving(struct radeon_device *rdev, int crtc)
-+{
-+	u32 vline1, vline2;
-+
-+	if (crtc == 0) {
-+		vline1 = (RREG32(RADEON_CRTC_VLINE_CRNT_VLINE) >> 16) & RADEON_CRTC_V_TOTAL;
-+		vline2 = (RREG32(RADEON_CRTC_VLINE_CRNT_VLINE) >> 16) & RADEON_CRTC_V_TOTAL;
-+	} else {
-+		vline1 = (RREG32(RADEON_CRTC2_VLINE_CRNT_VLINE) >> 16) & RADEON_CRTC_V_TOTAL;
-+		vline2 = (RREG32(RADEON_CRTC2_VLINE_CRNT_VLINE) >> 16) & RADEON_CRTC_V_TOTAL;
-+	}
-+	if (vline1 != vline2)
-+		return true;
-+	else
-+		return false;
-+}
-+
- /**
-  * r100_wait_for_vblank - vblank wait asic callback.
-  *
-@@ -79,36 +111,33 @@ MODULE_FIRMWARE(FIRMWARE_R520);
-  */
- void r100_wait_for_vblank(struct radeon_device *rdev, int crtc)
- {
--	int i;
-+	unsigned i = 0;
- 
- 	if (crtc >= rdev->num_crtc)
- 		return;
- 
- 	if (crtc == 0) {
--		if (RREG32(RADEON_CRTC_GEN_CNTL) & RADEON_CRTC_EN) {
--			for (i = 0; i < rdev->usec_timeout; i++) {
--				if (!(RREG32(RADEON_CRTC_STATUS) & RADEON_CRTC_VBLANK_CUR))
--					break;
--				udelay(1);
--			}
--			for (i = 0; i < rdev->usec_timeout; i++) {
--				if (RREG32(RADEON_CRTC_STATUS) & RADEON_CRTC_VBLANK_CUR)
--					break;
--				udelay(1);
--			}
--		}
-+		if (!(RREG32(RADEON_CRTC_GEN_CNTL) & RADEON_CRTC_EN))
-+			return;
- 	} else {
--		if (RREG32(RADEON_CRTC2_GEN_CNTL) & RADEON_CRTC2_EN) {
--			for (i = 0; i < rdev->usec_timeout; i++) {
--				if (!(RREG32(RADEON_CRTC2_STATUS) & RADEON_CRTC2_VBLANK_CUR))
--					break;
--				udelay(1);
--			}
--			for (i = 0; i < rdev->usec_timeout; i++) {
--				if (RREG32(RADEON_CRTC2_STATUS) & RADEON_CRTC2_VBLANK_CUR)
--					break;
--				udelay(1);
--			}
-+		if (!(RREG32(RADEON_CRTC2_GEN_CNTL) & RADEON_CRTC2_EN))
-+			return;
-+	}
-+
-+	/* depending on when we hit vblank, we may be close to active; if so,
-+	 * wait for another frame.
-+	 */
-+	while (r100_is_in_vblank(rdev, crtc)) {
-+		if (i++ % 100 == 0) {
-+			if (!r100_is_counter_moving(rdev, crtc))
-+				break;
-+		}
-+	}
-+
-+	while (!r100_is_in_vblank(rdev, crtc)) {
-+		if (i++ % 100 == 0) {
-+			if (!r100_is_counter_moving(rdev, crtc))
-+				break;
- 		}
- 	}
- }
-diff --git a/drivers/gpu/drm/radeon/r500_reg.h b/drivers/gpu/drm/radeon/r500_reg.h
-index c0dc8d3..1dd0d32 100644
---- a/drivers/gpu/drm/radeon/r500_reg.h
-+++ b/drivers/gpu/drm/radeon/r500_reg.h
-@@ -358,7 +358,9 @@
- #define AVIVO_D1CRTC_STATUS_HV_COUNT                            0x60ac
- #define AVIVO_D1CRTC_STEREO_CONTROL                             0x60c4
- 
-+#define AVIVO_D1MODE_MASTER_UPDATE_LOCK                         0x60e0
- #define AVIVO_D1MODE_MASTER_UPDATE_MODE                         0x60e4
-+#define AVIVO_D1CRTC_UPDATE_LOCK                                0x60e8
- 
- /* master controls */
- #define AVIVO_DC_CRTC_MASTER_EN                                 0x60f8
-diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
-index 21ecc0e..8520833 100644
---- a/drivers/gpu/drm/radeon/r600_hdmi.c
-+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
-@@ -433,7 +433,7 @@ void r600_hdmi_enable(struct drm_encoder *encoder)
- 	offset = dig->afmt->offset;
- 
- 	/* Older chipsets require setting HDMI and routing manually */
--	if (rdev->family >= CHIP_R600 && !ASIC_IS_DCE3(rdev)) {
-+	if (ASIC_IS_DCE2(rdev) && !ASIC_IS_DCE3(rdev)) {
- 		hdmi = HDMI0_ERROR_ACK | HDMI0_ENABLE;
- 		switch (radeon_encoder->encoder_id) {
- 		case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1:
-@@ -501,7 +501,7 @@ void r600_hdmi_disable(struct drm_encoder *encoder)
- 	radeon_irq_kms_disable_afmt(rdev, dig->afmt->id);
- 
- 	/* Older chipsets not handled by AtomBIOS */
--	if (rdev->family >= CHIP_R600 && !ASIC_IS_DCE3(rdev)) {
-+	if (ASIC_IS_DCE2(rdev) && !ASIC_IS_DCE3(rdev)) {
- 		switch (radeon_encoder->encoder_id) {
- 		case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1:
- 			WREG32_P(AVIVO_TMDSA_CNTL, 0,
-diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
-index f22eb57..96168ef 100644
---- a/drivers/gpu/drm/radeon/radeon_atombios.c
-+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
-@@ -2028,6 +2028,8 @@ static int radeon_atombios_parse_power_table_1_3(struct radeon_device *rdev)
- 	num_modes = power_info->info.ucNumOfPowerModeEntries;
- 	if (num_modes > ATOM_MAX_NUMBEROF_POWER_BLOCK)
- 		num_modes = ATOM_MAX_NUMBEROF_POWER_BLOCK;
-+	if (num_modes == 0)
-+		return state_index;
- 	rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) * num_modes, GFP_KERNEL);
- 	if (!rdev->pm.power_state)
- 		return state_index;
-@@ -2432,6 +2434,8 @@ static int radeon_atombios_parse_power_table_4_5(struct radeon_device *rdev)
- 	power_info = (union power_info *)(mode_info->atom_context->bios + data_offset);
- 
- 	radeon_atombios_add_pplib_thermal_controller(rdev, &power_info->pplib.sThermalController);
-+	if (power_info->pplib.ucNumStates == 0)
-+		return state_index;
- 	rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) *
- 				       power_info->pplib.ucNumStates, GFP_KERNEL);
- 	if (!rdev->pm.power_state)
-@@ -2514,6 +2518,7 @@ static int radeon_atombios_parse_power_table_6(struct radeon_device *rdev)
- 	int index = GetIndexIntoMasterTable(DATA, PowerPlayInfo);
-         u16 data_offset;
- 	u8 frev, crev;
-+	u8 *power_state_offset;
- 
- 	if (!atom_parse_data_header(mode_info->atom_context, index, NULL,
- 				   &frev, &crev, &data_offset))
-@@ -2530,15 +2535,17 @@ static int radeon_atombios_parse_power_table_6(struct radeon_device *rdev)
- 	non_clock_info_array = (struct _NonClockInfoArray *)
- 		(mode_info->atom_context->bios + data_offset +
- 		 le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
-+	if (state_array->ucNumEntries == 0)
-+		return state_index;
- 	rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) *
- 				       state_array->ucNumEntries, GFP_KERNEL);
- 	if (!rdev->pm.power_state)
- 		return state_index;
-+	power_state_offset = (u8 *)state_array->states;
- 	for (i = 0; i < state_array->ucNumEntries; i++) {
- 		mode_index = 0;
--		power_state = (union pplib_power_state *)&state_array->states[i];
--		/* XXX this might be an inagua bug... */
--		non_clock_array_index = i; /* power_state->v2.nonClockInfoIndex */
-+		power_state = (union pplib_power_state *)power_state_offset;
-+		non_clock_array_index = power_state->v2.nonClockInfoIndex;
- 		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
- 			&non_clock_info_array->nonClockInfo[non_clock_array_index];
- 		rdev->pm.power_state[i].clock_info = kzalloc(sizeof(struct radeon_pm_clock_info) *
-@@ -2550,9 +2557,6 @@ static int radeon_atombios_parse_power_table_6(struct radeon_device *rdev)
- 		if (power_state->v2.ucNumDPMLevels) {
- 			for (j = 0; j < power_state->v2.ucNumDPMLevels; j++) {
- 				clock_array_index = power_state->v2.clockInfoIndex[j];
--				/* XXX this might be an inagua bug... */
--				if (clock_array_index >= clock_info_array->ucNumEntries)
--					continue;
- 				clock_info = (union pplib_clock_info *)
- 					&clock_info_array->clockInfo[clock_array_index * clock_info_array->ucEntrySize];
- 				valid = radeon_atombios_parse_pplib_clock_info(rdev,
-@@ -2574,6 +2578,7 @@ static int radeon_atombios_parse_power_table_6(struct radeon_device *rdev)
- 								   non_clock_info);
- 			state_index++;
- 		}
-+		power_state_offset += 2 + power_state->v2.ucNumDPMLevels;
- 	}
- 	/* if multiple clock modes, mark the lowest as no display */
- 	for (i = 0; i < state_index; i++) {
-@@ -2620,7 +2625,9 @@ void radeon_atombios_get_power_modes(struct radeon_device *rdev)
- 		default:
- 			break;
- 		}
--	} else {
-+	}
-+
-+	if (state_index == 0) {
- 		rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state), GFP_KERNEL);
- 		if (rdev->pm.power_state) {
- 			rdev->pm.power_state[0].clock_info =
-diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
-index c75cb2c..c5b2765 100644
---- a/drivers/gpu/drm/radeon/radeon_kms.c
-+++ b/drivers/gpu/drm/radeon/radeon_kms.c
-@@ -50,9 +50,13 @@ int radeon_driver_unload_kms(struct drm_device *dev)
- 
- 	if (rdev == NULL)
- 		return 0;
-+	if (rdev->rmmio == NULL)
-+		goto done_free;
- 	radeon_acpi_fini(rdev);
- 	radeon_modeset_fini(rdev);
- 	radeon_device_fini(rdev);
-+
-+done_free:
- 	kfree(rdev);
- 	dev->dev_private = NULL;
- 	return 0;
-diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
-index 338fd6a..788c64c 100644
---- a/drivers/gpu/drm/radeon/radeon_pm.c
-+++ b/drivers/gpu/drm/radeon/radeon_pm.c
-@@ -843,7 +843,11 @@ static int radeon_debugfs_pm_info(struct seq_file *m, void *data)
- 	struct radeon_device *rdev = dev->dev_private;
- 
- 	seq_printf(m, "default engine clock: %u0 kHz\n", rdev->pm.default_sclk);
--	seq_printf(m, "current engine clock: %u0 kHz\n", radeon_get_engine_clock(rdev));
-+	/* radeon_get_engine_clock is not reliable on APUs so just print the current clock */
-+	if ((rdev->family >= CHIP_PALM) && (rdev->flags & RADEON_IS_IGP))
-+		seq_printf(m, "current engine clock: %u0 kHz\n", rdev->pm.current_sclk);
-+	else
-+		seq_printf(m, "current engine clock: %u0 kHz\n", radeon_get_engine_clock(rdev));
- 	seq_printf(m, "default memory clock: %u0 kHz\n", rdev->pm.default_mclk);
- 	if (rdev->asic->pm.get_memory_clock)
- 		seq_printf(m, "current memory clock: %u0 kHz\n", radeon_get_memory_clock(rdev));
-diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
-index 8d58e26..1ef5eaa 100644
---- a/drivers/gpu/drm/radeon/radeon_ring.c
-+++ b/drivers/gpu/drm/radeon/radeon_ring.c
-@@ -180,7 +180,8 @@ int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib,
- 		radeon_semaphore_free(rdev, &ib->semaphore, NULL);
- 	}
- 	/* if we can't remember our last VM flush then flush now! */
--	if (ib->vm && !ib->vm->last_flush) {
-+	/* XXX figure out why we have to flush for every IB */
-+	if (ib->vm /*&& !ib->vm->last_flush*/) {
- 		radeon_ring_vm_flush(rdev, ib->ring, ib->vm);
- 	}
- 	if (const_ib) {
-diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
-index 5a0fc74..46fa1b0 100644
---- a/drivers/gpu/drm/radeon/rs600.c
-+++ b/drivers/gpu/drm/radeon/rs600.c
-@@ -52,23 +52,59 @@ static const u32 crtc_offsets[2] =
- 	AVIVO_D2CRTC_H_TOTAL - AVIVO_D1CRTC_H_TOTAL
- };
- 
-+static bool avivo_is_in_vblank(struct radeon_device *rdev, int crtc)
-+{
-+	if (RREG32(AVIVO_D1CRTC_STATUS + crtc_offsets[crtc]) & AVIVO_D1CRTC_V_BLANK)
-+		return true;
-+	else
-+		return false;
-+}
-+
-+static bool avivo_is_counter_moving(struct radeon_device *rdev, int crtc)
-+{
-+	u32 pos1, pos2;
-+
-+	pos1 = RREG32(AVIVO_D1CRTC_STATUS_POSITION + crtc_offsets[crtc]);
-+	pos2 = RREG32(AVIVO_D1CRTC_STATUS_POSITION + crtc_offsets[crtc]);
-+
-+	if (pos1 != pos2)
-+		return true;
-+	else
-+		return false;
-+}
-+
-+/**
-+ * avivo_wait_for_vblank - vblank wait asic callback.
-+ *
-+ * @rdev: radeon_device pointer
-+ * @crtc: crtc to wait for vblank on
-+ *
-+ * Wait for vblank on the requested crtc (r5xx-r7xx).
-+ */
- void avivo_wait_for_vblank(struct radeon_device *rdev, int crtc)
- {
--	int i;
-+	unsigned i = 0;
- 
- 	if (crtc >= rdev->num_crtc)
- 		return;
- 
--	if (RREG32(AVIVO_D1CRTC_CONTROL + crtc_offsets[crtc]) & AVIVO_CRTC_EN) {
--		for (i = 0; i < rdev->usec_timeout; i++) {
--			if (!(RREG32(AVIVO_D1CRTC_STATUS + crtc_offsets[crtc]) & AVIVO_D1CRTC_V_BLANK))
-+	if (!(RREG32(AVIVO_D1CRTC_CONTROL + crtc_offsets[crtc]) & AVIVO_CRTC_EN))
-+		return;
-+
-+	/* depending on when we hit vblank, we may be close to active; if so,
-+	 * wait for another frame.
-+	 */
-+	while (avivo_is_in_vblank(rdev, crtc)) {
-+		if (i++ % 100 == 0) {
-+			if (!avivo_is_counter_moving(rdev, crtc))
- 				break;
--			udelay(1);
- 		}
--		for (i = 0; i < rdev->usec_timeout; i++) {
--			if (RREG32(AVIVO_D1CRTC_STATUS + crtc_offsets[crtc]) & AVIVO_D1CRTC_V_BLANK)
-+	}
-+
-+	while (!avivo_is_in_vblank(rdev, crtc)) {
-+		if (i++ % 100 == 0) {
-+			if (!avivo_is_counter_moving(rdev, crtc))
- 				break;
--			udelay(1);
- 		}
- 	}
- }
-diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
-index 435ed35..ffcba73 100644
---- a/drivers/gpu/drm/radeon/rv515.c
-+++ b/drivers/gpu/drm/radeon/rv515.c
-@@ -303,8 +303,10 @@ void rv515_mc_stop(struct radeon_device *rdev, struct rv515_mc_save *save)
- 			tmp = RREG32(AVIVO_D1CRTC_CONTROL + crtc_offsets[i]);
- 			if (!(tmp & AVIVO_CRTC_DISP_READ_REQUEST_DISABLE)) {
- 				radeon_wait_for_vblank(rdev, i);
-+				WREG32(AVIVO_D1CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
- 				tmp |= AVIVO_CRTC_DISP_READ_REQUEST_DISABLE;
- 				WREG32(AVIVO_D1CRTC_CONTROL + crtc_offsets[i], tmp);
-+				WREG32(AVIVO_D1CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
- 			}
- 			/* wait for the next frame */
- 			frame_count = radeon_get_vblank_counter(rdev, i);
-@@ -313,6 +315,15 @@ void rv515_mc_stop(struct radeon_device *rdev, struct rv515_mc_save *save)
- 					break;
- 				udelay(1);
- 			}
-+
-+			/* XXX this is a hack to avoid strange behavior with EFI on certain systems */
-+			WREG32(AVIVO_D1CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
-+			tmp = RREG32(AVIVO_D1CRTC_CONTROL + crtc_offsets[i]);
-+			tmp &= ~AVIVO_CRTC_EN;
-+			WREG32(AVIVO_D1CRTC_CONTROL + crtc_offsets[i], tmp);
-+			WREG32(AVIVO_D1CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
-+			save->crtc_enabled[i] = false;
-+			/* ***** */
- 		} else {
- 			save->crtc_enabled[i] = false;
- 		}
-@@ -338,6 +349,22 @@ void rv515_mc_stop(struct radeon_device *rdev, struct rv515_mc_save *save)
- 	}
- 	/* wait for the MC to settle */
- 	udelay(100);
-+
-+	/* lock double buffered regs */
-+	for (i = 0; i < rdev->num_crtc; i++) {
-+		if (save->crtc_enabled[i]) {
-+			tmp = RREG32(AVIVO_D1GRPH_UPDATE + crtc_offsets[i]);
-+			if (!(tmp & AVIVO_D1GRPH_UPDATE_LOCK)) {
-+				tmp |= AVIVO_D1GRPH_UPDATE_LOCK;
-+				WREG32(AVIVO_D1GRPH_UPDATE + crtc_offsets[i], tmp);
-+			}
-+			tmp = RREG32(AVIVO_D1MODE_MASTER_UPDATE_LOCK + crtc_offsets[i]);
-+			if (!(tmp & 1)) {
-+				tmp |= 1;
-+				WREG32(AVIVO_D1MODE_MASTER_UPDATE_LOCK + crtc_offsets[i], tmp);
-+			}
-+		}
-+	}
- }
- 
- void rv515_mc_resume(struct radeon_device *rdev, struct rv515_mc_save *save)
-@@ -348,7 +375,7 @@ void rv515_mc_resume(struct radeon_device *rdev, struct rv515_mc_save *save)
- 	/* update crtc base addresses */
- 	for (i = 0; i < rdev->num_crtc; i++) {
- 		if (rdev->family >= CHIP_RV770) {
--			if (i == 1) {
-+			if (i == 0) {
- 				WREG32(R700_D1GRPH_PRIMARY_SURFACE_ADDRESS_HIGH,
- 				       upper_32_bits(rdev->mc.vram_start));
- 				WREG32(R700_D1GRPH_SECONDARY_SURFACE_ADDRESS_HIGH,
-@@ -367,6 +394,33 @@ void rv515_mc_resume(struct radeon_device *rdev, struct rv515_mc_save *save)
- 	}
- 	WREG32(R_000310_VGA_MEMORY_BASE_ADDRESS, (u32)rdev->mc.vram_start);
- 
-+	/* unlock regs and wait for update */
-+	for (i = 0; i < rdev->num_crtc; i++) {
-+		if (save->crtc_enabled[i]) {
-+			tmp = RREG32(AVIVO_D1MODE_MASTER_UPDATE_MODE + crtc_offsets[i]);
-+			if ((tmp & 0x3) != 0) {
-+				tmp &= ~0x3;
-+				WREG32(AVIVO_D1MODE_MASTER_UPDATE_MODE + crtc_offsets[i], tmp);
-+			}
-+			tmp = RREG32(AVIVO_D1GRPH_UPDATE + crtc_offsets[i]);
-+			if (tmp & AVIVO_D1GRPH_UPDATE_LOCK) {
-+				tmp &= ~AVIVO_D1GRPH_UPDATE_LOCK;
-+				WREG32(AVIVO_D1GRPH_UPDATE + crtc_offsets[i], tmp);
-+			}
-+			tmp = RREG32(AVIVO_D1MODE_MASTER_UPDATE_LOCK + crtc_offsets[i]);
-+			if (tmp & 1) {
-+				tmp &= ~1;
-+				WREG32(AVIVO_D1MODE_MASTER_UPDATE_LOCK + crtc_offsets[i], tmp);
-+			}
-+			for (j = 0; j < rdev->usec_timeout; j++) {
-+				tmp = RREG32(AVIVO_D1GRPH_UPDATE + crtc_offsets[i]);
-+				if ((tmp & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING) == 0)
-+					break;
-+				udelay(1);
-+			}
-+		}
-+	}
-+
- 	if (rdev->family >= CHIP_R600) {
- 		/* unblackout the MC */
- 		if (rdev->family >= CHIP_RV770)
-diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
-index bafbe32..3dd7ecc 100644
---- a/drivers/gpu/drm/radeon/si.c
-+++ b/drivers/gpu/drm/radeon/si.c
-@@ -1463,7 +1463,7 @@ static void si_select_se_sh(struct radeon_device *rdev,
- 	u32 data = INSTANCE_BROADCAST_WRITES;
- 
- 	if ((se_num == 0xffffffff) && (sh_num == 0xffffffff))
--		data = SH_BROADCAST_WRITES | SE_BROADCAST_WRITES;
-+		data |= SH_BROADCAST_WRITES | SE_BROADCAST_WRITES;
- 	else if (se_num == 0xffffffff)
- 		data |= SE_BROADCAST_WRITES | SH_INDEX(sh_num);
- 	else if (sh_num == 0xffffffff)
-@@ -1765,6 +1765,7 @@ static void si_gpu_init(struct radeon_device *rdev)
- 
- 	WREG32(GB_ADDR_CONFIG, gb_addr_config);
- 	WREG32(DMIF_ADDR_CONFIG, gb_addr_config);
-+	WREG32(DMIF_ADDR_CALC, gb_addr_config);
- 	WREG32(HDP_ADDR_CONFIG, gb_addr_config);
- 	WREG32(DMA_TILING_CONFIG + DMA0_REGISTER_OFFSET, gb_addr_config);
- 	WREG32(DMA_TILING_CONFIG + DMA1_REGISTER_OFFSET, gb_addr_config);
-diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
-index 23fc08f..f84cff0 100644
---- a/drivers/gpu/drm/radeon/sid.h
-+++ b/drivers/gpu/drm/radeon/sid.h
-@@ -65,6 +65,8 @@
- 
- #define DMIF_ADDR_CONFIG  				0xBD4
- 
-+#define DMIF_ADDR_CALC  				0xC00
-+
- #define	SRBM_STATUS				        0xE50
- #define		GRBM_RQ_PENDING 			(1 << 5)
- #define		VMC_BUSY 				(1 << 8)
-diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
-index c5b592d..bfac582 100644
---- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
-+++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
-@@ -75,7 +75,7 @@ static int modeset_init(struct drm_device *dev)
- 		mod->funcs->modeset_init(mod, dev);
- 	}
- 
--	if ((priv->num_encoders = 0) || (priv->num_connectors == 0)) {
-+	if ((priv->num_encoders == 0) || (priv->num_connectors == 0)) {
- 		/* oh nos! */
- 		dev_err(dev->dev, "no encoders/connectors found\n");
- 		return -ENXIO;
-diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
-index 3816270..ef034fa 100644
---- a/drivers/gpu/drm/udl/udl_gem.c
-+++ b/drivers/gpu/drm/udl/udl_gem.c
-@@ -303,6 +303,8 @@ struct drm_gem_object *udl_gem_prime_import(struct drm_device *dev,
- 	if (IS_ERR(attach))
- 		return ERR_CAST(attach);
- 
-+	get_dma_buf(dma_buf);
-+
- 	sg = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL);
- 	if (IS_ERR(sg)) {
- 		ret = PTR_ERR(sg);
-@@ -322,5 +324,7 @@ fail_unmap:
- 	dma_buf_unmap_attachment(attach, sg, DMA_BIDIRECTIONAL);
- fail_detach:
- 	dma_buf_detach(dma_buf, attach);
-+	dma_buf_put(dma_buf);
-+
- 	return ERR_PTR(ret);
- }
-diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
-index 70b1808..ed49ab3 100644
---- a/drivers/infiniband/hw/cxgb4/qp.c
-+++ b/drivers/infiniband/hw/cxgb4/qp.c
-@@ -100,6 +100,16 @@ static int alloc_host_sq(struct c4iw_rdev *rdev, struct t4_sq *sq)
- 	return 0;
- }
- 
-+static int alloc_sq(struct c4iw_rdev *rdev, struct t4_sq *sq, int user)
-+{
-+	int ret = -ENOSYS;
-+	if (user)
-+		ret = alloc_oc_sq(rdev, sq);
-+	if (ret)
-+		ret = alloc_host_sq(rdev, sq);
-+	return ret;
-+}
-+
- static int destroy_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
- 		      struct c4iw_dev_ucontext *uctx)
- {
-@@ -168,18 +178,9 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
- 		goto free_sw_rq;
- 	}
- 
--	if (user) {
--		ret = alloc_oc_sq(rdev, &wq->sq);
--		if (ret)
--			goto free_hwaddr;
--
--		ret = alloc_host_sq(rdev, &wq->sq);
--		if (ret)
--			goto free_sq;
--	} else
--		ret = alloc_host_sq(rdev, &wq->sq);
--		if (ret)
--			goto free_hwaddr;
-+	ret = alloc_sq(rdev, &wq->sq, user);
-+	if (ret)
-+		goto free_hwaddr;
- 	memset(wq->sq.queue, 0, wq->sq.memsize);
- 	dma_unmap_addr_set(&wq->sq, mapping, wq->sq.dma_addr);
- 
-diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
-index b287ca3..cbb1645 100644
---- a/drivers/iommu/amd_iommu.c
-+++ b/drivers/iommu/amd_iommu.c
-@@ -3947,6 +3947,9 @@ static struct irq_remap_table *get_irq_table(u16 devid, bool ioapic)
- 	if (!table)
- 		goto out;
- 
-+	/* Initialize table spin-lock */
-+	spin_lock_init(&table->lock);
-+
- 	if (ioapic)
- 		/* Keep the first 32 indexes free for IOAPIC interrupts */
- 		table->min_index = 32;
-diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
-index c859771..f46dbef 100644
---- a/drivers/net/ethernet/ibm/ibmveth.c
-+++ b/drivers/net/ethernet/ibm/ibmveth.c
-@@ -1324,7 +1324,7 @@ static const struct net_device_ops ibmveth_netdev_ops = {
- 
- static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
- {
--	int rc, i;
-+	int rc, i, mac_len;
- 	struct net_device *netdev;
- 	struct ibmveth_adapter *adapter;
- 	unsigned char *mac_addr_p;
-@@ -1334,11 +1334,19 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
- 		dev->unit_address);
- 
- 	mac_addr_p = (unsigned char *)vio_get_attribute(dev, VETH_MAC_ADDR,
--							NULL);
-+							&mac_len);
- 	if (!mac_addr_p) {
- 		dev_err(&dev->dev, "Can't find VETH_MAC_ADDR attribute\n");
- 		return -EINVAL;
- 	}
-+	/* Workaround for old/broken pHyp */
-+	if (mac_len == 8)
-+		mac_addr_p += 2;
-+	else if (mac_len != 6) {
-+		dev_err(&dev->dev, "VETH_MAC_ADDR attribute wrong len %d\n",
-+			mac_len);
-+		return -EINVAL;
-+	}
- 
- 	mcastFilterSize_p = (unsigned int *)vio_get_attribute(dev,
- 						VETH_MCAST_FILTER_SIZE, NULL);
-@@ -1363,17 +1371,6 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
- 
- 	netif_napi_add(netdev, &adapter->napi, ibmveth_poll, 16);
- 
--	/*
--	 * Some older boxes running PHYP non-natively have an OF that returns
--	 * a 8-byte local-mac-address field (and the first 2 bytes have to be
--	 * ignored) while newer boxes' OF return a 6-byte field. Note that
--	 * IEEE 1275 specifies that local-mac-address must be a 6-byte field.
--	 * The RPA doc specifies that the first byte must be 10b, so we'll
--	 * just look for it to solve this 8 vs. 6 byte field issue
--	 */
--	if ((*mac_addr_p & 0x3) != 0x02)
--		mac_addr_p += 2;
--
- 	adapter->mac_addr = 0;
- 	memcpy(&adapter->mac_addr, mac_addr_p, 6);
- 
-diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
-index 4ecbe64..15ba8c4 100644
---- a/drivers/net/ethernet/realtek/r8169.c
-+++ b/drivers/net/ethernet/realtek/r8169.c
-@@ -5787,6 +5787,14 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
- 		goto err_stop_0;
- 	}
- 
-+	/* 8168evl does not automatically pad to minimum length. */
-+	if (unlikely(tp->mac_version == RTL_GIGA_MAC_VER_34 &&
-+		     skb->len < ETH_ZLEN)) {
-+		if (skb_padto(skb, ETH_ZLEN))
-+			goto err_update_stats;
-+		skb_put(skb, ETH_ZLEN - skb->len);
-+	}
-+
- 	if (unlikely(le32_to_cpu(txd->opts1) & DescOwn))
- 		goto err_stop_0;
- 
-@@ -5858,6 +5866,7 @@ err_dma_1:
- 	rtl8169_unmap_tx_skb(d, tp->tx_skb + entry, txd);
- err_dma_0:
- 	dev_kfree_skb(skb);
-+err_update_stats:
- 	dev->stats.tx_dropped++;
- 	return NETDEV_TX_OK;
- 
-diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
-index 57136dc..299c53b 100644
---- a/drivers/net/usb/cdc_ether.c
-+++ b/drivers/net/usb/cdc_ether.c
-@@ -615,6 +615,13 @@ static const struct usb_device_id	products [] = {
- 	.driver_info = 0,
- },
- 
-+/* Dell Wireless 5804 (Novatel E371) - handled by qmi_wwan */
-+{
-+	USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, 0x819b, USB_CLASS_COMM,
-+			USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
-+	.driver_info = 0,
-+},
-+
- /* AnyDATA ADU960S - handled by qmi_wwan */
- {
- 	USB_DEVICE_AND_INTERFACE_INFO(0x16d5, 0x650a, USB_CLASS_COMM,
-diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
-index 2a3579f..a7cafe4 100644
---- a/drivers/net/usb/qmi_wwan.c
-+++ b/drivers/net/usb/qmi_wwan.c
-@@ -496,6 +496,13 @@ static const struct usb_device_id products[] = {
- 					      USB_CDC_PROTO_NONE),
- 		.driver_info        = (unsigned long)&qmi_wwan_info,
- 	},
-+	{	/* Dell Wireless 5804 (Novatel E371) */
-+		USB_DEVICE_AND_INTERFACE_INFO(0x413C, 0x819b,
-+					      USB_CLASS_COMM,
-+					      USB_CDC_SUBCLASS_ETHERNET,
-+					      USB_CDC_PROTO_NONE),
-+		.driver_info        = (unsigned long)&qmi_wwan_info,
-+	},
- 	{	/* ADU960S */
- 		USB_DEVICE_AND_INTERFACE_INFO(0x16d5, 0x650a,
- 					      USB_CLASS_COMM,
-diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
-index 8647dc6..f9c61fb 100644
---- a/drivers/pci/bus.c
-+++ b/drivers/pci/bus.c
-@@ -174,6 +174,7 @@ int pci_bus_add_device(struct pci_dev *dev)
- 	 * Can not put in pci_device_add yet because resources
- 	 * are not assigned yet for some devices.
- 	 */
-+	pci_fixup_device(pci_fixup_final, dev);
- 	pci_create_sysfs_dev_files(dev);
- 
- 	dev->match_driver = true;
-diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
-index b494066..5427787 100644
---- a/drivers/pci/probe.c
-+++ b/drivers/pci/probe.c
-@@ -1339,7 +1339,6 @@ void pci_device_add(struct pci_dev *dev, struct pci_bus *bus)
- 	list_add_tail(&dev->bus_list, &bus->devices);
- 	up_write(&pci_bus_sem);
- 
--	pci_fixup_device(pci_fixup_final, dev);
- 	ret = pcibios_add_device(dev);
- 	WARN_ON(ret < 0);
- 
-diff --git a/drivers/pwm/pwm-spear.c b/drivers/pwm/pwm-spear.c
-index 69a2d9e..3223b57 100644
---- a/drivers/pwm/pwm-spear.c
-+++ b/drivers/pwm/pwm-spear.c
-@@ -143,7 +143,7 @@ static int spear_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
- 	u32 val;
- 
- 	rc = clk_enable(pc->clk);
--	if (!rc)
-+	if (rc)
- 		return rc;
- 
- 	val = spear_pwm_readl(pc, pwm->hwpwm, PWMCR);
-@@ -209,12 +209,12 @@ static int spear_pwm_probe(struct platform_device *pdev)
- 	pc->chip.npwm = NUM_PWM;
- 
- 	ret = clk_prepare(pc->clk);
--	if (!ret)
-+	if (ret)
- 		return ret;
- 
- 	if (of_device_is_compatible(np, "st,spear1340-pwm")) {
- 		ret = clk_enable(pc->clk);
--		if (!ret) {
-+		if (ret) {
- 			clk_unprepare(pc->clk);
- 			return ret;
- 		}
-diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
-index c6d77e2..be6e121 100644
---- a/drivers/remoteproc/Kconfig
-+++ b/drivers/remoteproc/Kconfig
-@@ -6,6 +6,7 @@ config REMOTEPROC
- 	depends on HAS_DMA
- 	select FW_LOADER
- 	select VIRTIO
-+	select VIRTUALIZATION
- 
- config OMAP_REMOTEPROC
- 	tristate "OMAP remoteproc support"
-diff --git a/drivers/rpmsg/Kconfig b/drivers/rpmsg/Kconfig
-index f6e0ea6..69a2193 100644
---- a/drivers/rpmsg/Kconfig
-+++ b/drivers/rpmsg/Kconfig
-@@ -4,5 +4,6 @@ menu "Rpmsg drivers"
- config RPMSG
- 	tristate
- 	select VIRTIO
-+	select VIRTUALIZATION
- 
- endmenu
-diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
-index 01443ce..13ddec9 100644
---- a/fs/autofs4/expire.c
-+++ b/fs/autofs4/expire.c
-@@ -61,15 +61,6 @@ static int autofs4_mount_busy(struct vfsmount *mnt, struct dentry *dentry)
- 		/* This is an autofs submount, we can't expire it */
- 		if (autofs_type_indirect(sbi->type))
- 			goto done;
--
--		/*
--		 * Otherwise it's an offset mount and we need to check
--		 * if we can umount its mount, if there is one.
--		 */
--		if (!d_mountpoint(path.dentry)) {
--			status = 0;
--			goto done;
--		}
- 	}
- 
- 	/* Update the expiry counter if fs is busy */
-diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
-index b7a0641..116abec 100644
---- a/fs/btrfs/delayed-ref.c
-+++ b/fs/btrfs/delayed-ref.c
-@@ -40,16 +40,19 @@ struct kmem_cache *btrfs_delayed_extent_op_cachep;
-  * compare two delayed tree backrefs with same bytenr and type
-  */
- static int comp_tree_refs(struct btrfs_delayed_tree_ref *ref2,
--			  struct btrfs_delayed_tree_ref *ref1)
-+			  struct btrfs_delayed_tree_ref *ref1, int type)
- {
--	if (ref1->root < ref2->root)
--		return -1;
--	if (ref1->root > ref2->root)
--		return 1;
--	if (ref1->parent < ref2->parent)
--		return -1;
--	if (ref1->parent > ref2->parent)
--		return 1;
-+	if (type == BTRFS_TREE_BLOCK_REF_KEY) {
-+		if (ref1->root < ref2->root)
-+			return -1;
-+		if (ref1->root > ref2->root)
-+			return 1;
-+	} else {
-+		if (ref1->parent < ref2->parent)
-+			return -1;
-+		if (ref1->parent > ref2->parent)
-+			return 1;
-+	}
- 	return 0;
- }
- 
-@@ -113,7 +116,8 @@ static int comp_entry(struct btrfs_delayed_ref_node *ref2,
- 	if (ref1->type == BTRFS_TREE_BLOCK_REF_KEY ||
- 	    ref1->type == BTRFS_SHARED_BLOCK_REF_KEY) {
- 		return comp_tree_refs(btrfs_delayed_node_to_tree_ref(ref2),
--				      btrfs_delayed_node_to_tree_ref(ref1));
-+				      btrfs_delayed_node_to_tree_ref(ref1),
-+				      ref1->type);
- 	} else if (ref1->type == BTRFS_EXTENT_DATA_REF_KEY ||
- 		   ref1->type == BTRFS_SHARED_DATA_REF_KEY) {
- 		return comp_data_refs(btrfs_delayed_node_to_data_ref(ref2),
-diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
-index 09c58a3..cc6ce3e 100644
---- a/fs/btrfs/inode.c
-+++ b/fs/btrfs/inode.c
-@@ -6502,7 +6502,9 @@ out:
-  * block must be cow'd
-  */
- static noinline int can_nocow_odirect(struct btrfs_trans_handle *trans,
--				      struct inode *inode, u64 offset, u64 len)
-+				      struct inode *inode, u64 offset, u64 *len,
-+				      u64 *orig_start, u64 *orig_block_len,
-+				      u64 *ram_bytes)
- {
- 	struct btrfs_path *path;
- 	int ret;
-@@ -6559,8 +6561,12 @@ static noinline int can_nocow_odirect(struct btrfs_trans_handle *trans,
- 	disk_bytenr = btrfs_file_extent_disk_bytenr(leaf, fi);
- 	backref_offset = btrfs_file_extent_offset(leaf, fi);
- 
-+	*orig_start = key.offset - backref_offset;
-+	*orig_block_len = btrfs_file_extent_disk_num_bytes(leaf, fi);
-+	*ram_bytes = btrfs_file_extent_ram_bytes(leaf, fi);
-+
- 	extent_end = key.offset + btrfs_file_extent_num_bytes(leaf, fi);
--	if (extent_end < offset + len) {
-+	if (extent_end < offset + *len) {
- 		/* extent doesn't include our full range, must cow */
- 		goto out;
- 	}
-@@ -6584,13 +6590,14 @@ static noinline int can_nocow_odirect(struct btrfs_trans_handle *trans,
- 	 */
- 	disk_bytenr += backref_offset;
- 	disk_bytenr += offset - key.offset;
--	num_bytes = min(offset + len, extent_end) - offset;
-+	num_bytes = min(offset + *len, extent_end) - offset;
- 	if (csum_exist_in_range(root, disk_bytenr, num_bytes))
- 				goto out;
- 	/*
- 	 * all of the above have passed, it is safe to overwrite this extent
- 	 * without cow
- 	 */
-+	*len = num_bytes;
- 	ret = 1;
- out:
- 	btrfs_free_path(path);
-@@ -6789,7 +6796,7 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
- 	     em->block_start != EXTENT_MAP_HOLE)) {
- 		int type;
- 		int ret;
--		u64 block_start;
-+		u64 block_start, orig_start, orig_block_len, ram_bytes;
- 
- 		if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
- 			type = BTRFS_ORDERED_PREALLOC;
-@@ -6807,10 +6814,8 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
- 		if (IS_ERR(trans))
- 			goto must_cow;
- 
--		if (can_nocow_odirect(trans, inode, start, len) == 1) {
--			u64 orig_start = em->orig_start;
--			u64 orig_block_len = em->orig_block_len;
--
-+		if (can_nocow_odirect(trans, inode, start, &len, &orig_start,
-+				      &orig_block_len, &ram_bytes) == 1) {
- 			if (type == BTRFS_ORDERED_PREALLOC) {
- 				free_extent_map(em);
- 				em = create_pinned_em(inode, start, len,
-diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
-index 1357260..3beae6a 100644
---- a/fs/ext4/resize.c
-+++ b/fs/ext4/resize.c
-@@ -1882,6 +1882,10 @@ retry:
- 		return 0;
- 
- 	ext4_get_group_no_and_offset(sb, n_blocks_count - 1, &n_group, &offset);
-+	if (n_group > (0xFFFFFFFFUL / EXT4_INODES_PER_GROUP(sb))) {
-+		ext4_warning(sb, "resize would cause inodes_count overflow");
-+		return -EINVAL;
-+	}
- 	ext4_get_group_no_and_offset(sb, o_blocks_count - 1, &o_group, &offset);
- 
- 	n_desc_blocks = num_desc_blocks(sb, n_group + 1);
-diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
-index 523464e..a3f868a 100644
---- a/fs/hugetlbfs/inode.c
-+++ b/fs/hugetlbfs/inode.c
-@@ -909,11 +909,8 @@ static int can_do_hugetlb_shm(void)
- 
- static int get_hstate_idx(int page_size_log)
- {
--	struct hstate *h;
-+	struct hstate *h = hstate_sizelog(page_size_log);
- 
--	if (!page_size_log)
--		return default_hstate_idx;
--	h = size_to_hstate(1 << page_size_log);
- 	if (!h)
- 		return -1;
- 	return h - hstates;
-@@ -929,9 +926,12 @@ static struct dentry_operations anon_ops = {
- 	.d_dname = hugetlb_dname
- };
- 
--struct file *hugetlb_file_setup(const char *name, unsigned long addr,
--				size_t size, vm_flags_t acctflag,
--				struct user_struct **user,
-+/*
-+ * Note that size should be aligned to proper hugepage size in caller side,
-+ * otherwise hugetlb_reserve_pages reserves one less hugepages than intended.
-+ */
-+struct file *hugetlb_file_setup(const char *name, size_t size,
-+				vm_flags_t acctflag, struct user_struct **user,
- 				int creat_flags, int page_size_log)
- {
- 	struct file *file = ERR_PTR(-ENOMEM);
-@@ -939,8 +939,6 @@ struct file *hugetlb_file_setup(const char *name, unsigned long addr,
- 	struct path path;
- 	struct super_block *sb;
- 	struct qstr quick_string;
--	struct hstate *hstate;
--	unsigned long num_pages;
- 	int hstate_idx;
- 
- 	hstate_idx = get_hstate_idx(page_size_log);
-@@ -980,12 +978,10 @@ struct file *hugetlb_file_setup(const char *name, unsigned long addr,
- 	if (!inode)
- 		goto out_dentry;
- 
--	hstate = hstate_inode(inode);
--	size += addr & ~huge_page_mask(hstate);
--	num_pages = ALIGN(size, huge_page_size(hstate)) >>
--			huge_page_shift(hstate);
- 	file = ERR_PTR(-ENOMEM);
--	if (hugetlb_reserve_pages(inode, 0, num_pages, NULL, acctflag))
-+	if (hugetlb_reserve_pages(inode, 0,
-+			size >> huge_page_shift(hstate_inode(inode)), NULL,
-+			acctflag))
- 		goto out_inode;
- 
- 	d_instantiate(path.dentry, inode);
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index c7856a1..0086401 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -4553,9 +4553,9 @@ static int nfs4_proc_unlck(struct nfs4_state *state, int cmd, struct file_lock *
- 	if (status != 0)
- 		goto out;
- 	/* Is this a delegated lock? */
--	if (test_bit(NFS_DELEGATED_STATE, &state->flags))
--		goto out;
- 	lsp = request->fl_u.nfs4_fl.owner;
-+	if (test_bit(NFS_LOCK_INITIALIZED, &lsp->ls_flags) == 0)
-+		goto out;
- 	seqid = nfs_alloc_seqid(&lsp->ls_seqid, GFP_KERNEL);
- 	status = -ENOMEM;
- 	if (seqid == NULL)
-diff --git a/include/drm/drmP.h b/include/drm/drmP.h
-index 2d94d74..f1ce786 100644
---- a/include/drm/drmP.h
-+++ b/include/drm/drmP.h
-@@ -1593,9 +1593,8 @@ extern void drm_prime_gem_destroy(struct drm_gem_object *obj, struct sg_table *s
- 
- void drm_prime_init_file_private(struct drm_prime_file_private *prime_fpriv);
- void drm_prime_destroy_file_private(struct drm_prime_file_private *prime_fpriv);
--int drm_prime_add_imported_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf, uint32_t handle);
--int drm_prime_lookup_imported_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf, uint32_t *handle);
--void drm_prime_remove_imported_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf);
-+int drm_prime_lookup_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf, uint32_t *handle);
-+void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf);
- 
- int drm_prime_add_dma_buf(struct drm_device *dev, struct drm_gem_object *obj);
- int drm_prime_lookup_obj(struct drm_device *dev, struct dma_buf *buf,
-diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
-index 918e8fe..c2af598 100644
---- a/include/drm/drm_pciids.h
-+++ b/include/drm/drm_pciids.h
-@@ -240,6 +240,7 @@
- 	{0x1002, 0x6819, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6820, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6821, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-+	{0x1002, 0x6822, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6823, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6824, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6825, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-@@ -247,11 +248,13 @@
- 	{0x1002, 0x6827, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6828, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6829, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
-+	{0x1002, 0x682A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x682B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x682D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x682F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6830, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6831, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-+	{0x1002, 0x6835, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6837, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6838, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
- 	{0x1002, 0x6839, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
-@@ -603,6 +606,8 @@
- 	{0x1002, 0x9999, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- 	{0x1002, 0x999A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- 	{0x1002, 0x999B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-+	{0x1002, 0x999C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-+	{0x1002, 0x999D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- 	{0x1002, 0x99A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- 	{0x1002, 0x99A2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- 	{0x1002, 0x99A4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
-index 78feda9..33f358f 100644
---- a/include/linux/blkdev.h
-+++ b/include/linux/blkdev.h
-@@ -838,7 +838,7 @@ static inline unsigned int blk_queue_get_max_sectors(struct request_queue *q,
- 						     unsigned int cmd_flags)
- {
- 	if (unlikely(cmd_flags & REQ_DISCARD))
--		return q->limits.max_discard_sectors;
-+		return min(q->limits.max_discard_sectors, UINT_MAX >> 9);
- 
- 	if (unlikely(cmd_flags & REQ_WRITE_SAME))
- 		return q->limits.max_write_same_sectors;
-diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
-index 16e4e9a..df1ff7c 100644
---- a/include/linux/hugetlb.h
-+++ b/include/linux/hugetlb.h
-@@ -185,8 +185,7 @@ static inline struct hugetlbfs_sb_info *HUGETLBFS_SB(struct super_block *sb)
- 
- extern const struct file_operations hugetlbfs_file_operations;
- extern const struct vm_operations_struct hugetlb_vm_ops;
--struct file *hugetlb_file_setup(const char *name, unsigned long addr,
--				size_t size, vm_flags_t acct,
-+struct file *hugetlb_file_setup(const char *name, size_t size, vm_flags_t acct,
- 				struct user_struct **user, int creat_flags,
- 				int page_size_log);
- 
-@@ -205,8 +204,8 @@ static inline int is_file_hugepages(struct file *file)
- 
- #define is_file_hugepages(file)			0
- static inline struct file *
--hugetlb_file_setup(const char *name, unsigned long addr, size_t size,
--		vm_flags_t acctflag, struct user_struct **user, int creat_flags,
-+hugetlb_file_setup(const char *name, size_t size, vm_flags_t acctflag,
-+		struct user_struct **user, int creat_flags,
- 		int page_size_log)
- {
- 	return ERR_PTR(-ENOSYS);
-@@ -284,6 +283,13 @@ static inline struct hstate *hstate_file(struct file *f)
- 	return hstate_inode(file_inode(f));
- }
- 
-+static inline struct hstate *hstate_sizelog(int page_size_log)
-+{
-+	if (!page_size_log)
-+		return &default_hstate;
-+	return size_to_hstate(1 << page_size_log);
-+}
-+
- static inline struct hstate *hstate_vma(struct vm_area_struct *vma)
- {
- 	return hstate_file(vma->vm_file);
-@@ -348,11 +354,12 @@ static inline int hstate_index(struct hstate *h)
- 	return h - hstates;
- }
- 
--#else
-+#else	/* CONFIG_HUGETLB_PAGE */
- struct hstate {};
- #define alloc_huge_page_node(h, nid) NULL
- #define alloc_bootmem_huge_page(h) NULL
- #define hstate_file(f) NULL
-+#define hstate_sizelog(s) NULL
- #define hstate_vma(v) NULL
- #define hstate_inode(i) NULL
- #define huge_page_size(h) PAGE_SIZE
-@@ -367,6 +374,6 @@ static inline unsigned int pages_per_huge_page(struct hstate *h)
- }
- #define hstate_index_to_shift(index) 0
- #define hstate_index(h) 0
--#endif
-+#endif	/* CONFIG_HUGETLB_PAGE */
- 
- #endif /* _LINUX_HUGETLB_H */
-diff --git a/ipc/shm.c b/ipc/shm.c
-index 8247c49..34af1fe 100644
---- a/ipc/shm.c
-+++ b/ipc/shm.c
-@@ -491,10 +491,14 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
- 
- 	sprintf (name, "SYSV%08x", key);
- 	if (shmflg & SHM_HUGETLB) {
-+		struct hstate *hs = hstate_sizelog((shmflg >> SHM_HUGE_SHIFT)
-+						& SHM_HUGE_MASK);
-+		size_t hugesize = ALIGN(size, huge_page_size(hs));
-+
- 		/* hugetlb_file_setup applies strict accounting */
- 		if (shmflg & SHM_NORESERVE)
- 			acctflag = VM_NORESERVE;
--		file = hugetlb_file_setup(name, 0, size, acctflag,
-+		file = hugetlb_file_setup(name, hugesize, acctflag,
- 				  &shp->mlock_user, HUGETLB_SHMFS_INODE,
- 				(shmflg >> SHM_HUGE_SHIFT) & SHM_HUGE_MASK);
- 	} else {
-diff --git a/kernel/Makefile b/kernel/Makefile
-index bbde5f1..5a51e6c 100644
---- a/kernel/Makefile
-+++ b/kernel/Makefile
-@@ -175,7 +175,7 @@ signing_key.priv signing_key.x509: x509.genkey
- 	openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
- 		-batch -x509 -config x509.genkey \
- 		-outform DER -out signing_key.x509 \
--		-keyout signing_key.priv
-+		-keyout signing_key.priv 2>&1
- 	@echo "###"
- 	@echo "### Key pair generated."
- 	@echo "###"
-diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
-index 642a89c..a291aa2 100644
---- a/kernel/audit_tree.c
-+++ b/kernel/audit_tree.c
-@@ -617,9 +617,9 @@ void audit_trim_trees(void)
- 		}
- 		spin_unlock(&hash_lock);
- 		trim_marked(tree);
--		put_tree(tree);
- 		drop_collected_mounts(root_mnt);
- skip_it:
-+		put_tree(tree);
- 		mutex_lock(&audit_filter_mutex);
- 	}
- 	list_del(&cursor);
-diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index 7713d1b..3f28192 100644
---- a/kernel/trace/trace.c
-+++ b/kernel/trace/trace.c
-@@ -5168,36 +5168,32 @@ void trace_init_global_iter(struct trace_iterator *iter)
- 	iter->cpu_file = TRACE_PIPE_ALL_CPU;
- }
- 
--static void
--__ftrace_dump(bool disable_tracing, enum ftrace_dump_mode oops_dump_mode)
-+void ftrace_dump(enum ftrace_dump_mode oops_dump_mode)
- {
--	static arch_spinlock_t ftrace_dump_lock =
--		(arch_spinlock_t)__ARCH_SPIN_LOCK_UNLOCKED;
- 	/* use static because iter can be a bit big for the stack */
- 	static struct trace_iterator iter;
-+	static atomic_t dump_running;
- 	unsigned int old_userobj;
--	static int dump_ran;
- 	unsigned long flags;
- 	int cnt = 0, cpu;
- 
--	/* only one dump */
--	local_irq_save(flags);
--	arch_spin_lock(&ftrace_dump_lock);
--	if (dump_ran)
--		goto out;
--
--	dump_ran = 1;
-+	/* Only allow one dump user at a time. */
-+	if (atomic_inc_return(&dump_running) != 1) {
-+		atomic_dec(&dump_running);
-+		return;
-+	}
- 
-+	/*
-+	 * Always turn off tracing when we dump.
-+	 * We don't need to show trace output of what happens
-+	 * between multiple crashes.
-+	 *
-+	 * If the user does a sysrq-z, then they can re-enable
-+	 * tracing with echo 1 > tracing_on.
-+	 */
- 	tracing_off();
- 
--	/* Did function tracer already get disabled? */
--	if (ftrace_is_dead()) {
--		printk("# WARNING: FUNCTION TRACING IS CORRUPTED\n");
--		printk("#          MAY BE MISSING FUNCTION EVENTS\n");
--	}
--
--	if (disable_tracing)
--		ftrace_kill();
-+	local_irq_save(flags);
- 
- 	/* Simulate the iterator */
- 	trace_init_global_iter(&iter);
-@@ -5227,6 +5223,12 @@ __ftrace_dump(bool disable_tracing, enum ftrace_dump_mode oops_dump_mode)
- 
- 	printk(KERN_TRACE "Dumping ftrace buffer:\n");
- 
-+	/* Did function tracer already get disabled? */
-+	if (ftrace_is_dead()) {
-+		printk("# WARNING: FUNCTION TRACING IS CORRUPTED\n");
-+		printk("#          MAY BE MISSING FUNCTION EVENTS\n");
-+	}
-+
- 	/*
- 	 * We need to stop all tracing on all CPUS to read the
- 	 * the next buffer. This is a bit expensive, but is
-@@ -5266,26 +5268,14 @@ __ftrace_dump(bool disable_tracing, enum ftrace_dump_mode oops_dump_mode)
- 		printk(KERN_TRACE "---------------------------------\n");
- 
-  out_enable:
--	/* Re-enable tracing if requested */
--	if (!disable_tracing) {
--		trace_flags |= old_userobj;
-+	trace_flags |= old_userobj;
- 
--		for_each_tracing_cpu(cpu) {
--			atomic_dec(&iter.tr->data[cpu]->disabled);
--		}
--		tracing_on();
-+	for_each_tracing_cpu(cpu) {
-+		atomic_dec(&iter.tr->data[cpu]->disabled);
- 	}
--
-- out:
--	arch_spin_unlock(&ftrace_dump_lock);
-+ 	atomic_dec(&dump_running);
- 	local_irq_restore(flags);
- }
--
--/* By default: disable tracing after the dump */
--void ftrace_dump(enum ftrace_dump_mode oops_dump_mode)
--{
--	__ftrace_dump(true, oops_dump_mode);
--}
- EXPORT_SYMBOL_GPL(ftrace_dump);
- 
- __init static int tracer_alloc_buffers(void)
-diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c
-index 51c819c..eedc297 100644
---- a/kernel/trace/trace_selftest.c
-+++ b/kernel/trace/trace_selftest.c
-@@ -703,8 +703,6 @@ trace_selftest_startup_function(struct tracer *trace, struct trace_array *tr)
- /* Maximum number of functions to trace before diagnosing a hang */
- #define GRAPH_MAX_FUNC_TEST	100000000
- 
--static void
--__ftrace_dump(bool disable_tracing, enum ftrace_dump_mode oops_dump_mode);
- static unsigned int graph_hang_thresh;
- 
- /* Wrap the real function entry probe to avoid possible hanging */
-@@ -714,8 +712,11 @@ static int trace_graph_entry_watchdog(struct ftrace_graph_ent *trace)
- 	if (unlikely(++graph_hang_thresh > GRAPH_MAX_FUNC_TEST)) {
- 		ftrace_graph_stop();
- 		printk(KERN_WARNING "BUG: Function graph tracer hang!\n");
--		if (ftrace_dump_on_oops)
--			__ftrace_dump(false, DUMP_ALL);
-+		if (ftrace_dump_on_oops) {
-+			ftrace_dump(DUMP_ALL);
-+			/* ftrace_dump() disables tracing */
-+			tracing_on();
-+		}
- 		return 0;
- 	}
- 
-diff --git a/mm/mmap.c b/mm/mmap.c
-index 033094b..e17fc06 100644
---- a/mm/mmap.c
-+++ b/mm/mmap.c
-@@ -1327,15 +1327,20 @@ SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len,
- 		file = fget(fd);
- 		if (!file)
- 			goto out;
-+		if (is_file_hugepages(file))
-+			len = ALIGN(len, huge_page_size(hstate_file(file)));
- 	} else if (flags & MAP_HUGETLB) {
- 		struct user_struct *user = NULL;
-+
-+		len = ALIGN(len, huge_page_size(hstate_sizelog(
-+			(flags >> MAP_HUGE_SHIFT) & MAP_HUGE_MASK)));
- 		/*
- 		 * VM_NORESERVE is used because the reservations will be
- 		 * taken when vm_ops->mmap() is called
- 		 * A dummy user value is used because we are not locking
- 		 * memory so no accounting is necessary
- 		 */
--		file = hugetlb_file_setup(HUGETLB_ANON_FILE, addr, len,
-+		file = hugetlb_file_setup(HUGETLB_ANON_FILE, len,
- 				VM_NORESERVE,
- 				&user, HUGETLB_ANONHUGE_INODE,
- 				(flags >> MAP_HUGE_SHIFT) & MAP_HUGE_MASK);
-diff --git a/net/netfilter/ipvs/ip_vs_pe_sip.c b/net/netfilter/ipvs/ip_vs_pe_sip.c
-index 12475ef..e5920fb 100644
---- a/net/netfilter/ipvs/ip_vs_pe_sip.c
-+++ b/net/netfilter/ipvs/ip_vs_pe_sip.c
-@@ -37,14 +37,10 @@ static int get_callid(const char *dptr, unsigned int dataoff,
- 		if (ret > 0)
- 			break;
- 		if (!ret)
--			return 0;
-+			return -EINVAL;
- 		dataoff += *matchoff;
- 	}
- 
--	/* Empty callid is useless */
--	if (!*matchlen)
--		return -EINVAL;
--
- 	/* Too large is useless */
- 	if (*matchlen > IP_VS_PEDATA_MAXLEN)
- 		return -EINVAL;
-diff --git a/scripts/kconfig/list.h b/scripts/kconfig/list.h
-index 0ae730b..b87206c 100644
---- a/scripts/kconfig/list.h
-+++ b/scripts/kconfig/list.h
-@@ -51,6 +51,19 @@ struct list_head {
- 	     pos = list_entry(pos->member.next, typeof(*pos), member))
- 
- /**
-+ * list_for_each_entry_safe - iterate over list of given type safe against removal of list entry
-+ * @pos:	the type * to use as a loop cursor.
-+ * @n:		another type * to use as temporary storage
-+ * @head:	the head for your list.
-+ * @member:	the name of the list_struct within the struct.
-+ */
-+#define list_for_each_entry_safe(pos, n, head, member)			\
-+	for (pos = list_entry((head)->next, typeof(*pos), member),	\
-+		n = list_entry(pos->member.next, typeof(*pos), member);	\
-+	     &pos->member != (head);					\
-+	     pos = n, n = list_entry(n->member.next, typeof(*n), member))
-+
-+/**
-  * list_empty - tests whether a list is empty
-  * @head: the list to test.
-  */
-diff --git a/scripts/kconfig/mconf.c b/scripts/kconfig/mconf.c
-index 566288a..c5418d6 100644
---- a/scripts/kconfig/mconf.c
-+++ b/scripts/kconfig/mconf.c
-@@ -389,6 +389,7 @@ again:
- 			.targets = targets,
- 			.keys = keys,
- 		};
-+		struct jump_key *pos, *tmp;
- 
- 		res = get_relations_str(sym_arr, &head);
- 		dres = show_textbox_ext(_("Search Results"), (char *)
-@@ -402,6 +403,8 @@ again:
- 				again = true;
- 			}
- 		str_free(&res);
-+		list_for_each_entry_safe(pos, tmp, &head, entries)
-+			free(pos);
- 	} while (again);
- 	free(sym_arr);
- 	str_free(&title);

Deleted: genpatches-2.6/trunk/3.10/1002_linux-3.9.3.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1002_linux-3.9.3.patch	2013-05-21 00:40:11 UTC (rev 2385)
+++ genpatches-2.6/trunk/3.10/1002_linux-3.9.3.patch	2013-05-21 00:44:32 UTC (rev 2386)
@@ -1,3755 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 3e71511..01003d4 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 9
--SUBLEVEL = 2
-+SUBLEVEL = 3
- EXTRAVERSION =
- NAME = Unicycling Gorilla
- 
-diff --git a/arch/arm/include/asm/cmpxchg.h b/arch/arm/include/asm/cmpxchg.h
-index 7eb18c1..4f009c1 100644
---- a/arch/arm/include/asm/cmpxchg.h
-+++ b/arch/arm/include/asm/cmpxchg.h
-@@ -233,15 +233,15 @@ static inline unsigned long __cmpxchg_local(volatile void *ptr,
- 	((__typeof__(*(ptr)))atomic64_cmpxchg(container_of((ptr),	\
- 						atomic64_t,		\
- 						counter),		\
--					      (unsigned long)(o),	\
--					      (unsigned long)(n)))
-+					      (unsigned long long)(o),	\
-+					      (unsigned long long)(n)))
- 
- #define cmpxchg64_local(ptr, o, n)					\
- 	((__typeof__(*(ptr)))local64_cmpxchg(container_of((ptr),	\
- 						local64_t,		\
- 						a),			\
--					     (unsigned long)(o),	\
--					     (unsigned long)(n)))
-+					     (unsigned long long)(o),	\
-+					     (unsigned long long)(n)))
- 
- #endif	/* __LINUX_ARM_ARCH__ >= 6 */
- 
-diff --git a/arch/arm/mach-exynos/include/mach/regs-pmu.h b/arch/arm/mach-exynos/include/mach/regs-pmu.h
-index 3f30aa1..57344b7 100644
---- a/arch/arm/mach-exynos/include/mach/regs-pmu.h
-+++ b/arch/arm/mach-exynos/include/mach/regs-pmu.h
-@@ -344,6 +344,7 @@
- #define EXYNOS5_FSYS_ARM_OPTION					S5P_PMUREG(0x2208)
- #define EXYNOS5_ISP_ARM_OPTION					S5P_PMUREG(0x2288)
- #define EXYNOS5_ARM_COMMON_OPTION				S5P_PMUREG(0x2408)
-+#define EXYNOS5_ARM_L2_OPTION					S5P_PMUREG(0x2608)
- #define EXYNOS5_TOP_PWR_OPTION					S5P_PMUREG(0x2C48)
- #define EXYNOS5_TOP_PWR_SYSMEM_OPTION				S5P_PMUREG(0x2CC8)
- #define EXYNOS5_JPEG_MEM_OPTION					S5P_PMUREG(0x2F48)
-diff --git a/arch/arm/mach-exynos/pmu.c b/arch/arm/mach-exynos/pmu.c
-index daebc1a..97d6885 100644
---- a/arch/arm/mach-exynos/pmu.c
-+++ b/arch/arm/mach-exynos/pmu.c
-@@ -228,6 +228,7 @@ static struct exynos_pmu_conf exynos5250_pmu_config[] = {
- 	{ EXYNOS5_DIS_IRQ_ISP_ARM_CENTRAL_SYS_PWR_REG,	{ 0x0, 0x0, 0x0} },
- 	{ EXYNOS5_ARM_COMMON_SYS_PWR_REG,		{ 0x0, 0x0, 0x2} },
- 	{ EXYNOS5_ARM_L2_SYS_PWR_REG,			{ 0x3, 0x3, 0x3} },
-+	{ EXYNOS5_ARM_L2_OPTION,			{ 0x10, 0x10, 0x0 } },
- 	{ EXYNOS5_CMU_ACLKSTOP_SYS_PWR_REG,		{ 0x1, 0x0, 0x1} },
- 	{ EXYNOS5_CMU_SCLKSTOP_SYS_PWR_REG,		{ 0x1, 0x0, 0x1} },
- 	{ EXYNOS5_CMU_RESET_SYS_PWR_REG,		{ 0x1, 0x1, 0x0} },
-@@ -353,11 +354,9 @@ static void exynos5_init_pmu(void)
- 
- 	/*
- 	 * SKIP_DEACTIVATE_ACEACP_IN_PWDN_BITFIELD Enable
--	 * MANUAL_L2RSTDISABLE_CONTROL_BITFIELD Enable
- 	 */
- 	tmp = __raw_readl(EXYNOS5_ARM_COMMON_OPTION);
--	tmp |= (EXYNOS5_MANUAL_L2RSTDISABLE_CONTROL |
--		EXYNOS5_SKIP_DEACTIVATE_ACEACP_IN_PWDN);
-+	tmp |= EXYNOS5_SKIP_DEACTIVATE_ACEACP_IN_PWDN;
- 	__raw_writel(tmp, EXYNOS5_ARM_COMMON_OPTION);
- 
- 	/*
-diff --git a/arch/arm/mach-omap2/board-rx51-peripherals.c b/arch/arm/mach-omap2/board-rx51-peripherals.c
-index 3a077df..9bc9f19 100644
---- a/arch/arm/mach-omap2/board-rx51-peripherals.c
-+++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
-@@ -73,11 +73,11 @@
- #define LIS302_IRQ1_GPIO 181
- #define LIS302_IRQ2_GPIO 180  /* Not yet in use */
- 
--/* list all spi devices here */
-+/* List all SPI devices here. Note that the list/probe order seems to matter! */
- enum {
- 	RX51_SPI_WL1251,
--	RX51_SPI_MIPID,		/* LCD panel */
- 	RX51_SPI_TSC2005,	/* Touch Controller */
-+	RX51_SPI_MIPID,		/* LCD panel */
- };
- 
- static struct wl12xx_platform_data wl1251_pdata;
-diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
-index 113e282..1976900 100644
---- a/arch/parisc/Makefile
-+++ b/arch/parisc/Makefile
-@@ -23,26 +23,21 @@ NM		= sh $(srctree)/arch/parisc/nm
- CHECKFLAGS	+= -D__hppa__=1
- LIBGCC		= $(shell $(CC) $(KBUILD_CFLAGS) -print-libgcc-file-name)
- 
--MACHINE		:= $(shell uname -m)
--ifeq ($(MACHINE),parisc*)
--NATIVE		:= 1
--endif
--
- ifdef CONFIG_64BIT
- UTS_MACHINE	:= parisc64
- CHECKFLAGS	+= -D__LP64__=1 -m64
--WIDTH		:= 64
-+CC_ARCHES	= hppa64
- else # 32-bit
--WIDTH		:=
-+CC_ARCHES	= hppa hppa2.0 hppa1.1
- endif
- 
--# attempt to help out folks who are cross-compiling
--ifeq ($(NATIVE),1)
--CROSS_COMPILE	:= hppa$(WIDTH)-linux-
--else
-- ifeq ($(CROSS_COMPILE),)
-- CROSS_COMPILE	:= hppa$(WIDTH)-linux-gnu-
-- endif
-+ifneq ($(SUBARCH),$(UTS_MACHINE))
-+	ifeq ($(CROSS_COMPILE),)
-+		CC_SUFFIXES = linux linux-gnu unknown-linux-gnu
-+		CROSS_COMPILE := $(call cc-cross-prefix, \
-+			$(foreach a,$(CC_ARCHES), \
-+			$(foreach s,$(CC_SUFFIXES),$(a)-$(s)-)))
-+	endif
- endif
- 
- OBJCOPY_FLAGS =-O binary -R .note -R .comment -S
-diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
-index f33201b..897bce4 100644
---- a/arch/parisc/kernel/entry.S
-+++ b/arch/parisc/kernel/entry.S
-@@ -444,9 +444,41 @@
- 	L2_ptep		\pgd,\pte,\index,\va,\fault
- 	.endm
- 
-+	/* Acquire pa_dbit_lock lock. */
-+	.macro		dbit_lock	spc,tmp,tmp1
-+#ifdef CONFIG_SMP
-+	cmpib,COND(=),n	0,\spc,2f
-+	load32		PA(pa_dbit_lock),\tmp
-+1:	LDCW		0(\tmp),\tmp1
-+	cmpib,COND(=)	0,\tmp1,1b
-+	nop
-+2:
-+#endif
-+	.endm
-+
-+	/* Release pa_dbit_lock lock without reloading lock address. */
-+	.macro		dbit_unlock0	spc,tmp
-+#ifdef CONFIG_SMP
-+	or,COND(=)	%r0,\spc,%r0
-+	stw             \spc,0(\tmp)
-+#endif
-+	.endm
-+
-+	/* Release pa_dbit_lock lock. */
-+	.macro		dbit_unlock1	spc,tmp
-+#ifdef CONFIG_SMP
-+	load32		PA(pa_dbit_lock),\tmp
-+	dbit_unlock0	\spc,\tmp
-+#endif
-+	.endm
-+
- 	/* Set the _PAGE_ACCESSED bit of the PTE.  Be clever and
- 	 * don't needlessly dirty the cache line if it was already set */
--	.macro		update_ptep	ptep,pte,tmp,tmp1
-+	.macro		update_ptep	spc,ptep,pte,tmp,tmp1
-+#ifdef CONFIG_SMP
-+	or,COND(=)	%r0,\spc,%r0
-+	LDREG		0(\ptep),\pte
-+#endif
- 	ldi		_PAGE_ACCESSED,\tmp1
- 	or		\tmp1,\pte,\tmp
- 	and,COND(<>)	\tmp1,\pte,%r0
-@@ -455,7 +487,11 @@
- 
- 	/* Set the dirty bit (and accessed bit).  No need to be
- 	 * clever, this is only used from the dirty fault */
--	.macro		update_dirty	ptep,pte,tmp
-+	.macro		update_dirty	spc,ptep,pte,tmp
-+#ifdef CONFIG_SMP
-+	or,COND(=)	%r0,\spc,%r0
-+	LDREG		0(\ptep),\pte
-+#endif
- 	ldi		_PAGE_ACCESSED|_PAGE_DIRTY,\tmp
- 	or		\tmp,\pte,\pte
- 	STREG		\pte,0(\ptep)
-@@ -825,11 +861,6 @@ ENTRY(syscall_exit_rfi)
- 	STREG   %r19,PT_SR7(%r16)
- 
- intr_return:
--	/* NOTE: Need to enable interrupts incase we schedule. */
--	ssm     PSW_SM_I, %r0
--
--intr_check_resched:
--
- 	/* check for reschedule */
- 	mfctl   %cr30,%r1
- 	LDREG   TI_FLAGS(%r1),%r19	/* sched.h: TIF_NEED_RESCHED */
-@@ -856,6 +887,11 @@ intr_check_sig:
- 	LDREG	PT_IASQ1(%r16), %r20
- 	cmpib,COND(=),n 0,%r20,intr_restore /* backward */
- 
-+	/* NOTE: We need to enable interrupts if we have to deliver
-+	 * signals. We used to do this earlier but it caused kernel
-+	 * stack overflows. */
-+	ssm     PSW_SM_I, %r0
-+
- 	copy	%r0, %r25			/* long in_syscall = 0 */
- #ifdef CONFIG_64BIT
- 	ldo	-16(%r30),%r29			/* Reference param save area */
-@@ -907,6 +943,10 @@ intr_do_resched:
- 	cmpib,COND(=)	0, %r20, intr_do_preempt
- 	nop
- 
-+	/* NOTE: We need to enable interrupts if we schedule.  We used
-+	 * to do this earlier but it caused kernel stack overflows. */
-+	ssm     PSW_SM_I, %r0
-+
- #ifdef CONFIG_64BIT
- 	ldo	-16(%r30),%r29		/* Reference param save area */
- #endif
-@@ -1099,11 +1139,13 @@ dtlb_miss_20w:
- 
- 	L3_ptep		ptp,pte,t0,va,dtlb_check_alias_20w
- 
--	update_ptep	ptp,pte,t0,t1
-+	dbit_lock	spc,t0,t1
-+	update_ptep	spc,ptp,pte,t0,t1
- 
- 	make_insert_tlb	spc,pte,prot
- 	
- 	idtlbt          pte,prot
-+	dbit_unlock1	spc,t0
- 
- 	rfir
- 	nop
-@@ -1123,11 +1165,13 @@ nadtlb_miss_20w:
- 
- 	L3_ptep		ptp,pte,t0,va,nadtlb_check_alias_20w
- 
--	update_ptep	ptp,pte,t0,t1
-+	dbit_lock	spc,t0,t1
-+	update_ptep	spc,ptp,pte,t0,t1
- 
- 	make_insert_tlb	spc,pte,prot
- 
- 	idtlbt          pte,prot
-+	dbit_unlock1	spc,t0
- 
- 	rfir
- 	nop
-@@ -1149,7 +1193,8 @@ dtlb_miss_11:
- 
- 	L2_ptep		ptp,pte,t0,va,dtlb_check_alias_11
- 
--	update_ptep	ptp,pte,t0,t1
-+	dbit_lock	spc,t0,t1
-+	update_ptep	spc,ptp,pte,t0,t1
- 
- 	make_insert_tlb_11	spc,pte,prot
- 
-@@ -1160,6 +1205,7 @@ dtlb_miss_11:
- 	idtlbp		prot,(%sr1,va)
- 
- 	mtsp		t0, %sr1	/* Restore sr1 */
-+	dbit_unlock1	spc,t0
- 
- 	rfir
- 	nop
-@@ -1180,7 +1226,8 @@ nadtlb_miss_11:
- 
- 	L2_ptep		ptp,pte,t0,va,nadtlb_check_alias_11
- 
--	update_ptep	ptp,pte,t0,t1
-+	dbit_lock	spc,t0,t1
-+	update_ptep	spc,ptp,pte,t0,t1
- 
- 	make_insert_tlb_11	spc,pte,prot
- 
-@@ -1192,6 +1239,7 @@ nadtlb_miss_11:
- 	idtlbp		prot,(%sr1,va)
- 
- 	mtsp		t0, %sr1	/* Restore sr1 */
-+	dbit_unlock1	spc,t0
- 
- 	rfir
- 	nop
-@@ -1212,13 +1260,15 @@ dtlb_miss_20:
- 
- 	L2_ptep		ptp,pte,t0,va,dtlb_check_alias_20
- 
--	update_ptep	ptp,pte,t0,t1
-+	dbit_lock	spc,t0,t1
-+	update_ptep	spc,ptp,pte,t0,t1
- 
- 	make_insert_tlb	spc,pte,prot
- 
- 	f_extend	pte,t0
- 
- 	idtlbt          pte,prot
-+	dbit_unlock1	spc,t0
- 
- 	rfir
- 	nop
-@@ -1238,13 +1288,15 @@ nadtlb_miss_20:
- 
- 	L2_ptep		ptp,pte,t0,va,nadtlb_check_alias_20
- 
--	update_ptep	ptp,pte,t0,t1
-+	dbit_lock	spc,t0,t1
-+	update_ptep	spc,ptp,pte,t0,t1
- 
- 	make_insert_tlb	spc,pte,prot
- 
- 	f_extend	pte,t0
- 	
-         idtlbt          pte,prot
-+	dbit_unlock1	spc,t0
- 
- 	rfir
- 	nop
-@@ -1345,11 +1397,13 @@ itlb_miss_20w:
- 
- 	L3_ptep		ptp,pte,t0,va,itlb_fault
- 
--	update_ptep	ptp,pte,t0,t1
-+	dbit_lock	spc,t0,t1
-+	update_ptep	spc,ptp,pte,t0,t1
- 
- 	make_insert_tlb	spc,pte,prot
- 	
- 	iitlbt          pte,prot
-+	dbit_unlock1	spc,t0
- 
- 	rfir
- 	nop
-@@ -1367,11 +1421,13 @@ naitlb_miss_20w:
- 
- 	L3_ptep		ptp,pte,t0,va,naitlb_check_alias_20w
- 
--	update_ptep	ptp,pte,t0,t1
-+	dbit_lock	spc,t0,t1
-+	update_ptep	spc,ptp,pte,t0,t1
- 
- 	make_insert_tlb	spc,pte,prot
- 
- 	iitlbt          pte,prot
-+	dbit_unlock1	spc,t0
- 
- 	rfir
- 	nop
-@@ -1393,7 +1449,8 @@ itlb_miss_11:
- 
- 	L2_ptep		ptp,pte,t0,va,itlb_fault
- 
--	update_ptep	ptp,pte,t0,t1
-+	dbit_lock	spc,t0,t1
-+	update_ptep	spc,ptp,pte,t0,t1
- 
- 	make_insert_tlb_11	spc,pte,prot
- 
-@@ -1404,6 +1461,7 @@ itlb_miss_11:
- 	iitlbp		prot,(%sr1,va)
- 
- 	mtsp		t0, %sr1	/* Restore sr1 */
-+	dbit_unlock1	spc,t0
- 
- 	rfir
- 	nop
-@@ -1415,7 +1473,8 @@ naitlb_miss_11:
- 
- 	L2_ptep		ptp,pte,t0,va,naitlb_check_alias_11
- 
--	update_ptep	ptp,pte,t0,t1
-+	dbit_lock	spc,t0,t1
-+	update_ptep	spc,ptp,pte,t0,t1
- 
- 	make_insert_tlb_11	spc,pte,prot
- 
-@@ -1426,6 +1485,7 @@ naitlb_miss_11:
- 	iitlbp		prot,(%sr1,va)
- 
- 	mtsp		t0, %sr1	/* Restore sr1 */
-+	dbit_unlock1	spc,t0
- 
- 	rfir
- 	nop
-@@ -1447,13 +1507,15 @@ itlb_miss_20:
- 
- 	L2_ptep		ptp,pte,t0,va,itlb_fault
- 
--	update_ptep	ptp,pte,t0,t1
-+	dbit_lock	spc,t0,t1
-+	update_ptep	spc,ptp,pte,t0,t1
- 
- 	make_insert_tlb	spc,pte,prot
- 
- 	f_extend	pte,t0	
- 
- 	iitlbt          pte,prot
-+	dbit_unlock1	spc,t0
- 
- 	rfir
- 	nop
-@@ -1465,13 +1527,15 @@ naitlb_miss_20:
- 
- 	L2_ptep		ptp,pte,t0,va,naitlb_check_alias_20
- 
--	update_ptep	ptp,pte,t0,t1
-+	dbit_lock	spc,t0,t1
-+	update_ptep	spc,ptp,pte,t0,t1
- 
- 	make_insert_tlb	spc,pte,prot
- 
- 	f_extend	pte,t0
- 
- 	iitlbt          pte,prot
-+	dbit_unlock1	spc,t0
- 
- 	rfir
- 	nop
-@@ -1495,29 +1559,13 @@ dbit_trap_20w:
- 
- 	L3_ptep		ptp,pte,t0,va,dbit_fault
- 
--#ifdef CONFIG_SMP
--	cmpib,COND(=),n        0,spc,dbit_nolock_20w
--	load32		PA(pa_dbit_lock),t0
--
--dbit_spin_20w:
--	LDCW		0(t0),t1
--	cmpib,COND(=)         0,t1,dbit_spin_20w
--	nop
--
--dbit_nolock_20w:
--#endif
--	update_dirty	ptp,pte,t1
-+	dbit_lock	spc,t0,t1
-+	update_dirty	spc,ptp,pte,t1
- 
- 	make_insert_tlb	spc,pte,prot
- 		
- 	idtlbt          pte,prot
--#ifdef CONFIG_SMP
--	cmpib,COND(=),n        0,spc,dbit_nounlock_20w
--	ldi             1,t1
--	stw             t1,0(t0)
--
--dbit_nounlock_20w:
--#endif
-+	dbit_unlock0	spc,t0
- 
- 	rfir
- 	nop
-@@ -1531,18 +1579,8 @@ dbit_trap_11:
- 
- 	L2_ptep		ptp,pte,t0,va,dbit_fault
- 
--#ifdef CONFIG_SMP
--	cmpib,COND(=),n        0,spc,dbit_nolock_11
--	load32		PA(pa_dbit_lock),t0
--
--dbit_spin_11:
--	LDCW		0(t0),t1
--	cmpib,=         0,t1,dbit_spin_11
--	nop
--
--dbit_nolock_11:
--#endif
--	update_dirty	ptp,pte,t1
-+	dbit_lock	spc,t0,t1
-+	update_dirty	spc,ptp,pte,t1
- 
- 	make_insert_tlb_11	spc,pte,prot
- 
-@@ -1553,13 +1591,7 @@ dbit_nolock_11:
- 	idtlbp		prot,(%sr1,va)
- 
- 	mtsp            t1, %sr1     /* Restore sr1 */
--#ifdef CONFIG_SMP
--	cmpib,COND(=),n        0,spc,dbit_nounlock_11
--	ldi             1,t1
--	stw             t1,0(t0)
--
--dbit_nounlock_11:
--#endif
-+	dbit_unlock0	spc,t0
- 
- 	rfir
- 	nop
-@@ -1571,32 +1603,15 @@ dbit_trap_20:
- 
- 	L2_ptep		ptp,pte,t0,va,dbit_fault
- 
--#ifdef CONFIG_SMP
--	cmpib,COND(=),n        0,spc,dbit_nolock_20
--	load32		PA(pa_dbit_lock),t0
--
--dbit_spin_20:
--	LDCW		0(t0),t1
--	cmpib,=         0,t1,dbit_spin_20
--	nop
--
--dbit_nolock_20:
--#endif
--	update_dirty	ptp,pte,t1
-+	dbit_lock	spc,t0,t1
-+	update_dirty	spc,ptp,pte,t1
- 
- 	make_insert_tlb	spc,pte,prot
- 
- 	f_extend	pte,t1
- 	
-         idtlbt          pte,prot
--
--#ifdef CONFIG_SMP
--	cmpib,COND(=),n        0,spc,dbit_nounlock_20
--	ldi             1,t1
--	stw             t1,0(t0)
--
--dbit_nounlock_20:
--#endif
-+	dbit_unlock0	spc,t0
- 
- 	rfir
- 	nop
-@@ -1694,7 +1709,8 @@ ENTRY(sys_\name\()_wrapper)
- 	ldo	TASK_REGS(%r1),%r1
- 	reg_save %r1
- 	mfctl	%cr27, %r28
--	b	sys_\name
-+	ldil	L%sys_\name, %r31
-+	be	R%sys_\name(%sr4,%r31)
- 	STREG	%r28, PT_CR27(%r1)
- ENDPROC(sys_\name\()_wrapper)
- 	.endm
-diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h
-index aef00c6..ee38f29 100644
---- a/arch/powerpc/include/asm/rtas.h
-+++ b/arch/powerpc/include/asm/rtas.h
-@@ -262,6 +262,8 @@ extern void rtas_progress(char *s, unsigned short hex);
- extern void rtas_initialize(void);
- extern int rtas_suspend_cpu(struct rtas_suspend_me_data *data);
- extern int rtas_suspend_last_cpu(struct rtas_suspend_me_data *data);
-+extern int rtas_online_cpus_mask(cpumask_var_t cpus);
-+extern int rtas_offline_cpus_mask(cpumask_var_t cpus);
- extern int rtas_ibm_suspend_me(struct rtas_args *);
- 
- struct rtc_time;
-diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c
-index 466a290..611acdf 100644
---- a/arch/powerpc/kernel/machine_kexec_64.c
-+++ b/arch/powerpc/kernel/machine_kexec_64.c
-@@ -17,6 +17,7 @@
- #include <linux/errno.h>
- #include <linux/kernel.h>
- #include <linux/cpu.h>
-+#include <linux/hardirq.h>
- 
- #include <asm/page.h>
- #include <asm/current.h>
-@@ -335,10 +336,13 @@ void default_machine_kexec(struct kimage *image)
- 	pr_debug("kexec: Starting switchover sequence.\n");
- 
- 	/* switch to a staticly allocated stack.  Based on irq stack code.
-+	 * We setup preempt_count to avoid using VMX in memcpy.
- 	 * XXX: the task struct will likely be invalid once we do the copy!
- 	 */
- 	kexec_stack.thread_info.task = current_thread_info()->task;
- 	kexec_stack.thread_info.flags = 0;
-+	kexec_stack.thread_info.preempt_count = HARDIRQ_OFFSET;
-+	kexec_stack.thread_info.cpu = current_thread_info()->cpu;
- 
- 	/* We need a static PACA, too; copy this CPU's PACA over and switch to
- 	 * it.  Also poison per_cpu_offset to catch anyone using non-static
-diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
-index 1fd6e7b..52add6f 100644
---- a/arch/powerpc/kernel/rtas.c
-+++ b/arch/powerpc/kernel/rtas.c
-@@ -19,6 +19,7 @@
- #include <linux/init.h>
- #include <linux/capability.h>
- #include <linux/delay.h>
-+#include <linux/cpu.h>
- #include <linux/smp.h>
- #include <linux/completion.h>
- #include <linux/cpumask.h>
-@@ -807,6 +808,95 @@ static void rtas_percpu_suspend_me(void *info)
- 	__rtas_suspend_cpu((struct rtas_suspend_me_data *)info, 1);
- }
- 
-+enum rtas_cpu_state {
-+	DOWN,
-+	UP,
-+};
-+
-+#ifndef CONFIG_SMP
-+static int rtas_cpu_state_change_mask(enum rtas_cpu_state state,
-+				cpumask_var_t cpus)
-+{
-+	if (!cpumask_empty(cpus)) {
-+		cpumask_clear(cpus);
-+		return -EINVAL;
-+	} else
-+		return 0;
-+}
-+#else
-+/* On return cpumask will be altered to indicate CPUs changed.
-+ * CPUs with states changed will be set in the mask,
-+ * CPUs with status unchanged will be unset in the mask. */
-+static int rtas_cpu_state_change_mask(enum rtas_cpu_state state,
-+				cpumask_var_t cpus)
-+{
-+	int cpu;
-+	int cpuret = 0;
-+	int ret = 0;
-+
-+	if (cpumask_empty(cpus))
-+		return 0;
-+
-+	for_each_cpu(cpu, cpus) {
-+		switch (state) {
-+		case DOWN:
-+			cpuret = cpu_down(cpu);
-+			break;
-+		case UP:
-+			cpuret = cpu_up(cpu);
-+			break;
-+		}
-+		if (cpuret) {
-+			pr_debug("%s: cpu_%s for cpu#%d returned %d.\n",
-+					__func__,
-+					((state == UP) ? "up" : "down"),
-+					cpu, cpuret);
-+			if (!ret)
-+				ret = cpuret;
-+			if (state == UP) {
-+				/* clear bits for unchanged cpus, return */
-+				cpumask_shift_right(cpus, cpus, cpu);
-+				cpumask_shift_left(cpus, cpus, cpu);
-+				break;
-+			} else {
-+				/* clear bit for unchanged cpu, continue */
-+				cpumask_clear_cpu(cpu, cpus);
-+			}
-+		}
-+	}
-+
-+	return ret;
-+}
-+#endif
-+
-+int rtas_online_cpus_mask(cpumask_var_t cpus)
-+{
-+	int ret;
-+
-+	ret = rtas_cpu_state_change_mask(UP, cpus);
-+
-+	if (ret) {
-+		cpumask_var_t tmp_mask;
-+
-+		if (!alloc_cpumask_var(&tmp_mask, GFP_TEMPORARY))
-+			return ret;
-+
-+		/* Use tmp_mask to preserve cpus mask from first failure */
-+		cpumask_copy(tmp_mask, cpus);
-+		rtas_offline_cpus_mask(tmp_mask);
-+		free_cpumask_var(tmp_mask);
-+	}
-+
-+	return ret;
-+}
-+EXPORT_SYMBOL(rtas_online_cpus_mask);
-+
-+int rtas_offline_cpus_mask(cpumask_var_t cpus)
-+{
-+	return rtas_cpu_state_change_mask(DOWN, cpus);
-+}
-+EXPORT_SYMBOL(rtas_offline_cpus_mask);
-+
- int rtas_ibm_suspend_me(struct rtas_args *args)
- {
- 	long state;
-@@ -814,6 +904,8 @@ int rtas_ibm_suspend_me(struct rtas_args *args)
- 	unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
- 	struct rtas_suspend_me_data data;
- 	DECLARE_COMPLETION_ONSTACK(done);
-+	cpumask_var_t offline_mask;
-+	int cpuret;
- 
- 	if (!rtas_service_present("ibm,suspend-me"))
- 		return -ENOSYS;
-@@ -837,11 +929,24 @@ int rtas_ibm_suspend_me(struct rtas_args *args)
- 		return 0;
- 	}
- 
-+	if (!alloc_cpumask_var(&offline_mask, GFP_TEMPORARY))
-+		return -ENOMEM;
-+
- 	atomic_set(&data.working, 0);
- 	atomic_set(&data.done, 0);
- 	atomic_set(&data.error, 0);
- 	data.token = rtas_token("ibm,suspend-me");
- 	data.complete = &done;
-+
-+	/* All present CPUs must be online */
-+	cpumask_andnot(offline_mask, cpu_present_mask, cpu_online_mask);
-+	cpuret = rtas_online_cpus_mask(offline_mask);
-+	if (cpuret) {
-+		pr_err("%s: Could not bring present CPUs online.\n", __func__);
-+		atomic_set(&data.error, cpuret);
-+		goto out;
-+	}
-+
- 	stop_topology_update();
- 
- 	/* Call function on all CPUs.  One of us will make the
-@@ -857,6 +962,14 @@ int rtas_ibm_suspend_me(struct rtas_args *args)
- 
- 	start_topology_update();
- 
-+	/* Take down CPUs not online prior to suspend */
-+	cpuret = rtas_offline_cpus_mask(offline_mask);
-+	if (cpuret)
-+		pr_warn("%s: Could not restore CPUs to offline state.\n",
-+				__func__);
-+
-+out:
-+	free_cpumask_var(offline_mask);
- 	return atomic_read(&data.error);
- }
- #else /* CONFIG_PPC_PSERIES */
-diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
-index 47226e0..5f997e7 100644
---- a/arch/powerpc/platforms/pseries/suspend.c
-+++ b/arch/powerpc/platforms/pseries/suspend.c
-@@ -16,6 +16,7 @@
-   * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
-   */
- 
-+#include <linux/cpu.h>
- #include <linux/delay.h>
- #include <linux/suspend.h>
- #include <linux/stat.h>
-@@ -126,11 +127,15 @@ static ssize_t store_hibernate(struct device *dev,
- 			       struct device_attribute *attr,
- 			       const char *buf, size_t count)
- {
-+	cpumask_var_t offline_mask;
- 	int rc;
- 
- 	if (!capable(CAP_SYS_ADMIN))
- 		return -EPERM;
- 
-+	if (!alloc_cpumask_var(&offline_mask, GFP_TEMPORARY))
-+		return -ENOMEM;
-+
- 	stream_id = simple_strtoul(buf, NULL, 16);
- 
- 	do {
-@@ -140,15 +145,32 @@ static ssize_t store_hibernate(struct device *dev,
- 	} while (rc == -EAGAIN);
- 
- 	if (!rc) {
-+		/* All present CPUs must be online */
-+		cpumask_andnot(offline_mask, cpu_present_mask,
-+				cpu_online_mask);
-+		rc = rtas_online_cpus_mask(offline_mask);
-+		if (rc) {
-+			pr_err("%s: Could not bring present CPUs online.\n",
-+					__func__);
-+			goto out;
-+		}
-+
- 		stop_topology_update();
- 		rc = pm_suspend(PM_SUSPEND_MEM);
- 		start_topology_update();
-+
-+		/* Take down CPUs not online prior to suspend */
-+		if (!rtas_offline_cpus_mask(offline_mask))
-+			pr_warn("%s: Could not restore CPUs to offline "
-+					"state.\n", __func__);
- 	}
- 
- 	stream_id = 0;
- 
- 	if (!rc)
- 		rc = count;
-+out:
-+	free_cpumask_var(offline_mask);
- 	return rc;
- }
- 
-diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
-index 25877ae..41a2a0b 100644
---- a/arch/tile/Kconfig
-+++ b/arch/tile/Kconfig
-@@ -368,11 +368,17 @@ config HARDWALL
- config KERNEL_PL
- 	int "Processor protection level for kernel"
- 	range 1 2
--	default "1"
-+	default 2 if TILEGX
-+	default 1 if !TILEGX
- 	---help---
--	  This setting determines the processor protection level the
--	  kernel will be built to run at.  Generally you should use
--	  the default value here.
-+	  Since MDE 4.2, the Tilera hypervisor runs the kernel
-+	  at PL2 by default.  If running under an older hypervisor,
-+	  or as a KVM guest, you must run at PL1.  (The current
-+	  hypervisor may also be recompiled with "make HV_PL=2" to
-+	  allow it to run a kernel at PL1, but clients running at PL1
-+	  are not expected to be supported indefinitely.)
-+
-+	  If you're not sure, don't change the default.
- 
- source "arch/tile/gxio/Kconfig"
- 
-diff --git a/arch/tile/include/hv/hypervisor.h b/arch/tile/include/hv/hypervisor.h
-index ccd847e..837dca5 100644
---- a/arch/tile/include/hv/hypervisor.h
-+++ b/arch/tile/include/hv/hypervisor.h
-@@ -107,7 +107,22 @@
- #define HV_DISPATCH_ENTRY_SIZE 32
- 
- /** Version of the hypervisor interface defined by this file */
--#define _HV_VERSION 11
-+#define _HV_VERSION 13
-+
-+/** Last version of the hypervisor interface with old hv_init() ABI.
-+ *
-+ * The change from version 12 to version 13 corresponds to launching
-+ * the client by default at PL2 instead of PL1 (corresponding to the
-+ * hv itself running at PL3 instead of PL2).  To make this explicit,
-+ * the hv_init() API was also extended so the client can report its
-+ * desired PL, resulting in a more helpful failure diagnostic.  If you
-+ * call hv_init() with _HV_VERSION_OLD_HV_INIT and omit the client_pl
-+ * argument, the hypervisor will assume client_pl = 1.
-+ *
-+ * Note that this is a deprecated solution and we do not expect to
-+ * support clients of the Tilera hypervisor running at PL1 indefinitely.
-+ */
-+#define _HV_VERSION_OLD_HV_INIT 12
- 
- /* Index into hypervisor interface dispatch code blocks.
-  *
-@@ -377,7 +392,11 @@ typedef int HV_Errno;
- #ifndef __ASSEMBLER__
- 
- /** Pass HV_VERSION to hv_init to request this version of the interface. */
--typedef enum { HV_VERSION = _HV_VERSION } HV_VersionNumber;
-+typedef enum {
-+  HV_VERSION = _HV_VERSION,
-+  HV_VERSION_OLD_HV_INIT = _HV_VERSION_OLD_HV_INIT,
-+
-+} HV_VersionNumber;
- 
- /** Initializes the hypervisor.
-  *
-@@ -385,9 +404,11 @@ typedef enum { HV_VERSION = _HV_VERSION } HV_VersionNumber;
-  * that this program expects, typically HV_VERSION.
-  * @param chip_num Architecture number of the chip the client was built for.
-  * @param chip_rev_num Revision number of the chip the client was built for.
-+ * @param client_pl Privilege level the client is built for
-+ *   (not required if interface_version_number == HV_VERSION_OLD_HV_INIT).
-  */
- void hv_init(HV_VersionNumber interface_version_number,
--             int chip_num, int chip_rev_num);
-+             int chip_num, int chip_rev_num, int client_pl);
- 
- 
- /** Queries we can make for hv_sysconf().
-diff --git a/arch/tile/kernel/head_32.S b/arch/tile/kernel/head_32.S
-index f71bfee..ac11530 100644
---- a/arch/tile/kernel/head_32.S
-+++ b/arch/tile/kernel/head_32.S
-@@ -38,7 +38,7 @@ ENTRY(_start)
- 	  movei r2, TILE_CHIP_REV
- 	}
- 	{
--	  moveli r0, _HV_VERSION
-+	  moveli r0, _HV_VERSION_OLD_HV_INIT
- 	  jal hv_init
- 	}
- 	/* Get a reasonable default ASID in r0 */
-diff --git a/arch/tile/kernel/head_64.S b/arch/tile/kernel/head_64.S
-index f9a2734..6093964 100644
---- a/arch/tile/kernel/head_64.S
-+++ b/arch/tile/kernel/head_64.S
-@@ -34,13 +34,19 @@
- ENTRY(_start)
- 	/* Notify the hypervisor of what version of the API we want */
- 	{
-+#if KERNEL_PL == 1 && _HV_VERSION == 13
-+	  /* Support older hypervisors by asking for API version 12. */
-+	  movei r0, _HV_VERSION_OLD_HV_INIT
-+#else
-+	  movei r0, _HV_VERSION
-+#endif
- 	  movei r1, TILE_CHIP
--	  movei r2, TILE_CHIP_REV
- 	}
- 	{
--	  moveli r0, _HV_VERSION
--	  jal hv_init
-+	  movei r2, TILE_CHIP_REV
-+	  movei r3, KERNEL_PL
- 	}
-+	jal hv_init
- 	/* Get a reasonable default ASID in r0 */
- 	{
- 	  move r0, zero
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 15b5cef..6ef2a37 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -107,7 +107,6 @@ config X86
- 	select GENERIC_CLOCKEVENTS_BROADCAST if X86_64 || (X86_32 && X86_LOCAL_APIC)
- 	select GENERIC_TIME_VSYSCALL if X86_64
- 	select KTIME_SCALAR if X86_32
--	select ALWAYS_USE_PERSISTENT_CLOCK
- 	select GENERIC_STRNCPY_FROM_USER
- 	select GENERIC_STRNLEN_USER
- 	select HAVE_CONTEXT_TRACKING if X86_64
-diff --git a/arch/x86/kernel/microcode_intel_early.c b/arch/x86/kernel/microcode_intel_early.c
-index d893e8e..2e9e128 100644
---- a/arch/x86/kernel/microcode_intel_early.c
-+++ b/arch/x86/kernel/microcode_intel_early.c
-@@ -487,6 +487,7 @@ static inline void show_saved_mc(void)
- #endif
- 
- #if defined(CONFIG_MICROCODE_INTEL_EARLY) && defined(CONFIG_HOTPLUG_CPU)
-+static DEFINE_MUTEX(x86_cpu_microcode_mutex);
- /*
-  * Save this mc into mc_saved_data. So it will be loaded early when a CPU is
-  * hot added or resumes.
-@@ -507,7 +508,7 @@ int save_mc_for_early(u8 *mc)
- 	 * Hold hotplug lock so mc_saved_data is not accessed by a CPU in
- 	 * hotplug.
- 	 */
--	cpu_hotplug_driver_lock();
-+	mutex_lock(&x86_cpu_microcode_mutex);
- 
- 	mc_saved_count_init = mc_saved_data.mc_saved_count;
- 	mc_saved_count = mc_saved_data.mc_saved_count;
-@@ -544,7 +545,7 @@ int save_mc_for_early(u8 *mc)
- 	}
- 
- out:
--	cpu_hotplug_driver_unlock();
-+	mutex_unlock(&x86_cpu_microcode_mutex);
- 
- 	return ret;
- }
-diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index a9c9d3e..59622c9 100644
---- a/arch/x86/kvm/emulate.c
-+++ b/arch/x86/kvm/emulate.c
-@@ -60,6 +60,7 @@
- #define OpGS              25ull  /* GS */
- #define OpMem8            26ull  /* 8-bit zero extended memory operand */
- #define OpImm64           27ull  /* Sign extended 16/32/64-bit immediate */
-+#define OpXLat            28ull  /* memory at BX/EBX/RBX + zero-extended AL */
- 
- #define OpBits             5  /* Width of operand field */
- #define OpMask             ((1ull << OpBits) - 1)
-@@ -99,6 +100,7 @@
- #define SrcImmUByte (OpImmUByte << SrcShift)
- #define SrcImmU     (OpImmU << SrcShift)
- #define SrcSI       (OpSI << SrcShift)
-+#define SrcXLat     (OpXLat << SrcShift)
- #define SrcImmFAddr (OpImmFAddr << SrcShift)
- #define SrcMemFAddr (OpMemFAddr << SrcShift)
- #define SrcAcc      (OpAcc << SrcShift)
-@@ -532,6 +534,9 @@ FOP_SETCC(setle)
- FOP_SETCC(setnle)
- FOP_END;
- 
-+FOP_START(salc) "pushf; sbb %al, %al; popf \n\t" FOP_RET
-+FOP_END;
-+
- #define __emulate_1op_rax_rdx(ctxt, _op, _suffix, _ex)			\
- 	do {								\
- 		unsigned long _tmp;					\
-@@ -2986,6 +2991,28 @@ static int em_das(struct x86_emulate_ctxt *ctxt)
- 	return X86EMUL_CONTINUE;
- }
- 
-+static int em_aam(struct x86_emulate_ctxt *ctxt)
-+{
-+	u8 al, ah;
-+
-+	if (ctxt->src.val == 0)
-+		return emulate_de(ctxt);
-+
-+	al = ctxt->dst.val & 0xff;
-+	ah = al / ctxt->src.val;
-+	al %= ctxt->src.val;
-+
-+	ctxt->dst.val = (ctxt->dst.val & 0xffff0000) | al | (ah << 8);
-+
-+	/* Set PF, ZF, SF */
-+	ctxt->src.type = OP_IMM;
-+	ctxt->src.val = 0;
-+	ctxt->src.bytes = 1;
-+	fastop(ctxt, em_or);
-+
-+	return X86EMUL_CONTINUE;
-+}
-+
- static int em_aad(struct x86_emulate_ctxt *ctxt)
- {
- 	u8 al = ctxt->dst.val & 0xff;
-@@ -3926,7 +3953,10 @@ static const struct opcode opcode_table[256] = {
- 	/* 0xD0 - 0xD7 */
- 	G(Src2One | ByteOp, group2), G(Src2One, group2),
- 	G(Src2CL | ByteOp, group2), G(Src2CL, group2),
--	N, I(DstAcc | SrcImmByte | No64, em_aad), N, N,
-+	I(DstAcc | SrcImmUByte | No64, em_aam),
-+	I(DstAcc | SrcImmUByte | No64, em_aad),
-+	F(DstAcc | ByteOp | No64, em_salc),
-+	I(DstAcc | SrcXLat | ByteOp, em_mov),
- 	/* 0xD8 - 0xDF */
- 	N, E(0, &escape_d9), N, E(0, &escape_db), N, E(0, &escape_dd), N, N,
- 	/* 0xE0 - 0xE7 */
-@@ -4188,6 +4218,16 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
- 		op->val = 0;
- 		op->count = 1;
- 		break;
-+	case OpXLat:
-+		op->type = OP_MEM;
-+		op->bytes = (ctxt->d & ByteOp) ? 1 : ctxt->op_bytes;
-+		op->addr.mem.ea =
-+			register_address(ctxt,
-+				reg_read(ctxt, VCPU_REGS_RBX) +
-+				(reg_read(ctxt, VCPU_REGS_RAX) & 0xff));
-+		op->addr.mem.seg = seg_override(ctxt);
-+		op->val = 0;
-+		break;
- 	case OpImmFAddr:
- 		op->type = OP_IMM;
- 		op->addr.mem.ea = ctxt->_eip;
-diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 6667042..0af1807 100644
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -5197,6 +5197,12 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
- 			return 0;
- 		}
- 
-+		if (vcpu->arch.halt_request) {
-+			vcpu->arch.halt_request = 0;
-+			ret = kvm_emulate_halt(vcpu);
-+			goto out;
-+		}
-+
- 		if (signal_pending(current))
- 			goto out;
- 		if (need_resched())
-diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 2363127..cf95e19 100644
---- a/arch/x86/xen/enlighten.c
-+++ b/arch/x86/xen/enlighten.c
-@@ -156,6 +156,21 @@ static void xen_vcpu_setup(int cpu)
- 
- 	BUG_ON(HYPERVISOR_shared_info == &xen_dummy_shared_info);
- 
-+	/*
-+	 * This path is called twice on PVHVM - first during bootup via
-+	 * smp_init -> xen_hvm_cpu_notify, and then if the VCPU is being
-+	 * hotplugged: cpu_up -> xen_hvm_cpu_notify.
-+	 * As we can only do the VCPUOP_register_vcpu_info once lets
-+	 * not over-write its result.
-+	 *
-+	 * For PV it is called during restore (xen_vcpu_restore) and bootup
-+	 * (xen_setup_vcpu_info_placement). The hotplug mechanism does not
-+	 * use this function.
-+	 */
-+	if (xen_hvm_domain()) {
-+		if (per_cpu(xen_vcpu, cpu) == &per_cpu(xen_vcpu_info, cpu))
-+			return;
-+	}
- 	if (cpu < MAX_VIRT_CPUS)
- 		per_cpu(xen_vcpu,cpu) = &HYPERVISOR_shared_info->vcpu_info[cpu];
- 
-diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
-index ec7f569..c84ee95 100644
---- a/drivers/acpi/acpica/exfldio.c
-+++ b/drivers/acpi/acpica/exfldio.c
-@@ -720,7 +720,19 @@ acpi_ex_extract_from_field(union acpi_operand_object *obj_desc,
- 
- 	if ((obj_desc->common_field.start_field_bit_offset == 0) &&
- 	    (obj_desc->common_field.bit_length == access_bit_width)) {
--		status = acpi_ex_field_datum_io(obj_desc, 0, buffer, ACPI_READ);
-+		if (buffer_length >= sizeof(u64)) {
-+			status =
-+			    acpi_ex_field_datum_io(obj_desc, 0, buffer,
-+						   ACPI_READ);
-+		} else {
-+			/* Use raw_datum (u64) to handle buffers < 64 bits */
-+
-+			status =
-+			    acpi_ex_field_datum_io(obj_desc, 0, &raw_datum,
-+						   ACPI_READ);
-+			ACPI_MEMCPY(buffer, &raw_datum, buffer_length);
-+		}
-+
- 		return_ACPI_STATUS(status);
- 	}
- 
-diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
-index d45b287..edc0081 100644
---- a/drivers/acpi/ec.c
-+++ b/drivers/acpi/ec.c
-@@ -223,7 +223,7 @@ static int ec_check_sci_sync(struct acpi_ec *ec, u8 state)
- static int ec_poll(struct acpi_ec *ec)
- {
- 	unsigned long flags;
--	int repeat = 2; /* number of command restarts */
-+	int repeat = 5; /* number of command restarts */
- 	while (repeat--) {
- 		unsigned long delay = jiffies +
- 			msecs_to_jiffies(ec_delay);
-@@ -241,8 +241,6 @@ static int ec_poll(struct acpi_ec *ec)
- 			}
- 			advance_transaction(ec, acpi_ec_read_status(ec));
- 		} while (time_before(jiffies, delay));
--		if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF)
--			break;
- 		pr_debug(PREFIX "controller reset, restart transaction\n");
- 		spin_lock_irqsave(&ec->lock, flags);
- 		start_transaction(ec);
-diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
-index e98da67..54d03d4 100644
---- a/drivers/block/drbd/drbd_main.c
-+++ b/drivers/block/drbd/drbd_main.c
-@@ -2795,6 +2795,7 @@ void drbd_free_bc(struct drbd_backing_dev *ldev)
- 	blkdev_put(ldev->backing_bdev, FMODE_READ | FMODE_WRITE | FMODE_EXCL);
- 	blkdev_put(ldev->md_bdev, FMODE_READ | FMODE_WRITE | FMODE_EXCL);
- 
-+	kfree(ldev->disk_conf);
- 	kfree(ldev);
- }
- 
-diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
-index a9eccfc..2f5fffd 100644
---- a/drivers/block/drbd/drbd_receiver.c
-+++ b/drivers/block/drbd/drbd_receiver.c
-@@ -2661,7 +2661,6 @@ static int drbd_asb_recover_1p(struct drbd_conf *mdev) __must_hold(local)
- 		if (hg == -1 && mdev->state.role == R_PRIMARY) {
- 			enum drbd_state_rv rv2;
- 
--			drbd_set_role(mdev, R_SECONDARY, 0);
- 			 /* drbd_change_state() does not sleep while in SS_IN_TRANSIENT_STATE,
- 			  * we might be here in C_WF_REPORT_PARAMS which is transient.
- 			  * we do not need to wait for the after state change work either. */
-@@ -4659,8 +4658,8 @@ static int drbd_do_features(struct drbd_tconn *tconn)
- #if !defined(CONFIG_CRYPTO_HMAC) && !defined(CONFIG_CRYPTO_HMAC_MODULE)
- static int drbd_do_auth(struct drbd_tconn *tconn)
- {
--	dev_err(DEV, "This kernel was build without CONFIG_CRYPTO_HMAC.\n");
--	dev_err(DEV, "You need to disable 'cram-hmac-alg' in drbd.conf.\n");
-+	conn_err(tconn, "This kernel was build without CONFIG_CRYPTO_HMAC.\n");
-+	conn_err(tconn, "You need to disable 'cram-hmac-alg' in drbd.conf.\n");
- 	return -1;
- }
- #else
-diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
-index cdd4c09f..a22a7a5 100644
---- a/drivers/char/ipmi/ipmi_bt_sm.c
-+++ b/drivers/char/ipmi/ipmi_bt_sm.c
-@@ -95,9 +95,9 @@ struct si_sm_data {
- 	enum bt_states	state;
- 	unsigned char	seq;		/* BT sequence number */
- 	struct si_sm_io	*io;
--	unsigned char	write_data[IPMI_MAX_MSG_LENGTH];
-+	unsigned char	write_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
- 	int		write_count;
--	unsigned char	read_data[IPMI_MAX_MSG_LENGTH];
-+	unsigned char	read_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
- 	int		read_count;
- 	int		truncated;
- 	long		timeout;	/* microseconds countdown */
-diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
-index 9eb360f..d5a5f02 100644
---- a/drivers/char/ipmi/ipmi_devintf.c
-+++ b/drivers/char/ipmi/ipmi_devintf.c
-@@ -837,13 +837,25 @@ static long compat_ipmi_ioctl(struct file *filep, unsigned int cmd,
- 		return ipmi_ioctl(filep, cmd, arg);
- 	}
- }
-+
-+static long unlocked_compat_ipmi_ioctl(struct file *filep, unsigned int cmd,
-+				       unsigned long arg)
-+{
-+	int ret;
-+
-+	mutex_lock(&ipmi_mutex);
-+	ret = compat_ipmi_ioctl(filep, cmd, arg);
-+	mutex_unlock(&ipmi_mutex);
-+
-+	return ret;
-+}
- #endif
- 
- static const struct file_operations ipmi_fops = {
- 	.owner		= THIS_MODULE,
- 	.unlocked_ioctl	= ipmi_unlocked_ioctl,
- #ifdef CONFIG_COMPAT
--	.compat_ioctl   = compat_ipmi_ioctl,
-+	.compat_ioctl   = unlocked_compat_ipmi_ioctl,
- #endif
- 	.open		= ipmi_open,
- 	.release	= ipmi_release,
-diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index 6133ef5..d8a8c9b 100644
---- a/drivers/cpufreq/intel_pstate.c
-+++ b/drivers/cpufreq/intel_pstate.c
-@@ -48,12 +48,7 @@ static inline int32_t div_fp(int32_t x, int32_t y)
- }
- 
- struct sample {
--	ktime_t start_time;
--	ktime_t end_time;
- 	int core_pct_busy;
--	int pstate_pct_busy;
--	u64 duration_us;
--	u64 idletime_us;
- 	u64 aperf;
- 	u64 mperf;
- 	int freq;
-@@ -91,8 +86,6 @@ struct cpudata {
- 	int min_pstate_count;
- 	int idle_mode;
- 
--	ktime_t prev_sample;
--	u64	prev_idle_time_us;
- 	u64	prev_aperf;
- 	u64	prev_mperf;
- 	int	sample_ptr;
-@@ -124,6 +117,8 @@ struct perf_limits {
- 	int min_perf_pct;
- 	int32_t max_perf;
- 	int32_t min_perf;
-+	int max_policy_pct;
-+	int max_sysfs_pct;
- };
- 
- static struct perf_limits limits = {
-@@ -132,6 +127,8 @@ static struct perf_limits limits = {
- 	.max_perf = int_tofp(1),
- 	.min_perf_pct = 0,
- 	.min_perf = 0,
-+	.max_policy_pct = 100,
-+	.max_sysfs_pct = 100,
- };
- 
- static inline void pid_reset(struct _pid *pid, int setpoint, int busy,
-@@ -302,7 +299,8 @@ static ssize_t store_max_perf_pct(struct kobject *a, struct attribute *b,
- 	if (ret != 1)
- 		return -EINVAL;
- 
--	limits.max_perf_pct = clamp_t(int, input, 0 , 100);
-+	limits.max_sysfs_pct = clamp_t(int, input, 0 , 100);
-+	limits.max_perf_pct = min(limits.max_policy_pct, limits.max_sysfs_pct);
- 	limits.max_perf = div_fp(int_tofp(limits.max_perf_pct), int_tofp(100));
- 	return count;
- }
-@@ -450,48 +448,26 @@ static inline void intel_pstate_calc_busy(struct cpudata *cpu,
- 					struct sample *sample)
- {
- 	u64 core_pct;
--	sample->pstate_pct_busy = 100 - div64_u64(
--					sample->idletime_us * 100,
--					sample->duration_us);
- 	core_pct = div64_u64(sample->aperf * 100, sample->mperf);
- 	sample->freq = cpu->pstate.max_pstate * core_pct * 1000;
- 
--	sample->core_pct_busy = div_s64((sample->pstate_pct_busy * core_pct),
--					100);
-+	sample->core_pct_busy = core_pct;
- }
- 
- static inline void intel_pstate_sample(struct cpudata *cpu)
- {
--	ktime_t now;
--	u64 idle_time_us;
- 	u64 aperf, mperf;
- 
--	now = ktime_get();
--	idle_time_us = get_cpu_idle_time_us(cpu->cpu, NULL);
--
- 	rdmsrl(MSR_IA32_APERF, aperf);
- 	rdmsrl(MSR_IA32_MPERF, mperf);
--	/* for the first sample, don't actually record a sample, just
--	 * set the baseline */
--	if (cpu->prev_idle_time_us > 0) {
--		cpu->sample_ptr = (cpu->sample_ptr + 1) % SAMPLE_COUNT;
--		cpu->samples[cpu->sample_ptr].start_time = cpu->prev_sample;
--		cpu->samples[cpu->sample_ptr].end_time = now;
--		cpu->samples[cpu->sample_ptr].duration_us =
--			ktime_us_delta(now, cpu->prev_sample);
--		cpu->samples[cpu->sample_ptr].idletime_us =
--			idle_time_us - cpu->prev_idle_time_us;
--
--		cpu->samples[cpu->sample_ptr].aperf = aperf;
--		cpu->samples[cpu->sample_ptr].mperf = mperf;
--		cpu->samples[cpu->sample_ptr].aperf -= cpu->prev_aperf;
--		cpu->samples[cpu->sample_ptr].mperf -= cpu->prev_mperf;
--
--		intel_pstate_calc_busy(cpu, &cpu->samples[cpu->sample_ptr]);
--	}
-+	cpu->sample_ptr = (cpu->sample_ptr + 1) % SAMPLE_COUNT;
-+	cpu->samples[cpu->sample_ptr].aperf = aperf;
-+	cpu->samples[cpu->sample_ptr].mperf = mperf;
-+	cpu->samples[cpu->sample_ptr].aperf -= cpu->prev_aperf;
-+	cpu->samples[cpu->sample_ptr].mperf -= cpu->prev_mperf;
-+
-+	intel_pstate_calc_busy(cpu, &cpu->samples[cpu->sample_ptr]);
- 
--	cpu->prev_sample = now;
--	cpu->prev_idle_time_us = idle_time_us;
- 	cpu->prev_aperf = aperf;
- 	cpu->prev_mperf = mperf;
- }
-@@ -575,22 +551,16 @@ static void intel_pstate_timer_func(unsigned long __data)
- 	struct cpudata *cpu = (struct cpudata *) __data;
- 
- 	intel_pstate_sample(cpu);
-+	intel_pstate_adjust_busy_pstate(cpu);
- 
--	if (!cpu->idle_mode)
--		intel_pstate_adjust_busy_pstate(cpu);
--	else
--		intel_pstate_adjust_idle_pstate(cpu);
--
--#if defined(XPERF_FIX)
- 	if (cpu->pstate.current_pstate == cpu->pstate.min_pstate) {
- 		cpu->min_pstate_count++;
- 		if (!(cpu->min_pstate_count % 5)) {
- 			intel_pstate_set_pstate(cpu, cpu->pstate.max_pstate);
--			intel_pstate_idle_mode(cpu);
- 		}
- 	} else
- 		cpu->min_pstate_count = 0;
--#endif
-+
- 	intel_pstate_set_sample_time(cpu);
- }
- 
-@@ -670,8 +640,9 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
- 	limits.min_perf_pct = clamp_t(int, limits.min_perf_pct, 0 , 100);
- 	limits.min_perf = div_fp(int_tofp(limits.min_perf_pct), int_tofp(100));
- 
--	limits.max_perf_pct = policy->max * 100 / policy->cpuinfo.max_freq;
--	limits.max_perf_pct = clamp_t(int, limits.max_perf_pct, 0 , 100);
-+	limits.max_policy_pct = policy->max * 100 / policy->cpuinfo.max_freq;
-+	limits.max_policy_pct = clamp_t(int, limits.max_policy_pct, 0 , 100);
-+	limits.max_perf_pct = min(limits.max_policy_pct, limits.max_sysfs_pct);
- 	limits.max_perf = div_fp(int_tofp(limits.max_perf_pct), int_tofp(100));
- 
- 	if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) {
-diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c
-index 69d04d2..09c7ad1 100644
---- a/drivers/dma/of-dma.c
-+++ b/drivers/dma/of-dma.c
-@@ -93,6 +93,7 @@ int of_dma_controller_register(struct device_node *np,
- {
- 	struct of_dma	*ofdma;
- 	int		nbcells;
-+	const __be32	*prop;
- 
- 	if (!np || !of_dma_xlate) {
- 		pr_err("%s: not enough information provided\n", __func__);
-@@ -103,8 +104,11 @@ int of_dma_controller_register(struct device_node *np,
- 	if (!ofdma)
- 		return -ENOMEM;
- 
--	nbcells = be32_to_cpup(of_get_property(np, "#dma-cells", NULL));
--	if (!nbcells) {
-+	prop = of_get_property(np, "#dma-cells", NULL);
-+	if (prop)
-+		nbcells = be32_to_cpup(prop);
-+
-+	if (!prop || !nbcells) {
- 		pr_err("%s: #dma-cells property is missing or invalid\n",
- 		       __func__);
- 		kfree(ofdma);
-diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c
-index d01faeb..ce3dc3e 100644
---- a/drivers/dma/pch_dma.c
-+++ b/drivers/dma/pch_dma.c
-@@ -476,7 +476,7 @@ static struct pch_dma_desc *pdc_desc_get(struct pch_dma_chan *pd_chan)
- 	dev_dbg(chan2dev(&pd_chan->chan), "scanned %d descriptors\n", i);
- 
- 	if (!ret) {
--		ret = pdc_alloc_desc(&pd_chan->chan, GFP_NOIO);
-+		ret = pdc_alloc_desc(&pd_chan->chan, GFP_ATOMIC);
- 		if (ret) {
- 			spin_lock(&pd_chan->lock);
- 			pd_chan->descs_allocated++;
-diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index dd64a06..016c5d8 100644
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -78,6 +78,10 @@ void drm_warn_on_modeset_not_all_locked(struct drm_device *dev)
- {
- 	struct drm_crtc *crtc;
- 
-+	/* Locking is currently fubar in the panic handler. */
-+	if (oops_in_progress)
-+		return;
-+
- 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
- 		WARN_ON(!mutex_is_locked(&crtc->mutex));
- 
-diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
-index db1e2d6..07cf99c 100644
---- a/drivers/gpu/drm/drm_mm.c
-+++ b/drivers/gpu/drm/drm_mm.c
-@@ -755,33 +755,35 @@ void drm_mm_debug_table(struct drm_mm *mm, const char *prefix)
- EXPORT_SYMBOL(drm_mm_debug_table);
- 
- #if defined(CONFIG_DEBUG_FS)
--int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
-+static unsigned long drm_mm_dump_hole(struct seq_file *m, struct drm_mm_node *entry)
- {
--	struct drm_mm_node *entry;
--	unsigned long total_used = 0, total_free = 0, total = 0;
- 	unsigned long hole_start, hole_end, hole_size;
- 
--	hole_start = drm_mm_hole_node_start(&mm->head_node);
--	hole_end = drm_mm_hole_node_end(&mm->head_node);
--	hole_size = hole_end - hole_start;
--	if (hole_size)
-+	if (entry->hole_follows) {
-+		hole_start = drm_mm_hole_node_start(entry);
-+		hole_end = drm_mm_hole_node_end(entry);
-+		hole_size = hole_end - hole_start;
- 		seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: free\n",
- 				hole_start, hole_end, hole_size);
--	total_free += hole_size;
-+		return hole_size;
-+	}
-+
-+	return 0;
-+}
-+
-+int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
-+{
-+	struct drm_mm_node *entry;
-+	unsigned long total_used = 0, total_free = 0, total = 0;
-+
-+	total_free += drm_mm_dump_hole(m, &mm->head_node);
- 
- 	drm_mm_for_each_node(entry, mm) {
- 		seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: used\n",
- 				entry->start, entry->start + entry->size,
- 				entry->size);
- 		total_used += entry->size;
--		if (entry->hole_follows) {
--			hole_start = drm_mm_hole_node_start(entry);
--			hole_end = drm_mm_hole_node_end(entry);
--			hole_size = hole_end - hole_start;
--			seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: free\n",
--					hole_start, hole_end, hole_size);
--			total_free += hole_size;
--		}
-+		total_free += drm_mm_dump_hole(m, entry);
- 	}
- 	total = total_free + total_used;
- 
-diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
-index 981bdce..898832b 100644
---- a/drivers/gpu/drm/i915/intel_fb.c
-+++ b/drivers/gpu/drm/i915/intel_fb.c
-@@ -261,10 +261,22 @@ void intel_fbdev_fini(struct drm_device *dev)
- void intel_fbdev_set_suspend(struct drm_device *dev, int state)
- {
- 	drm_i915_private_t *dev_priv = dev->dev_private;
--	if (!dev_priv->fbdev)
-+	struct intel_fbdev *ifbdev = dev_priv->fbdev;
-+	struct fb_info *info;
-+
-+	if (!ifbdev)
- 		return;
- 
--	fb_set_suspend(dev_priv->fbdev->helper.fbdev, state);
-+	info = ifbdev->helper.fbdev;
-+
-+	/* On resume from hibernation: If the object is shmemfs backed, it has
-+	 * been restored from swap. If the object is stolen however, it will be
-+	 * full of whatever garbage was left in there.
-+	 */
-+	if (!state && ifbdev->ifb.obj->stolen)
-+		memset_io(info->screen_base, 0, info->screen_size);
-+
-+	fb_set_suspend(info, state);
- }
- 
- MODULE_LICENSE("GPL and additional rights");
-diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
-index 78d8e91..713dd70 100644
---- a/drivers/gpu/drm/mgag200/mgag200_mode.c
-+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
-@@ -189,12 +189,12 @@ static int mga_g200wb_set_plls(struct mga_device *mdev, long clock)
- 		WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
- 		tmp = RREG8(DAC_DATA);
- 		tmp |= MGA1064_PIX_CLK_CTL_CLK_DIS;
--		WREG_DAC(MGA1064_PIX_CLK_CTL_CLK_DIS, tmp);
-+		WREG8(DAC_DATA, tmp);
- 
- 		WREG8(DAC_INDEX, MGA1064_REMHEADCTL);
- 		tmp = RREG8(DAC_DATA);
- 		tmp |= MGA1064_REMHEADCTL_CLKDIS;
--		WREG_DAC(MGA1064_REMHEADCTL, tmp);
-+		WREG8(DAC_DATA, tmp);
- 
- 		/* select PLL Set C */
- 		tmp = RREG8(MGAREG_MEM_MISC_READ);
-@@ -204,7 +204,7 @@ static int mga_g200wb_set_plls(struct mga_device *mdev, long clock)
- 		WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
- 		tmp = RREG8(DAC_DATA);
- 		tmp |= MGA1064_PIX_CLK_CTL_CLK_POW_DOWN | 0x80;
--		WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
-+		WREG8(DAC_DATA, tmp);
- 
- 		udelay(500);
- 
-@@ -212,7 +212,7 @@ static int mga_g200wb_set_plls(struct mga_device *mdev, long clock)
- 		WREG8(DAC_INDEX, MGA1064_VREF_CTL);
- 		tmp = RREG8(DAC_DATA);
- 		tmp &= ~0x04;
--		WREG_DAC(MGA1064_VREF_CTL, tmp);
-+		WREG8(DAC_DATA, tmp);
- 
- 		udelay(50);
- 
-@@ -236,13 +236,13 @@ static int mga_g200wb_set_plls(struct mga_device *mdev, long clock)
- 		tmp = RREG8(DAC_DATA);
- 		tmp &= ~MGA1064_PIX_CLK_CTL_SEL_MSK;
- 		tmp |= MGA1064_PIX_CLK_CTL_SEL_PLL;
--		WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
-+		WREG8(DAC_DATA, tmp);
- 
- 		WREG8(DAC_INDEX, MGA1064_REMHEADCTL);
- 		tmp = RREG8(DAC_DATA);
- 		tmp &= ~MGA1064_REMHEADCTL_CLKSL_MSK;
- 		tmp |= MGA1064_REMHEADCTL_CLKSL_PLL;
--		WREG_DAC(MGA1064_REMHEADCTL, tmp);
-+		WREG8(DAC_DATA, tmp);
- 
- 		/* reset dotclock rate bit */
- 		WREG8(MGAREG_SEQ_INDEX, 1);
-@@ -253,7 +253,7 @@ static int mga_g200wb_set_plls(struct mga_device *mdev, long clock)
- 		WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
- 		tmp = RREG8(DAC_DATA);
- 		tmp &= ~MGA1064_PIX_CLK_CTL_CLK_DIS;
--		WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
-+		WREG8(DAC_DATA, tmp);
- 
- 		vcount = RREG8(MGAREG_VCOUNT);
- 
-@@ -318,7 +318,7 @@ static int mga_g200ev_set_plls(struct mga_device *mdev, long clock)
- 	WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
- 	tmp = RREG8(DAC_DATA);
- 	tmp |= MGA1064_PIX_CLK_CTL_CLK_DIS;
--	WREG_DAC(MGA1064_PIX_CLK_CTL_CLK_DIS, tmp);
-+	WREG8(DAC_DATA, tmp);
- 
- 	tmp = RREG8(MGAREG_MEM_MISC_READ);
- 	tmp |= 0x3 << 2;
-@@ -326,12 +326,12 @@ static int mga_g200ev_set_plls(struct mga_device *mdev, long clock)
- 
- 	WREG8(DAC_INDEX, MGA1064_PIX_PLL_STAT);
- 	tmp = RREG8(DAC_DATA);
--	WREG_DAC(MGA1064_PIX_PLL_STAT, tmp & ~0x40);
-+	WREG8(DAC_DATA, tmp & ~0x40);
- 
- 	WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
- 	tmp = RREG8(DAC_DATA);
- 	tmp |= MGA1064_PIX_CLK_CTL_CLK_POW_DOWN;
--	WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
-+	WREG8(DAC_DATA, tmp);
- 
- 	WREG_DAC(MGA1064_EV_PIX_PLLC_M, m);
- 	WREG_DAC(MGA1064_EV_PIX_PLLC_N, n);
-@@ -342,7 +342,7 @@ static int mga_g200ev_set_plls(struct mga_device *mdev, long clock)
- 	WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
- 	tmp = RREG8(DAC_DATA);
- 	tmp &= ~MGA1064_PIX_CLK_CTL_CLK_POW_DOWN;
--	WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
-+	WREG8(DAC_DATA, tmp);
- 
- 	udelay(500);
- 
-@@ -350,11 +350,11 @@ static int mga_g200ev_set_plls(struct mga_device *mdev, long clock)
- 	tmp = RREG8(DAC_DATA);
- 	tmp &= ~MGA1064_PIX_CLK_CTL_SEL_MSK;
- 	tmp |= MGA1064_PIX_CLK_CTL_SEL_PLL;
--	WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
-+	WREG8(DAC_DATA, tmp);
- 
- 	WREG8(DAC_INDEX, MGA1064_PIX_PLL_STAT);
- 	tmp = RREG8(DAC_DATA);
--	WREG_DAC(MGA1064_PIX_PLL_STAT, tmp | 0x40);
-+	WREG8(DAC_DATA, tmp | 0x40);
- 
- 	tmp = RREG8(MGAREG_MEM_MISC_READ);
- 	tmp |= (0x3 << 2);
-@@ -363,7 +363,7 @@ static int mga_g200ev_set_plls(struct mga_device *mdev, long clock)
- 	WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
- 	tmp = RREG8(DAC_DATA);
- 	tmp &= ~MGA1064_PIX_CLK_CTL_CLK_DIS;
--	WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
-+	WREG8(DAC_DATA, tmp);
- 
- 	return 0;
- }
-@@ -416,7 +416,7 @@ static int mga_g200eh_set_plls(struct mga_device *mdev, long clock)
- 		WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
- 		tmp = RREG8(DAC_DATA);
- 		tmp |= MGA1064_PIX_CLK_CTL_CLK_DIS;
--		WREG_DAC(MGA1064_PIX_CLK_CTL_CLK_DIS, tmp);
-+		WREG8(DAC_DATA, tmp);
- 
- 		tmp = RREG8(MGAREG_MEM_MISC_READ);
- 		tmp |= 0x3 << 2;
-@@ -425,7 +425,7 @@ static int mga_g200eh_set_plls(struct mga_device *mdev, long clock)
- 		WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
- 		tmp = RREG8(DAC_DATA);
- 		tmp |= MGA1064_PIX_CLK_CTL_CLK_POW_DOWN;
--		WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
-+		WREG8(DAC_DATA, tmp);
- 
- 		udelay(500);
- 
-@@ -439,13 +439,13 @@ static int mga_g200eh_set_plls(struct mga_device *mdev, long clock)
- 		tmp = RREG8(DAC_DATA);
- 		tmp &= ~MGA1064_PIX_CLK_CTL_SEL_MSK;
- 		tmp |= MGA1064_PIX_CLK_CTL_SEL_PLL;
--		WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
-+		WREG8(DAC_DATA, tmp);
- 
- 		WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
- 		tmp = RREG8(DAC_DATA);
- 		tmp &= ~MGA1064_PIX_CLK_CTL_CLK_DIS;
- 		tmp &= ~MGA1064_PIX_CLK_CTL_CLK_POW_DOWN;
--		WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
-+		WREG8(DAC_DATA, tmp);
- 
- 		vcount = RREG8(MGAREG_VCOUNT);
- 
-@@ -515,12 +515,12 @@ static int mga_g200er_set_plls(struct mga_device *mdev, long clock)
- 	WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
- 	tmp = RREG8(DAC_DATA);
- 	tmp |= MGA1064_PIX_CLK_CTL_CLK_DIS;
--	WREG_DAC(MGA1064_PIX_CLK_CTL_CLK_DIS, tmp);
-+	WREG8(DAC_DATA, tmp);
- 
- 	WREG8(DAC_INDEX, MGA1064_REMHEADCTL);
- 	tmp = RREG8(DAC_DATA);
- 	tmp |= MGA1064_REMHEADCTL_CLKDIS;
--	WREG_DAC(MGA1064_REMHEADCTL, tmp);
-+	WREG8(DAC_DATA, tmp);
- 
- 	tmp = RREG8(MGAREG_MEM_MISC_READ);
- 	tmp |= (0x3<<2) | 0xc0;
-@@ -530,7 +530,7 @@ static int mga_g200er_set_plls(struct mga_device *mdev, long clock)
- 	tmp = RREG8(DAC_DATA);
- 	tmp &= ~MGA1064_PIX_CLK_CTL_CLK_DIS;
- 	tmp |= MGA1064_PIX_CLK_CTL_CLK_POW_DOWN;
--	WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
-+	WREG8(DAC_DATA, tmp);
- 
- 	udelay(500);
- 
-@@ -657,12 +657,26 @@ static void mga_g200wb_commit(struct drm_crtc *crtc)
- 	WREG_DAC(MGA1064_GEN_IO_DATA, tmp);
- }
- 
--
-+/*
-+   This is how the framebuffer base address is stored in g200 cards:
-+   * Assume @offset is the gpu_addr variable of the framebuffer object
-+   * Then addr is the number of _pixels_ (not bytes) from the start of
-+     VRAM to the first pixel we want to display. (divided by 2 for 32bit
-+     framebuffers)
-+   * addr is stored in the CRTCEXT0, CRTCC and CRTCD registers
-+   addr<20> -> CRTCEXT0<6>
-+   addr<19-16> -> CRTCEXT0<3-0>
-+   addr<15-8> -> CRTCC<7-0>
-+   addr<7-0> -> CRTCD<7-0>
-+   CRTCEXT0 has to be programmed last to trigger an update and make the
-+   new addr variable take effect.
-+ */
- void mga_set_start_address(struct drm_crtc *crtc, unsigned offset)
- {
- 	struct mga_device *mdev = crtc->dev->dev_private;
- 	u32 addr;
- 	int count;
-+	u8 crtcext0;
- 
- 	while (RREG8(0x1fda) & 0x08);
- 	while (!(RREG8(0x1fda) & 0x08));
-@@ -670,10 +684,17 @@ void mga_set_start_address(struct drm_crtc *crtc, unsigned offset)
- 	count = RREG8(MGAREG_VCOUNT) + 2;
- 	while (RREG8(MGAREG_VCOUNT) < count);
- 
--	addr = offset >> 2;
-+	WREG8(MGAREG_CRTCEXT_INDEX, 0);
-+	crtcext0 = RREG8(MGAREG_CRTCEXT_DATA);
-+	crtcext0 &= 0xB0;
-+	addr = offset / 8;
-+	/* Can't store addresses any higher than that...
-+	   but we also don't have more than 16MB of memory, so it should be fine. */
-+	WARN_ON(addr > 0x1fffff);
-+	crtcext0 |= (!!(addr & (1<<20)))<<6;
- 	WREG_CRT(0x0d, (u8)(addr & 0xff));
- 	WREG_CRT(0x0c, (u8)(addr >> 8) & 0xff);
--	WREG_CRT(0xaf, (u8)(addr >> 16) & 0xf);
-+	WREG_ECRT(0x0, ((u8)(addr >> 16) & 0xf) | crtcext0);
- }
- 
- 
-diff --git a/drivers/gpu/drm/radeon/r300_cmdbuf.c b/drivers/gpu/drm/radeon/r300_cmdbuf.c
-index 865e2c9..60170ea 100644
---- a/drivers/gpu/drm/radeon/r300_cmdbuf.c
-+++ b/drivers/gpu/drm/radeon/r300_cmdbuf.c
-@@ -75,7 +75,7 @@ static int r300_emit_cliprects(drm_radeon_private_t *dev_priv,
- 		OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));
- 
- 		for (i = 0; i < nr; ++i) {
--			if (DRM_COPY_FROM_USER_UNCHECKED
-+			if (DRM_COPY_FROM_USER
- 			    (&box, &cmdbuf->boxes[n + i], sizeof(box))) {
- 				DRM_ERROR("copy cliprect faulted\n");
- 				return -EFAULT;
-diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
-index 66a7f0f..96cf439 100644
---- a/drivers/gpu/drm/radeon/radeon_drv.c
-+++ b/drivers/gpu/drm/radeon/radeon_drv.c
-@@ -144,7 +144,7 @@ static inline void radeon_unregister_atpx_handler(void) {}
- #endif
- 
- int radeon_no_wb;
--int radeon_modeset = 1;
-+int radeon_modeset = -1;
- int radeon_dynclks = -1;
- int radeon_r4xx_atom = 0;
- int radeon_agpmode = 0;
-@@ -449,6 +449,16 @@ static struct pci_driver radeon_kms_pci_driver = {
- 
- static int __init radeon_init(void)
- {
-+#ifdef CONFIG_VGA_CONSOLE
-+	if (vgacon_text_force() && radeon_modeset == -1) {
-+		DRM_INFO("VGACON disable radeon kernel modesetting.\n");
-+		radeon_modeset = 0;
-+	}
-+#endif
-+	/* set to modesetting by default if not nomodeset */
-+	if (radeon_modeset == -1)
-+		radeon_modeset = 1;
-+
- 	if (radeon_modeset == 1) {
- 		DRM_INFO("radeon kernel modesetting enabled.\n");
- 		driver = &kms_driver;
-diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
-index aa341d1..e6dbf09 100644
---- a/drivers/hid/hid-core.c
-+++ b/drivers/hid/hid-core.c
-@@ -1702,6 +1702,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_NAVIGATION_CONTROLLER) },
- 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE) },
-+	{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGP_MOUSE) },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_SRWS1) },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_SUNPLUS, USB_DEVICE_ID_SUNPLUS_WDESKTOP) },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_THINGM, USB_DEVICE_ID_BLINK1) },
-diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
-index c608313..0387e05 100644
---- a/drivers/md/dm-bufio.c
-+++ b/drivers/md/dm-bufio.c
-@@ -319,6 +319,9 @@ static void __cache_size_refresh(void)
- static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask,
- 			       enum data_mode *data_mode)
- {
-+	unsigned noio_flag;
-+	void *ptr;
-+
- 	if (c->block_size <= DM_BUFIO_BLOCK_SIZE_SLAB_LIMIT) {
- 		*data_mode = DATA_MODE_SLAB;
- 		return kmem_cache_alloc(DM_BUFIO_CACHE(c), gfp_mask);
-@@ -332,7 +335,26 @@ static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask,
- 	}
- 
- 	*data_mode = DATA_MODE_VMALLOC;
--	return __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
-+
-+	/*
-+	 * __vmalloc allocates the data pages and auxiliary structures with
-+	 * gfp_flags that were specified, but pagetables are always allocated
-+	 * with GFP_KERNEL, no matter what was specified as gfp_mask.
-+	 *
-+	 * Consequently, we must set per-process flag PF_MEMALLOC_NOIO so that
-+	 * all allocations done by this process (including pagetables) are done
-+	 * as if GFP_NOIO was specified.
-+	 */
-+
-+	if (gfp_mask & __GFP_NORETRY)
-+		noio_flag = memalloc_noio_save();
-+
-+	ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
-+
-+	if (gfp_mask & __GFP_NORETRY)
-+		memalloc_noio_restore(noio_flag);
-+
-+	return ptr;
- }
- 
- /*
-diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
-index 1074409..6feaba2 100644
---- a/drivers/md/dm-cache-target.c
-+++ b/drivers/md/dm-cache-target.c
-@@ -1971,6 +1971,7 @@ static int cache_create(struct cache_args *ca, struct cache **result)
- 	atomic_set(&cache->nr_migrations, 0);
- 	init_waitqueue_head(&cache->migration_wait);
- 
-+	r = -ENOMEM;
- 	cache->nr_dirty = 0;
- 	cache->dirty_bitset = alloc_bitset(from_cblock(cache->cache_size));
- 	if (!cache->dirty_bitset) {
-diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
-index c0e0702..c434e5a 100644
---- a/drivers/md/dm-snap.c
-+++ b/drivers/md/dm-snap.c
-@@ -1121,6 +1121,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
- 	s->pending_pool = mempool_create_slab_pool(MIN_IOS, pending_cache);
- 	if (!s->pending_pool) {
- 		ti->error = "Could not allocate mempool for pending exceptions";
-+		r = -ENOMEM;
- 		goto bad_pending_pool;
- 	}
- 
-diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
-index d8837d3..7b8b2b9 100644
---- a/drivers/md/dm-stripe.c
-+++ b/drivers/md/dm-stripe.c
-@@ -94,7 +94,7 @@ static int get_stripe(struct dm_target *ti, struct stripe_c *sc,
- static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
- {
- 	struct stripe_c *sc;
--	sector_t width;
-+	sector_t width, tmp_len;
- 	uint32_t stripes;
- 	uint32_t chunk_size;
- 	int r;
-@@ -116,15 +116,16 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
- 	}
- 
- 	width = ti->len;
--	if (sector_div(width, chunk_size)) {
-+	if (sector_div(width, stripes)) {
- 		ti->error = "Target length not divisible by "
--		    "chunk size";
-+		    "number of stripes";
- 		return -EINVAL;
- 	}
- 
--	if (sector_div(width, stripes)) {
-+	tmp_len = width;
-+	if (sector_div(tmp_len, chunk_size)) {
- 		ti->error = "Target length not divisible by "
--		    "number of stripes";
-+		    "chunk size";
- 		return -EINVAL;
- 	}
- 
-diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
-index e50dad0..1ff252a 100644
---- a/drivers/md/dm-table.c
-+++ b/drivers/md/dm-table.c
-@@ -1442,7 +1442,7 @@ static bool dm_table_supports_write_same(struct dm_table *t)
- 			return false;
- 
- 		if (!ti->type->iterate_devices ||
--		    !ti->type->iterate_devices(ti, device_not_write_same_capable, NULL))
-+		    ti->type->iterate_devices(ti, device_not_write_same_capable, NULL))
- 			return false;
- 	}
- 
-diff --git a/drivers/net/ethernet/3com/3c509.c b/drivers/net/ethernet/3com/3c509.c
-index f36ff99..adb4bf5 100644
---- a/drivers/net/ethernet/3com/3c509.c
-+++ b/drivers/net/ethernet/3com/3c509.c
-@@ -306,6 +306,7 @@ static int el3_isa_match(struct device *pdev, unsigned int ndev)
- 	if (!dev)
- 		return -ENOMEM;
- 
-+	SET_NETDEV_DEV(dev, pdev);
- 	netdev_boot_setup_check(dev);
- 
- 	if (!request_region(ioaddr, EL3_IO_EXTENT, "3c509-isa")) {
-@@ -595,6 +596,7 @@ static int __init el3_eisa_probe (struct device *device)
- 		return -ENOMEM;
- 	}
- 
-+	SET_NETDEV_DEV(dev, device);
- 	netdev_boot_setup_check(dev);
- 
- 	el3_dev_fill(dev, phys_addr, ioaddr, irq, if_port, EL3_EISA);
-diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
-index 1928e20..072c6f1 100644
---- a/drivers/net/ethernet/3com/3c59x.c
-+++ b/drivers/net/ethernet/3com/3c59x.c
-@@ -632,7 +632,6 @@ struct vortex_private {
- 		pm_state_valid:1,				/* pci_dev->saved_config_space has sane contents */
- 		open:1,
- 		medialock:1,
--		must_free_region:1,				/* Flag: if zero, Cardbus owns the I/O region */
- 		large_frames:1,			/* accept large frames */
- 		handling_irq:1;			/* private in_irq indicator */
- 	/* {get|set}_wol operations are already serialized by rtnl.
-@@ -951,7 +950,7 @@ static int vortex_eisa_remove(struct device *device)
- 
- 	unregister_netdev(dev);
- 	iowrite16(TotalReset|0x14, ioaddr + EL3_CMD);
--	release_region(dev->base_addr, VORTEX_TOTAL_SIZE);
-+	release_region(edev->base_addr, VORTEX_TOTAL_SIZE);
- 
- 	free_netdev(dev);
- 	return 0;
-@@ -1012,6 +1011,12 @@ static int vortex_init_one(struct pci_dev *pdev,
- 	if (rc < 0)
- 		goto out;
- 
-+	rc = pci_request_regions(pdev, DRV_NAME);
-+	if (rc < 0) {
-+		pci_disable_device(pdev);
-+		goto out;
-+	}
-+
- 	unit = vortex_cards_found;
- 
- 	if (global_use_mmio < 0 && (unit >= MAX_UNITS || use_mmio[unit] < 0)) {
-@@ -1027,6 +1032,7 @@ static int vortex_init_one(struct pci_dev *pdev,
- 	if (!ioaddr) /* If mapping fails, fall-back to BAR 0... */
- 		ioaddr = pci_iomap(pdev, 0, 0);
- 	if (!ioaddr) {
-+		pci_release_regions(pdev);
- 		pci_disable_device(pdev);
- 		rc = -ENOMEM;
- 		goto out;
-@@ -1036,6 +1042,7 @@ static int vortex_init_one(struct pci_dev *pdev,
- 			   ent->driver_data, unit);
- 	if (rc < 0) {
- 		pci_iounmap(pdev, ioaddr);
-+		pci_release_regions(pdev);
- 		pci_disable_device(pdev);
- 		goto out;
- 	}
-@@ -1178,11 +1185,6 @@ static int vortex_probe1(struct device *gendev, void __iomem *ioaddr, int irq,
- 
- 	/* PCI-only startup logic */
- 	if (pdev) {
--		/* EISA resources already marked, so only PCI needs to do this here */
--		/* Ignore return value, because Cardbus drivers already allocate for us */
--		if (request_region(dev->base_addr, vci->io_size, print_name) != NULL)
--			vp->must_free_region = 1;
--
- 		/* enable bus-mastering if necessary */
- 		if (vci->flags & PCI_USES_MASTER)
- 			pci_set_master(pdev);
-@@ -1220,7 +1222,7 @@ static int vortex_probe1(struct device *gendev, void __iomem *ioaddr, int irq,
- 					   &vp->rx_ring_dma);
- 	retval = -ENOMEM;
- 	if (!vp->rx_ring)
--		goto free_region;
-+		goto free_device;
- 
- 	vp->tx_ring = (struct boom_tx_desc *)(vp->rx_ring + RX_RING_SIZE);
- 	vp->tx_ring_dma = vp->rx_ring_dma + sizeof(struct boom_rx_desc) * RX_RING_SIZE;
-@@ -1484,9 +1486,7 @@ free_ring:
- 							+ sizeof(struct boom_tx_desc) * TX_RING_SIZE,
- 						vp->rx_ring,
- 						vp->rx_ring_dma);
--free_region:
--	if (vp->must_free_region)
--		release_region(dev->base_addr, vci->io_size);
-+free_device:
- 	free_netdev(dev);
- 	pr_err(PFX "vortex_probe1 fails.  Returns %d\n", retval);
- out:
-@@ -3254,8 +3254,9 @@ static void vortex_remove_one(struct pci_dev *pdev)
- 							+ sizeof(struct boom_tx_desc) * TX_RING_SIZE,
- 						vp->rx_ring,
- 						vp->rx_ring_dma);
--	if (vp->must_free_region)
--		release_region(dev->base_addr, vp->io_size);
-+
-+	pci_release_regions(pdev);
-+
- 	free_netdev(dev);
- }
- 
-diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
-index 0095ce9..97dd8f18 100644
---- a/drivers/net/ethernet/sfc/mcdi.c
-+++ b/drivers/net/ethernet/sfc/mcdi.c
-@@ -667,7 +667,7 @@ fail:
- int efx_mcdi_get_board_cfg(struct efx_nic *efx, u8 *mac_address,
- 			   u16 *fw_subtype_list, u32 *capabilities)
- {
--	uint8_t outbuf[MC_CMD_GET_BOARD_CFG_OUT_LENMIN];
-+	uint8_t outbuf[MC_CMD_GET_BOARD_CFG_OUT_LENMAX];
- 	size_t outlen, offset, i;
- 	int port_num = efx_port_num(efx);
- 	int rc;
-diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
-index 66e025a..f3c2d03 100644
---- a/drivers/net/ethernet/tile/tilegx.c
-+++ b/drivers/net/ethernet/tile/tilegx.c
-@@ -930,7 +930,7 @@ static int tile_net_setup_interrupts(struct net_device *dev)
- 		if (info->has_iqueue) {
- 			gxio_mpipe_request_notif_ring_interrupt(
- 				&context, cpu_x(cpu), cpu_y(cpu),
--				1, ingress_irq, info->iqueue.ring);
-+				KERNEL_PL, ingress_irq, info->iqueue.ring);
- 		}
- 	}
- 
-diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
-index 73abbc1..011062e 100644
---- a/drivers/net/macvlan.c
-+++ b/drivers/net/macvlan.c
-@@ -222,7 +222,8 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
- 	}
- 
- 	if (port->passthru)
--		vlan = list_first_entry(&port->vlans, struct macvlan_dev, list);
-+		vlan = list_first_or_null_rcu(&port->vlans,
-+					      struct macvlan_dev, list);
- 	else
- 		vlan = macvlan_hash_lookup(port, eth->h_dest);
- 	if (vlan == NULL)
-@@ -807,7 +808,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
- 	if (err < 0)
- 		goto upper_dev_unlink;
- 
--	list_add_tail(&vlan->list, &port->vlans);
-+	list_add_tail_rcu(&vlan->list, &port->vlans);
- 	netif_stacked_transfer_operstate(lowerdev, dev);
- 
- 	return 0;
-@@ -835,7 +836,7 @@ void macvlan_dellink(struct net_device *dev, struct list_head *head)
- {
- 	struct macvlan_dev *vlan = netdev_priv(dev);
- 
--	list_del(&vlan->list);
-+	list_del_rcu(&vlan->list);
- 	unregister_netdevice_queue(dev, head);
- 	netdev_upper_dev_unlink(vlan->lowerdev, dev);
- }
-diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index 729ed53..755fa9e 100644
---- a/drivers/net/tun.c
-+++ b/drivers/net/tun.c
-@@ -1471,14 +1471,17 @@ static int tun_recvmsg(struct kiocb *iocb, struct socket *sock,
- 	if (!tun)
- 		return -EBADFD;
- 
--	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC))
--		return -EINVAL;
-+	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC)) {
-+		ret = -EINVAL;
-+		goto out;
-+	}
- 	ret = tun_do_read(tun, tfile, iocb, m->msg_iov, total_len,
- 			  flags & MSG_DONTWAIT);
- 	if (ret > total_len) {
- 		m->msg_flags |= MSG_TRUNC;
- 		ret = flags & MSG_TRUNC ? ret : total_len;
- 	}
-+out:
- 	tun_put(tun);
- 	return ret;
- }
-diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
-index f7f623a..577c72d 100644
---- a/drivers/net/usb/asix_common.c
-+++ b/drivers/net/usb/asix_common.c
-@@ -100,6 +100,9 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
- 			netdev_err(dev->net, "asix_rx_fixup() Bad RX Length %d\n",
- 				   rx->size);
- 			kfree_skb(rx->ax_skb);
-+			rx->ax_skb = NULL;
-+			rx->size = 0U;
-+
- 			return 0;
- 		}
- 
-diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
-index 988372d..e509c37 100644
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1308,6 +1308,7 @@ static int ath9k_sta_add(struct ieee80211_hw *hw,
- 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
- 	struct ath_node *an = (struct ath_node *) sta->drv_priv;
- 	struct ieee80211_key_conf ps_key = { };
-+	int key;
- 
- 	ath_node_attach(sc, sta, vif);
- 
-@@ -1315,7 +1316,9 @@ static int ath9k_sta_add(struct ieee80211_hw *hw,
- 	    vif->type != NL80211_IFTYPE_AP_VLAN)
- 		return 0;
- 
--	an->ps_key = ath_key_config(common, vif, sta, &ps_key);
-+	key = ath_key_config(common, vif, sta, &ps_key);
-+	if (key > 0)
-+		an->ps_key = key;
- 
- 	return 0;
- }
-@@ -1332,6 +1335,7 @@ static void ath9k_del_ps_key(struct ath_softc *sc,
- 	    return;
- 
- 	ath_key_delete(common, &ps_key);
-+	an->ps_key = 0;
- }
- 
- static int ath9k_sta_remove(struct ieee80211_hw *hw,
-diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
-index 1221469..ee3d640 100644
---- a/drivers/net/wireless/b43/dma.c
-+++ b/drivers/net/wireless/b43/dma.c
-@@ -1733,6 +1733,25 @@ drop_recycle_buffer:
- 	sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
- }
- 
-+void b43_dma_handle_rx_overflow(struct b43_dmaring *ring)
-+{
-+	int current_slot, previous_slot;
-+
-+	B43_WARN_ON(ring->tx);
-+
-+	/* Device has filled all buffers, drop all packets and let TCP
-+	 * decrease speed.
-+	 * Decrement RX index by one will let the device to see all slots
-+	 * as free again
-+	 */
-+	/*
-+	*TODO: How to increase rx_drop in mac80211?
-+	*/
-+	current_slot = ring->ops->get_current_rxslot(ring);
-+	previous_slot = prev_slot(ring, current_slot);
-+	ring->ops->set_current_rxslot(ring, previous_slot);
-+}
-+
- void b43_dma_rx(struct b43_dmaring *ring)
- {
- 	const struct b43_dma_ops *ops = ring->ops;
-diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
-index 9fdd198..df8c8cd 100644
---- a/drivers/net/wireless/b43/dma.h
-+++ b/drivers/net/wireless/b43/dma.h
-@@ -9,7 +9,7 @@
- /* DMA-Interrupt reasons. */
- #define B43_DMAIRQ_FATALMASK	((1 << 10) | (1 << 11) | (1 << 12) \
- 					 | (1 << 14) | (1 << 15))
--#define B43_DMAIRQ_NONFATALMASK	(1 << 13)
-+#define B43_DMAIRQ_RDESC_UFLOW		(1 << 13)
- #define B43_DMAIRQ_RX_DONE		(1 << 16)
- 
- /*** 32-bit DMA Engine. ***/
-@@ -295,6 +295,8 @@ int b43_dma_tx(struct b43_wldev *dev,
- void b43_dma_handle_txstatus(struct b43_wldev *dev,
- 			     const struct b43_txstatus *status);
- 
-+void b43_dma_handle_rx_overflow(struct b43_dmaring *ring);
-+
- void b43_dma_rx(struct b43_dmaring *ring);
- 
- void b43_dma_direct_fifo_rx(struct b43_wldev *dev,
-diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
-index 0568273..64b637a 100644
---- a/drivers/net/wireless/b43/main.c
-+++ b/drivers/net/wireless/b43/main.c
-@@ -1895,30 +1895,18 @@ static void b43_do_interrupt_thread(struct b43_wldev *dev)
- 		}
- 	}
- 
--	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
--					  B43_DMAIRQ_NONFATALMASK))) {
--		if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
--			b43err(dev->wl, "Fatal DMA error: "
--			       "0x%08X, 0x%08X, 0x%08X, "
--			       "0x%08X, 0x%08X, 0x%08X\n",
--			       dma_reason[0], dma_reason[1],
--			       dma_reason[2], dma_reason[3],
--			       dma_reason[4], dma_reason[5]);
--			b43err(dev->wl, "This device does not support DMA "
-+	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK))) {
-+		b43err(dev->wl,
-+			"Fatal DMA error: 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
-+			dma_reason[0], dma_reason[1],
-+			dma_reason[2], dma_reason[3],
-+			dma_reason[4], dma_reason[5]);
-+		b43err(dev->wl, "This device does not support DMA "
- 			       "on your system. It will now be switched to PIO.\n");
--			/* Fall back to PIO transfers if we get fatal DMA errors! */
--			dev->use_pio = true;
--			b43_controller_restart(dev, "DMA error");
--			return;
--		}
--		if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
--			b43err(dev->wl, "DMA error: "
--			       "0x%08X, 0x%08X, 0x%08X, "
--			       "0x%08X, 0x%08X, 0x%08X\n",
--			       dma_reason[0], dma_reason[1],
--			       dma_reason[2], dma_reason[3],
--			       dma_reason[4], dma_reason[5]);
--		}
-+		/* Fall back to PIO transfers if we get fatal DMA errors! */
-+		dev->use_pio = true;
-+		b43_controller_restart(dev, "DMA error");
-+		return;
- 	}
- 
- 	if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
-@@ -1937,6 +1925,11 @@ static void b43_do_interrupt_thread(struct b43_wldev *dev)
- 		handle_irq_noise(dev);
- 
- 	/* Check the DMA reason registers for received data. */
-+	if (dma_reason[0] & B43_DMAIRQ_RDESC_UFLOW) {
-+		if (B43_DEBUG)
-+			b43warn(dev->wl, "RX descriptor underrun\n");
-+		b43_dma_handle_rx_overflow(dev->dma.rx_ring);
-+	}
- 	if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
- 		if (b43_using_pio_transfers(dev))
- 			b43_pio_rx(dev->pio.rx_queue);
-@@ -1994,7 +1987,7 @@ static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
- 		return IRQ_NONE;
- 
- 	dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
--	    & 0x0001DC00;
-+	    & 0x0001FC00;
- 	dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
- 	    & 0x0000DC00;
- 	dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
-@@ -3126,7 +3119,7 @@ static int b43_chip_init(struct b43_wldev *dev)
- 		b43_write32(dev, 0x018C, 0x02000000);
- 	}
- 	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
--	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
-+	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001FC00);
- 	b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
- 	b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
- 	b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
-diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
-index 7941eb3..cbaa777 100644
---- a/drivers/net/wireless/iwlegacy/4965-mac.c
-+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
-@@ -5740,8 +5740,7 @@ il4965_mac_setup_register(struct il_priv *il, u32 max_probe_length)
- 	hw->flags =
- 	    IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_AMPDU_AGGREGATION |
- 	    IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC | IEEE80211_HW_SPECTRUM_MGMT |
--	    IEEE80211_HW_REPORTS_TX_ACK_STATUS | IEEE80211_HW_SUPPORTS_PS |
--	    IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
-+	    IEEE80211_HW_SUPPORTS_PS | IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
- 	if (il->cfg->sku & IL_SKU_N)
- 		hw->flags |=
- 		    IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
-diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
-index 8aaf56a..c13f6e9 100644
---- a/drivers/net/wireless/mwifiex/cfg80211.c
-+++ b/drivers/net/wireless/mwifiex/cfg80211.c
-@@ -2280,9 +2280,6 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
- 	if (wdev->netdev->reg_state == NETREG_REGISTERED)
- 		unregister_netdevice(wdev->netdev);
- 
--	if (wdev->netdev->reg_state == NETREG_UNREGISTERED)
--		free_netdev(wdev->netdev);
--
- 	/* Clear the priv in adapter */
- 	priv->netdev = NULL;
- 
-diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
-index b5c8b96..aeade10 100644
---- a/drivers/net/wireless/mwifiex/cmdevt.c
-+++ b/drivers/net/wireless/mwifiex/cmdevt.c
-@@ -1176,6 +1176,7 @@ mwifiex_process_hs_config(struct mwifiex_adapter *adapter)
- 	adapter->if_ops.wakeup(adapter);
- 	adapter->hs_activated = false;
- 	adapter->is_hs_configured = false;
-+	adapter->is_suspended = false;
- 	mwifiex_hs_activated_event(mwifiex_get_priv(adapter,
- 						    MWIFIEX_BSS_ROLE_ANY),
- 				   false);
-diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
-index 9c802ed..6d9bc63 100644
---- a/drivers/net/wireless/mwifiex/main.c
-+++ b/drivers/net/wireless/mwifiex/main.c
-@@ -646,6 +646,7 @@ void mwifiex_init_priv_params(struct mwifiex_private *priv,
- 						struct net_device *dev)
- {
- 	dev->netdev_ops = &mwifiex_netdev_ops;
-+	dev->destructor = free_netdev;
- 	/* Initialize private structure */
- 	priv->current_key_index = 0;
- 	priv->media_connected = false;
-diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
-index 13100f8..fb420fe 100644
---- a/drivers/net/wireless/mwifiex/sta_ioctl.c
-+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
-@@ -99,7 +99,7 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
- 	} else {
- 		/* Multicast */
- 		priv->curr_pkt_filter &= ~HostCmd_ACT_MAC_PROMISCUOUS_ENABLE;
--		if (mcast_list->mode == MWIFIEX_MULTICAST_MODE) {
-+		if (mcast_list->mode == MWIFIEX_ALL_MULTI_MODE) {
- 			dev_dbg(priv->adapter->dev,
- 				"info: Enabling All Multicast!\n");
- 			priv->curr_pkt_filter |=
-@@ -111,20 +111,11 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
- 				dev_dbg(priv->adapter->dev,
- 					"info: Set multicast list=%d\n",
- 				       mcast_list->num_multicast_addr);
--				/* Set multicast addresses to firmware */
--				if (old_pkt_filter == priv->curr_pkt_filter) {
--					/* Send request to firmware */
--					ret = mwifiex_send_cmd_async(priv,
--						HostCmd_CMD_MAC_MULTICAST_ADR,
--						HostCmd_ACT_GEN_SET, 0,
--						mcast_list);
--				} else {
--					/* Send request to firmware */
--					ret = mwifiex_send_cmd_async(priv,
--						HostCmd_CMD_MAC_MULTICAST_ADR,
--						HostCmd_ACT_GEN_SET, 0,
--						mcast_list);
--				}
-+				/* Send multicast addresses to firmware */
-+				ret = mwifiex_send_cmd_async(priv,
-+					HostCmd_CMD_MAC_MULTICAST_ADR,
-+					HostCmd_ACT_GEN_SET, 0,
-+					mcast_list);
- 			}
- 		}
- 	}
-diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
-index e64a7a8..a8e43cf 100644
---- a/drivers/platform/x86/hp_accel.c
-+++ b/drivers/platform/x86/hp_accel.c
-@@ -362,7 +362,8 @@ static int lis3lv02d_suspend(struct device *dev)
- 
- static int lis3lv02d_resume(struct device *dev)
- {
--	return lis3lv02d_poweron(&lis3_dev);
-+	lis3lv02d_poweron(&lis3_dev);
-+	return 0;
- }
- 
- static SIMPLE_DEV_PM_OPS(hp_accel_pm, lis3lv02d_suspend, lis3lv02d_resume);
-diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
-index 79fbe38..9e95473 100644
---- a/drivers/rtc/Kconfig
-+++ b/drivers/rtc/Kconfig
-@@ -20,7 +20,6 @@ if RTC_CLASS
- config RTC_HCTOSYS
- 	bool "Set system time from RTC on startup and resume"
- 	default y
--	depends on !ALWAYS_USE_PERSISTENT_CLOCK
- 	help
- 	  If you say yes here, the system time (wall clock) will be set using
- 	  the value read from a specified RTC device. This is useful to avoid
-@@ -29,7 +28,6 @@ config RTC_HCTOSYS
- config RTC_SYSTOHC
- 	bool "Set the RTC time based on NTP synchronization"
- 	default y
--	depends on !ALWAYS_USE_PERSISTENT_CLOCK
- 	help
- 	  If you say yes here, the system time (wall clock) will be stored
- 	  in the RTC specified by RTC_HCTOSYS_DEVICE approximately every 11
-diff --git a/drivers/rtc/rtc-pcf2123.c b/drivers/rtc/rtc-pcf2123.c
-index 02b742a..6dd6b38 100644
---- a/drivers/rtc/rtc-pcf2123.c
-+++ b/drivers/rtc/rtc-pcf2123.c
-@@ -265,6 +265,7 @@ static int pcf2123_probe(struct spi_device *spi)
- 
- 	if (!(rxbuf[0] & 0x20)) {
- 		dev_err(&spi->dev, "chip not found\n");
-+		ret = -ENODEV;
- 		goto kfree_exit;
- 	}
- 
-diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
-index 7992635..82910cc 100644
---- a/drivers/scsi/sd.c
-+++ b/drivers/scsi/sd.c
-@@ -142,6 +142,7 @@ sd_store_cache_type(struct device *dev, struct device_attribute *attr,
- 	char *buffer_data;
- 	struct scsi_mode_data data;
- 	struct scsi_sense_hdr sshdr;
-+	const char *temp = "temporary ";
- 	int len;
- 
- 	if (sdp->type != TYPE_DISK)
-@@ -150,6 +151,13 @@ sd_store_cache_type(struct device *dev, struct device_attribute *attr,
- 		 * it's not worth the risk */
- 		return -EINVAL;
- 
-+	if (strncmp(buf, temp, sizeof(temp) - 1) == 0) {
-+		buf += sizeof(temp) - 1;
-+		sdkp->cache_override = 1;
-+	} else {
-+		sdkp->cache_override = 0;
-+	}
-+
- 	for (i = 0; i < ARRAY_SIZE(sd_cache_types); i++) {
- 		len = strlen(sd_cache_types[i]);
- 		if (strncmp(sd_cache_types[i], buf, len) == 0 &&
-@@ -162,6 +170,13 @@ sd_store_cache_type(struct device *dev, struct device_attribute *attr,
- 		return -EINVAL;
- 	rcd = ct & 0x01 ? 1 : 0;
- 	wce = ct & 0x02 ? 1 : 0;
-+
-+	if (sdkp->cache_override) {
-+		sdkp->WCE = wce;
-+		sdkp->RCD = rcd;
-+		return count;
-+	}
-+
- 	if (scsi_mode_sense(sdp, 0x08, 8, buffer, sizeof(buffer), SD_TIMEOUT,
- 			    SD_MAX_RETRIES, &data, NULL))
- 		return -EINVAL;
-@@ -2319,6 +2334,10 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
- 	int old_rcd = sdkp->RCD;
- 	int old_dpofua = sdkp->DPOFUA;
- 
-+
-+	if (sdkp->cache_override)
-+		return;
-+
- 	first_len = 4;
- 	if (sdp->skip_ms_page_8) {
- 		if (sdp->type == TYPE_RBC)
-@@ -2812,6 +2831,7 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
- 	sdkp->capacity = 0;
- 	sdkp->media_present = 1;
- 	sdkp->write_prot = 0;
-+	sdkp->cache_override = 0;
- 	sdkp->WCE = 0;
- 	sdkp->RCD = 0;
- 	sdkp->ATO = 0;
-diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h
-index 74a1e4c..2386aeb 100644
---- a/drivers/scsi/sd.h
-+++ b/drivers/scsi/sd.h
-@@ -73,6 +73,7 @@ struct scsi_disk {
- 	u8		protection_type;/* Data Integrity Field */
- 	u8		provisioning_mode;
- 	unsigned	ATO : 1;	/* state of disk ATO bit */
-+	unsigned	cache_override : 1; /* temp override of WCE,RCD */
- 	unsigned	WCE : 1;	/* state of disk WCE bit */
- 	unsigned	RCD : 1;	/* state of disk RCD bit, unused */
- 	unsigned	DPOFUA : 1;	/* state of disk DPOFUA bit */
-diff --git a/drivers/target/iscsi/iscsi_target_erl1.c b/drivers/target/iscsi/iscsi_target_erl1.c
-index 0b52a23..805f3d2 100644
---- a/drivers/target/iscsi/iscsi_target_erl1.c
-+++ b/drivers/target/iscsi/iscsi_target_erl1.c
-@@ -819,7 +819,7 @@ static int iscsit_attach_ooo_cmdsn(
- 		/*
- 		 * CmdSN is greater than the tail of the list.
- 		 */
--		if (ooo_tail->cmdsn < ooo_cmdsn->cmdsn)
-+		if (iscsi_sna_lt(ooo_tail->cmdsn, ooo_cmdsn->cmdsn))
- 			list_add_tail(&ooo_cmdsn->ooo_list,
- 					&sess->sess_ooo_cmdsn_list);
- 		else {
-@@ -829,11 +829,12 @@ static int iscsit_attach_ooo_cmdsn(
- 			 */
- 			list_for_each_entry(ooo_tmp, &sess->sess_ooo_cmdsn_list,
- 						ooo_list) {
--				if (ooo_tmp->cmdsn < ooo_cmdsn->cmdsn)
-+				if (iscsi_sna_lt(ooo_tmp->cmdsn, ooo_cmdsn->cmdsn))
- 					continue;
- 
-+				/* Insert before this entry */
- 				list_add(&ooo_cmdsn->ooo_list,
--					&ooo_tmp->ooo_list);
-+					ooo_tmp->ooo_list.prev);
- 				break;
- 			}
- 		}
-diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
-index 17a6acb..ca4b219 100644
---- a/drivers/target/target_core_file.c
-+++ b/drivers/target/target_core_file.c
-@@ -148,13 +148,8 @@ static int fd_configure_device(struct se_device *dev)
- 	 */
- 	inode = file->f_mapping->host;
- 	if (S_ISBLK(inode->i_mode)) {
--		struct request_queue *q = bdev_get_queue(inode->i_bdev);
- 		unsigned long long dev_size;
- 
--		dev->dev_attrib.hw_block_size =
--			bdev_logical_block_size(inode->i_bdev);
--		dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q);
--
- 		/*
- 		 * Determine the number of bytes from i_size_read() minus
- 		 * one (1) logical sector from underlying struct block_device
-@@ -173,13 +168,12 @@ static int fd_configure_device(struct se_device *dev)
- 				" block_device\n");
- 			goto fail;
- 		}
--
--		dev->dev_attrib.hw_block_size = FD_BLOCKSIZE;
--		dev->dev_attrib.hw_max_sectors = FD_MAX_SECTORS;
- 	}
- 
- 	fd_dev->fd_block_size = dev->dev_attrib.hw_block_size;
- 
-+	dev->dev_attrib.hw_block_size = FD_BLOCKSIZE;
-+	dev->dev_attrib.hw_max_sectors = FD_MAX_SECTORS;
- 	dev->dev_attrib.hw_queue_depth = FD_MAX_DEVICE_QUEUE_DEPTH;
- 
- 	if (fd_dev->fbd_flags & FDBD_HAS_BUFFERED_IO_WCE) {
-diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
-index 8bcc514..e1af9d5 100644
---- a/drivers/target/target_core_iblock.c
-+++ b/drivers/target/target_core_iblock.c
-@@ -679,6 +679,8 @@ iblock_execute_rw(struct se_cmd *cmd)
- 				rw = WRITE_FUA;
- 			else if (!(q->flush_flags & REQ_FLUSH))
- 				rw = WRITE_FUA;
-+			else
-+				rw = WRITE;
- 		} else {
- 			rw = WRITE;
- 		}
-diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index 3243ea7..0d46276 100644
---- a/drivers/target/target_core_transport.c
-+++ b/drivers/target/target_core_transport.c
-@@ -2213,21 +2213,19 @@ static void target_release_cmd_kref(struct kref *kref)
- {
- 	struct se_cmd *se_cmd = container_of(kref, struct se_cmd, cmd_kref);
- 	struct se_session *se_sess = se_cmd->se_sess;
--	unsigned long flags;
- 
--	spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
- 	if (list_empty(&se_cmd->se_cmd_list)) {
--		spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
-+		spin_unlock(&se_sess->sess_cmd_lock);
- 		se_cmd->se_tfo->release_cmd(se_cmd);
- 		return;
- 	}
- 	if (se_sess->sess_tearing_down && se_cmd->cmd_wait_set) {
--		spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
-+		spin_unlock(&se_sess->sess_cmd_lock);
- 		complete(&se_cmd->cmd_wait_comp);
- 		return;
- 	}
- 	list_del(&se_cmd->se_cmd_list);
--	spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
-+	spin_unlock(&se_sess->sess_cmd_lock);
- 
- 	se_cmd->se_tfo->release_cmd(se_cmd);
- }
-@@ -2238,7 +2236,8 @@ static void target_release_cmd_kref(struct kref *kref)
-  */
- int target_put_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd)
- {
--	return kref_put(&se_cmd->cmd_kref, target_release_cmd_kref);
-+	return kref_put_spinlock_irqsave(&se_cmd->cmd_kref, target_release_cmd_kref,
-+			&se_sess->sess_cmd_lock);
- }
- EXPORT_SYMBOL(target_put_sess_cmd);
- 
-diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
-index 08b48bb..faf4e18 100644
---- a/drivers/watchdog/watchdog_dev.c
-+++ b/drivers/watchdog/watchdog_dev.c
-@@ -523,6 +523,7 @@ int watchdog_dev_register(struct watchdog_device *watchdog)
- 	int err, devno;
- 
- 	if (watchdog->id == 0) {
-+		old_wdd = watchdog;
- 		watchdog_miscdev.parent = watchdog->parent;
- 		err = misc_register(&watchdog_miscdev);
- 		if (err != 0) {
-@@ -531,9 +532,9 @@ int watchdog_dev_register(struct watchdog_device *watchdog)
- 			if (err == -EBUSY)
- 				pr_err("%s: a legacy watchdog module is probably present.\n",
- 					watchdog->info->identity);
-+			old_wdd = NULL;
- 			return err;
- 		}
--		old_wdd = watchdog;
- 	}
- 
- 	/* Fill in the data structures */
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index cf3025c..f3190ab 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -1994,7 +1994,11 @@ repeat:
- 		group = ac->ac_g_ex.fe_group;
- 
- 		for (i = 0; i < ngroups; group++, i++) {
--			if (group == ngroups)
-+			/*
-+			 * Artificially restricted ngroups for non-extent
-+			 * files makes group > ngroups possible on first loop.
-+			 */
-+			if (group >= ngroups)
- 				group = 0;
- 
- 			/* This now checks without needing the buddy page */
-diff --git a/fs/namei.c b/fs/namei.c
-index 57ae9c8..85e40d1 100644
---- a/fs/namei.c
-+++ b/fs/namei.c
-@@ -2740,7 +2740,7 @@ static int do_last(struct nameidata *nd, struct path *path,
- 		if (error)
- 			return error;
- 
--		audit_inode(name, dir, 0);
-+		audit_inode(name, dir, LOOKUP_PARENT);
- 		error = -EISDIR;
- 		/* trailing slashes? */
- 		if (nd->last.name[nd->last.len])
-diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
-index 8288b08..d401d01 100644
---- a/fs/nfsd/nfs4proc.c
-+++ b/fs/nfsd/nfs4proc.c
-@@ -271,6 +271,7 @@ static __be32
- do_open_fhandle(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
- {
- 	__be32 status;
-+	int accmode = 0;
- 
- 	/* We don't know the target directory, and therefore can not
- 	* set the change info
-@@ -284,9 +285,19 @@ do_open_fhandle(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_
- 
- 	open->op_truncate = (open->op_iattr.ia_valid & ATTR_SIZE) &&
- 		(open->op_iattr.ia_size == 0);
-+	/*
-+	 * In the delegation case, the client is telling us about an
-+	 * open that it *already* performed locally, some time ago.  We
-+	 * should let it succeed now if possible.
-+	 *
-+	 * In the case of a CLAIM_FH open, on the other hand, the client
-+	 * may be counting on us to enforce permissions (the Linux 4.1
-+	 * client uses this for normal opens, for example).
-+	 */
-+	if (open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH)
-+		accmode = NFSD_MAY_OWNER_OVERRIDE;
- 
--	status = do_open_permission(rqstp, current_fh, open,
--				    NFSD_MAY_OWNER_OVERRIDE);
-+	status = do_open_permission(rqstp, current_fh, open, accmode);
- 
- 	return status;
- }
-diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
-index 899ca26..4e9a21d 100644
---- a/fs/nfsd/nfs4recover.c
-+++ b/fs/nfsd/nfs4recover.c
-@@ -146,7 +146,7 @@ out_no_tfm:
-  * then disable recovery tracking.
-  */
- static void
--legacy_recdir_name_error(int error)
-+legacy_recdir_name_error(struct nfs4_client *clp, int error)
- {
- 	printk(KERN_ERR "NFSD: unable to generate recoverydir "
- 			"name (%d).\n", error);
-@@ -159,9 +159,7 @@ legacy_recdir_name_error(int error)
- 	if (error == -ENOENT) {
- 		printk(KERN_ERR "NFSD: disabling legacy clientid tracking. "
- 			"Reboot recovery will not function correctly!\n");
--
--		/* the argument is ignored by the legacy exit function */
--		nfsd4_client_tracking_exit(NULL);
-+		nfsd4_client_tracking_exit(clp->net);
- 	}
- }
- 
-@@ -184,7 +182,7 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
- 
- 	status = nfs4_make_rec_clidname(dname, &clp->cl_name);
- 	if (status)
--		return legacy_recdir_name_error(status);
-+		return legacy_recdir_name_error(clp, status);
- 
- 	status = nfs4_save_creds(&original_cred);
- 	if (status < 0)
-@@ -341,7 +339,7 @@ nfsd4_remove_clid_dir(struct nfs4_client *clp)
- 
- 	status = nfs4_make_rec_clidname(dname, &clp->cl_name);
- 	if (status)
--		return legacy_recdir_name_error(status);
-+		return legacy_recdir_name_error(clp, status);
- 
- 	status = mnt_want_write_file(nn->rec_file);
- 	if (status)
-@@ -601,7 +599,7 @@ nfsd4_check_legacy_client(struct nfs4_client *clp)
- 
- 	status = nfs4_make_rec_clidname(dname, &clp->cl_name);
- 	if (status) {
--		legacy_recdir_name_error(status);
-+		legacy_recdir_name_error(clp, status);
- 		return status;
- 	}
- 
-diff --git a/include/linux/audit.h b/include/linux/audit.h
-index 5a6d718..b4086cf 100644
---- a/include/linux/audit.h
-+++ b/include/linux/audit.h
-@@ -120,7 +120,7 @@ static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
- 				       unsigned long a1, unsigned long a2,
- 				       unsigned long a3)
- {
--	if (unlikely(!audit_dummy_context()))
-+	if (unlikely(current->audit_context))
- 		__audit_syscall_entry(arch, major, a0, a1, a2, a3);
- }
- static inline void audit_syscall_exit(void *pt_regs)
-@@ -390,6 +390,11 @@ static inline void audit_ptrace(struct task_struct *t)
- #define audit_signals 0
- #endif /* CONFIG_AUDITSYSCALL */
- 
-+static inline bool audit_loginuid_set(struct task_struct *tsk)
-+{
-+	return uid_valid(audit_get_loginuid(tsk));
-+}
-+
- #ifdef CONFIG_AUDIT
- /* These are defined in audit.c */
- 				/* Public API */
-diff --git a/include/linux/kref.h b/include/linux/kref.h
-index 4972e6e..7419c02 100644
---- a/include/linux/kref.h
-+++ b/include/linux/kref.h
-@@ -19,6 +19,7 @@
- #include <linux/atomic.h>
- #include <linux/kernel.h>
- #include <linux/mutex.h>
-+#include <linux/spinlock.h>
- 
- struct kref {
- 	atomic_t refcount;
-@@ -95,6 +96,38 @@ static inline int kref_put(struct kref *kref, void (*release)(struct kref *kref)
- 	return kref_sub(kref, 1, release);
- }
- 
-+/**
-+ * kref_put_spinlock_irqsave - decrement refcount for object.
-+ * @kref: object.
-+ * @release: pointer to the function that will clean up the object when the
-+ *	     last reference to the object is released.
-+ *	     This pointer is required, and it is not acceptable to pass kfree
-+ *	     in as this function.
-+ * @lock: lock to take in release case
-+ *
-+ * Behaves identical to kref_put with one exception.  If the reference count
-+ * drops to zero, the lock will be taken atomically wrt dropping the reference
-+ * count.  The release function has to call spin_unlock() without _irqrestore.
-+ */
-+static inline int kref_put_spinlock_irqsave(struct kref *kref,
-+		void (*release)(struct kref *kref),
-+		spinlock_t *lock)
-+{
-+	unsigned long flags;
-+
-+	WARN_ON(release == NULL);
-+	if (atomic_add_unless(&kref->refcount, -1, 1))
-+		return 0;
-+	spin_lock_irqsave(lock, flags);
-+	if (atomic_dec_and_test(&kref->refcount)) {
-+		release(kref);
-+		local_irq_restore(flags);
-+		return 1;
-+	}
-+	spin_unlock_irqrestore(lock, flags);
-+	return 0;
-+}
-+
- static inline int kref_put_mutex(struct kref *kref,
- 				 void (*release)(struct kref *kref),
- 				 struct mutex *lock)
-diff --git a/include/linux/time.h b/include/linux/time.h
-index d4835df..afcdc4b 100644
---- a/include/linux/time.h
-+++ b/include/linux/time.h
-@@ -117,14 +117,10 @@ static inline bool timespec_valid_strict(const struct timespec *ts)
- 
- extern bool persistent_clock_exist;
- 
--#ifdef ALWAYS_USE_PERSISTENT_CLOCK
--#define has_persistent_clock()	true
--#else
- static inline bool has_persistent_clock(void)
- {
- 	return persistent_clock_exist;
- }
--#endif
- 
- extern void read_persistent_clock(struct timespec *ts);
- extern void read_boot_clock(struct timespec *ts);
-diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
-index 0a1dcc2..ab3d0ac 100644
---- a/include/net/inet_frag.h
-+++ b/include/net/inet_frag.h
-@@ -135,14 +135,15 @@ static inline int sum_frag_mem_limit(struct netns_frags *nf)
- static inline void inet_frag_lru_move(struct inet_frag_queue *q)
- {
- 	spin_lock(&q->net->lru_lock);
--	list_move_tail(&q->lru_list, &q->net->lru_list);
-+	if (!list_empty(&q->lru_list))
-+		list_move_tail(&q->lru_list, &q->net->lru_list);
- 	spin_unlock(&q->net->lru_lock);
- }
- 
- static inline void inet_frag_lru_del(struct inet_frag_queue *q)
- {
- 	spin_lock(&q->net->lru_lock);
--	list_del(&q->lru_list);
-+	list_del_init(&q->lru_list);
- 	spin_unlock(&q->net->lru_lock);
- }
- 
-diff --git a/include/net/sock.h b/include/net/sock.h
-index 14f6e9d..0be480a 100644
---- a/include/net/sock.h
-+++ b/include/net/sock.h
-@@ -865,6 +865,18 @@ struct inet_hashinfo;
- struct raw_hashinfo;
- struct module;
- 
-+/*
-+ * caches using SLAB_DESTROY_BY_RCU should let .next pointer from nulls nodes
-+ * un-modified. Special care is taken when initializing object to zero.
-+ */
-+static inline void sk_prot_clear_nulls(struct sock *sk, int size)
-+{
-+	if (offsetof(struct sock, sk_node.next) != 0)
-+		memset(sk, 0, offsetof(struct sock, sk_node.next));
-+	memset(&sk->sk_node.pprev, 0,
-+	       size - offsetof(struct sock, sk_node.pprev));
-+}
-+
- /* Networking protocol blocks we attach to sockets.
-  * socket layer -> transport layer interface
-  * transport -> network interface is defined by struct inet_proto
-diff --git a/include/net/tcp.h b/include/net/tcp.h
-index cf0694d..a345480 100644
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -1049,6 +1049,7 @@ static inline bool tcp_prequeue(struct sock *sk, struct sk_buff *skb)
- 	    skb_queue_len(&tp->ucopy.prequeue) == 0)
- 		return false;
- 
-+	skb_dst_force(skb);
- 	__skb_queue_tail(&tp->ucopy.prequeue, skb);
- 	tp->ucopy.memory += skb->truesize;
- 	if (tp->ucopy.memory > sk->sk_rcvbuf) {
-diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
-index 9f096f1..9554a19 100644
---- a/include/uapi/linux/audit.h
-+++ b/include/uapi/linux/audit.h
-@@ -246,6 +246,7 @@
- #define AUDIT_OBJ_TYPE	21
- #define AUDIT_OBJ_LEV_LOW	22
- #define AUDIT_OBJ_LEV_HIGH	23
-+#define AUDIT_LOGINUID_SET	24
- 
- 				/* These are ONLY useful when checking
- 				 * at syscall exit time (AUDIT_AT_EXIT). */
-diff --git a/include/uapi/linux/if_cablemodem.h b/include/uapi/linux/if_cablemodem.h
-index 9ca1007..ee6b3c4 100644
---- a/include/uapi/linux/if_cablemodem.h
-+++ b/include/uapi/linux/if_cablemodem.h
-@@ -12,11 +12,11 @@
-  */
- 
- /* some useful defines for sb1000.c e cmconfig.c - fv */
--#define SIOCGCMSTATS		SIOCDEVPRIVATE+0	/* get cable modem stats */
--#define SIOCGCMFIRMWARE		SIOCDEVPRIVATE+1	/* get cm firmware version */
--#define SIOCGCMFREQUENCY	SIOCDEVPRIVATE+2	/* get cable modem frequency */
--#define SIOCSCMFREQUENCY	SIOCDEVPRIVATE+3	/* set cable modem frequency */
--#define SIOCGCMPIDS			SIOCDEVPRIVATE+4	/* get cable modem PIDs */
--#define SIOCSCMPIDS			SIOCDEVPRIVATE+5	/* set cable modem PIDs */
-+#define SIOCGCMSTATS		(SIOCDEVPRIVATE+0)	/* get cable modem stats */
-+#define SIOCGCMFIRMWARE		(SIOCDEVPRIVATE+1)	/* get cm firmware version */
-+#define SIOCGCMFREQUENCY	(SIOCDEVPRIVATE+2)	/* get cable modem frequency */
-+#define SIOCSCMFREQUENCY	(SIOCDEVPRIVATE+3)	/* set cable modem frequency */
-+#define SIOCGCMPIDS			(SIOCDEVPRIVATE+4)	/* get cable modem PIDs */
-+#define SIOCSCMPIDS			(SIOCDEVPRIVATE+5)	/* set cable modem PIDs */
- 
- #endif
-diff --git a/include/uapi/linux/virtio_net.h b/include/uapi/linux/virtio_net.h
-index a5a8c88..c520203 100644
---- a/include/uapi/linux/virtio_net.h
-+++ b/include/uapi/linux/virtio_net.h
-@@ -191,7 +191,7 @@ struct virtio_net_ctrl_mac {
-  * specified.
-  */
- struct virtio_net_ctrl_mq {
--	u16 virtqueue_pairs;
-+	__u16 virtqueue_pairs;
- };
- 
- #define VIRTIO_NET_CTRL_MQ   4
-diff --git a/ipc/shm.c b/ipc/shm.c
-index 34af1fe..7e199fa 100644
---- a/ipc/shm.c
-+++ b/ipc/shm.c
-@@ -493,7 +493,13 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
- 	if (shmflg & SHM_HUGETLB) {
- 		struct hstate *hs = hstate_sizelog((shmflg >> SHM_HUGE_SHIFT)
- 						& SHM_HUGE_MASK);
--		size_t hugesize = ALIGN(size, huge_page_size(hs));
-+		size_t hugesize;
-+
-+		if (!hs) {
-+			error = -EINVAL;
-+			goto no_file;
-+		}
-+		hugesize = ALIGN(size, huge_page_size(hs));
- 
- 		/* hugetlb_file_setup applies strict accounting */
- 		if (shmflg & SHM_NORESERVE)
-diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
-index f9fc54b..2bf508d 100644
---- a/kernel/auditfilter.c
-+++ b/kernel/auditfilter.c
-@@ -345,6 +345,12 @@ static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
- 		f->uid = INVALID_UID;
- 		f->gid = INVALID_GID;
- 
-+		/* Support legacy tests for a valid loginuid */
-+		if ((f->type == AUDIT_LOGINUID) && (f->val == 4294967295U)) {
-+			f->type = AUDIT_LOGINUID_SET;
-+			f->val = 0;
-+		}
-+
- 		err = -EINVAL;
- 		if (f->op == Audit_bad)
- 			goto exit_free;
-@@ -352,6 +358,12 @@ static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
- 		switch(f->type) {
- 		default:
- 			goto exit_free;
-+		case AUDIT_LOGINUID_SET:
-+			if ((f->val != 0) && (f->val != 1))
-+				goto exit_free;
-+			if (f->op != Audit_not_equal && f->op != Audit_equal)
-+				goto exit_free;
-+			break;
- 		case AUDIT_UID:
- 		case AUDIT_EUID:
- 		case AUDIT_SUID:
-@@ -459,7 +471,20 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
- 		f->gid = INVALID_GID;
- 		f->lsm_str = NULL;
- 		f->lsm_rule = NULL;
--		switch(f->type) {
-+
-+		/* Support legacy tests for a valid loginuid */
-+		if ((f->type == AUDIT_LOGINUID) && (f->val == 4294967295U)) {
-+			f->type = AUDIT_LOGINUID_SET;
-+			f->val = 0;
-+		}
-+
-+		switch (f->type) {
-+		case AUDIT_LOGINUID_SET:
-+			if ((f->val != 0) && (f->val != 1))
-+				goto exit_free;
-+			if (f->op != Audit_not_equal && f->op != Audit_equal)
-+				goto exit_free;
-+			break;
- 		case AUDIT_UID:
- 		case AUDIT_EUID:
- 		case AUDIT_SUID:
-@@ -1378,6 +1403,10 @@ static int audit_filter_user_rules(struct audit_krule *rule,
- 			result = audit_uid_comparator(audit_get_loginuid(current),
- 						  f->op, f->uid);
- 			break;
-+		case AUDIT_LOGINUID_SET:
-+			result = audit_comparator(audit_loginuid_set(current),
-+						  f->op, f->val);
-+			break;
- 		case AUDIT_SUBJ_USER:
- 		case AUDIT_SUBJ_ROLE:
- 		case AUDIT_SUBJ_TYPE:
-diff --git a/kernel/auditsc.c b/kernel/auditsc.c
-index a371f85..c4b72b0 100644
---- a/kernel/auditsc.c
-+++ b/kernel/auditsc.c
-@@ -742,6 +742,9 @@ static int audit_filter_rules(struct task_struct *tsk,
- 			if (ctx)
- 				result = audit_uid_comparator(tsk->loginuid, f->op, f->uid);
- 			break;
-+		case AUDIT_LOGINUID_SET:
-+			result = audit_comparator(audit_loginuid_set(tsk), f->op, f->val);
-+			break;
- 		case AUDIT_SUBJ_USER:
- 		case AUDIT_SUBJ_ROLE:
- 		case AUDIT_SUBJ_TYPE:
-@@ -2309,7 +2312,7 @@ int audit_set_loginuid(kuid_t loginuid)
- 	unsigned int sessionid;
- 
- #ifdef CONFIG_AUDIT_LOGINUID_IMMUTABLE
--	if (uid_valid(task->loginuid))
-+	if (audit_loginuid_set(task))
- 		return -EPERM;
- #else /* CONFIG_AUDIT_LOGINUID_IMMUTABLE */
- 	if (!capable(CAP_AUDIT_CONTROL))
-diff --git a/kernel/kmod.c b/kernel/kmod.c
-index 56dd349..8985c87 100644
---- a/kernel/kmod.c
-+++ b/kernel/kmod.c
-@@ -570,6 +570,11 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait)
- 	int retval = 0;
- 
- 	helper_lock();
-+	if (!sub_info->path) {
-+		retval = -EINVAL;
-+		goto out;
-+	}
-+
- 	if (sub_info->path[0] == '\0')
- 		goto out;
- 
-diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
-index e93cca9..6af50ad 100644
---- a/kernel/sched/cputime.c
-+++ b/kernel/sched/cputime.c
-@@ -521,18 +521,49 @@ EXPORT_SYMBOL_GPL(vtime_account_irq_enter);
- 
- #else /* !CONFIG_VIRT_CPU_ACCOUNTING */
- 
--static cputime_t scale_stime(cputime_t stime, cputime_t rtime, cputime_t total)
-+/*
-+ * Perform (stime * rtime) / total, but avoid multiplication overflow by
-+ * loosing precision when the numbers are big.
-+ */
-+static cputime_t scale_stime(u64 stime, u64 rtime, u64 total)
- {
--	u64 temp = (__force u64) rtime;
-+	u64 scaled;
- 
--	temp *= (__force u64) stime;
-+	for (;;) {
-+		/* Make sure "rtime" is the bigger of stime/rtime */
-+		if (stime > rtime) {
-+			u64 tmp = rtime; rtime = stime; stime = tmp;
-+		}
- 
--	if (sizeof(cputime_t) == 4)
--		temp = div_u64(temp, (__force u32) total);
--	else
--		temp = div64_u64(temp, (__force u64) total);
-+		/* Make sure 'total' fits in 32 bits */
-+		if (total >> 32)
-+			goto drop_precision;
-+
-+		/* Does rtime (and thus stime) fit in 32 bits? */
-+		if (!(rtime >> 32))
-+			break;
- 
--	return (__force cputime_t) temp;
-+		/* Can we just balance rtime/stime rather than dropping bits? */
-+		if (stime >> 31)
-+			goto drop_precision;
-+
-+		/* We can grow stime and shrink rtime and try to make them both fit */
-+		stime <<= 1;
-+		rtime >>= 1;
-+		continue;
-+
-+drop_precision:
-+		/* We drop from rtime, it has more bits than stime */
-+		rtime >>= 1;
-+		total >>= 1;
-+	}
-+
-+	/*
-+	 * Make sure gcc understands that this is a 32x32->64 multiply,
-+	 * followed by a 64/32->64 divide.
-+	 */
-+	scaled = div_u64((u64) (u32) stime * (u64) (u32) rtime, (u32)total);
-+	return (__force cputime_t) scaled;
- }
- 
- /*
-@@ -543,7 +574,7 @@ static void cputime_adjust(struct task_cputime *curr,
- 			   struct cputime *prev,
- 			   cputime_t *ut, cputime_t *st)
- {
--	cputime_t rtime, stime, total;
-+	cputime_t rtime, stime, utime, total;
- 
- 	stime = curr->stime;
- 	total = stime + curr->utime;
-@@ -560,10 +591,22 @@ static void cputime_adjust(struct task_cputime *curr,
- 	 */
- 	rtime = nsecs_to_cputime(curr->sum_exec_runtime);
- 
--	if (total)
--		stime = scale_stime(stime, rtime, total);
--	else
-+	/*
-+	 * Update userspace visible utime/stime values only if actual execution
-+	 * time is bigger than already exported. Note that can happen, that we
-+	 * provided bigger values due to scaling inaccuracy on big numbers.
-+	 */
-+	if (prev->stime + prev->utime >= rtime)
-+		goto out;
-+
-+	if (total) {
-+		stime = scale_stime((__force u64)stime,
-+				    (__force u64)rtime, (__force u64)total);
-+		utime = rtime - stime;
-+	} else {
- 		stime = rtime;
-+		utime = 0;
-+	}
- 
- 	/*
- 	 * If the tick based count grows faster than the scheduler one,
-@@ -571,8 +614,9 @@ static void cputime_adjust(struct task_cputime *curr,
- 	 * Let's enforce monotonicity.
- 	 */
- 	prev->stime = max(prev->stime, stime);
--	prev->utime = max(prev->utime, rtime - prev->stime);
-+	prev->utime = max(prev->utime, utime);
- 
-+out:
- 	*ut = prev->utime;
- 	*st = prev->stime;
- }
-diff --git a/kernel/time/Kconfig b/kernel/time/Kconfig
-index 24510d8..b696922 100644
---- a/kernel/time/Kconfig
-+++ b/kernel/time/Kconfig
-@@ -12,11 +12,6 @@ config CLOCKSOURCE_WATCHDOG
- config ARCH_CLOCKSOURCE_DATA
- 	bool
- 
--# Platforms has a persistent clock
--config ALWAYS_USE_PERSISTENT_CLOCK
--	bool
--	default n
--
- # Timekeeping vsyscall support
- config GENERIC_TIME_VSYSCALL
- 	bool
-diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
-index a19a399..e717ad9 100644
---- a/kernel/time/tick-sched.c
-+++ b/kernel/time/tick-sched.c
-@@ -904,7 +904,7 @@ void tick_cancel_sched_timer(int cpu)
- 		hrtimer_cancel(&ts->sched_timer);
- # endif
- 
--	ts->nohz_mode = NOHZ_MODE_INACTIVE;
-+	memset(ts, 0, sizeof(*ts));
- }
- #endif
- 
-diff --git a/kernel/timer.c b/kernel/timer.c
-index dbf7a78..1b399c8 100644
---- a/kernel/timer.c
-+++ b/kernel/timer.c
-@@ -1678,12 +1678,12 @@ static int __cpuinit init_timers_cpu(int cpu)
- 			boot_done = 1;
- 			base = &boot_tvec_bases;
- 		}
-+		spin_lock_init(&base->lock);
- 		tvec_base_done[cpu] = 1;
- 	} else {
- 		base = per_cpu(tvec_bases, cpu);
- 	}
- 
--	spin_lock_init(&base->lock);
- 
- 	for (j = 0; j < TVN_SIZE; j++) {
- 		INIT_LIST_HEAD(base->tv5.vec + j);
-diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
-index e5b0ca8..5a8a53e 100644
---- a/kernel/trace/trace_events_filter.c
-+++ b/kernel/trace/trace_events_filter.c
-@@ -777,7 +777,11 @@ static int filter_set_pred(struct event_filter *filter,
- 
- static void __free_preds(struct event_filter *filter)
- {
-+	int i;
-+
- 	if (filter->preds) {
-+		for (i = 0; i < filter->n_preds; i++)
-+			kfree(filter->preds[i].ops);
- 		kfree(filter->preds);
- 		filter->preds = NULL;
- 	}
-diff --git a/mm/mmap.c b/mm/mmap.c
-index e17fc06..0dceed8 100644
---- a/mm/mmap.c
-+++ b/mm/mmap.c
-@@ -1331,9 +1331,13 @@ SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len,
- 			len = ALIGN(len, huge_page_size(hstate_file(file)));
- 	} else if (flags & MAP_HUGETLB) {
- 		struct user_struct *user = NULL;
-+		struct hstate *hs = hstate_sizelog((flags >> MAP_HUGE_SHIFT) &
-+						   SHM_HUGE_MASK);
- 
--		len = ALIGN(len, huge_page_size(hstate_sizelog(
--			(flags >> MAP_HUGE_SHIFT) & MAP_HUGE_MASK)));
-+		if (!hs)
-+			return -EINVAL;
-+
-+		len = ALIGN(len, huge_page_size(hs));
- 		/*
- 		 * VM_NORESERVE is used because the reservations will be
- 		 * taken when vm_ops->mmap() is called
-diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
-index 19cf81b..63bd98c 100644
---- a/net/8021q/vlan_dev.c
-+++ b/net/8021q/vlan_dev.c
-@@ -627,7 +627,7 @@ static netdev_features_t vlan_dev_fix_features(struct net_device *dev,
- 	netdev_features_t features)
- {
- 	struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
--	u32 old_features = features;
-+	netdev_features_t old_features = features;
- 
- 	features &= real_dev->vlan_features;
- 	features |= NETIF_F_RXCSUM;
-diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
-index c3530a8..950663d 100644
---- a/net/bridge/br_stp_timer.c
-+++ b/net/bridge/br_stp_timer.c
-@@ -107,7 +107,7 @@ static void br_tcn_timer_expired(unsigned long arg)
- 
- 	br_debug(br, "tcn timer expired\n");
- 	spin_lock(&br->lock);
--	if (br->dev->flags & IFF_UP) {
-+	if (!br_is_root_bridge(br) && (br->dev->flags & IFF_UP)) {
- 		br_transmit_tcn(br);
- 
- 		mod_timer(&br->tcn_timer,jiffies + br->bridge_hello_time);
-diff --git a/net/core/dev.c b/net/core/dev.c
-index b24ab0e9..9a278e9 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -2458,7 +2458,7 @@ EXPORT_SYMBOL(netif_skb_features);
-  *	2. skb is fragmented and the device does not support SG.
-  */
- static inline int skb_needs_linearize(struct sk_buff *skb,
--				      int features)
-+				      netdev_features_t features)
- {
- 	return skb_is_nonlinear(skb) &&
- 			((skb_has_frag_list(skb) &&
-diff --git a/net/core/ethtool.c b/net/core/ethtool.c
-index 3e9b2c3..41f4bdf 100644
---- a/net/core/ethtool.c
-+++ b/net/core/ethtool.c
-@@ -1416,7 +1416,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
- 	void __user *useraddr = ifr->ifr_data;
- 	u32 ethcmd;
- 	int rc;
--	u32 old_features;
-+	netdev_features_t old_features;
- 
- 	if (!dev || !netif_device_present(dev))
- 		return -ENODEV;
-diff --git a/net/core/sock.c b/net/core/sock.c
-index b261a79..1432266 100644
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -1209,18 +1209,6 @@ static void sock_copy(struct sock *nsk, const struct sock *osk)
- #endif
- }
- 
--/*
-- * caches using SLAB_DESTROY_BY_RCU should let .next pointer from nulls nodes
-- * un-modified. Special care is taken when initializing object to zero.
-- */
--static inline void sk_prot_clear_nulls(struct sock *sk, int size)
--{
--	if (offsetof(struct sock, sk_node.next) != 0)
--		memset(sk, 0, offsetof(struct sock, sk_node.next));
--	memset(&sk->sk_node.pprev, 0,
--	       size - offsetof(struct sock, sk_node.pprev));
--}
--
- void sk_prot_clear_portaddr_nulls(struct sock *sk, int size)
- {
- 	unsigned long nulls1, nulls2;
-diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
-index f4fd23d..3211914 100644
---- a/net/ipv4/inet_fragment.c
-+++ b/net/ipv4/inet_fragment.c
-@@ -257,6 +257,7 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
- 	setup_timer(&q->timer, f->frag_expire, (unsigned long)q);
- 	spin_lock_init(&q->lock);
- 	atomic_set(&q->refcnt, 1);
-+	INIT_LIST_HEAD(&q->lru_list);
- 
- 	return q;
- }
-diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
-index b83a49c..2f672e7 100644
---- a/net/ipv4/tcp_minisocks.c
-+++ b/net/ipv4/tcp_minisocks.c
-@@ -583,8 +583,13 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
- 		 *
- 		 * Note that even if there is new data in the SYN packet
- 		 * they will be thrown away too.
-+		 *
-+		 * Reset timer after retransmitting SYNACK, similar to
-+		 * the idea of fast retransmit in recovery.
- 		 */
--		inet_rtx_syn_ack(sk, req);
-+		if (!inet_rtx_syn_ack(sk, req))
-+			req->expires = min(TCP_TIMEOUT_INIT << req->num_timeout,
-+					   TCP_RTO_MAX) + jiffies;
- 		return NULL;
- 	}
- 
-diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
-index e4efffe..95d13c7 100644
---- a/net/ipv6/ip6_gre.c
-+++ b/net/ipv6/ip6_gre.c
-@@ -1135,6 +1135,7 @@ static int ip6gre_tunnel_ioctl(struct net_device *dev,
- 		}
- 		if (t == NULL)
- 			t = netdev_priv(dev);
-+		memset(&p, 0, sizeof(p));
- 		ip6gre_tnl_parm_to_user(&p, &t->parms);
- 		if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
- 			err = -EFAULT;
-@@ -1182,6 +1183,7 @@ static int ip6gre_tunnel_ioctl(struct net_device *dev,
- 		if (t) {
- 			err = 0;
- 
-+			memset(&p, 0, sizeof(p));
- 			ip6gre_tnl_parm_to_user(&p, &t->parms);
- 			if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
- 				err = -EFAULT;
-diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 46a5be8..0fce928 100644
---- a/net/ipv6/tcp_ipv6.c
-+++ b/net/ipv6/tcp_ipv6.c
-@@ -1937,6 +1937,17 @@ void tcp6_proc_exit(struct net *net)
- }
- #endif
- 
-+static void tcp_v6_clear_sk(struct sock *sk, int size)
-+{
-+	struct inet_sock *inet = inet_sk(sk);
-+
-+	/* we do not want to clear pinet6 field, because of RCU lookups */
-+	sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
-+
-+	size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
-+	memset(&inet->pinet6 + 1, 0, size);
-+}
-+
- struct proto tcpv6_prot = {
- 	.name			= "TCPv6",
- 	.owner			= THIS_MODULE,
-@@ -1980,6 +1991,7 @@ struct proto tcpv6_prot = {
- #ifdef CONFIG_MEMCG_KMEM
- 	.proto_cgroup		= tcp_proto_cgroup,
- #endif
-+	.clear_sk		= tcp_v6_clear_sk,
- };
- 
- static const struct inet6_protocol tcpv6_protocol = {
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index d8e5e85..27f0f8e 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -1422,6 +1422,17 @@ void udp6_proc_exit(struct net *net) {
- }
- #endif /* CONFIG_PROC_FS */
- 
-+void udp_v6_clear_sk(struct sock *sk, int size)
-+{
-+	struct inet_sock *inet = inet_sk(sk);
-+
-+	/* we do not want to clear pinet6 field, because of RCU lookups */
-+	sk_prot_clear_portaddr_nulls(sk, offsetof(struct inet_sock, pinet6));
-+
-+	size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
-+	memset(&inet->pinet6 + 1, 0, size);
-+}
-+
- /* ------------------------------------------------------------------------ */
- 
- struct proto udpv6_prot = {
-@@ -1452,7 +1463,7 @@ struct proto udpv6_prot = {
- 	.compat_setsockopt = compat_udpv6_setsockopt,
- 	.compat_getsockopt = compat_udpv6_getsockopt,
- #endif
--	.clear_sk	   = sk_prot_clear_portaddr_nulls,
-+	.clear_sk	   = udp_v6_clear_sk,
- };
- 
- static struct inet_protosw udpv6_protosw = {
-diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
-index d757104..4691ed5 100644
---- a/net/ipv6/udp_impl.h
-+++ b/net/ipv6/udp_impl.h
-@@ -31,6 +31,8 @@ extern int	udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
- extern int	udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb);
- extern void	udpv6_destroy_sock(struct sock *sk);
- 
-+extern void udp_v6_clear_sk(struct sock *sk, int size);
-+
- #ifdef CONFIG_PROC_FS
- extern int	udp6_seq_show(struct seq_file *seq, void *v);
- #endif
-diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
-index 1d08e21..dfcc4be 100644
---- a/net/ipv6/udplite.c
-+++ b/net/ipv6/udplite.c
-@@ -56,7 +56,7 @@ struct proto udplitev6_prot = {
- 	.compat_setsockopt = compat_udpv6_setsockopt,
- 	.compat_getsockopt = compat_udpv6_getsockopt,
- #endif
--	.clear_sk	   = sk_prot_clear_portaddr_nulls,
-+	.clear_sk	   = udp_v6_clear_sk,
- };
- 
- static struct inet_protosw udplite6_protosw = {
-diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
-index 4ef7bdb..23ed03d 100644
---- a/net/ipv6/xfrm6_policy.c
-+++ b/net/ipv6/xfrm6_policy.c
-@@ -103,8 +103,10 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
- 	dev_hold(dev);
- 
- 	xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
--	if (!xdst->u.rt6.rt6i_idev)
-+	if (!xdst->u.rt6.rt6i_idev) {
-+		dev_put(dev);
- 		return -ENODEV;
-+	}
- 
- 	rt6_transfer_peer(&xdst->u.rt6, rt);
- 
-diff --git a/net/mac802154/mac802154.h b/net/mac802154/mac802154.h
-index a4dcaf1..703c121 100644
---- a/net/mac802154/mac802154.h
-+++ b/net/mac802154/mac802154.h
-@@ -90,7 +90,7 @@ struct mac802154_sub_if_data {
- 
- #define MAC802154_MAX_XMIT_ATTEMPTS	3
- 
--#define MAC802154_CHAN_NONE		(~(u8)0) /* No channel is assigned */
-+#define MAC802154_CHAN_NONE		0xff /* No channel is assigned */
- 
- extern struct ieee802154_reduced_mlme_ops mac802154_mlme_reduced;
- extern struct ieee802154_mlme_ops mac802154_mlme_wpan;
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 1d6793d..f83e172 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -693,36 +693,33 @@ static void prb_open_block(struct tpacket_kbdq_core *pkc1,
- 
- 	smp_rmb();
- 
--	if (likely(TP_STATUS_KERNEL == BLOCK_STATUS(pbd1))) {
-+	/* We could have just memset this but we will lose the
-+	 * flexibility of making the priv area sticky
-+	 */
- 
--		/* We could have just memset this but we will lose the
--		 * flexibility of making the priv area sticky
--		 */
--		BLOCK_SNUM(pbd1) = pkc1->knxt_seq_num++;
--		BLOCK_NUM_PKTS(pbd1) = 0;
--		BLOCK_LEN(pbd1) = BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
--		getnstimeofday(&ts);
--		h1->ts_first_pkt.ts_sec = ts.tv_sec;
--		h1->ts_first_pkt.ts_nsec = ts.tv_nsec;
--		pkc1->pkblk_start = (char *)pbd1;
--		pkc1->nxt_offset = pkc1->pkblk_start + BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
--		BLOCK_O2FP(pbd1) = (__u32)BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
--		BLOCK_O2PRIV(pbd1) = BLK_HDR_LEN;
--		pbd1->version = pkc1->version;
--		pkc1->prev = pkc1->nxt_offset;
--		pkc1->pkblk_end = pkc1->pkblk_start + pkc1->kblk_size;
--		prb_thaw_queue(pkc1);
--		_prb_refresh_rx_retire_blk_timer(pkc1);
-+	BLOCK_SNUM(pbd1) = pkc1->knxt_seq_num++;
-+	BLOCK_NUM_PKTS(pbd1) = 0;
-+	BLOCK_LEN(pbd1) = BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
- 
--		smp_wmb();
-+	getnstimeofday(&ts);
- 
--		return;
--	}
-+	h1->ts_first_pkt.ts_sec = ts.tv_sec;
-+	h1->ts_first_pkt.ts_nsec = ts.tv_nsec;
- 
--	WARN(1, "ERROR block:%p is NOT FREE status:%d kactive_blk_num:%d\n",
--		pbd1, BLOCK_STATUS(pbd1), pkc1->kactive_blk_num);
--	dump_stack();
--	BUG();
-+	pkc1->pkblk_start = (char *)pbd1;
-+	pkc1->nxt_offset = pkc1->pkblk_start + BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
-+
-+	BLOCK_O2FP(pbd1) = (__u32)BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
-+	BLOCK_O2PRIV(pbd1) = BLK_HDR_LEN;
-+
-+	pbd1->version = pkc1->version;
-+	pkc1->prev = pkc1->nxt_offset;
-+	pkc1->pkblk_end = pkc1->pkblk_start + pkc1->kblk_size;
-+
-+	prb_thaw_queue(pkc1);
-+	_prb_refresh_rx_retire_blk_timer(pkc1);
-+
-+	smp_wmb();
- }
- 
- /*
-@@ -813,10 +810,6 @@ static void prb_retire_current_block(struct tpacket_kbdq_core *pkc,
- 		prb_close_block(pkc, pbd, po, status);
- 		return;
- 	}
--
--	WARN(1, "ERROR-pbd[%d]:%p\n", pkc->kactive_blk_num, pbd);
--	dump_stack();
--	BUG();
- }
- 
- static int prb_curr_blk_in_use(struct tpacket_kbdq_core *pkc,
-diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
-index e0f6de6..60d88b6 100644
---- a/net/sched/act_ipt.c
-+++ b/net/sched/act_ipt.c
-@@ -8,7 +8,7 @@
-  *		as published by the Free Software Foundation; either version
-  *		2 of the License, or (at your option) any later version.
-  *
-- * Copyright:	Jamal Hadi Salim (2002-4)
-+ * Copyright:	Jamal Hadi Salim (2002-13)
-  */
- 
- #include <linux/types.h>
-@@ -303,17 +303,44 @@ static struct tc_action_ops act_ipt_ops = {
- 	.walk		=	tcf_generic_walker
- };
- 
--MODULE_AUTHOR("Jamal Hadi Salim(2002-4)");
-+static struct tc_action_ops act_xt_ops = {
-+	.kind		=	"xt",
-+	.hinfo		=	&ipt_hash_info,
-+	.type		=	TCA_ACT_IPT,
-+	.capab		=	TCA_CAP_NONE,
-+	.owner		=	THIS_MODULE,
-+	.act		=	tcf_ipt,
-+	.dump		=	tcf_ipt_dump,
-+	.cleanup	=	tcf_ipt_cleanup,
-+	.lookup		=	tcf_hash_search,
-+	.init		=	tcf_ipt_init,
-+	.walk		=	tcf_generic_walker
-+};
-+
-+MODULE_AUTHOR("Jamal Hadi Salim(2002-13)");
- MODULE_DESCRIPTION("Iptables target actions");
- MODULE_LICENSE("GPL");
-+MODULE_ALIAS("act_xt");
- 
- static int __init ipt_init_module(void)
- {
--	return tcf_register_action(&act_ipt_ops);
-+	int ret1, ret2;
-+	ret1 = tcf_register_action(&act_xt_ops);
-+	if (ret1 < 0)
-+		printk("Failed to load xt action\n");
-+	ret2 = tcf_register_action(&act_ipt_ops);
-+	if (ret2 < 0)
-+		printk("Failed to load ipt action\n");
-+
-+	if (ret1 < 0 && ret2 < 0)
-+		return ret1;
-+	else
-+		return 0;
- }
- 
- static void __exit ipt_cleanup_module(void)
- {
-+	tcf_unregister_action(&act_xt_ops);
- 	tcf_unregister_action(&act_ipt_ops);
- }
- 
-diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
-index 7f93e2a..2e330e8 100644
---- a/net/vmw_vsock/af_vsock.c
-+++ b/net/vmw_vsock/af_vsock.c
-@@ -165,7 +165,7 @@ static struct list_head vsock_bind_table[VSOCK_HASH_SIZE + 1];
- static struct list_head vsock_connected_table[VSOCK_HASH_SIZE];
- static DEFINE_SPINLOCK(vsock_table_lock);
- 
--static __init void vsock_init_tables(void)
-+static void vsock_init_tables(void)
- {
- 	int i;
- 
-diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
-index 4aba764..c414cdd 100644
---- a/sound/pci/hda/hda_codec.c
-+++ b/sound/pci/hda/hda_codec.c
-@@ -681,6 +681,9 @@ int snd_hda_queue_unsol_event(struct hda_bus *bus, u32 res, u32 res_ex)
- 	struct hda_bus_unsolicited *unsol;
- 	unsigned int wp;
- 
-+	if (!bus || !bus->workq)
-+		return 0;
-+
- 	trace_hda_unsol_event(bus, res, res_ex);
- 	unsol = bus->unsol;
- 	if (!unsol)
-@@ -1577,7 +1580,7 @@ void snd_hda_codec_setup_stream(struct hda_codec *codec, hda_nid_t nid,
- 		    "NID=0x%x, stream=0x%x, channel=%d, format=0x%x\n",
- 		    nid, stream_tag, channel_id, format);
- 	p = get_hda_cvt_setup(codec, nid);
--	if (!p || p->active)
-+	if (!p)
- 		return;
- 
- 	if (codec->pcm_format_first)
-@@ -1624,7 +1627,7 @@ void __snd_hda_codec_cleanup_stream(struct hda_codec *codec, hda_nid_t nid,
- 
- 	snd_printdd("hda_codec_cleanup_stream: NID=0x%x\n", nid);
- 	p = get_hda_cvt_setup(codec, nid);
--	if (p && p->active) {
-+	if (p) {
- 		/* here we just clear the active flag when do_now isn't set;
- 		 * actual clean-ups will be done later in
- 		 * purify_inactive_streams() called from snd_hda_codec_prpapre()
-diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
-index 2a89d1ee..1e5a30f 100644
---- a/sound/pci/hda/patch_conexant.c
-+++ b/sound/pci/hda/patch_conexant.c
-@@ -64,6 +64,7 @@ struct conexant_spec {
- 	/* extra EAPD pins */
- 	unsigned int num_eapds;
- 	hda_nid_t eapds[4];
-+	bool dynamic_eapd;
- 
- #ifdef ENABLE_CXT_STATIC_QUIRKS
- 	const struct snd_kcontrol_new *mixers[5];
-@@ -3152,7 +3153,7 @@ static void cx_auto_parse_eapd(struct hda_codec *codec)
- 	 * thus it might control over all pins.
- 	 */
- 	if (spec->num_eapds > 2)
--		spec->gen.own_eapd_ctl = 1;
-+		spec->dynamic_eapd = 1;
- }
- 
- static void cx_auto_turn_eapd(struct hda_codec *codec, int num_pins,
-@@ -3191,6 +3192,15 @@ static int cx_auto_build_controls(struct hda_codec *codec)
- 	return 0;
- }
- 
-+static int cx_auto_init(struct hda_codec *codec)
-+{
-+	struct conexant_spec *spec = codec->spec;
-+	snd_hda_gen_init(codec);
-+	if (!spec->dynamic_eapd)
-+		cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, true);
-+	return 0;
-+}
-+
- static void cx_auto_free(struct hda_codec *codec)
- {
- 	snd_hda_detach_beep_device(codec);
-@@ -3200,7 +3210,7 @@ static void cx_auto_free(struct hda_codec *codec)
- static const struct hda_codec_ops cx_auto_patch_ops = {
- 	.build_controls = cx_auto_build_controls,
- 	.build_pcms = snd_hda_gen_build_pcms,
--	.init = snd_hda_gen_init,
-+	.init = cx_auto_init,
- 	.free = cx_auto_free,
- 	.unsol_event = snd_hda_jack_unsol_event,
- #ifdef CONFIG_PM
-@@ -3350,7 +3360,8 @@ static int patch_conexant_auto(struct hda_codec *codec)
- 
- 	cx_auto_parse_beep(codec);
- 	cx_auto_parse_eapd(codec);
--	if (spec->gen.own_eapd_ctl)
-+	spec->gen.own_eapd_ctl = 1;
-+	if (spec->dynamic_eapd)
- 		spec->gen.vmaster_mute.hook = cx_auto_vmaster_hook;
- 
- 	switch (codec->vendor_id) {
-diff --git a/sound/soc/codecs/da7213.c b/sound/soc/codecs/da7213.c
-index 41230ad..4a6f1da 100644
---- a/sound/soc/codecs/da7213.c
-+++ b/sound/soc/codecs/da7213.c
-@@ -1488,17 +1488,17 @@ static int da7213_probe(struct snd_soc_codec *codec)
- 				     DA7213_DMIC_DATA_SEL_SHIFT);
- 			break;
- 		}
--		switch (pdata->dmic_data_sel) {
-+		switch (pdata->dmic_samplephase) {
- 		case DA7213_DMIC_SAMPLE_ON_CLKEDGE:
- 		case DA7213_DMIC_SAMPLE_BETWEEN_CLKEDGE:
--			dmic_cfg |= (pdata->dmic_data_sel <<
-+			dmic_cfg |= (pdata->dmic_samplephase <<
- 				     DA7213_DMIC_SAMPLEPHASE_SHIFT);
- 			break;
- 		}
--		switch (pdata->dmic_data_sel) {
-+		switch (pdata->dmic_clk_rate) {
- 		case DA7213_DMIC_CLK_3_0MHZ:
- 		case DA7213_DMIC_CLK_1_5MHZ:
--			dmic_cfg |= (pdata->dmic_data_sel <<
-+			dmic_cfg |= (pdata->dmic_clk_rate <<
- 				     DA7213_DMIC_CLK_RATE_SHIFT);
- 			break;
- 		}
-diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
-index c9bd445..e5f96c9 100644
---- a/sound/soc/codecs/wm8994.c
-+++ b/sound/soc/codecs/wm8994.c
-@@ -2841,6 +2841,7 @@ static int wm8994_aif3_hw_params(struct snd_pcm_substream *substream,
- 		default:
- 			return 0;
- 		}
-+		break;
- 	default:
- 		return 0;
- 	}