[gentoo-commits] linux-patches r1909 - genpatches-2.6/trunk/2.6.38

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2011-05-02 20:28:48 +0000 (Mon, 02 May 2011)
New Revision: 1909

Added:
   genpatches-2.6/trunk/2.6.38/1004_linux-2.6.38.5.patch
Modified:
   genpatches-2.6/trunk/2.6.38/0000_README
Log:
Linux patch 2.6.38.5

Modified: genpatches-2.6/trunk/2.6.38/0000_README
===================================================================
--- genpatches-2.6/trunk/2.6.38/0000_README	2011-04-27 23:16:27 UTC (rev 1908)
+++ genpatches-2.6/trunk/2.6.38/0000_README	2011-05-02 20:28:48 UTC (rev 1909)
@@ -55,6 +55,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 2.6.38.4
 
+Patch:  1004_linux-2.6.38.5.patch
+From:   http://www.kernel.org
+Desc:   Linux 2.6.38.5
+
 Patch:  1700_XEN-PVHVM-compile-issue-fix.patch
 From:   http://bugs.gentoo.org/show_bug.cgi?id=362415
 Desc:   Fix compile issue if XEN is enabled but XEN_PVHVM is disabled

Added: genpatches-2.6/trunk/2.6.38/1004_linux-2.6.38.5.patch
===================================================================
--- genpatches-2.6/trunk/2.6.38/1004_linux-2.6.38.5.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.38/1004_linux-2.6.38.5.patch	2011-05-02 20:28:48 UTC (rev 1909)
@@ -0,0 +1,1956 @@
+diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c
+index 02b7a03..8b3db1c 100644
+--- a/arch/m68k/mm/motorola.c
++++ b/arch/m68k/mm/motorola.c
+@@ -300,6 +300,8 @@ void __init paging_init(void)
+ 		zones_size[ZONE_DMA] = m68k_memory[i].size >> PAGE_SHIFT;
+ 		free_area_init_node(i, zones_size,
+ 				    m68k_memory[i].addr >> PAGE_SHIFT, NULL);
++		if (node_present_pages(i))
++			node_set_state(i, N_NORMAL_MEMORY);
+ 	}
+ }
+ 
+diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
+index f4f4d70..7fd8aad 100644
+--- a/arch/parisc/mm/init.c
++++ b/arch/parisc/mm/init.c
+@@ -266,8 +266,10 @@ static void __init setup_bootmem(void)
+ 	}
+ 	memset(pfnnid_map, 0xff, sizeof(pfnnid_map));
+ 
+-	for (i = 0; i < npmem_ranges; i++)
++	for (i = 0; i < npmem_ranges; i++) {
++		node_set_state(i, N_NORMAL_MEMORY);
+ 		node_set_online(i);
++	}
+ #endif
+ 
+ 	/*
+diff --git a/arch/s390/kvm/sie64a.S b/arch/s390/kvm/sie64a.S
+index 7e9d30d..ab0e041 100644
+--- a/arch/s390/kvm/sie64a.S
++++ b/arch/s390/kvm/sie64a.S
+@@ -48,10 +48,10 @@ sie_irq_handler:
+ 	tm	__TI_flags+7(%r2),_TIF_EXIT_SIE
+ 	jz	0f
+ 	larl	%r2,sie_exit			# work pending, leave sie
+-	stg	%r2,__LC_RETURN_PSW+8
++	stg	%r2,SPI_PSW+8(0,%r15)
+ 	br	%r14
+ 0:	larl	%r2,sie_reenter			# re-enter with guest id
+-	stg	%r2,__LC_RETURN_PSW+8
++	stg	%r2,SPI_PSW+8(0,%r15)
+ 1:	br	%r14
+ 
+ /*
+diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
+index 2c57806..0f900c8 100644
+--- a/arch/s390/mm/fault.c
++++ b/arch/s390/mm/fault.c
+@@ -558,9 +558,9 @@ static void pfault_interrupt(unsigned int ext_int_code,
+ 	 * Get the token (= address of the task structure of the affected task).
+ 	 */
+ #ifdef CONFIG_64BIT
+-	tsk = *(struct task_struct **) param64;
++	tsk = (struct task_struct *) param64;
+ #else
+-	tsk = *(struct task_struct **) param32;
++	tsk = (struct task_struct *) param32;
+ #endif
+ 
+ 	if (subcode & 0x0080) {
+diff --git a/arch/um/sys-i386/Makefile b/arch/um/sys-i386/Makefile
+index 804b28d..b1da91c 100644
+--- a/arch/um/sys-i386/Makefile
++++ b/arch/um/sys-i386/Makefile
+@@ -4,7 +4,7 @@
+ 
+ obj-y = bug.o bugs.o checksum.o delay.o fault.o ksyms.o ldt.o ptrace.o \
+ 	ptrace_user.o setjmp.o signal.o stub.o stub_segv.o syscalls.o sysrq.o \
+-	sys_call_table.o tls.o
++	sys_call_table.o tls.o atomic64_cx8_32.o
+ 
+ obj-$(CONFIG_BINFMT_ELF) += elfcore.o
+ 
+diff --git a/arch/um/sys-i386/atomic64_cx8_32.S b/arch/um/sys-i386/atomic64_cx8_32.S
+new file mode 100644
+index 0000000..1e901d3d
+--- /dev/null
++++ b/arch/um/sys-i386/atomic64_cx8_32.S
+@@ -0,0 +1,225 @@
++/*
++ * atomic64_t for 586+
++ *
++ * Copied from arch/x86/lib/atomic64_cx8_32.S
++ *
++ * Copyright © 2010  Luca Barbieri
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ */
++
++#include <linux/linkage.h>
++#include <asm/alternative-asm.h>
++#include <asm/dwarf2.h>
++
++.macro SAVE reg
++	pushl_cfi %\reg
++	CFI_REL_OFFSET \reg, 0
++.endm
++
++.macro RESTORE reg
++	popl_cfi %\reg
++	CFI_RESTORE \reg
++.endm
++
++.macro read64 reg
++	movl %ebx, %eax
++	movl %ecx, %edx
++/* we need LOCK_PREFIX since otherwise cmpxchg8b always does the write */
++	LOCK_PREFIX
++	cmpxchg8b (\reg)
++.endm
++
++ENTRY(atomic64_read_cx8)
++	CFI_STARTPROC
++
++	read64 %ecx
++	ret
++	CFI_ENDPROC
++ENDPROC(atomic64_read_cx8)
++
++ENTRY(atomic64_set_cx8)
++	CFI_STARTPROC
++
++1:
++/* we don't need LOCK_PREFIX since aligned 64-bit writes
++ * are atomic on 586 and newer */
++	cmpxchg8b (%esi)
++	jne 1b
++
++	ret
++	CFI_ENDPROC
++ENDPROC(atomic64_set_cx8)
++
++ENTRY(atomic64_xchg_cx8)
++	CFI_STARTPROC
++
++	movl %ebx, %eax
++	movl %ecx, %edx
++1:
++	LOCK_PREFIX
++	cmpxchg8b (%esi)
++	jne 1b
++
++	ret
++	CFI_ENDPROC
++ENDPROC(atomic64_xchg_cx8)
++
++.macro addsub_return func ins insc
++ENTRY(atomic64_\func\()_return_cx8)
++	CFI_STARTPROC
++	SAVE ebp
++	SAVE ebx
++	SAVE esi
++	SAVE edi
++
++	movl %eax, %esi
++	movl %edx, %edi
++	movl %ecx, %ebp
++
++	read64 %ebp
++1:
++	movl %eax, %ebx
++	movl %edx, %ecx
++	\ins\()l %esi, %ebx
++	\insc\()l %edi, %ecx
++	LOCK_PREFIX
++	cmpxchg8b (%ebp)
++	jne 1b
++
++10:
++	movl %ebx, %eax
++	movl %ecx, %edx
++	RESTORE edi
++	RESTORE esi
++	RESTORE ebx
++	RESTORE ebp
++	ret
++	CFI_ENDPROC
++ENDPROC(atomic64_\func\()_return_cx8)
++.endm
++
++addsub_return add add adc
++addsub_return sub sub sbb
++
++.macro incdec_return func ins insc
++ENTRY(atomic64_\func\()_return_cx8)
++	CFI_STARTPROC
++	SAVE ebx
++
++	read64 %esi
++1:
++	movl %eax, %ebx
++	movl %edx, %ecx
++	\ins\()l $1, %ebx
++	\insc\()l $0, %ecx
++	LOCK_PREFIX
++	cmpxchg8b (%esi)
++	jne 1b
++
++10:
++	movl %ebx, %eax
++	movl %ecx, %edx
++	RESTORE ebx
++	ret
++	CFI_ENDPROC
++ENDPROC(atomic64_\func\()_return_cx8)
++.endm
++
++incdec_return inc add adc
++incdec_return dec sub sbb
++
++ENTRY(atomic64_dec_if_positive_cx8)
++	CFI_STARTPROC
++	SAVE ebx
++
++	read64 %esi
++1:
++	movl %eax, %ebx
++	movl %edx, %ecx
++	subl $1, %ebx
++	sbb $0, %ecx
++	js 2f
++	LOCK_PREFIX
++	cmpxchg8b (%esi)
++	jne 1b
++
++2:
++	movl %ebx, %eax
++	movl %ecx, %edx
++	RESTORE ebx
++	ret
++	CFI_ENDPROC
++ENDPROC(atomic64_dec_if_positive_cx8)
++
++ENTRY(atomic64_add_unless_cx8)
++	CFI_STARTPROC
++	SAVE ebp
++	SAVE ebx
++/* these just push these two parameters on the stack */
++	SAVE edi
++	SAVE esi
++
++	movl %ecx, %ebp
++	movl %eax, %esi
++	movl %edx, %edi
++
++	read64 %ebp
++1:
++	cmpl %eax, 0(%esp)
++	je 4f
++2:
++	movl %eax, %ebx
++	movl %edx, %ecx
++	addl %esi, %ebx
++	adcl %edi, %ecx
++	LOCK_PREFIX
++	cmpxchg8b (%ebp)
++	jne 1b
++
++	movl $1, %eax
++3:
++	addl $8, %esp
++	CFI_ADJUST_CFA_OFFSET -8
++	RESTORE ebx
++	RESTORE ebp
++	ret
++4:
++	cmpl %edx, 4(%esp)
++	jne 2b
++	xorl %eax, %eax
++	jmp 3b
++	CFI_ENDPROC
++ENDPROC(atomic64_add_unless_cx8)
++
++ENTRY(atomic64_inc_not_zero_cx8)
++	CFI_STARTPROC
++	SAVE ebx
++
++	read64 %esi
++1:
++	testl %eax, %eax
++	je 4f
++2:
++	movl %eax, %ebx
++	movl %edx, %ecx
++	addl $1, %ebx
++	adcl $0, %ecx
++	LOCK_PREFIX
++	cmpxchg8b (%esi)
++	jne 1b
++
++	movl $1, %eax
++3:
++	RESTORE ebx
++	ret
++4:
++	testl %edx, %edx
++	jne 2b
++	jmp 3b
++	CFI_ENDPROC
++ENDPROC(atomic64_inc_not_zero_cx8)
+diff --git a/arch/x86/include/asm/gart.h b/arch/x86/include/asm/gart.h
+index 43085bf..3e7349f 100644
+--- a/arch/x86/include/asm/gart.h
++++ b/arch/x86/include/asm/gart.h
+@@ -66,7 +66,7 @@ static inline void gart_set_size_and_enable(struct pci_dev *dev, u32 order)
+ 	 * Don't enable translation but enable GART IO and CPU accesses.
+ 	 * Also, set DISTLBWALKPRB since GART tables memory is UC.
+ 	 */
+-	ctl = DISTLBWALKPRB | order << 1;
++	ctl = order << 1;
+ 
+ 	pci_write_config_dword(dev, AMD64_GARTAPERTURECTL, ctl);
+ }
+@@ -83,7 +83,7 @@ static inline void enable_gart_translation(struct pci_dev *dev, u64 addr)
+ 
+         /* Enable GART translation for this hammer. */
+         pci_read_config_dword(dev, AMD64_GARTAPERTURECTL, &ctl);
+-        ctl |= GARTEN;
++        ctl |= GARTEN | DISTLBWALKPRB;
+         ctl &= ~(DISGARTCPU | DISGARTIO);
+         pci_write_config_dword(dev, AMD64_GARTAPERTURECTL, ctl);
+ }
+diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
+index 5955a78..f6a1c23 100644
+--- a/arch/x86/kernel/aperture_64.c
++++ b/arch/x86/kernel/aperture_64.c
+@@ -500,7 +500,7 @@ out:
+ 		 * Don't enable translation yet but enable GART IO and CPU
+ 		 * accesses and set DISTLBWALKPRB since GART table memory is UC.
+ 		 */
+-		u32 ctl = DISTLBWALKPRB | aper_order << 1;
++		u32 ctl = aper_order << 1;
+ 
+ 		bus = amd_nb_bus_dev_ranges[i].bus;
+ 		dev_base = amd_nb_bus_dev_ranges[i].dev_base;
+diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
+index c01ffa5..197a46f 100644
+--- a/arch/x86/kernel/pci-gart_64.c
++++ b/arch/x86/kernel/pci-gart_64.c
+@@ -81,6 +81,9 @@ static u32 gart_unmapped_entry;
+ #define AGPEXTERN
+ #endif
+ 
++/* GART can only remap to physical addresses < 1TB */
++#define GART_MAX_PHYS_ADDR	(1ULL << 40)
++
+ /* backdoor interface to AGP driver */
+ AGPEXTERN int agp_memory_reserved;
+ AGPEXTERN __u32 *agp_gatt_table;
+@@ -212,9 +215,13 @@ static dma_addr_t dma_map_area(struct device *dev, dma_addr_t phys_mem,
+ 				size_t size, int dir, unsigned long align_mask)
+ {
+ 	unsigned long npages = iommu_num_pages(phys_mem, size, PAGE_SIZE);
+-	unsigned long iommu_page = alloc_iommu(dev, npages, align_mask);
++	unsigned long iommu_page;
+ 	int i;
+ 
++	if (unlikely(phys_mem + size > GART_MAX_PHYS_ADDR))
++		return bad_dma_addr;
++
++	iommu_page = alloc_iommu(dev, npages, align_mask);
+ 	if (iommu_page == -1) {
+ 		if (!nonforced_iommu(dev, phys_mem, size))
+ 			return phys_mem;
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index 41fb691..3655e19 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -511,8 +511,10 @@ int blk_register_queue(struct gendisk *disk)
+ 		return ret;
+ 
+ 	ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue");
+-	if (ret < 0)
++	if (ret < 0) {
++		blk_trace_remove_sysfs(dev);
+ 		return ret;
++	}
+ 
+ 	kobject_uevent(&q->kobj, KOBJ_ADD);
+ 
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index ac1a599..fcc13ac 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -33,6 +33,7 @@
+ #include <linux/async.h>
+ #include <linux/dmi.h>
+ #include <linux/slab.h>
++#include <linux/suspend.h>
+ 
+ #ifdef CONFIG_ACPI_PROCFS_POWER
+ #include <linux/proc_fs.h>
+@@ -102,6 +103,7 @@ struct acpi_battery {
+ 	struct mutex lock;
+ 	struct power_supply bat;
+ 	struct acpi_device *device;
++	struct notifier_block pm_nb;
+ 	unsigned long update_time;
+ 	int rate_now;
+ 	int capacity_now;
+@@ -940,6 +942,21 @@ static void acpi_battery_notify(struct acpi_device *device, u32 event)
+ 		power_supply_changed(&battery->bat);
+ }
+ 
++static int battery_notify(struct notifier_block *nb,
++			       unsigned long mode, void *_unused)
++{
++	struct acpi_battery *battery = container_of(nb, struct acpi_battery,
++						    pm_nb);
++	switch (mode) {
++	case PM_POST_SUSPEND:
++		sysfs_remove_battery(battery);
++		sysfs_add_battery(battery);
++		break;
++	}
++
++	return 0;
++}
++
+ static int acpi_battery_add(struct acpi_device *device)
+ {
+ 	int result = 0;
+@@ -972,6 +989,10 @@ static int acpi_battery_add(struct acpi_device *device)
+ #endif
+ 		kfree(battery);
+ 	}
++
++	battery->pm_nb.notifier_call = battery_notify;
++	register_pm_notifier(&battery->pm_nb);
++
+ 	return result;
+ }
+ 
+@@ -982,6 +1003,7 @@ static int acpi_battery_remove(struct acpi_device *device, int type)
+ 	if (!device || !acpi_driver_data(device))
+ 		return -EINVAL;
+ 	battery = acpi_driver_data(device);
++	unregister_pm_notifier(&battery->pm_nb);
+ #ifdef CONFIG_ACPI_PROCFS_POWER
+ 	acpi_battery_remove_fs(device);
+ #endif
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index b99e624..8eee69f 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -944,6 +944,10 @@ static int acpi_bus_get_flags(struct acpi_device *device)
+ 	if (ACPI_SUCCESS(status))
+ 		device->flags.lockable = 1;
+ 
++	/* Power resources cannot be power manageable. */
++	if (device->device_type == ACPI_BUS_TYPE_POWER)
++		return 0;
++
+ 	/* Presence of _PS0|_PR0 indicates 'power manageable' */
+ 	status = acpi_get_handle(device->handle, "_PS0", &temp);
+ 	if (ACPI_FAILURE(status))
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 34e08f6..54c096b 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -150,7 +150,7 @@ static const struct ata_port_info ahci_port_info[] = {
+ 	{
+ 		AHCI_HFLAGS	(AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP |
+ 				 AHCI_HFLAG_YES_NCQ),
+-		.flags		= AHCI_FLAG_COMMON,
++		.flags		= AHCI_FLAG_COMMON | ATA_FLAG_NO_DIPM,
+ 		.pio_mask	= ATA_PIO4,
+ 		.udma_mask	= ATA_UDMA6,
+ 		.port_ops	= &ahci_ops,
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index 26d4523..8498eb5 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -1897,7 +1897,17 @@ static void ahci_pmp_attach(struct ata_port *ap)
+ 	ahci_enable_fbs(ap);
+ 
+ 	pp->intr_mask |= PORT_IRQ_BAD_PMP;
+-	writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
++
++	/*
++	 * We must not change the port interrupt mask register if the
++	 * port is marked frozen, the value in pp->intr_mask will be
++	 * restored later when the port is thawed.
++	 *
++	 * Note that during initialization, the port is marked as
++	 * frozen since the irq handler is not yet registered.
++	 */
++	if (!(ap->pflags & ATA_PFLAG_FROZEN))
++		writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
+ }
+ 
+ static void ahci_pmp_detach(struct ata_port *ap)
+@@ -1913,7 +1923,10 @@ static void ahci_pmp_detach(struct ata_port *ap)
+ 	writel(cmd, port_mmio + PORT_CMD);
+ 
+ 	pp->intr_mask &= ~PORT_IRQ_BAD_PMP;
+-	writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
++
++	/* see comment above in ahci_pmp_attach() */
++	if (!(ap->pflags & ATA_PFLAG_FROZEN))
++		writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
+ }
+ 
+ int ahci_port_resume(struct ata_port *ap)
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index d4e52e2..4ccce0f 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -5479,8 +5479,8 @@ struct ata_port *ata_port_alloc(struct ata_host *host)
+ 	ap = kzalloc(sizeof(*ap), GFP_KERNEL);
+ 	if (!ap)
+ 		return NULL;
+-	
+-	ap->pflags |= ATA_PFLAG_INITIALIZING;
++
++	ap->pflags |= ATA_PFLAG_INITIALIZING | ATA_PFLAG_FROZEN;
+ 	ap->lock = &host->lock;
+ 	ap->print_id = -1;
+ 	ap->host = host;
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index e16850e..fe18c2d 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -3276,6 +3276,7 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
+ 	struct ata_eh_context *ehc = &link->eh_context;
+ 	struct ata_device *dev, *link_dev = NULL, *lpm_dev = NULL;
+ 	enum ata_lpm_policy old_policy = link->lpm_policy;
++	bool no_dipm = ap->flags & ATA_FLAG_NO_DIPM;
+ 	unsigned int hints = ATA_LPM_EMPTY | ATA_LPM_HIPM;
+ 	unsigned int err_mask;
+ 	int rc;
+@@ -3292,7 +3293,7 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
+ 	 */
+ 	ata_for_each_dev(dev, link, ENABLED) {
+ 		bool hipm = ata_id_has_hipm(dev->id);
+-		bool dipm = ata_id_has_dipm(dev->id);
++		bool dipm = ata_id_has_dipm(dev->id) && !no_dipm;
+ 
+ 		/* find the first enabled and LPM enabled devices */
+ 		if (!link_dev)
+@@ -3349,7 +3350,8 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
+ 
+ 	/* host config updated, enable DIPM if transitioning to MIN_POWER */
+ 	ata_for_each_dev(dev, link, ENABLED) {
+-		if (policy == ATA_LPM_MIN_POWER && ata_id_has_dipm(dev->id)) {
++		if (policy == ATA_LPM_MIN_POWER && !no_dipm &&
++		    ata_id_has_dipm(dev->id)) {
+ 			err_mask = ata_dev_set_feature(dev,
+ 					SETFEATURES_SATA_ENABLE, SATA_DIPM);
+ 			if (err_mask && err_mask != AC_ERR_DEV) {
+diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
+index 012cba0..b072648 100644
+--- a/drivers/char/agp/generic.c
++++ b/drivers/char/agp/generic.c
+@@ -115,6 +115,9 @@ static struct agp_memory *agp_create_user_memory(unsigned long num_agp_pages)
+ 	struct agp_memory *new;
+ 	unsigned long alloc_size = num_agp_pages*sizeof(struct page *);
+ 
++	if (INT_MAX/sizeof(struct page *) < num_agp_pages)
++		return NULL;
++
+ 	new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
+ 	if (new == NULL)
+ 		return NULL;
+@@ -234,11 +237,14 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
+ 	int scratch_pages;
+ 	struct agp_memory *new;
+ 	size_t i;
++	int cur_memory;
+ 
+ 	if (!bridge)
+ 		return NULL;
+ 
+-	if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)
++	cur_memory = atomic_read(&bridge->current_memory_agp);
++	if ((cur_memory + page_count > bridge->max_memory_agp) ||
++	    (cur_memory + page_count < page_count))
+ 		return NULL;
+ 
+ 	if (type >= AGP_USER_TYPES) {
+@@ -1089,8 +1095,8 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
+ 		return -EINVAL;
+ 	}
+ 
+-	/* AK: could wrap */
+-	if ((pg_start + mem->page_count) > num_entries)
++	if (((pg_start + mem->page_count) > num_entries) ||
++	    ((pg_start + mem->page_count) < pg_start))
+ 		return -EINVAL;
+ 
+ 	j = pg_start;
+@@ -1124,7 +1130,7 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
+ {
+ 	size_t i;
+ 	struct agp_bridge_data *bridge;
+-	int mask_type;
++	int mask_type, num_entries;
+ 
+ 	bridge = mem->bridge;
+ 	if (!bridge)
+@@ -1136,6 +1142,11 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
+ 	if (type != mem->type)
+ 		return -EINVAL;
+ 
++	num_entries = agp_num_entries();
++	if (((pg_start + mem->page_count) > num_entries) ||
++	    ((pg_start + mem->page_count) < pg_start))
++		return -EINVAL;
++
+ 	mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
+ 	if (mask_type != 0) {
+ 		/* The generic routines know nothing of memory types */
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index 84b164d..838568a 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -1280,18 +1280,7 @@ static void unplug_port(struct port *port)
+ 		spin_lock_irq(&pdrvdata_lock);
+ 		list_del(&port->cons.list);
+ 		spin_unlock_irq(&pdrvdata_lock);
+-#if 0
+-		/*
+-		 * hvc_remove() not called as removing one hvc port
+-		 * results in other hvc ports getting frozen.
+-		 *
+-		 * Once this is resolved in hvc, this functionality
+-		 * will be enabled.  Till that is done, the -EPIPE
+-		 * return from get_chars() above will help
+-		 * hvc_console.c to clean up on ports we remove here.
+-		 */
+ 		hvc_remove(port->cons.hvc);
+-#endif
+ 	}
+ 
+ 	/* Remove unused data this port might have received. */
+diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
+index 0902d44..4b4b545 100644
+--- a/drivers/gpu/drm/Kconfig
++++ b/drivers/gpu/drm/Kconfig
+@@ -24,6 +24,7 @@ config DRM_KMS_HELPER
+ 	depends on DRM
+ 	select FB
+ 	select FRAMEBUFFER_CONSOLE if !EXPERT
++	select FRAMEBUFFER_CONSOLE_DETECT_PRIMARY if FRAMEBUFFER_CONSOLE
+ 	help
+ 	  FB and CRTC helpers for KMS drivers.
+ 
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 49fb54f..ecf8f94 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -5630,36 +5630,6 @@ cleanup_work:
+ 	return ret;
+ }
+ 
+-static void intel_crtc_reset(struct drm_crtc *crtc)
+-{
+-	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+-
+-	/* Reset flags back to the 'unknown' status so that they
+-	 * will be correctly set on the initial modeset.
+-	 */
+-	intel_crtc->dpms_mode = -1;
+-}
+-
+-static struct drm_crtc_helper_funcs intel_helper_funcs = {
+-	.dpms = intel_crtc_dpms,
+-	.mode_fixup = intel_crtc_mode_fixup,
+-	.mode_set = intel_crtc_mode_set,
+-	.mode_set_base = intel_pipe_set_base,
+-	.mode_set_base_atomic = intel_pipe_set_base_atomic,
+-	.load_lut = intel_crtc_load_lut,
+-	.disable = intel_crtc_disable,
+-};
+-
+-static const struct drm_crtc_funcs intel_crtc_funcs = {
+-	.reset = intel_crtc_reset,
+-	.cursor_set = intel_crtc_cursor_set,
+-	.cursor_move = intel_crtc_cursor_move,
+-	.gamma_set = intel_crtc_gamma_set,
+-	.set_config = drm_crtc_helper_set_config,
+-	.destroy = intel_crtc_destroy,
+-	.page_flip = intel_crtc_page_flip,
+-};
+-
+ static void intel_sanitize_modesetting(struct drm_device *dev,
+ 				       int pipe, int plane)
+ {
+@@ -5710,6 +5680,42 @@ static void intel_sanitize_modesetting(struct drm_device *dev,
+ 	}
+ }
+ 
++static void intel_crtc_reset(struct drm_crtc *crtc)
++{
++	struct drm_device *dev = crtc->dev;
++	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
++
++	/* Reset flags back to the 'unknown' status so that they
++	 * will be correctly set on the initial modeset.
++	 */
++	intel_crtc->dpms_mode = -1;
++
++	/* We need to fix up any BIOS configuration that conflicts with
++	 * our expectations.
++	 */
++	intel_sanitize_modesetting(dev, intel_crtc->pipe, intel_crtc->plane);
++}
++
++static struct drm_crtc_helper_funcs intel_helper_funcs = {
++	.dpms = intel_crtc_dpms,
++	.mode_fixup = intel_crtc_mode_fixup,
++	.mode_set = intel_crtc_mode_set,
++	.mode_set_base = intel_pipe_set_base,
++	.mode_set_base_atomic = intel_pipe_set_base_atomic,
++	.load_lut = intel_crtc_load_lut,
++	.disable = intel_crtc_disable,
++};
++
++static const struct drm_crtc_funcs intel_crtc_funcs = {
++	.reset = intel_crtc_reset,
++	.cursor_set = intel_crtc_cursor_set,
++	.cursor_move = intel_crtc_cursor_move,
++	.gamma_set = intel_crtc_gamma_set,
++	.set_config = drm_crtc_helper_set_config,
++	.destroy = intel_crtc_destroy,
++	.page_flip = intel_crtc_page_flip,
++};
++
+ static void intel_crtc_init(struct drm_device *dev, int pipe)
+ {
+ 	drm_i915_private_t *dev_priv = dev->dev_private;
+@@ -5759,8 +5765,6 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
+ 
+ 	setup_timer(&intel_crtc->idle_timer, intel_crtc_idle_timer,
+ 		    (unsigned long)intel_crtc);
+-
+-	intel_sanitize_modesetting(dev, intel_crtc->pipe, intel_crtc->plane);
+ }
+ 
+ int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
+diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
+index fe4a53a..65edb22 100644
+--- a/drivers/gpu/drm/i915/intel_tv.c
++++ b/drivers/gpu/drm/i915/intel_tv.c
+@@ -1380,7 +1380,9 @@ intel_tv_detect(struct drm_connector *connector, bool force)
+ 	if (type < 0)
+ 		return connector_status_disconnected;
+ 
++	intel_tv->type = type;
+ 	intel_tv_find_better_format(connector);
++
+ 	return connector_status_connected;
+ }
+ 
+diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+index 60769d2..7826be0 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+@@ -181,13 +181,13 @@ nouveau_fbcon_sync(struct fb_info *info)
+ 		OUT_RING  (chan, 0);
+ 	}
+ 
+-	nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy + 3, 0xffffffff);
++	nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy/4 + 3, 0xffffffff);
+ 	FIRE_RING(chan);
+ 	mutex_unlock(&chan->mutex);
+ 
+ 	ret = -EBUSY;
+ 	for (i = 0; i < 100000; i++) {
+-		if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy + 3)) {
++		if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy/4 + 3)) {
+ 			ret = 0;
+ 			break;
+ 		}
+diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
+index d71d375..7bd7456 100644
+--- a/drivers/gpu/drm/radeon/atom.c
++++ b/drivers/gpu/drm/radeon/atom.c
+@@ -135,7 +135,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
+ 		case ATOM_IIO_MOVE_INDEX:
+ 			temp &=
+ 			    ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
+-			      CU8(base + 2));
++			      CU8(base + 3));
+ 			temp |=
+ 			    ((index >> CU8(base + 2)) &
+ 			     (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
+@@ -145,7 +145,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
+ 		case ATOM_IIO_MOVE_DATA:
+ 			temp &=
+ 			    ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
+-			      CU8(base + 2));
++			      CU8(base + 3));
+ 			temp |=
+ 			    ((data >> CU8(base + 2)) &
+ 			     (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
+@@ -155,7 +155,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
+ 		case ATOM_IIO_MOVE_ATTR:
+ 			temp &=
+ 			    ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
+-			      CU8(base + 2));
++			      CU8(base + 3));
+ 			temp |=
+ 			    ((ctx->
+ 			      io_attr >> CU8(base + 2)) & (0xFFFFFFFF >> (32 -
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 0861257..bede31c 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -532,10 +532,7 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ 		else
+ 			pll->flags |= RADEON_PLL_PREFER_LOW_REF_DIV;
+ 
+-		if ((rdev->family == CHIP_R600) ||
+-		    (rdev->family == CHIP_RV610) ||
+-		    (rdev->family == CHIP_RV630) ||
+-		    (rdev->family == CHIP_RV670))
++		if (rdev->family < CHIP_RV770)
+ 			pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ 	} else {
+ 		pll->flags |= RADEON_PLL_LEGACY;
+@@ -565,7 +562,6 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ 			if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
+ 				if (ss_enabled) {
+ 					if (ss->refdiv) {
+-						pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ 						pll->flags |= RADEON_PLL_USE_REF_DIV;
+ 						pll->reference_div = ss->refdiv;
+ 						if (ASIC_IS_AVIVO(rdev))
+diff --git a/drivers/input/xen-kbdfront.c b/drivers/input/xen-kbdfront.c
+index 53e6273..c35ab94 100644
+--- a/drivers/input/xen-kbdfront.c
++++ b/drivers/input/xen-kbdfront.c
+@@ -286,7 +286,7 @@ static void xenkbd_backend_changed(struct xenbus_device *dev,
+ 				   enum xenbus_state backend_state)
+ {
+ 	struct xenkbd_info *info = dev_get_drvdata(&dev->dev);
+-	int val;
++	int ret, val;
+ 
+ 	switch (backend_state) {
+ 	case XenbusStateInitialising:
+@@ -299,6 +299,16 @@ static void xenkbd_backend_changed(struct xenbus_device *dev,
+ 
+ 	case XenbusStateInitWait:
+ InitWait:
++		ret = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
++				   "feature-abs-pointer", "%d", &val);
++		if (ret < 0)
++			val = 0;
++		if (val) {
++			ret = xenbus_printf(XBT_NIL, info->xbdev->nodename,
++					    "request-abs-pointer", "1");
++			if (ret)
++				pr_warning("can't request abs-pointer\n");
++		}
+ 		xenbus_switch_state(dev, XenbusStateConnected);
+ 		break;
+ 
+diff --git a/drivers/media/dvb/b2c2/flexcop-pci.c b/drivers/media/dvb/b2c2/flexcop-pci.c
+index 227c020..4f3e3ce 100644
+--- a/drivers/media/dvb/b2c2/flexcop-pci.c
++++ b/drivers/media/dvb/b2c2/flexcop-pci.c
+@@ -38,7 +38,7 @@ MODULE_PARM_DESC(debug,
+ 	DEBSTATUS);
+ 
+ #define DRIVER_VERSION "0.1"
+-#define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver"
++#define DRIVER_NAME "flexcop-pci"
+ #define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher@××××.de>"
+ 
+ struct flexcop_pci {
+diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
+index a113805..10f86e0 100644
+--- a/drivers/net/netxen/netxen_nic.h
++++ b/drivers/net/netxen/netxen_nic.h
+@@ -174,7 +174,7 @@
+ 
+ #define	MAX_NUM_CARDS		4
+ 
+-#define MAX_BUFFERS_PER_CMD	32
++#define NETXEN_MAX_FRAGS_PER_TX	14
+ #define MAX_TSO_HEADER_DESC	2
+ #define MGMT_CMD_DESC_RESV	4
+ #define TX_STOP_THRESH		((MAX_SKB_FRAGS >> 2) + MAX_TSO_HEADER_DESC \
+@@ -558,7 +558,7 @@ struct netxen_recv_crb {
+  */
+ struct netxen_cmd_buffer {
+ 	struct sk_buff *skb;
+-	struct netxen_skb_frag frag_array[MAX_BUFFERS_PER_CMD + 1];
++	struct netxen_skb_frag frag_array[MAX_SKB_FRAGS + 1];
+ 	u32 frag_count;
+ };
+ 
+diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
+index 33fac32..28139df 100644
+--- a/drivers/net/netxen/netxen_nic_main.c
++++ b/drivers/net/netxen/netxen_nic_main.c
+@@ -1841,6 +1841,8 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+ 	struct cmd_desc_type0 *hwdesc, *first_desc;
+ 	struct pci_dev *pdev;
+ 	int i, k;
++	int delta = 0;
++	struct skb_frag_struct *frag;
+ 
+ 	u32 producer;
+ 	int frag_count, no_of_desc;
+@@ -1848,6 +1850,21 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+ 
+ 	frag_count = skb_shinfo(skb)->nr_frags + 1;
+ 
++	/* 14 frags supported for normal packet and
++	 * 32 frags supported for TSO packet
++	 */
++	if (!skb_is_gso(skb) && frag_count > NETXEN_MAX_FRAGS_PER_TX) {
++
++		for (i = 0; i < (frag_count - NETXEN_MAX_FRAGS_PER_TX); i++) {
++			frag = &skb_shinfo(skb)->frags[i];
++			delta += frag->size;
++		}
++
++		if (!__pskb_pull_tail(skb, delta))
++			goto drop_packet;
++
++		frag_count = 1 + skb_shinfo(skb)->nr_frags;
++	}
+ 	/* 4 fragments per cmd des */
+ 	no_of_desc = (frag_count + 3) >> 2;
+ 
+diff --git a/drivers/net/qlcnic/qlcnic.h b/drivers/net/qlcnic/qlcnic.h
+index 44e316f..0f136ff 100644
+--- a/drivers/net/qlcnic/qlcnic.h
++++ b/drivers/net/qlcnic/qlcnic.h
+@@ -99,6 +99,7 @@
+ #define TX_UDPV6_PKT	0x0c
+ 
+ /* Tx defines */
++#define QLCNIC_MAX_FRAGS_PER_TX	14
+ #define MAX_TSO_HEADER_DESC	2
+ #define MGMT_CMD_DESC_RESV	4
+ #define TX_STOP_THRESH		((MAX_SKB_FRAGS >> 2) + MAX_TSO_HEADER_DESC \
+diff --git a/drivers/net/qlcnic/qlcnic_main.c b/drivers/net/qlcnic/qlcnic_main.c
+index 37c04b4..92619d7 100644
+--- a/drivers/net/qlcnic/qlcnic_main.c
++++ b/drivers/net/qlcnic/qlcnic_main.c
+@@ -2099,6 +2099,7 @@ qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+ 	struct cmd_desc_type0 *hwdesc, *first_desc;
+ 	struct pci_dev *pdev;
+ 	struct ethhdr *phdr;
++	int delta = 0;
+ 	int i, k;
+ 
+ 	u32 producer;
+@@ -2118,6 +2119,19 @@ qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+ 	}
+ 
+ 	frag_count = skb_shinfo(skb)->nr_frags + 1;
++	/* 14 frags supported for normal packet and
++	 * 32 frags supported for TSO packet
++	 */
++	if (!skb_is_gso(skb) && frag_count > QLCNIC_MAX_FRAGS_PER_TX) {
++
++		for (i = 0; i < (frag_count - QLCNIC_MAX_FRAGS_PER_TX); i++)
++			delta += skb_shinfo(skb)->frags[i].size;
++
++		if (!__pskb_pull_tail(skb, delta))
++			goto drop_packet;
++
++		frag_count = 1 + skb_shinfo(skb)->nr_frags;
++	}
+ 
+ 	/* 4 fragments per cmd des */
+ 	no_of_desc = (frag_count + 3) >> 2;
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+index 4ceddbb..038a0cb 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+@@ -615,7 +615,7 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
+ 		 */
+ 		if (rxsp->status11 & AR_CRCErr)
+ 			rxs->rs_status |= ATH9K_RXERR_CRC;
+-		if (rxsp->status11 & AR_PHYErr) {
++		else if (rxsp->status11 & AR_PHYErr) {
+ 			phyerr = MS(rxsp->status11, AR_PHYErrCode);
+ 			/*
+ 			 * If we reach a point here where AR_PostDelimCRCErr is
+@@ -638,11 +638,11 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
+ 				rxs->rs_phyerr = phyerr;
+ 			}
+ 
+-		}
+-		if (rxsp->status11 & AR_DecryptCRCErr)
++		} else if (rxsp->status11 & AR_DecryptCRCErr)
+ 			rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+-		if (rxsp->status11 & AR_MichaelErr)
++		else if (rxsp->status11 & AR_MichaelErr)
+ 			rxs->rs_status |= ATH9K_RXERR_MIC;
++
+ 		if (rxsp->status11 & AR_KeyMiss)
+ 			rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+ 	}
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index 7c0a7c4..a3b77ae 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1218,15 +1218,6 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
+ 	ah->txchainmask = common->tx_chainmask;
+ 	ah->rxchainmask = common->rx_chainmask;
+ 
+-	if ((common->bus_ops->ath_bus_type != ATH_USB) && !ah->chip_fullsleep) {
+-		ath9k_hw_abortpcurecv(ah);
+-		if (!ath9k_hw_stopdmarecv(ah)) {
+-			ath_dbg(common, ATH_DBG_XMIT,
+-				"Failed to stop receive dma\n");
+-			bChannelChange = false;
+-		}
+-	}
+-
+ 	if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE))
+ 		return -EIO;
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
+index 2915b11..e9fc97d 100644
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -690,17 +690,23 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
+ 		rs->rs_flags |= ATH9K_RX_DECRYPT_BUSY;
+ 
+ 	if ((ads.ds_rxstatus8 & AR_RxFrameOK) == 0) {
++		/*
++		 * Treat these errors as mutually exclusive to avoid spurious
++		 * extra error reports from the hardware. If a CRC error is
++		 * reported, then decryption and MIC errors are irrelevant,
++		 * the frame is going to be dropped either way
++		 */
+ 		if (ads.ds_rxstatus8 & AR_CRCErr)
+ 			rs->rs_status |= ATH9K_RXERR_CRC;
+-		if (ads.ds_rxstatus8 & AR_PHYErr) {
++		else if (ads.ds_rxstatus8 & AR_PHYErr) {
+ 			rs->rs_status |= ATH9K_RXERR_PHY;
+ 			phyerr = MS(ads.ds_rxstatus8, AR_PHYErrCode);
+ 			rs->rs_phyerr = phyerr;
+-		}
+-		if (ads.ds_rxstatus8 & AR_DecryptCRCErr)
++		} else if (ads.ds_rxstatus8 & AR_DecryptCRCErr)
+ 			rs->rs_status |= ATH9K_RXERR_DECRYPT;
+-		if (ads.ds_rxstatus8 & AR_MichaelErr)
++		else if (ads.ds_rxstatus8 & AR_MichaelErr)
+ 			rs->rs_status |= ATH9K_RXERR_MIC;
++
+ 		if (ads.ds_rxstatus8 & AR_KeyMiss)
+ 			rs->rs_status |= ATH9K_RXERR_DECRYPT;
+ 	}
+@@ -770,28 +776,47 @@ void ath9k_hw_abortpcurecv(struct ath_hw *ah)
+ }
+ EXPORT_SYMBOL(ath9k_hw_abortpcurecv);
+ 
+-bool ath9k_hw_stopdmarecv(struct ath_hw *ah)
++bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset)
+ {
+ #define AH_RX_STOP_DMA_TIMEOUT 10000   /* usec */
+ #define AH_RX_TIME_QUANTUM     100     /* usec */
+ 	struct ath_common *common = ath9k_hw_common(ah);
++	u32 mac_status, last_mac_status = 0;
+ 	int i;
+ 
++	/* Enable access to the DMA observation bus */
++	REG_WRITE(ah, AR_MACMISC,
++		  ((AR_MACMISC_DMA_OBS_LINE_8 << AR_MACMISC_DMA_OBS_S) |
++		   (AR_MACMISC_MISC_OBS_BUS_1 <<
++		    AR_MACMISC_MISC_OBS_BUS_MSB_S)));
++
+ 	REG_WRITE(ah, AR_CR, AR_CR_RXD);
+ 
+ 	/* Wait for rx enable bit to go low */
+ 	for (i = AH_RX_STOP_DMA_TIMEOUT / AH_TIME_QUANTUM; i != 0; i--) {
+ 		if ((REG_READ(ah, AR_CR) & AR_CR_RXE) == 0)
+ 			break;
++
++		if (!AR_SREV_9300_20_OR_LATER(ah)) {
++			mac_status = REG_READ(ah, AR_DMADBG_7) & 0x7f0;
++			if (mac_status == 0x1c0 && mac_status == last_mac_status) {
++				*reset = true;
++				break;
++			}
++
++			last_mac_status = mac_status;
++		}
++
+ 		udelay(AH_TIME_QUANTUM);
+ 	}
+ 
+ 	if (i == 0) {
+ 		ath_err(common,
+-			"DMA failed to stop in %d ms AR_CR=0x%08x AR_DIAG_SW=0x%08x\n",
++			"DMA failed to stop in %d ms AR_CR=0x%08x AR_DIAG_SW=0x%08x DMADBG_7=0x%08x\n",
+ 			AH_RX_STOP_DMA_TIMEOUT / 1000,
+ 			REG_READ(ah, AR_CR),
+-			REG_READ(ah, AR_DIAG_SW));
++			REG_READ(ah, AR_DIAG_SW),
++			REG_READ(ah, AR_DMADBG_7));
+ 		return false;
+ 	} else {
+ 		return true;
+diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
+index 7512f97..d9cc299 100644
+--- a/drivers/net/wireless/ath/ath9k/mac.h
++++ b/drivers/net/wireless/ath/ath9k/mac.h
+@@ -692,7 +692,7 @@ bool ath9k_hw_setrxabort(struct ath_hw *ah, bool set);
+ void ath9k_hw_putrxbuf(struct ath_hw *ah, u32 rxdp);
+ void ath9k_hw_startpcureceive(struct ath_hw *ah, bool is_scanning);
+ void ath9k_hw_abortpcurecv(struct ath_hw *ah);
+-bool ath9k_hw_stopdmarecv(struct ath_hw *ah);
++bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset);
+ int ath9k_hw_beaconq_setup(struct ath_hw *ah);
+ 
+ /* Interrupt Handling */
+diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
+index 3867a2e..89546bc 100644
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -513,12 +513,12 @@ start_recv:
+ bool ath_stoprecv(struct ath_softc *sc)
+ {
+ 	struct ath_hw *ah = sc->sc_ah;
+-	bool stopped;
++	bool stopped, reset = false;
+ 
+ 	spin_lock_bh(&sc->rx.rxbuflock);
+ 	ath9k_hw_abortpcurecv(ah);
+ 	ath9k_hw_setrxfilter(ah, 0);
+-	stopped = ath9k_hw_stopdmarecv(ah);
++	stopped = ath9k_hw_stopdmarecv(ah, &reset);
+ 
+ 	if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+ 		ath_edma_stop_recv(sc);
+@@ -533,7 +533,7 @@ bool ath_stoprecv(struct ath_softc *sc)
+ 			"confusing the DMA engine when we start RX up\n");
+ 		ATH_DBG_WARN_ON_ONCE(!stopped);
+ 	}
+-	return stopped;
++	return stopped || reset;
+ }
+ 
+ void ath_flushrecv(struct ath_softc *sc)
+diff --git a/drivers/net/wireless/ath/regd_common.h b/drivers/net/wireless/ath/regd_common.h
+index 248c670..5c2cfe6 100644
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -195,6 +195,7 @@ static struct reg_dmn_pair_mapping regDomainPairs[] = {
+ 	{APL9_WORLD, CTL_ETSI, CTL_ETSI},
+ 
+ 	{APL3_FCCA, CTL_FCC, CTL_FCC},
++	{APL7_FCCA, CTL_FCC, CTL_FCC},
+ 	{APL1_ETSIC, CTL_FCC, CTL_ETSI},
+ 	{APL2_ETSIC, CTL_FCC, CTL_ETSI},
+ 	{APL2_APLD, CTL_FCC, NO_CTL},
+diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+index 65b5834..c2dd4cd 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
++++ b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+@@ -74,8 +74,6 @@
+ /* RSSI to dBm */
+ #define IWL39_RSSI_OFFSET	95
+ 
+-#define IWL_DEFAULT_TX_POWER	0x0F
+-
+ /*
+  * EEPROM related constants, enums, and structures.
+  */
+diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
+index 39b6f16..4e7b58b 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
++++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
+@@ -1823,7 +1823,7 @@ int iwl3945_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+ 
+ 	/* If we issue a new RXON command which required a tune then we must
+ 	 * send a new TXPOWER command or we won't be able to Tx any frames */
+-	rc = priv->cfg->ops->lib->send_tx_power(priv);
++	rc = iwl_set_tx_power(priv, priv->tx_power_next, true);
+ 	if (rc) {
+ 		IWL_ERR(priv, "Error setting Tx power (%d).\n", rc);
+ 		return rc;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
+index 91a9f52..992caa0 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
++++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
+@@ -1571,7 +1571,7 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *c
+ 
+ 	/* If we issue a new RXON command which required a tune then we must
+ 	 * send a new TXPOWER command or we won't be able to Tx any frames */
+-	ret = iwl_set_tx_power(priv, priv->tx_power_user_lmt, true);
++	ret = iwl_set_tx_power(priv, priv->tx_power_next, true);
+ 	if (ret) {
+ 		IWL_ERR(priv, "Error sending TX power (%d)\n", ret);
+ 		return ret;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+index 6d140bd..ee802fe 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+@@ -288,10 +288,9 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+ 	 * If we issue a new RXON command which required a tune then we must
+ 	 * send a new TXPOWER command or we won't be able to Tx any frames.
+ 	 *
+-	 * FIXME: which RXON requires a tune? Can we optimise this out in
+-	 *        some cases?
++	 * It's expected we set power here if channel is changing.
+ 	 */
+-	ret = iwl_set_tx_power(priv, priv->tx_power_user_lmt, true);
++	ret = iwl_set_tx_power(priv, priv->tx_power_next, true);
+ 	if (ret) {
+ 		IWL_ERR(priv, "Error sending TX power (%d)\n", ret);
+ 		return ret;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
+index c1cfd99..35239f0 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -3841,12 +3841,6 @@ static int iwl_init_drv(struct iwl_priv *priv)
+ 		priv->dynamic_frag_thresh = BT_FRAG_THRESHOLD_DEF;
+ 	}
+ 
+-	/* Set the tx_power_user_lmt to the lowest power level
+-	 * this value will get overwritten by channel max power avg
+-	 * from eeprom */
+-	priv->tx_power_user_lmt = IWLAGN_TX_POWER_TARGET_POWER_MIN;
+-	priv->tx_power_next = IWLAGN_TX_POWER_TARGET_POWER_MIN;
+-
+ 	ret = iwl_init_channel_map(priv);
+ 	if (ret) {
+ 		IWL_ERR(priv, "initializing regulatory failed: %d\n", ret);
+diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
+index efbde1f..294e9fc 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -168,6 +168,7 @@ int iwlcore_init_geos(struct iwl_priv *priv)
+ 	struct ieee80211_channel *geo_ch;
+ 	struct ieee80211_rate *rates;
+ 	int i = 0;
++	s8 max_tx_power = 0;
+ 
+ 	if (priv->bands[IEEE80211_BAND_2GHZ].n_bitrates ||
+ 	    priv->bands[IEEE80211_BAND_5GHZ].n_bitrates) {
+@@ -244,8 +245,8 @@ int iwlcore_init_geos(struct iwl_priv *priv)
+ 
+ 			geo_ch->flags |= ch->ht40_extension_channel;
+ 
+-			if (ch->max_power_avg > priv->tx_power_device_lmt)
+-				priv->tx_power_device_lmt = ch->max_power_avg;
++			if (ch->max_power_avg > max_tx_power)
++				max_tx_power = ch->max_power_avg;
+ 		} else {
+ 			geo_ch->flags |= IEEE80211_CHAN_DISABLED;
+ 		}
+@@ -258,6 +259,10 @@ int iwlcore_init_geos(struct iwl_priv *priv)
+ 				 geo_ch->flags);
+ 	}
+ 
++	priv->tx_power_device_lmt = max_tx_power;
++	priv->tx_power_user_lmt = max_tx_power;
++	priv->tx_power_next = max_tx_power;
++
+ 	if ((priv->bands[IEEE80211_BAND_5GHZ].n_channels == 0) &&
+ 	     priv->cfg->sku & IWL_SKU_A) {
+ 		IWL_INFO(priv, "Incorrectly detected BG card as ABG. "
+@@ -1161,6 +1166,8 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
+ {
+ 	int ret;
+ 	s8 prev_tx_power;
++	bool defer;
++	struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+ 
+ 	lockdep_assert_held(&priv->mutex);
+ 
+@@ -1188,10 +1195,15 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
+ 	if (!iwl_is_ready_rf(priv))
+ 		return -EIO;
+ 
+-	/* scan complete use tx_power_next, need to be updated */
++	/* scan complete and commit_rxon use tx_power_next value,
++	 * it always need to be updated for newest request */
+ 	priv->tx_power_next = tx_power;
+-	if (test_bit(STATUS_SCANNING, &priv->status) && !force) {
+-		IWL_DEBUG_INFO(priv, "Deferring tx power set while scanning\n");
++
++	/* do not set tx power when scanning or channel changing */
++	defer = test_bit(STATUS_SCANNING, &priv->status) ||
++		memcmp(&ctx->active, &ctx->staging, sizeof(ctx->staging));
++	if (defer && !force) {
++		IWL_DEBUG_INFO(priv, "Deferring tx power set\n");
+ 		return 0;
+ 	}
+ 
+diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+index 358cfd7..8b3c127 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
++++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+@@ -724,13 +724,6 @@ int iwl_init_channel_map(struct iwl_priv *priv)
+ 					     flags & EEPROM_CHANNEL_RADAR))
+ 				       ? "" : "not ");
+ 
+-			/* Set the tx_power_user_lmt to the highest power
+-			 * supported by any channel */
+-			if (eeprom_ch_info[ch].max_power_avg >
+-						priv->tx_power_user_lmt)
+-				priv->tx_power_user_lmt =
+-				    eeprom_ch_info[ch].max_power_avg;
+-
+ 			ch_info++;
+ 		}
+ 	}
+diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+index 371abbf..64917ed 100644
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -94,6 +94,7 @@ MODULE_LICENSE("GPL");
+ struct iwl_mod_params iwl3945_mod_params = {
+ 	.sw_crypto = 1,
+ 	.restart_fw = 1,
++	.disable_hw_scan = 1,
+ 	/* the rest are 0 by default */
+ };
+ 
+@@ -3858,10 +3859,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
+ 	priv->force_reset[IWL_FW_RESET].reset_duration =
+ 		IWL_DELAY_NEXT_FORCE_FW_RELOAD;
+ 
+-
+-	priv->tx_power_user_lmt = IWL_DEFAULT_TX_POWER;
+-	priv->tx_power_next = IWL_DEFAULT_TX_POWER;
+-
+ 	if (eeprom->version < EEPROM_3945_EEPROM_VERSION) {
+ 		IWL_WARN(priv, "Unsupported EEPROM version: 0x%04X\n",
+ 			 eeprom->version);
+@@ -3995,8 +3992,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
+ 	 * "the hard way", rather than using device's scan.
+ 	 */
+ 	if (iwl3945_mod_params.disable_hw_scan) {
+-		dev_printk(KERN_DEBUG, &(pdev->dev),
+-			"sw scan support is deprecated\n");
++		IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
+ 		iwl3945_hw_ops.hw_scan = NULL;
+ 	}
+ 
+@@ -4318,8 +4314,7 @@ MODULE_PARM_DESC(debug, "debug output mask");
+ #endif
+ module_param_named(disable_hw_scan, iwl3945_mod_params.disable_hw_scan,
+ 		   int, S_IRUGO);
+-MODULE_PARM_DESC(disable_hw_scan,
+-		 "disable hardware scanning (default 0) (deprecated)");
++MODULE_PARM_DESC(disable_hw_scan, "disable hardware scanning (default 1)");
+ module_param_named(fw_restart3945, iwl3945_mod_params.restart_fw, int, S_IRUGO);
+ MODULE_PARM_DESC(fw_restart3945, "restart firmware in case of error");
+ 
+diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
+index f618b96..2cfdd38 100644
+--- a/drivers/net/wireless/p54/txrx.c
++++ b/drivers/net/wireless/p54/txrx.c
+@@ -705,7 +705,7 @@ int p54_tx_80211(struct ieee80211_hw *dev, struct sk_buff *skb)
+ 	struct p54_tx_info *p54info;
+ 	struct p54_hdr *hdr;
+ 	struct p54_tx_data *txhdr;
+-	unsigned int padding, len, extra_len;
++	unsigned int padding, len, extra_len = 0;
+ 	int i, j, ridx;
+ 	u16 hdr_flags = 0, aid = 0;
+ 	u8 rate, queue = 0, crypt_offset = 0;
+diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
+index 4789f8e..5dc5d3e 100644
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -1835,7 +1835,7 @@ static struct dmar_domain *get_domain_for_dev(struct pci_dev *pdev, int gaw)
+ 
+ 	ret = iommu_attach_domain(domain, iommu);
+ 	if (ret) {
+-		domain_exit(domain);
++		free_domain_mem(domain);
+ 		goto error;
+ 	}
+ 
+@@ -3260,9 +3260,15 @@ static int device_notifier(struct notifier_block *nb,
+ 	if (!domain)
+ 		return 0;
+ 
+-	if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through)
++	if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through) {
+ 		domain_remove_one_dev_info(domain, pdev);
+ 
++		if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
++		    !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
++		    list_empty(&domain->devices))
++			domain_exit(domain);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -3411,6 +3417,11 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain,
+ 		domain->iommu_count--;
+ 		domain_update_iommu_cap(domain);
+ 		spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags);
++
++		spin_lock_irqsave(&iommu->lock, tmp_flags);
++		clear_bit(domain->id, iommu->domain_ids);
++		iommu->domains[domain->id] = NULL;
++		spin_unlock_irqrestore(&iommu->lock, tmp_flags);
+ 	}
+ 
+ 	spin_unlock_irqrestore(&device_domain_lock, flags);
+@@ -3627,9 +3638,9 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
+ 
+ 		pte = dmar_domain->pgd;
+ 		if (dma_pte_present(pte)) {
+-			free_pgtable_page(dmar_domain->pgd);
+ 			dmar_domain->pgd = (struct dma_pte *)
+ 				phys_to_virt(dma_pte_addr(pte));
++			free_pgtable_page(pte);
+ 		}
+ 		dmar_domain->agaw--;
+ 	}
+diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
+index 114d952..21b1018 100644
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -459,6 +459,8 @@ static void ideapad_acpi_notify(struct acpi_device *adevice, u32 event)
+ 		if (test_bit(vpc_bit, &vpc1)) {
+ 			if (vpc_bit == 9)
+ 				ideapad_sync_rfk_state(adevice);
++			else if (vpc_bit == 4)
++				read_ec_data(handle, 0x12, &vpc2);
+ 			else
+ 				ideapad_input_report(priv, vpc_bit);
+ 		}
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index aa2e5d3..c4b0ef1 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -1659,8 +1659,12 @@ static void gsm_queue(struct gsm_mux *gsm)
+ 
+ 	if ((gsm->control & ~PF) == UI)
+ 		gsm->fcs = gsm_fcs_add_block(gsm->fcs, gsm->buf, gsm->len);
+-	/* generate final CRC with received FCS */
+-	gsm->fcs = gsm_fcs_add(gsm->fcs, gsm->received_fcs);
++	if (gsm->encoding == 0){
++		/* WARNING: gsm->received_fcs is used for gsm->encoding = 0 only.
++		            In this case it contain the last piece of data
++		            required to generate final CRC */
++		gsm->fcs = gsm_fcs_add(gsm->fcs, gsm->received_fcs);
++	}
+ 	if (gsm->fcs != GOOD_FCS) {
+ 		gsm->bad_fcs++;
+ 		if (debug & 4)
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index dfcf4b1..0d66751 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -382,12 +382,13 @@ static void imx_start_tx(struct uart_port *port)
+ static irqreturn_t imx_rtsint(int irq, void *dev_id)
+ {
+ 	struct imx_port *sport = dev_id;
+-	unsigned int val = readl(sport->port.membase + USR1) & USR1_RTSS;
++	unsigned int val;
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&sport->port.lock, flags);
+ 
+ 	writel(USR1_RTSD, sport->port.membase + USR1);
++	val = readl(sport->port.membase + USR1) & USR1_RTSS;
+ 	uart_handle_cts_change(&sport->port, !!val);
+ 	wake_up_interruptible(&sport->port.state->port.delta_msr_wait);
+ 
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index cc2f73e..b0043fb 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -371,6 +371,7 @@ void *virtqueue_detach_unused_buf(struct virtqueue *_vq)
+ 		/* detach_buf clears data, so grab it now. */
+ 		buf = vq->data[i];
+ 		detach_buf(vq, i);
++		vq->vring.avail->idx--;
+ 		END_USE(vq);
+ 		return buf;
+ 	}
+diff --git a/fs/file.c b/fs/file.c
+index 0be3447..4c6992d 100644
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -9,6 +9,7 @@
+ #include <linux/module.h>
+ #include <linux/fs.h>
+ #include <linux/mm.h>
++#include <linux/mmzone.h>
+ #include <linux/time.h>
+ #include <linux/sched.h>
+ #include <linux/slab.h>
+@@ -39,14 +40,17 @@ int sysctl_nr_open_max = 1024 * 1024; /* raised later */
+  */
+ static DEFINE_PER_CPU(struct fdtable_defer, fdtable_defer_list);
+ 
+-static inline void *alloc_fdmem(unsigned int size)
++static void *alloc_fdmem(unsigned int size)
+ {
+-	void *data;
+-
+-	data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN);
+-	if (data != NULL)
+-		return data;
+-
++	/*
++	 * Very large allocations can stress page reclaim, so fall back to
++	 * vmalloc() if the allocation size will be considered "large" by the VM.
++	 */
++	if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
++		void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN);
++		if (data != NULL)
++			return data;
++	}
+ 	return vmalloc(size);
+ }
+ 
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 0592288..6221640 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1600,7 +1600,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ 	int status = 0;
+ 
+ 	/* Ensure exclusive access to NFSv4 state */
+-	for(;;) {
++	do {
+ 		if (test_and_clear_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state)) {
+ 			/* We're going to have to re-establish a clientid */
+ 			status = nfs4_reclaim_lease(clp);
+@@ -1684,7 +1684,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ 			break;
+ 		if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
+ 			break;
+-	}
++	} while (atomic_read(&clp->cl_count) > 1);
+ 	return;
+ out_error:
+ 	printk(KERN_WARNING "Error: state manager failed on NFSv4 server %s"
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index b68c860..6a2ec50 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -2077,6 +2077,15 @@ nfs_remount(struct super_block *sb, int *flags, char *raw_data)
+ 	if (error < 0)
+ 		goto out;
+ 
++	/*
++	 * noac is a special case. It implies -o sync, but that's not
++	 * necessarily reflected in the mtab options. do_remount_sb
++	 * will clear MS_SYNCHRONOUS if -o sync wasn't specified in the
++	 * remount options, so we have to explicitly reset it.
++	 */
++	if (data->flags & NFS_MOUNT_NOAC)
++		*flags |= MS_SYNCHRONOUS;
++
+ 	/* compare new mount options with old ones */
+ 	error = nfs_compare_remount_data(nfss, data);
+ out:
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 96aaaa4..18c356c 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -258,6 +258,7 @@ static void nfs4_put_deleg_lease(struct nfs4_file *fp)
+ 	if (atomic_dec_and_test(&fp->fi_delegees)) {
+ 		vfs_setlease(fp->fi_deleg_file, F_UNLCK, &fp->fi_lease);
+ 		fp->fi_lease = NULL;
++		fput(fp->fi_deleg_file);
+ 		fp->fi_deleg_file = NULL;
+ 	}
+ }
+@@ -402,8 +403,8 @@ static void free_generic_stateid(struct nfs4_stateid *stp)
+ 	if (stp->st_access_bmap) {
+ 		oflag = nfs4_access_bmap_to_omode(stp);
+ 		nfs4_file_put_access(stp->st_file, oflag);
+-		put_nfs4_file(stp->st_file);
+ 	}
++	put_nfs4_file(stp->st_file);
+ 	kmem_cache_free(stateid_slab, stp);
+ }
+ 
+diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c
+index 77e9b87..c0c590f 100644
+--- a/fs/ubifs/recovery.c
++++ b/fs/ubifs/recovery.c
+@@ -300,6 +300,32 @@ int ubifs_recover_master_node(struct ubifs_info *c)
+ 			goto out_free;
+ 		}
+ 		memcpy(c->rcvrd_mst_node, c->mst_node, UBIFS_MST_NODE_SZ);
++
++		/*
++		 * We had to recover the master node, which means there was an
++		 * unclean reboot. However, it is possible that the master node
++		 * is clean at this point, i.e., %UBIFS_MST_DIRTY is not set.
++		 * E.g., consider the following chain of events:
++		 *
++		 * 1. UBIFS was cleanly unmounted, so the master node is clean
++		 * 2. UBIFS is being mounted R/W and starts changing the master
++		 *    node in the first (%UBIFS_MST_LNUM). A power cut happens,
++		 *    so this LEB ends up with some amount of garbage at the
++		 *    end.
++		 * 3. UBIFS is being mounted R/O. We reach this place and
++		 *    recover the master node from the second LEB
++		 *    (%UBIFS_MST_LNUM + 1). But we cannot update the media
++		 *    because we are being mounted R/O. We have to defer the
++		 *    operation.
++		 * 4. However, this master node (@c->mst_node) is marked as
++		 *    clean (since the step 1). And if we just return, the
++		 *    mount code will be confused and won't recover the master
++		 *    node when it is re-mounter R/W later.
++		 *
++		 *    Thus, to force the recovery by marking the master node as
++		 *    dirty.
++		 */
++		c->mst_node->flags |= cpu_to_le32(UBIFS_MST_DIRTY);
+ 	} else {
+ 		/* Write the recovered master node */
+ 		c->max_sqnum = le64_to_cpu(mst->ch.sqnum) - 1;
+diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
+index 0f029e1..e94d962 100644
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1643,15 +1643,27 @@ static int ubifs_remount_rw(struct ubifs_info *c)
+ 	if (err)
+ 		goto out;
+ 
++	dbg_gen("re-mounted read-write");
++	c->remounting_rw = 0;
++
+ 	if (c->need_recovery) {
+ 		c->need_recovery = 0;
+ 		ubifs_msg("deferred recovery completed");
++	} else {
++		/*
++		 * Do not run the debugging space check if the were doing
++		 * recovery, because when we saved the information we had the
++		 * file-system in a state where the TNC and lprops has been
++		 * modified in memory, but all the I/O operations (including a
++		 * commit) were deferred. So the file-system was in
++		 * "non-committed" state. Now the file-system is in committed
++		 * state, and of course the amount of free space will change
++		 * because, for example, the old index size was imprecise.
++		 */
++		err = dbg_check_space_info(c);
+ 	}
+ 
+-	dbg_gen("re-mounted read-write");
+-	c->remounting_rw = 0;
+ 	c->always_chk_crc = 0;
+-	err = dbg_check_space_info(c);
+ 	mutex_unlock(&c->umount_mutex);
+ 	return err;
+ 
+diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
+index df29c8f..8847c8c 100644
+--- a/include/linux/huge_mm.h
++++ b/include/linux/huge_mm.h
+@@ -117,7 +117,7 @@ static inline void vma_adjust_trans_huge(struct vm_area_struct *vma,
+ 					 unsigned long end,
+ 					 long adjust_next)
+ {
+-	if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
++	if (!vma->anon_vma || vma->vm_ops)
+ 		return;
+ 	__vma_adjust_trans_huge(vma, start, end, adjust_next);
+ }
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index c9c5d7a..1f00080 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -203,6 +203,7 @@ enum {
+ 					      * management */
+ 	ATA_FLAG_SW_ACTIVITY	= (1 << 22), /* driver supports sw activity
+ 					      * led */
++	ATA_FLAG_NO_DIPM	= (1 << 23), /* host not happy with DIPM */
+ 
+ 	/* bits 24:31 of ap->flags are reserved for LLD specific flags */
+ 
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index c67adb4..248c946 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -137,7 +137,8 @@ extern unsigned int kobjsize(const void *objp);
+ #define VM_RandomReadHint(v)		((v)->vm_flags & VM_RAND_READ)
+ 
+ /*
+- * special vmas that are non-mergable, non-mlock()able
++ * Special vmas that are non-mergable, non-mlock()able.
++ * Note: mm/huge_memory.c VM_NO_THP depends on this definition.
+  */
+ #define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_RESERVED | VM_PFNMAP)
+ 
+diff --git a/init/Kconfig b/init/Kconfig
+index be788c0..47dd02f 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1209,6 +1209,7 @@ config SLAB
+ 	  per cpu and per node queues.
+ 
+ config SLUB
++	depends on BROKEN || NUMA || !DISCONTIGMEM
+ 	bool "SLUB (Unqueued Allocator)"
+ 	help
+ 	   SLUB is a slab allocator that minimizes cache line usage
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 8f76561..56cac93 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1400,6 +1400,9 @@ out:
+ 	return ret;
+ }
+ 
++#define VM_NO_THP (VM_SPECIAL|VM_INSERTPAGE|VM_MIXEDMAP|VM_SAO| \
++		   VM_HUGETLB|VM_SHARED|VM_MAYSHARE)
++
+ int hugepage_madvise(struct vm_area_struct *vma,
+ 		     unsigned long *vm_flags, int advice)
+ {
+@@ -1408,11 +1411,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
+ 		/*
+ 		 * Be somewhat over-protective like KSM for now!
+ 		 */
+-		if (*vm_flags & (VM_HUGEPAGE |
+-				 VM_SHARED   | VM_MAYSHARE   |
+-				 VM_PFNMAP   | VM_IO      | VM_DONTEXPAND |
+-				 VM_RESERVED | VM_HUGETLB | VM_INSERTPAGE |
+-				 VM_MIXEDMAP | VM_SAO))
++		if (*vm_flags & (VM_HUGEPAGE | VM_NO_THP))
+ 			return -EINVAL;
+ 		*vm_flags &= ~VM_NOHUGEPAGE;
+ 		*vm_flags |= VM_HUGEPAGE;
+@@ -1428,11 +1427,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
+ 		/*
+ 		 * Be somewhat over-protective like KSM for now!
+ 		 */
+-		if (*vm_flags & (VM_NOHUGEPAGE |
+-				 VM_SHARED   | VM_MAYSHARE   |
+-				 VM_PFNMAP   | VM_IO      | VM_DONTEXPAND |
+-				 VM_RESERVED | VM_HUGETLB | VM_INSERTPAGE |
+-				 VM_MIXEDMAP | VM_SAO))
++		if (*vm_flags & (VM_NOHUGEPAGE | VM_NO_THP))
+ 			return -EINVAL;
+ 		*vm_flags &= ~VM_HUGEPAGE;
+ 		*vm_flags |= VM_NOHUGEPAGE;
+@@ -1566,10 +1561,14 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
+ 		 * page fault if needed.
+ 		 */
+ 		return 0;
+-	if (vma->vm_file || vma->vm_ops)
++	if (vma->vm_ops)
+ 		/* khugepaged not yet working on file or special mappings */
+ 		return 0;
+-	VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
++	/*
++	 * If is_pfn_mapping() is true is_learn_pfn_mapping() must be
++	 * true too, verify it here.
++	 */
++	VM_BUG_ON(is_linear_pfn_mapping(vma) || vma->vm_flags & VM_NO_THP);
+ 	hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ 	hend = vma->vm_end & HPAGE_PMD_MASK;
+ 	if (hstart < hend)
+@@ -1818,12 +1817,15 @@ static void collapse_huge_page(struct mm_struct *mm,
+ 	    (vma->vm_flags & VM_NOHUGEPAGE))
+ 		goto out;
+ 
+-	/* VM_PFNMAP vmas may have vm_ops null but vm_file set */
+-	if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
++	if (!vma->anon_vma || vma->vm_ops)
+ 		goto out;
+ 	if (is_vma_temporary_stack(vma))
+ 		goto out;
+-	VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
++	/*
++	 * If is_pfn_mapping() is true is_learn_pfn_mapping() must be
++	 * true too, verify it here.
++	 */
++	VM_BUG_ON(is_linear_pfn_mapping(vma) || vma->vm_flags & VM_NO_THP);
+ 
+ 	pgd = pgd_offset(mm, address);
+ 	if (!pgd_present(*pgd))
+@@ -2056,13 +2058,16 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages,
+ 			progress++;
+ 			continue;
+ 		}
+-		/* VM_PFNMAP vmas may have vm_ops null but vm_file set */
+-		if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
++		if (!vma->anon_vma || vma->vm_ops)
+ 			goto skip;
+ 		if (is_vma_temporary_stack(vma))
+ 			goto skip;
+-
+-		VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
++		/*
++		 * If is_pfn_mapping() is true is_learn_pfn_mapping()
++		 * must be true too, verify it here.
++		 */
++		VM_BUG_ON(is_linear_pfn_mapping(vma) ||
++			  vma->vm_flags & VM_NO_THP);
+ 
+ 		hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ 		hend = vma->vm_end & HPAGE_PMD_MASK;
+diff --git a/mm/memory.c b/mm/memory.c
+index f17746a..ab88d09 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3332,7 +3332,7 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ 	 * run pte_offset_map on the pmd, if an huge pmd could
+ 	 * materialize from under us from a different thread.
+ 	 */
+-	if (unlikely(__pte_alloc(mm, vma, pmd, address)))
++	if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
+ 		return VM_FAULT_OOM;
+ 	/* if an huge pmd materialized from under us just retry later */
+ 	if (unlikely(pmd_trans_huge(*pmd)))
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c
+index ea16f72..49ea0cc 100644
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -172,10 +172,13 @@ unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem,
+ 
+ 	/*
+ 	 * The baseline for the badness score is the proportion of RAM that each
+-	 * task's rss and swap space use.
++	 * task's rss, pagetable and swap space use.
+ 	 */
+-	points = (get_mm_rss(p->mm) + get_mm_counter(p->mm, MM_SWAPENTS)) * 1000 /
+-			totalpages;
++	points = get_mm_rss(p->mm) + p->mm->nr_ptes;
++	points += get_mm_counter(p->mm, MM_SWAPENTS);
++
++	points *= 1000;
++	points /= totalpages;
+ 	task_unlock(p);
+ 
+ 	/*
+diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
+index 659326c..006ad81 100644
+--- a/scripts/kconfig/conf.c
++++ b/scripts/kconfig/conf.c
+@@ -332,7 +332,7 @@ static int conf_choice(struct menu *menu)
+ 		}
+ 		if (!child)
+ 			continue;
+-		if (line[strlen(line) - 1] == '?') {
++		if (line[0] && line[strlen(line) - 1] == '?') {
+ 			print_help(child);
+ 			continue;
+ 		}
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index da7cdca..8ff0223 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -14945,6 +14945,23 @@ static void alc269_fixup_hweq(struct hda_codec *codec,
+ 	alc_write_coef_idx(codec, 0x1e, coef | 0x80);
+ }
+ 
++static void alc271_fixup_dmic(struct hda_codec *codec,
++			      const struct alc_fixup *fix, int action)
++{
++	static struct hda_verb verbs[] = {
++		{0x20, AC_VERB_SET_COEF_INDEX, 0x0d},
++		{0x20, AC_VERB_SET_PROC_COEF, 0x4000},
++		{}
++	};
++	unsigned int cfg;
++
++	if (strcmp(codec->chip_name, "ALC271X"))
++		return;
++	cfg = snd_hda_codec_get_pincfg(codec, 0x12);
++	if (get_defcfg_connect(cfg) == AC_JACK_PORT_FIXED)
++		snd_hda_sequence_write(codec, verbs);
++}
++
+ enum {
+ 	ALC269_FIXUP_SONY_VAIO,
+ 	ALC275_FIXUP_SONY_VAIO_GPIO2,
+@@ -14953,6 +14970,7 @@ enum {
+ 	ALC269_FIXUP_ASUS_G73JW,
+ 	ALC269_FIXUP_LENOVO_EAPD,
+ 	ALC275_FIXUP_SONY_HWEQ,
++	ALC271_FIXUP_DMIC,
+ };
+ 
+ static const struct alc_fixup alc269_fixups[] = {
+@@ -15006,7 +15024,11 @@ static const struct alc_fixup alc269_fixups[] = {
+ 		.v.func = alc269_fixup_hweq,
+ 		.chained = true,
+ 		.chain_id = ALC275_FIXUP_SONY_VAIO_GPIO2
+-	}
++	},
++	[ALC271_FIXUP_DMIC] = {
++		.type = ALC_FIXUP_FUNC,
++		.v.func = alc271_fixup_dmic,
++	},
+ };
+ 
+ static struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -15015,6 +15037,7 @@ static struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
+ 	SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
+ 	SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
++	SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
+ 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
+ 	SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
+ 	SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
+diff --git a/sound/soc/codecs/jz4740.c b/sound/soc/codecs/jz4740.c
+index f7cd346..f5ccdbf 100644
+--- a/sound/soc/codecs/jz4740.c
++++ b/sound/soc/codecs/jz4740.c
+@@ -308,8 +308,6 @@ static int jz4740_codec_dev_probe(struct snd_soc_codec *codec)
+ 	snd_soc_dapm_add_routes(dapm, jz4740_codec_dapm_routes,
+ 		ARRAY_SIZE(jz4740_codec_dapm_routes));
+ 
+-	snd_soc_dapm_new_widgets(codec);
+-
+ 	jz4740_codec_set_bias_level(codec, SND_SOC_BIAS_STANDBY);
+ 
+ 	return 0;
+diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
+index 5168927..d365f43 100644
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -739,12 +739,12 @@ static const struct snd_soc_dapm_route analogue_routes[] = {
+ 
+ 	{ "SPKL", "Input Switch", "MIXINL" },
+ 	{ "SPKL", "IN1LP Switch", "IN1LP" },
+-	{ "SPKL", "Output Switch", "Left Output Mixer" },
++	{ "SPKL", "Output Switch", "Left Output PGA" },
+ 	{ "SPKL", NULL, "TOCLK" },
+ 
+ 	{ "SPKR", "Input Switch", "MIXINR" },
+ 	{ "SPKR", "IN1RP Switch", "IN1RP" },
+-	{ "SPKR", "Output Switch", "Right Output Mixer" },
++	{ "SPKR", "Output Switch", "Right Output PGA" },
+ 	{ "SPKR", NULL, "TOCLK" },
+ 
+ 	{ "SPKL Boost", "Direct Voice Switch", "Direct Voice" },
+@@ -766,8 +766,8 @@ static const struct snd_soc_dapm_route analogue_routes[] = {
+ 	{ "SPKOUTRP", NULL, "SPKR Driver" },
+ 	{ "SPKOUTRN", NULL, "SPKR Driver" },
+ 
+-	{ "Left Headphone Mux", "Mixer", "Left Output Mixer" },
+-	{ "Right Headphone Mux", "Mixer", "Right Output Mixer" },
++	{ "Left Headphone Mux", "Mixer", "Left Output PGA" },
++	{ "Right Headphone Mux", "Mixer", "Right Output PGA" },
+ 
+ 	{ "Headphone PGA", NULL, "Left Headphone Mux" },
+ 	{ "Headphone PGA", NULL, "Right Headphone Mux" },