[gentoo-commits] linux-patches r2821 - genpatches-2.6/trunk/3.4

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2014-06-09 17:53:50 +0000 (Mon, 09 Jun 2014)
New Revision: 2821

Added:
   genpatches-2.6/trunk/3.4/1091_linux-3.4.92.patch
Removed:
   genpatches-2.6/trunk/3.4/1501-futex-add-another-early-deadlock-detection-check.patch
   genpatches-2.6/trunk/3.4/1502-futex-prevent-attaching-to-kernel-threads.patch
   genpatches-2.6/trunk/3.4/1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch
   genpatches-2.6/trunk/3.4/1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch
   genpatches-2.6/trunk/3.4/1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch
   genpatches-2.6/trunk/3.4/1506-futex-make-lookup_pi_state-more-robust.patch
   genpatches-2.6/trunk/3.4/2700_thinkpad-acpi_fix-issuing-duplicated-keyevents-for-brightness.patch
Modified:
   genpatches-2.6/trunk/3.4/0000_README
Log:
Linux patch 3.4.92. Removal of redundant patches.

Modified: genpatches-2.6/trunk/3.4/0000_README
===================================================================
--- genpatches-2.6/trunk/3.4/0000_README	2014-06-09 12:35:00 UTC (rev 2820)
+++ genpatches-2.6/trunk/3.4/0000_README	2014-06-09 17:53:50 UTC (rev 2821)
@@ -403,6 +403,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.4.91
 
+Patch:  1091_linux-3.4.92.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.4.92
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
@@ -411,30 +415,6 @@
 From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6a96e15096da6e7491107321cfa660c7c2aa119d
 Desc:   selinux: add SOCK_DIAG_BY_FAMILY to the list of netlink message types
 
-Patch:  1501-futex-add-another-early-deadlock-detection-check.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=866293ee54227584ffcb4a42f69c1f365974ba7f
-Desc:   CVE-2014-3153
-
-Patch:  1502-futex-prevent-attaching-to-kernel-threads.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f0d71b3dcb8332f7971b5f2363632573e6d9486a
-Desc:   CVE-2014-3153
-
-Patch:  1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9c243a5a6de0be8e584c604d353412584b592f8
-Desc:   CVE-2014-3153
-
-Patch:  1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270
-Desc:   CVE-2014-3153
-
-Patch:  1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e
-Desc:   CVE-2014-3153
-
-Patch:  1506-futex-make-lookup_pi_state-more-robust.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339
-Desc:   CVE-2014-3153
-
 Patch:  1512_af_key-initialize-satype-in-key_notify_policy_flush.patch
 From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=85dfb745ee40232876663ae206cba35f24ab2a40
 Desc:   af_key: initialize satype in key_notify_policy_flush()
@@ -459,10 +439,6 @@
 From:   Seth Forshee <seth.forshee@×××××××××.com>
 Desc:   ACPI: Disable Windows 8 compatibility for some Lenovo ThinkPads
 
-Patch:  2700_thinkpad-acpi_fix-issuing-duplicated-keyevents-for-brightness.patch
-From:   http://www.spinics.net/lists/ibm-acpi-devel/msg02805.html
-Desc:   thinkpad-acpi: fix issuing duplicated key events for brightness up/down
-
 Patch:  4200_fbcondecor-0.9.6.patch
 From:   http://dev.gentoo.org/~spock
 Desc:   Bootsplash successor by Michal Januszewski ported by Alexxy

Added: genpatches-2.6/trunk/3.4/1091_linux-3.4.92.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1091_linux-3.4.92.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.4/1091_linux-3.4.92.patch	2014-06-09 17:53:50 UTC (rev 2821)
@@ -0,0 +1,7740 @@
+diff --git a/Documentation/i2c/busses/i2c-piix4 b/Documentation/i2c/busses/i2c-piix4
+index 475bb4ae0720..65da15796ed3 100644
+--- a/Documentation/i2c/busses/i2c-piix4
++++ b/Documentation/i2c/busses/i2c-piix4
+@@ -8,7 +8,7 @@ Supported adapters:
+     Datasheet: Only available via NDA from ServerWorks
+   * ATI IXP200, IXP300, IXP400, SB600, SB700 and SB800 southbridges
+     Datasheet: Not publicly available
+-  * AMD Hudson-2
++  * AMD Hudson-2, CZ
+     Datasheet: Not publicly available
+   * Standard Microsystems (SMSC) SLC90E66 (Victory66) southbridge
+     Datasheet: Publicly available at the SMSC website http://www.smsc.com
+diff --git a/Documentation/ja_JP/HOWTO b/Documentation/ja_JP/HOWTO
+index 050d37fe6d40..46ed73593465 100644
+--- a/Documentation/ja_JP/HOWTO
++++ b/Documentation/ja_JP/HOWTO
+@@ -315,7 +315,7 @@ Andrew Morton が Linux-kernel メーリングリストにカーネルリリー
+ もし、2.6.x.y カーネルが存在しない場合には、番号が一番大きい 2.6.x が
+ 最新の安定版カーネルです。
+ 
+-2.6.x.y は "stable" チーム <stable@××××××.org> でメンテされており、必
++2.6.x.y は "stable" チーム <stable@×××××××××××.org> でメンテされており、必
+ 要に応じてリリースされます。通常のリリース期間は 2週間毎ですが、差し迫っ
+ た問題がなければもう少し長くなることもあります。セキュリティ関連の問題
+ の場合はこれに対してだいたいの場合、すぐにリリースがされます。
+diff --git a/Documentation/ja_JP/stable_kernel_rules.txt b/Documentation/ja_JP/stable_kernel_rules.txt
+index 14265837c4ce..9dbda9b5d21e 100644
+--- a/Documentation/ja_JP/stable_kernel_rules.txt
++++ b/Documentation/ja_JP/stable_kernel_rules.txt
+@@ -50,16 +50,16 @@ linux-2.6.29/Documentation/stable_kernel_rules.txt
+ 
+ -stable ツリーにパッチを送付する手続き-
+ 
+- - 上記の規則に従っているかを確認した後に、stable@××××××.org にパッチ
++ - 上記の規則に従っているかを確認した後に、stable@×××××××××××.org にパッチ
+    を送る。
+  - 送信者はパッチがキューに受け付けられた際には ACK を、却下された場合
+    には NAK を受け取る。この反応は開発者たちのスケジュールによって、数
+    日かかる場合がある。
+  - もし受け取られたら、パッチは他の開発者たちと関連するサブシステムの
+    メンテナーによるレビューのために -stable キューに追加される。
+- - パッチに stable@××××××.org のアドレスが付加されているときには、それ
++ - パッチに stable@×××××××××××.org のアドレスが付加されているときには、それ
+    が Linus のツリーに入る時に自動的に stable チームに email される。
+- - セキュリティパッチはこのエイリアス (stable@××××××.org) に送られるべ
++ - セキュリティパッチはこのエイリアス (stable@×××××××××××.org) に送られるべ
+    きではなく、代わりに security@××××××.org のアドレスに送られる。
+ 
+ レビューサイクル-
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index 753d18ae0105..63740dae90a0 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -773,6 +773,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+ 	edd=		[EDD]
+ 			Format: {"off" | "on" | "skip[mbr]"}
+ 
++	efi_no_storage_paranoia [EFI; X86]
++			Using this parameter you can use more than 50% of
++			your efi variable storage. Use this parameter only if
++			you are really sure that your UEFI does sane gc and
++			fulfills the spec otherwise your board may brick.
++
+ 	eisa_irq_edge=	[PARISC,HW]
+ 			See header of drivers/parisc/eisa.c.
+ 
+@@ -987,6 +993,20 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+ 	i8k.restricted	[HW] Allow controlling fans only if SYS_ADMIN
+ 			capability is set.
+ 
++	i915.invert_brightness=
++			[DRM] Invert the sense of the variable that is used to
++			set the brightness of the panel backlight. Normally a
++			brightness value of 0 indicates backlight switched off,
++			and the maximum of the brightness value sets the backlight
++			to maximum brightness. If this parameter is set to 0
++			(default) and the machine requires it, or this parameter
++			is set to 1, a brightness value of 0 sets the backlight
++			to maximum brightness, and the maximum of the brightness
++			value switches the backlight off.
++			-1 -- never invert brightness
++			 0 -- machine default
++			 1 -- force brightness inversion
++
+ 	icn=		[HW,ISDN]
+ 			Format: <io>[,<membase>[,<icn_id>[,<icn_id2>]]]
+ 
+diff --git a/Documentation/zh_CN/HOWTO b/Documentation/zh_CN/HOWTO
+index 7fba5aab9ef9..7599eb38b764 100644
+--- a/Documentation/zh_CN/HOWTO
++++ b/Documentation/zh_CN/HOWTO
+@@ -237,7 +237,7 @@ kernel.org网站的pub/linux/kernel/v2.6/目录下找到它。它的开发遵循
+ 如果没有2.6.x.y版本内核存在，那么最新的2.6.x版本内核就相当于是当前的稳定
+ 版内核。
+ 
+-2.6.x.y版本由“稳定版”小组（邮件地址<stable@××××××.org>）维护，一般隔周发
++2.6.x.y版本由“稳定版”小组（邮件地址<stable@×××××××××××.org>）维护，一般隔周发
+ 布新版本。
+ 
+ 内核源码中的Documentation/stable_kernel_rules.txt文件具体描述了可被稳定
+diff --git a/Documentation/zh_CN/stable_kernel_rules.txt b/Documentation/zh_CN/stable_kernel_rules.txt
+index b5b9b0ab02fd..26ea5ed7cd9c 100644
+--- a/Documentation/zh_CN/stable_kernel_rules.txt
++++ b/Documentation/zh_CN/stable_kernel_rules.txt
+@@ -42,7 +42,7 @@ Documentation/stable_kernel_rules.txt 的中文翻译
+ 
+ 向稳定版代码树提交补丁的过程：
+ 
+-  - 在确认了补丁符合以上的规则后，将补丁发送到stable@××××××.org。
++  - 在确认了补丁符合以上的规则后，将补丁发送到stable@×××××××××××.org。
+   - 如果补丁被接受到队列里，发送者会收到一个ACK回复，如果没有被接受，收
+     到的是NAK回复。回复需要几天的时间，这取决于开发者的时间安排。
+   - 被接受的补丁会被加到稳定版本队列里，等待其他开发者的审查。
+diff --git a/Makefile b/Makefile
+index 16899b9ba84f..513b460b49f9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 91
++SUBLEVEL = 92
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/kernel/crash_dump.c b/arch/arm/kernel/crash_dump.c
+index 90c50d4b43f7..5d1286d51154 100644
+--- a/arch/arm/kernel/crash_dump.c
++++ b/arch/arm/kernel/crash_dump.c
+@@ -39,7 +39,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
+ 	if (!csize)
+ 		return 0;
+ 
+-	vaddr = ioremap(pfn << PAGE_SHIFT, PAGE_SIZE);
++	vaddr = ioremap(__pfn_to_phys(pfn), PAGE_SIZE);
+ 	if (!vaddr)
+ 		return -ENOMEM;
+ 
+diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
+index 3735abd7f8f6..4014d9064be1 100644
+--- a/arch/parisc/kernel/syscall_table.S
++++ b/arch/parisc/kernel/syscall_table.S
+@@ -395,7 +395,7 @@
+ 	ENTRY_COMP(vmsplice)
+ 	ENTRY_COMP(move_pages)		/* 295 */
+ 	ENTRY_SAME(getcpu)
+-	ENTRY_SAME(epoll_pwait)
++	ENTRY_COMP(epoll_pwait)
+ 	ENTRY_COMP(statfs64)
+ 	ENTRY_COMP(fstatfs64)
+ 	ENTRY_COMP(kexec_load)		/* 300 */
+diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
+index a9ce135893f8..3ec8b394146d 100644
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -35,7 +35,6 @@ static u8 *ctrblk;
+ static char keylen_flag;
+ 
+ struct s390_aes_ctx {
+-	u8 iv[AES_BLOCK_SIZE];
+ 	u8 key[AES_MAX_KEY_SIZE];
+ 	long enc;
+ 	long dec;
+@@ -56,8 +55,7 @@ struct pcc_param {
+ 
+ struct s390_xts_ctx {
+ 	u8 key[32];
+-	u8 xts_param[16];
+-	struct pcc_param pcc;
++	u8 pcc_key[32];
+ 	long enc;
+ 	long dec;
+ 	int key_len;
+@@ -442,29 +440,35 @@ static int cbc_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
+ 	return aes_set_key(tfm, in_key, key_len);
+ }
+ 
+-static int cbc_aes_crypt(struct blkcipher_desc *desc, long func, void *param,
++static int cbc_aes_crypt(struct blkcipher_desc *desc, long func,
+ 			 struct blkcipher_walk *walk)
+ {
++	struct s390_aes_ctx *sctx = crypto_blkcipher_ctx(desc->tfm);
+ 	int ret = blkcipher_walk_virt(desc, walk);
+ 	unsigned int nbytes = walk->nbytes;
++	struct {
++		u8 iv[AES_BLOCK_SIZE];
++		u8 key[AES_MAX_KEY_SIZE];
++	} param;
+ 
+ 	if (!nbytes)
+ 		goto out;
+ 
+-	memcpy(param, walk->iv, AES_BLOCK_SIZE);
++	memcpy(param.iv, walk->iv, AES_BLOCK_SIZE);
++	memcpy(param.key, sctx->key, sctx->key_len);
+ 	do {
+ 		/* only use complete blocks */
+ 		unsigned int n = nbytes & ~(AES_BLOCK_SIZE - 1);
+ 		u8 *out = walk->dst.virt.addr;
+ 		u8 *in = walk->src.virt.addr;
+ 
+-		ret = crypt_s390_kmc(func, param, out, in, n);
++		ret = crypt_s390_kmc(func, &param, out, in, n);
+ 		BUG_ON((ret < 0) || (ret != n));
+ 
+ 		nbytes &= AES_BLOCK_SIZE - 1;
+ 		ret = blkcipher_walk_done(desc, walk, nbytes);
+ 	} while ((nbytes = walk->nbytes));
+-	memcpy(walk->iv, param, AES_BLOCK_SIZE);
++	memcpy(walk->iv, param.iv, AES_BLOCK_SIZE);
+ 
+ out:
+ 	return ret;
+@@ -481,7 +485,7 @@ static int cbc_aes_encrypt(struct blkcipher_desc *desc,
+ 		return fallback_blk_enc(desc, dst, src, nbytes);
+ 
+ 	blkcipher_walk_init(&walk, dst, src, nbytes);
+-	return cbc_aes_crypt(desc, sctx->enc, sctx->iv, &walk);
++	return cbc_aes_crypt(desc, sctx->enc, &walk);
+ }
+ 
+ static int cbc_aes_decrypt(struct blkcipher_desc *desc,
+@@ -495,7 +499,7 @@ static int cbc_aes_decrypt(struct blkcipher_desc *desc,
+ 		return fallback_blk_dec(desc, dst, src, nbytes);
+ 
+ 	blkcipher_walk_init(&walk, dst, src, nbytes);
+-	return cbc_aes_crypt(desc, sctx->dec, sctx->iv, &walk);
++	return cbc_aes_crypt(desc, sctx->dec, &walk);
+ }
+ 
+ static struct crypto_alg cbc_aes_alg = {
+@@ -587,7 +591,7 @@ static int xts_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
+ 		xts_ctx->enc = KM_XTS_128_ENCRYPT;
+ 		xts_ctx->dec = KM_XTS_128_DECRYPT;
+ 		memcpy(xts_ctx->key + 16, in_key, 16);
+-		memcpy(xts_ctx->pcc.key + 16, in_key + 16, 16);
++		memcpy(xts_ctx->pcc_key + 16, in_key + 16, 16);
+ 		break;
+ 	case 48:
+ 		xts_ctx->enc = 0;
+@@ -598,7 +602,7 @@ static int xts_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
+ 		xts_ctx->enc = KM_XTS_256_ENCRYPT;
+ 		xts_ctx->dec = KM_XTS_256_DECRYPT;
+ 		memcpy(xts_ctx->key, in_key, 32);
+-		memcpy(xts_ctx->pcc.key, in_key + 32, 32);
++		memcpy(xts_ctx->pcc_key, in_key + 32, 32);
+ 		break;
+ 	default:
+ 		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
+@@ -617,28 +621,32 @@ static int xts_aes_crypt(struct blkcipher_desc *desc, long func,
+ 	unsigned int nbytes = walk->nbytes;
+ 	unsigned int n;
+ 	u8 *in, *out;
+-	void *param;
++	struct pcc_param pcc_param;
++	struct {
++		u8 key[32];
++		u8 init[16];
++	} xts_param;
+ 
+ 	if (!nbytes)
+ 		goto out;
+ 
+-	memset(xts_ctx->pcc.block, 0, sizeof(xts_ctx->pcc.block));
+-	memset(xts_ctx->pcc.bit, 0, sizeof(xts_ctx->pcc.bit));
+-	memset(xts_ctx->pcc.xts, 0, sizeof(xts_ctx->pcc.xts));
+-	memcpy(xts_ctx->pcc.tweak, walk->iv, sizeof(xts_ctx->pcc.tweak));
+-	param = xts_ctx->pcc.key + offset;
+-	ret = crypt_s390_pcc(func, param);
++	memset(pcc_param.block, 0, sizeof(pcc_param.block));
++	memset(pcc_param.bit, 0, sizeof(pcc_param.bit));
++	memset(pcc_param.xts, 0, sizeof(pcc_param.xts));
++	memcpy(pcc_param.tweak, walk->iv, sizeof(pcc_param.tweak));
++	memcpy(pcc_param.key, xts_ctx->pcc_key, 32);
++	ret = crypt_s390_pcc(func, &pcc_param.key[offset]);
+ 	BUG_ON(ret < 0);
+ 
+-	memcpy(xts_ctx->xts_param, xts_ctx->pcc.xts, 16);
+-	param = xts_ctx->key + offset;
++	memcpy(xts_param.key, xts_ctx->key, 32);
++	memcpy(xts_param.init, pcc_param.xts, 16);
+ 	do {
+ 		/* only use complete blocks */
+ 		n = nbytes & ~(AES_BLOCK_SIZE - 1);
+ 		out = walk->dst.virt.addr;
+ 		in = walk->src.virt.addr;
+ 
+-		ret = crypt_s390_km(func, param, out, in, n);
++		ret = crypt_s390_km(func, &xts_param.key[offset], out, in, n);
+ 		BUG_ON(ret < 0 || ret != n);
+ 
+ 		nbytes &= AES_BLOCK_SIZE - 1;
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index b1478f407238..9df4ea1caaf1 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -2157,6 +2157,7 @@ source "fs/Kconfig.binfmt"
+ config IA32_EMULATION
+ 	bool "IA32 Emulation"
+ 	depends on X86_64
++	select BINFMT_ELF
+ 	select COMPAT_BINFMT_ELF
+ 	---help---
+ 	  Include code to run legacy 32-bit programs under a
+diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
+index 5a747dd884db..8dfb1ff56e04 100644
+--- a/arch/x86/boot/Makefile
++++ b/arch/x86/boot/Makefile
+@@ -52,18 +52,18 @@ $(obj)/cpustr.h: $(obj)/mkcpustr FORCE
+ 
+ # How to compile the 16-bit code.  Note we always compile for -march=i386,
+ # that way we can complain to the user if the CPU is insufficient.
+-KBUILD_CFLAGS	:= $(LINUXINCLUDE) -g -Os -D_SETUP -D__KERNEL__ \
++KBUILD_CFLAGS	:= $(LINUXINCLUDE) -m32 -g -Os -D_SETUP -D__KERNEL__ \
+ 		   -DDISABLE_BRANCH_PROFILING \
+ 		   -Wall -Wstrict-prototypes \
+ 		   -march=i386 -mregparm=3 \
+ 		   -include $(srctree)/$(src)/code16gcc.h \
+ 		   -fno-strict-aliasing -fomit-frame-pointer \
++		   -mno-mmx -mno-sse \
+ 		   $(call cc-option, -ffreestanding) \
+ 		   $(call cc-option, -fno-toplevel-reorder,\
+-			$(call cc-option, -fno-unit-at-a-time)) \
++		   $(call cc-option, -fno-unit-at-a-time)) \
+ 		   $(call cc-option, -fno-stack-protector) \
+ 		   $(call cc-option, -mpreferred-stack-boundary=2)
+-KBUILD_CFLAGS	+= $(call cc-option, -m32)
+ KBUILD_AFLAGS	:= $(KBUILD_CFLAGS) -D__ASSEMBLY__
+ GCOV_PROFILE := n
+ 
+diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
+index 5ef205c5f37b..7194d9f094bc 100644
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -12,6 +12,7 @@ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
+ cflags-$(CONFIG_X86_32) := -march=i386
+ cflags-$(CONFIG_X86_64) := -mcmodel=small
+ KBUILD_CFLAGS += $(cflags-y)
++KBUILD_CFLAGS += -mno-mmx -mno-sse
+ KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
+ KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
+ 
+diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h
+index 439a9acc132d..48fa3915fd02 100644
+--- a/arch/x86/include/asm/hugetlb.h
++++ b/arch/x86/include/asm/hugetlb.h
+@@ -51,6 +51,7 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+ static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
+ 					 unsigned long addr, pte_t *ptep)
+ {
++	ptep_clear_flush(vma, addr, ptep);
+ }
+ 
+ static inline int huge_pte_none(pte_t pte)
+diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
+index 13ad89971d47..69e231b9d925 100644
+--- a/arch/x86/kernel/crash.c
++++ b/arch/x86/kernel/crash.c
+@@ -95,10 +95,10 @@ void native_machine_crash_shutdown(struct pt_regs *regs)
+ 	cpu_emergency_vmxoff();
+ 	cpu_emergency_svm_disable();
+ 
+-	lapic_shutdown();
+ #if defined(CONFIG_X86_IO_APIC)
+ 	disable_IO_APIC();
+ #endif
++	lapic_shutdown();
+ #ifdef CONFIG_HPET_TIMER
+ 	hpet_disable();
+ #endif
+diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
+index af1d14a9ebda..dcbbaa165bde 100644
+--- a/arch/x86/kernel/ldt.c
++++ b/arch/x86/kernel/ldt.c
+@@ -20,6 +20,8 @@
+ #include <asm/mmu_context.h>
+ #include <asm/syscalls.h>
+ 
++int sysctl_ldt16 = 0;
++
+ #ifdef CONFIG_SMP
+ static void flush_ldt(void *current_mm)
+ {
+@@ -234,7 +236,7 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+ 	 * IRET leaking the high bits of the kernel stack address.
+ 	 */
+ #ifdef CONFIG_X86_64
+-	if (!ldt_info.seg_32bit) {
++	if (!ldt_info.seg_32bit && !sysctl_ldt16) {
+ 		error = -EINVAL;
+ 		goto out_unlock;
+ 	}
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index bd70df6162f7..d398f317f5e0 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -668,6 +668,13 @@ void native_machine_shutdown(void)
+ 
+ 	/* The boot cpu is always logical cpu 0 */
+ 	int reboot_cpu_id = 0;
++#endif
++
++#ifdef CONFIG_X86_IO_APIC
++	disable_IO_APIC();
++#endif
++
++#ifdef CONFIG_SMP
+ 
+ #ifdef CONFIG_X86_32
+ 	/* See if there has been given a command line override */
+@@ -691,10 +698,6 @@ void native_machine_shutdown(void)
+ 
+ 	lapic_shutdown();
+ 
+-#ifdef CONFIG_X86_IO_APIC
+-	disable_IO_APIC();
+-#endif
+-
+ #ifdef CONFIG_HPET_TIMER
+ 	hpet_disable();
+ #endif
+diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
+index 537dc033868d..46112cef59a7 100644
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -625,7 +625,7 @@ static bool __init snb_gfx_workaround_needed(void)
+ #ifdef CONFIG_PCI
+ 	int i;
+ 	u16 vendor, devid;
+-	static const u16 snb_ids[] = {
++	static const __initconst u16 snb_ids[] = {
+ 		0x0102,
+ 		0x0112,
+ 		0x0122,
+@@ -658,7 +658,7 @@ static bool __init snb_gfx_workaround_needed(void)
+  */
+ static void __init trim_snb_memory(void)
+ {
+-	static const unsigned long bad_pages[] = {
++	static const __initconst unsigned long bad_pages[] = {
+ 		0x20050000,
+ 		0x20110000,
+ 		0x20130000,
+diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
+index c346d1161488..f89cdc6ccd5b 100644
+--- a/arch/x86/kernel/step.c
++++ b/arch/x86/kernel/step.c
+@@ -157,6 +157,33 @@ static int enable_single_step(struct task_struct *child)
+ 	return 1;
+ }
+ 
++static void set_task_blockstep(struct task_struct *task, bool on)
++{
++	unsigned long debugctl;
++
++	/*
++	 * Ensure irq/preemption can't change debugctl in between.
++	 * Note also that both TIF_BLOCKSTEP and debugctl should
++	 * be changed atomically wrt preemption.
++	 * FIXME: this means that set/clear TIF_BLOCKSTEP is simply
++	 * wrong if task != current, SIGKILL can wakeup the stopped
++	 * tracee and set/clear can play with the running task, this
++	 * can confuse the next __switch_to_xtra().
++	 */
++	local_irq_disable();
++	debugctl = get_debugctlmsr();
++	if (on) {
++		debugctl |= DEBUGCTLMSR_BTF;
++		set_tsk_thread_flag(task, TIF_BLOCKSTEP);
++	} else {
++		debugctl &= ~DEBUGCTLMSR_BTF;
++		clear_tsk_thread_flag(task, TIF_BLOCKSTEP);
++	}
++	if (task == current)
++		update_debugctlmsr(debugctl);
++	local_irq_enable();
++}
++
+ /*
+  * Enable single or block step.
+  */
+@@ -169,19 +196,10 @@ static void enable_step(struct task_struct *child, bool block)
+ 	 * So no one should try to use debugger block stepping in a program
+ 	 * that uses user-mode single stepping itself.
+ 	 */
+-	if (enable_single_step(child) && block) {
+-		unsigned long debugctl = get_debugctlmsr();
+-
+-		debugctl |= DEBUGCTLMSR_BTF;
+-		update_debugctlmsr(debugctl);
+-		set_tsk_thread_flag(child, TIF_BLOCKSTEP);
+-	} else if (test_tsk_thread_flag(child, TIF_BLOCKSTEP)) {
+-		unsigned long debugctl = get_debugctlmsr();
+-
+-		debugctl &= ~DEBUGCTLMSR_BTF;
+-		update_debugctlmsr(debugctl);
+-		clear_tsk_thread_flag(child, TIF_BLOCKSTEP);
+-	}
++	if (enable_single_step(child) && block)
++		set_task_blockstep(child, true);
++	else if (test_tsk_thread_flag(child, TIF_BLOCKSTEP))
++		set_task_blockstep(child, false);
+ }
+ 
+ void user_enable_single_step(struct task_struct *child)
+@@ -199,13 +217,8 @@ void user_disable_single_step(struct task_struct *child)
+ 	/*
+ 	 * Make sure block stepping (BTF) is disabled.
+ 	 */
+-	if (test_tsk_thread_flag(child, TIF_BLOCKSTEP)) {
+-		unsigned long debugctl = get_debugctlmsr();
+-
+-		debugctl &= ~DEBUGCTLMSR_BTF;
+-		update_debugctlmsr(debugctl);
+-		clear_tsk_thread_flag(child, TIF_BLOCKSTEP);
+-	}
++	if (test_tsk_thread_flag(child, TIF_BLOCKSTEP))
++		set_task_blockstep(child, false);
+ 
+ 	/* Always clear TIF_SINGLESTEP... */
+ 	clear_tsk_thread_flag(child, TIF_SINGLESTEP);
+diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
+index b4d3c3927dd8..51534ef23c1c 100644
+--- a/arch/x86/kernel/sys_x86_64.c
++++ b/arch/x86/kernel/sys_x86_64.c
+@@ -115,7 +115,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
+ 				*begin = new_begin;
+ 		}
+ 	} else {
+-		*begin = TASK_UNMAPPED_BASE;
++		*begin = current->mm->mmap_legacy_base;
+ 		*end = TASK_SIZE;
+ 	}
+ }
+diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
+index 845df6835f9f..5c1ae28825cd 100644
+--- a/arch/x86/mm/mmap.c
++++ b/arch/x86/mm/mmap.c
+@@ -112,12 +112,14 @@ static unsigned long mmap_legacy_base(void)
+  */
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+ {
++	mm->mmap_legacy_base = mmap_legacy_base();
++	mm->mmap_base = mmap_base();
++
+ 	if (mmap_is_legacy()) {
+-		mm->mmap_base = mmap_legacy_base();
++		mm->mmap_base = mm->mmap_legacy_base;
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+-		mm->mmap_base = mmap_base();
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 8a67b7c019b8..46e5387f5782 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -50,6 +50,13 @@
+ 
+ #define EFI_DEBUG	1
+ 
++#define EFI_MIN_RESERVE 5120
++
++#define EFI_DUMMY_GUID \
++	EFI_GUID(0x4424ac57, 0xbe4b, 0x47dd, 0x9e, 0x97, 0xed, 0x50, 0xf0, 0x9f, 0x92, 0xa9)
++
++static efi_char16_t efi_dummy_name[6] = { 'D', 'U', 'M', 'M', 'Y', 0 };
++
+ struct efi __read_mostly efi = {
+ 	.mps        = EFI_INVALID_TABLE_ADDR,
+ 	.acpi       = EFI_INVALID_TABLE_ADDR,
+@@ -102,6 +109,15 @@ static int __init setup_add_efi_memmap(char *arg)
+ }
+ early_param("add_efi_memmap", setup_add_efi_memmap);
+ 
++static bool efi_no_storage_paranoia;
++
++static int __init setup_storage_paranoia(char *arg)
++{
++	efi_no_storage_paranoia = true;
++	return 0;
++}
++early_param("efi_no_storage_paranoia", setup_storage_paranoia);
++
+ 
+ static efi_status_t virt_efi_get_time(efi_time_t *tm, efi_time_cap_t *tc)
+ {
+@@ -923,6 +939,13 @@ void __init efi_enter_virtual_mode(void)
+ 		runtime_code_page_mkexec();
+ 
+ 	kfree(new_memmap);
++
++	/* clean DUMMY object */
++	efi.set_variable(efi_dummy_name, &EFI_DUMMY_GUID,
++			 EFI_VARIABLE_NON_VOLATILE |
++			 EFI_VARIABLE_BOOTSERVICE_ACCESS |
++			 EFI_VARIABLE_RUNTIME_ACCESS,
++			 0, NULL);
+ }
+ 
+ /*
+@@ -960,3 +983,85 @@ u64 efi_mem_attributes(unsigned long phys_addr)
+ 	}
+ 	return 0;
+ }
++
++/*
++ * Some firmware has serious problems when using more than 50% of the EFI
++ * variable store, i.e. it triggers bugs that can brick machines. Ensure that
++ * we never use more than this safe limit.
++ *
++ * Return EFI_SUCCESS if it is safe to write 'size' bytes to the variable
++ * store.
++ */
++efi_status_t efi_query_variable_store(u32 attributes, unsigned long size)
++{
++	efi_status_t status;
++	u64 storage_size, remaining_size, max_size;
++
++	if (!(attributes & EFI_VARIABLE_NON_VOLATILE))
++		return 0;
++
++	status = efi.query_variable_info(attributes, &storage_size,
++					 &remaining_size, &max_size);
++	if (status != EFI_SUCCESS)
++		return status;
++
++	/*
++	 * Some firmware implementations refuse to boot if there's insufficient
++	 * space in the variable store. We account for that by refusing the
++	 * write if permitting it would reduce the available space to under
++	 * 5KB. This figure was provided by Samsung, so should be safe.
++	 */
++	if ((remaining_size - size < EFI_MIN_RESERVE) &&
++		!efi_no_storage_paranoia) {
++
++		/*
++		 * Triggering garbage collection may require that the firmware
++		 * generate a real EFI_OUT_OF_RESOURCES error. We can force
++		 * that by attempting to use more space than is available.
++		 */
++		unsigned long dummy_size = remaining_size + 1024;
++		void *dummy = kzalloc(dummy_size, GFP_ATOMIC);
++
++		if (!dummy)
++			return EFI_OUT_OF_RESOURCES;
++
++		status = efi.set_variable(efi_dummy_name, &EFI_DUMMY_GUID,
++					  EFI_VARIABLE_NON_VOLATILE |
++					  EFI_VARIABLE_BOOTSERVICE_ACCESS |
++					  EFI_VARIABLE_RUNTIME_ACCESS,
++					  dummy_size, dummy);
++
++		if (status == EFI_SUCCESS) {
++			/*
++			 * This should have failed, so if it didn't make sure
++			 * that we delete it...
++			 */
++			efi.set_variable(efi_dummy_name, &EFI_DUMMY_GUID,
++					 EFI_VARIABLE_NON_VOLATILE |
++					 EFI_VARIABLE_BOOTSERVICE_ACCESS |
++					 EFI_VARIABLE_RUNTIME_ACCESS,
++					 0, dummy);
++		}
++
++		kfree(dummy);
++
++		/*
++		 * The runtime code may now have triggered a garbage collection
++		 * run, so check the variable info again
++		 */
++		status = efi.query_variable_info(attributes, &storage_size,
++						 &remaining_size, &max_size);
++
++		if (status != EFI_SUCCESS)
++			return status;
++
++		/*
++		 * There still isn't enough room, so return an error
++		 */
++		if (remaining_size - size < EFI_MIN_RESERVE)
++			return EFI_OUT_OF_RESOURCES;
++	}
++
++	return EFI_SUCCESS;
++}
++EXPORT_SYMBOL_GPL(efi_query_variable_store);
+diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
+index 66e6d9359826..c734408d55e4 100644
+--- a/arch/x86/vdso/vdso32-setup.c
++++ b/arch/x86/vdso/vdso32-setup.c
+@@ -41,6 +41,7 @@ enum {
+ #ifdef CONFIG_X86_64
+ #define vdso_enabled			sysctl_vsyscall32
+ #define arch_setup_additional_pages	syscall32_setup_pages
++extern int sysctl_ldt16;
+ #endif
+ 
+ /*
+@@ -380,6 +381,13 @@ static ctl_table abi_table2[] = {
+ 		.mode		= 0644,
+ 		.proc_handler	= proc_dointvec
+ 	},
++	{
++		.procname	= "ldt16",
++		.data		= &sysctl_ldt16,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec
++	},
+ 	{}
+ };
+ 
+diff --git a/crypto/crypto_wq.c b/crypto/crypto_wq.c
+index adad92a44ba2..2f1b8d12952a 100644
+--- a/crypto/crypto_wq.c
++++ b/crypto/crypto_wq.c
+@@ -33,7 +33,7 @@ static void __exit crypto_wq_exit(void)
+ 	destroy_workqueue(kcrypto_wq);
+ }
+ 
+-module_init(crypto_wq_init);
++subsys_initcall(crypto_wq_init);
+ module_exit(crypto_wq_exit);
+ 
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
+index cb9629638def..76da257cfc28 100644
+--- a/drivers/acpi/blacklist.c
++++ b/drivers/acpi/blacklist.c
+@@ -327,6 +327,19 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
+ 		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T500"),
+ 		},
+ 	},
++	/*
++	 * Without this this EEEpc exports a non working WMI interface, with
++	 * this it exports a working "good old" eeepc_laptop interface, fixing
++	 * both brightness control, and rfkill not working.
++	 */
++	{
++	.callback = dmi_enable_osi_linux,
++	.ident = "Asus EEE PC 1015PX",
++	.matches = {
++		     DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."),
++		     DMI_MATCH(DMI_PRODUCT_NAME, "1015PX"),
++		},
++	},
+ 	{}
+ };
+ 
+diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
+index 9dbd3aee0870..9f165a81d0ea 100644
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -331,6 +331,14 @@ static const struct pci_device_id piix_pci_tbl[] = {
+ 	{ 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
+ 	/* SATA Controller IDE (Lynx Point) */
+ 	{ 0x8086, 0x8c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
++	/* SATA Controller IDE (Lynx Point-LP) */
++	{ 0x8086, 0x9c00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
++	/* SATA Controller IDE (Lynx Point-LP) */
++	{ 0x8086, 0x9c01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
++	/* SATA Controller IDE (Lynx Point-LP) */
++	{ 0x8086, 0x9c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
++	/* SATA Controller IDE (Lynx Point-LP) */
++	{ 0x8086, 0x9c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+ 	/* SATA Controller IDE (DH89xxCC) */
+ 	{ 0x8086, 0x2326, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+ 	/* SATA Controller IDE (Avoton) */
+diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c
+index 53d3770a0b1b..47d5d58ad0eb 100644
+--- a/drivers/ata/pata_at91.c
++++ b/drivers/ata/pata_at91.c
+@@ -408,12 +408,13 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
+ 
+ 	host->private_data = info;
+ 
+-	return ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
+-			gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
+-			irq_flags, &pata_at91_sht);
++	ret = ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
++				gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
++				irq_flags, &pata_at91_sht);
++	if (ret)
++		goto err_put;
+ 
+-	if (!ret)
+-		return 0;
++	return 0;
+ 
+ err_put:
+ 	clk_put(info->mck);
+diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
+index f8f41e0e8a8c..89b30f32ba68 100644
+--- a/drivers/atm/ambassador.c
++++ b/drivers/atm/ambassador.c
+@@ -802,7 +802,7 @@ static void fill_rx_pool (amb_dev * dev, unsigned char pool,
+     }
+     // cast needed as there is no %? for pointer differences
+     PRINTD (DBG_SKB, "allocated skb at %p, head %p, area %li",
+-	    skb, skb->head, (long) (skb_end_pointer(skb) - skb->head));
++	    skb, skb->head, (long) skb_end_offset(skb));
+     rx.handle = virt_to_bus (skb);
+     rx.host_address = cpu_to_be32 (virt_to_bus (skb->data));
+     if (rx_give (dev, &rx, pool))
+diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
+index b0e75ce3c8fc..81845fa2a9cd 100644
+--- a/drivers/atm/idt77252.c
++++ b/drivers/atm/idt77252.c
+@@ -1258,7 +1258,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
+ 	tail = readl(SAR_REG_RAWCT);
+ 
+ 	pci_dma_sync_single_for_cpu(card->pcidev, IDT77252_PRV_PADDR(queue),
+-				    skb_end_pointer(queue) - queue->head - 16,
++				    skb_end_offset(queue) - 16,
+ 				    PCI_DMA_FROMDEVICE);
+ 
+ 	while (head != tail) {
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 97fc774e6bc2..baa2f190f3fe 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -51,6 +51,7 @@ static DEFINE_MUTEX(deferred_probe_mutex);
+ static LIST_HEAD(deferred_probe_pending_list);
+ static LIST_HEAD(deferred_probe_active_list);
+ static struct workqueue_struct *deferred_wq;
++static atomic_t deferred_trigger_count = ATOMIC_INIT(0);
+ 
+ /**
+  * deferred_probe_work_func() - Retry probing devices in the active list.
+@@ -122,6 +123,17 @@ static bool driver_deferred_probe_enable = false;
+  * This functions moves all devices from the pending list to the active
+  * list and schedules the deferred probe workqueue to process them.  It
+  * should be called anytime a driver is successfully bound to a device.
++ *
++ * Note, there is a race condition in multi-threaded probe. In the case where
++ * more than one device is probing at the same time, it is possible for one
++ * probe to complete successfully while another is about to defer. If the second
++ * depends on the first, then it will get put on the pending list after the
++ * trigger event has already occured and will be stuck there.
++ *
++ * The atomic 'deferred_trigger_count' is used to determine if a successful
++ * trigger has occurred in the midst of probing a driver. If the trigger count
++ * changes in the midst of a probe, then deferred processing should be triggered
++ * again.
+  */
+ static void driver_deferred_probe_trigger(void)
+ {
+@@ -134,6 +146,7 @@ static void driver_deferred_probe_trigger(void)
+ 	 * into the active list so they can be retried by the workqueue
+ 	 */
+ 	mutex_lock(&deferred_probe_mutex);
++	atomic_inc(&deferred_trigger_count);
+ 	list_splice_tail_init(&deferred_probe_pending_list,
+ 			      &deferred_probe_active_list);
+ 	mutex_unlock(&deferred_probe_mutex);
+@@ -252,6 +265,7 @@ static DECLARE_WAIT_QUEUE_HEAD(probe_waitqueue);
+ static int really_probe(struct device *dev, struct device_driver *drv)
+ {
+ 	int ret = 0;
++	int local_trigger_count = atomic_read(&deferred_trigger_count);
+ 
+ 	atomic_inc(&probe_count);
+ 	pr_debug("bus: '%s': %s: probing driver %s with device %s\n",
+@@ -290,6 +304,9 @@ probe_failed:
+ 		/* Driver requested deferred probing */
+ 		dev_info(dev, "Driver %s requests probe deferral\n", drv->name);
+ 		driver_deferred_probe_add(dev);
++		/* Did a trigger occur while probing? Need to re-trigger if yes */
++		if (local_trigger_count != atomic_read(&deferred_trigger_count))
++			driver_deferred_probe_trigger();
+ 	} else if (ret != -ENODEV && ret != -ENXIO) {
+ 		/* driver matched but the probe failed */
+ 		printk(KERN_WARNING
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index 2cac6e64b67d..bc99e5c68d76 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -4306,7 +4306,7 @@ static int __init floppy_init(void)
+ 
+ 		err = platform_device_register(&floppy_device[drive]);
+ 		if (err)
+-			goto out_flush_work;
++			goto out_remove_drives;
+ 
+ 		err = device_create_file(&floppy_device[drive].dev,
+ 					 &dev_attr_cmos);
+@@ -4324,6 +4324,15 @@ static int __init floppy_init(void)
+ 
+ out_unreg_platform_dev:
+ 	platform_device_unregister(&floppy_device[drive]);
++out_remove_drives:
++	while (drive--) {
++		if ((allowed_drive_mask & (1 << drive)) &&
++		    fdc_state[FDC(drive)].version != FDC_NONE) {
++			del_gendisk(disks[drive]);
++			device_remove_file(&floppy_device[drive].dev, &dev_attr_cmos);
++			platform_device_unregister(&floppy_device[drive]);
++		}
++	}
+ out_flush_work:
+ 	flush_work_sync(&floppy_work);
+ 	if (atomic_read(&usage_count))
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index d724da52153b..35fc56981875 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -584,10 +584,17 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ 		struct request sreq;
+ 
+ 		dev_info(disk_to_dev(nbd->disk), "NBD_DISCONNECT\n");
++		if (!nbd->sock)
++			return -EINVAL;
+ 
++		mutex_unlock(&nbd->tx_lock);
++		fsync_bdev(bdev);
++		mutex_lock(&nbd->tx_lock);
+ 		blk_rq_init(NULL, &sreq);
+ 		sreq.cmd_type = REQ_TYPE_SPECIAL;
+ 		nbd_cmd(&sreq) = NBD_CMD_DISC;
++
++		/* Check again after getting mutex back.  */
+ 		if (!nbd->sock)
+ 			return -EINVAL;
+ 
+@@ -606,6 +613,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ 		nbd_clear_que(nbd);
+ 		BUG_ON(!list_empty(&nbd->queue_head));
+ 		BUG_ON(!list_empty(&nbd->waiting_queue));
++		kill_bdev(bdev);
+ 		if (file)
+ 			fput(file);
+ 		return 0;
+@@ -688,6 +696,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ 		nbd->file = NULL;
+ 		nbd_clear_que(nbd);
+ 		dev_warn(disk_to_dev(nbd->disk), "queue cleared\n");
++		kill_bdev(bdev);
+ 		if (file)
+ 			fput(file);
+ 		nbd->bytesize = 0;
+diff --git a/drivers/char/ipmi/ipmi_kcs_sm.c b/drivers/char/ipmi/ipmi_kcs_sm.c
+index e53fc24c6af3..e1ddcf938519 100644
+--- a/drivers/char/ipmi/ipmi_kcs_sm.c
++++ b/drivers/char/ipmi/ipmi_kcs_sm.c
+@@ -251,8 +251,9 @@ static inline int check_obf(struct si_sm_data *kcs, unsigned char status,
+ 	if (!GET_STATUS_OBF(status)) {
+ 		kcs->obf_timeout -= time;
+ 		if (kcs->obf_timeout < 0) {
+-		    start_error_recovery(kcs, "OBF not ready in time");
+-		    return 1;
++			kcs->obf_timeout = OBF_RETRY_TIMEOUT;
++			start_error_recovery(kcs, "OBF not ready in time");
++			return 1;
+ 		}
+ 		return 0;
+ 	}
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index 1e638fff40ea..bdecba5de3a4 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -244,6 +244,9 @@ struct smi_info {
+ 	/* The timer for this si. */
+ 	struct timer_list   si_timer;
+ 
++	/* This flag is set, if the timer is running (timer_pending() isn't enough) */
++	bool		    timer_running;
++
+ 	/* The time (in jiffies) the last timeout occurred at. */
+ 	unsigned long       last_timeout_jiffies;
+ 
+@@ -427,6 +430,13 @@ static void start_clear_flags(struct smi_info *smi_info)
+ 	smi_info->si_state = SI_CLEARING_FLAGS;
+ }
+ 
++static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
++{
++	smi_info->last_timeout_jiffies = jiffies;
++	mod_timer(&smi_info->si_timer, new_val);
++	smi_info->timer_running = true;
++}
++
+ /*
+  * When we have a situtaion where we run out of memory and cannot
+  * allocate messages, we just leave them in the BMC and run the system
+@@ -439,8 +449,7 @@ static inline void disable_si_irq(struct smi_info *smi_info)
+ 		start_disable_irq(smi_info);
+ 		smi_info->interrupt_disabled = 1;
+ 		if (!atomic_read(&smi_info->stop_operation))
+-			mod_timer(&smi_info->si_timer,
+-				  jiffies + SI_TIMEOUT_JIFFIES);
++			smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
+ 	}
+ }
+ 
+@@ -896,15 +905,7 @@ static void sender(void                *send_info,
+ 		list_add_tail(&msg->link, &smi_info->xmit_msgs);
+ 
+ 	if (smi_info->si_state == SI_NORMAL && smi_info->curr_msg == NULL) {
+-		/*
+-		 * last_timeout_jiffies is updated here to avoid
+-		 * smi_timeout() handler passing very large time_diff
+-		 * value to smi_event_handler() that causes
+-		 * the send command to abort.
+-		 */
+-		smi_info->last_timeout_jiffies = jiffies;
+-
+-		mod_timer(&smi_info->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
++		smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
+ 
+ 		if (smi_info->thread)
+ 			wake_up_process(smi_info->thread);
+@@ -993,6 +994,17 @@ static int ipmi_thread(void *data)
+ 
+ 		spin_lock_irqsave(&(smi_info->si_lock), flags);
+ 		smi_result = smi_event_handler(smi_info, 0);
++
++		/*
++		 * If the driver is doing something, there is a possible
++		 * race with the timer.  If the timer handler see idle,
++		 * and the thread here sees something else, the timer
++		 * handler won't restart the timer even though it is
++		 * required.  So start it here if necessary.
++		 */
++		if (smi_result != SI_SM_IDLE && !smi_info->timer_running)
++			smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
++
+ 		spin_unlock_irqrestore(&(smi_info->si_lock), flags);
+ 		busy_wait = ipmi_thread_busy_wait(smi_result, smi_info,
+ 						  &busy_until);
+@@ -1062,10 +1074,6 @@ static void smi_timeout(unsigned long data)
+ 		     * SI_USEC_PER_JIFFY);
+ 	smi_result = smi_event_handler(smi_info, time_diff);
+ 
+-	spin_unlock_irqrestore(&(smi_info->si_lock), flags);
+-
+-	smi_info->last_timeout_jiffies = jiffies_now;
+-
+ 	if ((smi_info->irq) && (!smi_info->interrupt_disabled)) {
+ 		/* Running with interrupts, only do long timeouts. */
+ 		timeout = jiffies + SI_TIMEOUT_JIFFIES;
+@@ -1087,7 +1095,10 @@ static void smi_timeout(unsigned long data)
+ 
+  do_mod_timer:
+ 	if (smi_result != SI_SM_IDLE)
+-		mod_timer(&(smi_info->si_timer), timeout);
++		smi_mod_timer(smi_info, timeout);
++	else
++		smi_info->timer_running = false;
++	spin_unlock_irqrestore(&(smi_info->si_lock), flags);
+ }
+ 
+ static irqreturn_t si_irq_handler(int irq, void *data)
+@@ -1135,8 +1146,7 @@ static int smi_start_processing(void       *send_info,
+ 
+ 	/* Set up the timer that drives the interface. */
+ 	setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
+-	new_smi->last_timeout_jiffies = jiffies;
+-	mod_timer(&new_smi->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
++	smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
+ 
+ 	/*
+ 	 * Check if the user forcefully enabled the daemon.
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 817eeb642732..1052fc4cae66 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -867,16 +867,24 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
+ 	if (r->entropy_count / 8 < min + reserved) {
+ 		nbytes = 0;
+ 	} else {
++		int entropy_count, orig;
++retry:
++		entropy_count = orig = ACCESS_ONCE(r->entropy_count);
+ 		/* If limited, never pull more than available */
+-		if (r->limit && nbytes + reserved >= r->entropy_count / 8)
+-			nbytes = r->entropy_count/8 - reserved;
+-
+-		if (r->entropy_count / 8 >= nbytes + reserved)
+-			r->entropy_count -= nbytes*8;
+-		else
+-			r->entropy_count = reserved;
++		if (r->limit && nbytes + reserved >= entropy_count / 8)
++			nbytes = entropy_count/8 - reserved;
++
++		if (entropy_count / 8 >= nbytes + reserved) {
++			entropy_count -= nbytes*8;
++			if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
++				goto retry;
++		} else {
++			entropy_count = reserved;
++			if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
++				goto retry;
++		}
+ 
+-		if (r->entropy_count < random_write_wakeup_thresh) {
++		if (entropy_count < random_write_wakeup_thresh) {
+ 			wake_up_interruptible(&random_write_wait);
+ 			kill_fasync(&fasync, SIGIO, POLL_OUT);
+ 		}
+diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
+index 7e2d54bffad6..9b8d231b1da6 100644
+--- a/drivers/crypto/caam/error.c
++++ b/drivers/crypto/caam/error.c
+@@ -16,9 +16,13 @@
+ 	char *tmp;						\
+ 								\
+ 	tmp = kmalloc(sizeof(format) + max_alloc, GFP_ATOMIC);	\
+-	sprintf(tmp, format, param);				\
+-	strcat(str, tmp);					\
+-	kfree(tmp);						\
++	if (likely(tmp)) {					\
++		sprintf(tmp, format, param);			\
++		strcat(str, tmp);				\
++		kfree(tmp);					\
++	} else {						\
++		strcat(str, "kmalloc failure in SPRINTFCAT");	\
++	}							\
+ }
+ 
+ static void report_jump_idx(u32 status, char *outstr)
+diff --git a/drivers/edac/i82975x_edac.c b/drivers/edac/i82975x_edac.c
+index 0cd8368f88f8..182d82afd223 100644
+--- a/drivers/edac/i82975x_edac.c
++++ b/drivers/edac/i82975x_edac.c
+@@ -363,10 +363,6 @@ static enum dev_type i82975x_dram_type(void __iomem *mch_window, int rank)
+ static void i82975x_init_csrows(struct mem_ctl_info *mci,
+ 		struct pci_dev *pdev, void __iomem *mch_window)
+ {
+-	static const char *labels[4] = {
+-							"DIMM A1", "DIMM A2",
+-							"DIMM B1", "DIMM B2"
+-						};
+ 	struct csrow_info *csrow;
+ 	unsigned long last_cumul_size;
+ 	u8 value;
+@@ -407,9 +403,10 @@ static void i82975x_init_csrows(struct mem_ctl_info *mci,
+ 		 *   [0-3] for dual-channel; i.e. csrow->nr_channels = 2
+ 		 */
+ 		for (chan = 0; chan < csrow->nr_channels; chan++)
+-			strncpy(csrow->channels[chan].label,
+-					labels[(index >> 1) + (chan * 2)],
+-					EDAC_MC_LABEL_LEN);
++
++			snprintf(csrow->channels[chan].label, EDAC_MC_LABEL_LEN, "DIMM %c%d",
++				 (chan == 0) ? 'A' : 'B',
++				 index);
+ 
+ 		if (cumul_size == last_cumul_size)
+ 			continue;	/* not populated */
+diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
+index 9b00072a020f..42c759a4d047 100644
+--- a/drivers/firmware/Kconfig
++++ b/drivers/firmware/Kconfig
+@@ -53,6 +53,24 @@ config EFI_VARS
+ 	  Subsequent efibootmgr releases may be found at:
+ 	  <http://linux.dell.com/efibootmgr>
+ 
++config EFI_VARS_PSTORE
++	bool "Register efivars backend for pstore"
++	depends on EFI_VARS && PSTORE
++	default y
++	help
++	  Say Y here to enable use efivars as a backend to pstore. This
++	  will allow writing console messages, crash dumps, or anything
++	  else supported by pstore to EFI variables.
++
++config EFI_VARS_PSTORE_DEFAULT_DISABLE
++	bool "Disable using efivars as a pstore backend by default"
++	depends on EFI_VARS_PSTORE
++	default n
++	help
++	  Saying Y here will disable the use of efivars as a storage
++	  backend for pstore by default. This setting can be overridden
++	  using the efivars module's pstore_disable parameter.
++
+ config EFI_PCDP
+ 	bool "Console device selection via EFI PCDP or HCDP table"
+ 	depends on ACPI && EFI && IA64
+diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
+index 2cbb675a66cc..80c6667c8a3b 100644
+--- a/drivers/firmware/efivars.c
++++ b/drivers/firmware/efivars.c
+@@ -92,6 +92,11 @@ MODULE_VERSION(EFIVARS_VERSION);
+ 
+ #define DUMP_NAME_LEN 52
+ 
++static bool efivars_pstore_disable =
++	IS_ENABLED(CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE);
++
++module_param_named(pstore_disable, efivars_pstore_disable, bool, 0644);
++
+ /*
+  * The maximum size of VariableName + Data = 1024
+  * Therefore, it's reasonable to save that much
+@@ -149,6 +154,13 @@ efivar_create_sysfs_entry(struct efivars *efivars,
+ 			  efi_char16_t *variable_name,
+ 			  efi_guid_t *vendor_guid);
+ 
++/*
++ * Prototype for workqueue functions updating sysfs entry
++ */
++
++static void efivar_update_sysfs_entries(struct work_struct *);
++static DECLARE_WORK(efivar_work, efivar_update_sysfs_entries);
++
+ /* Return the number of unicode characters in data */
+ static unsigned long
+ utf16_strnlen(efi_char16_t *s, size_t maxlength)
+@@ -396,10 +408,11 @@ static efi_status_t
+ get_var_data(struct efivars *efivars, struct efi_variable *var)
+ {
+ 	efi_status_t status;
++	unsigned long flags;
+ 
+-	spin_lock(&efivars->lock);
++	spin_lock_irqsave(&efivars->lock, flags);
+ 	status = get_var_data_locked(efivars, var);
+-	spin_unlock(&efivars->lock);
++	spin_unlock_irqrestore(&efivars->lock, flags);
+ 
+ 	if (status != EFI_SUCCESS) {
+ 		printk(KERN_WARNING "efivars: get_variable() failed 0x%lx!\n",
+@@ -408,6 +421,18 @@ get_var_data(struct efivars *efivars, struct efi_variable *var)
+ 	return status;
+ }
+ 
++static efi_status_t
++check_var_size_locked(struct efivars *efivars, u32 attributes,
++			unsigned long size)
++{
++	const struct efivar_operations *fops = efivars->ops;
++
++	if (!efivars->ops->query_variable_store)
++		return EFI_UNSUPPORTED;
++
++	return fops->query_variable_store(attributes, size);
++}
++
+ static ssize_t
+ efivar_guid_read(struct efivar_entry *entry, char *buf)
+ {
+@@ -528,14 +553,19 @@ efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count)
+ 		return -EINVAL;
+ 	}
+ 
+-	spin_lock(&efivars->lock);
+-	status = efivars->ops->set_variable(new_var->VariableName,
+-					    &new_var->VendorGuid,
+-					    new_var->Attributes,
+-					    new_var->DataSize,
+-					    new_var->Data);
++	spin_lock_irq(&efivars->lock);
++
++	status = check_var_size_locked(efivars, new_var->Attributes,
++	       new_var->DataSize + utf16_strsize(new_var->VariableName, 1024));
+ 
+-	spin_unlock(&efivars->lock);
++	if (status == EFI_SUCCESS || status == EFI_UNSUPPORTED)
++		status = efivars->ops->set_variable(new_var->VariableName,
++						    &new_var->VendorGuid,
++						    new_var->Attributes,
++						    new_var->DataSize,
++						    new_var->Data);
++
++	spin_unlock_irq(&efivars->lock);
+ 
+ 	if (status != EFI_SUCCESS) {
+ 		printk(KERN_WARNING "efivars: set_variable() failed: status=%lx\n",
+@@ -632,21 +662,49 @@ static struct kobj_type efivar_ktype = {
+ 	.default_attrs = def_attrs,
+ };
+ 
+-static struct pstore_info efi_pstore_info;
+-
+ static inline void
+ efivar_unregister(struct efivar_entry *var)
+ {
+ 	kobject_put(&var->kobj);
+ }
+ 
+-#ifdef CONFIG_PSTORE
++static int efi_status_to_err(efi_status_t status)
++{
++	int err;
++
++	switch (status) {
++	case EFI_INVALID_PARAMETER:
++		err = -EINVAL;
++		break;
++	case EFI_OUT_OF_RESOURCES:
++		err = -ENOSPC;
++		break;
++	case EFI_DEVICE_ERROR:
++		err = -EIO;
++		break;
++	case EFI_WRITE_PROTECTED:
++		err = -EROFS;
++		break;
++	case EFI_SECURITY_VIOLATION:
++		err = -EACCES;
++		break;
++	case EFI_NOT_FOUND:
++		err = -ENOENT;
++		break;
++	default:
++		err = -EINVAL;
++	}
++
++	return err;
++}
++
++#ifdef CONFIG_EFI_VARS_PSTORE
+ 
+ static int efi_pstore_open(struct pstore_info *psi)
+ {
+ 	struct efivars *efivars = psi->data;
+ 
+-	spin_lock(&efivars->lock);
++	spin_lock_irq(&efivars->lock);
+ 	efivars->walk_entry = list_first_entry(&efivars->list,
+ 					       struct efivar_entry, list);
+ 	return 0;
+@@ -656,7 +714,7 @@ static int efi_pstore_close(struct pstore_info *psi)
+ {
+ 	struct efivars *efivars = psi->data;
+ 
+-	spin_unlock(&efivars->lock);
++	spin_unlock_irq(&efivars->lock);
+ 	return 0;
+ }
+ 
+@@ -710,11 +768,30 @@ static int efi_pstore_write(enum pstore_type_id type,
+ 	struct efivars *efivars = psi->data;
+ 	struct efivar_entry *entry, *found = NULL;
+ 	int i, ret = 0;
++	efi_status_t status = EFI_NOT_FOUND;
++	unsigned long flags;
+ 
+ 	sprintf(stub_name, "dump-type%u-%u-", type, part);
+ 	sprintf(name, "%s%lu", stub_name, get_seconds());
+ 
+-	spin_lock(&efivars->lock);
++	spin_lock_irqsave(&efivars->lock, flags);
++
++	if (size) {
++		/*
++		 * Check if there is a space enough to log.
++		 * size: a size of logging data
++		 * DUMP_NAME_LEN * 2: a maximum size of variable name
++		 */
++
++		status = check_var_size_locked(efivars, PSTORE_EFI_ATTRIBUTES,
++					       size + DUMP_NAME_LEN * 2);
++
++		if (status) {
++			spin_unlock_irqrestore(&efivars->lock, flags);
++			*id = part;
++			return -ENOSPC;
++		}
++	}
+ 
+ 	for (i = 0; i < DUMP_NAME_LEN; i++)
+ 		efi_name[i] = stub_name[i];
+@@ -752,16 +829,13 @@ static int efi_pstore_write(enum pstore_type_id type,
+ 	efivars->ops->set_variable(efi_name, &vendor, PSTORE_EFI_ATTRIBUTES,
+ 				   size, psi->buf);
+ 
+-	spin_unlock(&efivars->lock);
++	spin_unlock_irqrestore(&efivars->lock, flags);
+ 
+ 	if (found)
+ 		efivar_unregister(found);
+ 
+-	if (size)
+-		ret = efivar_create_sysfs_entry(efivars,
+-					  utf16_strsize(efi_name,
+-							DUMP_NAME_LEN * 2),
+-					  efi_name, &vendor);
++	if (reason == KMSG_DUMP_OOPS)
++		schedule_work(&efivar_work);
+ 
+ 	*id = part;
+ 	return ret;
+@@ -774,37 +848,6 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id,
+ 
+ 	return 0;
+ }
+-#else
+-static int efi_pstore_open(struct pstore_info *psi)
+-{
+-	return 0;
+-}
+-
+-static int efi_pstore_close(struct pstore_info *psi)
+-{
+-	return 0;
+-}
+-
+-static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
+-			       struct timespec *timespec,
+-			       char **buf, struct pstore_info *psi)
+-{
+-	return -1;
+-}
+-
+-static int efi_pstore_write(enum pstore_type_id type,
+-		enum kmsg_dump_reason reason, u64 *id,
+-		unsigned int part, size_t size, struct pstore_info *psi)
+-{
+-	return 0;
+-}
+-
+-static int efi_pstore_erase(enum pstore_type_id type, u64 id,
+-			    struct pstore_info *psi)
+-{
+-	return 0;
+-}
+-#endif
+ 
+ static struct pstore_info efi_pstore_info = {
+ 	.owner		= THIS_MODULE,
+@@ -816,6 +859,24 @@ static struct pstore_info efi_pstore_info = {
+ 	.erase		= efi_pstore_erase,
+ };
+ 
++static void efivar_pstore_register(struct efivars *efivars)
++{
++	efivars->efi_pstore_info = efi_pstore_info;
++	efivars->efi_pstore_info.buf = kmalloc(4096, GFP_KERNEL);
++	if (efivars->efi_pstore_info.buf) {
++		efivars->efi_pstore_info.bufsize = 1024;
++		efivars->efi_pstore_info.data = efivars;
++		spin_lock_init(&efivars->efi_pstore_info.buf_lock);
++		pstore_register(&efivars->efi_pstore_info);
++	}
++}
++#else
++static void efivar_pstore_register(struct efivars *efivars)
++{
++	return;
++}
++#endif
++
+ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
+ 			     struct bin_attribute *bin_attr,
+ 			     char *buf, loff_t pos, size_t count)
+@@ -836,7 +897,7 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
+ 		return -EINVAL;
+ 	}
+ 
+-	spin_lock(&efivars->lock);
++	spin_lock_irq(&efivars->lock);
+ 
+ 	/*
+ 	 * Does this variable already exist?
+@@ -854,10 +915,18 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
+ 		}
+ 	}
+ 	if (found) {
+-		spin_unlock(&efivars->lock);
++		spin_unlock_irq(&efivars->lock);
+ 		return -EINVAL;
+ 	}
+ 
++	status = check_var_size_locked(efivars, new_var->Attributes,
++	       new_var->DataSize + utf16_strsize(new_var->VariableName, 1024));
++
++	if (status && status != EFI_UNSUPPORTED) {
++		spin_unlock_irq(&efivars->lock);
++		return efi_status_to_err(status);
++	}
++
+ 	/* now *really* create the variable via EFI */
+ 	status = efivars->ops->set_variable(new_var->VariableName,
+ 					    &new_var->VendorGuid,
+@@ -868,10 +937,10 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
+ 	if (status != EFI_SUCCESS) {
+ 		printk(KERN_WARNING "efivars: set_variable() failed: status=%lx\n",
+ 			status);
+-		spin_unlock(&efivars->lock);
++		spin_unlock_irq(&efivars->lock);
+ 		return -EIO;
+ 	}
+-	spin_unlock(&efivars->lock);
++	spin_unlock_irq(&efivars->lock);
+ 
+ 	/* Create the entry in sysfs.  Locking is not required here */
+ 	status = efivar_create_sysfs_entry(efivars,
+@@ -899,7 +968,7 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
+ 	if (!capable(CAP_SYS_ADMIN))
+ 		return -EACCES;
+ 
+-	spin_lock(&efivars->lock);
++	spin_lock_irq(&efivars->lock);
+ 
+ 	/*
+ 	 * Does this variable already exist?
+@@ -917,7 +986,7 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
+ 		}
+ 	}
+ 	if (!found) {
+-		spin_unlock(&efivars->lock);
++		spin_unlock_irq(&efivars->lock);
+ 		return -EINVAL;
+ 	}
+ 	/* force the Attributes/DataSize to 0 to ensure deletion */
+@@ -933,12 +1002,12 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
+ 	if (status != EFI_SUCCESS) {
+ 		printk(KERN_WARNING "efivars: set_variable() failed: status=%lx\n",
+ 			status);
+-		spin_unlock(&efivars->lock);
++		spin_unlock_irq(&efivars->lock);
+ 		return -EIO;
+ 	}
+ 	list_del(&search_efivar->list);
+ 	/* We need to release this lock before unregistering. */
+-	spin_unlock(&efivars->lock);
++	spin_unlock_irq(&efivars->lock);
+ 	efivar_unregister(search_efivar);
+ 
+ 	/* It's dead Jim.... */
+@@ -967,6 +1036,53 @@ static bool variable_is_present(efi_char16_t *variable_name, efi_guid_t *vendor)
+ 	return found;
+ }
+ 
++static void efivar_update_sysfs_entries(struct work_struct *work)
++{
++	struct efivars *efivars = &__efivars;
++	efi_guid_t vendor;
++	efi_char16_t *variable_name;
++	unsigned long variable_name_size = 1024;
++	efi_status_t status = EFI_NOT_FOUND;
++	bool found;
++
++	/* Add new sysfs entries */
++	while (1) {
++		variable_name = kzalloc(variable_name_size, GFP_KERNEL);
++		if (!variable_name) {
++			pr_err("efivars: Memory allocation failed.\n");
++			return;
++		}
++
++		spin_lock_irq(&efivars->lock);
++		found = false;
++		while (1) {
++			variable_name_size = 1024;
++			status = efivars->ops->get_next_variable(
++							&variable_name_size,
++							variable_name,
++							&vendor);
++			if (status != EFI_SUCCESS) {
++				break;
++			} else {
++				if (!variable_is_present(variable_name,
++				    &vendor)) {
++					found = true;
++					break;
++				}
++			}
++		}
++		spin_unlock_irq(&efivars->lock);
++
++		if (!found) {
++			kfree(variable_name);
++			break;
++		} else
++			efivar_create_sysfs_entry(efivars,
++						  variable_name_size,
++						  variable_name, &vendor);
++	}
++}
++
+ /*
+  * Returns the size of variable_name, in bytes, including the
+  * terminating NULL character, or variable_name_size if no NULL
+@@ -1093,9 +1209,9 @@ efivar_create_sysfs_entry(struct efivars *efivars,
+ 	kfree(short_name);
+ 	short_name = NULL;
+ 
+-	spin_lock(&efivars->lock);
++	spin_lock_irq(&efivars->lock);
+ 	list_add(&new_efivar->list, &efivars->list);
+-	spin_unlock(&efivars->lock);
++	spin_unlock_irq(&efivars->lock);
+ 
+ 	return 0;
+ }
+@@ -1164,9 +1280,9 @@ void unregister_efivars(struct efivars *efivars)
+ 	struct efivar_entry *entry, *n;
+ 
+ 	list_for_each_entry_safe(entry, n, &efivars->list, list) {
+-		spin_lock(&efivars->lock);
++		spin_lock_irq(&efivars->lock);
+ 		list_del(&entry->list);
+-		spin_unlock(&efivars->lock);
++		spin_unlock_irq(&efivars->lock);
+ 		efivar_unregister(entry);
+ 	}
+ 	if (efivars->new_var)
+@@ -1278,15 +1394,8 @@ int register_efivars(struct efivars *efivars,
+ 	if (error)
+ 		unregister_efivars(efivars);
+ 
+-	efivars->efi_pstore_info = efi_pstore_info;
+-
+-	efivars->efi_pstore_info.buf = kmalloc(4096, GFP_KERNEL);
+-	if (efivars->efi_pstore_info.buf) {
+-		efivars->efi_pstore_info.bufsize = 1024;
+-		efivars->efi_pstore_info.data = efivars;
+-		spin_lock_init(&efivars->efi_pstore_info.buf_lock);
+-		pstore_register(&efivars->efi_pstore_info);
+-	}
++	if (!efivars_pstore_disable)
++		efivar_pstore_register(efivars);
+ 
+ out:
+ 	kfree(variable_name);
+@@ -1324,6 +1433,7 @@ efivars_init(void)
+ 	ops.get_variable = efi.get_variable;
+ 	ops.set_variable = efi.set_variable;
+ 	ops.get_next_variable = efi.get_next_variable;
++	ops.query_variable_store = efi_query_variable_store;
+ 	error = register_efivars(&__efivars, &ops, efi_kobj);
+ 	if (error)
+ 		goto err_put;
+diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
+index 81118893264c..b3abf7044718 100644
+--- a/drivers/gpu/drm/drm_crtc_helper.c
++++ b/drivers/gpu/drm/drm_crtc_helper.c
+@@ -328,8 +328,8 @@ drm_crtc_prepare_encoders(struct drm_device *dev)
+  * drm_crtc_set_mode - set a mode
+  * @crtc: CRTC to program
+  * @mode: mode to use
+- * @x: width of mode
+- * @y: height of mode
++ * @x: horizontal offset into the surface
++ * @y: vertical offset into the surface
+  *
+  * LOCKING:
+  * Caller must hold mode config lock.
+diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
+index 34791fb7aa78..39f81115fcf1 100644
+--- a/drivers/gpu/drm/i915/i915_debugfs.c
++++ b/drivers/gpu/drm/i915/i915_debugfs.c
+@@ -30,6 +30,7 @@
+ #include <linux/debugfs.h>
+ #include <linux/slab.h>
+ #include <linux/export.h>
++#include <generated/utsrelease.h>
+ #include "drmP.h"
+ #include "drm.h"
+ #include "intel_drv.h"
+@@ -340,7 +341,7 @@ static int i915_gem_pageflip_info(struct seq_file *m, void *data)
+ 			seq_printf(m, "No flip due on pipe %c (plane %c)\n",
+ 				   pipe, plane);
+ 		} else {
+-			if (!work->pending) {
++			if (atomic_read(&work->pending) < INTEL_FLIP_COMPLETE) {
+ 				seq_printf(m, "Flip queued on pipe %c (plane %c)\n",
+ 					   pipe, plane);
+ 			} else {
+@@ -351,7 +352,7 @@ static int i915_gem_pageflip_info(struct seq_file *m, void *data)
+ 				seq_printf(m, "Stall check enabled, ");
+ 			else
+ 				seq_printf(m, "Stall check waiting for page flip ioctl, ");
+-			seq_printf(m, "%d prepares\n", work->pending);
++			seq_printf(m, "%d prepares\n", atomic_read(&work->pending));
+ 
+ 			if (work->old_fb_obj) {
+ 				struct drm_i915_gem_object *obj = work->old_fb_obj;
+@@ -750,6 +751,7 @@ static int i915_error_state(struct seq_file *m, void *unused)
+ 
+ 	seq_printf(m, "Time: %ld s %ld us\n", error->time.tv_sec,
+ 		   error->time.tv_usec);
++	seq_printf(m, "Kernel: " UTS_RELEASE "\n");
+ 	seq_printf(m, "PCI ID: 0x%04x\n", dev->pci_device);
+ 	seq_printf(m, "EIR: 0x%08x\n", error->eir);
+ 	seq_printf(m, "PGTBL_ER: 0x%08x\n", error->pgtbl_er);
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 232119ac266f..a8f00d06a46f 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -296,7 +296,8 @@ enum intel_pch {
+ 
+ #define QUIRK_PIPEA_FORCE (1<<0)
+ #define QUIRK_LVDS_SSC_DISABLE (1<<1)
+-#define QUIRK_NO_PCH_PWM_ENABLE (1<<2)
++#define QUIRK_INVERT_BRIGHTNESS (1<<2)
++#define QUIRK_NO_PCH_PWM_ENABLE (1<<3)
+ 
+ struct intel_fbdev;
+ struct intel_fbc_work;
+@@ -1397,6 +1398,7 @@ static inline void intel_unregister_dsm_handler(void) { return; }
+ #endif /* CONFIG_ACPI */
+ 
+ /* modesetting */
++extern void i915_redisable_vga(struct drm_device *dev);
+ extern void intel_modeset_init(struct drm_device *dev);
+ extern void intel_modeset_gem_init(struct drm_device *dev);
+ extern void intel_modeset_cleanup(struct drm_device *dev);
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index eb339456c111..2ac4ded0de99 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -2468,6 +2468,11 @@ i915_find_fence_reg(struct drm_device *dev,
+ 	return avail;
+ }
+ 
++static void i915_gem_write_fence__ipi(void *data)
++{
++	wbinvd();
++}
++
+ /**
+  * i915_gem_object_get_fence - set up a fence reg for an object
+  * @obj: object to map through a fence reg
+@@ -2589,6 +2594,17 @@ update:
+ 	switch (INTEL_INFO(dev)->gen) {
+ 	case 7:
+ 	case 6:
++		/* In order to fully serialize access to the fenced region and
++		 * the update to the fence register we need to take extreme
++		 * measures on SNB+. In theory, the write to the fence register
++		 * flushes all memory transactions before, and coupled with the
++		 * mb() placed around the register write we serialise all memory
++		 * operations with respect to the changes in the tiler. Yet, on
++		 * SNB+ we need to take a step further and emit an explicit wbinvd()
++		 * on each processor in order to manually flush all memory
++		 * transactions before updating the fence register.
++		 */
++		on_each_cpu(i915_gem_write_fence__ipi, NULL, 1);
+ 		ret = sandybridge_write_fence_reg(obj, pipelined);
+ 		break;
+ 	case 5:
+@@ -3411,14 +3427,15 @@ i915_gem_pin_ioctl(struct drm_device *dev, void *data,
+ 		goto out;
+ 	}
+ 
+-	obj->user_pin_count++;
+-	obj->pin_filp = file;
+-	if (obj->user_pin_count == 1) {
++	if (obj->user_pin_count == 0) {
+ 		ret = i915_gem_object_pin(obj, args->alignment, true);
+ 		if (ret)
+ 			goto out;
+ 	}
+ 
++	obj->user_pin_count++;
++	obj->pin_filp = file;
++
+ 	/* XXX - flush the CPU caches for pinned objects
+ 	 * as the X server doesn't manage domains yet
+ 	 */
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index 8bca2d2d804d..fc6f32a579be 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -1251,7 +1251,9 @@ static void i915_pageflip_stall_check(struct drm_device *dev, int pipe)
+ 	spin_lock_irqsave(&dev->event_lock, flags);
+ 	work = intel_crtc->unpin_work;
+ 
+-	if (work == NULL || work->pending || !work->enable_stall_check) {
++	if (work == NULL ||
++	    atomic_read(&work->pending) >= INTEL_FLIP_COMPLETE ||
++	    !work->enable_stall_check) {
+ 		/* Either the pending flip IRQ arrived, or we're too early. Don't check */
+ 		spin_unlock_irqrestore(&dev->event_lock, flags);
+ 		return;
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 5647ce4b3ec7..c975c996ff5f 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -25,6 +25,7 @@
+  */
+ 
+ #include <linux/cpufreq.h>
++#include <linux/dmi.h>
+ #include <linux/module.h>
+ #include <linux/input.h>
+ #include <linux/i2c.h>
+@@ -7245,11 +7246,18 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
+ 
+ 	spin_lock_irqsave(&dev->event_lock, flags);
+ 	work = intel_crtc->unpin_work;
+-	if (work == NULL || !work->pending) {
++
++	/* Ensure we don't miss a work->pending update ... */
++	smp_rmb();
++
++	if (work == NULL || atomic_read(&work->pending) < INTEL_FLIP_COMPLETE) {
+ 		spin_unlock_irqrestore(&dev->event_lock, flags);
+ 		return;
+ 	}
+ 
++	/* and that the unpin work is consistent wrt ->pending. */
++	smp_rmb();
++
+ 	intel_crtc->unpin_work = NULL;
+ 
+ 	if (work->event) {
+@@ -7321,16 +7329,25 @@ void intel_prepare_page_flip(struct drm_device *dev, int plane)
+ 		to_intel_crtc(dev_priv->plane_to_crtc_mapping[plane]);
+ 	unsigned long flags;
+ 
++	/* NB: An MMIO update of the plane base pointer will also
++	 * generate a page-flip completion irq, i.e. every modeset
++	 * is also accompanied by a spurious intel_prepare_page_flip().
++	 */
+ 	spin_lock_irqsave(&dev->event_lock, flags);
+-	if (intel_crtc->unpin_work) {
+-		if ((++intel_crtc->unpin_work->pending) > 1)
+-			DRM_ERROR("Prepared flip multiple times\n");
+-	} else {
+-		DRM_DEBUG_DRIVER("preparing flip with no unpin work?\n");
+-	}
++	if (intel_crtc->unpin_work)
++		atomic_inc_not_zero(&intel_crtc->unpin_work->pending);
+ 	spin_unlock_irqrestore(&dev->event_lock, flags);
+ }
+ 
++inline static void intel_mark_page_flip_active(struct intel_crtc *intel_crtc)
++{
++	/* Ensure that the work item is consistent when activating it ... */
++	smp_wmb();
++	atomic_set(&intel_crtc->unpin_work->pending, INTEL_FLIP_PENDING);
++	/* and that it is marked active as soon as the irq could fire. */
++	smp_wmb();
++}
++
+ static int intel_gen2_queue_flip(struct drm_device *dev,
+ 				 struct drm_crtc *crtc,
+ 				 struct drm_framebuffer *fb,
+@@ -7367,6 +7384,8 @@ static int intel_gen2_queue_flip(struct drm_device *dev,
+ 	OUT_RING(fb->pitches[0]);
+ 	OUT_RING(obj->gtt_offset + offset);
+ 	OUT_RING(0); /* aux display base address, unused */
++
++	intel_mark_page_flip_active(intel_crtc);
+ 	ADVANCE_LP_RING();
+ 	return 0;
+ 
+@@ -7410,6 +7429,7 @@ static int intel_gen3_queue_flip(struct drm_device *dev,
+ 	OUT_RING(obj->gtt_offset + offset);
+ 	OUT_RING(MI_NOOP);
+ 
++	intel_mark_page_flip_active(intel_crtc);
+ 	ADVANCE_LP_RING();
+ 	return 0;
+ 
+@@ -7453,6 +7473,8 @@ static int intel_gen4_queue_flip(struct drm_device *dev,
+ 	pf = 0;
+ 	pipesrc = I915_READ(PIPESRC(intel_crtc->pipe)) & 0x0fff0fff;
+ 	OUT_RING(pf | pipesrc);
++
++	intel_mark_page_flip_active(intel_crtc);
+ 	ADVANCE_LP_RING();
+ 	return 0;
+ 
+@@ -7494,6 +7516,8 @@ static int intel_gen6_queue_flip(struct drm_device *dev,
+ 	pf = 0;
+ 	pipesrc = I915_READ(PIPESRC(intel_crtc->pipe)) & 0x0fff0fff;
+ 	OUT_RING(pf | pipesrc);
++
++	intel_mark_page_flip_active(intel_crtc);
+ 	ADVANCE_LP_RING();
+ 	return 0;
+ 
+@@ -7548,6 +7572,8 @@ static int intel_gen7_queue_flip(struct drm_device *dev,
+ 	intel_ring_emit(ring, (fb->pitches[0] | obj->tiling_mode));
+ 	intel_ring_emit(ring, (obj->gtt_offset));
+ 	intel_ring_emit(ring, (MI_NOOP));
++
++	intel_mark_page_flip_active(intel_crtc);
+ 	intel_ring_advance(ring);
+ 	return 0;
+ 
+@@ -9175,6 +9201,16 @@ static void quirk_no_pcm_pwm_enable(struct drm_device *dev)
+ 	DRM_INFO("applying no-PCH_PWM_ENABLE quirk\n");
+ }
+ 
++/*
++ * A machine (e.g. Acer Aspire 5734Z) may need to invert the panel backlight
++ * brightness value
++ */
++static void quirk_invert_brightness(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++	dev_priv->quirks |= QUIRK_INVERT_BRIGHTNESS;
++}
++
+ struct intel_quirk {
+ 	int device;
+ 	int subsystem_vendor;
+@@ -9182,6 +9218,34 @@ struct intel_quirk {
+ 	void (*hook)(struct drm_device *dev);
+ };
+ 
++/* For systems that don't have a meaningful PCI subdevice/subvendor ID */
++struct intel_dmi_quirk {
++	void (*hook)(struct drm_device *dev);
++	const struct dmi_system_id (*dmi_id_list)[];
++};
++
++static int intel_dmi_reverse_brightness(const struct dmi_system_id *id)
++{
++	DRM_INFO("Backlight polarity reversed on %s\n", id->ident);
++	return 1;
++}
++
++static const struct intel_dmi_quirk intel_dmi_quirks[] = {
++	{
++		.dmi_id_list = &(const struct dmi_system_id[]) {
++			{
++				.callback = intel_dmi_reverse_brightness,
++				.ident = "NCR Corporation",
++				.matches = {DMI_MATCH(DMI_SYS_VENDOR, "NCR Corporation"),
++					    DMI_MATCH(DMI_PRODUCT_NAME, ""),
++				},
++			},
++			{ }  /* terminating entry */
++		},
++		.hook = quirk_invert_brightness,
++	},
++};
++
+ struct intel_quirk intel_quirks[] = {
+ 	/* HP Mini needs pipe A force quirk (LP: #322104) */
+ 	{ 0x27ae, 0x103c, 0x361a, quirk_pipea_force },
+@@ -9208,6 +9272,18 @@ struct intel_quirk intel_quirks[] = {
+ 	/* Sony Vaio Y cannot use SSC on LVDS */
+ 	{ 0x0046, 0x104d, 0x9076, quirk_ssc_force_disable },
+ 
++	/* Acer Aspire 5734Z must invert backlight brightness */
++	{ 0x2a42, 0x1025, 0x0459, quirk_invert_brightness },
++
++	/* Acer/eMachines G725 */
++	{ 0x2a42, 0x1025, 0x0210, quirk_invert_brightness },
++
++	/* Acer/eMachines e725 */
++	{ 0x2a42, 0x1025, 0x0212, quirk_invert_brightness },
++
++	/* Acer/Packard Bell NCL20 */
++	{ 0x2a42, 0x1025, 0x034b, quirk_invert_brightness },
++
+ 	/* Dell XPS13 HD Sandy Bridge */
+ 	{ 0x0116, 0x1028, 0x052e, quirk_no_pcm_pwm_enable },
+ 	/* Dell XPS13 HD and XPS13 FHD Ivy Bridge */
+@@ -9229,6 +9305,10 @@ static void intel_init_quirks(struct drm_device *dev)
+ 		     q->subsystem_device == PCI_ANY_ID))
+ 			q->hook(dev);
+ 	}
++	for (i = 0; i < ARRAY_SIZE(intel_dmi_quirks); i++) {
++		if (dmi_check_system(*intel_dmi_quirks[i].dmi_id_list) != 0)
++			intel_dmi_quirks[i].hook(dev);
++	}
+ }
+ 
+ /* Disable the VGA plane that we never use */
+@@ -9254,6 +9334,23 @@ static void i915_disable_vga(struct drm_device *dev)
+ 	POSTING_READ(vga_reg);
+ }
+ 
++void i915_redisable_vga(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++	u32 vga_reg;
++
++	if (HAS_PCH_SPLIT(dev))
++		vga_reg = CPU_VGACNTRL;
++	else
++		vga_reg = VGACNTRL;
++
++	if (I915_READ(vga_reg) != VGA_DISP_DISABLE) {
++		DRM_DEBUG_KMS("Something enabled VGA plane, disabling it\n");
++		I915_WRITE(vga_reg, VGA_DISP_DISABLE);
++		POSTING_READ(vga_reg);
++	}
++}
++
+ void intel_modeset_init(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -9374,6 +9471,9 @@ void intel_modeset_cleanup(struct drm_device *dev)
+ 	del_timer_sync(&dev_priv->idle_timer);
+ 	cancel_work_sync(&dev_priv->idle_work);
+ 
++	/* destroy backlight, if any, before the connectors */
++	intel_panel_destroy_backlight(dev);
++
+ 	drm_mode_config_cleanup(dev);
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index eee6cd391993..9a3ecd61de7c 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -2289,11 +2289,6 @@ done:
+ static void
+ intel_dp_destroy(struct drm_connector *connector)
+ {
+-	struct drm_device *dev = connector->dev;
+-
+-	if (intel_dpd_is_edp(dev))
+-		intel_panel_destroy_backlight(dev);
+-
+ 	drm_sysfs_connector_remove(connector);
+ 	drm_connector_cleanup(connector);
+ 	kfree(connector);
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index cd623e899f58..018dfbd776d9 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -277,7 +277,10 @@ struct intel_unpin_work {
+ 	struct drm_i915_gem_object *old_fb_obj;
+ 	struct drm_i915_gem_object *pending_flip_obj;
+ 	struct drm_pending_vblank_event *event;
+-	int pending;
++	atomic_t pending;
++#define INTEL_FLIP_INACTIVE	0
++#define INTEL_FLIP_PENDING	1
++#define INTEL_FLIP_COMPLETE	2
+ 	bool enable_stall_check;
+ };
+ 
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index dc7c5f6415a7..b695ab48ebf0 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -535,6 +535,7 @@ static int intel_lid_notify(struct notifier_block *nb, unsigned long val,
+ 
+ 	mutex_lock(&dev->mode_config.mutex);
+ 	drm_helper_resume_force_mode(dev);
++	i915_redisable_vga(dev);
+ 	mutex_unlock(&dev->mode_config.mutex);
+ 
+ 	return NOTIFY_OK;
+@@ -552,8 +553,6 @@ static void intel_lvds_destroy(struct drm_connector *connector)
+ 	struct drm_device *dev = connector->dev;
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 
+-	intel_panel_destroy_backlight(dev);
+-
+ 	if (dev_priv->lid_notifier.notifier_call)
+ 		acpi_lid_notifier_unregister(&dev_priv->lid_notifier);
+ 	drm_sysfs_connector_remove(connector);
+diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
+index cffb0071f877..356a252e6861 100644
+--- a/drivers/gpu/drm/i915/intel_opregion.c
++++ b/drivers/gpu/drm/i915/intel_opregion.c
+@@ -161,7 +161,7 @@ static u32 asle_set_backlight(struct drm_device *dev, u32 bclp)
+ 
+ 	max = intel_panel_get_max_backlight(dev);
+ 	intel_panel_set_backlight(dev, bclp * max / 255);
+-	asle->cblv = (bclp*0x64)/0xff | ASLE_CBLV_VALID;
++	asle->cblv = DIV_ROUND_UP(bclp * 100, 255) | ASLE_CBLV_VALID;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
+index 48177ec4720e..0bae2bbe7b3c 100644
+--- a/drivers/gpu/drm/i915/intel_panel.c
++++ b/drivers/gpu/drm/i915/intel_panel.c
+@@ -28,6 +28,7 @@
+  *      Chris Wilson <chris@×××××××××××××××.uk>
+  */
+ 
++#include <linux/moduleparam.h>
+ #include "intel_drv.h"
+ 
+ #define PCI_LBPC 0xf4 /* legacy/combination backlight modes */
+@@ -189,6 +190,27 @@ u32 intel_panel_get_max_backlight(struct drm_device *dev)
+ 	return max;
+ }
+ 
++static int i915_panel_invert_brightness;
++MODULE_PARM_DESC(invert_brightness, "Invert backlight brightness "
++	"(-1 force normal, 0 machine defaults, 1 force inversion), please "
++	"report PCI device ID, subsystem vendor and subsystem device ID "
++	"to dri-devel@×××××××××××××××××.org, if your machine needs it. "
++	"It will then be included in an upcoming module version.");
++module_param_named(invert_brightness, i915_panel_invert_brightness, int, 0600);
++static u32 intel_panel_compute_brightness(struct drm_device *dev, u32 val)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++
++	if (i915_panel_invert_brightness < 0)
++		return val;
++
++	if (i915_panel_invert_brightness > 0 ||
++	    dev_priv->quirks & QUIRK_INVERT_BRIGHTNESS)
++		return intel_panel_get_max_backlight(dev) - val;
++
++	return val;
++}
++
+ u32 intel_panel_get_backlight(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -209,6 +231,7 @@ u32 intel_panel_get_backlight(struct drm_device *dev)
+ 		}
+ 	}
+ 
++	val = intel_panel_compute_brightness(dev, val);
+ 	DRM_DEBUG_DRIVER("get backlight PWM = %d\n", val);
+ 	return val;
+ }
+@@ -226,6 +249,7 @@ static void intel_panel_actually_set_backlight(struct drm_device *dev, u32 level
+ 	u32 tmp;
+ 
+ 	DRM_DEBUG_DRIVER("set backlight PWM = %d\n", level);
++	level = intel_panel_compute_brightness(dev, level);
+ 
+ 	if (HAS_PCH_SPLIT(dev))
+ 		return intel_pch_panel_set_backlight(dev, level);
+@@ -335,6 +359,9 @@ int intel_panel_setup_backlight(struct drm_device *dev)
+ 
+ 	intel_panel_init_backlight(dev);
+ 
++	if (WARN_ON(dev_priv->backlight))
++		return -ENODEV;
++
+ 	if (dev_priv->int_lvds_connector)
+ 		connector = dev_priv->int_lvds_connector;
+ 	else if (dev_priv->int_edp_connector)
+@@ -362,8 +389,10 @@ int intel_panel_setup_backlight(struct drm_device *dev)
+ void intel_panel_destroy_backlight(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+-	if (dev_priv->backlight)
++	if (dev_priv->backlight) {
+ 		backlight_device_unregister(dev_priv->backlight);
++		dev_priv->backlight = NULL;
++	}
+ }
+ #else
+ int intel_panel_setup_backlight(struct drm_device *dev)
+diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
+index c0ba260cc222..8d55a33d7226 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -2265,6 +2265,18 @@ intel_sdvo_output_setup(struct intel_sdvo *intel_sdvo, uint16_t flags)
+ 	return true;
+ }
+ 
++static void intel_sdvo_output_cleanup(struct intel_sdvo *intel_sdvo)
++{
++	struct drm_device *dev = intel_sdvo->base.base.dev;
++	struct drm_connector *connector, *tmp;
++
++	list_for_each_entry_safe(connector, tmp,
++				 &dev->mode_config.connector_list, head) {
++		if (intel_attached_encoder(connector) == &intel_sdvo->base)
++			intel_sdvo_destroy(connector);
++	}
++}
++
+ static bool intel_sdvo_tv_create_property(struct intel_sdvo *intel_sdvo,
+ 					  struct intel_sdvo_connector *intel_sdvo_connector,
+ 					  int type)
+@@ -2583,7 +2595,8 @@ bool intel_sdvo_init(struct drm_device *dev, int sdvo_reg)
+ 				    intel_sdvo->caps.output_flags) != true) {
+ 		DRM_DEBUG_KMS("SDVO output failed to setup on SDVO%c\n",
+ 			      IS_SDVOB(sdvo_reg) ? 'B' : 'C');
+-		goto err;
++		/* Output_setup can leave behind connectors! */
++		goto err_output;
+ 	}
+ 
+ 	/* Only enable the hotplug irq if we need it, to work around noisy
+@@ -2596,12 +2609,12 @@ bool intel_sdvo_init(struct drm_device *dev, int sdvo_reg)
+ 
+ 	/* Set the input timing to the screen. Assume always input 0. */
+ 	if (!intel_sdvo_set_target_input(intel_sdvo))
+-		goto err;
++		goto err_output;
+ 
+ 	if (!intel_sdvo_get_input_pixel_clock_range(intel_sdvo,
+ 						    &intel_sdvo->pixel_clock_min,
+ 						    &intel_sdvo->pixel_clock_max))
+-		goto err;
++		goto err_output;
+ 
+ 	DRM_DEBUG_KMS("%s device VID/DID: %02X:%02X.%02X, "
+ 			"clock range %dMHz - %dMHz, "
+@@ -2621,6 +2634,9 @@ bool intel_sdvo_init(struct drm_device *dev, int sdvo_reg)
+ 			(SDVO_OUTPUT_TMDS1 | SDVO_OUTPUT_RGB1) ? 'Y' : 'N');
+ 	return true;
+ 
++err_output:
++	intel_sdvo_output_cleanup(intel_sdvo);
++
+ err:
+ 	drm_encoder_cleanup(&intel_encoder->base);
+ 	i2c_del_adapter(&intel_sdvo->ddc);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
+index 284bd25d5d21..4339694bd9f8 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
++++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
+@@ -375,9 +375,6 @@ bool nouveau_acpi_rom_supported(struct pci_dev *pdev)
+ 	acpi_status status;
+ 	acpi_handle dhandle, rom_handle;
+ 
+-	if (!nouveau_dsm_priv.dsm_detected && !nouveau_dsm_priv.optimus_detected)
+-		return false;
+-
+ 	dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
+ 	if (!dhandle)
+ 		return false;
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
+index 12ce044f12f5..2c3d5c8b7a3f 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
+@@ -946,7 +946,7 @@ nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *mem)
+ 		if (dev_priv->gart_info.type == NOUVEAU_GART_AGP) {
+ 			mem->bus.offset = mem->start << PAGE_SHIFT;
+ 			mem->bus.base = dev_priv->gart_info.aper_base;
+-			mem->bus.is_iomem = true;
++			mem->bus.is_iomem = !dev->agp->cant_use_aperture;
+ 		}
+ #endif
+ 		break;
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index ebbfbd201739..dc612efbeb7a 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -573,6 +573,11 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ 		/* use frac fb div on APUs */
+ 		if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev))
+ 			pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
++		/* use frac fb div on RS780/RS880 */
++		if ((rdev->family == CHIP_RS780) || (rdev->family == CHIP_RS880))
++			pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
++		if (ASIC_IS_DCE32(rdev) && mode->clock > 165000)
++			pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
+ 	} else {
+ 		pll->flags |= RADEON_PLL_LEGACY;
+ 
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index ad72295403a8..df62c393f2f5 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -1292,7 +1292,7 @@ void evergreen_mc_resume(struct radeon_device *rdev, struct evergreen_mc_save *s
+ 	WREG32(BIF_FB_EN, FB_READ_EN | FB_WRITE_EN);
+ 
+ 	for (i = 0; i < rdev->num_crtc; i++) {
+-		if (save->crtc_enabled) {
++		if (save->crtc_enabled[i]) {
+ 			if (ASIC_IS_DCE6(rdev)) {
+ 				tmp = RREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i]);
+ 				tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
+@@ -1874,7 +1874,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
+ 	case CHIP_SUMO:
+ 		rdev->config.evergreen.num_ses = 1;
+ 		rdev->config.evergreen.max_pipes = 4;
+-		rdev->config.evergreen.max_tile_pipes = 2;
++		rdev->config.evergreen.max_tile_pipes = 4;
+ 		if (rdev->pdev->device == 0x9648)
+ 			rdev->config.evergreen.max_simds = 3;
+ 		else if ((rdev->pdev->device == 0x9647) ||
+@@ -1963,7 +1963,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
+ 		break;
+ 	case CHIP_CAICOS:
+ 		rdev->config.evergreen.num_ses = 1;
+-		rdev->config.evergreen.max_pipes = 4;
++		rdev->config.evergreen.max_pipes = 2;
+ 		rdev->config.evergreen.max_tile_pipes = 2;
+ 		rdev->config.evergreen.max_simds = 2;
+ 		rdev->config.evergreen.max_backends = 1 * rdev->config.evergreen.num_ses;
+@@ -3219,6 +3219,8 @@ static int evergreen_startup(struct radeon_device *rdev)
+ 	/* enable pcie gen2 link */
+ 	evergreen_pcie_gen2_enable(rdev);
+ 
++	evergreen_mc_program(rdev);
++
+ 	if (ASIC_IS_DCE5(rdev)) {
+ 		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw || !rdev->mc_fw) {
+ 			r = ni_init_microcode(rdev);
+@@ -3246,7 +3248,6 @@ static int evergreen_startup(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
+-	evergreen_mc_program(rdev);
+ 	if (rdev->flags & RADEON_IS_AGP) {
+ 		evergreen_agp_enable(rdev);
+ 	} else {
+diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
+index f481da3a4f29..461262eee79a 100644
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1552,6 +1552,8 @@ static int cayman_startup(struct radeon_device *rdev)
+ 	/* enable pcie gen2 link */
+ 	evergreen_pcie_gen2_enable(rdev);
+ 
++	evergreen_mc_program(rdev);
++
+ 	if (rdev->flags & RADEON_IS_IGP) {
+ 		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
+ 			r = ni_init_microcode(rdev);
+@@ -1580,7 +1582,6 @@ static int cayman_startup(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
+-	evergreen_mc_program(rdev);
+ 	r = cayman_pcie_gart_enable(rdev);
+ 	if (r)
+ 		return r;
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index 49b622904217..1555cd694111 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -2431,6 +2431,8 @@ int r600_startup(struct radeon_device *rdev)
+ 	/* enable pcie gen2 link */
+ 	r600_pcie_gen2_enable(rdev);
+ 
++	r600_mc_program(rdev);
++
+ 	if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
+ 		r = r600_init_microcode(rdev);
+ 		if (r) {
+@@ -2443,7 +2445,6 @@ int r600_startup(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
+-	r600_mc_program(rdev);
+ 	if (rdev->flags & RADEON_IS_AGP) {
+ 		r600_agp_enable(rdev);
+ 	} else {
+diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
+index 0b5920671450..61ffe3c76474 100644
+--- a/drivers/gpu/drm/radeon/r600_hdmi.c
++++ b/drivers/gpu/drm/radeon/r600_hdmi.c
+@@ -530,7 +530,7 @@ void r600_hdmi_enable(struct drm_encoder *encoder)
+ 		WREG32_P(radeon_encoder->hdmi_config_offset + 0x4, 0x1, ~0x1);
+ 	} else if (ASIC_IS_DCE3(rdev)) {
+ 		/* TODO */
+-	} else if (rdev->family >= CHIP_R600) {
++	} else if (ASIC_IS_DCE2(rdev)) {
+ 		switch (radeon_encoder->encoder_id) {
+ 		case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1:
+ 			WREG32_P(AVIVO_TMDSA_CNTL, AVIVO_TMDSA_CNTL_HDMI_EN,
+@@ -602,7 +602,7 @@ void r600_hdmi_disable(struct drm_encoder *encoder)
+ 		WREG32_P(radeon_encoder->hdmi_config_offset + 0xc, 0, ~0x1);
+ 	} else if (ASIC_IS_DCE32(rdev)) {
+ 		WREG32_P(radeon_encoder->hdmi_config_offset + 0x4, 0, ~0x1);
+-	} else if (rdev->family >= CHIP_R600 && !ASIC_IS_DCE3(rdev)) {
++	} else if (ASIC_IS_DCE2(rdev) && !ASIC_IS_DCE3(rdev)) {
+ 		switch (radeon_encoder->encoder_id) {
+ 		case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1:
+ 			WREG32_P(AVIVO_TMDSA_CNTL, 0,
+diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+index 2a2cf0b88a28..428bce6cb4f0 100644
+--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
++++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+@@ -202,6 +202,13 @@ static bool radeon_atpx_detect(void)
+ 		has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
+ 	}
+ 
++	/* some newer PX laptops mark the dGPU as a non-VGA display device */
++	while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
++		vga_count++;
++
++		has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
++	}
++
+ 	if (has_atpx && vga_count == 2) {
+ 		acpi_get_name(radeon_atpx_priv.atpx_handle, ACPI_FULL_PATHNAME, &buffer);
+ 		printk(KERN_INFO "VGA switcheroo: detected switching method %s handle\n",
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index 07d0bcd718a1..cf5dd63a95c3 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -898,10 +898,14 @@ struct radeon_encoder_primary_dac *radeon_combios_get_primary_dac_info(struct
+ 	}
+ 
+ 	/* quirks */
++	/* Radeon 7000 (RV100) */
++	if (((dev->pdev->device == 0x5159) &&
++	    (dev->pdev->subsystem_vendor == 0x174B) &&
++	    (dev->pdev->subsystem_device == 0x7c28)) ||
+ 	/* Radeon 9100 (R200) */
+-	if ((dev->pdev->device == 0x514D) &&
++	   ((dev->pdev->device == 0x514D) &&
+ 	    (dev->pdev->subsystem_vendor == 0x174B) &&
+-	    (dev->pdev->subsystem_device == 0x7149)) {
++	    (dev->pdev->subsystem_device == 0x7149))) {
+ 		/* vbios value is bad, use the default */
+ 		found = 0;
+ 	}
+@@ -1484,6 +1488,9 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
+ 			   of_machine_is_compatible("PowerBook6,7")) {
+ 			/* ibook */
+ 			rdev->mode_info.connector_table = CT_IBOOK;
++		} else if (of_machine_is_compatible("PowerMac3,5")) {
++			/* PowerMac G4 Silver radeon 7500 */
++			rdev->mode_info.connector_table = CT_MAC_G4_SILVER;
+ 		} else if (of_machine_is_compatible("PowerMac4,4")) {
+ 			/* emac */
+ 			rdev->mode_info.connector_table = CT_EMAC;
+@@ -1509,6 +1516,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
+ 			   (rdev->pdev->subsystem_device == 0x4150)) {
+ 			/* Mac G5 tower 9600 */
+ 			rdev->mode_info.connector_table = CT_MAC_G5_9600;
++		} else if ((rdev->pdev->device == 0x4c66) &&
++			   (rdev->pdev->subsystem_vendor == 0x1002) &&
++			   (rdev->pdev->subsystem_device == 0x4c66)) {
++			/* SAM440ep RV250 embedded board */
++			rdev->mode_info.connector_table = CT_SAM440EP;
+ 		} else
+ #endif /* CONFIG_PPC_PMAC */
+ #ifdef CONFIG_PPC64
+@@ -2082,6 +2094,115 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
+ 					    CONNECTOR_OBJECT_ID_SVIDEO,
+ 					    &hpd);
+ 		break;
++	case CT_SAM440EP:
++		DRM_INFO("Connector Table: %d (SAM440ep embedded board)\n",
++			 rdev->mode_info.connector_table);
++		/* LVDS */
++		ddc_i2c = combios_setup_i2c_bus(rdev, DDC_NONE_DETECTED, 0, 0);
++		hpd.hpd = RADEON_HPD_NONE;
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_LCD1_SUPPORT,
++								0),
++					  ATOM_DEVICE_LCD1_SUPPORT);
++		radeon_add_legacy_connector(dev, 0, ATOM_DEVICE_LCD1_SUPPORT,
++					    DRM_MODE_CONNECTOR_LVDS, &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_LVDS,
++					    &hpd);
++		/* DVI-I - secondary dac, int tmds */
++		ddc_i2c = combios_setup_i2c_bus(rdev, DDC_DVI, 0, 0);
++		hpd.hpd = RADEON_HPD_1; /* ??? */
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_DFP1_SUPPORT,
++								0),
++					  ATOM_DEVICE_DFP1_SUPPORT);
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_CRT2_SUPPORT,
++								2),
++					  ATOM_DEVICE_CRT2_SUPPORT);
++		radeon_add_legacy_connector(dev, 1,
++					    ATOM_DEVICE_DFP1_SUPPORT |
++					    ATOM_DEVICE_CRT2_SUPPORT,
++					    DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
++					    &hpd);
++		/* VGA - primary dac */
++		ddc_i2c = combios_setup_i2c_bus(rdev, DDC_VGA, 0, 0);
++		hpd.hpd = RADEON_HPD_NONE;
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_CRT1_SUPPORT,
++								1),
++					  ATOM_DEVICE_CRT1_SUPPORT);
++		radeon_add_legacy_connector(dev, 2,
++					    ATOM_DEVICE_CRT1_SUPPORT,
++					    DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_VGA,
++					    &hpd);
++		/* TV - TV DAC */
++		ddc_i2c.valid = false;
++		hpd.hpd = RADEON_HPD_NONE;
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_TV1_SUPPORT,
++								2),
++					  ATOM_DEVICE_TV1_SUPPORT);
++		radeon_add_legacy_connector(dev, 3, ATOM_DEVICE_TV1_SUPPORT,
++					    DRM_MODE_CONNECTOR_SVIDEO,
++					    &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_SVIDEO,
++					    &hpd);
++		break;
++	case CT_MAC_G4_SILVER:
++		DRM_INFO("Connector Table: %d (mac g4 silver)\n",
++			 rdev->mode_info.connector_table);
++		/* DVI-I - tv dac, int tmds */
++		ddc_i2c = combios_setup_i2c_bus(rdev, DDC_DVI, 0, 0);
++		hpd.hpd = RADEON_HPD_1; /* ??? */
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_DFP1_SUPPORT,
++								0),
++					  ATOM_DEVICE_DFP1_SUPPORT);
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_CRT2_SUPPORT,
++								2),
++					  ATOM_DEVICE_CRT2_SUPPORT);
++		radeon_add_legacy_connector(dev, 0,
++					    ATOM_DEVICE_DFP1_SUPPORT |
++					    ATOM_DEVICE_CRT2_SUPPORT,
++					    DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
++					    &hpd);
++		/* VGA - primary dac */
++		ddc_i2c = combios_setup_i2c_bus(rdev, DDC_VGA, 0, 0);
++		hpd.hpd = RADEON_HPD_NONE;
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_CRT1_SUPPORT,
++								1),
++					  ATOM_DEVICE_CRT1_SUPPORT);
++		radeon_add_legacy_connector(dev, 1, ATOM_DEVICE_CRT1_SUPPORT,
++					    DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_VGA,
++					    &hpd);
++		/* TV - TV DAC */
++		ddc_i2c.valid = false;
++		hpd.hpd = RADEON_HPD_NONE;
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_TV1_SUPPORT,
++								2),
++					  ATOM_DEVICE_TV1_SUPPORT);
++		radeon_add_legacy_connector(dev, 2, ATOM_DEVICE_TV1_SUPPORT,
++					    DRM_MODE_CONNECTOR_SVIDEO,
++					    &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_SVIDEO,
++					    &hpd);
++		break;
+ 	default:
+ 		DRM_INFO("Connector table: %d (invalid)\n",
+ 			 rdev->mode_info.connector_table);
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index ab63bcd17277..1334dbd15c1b 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -1423,6 +1423,24 @@ struct drm_connector_funcs radeon_dp_connector_funcs = {
+ 	.force = radeon_dvi_force,
+ };
+ 
++static const struct drm_connector_funcs radeon_edp_connector_funcs = {
++	.dpms = drm_helper_connector_dpms,
++	.detect = radeon_dp_detect,
++	.fill_modes = drm_helper_probe_single_connector_modes,
++	.set_property = radeon_lvds_set_property,
++	.destroy = radeon_dp_connector_destroy,
++	.force = radeon_dvi_force,
++};
++
++static const struct drm_connector_funcs radeon_lvds_bridge_connector_funcs = {
++	.dpms = drm_helper_connector_dpms,
++	.detect = radeon_dp_detect,
++	.fill_modes = drm_helper_probe_single_connector_modes,
++	.set_property = radeon_lvds_set_property,
++	.destroy = radeon_dp_connector_destroy,
++	.force = radeon_dvi_force,
++};
++
+ void
+ radeon_add_atom_connector(struct drm_device *dev,
+ 			  uint32_t connector_id,
+@@ -1514,8 +1532,6 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 			goto failed;
+ 		radeon_dig_connector->igp_lane_info = igp_lane_info;
+ 		radeon_connector->con_priv = radeon_dig_connector;
+-		drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type);
+-		drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs);
+ 		if (i2c_bus->valid) {
+ 			/* add DP i2c bus */
+ 			if (connector_type == DRM_MODE_CONNECTOR_eDP)
+@@ -1532,6 +1548,10 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 		case DRM_MODE_CONNECTOR_VGA:
+ 		case DRM_MODE_CONNECTOR_DVIA:
+ 		default:
++			drm_connector_init(dev, &radeon_connector->base,
++					   &radeon_dp_connector_funcs, connector_type);
++			drm_connector_helper_add(&radeon_connector->base,
++						 &radeon_dp_connector_helper_funcs);
+ 			connector->interlace_allowed = true;
+ 			connector->doublescan_allowed = true;
+ 			radeon_connector->dac_load_detect = true;
+@@ -1544,6 +1564,10 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 		case DRM_MODE_CONNECTOR_HDMIA:
+ 		case DRM_MODE_CONNECTOR_HDMIB:
+ 		case DRM_MODE_CONNECTOR_DisplayPort:
++			drm_connector_init(dev, &radeon_connector->base,
++					   &radeon_dp_connector_funcs, connector_type);
++			drm_connector_helper_add(&radeon_connector->base,
++						 &radeon_dp_connector_helper_funcs);
+ 			drm_connector_attach_property(&radeon_connector->base,
+ 						      rdev->mode_info.underscan_property,
+ 						      UNDERSCAN_OFF);
+@@ -1568,6 +1592,10 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 			break;
+ 		case DRM_MODE_CONNECTOR_LVDS:
+ 		case DRM_MODE_CONNECTOR_eDP:
++			drm_connector_init(dev, &radeon_connector->base,
++					   &radeon_lvds_bridge_connector_funcs, connector_type);
++			drm_connector_helper_add(&radeon_connector->base,
++						 &radeon_dp_connector_helper_funcs);
+ 			drm_connector_attach_property(&radeon_connector->base,
+ 						      dev->mode_config.scaling_mode_property,
+ 						      DRM_MODE_SCALE_FULLSCREEN);
+@@ -1731,7 +1759,7 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 				goto failed;
+ 			radeon_dig_connector->igp_lane_info = igp_lane_info;
+ 			radeon_connector->con_priv = radeon_dig_connector;
+-			drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type);
++			drm_connector_init(dev, &radeon_connector->base, &radeon_edp_connector_funcs, connector_type);
+ 			drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs);
+ 			if (i2c_bus->valid) {
+ 				/* add DP i2c bus */
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 00d9cac69f93..60404f4b2446 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -750,6 +750,7 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
+ 	if (radeon_connector->edid) {
+ 		drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid);
+ 		ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid);
++		drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid);
+ 		return ret;
+ 	}
+ 	drm_mode_connector_update_edid_property(&radeon_connector->base, NULL);
+diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
+index 3c2628b14d56..9b46238b9692 100644
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -39,8 +39,12 @@ int radeon_driver_unload_kms(struct drm_device *dev)
+ 
+ 	if (rdev == NULL)
+ 		return 0;
++	if (rdev->rmmio == NULL)
++		goto done_free;
+ 	radeon_modeset_fini(rdev);
+ 	radeon_device_fini(rdev);
++
++done_free:
+ 	kfree(rdev);
+ 	dev->dev_private = NULL;
+ 	return 0;
+diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
+index dabfefda8f55..65da706bc7be 100644
+--- a/drivers/gpu/drm/radeon/radeon_mode.h
++++ b/drivers/gpu/drm/radeon/radeon_mode.h
+@@ -210,6 +210,8 @@ enum radeon_connector_table {
+ 	CT_RN50_POWER,
+ 	CT_MAC_X800,
+ 	CT_MAC_G5_9600,
++	CT_SAM440EP,
++	CT_MAC_G4_SILVER
+ };
+ 
+ enum radeon_dvo_chip {
+diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
+index 4a3937fa2dc7..1ec1255520ad 100644
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -1058,6 +1058,8 @@ static int rv770_startup(struct radeon_device *rdev)
+ 	/* enable pcie gen2 link */
+ 	rv770_pcie_gen2_enable(rdev);
+ 
++	rv770_mc_program(rdev);
++
+ 	if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
+ 		r = r600_init_microcode(rdev);
+ 		if (r) {
+@@ -1070,7 +1072,6 @@ static int rv770_startup(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
+-	rv770_mc_program(rdev);
+ 	if (rdev->flags & RADEON_IS_AGP) {
+ 		rv770_agp_enable(rdev);
+ 	} else {
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index c22b5e7849f8..e710073923e9 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -3834,6 +3834,8 @@ static int si_startup(struct radeon_device *rdev)
+ 	struct radeon_ring *ring;
+ 	int r;
+ 
++	si_mc_program(rdev);
++
+ 	if (!rdev->me_fw || !rdev->pfp_fw || !rdev->ce_fw ||
+ 	    !rdev->rlc_fw || !rdev->mc_fw) {
+ 		r = si_init_microcode(rdev);
+@@ -3853,7 +3855,6 @@ static int si_startup(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
+-	si_mc_program(rdev);
+ 	r = si_pcie_gart_enable(rdev);
+ 	if (r)
+ 		return r;
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index ceb70dde21ab..a67e61be38f2 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -1091,24 +1091,32 @@ out_unlock:
+ 	return ret;
+ }
+ 
+-static int ttm_bo_mem_compat(struct ttm_placement *placement,
+-			     struct ttm_mem_reg *mem)
++static bool ttm_bo_mem_compat(struct ttm_placement *placement,
++			      struct ttm_mem_reg *mem,
++			      uint32_t *new_flags)
+ {
+ 	int i;
+ 
+ 	if (mem->mm_node && placement->lpfn != 0 &&
+ 	    (mem->start < placement->fpfn ||
+ 	     mem->start + mem->num_pages > placement->lpfn))
+-		return -1;
++		return false;
+ 
+ 	for (i = 0; i < placement->num_placement; i++) {
+-		if ((placement->placement[i] & mem->placement &
+-			TTM_PL_MASK_CACHING) &&
+-			(placement->placement[i] & mem->placement &
+-			TTM_PL_MASK_MEM))
+-			return i;
++		*new_flags = placement->placement[i];
++		if ((*new_flags & mem->placement & TTM_PL_MASK_CACHING) &&
++		    (*new_flags & mem->placement & TTM_PL_MASK_MEM))
++			return true;
++	}
++
++	for (i = 0; i < placement->num_busy_placement; i++) {
++		*new_flags = placement->busy_placement[i];
++		if ((*new_flags & mem->placement & TTM_PL_MASK_CACHING) &&
++		    (*new_flags & mem->placement & TTM_PL_MASK_MEM))
++			return true;
+ 	}
+-	return -1;
++
++	return false;
+ }
+ 
+ int ttm_bo_validate(struct ttm_buffer_object *bo,
+@@ -1117,6 +1125,7 @@ int ttm_bo_validate(struct ttm_buffer_object *bo,
+ 			bool no_wait_gpu)
+ {
+ 	int ret;
++	uint32_t new_flags;
+ 
+ 	BUG_ON(!atomic_read(&bo->reserved));
+ 	/* Check that range is valid */
+@@ -1127,8 +1136,7 @@ int ttm_bo_validate(struct ttm_buffer_object *bo,
+ 	/*
+ 	 * Check whether we need to move buffer.
+ 	 */
+-	ret = ttm_bo_mem_compat(placement, &bo->mem);
+-	if (ret < 0) {
++	if (!ttm_bo_mem_compat(placement, &bo->mem, &new_flags)) {
+ 		ret = ttm_bo_move_buffer(bo, placement, interruptible, no_wait_reserve, no_wait_gpu);
+ 		if (ret)
+ 			return ret;
+@@ -1137,7 +1145,7 @@ int ttm_bo_validate(struct ttm_buffer_object *bo,
+ 		 * Use the access and other non-mapping-related flag bits from
+ 		 * the compatible memory placement flags to the active flags
+ 		 */
+-		ttm_flag_masked(&bo->mem.placement, placement->placement[ret],
++		ttm_flag_masked(&bo->mem.placement, new_flags,
+ 				~TTM_PL_MASK_MEMTYPE);
+ 	}
+ 	/*
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+index 3c447bf317cb..6651cb328598 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+@@ -147,7 +147,7 @@ static int vmw_fb_check_var(struct fb_var_screeninfo *var,
+ 	}
+ 
+ 	if (!vmw_kms_validate_mode_vram(vmw_priv,
+-					info->fix.line_length,
++					var->xres * var->bits_per_pixel/8,
+ 					var->yoffset + var->yres)) {
+ 		DRM_ERROR("Requested geom can not fit in framebuffer\n");
+ 		return -EINVAL;
+@@ -162,6 +162,8 @@ static int vmw_fb_set_par(struct fb_info *info)
+ 	struct vmw_private *vmw_priv = par->vmw_priv;
+ 	int ret;
+ 
++	info->fix.line_length = info->var.xres * info->var.bits_per_pixel/8;
++
+ 	ret = vmw_kms_write_svga(vmw_priv, info->var.xres, info->var.yres,
+ 				 info->fix.line_length,
+ 				 par->bpp, par->depth);
+@@ -177,6 +179,7 @@ static int vmw_fb_set_par(struct fb_info *info)
+ 		vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset);
+ 		vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
+ 		vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
++		vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length);
+ 		vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+ 	}
+ 
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index 265284620980..3bfd74f1ad49 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -474,28 +474,38 @@ static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev,
+ 
+ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
+ {
+-	struct dj_report dj_report;
++	struct dj_report *dj_report;
++	int retval;
+ 
+-	memset(&dj_report, 0, sizeof(dj_report));
+-	dj_report.report_id = REPORT_ID_DJ_SHORT;
+-	dj_report.device_index = 0xFF;
+-	dj_report.report_type = REPORT_TYPE_CMD_GET_PAIRED_DEVICES;
+-	return logi_dj_recv_send_report(djrcv_dev, &dj_report);
++	dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
++	if (!dj_report)
++		return -ENOMEM;
++	dj_report->report_id = REPORT_ID_DJ_SHORT;
++	dj_report->device_index = 0xFF;
++	dj_report->report_type = REPORT_TYPE_CMD_GET_PAIRED_DEVICES;
++	retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
++	kfree(dj_report);
++	return retval;
+ }
+ 
+ 
+ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
+ 					  unsigned timeout)
+ {
+-	struct dj_report dj_report;
++	struct dj_report *dj_report;
++	int retval;
+ 
+-	memset(&dj_report, 0, sizeof(dj_report));
+-	dj_report.report_id = REPORT_ID_DJ_SHORT;
+-	dj_report.device_index = 0xFF;
+-	dj_report.report_type = REPORT_TYPE_CMD_SWITCH;
+-	dj_report.report_params[CMD_SWITCH_PARAM_DEVBITFIELD] = 0x3F;
+-	dj_report.report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS] = (u8)timeout;
+-	return logi_dj_recv_send_report(djrcv_dev, &dj_report);
++	dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
++	if (!dj_report)
++		return -ENOMEM;
++	dj_report->report_id = REPORT_ID_DJ_SHORT;
++	dj_report->device_index = 0xFF;
++	dj_report->report_type = REPORT_TYPE_CMD_SWITCH;
++	dj_report->report_params[CMD_SWITCH_PARAM_DEVBITFIELD] = 0x3F;
++	dj_report->report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS] = (u8)timeout;
++	retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
++	kfree(dj_report);
++	return retval;
+ }
+ 
+ 
+diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
+index 8af25a097d75..d01edf3c7b28 100644
+--- a/drivers/hv/ring_buffer.c
++++ b/drivers/hv/ring_buffer.c
+@@ -383,7 +383,7 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+ 					     sizeof(u64));
+ 
+ 	/* Make sure we flush all writes before updating the writeIndex */
+-	smp_wmb();
++	wmb();
+ 
+ 	/* Now, update the write location */
+ 	hv_set_next_write_location(outring_info, next_write_location);
+@@ -485,7 +485,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info, void *buffer,
+ 	/* Make sure all reads are done before we update the read index since */
+ 	/* the writer may start writing to the read area once the read index */
+ 	/*is updated */
+-	smp_mb();
++	mb();
+ 
+ 	/* Update the read index */
+ 	hv_set_next_read_location(inring_info, next_read_location);
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index a220e5746d67..10619b34bd31 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -466,7 +466,7 @@ static void vmbus_on_msg_dpc(unsigned long data)
+ 		 * will not deliver any more messages since there is
+ 		 * no empty slot
+ 		 */
+-		smp_mb();
++		mb();
+ 
+ 		if (msg->header.message_flags.msg_pending) {
+ 			/*
+diff --git a/drivers/hwmon/emc1403.c b/drivers/hwmon/emc1403.c
+index 149dcb0e148f..d5c33d5c0389 100644
+--- a/drivers/hwmon/emc1403.c
++++ b/drivers/hwmon/emc1403.c
+@@ -161,7 +161,7 @@ static ssize_t store_hyst(struct device *dev,
+ 	if (retval < 0)
+ 		goto fail;
+ 
+-	hyst = val - retval * 1000;
++	hyst = retval * 1000 - val;
+ 	hyst = DIV_ROUND_CLOSEST(hyst, 1000);
+ 	if (hyst < 0 || hyst > 255) {
+ 		retval = -ERANGE;
+@@ -294,7 +294,7 @@ static int emc1403_detect(struct i2c_client *client,
+ 	}
+ 
+ 	id = i2c_smbus_read_byte_data(client, THERMAL_REVISION_REG);
+-	if (id != 0x01)
++	if (id < 0x01 || id > 0x04)
+ 		return -ENODEV;
+ 
+ 	return 0;
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index bc625f6c5b4c..9494910b330c 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -138,6 +138,7 @@ config I2C_PIIX4
+ 	    ATI SB700
+ 	    ATI SB800
+ 	    AMD Hudson-2
++	    AMD CZ
+ 	    Serverworks OSB4
+ 	    Serverworks CSB5
+ 	    Serverworks CSB6
+diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
+index 3c2812f13d96..aadb3984f0d3 100644
+--- a/drivers/i2c/busses/i2c-designware-core.c
++++ b/drivers/i2c/busses/i2c-designware-core.c
+@@ -346,6 +346,9 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
+ 		ic_con &= ~DW_IC_CON_10BITADDR_MASTER;
+ 	dw_writel(dev, ic_con, DW_IC_CON);
+ 
++	/* enforce disabled interrupts (due to HW issues) */
++	i2c_dw_disable_int(dev);
++
+ 	/* Enable the adapter */
+ 	dw_writel(dev, 1, DW_IC_ENABLE);
+ 
+diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
+index c14d48dd601a..a35697490681 100644
+--- a/drivers/i2c/busses/i2c-piix4.c
++++ b/drivers/i2c/busses/i2c-piix4.c
+@@ -22,7 +22,7 @@
+ 	Intel PIIX4, 440MX
+ 	Serverworks OSB4, CSB5, CSB6, HT-1000, HT-1100
+ 	ATI IXP200, IXP300, IXP400, SB600, SB700, SB800
+-	AMD Hudson-2
++	AMD Hudson-2, CZ
+ 	SMSC Victory66
+ 
+    Note: we assume there can only be one device, with one SMBus interface.
+@@ -481,6 +481,7 @@ static DEFINE_PCI_DEVICE_TABLE(piix4_ids) = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP400_SMBUS) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_SBX00_SMBUS) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, 0x790b) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
+ 		     PCI_DEVICE_ID_SERVERWORKS_OSB4) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
+diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
+index df19f3d588cd..d47ca36b4dee 100644
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -341,7 +341,11 @@ static int tegra_i2c_init(struct tegra_i2c_dev *i2c_dev)
+ 	u32 val;
+ 	int err = 0;
+ 
+-	clk_enable(i2c_dev->clk);
++	err = clk_enable(i2c_dev->clk);
++	if (err < 0) {
++		dev_err(i2c_dev->dev, "Clock enable failed %d\n", err);
++		return err;
++	}
+ 
+ 	tegra_periph_reset_assert(i2c_dev->clk);
+ 	udelay(2);
+@@ -543,7 +547,12 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
+ 	if (i2c_dev->is_suspended)
+ 		return -EBUSY;
+ 
+-	clk_enable(i2c_dev->clk);
++	ret = clk_enable(i2c_dev->clk);
++	if (ret < 0) {
++		dev_err(i2c_dev->dev, "Clock enable failed %d\n", ret);
++		return ret;
++	}
++
+ 	for (i = 0; i < num; i++) {
+ 		int stop = (i == (num - 1)) ? 1  : 0;
+ 		ret = tegra_i2c_xfer_msg(i2c_dev, &msgs[i], stop);
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index 014364ab689b..9b09185683f8 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -443,10 +443,8 @@ static int intel_idle_probe(void)
+ 
+ 	if (boot_cpu_has(X86_FEATURE_ARAT))	/* Always Reliable APIC Timer */
+ 		lapic_timer_reliable_states = LAPIC_TIMER_ALWAYS_RELIABLE;
+-	else {
++	else
+ 		on_each_cpu(__setup_broadcast_timer, (void *)true, 1);
+-		register_cpu_notifier(&setup_broadcast_notifier);
+-	}
+ 
+ 	pr_debug(PREFIX "v" INTEL_IDLE_VERSION
+ 		" model 0x%X\n", boot_cpu_data.x86_model);
+@@ -612,6 +610,9 @@ static int __init intel_idle_init(void)
+ 		}
+ 	}
+ 
++	if (lapic_timer_reliable_states != LAPIC_TIMER_ALWAYS_RELIABLE)
++		register_cpu_notifier(&setup_broadcast_notifier);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index c1f7e9b65088..326e19459ee6 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -53,14 +53,19 @@
+ #define ABS_POS_BITS 13
+ 
+ /*
+- * Any position values from the hardware above the following limits are
+- * treated as "wrapped around negative" values that have been truncated to
+- * the 13-bit reporting range of the hardware. These are just reasonable
+- * guesses and can be adjusted if hardware is found that operates outside
+- * of these parameters.
++ * These values should represent the absolute maximum value that will
++ * be reported for a positive position value. Some Synaptics firmware
++ * uses this value to indicate a finger near the edge of the touchpad
++ * whose precise position cannot be determined.
++ *
++ * At least one touchpad is known to report positions in excess of this
++ * value which are actually negative values truncated to the 13-bit
++ * reporting range. These values have never been observed to be lower
++ * than 8184 (i.e. -8), so we treat all values greater than 8176 as
++ * negative and any other value as positive.
+  */
+-#define X_MAX_POSITIVE (((1 << ABS_POS_BITS) + XMAX) / 2)
+-#define Y_MAX_POSITIVE (((1 << ABS_POS_BITS) + YMAX) / 2)
++#define X_MAX_POSITIVE 8176
++#define Y_MAX_POSITIVE 8176
+ 
+ /*
+  * Synaptics touchpads report the y coordinate from bottom to top, which is
+@@ -583,11 +588,21 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
+ 		hw->right = (buf[0] & 0x02) ? 1 : 0;
+ 	}
+ 
+-	/* Convert wrap-around values to negative */
++	/*
++	 * Convert wrap-around values to negative. (X|Y)_MAX_POSITIVE
++	 * is used by some firmware to indicate a finger at the edge of
++	 * the touchpad whose precise position cannot be determined, so
++	 * convert these values to the maximum axis value.
++	 */
+ 	if (hw->x > X_MAX_POSITIVE)
+ 		hw->x -= 1 << ABS_POS_BITS;
++	else if (hw->x == X_MAX_POSITIVE)
++		hw->x = XMAX;
++
+ 	if (hw->y > Y_MAX_POSITIVE)
+ 		hw->y -= 1 << ABS_POS_BITS;
++	else if (hw->y == Y_MAX_POSITIVE)
++		hw->y = YMAX;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
+index 4c260dc7910e..6f99500790b3 100644
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -321,6 +321,9 @@ static void __cache_size_refresh(void)
+ static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask,
+ 			       enum data_mode *data_mode)
+ {
++	unsigned noio_flag;
++	void *ptr;
++
+ 	if (c->block_size <= DM_BUFIO_BLOCK_SIZE_SLAB_LIMIT) {
+ 		*data_mode = DATA_MODE_SLAB;
+ 		return kmem_cache_alloc(DM_BUFIO_CACHE(c), gfp_mask);
+@@ -334,7 +337,28 @@ static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask,
+ 	}
+ 
+ 	*data_mode = DATA_MODE_VMALLOC;
+-	return __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
++
++	/*
++	 * __vmalloc allocates the data pages and auxiliary structures with
++	 * gfp_flags that were specified, but pagetables are always allocated
++	 * with GFP_KERNEL, no matter what was specified as gfp_mask.
++	 *
++	 * Consequently, we must set per-process flag PF_MEMALLOC_NOIO so that
++	 * all allocations done by this process (including pagetables) are done
++	 * as if GFP_NOIO was specified.
++	 */
++
++	if (gfp_mask & __GFP_NORETRY) {
++		noio_flag = current->flags & PF_MEMALLOC;
++		current->flags |= PF_MEMALLOC;
++	}
++
++	ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
++
++	if (gfp_mask & __GFP_NORETRY)
++		current->flags = (current->flags & ~PF_MEMALLOC) | noio_flag;
++
++	return ptr;
+ }
+ 
+ /*
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index 9147569545e2..d5fc3ec3639e 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -84,6 +84,7 @@ struct multipath {
+ 	unsigned queue_io;		/* Must we queue all I/O? */
+ 	unsigned queue_if_no_path;	/* Queue I/O if last path fails? */
+ 	unsigned saved_queue_if_no_path;/* Saved state during suspension */
++	unsigned pg_init_disabled:1;	/* pg_init is not currently allowed */
+ 	unsigned pg_init_retries;	/* Number of times to retry pg_init */
+ 	unsigned pg_init_count;		/* Number of times pg_init called */
+ 	unsigned pg_init_delay_msecs;	/* Number of msecs before pg_init retry */
+@@ -493,7 +494,8 @@ static void process_queued_ios(struct work_struct *work)
+ 	    (!pgpath && !m->queue_if_no_path))
+ 		must_queue = 0;
+ 
+-	if (m->pg_init_required && !m->pg_init_in_progress && pgpath)
++	if (m->pg_init_required && !m->pg_init_in_progress && pgpath &&
++	    !m->pg_init_disabled)
+ 		__pg_init_all_paths(m);
+ 
+ out:
+@@ -907,10 +909,20 @@ static void multipath_wait_for_pg_init_completion(struct multipath *m)
+ 
+ static void flush_multipath_work(struct multipath *m)
+ {
++	unsigned long flags;
++
++	spin_lock_irqsave(&m->lock, flags);
++	m->pg_init_disabled = 1;
++	spin_unlock_irqrestore(&m->lock, flags);
++
+ 	flush_workqueue(kmpath_handlerd);
+ 	multipath_wait_for_pg_init_completion(m);
+ 	flush_workqueue(kmultipathd);
+ 	flush_work_sync(&m->trigger_event);
++
++	spin_lock_irqsave(&m->lock, flags);
++	m->pg_init_disabled = 0;
++	spin_unlock_irqrestore(&m->lock, flags);
+ }
+ 
+ static void multipath_dtr(struct dm_target *ti)
+@@ -1129,7 +1141,7 @@ static int pg_init_limit_reached(struct multipath *m, struct pgpath *pgpath)
+ 
+ 	spin_lock_irqsave(&m->lock, flags);
+ 
+-	if (m->pg_init_count <= m->pg_init_retries)
++	if (m->pg_init_count <= m->pg_init_retries && !m->pg_init_disabled)
+ 		m->pg_init_required = 1;
+ 	else
+ 		limit_reached = 1;
+@@ -1644,7 +1656,7 @@ out:
+  *---------------------------------------------------------------*/
+ static struct target_type multipath_target = {
+ 	.name = "multipath",
+-	.version = {1, 3, 0},
++	.version = {1, 3, 2},
+ 	.module = THIS_MODULE,
+ 	.ctr = multipath_ctr,
+ 	.dtr = multipath_dtr,
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index db77ac693323..b092338d5966 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -66,6 +66,18 @@ struct dm_snapshot {
+ 
+ 	atomic_t pending_exceptions_count;
+ 
++	/* Protected by "lock" */
++	sector_t exception_start_sequence;
++
++	/* Protected by kcopyd single-threaded callback */
++	sector_t exception_complete_sequence;
++
++	/*
++	 * A list of pending exceptions that completed out of order.
++	 * Protected by kcopyd single-threaded callback.
++	 */
++	struct list_head out_of_order_list;
++
+ 	mempool_t *pending_pool;
+ 
+ 	struct dm_exception_table pending;
+@@ -171,6 +183,14 @@ struct dm_snap_pending_exception {
+ 	 */
+ 	int started;
+ 
++	/* There was copying error. */
++	int copy_error;
++
++	/* A sequence number, it is used for in-order completion. */
++	sector_t exception_sequence;
++
++	struct list_head out_of_order_entry;
++
+ 	/*
+ 	 * For writing a complete chunk, bypassing the copy.
+ 	 */
+@@ -1090,6 +1110,9 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ 	s->valid = 1;
+ 	s->active = 0;
+ 	atomic_set(&s->pending_exceptions_count, 0);
++	s->exception_start_sequence = 0;
++	s->exception_complete_sequence = 0;
++	INIT_LIST_HEAD(&s->out_of_order_list);
+ 	init_rwsem(&s->lock);
+ 	INIT_LIST_HEAD(&s->list);
+ 	spin_lock_init(&s->pe_lock);
+@@ -1448,6 +1471,19 @@ static void commit_callback(void *context, int success)
+ 	pending_complete(pe, success);
+ }
+ 
++static void complete_exception(struct dm_snap_pending_exception *pe)
++{
++	struct dm_snapshot *s = pe->snap;
++
++	if (unlikely(pe->copy_error))
++		pending_complete(pe, 0);
++
++	else
++		/* Update the metadata if we are persistent */
++		s->store->type->commit_exception(s->store, &pe->e,
++						 commit_callback, pe);
++}
++
+ /*
+  * Called when the copy I/O has finished.  kcopyd actually runs
+  * this code so don't block.
+@@ -1457,13 +1493,32 @@ static void copy_callback(int read_err, unsigned long write_err, void *context)
+ 	struct dm_snap_pending_exception *pe = context;
+ 	struct dm_snapshot *s = pe->snap;
+ 
+-	if (read_err || write_err)
+-		pending_complete(pe, 0);
++	pe->copy_error = read_err || write_err;
+ 
+-	else
+-		/* Update the metadata if we are persistent */
+-		s->store->type->commit_exception(s->store, &pe->e,
+-						 commit_callback, pe);
++	if (pe->exception_sequence == s->exception_complete_sequence) {
++		s->exception_complete_sequence++;
++		complete_exception(pe);
++
++		while (!list_empty(&s->out_of_order_list)) {
++			pe = list_entry(s->out_of_order_list.next,
++					struct dm_snap_pending_exception, out_of_order_entry);
++			if (pe->exception_sequence != s->exception_complete_sequence)
++				break;
++			s->exception_complete_sequence++;
++			list_del(&pe->out_of_order_entry);
++			complete_exception(pe);
++		}
++	} else {
++		struct list_head *lh;
++		struct dm_snap_pending_exception *pe2;
++
++		list_for_each_prev(lh, &s->out_of_order_list) {
++			pe2 = list_entry(lh, struct dm_snap_pending_exception, out_of_order_entry);
++			if (pe2->exception_sequence < pe->exception_sequence)
++				break;
++		}
++		list_add(&pe->out_of_order_entry, lh);
++	}
+ }
+ 
+ /*
+@@ -1558,6 +1613,8 @@ __find_pending_exception(struct dm_snapshot *s,
+ 		return NULL;
+ 	}
+ 
++	pe->exception_sequence = s->exception_start_sequence++;
++
+ 	dm_insert_exception(&s->pending, &pe->e);
+ 
+ 	return pe;
+@@ -2200,7 +2257,7 @@ static struct target_type origin_target = {
+ 
+ static struct target_type snapshot_target = {
+ 	.name    = "snapshot",
+-	.version = {1, 10, 0},
++	.version = {1, 10, 2},
+ 	.module  = THIS_MODULE,
+ 	.ctr     = snapshot_ctr,
+ 	.dtr     = snapshot_dtr,
+@@ -2323,3 +2380,5 @@ module_exit(dm_snapshot_exit);
+ MODULE_DESCRIPTION(DM_NAME " snapshot target");
+ MODULE_AUTHOR("Joe Thornber");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("dm-snapshot-origin");
++MODULE_ALIAS("dm-snapshot-merge");
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index b253744fc3c8..e811e44dfcf7 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2472,7 +2472,7 @@ static struct target_type pool_target = {
+ 	.name = "thin-pool",
+ 	.features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
+ 		    DM_TARGET_IMMUTABLE,
+-	.version = {1, 1, 0},
++	.version = {1, 1, 1},
+ 	.module = THIS_MODULE,
+ 	.ctr = pool_ctr,
+ 	.dtr = pool_dtr,
+@@ -2752,7 +2752,7 @@ static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
+ 
+ static struct target_type thin_target = {
+ 	.name = "thin",
+-	.version = {1, 1, 0},
++	.version = {1, 1, 1},
+ 	.module	= THIS_MODULE,
+ 	.ctr = thin_ctr,
+ 	.dtr = thin_dtr,
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index e63ca864b35a..8590d2c256a6 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -8167,7 +8167,8 @@ static int md_notify_reboot(struct notifier_block *this,
+ 		if (mddev_trylock(mddev)) {
+ 			if (mddev->pers)
+ 				__md_stop_writes(mddev);
+-			mddev->safemode = 2;
++			if (mddev->persistent)
++				mddev->safemode = 2;
+ 			mddev_unlock(mddev);
+ 		}
+ 		need_delay = 1;
+diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
+index c4f28133ef82..b88757cd0d1d 100644
+--- a/drivers/md/persistent-data/dm-btree-remove.c
++++ b/drivers/md/persistent-data/dm-btree-remove.c
+@@ -139,15 +139,8 @@ struct child {
+ 	struct btree_node *n;
+ };
+ 
+-static struct dm_btree_value_type le64_type = {
+-	.context = NULL,
+-	.size = sizeof(__le64),
+-	.inc = NULL,
+-	.dec = NULL,
+-	.equal = NULL
+-};
+-
+-static int init_child(struct dm_btree_info *info, struct btree_node *parent,
++static int init_child(struct dm_btree_info *info, struct dm_btree_value_type *vt,
++		      struct btree_node *parent,
+ 		      unsigned index, struct child *result)
+ {
+ 	int r, inc;
+@@ -164,7 +157,7 @@ static int init_child(struct dm_btree_info *info, struct btree_node *parent,
+ 	result->n = dm_block_data(result->block);
+ 
+ 	if (inc)
+-		inc_children(info->tm, result->n, &le64_type);
++		inc_children(info->tm, result->n, vt);
+ 
+ 	*((__le64 *) value_ptr(parent, index)) =
+ 		cpu_to_le64(dm_block_location(result->block));
+@@ -236,7 +229,7 @@ static void __rebalance2(struct dm_btree_info *info, struct btree_node *parent,
+ }
+ 
+ static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info,
+-		      unsigned left_index)
++		      struct dm_btree_value_type *vt, unsigned left_index)
+ {
+ 	int r;
+ 	struct btree_node *parent;
+@@ -244,11 +237,11 @@ static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info,
+ 
+ 	parent = dm_block_data(shadow_current(s));
+ 
+-	r = init_child(info, parent, left_index, &left);
++	r = init_child(info, vt, parent, left_index, &left);
+ 	if (r)
+ 		return r;
+ 
+-	r = init_child(info, parent, left_index + 1, &right);
++	r = init_child(info, vt, parent, left_index + 1, &right);
+ 	if (r) {
+ 		exit_child(info, &left);
+ 		return r;
+@@ -368,7 +361,7 @@ static void __rebalance3(struct dm_btree_info *info, struct btree_node *parent,
+ }
+ 
+ static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info,
+-		      unsigned left_index)
++		      struct dm_btree_value_type *vt, unsigned left_index)
+ {
+ 	int r;
+ 	struct btree_node *parent = dm_block_data(shadow_current(s));
+@@ -377,17 +370,17 @@ static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info,
+ 	/*
+ 	 * FIXME: fill out an array?
+ 	 */
+-	r = init_child(info, parent, left_index, &left);
++	r = init_child(info, vt, parent, left_index, &left);
+ 	if (r)
+ 		return r;
+ 
+-	r = init_child(info, parent, left_index + 1, &center);
++	r = init_child(info, vt, parent, left_index + 1, &center);
+ 	if (r) {
+ 		exit_child(info, &left);
+ 		return r;
+ 	}
+ 
+-	r = init_child(info, parent, left_index + 2, &right);
++	r = init_child(info, vt, parent, left_index + 2, &right);
+ 	if (r) {
+ 		exit_child(info, &left);
+ 		exit_child(info, &center);
+@@ -434,7 +427,8 @@ static int get_nr_entries(struct dm_transaction_manager *tm,
+ }
+ 
+ static int rebalance_children(struct shadow_spine *s,
+-			      struct dm_btree_info *info, uint64_t key)
++			      struct dm_btree_info *info,
++			      struct dm_btree_value_type *vt, uint64_t key)
+ {
+ 	int i, r, has_left_sibling, has_right_sibling;
+ 	uint32_t child_entries;
+@@ -472,13 +466,13 @@ static int rebalance_children(struct shadow_spine *s,
+ 	has_right_sibling = i < (le32_to_cpu(n->header.nr_entries) - 1);
+ 
+ 	if (!has_left_sibling)
+-		r = rebalance2(s, info, i);
++		r = rebalance2(s, info, vt, i);
+ 
+ 	else if (!has_right_sibling)
+-		r = rebalance2(s, info, i - 1);
++		r = rebalance2(s, info, vt, i - 1);
+ 
+ 	else
+-		r = rebalance3(s, info, i - 1);
++		r = rebalance3(s, info, vt, i - 1);
+ 
+ 	return r;
+ }
+@@ -529,7 +523,7 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info,
+ 		if (le32_to_cpu(n->header.flags) & LEAF_NODE)
+ 			return do_leaf(n, key, index);
+ 
+-		r = rebalance_children(s, info, key);
++		r = rebalance_children(s, info, vt, key);
+ 		if (r)
+ 			break;
+ 
+@@ -550,6 +544,14 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info,
+ 	return r;
+ }
+ 
++static struct dm_btree_value_type le64_type = {
++	.context = NULL,
++	.size = sizeof(__le64),
++	.inc = NULL,
++	.dec = NULL,
++	.equal = NULL
++};
++
+ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
+ 		    uint64_t *keys, dm_block_t *new_root)
+ {
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 67a8393e3f86..149426cd1e84 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1419,14 +1419,16 @@ static int enough(struct r10conf *conf, int ignore)
+ 	do {
+ 		int n = conf->copies;
+ 		int cnt = 0;
++		int this = first;
+ 		while (n--) {
+-			if (conf->mirrors[first].rdev &&
+-			    first != ignore)
++			if (conf->mirrors[this].rdev &&
++			    this != ignore)
+ 				cnt++;
+-			first = (first+1) % conf->raid_disks;
++			this = (this+1) % conf->raid_disks;
+ 		}
+ 		if (cnt == 0)
+ 			return 0;
++		first = (first + conf->near_copies) % conf->raid_disks;
+ 	} while (first != 0);
+ 	return 1;
+ }
+diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
+index 6f9eb94e85b3..25968dcfa422 100644
+--- a/drivers/media/media-device.c
++++ b/drivers/media/media-device.c
+@@ -90,6 +90,7 @@ static long media_device_enum_entities(struct media_device *mdev,
+ 	struct media_entity *ent;
+ 	struct media_entity_desc u_ent;
+ 
++	memset(&u_ent, 0, sizeof(u_ent));
+ 	if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id)))
+ 		return -EFAULT;
+ 
+diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
+index fffc227181b0..9c99680f645a 100644
+--- a/drivers/misc/hpilo.c
++++ b/drivers/misc/hpilo.c
+@@ -735,7 +735,14 @@ static void ilo_remove(struct pci_dev *pdev)
+ 	free_irq(pdev->irq, ilo_hw);
+ 	ilo_unmap_device(pdev, ilo_hw);
+ 	pci_release_regions(pdev);
+-	pci_disable_device(pdev);
++	/*
++	 * pci_disable_device(pdev) used to be here. But this PCI device has
++	 * two functions with interrupt lines connected to a single pin. The
++	 * other one is a USB host controller. So when we disable the PIN here
++	 * e.g. by rmmod hpilo, the controller stops working. It is because
++	 * the interrupt link is disabled in ACPI since it is not refcounted
++	 * yet. See acpi_pci_link_free_irq called from acpi_pci_irq_disable.
++	 */
+ 	kfree(ilo_hw);
+ 	ilo_hwdev[(minor / MAX_CCB)] = 0;
+ }
+@@ -820,7 +827,7 @@ unmap:
+ free_regions:
+ 	pci_release_regions(pdev);
+ disable:
+-	pci_disable_device(pdev);
++/*	pci_disable_device(pdev);  see comment in ilo_remove */
+ free:
+ 	kfree(ilo_hw);
+ out:
+diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
+index 1924d247c1cb..797860ea3e04 100644
+--- a/drivers/mtd/devices/m25p80.c
++++ b/drivers/mtd/devices/m25p80.c
+@@ -71,7 +71,7 @@
+ 
+ /* Define max times to check status register before we give up. */
+ #define	MAX_READY_WAIT_JIFFIES	(40 * HZ)	/* M25P16 specs 40s max chip erase */
+-#define	MAX_CMD_SIZE		5
++#define	MAX_CMD_SIZE		6
+ 
+ #ifdef CONFIG_M25PXX_USE_FAST_READ
+ #define OPCODE_READ 	OPCODE_FAST_READ
+@@ -843,14 +843,13 @@ static int __devinit m25p_probe(struct spi_device *spi)
+ 		}
+ 	}
+ 
+-	flash = kzalloc(sizeof *flash, GFP_KERNEL);
++	flash = devm_kzalloc(&spi->dev, sizeof(*flash), GFP_KERNEL);
+ 	if (!flash)
+ 		return -ENOMEM;
+-	flash->command = kmalloc(MAX_CMD_SIZE + FAST_READ_DUMMY_BYTE, GFP_KERNEL);
+-	if (!flash->command) {
+-		kfree(flash);
++
++	flash->command = devm_kzalloc(&spi->dev, MAX_CMD_SIZE, GFP_KERNEL);
++	if (!flash->command)
+ 		return -ENOMEM;
+-	}
+ 
+ 	flash->spi = spi;
+ 	mutex_init(&flash->lock);
+@@ -947,14 +946,10 @@ static int __devinit m25p_probe(struct spi_device *spi)
+ static int __devexit m25p_remove(struct spi_device *spi)
+ {
+ 	struct m25p	*flash = dev_get_drvdata(&spi->dev);
+-	int		status;
+ 
+ 	/* Clean up MTD stuff. */
+-	status = mtd_device_unregister(&flash->mtd);
+-	if (status == 0) {
+-		kfree(flash->command);
+-		kfree(flash);
+-	}
++	mtd_device_unregister(&flash->mtd);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
+index 12c43b44f815..4f71793f5505 100644
+--- a/drivers/mtd/ubi/scan.c
++++ b/drivers/mtd/ubi/scan.c
+@@ -997,7 +997,7 @@ static int process_eb(struct ubi_device *ubi, struct ubi_scan_info *si,
+ 			return err;
+ 		goto adjust_mean_ec;
+ 	case UBI_IO_FF:
+-		if (ec_err)
++		if (ec_err || bitflips)
+ 			err = add_to_list(si, pnum, ec, 1, &si->erase);
+ 		else
+ 			err = add_to_list(si, pnum, ec, 0, &si->free);
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 098581afdd9f..2402af322de6 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4930,6 +4930,7 @@ static int __init bonding_init(void)
+ out:
+ 	return res;
+ err:
++	bond_destroy_debugfs();
+ 	rtnl_link_unregister(&bond_link_ops);
+ err_link:
+ 	unregister_pernet_subsys(&bond_net_ops);
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 77405b4e8636..91d1b5af982b 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -446,8 +446,12 @@ static void c_can_setup_receive_object(struct net_device *dev, int iface,
+ 
+ 	priv->write_reg(priv, &priv->regs->ifregs[iface].mask1,
+ 			IFX_WRITE_LOW_16BIT(mask));
++
++	/* According to C_CAN documentation, the reserved bit
++	 * in IFx_MASK2 register is fixed 1
++	 */
+ 	priv->write_reg(priv, &priv->regs->ifregs[iface].mask2,
+-			IFX_WRITE_HIGH_16BIT(mask));
++			IFX_WRITE_HIGH_16BIT(mask) | BIT(13));
+ 
+ 	priv->write_reg(priv, &priv->regs->ifregs[iface].arb1,
+ 			IFX_WRITE_LOW_16BIT(id));
+diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
+index c2309ec71369..2d3ad72958ff 100644
+--- a/drivers/net/can/sja1000/sja1000.c
++++ b/drivers/net/can/sja1000/sja1000.c
+@@ -487,19 +487,19 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
+ 	uint8_t isrc, status;
+ 	int n = 0;
+ 
+-	/* Shared interrupts and IRQ off? */
+-	if (priv->read_reg(priv, REG_IER) == IRQ_OFF)
+-		return IRQ_NONE;
+-
+ 	if (priv->pre_irq)
+ 		priv->pre_irq(priv);
+ 
++	/* Shared interrupts and IRQ off? */
++	if (priv->read_reg(priv, REG_IER) == IRQ_OFF)
++		goto out;
++
+ 	while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
+-		n++;
++
+ 		status = priv->read_reg(priv, SJA1000_REG_SR);
+ 		/* check for absent controller due to hw unplug */
+ 		if (status == 0xFF && sja1000_is_absent(priv))
+-			return IRQ_NONE;
++			goto out;
+ 
+ 		if (isrc & IRQ_WUI)
+ 			netdev_warn(dev, "wakeup interrupt\n");
+@@ -518,7 +518,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
+ 				status = priv->read_reg(priv, SJA1000_REG_SR);
+ 				/* check for absent controller */
+ 				if (status == 0xFF && sja1000_is_absent(priv))
+-					return IRQ_NONE;
++					goto out;
+ 			}
+ 		}
+ 		if (isrc & (IRQ_DOI | IRQ_EI | IRQ_BEI | IRQ_EPI | IRQ_ALI)) {
+@@ -526,8 +526,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
+ 			if (sja1000_err(dev, isrc, status))
+ 				break;
+ 		}
++		n++;
+ 	}
+-
++out:
+ 	if (priv->post_irq)
+ 		priv->post_irq(priv);
+ 
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+index 513573321625..05ec7f1ed3f5 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+@@ -1030,9 +1030,6 @@ static void bnx2x_set_one_vlan_mac_e1h(struct bnx2x *bp,
+ 				     ETH_VLAN_FILTER_CLASSIFY, config);
+ }
+ 
+-#define list_next_entry(pos, member) \
+-	list_entry((pos)->member.next, typeof(*(pos)), member)
+-
+ /**
+  * bnx2x_vlan_mac_restore - reconfigure next MAC/VLAN/VLAN-MAC element
+  *
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 237e2a4f58c0..cbc6a62084e1 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -10861,7 +10861,9 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
+ 	if (tg3_flag(tp, MAX_RXPEND_64) &&
+ 	    tp->rx_pending > 63)
+ 		tp->rx_pending = 63;
+-	tp->rx_jumbo_pending = ering->rx_jumbo_pending;
++
++	if (tg3_flag(tp, JUMBO_RING_ENABLE))
++		tp->rx_jumbo_pending = ering->rx_jumbo_pending;
+ 
+ 	for (i = 0; i < tp->irq_max; i++)
+ 		tp->napi[i].tx_pending = ering->tx_pending;
+diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
+index 1ab8067b028b..21c058bdc1f8 100644
+--- a/drivers/net/ethernet/intel/e1000e/e1000.h
++++ b/drivers/net/ethernet/intel/e1000e/e1000.h
+@@ -309,6 +309,7 @@ struct e1000_adapter {
+ 	 */
+ 	struct e1000_ring *tx_ring /* One per active queue */
+ 						____cacheline_aligned_in_smp;
++	u32 tx_fifo_limit;
+ 
+ 	struct napi_struct napi;
+ 
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index c80b4b4e657d..e65f529b430d 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -3498,6 +3498,15 @@ void e1000e_reset(struct e1000_adapter *adapter)
+ 	}
+ 
+ 	/*
++	 * Alignment of Tx data is on an arbitrary byte boundary with the
++	 * maximum size per Tx descriptor limited only to the transmit
++	 * allocation of the packet buffer minus 96 bytes with an upper
++	 * limit of 24KB due to receive synchronization limitations.
++	 */
++	adapter->tx_fifo_limit = min_t(u32, ((er32(PBA) >> 16) << 10) - 96,
++				       24 << 10);
++
++	/*
+ 	 * Disable Adaptive Interrupt Moderation if 2 full packets cannot
+ 	 * fit in receive buffer.
+ 	 */
+@@ -4766,12 +4775,9 @@ static bool e1000_tx_csum(struct e1000_ring *tx_ring, struct sk_buff *skb)
+ 	return 1;
+ }
+ 
+-#define E1000_MAX_PER_TXD	8192
+-#define E1000_MAX_TXD_PWR	12
+-
+ static int e1000_tx_map(struct e1000_ring *tx_ring, struct sk_buff *skb,
+ 			unsigned int first, unsigned int max_per_txd,
+-			unsigned int nr_frags, unsigned int mss)
++			unsigned int nr_frags)
+ {
+ 	struct e1000_adapter *adapter = tx_ring->adapter;
+ 	struct pci_dev *pdev = adapter->pdev;
+@@ -5004,20 +5010,19 @@ static int __e1000_maybe_stop_tx(struct e1000_ring *tx_ring, int size)
+ 
+ static int e1000_maybe_stop_tx(struct e1000_ring *tx_ring, int size)
+ {
++	BUG_ON(size > tx_ring->count);
++
+ 	if (e1000_desc_unused(tx_ring) >= size)
+ 		return 0;
+ 	return __e1000_maybe_stop_tx(tx_ring, size);
+ }
+ 
+-#define TXD_USE_COUNT(S, X) (((S) >> (X)) + 1)
+ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
+ 				    struct net_device *netdev)
+ {
+ 	struct e1000_adapter *adapter = netdev_priv(netdev);
+ 	struct e1000_ring *tx_ring = adapter->tx_ring;
+ 	unsigned int first;
+-	unsigned int max_per_txd = E1000_MAX_PER_TXD;
+-	unsigned int max_txd_pwr = E1000_MAX_TXD_PWR;
+ 	unsigned int tx_flags = 0;
+ 	unsigned int len = skb_headlen(skb);
+ 	unsigned int nr_frags;
+@@ -5037,18 +5042,8 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
+ 	}
+ 
+ 	mss = skb_shinfo(skb)->gso_size;
+-	/*
+-	 * The controller does a simple calculation to
+-	 * make sure there is enough room in the FIFO before
+-	 * initiating the DMA for each buffer.  The calc is:
+-	 * 4 = ceil(buffer len/mss).  To make sure we don't
+-	 * overrun the FIFO, adjust the max buffer len if mss
+-	 * drops.
+-	 */
+ 	if (mss) {
+ 		u8 hdr_len;
+-		max_per_txd = min(mss << 2, max_per_txd);
+-		max_txd_pwr = fls(max_per_txd) - 1;
+ 
+ 		/*
+ 		 * TSO Workaround for 82571/2/3 Controllers -- if skb->data
+@@ -5078,12 +5073,12 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
+ 		count++;
+ 	count++;
+ 
+-	count += TXD_USE_COUNT(len, max_txd_pwr);
++	count += DIV_ROUND_UP(len, adapter->tx_fifo_limit);
+ 
+ 	nr_frags = skb_shinfo(skb)->nr_frags;
+ 	for (f = 0; f < nr_frags; f++)
+-		count += TXD_USE_COUNT(skb_frag_size(&skb_shinfo(skb)->frags[f]),
+-				       max_txd_pwr);
++		count += DIV_ROUND_UP(skb_frag_size(&skb_shinfo(skb)->frags[f]),
++				      adapter->tx_fifo_limit);
+ 
+ 	if (adapter->hw.mac.tx_pkt_filtering)
+ 		e1000_transfer_dhcp_info(adapter, skb);
+@@ -5125,13 +5120,16 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
+ 		tx_flags |= E1000_TX_FLAGS_NO_FCS;
+ 
+ 	/* if count is 0 then mapping error has occurred */
+-	count = e1000_tx_map(tx_ring, skb, first, max_per_txd, nr_frags, mss);
++	count = e1000_tx_map(tx_ring, skb, first, adapter->tx_fifo_limit,
++			     nr_frags);
+ 	if (count) {
+ 		netdev_sent_queue(netdev, skb->len);
+ 		e1000_tx_queue(tx_ring, tx_flags, count);
+ 		/* Make sure there is space in the ring for the next send. */
+-		e1000_maybe_stop_tx(tx_ring, MAX_SKB_FRAGS + 2);
+-
++		e1000_maybe_stop_tx(tx_ring,
++				    (MAX_SKB_FRAGS *
++				     DIV_ROUND_UP(PAGE_SIZE,
++						  adapter->tx_fifo_limit) + 2));
+ 	} else {
+ 		dev_kfree_skb_any(skb);
+ 		tx_ring->buffer_info[first].time_stamp = 0;
+@@ -6303,8 +6301,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
+ 	adapter->hw.phy.autoneg_advertised = 0x2f;
+ 
+ 	/* ring size defaults */
+-	adapter->rx_ring->count = 256;
+-	adapter->tx_ring->count = 256;
++	adapter->rx_ring->count = E1000_DEFAULT_RXD;
++	adapter->tx_ring->count = E1000_DEFAULT_TXD;
+ 
+ 	/*
+ 	 * Initial Wake on LAN setting - If APM wake is enabled in
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 8f9554596c1e..861140975f08 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -7464,12 +7464,15 @@ static int __init ixgbe_init_module(void)
+ 	pr_info("%s - version %s\n", ixgbe_driver_string, ixgbe_driver_version);
+ 	pr_info("%s\n", ixgbe_copyright);
+ 
++	ret = pci_register_driver(&ixgbe_driver);
++	if (ret)
++		return ret;
++
+ #ifdef CONFIG_IXGBE_DCA
+ 	dca_register_notify(&dca_notifier);
+ #endif
+ 
+-	ret = pci_register_driver(&ixgbe_driver);
+-	return ret;
++	return 0;
+ }
+ 
+ module_init(ixgbe_init_module);
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 71605231bcb2..c4bb95b051f3 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -237,11 +237,9 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	const struct macvlan_dev *vlan = netdev_priv(dev);
+ 	const struct macvlan_port *port = vlan->port;
+ 	const struct macvlan_dev *dest;
+-	__u8 ip_summed = skb->ip_summed;
+ 
+ 	if (vlan->mode == MACVLAN_MODE_BRIDGE) {
+ 		const struct ethhdr *eth = (void *)skb->data;
+-		skb->ip_summed = CHECKSUM_UNNECESSARY;
+ 
+ 		/* send to other bridge ports directly */
+ 		if (is_multicast_ether_addr(eth->h_dest)) {
+@@ -259,7 +257,6 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	}
+ 
+ xmit_world:
+-	skb->ip_summed = ip_summed;
+ 	skb->dev = vlan->lowerdev;
+ 	return dev_queue_xmit(skb);
+ }
+diff --git a/drivers/net/wimax/i2400m/usb-rx.c b/drivers/net/wimax/i2400m/usb-rx.c
+index e3257681e360..b78ee676e102 100644
+--- a/drivers/net/wimax/i2400m/usb-rx.c
++++ b/drivers/net/wimax/i2400m/usb-rx.c
+@@ -277,7 +277,7 @@ retry:
+ 		d_printf(1, dev, "RX: size changed to %d, received %d, "
+ 			 "copied %d, capacity %ld\n",
+ 			 rx_size, read_size, rx_skb->len,
+-			 (long) (skb_end_pointer(new_skb) - new_skb->head));
++			 (long) skb_end_offset(new_skb));
+ 		goto retry;
+ 	}
+ 		/* In most cases, it happens due to the hardware scheduling a
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 3d0aa4723ff9..1a5f275f8d6b 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -1242,14 +1242,16 @@ void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc,
+ 	for (tidno = 0, tid = &an->tid[tidno];
+ 	     tidno < WME_NUM_TID; tidno++, tid++) {
+ 
+-		if (!tid->sched)
+-			continue;
+-
+ 		ac = tid->ac;
+ 		txq = ac->txq;
+ 
+ 		ath_txq_lock(sc, txq);
+ 
++		if (!tid->sched) {
++			ath_txq_unlock(sc, txq);
++			continue;
++		}
++
+ 		buffered = !skb_queue_empty(&tid->buf_q);
+ 
+ 		tid->sched = false;
+diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
+index 3876c7ea54f4..af40211cc9dd 100644
+--- a/drivers/net/wireless/b43/Kconfig
++++ b/drivers/net/wireless/b43/Kconfig
+@@ -28,7 +28,7 @@ config B43
+ 
+ config B43_BCMA
+ 	bool "Support for BCMA bus"
+-	depends on B43 && BCMA
++	depends on B43 && (BCMA = y || BCMA = B43)
+ 	default y
+ 
+ config B43_BCMA_EXTRA
+@@ -39,7 +39,7 @@ config B43_BCMA_EXTRA
+ 
+ config B43_SSB
+ 	bool
+-	depends on B43 && SSB
++	depends on B43 && (SSB = y || SSB = B43)
+ 	default y
+ 
+ # Auto-select SSB PCI-HOST support, if possible
+diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
+index e0a7efccb73b..9e55debc3e52 100644
+--- a/drivers/net/wireless/rt2x00/rt2500usb.c
++++ b/drivers/net/wireless/rt2x00/rt2500usb.c
+@@ -1921,7 +1921,7 @@ static struct usb_device_id rt2500usb_device_table[] = {
+ 	{ USB_DEVICE(0x0b05, 0x1706) },
+ 	{ USB_DEVICE(0x0b05, 0x1707) },
+ 	/* Belkin */
+-	{ USB_DEVICE(0x050d, 0x7050) },
++	{ USB_DEVICE(0x050d, 0x7050) },	/* FCC ID: K7SF5D7050A ver. 2.x */
+ 	{ USB_DEVICE(0x050d, 0x7051) },
+ 	/* Cisco Systems */
+ 	{ USB_DEVICE(0x13b1, 0x000d) },
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index 6eec862fea28..664e93d2a682 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -1009,6 +1009,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x07d1, 0x3c15) },
+ 	{ USB_DEVICE(0x07d1, 0x3c16) },
+ 	{ USB_DEVICE(0x2001, 0x3c1b) },
++	{ USB_DEVICE(0x2001, 0x3c1e) },
+ 	/* Draytek */
+ 	{ USB_DEVICE(0x07fa, 0x7712) },
+ 	/* DVICO */
+@@ -1140,6 +1141,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x177f, 0x0153) },
+ 	{ USB_DEVICE(0x177f, 0x0302) },
+ 	{ USB_DEVICE(0x177f, 0x0313) },
++	{ USB_DEVICE(0x177f, 0x0323) },
+ 	/* U-Media */
+ 	{ USB_DEVICE(0x157e, 0x300e) },
+ 	{ USB_DEVICE(0x157e, 0x3013) },
+diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
+index 6701f2d71274..af247b06c842 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
+@@ -651,20 +651,18 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
+ 				      bss_conf->bssid);
+ 
+ 	/*
+-	 * Update the beacon. This is only required on USB devices. PCI
+-	 * devices fetch beacons periodically.
+-	 */
+-	if (changes & BSS_CHANGED_BEACON && rt2x00_is_usb(rt2x00dev))
+-		rt2x00queue_update_beacon(rt2x00dev, vif);
+-
+-	/*
+ 	 * Start/stop beaconing.
+ 	 */
+ 	if (changes & BSS_CHANGED_BEACON_ENABLED) {
+ 		if (!bss_conf->enable_beacon && intf->enable_beacon) {
+-			rt2x00queue_clear_beacon(rt2x00dev, vif);
+ 			rt2x00dev->intf_beaconing--;
+ 			intf->enable_beacon = false;
++			/*
++			 * Clear beacon in the H/W for this vif. This is needed
++			 * to disable beaconing on this particular interface
++			 * and keep it running on other interfaces.
++			 */
++			rt2x00queue_clear_beacon(rt2x00dev, vif);
+ 
+ 			if (rt2x00dev->intf_beaconing == 0) {
+ 				/*
+@@ -675,11 +673,15 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
+ 				rt2x00queue_stop_queue(rt2x00dev->bcn);
+ 				mutex_unlock(&intf->beacon_skb_mutex);
+ 			}
+-
+-
+ 		} else if (bss_conf->enable_beacon && !intf->enable_beacon) {
+ 			rt2x00dev->intf_beaconing++;
+ 			intf->enable_beacon = true;
++			/*
++			 * Upload beacon to the H/W. This is only required on
++			 * USB devices. PCI devices fetch beacons periodically.
++			 */
++			if (rt2x00_is_usb(rt2x00dev))
++				rt2x00queue_update_beacon(rt2x00dev, vif);
+ 
+ 			if (rt2x00dev->intf_beaconing == 1) {
+ 				/*
+diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
+index ffdd32e74b0b..ef4cd40aef39 100644
+--- a/drivers/net/wireless/rt2x00/rt73usb.c
++++ b/drivers/net/wireless/rt2x00/rt73usb.c
+@@ -2422,6 +2422,7 @@ static struct usb_device_id rt73usb_device_table[] = {
+ 	{ USB_DEVICE(0x0b05, 0x1723) },
+ 	{ USB_DEVICE(0x0b05, 0x1724) },
+ 	/* Belkin */
++	{ USB_DEVICE(0x050d, 0x7050) },	/* FCC ID: K7SF5D7050B ver. 3.x */
+ 	{ USB_DEVICE(0x050d, 0x705a) },
+ 	{ USB_DEVICE(0x050d, 0x905b) },
+ 	{ USB_DEVICE(0x050d, 0x905c) },
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+index a4387acbf220..0908a3bf2f68 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+@@ -1001,7 +1001,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
+ 	err = _rtl92cu_init_mac(hw);
+ 	if (err) {
+ 		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "init mac failed!\n");
+-		return err;
++		goto exit;
+ 	}
+ 	err = rtl92c_download_fw(hw);
+ 	if (err) {
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 796afbf13eb4..fe50f14fba4e 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -36,7 +36,7 @@
+ #include <linux/skbuff.h>
+ #include <linux/ethtool.h>
+ #include <linux/if_ether.h>
+-#include <linux/tcp.h>
++#include <net/tcp.h>
+ #include <linux/udp.h>
+ #include <linux/moduleparam.h>
+ #include <linux/mm.h>
+@@ -492,6 +492,16 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	unsigned int len = skb_headlen(skb);
+ 	unsigned long flags;
+ 
++	/* If skb->len is too big for wire format, drop skb and alert
++	 * user about misconfiguration.
++	 */
++	if (unlikely(skb->len > XEN_NETIF_MAX_TX_SIZE)) {
++		net_alert_ratelimited(
++			"xennet: skb->len = %u, too big for wire format\n",
++			skb->len);
++		goto drop;
++	}
++
+ 	frags += DIV_ROUND_UP(offset + len, PAGE_SIZE);
+ 	if (unlikely(frags > MAX_SKB_FRAGS + 1)) {
+ 		printk(KERN_ALERT "xennet: skb rides the rocket: %d frags\n",
+@@ -1045,7 +1055,8 @@ err:
+ 
+ static int xennet_change_mtu(struct net_device *dev, int mtu)
+ {
+-	int max = xennet_can_sg(dev) ? 65535 - ETH_HLEN : ETH_DATA_LEN;
++	int max = xennet_can_sg(dev) ?
++		XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER : ETH_DATA_LEN;
+ 
+ 	if (mtu > max)
+ 		return -EINVAL;
+@@ -1349,6 +1360,8 @@ static struct net_device * __devinit xennet_create_dev(struct xenbus_device *dev
+ 	SET_ETHTOOL_OPS(netdev, &xennet_ethtool_ops);
+ 	SET_NETDEV_DEV(netdev, &dev->dev);
+ 
++	netif_set_gso_max_size(netdev, XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER);
++
+ 	np->netdev = netdev;
+ 
+ 	netif_carrier_off(netdev);
+diff --git a/drivers/pci/hotplug/shpchp.h b/drivers/pci/hotplug/shpchp.h
+index 1b69d955a31f..b849f995075a 100644
+--- a/drivers/pci/hotplug/shpchp.h
++++ b/drivers/pci/hotplug/shpchp.h
+@@ -46,7 +46,6 @@
+ extern bool shpchp_poll_mode;
+ extern int shpchp_poll_time;
+ extern bool shpchp_debug;
+-extern struct workqueue_struct *shpchp_wq;
+ 
+ #define dbg(format, arg...)						\
+ do {									\
+@@ -90,6 +89,7 @@ struct slot {
+ 	struct list_head	slot_list;
+ 	struct delayed_work work;	/* work for button event */
+ 	struct mutex lock;
++	struct workqueue_struct *wq;
+ 	u8 hp_slot;
+ };
+ 
+diff --git a/drivers/pci/hotplug/shpchp_core.c b/drivers/pci/hotplug/shpchp_core.c
+index 5f1f0d93dc13..dd37452cca5e 100644
+--- a/drivers/pci/hotplug/shpchp_core.c
++++ b/drivers/pci/hotplug/shpchp_core.c
+@@ -39,7 +39,6 @@
+ bool shpchp_debug;
+ bool shpchp_poll_mode;
+ int shpchp_poll_time;
+-struct workqueue_struct *shpchp_wq;
+ 
+ #define DRIVER_VERSION	"0.4"
+ #define DRIVER_AUTHOR	"Dan Zink <dan.zink@××××××.com>, Greg Kroah-Hartman <greg@×××××.com>, Dely Sy <dely.l.sy@×××××.com>"
+@@ -122,6 +121,14 @@ static int init_slots(struct controller *ctrl)
+ 		slot->device = ctrl->slot_device_offset + i;
+ 		slot->hpc_ops = ctrl->hpc_ops;
+ 		slot->number = ctrl->first_slot + (ctrl->slot_num_inc * i);
++
++		snprintf(name, sizeof(name), "shpchp-%d", slot->number);
++		slot->wq = alloc_workqueue(name, 0, 0);
++		if (!slot->wq) {
++			retval = -ENOMEM;
++			goto error_info;
++		}
++
+ 		mutex_init(&slot->lock);
+ 		INIT_DELAYED_WORK(&slot->work, shpchp_queue_pushbutton_work);
+ 
+@@ -141,7 +148,7 @@ static int init_slots(struct controller *ctrl)
+ 		if (retval) {
+ 			ctrl_err(ctrl, "pci_hp_register failed with error %d\n",
+ 				 retval);
+-			goto error_info;
++			goto error_slotwq;
+ 		}
+ 
+ 		get_power_status(hotplug_slot, &info->power_status);
+@@ -153,6 +160,8 @@ static int init_slots(struct controller *ctrl)
+ 	}
+ 
+ 	return 0;
++error_slotwq:
++	destroy_workqueue(slot->wq);
+ error_info:
+ 	kfree(info);
+ error_hpslot:
+@@ -173,7 +182,7 @@ void cleanup_slots(struct controller *ctrl)
+ 		slot = list_entry(tmp, struct slot, slot_list);
+ 		list_del(&slot->slot_list);
+ 		cancel_delayed_work(&slot->work);
+-		flush_workqueue(shpchp_wq);
++		destroy_workqueue(slot->wq);
+ 		pci_hp_deregister(slot->hotplug_slot);
+ 	}
+ }
+@@ -356,18 +365,12 @@ static struct pci_driver shpc_driver = {
+ 
+ static int __init shpcd_init(void)
+ {
+-	int retval = 0;
+-
+-	shpchp_wq = alloc_ordered_workqueue("shpchp", 0);
+-	if (!shpchp_wq)
+-		return -ENOMEM;
++	int retval;
+ 
+ 	retval = pci_register_driver(&shpc_driver);
+ 	dbg("%s: pci_register_driver = %d\n", __func__, retval);
+ 	info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
+-	if (retval) {
+-		destroy_workqueue(shpchp_wq);
+-	}
++
+ 	return retval;
+ }
+ 
+@@ -375,7 +378,6 @@ static void __exit shpcd_cleanup(void)
+ {
+ 	dbg("unload_shpchpd()\n");
+ 	pci_unregister_driver(&shpc_driver);
+-	destroy_workqueue(shpchp_wq);
+ 	info(DRIVER_DESC " version: " DRIVER_VERSION " unloaded\n");
+ }
+ 
+diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
+index bba5b3e0bf8a..b888675a228a 100644
+--- a/drivers/pci/hotplug/shpchp_ctrl.c
++++ b/drivers/pci/hotplug/shpchp_ctrl.c
+@@ -51,7 +51,7 @@ static int queue_interrupt_event(struct slot *p_slot, u32 event_type)
+ 	info->p_slot = p_slot;
+ 	INIT_WORK(&info->work, interrupt_event_handler);
+ 
+-	queue_work(shpchp_wq, &info->work);
++	queue_work(p_slot->wq, &info->work);
+ 
+ 	return 0;
+ }
+@@ -285,8 +285,8 @@ static int board_added(struct slot *p_slot)
+ 		return WRONG_BUS_FREQUENCY;
+ 	}
+ 
+-	bsp = ctrl->pci_dev->bus->cur_bus_speed;
+-	msp = ctrl->pci_dev->bus->max_bus_speed;
++	bsp = ctrl->pci_dev->subordinate->cur_bus_speed;
++	msp = ctrl->pci_dev->subordinate->max_bus_speed;
+ 
+ 	/* Check if there are other slots or devices on the same bus */
+ 	if (!list_empty(&ctrl->pci_dev->subordinate->devices))
+@@ -456,7 +456,7 @@ void shpchp_queue_pushbutton_work(struct work_struct *work)
+ 		kfree(info);
+ 		goto out;
+ 	}
+-	queue_work(shpchp_wq, &info->work);
++	queue_work(p_slot->wq, &info->work);
+  out:
+ 	mutex_unlock(&p_slot->lock);
+ }
+@@ -504,7 +504,7 @@ static void handle_button_press_event(struct slot *p_slot)
+ 		p_slot->hpc_ops->green_led_blink(p_slot);
+ 		p_slot->hpc_ops->set_attention_status(p_slot, 0);
+ 
+-		queue_delayed_work(shpchp_wq, &p_slot->work, 5*HZ);
++		queue_delayed_work(p_slot->wq, &p_slot->work, 5*HZ);
+ 		break;
+ 	case BLINKINGOFF_STATE:
+ 	case BLINKINGON_STATE:
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 474f22f304e4..c9ce611d46bd 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -583,6 +583,9 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev)
+ 	struct pcie_link_state *link;
+ 	int blacklist = !!pcie_aspm_sanity_check(pdev);
+ 
++	if (!aspm_support_enabled)
++		return;
++
+ 	if (!pci_is_pcie(pdev) || pdev->link_state)
+ 		return;
+ 	if (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT &&
+diff --git a/drivers/platform/x86/msi-wmi.c b/drivers/platform/x86/msi-wmi.c
+index 2264331bd48e..b96766b61ea3 100644
+--- a/drivers/platform/x86/msi-wmi.c
++++ b/drivers/platform/x86/msi-wmi.c
+@@ -176,7 +176,7 @@ static void msi_wmi_notify(u32 value, void *context)
+ 				pr_debug("Suppressed key event 0x%X - "
+ 					 "Last press was %lld us ago\n",
+ 					 key->code, ktime_to_us(diff));
+-				return;
++				goto msi_wmi_notify_exit;
+ 			}
+ 			last_pressed[key->code - SCANCODE_BASE] = cur;
+ 
+@@ -195,6 +195,8 @@ static void msi_wmi_notify(u32 value, void *context)
+ 			pr_info("Unknown key pressed - %x\n", eventcode);
+ 	} else
+ 		pr_info("Unknown event received\n");
++
++msi_wmi_notify_exit:
+ 	kfree(response.pointer);
+ }
+ 
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index f08aee680f0a..aa232de6d48d 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -3402,7 +3402,7 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
+ 	/* Do not issue duplicate brightness change events to
+ 	 * userspace. tpacpi_detect_brightness_capabilities() must have
+ 	 * been called before this point  */
+-	if (tp_features.bright_acpimode && acpi_video_backlight_support()) {
++	if (acpi_video_backlight_support()) {
+ 		pr_info("This ThinkPad has standard ACPI backlight "
+ 			"brightness control, supported by the ACPI "
+ 			"video driver\n");
+diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
+index 33471e11a738..84eab3fa9bca 100644
+--- a/drivers/rapidio/devices/tsi721.c
++++ b/drivers/rapidio/devices/tsi721.c
+@@ -475,6 +475,10 @@ static irqreturn_t tsi721_irqhandler(int irq, void *ptr)
+ 	u32 intval;
+ 	u32 ch_inte;
+ 
++	/* For MSI mode disable all device-level interrupts */
++	if (priv->flags & TSI721_USING_MSI)
++		iowrite32(0, priv->regs + TSI721_DEV_INTE);
++
+ 	dev_int = ioread32(priv->regs + TSI721_DEV_INT);
+ 	if (!dev_int)
+ 		return IRQ_NONE;
+@@ -548,6 +552,13 @@ static irqreturn_t tsi721_irqhandler(int irq, void *ptr)
+ 			tsi721_pw_handler(mport);
+ 	}
+ 
++	/* For MSI mode re-enable device-level interrupts */
++	if (priv->flags & TSI721_USING_MSI) {
++		dev_int = TSI721_DEV_INT_SR2PC_CH | TSI721_DEV_INT_SRIO |
++			TSI721_DEV_INT_SMSG_CH;
++		iowrite32(dev_int, priv->regs + TSI721_DEV_INTE);
++	}
++
+ 	return IRQ_HANDLED;
+ }
+ 
+diff --git a/drivers/regulator/max8997.c b/drivers/regulator/max8997.c
+index 17a58c56eebf..8350f50bb062 100644
+--- a/drivers/regulator/max8997.c
++++ b/drivers/regulator/max8997.c
+@@ -71,26 +71,26 @@ struct voltage_map_desc {
+ 	unsigned int n_bits;
+ };
+ 
+-/* Voltage maps in mV */
++/* Voltage maps in uV */
+ static const struct voltage_map_desc ldo_voltage_map_desc = {
+-	.min = 800,	.max = 3950,	.step = 50,	.n_bits = 6,
++	.min = 800000,	.max = 3950000,	.step = 50000,	.n_bits = 6,
+ }; /* LDO1 ~ 18, 21 all */
+ 
+ static const struct voltage_map_desc buck1245_voltage_map_desc = {
+-	.min = 650,	.max = 2225,	.step = 25,	.n_bits = 6,
++	.min = 650000,	.max = 2225000,	.step = 25000,	.n_bits = 6,
+ }; /* Buck1, 2, 4, 5 */
+ 
+ static const struct voltage_map_desc buck37_voltage_map_desc = {
+-	.min = 750,	.max = 3900,	.step = 50,	.n_bits = 6,
++	.min = 750000,	.max = 3900000,	.step = 50000,	.n_bits = 6,
+ }; /* Buck3, 7 */
+ 
+-/* current map in mA */
++/* current map in uA */
+ static const struct voltage_map_desc charger_current_map_desc = {
+-	.min = 200,	.max = 950,	.step = 50,	.n_bits = 4,
++	.min = 200000,	.max = 950000,	.step = 50000,	.n_bits = 4,
+ };
+ 
+ static const struct voltage_map_desc topoff_current_map_desc = {
+-	.min = 50,	.max = 200,	.step = 10,	.n_bits = 4,
++	.min = 50000,	.max = 200000,	.step = 10000,	.n_bits = 4,
+ };
+ 
+ static const struct voltage_map_desc *reg_voltage_map[] = {
+@@ -194,7 +194,7 @@ static int max8997_list_voltage(struct regulator_dev *rdev,
+ 	if (val > desc->max)
+ 		return -EINVAL;
+ 
+-	return val * 1000;
++	return val;
+ }
+ 
+ static int max8997_get_enable_register(struct regulator_dev *rdev,
+@@ -496,7 +496,6 @@ static int max8997_set_voltage_ldobuck(struct regulator_dev *rdev,
+ {
+ 	struct max8997_data *max8997 = rdev_get_drvdata(rdev);
+ 	struct i2c_client *i2c = max8997->iodev->i2c;
+-	int min_vol = min_uV / 1000, max_vol = max_uV / 1000;
+ 	const struct voltage_map_desc *desc;
+ 	int rid = rdev_get_id(rdev);
+ 	int reg, shift = 0, mask, ret;
+@@ -522,7 +521,7 @@ static int max8997_set_voltage_ldobuck(struct regulator_dev *rdev,
+ 
+ 	desc = reg_voltage_map[rid];
+ 
+-	i = max8997_get_voltage_proper_val(desc, min_vol, max_vol);
++	i = max8997_get_voltage_proper_val(desc, min_uV, max_uV);
+ 	if (i < 0)
+ 		return i;
+ 
+@@ -541,7 +540,7 @@ static int max8997_set_voltage_ldobuck(struct regulator_dev *rdev,
+ 		/* If the voltage is increasing */
+ 		if (org < i)
+ 			udelay(DIV_ROUND_UP(desc->step * (i - org),
+-						max8997->ramp_delay));
++						max8997->ramp_delay * 1000));
+ 	}
+ 
+ 	return ret;
+@@ -640,7 +639,6 @@ static int max8997_set_voltage_buck(struct regulator_dev *rdev,
+ 	const struct voltage_map_desc *desc;
+ 	int new_val, new_idx, damage, tmp_val, tmp_idx, tmp_dmg;
+ 	bool gpio_dvs_mode = false;
+-	int min_vol = min_uV / 1000, max_vol = max_uV / 1000;
+ 
+ 	if (rid < MAX8997_BUCK1 || rid > MAX8997_BUCK7)
+ 		return -EINVAL;
+@@ -665,7 +663,7 @@ static int max8997_set_voltage_buck(struct regulator_dev *rdev,
+ 						selector);
+ 
+ 	desc = reg_voltage_map[rid];
+-	new_val = max8997_get_voltage_proper_val(desc, min_vol, max_vol);
++	new_val = max8997_get_voltage_proper_val(desc, min_uV, max_uV);
+ 	if (new_val < 0)
+ 		return new_val;
+ 
+@@ -997,8 +995,8 @@ static __devinit int max8997_pmic_probe(struct platform_device *pdev)
+ 		max8997->buck1_vol[i] = ret =
+ 			max8997_get_voltage_proper_val(
+ 					&buck1245_voltage_map_desc,
+-					pdata->buck1_voltage[i] / 1000,
+-					pdata->buck1_voltage[i] / 1000 +
++					pdata->buck1_voltage[i],
++					pdata->buck1_voltage[i] +
+ 					buck1245_voltage_map_desc.step);
+ 		if (ret < 0)
+ 			goto err_alloc;
+@@ -1006,8 +1004,8 @@ static __devinit int max8997_pmic_probe(struct platform_device *pdev)
+ 		max8997->buck2_vol[i] = ret =
+ 			max8997_get_voltage_proper_val(
+ 					&buck1245_voltage_map_desc,
+-					pdata->buck2_voltage[i] / 1000,
+-					pdata->buck2_voltage[i] / 1000 +
++					pdata->buck2_voltage[i],
++					pdata->buck2_voltage[i] +
+ 					buck1245_voltage_map_desc.step);
+ 		if (ret < 0)
+ 			goto err_alloc;
+@@ -1015,8 +1013,8 @@ static __devinit int max8997_pmic_probe(struct platform_device *pdev)
+ 		max8997->buck5_vol[i] = ret =
+ 			max8997_get_voltage_proper_val(
+ 					&buck1245_voltage_map_desc,
+-					pdata->buck5_voltage[i] / 1000,
+-					pdata->buck5_voltage[i] / 1000 +
++					pdata->buck5_voltage[i],
++					pdata->buck5_voltage[i] +
+ 					buck1245_voltage_map_desc.step);
+ 		if (ret < 0)
+ 			goto err_alloc;
+diff --git a/drivers/regulator/max8998.c b/drivers/regulator/max8998.c
+index 5890265eeacc..130038368b73 100644
+--- a/drivers/regulator/max8998.c
++++ b/drivers/regulator/max8998.c
+@@ -492,7 +492,7 @@ buck2_exit:
+ 
+ 	difference = desc->min + desc->step*i - previous_vol/1000;
+ 	if (difference > 0)
+-		udelay(difference / ((val & 0x0f) + 1));
++		udelay(DIV_ROUND_UP(difference, (val & 0x0f) + 1));
+ 
+ 	return ret;
+ }
+diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c
+index f027c063fb20..65ef56fb9a66 100644
+--- a/drivers/rtc/rtc-pl031.c
++++ b/drivers/rtc/rtc-pl031.c
+@@ -44,6 +44,7 @@
+ #define RTC_YMR		0x34	/* Year match register */
+ #define RTC_YLR		0x38	/* Year data load register */
+ 
++#define RTC_CR_EN	(1 << 0)	/* counter enable bit */
+ #define RTC_CR_CWEN	(1 << 26)	/* Clockwatch enable bit */
+ 
+ #define RTC_TCR_EN	(1 << 1) /* Periodic timer enable bit */
+@@ -312,7 +313,7 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
+ 	int ret;
+ 	struct pl031_local *ldata;
+ 	struct rtc_class_ops *ops = id->data;
+-	unsigned long time;
++	unsigned long time, data;
+ 
+ 	ret = amba_request_regions(adev, NULL);
+ 	if (ret)
+@@ -339,10 +340,13 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
+ 	dev_dbg(&adev->dev, "designer ID = 0x%02x\n", ldata->hw_designer);
+ 	dev_dbg(&adev->dev, "revision = 0x%01x\n", ldata->hw_revision);
+ 
++	data = readl(ldata->base + RTC_CR);
+ 	/* Enable the clockwatch on ST Variants */
+ 	if (ldata->hw_designer == AMBA_VENDOR_ST)
+-		writel(readl(ldata->base + RTC_CR) | RTC_CR_CWEN,
+-		       ldata->base + RTC_CR);
++		data |= RTC_CR_CWEN;
++	else
++		data |= RTC_CR_EN;
++	writel(data, ldata->base + RTC_CR);
+ 
+ 	/*
+ 	 * On ST PL031 variants, the RTC reset value does not provide correct
+diff --git a/drivers/staging/octeon/ethernet-tx.c b/drivers/staging/octeon/ethernet-tx.c
+index 91a97b3e45c6..5877b2c64e2a 100644
+--- a/drivers/staging/octeon/ethernet-tx.c
++++ b/drivers/staging/octeon/ethernet-tx.c
+@@ -345,7 +345,7 @@ int cvm_oct_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	}
+ 	if (unlikely
+ 	    (skb->truesize !=
+-	     sizeof(*skb) + skb_end_pointer(skb) - skb->head)) {
++	     sizeof(*skb) + skb_end_offset(skb))) {
+ 		/*
+ 		   printk("TX buffer truesize has been changed\n");
+ 		 */
+diff --git a/drivers/staging/speakup/speakup_soft.c b/drivers/staging/speakup/speakup_soft.c
+index b5130c8bcb64..e2f5c81e7548 100644
+--- a/drivers/staging/speakup/speakup_soft.c
++++ b/drivers/staging/speakup/speakup_soft.c
+@@ -46,7 +46,7 @@ static int misc_registered;
+ static struct var_t vars[] = {
+ 	{ CAPS_START, .u.s = {"\x01+3p" } },
+ 	{ CAPS_STOP, .u.s = {"\x01-3p" } },
+-	{ RATE, .u.n = {"\x01%ds", 5, 0, 9, 0, 0, NULL } },
++	{ RATE, .u.n = {"\x01%ds", 2, 0, 9, 0, 0, NULL } },
+ 	{ PITCH, .u.n = {"\x01%dp", 5, 0, 9, 0, 0, NULL } },
+ 	{ VOL, .u.n = {"\x01%dv", 5, 0, 9, 0, 0, NULL } },
+ 	{ TONE, .u.n = {"\x01%dx", 1, 0, 2, 0, 0, NULL } },
+diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
+index 685d612a627b..cdac567dc4eb 100644
+--- a/drivers/staging/zram/zram_drv.c
++++ b/drivers/staging/zram/zram_drv.c
+@@ -235,7 +235,7 @@ static int zram_bvec_read(struct zram *zram, struct bio_vec *bvec,
+ 
+ 	if (is_partial_io(bvec)) {
+ 		/* Use  a temporary buffer to decompress the page */
+-		uncmem = kmalloc(PAGE_SIZE, GFP_KERNEL);
++		uncmem = kmalloc(PAGE_SIZE, GFP_NOIO);
+ 		if (!uncmem) {
+ 			pr_info("Error allocating temp memory!\n");
+ 			return -ENOMEM;
+@@ -330,7 +330,7 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
+ 		 * This is a partial IO. We need to read the full page
+ 		 * before to write the changes.
+ 		 */
+-		uncmem = kmalloc(PAGE_SIZE, GFP_KERNEL);
++		uncmem = kmalloc(PAGE_SIZE, GFP_NOIO);
+ 		if (!uncmem) {
+ 			pr_info("Error allocating temp memory!\n");
+ 			ret = -ENOMEM;
+@@ -535,13 +535,20 @@ out:
+  */
+ static inline int valid_io_request(struct zram *zram, struct bio *bio)
+ {
+-	if (unlikely(
+-		(bio->bi_sector >= (zram->disksize >> SECTOR_SHIFT)) ||
+-		(bio->bi_sector & (ZRAM_SECTOR_PER_LOGICAL_BLOCK - 1)) ||
+-		(bio->bi_size & (ZRAM_LOGICAL_BLOCK_SIZE - 1)))) {
++	u64 start, end, bound;
+ 
++	/* unaligned request */
++	if (unlikely(bio->bi_sector & (ZRAM_SECTOR_PER_LOGICAL_BLOCK - 1)))
++		return 0;
++	if (unlikely(bio->bi_size & (ZRAM_LOGICAL_BLOCK_SIZE - 1)))
++		return 0;
++
++	start = bio->bi_sector;
++	end = start + (bio->bi_size >> SECTOR_SHIFT);
++	bound = zram->disksize >> SECTOR_SHIFT;
++	/* out of range range */
++	if (unlikely(start >= bound || end > bound || start > end))
+ 		return 0;
+-	}
+ 
+ 	/* I/O request is valid */
+ 	return 1;
+@@ -703,7 +710,7 @@ static const struct block_device_operations zram_devops = {
+ 
+ static int create_device(struct zram *zram, int device_id)
+ {
+-	int ret = 0;
++	int ret = -ENOMEM;
+ 
+ 	init_rwsem(&zram->lock);
+ 	init_rwsem(&zram->init_lock);
+@@ -713,7 +720,6 @@ static int create_device(struct zram *zram, int device_id)
+ 	if (!zram->queue) {
+ 		pr_err("Error allocating disk queue for device %d\n",
+ 			device_id);
+-		ret = -ENOMEM;
+ 		goto out;
+ 	}
+ 
+@@ -723,11 +729,9 @@ static int create_device(struct zram *zram, int device_id)
+ 	 /* gendisk structure */
+ 	zram->disk = alloc_disk(1);
+ 	if (!zram->disk) {
+-		blk_cleanup_queue(zram->queue);
+ 		pr_warning("Error allocating disk structure for device %d\n",
+ 			device_id);
+-		ret = -ENOMEM;
+-		goto out;
++		goto out_free_queue;
+ 	}
+ 
+ 	zram->disk->major = zram_major;
+@@ -756,11 +760,17 @@ static int create_device(struct zram *zram, int device_id)
+ 				&zram_disk_attr_group);
+ 	if (ret < 0) {
+ 		pr_warning("Error creating sysfs group");
+-		goto out;
++		goto out_free_disk;
+ 	}
+ 
+ 	zram->init_done = 0;
++	return 0;
+ 
++out_free_disk:
++	del_gendisk(zram->disk);
++	put_disk(zram->disk);
++out_free_queue:
++	blk_cleanup_queue(zram->queue);
+ out:
+ 	return ret;
+ }
+@@ -841,9 +851,11 @@ static void __exit zram_exit(void)
+ 	for (i = 0; i < num_devices; i++) {
+ 		zram = &zram_devices[i];
+ 
++		get_disk(zram->disk);
+ 		destroy_device(zram);
+ 		if (zram->init_done)
+ 			zram_reset_device(zram);
++		put_disk(zram->disk);
+ 	}
+ 
+ 	unregister_blkdev(zram_major, "zram");
+diff --git a/drivers/staging/zram/zram_sysfs.c b/drivers/staging/zram/zram_sysfs.c
+index a7f377175525..826653fff70e 100644
+--- a/drivers/staging/zram/zram_sysfs.c
++++ b/drivers/staging/zram/zram_sysfs.c
+@@ -95,6 +95,9 @@ static ssize_t reset_store(struct device *dev,
+ 	zram = dev_to_zram(dev);
+ 	bdev = bdget_disk(zram->disk, 0);
+ 
++	if (!bdev)
++		return -ENOMEM;
++
+ 	/* Do not reset an active device! */
+ 	if (bdev->bd_holders)
+ 		return -EBUSY;
+@@ -107,8 +110,7 @@ static ssize_t reset_store(struct device *dev,
+ 		return -EINVAL;
+ 
+ 	/* Make sure all pending I/O is finished */
+-	if (bdev)
+-		fsync_bdev(bdev);
++	fsync_bdev(bdev);
+ 
+ 	down_write(&zram->init_lock);
+ 	if (zram->init_done)
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index acc0eab58468..53ff37bb17d0 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -108,7 +108,7 @@ struct gsm_mux_net {
+  */
+ 
+ struct gsm_msg {
+-	struct gsm_msg *next;
++	struct list_head list;
+ 	u8 addr;		/* DLCI address + flags */
+ 	u8 ctrl;		/* Control byte + flags */
+ 	unsigned int len;	/* Length of data block (can be zero) */
+@@ -245,8 +245,7 @@ struct gsm_mux {
+ 	unsigned int tx_bytes;		/* TX data outstanding */
+ #define TX_THRESH_HI		8192
+ #define TX_THRESH_LO		2048
+-	struct gsm_msg *tx_head;	/* Pending data packets */
+-	struct gsm_msg *tx_tail;
++	struct list_head tx_list;	/* Pending data packets */
+ 
+ 	/* Control messages */
+ 	struct timer_list t2_timer;	/* Retransmit timer for commands */
+@@ -663,7 +662,7 @@ static struct gsm_msg *gsm_data_alloc(struct gsm_mux *gsm, u8 addr, int len,
+ 	m->len = len;
+ 	m->addr = addr;
+ 	m->ctrl = ctrl;
+-	m->next = NULL;
++	INIT_LIST_HEAD(&m->list);
+ 	return m;
+ }
+ 
+@@ -673,22 +672,21 @@ static struct gsm_msg *gsm_data_alloc(struct gsm_mux *gsm, u8 addr, int len,
+  *
+  *	The tty device has called us to indicate that room has appeared in
+  *	the transmit queue. Ram more data into the pipe if we have any
++ *	If we have been flow-stopped by a CMD_FCOFF, then we can only
++ *	send messages on DLCI0 until CMD_FCON
+  *
+  *	FIXME: lock against link layer control transmissions
+  */
+ 
+ static void gsm_data_kick(struct gsm_mux *gsm)
+ {
+-	struct gsm_msg *msg = gsm->tx_head;
++	struct gsm_msg *msg, *nmsg;
+ 	int len;
+ 	int skip_sof = 0;
+ 
+-	/* FIXME: We need to apply this solely to data messages */
+-	if (gsm->constipated)
+-		return;
+-
+-	while (gsm->tx_head != NULL) {
+-		msg = gsm->tx_head;
++	list_for_each_entry_safe(msg, nmsg, &gsm->tx_list, list) {
++		if (gsm->constipated && msg->addr)
++			continue;
+ 		if (gsm->encoding != 0) {
+ 			gsm->txframe[0] = GSM1_SOF;
+ 			len = gsm_stuff_frame(msg->data,
+@@ -711,14 +709,13 @@ static void gsm_data_kick(struct gsm_mux *gsm)
+ 						len - skip_sof) < 0)
+ 			break;
+ 		/* FIXME: Can eliminate one SOF in many more cases */
+-		gsm->tx_head = msg->next;
+-		if (gsm->tx_head == NULL)
+-			gsm->tx_tail = NULL;
+ 		gsm->tx_bytes -= msg->len;
+-		kfree(msg);
+ 		/* For a burst of frames skip the extra SOF within the
+ 		   burst */
+ 		skip_sof = 1;
++
++		list_del(&msg->list);
++		kfree(msg);
+ 	}
+ }
+ 
+@@ -768,11 +765,7 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)
+ 	msg->data = dp;
+ 
+ 	/* Add to the actual output queue */
+-	if (gsm->tx_tail)
+-		gsm->tx_tail->next = msg;
+-	else
+-		gsm->tx_head = msg;
+-	gsm->tx_tail = msg;
++	list_add_tail(&msg->list, &gsm->tx_list);
+ 	gsm->tx_bytes += msg->len;
+ 	gsm_data_kick(gsm);
+ }
+@@ -886,7 +879,7 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,
+ 	if (len > gsm->mtu) {
+ 		if (dlci->adaption == 3) {
+ 			/* Over long frame, bin it */
+-			kfree_skb(dlci->skb);
++			dev_kfree_skb_any(dlci->skb);
+ 			dlci->skb = NULL;
+ 			return 0;
+ 		}
+@@ -915,7 +908,7 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,
+ 	skb_pull(dlci->skb, len);
+ 	__gsm_data_queue(dlci, msg);
+ 	if (last) {
+-		kfree_skb(dlci->skb);
++		dev_kfree_skb_any(dlci->skb);
+ 		dlci->skb = NULL;
+ 	}
+ 	return size;
+@@ -976,6 +969,9 @@ static void gsm_dlci_data_kick(struct gsm_dlci *dlci)
+ 	unsigned long flags;
+ 	int sweep;
+ 
++	if (dlci->constipated)
++		return;
++
+ 	spin_lock_irqsave(&dlci->gsm->tx_lock, flags);
+ 	/* If we have nothing running then we need to fire up */
+ 	sweep = (dlci->gsm->tx_bytes < TX_THRESH_LO);
+@@ -1033,6 +1029,7 @@ static void gsm_process_modem(struct tty_struct *tty, struct gsm_dlci *dlci,
+ {
+ 	int  mlines = 0;
+ 	u8 brk = 0;
++	int fc;
+ 
+ 	/* The modem status command can either contain one octet (v.24 signals)
+ 	   or two octets (v.24 signals + break signals). The length field will
+@@ -1044,19 +1041,21 @@ static void gsm_process_modem(struct tty_struct *tty, struct gsm_dlci *dlci,
+ 	else {
+ 		brk = modem & 0x7f;
+ 		modem = (modem >> 7) & 0x7f;
+-	};
++	}
+ 
+ 	/* Flow control/ready to communicate */
+-	if (modem & MDM_FC) {
++	fc = (modem & MDM_FC) || !(modem & MDM_RTR);
++	if (fc && !dlci->constipated) {
+ 		/* Need to throttle our output on this device */
+ 		dlci->constipated = 1;
+-	}
+-	if (modem & MDM_RTC) {
+-		mlines |= TIOCM_DSR | TIOCM_DTR;
++	} else if (!fc && dlci->constipated) {
+ 		dlci->constipated = 0;
+ 		gsm_dlci_data_kick(dlci);
+ 	}
++
+ 	/* Map modem bits */
++	if (modem & MDM_RTC)
++		mlines |= TIOCM_DSR | TIOCM_DTR;
+ 	if (modem & MDM_RTR)
+ 		mlines |= TIOCM_RTS | TIOCM_CTS;
+ 	if (modem & MDM_IC)
+@@ -1225,19 +1224,19 @@ static void gsm_control_message(struct gsm_mux *gsm, unsigned int command,
+ 		gsm_control_reply(gsm, CMD_TEST, data, clen);
+ 		break;
+ 	case CMD_FCON:
+-		/* Modem wants us to STFU */
+-		gsm->constipated = 1;
+-		gsm_control_reply(gsm, CMD_FCON, NULL, 0);
+-		break;
+-	case CMD_FCOFF:
+ 		/* Modem can accept data again */
+ 		gsm->constipated = 0;
+-		gsm_control_reply(gsm, CMD_FCOFF, NULL, 0);
++		gsm_control_reply(gsm, CMD_FCON, NULL, 0);
+ 		/* Kick the link in case it is idling */
+ 		spin_lock_irqsave(&gsm->tx_lock, flags);
+ 		gsm_data_kick(gsm);
+ 		spin_unlock_irqrestore(&gsm->tx_lock, flags);
+ 		break;
++	case CMD_FCOFF:
++		/* Modem wants us to STFU */
++		gsm->constipated = 1;
++		gsm_control_reply(gsm, CMD_FCOFF, NULL, 0);
++		break;
+ 	case CMD_MSC:
+ 		/* Out of band modem line change indicator for a DLCI */
+ 		gsm_control_modem(gsm, data, clen);
+@@ -1689,7 +1688,7 @@ static void gsm_dlci_free(struct kref *ref)
+ 	dlci->gsm->dlci[dlci->addr] = NULL;
+ 	kfifo_free(dlci->fifo);
+ 	while ((dlci->skb = skb_dequeue(&dlci->skb_list)))
+-		kfree_skb(dlci->skb);
++		dev_kfree_skb(dlci->skb);
+ 	kfree(dlci);
+ }
+ 
+@@ -2040,7 +2039,7 @@ void gsm_cleanup_mux(struct gsm_mux *gsm)
+ {
+ 	int i;
+ 	struct gsm_dlci *dlci = gsm->dlci[0];
+-	struct gsm_msg *txq;
++	struct gsm_msg *txq, *ntxq;
+ 	struct gsm_control *gc;
+ 
+ 	gsm->dead = 1;
+@@ -2075,11 +2074,9 @@ void gsm_cleanup_mux(struct gsm_mux *gsm)
+ 		if (gsm->dlci[i])
+ 			gsm_dlci_release(gsm->dlci[i]);
+ 	/* Now wipe the queues */
+-	for (txq = gsm->tx_head; txq != NULL; txq = gsm->tx_head) {
+-		gsm->tx_head = txq->next;
++	list_for_each_entry_safe(txq, ntxq, &gsm->tx_list, list)
+ 		kfree(txq);
+-	}
+-	gsm->tx_tail = NULL;
++	INIT_LIST_HEAD(&gsm->tx_list);
+ }
+ EXPORT_SYMBOL_GPL(gsm_cleanup_mux);
+ 
+@@ -2190,6 +2187,7 @@ struct gsm_mux *gsm_alloc_mux(void)
+ 	}
+ 	spin_lock_init(&gsm->lock);
+ 	kref_init(&gsm->ref);
++	INIT_LIST_HEAD(&gsm->tx_list);
+ 
+ 	gsm->t1 = T1;
+ 	gsm->t2 = T2;
+@@ -2306,7 +2304,7 @@ static void gsmld_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+ 			gsm->error(gsm, *dp, flags);
+ 			break;
+ 		default:
+-			WARN_ONCE("%s: unknown flag %d\n",
++			WARN_ONCE(1, "%s: unknown flag %d\n",
+ 			       tty_name(tty, buf), flags);
+ 			break;
+ 		}
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 0de7ed788631..88620e1ad5fc 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -131,6 +131,7 @@
+ #define  UCR4_OREN  	 (1<<1)  /* Receiver overrun interrupt enable */
+ #define  UCR4_DREN  	 (1<<0)  /* Recv data ready interrupt enable */
+ #define  UFCR_RXTL_SHF   0       /* Receiver trigger level shift */
++#define  UFCR_DCEDTE	 (1<<6)  /* DCE/DTE mode select */
+ #define  UFCR_RFDIV      (7<<7)  /* Reference freq divider mask */
+ #define  UFCR_RFDIV_REG(x)	(((x) < 7 ? 6 - (x) : 6) << 7)
+ #define  UFCR_TXTL_SHF   10      /* Transmitter trigger level shift */
+@@ -666,22 +667,11 @@ static void imx_break_ctl(struct uart_port *port, int break_state)
+ static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
+ {
+ 	unsigned int val;
+-	unsigned int ufcr_rfdiv;
+-
+-	/* set receiver / transmitter trigger level.
+-	 * RFDIV is set such way to satisfy requested uartclk value
+-	 */
+-	val = TXTL << 10 | RXTL;
+-	ufcr_rfdiv = (clk_get_rate(sport->clk) + sport->port.uartclk / 2)
+-			/ sport->port.uartclk;
+-
+-	if(!ufcr_rfdiv)
+-		ufcr_rfdiv = 1;
+-
+-	val |= UFCR_RFDIV_REG(ufcr_rfdiv);
+ 
++	/* set receiver / transmitter trigger level */
++	val = readl(sport->port.membase + UFCR) & (UFCR_RFDIV | UFCR_DCEDTE);
++	val |= TXTL << UFCR_TXTL_SHF | RXTL;
+ 	writel(val, sport->port.membase + UFCR);
+-
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 4a9dd86bce8e..f509888b7ad0 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1587,13 +1587,27 @@ static const struct usb_device_id acm_ids[] = {
+ 	},
+ 	/* Motorola H24 HSPA module: */
+ 	{ USB_DEVICE(0x22b8, 0x2d91) }, /* modem                                */
+-	{ USB_DEVICE(0x22b8, 0x2d92) }, /* modem           + diagnostics        */
+-	{ USB_DEVICE(0x22b8, 0x2d93) }, /* modem + AT port                      */
+-	{ USB_DEVICE(0x22b8, 0x2d95) }, /* modem + AT port + diagnostics        */
+-	{ USB_DEVICE(0x22b8, 0x2d96) }, /* modem                         + NMEA */
+-	{ USB_DEVICE(0x22b8, 0x2d97) }, /* modem           + diagnostics + NMEA */
+-	{ USB_DEVICE(0x22b8, 0x2d99) }, /* modem + AT port               + NMEA */
+-	{ USB_DEVICE(0x22b8, 0x2d9a) }, /* modem + AT port + diagnostics + NMEA */
++	{ USB_DEVICE(0x22b8, 0x2d92),   /* modem           + diagnostics        */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d93),   /* modem + AT port                      */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d95),   /* modem + AT port + diagnostics        */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d96),   /* modem                         + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d97),   /* modem           + diagnostics + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d99),   /* modem + AT port               + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d9a),   /* modem + AT port + diagnostics + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
+ 
+ 	{ USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
+ 	.driver_info = NO_UNION_NORMAL, /* union descriptor misplaced on
+diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
+index be6952e2fc5a..bf5671c74607 100644
+--- a/drivers/usb/gadget/at91_udc.c
++++ b/drivers/usb/gadget/at91_udc.c
+@@ -1741,16 +1741,6 @@ static int __devinit at91udc_probe(struct platform_device *pdev)
+ 		return -ENODEV;
+ 	}
+ 
+-	if (pdev->num_resources != 2) {
+-		DBG("invalid num_resources\n");
+-		return -ENODEV;
+-	}
+-	if ((pdev->resource[0].flags != IORESOURCE_MEM)
+-			|| (pdev->resource[1].flags != IORESOURCE_IRQ)) {
+-		DBG("invalid resource type\n");
+-		return -ENODEV;
+-	}
+-
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	if (!res)
+ 		return -ENXIO;
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index b53065b53fc9..3bd9bd49ed9a 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -110,6 +110,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */
+ 	{ USB_DEVICE(0x10C4, 0x822B) }, /* Modem EDGE(GSM) Comander 2 */
+ 	{ USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */
++	{ USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */
+ 	{ USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */
+ 	{ USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */
+ 	{ USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 156cf593d84f..3b2dfe9c5212 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -920,6 +920,39 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
+ 	/* Cressi Devices */
+ 	{ USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) },
++	/* Brainboxes Devices */
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_001_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_012_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_4_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_5_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_357_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
+ 	{ },					/* Optional parameter entry */
+ 	{ }					/* Terminating entry */
+ };
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index e599fbfcde5f..993c93df6874 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1326,3 +1326,40 @@
+  * Manufacturer: Cressi
+  */
+ #define FTDI_CRESSI_PID		0x87d0
++
++/*
++ * Brainboxes devices
++ */
++#define BRAINBOXES_VID			0x05d1
++#define BRAINBOXES_VX_001_PID		0x1001 /* VX-001 ExpressCard 1 Port RS232 */
++#define BRAINBOXES_VX_012_PID		0x1002 /* VX-012 ExpressCard 2 Port RS232 */
++#define BRAINBOXES_VX_023_PID		0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */
++#define BRAINBOXES_VX_034_PID		0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */
++#define BRAINBOXES_US_101_PID		0x1011 /* US-101 1xRS232 */
++#define BRAINBOXES_US_324_PID		0x1013 /* US-324 1xRS422/485 1Mbaud */
++#define BRAINBOXES_US_606_1_PID		0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */
++#define BRAINBOXES_US_606_2_PID		0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */
++#define BRAINBOXES_US_606_3_PID		0x2003 /* US-606 6 Port RS232 Serial Port 4 and 6 */
++#define BRAINBOXES_US_701_1_PID		0x2011 /* US-701 4xRS232 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_701_2_PID		0x2012 /* US-701 4xRS422 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_279_1_PID		0x2021 /* US-279 8xRS422 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_279_2_PID		0x2022 /* US-279 8xRS422 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_279_3_PID		0x2023 /* US-279 8xRS422 1Mbaud Port 5 and 6 */
++#define BRAINBOXES_US_279_4_PID		0x2024 /* US-279 8xRS422 1Mbaud Port 7 and 8 */
++#define BRAINBOXES_US_346_1_PID		0x3011 /* US-346 4xRS422/485 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_346_2_PID		0x3012 /* US-346 4xRS422/485 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_257_PID		0x5001 /* US-257 2xRS232 1Mbaud */
++#define BRAINBOXES_US_313_PID		0x6001 /* US-313 2xRS422/485 1Mbaud */
++#define BRAINBOXES_US_357_PID		0x7001 /* US_357 1xRS232/422/485 */
++#define BRAINBOXES_US_842_1_PID		0x8001 /* US-842 8xRS422/485 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_842_2_PID		0x8002 /* US-842 8xRS422/485 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_842_3_PID		0x8003 /* US-842 8xRS422/485 1Mbaud Port 5 and 6 */
++#define BRAINBOXES_US_842_4_PID		0x8004 /* US-842 8xRS422/485 1Mbaud Port 7 and 8 */
++#define BRAINBOXES_US_160_1_PID		0x9001 /* US-160 16xRS232 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_160_2_PID		0x9002 /* US-160 16xRS232 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_160_3_PID		0x9003 /* US-160 16xRS232 1Mbaud Port 5 and 6 */
++#define BRAINBOXES_US_160_4_PID		0x9004 /* US-160 16xRS232 1Mbaud Port 7 and 8 */
++#define BRAINBOXES_US_160_5_PID		0x9005 /* US-160 16xRS232 1Mbaud Port 9 and 10 */
++#define BRAINBOXES_US_160_6_PID		0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */
++#define BRAINBOXES_US_160_7_PID		0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */
++#define BRAINBOXES_US_160_8_PID		0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index 64eb8799f1ed..5cca1b3cb083 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -29,6 +29,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/mutex.h>
+ #include <linux/serial.h>
++#include <linux/swab.h>
+ #include <linux/kfifo.h>
+ #include <linux/ioctl.h>
+ #include <linux/firmware.h>
+@@ -298,7 +299,7 @@ static int read_download_mem(struct usb_device *dev, int start_address,
+ {
+ 	int status = 0;
+ 	__u8 read_length;
+-	__be16 be_start_address;
++	u16 be_start_address;
+ 
+ 	dbg("%s - @ %x for %d", __func__, start_address, length);
+ 
+@@ -315,10 +316,14 @@ static int read_download_mem(struct usb_device *dev, int start_address,
+ 			dbg("%s - @ %x for %d", __func__,
+ 			     start_address, read_length);
+ 		}
+-		be_start_address = cpu_to_be16(start_address);
++		/*
++		 * NOTE: Must use swab as wIndex is sent in little-endian
++		 *       byte order regardless of host byte order.
++		 */
++		be_start_address = swab16((u16)start_address);
+ 		status = ti_vread_sync(dev, UMPC_MEMORY_READ,
+ 					(__u16)address_type,
+-					(__force __u16)be_start_address,
++					be_start_address,
+ 					buffer, read_length);
+ 
+ 		if (status) {
+@@ -418,7 +423,7 @@ static int write_i2c_mem(struct edgeport_serial *serial,
+ {
+ 	int status = 0;
+ 	int write_length;
+-	__be16 be_start_address;
++	u16 be_start_address;
+ 
+ 	/* We can only send a maximum of 1 aligned byte page at a time */
+ 
+@@ -434,11 +439,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
+ 	usb_serial_debug_data(debug, &serial->serial->dev->dev,
+ 						__func__, write_length, buffer);
+ 
+-	/* Write first page */
+-	be_start_address = cpu_to_be16(start_address);
++	/*
++	 * Write first page.
++	 *
++	 * NOTE: Must use swab as wIndex is sent in little-endian byte order
++	 *       regardless of host byte order.
++	 */
++	be_start_address = swab16((u16)start_address);
+ 	status = ti_vsend_sync(serial->serial->dev,
+ 				UMPC_MEMORY_WRITE, (__u16)address_type,
+-				(__force __u16)be_start_address,
++				be_start_address,
+ 				buffer,	write_length);
+ 	if (status) {
+ 		dbg("%s - ERROR %d", __func__, status);
+@@ -462,11 +472,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
+ 		usb_serial_debug_data(debug, &serial->serial->dev->dev,
+ 					__func__, write_length, buffer);
+ 
+-		/* Write next page */
+-		be_start_address = cpu_to_be16(start_address);
++		/*
++		 * Write next page.
++		 *
++		 * NOTE: Must use swab as wIndex is sent in little-endian byte
++		 *       order regardless of host byte order.
++		 */
++		be_start_address = swab16((u16)start_address);
+ 		status = ti_vsend_sync(serial->serial->dev, UMPC_MEMORY_WRITE,
+ 				(__u16)address_type,
+-				(__force __u16)be_start_address,
++				be_start_address,
+ 				buffer, write_length);
+ 		if (status) {
+ 			dev_err(&serial->serial->dev->dev, "%s - ERROR %d\n",
+@@ -673,8 +688,8 @@ static int get_descriptor_addr(struct edgeport_serial *serial,
+ 		if (rom_desc->Type == desc_type)
+ 			return start_address;
+ 
+-		start_address = start_address + sizeof(struct ti_i2c_desc)
+-							+ rom_desc->Size;
++		start_address = start_address + sizeof(struct ti_i2c_desc) +
++						le16_to_cpu(rom_desc->Size);
+ 
+ 	} while ((start_address < TI_MAX_I2C_SIZE) && rom_desc->Type);
+ 
+@@ -687,7 +702,7 @@ static int valid_csum(struct ti_i2c_desc *rom_desc, __u8 *buffer)
+ 	__u16 i;
+ 	__u8 cs = 0;
+ 
+-	for (i = 0; i < rom_desc->Size; i++)
++	for (i = 0; i < le16_to_cpu(rom_desc->Size); i++)
+ 		cs = (__u8)(cs + buffer[i]);
+ 
+ 	if (cs != rom_desc->CheckSum) {
+@@ -741,7 +756,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
+ 			break;
+ 
+ 		if ((start_address + sizeof(struct ti_i2c_desc) +
+-					rom_desc->Size) > TI_MAX_I2C_SIZE) {
++			le16_to_cpu(rom_desc->Size)) > TI_MAX_I2C_SIZE) {
+ 			status = -ENODEV;
+ 			dbg("%s - structure too big, erroring out.", __func__);
+ 			break;
+@@ -756,7 +771,8 @@ static int check_i2c_image(struct edgeport_serial *serial)
+ 			/* Read the descriptor data */
+ 			status = read_rom(serial, start_address +
+ 						sizeof(struct ti_i2c_desc),
+-						rom_desc->Size, buffer);
++						le16_to_cpu(rom_desc->Size),
++						buffer);
+ 			if (status)
+ 				break;
+ 
+@@ -765,7 +781,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
+ 				break;
+ 		}
+ 		start_address = start_address + sizeof(struct ti_i2c_desc) +
+-								rom_desc->Size;
++						le16_to_cpu(rom_desc->Size);
+ 
+ 	} while ((rom_desc->Type != I2C_DESC_TYPE_ION) &&
+ 				(start_address < TI_MAX_I2C_SIZE));
+@@ -804,7 +820,7 @@ static int get_manuf_info(struct edgeport_serial *serial, __u8 *buffer)
+ 
+ 	/* Read the descriptor data */
+ 	status = read_rom(serial, start_address+sizeof(struct ti_i2c_desc),
+-						rom_desc->Size, buffer);
++					le16_to_cpu(rom_desc->Size), buffer);
+ 	if (status)
+ 		goto exit;
+ 
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 8b5c8e5d78d8..e9c113dab5c4 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -234,8 +234,31 @@ static void option_instat_callback(struct urb *urb);
+ #define QUALCOMM_VENDOR_ID			0x05C6
+ 
+ #define CMOTECH_VENDOR_ID			0x16d8
+-#define CMOTECH_PRODUCT_6008			0x6008
+-#define CMOTECH_PRODUCT_6280			0x6280
++#define CMOTECH_PRODUCT_6001			0x6001
++#define CMOTECH_PRODUCT_CMU_300			0x6002
++#define CMOTECH_PRODUCT_6003			0x6003
++#define CMOTECH_PRODUCT_6004			0x6004
++#define CMOTECH_PRODUCT_6005			0x6005
++#define CMOTECH_PRODUCT_CGU_628A		0x6006
++#define CMOTECH_PRODUCT_CHE_628S		0x6007
++#define CMOTECH_PRODUCT_CMU_301			0x6008
++#define CMOTECH_PRODUCT_CHU_628			0x6280
++#define CMOTECH_PRODUCT_CHU_628S		0x6281
++#define CMOTECH_PRODUCT_CDU_680			0x6803
++#define CMOTECH_PRODUCT_CDU_685A		0x6804
++#define CMOTECH_PRODUCT_CHU_720S		0x7001
++#define CMOTECH_PRODUCT_7002			0x7002
++#define CMOTECH_PRODUCT_CHU_629K		0x7003
++#define CMOTECH_PRODUCT_7004			0x7004
++#define CMOTECH_PRODUCT_7005			0x7005
++#define CMOTECH_PRODUCT_CGU_629			0x7006
++#define CMOTECH_PRODUCT_CHU_629S		0x700a
++#define CMOTECH_PRODUCT_CHU_720I		0x7211
++#define CMOTECH_PRODUCT_7212			0x7212
++#define CMOTECH_PRODUCT_7213			0x7213
++#define CMOTECH_PRODUCT_7251			0x7251
++#define CMOTECH_PRODUCT_7252			0x7252
++#define CMOTECH_PRODUCT_7253			0x7253
+ 
+ #define TELIT_VENDOR_ID				0x1bc7
+ #define TELIT_PRODUCT_UC864E			0x1003
+@@ -243,6 +266,7 @@ static void option_instat_callback(struct urb *urb);
+ #define TELIT_PRODUCT_CC864_DUAL		0x1005
+ #define TELIT_PRODUCT_CC864_SINGLE		0x1006
+ #define TELIT_PRODUCT_DE910_DUAL		0x1010
++#define TELIT_PRODUCT_UE910_V2			0x1012
+ #define TELIT_PRODUCT_LE920			0x1200
+ 
+ /* ZTE PRODUCTS */
+@@ -291,6 +315,7 @@ static void option_instat_callback(struct urb *urb);
+ #define ALCATEL_PRODUCT_X060S_X200		0x0000
+ #define ALCATEL_PRODUCT_X220_X500D		0x0017
+ #define ALCATEL_PRODUCT_L100V			0x011e
++#define ALCATEL_PRODUCT_L800MA			0x0203
+ 
+ #define PIRELLI_VENDOR_ID			0x1266
+ #define PIRELLI_PRODUCT_C100_1			0x1002
+@@ -353,6 +378,7 @@ static void option_instat_callback(struct urb *urb);
+ #define OLIVETTI_PRODUCT_OLICARD100		0xc000
+ #define OLIVETTI_PRODUCT_OLICARD145		0xc003
+ #define OLIVETTI_PRODUCT_OLICARD200		0xc005
++#define OLIVETTI_PRODUCT_OLICARD500		0xc00b
+ 
+ /* Celot products */
+ #define CELOT_VENDOR_ID				0x211f
+@@ -514,6 +540,10 @@ static const struct option_blacklist_info huawei_cdc12_blacklist = {
+ 	.reserved = BIT(1) | BIT(2),
+ };
+ 
++static const struct option_blacklist_info net_intf0_blacklist = {
++	.reserved = BIT(0),
++};
++
+ static const struct option_blacklist_info net_intf1_blacklist = {
+ 	.reserved = BIT(1),
+ };
+@@ -1048,13 +1078,53 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+-	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
+-	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6004) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6005) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_628A) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHE_628S),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_301),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628S) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_680) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_685A) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720S),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7002),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629K),
++	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7004),
++	  .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7005) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_629),
++	  .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629S),
++	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720I),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7212),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7213),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7251),
++	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7252),
++	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7253),
++	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
++	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+ 		.driver_info = (kernel_ulong_t)&telit_le920_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+@@ -1518,6 +1588,8 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
+ 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V),
+ 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L800MA),
++	  .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+ 	{ USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+ 	{ USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
+ 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
+@@ -1563,6 +1635,9 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
+ 		.driver_info = (kernel_ulong_t)&net_intf6_blacklist
+ 	},
++	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
++		.driver_info = (kernel_ulong_t)&net_intf4_blacklist
++	},
+ 	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
+ 	{ USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index 8ec15c2540b8..3f5e4a73ddd5 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -305,7 +305,6 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x0f3d, 0x68A3), 	/* Airprime/Sierra Wireless Direct IP modems */
+ 	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ 	},
+-       { USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */
+ 
+ 	{ }
+ };
+diff --git a/drivers/usb/storage/shuttle_usbat.c b/drivers/usb/storage/shuttle_usbat.c
+index fa1ceebc465c..f3248fbd0b3d 100644
+--- a/drivers/usb/storage/shuttle_usbat.c
++++ b/drivers/usb/storage/shuttle_usbat.c
+@@ -1846,7 +1846,7 @@ static int usbat_probe(struct usb_interface *intf,
+ 	us->transport_name = "Shuttle USBAT";
+ 	us->transport = usbat_flash_transport;
+ 	us->transport_reset = usb_stor_CB_reset;
+-	us->max_lun = 1;
++	us->max_lun = 0;
+ 
+ 	result = usb_stor_probe2(us);
+ 	return result;
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index bbe9adb0eb66..1d9fc30f3ac3 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -226,6 +226,20 @@ UNUSUAL_DEV(  0x0421, 0x0495, 0x0370, 0x0370,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_MAX_SECTORS_64 ),
+ 
++/* Reported by Daniele Forsi <dforsi@×××××.com> */
++UNUSUAL_DEV(  0x0421, 0x04b9, 0x0350, 0x0350,
++		"Nokia",
++		"5300",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_MAX_SECTORS_64 ),
++
++/* Patch submitted by Victor A. Santos <victoraur.santos@×××××.com> */
++UNUSUAL_DEV(  0x0421, 0x05af, 0x0742, 0x0742,
++		"Nokia",
++		"305",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_MAX_SECTORS_64),
++
+ /* Patch submitted by Mikhail Zolotaryov <lebon@×××××××××.ua> */
+ UNUSUAL_DEV(  0x0421, 0x06aa, 0x1110, 0x1110,
+ 		"Nokia",
+diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c
+index 4d2bbd893e88..dab3a0c9f480 100644
+--- a/drivers/video/backlight/atmel-pwm-bl.c
++++ b/drivers/video/backlight/atmel-pwm-bl.c
+@@ -211,7 +211,8 @@ static int __exit atmel_pwm_bl_remove(struct platform_device *pdev)
+ 	struct atmel_pwm_bl *pwmbl = platform_get_drvdata(pdev);
+ 
+ 	if (pwmbl->gpio_on != -1) {
+-		gpio_set_value(pwmbl->gpio_on, 0);
++		gpio_set_value(pwmbl->gpio_on,
++					0 ^ pwmbl->pdata->on_active_low);
+ 		gpio_free(pwmbl->gpio_on);
+ 	}
+ 	pwm_channel_disable(&pwmbl->pwmc);
+diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
+index 5855d17d19ac..9d8feac67637 100644
+--- a/drivers/video/console/vgacon.c
++++ b/drivers/video/console/vgacon.c
+@@ -42,6 +42,7 @@
+ #include <linux/kd.h>
+ #include <linux/slab.h>
+ #include <linux/vt_kern.h>
++#include <linux/sched.h>
+ #include <linux/selection.h>
+ #include <linux/spinlock.h>
+ #include <linux/ioport.h>
+@@ -1124,11 +1125,15 @@ static int vgacon_do_font_op(struct vgastate *state,char *arg,int set,int ch512)
+ 
+ 	if (arg) {
+ 		if (set)
+-			for (i = 0; i < cmapsz; i++)
++			for (i = 0; i < cmapsz; i++) {
+ 				vga_writeb(arg[i], charmap + i);
++				cond_resched();
++			}
+ 		else
+-			for (i = 0; i < cmapsz; i++)
++			for (i = 0; i < cmapsz; i++) {
+ 				arg[i] = vga_readb(charmap + i);
++				cond_resched();
++			}
+ 
+ 		/*
+ 		 * In 512-character mode, the character map is not contiguous if
+@@ -1139,11 +1144,15 @@ static int vgacon_do_font_op(struct vgastate *state,char *arg,int set,int ch512)
+ 			charmap += 2 * cmapsz;
+ 			arg += cmapsz;
+ 			if (set)
+-				for (i = 0; i < cmapsz; i++)
++				for (i = 0; i < cmapsz; i++) {
+ 					vga_writeb(arg[i], charmap + i);
++					cond_resched();
++				}
+ 			else
+-				for (i = 0; i < cmapsz; i++)
++				for (i = 0; i < cmapsz; i++) {
+ 					arg[i] = vga_readb(charmap + i);
++					cond_resched();
++				}
+ 		}
+ 	}
+ 
+diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
+index 0e3c0924cc3a..b4d2438da9a5 100644
+--- a/fs/cachefiles/rdwr.c
++++ b/fs/cachefiles/rdwr.c
+@@ -918,7 +918,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
+ 	 * own time */
+ 	dget(object->backer);
+ 	mntget(cache->mnt);
+-	file = dentry_open(object->backer, cache->mnt, O_RDWR,
++	file = dentry_open(object->backer, cache->mnt, O_RDWR | O_LARGEFILE,
+ 			   cache->cache_cred);
+ 	if (IS_ERR(file)) {
+ 		ret = PTR_ERR(file);
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index d7561e03870c..c0f65e84873e 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -87,6 +87,30 @@ extern mempool_t *cifs_mid_poolp;
+ 
+ struct workqueue_struct	*cifsiod_wq;
+ 
++/*
++ * Bumps refcount for cifs super block.
++ * Note that it should be only called if a referece to VFS super block is
++ * already held, e.g. in open-type syscalls context. Otherwise it can race with
++ * atomic_dec_and_test in deactivate_locked_super.
++ */
++void
++cifs_sb_active(struct super_block *sb)
++{
++	struct cifs_sb_info *server = CIFS_SB(sb);
++
++	if (atomic_inc_return(&server->active) == 1)
++		atomic_inc(&sb->s_active);
++}
++
++void
++cifs_sb_deactive(struct super_block *sb)
++{
++	struct cifs_sb_info *server = CIFS_SB(sb);
++
++	if (atomic_dec_and_test(&server->active))
++		deactivate_super(sb);
++}
++
+ static int
+ cifs_read_super(struct super_block *sb)
+ {
+diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
+index 65365358c976..f71176578278 100644
+--- a/fs/cifs/cifsfs.h
++++ b/fs/cifs/cifsfs.h
+@@ -41,6 +41,10 @@ extern struct file_system_type cifs_fs_type;
+ extern const struct address_space_operations cifs_addr_ops;
+ extern const struct address_space_operations cifs_addr_ops_smallbuf;
+ 
++/* Functions related to super block operations */
++extern void cifs_sb_active(struct super_block *sb);
++extern void cifs_sb_deactive(struct super_block *sb);
++
+ /* Functions related to inodes */
+ extern const struct inode_operations cifs_dir_inode_ops;
+ extern struct inode *cifs_root_iget(struct super_block *);
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index 3a75ee5a6b33..6e609819c62a 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -3454,11 +3454,13 @@ static __u16 ACL_to_cifs_posix(char *parm_data, const char *pACL,
+ 		return 0;
+ 	}
+ 	cifs_acl->version = cpu_to_le16(1);
+-	if (acl_type == ACL_TYPE_ACCESS)
++	if (acl_type == ACL_TYPE_ACCESS) {
+ 		cifs_acl->access_entry_count = cpu_to_le16(count);
+-	else if (acl_type == ACL_TYPE_DEFAULT)
++		cifs_acl->default_entry_count = __constant_cpu_to_le16(0xFFFF);
++	} else if (acl_type == ACL_TYPE_DEFAULT) {
+ 		cifs_acl->default_entry_count = cpu_to_le16(count);
+-	else {
++		cifs_acl->access_entry_count = __constant_cpu_to_le16(0xFFFF);
++	} else {
+ 		cFYI(1, "unknown ACL type %d", acl_type);
+ 		return 0;
+ 	}
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 9ace37521510..0898d99b5f7b 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -265,6 +265,8 @@ cifs_new_fileinfo(__u16 fileHandle, struct file *file,
+ 	mutex_init(&pCifsFile->fh_mutex);
+ 	INIT_WORK(&pCifsFile->oplock_break, cifs_oplock_break);
+ 
++	cifs_sb_active(inode->i_sb);
++
+ 	spin_lock(&cifs_file_list_lock);
+ 	list_add(&pCifsFile->tlist, &(tlink_tcon(tlink)->openFileList));
+ 	/* if readable file instance put first in list*/
+@@ -293,7 +295,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
+ 	struct inode *inode = cifs_file->dentry->d_inode;
+ 	struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink);
+ 	struct cifsInodeInfo *cifsi = CIFS_I(inode);
+-	struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
++	struct super_block *sb = inode->i_sb;
++	struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
+ 	struct cifsLockInfo *li, *tmp;
+ 
+ 	spin_lock(&cifs_file_list_lock);
+@@ -345,6 +348,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
+ 
+ 	cifs_put_tlink(cifs_file->tlink);
+ 	dput(cifs_file->dentry);
++	cifs_sb_deactive(sb);
+ 	kfree(cifs_file);
+ }
+ 
+@@ -882,7 +886,7 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
+ 	if (!buf) {
+ 		mutex_unlock(&cinode->lock_mutex);
+ 		FreeXid(xid);
+-		return rc;
++		return -ENOMEM;
+ 	}
+ 
+ 	for (i = 0; i < 2; i++) {
+diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
+index 2333203a120b..d28fc348afe7 100644
+--- a/fs/ecryptfs/keystore.c
++++ b/fs/ecryptfs/keystore.c
+@@ -1149,7 +1149,7 @@ decrypt_pki_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
+ 	struct ecryptfs_msg_ctx *msg_ctx;
+ 	struct ecryptfs_message *msg = NULL;
+ 	char *auth_tok_sig;
+-	char *payload;
++	char *payload = NULL;
+ 	size_t payload_len;
+ 	int rc;
+ 
+@@ -1204,6 +1204,7 @@ decrypt_pki_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
+ out:
+ 	if (msg)
+ 		kfree(msg);
++	kfree(payload);
+ 	return rc;
+ }
+ 
+diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
+index 95bfc243992c..27c2969a9d02 100644
+--- a/fs/nfs/callback_xdr.c
++++ b/fs/nfs/callback_xdr.c
+@@ -455,9 +455,9 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
+ 	args->csa_nrclists = ntohl(*p++);
+ 	args->csa_rclists = NULL;
+ 	if (args->csa_nrclists) {
+-		args->csa_rclists = kmalloc(args->csa_nrclists *
+-					    sizeof(*args->csa_rclists),
+-					    GFP_KERNEL);
++		args->csa_rclists = kmalloc_array(args->csa_nrclists,
++						  sizeof(*args->csa_rclists),
++						  GFP_KERNEL);
+ 		if (unlikely(args->csa_rclists == NULL))
+ 			goto out;
+ 
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index d5faa264ecc2..934bb1ca8335 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3724,7 +3724,8 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
+ 		.rpc_argp = &args,
+ 		.rpc_resp = &res,
+ 	};
+-	int ret = -ENOMEM, npages, i, acl_len = 0;
++	int ret = -ENOMEM, npages, i;
++	size_t acl_len = 0;
+ 
+ 	npages = (buflen + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ 	/* As long as we're doing a round trip to the server anyway,
+@@ -3910,8 +3911,7 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
+ 			dprintk("%s ERROR %d, Reset session\n", __func__,
+ 				task->tk_status);
+ 			nfs4_schedule_session_recovery(clp->cl_session);
+-			task->tk_status = 0;
+-			return -EAGAIN;
++			goto wait_on_recovery;
+ #endif /* CONFIG_NFS_V4_1 */
+ 		case -NFS4ERR_DELAY:
+ 			nfs_inc_server_stats(server, NFSIOS_DELAY);
+@@ -6084,7 +6084,8 @@ int nfs4_proc_layoutget(struct nfs4_layoutget *lgp, gfp_t gfp_flags)
+ 	status = nfs4_wait_for_completion_rpc_task(task);
+ 	if (status == 0)
+ 		status = task->tk_status;
+-	if (status == 0)
++	/* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
++	if (status == 0 && lgp->res.layoutp->len)
+ 		status = pnfs_layout_process(lgp);
+ 	rpc_put_task(task);
+ 	dprintk("<-- %s status=%d\n", __func__, status);
+@@ -6297,22 +6298,8 @@ nfs4_layoutcommit_done(struct rpc_task *task, void *calldata)
+ static void nfs4_layoutcommit_release(void *calldata)
+ {
+ 	struct nfs4_layoutcommit_data *data = calldata;
+-	struct pnfs_layout_segment *lseg, *tmp;
+-	unsigned long *bitlock = &NFS_I(data->args.inode)->flags;
+ 
+ 	pnfs_cleanup_layoutcommit(data);
+-	/* Matched by references in pnfs_set_layoutcommit */
+-	list_for_each_entry_safe(lseg, tmp, &data->lseg_list, pls_lc_list) {
+-		list_del_init(&lseg->pls_lc_list);
+-		if (test_and_clear_bit(NFS_LSEG_LAYOUTCOMMIT,
+-				       &lseg->pls_flags))
+-			put_lseg(lseg);
+-	}
+-
+-	clear_bit_unlock(NFS_INO_LAYOUTCOMMITTING, bitlock);
+-	smp_mb__after_clear_bit();
+-	wake_up_bit(bitlock, NFS_INO_LAYOUTCOMMITTING);
+-
+ 	put_rpccred(data->cred);
+ 	kfree(data);
+ }
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index e46579471ccc..461816beff13 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1651,8 +1651,18 @@ static int nfs4_reset_session(struct nfs_client *clp)
+ 
+ 	nfs4_begin_drain_session(clp);
+ 	status = nfs4_proc_destroy_session(clp->cl_session);
+-	if (status && status != -NFS4ERR_BADSESSION &&
+-	    status != -NFS4ERR_DEADSESSION) {
++	switch (status) {
++	case 0:
++	case -NFS4ERR_BADSESSION:
++	case -NFS4ERR_DEADSESSION:
++		break;
++	case -NFS4ERR_BACK_CHAN_BUSY:
++	case -NFS4ERR_DELAY:
++		set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
++		status = 0;
++		ssleep(1);
++		goto out;
++	default:
+ 		status = nfs4_recovery_handle_error(clp, status);
+ 		goto out;
+ 	}
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 059e2c350ad7..ae3118212bd6 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1381,11 +1381,27 @@ static void pnfs_list_write_lseg(struct inode *inode, struct list_head *listp)
+ 
+ 	list_for_each_entry(lseg, &NFS_I(inode)->layout->plh_segs, pls_list) {
+ 		if (lseg->pls_range.iomode == IOMODE_RW &&
+-		    test_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
++		    test_and_clear_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
+ 			list_add(&lseg->pls_lc_list, listp);
+ 	}
+ }
+ 
++static void pnfs_list_write_lseg_done(struct inode *inode, struct list_head *listp)
++{
++	struct pnfs_layout_segment *lseg, *tmp;
++	unsigned long *bitlock = &NFS_I(inode)->flags;
++
++	/* Matched by references in pnfs_set_layoutcommit */
++	list_for_each_entry_safe(lseg, tmp, listp, pls_lc_list) {
++		list_del_init(&lseg->pls_lc_list);
++		put_lseg(lseg);
++	}
++
++	clear_bit_unlock(NFS_INO_LAYOUTCOMMITTING, bitlock);
++	smp_mb__after_clear_bit();
++	wake_up_bit(bitlock, NFS_INO_LAYOUTCOMMITTING);
++}
++
+ void pnfs_set_lo_fail(struct pnfs_layout_segment *lseg)
+ {
+ 	if (lseg->pls_range.iomode == IOMODE_RW) {
+@@ -1434,6 +1450,7 @@ void pnfs_cleanup_layoutcommit(struct nfs4_layoutcommit_data *data)
+ 
+ 	if (nfss->pnfs_curr_ld->cleanup_layoutcommit)
+ 		nfss->pnfs_curr_ld->cleanup_layoutcommit(data);
++	pnfs_list_write_lseg_done(data->args.inode, &data->lseg_list);
+ }
+ 
+ /*
+diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
+index 9c51aff02ae2..435a9be1265e 100644
+--- a/fs/nfsd/nfs4acl.c
++++ b/fs/nfsd/nfs4acl.c
+@@ -373,8 +373,10 @@ sort_pacl(struct posix_acl *pacl)
+ 	 * by uid/gid. */
+ 	int i, j;
+ 
+-	if (pacl->a_count <= 4)
+-		return; /* no users or groups */
++	/* no users or groups */
++	if (!pacl || pacl->a_count <= 4)
++		return;
++
+ 	i = 1;
+ 	while (pacl->a_entries[i].e_tag == ACL_USER)
+ 		i++;
+@@ -498,13 +500,12 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
+ 
+ 	/*
+ 	 * ACLs with no ACEs are treated differently in the inheritable
+-	 * and effective cases: when there are no inheritable ACEs, we
+-	 * set a zero-length default posix acl:
++	 * and effective cases: when there are no inheritable ACEs,
++	 * calls ->set_acl with a NULL ACL structure.
+ 	 */
+-	if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT)) {
+-		pacl = posix_acl_alloc(0, GFP_KERNEL);
+-		return pacl ? pacl : ERR_PTR(-ENOMEM);
+-	}
++	if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT))
++		return NULL;
++
+ 	/*
+ 	 * When there are no effective ACEs, the following will end
+ 	 * up setting a 3-element effective posix ACL with all
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index e5404945f854..97a142cde23b 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -904,14 +904,14 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ 
+ 	nfs4_lock_state();
+ 	status = nfs4_preprocess_stateid_op(cstate, stateid, WR_STATE, &filp);
+-	if (filp)
+-		get_file(filp);
+-	nfs4_unlock_state();
+-
+ 	if (status) {
++		nfs4_unlock_state();
+ 		dprintk("NFSD: nfsd4_write: couldn't process stateid!\n");
+ 		return status;
+ 	}
++	if (filp)
++		get_file(filp);
++	nfs4_unlock_state();
+ 
+ 	cnt = write->wr_buflen;
+ 	write->wr_how_written = write->wr_stable_how;
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index f90b197ceffa..28e5648c9cc4 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3476,9 +3476,16 @@ out:
+ static __be32
+ nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp)
+ {
+-	if (check_for_locks(stp->st_file, lockowner(stp->st_stateowner)))
++	struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
++
++	if (check_for_locks(stp->st_file, lo))
+ 		return nfserr_locks_held;
+-	release_lock_stateid(stp);
++	/*
++	 * Currently there's a 1-1 lock stateid<->lockowner
++	 * correspondance, and we have to delete the lockowner when we
++	 * delete the lock stateid:
++	 */
++	unhash_lockowner(lo);
+ 	return nfs_ok;
+ }
+ 
+@@ -3918,6 +3925,10 @@ static bool same_lockowner_ino(struct nfs4_lockowner *lo, struct inode *inode, c
+ 
+ 	if (!same_owner_str(&lo->lo_owner, owner, clid))
+ 		return false;
++	if (list_empty(&lo->lo_owner.so_stateids)) {
++		WARN_ON_ONCE(1);
++		return false;
++	}
+ 	lst = list_first_entry(&lo->lo_owner.so_stateids,
+ 			       struct nfs4_ol_stateid, st_perstateowner);
+ 	return lst->st_file->fi_inode == inode;
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index a0f92ec4b38e..6eaa2e2335dc 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -161,8 +161,8 @@ static __be32 *read_buf(struct nfsd4_compoundargs *argp, u32 nbytes)
+ 	 */
+ 	memcpy(p, argp->p, avail);
+ 	/* step to next page */
+-	argp->pagelist++;
+ 	argp->p = page_address(argp->pagelist[0]);
++	argp->pagelist++;
+ 	if (argp->pagelen < PAGE_SIZE) {
+ 		argp->end = argp->p + (argp->pagelen>>2);
+ 		argp->pagelen = 0;
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 638306219ae8..e3abfde27863 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -828,9 +828,10 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
+ 	}
+ 	*filp = dentry_open(dget(dentry), mntget(fhp->fh_export->ex_path.mnt),
+ 			    flags, current_cred());
+-	if (IS_ERR(*filp))
++	if (IS_ERR(*filp)) {
+ 		host_err = PTR_ERR(*filp);
+-	else {
++		*filp = NULL;
++	} else {
+ 		host_err = ima_file_check(*filp, may_flags);
+ 
+ 		if (may_flags & NFSD_MAY_64BIT_COOKIE)
+diff --git a/fs/posix_acl.c b/fs/posix_acl.c
+index 5e325a42e33d..64496020bf19 100644
+--- a/fs/posix_acl.c
++++ b/fs/posix_acl.c
+@@ -155,6 +155,12 @@ posix_acl_equiv_mode(const struct posix_acl *acl, umode_t *mode_p)
+ 	umode_t mode = 0;
+ 	int not_equiv = 0;
+ 
++	/*
++	 * A null ACL can always be presented as mode bits.
++	 */
++	if (!acl)
++		return 0;
++
+ 	FOREACH_ACL_ENTRY(pa, acl, pe) {
+ 		switch (pa->e_tag) {
+ 			case ACL_USER_OBJ:
+diff --git a/fs/stat.c b/fs/stat.c
+index dc6d0be300ca..88b36c770762 100644
+--- a/fs/stat.c
++++ b/fs/stat.c
+@@ -57,12 +57,13 @@ EXPORT_SYMBOL(vfs_getattr);
+ 
+ int vfs_fstat(unsigned int fd, struct kstat *stat)
+ {
+-	struct file *f = fget_raw(fd);
++	int fput_needed;
++	struct file *f = fget_light(fd, &fput_needed);
+ 	int error = -EBADF;
+ 
+ 	if (f) {
+ 		error = vfs_getattr(f->f_path.mnt, f->f_path.dentry, stat);
+-		fput(f);
++		fput_light(f, fput_needed);
+ 	}
+ 	return error;
+ }
+diff --git a/include/drm/drm_mode.h b/include/drm/drm_mode.h
+index 9242310b47cd..cbf2d9ada2ea 100644
+--- a/include/drm/drm_mode.h
++++ b/include/drm/drm_mode.h
+@@ -223,6 +223,8 @@ struct drm_mode_get_connector {
+ 	__u32 connection;
+ 	__u32 mm_width, mm_height; /**< HxW in millimeters */
+ 	__u32 subpixel;
++
++	__u32 pad;
+ };
+ 
+ #define DRM_MODE_PROP_PENDING	(1<<0)
+diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h
+index d8e636e5607d..cba9593c4047 100644
+--- a/include/linux/compiler-intel.h
++++ b/include/linux/compiler-intel.h
+@@ -27,5 +27,3 @@
+ #define __must_be_array(a) 0
+ 
+ #endif
+-
+-#define uninitialized_var(x) x
+diff --git a/include/linux/efi.h b/include/linux/efi.h
+index eee8b0b190ea..6bf839418dd4 100644
+--- a/include/linux/efi.h
++++ b/include/linux/efi.h
+@@ -29,7 +29,12 @@
+ #define EFI_UNSUPPORTED		( 3 | (1UL << (BITS_PER_LONG-1)))
+ #define EFI_BAD_BUFFER_SIZE     ( 4 | (1UL << (BITS_PER_LONG-1)))
+ #define EFI_BUFFER_TOO_SMALL	( 5 | (1UL << (BITS_PER_LONG-1)))
++#define EFI_NOT_READY		( 6 | (1UL << (BITS_PER_LONG-1)))
++#define EFI_DEVICE_ERROR	( 7 | (1UL << (BITS_PER_LONG-1)))
++#define EFI_WRITE_PROTECTED	( 8 | (1UL << (BITS_PER_LONG-1)))
++#define EFI_OUT_OF_RESOURCES	( 9 | (1UL << (BITS_PER_LONG-1)))
+ #define EFI_NOT_FOUND		(14 | (1UL << (BITS_PER_LONG-1)))
++#define EFI_SECURITY_VIOLATION	(26 | (1UL << (BITS_PER_LONG-1)))
+ 
+ typedef unsigned long efi_status_t;
+ typedef u8 efi_bool_t;
+@@ -257,6 +262,7 @@ typedef efi_status_t efi_query_capsule_caps_t(efi_capsule_header_t **capsules,
+ 					      unsigned long count,
+ 					      u64 *max_size,
+ 					      int *reset_type);
++typedef efi_status_t efi_query_variable_store_t(u32 attributes, unsigned long size);
+ 
+ /*
+  *  EFI Configuration Table and GUID definitions
+@@ -498,8 +504,14 @@ extern void efi_gettimeofday (struct timespec *ts);
+ extern void efi_enter_virtual_mode (void);	/* switch EFI to virtual mode, if possible */
+ #ifdef CONFIG_X86
+ extern void efi_free_boot_services(void);
++extern efi_status_t efi_query_variable_store(u32 attributes, unsigned long size);
+ #else
+ static inline void efi_free_boot_services(void) {}
++
++static inline efi_status_t efi_query_variable_store(u32 attributes, unsigned long size)
++{
++	return EFI_SUCCESS;
++}
+ #endif
+ extern u64 efi_get_iobase (void);
+ extern u32 efi_mem_type (unsigned long phys_addr);
+@@ -652,6 +664,7 @@ struct efivar_operations {
+ 	efi_get_variable_t *get_variable;
+ 	efi_get_next_variable_t *get_next_variable;
+ 	efi_set_variable_t *set_variable;
++	efi_query_variable_store_t *query_variable_store;
+ };
+ 
+ struct efivars {
+@@ -660,7 +673,8 @@ struct efivars {
+ 	 * 1) ->list - adds, removals, reads, writes
+ 	 * 2) ops.[gs]et_variable() calls.
+ 	 * It must not be held when creating sysfs entries or calling kmalloc.
+-	 * ops.get_next_variable() is only called from register_efivars(),
++	 * ops.get_next_variable() is only called from register_efivars()
++	 * or efivar_update_sysfs_entries(),
+ 	 * which is protected by the BKL, so that path is safe.
+ 	 */
+ 	spinlock_t lock;
+diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
+index f80ca4a6ed96..bfbcd439e2c6 100644
+--- a/include/linux/ftrace.h
++++ b/include/linux/ftrace.h
+@@ -374,6 +374,7 @@ extern int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr);
+ extern int ftrace_arch_read_dyn_info(char *buf, int size);
+ 
+ extern int skip_trace(unsigned long ip);
++extern void ftrace_module_init(struct module *mod);
+ 
+ extern void ftrace_disable_daemon(void);
+ extern void ftrace_enable_daemon(void);
+@@ -383,6 +384,7 @@ static inline int ftrace_force_update(void) { return 0; }
+ static inline void ftrace_disable_daemon(void) { }
+ static inline void ftrace_enable_daemon(void) { }
+ static inline void ftrace_release_mod(struct module *mod) {}
++static inline void ftrace_module_init(struct module *mod) {}
+ static inline int register_ftrace_command(struct ftrace_func_command *cmd)
+ {
+ 	return -EINVAL;
+diff --git a/include/linux/list.h b/include/linux/list.h
+index cc6d2aa6b415..1712c7e1f56b 100644
+--- a/include/linux/list.h
++++ b/include/linux/list.h
+@@ -362,6 +362,22 @@ static inline void list_splice_tail_init(struct list_head *list,
+ 	list_entry((ptr)->next, type, member)
+ 
+ /**
++ * list_next_entry - get the next element in list
++ * @pos:	the type * to cursor
++ * @member:	the name of the list_struct within the struct.
++ */
++#define list_next_entry(pos, member) \
++	list_entry((pos)->member.next, typeof(*(pos)), member)
++
++/**
++ * list_prev_entry - get the prev element in list
++ * @pos:	the type * to cursor
++ * @member:	the name of the list_struct within the struct.
++ */
++#define list_prev_entry(pos, member) \
++	list_entry((pos)->member.prev, typeof(*(pos)), member)
++
++/**
+  * list_for_each	-	iterate over a list
+  * @pos:	the &struct list_head to use as a loop cursor.
+  * @head:	the head for your list.
+diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
+index b35752fb2ad8..16cb641bb89f 100644
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -306,6 +306,7 @@ struct mm_struct {
+ 	void (*unmap_area) (struct mm_struct *mm, unsigned long addr);
+ #endif
+ 	unsigned long mmap_base;		/* base of mmap area */
++	unsigned long mmap_legacy_base;         /* base of mmap area in bottom-up allocations */
+ 	unsigned long task_size;		/* size of task vm space */
+ 	unsigned long cached_hole_size; 	/* if non-zero, the largest hole below free_area_cache */
+ 	unsigned long free_area_cache;		/* first hole of size cached_hole_size or larger */
+diff --git a/include/linux/net.h b/include/linux/net.h
+index d40ccb796e8d..16b499620a0a 100644
+--- a/include/linux/net.h
++++ b/include/linux/net.h
+@@ -282,6 +282,29 @@ do {								\
+ #define net_dbg_ratelimited(fmt, ...)				\
+ 	net_ratelimited_function(pr_debug, fmt, ##__VA_ARGS__)
+ 
++#define net_ratelimited_function(function, ...)			\
++do {								\
++	if (net_ratelimit())					\
++		function(__VA_ARGS__);				\
++} while (0)
++
++#define net_emerg_ratelimited(fmt, ...)				\
++	net_ratelimited_function(pr_emerg, fmt, ##__VA_ARGS__)
++#define net_alert_ratelimited(fmt, ...)				\
++	net_ratelimited_function(pr_alert, fmt, ##__VA_ARGS__)
++#define net_crit_ratelimited(fmt, ...)				\
++	net_ratelimited_function(pr_crit, fmt, ##__VA_ARGS__)
++#define net_err_ratelimited(fmt, ...)				\
++	net_ratelimited_function(pr_err, fmt, ##__VA_ARGS__)
++#define net_notice_ratelimited(fmt, ...)			\
++	net_ratelimited_function(pr_notice, fmt, ##__VA_ARGS__)
++#define net_warn_ratelimited(fmt, ...)				\
++	net_ratelimited_function(pr_warn, fmt, ##__VA_ARGS__)
++#define net_info_ratelimited(fmt, ...)				\
++	net_ratelimited_function(pr_info, fmt, ##__VA_ARGS__)
++#define net_dbg_ratelimited(fmt, ...)				\
++	net_ratelimited_function(pr_debug, fmt, ##__VA_ARGS__)
++
+ #define net_random()		random32()
+ #define net_srandom(seed)	srandom32((__force u32)seed)
+ 
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index e45ffad543be..47c3d045c7fd 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -391,13 +391,15 @@ struct perf_event_mmap_page {
+ 	/*
+ 	 * Control data for the mmap() data buffer.
+ 	 *
+-	 * User-space reading the @data_head value should issue an rmb(), on
+-	 * SMP capable platforms, after reading this value -- see
+-	 * perf_event_wakeup().
++	 * User-space reading the @data_head value should issue an smp_rmb(),
++	 * after reading this value.
+ 	 *
+ 	 * When the mapping is PROT_WRITE the @data_tail value should be
+-	 * written by userspace to reflect the last read data. In this case
+-	 * the kernel will not over-write unread data.
++	 * written by userspace to reflect the last read data, after issueing
++	 * an smp_mb() to separate the data read from the ->data_tail store.
++	 * In this case the kernel will not over-write unread data.
++	 *
++	 * See perf_output_put_handle() for the data ordering.
+ 	 */
+ 	__u64   data_head;		/* head in the data section */
+ 	__u64	data_tail;		/* user-space written tail */
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 3a7b87e1fd89..0884db3d315e 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -640,11 +640,21 @@ static inline unsigned char *skb_end_pointer(const struct sk_buff *skb)
+ {
+ 	return skb->head + skb->end;
+ }
++
++static inline unsigned int skb_end_offset(const struct sk_buff *skb)
++{
++	return skb->end;
++}
+ #else
+ static inline unsigned char *skb_end_pointer(const struct sk_buff *skb)
+ {
+ 	return skb->end;
+ }
++
++static inline unsigned int skb_end_offset(const struct sk_buff *skb)
++{
++	return skb->end - skb->head;
++}
+ #endif
+ 
+ /* Internal */
+@@ -2574,7 +2584,7 @@ static inline bool skb_is_recycleable(const struct sk_buff *skb, int skb_size)
+ 		return false;
+ 
+ 	skb_size = SKB_DATA_ALIGN(skb_size + NET_SKB_PAD);
+-	if (skb_end_pointer(skb) - skb->head < skb_size)
++	if (skb_end_offset(skb) < skb_size)
+ 		return false;
+ 
+ 	if (skb_shared(skb) || skb_cloned(skb))
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index 2ad92ca4e6f3..7cd3caab0394 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -34,6 +34,11 @@ struct route_info {
+ #define RT6_LOOKUP_F_SRCPREF_PUBLIC	0x00000010
+ #define RT6_LOOKUP_F_SRCPREF_COA	0x00000020
+ 
++/* We do not (yet ?) support IPv6 jumbograms (RFC 2675)
++ * Unlike IPv4, hdr->seg_len doesn't include the IPv6 header
++ */
++#define IP6_MAX_MTU (0xFFFF + sizeof(struct ipv6hdr))
++
+ /*
+  * rt6_srcprefs2flags() and rt6_flags2srcprefs() translate
+  * between IPV6_ADDR_PREFERENCES socket option values
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 9210bdc7bd8d..aa12b395b2b7 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1174,6 +1174,10 @@ enum sta_notify_cmd {
+  * @IEEE80211_HW_SCAN_WHILE_IDLE: The device can do hw scan while
+  *	being idle (i.e. mac80211 doesn't have to go idle-off during the
+  *	the scan).
++ *
++ * @IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL: On this hardware TX BA session
++ *	should be tear down once BAR frame will not be acked.
++ *
+  */
+ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_HAS_RATE_CONTROL			= 1<<0,
+@@ -1201,6 +1205,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_AP_LINK_PS				= 1<<22,
+ 	IEEE80211_HW_TX_AMPDU_SETUP_IN_HW		= 1<<23,
+ 	IEEE80211_HW_SCAN_WHILE_IDLE			= 1<<24,
++	IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL		= 1<<26,
+ };
+ 
+ /**
+diff --git a/include/trace/events/module.h b/include/trace/events/module.h
+index 161932737416..ca298c7157ae 100644
+--- a/include/trace/events/module.h
++++ b/include/trace/events/module.h
+@@ -78,7 +78,7 @@ DECLARE_EVENT_CLASS(module_refcnt,
+ 
+ 	TP_fast_assign(
+ 		__entry->ip	= ip;
+-		__entry->refcnt	= __this_cpu_read(mod->refptr->incs) + __this_cpu_read(mod->refptr->decs);
++		__entry->refcnt	= __this_cpu_read(mod->refptr->incs) - __this_cpu_read(mod->refptr->decs);
+ 		__assign_str(name, mod->name);
+ 	),
+ 
+diff --git a/include/xen/interface/io/netif.h b/include/xen/interface/io/netif.h
+index a36c87a6623d..d4635cd786b4 100644
+--- a/include/xen/interface/io/netif.h
++++ b/include/xen/interface/io/netif.h
+@@ -65,6 +65,7 @@
+ #define _XEN_NETTXF_extra_info		(3)
+ #define  XEN_NETTXF_extra_info		(1U<<_XEN_NETTXF_extra_info)
+ 
++#define XEN_NETIF_MAX_TX_SIZE 0xFFFF
+ struct xen_netif_tx_request {
+     grant_ref_t gref;      /* Reference to buffer page */
+     uint16_t offset;       /* Offset within buffer page */
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index eba82e2d34e9..e39346fb2e91 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -1973,9 +1973,6 @@ static void __perf_event_sync_stat(struct perf_event *event,
+ 	perf_event_update_userpage(next_event);
+ }
+ 
+-#define list_next_entry(pos, member) \
+-	list_entry(pos->member.next, typeof(*pos), member)
+-
+ static void perf_event_sync_stat(struct perf_event_context *ctx,
+ 				   struct perf_event_context *next_ctx)
+ {
+@@ -5874,6 +5871,7 @@ skip_type:
+ 	if (pmu->pmu_cpu_context)
+ 		goto got_cpu_context;
+ 
++	ret = -ENOMEM;
+ 	pmu->pmu_cpu_context = alloc_percpu(struct perf_cpu_context);
+ 	if (!pmu->pmu_cpu_context)
+ 		goto free_dev;
+diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
+index 6ddaba43fb7a..4636ecc26d75 100644
+--- a/kernel/events/ring_buffer.c
++++ b/kernel/events/ring_buffer.c
+@@ -75,10 +75,31 @@ again:
+ 		goto out;
+ 
+ 	/*
+-	 * Publish the known good head. Rely on the full barrier implied
+-	 * by atomic_dec_and_test() order the rb->head read and this
+-	 * write.
++	 * Since the mmap() consumer (userspace) can run on a different CPU:
++	 *
++	 *   kernel				user
++	 *
++	 *   READ ->data_tail			READ ->data_head
++	 *   smp_mb()	(A)			smp_rmb()	(C)
++	 *   WRITE $data			READ $data
++	 *   smp_wmb()	(B)			smp_mb()	(D)
++	 *   STORE ->data_head			WRITE ->data_tail
++	 *
++	 * Where A pairs with D, and B pairs with C.
++	 *
++	 * I don't think A needs to be a full barrier because we won't in fact
++	 * write data until we see the store from userspace. So we simply don't
++	 * issue the data WRITE until we observe it. Be conservative for now.
++	 *
++	 * OTOH, D needs to be a full barrier since it separates the data READ
++	 * from the tail WRITE.
++	 *
++	 * For B a WMB is sufficient since it separates two WRITEs, and for C
++	 * an RMB is sufficient since it separates two READs.
++	 *
++	 * See perf_output_begin().
+ 	 */
++	smp_wmb();
+ 	rb->user_page->data_head = head;
+ 
+ 	/*
+@@ -142,9 +163,11 @@ int perf_output_begin(struct perf_output_handle *handle,
+ 		 * Userspace could choose to issue a mb() before updating the
+ 		 * tail pointer. So that all reads will be completed before the
+ 		 * write is issued.
++		 *
++		 * See perf_output_put_handle().
+ 		 */
+ 		tail = ACCESS_ONCE(rb->user_page->data_tail);
+-		smp_rmb();
++		smp_mb();
+ 		offset = head = local_read(&rb->head);
+ 		head += size;
+ 		if (unlikely(!perf_output_space(rb, tail, offset, head)))
+diff --git a/kernel/futex.c b/kernel/futex.c
+index e564a9a3ea2a..9396b7b853f7 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -588,6 +588,55 @@ void exit_pi_state_list(struct task_struct *curr)
+ 	raw_spin_unlock_irq(&curr->pi_lock);
+ }
+ 
++/*
++ * We need to check the following states:
++ *
++ *      Waiter | pi_state | pi->owner | uTID      | uODIED | ?
++ *
++ * [1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
++ * [2]  NULL   | ---      | ---       | >0        | 0/1    | Valid
++ *
++ * [3]  Found  | NULL     | --        | Any       | 0/1    | Invalid
++ *
++ * [4]  Found  | Found    | NULL      | 0         | 1      | Valid
++ * [5]  Found  | Found    | NULL      | >0        | 1      | Invalid
++ *
++ * [6]  Found  | Found    | task      | 0         | 1      | Valid
++ *
++ * [7]  Found  | Found    | NULL      | Any       | 0      | Invalid
++ *
++ * [8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
++ * [9]  Found  | Found    | task      | 0         | 0      | Invalid
++ * [10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid
++ *
++ * [1]	Indicates that the kernel can acquire the futex atomically. We
++ *	came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.
++ *
++ * [2]	Valid, if TID does not belong to a kernel thread. If no matching
++ *      thread is found then it indicates that the owner TID has died.
++ *
++ * [3]	Invalid. The waiter is queued on a non PI futex
++ *
++ * [4]	Valid state after exit_robust_list(), which sets the user space
++ *	value to FUTEX_WAITERS | FUTEX_OWNER_DIED.
++ *
++ * [5]	The user space value got manipulated between exit_robust_list()
++ *	and exit_pi_state_list()
++ *
++ * [6]	Valid state after exit_pi_state_list() which sets the new owner in
++ *	the pi_state but cannot access the user space value.
++ *
++ * [7]	pi_state->owner can only be NULL when the OWNER_DIED bit is set.
++ *
++ * [8]	Owner and user space value match
++ *
++ * [9]	There is no transient state which sets the user space TID to 0
++ *	except exit_robust_list(), but this is indicated by the
++ *	FUTEX_OWNER_DIED bit. See [4]
++ *
++ * [10] There is no transient state which leaves owner and user space
++ *	TID out of sync.
++ */
+ static int
+ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 		union futex_key *key, struct futex_pi_state **ps)
+@@ -603,12 +652,13 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 	plist_for_each_entry_safe(this, next, head, list) {
+ 		if (match_futex(&this->key, key)) {
+ 			/*
+-			 * Another waiter already exists - bump up
+-			 * the refcount and return its pi_state:
++			 * Sanity check the waiter before increasing
++			 * the refcount and attaching to it.
+ 			 */
+ 			pi_state = this->pi_state;
+ 			/*
+-			 * Userspace might have messed up non-PI and PI futexes
++			 * Userspace might have messed up non-PI and
++			 * PI futexes [3]
+ 			 */
+ 			if (unlikely(!pi_state))
+ 				return -EINVAL;
+@@ -616,34 +666,70 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 			WARN_ON(!atomic_read(&pi_state->refcount));
+ 
+ 			/*
+-			 * When pi_state->owner is NULL then the owner died
+-			 * and another waiter is on the fly. pi_state->owner
+-			 * is fixed up by the task which acquires
+-			 * pi_state->rt_mutex.
+-			 *
+-			 * We do not check for pid == 0 which can happen when
+-			 * the owner died and robust_list_exit() cleared the
+-			 * TID.
++			 * Handle the owner died case:
+ 			 */
+-			if (pid && pi_state->owner) {
++			if (uval & FUTEX_OWNER_DIED) {
++				/*
++				 * exit_pi_state_list sets owner to NULL and
++				 * wakes the topmost waiter. The task which
++				 * acquires the pi_state->rt_mutex will fixup
++				 * owner.
++				 */
++				if (!pi_state->owner) {
++					/*
++					 * No pi state owner, but the user
++					 * space TID is not 0. Inconsistent
++					 * state. [5]
++					 */
++					if (pid)
++						return -EINVAL;
++					/*
++					 * Take a ref on the state and
++					 * return. [4]
++					 */
++					goto out_state;
++				}
++
+ 				/*
+-				 * Bail out if user space manipulated the
+-				 * futex value.
++				 * If TID is 0, then either the dying owner
++				 * has not yet executed exit_pi_state_list()
++				 * or some waiter acquired the rtmutex in the
++				 * pi state, but did not yet fixup the TID in
++				 * user space.
++				 *
++				 * Take a ref on the state and return. [6]
+ 				 */
+-				if (pid != task_pid_vnr(pi_state->owner))
++				if (!pid)
++					goto out_state;
++			} else {
++				/*
++				 * If the owner died bit is not set,
++				 * then the pi_state must have an
++				 * owner. [7]
++				 */
++				if (!pi_state->owner)
+ 					return -EINVAL;
+ 			}
+ 
++			/*
++			 * Bail out if user space manipulated the
++			 * futex value. If pi state exists then the
++			 * owner TID must be the same as the user
++			 * space TID. [9/10]
++			 */
++			if (pid != task_pid_vnr(pi_state->owner))
++				return -EINVAL;
++
++		out_state:
+ 			atomic_inc(&pi_state->refcount);
+ 			*ps = pi_state;
+-
+ 			return 0;
+ 		}
+ 	}
+ 
+ 	/*
+ 	 * We are the first waiter - try to look up the real owner and attach
+-	 * the new pi_state to it, but bail out when TID = 0
++	 * the new pi_state to it, but bail out when TID = 0 [1]
+ 	 */
+ 	if (!pid)
+ 		return -ESRCH;
+@@ -651,6 +737,11 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 	if (!p)
+ 		return -ESRCH;
+ 
++	if (!p->mm) {
++		put_task_struct(p);
++		return -EPERM;
++	}
++
+ 	/*
+ 	 * We need to look at the task state flags to figure out,
+ 	 * whether the task is exiting. To protect against the do_exit
+@@ -671,6 +762,9 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 		return ret;
+ 	}
+ 
++	/*
++	 * No existing pi state. First waiter. [2]
++	 */
+ 	pi_state = alloc_pi_state();
+ 
+ 	/*
+@@ -742,10 +836,18 @@ retry:
+ 		return -EDEADLK;
+ 
+ 	/*
+-	 * Surprise - we got the lock. Just return to userspace:
++	 * Surprise - we got the lock, but we do not trust user space at all.
+ 	 */
+-	if (unlikely(!curval))
+-		return 1;
++	if (unlikely(!curval)) {
++		/*
++		 * We verify whether there is kernel state for this
++		 * futex. If not, we can safely assume, that the 0 ->
++		 * TID transition is correct. If state exists, we do
++		 * not bother to fixup the user space state as it was
++		 * corrupted already.
++		 */
++		return futex_top_waiter(hb, key) ? -EINVAL : 1;
++	}
+ 
+ 	uval = curval;
+ 
+@@ -875,6 +977,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
+ 	struct task_struct *new_owner;
+ 	struct futex_pi_state *pi_state = this->pi_state;
+ 	u32 uninitialized_var(curval), newval;
++	int ret = 0;
+ 
+ 	if (!pi_state)
+ 		return -EINVAL;
+@@ -898,23 +1001,19 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
+ 		new_owner = this->task;
+ 
+ 	/*
+-	 * We pass it to the next owner. (The WAITERS bit is always
+-	 * kept enabled while there is PI state around. We must also
+-	 * preserve the owner died bit.)
++	 * We pass it to the next owner. The WAITERS bit is always
++	 * kept enabled while there is PI state around. We cleanup the
++	 * owner died bit, because we are the owner.
+ 	 */
+-	if (!(uval & FUTEX_OWNER_DIED)) {
+-		int ret = 0;
++	newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
+ 
+-		newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
+-
+-		if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
+-			ret = -EFAULT;
+-		else if (curval != uval)
+-			ret = -EINVAL;
+-		if (ret) {
+-			raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
+-			return ret;
+-		}
++	if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
++		ret = -EFAULT;
++	else if (curval != uval)
++		ret = -EINVAL;
++	if (ret) {
++		raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
++		return ret;
+ 	}
+ 
+ 	raw_spin_lock_irq(&pi_state->owner->pi_lock);
+@@ -1193,7 +1292,7 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
+  *
+  * Returns:
+  *  0 - failed to acquire the lock atomicly
+- *  1 - acquired the lock
++ * >0 - acquired the lock, return value is vpid of the top_waiter
+  * <0 - error
+  */
+ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
+@@ -1204,7 +1303,7 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
+ {
+ 	struct futex_q *top_waiter = NULL;
+ 	u32 curval;
+-	int ret;
++	int ret, vpid;
+ 
+ 	if (get_futex_value_locked(&curval, pifutex))
+ 		return -EFAULT;
+@@ -1232,11 +1331,13 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
+ 	 * the contended case or if set_waiters is 1.  The pi_state is returned
+ 	 * in ps in contended cases.
+ 	 */
++	vpid = task_pid_vnr(top_waiter->task);
+ 	ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
+ 				   set_waiters);
+-	if (ret == 1)
++	if (ret == 1) {
+ 		requeue_pi_wake_futex(top_waiter, key2, hb2);
+-
++		return vpid;
++	}
+ 	return ret;
+ }
+ 
+@@ -1268,10 +1369,16 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
+ 	struct futex_hash_bucket *hb1, *hb2;
+ 	struct plist_head *head1;
+ 	struct futex_q *this, *next;
+-	u32 curval2;
+ 
+ 	if (requeue_pi) {
+ 		/*
++		 * Requeue PI only works on two distinct uaddrs. This
++		 * check is only valid for private futexes. See below.
++		 */
++		if (uaddr1 == uaddr2)
++			return -EINVAL;
++
++		/*
+ 		 * requeue_pi requires a pi_state, try to allocate it now
+ 		 * without any locks in case it fails.
+ 		 */
+@@ -1309,6 +1416,15 @@ retry:
+ 	if (unlikely(ret != 0))
+ 		goto out_put_key1;
+ 
++	/*
++	 * The check above which compares uaddrs is not sufficient for
++	 * shared futexes. We need to compare the keys:
++	 */
++	if (requeue_pi && match_futex(&key1, &key2)) {
++		ret = -EINVAL;
++		goto out_put_keys;
++	}
++
+ 	hb1 = hash_futex(&key1);
+ 	hb2 = hash_futex(&key2);
+ 
+@@ -1354,16 +1470,25 @@ retry_private:
+ 		 * At this point the top_waiter has either taken uaddr2 or is
+ 		 * waiting on it.  If the former, then the pi_state will not
+ 		 * exist yet, look it up one more time to ensure we have a
+-		 * reference to it.
++		 * reference to it. If the lock was taken, ret contains the
++		 * vpid of the top waiter task.
+ 		 */
+-		if (ret == 1) {
++		if (ret > 0) {
+ 			WARN_ON(pi_state);
+ 			drop_count++;
+ 			task_count++;
+-			ret = get_futex_value_locked(&curval2, uaddr2);
+-			if (!ret)
+-				ret = lookup_pi_state(curval2, hb2, &key2,
+-						      &pi_state);
++			/*
++			 * If we acquired the lock, then the user
++			 * space value of uaddr2 should be vpid. It
++			 * cannot be changed by the top waiter as it
++			 * is blocked on hb2 lock if it tries to do
++			 * so. If something fiddled with it behind our
++			 * back the pi state lookup might unearth
++			 * it. So we rather use the known value than
++			 * rereading and handing potential crap to
++			 * lookup_pi_state.
++			 */
++			ret = lookup_pi_state(ret, hb2, &key2, &pi_state);
+ 		}
+ 
+ 		switch (ret) {
+@@ -2133,9 +2258,10 @@ retry:
+ 	/*
+ 	 * To avoid races, try to do the TID -> 0 atomic transition
+ 	 * again. If it succeeds then we can return without waking
+-	 * anyone else up:
++	 * anyone else up. We only try this if neither the waiters nor
++	 * the owner died bit are set.
+ 	 */
+-	if (!(uval & FUTEX_OWNER_DIED) &&
++	if (!(uval & ~FUTEX_TID_MASK) &&
+ 	    cmpxchg_futex_value_locked(&uval, uaddr, vpid, 0))
+ 		goto pi_faulted;
+ 	/*
+@@ -2167,11 +2293,9 @@ retry:
+ 	/*
+ 	 * No waiters - kernel unlocks the futex:
+ 	 */
+-	if (!(uval & FUTEX_OWNER_DIED)) {
+-		ret = unlock_futex_pi(uaddr, uval);
+-		if (ret == -EFAULT)
+-			goto pi_faulted;
+-	}
++	ret = unlock_futex_pi(uaddr, uval);
++	if (ret == -EFAULT)
++		goto pi_faulted;
+ 
+ out_unlock:
+ 	spin_unlock(&hb->lock);
+@@ -2331,6 +2455,15 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ 	if (ret)
+ 		goto out_key2;
+ 
++	/*
++	 * The check above which compares uaddrs is not sufficient for
++	 * shared futexes. We need to compare the keys:
++	 */
++	if (match_futex(&q.key, &key2)) {
++		ret = -EINVAL;
++		goto out_put_keys;
++	}
++
+ 	/* Queue the futex_q, drop the hb lock, wait for wakeup. */
+ 	futex_wait_queue_me(hb, &q, to);
+ 
+diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
+index a57ef25867e3..434f2b673d5b 100644
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -232,6 +232,11 @@ again:
+ 			goto again;
+ 		}
+ 		timer->base = new_base;
++	} else {
++		if (cpu != this_cpu && hrtimer_check_target(timer, new_base)) {
++			cpu = this_cpu;
++			goto again;
++		}
+ 	}
+ 	return new_base;
+ }
+@@ -567,6 +572,23 @@ hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base, int skip_equal)
+ 
+ 	cpu_base->expires_next.tv64 = expires_next.tv64;
+ 
++	/*
++	 * If a hang was detected in the last timer interrupt then we
++	 * leave the hang delay active in the hardware. We want the
++	 * system to make progress. That also prevents the following
++	 * scenario:
++	 * T1 expires 50ms from now
++	 * T2 expires 5s from now
++	 *
++	 * T1 is removed, so this code is called and would reprogram
++	 * the hardware to 5s from now. Any hrtimer_start after that
++	 * will not reprogram the hardware due to hang_detected being
++	 * set. So we'd effectivly block all timers until the T2 event
++	 * fires.
++	 */
++	if (cpu_base->hang_detected)
++		return;
++
+ 	if (cpu_base->expires_next.tv64 != KTIME_MAX)
+ 		tick_program_event(cpu_base->expires_next, 1);
+ }
+@@ -963,11 +985,8 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
+ 	/* Remove an active timer from the queue: */
+ 	ret = remove_hrtimer(timer, base);
+ 
+-	/* Switch the timer base, if necessary: */
+-	new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
+-
+ 	if (mode & HRTIMER_MODE_REL) {
+-		tim = ktime_add_safe(tim, new_base->get_time());
++		tim = ktime_add_safe(tim, base->get_time());
+ 		/*
+ 		 * CONFIG_TIME_LOW_RES is a temporary way for architectures
+ 		 * to signal that they simply return xtime in
+@@ -982,6 +1001,9 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
+ 
+ 	hrtimer_set_expires_range_ns(timer, tim, delta_ns);
+ 
++	/* Switch the timer base, if necessary: */
++	new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
++
+ 	timer_stats_hrtimer_set_start_info(timer);
+ 
+ 	leftmost = enqueue_hrtimer(timer, new_base);
+diff --git a/kernel/module.c b/kernel/module.c
+index 85972171ecd3..5e398961b7b5 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -2951,6 +2951,9 @@ static struct module *load_module(void __user *umod,
+ 	/* This has to be done once we're sure module name is unique. */
+ 	dynamic_debug_setup(info.debug, info.num_debug);
+ 
++	/* Ftrace init must be called in the MODULE_STATE_UNFORMED state */
++	ftrace_module_init(mod);
++
+ 	/* Find duplicate symbols */
+ 	err = verify_export_symbols(mod);
+ 	if (err < 0)
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 94f132775d05..e01398f0a52e 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5433,16 +5433,25 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
+ 	*tablep = NULL;
+ }
+ 
++static int min_load_idx = 0;
++static int max_load_idx = CPU_LOAD_IDX_MAX-1;
++
+ static void
+ set_table_entry(struct ctl_table *entry,
+ 		const char *procname, void *data, int maxlen,
+-		umode_t mode, proc_handler *proc_handler)
++		umode_t mode, proc_handler *proc_handler,
++		bool load_idx)
+ {
+ 	entry->procname = procname;
+ 	entry->data = data;
+ 	entry->maxlen = maxlen;
+ 	entry->mode = mode;
+ 	entry->proc_handler = proc_handler;
++
++	if (load_idx) {
++		entry->extra1 = &min_load_idx;
++		entry->extra2 = &max_load_idx;
++	}
+ }
+ 
+ static struct ctl_table *
+@@ -5454,30 +5463,30 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
+ 		return NULL;
+ 
+ 	set_table_entry(&table[0], "min_interval", &sd->min_interval,
+-		sizeof(long), 0644, proc_doulongvec_minmax);
++		sizeof(long), 0644, proc_doulongvec_minmax, false);
+ 	set_table_entry(&table[1], "max_interval", &sd->max_interval,
+-		sizeof(long), 0644, proc_doulongvec_minmax);
++		sizeof(long), 0644, proc_doulongvec_minmax, false);
+ 	set_table_entry(&table[2], "busy_idx", &sd->busy_idx,
+-		sizeof(int), 0644, proc_dointvec_minmax);
++		sizeof(int), 0644, proc_dointvec_minmax, true);
+ 	set_table_entry(&table[3], "idle_idx", &sd->idle_idx,
+-		sizeof(int), 0644, proc_dointvec_minmax);
++		sizeof(int), 0644, proc_dointvec_minmax, true);
+ 	set_table_entry(&table[4], "newidle_idx", &sd->newidle_idx,
+-		sizeof(int), 0644, proc_dointvec_minmax);
++		sizeof(int), 0644, proc_dointvec_minmax, true);
+ 	set_table_entry(&table[5], "wake_idx", &sd->wake_idx,
+-		sizeof(int), 0644, proc_dointvec_minmax);
++		sizeof(int), 0644, proc_dointvec_minmax, true);
+ 	set_table_entry(&table[6], "forkexec_idx", &sd->forkexec_idx,
+-		sizeof(int), 0644, proc_dointvec_minmax);
++		sizeof(int), 0644, proc_dointvec_minmax, true);
+ 	set_table_entry(&table[7], "busy_factor", &sd->busy_factor,
+-		sizeof(int), 0644, proc_dointvec_minmax);
++		sizeof(int), 0644, proc_dointvec_minmax, false);
+ 	set_table_entry(&table[8], "imbalance_pct", &sd->imbalance_pct,
+-		sizeof(int), 0644, proc_dointvec_minmax);
++		sizeof(int), 0644, proc_dointvec_minmax, false);
+ 	set_table_entry(&table[9], "cache_nice_tries",
+ 		&sd->cache_nice_tries,
+-		sizeof(int), 0644, proc_dointvec_minmax);
++		sizeof(int), 0644, proc_dointvec_minmax, false);
+ 	set_table_entry(&table[10], "flags", &sd->flags,
+-		sizeof(int), 0644, proc_dointvec_minmax);
++		sizeof(int), 0644, proc_dointvec_minmax, false);
+ 	set_table_entry(&table[11], "name", sd->name,
+-		CORENAME_MAX_SIZE, 0444, proc_dostring);
++		CORENAME_MAX_SIZE, 0444, proc_dostring, false);
+ 	/* &table[12] is terminator */
+ 
+ 	return table;
+diff --git a/kernel/timer.c b/kernel/timer.c
+index 7e0a770be489..87ff7b19d27f 100644
+--- a/kernel/timer.c
++++ b/kernel/timer.c
+@@ -815,7 +815,7 @@ unsigned long apply_slack(struct timer_list *timer, unsigned long expires)
+ 
+ 	bit = find_last_bit(&mask, BITS_PER_LONG);
+ 
+-	mask = (1 << bit) - 1;
++	mask = (1UL << bit) - 1;
+ 
+ 	expires_limit = expires_limit & ~(mask);
+ 
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 5efdddf04b15..5b6bd45bc58b 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2080,12 +2080,57 @@ static cycle_t		ftrace_update_time;
+ static unsigned long	ftrace_update_cnt;
+ unsigned long		ftrace_update_tot_cnt;
+ 
+-static int ops_traces_mod(struct ftrace_ops *ops)
++static inline int ops_traces_mod(struct ftrace_ops *ops)
+ {
+-	struct ftrace_hash *hash;
++	/*
++	 * Filter_hash being empty will default to trace module.
++	 * But notrace hash requires a test of individual module functions.
++	 */
++	return ftrace_hash_empty(ops->filter_hash) &&
++		ftrace_hash_empty(ops->notrace_hash);
++}
+ 
+-	hash = ops->filter_hash;
+-	return ftrace_hash_empty(hash);
++/*
++ * Check if the current ops references the record.
++ *
++ * If the ops traces all functions, then it was already accounted for.
++ * If the ops does not trace the current record function, skip it.
++ * If the ops ignores the function via notrace filter, skip it.
++ */
++static inline bool
++ops_references_rec(struct ftrace_ops *ops, struct dyn_ftrace *rec)
++{
++	/* If ops isn't enabled, ignore it */
++	if (!(ops->flags & FTRACE_OPS_FL_ENABLED))
++		return 0;
++
++	/* If ops traces all mods, we already accounted for it */
++	if (ops_traces_mod(ops))
++		return 0;
++
++	/* The function must be in the filter */
++	if (!ftrace_hash_empty(ops->filter_hash) &&
++	    !ftrace_lookup_ip(ops->filter_hash, rec->ip))
++		return 0;
++
++	/* If in notrace hash, we ignore it too */
++	if (ftrace_lookup_ip(ops->notrace_hash, rec->ip))
++		return 0;
++
++	return 1;
++}
++
++static int referenced_filters(struct dyn_ftrace *rec)
++{
++	struct ftrace_ops *ops;
++	int cnt = 0;
++
++	for (ops = ftrace_ops_list; ops != &ftrace_list_end; ops = ops->next) {
++		if (ops_references_rec(ops, rec))
++		    cnt++;
++	}
++
++	return cnt;
+ }
+ 
+ static int ftrace_update_code(struct module *mod)
+@@ -2094,6 +2139,7 @@ static int ftrace_update_code(struct module *mod)
+ 	struct dyn_ftrace *p;
+ 	cycle_t start, stop;
+ 	unsigned long ref = 0;
++	bool test = false;
+ 	int i;
+ 
+ 	/*
+@@ -2107,9 +2153,12 @@ static int ftrace_update_code(struct module *mod)
+ 
+ 		for (ops = ftrace_ops_list;
+ 		     ops != &ftrace_list_end; ops = ops->next) {
+-			if (ops->flags & FTRACE_OPS_FL_ENABLED &&
+-			    ops_traces_mod(ops))
+-				ref++;
++			if (ops->flags & FTRACE_OPS_FL_ENABLED) {
++				if (ops_traces_mod(ops))
++					ref++;
++				else
++					test = true;
++			}
+ 		}
+ 	}
+ 
+@@ -2119,12 +2168,16 @@ static int ftrace_update_code(struct module *mod)
+ 	for (pg = ftrace_new_pgs; pg; pg = pg->next) {
+ 
+ 		for (i = 0; i < pg->index; i++) {
++			int cnt = ref;
++
+ 			/* If something went wrong, bail without enabling anything */
+ 			if (unlikely(ftrace_disabled))
+ 				return -1;
+ 
+ 			p = &pg->records[i];
+-			p->flags = ref;
++			if (test)
++				cnt += referenced_filters(p);
++			p->flags = cnt;
+ 
+ 			/*
+ 			 * Do the initial record conversion from mcount jump
+@@ -2144,7 +2197,7 @@ static int ftrace_update_code(struct module *mod)
+ 			 * conversion puts the module to the correct state, thus
+ 			 * passing the ftrace_make_call check.
+ 			 */
+-			if (ftrace_start_up && ref) {
++			if (ftrace_start_up && cnt) {
+ 				int failed = __ftrace_replace_code(p, 1);
+ 				if (failed)
+ 					ftrace_bug(failed, p->ip);
+@@ -3880,16 +3933,11 @@ static void ftrace_init_module(struct module *mod,
+ 	ftrace_process_locs(mod, start, end);
+ }
+ 
+-static int ftrace_module_notify_enter(struct notifier_block *self,
+-				      unsigned long val, void *data)
++void ftrace_module_init(struct module *mod)
+ {
+-	struct module *mod = data;
+-
+-	if (val == MODULE_STATE_COMING)
+-		ftrace_init_module(mod, mod->ftrace_callsites,
+-				   mod->ftrace_callsites +
+-				   mod->num_ftrace_callsites);
+-	return 0;
++	ftrace_init_module(mod, mod->ftrace_callsites,
++			   mod->ftrace_callsites +
++			   mod->num_ftrace_callsites);
+ }
+ 
+ static int ftrace_module_notify_exit(struct notifier_block *self,
+@@ -3903,11 +3951,6 @@ static int ftrace_module_notify_exit(struct notifier_block *self,
+ 	return 0;
+ }
+ #else
+-static int ftrace_module_notify_enter(struct notifier_block *self,
+-				      unsigned long val, void *data)
+-{
+-	return 0;
+-}
+ static int ftrace_module_notify_exit(struct notifier_block *self,
+ 				     unsigned long val, void *data)
+ {
+@@ -3915,11 +3958,6 @@ static int ftrace_module_notify_exit(struct notifier_block *self,
+ }
+ #endif /* CONFIG_MODULES */
+ 
+-struct notifier_block ftrace_module_enter_nb = {
+-	.notifier_call = ftrace_module_notify_enter,
+-	.priority = INT_MAX,	/* Run before anything that can use kprobes */
+-};
+-
+ struct notifier_block ftrace_module_exit_nb = {
+ 	.notifier_call = ftrace_module_notify_exit,
+ 	.priority = INT_MIN,	/* Run after anything that can remove kprobes */
+@@ -3956,10 +3994,6 @@ void __init ftrace_init(void)
+ 				  __start_mcount_loc,
+ 				  __stop_mcount_loc);
+ 
+-	ret = register_module_notifier(&ftrace_module_enter_nb);
+-	if (ret)
+-		pr_warning("Failed to register trace ftrace module enter notifier\n");
+-
+ 	ret = register_module_notifier(&ftrace_module_exit_nb);
+ 	if (ret)
+ 		pr_warning("Failed to register trace ftrace module exit notifier\n");
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 022940f097b8..a494ec317e0a 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2782,8 +2782,12 @@ int set_tracer_flag(unsigned int mask, int enabled)
+ 	if (mask == TRACE_ITER_RECORD_CMD)
+ 		trace_event_enable_cmd_record(enabled);
+ 
+-	if (mask == TRACE_ITER_OVERWRITE)
++	if (mask == TRACE_ITER_OVERWRITE) {
+ 		ring_buffer_change_overwrite(global_trace.buffer, enabled);
++#ifdef CONFIG_TRACER_MAX_TRACE
++		ring_buffer_change_overwrite(max_tr.buffer, enabled);
++#endif
++	}
+ 
+ 	return 0;
+ }
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index c8eed94343e0..d5facc8d78a4 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1082,6 +1082,7 @@ static void return_unused_surplus_pages(struct hstate *h,
+ 	while (nr_pages--) {
+ 		if (!free_pool_huge_page(h, &node_states[N_HIGH_MEMORY], 1))
+ 			break;
++		cond_resched_lock(&hugetlb_lock);
+ 	}
+ }
+ 
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 7e95698e4139..455a67971570 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1061,15 +1061,16 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
+ 			return 0;
+ 		} else if (PageHuge(hpage)) {
+ 			/*
+-			 * Check "just unpoisoned", "filter hit", and
+-			 * "race with other subpage."
++			 * Check "filter hit" and "race with other subpage."
+ 			 */
+ 			lock_page(hpage);
+-			if (!PageHWPoison(hpage)
+-			    || (hwpoison_filter(p) && TestClearPageHWPoison(p))
+-			    || (p != hpage && TestSetPageHWPoison(hpage))) {
+-				atomic_long_sub(nr_pages, &mce_bad_pages);
+-				return 0;
++			if (PageHWPoison(hpage)) {
++				if ((hwpoison_filter(p) && TestClearPageHWPoison(p))
++				    || (p != hpage && TestSetPageHWPoison(hpage))) {
++					atomic_long_sub(nr_pages, &mce_bad_pages);
++					unlock_page(hpage);
++					return 0;
++				}
+ 			}
+ 			set_page_hwpoison_huge_page(hpage);
+ 			res = dequeue_hwpoisoned_huge_page(hpage);
+diff --git a/mm/memory.c b/mm/memory.c
+index 17d8661f44fe..ffd74f370e8d 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1872,12 +1872,17 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
+ 		     unsigned long address, unsigned int fault_flags)
+ {
+ 	struct vm_area_struct *vma;
++	vm_flags_t vm_flags;
+ 	int ret;
+ 
+ 	vma = find_extend_vma(mm, address);
+ 	if (!vma || address < vma->vm_start)
+ 		return -EFAULT;
+ 
++	vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ;
++	if (!(vm_flags & vma->vm_flags))
++		return -EFAULT;
++
+ 	ret = handle_mm_fault(mm, vma, address, fault_flags);
+ 	if (ret & VM_FAULT_ERROR) {
+ 		if (ret & VM_FAULT_OOM)
+diff --git a/mm/percpu.c b/mm/percpu.c
+index bb4be7435ce3..13b2eefabfdd 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -612,7 +612,7 @@ static struct pcpu_chunk *pcpu_alloc_chunk(void)
+ 	chunk->map = pcpu_mem_zalloc(PCPU_DFL_MAP_ALLOC *
+ 						sizeof(chunk->map[0]));
+ 	if (!chunk->map) {
+-		kfree(chunk);
++		pcpu_mem_free(chunk, pcpu_chunk_struct_size);
+ 		return NULL;
+ 	}
+ 
+diff --git a/net/core/dev.c b/net/core/dev.c
+index cebdc15ce327..b47375d9d956 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3574,6 +3574,7 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
+ 	skb->vlan_tci = 0;
+ 	skb->dev = napi->dev;
+ 	skb->skb_iif = 0;
++	skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
+ 
+ 	napi->skb = skb;
+ }
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 6f755cca4520..3b7398ae270a 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -322,6 +322,8 @@ load_b:
+ 
+ 			if (skb_is_nonlinear(skb))
+ 				return 0;
++			if (skb->len < sizeof(struct nlattr))
++				return 0;
+ 			if (A > skb->len - sizeof(struct nlattr))
+ 				return 0;
+ 
+@@ -338,11 +340,13 @@ load_b:
+ 
+ 			if (skb_is_nonlinear(skb))
+ 				return 0;
++			if (skb->len < sizeof(struct nlattr))
++				return 0;
+ 			if (A > skb->len - sizeof(struct nlattr))
+ 				return 0;
+ 
+ 			nla = (struct nlattr *)&skb->data[A];
+-			if (nla->nla_len > A - skb->len)
++			if (nla->nla_len > skb->len - A)
+ 				return 0;
+ 
+ 			nla = nla_find_nested(nla, X);
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index a1334275a7da..3cd37e9d91a6 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -746,7 +746,8 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev,
+ 		return 0;
+ }
+ 
+-static size_t rtnl_port_size(const struct net_device *dev)
++static size_t rtnl_port_size(const struct net_device *dev,
++			     u32 ext_filter_mask)
+ {
+ 	size_t port_size = nla_total_size(4)		/* PORT_VF */
+ 		+ nla_total_size(PORT_PROFILE_MAX)	/* PORT_PROFILE */
+@@ -762,7 +763,8 @@ static size_t rtnl_port_size(const struct net_device *dev)
+ 	size_t port_self_size = nla_total_size(sizeof(struct nlattr))
+ 		+ port_size;
+ 
+-	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
++	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
++	    !(ext_filter_mask & RTEXT_FILTER_VF))
+ 		return 0;
+ 	if (dev_num_vf(dev->dev.parent))
+ 		return port_self_size + vf_ports_size +
+@@ -793,7 +795,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
+ 	       + nla_total_size(ext_filter_mask
+ 			        & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
+ 	       + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
+-	       + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
++	       + rtnl_port_size(dev, ext_filter_mask) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
+ 	       + rtnl_link_get_size(dev) /* IFLA_LINKINFO */
+ 	       + rtnl_link_get_af_size(dev); /* IFLA_AF_SPEC */
+ }
+@@ -853,11 +855,13 @@ static int rtnl_port_self_fill(struct sk_buff *skb, struct net_device *dev)
+ 	return 0;
+ }
+ 
+-static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev)
++static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev,
++			  u32 ext_filter_mask)
+ {
+ 	int err;
+ 
+-	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
++	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
++	    !(ext_filter_mask & RTEXT_FILTER_VF))
+ 		return 0;
+ 
+ 	err = rtnl_port_self_fill(skb, dev);
+@@ -1004,7 +1008,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
+ 		nla_nest_end(skb, vfinfo);
+ 	}
+ 
+-	if (rtnl_port_fill(skb, dev))
++	if (rtnl_port_fill(skb, dev, ext_filter_mask))
+ 		goto nla_put_failure;
+ 
+ 	if (dev->rtnl_link_ops) {
+@@ -1059,6 +1063,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ 	struct hlist_node *node;
+ 	struct nlattr *tb[IFLA_MAX+1];
+ 	u32 ext_filter_mask = 0;
++	int err;
+ 
+ 	s_h = cb->args[0];
+ 	s_idx = cb->args[1];
+@@ -1079,11 +1084,17 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ 		hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+ 			if (idx < s_idx)
+ 				goto cont;
+-			if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
+-					     NETLINK_CB(cb->skb).pid,
+-					     cb->nlh->nlmsg_seq, 0,
+-					     NLM_F_MULTI,
+-					     ext_filter_mask) <= 0)
++			err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
++					       NETLINK_CB(cb->skb).pid,
++					       cb->nlh->nlmsg_seq, 0,
++					       NLM_F_MULTI,
++					       ext_filter_mask);
++			/* If we ran out of room on the first message,
++			 * we're in trouble
++			 */
++			WARN_ON((err == -EMSGSIZE) && (skb->len == 0));
++
++			if (err <= 0)
+ 				goto out;
+ 
+ 			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 7a597d4feaec..fe42834df408 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -821,7 +821,7 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
+ struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t gfp_mask)
+ {
+ 	int headerlen = skb_headroom(skb);
+-	unsigned int size = (skb_end_pointer(skb) - skb->head) + skb->data_len;
++	unsigned int size = skb_end_offset(skb) + skb->data_len;
+ 	struct sk_buff *n = alloc_skb(size, gfp_mask);
+ 
+ 	if (!n)
+@@ -922,7 +922,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
+ {
+ 	int i;
+ 	u8 *data;
+-	int size = nhead + (skb_end_pointer(skb) - skb->head) + ntail;
++	int size = nhead + skb_end_offset(skb) + ntail;
+ 	long off;
+ 	bool fastpath;
+ 
+@@ -2721,14 +2721,13 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
+ 			if (unlikely(!nskb))
+ 				goto err;
+ 
+-			hsize = skb_end_pointer(nskb) - nskb->head;
++			hsize = skb_end_offset(nskb);
+ 			if (skb_cow_head(nskb, doffset + headroom)) {
+ 				kfree_skb(nskb);
+ 				goto err;
+ 			}
+ 
+-			nskb->truesize += skb_end_pointer(nskb) - nskb->head -
+-					  hsize;
++			nskb->truesize += skb_end_offset(nskb) - hsize;
+ 			skb_release_head_state(nskb);
+ 			__skb_push(nskb, doffset);
+ 		} else {
+@@ -3297,12 +3296,14 @@ EXPORT_SYMBOL(__skb_warn_lro_forwarding);
+ unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
+ {
+ 	const struct skb_shared_info *shinfo = skb_shinfo(skb);
+-	unsigned int hdr_len;
+ 
+ 	if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
+-		hdr_len = tcp_hdrlen(skb);
+-	else
+-		hdr_len = sizeof(struct udphdr);
+-	return hdr_len + shinfo->gso_size;
++		return tcp_hdrlen(skb) + shinfo->gso_size;
++
++	/* UFO sets gso_size to the size of the fragmentation
++	 * payload, i.e. the size of the L4 (UDP) header is already
++	 * accounted for.
++	 */
++	return shinfo->gso_size;
+ }
+ EXPORT_SYMBOL_GPL(skb_gso_transport_seglen);
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
+index 8861f91a07cf..8d244eaf6b0d 100644
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -751,13 +751,13 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
+ 	fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
+ 	if (fi == NULL)
+ 		goto failure;
++	fib_info_cnt++;
+ 	if (cfg->fc_mx) {
+ 		fi->fib_metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
+ 		if (!fi->fib_metrics)
+ 			goto failure;
+ 	} else
+ 		fi->fib_metrics = (u32 *) dst_default_metrics;
+-	fib_info_cnt++;
+ 
+ 	fi->fib_net = hold_net(net);
+ 	fi->fib_protocol = cfg->fc_protocol;
+diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
+index e0d9f02fec11..7593f3a46035 100644
+--- a/net/ipv4/ip_forward.c
++++ b/net/ipv4/ip_forward.c
+@@ -42,12 +42,12 @@
+ static bool ip_may_fragment(const struct sk_buff *skb)
+ {
+ 	return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ||
+-	       !skb->local_df;
++		skb->local_df;
+ }
+ 
+ static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
+ {
+-	if (skb->len <= mtu || skb->local_df)
++	if (skb->len <= mtu)
+ 		return false;
+ 
+ 	if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index e80db1e6b0b2..cb9085272dd7 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -203,26 +203,33 @@ static int ping_init_sock(struct sock *sk)
+ 	struct net *net = sock_net(sk);
+ 	gid_t group = current_egid();
+ 	gid_t range[2];
+-	struct group_info *group_info = get_current_groups();
+-	int i, j, count = group_info->ngroups;
++	struct group_info *group_info;
++	int i, j, count;
++	int ret = 0;
+ 
+ 	inet_get_ping_group_range_net(net, range, range+1);
+ 	if (range[0] <= group && group <= range[1])
+ 		return 0;
+ 
++	group_info = get_current_groups();
++	count = group_info->ngroups;
+ 	for (i = 0; i < group_info->nblocks; i++) {
+ 		int cp_count = min_t(int, NGROUPS_PER_BLOCK, count);
+ 
+ 		for (j = 0; j < cp_count; j++) {
+ 			group = group_info->blocks[i][j];
+ 			if (range[0] <= group && group <= range[1])
+-				return 0;
++				goto out_release_group;
+ 		}
+ 
+ 		count -= cp_count;
+ 	}
+ 
+-	return -EACCES;
++	ret = -EACCES;
++
++out_release_group:
++	put_group_info(group_info);
++	return ret;
+ }
+ 
+ static void ping_close(struct sock *sk, long timeout)
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 108c73d760df..90bc88bbd2a4 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -2129,7 +2129,7 @@ static int __mkroute_input(struct sk_buff *skb,
+ 	struct in_device *out_dev;
+ 	unsigned int flags = 0;
+ 	__be32 spec_dst;
+-	u32 itag;
++	u32 itag = 0;
+ 
+ 	/* get a working reference to the output device */
+ 	out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));
+diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
+index b6ae92a51f58..894b7cea5d7b 100644
+--- a/net/ipv4/tcp_cubic.c
++++ b/net/ipv4/tcp_cubic.c
+@@ -408,7 +408,7 @@ static void bictcp_acked(struct sock *sk, u32 cnt, s32 rtt_us)
+ 		ratio -= ca->delayed_ack >> ACK_RATIO_SHIFT;
+ 		ratio += cnt;
+ 
+-		ca->delayed_ack = min(ratio, ACK_RATIO_LIMIT);
++		ca->delayed_ack = clamp(ratio, 1U, ACK_RATIO_LIMIT);
+ 	}
+ 
+ 	/* Some calls are for duplicates without timetamps */
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index b685f99ffb18..c8643a3d2658 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1092,7 +1092,7 @@ static unsigned int ip6_mtu(const struct dst_entry *dst)
+ 	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
+ 
+ 	if (mtu)
+-		return mtu;
++		goto out;
+ 
+ 	mtu = IPV6_MIN_MTU;
+ 
+@@ -1102,7 +1102,8 @@ static unsigned int ip6_mtu(const struct dst_entry *dst)
+ 		mtu = idev->cnf.mtu6;
+ 	rcu_read_unlock();
+ 
+-	return mtu;
++out:
++	return min_t(unsigned int, mtu, IP6_MAX_MTU);
+ }
+ 
+ static struct dst_entry *icmp6_dst_gc_list;
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index 22112754ba06..4e38a81e48ee 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -772,9 +772,9 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ 	session->deref = pppol2tp_session_sock_put;
+ 
+ 	/* If PMTU discovery was enabled, use the MTU that was discovered */
+-	dst = sk_dst_get(sk);
++	dst = sk_dst_get(tunnel->sock);
+ 	if (dst != NULL) {
+-		u32 pmtu = dst_mtu(__sk_dst_get(sk));
++		u32 pmtu = dst_mtu(__sk_dst_get(tunnel->sock));
+ 		if (pmtu != 0)
+ 			session->mtu = session->mru = pmtu -
+ 				PPPOL2TP_HEADER_OVERHEAD;
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 6937a84bef3a..f5ed86388555 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2828,6 +2828,9 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
+ 	case NL80211_IFTYPE_ADHOC:
+ 		if (!bssid)
+ 			return 0;
++		if (compare_ether_addr(sdata->vif.addr, hdr->addr2) == 0 ||
++		    compare_ether_addr(sdata->u.ibss.bssid, hdr->addr2) == 0)
++			return 0;
+ 		if (ieee80211_is_beacon(hdr->frame_control)) {
+ 			return 1;
+ 		}
+diff --git a/net/mac80211/status.c b/net/mac80211/status.c
+index b992a49fbe08..9e888970a7e4 100644
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -432,7 +432,11 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
+ 				       IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
+ 				      IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
+ 
+-				ieee80211_set_bar_pending(sta, tid, ssn);
++				if (local->hw.flags &
++				    IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL)
++					ieee80211_stop_tx_ba_session(&sta->sta, tid);
++				else
++					ieee80211_set_bar_pending(sta, tid, ssn);
+ 			}
+ 		}
+ 
+diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
+index e051398fdf6b..d067ed16bab1 100644
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -201,13 +201,12 @@ static int tcf_mirred(struct sk_buff *skb, const struct tc_action *a,
+ out:
+ 	if (err) {
+ 		m->tcf_qstats.overlimits++;
+-		/* should we be asking for packet to be dropped?
+-		 * may make sense for redirect case only
+-		 */
+-		retval = TC_ACT_SHOT;
+-	} else {
++		if (m->tcfm_eaction != TCA_EGRESS_MIRROR)
++			retval = TC_ACT_SHOT;
++		else
++			retval = m->tcf_action;
++	} else
+ 		retval = m->tcf_action;
+-	}
+ 	spin_unlock(&m->tcf_lock);
+ 
+ 	return retval;
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 0ed156b537d2..0c0bd2fe9aca 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -6369,6 +6369,46 @@ static void __sctp_write_space(struct sctp_association *asoc)
+ 	}
+ }
+ 
++static void sctp_wake_up_waiters(struct sock *sk,
++				 struct sctp_association *asoc)
++{
++	struct sctp_association *tmp = asoc;
++
++	/* We do accounting for the sndbuf space per association,
++	 * so we only need to wake our own association.
++	 */
++	if (asoc->ep->sndbuf_policy)
++		return __sctp_write_space(asoc);
++
++	/* If association goes down and is just flushing its
++	 * outq, then just normally notify others.
++	 */
++	if (asoc->base.dead)
++		return sctp_write_space(sk);
++
++	/* Accounting for the sndbuf space is per socket, so we
++	 * need to wake up others, try to be fair and in case of
++	 * other associations, let them have a go first instead
++	 * of just doing a sctp_write_space() call.
++	 *
++	 * Note that we reach sctp_wake_up_waiters() only when
++	 * associations free up queued chunks, thus we are under
++	 * lock and the list of associations on a socket is
++	 * guaranteed not to change.
++	 */
++	for (tmp = list_next_entry(tmp, asocs); 1;
++	     tmp = list_next_entry(tmp, asocs)) {
++		/* Manually skip the head element. */
++		if (&tmp->asocs == &((sctp_sk(sk))->ep->asocs))
++			continue;
++		/* Wake up association. */
++		__sctp_write_space(tmp);
++		/* We've reached the end. */
++		if (tmp == asoc)
++			break;
++	}
++}
++
+ /* Do accounting for the sndbuf space.
+  * Decrement the used sndbuf space of the corresponding association by the
+  * data size which was just transmitted(freed).
+@@ -6396,7 +6436,7 @@ static void sctp_wfree(struct sk_buff *skb)
+ 	sk_mem_uncharge(sk, skb->truesize);
+ 
+ 	sock_wfree(skb);
+-	__sctp_write_space(asoc);
++	sctp_wake_up_waiters(sk, asoc);
+ 
+ 	sctp_association_put(asoc);
+ }
+diff --git a/net/wireless/sme.c b/net/wireless/sme.c
+index f7e937ff8978..3fd50a11c150 100644
+--- a/net/wireless/sme.c
++++ b/net/wireless/sme.c
+@@ -222,6 +222,9 @@ void cfg80211_conn_work(struct work_struct *work)
+ 	mutex_lock(&rdev->devlist_mtx);
+ 
+ 	list_for_each_entry(wdev, &rdev->netdev_list, list) {
++		if (!wdev->netdev)
++			continue;
++
+ 		wdev_lock(wdev);
+ 		if (!netif_running(wdev->netdev)) {
+ 			wdev_unlock(wdev);
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 17d80b2694a2..20cfc5b44710 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -4430,7 +4430,9 @@ static void apply_fixup(struct hda_codec *codec,
+ 	 struct conexant_spec *spec = codec->spec;
+ 
+ 	quirk = snd_pci_quirk_lookup(codec->bus->pci, quirk);
+-	if (quirk && table[quirk->value]) {
++	if (!quirk)
++		return;
++	if (table[quirk->value]) {
+ 		snd_printdd(KERN_INFO "hda_codec: applying pincfg for %s\n",
+ 			    quirk->name);
+ 		apply_pincfg(codec, table[quirk->value]);
+@@ -4471,12 +4473,15 @@ static const struct snd_pci_quirk cxt5051_fixups[] = {
+ };
+ 
+ static const struct snd_pci_quirk cxt5066_fixups[] = {
++	SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC),
+ 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
+ 	SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410),
+ 	SND_PCI_QUIRK(0x17aa, 0x215f, "Lenovo T510", CXT_PINCFG_LENOVO_TP410),
+ 	SND_PCI_QUIRK(0x17aa, 0x21ce, "Lenovo T420", CXT_PINCFG_LENOVO_TP410),
+ 	SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
+ 	SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
++	SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
++	SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
+ 	{}
+ };
+ 
+@@ -4567,10 +4572,6 @@ static int patch_conexant_auto(struct hda_codec *codec)
+  */
+ 
+ static const struct hda_codec_preset snd_hda_preset_conexant[] = {
+-	{ .id = 0x14f11510, .name = "CX20751/2",
+-	  .patch = patch_conexant_auto },
+-	{ .id = 0x14f11511, .name = "CX20753/4",
+-	  .patch = patch_conexant_auto },
+ 	{ .id = 0x14f15045, .name = "CX20549 (Venice)",
+ 	  .patch = patch_cxt5045 },
+ 	{ .id = 0x14f15047, .name = "CX20551 (Waikiki)",
+@@ -4605,11 +4606,23 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = {
+ 	  .patch = patch_conexant_auto },
+ 	{ .id = 0x14f150b9, .name = "CX20665",
+ 	  .patch = patch_conexant_auto },
++	{ .id = 0x14f1510f, .name = "CX20751/2",
++	  .patch = patch_conexant_auto },
++	{ .id = 0x14f15110, .name = "CX20751/2",
++	  .patch = patch_conexant_auto },
++	{ .id = 0x14f15111, .name = "CX20753/4",
++	  .patch = patch_conexant_auto },
++	{ .id = 0x14f15113, .name = "CX20755",
++	  .patch = patch_conexant_auto },
++	{ .id = 0x14f15114, .name = "CX20756",
++	  .patch = patch_conexant_auto },
++	{ .id = 0x14f15115, .name = "CX20757",
++	  .patch = patch_conexant_auto },
++	{ .id = 0x14f151d7, .name = "CX20952",
++	  .patch = patch_conexant_auto },
+ 	{} /* terminator */
+ };
+ 
+-MODULE_ALIAS("snd-hda-codec-id:14f11510");
+-MODULE_ALIAS("snd-hda-codec-id:14f11511");
+ MODULE_ALIAS("snd-hda-codec-id:14f15045");
+ MODULE_ALIAS("snd-hda-codec-id:14f15047");
+ MODULE_ALIAS("snd-hda-codec-id:14f15051");
+@@ -4627,6 +4640,13 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab");
+ MODULE_ALIAS("snd-hda-codec-id:14f150ac");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b8");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b9");
++MODULE_ALIAS("snd-hda-codec-id:14f1510f");
++MODULE_ALIAS("snd-hda-codec-id:14f15110");
++MODULE_ALIAS("snd-hda-codec-id:14f15111");
++MODULE_ALIAS("snd-hda-codec-id:14f15113");
++MODULE_ALIAS("snd-hda-codec-id:14f15114");
++MODULE_ALIAS("snd-hda-codec-id:14f15115");
++MODULE_ALIAS("snd-hda-codec-id:14f151d7");
+ 
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Conexant HD-audio codec");
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 0b5132f79750..451ec4800f4e 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -153,6 +153,7 @@ static struct reg_default wm8962_reg[] = {
+ 	{ 40, 0x0000 },   /* R40    - SPKOUTL volume */
+ 	{ 41, 0x0000 },   /* R41    - SPKOUTR volume */
+ 
++	{ 49, 0x0010 },   /* R49    - Class D Control 1 */
+ 	{ 51, 0x0003 },   /* R51    - Class D Control 2 */
+ 
+ 	{ 56, 0x0506 },   /* R56    - Clocking 4 */
+@@ -794,7 +795,6 @@ static bool wm8962_volatile_register(struct device *dev, unsigned int reg)
+ 	case WM8962_ALC2:
+ 	case WM8962_THERMAL_SHUTDOWN_STATUS:
+ 	case WM8962_ADDITIONAL_CONTROL_4:
+-	case WM8962_CLASS_D_CONTROL_1:
+ 	case WM8962_DC_SERVO_6:
+ 	case WM8962_INTERRUPT_STATUS_1:
+ 	case WM8962_INTERRUPT_STATUS_2:
+@@ -2888,13 +2888,22 @@ static int wm8962_set_fll(struct snd_soc_codec *codec, int fll_id, int source,
+ static int wm8962_mute(struct snd_soc_dai *dai, int mute)
+ {
+ 	struct snd_soc_codec *codec = dai->codec;
+-	int val;
++	int val, ret;
+ 
+ 	if (mute)
+-		val = WM8962_DAC_MUTE;
++		val = WM8962_DAC_MUTE | WM8962_DAC_MUTE_ALT;
+ 	else
+ 		val = 0;
+ 
++	/**
++	 * The DAC mute bit is mirrored in two registers, update both to keep
++	 * the register cache consistent.
++	 */
++	ret = snd_soc_update_bits(codec, WM8962_CLASS_D_CONTROL_1,
++				  WM8962_DAC_MUTE_ALT, val);
++	if (ret < 0)
++		return ret;
++
+ 	return snd_soc_update_bits(codec, WM8962_ADC_DAC_CONTROL_1,
+ 				   WM8962_DAC_MUTE, val);
+ }
+diff --git a/sound/soc/codecs/wm8962.h b/sound/soc/codecs/wm8962.h
+index a1a5d5294c19..910aafd09d21 100644
+--- a/sound/soc/codecs/wm8962.h
++++ b/sound/soc/codecs/wm8962.h
+@@ -1954,6 +1954,10 @@
+ #define WM8962_SPKOUTL_ENA_MASK                 0x0040  /* SPKOUTL_ENA */
+ #define WM8962_SPKOUTL_ENA_SHIFT                     6  /* SPKOUTL_ENA */
+ #define WM8962_SPKOUTL_ENA_WIDTH                     1  /* SPKOUTL_ENA */
++#define WM8962_DAC_MUTE_ALT                     0x0010  /* DAC_MUTE */
++#define WM8962_DAC_MUTE_ALT_MASK                0x0010  /* DAC_MUTE */
++#define WM8962_DAC_MUTE_ALT_SHIFT                    4  /* DAC_MUTE */
++#define WM8962_DAC_MUTE_ALT_WIDTH                    1  /* DAC_MUTE */
+ #define WM8962_SPKOUTL_PGA_MUTE                 0x0002  /* SPKOUTL_PGA_MUTE */
+ #define WM8962_SPKOUTL_PGA_MUTE_MASK            0x0002  /* SPKOUTL_PGA_MUTE */
+ #define WM8962_SPKOUTL_PGA_MUTE_SHIFT                1  /* SPKOUTL_PGA_MUTE */

Deleted: genpatches-2.6/trunk/3.4/1501-futex-add-another-early-deadlock-detection-check.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1501-futex-add-another-early-deadlock-detection-check.patch	2014-06-09 12:35:00 UTC (rev 2820)
+++ genpatches-2.6/trunk/3.4/1501-futex-add-another-early-deadlock-detection-check.patch	2014-06-09 17:53:50 UTC (rev 2821)
@@ -1,160 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Mon, 12 May 2014 20:45:34 +0000
-Subject: futex: Add another early deadlock detection check
-Git-commit: 866293ee54227584ffcb4a42f69c1f365974ba7f
-
-Dave Jones trinity syscall fuzzer exposed an issue in the deadlock
-detection code of rtmutex:
-  http://lkml.kernel.org/r/20140429151655.GA14277@××××××.com
-
-That underlying issue has been fixed with a patch to the rtmutex code,
-but the futex code must not call into rtmutex in that case because
-    - it can detect that issue early
-    - it avoids a different and more complex fixup for backing out
-
-If the user space variable got manipulated to 0x80000000 which means
-no lock holder, but the waiters bit set and an active pi_state in the
-kernel is found we can figure out the recursive locking issue by
-looking at the pi_state owner. If that is the current task, then we
-can safely return -EDEADLK.
-
-The check should have been added in commit 59fa62451 (futex: Handle
-futex_pi OWNER_DIED take over correctly) already, but I did not see
-the above issue caused by user space manipulation back then.
-
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: Dave Jones <davej@××××××.com>
-Cc: Linus Torvalds <torvalds@××××××××××××××××.org>
-Cc: Peter Zijlstra <peterz@×××××××××.org>
-Cc: Darren Hart <darren@××××××.com>
-Cc: Davidlohr Bueso <davidlohr@××.com>
-Cc: Steven Rostedt <rostedt@×××××××.org>
-Cc: Clark Williams <williams@××××××.com>
-Cc: Paul McKenney <paulmck@××××××××××××××.com>
-Cc: Lai Jiangshan <laijs@××××××××××.com>
-Cc: Roland McGrath <roland@×××××××××.com>
-Cc: Carlos ODonell <carlos@××××××.com>
-Cc: Jakub Jelinek <jakub@××××××.com>
-Cc: Michael Kerrisk <mtk.manpages@×××××.com>
-Cc: Sebastian Andrzej Siewior <bigeasy@××××××××××.de>
-Link: http://lkml.kernel.org/r/20140512201701.097349971@××××××××××.de
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: stable@×××××××××××.org
----
- kernel/futex.c | 47 ++++++++++++++++++++++++++++++++++-------------
- 1 file changed, 34 insertions(+), 13 deletions(-)
-
-Index: linux-3.4/kernel/futex.c
-===================================================================
---- linux-3.4.orig/kernel/futex.c
-+++ linux-3.4/kernel/futex.c
-@@ -590,7 +590,8 @@ void exit_pi_state_list(struct task_stru
- 
- static int
- lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
--		union futex_key *key, struct futex_pi_state **ps)
-+		union futex_key *key, struct futex_pi_state **ps,
-+		struct task_struct *task)
- {
- 	struct futex_pi_state *pi_state = NULL;
- 	struct futex_q *this, *next;
-@@ -634,6 +635,16 @@ lookup_pi_state(u32 uval, struct futex_h
- 					return -EINVAL;
- 			}
- 
-+			/*
-+			 * Protect against a corrupted uval. If uval
-+			 * is 0x80000000 then pid is 0 and the waiter
-+			 * bit is set. So the deadlock check in the
-+			 * calling code has failed and we did not fall
-+			 * into the check above due to !pid.
-+			 */
-+			if (task && pi_state->owner == task)
-+				return -EDEADLK;
-+
- 			atomic_inc(&pi_state->refcount);
- 			*ps = pi_state;
- 
-@@ -783,7 +794,7 @@ retry:
- 	 * We dont have the lock. Look up the PI state (or create it if
- 	 * we are the first waiter):
- 	 */
--	ret = lookup_pi_state(uval, hb, key, ps);
-+	ret = lookup_pi_state(uval, hb, key, ps, task);
- 
- 	if (unlikely(ret)) {
- 		switch (ret) {
-@@ -1193,7 +1204,7 @@ void requeue_pi_wake_futex(struct futex_
-  *
-  * Returns:
-  *  0 - failed to acquire the lock atomicly
-- *  1 - acquired the lock
-+ * >0 - acquired the lock, return value is vpid of the top_waiter
-  * <0 - error
-  */
- static int futex_proxy_trylock_atomic(u32 __user *pifutex,
-@@ -1204,7 +1215,7 @@ static int futex_proxy_trylock_atomic(u3
- {
- 	struct futex_q *top_waiter = NULL;
- 	u32 curval;
--	int ret;
-+	int ret, vpid;
- 
- 	if (get_futex_value_locked(&curval, pifutex))
- 		return -EFAULT;
-@@ -1232,11 +1243,13 @@ static int futex_proxy_trylock_atomic(u3
- 	 * the contended case or if set_waiters is 1.  The pi_state is returned
- 	 * in ps in contended cases.
- 	 */
-+	vpid = task_pid_vnr(top_waiter->task);
- 	ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
- 				   set_waiters);
--	if (ret == 1)
-+	if (ret == 1) {
- 		requeue_pi_wake_futex(top_waiter, key2, hb2);
--
-+		return vpid;
-+	}
- 	return ret;
- }
- 
-@@ -1268,7 +1281,6 @@ static int futex_requeue(u32 __user *uad
- 	struct futex_hash_bucket *hb1, *hb2;
- 	struct plist_head *head1;
- 	struct futex_q *this, *next;
--	u32 curval2;
- 
- 	if (requeue_pi) {
- 		/*
-@@ -1354,16 +1366,25 @@ retry_private:
- 		 * At this point the top_waiter has either taken uaddr2 or is
- 		 * waiting on it.  If the former, then the pi_state will not
- 		 * exist yet, look it up one more time to ensure we have a
--		 * reference to it.
-+		 * reference to it. If the lock was taken, ret contains the
-+		 * vpid of the top waiter task.
- 		 */
--		if (ret == 1) {
-+		if (ret > 0) {
- 			WARN_ON(pi_state);
- 			drop_count++;
- 			task_count++;
--			ret = get_futex_value_locked(&curval2, uaddr2);
--			if (!ret)
--				ret = lookup_pi_state(curval2, hb2, &key2,
--						      &pi_state);
-+			/*
-+			 * If we acquired the lock, then the user
-+			 * space value of uaddr2 should be vpid. It
-+			 * cannot be changed by the top waiter as it
-+			 * is blocked on hb2 lock if it tries to do
-+			 * so. If something fiddled with it behind our
-+			 * back the pi state lookup might unearth
-+			 * it. So we rather use the known value than
-+			 * rereading and handing potential crap to
-+			 * lookup_pi_state.
-+			 */
-+			ret = lookup_pi_state(ret, hb2, &key2, &pi_state, NULL);
- 		}
- 
- 		switch (ret) {

Deleted: genpatches-2.6/trunk/3.4/1502-futex-prevent-attaching-to-kernel-threads.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1502-futex-prevent-attaching-to-kernel-threads.patch	2014-06-09 12:35:00 UTC (rev 2820)
+++ genpatches-2.6/trunk/3.4/1502-futex-prevent-attaching-to-kernel-threads.patch	2014-06-09 17:53:50 UTC (rev 2821)
@@ -1,52 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Mon, 12 May 2014 20:45:35 +0000
-Subject: futex: Prevent attaching to kernel threads
-Git-commit: f0d71b3dcb8332f7971b5f2363632573e6d9486a
-
-We happily allow userspace to declare a random kernel thread to be the
-owner of a user space PI futex.
-
-Found while analysing the fallout of Dave Jones syscall fuzzer.
-
-We also should validate the thread group for private futexes and find
-some fast way to validate whether the "alleged" owner has RW access on
-the file which backs the SHM, but that's a separate issue.
-
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: Dave Jones <davej@××××××.com>
-Cc: Linus Torvalds <torvalds@××××××××××××××××.org>
-Cc: Peter Zijlstra <peterz@×××××××××.org>
-Cc: Darren Hart <darren@××××××.com>
-Cc: Davidlohr Bueso <davidlohr@××.com>
-Cc: Steven Rostedt <rostedt@×××××××.org>
-Cc: Clark Williams <williams@××××××.com>
-Cc: Paul McKenney <paulmck@××××××××××××××.com>
-Cc: Lai Jiangshan <laijs@××××××××××.com>
-Cc: Roland McGrath <roland@×××××××××.com>
-Cc: Carlos ODonell <carlos@××××××.com>
-Cc: Jakub Jelinek <jakub@××××××.com>
-Cc: Michael Kerrisk <mtk.manpages@×××××.com>
-Cc: Sebastian Andrzej Siewior <bigeasy@××××××××××.de>
-Link: http://lkml.kernel.org/r/20140512201701.194824402@××××××××××.de
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: stable@×××××××××××.org
----
- kernel/futex.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-Index: linux-3.4/kernel/futex.c
-===================================================================
---- linux-3.4.orig/kernel/futex.c
-+++ linux-3.4/kernel/futex.c
-@@ -662,6 +662,11 @@ lookup_pi_state(u32 uval, struct futex_h
- 	if (!p)
- 		return -ESRCH;
- 
-+	if (!p->mm) {
-+		put_task_struct(p);
-+		return -EPERM;
-+	}
-+
- 	/*
- 	 * We need to look at the task state flags to figure out,
- 	 * whether the task is exiting. To protect against the do_exit

Deleted: genpatches-2.6/trunk/3.4/1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch	2014-06-09 12:35:00 UTC (rev 2820)
+++ genpatches-2.6/trunk/3.4/1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch	2014-06-09 17:53:50 UTC (rev 2821)
@@ -1,81 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Tue, 3 Jun 2014 12:27:06 +0000
-Subject: futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr ==
- uaddr2 in futex_requeue(..., requeue_pi=1)
-Git-commit: e9c243a5a6de0be8e584c604d353412584b592f8
-
-If uaddr == uaddr2, then we have broken the rule of only requeueing from
-a non-pi futex to a pi futex with this call.  If we attempt this, then
-dangling pointers may be left for rt_waiter resulting in an exploitable
-condition.
-
-This change brings futex_requeue() in line with futex_wait_requeue_pi()
-which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
-uaddr == uaddr2 in futex_wait_requeue_pi()")
-
-[ tglx: Compare the resulting keys as well, as uaddrs might be
-  	different depending on the mapping ]
-
-Fixes CVE-2014-3153.
-
-Reported-by: Pinkie Pie
-Signed-off-by: Will Drewry <wad@××××××××.org>
-Signed-off-by: Kees Cook <keescook@××××××××.org>
-Cc: stable@×××××××××××.org
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Reviewed-by: Darren Hart <dvhart@×××××××××××.com>
-Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
----
- kernel/futex.c | 25 +++++++++++++++++++++++++
- 1 file changed, 25 insertions(+)
-
-Index: linux-3.4/kernel/futex.c
-===================================================================
---- linux-3.4.orig/kernel/futex.c
-+++ linux-3.4/kernel/futex.c
-@@ -1289,6 +1289,13 @@ static int futex_requeue(u32 __user *uad
- 
- 	if (requeue_pi) {
- 		/*
-+		 * Requeue PI only works on two distinct uaddrs. This
-+		 * check is only valid for private futexes. See below.
-+		 */
-+		if (uaddr1 == uaddr2)
-+			return -EINVAL;
-+
-+		/*
- 		 * requeue_pi requires a pi_state, try to allocate it now
- 		 * without any locks in case it fails.
- 		 */
-@@ -1326,6 +1333,15 @@ retry:
- 	if (unlikely(ret != 0))
- 		goto out_put_key1;
- 
-+	/*
-+	 * The check above which compares uaddrs is not sufficient for
-+	 * shared futexes. We need to compare the keys:
-+	 */
-+	if (requeue_pi && match_futex(&key1, &key2)) {
-+		ret = -EINVAL;
-+		goto out_put_keys;
-+	}
-+
- 	hb1 = hash_futex(&key1);
- 	hb2 = hash_futex(&key2);
- 
-@@ -2357,6 +2373,15 @@ static int futex_wait_requeue_pi(u32 __u
- 	if (ret)
- 		goto out_key2;
- 
-+	/*
-+	 * The check above which compares uaddrs is not sufficient for
-+	 * shared futexes. We need to compare the keys:
-+	 */
-+	if (match_futex(&q.key, &key2)) {
-+		ret = -EINVAL;
-+		goto out_put_keys;
-+	}
-+
- 	/* Queue the futex_q, drop the hb lock, wait for wakeup. */
- 	futex_wait_queue_me(hb, &q, to);
- 

Deleted: genpatches-2.6/trunk/3.4/1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch	2014-06-09 12:35:00 UTC (rev 2820)
+++ genpatches-2.6/trunk/3.4/1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch	2014-06-09 17:53:50 UTC (rev 2821)
@@ -1,53 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Tue, 3 Jun 2014 12:27:06 +0000
-Subject: futex: Validate atomic acquisition in futex_lock_pi_atomic()
-Git-commit: b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270
-
-We need to protect the atomic acquisition in the kernel against rogue
-user space which sets the user space futex to 0, so the kernel side
-acquisition succeeds while there is existing state in the kernel
-associated to the real owner.
-
-Verify whether the futex has waiters associated with kernel state.  If
-it has, return -EINVAL.  The state is corrupted already, so no point in
-cleaning it up.  Subsequent calls will fail as well.  Not our problem.
-
-[ tglx: Use futex_top_waiter() and explain why we do not need to try
-  	restoring the already corrupted user space state. ]
-
-Signed-off-by: Darren Hart <dvhart@×××××××××××.com>
-Cc: Kees Cook <keescook@××××××××.org>
-Cc: Will Drewry <wad@××××××××.org>
-Cc: stable@×××××××××××.org
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
----
- kernel/futex.c | 14 +++++++++++---
- 1 file changed, 11 insertions(+), 3 deletions(-)
-
-Index: linux-3.4/kernel/futex.c
-===================================================================
---- linux-3.4.orig/kernel/futex.c
-+++ linux-3.4/kernel/futex.c
-@@ -758,10 +758,18 @@ retry:
- 		return -EDEADLK;
- 
- 	/*
--	 * Surprise - we got the lock. Just return to userspace:
-+	 * Surprise - we got the lock, but we do not trust user space at all.
- 	 */
--	if (unlikely(!curval))
--		return 1;
-+	if (unlikely(!curval)) {
-+		/*
-+		 * We verify whether there is kernel state for this
-+		 * futex. If not, we can safely assume, that the 0 ->
-+		 * TID transition is correct. If state exists, we do
-+		 * not bother to fixup the user space state as it was
-+		 * corrupted already.
-+		 */
-+		return futex_top_waiter(hb, key) ? -EINVAL : 1;
-+	}
- 
- 	uval = curval;
- 

Deleted: genpatches-2.6/trunk/3.4/1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch	2014-06-09 12:35:00 UTC (rev 2820)
+++ genpatches-2.6/trunk/3.4/1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch	2014-06-09 17:53:50 UTC (rev 2821)
@@ -1,99 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Tue, 3 Jun 2014 12:27:07 +0000
-Subject: futex: Always cleanup owner tid in unlock_pi
-Git-commit: 13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e
-
-If the owner died bit is set at futex_unlock_pi, we currently do not
-cleanup the user space futex.  So the owner TID of the current owner
-(the unlocker) persists.  That's observable inconsistant state,
-especially when the ownership of the pi state got transferred.
-
-Clean it up unconditionally.
-
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: Kees Cook <keescook@××××××××.org>
-Cc: Will Drewry <wad@××××××××.org>
-Cc: Darren Hart <dvhart@×××××××××××.com>
-Cc: stable@×××××××××××.org
-Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
----
- kernel/futex.c | 40 ++++++++++++++++++----------------------
- 1 file changed, 18 insertions(+), 22 deletions(-)
-
-Index: linux-3.4/kernel/futex.c
-===================================================================
---- linux-3.4.orig/kernel/futex.c
-+++ linux-3.4/kernel/futex.c
-@@ -899,6 +899,7 @@ static int wake_futex_pi(u32 __user *uad
- 	struct task_struct *new_owner;
- 	struct futex_pi_state *pi_state = this->pi_state;
- 	u32 uninitialized_var(curval), newval;
-+	int ret = 0;
- 
- 	if (!pi_state)
- 		return -EINVAL;
-@@ -922,23 +923,19 @@ static int wake_futex_pi(u32 __user *uad
- 		new_owner = this->task;
- 
- 	/*
--	 * We pass it to the next owner. (The WAITERS bit is always
--	 * kept enabled while there is PI state around. We must also
--	 * preserve the owner died bit.)
--	 */
--	if (!(uval & FUTEX_OWNER_DIED)) {
--		int ret = 0;
--
--		newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
--
--		if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
--			ret = -EFAULT;
--		else if (curval != uval)
--			ret = -EINVAL;
--		if (ret) {
--			raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
--			return ret;
--		}
-+	 * We pass it to the next owner. The WAITERS bit is always
-+	 * kept enabled while there is PI state around. We cleanup the
-+	 * owner died bit, because we are the owner.
-+	 */
-+	newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
-+
-+	if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
-+		ret = -EFAULT;
-+	else if (curval != uval)
-+		ret = -EINVAL;
-+	if (ret) {
-+		raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
-+		return ret;
- 	}
- 
- 	raw_spin_lock_irq(&pi_state->owner->pi_lock);
-@@ -2183,9 +2180,10 @@ retry:
- 	/*
- 	 * To avoid races, try to do the TID -> 0 atomic transition
- 	 * again. If it succeeds then we can return without waking
--	 * anyone else up:
-+	 * anyone else up. We only try this if neither the waiters nor
-+	 * the owner died bit are set.
- 	 */
--	if (!(uval & FUTEX_OWNER_DIED) &&
-+	if (!(uval & ~FUTEX_TID_MASK) &&
- 	    cmpxchg_futex_value_locked(&uval, uaddr, vpid, 0))
- 		goto pi_faulted;
- 	/*
-@@ -2217,11 +2215,9 @@ retry:
- 	/*
- 	 * No waiters - kernel unlocks the futex:
- 	 */
--	if (!(uval & FUTEX_OWNER_DIED)) {
--		ret = unlock_futex_pi(uaddr, uval);
--		if (ret == -EFAULT)
--			goto pi_faulted;
--	}
-+	ret = unlock_futex_pi(uaddr, uval);
-+	if (ret == -EFAULT)
-+		goto pi_faulted;
- 
- out_unlock:
- 	spin_unlock(&hb->lock);

Deleted: genpatches-2.6/trunk/3.4/1506-futex-make-lookup_pi_state-more-robust.patch
===================================================================
(Binary files differ)

Deleted: genpatches-2.6/trunk/3.4/2700_thinkpad-acpi_fix-issuing-duplicated-keyevents-for-brightness.patch
===================================================================
--- genpatches-2.6/trunk/3.4/2700_thinkpad-acpi_fix-issuing-duplicated-keyevents-for-brightness.patch	2014-06-09 12:35:00 UTC (rev 2820)
+++ genpatches-2.6/trunk/3.4/2700_thinkpad-acpi_fix-issuing-duplicated-keyevents-for-brightness.patch	2014-06-09 17:53:50 UTC (rev 2821)
@@ -1,26 +0,0 @@
-The tp_features.bright_acpimode will not be set correctly for brightness
-control because ACPI_VIDEO_HID will not be located in ACPI. As a result,
-a duplicated key event will always be sent. acpi_video_backlight_support()
-is sufficient to detect standard ACPI brightness control.
-
-Signed-off-by: Alex Hung <alex.hung@xxxxxxxxxxxxx>
----
- drivers/platform/x86/thinkpad_acpi.c |    2 +-
- 1 files changed, 1 insertions(+), 1 deletions(-)
-
-diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
-index 7b82868..7d032d5 100644
---- a/drivers/platform/x86/thinkpad_acpi.c
-+++ b/drivers/platform/x86/thinkpad_acpi.c
-@@ -3405,7 +3405,7 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
- 	/* Do not issue duplicate brightness change events to
- 	 * userspace. tpacpi_detect_brightness_capabilities() must have
- 	 * been called before this point  */
--	if (tp_features.bright_acpimode && acpi_video_backlight_support()) {
-+	if (acpi_video_backlight_support()) {
- 		pr_info("This ThinkPad has standard ACPI backlight "
- 			"brightness control, supported by the ACPI "
- 			"video driver\n");
--- 
-1.7.0.4
-