[gentoo-commits] linux-patches r2529 - in genpatches-2.6/trunk: 3.0 3.10 3.11 3.4

[Tom Wijsman (tomwij)]

Author: tomwij
Date: 2013-09-27 17:20:08 +0000 (Fri, 27 Sep 2013)
New Revision: 2529

Added:
   genpatches-2.6/trunk/3.0/1096_linux-3.0.97.patch
   genpatches-2.6/trunk/3.10/1012_linux-3.10.13.patch
   genpatches-2.6/trunk/3.11/1001_linux-3.11.2.patch
   genpatches-2.6/trunk/3.4/1062_linux-3.4.63.patch
Removed:
   genpatches-2.6/trunk/3.10/1500_CVE-2013-4300-net-Check-the-correct-namespace-when-spoofing-pid-ov.patch
Modified:
   genpatches-2.6/trunk/3.0/0000_README
   genpatches-2.6/trunk/3.10/0000_README
   genpatches-2.6/trunk/3.11/0000_README
   genpatches-2.6/trunk/3.4/0000_README
Log:
Linux patches 3.0.97, 3.4.63, 3.10.13 and 3.11.2.

Modified: genpatches-2.6/trunk/3.0/0000_README
===================================================================
--- genpatches-2.6/trunk/3.0/0000_README	2013-09-25 17:13:05 UTC (rev 2528)
+++ genpatches-2.6/trunk/3.0/0000_README	2013-09-27 17:20:08 UTC (rev 2529)
@@ -419,6 +419,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.0.96
 
+Patch:  1096_linux-3.0.97.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.0.97
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.0/1096_linux-3.0.97.patch
===================================================================
--- genpatches-2.6/trunk/3.0/1096_linux-3.0.97.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.0/1096_linux-3.0.97.patch	2013-09-27 17:20:08 UTC (rev 2529)
@@ -0,0 +1,597 @@
+diff --git a/Makefile b/Makefile
+index e2a73ebd..53c9a5dc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 0
+-SUBLEVEL = 96
++SUBLEVEL = 97
+ EXTRAVERSION =
+ NAME = Sneaky Weasel
+ 
+diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
+index 13c7e5f9..3f47259b 100644
+--- a/arch/arm/mach-versatile/pci.c
++++ b/arch/arm/mach-versatile/pci.c
+@@ -43,9 +43,9 @@
+ #define PCI_IMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x0)
+ #define PCI_IMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x4)
+ #define PCI_IMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x8)
+-#define PCI_SMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x10)
+-#define PCI_SMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
+-#define PCI_SMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
++#define PCI_SMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x1c)
+ #define PCI_SELFID		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0xc)
+ 
+ #define DEVICE_ID_OFFSET		0x00
+diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
+index 8184ee97..3fcbae0f 100644
+--- a/arch/powerpc/kernel/align.c
++++ b/arch/powerpc/kernel/align.c
+@@ -764,6 +764,16 @@ int fix_alignment(struct pt_regs *regs)
+ 	nb = aligninfo[instr].len;
+ 	flags = aligninfo[instr].flags;
+ 
++	/* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */
++	if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) {
++		nb = 8;
++		flags = LD+SW;
++	} else if (IS_XFORM(instruction) &&
++		   ((instruction >> 1) & 0x3ff) == 660) {
++		nb = 8;
++		flags = ST+SW;
++	}
++
+ 	/* Byteswap little endian loads and stores */
+ 	swiz = 0;
+ 	if (regs->msr & MSR_LE) {
+diff --git a/crypto/api.c b/crypto/api.c
+index 033a7147..4f98dd5b 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -40,6 +40,8 @@ static inline struct crypto_alg *crypto_alg_get(struct crypto_alg *alg)
+ 	return alg;
+ }
+ 
++static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg);
++
+ struct crypto_alg *crypto_mod_get(struct crypto_alg *alg)
+ {
+ 	return try_module_get(alg->cra_module) ? crypto_alg_get(alg) : NULL;
+@@ -150,8 +152,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,
+ 	}
+ 	up_write(&crypto_alg_sem);
+ 
+-	if (alg != &larval->alg)
++	if (alg != &larval->alg) {
+ 		kfree(larval);
++		if (crypto_is_larval(alg))
++			alg = crypto_larval_wait(alg);
++	}
+ 
+ 	return alg;
+ }
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 53576e7c..a9c2b689 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -58,6 +58,8 @@ struct hid_report *hid_register_report(struct hid_device *device, unsigned type,
+ 	struct hid_report_enum *report_enum = device->report_enum + type;
+ 	struct hid_report *report;
+ 
++	if (id >= HID_MAX_IDS)
++		return NULL;
+ 	if (report_enum->report_id_hash[id])
+ 		return report_enum->report_id_hash[id];
+ 
+@@ -379,9 +381,11 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
+ 
+ 	case HID_GLOBAL_ITEM_TAG_REPORT_ID:
+ 		parser->global.report_id = item_udata(item);
+-		if (parser->global.report_id == 0) {
+-			dbg_hid("report_id 0 is invalid\n");
+-			return -1;
++		if (parser->global.report_id == 0 ||
++		    parser->global.report_id >= HID_MAX_IDS) {
++			hid_err(parser->device, "report_id %u is invalid\n",
++				parser->global.report_id);
++ 			return -1;
+ 		}
+ 		return 0;
+ 
+@@ -551,7 +555,7 @@ static void hid_device_release(struct device *dev)
+ 	for (i = 0; i < HID_REPORT_TYPES; i++) {
+ 		struct hid_report_enum *report_enum = device->report_enum + i;
+ 
+-		for (j = 0; j < 256; j++) {
++		for (j = 0; j < HID_MAX_IDS; j++) {
+ 			struct hid_report *report = report_enum->report_id_hash[j];
+ 			if (report)
+ 				hid_free_report(report);
+@@ -989,7 +993,12 @@ EXPORT_SYMBOL_GPL(hid_output_report);
+ 
+ int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
+ {
+-	unsigned size = field->report_size;
++	unsigned size;
++
++	if (!field)
++		return -1;
++
++	size = field->report_size;
+ 
+ 	hid_dump_input(field->report->device, field->usage + offset, value);
+ 
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index 9fae2ebd..48cba857 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev)
+ 	struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT].
+ 				    report_id_hash[0x0d];
+ 
+-	if (!report)
++	if (!report || report->maxfield < 1 ||
++	    report->field[0]->report_count < 1)
+ 		return -EINVAL;
+ 
+ 	usbhid_submit_report(hdev, report, USB_DIR_IN);
+diff --git a/drivers/hid/hid-pl.c b/drivers/hid/hid-pl.c
+index 06e5300d..fa742323 100644
+--- a/drivers/hid/hid-pl.c
++++ b/drivers/hid/hid-pl.c
+@@ -128,8 +128,14 @@ static int plff_init(struct hid_device *hid)
+ 			strong = &report->field[0]->value[2];
+ 			weak = &report->field[0]->value[3];
+ 			debug("detected single-field device");
+-		} else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 &&
+-				report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) {
++		} else if (report->field[0]->maxusage == 1 &&
++			   report->field[0]->usage[0].hid ==
++				(HID_UP_LED | 0x43) &&
++			   report->maxfield >= 4 &&
++			   report->field[0]->report_count >= 1 &&
++			   report->field[1]->report_count >= 1 &&
++			   report->field[2]->report_count >= 1 &&
++			   report->field[3]->report_count >= 1) {
+ 			report->field[0]->value[0] = 0x00;
+ 			report->field[1]->value[0] = 0x00;
+ 			strong = &report->field[2]->value[0];
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+index 892c48b1..b8a26d20 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -1005,6 +1005,10 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah,
+ 		 * is_on == 0 means MRC CCK is OFF (more noise imm)
+ 		 */
+ 		bool is_on = param ? 1 : 0;
++
++		if (ah->caps.rx_chainmask == 1)
++			break;
++
+ 		REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+ 			      AR_PHY_MRC_CCK_ENABLE, is_on);
+ 		REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 6f6f1002..e1f19719 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2433,6 +2433,7 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
+ 	for (acno = 0, ac = &an->ac[acno];
+ 	     acno < WME_NUM_AC; acno++, ac++) {
+ 		ac->sched    = false;
++		ac->clear_ps_filter = true;
+ 		ac->txq = sc->tx.txq_map[acno];
+ 		INIT_LIST_HEAD(&ac->tid_q);
+ 	}
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 3d15a37c..cc3943a0 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2135,14 +2135,9 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
+ 			}
+ 		}
+ 
+-		if (modepage == 0x3F) {
+-			sd_printk(KERN_ERR, sdkp, "No Caching mode page "
+-				  "present\n");
+-			goto defaults;
+-		} else if ((buffer[offset] & 0x3f) != modepage) {
+-			sd_printk(KERN_ERR, sdkp, "Got wrong page\n");
+-			goto defaults;
+-		}
++		sd_printk(KERN_ERR, sdkp, "No Caching mode page found\n");
++		goto defaults;
++
+ 	Page_found:
+ 		if (modepage == 8) {
+ 			sdkp->WCE = ((buffer[offset + 2] & 0x04) != 0);
+diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c
+index 8cea9dca..00a285c5 100644
+--- a/drivers/staging/comedi/drivers/dt282x.c
++++ b/drivers/staging/comedi/drivers/dt282x.c
+@@ -406,8 +406,9 @@ struct dt282x_private {
+ 			}					\
+ 			udelay(5);				\
+ 		}						\
+-		if (_i)						\
++		if (_i) {					\
+ 			b					\
++		}						\
+ 	} while (0)
+ 
+ static int dt282x_attach(struct comedi_device *dev,
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index c84b4553..0b85e2c7 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -171,6 +171,7 @@ skip_error:
+ static void wdm_int_callback(struct urb *urb)
+ {
+ 	int rv = 0;
++	int responding;
+ 	int status = urb->status;
+ 	struct wdm_device *desc;
+ 	struct usb_ctrlrequest *req;
+@@ -244,8 +245,8 @@ static void wdm_int_callback(struct urb *urb)
+ 	desc->response->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+ 	spin_lock(&desc->iuspin);
+ 	clear_bit(WDM_READ, &desc->flags);
+-	set_bit(WDM_RESPONDING, &desc->flags);
+-	if (!test_bit(WDM_DISCONNECTING, &desc->flags)
++	responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
++	if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags)
+ 		&& !test_bit(WDM_SUSPENDING, &desc->flags)) {
+ 		rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+ 		dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
+@@ -635,16 +636,20 @@ static void wdm_rxwork(struct work_struct *work)
+ {
+ 	struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);
+ 	unsigned long flags;
+-	int rv;
++	int rv = 0;
++	int responding;
+ 
+ 	spin_lock_irqsave(&desc->iuspin, flags);
+ 	if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+ 		spin_unlock_irqrestore(&desc->iuspin, flags);
+ 	} else {
++		responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
+ 		spin_unlock_irqrestore(&desc->iuspin, flags);
+-		rv = usb_submit_urb(desc->response, GFP_KERNEL);
++		if (!responding)
++			rv = usb_submit_urb(desc->response, GFP_KERNEL);
+ 		if (rv < 0 && rv != -EPERM) {
+ 			spin_lock_irqsave(&desc->iuspin, flags);
++			clear_bit(WDM_RESPONDING, &desc->flags);
+ 			if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+ 				schedule_work(&desc->rxwork);
+ 			spin_unlock_irqrestore(&desc->iuspin, flags);
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 26678cad..c29f5214 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -424,7 +424,8 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
+ 
+ 	memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+ 	if (config->desc.bDescriptorType != USB_DT_CONFIG ||
+-	    config->desc.bLength < USB_DT_CONFIG_SIZE) {
++	    config->desc.bLength < USB_DT_CONFIG_SIZE ||
++	    config->desc.bLength > size) {
+ 		dev_err(ddev, "invalid descriptor for config index %d: "
+ 		    "type = 0x%X, length = %d\n", cfgidx,
+ 		    config->desc.bDescriptorType, config->desc.bLength);
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 7f07eb8d..c95252d1 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -2713,10 +2713,21 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ 	struct xhci_virt_device *virt_dev;
++	struct device *dev = hcd->self.controller;
+ 	unsigned long flags;
+ 	u32 state;
+ 	int i, ret;
+ 
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++	/*
++	 * We called pm_runtime_get_noresume when the device was attached.
++	 * Decrement the counter here to allow controller to runtime suspend
++	 * if no devices remain.
++	 */
++	if (xhci->quirks & XHCI_RESET_ON_RESUME)
++		pm_runtime_put_noidle(dev);
++#endif
++
+ 	ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
+ 	/* If the host is halted due to driver unload, we still need to free the
+ 	 * device.
+@@ -2783,6 +2794,7 @@ static int xhci_reserve_host_control_ep_resources(struct xhci_hcd *xhci)
+ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++	struct device *dev = hcd->self.controller;
+ 	unsigned long flags;
+ 	int timeleft;
+ 	int ret;
+@@ -2835,6 +2847,16 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ 		goto disable_slot;
+ 	}
+ 	udev->slot_id = xhci->slot_id;
++
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++	/*
++	 * If resetting upon resume, we can't put the controller into runtime
++	 * suspend if there is a device attached.
++	 */
++	if (xhci->quirks & XHCI_RESET_ON_RESUME)
++		pm_runtime_get_noresume(dev);
++#endif
++
+ 	/* Is this a LS or FS device under a HS hub? */
+ 	/* Hub or peripherial? */
+ 	return 1;
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index 267dff94..7ee78bd6 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -383,7 +383,7 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ 		kfree(urbtrack);
+ 		return -ENOMEM;
+ 	}
+-	urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
++	urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_ATOMIC);
+ 	if (!urbtrack->setup) {
+ 		usb_free_urb(urbtrack->urb);
+ 		kfree(urbtrack);
+@@ -391,8 +391,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ 	}
+ 	urbtrack->setup->bRequestType = (__u8)0x40;
+ 	urbtrack->setup->bRequest = (__u8)0x0e;
+-	urbtrack->setup->wValue = get_reg_value(reg, dummy);
+-	urbtrack->setup->wIndex = get_reg_index(reg);
++	urbtrack->setup->wValue = cpu_to_le16(get_reg_value(reg, dummy));
++	urbtrack->setup->wIndex = cpu_to_le16(get_reg_index(reg));
+ 	urbtrack->setup->wLength = 0;
+ 	usb_fill_control_urb(urbtrack->urb, usbdev,
+ 			     usb_sndctrlpipe(usbdev, 0),
+diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
+index fd725cde..949af52a 100644
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -355,9 +355,18 @@ void gnttab_request_free_callback(struct gnttab_free_callback *callback,
+ 				  void (*fn)(void *), void *arg, u16 count)
+ {
+ 	unsigned long flags;
++	struct gnttab_free_callback *cb;
++
+ 	spin_lock_irqsave(&gnttab_list_lock, flags);
+-	if (callback->next)
+-		goto out;
++
++	/* Check if the callback is already on the list */
++	cb = gnttab_free_callback_list;
++	while (cb) {
++		if (cb == callback)
++			goto out;
++		cb = cb->next;
++	}
++
+ 	callback->fn = fn;
+ 	callback->arg = arg;
+ 	callback->count = count;
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index b7758094..9e6ee471 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -158,6 +158,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ 		try_to_freeze();
+ 
+ 		/* we should try only the port we connected to before */
++		mutex_lock(&server->srv_mutex);
+ 		rc = generic_ip_connect(server);
+ 		if (rc) {
+ 			cFYI(1, "reconnect error %d", rc);
+@@ -169,6 +170,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ 				server->tcpStatus = CifsNeedNegotiate;
+ 			spin_unlock(&GlobalMid_Lock);
+ 		}
++		mutex_unlock(&server->srv_mutex);
+ 	} while (server->tcpStatus == CifsNeedReconnect);
+ 
+ 	return rc;
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index c04a025c..607a9736 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1439,6 +1439,8 @@ static int fuse_setxattr(struct dentry *entry, const char *name,
+ 		fc->no_setxattr = 1;
+ 		err = -EOPNOTSUPP;
+ 	}
++	if (!err)
++		fuse_invalidate_attr(inode);
+ 	return err;
+ }
+ 
+@@ -1568,6 +1570,8 @@ static int fuse_removexattr(struct dentry *entry, const char *name)
+ 		fc->no_removexattr = 1;
+ 		err = -EOPNOTSUPP;
+ 	}
++	if (!err)
++		fuse_invalidate_attr(inode);
+ 	return err;
+ }
+ 
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 79fca8df..2e1c10fe 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1298,7 +1298,6 @@ static int fuse_writepage_locked(struct page *page)
+ 
+ 	inc_bdi_stat(mapping->backing_dev_info, BDI_WRITEBACK);
+ 	inc_zone_page_state(tmp_page, NR_WRITEBACK_TEMP);
+-	end_page_writeback(page);
+ 
+ 	spin_lock(&fc->lock);
+ 	list_add(&req->writepages_entry, &fi->writepages);
+@@ -1306,6 +1305,8 @@ static int fuse_writepage_locked(struct page *page)
+ 	fuse_flush_writepages(inode);
+ 	spin_unlock(&fc->lock);
+ 
++	end_page_writeback(page);
++
+ 	return 0;
+ 
+ err_free:
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index b3cc8586..26f63644 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -119,8 +119,8 @@ static void destroy_inodecache(void)
+ 
+ static int isofs_remount(struct super_block *sb, int *flags, char *data)
+ {
+-	/* we probably want a lot more here */
+-	*flags |= MS_RDONLY;
++	if (!(*flags & MS_RDONLY))
++		return -EROFS;
+ 	return 0;
+ }
+ 
+@@ -769,15 +769,6 @@ root_found:
+ 	 */
+ 	s->s_maxbytes = 0x80000000000LL;
+ 
+-	/*
+-	 * The CDROM is read-only, has no nodes (devices) on it, and since
+-	 * all of the files appear to be owned by root, we really do not want
+-	 * to allow suid.  (suid or devices will not show up unless we have
+-	 * Rock Ridge extensions)
+-	 */
+-
+-	s->s_flags |= MS_RDONLY /* | MS_NODEV | MS_NOSUID */;
+-
+ 	/* Set this for reference. Its not currently used except on write
+ 	   which we don't have .. */
+ 
+@@ -1528,6 +1519,9 @@ struct inode *isofs_iget(struct super_block *sb,
+ static struct dentry *isofs_mount(struct file_system_type *fs_type,
+ 	int flags, const char *dev_name, void *data)
+ {
++	/* We don't support read-write mounts */
++	if (!(flags & MS_RDONLY))
++		return ERR_PTR(-EACCES);
+ 	return mount_bdev(fs_type, flags, dev_name, data, isofs_fill_super);
+ }
+ 
+diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
+index 59412840..774a032a 100644
+--- a/fs/ocfs2/extent_map.c
++++ b/fs/ocfs2/extent_map.c
+@@ -782,7 +782,6 @@ int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ 	cpos = map_start >> osb->s_clustersize_bits;
+ 	mapping_end = ocfs2_clusters_for_bytes(inode->i_sb,
+ 					       map_start + map_len);
+-	mapping_end -= cpos;
+ 	is_last = 0;
+ 	while (cpos < mapping_end && !is_last) {
+ 		u32 fe_flags;
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 42f7e2fb..af30c641 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -414,10 +414,12 @@ struct hid_report {
+ 	struct hid_device *device;			/* associated device */
+ };
+ 
++#define HID_MAX_IDS 256
++
+ struct hid_report_enum {
+ 	unsigned numbered;
+ 	struct list_head report_list;
+-	struct hid_report *report_id_hash[256];
++	struct hid_report *report_id_hash[HID_MAX_IDS];
+ };
+ 
+ #define HID_REPORT_TYPES 3
+diff --git a/include/linux/rculist.h b/include/linux/rculist.h
+index c30ffd87..52d280ba 100644
+--- a/include/linux/rculist.h
++++ b/include/linux/rculist.h
+@@ -254,8 +254,9 @@ static inline void list_splice_init_rcu(struct list_head *list,
+  */
+ #define list_first_or_null_rcu(ptr, type, member) \
+ 	({struct list_head *__ptr = (ptr); \
+-	  struct list_head __rcu *__next = list_next_rcu(__ptr); \
+-	  likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \
++	  struct list_head *__next = ACCESS_ONCE(__ptr->next); \
++	  likely(__ptr != __next) ? \
++		list_entry_rcu(__next, type, member) : NULL; \
+ 	})
+ 
+ /**
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 983d2e11..78f71869 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1838,6 +1838,8 @@ static void collapse_huge_page(struct mm_struct *mm,
+ 		goto out;
+ 
+ 	vma = find_vma(mm, address);
++	if (!vma)
++		goto out;
+ 	hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ 	hend = vma->vm_end & HPAGE_PMD_MASK;
+ 	if (address < hstart || address + HPAGE_PMD_SIZE > hend)
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 57cdf5ad..d7b51d5b 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -4433,7 +4433,13 @@ static int compare_thresholds(const void *a, const void *b)
+ 	const struct mem_cgroup_threshold *_a = a;
+ 	const struct mem_cgroup_threshold *_b = b;
+ 
+-	return _a->threshold - _b->threshold;
++	if (_a->threshold > _b->threshold)
++		return 1;
++
++	if (_a->threshold < _b->threshold)
++		return -1;
++
++	return 0;
+ }
+ 
+ static int mem_cgroup_oom_notify_cb(struct mem_cgroup *mem)
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index c5c97880..a9537d42 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2461,6 +2461,7 @@ static struct snd_pci_quirk msi_black_list[] __devinitdata = {
+ 	SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
+ 	SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
+ 	SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
++	SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */
+ 	SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */
+ 	SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */
+ 	{}
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 4393394b..ca1a90b8 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -801,9 +801,9 @@ static int wm8960_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
+ 	if (pll_div.k) {
+ 		reg |= 0x20;
+ 
+-		snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 18) & 0x3f);
+-		snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 9) & 0x1ff);
+-		snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0x1ff);
++		snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 16) & 0xff);
++		snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 8) & 0xff);
++		snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0xff);
+ 	}
+ 	snd_soc_write(codec, WM8960_PLL1, reg);
+ 

Modified: genpatches-2.6/trunk/3.10/0000_README
===================================================================
--- genpatches-2.6/trunk/3.10/0000_README	2013-09-25 17:13:05 UTC (rev 2528)
+++ genpatches-2.6/trunk/3.10/0000_README	2013-09-27 17:20:08 UTC (rev 2529)
@@ -90,9 +90,9 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.10.12
 
-Patch:  1500_CVE-2013-4300-net-Check-the-correct-namespace-when-spoofing-pid-ov.patch
-From:   http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=d661684cf6820331feae71146c35da83d794467e
-Desc:   CVE-2013-4300: PID Spoofing Privilege Escalation Vulnerability
+Patch:  1012_linux-3.10.13.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.13
 
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644

Added: genpatches-2.6/trunk/3.10/1012_linux-3.10.13.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1012_linux-3.10.13.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10/1012_linux-3.10.13.patch	2013-09-27 17:20:08 UTC (rev 2529)
@@ -0,0 +1,3897 @@
+diff --git a/Documentation/DocBook/media_api.tmpl b/Documentation/DocBook/media_api.tmpl
+index 6a8b7158..9c92bb87 100644
+--- a/Documentation/DocBook/media_api.tmpl
++++ b/Documentation/DocBook/media_api.tmpl
+@@ -1,6 +1,6 @@
+ <?xml version="1.0"?>
+-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
+-	"http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" [
++<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
++	"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
+ <!ENTITY % media-entities SYSTEM "./media-entities.tmpl"> %media-entities;
+ <!ENTITY media-indices SYSTEM "./media-indices.tmpl">
+ 
+diff --git a/Makefile b/Makefile
+index afe001e3..25d38b79 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 12
++SUBLEVEL = 13
+ EXTRAVERSION =
+ NAME = TOSSUG Baby Fish
+ 
+diff --git a/arch/arm/boot/dts/at91rm9200.dtsi b/arch/arm/boot/dts/at91rm9200.dtsi
+index 5d3ed5aa..0af879a4 100644
+--- a/arch/arm/boot/dts/at91rm9200.dtsi
++++ b/arch/arm/boot/dts/at91rm9200.dtsi
+@@ -35,8 +35,12 @@
+ 		ssc2 = &ssc2;
+ 	};
+ 	cpus {
+-		cpu@0 {
++		#address-cells = <0>;
++		#size-cells = <0>;
++
++		cpu {
+ 			compatible = "arm,arm920t";
++			device_type = "cpu";
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/at91sam9260.dtsi b/arch/arm/boot/dts/at91sam9260.dtsi
+index 43a18f74..0dbdb846 100644
+--- a/arch/arm/boot/dts/at91sam9260.dtsi
++++ b/arch/arm/boot/dts/at91sam9260.dtsi
+@@ -32,8 +32,12 @@
+ 		ssc0 = &ssc0;
+ 	};
+ 	cpus {
+-		cpu@0 {
+-			compatible = "arm,arm926ejs";
++		#address-cells = <0>;
++		#size-cells = <0>;
++
++		cpu {
++			compatible = "arm,arm926ej-s";
++			device_type = "cpu";
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi
+index 94b58ab2..fcd38f89 100644
+--- a/arch/arm/boot/dts/at91sam9263.dtsi
++++ b/arch/arm/boot/dts/at91sam9263.dtsi
+@@ -29,8 +29,12 @@
+ 		ssc1 = &ssc1;
+ 	};
+ 	cpus {
+-		cpu@0 {
+-			compatible = "arm,arm926ejs";
++		#address-cells = <0>;
++		#size-cells = <0>;
++
++		cpu {
++			compatible = "arm,arm926ej-s";
++			device_type = "cpu";
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
+index bf18a735..479a0622 100644
+--- a/arch/arm/boot/dts/at91sam9g45.dtsi
++++ b/arch/arm/boot/dts/at91sam9g45.dtsi
+@@ -35,8 +35,12 @@
+ 		ssc1 = &ssc1;
+ 	};
+ 	cpus {
+-		cpu@0 {
+-			compatible = "arm,arm926ejs";
++		#address-cells = <0>;
++		#size-cells = <0>;
++
++		cpu {
++			compatible = "arm,arm926ej-s";
++			device_type = "cpu";
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/at91sam9n12.dtsi b/arch/arm/boot/dts/at91sam9n12.dtsi
+index 8d25f889..a92ec783 100644
+--- a/arch/arm/boot/dts/at91sam9n12.dtsi
++++ b/arch/arm/boot/dts/at91sam9n12.dtsi
+@@ -31,8 +31,12 @@
+ 		ssc0 = &ssc0;
+ 	};
+ 	cpus {
+-		cpu@0 {
+-			compatible = "arm,arm926ejs";
++		#address-cells = <0>;
++		#size-cells = <0>;
++
++		cpu {
++			compatible = "arm,arm926ej-s";
++			device_type = "cpu";
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
+index b5833d1f..2b2b6923 100644
+--- a/arch/arm/boot/dts/at91sam9x5.dtsi
++++ b/arch/arm/boot/dts/at91sam9x5.dtsi
+@@ -33,8 +33,12 @@
+ 		ssc0 = &ssc0;
+ 	};
+ 	cpus {
+-		cpu@0 {
+-			compatible = "arm,arm926ejs";
++		#address-cells = <0>;
++		#size-cells = <0>;
++
++		cpu {
++			compatible = "arm,arm926ej-s";
++			device_type = "cpu";
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/sama5d3.dtsi b/arch/arm/boot/dts/sama5d3.dtsi
+index 5000e0d4..642775d7 100644
+--- a/arch/arm/boot/dts/sama5d3.dtsi
++++ b/arch/arm/boot/dts/sama5d3.dtsi
+@@ -35,8 +35,12 @@
+ 		ssc1 = &ssc1;
+ 	};
+ 	cpus {
++		#address-cells = <1>;
++		#size-cells = <0>;
+ 		cpu@0 {
++			device_type = "cpu";
+ 			compatible = "arm,cortex-a5";
++			reg = <0x0>;
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
+index e7ef619a..06ef8b62 100644
+--- a/arch/arm/boot/dts/sun4i-a10.dtsi
++++ b/arch/arm/boot/dts/sun4i-a10.dtsi
+@@ -16,8 +16,12 @@
+ 	interrupt-parent = <&intc>;
+ 
+ 	cpus {
++		#address-cells = <1>;
++		#size-cells = <0>;
+ 		cpu@0 {
++			device_type = "cpu";
+ 			compatible = "arm,cortex-a8";
++			reg = <0x0>;
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
+index 31fa38f8..d2852547 100644
+--- a/arch/arm/boot/dts/sun5i-a13.dtsi
++++ b/arch/arm/boot/dts/sun5i-a13.dtsi
+@@ -17,8 +17,12 @@
+ 	interrupt-parent = <&intc>;
+ 
+ 	cpus {
++		#address-cells = <1>;
++		#size-cells = <0>;
+ 		cpu@0 {
++			device_type = "cpu";
+ 			compatible = "arm,cortex-a8";
++			reg = <0x0>;
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
+index 4a519907..db9cf692 100644
+--- a/arch/arm/kvm/coproc.c
++++ b/arch/arm/kvm/coproc.c
+@@ -146,7 +146,11 @@ static bool pm_fake(struct kvm_vcpu *vcpu,
+ #define access_pmintenclr pm_fake
+ 
+ /* Architected CP15 registers.
+- * Important: Must be sorted ascending by CRn, CRM, Op1, Op2
++ * CRn denotes the primary register number, but is copied to the CRm in the
++ * user space API for 64-bit register access in line with the terminology used
++ * in the ARM ARM.
++ * Important: Must be sorted ascending by CRn, CRM, Op1, Op2 and with 64-bit
++ *            registers preceding 32-bit ones.
+  */
+ static const struct coproc_reg cp15_regs[] = {
+ 	/* CSSELR: swapped by interrupt.S. */
+@@ -154,8 +158,8 @@ static const struct coproc_reg cp15_regs[] = {
+ 			NULL, reset_unknown, c0_CSSELR },
+ 
+ 	/* TTBR0/TTBR1: swapped by interrupt.S. */
+-	{ CRm( 2), Op1( 0), is64, NULL, reset_unknown64, c2_TTBR0 },
+-	{ CRm( 2), Op1( 1), is64, NULL, reset_unknown64, c2_TTBR1 },
++	{ CRm64( 2), Op1( 0), is64, NULL, reset_unknown64, c2_TTBR0 },
++	{ CRm64( 2), Op1( 1), is64, NULL, reset_unknown64, c2_TTBR1 },
+ 
+ 	/* TTBCR: swapped by interrupt.S. */
+ 	{ CRn( 2), CRm( 0), Op1( 0), Op2( 2), is32,
+@@ -182,7 +186,7 @@ static const struct coproc_reg cp15_regs[] = {
+ 			NULL, reset_unknown, c6_IFAR },
+ 
+ 	/* PAR swapped by interrupt.S */
+-	{ CRn( 7), Op1( 0), is64, NULL, reset_unknown64, c7_PAR },
++	{ CRm64( 7), Op1( 0), is64, NULL, reset_unknown64, c7_PAR },
+ 
+ 	/*
+ 	 * DC{C,I,CI}SW operations:
+@@ -399,12 +403,13 @@ static bool index_to_params(u64 id, struct coproc_params *params)
+ 			      | KVM_REG_ARM_OPC1_MASK))
+ 			return false;
+ 		params->is_64bit = true;
+-		params->CRm = ((id & KVM_REG_ARM_CRM_MASK)
++		/* CRm to CRn: see cp15_to_index for details */
++		params->CRn = ((id & KVM_REG_ARM_CRM_MASK)
+ 			       >> KVM_REG_ARM_CRM_SHIFT);
+ 		params->Op1 = ((id & KVM_REG_ARM_OPC1_MASK)
+ 			       >> KVM_REG_ARM_OPC1_SHIFT);
+ 		params->Op2 = 0;
+-		params->CRn = 0;
++		params->CRm = 0;
+ 		return true;
+ 	default:
+ 		return false;
+@@ -898,7 +903,14 @@ static u64 cp15_to_index(const struct coproc_reg *reg)
+ 	if (reg->is_64) {
+ 		val |= KVM_REG_SIZE_U64;
+ 		val |= (reg->Op1 << KVM_REG_ARM_OPC1_SHIFT);
+-		val |= (reg->CRm << KVM_REG_ARM_CRM_SHIFT);
++		/*
++		 * CRn always denotes the primary coproc. reg. nr. for the
++		 * in-kernel representation, but the user space API uses the
++		 * CRm for the encoding, because it is modelled after the
++		 * MRRC/MCRR instructions: see the ARM ARM rev. c page
++		 * B3-1445
++		 */
++		val |= (reg->CRn << KVM_REG_ARM_CRM_SHIFT);
+ 	} else {
+ 		val |= KVM_REG_SIZE_U32;
+ 		val |= (reg->Op1 << KVM_REG_ARM_OPC1_SHIFT);
+diff --git a/arch/arm/kvm/coproc.h b/arch/arm/kvm/coproc.h
+index b7301d3e..0461d5c8 100644
+--- a/arch/arm/kvm/coproc.h
++++ b/arch/arm/kvm/coproc.h
+@@ -135,6 +135,8 @@ static inline int cmp_reg(const struct coproc_reg *i1,
+ 		return -1;
+ 	if (i1->CRn != i2->CRn)
+ 		return i1->CRn - i2->CRn;
++	if (i1->is_64 != i2->is_64)
++		return i2->is_64 - i1->is_64;
+ 	if (i1->CRm != i2->CRm)
+ 		return i1->CRm - i2->CRm;
+ 	if (i1->Op1 != i2->Op1)
+@@ -145,6 +147,7 @@ static inline int cmp_reg(const struct coproc_reg *i1,
+ 
+ #define CRn(_x)		.CRn = _x
+ #define CRm(_x) 	.CRm = _x
++#define CRm64(_x)       .CRn = _x, .CRm = 0
+ #define Op1(_x) 	.Op1 = _x
+ #define Op2(_x) 	.Op2 = _x
+ #define is64		.is_64 = true
+diff --git a/arch/arm/kvm/coproc_a15.c b/arch/arm/kvm/coproc_a15.c
+index 685063a6..cf93472b 100644
+--- a/arch/arm/kvm/coproc_a15.c
++++ b/arch/arm/kvm/coproc_a15.c
+@@ -114,7 +114,11 @@ static bool access_l2ectlr(struct kvm_vcpu *vcpu,
+ 
+ /*
+  * A15-specific CP15 registers.
+- * Important: Must be sorted ascending by CRn, CRM, Op1, Op2
++ * CRn denotes the primary register number, but is copied to the CRm in the
++ * user space API for 64-bit register access in line with the terminology used
++ * in the ARM ARM.
++ * Important: Must be sorted ascending by CRn, CRM, Op1, Op2 and with 64-bit
++ *            registers preceding 32-bit ones.
+  */
+ static const struct coproc_reg a15_regs[] = {
+ 	/* MPIDR: we use VMPIDR for guest access. */
+diff --git a/arch/arm/mach-versatile/include/mach/platform.h b/arch/arm/mach-versatile/include/mach/platform.h
+index ec087407..6f938ccb 100644
+--- a/arch/arm/mach-versatile/include/mach/platform.h
++++ b/arch/arm/mach-versatile/include/mach/platform.h
+@@ -231,12 +231,14 @@
+ /* PCI space */
+ #define VERSATILE_PCI_BASE             0x41000000	/* PCI Interface */
+ #define VERSATILE_PCI_CFG_BASE	       0x42000000
++#define VERSATILE_PCI_IO_BASE          0x43000000
+ #define VERSATILE_PCI_MEM_BASE0        0x44000000
+ #define VERSATILE_PCI_MEM_BASE1        0x50000000
+ #define VERSATILE_PCI_MEM_BASE2        0x60000000
+ /* Sizes of above maps */
+ #define VERSATILE_PCI_BASE_SIZE	       0x01000000
+ #define VERSATILE_PCI_CFG_BASE_SIZE    0x02000000
++#define VERSATILE_PCI_IO_BASE_SIZE     0x01000000
+ #define VERSATILE_PCI_MEM_BASE0_SIZE   0x0c000000	/* 32Mb */
+ #define VERSATILE_PCI_MEM_BASE1_SIZE   0x10000000	/* 256Mb */
+ #define VERSATILE_PCI_MEM_BASE2_SIZE   0x10000000	/* 256Mb */
+diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
+index e92e5e07..c97be4ea 100644
+--- a/arch/arm/mach-versatile/pci.c
++++ b/arch/arm/mach-versatile/pci.c
+@@ -43,9 +43,9 @@
+ #define PCI_IMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x0)
+ #define PCI_IMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x4)
+ #define PCI_IMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x8)
+-#define PCI_SMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x10)
+-#define PCI_SMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
+-#define PCI_SMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
++#define PCI_SMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x1c)
+ #define PCI_SELFID		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0xc)
+ 
+ #define DEVICE_ID_OFFSET		0x00
+@@ -170,8 +170,8 @@ static struct pci_ops pci_versatile_ops = {
+ 	.write	= versatile_write_config,
+ };
+ 
+-static struct resource io_mem = {
+-	.name	= "PCI I/O space",
++static struct resource unused_mem = {
++	.name	= "PCI unused",
+ 	.start	= VERSATILE_PCI_MEM_BASE0,
+ 	.end	= VERSATILE_PCI_MEM_BASE0+VERSATILE_PCI_MEM_BASE0_SIZE-1,
+ 	.flags	= IORESOURCE_MEM,
+@@ -195,9 +195,9 @@ static int __init pci_versatile_setup_resources(struct pci_sys_data *sys)
+ {
+ 	int ret = 0;
+ 
+-	ret = request_resource(&iomem_resource, &io_mem);
++	ret = request_resource(&iomem_resource, &unused_mem);
+ 	if (ret) {
+-		printk(KERN_ERR "PCI: unable to allocate I/O "
++		printk(KERN_ERR "PCI: unable to allocate unused "
+ 		       "memory region (%d)\n", ret);
+ 		goto out;
+ 	}
+@@ -205,7 +205,7 @@ static int __init pci_versatile_setup_resources(struct pci_sys_data *sys)
+ 	if (ret) {
+ 		printk(KERN_ERR "PCI: unable to allocate non-prefetchable "
+ 		       "memory region (%d)\n", ret);
+-		goto release_io_mem;
++		goto release_unused_mem;
+ 	}
+ 	ret = request_resource(&iomem_resource, &pre_mem);
+ 	if (ret) {
+@@ -225,8 +225,8 @@ static int __init pci_versatile_setup_resources(struct pci_sys_data *sys)
+ 
+  release_non_mem:
+ 	release_resource(&non_mem);
+- release_io_mem:
+-	release_resource(&io_mem);
++ release_unused_mem:
++	release_resource(&unused_mem);
+  out:
+ 	return ret;
+ }
+@@ -246,7 +246,7 @@ int __init pci_versatile_setup(int nr, struct pci_sys_data *sys)
+ 		goto out;
+ 	}
+ 
+-	ret = pci_ioremap_io(0, VERSATILE_PCI_MEM_BASE0);
++	ret = pci_ioremap_io(0, VERSATILE_PCI_IO_BASE);
+ 	if (ret)
+ 		goto out;
+ 
+@@ -295,6 +295,19 @@ int __init pci_versatile_setup(int nr, struct pci_sys_data *sys)
+ 	__raw_writel(PHYS_OFFSET, local_pci_cfg_base + PCI_BASE_ADDRESS_2);
+ 
+ 	/*
++	 * For many years the kernel and QEMU were symbiotically buggy
++	 * in that they both assumed the same broken IRQ mapping.
++	 * QEMU therefore attempts to auto-detect old broken kernels
++	 * so that they still work on newer QEMU as they did on old
++	 * QEMU. Since we now use the correct (ie matching-hardware)
++	 * IRQ mapping we write a definitely different value to a
++	 * PCI_INTERRUPT_LINE register to tell QEMU that we expect
++	 * real hardware behaviour and it need not be backwards
++	 * compatible for us. This write is harmless on real hardware.
++	 */
++	__raw_writel(0, VERSATILE_PCI_VIRT_BASE+PCI_INTERRUPT_LINE);
++
++	/*
+ 	 * Do not to map Versatile FPGA PCI device into memory space
+ 	 */
+ 	pci_slot_ignore |= (1 << myslot);
+@@ -327,13 +340,13 @@ static int __init versatile_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+ {
+ 	int irq;
+ 
+-	/* slot,  pin,	irq
+-	 *  24     1     IRQ_SIC_PCI0
+-	 *  25     1     IRQ_SIC_PCI1
+-	 *  26     1     IRQ_SIC_PCI2
+-	 *  27     1     IRQ_SIC_PCI3
++	/*
++	 * Slot	INTA	INTB	INTC	INTD
++	 * 31	PCI1	PCI2	PCI3	PCI0
++	 * 30	PCI0	PCI1	PCI2	PCI3
++	 * 29	PCI3	PCI0	PCI1	PCI2
+ 	 */
+-	irq = IRQ_SIC_PCI0 + ((slot - 24 + pin - 1) & 3);
++	irq = IRQ_SIC_PCI0 + ((slot + 2 + pin - 1) & 3);
+ 
+ 	return irq;
+ }
+diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
+index 05db95d0..81edd31b 100644
+--- a/arch/arm/xen/enlighten.c
++++ b/arch/arm/xen/enlighten.c
+@@ -273,12 +273,15 @@ core_initcall(xen_guest_init);
+ 
+ static int __init xen_pm_init(void)
+ {
++	if (!xen_domain())
++		return -ENODEV;
++
+ 	pm_power_off = xen_power_off;
+ 	arm_pm_restart = xen_restart;
+ 
+ 	return 0;
+ }
+-subsys_initcall(xen_pm_init);
++late_initcall(xen_pm_init);
+ 
+ static irqreturn_t xen_arm_callback(int irq, void *arg)
+ {
+diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
+index 12e6ccb8..cea1594f 100644
+--- a/arch/arm64/kernel/perf_event.c
++++ b/arch/arm64/kernel/perf_event.c
+@@ -325,7 +325,10 @@ validate_event(struct pmu_hw_events *hw_events,
+ 	if (is_software_event(event))
+ 		return 1;
+ 
+-	if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)
++	if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
++		return 1;
++
++	if (event->state == PERF_EVENT_STATE_OFF && !event->attr.enable_on_exec)
+ 		return 1;
+ 
+ 	return armpmu->get_event_idx(hw_events, &fake_event) >= 0;
+@@ -781,7 +784,7 @@ static const unsigned armv8_pmuv3_perf_cache_map[PERF_COUNT_HW_CACHE_MAX]
+ /*
+  * PMXEVTYPER: Event selection reg
+  */
+-#define	ARMV8_EVTYPE_MASK	0xc00000ff	/* Mask for writable bits */
++#define	ARMV8_EVTYPE_MASK	0xc80000ff	/* Mask for writable bits */
+ #define	ARMV8_EVTYPE_EVENT	0xff		/* Mask for EVENT bits */
+ 
+ /*
+diff --git a/arch/mips/ath79/clock.c b/arch/mips/ath79/clock.c
+index 765ef30e..733017b3 100644
+--- a/arch/mips/ath79/clock.c
++++ b/arch/mips/ath79/clock.c
+@@ -164,7 +164,7 @@ static void __init ar933x_clocks_init(void)
+ 		ath79_ahb_clk.rate = freq / t;
+ 	}
+ 
+-	ath79_wdt_clk.rate = ath79_ref_clk.rate;
++	ath79_wdt_clk.rate = ath79_ahb_clk.rate;
+ 	ath79_uart_clk.rate = ath79_ref_clk.rate;
+ }
+ 
+diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
+index ee5b690a..52e5758e 100644
+--- a/arch/powerpc/kernel/align.c
++++ b/arch/powerpc/kernel/align.c
+@@ -764,6 +764,16 @@ int fix_alignment(struct pt_regs *regs)
+ 	nb = aligninfo[instr].len;
+ 	flags = aligninfo[instr].flags;
+ 
++	/* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */
++	if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) {
++		nb = 8;
++		flags = LD+SW;
++	} else if (IS_XFORM(instruction) &&
++		   ((instruction >> 1) & 0x3ff) == 660) {
++		nb = 8;
++		flags = ST+SW;
++	}
++
+ 	/* Byteswap little endian loads and stores */
+ 	swiz = 0;
+ 	if (regs->msr & MSR_LE) {
+diff --git a/arch/powerpc/kvm/book3s_xics.c b/arch/powerpc/kvm/book3s_xics.c
+index 94c1dd46..a3a5cb8e 100644
+--- a/arch/powerpc/kvm/book3s_xics.c
++++ b/arch/powerpc/kvm/book3s_xics.c
+@@ -19,6 +19,7 @@
+ #include <asm/hvcall.h>
+ #include <asm/xics.h>
+ #include <asm/debug.h>
++#include <asm/time.h>
+ 
+ #include <linux/debugfs.h>
+ #include <linux/seq_file.h>
+diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
+index c11c8238..54b998f2 100644
+--- a/arch/powerpc/platforms/pseries/setup.c
++++ b/arch/powerpc/platforms/pseries/setup.c
+@@ -354,7 +354,7 @@ static int alloc_dispatch_log_kmem_cache(void)
+ }
+ early_initcall(alloc_dispatch_log_kmem_cache);
+ 
+-static void pSeries_idle(void)
++static void pseries_lpar_idle(void)
+ {
+ 	/* This would call on the cpuidle framework, and the back-end pseries
+ 	 * driver to  go to idle states
+@@ -362,10 +362,22 @@ static void pSeries_idle(void)
+ 	if (cpuidle_idle_call()) {
+ 		/* On error, execute default handler
+ 		 * to go into low thread priority and possibly
+-		 * low power mode.
++		 * low power mode by cedeing processor to hypervisor
+ 		 */
+-		HMT_low();
+-		HMT_very_low();
++
++		/* Indicate to hypervisor that we are idle. */
++		get_lppaca()->idle = 1;
++
++		/*
++		 * Yield the processor to the hypervisor.  We return if
++		 * an external interrupt occurs (which are driven prior
++		 * to returning here) or if a prod occurs from another
++		 * processor. When returning here, external interrupts
++		 * are enabled.
++		 */
++		cede_processor();
++
++		get_lppaca()->idle = 0;
+ 	}
+ }
+ 
+@@ -456,15 +468,14 @@ static void __init pSeries_setup_arch(void)
+ 
+ 	pSeries_nvram_init();
+ 
+-	if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
++	if (firmware_has_feature(FW_FEATURE_LPAR)) {
+ 		vpa_init(boot_cpuid);
+-		ppc_md.power_save = pSeries_idle;
+-	}
+-
+-	if (firmware_has_feature(FW_FEATURE_LPAR))
++		ppc_md.power_save = pseries_lpar_idle;
+ 		ppc_md.enable_pmcs = pseries_lpar_enable_pmcs;
+-	else
++	} else {
++		/* No special idle routine */
+ 		ppc_md.enable_pmcs = power4_enable_pmcs;
++	}
+ 
+ 	ppc_md.pcibios_root_bridge_prepare = pseries_root_bridge_prepare;
+ 
+diff --git a/arch/um/include/shared/os.h b/arch/um/include/shared/os.h
+index 95feaa47..c70a234a 100644
+--- a/arch/um/include/shared/os.h
++++ b/arch/um/include/shared/os.h
+@@ -200,6 +200,7 @@ extern int os_unmap_memory(void *addr, int len);
+ extern int os_drop_memory(void *addr, int length);
+ extern int can_drop_memory(void);
+ extern void os_flush_stdout(void);
++extern int os_mincore(void *addr, unsigned long len);
+ 
+ /* execvp.c */
+ extern int execvp_noalloc(char *buf, const char *file, char *const argv[]);
+diff --git a/arch/um/kernel/Makefile b/arch/um/kernel/Makefile
+index babe2182..d8b78a03 100644
+--- a/arch/um/kernel/Makefile
++++ b/arch/um/kernel/Makefile
+@@ -13,7 +13,7 @@ clean-files :=
+ obj-y = config.o exec.o exitcode.o irq.o ksyms.o mem.o \
+ 	physmem.o process.o ptrace.o reboot.o sigio.o \
+ 	signal.o smp.o syscall.o sysrq.o time.o tlb.o trap.o \
+-	um_arch.o umid.o skas/
++	um_arch.o umid.o maccess.o skas/
+ 
+ obj-$(CONFIG_BLK_DEV_INITRD) += initrd.o
+ obj-$(CONFIG_GPROF)	+= gprof_syms.o
+diff --git a/arch/um/kernel/maccess.c b/arch/um/kernel/maccess.c
+new file mode 100644
+index 00000000..1f3d5c49
+--- /dev/null
++++ b/arch/um/kernel/maccess.c
+@@ -0,0 +1,24 @@
++/*
++ * Copyright (C) 2013 Richard Weinberger <richrd@×××.at>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/uaccess.h>
++#include <linux/kernel.h>
++#include <os.h>
++
++long probe_kernel_read(void *dst, const void *src, size_t size)
++{
++	void *psrc = (void *)rounddown((unsigned long)src, PAGE_SIZE);
++
++	if ((unsigned long)src < PAGE_SIZE || size <= 0)
++		return -EFAULT;
++
++	if (os_mincore(psrc, size + src - psrc) <= 0)
++		return -EFAULT;
++
++	return __probe_kernel_read(dst, src, size);
++}
+diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c
+index b8f34c9e..67b9c8f5 100644
+--- a/arch/um/os-Linux/process.c
++++ b/arch/um/os-Linux/process.c
+@@ -4,6 +4,7 @@
+  */
+ 
+ #include <stdio.h>
++#include <stdlib.h>
+ #include <unistd.h>
+ #include <errno.h>
+ #include <signal.h>
+@@ -232,6 +233,57 @@ out:
+ 	return ok;
+ }
+ 
++static int os_page_mincore(void *addr)
++{
++	char vec[2];
++	int ret;
++
++	ret = mincore(addr, UM_KERN_PAGE_SIZE, vec);
++	if (ret < 0) {
++		if (errno == ENOMEM || errno == EINVAL)
++			return 0;
++		else
++			return -errno;
++	}
++
++	return vec[0] & 1;
++}
++
++int os_mincore(void *addr, unsigned long len)
++{
++	char *vec;
++	int ret, i;
++
++	if (len <= UM_KERN_PAGE_SIZE)
++		return os_page_mincore(addr);
++
++	vec = calloc(1, (len + UM_KERN_PAGE_SIZE - 1) / UM_KERN_PAGE_SIZE);
++	if (!vec)
++		return -ENOMEM;
++
++	ret = mincore(addr, UM_KERN_PAGE_SIZE, vec);
++	if (ret < 0) {
++		if (errno == ENOMEM || errno == EINVAL)
++			ret = 0;
++		else
++			ret = -errno;
++
++		goto out;
++	}
++
++	for (i = 0; i < ((len + UM_KERN_PAGE_SIZE - 1) / UM_KERN_PAGE_SIZE); i++) {
++		if (!(vec[i] & 1)) {
++			ret = 0;
++			goto out;
++		}
++	}
++
++	ret = 1;
++out:
++	free(vec);
++	return ret;
++}
++
+ void init_new_thread_signals(void)
+ {
+ 	set_handler(SIGSEGV);
+diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
+index cf1a471a..10adb41f 100644
+--- a/arch/x86/ia32/ia32_signal.c
++++ b/arch/x86/ia32/ia32_signal.c
+@@ -459,7 +459,7 @@ int ia32_setup_rt_frame(int sig, struct ksignal *ksig,
+ 		else
+ 			put_user_ex(0, &frame->uc.uc_flags);
+ 		put_user_ex(0, &frame->uc.uc_link);
+-		err |= __compat_save_altstack(&frame->uc.uc_stack, regs->sp);
++		compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+ 
+ 		if (ksig->ka.sa.sa_flags & SA_RESTORER)
+ 			restorer = ksig->ka.sa.sa_restorer;
+diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
+index 46fc474f..f50de695 100644
+--- a/arch/x86/include/asm/checksum_32.h
++++ b/arch/x86/include/asm/checksum_32.h
+@@ -49,9 +49,15 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
+ 						 int len, __wsum sum,
+ 						 int *err_ptr)
+ {
++	__wsum ret;
++
+ 	might_sleep();
+-	return csum_partial_copy_generic((__force void *)src, dst,
+-					 len, sum, err_ptr, NULL);
++	stac();
++	ret = csum_partial_copy_generic((__force void *)src, dst,
++					len, sum, err_ptr, NULL);
++	clac();
++
++	return ret;
+ }
+ 
+ /*
+@@ -176,10 +182,16 @@ static inline __wsum csum_and_copy_to_user(const void *src,
+ 					   int len, __wsum sum,
+ 					   int *err_ptr)
+ {
++	__wsum ret;
++
+ 	might_sleep();
+-	if (access_ok(VERIFY_WRITE, dst, len))
+-		return csum_partial_copy_generic(src, (__force void *)dst,
+-						 len, sum, NULL, err_ptr);
++	if (access_ok(VERIFY_WRITE, dst, len)) {
++		stac();
++		ret = csum_partial_copy_generic(src, (__force void *)dst,
++						len, sum, NULL, err_ptr);
++		clac();
++		return ret;
++	}
+ 
+ 	if (len)
+ 		*err_ptr = -EFAULT;
+diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
+index fa5f71e0..e6833c65 100644
+--- a/arch/x86/include/asm/mce.h
++++ b/arch/x86/include/asm/mce.h
+@@ -32,11 +32,20 @@
+ #define MCI_STATUS_PCC   (1ULL<<57)  /* processor context corrupt */
+ #define MCI_STATUS_S	 (1ULL<<56)  /* Signaled machine check */
+ #define MCI_STATUS_AR	 (1ULL<<55)  /* Action required */
+-#define MCACOD		  0xffff     /* MCA Error Code */
++
++/*
++ * Note that the full MCACOD field of IA32_MCi_STATUS MSR is
++ * bits 15:0.  But bit 12 is the 'F' bit, defined for corrected
++ * errors to indicate that errors are being filtered by hardware.
++ * We should mask out bit 12 when looking for specific signatures
++ * of uncorrected errors - so the F bit is deliberately skipped
++ * in this #define.
++ */
++#define MCACOD		  0xefff     /* MCA Error Code */
+ 
+ /* Architecturally defined codes from SDM Vol. 3B Chapter 15 */
+ #define MCACOD_SCRUB	0x00C0	/* 0xC0-0xCF Memory Scrubbing */
+-#define MCACOD_SCRUBMSK	0xfff0
++#define MCACOD_SCRUBMSK	0xeff0	/* Skip bit 12 ('F' bit) */
+ #define MCACOD_L3WB	0x017A	/* L3 Explicit Writeback */
+ #define MCACOD_DATA	0x0134	/* Data Load */
+ #define MCACOD_INSTR	0x0150	/* Instruction Fetch */
+diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
+index cdbf3677..be12c534 100644
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -45,22 +45,28 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ 		/* Re-load page tables */
+ 		load_cr3(next->pgd);
+ 
+-		/* stop flush ipis for the previous mm */
++		/* Stop flush ipis for the previous mm */
+ 		cpumask_clear_cpu(cpu, mm_cpumask(prev));
+ 
+-		/*
+-		 * load the LDT, if the LDT is different:
+-		 */
++		/* Load the LDT, if the LDT is different: */
+ 		if (unlikely(prev->context.ldt != next->context.ldt))
+ 			load_LDT_nolock(&next->context);
+ 	}
+ #ifdef CONFIG_SMP
+-	else {
++	  else {
+ 		this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+ 		BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next);
+ 
+-		if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next))) {
+-			/* We were in lazy tlb mode and leave_mm disabled
++		if (!cpumask_test_cpu(cpu, mm_cpumask(next))) {
++			/*
++			 * On established mms, the mm_cpumask is only changed
++			 * from irq context, from ptep_clear_flush() while in
++			 * lazy tlb mode, and here. Irqs are blocked during
++			 * schedule, protecting us from simultaneous changes.
++			 */
++			cpumask_set_cpu(cpu, mm_cpumask(next));
++			/*
++			 * We were in lazy tlb mode and leave_mm disabled
+ 			 * tlb flush IPI delivery. We must reload CR3
+ 			 * to make sure to use no freed page tables.
+ 			 */
+diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
+index 3048ded1..59554dca 100644
+--- a/arch/x86/kernel/amd_nb.c
++++ b/arch/x86/kernel/amd_nb.c
+@@ -20,6 +20,7 @@ const struct pci_device_id amd_nb_misc_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ 	{}
+ };
+@@ -27,6 +28,7 @@ EXPORT_SYMBOL(amd_nb_misc_ids);
+ 
+ static const struct pci_device_id amd_nb_link_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F4) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
+ 	{}
+ };
+@@ -81,13 +83,20 @@ int amd_cache_northbridges(void)
+ 			next_northbridge(misc, amd_nb_misc_ids);
+ 		node_to_amd_nb(i)->link = link =
+ 			next_northbridge(link, amd_nb_link_ids);
+-        }
++	}
+ 
++	/* GART present only on Fam15h upto model 0fh */
+ 	if (boot_cpu_data.x86 == 0xf || boot_cpu_data.x86 == 0x10 ||
+-	    boot_cpu_data.x86 == 0x15)
++	    (boot_cpu_data.x86 == 0x15 && boot_cpu_data.x86_model < 0x10))
+ 		amd_northbridges.flags |= AMD_NB_GART;
+ 
+ 	/*
++	 * Check for L3 cache presence.
++	 */
++	if (!cpuid_edx(0x80000006))
++		return 0;
++
++	/*
+ 	 * Some CPU families support L3 Cache Index Disable. There are some
+ 	 * limitations because of E382 and E388 on family 0x10.
+ 	 */
+diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
+index 69562992..087ab2af 100644
+--- a/arch/x86/kernel/signal.c
++++ b/arch/x86/kernel/signal.c
+@@ -364,7 +364,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
+ 		else
+ 			put_user_ex(0, &frame->uc.uc_flags);
+ 		put_user_ex(0, &frame->uc.uc_link);
+-		err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
++		save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+ 
+ 		/* Set up to return from userspace.  */
+ 		restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
+@@ -429,7 +429,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
+ 		else
+ 			put_user_ex(0, &frame->uc.uc_flags);
+ 		put_user_ex(0, &frame->uc.uc_link);
+-		err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
++		save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+ 
+ 		/* Set up to return from userspace.  If provided, use a stub
+ 		   already in userspace.  */
+@@ -496,7 +496,7 @@ static int x32_setup_rt_frame(struct ksignal *ksig,
+ 		else
+ 			put_user_ex(0, &frame->uc.uc_flags);
+ 		put_user_ex(0, &frame->uc.uc_link);
+-		err |= __compat_save_altstack(&frame->uc.uc_stack, regs->sp);
++		compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+ 		put_user_ex(0, &frame->uc.uc__pad0);
+ 
+ 		if (ksig->ka.sa.sa_flags & SA_RESTORER) {
+diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
+index 25b7ae8d..7609e0e4 100644
+--- a/arch/x86/lib/csum-wrappers_64.c
++++ b/arch/x86/lib/csum-wrappers_64.c
+@@ -6,6 +6,7 @@
+  */
+ #include <asm/checksum.h>
+ #include <linux/module.h>
++#include <asm/smap.h>
+ 
+ /**
+  * csum_partial_copy_from_user - Copy and checksum from user space.
+@@ -52,8 +53,10 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
+ 			len -= 2;
+ 		}
+ 	}
++	stac();
+ 	isum = csum_partial_copy_generic((__force const void *)src,
+ 				dst, len, isum, errp, NULL);
++	clac();
+ 	if (unlikely(*errp))
+ 		goto out_err;
+ 
+@@ -82,6 +85,8 @@ __wsum
+ csum_partial_copy_to_user(const void *src, void __user *dst,
+ 			  int len, __wsum isum, int *errp)
+ {
++	__wsum ret;
++
+ 	might_sleep();
+ 
+ 	if (unlikely(!access_ok(VERIFY_WRITE, dst, len))) {
+@@ -105,8 +110,11 @@ csum_partial_copy_to_user(const void *src, void __user *dst,
+ 	}
+ 
+ 	*errp = 0;
+-	return csum_partial_copy_generic(src, (void __force *)dst,
+-					 len, isum, NULL, errp);
++	stac();
++	ret = csum_partial_copy_generic(src, (void __force *)dst,
++					len, isum, NULL, errp);
++	clac();
++	return ret;
+ }
+ EXPORT_SYMBOL(csum_partial_copy_to_user);
+ 
+diff --git a/crypto/api.c b/crypto/api.c
+index 3b618033..37c4c721 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -34,6 +34,8 @@ EXPORT_SYMBOL_GPL(crypto_alg_sem);
+ BLOCKING_NOTIFIER_HEAD(crypto_chain);
+ EXPORT_SYMBOL_GPL(crypto_chain);
+ 
++static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg);
++
+ struct crypto_alg *crypto_mod_get(struct crypto_alg *alg)
+ {
+ 	return try_module_get(alg->cra_module) ? crypto_alg_get(alg) : NULL;
+@@ -144,8 +146,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,
+ 	}
+ 	up_write(&crypto_alg_sem);
+ 
+-	if (alg != &larval->alg)
++	if (alg != &larval->alg) {
+ 		kfree(larval);
++		if (crypto_is_larval(alg))
++			alg = crypto_larval_wait(alg);
++	}
+ 
+ 	return alg;
+ }
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index cab13f2f..7c451cb2 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -155,12 +155,13 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
+ 			pdata->mmio_size = resource_size(&rentry->res);
+ 			pdata->mmio_base = ioremap(rentry->res.start,
+ 						   pdata->mmio_size);
+-			pdata->dev_desc = dev_desc;
+ 			break;
+ 		}
+ 
+ 	acpi_dev_free_resource_list(&resource_list);
+ 
++	pdata->dev_desc = dev_desc;
++
+ 	if (dev_desc->clk_required) {
+ 		ret = register_device_clock(adev, pdata);
+ 		if (ret) {
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index aff789d6..8c7421af 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -1565,11 +1565,12 @@ rbd_img_obj_request_read_callback(struct rbd_obj_request *obj_request)
+ 		obj_request, obj_request->img_request, obj_request->result,
+ 		xferred, length);
+ 	/*
+-	 * ENOENT means a hole in the image.  We zero-fill the
+-	 * entire length of the request.  A short read also implies
+-	 * zero-fill to the end of the request.  Either way we
+-	 * update the xferred count to indicate the whole request
+-	 * was satisfied.
++	 * ENOENT means a hole in the image.  We zero-fill the entire
++	 * length of the request.  A short read also implies zero-fill
++	 * to the end of the request.  An error requires the whole
++	 * length of the request to be reported finished with an error
++	 * to the block layer.  In each case we update the xferred
++	 * count to indicate the whole request was satisfied.
+ 	 */
+ 	rbd_assert(obj_request->type != OBJ_REQUEST_NODATA);
+ 	if (obj_request->result == -ENOENT) {
+@@ -1578,14 +1579,13 @@ rbd_img_obj_request_read_callback(struct rbd_obj_request *obj_request)
+ 		else
+ 			zero_pages(obj_request->pages, 0, length);
+ 		obj_request->result = 0;
+-		obj_request->xferred = length;
+ 	} else if (xferred < length && !obj_request->result) {
+ 		if (obj_request->type == OBJ_REQUEST_BIO)
+ 			zero_bio_chain(obj_request->bio_list, xferred);
+ 		else
+ 			zero_pages(obj_request->pages, xferred, length);
+-		obj_request->xferred = length;
+ 	}
++	obj_request->xferred = length;
+ 	obj_request_done_set(obj_request);
+ }
+ 
+diff --git a/drivers/clk/clk-wm831x.c b/drivers/clk/clk-wm831x.c
+index 16ed0680..917a3ab4 100644
+--- a/drivers/clk/clk-wm831x.c
++++ b/drivers/clk/clk-wm831x.c
+@@ -360,6 +360,8 @@ static int wm831x_clk_probe(struct platform_device *pdev)
+ 	if (!clkdata)
+ 		return -ENOMEM;
+ 
++	clkdata->wm831x = wm831x;
++
+ 	/* XTAL_ENA can only be set via OTP/InstantConfig so just read once */
+ 	ret = wm831x_reg_read(wm831x, WM831X_CLOCK_CONTROL_2);
+ 	if (ret < 0) {
+diff --git a/drivers/cpuidle/coupled.c b/drivers/cpuidle/coupled.c
+index 2a297f86..fe853903 100644
+--- a/drivers/cpuidle/coupled.c
++++ b/drivers/cpuidle/coupled.c
+@@ -106,6 +106,7 @@ struct cpuidle_coupled {
+ 	cpumask_t coupled_cpus;
+ 	int requested_state[NR_CPUS];
+ 	atomic_t ready_waiting_counts;
++	atomic_t abort_barrier;
+ 	int online_count;
+ 	int refcnt;
+ 	int prevent;
+@@ -122,12 +123,19 @@ static DEFINE_MUTEX(cpuidle_coupled_lock);
+ static DEFINE_PER_CPU(struct call_single_data, cpuidle_coupled_poke_cb);
+ 
+ /*
+- * The cpuidle_coupled_poked_mask mask is used to avoid calling
++ * The cpuidle_coupled_poke_pending mask is used to avoid calling
+  * __smp_call_function_single with the per cpu call_single_data struct already
+  * in use.  This prevents a deadlock where two cpus are waiting for each others
+  * call_single_data struct to be available
+  */
+-static cpumask_t cpuidle_coupled_poked_mask;
++static cpumask_t cpuidle_coupled_poke_pending;
++
++/*
++ * The cpuidle_coupled_poked mask is used to ensure that each cpu has been poked
++ * once to minimize entering the ready loop with a poke pending, which would
++ * require aborting and retrying.
++ */
++static cpumask_t cpuidle_coupled_poked;
+ 
+ /**
+  * cpuidle_coupled_parallel_barrier - synchronize all online coupled cpus
+@@ -291,10 +299,11 @@ static inline int cpuidle_coupled_get_state(struct cpuidle_device *dev,
+ 	return state;
+ }
+ 
+-static void cpuidle_coupled_poked(void *info)
++static void cpuidle_coupled_handle_poke(void *info)
+ {
+ 	int cpu = (unsigned long)info;
+-	cpumask_clear_cpu(cpu, &cpuidle_coupled_poked_mask);
++	cpumask_set_cpu(cpu, &cpuidle_coupled_poked);
++	cpumask_clear_cpu(cpu, &cpuidle_coupled_poke_pending);
+ }
+ 
+ /**
+@@ -313,7 +322,7 @@ static void cpuidle_coupled_poke(int cpu)
+ {
+ 	struct call_single_data *csd = &per_cpu(cpuidle_coupled_poke_cb, cpu);
+ 
+-	if (!cpumask_test_and_set_cpu(cpu, &cpuidle_coupled_poked_mask))
++	if (!cpumask_test_and_set_cpu(cpu, &cpuidle_coupled_poke_pending))
+ 		__smp_call_function_single(cpu, csd, 0);
+ }
+ 
+@@ -340,30 +349,19 @@ static void cpuidle_coupled_poke_others(int this_cpu,
+  * @coupled: the struct coupled that contains the current cpu
+  * @next_state: the index in drv->states of the requested state for this cpu
+  *
+- * Updates the requested idle state for the specified cpuidle device,
+- * poking all coupled cpus out of idle if necessary to let them see the new
+- * state.
++ * Updates the requested idle state for the specified cpuidle device.
++ * Returns the number of waiting cpus.
+  */
+-static void cpuidle_coupled_set_waiting(int cpu,
++static int cpuidle_coupled_set_waiting(int cpu,
+ 		struct cpuidle_coupled *coupled, int next_state)
+ {
+-	int w;
+-
+ 	coupled->requested_state[cpu] = next_state;
+ 
+ 	/*
+-	 * If this is the last cpu to enter the waiting state, poke
+-	 * all the other cpus out of their waiting state so they can
+-	 * enter a deeper state.  This can race with one of the cpus
+-	 * exiting the waiting state due to an interrupt and
+-	 * decrementing waiting_count, see comment below.
+-	 *
+ 	 * The atomic_inc_return provides a write barrier to order the write
+ 	 * to requested_state with the later write that increments ready_count.
+ 	 */
+-	w = atomic_inc_return(&coupled->ready_waiting_counts) & WAITING_MASK;
+-	if (w == coupled->online_count)
+-		cpuidle_coupled_poke_others(cpu, coupled);
++	return atomic_inc_return(&coupled->ready_waiting_counts) & WAITING_MASK;
+ }
+ 
+ /**
+@@ -410,19 +408,33 @@ static void cpuidle_coupled_set_done(int cpu, struct cpuidle_coupled *coupled)
+  * been processed and the poke bit has been cleared.
+  *
+  * Other interrupts may also be processed while interrupts are enabled, so
+- * need_resched() must be tested after turning interrupts off again to make sure
++ * need_resched() must be tested after this function returns to make sure
+  * the interrupt didn't schedule work that should take the cpu out of idle.
+  *
+- * Returns 0 if need_resched was false, -EINTR if need_resched was true.
++ * Returns 0 if no poke was pending, 1 if a poke was cleared.
+  */
+ static int cpuidle_coupled_clear_pokes(int cpu)
+ {
++	if (!cpumask_test_cpu(cpu, &cpuidle_coupled_poke_pending))
++		return 0;
++
+ 	local_irq_enable();
+-	while (cpumask_test_cpu(cpu, &cpuidle_coupled_poked_mask))
++	while (cpumask_test_cpu(cpu, &cpuidle_coupled_poke_pending))
+ 		cpu_relax();
+ 	local_irq_disable();
+ 
+-	return need_resched() ? -EINTR : 0;
++	return 1;
++}
++
++static bool cpuidle_coupled_any_pokes_pending(struct cpuidle_coupled *coupled)
++{
++	cpumask_t cpus;
++	int ret;
++
++	cpumask_and(&cpus, cpu_online_mask, &coupled->coupled_cpus);
++	ret = cpumask_and(&cpus, &cpuidle_coupled_poke_pending, &cpus);
++
++	return ret;
+ }
+ 
+ /**
+@@ -449,12 +461,14 @@ int cpuidle_enter_state_coupled(struct cpuidle_device *dev,
+ {
+ 	int entered_state = -1;
+ 	struct cpuidle_coupled *coupled = dev->coupled;
++	int w;
+ 
+ 	if (!coupled)
+ 		return -EINVAL;
+ 
+ 	while (coupled->prevent) {
+-		if (cpuidle_coupled_clear_pokes(dev->cpu)) {
++		cpuidle_coupled_clear_pokes(dev->cpu);
++		if (need_resched()) {
+ 			local_irq_enable();
+ 			return entered_state;
+ 		}
+@@ -465,15 +479,37 @@ int cpuidle_enter_state_coupled(struct cpuidle_device *dev,
+ 	/* Read barrier ensures online_count is read after prevent is cleared */
+ 	smp_rmb();
+ 
+-	cpuidle_coupled_set_waiting(dev->cpu, coupled, next_state);
++reset:
++	cpumask_clear_cpu(dev->cpu, &cpuidle_coupled_poked);
++
++	w = cpuidle_coupled_set_waiting(dev->cpu, coupled, next_state);
++	/*
++	 * If this is the last cpu to enter the waiting state, poke
++	 * all the other cpus out of their waiting state so they can
++	 * enter a deeper state.  This can race with one of the cpus
++	 * exiting the waiting state due to an interrupt and
++	 * decrementing waiting_count, see comment below.
++	 */
++	if (w == coupled->online_count) {
++		cpumask_set_cpu(dev->cpu, &cpuidle_coupled_poked);
++		cpuidle_coupled_poke_others(dev->cpu, coupled);
++	}
+ 
+ retry:
+ 	/*
+ 	 * Wait for all coupled cpus to be idle, using the deepest state
+-	 * allowed for a single cpu.
++	 * allowed for a single cpu.  If this was not the poking cpu, wait
++	 * for at least one poke before leaving to avoid a race where
++	 * two cpus could arrive at the waiting loop at the same time,
++	 * but the first of the two to arrive could skip the loop without
++	 * processing the pokes from the last to arrive.
+ 	 */
+-	while (!cpuidle_coupled_cpus_waiting(coupled)) {
+-		if (cpuidle_coupled_clear_pokes(dev->cpu)) {
++	while (!cpuidle_coupled_cpus_waiting(coupled) ||
++			!cpumask_test_cpu(dev->cpu, &cpuidle_coupled_poked)) {
++		if (cpuidle_coupled_clear_pokes(dev->cpu))
++			continue;
++
++		if (need_resched()) {
+ 			cpuidle_coupled_set_not_waiting(dev->cpu, coupled);
+ 			goto out;
+ 		}
+@@ -487,12 +523,19 @@ retry:
+ 			dev->safe_state_index);
+ 	}
+ 
+-	if (cpuidle_coupled_clear_pokes(dev->cpu)) {
++	cpuidle_coupled_clear_pokes(dev->cpu);
++	if (need_resched()) {
+ 		cpuidle_coupled_set_not_waiting(dev->cpu, coupled);
+ 		goto out;
+ 	}
+ 
+ 	/*
++	 * Make sure final poke status for this cpu is visible before setting
++	 * cpu as ready.
++	 */
++	smp_wmb();
++
++	/*
+ 	 * All coupled cpus are probably idle.  There is a small chance that
+ 	 * one of the other cpus just became active.  Increment the ready count,
+ 	 * and spin until all coupled cpus have incremented the counter. Once a
+@@ -511,6 +554,28 @@ retry:
+ 		cpu_relax();
+ 	}
+ 
++	/*
++	 * Make sure read of all cpus ready is done before reading pending pokes
++	 */
++	smp_rmb();
++
++	/*
++	 * There is a small chance that a cpu left and reentered idle after this
++	 * cpu saw that all cpus were waiting.  The cpu that reentered idle will
++	 * have sent this cpu a poke, which will still be pending after the
++	 * ready loop.  The pending interrupt may be lost by the interrupt
++	 * controller when entering the deep idle state.  It's not possible to
++	 * clear a pending interrupt without turning interrupts on and handling
++	 * it, and it's too late to turn on interrupts here, so reset the
++	 * coupled idle state of all cpus and retry.
++	 */
++	if (cpuidle_coupled_any_pokes_pending(coupled)) {
++		cpuidle_coupled_set_done(dev->cpu, coupled);
++		/* Wait for all cpus to see the pending pokes */
++		cpuidle_coupled_parallel_barrier(dev, &coupled->abort_barrier);
++		goto reset;
++	}
++
+ 	/* all cpus have acked the coupled state */
+ 	next_state = cpuidle_coupled_get_state(dev, coupled);
+ 
+@@ -596,7 +661,7 @@ have_coupled:
+ 	coupled->refcnt++;
+ 
+ 	csd = &per_cpu(cpuidle_coupled_poke_cb, dev->cpu);
+-	csd->func = cpuidle_coupled_poked;
++	csd->func = cpuidle_coupled_handle_poke;
+ 	csd->info = (void *)(unsigned long)dev->cpu;
+ 
+ 	return 0;
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index 8b6a0343..8b3d9014 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -2470,8 +2470,15 @@ static int amd64_init_one_instance(struct pci_dev *F2)
+ 	layers[0].size = pvt->csels[0].b_cnt;
+ 	layers[0].is_virt_csrow = true;
+ 	layers[1].type = EDAC_MC_LAYER_CHANNEL;
+-	layers[1].size = pvt->channel_count;
++
++	/*
++	 * Always allocate two channels since we can have setups with DIMMs on
++	 * only one channel. Also, this simplifies handling later for the price
++	 * of a couple of KBs tops.
++	 */
++	layers[1].size = 2;
+ 	layers[1].is_virt_csrow = false;
++
+ 	mci = edac_mc_alloc(nid, ARRAY_SIZE(layers), layers, 0);
+ 	if (!mci)
+ 		goto err_siblings;
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 9e62bbed..0cb9b5d8 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -125,6 +125,9 @@ static struct edid_quirk {
+ 
+ 	/* ViewSonic VA2026w */
+ 	{ "VSC", 5020, EDID_QUIRK_FORCE_REDUCED_BLANKING },
++
++	/* Medion MD 30217 PG */
++	{ "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
+ };
+ 
+ /*
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 402f4868..ed626e01 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -63,6 +63,8 @@ struct hid_report *hid_register_report(struct hid_device *device, unsigned type,
+ 	struct hid_report_enum *report_enum = device->report_enum + type;
+ 	struct hid_report *report;
+ 
++	if (id >= HID_MAX_IDS)
++		return NULL;
+ 	if (report_enum->report_id_hash[id])
+ 		return report_enum->report_id_hash[id];
+ 
+@@ -404,8 +406,10 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
+ 
+ 	case HID_GLOBAL_ITEM_TAG_REPORT_ID:
+ 		parser->global.report_id = item_udata(item);
+-		if (parser->global.report_id == 0) {
+-			hid_err(parser->device, "report_id 0 is invalid\n");
++		if (parser->global.report_id == 0 ||
++		    parser->global.report_id >= HID_MAX_IDS) {
++			hid_err(parser->device, "report_id %u is invalid\n",
++				parser->global.report_id);
+ 			return -1;
+ 		}
+ 		return 0;
+@@ -575,7 +579,7 @@ static void hid_close_report(struct hid_device *device)
+ 	for (i = 0; i < HID_REPORT_TYPES; i++) {
+ 		struct hid_report_enum *report_enum = device->report_enum + i;
+ 
+-		for (j = 0; j < 256; j++) {
++		for (j = 0; j < HID_MAX_IDS; j++) {
+ 			struct hid_report *report = report_enum->report_id_hash[j];
+ 			if (report)
+ 				hid_free_report(report);
+@@ -1152,7 +1156,12 @@ EXPORT_SYMBOL_GPL(hid_output_report);
+ 
+ int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
+ {
+-	unsigned size = field->report_size;
++	unsigned size;
++
++	if (!field)
++		return -1;
++
++	size = field->report_size;
+ 
+ 	hid_dump_input(field->report->device, field->usage + offset, value);
+ 
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 21688853..ca0219f9 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -135,9 +135,9 @@
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS   0x023b
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI  0x0255
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO   0x0256
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI	0x0291
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO	0x0292
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS	0x0293
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI	0x0290
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO	0x0291
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS	0x0292
+ #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY	0x030a
+ #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY	0x030b
+ #define USB_DEVICE_ID_APPLE_IRCONTROL	0x8240
+@@ -646,6 +646,7 @@
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16   0x0012
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17   0x0013
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18   0x0014
++#define USB_DEVICE_ID_NTRIG_DUOSENSE 0x1500
+ 
+ #define USB_VENDOR_ID_ONTRAK		0x0a07
+ #define USB_DEVICE_ID_ONTRAK_ADU100	0x0064
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 945b8158..ac5e9352 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -340,7 +340,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ {
+ 	struct hid_device *dev = container_of(psy, struct hid_device, battery);
+ 	int ret = 0;
+-	__u8 buf[2] = {};
++	__u8 *buf;
+ 
+ 	switch (prop) {
+ 	case POWER_SUPPLY_PROP_PRESENT:
+@@ -349,13 +349,20 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ 		break;
+ 
+ 	case POWER_SUPPLY_PROP_CAPACITY:
++
++		buf = kmalloc(2 * sizeof(__u8), GFP_KERNEL);
++		if (!buf) {
++			ret = -ENOMEM;
++			break;
++		}
+ 		ret = dev->hid_get_raw_report(dev, dev->battery_report_id,
+-					      buf, sizeof(buf),
++					      buf, 2,
+ 					      dev->battery_report_type);
+ 
+ 		if (ret != 2) {
+ 			if (ret >= 0)
+ 				ret = -EINVAL;
++			kfree(buf);
+ 			break;
+ 		}
+ 
+@@ -364,6 +371,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ 		    buf[1] <= dev->battery_max)
+ 			val->intval = (100 * (buf[1] - dev->battery_min)) /
+ 				(dev->battery_max - dev->battery_min);
++		kfree(buf);
+ 		break;
+ 
+ 	case POWER_SUPPLY_PROP_MODEL_NAME:
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index ef951025..5482156a 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev)
+ 	struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT].
+ 				    report_id_hash[0x0d];
+ 
+-	if (!report)
++	if (!report || report->maxfield < 1 ||
++	    report->field[0]->report_count < 1)
+ 		return -EINVAL;
+ 
+ 	hid_hw_request(hdev, report, HID_REQ_GET_REPORT);
+diff --git a/drivers/hid/hid-picolcd_cir.c b/drivers/hid/hid-picolcd_cir.c
+index e346038f..59d5eb1e 100644
+--- a/drivers/hid/hid-picolcd_cir.c
++++ b/drivers/hid/hid-picolcd_cir.c
+@@ -145,6 +145,7 @@ void picolcd_exit_cir(struct picolcd_data *data)
+ 	struct rc_dev *rdev = data->rc_dev;
+ 
+ 	data->rc_dev = NULL;
+-	rc_unregister_device(rdev);
++	if (rdev)
++		rc_unregister_device(rdev);
+ }
+ 
+diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
+index b48092d0..acbb0210 100644
+--- a/drivers/hid/hid-picolcd_core.c
++++ b/drivers/hid/hid-picolcd_core.c
+@@ -290,7 +290,7 @@ static ssize_t picolcd_operation_mode_store(struct device *dev,
+ 		buf += 10;
+ 		cnt -= 10;
+ 	}
+-	if (!report)
++	if (!report || report->maxfield != 1)
+ 		return -EINVAL;
+ 
+ 	while (cnt > 0 && (buf[cnt-1] == '\n' || buf[cnt-1] == '\r'))
+diff --git a/drivers/hid/hid-picolcd_fb.c b/drivers/hid/hid-picolcd_fb.c
+index 591f6b22..c930ab85 100644
+--- a/drivers/hid/hid-picolcd_fb.c
++++ b/drivers/hid/hid-picolcd_fb.c
+@@ -593,10 +593,14 @@ err_nomem:
+ void picolcd_exit_framebuffer(struct picolcd_data *data)
+ {
+ 	struct fb_info *info = data->fb_info;
+-	struct picolcd_fb_data *fbdata = info->par;
++	struct picolcd_fb_data *fbdata;
+ 	unsigned long flags;
+ 
++	if (!info)
++		return;
++
+ 	device_remove_file(&data->hdev->dev, &dev_attr_fb_update_rate);
++	fbdata = info->par;
+ 
+ 	/* disconnect framebuffer from HID dev */
+ 	spin_lock_irqsave(&fbdata->lock, flags);
+diff --git a/drivers/hid/hid-pl.c b/drivers/hid/hid-pl.c
+index d29112fa..2dcd7d98 100644
+--- a/drivers/hid/hid-pl.c
++++ b/drivers/hid/hid-pl.c
+@@ -132,8 +132,14 @@ static int plff_init(struct hid_device *hid)
+ 			strong = &report->field[0]->value[2];
+ 			weak = &report->field[0]->value[3];
+ 			debug("detected single-field device");
+-		} else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 &&
+-				report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) {
++		} else if (report->field[0]->maxusage == 1 &&
++			   report->field[0]->usage[0].hid ==
++				(HID_UP_LED | 0x43) &&
++			   report->maxfield >= 4 &&
++			   report->field[0]->report_count >= 1 &&
++			   report->field[1]->report_count >= 1 &&
++			   report->field[2]->report_count >= 1 &&
++			   report->field[3]->report_count >= 1) {
+ 			report->field[0]->value[0] = 0x00;
+ 			report->field[1]->value[0] = 0x00;
+ 			strong = &report->field[2]->value[0];
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index ca749810..aa34755c 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -221,7 +221,8 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
+ 
+ 	mutex_lock(&data->mutex);
+ 	report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
+-	if (!report || (field_index >=  report->maxfield)) {
++	if (!report || (field_index >=  report->maxfield) ||
++	    report->field[field_index]->report_count < 1) {
+ 		ret = -EINVAL;
+ 		goto done_proc;
+ 	}
+diff --git a/drivers/hid/hid-speedlink.c b/drivers/hid/hid-speedlink.c
+index a2f587d0..7112f3e8 100644
+--- a/drivers/hid/hid-speedlink.c
++++ b/drivers/hid/hid-speedlink.c
+@@ -3,7 +3,7 @@
+  *  Fixes "jumpy" cursor and removes nonexistent keyboard LEDS from
+  *  the HID descriptor.
+  *
+- *  Copyright (c) 2011 Stefan Kriwanek <mail@××××××××××××××.de>
++ *  Copyright (c) 2011, 2013 Stefan Kriwanek <dev@××××××××××××××.de>
+  */
+ 
+ /*
+@@ -46,8 +46,13 @@ static int speedlink_event(struct hid_device *hdev, struct hid_field *field,
+ 		struct hid_usage *usage, __s32 value)
+ {
+ 	/* No other conditions due to usage_table. */
+-	/* Fix "jumpy" cursor (invalid events sent by device). */
+-	if (value == 256)
++
++	/* This fixes the "jumpy" cursor occuring due to invalid events sent
++	 * by the device. Some devices only send them with value==+256, others
++	 * don't. However, catching abs(value)>=256 is restrictive enough not
++	 * to interfere with devices that were bug-free (has been tested).
++	 */
++	if (abs(value) >= 256)
+ 		return 1;
+ 	/* Drop useless distance 0 events (on button clicks etc.) as well */
+ 	if (value == 0)
+diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
+index a7451632..612a655b 100644
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -113,7 +113,7 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer,
+ 	__u8 *buf;
+ 	int ret = 0;
+ 
+-	if (!hidraw_table[minor]) {
++	if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
+ 		ret = -ENODEV;
+ 		goto out;
+ 	}
+@@ -261,7 +261,7 @@ static int hidraw_open(struct inode *inode, struct file *file)
+ 	}
+ 
+ 	mutex_lock(&minors_lock);
+-	if (!hidraw_table[minor]) {
++	if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
+ 		err = -ENODEV;
+ 		goto out_unlock;
+ 	}
+@@ -302,39 +302,38 @@ static int hidraw_fasync(int fd, struct file *file, int on)
+ 	return fasync_helper(fd, file, on, &list->fasync);
+ }
+ 
++static void drop_ref(struct hidraw *hidraw, int exists_bit)
++{
++	if (exists_bit) {
++		hid_hw_close(hidraw->hid);
++		hidraw->exist = 0;
++		if (hidraw->open)
++			wake_up_interruptible(&hidraw->wait);
++	} else {
++		--hidraw->open;
++	}
++
++	if (!hidraw->open && !hidraw->exist) {
++		device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
++		hidraw_table[hidraw->minor] = NULL;
++		kfree(hidraw);
++	}
++}
++
+ static int hidraw_release(struct inode * inode, struct file * file)
+ {
+ 	unsigned int minor = iminor(inode);
+-	struct hidraw *dev;
+ 	struct hidraw_list *list = file->private_data;
+-	int ret;
+-	int i;
+ 
+ 	mutex_lock(&minors_lock);
+-	if (!hidraw_table[minor]) {
+-		ret = -ENODEV;
+-		goto unlock;
+-	}
+ 
+ 	list_del(&list->node);
+-	dev = hidraw_table[minor];
+-	if (!--dev->open) {
+-		if (list->hidraw->exist) {
+-			hid_hw_power(dev->hid, PM_HINT_NORMAL);
+-			hid_hw_close(dev->hid);
+-		} else {
+-			kfree(list->hidraw);
+-		}
+-	}
+-
+-	for (i = 0; i < HIDRAW_BUFFER_SIZE; ++i)
+-		kfree(list->buffer[i].value);
+ 	kfree(list);
+-	ret = 0;
+-unlock:
+-	mutex_unlock(&minors_lock);
+ 
+-	return ret;
++	drop_ref(hidraw_table[minor], 0);
++
++	mutex_unlock(&minors_lock);
++	return 0;
+ }
+ 
+ static long hidraw_ioctl(struct file *file, unsigned int cmd,
+@@ -539,18 +538,9 @@ void hidraw_disconnect(struct hid_device *hid)
+ 	struct hidraw *hidraw = hid->hidraw;
+ 
+ 	mutex_lock(&minors_lock);
+-	hidraw->exist = 0;
+-
+-	device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
+ 
+-	hidraw_table[hidraw->minor] = NULL;
++	drop_ref(hidraw, 1);
+ 
+-	if (hidraw->open) {
+-		hid_hw_close(hid);
+-		wake_up_interruptible(&hidraw->wait);
+-	} else {
+-		kfree(hidraw);
+-	}
+ 	mutex_unlock(&minors_lock);
+ }
+ EXPORT_SYMBOL_GPL(hidraw_disconnect);
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 19b8360f..07345521 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -109,6 +109,8 @@ static const struct hid_blacklist {
+ 	{ USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
+ 	{ USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
+ 	{ USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
++	{ USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
++
+ 	{ 0, 0 }
+ };
+ 
+diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
+index 4ef4d5e1..a73f9618 100644
+--- a/drivers/input/mouse/bcm5974.c
++++ b/drivers/input/mouse/bcm5974.c
+@@ -89,9 +89,9 @@
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO	0x025a
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS	0x025b
+ /* MacbookAir6,2 (unibody, June 2013) */
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI	0x0291
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO	0x0292
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS	0x0293
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI	0x0290
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO	0x0291
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS	0x0292
+ 
+ #define BCM5974_DEVICE(prod) {					\
+ 	.match_flags = (USB_DEVICE_ID_MATCH_DEVICE |		\
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index b4f0e28d..fa004b11 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -890,56 +890,54 @@ static int dma_pte_clear_range(struct dmar_domain *domain,
+ 	return order;
+ }
+ 
++static void dma_pte_free_level(struct dmar_domain *domain, int level,
++			       struct dma_pte *pte, unsigned long pfn,
++			       unsigned long start_pfn, unsigned long last_pfn)
++{
++	pfn = max(start_pfn, pfn);
++	pte = &pte[pfn_level_offset(pfn, level)];
++
++	do {
++		unsigned long level_pfn;
++		struct dma_pte *level_pte;
++
++		if (!dma_pte_present(pte) || dma_pte_superpage(pte))
++			goto next;
++
++		level_pfn = pfn & level_mask(level - 1);
++		level_pte = phys_to_virt(dma_pte_addr(pte));
++
++		if (level > 2)
++			dma_pte_free_level(domain, level - 1, level_pte,
++					   level_pfn, start_pfn, last_pfn);
++
++		/* If range covers entire pagetable, free it */
++		if (!(start_pfn > level_pfn ||
++		      last_pfn < level_pfn + level_size(level))) {
++			dma_clear_pte(pte);
++			domain_flush_cache(domain, pte, sizeof(*pte));
++			free_pgtable_page(level_pte);
++		}
++next:
++		pfn += level_size(level);
++	} while (!first_pte_in_page(++pte) && pfn <= last_pfn);
++}
++
+ /* free page table pages. last level pte should already be cleared */
+ static void dma_pte_free_pagetable(struct dmar_domain *domain,
+ 				   unsigned long start_pfn,
+ 				   unsigned long last_pfn)
+ {
+ 	int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
+-	struct dma_pte *first_pte, *pte;
+-	int total = agaw_to_level(domain->agaw);
+-	int level;
+-	unsigned long tmp;
+-	int large_page = 2;
+ 
+ 	BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
+ 	BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width);
+ 	BUG_ON(start_pfn > last_pfn);
+ 
+ 	/* We don't need lock here; nobody else touches the iova range */
+-	level = 2;
+-	while (level <= total) {
+-		tmp = align_to_level(start_pfn, level);
+-
+-		/* If we can't even clear one PTE at this level, we're done */
+-		if (tmp + level_size(level) - 1 > last_pfn)
+-			return;
+-
+-		do {
+-			large_page = level;
+-			first_pte = pte = dma_pfn_level_pte(domain, tmp, level, &large_page);
+-			if (large_page > level)
+-				level = large_page + 1;
+-			if (!pte) {
+-				tmp = align_to_level(tmp + 1, level + 1);
+-				continue;
+-			}
+-			do {
+-				if (dma_pte_present(pte)) {
+-					free_pgtable_page(phys_to_virt(dma_pte_addr(pte)));
+-					dma_clear_pte(pte);
+-				}
+-				pte++;
+-				tmp += level_size(level);
+-			} while (!first_pte_in_page(pte) &&
+-				 tmp + level_size(level) - 1 <= last_pfn);
++	dma_pte_free_level(domain, agaw_to_level(domain->agaw),
++			   domain->pgd, 0, start_pfn, last_pfn);
+ 
+-			domain_flush_cache(domain, first_pte,
+-					   (void *)pte - (void *)first_pte);
+-			
+-		} while (tmp && tmp + level_size(level) - 1 <= last_pfn);
+-		level++;
+-	}
+ 	/* free pgd */
+ 	if (start_pfn == 0 && last_pfn == DOMAIN_MAX_PFN(domain->gaw)) {
+ 		free_pgtable_page(domain->pgd);
+diff --git a/drivers/leds/leds-wm831x-status.c b/drivers/leds/leds-wm831x-status.c
+index 6bd5c679..b7d83d68 100644
+--- a/drivers/leds/leds-wm831x-status.c
++++ b/drivers/leds/leds-wm831x-status.c
+@@ -230,9 +230,9 @@ static int wm831x_status_probe(struct platform_device *pdev)
+ 	int id = pdev->id % ARRAY_SIZE(chip_pdata->status);
+ 	int ret;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_IO, 0);
++	res = platform_get_resource(pdev, IORESOURCE_REG, 0);
+ 	if (res == NULL) {
+-		dev_err(&pdev->dev, "No I/O resource\n");
++		dev_err(&pdev->dev, "No register resource\n");
+ 		ret = -EINVAL;
+ 		goto err;
+ 	}
+diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c
+index 297f1b2f..8df1aea5 100644
+--- a/drivers/media/common/siano/smsdvb-main.c
++++ b/drivers/media/common/siano/smsdvb-main.c
+@@ -275,7 +275,8 @@ static void smsdvb_update_per_slices(struct smsdvb_client_t *client,
+ 
+ 	/* Legacy PER/BER */
+ 	tmp = p->ets_packets * 65535;
+-	do_div(tmp, p->ts_packets + p->ets_packets);
++	if (p->ts_packets + p->ets_packets)
++		do_div(tmp, p->ts_packets + p->ets_packets);
+ 	client->legacy_per = tmp;
+ }
+ 
+diff --git a/drivers/media/dvb-frontends/mb86a20s.c b/drivers/media/dvb-frontends/mb86a20s.c
+index 856374bd..2c7217fb 100644
+--- a/drivers/media/dvb-frontends/mb86a20s.c
++++ b/drivers/media/dvb-frontends/mb86a20s.c
+@@ -157,7 +157,6 @@ static struct regdata mb86a20s_init2[] = {
+ 	{ 0x45, 0x04 },				/* CN symbol 4 */
+ 	{ 0x48, 0x04 },				/* CN manual mode */
+ 
+-	{ 0x50, 0xd5 }, { 0x51, 0x01 },		/* Serial */
+ 	{ 0x50, 0xd6 }, { 0x51, 0x1f },
+ 	{ 0x50, 0xd2 }, { 0x51, 0x03 },
+ 	{ 0x50, 0xd7 }, { 0x51, 0xbf },
+@@ -1860,16 +1859,15 @@ static int mb86a20s_initfe(struct dvb_frontend *fe)
+ 	dev_dbg(&state->i2c->dev, "%s: IF=%d, IF reg=0x%06llx\n",
+ 		__func__, state->if_freq, (long long)pll);
+ 
+-	if (!state->config->is_serial) {
++	if (!state->config->is_serial)
+ 		regD5 &= ~1;
+ 
+-		rc = mb86a20s_writereg(state, 0x50, 0xd5);
+-		if (rc < 0)
+-			goto err;
+-		rc = mb86a20s_writereg(state, 0x51, regD5);
+-		if (rc < 0)
+-			goto err;
+-	}
++	rc = mb86a20s_writereg(state, 0x50, 0xd5);
++	if (rc < 0)
++		goto err;
++	rc = mb86a20s_writereg(state, 0x51, regD5);
++	if (rc < 0)
++		goto err;
+ 
+ 	rc = mb86a20s_writeregdata(state, mb86a20s_init2);
+ 	if (rc < 0)
+diff --git a/drivers/media/platform/coda.c b/drivers/media/platform/coda.c
+index 9d1481a6..c504f70d 100644
+--- a/drivers/media/platform/coda.c
++++ b/drivers/media/platform/coda.c
+@@ -1933,7 +1933,7 @@ MODULE_DEVICE_TABLE(platform, coda_platform_ids);
+ 
+ #ifdef CONFIG_OF
+ static const struct of_device_id coda_dt_ids[] = {
+-	{ .compatible = "fsl,imx27-vpu", .data = &coda_platform_ids[CODA_IMX27] },
++	{ .compatible = "fsl,imx27-vpu", .data = &coda_devdata[CODA_IMX27] },
+ 	{ .compatible = "fsl,imx53-vpu", .data = &coda_devdata[CODA_IMX53] },
+ 	{ /* sentinel */ }
+ };
+diff --git a/drivers/media/platform/exynos-gsc/gsc-core.c b/drivers/media/platform/exynos-gsc/gsc-core.c
+index 33b5ffc8..f45b940d 100644
+--- a/drivers/media/platform/exynos-gsc/gsc-core.c
++++ b/drivers/media/platform/exynos-gsc/gsc-core.c
+@@ -1122,10 +1122,14 @@ static int gsc_probe(struct platform_device *pdev)
+ 		goto err_clk;
+ 	}
+ 
+-	ret = gsc_register_m2m_device(gsc);
++	ret = v4l2_device_register(dev, &gsc->v4l2_dev);
+ 	if (ret)
+ 		goto err_clk;
+ 
++	ret = gsc_register_m2m_device(gsc);
++	if (ret)
++		goto err_v4l2;
++
+ 	platform_set_drvdata(pdev, gsc);
+ 	pm_runtime_enable(dev);
+ 	ret = pm_runtime_get_sync(&pdev->dev);
+@@ -1147,6 +1151,8 @@ err_pm:
+ 	pm_runtime_put(dev);
+ err_m2m:
+ 	gsc_unregister_m2m_device(gsc);
++err_v4l2:
++	v4l2_device_unregister(&gsc->v4l2_dev);
+ err_clk:
+ 	gsc_clk_put(gsc);
+ 	return ret;
+@@ -1157,6 +1163,7 @@ static int gsc_remove(struct platform_device *pdev)
+ 	struct gsc_dev *gsc = platform_get_drvdata(pdev);
+ 
+ 	gsc_unregister_m2m_device(gsc);
++	v4l2_device_unregister(&gsc->v4l2_dev);
+ 
+ 	vb2_dma_contig_cleanup_ctx(gsc->alloc_ctx);
+ 	pm_runtime_disable(&pdev->dev);
+diff --git a/drivers/media/platform/exynos-gsc/gsc-core.h b/drivers/media/platform/exynos-gsc/gsc-core.h
+index cc19bba0..76435d3b 100644
+--- a/drivers/media/platform/exynos-gsc/gsc-core.h
++++ b/drivers/media/platform/exynos-gsc/gsc-core.h
+@@ -343,6 +343,7 @@ struct gsc_dev {
+ 	unsigned long			state;
+ 	struct vb2_alloc_ctx		*alloc_ctx;
+ 	struct video_device		vdev;
++	struct v4l2_device		v4l2_dev;
+ };
+ 
+ /**
+diff --git a/drivers/media/platform/exynos-gsc/gsc-m2m.c b/drivers/media/platform/exynos-gsc/gsc-m2m.c
+index 40a73f7d..e576ff2d 100644
+--- a/drivers/media/platform/exynos-gsc/gsc-m2m.c
++++ b/drivers/media/platform/exynos-gsc/gsc-m2m.c
+@@ -751,6 +751,7 @@ int gsc_register_m2m_device(struct gsc_dev *gsc)
+ 	gsc->vdev.release	= video_device_release_empty;
+ 	gsc->vdev.lock		= &gsc->lock;
+ 	gsc->vdev.vfl_dir	= VFL_DIR_M2M;
++	gsc->vdev.v4l2_dev	= &gsc->v4l2_dev;
+ 	snprintf(gsc->vdev.name, sizeof(gsc->vdev.name), "%s.%d:m2m",
+ 					GSC_MODULE_NAME, gsc->id);
+ 
+diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
+index 15ef8f28..b5b480be 100644
+--- a/drivers/media/platform/exynos4-is/media-dev.c
++++ b/drivers/media/platform/exynos4-is/media-dev.c
+@@ -1441,9 +1441,9 @@ static int fimc_md_probe(struct platform_device *pdev)
+ err_unlock:
+ 	mutex_unlock(&fmd->media_dev.graph_mutex);
+ err_clk:
+-	media_device_unregister(&fmd->media_dev);
+ 	fimc_md_put_clocks(fmd);
+ 	fimc_md_unregister_entities(fmd);
++	media_device_unregister(&fmd->media_dev);
+ err_md:
+ 	v4l2_device_unregister(&fmd->v4l2_dev);
+ 	return ret;
+diff --git a/drivers/media/platform/s5p-g2d/g2d.c b/drivers/media/platform/s5p-g2d/g2d.c
+index 553d87e5..fd6289d6 100644
+--- a/drivers/media/platform/s5p-g2d/g2d.c
++++ b/drivers/media/platform/s5p-g2d/g2d.c
+@@ -784,6 +784,7 @@ static int g2d_probe(struct platform_device *pdev)
+ 	}
+ 	*vfd = g2d_videodev;
+ 	vfd->lock = &dev->mutex;
++	vfd->v4l2_dev = &dev->v4l2_dev;
+ 	ret = video_register_device(vfd, VFL_TYPE_GRABBER, 0);
+ 	if (ret) {
+ 		v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
+diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c
+index 8247c19d..77d7b7fb 100644
+--- a/drivers/media/usb/hdpvr/hdpvr-core.c
++++ b/drivers/media/usb/hdpvr/hdpvr-core.c
+@@ -311,6 +311,11 @@ static int hdpvr_probe(struct usb_interface *interface,
+ 
+ 	dev->workqueue = 0;
+ 
++	/* init video transfer queues first of all */
++	/* to prevent oops in hdpvr_delete() on error paths */
++	INIT_LIST_HEAD(&dev->free_buff_list);
++	INIT_LIST_HEAD(&dev->rec_buff_list);
++
+ 	/* register v4l2_device early so it can be used for printks */
+ 	if (v4l2_device_register(&interface->dev, &dev->v4l2_dev)) {
+ 		dev_err(&interface->dev, "v4l2_device_register failed\n");
+@@ -333,10 +338,6 @@ static int hdpvr_probe(struct usb_interface *interface,
+ 	if (!dev->workqueue)
+ 		goto error;
+ 
+-	/* init video transfer queues */
+-	INIT_LIST_HEAD(&dev->free_buff_list);
+-	INIT_LIST_HEAD(&dev->rec_buff_list);
+-
+ 	dev->options = hdpvr_default_options;
+ 
+ 	if (default_video_input < HDPVR_VIDEO_INPUTS)
+@@ -413,7 +414,7 @@ static int hdpvr_probe(struct usb_interface *interface,
+ 				    video_nr[atomic_inc_return(&dev_nr)]);
+ 	if (retval < 0) {
+ 		v4l2_err(&dev->v4l2_dev, "registering videodev failed\n");
+-		goto error;
++		goto reg_fail;
+ 	}
+ 
+ 	/* let the user know what node this device is now attached to */
+diff --git a/drivers/mmc/host/tmio_mmc_dma.c b/drivers/mmc/host/tmio_mmc_dma.c
+index fff92860..491e9ecc 100644
+--- a/drivers/mmc/host/tmio_mmc_dma.c
++++ b/drivers/mmc/host/tmio_mmc_dma.c
+@@ -104,6 +104,7 @@ static void tmio_mmc_start_dma_rx(struct tmio_mmc_host *host)
+ pio:
+ 	if (!desc) {
+ 		/* DMA failed, fall back to PIO */
++		tmio_mmc_enable_dma(host, false);
+ 		if (ret >= 0)
+ 			ret = -EIO;
+ 		host->chan_rx = NULL;
+@@ -116,7 +117,6 @@ pio:
+ 		}
+ 		dev_warn(&host->pdev->dev,
+ 			 "DMA failed: %d, falling back to PIO\n", ret);
+-		tmio_mmc_enable_dma(host, false);
+ 	}
+ 
+ 	dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d, sg[%d]\n", __func__,
+@@ -185,6 +185,7 @@ static void tmio_mmc_start_dma_tx(struct tmio_mmc_host *host)
+ pio:
+ 	if (!desc) {
+ 		/* DMA failed, fall back to PIO */
++		tmio_mmc_enable_dma(host, false);
+ 		if (ret >= 0)
+ 			ret = -EIO;
+ 		host->chan_tx = NULL;
+@@ -197,7 +198,6 @@ pio:
+ 		}
+ 		dev_warn(&host->pdev->dev,
+ 			 "DMA failed: %d, falling back to PIO\n", ret);
+-		tmio_mmc_enable_dma(host, false);
+ 	}
+ 
+ 	dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d\n", __func__,
+diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
+index dfcd0a56..fb8c4dea 100644
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -2793,7 +2793,9 @@ static void nand_set_defaults(struct nand_chip *chip, int busw)
+ 
+ 	if (!chip->select_chip)
+ 		chip->select_chip = nand_select_chip;
+-	if (!chip->read_byte)
++
++	/* If called twice, pointers that depend on busw may need to be reset */
++	if (!chip->read_byte || chip->read_byte == nand_read_byte)
+ 		chip->read_byte = busw ? nand_read_byte16 : nand_read_byte;
+ 	if (!chip->read_word)
+ 		chip->read_word = nand_read_word;
+@@ -2801,9 +2803,9 @@ static void nand_set_defaults(struct nand_chip *chip, int busw)
+ 		chip->block_bad = nand_block_bad;
+ 	if (!chip->block_markbad)
+ 		chip->block_markbad = nand_default_block_markbad;
+-	if (!chip->write_buf)
++	if (!chip->write_buf || chip->write_buf == nand_write_buf)
+ 		chip->write_buf = busw ? nand_write_buf16 : nand_write_buf;
+-	if (!chip->read_buf)
++	if (!chip->read_buf || chip->read_buf == nand_read_buf)
+ 		chip->read_buf = busw ? nand_read_buf16 : nand_read_buf;
+ 	if (!chip->scan_bbt)
+ 		chip->scan_bbt = nand_default_bbt;
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 5df49d3c..c95bfb18 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -1069,6 +1069,9 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ 		if (!(e2->ec - e1->ec >= UBI_WL_THRESHOLD)) {
+ 			dbg_wl("no WL needed: min used EC %d, max free EC %d",
+ 			       e1->ec, e2->ec);
++
++			/* Give the unused PEB back */
++			wl_tree_add(e2, &ubi->free);
+ 			goto out_cancel;
+ 		}
+ 		self_check_in_wl_tree(ubi, e1, &ubi->used);
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+index e1714d7c..3457ca53 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -1076,6 +1076,10 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah,
+ 		 * is_on == 0 means MRC CCK is OFF (more noise imm)
+ 		 */
+ 		bool is_on = param ? 1 : 0;
++
++		if (ah->caps.rx_chainmask == 1)
++			break;
++
+ 		REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+ 			      AR_PHY_MRC_CCK_ENABLE, is_on);
+ 		REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index 42b03dc3..4ebd9fd8 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -79,10 +79,6 @@ struct ath_config {
+ 		       sizeof(struct ath_buf_state));		\
+ 	} while (0)
+ 
+-#define ATH_RXBUF_RESET(_bf) do {		\
+-		(_bf)->bf_stale = false;	\
+-	} while (0)
+-
+ /**
+  * enum buffer_type - Buffer type flags
+  *
+@@ -316,6 +312,7 @@ struct ath_rx {
+ 	struct ath_descdma rxdma;
+ 	struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
+ 
++	struct ath_buf *buf_hold;
+ 	struct sk_buff *frag;
+ 
+ 	u32 ampdu_ref;
+diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
+index 8be2b5d8..f53dbd11 100644
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -42,8 +42,6 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+ 	struct ath_desc *ds;
+ 	struct sk_buff *skb;
+ 
+-	ATH_RXBUF_RESET(bf);
+-
+ 	ds = bf->bf_desc;
+ 	ds->ds_link = 0; /* link to null */
+ 	ds->ds_data = bf->bf_buf_addr;
+@@ -70,6 +68,14 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+ 	sc->rx.rxlink = &ds->ds_link;
+ }
+ 
++static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
++{
++	if (sc->rx.buf_hold)
++		ath_rx_buf_link(sc, sc->rx.buf_hold);
++
++	sc->rx.buf_hold = bf;
++}
++
+ static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
+ {
+ 	/* XXX block beacon interrupts */
+@@ -117,7 +123,6 @@ static bool ath_rx_edma_buf_link(struct ath_softc *sc,
+ 
+ 	skb = bf->bf_mpdu;
+ 
+-	ATH_RXBUF_RESET(bf);
+ 	memset(skb->data, 0, ah->caps.rx_status_len);
+ 	dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+ 				ah->caps.rx_status_len, DMA_TO_DEVICE);
+@@ -432,6 +437,7 @@ int ath_startrecv(struct ath_softc *sc)
+ 	if (list_empty(&sc->rx.rxbuf))
+ 		goto start_recv;
+ 
++	sc->rx.buf_hold = NULL;
+ 	sc->rx.rxlink = NULL;
+ 	list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
+ 		ath_rx_buf_link(sc, bf);
+@@ -677,6 +683,9 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
+ 	}
+ 
+ 	bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
++	if (bf == sc->rx.buf_hold)
++		return NULL;
++
+ 	ds = bf->bf_desc;
+ 
+ 	/*
+@@ -1378,7 +1387,7 @@ requeue:
+ 		if (edma) {
+ 			ath_rx_edma_buf_link(sc, qtype);
+ 		} else {
+-			ath_rx_buf_link(sc, bf);
++			ath_rx_buf_relink(sc, bf);
+ 			ath9k_hw_rxena(ah);
+ 		}
+ 	} while (1);
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 83ab6be3..e752f5d4 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2387,6 +2387,7 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
+ 	for (acno = 0, ac = &an->ac[acno];
+ 	     acno < IEEE80211_NUM_ACS; acno++, ac++) {
+ 		ac->sched    = false;
++		ac->clear_ps_filter = true;
+ 		ac->txq = sc->tx.txq_map[acno];
+ 		INIT_LIST_HEAD(&ac->tid_q);
+ 	}
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+index 1860c572..4fb9635d 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+@@ -1015,9 +1015,10 @@ static bool dma64_txidle(struct dma_info *di)
+ 
+ /*
+  * post receive buffers
+- *  return false is refill failed completely and ring is empty this will stall
+- *  the rx dma and user might want to call rxfill again asap. This unlikely
+- *  happens on memory-rich NIC, but often on memory-constrained dongle
++ *  Return false if refill failed completely or dma mapping failed. The ring
++ *  is empty, which will stall the rx dma and user might want to call rxfill
++ *  again asap. This is unlikely to happen on a memory-rich NIC, but often on
++ *  memory-constrained dongle.
+  */
+ bool dma_rxfill(struct dma_pub *pub)
+ {
+@@ -1078,6 +1079,8 @@ bool dma_rxfill(struct dma_pub *pub)
+ 
+ 		pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
+ 				    DMA_FROM_DEVICE);
++		if (dma_mapping_error(di->dmadev, pa))
++			return false;
+ 
+ 		/* save the free packet pointer */
+ 		di->rxp[rxout] = p;
+@@ -1284,7 +1287,11 @@ static void dma_txenq(struct dma_info *di, struct sk_buff *p)
+ 
+ 	/* get physical address of buffer start */
+ 	pa = dma_map_single(di->dmadev, data, len, DMA_TO_DEVICE);
+-
++	/* if mapping failed, free skb */
++	if (dma_mapping_error(di->dmadev, pa)) {
++		brcmu_pkt_buf_free_skb(p);
++		return;
++	}
+ 	/* With a DMA segment list, Descriptor table is filled
+ 	 * using the segment list instead of looping over
+ 	 * buffers in multi-chain DMA. Therefore, EOF for SGLIST
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index a6f584a7..1d10b4ec 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1629,6 +1629,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
+ 		ap = dt_alloc(sizeof(*ap) + len + 1, 4);
+ 		if (!ap)
+ 			continue;
++		memset(ap, 0, sizeof(*ap) + len + 1);
+ 		ap->alias = start;
+ 		of_alias_add(ap, np, id, start, len);
+ 	}
+diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
+index 5d7529ed..314e5e8e 100644
+--- a/drivers/pinctrl/pinctrl-at91.c
++++ b/drivers/pinctrl/pinctrl-at91.c
+@@ -325,7 +325,7 @@ static void at91_mux_disable_interrupt(void __iomem *pio, unsigned mask)
+ 
+ static unsigned at91_mux_get_pullup(void __iomem *pio, unsigned pin)
+ {
+-	return (readl_relaxed(pio + PIO_PUSR) >> pin) & 0x1;
++	return !((readl_relaxed(pio + PIO_PUSR) >> pin) & 0x1);
+ }
+ 
+ static void at91_mux_set_pullup(void __iomem *pio, unsigned mask, bool on)
+@@ -445,7 +445,7 @@ static void at91_mux_pio3_set_debounce(void __iomem *pio, unsigned mask,
+ 
+ static bool at91_mux_pio3_get_pulldown(void __iomem *pio, unsigned pin)
+ {
+-	return (__raw_readl(pio + PIO_PPDSR) >> pin) & 0x1;
++	return !((__raw_readl(pio + PIO_PPDSR) >> pin) & 0x1);
+ }
+ 
+ static void at91_mux_pio3_set_pulldown(void __iomem *pio, unsigned mask, bool is_on)
+diff --git a/drivers/scsi/mpt3sas/Makefile b/drivers/scsi/mpt3sas/Makefile
+index 4c1d2e7a..efb0c4c2 100644
+--- a/drivers/scsi/mpt3sas/Makefile
++++ b/drivers/scsi/mpt3sas/Makefile
+@@ -1,5 +1,5 @@
+ # mpt3sas makefile
+-obj-m += mpt3sas.o
++obj-$(CONFIG_SCSI_MPT3SAS) += mpt3sas.o
+ mpt3sas-y +=  mpt3sas_base.o     \
+ 		mpt3sas_config.o \
+ 		mpt3sas_scsih.o      \
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 610417ec..c3986344 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2409,14 +2409,9 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
+ 			}
+ 		}
+ 
+-		if (modepage == 0x3F) {
+-			sd_printk(KERN_ERR, sdkp, "No Caching mode page "
+-				  "present\n");
+-			goto defaults;
+-		} else if ((buffer[offset] & 0x3f) != modepage) {
+-			sd_printk(KERN_ERR, sdkp, "Got wrong page\n");
+-			goto defaults;
+-		}
++		sd_printk(KERN_ERR, sdkp, "No Caching mode page found\n");
++		goto defaults;
++
+ 	Page_found:
+ 		if (modepage == 8) {
+ 			sdkp->WCE = ((buffer[offset + 2] & 0x04) != 0);
+diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c
+index 90f2de9b..f4c1e998 100644
+--- a/drivers/staging/comedi/drivers/dt282x.c
++++ b/drivers/staging/comedi/drivers/dt282x.c
+@@ -269,8 +269,9 @@ struct dt282x_private {
+ 			}					\
+ 			udelay(5);				\
+ 		}						\
+-		if (_i)						\
++		if (_i) {					\
+ 			b					\
++		}						\
+ 	} while (0)
+ 
+ static int prep_ai_dma(struct comedi_device *dev, int chan, int size);
+diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
+index 163c638e..972a0723 100644
+--- a/drivers/staging/iio/adc/mxs-lradc.c
++++ b/drivers/staging/iio/adc/mxs-lradc.c
+@@ -234,7 +234,6 @@ static int mxs_lradc_read_raw(struct iio_dev *iio_dev,
+ {
+ 	struct mxs_lradc *lradc = iio_priv(iio_dev);
+ 	int ret;
+-	unsigned long mask;
+ 
+ 	if (m != IIO_CHAN_INFO_RAW)
+ 		return -EINVAL;
+@@ -243,12 +242,6 @@ static int mxs_lradc_read_raw(struct iio_dev *iio_dev,
+ 	if (chan->channel > LRADC_MAX_TOTAL_CHANS)
+ 		return -EINVAL;
+ 
+-	/* Validate the channel if it doesn't intersect with reserved chans. */
+-	bitmap_set(&mask, chan->channel, 1);
+-	ret = iio_validate_scan_mask_onehot(iio_dev, &mask);
+-	if (ret)
+-		return -EINVAL;
+-
+ 	/*
+ 	 * See if there is no buffered operation in progess. If there is, simply
+ 	 * bail out. This can be improved to support both buffered and raw IO at
+@@ -661,12 +654,13 @@ static int mxs_lradc_trigger_init(struct iio_dev *iio)
+ {
+ 	int ret;
+ 	struct iio_trigger *trig;
++	struct mxs_lradc *lradc = iio_priv(iio);
+ 
+ 	trig = iio_trigger_alloc("%s-dev%i", iio->name, iio->id);
+ 	if (trig == NULL)
+ 		return -ENOMEM;
+ 
+-	trig->dev.parent = iio->dev.parent;
++	trig->dev.parent = lradc->dev;
+ 	iio_trigger_set_drvdata(trig, iio);
+ 	trig->ops = &mxs_lradc_trigger_ops;
+ 
+@@ -676,15 +670,17 @@ static int mxs_lradc_trigger_init(struct iio_dev *iio)
+ 		return ret;
+ 	}
+ 
+-	iio->trig = trig;
++	lradc->trig = trig;
+ 
+ 	return 0;
+ }
+ 
+ static void mxs_lradc_trigger_remove(struct iio_dev *iio)
+ {
+-	iio_trigger_unregister(iio->trig);
+-	iio_trigger_free(iio->trig);
++	struct mxs_lradc *lradc = iio_priv(iio);
++
++	iio_trigger_unregister(lradc->trig);
++	iio_trigger_free(lradc->trig);
+ }
+ 
+ static int mxs_lradc_buffer_preenable(struct iio_dev *iio)
+diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
+index cbe48ab4..f608fbc1 100644
+--- a/drivers/target/target_core_alua.c
++++ b/drivers/target/target_core_alua.c
+@@ -730,7 +730,7 @@ static int core_alua_write_tpg_metadata(
+ 	if (ret < 0)
+ 		pr_err("Error writing ALUA metadata file: %s\n", path);
+ 	fput(file);
+-	return ret ? -EIO : 0;
++	return (ret < 0) ? -EIO : 0;
+ }
+ 
+ /*
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index 3240f2cc..04a74938 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -1987,7 +1987,7 @@ static int __core_scsi3_write_aptpl_to_file(
+ 		pr_debug("Error writing APTPL metadata file: %s\n", path);
+ 	fput(file);
+ 
+-	return ret ? -EIO : 0;
++	return (ret < 0) ? -EIO : 0;
+ }
+ 
+ static int
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 44766821..59d26ef5 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -850,7 +850,8 @@ void disassociate_ctty(int on_exit)
+ 			struct pid *tty_pgrp = tty_get_pgrp(tty);
+ 			if (tty_pgrp) {
+ 				kill_pgrp(tty_pgrp, SIGHUP, on_exit);
+-				kill_pgrp(tty_pgrp, SIGCONT, on_exit);
++				if (!on_exit)
++					kill_pgrp(tty_pgrp, SIGCONT, on_exit);
+ 				put_pid(tty_pgrp);
+ 			}
+ 		}
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 8a230f0e..d3318a0d 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -209,6 +209,7 @@ skip_error:
+ static void wdm_int_callback(struct urb *urb)
+ {
+ 	int rv = 0;
++	int responding;
+ 	int status = urb->status;
+ 	struct wdm_device *desc;
+ 	struct usb_cdc_notification *dr;
+@@ -262,8 +263,8 @@ static void wdm_int_callback(struct urb *urb)
+ 
+ 	spin_lock(&desc->iuspin);
+ 	clear_bit(WDM_READ, &desc->flags);
+-	set_bit(WDM_RESPONDING, &desc->flags);
+-	if (!test_bit(WDM_DISCONNECTING, &desc->flags)
++	responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
++	if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags)
+ 		&& !test_bit(WDM_SUSPENDING, &desc->flags)) {
+ 		rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+ 		dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
+@@ -685,16 +686,20 @@ static void wdm_rxwork(struct work_struct *work)
+ {
+ 	struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);
+ 	unsigned long flags;
+-	int rv;
++	int rv = 0;
++	int responding;
+ 
+ 	spin_lock_irqsave(&desc->iuspin, flags);
+ 	if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+ 		spin_unlock_irqrestore(&desc->iuspin, flags);
+ 	} else {
++		responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
+ 		spin_unlock_irqrestore(&desc->iuspin, flags);
+-		rv = usb_submit_urb(desc->response, GFP_KERNEL);
++		if (!responding)
++			rv = usb_submit_urb(desc->response, GFP_KERNEL);
+ 		if (rv < 0 && rv != -EPERM) {
+ 			spin_lock_irqsave(&desc->iuspin, flags);
++			clear_bit(WDM_RESPONDING, &desc->flags);
+ 			if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+ 				schedule_work(&desc->rxwork);
+ 			spin_unlock_irqrestore(&desc->iuspin, flags);
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 7199adcc..a6b2cabe 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -424,7 +424,8 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
+ 
+ 	memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+ 	if (config->desc.bDescriptorType != USB_DT_CONFIG ||
+-	    config->desc.bLength < USB_DT_CONFIG_SIZE) {
++	    config->desc.bLength < USB_DT_CONFIG_SIZE ||
++	    config->desc.bLength > size) {
+ 		dev_err(ddev, "invalid descriptor for config index %d: "
+ 		    "type = 0x%X, length = %d\n", cfgidx,
+ 		    config->desc.bDescriptorType, config->desc.bLength);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index da2905a1..6cf2ae0a 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2916,7 +2916,6 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ {
+ 	struct usb_hub	*hub = usb_hub_to_struct_hub(udev->parent);
+ 	struct usb_port *port_dev = hub->ports[udev->portnum - 1];
+-	enum pm_qos_flags_status pm_qos_stat;
+ 	int		port1 = udev->portnum;
+ 	int		status;
+ 	bool		really_suspend = true;
+@@ -2954,7 +2953,7 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ 					status);
+ 			/* bail if autosuspend is requested */
+ 			if (PMSG_IS_AUTO(msg))
+-				return status;
++				goto err_wakeup;
+ 		}
+ 	}
+ 
+@@ -2963,14 +2962,16 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ 		usb_set_usb2_hardware_lpm(udev, 0);
+ 
+ 	if (usb_disable_ltm(udev)) {
+-		dev_err(&udev->dev, "%s Failed to disable LTM before suspend\n.",
+-				__func__);
+-		return -ENOMEM;
++		dev_err(&udev->dev, "Failed to disable LTM before suspend\n.");
++		status = -ENOMEM;
++		if (PMSG_IS_AUTO(msg))
++			goto err_ltm;
+ 	}
+ 	if (usb_unlocked_disable_lpm(udev)) {
+-		dev_err(&udev->dev, "%s Failed to disable LPM before suspend\n.",
+-				__func__);
+-		return -ENOMEM;
++		dev_err(&udev->dev, "Failed to disable LPM before suspend\n.");
++		status = -ENOMEM;
++		if (PMSG_IS_AUTO(msg))
++			goto err_lpm3;
+ 	}
+ 
+ 	/* see 7.1.7.6 */
+@@ -2998,28 +2999,31 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ 	if (status) {
+ 		dev_dbg(hub->intfdev, "can't suspend port %d, status %d\n",
+ 				port1, status);
+-		/* paranoia:  "should not happen" */
+-		if (udev->do_remote_wakeup) {
+-			if (!hub_is_superspeed(hub->hdev)) {
+-				(void) usb_control_msg(udev,
+-						usb_sndctrlpipe(udev, 0),
+-						USB_REQ_CLEAR_FEATURE,
+-						USB_RECIP_DEVICE,
+-						USB_DEVICE_REMOTE_WAKEUP, 0,
+-						NULL, 0,
+-						USB_CTRL_SET_TIMEOUT);
+-			} else
+-				(void) usb_disable_function_remotewakeup(udev);
+-
+-		}
+ 
++		/* Try to enable USB3 LPM and LTM again */
++		usb_unlocked_enable_lpm(udev);
++ err_lpm3:
++		usb_enable_ltm(udev);
++ err_ltm:
+ 		/* Try to enable USB2 hardware LPM again */
+ 		if (udev->usb2_hw_lpm_capable == 1)
+ 			usb_set_usb2_hardware_lpm(udev, 1);
+ 
+-		/* Try to enable USB3 LTM and LPM again */
+-		usb_enable_ltm(udev);
+-		usb_unlocked_enable_lpm(udev);
++		if (udev->do_remote_wakeup) {
++			if (udev->speed < USB_SPEED_SUPER)
++				usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
++						USB_REQ_CLEAR_FEATURE,
++						USB_RECIP_DEVICE,
++						USB_DEVICE_REMOTE_WAKEUP, 0,
++						NULL, 0, USB_CTRL_SET_TIMEOUT);
++			else
++				usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
++						USB_REQ_CLEAR_FEATURE,
++						USB_RECIP_INTERFACE,
++						USB_INTRF_FUNC_SUSPEND, 0,
++						NULL, 0, USB_CTRL_SET_TIMEOUT);
++		}
++ err_wakeup:
+ 
+ 		/* System sleep transitions should never fail */
+ 		if (!PMSG_IS_AUTO(msg))
+@@ -3037,16 +3041,7 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ 		usb_set_device_state(udev, USB_STATE_SUSPENDED);
+ 	}
+ 
+-	/*
+-	 * Check whether current status meets the requirement of
+-	 * usb port power off mechanism
+-	 */
+-	pm_qos_stat = dev_pm_qos_flags(&port_dev->dev,
+-			PM_QOS_FLAG_NO_POWER_OFF);
+-	if (!udev->do_remote_wakeup
+-			&& pm_qos_stat != PM_QOS_FLAGS_ALL
+-			&& udev->persist_enabled
+-			&& !status) {
++	if (status == 0 && !udev->do_remote_wakeup && udev->persist_enabled) {
+ 		pm_runtime_put_sync(&port_dev->dev);
+ 		port_dev->did_runtime_put = true;
+ 	}
+diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c
+index b8bad294..ef07b359 100644
+--- a/drivers/usb/core/port.c
++++ b/drivers/usb/core/port.c
+@@ -89,22 +89,19 @@ static int usb_port_runtime_resume(struct device *dev)
+ 	retval = usb_hub_set_port_power(hdev, port1, true);
+ 	if (port_dev->child && !retval) {
+ 		/*
+-		 * Wait for usb hub port to be reconnected in order to make
+-		 * the resume procedure successful.
++		 * Attempt to wait for usb hub port to be reconnected in order
++		 * to make the resume procedure successful.  The device may have
++		 * disconnected while the port was powered off, so ignore the
++		 * return status.
+ 		 */
+ 		retval = hub_port_debounce_be_connected(hub, port1);
+-		if (retval < 0) {
++		if (retval < 0)
+ 			dev_dbg(&port_dev->dev, "can't get reconnection after setting port  power on, status %d\n",
+ 					retval);
+-			goto out;
+-		}
+ 		usb_clear_port_feature(hdev, port1, USB_PORT_FEAT_C_ENABLE);
+-
+-		/* Set return value to 0 if debounce successful */
+ 		retval = 0;
+ 	}
+ 
+-out:
+ 	clear_bit(port1, hub->busy_bits);
+ 	usb_autopm_put_interface(intf);
+ 	return retval;
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index f77083fe..14d28d61 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1508,6 +1508,15 @@ static int dwc3_gadget_start(struct usb_gadget *g,
+ 	int			irq;
+ 	u32			reg;
+ 
++	irq = platform_get_irq(to_platform_device(dwc->dev), 0);
++	ret = request_threaded_irq(irq, dwc3_interrupt, dwc3_thread_interrupt,
++			IRQF_SHARED | IRQF_ONESHOT, "dwc3", dwc);
++	if (ret) {
++		dev_err(dwc->dev, "failed to request irq #%d --> %d\n",
++				irq, ret);
++		goto err0;
++	}
++
+ 	spin_lock_irqsave(&dwc->lock, flags);
+ 
+ 	if (dwc->gadget_driver) {
+@@ -1515,7 +1524,7 @@ static int dwc3_gadget_start(struct usb_gadget *g,
+ 				dwc->gadget.name,
+ 				dwc->gadget_driver->driver.name);
+ 		ret = -EBUSY;
+-		goto err0;
++		goto err1;
+ 	}
+ 
+ 	dwc->gadget_driver	= driver;
+@@ -1551,42 +1560,38 @@ static int dwc3_gadget_start(struct usb_gadget *g,
+ 	ret = __dwc3_gadget_ep_enable(dep, &dwc3_gadget_ep0_desc, NULL, false);
+ 	if (ret) {
+ 		dev_err(dwc->dev, "failed to enable %s\n", dep->name);
+-		goto err0;
++		goto err2;
+ 	}
+ 
+ 	dep = dwc->eps[1];
+ 	ret = __dwc3_gadget_ep_enable(dep, &dwc3_gadget_ep0_desc, NULL, false);
+ 	if (ret) {
+ 		dev_err(dwc->dev, "failed to enable %s\n", dep->name);
+-		goto err1;
++		goto err3;
+ 	}
+ 
+ 	/* begin to receive SETUP packets */
+ 	dwc->ep0state = EP0_SETUP_PHASE;
+ 	dwc3_ep0_out_start(dwc);
+ 
+-	irq = platform_get_irq(to_platform_device(dwc->dev), 0);
+-	ret = request_threaded_irq(irq, dwc3_interrupt, dwc3_thread_interrupt,
+-			IRQF_SHARED | IRQF_ONESHOT, "dwc3", dwc);
+-	if (ret) {
+-		dev_err(dwc->dev, "failed to request irq #%d --> %d\n",
+-				irq, ret);
+-		goto err1;
+-	}
+-
+ 	dwc3_gadget_enable_irq(dwc);
+ 
+ 	spin_unlock_irqrestore(&dwc->lock, flags);
+ 
+ 	return 0;
+ 
+-err1:
++err3:
+ 	__dwc3_gadget_ep_disable(dwc->eps[0]);
+ 
+-err0:
++err2:
+ 	dwc->gadget_driver = NULL;
++
++err1:
+ 	spin_unlock_irqrestore(&dwc->lock, flags);
+ 
++	free_irq(irq, dwc);
++
++err0:
+ 	return ret;
+ }
+ 
+@@ -1600,9 +1605,6 @@ static int dwc3_gadget_stop(struct usb_gadget *g,
+ 	spin_lock_irqsave(&dwc->lock, flags);
+ 
+ 	dwc3_gadget_disable_irq(dwc);
+-	irq = platform_get_irq(to_platform_device(dwc->dev), 0);
+-	free_irq(irq, dwc);
+-
+ 	__dwc3_gadget_ep_disable(dwc->eps[0]);
+ 	__dwc3_gadget_ep_disable(dwc->eps[1]);
+ 
+@@ -1610,6 +1612,9 @@ static int dwc3_gadget_stop(struct usb_gadget *g,
+ 
+ 	spin_unlock_irqrestore(&dwc->lock, flags);
+ 
++	irq = platform_get_irq(to_platform_device(dwc->dev), 0);
++	free_irq(irq, dwc);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/gadget/uvc_queue.c b/drivers/usb/gadget/uvc_queue.c
+index 7ce27e35..de456a5a 100644
+--- a/drivers/usb/gadget/uvc_queue.c
++++ b/drivers/usb/gadget/uvc_queue.c
+@@ -177,12 +177,16 @@ static int uvc_queue_buffer(struct uvc_video_queue *queue,
+ 
+ 	mutex_lock(&queue->mutex);
+ 	ret = vb2_qbuf(&queue->queue, buf);
++	if (ret < 0)
++		goto done;
++
+ 	spin_lock_irqsave(&queue->irqlock, flags);
+ 	ret = (queue->flags & UVC_QUEUE_PAUSED) != 0;
+ 	queue->flags &= ~UVC_QUEUE_PAUSED;
+ 	spin_unlock_irqrestore(&queue->irqlock, flags);
+-	mutex_unlock(&queue->mutex);
+ 
++done:
++	mutex_unlock(&queue->mutex);
+ 	return ret;
+ }
+ 
+diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
+index c369767b..ec128bc7 100644
+--- a/drivers/usb/host/ehci-mxc.c
++++ b/drivers/usb/host/ehci-mxc.c
+@@ -184,7 +184,7 @@ static int ehci_mxc_drv_remove(struct platform_device *pdev)
+ 	if (pdata && pdata->exit)
+ 		pdata->exit(pdev);
+ 
+-	if (pdata->otg)
++	if (pdata && pdata->otg)
+ 		usb_phy_shutdown(pdata->otg);
+ 
+ 	clk_disable_unprepare(priv->usbclk);
+diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
+index 951514ef..ef6782bd 100644
+--- a/drivers/usb/host/ohci-pci.c
++++ b/drivers/usb/host/ohci-pci.c
+@@ -371,7 +371,7 @@ static struct pci_driver ohci_pci_driver = {
+ 	.remove =	usb_hcd_pci_remove,
+ 	.shutdown =	usb_hcd_pci_shutdown,
+ 
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_PM
+ 	.driver =	{
+ 		.pm =	&usb_hcd_pci_pm_ops
+ 	},
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 93ad67ec..6e70ce97 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -24,7 +24,7 @@ static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 	 * here that the generic code does not try to make a pci_dev from our
+ 	 * dev struct in order to setup MSI
+ 	 */
+-	xhci->quirks |= XHCI_BROKEN_MSI;
++	xhci->quirks |= XHCI_PLAT;
+ }
+ 
+ /* called during probe() after chip reset completes */
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 9a550b6a..f4a49c45 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -342,9 +342,14 @@ static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
+ static int xhci_try_enable_msi(struct usb_hcd *hcd)
+ {
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+-	struct pci_dev  *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
++	struct pci_dev  *pdev;
+ 	int ret;
+ 
++	/* The xhci platform device has set up IRQs through usb_add_hcd. */
++	if (xhci->quirks & XHCI_PLAT)
++		return 0;
++
++	pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+ 	/*
+ 	 * Some Fresco Logic host controllers advertise MSI, but fail to
+ 	 * generate interrupts.  Don't even try to enable MSI.
+@@ -3506,10 +3511,21 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ 	struct xhci_virt_device *virt_dev;
++	struct device *dev = hcd->self.controller;
+ 	unsigned long flags;
+ 	u32 state;
+ 	int i, ret;
+ 
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++	/*
++	 * We called pm_runtime_get_noresume when the device was attached.
++	 * Decrement the counter here to allow controller to runtime suspend
++	 * if no devices remain.
++	 */
++	if (xhci->quirks & XHCI_RESET_ON_RESUME)
++		pm_runtime_put_noidle(dev);
++#endif
++
+ 	ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
+ 	/* If the host is halted due to driver unload, we still need to free the
+ 	 * device.
+@@ -3581,6 +3597,7 @@ static int xhci_reserve_host_control_ep_resources(struct xhci_hcd *xhci)
+ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++	struct device *dev = hcd->self.controller;
+ 	unsigned long flags;
+ 	int timeleft;
+ 	int ret;
+@@ -3633,6 +3650,16 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ 		goto disable_slot;
+ 	}
+ 	udev->slot_id = xhci->slot_id;
++
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++	/*
++	 * If resetting upon resume, we can't put the controller into runtime
++	 * suspend if there is a device attached.
++	 */
++	if (xhci->quirks & XHCI_RESET_ON_RESUME)
++		pm_runtime_get_noresume(dev);
++#endif
++
+ 	/* Is this a LS or FS device under a HS hub? */
+ 	/* Hub or peripherial? */
+ 	return 1;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 77600cef..3638f1d7 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1516,6 +1516,7 @@ struct xhci_hcd {
+ #define XHCI_SPURIOUS_REBOOT	(1 << 13)
+ #define XHCI_COMP_MODE_QUIRK	(1 << 14)
+ #define XHCI_AVOID_BEI		(1 << 15)
++#define XHCI_PLAT		(1 << 16)
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
+ 	/* There are two roothubs to keep track of bus suspend info for */
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index 5050cc85..0f16bf6e 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -374,7 +374,7 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ 		kfree(urbtrack);
+ 		return -ENOMEM;
+ 	}
+-	urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
++	urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_ATOMIC);
+ 	if (!urbtrack->setup) {
+ 		usb_free_urb(urbtrack->urb);
+ 		kfree(urbtrack);
+@@ -382,8 +382,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ 	}
+ 	urbtrack->setup->bRequestType = (__u8)0x40;
+ 	urbtrack->setup->bRequest = (__u8)0x0e;
+-	urbtrack->setup->wValue = get_reg_value(reg, dummy);
+-	urbtrack->setup->wIndex = get_reg_index(reg);
++	urbtrack->setup->wValue = cpu_to_le16(get_reg_value(reg, dummy));
++	urbtrack->setup->wIndex = cpu_to_le16(get_reg_index(reg));
+ 	urbtrack->setup->wLength = 0;
+ 	usb_fill_control_urb(urbtrack->urb, usbdev,
+ 			     usb_sndctrlpipe(usbdev, 0),
+diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
+index 04c1b2d9..d5418c1b 100644
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -729,9 +729,18 @@ void gnttab_request_free_callback(struct gnttab_free_callback *callback,
+ 				  void (*fn)(void *), void *arg, u16 count)
+ {
+ 	unsigned long flags;
++	struct gnttab_free_callback *cb;
++
+ 	spin_lock_irqsave(&gnttab_list_lock, flags);
+-	if (callback->next)
+-		goto out;
++
++	/* Check if the callback is already on the list */
++	cb = gnttab_free_callback_list;
++	while (cb) {
++		if (cb == callback)
++			goto out;
++		cb = cb->next;
++	}
++
+ 	callback->fn = fn;
+ 	callback->arg = arg;
+ 	callback->count = count;
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 0f81d67c..8dedf401 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -3299,6 +3299,9 @@ static long btrfs_ioctl_dev_replace(struct btrfs_root *root, void __user *arg)
+ 
+ 	switch (p->cmd) {
+ 	case BTRFS_IOCTL_DEV_REPLACE_CMD_START:
++		if (root->fs_info->sb->s_flags & MS_RDONLY)
++			return -EROFS;
++
+ 		if (atomic_xchg(
+ 			&root->fs_info->mutually_exclusive_operation_running,
+ 			1)) {
+diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
+index e0b4ef31..a5ce62eb 100644
+--- a/fs/ceph/ioctl.c
++++ b/fs/ceph/ioctl.c
+@@ -196,8 +196,10 @@ static long ceph_ioctl_get_dataloc(struct file *file, void __user *arg)
+ 	r = ceph_calc_file_object_mapping(&ci->i_layout, dl.file_offset, len,
+ 					  &dl.object_no, &dl.object_offset,
+ 					  &olen);
+-	if (r < 0)
++	if (r < 0) {
++		up_read(&osdc->map_sem);
+ 		return -EIO;
++	}
+ 	dl.file_offset -= dl.object_offset;
+ 	dl.object_size = ceph_file_layout_object_size(ci->i_layout);
+ 	dl.block_size = ceph_file_layout_su(ci->i_layout);
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index d6a5c5ac..d05a3007 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -377,6 +377,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ 		try_to_freeze();
+ 
+ 		/* we should try only the port we connected to before */
++		mutex_lock(&server->srv_mutex);
+ 		rc = generic_ip_connect(server);
+ 		if (rc) {
+ 			cifs_dbg(FYI, "reconnect error %d\n", rc);
+@@ -388,6 +389,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ 				server->tcpStatus = CifsNeedNegotiate;
+ 			spin_unlock(&GlobalMid_Lock);
+ 		}
++		mutex_unlock(&server->srv_mutex);
+ 	} while (server->tcpStatus == CifsNeedReconnect);
+ 
+ 	return rc;
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 10383d8c..4f791e0e 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -413,96 +413,108 @@ cifs_ses_oplock_break(struct work_struct *work)
+ }
+ 
+ static bool
+-smb2_is_valid_lease_break(char *buffer, struct TCP_Server_Info *server)
++smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
++		    struct smb2_lease_break_work *lw)
+ {
+-	struct smb2_lease_break *rsp = (struct smb2_lease_break *)buffer;
+-	struct list_head *tmp, *tmp1, *tmp2;
+-	struct cifs_ses *ses;
+-	struct cifs_tcon *tcon;
+-	struct cifsInodeInfo *cinode;
++	bool found;
++	__u8 lease_state;
++	struct list_head *tmp;
+ 	struct cifsFileInfo *cfile;
+ 	struct cifs_pending_open *open;
+-	struct smb2_lease_break_work *lw;
+-	bool found;
++	struct cifsInodeInfo *cinode;
+ 	int ack_req = le32_to_cpu(rsp->Flags &
+ 				  SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED);
+ 
+-	lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
+-	if (!lw)
+-		return false;
++	lease_state = smb2_map_lease_to_oplock(rsp->NewLeaseState);
+ 
+-	INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
+-	lw->lease_state = rsp->NewLeaseState;
++	list_for_each(tmp, &tcon->openFileList) {
++		cfile = list_entry(tmp, struct cifsFileInfo, tlist);
++		cinode = CIFS_I(cfile->dentry->d_inode);
+ 
+-	cifs_dbg(FYI, "Checking for lease break\n");
++		if (memcmp(cinode->lease_key, rsp->LeaseKey,
++							SMB2_LEASE_KEY_SIZE))
++			continue;
+ 
+-	/* look up tcon based on tid & uid */
+-	spin_lock(&cifs_tcp_ses_lock);
+-	list_for_each(tmp, &server->smb_ses_list) {
+-		ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
++		cifs_dbg(FYI, "found in the open list\n");
++		cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
++			 le32_to_cpu(rsp->NewLeaseState));
+ 
+-		spin_lock(&cifs_file_list_lock);
+-		list_for_each(tmp1, &ses->tcon_list) {
+-			tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
++		smb2_set_oplock_level(cinode, lease_state);
+ 
+-			cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks);
+-			list_for_each(tmp2, &tcon->openFileList) {
+-				cfile = list_entry(tmp2, struct cifsFileInfo,
+-						   tlist);
+-				cinode = CIFS_I(cfile->dentry->d_inode);
++		if (ack_req)
++			cfile->oplock_break_cancelled = false;
++		else
++			cfile->oplock_break_cancelled = true;
+ 
+-				if (memcmp(cinode->lease_key, rsp->LeaseKey,
+-					   SMB2_LEASE_KEY_SIZE))
+-					continue;
++		queue_work(cifsiod_wq, &cfile->oplock_break);
++		kfree(lw);
++		return true;
++	}
+ 
+-				cifs_dbg(FYI, "found in the open list\n");
+-				cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
+-					 le32_to_cpu(rsp->NewLeaseState));
++	found = false;
++	list_for_each_entry(open, &tcon->pending_opens, olist) {
++		if (memcmp(open->lease_key, rsp->LeaseKey,
++			   SMB2_LEASE_KEY_SIZE))
++			continue;
++
++		if (!found && ack_req) {
++			found = true;
++			memcpy(lw->lease_key, open->lease_key,
++			       SMB2_LEASE_KEY_SIZE);
++			lw->tlink = cifs_get_tlink(open->tlink);
++			queue_work(cifsiod_wq, &lw->lease_break);
++		}
+ 
+-				smb2_set_oplock_level(cinode,
+-				  smb2_map_lease_to_oplock(rsp->NewLeaseState));
++		cifs_dbg(FYI, "found in the pending open list\n");
++		cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
++			 le32_to_cpu(rsp->NewLeaseState));
+ 
+-				if (ack_req)
+-					cfile->oplock_break_cancelled = false;
+-				else
+-					cfile->oplock_break_cancelled = true;
++		open->oplock = lease_state;
++	}
++	return found;
++}
+ 
+-				queue_work(cifsiod_wq, &cfile->oplock_break);
++static bool
++smb2_is_valid_lease_break(char *buffer)
++{
++	struct smb2_lease_break *rsp = (struct smb2_lease_break *)buffer;
++	struct list_head *tmp, *tmp1, *tmp2;
++	struct TCP_Server_Info *server;
++	struct cifs_ses *ses;
++	struct cifs_tcon *tcon;
++	struct smb2_lease_break_work *lw;
+ 
+-				spin_unlock(&cifs_file_list_lock);
+-				spin_unlock(&cifs_tcp_ses_lock);
+-				return true;
+-			}
++	lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
++	if (!lw)
++		return false;
+ 
+-			found = false;
+-			list_for_each_entry(open, &tcon->pending_opens, olist) {
+-				if (memcmp(open->lease_key, rsp->LeaseKey,
+-					   SMB2_LEASE_KEY_SIZE))
+-					continue;
++	INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
++	lw->lease_state = rsp->NewLeaseState;
+ 
+-				if (!found && ack_req) {
+-					found = true;
+-					memcpy(lw->lease_key, open->lease_key,
+-					       SMB2_LEASE_KEY_SIZE);
+-					lw->tlink = cifs_get_tlink(open->tlink);
+-					queue_work(cifsiod_wq,
+-						   &lw->lease_break);
+-				}
++	cifs_dbg(FYI, "Checking for lease break\n");
++
++	/* look up tcon based on tid & uid */
++	spin_lock(&cifs_tcp_ses_lock);
++	list_for_each(tmp, &cifs_tcp_ses_list) {
++		server = list_entry(tmp, struct TCP_Server_Info, tcp_ses_list);
+ 
+-				cifs_dbg(FYI, "found in the pending open list\n");
+-				cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
+-					 le32_to_cpu(rsp->NewLeaseState));
++		list_for_each(tmp1, &server->smb_ses_list) {
++			ses = list_entry(tmp1, struct cifs_ses, smb_ses_list);
+ 
+-				open->oplock =
+-				  smb2_map_lease_to_oplock(rsp->NewLeaseState);
+-			}
+-			if (found) {
+-				spin_unlock(&cifs_file_list_lock);
+-				spin_unlock(&cifs_tcp_ses_lock);
+-				return true;
++			spin_lock(&cifs_file_list_lock);
++			list_for_each(tmp2, &ses->tcon_list) {
++				tcon = list_entry(tmp2, struct cifs_tcon,
++						  tcon_list);
++				cifs_stats_inc(
++				    &tcon->stats.cifs_stats.num_oplock_brks);
++				if (smb2_tcon_has_lease(tcon, rsp, lw)) {
++					spin_unlock(&cifs_file_list_lock);
++					spin_unlock(&cifs_tcp_ses_lock);
++					return true;
++				}
+ 			}
++			spin_unlock(&cifs_file_list_lock);
+ 		}
+-		spin_unlock(&cifs_file_list_lock);
+ 	}
+ 	spin_unlock(&cifs_tcp_ses_lock);
+ 	kfree(lw);
+@@ -528,7 +540,7 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ 	if (rsp->StructureSize !=
+ 				smb2_rsp_struct_sizes[SMB2_OPLOCK_BREAK_HE]) {
+ 		if (le16_to_cpu(rsp->StructureSize) == 44)
+-			return smb2_is_valid_lease_break(buffer, server);
++			return smb2_is_valid_lease_break(buffer);
+ 		else
+ 			return false;
+ 	}
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index ccbfbbb1..904ca1a2 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4706,7 +4706,9 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ 		ext4_journal_stop(handle);
+ 	}
+ 
+-	if (attr->ia_valid & ATTR_SIZE) {
++	if (attr->ia_valid & ATTR_SIZE && attr->ia_size != inode->i_size) {
++		handle_t *handle;
++		loff_t oldsize = inode->i_size;
+ 
+ 		if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
+ 			struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+@@ -4714,73 +4716,60 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ 			if (attr->ia_size > sbi->s_bitmap_maxbytes)
+ 				return -EFBIG;
+ 		}
+-	}
+-
+-	if (S_ISREG(inode->i_mode) &&
+-	    attr->ia_valid & ATTR_SIZE &&
+-	    (attr->ia_size < inode->i_size)) {
+-		handle_t *handle;
+-
+-		handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
+-		if (IS_ERR(handle)) {
+-			error = PTR_ERR(handle);
+-			goto err_out;
+-		}
+-		if (ext4_handle_valid(handle)) {
+-			error = ext4_orphan_add(handle, inode);
+-			orphan = 1;
+-		}
+-		EXT4_I(inode)->i_disksize = attr->ia_size;
+-		rc = ext4_mark_inode_dirty(handle, inode);
+-		if (!error)
+-			error = rc;
+-		ext4_journal_stop(handle);
+-
+-		if (ext4_should_order_data(inode)) {
+-			error = ext4_begin_ordered_truncate(inode,
++		if (S_ISREG(inode->i_mode) &&
++		    (attr->ia_size < inode->i_size)) {
++			if (ext4_should_order_data(inode)) {
++				error = ext4_begin_ordered_truncate(inode,
+ 							    attr->ia_size);
+-			if (error) {
+-				/* Do as much error cleanup as possible */
+-				handle = ext4_journal_start(inode,
+-							    EXT4_HT_INODE, 3);
+-				if (IS_ERR(handle)) {
+-					ext4_orphan_del(NULL, inode);
++				if (error)
+ 					goto err_out;
+-				}
+-				ext4_orphan_del(handle, inode);
+-				orphan = 0;
+-				ext4_journal_stop(handle);
++			}
++			handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
++			if (IS_ERR(handle)) {
++				error = PTR_ERR(handle);
++				goto err_out;
++			}
++			if (ext4_handle_valid(handle)) {
++				error = ext4_orphan_add(handle, inode);
++				orphan = 1;
++			}
++			EXT4_I(inode)->i_disksize = attr->ia_size;
++			rc = ext4_mark_inode_dirty(handle, inode);
++			if (!error)
++				error = rc;
++			ext4_journal_stop(handle);
++			if (error) {
++				ext4_orphan_del(NULL, inode);
+ 				goto err_out;
+ 			}
+ 		}
+-	}
+-
+-	if (attr->ia_valid & ATTR_SIZE) {
+-		if (attr->ia_size != inode->i_size) {
+-			loff_t oldsize = inode->i_size;
+ 
+-			i_size_write(inode, attr->ia_size);
+-			/*
+-			 * Blocks are going to be removed from the inode. Wait
+-			 * for dio in flight.  Temporarily disable
+-			 * dioread_nolock to prevent livelock.
+-			 */
+-			if (orphan) {
+-				if (!ext4_should_journal_data(inode)) {
+-					ext4_inode_block_unlocked_dio(inode);
+-					inode_dio_wait(inode);
+-					ext4_inode_resume_unlocked_dio(inode);
+-				} else
+-					ext4_wait_for_tail_page_commit(inode);
+-			}
+-			/*
+-			 * Truncate pagecache after we've waited for commit
+-			 * in data=journal mode to make pages freeable.
+-			 */
+-			truncate_pagecache(inode, oldsize, inode->i_size);
++		i_size_write(inode, attr->ia_size);
++		/*
++		 * Blocks are going to be removed from the inode. Wait
++		 * for dio in flight.  Temporarily disable
++		 * dioread_nolock to prevent livelock.
++		 */
++		if (orphan) {
++			if (!ext4_should_journal_data(inode)) {
++				ext4_inode_block_unlocked_dio(inode);
++				inode_dio_wait(inode);
++				ext4_inode_resume_unlocked_dio(inode);
++			} else
++				ext4_wait_for_tail_page_commit(inode);
+ 		}
+-		ext4_truncate(inode);
++		/*
++		 * Truncate pagecache after we've waited for commit
++		 * in data=journal mode to make pages freeable.
++		 */
++		truncate_pagecache(inode, oldsize, inode->i_size);
+ 	}
++	/*
++	 * We want to call ext4_truncate() even if attr->ia_size ==
++	 * inode->i_size for cases like truncation of fallocated space
++	 */
++	if (attr->ia_valid & ATTR_SIZE)
++		ext4_truncate(inode);
+ 
+ 	if (!rc) {
+ 		setattr_copy(inode, attr);
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 5b127469..e67b13de 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1175,6 +1175,8 @@ static int parse_dirfile(char *buf, size_t nbytes, struct file *file,
+ 			return -EIO;
+ 		if (reclen > nbytes)
+ 			break;
++		if (memchr(dirent->name, '/', dirent->namelen) != NULL)
++			return -EIO;
+ 
+ 		over = filldir(dstbuf, dirent->name, dirent->namelen,
+ 			       file->f_pos, dirent->ino, dirent->type);
+@@ -1323,6 +1325,8 @@ static int parse_dirplusfile(char *buf, size_t nbytes, struct file *file,
+ 			return -EIO;
+ 		if (reclen > nbytes)
+ 			break;
++		if (memchr(dirent->name, '/', dirent->namelen) != NULL)
++			return -EIO;
+ 
+ 		if (!over) {
+ 			/* We fill entries into dstbuf only as much as
+@@ -1594,6 +1598,7 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
+ 		    struct file *file)
+ {
+ 	struct fuse_conn *fc = get_fuse_conn(inode);
++	struct fuse_inode *fi = get_fuse_inode(inode);
+ 	struct fuse_req *req;
+ 	struct fuse_setattr_in inarg;
+ 	struct fuse_attr_out outarg;
+@@ -1621,8 +1626,10 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
+ 	if (IS_ERR(req))
+ 		return PTR_ERR(req);
+ 
+-	if (is_truncate)
++	if (is_truncate) {
+ 		fuse_set_nowrite(inode);
++		set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
++	}
+ 
+ 	memset(&inarg, 0, sizeof(inarg));
+ 	memset(&outarg, 0, sizeof(outarg));
+@@ -1684,12 +1691,14 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
+ 		invalidate_inode_pages2(inode->i_mapping);
+ 	}
+ 
++	clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ 	return 0;
+ 
+ error:
+ 	if (is_truncate)
+ 		fuse_release_nowrite(inode);
+ 
++	clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ 	return err;
+ }
+ 
+@@ -1753,6 +1762,8 @@ static int fuse_setxattr(struct dentry *entry, const char *name,
+ 		fc->no_setxattr = 1;
+ 		err = -EOPNOTSUPP;
+ 	}
++	if (!err)
++		fuse_invalidate_attr(inode);
+ 	return err;
+ }
+ 
+@@ -1882,6 +1893,8 @@ static int fuse_removexattr(struct dentry *entry, const char *name)
+ 		fc->no_removexattr = 1;
+ 		err = -EOPNOTSUPP;
+ 	}
++	if (!err)
++		fuse_invalidate_attr(inode);
+ 	return err;
+ }
+ 
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 35f28103..473e8453 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -630,7 +630,8 @@ static void fuse_read_update_size(struct inode *inode, loff_t size,
+ 	struct fuse_inode *fi = get_fuse_inode(inode);
+ 
+ 	spin_lock(&fc->lock);
+-	if (attr_ver == fi->attr_version && size < inode->i_size) {
++	if (attr_ver == fi->attr_version && size < inode->i_size &&
++	    !test_bit(FUSE_I_SIZE_UNSTABLE, &fi->state)) {
+ 		fi->attr_version = ++fc->attr_version;
+ 		i_size_write(inode, size);
+ 	}
+@@ -1033,12 +1034,16 @@ static ssize_t fuse_perform_write(struct file *file,
+ {
+ 	struct inode *inode = mapping->host;
+ 	struct fuse_conn *fc = get_fuse_conn(inode);
++	struct fuse_inode *fi = get_fuse_inode(inode);
+ 	int err = 0;
+ 	ssize_t res = 0;
+ 
+ 	if (is_bad_inode(inode))
+ 		return -EIO;
+ 
++	if (inode->i_size < pos + iov_iter_count(ii))
++		set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
++
+ 	do {
+ 		struct fuse_req *req;
+ 		ssize_t count;
+@@ -1074,6 +1079,7 @@ static ssize_t fuse_perform_write(struct file *file,
+ 	if (res > 0)
+ 		fuse_write_update_size(inode, pos);
+ 
++	clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ 	fuse_invalidate_attr(inode);
+ 
+ 	return res > 0 ? res : err;
+@@ -1530,7 +1536,6 @@ static int fuse_writepage_locked(struct page *page)
+ 
+ 	inc_bdi_stat(mapping->backing_dev_info, BDI_WRITEBACK);
+ 	inc_zone_page_state(tmp_page, NR_WRITEBACK_TEMP);
+-	end_page_writeback(page);
+ 
+ 	spin_lock(&fc->lock);
+ 	list_add(&req->writepages_entry, &fi->writepages);
+@@ -1538,6 +1543,8 @@ static int fuse_writepage_locked(struct page *page)
+ 	fuse_flush_writepages(inode);
+ 	spin_unlock(&fc->lock);
+ 
++	end_page_writeback(page);
++
+ 	return 0;
+ 
+ err_free:
+diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
+index fde7249a..5ced199b 100644
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -115,6 +115,8 @@ struct fuse_inode {
+ enum {
+ 	/** Advise readdirplus  */
+ 	FUSE_I_ADVISE_RDPLUS,
++	/** An operation changing file size is in progress  */
++	FUSE_I_SIZE_UNSTABLE,
+ };
+ 
+ struct fuse_conn;
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index 9a0cdde1..b5718516 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -201,7 +201,8 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,
+ 	struct timespec old_mtime;
+ 
+ 	spin_lock(&fc->lock);
+-	if (attr_version != 0 && fi->attr_version > attr_version) {
++	if ((attr_version != 0 && fi->attr_version > attr_version) ||
++	    test_bit(FUSE_I_SIZE_UNSTABLE, &fi->state)) {
+ 		spin_unlock(&fc->lock);
+ 		return;
+ 	}
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index d9b8aebd..d3705490 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -125,8 +125,8 @@ static void destroy_inodecache(void)
+ 
+ static int isofs_remount(struct super_block *sb, int *flags, char *data)
+ {
+-	/* we probably want a lot more here */
+-	*flags |= MS_RDONLY;
++	if (!(*flags & MS_RDONLY))
++		return -EROFS;
+ 	return 0;
+ }
+ 
+@@ -779,15 +779,6 @@ root_found:
+ 	 */
+ 	s->s_maxbytes = 0x80000000000LL;
+ 
+-	/*
+-	 * The CDROM is read-only, has no nodes (devices) on it, and since
+-	 * all of the files appear to be owned by root, we really do not want
+-	 * to allow suid.  (suid or devices will not show up unless we have
+-	 * Rock Ridge extensions)
+-	 */
+-
+-	s->s_flags |= MS_RDONLY /* | MS_NODEV | MS_NOSUID */;
+-
+ 	/* Set this for reference. Its not currently used except on write
+ 	   which we don't have .. */
+ 
+@@ -1546,6 +1537,9 @@ struct inode *isofs_iget(struct super_block *sb,
+ static struct dentry *isofs_mount(struct file_system_type *fs_type,
+ 	int flags, const char *dev_name, void *data)
+ {
++	/* We don't support read-write mounts */
++	if (!(flags & MS_RDONLY))
++		return ERR_PTR(-EACCES);
+ 	return mount_bdev(fs_type, flags, dev_name, data, isofs_fill_super);
+ }
+ 
+diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
+index 2487116d..84606472 100644
+--- a/fs/ocfs2/extent_map.c
++++ b/fs/ocfs2/extent_map.c
+@@ -781,7 +781,6 @@ int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ 	cpos = map_start >> osb->s_clustersize_bits;
+ 	mapping_end = ocfs2_clusters_for_bytes(inode->i_sb,
+ 					       map_start + map_len);
+-	mapping_end -= cpos;
+ 	is_last = 0;
+ 	while (cpos < mapping_end && !is_last) {
+ 		u32 fe_flags;
+diff --git a/fs/proc/root.c b/fs/proc/root.c
+index 41a6ea93..04ec276c 100644
+--- a/fs/proc/root.c
++++ b/fs/proc/root.c
+@@ -110,7 +110,8 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
+ 		ns = task_active_pid_ns(current);
+ 		options = data;
+ 
+-		if (!current_user_ns()->may_mount_proc)
++		if (!current_user_ns()->may_mount_proc ||
++		    !ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+ 			return ERR_PTR(-EPERM);
+ 	}
+ 
+diff --git a/include/linux/compat.h b/include/linux/compat.h
+index 7f0c1dd0..ec1aee4a 100644
+--- a/include/linux/compat.h
++++ b/include/linux/compat.h
+@@ -669,6 +669,13 @@ asmlinkage long compat_sys_sigaltstack(const compat_stack_t __user *uss_ptr,
+ 
+ int compat_restore_altstack(const compat_stack_t __user *uss);
+ int __compat_save_altstack(compat_stack_t __user *, unsigned long);
++#define compat_save_altstack_ex(uss, sp) do { \
++	compat_stack_t __user *__uss = uss; \
++	struct task_struct *t = current; \
++	put_user_ex(ptr_to_compat((void __user *)t->sas_ss_sp), &__uss->ss_sp); \
++	put_user_ex(sas_ss_flags(sp), &__uss->ss_flags); \
++	put_user_ex(t->sas_ss_size, &__uss->ss_size); \
++} while (0);
+ 
+ asmlinkage long compat_sys_sched_rr_get_interval(compat_pid_t pid,
+ 						 struct compat_timespec __user *interval);
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 0c48991b..ff545cc3 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -393,10 +393,12 @@ struct hid_report {
+ 	struct hid_device *device;			/* associated device */
+ };
+ 
++#define HID_MAX_IDS 256
++
+ struct hid_report_enum {
+ 	unsigned numbered;
+ 	struct list_head report_list;
+-	struct hid_report *report_id_hash[256];
++	struct hid_report *report_id_hash[HID_MAX_IDS];
+ };
+ 
+ #define HID_REPORT_TYPES 3
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index c1291624..6c7bb35a 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -518,6 +518,8 @@
+ #define PCI_DEVICE_ID_AMD_11H_NB_MISC	0x1303
+ #define PCI_DEVICE_ID_AMD_11H_NB_LINK	0x1304
+ #define PCI_DEVICE_ID_AMD_15H_M10H_F3	0x1403
++#define PCI_DEVICE_ID_AMD_15H_M30H_NB_F3 0x141d
++#define PCI_DEVICE_ID_AMD_15H_M30H_NB_F4 0x141e
+ #define PCI_DEVICE_ID_AMD_15H_NB_F0	0x1600
+ #define PCI_DEVICE_ID_AMD_15H_NB_F1	0x1601
+ #define PCI_DEVICE_ID_AMD_15H_NB_F2	0x1602
+diff --git a/include/linux/rculist.h b/include/linux/rculist.h
+index f4b1001a..4106721c 100644
+--- a/include/linux/rculist.h
++++ b/include/linux/rculist.h
+@@ -267,8 +267,9 @@ static inline void list_splice_init_rcu(struct list_head *list,
+  */
+ #define list_first_or_null_rcu(ptr, type, member) \
+ 	({struct list_head *__ptr = (ptr); \
+-	  struct list_head __rcu *__next = list_next_rcu(__ptr); \
+-	  likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \
++	  struct list_head *__next = ACCESS_ONCE(__ptr->next); \
++	  likely(__ptr != __next) ? \
++		list_entry_rcu(__next, type, member) : NULL; \
+ 	})
+ 
+ /**
+diff --git a/include/linux/signal.h b/include/linux/signal.h
+index d8974847..2ac423bd 100644
+--- a/include/linux/signal.h
++++ b/include/linux/signal.h
+@@ -434,6 +434,14 @@ void signals_init(void);
+ int restore_altstack(const stack_t __user *);
+ int __save_altstack(stack_t __user *, unsigned long);
+ 
++#define save_altstack_ex(uss, sp) do { \
++	stack_t __user *__uss = uss; \
++	struct task_struct *t = current; \
++	put_user_ex((void __user *)t->sas_ss_sp, &__uss->ss_sp); \
++	put_user_ex(sas_ss_flags(sp), &__uss->ss_flags); \
++	put_user_ex(t->sas_ss_size, &__uss->ss_size); \
++} while (0);
++
+ #ifdef CONFIG_PROC_FS
+ struct seq_file;
+ extern void render_sigset_t(struct seq_file *, const char *, sigset_t *);
+diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
+index f5f5c7df..0fdff28d 100644
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -410,7 +410,7 @@ extern int usb_hcd_pci_probe(struct pci_dev *dev,
+ extern void usb_hcd_pci_remove(struct pci_dev *dev);
+ extern void usb_hcd_pci_shutdown(struct pci_dev *dev);
+ 
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_PM
+ extern const struct dev_pm_ops usb_hcd_pci_pm_ops;
+ #endif
+ #endif /* CONFIG_PCI */
+diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
+index 7343a27f..47ada233 100644
+--- a/include/media/v4l2-ctrls.h
++++ b/include/media/v4l2-ctrls.h
+@@ -22,6 +22,7 @@
+ #define _V4L2_CTRLS_H
+ 
+ #include <linux/list.h>
++#include <linux/mutex.h>
+ #include <linux/videodev2.h>
+ 
+ /* forward references */
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index f3569747..ad8e1bdc 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -1682,12 +1682,10 @@ static bool handle_trampoline(struct pt_regs *regs)
+ 		tmp = ri;
+ 		ri = ri->next;
+ 		kfree(tmp);
++		utask->depth--;
+ 
+ 		if (!chained)
+ 			break;
+-
+-		utask->depth--;
+-
+ 		BUG_ON(!ri);
+ 	}
+ 
+diff --git a/kernel/fork.c b/kernel/fork.c
+index ffbc0904..80d92e98 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1171,10 +1171,11 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	/*
+-	 * If the new process will be in a different pid namespace
+-	 * don't allow the creation of threads.
++	 * If the new process will be in a different pid namespace don't
++	 * allow it to share a thread group or signal handlers with the
++	 * forking task.
+ 	 */
+-	if ((clone_flags & (CLONE_VM|CLONE_NEWPID)) &&
++	if ((clone_flags & (CLONE_SIGHAND | CLONE_NEWPID)) &&
+ 	    (task_active_pid_ns(current) != current->nsproxy->pid_ns))
+ 		return ERR_PTR(-EINVAL);
+ 
+diff --git a/kernel/pid.c b/kernel/pid.c
+index 0db3e791..0eb6d8e8 100644
+--- a/kernel/pid.c
++++ b/kernel/pid.c
+@@ -264,6 +264,7 @@ void free_pid(struct pid *pid)
+ 		struct pid_namespace *ns = upid->ns;
+ 		hlist_del_rcu(&upid->pid_chain);
+ 		switch(--ns->nr_hashed) {
++		case 2:
+ 		case 1:
+ 			/* When all that is left in the pid namespace
+ 			 * is the reaper wake up the reaper.  The reaper
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 362c329b..b92d0ce4 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2286,6 +2286,8 @@ static void collapse_huge_page(struct mm_struct *mm,
+ 		goto out;
+ 
+ 	vma = find_vma(mm, address);
++	if (!vma)
++		goto out;
+ 	hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ 	hend = vma->vm_end & HPAGE_PMD_MASK;
+ 	if (address < hstart || address + HPAGE_PMD_SIZE > hend)
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 82a187ae..905ce72c 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -5584,7 +5584,13 @@ static int compare_thresholds(const void *a, const void *b)
+ 	const struct mem_cgroup_threshold *_a = a;
+ 	const struct mem_cgroup_threshold *_b = b;
+ 
+-	return _a->threshold - _b->threshold;
++	if (_a->threshold > _b->threshold)
++		return 1;
++
++	if (_a->threshold < _b->threshold)
++		return -1;
++
++	return 0;
+ }
+ 
+ static int mem_cgroup_oom_notify_cb(struct mem_cgroup *memcg)
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index 3a246a6c..46ec7672 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -2130,6 +2130,8 @@ int ceph_osdc_start_request(struct ceph_osd_client *osdc,
+ 			dout("osdc_start_request failed map, "
+ 				" will retry %lld\n", req->r_tid);
+ 			rc = 0;
++		} else {
++			__unregister_request(osdc, req);
+ 		}
+ 		goto out_unlock;
+ 	}
+diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
+index 603ddd92..dbd9a479 100644
+--- a/net/ceph/osdmap.c
++++ b/net/ceph/osdmap.c
+@@ -1129,7 +1129,7 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
+ 
+ 	/* pg_temp? */
+ 	pgid.seed = ceph_stable_mod(pgid.seed, pool->pg_num,
+-				    pool->pgp_num_mask);
++				    pool->pg_num_mask);
+ 	pg = __lookup_pg_mapping(&osdmap->pg_temp, pgid);
+ 	if (pg) {
+ 		*num = pg->len;
+diff --git a/net/core/scm.c b/net/core/scm.c
+index 03795d01..b4da80b1 100644
+--- a/net/core/scm.c
++++ b/net/core/scm.c
+@@ -54,7 +54,7 @@ static __inline__ int scm_check_creds(struct ucred *creds)
+ 		return -EINVAL;
+ 
+ 	if ((creds->pid == task_tgid_vnr(current) ||
+-	     ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
++	     ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
+ 	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
+ 	      uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
+ 	    ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index de18722c..624e6c04 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -3335,6 +3335,7 @@ static struct snd_pci_quirk msi_black_list[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
+ 	SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
+ 	SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
++	SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */
+ 	SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */
+ 	SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */
+ 	{}
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 5bc41945..b5375ed0 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -67,6 +67,8 @@ struct hdmi_spec_per_pin {
+ 	struct delayed_work work;
+ 	struct snd_kcontrol *eld_ctl;
+ 	int repoll_count;
++	bool setup; /* the stream has been set up by prepare callback */
++	int channels; /* current number of channels */
+ 	bool non_pcm;
+ 	bool chmap_set;		/* channel-map override by ALSA API? */
+ 	unsigned char chmap[8]; /* ALSA API channel-map */
+@@ -551,6 +553,17 @@ static int hdmi_channel_allocation(struct hdmi_eld *eld, int channels)
+ 		}
+ 	}
+ 
++	if (!ca) {
++		/* if there was no match, select the regular ALSA channel
++		 * allocation with the matching number of channels */
++		for (i = 0; i < ARRAY_SIZE(channel_allocations); i++) {
++			if (channels == channel_allocations[i].channels) {
++				ca = channel_allocations[i].ca_index;
++				break;
++			}
++		}
++	}
++
+ 	snd_print_channel_allocation(eld->info.spk_alloc, buf, sizeof(buf));
+ 	snd_printdd("HDMI: select CA 0x%x for %d-channel allocation: %s\n",
+ 		    ca, channels, buf);
+@@ -868,18 +881,19 @@ static bool hdmi_infoframe_uptodate(struct hda_codec *codec, hda_nid_t pin_nid,
+ 	return true;
+ }
+ 
+-static void hdmi_setup_audio_infoframe(struct hda_codec *codec, int pin_idx,
+-				       bool non_pcm,
+-				       struct snd_pcm_substream *substream)
++static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
++				       struct hdmi_spec_per_pin *per_pin,
++				       bool non_pcm)
+ {
+-	struct hdmi_spec *spec = codec->spec;
+-	struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
+ 	hda_nid_t pin_nid = per_pin->pin_nid;
+-	int channels = substream->runtime->channels;
++	int channels = per_pin->channels;
+ 	struct hdmi_eld *eld;
+ 	int ca;
+ 	union audio_infoframe ai;
+ 
++	if (!channels)
++		return;
++
+ 	eld = &per_pin->sink_eld;
+ 	if (!eld->monitor_present)
+ 		return;
+@@ -1263,6 +1277,7 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
+ 		eld_changed = true;
+ 	}
+ 	if (update_eld) {
++		bool old_eld_valid = pin_eld->eld_valid;
+ 		pin_eld->eld_valid = eld->eld_valid;
+ 		eld_changed = pin_eld->eld_size != eld->eld_size ||
+ 			      memcmp(pin_eld->eld_buffer, eld->eld_buffer,
+@@ -1272,6 +1287,18 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
+ 			       eld->eld_size);
+ 		pin_eld->eld_size = eld->eld_size;
+ 		pin_eld->info = eld->info;
++
++		/* Haswell-specific workaround: re-setup when the transcoder is
++		 * changed during the stream playback
++		 */
++		if (codec->vendor_id == 0x80862807 &&
++		    eld->eld_valid && !old_eld_valid && per_pin->setup) {
++			snd_hda_codec_write(codec, pin_nid, 0,
++					    AC_VERB_SET_AMP_GAIN_MUTE,
++					    AMP_OUT_UNMUTE);
++			hdmi_setup_audio_infoframe(codec, per_pin,
++						   per_pin->non_pcm);
++		}
+ 	}
+ 	mutex_unlock(&pin_eld->lock);
+ 
+@@ -1444,14 +1471,17 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
+ 	hda_nid_t cvt_nid = hinfo->nid;
+ 	struct hdmi_spec *spec = codec->spec;
+ 	int pin_idx = hinfo_to_pin_index(spec, hinfo);
+-	hda_nid_t pin_nid = get_pin(spec, pin_idx)->pin_nid;
++	struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
++	hda_nid_t pin_nid = per_pin->pin_nid;
+ 	bool non_pcm;
+ 
+ 	non_pcm = check_non_pcm_per_cvt(codec, cvt_nid);
++	per_pin->channels = substream->runtime->channels;
++	per_pin->setup = true;
+ 
+ 	hdmi_set_channel_count(codec, cvt_nid, substream->runtime->channels);
+ 
+-	hdmi_setup_audio_infoframe(codec, pin_idx, non_pcm, substream);
++	hdmi_setup_audio_infoframe(codec, per_pin, non_pcm);
+ 
+ 	return hdmi_setup_stream(codec, cvt_nid, pin_nid, stream_tag, format);
+ }
+@@ -1491,6 +1521,9 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo,
+ 		snd_hda_spdif_ctls_unassign(codec, pin_idx);
+ 		per_pin->chmap_set = false;
+ 		memset(per_pin->chmap, 0, sizeof(per_pin->chmap));
++
++		per_pin->setup = false;
++		per_pin->channels = 0;
+ 	}
+ 
+ 	return 0;
+@@ -1626,8 +1659,7 @@ static int hdmi_chmap_ctl_put(struct snd_kcontrol *kcontrol,
+ 	per_pin->chmap_set = true;
+ 	memcpy(per_pin->chmap, chmap, sizeof(chmap));
+ 	if (prepared)
+-		hdmi_setup_audio_infoframe(codec, pin_idx, per_pin->non_pcm,
+-					   substream);
++		hdmi_setup_audio_infoframe(codec, per_pin, per_pin->non_pcm);
+ 
+ 	return 0;
+ }
+diff --git a/sound/soc/codecs/mc13783.c b/sound/soc/codecs/mc13783.c
+index 5402dfbb..8a8d9364 100644
+--- a/sound/soc/codecs/mc13783.c
++++ b/sound/soc/codecs/mc13783.c
+@@ -126,6 +126,10 @@ static int mc13783_write(struct snd_soc_codec *codec,
+ 
+ 	ret = mc13xxx_reg_write(priv->mc13xxx, reg, value);
+ 
++	/* include errata fix for spi audio problems */
++	if (reg == MC13783_AUDIO_CODEC || reg == MC13783_AUDIO_DAC)
++		ret = mc13xxx_reg_write(priv->mc13xxx, reg, value);
++
+ 	mc13xxx_unlock(priv->mc13xxx);
+ 
+ 	return ret;
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 0a4ffdd1..5e5af898 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -857,9 +857,9 @@ static int wm8960_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
+ 	if (pll_div.k) {
+ 		reg |= 0x20;
+ 
+-		snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 18) & 0x3f);
+-		snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 9) & 0x1ff);
+-		snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0x1ff);
++		snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 16) & 0xff);
++		snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 8) & 0xff);
++		snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0xff);
+ 	}
+ 	snd_soc_write(codec, WM8960_PLL1, reg);
+ 

Deleted: genpatches-2.6/trunk/3.10/1500_CVE-2013-4300-net-Check-the-correct-namespace-when-spoofing-pid-ov.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1500_CVE-2013-4300-net-Check-the-correct-namespace-when-spoofing-pid-ov.patch	2013-09-25 17:13:05 UTC (rev 2528)
+++ genpatches-2.6/trunk/3.10/1500_CVE-2013-4300-net-Check-the-correct-namespace-when-spoofing-pid-ov.patch	2013-09-27 17:20:08 UTC (rev 2529)
@@ -1,35 +0,0 @@
-From d661684cf6820331feae71146c35da83d794467e Mon Sep 17 00:00:00 2001
-From: Andy Lutomirski <luto@××××××××××.net>
-Date: Thu, 22 Aug 2013 11:39:15 -0700
-Subject: [PATCH] net: Check the correct namespace when spoofing pid over
- SCM_RIGHTS
-
-This is a security bug.
-
-The follow-up will fix nsproxy to discourage this type of issue from
-happening again.
-
-Cc: stable@×××××××××××.org
-Signed-off-by: Andy Lutomirski <luto@××××××××××.net>
-Reviewed-by: "Eric W. Biederman" <ebiederm@××××××××.com>
-Signed-off-by: David S. Miller <davem@×××××××××.net>
----
- net/core/scm.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/core/scm.c b/net/core/scm.c
-index 03795d0..b4da80b 100644
---- a/net/core/scm.c
-+++ b/net/core/scm.c
-@@ -54,7 +54,7 @@ static __inline__ int scm_check_creds(struct ucred *creds)
- 		return -EINVAL;
- 
- 	if ((creds->pid == task_tgid_vnr(current) ||
--	     ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
-+	     ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
- 	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
- 	      uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
- 	    ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||
--- 
-1.8.3.2
-

Modified: genpatches-2.6/trunk/3.11/0000_README
===================================================================
--- genpatches-2.6/trunk/3.11/0000_README	2013-09-25 17:13:05 UTC (rev 2528)
+++ genpatches-2.6/trunk/3.11/0000_README	2013-09-27 17:20:08 UTC (rev 2529)
@@ -46,6 +46,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.11.1
 
+Patch:  1001_linux-3.11.2.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.11.2
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.11/1001_linux-3.11.2.patch
===================================================================
--- genpatches-2.6/trunk/3.11/1001_linux-3.11.2.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.11/1001_linux-3.11.2.patch	2013-09-27 17:20:08 UTC (rev 2529)
@@ -0,0 +1,4419 @@
+diff --git a/Makefile b/Makefile
+index efd23961..aede3194 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 11
+-SUBLEVEL = 1
++SUBLEVEL = 2
+ EXTRAVERSION =
+ NAME = Linux for Workgroups
+ 
+diff --git a/arch/arc/include/asm/sections.h b/arch/arc/include/asm/sections.h
+index 6fc1159d..764f1e3b 100644
+--- a/arch/arc/include/asm/sections.h
++++ b/arch/arc/include/asm/sections.h
+@@ -11,7 +11,6 @@
+ 
+ #include <asm-generic/sections.h>
+ 
+-extern char _int_vec_base_lds[];
+ extern char __arc_dccm_base[];
+ extern char __dtb_start[];
+ 
+diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S
+index 2a913f85..0f944f02 100644
+--- a/arch/arc/kernel/head.S
++++ b/arch/arc/kernel/head.S
+@@ -34,6 +34,9 @@ stext:
+ 	;	IDENTITY Reg [ 3  2  1  0 ]
+ 	;	(cpu-id)             ^^^	=> Zero for UP ARC700
+ 	;					=> #Core-ID if SMP (Master 0)
++	; Note that non-boot CPUs might not land here if halt-on-reset and
++	; instead breath life from @first_lines_of_secondary, but we still
++	; need to make sure only boot cpu takes this path.
+ 	GET_CPU_ID  r5
+ 	cmp	r5, 0
+ 	jnz	arc_platform_smp_wait_to_boot
+@@ -98,6 +101,8 @@ stext:
+ 
+ first_lines_of_secondary:
+ 
++	sr	@_int_vec_base_lds, [AUX_INTR_VEC_BASE]
++
+ 	; setup per-cpu idle task as "current" on this CPU
+ 	ld	r0, [@secondary_idle_tsk]
+ 	SET_CURR_TASK_ON_CPU  r0, r1
+diff --git a/arch/arc/kernel/irq.c b/arch/arc/kernel/irq.c
+index 305b3f86..5fc92455 100644
+--- a/arch/arc/kernel/irq.c
++++ b/arch/arc/kernel/irq.c
+@@ -24,7 +24,6 @@
+  * -Needed for each CPU (hence not foldable into init_IRQ)
+  *
+  * what it does ?
+- * -setup Vector Table Base Reg - in case Linux not linked at 0x8000_0000
+  * -Disable all IRQs (on CPU side)
+  * -Optionally, setup the High priority Interrupts as Level 2 IRQs
+  */
+diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
+index 6b083454..e8185631 100644
+--- a/arch/arc/kernel/setup.c
++++ b/arch/arc/kernel/setup.c
+@@ -47,10 +47,7 @@ void read_arc_build_cfg_regs(void)
+ 	READ_BCR(AUX_IDENTITY, cpu->core);
+ 
+ 	cpu->timers = read_aux_reg(ARC_REG_TIMERS_BCR);
+-
+ 	cpu->vec_base = read_aux_reg(AUX_INTR_VEC_BASE);
+-	if (cpu->vec_base == 0)
+-		cpu->vec_base = (unsigned int)_int_vec_base_lds;
+ 
+ 	READ_BCR(ARC_REG_D_UNCACH_BCR, uncached_space);
+ 	cpu->uncached_base = uncached_space.start << 24;
+diff --git a/arch/arm/mach-versatile/include/mach/platform.h b/arch/arm/mach-versatile/include/mach/platform.h
+index ec087407..6f938ccb 100644
+--- a/arch/arm/mach-versatile/include/mach/platform.h
++++ b/arch/arm/mach-versatile/include/mach/platform.h
+@@ -231,12 +231,14 @@
+ /* PCI space */
+ #define VERSATILE_PCI_BASE             0x41000000	/* PCI Interface */
+ #define VERSATILE_PCI_CFG_BASE	       0x42000000
++#define VERSATILE_PCI_IO_BASE          0x43000000
+ #define VERSATILE_PCI_MEM_BASE0        0x44000000
+ #define VERSATILE_PCI_MEM_BASE1        0x50000000
+ #define VERSATILE_PCI_MEM_BASE2        0x60000000
+ /* Sizes of above maps */
+ #define VERSATILE_PCI_BASE_SIZE	       0x01000000
+ #define VERSATILE_PCI_CFG_BASE_SIZE    0x02000000
++#define VERSATILE_PCI_IO_BASE_SIZE     0x01000000
+ #define VERSATILE_PCI_MEM_BASE0_SIZE   0x0c000000	/* 32Mb */
+ #define VERSATILE_PCI_MEM_BASE1_SIZE   0x10000000	/* 256Mb */
+ #define VERSATILE_PCI_MEM_BASE2_SIZE   0x10000000	/* 256Mb */
+diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
+index e92e5e07..c97be4ea 100644
+--- a/arch/arm/mach-versatile/pci.c
++++ b/arch/arm/mach-versatile/pci.c
+@@ -43,9 +43,9 @@
+ #define PCI_IMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x0)
+ #define PCI_IMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x4)
+ #define PCI_IMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x8)
+-#define PCI_SMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x10)
+-#define PCI_SMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
+-#define PCI_SMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
++#define PCI_SMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x1c)
+ #define PCI_SELFID		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0xc)
+ 
+ #define DEVICE_ID_OFFSET		0x00
+@@ -170,8 +170,8 @@ static struct pci_ops pci_versatile_ops = {
+ 	.write	= versatile_write_config,
+ };
+ 
+-static struct resource io_mem = {
+-	.name	= "PCI I/O space",
++static struct resource unused_mem = {
++	.name	= "PCI unused",
+ 	.start	= VERSATILE_PCI_MEM_BASE0,
+ 	.end	= VERSATILE_PCI_MEM_BASE0+VERSATILE_PCI_MEM_BASE0_SIZE-1,
+ 	.flags	= IORESOURCE_MEM,
+@@ -195,9 +195,9 @@ static int __init pci_versatile_setup_resources(struct pci_sys_data *sys)
+ {
+ 	int ret = 0;
+ 
+-	ret = request_resource(&iomem_resource, &io_mem);
++	ret = request_resource(&iomem_resource, &unused_mem);
+ 	if (ret) {
+-		printk(KERN_ERR "PCI: unable to allocate I/O "
++		printk(KERN_ERR "PCI: unable to allocate unused "
+ 		       "memory region (%d)\n", ret);
+ 		goto out;
+ 	}
+@@ -205,7 +205,7 @@ static int __init pci_versatile_setup_resources(struct pci_sys_data *sys)
+ 	if (ret) {
+ 		printk(KERN_ERR "PCI: unable to allocate non-prefetchable "
+ 		       "memory region (%d)\n", ret);
+-		goto release_io_mem;
++		goto release_unused_mem;
+ 	}
+ 	ret = request_resource(&iomem_resource, &pre_mem);
+ 	if (ret) {
+@@ -225,8 +225,8 @@ static int __init pci_versatile_setup_resources(struct pci_sys_data *sys)
+ 
+  release_non_mem:
+ 	release_resource(&non_mem);
+- release_io_mem:
+-	release_resource(&io_mem);
++ release_unused_mem:
++	release_resource(&unused_mem);
+  out:
+ 	return ret;
+ }
+@@ -246,7 +246,7 @@ int __init pci_versatile_setup(int nr, struct pci_sys_data *sys)
+ 		goto out;
+ 	}
+ 
+-	ret = pci_ioremap_io(0, VERSATILE_PCI_MEM_BASE0);
++	ret = pci_ioremap_io(0, VERSATILE_PCI_IO_BASE);
+ 	if (ret)
+ 		goto out;
+ 
+@@ -295,6 +295,19 @@ int __init pci_versatile_setup(int nr, struct pci_sys_data *sys)
+ 	__raw_writel(PHYS_OFFSET, local_pci_cfg_base + PCI_BASE_ADDRESS_2);
+ 
+ 	/*
++	 * For many years the kernel and QEMU were symbiotically buggy
++	 * in that they both assumed the same broken IRQ mapping.
++	 * QEMU therefore attempts to auto-detect old broken kernels
++	 * so that they still work on newer QEMU as they did on old
++	 * QEMU. Since we now use the correct (ie matching-hardware)
++	 * IRQ mapping we write a definitely different value to a
++	 * PCI_INTERRUPT_LINE register to tell QEMU that we expect
++	 * real hardware behaviour and it need not be backwards
++	 * compatible for us. This write is harmless on real hardware.
++	 */
++	__raw_writel(0, VERSATILE_PCI_VIRT_BASE+PCI_INTERRUPT_LINE);
++
++	/*
+ 	 * Do not to map Versatile FPGA PCI device into memory space
+ 	 */
+ 	pci_slot_ignore |= (1 << myslot);
+@@ -327,13 +340,13 @@ static int __init versatile_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+ {
+ 	int irq;
+ 
+-	/* slot,  pin,	irq
+-	 *  24     1     IRQ_SIC_PCI0
+-	 *  25     1     IRQ_SIC_PCI1
+-	 *  26     1     IRQ_SIC_PCI2
+-	 *  27     1     IRQ_SIC_PCI3
++	/*
++	 * Slot	INTA	INTB	INTC	INTD
++	 * 31	PCI1	PCI2	PCI3	PCI0
++	 * 30	PCI0	PCI1	PCI2	PCI3
++	 * 29	PCI3	PCI0	PCI1	PCI2
+ 	 */
+-	irq = IRQ_SIC_PCI0 + ((slot - 24 + pin - 1) & 3);
++	irq = IRQ_SIC_PCI0 + ((slot + 2 + pin - 1) & 3);
+ 
+ 	return irq;
+ }
+diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
+index 8a6295c8..7071fcac 100644
+--- a/arch/arm/xen/enlighten.c
++++ b/arch/arm/xen/enlighten.c
+@@ -273,12 +273,15 @@ core_initcall(xen_guest_init);
+ 
+ static int __init xen_pm_init(void)
+ {
++	if (!xen_domain())
++		return -ENODEV;
++
+ 	pm_power_off = xen_power_off;
+ 	arm_pm_restart = xen_restart;
+ 
+ 	return 0;
+ }
+-subsys_initcall(xen_pm_init);
++late_initcall(xen_pm_init);
+ 
+ static irqreturn_t xen_arm_callback(int irq, void *arg)
+ {
+diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
+index 12e6ccb8..cea1594f 100644
+--- a/arch/arm64/kernel/perf_event.c
++++ b/arch/arm64/kernel/perf_event.c
+@@ -325,7 +325,10 @@ validate_event(struct pmu_hw_events *hw_events,
+ 	if (is_software_event(event))
+ 		return 1;
+ 
+-	if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)
++	if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
++		return 1;
++
++	if (event->state == PERF_EVENT_STATE_OFF && !event->attr.enable_on_exec)
+ 		return 1;
+ 
+ 	return armpmu->get_event_idx(hw_events, &fake_event) >= 0;
+@@ -781,7 +784,7 @@ static const unsigned armv8_pmuv3_perf_cache_map[PERF_COUNT_HW_CACHE_MAX]
+ /*
+  * PMXEVTYPER: Event selection reg
+  */
+-#define	ARMV8_EVTYPE_MASK	0xc00000ff	/* Mask for writable bits */
++#define	ARMV8_EVTYPE_MASK	0xc80000ff	/* Mask for writable bits */
+ #define	ARMV8_EVTYPE_EVENT	0xff		/* Mask for EVENT bits */
+ 
+ /*
+diff --git a/arch/mips/ath79/clock.c b/arch/mips/ath79/clock.c
+index 765ef30e..733017b3 100644
+--- a/arch/mips/ath79/clock.c
++++ b/arch/mips/ath79/clock.c
+@@ -164,7 +164,7 @@ static void __init ar933x_clocks_init(void)
+ 		ath79_ahb_clk.rate = freq / t;
+ 	}
+ 
+-	ath79_wdt_clk.rate = ath79_ref_clk.rate;
++	ath79_wdt_clk.rate = ath79_ahb_clk.rate;
+ 	ath79_uart_clk.rate = ath79_ref_clk.rate;
+ }
+ 
+diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
+index ee5b690a..52e5758e 100644
+--- a/arch/powerpc/kernel/align.c
++++ b/arch/powerpc/kernel/align.c
+@@ -764,6 +764,16 @@ int fix_alignment(struct pt_regs *regs)
+ 	nb = aligninfo[instr].len;
+ 	flags = aligninfo[instr].flags;
+ 
++	/* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */
++	if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) {
++		nb = 8;
++		flags = LD+SW;
++	} else if (IS_XFORM(instruction) &&
++		   ((instruction >> 1) & 0x3ff) == 660) {
++		nb = 8;
++		flags = ST+SW;
++	}
++
+ 	/* Byteswap little endian loads and stores */
+ 	swiz = 0;
+ 	if (regs->msr & MSR_LE) {
+diff --git a/arch/powerpc/kvm/book3s_xics.c b/arch/powerpc/kvm/book3s_xics.c
+index 94c1dd46..a3a5cb8e 100644
+--- a/arch/powerpc/kvm/book3s_xics.c
++++ b/arch/powerpc/kvm/book3s_xics.c
+@@ -19,6 +19,7 @@
+ #include <asm/hvcall.h>
+ #include <asm/xics.h>
+ #include <asm/debug.h>
++#include <asm/time.h>
+ 
+ #include <linux/debugfs.h>
+ #include <linux/seq_file.h>
+diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
+index c11c8238..54b998f2 100644
+--- a/arch/powerpc/platforms/pseries/setup.c
++++ b/arch/powerpc/platforms/pseries/setup.c
+@@ -354,7 +354,7 @@ static int alloc_dispatch_log_kmem_cache(void)
+ }
+ early_initcall(alloc_dispatch_log_kmem_cache);
+ 
+-static void pSeries_idle(void)
++static void pseries_lpar_idle(void)
+ {
+ 	/* This would call on the cpuidle framework, and the back-end pseries
+ 	 * driver to  go to idle states
+@@ -362,10 +362,22 @@ static void pSeries_idle(void)
+ 	if (cpuidle_idle_call()) {
+ 		/* On error, execute default handler
+ 		 * to go into low thread priority and possibly
+-		 * low power mode.
++		 * low power mode by cedeing processor to hypervisor
+ 		 */
+-		HMT_low();
+-		HMT_very_low();
++
++		/* Indicate to hypervisor that we are idle. */
++		get_lppaca()->idle = 1;
++
++		/*
++		 * Yield the processor to the hypervisor.  We return if
++		 * an external interrupt occurs (which are driven prior
++		 * to returning here) or if a prod occurs from another
++		 * processor. When returning here, external interrupts
++		 * are enabled.
++		 */
++		cede_processor();
++
++		get_lppaca()->idle = 0;
+ 	}
+ }
+ 
+@@ -456,15 +468,14 @@ static void __init pSeries_setup_arch(void)
+ 
+ 	pSeries_nvram_init();
+ 
+-	if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
++	if (firmware_has_feature(FW_FEATURE_LPAR)) {
+ 		vpa_init(boot_cpuid);
+-		ppc_md.power_save = pSeries_idle;
+-	}
+-
+-	if (firmware_has_feature(FW_FEATURE_LPAR))
++		ppc_md.power_save = pseries_lpar_idle;
+ 		ppc_md.enable_pmcs = pseries_lpar_enable_pmcs;
+-	else
++	} else {
++		/* No special idle routine */
+ 		ppc_md.enable_pmcs = power4_enable_pmcs;
++	}
+ 
+ 	ppc_md.pcibios_root_bridge_prepare = pseries_root_bridge_prepare;
+ 
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index d5f10a43..70923928 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -805,7 +805,7 @@ static struct bpf_binary_header *bpf_alloc_binary(unsigned int bpfsize,
+ 		return NULL;
+ 	memset(header, 0, sz);
+ 	header->pages = sz / PAGE_SIZE;
+-	hole = sz - bpfsize + sizeof(*header);
++	hole = sz - (bpfsize + sizeof(*header));
+ 	/* Insert random number of illegal instructions before BPF code
+ 	 * and make sure the first instruction starts at an even address.
+ 	 */
+diff --git a/arch/um/include/shared/os.h b/arch/um/include/shared/os.h
+index 95feaa47..c70a234a 100644
+--- a/arch/um/include/shared/os.h
++++ b/arch/um/include/shared/os.h
+@@ -200,6 +200,7 @@ extern int os_unmap_memory(void *addr, int len);
+ extern int os_drop_memory(void *addr, int length);
+ extern int can_drop_memory(void);
+ extern void os_flush_stdout(void);
++extern int os_mincore(void *addr, unsigned long len);
+ 
+ /* execvp.c */
+ extern int execvp_noalloc(char *buf, const char *file, char *const argv[]);
+diff --git a/arch/um/kernel/Makefile b/arch/um/kernel/Makefile
+index babe2182..d8b78a03 100644
+--- a/arch/um/kernel/Makefile
++++ b/arch/um/kernel/Makefile
+@@ -13,7 +13,7 @@ clean-files :=
+ obj-y = config.o exec.o exitcode.o irq.o ksyms.o mem.o \
+ 	physmem.o process.o ptrace.o reboot.o sigio.o \
+ 	signal.o smp.o syscall.o sysrq.o time.o tlb.o trap.o \
+-	um_arch.o umid.o skas/
++	um_arch.o umid.o maccess.o skas/
+ 
+ obj-$(CONFIG_BLK_DEV_INITRD) += initrd.o
+ obj-$(CONFIG_GPROF)	+= gprof_syms.o
+diff --git a/arch/um/kernel/maccess.c b/arch/um/kernel/maccess.c
+new file mode 100644
+index 00000000..1f3d5c49
+--- /dev/null
++++ b/arch/um/kernel/maccess.c
+@@ -0,0 +1,24 @@
++/*
++ * Copyright (C) 2013 Richard Weinberger <richrd@×××.at>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/uaccess.h>
++#include <linux/kernel.h>
++#include <os.h>
++
++long probe_kernel_read(void *dst, const void *src, size_t size)
++{
++	void *psrc = (void *)rounddown((unsigned long)src, PAGE_SIZE);
++
++	if ((unsigned long)src < PAGE_SIZE || size <= 0)
++		return -EFAULT;
++
++	if (os_mincore(psrc, size + src - psrc) <= 0)
++		return -EFAULT;
++
++	return __probe_kernel_read(dst, src, size);
++}
+diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c
+index b8f34c9e..67b9c8f5 100644
+--- a/arch/um/os-Linux/process.c
++++ b/arch/um/os-Linux/process.c
+@@ -4,6 +4,7 @@
+  */
+ 
+ #include <stdio.h>
++#include <stdlib.h>
+ #include <unistd.h>
+ #include <errno.h>
+ #include <signal.h>
+@@ -232,6 +233,57 @@ out:
+ 	return ok;
+ }
+ 
++static int os_page_mincore(void *addr)
++{
++	char vec[2];
++	int ret;
++
++	ret = mincore(addr, UM_KERN_PAGE_SIZE, vec);
++	if (ret < 0) {
++		if (errno == ENOMEM || errno == EINVAL)
++			return 0;
++		else
++			return -errno;
++	}
++
++	return vec[0] & 1;
++}
++
++int os_mincore(void *addr, unsigned long len)
++{
++	char *vec;
++	int ret, i;
++
++	if (len <= UM_KERN_PAGE_SIZE)
++		return os_page_mincore(addr);
++
++	vec = calloc(1, (len + UM_KERN_PAGE_SIZE - 1) / UM_KERN_PAGE_SIZE);
++	if (!vec)
++		return -ENOMEM;
++
++	ret = mincore(addr, UM_KERN_PAGE_SIZE, vec);
++	if (ret < 0) {
++		if (errno == ENOMEM || errno == EINVAL)
++			ret = 0;
++		else
++			ret = -errno;
++
++		goto out;
++	}
++
++	for (i = 0; i < ((len + UM_KERN_PAGE_SIZE - 1) / UM_KERN_PAGE_SIZE); i++) {
++		if (!(vec[i] & 1)) {
++			ret = 0;
++			goto out;
++		}
++	}
++
++	ret = 1;
++out:
++	free(vec);
++	return ret;
++}
++
+ void init_new_thread_signals(void)
+ {
+ 	set_handler(SIGSEGV);
+diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
+index bccfca68..665a7303 100644
+--- a/arch/x86/ia32/ia32_signal.c
++++ b/arch/x86/ia32/ia32_signal.c
+@@ -457,7 +457,7 @@ int ia32_setup_rt_frame(int sig, struct ksignal *ksig,
+ 		else
+ 			put_user_ex(0, &frame->uc.uc_flags);
+ 		put_user_ex(0, &frame->uc.uc_link);
+-		err |= __compat_save_altstack(&frame->uc.uc_stack, regs->sp);
++		compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+ 
+ 		if (ksig->ka.sa.sa_flags & SA_RESTORER)
+ 			restorer = ksig->ka.sa.sa_restorer;
+diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
+index 46fc474f..f50de695 100644
+--- a/arch/x86/include/asm/checksum_32.h
++++ b/arch/x86/include/asm/checksum_32.h
+@@ -49,9 +49,15 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
+ 						 int len, __wsum sum,
+ 						 int *err_ptr)
+ {
++	__wsum ret;
++
+ 	might_sleep();
+-	return csum_partial_copy_generic((__force void *)src, dst,
+-					 len, sum, err_ptr, NULL);
++	stac();
++	ret = csum_partial_copy_generic((__force void *)src, dst,
++					len, sum, err_ptr, NULL);
++	clac();
++
++	return ret;
+ }
+ 
+ /*
+@@ -176,10 +182,16 @@ static inline __wsum csum_and_copy_to_user(const void *src,
+ 					   int len, __wsum sum,
+ 					   int *err_ptr)
+ {
++	__wsum ret;
++
+ 	might_sleep();
+-	if (access_ok(VERIFY_WRITE, dst, len))
+-		return csum_partial_copy_generic(src, (__force void *)dst,
+-						 len, sum, NULL, err_ptr);
++	if (access_ok(VERIFY_WRITE, dst, len)) {
++		stac();
++		ret = csum_partial_copy_generic(src, (__force void *)dst,
++						len, sum, NULL, err_ptr);
++		clac();
++		return ret;
++	}
+ 
+ 	if (len)
+ 		*err_ptr = -EFAULT;
+diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
+index 29e3093b..aa97342e 100644
+--- a/arch/x86/include/asm/mce.h
++++ b/arch/x86/include/asm/mce.h
+@@ -32,11 +32,20 @@
+ #define MCI_STATUS_PCC   (1ULL<<57)  /* processor context corrupt */
+ #define MCI_STATUS_S	 (1ULL<<56)  /* Signaled machine check */
+ #define MCI_STATUS_AR	 (1ULL<<55)  /* Action required */
+-#define MCACOD		  0xffff     /* MCA Error Code */
++
++/*
++ * Note that the full MCACOD field of IA32_MCi_STATUS MSR is
++ * bits 15:0.  But bit 12 is the 'F' bit, defined for corrected
++ * errors to indicate that errors are being filtered by hardware.
++ * We should mask out bit 12 when looking for specific signatures
++ * of uncorrected errors - so the F bit is deliberately skipped
++ * in this #define.
++ */
++#define MCACOD		  0xefff     /* MCA Error Code */
+ 
+ /* Architecturally defined codes from SDM Vol. 3B Chapter 15 */
+ #define MCACOD_SCRUB	0x00C0	/* 0xC0-0xCF Memory Scrubbing */
+-#define MCACOD_SCRUBMSK	0xfff0
++#define MCACOD_SCRUBMSK	0xeff0	/* Skip bit 12 ('F' bit) */
+ #define MCACOD_L3WB	0x017A	/* L3 Explicit Writeback */
+ #define MCACOD_DATA	0x0134	/* Data Load */
+ #define MCACOD_INSTR	0x0150	/* Instruction Fetch */
+diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
+index cdbf3677..be12c534 100644
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -45,22 +45,28 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ 		/* Re-load page tables */
+ 		load_cr3(next->pgd);
+ 
+-		/* stop flush ipis for the previous mm */
++		/* Stop flush ipis for the previous mm */
+ 		cpumask_clear_cpu(cpu, mm_cpumask(prev));
+ 
+-		/*
+-		 * load the LDT, if the LDT is different:
+-		 */
++		/* Load the LDT, if the LDT is different: */
+ 		if (unlikely(prev->context.ldt != next->context.ldt))
+ 			load_LDT_nolock(&next->context);
+ 	}
+ #ifdef CONFIG_SMP
+-	else {
++	  else {
+ 		this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+ 		BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next);
+ 
+-		if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next))) {
+-			/* We were in lazy tlb mode and leave_mm disabled
++		if (!cpumask_test_cpu(cpu, mm_cpumask(next))) {
++			/*
++			 * On established mms, the mm_cpumask is only changed
++			 * from irq context, from ptep_clear_flush() while in
++			 * lazy tlb mode, and here. Irqs are blocked during
++			 * schedule, protecting us from simultaneous changes.
++			 */
++			cpumask_set_cpu(cpu, mm_cpumask(next));
++			/*
++			 * We were in lazy tlb mode and leave_mm disabled
+ 			 * tlb flush IPI delivery. We must reload CR3
+ 			 * to make sure to use no freed page tables.
+ 			 */
+diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
+index 3048ded1..59554dca 100644
+--- a/arch/x86/kernel/amd_nb.c
++++ b/arch/x86/kernel/amd_nb.c
+@@ -20,6 +20,7 @@ const struct pci_device_id amd_nb_misc_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ 	{}
+ };
+@@ -27,6 +28,7 @@ EXPORT_SYMBOL(amd_nb_misc_ids);
+ 
+ static const struct pci_device_id amd_nb_link_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F4) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
+ 	{}
+ };
+@@ -81,13 +83,20 @@ int amd_cache_northbridges(void)
+ 			next_northbridge(misc, amd_nb_misc_ids);
+ 		node_to_amd_nb(i)->link = link =
+ 			next_northbridge(link, amd_nb_link_ids);
+-        }
++	}
+ 
++	/* GART present only on Fam15h upto model 0fh */
+ 	if (boot_cpu_data.x86 == 0xf || boot_cpu_data.x86 == 0x10 ||
+-	    boot_cpu_data.x86 == 0x15)
++	    (boot_cpu_data.x86 == 0x15 && boot_cpu_data.x86_model < 0x10))
+ 		amd_northbridges.flags |= AMD_NB_GART;
+ 
+ 	/*
++	 * Check for L3 cache presence.
++	 */
++	if (!cpuid_edx(0x80000006))
++		return 0;
++
++	/*
+ 	 * Some CPU families support L3 Cache Index Disable. There are some
+ 	 * limitations because of E382 and E388 on family 0x10.
+ 	 */
+diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
+index cf913587..d859eea0 100644
+--- a/arch/x86/kernel/signal.c
++++ b/arch/x86/kernel/signal.c
+@@ -358,7 +358,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
+ 		else
+ 			put_user_ex(0, &frame->uc.uc_flags);
+ 		put_user_ex(0, &frame->uc.uc_link);
+-		err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
++		save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+ 
+ 		/* Set up to return from userspace.  */
+ 		restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
+@@ -423,7 +423,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
+ 		else
+ 			put_user_ex(0, &frame->uc.uc_flags);
+ 		put_user_ex(0, &frame->uc.uc_link);
+-		err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
++		save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+ 
+ 		/* Set up to return from userspace.  If provided, use a stub
+ 		   already in userspace.  */
+@@ -490,7 +490,7 @@ static int x32_setup_rt_frame(struct ksignal *ksig,
+ 		else
+ 			put_user_ex(0, &frame->uc.uc_flags);
+ 		put_user_ex(0, &frame->uc.uc_link);
+-		err |= __compat_save_altstack(&frame->uc.uc_stack, regs->sp);
++		compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+ 		put_user_ex(0, &frame->uc.uc__pad0);
+ 
+ 		if (ksig->ka.sa.sa_flags & SA_RESTORER) {
+diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
+index 25b7ae8d..7609e0e4 100644
+--- a/arch/x86/lib/csum-wrappers_64.c
++++ b/arch/x86/lib/csum-wrappers_64.c
+@@ -6,6 +6,7 @@
+  */
+ #include <asm/checksum.h>
+ #include <linux/module.h>
++#include <asm/smap.h>
+ 
+ /**
+  * csum_partial_copy_from_user - Copy and checksum from user space.
+@@ -52,8 +53,10 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
+ 			len -= 2;
+ 		}
+ 	}
++	stac();
+ 	isum = csum_partial_copy_generic((__force const void *)src,
+ 				dst, len, isum, errp, NULL);
++	clac();
+ 	if (unlikely(*errp))
+ 		goto out_err;
+ 
+@@ -82,6 +85,8 @@ __wsum
+ csum_partial_copy_to_user(const void *src, void __user *dst,
+ 			  int len, __wsum isum, int *errp)
+ {
++	__wsum ret;
++
+ 	might_sleep();
+ 
+ 	if (unlikely(!access_ok(VERIFY_WRITE, dst, len))) {
+@@ -105,8 +110,11 @@ csum_partial_copy_to_user(const void *src, void __user *dst,
+ 	}
+ 
+ 	*errp = 0;
+-	return csum_partial_copy_generic(src, (void __force *)dst,
+-					 len, isum, NULL, errp);
++	stac();
++	ret = csum_partial_copy_generic(src, (void __force *)dst,
++					len, isum, NULL, errp);
++	clac();
++	return ret;
+ }
+ EXPORT_SYMBOL(csum_partial_copy_to_user);
+ 
+diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
+index d8507f81..74a60c7e 100644
+--- a/arch/xtensa/kernel/xtensa_ksyms.c
++++ b/arch/xtensa/kernel/xtensa_ksyms.c
+@@ -25,6 +25,7 @@
+ #include <asm/io.h>
+ #include <asm/page.h>
+ #include <asm/pgalloc.h>
++#include <asm/ftrace.h>
+ #ifdef CONFIG_BLK_DEV_FD
+ #include <asm/floppy.h>
+ #endif
+diff --git a/crypto/api.c b/crypto/api.c
+index 3b618033..37c4c721 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -34,6 +34,8 @@ EXPORT_SYMBOL_GPL(crypto_alg_sem);
+ BLOCKING_NOTIFIER_HEAD(crypto_chain);
+ EXPORT_SYMBOL_GPL(crypto_chain);
+ 
++static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg);
++
+ struct crypto_alg *crypto_mod_get(struct crypto_alg *alg)
+ {
+ 	return try_module_get(alg->cra_module) ? crypto_alg_get(alg) : NULL;
+@@ -144,8 +146,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,
+ 	}
+ 	up_write(&crypto_alg_sem);
+ 
+-	if (alg != &larval->alg)
++	if (alg != &larval->alg) {
+ 		kfree(larval);
++		if (crypto_is_larval(alg))
++			alg = crypto_larval_wait(alg);
++	}
+ 
+ 	return alg;
+ }
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 6a382188..fb78bb9a 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -257,12 +257,13 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
+ 				pdata->mmio_size = resource_size(&rentry->res);
+ 			pdata->mmio_base = ioremap(rentry->res.start,
+ 						   pdata->mmio_size);
+-			pdata->dev_desc = dev_desc;
+ 			break;
+ 		}
+ 
+ 	acpi_dev_free_resource_list(&resource_list);
+ 
++	pdata->dev_desc = dev_desc;
++
+ 	if (dev_desc->clk_required) {
+ 		ret = register_device_clock(adev, pdata);
+ 		if (ret) {
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index 59178393..a67853e3 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -378,6 +378,7 @@ static int acpi_pci_root_add(struct acpi_device *device,
+ 	struct acpi_pci_root *root;
+ 	u32 flags, base_flags;
+ 	acpi_handle handle = device->handle;
++	bool no_aspm = false, clear_aspm = false;
+ 
+ 	root = kzalloc(sizeof(struct acpi_pci_root), GFP_KERNEL);
+ 	if (!root)
+@@ -437,27 +438,6 @@ static int acpi_pci_root_add(struct acpi_device *device,
+ 	flags = base_flags = OSC_PCI_SEGMENT_GROUPS_SUPPORT;
+ 	acpi_pci_osc_support(root, flags);
+ 
+-	/*
+-	 * TBD: Need PCI interface for enumeration/configuration of roots.
+-	 */
+-
+-	/*
+-	 * Scan the Root Bridge
+-	 * --------------------
+-	 * Must do this prior to any attempt to bind the root device, as the
+-	 * PCI namespace does not get created until this call is made (and
+-	 * thus the root bridge's pci_dev does not exist).
+-	 */
+-	root->bus = pci_acpi_scan_root(root);
+-	if (!root->bus) {
+-		dev_err(&device->dev,
+-			"Bus %04x:%02x not present in PCI namespace\n",
+-			root->segment, (unsigned int)root->secondary.start);
+-		result = -ENODEV;
+-		goto end;
+-	}
+-
+-	/* Indicate support for various _OSC capabilities. */
+ 	if (pci_ext_cfg_avail())
+ 		flags |= OSC_EXT_PCI_CONFIG_SUPPORT;
+ 	if (pcie_aspm_support_enabled()) {
+@@ -471,7 +451,7 @@ static int acpi_pci_root_add(struct acpi_device *device,
+ 		if (ACPI_FAILURE(status)) {
+ 			dev_info(&device->dev, "ACPI _OSC support "
+ 				"notification failed, disabling PCIe ASPM\n");
+-			pcie_no_aspm();
++			no_aspm = true;
+ 			flags = base_flags;
+ 		}
+ 	}
+@@ -503,7 +483,7 @@ static int acpi_pci_root_add(struct acpi_device *device,
+ 				 * We have ASPM control, but the FADT indicates
+ 				 * that it's unsupported. Clear it.
+ 				 */
+-				pcie_clear_aspm(root->bus);
++				clear_aspm = true;
+ 			}
+ 		} else {
+ 			dev_info(&device->dev,
+@@ -512,7 +492,14 @@ static int acpi_pci_root_add(struct acpi_device *device,
+ 				acpi_format_exception(status), flags);
+ 			dev_info(&device->dev,
+ 				 "ACPI _OSC control for PCIe not granted, disabling ASPM\n");
+-			pcie_no_aspm();
++			/*
++			 * We want to disable ASPM here, but aspm_disabled
++			 * needs to remain in its state from boot so that we
++			 * properly handle PCIe 1.1 devices.  So we set this
++			 * flag here, to defer the action until after the ACPI
++			 * root scan.
++			 */
++			no_aspm = true;
+ 		}
+ 	} else {
+ 		dev_info(&device->dev,
+@@ -520,6 +507,33 @@ static int acpi_pci_root_add(struct acpi_device *device,
+ 			 "(_OSC support mask: 0x%02x)\n", flags);
+ 	}
+ 
++	/*
++	 * TBD: Need PCI interface for enumeration/configuration of roots.
++	 */
++
++	/*
++	 * Scan the Root Bridge
++	 * --------------------
++	 * Must do this prior to any attempt to bind the root device, as the
++	 * PCI namespace does not get created until this call is made (and
++	 * thus the root bridge's pci_dev does not exist).
++	 */
++	root->bus = pci_acpi_scan_root(root);
++	if (!root->bus) {
++		dev_err(&device->dev,
++			"Bus %04x:%02x not present in PCI namespace\n",
++			root->segment, (unsigned int)root->secondary.start);
++		result = -ENODEV;
++		goto end;
++	}
++
++	if (clear_aspm) {
++		dev_info(&device->dev, "Disabling ASPM (FADT indicates it is unsupported)\n");
++		pcie_clear_aspm(root->bus);
++	}
++	if (no_aspm)
++		pcie_no_aspm();
++
+ 	pci_acpi_add_bus_pm_notifier(device, root->bus);
+ 	if (device->wakeup.flags.run_wake)
+ 		device_set_run_wake(root->bus->bridge, true);
+diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
+index a439602e..c8dac745 100644
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -868,8 +868,15 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,
+ 		goto err_del_dev;
+ 	}
+ 
++	mutex_lock(&fw_lock);
++	list_add(&buf->pending_list, &pending_fw_head);
++	mutex_unlock(&fw_lock);
++
+ 	retval = device_create_file(f_dev, &dev_attr_loading);
+ 	if (retval) {
++		mutex_lock(&fw_lock);
++		list_del_init(&buf->pending_list);
++		mutex_unlock(&fw_lock);
+ 		dev_err(f_dev, "%s: device_create_file failed\n", __func__);
+ 		goto err_del_bin_attr;
+ 	}
+@@ -884,10 +891,6 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,
+ 		kobject_uevent(&fw_priv->dev.kobj, KOBJ_ADD);
+ 	}
+ 
+-	mutex_lock(&fw_lock);
+-	list_add(&buf->pending_list, &pending_fw_head);
+-	mutex_unlock(&fw_lock);
+-
+ 	wait_for_completion(&buf->completion);
+ 
+ 	cancel_delayed_work_sync(&fw_priv->timeout_work);
+diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
+index 53495753..6c2652a8 100644
+--- a/drivers/base/regmap/regmap-debugfs.c
++++ b/drivers/base/regmap/regmap-debugfs.c
+@@ -85,8 +85,8 @@ static unsigned int regmap_debugfs_get_dump_start(struct regmap *map,
+ 	unsigned int reg_offset;
+ 
+ 	/* Suppress the cache if we're using a subrange */
+-	if (from)
+-		return from;
++	if (base)
++		return base;
+ 
+ 	/*
+ 	 * If we don't have a cache build one so we don't have to do a
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 4ad2ad9a..45aa20aa 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -1557,11 +1557,12 @@ rbd_img_obj_request_read_callback(struct rbd_obj_request *obj_request)
+ 		obj_request, obj_request->img_request, obj_request->result,
+ 		xferred, length);
+ 	/*
+-	 * ENOENT means a hole in the image.  We zero-fill the
+-	 * entire length of the request.  A short read also implies
+-	 * zero-fill to the end of the request.  Either way we
+-	 * update the xferred count to indicate the whole request
+-	 * was satisfied.
++	 * ENOENT means a hole in the image.  We zero-fill the entire
++	 * length of the request.  A short read also implies zero-fill
++	 * to the end of the request.  An error requires the whole
++	 * length of the request to be reported finished with an error
++	 * to the block layer.  In each case we update the xferred
++	 * count to indicate the whole request was satisfied.
+ 	 */
+ 	rbd_assert(obj_request->type != OBJ_REQUEST_NODATA);
+ 	if (obj_request->result == -ENOENT) {
+@@ -1570,14 +1571,13 @@ rbd_img_obj_request_read_callback(struct rbd_obj_request *obj_request)
+ 		else
+ 			zero_pages(obj_request->pages, 0, length);
+ 		obj_request->result = 0;
+-		obj_request->xferred = length;
+ 	} else if (xferred < length && !obj_request->result) {
+ 		if (obj_request->type == OBJ_REQUEST_BIO)
+ 			zero_bio_chain(obj_request->bio_list, xferred);
+ 		else
+ 			zero_pages(obj_request->pages, xferred, length);
+-		obj_request->xferred = length;
+ 	}
++	obj_request->xferred = length;
+ 	obj_request_done_set(obj_request);
+ }
+ 
+diff --git a/drivers/clk/clk-wm831x.c b/drivers/clk/clk-wm831x.c
+index 1b3f8c9b..1d5af3f7 100644
+--- a/drivers/clk/clk-wm831x.c
++++ b/drivers/clk/clk-wm831x.c
+@@ -360,6 +360,8 @@ static int wm831x_clk_probe(struct platform_device *pdev)
+ 	if (!clkdata)
+ 		return -ENOMEM;
+ 
++	clkdata->wm831x = wm831x;
++
+ 	/* XTAL_ENA can only be set via OTP/InstantConfig so just read once */
+ 	ret = wm831x_reg_read(wm831x, WM831X_CLOCK_CONTROL_2);
+ 	if (ret < 0) {
+diff --git a/drivers/cpuidle/coupled.c b/drivers/cpuidle/coupled.c
+index 2a297f86..fe853903 100644
+--- a/drivers/cpuidle/coupled.c
++++ b/drivers/cpuidle/coupled.c
+@@ -106,6 +106,7 @@ struct cpuidle_coupled {
+ 	cpumask_t coupled_cpus;
+ 	int requested_state[NR_CPUS];
+ 	atomic_t ready_waiting_counts;
++	atomic_t abort_barrier;
+ 	int online_count;
+ 	int refcnt;
+ 	int prevent;
+@@ -122,12 +123,19 @@ static DEFINE_MUTEX(cpuidle_coupled_lock);
+ static DEFINE_PER_CPU(struct call_single_data, cpuidle_coupled_poke_cb);
+ 
+ /*
+- * The cpuidle_coupled_poked_mask mask is used to avoid calling
++ * The cpuidle_coupled_poke_pending mask is used to avoid calling
+  * __smp_call_function_single with the per cpu call_single_data struct already
+  * in use.  This prevents a deadlock where two cpus are waiting for each others
+  * call_single_data struct to be available
+  */
+-static cpumask_t cpuidle_coupled_poked_mask;
++static cpumask_t cpuidle_coupled_poke_pending;
++
++/*
++ * The cpuidle_coupled_poked mask is used to ensure that each cpu has been poked
++ * once to minimize entering the ready loop with a poke pending, which would
++ * require aborting and retrying.
++ */
++static cpumask_t cpuidle_coupled_poked;
+ 
+ /**
+  * cpuidle_coupled_parallel_barrier - synchronize all online coupled cpus
+@@ -291,10 +299,11 @@ static inline int cpuidle_coupled_get_state(struct cpuidle_device *dev,
+ 	return state;
+ }
+ 
+-static void cpuidle_coupled_poked(void *info)
++static void cpuidle_coupled_handle_poke(void *info)
+ {
+ 	int cpu = (unsigned long)info;
+-	cpumask_clear_cpu(cpu, &cpuidle_coupled_poked_mask);
++	cpumask_set_cpu(cpu, &cpuidle_coupled_poked);
++	cpumask_clear_cpu(cpu, &cpuidle_coupled_poke_pending);
+ }
+ 
+ /**
+@@ -313,7 +322,7 @@ static void cpuidle_coupled_poke(int cpu)
+ {
+ 	struct call_single_data *csd = &per_cpu(cpuidle_coupled_poke_cb, cpu);
+ 
+-	if (!cpumask_test_and_set_cpu(cpu, &cpuidle_coupled_poked_mask))
++	if (!cpumask_test_and_set_cpu(cpu, &cpuidle_coupled_poke_pending))
+ 		__smp_call_function_single(cpu, csd, 0);
+ }
+ 
+@@ -340,30 +349,19 @@ static void cpuidle_coupled_poke_others(int this_cpu,
+  * @coupled: the struct coupled that contains the current cpu
+  * @next_state: the index in drv->states of the requested state for this cpu
+  *
+- * Updates the requested idle state for the specified cpuidle device,
+- * poking all coupled cpus out of idle if necessary to let them see the new
+- * state.
++ * Updates the requested idle state for the specified cpuidle device.
++ * Returns the number of waiting cpus.
+  */
+-static void cpuidle_coupled_set_waiting(int cpu,
++static int cpuidle_coupled_set_waiting(int cpu,
+ 		struct cpuidle_coupled *coupled, int next_state)
+ {
+-	int w;
+-
+ 	coupled->requested_state[cpu] = next_state;
+ 
+ 	/*
+-	 * If this is the last cpu to enter the waiting state, poke
+-	 * all the other cpus out of their waiting state so they can
+-	 * enter a deeper state.  This can race with one of the cpus
+-	 * exiting the waiting state due to an interrupt and
+-	 * decrementing waiting_count, see comment below.
+-	 *
+ 	 * The atomic_inc_return provides a write barrier to order the write
+ 	 * to requested_state with the later write that increments ready_count.
+ 	 */
+-	w = atomic_inc_return(&coupled->ready_waiting_counts) & WAITING_MASK;
+-	if (w == coupled->online_count)
+-		cpuidle_coupled_poke_others(cpu, coupled);
++	return atomic_inc_return(&coupled->ready_waiting_counts) & WAITING_MASK;
+ }
+ 
+ /**
+@@ -410,19 +408,33 @@ static void cpuidle_coupled_set_done(int cpu, struct cpuidle_coupled *coupled)
+  * been processed and the poke bit has been cleared.
+  *
+  * Other interrupts may also be processed while interrupts are enabled, so
+- * need_resched() must be tested after turning interrupts off again to make sure
++ * need_resched() must be tested after this function returns to make sure
+  * the interrupt didn't schedule work that should take the cpu out of idle.
+  *
+- * Returns 0 if need_resched was false, -EINTR if need_resched was true.
++ * Returns 0 if no poke was pending, 1 if a poke was cleared.
+  */
+ static int cpuidle_coupled_clear_pokes(int cpu)
+ {
++	if (!cpumask_test_cpu(cpu, &cpuidle_coupled_poke_pending))
++		return 0;
++
+ 	local_irq_enable();
+-	while (cpumask_test_cpu(cpu, &cpuidle_coupled_poked_mask))
++	while (cpumask_test_cpu(cpu, &cpuidle_coupled_poke_pending))
+ 		cpu_relax();
+ 	local_irq_disable();
+ 
+-	return need_resched() ? -EINTR : 0;
++	return 1;
++}
++
++static bool cpuidle_coupled_any_pokes_pending(struct cpuidle_coupled *coupled)
++{
++	cpumask_t cpus;
++	int ret;
++
++	cpumask_and(&cpus, cpu_online_mask, &coupled->coupled_cpus);
++	ret = cpumask_and(&cpus, &cpuidle_coupled_poke_pending, &cpus);
++
++	return ret;
+ }
+ 
+ /**
+@@ -449,12 +461,14 @@ int cpuidle_enter_state_coupled(struct cpuidle_device *dev,
+ {
+ 	int entered_state = -1;
+ 	struct cpuidle_coupled *coupled = dev->coupled;
++	int w;
+ 
+ 	if (!coupled)
+ 		return -EINVAL;
+ 
+ 	while (coupled->prevent) {
+-		if (cpuidle_coupled_clear_pokes(dev->cpu)) {
++		cpuidle_coupled_clear_pokes(dev->cpu);
++		if (need_resched()) {
+ 			local_irq_enable();
+ 			return entered_state;
+ 		}
+@@ -465,15 +479,37 @@ int cpuidle_enter_state_coupled(struct cpuidle_device *dev,
+ 	/* Read barrier ensures online_count is read after prevent is cleared */
+ 	smp_rmb();
+ 
+-	cpuidle_coupled_set_waiting(dev->cpu, coupled, next_state);
++reset:
++	cpumask_clear_cpu(dev->cpu, &cpuidle_coupled_poked);
++
++	w = cpuidle_coupled_set_waiting(dev->cpu, coupled, next_state);
++	/*
++	 * If this is the last cpu to enter the waiting state, poke
++	 * all the other cpus out of their waiting state so they can
++	 * enter a deeper state.  This can race with one of the cpus
++	 * exiting the waiting state due to an interrupt and
++	 * decrementing waiting_count, see comment below.
++	 */
++	if (w == coupled->online_count) {
++		cpumask_set_cpu(dev->cpu, &cpuidle_coupled_poked);
++		cpuidle_coupled_poke_others(dev->cpu, coupled);
++	}
+ 
+ retry:
+ 	/*
+ 	 * Wait for all coupled cpus to be idle, using the deepest state
+-	 * allowed for a single cpu.
++	 * allowed for a single cpu.  If this was not the poking cpu, wait
++	 * for at least one poke before leaving to avoid a race where
++	 * two cpus could arrive at the waiting loop at the same time,
++	 * but the first of the two to arrive could skip the loop without
++	 * processing the pokes from the last to arrive.
+ 	 */
+-	while (!cpuidle_coupled_cpus_waiting(coupled)) {
+-		if (cpuidle_coupled_clear_pokes(dev->cpu)) {
++	while (!cpuidle_coupled_cpus_waiting(coupled) ||
++			!cpumask_test_cpu(dev->cpu, &cpuidle_coupled_poked)) {
++		if (cpuidle_coupled_clear_pokes(dev->cpu))
++			continue;
++
++		if (need_resched()) {
+ 			cpuidle_coupled_set_not_waiting(dev->cpu, coupled);
+ 			goto out;
+ 		}
+@@ -487,12 +523,19 @@ retry:
+ 			dev->safe_state_index);
+ 	}
+ 
+-	if (cpuidle_coupled_clear_pokes(dev->cpu)) {
++	cpuidle_coupled_clear_pokes(dev->cpu);
++	if (need_resched()) {
+ 		cpuidle_coupled_set_not_waiting(dev->cpu, coupled);
+ 		goto out;
+ 	}
+ 
+ 	/*
++	 * Make sure final poke status for this cpu is visible before setting
++	 * cpu as ready.
++	 */
++	smp_wmb();
++
++	/*
+ 	 * All coupled cpus are probably idle.  There is a small chance that
+ 	 * one of the other cpus just became active.  Increment the ready count,
+ 	 * and spin until all coupled cpus have incremented the counter. Once a
+@@ -511,6 +554,28 @@ retry:
+ 		cpu_relax();
+ 	}
+ 
++	/*
++	 * Make sure read of all cpus ready is done before reading pending pokes
++	 */
++	smp_rmb();
++
++	/*
++	 * There is a small chance that a cpu left and reentered idle after this
++	 * cpu saw that all cpus were waiting.  The cpu that reentered idle will
++	 * have sent this cpu a poke, which will still be pending after the
++	 * ready loop.  The pending interrupt may be lost by the interrupt
++	 * controller when entering the deep idle state.  It's not possible to
++	 * clear a pending interrupt without turning interrupts on and handling
++	 * it, and it's too late to turn on interrupts here, so reset the
++	 * coupled idle state of all cpus and retry.
++	 */
++	if (cpuidle_coupled_any_pokes_pending(coupled)) {
++		cpuidle_coupled_set_done(dev->cpu, coupled);
++		/* Wait for all cpus to see the pending pokes */
++		cpuidle_coupled_parallel_barrier(dev, &coupled->abort_barrier);
++		goto reset;
++	}
++
+ 	/* all cpus have acked the coupled state */
+ 	next_state = cpuidle_coupled_get_state(dev, coupled);
+ 
+@@ -596,7 +661,7 @@ have_coupled:
+ 	coupled->refcnt++;
+ 
+ 	csd = &per_cpu(cpuidle_coupled_poke_cb, dev->cpu);
+-	csd->func = cpuidle_coupled_poked;
++	csd->func = cpuidle_coupled_handle_poke;
+ 	csd->info = (void *)(unsigned long)dev->cpu;
+ 
+ 	return 0;
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index 8b6a0343..8b3d9014 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -2470,8 +2470,15 @@ static int amd64_init_one_instance(struct pci_dev *F2)
+ 	layers[0].size = pvt->csels[0].b_cnt;
+ 	layers[0].is_virt_csrow = true;
+ 	layers[1].type = EDAC_MC_LAYER_CHANNEL;
+-	layers[1].size = pvt->channel_count;
++
++	/*
++	 * Always allocate two channels since we can have setups with DIMMs on
++	 * only one channel. Also, this simplifies handling later for the price
++	 * of a couple of KBs tops.
++	 */
++	layers[1].size = 2;
+ 	layers[1].is_virt_csrow = false;
++
+ 	mci = edac_mc_alloc(nid, ARRAY_SIZE(layers), layers, 0);
+ 	if (!mci)
+ 		goto err_siblings;
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 95d6f4b6..70fc1335 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -125,6 +125,9 @@ static struct edid_quirk {
+ 
+ 	/* ViewSonic VA2026w */
+ 	{ "VSC", 5020, EDID_QUIRK_FORCE_REDUCED_BLANKING },
++
++	/* Medion MD 30217 PG */
++	{ "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
+ };
+ 
+ /*
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index be79f477..ca40d1b1 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -7809,6 +7809,19 @@ intel_modeset_pipe_config(struct drm_crtc *crtc,
+ 	pipe_config->cpu_transcoder = to_intel_crtc(crtc)->pipe;
+ 	pipe_config->shared_dpll = DPLL_ID_PRIVATE;
+ 
++	/*
++	 * Sanitize sync polarity flags based on requested ones. If neither
++	 * positive or negative polarity is requested, treat this as meaning
++	 * negative polarity.
++	 */
++	if (!(pipe_config->adjusted_mode.flags &
++	      (DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_NHSYNC)))
++		pipe_config->adjusted_mode.flags |= DRM_MODE_FLAG_NHSYNC;
++
++	if (!(pipe_config->adjusted_mode.flags &
++	      (DRM_MODE_FLAG_PVSYNC | DRM_MODE_FLAG_NVSYNC)))
++		pipe_config->adjusted_mode.flags |= DRM_MODE_FLAG_NVSYNC;
++
+ 	/* Compute a starting value for pipe_config->pipe_bpp taking the source
+ 	 * plane pixel format and any sink constraints into account. Returns the
+ 	 * source plane bpp so that dithering can be selected on mismatches
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 36668d1a..5956445d 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -63,6 +63,8 @@ struct hid_report *hid_register_report(struct hid_device *device, unsigned type,
+ 	struct hid_report_enum *report_enum = device->report_enum + type;
+ 	struct hid_report *report;
+ 
++	if (id >= HID_MAX_IDS)
++		return NULL;
+ 	if (report_enum->report_id_hash[id])
+ 		return report_enum->report_id_hash[id];
+ 
+@@ -404,8 +406,10 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
+ 
+ 	case HID_GLOBAL_ITEM_TAG_REPORT_ID:
+ 		parser->global.report_id = item_udata(item);
+-		if (parser->global.report_id == 0) {
+-			hid_err(parser->device, "report_id 0 is invalid\n");
++		if (parser->global.report_id == 0 ||
++		    parser->global.report_id >= HID_MAX_IDS) {
++			hid_err(parser->device, "report_id %u is invalid\n",
++				parser->global.report_id);
+ 			return -1;
+ 		}
+ 		return 0;
+@@ -575,7 +579,7 @@ static void hid_close_report(struct hid_device *device)
+ 	for (i = 0; i < HID_REPORT_TYPES; i++) {
+ 		struct hid_report_enum *report_enum = device->report_enum + i;
+ 
+-		for (j = 0; j < 256; j++) {
++		for (j = 0; j < HID_MAX_IDS; j++) {
+ 			struct hid_report *report = report_enum->report_id_hash[j];
+ 			if (report)
+ 				hid_free_report(report);
+@@ -1152,7 +1156,12 @@ EXPORT_SYMBOL_GPL(hid_output_report);
+ 
+ int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
+ {
+-	unsigned size = field->report_size;
++	unsigned size;
++
++	if (!field)
++		return -1;
++
++	size = field->report_size;
+ 
+ 	hid_dump_input(field->report->device, field->usage + offset, value);
+ 
+@@ -1597,6 +1606,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_KEYTOUCH, USB_DEVICE_ID_KEYTOUCH_IEC) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_I405X) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index ffe4c7ae..22134d4b 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -135,9 +135,9 @@
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS   0x023b
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI  0x0255
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO   0x0256
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI	0x0291
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO	0x0292
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS	0x0293
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI	0x0290
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO	0x0291
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS	0x0292
+ #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY	0x030a
+ #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY	0x030b
+ #define USB_DEVICE_ID_APPLE_IRCONTROL	0x8240
+@@ -482,6 +482,7 @@
+ #define USB_VENDOR_ID_KYE		0x0458
+ #define USB_DEVICE_ID_KYE_ERGO_525V	0x0087
+ #define USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE	0x0138
++#define USB_DEVICE_ID_GENIUS_GX_IMPERATOR	0x4018
+ #define USB_DEVICE_ID_KYE_GPEN_560	0x5003
+ #define USB_DEVICE_ID_KYE_EASYPEN_I405X	0x5010
+ #define USB_DEVICE_ID_KYE_MOUSEPEN_I608X	0x5011
+@@ -658,6 +659,7 @@
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16   0x0012
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17   0x0013
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18   0x0014
++#define USB_DEVICE_ID_NTRIG_DUOSENSE 0x1500
+ 
+ #define USB_VENDOR_ID_ONTRAK		0x0a07
+ #define USB_DEVICE_ID_ONTRAK_ADU100	0x0064
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 7480799e..3fc4034a 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -340,7 +340,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ {
+ 	struct hid_device *dev = container_of(psy, struct hid_device, battery);
+ 	int ret = 0;
+-	__u8 buf[2] = {};
++	__u8 *buf;
+ 
+ 	switch (prop) {
+ 	case POWER_SUPPLY_PROP_PRESENT:
+@@ -349,12 +349,19 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ 		break;
+ 
+ 	case POWER_SUPPLY_PROP_CAPACITY:
++
++		buf = kmalloc(2 * sizeof(__u8), GFP_KERNEL);
++		if (!buf) {
++			ret = -ENOMEM;
++			break;
++		}
+ 		ret = dev->hid_get_raw_report(dev, dev->battery_report_id,
+-					      buf, sizeof(buf),
++					      buf, 2,
+ 					      dev->battery_report_type);
+ 
+ 		if (ret != 2) {
+ 			ret = -ENODATA;
++			kfree(buf);
+ 			break;
+ 		}
+ 		ret = 0;
+@@ -364,6 +371,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ 		    buf[1] <= dev->battery_max)
+ 			val->intval = (100 * (buf[1] - dev->battery_min)) /
+ 				(dev->battery_max - dev->battery_min);
++		kfree(buf);
+ 		break;
+ 
+ 	case POWER_SUPPLY_PROP_MODEL_NAME:
+diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
+index 1e2ee2aa..73845120 100644
+--- a/drivers/hid/hid-kye.c
++++ b/drivers/hid/hid-kye.c
+@@ -268,6 +268,26 @@ static __u8 easypen_m610x_rdesc_fixed[] = {
+ 	0xC0                          /*  End Collection                  */
+ };
+ 
++static __u8 *kye_consumer_control_fixup(struct hid_device *hdev, __u8 *rdesc,
++		unsigned int *rsize, int offset, const char *device_name) {
++	/*
++	 * the fixup that need to be done:
++	 *   - change Usage Maximum in the Comsumer Control
++	 *     (report ID 3) to a reasonable value
++	 */
++	if (*rsize >= offset + 31 &&
++	    /* Usage Page (Consumer Devices) */
++	    rdesc[offset] == 0x05 && rdesc[offset + 1] == 0x0c &&
++	    /* Usage (Consumer Control) */
++	    rdesc[offset + 2] == 0x09 && rdesc[offset + 3] == 0x01 &&
++	    /*   Usage Maximum > 12287 */
++	    rdesc[offset + 10] == 0x2a && rdesc[offset + 12] > 0x2f) {
++		hid_info(hdev, "fixing up %s report descriptor\n", device_name);
++		rdesc[offset + 12] = 0x2f;
++	}
++	return rdesc;
++}
++
+ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 		unsigned int *rsize)
+ {
+@@ -315,23 +335,12 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 		}
+ 		break;
+ 	case USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE:
+-		/*
+-		 * the fixup that need to be done:
+-		 *   - change Usage Maximum in the Comsumer Control
+-		 *     (report ID 3) to a reasonable value
+-		 */
+-		if (*rsize >= 135 &&
+-			/* Usage Page (Consumer Devices) */
+-			rdesc[104] == 0x05 && rdesc[105] == 0x0c &&
+-			/* Usage (Consumer Control) */
+-			rdesc[106] == 0x09 && rdesc[107] == 0x01 &&
+-			/*   Usage Maximum > 12287 */
+-			rdesc[114] == 0x2a && rdesc[116] > 0x2f) {
+-			hid_info(hdev,
+-				 "fixing up Genius Gila Gaming Mouse "
+-				 "report descriptor\n");
+-			rdesc[116] = 0x2f;
+-		}
++		rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 104,
++					"Genius Gila Gaming Mouse");
++		break;
++	case USB_DEVICE_ID_GENIUS_GX_IMPERATOR:
++		rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 83,
++					"Genius Gx Imperator Keyboard");
+ 		break;
+ 	}
+ 	return rdesc;
+@@ -428,6 +437,8 @@ static const struct hid_device_id kye_devices[] = {
+ 				USB_DEVICE_ID_KYE_EASYPEN_M610X) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+ 				USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE,
++				USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(hid, kye_devices);
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index ef951025..5482156a 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev)
+ 	struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT].
+ 				    report_id_hash[0x0d];
+ 
+-	if (!report)
++	if (!report || report->maxfield < 1 ||
++	    report->field[0]->report_count < 1)
+ 		return -EINVAL;
+ 
+ 	hid_hw_request(hdev, report, HID_REQ_GET_REPORT);
+diff --git a/drivers/hid/hid-picolcd_cir.c b/drivers/hid/hid-picolcd_cir.c
+index e346038f..59d5eb1e 100644
+--- a/drivers/hid/hid-picolcd_cir.c
++++ b/drivers/hid/hid-picolcd_cir.c
+@@ -145,6 +145,7 @@ void picolcd_exit_cir(struct picolcd_data *data)
+ 	struct rc_dev *rdev = data->rc_dev;
+ 
+ 	data->rc_dev = NULL;
+-	rc_unregister_device(rdev);
++	if (rdev)
++		rc_unregister_device(rdev);
+ }
+ 
+diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
+index b48092d0..acbb0210 100644
+--- a/drivers/hid/hid-picolcd_core.c
++++ b/drivers/hid/hid-picolcd_core.c
+@@ -290,7 +290,7 @@ static ssize_t picolcd_operation_mode_store(struct device *dev,
+ 		buf += 10;
+ 		cnt -= 10;
+ 	}
+-	if (!report)
++	if (!report || report->maxfield != 1)
+ 		return -EINVAL;
+ 
+ 	while (cnt > 0 && (buf[cnt-1] == '\n' || buf[cnt-1] == '\r'))
+diff --git a/drivers/hid/hid-picolcd_fb.c b/drivers/hid/hid-picolcd_fb.c
+index 591f6b22..c930ab85 100644
+--- a/drivers/hid/hid-picolcd_fb.c
++++ b/drivers/hid/hid-picolcd_fb.c
+@@ -593,10 +593,14 @@ err_nomem:
+ void picolcd_exit_framebuffer(struct picolcd_data *data)
+ {
+ 	struct fb_info *info = data->fb_info;
+-	struct picolcd_fb_data *fbdata = info->par;
++	struct picolcd_fb_data *fbdata;
+ 	unsigned long flags;
+ 
++	if (!info)
++		return;
++
+ 	device_remove_file(&data->hdev->dev, &dev_attr_fb_update_rate);
++	fbdata = info->par;
+ 
+ 	/* disconnect framebuffer from HID dev */
+ 	spin_lock_irqsave(&fbdata->lock, flags);
+diff --git a/drivers/hid/hid-pl.c b/drivers/hid/hid-pl.c
+index d29112fa..2dcd7d98 100644
+--- a/drivers/hid/hid-pl.c
++++ b/drivers/hid/hid-pl.c
+@@ -132,8 +132,14 @@ static int plff_init(struct hid_device *hid)
+ 			strong = &report->field[0]->value[2];
+ 			weak = &report->field[0]->value[3];
+ 			debug("detected single-field device");
+-		} else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 &&
+-				report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) {
++		} else if (report->field[0]->maxusage == 1 &&
++			   report->field[0]->usage[0].hid ==
++				(HID_UP_LED | 0x43) &&
++			   report->maxfield >= 4 &&
++			   report->field[0]->report_count >= 1 &&
++			   report->field[1]->report_count >= 1 &&
++			   report->field[2]->report_count >= 1 &&
++			   report->field[3]->report_count >= 1) {
+ 			report->field[0]->value[0] = 0x00;
+ 			report->field[1]->value[0] = 0x00;
+ 			strong = &report->field[2]->value[0];
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index ca749810..aa34755c 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -221,7 +221,8 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
+ 
+ 	mutex_lock(&data->mutex);
+ 	report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
+-	if (!report || (field_index >=  report->maxfield)) {
++	if (!report || (field_index >=  report->maxfield) ||
++	    report->field[field_index]->report_count < 1) {
+ 		ret = -EINVAL;
+ 		goto done_proc;
+ 	}
+diff --git a/drivers/hid/hid-speedlink.c b/drivers/hid/hid-speedlink.c
+index a2f587d0..7112f3e8 100644
+--- a/drivers/hid/hid-speedlink.c
++++ b/drivers/hid/hid-speedlink.c
+@@ -3,7 +3,7 @@
+  *  Fixes "jumpy" cursor and removes nonexistent keyboard LEDS from
+  *  the HID descriptor.
+  *
+- *  Copyright (c) 2011 Stefan Kriwanek <mail@××××××××××××××.de>
++ *  Copyright (c) 2011, 2013 Stefan Kriwanek <dev@××××××××××××××.de>
+  */
+ 
+ /*
+@@ -46,8 +46,13 @@ static int speedlink_event(struct hid_device *hdev, struct hid_field *field,
+ 		struct hid_usage *usage, __s32 value)
+ {
+ 	/* No other conditions due to usage_table. */
+-	/* Fix "jumpy" cursor (invalid events sent by device). */
+-	if (value == 256)
++
++	/* This fixes the "jumpy" cursor occuring due to invalid events sent
++	 * by the device. Some devices only send them with value==+256, others
++	 * don't. However, catching abs(value)>=256 is restrictive enough not
++	 * to interfere with devices that were bug-free (has been tested).
++	 */
++	if (abs(value) >= 256)
+ 		return 1;
+ 	/* Drop useless distance 0 events (on button clicks etc.) as well */
+ 	if (value == 0)
+diff --git a/drivers/hid/hid-wiimote-core.c b/drivers/hid/hid-wiimote-core.c
+index 0c06054c..66020982 100644
+--- a/drivers/hid/hid-wiimote-core.c
++++ b/drivers/hid/hid-wiimote-core.c
+@@ -212,10 +212,12 @@ static __u8 select_drm(struct wiimote_data *wdata)
+ 
+ 	if (ir == WIIPROTO_FLAG_IR_BASIC) {
+ 		if (wdata->state.flags & WIIPROTO_FLAG_ACCEL) {
+-			if (ext)
+-				return WIIPROTO_REQ_DRM_KAIE;
+-			else
+-				return WIIPROTO_REQ_DRM_KAI;
++			/* GEN10 and ealier devices bind IR formats to DRMs.
++			 * Hence, we cannot use DRM_KAI here as it might be
++			 * bound to IR_EXT. Use DRM_KAIE unconditionally so we
++			 * work with all devices and our parsers can use the
++			 * fixed formats, too. */
++			return WIIPROTO_REQ_DRM_KAIE;
+ 		} else {
+ 			return WIIPROTO_REQ_DRM_KIE;
+ 		}
+diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
+index 6f1feb2c..dbfe3007 100644
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -113,7 +113,7 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer,
+ 	__u8 *buf;
+ 	int ret = 0;
+ 
+-	if (!hidraw_table[minor]) {
++	if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
+ 		ret = -ENODEV;
+ 		goto out;
+ 	}
+@@ -261,7 +261,7 @@ static int hidraw_open(struct inode *inode, struct file *file)
+ 	}
+ 
+ 	mutex_lock(&minors_lock);
+-	if (!hidraw_table[minor]) {
++	if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
+ 		err = -ENODEV;
+ 		goto out_unlock;
+ 	}
+@@ -302,39 +302,38 @@ static int hidraw_fasync(int fd, struct file *file, int on)
+ 	return fasync_helper(fd, file, on, &list->fasync);
+ }
+ 
++static void drop_ref(struct hidraw *hidraw, int exists_bit)
++{
++	if (exists_bit) {
++		hid_hw_close(hidraw->hid);
++		hidraw->exist = 0;
++		if (hidraw->open)
++			wake_up_interruptible(&hidraw->wait);
++	} else {
++		--hidraw->open;
++	}
++
++	if (!hidraw->open && !hidraw->exist) {
++		device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
++		hidraw_table[hidraw->minor] = NULL;
++		kfree(hidraw);
++	}
++}
++
+ static int hidraw_release(struct inode * inode, struct file * file)
+ {
+ 	unsigned int minor = iminor(inode);
+-	struct hidraw *dev;
+ 	struct hidraw_list *list = file->private_data;
+-	int ret;
+-	int i;
+ 
+ 	mutex_lock(&minors_lock);
+-	if (!hidraw_table[minor]) {
+-		ret = -ENODEV;
+-		goto unlock;
+-	}
+ 
+ 	list_del(&list->node);
+-	dev = hidraw_table[minor];
+-	if (!--dev->open) {
+-		if (list->hidraw->exist) {
+-			hid_hw_power(dev->hid, PM_HINT_NORMAL);
+-			hid_hw_close(dev->hid);
+-		} else {
+-			kfree(list->hidraw);
+-		}
+-	}
+-
+-	for (i = 0; i < HIDRAW_BUFFER_SIZE; ++i)
+-		kfree(list->buffer[i].value);
+ 	kfree(list);
+-	ret = 0;
+-unlock:
+-	mutex_unlock(&minors_lock);
+ 
+-	return ret;
++	drop_ref(hidraw_table[minor], 0);
++
++	mutex_unlock(&minors_lock);
++	return 0;
+ }
+ 
+ static long hidraw_ioctl(struct file *file, unsigned int cmd,
+@@ -539,18 +538,9 @@ void hidraw_disconnect(struct hid_device *hid)
+ 	struct hidraw *hidraw = hid->hidraw;
+ 
+ 	mutex_lock(&minors_lock);
+-	hidraw->exist = 0;
+-
+-	device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
+ 
+-	hidraw_table[hidraw->minor] = NULL;
++	drop_ref(hidraw, 1);
+ 
+-	if (hidraw->open) {
+-		hid_hw_close(hid);
+-		wake_up_interruptible(&hidraw->wait);
+-	} else {
+-		kfree(hidraw);
+-	}
+ 	mutex_unlock(&minors_lock);
+ }
+ EXPORT_SYMBOL_GPL(hidraw_disconnect);
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 19b8360f..07345521 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -109,6 +109,8 @@ static const struct hid_blacklist {
+ 	{ USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
+ 	{ USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
+ 	{ USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
++	{ USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
++
+ 	{ 0, 0 }
+ };
+ 
+diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
+index 4ef4d5e1..a73f9618 100644
+--- a/drivers/input/mouse/bcm5974.c
++++ b/drivers/input/mouse/bcm5974.c
+@@ -89,9 +89,9 @@
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO	0x025a
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS	0x025b
+ /* MacbookAir6,2 (unibody, June 2013) */
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI	0x0291
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO	0x0292
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS	0x0293
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI	0x0290
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO	0x0291
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS	0x0292
+ 
+ #define BCM5974_DEVICE(prod) {					\
+ 	.match_flags = (USB_DEVICE_ID_MATCH_DEVICE |		\
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index eec0d3e0..15e9b57e 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -890,56 +890,54 @@ static int dma_pte_clear_range(struct dmar_domain *domain,
+ 	return order;
+ }
+ 
++static void dma_pte_free_level(struct dmar_domain *domain, int level,
++			       struct dma_pte *pte, unsigned long pfn,
++			       unsigned long start_pfn, unsigned long last_pfn)
++{
++	pfn = max(start_pfn, pfn);
++	pte = &pte[pfn_level_offset(pfn, level)];
++
++	do {
++		unsigned long level_pfn;
++		struct dma_pte *level_pte;
++
++		if (!dma_pte_present(pte) || dma_pte_superpage(pte))
++			goto next;
++
++		level_pfn = pfn & level_mask(level - 1);
++		level_pte = phys_to_virt(dma_pte_addr(pte));
++
++		if (level > 2)
++			dma_pte_free_level(domain, level - 1, level_pte,
++					   level_pfn, start_pfn, last_pfn);
++
++		/* If range covers entire pagetable, free it */
++		if (!(start_pfn > level_pfn ||
++		      last_pfn < level_pfn + level_size(level))) {
++			dma_clear_pte(pte);
++			domain_flush_cache(domain, pte, sizeof(*pte));
++			free_pgtable_page(level_pte);
++		}
++next:
++		pfn += level_size(level);
++	} while (!first_pte_in_page(++pte) && pfn <= last_pfn);
++}
++
+ /* free page table pages. last level pte should already be cleared */
+ static void dma_pte_free_pagetable(struct dmar_domain *domain,
+ 				   unsigned long start_pfn,
+ 				   unsigned long last_pfn)
+ {
+ 	int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
+-	struct dma_pte *first_pte, *pte;
+-	int total = agaw_to_level(domain->agaw);
+-	int level;
+-	unsigned long tmp;
+-	int large_page = 2;
+ 
+ 	BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
+ 	BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width);
+ 	BUG_ON(start_pfn > last_pfn);
+ 
+ 	/* We don't need lock here; nobody else touches the iova range */
+-	level = 2;
+-	while (level <= total) {
+-		tmp = align_to_level(start_pfn, level);
+-
+-		/* If we can't even clear one PTE at this level, we're done */
+-		if (tmp + level_size(level) - 1 > last_pfn)
+-			return;
+-
+-		do {
+-			large_page = level;
+-			first_pte = pte = dma_pfn_level_pte(domain, tmp, level, &large_page);
+-			if (large_page > level)
+-				level = large_page + 1;
+-			if (!pte) {
+-				tmp = align_to_level(tmp + 1, level + 1);
+-				continue;
+-			}
+-			do {
+-				if (dma_pte_present(pte)) {
+-					free_pgtable_page(phys_to_virt(dma_pte_addr(pte)));
+-					dma_clear_pte(pte);
+-				}
+-				pte++;
+-				tmp += level_size(level);
+-			} while (!first_pte_in_page(pte) &&
+-				 tmp + level_size(level) - 1 <= last_pfn);
++	dma_pte_free_level(domain, agaw_to_level(domain->agaw),
++			   domain->pgd, 0, start_pfn, last_pfn);
+ 
+-			domain_flush_cache(domain, first_pte,
+-					   (void *)pte - (void *)first_pte);
+-			
+-		} while (tmp && tmp + level_size(level) - 1 <= last_pfn);
+-		level++;
+-	}
+ 	/* free pgd */
+ 	if (start_pfn == 0 && last_pfn == DOMAIN_MAX_PFN(domain->gaw)) {
+ 		free_pgtable_page(domain->pgd);
+diff --git a/drivers/leds/leds-wm831x-status.c b/drivers/leds/leds-wm831x-status.c
+index 120815a4..5a19abde 100644
+--- a/drivers/leds/leds-wm831x-status.c
++++ b/drivers/leds/leds-wm831x-status.c
+@@ -230,9 +230,9 @@ static int wm831x_status_probe(struct platform_device *pdev)
+ 	int id = pdev->id % ARRAY_SIZE(chip_pdata->status);
+ 	int ret;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_IO, 0);
++	res = platform_get_resource(pdev, IORESOURCE_REG, 0);
+ 	if (res == NULL) {
+-		dev_err(&pdev->dev, "No I/O resource\n");
++		dev_err(&pdev->dev, "No register resource\n");
+ 		ret = -EINVAL;
+ 		goto err;
+ 	}
+diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c
+index 08626225..63676a8b 100644
+--- a/drivers/media/common/siano/smsdvb-main.c
++++ b/drivers/media/common/siano/smsdvb-main.c
+@@ -276,7 +276,8 @@ static void smsdvb_update_per_slices(struct smsdvb_client_t *client,
+ 
+ 	/* Legacy PER/BER */
+ 	tmp = p->ets_packets * 65535;
+-	do_div(tmp, p->ts_packets + p->ets_packets);
++	if (p->ts_packets + p->ets_packets)
++		do_div(tmp, p->ts_packets + p->ets_packets);
+ 	client->legacy_per = tmp;
+ }
+ 
+diff --git a/drivers/media/dvb-frontends/mb86a20s.c b/drivers/media/dvb-frontends/mb86a20s.c
+index 856374bd..2c7217fb 100644
+--- a/drivers/media/dvb-frontends/mb86a20s.c
++++ b/drivers/media/dvb-frontends/mb86a20s.c
+@@ -157,7 +157,6 @@ static struct regdata mb86a20s_init2[] = {
+ 	{ 0x45, 0x04 },				/* CN symbol 4 */
+ 	{ 0x48, 0x04 },				/* CN manual mode */
+ 
+-	{ 0x50, 0xd5 }, { 0x51, 0x01 },		/* Serial */
+ 	{ 0x50, 0xd6 }, { 0x51, 0x1f },
+ 	{ 0x50, 0xd2 }, { 0x51, 0x03 },
+ 	{ 0x50, 0xd7 }, { 0x51, 0xbf },
+@@ -1860,16 +1859,15 @@ static int mb86a20s_initfe(struct dvb_frontend *fe)
+ 	dev_dbg(&state->i2c->dev, "%s: IF=%d, IF reg=0x%06llx\n",
+ 		__func__, state->if_freq, (long long)pll);
+ 
+-	if (!state->config->is_serial) {
++	if (!state->config->is_serial)
+ 		regD5 &= ~1;
+ 
+-		rc = mb86a20s_writereg(state, 0x50, 0xd5);
+-		if (rc < 0)
+-			goto err;
+-		rc = mb86a20s_writereg(state, 0x51, regD5);
+-		if (rc < 0)
+-			goto err;
+-	}
++	rc = mb86a20s_writereg(state, 0x50, 0xd5);
++	if (rc < 0)
++		goto err;
++	rc = mb86a20s_writereg(state, 0x51, regD5);
++	if (rc < 0)
++		goto err;
+ 
+ 	rc = mb86a20s_writeregdata(state, mb86a20s_init2);
+ 	if (rc < 0)
+diff --git a/drivers/media/pci/cx88/cx88.h b/drivers/media/pci/cx88/cx88.h
+index afe0eaea..28893a6b 100644
+--- a/drivers/media/pci/cx88/cx88.h
++++ b/drivers/media/pci/cx88/cx88.h
+@@ -259,7 +259,7 @@ struct cx88_input {
+ };
+ 
+ enum cx88_audio_chip {
+-	CX88_AUDIO_WM8775,
++	CX88_AUDIO_WM8775 = 1,
+ 	CX88_AUDIO_TVAUDIO,
+ };
+ 
+diff --git a/drivers/media/platform/exynos-gsc/gsc-core.c b/drivers/media/platform/exynos-gsc/gsc-core.c
+index 559fab2a..1ec60264 100644
+--- a/drivers/media/platform/exynos-gsc/gsc-core.c
++++ b/drivers/media/platform/exynos-gsc/gsc-core.c
+@@ -1122,10 +1122,14 @@ static int gsc_probe(struct platform_device *pdev)
+ 		goto err_clk;
+ 	}
+ 
+-	ret = gsc_register_m2m_device(gsc);
++	ret = v4l2_device_register(dev, &gsc->v4l2_dev);
+ 	if (ret)
+ 		goto err_clk;
+ 
++	ret = gsc_register_m2m_device(gsc);
++	if (ret)
++		goto err_v4l2;
++
+ 	platform_set_drvdata(pdev, gsc);
+ 	pm_runtime_enable(dev);
+ 	ret = pm_runtime_get_sync(&pdev->dev);
+@@ -1147,6 +1151,8 @@ err_pm:
+ 	pm_runtime_put(dev);
+ err_m2m:
+ 	gsc_unregister_m2m_device(gsc);
++err_v4l2:
++	v4l2_device_unregister(&gsc->v4l2_dev);
+ err_clk:
+ 	gsc_clk_put(gsc);
+ 	return ret;
+@@ -1157,6 +1163,7 @@ static int gsc_remove(struct platform_device *pdev)
+ 	struct gsc_dev *gsc = platform_get_drvdata(pdev);
+ 
+ 	gsc_unregister_m2m_device(gsc);
++	v4l2_device_unregister(&gsc->v4l2_dev);
+ 
+ 	vb2_dma_contig_cleanup_ctx(gsc->alloc_ctx);
+ 	pm_runtime_disable(&pdev->dev);
+diff --git a/drivers/media/platform/exynos-gsc/gsc-core.h b/drivers/media/platform/exynos-gsc/gsc-core.h
+index cc19bba0..76435d3b 100644
+--- a/drivers/media/platform/exynos-gsc/gsc-core.h
++++ b/drivers/media/platform/exynos-gsc/gsc-core.h
+@@ -343,6 +343,7 @@ struct gsc_dev {
+ 	unsigned long			state;
+ 	struct vb2_alloc_ctx		*alloc_ctx;
+ 	struct video_device		vdev;
++	struct v4l2_device		v4l2_dev;
+ };
+ 
+ /**
+diff --git a/drivers/media/platform/exynos-gsc/gsc-m2m.c b/drivers/media/platform/exynos-gsc/gsc-m2m.c
+index 40a73f7d..e576ff2d 100644
+--- a/drivers/media/platform/exynos-gsc/gsc-m2m.c
++++ b/drivers/media/platform/exynos-gsc/gsc-m2m.c
+@@ -751,6 +751,7 @@ int gsc_register_m2m_device(struct gsc_dev *gsc)
+ 	gsc->vdev.release	= video_device_release_empty;
+ 	gsc->vdev.lock		= &gsc->lock;
+ 	gsc->vdev.vfl_dir	= VFL_DIR_M2M;
++	gsc->vdev.v4l2_dev	= &gsc->v4l2_dev;
+ 	snprintf(gsc->vdev.name, sizeof(gsc->vdev.name), "%s.%d:m2m",
+ 					GSC_MODULE_NAME, gsc->id);
+ 
+diff --git a/drivers/media/platform/exynos4-is/fimc-lite.c b/drivers/media/platform/exynos4-is/fimc-lite.c
+index 08fbfede..e85dc4f2 100644
+--- a/drivers/media/platform/exynos4-is/fimc-lite.c
++++ b/drivers/media/platform/exynos4-is/fimc-lite.c
+@@ -90,7 +90,7 @@ static const struct fimc_fmt fimc_lite_formats[] = {
+ 		.name		= "RAW10 (GRBG)",
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG10,
+ 		.colorspace	= V4L2_COLORSPACE_SRGB,
+-		.depth		= { 10 },
++		.depth		= { 16 },
+ 		.color		= FIMC_FMT_RAW10,
+ 		.memplanes	= 1,
+ 		.mbus_code	= V4L2_MBUS_FMT_SGRBG10_1X10,
+@@ -99,7 +99,7 @@ static const struct fimc_fmt fimc_lite_formats[] = {
+ 		.name		= "RAW12 (GRBG)",
+ 		.fourcc		= V4L2_PIX_FMT_SGRBG12,
+ 		.colorspace	= V4L2_COLORSPACE_SRGB,
+-		.depth		= { 12 },
++		.depth		= { 16 },
+ 		.color		= FIMC_FMT_RAW12,
+ 		.memplanes	= 1,
+ 		.mbus_code	= V4L2_MBUS_FMT_SGRBG12_1X12,
+diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
+index 19f556c5..91f21e27 100644
+--- a/drivers/media/platform/exynos4-is/media-dev.c
++++ b/drivers/media/platform/exynos4-is/media-dev.c
+@@ -1530,9 +1530,9 @@ static int fimc_md_probe(struct platform_device *pdev)
+ err_unlock:
+ 	mutex_unlock(&fmd->media_dev.graph_mutex);
+ err_clk:
+-	media_device_unregister(&fmd->media_dev);
+ 	fimc_md_put_clocks(fmd);
+ 	fimc_md_unregister_entities(fmd);
++	media_device_unregister(&fmd->media_dev);
+ err_md:
+ 	v4l2_device_unregister(&fmd->v4l2_dev);
+ 	return ret;
+diff --git a/drivers/mmc/host/tmio_mmc_dma.c b/drivers/mmc/host/tmio_mmc_dma.c
+index 47bdb8fa..65edb4a6 100644
+--- a/drivers/mmc/host/tmio_mmc_dma.c
++++ b/drivers/mmc/host/tmio_mmc_dma.c
+@@ -104,6 +104,7 @@ static void tmio_mmc_start_dma_rx(struct tmio_mmc_host *host)
+ pio:
+ 	if (!desc) {
+ 		/* DMA failed, fall back to PIO */
++		tmio_mmc_enable_dma(host, false);
+ 		if (ret >= 0)
+ 			ret = -EIO;
+ 		host->chan_rx = NULL;
+@@ -116,7 +117,6 @@ pio:
+ 		}
+ 		dev_warn(&host->pdev->dev,
+ 			 "DMA failed: %d, falling back to PIO\n", ret);
+-		tmio_mmc_enable_dma(host, false);
+ 	}
+ 
+ 	dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d, sg[%d]\n", __func__,
+@@ -185,6 +185,7 @@ static void tmio_mmc_start_dma_tx(struct tmio_mmc_host *host)
+ pio:
+ 	if (!desc) {
+ 		/* DMA failed, fall back to PIO */
++		tmio_mmc_enable_dma(host, false);
+ 		if (ret >= 0)
+ 			ret = -EIO;
+ 		host->chan_tx = NULL;
+@@ -197,7 +198,6 @@ pio:
+ 		}
+ 		dev_warn(&host->pdev->dev,
+ 			 "DMA failed: %d, falling back to PIO\n", ret);
+-		tmio_mmc_enable_dma(host, false);
+ 	}
+ 
+ 	dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d\n", __func__,
+diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
+index dfcd0a56..fb8c4dea 100644
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -2793,7 +2793,9 @@ static void nand_set_defaults(struct nand_chip *chip, int busw)
+ 
+ 	if (!chip->select_chip)
+ 		chip->select_chip = nand_select_chip;
+-	if (!chip->read_byte)
++
++	/* If called twice, pointers that depend on busw may need to be reset */
++	if (!chip->read_byte || chip->read_byte == nand_read_byte)
+ 		chip->read_byte = busw ? nand_read_byte16 : nand_read_byte;
+ 	if (!chip->read_word)
+ 		chip->read_word = nand_read_word;
+@@ -2801,9 +2803,9 @@ static void nand_set_defaults(struct nand_chip *chip, int busw)
+ 		chip->block_bad = nand_block_bad;
+ 	if (!chip->block_markbad)
+ 		chip->block_markbad = nand_default_block_markbad;
+-	if (!chip->write_buf)
++	if (!chip->write_buf || chip->write_buf == nand_write_buf)
+ 		chip->write_buf = busw ? nand_write_buf16 : nand_write_buf;
+-	if (!chip->read_buf)
++	if (!chip->read_buf || chip->read_buf == nand_read_buf)
+ 		chip->read_buf = busw ? nand_read_buf16 : nand_read_buf;
+ 	if (!chip->scan_bbt)
+ 		chip->scan_bbt = nand_default_bbt;
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 5df49d3c..c95bfb18 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -1069,6 +1069,9 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ 		if (!(e2->ec - e1->ec >= UBI_WL_THRESHOLD)) {
+ 			dbg_wl("no WL needed: min used EC %d, max free EC %d",
+ 			       e1->ec, e2->ec);
++
++			/* Give the unused PEB back */
++			wl_tree_add(e2, &ubi->free);
+ 			goto out_cancel;
+ 		}
+ 		self_check_in_wl_tree(ubi, e1, &ubi->used);
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index b017818b..90ab2928 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -138,7 +138,9 @@
+ #define      MVNETA_GMAC_FORCE_LINK_PASS         BIT(1)
+ #define      MVNETA_GMAC_CONFIG_MII_SPEED        BIT(5)
+ #define      MVNETA_GMAC_CONFIG_GMII_SPEED       BIT(6)
++#define      MVNETA_GMAC_AN_SPEED_EN             BIT(7)
+ #define      MVNETA_GMAC_CONFIG_FULL_DUPLEX      BIT(12)
++#define      MVNETA_GMAC_AN_DUPLEX_EN            BIT(13)
+ #define MVNETA_MIB_COUNTERS_BASE                 0x3080
+ #define      MVNETA_MIB_LATE_COLLISION           0x7c
+ #define MVNETA_DA_FILT_SPEC_MCAST                0x3400
+@@ -915,6 +917,13 @@ static void mvneta_defaults_set(struct mvneta_port *pp)
+ 	/* Assign port SDMA configuration */
+ 	mvreg_write(pp, MVNETA_SDMA_CONFIG, val);
+ 
++	/* Disable PHY polling in hardware, since we're using the
++	 * kernel phylib to do this.
++	 */
++	val = mvreg_read(pp, MVNETA_UNIT_CONTROL);
++	val &= ~MVNETA_PHY_POLLING_ENABLE;
++	mvreg_write(pp, MVNETA_UNIT_CONTROL, val);
++
+ 	mvneta_set_ucast_table(pp, -1);
+ 	mvneta_set_special_mcast_table(pp, -1);
+ 	mvneta_set_other_mcast_table(pp, -1);
+@@ -2307,7 +2316,9 @@ static void mvneta_adjust_link(struct net_device *ndev)
+ 			val = mvreg_read(pp, MVNETA_GMAC_AUTONEG_CONFIG);
+ 			val &= ~(MVNETA_GMAC_CONFIG_MII_SPEED |
+ 				 MVNETA_GMAC_CONFIG_GMII_SPEED |
+-				 MVNETA_GMAC_CONFIG_FULL_DUPLEX);
++				 MVNETA_GMAC_CONFIG_FULL_DUPLEX |
++				 MVNETA_GMAC_AN_SPEED_EN |
++				 MVNETA_GMAC_AN_DUPLEX_EN);
+ 
+ 			if (phydev->duplex)
+ 				val |= MVNETA_GMAC_CONFIG_FULL_DUPLEX;
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+index 1f694ab3..77d3a705 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -1173,6 +1173,10 @@ skip_ws_det:
+ 		 * is_on == 0 means MRC CCK is OFF (more noise imm)
+ 		 */
+ 		bool is_on = param ? 1 : 0;
++
++		if (ah->caps.rx_chainmask == 1)
++			break;
++
+ 		REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+ 			      AR_PHY_MRC_CCK_ENABLE, is_on);
+ 		REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index c1224b5a..020b9b37 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -79,10 +79,6 @@ struct ath_config {
+ 		       sizeof(struct ath_buf_state));		\
+ 	} while (0)
+ 
+-#define ATH_RXBUF_RESET(_bf) do {		\
+-		(_bf)->bf_stale = false;	\
+-	} while (0)
+-
+ /**
+  * enum buffer_type - Buffer type flags
+  *
+@@ -317,6 +313,7 @@ struct ath_rx {
+ 	struct ath_descdma rxdma;
+ 	struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
+ 
++	struct ath_buf *buf_hold;
+ 	struct sk_buff *frag;
+ 
+ 	u32 ampdu_ref;
+diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
+index 865e043e..b4902b34 100644
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -42,8 +42,6 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+ 	struct ath_desc *ds;
+ 	struct sk_buff *skb;
+ 
+-	ATH_RXBUF_RESET(bf);
+-
+ 	ds = bf->bf_desc;
+ 	ds->ds_link = 0; /* link to null */
+ 	ds->ds_data = bf->bf_buf_addr;
+@@ -70,6 +68,14 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+ 	sc->rx.rxlink = &ds->ds_link;
+ }
+ 
++static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
++{
++	if (sc->rx.buf_hold)
++		ath_rx_buf_link(sc, sc->rx.buf_hold);
++
++	sc->rx.buf_hold = bf;
++}
++
+ static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
+ {
+ 	/* XXX block beacon interrupts */
+@@ -117,7 +123,6 @@ static bool ath_rx_edma_buf_link(struct ath_softc *sc,
+ 
+ 	skb = bf->bf_mpdu;
+ 
+-	ATH_RXBUF_RESET(bf);
+ 	memset(skb->data, 0, ah->caps.rx_status_len);
+ 	dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+ 				ah->caps.rx_status_len, DMA_TO_DEVICE);
+@@ -432,6 +437,7 @@ int ath_startrecv(struct ath_softc *sc)
+ 	if (list_empty(&sc->rx.rxbuf))
+ 		goto start_recv;
+ 
++	sc->rx.buf_hold = NULL;
+ 	sc->rx.rxlink = NULL;
+ 	list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
+ 		ath_rx_buf_link(sc, bf);
+@@ -677,6 +683,9 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
+ 	}
+ 
+ 	bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
++	if (bf == sc->rx.buf_hold)
++		return NULL;
++
+ 	ds = bf->bf_desc;
+ 
+ 	/*
+@@ -1375,7 +1384,7 @@ requeue:
+ 		if (edma) {
+ 			ath_rx_edma_buf_link(sc, qtype);
+ 		} else {
+-			ath_rx_buf_link(sc, bf);
++			ath_rx_buf_relink(sc, bf);
+ 			ath9k_hw_rxena(ah);
+ 		}
+ 	} while (1);
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 92799273..ab646838 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2602,6 +2602,7 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
+ 	for (acno = 0, ac = &an->ac[acno];
+ 	     acno < IEEE80211_NUM_ACS; acno++, ac++) {
+ 		ac->sched    = false;
++		ac->clear_ps_filter = true;
+ 		ac->txq = sc->tx.txq_map[acno];
+ 		INIT_LIST_HEAD(&ac->tid_q);
+ 	}
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+index 1860c572..4fb9635d 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+@@ -1015,9 +1015,10 @@ static bool dma64_txidle(struct dma_info *di)
+ 
+ /*
+  * post receive buffers
+- *  return false is refill failed completely and ring is empty this will stall
+- *  the rx dma and user might want to call rxfill again asap. This unlikely
+- *  happens on memory-rich NIC, but often on memory-constrained dongle
++ *  Return false if refill failed completely or dma mapping failed. The ring
++ *  is empty, which will stall the rx dma and user might want to call rxfill
++ *  again asap. This is unlikely to happen on a memory-rich NIC, but often on
++ *  memory-constrained dongle.
+  */
+ bool dma_rxfill(struct dma_pub *pub)
+ {
+@@ -1078,6 +1079,8 @@ bool dma_rxfill(struct dma_pub *pub)
+ 
+ 		pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
+ 				    DMA_FROM_DEVICE);
++		if (dma_mapping_error(di->dmadev, pa))
++			return false;
+ 
+ 		/* save the free packet pointer */
+ 		di->rxp[rxout] = p;
+@@ -1284,7 +1287,11 @@ static void dma_txenq(struct dma_info *di, struct sk_buff *p)
+ 
+ 	/* get physical address of buffer start */
+ 	pa = dma_map_single(di->dmadev, data, len, DMA_TO_DEVICE);
+-
++	/* if mapping failed, free skb */
++	if (dma_mapping_error(di->dmadev, pa)) {
++		brcmu_pkt_buf_free_skb(p);
++		return;
++	}
+ 	/* With a DMA segment list, Descriptor table is filled
+ 	 * using the segment list instead of looping over
+ 	 * buffers in multi-chain DMA. Therefore, EOF for SGLIST
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 5c542791..bf8432f5 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1629,6 +1629,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
+ 		ap = dt_alloc(sizeof(*ap) + len + 1, 4);
+ 		if (!ap)
+ 			continue;
++		memset(ap, 0, sizeof(*ap) + len + 1);
+ 		ap->alias = start;
+ 		of_alias_add(ap, np, id, start, len);
+ 	}
+diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
+index b90a3a0a..19afb9a7 100644
+--- a/drivers/pinctrl/pinctrl-at91.c
++++ b/drivers/pinctrl/pinctrl-at91.c
+@@ -325,7 +325,7 @@ static void at91_mux_disable_interrupt(void __iomem *pio, unsigned mask)
+ 
+ static unsigned at91_mux_get_pullup(void __iomem *pio, unsigned pin)
+ {
+-	return (readl_relaxed(pio + PIO_PUSR) >> pin) & 0x1;
++	return !((readl_relaxed(pio + PIO_PUSR) >> pin) & 0x1);
+ }
+ 
+ static void at91_mux_set_pullup(void __iomem *pio, unsigned mask, bool on)
+@@ -445,7 +445,7 @@ static void at91_mux_pio3_set_debounce(void __iomem *pio, unsigned mask,
+ 
+ static bool at91_mux_pio3_get_pulldown(void __iomem *pio, unsigned pin)
+ {
+-	return (__raw_readl(pio + PIO_PPDSR) >> pin) & 0x1;
++	return !((__raw_readl(pio + PIO_PPDSR) >> pin) & 0x1);
+ }
+ 
+ static void at91_mux_pio3_set_pulldown(void __iomem *pio, unsigned mask, bool is_on)
+diff --git a/drivers/scsi/mpt3sas/Makefile b/drivers/scsi/mpt3sas/Makefile
+index 4c1d2e7a..efb0c4c2 100644
+--- a/drivers/scsi/mpt3sas/Makefile
++++ b/drivers/scsi/mpt3sas/Makefile
+@@ -1,5 +1,5 @@
+ # mpt3sas makefile
+-obj-m += mpt3sas.o
++obj-$(CONFIG_SCSI_MPT3SAS) += mpt3sas.o
+ mpt3sas-y +=  mpt3sas_base.o     \
+ 		mpt3sas_config.o \
+ 		mpt3sas_scsih.o      \
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 86fcf2c3..2783dd70 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2419,14 +2419,9 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
+ 			}
+ 		}
+ 
+-		if (modepage == 0x3F) {
+-			sd_printk(KERN_ERR, sdkp, "No Caching mode page "
+-				  "present\n");
+-			goto defaults;
+-		} else if ((buffer[offset] & 0x3f) != modepage) {
+-			sd_printk(KERN_ERR, sdkp, "Got wrong page\n");
+-			goto defaults;
+-		}
++		sd_printk(KERN_ERR, sdkp, "No Caching mode page found\n");
++		goto defaults;
++
+ 	Page_found:
+ 		if (modepage == 8) {
+ 			sdkp->WCE = ((buffer[offset + 2] & 0x04) != 0);
+diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c
+index c1950e3b..674b236f 100644
+--- a/drivers/staging/comedi/drivers/dt282x.c
++++ b/drivers/staging/comedi/drivers/dt282x.c
+@@ -264,8 +264,9 @@ struct dt282x_private {
+ 			}					\
+ 			udelay(5);				\
+ 		}						\
+-		if (_i)						\
++		if (_i) {					\
+ 			b					\
++		}						\
+ 	} while (0)
+ 
+ static int prep_ai_dma(struct comedi_device *dev, int chan, int size);
+diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
+index e77fb6ea..8f54c503 100644
+--- a/drivers/staging/zram/zram_drv.c
++++ b/drivers/staging/zram/zram_drv.c
+@@ -445,6 +445,14 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
+ 		goto out;
+ 	}
+ 
++	/*
++	 * zram_slot_free_notify could miss free so that let's
++	 * double check.
++	 */
++	if (unlikely(meta->table[index].handle ||
++			zram_test_flag(meta, index, ZRAM_ZERO)))
++		zram_free_page(zram, index);
++
+ 	ret = lzo1x_1_compress(uncmem, PAGE_SIZE, src, &clen,
+ 			       meta->compress_workmem);
+ 
+@@ -504,6 +512,20 @@ out:
+ 	return ret;
+ }
+ 
++static void handle_pending_slot_free(struct zram *zram)
++{
++	struct zram_slot_free *free_rq;
++
++	spin_lock(&zram->slot_free_lock);
++	while (zram->slot_free_rq) {
++		free_rq = zram->slot_free_rq;
++		zram->slot_free_rq = free_rq->next;
++		zram_free_page(zram, free_rq->index);
++		kfree(free_rq);
++	}
++	spin_unlock(&zram->slot_free_lock);
++}
++
+ static int zram_bvec_rw(struct zram *zram, struct bio_vec *bvec, u32 index,
+ 			int offset, struct bio *bio, int rw)
+ {
+@@ -511,10 +533,12 @@ static int zram_bvec_rw(struct zram *zram, struct bio_vec *bvec, u32 index,
+ 
+ 	if (rw == READ) {
+ 		down_read(&zram->lock);
++		handle_pending_slot_free(zram);
+ 		ret = zram_bvec_read(zram, bvec, index, offset, bio);
+ 		up_read(&zram->lock);
+ 	} else {
+ 		down_write(&zram->lock);
++		handle_pending_slot_free(zram);
+ 		ret = zram_bvec_write(zram, bvec, index, offset);
+ 		up_write(&zram->lock);
+ 	}
+@@ -522,11 +546,13 @@ static int zram_bvec_rw(struct zram *zram, struct bio_vec *bvec, u32 index,
+ 	return ret;
+ }
+ 
+-static void zram_reset_device(struct zram *zram)
++static void zram_reset_device(struct zram *zram, bool reset_capacity)
+ {
+ 	size_t index;
+ 	struct zram_meta *meta;
+ 
++	flush_work(&zram->free_work);
++
+ 	down_write(&zram->init_lock);
+ 	if (!zram->init_done) {
+ 		up_write(&zram->init_lock);
+@@ -551,7 +577,8 @@ static void zram_reset_device(struct zram *zram)
+ 	memset(&zram->stats, 0, sizeof(zram->stats));
+ 
+ 	zram->disksize = 0;
+-	set_capacity(zram->disk, 0);
++	if (reset_capacity)
++		set_capacity(zram->disk, 0);
+ 	up_write(&zram->init_lock);
+ }
+ 
+@@ -635,7 +662,7 @@ static ssize_t reset_store(struct device *dev,
+ 	if (bdev)
+ 		fsync_bdev(bdev);
+ 
+-	zram_reset_device(zram);
++	zram_reset_device(zram, true);
+ 	return len;
+ }
+ 
+@@ -720,16 +747,40 @@ error:
+ 	bio_io_error(bio);
+ }
+ 
++static void zram_slot_free(struct work_struct *work)
++{
++	struct zram *zram;
++
++	zram = container_of(work, struct zram, free_work);
++	down_write(&zram->lock);
++	handle_pending_slot_free(zram);
++	up_write(&zram->lock);
++}
++
++static void add_slot_free(struct zram *zram, struct zram_slot_free *free_rq)
++{
++	spin_lock(&zram->slot_free_lock);
++	free_rq->next = zram->slot_free_rq;
++	zram->slot_free_rq = free_rq;
++	spin_unlock(&zram->slot_free_lock);
++}
++
+ static void zram_slot_free_notify(struct block_device *bdev,
+ 				unsigned long index)
+ {
+ 	struct zram *zram;
++	struct zram_slot_free *free_rq;
+ 
+ 	zram = bdev->bd_disk->private_data;
+-	down_write(&zram->lock);
+-	zram_free_page(zram, index);
+-	up_write(&zram->lock);
+ 	atomic64_inc(&zram->stats.notify_free);
++
++	free_rq = kmalloc(sizeof(struct zram_slot_free), GFP_ATOMIC);
++	if (!free_rq)
++		return;
++
++	free_rq->index = index;
++	add_slot_free(zram, free_rq);
++	schedule_work(&zram->free_work);
+ }
+ 
+ static const struct block_device_operations zram_devops = {
+@@ -776,6 +827,10 @@ static int create_device(struct zram *zram, int device_id)
+ 	init_rwsem(&zram->lock);
+ 	init_rwsem(&zram->init_lock);
+ 
++	INIT_WORK(&zram->free_work, zram_slot_free);
++	spin_lock_init(&zram->slot_free_lock);
++	zram->slot_free_rq = NULL;
++
+ 	zram->queue = blk_alloc_queue(GFP_KERNEL);
+ 	if (!zram->queue) {
+ 		pr_err("Error allocating disk queue for device %d\n",
+@@ -902,10 +957,12 @@ static void __exit zram_exit(void)
+ 	for (i = 0; i < num_devices; i++) {
+ 		zram = &zram_devices[i];
+ 
+-		get_disk(zram->disk);
+ 		destroy_device(zram);
+-		zram_reset_device(zram);
+-		put_disk(zram->disk);
++		/*
++		 * Shouldn't access zram->disk after destroy_device
++		 * because destroy_device already released zram->disk.
++		 */
++		zram_reset_device(zram, false);
+ 	}
+ 
+ 	unregister_blkdev(zram_major, "zram");
+diff --git a/drivers/staging/zram/zram_drv.h b/drivers/staging/zram/zram_drv.h
+index 9e57bfb2..97a3acf6 100644
+--- a/drivers/staging/zram/zram_drv.h
++++ b/drivers/staging/zram/zram_drv.h
+@@ -94,11 +94,20 @@ struct zram_meta {
+ 	struct zs_pool *mem_pool;
+ };
+ 
++struct zram_slot_free {
++	unsigned long index;
++	struct zram_slot_free *next;
++};
++
+ struct zram {
+ 	struct zram_meta *meta;
+ 	struct rw_semaphore lock; /* protect compression buffers, table,
+ 				   * 32bit stat counters against concurrent
+ 				   * notifications, reads and writes */
++
++	struct work_struct free_work;  /* handle pending free request */
++	struct zram_slot_free *slot_free_rq; /* list head of free request */
++
+ 	struct request_queue *queue;
+ 	struct gendisk *disk;
+ 	int init_done;
+@@ -109,6 +118,7 @@ struct zram {
+ 	 * we can store in a disk.
+ 	 */
+ 	u64 disksize;	/* bytes */
++	spinlock_t slot_free_lock;
+ 
+ 	struct zram_stats stats;
+ };
+diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
+index cbe48ab4..f608fbc1 100644
+--- a/drivers/target/target_core_alua.c
++++ b/drivers/target/target_core_alua.c
+@@ -730,7 +730,7 @@ static int core_alua_write_tpg_metadata(
+ 	if (ret < 0)
+ 		pr_err("Error writing ALUA metadata file: %s\n", path);
+ 	fput(file);
+-	return ret ? -EIO : 0;
++	return (ret < 0) ? -EIO : 0;
+ }
+ 
+ /*
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index bd78faf6..adec5a82 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -1949,7 +1949,7 @@ static int __core_scsi3_write_aptpl_to_file(
+ 		pr_debug("Error writing APTPL metadata file: %s\n", path);
+ 	fput(file);
+ 
+-	return ret ? -EIO : 0;
++	return (ret < 0) ? -EIO : 0;
+ }
+ 
+ /*
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 366af832..20689b95 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -850,7 +850,8 @@ void disassociate_ctty(int on_exit)
+ 			struct pid *tty_pgrp = tty_get_pgrp(tty);
+ 			if (tty_pgrp) {
+ 				kill_pgrp(tty_pgrp, SIGHUP, on_exit);
+-				kill_pgrp(tty_pgrp, SIGCONT, on_exit);
++				if (!on_exit)
++					kill_pgrp(tty_pgrp, SIGCONT, on_exit);
+ 				put_pid(tty_pgrp);
+ 			}
+ 		}
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 8a230f0e..d3318a0d 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -209,6 +209,7 @@ skip_error:
+ static void wdm_int_callback(struct urb *urb)
+ {
+ 	int rv = 0;
++	int responding;
+ 	int status = urb->status;
+ 	struct wdm_device *desc;
+ 	struct usb_cdc_notification *dr;
+@@ -262,8 +263,8 @@ static void wdm_int_callback(struct urb *urb)
+ 
+ 	spin_lock(&desc->iuspin);
+ 	clear_bit(WDM_READ, &desc->flags);
+-	set_bit(WDM_RESPONDING, &desc->flags);
+-	if (!test_bit(WDM_DISCONNECTING, &desc->flags)
++	responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
++	if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags)
+ 		&& !test_bit(WDM_SUSPENDING, &desc->flags)) {
+ 		rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+ 		dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
+@@ -685,16 +686,20 @@ static void wdm_rxwork(struct work_struct *work)
+ {
+ 	struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);
+ 	unsigned long flags;
+-	int rv;
++	int rv = 0;
++	int responding;
+ 
+ 	spin_lock_irqsave(&desc->iuspin, flags);
+ 	if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+ 		spin_unlock_irqrestore(&desc->iuspin, flags);
+ 	} else {
++		responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
+ 		spin_unlock_irqrestore(&desc->iuspin, flags);
+-		rv = usb_submit_urb(desc->response, GFP_KERNEL);
++		if (!responding)
++			rv = usb_submit_urb(desc->response, GFP_KERNEL);
+ 		if (rv < 0 && rv != -EPERM) {
+ 			spin_lock_irqsave(&desc->iuspin, flags);
++			clear_bit(WDM_RESPONDING, &desc->flags);
+ 			if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+ 				schedule_work(&desc->rxwork);
+ 			spin_unlock_irqrestore(&desc->iuspin, flags);
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 7199adcc..a6b2cabe 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -424,7 +424,8 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
+ 
+ 	memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+ 	if (config->desc.bDescriptorType != USB_DT_CONFIG ||
+-	    config->desc.bLength < USB_DT_CONFIG_SIZE) {
++	    config->desc.bLength < USB_DT_CONFIG_SIZE ||
++	    config->desc.bLength > size) {
+ 		dev_err(ddev, "invalid descriptor for config index %d: "
+ 		    "type = 0x%X, length = %d\n", cfgidx,
+ 		    config->desc.bDescriptorType, config->desc.bLength);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 558313de..17c37852 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2918,7 +2918,6 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ {
+ 	struct usb_hub	*hub = usb_hub_to_struct_hub(udev->parent);
+ 	struct usb_port *port_dev = hub->ports[udev->portnum - 1];
+-	enum pm_qos_flags_status pm_qos_stat;
+ 	int		port1 = udev->portnum;
+ 	int		status;
+ 	bool		really_suspend = true;
+@@ -2956,7 +2955,7 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ 					status);
+ 			/* bail if autosuspend is requested */
+ 			if (PMSG_IS_AUTO(msg))
+-				return status;
++				goto err_wakeup;
+ 		}
+ 	}
+ 
+@@ -2965,14 +2964,16 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ 		usb_set_usb2_hardware_lpm(udev, 0);
+ 
+ 	if (usb_disable_ltm(udev)) {
+-		dev_err(&udev->dev, "%s Failed to disable LTM before suspend\n.",
+-				__func__);
+-		return -ENOMEM;
++		dev_err(&udev->dev, "Failed to disable LTM before suspend\n.");
++		status = -ENOMEM;
++		if (PMSG_IS_AUTO(msg))
++			goto err_ltm;
+ 	}
+ 	if (usb_unlocked_disable_lpm(udev)) {
+-		dev_err(&udev->dev, "%s Failed to disable LPM before suspend\n.",
+-				__func__);
+-		return -ENOMEM;
++		dev_err(&udev->dev, "Failed to disable LPM before suspend\n.");
++		status = -ENOMEM;
++		if (PMSG_IS_AUTO(msg))
++			goto err_lpm3;
+ 	}
+ 
+ 	/* see 7.1.7.6 */
+@@ -3000,28 +3001,31 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ 	if (status) {
+ 		dev_dbg(hub->intfdev, "can't suspend port %d, status %d\n",
+ 				port1, status);
+-		/* paranoia:  "should not happen" */
+-		if (udev->do_remote_wakeup) {
+-			if (!hub_is_superspeed(hub->hdev)) {
+-				(void) usb_control_msg(udev,
+-						usb_sndctrlpipe(udev, 0),
+-						USB_REQ_CLEAR_FEATURE,
+-						USB_RECIP_DEVICE,
+-						USB_DEVICE_REMOTE_WAKEUP, 0,
+-						NULL, 0,
+-						USB_CTRL_SET_TIMEOUT);
+-			} else
+-				(void) usb_disable_function_remotewakeup(udev);
+-
+-		}
+ 
++		/* Try to enable USB3 LPM and LTM again */
++		usb_unlocked_enable_lpm(udev);
++ err_lpm3:
++		usb_enable_ltm(udev);
++ err_ltm:
+ 		/* Try to enable USB2 hardware LPM again */
+ 		if (udev->usb2_hw_lpm_capable == 1)
+ 			usb_set_usb2_hardware_lpm(udev, 1);
+ 
+-		/* Try to enable USB3 LTM and LPM again */
+-		usb_enable_ltm(udev);
+-		usb_unlocked_enable_lpm(udev);
++		if (udev->do_remote_wakeup) {
++			if (udev->speed < USB_SPEED_SUPER)
++				usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
++						USB_REQ_CLEAR_FEATURE,
++						USB_RECIP_DEVICE,
++						USB_DEVICE_REMOTE_WAKEUP, 0,
++						NULL, 0, USB_CTRL_SET_TIMEOUT);
++			else
++				usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
++						USB_REQ_CLEAR_FEATURE,
++						USB_RECIP_INTERFACE,
++						USB_INTRF_FUNC_SUSPEND, 0,
++						NULL, 0, USB_CTRL_SET_TIMEOUT);
++		}
++ err_wakeup:
+ 
+ 		/* System sleep transitions should never fail */
+ 		if (!PMSG_IS_AUTO(msg))
+@@ -3039,16 +3043,7 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ 		usb_set_device_state(udev, USB_STATE_SUSPENDED);
+ 	}
+ 
+-	/*
+-	 * Check whether current status meets the requirement of
+-	 * usb port power off mechanism
+-	 */
+-	pm_qos_stat = dev_pm_qos_flags(&port_dev->dev,
+-			PM_QOS_FLAG_NO_POWER_OFF);
+-	if (!udev->do_remote_wakeup
+-			&& pm_qos_stat != PM_QOS_FLAGS_ALL
+-			&& udev->persist_enabled
+-			&& !status) {
++	if (status == 0 && !udev->do_remote_wakeup && udev->persist_enabled) {
+ 		pm_runtime_put_sync(&port_dev->dev);
+ 		port_dev->did_runtime_put = true;
+ 	}
+diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c
+index d6b0fadf..99099116 100644
+--- a/drivers/usb/core/port.c
++++ b/drivers/usb/core/port.c
+@@ -89,22 +89,19 @@ static int usb_port_runtime_resume(struct device *dev)
+ 	retval = usb_hub_set_port_power(hdev, hub, port1, true);
+ 	if (port_dev->child && !retval) {
+ 		/*
+-		 * Wait for usb hub port to be reconnected in order to make
+-		 * the resume procedure successful.
++		 * Attempt to wait for usb hub port to be reconnected in order
++		 * to make the resume procedure successful.  The device may have
++		 * disconnected while the port was powered off, so ignore the
++		 * return status.
+ 		 */
+ 		retval = hub_port_debounce_be_connected(hub, port1);
+-		if (retval < 0) {
++		if (retval < 0)
+ 			dev_dbg(&port_dev->dev, "can't get reconnection after setting port  power on, status %d\n",
+ 					retval);
+-			goto out;
+-		}
+ 		usb_clear_port_feature(hdev, port1, USB_PORT_FEAT_C_ENABLE);
+-
+-		/* Set return value to 0 if debounce successful */
+ 		retval = 0;
+ 	}
+ 
+-out:
+ 	clear_bit(port1, hub->busy_bits);
+ 	usb_autopm_put_interface(intf);
+ 	return retval;
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index f77083fe..14d28d61 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1508,6 +1508,15 @@ static int dwc3_gadget_start(struct usb_gadget *g,
+ 	int			irq;
+ 	u32			reg;
+ 
++	irq = platform_get_irq(to_platform_device(dwc->dev), 0);
++	ret = request_threaded_irq(irq, dwc3_interrupt, dwc3_thread_interrupt,
++			IRQF_SHARED | IRQF_ONESHOT, "dwc3", dwc);
++	if (ret) {
++		dev_err(dwc->dev, "failed to request irq #%d --> %d\n",
++				irq, ret);
++		goto err0;
++	}
++
+ 	spin_lock_irqsave(&dwc->lock, flags);
+ 
+ 	if (dwc->gadget_driver) {
+@@ -1515,7 +1524,7 @@ static int dwc3_gadget_start(struct usb_gadget *g,
+ 				dwc->gadget.name,
+ 				dwc->gadget_driver->driver.name);
+ 		ret = -EBUSY;
+-		goto err0;
++		goto err1;
+ 	}
+ 
+ 	dwc->gadget_driver	= driver;
+@@ -1551,42 +1560,38 @@ static int dwc3_gadget_start(struct usb_gadget *g,
+ 	ret = __dwc3_gadget_ep_enable(dep, &dwc3_gadget_ep0_desc, NULL, false);
+ 	if (ret) {
+ 		dev_err(dwc->dev, "failed to enable %s\n", dep->name);
+-		goto err0;
++		goto err2;
+ 	}
+ 
+ 	dep = dwc->eps[1];
+ 	ret = __dwc3_gadget_ep_enable(dep, &dwc3_gadget_ep0_desc, NULL, false);
+ 	if (ret) {
+ 		dev_err(dwc->dev, "failed to enable %s\n", dep->name);
+-		goto err1;
++		goto err3;
+ 	}
+ 
+ 	/* begin to receive SETUP packets */
+ 	dwc->ep0state = EP0_SETUP_PHASE;
+ 	dwc3_ep0_out_start(dwc);
+ 
+-	irq = platform_get_irq(to_platform_device(dwc->dev), 0);
+-	ret = request_threaded_irq(irq, dwc3_interrupt, dwc3_thread_interrupt,
+-			IRQF_SHARED | IRQF_ONESHOT, "dwc3", dwc);
+-	if (ret) {
+-		dev_err(dwc->dev, "failed to request irq #%d --> %d\n",
+-				irq, ret);
+-		goto err1;
+-	}
+-
+ 	dwc3_gadget_enable_irq(dwc);
+ 
+ 	spin_unlock_irqrestore(&dwc->lock, flags);
+ 
+ 	return 0;
+ 
+-err1:
++err3:
+ 	__dwc3_gadget_ep_disable(dwc->eps[0]);
+ 
+-err0:
++err2:
+ 	dwc->gadget_driver = NULL;
++
++err1:
+ 	spin_unlock_irqrestore(&dwc->lock, flags);
+ 
++	free_irq(irq, dwc);
++
++err0:
+ 	return ret;
+ }
+ 
+@@ -1600,9 +1605,6 @@ static int dwc3_gadget_stop(struct usb_gadget *g,
+ 	spin_lock_irqsave(&dwc->lock, flags);
+ 
+ 	dwc3_gadget_disable_irq(dwc);
+-	irq = platform_get_irq(to_platform_device(dwc->dev), 0);
+-	free_irq(irq, dwc);
+-
+ 	__dwc3_gadget_ep_disable(dwc->eps[0]);
+ 	__dwc3_gadget_ep_disable(dwc->eps[1]);
+ 
+@@ -1610,6 +1612,9 @@ static int dwc3_gadget_stop(struct usb_gadget *g,
+ 
+ 	spin_unlock_irqrestore(&dwc->lock, flags);
+ 
++	irq = platform_get_irq(to_platform_device(dwc->dev), 0);
++	free_irq(irq, dwc);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/gadget/uvc_queue.c b/drivers/usb/gadget/uvc_queue.c
+index e6170478..0bb5d500 100644
+--- a/drivers/usb/gadget/uvc_queue.c
++++ b/drivers/usb/gadget/uvc_queue.c
+@@ -193,12 +193,16 @@ static int uvc_queue_buffer(struct uvc_video_queue *queue,
+ 
+ 	mutex_lock(&queue->mutex);
+ 	ret = vb2_qbuf(&queue->queue, buf);
++	if (ret < 0)
++		goto done;
++
+ 	spin_lock_irqsave(&queue->irqlock, flags);
+ 	ret = (queue->flags & UVC_QUEUE_PAUSED) != 0;
+ 	queue->flags &= ~UVC_QUEUE_PAUSED;
+ 	spin_unlock_irqrestore(&queue->irqlock, flags);
+-	mutex_unlock(&queue->mutex);
+ 
++done:
++	mutex_unlock(&queue->mutex);
+ 	return ret;
+ }
+ 
+diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
+index e4c34ac3..4c166e1e 100644
+--- a/drivers/usb/host/ehci-mxc.c
++++ b/drivers/usb/host/ehci-mxc.c
+@@ -184,7 +184,7 @@ static int ehci_mxc_drv_remove(struct platform_device *pdev)
+ 	if (pdata && pdata->exit)
+ 		pdata->exit(pdev);
+ 
+-	if (pdata->otg)
++	if (pdata && pdata->otg)
+ 		usb_phy_shutdown(pdata->otg);
+ 
+ 	clk_disable_unprepare(priv->usbclk);
+diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
+index 279b0491..ec337c2b 100644
+--- a/drivers/usb/host/ohci-pci.c
++++ b/drivers/usb/host/ohci-pci.c
+@@ -289,7 +289,7 @@ static struct pci_driver ohci_pci_driver = {
+ 	.remove =	usb_hcd_pci_remove,
+ 	.shutdown =	usb_hcd_pci_shutdown,
+ 
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_PM
+ 	.driver =	{
+ 		.pm =	&usb_hcd_pci_pm_ops
+ 	},
+diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h
+index 8d7a1324..9fe3225e 100644
+--- a/drivers/usb/host/xhci-ext-caps.h
++++ b/drivers/usb/host/xhci-ext-caps.h
+@@ -71,7 +71,7 @@
+ 
+ /* USB 2.0 xHCI 1.0 hardware LMP capability - section 7.2.2.1.3.2 */
+ #define XHCI_HLC               (1 << 19)
+-#define XHCI_BLC               (1 << 19)
++#define XHCI_BLC               (1 << 20)
+ 
+ /* command register values to disable interrupts and halt the HC */
+ /* start/stop HC execution - do not write unless HC is halted*/
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 51e22bf8..6eca5a53 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -24,7 +24,7 @@ static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 	 * here that the generic code does not try to make a pci_dev from our
+ 	 * dev struct in order to setup MSI
+ 	 */
+-	xhci->quirks |= XHCI_BROKEN_MSI;
++	xhci->quirks |= XHCI_PLAT;
+ }
+ 
+ /* called during probe() after chip reset completes */
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 9478caa2..b3c4162c 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -343,9 +343,14 @@ static void __maybe_unused xhci_msix_sync_irqs(struct xhci_hcd *xhci)
+ static int xhci_try_enable_msi(struct usb_hcd *hcd)
+ {
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+-	struct pci_dev  *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
++	struct pci_dev  *pdev;
+ 	int ret;
+ 
++	/* The xhci platform device has set up IRQs through usb_add_hcd. */
++	if (xhci->quirks & XHCI_PLAT)
++		return 0;
++
++	pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+ 	/*
+ 	 * Some Fresco Logic host controllers advertise MSI, but fail to
+ 	 * generate interrupts.  Don't even try to enable MSI.
+@@ -3581,10 +3586,21 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ 	struct xhci_virt_device *virt_dev;
++	struct device *dev = hcd->self.controller;
+ 	unsigned long flags;
+ 	u32 state;
+ 	int i, ret;
+ 
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++	/*
++	 * We called pm_runtime_get_noresume when the device was attached.
++	 * Decrement the counter here to allow controller to runtime suspend
++	 * if no devices remain.
++	 */
++	if (xhci->quirks & XHCI_RESET_ON_RESUME)
++		pm_runtime_put_noidle(dev);
++#endif
++
+ 	ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
+ 	/* If the host is halted due to driver unload, we still need to free the
+ 	 * device.
+@@ -3656,6 +3672,7 @@ static int xhci_reserve_host_control_ep_resources(struct xhci_hcd *xhci)
+ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++	struct device *dev = hcd->self.controller;
+ 	unsigned long flags;
+ 	int timeleft;
+ 	int ret;
+@@ -3708,6 +3725,16 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ 		goto disable_slot;
+ 	}
+ 	udev->slot_id = xhci->slot_id;
++
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++	/*
++	 * If resetting upon resume, we can't put the controller into runtime
++	 * suspend if there is a device attached.
++	 */
++	if (xhci->quirks & XHCI_RESET_ON_RESUME)
++		pm_runtime_get_noresume(dev);
++#endif
++
+ 	/* Is this a LS or FS device under a HS hub? */
+ 	/* Hub or peripherial? */
+ 	return 1;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index c338741a..6ab1e600 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1542,6 +1542,7 @@ struct xhci_hcd {
+ #define XHCI_SPURIOUS_REBOOT	(1 << 13)
+ #define XHCI_COMP_MODE_QUIRK	(1 << 14)
+ #define XHCI_AVOID_BEI		(1 << 15)
++#define XHCI_PLAT		(1 << 16)
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
+ 	/* There are two roothubs to keep track of bus suspend info for */
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index b0130016..84657e07 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -374,7 +374,7 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ 		kfree(urbtrack);
+ 		return -ENOMEM;
+ 	}
+-	urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
++	urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_ATOMIC);
+ 	if (!urbtrack->setup) {
+ 		usb_free_urb(urbtrack->urb);
+ 		kfree(urbtrack);
+@@ -382,8 +382,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ 	}
+ 	urbtrack->setup->bRequestType = (__u8)0x40;
+ 	urbtrack->setup->bRequest = (__u8)0x0e;
+-	urbtrack->setup->wValue = get_reg_value(reg, dummy);
+-	urbtrack->setup->wIndex = get_reg_index(reg);
++	urbtrack->setup->wValue = cpu_to_le16(get_reg_value(reg, dummy));
++	urbtrack->setup->wIndex = cpu_to_le16(get_reg_index(reg));
+ 	urbtrack->setup->wLength = 0;
+ 	usb_fill_control_urb(urbtrack->urb, usbdev,
+ 			     usb_sndctrlpipe(usbdev, 0),
+diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
+index 04cdeb8e..c4d22988 100644
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -730,9 +730,18 @@ void gnttab_request_free_callback(struct gnttab_free_callback *callback,
+ 				  void (*fn)(void *), void *arg, u16 count)
+ {
+ 	unsigned long flags;
++	struct gnttab_free_callback *cb;
++
+ 	spin_lock_irqsave(&gnttab_list_lock, flags);
+-	if (callback->next)
+-		goto out;
++
++	/* Check if the callback is already on the list */
++	cb = gnttab_free_callback_list;
++	while (cb) {
++		if (cb == callback)
++			goto out;
++		cb = cb->next;
++	}
++
+ 	callback->fn = fn;
+ 	callback->arg = arg;
+ 	callback->count = count;
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 238a0554..9877a2a2 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -3312,6 +3312,9 @@ static long btrfs_ioctl_dev_replace(struct btrfs_root *root, void __user *arg)
+ 
+ 	switch (p->cmd) {
+ 	case BTRFS_IOCTL_DEV_REPLACE_CMD_START:
++		if (root->fs_info->sb->s_flags & MS_RDONLY)
++			return -EROFS;
++
+ 		if (atomic_xchg(
+ 			&root->fs_info->mutually_exclusive_operation_running,
+ 			1)) {
+diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
+index e0b4ef31..a5ce62eb 100644
+--- a/fs/ceph/ioctl.c
++++ b/fs/ceph/ioctl.c
+@@ -196,8 +196,10 @@ static long ceph_ioctl_get_dataloc(struct file *file, void __user *arg)
+ 	r = ceph_calc_file_object_mapping(&ci->i_layout, dl.file_offset, len,
+ 					  &dl.object_no, &dl.object_offset,
+ 					  &olen);
+-	if (r < 0)
++	if (r < 0) {
++		up_read(&osdc->map_sem);
+ 		return -EIO;
++	}
+ 	dl.file_offset -= dl.object_offset;
+ 	dl.object_size = ceph_file_layout_object_size(ci->i_layout);
+ 	dl.block_size = ceph_file_layout_su(ci->i_layout);
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index d67c550c..37950c65 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -379,6 +379,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ 		try_to_freeze();
+ 
+ 		/* we should try only the port we connected to before */
++		mutex_lock(&server->srv_mutex);
+ 		rc = generic_ip_connect(server);
+ 		if (rc) {
+ 			cifs_dbg(FYI, "reconnect error %d\n", rc);
+@@ -390,6 +391,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ 				server->tcpStatus = CifsNeedNegotiate;
+ 			spin_unlock(&GlobalMid_Lock);
+ 		}
++		mutex_unlock(&server->srv_mutex);
+ 	} while (server->tcpStatus == CifsNeedReconnect);
+ 
+ 	return rc;
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index b0c43345..f851d03f 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -417,96 +417,108 @@ cifs_ses_oplock_break(struct work_struct *work)
+ }
+ 
+ static bool
+-smb2_is_valid_lease_break(char *buffer, struct TCP_Server_Info *server)
++smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
++		    struct smb2_lease_break_work *lw)
+ {
+-	struct smb2_lease_break *rsp = (struct smb2_lease_break *)buffer;
+-	struct list_head *tmp, *tmp1, *tmp2;
+-	struct cifs_ses *ses;
+-	struct cifs_tcon *tcon;
+-	struct cifsInodeInfo *cinode;
++	bool found;
++	__u8 lease_state;
++	struct list_head *tmp;
+ 	struct cifsFileInfo *cfile;
+ 	struct cifs_pending_open *open;
+-	struct smb2_lease_break_work *lw;
+-	bool found;
++	struct cifsInodeInfo *cinode;
+ 	int ack_req = le32_to_cpu(rsp->Flags &
+ 				  SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED);
+ 
+-	lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
+-	if (!lw)
+-		return false;
++	lease_state = smb2_map_lease_to_oplock(rsp->NewLeaseState);
+ 
+-	INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
+-	lw->lease_state = rsp->NewLeaseState;
++	list_for_each(tmp, &tcon->openFileList) {
++		cfile = list_entry(tmp, struct cifsFileInfo, tlist);
++		cinode = CIFS_I(cfile->dentry->d_inode);
+ 
+-	cifs_dbg(FYI, "Checking for lease break\n");
++		if (memcmp(cinode->lease_key, rsp->LeaseKey,
++							SMB2_LEASE_KEY_SIZE))
++			continue;
+ 
+-	/* look up tcon based on tid & uid */
+-	spin_lock(&cifs_tcp_ses_lock);
+-	list_for_each(tmp, &server->smb_ses_list) {
+-		ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
++		cifs_dbg(FYI, "found in the open list\n");
++		cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
++			 le32_to_cpu(rsp->NewLeaseState));
+ 
+-		spin_lock(&cifs_file_list_lock);
+-		list_for_each(tmp1, &ses->tcon_list) {
+-			tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
++		smb2_set_oplock_level(cinode, lease_state);
+ 
+-			cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks);
+-			list_for_each(tmp2, &tcon->openFileList) {
+-				cfile = list_entry(tmp2, struct cifsFileInfo,
+-						   tlist);
+-				cinode = CIFS_I(cfile->dentry->d_inode);
++		if (ack_req)
++			cfile->oplock_break_cancelled = false;
++		else
++			cfile->oplock_break_cancelled = true;
+ 
+-				if (memcmp(cinode->lease_key, rsp->LeaseKey,
+-					   SMB2_LEASE_KEY_SIZE))
+-					continue;
++		queue_work(cifsiod_wq, &cfile->oplock_break);
++		kfree(lw);
++		return true;
++	}
+ 
+-				cifs_dbg(FYI, "found in the open list\n");
+-				cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
+-					 le32_to_cpu(rsp->NewLeaseState));
++	found = false;
++	list_for_each_entry(open, &tcon->pending_opens, olist) {
++		if (memcmp(open->lease_key, rsp->LeaseKey,
++			   SMB2_LEASE_KEY_SIZE))
++			continue;
++
++		if (!found && ack_req) {
++			found = true;
++			memcpy(lw->lease_key, open->lease_key,
++			       SMB2_LEASE_KEY_SIZE);
++			lw->tlink = cifs_get_tlink(open->tlink);
++			queue_work(cifsiod_wq, &lw->lease_break);
++		}
+ 
+-				smb2_set_oplock_level(cinode,
+-				  smb2_map_lease_to_oplock(rsp->NewLeaseState));
++		cifs_dbg(FYI, "found in the pending open list\n");
++		cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
++			 le32_to_cpu(rsp->NewLeaseState));
+ 
+-				if (ack_req)
+-					cfile->oplock_break_cancelled = false;
+-				else
+-					cfile->oplock_break_cancelled = true;
++		open->oplock = lease_state;
++	}
++	return found;
++}
+ 
+-				queue_work(cifsiod_wq, &cfile->oplock_break);
++static bool
++smb2_is_valid_lease_break(char *buffer)
++{
++	struct smb2_lease_break *rsp = (struct smb2_lease_break *)buffer;
++	struct list_head *tmp, *tmp1, *tmp2;
++	struct TCP_Server_Info *server;
++	struct cifs_ses *ses;
++	struct cifs_tcon *tcon;
++	struct smb2_lease_break_work *lw;
+ 
+-				spin_unlock(&cifs_file_list_lock);
+-				spin_unlock(&cifs_tcp_ses_lock);
+-				return true;
+-			}
++	lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
++	if (!lw)
++		return false;
+ 
+-			found = false;
+-			list_for_each_entry(open, &tcon->pending_opens, olist) {
+-				if (memcmp(open->lease_key, rsp->LeaseKey,
+-					   SMB2_LEASE_KEY_SIZE))
+-					continue;
++	INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
++	lw->lease_state = rsp->NewLeaseState;
+ 
+-				if (!found && ack_req) {
+-					found = true;
+-					memcpy(lw->lease_key, open->lease_key,
+-					       SMB2_LEASE_KEY_SIZE);
+-					lw->tlink = cifs_get_tlink(open->tlink);
+-					queue_work(cifsiod_wq,
+-						   &lw->lease_break);
+-				}
++	cifs_dbg(FYI, "Checking for lease break\n");
++
++	/* look up tcon based on tid & uid */
++	spin_lock(&cifs_tcp_ses_lock);
++	list_for_each(tmp, &cifs_tcp_ses_list) {
++		server = list_entry(tmp, struct TCP_Server_Info, tcp_ses_list);
+ 
+-				cifs_dbg(FYI, "found in the pending open list\n");
+-				cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
+-					 le32_to_cpu(rsp->NewLeaseState));
++		list_for_each(tmp1, &server->smb_ses_list) {
++			ses = list_entry(tmp1, struct cifs_ses, smb_ses_list);
+ 
+-				open->oplock =
+-				  smb2_map_lease_to_oplock(rsp->NewLeaseState);
+-			}
+-			if (found) {
+-				spin_unlock(&cifs_file_list_lock);
+-				spin_unlock(&cifs_tcp_ses_lock);
+-				return true;
++			spin_lock(&cifs_file_list_lock);
++			list_for_each(tmp2, &ses->tcon_list) {
++				tcon = list_entry(tmp2, struct cifs_tcon,
++						  tcon_list);
++				cifs_stats_inc(
++				    &tcon->stats.cifs_stats.num_oplock_brks);
++				if (smb2_tcon_has_lease(tcon, rsp, lw)) {
++					spin_unlock(&cifs_file_list_lock);
++					spin_unlock(&cifs_tcp_ses_lock);
++					return true;
++				}
+ 			}
++			spin_unlock(&cifs_file_list_lock);
+ 		}
+-		spin_unlock(&cifs_file_list_lock);
+ 	}
+ 	spin_unlock(&cifs_tcp_ses_lock);
+ 	kfree(lw);
+@@ -532,7 +544,7 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ 	if (rsp->StructureSize !=
+ 				smb2_rsp_struct_sizes[SMB2_OPLOCK_BREAK_HE]) {
+ 		if (le16_to_cpu(rsp->StructureSize) == 44)
+-			return smb2_is_valid_lease_break(buffer, server);
++			return smb2_is_valid_lease_break(buffer);
+ 		else
+ 			return false;
+ 	}
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index c2ca04e6..ea4d1884 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1890,6 +1890,26 @@ static int ext4_writepage(struct page *page,
+ 	return ret;
+ }
+ 
++static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page)
++{
++	int len;
++	loff_t size = i_size_read(mpd->inode);
++	int err;
++
++	BUG_ON(page->index != mpd->first_page);
++	if (page->index == size >> PAGE_CACHE_SHIFT)
++		len = size & ~PAGE_CACHE_MASK;
++	else
++		len = PAGE_CACHE_SIZE;
++	clear_page_dirty_for_io(page);
++	err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc);
++	if (!err)
++		mpd->wbc->nr_to_write--;
++	mpd->first_page++;
++
++	return err;
++}
++
+ #define BH_FLAGS ((1 << BH_Unwritten) | (1 << BH_Delay))
+ 
+ /*
+@@ -1904,82 +1924,94 @@ static int ext4_writepage(struct page *page,
+  *
+  * @mpd - extent of blocks
+  * @lblk - logical number of the block in the file
+- * @b_state - b_state of the buffer head added
++ * @bh - buffer head we want to add to the extent
+  *
+- * the function is used to collect contig. blocks in same state
++ * The function is used to collect contig. blocks in the same state. If the
++ * buffer doesn't require mapping for writeback and we haven't started the
++ * extent of buffers to map yet, the function returns 'true' immediately - the
++ * caller can write the buffer right away. Otherwise the function returns true
++ * if the block has been added to the extent, false if the block couldn't be
++ * added.
+  */
+-static int mpage_add_bh_to_extent(struct mpage_da_data *mpd, ext4_lblk_t lblk,
+-				  unsigned long b_state)
++static bool mpage_add_bh_to_extent(struct mpage_da_data *mpd, ext4_lblk_t lblk,
++				   struct buffer_head *bh)
+ {
+ 	struct ext4_map_blocks *map = &mpd->map;
+ 
+-	/* Don't go larger than mballoc is willing to allocate */
+-	if (map->m_len >= MAX_WRITEPAGES_EXTENT_LEN)
+-		return 0;
++	/* Buffer that doesn't need mapping for writeback? */
++	if (!buffer_dirty(bh) || !buffer_mapped(bh) ||
++	    (!buffer_delay(bh) && !buffer_unwritten(bh))) {
++		/* So far no extent to map => we write the buffer right away */
++		if (map->m_len == 0)
++			return true;
++		return false;
++	}
+ 
+ 	/* First block in the extent? */
+ 	if (map->m_len == 0) {
+ 		map->m_lblk = lblk;
+ 		map->m_len = 1;
+-		map->m_flags = b_state & BH_FLAGS;
+-		return 1;
++		map->m_flags = bh->b_state & BH_FLAGS;
++		return true;
+ 	}
+ 
++	/* Don't go larger than mballoc is willing to allocate */
++	if (map->m_len >= MAX_WRITEPAGES_EXTENT_LEN)
++		return false;
++
+ 	/* Can we merge the block to our big extent? */
+ 	if (lblk == map->m_lblk + map->m_len &&
+-	    (b_state & BH_FLAGS) == map->m_flags) {
++	    (bh->b_state & BH_FLAGS) == map->m_flags) {
+ 		map->m_len++;
+-		return 1;
++		return true;
+ 	}
+-	return 0;
++	return false;
+ }
+ 
+-static bool add_page_bufs_to_extent(struct mpage_da_data *mpd,
+-				    struct buffer_head *head,
+-				    struct buffer_head *bh,
+-				    ext4_lblk_t lblk)
++/*
++ * mpage_process_page_bufs - submit page buffers for IO or add them to extent
++ *
++ * @mpd - extent of blocks for mapping
++ * @head - the first buffer in the page
++ * @bh - buffer we should start processing from
++ * @lblk - logical number of the block in the file corresponding to @bh
++ *
++ * Walk through page buffers from @bh upto @head (exclusive) and either submit
++ * the page for IO if all buffers in this page were mapped and there's no
++ * accumulated extent of buffers to map or add buffers in the page to the
++ * extent of buffers to map. The function returns 1 if the caller can continue
++ * by processing the next page, 0 if it should stop adding buffers to the
++ * extent to map because we cannot extend it anymore. It can also return value
++ * < 0 in case of error during IO submission.
++ */
++static int mpage_process_page_bufs(struct mpage_da_data *mpd,
++				   struct buffer_head *head,
++				   struct buffer_head *bh,
++				   ext4_lblk_t lblk)
+ {
+ 	struct inode *inode = mpd->inode;
++	int err;
+ 	ext4_lblk_t blocks = (i_size_read(inode) + (1 << inode->i_blkbits) - 1)
+ 							>> inode->i_blkbits;
+ 
+ 	do {
+ 		BUG_ON(buffer_locked(bh));
+ 
+-		if (!buffer_dirty(bh) || !buffer_mapped(bh) ||
+-		    (!buffer_delay(bh) && !buffer_unwritten(bh)) ||
+-		    lblk >= blocks) {
++		if (lblk >= blocks || !mpage_add_bh_to_extent(mpd, lblk, bh)) {
+ 			/* Found extent to map? */
+ 			if (mpd->map.m_len)
+-				return false;
+-			if (lblk >= blocks)
+-				return true;
+-			continue;
++				return 0;
++			/* Everything mapped so far and we hit EOF */
++			break;
+ 		}
+-		if (!mpage_add_bh_to_extent(mpd, lblk, bh->b_state))
+-			return false;
+ 	} while (lblk++, (bh = bh->b_this_page) != head);
+-	return true;
+-}
+-
+-static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page)
+-{
+-	int len;
+-	loff_t size = i_size_read(mpd->inode);
+-	int err;
+-
+-	BUG_ON(page->index != mpd->first_page);
+-	if (page->index == size >> PAGE_CACHE_SHIFT)
+-		len = size & ~PAGE_CACHE_MASK;
+-	else
+-		len = PAGE_CACHE_SIZE;
+-	clear_page_dirty_for_io(page);
+-	err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc);
+-	if (!err)
+-		mpd->wbc->nr_to_write--;
+-	mpd->first_page++;
+-
+-	return err;
++	/* So far everything mapped? Submit the page for IO. */
++	if (mpd->map.m_len == 0) {
++		err = mpage_submit_page(mpd, head->b_page);
++		if (err < 0)
++			return err;
++	}
++	return lblk < blocks;
+ }
+ 
+ /*
+@@ -2003,8 +2035,6 @@ static int mpage_map_and_submit_buffers(struct mpage_da_data *mpd)
+ 	struct inode *inode = mpd->inode;
+ 	struct buffer_head *head, *bh;
+ 	int bpp_bits = PAGE_CACHE_SHIFT - inode->i_blkbits;
+-	ext4_lblk_t blocks = (i_size_read(inode) + (1 << inode->i_blkbits) - 1)
+-							>> inode->i_blkbits;
+ 	pgoff_t start, end;
+ 	ext4_lblk_t lblk;
+ 	sector_t pblock;
+@@ -2039,18 +2069,26 @@ static int mpage_map_and_submit_buffers(struct mpage_da_data *mpd)
+ 					 */
+ 					mpd->map.m_len = 0;
+ 					mpd->map.m_flags = 0;
+-					add_page_bufs_to_extent(mpd, head, bh,
+-								lblk);
++					/*
++					 * FIXME: If dioread_nolock supports
++					 * blocksize < pagesize, we need to make
++					 * sure we add size mapped so far to
++					 * io_end->size as the following call
++					 * can submit the page for IO.
++					 */
++					err = mpage_process_page_bufs(mpd, head,
++								      bh, lblk);
+ 					pagevec_release(&pvec);
+-					return 0;
++					if (err > 0)
++						err = 0;
++					return err;
+ 				}
+ 				if (buffer_delay(bh)) {
+ 					clear_buffer_delay(bh);
+ 					bh->b_blocknr = pblock++;
+ 				}
+ 				clear_buffer_unwritten(bh);
+-			} while (++lblk < blocks &&
+-				 (bh = bh->b_this_page) != head);
++			} while (lblk++, (bh = bh->b_this_page) != head);
+ 
+ 			/*
+ 			 * FIXME: This is going to break if dioread_nolock
+@@ -2319,14 +2357,10 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd)
+ 			lblk = ((ext4_lblk_t)page->index) <<
+ 				(PAGE_CACHE_SHIFT - blkbits);
+ 			head = page_buffers(page);
+-			if (!add_page_bufs_to_extent(mpd, head, head, lblk))
++			err = mpage_process_page_bufs(mpd, head, head, lblk);
++			if (err <= 0)
+ 				goto out;
+-			/* So far everything mapped? Submit the page for IO. */
+-			if (mpd->map.m_len == 0) {
+-				err = mpage_submit_page(mpd, page);
+-				if (err < 0)
+-					goto out;
+-			}
++			err = 0;
+ 
+ 			/*
+ 			 * Accumulated enough dirty pages? This doesn't apply
+@@ -4566,7 +4600,9 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ 		ext4_journal_stop(handle);
+ 	}
+ 
+-	if (attr->ia_valid & ATTR_SIZE) {
++	if (attr->ia_valid & ATTR_SIZE && attr->ia_size != inode->i_size) {
++		handle_t *handle;
++		loff_t oldsize = inode->i_size;
+ 
+ 		if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
+ 			struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+@@ -4574,73 +4610,60 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ 			if (attr->ia_size > sbi->s_bitmap_maxbytes)
+ 				return -EFBIG;
+ 		}
+-	}
+-
+-	if (S_ISREG(inode->i_mode) &&
+-	    attr->ia_valid & ATTR_SIZE &&
+-	    (attr->ia_size < inode->i_size)) {
+-		handle_t *handle;
+-
+-		handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
+-		if (IS_ERR(handle)) {
+-			error = PTR_ERR(handle);
+-			goto err_out;
+-		}
+-		if (ext4_handle_valid(handle)) {
+-			error = ext4_orphan_add(handle, inode);
+-			orphan = 1;
+-		}
+-		EXT4_I(inode)->i_disksize = attr->ia_size;
+-		rc = ext4_mark_inode_dirty(handle, inode);
+-		if (!error)
+-			error = rc;
+-		ext4_journal_stop(handle);
+-
+-		if (ext4_should_order_data(inode)) {
+-			error = ext4_begin_ordered_truncate(inode,
++		if (S_ISREG(inode->i_mode) &&
++		    (attr->ia_size < inode->i_size)) {
++			if (ext4_should_order_data(inode)) {
++				error = ext4_begin_ordered_truncate(inode,
+ 							    attr->ia_size);
+-			if (error) {
+-				/* Do as much error cleanup as possible */
+-				handle = ext4_journal_start(inode,
+-							    EXT4_HT_INODE, 3);
+-				if (IS_ERR(handle)) {
+-					ext4_orphan_del(NULL, inode);
++				if (error)
+ 					goto err_out;
+-				}
+-				ext4_orphan_del(handle, inode);
+-				orphan = 0;
+-				ext4_journal_stop(handle);
++			}
++			handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
++			if (IS_ERR(handle)) {
++				error = PTR_ERR(handle);
++				goto err_out;
++			}
++			if (ext4_handle_valid(handle)) {
++				error = ext4_orphan_add(handle, inode);
++				orphan = 1;
++			}
++			EXT4_I(inode)->i_disksize = attr->ia_size;
++			rc = ext4_mark_inode_dirty(handle, inode);
++			if (!error)
++				error = rc;
++			ext4_journal_stop(handle);
++			if (error) {
++				ext4_orphan_del(NULL, inode);
+ 				goto err_out;
+ 			}
+ 		}
+-	}
+-
+-	if (attr->ia_valid & ATTR_SIZE) {
+-		if (attr->ia_size != inode->i_size) {
+-			loff_t oldsize = inode->i_size;
+ 
+-			i_size_write(inode, attr->ia_size);
+-			/*
+-			 * Blocks are going to be removed from the inode. Wait
+-			 * for dio in flight.  Temporarily disable
+-			 * dioread_nolock to prevent livelock.
+-			 */
+-			if (orphan) {
+-				if (!ext4_should_journal_data(inode)) {
+-					ext4_inode_block_unlocked_dio(inode);
+-					inode_dio_wait(inode);
+-					ext4_inode_resume_unlocked_dio(inode);
+-				} else
+-					ext4_wait_for_tail_page_commit(inode);
+-			}
+-			/*
+-			 * Truncate pagecache after we've waited for commit
+-			 * in data=journal mode to make pages freeable.
+-			 */
+-			truncate_pagecache(inode, oldsize, inode->i_size);
++		i_size_write(inode, attr->ia_size);
++		/*
++		 * Blocks are going to be removed from the inode. Wait
++		 * for dio in flight.  Temporarily disable
++		 * dioread_nolock to prevent livelock.
++		 */
++		if (orphan) {
++			if (!ext4_should_journal_data(inode)) {
++				ext4_inode_block_unlocked_dio(inode);
++				inode_dio_wait(inode);
++				ext4_inode_resume_unlocked_dio(inode);
++			} else
++				ext4_wait_for_tail_page_commit(inode);
+ 		}
+-		ext4_truncate(inode);
++		/*
++		 * Truncate pagecache after we've waited for commit
++		 * in data=journal mode to make pages freeable.
++		 */
++		truncate_pagecache(inode, oldsize, inode->i_size);
+ 	}
++	/*
++	 * We want to call ext4_truncate() even if attr->ia_size ==
++	 * inode->i_size for cases like truncation of fallocated space
++	 */
++	if (attr->ia_valid & ATTR_SIZE)
++		ext4_truncate(inode);
+ 
+ 	if (!rc) {
+ 		setattr_copy(inode, attr);
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 72a5d5b0..8fec28ff 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1174,6 +1174,8 @@ static int parse_dirfile(char *buf, size_t nbytes, struct file *file,
+ 			return -EIO;
+ 		if (reclen > nbytes)
+ 			break;
++		if (memchr(dirent->name, '/', dirent->namelen) != NULL)
++			return -EIO;
+ 
+ 		if (!dir_emit(ctx, dirent->name, dirent->namelen,
+ 			       dirent->ino, dirent->type))
+@@ -1320,6 +1322,8 @@ static int parse_dirplusfile(char *buf, size_t nbytes, struct file *file,
+ 			return -EIO;
+ 		if (reclen > nbytes)
+ 			break;
++		if (memchr(dirent->name, '/', dirent->namelen) != NULL)
++			return -EIO;
+ 
+ 		if (!over) {
+ 			/* We fill entries into dstbuf only as much as
+@@ -1590,6 +1594,7 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
+ 		    struct file *file)
+ {
+ 	struct fuse_conn *fc = get_fuse_conn(inode);
++	struct fuse_inode *fi = get_fuse_inode(inode);
+ 	struct fuse_req *req;
+ 	struct fuse_setattr_in inarg;
+ 	struct fuse_attr_out outarg;
+@@ -1617,8 +1622,10 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
+ 	if (IS_ERR(req))
+ 		return PTR_ERR(req);
+ 
+-	if (is_truncate)
++	if (is_truncate) {
+ 		fuse_set_nowrite(inode);
++		set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
++	}
+ 
+ 	memset(&inarg, 0, sizeof(inarg));
+ 	memset(&outarg, 0, sizeof(outarg));
+@@ -1680,12 +1687,14 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
+ 		invalidate_inode_pages2(inode->i_mapping);
+ 	}
+ 
++	clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ 	return 0;
+ 
+ error:
+ 	if (is_truncate)
+ 		fuse_release_nowrite(inode);
+ 
++	clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ 	return err;
+ }
+ 
+@@ -1749,6 +1758,8 @@ static int fuse_setxattr(struct dentry *entry, const char *name,
+ 		fc->no_setxattr = 1;
+ 		err = -EOPNOTSUPP;
+ 	}
++	if (!err)
++		fuse_invalidate_attr(inode);
+ 	return err;
+ }
+ 
+@@ -1878,6 +1889,8 @@ static int fuse_removexattr(struct dentry *entry, const char *name)
+ 		fc->no_removexattr = 1;
+ 		err = -EOPNOTSUPP;
+ 	}
++	if (!err)
++		fuse_invalidate_attr(inode);
+ 	return err;
+ }
+ 
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 5c121fe1..d409deaf 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -629,7 +629,8 @@ static void fuse_read_update_size(struct inode *inode, loff_t size,
+ 	struct fuse_inode *fi = get_fuse_inode(inode);
+ 
+ 	spin_lock(&fc->lock);
+-	if (attr_ver == fi->attr_version && size < inode->i_size) {
++	if (attr_ver == fi->attr_version && size < inode->i_size &&
++	    !test_bit(FUSE_I_SIZE_UNSTABLE, &fi->state)) {
+ 		fi->attr_version = ++fc->attr_version;
+ 		i_size_write(inode, size);
+ 	}
+@@ -1032,12 +1033,16 @@ static ssize_t fuse_perform_write(struct file *file,
+ {
+ 	struct inode *inode = mapping->host;
+ 	struct fuse_conn *fc = get_fuse_conn(inode);
++	struct fuse_inode *fi = get_fuse_inode(inode);
+ 	int err = 0;
+ 	ssize_t res = 0;
+ 
+ 	if (is_bad_inode(inode))
+ 		return -EIO;
+ 
++	if (inode->i_size < pos + iov_iter_count(ii))
++		set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
++
+ 	do {
+ 		struct fuse_req *req;
+ 		ssize_t count;
+@@ -1073,6 +1078,7 @@ static ssize_t fuse_perform_write(struct file *file,
+ 	if (res > 0)
+ 		fuse_write_update_size(inode, pos);
+ 
++	clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ 	fuse_invalidate_attr(inode);
+ 
+ 	return res > 0 ? res : err;
+@@ -1529,7 +1535,6 @@ static int fuse_writepage_locked(struct page *page)
+ 
+ 	inc_bdi_stat(mapping->backing_dev_info, BDI_WRITEBACK);
+ 	inc_zone_page_state(tmp_page, NR_WRITEBACK_TEMP);
+-	end_page_writeback(page);
+ 
+ 	spin_lock(&fc->lock);
+ 	list_add(&req->writepages_entry, &fi->writepages);
+@@ -1537,6 +1542,8 @@ static int fuse_writepage_locked(struct page *page)
+ 	fuse_flush_writepages(inode);
+ 	spin_unlock(&fc->lock);
+ 
++	end_page_writeback(page);
++
+ 	return 0;
+ 
+ err_free:
+diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
+index fde7249a..5ced199b 100644
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -115,6 +115,8 @@ struct fuse_inode {
+ enum {
+ 	/** Advise readdirplus  */
+ 	FUSE_I_ADVISE_RDPLUS,
++	/** An operation changing file size is in progress  */
++	FUSE_I_SIZE_UNSTABLE,
+ };
+ 
+ struct fuse_conn;
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index 0b578598..e0fe703e 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -201,7 +201,8 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,
+ 	struct timespec old_mtime;
+ 
+ 	spin_lock(&fc->lock);
+-	if (attr_version != 0 && fi->attr_version > attr_version) {
++	if ((attr_version != 0 && fi->attr_version > attr_version) ||
++	    test_bit(FUSE_I_SIZE_UNSTABLE, &fi->state)) {
+ 		spin_unlock(&fc->lock);
+ 		return;
+ 	}
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index c348d6d8..e5d408a7 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -117,8 +117,8 @@ static void destroy_inodecache(void)
+ 
+ static int isofs_remount(struct super_block *sb, int *flags, char *data)
+ {
+-	/* we probably want a lot more here */
+-	*flags |= MS_RDONLY;
++	if (!(*flags & MS_RDONLY))
++		return -EROFS;
+ 	return 0;
+ }
+ 
+@@ -763,15 +763,6 @@ root_found:
+ 	 */
+ 	s->s_maxbytes = 0x80000000000LL;
+ 
+-	/*
+-	 * The CDROM is read-only, has no nodes (devices) on it, and since
+-	 * all of the files appear to be owned by root, we really do not want
+-	 * to allow suid.  (suid or devices will not show up unless we have
+-	 * Rock Ridge extensions)
+-	 */
+-
+-	s->s_flags |= MS_RDONLY /* | MS_NODEV | MS_NOSUID */;
+-
+ 	/* Set this for reference. Its not currently used except on write
+ 	   which we don't have .. */
+ 
+@@ -1530,6 +1521,9 @@ struct inode *isofs_iget(struct super_block *sb,
+ static struct dentry *isofs_mount(struct file_system_type *fs_type,
+ 	int flags, const char *dev_name, void *data)
+ {
++	/* We don't support read-write mounts */
++	if (!(flags & MS_RDONLY))
++		return ERR_PTR(-EACCES);
+ 	return mount_bdev(fs_type, flags, dev_name, data, isofs_fill_super);
+ }
+ 
+diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
+index 2487116d..84606472 100644
+--- a/fs/ocfs2/extent_map.c
++++ b/fs/ocfs2/extent_map.c
+@@ -781,7 +781,6 @@ int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ 	cpos = map_start >> osb->s_clustersize_bits;
+ 	mapping_end = ocfs2_clusters_for_bytes(inode->i_sb,
+ 					       map_start + map_len);
+-	mapping_end -= cpos;
+ 	is_last = 0;
+ 	while (cpos < mapping_end && !is_last) {
+ 		u32 fe_flags;
+diff --git a/fs/proc/root.c b/fs/proc/root.c
+index e0a790da..0e0e83c4 100644
+--- a/fs/proc/root.c
++++ b/fs/proc/root.c
+@@ -110,7 +110,8 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
+ 		ns = task_active_pid_ns(current);
+ 		options = data;
+ 
+-		if (!current_user_ns()->may_mount_proc)
++		if (!current_user_ns()->may_mount_proc ||
++		    !ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+ 			return ERR_PTR(-EPERM);
+ 	}
+ 
+diff --git a/include/linux/compat.h b/include/linux/compat.h
+index 7f0c1dd0..ec1aee4a 100644
+--- a/include/linux/compat.h
++++ b/include/linux/compat.h
+@@ -669,6 +669,13 @@ asmlinkage long compat_sys_sigaltstack(const compat_stack_t __user *uss_ptr,
+ 
+ int compat_restore_altstack(const compat_stack_t __user *uss);
+ int __compat_save_altstack(compat_stack_t __user *, unsigned long);
++#define compat_save_altstack_ex(uss, sp) do { \
++	compat_stack_t __user *__uss = uss; \
++	struct task_struct *t = current; \
++	put_user_ex(ptr_to_compat((void __user *)t->sas_ss_sp), &__uss->ss_sp); \
++	put_user_ex(sas_ss_flags(sp), &__uss->ss_flags); \
++	put_user_ex(t->sas_ss_size, &__uss->ss_size); \
++} while (0);
+ 
+ asmlinkage long compat_sys_sched_rr_get_interval(compat_pid_t pid,
+ 						 struct compat_timespec __user *interval);
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 0c48991b..ff545cc3 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -393,10 +393,12 @@ struct hid_report {
+ 	struct hid_device *device;			/* associated device */
+ };
+ 
++#define HID_MAX_IDS 256
++
+ struct hid_report_enum {
+ 	unsigned numbered;
+ 	struct list_head report_list;
+-	struct hid_report *report_id_hash[256];
++	struct hid_report *report_id_hash[HID_MAX_IDS];
+ };
+ 
+ #define HID_REPORT_TYPES 3
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index 3bed2e89..d1fe5d00 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -518,6 +518,8 @@
+ #define PCI_DEVICE_ID_AMD_11H_NB_MISC	0x1303
+ #define PCI_DEVICE_ID_AMD_11H_NB_LINK	0x1304
+ #define PCI_DEVICE_ID_AMD_15H_M10H_F3	0x1403
++#define PCI_DEVICE_ID_AMD_15H_M30H_NB_F3 0x141d
++#define PCI_DEVICE_ID_AMD_15H_M30H_NB_F4 0x141e
+ #define PCI_DEVICE_ID_AMD_15H_NB_F0	0x1600
+ #define PCI_DEVICE_ID_AMD_15H_NB_F1	0x1601
+ #define PCI_DEVICE_ID_AMD_15H_NB_F2	0x1602
+diff --git a/include/linux/rculist.h b/include/linux/rculist.h
+index f4b1001a..4106721c 100644
+--- a/include/linux/rculist.h
++++ b/include/linux/rculist.h
+@@ -267,8 +267,9 @@ static inline void list_splice_init_rcu(struct list_head *list,
+  */
+ #define list_first_or_null_rcu(ptr, type, member) \
+ 	({struct list_head *__ptr = (ptr); \
+-	  struct list_head __rcu *__next = list_next_rcu(__ptr); \
+-	  likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \
++	  struct list_head *__next = ACCESS_ONCE(__ptr->next); \
++	  likely(__ptr != __next) ? \
++		list_entry_rcu(__next, type, member) : NULL; \
+ 	})
+ 
+ /**
+diff --git a/include/linux/signal.h b/include/linux/signal.h
+index d8974847..2ac423bd 100644
+--- a/include/linux/signal.h
++++ b/include/linux/signal.h
+@@ -434,6 +434,14 @@ void signals_init(void);
+ int restore_altstack(const stack_t __user *);
+ int __save_altstack(stack_t __user *, unsigned long);
+ 
++#define save_altstack_ex(uss, sp) do { \
++	stack_t __user *__uss = uss; \
++	struct task_struct *t = current; \
++	put_user_ex((void __user *)t->sas_ss_sp, &__uss->ss_sp); \
++	put_user_ex(sas_ss_flags(sp), &__uss->ss_flags); \
++	put_user_ex(t->sas_ss_size, &__uss->ss_size); \
++} while (0);
++
+ #ifdef CONFIG_PROC_FS
+ struct seq_file;
+ extern void render_sigset_t(struct seq_file *, const char *, sigset_t *);
+diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
+index 1e88377e..3e541e63 100644
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -411,7 +411,7 @@ extern int usb_hcd_pci_probe(struct pci_dev *dev,
+ extern void usb_hcd_pci_remove(struct pci_dev *dev);
+ extern void usb_hcd_pci_shutdown(struct pci_dev *dev);
+ 
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_PM
+ extern const struct dev_pm_ops usb_hcd_pci_pm_ops;
+ #endif
+ #endif /* CONFIG_PCI */
+diff --git a/ipc/msg.c b/ipc/msg.c
+index 9f29d9e8..b65fdf1a 100644
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -680,16 +680,18 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
+ 		goto out_unlock1;
+ 	}
+ 
++	ipc_lock_object(&msq->q_perm);
++
+ 	for (;;) {
+ 		struct msg_sender s;
+ 
+ 		err = -EACCES;
+ 		if (ipcperms(ns, &msq->q_perm, S_IWUGO))
+-			goto out_unlock1;
++			goto out_unlock0;
+ 
+ 		err = security_msg_queue_msgsnd(msq, msg, msgflg);
+ 		if (err)
+-			goto out_unlock1;
++			goto out_unlock0;
+ 
+ 		if (msgsz + msq->q_cbytes <= msq->q_qbytes &&
+ 				1 + msq->q_qnum <= msq->q_qbytes) {
+@@ -699,10 +701,9 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
+ 		/* queue full, wait: */
+ 		if (msgflg & IPC_NOWAIT) {
+ 			err = -EAGAIN;
+-			goto out_unlock1;
++			goto out_unlock0;
+ 		}
+ 
+-		ipc_lock_object(&msq->q_perm);
+ 		ss_add(msq, &s);
+ 
+ 		if (!ipc_rcu_getref(msq)) {
+@@ -730,10 +731,7 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
+ 			goto out_unlock0;
+ 		}
+ 
+-		ipc_unlock_object(&msq->q_perm);
+ 	}
+-
+-	ipc_lock_object(&msq->q_perm);
+ 	msq->q_lspid = task_tgid_vnr(current);
+ 	msq->q_stime = get_seconds();
+ 
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index f3569747..ad8e1bdc 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -1682,12 +1682,10 @@ static bool handle_trampoline(struct pt_regs *regs)
+ 		tmp = ri;
+ 		ri = ri->next;
+ 		kfree(tmp);
++		utask->depth--;
+ 
+ 		if (!chained)
+ 			break;
+-
+-		utask->depth--;
+-
+ 		BUG_ON(!ri);
+ 	}
+ 
+diff --git a/kernel/fork.c b/kernel/fork.c
+index bf46287c..200a7a29 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1173,10 +1173,11 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	/*
+-	 * If the new process will be in a different pid namespace
+-	 * don't allow the creation of threads.
++	 * If the new process will be in a different pid namespace don't
++	 * allow it to share a thread group or signal handlers with the
++	 * forking task.
+ 	 */
+-	if ((clone_flags & (CLONE_VM|CLONE_NEWPID)) &&
++	if ((clone_flags & (CLONE_SIGHAND | CLONE_NEWPID)) &&
+ 	    (task_active_pid_ns(current) !=
+ 	     current->nsproxy->pid_ns_for_children))
+ 		return ERR_PTR(-EINVAL);
+diff --git a/kernel/pid.c b/kernel/pid.c
+index 66505c1d..ebe5e80b 100644
+--- a/kernel/pid.c
++++ b/kernel/pid.c
+@@ -265,6 +265,7 @@ void free_pid(struct pid *pid)
+ 		struct pid_namespace *ns = upid->ns;
+ 		hlist_del_rcu(&upid->pid_chain);
+ 		switch(--ns->nr_hashed) {
++		case 2:
+ 		case 1:
+ 			/* When all that is left in the pid namespace
+ 			 * is the reaper wake up the reaper.  The reaper
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index a92012a7..f2820fbf 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2296,6 +2296,8 @@ static void collapse_huge_page(struct mm_struct *mm,
+ 		goto out;
+ 
+ 	vma = find_vma(mm, address);
++	if (!vma)
++		goto out;
+ 	hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ 	hend = vma->vm_end & HPAGE_PMD_MASK;
+ 	if (address < hstart || address + HPAGE_PMD_SIZE > hend)
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 0878ff7c..aa44621e 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -5616,7 +5616,13 @@ static int compare_thresholds(const void *a, const void *b)
+ 	const struct mem_cgroup_threshold *_a = a;
+ 	const struct mem_cgroup_threshold *_b = b;
+ 
+-	return _a->threshold - _b->threshold;
++	if (_a->threshold > _b->threshold)
++		return 1;
++
++	if (_a->threshold < _b->threshold)
++		return -1;
++
++	return 0;
+ }
+ 
+ static int mem_cgroup_oom_notify_cb(struct mem_cgroup *memcg)
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index dd47889a..dbc0a739 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -2129,6 +2129,8 @@ int ceph_osdc_start_request(struct ceph_osd_client *osdc,
+ 			dout("osdc_start_request failed map, "
+ 				" will retry %lld\n", req->r_tid);
+ 			rc = 0;
++		} else {
++			__unregister_request(osdc, req);
+ 		}
+ 		goto out_unlock;
+ 	}
+diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
+index 603ddd92..dbd9a479 100644
+--- a/net/ceph/osdmap.c
++++ b/net/ceph/osdmap.c
+@@ -1129,7 +1129,7 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
+ 
+ 	/* pg_temp? */
+ 	pgid.seed = ceph_stable_mod(pgid.seed, pool->pg_num,
+-				    pool->pgp_num_mask);
++				    pool->pg_num_mask);
+ 	pg = __lookup_pg_mapping(&osdmap->pg_temp, pgid);
+ 	if (pg) {
+ 		*num = pg->len;
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index cc9e02d7..7a98d524 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2851,14 +2851,6 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
+ 		ieee80211_rx_bss_put(local, bss);
+ 		sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
+ 	}
+-
+-	if (!sdata->u.mgd.associated ||
+-	    !ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid))
+-		return;
+-
+-	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
+-					 elems, true);
+-
+ }
+ 
+ 
+@@ -3147,6 +3139,9 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
+ 
+ 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
+ 
++	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
++					 &elems, true);
++
+ 	if (ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
+ 				     elems.wmm_param_len))
+ 		changed |= BSS_CHANGED_QOS;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 8860dd52..9552da23 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -3376,6 +3376,7 @@ static struct snd_pci_quirk msi_black_list[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
+ 	SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
+ 	SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
++	SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */
+ 	SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */
+ 	SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */
+ 	{}
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 9f358627..45850f67 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -67,6 +67,8 @@ struct hdmi_spec_per_pin {
+ 	struct delayed_work work;
+ 	struct snd_kcontrol *eld_ctl;
+ 	int repoll_count;
++	bool setup; /* the stream has been set up by prepare callback */
++	int channels; /* current number of channels */
+ 	bool non_pcm;
+ 	bool chmap_set;		/* channel-map override by ALSA API? */
+ 	unsigned char chmap[8]; /* ALSA API channel-map */
+@@ -551,6 +553,17 @@ static int hdmi_channel_allocation(struct hdmi_eld *eld, int channels)
+ 		}
+ 	}
+ 
++	if (!ca) {
++		/* if there was no match, select the regular ALSA channel
++		 * allocation with the matching number of channels */
++		for (i = 0; i < ARRAY_SIZE(channel_allocations); i++) {
++			if (channels == channel_allocations[i].channels) {
++				ca = channel_allocations[i].ca_index;
++				break;
++			}
++		}
++	}
++
+ 	snd_print_channel_allocation(eld->info.spk_alloc, buf, sizeof(buf));
+ 	snd_printdd("HDMI: select CA 0x%x for %d-channel allocation: %s\n",
+ 		    ca, channels, buf);
+@@ -868,18 +881,19 @@ static bool hdmi_infoframe_uptodate(struct hda_codec *codec, hda_nid_t pin_nid,
+ 	return true;
+ }
+ 
+-static void hdmi_setup_audio_infoframe(struct hda_codec *codec, int pin_idx,
+-				       bool non_pcm,
+-				       struct snd_pcm_substream *substream)
++static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
++				       struct hdmi_spec_per_pin *per_pin,
++				       bool non_pcm)
+ {
+-	struct hdmi_spec *spec = codec->spec;
+-	struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
+ 	hda_nid_t pin_nid = per_pin->pin_nid;
+-	int channels = substream->runtime->channels;
++	int channels = per_pin->channels;
+ 	struct hdmi_eld *eld;
+ 	int ca;
+ 	union audio_infoframe ai;
+ 
++	if (!channels)
++		return;
++
+ 	eld = &per_pin->sink_eld;
+ 	if (!eld->monitor_present)
+ 		return;
+@@ -1329,6 +1343,7 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
+ 		eld_changed = true;
+ 	}
+ 	if (update_eld) {
++		bool old_eld_valid = pin_eld->eld_valid;
+ 		pin_eld->eld_valid = eld->eld_valid;
+ 		eld_changed = pin_eld->eld_size != eld->eld_size ||
+ 			      memcmp(pin_eld->eld_buffer, eld->eld_buffer,
+@@ -1338,6 +1353,18 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
+ 			       eld->eld_size);
+ 		pin_eld->eld_size = eld->eld_size;
+ 		pin_eld->info = eld->info;
++
++		/* Haswell-specific workaround: re-setup when the transcoder is
++		 * changed during the stream playback
++		 */
++		if (codec->vendor_id == 0x80862807 &&
++		    eld->eld_valid && !old_eld_valid && per_pin->setup) {
++			snd_hda_codec_write(codec, pin_nid, 0,
++					    AC_VERB_SET_AMP_GAIN_MUTE,
++					    AMP_OUT_UNMUTE);
++			hdmi_setup_audio_infoframe(codec, per_pin,
++						   per_pin->non_pcm);
++		}
+ 	}
+ 	mutex_unlock(&pin_eld->lock);
+ 
+@@ -1510,14 +1537,17 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
+ 	hda_nid_t cvt_nid = hinfo->nid;
+ 	struct hdmi_spec *spec = codec->spec;
+ 	int pin_idx = hinfo_to_pin_index(spec, hinfo);
+-	hda_nid_t pin_nid = get_pin(spec, pin_idx)->pin_nid;
++	struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
++	hda_nid_t pin_nid = per_pin->pin_nid;
+ 	bool non_pcm;
+ 
+ 	non_pcm = check_non_pcm_per_cvt(codec, cvt_nid);
++	per_pin->channels = substream->runtime->channels;
++	per_pin->setup = true;
+ 
+ 	hdmi_set_channel_count(codec, cvt_nid, substream->runtime->channels);
+ 
+-	hdmi_setup_audio_infoframe(codec, pin_idx, non_pcm, substream);
++	hdmi_setup_audio_infoframe(codec, per_pin, non_pcm);
+ 
+ 	return hdmi_setup_stream(codec, cvt_nid, pin_nid, stream_tag, format);
+ }
+@@ -1557,6 +1587,9 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo,
+ 		snd_hda_spdif_ctls_unassign(codec, pin_idx);
+ 		per_pin->chmap_set = false;
+ 		memset(per_pin->chmap, 0, sizeof(per_pin->chmap));
++
++		per_pin->setup = false;
++		per_pin->channels = 0;
+ 	}
+ 
+ 	return 0;
+@@ -1692,8 +1725,7 @@ static int hdmi_chmap_ctl_put(struct snd_kcontrol *kcontrol,
+ 	per_pin->chmap_set = true;
+ 	memcpy(per_pin->chmap, chmap, sizeof(chmap));
+ 	if (prepared)
+-		hdmi_setup_audio_infoframe(codec, pin_idx, per_pin->non_pcm,
+-					   substream);
++		hdmi_setup_audio_infoframe(codec, per_pin, per_pin->non_pcm);
+ 
+ 	return 0;
+ }
+diff --git a/sound/soc/codecs/mc13783.c b/sound/soc/codecs/mc13783.c
+index 5402dfbb..8a8d9364 100644
+--- a/sound/soc/codecs/mc13783.c
++++ b/sound/soc/codecs/mc13783.c
+@@ -126,6 +126,10 @@ static int mc13783_write(struct snd_soc_codec *codec,
+ 
+ 	ret = mc13xxx_reg_write(priv->mc13xxx, reg, value);
+ 
++	/* include errata fix for spi audio problems */
++	if (reg == MC13783_AUDIO_CODEC || reg == MC13783_AUDIO_DAC)
++		ret = mc13xxx_reg_write(priv->mc13xxx, reg, value);
++
+ 	mc13xxx_unlock(priv->mc13xxx);
+ 
+ 	return ret;
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 0a4ffdd1..5e5af898 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -857,9 +857,9 @@ static int wm8960_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
+ 	if (pll_div.k) {
+ 		reg |= 0x20;
+ 
+-		snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 18) & 0x3f);
+-		snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 9) & 0x1ff);
+-		snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0x1ff);
++		snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 16) & 0xff);
++		snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 8) & 0xff);
++		snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0xff);
+ 	}
+ 	snd_soc_write(codec, WM8960_PLL1, reg);
+ 

Modified: genpatches-2.6/trunk/3.4/0000_README
===================================================================
--- genpatches-2.6/trunk/3.4/0000_README	2013-09-25 17:13:05 UTC (rev 2528)
+++ genpatches-2.6/trunk/3.4/0000_README	2013-09-27 17:20:08 UTC (rev 2529)
@@ -287,6 +287,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.4.62
 
+Patch:  1062_linux-3.4.63.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.4.63
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.4/1062_linux-3.4.63.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1062_linux-3.4.63.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.4/1062_linux-3.4.63.patch	2013-09-27 17:20:08 UTC (rev 2529)
@@ -0,0 +1,1055 @@
+diff --git a/Makefile b/Makefile
+index 3f23cb7e..94ce9416 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 62
++SUBLEVEL = 63
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
+index d2268be8..709beb1d 100644
+--- a/arch/arm/mach-versatile/pci.c
++++ b/arch/arm/mach-versatile/pci.c
+@@ -42,9 +42,9 @@
+ #define PCI_IMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x0)
+ #define PCI_IMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x4)
+ #define PCI_IMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x8)
+-#define PCI_SMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x10)
+-#define PCI_SMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
+-#define PCI_SMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP0		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
++#define PCI_SMAP1		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP2		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x1c)
+ #define PCI_SELFID		__IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0xc)
+ 
+ #define DEVICE_ID_OFFSET		0x00
+diff --git a/arch/mips/ath79/clock.c b/arch/mips/ath79/clock.c
+index 54d0eb4db..89276a2f 100644
+--- a/arch/mips/ath79/clock.c
++++ b/arch/mips/ath79/clock.c
+@@ -159,7 +159,7 @@ static void __init ar933x_clocks_init(void)
+ 		ath79_ahb_clk.rate = freq / t;
+ 	}
+ 
+-	ath79_wdt_clk.rate = ath79_ref_clk.rate;
++	ath79_wdt_clk.rate = ath79_ahb_clk.rate;
+ 	ath79_uart_clk.rate = ath79_ref_clk.rate;
+ }
+ 
+diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
+index ee5b690a..52e5758e 100644
+--- a/arch/powerpc/kernel/align.c
++++ b/arch/powerpc/kernel/align.c
+@@ -764,6 +764,16 @@ int fix_alignment(struct pt_regs *regs)
+ 	nb = aligninfo[instr].len;
+ 	flags = aligninfo[instr].flags;
+ 
++	/* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */
++	if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) {
++		nb = 8;
++		flags = LD+SW;
++	} else if (IS_XFORM(instruction) &&
++		   ((instruction >> 1) & 0x3ff) == 660) {
++		nb = 8;
++		flags = ST+SW;
++	}
++
+ 	/* Byteswap little endian loads and stores */
+ 	swiz = 0;
+ 	if (regs->msr & MSR_LE) {
+diff --git a/crypto/api.c b/crypto/api.c
+index 033a7147..4f98dd5b 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -40,6 +40,8 @@ static inline struct crypto_alg *crypto_alg_get(struct crypto_alg *alg)
+ 	return alg;
+ }
+ 
++static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg);
++
+ struct crypto_alg *crypto_mod_get(struct crypto_alg *alg)
+ {
+ 	return try_module_get(alg->cra_module) ? crypto_alg_get(alg) : NULL;
+@@ -150,8 +152,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,
+ 	}
+ 	up_write(&crypto_alg_sem);
+ 
+-	if (alg != &larval->alg)
++	if (alg != &larval->alg) {
+ 		kfree(larval);
++		if (crypto_is_larval(alg))
++			alg = crypto_larval_wait(alg);
++	}
+ 
+ 	return alg;
+ }
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 8b77fd31..efe172f3 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -125,6 +125,9 @@ static struct edid_quirk {
+ 
+ 	/* ViewSonic VA2026w */
+ 	{ "VSC", 5020, EDID_QUIRK_FORCE_REDUCED_BLANKING },
++
++	/* Medion MD 30217 PG */
++	{ "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
+ };
+ 
+ /*** DDC fetch and block validation ***/
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index ff73d60c..ab59fdf0 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -63,6 +63,8 @@ struct hid_report *hid_register_report(struct hid_device *device, unsigned type,
+ 	struct hid_report_enum *report_enum = device->report_enum + type;
+ 	struct hid_report *report;
+ 
++	if (id >= HID_MAX_IDS)
++		return NULL;
+ 	if (report_enum->report_id_hash[id])
+ 		return report_enum->report_id_hash[id];
+ 
+@@ -385,8 +387,10 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
+ 
+ 	case HID_GLOBAL_ITEM_TAG_REPORT_ID:
+ 		parser->global.report_id = item_udata(item);
+-		if (parser->global.report_id == 0) {
+-			hid_err(parser->device, "report_id 0 is invalid\n");
++		if (parser->global.report_id == 0 ||
++		    parser->global.report_id >= HID_MAX_IDS) {
++			hid_err(parser->device, "report_id %u is invalid\n",
++				parser->global.report_id);
+ 			return -1;
+ 		}
+ 		return 0;
+@@ -557,7 +561,7 @@ static void hid_device_release(struct device *dev)
+ 	for (i = 0; i < HID_REPORT_TYPES; i++) {
+ 		struct hid_report_enum *report_enum = device->report_enum + i;
+ 
+-		for (j = 0; j < 256; j++) {
++		for (j = 0; j < HID_MAX_IDS; j++) {
+ 			struct hid_report *report = report_enum->report_id_hash[j];
+ 			if (report)
+ 				hid_free_report(report);
+@@ -995,7 +999,12 @@ EXPORT_SYMBOL_GPL(hid_output_report);
+ 
+ int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
+ {
+-	unsigned size = field->report_size;
++	unsigned size;
++
++	if (!field)
++		return -1;
++
++	size = field->report_size;
+ 
+ 	hid_dump_input(field->report->device, field->usage + offset, value);
+ 
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 14d22399..8cc08e23 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -595,6 +595,7 @@
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16   0x0012
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17   0x0013
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18   0x0014
++#define USB_DEVICE_ID_NTRIG_DUOSENSE 0x1500
+ 
+ #define USB_VENDOR_ID_ONTRAK		0x0a07
+ #define USB_DEVICE_ID_ONTRAK_ADU100	0x0064
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 21e473e7..f03c684e 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -314,7 +314,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ {
+ 	struct hid_device *dev = container_of(psy, struct hid_device, battery);
+ 	int ret = 0;
+-	__u8 buf[2] = {};
++	__u8 *buf;
+ 
+ 	switch (prop) {
+ 	case POWER_SUPPLY_PROP_PRESENT:
+@@ -323,13 +323,20 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ 		break;
+ 
+ 	case POWER_SUPPLY_PROP_CAPACITY:
++
++		buf = kmalloc(2 * sizeof(__u8), GFP_KERNEL);
++		if (!buf) {
++			ret = -ENOMEM;
++			break;
++		}
+ 		ret = dev->hid_get_raw_report(dev, dev->battery_report_id,
+-					      buf, sizeof(buf),
++					      buf, 2,
+ 					      dev->battery_report_type);
+ 
+ 		if (ret != 2) {
+ 			if (ret >= 0)
+ 				ret = -EINVAL;
++			kfree(buf);
+ 			break;
+ 		}
+ 
+@@ -338,6 +345,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ 		    buf[1] <= dev->battery_max)
+ 			val->intval = (100 * (buf[1] - dev->battery_min)) /
+ 				(dev->battery_max - dev->battery_min);
++		kfree(buf);
+ 		break;
+ 
+ 	case POWER_SUPPLY_PROP_MODEL_NAME:
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index 9fae2ebd..48cba857 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev)
+ 	struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT].
+ 				    report_id_hash[0x0d];
+ 
+-	if (!report)
++	if (!report || report->maxfield < 1 ||
++	    report->field[0]->report_count < 1)
+ 		return -EINVAL;
+ 
+ 	usbhid_submit_report(hdev, report, USB_DIR_IN);
+diff --git a/drivers/hid/hid-pl.c b/drivers/hid/hid-pl.c
+index 47ed74c4..00cd2f8b 100644
+--- a/drivers/hid/hid-pl.c
++++ b/drivers/hid/hid-pl.c
+@@ -129,8 +129,14 @@ static int plff_init(struct hid_device *hid)
+ 			strong = &report->field[0]->value[2];
+ 			weak = &report->field[0]->value[3];
+ 			debug("detected single-field device");
+-		} else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 &&
+-				report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) {
++		} else if (report->field[0]->maxusage == 1 &&
++			   report->field[0]->usage[0].hid ==
++				(HID_UP_LED | 0x43) &&
++			   report->maxfield >= 4 &&
++			   report->field[0]->report_count >= 1 &&
++			   report->field[1]->report_count >= 1 &&
++			   report->field[2]->report_count >= 1 &&
++			   report->field[3]->report_count >= 1) {
+ 			report->field[0]->value[0] = 0x00;
+ 			report->field[1]->value[0] = 0x00;
+ 			strong = &report->field[2]->value[0];
+diff --git a/drivers/hid/hid-speedlink.c b/drivers/hid/hid-speedlink.c
+index 60201374..2b03c9ba 100644
+--- a/drivers/hid/hid-speedlink.c
++++ b/drivers/hid/hid-speedlink.c
+@@ -3,7 +3,7 @@
+  *  Fixes "jumpy" cursor and removes nonexistent keyboard LEDS from
+  *  the HID descriptor.
+  *
+- *  Copyright (c) 2011 Stefan Kriwanek <mail@××××××××××××××.de>
++ *  Copyright (c) 2011, 2013 Stefan Kriwanek <dev@××××××××××××××.de>
+  */
+ 
+ /*
+@@ -48,8 +48,13 @@ static int speedlink_event(struct hid_device *hdev, struct hid_field *field,
+ 		struct hid_usage *usage, __s32 value)
+ {
+ 	/* No other conditions due to usage_table. */
+-	/* Fix "jumpy" cursor (invalid events sent by device). */
+-	if (value == 256)
++
++	/* This fixes the "jumpy" cursor occuring due to invalid events sent
++	 * by the device. Some devices only send them with value==+256, others
++	 * don't. However, catching abs(value)>=256 is restrictive enough not
++	 * to interfere with devices that were bug-free (has been tested).
++	 */
++	if (abs(value) >= 256)
+ 		return 1;
+ 	/* Drop useless distance 0 events (on button clicks etc.) as well */
+ 	if (value == 0)
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 5c4112e6..d712294b 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -103,6 +103,8 @@ static const struct hid_blacklist {
+ 	{ USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
+ 	{ USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
+ 	{ USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
++	{ USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
++
+ 	{ 0, 0 }
+ };
+ 
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 17119247..a60a54d8 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -886,56 +886,54 @@ static int dma_pte_clear_range(struct dmar_domain *domain,
+ 	return order;
+ }
+ 
++static void dma_pte_free_level(struct dmar_domain *domain, int level,
++			       struct dma_pte *pte, unsigned long pfn,
++			       unsigned long start_pfn, unsigned long last_pfn)
++{
++	pfn = max(start_pfn, pfn);
++	pte = &pte[pfn_level_offset(pfn, level)];
++
++	do {
++		unsigned long level_pfn;
++		struct dma_pte *level_pte;
++
++		if (!dma_pte_present(pte) || dma_pte_superpage(pte))
++			goto next;
++
++		level_pfn = pfn & level_mask(level - 1);
++		level_pte = phys_to_virt(dma_pte_addr(pte));
++
++		if (level > 2)
++			dma_pte_free_level(domain, level - 1, level_pte,
++					   level_pfn, start_pfn, last_pfn);
++
++		/* If range covers entire pagetable, free it */
++		if (!(start_pfn > level_pfn ||
++		      last_pfn < level_pfn + level_size(level))) {
++			dma_clear_pte(pte);
++			domain_flush_cache(domain, pte, sizeof(*pte));
++			free_pgtable_page(level_pte);
++		}
++next:
++		pfn += level_size(level);
++	} while (!first_pte_in_page(++pte) && pfn <= last_pfn);
++}
++
+ /* free page table pages. last level pte should already be cleared */
+ static void dma_pte_free_pagetable(struct dmar_domain *domain,
+ 				   unsigned long start_pfn,
+ 				   unsigned long last_pfn)
+ {
+ 	int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
+-	struct dma_pte *first_pte, *pte;
+-	int total = agaw_to_level(domain->agaw);
+-	int level;
+-	unsigned long tmp;
+-	int large_page = 2;
+ 
+ 	BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
+ 	BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width);
+ 	BUG_ON(start_pfn > last_pfn);
+ 
+ 	/* We don't need lock here; nobody else touches the iova range */
+-	level = 2;
+-	while (level <= total) {
+-		tmp = align_to_level(start_pfn, level);
+-
+-		/* If we can't even clear one PTE at this level, we're done */
+-		if (tmp + level_size(level) - 1 > last_pfn)
+-			return;
+-
+-		do {
+-			large_page = level;
+-			first_pte = pte = dma_pfn_level_pte(domain, tmp, level, &large_page);
+-			if (large_page > level)
+-				level = large_page + 1;
+-			if (!pte) {
+-				tmp = align_to_level(tmp + 1, level + 1);
+-				continue;
+-			}
+-			do {
+-				if (dma_pte_present(pte)) {
+-					free_pgtable_page(phys_to_virt(dma_pte_addr(pte)));
+-					dma_clear_pte(pte);
+-				}
+-				pte++;
+-				tmp += level_size(level);
+-			} while (!first_pte_in_page(pte) &&
+-				 tmp + level_size(level) - 1 <= last_pfn);
++	dma_pte_free_level(domain, agaw_to_level(domain->agaw),
++			   domain->pgd, 0, start_pfn, last_pfn);
+ 
+-			domain_flush_cache(domain, first_pte,
+-					   (void *)pte - (void *)first_pte);
+-			
+-		} while (tmp && tmp + level_size(level) - 1 <= last_pfn);
+-		level++;
+-	}
+ 	/* free pgd */
+ 	if (start_pfn == 0 && last_pfn == DOMAIN_MAX_PFN(domain->gaw)) {
+ 		free_pgtable_page(domain->pgd);
+diff --git a/drivers/mmc/host/tmio_mmc_dma.c b/drivers/mmc/host/tmio_mmc_dma.c
+index fff92860..491e9ecc 100644
+--- a/drivers/mmc/host/tmio_mmc_dma.c
++++ b/drivers/mmc/host/tmio_mmc_dma.c
+@@ -104,6 +104,7 @@ static void tmio_mmc_start_dma_rx(struct tmio_mmc_host *host)
+ pio:
+ 	if (!desc) {
+ 		/* DMA failed, fall back to PIO */
++		tmio_mmc_enable_dma(host, false);
+ 		if (ret >= 0)
+ 			ret = -EIO;
+ 		host->chan_rx = NULL;
+@@ -116,7 +117,6 @@ pio:
+ 		}
+ 		dev_warn(&host->pdev->dev,
+ 			 "DMA failed: %d, falling back to PIO\n", ret);
+-		tmio_mmc_enable_dma(host, false);
+ 	}
+ 
+ 	dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d, sg[%d]\n", __func__,
+@@ -185,6 +185,7 @@ static void tmio_mmc_start_dma_tx(struct tmio_mmc_host *host)
+ pio:
+ 	if (!desc) {
+ 		/* DMA failed, fall back to PIO */
++		tmio_mmc_enable_dma(host, false);
+ 		if (ret >= 0)
+ 			ret = -EIO;
+ 		host->chan_tx = NULL;
+@@ -197,7 +198,6 @@ pio:
+ 		}
+ 		dev_warn(&host->pdev->dev,
+ 			 "DMA failed: %d, falling back to PIO\n", ret);
+-		tmio_mmc_enable_dma(host, false);
+ 	}
+ 
+ 	dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d\n", __func__,
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+index f86ee0c7..503ff9f6 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -1030,6 +1030,10 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah,
+ 		 * is_on == 0 means MRC CCK is OFF (more noise imm)
+ 		 */
+ 		bool is_on = param ? 1 : 0;
++
++		if (ah->caps.rx_chainmask == 1)
++			break;
++
+ 		REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+ 			      AR_PHY_MRC_CCK_ENABLE, is_on);
+ 		REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index 4bfb44a0..e2ab182d 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -78,10 +78,6 @@ struct ath_config {
+ 		       sizeof(struct ath_buf_state));		\
+ 	} while (0)
+ 
+-#define ATH_RXBUF_RESET(_bf) do {		\
+-		(_bf)->bf_stale = false;	\
+-	} while (0)
+-
+ /**
+  * enum buffer_type - Buffer type flags
+  *
+@@ -314,6 +310,7 @@ struct ath_rx {
+ 	struct ath_buf *rx_bufptr;
+ 	struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
+ 
++	struct ath_buf *buf_hold;
+ 	struct sk_buff *frag;
+ };
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
+index 039bac7e..2e6583d3 100644
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -78,8 +78,6 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+ 	struct ath_desc *ds;
+ 	struct sk_buff *skb;
+ 
+-	ATH_RXBUF_RESET(bf);
+-
+ 	ds = bf->bf_desc;
+ 	ds->ds_link = 0; /* link to null */
+ 	ds->ds_data = bf->bf_buf_addr;
+@@ -106,6 +104,14 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+ 	sc->rx.rxlink = &ds->ds_link;
+ }
+ 
++static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
++{
++	if (sc->rx.buf_hold)
++		ath_rx_buf_link(sc, sc->rx.buf_hold);
++
++	sc->rx.buf_hold = bf;
++}
++
+ static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
+ {
+ 	/* XXX block beacon interrupts */
+@@ -153,7 +159,6 @@ static bool ath_rx_edma_buf_link(struct ath_softc *sc,
+ 
+ 	skb = bf->bf_mpdu;
+ 
+-	ATH_RXBUF_RESET(bf);
+ 	memset(skb->data, 0, ah->caps.rx_status_len);
+ 	dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+ 				ah->caps.rx_status_len, DMA_TO_DEVICE);
+@@ -485,6 +490,7 @@ int ath_startrecv(struct ath_softc *sc)
+ 	if (list_empty(&sc->rx.rxbuf))
+ 		goto start_recv;
+ 
++	sc->rx.buf_hold = NULL;
+ 	sc->rx.rxlink = NULL;
+ 	list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
+ 		ath_rx_buf_link(sc, bf);
+@@ -734,6 +740,9 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
+ 	}
+ 
+ 	bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
++	if (bf == sc->rx.buf_hold)
++		return NULL;
++
+ 	ds = bf->bf_desc;
+ 
+ 	/*
+@@ -1974,7 +1983,7 @@ requeue:
+ 		if (edma) {
+ 			ath_rx_edma_buf_link(sc, qtype);
+ 		} else {
+-			ath_rx_buf_link(sc, bf);
++			ath_rx_buf_relink(sc, bf);
+ 			ath9k_hw_rxena(ah);
+ 		}
+ 	} while (1);
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 12a42f2c..3d0aa472 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2479,6 +2479,7 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
+ 	for (acno = 0, ac = &an->ac[acno];
+ 	     acno < WME_NUM_AC; acno++, ac++) {
+ 		ac->sched    = false;
++		ac->clear_ps_filter = true;
+ 		ac->txq = sc->tx.txq_map[acno];
+ 		INIT_LIST_HEAD(&ac->tid_q);
+ 	}
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+index 11054ae9..9a184058 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+@@ -1013,9 +1013,10 @@ static bool dma64_rxidle(struct dma_info *di)
+ 
+ /*
+  * post receive buffers
+- *  return false is refill failed completely and ring is empty this will stall
+- *  the rx dma and user might want to call rxfill again asap. This unlikely
+- *  happens on memory-rich NIC, but often on memory-constrained dongle
++ *  Return false if refill failed completely or dma mapping failed. The ring
++ *  is empty, which will stall the rx dma and user might want to call rxfill
++ *  again asap. This is unlikely to happen on a memory-rich NIC, but often on
++ *  memory-constrained dongle.
+  */
+ bool dma_rxfill(struct dma_pub *pub)
+ {
+@@ -1074,6 +1075,8 @@ bool dma_rxfill(struct dma_pub *pub)
+ 
+ 		pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
+ 				    DMA_FROM_DEVICE);
++		if (dma_mapping_error(di->dmadev, pa))
++			return false;
+ 
+ 		/* save the free packet pointer */
+ 		di->rxp[rxout] = p;
+@@ -1294,7 +1297,11 @@ int dma_txfast(struct dma_pub *pub, struct sk_buff *p, bool commit)
+ 
+ 	/* get physical address of buffer start */
+ 	pa = dma_map_single(di->dmadev, data, len, DMA_TO_DEVICE);
+-
++	/* if mapping failed, free skb */
++	if (dma_mapping_error(di->dmadev, pa)) {
++		brcmu_pkt_buf_free_skb(p);
++		return;
++	}
+ 	/* With a DMA segment list, Descriptor table is filled
+ 	 * using the segment list instead of looping over
+ 	 * buffers in multi-chain DMA. Therefore, EOF for SGLIST
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 58064498..1c207f23 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1227,6 +1227,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
+ 		ap = dt_alloc(sizeof(*ap) + len + 1, 4);
+ 		if (!ap)
+ 			continue;
++		memset(ap, 0, sizeof(*ap) + len + 1);
+ 		ap->alias = start;
+ 		of_alias_add(ap, np, id, start, len);
+ 	}
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 105fff2e..05973a49 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2225,14 +2225,9 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
+ 			}
+ 		}
+ 
+-		if (modepage == 0x3F) {
+-			sd_printk(KERN_ERR, sdkp, "No Caching mode page "
+-				  "present\n");
+-			goto defaults;
+-		} else if ((buffer[offset] & 0x3f) != modepage) {
+-			sd_printk(KERN_ERR, sdkp, "Got wrong page\n");
+-			goto defaults;
+-		}
++		sd_printk(KERN_ERR, sdkp, "No Caching mode page found\n");
++		goto defaults;
++
+ 	Page_found:
+ 		if (modepage == 8) {
+ 			sdkp->WCE = ((buffer[offset + 2] & 0x04) != 0);
+diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c
+index 95ebc267..e3adb382 100644
+--- a/drivers/staging/comedi/drivers/dt282x.c
++++ b/drivers/staging/comedi/drivers/dt282x.c
+@@ -407,8 +407,9 @@ struct dt282x_private {
+ 			}					\
+ 			udelay(5);				\
+ 		}						\
+-		if (_i)						\
++		if (_i) {					\
+ 			b					\
++		}						\
+ 	} while (0)
+ 
+ static int dt282x_attach(struct comedi_device *dev,
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 9dd51f7f..1434ee9e 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -233,6 +233,7 @@ skip_error:
+ static void wdm_int_callback(struct urb *urb)
+ {
+ 	int rv = 0;
++	int responding;
+ 	int status = urb->status;
+ 	struct wdm_device *desc;
+ 	struct usb_cdc_notification *dr;
+@@ -286,8 +287,8 @@ static void wdm_int_callback(struct urb *urb)
+ 
+ 	spin_lock(&desc->iuspin);
+ 	clear_bit(WDM_READ, &desc->flags);
+-	set_bit(WDM_RESPONDING, &desc->flags);
+-	if (!test_bit(WDM_DISCONNECTING, &desc->flags)
++	responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
++	if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags)
+ 		&& !test_bit(WDM_SUSPENDING, &desc->flags)) {
+ 		rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+ 		dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
+@@ -687,16 +688,20 @@ static void wdm_rxwork(struct work_struct *work)
+ {
+ 	struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);
+ 	unsigned long flags;
+-	int rv;
++	int rv = 0;
++	int responding;
+ 
+ 	spin_lock_irqsave(&desc->iuspin, flags);
+ 	if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+ 		spin_unlock_irqrestore(&desc->iuspin, flags);
+ 	} else {
++		responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
+ 		spin_unlock_irqrestore(&desc->iuspin, flags);
+-		rv = usb_submit_urb(desc->response, GFP_KERNEL);
++		if (!responding)
++			rv = usb_submit_urb(desc->response, GFP_KERNEL);
+ 		if (rv < 0 && rv != -EPERM) {
+ 			spin_lock_irqsave(&desc->iuspin, flags);
++			clear_bit(WDM_RESPONDING, &desc->flags);
+ 			if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+ 				schedule_work(&desc->rxwork);
+ 			spin_unlock_irqrestore(&desc->iuspin, flags);
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index f4bdd0ce..78609d30 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -424,7 +424,8 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
+ 
+ 	memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+ 	if (config->desc.bDescriptorType != USB_DT_CONFIG ||
+-	    config->desc.bLength < USB_DT_CONFIG_SIZE) {
++	    config->desc.bLength < USB_DT_CONFIG_SIZE ||
++	    config->desc.bLength > size) {
+ 		dev_err(ddev, "invalid descriptor for config index %d: "
+ 		    "type = 0x%X, length = %d\n", cfgidx,
+ 		    config->desc.bDescriptorType, config->desc.bLength);
+diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
+index a797d51e..77477ca5 100644
+--- a/drivers/usb/host/ehci-mxc.c
++++ b/drivers/usb/host/ehci-mxc.c
+@@ -298,7 +298,7 @@ static int __exit ehci_mxc_drv_remove(struct platform_device *pdev)
+ 	if (pdata && pdata->exit)
+ 		pdata->exit(pdev);
+ 
+-	if (pdata->otg)
++	if (pdata && pdata->otg)
+ 		usb_phy_shutdown(pdata->otg);
+ 
+ 	usb_remove_hcd(hcd);
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 93ad67ec..6e70ce97 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -24,7 +24,7 @@ static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 	 * here that the generic code does not try to make a pci_dev from our
+ 	 * dev struct in order to setup MSI
+ 	 */
+-	xhci->quirks |= XHCI_BROKEN_MSI;
++	xhci->quirks |= XHCI_PLAT;
+ }
+ 
+ /* called during probe() after chip reset completes */
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 8072a932..1504946c 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -342,9 +342,14 @@ static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
+ static int xhci_try_enable_msi(struct usb_hcd *hcd)
+ {
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+-	struct pci_dev  *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
++	struct pci_dev  *pdev;
+ 	int ret;
+ 
++	/* The xhci platform device has set up IRQs through usb_add_hcd. */
++	if (xhci->quirks & XHCI_PLAT)
++		return 0;
++
++	pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+ 	/*
+ 	 * Some Fresco Logic host controllers advertise MSI, but fail to
+ 	 * generate interrupts.  Don't even try to enable MSI.
+@@ -3496,10 +3501,21 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ 	struct xhci_virt_device *virt_dev;
++	struct device *dev = hcd->self.controller;
+ 	unsigned long flags;
+ 	u32 state;
+ 	int i, ret;
+ 
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++	/*
++	 * We called pm_runtime_get_noresume when the device was attached.
++	 * Decrement the counter here to allow controller to runtime suspend
++	 * if no devices remain.
++	 */
++	if (xhci->quirks & XHCI_RESET_ON_RESUME)
++		pm_runtime_put_noidle(dev);
++#endif
++
+ 	ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
+ 	/* If the host is halted due to driver unload, we still need to free the
+ 	 * device.
+@@ -3571,6 +3587,7 @@ static int xhci_reserve_host_control_ep_resources(struct xhci_hcd *xhci)
+ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++	struct device *dev = hcd->self.controller;
+ 	unsigned long flags;
+ 	int timeleft;
+ 	int ret;
+@@ -3623,6 +3640,16 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ 		goto disable_slot;
+ 	}
+ 	udev->slot_id = xhci->slot_id;
++
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++	/*
++	 * If resetting upon resume, we can't put the controller into runtime
++	 * suspend if there is a device attached.
++	 */
++	if (xhci->quirks & XHCI_RESET_ON_RESUME)
++		pm_runtime_get_noresume(dev);
++#endif
++
+ 	/* Is this a LS or FS device under a HS hub? */
+ 	/* Hub or peripherial? */
+ 	return 1;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 15aaf58c..a54a408c 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1508,6 +1508,7 @@ struct xhci_hcd {
+ #define XHCI_SPURIOUS_REBOOT	(1 << 13)
+ #define XHCI_COMP_MODE_QUIRK	(1 << 14)
+ #define XHCI_AVOID_BEI		(1 << 15)
++#define XHCI_PLAT		(1 << 16)
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
+ 	/* There are two roothubs to keep track of bus suspend info for */
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index cdde45de..4491830b 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -383,7 +383,7 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ 		kfree(urbtrack);
+ 		return -ENOMEM;
+ 	}
+-	urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
++	urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_ATOMIC);
+ 	if (!urbtrack->setup) {
+ 		usb_free_urb(urbtrack->urb);
+ 		kfree(urbtrack);
+@@ -391,8 +391,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ 	}
+ 	urbtrack->setup->bRequestType = (__u8)0x40;
+ 	urbtrack->setup->bRequest = (__u8)0x0e;
+-	urbtrack->setup->wValue = get_reg_value(reg, dummy);
+-	urbtrack->setup->wIndex = get_reg_index(reg);
++	urbtrack->setup->wValue = cpu_to_le16(get_reg_value(reg, dummy));
++	urbtrack->setup->wIndex = cpu_to_le16(get_reg_index(reg));
+ 	urbtrack->setup->wLength = 0;
+ 	usb_fill_control_urb(urbtrack->urb, usbdev,
+ 			     usb_sndctrlpipe(usbdev, 0),
+diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
+index 7e34beed..3275bde6 100644
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -641,9 +641,18 @@ void gnttab_request_free_callback(struct gnttab_free_callback *callback,
+ 				  void (*fn)(void *), void *arg, u16 count)
+ {
+ 	unsigned long flags;
++	struct gnttab_free_callback *cb;
++
+ 	spin_lock_irqsave(&gnttab_list_lock, flags);
+-	if (callback->next)
+-		goto out;
++
++	/* Check if the callback is already on the list */
++	cb = gnttab_free_callback_list;
++	while (cb) {
++		if (cb == callback)
++			goto out;
++		cb = cb->next;
++	}
++
+ 	callback->fn = fn;
+ 	callback->arg = arg;
+ 	callback->count = count;
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index e7fe81d3..4ac06b08 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -362,6 +362,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ 		try_to_freeze();
+ 
+ 		/* we should try only the port we connected to before */
++		mutex_lock(&server->srv_mutex);
+ 		rc = generic_ip_connect(server);
+ 		if (rc) {
+ 			cFYI(1, "reconnect error %d", rc);
+@@ -373,6 +374,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ 				server->tcpStatus = CifsNeedNegotiate;
+ 			spin_unlock(&GlobalMid_Lock);
+ 		}
++		mutex_unlock(&server->srv_mutex);
+ 	} while (server->tcpStatus == CifsNeedReconnect);
+ 
+ 	return rc;
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index d48478a8..373b2514 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1503,6 +1503,8 @@ static int fuse_setxattr(struct dentry *entry, const char *name,
+ 		fc->no_setxattr = 1;
+ 		err = -EOPNOTSUPP;
+ 	}
++	if (!err)
++		fuse_invalidate_attr(inode);
+ 	return err;
+ }
+ 
+@@ -1632,6 +1634,8 @@ static int fuse_removexattr(struct dentry *entry, const char *name)
+ 		fc->no_removexattr = 1;
+ 		err = -EOPNOTSUPP;
+ 	}
++	if (!err)
++		fuse_invalidate_attr(inode);
+ 	return err;
+ }
+ 
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 8e6381a1..df25454e 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1294,7 +1294,6 @@ static int fuse_writepage_locked(struct page *page)
+ 
+ 	inc_bdi_stat(mapping->backing_dev_info, BDI_WRITEBACK);
+ 	inc_zone_page_state(tmp_page, NR_WRITEBACK_TEMP);
+-	end_page_writeback(page);
+ 
+ 	spin_lock(&fc->lock);
+ 	list_add(&req->writepages_entry, &fi->writepages);
+@@ -1302,6 +1301,8 @@ static int fuse_writepage_locked(struct page *page)
+ 	fuse_flush_writepages(inode);
+ 	spin_unlock(&fc->lock);
+ 
++	end_page_writeback(page);
++
+ 	return 0;
+ 
+ err_free:
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index 29037c36..e92a342f 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -119,8 +119,8 @@ static void destroy_inodecache(void)
+ 
+ static int isofs_remount(struct super_block *sb, int *flags, char *data)
+ {
+-	/* we probably want a lot more here */
+-	*flags |= MS_RDONLY;
++	if (!(*flags & MS_RDONLY))
++		return -EROFS;
+ 	return 0;
+ }
+ 
+@@ -769,15 +769,6 @@ root_found:
+ 	 */
+ 	s->s_maxbytes = 0x80000000000LL;
+ 
+-	/*
+-	 * The CDROM is read-only, has no nodes (devices) on it, and since
+-	 * all of the files appear to be owned by root, we really do not want
+-	 * to allow suid.  (suid or devices will not show up unless we have
+-	 * Rock Ridge extensions)
+-	 */
+-
+-	s->s_flags |= MS_RDONLY /* | MS_NODEV | MS_NOSUID */;
+-
+ 	/* Set this for reference. Its not currently used except on write
+ 	   which we don't have .. */
+ 
+@@ -1536,6 +1527,9 @@ struct inode *isofs_iget(struct super_block *sb,
+ static struct dentry *isofs_mount(struct file_system_type *fs_type,
+ 	int flags, const char *dev_name, void *data)
+ {
++	/* We don't support read-write mounts */
++	if (!(flags & MS_RDONLY))
++		return ERR_PTR(-EACCES);
+ 	return mount_bdev(fs_type, flags, dev_name, data, isofs_fill_super);
+ }
+ 
+diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
+index 7eb1c0c7..cf228479 100644
+--- a/fs/ocfs2/extent_map.c
++++ b/fs/ocfs2/extent_map.c
+@@ -782,7 +782,6 @@ int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ 	cpos = map_start >> osb->s_clustersize_bits;
+ 	mapping_end = ocfs2_clusters_for_bytes(inode->i_sb,
+ 					       map_start + map_len);
+-	mapping_end -= cpos;
+ 	is_last = 0;
+ 	while (cpos < mapping_end && !is_last) {
+ 		u32 fe_flags;
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 3a95da60..8c933a86 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -420,10 +420,12 @@ struct hid_report {
+ 	struct hid_device *device;			/* associated device */
+ };
+ 
++#define HID_MAX_IDS 256
++
+ struct hid_report_enum {
+ 	unsigned numbered;
+ 	struct list_head report_list;
+-	struct hid_report *report_id_hash[256];
++	struct hid_report *report_id_hash[HID_MAX_IDS];
+ };
+ 
+ #define HID_REPORT_TYPES 3
+diff --git a/include/linux/rculist.h b/include/linux/rculist.h
+index 6f95e241..38633526 100644
+--- a/include/linux/rculist.h
++++ b/include/linux/rculist.h
+@@ -254,8 +254,9 @@ static inline void list_splice_init_rcu(struct list_head *list,
+  */
+ #define list_first_or_null_rcu(ptr, type, member) \
+ 	({struct list_head *__ptr = (ptr); \
+-	  struct list_head __rcu *__next = list_next_rcu(__ptr); \
+-	  likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \
++	  struct list_head *__next = ACCESS_ONCE(__ptr->next); \
++	  likely(__ptr != __next) ? \
++		list_entry_rcu(__next, type, member) : NULL; \
+ 	})
+ 
+ /**
+diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
+index 11e67562..ab45ea5b 100644
+--- a/include/media/v4l2-ctrls.h
++++ b/include/media/v4l2-ctrls.h
+@@ -22,6 +22,7 @@
+ #define _V4L2_CTRLS_H
+ 
+ #include <linux/list.h>
++#include <linux/mutex.h>
+ #include <linux/videodev2.h>
+ 
+ /* forward references */
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index ef99c15f..3da5c0bf 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1894,6 +1894,8 @@ static void collapse_huge_page(struct mm_struct *mm,
+ 		goto out;
+ 
+ 	vma = find_vma(mm, address);
++	if (!vma)
++		goto out;
+ 	hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ 	hend = vma->vm_end & HPAGE_PMD_MASK;
+ 	if (address < hstart || address + HPAGE_PMD_SIZE > hend)
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 81c275b3..9c364428 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -4349,7 +4349,13 @@ static int compare_thresholds(const void *a, const void *b)
+ 	const struct mem_cgroup_threshold *_a = a;
+ 	const struct mem_cgroup_threshold *_b = b;
+ 
+-	return _a->threshold - _b->threshold;
++	if (_a->threshold > _b->threshold)
++		return 1;
++
++	if (_a->threshold < _b->threshold)
++		return -1;
++
++	return 0;
+ }
+ 
+ static int mem_cgroup_oom_notify_cb(struct mem_cgroup *memcg)
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 1f350522..e6083c14 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2602,6 +2602,7 @@ static struct snd_pci_quirk msi_black_list[] __devinitdata = {
+ 	SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
+ 	SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
+ 	SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
++	SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */
+ 	SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */
+ 	SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */
+ 	{}
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 840d7208..ddb0d904 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -790,9 +790,9 @@ static int wm8960_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
+ 	if (pll_div.k) {
+ 		reg |= 0x20;
+ 
+-		snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 18) & 0x3f);
+-		snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 9) & 0x1ff);
+-		snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0x1ff);
++		snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 16) & 0xff);
++		snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 8) & 0xff);
++		snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0xff);
+ 	}
+ 	snd_soc_write(codec, WM8960_PLL1, reg);
+