[gentoo-commits] linux-patches r2497 - in genpatches-2.6/trunk: . 3.10.7

[Tom Wijsman (tomwij)]

Author: tomwij
Date: 2013-08-29 12:09:12 +0000 (Thu, 29 Aug 2013)
New Revision: 2497

Added:
   genpatches-2.6/trunk/3.10.7/
   genpatches-2.6/trunk/3.10.7/0000_README
   genpatches-2.6/trunk/3.10.7/1000_linux-3.10.1.patch
   genpatches-2.6/trunk/3.10.7/1001_linux-3.10.2.patch
   genpatches-2.6/trunk/3.10.7/1002_linux-3.10.3.patch
   genpatches-2.6/trunk/3.10.7/1003_linux-3.10.4.patch
   genpatches-2.6/trunk/3.10.7/1004_linux-3.10.5.patch
   genpatches-2.6/trunk/3.10.7/1005_linux-3.10.6.patch
   genpatches-2.6/trunk/3.10.7/1006_linux-3.10.7.patch
   genpatches-2.6/trunk/3.10.7/1500_XATTR_USER_PREFIX.patch
   genpatches-2.6/trunk/3.10.7/1700_enable-thinkpad-micled.patch
   genpatches-2.6/trunk/3.10.7/1801_block-cgroups-kconfig-build-bits-for-BFQ-v6r2-3.10.patch
   genpatches-2.6/trunk/3.10.7/1802_block-introduce-the-BFQ-v6r2-I-O-sched-for-3.10.patch1
   genpatches-2.6/trunk/3.10.7/1803_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v6r2-for-3.10.0.patch1
   genpatches-2.6/trunk/3.10.7/2400_kcopy-patch-for-infiniband-driver.patch
   genpatches-2.6/trunk/3.10.7/2700_ThinkPad-30-brightness-control-fix.patch
   genpatches-2.6/trunk/3.10.7/2900_dev-root-proc-mount-fix.patch
   genpatches-2.6/trunk/3.10.7/4200_fbcondecor-0.9.6.patch
   genpatches-2.6/trunk/3.10.7/4500_nouveau-video-output-control-Kconfig.patch
   genpatches-2.6/trunk/3.10.7/4567_distro-Gentoo-Kconfig.patch
Log:
Import 3.10-13 (3.10.7 release) as 3.10.7 branch, to bring security fixes to stable.

Added: genpatches-2.6/trunk/3.10.7/0000_README
===================================================================
--- genpatches-2.6/trunk/3.10.7/0000_README	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/0000_README	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,116 @@
+README
+--------------------------------------------------------------------------
+This patchset is to be the 2.6 series of gentoo-sources.
+It is designed for cross-compatibility, fixes and stability, with performance
+and additional features/driver support being a second.
+
+Unless otherwise stated and marked as such, this kernel should be suitable for
+all environments.
+
+
+Patchset Numbering Scheme
+--------------------------------------------------------------------------
+
+FIXES
[phone]	linux-stable
[phone]	linux-stable queue
[phone]	security
[phone]	architecture-related
[phone]	mm/scheduling/misc
[phone]	filesystems
[phone]	networking core
[phone]	storage core
[phone]	power management (ACPI, APM)
[phone]	bus (USB, IEEE1394, PCI, PCMCIA, ...)
[phone]	network drivers
[phone]	storage drivers
[phone]	input
[phone]	media (graphics, sound, tv)
[phone]	other
[phone]	reserved
+
+FEATURES
[phone]	network
[phone]	storage
[phone]	graphics
[phone]	filesystem
[phone]   security enhancement
[phone]   other
+
+Individual Patch Descriptions:
+--------------------------------------------------------------------------
+Patch:  1000_linux-3.10.1.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.1
+
+Patch:  1001_linux-3.10.2.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.2
+
+Patch:  1002_linux-3.10.3.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.3
+
+Patch:  1003_linux-3.10.4.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.4
+
+Patch:  1004_linux-3.10.5.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.5
+
+Patch:  1005_linux-3.10.6.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.6
+
+Patch:  1006_linux-3.10.7.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.7
+
+Patch:  1500_XATTR_USER_PREFIX.patch
+From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
+Desc:   Support for namespace user.pax.* on tmpfs.
+
+Patch:  1700_enable-thinkpad-micled.patch
+From:   https://bugs.gentoo.org/show_bug.cgi?id=449248
+Desc:   Enable mic mute led in thinkpads
+
+Patch:  1800_memcg-OOM-revert-ZFS-deadlock.patch
+From:   https://bugs.gentoo.org/show_bug.cgi?id=462066
+Desc:   Revert memcg patches that prevent OOM with too many dirty pages.
+
+Patch:  1801_block-cgroups-kconfig-build-bits-for-BFQ-v6r2-3.10.patch        
+From:   http://algo.ing.unimo.it/people/paolo/disk_sched/
+Desc:   BFQ v6r2 patch 1 for 3.10: Build, cgroups and kconfig bits
+
+Patch:  1802_block-introduce-the-BFQ-v6r2-I-O-sched-for-3.10.patch1
+From:   http://algo.ing.unimo.it/people/paolo/disk_sched/
+Desc:   BFQ v6r2 patch 2 for 3.10: BFQ Scheduler
+
+Patch:  1803_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v6r2-for-3.10.0.patch1
+From:   http://algo.ing.unimo.it/people/paolo/disk_sched/
+Desc:   BFQ v6r2 patch 3 for 3.10: Early Queue Merge (EQM)
+
+Patch:  2400_kcopy-patch-for-infiniband-driver.patch
+From:   Alexey Shvetsov <alexxy@g.o>
+Desc:   Zero copy for infiniband psm userspace driver
+
+Patch:  2700_ThinkPad-30-brightness-control-fix.patch
+From:   Seth Forshee <seth.forshee@×××××××××.com>
+Desc:   ACPI: Disable Windows 8 compatibility for some Lenovo ThinkPads
+
+Patch:  2900_dev-root-proc-mount-fix.patch
+From:   https://bugs.gentoo.org/show_bug.cgi?id=438380
+Desc:   Ensure that /dev/root doesn't appear in /proc/mounts when bootint without an initramfs.
+
+Patch:  4200_fbcondecor-0.9.6.patch
+From:   http://dev.gentoo.org/~spock
+Desc:   Bootsplash successor by Michal Januszewski ported by Jeremy (bug #452574)
+
+Patch:  4500_nouveau-video-output-control-Kconfig.patch
+From:   Tom Wijsman <TomWij@g.o
+Desc:   Make DRM_NOUVEU select VIDEO_OUTPUT_CONTROL, fixes bug #475748.
+
+Patch:  4567_distro-Gentoo-Kconfig.patch
+From:   Tom Wijsman <TomWij@g.o
+Desc:   Add Gentoo Linux support config settings and defaults.

Added: genpatches-2.6/trunk/3.10.7/1000_linux-3.10.1.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/1000_linux-3.10.1.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/1000_linux-3.10.1.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,511 @@
+diff --git a/MAINTAINERS b/MAINTAINERS
+index ad7e322..48c7480 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -7667,6 +7667,7 @@ STABLE BRANCH
+ M:	Greg Kroah-Hartman <gregkh@×××××××××××××××.org>
+ L:	stable@×××××××××××.org
+ S:	Supported
++F:	Documentation/stable_kernel_rules.txt
+ 
+ STAGING SUBSYSTEM
+ M:	Greg Kroah-Hartman <gregkh@×××××××××××××××.org>
+diff --git a/Makefile b/Makefile
+index e5e3ba0..b75cc30 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 0
++SUBLEVEL = 1
+ EXTRAVERSION =
+ NAME = Unicycling Gorilla
+ 
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 260a919..5402c94 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3399,15 +3399,22 @@ static void vmx_get_segment(struct kvm_vcpu *vcpu,
+ 	var->limit = vmx_read_guest_seg_limit(vmx, seg);
+ 	var->selector = vmx_read_guest_seg_selector(vmx, seg);
+ 	ar = vmx_read_guest_seg_ar(vmx, seg);
++	var->unusable = (ar >> 16) & 1;
+ 	var->type = ar & 15;
+ 	var->s = (ar >> 4) & 1;
+ 	var->dpl = (ar >> 5) & 3;
+-	var->present = (ar >> 7) & 1;
++	/*
++	 * Some userspaces do not preserve unusable property. Since usable
++	 * segment has to be present according to VMX spec we can use present
++	 * property to amend userspace bug by making unusable segment always
++	 * nonpresent. vmx_segment_access_rights() already marks nonpresent
++	 * segment as unusable.
++	 */
++	var->present = !var->unusable;
+ 	var->avl = (ar >> 12) & 1;
+ 	var->l = (ar >> 13) & 1;
+ 	var->db = (ar >> 14) & 1;
+ 	var->g = (ar >> 15) & 1;
+-	var->unusable = (ar >> 16) & 1;
+ }
+ 
+ static u64 vmx_get_segment_base(struct kvm_vcpu *vcpu, int seg)
+diff --git a/block/genhd.c b/block/genhd.c
+index 20625ee..cdeb527 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -512,7 +512,7 @@ static void register_disk(struct gendisk *disk)
+ 
+ 	ddev->parent = disk->driverfs_dev;
+ 
+-	dev_set_name(ddev, disk->disk_name);
++	dev_set_name(ddev, "%s", disk->disk_name);
+ 
+ 	/* delay uevents, until we scanned partition table */
+ 	dev_set_uevent_suppress(ddev, 1);
+diff --git a/crypto/algapi.c b/crypto/algapi.c
+index 6149a6e..7a1ae87 100644
+--- a/crypto/algapi.c
++++ b/crypto/algapi.c
+@@ -495,7 +495,8 @@ static struct crypto_template *__crypto_lookup_template(const char *name)
+ 
+ struct crypto_template *crypto_lookup_template(const char *name)
+ {
+-	return try_then_request_module(__crypto_lookup_template(name), name);
++	return try_then_request_module(__crypto_lookup_template(name), "%s",
++				       name);
+ }
+ EXPORT_SYMBOL_GPL(crypto_lookup_template);
+ 
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 037288e..46b35f7 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -714,7 +714,8 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ 		else
+ 			blk_queue_flush(nbd->disk->queue, 0);
+ 
+-		thread = kthread_create(nbd_thread, nbd, nbd->disk->disk_name);
++		thread = kthread_create(nbd_thread, nbd, "%s",
++					nbd->disk->disk_name);
+ 		if (IS_ERR(thread)) {
+ 			mutex_lock(&nbd->tx_lock);
+ 			return PTR_ERR(thread);
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index d620b44..8a3aff7 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -2882,7 +2882,7 @@ static noinline int mmc_ioctl_cdrom_read_data(struct cdrom_device_info *cdi,
+ 	if (lba < 0)
+ 		return -EINVAL;
+ 
+-	cgc->buffer = kmalloc(blocksize, GFP_KERNEL);
++	cgc->buffer = kzalloc(blocksize, GFP_KERNEL);
+ 	if (cgc->buffer == NULL)
+ 		return -ENOMEM;
+ 
+diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
+index fb65dec..591b6fb 100644
+--- a/drivers/cpufreq/cpufreq_stats.c
++++ b/drivers/cpufreq/cpufreq_stats.c
+@@ -349,6 +349,7 @@ static int __cpuinit cpufreq_stat_cpu_callback(struct notifier_block *nfb,
+ 
+ 	switch (action) {
+ 	case CPU_ONLINE:
++	case CPU_ONLINE_FROZEN:
+ 		cpufreq_update_policy(cpu);
+ 		break;
+ 	case CPU_DOWN_PREPARE:
+diff --git a/drivers/power/charger-manager.c b/drivers/power/charger-manager.c
+index fefc39f..98de1dd 100644
+--- a/drivers/power/charger-manager.c
++++ b/drivers/power/charger-manager.c
+@@ -450,7 +450,7 @@ static void uevent_notify(struct charger_manager *cm, const char *event)
+ 	strncpy(env_str, event, UEVENT_BUF_SIZE);
+ 	kobject_uevent(&cm->dev->kobj, KOBJ_CHANGE);
+ 
+-	dev_info(cm->dev, event);
++	dev_info(cm->dev, "%s", event);
+ }
+ 
+ /**
+diff --git a/drivers/scsi/osd/osd_uld.c b/drivers/scsi/osd/osd_uld.c
+index 0fab6b5..9d86947 100644
+--- a/drivers/scsi/osd/osd_uld.c
++++ b/drivers/scsi/osd/osd_uld.c
+@@ -485,7 +485,7 @@ static int osd_probe(struct device *dev)
+ 	oud->class_dev.class = &osd_uld_class;
+ 	oud->class_dev.parent = dev;
+ 	oud->class_dev.release = __remove;
+-	error = dev_set_name(&oud->class_dev, disk->disk_name);
++	error = dev_set_name(&oud->class_dev, "%s", disk->disk_name);
+ 	if (error) {
+ 		OSD_ERR("dev_set_name failed => %d\n", error);
+ 		goto err_put_cdev;
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index c1c5552..6f6a1b4 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -142,7 +142,7 @@ sd_store_cache_type(struct device *dev, struct device_attribute *attr,
+ 	char *buffer_data;
+ 	struct scsi_mode_data data;
+ 	struct scsi_sense_hdr sshdr;
+-	const char *temp = "temporary ";
++	static const char temp[] = "temporary ";
+ 	int len;
+ 
+ 	if (sdp->type != TYPE_DISK)
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index 26e3a97..c52948b 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -4797,10 +4797,6 @@ static struct pci_device_id serial_pci_tbl[] = {
+ 		PCI_VENDOR_ID_IBM, 0x0299,
+ 		0, 0, pbn_b0_bt_2_115200 },
+ 
+-	{	PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9835,
+-		0x1000, 0x0012,
+-		0, 0, pbn_b0_bt_2_115200 },
+-
+ 	{	PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9901,
+ 		0xA000, 0x1000,
+ 		0, 0, pbn_b0_1_115200 },
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 6464029..4476682 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1618,6 +1618,8 @@ static void release_tty(struct tty_struct *tty, int idx)
+ 	tty_free_termios(tty);
+ 	tty_driver_remove_tty(tty->driver, tty);
+ 	tty->port->itty = NULL;
++	if (tty->link)
++		tty->link->port->itty = NULL;
+ 	cancel_work_sync(&tty->port->buf.work);
+ 
+ 	if (tty->link)
+diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
+index 9b6b2b6..be661d8 100644
+--- a/fs/ceph/xattr.c
++++ b/fs/ceph/xattr.c
+@@ -675,17 +675,18 @@ ssize_t ceph_getxattr(struct dentry *dentry, const char *name, void *value,
+ 	if (!ceph_is_valid_xattr(name))
+ 		return -ENODATA;
+ 
+-	spin_lock(&ci->i_ceph_lock);
+-	dout("getxattr %p ver=%lld index_ver=%lld\n", inode,
+-	     ci->i_xattrs.version, ci->i_xattrs.index_version);
+ 
+ 	/* let's see if a virtual xattr was requested */
+ 	vxattr = ceph_match_vxattr(inode, name);
+ 	if (vxattr && !(vxattr->exists_cb && !vxattr->exists_cb(ci))) {
+ 		err = vxattr->getxattr_cb(ci, value, size);
+-		goto out;
++		return err;
+ 	}
+ 
++	spin_lock(&ci->i_ceph_lock);
++	dout("getxattr %p ver=%lld index_ver=%lld\n", inode,
++	     ci->i_xattrs.version, ci->i_xattrs.index_version);
++
+ 	if (__ceph_caps_issued_mask(ci, CEPH_CAP_XATTR_SHARED, 1) &&
+ 	    (ci->i_xattrs.index_version >= ci->i_xattrs.version)) {
+ 		goto get_xattr;
+diff --git a/fs/hpfs/map.c b/fs/hpfs/map.c
+index 4acb19d..803d3da 100644
+--- a/fs/hpfs/map.c
++++ b/fs/hpfs/map.c
+@@ -17,7 +17,8 @@ __le32 *hpfs_map_bitmap(struct super_block *s, unsigned bmp_block,
+ 			 struct quad_buffer_head *qbh, char *id)
+ {
+ 	secno sec;
+-	if (hpfs_sb(s)->sb_chk) if (bmp_block * 16384 > hpfs_sb(s)->sb_fs_size) {
++	unsigned n_bands = (hpfs_sb(s)->sb_fs_size + 0x3fff) >> 14;
++	if (hpfs_sb(s)->sb_chk) if (bmp_block >= n_bands) {
+ 		hpfs_error(s, "hpfs_map_bitmap called with bad parameter: %08x at %s", bmp_block, id);
+ 		return NULL;
+ 	}
+diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
+index a0617e7..962e90c 100644
+--- a/fs/hpfs/super.c
++++ b/fs/hpfs/super.c
+@@ -558,7 +558,13 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
+ 	sbi->sb_cp_table = NULL;
+ 	sbi->sb_c_bitmap = -1;
+ 	sbi->sb_max_fwd_alloc = 0xffffff;
+-	
++
++	if (sbi->sb_fs_size >= 0x80000000) {
++		hpfs_error(s, "invalid size in superblock: %08x",
++			(unsigned)sbi->sb_fs_size);
++		goto bail4;
++	}
++
+ 	/* Load bitmap directory */
+ 	if (!(sbi->sb_bmp_dir = hpfs_load_bitmap_directory(s, le32_to_cpu(superblock->bitmaps))))
+ 		goto bail4;
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 1fab140..2c37442 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -228,19 +228,8 @@ static int nfs41_setup_state_renewal(struct nfs_client *clp)
+ 	return status;
+ }
+ 
+-/*
+- * Back channel returns NFS4ERR_DELAY for new requests when
+- * NFS4_SESSION_DRAINING is set so there is no work to be done when draining
+- * is ended.
+- */
+-static void nfs4_end_drain_session(struct nfs_client *clp)
++static void nfs4_end_drain_slot_table(struct nfs4_slot_table *tbl)
+ {
+-	struct nfs4_session *ses = clp->cl_session;
+-	struct nfs4_slot_table *tbl;
+-
+-	if (ses == NULL)
+-		return;
+-	tbl = &ses->fc_slot_table;
+ 	if (test_and_clear_bit(NFS4_SLOT_TBL_DRAINING, &tbl->slot_tbl_state)) {
+ 		spin_lock(&tbl->slot_tbl_lock);
+ 		nfs41_wake_slot_table(tbl);
+@@ -248,6 +237,16 @@ static void nfs4_end_drain_session(struct nfs_client *clp)
+ 	}
+ }
+ 
++static void nfs4_end_drain_session(struct nfs_client *clp)
++{
++	struct nfs4_session *ses = clp->cl_session;
++
++	if (ses != NULL) {
++		nfs4_end_drain_slot_table(&ses->bc_slot_table);
++		nfs4_end_drain_slot_table(&ses->fc_slot_table);
++	}
++}
++
+ /*
+  * Signal state manager thread if session fore channel is drained
+  */
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 6cd86e0..582321a 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -162,8 +162,8 @@ static __be32 *read_buf(struct nfsd4_compoundargs *argp, u32 nbytes)
+ 	 */
+ 	memcpy(p, argp->p, avail);
+ 	/* step to next page */
+-	argp->p = page_address(argp->pagelist[0]);
+ 	argp->pagelist++;
++	argp->p = page_address(argp->pagelist[0]);
+ 	if (argp->pagelen < PAGE_SIZE) {
+ 		argp->end = argp->p + (argp->pagelen>>2);
+ 		argp->pagelen = 0;
+diff --git a/include/linux/ceph/decode.h b/include/linux/ceph/decode.h
+index 379f715..0442c3d 100644
+--- a/include/linux/ceph/decode.h
++++ b/include/linux/ceph/decode.h
+@@ -160,11 +160,6 @@ static inline void ceph_decode_timespec(struct timespec *ts,
+ static inline void ceph_encode_timespec(struct ceph_timespec *tv,
+ 					const struct timespec *ts)
+ {
+-	BUG_ON(ts->tv_sec < 0);
+-	BUG_ON(ts->tv_sec > (__kernel_time_t)U32_MAX);
+-	BUG_ON(ts->tv_nsec < 0);
+-	BUG_ON(ts->tv_nsec > (long)U32_MAX);
+-
+ 	tv->tv_sec = cpu_to_le32((u32)ts->tv_sec);
+ 	tv->tv_nsec = cpu_to_le32((u32)ts->tv_nsec);
+ }
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index 6b4890f..feaf0c7 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -358,6 +358,17 @@ static inline int hstate_index(struct hstate *h)
+ 	return h - hstates;
+ }
+ 
++pgoff_t __basepage_index(struct page *page);
++
++/* Return page->index in PAGE_SIZE units */
++static inline pgoff_t basepage_index(struct page *page)
++{
++	if (!PageCompound(page))
++		return page->index;
++
++	return __basepage_index(page);
++}
++
+ #else	/* CONFIG_HUGETLB_PAGE */
+ struct hstate {};
+ #define alloc_huge_page_node(h, nid) NULL
+@@ -378,6 +389,11 @@ static inline unsigned int pages_per_huge_page(struct hstate *h)
+ }
+ #define hstate_index_to_shift(index) 0
+ #define hstate_index(h) 0
++
++static inline pgoff_t basepage_index(struct page *page)
++{
++	return page->index;
++}
+ #endif	/* CONFIG_HUGETLB_PAGE */
+ 
+ #endif /* _LINUX_HUGETLB_H */
+diff --git a/kernel/futex.c b/kernel/futex.c
+index b26dcfc..49dacfb 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -61,6 +61,7 @@
+ #include <linux/nsproxy.h>
+ #include <linux/ptrace.h>
+ #include <linux/sched/rt.h>
++#include <linux/hugetlb.h>
+ 
+ #include <asm/futex.h>
+ 
+@@ -365,7 +366,7 @@ again:
+ 	} else {
+ 		key->both.offset |= FUT_OFF_INODE; /* inode-based key */
+ 		key->shared.inode = page_head->mapping->host;
+-		key->shared.pgoff = page_head->index;
++		key->shared.pgoff = basepage_index(page);
+ 	}
+ 
+ 	get_futex_key_refs(key);
+diff --git a/kernel/module.c b/kernel/module.c
+index cab4bce..fa53db8 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -2927,7 +2927,6 @@ static struct module *layout_and_allocate(struct load_info *info, int flags)
+ {
+ 	/* Module within temporary copy. */
+ 	struct module *mod;
+-	Elf_Shdr *pcpusec;
+ 	int err;
+ 
+ 	mod = setup_load_info(info, flags);
+@@ -2942,17 +2941,10 @@ static struct module *layout_and_allocate(struct load_info *info, int flags)
+ 	err = module_frob_arch_sections(info->hdr, info->sechdrs,
+ 					info->secstrings, mod);
+ 	if (err < 0)
+-		goto out;
++		return ERR_PTR(err);
+ 
+-	pcpusec = &info->sechdrs[info->index.pcpu];
+-	if (pcpusec->sh_size) {
+-		/* We have a special allocation for this section. */
+-		err = percpu_modalloc(mod,
+-				      pcpusec->sh_size, pcpusec->sh_addralign);
+-		if (err)
+-			goto out;
+-		pcpusec->sh_flags &= ~(unsigned long)SHF_ALLOC;
+-	}
++	/* We will do a special allocation for per-cpu sections later. */
++	info->sechdrs[info->index.pcpu].sh_flags &= ~(unsigned long)SHF_ALLOC;
+ 
+ 	/* Determine total sizes, and put offsets in sh_entsize.  For now
+ 	   this is done generically; there doesn't appear to be any
+@@ -2963,17 +2955,22 @@ static struct module *layout_and_allocate(struct load_info *info, int flags)
+ 	/* Allocate and move to the final place */
+ 	err = move_module(mod, info);
+ 	if (err)
+-		goto free_percpu;
++		return ERR_PTR(err);
+ 
+ 	/* Module has been copied to its final place now: return it. */
+ 	mod = (void *)info->sechdrs[info->index.mod].sh_addr;
+ 	kmemleak_load_module(mod, info);
+ 	return mod;
++}
+ 
+-free_percpu:
+-	percpu_modfree(mod);
+-out:
+-	return ERR_PTR(err);
++static int alloc_module_percpu(struct module *mod, struct load_info *info)
++{
++	Elf_Shdr *pcpusec = &info->sechdrs[info->index.pcpu];
++	if (!pcpusec->sh_size)
++		return 0;
++
++	/* We have a special allocation for this section. */
++	return percpu_modalloc(mod, pcpusec->sh_size, pcpusec->sh_addralign);
+ }
+ 
+ /* mod is no longer valid after this! */
+@@ -3237,6 +3234,11 @@ static int load_module(struct load_info *info, const char __user *uargs,
+ 	}
+ #endif
+ 
++	/* To avoid stressing percpu allocator, do this once we're unique. */
++	err = alloc_module_percpu(mod, info);
++	if (err)
++		goto unlink_mod;
++
+ 	/* Now module is in final location, initialize linked lists, etc. */
+ 	err = module_unload_init(mod);
+ 	if (err)
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index e2bfbf7..5cf99bf 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -690,6 +690,23 @@ int PageHuge(struct page *page)
+ }
+ EXPORT_SYMBOL_GPL(PageHuge);
+ 
++pgoff_t __basepage_index(struct page *page)
++{
++	struct page *page_head = compound_head(page);
++	pgoff_t index = page_index(page_head);
++	unsigned long compound_idx;
++
++	if (!PageHuge(page_head))
++		return page_index(page);
++
++	if (compound_order(page_head) >= MAX_ORDER)
++		compound_idx = page_to_pfn(page) - page_to_pfn(page_head);
++	else
++		compound_idx = page - page_head;
++
++	return (index << compound_order(page_head)) + compound_idx;
++}
++
+ static struct page *alloc_fresh_huge_page_node(struct hstate *h, int nid)
+ {
+ 	struct page *page;
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 1947218..fd79df5 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -6303,8 +6303,6 @@ mem_cgroup_css_online(struct cgroup *cont)
+ 		 * call __mem_cgroup_free, so return directly
+ 		 */
+ 		mem_cgroup_put(memcg);
+-		if (parent->use_hierarchy)
+-			mem_cgroup_put(parent);
+ 	}
+ 	return error;
+ }
+diff --git a/net/ceph/auth_none.c b/net/ceph/auth_none.c
+index 925ca58..8c93fa8 100644
+--- a/net/ceph/auth_none.c
++++ b/net/ceph/auth_none.c
+@@ -39,6 +39,11 @@ static int should_authenticate(struct ceph_auth_client *ac)
+ 	return xi->starting;
+ }
+ 
++static int build_request(struct ceph_auth_client *ac, void *buf, void *end)
++{
++	return 0;
++}
++
+ /*
+  * the generic auth code decode the global_id, and we carry no actual
+  * authenticate state, so nothing happens here.
+@@ -106,6 +111,7 @@ static const struct ceph_auth_client_ops ceph_auth_none_ops = {
+ 	.destroy = destroy,
+ 	.is_authenticated = is_authenticated,
+ 	.should_authenticate = should_authenticate,
++	.build_request = build_request,
+ 	.handle_reply = handle_reply,
+ 	.create_authorizer = ceph_auth_none_create_authorizer,
+ 	.destroy_authorizer = ceph_auth_none_destroy_authorizer,

Added: genpatches-2.6/trunk/3.10.7/1001_linux-3.10.2.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/1001_linux-3.10.2.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/1001_linux-3.10.2.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,2395 @@
+diff --git a/Documentation/parisc/registers b/Documentation/parisc/registers
+index dd3cadd..10c7d17 100644
+--- a/Documentation/parisc/registers
++++ b/Documentation/parisc/registers
+@@ -78,6 +78,14 @@ Shadow Registers		used by interruption handler code
+ TOC enable bit			1
+ 
+ =========================================================================
++
++The PA-RISC architecture defines 7 registers as "shadow registers".
++Those are used in RETURN FROM INTERRUPTION AND RESTORE instruction to reduce
++the state save and restore time by eliminating the need for general register
++(GR) saves and restores in interruption handlers.
++Shadow registers are the GRs 1, 8, 9, 16, 17, 24, and 25.
++
++=========================================================================
+ Register usage notes, originally from John Marvin, with some additional
+ notes from Randolph Chung.
+ 
+diff --git a/Makefile b/Makefile
+index b75cc30..4336730 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 1
++SUBLEVEL = 2
+ EXTRAVERSION =
+ NAME = Unicycling Gorilla
+ 
+diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
+index 73fd7d0..587ceef 100644
+--- a/arch/arm/boot/dts/imx23.dtsi
++++ b/arch/arm/boot/dts/imx23.dtsi
+@@ -23,8 +23,12 @@
+ 	};
+ 
+ 	cpus {
+-		cpu@0 {
+-			compatible = "arm,arm926ejs";
++		#address-cells = <0>;
++		#size-cells = <0>;
++
++		cpu {
++			compatible = "arm,arm926ej-s";
++			device_type = "cpu";
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx28.dtsi b/arch/arm/boot/dts/imx28.dtsi
+index 600f7cb..4c10a19 100644
+--- a/arch/arm/boot/dts/imx28.dtsi
++++ b/arch/arm/boot/dts/imx28.dtsi
+@@ -32,8 +32,12 @@
+ 	};
+ 
+ 	cpus {
+-		cpu@0 {
+-			compatible = "arm,arm926ejs";
++		#address-cells = <0>;
++		#size-cells = <0>;
++
++		cpu {
++			compatible = "arm,arm926ej-s";
++			device_type = "cpu";
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx6dl.dtsi b/arch/arm/boot/dts/imx6dl.dtsi
+index 5bcdf3a..62dc781 100644
+--- a/arch/arm/boot/dts/imx6dl.dtsi
++++ b/arch/arm/boot/dts/imx6dl.dtsi
+@@ -18,12 +18,14 @@
+ 
+ 		cpu@0 {
+ 			compatible = "arm,cortex-a9";
++			device_type = "cpu";
+ 			reg = <0>;
+ 			next-level-cache = <&L2>;
+ 		};
+ 
+ 		cpu@1 {
+ 			compatible = "arm,cortex-a9";
++			device_type = "cpu";
+ 			reg = <1>;
+ 			next-level-cache = <&L2>;
+ 		};
+diff --git a/arch/arm/boot/dts/imx6q.dtsi b/arch/arm/boot/dts/imx6q.dtsi
+index 21e6758..dc54a72 100644
+--- a/arch/arm/boot/dts/imx6q.dtsi
++++ b/arch/arm/boot/dts/imx6q.dtsi
+@@ -18,6 +18,7 @@
+ 
+ 		cpu@0 {
+ 			compatible = "arm,cortex-a9";
++			device_type = "cpu";
+ 			reg = <0>;
+ 			next-level-cache = <&L2>;
+ 			operating-points = <
+@@ -39,18 +40,21 @@
+ 
+ 		cpu@1 {
+ 			compatible = "arm,cortex-a9";
++			device_type = "cpu";
+ 			reg = <1>;
+ 			next-level-cache = <&L2>;
+ 		};
+ 
+ 		cpu@2 {
+ 			compatible = "arm,cortex-a9";
++			device_type = "cpu";
+ 			reg = <2>;
+ 			next-level-cache = <&L2>;
+ 		};
+ 
+ 		cpu@3 {
+ 			compatible = "arm,cortex-a9";
++			device_type = "cpu";
+ 			reg = <3>;
+ 			next-level-cache = <&L2>;
+ 		};
+diff --git a/arch/arm/include/asm/mmu_context.h b/arch/arm/include/asm/mmu_context.h
+index a7b85e0..dc90203 100644
+--- a/arch/arm/include/asm/mmu_context.h
++++ b/arch/arm/include/asm/mmu_context.h
+@@ -27,7 +27,15 @@ void __check_vmalloc_seq(struct mm_struct *mm);
+ void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk);
+ #define init_new_context(tsk,mm)	({ atomic64_set(&mm->context.id, 0); 0; })
+ 
+-DECLARE_PER_CPU(atomic64_t, active_asids);
++#ifdef CONFIG_ARM_ERRATA_798181
++void a15_erratum_get_cpumask(int this_cpu, struct mm_struct *mm,
++			     cpumask_t *mask);
++#else  /* !CONFIG_ARM_ERRATA_798181 */
++static inline void a15_erratum_get_cpumask(int this_cpu, struct mm_struct *mm,
++					   cpumask_t *mask)
++{
++}
++#endif /* CONFIG_ARM_ERRATA_798181 */
+ 
+ #else	/* !CONFIG_CPU_HAS_ASID */
+ 
+diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
+index 8c3094d..d9f5cd4 100644
+--- a/arch/arm/kernel/perf_event.c
++++ b/arch/arm/kernel/perf_event.c
+@@ -569,6 +569,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
+ 		return;
+ 	}
+ 
++	perf_callchain_store(entry, regs->ARM_pc);
+ 	tail = (struct frame_tail __user *)regs->ARM_fp - 1;
+ 
+ 	while ((entry->nr < PERF_MAX_STACK_DEPTH) &&
+diff --git a/arch/arm/kernel/smp_tlb.c b/arch/arm/kernel/smp_tlb.c
+index 9a52a07..a98b62d 100644
+--- a/arch/arm/kernel/smp_tlb.c
++++ b/arch/arm/kernel/smp_tlb.c
+@@ -103,7 +103,7 @@ static void broadcast_tlb_a15_erratum(void)
+ 
+ static void broadcast_tlb_mm_a15_erratum(struct mm_struct *mm)
+ {
+-	int cpu, this_cpu;
++	int this_cpu;
+ 	cpumask_t mask = { CPU_BITS_NONE };
+ 
+ 	if (!erratum_a15_798181())
+@@ -111,21 +111,7 @@ static void broadcast_tlb_mm_a15_erratum(struct mm_struct *mm)
+ 
+ 	dummy_flush_tlb_a15_erratum();
+ 	this_cpu = get_cpu();
+-	for_each_online_cpu(cpu) {
+-		if (cpu == this_cpu)
+-			continue;
+-		/*
+-		 * We only need to send an IPI if the other CPUs are running
+-		 * the same ASID as the one being invalidated. There is no
+-		 * need for locking around the active_asids check since the
+-		 * switch_mm() function has at least one dmb() (as required by
+-		 * this workaround) in case a context switch happens on
+-		 * another CPU after the condition below.
+-		 */
+-		if (atomic64_read(&mm->context.id) ==
+-		    atomic64_read(&per_cpu(active_asids, cpu)))
+-			cpumask_set_cpu(cpu, &mask);
+-	}
++	a15_erratum_get_cpumask(this_cpu, mm, &mask);
+ 	smp_call_function_many(&mask, ipi_flush_tlb_a15_erratum, NULL, 1);
+ 	put_cpu();
+ }
+diff --git a/arch/arm/kernel/smp_twd.c b/arch/arm/kernel/smp_twd.c
+index 90525d9..f6fd1d4 100644
+--- a/arch/arm/kernel/smp_twd.c
++++ b/arch/arm/kernel/smp_twd.c
+@@ -120,7 +120,7 @@ static int twd_rate_change(struct notifier_block *nb,
+ 	 * changing cpu.
+ 	 */
+ 	if (flags == POST_RATE_CHANGE)
+-		smp_call_function(twd_update_frequency,
++		on_each_cpu(twd_update_frequency,
+ 				  (void *)&cnd->new_rate, 1);
+ 
+ 	return NOTIFY_OK;
+diff --git a/arch/arm/mach-shmobile/setup-emev2.c b/arch/arm/mach-shmobile/setup-emev2.c
+index 899a86c..1ccddd2 100644
+--- a/arch/arm/mach-shmobile/setup-emev2.c
++++ b/arch/arm/mach-shmobile/setup-emev2.c
+@@ -287,14 +287,14 @@ static struct gpio_em_config gio3_config = {
+ static struct resource gio3_resources[] = {
+ 	[0] = {
+ 		.name	= "GIO_096",
+-		.start	= 0xe0050100,
+-		.end	= 0xe005012b,
++		.start	= 0xe0050180,
++		.end	= 0xe00501ab,
+ 		.flags	= IORESOURCE_MEM,
+ 	},
+ 	[1] = {
+ 		.name	= "GIO_096",
+-		.start	= 0xe0050140,
+-		.end	= 0xe005015f,
++		.start	= 0xe00501c0,
++		.end	= 0xe00501df,
+ 		.flags	= IORESOURCE_MEM,
+ 	},
+ 	[2] = {
+diff --git a/arch/arm/mach-shmobile/setup-r8a73a4.c b/arch/arm/mach-shmobile/setup-r8a73a4.c
+index c5a75a7..7f45c2e 100644
+--- a/arch/arm/mach-shmobile/setup-r8a73a4.c
++++ b/arch/arm/mach-shmobile/setup-r8a73a4.c
+@@ -62,7 +62,7 @@ enum { SCIFA0, SCIFA1, SCIFB0, SCIFB1, SCIFB2, SCIFB3 };
+ static const struct plat_sci_port scif[] = {
+ 	SCIFA_DATA(SCIFA0, 0xe6c40000, gic_spi(144)), /* SCIFA0 */
+ 	SCIFA_DATA(SCIFA1, 0xe6c50000, gic_spi(145)), /* SCIFA1 */
+-	SCIFB_DATA(SCIFB0, 0xe6c50000, gic_spi(145)), /* SCIFB0 */
++	SCIFB_DATA(SCIFB0, 0xe6c20000, gic_spi(148)), /* SCIFB0 */
+ 	SCIFB_DATA(SCIFB1, 0xe6c30000, gic_spi(149)), /* SCIFB1 */
+ 	SCIFB_DATA(SCIFB2, 0xe6ce0000, gic_spi(150)), /* SCIFB2 */
+ 	SCIFB_DATA(SCIFB3, 0xe6cf0000, gic_spi(151)), /* SCIFB3 */
+diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
+index 2ac3737..eeab06e 100644
+--- a/arch/arm/mm/context.c
++++ b/arch/arm/mm/context.c
+@@ -39,19 +39,43 @@
+  * non 64-bit operations.
+  */
+ #define ASID_FIRST_VERSION	(1ULL << ASID_BITS)
+-#define NUM_USER_ASIDS		(ASID_FIRST_VERSION - 1)
+-
+-#define ASID_TO_IDX(asid)	((asid & ~ASID_MASK) - 1)
+-#define IDX_TO_ASID(idx)	((idx + 1) & ~ASID_MASK)
++#define NUM_USER_ASIDS		ASID_FIRST_VERSION
+ 
+ static DEFINE_RAW_SPINLOCK(cpu_asid_lock);
+ static atomic64_t asid_generation = ATOMIC64_INIT(ASID_FIRST_VERSION);
+ static DECLARE_BITMAP(asid_map, NUM_USER_ASIDS);
+ 
+-DEFINE_PER_CPU(atomic64_t, active_asids);
++static DEFINE_PER_CPU(atomic64_t, active_asids);
+ static DEFINE_PER_CPU(u64, reserved_asids);
+ static cpumask_t tlb_flush_pending;
+ 
++#ifdef CONFIG_ARM_ERRATA_798181
++void a15_erratum_get_cpumask(int this_cpu, struct mm_struct *mm,
++			     cpumask_t *mask)
++{
++	int cpu;
++	unsigned long flags;
++	u64 context_id, asid;
++
++	raw_spin_lock_irqsave(&cpu_asid_lock, flags);
++	context_id = mm->context.id.counter;
++	for_each_online_cpu(cpu) {
++		if (cpu == this_cpu)
++			continue;
++		/*
++		 * We only need to send an IPI if the other CPUs are
++		 * running the same ASID as the one being invalidated.
++		 */
++		asid = per_cpu(active_asids, cpu).counter;
++		if (asid == 0)
++			asid = per_cpu(reserved_asids, cpu);
++		if (context_id == asid)
++			cpumask_set_cpu(cpu, mask);
++	}
++	raw_spin_unlock_irqrestore(&cpu_asid_lock, flags);
++}
++#endif
++
+ #ifdef CONFIG_ARM_LPAE
+ static void cpu_set_reserved_ttbr0(void)
+ {
+@@ -128,7 +152,16 @@ static void flush_context(unsigned int cpu)
+ 			asid = 0;
+ 		} else {
+ 			asid = atomic64_xchg(&per_cpu(active_asids, i), 0);
+-			__set_bit(ASID_TO_IDX(asid), asid_map);
++			/*
++			 * If this CPU has already been through a
++			 * rollover, but hasn't run another task in
++			 * the meantime, we must preserve its reserved
++			 * ASID, as this is the only trace we have of
++			 * the process it is still running.
++			 */
++			if (asid == 0)
++				asid = per_cpu(reserved_asids, i);
++			__set_bit(asid & ~ASID_MASK, asid_map);
+ 		}
+ 		per_cpu(reserved_asids, i) = asid;
+ 	}
+@@ -167,17 +200,19 @@ static u64 new_context(struct mm_struct *mm, unsigned int cpu)
+ 		/*
+ 		 * Allocate a free ASID. If we can't find one, take a
+ 		 * note of the currently active ASIDs and mark the TLBs
+-		 * as requiring flushes.
++		 * as requiring flushes. We always count from ASID #1,
++		 * as we reserve ASID #0 to switch via TTBR0 and indicate
++		 * rollover events.
+ 		 */
+-		asid = find_first_zero_bit(asid_map, NUM_USER_ASIDS);
++		asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, 1);
+ 		if (asid == NUM_USER_ASIDS) {
+ 			generation = atomic64_add_return(ASID_FIRST_VERSION,
+ 							 &asid_generation);
+ 			flush_context(cpu);
+-			asid = find_first_zero_bit(asid_map, NUM_USER_ASIDS);
++			asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, 1);
+ 		}
+ 		__set_bit(asid, asid_map);
+-		asid = generation | IDX_TO_ASID(asid);
++		asid |= generation;
+ 		cpumask_clear(mm_cpumask(mm));
+ 	}
+ 
+diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
+index 9a5cdc0..0ecc43f 100644
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -600,7 +600,7 @@ void __init mem_init(void)
+ 
+ #ifdef CONFIG_SA1111
+ 	/* now that our DMA memory is actually so designated, we can free it */
+-	free_reserved_area(__va(PHYS_PFN_OFFSET), swapper_pg_dir, 0, NULL);
++	free_reserved_area(__va(PHYS_OFFSET), swapper_pg_dir, 0, NULL);
+ #endif
+ 
+ 	free_highpages();
+diff --git a/arch/c6x/mm/init.c b/arch/c6x/mm/init.c
+index a9fcd89..b74ccb5 100644
+--- a/arch/c6x/mm/init.c
++++ b/arch/c6x/mm/init.c
+@@ -18,6 +18,7 @@
+ #include <linux/initrd.h>
+ 
+ #include <asm/sections.h>
++#include <asm/uaccess.h>
+ 
+ /*
+  * ZERO_PAGE is a special page that is used for zero-initialized
+diff --git a/arch/parisc/include/asm/special_insns.h b/arch/parisc/include/asm/special_insns.h
+index d306b75..e150930 100644
+--- a/arch/parisc/include/asm/special_insns.h
++++ b/arch/parisc/include/asm/special_insns.h
+@@ -32,9 +32,12 @@ static inline void set_eiem(unsigned long val)
+ 	cr;				\
+ })
+ 
+-#define mtsp(gr, cr) \
+-	__asm__ __volatile__("mtsp %0,%1" \
++#define mtsp(val, cr) \
++	{ if (__builtin_constant_p(val) && ((val) == 0)) \
++	 __asm__ __volatile__("mtsp %%r0,%0" : : "i" (cr) : "memory"); \
++	else \
++	 __asm__ __volatile__("mtsp %0,%1" \
+ 		: /* no outputs */ \
+-		: "r" (gr), "i" (cr) : "memory")
++		: "r" (val), "i" (cr) : "memory"); }
+ 
+ #endif /* __PARISC_SPECIAL_INSNS_H */
+diff --git a/arch/parisc/include/asm/tlbflush.h b/arch/parisc/include/asm/tlbflush.h
+index 5273da9..9d086a5 100644
+--- a/arch/parisc/include/asm/tlbflush.h
++++ b/arch/parisc/include/asm/tlbflush.h
+@@ -63,13 +63,14 @@ static inline void flush_tlb_mm(struct mm_struct *mm)
+ static inline void flush_tlb_page(struct vm_area_struct *vma,
+ 	unsigned long addr)
+ {
+-	unsigned long flags;
++	unsigned long flags, sid;
+ 
+ 	/* For one page, it's not worth testing the split_tlb variable */
+ 
+ 	mb();
+-	mtsp(vma->vm_mm->context,1);
++	sid = vma->vm_mm->context;
+ 	purge_tlb_start(flags);
++	mtsp(sid, 1);
+ 	pdtlb(addr);
+ 	pitlb(addr);
+ 	purge_tlb_end(flags);
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index 65fb4cb..2e65aa5 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -440,8 +440,8 @@ void __flush_tlb_range(unsigned long sid, unsigned long start,
+ 	else {
+ 		unsigned long flags;
+ 
+-		mtsp(sid, 1);
+ 		purge_tlb_start(flags);
++		mtsp(sid, 1);
+ 		if (split_tlb) {
+ 			while (npages--) {
+ 				pdtlb(start);
+diff --git a/arch/parisc/lib/memcpy.c b/arch/parisc/lib/memcpy.c
+index a49cc81..ac4370b 100644
+--- a/arch/parisc/lib/memcpy.c
++++ b/arch/parisc/lib/memcpy.c
+@@ -2,6 +2,7 @@
+  *    Optimized memory copy routines.
+  *
+  *    Copyright (C) 2004 Randolph Chung <tausq@××××××.org>
++ *    Copyright (C) 2013 Helge Deller <deller@×××.de>
+  *
+  *    This program is free software; you can redistribute it and/or modify
+  *    it under the terms of the GNU General Public License as published by
+@@ -153,17 +154,21 @@ static inline void prefetch_dst(const void *addr)
+ #define prefetch_dst(addr) do { } while(0)
+ #endif
+ 
++#define PA_MEMCPY_OK		0
++#define PA_MEMCPY_LOAD_ERROR	1
++#define PA_MEMCPY_STORE_ERROR	2
++
+ /* Copy from a not-aligned src to an aligned dst, using shifts. Handles 4 words
+  * per loop.  This code is derived from glibc. 
+  */
+-static inline unsigned long copy_dstaligned(unsigned long dst, unsigned long src, unsigned long len, unsigned long o_dst, unsigned long o_src, unsigned long o_len)
++static inline unsigned long copy_dstaligned(unsigned long dst,
++					unsigned long src, unsigned long len)
+ {
+ 	/* gcc complains that a2 and a3 may be uninitialized, but actually
+ 	 * they cannot be.  Initialize a2/a3 to shut gcc up.
+ 	 */
+ 	register unsigned int a0, a1, a2 = 0, a3 = 0;
+ 	int sh_1, sh_2;
+-	struct exception_data *d;
+ 
+ 	/* prefetch_src((const void *)src); */
+ 
+@@ -197,7 +202,7 @@ static inline unsigned long copy_dstaligned(unsigned long dst, unsigned long src
+ 			goto do2;
+ 		case 0:
+ 			if (len == 0)
+-				return 0;
++				return PA_MEMCPY_OK;
+ 			/* a3 = ((unsigned int *) src)[0];
+ 			   a0 = ((unsigned int *) src)[1]; */
+ 			ldw(s_space, 0, src, a3, cda_ldw_exc);
+@@ -256,42 +261,35 @@ do0:
+ 	preserve_branch(handle_load_error);
+ 	preserve_branch(handle_store_error);
+ 
+-	return 0;
++	return PA_MEMCPY_OK;
+ 
+ handle_load_error:
+ 	__asm__ __volatile__ ("cda_ldw_exc:\n");
+-	d = &__get_cpu_var(exception_data);
+-	DPRINTF("cda_ldw_exc: o_len=%lu fault_addr=%lu o_src=%lu ret=%lu\n",
+-		o_len, d->fault_addr, o_src, o_len - d->fault_addr + o_src);
+-	return o_len * 4 - d->fault_addr + o_src;
++	return PA_MEMCPY_LOAD_ERROR;
+ 
+ handle_store_error:
+ 	__asm__ __volatile__ ("cda_stw_exc:\n");
+-	d = &__get_cpu_var(exception_data);
+-	DPRINTF("cda_stw_exc: o_len=%lu fault_addr=%lu o_dst=%lu ret=%lu\n",
+-		o_len, d->fault_addr, o_dst, o_len - d->fault_addr + o_dst);
+-	return o_len * 4 - d->fault_addr + o_dst;
++	return PA_MEMCPY_STORE_ERROR;
+ }
+ 
+ 
+-/* Returns 0 for success, otherwise, returns number of bytes not transferred. */
+-static unsigned long pa_memcpy(void *dstp, const void *srcp, unsigned long len)
++/* Returns PA_MEMCPY_OK, PA_MEMCPY_LOAD_ERROR or PA_MEMCPY_STORE_ERROR.
++ * In case of an access fault the faulty address can be read from the per_cpu
++ * exception data struct. */
++static unsigned long pa_memcpy_internal(void *dstp, const void *srcp,
++					unsigned long len)
+ {
+ 	register unsigned long src, dst, t1, t2, t3;
+ 	register unsigned char *pcs, *pcd;
+ 	register unsigned int *pws, *pwd;
+ 	register double *pds, *pdd;
+-	unsigned long ret = 0;
+-	unsigned long o_dst, o_src, o_len;
+-	struct exception_data *d;
++	unsigned long ret;
+ 
+ 	src = (unsigned long)srcp;
+ 	dst = (unsigned long)dstp;
+ 	pcs = (unsigned char *)srcp;
+ 	pcd = (unsigned char *)dstp;
+ 
+-	o_dst = dst; o_src = src; o_len = len;
+-
+ 	/* prefetch_src((const void *)srcp); */
+ 
+ 	if (len < THRESHOLD)
+@@ -401,7 +399,7 @@ byte_copy:
+ 		len--;
+ 	}
+ 
+-	return 0;
++	return PA_MEMCPY_OK;
+ 
+ unaligned_copy:
+ 	/* possibly we are aligned on a word, but not on a double... */
+@@ -438,8 +436,7 @@ unaligned_copy:
+ 		src = (unsigned long)pcs;
+ 	}
+ 
+-	ret = copy_dstaligned(dst, src, len / sizeof(unsigned int), 
+-		o_dst, o_src, o_len);
++	ret = copy_dstaligned(dst, src, len / sizeof(unsigned int));
+ 	if (ret)
+ 		return ret;
+ 
+@@ -454,17 +451,41 @@ unaligned_copy:
+ 
+ handle_load_error:
+ 	__asm__ __volatile__ ("pmc_load_exc:\n");
+-	d = &__get_cpu_var(exception_data);
+-	DPRINTF("pmc_load_exc: o_len=%lu fault_addr=%lu o_src=%lu ret=%lu\n",
+-		o_len, d->fault_addr, o_src, o_len - d->fault_addr + o_src);
+-	return o_len - d->fault_addr + o_src;
++	return PA_MEMCPY_LOAD_ERROR;
+ 
+ handle_store_error:
+ 	__asm__ __volatile__ ("pmc_store_exc:\n");
++	return PA_MEMCPY_STORE_ERROR;
++}
++
++
++/* Returns 0 for success, otherwise, returns number of bytes not transferred. */
++static unsigned long pa_memcpy(void *dstp, const void *srcp, unsigned long len)
++{
++	unsigned long ret, fault_addr, reference;
++	struct exception_data *d;
++
++	ret = pa_memcpy_internal(dstp, srcp, len);
++	if (likely(ret == PA_MEMCPY_OK))
++		return 0;
++
++	/* if a load or store fault occured we can get the faulty addr */
+ 	d = &__get_cpu_var(exception_data);
+-	DPRINTF("pmc_store_exc: o_len=%lu fault_addr=%lu o_dst=%lu ret=%lu\n",
+-		o_len, d->fault_addr, o_dst, o_len - d->fault_addr + o_dst);
+-	return o_len - d->fault_addr + o_dst;
++	fault_addr = d->fault_addr;
++
++	/* error in load or store? */
++	if (ret == PA_MEMCPY_LOAD_ERROR)
++		reference = (unsigned long) srcp;
++	else
++		reference = (unsigned long) dstp;
++
++	DPRINTF("pa_memcpy: fault type = %lu, len=%lu fault_addr=%lu ref=%lu\n",
++		ret, len, fault_addr, reference);
++
++	if (fault_addr >= reference)
++		return len - (fault_addr - reference);
++	else
++		return len;
+ }
+ 
+ #ifdef __KERNEL__
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index c205035..d606463 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -992,18 +992,20 @@ static efi_status_t exit_boot(struct boot_params *boot_params,
+ 	efi_memory_desc_t *mem_map;
+ 	efi_status_t status;
+ 	__u32 desc_version;
++	bool called_exit = false;
+ 	u8 nr_entries;
+ 	int i;
+ 
+ 	size = sizeof(*mem_map) * 32;
+ 
+ again:
+-	size += sizeof(*mem_map);
++	size += sizeof(*mem_map) * 2;
+ 	_size = size;
+ 	status = low_alloc(size, 1, (unsigned long *)&mem_map);
+ 	if (status != EFI_SUCCESS)
+ 		return status;
+ 
++get_map:
+ 	status = efi_call_phys5(sys_table->boottime->get_memory_map, &size,
+ 				mem_map, &key, &desc_size, &desc_version);
+ 	if (status == EFI_BUFFER_TOO_SMALL) {
+@@ -1029,8 +1031,20 @@ again:
+ 	/* Might as well exit boot services now */
+ 	status = efi_call_phys2(sys_table->boottime->exit_boot_services,
+ 				handle, key);
+-	if (status != EFI_SUCCESS)
+-		goto free_mem_map;
++	if (status != EFI_SUCCESS) {
++		/*
++		 * ExitBootServices() will fail if any of the event
++		 * handlers change the memory map. In which case, we
++		 * must be prepared to retry, but only once so that
++		 * we're guaranteed to exit on repeated failures instead
++		 * of spinning forever.
++		 */
++		if (called_exit)
++			goto free_mem_map;
++
++		called_exit = true;
++		goto get_map;
++	}
+ 
+ 	/* Historic? */
+ 	boot_params->alt_mem_k = 32 * 1024;
+diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
+index 3d88bfd..13e8935 100644
+--- a/arch/x86/xen/time.c
++++ b/arch/x86/xen/time.c
+@@ -36,9 +36,8 @@ static DEFINE_PER_CPU(struct vcpu_runstate_info, xen_runstate);
+ /* snapshots of runstate info */
+ static DEFINE_PER_CPU(struct vcpu_runstate_info, xen_runstate_snapshot);
+ 
+-/* unused ns of stolen and blocked time */
++/* unused ns of stolen time */
+ static DEFINE_PER_CPU(u64, xen_residual_stolen);
+-static DEFINE_PER_CPU(u64, xen_residual_blocked);
+ 
+ /* return an consistent snapshot of 64-bit time/counter value */
+ static u64 get64(const u64 *p)
+@@ -115,7 +114,7 @@ static void do_stolen_accounting(void)
+ {
+ 	struct vcpu_runstate_info state;
+ 	struct vcpu_runstate_info *snap;
+-	s64 blocked, runnable, offline, stolen;
++	s64 runnable, offline, stolen;
+ 	cputime_t ticks;
+ 
+ 	get_runstate_snapshot(&state);
+@@ -125,7 +124,6 @@ static void do_stolen_accounting(void)
+ 	snap = &__get_cpu_var(xen_runstate_snapshot);
+ 
+ 	/* work out how much time the VCPU has not been runn*ing*  */
+-	blocked = state.time[RUNSTATE_blocked] - snap->time[RUNSTATE_blocked];
+ 	runnable = state.time[RUNSTATE_runnable] - snap->time[RUNSTATE_runnable];
+ 	offline = state.time[RUNSTATE_offline] - snap->time[RUNSTATE_offline];
+ 
+@@ -141,17 +139,6 @@ static void do_stolen_accounting(void)
+ 	ticks = iter_div_u64_rem(stolen, NS_PER_TICK, &stolen);
+ 	__this_cpu_write(xen_residual_stolen, stolen);
+ 	account_steal_ticks(ticks);
+-
+-	/* Add the appropriate number of ticks of blocked time,
+-	   including any left-overs from last time. */
+-	blocked += __this_cpu_read(xen_residual_blocked);
+-
+-	if (blocked < 0)
+-		blocked = 0;
+-
+-	ticks = iter_div_u64_rem(blocked, NS_PER_TICK, &blocked);
+-	__this_cpu_write(xen_residual_blocked, blocked);
+-	account_idle_ticks(ticks);
+ }
+ 
+ /* Get the TSC speed from Xen */
+diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
+index 536562c..97c949a 100644
+--- a/drivers/acpi/Makefile
++++ b/drivers/acpi/Makefile
+@@ -43,6 +43,7 @@ acpi-y				+= acpi_platform.o
+ acpi-y				+= power.o
+ acpi-y				+= event.o
+ acpi-y				+= sysfs.o
++acpi-$(CONFIG_X86)		+= acpi_cmos_rtc.o
+ acpi-$(CONFIG_DEBUG_FS)		+= debugfs.o
+ acpi-$(CONFIG_ACPI_NUMA)	+= numa.o
+ acpi-$(CONFIG_ACPI_PROCFS_POWER) += cm_sbs.o
+diff --git a/drivers/acpi/acpi_cmos_rtc.c b/drivers/acpi/acpi_cmos_rtc.c
+new file mode 100644
+index 0000000..84190ed
+--- /dev/null
++++ b/drivers/acpi/acpi_cmos_rtc.c
+@@ -0,0 +1,92 @@
++/*
++ * ACPI support for CMOS RTC Address Space access
++ *
++ * Copyright (C) 2013, Intel Corporation
++ * Authors: Lan Tianyu <tianyu.lan@×××××.com>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/acpi.h>
++#include <linux/device.h>
++#include <linux/err.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <asm-generic/rtc.h>
++
++#include "internal.h"
++
++#define PREFIX "ACPI: "
++
++ACPI_MODULE_NAME("cmos rtc");
++
++static const struct acpi_device_id acpi_cmos_rtc_ids[] = {
++	{ "PNP0B00" },
++	{ "PNP0B01" },
++	{ "PNP0B02" },
++	{}
++};
++
++static acpi_status
++acpi_cmos_rtc_space_handler(u32 function, acpi_physical_address address,
++		      u32 bits, u64 *value64,
++		      void *handler_context, void *region_context)
++{
++	int i;
++	u8 *value = (u8 *)&value64;
++
++	if (address > 0xff || !value64)
++		return AE_BAD_PARAMETER;
++
++	if (function != ACPI_WRITE && function != ACPI_READ)
++		return AE_BAD_PARAMETER;
++
++	spin_lock_irq(&rtc_lock);
++
++	for (i = 0; i < DIV_ROUND_UP(bits, 8); ++i, ++address, ++value)
++		if (function == ACPI_READ)
++			*value = CMOS_READ(address);
++		else
++			CMOS_WRITE(*value, address);
++
++	spin_unlock_irq(&rtc_lock);
++
++	return AE_OK;
++}
++
++static int acpi_install_cmos_rtc_space_handler(struct acpi_device *adev,
++		const struct acpi_device_id *id)
++{
++	acpi_status status;
++
++	status = acpi_install_address_space_handler(adev->handle,
++			ACPI_ADR_SPACE_CMOS,
++			&acpi_cmos_rtc_space_handler,
++			NULL, NULL);
++	if (ACPI_FAILURE(status)) {
++		pr_err(PREFIX "Error installing CMOS-RTC region handler\n");
++		return -ENODEV;
++	}
++
++	return 0;
++}
++
++static void acpi_remove_cmos_rtc_space_handler(struct acpi_device *adev)
++{
++	if (ACPI_FAILURE(acpi_remove_address_space_handler(adev->handle,
++			ACPI_ADR_SPACE_CMOS, &acpi_cmos_rtc_space_handler)))
++		pr_err(PREFIX "Error removing CMOS-RTC region handler\n");
++}
++
++static struct acpi_scan_handler cmos_rtc_handler = {
++	.ids = acpi_cmos_rtc_ids,
++	.attach = acpi_install_cmos_rtc_space_handler,
++	.detach = acpi_remove_cmos_rtc_space_handler,
++};
++
++void __init acpi_cmos_rtc_init(void)
++{
++	acpi_scan_add_handler(&cmos_rtc_handler);
++}
+diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c
+index 35eebda..09b06e2 100644
+--- a/drivers/acpi/acpica/hwxfsleep.c
++++ b/drivers/acpi/acpica/hwxfsleep.c
+@@ -240,12 +240,14 @@ static acpi_status acpi_hw_sleep_dispatch(u8 sleep_state, u32 function_id)
+ 	    &acpi_sleep_dispatch[function_id];
+ 
+ #if (!ACPI_REDUCED_HARDWARE)
+-
+ 	/*
+ 	 * If the Hardware Reduced flag is set (from the FADT), we must
+-	 * use the extended sleep registers
++	 * use the extended sleep registers (FADT). Note: As per the ACPI
++	 * specification, these extended registers are to be used for HW-reduced
++	 * platforms only. They are not general-purpose replacements for the
++	 * legacy PM register sleep support.
+ 	 */
+-	if (acpi_gbl_reduced_hardware || acpi_gbl_FADT.sleep_control.address) {
++	if (acpi_gbl_reduced_hardware) {
+ 		status = sleep_functions->extended_function(sleep_state);
+ 	} else {
+ 		/* Legacy sleep */
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index 31c217a..553527c 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -324,14 +324,27 @@ int acpi_bus_update_power(acpi_handle handle, int *state_p)
+ 	if (result)
+ 		return result;
+ 
+-	if (state == ACPI_STATE_UNKNOWN)
++	if (state == ACPI_STATE_UNKNOWN) {
+ 		state = ACPI_STATE_D0;
+-
+-	result = acpi_device_set_power(device, state);
+-	if (!result && state_p)
++		result = acpi_device_set_power(device, state);
++		if (result)
++			return result;
++	} else {
++		if (device->power.flags.power_resources) {
++			/*
++			 * We don't need to really switch the state, bu we need
++			 * to update the power resources' reference counters.
++			 */
++			result = acpi_power_transition(device, state);
++			if (result)
++				return result;
++		}
++		device->power.state = state;
++	}
++	if (state_p)
+ 		*state_p = state;
+ 
+-	return result;
++	return 0;
+ }
+ EXPORT_SYMBOL_GPL(acpi_bus_update_power);
+ 
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index edc0081..80403c1 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -983,6 +983,10 @@ static struct dmi_system_id __initdata ec_dmi_table[] = {
+ 	ec_enlarge_storm_threshold, "CLEVO hardware", {
+ 	DMI_MATCH(DMI_SYS_VENDOR, "CLEVO Co."),
+ 	DMI_MATCH(DMI_PRODUCT_NAME, "M720T/M730T"),}, NULL},
++	{
++	ec_skip_dsdt_scan, "HP Folio 13", {
++	DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++	DMI_MATCH(DMI_PRODUCT_NAME, "HP Folio 13"),}, NULL},
+ 	{},
+ };
+ 
+diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
+index c610a76..63a0854 100644
+--- a/drivers/acpi/internal.h
++++ b/drivers/acpi/internal.h
+@@ -50,6 +50,11 @@ void acpi_memory_hotplug_init(void);
+ #else
+ static inline void acpi_memory_hotplug_init(void) {}
+ #endif
++#ifdef CONFIG_X86
++void acpi_cmos_rtc_init(void);
++#else
++static inline void acpi_cmos_rtc_init(void) {}
++#endif
+ 
+ void acpi_sysfs_add_hotplug_profile(struct acpi_hotplug_profile *hotplug,
+ 				    const char *name);
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 27da630..14807e5 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -2040,6 +2040,7 @@ int __init acpi_scan_init(void)
+ 	acpi_pci_link_init();
+ 	acpi_platform_init();
+ 	acpi_lpss_init();
++	acpi_cmos_rtc_init();
+ 	acpi_container_init();
+ 	acpi_memory_hotplug_init();
+ 	acpi_dock_init();
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 2b50dfd..b112625 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -291,6 +291,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	{ PCI_VDEVICE(INTEL, 0x8d64), board_ahci }, /* Wellsburg RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x8d66), board_ahci }, /* Wellsburg RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x8d6e), board_ahci }, /* Wellsburg RAID */
++	{ PCI_VDEVICE(INTEL, 0x23a3), board_ahci }, /* Coleto Creek AHCI */
+ 
+ 	/* JMicron 360/1/3/5/6, match class to avoid IDE function */
+ 	{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+@@ -310,6 +311,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 
+ 	/* AMD */
+ 	{ PCI_VDEVICE(AMD, 0x7800), board_ahci }, /* AMD Hudson-2 */
++	{ PCI_VDEVICE(AMD, 0x7900), board_ahci }, /* AMD CZ */
+ 	/* AMD is using RAID class only for ahci controllers */
+ 	{ PCI_VENDOR_ID_AMD, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+ 	  PCI_CLASS_STORAGE_RAID << 8, 0xffffff, board_ahci },
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index a70ff15..7b9bdd8 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -1560,8 +1560,7 @@ static void ahci_error_intr(struct ata_port *ap, u32 irq_stat)
+ 		u32 fbs = readl(port_mmio + PORT_FBS);
+ 		int pmp = fbs >> PORT_FBS_DWE_OFFSET;
+ 
+-		if ((fbs & PORT_FBS_SDE) && (pmp < ap->nr_pmp_links) &&
+-		    ata_link_online(&ap->pmp_link[pmp])) {
++		if ((fbs & PORT_FBS_SDE) && (pmp < ap->nr_pmp_links)) {
+ 			link = &ap->pmp_link[pmp];
+ 			fbs_need_dec = true;
+ 		}
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 46b35f7..cf1576d 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -623,8 +623,10 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ 		if (!nbd->sock)
+ 			return -EINVAL;
+ 
++		nbd->disconnect = 1;
++
+ 		nbd_send_req(nbd, &sreq);
+-                return 0;
++		return 0;
+ 	}
+  
+ 	case NBD_CLEAR_SOCK: {
+@@ -654,6 +656,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ 				nbd->sock = SOCKET_I(inode);
+ 				if (max_part > 0)
+ 					bdev->bd_invalidated = 1;
++				nbd->disconnect = 0; /* we're connected now */
+ 				return 0;
+ 			} else {
+ 				fput(file);
+@@ -743,6 +746,8 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ 		set_capacity(nbd->disk, 0);
+ 		if (max_part > 0)
+ 			ioctl_by_bdev(bdev, BLKRRPART, 0);
++		if (nbd->disconnect) /* user requested, ignore socket errors */
++			return 0;
+ 		return nbd->harderror;
+ 	}
+ 
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index a17553f..7ec82f0 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2485,10 +2485,10 @@ static void pl330_free_chan_resources(struct dma_chan *chan)
+ 	struct dma_pl330_chan *pch = to_pchan(chan);
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&pch->lock, flags);
+-
+ 	tasklet_kill(&pch->task);
+ 
++	spin_lock_irqsave(&pch->lock, flags);
++
+ 	pl330_release_channel(pch->pl330_chid);
+ 	pch->pl330_chid = NULL;
+ 
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index feae88b..c7710b5 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -524,6 +524,12 @@ static const struct hid_device_id apple_devices[] = {
+ 		.driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS),
+ 		.driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI),
++		.driver_data = APPLE_HAS_FN },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ISO),
++		.driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS),
++		.driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI),
+ 		.driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO),
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 264f550..402f486 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1547,6 +1547,9 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ISO) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS) },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
+@@ -2179,6 +2182,9 @@ static const struct hid_device_id hid_mouse_ignore_list[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ISO) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
+ 	{ }
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 38535c9..2168885 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -135,6 +135,9 @@
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS   0x023b
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI  0x0255
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO   0x0256
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI	0x0291
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO	0x0292
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS	0x0293
+ #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY	0x030a
+ #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY	0x030b
+ #define USB_DEVICE_ID_APPLE_IRCONTROL	0x8240
+diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
+index d6fbb577..791f45d 100644
+--- a/drivers/hv/ring_buffer.c
++++ b/drivers/hv/ring_buffer.c
+@@ -32,7 +32,7 @@
+ void hv_begin_read(struct hv_ring_buffer_info *rbi)
+ {
+ 	rbi->ring_buffer->interrupt_mask = 1;
+-	smp_mb();
++	mb();
+ }
+ 
+ u32 hv_end_read(struct hv_ring_buffer_info *rbi)
+@@ -41,7 +41,7 @@ u32 hv_end_read(struct hv_ring_buffer_info *rbi)
+ 	u32 write;
+ 
+ 	rbi->ring_buffer->interrupt_mask = 0;
+-	smp_mb();
++	mb();
+ 
+ 	/*
+ 	 * Now check to see if the ring buffer is still empty.
+@@ -71,7 +71,7 @@ u32 hv_end_read(struct hv_ring_buffer_info *rbi)
+ 
+ static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi)
+ {
+-	smp_mb();
++	mb();
+ 	if (rbi->ring_buffer->interrupt_mask)
+ 		return false;
+ 
+@@ -442,7 +442,7 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+ 					     sizeof(u64));
+ 
+ 	/* Issue a full memory barrier before updating the write index */
+-	smp_mb();
++	mb();
+ 
+ 	/* Now, update the write location */
+ 	hv_set_next_write_location(outring_info, next_write_location);
+@@ -549,7 +549,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info, void *buffer,
+ 	/* Make sure all reads are done before we update the read index since */
+ 	/* the writer may start writing to the read area once the read index */
+ 	/*is updated */
+-	smp_mb();
++	mb();
+ 
+ 	/* Update the read index */
+ 	hv_set_next_read_location(inring_info, next_read_location);
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index bf421e0..4004e54 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -434,7 +434,7 @@ static void vmbus_on_msg_dpc(unsigned long data)
+ 		 * will not deliver any more messages since there is
+ 		 * no empty slot
+ 		 */
+-		smp_mb();
++		mb();
+ 
+ 		if (msg->header.message_flags.msg_pending) {
+ 			/*
+diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
+index 2baff1b..4ef4d5e 100644
+--- a/drivers/input/mouse/bcm5974.c
++++ b/drivers/input/mouse/bcm5974.c
+@@ -88,6 +88,10 @@
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI	0x0259
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO	0x025a
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS	0x025b
++/* MacbookAir6,2 (unibody, June 2013) */
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI	0x0291
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO	0x0292
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS	0x0293
+ 
+ #define BCM5974_DEVICE(prod) {					\
+ 	.match_flags = (USB_DEVICE_ID_MATCH_DEVICE |		\
+@@ -145,6 +149,10 @@ static const struct usb_device_id bcm5974_table[] = {
+ 	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI),
+ 	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO),
+ 	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS),
++	/* MacbookAir6,2 */
++	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI),
++	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING8_ISO),
++	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING8_JIS),
+ 	/* Terminating entry */
+ 	{}
+ };
+@@ -172,15 +180,18 @@ struct bt_data {
+ /* trackpad header types */
+ enum tp_type {
+ 	TYPE1,			/* plain trackpad */
+-	TYPE2			/* button integrated in trackpad */
++	TYPE2,			/* button integrated in trackpad */
++	TYPE3			/* additional header fields since June 2013 */
+ };
+ 
+ /* trackpad finger data offsets, le16-aligned */
+ #define FINGER_TYPE1		(13 * sizeof(__le16))
+ #define FINGER_TYPE2		(15 * sizeof(__le16))
++#define FINGER_TYPE3		(19 * sizeof(__le16))
+ 
+ /* trackpad button data offsets */
+ #define BUTTON_TYPE2		15
++#define BUTTON_TYPE3		23
+ 
+ /* list of device capability bits */
+ #define HAS_INTEGRATED_BUTTON	1
+@@ -400,6 +411,19 @@ static const struct bcm5974_config bcm5974_config_table[] = {
+ 		{ SN_COORD, -150, 6730 },
+ 		{ SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
+ 	},
++	{
++		USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI,
++		USB_DEVICE_ID_APPLE_WELLSPRING8_ISO,
++		USB_DEVICE_ID_APPLE_WELLSPRING8_JIS,
++		HAS_INTEGRATED_BUTTON,
++		0, sizeof(struct bt_data),
++		0x83, TYPE3, FINGER_TYPE3, FINGER_TYPE3 + SIZEOF_ALL_FINGERS,
++		{ SN_PRESSURE, 0, 300 },
++		{ SN_WIDTH, 0, 2048 },
++		{ SN_COORD, -4620, 5140 },
++		{ SN_COORD, -150, 6600 },
++		{ SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
++	},
+ 	{}
+ };
+ 
+@@ -557,6 +581,9 @@ static int report_tp_state(struct bcm5974 *dev, int size)
+ 		input_report_key(input, BTN_LEFT, ibt);
+ 	}
+ 
++	if (c->tp_type == TYPE3)
++		input_report_key(input, BTN_LEFT, dev->tp_data[BUTTON_TYPE3]);
++
+ 	input_sync(input);
+ 
+ 	return 0;
+@@ -572,9 +599,14 @@ static int report_tp_state(struct bcm5974 *dev, int size)
+ 
+ static int bcm5974_wellspring_mode(struct bcm5974 *dev, bool on)
+ {
+-	char *data = kmalloc(8, GFP_KERNEL);
+ 	int retval = 0, size;
++	char *data;
++
++	/* Type 3 does not require a mode switch */
++	if (dev->cfg.tp_type == TYPE3)
++		return 0;
+ 
++	data = kmalloc(8, GFP_KERNEL);
+ 	if (!data) {
+ 		dev_err(&dev->intf->dev, "out of memory\n");
+ 		retval = -ENOMEM;
+diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
+index c5e3029..48acfc6 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
+@@ -576,10 +576,16 @@ static void iwl_pcie_txq_unmap(struct iwl_trans *trans, int txq_id)
+ 
+ 	spin_lock_bh(&txq->lock);
+ 	while (q->write_ptr != q->read_ptr) {
++		IWL_DEBUG_TX_REPLY(trans, "Q %d Free %d\n",
++				   txq_id, q->read_ptr);
+ 		iwl_pcie_txq_free_tfd(trans, txq);
+ 		q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd);
+ 	}
++	txq->active = false;
+ 	spin_unlock_bh(&txq->lock);
++
++	/* just in case - this queue may have been stopped */
++	iwl_wake_queue(trans, txq);
+ }
+ 
+ /*
+@@ -927,6 +933,12 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
+ 
+ 	spin_lock_bh(&txq->lock);
+ 
++	if (!txq->active) {
++		IWL_DEBUG_TX_QUEUES(trans, "Q %d inactive - ignoring idx %d\n",
++				    txq_id, ssn);
++		goto out;
++	}
++
+ 	if (txq->q.read_ptr == tfd_num)
+ 		goto out;
+ 
+@@ -1103,6 +1115,7 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, int fifo,
+ 		       (fifo << SCD_QUEUE_STTS_REG_POS_TXF) |
+ 		       (1 << SCD_QUEUE_STTS_REG_POS_WSL) |
+ 		       SCD_QUEUE_STTS_REG_MSK);
++	trans_pcie->txq[txq_id].active = true;
+ 	IWL_DEBUG_TX_QUEUES(trans, "Activate queue %d on FIFO %d WrPtr: %d\n",
+ 			    txq_id, fifo, ssn & 0xff);
+ }
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+index 953f1a0..2119313 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+@@ -104,7 +104,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+ 			tx_agc[RF90_PATH_A] = 0x10101010;
+ 			tx_agc[RF90_PATH_B] = 0x10101010;
+ 		} else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
+-			   TXHIGHPWRLEVEL_LEVEL1) {
++			   TXHIGHPWRLEVEL_LEVEL2) {
+ 			tx_agc[RF90_PATH_A] = 0x00000000;
+ 			tx_agc[RF90_PATH_B] = 0x00000000;
+ 		} else{
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index 826f085..2bd5985 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -359,6 +359,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ 	{RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
+ 	{RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/
+ 	{RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/
++	{RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/
+ 	{RTL_USB_DEVICE(0x7392, 0x7822, rtl92cu_hal_cfg)}, /*Edimax -Edimax*/
+ 	{}
+ };
+diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
+index e4c4cdc..d9ee2ef 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
+@@ -251,7 +251,7 @@ static struct rtl_hal_cfg rtl8723ae_hal_cfg = {
+ 	.bar_id = 2,
+ 	.write_readback = true,
+ 	.name = "rtl8723ae_pci",
+-	.fw_name = "rtlwifi/rtl8723aefw.bin",
++	.fw_name = "rtlwifi/rtl8723fw.bin",
+ 	.ops = &rtl8723ae_hal_ops,
+ 	.mod_params = &rtl8723ae_mod_params,
+ 	.maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
+@@ -353,8 +353,8 @@ MODULE_AUTHOR("Realtek WlanFAE	<wlanfae@×××××××.com>");
+ MODULE_AUTHOR("Larry Finger	<Larry.Finger@××××××××.net>");
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Realtek 8723E 802.11n PCI wireless");
+-MODULE_FIRMWARE("rtlwifi/rtl8723aefw.bin");
+-MODULE_FIRMWARE("rtlwifi/rtl8723aefw_B.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8723fw.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8723fw_B.bin");
+ 
+ module_param_named(swenc, rtl8723ae_mod_params.sw_crypto, bool, 0444);
+ module_param_named(debug, rtl8723ae_mod_params.debug, int, 0444);
+diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c
+index 1f05913..19f6f70 100644
+--- a/drivers/parisc/lba_pci.c
++++ b/drivers/parisc/lba_pci.c
+@@ -613,6 +613,54 @@ truncate_pat_collision(struct resource *root, struct resource *new)
+ 	return 0;	/* truncation successful */
+ }
+ 
++/*
++ * extend_lmmio_len: extend lmmio range to maximum length
++ *
++ * This is needed at least on C8000 systems to get the ATI FireGL card
++ * working. On other systems we will currently not extend the lmmio space.
++ */
++static unsigned long
++extend_lmmio_len(unsigned long start, unsigned long end, unsigned long lba_len)
++{
++	struct resource *tmp;
++
++	pr_debug("LMMIO mismatch: PAT length = 0x%lx, MASK register = 0x%lx\n",
++		end - start, lba_len);
++
++	lba_len = min(lba_len+1, 256UL*1024*1024); /* limit to 256 MB */
++
++	pr_debug("LBA: lmmio_space [0x%lx-0x%lx] - original\n", start, end);
++
++	if (boot_cpu_data.cpu_type < mako) {
++		pr_info("LBA: Not a C8000 system - not extending LMMIO range.\n");
++		return end;
++	}
++
++	end += lba_len;
++	if (end < start) /* fix overflow */
++		end = -1ULL;
++
++	pr_debug("LBA: lmmio_space [0x%lx-0x%lx] - current\n", start, end);
++
++	/* first overlap */
++	for (tmp = iomem_resource.child; tmp; tmp = tmp->sibling) {
++		pr_debug("LBA: testing %pR\n", tmp);
++		if (tmp->start == start)
++			continue; /* ignore ourself */
++		if (tmp->end < start)
++			continue;
++		if (tmp->start > end)
++			continue;
++		if (end >= tmp->start)
++			end = tmp->start - 1;
++	}
++
++	pr_info("LBA: lmmio_space [0x%lx-0x%lx] - new\n", start, end);
++
++	/* return new end */
++	return end;
++}
++
+ #else
+ #define truncate_pat_collision(r,n)  (0)
+ #endif
+@@ -994,6 +1042,14 @@ lba_pat_resources(struct parisc_device *pa_dev, struct lba_device *lba_dev)
+ 		case PAT_LMMIO:
+ 			/* used to fix up pre-initialized MEM BARs */
+ 			if (!lba_dev->hba.lmmio_space.flags) {
++				unsigned long lba_len;
++
++				lba_len = ~READ_REG32(lba_dev->hba.base_addr
++						+ LBA_LMMIO_MASK);
++				if ((p->end - p->start) != lba_len)
++					p->end = extend_lmmio_len(p->start,
++						p->end, lba_len);
++
+ 				sprintf(lba_dev->hba.lmmio_name,
+ 						"PCI%02x LMMIO",
+ 						(int)lba_dev->hba.bus_num.start);
+diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
+index c93071d..a971a6f 100644
+--- a/drivers/pci/iov.c
++++ b/drivers/pci/iov.c
+@@ -92,6 +92,8 @@ static int virtfn_add(struct pci_dev *dev, int id, int reset)
+ 	pci_read_config_word(dev, iov->pos + PCI_SRIOV_VF_DID, &virtfn->device);
+ 	pci_setup_device(virtfn);
+ 	virtfn->dev.parent = dev->dev.parent;
++	virtfn->physfn = pci_dev_get(dev);
++	virtfn->is_virtfn = 1;
+ 
+ 	for (i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
+ 		res = dev->resource + PCI_IOV_RESOURCES + i;
+@@ -113,9 +115,6 @@ static int virtfn_add(struct pci_dev *dev, int id, int reset)
+ 	pci_device_add(virtfn, virtfn->bus);
+ 	mutex_unlock(&iov->dev->sriov->lock);
+ 
+-	virtfn->physfn = pci_dev_get(dev);
+-	virtfn->is_virtfn = 1;
+-
+ 	rc = pci_bus_add_device(virtfn);
+ 	sprintf(buf, "virtfn%u", id);
+ 	rc = sysfs_create_link(&dev->dev.kobj, &virtfn->dev.kobj, buf);
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 70f10fa..ea37072 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -1703,12 +1703,16 @@ struct pci_bus *pci_create_root_bus(struct device *parent, int bus,
+ 	bridge->dev.release = pci_release_bus_bridge_dev;
+ 	dev_set_name(&bridge->dev, "pci%04x:%02x", pci_domain_nr(b), bus);
+ 	error = pcibios_root_bridge_prepare(bridge);
+-	if (error)
+-		goto bridge_dev_reg_err;
++	if (error) {
++		kfree(bridge);
++		goto err_out;
++	}
+ 
+ 	error = device_register(&bridge->dev);
+-	if (error)
+-		goto bridge_dev_reg_err;
++	if (error) {
++		put_device(&bridge->dev);
++		goto err_out;
++	}
+ 	b->bridge = get_device(&bridge->dev);
+ 	device_enable_async_suspend(b->bridge);
+ 	pci_set_bus_of_node(b);
+@@ -1764,8 +1768,6 @@ struct pci_bus *pci_create_root_bus(struct device *parent, int bus,
+ class_dev_reg_err:
+ 	put_device(&bridge->dev);
+ 	device_unregister(&bridge->dev);
+-bridge_dev_reg_err:
+-	kfree(bridge);
+ err_out:
+ 	kfree(b);
+ 	return NULL;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 7d68aee..df4655c 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1022,6 +1022,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP700_SATA, quirk
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP700_SATA, quirk_amd_ide_mode);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_HUDSON2_SATA_IDE, quirk_amd_ide_mode);
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_HUDSON2_SATA_IDE, quirk_amd_ide_mode);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x7900, quirk_amd_ide_mode);
++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_AMD, 0x7900, quirk_amd_ide_mode);
+ 
+ /*
+  *	Serverworks CSB5 IDE does not fully support native mode
+diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c
+index 966abc6..f7197a7 100644
+--- a/drivers/pci/xen-pcifront.c
++++ b/drivers/pci/xen-pcifront.c
+@@ -678,10 +678,9 @@ static int pcifront_connect_and_init_dma(struct pcifront_device *pdev)
+ 	if (!pcifront_dev) {
+ 		dev_info(&pdev->xdev->dev, "Installing PCI frontend\n");
+ 		pcifront_dev = pdev;
+-	} else {
+-		dev_err(&pdev->xdev->dev, "PCI frontend already installed!\n");
++	} else
+ 		err = -EEXIST;
+-	}
++
+ 	spin_unlock(&pcifront_dev_lock);
+ 
+ 	if (!err && !swiotlb_nr_tbl()) {
+@@ -848,7 +847,7 @@ static int pcifront_try_connect(struct pcifront_device *pdev)
+ 		goto out;
+ 
+ 	err = pcifront_connect_and_init_dma(pdev);
+-	if (err) {
++	if (err && err != -EEXIST) {
+ 		xenbus_dev_fatal(pdev->xdev, err,
+ 				 "Error setting up PCI Frontend");
+ 		goto out;
+diff --git a/drivers/pcmcia/at91_cf.c b/drivers/pcmcia/at91_cf.c
+index 01463c7..1b2c631 100644
+--- a/drivers/pcmcia/at91_cf.c
++++ b/drivers/pcmcia/at91_cf.c
+@@ -100,9 +100,9 @@ static int at91_cf_get_status(struct pcmcia_socket *s, u_int *sp)
+ 		int vcc	= gpio_is_valid(cf->board->vcc_pin);
+ 
+ 		*sp = SS_DETECT | SS_3VCARD;
+-		if (!rdy || gpio_get_value(rdy))
++		if (!rdy || gpio_get_value(cf->board->irq_pin))
+ 			*sp |= SS_READY;
+-		if (!vcc || gpio_get_value(vcc))
++		if (!vcc || gpio_get_value(cf->board->vcc_pin))
+ 			*sp |= SS_POWERON;
+ 	} else
+ 		*sp = 0;
+diff --git a/drivers/rtc/rtc-rv3029c2.c b/drivers/rtc/rtc-rv3029c2.c
+index 5032c24..9100a34 100644
+--- a/drivers/rtc/rtc-rv3029c2.c
++++ b/drivers/rtc/rtc-rv3029c2.c
+@@ -310,7 +310,7 @@ static int rv3029c2_rtc_i2c_set_alarm(struct i2c_client *client,
+ 		dev_dbg(&client->dev, "alarm IRQ armed\n");
+ 	} else {
+ 		/* disable AIE irq */
+-		ret = rv3029c2_rtc_i2c_alarm_set_irq(client, 1);
++		ret = rv3029c2_rtc_i2c_alarm_set_irq(client, 0);
+ 		if (ret)
+ 			return ret;
+ 
+diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
+index 21a7e17..572d481 100644
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -217,6 +217,7 @@ enum {
+ #define FRI2_64_UARTCLK  64000000 /*  64.0000 MHz */
+ #define FRI2_48_UARTCLK  48000000 /*  48.0000 MHz */
+ #define NTC1_UARTCLK     64000000 /*  64.0000 MHz */
++#define MINNOW_UARTCLK   50000000 /*  50.0000 MHz */
+ 
+ struct pch_uart_buffer {
+ 	unsigned char *buf;
+@@ -398,6 +399,10 @@ static int pch_uart_get_uartclk(void)
+ 		    strstr(cmp, "nanoETXexpress-TT")))
+ 		return NTC1_UARTCLK;
+ 
++	cmp = dmi_get_system_info(DMI_BOARD_NAME);
++	if (cmp && strstr(cmp, "MinnowBoard"))
++		return MINNOW_UARTCLK;
++
+ 	return DEFAULT_UARTCLK;
+ }
+ 
+diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
+index 97666e8..c35a9ec 100644
+--- a/drivers/usb/gadget/f_mass_storage.c
++++ b/drivers/usb/gadget/f_mass_storage.c
+@@ -413,6 +413,7 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
+ /* Caller must hold fsg->lock */
+ static void wakeup_thread(struct fsg_common *common)
+ {
++	smp_wmb();	/* ensure the write of bh->state is complete */
+ 	/* Tell the main thread that something has happened */
+ 	common->thread_wakeup_needed = 1;
+ 	if (common->thread_task)
+@@ -632,6 +633,7 @@ static int sleep_thread(struct fsg_common *common)
+ 	}
+ 	__set_current_state(TASK_RUNNING);
+ 	common->thread_wakeup_needed = 0;
++	smp_rmb();	/* ensure the latest bh->state is visible */
+ 	return rc;
+ }
+ 
+diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
+index 16d7150..dda408f 100644
+--- a/drivers/usb/host/ehci-omap.c
++++ b/drivers/usb/host/ehci-omap.c
+@@ -187,6 +187,12 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
+ 		}
+ 
+ 		omap->phy[i] = phy;
++
++		if (pdata->port_mode[i] == OMAP_EHCI_PORT_MODE_PHY) {
++			usb_phy_init(omap->phy[i]);
++			/* bring PHY out of suspend */
++			usb_phy_set_suspend(omap->phy[i], 0);
++		}
+ 	}
+ 
+ 	pm_runtime_enable(dev);
+@@ -211,13 +217,14 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	/*
+-	 * Bring PHYs out of reset.
++	 * Bring PHYs out of reset for non PHY modes.
+ 	 * Even though HSIC mode is a PHY-less mode, the reset
+ 	 * line exists between the chips and can be modelled
+ 	 * as a PHY device for reset control.
+ 	 */
+ 	for (i = 0; i < omap->nports; i++) {
+-		if (!omap->phy[i])
++		if (!omap->phy[i] ||
++		     pdata->port_mode[i] == OMAP_EHCI_PORT_MODE_PHY)
+ 			continue;
+ 
+ 		usb_phy_init(omap->phy[i]);
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index fbf75e5..f2e57a1 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -369,6 +369,10 @@ static struct xhci_container_ctx *xhci_alloc_container_ctx(struct xhci_hcd *xhci
+ 		ctx->size += CTX_SIZE(xhci->hcc_params);
+ 
+ 	ctx->bytes = dma_pool_alloc(xhci->device_pool, flags, &ctx->dma);
++	if (!ctx->bytes) {
++		kfree(ctx);
++		return NULL;
++	}
+ 	memset(ctx->bytes, 0, ctx->size);
+ 	return ctx;
+ }
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index df90fe5..93ad67e 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -179,6 +179,7 @@ static int xhci_plat_remove(struct platform_device *dev)
+ 
+ 	usb_remove_hcd(hcd);
+ 	iounmap(hcd->regs);
++	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+ 	usb_put_hcd(hcd);
+ 	kfree(xhci);
+ 
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index bd4323d..5dd857d 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -159,8 +159,6 @@ static void option_instat_callback(struct urb *urb);
+ #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED	0x9000
+ #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED	0x9001
+ #define NOVATELWIRELESS_PRODUCT_E362		0x9010
+-#define NOVATELWIRELESS_PRODUCT_G1		0xA001
+-#define NOVATELWIRELESS_PRODUCT_G1_M		0xA002
+ #define NOVATELWIRELESS_PRODUCT_G2		0xA010
+ #define NOVATELWIRELESS_PRODUCT_MC551		0xB001
+ 
+@@ -730,8 +728,6 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC547) },
+ 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED) },
+ 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED) },
+-	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1) },
+-	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1_M) },
+ 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G2) },
+ 	/* Novatel Ovation MC551 a.k.a. Verizon USB551L */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) },
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index bd794b4..c65437c 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -35,7 +35,13 @@ static const struct usb_device_id id_table[] = {
+ 	{DEVICE_G1K(0x04da, 0x250c)},	/* Panasonic Gobi QDL device */
+ 	{DEVICE_G1K(0x413c, 0x8172)},	/* Dell Gobi Modem device */
+ 	{DEVICE_G1K(0x413c, 0x8171)},	/* Dell Gobi QDL device */
+-	{DEVICE_G1K(0x1410, 0xa001)},	/* Novatel Gobi Modem device */
++	{DEVICE_G1K(0x1410, 0xa001)},	/* Novatel/Verizon USB-1000 */
++	{DEVICE_G1K(0x1410, 0xa002)},	/* Novatel Gobi Modem device */
++	{DEVICE_G1K(0x1410, 0xa003)},	/* Novatel Gobi Modem device */
++	{DEVICE_G1K(0x1410, 0xa004)},	/* Novatel Gobi Modem device */
++	{DEVICE_G1K(0x1410, 0xa005)},	/* Novatel Gobi Modem device */
++	{DEVICE_G1K(0x1410, 0xa006)},	/* Novatel Gobi Modem device */
++	{DEVICE_G1K(0x1410, 0xa007)},	/* Novatel Gobi Modem device */
+ 	{DEVICE_G1K(0x1410, 0xa008)},	/* Novatel Gobi QDL device */
+ 	{DEVICE_G1K(0x0b05, 0x1776)},	/* Asus Gobi Modem device */
+ 	{DEVICE_G1K(0x0b05, 0x1774)},	/* Asus Gobi QDL device */
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 02fae7f..7fb054b 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1089,7 +1089,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+ 		btrfs_set_node_ptr_generation(parent, parent_slot,
+ 					      trans->transid);
+ 		btrfs_mark_buffer_dirty(parent);
+-		tree_mod_log_free_eb(root->fs_info, buf);
++		if (last_ref)
++			tree_mod_log_free_eb(root->fs_info, buf);
+ 		btrfs_free_tree_block(trans, root, buf, parent_start,
+ 				      last_ref);
+ 	}
+@@ -1161,8 +1162,8 @@ __tree_mod_log_oldest_root(struct btrfs_fs_info *fs_info,
+  * time_seq).
+  */
+ static void
+-__tree_mod_log_rewind(struct extent_buffer *eb, u64 time_seq,
+-		      struct tree_mod_elem *first_tm)
++__tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct extent_buffer *eb,
++		      u64 time_seq, struct tree_mod_elem *first_tm)
+ {
+ 	u32 n;
+ 	struct rb_node *next;
+@@ -1172,6 +1173,7 @@ __tree_mod_log_rewind(struct extent_buffer *eb, u64 time_seq,
+ 	unsigned long p_size = sizeof(struct btrfs_key_ptr);
+ 
+ 	n = btrfs_header_nritems(eb);
++	tree_mod_log_read_lock(fs_info);
+ 	while (tm && tm->seq >= time_seq) {
+ 		/*
+ 		 * all the operations are recorded with the operator used for
+@@ -1226,6 +1228,7 @@ __tree_mod_log_rewind(struct extent_buffer *eb, u64 time_seq,
+ 		if (tm->index != first_tm->index)
+ 			break;
+ 	}
++	tree_mod_log_read_unlock(fs_info);
+ 	btrfs_set_header_nritems(eb, n);
+ }
+ 
+@@ -1274,7 +1277,7 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct extent_buffer *eb,
+ 
+ 	extent_buffer_get(eb_rewin);
+ 	btrfs_tree_read_lock(eb_rewin);
+-	__tree_mod_log_rewind(eb_rewin, time_seq, tm);
++	__tree_mod_log_rewind(fs_info, eb_rewin, time_seq, tm);
+ 	WARN_ON(btrfs_header_nritems(eb_rewin) >
+ 		BTRFS_NODEPTRS_PER_BLOCK(fs_info->tree_root));
+ 
+@@ -1350,7 +1353,7 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
+ 		btrfs_set_header_generation(eb, old_generation);
+ 	}
+ 	if (tm)
+-		__tree_mod_log_rewind(eb, time_seq, tm);
++		__tree_mod_log_rewind(root->fs_info, eb, time_seq, tm);
+ 	else
+ 		WARN_ON(btrfs_header_level(eb) != 0);
+ 	WARN_ON(btrfs_header_nritems(eb) > BTRFS_NODEPTRS_PER_BLOCK(root));
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index ff40f1c..ba9690b 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -4579,6 +4579,41 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
+ 	send_root = BTRFS_I(file_inode(mnt_file))->root;
+ 	fs_info = send_root->fs_info;
+ 
++	/*
++	 * This is done when we lookup the root, it should already be complete
++	 * by the time we get here.
++	 */
++	WARN_ON(send_root->orphan_cleanup_state != ORPHAN_CLEANUP_DONE);
++
++	/*
++	 * If we just created this root we need to make sure that the orphan
++	 * cleanup has been done and committed since we search the commit root,
++	 * so check its commit root transid with our otransid and if they match
++	 * commit the transaction to make sure everything is updated.
++	 */
++	down_read(&send_root->fs_info->extent_commit_sem);
++	if (btrfs_header_generation(send_root->commit_root) ==
++	    btrfs_root_otransid(&send_root->root_item)) {
++		struct btrfs_trans_handle *trans;
++
++		up_read(&send_root->fs_info->extent_commit_sem);
++
++		trans = btrfs_attach_transaction_barrier(send_root);
++		if (IS_ERR(trans)) {
++			if (PTR_ERR(trans) != -ENOENT) {
++				ret = PTR_ERR(trans);
++				goto out;
++			}
++			/* ENOENT means theres no transaction */
++		} else {
++			ret = btrfs_commit_transaction(trans, send_root);
++			if (ret)
++				goto out;
++		}
++	} else {
++		up_read(&send_root->fs_info->extent_commit_sem);
++	}
++
+ 	arg = memdup_user(arg_, sizeof(*arg));
+ 	if (IS_ERR(arg)) {
+ 		ret = PTR_ERR(arg);
+diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
+index 4fb0974..fe8d627 100644
+--- a/fs/cifs/cifs_unicode.h
++++ b/fs/cifs/cifs_unicode.h
+@@ -327,14 +327,14 @@ UniToupper(register wchar_t uc)
+ /*
+  * UniStrupr:  Upper case a unicode string
+  */
+-static inline wchar_t *
+-UniStrupr(register wchar_t *upin)
++static inline __le16 *
++UniStrupr(register __le16 *upin)
+ {
+-	register wchar_t *up;
++	register __le16 *up;
+ 
+ 	up = upin;
+ 	while (*up) {		/* For all characters */
+-		*up = UniToupper(*up);
++		*up = cpu_to_le16(UniToupper(le16_to_cpu(*up)));
+ 		up++;
+ 	}
+ 	return upin;		/* Return input pointer */
+diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
+index 71436d1..f59d0d5 100644
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -414,7 +414,7 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
+ 	int rc = 0;
+ 	int len;
+ 	char nt_hash[CIFS_NTHASH_SIZE];
+-	wchar_t *user;
++	__le16 *user;
+ 	wchar_t *domain;
+ 	wchar_t *server;
+ 
+@@ -439,7 +439,7 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
+ 		return rc;
+ 	}
+ 
+-	/* convert ses->user_name to unicode and uppercase */
++	/* convert ses->user_name to unicode */
+ 	len = ses->user_name ? strlen(ses->user_name) : 0;
+ 	user = kmalloc(2 + (len * 2), GFP_KERNEL);
+ 	if (user == NULL) {
+@@ -448,7 +448,7 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
+ 	}
+ 
+ 	if (len) {
+-		len = cifs_strtoUTF16((__le16 *)user, ses->user_name, len, nls_cp);
++		len = cifs_strtoUTF16(user, ses->user_name, len, nls_cp);
+ 		UniStrupr(user);
+ 	} else {
+ 		memset(user, '\0', 2);
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 48b29d2..c2934f8 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -553,11 +553,10 @@ cifs_relock_file(struct cifsFileInfo *cfile)
+ 	struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
+ 	int rc = 0;
+ 
+-	/* we are going to update can_cache_brlcks here - need a write access */
+-	down_write(&cinode->lock_sem);
++	down_read(&cinode->lock_sem);
+ 	if (cinode->can_cache_brlcks) {
+-		/* can cache locks - no need to push them */
+-		up_write(&cinode->lock_sem);
++		/* can cache locks - no need to relock */
++		up_read(&cinode->lock_sem);
+ 		return rc;
+ 	}
+ 
+@@ -568,7 +567,7 @@ cifs_relock_file(struct cifsFileInfo *cfile)
+ 	else
+ 		rc = tcon->ses->server->ops->push_mand_locks(cfile);
+ 
+-	up_write(&cinode->lock_sem);
++	up_read(&cinode->lock_sem);
+ 	return rc;
+ }
+ 
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 20efd81..449b6cf 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -558,6 +558,11 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
+ 			fattr->cf_mode &= ~(S_IWUGO);
+ 
+ 		fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
++		if (fattr->cf_nlink < 1) {
++			cifs_dbg(1, "replacing bogus file nlink value %u\n",
++				fattr->cf_nlink);
++			fattr->cf_nlink = 1;
++		}
+ 	}
+ 
+ 	fattr->cf_uid = cifs_sb->mnt_uid;
+diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
+index 692de13..cea8ecf 100644
+--- a/fs/ext3/namei.c
++++ b/fs/ext3/namei.c
+@@ -576,11 +576,8 @@ static int htree_dirblock_to_tree(struct file *dir_file,
+ 		if (!ext3_check_dir_entry("htree_dirblock_to_tree", dir, de, bh,
+ 					(block<<EXT3_BLOCK_SIZE_BITS(dir->i_sb))
+ 						+((char *)de - bh->b_data))) {
+-			/* On error, skip the f_pos to the next block. */
+-			dir_file->f_pos = (dir_file->f_pos |
+-					(dir->i_sb->s_blocksize - 1)) + 1;
+-			brelse (bh);
+-			return count;
++			/* silently ignore the rest of the block */
++			break;
+ 		}
+ 		ext3fs_dirhash(de->name, de->name_len, hinfo);
+ 		if ((hinfo->hash < start_hash) ||
+diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
+index d0f13ea..3742e4c 100644
+--- a/fs/ext4/balloc.c
++++ b/fs/ext4/balloc.c
+@@ -38,8 +38,8 @@ ext4_group_t ext4_get_group_number(struct super_block *sb,
+ 	ext4_group_t group;
+ 
+ 	if (test_opt2(sb, STD_GROUP_SIZE))
+-		group = (le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block) +
+-			 block) >>
++		group = (block -
++			 le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) >>
+ 			(EXT4_BLOCK_SIZE_BITS(sb) + EXT4_CLUSTER_BITS(sb) + 3);
+ 	else
+ 		ext4_get_group_no_and_offset(sb, block, &group, NULL);
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index bc0f191..e49da58 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4659,7 +4659,7 @@ static int ext4_xattr_fiemap(struct inode *inode,
+ 		error = ext4_get_inode_loc(inode, &iloc);
+ 		if (error)
+ 			return error;
+-		physical = iloc.bh->b_blocknr << blockbits;
++		physical = (__u64)iloc.bh->b_blocknr << blockbits;
+ 		offset = EXT4_GOOD_OLD_INODE_SIZE +
+ 				EXT4_I(inode)->i_extra_isize;
+ 		physical += offset;
+@@ -4667,7 +4667,7 @@ static int ext4_xattr_fiemap(struct inode *inode,
+ 		flags |= FIEMAP_EXTENT_DATA_INLINE;
+ 		brelse(iloc.bh);
+ 	} else { /* external block */
+-		physical = EXT4_I(inode)->i_file_acl << blockbits;
++		physical = (__u64)EXT4_I(inode)->i_file_acl << blockbits;
+ 		length = inode->i_sb->s_blocksize;
+ 	}
+ 
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index b1b4d51..b19f0a4 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -312,7 +312,7 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
+ 	blkbits = inode->i_sb->s_blocksize_bits;
+ 	startoff = *offset;
+ 	lastoff = startoff;
+-	endoff = (map->m_lblk + map->m_len) << blkbits;
++	endoff = (loff_t)(map->m_lblk + map->m_len) << blkbits;
+ 
+ 	index = startoff >> PAGE_CACHE_SHIFT;
+ 	end = endoff >> PAGE_CACHE_SHIFT;
+@@ -457,7 +457,7 @@ static loff_t ext4_seek_data(struct file *file, loff_t offset, loff_t maxsize)
+ 		ret = ext4_map_blocks(NULL, inode, &map, 0);
+ 		if (ret > 0 && !(map.m_flags & EXT4_MAP_UNWRITTEN)) {
+ 			if (last != start)
+-				dataoff = last << blkbits;
++				dataoff = (loff_t)last << blkbits;
+ 			break;
+ 		}
+ 
+@@ -468,7 +468,7 @@ static loff_t ext4_seek_data(struct file *file, loff_t offset, loff_t maxsize)
+ 		ext4_es_find_delayed_extent_range(inode, last, last, &es);
+ 		if (es.es_len != 0 && in_range(last, es.es_lblk, es.es_len)) {
+ 			if (last != start)
+-				dataoff = last << blkbits;
++				dataoff = (loff_t)last << blkbits;
+ 			break;
+ 		}
+ 
+@@ -486,7 +486,7 @@ static loff_t ext4_seek_data(struct file *file, loff_t offset, loff_t maxsize)
+ 		}
+ 
+ 		last++;
+-		dataoff = last << blkbits;
++		dataoff = (loff_t)last << blkbits;
+ 	} while (last <= end);
+ 
+ 	mutex_unlock(&inode->i_mutex);
+@@ -540,7 +540,7 @@ static loff_t ext4_seek_hole(struct file *file, loff_t offset, loff_t maxsize)
+ 		ret = ext4_map_blocks(NULL, inode, &map, 0);
+ 		if (ret > 0 && !(map.m_flags & EXT4_MAP_UNWRITTEN)) {
+ 			last += ret;
+-			holeoff = last << blkbits;
++			holeoff = (loff_t)last << blkbits;
+ 			continue;
+ 		}
+ 
+@@ -551,7 +551,7 @@ static loff_t ext4_seek_hole(struct file *file, loff_t offset, loff_t maxsize)
+ 		ext4_es_find_delayed_extent_range(inode, last, last, &es);
+ 		if (es.es_len != 0 && in_range(last, es.es_lblk, es.es_len)) {
+ 			last = es.es_lblk + es.es_len;
+-			holeoff = last << blkbits;
++			holeoff = (loff_t)last << blkbits;
+ 			continue;
+ 		}
+ 
+@@ -566,7 +566,7 @@ static loff_t ext4_seek_hole(struct file *file, loff_t offset, loff_t maxsize)
+ 							      &map, &holeoff);
+ 			if (!unwritten) {
+ 				last += ret;
+-				holeoff = last << blkbits;
++				holeoff = (loff_t)last << blkbits;
+ 				continue;
+ 			}
+ 		}
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 3e2bf87..33331b4 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1842,7 +1842,7 @@ int ext4_inline_data_fiemap(struct inode *inode,
+ 	if (error)
+ 		goto out;
+ 
+-	physical = iloc.bh->b_blocknr << inode->i_sb->s_blocksize_bits;
++	physical = (__u64)iloc.bh->b_blocknr << inode->i_sb->s_blocksize_bits;
+ 	physical += (char *)ext4_raw_inode(&iloc) - iloc.bh->b_data;
+ 	physical += offsetof(struct ext4_inode, i_block);
+ 	length = i_size_read(inode);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index d6382b8..ccbfbbb 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1118,10 +1118,13 @@ static int ext4_write_end(struct file *file,
+ 		}
+ 	}
+ 
+-	if (ext4_has_inline_data(inode))
+-		copied = ext4_write_inline_data_end(inode, pos, len,
+-						    copied, page);
+-	else
++	if (ext4_has_inline_data(inode)) {
++		ret = ext4_write_inline_data_end(inode, pos, len,
++						 copied, page);
++		if (ret < 0)
++			goto errout;
++		copied = ret;
++	} else
+ 		copied = block_write_end(file, mapping, pos,
+ 					 len, copied, page, fsdata);
+ 
+@@ -4805,7 +4808,7 @@ int ext4_getattr(struct vfsmount *mnt, struct dentry *dentry,
+ 		 struct kstat *stat)
+ {
+ 	struct inode *inode;
+-	unsigned long delalloc_blocks;
++	unsigned long long delalloc_blocks;
+ 
+ 	inode = dentry->d_inode;
+ 	generic_fillattr(inode, stat);
+@@ -4823,7 +4826,7 @@ int ext4_getattr(struct vfsmount *mnt, struct dentry *dentry,
+ 	delalloc_blocks = EXT4_C2B(EXT4_SB(inode->i_sb),
+ 				EXT4_I(inode)->i_reserved_data_blocks);
+ 
+-	stat->blocks += (delalloc_blocks << inode->i_sb->s_blocksize_bits)>>9;
++	stat->blocks += delalloc_blocks << (inode->i_sb->s_blocksize_bits-9);
+ 	return 0;
+ }
+ 
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index def8408..59c6750 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -4735,11 +4735,16 @@ do_more:
+ 		 * blocks being freed are metadata. these blocks shouldn't
+ 		 * be used until this transaction is committed
+ 		 */
++	retry:
+ 		new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS);
+ 		if (!new_entry) {
+-			ext4_mb_unload_buddy(&e4b);
+-			err = -ENOMEM;
+-			goto error_return;
++			/*
++			 * We use a retry loop because
++			 * ext4_free_blocks() is not allowed to fail.
++			 */
++			cond_resched();
++			congestion_wait(BLK_RW_ASYNC, HZ/50);
++			goto retry;
+ 		}
+ 		new_entry->efd_start_cluster = bit;
+ 		new_entry->efd_group = block_group;
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 6653fc3..ab2f6dc 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -918,11 +918,8 @@ static int htree_dirblock_to_tree(struct file *dir_file,
+ 				bh->b_data, bh->b_size,
+ 				(block<<EXT4_BLOCK_SIZE_BITS(dir->i_sb))
+ 					 + ((char *)de - bh->b_data))) {
+-			/* On error, skip the f_pos to the next block. */
+-			dir_file->f_pos = (dir_file->f_pos |
+-					(dir->i_sb->s_blocksize - 1)) + 1;
+-			brelse(bh);
+-			return count;
++			/* silently ignore the rest of the block */
++			break;
+ 		}
+ 		ext4fs_dirhash(de->name, de->name_len, hinfo);
+ 		if ((hinfo->hash < start_hash) ||
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index b27c96d..49d3c01 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1656,12 +1656,10 @@ errout:
+ 		err = err2;
+ 
+ 	if (!err) {
+-		ext4_fsblk_t first_block;
+-		first_block = ext4_group_first_block_no(sb, 0);
+ 		if (test_opt(sb, DEBUG))
+ 			printk(KERN_DEBUG "EXT4-fs: extended group to %llu "
+ 			       "blocks\n", ext4_blocks_count(es));
+-		update_backups(sb, EXT4_SB(sb)->s_sbh->b_blocknr - first_block,
++		update_backups(sb, EXT4_SB(sb)->s_sbh->b_blocknr,
+ 			       (char *)es, sizeof(struct ext4_super_block), 0);
+ 	}
+ 	return err;
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 94cc84d..6681c03 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1684,12 +1684,6 @@ static inline void ext4_show_quota_options(struct seq_file *seq,
+ 
+ 	if (sbi->s_qf_names[GRPQUOTA])
+ 		seq_printf(seq, ",grpjquota=%s", sbi->s_qf_names[GRPQUOTA]);
+-
+-	if (test_opt(sb, USRQUOTA))
+-		seq_puts(seq, ",usrquota");
+-
+-	if (test_opt(sb, GRPQUOTA))
+-		seq_puts(seq, ",grpquota");
+ #endif
+ }
+ 
+@@ -3586,10 +3580,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ 	sbi->s_addr_per_block_bits = ilog2(EXT4_ADDR_PER_BLOCK(sb));
+ 	sbi->s_desc_per_block_bits = ilog2(EXT4_DESC_PER_BLOCK(sb));
+ 
+-	/* Do we have standard group size of blocksize * 8 blocks ? */
+-	if (sbi->s_blocks_per_group == blocksize << 3)
+-		set_opt2(sb, STD_GROUP_SIZE);
+-
+ 	for (i = 0; i < 4; i++)
+ 		sbi->s_hash_seed[i] = le32_to_cpu(es->s_hash_seed[i]);
+ 	sbi->s_def_hash_version = es->s_def_hash_version;
+@@ -3659,6 +3649,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ 		goto failed_mount;
+ 	}
+ 
++	/* Do we have standard group size of clustersize * 8 blocks ? */
++	if (sbi->s_blocks_per_group == clustersize << 3)
++		set_opt2(sb, STD_GROUP_SIZE);
++
+ 	/*
+ 	 * Test whether we have more sectors than will fit in sector_t,
+ 	 * and whether the max offset is addressable by the page cache.
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 9545757..aaa1a3f 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1318,6 +1318,7 @@ static int journal_reset(journal_t *journal)
+ static void jbd2_write_superblock(journal_t *journal, int write_op)
+ {
+ 	struct buffer_head *bh = journal->j_sb_buffer;
++	journal_superblock_t *sb = journal->j_superblock;
+ 	int ret;
+ 
+ 	trace_jbd2_write_superblock(journal, write_op);
+@@ -1339,6 +1340,7 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
+ 		clear_buffer_write_io_error(bh);
+ 		set_buffer_uptodate(bh);
+ 	}
++	jbd2_superblock_csum_set(journal, sb);
+ 	get_bh(bh);
+ 	bh->b_end_io = end_buffer_write_sync;
+ 	ret = submit_bh(write_op, bh);
+@@ -1435,7 +1437,6 @@ void jbd2_journal_update_sb_errno(journal_t *journal)
+ 	jbd_debug(1, "JBD2: updating superblock error (errno %d)\n",
+ 		  journal->j_errno);
+ 	sb->s_errno    = cpu_to_be32(journal->j_errno);
+-	jbd2_superblock_csum_set(journal, sb);
+ 	read_unlock(&journal->j_state_lock);
+ 
+ 	jbd2_write_superblock(journal, WRITE_SYNC);
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 10f524c..e0c0bc2 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -517,10 +517,10 @@ int jbd2__journal_restart(handle_t *handle, int nblocks, gfp_t gfp_mask)
+ 		   &transaction->t_outstanding_credits);
+ 	if (atomic_dec_and_test(&transaction->t_updates))
+ 		wake_up(&journal->j_wait_updates);
++	tid = transaction->t_tid;
+ 	spin_unlock(&transaction->t_handle_lock);
+ 
+ 	jbd_debug(2, "restarting handle %p\n", handle);
+-	tid = transaction->t_tid;
+ 	need_to_start = !tid_geq(journal->j_commit_request, tid);
+ 	read_unlock(&journal->j_state_lock);
+ 	if (need_to_start)
+diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
+index 2e3ea30..5b8d944 100644
+--- a/fs/ocfs2/xattr.c
++++ b/fs/ocfs2/xattr.c
+@@ -6499,6 +6499,16 @@ static int ocfs2_reflink_xattr_inline(struct ocfs2_xattr_reflink *args)
+ 	}
+ 
+ 	new_oi = OCFS2_I(args->new_inode);
++	/*
++	 * Adjust extent record count to reserve space for extended attribute.
++	 * Inline data count had been adjusted in ocfs2_duplicate_inline_data().
++	 */
++	if (!(new_oi->ip_dyn_features & OCFS2_INLINE_DATA_FL) &&
++	    !(ocfs2_inode_is_fast_symlink(args->new_inode))) {
++		struct ocfs2_extent_list *el = &new_di->id2.i_list;
++		le16_add_cpu(&el->l_count, -(inline_size /
++					sizeof(struct ocfs2_extent_rec)));
++	}
+ 	spin_lock(&new_oi->ip_lock);
+ 	new_oi->ip_dyn_features |= OCFS2_HAS_XATTR_FL | OCFS2_INLINE_XATTR_FL;
+ 	new_di->i_dyn_features = cpu_to_le16(new_oi->ip_dyn_features);
+diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
+index f21acf0..879b997 100644
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1412,7 +1412,7 @@ static int mount_ubifs(struct ubifs_info *c)
+ 
+ 	ubifs_msg("mounted UBI device %d, volume %d, name \"%s\"%s",
+ 		  c->vi.ubi_num, c->vi.vol_id, c->vi.name,
+-		  c->ro_mount ? ", R/O mode" : NULL);
++		  c->ro_mount ? ", R/O mode" : "");
+ 	x = (long long)c->main_lebs * c->leb_size;
+ 	y = (long long)c->log_lebs * c->leb_size + c->max_bud_bytes;
+ 	ubifs_msg("LEB size: %d bytes (%d KiB), min./max. I/O unit sizes: %d bytes/%d bytes",
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index 8bda129..8852d37 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -646,22 +646,60 @@ static inline struct cgroup_subsys_state *cgroup_subsys_state(
+ 	return cgrp->subsys[subsys_id];
+ }
+ 
+-/*
+- * function to get the cgroup_subsys_state which allows for extra
+- * rcu_dereference_check() conditions, such as locks used during the
+- * cgroup_subsys::attach() methods.
++/**
++ * task_css_set_check - obtain a task's css_set with extra access conditions
++ * @task: the task to obtain css_set for
++ * @__c: extra condition expression to be passed to rcu_dereference_check()
++ *
++ * A task's css_set is RCU protected, initialized and exited while holding
++ * task_lock(), and can only be modified while holding both cgroup_mutex
++ * and task_lock() while the task is alive.  This macro verifies that the
++ * caller is inside proper critical section and returns @task's css_set.
++ *
++ * The caller can also specify additional allowed conditions via @__c, such
++ * as locks used during the cgroup_subsys::attach() methods.
+  */
+ #ifdef CONFIG_PROVE_RCU
+ extern struct mutex cgroup_mutex;
+-#define task_subsys_state_check(task, subsys_id, __c)			\
+-	rcu_dereference_check((task)->cgroups->subsys[(subsys_id)],	\
+-			      lockdep_is_held(&(task)->alloc_lock) ||	\
+-			      lockdep_is_held(&cgroup_mutex) || (__c))
++#define task_css_set_check(task, __c)					\
++	rcu_dereference_check((task)->cgroups,				\
++		lockdep_is_held(&(task)->alloc_lock) ||			\
++		lockdep_is_held(&cgroup_mutex) || (__c))
+ #else
+-#define task_subsys_state_check(task, subsys_id, __c)			\
+-	rcu_dereference((task)->cgroups->subsys[(subsys_id)])
++#define task_css_set_check(task, __c)					\
++	rcu_dereference((task)->cgroups)
+ #endif
+ 
++/**
++ * task_subsys_state_check - obtain css for (task, subsys) w/ extra access conds
++ * @task: the target task
++ * @subsys_id: the target subsystem ID
++ * @__c: extra condition expression to be passed to rcu_dereference_check()
++ *
++ * Return the cgroup_subsys_state for the (@task, @subsys_id) pair.  The
++ * synchronization rules are the same as task_css_set_check().
++ */
++#define task_subsys_state_check(task, subsys_id, __c)			\
++	task_css_set_check((task), (__c))->subsys[(subsys_id)]
++
++/**
++ * task_css_set - obtain a task's css_set
++ * @task: the task to obtain css_set for
++ *
++ * See task_css_set_check().
++ */
++static inline struct css_set *task_css_set(struct task_struct *task)
++{
++	return task_css_set_check(task, false);
++}
++
++/**
++ * task_subsys_state - obtain css for (task, subsys)
++ * @task: the target task
++ * @subsys_id: the target subsystem ID
++ *
++ * See task_subsys_state_check().
++ */
+ static inline struct cgroup_subsys_state *
+ task_subsys_state(struct task_struct *task, int subsys_id)
+ {
+diff --git a/include/linux/nbd.h b/include/linux/nbd.h
+index 4871170..ae4981e 100644
+--- a/include/linux/nbd.h
++++ b/include/linux/nbd.h
+@@ -41,6 +41,7 @@ struct nbd_device {
+ 	u64 bytesize;
+ 	pid_t pid; /* pid of nbd-client, if attached */
+ 	int xmit_timeout;
++	int disconnect; /* a disconnect has been requested by user */
+ };
+ 
+ #endif
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index a7c9e6d..c6e77ef 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -3727,6 +3727,23 @@ static int cgroup_write_notify_on_release(struct cgroup *cgrp,
+ }
+ 
+ /*
++ * When dput() is called asynchronously, if umount has been done and
++ * then deactivate_super() in cgroup_free_fn() kills the superblock,
++ * there's a small window that vfs will see the root dentry with non-zero
++ * refcnt and trigger BUG().
++ *
++ * That's why we hold a reference before dput() and drop it right after.
++ */
++static void cgroup_dput(struct cgroup *cgrp)
++{
++	struct super_block *sb = cgrp->root->sb;
++
++	atomic_inc(&sb->s_active);
++	dput(cgrp->dentry);
++	deactivate_super(sb);
++}
++
++/*
+  * Unregister event and free resources.
+  *
+  * Gets called from workqueue.
+@@ -3746,7 +3763,7 @@ static void cgroup_event_remove(struct work_struct *work)
+ 
+ 	eventfd_ctx_put(event->eventfd);
+ 	kfree(event);
+-	dput(cgrp->dentry);
++	cgroup_dput(cgrp);
+ }
+ 
+ /*
+@@ -4031,12 +4048,8 @@ static void css_dput_fn(struct work_struct *work)
+ {
+ 	struct cgroup_subsys_state *css =
+ 		container_of(work, struct cgroup_subsys_state, dput_work);
+-	struct dentry *dentry = css->cgroup->dentry;
+-	struct super_block *sb = dentry->d_sb;
+ 
+-	atomic_inc(&sb->s_active);
+-	dput(dentry);
+-	deactivate_super(sb);
++	cgroup_dput(css->cgroup);
+ }
+ 
+ static void init_cgroup_css(struct cgroup_subsys_state *css,
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index fa17855..dc4db32 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -555,9 +555,9 @@ int can_request_irq(unsigned int irq, unsigned long irqflags)
+ 		return 0;
+ 
+ 	if (irq_settings_can_request(desc)) {
+-		if (desc->action)
+-			if (irqflags & desc->action->flags & IRQF_SHARED)
+-				canrequest =1;
++		if (!desc->action ||
++		    irqflags & desc->action->flags & IRQF_SHARED)
++			canrequest = 1;
+ 	}
+ 	irq_put_desc_unlock(desc, flags);
+ 	return canrequest;
+diff --git a/kernel/timer.c b/kernel/timer.c
+index 15ffdb3..15bc1b4 100644
+--- a/kernel/timer.c
++++ b/kernel/timer.c
+@@ -149,9 +149,11 @@ static unsigned long round_jiffies_common(unsigned long j, int cpu,
+ 	/* now that we have rounded, subtract the extra skew again */
+ 	j -= cpu * 3;
+ 
+-	if (j <= jiffies) /* rounding ate our timeout entirely; */
+-		return original;
+-	return j;
++	/*
++	 * Make sure j is still in the future. Otherwise return the
++	 * unmodified value.
++	 */
++	return time_is_after_jiffies(j) ? j : original;
+ }
+ 
+ /**
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index fd79df5..15b0409 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -6296,14 +6296,6 @@ mem_cgroup_css_online(struct cgroup *cont)
+ 
+ 	error = memcg_init_kmem(memcg, &mem_cgroup_subsys);
+ 	mutex_unlock(&memcg_create_mutex);
+-	if (error) {
+-		/*
+-		 * We call put now because our (and parent's) refcnts
+-		 * are already in place. mem_cgroup_put() will internally
+-		 * call __mem_cgroup_free, so return directly
+-		 */
+-		mem_cgroup_put(memcg);
+-	}
+ 	return error;
+ }
+ 
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index c3edb62..2ee0fd3 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -6142,6 +6142,10 @@ __offline_isolated_pages(unsigned long start_pfn, unsigned long end_pfn)
+ 		list_del(&page->lru);
+ 		rmv_page_order(page);
+ 		zone->free_area[order].nr_free--;
++#ifdef CONFIG_HIGHMEM
++		if (PageHighMem(page))
++			totalhigh_pages -= 1 << order;
++#endif
+ 		for (i = 0; i < (1 << order); i++)
+ 			SetPageReserved((page+i));
+ 		pfn += (1 << order);
+diff --git a/mm/slab.c b/mm/slab.c
+index 8ccd296..bd88411 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -565,7 +565,7 @@ static void init_node_lock_keys(int q)
+ 	if (slab_state < UP)
+ 		return;
+ 
+-	for (i = 1; i < PAGE_SHIFT + MAX_ORDER; i++) {
++	for (i = 1; i <= KMALLOC_SHIFT_HIGH; i++) {
+ 		struct kmem_cache_node *n;
+ 		struct kmem_cache *cache = kmalloc_caches[i];
+ 

Added: genpatches-2.6/trunk/3.10.7/1002_linux-3.10.3.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/1002_linux-3.10.3.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/1002_linux-3.10.3.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,4037 @@
+diff --git a/Documentation/i2c/busses/i2c-piix4 b/Documentation/i2c/busses/i2c-piix4
+index 1e6634f5..a370b204 100644
+--- a/Documentation/i2c/busses/i2c-piix4
++++ b/Documentation/i2c/busses/i2c-piix4
+@@ -13,7 +13,7 @@ Supported adapters:
+   * AMD SP5100 (SB700 derivative found on some server mainboards)
+     Datasheet: Publicly available at the AMD website
+     http://support.amd.com/us/Embedded_TechDocs/44413.pdf
+-  * AMD Hudson-2
++  * AMD Hudson-2, CZ
+     Datasheet: Not publicly available
+   * Standard Microsystems (SMSC) SLC90E66 (Victory66) southbridge
+     Datasheet: Publicly available at the SMSC website http://www.smsc.com
+diff --git a/Makefile b/Makefile
+index 43367309..b5485529 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 2
++SUBLEVEL = 3
+ EXTRAVERSION =
+ NAME = Unicycling Gorilla
+ 
+diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
+index 1426468b..f51d669c 100644
+--- a/arch/arm64/mm/fault.c
++++ b/arch/arm64/mm/fault.c
+@@ -152,25 +152,8 @@ void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *regs)
+ #define ESR_CM			(1 << 8)
+ #define ESR_LNX_EXEC		(1 << 24)
+ 
+-/*
+- * Check that the permissions on the VMA allow for the fault which occurred.
+- * If we encountered a write fault, we must have write permission, otherwise
+- * we allow any permission.
+- */
+-static inline bool access_error(unsigned int esr, struct vm_area_struct *vma)
+-{
+-	unsigned int mask = VM_READ | VM_WRITE | VM_EXEC;
+-
+-	if (esr & ESR_WRITE)
+-		mask = VM_WRITE;
+-	if (esr & ESR_LNX_EXEC)
+-		mask = VM_EXEC;
+-
+-	return vma->vm_flags & mask ? false : true;
+-}
+-
+ static int __do_page_fault(struct mm_struct *mm, unsigned long addr,
+-			   unsigned int esr, unsigned int flags,
++			   unsigned int mm_flags, unsigned long vm_flags,
+ 			   struct task_struct *tsk)
+ {
+ 	struct vm_area_struct *vma;
+@@ -188,12 +171,17 @@ static int __do_page_fault(struct mm_struct *mm, unsigned long addr,
+ 	 * it.
+ 	 */
+ good_area:
+-	if (access_error(esr, vma)) {
++	/*
++	 * Check that the permissions on the VMA allow for the fault which
++	 * occurred. If we encountered a write or exec fault, we must have
++	 * appropriate permissions, otherwise we allow any permission.
++	 */
++	if (!(vma->vm_flags & vm_flags)) {
+ 		fault = VM_FAULT_BADACCESS;
+ 		goto out;
+ 	}
+ 
+-	return handle_mm_fault(mm, vma, addr & PAGE_MASK, flags);
++	return handle_mm_fault(mm, vma, addr & PAGE_MASK, mm_flags);
+ 
+ check_stack:
+ 	if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
+@@ -208,9 +196,15 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
+ 	struct task_struct *tsk;
+ 	struct mm_struct *mm;
+ 	int fault, sig, code;
+-	bool write = (esr & ESR_WRITE) && !(esr & ESR_CM);
+-	unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
+-		(write ? FAULT_FLAG_WRITE : 0);
++	unsigned long vm_flags = VM_READ | VM_WRITE | VM_EXEC;
++	unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
++
++	if (esr & ESR_LNX_EXEC) {
++		vm_flags = VM_EXEC;
++	} else if ((esr & ESR_WRITE) && !(esr & ESR_CM)) {
++		vm_flags = VM_WRITE;
++		mm_flags |= FAULT_FLAG_WRITE;
++	}
+ 
+ 	tsk = current;
+ 	mm  = tsk->mm;
+@@ -248,7 +242,7 @@ retry:
+ #endif
+ 	}
+ 
+-	fault = __do_page_fault(mm, addr, esr, flags, tsk);
++	fault = __do_page_fault(mm, addr, mm_flags, vm_flags, tsk);
+ 
+ 	/*
+ 	 * If we need to retry but a fatal signal is pending, handle the
+@@ -265,7 +259,7 @@ retry:
+ 	 */
+ 
+ 	perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
+-	if (flags & FAULT_FLAG_ALLOW_RETRY) {
++	if (mm_flags & FAULT_FLAG_ALLOW_RETRY) {
+ 		if (fault & VM_FAULT_MAJOR) {
+ 			tsk->maj_flt++;
+ 			perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs,
+@@ -280,7 +274,7 @@ retry:
+ 			 * Clear FAULT_FLAG_ALLOW_RETRY to avoid any risk of
+ 			 * starvation.
+ 			 */
+-			flags &= ~FAULT_FLAG_ALLOW_RETRY;
++			mm_flags &= ~FAULT_FLAG_ALLOW_RETRY;
+ 			goto retry;
+ 		}
+ 	}
+diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c
+index 01b1b3f9..1e1e18c5 100644
+--- a/arch/mips/cavium-octeon/setup.c
++++ b/arch/mips/cavium-octeon/setup.c
+@@ -996,7 +996,7 @@ void __init plat_mem_setup(void)
+ 	cvmx_bootmem_unlock();
+ 	/* Add the memory region for the kernel. */
+ 	kernel_start = (unsigned long) _text;
+-	kernel_size = ALIGN(_end - _text, 0x100000);
++	kernel_size = _end - _text;
+ 
+ 	/* Adjust for physical offset. */
+ 	kernel_start &= ~0xffffffff80000000ULL;
+diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
+index 46793b58..07ca627e 100644
+--- a/arch/powerpc/include/asm/exception-64s.h
++++ b/arch/powerpc/include/asm/exception-64s.h
+@@ -358,12 +358,12 @@ label##_relon_pSeries:					\
+ 	/* No guest interrupts come through here */	\
+ 	SET_SCRATCH0(r13);		/* save r13 */	\
+ 	EXCEPTION_RELON_PROLOG_PSERIES(PACA_EXGEN, label##_common, \
+-				       EXC_STD, KVMTEST_PR, vec)
++				       EXC_STD, NOTEST, vec)
+ 
+ #define STD_RELON_EXCEPTION_PSERIES_OOL(vec, label)		\
+ 	.globl label##_relon_pSeries;				\
+ label##_relon_pSeries:						\
+-	EXCEPTION_PROLOG_1(PACA_EXGEN, KVMTEST_PR, vec);	\
++	EXCEPTION_PROLOG_1(PACA_EXGEN, NOTEST, vec);		\
+ 	EXCEPTION_RELON_PROLOG_PSERIES_1(label##_common, EXC_STD)
+ 
+ #define STD_RELON_EXCEPTION_HV(loc, vec, label)		\
+@@ -374,12 +374,12 @@ label##_relon_hv:					\
+ 	/* No guest interrupts come through here */	\
+ 	SET_SCRATCH0(r13);	/* save r13 */		\
+ 	EXCEPTION_RELON_PROLOG_PSERIES(PACA_EXGEN, label##_common, \
+-				       EXC_HV, KVMTEST, vec)
++				       EXC_HV, NOTEST, vec)
+ 
+ #define STD_RELON_EXCEPTION_HV_OOL(vec, label)			\
+ 	.globl label##_relon_hv;				\
+ label##_relon_hv:						\
+-	EXCEPTION_PROLOG_1(PACA_EXGEN, KVMTEST, vec);		\
++	EXCEPTION_PROLOG_1(PACA_EXGEN, NOTEST, vec);		\
+ 	EXCEPTION_RELON_PROLOG_PSERIES_1(label##_common, EXC_HV)
+ 
+ /* This associate vector numbers with bits in paca->irq_happened */
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index 4a9e4086..362142b6 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -626,6 +626,7 @@
+ #define   MMCR0_TRIGGER	0x00002000UL /* TRIGGER enable */
+ #define   MMCR0_PMAO	0x00000080UL /* performance monitor alert has occurred, set to 0 after handling exception */
+ #define   MMCR0_SHRFC	0x00000040UL /* SHRre freeze conditions between threads */
++#define   MMCR0_FC56	0x00000010UL /* freeze counters 5 and 6 */
+ #define   MMCR0_FCTI	0x00000008UL /* freeze counters in tags inactive mode */
+ #define   MMCR0_FCTA	0x00000004UL /* freeze counters in tags active mode */
+ #define   MMCR0_FCWAIT	0x00000002UL /* freeze counter in WAIT state */
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 40e4a17c..4e00d223 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -341,10 +341,17 @@ vsx_unavailable_pSeries_1:
+ 	EXCEPTION_PROLOG_0(PACA_EXGEN)
+ 	b	vsx_unavailable_pSeries
+ 
++facility_unavailable_trampoline:
+ 	. = 0xf60
+ 	SET_SCRATCH0(r13)
+ 	EXCEPTION_PROLOG_0(PACA_EXGEN)
+-	b	tm_unavailable_pSeries
++	b	facility_unavailable_pSeries
++
++hv_facility_unavailable_trampoline:
++	. = 0xf80
++	SET_SCRATCH0(r13)
++	EXCEPTION_PROLOG_0(PACA_EXGEN)
++	b	facility_unavailable_hv
+ 
+ #ifdef CONFIG_CBE_RAS
+ 	STD_EXCEPTION_HV(0x1200, 0x1202, cbe_system_error)
+@@ -522,8 +529,10 @@ denorm_done:
+ 	KVM_HANDLER_PR(PACA_EXGEN, EXC_STD, 0xf20)
+ 	STD_EXCEPTION_PSERIES_OOL(0xf40, vsx_unavailable)
+ 	KVM_HANDLER_PR(PACA_EXGEN, EXC_STD, 0xf40)
+-	STD_EXCEPTION_PSERIES_OOL(0xf60, tm_unavailable)
++	STD_EXCEPTION_PSERIES_OOL(0xf60, facility_unavailable)
+ 	KVM_HANDLER_PR(PACA_EXGEN, EXC_STD, 0xf60)
++	STD_EXCEPTION_HV_OOL(0xf82, facility_unavailable)
++	KVM_HANDLER(PACA_EXGEN, EXC_HV, 0xf82)
+ 
+ /*
+  * An interrupt came in while soft-disabled. We set paca->irq_happened, then:
+@@ -793,14 +802,10 @@ system_call_relon_pSeries:
+ 	STD_RELON_EXCEPTION_PSERIES(0x4d00, 0xd00, single_step)
+ 
+ 	. = 0x4e00
+-	SET_SCRATCH0(r13)
+-	EXCEPTION_PROLOG_0(PACA_EXGEN)
+-	b	h_data_storage_relon_hv
++	b	.	/* Can't happen, see v2.07 Book III-S section 6.5 */
+ 
+ 	. = 0x4e20
+-	SET_SCRATCH0(r13)
+-	EXCEPTION_PROLOG_0(PACA_EXGEN)
+-	b	h_instr_storage_relon_hv
++	b	.	/* Can't happen, see v2.07 Book III-S section 6.5 */
+ 
+ 	. = 0x4e40
+ 	SET_SCRATCH0(r13)
+@@ -808,9 +813,7 @@ system_call_relon_pSeries:
+ 	b	emulation_assist_relon_hv
+ 
+ 	. = 0x4e60
+-	SET_SCRATCH0(r13)
+-	EXCEPTION_PROLOG_0(PACA_EXGEN)
+-	b	hmi_exception_relon_hv
++	b	.	/* Can't happen, see v2.07 Book III-S section 6.5 */
+ 
+ 	. = 0x4e80
+ 	SET_SCRATCH0(r13)
+@@ -835,11 +838,17 @@ vsx_unavailable_relon_pSeries_1:
+ 	EXCEPTION_PROLOG_0(PACA_EXGEN)
+ 	b	vsx_unavailable_relon_pSeries
+ 
+-tm_unavailable_relon_pSeries_1:
++facility_unavailable_relon_trampoline:
+ 	. = 0x4f60
+ 	SET_SCRATCH0(r13)
+ 	EXCEPTION_PROLOG_0(PACA_EXGEN)
+-	b	tm_unavailable_relon_pSeries
++	b	facility_unavailable_relon_pSeries
++
++hv_facility_unavailable_relon_trampoline:
++	. = 0x4f80
++	SET_SCRATCH0(r13)
++	EXCEPTION_PROLOG_0(PACA_EXGEN)
++	b	facility_unavailable_relon_hv
+ 
+ 	STD_RELON_EXCEPTION_PSERIES(0x5300, 0x1300, instruction_breakpoint)
+ #ifdef CONFIG_PPC_DENORMALISATION
+@@ -1165,36 +1174,21 @@ END_FTR_SECTION_IFSET(CPU_FTR_VSX)
+ 	bl	.vsx_unavailable_exception
+ 	b	.ret_from_except
+ 
+-	.align	7
+-	.globl tm_unavailable_common
+-tm_unavailable_common:
+-	EXCEPTION_PROLOG_COMMON(0xf60, PACA_EXGEN)
+-	bl	.save_nvgprs
+-	DISABLE_INTS
+-	addi	r3,r1,STACK_FRAME_OVERHEAD
+-	bl	.tm_unavailable_exception
+-	b	.ret_from_except
++	STD_EXCEPTION_COMMON(0xf60, facility_unavailable, .facility_unavailable_exception)
+ 
+ 	.align	7
+ 	.globl	__end_handlers
+ __end_handlers:
+ 
+ 	/* Equivalents to the above handlers for relocation-on interrupt vectors */
+-	STD_RELON_EXCEPTION_HV_OOL(0xe00, h_data_storage)
+-	KVM_HANDLER(PACA_EXGEN, EXC_HV, 0xe00)
+-	STD_RELON_EXCEPTION_HV_OOL(0xe20, h_instr_storage)
+-	KVM_HANDLER(PACA_EXGEN, EXC_HV, 0xe20)
+ 	STD_RELON_EXCEPTION_HV_OOL(0xe40, emulation_assist)
+-	KVM_HANDLER(PACA_EXGEN, EXC_HV, 0xe40)
+-	STD_RELON_EXCEPTION_HV_OOL(0xe60, hmi_exception)
+-	KVM_HANDLER(PACA_EXGEN, EXC_HV, 0xe60)
+ 	MASKABLE_RELON_EXCEPTION_HV_OOL(0xe80, h_doorbell)
+-	KVM_HANDLER(PACA_EXGEN, EXC_HV, 0xe80)
+ 
+ 	STD_RELON_EXCEPTION_PSERIES_OOL(0xf00, performance_monitor)
+ 	STD_RELON_EXCEPTION_PSERIES_OOL(0xf20, altivec_unavailable)
+ 	STD_RELON_EXCEPTION_PSERIES_OOL(0xf40, vsx_unavailable)
+-	STD_RELON_EXCEPTION_PSERIES_OOL(0xf60, tm_unavailable)
++	STD_RELON_EXCEPTION_PSERIES_OOL(0xf60, facility_unavailable)
++	STD_RELON_EXCEPTION_HV_OOL(0xf80, facility_unavailable)
+ 
+ #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_PPC_POWERNV)
+ /*
+diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c
+index a949bdfc..f0b47d1a 100644
+--- a/arch/powerpc/kernel/hw_breakpoint.c
++++ b/arch/powerpc/kernel/hw_breakpoint.c
+@@ -176,7 +176,7 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
+ 		length_max = 512 ; /* 64 doublewords */
+ 		/* DAWR region can't cross 512 boundary */
+ 		if ((bp->attr.bp_addr >> 10) != 
+-		    ((bp->attr.bp_addr + bp->attr.bp_len) >> 10))
++		    ((bp->attr.bp_addr + bp->attr.bp_len - 1) >> 10))
+ 			return -EINVAL;
+ 	}
+ 	if (info->len >
+@@ -250,6 +250,7 @@ int __kprobes hw_breakpoint_handler(struct die_args *args)
+ 	 * we still need to single-step the instruction, but we don't
+ 	 * generate an event.
+ 	 */
++	info->type &= ~HW_BRK_TYPE_EXTRANEOUS_IRQ;
+ 	if (!((bp->attr.bp_addr <= dar) &&
+ 	      (dar - bp->attr.bp_addr < bp->attr.bp_len)))
+ 		info->type |= HW_BRK_TYPE_EXTRANEOUS_IRQ;
+diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
+index 98c2fc19..64f7bd5b 100644
+--- a/arch/powerpc/kernel/ptrace.c
++++ b/arch/powerpc/kernel/ptrace.c
+@@ -1449,7 +1449,9 @@ static long ppc_set_hwdebug(struct task_struct *child,
+ 	 */
+ 	if (bp_info->addr_mode == PPC_BREAKPOINT_MODE_RANGE_INCLUSIVE) {
+ 		len = bp_info->addr2 - bp_info->addr;
+-	} else if (bp_info->addr_mode != PPC_BREAKPOINT_MODE_EXACT) {
++	} else if (bp_info->addr_mode == PPC_BREAKPOINT_MODE_EXACT)
++		len = 1;
++	else {
+ 		ptrace_put_breakpoints(child);
+ 		return -EINVAL;
+ 	}
+diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
+index e379d3fd..389fb807 100644
+--- a/arch/powerpc/kernel/setup_64.c
++++ b/arch/powerpc/kernel/setup_64.c
+@@ -76,7 +76,7 @@
+ #endif
+ 
+ int boot_cpuid = 0;
+-int __initdata spinning_secondaries;
++int spinning_secondaries;
+ u64 ppc64_pft_size;
+ 
+ /* Pick defaults since we might want to patch instructions
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
+index 201385c3..0f83122e 100644
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -407,7 +407,8 @@ inline unsigned long copy_transact_fpr_from_user(struct task_struct *task,
+  * altivec/spe instructions at some point.
+  */
+ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
+-		int sigret, int ctx_has_vsx_region)
++			  struct mcontext __user *tm_frame, int sigret,
++			  int ctx_has_vsx_region)
+ {
+ 	unsigned long msr = regs->msr;
+ 
+@@ -475,6 +476,12 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
+ 
+ 	if (__put_user(msr, &frame->mc_gregs[PT_MSR]))
+ 		return 1;
++	/* We need to write 0 the MSR top 32 bits in the tm frame so that we
++	 * can check it on the restore to see if TM is active
++	 */
++	if (tm_frame && __put_user(0, &tm_frame->mc_gregs[PT_MSR]))
++		return 1;
++
+ 	if (sigret) {
+ 		/* Set up the sigreturn trampoline: li r0,sigret; sc */
+ 		if (__put_user(0x38000000UL + sigret, &frame->tramp[0])
+@@ -747,7 +754,7 @@ static long restore_tm_user_regs(struct pt_regs *regs,
+ 				 struct mcontext __user *tm_sr)
+ {
+ 	long err;
+-	unsigned long msr;
++	unsigned long msr, msr_hi;
+ #ifdef CONFIG_VSX
+ 	int i;
+ #endif
+@@ -852,8 +859,11 @@ static long restore_tm_user_regs(struct pt_regs *regs,
+ 	tm_enable();
+ 	/* This loads the checkpointed FP/VEC state, if used */
+ 	tm_recheckpoint(&current->thread, msr);
+-	/* The task has moved into TM state S, so ensure MSR reflects this */
+-	regs->msr = (regs->msr & ~MSR_TS_MASK) | MSR_TS_S;
++	/* Get the top half of the MSR */
++	if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR]))
++		return 1;
++	/* Pull in MSR TM from user context */
++	regs->msr = (regs->msr & ~MSR_TS_MASK) | ((msr_hi<<32) & MSR_TS_MASK);
+ 
+ 	/* This loads the speculative FP/VEC state, if used */
+ 	if (msr & MSR_FP) {
+@@ -952,6 +962,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
+ {
+ 	struct rt_sigframe __user *rt_sf;
+ 	struct mcontext __user *frame;
++	struct mcontext __user *tm_frame = NULL;
+ 	void __user *addr;
+ 	unsigned long newsp = 0;
+ 	int sigret;
+@@ -985,23 +996,24 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
+ 	}
+ 
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
++	tm_frame = &rt_sf->uc_transact.uc_mcontext;
+ 	if (MSR_TM_ACTIVE(regs->msr)) {
+-		if (save_tm_user_regs(regs, &rt_sf->uc.uc_mcontext,
+-				      &rt_sf->uc_transact.uc_mcontext, sigret))
++		if (save_tm_user_regs(regs, frame, tm_frame, sigret))
+ 			goto badframe;
+ 	}
+ 	else
+ #endif
+-		if (save_user_regs(regs, frame, sigret, 1))
++	{
++		if (save_user_regs(regs, frame, tm_frame, sigret, 1))
+ 			goto badframe;
++	}
+ 	regs->link = tramp;
+ 
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ 	if (MSR_TM_ACTIVE(regs->msr)) {
+ 		if (__put_user((unsigned long)&rt_sf->uc_transact,
+ 			       &rt_sf->uc.uc_link)
+-		    || __put_user(to_user_ptr(&rt_sf->uc_transact.uc_mcontext),
+-				  &rt_sf->uc_transact.uc_regs))
++		    || __put_user((unsigned long)tm_frame, &rt_sf->uc_transact.uc_regs))
+ 			goto badframe;
+ 	}
+ 	else
+@@ -1170,7 +1182,7 @@ long sys_swapcontext(struct ucontext __user *old_ctx,
+ 		mctx = (struct mcontext __user *)
+ 			((unsigned long) &old_ctx->uc_mcontext & ~0xfUL);
+ 		if (!access_ok(VERIFY_WRITE, old_ctx, ctx_size)
+-		    || save_user_regs(regs, mctx, 0, ctx_has_vsx_region)
++		    || save_user_regs(regs, mctx, NULL, 0, ctx_has_vsx_region)
+ 		    || put_sigset_t(&old_ctx->uc_sigmask, &current->blocked)
+ 		    || __put_user(to_user_ptr(mctx), &old_ctx->uc_regs))
+ 			return -EFAULT;
+@@ -1233,7 +1245,7 @@ long sys_rt_sigreturn(int r3, int r4, int r5, int r6, int r7, int r8,
+ 		if (__get_user(msr_hi, &mcp->mc_gregs[PT_MSR]))
+ 			goto bad;
+ 
+-		if (MSR_TM_SUSPENDED(msr_hi<<32)) {
++		if (MSR_TM_ACTIVE(msr_hi<<32)) {
+ 			/* We only recheckpoint on return if we're
+ 			 * transaction.
+ 			 */
+@@ -1392,6 +1404,7 @@ int handle_signal32(unsigned long sig, struct k_sigaction *ka,
+ {
+ 	struct sigcontext __user *sc;
+ 	struct sigframe __user *frame;
++	struct mcontext __user *tm_mctx = NULL;
+ 	unsigned long newsp = 0;
+ 	int sigret;
+ 	unsigned long tramp;
+@@ -1425,6 +1438,7 @@ int handle_signal32(unsigned long sig, struct k_sigaction *ka,
+ 	}
+ 
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
++	tm_mctx = &frame->mctx_transact;
+ 	if (MSR_TM_ACTIVE(regs->msr)) {
+ 		if (save_tm_user_regs(regs, &frame->mctx, &frame->mctx_transact,
+ 				      sigret))
+@@ -1432,8 +1446,10 @@ int handle_signal32(unsigned long sig, struct k_sigaction *ka,
+ 	}
+ 	else
+ #endif
+-		if (save_user_regs(regs, &frame->mctx, sigret, 1))
++	{
++		if (save_user_regs(regs, &frame->mctx, tm_mctx, sigret, 1))
+ 			goto badframe;
++	}
+ 
+ 	regs->link = tramp;
+ 
+@@ -1481,16 +1497,22 @@ badframe:
+ long sys_sigreturn(int r3, int r4, int r5, int r6, int r7, int r8,
+ 		       struct pt_regs *regs)
+ {
++	struct sigframe __user *sf;
+ 	struct sigcontext __user *sc;
+ 	struct sigcontext sigctx;
+ 	struct mcontext __user *sr;
+ 	void __user *addr;
+ 	sigset_t set;
++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
++	struct mcontext __user *mcp, *tm_mcp;
++	unsigned long msr_hi;
++#endif
+ 
+ 	/* Always make any pending restarted system calls return -EINTR */
+ 	current_thread_info()->restart_block.fn = do_no_restart_syscall;
+ 
+-	sc = (struct sigcontext __user *)(regs->gpr[1] + __SIGNAL_FRAMESIZE);
++	sf = (struct sigframe __user *)(regs->gpr[1] + __SIGNAL_FRAMESIZE);
++	sc = &sf->sctx;
+ 	addr = sc;
+ 	if (copy_from_user(&sigctx, sc, sizeof(sigctx)))
+ 		goto badframe;
+@@ -1507,11 +1529,25 @@ long sys_sigreturn(int r3, int r4, int r5, int r6, int r7, int r8,
+ #endif
+ 	set_current_blocked(&set);
+ 
+-	sr = (struct mcontext __user *)from_user_ptr(sigctx.regs);
+-	addr = sr;
+-	if (!access_ok(VERIFY_READ, sr, sizeof(*sr))
+-	    || restore_user_regs(regs, sr, 1))
++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
++	mcp = (struct mcontext __user *)&sf->mctx;
++	tm_mcp = (struct mcontext __user *)&sf->mctx_transact;
++	if (__get_user(msr_hi, &tm_mcp->mc_gregs[PT_MSR]))
+ 		goto badframe;
++	if (MSR_TM_ACTIVE(msr_hi<<32)) {
++		if (!cpu_has_feature(CPU_FTR_TM))
++			goto badframe;
++		if (restore_tm_user_regs(regs, mcp, tm_mcp))
++			goto badframe;
++	} else
++#endif
++	{
++		sr = (struct mcontext __user *)from_user_ptr(sigctx.regs);
++		addr = sr;
++		if (!access_ok(VERIFY_READ, sr, sizeof(*sr))
++		    || restore_user_regs(regs, sr, 1))
++			goto badframe;
++	}
+ 
+ 	set_thread_flag(TIF_RESTOREALL);
+ 	return 0;
+diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
+index 34594736..887e99d8 100644
+--- a/arch/powerpc/kernel/signal_64.c
++++ b/arch/powerpc/kernel/signal_64.c
+@@ -410,6 +410,10 @@ static long restore_tm_sigcontexts(struct pt_regs *regs,
+ 
+ 	/* get MSR separately, transfer the LE bit if doing signal return */
+ 	err |= __get_user(msr, &sc->gp_regs[PT_MSR]);
++	/* pull in MSR TM from user context */
++	regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
++
++	/* pull in MSR LE from user context */
+ 	regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
+ 
+ 	/* The following non-GPR non-FPR non-VR state is also checkpointed: */
+@@ -505,8 +509,6 @@ static long restore_tm_sigcontexts(struct pt_regs *regs,
+ 	tm_enable();
+ 	/* This loads the checkpointed FP/VEC state, if used */
+ 	tm_recheckpoint(&current->thread, msr);
+-	/* The task has moved into TM state S, so ensure MSR reflects this: */
+-	regs->msr = (regs->msr & ~MSR_TS_MASK) | __MASK(33);
+ 
+ 	/* This loads the speculative FP/VEC state, if used */
+ 	if (msr & MSR_FP) {
+@@ -654,7 +656,7 @@ int sys_rt_sigreturn(unsigned long r3, unsigned long r4, unsigned long r5,
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ 	if (__get_user(msr, &uc->uc_mcontext.gp_regs[PT_MSR]))
+ 		goto badframe;
+-	if (MSR_TM_SUSPENDED(msr)) {
++	if (MSR_TM_ACTIVE(msr)) {
+ 		/* We recheckpoint on return. */
+ 		struct ucontext __user *uc_transact;
+ 		if (__get_user(uc_transact, &uc->uc_link))
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index c0e5caf8..e4f205a2 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -1282,25 +1282,50 @@ void vsx_unavailable_exception(struct pt_regs *regs)
+ 	die("Unrecoverable VSX Unavailable Exception", regs, SIGABRT);
+ }
+ 
+-void tm_unavailable_exception(struct pt_regs *regs)
++void facility_unavailable_exception(struct pt_regs *regs)
+ {
++	static char *facility_strings[] = {
++		"FPU",
++		"VMX/VSX",
++		"DSCR",
++		"PMU SPRs",
++		"BHRB",
++		"TM",
++		"AT",
++		"EBB",
++		"TAR",
++	};
++	char *facility, *prefix;
++	u64 value;
++
++	if (regs->trap == 0xf60) {
++		value = mfspr(SPRN_FSCR);
++		prefix = "";
++	} else {
++		value = mfspr(SPRN_HFSCR);
++		prefix = "Hypervisor ";
++	}
++
++	value = value >> 56;
++
+ 	/* We restore the interrupt state now */
+ 	if (!arch_irq_disabled_regs(regs))
+ 		local_irq_enable();
+ 
+-	/* Currently we never expect a TMU exception.  Catch
+-	 * this and kill the process!
+-	 */
+-	printk(KERN_EMERG "Unexpected TM unavailable exception at %lx "
+-	       "(msr %lx)\n",
+-	       regs->nip, regs->msr);
++	if (value < ARRAY_SIZE(facility_strings))
++		facility = facility_strings[value];
++	else
++		facility = "unknown";
++
++	pr_err("%sFacility '%s' unavailable, exception at 0x%lx, MSR=%lx\n",
++		prefix, facility, regs->nip, regs->msr);
+ 
+ 	if (user_mode(regs)) {
+ 		_exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
+ 		return;
+ 	}
+ 
+-	die("Unexpected TM unavailable exception", regs, SIGABRT);
++	die("Unexpected facility unavailable exception", regs, SIGABRT);
+ }
+ 
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index 88c0425d..2859a1f5 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -1433,11 +1433,9 @@ static int update_cpu_topology(void *data)
+ 		if (cpu != update->cpu)
+ 			continue;
+ 
+-		unregister_cpu_under_node(update->cpu, update->old_nid);
+ 		unmap_cpu_from_node(update->cpu);
+ 		map_cpu_to_node(update->cpu, update->new_nid);
+ 		vdso_getcpu_init();
+-		register_cpu_under_node(update->cpu, update->new_nid);
+ 	}
+ 
+ 	return 0;
+@@ -1485,6 +1483,9 @@ int arch_update_cpu_topology(void)
+ 	stop_machine(update_cpu_topology, &updates[0], &updated_cpus);
+ 
+ 	for (ud = &updates[0]; ud; ud = ud->next) {
++		unregister_cpu_under_node(ud->cpu, ud->old_nid);
++		register_cpu_under_node(ud->cpu, ud->new_nid);
++
+ 		dev = get_cpu_device(ud->cpu);
+ 		if (dev)
+ 			kobject_uevent(&dev->kobj, KOBJ_CHANGE);
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index 29c64828..d3ee2e50 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -75,6 +75,8 @@ static unsigned int freeze_events_kernel = MMCR0_FCS;
+ 
+ #define MMCR0_FCHV		0
+ #define MMCR0_PMCjCE		MMCR0_PMCnCE
++#define MMCR0_FC56		0
++#define MMCR0_PMAO		0
+ 
+ #define SPRN_MMCRA		SPRN_MMCR2
+ #define MMCRA_SAMPLE_ENABLE	0
+@@ -852,7 +854,7 @@ static void write_mmcr0(struct cpu_hw_events *cpuhw, unsigned long mmcr0)
+ static void power_pmu_disable(struct pmu *pmu)
+ {
+ 	struct cpu_hw_events *cpuhw;
+-	unsigned long flags;
++	unsigned long flags, val;
+ 
+ 	if (!ppmu)
+ 		return;
+@@ -860,9 +862,6 @@ static void power_pmu_disable(struct pmu *pmu)
+ 	cpuhw = &__get_cpu_var(cpu_hw_events);
+ 
+ 	if (!cpuhw->disabled) {
+-		cpuhw->disabled = 1;
+-		cpuhw->n_added = 0;
+-
+ 		/*
+ 		 * Check if we ever enabled the PMU on this cpu.
+ 		 */
+@@ -872,6 +871,21 @@ static void power_pmu_disable(struct pmu *pmu)
+ 		}
+ 
+ 		/*
++		 * Set the 'freeze counters' bit, clear PMAO/FC56.
++		 */
++		val  = mfspr(SPRN_MMCR0);
++		val |= MMCR0_FC;
++		val &= ~(MMCR0_PMAO | MMCR0_FC56);
++
++		/*
++		 * The barrier is to make sure the mtspr has been
++		 * executed and the PMU has frozen the events etc.
++		 * before we return.
++		 */
++		write_mmcr0(cpuhw, val);
++		mb();
++
++		/*
+ 		 * Disable instruction sampling if it was enabled
+ 		 */
+ 		if (cpuhw->mmcr[2] & MMCRA_SAMPLE_ENABLE) {
+@@ -880,14 +894,8 @@ static void power_pmu_disable(struct pmu *pmu)
+ 			mb();
+ 		}
+ 
+-		/*
+-		 * Set the 'freeze counters' bit.
+-		 * The barrier is to make sure the mtspr has been
+-		 * executed and the PMU has frozen the events
+-		 * before we return.
+-		 */
+-		write_mmcr0(cpuhw, mfspr(SPRN_MMCR0) | MMCR0_FC);
+-		mb();
++		cpuhw->disabled = 1;
++		cpuhw->n_added = 0;
+ 	}
+ 	local_irq_restore(flags);
+ }
+@@ -911,12 +919,18 @@ static void power_pmu_enable(struct pmu *pmu)
+ 
+ 	if (!ppmu)
+ 		return;
++
+ 	local_irq_save(flags);
++
+ 	cpuhw = &__get_cpu_var(cpu_hw_events);
+-	if (!cpuhw->disabled) {
+-		local_irq_restore(flags);
+-		return;
++	if (!cpuhw->disabled)
++		goto out;
++
++	if (cpuhw->n_events == 0) {
++		ppc_set_pmu_inuse(0);
++		goto out;
+ 	}
++
+ 	cpuhw->disabled = 0;
+ 
+ 	/*
+@@ -928,8 +942,6 @@ static void power_pmu_enable(struct pmu *pmu)
+ 	if (!cpuhw->n_added) {
+ 		mtspr(SPRN_MMCRA, cpuhw->mmcr[2] & ~MMCRA_SAMPLE_ENABLE);
+ 		mtspr(SPRN_MMCR1, cpuhw->mmcr[1]);
+-		if (cpuhw->n_events == 0)
+-			ppc_set_pmu_inuse(0);
+ 		goto out_enable;
+ 	}
+ 
+diff --git a/arch/powerpc/perf/power8-pmu.c b/arch/powerpc/perf/power8-pmu.c
+index f7d1c4ff..d59f5b2d 100644
+--- a/arch/powerpc/perf/power8-pmu.c
++++ b/arch/powerpc/perf/power8-pmu.c
+@@ -109,6 +109,16 @@
+ #define EVENT_IS_MARKED		(EVENT_MARKED_MASK << EVENT_MARKED_SHIFT)
+ #define EVENT_PSEL_MASK		0xff	/* PMCxSEL value */
+ 
++#define EVENT_VALID_MASK	\
++	((EVENT_THRESH_MASK    << EVENT_THRESH_SHIFT)		|	\
++	 (EVENT_SAMPLE_MASK    << EVENT_SAMPLE_SHIFT)		|	\
++	 (EVENT_CACHE_SEL_MASK << EVENT_CACHE_SEL_SHIFT)	|	\
++	 (EVENT_PMC_MASK       << EVENT_PMC_SHIFT)		|	\
++	 (EVENT_UNIT_MASK      << EVENT_UNIT_SHIFT)		|	\
++	 (EVENT_COMBINE_MASK   << EVENT_COMBINE_SHIFT)		|	\
++	 (EVENT_MARKED_MASK    << EVENT_MARKED_SHIFT)		|	\
++	  EVENT_PSEL_MASK)
++
+ /* MMCRA IFM bits - POWER8 */
+ #define	POWER8_MMCRA_IFM1		0x0000000040000000UL
+ #define	POWER8_MMCRA_IFM2		0x0000000080000000UL
+@@ -212,6 +222,9 @@ static int power8_get_constraint(u64 event, unsigned long *maskp, unsigned long
+ 
+ 	mask = value = 0;
+ 
++	if (event & ~EVENT_VALID_MASK)
++		return -1;
++
+ 	pmc   = (event >> EVENT_PMC_SHIFT)       & EVENT_PMC_MASK;
+ 	unit  = (event >> EVENT_UNIT_SHIFT)      & EVENT_UNIT_MASK;
+ 	cache = (event >> EVENT_CACHE_SEL_SHIFT) & EVENT_CACHE_SEL_MASK;
+@@ -378,6 +391,10 @@ static int power8_compute_mmcr(u64 event[], int n_ev,
+ 	if (pmc_inuse & 0x7c)
+ 		mmcr[0] |= MMCR0_PMCjCE;
+ 
++	/* If we're not using PMC 5 or 6, freeze them */
++	if (!(pmc_inuse & 0x60))
++		mmcr[0] |= MMCR0_FC56;
++
+ 	mmcr[1] = mmcr1;
+ 	mmcr[2] = mmcra;
+ 
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 9c9d15e4..7816beff 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -441,6 +441,17 @@ static void pnv_pci_ioda_dma_dev_setup(struct pnv_phb *phb, struct pci_dev *pdev
+ 	set_iommu_table_base(&pdev->dev, &pe->tce32_table);
+ }
+ 
++static void pnv_ioda_setup_bus_dma(struct pnv_ioda_pe *pe, struct pci_bus *bus)
++{
++	struct pci_dev *dev;
++
++	list_for_each_entry(dev, &bus->devices, bus_list) {
++		set_iommu_table_base(&dev->dev, &pe->tce32_table);
++		if (dev->subordinate)
++			pnv_ioda_setup_bus_dma(pe, dev->subordinate);
++	}
++}
++
+ static void pnv_pci_ioda1_tce_invalidate(struct iommu_table *tbl,
+ 					 u64 *startp, u64 *endp)
+ {
+@@ -596,6 +607,11 @@ static void pnv_pci_ioda_setup_dma_pe(struct pnv_phb *phb,
+ 	}
+ 	iommu_init_table(tbl, phb->hose->node);
+ 
++	if (pe->pdev)
++		set_iommu_table_base(&pe->pdev->dev, tbl);
++	else
++		pnv_ioda_setup_bus_dma(pe, pe->pbus);
++
+ 	return;
+  fail:
+ 	/* XXX Failure: Try to fallback to 64-bit only ? */
+@@ -667,6 +683,11 @@ static void pnv_pci_ioda2_setup_dma_pe(struct pnv_phb *phb,
+ 	}
+ 	iommu_init_table(tbl, phb->hose->node);
+ 
++	if (pe->pdev)
++		set_iommu_table_base(&pe->pdev->dev, tbl);
++	else
++		pnv_ioda_setup_bus_dma(pe, pe->pbus);
++
+ 	return;
+ fail:
+ 	if (pe->tce32_seg >= 0)
+diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
+index ef12c0e6..7d740ebb 100644
+--- a/arch/xtensa/kernel/head.S
++++ b/arch/xtensa/kernel/head.S
+@@ -68,6 +68,15 @@ _SetupMMU:
+ 
+ #ifdef CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX
+ 	initialize_mmu
++#if defined(CONFIG_MMU) && XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY
++	rsr	a2, excsave1
++	movi	a3, 0x08000000
++	bgeu	a2, a3, 1f
++	movi	a3, 0xd0000000
++	add	a2, a2, a3
++	wsr	a2, excsave1
++1:
++#endif
+ #endif
+ 	.end	no-absolute-literals
+ 
+diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
+index 6dd25ecd..14c6c3a6 100644
+--- a/arch/xtensa/kernel/setup.c
++++ b/arch/xtensa/kernel/setup.c
+@@ -152,8 +152,8 @@ static int __init parse_tag_initrd(const bp_tag_t* tag)
+ {
+ 	meminfo_t* mi;
+ 	mi = (meminfo_t*)(tag->data);
+-	initrd_start = (void*)(mi->start);
+-	initrd_end = (void*)(mi->end);
++	initrd_start = __va(mi->start);
++	initrd_end = __va(mi->end);
+ 
+ 	return 0;
+ }
+@@ -164,7 +164,7 @@ __tagtable(BP_TAG_INITRD, parse_tag_initrd);
+ 
+ static int __init parse_tag_fdt(const bp_tag_t *tag)
+ {
+-	dtb_start = (void *)(tag->data[0]);
++	dtb_start = __va(tag->data[0]);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
+index 9a8a674e..8eae6590 100644
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -338,6 +338,8 @@ static const struct pci_device_id piix_pci_tbl[] = {
+ 	/* SATA Controller IDE (BayTrail) */
+ 	{ 0x8086, 0x0F20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt },
+ 	{ 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt },
++	/* SATA Controller IDE (Coleto Creek) */
++	{ 0x8086, 0x23a6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+ 
+ 	{ }	/* terminate list */
+ };
+diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
+index 61c59ee4..1c41722b 100644
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -389,9 +389,13 @@ static void sata_pmp_quirks(struct ata_port *ap)
+ 			/* link reports offline after LPM */
+ 			link->flags |= ATA_LFLAG_NO_LPM;
+ 
+-			/* Class code report is unreliable. */
++			/*
++			 * Class code report is unreliable and SRST times
++			 * out under certain configurations.
++			 */
+ 			if (link->pmp < 5)
+-				link->flags |= ATA_LFLAG_ASSUME_ATA;
++				link->flags |= ATA_LFLAG_NO_SRST |
++					       ATA_LFLAG_ASSUME_ATA;
+ 
+ 			/* port 5 is for SEMB device and it doesn't like SRST */
+ 			if (link->pmp == 5)
+@@ -399,20 +403,17 @@ static void sata_pmp_quirks(struct ata_port *ap)
+ 					       ATA_LFLAG_ASSUME_SEMB;
+ 		}
+ 	} else if (vendor == 0x1095 && devid == 0x4723) {
+-		/* sil4723 quirks */
+-		ata_for_each_link(link, ap, EDGE) {
+-			/* link reports offline after LPM */
+-			link->flags |= ATA_LFLAG_NO_LPM;
+-
+-			/* class code report is unreliable */
+-			if (link->pmp < 2)
+-				link->flags |= ATA_LFLAG_ASSUME_ATA;
+-
+-			/* the config device at port 2 locks up on SRST */
+-			if (link->pmp == 2)
+-				link->flags |= ATA_LFLAG_NO_SRST |
+-					       ATA_LFLAG_ASSUME_ATA;
+-		}
++		/*
++		 * sil4723 quirks
++		 *
++		 * Link reports offline after LPM.  Class code report is
++		 * unreliable.  SIMG PMPs never got SRST reliable and the
++		 * config device at port 2 locks up on SRST.
++		 */
++		ata_for_each_link(link, ap, EDGE)
++			link->flags |= ATA_LFLAG_NO_LPM |
++				       ATA_LFLAG_NO_SRST |
++				       ATA_LFLAG_ASSUME_ATA;
+ 	} else if (vendor == 0x1095 && devid == 0x4726) {
+ 		/* sil4726 quirks */
+ 		ata_for_each_link(link, ap, EDGE) {
+diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
+index 90b159b7..cd8daf47 100644
+--- a/drivers/ata/libata-zpodd.c
++++ b/drivers/ata/libata-zpodd.c
+@@ -32,13 +32,14 @@ struct zpodd {
+ 
+ static int eject_tray(struct ata_device *dev)
+ {
+-	struct ata_taskfile tf = {};
++	struct ata_taskfile tf;
+ 	const char cdb[] = {  GPCMD_START_STOP_UNIT,
+ 		0, 0, 0,
+ 		0x02,     /* LoEj */
+ 		0, 0, 0, 0, 0, 0, 0,
+ 	};
+ 
++	ata_tf_init(dev, &tf);
+ 	tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
+ 	tf.command = ATA_CMD_PACKET;
+ 	tf.protocol = ATAPI_PROT_NODATA;
+@@ -52,8 +53,7 @@ static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
+ 	char buf[16];
+ 	unsigned int ret;
+ 	struct rm_feature_desc *desc = (void *)(buf + 8);
+-	struct ata_taskfile tf = {};
+-
++	struct ata_taskfile tf;
+ 	char cdb[] = {  GPCMD_GET_CONFIGURATION,
+ 			2,      /* only 1 feature descriptor requested */
+ 			0, 3,   /* 3, removable medium feature */
+@@ -62,6 +62,7 @@ static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
+ 			0, 0, 0,
+ 	};
+ 
++	ata_tf_init(dev, &tf);
+ 	tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
+ 	tf.command = ATA_CMD_PACKET;
+ 	tf.protocol = ATAPI_PROT_PIO;
+diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c
+index b20aa96b..c846fd3c 100644
+--- a/drivers/ata/sata_highbank.c
++++ b/drivers/ata/sata_highbank.c
+@@ -196,10 +196,26 @@ static int highbank_initialize_phys(struct device *dev, void __iomem *addr)
+ 	return 0;
+ }
+ 
++/*
++ * The Calxeda SATA phy intermittently fails to bring up a link with Gen3
++ * Retrying the phy hard reset can work around the issue, but the drive
++ * may fail again. In less than 150 out of 15000 test runs, it took more
++ * than 10 tries for the link to be established (but never more than 35).
++ * Triple the maximum observed retry count to provide plenty of margin for
++ * rare events and to guarantee that the link is established.
++ *
++ * Also, the default 2 second time-out on a failed drive is too long in
++ * this situation. The uboot implementation of the same driver function
++ * uses a much shorter time-out period and never experiences a time out
++ * issue. Reducing the time-out to 500ms improves the responsiveness.
++ * The other timing constants were kept the same as the stock AHCI driver.
++ * This change was also tested 15000 times on 24 drives and none of them
++ * experienced a time out.
++ */
+ static int ahci_highbank_hardreset(struct ata_link *link, unsigned int *class,
+ 				unsigned long deadline)
+ {
+-	const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context);
++	static const unsigned long timing[] = { 5, 100, 500};
+ 	struct ata_port *ap = link->ap;
+ 	struct ahci_port_priv *pp = ap->private_data;
+ 	u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
+@@ -207,7 +223,7 @@ static int ahci_highbank_hardreset(struct ata_link *link, unsigned int *class,
+ 	bool online;
+ 	u32 sstatus;
+ 	int rc;
+-	int retry = 10;
++	int retry = 100;
+ 
+ 	ahci_stop_engine(ap);
+ 
+diff --git a/drivers/clocksource/dw_apb_timer_of.c b/drivers/clocksource/dw_apb_timer_of.c
+index ab09ed37..6b02eddc 100644
+--- a/drivers/clocksource/dw_apb_timer_of.c
++++ b/drivers/clocksource/dw_apb_timer_of.c
+@@ -44,7 +44,7 @@ static void add_clockevent(struct device_node *event_timer)
+ 	u32 irq, rate;
+ 
+ 	irq = irq_of_parse_and_map(event_timer, 0);
+-	if (irq == NO_IRQ)
++	if (irq == 0)
+ 		panic("No IRQ for clock event timer");
+ 
+ 	timer_get_base_and_rate(event_timer, &iobase, &rate);
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index 2d53f47d..178fe7a6 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1837,13 +1837,15 @@ static int __cpuinit cpufreq_cpu_callback(struct notifier_block *nfb,
+ 	if (dev) {
+ 		switch (action) {
+ 		case CPU_ONLINE:
++		case CPU_ONLINE_FROZEN:
+ 			cpufreq_add_dev(dev, NULL);
+ 			break;
+ 		case CPU_DOWN_PREPARE:
+-		case CPU_UP_CANCELED_FROZEN:
++		case CPU_DOWN_PREPARE_FROZEN:
+ 			__cpufreq_remove_dev(dev, NULL);
+ 			break;
+ 		case CPU_DOWN_FAILED:
++		case CPU_DOWN_FAILED_FROZEN:
+ 			cpufreq_add_dev(dev, NULL);
+ 			break;
+ 		}
+diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
+index dc9b72e2..5af40ad8 100644
+--- a/drivers/cpufreq/cpufreq_governor.c
++++ b/drivers/cpufreq/cpufreq_governor.c
+@@ -26,7 +26,6 @@
+ #include <linux/tick.h>
+ #include <linux/types.h>
+ #include <linux/workqueue.h>
+-#include <linux/cpu.h>
+ 
+ #include "cpufreq_governor.h"
+ 
+@@ -181,10 +180,8 @@ void gov_queue_work(struct dbs_data *dbs_data, struct cpufreq_policy *policy,
+ 	if (!all_cpus) {
+ 		__gov_queue_work(smp_processor_id(), dbs_data, delay);
+ 	} else {
+-		get_online_cpus();
+ 		for_each_cpu(i, policy->cpus)
+ 			__gov_queue_work(i, dbs_data, delay);
+-		put_online_cpus();
+ 	}
+ }
+ EXPORT_SYMBOL_GPL(gov_queue_work);
+diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
+index 591b6fb6..bfd6273f 100644
+--- a/drivers/cpufreq/cpufreq_stats.c
++++ b/drivers/cpufreq/cpufreq_stats.c
+@@ -353,13 +353,11 @@ static int __cpuinit cpufreq_stat_cpu_callback(struct notifier_block *nfb,
+ 		cpufreq_update_policy(cpu);
+ 		break;
+ 	case CPU_DOWN_PREPARE:
++	case CPU_DOWN_PREPARE_FROZEN:
+ 		cpufreq_stats_free_sysfs(cpu);
+ 		break;
+ 	case CPU_DEAD:
+-		cpufreq_stats_free_table(cpu);
+-		break;
+-	case CPU_UP_CANCELED_FROZEN:
+-		cpufreq_stats_free_sysfs(cpu);
++	case CPU_DEAD_FROZEN:
+ 		cpufreq_stats_free_table(cpu);
+ 		break;
+ 	}
+diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
+index cf919e36..239ef30f 100644
+--- a/drivers/gpu/drm/drm_gem.c
++++ b/drivers/gpu/drm/drm_gem.c
+@@ -453,25 +453,21 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
+ 	spin_lock(&dev->object_name_lock);
+ 	if (!obj->name) {
+ 		ret = idr_alloc(&dev->object_name_idr, obj, 1, 0, GFP_NOWAIT);
+-		obj->name = ret;
+-		args->name = (uint64_t) obj->name;
+-		spin_unlock(&dev->object_name_lock);
+-		idr_preload_end();
+-
+ 		if (ret < 0)
+ 			goto err;
+-		ret = 0;
++
++		obj->name = ret;
+ 
+ 		/* Allocate a reference for the name table.  */
+ 		drm_gem_object_reference(obj);
+-	} else {
+-		args->name = (uint64_t) obj->name;
+-		spin_unlock(&dev->object_name_lock);
+-		idr_preload_end();
+-		ret = 0;
+ 	}
+ 
++	args->name = (uint64_t) obj->name;
++	ret = 0;
++
+ err:
++	spin_unlock(&dev->object_name_lock);
++	idr_preload_end();
+ 	drm_gem_object_unreference_unlocked(obj);
+ 	return ret;
+ }
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 9e35dafc..34118b0c 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1160,7 +1160,8 @@ i915_gem_object_wait_rendering__nonblocking(struct drm_i915_gem_object *obj,
+ 	/* Manually manage the write flush as we may have not yet
+ 	 * retired the buffer.
+ 	 */
+-	if (obj->last_write_seqno &&
++	if (ret == 0 &&
++	    obj->last_write_seqno &&
+ 	    i915_seqno_passed(seqno, obj->last_write_seqno)) {
+ 		obj->last_write_seqno = 0;
+ 		obj->base.write_domain &= ~I915_GEM_GPU_DOMAINS;
+diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
+index a1e8ecb6..3bc8a58a 100644
+--- a/drivers/gpu/drm/i915/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/i915_gem_context.c
+@@ -113,7 +113,7 @@ static int get_context_size(struct drm_device *dev)
+ 	case 7:
+ 		reg = I915_READ(GEN7_CXT_SIZE);
+ 		if (IS_HASWELL(dev))
+-			ret = HSW_CXT_TOTAL_SIZE(reg) * 64;
++			ret = HSW_CXT_TOTAL_SIZE;
+ 		else
+ 			ret = GEN7_CXT_TOTAL_SIZE(reg) * 64;
+ 		break;
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index 0aa2ef0d..e5e32869 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -70,15 +70,6 @@ static const u32 hpd_status_gen4[] = {
+ 	[HPD_PORT_D] = PORTD_HOTPLUG_INT_STATUS
+ };
+ 
+-static const u32 hpd_status_i965[] = {
+-	 [HPD_CRT] = CRT_HOTPLUG_INT_STATUS,
+-	 [HPD_SDVO_B] = SDVOB_HOTPLUG_INT_STATUS_I965,
+-	 [HPD_SDVO_C] = SDVOC_HOTPLUG_INT_STATUS_I965,
+-	 [HPD_PORT_B] = PORTB_HOTPLUG_INT_STATUS,
+-	 [HPD_PORT_C] = PORTC_HOTPLUG_INT_STATUS,
+-	 [HPD_PORT_D] = PORTD_HOTPLUG_INT_STATUS
+-};
+-
+ static const u32 hpd_status_i915[] = { /* i915 and valleyview are the same */
+ 	[HPD_CRT] = CRT_HOTPLUG_INT_STATUS,
+ 	[HPD_SDVO_B] = SDVOB_HOTPLUG_INT_STATUS_I915,
+@@ -2952,13 +2943,13 @@ static irqreturn_t i965_irq_handler(int irq, void *arg)
+ 			u32 hotplug_status = I915_READ(PORT_HOTPLUG_STAT);
+ 			u32 hotplug_trigger = hotplug_status & (IS_G4X(dev) ?
+ 								  HOTPLUG_INT_STATUS_G4X :
+-								  HOTPLUG_INT_STATUS_I965);
++								  HOTPLUG_INT_STATUS_I915);
+ 
+ 			DRM_DEBUG_DRIVER("hotplug event received, stat 0x%08x\n",
+ 				  hotplug_status);
+ 			if (hotplug_trigger) {
+ 				if (hotplug_irq_storm_detect(dev, hotplug_trigger,
+-							    IS_G4X(dev) ? hpd_status_gen4 : hpd_status_i965))
++							    IS_G4X(dev) ? hpd_status_gen4 : hpd_status_i915))
+ 					i915_hpd_irq_setup(dev);
+ 				queue_work(dev_priv->wq,
+ 					   &dev_priv->hotplug_work);
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 2d6b62e4..80b0a662 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -1535,14 +1535,13 @@
+ 					 GEN7_CXT_EXTENDED_SIZE(ctx_reg) + \
+ 					 GEN7_CXT_GT1_SIZE(ctx_reg) + \
+ 					 GEN7_CXT_VFSTATE_SIZE(ctx_reg))
+-#define HSW_CXT_POWER_SIZE(ctx_reg)	((ctx_reg >> 26) & 0x3f)
+-#define HSW_CXT_RING_SIZE(ctx_reg)	((ctx_reg >> 23) & 0x7)
+-#define HSW_CXT_RENDER_SIZE(ctx_reg)	((ctx_reg >> 15) & 0xff)
+-#define HSW_CXT_TOTAL_SIZE(ctx_reg)	(HSW_CXT_POWER_SIZE(ctx_reg) + \
+-					 HSW_CXT_RING_SIZE(ctx_reg) + \
+-					 HSW_CXT_RENDER_SIZE(ctx_reg) + \
+-					 GEN7_CXT_VFSTATE_SIZE(ctx_reg))
+-
++/* Haswell does have the CXT_SIZE register however it does not appear to be
++ * valid. Now, docs explain in dwords what is in the context object. The full
++ * size is 70720 bytes, however, the power context and execlist context will
++ * never be saved (power context is stored elsewhere, and execlists don't work
++ * on HSW) - so the final size is 66944 bytes, which rounds to 17 pages.
++ */
++#define HSW_CXT_TOTAL_SIZE		(17 * PAGE_SIZE)
+ 
+ /*
+  * Overlay regs
+@@ -1691,6 +1690,12 @@
+ /* SDVO is different across gen3/4 */
+ #define   SDVOC_HOTPLUG_INT_STATUS_G4X		(1 << 3)
+ #define   SDVOB_HOTPLUG_INT_STATUS_G4X		(1 << 2)
++/*
++ * Bspec seems to be seriously misleaded about the SDVO hpd bits on i965g/gm,
++ * since reality corrobates that they're the same as on gen3. But keep these
++ * bits here (and the comment!) to help any other lost wanderers back onto the
++ * right tracks.
++ */
+ #define   SDVOC_HOTPLUG_INT_STATUS_I965		(3 << 4)
+ #define   SDVOB_HOTPLUG_INT_STATUS_I965		(3 << 2)
+ #define   SDVOC_HOTPLUG_INT_STATUS_I915		(1 << 7)
+@@ -1702,13 +1707,6 @@
+ 						 PORTC_HOTPLUG_INT_STATUS | \
+ 						 PORTD_HOTPLUG_INT_STATUS)
+ 
+-#define HOTPLUG_INT_STATUS_I965			(CRT_HOTPLUG_INT_STATUS | \
+-						 SDVOB_HOTPLUG_INT_STATUS_I965 | \
+-						 SDVOC_HOTPLUG_INT_STATUS_I965 | \
+-						 PORTB_HOTPLUG_INT_STATUS | \
+-						 PORTC_HOTPLUG_INT_STATUS | \
+-						 PORTD_HOTPLUG_INT_STATUS)
+-
+ #define HOTPLUG_INT_STATUS_I915			(CRT_HOTPLUG_INT_STATUS | \
+ 						 SDVOB_HOTPLUG_INT_STATUS_I915 | \
+ 						 SDVOC_HOTPLUG_INT_STATUS_I915 | \
+diff --git a/drivers/gpu/drm/mgag200/mgag200_drv.h b/drivers/gpu/drm/mgag200/mgag200_drv.h
+index bf29b2f4..988911af 100644
+--- a/drivers/gpu/drm/mgag200/mgag200_drv.h
++++ b/drivers/gpu/drm/mgag200/mgag200_drv.h
+@@ -198,7 +198,8 @@ struct mga_device {
+ 		struct ttm_bo_device bdev;
+ 	} ttm;
+ 
+-	u32 reg_1e24; /* SE model number */
++	/* SE model number stored in reg 0x1e24 */
++	u32 unique_rev_id;
+ };
+ 
+ 
+diff --git a/drivers/gpu/drm/mgag200/mgag200_main.c b/drivers/gpu/drm/mgag200/mgag200_main.c
+index 99059237..dafe049f 100644
+--- a/drivers/gpu/drm/mgag200/mgag200_main.c
++++ b/drivers/gpu/drm/mgag200/mgag200_main.c
+@@ -176,7 +176,7 @@ static int mgag200_device_init(struct drm_device *dev,
+ 
+ 	/* stash G200 SE model number for later use */
+ 	if (IS_G200_SE(mdev))
+-		mdev->reg_1e24 = RREG32(0x1e24);
++		mdev->unique_rev_id = RREG32(0x1e24);
+ 
+ 	ret = mga_vram_init(mdev);
+ 	if (ret)
+diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
+index ee66badc..99e07b68 100644
+--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
++++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
+@@ -1008,7 +1008,7 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
+ 
+ 
+ 	if (IS_G200_SE(mdev)) {
+-		if (mdev->reg_1e24 >= 0x02) {
++		if (mdev->unique_rev_id >= 0x02) {
+ 			u8 hi_pri_lvl;
+ 			u32 bpp;
+ 			u32 mb;
+@@ -1038,7 +1038,7 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
+ 			WREG8(MGAREG_CRTCEXT_DATA, hi_pri_lvl);
+ 		} else {
+ 			WREG8(MGAREG_CRTCEXT_INDEX, 0x06);
+-			if (mdev->reg_1e24 >= 0x01)
++			if (mdev->unique_rev_id >= 0x01)
+ 				WREG8(MGAREG_CRTCEXT_DATA, 0x03);
+ 			else
+ 				WREG8(MGAREG_CRTCEXT_DATA, 0x04);
+@@ -1410,6 +1410,32 @@ static int mga_vga_get_modes(struct drm_connector *connector)
+ 	return ret;
+ }
+ 
++static uint32_t mga_vga_calculate_mode_bandwidth(struct drm_display_mode *mode,
++							int bits_per_pixel)
++{
++	uint32_t total_area, divisor;
++	int64_t active_area, pixels_per_second, bandwidth;
++	uint64_t bytes_per_pixel = (bits_per_pixel + 7) / 8;
++
++	divisor = 1024;
++
++	if (!mode->htotal || !mode->vtotal || !mode->clock)
++		return 0;
++
++	active_area = mode->hdisplay * mode->vdisplay;
++	total_area = mode->htotal * mode->vtotal;
++
++	pixels_per_second = active_area * mode->clock * 1000;
++	do_div(pixels_per_second, total_area);
++
++	bandwidth = pixels_per_second * bytes_per_pixel * 100;
++	do_div(bandwidth, divisor);
++
++	return (uint32_t)(bandwidth);
++}
++
++#define MODE_BANDWIDTH	MODE_BAD
++
+ static int mga_vga_mode_valid(struct drm_connector *connector,
+ 				 struct drm_display_mode *mode)
+ {
+@@ -1421,7 +1447,45 @@ static int mga_vga_mode_valid(struct drm_connector *connector,
+ 	int bpp = 32;
+ 	int i = 0;
+ 
+-	/* FIXME: Add bandwidth and g200se limitations */
++	if (IS_G200_SE(mdev)) {
++		if (mdev->unique_rev_id == 0x01) {
++			if (mode->hdisplay > 1600)
++				return MODE_VIRTUAL_X;
++			if (mode->vdisplay > 1200)
++				return MODE_VIRTUAL_Y;
++			if (mga_vga_calculate_mode_bandwidth(mode, bpp)
++				> (24400 * 1024))
++				return MODE_BANDWIDTH;
++		} else if (mdev->unique_rev_id >= 0x02) {
++			if (mode->hdisplay > 1920)
++				return MODE_VIRTUAL_X;
++			if (mode->vdisplay > 1200)
++				return MODE_VIRTUAL_Y;
++			if (mga_vga_calculate_mode_bandwidth(mode, bpp)
++				> (30100 * 1024))
++				return MODE_BANDWIDTH;
++		}
++	} else if (mdev->type == G200_WB) {
++		if (mode->hdisplay > 1280)
++			return MODE_VIRTUAL_X;
++		if (mode->vdisplay > 1024)
++			return MODE_VIRTUAL_Y;
++		if (mga_vga_calculate_mode_bandwidth(mode,
++			bpp > (31877 * 1024)))
++			return MODE_BANDWIDTH;
++	} else if (mdev->type == G200_EV &&
++		(mga_vga_calculate_mode_bandwidth(mode, bpp)
++			> (32700 * 1024))) {
++		return MODE_BANDWIDTH;
++	} else if (mode->type == G200_EH &&
++		(mga_vga_calculate_mode_bandwidth(mode, bpp)
++			> (37500 * 1024))) {
++		return MODE_BANDWIDTH;
++	} else if (mode->type == G200_ER &&
++		(mga_vga_calculate_mode_bandwidth(mode,
++			bpp) > (55000 * 1024))) {
++		return MODE_BANDWIDTH;
++	}
+ 
+ 	if (mode->crtc_hdisplay > 2048 || mode->crtc_hsync_start > 4096 ||
+ 	    mode->crtc_hsync_end > 4096 || mode->crtc_htotal > 4096 ||
+diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/hdminva3.c b/drivers/gpu/drm/nouveau/core/engine/disp/hdminva3.c
+index f065fc24..db8c6fd4 100644
+--- a/drivers/gpu/drm/nouveau/core/engine/disp/hdminva3.c
++++ b/drivers/gpu/drm/nouveau/core/engine/disp/hdminva3.c
+@@ -55,6 +55,10 @@ nva3_hdmi_ctrl(struct nv50_disp_priv *priv, int head, int or, u32 data)
+ 	nv_wr32(priv, 0x61c510 + soff, 0x00000000);
+ 	nv_mask(priv, 0x61c500 + soff, 0x00000001, 0x00000001);
+ 
++	nv_mask(priv, 0x61c5d0 + soff, 0x00070001, 0x00010001); /* SPARE, HW_CTS */
++	nv_mask(priv, 0x61c568 + soff, 0x00010101, 0x00000000); /* ACR_CTRL, ?? */
++	nv_mask(priv, 0x61c578 + soff, 0x80000000, 0x80000000); /* ACR_0441_ENABLE */
++
+ 	/* ??? */
+ 	nv_mask(priv, 0x61733c, 0x00100000, 0x00100000); /* RESETF */
+ 	nv_mask(priv, 0x61733c, 0x10000000, 0x10000000); /* LOOKUP_EN */
+diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
+index 6a38402f..5680d3eb 100644
+--- a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
++++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
+@@ -1107,6 +1107,7 @@ nv50_disp_intr_unk20_2(struct nv50_disp_priv *priv, int head)
+ 	u32 pclk = nv_rd32(priv, 0x610ad0 + (head * 0x540)) & 0x3fffff;
+ 	u32 hval, hreg = 0x614200 + (head * 0x800);
+ 	u32 oval, oreg;
++	u32 mask;
+ 	u32 conf = exec_clkcmp(priv, head, 0xff, pclk, &outp);
+ 	if (conf != ~0) {
+ 		if (outp.location == 0 && outp.type == DCB_OUTPUT_DP) {
+@@ -1133,6 +1134,7 @@ nv50_disp_intr_unk20_2(struct nv50_disp_priv *priv, int head)
+ 			oreg = 0x614280 + (ffs(outp.or) - 1) * 0x800;
+ 			oval = 0x00000000;
+ 			hval = 0x00000000;
++			mask = 0xffffffff;
+ 		} else
+ 		if (!outp.location) {
+ 			if (outp.type == DCB_OUTPUT_DP)
+@@ -1140,14 +1142,16 @@ nv50_disp_intr_unk20_2(struct nv50_disp_priv *priv, int head)
+ 			oreg = 0x614300 + (ffs(outp.or) - 1) * 0x800;
+ 			oval = (conf & 0x0100) ? 0x00000101 : 0x00000000;
+ 			hval = 0x00000000;
++			mask = 0x00000707;
+ 		} else {
+ 			oreg = 0x614380 + (ffs(outp.or) - 1) * 0x800;
+ 			oval = 0x00000001;
+ 			hval = 0x00000001;
++			mask = 0x00000707;
+ 		}
+ 
+ 		nv_mask(priv, hreg, 0x0000000f, hval);
+-		nv_mask(priv, oreg, 0x00000707, oval);
++		nv_mask(priv, oreg, mask, oval);
+ 	}
+ }
+ 
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
+index 77c67fc9..e66fb771 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
+@@ -362,7 +362,7 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
+ 	vm->fpde = offset >> (vmm->pgt_bits + 12);
+ 	vm->lpde = (offset + length - 1) >> (vmm->pgt_bits + 12);
+ 
+-	vm->pgt  = kcalloc(vm->lpde - vm->fpde + 1, sizeof(*vm->pgt), GFP_KERNEL);
++	vm->pgt  = vzalloc((vm->lpde - vm->fpde + 1) * sizeof(*vm->pgt));
+ 	if (!vm->pgt) {
+ 		kfree(vm);
+ 		return -ENOMEM;
+@@ -371,7 +371,7 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
+ 	ret = nouveau_mm_init(&vm->mm, mm_offset >> 12, mm_length >> 12,
+ 			      block >> 12);
+ 	if (ret) {
+-		kfree(vm->pgt);
++		vfree(vm->pgt);
+ 		kfree(vm);
+ 		return ret;
+ 	}
+@@ -446,7 +446,7 @@ nouveau_vm_del(struct nouveau_vm *vm)
+ 	}
+ 
+ 	nouveau_mm_fini(&vm->mm);
+-	kfree(vm->pgt);
++	vfree(vm->pgt);
+ 	kfree(vm);
+ }
+ 
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index 8406c825..4120d355 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -186,6 +186,13 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder,
+ 	u8 backlight_level;
+ 	char bl_name[16];
+ 
++	/* Mac laptops with multiple GPUs use the gmux driver for backlight
++	 * so don't register a backlight device
++	 */
++	if ((rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE) &&
++	    (rdev->pdev->device == 0x6741))
++		return;
++
+ 	if (!radeon_encoder->enc_priv)
+ 		return;
+ 
+diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
+index ed7c8a76..b9c6f767 100644
+--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
++++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
+@@ -128,14 +128,7 @@ static void evergreen_hdmi_update_avi_infoframe(struct drm_encoder *encoder,
+ 	struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+ 	uint32_t offset = dig->afmt->offset;
+ 	uint8_t *frame = buffer + 3;
+-
+-	/* Our header values (type, version, length) should be alright, Intel
+-	 * is using the same. Checksum function also seems to be OK, it works
+-	 * fine for audio infoframe. However calculated value is always lower
+-	 * by 2 in comparison to fglrx. It breaks displaying anything in case
+-	 * of TVs that strictly check the checksum. Hack it manually here to
+-	 * workaround this issue. */
+-	frame[0x0] += 2;
++	uint8_t *header = buffer;
+ 
+ 	WREG32(AFMT_AVI_INFO0 + offset,
+ 		frame[0x0] | (frame[0x1] << 8) | (frame[0x2] << 16) | (frame[0x3] << 24));
+@@ -144,7 +137,7 @@ static void evergreen_hdmi_update_avi_infoframe(struct drm_encoder *encoder,
+ 	WREG32(AFMT_AVI_INFO2 + offset,
+ 		frame[0x8] | (frame[0x9] << 8) | (frame[0xA] << 16) | (frame[0xB] << 24));
+ 	WREG32(AFMT_AVI_INFO3 + offset,
+-		frame[0xC] | (frame[0xD] << 8));
++		frame[0xC] | (frame[0xD] << 8) | (header[1] << 24));
+ }
+ 
+ static void evergreen_audio_set_dto(struct drm_encoder *encoder, u32 clock)
+diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
+index 456750a0..e73b2a73 100644
+--- a/drivers/gpu/drm/radeon/r600_hdmi.c
++++ b/drivers/gpu/drm/radeon/r600_hdmi.c
+@@ -133,14 +133,7 @@ static void r600_hdmi_update_avi_infoframe(struct drm_encoder *encoder,
+ 	struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+ 	uint32_t offset = dig->afmt->offset;
+ 	uint8_t *frame = buffer + 3;
+-
+-	/* Our header values (type, version, length) should be alright, Intel
+-	 * is using the same. Checksum function also seems to be OK, it works
+-	 * fine for audio infoframe. However calculated value is always lower
+-	 * by 2 in comparison to fglrx. It breaks displaying anything in case
+-	 * of TVs that strictly check the checksum. Hack it manually here to
+-	 * workaround this issue. */
+-	frame[0x0] += 2;
++	uint8_t *header = buffer;
+ 
+ 	WREG32(HDMI0_AVI_INFO0 + offset,
+ 		frame[0x0] | (frame[0x1] << 8) | (frame[0x2] << 16) | (frame[0x3] << 24));
+@@ -149,7 +142,7 @@ static void r600_hdmi_update_avi_infoframe(struct drm_encoder *encoder,
+ 	WREG32(HDMI0_AVI_INFO2 + offset,
+ 		frame[0x8] | (frame[0x9] << 8) | (frame[0xA] << 16) | (frame[0xB] << 24));
+ 	WREG32(HDMI0_AVI_INFO3 + offset,
+-		frame[0xC] | (frame[0xD] << 8));
++		frame[0xC] | (frame[0xD] << 8) | (header[1] << 24));
+ }
+ 
+ /*
+diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
+index 04638aee..99cec182 100644
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -199,7 +199,7 @@ static const s8 NCT6775_ALARM_BITS[] = {
+ 	0, 1, 2, 3, 8, 21, 20, 16,	/* in0.. in7 */
+ 	17, -1, -1, -1, -1, -1, -1,	/* in8..in14 */
+ 	-1,				/* unused */
+-	6, 7, 11, 10, 23,		/* fan1..fan5 */
++	6, 7, 11, -1, -1,		/* fan1..fan5 */
+ 	-1, -1, -1,			/* unused */
+ 	4, 5, 13, -1, -1, -1,		/* temp1..temp6 */
+ 	12, -1 };			/* intrusion0, intrusion1 */
+@@ -625,6 +625,7 @@ struct nct6775_data {
+ 	u8 has_fan_min;		/* some fans don't have min register */
+ 	bool has_fan_div;
+ 
++	u8 num_temp_alarms;	/* 2 or 3 */
+ 	u8 temp_fixed_num;	/* 3 or 6 */
+ 	u8 temp_type[NUM_TEMP_FIXED];
+ 	s8 temp_offset[NUM_TEMP_FIXED];
+@@ -1193,6 +1194,42 @@ show_alarm(struct device *dev, struct device_attribute *attr, char *buf)
+ 		       (unsigned int)((data->alarms >> nr) & 0x01));
+ }
+ 
++static int find_temp_source(struct nct6775_data *data, int index, int count)
++{
++	int source = data->temp_src[index];
++	int nr;
++
++	for (nr = 0; nr < count; nr++) {
++		int src;
++
++		src = nct6775_read_value(data,
++					 data->REG_TEMP_SOURCE[nr]) & 0x1f;
++		if (src == source)
++			return nr;
++	}
++	return -1;
++}
++
++static ssize_t
++show_temp_alarm(struct device *dev, struct device_attribute *attr, char *buf)
++{
++	struct sensor_device_attribute *sattr = to_sensor_dev_attr(attr);
++	struct nct6775_data *data = nct6775_update_device(dev);
++	unsigned int alarm = 0;
++	int nr;
++
++	/*
++	 * For temperatures, there is no fixed mapping from registers to alarm
++	 * bits. Alarm bits are determined by the temperature source mapping.
++	 */
++	nr = find_temp_source(data, sattr->index, data->num_temp_alarms);
++	if (nr >= 0) {
++		int bit = data->ALARM_BITS[nr + TEMP_ALARM_BASE];
++		alarm = (data->alarms >> bit) & 0x01;
++	}
++	return sprintf(buf, "%u\n", alarm);
++}
++
+ static SENSOR_DEVICE_ATTR_2(in0_input, S_IRUGO, show_in_reg, NULL, 0, 0);
+ static SENSOR_DEVICE_ATTR_2(in1_input, S_IRUGO, show_in_reg, NULL, 1, 0);
+ static SENSOR_DEVICE_ATTR_2(in2_input, S_IRUGO, show_in_reg, NULL, 2, 0);
+@@ -1874,22 +1911,18 @@ static struct sensor_device_attribute sda_temp_type[] = {
+ };
+ 
+ static struct sensor_device_attribute sda_temp_alarm[] = {
+-	SENSOR_ATTR(temp1_alarm, S_IRUGO, show_alarm, NULL,
+-		    TEMP_ALARM_BASE),
+-	SENSOR_ATTR(temp2_alarm, S_IRUGO, show_alarm, NULL,
+-		    TEMP_ALARM_BASE + 1),
+-	SENSOR_ATTR(temp3_alarm, S_IRUGO, show_alarm, NULL,
+-		    TEMP_ALARM_BASE + 2),
+-	SENSOR_ATTR(temp4_alarm, S_IRUGO, show_alarm, NULL,
+-		    TEMP_ALARM_BASE + 3),
+-	SENSOR_ATTR(temp5_alarm, S_IRUGO, show_alarm, NULL,
+-		    TEMP_ALARM_BASE + 4),
+-	SENSOR_ATTR(temp6_alarm, S_IRUGO, show_alarm, NULL,
+-		    TEMP_ALARM_BASE + 5),
++	SENSOR_ATTR(temp1_alarm, S_IRUGO, show_temp_alarm, NULL, 0),
++	SENSOR_ATTR(temp2_alarm, S_IRUGO, show_temp_alarm, NULL, 1),
++	SENSOR_ATTR(temp3_alarm, S_IRUGO, show_temp_alarm, NULL, 2),
++	SENSOR_ATTR(temp4_alarm, S_IRUGO, show_temp_alarm, NULL, 3),
++	SENSOR_ATTR(temp5_alarm, S_IRUGO, show_temp_alarm, NULL, 4),
++	SENSOR_ATTR(temp6_alarm, S_IRUGO, show_temp_alarm, NULL, 5),
++	SENSOR_ATTR(temp7_alarm, S_IRUGO, show_temp_alarm, NULL, 6),
++	SENSOR_ATTR(temp8_alarm, S_IRUGO, show_temp_alarm, NULL, 7),
++	SENSOR_ATTR(temp9_alarm, S_IRUGO, show_temp_alarm, NULL, 8),
++	SENSOR_ATTR(temp10_alarm, S_IRUGO, show_temp_alarm, NULL, 9),
+ };
+ 
+-#define NUM_TEMP_ALARM	ARRAY_SIZE(sda_temp_alarm)
+-
+ static ssize_t
+ show_pwm_mode(struct device *dev, struct device_attribute *attr, char *buf)
+ {
+@@ -3215,13 +3248,11 @@ static void nct6775_device_remove_files(struct device *dev)
+ 		device_remove_file(dev, &sda_temp_max[i].dev_attr);
+ 		device_remove_file(dev, &sda_temp_max_hyst[i].dev_attr);
+ 		device_remove_file(dev, &sda_temp_crit[i].dev_attr);
++		device_remove_file(dev, &sda_temp_alarm[i].dev_attr);
+ 		if (!(data->have_temp_fixed & (1 << i)))
+ 			continue;
+ 		device_remove_file(dev, &sda_temp_type[i].dev_attr);
+ 		device_remove_file(dev, &sda_temp_offset[i].dev_attr);
+-		if (i >= NUM_TEMP_ALARM)
+-			continue;
+-		device_remove_file(dev, &sda_temp_alarm[i].dev_attr);
+ 	}
+ 
+ 	device_remove_file(dev, &sda_caseopen[0].dev_attr);
+@@ -3419,6 +3450,7 @@ static int nct6775_probe(struct platform_device *pdev)
+ 		data->auto_pwm_num = 6;
+ 		data->has_fan_div = true;
+ 		data->temp_fixed_num = 3;
++		data->num_temp_alarms = 3;
+ 
+ 		data->ALARM_BITS = NCT6775_ALARM_BITS;
+ 
+@@ -3483,6 +3515,7 @@ static int nct6775_probe(struct platform_device *pdev)
+ 		data->auto_pwm_num = 4;
+ 		data->has_fan_div = false;
+ 		data->temp_fixed_num = 3;
++		data->num_temp_alarms = 3;
+ 
+ 		data->ALARM_BITS = NCT6776_ALARM_BITS;
+ 
+@@ -3547,6 +3580,7 @@ static int nct6775_probe(struct platform_device *pdev)
+ 		data->auto_pwm_num = 4;
+ 		data->has_fan_div = false;
+ 		data->temp_fixed_num = 6;
++		data->num_temp_alarms = 2;
+ 
+ 		data->ALARM_BITS = NCT6779_ALARM_BITS;
+ 
+@@ -3843,10 +3877,12 @@ static int nct6775_probe(struct platform_device *pdev)
+ 						 &sda_fan_input[i].dev_attr);
+ 			if (err)
+ 				goto exit_remove;
+-			err = device_create_file(dev,
+-						 &sda_fan_alarm[i].dev_attr);
+-			if (err)
+-				goto exit_remove;
++			if (data->ALARM_BITS[FAN_ALARM_BASE + i] >= 0) {
++				err = device_create_file(dev,
++						&sda_fan_alarm[i].dev_attr);
++				if (err)
++					goto exit_remove;
++			}
+ 			if (data->kind != nct6776 &&
+ 			    data->kind != nct6779) {
+ 				err = device_create_file(dev,
+@@ -3897,6 +3933,12 @@ static int nct6775_probe(struct platform_device *pdev)
+ 			if (err)
+ 				goto exit_remove;
+ 		}
++		if (find_temp_source(data, i, data->num_temp_alarms) >= 0) {
++			err = device_create_file(dev,
++						 &sda_temp_alarm[i].dev_attr);
++			if (err)
++				goto exit_remove;
++		}
+ 		if (!(data->have_temp_fixed & (1 << i)))
+ 			continue;
+ 		err = device_create_file(dev, &sda_temp_type[i].dev_attr);
+@@ -3905,12 +3947,6 @@ static int nct6775_probe(struct platform_device *pdev)
+ 		err = device_create_file(dev, &sda_temp_offset[i].dev_attr);
+ 		if (err)
+ 			goto exit_remove;
+-		if (i >= NUM_TEMP_ALARM ||
+-		    data->ALARM_BITS[TEMP_ALARM_BASE + i] < 0)
+-			continue;
+-		err = device_create_file(dev, &sda_temp_alarm[i].dev_attr);
+-		if (err)
+-			goto exit_remove;
+ 	}
+ 
+ 	for (i = 0; i < ARRAY_SIZE(sda_caseopen); i++) {
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index 631736e2..4faf02b3 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -150,6 +150,7 @@ config I2C_PIIX4
+ 	    ATI SB700/SP5100
+ 	    ATI SB800
+ 	    AMD Hudson-2
++	    AMD CZ
+ 	    Serverworks OSB4
+ 	    Serverworks CSB5
+ 	    Serverworks CSB6
+diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
+index 39ab78c1..d05ad590 100644
+--- a/drivers/i2c/busses/i2c-piix4.c
++++ b/drivers/i2c/busses/i2c-piix4.c
+@@ -22,7 +22,7 @@
+ 	Intel PIIX4, 440MX
+ 	Serverworks OSB4, CSB5, CSB6, HT-1000, HT-1100
+ 	ATI IXP200, IXP300, IXP400, SB600, SB700/SP5100, SB800
+-	AMD Hudson-2
++	AMD Hudson-2, CZ
+ 	SMSC Victory66
+ 
+    Note: we assume there can only be one device, with one or more
+@@ -522,6 +522,7 @@ static DEFINE_PCI_DEVICE_TABLE(piix4_ids) = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP400_SMBUS) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_SBX00_SMBUS) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, 0x790b) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
+ 		     PCI_DEVICE_ID_SERVERWORKS_OSB4) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index 98ddc323..0cf5f8e0 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -451,7 +451,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ 	int ret;
+ 
+ 	ret = iio_channel_read(chan, &offset, NULL, IIO_CHAN_INFO_OFFSET);
+-	if (ret == 0)
++	if (ret >= 0)
+ 		raw64 += offset;
+ 
+ 	scale_type = iio_channel_read(chan, &scale_val, &scale_val2,
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 21d02b0d..a3c33894 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -1484,6 +1484,10 @@ static unsigned long iommu_unmap_page(struct protection_domain *dom,
+ 
+ 			/* Large PTE found which maps this address */
+ 			unmap_size = PTE_PAGE_SIZE(*pte);
++
++			/* Only unmap from the first pte in the page */
++			if ((unmap_size - 1) & bus_addr)
++				break;
+ 			count      = PAGE_SIZE_PTE_COUNT(unmap_size);
+ 			for (i = 0; i < count; i++)
+ 				pte[i] = 0ULL;
+@@ -1493,7 +1497,7 @@ static unsigned long iommu_unmap_page(struct protection_domain *dom,
+ 		unmapped += unmap_size;
+ 	}
+ 
+-	BUG_ON(!is_power_of_2(unmapped));
++	BUG_ON(unmapped && !is_power_of_2(unmapped));
+ 
+ 	return unmapped;
+ }
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 6ddae250..d61eb7ea 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -2075,11 +2075,17 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)
+ 			 * both 'first' and 'i', so we just compare them.
+ 			 * All vec entries are PAGE_SIZE;
+ 			 */
+-			for (j = 0; j < vcnt; j++)
++			int sectors = r10_bio->sectors;
++			for (j = 0; j < vcnt; j++) {
++				int len = PAGE_SIZE;
++				if (sectors < (len / 512))
++					len = sectors * 512;
+ 				if (memcmp(page_address(fbio->bi_io_vec[j].bv_page),
+ 					   page_address(tbio->bi_io_vec[j].bv_page),
+-					   fbio->bi_io_vec[j].bv_len))
++					   len))
+ 					break;
++				sectors -= len/512;
++			}
+ 			if (j == vcnt)
+ 				continue;
+ 			atomic64_add(r10_bio->sectors, &mddev->resync_mismatches);
+@@ -2909,14 +2915,13 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
+ 	 */
+ 	if (mddev->bitmap == NULL &&
+ 	    mddev->recovery_cp == MaxSector &&
++	    mddev->reshape_position == MaxSector &&
++	    !test_bit(MD_RECOVERY_SYNC, &mddev->recovery) &&
+ 	    !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery) &&
++	    !test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
+ 	    conf->fullsync == 0) {
+ 		*skipped = 1;
+-		max_sector = mddev->dev_sectors;
+-		if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery) ||
+-		    test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery))
+-			max_sector = mddev->resync_max_sectors;
+-		return max_sector - sector_nr;
++		return mddev->dev_sectors - sector_nr;
+ 	}
+ 
+  skipped:
+@@ -3386,6 +3391,7 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
+ 
+ 		if (bio->bi_end_io == end_sync_read) {
+ 			md_sync_acct(bio->bi_bdev, nr_sectors);
++			set_bit(BIO_UPTODATE, &bio->bi_flags);
+ 			generic_make_request(bio);
+ 		}
+ 	}
+@@ -3532,7 +3538,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
+ 
+ 	/* FIXME calc properly */
+ 	conf->mirrors = kzalloc(sizeof(struct raid10_info)*(mddev->raid_disks +
+-							    max(0,mddev->delta_disks)),
++							    max(0,-mddev->delta_disks)),
+ 				GFP_KERNEL);
+ 	if (!conf->mirrors)
+ 		goto out;
+@@ -3691,7 +3697,7 @@ static int run(struct mddev *mddev)
+ 		    conf->geo.far_offset == 0)
+ 			goto out_free_conf;
+ 		if (conf->prev.far_copies != 1 &&
+-		    conf->geo.far_offset == 0)
++		    conf->prev.far_offset == 0)
+ 			goto out_free_conf;
+ 	}
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+index e6b92ff2..25b8bbbe 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -3563,14 +3563,18 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
+ {
+ 	struct ath9k_hw_capabilities *pCap = &ah->caps;
+ 	int chain;
+-	u32 regval;
++	u32 regval, value;
+ 	static const u32 switch_chain_reg[AR9300_MAX_CHAINS] = {
+ 			AR_PHY_SWITCH_CHAIN_0,
+ 			AR_PHY_SWITCH_CHAIN_1,
+ 			AR_PHY_SWITCH_CHAIN_2,
+ 	};
+ 
+-	u32 value = ar9003_hw_ant_ctrl_common_get(ah, is2ghz);
++	if (AR_SREV_9485(ah) && (ar9003_hw_get_rx_gain_idx(ah) == 0))
++		ath9k_hw_cfg_output(ah, AR9300_EXT_LNA_CTL_GPIO_AR9485,
++				    AR_GPIO_OUTPUT_MUX_AS_PCIE_ATTENTION_LED);
++
++	value = ar9003_hw_ant_ctrl_common_get(ah, is2ghz);
+ 
+ 	if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
+ 		REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+index e7177419..5013c731 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+@@ -351,6 +351,8 @@
+ 
+ #define AR_PHY_CCA_NOM_VAL_9330_2GHZ          -118
+ 
++#define AR9300_EXT_LNA_CTL_GPIO_AR9485 9
++
+ /*
+  * AGC Field Definitions
+  */
+diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
+index 7304e758..5e8219a9 100644
+--- a/drivers/net/wireless/ath/ath9k/calib.c
++++ b/drivers/net/wireless/ath/ath9k/calib.c
+@@ -387,7 +387,6 @@ bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan)
+ 
+ 	if (!caldata) {
+ 		chan->noisefloor = nf;
+-		ah->noise = ath9k_hw_getchan_noise(ah, chan);
+ 		return false;
+ 	}
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index 15dfefcf..b1d5037b 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1872,7 +1872,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
+ 
+ 	ah->caldata = caldata;
+ 	if (caldata && (chan->channel != caldata->channel ||
+-			chan->channelFlags != caldata->channelFlags)) {
++			chan->channelFlags != caldata->channelFlags ||
++			chan->chanmode != caldata->chanmode)) {
+ 		/* Operating channel changed, reset channel calibration data */
+ 		memset(caldata, 0, sizeof(*caldata));
+ 		ath9k_init_nfcal_hist_buffer(ah, chan);
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 5092ecae..35ced100 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1211,13 +1211,6 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
+ 		ath_update_survey_stats(sc);
+ 		spin_unlock_irqrestore(&common->cc_lock, flags);
+ 
+-		/*
+-		 * Preserve the current channel values, before updating
+-		 * the same channel
+-		 */
+-		if (ah->curchan && (old_pos == pos))
+-			ath9k_hw_getnf(ah, ah->curchan);
+-
+ 		ath9k_cmn_update_ichannel(&sc->sc_ah->channels[pos],
+ 					  curchan, channel_type);
+ 
+diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
+index 078e6f34..13f91ac9 100644
+--- a/drivers/net/wireless/b43/Kconfig
++++ b/drivers/net/wireless/b43/Kconfig
+@@ -28,7 +28,7 @@ config B43
+ 
+ config B43_BCMA
+ 	bool "Support for BCMA bus"
+-	depends on B43 && BCMA
++	depends on B43 && (BCMA = y || BCMA = B43)
+ 	default y
+ 
+ config B43_BCMA_EXTRA
+@@ -39,7 +39,7 @@ config B43_BCMA_EXTRA
+ 
+ config B43_SSB
+ 	bool
+-	depends on B43 && SSB
++	depends on B43 && (SSB = y || SSB = B43)
+ 	default y
+ 
+ # Auto-select SSB PCI-HOST support, if possible
+diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
+index 72f32e5c..705aa338 100644
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -2392,7 +2392,7 @@ static void rt2800_config_channel_rf55xx(struct rt2x00_dev *rt2x00dev,
+ 	rt2800_rfcsr_write(rt2x00dev, 49, rfcsr);
+ 
+ 	rt2800_rfcsr_read(rt2x00dev, 50, &rfcsr);
+-	if (info->default_power1 > power_bound)
++	if (info->default_power2 > power_bound)
+ 		rt2x00_set_field8(&rfcsr, RFCSR50_TX, power_bound);
+ 	else
+ 		rt2x00_set_field8(&rfcsr, RFCSR50_TX, info->default_power2);
+@@ -6056,8 +6056,8 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+ 		default_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
+ 
+ 		for (i = 14; i < spec->num_channels; i++) {
+-			info[i].default_power1 = default_power1[i];
+-			info[i].default_power2 = default_power2[i];
++			info[i].default_power1 = default_power1[i - 14];
++			info[i].default_power2 = default_power2[i - 14];
+ 		}
+ 	}
+ 
+diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
+index 0dc8180e..883a54c8 100644
+--- a/drivers/net/wireless/rt2x00/rt61pci.c
++++ b/drivers/net/wireless/rt2x00/rt61pci.c
+@@ -2825,7 +2825,8 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+ 		tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
+ 		for (i = 14; i < spec->num_channels; i++) {
+ 			info[i].max_power = MAX_TXPOWER;
+-			info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
++			info[i].default_power1 =
++					TXPOWER_FROM_DEV(tx_power[i - 14]);
+ 		}
+ 	}
+ 
+diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
+index 377e09bb..2bbca183 100644
+--- a/drivers/net/wireless/rt2x00/rt73usb.c
++++ b/drivers/net/wireless/rt2x00/rt73usb.c
+@@ -2167,7 +2167,8 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+ 		tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
+ 		for (i = 14; i < spec->num_channels; i++) {
+ 			info[i].max_power = MAX_TXPOWER;
+-			info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
++			info[i].default_power1 =
++					TXPOWER_FROM_DEV(tx_power[i - 14]);
+ 		}
+ 	}
+ 
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index 04da786c..7c8221d3 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -106,8 +106,12 @@ static unsigned int of_bus_default_get_flags(const __be32 *addr)
+ 
+ static int of_bus_pci_match(struct device_node *np)
+ {
+-	/* "vci" is for the /chaos bridge on 1st-gen PCI powermacs */
+-	return !strcmp(np->type, "pci") || !strcmp(np->type, "vci");
++	/*
++	 * "vci" is for the /chaos bridge on 1st-gen PCI powermacs
++	 * "ht" is hypertransport
++	 */
++	return !strcmp(np->type, "pci") || !strcmp(np->type, "vci") ||
++		!strcmp(np->type, "ht");
+ }
+ 
+ static void of_bus_pci_count_cells(struct device_node *np,
+diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
+index f6adde44..3743ac93 100644
+--- a/drivers/s390/scsi/zfcp_aux.c
++++ b/drivers/s390/scsi/zfcp_aux.c
+@@ -3,7 +3,7 @@
+  *
+  * Module interface and handling of zfcp data structures.
+  *
+- * Copyright IBM Corp. 2002, 2010
++ * Copyright IBM Corp. 2002, 2013
+  */
+ 
+ /*
+@@ -23,6 +23,7 @@
+  *            Christof Schmitt
+  *            Martin Petermann
+  *            Sven Schuetz
++ *            Steffen Maier
+  */
+ 
+ #define KMSG_COMPONENT "zfcp"
+@@ -415,6 +416,8 @@ struct zfcp_adapter *zfcp_adapter_enqueue(struct ccw_device *ccw_device)
+ 	adapter->dma_parms.max_segment_size = ZFCP_QDIO_SBALE_LEN;
+ 	adapter->ccw_device->dev.dma_parms = &adapter->dma_parms;
+ 
++	adapter->stat_read_buf_num = FSF_STATUS_READS_RECOM;
++
+ 	if (!zfcp_scsi_adapter_register(adapter))
+ 		return adapter;
+ 
+diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
+index c7e148f3..9152999a 100644
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -3,7 +3,7 @@
+  *
+  * Implementation of FSF commands.
+  *
+- * Copyright IBM Corp. 2002, 2010
++ * Copyright IBM Corp. 2002, 2013
+  */
+ 
+ #define KMSG_COMPONENT "zfcp"
+@@ -483,12 +483,8 @@ static int zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *req)
+ 
+ 	fc_host_port_name(shost) = nsp->fl_wwpn;
+ 	fc_host_node_name(shost) = nsp->fl_wwnn;
+-	fc_host_port_id(shost) = ntoh24(bottom->s_id);
+-	fc_host_speed(shost) =
+-		zfcp_fsf_convert_portspeed(bottom->fc_link_speed);
+ 	fc_host_supported_classes(shost) = FC_COS_CLASS2 | FC_COS_CLASS3;
+ 
+-	adapter->hydra_version = bottom->adapter_type;
+ 	adapter->timer_ticks = bottom->timer_interval & ZFCP_FSF_TIMER_INT_MASK;
+ 	adapter->stat_read_buf_num = max(bottom->status_read_buf_num,
+ 					 (u16)FSF_STATUS_READS_RECOM);
+@@ -496,6 +492,19 @@ static int zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *req)
+ 	if (fc_host_permanent_port_name(shost) == -1)
+ 		fc_host_permanent_port_name(shost) = fc_host_port_name(shost);
+ 
++	zfcp_scsi_set_prot(adapter);
++
++	/* no error return above here, otherwise must fix call chains */
++	/* do not evaluate invalid fields */
++	if (req->qtcb->header.fsf_status == FSF_EXCHANGE_CONFIG_DATA_INCOMPLETE)
++		return 0;
++
++	fc_host_port_id(shost) = ntoh24(bottom->s_id);
++	fc_host_speed(shost) =
++		zfcp_fsf_convert_portspeed(bottom->fc_link_speed);
++
++	adapter->hydra_version = bottom->adapter_type;
++
+ 	switch (bottom->fc_topology) {
+ 	case FSF_TOPO_P2P:
+ 		adapter->peer_d_id = ntoh24(bottom->peer_d_id);
+@@ -517,8 +526,6 @@ static int zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *req)
+ 		return -EIO;
+ 	}
+ 
+-	zfcp_scsi_set_prot(adapter);
+-
+ 	return 0;
+ }
+ 
+@@ -563,8 +570,14 @@ static void zfcp_fsf_exchange_config_data_handler(struct zfcp_fsf_req *req)
+ 		fc_host_port_type(shost) = FC_PORTTYPE_UNKNOWN;
+ 		adapter->hydra_version = 0;
+ 
++		/* avoids adapter shutdown to be able to recognize
++		 * events such as LINK UP */
++		atomic_set_mask(ZFCP_STATUS_ADAPTER_XCONFIG_OK,
++				&adapter->status);
+ 		zfcp_fsf_link_down_info_eval(req,
+ 			&qtcb->header.fsf_status_qual.link_down_info);
++		if (zfcp_fsf_exchange_config_evaluate(req))
++			return;
+ 		break;
+ 	default:
+ 		zfcp_erp_adapter_shutdown(adapter, 0, "fsecdh3");
+diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
+index 7b31e3f4..7b353647 100644
+--- a/drivers/s390/scsi/zfcp_scsi.c
++++ b/drivers/s390/scsi/zfcp_scsi.c
+@@ -3,7 +3,7 @@
+  *
+  * Interface to Linux SCSI midlayer.
+  *
+- * Copyright IBM Corp. 2002, 2010
++ * Copyright IBM Corp. 2002, 2013
+  */
+ 
+ #define KMSG_COMPONENT "zfcp"
+@@ -311,8 +311,12 @@ static struct scsi_host_template zfcp_scsi_host_template = {
+ 	.proc_name		 = "zfcp",
+ 	.can_queue		 = 4096,
+ 	.this_id		 = -1,
+-	.sg_tablesize		 = 1, /* adjusted later */
+-	.max_sectors		 = 8, /* adjusted later */
++	.sg_tablesize		 = (((QDIO_MAX_ELEMENTS_PER_BUFFER - 1)
++				     * ZFCP_QDIO_MAX_SBALS_PER_REQ) - 2),
++				   /* GCD, adjusted later */
++	.max_sectors		 = (((QDIO_MAX_ELEMENTS_PER_BUFFER - 1)
++				     * ZFCP_QDIO_MAX_SBALS_PER_REQ) - 2) * 8,
++				   /* GCD, adjusted later */
+ 	.dma_boundary		 = ZFCP_QDIO_SBALE_LEN - 1,
+ 	.cmd_per_lun		 = 1,
+ 	.use_clustering		 = 1,
+diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c
+index 0f56d8d7..7e171076 100644
+--- a/drivers/scsi/aacraid/src.c
++++ b/drivers/scsi/aacraid/src.c
+@@ -93,6 +93,9 @@ static irqreturn_t aac_src_intr_message(int irq, void *dev_id)
+ 			int send_it = 0;
+ 			extern int aac_sync_mode;
+ 
++			src_writel(dev, MUnit.ODR_C, bellbits);
++			src_readl(dev, MUnit.ODR_C);
++
+ 			if (!aac_sync_mode) {
+ 				src_writel(dev, MUnit.ODR_C, bellbits);
+ 				src_readl(dev, MUnit.ODR_C);
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
+index bcb23d28..c76b18bb 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -80,10 +80,6 @@ static int msix_disable = -1;
+ module_param(msix_disable, int, 0);
+ MODULE_PARM_DESC(msix_disable, " disable msix routed interrupts (default=0)");
+ 
+-static int missing_delay[2] = {-1, -1};
+-module_param_array(missing_delay, int, NULL, 0);
+-MODULE_PARM_DESC(missing_delay, " device missing delay , io missing delay");
+-
+ static int mpt2sas_fwfault_debug;
+ MODULE_PARM_DESC(mpt2sas_fwfault_debug, " enable detection of firmware fault "
+ 	"and halt firmware - (default=0)");
+@@ -2199,7 +2195,7 @@ _base_display_ioc_capabilities(struct MPT2SAS_ADAPTER *ioc)
+ }
+ 
+ /**
+- * _base_update_missing_delay - change the missing delay timers
++ * mpt2sas_base_update_missing_delay - change the missing delay timers
+  * @ioc: per adapter object
+  * @device_missing_delay: amount of time till device is reported missing
+  * @io_missing_delay: interval IO is returned when there is a missing device
+@@ -2210,8 +2206,8 @@ _base_display_ioc_capabilities(struct MPT2SAS_ADAPTER *ioc)
+  * delay, as well as the io missing delay. This should be called at driver
+  * load time.
+  */
+-static void
+-_base_update_missing_delay(struct MPT2SAS_ADAPTER *ioc,
++void
++mpt2sas_base_update_missing_delay(struct MPT2SAS_ADAPTER *ioc,
+ 	u16 device_missing_delay, u8 io_missing_delay)
+ {
+ 	u16 dmd, dmd_new, dmd_orignal;
+@@ -4407,9 +4403,6 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
+ 	if (r)
+ 		goto out_free_resources;
+ 
+-	if (missing_delay[0] != -1 && missing_delay[1] != -1)
+-		_base_update_missing_delay(ioc, missing_delay[0],
+-		    missing_delay[1]);
+ 	ioc->non_operational_loop = 0;
+ 
+ 	return 0;
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.h b/drivers/scsi/mpt2sas/mpt2sas_base.h
+index 4caaac13..11301974 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.h
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.h
+@@ -1055,6 +1055,9 @@ void mpt2sas_base_validate_event_type(struct MPT2SAS_ADAPTER *ioc, u32 *event_ty
+ 
+ void mpt2sas_halt_firmware(struct MPT2SAS_ADAPTER *ioc);
+ 
++void mpt2sas_base_update_missing_delay(struct MPT2SAS_ADAPTER *ioc,
++	u16 device_missing_delay, u8 io_missing_delay);
++
+ int mpt2sas_port_enable(struct MPT2SAS_ADAPTER *ioc);
+ 
+ /* scsih shared API */
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+index c6bdc926..8dbe500c 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -101,6 +101,10 @@ static ushort max_sectors = 0xFFFF;
+ module_param(max_sectors, ushort, 0);
+ MODULE_PARM_DESC(max_sectors, "max sectors, range 64 to 32767  default=32767");
+ 
++static int missing_delay[2] = {-1, -1};
++module_param_array(missing_delay, int, NULL, 0);
++MODULE_PARM_DESC(missing_delay, " device missing delay , io missing delay");
++
+ /* scsi-mid layer global parmeter is max_report_luns, which is 511 */
+ #define MPT2SAS_MAX_LUN (16895)
+ static int max_lun = MPT2SAS_MAX_LUN;
+@@ -3994,11 +3998,7 @@ _scsih_qcmd_lck(struct scsi_cmnd *scmd, void (*done)(struct scsi_cmnd *))
+ 			else
+ 				mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ;
+ 		} else
+-/* MPI Revision I (UNIT = 0xA) - removed MPI2_SCSIIO_CONTROL_UNTAGGED */
+-/*			mpi_control |= MPI2_SCSIIO_CONTROL_UNTAGGED;
+- */
+-			mpi_control |= (0x500);
+-
++			mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ;
+ 	} else
+ 		mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ;
+ 	/* Make sure Device is not raid volume.
+@@ -7303,7 +7303,9 @@ _firmware_event_work(struct work_struct *work)
+ 	case MPT2SAS_PORT_ENABLE_COMPLETE:
+ 		ioc->start_scan = 0;
+ 
+-
++		if (missing_delay[0] != -1 && missing_delay[1] != -1)
++			mpt2sas_base_update_missing_delay(ioc, missing_delay[0],
++				missing_delay[1]);
+ 
+ 		dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "port enable: complete "
+ 		    "from worker thread\n", ioc->name));
+diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
+index 2c0d0ec8..3b1ea34e 100644
+--- a/drivers/scsi/scsi.c
++++ b/drivers/scsi/scsi.c
+@@ -1070,8 +1070,8 @@ EXPORT_SYMBOL_GPL(scsi_get_vpd_page);
+  * @opcode:	opcode for command to look up
+  *
+  * Uses the REPORT SUPPORTED OPERATION CODES to look up the given
+- * opcode. Returns 0 if RSOC fails or if the command opcode is
+- * unsupported. Returns 1 if the device claims to support the command.
++ * opcode. Returns -EINVAL if RSOC fails, 0 if the command opcode is
++ * unsupported and 1 if the device claims to support the command.
+  */
+ int scsi_report_opcode(struct scsi_device *sdev, unsigned char *buffer,
+ 		       unsigned int len, unsigned char opcode)
+@@ -1081,7 +1081,7 @@ int scsi_report_opcode(struct scsi_device *sdev, unsigned char *buffer,
+ 	int result;
+ 
+ 	if (sdev->no_report_opcodes || sdev->scsi_level < SCSI_SPC_3)
+-		return 0;
++		return -EINVAL;
+ 
+ 	memset(cmd, 0, 16);
+ 	cmd[0] = MAINTENANCE_IN;
+@@ -1097,7 +1097,7 @@ int scsi_report_opcode(struct scsi_device *sdev, unsigned char *buffer,
+ 	if (result && scsi_sense_valid(&sshdr) &&
+ 	    sshdr.sense_key == ILLEGAL_REQUEST &&
+ 	    (sshdr.asc == 0x20 || sshdr.asc == 0x24) && sshdr.ascq == 0x00)
+-		return 0;
++		return -EINVAL;
+ 
+ 	if ((buffer[1] & 3) == 3) /* Command supported */
+ 		return 1;
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 6f6a1b48..1b1125e6 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -442,8 +442,10 @@ sd_store_write_same_blocks(struct device *dev, struct device_attribute *attr,
+ 
+ 	if (max == 0)
+ 		sdp->no_write_same = 1;
+-	else if (max <= SD_MAX_WS16_BLOCKS)
++	else if (max <= SD_MAX_WS16_BLOCKS) {
++		sdp->no_write_same = 0;
+ 		sdkp->max_ws_blocks = max;
++	}
+ 
+ 	sd_config_write_same(sdkp);
+ 
+@@ -740,7 +742,6 @@ static void sd_config_write_same(struct scsi_disk *sdkp)
+ {
+ 	struct request_queue *q = sdkp->disk->queue;
+ 	unsigned int logical_block_size = sdkp->device->sector_size;
+-	unsigned int blocks = 0;
+ 
+ 	if (sdkp->device->no_write_same) {
+ 		sdkp->max_ws_blocks = 0;
+@@ -752,18 +753,20 @@ static void sd_config_write_same(struct scsi_disk *sdkp)
+ 	 * blocks per I/O unless the device explicitly advertises a
+ 	 * bigger limit.
+ 	 */
+-	if (sdkp->max_ws_blocks == 0)
+-		sdkp->max_ws_blocks = SD_MAX_WS10_BLOCKS;
+-
+-	if (sdkp->ws16 || sdkp->max_ws_blocks > SD_MAX_WS10_BLOCKS)
+-		blocks = min_not_zero(sdkp->max_ws_blocks,
+-				      (u32)SD_MAX_WS16_BLOCKS);
+-	else
+-		blocks = min_not_zero(sdkp->max_ws_blocks,
+-				      (u32)SD_MAX_WS10_BLOCKS);
++	if (sdkp->max_ws_blocks > SD_MAX_WS10_BLOCKS)
++		sdkp->max_ws_blocks = min_not_zero(sdkp->max_ws_blocks,
++						   (u32)SD_MAX_WS16_BLOCKS);
++	else if (sdkp->ws16 || sdkp->ws10 || sdkp->device->no_report_opcodes)
++		sdkp->max_ws_blocks = min_not_zero(sdkp->max_ws_blocks,
++						   (u32)SD_MAX_WS10_BLOCKS);
++	else {
++		sdkp->device->no_write_same = 1;
++		sdkp->max_ws_blocks = 0;
++	}
+ 
+ out:
+-	blk_queue_max_write_same_sectors(q, blocks * (logical_block_size >> 9));
++	blk_queue_max_write_same_sectors(q, sdkp->max_ws_blocks *
++					 (logical_block_size >> 9));
+ }
+ 
+ /**
+@@ -2635,9 +2638,24 @@ static void sd_read_block_provisioning(struct scsi_disk *sdkp)
+ 
+ static void sd_read_write_same(struct scsi_disk *sdkp, unsigned char *buffer)
+ {
+-	if (scsi_report_opcode(sdkp->device, buffer, SD_BUF_SIZE,
+-			       WRITE_SAME_16))
++	struct scsi_device *sdev = sdkp->device;
++
++	if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE, INQUIRY) < 0) {
++		sdev->no_report_opcodes = 1;
++
++		/* Disable WRITE SAME if REPORT SUPPORTED OPERATION
++		 * CODES is unsupported and the device has an ATA
++		 * Information VPD page (SAT).
++		 */
++		if (!scsi_get_vpd_page(sdev, 0x89, buffer, SD_BUF_SIZE))
++			sdev->no_write_same = 1;
++	}
++
++	if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE, WRITE_SAME_16) == 1)
+ 		sdkp->ws16 = 1;
++
++	if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE, WRITE_SAME) == 1)
++		sdkp->ws10 = 1;
+ }
+ 
+ static int sd_try_extended_inquiry(struct scsi_device *sdp)
+diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h
+index 2386aeb4..7a049de2 100644
+--- a/drivers/scsi/sd.h
++++ b/drivers/scsi/sd.h
+@@ -84,6 +84,7 @@ struct scsi_disk {
+ 	unsigned	lbpws : 1;
+ 	unsigned	lbpws10 : 1;
+ 	unsigned	lbpvpd : 1;
++	unsigned	ws10 : 1;
+ 	unsigned	ws16 : 1;
+ };
+ #define to_scsi_disk(obj) container_of(obj,struct scsi_disk,dev)
+diff --git a/drivers/staging/line6/pcm.c b/drivers/staging/line6/pcm.c
+index 02f77d74..a7856bad 100644
+--- a/drivers/staging/line6/pcm.c
++++ b/drivers/staging/line6/pcm.c
+@@ -385,8 +385,11 @@ static int snd_line6_pcm_free(struct snd_device *device)
+ */
+ static void pcm_disconnect_substream(struct snd_pcm_substream *substream)
+ {
+-	if (substream->runtime && snd_pcm_running(substream))
++	if (substream->runtime && snd_pcm_running(substream)) {
++		snd_pcm_stream_lock_irq(substream);
+ 		snd_pcm_stop(substream, SNDRV_PCM_STATE_DISCONNECTED);
++		snd_pcm_stream_unlock_irq(substream);
++	}
+ }
+ 
+ /*
+diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
+index bd3ae324..71af7b5a 100644
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -191,7 +191,8 @@ static void leak_balloon(struct virtio_balloon *vb, size_t num)
+ 	 * virtio_has_feature(vdev, VIRTIO_BALLOON_F_MUST_TELL_HOST);
+ 	 * is true, we *have* to do it in this order
+ 	 */
+-	tell_host(vb, vb->deflate_vq);
++	if (vb->num_pfns != 0)
++		tell_host(vb, vb->deflate_vq);
+ 	mutex_unlock(&vb->balloon_lock);
+ 	release_pages_by_pfn(vb->pfns, vb->num_pfns);
+ }
+diff --git a/include/linux/cpu_cooling.h b/include/linux/cpu_cooling.h
+index 282e2702..a5d52eea 100644
+--- a/include/linux/cpu_cooling.h
++++ b/include/linux/cpu_cooling.h
+@@ -41,7 +41,7 @@ cpufreq_cooling_register(const struct cpumask *clip_cpus);
+  */
+ void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev);
+ 
+-unsigned long cpufreq_cooling_get_level(unsigned int, unsigned int);
++unsigned long cpufreq_cooling_get_level(unsigned int cpu, unsigned int freq);
+ #else /* !CONFIG_CPU_THERMAL */
+ static inline struct thermal_cooling_device *
+ cpufreq_cooling_register(const struct cpumask *clip_cpus)
+@@ -54,7 +54,7 @@ void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
+ 	return;
+ }
+ static inline
+-unsigned long cpufreq_cooling_get_level(unsigned int, unsigned int)
++unsigned long cpufreq_cooling_get_level(unsigned int cpu, unsigned int freq)
+ {
+ 	return THERMAL_CSTATE_INVALID;
+ }
+diff --git a/include/linux/iio/iio.h b/include/linux/iio/iio.h
+index 8d171f42..3d35b702 100644
+--- a/include/linux/iio/iio.h
++++ b/include/linux/iio/iio.h
+@@ -211,8 +211,8 @@ struct iio_chan_spec {
+ static inline bool iio_channel_has_info(const struct iio_chan_spec *chan,
+ 	enum iio_chan_info_enum type)
+ {
+-	return (chan->info_mask_separate & type) |
+-	       (chan->info_mask_shared_by_type & type);
++	return (chan->info_mask_separate & BIT(type)) |
++	       (chan->info_mask_shared_by_type & BIT(type));
+ }
+ 
+ #define IIO_ST(si, rb, sb, sh)						\
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index b391907d..e76e4959 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -761,8 +761,18 @@ perf_lock_task_context(struct task_struct *task, int ctxn, unsigned long *flags)
+ {
+ 	struct perf_event_context *ctx;
+ 
+-	rcu_read_lock();
+ retry:
++	/*
++	 * One of the few rules of preemptible RCU is that one cannot do
++	 * rcu_read_unlock() while holding a scheduler (or nested) lock when
++	 * part of the read side critical section was preemptible -- see
++	 * rcu_read_unlock_special().
++	 *
++	 * Since ctx->lock nests under rq->lock we must ensure the entire read
++	 * side critical section is non-preemptible.
++	 */
++	preempt_disable();
++	rcu_read_lock();
+ 	ctx = rcu_dereference(task->perf_event_ctxp[ctxn]);
+ 	if (ctx) {
+ 		/*
+@@ -778,6 +788,8 @@ retry:
+ 		raw_spin_lock_irqsave(&ctx->lock, *flags);
+ 		if (ctx != rcu_dereference(task->perf_event_ctxp[ctxn])) {
+ 			raw_spin_unlock_irqrestore(&ctx->lock, *flags);
++			rcu_read_unlock();
++			preempt_enable();
+ 			goto retry;
+ 		}
+ 
+@@ -787,6 +799,7 @@ retry:
+ 		}
+ 	}
+ 	rcu_read_unlock();
++	preempt_enable();
+ 	return ctx;
+ }
+ 
+@@ -1761,7 +1774,16 @@ static int __perf_event_enable(void *info)
+ 	struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
+ 	int err;
+ 
+-	if (WARN_ON_ONCE(!ctx->is_active))
++	/*
++	 * There's a time window between 'ctx->is_active' check
++	 * in perf_event_enable function and this place having:
++	 *   - IRQs on
++	 *   - ctx->lock unlocked
++	 *
++	 * where the task could be killed and 'ctx' deactivated
++	 * by perf_event_exit_task.
++	 */
++	if (!ctx->is_active)
+ 		return -EINVAL;
+ 
+ 	raw_spin_lock(&ctx->lock);
+@@ -7228,7 +7250,7 @@ inherit_task_group(struct perf_event *event, struct task_struct *parent,
+ 		 * child.
+ 		 */
+ 
+-		child_ctx = alloc_perf_context(event->pmu, child);
++		child_ctx = alloc_perf_context(parent_ctx->pmu, child);
+ 		if (!child_ctx)
+ 			return -ENOMEM;
+ 
+diff --git a/kernel/printk.c b/kernel/printk.c
+index 8212c1ae..d37d45c9 100644
+--- a/kernel/printk.c
++++ b/kernel/printk.c
+@@ -1369,9 +1369,9 @@ static int console_trylock_for_printk(unsigned int cpu)
+ 		}
+ 	}
+ 	logbuf_cpu = UINT_MAX;
++	raw_spin_unlock(&logbuf_lock);
+ 	if (wake)
+ 		up(&console_sem);
+-	raw_spin_unlock(&logbuf_lock);
+ 	return retval;
+ }
+ 
+diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
+index 20d6fba7..297b90b5 100644
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -29,6 +29,7 @@
+ 
+ static struct tick_device tick_broadcast_device;
+ static cpumask_var_t tick_broadcast_mask;
++static cpumask_var_t tick_broadcast_on;
+ static cpumask_var_t tmpmask;
+ static DEFINE_RAW_SPINLOCK(tick_broadcast_lock);
+ static int tick_broadcast_force;
+@@ -123,8 +124,9 @@ static void tick_device_setup_broadcast_func(struct clock_event_device *dev)
+  */
+ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
+ {
++	struct clock_event_device *bc = tick_broadcast_device.evtdev;
+ 	unsigned long flags;
+-	int ret = 0;
++	int ret;
+ 
+ 	raw_spin_lock_irqsave(&tick_broadcast_lock, flags);
+ 
+@@ -138,20 +140,59 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
+ 		dev->event_handler = tick_handle_periodic;
+ 		tick_device_setup_broadcast_func(dev);
+ 		cpumask_set_cpu(cpu, tick_broadcast_mask);
+-		tick_broadcast_start_periodic(tick_broadcast_device.evtdev);
++		tick_broadcast_start_periodic(bc);
+ 		ret = 1;
+ 	} else {
+ 		/*
+-		 * When the new device is not affected by the stop
+-		 * feature and the cpu is marked in the broadcast mask
+-		 * then clear the broadcast bit.
++		 * Clear the broadcast bit for this cpu if the
++		 * device is not power state affected.
+ 		 */
+-		if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
+-			int cpu = smp_processor_id();
++		if (!(dev->features & CLOCK_EVT_FEAT_C3STOP))
+ 			cpumask_clear_cpu(cpu, tick_broadcast_mask);
+-			tick_broadcast_clear_oneshot(cpu);
+-		} else {
++		else
+ 			tick_device_setup_broadcast_func(dev);
++
++		/*
++		 * Clear the broadcast bit if the CPU is not in
++		 * periodic broadcast on state.
++		 */
++		if (!cpumask_test_cpu(cpu, tick_broadcast_on))
++			cpumask_clear_cpu(cpu, tick_broadcast_mask);
++
++		switch (tick_broadcast_device.mode) {
++		case TICKDEV_MODE_ONESHOT:
++			/*
++			 * If the system is in oneshot mode we can
++			 * unconditionally clear the oneshot mask bit,
++			 * because the CPU is running and therefore
++			 * not in an idle state which causes the power
++			 * state affected device to stop. Let the
++			 * caller initialize the device.
++			 */
++			tick_broadcast_clear_oneshot(cpu);
++			ret = 0;
++			break;
++
++		case TICKDEV_MODE_PERIODIC:
++			/*
++			 * If the system is in periodic mode, check
++			 * whether the broadcast device can be
++			 * switched off now.
++			 */
++			if (cpumask_empty(tick_broadcast_mask) && bc)
++				clockevents_shutdown(bc);
++			/*
++			 * If we kept the cpu in the broadcast mask,
++			 * tell the caller to leave the per cpu device
++			 * in shutdown state. The periodic interrupt
++			 * is delivered by the broadcast device.
++			 */
++			ret = cpumask_test_cpu(cpu, tick_broadcast_mask);
++			break;
++		default:
++			/* Nothing to do */
++			ret = 0;
++			break;
+ 		}
+ 	}
+ 	raw_spin_unlock_irqrestore(&tick_broadcast_lock, flags);
+@@ -281,6 +322,7 @@ static void tick_do_broadcast_on_off(unsigned long *reason)
+ 	switch (*reason) {
+ 	case CLOCK_EVT_NOTIFY_BROADCAST_ON:
+ 	case CLOCK_EVT_NOTIFY_BROADCAST_FORCE:
++		cpumask_set_cpu(cpu, tick_broadcast_on);
+ 		if (!cpumask_test_and_set_cpu(cpu, tick_broadcast_mask)) {
+ 			if (tick_broadcast_device.mode ==
+ 			    TICKDEV_MODE_PERIODIC)
+@@ -290,8 +332,12 @@ static void tick_do_broadcast_on_off(unsigned long *reason)
+ 			tick_broadcast_force = 1;
+ 		break;
+ 	case CLOCK_EVT_NOTIFY_BROADCAST_OFF:
+-		if (!tick_broadcast_force &&
+-		    cpumask_test_and_clear_cpu(cpu, tick_broadcast_mask)) {
++		if (tick_broadcast_force)
++			break;
++		cpumask_clear_cpu(cpu, tick_broadcast_on);
++		if (!tick_device_is_functional(dev))
++			break;
++		if (cpumask_test_and_clear_cpu(cpu, tick_broadcast_mask)) {
+ 			if (tick_broadcast_device.mode ==
+ 			    TICKDEV_MODE_PERIODIC)
+ 				tick_setup_periodic(dev, 0);
+@@ -349,6 +395,7 @@ void tick_shutdown_broadcast(unsigned int *cpup)
+ 
+ 	bc = tick_broadcast_device.evtdev;
+ 	cpumask_clear_cpu(cpu, tick_broadcast_mask);
++	cpumask_clear_cpu(cpu, tick_broadcast_on);
+ 
+ 	if (tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC) {
+ 		if (bc && cpumask_empty(tick_broadcast_mask))
+@@ -475,7 +522,15 @@ void tick_check_oneshot_broadcast(int cpu)
+ 	if (cpumask_test_cpu(cpu, tick_broadcast_oneshot_mask)) {
+ 		struct tick_device *td = &per_cpu(tick_cpu_device, cpu);
+ 
+-		clockevents_set_mode(td->evtdev, CLOCK_EVT_MODE_ONESHOT);
++		/*
++		 * We might be in the middle of switching over from
++		 * periodic to oneshot. If the CPU has not yet
++		 * switched over, leave the device alone.
++		 */
++		if (td->mode == TICKDEV_MODE_ONESHOT) {
++			clockevents_set_mode(td->evtdev,
++					     CLOCK_EVT_MODE_ONESHOT);
++		}
+ 	}
+ }
+ 
+@@ -792,6 +847,7 @@ bool tick_broadcast_oneshot_available(void)
+ void __init tick_broadcast_init(void)
+ {
+ 	zalloc_cpumask_var(&tick_broadcast_mask, GFP_NOWAIT);
++	zalloc_cpumask_var(&tick_broadcast_on, GFP_NOWAIT);
+ 	zalloc_cpumask_var(&tmpmask, GFP_NOWAIT);
+ #ifdef CONFIG_TICK_ONESHOT
+ 	zalloc_cpumask_var(&tick_broadcast_oneshot_mask, GFP_NOWAIT);
+diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
+index 5d3fb100..7ce5e5a4 100644
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -194,7 +194,8 @@ static void tick_setup_device(struct tick_device *td,
+ 	 * When global broadcasting is active, check if the current
+ 	 * device is registered as a placeholder for broadcast mode.
+ 	 * This allows us to handle this x86 misfeature in a generic
+-	 * way.
++	 * way. This function also returns !=0 when we keep the
++	 * current active broadcast state for this CPU.
+ 	 */
+ 	if (tick_device_uses_broadcast(newdev, cpu))
+ 		return;
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index e71a8be4..0b936d80 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -193,6 +193,37 @@ static struct trace_array	global_trace;
+ 
+ LIST_HEAD(ftrace_trace_arrays);
+ 
++int trace_array_get(struct trace_array *this_tr)
++{
++	struct trace_array *tr;
++	int ret = -ENODEV;
++
++	mutex_lock(&trace_types_lock);
++	list_for_each_entry(tr, &ftrace_trace_arrays, list) {
++		if (tr == this_tr) {
++			tr->ref++;
++			ret = 0;
++			break;
++		}
++	}
++	mutex_unlock(&trace_types_lock);
++
++	return ret;
++}
++
++static void __trace_array_put(struct trace_array *this_tr)
++{
++	WARN_ON(!this_tr->ref);
++	this_tr->ref--;
++}
++
++void trace_array_put(struct trace_array *this_tr)
++{
++	mutex_lock(&trace_types_lock);
++	__trace_array_put(this_tr);
++	mutex_unlock(&trace_types_lock);
++}
++
+ int filter_current_check_discard(struct ring_buffer *buffer,
+ 				 struct ftrace_event_call *call, void *rec,
+ 				 struct ring_buffer_event *event)
+@@ -240,7 +271,7 @@ static struct tracer		*trace_types __read_mostly;
+ /*
+  * trace_types_lock is used to protect the trace_types list.
+  */
+-static DEFINE_MUTEX(trace_types_lock);
++DEFINE_MUTEX(trace_types_lock);
+ 
+ /*
+  * serialize the access of the ring buffer
+@@ -2768,10 +2799,9 @@ static const struct seq_operations tracer_seq_ops = {
+ };
+ 
+ static struct trace_iterator *
+-__tracing_open(struct inode *inode, struct file *file, bool snapshot)
++__tracing_open(struct trace_array *tr, struct trace_cpu *tc,
++	       struct inode *inode, struct file *file, bool snapshot)
+ {
+-	struct trace_cpu *tc = inode->i_private;
+-	struct trace_array *tr = tc->tr;
+ 	struct trace_iterator *iter;
+ 	int cpu;
+ 
+@@ -2850,8 +2880,6 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot)
+ 		tracing_iter_reset(iter, cpu);
+ 	}
+ 
+-	tr->ref++;
+-
+ 	mutex_unlock(&trace_types_lock);
+ 
+ 	return iter;
+@@ -2874,6 +2902,43 @@ int tracing_open_generic(struct inode *inode, struct file *filp)
+ 	return 0;
+ }
+ 
++/*
++ * Open and update trace_array ref count.
++ * Must have the current trace_array passed to it.
++ */
++int tracing_open_generic_tr(struct inode *inode, struct file *filp)
++{
++	struct trace_array *tr = inode->i_private;
++
++	if (tracing_disabled)
++		return -ENODEV;
++
++	if (trace_array_get(tr) < 0)
++		return -ENODEV;
++
++	filp->private_data = inode->i_private;
++
++	return 0;
++
++}
++
++int tracing_open_generic_tc(struct inode *inode, struct file *filp)
++{
++	struct trace_cpu *tc = inode->i_private;
++	struct trace_array *tr = tc->tr;
++
++	if (tracing_disabled)
++		return -ENODEV;
++
++	if (trace_array_get(tr) < 0)
++		return -ENODEV;
++
++	filp->private_data = inode->i_private;
++
++	return 0;
++
++}
++
+ static int tracing_release(struct inode *inode, struct file *file)
+ {
+ 	struct seq_file *m = file->private_data;
+@@ -2881,17 +2946,20 @@ static int tracing_release(struct inode *inode, struct file *file)
+ 	struct trace_array *tr;
+ 	int cpu;
+ 
+-	if (!(file->f_mode & FMODE_READ))
++	/* Writes do not use seq_file, need to grab tr from inode */
++	if (!(file->f_mode & FMODE_READ)) {
++		struct trace_cpu *tc = inode->i_private;
++
++		trace_array_put(tc->tr);
+ 		return 0;
++	}
+ 
+ 	iter = m->private;
+ 	tr = iter->tr;
++	trace_array_put(tr);
+ 
+ 	mutex_lock(&trace_types_lock);
+ 
+-	WARN_ON(!tr->ref);
+-	tr->ref--;
+-
+ 	for_each_tracing_cpu(cpu) {
+ 		if (iter->buffer_iter[cpu])
+ 			ring_buffer_read_finish(iter->buffer_iter[cpu]);
+@@ -2910,20 +2978,49 @@ static int tracing_release(struct inode *inode, struct file *file)
+ 	kfree(iter->trace);
+ 	kfree(iter->buffer_iter);
+ 	seq_release_private(inode, file);
++
++	return 0;
++}
++
++static int tracing_release_generic_tr(struct inode *inode, struct file *file)
++{
++	struct trace_array *tr = inode->i_private;
++
++	trace_array_put(tr);
+ 	return 0;
+ }
+ 
++static int tracing_release_generic_tc(struct inode *inode, struct file *file)
++{
++	struct trace_cpu *tc = inode->i_private;
++	struct trace_array *tr = tc->tr;
++
++	trace_array_put(tr);
++	return 0;
++}
++
++static int tracing_single_release_tr(struct inode *inode, struct file *file)
++{
++	struct trace_array *tr = inode->i_private;
++
++	trace_array_put(tr);
++
++	return single_release(inode, file);
++}
++
+ static int tracing_open(struct inode *inode, struct file *file)
+ {
++	struct trace_cpu *tc = inode->i_private;
++	struct trace_array *tr = tc->tr;
+ 	struct trace_iterator *iter;
+ 	int ret = 0;
+ 
++	if (trace_array_get(tr) < 0)
++		return -ENODEV;
++
+ 	/* If this file was open for write, then erase contents */
+ 	if ((file->f_mode & FMODE_WRITE) &&
+ 	    (file->f_flags & O_TRUNC)) {
+-		struct trace_cpu *tc = inode->i_private;
+-		struct trace_array *tr = tc->tr;
+-
+ 		if (tc->cpu == RING_BUFFER_ALL_CPUS)
+ 			tracing_reset_online_cpus(&tr->trace_buffer);
+ 		else
+@@ -2931,12 +3028,16 @@ static int tracing_open(struct inode *inode, struct file *file)
+ 	}
+ 
+ 	if (file->f_mode & FMODE_READ) {
+-		iter = __tracing_open(inode, file, false);
++		iter = __tracing_open(tr, tc, inode, file, false);
+ 		if (IS_ERR(iter))
+ 			ret = PTR_ERR(iter);
+ 		else if (trace_flags & TRACE_ITER_LATENCY_FMT)
+ 			iter->iter_flags |= TRACE_FILE_LAT_FMT;
+ 	}
++
++	if (ret < 0)
++		trace_array_put(tr);
++
+ 	return ret;
+ }
+ 
+@@ -3293,9 +3394,14 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf,
+ 
+ static int tracing_trace_options_open(struct inode *inode, struct file *file)
+ {
++	struct trace_array *tr = inode->i_private;
++
+ 	if (tracing_disabled)
+ 		return -ENODEV;
+ 
++	if (trace_array_get(tr) < 0)
++		return -ENODEV;
++
+ 	return single_open(file, tracing_trace_options_show, inode->i_private);
+ }
+ 
+@@ -3303,7 +3409,7 @@ static const struct file_operations tracing_iter_fops = {
+ 	.open		= tracing_trace_options_open,
+ 	.read		= seq_read,
+ 	.llseek		= seq_lseek,
+-	.release	= single_release,
++	.release	= tracing_single_release_tr,
+ 	.write		= tracing_trace_options_write,
+ };
+ 
+@@ -3791,6 +3897,9 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp)
+ 	if (tracing_disabled)
+ 		return -ENODEV;
+ 
++	if (trace_array_get(tr) < 0)
++		return -ENODEV;
++
+ 	mutex_lock(&trace_types_lock);
+ 
+ 	/* create a buffer to store the information to pass to userspace */
+@@ -3843,6 +3952,7 @@ out:
+ fail:
+ 	kfree(iter->trace);
+ 	kfree(iter);
++	__trace_array_put(tr);
+ 	mutex_unlock(&trace_types_lock);
+ 	return ret;
+ }
+@@ -3850,6 +3960,8 @@ fail:
+ static int tracing_release_pipe(struct inode *inode, struct file *file)
+ {
+ 	struct trace_iterator *iter = file->private_data;
++	struct trace_cpu *tc = inode->i_private;
++	struct trace_array *tr = tc->tr;
+ 
+ 	mutex_lock(&trace_types_lock);
+ 
+@@ -3863,6 +3975,8 @@ static int tracing_release_pipe(struct inode *inode, struct file *file)
+ 	kfree(iter->trace);
+ 	kfree(iter);
+ 
++	trace_array_put(tr);
++
+ 	return 0;
+ }
+ 
+@@ -4320,6 +4434,8 @@ tracing_free_buffer_release(struct inode *inode, struct file *filp)
+ 	/* resize the ring buffer to 0 */
+ 	tracing_resize_ring_buffer(tr, 0, RING_BUFFER_ALL_CPUS);
+ 
++	trace_array_put(tr);
++
+ 	return 0;
+ }
+ 
+@@ -4328,6 +4444,7 @@ tracing_mark_write(struct file *filp, const char __user *ubuf,
+ 					size_t cnt, loff_t *fpos)
+ {
+ 	unsigned long addr = (unsigned long)ubuf;
++	struct trace_array *tr = filp->private_data;
+ 	struct ring_buffer_event *event;
+ 	struct ring_buffer *buffer;
+ 	struct print_entry *entry;
+@@ -4387,7 +4504,7 @@ tracing_mark_write(struct file *filp, const char __user *ubuf,
+ 
+ 	local_save_flags(irq_flags);
+ 	size = sizeof(*entry) + cnt + 2; /* possible \n added */
+-	buffer = global_trace.trace_buffer.buffer;
++	buffer = tr->trace_buffer.buffer;
+ 	event = trace_buffer_lock_reserve(buffer, TRACE_PRINT, size,
+ 					  irq_flags, preempt_count());
+ 	if (!event) {
+@@ -4495,10 +4612,20 @@ static ssize_t tracing_clock_write(struct file *filp, const char __user *ubuf,
+ 
+ static int tracing_clock_open(struct inode *inode, struct file *file)
+ {
++	struct trace_array *tr = inode->i_private;
++	int ret;
++
+ 	if (tracing_disabled)
+ 		return -ENODEV;
+ 
+-	return single_open(file, tracing_clock_show, inode->i_private);
++	if (trace_array_get(tr))
++		return -ENODEV;
++
++	ret = single_open(file, tracing_clock_show, inode->i_private);
++	if (ret < 0)
++		trace_array_put(tr);
++
++	return ret;
+ }
+ 
+ struct ftrace_buffer_info {
+@@ -4511,12 +4638,16 @@ struct ftrace_buffer_info {
+ static int tracing_snapshot_open(struct inode *inode, struct file *file)
+ {
+ 	struct trace_cpu *tc = inode->i_private;
++	struct trace_array *tr = tc->tr;
+ 	struct trace_iterator *iter;
+ 	struct seq_file *m;
+ 	int ret = 0;
+ 
++	if (trace_array_get(tr) < 0)
++		return -ENODEV;
++
+ 	if (file->f_mode & FMODE_READ) {
+-		iter = __tracing_open(inode, file, true);
++		iter = __tracing_open(tr, tc, inode, file, true);
+ 		if (IS_ERR(iter))
+ 			ret = PTR_ERR(iter);
+ 	} else {
+@@ -4529,13 +4660,16 @@ static int tracing_snapshot_open(struct inode *inode, struct file *file)
+ 			kfree(m);
+ 			return -ENOMEM;
+ 		}
+-		iter->tr = tc->tr;
++		iter->tr = tr;
+ 		iter->trace_buffer = &tc->tr->max_buffer;
+ 		iter->cpu_file = tc->cpu;
+ 		m->private = iter;
+ 		file->private_data = m;
+ 	}
+ 
++	if (ret < 0)
++		trace_array_put(tr);
++
+ 	return ret;
+ }
+ 
+@@ -4616,9 +4750,12 @@ out:
+ static int tracing_snapshot_release(struct inode *inode, struct file *file)
+ {
+ 	struct seq_file *m = file->private_data;
++	int ret;
++
++	ret = tracing_release(inode, file);
+ 
+ 	if (file->f_mode & FMODE_READ)
+-		return tracing_release(inode, file);
++		return ret;
+ 
+ 	/* If write only, the seq_file is just a stub */
+ 	if (m)
+@@ -4684,34 +4821,38 @@ static const struct file_operations tracing_pipe_fops = {
+ };
+ 
+ static const struct file_operations tracing_entries_fops = {
+-	.open		= tracing_open_generic,
++	.open		= tracing_open_generic_tc,
+ 	.read		= tracing_entries_read,
+ 	.write		= tracing_entries_write,
+ 	.llseek		= generic_file_llseek,
++	.release	= tracing_release_generic_tc,
+ };
+ 
+ static const struct file_operations tracing_total_entries_fops = {
+-	.open		= tracing_open_generic,
++	.open		= tracing_open_generic_tr,
+ 	.read		= tracing_total_entries_read,
+ 	.llseek		= generic_file_llseek,
++	.release	= tracing_release_generic_tr,
+ };
+ 
+ static const struct file_operations tracing_free_buffer_fops = {
++	.open		= tracing_open_generic_tr,
+ 	.write		= tracing_free_buffer_write,
+ 	.release	= tracing_free_buffer_release,
+ };
+ 
+ static const struct file_operations tracing_mark_fops = {
+-	.open		= tracing_open_generic,
++	.open		= tracing_open_generic_tr,
+ 	.write		= tracing_mark_write,
+ 	.llseek		= generic_file_llseek,
++	.release	= tracing_release_generic_tr,
+ };
+ 
+ static const struct file_operations trace_clock_fops = {
+ 	.open		= tracing_clock_open,
+ 	.read		= seq_read,
+ 	.llseek		= seq_lseek,
+-	.release	= single_release,
++	.release	= tracing_single_release_tr,
+ 	.write		= tracing_clock_write,
+ };
+ 
+@@ -4739,13 +4880,19 @@ static int tracing_buffers_open(struct inode *inode, struct file *filp)
+ 	struct trace_cpu *tc = inode->i_private;
+ 	struct trace_array *tr = tc->tr;
+ 	struct ftrace_buffer_info *info;
++	int ret;
+ 
+ 	if (tracing_disabled)
+ 		return -ENODEV;
+ 
++	if (trace_array_get(tr) < 0)
++		return -ENODEV;
++
+ 	info = kzalloc(sizeof(*info), GFP_KERNEL);
+-	if (!info)
++	if (!info) {
++		trace_array_put(tr);
+ 		return -ENOMEM;
++	}
+ 
+ 	mutex_lock(&trace_types_lock);
+ 
+@@ -4763,7 +4910,11 @@ static int tracing_buffers_open(struct inode *inode, struct file *filp)
+ 
+ 	mutex_unlock(&trace_types_lock);
+ 
+-	return nonseekable_open(inode, filp);
++	ret = nonseekable_open(inode, filp);
++	if (ret < 0)
++		trace_array_put(tr);
++
++	return ret;
+ }
+ 
+ static unsigned int
+@@ -4863,8 +5014,7 @@ static int tracing_buffers_release(struct inode *inode, struct file *file)
+ 
+ 	mutex_lock(&trace_types_lock);
+ 
+-	WARN_ON(!iter->tr->ref);
+-	iter->tr->ref--;
++	__trace_array_put(iter->tr);
+ 
+ 	if (info->spare)
+ 		ring_buffer_free_read_page(iter->trace_buffer->buffer, info->spare);
+@@ -5659,9 +5809,10 @@ rb_simple_write(struct file *filp, const char __user *ubuf,
+ }
+ 
+ static const struct file_operations rb_simple_fops = {
+-	.open		= tracing_open_generic,
++	.open		= tracing_open_generic_tr,
+ 	.read		= rb_simple_read,
+ 	.write		= rb_simple_write,
++	.release	= tracing_release_generic_tr,
+ 	.llseek		= default_llseek,
+ };
+ 
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index 20572ed8..51b44483 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -224,6 +224,11 @@ enum {
+ 
+ extern struct list_head ftrace_trace_arrays;
+ 
++extern struct mutex trace_types_lock;
++
++extern int trace_array_get(struct trace_array *tr);
++extern void trace_array_put(struct trace_array *tr);
++
+ /*
+  * The global tracer (top) should be the first trace array added,
+  * but we check the flag anyway.
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 27963e2b..6dfd48b5 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -41,6 +41,23 @@ static LIST_HEAD(ftrace_common_fields);
+ static struct kmem_cache *field_cachep;
+ static struct kmem_cache *file_cachep;
+ 
++#define SYSTEM_FL_FREE_NAME		(1 << 31)
++
++static inline int system_refcount(struct event_subsystem *system)
++{
++	return system->ref_count & ~SYSTEM_FL_FREE_NAME;
++}
++
++static int system_refcount_inc(struct event_subsystem *system)
++{
++	return (system->ref_count++) & ~SYSTEM_FL_FREE_NAME;
++}
++
++static int system_refcount_dec(struct event_subsystem *system)
++{
++	return (--system->ref_count) & ~SYSTEM_FL_FREE_NAME;
++}
++
+ /* Double loops, do not use break, only goto's work */
+ #define do_for_each_event_file(tr, file)			\
+ 	list_for_each_entry(tr, &ftrace_trace_arrays, list) {	\
+@@ -349,8 +366,8 @@ static void __put_system(struct event_subsystem *system)
+ {
+ 	struct event_filter *filter = system->filter;
+ 
+-	WARN_ON_ONCE(system->ref_count == 0);
+-	if (--system->ref_count)
++	WARN_ON_ONCE(system_refcount(system) == 0);
++	if (system_refcount_dec(system))
+ 		return;
+ 
+ 	list_del(&system->list);
+@@ -359,13 +376,15 @@ static void __put_system(struct event_subsystem *system)
+ 		kfree(filter->filter_string);
+ 		kfree(filter);
+ 	}
++	if (system->ref_count & SYSTEM_FL_FREE_NAME)
++		kfree(system->name);
+ 	kfree(system);
+ }
+ 
+ static void __get_system(struct event_subsystem *system)
+ {
+-	WARN_ON_ONCE(system->ref_count == 0);
+-	system->ref_count++;
++	WARN_ON_ONCE(system_refcount(system) == 0);
++	system_refcount_inc(system);
+ }
+ 
+ static void __get_system_dir(struct ftrace_subsystem_dir *dir)
+@@ -379,7 +398,7 @@ static void __put_system_dir(struct ftrace_subsystem_dir *dir)
+ {
+ 	WARN_ON_ONCE(dir->ref_count == 0);
+ 	/* If the subsystem is about to be freed, the dir must be too */
+-	WARN_ON_ONCE(dir->subsystem->ref_count == 1 && dir->ref_count != 1);
++	WARN_ON_ONCE(system_refcount(dir->subsystem) == 1 && dir->ref_count != 1);
+ 
+ 	__put_system(dir->subsystem);
+ 	if (!--dir->ref_count)
+@@ -394,16 +413,45 @@ static void put_system(struct ftrace_subsystem_dir *dir)
+ }
+ 
+ /*
++ * Open and update trace_array ref count.
++ * Must have the current trace_array passed to it.
++ */
++static int tracing_open_generic_file(struct inode *inode, struct file *filp)
++{
++	struct ftrace_event_file *file = inode->i_private;
++	struct trace_array *tr = file->tr;
++	int ret;
++
++	if (trace_array_get(tr) < 0)
++		return -ENODEV;
++
++	ret = tracing_open_generic(inode, filp);
++	if (ret < 0)
++		trace_array_put(tr);
++	return ret;
++}
++
++static int tracing_release_generic_file(struct inode *inode, struct file *filp)
++{
++	struct ftrace_event_file *file = inode->i_private;
++	struct trace_array *tr = file->tr;
++
++	trace_array_put(tr);
++
++	return 0;
++}
++
++/*
+  * __ftrace_set_clr_event(NULL, NULL, NULL, set) will set/unset all events.
+  */
+-static int __ftrace_set_clr_event(struct trace_array *tr, const char *match,
+-				  const char *sub, const char *event, int set)
++static int
++__ftrace_set_clr_event_nolock(struct trace_array *tr, const char *match,
++			      const char *sub, const char *event, int set)
+ {
+ 	struct ftrace_event_file *file;
+ 	struct ftrace_event_call *call;
+ 	int ret = -EINVAL;
+ 
+-	mutex_lock(&event_mutex);
+ 	list_for_each_entry(file, &tr->events, list) {
+ 
+ 		call = file->event_call;
+@@ -429,6 +477,17 @@ static int __ftrace_set_clr_event(struct trace_array *tr, const char *match,
+ 
+ 		ret = 0;
+ 	}
++
++	return ret;
++}
++
++static int __ftrace_set_clr_event(struct trace_array *tr, const char *match,
++				  const char *sub, const char *event, int set)
++{
++	int ret;
++
++	mutex_lock(&event_mutex);
++	ret = __ftrace_set_clr_event_nolock(tr, match, sub, event, set);
+ 	mutex_unlock(&event_mutex);
+ 
+ 	return ret;
+@@ -992,6 +1051,7 @@ static int subsystem_open(struct inode *inode, struct file *filp)
+ 	int ret;
+ 
+ 	/* Make sure the system still exists */
++	mutex_lock(&trace_types_lock);
+ 	mutex_lock(&event_mutex);
+ 	list_for_each_entry(tr, &ftrace_trace_arrays, list) {
+ 		list_for_each_entry(dir, &tr->systems, list) {
+@@ -1007,6 +1067,7 @@ static int subsystem_open(struct inode *inode, struct file *filp)
+ 	}
+  exit_loop:
+ 	mutex_unlock(&event_mutex);
++	mutex_unlock(&trace_types_lock);
+ 
+ 	if (!system)
+ 		return -ENODEV;
+@@ -1014,9 +1075,17 @@ static int subsystem_open(struct inode *inode, struct file *filp)
+ 	/* Some versions of gcc think dir can be uninitialized here */
+ 	WARN_ON(!dir);
+ 
++	/* Still need to increment the ref count of the system */
++	if (trace_array_get(tr) < 0) {
++		put_system(dir);
++		return -ENODEV;
++	}
++
+ 	ret = tracing_open_generic(inode, filp);
+-	if (ret < 0)
++	if (ret < 0) {
++		trace_array_put(tr);
+ 		put_system(dir);
++	}
+ 
+ 	return ret;
+ }
+@@ -1027,16 +1096,23 @@ static int system_tr_open(struct inode *inode, struct file *filp)
+ 	struct trace_array *tr = inode->i_private;
+ 	int ret;
+ 
++	if (trace_array_get(tr) < 0)
++		return -ENODEV;
++
+ 	/* Make a temporary dir that has no system but points to tr */
+ 	dir = kzalloc(sizeof(*dir), GFP_KERNEL);
+-	if (!dir)
++	if (!dir) {
++		trace_array_put(tr);
+ 		return -ENOMEM;
++	}
+ 
+ 	dir->tr = tr;
+ 
+ 	ret = tracing_open_generic(inode, filp);
+-	if (ret < 0)
++	if (ret < 0) {
++		trace_array_put(tr);
+ 		kfree(dir);
++	}
+ 
+ 	filp->private_data = dir;
+ 
+@@ -1047,6 +1123,8 @@ static int subsystem_release(struct inode *inode, struct file *file)
+ {
+ 	struct ftrace_subsystem_dir *dir = file->private_data;
+ 
++	trace_array_put(dir->tr);
++
+ 	/*
+ 	 * If dir->subsystem is NULL, then this is a temporary
+ 	 * descriptor that was made for a trace_array to enable
+@@ -1174,9 +1252,10 @@ static const struct file_operations ftrace_set_event_fops = {
+ };
+ 
+ static const struct file_operations ftrace_enable_fops = {
+-	.open = tracing_open_generic,
++	.open = tracing_open_generic_file,
+ 	.read = event_enable_read,
+ 	.write = event_enable_write,
++	.release = tracing_release_generic_file,
+ 	.llseek = default_llseek,
+ };
+ 
+@@ -1279,7 +1358,15 @@ create_new_subsystem(const char *name)
+ 		return NULL;
+ 
+ 	system->ref_count = 1;
+-	system->name = name;
++
++	/* Only allocate if dynamic (kprobes and modules) */
++	if (!core_kernel_data((unsigned long)name)) {
++		system->ref_count |= SYSTEM_FL_FREE_NAME;
++		system->name = kstrdup(name, GFP_KERNEL);
++		if (!system->name)
++			goto out_free;
++	} else
++		system->name = name;
+ 
+ 	system->filter = NULL;
+ 
+@@ -1292,6 +1379,8 @@ create_new_subsystem(const char *name)
+ 	return system;
+ 
+  out_free:
++	if (system->ref_count & SYSTEM_FL_FREE_NAME)
++		kfree(system->name);
+ 	kfree(system);
+ 	return NULL;
+ }
+@@ -1591,6 +1680,7 @@ static void __add_event_to_tracers(struct ftrace_event_call *call,
+ int trace_add_event_call(struct ftrace_event_call *call)
+ {
+ 	int ret;
++	mutex_lock(&trace_types_lock);
+ 	mutex_lock(&event_mutex);
+ 
+ 	ret = __register_event(call, NULL);
+@@ -1598,11 +1688,13 @@ int trace_add_event_call(struct ftrace_event_call *call)
+ 		__add_event_to_tracers(call, NULL);
+ 
+ 	mutex_unlock(&event_mutex);
++	mutex_unlock(&trace_types_lock);
+ 	return ret;
+ }
+ 
+ /*
+- * Must be called under locking both of event_mutex and trace_event_sem.
++ * Must be called under locking of trace_types_lock, event_mutex and
++ * trace_event_sem.
+  */
+ static void __trace_remove_event_call(struct ftrace_event_call *call)
+ {
+@@ -1614,11 +1706,13 @@ static void __trace_remove_event_call(struct ftrace_event_call *call)
+ /* Remove an event_call */
+ void trace_remove_event_call(struct ftrace_event_call *call)
+ {
++	mutex_lock(&trace_types_lock);
+ 	mutex_lock(&event_mutex);
+ 	down_write(&trace_event_sem);
+ 	__trace_remove_event_call(call);
+ 	up_write(&trace_event_sem);
+ 	mutex_unlock(&event_mutex);
++	mutex_unlock(&trace_types_lock);
+ }
+ 
+ #define for_each_event(event, start, end)			\
+@@ -1762,6 +1856,7 @@ static int trace_module_notify(struct notifier_block *self,
+ {
+ 	struct module *mod = data;
+ 
++	mutex_lock(&trace_types_lock);
+ 	mutex_lock(&event_mutex);
+ 	switch (val) {
+ 	case MODULE_STATE_COMING:
+@@ -1772,6 +1867,7 @@ static int trace_module_notify(struct notifier_block *self,
+ 		break;
+ 	}
+ 	mutex_unlock(&event_mutex);
++	mutex_unlock(&trace_types_lock);
+ 
+ 	return 0;
+ }
+@@ -2329,11 +2425,11 @@ early_event_add_tracer(struct dentry *parent, struct trace_array *tr)
+ 
+ int event_trace_del_tracer(struct trace_array *tr)
+ {
+-	/* Disable any running events */
+-	__ftrace_set_clr_event(tr, NULL, NULL, NULL, 0);
+-
+ 	mutex_lock(&event_mutex);
+ 
++	/* Disable any running events */
++	__ftrace_set_clr_event_nolock(tr, NULL, NULL, NULL, 0);
++
+ 	down_write(&trace_event_sem);
+ 	__trace_remove_event_dirs(tr);
+ 	debugfs_remove_recursive(tr->event_dir);
+diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
+index 8f2ac73c..322e1646 100644
+--- a/kernel/trace/trace_syscalls.c
++++ b/kernel/trace/trace_syscalls.c
+@@ -306,6 +306,8 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
+ 	struct syscall_metadata *sys_data;
+ 	struct ring_buffer_event *event;
+ 	struct ring_buffer *buffer;
++	unsigned long irq_flags;
++	int pc;
+ 	int syscall_nr;
+ 	int size;
+ 
+@@ -321,9 +323,12 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
+ 
+ 	size = sizeof(*entry) + sizeof(unsigned long) * sys_data->nb_args;
+ 
++	local_save_flags(irq_flags);
++	pc = preempt_count();
++
+ 	buffer = tr->trace_buffer.buffer;
+ 	event = trace_buffer_lock_reserve(buffer,
+-			sys_data->enter_event->event.type, size, 0, 0);
++			sys_data->enter_event->event.type, size, irq_flags, pc);
+ 	if (!event)
+ 		return;
+ 
+@@ -333,7 +338,8 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
+ 
+ 	if (!filter_current_check_discard(buffer, sys_data->enter_event,
+ 					  entry, event))
+-		trace_current_buffer_unlock_commit(buffer, event, 0, 0);
++		trace_current_buffer_unlock_commit(buffer, event,
++						   irq_flags, pc);
+ }
+ 
+ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)
+@@ -343,6 +349,8 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)
+ 	struct syscall_metadata *sys_data;
+ 	struct ring_buffer_event *event;
+ 	struct ring_buffer *buffer;
++	unsigned long irq_flags;
++	int pc;
+ 	int syscall_nr;
+ 
+ 	syscall_nr = trace_get_syscall_nr(current, regs);
+@@ -355,9 +363,13 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)
+ 	if (!sys_data)
+ 		return;
+ 
++	local_save_flags(irq_flags);
++	pc = preempt_count();
++
+ 	buffer = tr->trace_buffer.buffer;
+ 	event = trace_buffer_lock_reserve(buffer,
+-			sys_data->exit_event->event.type, sizeof(*entry), 0, 0);
++			sys_data->exit_event->event.type, sizeof(*entry),
++			irq_flags, pc);
+ 	if (!event)
+ 		return;
+ 
+@@ -367,7 +379,8 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)
+ 
+ 	if (!filter_current_check_discard(buffer, sys_data->exit_event,
+ 					  entry, event))
+-		trace_current_buffer_unlock_commit(buffer, event, 0, 0);
++		trace_current_buffer_unlock_commit(buffer, event,
++						   irq_flags, pc);
+ }
+ 
+ static int reg_event_syscall_enter(struct ftrace_event_file *file,
+diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
+index 32494fb0..d5d0cd36 100644
+--- a/kernel/trace/trace_uprobe.c
++++ b/kernel/trace/trace_uprobe.c
+@@ -283,8 +283,10 @@ static int create_trace_uprobe(int argc, char **argv)
+ 		return -EINVAL;
+ 	}
+ 	arg = strchr(argv[1], ':');
+-	if (!arg)
++	if (!arg) {
++		ret = -EINVAL;
+ 		goto fail_address_parse;
++	}
+ 
+ 	*arg++ = '\0';
+ 	filename = argv[1];
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 98d20c0f..514e90f4 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1726,6 +1726,15 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
+ 		if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+ 			dev_close(sdata->dev);
+ 
++	/*
++	 * Close all AP_VLAN interfaces first, as otherwise they
++	 * might be closed while the AP interface they belong to
++	 * is closed, causing unregister_netdevice_many() to crash.
++	 */
++	list_for_each_entry(sdata, &local->interfaces, list)
++		if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
++			dev_close(sdata->dev);
++
+ 	mutex_lock(&local->iflist_mtx);
+ 	list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
+ 		list_del(&sdata->list);
+diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
+index 06bdf5a1..1583c8a4 100644
+--- a/net/sunrpc/svcauth_unix.c
++++ b/net/sunrpc/svcauth_unix.c
+@@ -493,8 +493,6 @@ static int unix_gid_parse(struct cache_detail *cd,
+ 	if (rv)
+ 		return -EINVAL;
+ 	uid = make_kuid(&init_user_ns, id);
+-	if (!uid_valid(uid))
+-		return -EINVAL;
+ 	ug.uid = uid;
+ 
+ 	expiry = get_expiry(&mesg);
+diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
+index 0f679df7..305374d4 100644
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -917,7 +917,10 @@ static void svc_tcp_clear_pages(struct svc_sock *svsk)
+ 	len = svsk->sk_datalen;
+ 	npages = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ 	for (i = 0; i < npages; i++) {
+-		BUG_ON(svsk->sk_pages[i] == NULL);
++		if (svsk->sk_pages[i] == NULL) {
++			WARN_ON_ONCE(1);
++			continue;
++		}
+ 		put_page(svsk->sk_pages[i]);
+ 		svsk->sk_pages[i] = NULL;
+ 	}
+@@ -1092,8 +1095,10 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
+ 		goto err_noclose;
+ 	}
+ 
+-	if (svc_sock_reclen(svsk) < 8)
++	if (svsk->sk_datalen < 8) {
++		svsk->sk_datalen = 0;
+ 		goto err_delete; /* client is nuts. */
++	}
+ 
+ 	rqstp->rq_arg.len = svsk->sk_datalen;
+ 	rqstp->rq_arg.page_base = 0;
+diff --git a/sound/arm/pxa2xx-pcm-lib.c b/sound/arm/pxa2xx-pcm-lib.c
+index 76e0d569..823359ed 100644
+--- a/sound/arm/pxa2xx-pcm-lib.c
++++ b/sound/arm/pxa2xx-pcm-lib.c
+@@ -166,7 +166,9 @@ void pxa2xx_pcm_dma_irq(int dma_ch, void *dev_id)
+ 	} else {
+ 		printk(KERN_ERR "%s: DMA error on channel %d (DCSR=%#x)\n",
+ 			rtd->params->name, dma_ch, dcsr);
++		snd_pcm_stream_lock(substream);
+ 		snd_pcm_stop(substream, SNDRV_PCM_STATE_XRUN);
++		snd_pcm_stream_unlock(substream);
+ 	}
+ }
+ EXPORT_SYMBOL(pxa2xx_pcm_dma_irq);
+diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c
+index e3cb46fe..b3f39b5e 100644
+--- a/sound/core/seq/oss/seq_oss_init.c
++++ b/sound/core/seq/oss/seq_oss_init.c
+@@ -31,6 +31,7 @@
+ #include <linux/export.h>
+ #include <linux/moduleparam.h>
+ #include <linux/slab.h>
++#include <linux/workqueue.h>
+ 
+ /*
+  * common variables
+@@ -60,6 +61,14 @@ static void free_devinfo(void *private);
+ #define call_ctl(type,rec) snd_seq_kernel_client_ctl(system_client, type, rec)
+ 
+ 
++/* call snd_seq_oss_midi_lookup_ports() asynchronously */
++static void async_call_lookup_ports(struct work_struct *work)
++{
++	snd_seq_oss_midi_lookup_ports(system_client);
++}
++
++static DECLARE_WORK(async_lookup_work, async_call_lookup_ports);
++
+ /*
+  * create sequencer client for OSS sequencer
+  */
+@@ -85,9 +94,6 @@ snd_seq_oss_create_client(void)
+ 	system_client = rc;
+ 	debug_printk(("new client = %d\n", rc));
+ 
+-	/* look up midi devices */
+-	snd_seq_oss_midi_lookup_ports(system_client);
+-
+ 	/* create annoucement receiver port */
+ 	memset(port, 0, sizeof(*port));
+ 	strcpy(port->name, "Receiver");
+@@ -115,6 +121,9 @@ snd_seq_oss_create_client(void)
+ 	}
+ 	rc = 0;
+ 
++	/* look up midi devices */
++	schedule_work(&async_lookup_work);
++
+  __error:
+ 	kfree(port);
+ 	return rc;
+@@ -160,6 +169,7 @@ receive_announce(struct snd_seq_event *ev, int direct, void *private, int atomic
+ int
+ snd_seq_oss_delete_client(void)
+ {
++	cancel_work_sync(&async_lookup_work);
+ 	if (system_client >= 0)
+ 		snd_seq_delete_kernel_client(system_client);
+ 
+diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c
+index 677dc845..862d8489 100644
+--- a/sound/core/seq/oss/seq_oss_midi.c
++++ b/sound/core/seq/oss/seq_oss_midi.c
+@@ -72,7 +72,7 @@ static int send_midi_event(struct seq_oss_devinfo *dp, struct snd_seq_event *ev,
+  * look up the existing ports
+  * this looks a very exhausting job.
+  */
+-int __init
++int
+ snd_seq_oss_midi_lookup_ports(int client)
+ {
+ 	struct snd_seq_client_info *clinfo;
+diff --git a/sound/pci/asihpi/asihpi.c b/sound/pci/asihpi/asihpi.c
+index fbc17203..a471d821 100644
+--- a/sound/pci/asihpi/asihpi.c
++++ b/sound/pci/asihpi/asihpi.c
+@@ -769,7 +769,10 @@ static void snd_card_asihpi_timer_function(unsigned long data)
+ 						s->number);
+ 				ds->drained_count++;
+ 				if (ds->drained_count > 20) {
++					unsigned long flags;
++					snd_pcm_stream_lock_irqsave(s, flags);
+ 					snd_pcm_stop(s, SNDRV_PCM_STATE_XRUN);
++					snd_pcm_stream_unlock_irqrestore(s, flags);
+ 					continue;
+ 				}
+ 			} else {
+diff --git a/sound/pci/atiixp.c b/sound/pci/atiixp.c
+index 6e78c678..819430ac 100644
+--- a/sound/pci/atiixp.c
++++ b/sound/pci/atiixp.c
+@@ -689,7 +689,9 @@ static void snd_atiixp_xrun_dma(struct atiixp *chip, struct atiixp_dma *dma)
+ 	if (! dma->substream || ! dma->running)
+ 		return;
+ 	snd_printdd("atiixp: XRUN detected (DMA %d)\n", dma->ops->type);
++	snd_pcm_stream_lock(dma->substream);
+ 	snd_pcm_stop(dma->substream, SNDRV_PCM_STATE_XRUN);
++	snd_pcm_stream_unlock(dma->substream);
+ }
+ 
+ /*
+diff --git a/sound/pci/atiixp_modem.c b/sound/pci/atiixp_modem.c
+index d0bec7ba..57f41820 100644
+--- a/sound/pci/atiixp_modem.c
++++ b/sound/pci/atiixp_modem.c
+@@ -638,7 +638,9 @@ static void snd_atiixp_xrun_dma(struct atiixp_modem *chip,
+ 	if (! dma->substream || ! dma->running)
+ 		return;
+ 	snd_printdd("atiixp-modem: XRUN detected (DMA %d)\n", dma->ops->type);
++	snd_pcm_stream_lock(dma->substream);
+ 	snd_pcm_stop(dma->substream, SNDRV_PCM_STATE_XRUN);
++	snd_pcm_stream_unlock(dma->substream);
+ }
+ 
+ /*
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 4b1524a8..24400cff 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -840,7 +840,7 @@ static int add_control_with_pfx(struct hda_gen_spec *spec, int type,
+ 				const char *pfx, const char *dir,
+ 				const char *sfx, int cidx, unsigned long val)
+ {
+-	char name[32];
++	char name[44];
+ 	snprintf(name, sizeof(name), "%s %s %s", pfx, dir, sfx);
+ 	if (!add_control(spec, type, name, cidx, val))
+ 		return -ENOMEM;
+diff --git a/sound/pci/hda/hda_local.h b/sound/pci/hda/hda_local.h
+index e0bf7534..2e7493ef 100644
+--- a/sound/pci/hda/hda_local.h
++++ b/sound/pci/hda/hda_local.h
+@@ -562,6 +562,14 @@ static inline unsigned int get_wcaps_channels(u32 wcaps)
+ 	return chans;
+ }
+ 
++static inline void snd_hda_override_wcaps(struct hda_codec *codec,
++					  hda_nid_t nid, u32 val)
++{
++	if (nid >= codec->start_nid &&
++	    nid < codec->start_nid + codec->num_nodes)
++		codec->wcaps[nid - codec->start_nid] = val;
++}
++
+ u32 query_amp_caps(struct hda_codec *codec, hda_nid_t nid, int direction);
+ int snd_hda_override_amp_caps(struct hda_codec *codec, hda_nid_t nid, int dir,
+ 			      unsigned int caps);
+@@ -667,7 +675,7 @@ snd_hda_check_power_state(struct hda_codec *codec, hda_nid_t nid,
+ 	if (state & AC_PWRST_ERROR)
+ 		return true;
+ 	state = (state >> 4) & 0x0f;
+-	return (state != target_state);
++	return (state == target_state);
+ }
+ 
+ unsigned int snd_hda_codec_eapd_power_filter(struct hda_codec *codec,
+diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
+index 977b0d87..d97f0d61 100644
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -2112,6 +2112,9 @@ static void ad_vmaster_eapd_hook(void *private_data, int enabled)
+ {
+ 	struct hda_codec *codec = private_data;
+ 	struct ad198x_spec *spec = codec->spec;
++
++	if (!spec->eapd_nid)
++		return;
+ 	snd_hda_codec_update_cache(codec, spec->eapd_nid, 0,
+ 				   AC_VERB_SET_EAPD_BTLENABLE,
+ 				   enabled ? 0x02 : 0x00);
+@@ -3601,13 +3604,16 @@ static void ad1884_fixup_hp_eapd(struct hda_codec *codec,
+ {
+ 	struct ad198x_spec *spec = codec->spec;
+ 
+-	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++	switch (action) {
++	case HDA_FIXUP_ACT_PRE_PROBE:
++		spec->gen.vmaster_mute.hook = ad_vmaster_eapd_hook;
++		break;
++	case HDA_FIXUP_ACT_PROBE:
+ 		if (spec->gen.autocfg.line_out_type == AUTO_PIN_SPEAKER_OUT)
+ 			spec->eapd_nid = spec->gen.autocfg.line_out_pins[0];
+ 		else
+ 			spec->eapd_nid = spec->gen.autocfg.speaker_pins[0];
+-		if (spec->eapd_nid)
+-			spec->gen.vmaster_mute.hook = ad_vmaster_eapd_hook;
++		break;
+ 	}
+ }
+ 
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index e12f7a03..496d7f21 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1146,7 +1146,7 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo,
+ 	per_cvt->assigned = 1;
+ 	hinfo->nid = per_cvt->cvt_nid;
+ 
+-	snd_hda_codec_write(codec, per_pin->pin_nid, 0,
++	snd_hda_codec_write_cache(codec, per_pin->pin_nid, 0,
+ 			    AC_VERB_SET_CONNECT_SEL,
+ 			    mux_idx);
+ 	snd_hda_spdif_ctls_assign(codec, pin_idx, per_cvt->cvt_nid);
+@@ -2536,6 +2536,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
+ { .id = 0x10de0043, .name = "GPU 43 HDMI/DP",	.patch = patch_generic_hdmi },
+ { .id = 0x10de0044, .name = "GPU 44 HDMI/DP",	.patch = patch_generic_hdmi },
+ { .id = 0x10de0051, .name = "GPU 51 HDMI/DP",	.patch = patch_generic_hdmi },
++{ .id = 0x10de0060, .name = "GPU 60 HDMI/DP",	.patch = patch_generic_hdmi },
+ { .id = 0x10de0067, .name = "MCP67 HDMI",	.patch = patch_nvhdmi_2ch },
+ { .id = 0x10de8001, .name = "MCP73 HDMI",	.patch = patch_nvhdmi_2ch },
+ { .id = 0x11069f80, .name = "VX900 HDMI/DP",	.patch = patch_via_hdmi },
+@@ -2588,6 +2589,7 @@ MODULE_ALIAS("snd-hda-codec-id:10de0042");
+ MODULE_ALIAS("snd-hda-codec-id:10de0043");
+ MODULE_ALIAS("snd-hda-codec-id:10de0044");
+ MODULE_ALIAS("snd-hda-codec-id:10de0051");
++MODULE_ALIAS("snd-hda-codec-id:10de0060");
+ MODULE_ALIAS("snd-hda-codec-id:10de0067");
+ MODULE_ALIAS("snd-hda-codec-id:10de8001");
+ MODULE_ALIAS("snd-hda-codec-id:11069f80");
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index e5245544..aed19c3f 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -910,6 +910,8 @@ static const struct hda_verb vt1708S_init_verbs[] = {
+ static void override_mic_boost(struct hda_codec *codec, hda_nid_t pin,
+ 			       int offset, int num_steps, int step_size)
+ {
++	snd_hda_override_wcaps(codec, pin,
++			       get_wcaps(codec, pin) | AC_WCAP_IN_AMP);
+ 	snd_hda_override_amp_caps(codec, pin, HDA_INPUT,
+ 				  (offset << AC_AMPCAP_OFFSET_SHIFT) |
+ 				  (num_steps << AC_AMPCAP_NUM_STEPS_SHIFT) |
+diff --git a/sound/soc/atmel/atmel-pcm-dma.c b/sound/soc/atmel/atmel-pcm-dma.c
+index 1d38fd0b..d1282652 100644
+--- a/sound/soc/atmel/atmel-pcm-dma.c
++++ b/sound/soc/atmel/atmel-pcm-dma.c
+@@ -81,7 +81,9 @@ static void atmel_pcm_dma_irq(u32 ssc_sr,
+ 
+ 		/* stop RX and capture: will be enabled again at restart */
+ 		ssc_writex(prtd->ssc->regs, SSC_CR, prtd->mask->ssc_disable);
++		snd_pcm_stream_lock(substream);
+ 		snd_pcm_stop(substream, SNDRV_PCM_STATE_XRUN);
++		snd_pcm_stream_unlock(substream);
+ 
+ 		/* now drain RHR and read status to remove xrun condition */
+ 		ssc_readx(prtd->ssc->regs, SSC_RHR);
+diff --git a/sound/soc/codecs/sgtl5000.h b/sound/soc/codecs/sgtl5000.h
+index 8a9f4353..d3a68bbf 100644
+--- a/sound/soc/codecs/sgtl5000.h
++++ b/sound/soc/codecs/sgtl5000.h
+@@ -347,7 +347,7 @@
+ #define SGTL5000_PLL_INT_DIV_MASK		0xf800
+ #define SGTL5000_PLL_INT_DIV_SHIFT		11
+ #define SGTL5000_PLL_INT_DIV_WIDTH		5
+-#define SGTL5000_PLL_FRAC_DIV_MASK		0x0700
++#define SGTL5000_PLL_FRAC_DIV_MASK		0x07ff
+ #define SGTL5000_PLL_FRAC_DIV_SHIFT		0
+ #define SGTL5000_PLL_FRAC_DIV_WIDTH		11
+ 
+diff --git a/sound/soc/s6000/s6000-pcm.c b/sound/soc/s6000/s6000-pcm.c
+index 1358c7de..d0740a76 100644
+--- a/sound/soc/s6000/s6000-pcm.c
++++ b/sound/soc/s6000/s6000-pcm.c
+@@ -128,7 +128,9 @@ static irqreturn_t s6000_pcm_irq(int irq, void *data)
+ 		    substream->runtime &&
+ 		    snd_pcm_running(substream)) {
+ 			dev_dbg(pcm->dev, "xrun\n");
++			snd_pcm_stream_lock(substream);
+ 			snd_pcm_stop(substream, SNDRV_PCM_STATE_XRUN);
++			snd_pcm_stream_unlock(substream);
+ 			ret = IRQ_HANDLED;
+ 		}
+ 
+diff --git a/sound/usb/6fire/pcm.c b/sound/usb/6fire/pcm.c
+index 40dd50a8..8221ff2f 100644
+--- a/sound/usb/6fire/pcm.c
++++ b/sound/usb/6fire/pcm.c
+@@ -641,17 +641,25 @@ int usb6fire_pcm_init(struct sfire_chip *chip)
+ void usb6fire_pcm_abort(struct sfire_chip *chip)
+ {
+ 	struct pcm_runtime *rt = chip->pcm;
++	unsigned long flags;
+ 	int i;
+ 
+ 	if (rt) {
+ 		rt->panic = true;
+ 
+-		if (rt->playback.instance)
++		if (rt->playback.instance) {
++			snd_pcm_stream_lock_irqsave(rt->playback.instance, flags);
+ 			snd_pcm_stop(rt->playback.instance,
+ 					SNDRV_PCM_STATE_XRUN);
+-		if (rt->capture.instance)
++			snd_pcm_stream_unlock_irqrestore(rt->playback.instance, flags);
++		}
++
++		if (rt->capture.instance) {
++			snd_pcm_stream_lock_irqsave(rt->capture.instance, flags);
+ 			snd_pcm_stop(rt->capture.instance,
+ 					SNDRV_PCM_STATE_XRUN);
++			snd_pcm_stream_unlock_irqrestore(rt->capture.instance, flags);
++		}
+ 
+ 		for (i = 0; i < PCM_N_URBS; i++) {
+ 			usb_poison_urb(&rt->in_urbs[i].instance);
+diff --git a/sound/usb/misc/ua101.c b/sound/usb/misc/ua101.c
+index 6ad617b9..76d83290 100644
+--- a/sound/usb/misc/ua101.c
++++ b/sound/usb/misc/ua101.c
+@@ -613,14 +613,24 @@ static int start_usb_playback(struct ua101 *ua)
+ 
+ static void abort_alsa_capture(struct ua101 *ua)
+ {
+-	if (test_bit(ALSA_CAPTURE_RUNNING, &ua->states))
++	unsigned long flags;
++
++	if (test_bit(ALSA_CAPTURE_RUNNING, &ua->states)) {
++		snd_pcm_stream_lock_irqsave(ua->capture.substream, flags);
+ 		snd_pcm_stop(ua->capture.substream, SNDRV_PCM_STATE_XRUN);
++		snd_pcm_stream_unlock_irqrestore(ua->capture.substream, flags);
++	}
+ }
+ 
+ static void abort_alsa_playback(struct ua101 *ua)
+ {
+-	if (test_bit(ALSA_PLAYBACK_RUNNING, &ua->states))
++	unsigned long flags;
++
++	if (test_bit(ALSA_PLAYBACK_RUNNING, &ua->states)) {
++		snd_pcm_stream_lock_irqsave(ua->playback.substream, flags);
+ 		snd_pcm_stop(ua->playback.substream, SNDRV_PCM_STATE_XRUN);
++		snd_pcm_stream_unlock_irqrestore(ua->playback.substream, flags);
++	}
+ }
+ 
+ static int set_stream_hw(struct ua101 *ua, struct snd_pcm_substream *substream,
+diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
+index b3765324..0ce90337 100644
+--- a/sound/usb/usx2y/usbusx2yaudio.c
++++ b/sound/usb/usx2y/usbusx2yaudio.c
+@@ -273,7 +273,11 @@ static void usX2Y_clients_stop(struct usX2Ydev *usX2Y)
+ 		struct snd_usX2Y_substream *subs = usX2Y->subs[s];
+ 		if (subs) {
+ 			if (atomic_read(&subs->state) >= state_PRERUNNING) {
++				unsigned long flags;
++
++				snd_pcm_stream_lock_irqsave(subs->pcm_substream, flags);
+ 				snd_pcm_stop(subs->pcm_substream, SNDRV_PCM_STATE_XRUN);
++				snd_pcm_stream_unlock_irqrestore(subs->pcm_substream, flags);
+ 			}
+ 			for (u = 0; u < NRURBS; u++) {
+ 				struct urb *urb = subs->urb[u];

Added: genpatches-2.6/trunk/3.10.7/1003_linux-3.10.4.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/1003_linux-3.10.4.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/1003_linux-3.10.4.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,3086 @@
+diff --git a/Makefile b/Makefile
+index b548552..b4df9b2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 3
++SUBLEVEL = 4
+ EXTRAVERSION =
+ NAME = Unicycling Gorilla
+ 
+diff --git a/arch/arm/mach-footbridge/dc21285.c b/arch/arm/mach-footbridge/dc21285.c
+index a7cd2cf..3490a24 100644
+--- a/arch/arm/mach-footbridge/dc21285.c
++++ b/arch/arm/mach-footbridge/dc21285.c
+@@ -276,8 +276,6 @@ int __init dc21285_setup(int nr, struct pci_sys_data *sys)
+ 
+ 	sys->mem_offset  = DC21285_PCI_MEM;
+ 
+-	pci_ioremap_io(0, DC21285_PCI_IO);
+-
+ 	pci_add_resource_offset(&sys->resources, &res[0], sys->mem_offset);
+ 	pci_add_resource_offset(&sys->resources, &res[1], sys->mem_offset);
+ 
+diff --git a/arch/arm/mach-s3c24xx/clock-s3c2410.c b/arch/arm/mach-s3c24xx/clock-s3c2410.c
+index 34fffdf..5645536 100644
+--- a/arch/arm/mach-s3c24xx/clock-s3c2410.c
++++ b/arch/arm/mach-s3c24xx/clock-s3c2410.c
+@@ -119,66 +119,101 @@ static struct clk init_clocks_off[] = {
+ 	}
+ };
+ 
+-static struct clk init_clocks[] = {
+-	{
+-		.name		= "lcd",
+-		.parent		= &clk_h,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_LCDC,
+-	}, {
+-		.name		= "gpio",
+-		.parent		= &clk_p,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_GPIO,
+-	}, {
+-		.name		= "usb-host",
+-		.parent		= &clk_h,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_USBH,
+-	}, {
+-		.name		= "usb-device",
+-		.parent		= &clk_h,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_USBD,
+-	}, {
+-		.name		= "timers",
+-		.parent		= &clk_p,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_PWMT,
+-	}, {
+-		.name		= "uart",
+-		.devname	= "s3c2410-uart.0",
+-		.parent		= &clk_p,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_UART0,
+-	}, {
+-		.name		= "uart",
+-		.devname	= "s3c2410-uart.1",
+-		.parent		= &clk_p,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_UART1,
+-	}, {
+-		.name		= "uart",
+-		.devname	= "s3c2410-uart.2",
+-		.parent		= &clk_p,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_UART2,
+-	}, {
+-		.name		= "rtc",
+-		.parent		= &clk_p,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_RTC,
+-	}, {
+-		.name		= "watchdog",
+-		.parent		= &clk_p,
+-		.ctrlbit	= 0,
+-	}, {
+-		.name		= "usb-bus-host",
+-		.parent		= &clk_usb_bus,
+-	}, {
+-		.name		= "usb-bus-gadget",
+-		.parent		= &clk_usb_bus,
+-	},
++static struct clk clk_lcd = {
++	.name		= "lcd",
++	.parent		= &clk_h,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_LCDC,
++};
++
++static struct clk clk_gpio = {
++	.name		= "gpio",
++	.parent		= &clk_p,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_GPIO,
++};
++
++static struct clk clk_usb_host = {
++	.name		= "usb-host",
++	.parent		= &clk_h,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_USBH,
++};
++
++static struct clk clk_usb_device = {
++	.name		= "usb-device",
++	.parent		= &clk_h,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_USBD,
++};
++
++static struct clk clk_timers = {
++	.name		= "timers",
++	.parent		= &clk_p,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_PWMT,
++};
++
++struct clk s3c24xx_clk_uart0 = {
++	.name		= "uart",
++	.devname	= "s3c2410-uart.0",
++	.parent		= &clk_p,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_UART0,
++};
++
++struct clk s3c24xx_clk_uart1 = {
++	.name		= "uart",
++	.devname	= "s3c2410-uart.1",
++	.parent		= &clk_p,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_UART1,
++};
++
++struct clk s3c24xx_clk_uart2 = {
++	.name		= "uart",
++	.devname	= "s3c2410-uart.2",
++	.parent		= &clk_p,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_UART2,
++};
++
++static struct clk clk_rtc = {
++	.name		= "rtc",
++	.parent		= &clk_p,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_RTC,
++};
++
++static struct clk clk_watchdog = {
++	.name		= "watchdog",
++	.parent		= &clk_p,
++	.ctrlbit	= 0,
++};
++
++static struct clk clk_usb_bus_host = {
++	.name		= "usb-bus-host",
++	.parent		= &clk_usb_bus,
++};
++
++static struct clk clk_usb_bus_gadget = {
++	.name		= "usb-bus-gadget",
++	.parent		= &clk_usb_bus,
++};
++
++static struct clk *init_clocks[] = {
++	&clk_lcd,
++	&clk_gpio,
++	&clk_usb_host,
++	&clk_usb_device,
++	&clk_timers,
++	&s3c24xx_clk_uart0,
++	&s3c24xx_clk_uart1,
++	&s3c24xx_clk_uart2,
++	&clk_rtc,
++	&clk_watchdog,
++	&clk_usb_bus_host,
++	&clk_usb_bus_gadget,
+ };
+ 
+ /* s3c2410_baseclk_add()
+@@ -195,7 +230,6 @@ int __init s3c2410_baseclk_add(void)
+ {
+ 	unsigned long clkslow = __raw_readl(S3C2410_CLKSLOW);
+ 	unsigned long clkcon  = __raw_readl(S3C2410_CLKCON);
+-	struct clk *clkp;
+ 	struct clk *xtal;
+ 	int ret;
+ 	int ptr;
+@@ -207,8 +241,9 @@ int __init s3c2410_baseclk_add(void)
+ 
+ 	/* register clocks from clock array */
+ 
+-	clkp = init_clocks;
+-	for (ptr = 0; ptr < ARRAY_SIZE(init_clocks); ptr++, clkp++) {
++	for (ptr = 0; ptr < ARRAY_SIZE(init_clocks); ptr++) {
++		struct clk *clkp = init_clocks[ptr];
++
+ 		/* ensure that we note the clock state */
+ 
+ 		clkp->usage = clkcon & clkp->ctrlbit ? 1 : 0;
+diff --git a/arch/arm/mach-s3c24xx/clock-s3c2440.c b/arch/arm/mach-s3c24xx/clock-s3c2440.c
+index 1069b56..aaf006d 100644
+--- a/arch/arm/mach-s3c24xx/clock-s3c2440.c
++++ b/arch/arm/mach-s3c24xx/clock-s3c2440.c
+@@ -166,6 +166,9 @@ static struct clk_lookup s3c2440_clk_lookup[] = {
+ 	CLKDEV_INIT(NULL, "clk_uart_baud1", &s3c24xx_uclk),
+ 	CLKDEV_INIT(NULL, "clk_uart_baud2", &clk_p),
+ 	CLKDEV_INIT(NULL, "clk_uart_baud3", &s3c2440_clk_fclk_n),
++	CLKDEV_INIT("s3c2440-uart.0", "uart", &s3c24xx_clk_uart0),
++	CLKDEV_INIT("s3c2440-uart.1", "uart", &s3c24xx_clk_uart1),
++	CLKDEV_INIT("s3c2440-uart.2", "uart", &s3c24xx_clk_uart2),
+ 	CLKDEV_INIT("s3c2440-camif", "camera", &s3c2440_clk_cam_upll),
+ };
+ 
+diff --git a/arch/arm/plat-samsung/include/plat/clock.h b/arch/arm/plat-samsung/include/plat/clock.h
+index a62753d..df45d6e 100644
+--- a/arch/arm/plat-samsung/include/plat/clock.h
++++ b/arch/arm/plat-samsung/include/plat/clock.h
+@@ -83,6 +83,11 @@ extern struct clk clk_ext;
+ extern struct clksrc_clk clk_epllref;
+ extern struct clksrc_clk clk_esysclk;
+ 
++/* S3C24XX UART clocks */
++extern struct clk s3c24xx_clk_uart0;
++extern struct clk s3c24xx_clk_uart1;
++extern struct clk s3c24xx_clk_uart2;
++
+ /* S3C64XX specific clocks */
+ extern struct clk clk_h2;
+ extern struct clk clk_27m;
+diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c
+index 1e1e18c..2a75ff2 100644
+--- a/arch/mips/cavium-octeon/setup.c
++++ b/arch/mips/cavium-octeon/setup.c
+@@ -7,6 +7,7 @@
+  * Copyright (C) 2008, 2009 Wind River Systems
+  *   written by Ralf Baechle <ralf@××××××××××.org>
+  */
++#include <linux/compiler.h>
+ #include <linux/init.h>
+ #include <linux/kernel.h>
+ #include <linux/console.h>
+@@ -712,7 +713,7 @@ void __init prom_init(void)
+ 	if (cvmx_read_csr(CVMX_L2D_FUS3) & (3ull << 34)) {
+ 		pr_info("Skipping L2 locking due to reduced L2 cache size\n");
+ 	} else {
+-		uint32_t ebase = read_c0_ebase() & 0x3ffff000;
++		uint32_t __maybe_unused ebase = read_c0_ebase() & 0x3ffff000;
+ #ifdef CONFIG_CAVIUM_OCTEON_LOCK_L2_TLB
+ 		/* TLB refill */
+ 		cvmx_l2c_lock_mem_region(ebase, 0x100);
+diff --git a/arch/sparc/kernel/asm-offsets.c b/arch/sparc/kernel/asm-offsets.c
+index 961b87f..f76389a 100644
+--- a/arch/sparc/kernel/asm-offsets.c
++++ b/arch/sparc/kernel/asm-offsets.c
+@@ -49,6 +49,8 @@ int foo(void)
+ 	DEFINE(AOFF_task_thread, offsetof(struct task_struct, thread));
+ 	BLANK();
+ 	DEFINE(AOFF_mm_context, offsetof(struct mm_struct, context));
++	BLANK();
++	DEFINE(VMA_VM_MM,    offsetof(struct vm_area_struct, vm_mm));
+ 
+ 	/* DEFINE(NUM_USER_SEGMENTS, TASK_SIZE>>28); */
+ 	return 0;
+diff --git a/arch/sparc/mm/hypersparc.S b/arch/sparc/mm/hypersparc.S
+index 44aad32..969f964 100644
+--- a/arch/sparc/mm/hypersparc.S
++++ b/arch/sparc/mm/hypersparc.S
+@@ -74,7 +74,7 @@ hypersparc_flush_cache_mm_out:
+ 
+ 	/* The things we do for performance... */
+ hypersparc_flush_cache_range:
+-	ld	[%o0 + 0x0], %o0		/* XXX vma->vm_mm, GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ #ifndef CONFIG_SMP
+ 	ld	[%o0 + AOFF_mm_context], %g1
+ 	cmp	%g1, -1
+@@ -163,7 +163,7 @@ hypersparc_flush_cache_range_out:
+ 	 */
+ 	/* Verified, my ass... */
+ hypersparc_flush_cache_page:
+-	ld	[%o0 + 0x0], %o0		/* XXX vma->vm_mm, GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	ld	[%o0 + AOFF_mm_context], %g2
+ #ifndef CONFIG_SMP
+ 	cmp	%g2, -1
+@@ -284,7 +284,7 @@ hypersparc_flush_tlb_mm_out:
+ 	 sta	%g5, [%g1] ASI_M_MMUREGS
+ 
+ hypersparc_flush_tlb_range:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	mov	SRMMU_CTX_REG, %g1
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	lda	[%g1] ASI_M_MMUREGS, %g5
+@@ -307,7 +307,7 @@ hypersparc_flush_tlb_range_out:
+ 	 sta	%g5, [%g1] ASI_M_MMUREGS
+ 
+ hypersparc_flush_tlb_page:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	mov	SRMMU_CTX_REG, %g1
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	andn	%o1, (PAGE_SIZE - 1), %o1
+diff --git a/arch/sparc/mm/swift.S b/arch/sparc/mm/swift.S
+index c801c39..5d2b88d 100644
+--- a/arch/sparc/mm/swift.S
++++ b/arch/sparc/mm/swift.S
+@@ -105,7 +105,7 @@ swift_flush_cache_mm_out:
+ 
+ 	.globl	swift_flush_cache_range
+ swift_flush_cache_range:
+-	ld	[%o0 + 0x0], %o0		/* XXX vma->vm_mm, GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	sub	%o2, %o1, %o2
+ 	sethi	%hi(4096), %o3
+ 	cmp	%o2, %o3
+@@ -116,7 +116,7 @@ swift_flush_cache_range:
+ 
+ 	.globl	swift_flush_cache_page
+ swift_flush_cache_page:
+-	ld	[%o0 + 0x0], %o0		/* XXX vma->vm_mm, GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 70:
+ 	ld	[%o0 + AOFF_mm_context], %g2
+ 	cmp	%g2, -1
+@@ -219,7 +219,7 @@ swift_flush_sig_insns:
+ 	.globl	swift_flush_tlb_range
+ 	.globl	swift_flush_tlb_all
+ swift_flush_tlb_range:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ swift_flush_tlb_mm:
+ 	ld	[%o0 + AOFF_mm_context], %g2
+ 	cmp	%g2, -1
+@@ -233,7 +233,7 @@ swift_flush_tlb_all_out:
+ 
+ 	.globl	swift_flush_tlb_page
+ swift_flush_tlb_page:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	mov	SRMMU_CTX_REG, %g1
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	andn	%o1, (PAGE_SIZE - 1), %o1
+diff --git a/arch/sparc/mm/tsunami.S b/arch/sparc/mm/tsunami.S
+index 4e55e8f..bf10a34 100644
+--- a/arch/sparc/mm/tsunami.S
++++ b/arch/sparc/mm/tsunami.S
+@@ -24,7 +24,7 @@
+ 	/* Sliiick... */
+ tsunami_flush_cache_page:
+ tsunami_flush_cache_range:
+-	ld	[%o0 + 0x0], %o0	/* XXX vma->vm_mm, GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ tsunami_flush_cache_mm:
+ 	ld	[%o0 + AOFF_mm_context], %g2
+ 	cmp	%g2, -1
+@@ -46,7 +46,7 @@ tsunami_flush_sig_insns:
+ 
+ 	/* More slick stuff... */
+ tsunami_flush_tlb_range:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ tsunami_flush_tlb_mm:
+ 	ld	[%o0 + AOFF_mm_context], %g2
+ 	cmp	%g2, -1
+@@ -65,7 +65,7 @@ tsunami_flush_tlb_out:
+ 
+ 	/* This one can be done in a fine grained manner... */
+ tsunami_flush_tlb_page:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	mov	SRMMU_CTX_REG, %g1
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	andn	%o1, (PAGE_SIZE - 1), %o1
+diff --git a/arch/sparc/mm/viking.S b/arch/sparc/mm/viking.S
+index bf8ee06..852257f 100644
+--- a/arch/sparc/mm/viking.S
++++ b/arch/sparc/mm/viking.S
+@@ -108,7 +108,7 @@ viking_mxcc_flush_page:
+ viking_flush_cache_page:
+ viking_flush_cache_range:
+ #ifndef CONFIG_SMP
+-	ld	[%o0 + 0x0], %o0		/* XXX vma->vm_mm, GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ #endif
+ viking_flush_cache_mm:
+ #ifndef CONFIG_SMP
+@@ -148,7 +148,7 @@ viking_flush_tlb_mm:
+ #endif
+ 
+ viking_flush_tlb_range:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	mov	SRMMU_CTX_REG, %g1
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	lda	[%g1] ASI_M_MMUREGS, %g5
+@@ -173,7 +173,7 @@ viking_flush_tlb_range:
+ #endif
+ 
+ viking_flush_tlb_page:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	mov	SRMMU_CTX_REG, %g1
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	lda	[%g1] ASI_M_MMUREGS, %g5
+@@ -239,7 +239,7 @@ sun4dsmp_flush_tlb_range:
+ 	tst	%g5
+ 	bne	3f
+ 	 mov	SRMMU_CTX_REG, %g1
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	lda	[%g1] ASI_M_MMUREGS, %g5
+ 	sethi	%hi(~((1 << SRMMU_PGDIR_SHIFT) - 1)), %o4
+@@ -265,7 +265,7 @@ sun4dsmp_flush_tlb_page:
+ 	tst	%g5
+ 	bne	2f
+ 	 mov	SRMMU_CTX_REG, %g1
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	lda	[%g1] ASI_M_MMUREGS, %g5
+ 	and	%o1, PAGE_MASK, %o1
+diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
+index 27e86d9..89e1090 100644
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -48,6 +48,8 @@ static LIST_HEAD(mc_devices);
+  */
+ static void const *edac_mc_owner;
+ 
++static struct bus_type mc_bus[EDAC_MAX_MCS];
++
+ unsigned edac_dimm_info_location(struct dimm_info *dimm, char *buf,
+ 			         unsigned len)
+ {
+@@ -723,6 +725,11 @@ int edac_mc_add_mc(struct mem_ctl_info *mci)
+ 	int ret = -EINVAL;
+ 	edac_dbg(0, "\n");
+ 
++	if (mci->mc_idx >= EDAC_MAX_MCS) {
++		pr_warn_once("Too many memory controllers: %d\n", mci->mc_idx);
++		return -ENODEV;
++	}
++
+ #ifdef CONFIG_EDAC_DEBUG
+ 	if (edac_debug_level >= 3)
+ 		edac_mc_dump_mci(mci);
+@@ -762,6 +769,8 @@ int edac_mc_add_mc(struct mem_ctl_info *mci)
+ 	/* set load time so that error rate can be tracked */
+ 	mci->start_time = jiffies;
+ 
++	mci->bus = &mc_bus[mci->mc_idx];
++
+ 	if (edac_create_sysfs_mci_device(mci)) {
+ 		edac_mc_printk(mci, KERN_WARNING,
+ 			"failed to create sysfs device\n");
+diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
+index 67610a6..c4d700a 100644
+--- a/drivers/edac/edac_mc_sysfs.c
++++ b/drivers/edac/edac_mc_sysfs.c
+@@ -370,7 +370,7 @@ static int edac_create_csrow_object(struct mem_ctl_info *mci,
+ 		return -ENODEV;
+ 
+ 	csrow->dev.type = &csrow_attr_type;
+-	csrow->dev.bus = &mci->bus;
++	csrow->dev.bus = mci->bus;
+ 	device_initialize(&csrow->dev);
+ 	csrow->dev.parent = &mci->dev;
+ 	csrow->mci = mci;
+@@ -605,7 +605,7 @@ static int edac_create_dimm_object(struct mem_ctl_info *mci,
+ 	dimm->mci = mci;
+ 
+ 	dimm->dev.type = &dimm_attr_type;
+-	dimm->dev.bus = &mci->bus;
++	dimm->dev.bus = mci->bus;
+ 	device_initialize(&dimm->dev);
+ 
+ 	dimm->dev.parent = &mci->dev;
+@@ -975,11 +975,13 @@ int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
+ 	 * The memory controller needs its own bus, in order to avoid
+ 	 * namespace conflicts at /sys/bus/edac.
+ 	 */
+-	mci->bus.name = kasprintf(GFP_KERNEL, "mc%d", mci->mc_idx);
+-	if (!mci->bus.name)
++	mci->bus->name = kasprintf(GFP_KERNEL, "mc%d", mci->mc_idx);
++	if (!mci->bus->name)
+ 		return -ENOMEM;
+-	edac_dbg(0, "creating bus %s\n", mci->bus.name);
+-	err = bus_register(&mci->bus);
++
++	edac_dbg(0, "creating bus %s\n", mci->bus->name);
++
++	err = bus_register(mci->bus);
+ 	if (err < 0)
+ 		return err;
+ 
+@@ -988,7 +990,7 @@ int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
+ 	device_initialize(&mci->dev);
+ 
+ 	mci->dev.parent = mci_pdev;
+-	mci->dev.bus = &mci->bus;
++	mci->dev.bus = mci->bus;
+ 	dev_set_name(&mci->dev, "mc%d", mci->mc_idx);
+ 	dev_set_drvdata(&mci->dev, mci);
+ 	pm_runtime_forbid(&mci->dev);
+@@ -997,8 +999,8 @@ int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
+ 	err = device_add(&mci->dev);
+ 	if (err < 0) {
+ 		edac_dbg(1, "failure: create device %s\n", dev_name(&mci->dev));
+-		bus_unregister(&mci->bus);
+-		kfree(mci->bus.name);
++		bus_unregister(mci->bus);
++		kfree(mci->bus->name);
+ 		return err;
+ 	}
+ 
+@@ -1064,8 +1066,8 @@ fail:
+ 	}
+ fail2:
+ 	device_unregister(&mci->dev);
+-	bus_unregister(&mci->bus);
+-	kfree(mci->bus.name);
++	bus_unregister(mci->bus);
++	kfree(mci->bus->name);
+ 	return err;
+ }
+ 
+@@ -1098,8 +1100,8 @@ void edac_unregister_sysfs(struct mem_ctl_info *mci)
+ {
+ 	edac_dbg(1, "Unregistering device %s\n", dev_name(&mci->dev));
+ 	device_unregister(&mci->dev);
+-	bus_unregister(&mci->bus);
+-	kfree(mci->bus.name);
++	bus_unregister(mci->bus);
++	kfree(mci->bus->name);
+ }
+ 
+ static void mc_attr_release(struct device *dev)
+diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
+index 1b63517..157b934 100644
+--- a/drivers/edac/i5100_edac.c
++++ b/drivers/edac/i5100_edac.c
+@@ -974,7 +974,7 @@ static int i5100_setup_debugfs(struct mem_ctl_info *mci)
+ 	if (!i5100_debugfs)
+ 		return -ENODEV;
+ 
+-	priv->debugfs = debugfs_create_dir(mci->bus.name, i5100_debugfs);
++	priv->debugfs = debugfs_create_dir(mci->bus->name, i5100_debugfs);
+ 
+ 	if (!priv->debugfs)
+ 		return -ENOMEM;
+diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
+index d3e15b4..c42b14b 100644
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -437,6 +437,7 @@ struct bcache_device {
+ 
+ 	/* If nonzero, we're detaching/unregistering from cache set */
+ 	atomic_t		detaching;
++	int			flush_done;
+ 
+ 	atomic_long_t		sectors_dirty;
+ 	unsigned long		sectors_dirty_gc;
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 7a5658f..7b687a6 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -1419,8 +1419,10 @@ static void btree_gc_start(struct cache_set *c)
+ 	for_each_cache(ca, c, i)
+ 		for_each_bucket(b, ca) {
+ 			b->gc_gen = b->gen;
+-			if (!atomic_read(&b->pin))
++			if (!atomic_read(&b->pin)) {
+ 				SET_GC_MARK(b, GC_MARK_RECLAIMABLE);
++				SET_GC_SECTORS_USED(b, 0);
++			}
+ 		}
+ 
+ 	for (d = c->devices;
+diff --git a/drivers/md/bcache/closure.c b/drivers/md/bcache/closure.c
+index bd05a9a..9aba201 100644
+--- a/drivers/md/bcache/closure.c
++++ b/drivers/md/bcache/closure.c
+@@ -66,16 +66,18 @@ static inline void closure_put_after_sub(struct closure *cl, int flags)
+ 		} else {
+ 			struct closure *parent = cl->parent;
+ 			struct closure_waitlist *wait = closure_waitlist(cl);
++			closure_fn *destructor = cl->fn;
+ 
+ 			closure_debug_destroy(cl);
+ 
++			smp_mb();
+ 			atomic_set(&cl->remaining, -1);
+ 
+ 			if (wait)
+ 				closure_wake_up(wait);
+ 
+-			if (cl->fn)
+-				cl->fn(cl);
++			if (destructor)
++				destructor(cl);
+ 
+ 			if (parent)
+ 				closure_put(parent);
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 8c8dfdc..8a54d3b 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -182,9 +182,14 @@ bsearch:
+ 		pr_debug("starting binary search, l %u r %u", l, r);
+ 
+ 		while (l + 1 < r) {
++			seq = list_entry(list->prev, struct journal_replay,
++					 list)->j.seq;
++
+ 			m = (l + r) >> 1;
++			read_bucket(m);
+ 
+-			if (read_bucket(m))
++			if (seq != list_entry(list->prev, struct journal_replay,
++					      list)->j.seq)
+ 				l = m;
+ 			else
+ 				r = m;
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index e5ff12e..2f36743 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -489,6 +489,12 @@ static void bch_insert_data_loop(struct closure *cl)
+ 		bch_queue_gc(op->c);
+ 	}
+ 
++	/*
++	 * Journal writes are marked REQ_FLUSH; if the original write was a
++	 * flush, it'll wait on the journal write.
++	 */
++	bio->bi_rw &= ~(REQ_FLUSH|REQ_FUA);
++
+ 	do {
+ 		unsigned i;
+ 		struct bkey *k;
+@@ -716,7 +722,7 @@ static struct search *search_alloc(struct bio *bio, struct bcache_device *d)
+ 	s->task			= current;
+ 	s->orig_bio		= bio;
+ 	s->write		= (bio->bi_rw & REQ_WRITE) != 0;
+-	s->op.flush_journal	= (bio->bi_rw & REQ_FLUSH) != 0;
++	s->op.flush_journal	= (bio->bi_rw & (REQ_FLUSH|REQ_FUA)) != 0;
+ 	s->op.skip		= (bio->bi_rw & REQ_DISCARD) != 0;
+ 	s->recoverable		= 1;
+ 	s->start_time		= jiffies;
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index f88e2b6..b4713ce 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -704,7 +704,8 @@ static void bcache_device_detach(struct bcache_device *d)
+ 		atomic_set(&d->detaching, 0);
+ 	}
+ 
+-	bcache_device_unlink(d);
++	if (!d->flush_done)
++		bcache_device_unlink(d);
+ 
+ 	d->c->devices[d->id] = NULL;
+ 	closure_put(&d->c->caching);
+@@ -781,6 +782,8 @@ static int bcache_device_init(struct bcache_device *d, unsigned block_size)
+ 	set_bit(QUEUE_FLAG_NONROT,	&d->disk->queue->queue_flags);
+ 	set_bit(QUEUE_FLAG_DISCARD,	&d->disk->queue->queue_flags);
+ 
++	blk_queue_flush(q, REQ_FLUSH|REQ_FUA);
++
+ 	return 0;
+ }
+ 
+@@ -1014,6 +1017,14 @@ static void cached_dev_flush(struct closure *cl)
+ 	struct cached_dev *dc = container_of(cl, struct cached_dev, disk.cl);
+ 	struct bcache_device *d = &dc->disk;
+ 
++	mutex_lock(&bch_register_lock);
++	d->flush_done = 1;
++
++	if (d->c)
++		bcache_device_unlink(d);
++
++	mutex_unlock(&bch_register_lock);
++
+ 	bch_cache_accounting_destroy(&dc->accounting);
+ 	kobject_del(&d->kobj);
+ 
+@@ -1303,18 +1314,22 @@ static void cache_set_flush(struct closure *cl)
+ static void __cache_set_unregister(struct closure *cl)
+ {
+ 	struct cache_set *c = container_of(cl, struct cache_set, caching);
+-	struct cached_dev *dc, *t;
++	struct cached_dev *dc;
+ 	size_t i;
+ 
+ 	mutex_lock(&bch_register_lock);
+ 
+-	if (test_bit(CACHE_SET_UNREGISTERING, &c->flags))
+-		list_for_each_entry_safe(dc, t, &c->cached_devs, list)
+-			bch_cached_dev_detach(dc);
+-
+ 	for (i = 0; i < c->nr_uuids; i++)
+-		if (c->devices[i] && UUID_FLASH_ONLY(&c->uuids[i]))
+-			bcache_device_stop(c->devices[i]);
++		if (c->devices[i]) {
++			if (!UUID_FLASH_ONLY(&c->uuids[i]) &&
++			    test_bit(CACHE_SET_UNREGISTERING, &c->flags)) {
++				dc = container_of(c->devices[i],
++						  struct cached_dev, disk);
++				bch_cached_dev_detach(dc);
++			} else {
++				bcache_device_stop(c->devices[i]);
++			}
++		}
+ 
+ 	mutex_unlock(&bch_register_lock);
+ 
+diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
+index a1a3a51..0b4616b 100644
+--- a/drivers/media/dvb-core/dmxdev.c
++++ b/drivers/media/dvb-core/dmxdev.c
+@@ -377,10 +377,8 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
+ 		ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer, buffer2,
+ 					      buffer2_len);
+ 	}
+-	if (ret < 0) {
+-		dvb_ringbuffer_flush(&dmxdevfilter->buffer);
++	if (ret < 0)
+ 		dmxdevfilter->buffer.error = ret;
+-	}
+ 	if (dmxdevfilter->params.sec.flags & DMX_ONESHOT)
+ 		dmxdevfilter->state = DMXDEV_STATE_DONE;
+ 	spin_unlock(&dmxdevfilter->dev->lock);
+@@ -416,10 +414,8 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
+ 	ret = dvb_dmxdev_buffer_write(buffer, buffer1, buffer1_len);
+ 	if (ret == buffer1_len)
+ 		ret = dvb_dmxdev_buffer_write(buffer, buffer2, buffer2_len);
+-	if (ret < 0) {
+-		dvb_ringbuffer_flush(buffer);
++	if (ret < 0)
+ 		buffer->error = ret;
+-	}
+ 	spin_unlock(&dmxdevfilter->dev->lock);
+ 	wake_up(&buffer->queue);
+ 	return 0;
+diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c
+index 10460fd..dbcdfbf 100644
+--- a/drivers/media/pci/saa7134/saa7134-alsa.c
++++ b/drivers/media/pci/saa7134/saa7134-alsa.c
+@@ -172,7 +172,9 @@ static void saa7134_irq_alsa_done(struct saa7134_dev *dev,
+ 		dprintk("irq: overrun [full=%d/%d] - Blocks in %d\n",dev->dmasound.read_count,
+ 			dev->dmasound.bufsize, dev->dmasound.blocks);
+ 		spin_unlock(&dev->slock);
++		snd_pcm_stream_lock(dev->dmasound.substream);
+ 		snd_pcm_stop(dev->dmasound.substream,SNDRV_PCM_STATE_XRUN);
++		snd_pcm_stream_unlock(dev->dmasound.substream);
+ 		return;
+ 	}
+ 
+diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
+index 42aa54a..b710c6b 100644
+--- a/drivers/net/dummy.c
++++ b/drivers/net/dummy.c
+@@ -185,6 +185,8 @@ static int __init dummy_init_module(void)
+ 
+ 	rtnl_lock();
+ 	err = __rtnl_link_register(&dummy_link_ops);
++	if (err < 0)
++		goto out;
+ 
+ 	for (i = 0; i < numdummies && !err; i++) {
+ 		err = dummy_init_one();
+@@ -192,6 +194,8 @@ static int __init dummy_init_module(void)
+ 	}
+ 	if (err < 0)
+ 		__rtnl_link_unregister(&dummy_link_ops);
++
++out:
+ 	rtnl_unlock();
+ 
+ 	return err;
+diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
+index 418de8b..d30085c 100644
+--- a/drivers/net/ethernet/atheros/alx/main.c
++++ b/drivers/net/ethernet/atheros/alx/main.c
+@@ -1303,6 +1303,8 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 
+ 	SET_NETDEV_DEV(netdev, &pdev->dev);
+ 	alx = netdev_priv(netdev);
++	spin_lock_init(&alx->hw.mdio_lock);
++	spin_lock_init(&alx->irq_lock);
+ 	alx->dev = netdev;
+ 	alx->hw.pdev = pdev;
+ 	alx->msg_enable = NETIF_MSG_LINK | NETIF_MSG_HW | NETIF_MSG_IFUP |
+@@ -1385,9 +1387,6 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 
+ 	INIT_WORK(&alx->link_check_wk, alx_link_check);
+ 	INIT_WORK(&alx->reset_wk, alx_reset);
+-	spin_lock_init(&alx->hw.mdio_lock);
+-	spin_lock_init(&alx->irq_lock);
+-
+ 	netif_carrier_off(netdev);
+ 
+ 	err = register_netdev(netdev);
+diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+index 0688bb8..c23bb02 100644
+--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+@@ -1665,8 +1665,8 @@ check_sum:
+ 	return 0;
+ }
+ 
+-static void atl1e_tx_map(struct atl1e_adapter *adapter,
+-		      struct sk_buff *skb, struct atl1e_tpd_desc *tpd)
++static int atl1e_tx_map(struct atl1e_adapter *adapter,
++			struct sk_buff *skb, struct atl1e_tpd_desc *tpd)
+ {
+ 	struct atl1e_tpd_desc *use_tpd = NULL;
+ 	struct atl1e_tx_buffer *tx_buffer = NULL;
+@@ -1677,6 +1677,8 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
+ 	u16 nr_frags;
+ 	u16 f;
+ 	int segment;
++	int ring_start = adapter->tx_ring.next_to_use;
++	int ring_end;
+ 
+ 	nr_frags = skb_shinfo(skb)->nr_frags;
+ 	segment = (tpd->word3 >> TPD_SEGMENT_EN_SHIFT) & TPD_SEGMENT_EN_MASK;
+@@ -1689,6 +1691,9 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
+ 		tx_buffer->length = map_len;
+ 		tx_buffer->dma = pci_map_single(adapter->pdev,
+ 					skb->data, hdr_len, PCI_DMA_TODEVICE);
++		if (dma_mapping_error(&adapter->pdev->dev, tx_buffer->dma))
++			return -ENOSPC;
++
+ 		ATL1E_SET_PCIMAP_TYPE(tx_buffer, ATL1E_TX_PCIMAP_SINGLE);
+ 		mapped_len += map_len;
+ 		use_tpd->buffer_addr = cpu_to_le64(tx_buffer->dma);
+@@ -1715,6 +1720,22 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
+ 		tx_buffer->dma =
+ 			pci_map_single(adapter->pdev, skb->data + mapped_len,
+ 					map_len, PCI_DMA_TODEVICE);
++
++		if (dma_mapping_error(&adapter->pdev->dev, tx_buffer->dma)) {
++			/* We need to unwind the mappings we've done */
++			ring_end = adapter->tx_ring.next_to_use;
++			adapter->tx_ring.next_to_use = ring_start;
++			while (adapter->tx_ring.next_to_use != ring_end) {
++				tpd = atl1e_get_tpd(adapter);
++				tx_buffer = atl1e_get_tx_buffer(adapter, tpd);
++				pci_unmap_single(adapter->pdev, tx_buffer->dma,
++						 tx_buffer->length, PCI_DMA_TODEVICE);
++			}
++			/* Reset the tx rings next pointer */
++			adapter->tx_ring.next_to_use = ring_start;
++			return -ENOSPC;
++		}
++
+ 		ATL1E_SET_PCIMAP_TYPE(tx_buffer, ATL1E_TX_PCIMAP_SINGLE);
+ 		mapped_len  += map_len;
+ 		use_tpd->buffer_addr = cpu_to_le64(tx_buffer->dma);
+@@ -1750,6 +1771,23 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
+ 							  (i * MAX_TX_BUF_LEN),
+ 							  tx_buffer->length,
+ 							  DMA_TO_DEVICE);
++
++			if (dma_mapping_error(&adapter->pdev->dev, tx_buffer->dma)) {
++				/* We need to unwind the mappings we've done */
++				ring_end = adapter->tx_ring.next_to_use;
++				adapter->tx_ring.next_to_use = ring_start;
++				while (adapter->tx_ring.next_to_use != ring_end) {
++					tpd = atl1e_get_tpd(adapter);
++					tx_buffer = atl1e_get_tx_buffer(adapter, tpd);
++					dma_unmap_page(&adapter->pdev->dev, tx_buffer->dma,
++						       tx_buffer->length, DMA_TO_DEVICE);
++				}
++
++				/* Reset the ring next to use pointer */
++				adapter->tx_ring.next_to_use = ring_start;
++				return -ENOSPC;
++			}
++
+ 			ATL1E_SET_PCIMAP_TYPE(tx_buffer, ATL1E_TX_PCIMAP_PAGE);
+ 			use_tpd->buffer_addr = cpu_to_le64(tx_buffer->dma);
+ 			use_tpd->word2 = (use_tpd->word2 & (~TPD_BUFLEN_MASK)) |
+@@ -1767,6 +1805,7 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
+ 	/* The last buffer info contain the skb address,
+ 	   so it will be free after unmap */
+ 	tx_buffer->skb = skb;
++	return 0;
+ }
+ 
+ static void atl1e_tx_queue(struct atl1e_adapter *adapter, u16 count,
+@@ -1834,10 +1873,15 @@ static netdev_tx_t atl1e_xmit_frame(struct sk_buff *skb,
+ 		return NETDEV_TX_OK;
+ 	}
+ 
+-	atl1e_tx_map(adapter, skb, tpd);
++	if (atl1e_tx_map(adapter, skb, tpd)) {
++		dev_kfree_skb_any(skb);
++		goto out;
++	}
++
+ 	atl1e_tx_queue(adapter, tpd_req, tpd);
+ 
+ 	netdev->trans_start = jiffies; /* NETIF_F_LLTX driver :( */
++out:
+ 	spin_unlock_irqrestore(&adapter->tx_lock, flags);
+ 	return NETDEV_TX_OK;
+ }
+diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
+index c89aa41..b4e0dc8 100644
+--- a/drivers/net/ethernet/cadence/macb.c
++++ b/drivers/net/ethernet/cadence/macb.c
+@@ -1070,7 +1070,7 @@ static void macb_configure_dma(struct macb *bp)
+ static void macb_configure_caps(struct macb *bp)
+ {
+ 	if (macb_is_gem(bp)) {
+-		if (GEM_BF(IRQCOR, gem_readl(bp, DCFG1)) == 0)
++		if (GEM_BFEXT(IRQCOR, gem_readl(bp, DCFG1)) == 0)
+ 			bp->caps |= MACB_CAPS_ISR_CLEAR_ON_WRITE;
+ 	}
+ }
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index a0b4be5..6e43426 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -782,16 +782,22 @@ static struct sk_buff *be_insert_vlan_in_pkt(struct be_adapter *adapter,
+ 
+ 	if (vlan_tx_tag_present(skb))
+ 		vlan_tag = be_get_tx_vlan_tag(adapter, skb);
+-	else if (qnq_async_evt_rcvd(adapter) && adapter->pvid)
+-		vlan_tag = adapter->pvid;
++
++	if (qnq_async_evt_rcvd(adapter) && adapter->pvid) {
++		if (!vlan_tag)
++			vlan_tag = adapter->pvid;
++		/* f/w workaround to set skip_hw_vlan = 1, informs the F/W to
++		 * skip VLAN insertion
++		 */
++		if (skip_hw_vlan)
++			*skip_hw_vlan = true;
++	}
+ 
+ 	if (vlan_tag) {
+ 		skb = __vlan_put_tag(skb, htons(ETH_P_8021Q), vlan_tag);
+ 		if (unlikely(!skb))
+ 			return skb;
+ 		skb->vlan_tci = 0;
+-		if (skip_hw_vlan)
+-			*skip_hw_vlan = true;
+ 	}
+ 
+ 	/* Insert the outer VLAN, if any */
+diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
+index a7dfe36..5173eaa 100644
+--- a/drivers/net/ethernet/sfc/rx.c
++++ b/drivers/net/ethernet/sfc/rx.c
+@@ -282,9 +282,9 @@ static void efx_fini_rx_buffer(struct efx_rx_queue *rx_queue,
+ }
+ 
+ /* Recycle the pages that are used by buffers that have just been received. */
+-static void efx_recycle_rx_buffers(struct efx_channel *channel,
+-				   struct efx_rx_buffer *rx_buf,
+-				   unsigned int n_frags)
++static void efx_recycle_rx_pages(struct efx_channel *channel,
++				 struct efx_rx_buffer *rx_buf,
++				 unsigned int n_frags)
+ {
+ 	struct efx_rx_queue *rx_queue = efx_channel_get_rx_queue(channel);
+ 
+@@ -294,6 +294,20 @@ static void efx_recycle_rx_buffers(struct efx_channel *channel,
+ 	} while (--n_frags);
+ }
+ 
++static void efx_discard_rx_packet(struct efx_channel *channel,
++				  struct efx_rx_buffer *rx_buf,
++				  unsigned int n_frags)
++{
++	struct efx_rx_queue *rx_queue = efx_channel_get_rx_queue(channel);
++
++	efx_recycle_rx_pages(channel, rx_buf, n_frags);
++
++	do {
++		efx_free_rx_buffer(rx_buf);
++		rx_buf = efx_rx_buf_next(rx_queue, rx_buf);
++	} while (--n_frags);
++}
++
+ /**
+  * efx_fast_push_rx_descriptors - push new RX descriptors quickly
+  * @rx_queue:		RX descriptor queue
+@@ -533,8 +547,7 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
+ 	 */
+ 	if (unlikely(rx_buf->flags & EFX_RX_PKT_DISCARD)) {
+ 		efx_rx_flush_packet(channel);
+-		put_page(rx_buf->page);
+-		efx_recycle_rx_buffers(channel, rx_buf, n_frags);
++		efx_discard_rx_packet(channel, rx_buf, n_frags);
+ 		return;
+ 	}
+ 
+@@ -570,9 +583,9 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
+ 		efx_sync_rx_buffer(efx, rx_buf, rx_buf->len);
+ 	}
+ 
+-	/* All fragments have been DMA-synced, so recycle buffers and pages. */
++	/* All fragments have been DMA-synced, so recycle pages. */
+ 	rx_buf = efx_rx_buffer(rx_queue, index);
+-	efx_recycle_rx_buffers(channel, rx_buf, n_frags);
++	efx_recycle_rx_pages(channel, rx_buf, n_frags);
+ 
+ 	/* Pipeline receives so that we give time for packet headers to be
+ 	 * prefetched into cache.
+diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
+index 1df0ff3..3df5684 100644
+--- a/drivers/net/ethernet/sun/sunvnet.c
++++ b/drivers/net/ethernet/sun/sunvnet.c
+@@ -1239,6 +1239,8 @@ static int vnet_port_remove(struct vio_dev *vdev)
+ 		dev_set_drvdata(&vdev->dev, NULL);
+ 
+ 		kfree(port);
++
++		unregister_netdev(vp->dev);
+ 	}
+ 	return 0;
+ }
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 4dccead..23a0fff 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -431,8 +431,8 @@ static int netvsc_probe(struct hv_device *dev,
+ 	net->netdev_ops = &device_ops;
+ 
+ 	/* TODO: Add GSO and Checksum offload */
+-	net->hw_features = NETIF_F_SG;
+-	net->features = NETIF_F_SG | NETIF_F_HW_VLAN_CTAG_TX;
++	net->hw_features = 0;
++	net->features = NETIF_F_HW_VLAN_CTAG_TX;
+ 
+ 	SET_ETHTOOL_OPS(net, &ethtool_ops);
+ 	SET_NETDEV_DEV(net, &dev->device);
+diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
+index dc9f6a4..a3bed28 100644
+--- a/drivers/net/ifb.c
++++ b/drivers/net/ifb.c
+@@ -291,11 +291,17 @@ static int __init ifb_init_module(void)
+ 
+ 	rtnl_lock();
+ 	err = __rtnl_link_register(&ifb_link_ops);
++	if (err < 0)
++		goto out;
+ 
+-	for (i = 0; i < numifbs && !err; i++)
++	for (i = 0; i < numifbs && !err; i++) {
+ 		err = ifb_init_one(i);
++		cond_resched();
++	}
+ 	if (err)
+ 		__rtnl_link_unregister(&ifb_link_ops);
++
++out:
+ 	rtnl_unlock();
+ 
+ 	return err;
+diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
+index b6dd6a7..523d6b2 100644
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -633,6 +633,28 @@ static int macvtap_skb_to_vnet_hdr(const struct sk_buff *skb,
+ 	return 0;
+ }
+ 
++static unsigned long iov_pages(const struct iovec *iv, int offset,
++			       unsigned long nr_segs)
++{
++	unsigned long seg, base;
++	int pages = 0, len, size;
++
++	while (nr_segs && (offset >= iv->iov_len)) {
++		offset -= iv->iov_len;
++		++iv;
++		--nr_segs;
++	}
++
++	for (seg = 0; seg < nr_segs; seg++) {
++		base = (unsigned long)iv[seg].iov_base + offset;
++		len = iv[seg].iov_len - offset;
++		size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
++		pages += size;
++		offset = 0;
++	}
++
++	return pages;
++}
+ 
+ /* Get packet from user space buffer */
+ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+@@ -647,6 +669,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+ 	int vnet_hdr_len = 0;
+ 	int copylen = 0;
+ 	bool zerocopy = false;
++	size_t linear;
+ 
+ 	if (q->flags & IFF_VNET_HDR) {
+ 		vnet_hdr_len = q->vnet_hdr_sz;
+@@ -678,42 +701,35 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+ 	if (unlikely(count > UIO_MAXIOV))
+ 		goto err;
+ 
+-	if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY))
+-		zerocopy = true;
++	if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY)) {
++		copylen = vnet_hdr.hdr_len ? vnet_hdr.hdr_len : GOODCOPY_LEN;
++		linear = copylen;
++		if (iov_pages(iv, vnet_hdr_len + copylen, count)
++		    <= MAX_SKB_FRAGS)
++			zerocopy = true;
++	}
+ 
+-	if (zerocopy) {
+-		/* Userspace may produce vectors with count greater than
+-		 * MAX_SKB_FRAGS, so we need to linearize parts of the skb
+-		 * to let the rest of data to be fit in the frags.
+-		 */
+-		if (count > MAX_SKB_FRAGS) {
+-			copylen = iov_length(iv, count - MAX_SKB_FRAGS);
+-			if (copylen < vnet_hdr_len)
+-				copylen = 0;
+-			else
+-				copylen -= vnet_hdr_len;
+-		}
+-		/* There are 256 bytes to be copied in skb, so there is enough
+-		 * room for skb expand head in case it is used.
+-		 * The rest buffer is mapped from userspace.
+-		 */
+-		if (copylen < vnet_hdr.hdr_len)
+-			copylen = vnet_hdr.hdr_len;
+-		if (!copylen)
+-			copylen = GOODCOPY_LEN;
+-	} else
++	if (!zerocopy) {
+ 		copylen = len;
++		linear = vnet_hdr.hdr_len;
++	}
+ 
+ 	skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen,
+-				vnet_hdr.hdr_len, noblock, &err);
++				linear, noblock, &err);
+ 	if (!skb)
+ 		goto err;
+ 
+ 	if (zerocopy)
+ 		err = zerocopy_sg_from_iovec(skb, iv, vnet_hdr_len, count);
+-	else
++	else {
+ 		err = skb_copy_datagram_from_iovec(skb, 0, iv, vnet_hdr_len,
+ 						   len);
++		if (!err && m && m->msg_control) {
++			struct ubuf_info *uarg = m->msg_control;
++			uarg->callback(uarg, false);
++		}
++	}
++
+ 	if (err)
+ 		goto err_kfree;
+ 
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 9c61f87..2491eb2 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1037,6 +1037,29 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
+ 	return 0;
+ }
+ 
++static unsigned long iov_pages(const struct iovec *iv, int offset,
++			       unsigned long nr_segs)
++{
++	unsigned long seg, base;
++	int pages = 0, len, size;
++
++	while (nr_segs && (offset >= iv->iov_len)) {
++		offset -= iv->iov_len;
++		++iv;
++		--nr_segs;
++	}
++
++	for (seg = 0; seg < nr_segs; seg++) {
++		base = (unsigned long)iv[seg].iov_base + offset;
++		len = iv[seg].iov_len - offset;
++		size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
++		pages += size;
++		offset = 0;
++	}
++
++	return pages;
++}
++
+ /* Get packet from user space buffer */
+ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ 			    void *msg_control, const struct iovec *iv,
+@@ -1044,7 +1067,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ {
+ 	struct tun_pi pi = { 0, cpu_to_be16(ETH_P_IP) };
+ 	struct sk_buff *skb;
+-	size_t len = total_len, align = NET_SKB_PAD;
++	size_t len = total_len, align = NET_SKB_PAD, linear;
+ 	struct virtio_net_hdr gso = { 0 };
+ 	int offset = 0;
+ 	int copylen;
+@@ -1084,34 +1107,23 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ 			return -EINVAL;
+ 	}
+ 
+-	if (msg_control)
+-		zerocopy = true;
+-
+-	if (zerocopy) {
+-		/* Userspace may produce vectors with count greater than
+-		 * MAX_SKB_FRAGS, so we need to linearize parts of the skb
+-		 * to let the rest of data to be fit in the frags.
+-		 */
+-		if (count > MAX_SKB_FRAGS) {
+-			copylen = iov_length(iv, count - MAX_SKB_FRAGS);
+-			if (copylen < offset)
+-				copylen = 0;
+-			else
+-				copylen -= offset;
+-		} else
+-				copylen = 0;
+-		/* There are 256 bytes to be copied in skb, so there is enough
+-		 * room for skb expand head in case it is used.
++	if (msg_control) {
++		/* There are 256 bytes to be copied in skb, so there is
++		 * enough room for skb expand head in case it is used.
+ 		 * The rest of the buffer is mapped from userspace.
+ 		 */
+-		if (copylen < gso.hdr_len)
+-			copylen = gso.hdr_len;
+-		if (!copylen)
+-			copylen = GOODCOPY_LEN;
+-	} else
++		copylen = gso.hdr_len ? gso.hdr_len : GOODCOPY_LEN;
++		linear = copylen;
++		if (iov_pages(iv, offset + copylen, count) <= MAX_SKB_FRAGS)
++			zerocopy = true;
++	}
++
++	if (!zerocopy) {
+ 		copylen = len;
++		linear = gso.hdr_len;
++	}
+ 
+-	skb = tun_alloc_skb(tfile, align, copylen, gso.hdr_len, noblock);
++	skb = tun_alloc_skb(tfile, align, copylen, linear, noblock);
+ 	if (IS_ERR(skb)) {
+ 		if (PTR_ERR(skb) != -EAGAIN)
+ 			tun->dev->stats.rx_dropped++;
+@@ -1120,8 +1132,13 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ 
+ 	if (zerocopy)
+ 		err = zerocopy_sg_from_iovec(skb, iv, offset, count);
+-	else
++	else {
+ 		err = skb_copy_datagram_from_iovec(skb, 0, iv, offset, len);
++		if (!err && msg_control) {
++			struct ubuf_info *uarg = msg_control;
++			uarg->callback(uarg, false);
++		}
++	}
+ 
+ 	if (err) {
+ 		tun->dev->stats.rx_dropped++;
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index c9e0038..42d670a 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -602,7 +602,7 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
+ 		container_of(napi, struct receive_queue, napi);
+ 	struct virtnet_info *vi = rq->vq->vdev->priv;
+ 	void *buf;
+-	unsigned int len, received = 0;
++	unsigned int r, len, received = 0;
+ 
+ again:
+ 	while (received < budget &&
+@@ -619,8 +619,9 @@ again:
+ 
+ 	/* Out of packets? */
+ 	if (received < budget) {
++		r = virtqueue_enable_cb_prepare(rq->vq);
+ 		napi_complete(napi);
+-		if (unlikely(!virtqueue_enable_cb(rq->vq)) &&
++		if (unlikely(virtqueue_poll(rq->vq, r)) &&
+ 		    napi_schedule_prep(napi)) {
+ 			virtqueue_disable_cb(rq->vq);
+ 			__napi_schedule(napi);
+diff --git a/drivers/rapidio/switches/idt_gen2.c b/drivers/rapidio/switches/idt_gen2.c
+index 809b7a3..5d3b0f0 100644
+--- a/drivers/rapidio/switches/idt_gen2.c
++++ b/drivers/rapidio/switches/idt_gen2.c
+@@ -15,6 +15,8 @@
+ #include <linux/rio_drv.h>
+ #include <linux/rio_ids.h>
+ #include <linux/delay.h>
++
++#include <asm/page.h>
+ #include "../rio.h"
+ 
+ #define LOCAL_RTE_CONF_DESTID_SEL	0x010070
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 3a9ddae..89178b8 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -4852,10 +4852,12 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
+ 				    sense, sense_handle);
+ 	}
+ 
+-	for (i = 0; i < ioc->sge_count && kbuff_arr[i]; i++) {
+-		dma_free_coherent(&instance->pdev->dev,
+-				    kern_sge32[i].length,
+-				    kbuff_arr[i], kern_sge32[i].phys_addr);
++	for (i = 0; i < ioc->sge_count; i++) {
++		if (kbuff_arr[i])
++			dma_free_coherent(&instance->pdev->dev,
++					  kern_sge32[i].length,
++					  kbuff_arr[i],
++					  kern_sge32[i].phys_addr);
+ 	}
+ 
+ 	megasas_return_cmd(instance, cmd);
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index dcbf7c8..f8c4b85 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -1273,6 +1273,7 @@ _scsih_slave_alloc(struct scsi_device *sdev)
+ 	struct MPT3SAS_DEVICE *sas_device_priv_data;
+ 	struct scsi_target *starget;
+ 	struct _raid_device *raid_device;
++	struct _sas_device *sas_device;
+ 	unsigned long flags;
+ 
+ 	sas_device_priv_data = kzalloc(sizeof(struct scsi_device), GFP_KERNEL);
+@@ -1301,6 +1302,19 @@ _scsih_slave_alloc(struct scsi_device *sdev)
+ 		spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
+ 	}
+ 
++	if (!(sas_target_priv_data->flags & MPT_TARGET_FLAGS_VOLUME)) {
++		spin_lock_irqsave(&ioc->sas_device_lock, flags);
++		sas_device = mpt3sas_scsih_sas_device_find_by_sas_address(ioc,
++					sas_target_priv_data->sas_address);
++		if (sas_device && (sas_device->starget == NULL)) {
++			sdev_printk(KERN_INFO, sdev,
++			"%s : sas_device->starget set to starget @ %d\n",
++				__func__, __LINE__);
++			sas_device->starget = starget;
++		}
++		spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -6392,7 +6406,7 @@ _scsih_search_responding_sas_devices(struct MPT3SAS_ADAPTER *ioc)
+ 	    handle))) {
+ 		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 		    MPI2_IOCSTATUS_MASK;
+-		if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
++		if (ioc_status != MPI2_IOCSTATUS_SUCCESS)
+ 			break;
+ 		handle = le16_to_cpu(sas_device_pg0.DevHandle);
+ 		device_info = le32_to_cpu(sas_device_pg0.DeviceInfo);
+@@ -6494,7 +6508,7 @@ _scsih_search_responding_raid_devices(struct MPT3SAS_ADAPTER *ioc)
+ 	    &volume_pg1, MPI2_RAID_VOLUME_PGAD_FORM_GET_NEXT_HANDLE, handle))) {
+ 		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 		    MPI2_IOCSTATUS_MASK;
+-		if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
++		if (ioc_status != MPI2_IOCSTATUS_SUCCESS)
+ 			break;
+ 		handle = le16_to_cpu(volume_pg1.DevHandle);
+ 
+@@ -6518,7 +6532,7 @@ _scsih_search_responding_raid_devices(struct MPT3SAS_ADAPTER *ioc)
+ 		    phys_disk_num))) {
+ 			ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 			    MPI2_IOCSTATUS_MASK;
+-			if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
++			if (ioc_status != MPI2_IOCSTATUS_SUCCESS)
+ 				break;
+ 			phys_disk_num = pd_pg0.PhysDiskNum;
+ 			handle = le16_to_cpu(pd_pg0.DevHandle);
+@@ -6597,7 +6611,7 @@ _scsih_search_responding_expanders(struct MPT3SAS_ADAPTER *ioc)
+ 
+ 		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 		    MPI2_IOCSTATUS_MASK;
+-		if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
++		if (ioc_status != MPI2_IOCSTATUS_SUCCESS)
+ 			break;
+ 
+ 		handle = le16_to_cpu(expander_pg0.DevHandle);
+@@ -6742,8 +6756,6 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc)
+ 	    MPI2_SAS_EXPAND_PGAD_FORM_GET_NEXT_HNDL, handle))) {
+ 		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 		    MPI2_IOCSTATUS_MASK;
+-		if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
+-			break;
+ 		if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+ 			pr_info(MPT3SAS_FMT "\tbreak from expander scan: " \
+ 			    "ioc_status(0x%04x), loginfo(0x%08x)\n",
+@@ -6787,8 +6799,6 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc)
+ 	    phys_disk_num))) {
+ 		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 		    MPI2_IOCSTATUS_MASK;
+-		if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
+-			break;
+ 		if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+ 			pr_info(MPT3SAS_FMT "\tbreak from phys disk scan: "\
+ 			    "ioc_status(0x%04x), loginfo(0x%08x)\n",
+@@ -6854,8 +6864,6 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc)
+ 	    &volume_pg1, MPI2_RAID_VOLUME_PGAD_FORM_GET_NEXT_HANDLE, handle))) {
+ 		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 		    MPI2_IOCSTATUS_MASK;
+-		if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
+-			break;
+ 		if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+ 			pr_info(MPT3SAS_FMT "\tbreak from volume scan: " \
+ 			    "ioc_status(0x%04x), loginfo(0x%08x)\n",
+@@ -6914,8 +6922,6 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc)
+ 	    handle))) {
+ 		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 		    MPI2_IOCSTATUS_MASK;
+-		if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
+-			break;
+ 		if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+ 			pr_info(MPT3SAS_FMT "\tbreak from end device scan:"\
+ 			    " ioc_status(0x%04x), loginfo(0x%08x)\n",
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 2c65955..c90d960 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -53,6 +53,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
+ 	{ USB_DEVICE(0x0489, 0xE003) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
+ 	{ USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */
++	{ USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
+ 	{ USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
+ 	{ USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
+ 	{ USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
+@@ -118,6 +119,8 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
+ 	{ USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
+ 	{ USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
++	{ USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
++	{ USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+ 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ 	{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ 	{ USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+@@ -148,6 +151,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
+ 	{ USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ 	{ USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
++	{ USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
+ 	{ USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
+ 	{ USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
+ 	{ USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 5dd857d..1cf6f12 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -341,17 +341,12 @@ static void option_instat_callback(struct urb *urb);
+ #define OLIVETTI_VENDOR_ID			0x0b3c
+ #define OLIVETTI_PRODUCT_OLICARD100		0xc000
+ #define OLIVETTI_PRODUCT_OLICARD145		0xc003
++#define OLIVETTI_PRODUCT_OLICARD200		0xc005
+ 
+ /* Celot products */
+ #define CELOT_VENDOR_ID				0x211f
+ #define CELOT_PRODUCT_CT680M			0x6801
+ 
+-/* ONDA Communication vendor id */
+-#define ONDA_VENDOR_ID       0x1ee8
+-
+-/* ONDA MT825UP HSDPA 14.2 modem */
+-#define ONDA_MT825UP         0x000b
+-
+ /* Samsung products */
+ #define SAMSUNG_VENDOR_ID                       0x04e8
+ #define SAMSUNG_PRODUCT_GT_B3730                0x6889
+@@ -444,7 +439,8 @@ static void option_instat_callback(struct urb *urb);
+ 
+ /* Hyundai Petatel Inc. products */
+ #define PETATEL_VENDOR_ID			0x1ff4
+-#define PETATEL_PRODUCT_NP10T			0x600e
++#define PETATEL_PRODUCT_NP10T_600A		0x600a
++#define PETATEL_PRODUCT_NP10T_600E		0x600e
+ 
+ /* TP-LINK Incorporated products */
+ #define TPLINK_VENDOR_ID			0x2357
+@@ -782,6 +778,7 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) },
+ 	{ USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
++	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
+@@ -817,7 +814,8 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff),
+ 		.driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0018, 0xff, 0xff, 0xff) },
+-	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0019, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0019, 0xff, 0xff, 0xff),
++		.driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0020, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0021, 0xff, 0xff, 0xff),
+ 		.driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+@@ -1256,8 +1254,8 @@ static const struct usb_device_id option_ids[] = {
+ 
+ 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
+ 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
++	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200) },
+ 	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
+-	{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
+ 	{ USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
+ 	{ USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM610) },
+@@ -1329,9 +1327,12 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) },
+ 	{ USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
+-	{ USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T) },
++	{ USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) },
++	{ USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) },
+ 	{ USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
+ 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(TPLINK_VENDOR_ID, 0x9000),					/* TP-Link MA260 */
++	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ 	{ USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x02, 0x01) },	/* D-Link DWM-156 (variant) */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x00, 0x00) },	/* D-Link DWM-156 (variant) */
+@@ -1339,6 +1340,8 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+ 	{ } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index f80d3dd..8ca5ac7 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -150,6 +150,11 @@ static void vhost_net_ubuf_put_and_wait(struct vhost_net_ubuf_ref *ubufs)
+ {
+ 	kref_put(&ubufs->kref, vhost_net_zerocopy_done_signal);
+ 	wait_event(ubufs->wait, !atomic_read(&ubufs->kref.refcount));
++}
++
++static void vhost_net_ubuf_put_wait_and_free(struct vhost_net_ubuf_ref *ubufs)
++{
++	vhost_net_ubuf_put_and_wait(ubufs);
+ 	kfree(ubufs);
+ }
+ 
+@@ -948,7 +953,7 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
+ 	mutex_unlock(&vq->mutex);
+ 
+ 	if (oldubufs) {
+-		vhost_net_ubuf_put_and_wait(oldubufs);
++		vhost_net_ubuf_put_wait_and_free(oldubufs);
+ 		mutex_lock(&vq->mutex);
+ 		vhost_zerocopy_signal_used(n, vq);
+ 		mutex_unlock(&vq->mutex);
+@@ -966,7 +971,7 @@ err_used:
+ 	rcu_assign_pointer(vq->private_data, oldsock);
+ 	vhost_net_enable_vq(n, vq);
+ 	if (ubufs)
+-		vhost_net_ubuf_put_and_wait(ubufs);
++		vhost_net_ubuf_put_wait_and_free(ubufs);
+ err_ubufs:
+ 	fput(sock->file);
+ err_vq:
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 5217baf..37d58f8 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -607,19 +607,21 @@ void virtqueue_disable_cb(struct virtqueue *_vq)
+ EXPORT_SYMBOL_GPL(virtqueue_disable_cb);
+ 
+ /**
+- * virtqueue_enable_cb - restart callbacks after disable_cb.
++ * virtqueue_enable_cb_prepare - restart callbacks after disable_cb
+  * @vq: the struct virtqueue we're talking about.
+  *
+- * This re-enables callbacks; it returns "false" if there are pending
+- * buffers in the queue, to detect a possible race between the driver
+- * checking for more work, and enabling callbacks.
++ * This re-enables callbacks; it returns current queue state
++ * in an opaque unsigned value. This value should be later tested by
++ * virtqueue_poll, to detect a possible race between the driver checking for
++ * more work, and enabling callbacks.
+  *
+  * Caller must ensure we don't call this with other virtqueue
+  * operations at the same time (except where noted).
+  */
+-bool virtqueue_enable_cb(struct virtqueue *_vq)
++unsigned virtqueue_enable_cb_prepare(struct virtqueue *_vq)
+ {
+ 	struct vring_virtqueue *vq = to_vvq(_vq);
++	u16 last_used_idx;
+ 
+ 	START_USE(vq);
+ 
+@@ -629,15 +631,45 @@ bool virtqueue_enable_cb(struct virtqueue *_vq)
+ 	 * either clear the flags bit or point the event index at the next
+ 	 * entry. Always do both to keep code simple. */
+ 	vq->vring.avail->flags &= ~VRING_AVAIL_F_NO_INTERRUPT;
+-	vring_used_event(&vq->vring) = vq->last_used_idx;
++	vring_used_event(&vq->vring) = last_used_idx = vq->last_used_idx;
++	END_USE(vq);
++	return last_used_idx;
++}
++EXPORT_SYMBOL_GPL(virtqueue_enable_cb_prepare);
++
++/**
++ * virtqueue_poll - query pending used buffers
++ * @vq: the struct virtqueue we're talking about.
++ * @last_used_idx: virtqueue state (from call to virtqueue_enable_cb_prepare).
++ *
++ * Returns "true" if there are pending used buffers in the queue.
++ *
++ * This does not need to be serialized.
++ */
++bool virtqueue_poll(struct virtqueue *_vq, unsigned last_used_idx)
++{
++	struct vring_virtqueue *vq = to_vvq(_vq);
++
+ 	virtio_mb(vq->weak_barriers);
+-	if (unlikely(more_used(vq))) {
+-		END_USE(vq);
+-		return false;
+-	}
++	return (u16)last_used_idx != vq->vring.used->idx;
++}
++EXPORT_SYMBOL_GPL(virtqueue_poll);
+ 
+-	END_USE(vq);
+-	return true;
++/**
++ * virtqueue_enable_cb - restart callbacks after disable_cb.
++ * @vq: the struct virtqueue we're talking about.
++ *
++ * This re-enables callbacks; it returns "false" if there are pending
++ * buffers in the queue, to detect a possible race between the driver
++ * checking for more work, and enabling callbacks.
++ *
++ * Caller must ensure we don't call this with other virtqueue
++ * operations at the same time (except where noted).
++ */
++bool virtqueue_enable_cb(struct virtqueue *_vq)
++{
++	unsigned last_used_idx = virtqueue_enable_cb_prepare(_vq);
++	return !virtqueue_poll(_vq, last_used_idx);
+ }
+ EXPORT_SYMBOL_GPL(virtqueue_enable_cb);
+ 
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 2091db8..85f5c85 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -58,17 +58,24 @@ static void bdev_inode_switch_bdi(struct inode *inode,
+ 			struct backing_dev_info *dst)
+ {
+ 	struct backing_dev_info *old = inode->i_data.backing_dev_info;
++	bool wakeup_bdi = false;
+ 
+ 	if (unlikely(dst == old))		/* deadlock avoidance */
+ 		return;
+ 	bdi_lock_two(&old->wb, &dst->wb);
+ 	spin_lock(&inode->i_lock);
+ 	inode->i_data.backing_dev_info = dst;
+-	if (inode->i_state & I_DIRTY)
++	if (inode->i_state & I_DIRTY) {
++		if (bdi_cap_writeback_dirty(dst) && !wb_has_dirty_io(&dst->wb))
++			wakeup_bdi = true;
+ 		list_move(&inode->i_wb_list, &dst->wb.b_dirty);
++	}
+ 	spin_unlock(&inode->i_lock);
+ 	spin_unlock(&old->wb.list_lock);
+ 	spin_unlock(&dst->wb.list_lock);
++
++	if (wakeup_bdi)
++		bdi_wakeup_thread_delayed(dst);
+ }
+ 
+ /* Kill _all_ buffers and pagecache , dirty or not.. */
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index e49da58..fddf3d9 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4386,9 +4386,20 @@ void ext4_ext_truncate(handle_t *handle, struct inode *inode)
+ 
+ 	last_block = (inode->i_size + sb->s_blocksize - 1)
+ 			>> EXT4_BLOCK_SIZE_BITS(sb);
++retry:
+ 	err = ext4_es_remove_extent(inode, last_block,
+ 				    EXT_MAX_BLOCKS - last_block);
++	if (err == ENOMEM) {
++		cond_resched();
++		congestion_wait(BLK_RW_ASYNC, HZ/50);
++		goto retry;
++	}
++	if (err) {
++		ext4_std_error(inode->i_sb, err);
++		return;
++	}
+ 	err = ext4_ext_remove_space(inode, last_block, EXT_MAX_BLOCKS - 1);
++	ext4_std_error(inode->i_sb, err);
+ }
+ 
+ static void ext4_falloc_update_inode(struct inode *inode,
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index f3f783d..5b12746 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1225,13 +1225,29 @@ static int fuse_direntplus_link(struct file *file,
+ 		if (name.name[1] == '.' && name.len == 2)
+ 			return 0;
+ 	}
++
++	if (invalid_nodeid(o->nodeid))
++		return -EIO;
++	if (!fuse_valid_type(o->attr.mode))
++		return -EIO;
++
+ 	fc = get_fuse_conn(dir);
+ 
+ 	name.hash = full_name_hash(name.name, name.len);
+ 	dentry = d_lookup(parent, &name);
+-	if (dentry && dentry->d_inode) {
++	if (dentry) {
+ 		inode = dentry->d_inode;
+-		if (get_node_id(inode) == o->nodeid) {
++		if (!inode) {
++			d_drop(dentry);
++		} else if (get_node_id(inode) != o->nodeid ||
++			   ((o->attr.mode ^ inode->i_mode) & S_IFMT)) {
++			err = d_invalidate(dentry);
++			if (err)
++				goto out;
++		} else if (is_bad_inode(inode)) {
++			err = -EIO;
++			goto out;
++		} else {
+ 			struct fuse_inode *fi;
+ 			fi = get_fuse_inode(inode);
+ 			spin_lock(&fc->lock);
+@@ -1244,9 +1260,6 @@ static int fuse_direntplus_link(struct file *file,
+ 			 */
+ 			goto found;
+ 		}
+-		err = d_invalidate(dentry);
+-		if (err)
+-			goto out;
+ 		dput(dentry);
+ 		dentry = NULL;
+ 	}
+@@ -1261,10 +1274,19 @@ static int fuse_direntplus_link(struct file *file,
+ 	if (!inode)
+ 		goto out;
+ 
+-	alias = d_materialise_unique(dentry, inode);
+-	err = PTR_ERR(alias);
+-	if (IS_ERR(alias))
+-		goto out;
++	if (S_ISDIR(inode->i_mode)) {
++		mutex_lock(&fc->inst_mutex);
++		alias = fuse_d_add_directory(dentry, inode);
++		mutex_unlock(&fc->inst_mutex);
++		err = PTR_ERR(alias);
++		if (IS_ERR(alias)) {
++			iput(inode);
++			goto out;
++		}
++	} else {
++		alias = d_splice_alias(inode, dentry);
++	}
++
+ 	if (alias) {
+ 		dput(dentry);
+ 		dentry = alias;
+diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
+index e703318..8ebd3f5 100644
+--- a/fs/lockd/svclock.c
++++ b/fs/lockd/svclock.c
+@@ -939,6 +939,7 @@ nlmsvc_retry_blocked(void)
+ 	unsigned long	timeout = MAX_SCHEDULE_TIMEOUT;
+ 	struct nlm_block *block;
+ 
++	spin_lock(&nlm_blocked_lock);
+ 	while (!list_empty(&nlm_blocked) && !kthread_should_stop()) {
+ 		block = list_entry(nlm_blocked.next, struct nlm_block, b_list);
+ 
+@@ -948,6 +949,7 @@ nlmsvc_retry_blocked(void)
+ 			timeout = block->b_when - jiffies;
+ 			break;
+ 		}
++		spin_unlock(&nlm_blocked_lock);
+ 
+ 		dprintk("nlmsvc_retry_blocked(%p, when=%ld)\n",
+ 			block, block->b_when);
+@@ -957,7 +959,9 @@ nlmsvc_retry_blocked(void)
+ 			retry_deferred_block(block);
+ 		} else
+ 			nlmsvc_grant_blocked(block);
++		spin_lock(&nlm_blocked_lock);
+ 	}
++	spin_unlock(&nlm_blocked_lock);
+ 
+ 	return timeout;
+ }
+diff --git a/include/linux/edac.h b/include/linux/edac.h
+index 0b76327..5c6d7fb 100644
+--- a/include/linux/edac.h
++++ b/include/linux/edac.h
+@@ -622,7 +622,7 @@ struct edac_raw_error_desc {
+  */
+ struct mem_ctl_info {
+ 	struct device			dev;
+-	struct bus_type			bus;
++	struct bus_type			*bus;
+ 
+ 	struct list_head link;	/* for global list of mem_ctl_info structs */
+ 
+@@ -742,4 +742,9 @@ struct mem_ctl_info {
+ #endif
+ };
+ 
++/*
++ * Maximum number of memory controllers in the coherent fabric.
++ */
++#define EDAC_MAX_MCS	16
++
+ #endif
+diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
+index 637fa71d..0b34988 100644
+--- a/include/linux/if_vlan.h
++++ b/include/linux/if_vlan.h
+@@ -79,9 +79,8 @@ static inline int is_vlan_dev(struct net_device *dev)
+ }
+ 
+ #define vlan_tx_tag_present(__skb)	((__skb)->vlan_tci & VLAN_TAG_PRESENT)
+-#define vlan_tx_nonzero_tag_present(__skb) \
+-	(vlan_tx_tag_present(__skb) && ((__skb)->vlan_tci & VLAN_VID_MASK))
+ #define vlan_tx_tag_get(__skb)		((__skb)->vlan_tci & ~VLAN_TAG_PRESENT)
++#define vlan_tx_tag_get_id(__skb)	((__skb)->vlan_tci & VLAN_VID_MASK)
+ 
+ #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
+ 
+diff --git a/include/linux/virtio.h b/include/linux/virtio.h
+index 9ff8645..72398ee 100644
+--- a/include/linux/virtio.h
++++ b/include/linux/virtio.h
+@@ -70,6 +70,10 @@ void virtqueue_disable_cb(struct virtqueue *vq);
+ 
+ bool virtqueue_enable_cb(struct virtqueue *vq);
+ 
++unsigned virtqueue_enable_cb_prepare(struct virtqueue *vq);
++
++bool virtqueue_poll(struct virtqueue *vq, unsigned);
++
+ bool virtqueue_enable_cb_delayed(struct virtqueue *vq);
+ 
+ void *virtqueue_detach_unused_buf(struct virtqueue *vq);
+diff --git a/include/net/addrconf.h b/include/net/addrconf.h
+index 21f70270..01b1a1a 100644
+--- a/include/net/addrconf.h
++++ b/include/net/addrconf.h
+@@ -86,6 +86,9 @@ extern int			ipv6_dev_get_saddr(struct net *net,
+ 					       const struct in6_addr *daddr,
+ 					       unsigned int srcprefs,
+ 					       struct in6_addr *saddr);
++extern int			__ipv6_get_lladdr(struct inet6_dev *idev,
++						  struct in6_addr *addr,
++						  unsigned char banned_flags);
+ extern int			ipv6_get_lladdr(struct net_device *dev,
+ 						struct in6_addr *addr,
+ 						unsigned char banned_flags);
+diff --git a/include/net/udp.h b/include/net/udp.h
+index 065f379..ad99eed 100644
+--- a/include/net/udp.h
++++ b/include/net/udp.h
+@@ -181,6 +181,7 @@ extern int udp_get_port(struct sock *sk, unsigned short snum,
+ extern void udp_err(struct sk_buff *, u32);
+ extern int udp_sendmsg(struct kiocb *iocb, struct sock *sk,
+ 			    struct msghdr *msg, size_t len);
++extern int udp_push_pending_frames(struct sock *sk);
+ extern void udp_flush_pending_frames(struct sock *sk);
+ extern int udp_rcv(struct sk_buff *skb);
+ extern int udp_ioctl(struct sock *sk, int cmd, unsigned long arg);
+diff --git a/include/uapi/linux/if_pppox.h b/include/uapi/linux/if_pppox.h
+index 0b46fd5..e36a4ae 100644
+--- a/include/uapi/linux/if_pppox.h
++++ b/include/uapi/linux/if_pppox.h
+@@ -135,11 +135,11 @@ struct pppoe_tag {
+ 
+ struct pppoe_hdr {
+ #if defined(__LITTLE_ENDIAN_BITFIELD)
+-	__u8 ver : 4;
+ 	__u8 type : 4;
++	__u8 ver : 4;
+ #elif defined(__BIG_ENDIAN_BITFIELD)
+-	__u8 type : 4;
+ 	__u8 ver : 4;
++	__u8 type : 4;
+ #else
+ #error	"Please fix <asm/byteorder.h>"
+ #endif
+diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
+index fd4b13b..2288fbd 100644
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -721,17 +721,20 @@ static int hrtimer_switch_to_hres(void)
+ 	return 1;
+ }
+ 
++static void clock_was_set_work(struct work_struct *work)
++{
++	clock_was_set();
++}
++
++static DECLARE_WORK(hrtimer_work, clock_was_set_work);
++
+ /*
+- * Called from timekeeping code to reprogramm the hrtimer interrupt
+- * device. If called from the timer interrupt context we defer it to
+- * softirq context.
++ * Called from timekeeping and resume code to reprogramm the hrtimer
++ * interrupt device on all cpus.
+  */
+ void clock_was_set_delayed(void)
+ {
+-	struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
+-
+-	cpu_base->clock_was_set = 1;
+-	__raise_softirq_irqoff(HRTIMER_SOFTIRQ);
++	schedule_work(&hrtimer_work);
+ }
+ 
+ #else
+@@ -780,8 +783,10 @@ void hrtimers_resume(void)
+ 	WARN_ONCE(!irqs_disabled(),
+ 		  KERN_INFO "hrtimers_resume() called with IRQs enabled!");
+ 
++	/* Retrigger on the local CPU */
+ 	retrigger_next_event(NULL);
+-	timerfd_clock_was_set();
++	/* And schedule a retrigger for all others */
++	clock_was_set_delayed();
+ }
+ 
+ static inline void timer_stats_hrtimer_set_start_info(struct hrtimer *timer)
+@@ -1432,13 +1437,6 @@ void hrtimer_peek_ahead_timers(void)
+ 
+ static void run_hrtimer_softirq(struct softirq_action *h)
+ {
+-	struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
+-
+-	if (cpu_base->clock_was_set) {
+-		cpu_base->clock_was_set = 0;
+-		clock_was_set();
+-	}
+-
+ 	hrtimer_peek_ahead_timers();
+ }
+ 
+diff --git a/kernel/power/autosleep.c b/kernel/power/autosleep.c
+index c6422ff..9012ecf 100644
+--- a/kernel/power/autosleep.c
++++ b/kernel/power/autosleep.c
+@@ -32,7 +32,8 @@ static void try_to_suspend(struct work_struct *work)
+ 
+ 	mutex_lock(&autosleep_lock);
+ 
+-	if (!pm_save_wakeup_count(initial_count)) {
++	if (!pm_save_wakeup_count(initial_count) ||
++		system_state != SYSTEM_RUNNING) {
+ 		mutex_unlock(&autosleep_lock);
+ 		goto out;
+ 	}
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 566cf2b..74fdc5c 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -1272,7 +1272,7 @@ config FAULT_INJECTION_STACKTRACE_FILTER
+ 	depends on FAULT_INJECTION_DEBUG_FS && STACKTRACE_SUPPORT
+ 	depends on !X86_64
+ 	select STACKTRACE
+-	select FRAME_POINTER if !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND
++	select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND
+ 	help
+ 	  Provide stacktrace filter for fault-injection capabilities
+ 
+diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
+index 8a15eaa..4a78c4d 100644
+--- a/net/8021q/vlan_core.c
++++ b/net/8021q/vlan_core.c
+@@ -9,7 +9,7 @@ bool vlan_do_receive(struct sk_buff **skbp)
+ {
+ 	struct sk_buff *skb = *skbp;
+ 	__be16 vlan_proto = skb->vlan_proto;
+-	u16 vlan_id = skb->vlan_tci & VLAN_VID_MASK;
++	u16 vlan_id = vlan_tx_tag_get_id(skb);
+ 	struct net_device *vlan_dev;
+ 	struct vlan_pcpu_stats *rx_stats;
+ 
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index 3a8c8fd..1cd3d2a 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -73,6 +73,8 @@ vlan_dev_get_egress_qos_mask(struct net_device *dev, struct sk_buff *skb)
+ {
+ 	struct vlan_priority_tci_mapping *mp;
+ 
++	smp_rmb(); /* coupled with smp_wmb() in vlan_dev_set_egress_priority() */
++
+ 	mp = vlan_dev_priv(dev)->egress_priority_map[(skb->priority & 0xF)];
+ 	while (mp) {
+ 		if (mp->priority == skb->priority) {
+@@ -249,6 +251,11 @@ int vlan_dev_set_egress_priority(const struct net_device *dev,
+ 	np->next = mp;
+ 	np->priority = skb_prio;
+ 	np->vlan_qos = vlan_qos;
++	/* Before inserting this element in hash table, make sure all its fields
++	 * are committed to memory.
++	 * coupled with smp_rmb() in vlan_dev_get_egress_qos_mask()
++	 */
++	smp_wmb();
+ 	vlan->egress_priority_map[skb_prio & 0xF] = np;
+ 	if (vlan_qos)
+ 		vlan->nr_egress_mappings++;
+diff --git a/net/9p/trans_common.c b/net/9p/trans_common.c
+index de8df95..2ee3879 100644
+--- a/net/9p/trans_common.c
++++ b/net/9p/trans_common.c
+@@ -24,11 +24,11 @@
+  */
+ void p9_release_pages(struct page **pages, int nr_pages)
+ {
+-	int i = 0;
+-	while (pages[i] && nr_pages--) {
+-		put_page(pages[i]);
+-		i++;
+-	}
++	int i;
++
++	for (i = 0; i < nr_pages; i++)
++		if (pages[i])
++			put_page(pages[i]);
+ }
+ EXPORT_SYMBOL(p9_release_pages);
+ 
+diff --git a/net/core/dev.c b/net/core/dev.c
+index faebb39..7ddbb31 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3513,8 +3513,15 @@ ncls:
+ 		}
+ 	}
+ 
+-	if (vlan_tx_nonzero_tag_present(skb))
+-		skb->pkt_type = PACKET_OTHERHOST;
++	if (unlikely(vlan_tx_tag_present(skb))) {
++		if (vlan_tx_tag_get_id(skb))
++			skb->pkt_type = PACKET_OTHERHOST;
++		/* Note: we might in the future use prio bits
++		 * and set skb->priority like in vlan_do_receive()
++		 * For the time being, just ignore Priority Code Point
++		 */
++		skb->vlan_tci = 0;
++	}
+ 
+ 	/* deliver only exact match when indicated */
+ 	null_or_dev = deliver_exact ? skb->dev : NULL;
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 5c56b21..ce90b02 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -231,7 +231,7 @@ static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
+ 				   we must kill timers etc. and move
+ 				   it to safe state.
+ 				 */
+-				skb_queue_purge(&n->arp_queue);
++				__skb_queue_purge(&n->arp_queue);
+ 				n->arp_queue_len_bytes = 0;
+ 				n->output = neigh_blackhole;
+ 				if (n->nud_state & NUD_VALID)
+@@ -286,7 +286,7 @@ static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device
+ 	if (!n)
+ 		goto out_entries;
+ 
+-	skb_queue_head_init(&n->arp_queue);
++	__skb_queue_head_init(&n->arp_queue);
+ 	rwlock_init(&n->lock);
+ 	seqlock_init(&n->ha_lock);
+ 	n->updated	  = n->used = now;
+@@ -708,7 +708,9 @@ void neigh_destroy(struct neighbour *neigh)
+ 	if (neigh_del_timer(neigh))
+ 		pr_warn("Impossible event\n");
+ 
+-	skb_queue_purge(&neigh->arp_queue);
++	write_lock_bh(&neigh->lock);
++	__skb_queue_purge(&neigh->arp_queue);
++	write_unlock_bh(&neigh->lock);
+ 	neigh->arp_queue_len_bytes = 0;
+ 
+ 	if (dev->netdev_ops->ndo_neigh_destroy)
+@@ -858,7 +860,7 @@ static void neigh_invalidate(struct neighbour *neigh)
+ 		neigh->ops->error_report(neigh, skb);
+ 		write_lock(&neigh->lock);
+ 	}
+-	skb_queue_purge(&neigh->arp_queue);
++	__skb_queue_purge(&neigh->arp_queue);
+ 	neigh->arp_queue_len_bytes = 0;
+ }
+ 
+@@ -1210,7 +1212,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
+ 
+ 			write_lock_bh(&neigh->lock);
+ 		}
+-		skb_queue_purge(&neigh->arp_queue);
++		__skb_queue_purge(&neigh->arp_queue);
+ 		neigh->arp_queue_len_bytes = 0;
+ 	}
+ out:
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 2a83591..855004f 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -503,10 +503,11 @@ static int ipgre_tunnel_ioctl(struct net_device *dev,
+ 
+ 	if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
+ 		return -EFAULT;
+-	if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE ||
+-	    p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)) ||
+-	    ((p.i_flags|p.o_flags)&(GRE_VERSION|GRE_ROUTING))) {
+-		return -EINVAL;
++	if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
++		if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE ||
++		    p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)) ||
++		    ((p.i_flags|p.o_flags)&(GRE_VERSION|GRE_ROUTING)))
++			return -EINVAL;
+ 	}
+ 	p.i_flags = gre_flags_to_tnl_flags(p.i_flags);
+ 	p.o_flags = gre_flags_to_tnl_flags(p.o_flags);
+diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
+index 3da817b..15e3e68 100644
+--- a/net/ipv4/ip_input.c
++++ b/net/ipv4/ip_input.c
+@@ -190,10 +190,7 @@ static int ip_local_deliver_finish(struct sk_buff *skb)
+ {
+ 	struct net *net = dev_net(skb->dev);
+ 
+-	__skb_pull(skb, ip_hdrlen(skb));
+-
+-	/* Point into the IP datagram, just past the header. */
+-	skb_reset_transport_header(skb);
++	__skb_pull(skb, skb_network_header_len(skb));
+ 
+ 	rcu_read_lock();
+ 	{
+@@ -437,6 +434,8 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
+ 		goto drop;
+ 	}
+ 
++	skb->transport_header = skb->network_header + iph->ihl*4;
++
+ 	/* Remove any debris in the socket control block */
+ 	memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+ 
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 7fa8f08..cbfc37f 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -486,6 +486,53 @@ drop:
+ }
+ EXPORT_SYMBOL_GPL(ip_tunnel_rcv);
+ 
++static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
++			    struct rtable *rt, __be16 df)
++{
++	struct ip_tunnel *tunnel = netdev_priv(dev);
++	int pkt_size = skb->len - tunnel->hlen - dev->hard_header_len;
++	int mtu;
++
++	if (df)
++		mtu = dst_mtu(&rt->dst) - dev->hard_header_len
++					- sizeof(struct iphdr) - tunnel->hlen;
++	else
++		mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
++
++	if (skb_dst(skb))
++		skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
++
++	if (skb->protocol == htons(ETH_P_IP)) {
++		if (!skb_is_gso(skb) &&
++		    (df & htons(IP_DF)) && mtu < pkt_size) {
++			icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
++			return -E2BIG;
++		}
++	}
++#if IS_ENABLED(CONFIG_IPV6)
++	else if (skb->protocol == htons(ETH_P_IPV6)) {
++		struct rt6_info *rt6 = (struct rt6_info *)skb_dst(skb);
++
++		if (rt6 && mtu < dst_mtu(skb_dst(skb)) &&
++			   mtu >= IPV6_MIN_MTU) {
++			if ((tunnel->parms.iph.daddr &&
++			    !ipv4_is_multicast(tunnel->parms.iph.daddr)) ||
++			    rt6->rt6i_dst.plen == 128) {
++				rt6->rt6i_flags |= RTF_MODIFIED;
++				dst_metric_set(skb_dst(skb), RTAX_MTU, mtu);
++			}
++		}
++
++		if (!skb_is_gso(skb) && mtu >= IPV6_MIN_MTU &&
++					mtu < pkt_size) {
++			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
++			return -E2BIG;
++		}
++	}
++#endif
++	return 0;
++}
++
+ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 		    const struct iphdr *tnl_params)
+ {
+@@ -499,7 +546,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 	struct net_device *tdev;	/* Device to other host */
+ 	unsigned int max_headroom;	/* The extra header space needed */
+ 	__be32 dst;
+-	int mtu;
+ 
+ 	inner_iph = (const struct iphdr *)skb_inner_network_header(skb);
+ 
+@@ -579,50 +625,11 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 		goto tx_error;
+ 	}
+ 
+-	df = tnl_params->frag_off;
+ 
+-	if (df)
+-		mtu = dst_mtu(&rt->dst) - dev->hard_header_len
+-					- sizeof(struct iphdr);
+-	else
+-		mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
+-
+-	if (skb_dst(skb))
+-		skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
+-
+-	if (skb->protocol == htons(ETH_P_IP)) {
+-		df |= (inner_iph->frag_off&htons(IP_DF));
+-
+-		if (!skb_is_gso(skb) &&
+-		    (inner_iph->frag_off&htons(IP_DF)) &&
+-		     mtu < ntohs(inner_iph->tot_len)) {
+-			icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
+-			ip_rt_put(rt);
+-			goto tx_error;
+-		}
+-	}
+-#if IS_ENABLED(CONFIG_IPV6)
+-	else if (skb->protocol == htons(ETH_P_IPV6)) {
+-		struct rt6_info *rt6 = (struct rt6_info *)skb_dst(skb);
+-
+-		if (rt6 && mtu < dst_mtu(skb_dst(skb)) &&
+-		    mtu >= IPV6_MIN_MTU) {
+-			if ((tunnel->parms.iph.daddr &&
+-			    !ipv4_is_multicast(tunnel->parms.iph.daddr)) ||
+-			    rt6->rt6i_dst.plen == 128) {
+-				rt6->rt6i_flags |= RTF_MODIFIED;
+-				dst_metric_set(skb_dst(skb), RTAX_MTU, mtu);
+-			}
+-		}
+-
+-		if (!skb_is_gso(skb) && mtu >= IPV6_MIN_MTU &&
+-		    mtu < skb->len) {
+-			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+-			ip_rt_put(rt);
+-			goto tx_error;
+-		}
++	if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off)) {
++		ip_rt_put(rt);
++		goto tx_error;
+ 	}
+-#endif
+ 
+ 	if (tunnel->err_count > 0) {
+ 		if (time_before(jiffies,
+@@ -646,6 +653,10 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 			ttl = ip4_dst_hoplimit(&rt->dst);
+ 	}
+ 
++	df = tnl_params->frag_off;
++	if (skb->protocol == htons(ETH_P_IP))
++		df |= (inner_iph->frag_off&htons(IP_DF));
++
+ 	max_headroom = LL_RESERVED_SPACE(tdev) + sizeof(struct iphdr)
+ 					       + rt->dst.header_len;
+ 	if (max_headroom > dev->needed_headroom) {
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index c118f6b..17cc0ff 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -606,17 +606,10 @@ static int __net_init vti_fb_tunnel_init(struct net_device *dev)
+ 	struct iphdr *iph = &tunnel->parms.iph;
+ 	struct vti_net *ipn = net_generic(dev_net(dev), vti_net_id);
+ 
+-	tunnel->dev = dev;
+-	strcpy(tunnel->parms.name, dev->name);
+-
+ 	iph->version		= 4;
+ 	iph->protocol		= IPPROTO_IPIP;
+ 	iph->ihl		= 5;
+ 
+-	dev->tstats = alloc_percpu(struct pcpu_tstats);
+-	if (!dev->tstats)
+-		return -ENOMEM;
+-
+ 	dev_hold(dev);
+ 	rcu_assign_pointer(ipn->tunnels_wc[0], tunnel);
+ 	return 0;
+diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
+index 77bfcce..7cfc456 100644
+--- a/net/ipv4/ipip.c
++++ b/net/ipv4/ipip.c
+@@ -240,11 +240,13 @@ ipip_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ 	if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
+ 		return -EFAULT;
+ 
+-	if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
+-			p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
+-		return -EINVAL;
+-	if (p.i_key || p.o_key || p.i_flags || p.o_flags)
+-		return -EINVAL;
++	if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
++		if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
++		    p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
++			return -EINVAL;
++	}
++
++	p.i_key = p.o_key = p.i_flags = p.o_flags = 0;
+ 	if (p.iph.ttl)
+ 		p.iph.frag_off |= htons(IP_DF);
+ 
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 0bf5d39..93b731d 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -799,7 +799,7 @@ send:
+ /*
+  * Push out all pending data as one UDP datagram. Socket is locked.
+  */
+-static int udp_push_pending_frames(struct sock *sk)
++int udp_push_pending_frames(struct sock *sk)
+ {
+ 	struct udp_sock  *up = udp_sk(sk);
+ 	struct inet_sock *inet = inet_sk(sk);
+@@ -818,6 +818,7 @@ out:
+ 	up->pending = 0;
+ 	return err;
+ }
++EXPORT_SYMBOL(udp_push_pending_frames);
+ 
+ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+ 		size_t len)
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 4ab4c38..fb8c94c 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -1448,6 +1448,23 @@ try_nextdev:
+ }
+ EXPORT_SYMBOL(ipv6_dev_get_saddr);
+ 
++int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
++		      unsigned char banned_flags)
++{
++	struct inet6_ifaddr *ifp;
++	int err = -EADDRNOTAVAIL;
++
++	list_for_each_entry(ifp, &idev->addr_list, if_list) {
++		if (ifp->scope == IFA_LINK &&
++		    !(ifp->flags & banned_flags)) {
++			*addr = ifp->addr;
++			err = 0;
++			break;
++		}
++	}
++	return err;
++}
++
+ int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
+ 		    unsigned char banned_flags)
+ {
+@@ -1457,17 +1474,8 @@ int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
+ 	rcu_read_lock();
+ 	idev = __in6_dev_get(dev);
+ 	if (idev) {
+-		struct inet6_ifaddr *ifp;
+-
+ 		read_lock_bh(&idev->lock);
+-		list_for_each_entry(ifp, &idev->addr_list, if_list) {
+-			if (ifp->scope == IFA_LINK &&
+-			    !(ifp->flags & banned_flags)) {
+-				*addr = ifp->addr;
+-				err = 0;
+-				break;
+-			}
+-		}
++		err = __ipv6_get_lladdr(idev, addr, banned_flags);
+ 		read_unlock_bh(&idev->lock);
+ 	}
+ 	rcu_read_unlock();
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index 192dd1a..5fc9c7a 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -632,6 +632,12 @@ insert_above:
+ 	return ln;
+ }
+ 
++static inline bool rt6_qualify_for_ecmp(struct rt6_info *rt)
++{
++	return (rt->rt6i_flags & (RTF_GATEWAY|RTF_ADDRCONF|RTF_DYNAMIC)) ==
++	       RTF_GATEWAY;
++}
++
+ /*
+  *	Insert routing information in a node.
+  */
+@@ -646,6 +652,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
+ 	int add = (!info->nlh ||
+ 		   (info->nlh->nlmsg_flags & NLM_F_CREATE));
+ 	int found = 0;
++	bool rt_can_ecmp = rt6_qualify_for_ecmp(rt);
+ 
+ 	ins = &fn->leaf;
+ 
+@@ -691,9 +698,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
+ 			 * To avoid long list, we only had siblings if the
+ 			 * route have a gateway.
+ 			 */
+-			if (rt->rt6i_flags & RTF_GATEWAY &&
+-			    !(rt->rt6i_flags & RTF_EXPIRES) &&
+-			    !(iter->rt6i_flags & RTF_EXPIRES))
++			if (rt_can_ecmp &&
++			    rt6_qualify_for_ecmp(iter))
+ 				rt->rt6i_nsiblings++;
+ 		}
+ 
+@@ -715,7 +721,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
+ 		/* Find the first route that have the same metric */
+ 		sibling = fn->leaf;
+ 		while (sibling) {
+-			if (sibling->rt6i_metric == rt->rt6i_metric) {
++			if (sibling->rt6i_metric == rt->rt6i_metric &&
++			    rt6_qualify_for_ecmp(sibling)) {
+ 				list_add_tail(&rt->rt6i_siblings,
+ 					      &sibling->rt6i_siblings);
+ 				break;
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index d5d20cd..6e3ddf8 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1098,11 +1098,12 @@ static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
+ 	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
+ }
+ 
+-static void ip6_append_data_mtu(int *mtu,
++static void ip6_append_data_mtu(unsigned int *mtu,
+ 				int *maxfraglen,
+ 				unsigned int fragheaderlen,
+ 				struct sk_buff *skb,
+-				struct rt6_info *rt)
++				struct rt6_info *rt,
++				bool pmtuprobe)
+ {
+ 	if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
+ 		if (skb == NULL) {
+@@ -1114,7 +1115,9 @@ static void ip6_append_data_mtu(int *mtu,
+ 			 * this fragment is not first, the headers
+ 			 * space is regarded as data space.
+ 			 */
+-			*mtu = dst_mtu(rt->dst.path);
++			*mtu = min(*mtu, pmtuprobe ?
++				   rt->dst.dev->mtu :
++				   dst_mtu(rt->dst.path));
+ 		}
+ 		*maxfraglen = ((*mtu - fragheaderlen) & ~7)
+ 			      + fragheaderlen - sizeof(struct frag_hdr);
+@@ -1131,11 +1134,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+ 	struct ipv6_pinfo *np = inet6_sk(sk);
+ 	struct inet_cork *cork;
+ 	struct sk_buff *skb, *skb_prev = NULL;
+-	unsigned int maxfraglen, fragheaderlen;
++	unsigned int maxfraglen, fragheaderlen, mtu;
+ 	int exthdrlen;
+ 	int dst_exthdrlen;
+ 	int hh_len;
+-	int mtu;
+ 	int copy;
+ 	int err;
+ 	int offset = 0;
+@@ -1292,7 +1294,9 @@ alloc_new_skb:
+ 			/* update mtu and maxfraglen if necessary */
+ 			if (skb == NULL || skb_prev == NULL)
+ 				ip6_append_data_mtu(&mtu, &maxfraglen,
+-						    fragheaderlen, skb, rt);
++						    fragheaderlen, skb, rt,
++						    np->pmtudisc ==
++						    IPV6_PMTUDISC_PROBE);
+ 
+ 			skb_prev = skb;
+ 
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index bfa6cc3..c3998c2 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -1343,8 +1343,9 @@ static void ip6_mc_hdr(struct sock *sk, struct sk_buff *skb,
+ 	hdr->daddr = *daddr;
+ }
+ 
+-static struct sk_buff *mld_newpack(struct net_device *dev, int size)
++static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
+ {
++	struct net_device *dev = idev->dev;
+ 	struct net *net = dev_net(dev);
+ 	struct sock *sk = net->ipv6.igmp_sk;
+ 	struct sk_buff *skb;
+@@ -1369,7 +1370,7 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
+ 
+ 	skb_reserve(skb, hlen);
+ 
+-	if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
++	if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
+ 		/* <draft-ietf-magma-mld-source-05.txt>:
+ 		 * use unspecified address as the source address
+ 		 * when a valid link-local address is not available.
+@@ -1465,7 +1466,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
+ 	struct mld2_grec *pgr;
+ 
+ 	if (!skb)
+-		skb = mld_newpack(dev, dev->mtu);
++		skb = mld_newpack(pmc->idev, dev->mtu);
+ 	if (!skb)
+ 		return NULL;
+ 	pgr = (struct mld2_grec *)skb_put(skb, sizeof(struct mld2_grec));
+@@ -1485,7 +1486,8 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
+ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
+ 	int type, int gdeleted, int sdeleted)
+ {
+-	struct net_device *dev = pmc->idev->dev;
++	struct inet6_dev *idev = pmc->idev;
++	struct net_device *dev = idev->dev;
+ 	struct mld2_report *pmr;
+ 	struct mld2_grec *pgr = NULL;
+ 	struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list;
+@@ -1514,7 +1516,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
+ 		    AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
+ 			if (skb)
+ 				mld_sendpack(skb);
+-			skb = mld_newpack(dev, dev->mtu);
++			skb = mld_newpack(idev, dev->mtu);
+ 		}
+ 	}
+ 	first = 1;
+@@ -1541,7 +1543,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
+ 				pgr->grec_nsrcs = htons(scount);
+ 			if (skb)
+ 				mld_sendpack(skb);
+-			skb = mld_newpack(dev, dev->mtu);
++			skb = mld_newpack(idev, dev->mtu);
+ 			first = 1;
+ 			scount = 0;
+ 		}
+@@ -1596,8 +1598,8 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
+ 	struct sk_buff *skb = NULL;
+ 	int type;
+ 
++	read_lock_bh(&idev->lock);
+ 	if (!pmc) {
+-		read_lock_bh(&idev->lock);
+ 		for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
+ 			if (pmc->mca_flags & MAF_NOREPORT)
+ 				continue;
+@@ -1609,7 +1611,6 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
+ 			skb = add_grec(skb, pmc, type, 0, 0);
+ 			spin_unlock_bh(&pmc->mca_lock);
+ 		}
+-		read_unlock_bh(&idev->lock);
+ 	} else {
+ 		spin_lock_bh(&pmc->mca_lock);
+ 		if (pmc->mca_sfcount[MCAST_EXCLUDE])
+@@ -1619,6 +1620,7 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
+ 		skb = add_grec(skb, pmc, type, 0, 0);
+ 		spin_unlock_bh(&pmc->mca_lock);
+ 	}
++	read_unlock_bh(&idev->lock);
+ 	if (skb)
+ 		mld_sendpack(skb);
+ }
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index ad0aa6b..bacce6c 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -65,6 +65,12 @@
+ #include <linux/sysctl.h>
+ #endif
+ 
++enum rt6_nud_state {
++	RT6_NUD_FAIL_HARD = -2,
++	RT6_NUD_FAIL_SOFT = -1,
++	RT6_NUD_SUCCEED = 1
++};
++
+ static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
+ 				    const struct in6_addr *dest);
+ static struct dst_entry	*ip6_dst_check(struct dst_entry *dst, u32 cookie);
+@@ -527,26 +533,29 @@ static inline int rt6_check_dev(struct rt6_info *rt, int oif)
+ 	return 0;
+ }
+ 
+-static inline bool rt6_check_neigh(struct rt6_info *rt)
++static inline enum rt6_nud_state rt6_check_neigh(struct rt6_info *rt)
+ {
+ 	struct neighbour *neigh;
+-	bool ret = false;
++	enum rt6_nud_state ret = RT6_NUD_FAIL_HARD;
+ 
+ 	if (rt->rt6i_flags & RTF_NONEXTHOP ||
+ 	    !(rt->rt6i_flags & RTF_GATEWAY))
+-		return true;
++		return RT6_NUD_SUCCEED;
+ 
+ 	rcu_read_lock_bh();
+ 	neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway);
+ 	if (neigh) {
+ 		read_lock(&neigh->lock);
+ 		if (neigh->nud_state & NUD_VALID)
+-			ret = true;
++			ret = RT6_NUD_SUCCEED;
+ #ifdef CONFIG_IPV6_ROUTER_PREF
+ 		else if (!(neigh->nud_state & NUD_FAILED))
+-			ret = true;
++			ret = RT6_NUD_SUCCEED;
+ #endif
+ 		read_unlock(&neigh->lock);
++	} else {
++		ret = IS_ENABLED(CONFIG_IPV6_ROUTER_PREF) ?
++		      RT6_NUD_SUCCEED : RT6_NUD_FAIL_SOFT;
+ 	}
+ 	rcu_read_unlock_bh();
+ 
+@@ -560,43 +569,52 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
+ 
+ 	m = rt6_check_dev(rt, oif);
+ 	if (!m && (strict & RT6_LOOKUP_F_IFACE))
+-		return -1;
++		return RT6_NUD_FAIL_HARD;
+ #ifdef CONFIG_IPV6_ROUTER_PREF
+ 	m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;
+ #endif
+-	if (!rt6_check_neigh(rt) && (strict & RT6_LOOKUP_F_REACHABLE))
+-		return -1;
++	if (strict & RT6_LOOKUP_F_REACHABLE) {
++		int n = rt6_check_neigh(rt);
++		if (n < 0)
++			return n;
++	}
+ 	return m;
+ }
+ 
+ static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict,
+-				   int *mpri, struct rt6_info *match)
++				   int *mpri, struct rt6_info *match,
++				   bool *do_rr)
+ {
+ 	int m;
++	bool match_do_rr = false;
+ 
+ 	if (rt6_check_expired(rt))
+ 		goto out;
+ 
+ 	m = rt6_score_route(rt, oif, strict);
+-	if (m < 0)
++	if (m == RT6_NUD_FAIL_SOFT && !IS_ENABLED(CONFIG_IPV6_ROUTER_PREF)) {
++		match_do_rr = true;
++		m = 0; /* lowest valid score */
++	} else if (m < 0) {
+ 		goto out;
++	}
++
++	if (strict & RT6_LOOKUP_F_REACHABLE)
++		rt6_probe(rt);
+ 
+ 	if (m > *mpri) {
+-		if (strict & RT6_LOOKUP_F_REACHABLE)
+-			rt6_probe(match);
++		*do_rr = match_do_rr;
+ 		*mpri = m;
+ 		match = rt;
+-	} else if (strict & RT6_LOOKUP_F_REACHABLE) {
+-		rt6_probe(rt);
+ 	}
+-
+ out:
+ 	return match;
+ }
+ 
+ static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
+ 				     struct rt6_info *rr_head,
+-				     u32 metric, int oif, int strict)
++				     u32 metric, int oif, int strict,
++				     bool *do_rr)
+ {
+ 	struct rt6_info *rt, *match;
+ 	int mpri = -1;
+@@ -604,10 +622,10 @@ static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
+ 	match = NULL;
+ 	for (rt = rr_head; rt && rt->rt6i_metric == metric;
+ 	     rt = rt->dst.rt6_next)
+-		match = find_match(rt, oif, strict, &mpri, match);
++		match = find_match(rt, oif, strict, &mpri, match, do_rr);
+ 	for (rt = fn->leaf; rt && rt != rr_head && rt->rt6i_metric == metric;
+ 	     rt = rt->dst.rt6_next)
+-		match = find_match(rt, oif, strict, &mpri, match);
++		match = find_match(rt, oif, strict, &mpri, match, do_rr);
+ 
+ 	return match;
+ }
+@@ -616,15 +634,16 @@ static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
+ {
+ 	struct rt6_info *match, *rt0;
+ 	struct net *net;
++	bool do_rr = false;
+ 
+ 	rt0 = fn->rr_ptr;
+ 	if (!rt0)
+ 		fn->rr_ptr = rt0 = fn->leaf;
+ 
+-	match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict);
++	match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict,
++			     &do_rr);
+ 
+-	if (!match &&
+-	    (strict & RT6_LOOKUP_F_REACHABLE)) {
++	if (do_rr) {
+ 		struct rt6_info *next = rt0->dst.rt6_next;
+ 
+ 		/* no entries matched; do round-robin */
+@@ -1074,10 +1093,13 @@ static void ip6_link_failure(struct sk_buff *skb)
+ 
+ 	rt = (struct rt6_info *) skb_dst(skb);
+ 	if (rt) {
+-		if (rt->rt6i_flags & RTF_CACHE)
+-			rt6_update_expires(rt, 0);
+-		else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT))
++		if (rt->rt6i_flags & RTF_CACHE) {
++			dst_hold(&rt->dst);
++			if (ip6_del_rt(rt))
++				dst_free(&rt->dst);
++		} else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT)) {
+ 			rt->rt6i_node->fn_sernum = -1;
++		}
+ 	}
+ }
+ 
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 3353634..60df36d 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -589,7 +589,7 @@ static int ipip6_rcv(struct sk_buff *skb)
+ 				tunnel->dev->stats.rx_errors++;
+ 				goto out;
+ 			}
+-		} else {
++		} else if (!(tunnel->dev->flags&IFF_POINTOPOINT)) {
+ 			if (is_spoofed_6rd(tunnel, iph->saddr,
+ 					   &ipv6_hdr(skb)->saddr) ||
+ 			    is_spoofed_6rd(tunnel, iph->daddr,
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 42923b1..e7b28f9 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -955,11 +955,16 @@ static int udp_v6_push_pending_frames(struct sock *sk)
+ 	struct udphdr *uh;
+ 	struct udp_sock  *up = udp_sk(sk);
+ 	struct inet_sock *inet = inet_sk(sk);
+-	struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
++	struct flowi6 *fl6;
+ 	int err = 0;
+ 	int is_udplite = IS_UDPLITE(sk);
+ 	__wsum csum = 0;
+ 
++	if (up->pending == AF_INET)
++		return udp_push_pending_frames(sk);
++
++	fl6 = &inet->cork.fl.u.ip6;
++
+ 	/* Grab the skbuff where UDP header space exists. */
+ 	if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
+ 		goto out;
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index 8dec687..5ebee2d 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -1793,7 +1793,8 @@ static const struct proto_ops pppol2tp_ops = {
+ 
+ static const struct pppox_proto pppol2tp_proto = {
+ 	.create		= pppol2tp_create,
+-	.ioctl		= pppol2tp_ioctl
++	.ioctl		= pppol2tp_ioctl,
++	.owner		= THIS_MODULE,
+ };
+ 
+ #ifdef CONFIG_L2TP_V3
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index d51852b..5792252 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -113,7 +113,6 @@
+ 
+ #define FRAC_BITS		30	/* fixed point arithmetic */
+ #define ONE_FP			(1UL << FRAC_BITS)
+-#define IWSUM			(ONE_FP/QFQ_MAX_WSUM)
+ 
+ #define QFQ_MTU_SHIFT		16	/* to support TSO/GSO */
+ #define QFQ_MIN_LMAX		512	/* see qfq_slot_insert */
+@@ -189,6 +188,7 @@ struct qfq_sched {
+ 	struct qfq_aggregate	*in_serv_agg;   /* Aggregate being served. */
+ 	u32			num_active_agg; /* Num. of active aggregates */
+ 	u32			wsum;		/* weight sum */
++	u32			iwsum;		/* inverse weight sum */
+ 
+ 	unsigned long bitmaps[QFQ_MAX_STATE];	    /* Group bitmaps. */
+ 	struct qfq_group groups[QFQ_MAX_INDEX + 1]; /* The groups. */
+@@ -314,6 +314,7 @@ static void qfq_update_agg(struct qfq_sched *q, struct qfq_aggregate *agg,
+ 
+ 	q->wsum +=
+ 		(int) agg->class_weight * (new_num_classes - agg->num_classes);
++	q->iwsum = ONE_FP / q->wsum;
+ 
+ 	agg->num_classes = new_num_classes;
+ }
+@@ -340,6 +341,10 @@ static void qfq_destroy_agg(struct qfq_sched *q, struct qfq_aggregate *agg)
+ {
+ 	if (!hlist_unhashed(&agg->nonfull_next))
+ 		hlist_del_init(&agg->nonfull_next);
++	q->wsum -= agg->class_weight;
++	if (q->wsum != 0)
++		q->iwsum = ONE_FP / q->wsum;
++
+ 	if (q->in_serv_agg == agg)
+ 		q->in_serv_agg = qfq_choose_next_agg(q);
+ 	kfree(agg);
+@@ -827,38 +832,60 @@ static void qfq_make_eligible(struct qfq_sched *q)
+ 	}
+ }
+ 
+-
+ /*
+- * The index of the slot in which the aggregate is to be inserted must
+- * not be higher than QFQ_MAX_SLOTS-2. There is a '-2' and not a '-1'
+- * because the start time of the group may be moved backward by one
+- * slot after the aggregate has been inserted, and this would cause
+- * non-empty slots to be right-shifted by one position.
++ * The index of the slot in which the input aggregate agg is to be
++ * inserted must not be higher than QFQ_MAX_SLOTS-2. There is a '-2'
++ * and not a '-1' because the start time of the group may be moved
++ * backward by one slot after the aggregate has been inserted, and
++ * this would cause non-empty slots to be right-shifted by one
++ * position.
++ *
++ * QFQ+ fully satisfies this bound to the slot index if the parameters
++ * of the classes are not changed dynamically, and if QFQ+ never
++ * happens to postpone the service of agg unjustly, i.e., it never
++ * happens that the aggregate becomes backlogged and eligible, or just
++ * eligible, while an aggregate with a higher approximated finish time
++ * is being served. In particular, in this case QFQ+ guarantees that
++ * the timestamps of agg are low enough that the slot index is never
++ * higher than 2. Unfortunately, QFQ+ cannot provide the same
++ * guarantee if it happens to unjustly postpone the service of agg, or
++ * if the parameters of some class are changed.
++ *
++ * As for the first event, i.e., an out-of-order service, the
++ * upper bound to the slot index guaranteed by QFQ+ grows to
++ * 2 +
++ * QFQ_MAX_AGG_CLASSES * ((1<<QFQ_MTU_SHIFT)/QFQ_MIN_LMAX) *
++ * (current_max_weight/current_wsum) <= 2 + 8 * 128 * 1.
+  *
+- * If the weight and lmax (max_pkt_size) of the classes do not change,
+- * then QFQ+ does meet the above contraint according to the current
+- * values of its parameters. In fact, if the weight and lmax of the
+- * classes do not change, then, from the theory, QFQ+ guarantees that
+- * the slot index is never higher than
+- * 2 + QFQ_MAX_AGG_CLASSES * ((1<<QFQ_MTU_SHIFT)/QFQ_MIN_LMAX) *
+- * (QFQ_MAX_WEIGHT/QFQ_MAX_WSUM) = 2 + 8 * 128 * (1 / 64) = 18
++ * The following function deals with this problem by backward-shifting
++ * the timestamps of agg, if needed, so as to guarantee that the slot
++ * index is never higher than QFQ_MAX_SLOTS-2. This backward-shift may
++ * cause the service of other aggregates to be postponed, yet the
++ * worst-case guarantees of these aggregates are not violated.  In
++ * fact, in case of no out-of-order service, the timestamps of agg
++ * would have been even lower than they are after the backward shift,
++ * because QFQ+ would have guaranteed a maximum value equal to 2 for
++ * the slot index, and 2 < QFQ_MAX_SLOTS-2. Hence the aggregates whose
++ * service is postponed because of the backward-shift would have
++ * however waited for the service of agg before being served.
+  *
+- * When the weight of a class is increased or the lmax of the class is
+- * decreased, a new aggregate with smaller slot size than the original
+- * parent aggregate of the class may happen to be activated. The
+- * activation of this aggregate should be properly delayed to when the
+- * service of the class has finished in the ideal system tracked by
+- * QFQ+. If the activation of the aggregate is not delayed to this
+- * reference time instant, then this aggregate may be unjustly served
+- * before other aggregates waiting for service. This may cause the
+- * above bound to the slot index to be violated for some of these
+- * unlucky aggregates.
++ * The other event that may cause the slot index to be higher than 2
++ * for agg is a recent change of the parameters of some class. If the
++ * weight of a class is increased or the lmax (max_pkt_size) of the
++ * class is decreased, then a new aggregate with smaller slot size
++ * than the original parent aggregate of the class may happen to be
++ * activated. The activation of this aggregate should be properly
++ * delayed to when the service of the class has finished in the ideal
++ * system tracked by QFQ+. If the activation of the aggregate is not
++ * delayed to this reference time instant, then this aggregate may be
++ * unjustly served before other aggregates waiting for service. This
++ * may cause the above bound to the slot index to be violated for some
++ * of these unlucky aggregates.
+  *
+  * Instead of delaying the activation of the new aggregate, which is
+- * quite complex, the following inaccurate but simple solution is used:
+- * if the slot index is higher than QFQ_MAX_SLOTS-2, then the
+- * timestamps of the aggregate are shifted backward so as to let the
+- * slot index become equal to QFQ_MAX_SLOTS-2.
++ * quite complex, the above-discussed capping of the slot index is
++ * used to handle also the consequences of a change of the parameters
++ * of a class.
+  */
+ static void qfq_slot_insert(struct qfq_group *grp, struct qfq_aggregate *agg,
+ 			    u64 roundedS)
+@@ -1077,7 +1104,7 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
+ 	else
+ 		in_serv_agg->budget -= len;
+ 
+-	q->V += (u64)len * IWSUM;
++	q->V += (u64)len * q->iwsum;
+ 	pr_debug("qfq dequeue: len %u F %lld now %lld\n",
+ 		 len, (unsigned long long) in_serv_agg->F,
+ 		 (unsigned long long) q->V);
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 37ca969..22c88d2 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -1583,11 +1583,11 @@ out_cud_release:
+ 	case SIOCX25CALLACCPTAPPRV: {
+ 		rc = -EINVAL;
+ 		lock_sock(sk);
+-		if (sk->sk_state != TCP_CLOSE)
+-			break;
+-		clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
++		if (sk->sk_state == TCP_CLOSE) {
++			clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
++			rc = 0;
++		}
+ 		release_sock(sk);
+-		rc = 0;
+ 		break;
+ 	}
+ 
+@@ -1595,14 +1595,15 @@ out_cud_release:
+ 		rc = -EINVAL;
+ 		lock_sock(sk);
+ 		if (sk->sk_state != TCP_ESTABLISHED)
+-			break;
++			goto out_sendcallaccpt_release;
+ 		/* must call accptapprv above */
+ 		if (test_bit(X25_ACCPT_APPRV_FLAG, &x25->flags))
+-			break;
++			goto out_sendcallaccpt_release;
+ 		x25_write_internal(sk, X25_CALL_ACCEPTED);
+ 		x25->state = X25_STATE_3;
+-		release_sock(sk);
+ 		rc = 0;
++out_sendcallaccpt_release:
++		release_sock(sk);
+ 		break;
+ 	}
+ 
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 1d9d642..e849e1e 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -417,9 +417,11 @@ static void stac_update_outputs(struct hda_codec *codec)
+ 			val &= ~spec->eapd_mask;
+ 		else
+ 			val |= spec->eapd_mask;
+-		if (spec->gpio_data != val)
++		if (spec->gpio_data != val) {
++			spec->gpio_data = val;
+ 			stac_gpio_set(codec, spec->gpio_mask, spec->gpio_dir,
+ 				      val);
++		}
+ 	}
+ }
+ 
+@@ -3227,7 +3229,7 @@ static const struct hda_fixup stac927x_fixups[] = {
+ 			/* configure the analog microphone on some laptops */
+ 			{ 0x0c, 0x90a79130 },
+ 			/* correct the front output jack as a hp out */
+-			{ 0x0f, 0x0227011f },
++			{ 0x0f, 0x0221101f },
+ 			/* correct the front input jack as a mic */
+ 			{ 0x0e, 0x02a79130 },
+ 			{}
+@@ -3608,20 +3610,18 @@ static int stac_parse_auto_config(struct hda_codec *codec)
+ static int stac_init(struct hda_codec *codec)
+ {
+ 	struct sigmatel_spec *spec = codec->spec;
+-	unsigned int gpio;
+ 	int i;
+ 
+ 	/* override some hints */
+ 	stac_store_hints(codec);
+ 
+ 	/* set up GPIO */
+-	gpio = spec->gpio_data;
+ 	/* turn on EAPD statically when spec->eapd_switch isn't set.
+ 	 * otherwise, unsol event will turn it on/off dynamically
+ 	 */
+ 	if (!spec->eapd_switch)
+-		gpio |= spec->eapd_mask;
+-	stac_gpio_set(codec, spec->gpio_mask, spec->gpio_dir, gpio);
++		spec->gpio_data |= spec->eapd_mask;
++	stac_gpio_set(codec, spec->gpio_mask, spec->gpio_dir, spec->gpio_data);
+ 
+ 	snd_hda_gen_init(codec);
+ 
+@@ -3921,6 +3921,7 @@ static void stac_setup_gpio(struct hda_codec *codec)
+ {
+ 	struct sigmatel_spec *spec = codec->spec;
+ 
++	spec->gpio_mask |= spec->eapd_mask;
+ 	if (spec->gpio_led) {
+ 		if (!spec->vref_mute_led_nid) {
+ 			spec->gpio_mask |= spec->gpio_led;
+diff --git a/sound/usb/6fire/pcm.c b/sound/usb/6fire/pcm.c
+index 8221ff2..074aaf7 100644
+--- a/sound/usb/6fire/pcm.c
++++ b/sound/usb/6fire/pcm.c
+@@ -543,7 +543,7 @@ static snd_pcm_uframes_t usb6fire_pcm_pointer(
+ 	snd_pcm_uframes_t ret;
+ 
+ 	if (rt->panic || !sub)
+-		return SNDRV_PCM_STATE_XRUN;
++		return SNDRV_PCM_POS_XRUN;
+ 
+ 	spin_lock_irqsave(&sub->lock, flags);
+ 	ret = sub->dma_off;

Added: genpatches-2.6/trunk/3.10.7/1004_linux-3.10.5.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/1004_linux-3.10.5.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/1004_linux-3.10.5.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,4826 @@
+diff --git a/Makefile b/Makefile
+index b4df9b2..f8349d0 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+ NAME = Unicycling Gorilla
+ 
+diff --git a/arch/arm/boot/compressed/atags_to_fdt.c b/arch/arm/boot/compressed/atags_to_fdt.c
+index aabc02a..d1153c8 100644
+--- a/arch/arm/boot/compressed/atags_to_fdt.c
++++ b/arch/arm/boot/compressed/atags_to_fdt.c
+@@ -53,6 +53,17 @@ static const void *getprop(const void *fdt, const char *node_path,
+ 	return fdt_getprop(fdt, offset, property, len);
+ }
+ 
++static uint32_t get_cell_size(const void *fdt)
++{
++	int len;
++	uint32_t cell_size = 1;
++	const uint32_t *size_len =  getprop(fdt, "/", "#size-cells", &len);
++
++	if (size_len)
++		cell_size = fdt32_to_cpu(*size_len);
++	return cell_size;
++}
++
+ static void merge_fdt_bootargs(void *fdt, const char *fdt_cmdline)
+ {
+ 	char cmdline[COMMAND_LINE_SIZE];
+@@ -95,9 +106,11 @@ static void merge_fdt_bootargs(void *fdt, const char *fdt_cmdline)
+ int atags_to_fdt(void *atag_list, void *fdt, int total_space)
+ {
+ 	struct tag *atag = atag_list;
+-	uint32_t mem_reg_property[2 * NR_BANKS];
++	/* In the case of 64 bits memory size, need to reserve 2 cells for
++	 * address and size for each bank */
++	uint32_t mem_reg_property[2 * 2 * NR_BANKS];
+ 	int memcount = 0;
+-	int ret;
++	int ret, memsize;
+ 
+ 	/* make sure we've got an aligned pointer */
+ 	if ((u32)atag_list & 0x3)
+@@ -137,8 +150,25 @@ int atags_to_fdt(void *atag_list, void *fdt, int total_space)
+ 				continue;
+ 			if (!atag->u.mem.size)
+ 				continue;
+-			mem_reg_property[memcount++] = cpu_to_fdt32(atag->u.mem.start);
+-			mem_reg_property[memcount++] = cpu_to_fdt32(atag->u.mem.size);
++			memsize = get_cell_size(fdt);
++
++			if (memsize == 2) {
++				/* if memsize is 2, that means that
++				 * each data needs 2 cells of 32 bits,
++				 * so the data are 64 bits */
++				uint64_t *mem_reg_prop64 =
++					(uint64_t *)mem_reg_property;
++				mem_reg_prop64[memcount++] =
++					cpu_to_fdt64(atag->u.mem.start);
++				mem_reg_prop64[memcount++] =
++					cpu_to_fdt64(atag->u.mem.size);
++			} else {
++				mem_reg_property[memcount++] =
++					cpu_to_fdt32(atag->u.mem.start);
++				mem_reg_property[memcount++] =
++					cpu_to_fdt32(atag->u.mem.size);
++			}
++
+ 		} else if (atag->hdr.tag == ATAG_INITRD2) {
+ 			uint32_t initrd_start, initrd_size;
+ 			initrd_start = atag->u.initrd.start;
+@@ -150,8 +180,10 @@ int atags_to_fdt(void *atag_list, void *fdt, int total_space)
+ 		}
+ 	}
+ 
+-	if (memcount)
+-		setprop(fdt, "/memory", "reg", mem_reg_property, 4*memcount);
++	if (memcount) {
++		setprop(fdt, "/memory", "reg", mem_reg_property,
++			4 * memcount * memsize);
++	}
+ 
+ 	return fdt_pack(fdt);
+ }
+diff --git a/arch/powerpc/include/asm/module.h b/arch/powerpc/include/asm/module.h
+index c1df590..49fa55b 100644
+--- a/arch/powerpc/include/asm/module.h
++++ b/arch/powerpc/include/asm/module.h
+@@ -82,10 +82,9 @@ struct exception_table_entry;
+ void sort_ex_table(struct exception_table_entry *start,
+ 		   struct exception_table_entry *finish);
+ 
+-#ifdef CONFIG_MODVERSIONS
++#if defined(CONFIG_MODVERSIONS) && defined(CONFIG_PPC64)
+ #define ARCH_RELOCATES_KCRCTAB
+-
+-extern const unsigned long reloc_start[];
++#define reloc_start PHYSICAL_START
+ #endif
+ #endif /* __KERNEL__ */
+ #endif	/* _ASM_POWERPC_MODULE_H */
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index 654e479..f096e72 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -38,9 +38,6 @@ jiffies = jiffies_64 + 4;
+ #endif
+ SECTIONS
+ {
+-	. = 0;
+-	reloc_start = .;
+-
+ 	. = KERNELBASE;
+ 
+ /*
+diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
+index b44577b..ec94e11 100644
+--- a/arch/x86/kernel/acpi/sleep.c
++++ b/arch/x86/kernel/acpi/sleep.c
+@@ -48,9 +48,20 @@ int acpi_suspend_lowlevel(void)
+ #ifndef CONFIG_64BIT
+ 	native_store_gdt((struct desc_ptr *)&header->pmode_gdt);
+ 
++	/*
++	 * We have to check that we can write back the value, and not
++	 * just read it.  At least on 90 nm Pentium M (Family 6, Model
++	 * 13), reading an invalid MSR is not guaranteed to trap, see
++	 * Erratum X4 in "Intel Pentium M Processor on 90 nm Process
++	 * with 2-MB L2 Cache and Intel® Processor A100 and A110 on 90
++	 * nm process with 512-KB L2 Cache Specification Update".
++	 */
+ 	if (!rdmsr_safe(MSR_EFER,
+ 			&header->pmode_efer_low,
+-			&header->pmode_efer_high))
++			&header->pmode_efer_high) &&
++	    !wrmsr_safe(MSR_EFER,
++			header->pmode_efer_low,
++			header->pmode_efer_high))
+ 		header->pmode_behavior |= (1 << WAKEUP_BEHAVIOR_RESTORE_EFER);
+ #endif /* !CONFIG_64BIT */
+ 
+@@ -61,7 +72,10 @@ int acpi_suspend_lowlevel(void)
+ 	}
+ 	if (!rdmsr_safe(MSR_IA32_MISC_ENABLE,
+ 			&header->pmode_misc_en_low,
+-			&header->pmode_misc_en_high))
++			&header->pmode_misc_en_high) &&
++	    !wrmsr_safe(MSR_IA32_MISC_ENABLE,
++			header->pmode_misc_en_low,
++			header->pmode_misc_en_high))
+ 		header->pmode_behavior |=
+ 			(1 << WAKEUP_BEHAVIOR_RESTORE_MISC_ENABLE);
+ 	header->realmode_flags = acpi_realmode_flags;
+diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
+index fa72a39..3982357 100644
+--- a/arch/x86/kernel/cpu/mtrr/generic.c
++++ b/arch/x86/kernel/cpu/mtrr/generic.c
+@@ -510,8 +510,9 @@ generic_get_free_region(unsigned long base, unsigned long size, int replace_reg)
+ static void generic_get_mtrr(unsigned int reg, unsigned long *base,
+ 			     unsigned long *size, mtrr_type *type)
+ {
+-	unsigned int mask_lo, mask_hi, base_lo, base_hi;
+-	unsigned int tmp, hi;
++	u32 mask_lo, mask_hi, base_lo, base_hi;
++	unsigned int hi;
++	u64 tmp, mask;
+ 
+ 	/*
+ 	 * get_mtrr doesn't need to update mtrr_state, also it could be called
+@@ -532,18 +533,18 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base,
+ 	rdmsr(MTRRphysBase_MSR(reg), base_lo, base_hi);
+ 
+ 	/* Work out the shifted address mask: */
+-	tmp = mask_hi << (32 - PAGE_SHIFT) | mask_lo >> PAGE_SHIFT;
+-	mask_lo = size_or_mask | tmp;
++	tmp = (u64)mask_hi << (32 - PAGE_SHIFT) | mask_lo >> PAGE_SHIFT;
++	mask = size_or_mask | tmp;
+ 
+ 	/* Expand tmp with high bits to all 1s: */
+-	hi = fls(tmp);
++	hi = fls64(tmp);
+ 	if (hi > 0) {
+-		tmp |= ~((1<<(hi - 1)) - 1);
++		tmp |= ~((1ULL<<(hi - 1)) - 1);
+ 
+-		if (tmp != mask_lo) {
++		if (tmp != mask) {
+ 			printk(KERN_WARNING "mtrr: your BIOS has configured an incorrect mask, fixing it.\n");
+ 			add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+-			mask_lo = tmp;
++			mask = tmp;
+ 		}
+ 	}
+ 
+@@ -551,8 +552,8 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base,
+ 	 * This works correctly if size is a power of two, i.e. a
+ 	 * contiguous range:
+ 	 */
+-	*size = -mask_lo;
+-	*base = base_hi << (32 - PAGE_SHIFT) | base_lo >> PAGE_SHIFT;
++	*size = -mask;
++	*base = (u64)base_hi << (32 - PAGE_SHIFT) | base_lo >> PAGE_SHIFT;
+ 	*type = base_lo & 0xff;
+ 
+ out_put_cpu:
+diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
+index 726bf96..ca22b73 100644
+--- a/arch/x86/kernel/cpu/mtrr/main.c
++++ b/arch/x86/kernel/cpu/mtrr/main.c
+@@ -305,7 +305,8 @@ int mtrr_add_page(unsigned long base, unsigned long size,
+ 		return -EINVAL;
+ 	}
+ 
+-	if (base & size_or_mask || size & size_or_mask) {
++	if ((base | (base + size - 1)) >>
++	    (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) {
+ 		pr_warning("mtrr: base or size exceeds the MTRR width\n");
+ 		return -EINVAL;
+ 	}
+@@ -583,6 +584,7 @@ static struct syscore_ops mtrr_syscore_ops = {
+ 
+ int __initdata changed_by_mtrr_cleanup;
+ 
++#define SIZE_OR_MASK_BITS(n)  (~((1ULL << ((n) - PAGE_SHIFT)) - 1))
+ /**
+  * mtrr_bp_init - initialize mtrrs on the boot CPU
+  *
+@@ -600,7 +602,7 @@ void __init mtrr_bp_init(void)
+ 
+ 	if (cpu_has_mtrr) {
+ 		mtrr_if = &generic_mtrr_ops;
+-		size_or_mask = 0xff000000;			/* 36 bits */
++		size_or_mask = SIZE_OR_MASK_BITS(36);
+ 		size_and_mask = 0x00f00000;
+ 		phys_addr = 36;
+ 
+@@ -619,7 +621,7 @@ void __init mtrr_bp_init(void)
+ 			     boot_cpu_data.x86_mask == 0x4))
+ 				phys_addr = 36;
+ 
+-			size_or_mask = ~((1ULL << (phys_addr - PAGE_SHIFT)) - 1);
++			size_or_mask = SIZE_OR_MASK_BITS(phys_addr);
+ 			size_and_mask = ~size_or_mask & 0xfffff00000ULL;
+ 		} else if (boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR &&
+ 			   boot_cpu_data.x86 == 6) {
+@@ -627,7 +629,7 @@ void __init mtrr_bp_init(void)
+ 			 * VIA C* family have Intel style MTRRs,
+ 			 * but don't support PAE
+ 			 */
+-			size_or_mask = 0xfff00000;		/* 32 bits */
++			size_or_mask = SIZE_OR_MASK_BITS(32);
+ 			size_and_mask = 0;
+ 			phys_addr = 32;
+ 		}
+@@ -637,21 +639,21 @@ void __init mtrr_bp_init(void)
+ 			if (cpu_has_k6_mtrr) {
+ 				/* Pre-Athlon (K6) AMD CPU MTRRs */
+ 				mtrr_if = mtrr_ops[X86_VENDOR_AMD];
+-				size_or_mask = 0xfff00000;	/* 32 bits */
++				size_or_mask = SIZE_OR_MASK_BITS(32);
+ 				size_and_mask = 0;
+ 			}
+ 			break;
+ 		case X86_VENDOR_CENTAUR:
+ 			if (cpu_has_centaur_mcr) {
+ 				mtrr_if = mtrr_ops[X86_VENDOR_CENTAUR];
+-				size_or_mask = 0xfff00000;	/* 32 bits */
++				size_or_mask = SIZE_OR_MASK_BITS(32);
+ 				size_and_mask = 0;
+ 			}
+ 			break;
+ 		case X86_VENDOR_CYRIX:
+ 			if (cpu_has_cyrix_arr) {
+ 				mtrr_if = mtrr_ops[X86_VENDOR_CYRIX];
+-				size_or_mask = 0xfff00000;	/* 32 bits */
++				size_or_mask = SIZE_OR_MASK_BITS(32);
+ 				size_and_mask = 0;
+ 			}
+ 			break;
+diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
+index 321d65e..a836860 100644
+--- a/arch/x86/kernel/head_64.S
++++ b/arch/x86/kernel/head_64.S
+@@ -513,7 +513,7 @@ ENTRY(phys_base)
+ #include "../../x86/xen/xen-head.S"
+ 	
+ 	.section .bss, "aw", @nobits
+-	.align L1_CACHE_BYTES
++	.align PAGE_SIZE
+ ENTRY(idt_table)
+ 	.skip IDT_ENTRIES * 16
+ 
+diff --git a/drivers/acpi/acpi_memhotplug.c b/drivers/acpi/acpi_memhotplug.c
+index 5e6301e..2cf0244 100644
+--- a/drivers/acpi/acpi_memhotplug.c
++++ b/drivers/acpi/acpi_memhotplug.c
+@@ -283,6 +283,7 @@ static int acpi_memory_device_add(struct acpi_device *device,
+ 	/* Get the range from the _CRS */
+ 	result = acpi_memory_get_device_resources(mem_device);
+ 	if (result) {
++		device->driver_data = NULL;
+ 		kfree(mem_device);
+ 		return result;
+ 	}
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 14807e5..af658b2 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -237,10 +237,12 @@ static void acpi_scan_bus_device_check(acpi_handle handle, u32 ost_source)
+ 
+ 	mutex_lock(&acpi_scan_lock);
+ 
+-	acpi_bus_get_device(handle, &device);
+-	if (device) {
+-		dev_warn(&device->dev, "Attempt to re-insert\n");
+-		goto out;
++	if (ost_source != ACPI_NOTIFY_BUS_CHECK) {
++		acpi_bus_get_device(handle, &device);
++		if (device) {
++			dev_warn(&device->dev, "Attempt to re-insert\n");
++			goto out;
++		}
+ 	}
+ 	acpi_evaluate_hotplug_ost(handle, ost_source,
+ 				  ACPI_OST_SC_INSERT_IN_PROGRESS, NULL);
+@@ -1890,6 +1892,9 @@ static acpi_status acpi_bus_device_attach(acpi_handle handle, u32 lvl_not_used,
+ 	if (acpi_bus_get_device(handle, &device))
+ 		return AE_CTRL_DEPTH;
+ 
++	if (device->handler)
++		return AE_OK;
++
+ 	ret = acpi_scan_attach_handler(device);
+ 	if (ret)
+ 		return ret > 0 ? AE_OK : AE_CTRL_DEPTH;
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index 440eadf..0e4b96b 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -450,6 +450,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
+ 	},
+ 	{
+ 	 .callback = video_ignore_initial_backlight,
++	 .ident = "Fujitsu E753",
++	 .matches = {
++		DMI_MATCH(DMI_BOARD_VENDOR, "FUJITSU"),
++		DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E753"),
++		},
++	},
++	{
++	 .callback = video_ignore_initial_backlight,
+ 	 .ident = "HP Pavilion dm4",
+ 	 .matches = {
+ 		DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
+diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
+index a5a3ebc..78eabff 100644
+--- a/drivers/ata/Kconfig
++++ b/drivers/ata/Kconfig
+@@ -107,7 +107,7 @@ config SATA_FSL
+ 	  If unsure, say N.
+ 
+ config SATA_INIC162X
+-	tristate "Initio 162x SATA support"
++	tristate "Initio 162x SATA support (Very Experimental)"
+ 	depends on PCI
+ 	help
+ 	  This option enables support for Initio 162x Serial ATA.
+diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
+index 8eae659..b92913a 100644
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -330,7 +330,7 @@ static const struct pci_device_id piix_pci_tbl[] = {
+ 	/* SATA Controller IDE (Wellsburg) */
+ 	{ 0x8086, 0x8d00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+ 	/* SATA Controller IDE (Wellsburg) */
+-	{ 0x8086, 0x8d08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
++	{ 0x8086, 0x8d08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
+ 	/* SATA Controller IDE (Wellsburg) */
+ 	{ 0x8086, 0x8d60, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+ 	/* SATA Controller IDE (Wellsburg) */
+diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
+index 1e6827c..74456fa 100644
+--- a/drivers/ata/sata_inic162x.c
++++ b/drivers/ata/sata_inic162x.c
+@@ -6,6 +6,18 @@
+  *
+  * This file is released under GPL v2.
+  *
++ * **** WARNING ****
++ *
++ * This driver never worked properly and unfortunately data corruption is
++ * relatively common.  There isn't anyone working on the driver and there's
++ * no support from the vendor.  Do not use this driver in any production
++ * environment.
++ *
++ * http://thread.gmane.org/gmane.linux.debian.devel.bugs.rc/378525/focus=54491
++ * https://bugzilla.kernel.org/show_bug.cgi?id=60565
++ *
++ * *****************
++ *
+  * This controller is eccentric and easily locks up if something isn't
+  * right.  Documentation is available at initio's website but it only
+  * documents registers (not programming model).
+@@ -807,6 +819,8 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 
+ 	ata_print_version_once(&pdev->dev, DRV_VERSION);
+ 
++	dev_alert(&pdev->dev, "inic162x support is broken with common data corruption issues and will be disabled by default, contact linux-ide@×××××××××××.org if in production use\n");
++
+ 	/* alloc host */
+ 	host = ata_host_alloc_pinfo(&pdev->dev, ppi, NR_PORTS);
+ 	hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL);
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index a941dcf..d0c81d1 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1717,7 +1717,7 @@ int regmap_async_complete(struct regmap *map)
+ 	int ret;
+ 
+ 	/* Nothing to do with no async support */
+-	if (!map->bus->async_write)
++	if (!map->bus || !map->bus->async_write)
+ 		return 0;
+ 
+ 	trace_regmap_async_complete_start(map->dev);
+diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
+index dd5b2fe..d81dfca 100644
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -647,7 +647,18 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
+ 	int status = BLKIF_RSP_OKAY;
+ 	struct block_device *bdev = blkif->vbd.bdev;
+ 	unsigned long secure;
++	struct phys_req preq;
++
++	preq.sector_number = req->u.discard.sector_number;
++	preq.nr_sects      = req->u.discard.nr_sectors;
+ 
++	err = xen_vbd_translate(&preq, blkif, WRITE);
++	if (err) {
++		pr_warn(DRV_PFX "access denied: DISCARD [%llu->%llu] on dev=%04x\n",
++			preq.sector_number,
++			preq.sector_number + preq.nr_sects, blkif->vbd.pdevice);
++		goto fail_response;
++	}
+ 	blkif->st_ds_req++;
+ 
+ 	xen_blkif_get(blkif);
+@@ -658,7 +669,7 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
+ 	err = blkdev_issue_discard(bdev, req->u.discard.sector_number,
+ 				   req->u.discard.nr_sectors,
+ 				   GFP_KERNEL, secure);
+-
++fail_response:
+ 	if (err == -EOPNOTSUPP) {
+ 		pr_debug(DRV_PFX "discard op failed, not supported\n");
+ 		status = BLKIF_RSP_EOPNOTSUPP;
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 07f2840..6d6a0b4 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -103,10 +103,10 @@ struct pstate_adjust_policy {
+ static struct pstate_adjust_policy default_policy = {
+ 	.sample_rate_ms = 10,
+ 	.deadband = 0,
+-	.setpoint = 109,
+-	.p_gain_pct = 17,
++	.setpoint = 97,
++	.p_gain_pct = 20,
+ 	.d_gain_pct = 0,
+-	.i_gain_pct = 4,
++	.i_gain_pct = 0,
+ };
+ 
+ struct perf_limits {
+@@ -468,12 +468,12 @@ static inline void intel_pstate_set_sample_time(struct cpudata *cpu)
+ static inline int intel_pstate_get_scaled_busy(struct cpudata *cpu)
+ {
+ 	int32_t busy_scaled;
+-	int32_t core_busy, turbo_pstate, current_pstate;
++	int32_t core_busy, max_pstate, current_pstate;
+ 
+ 	core_busy = int_tofp(cpu->samples[cpu->sample_ptr].core_pct_busy);
+-	turbo_pstate = int_tofp(cpu->pstate.turbo_pstate);
++	max_pstate = int_tofp(cpu->pstate.max_pstate);
+ 	current_pstate = int_tofp(cpu->pstate.current_pstate);
+-	busy_scaled = mul_fp(core_busy, div_fp(turbo_pstate, current_pstate));
++	busy_scaled = mul_fp(core_busy, div_fp(max_pstate, current_pstate));
+ 
+ 	return fp_toint(busy_scaled);
+ }
+diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
+index 5996521..84573b4 100644
+--- a/drivers/crypto/caam/caamhash.c
++++ b/drivers/crypto/caam/caamhash.c
+@@ -429,7 +429,7 @@ static int hash_digest_key(struct caam_hash_ctx *ctx, const u8 *key_in,
+ 	dma_addr_t src_dma, dst_dma;
+ 	int ret = 0;
+ 
+-	desc = kmalloc(CAAM_CMD_SZ * 6 + CAAM_PTR_SZ * 2, GFP_KERNEL | GFP_DMA);
++	desc = kmalloc(CAAM_CMD_SZ * 8 + CAAM_PTR_SZ * 2, GFP_KERNEL | GFP_DMA);
+ 	if (!desc) {
+ 		dev_err(jrdev, "unable to allocate key input memory\n");
+ 		return -ENOMEM;
+diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
+index 7ef316f..ac1b43a 100644
+--- a/drivers/firewire/core-cdev.c
++++ b/drivers/firewire/core-cdev.c
+@@ -54,6 +54,7 @@
+ #define FW_CDEV_KERNEL_VERSION			5
+ #define FW_CDEV_VERSION_EVENT_REQUEST2		4
+ #define FW_CDEV_VERSION_ALLOCATE_REGION_END	4
++#define FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW	5
+ 
+ struct client {
+ 	u32 version;
+@@ -1005,6 +1006,8 @@ static int ioctl_create_iso_context(struct client *client, union ioctl_arg *arg)
+ 			a->channel, a->speed, a->header_size, cb, client);
+ 	if (IS_ERR(context))
+ 		return PTR_ERR(context);
++	if (client->version < FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW)
++		context->drop_overflow_headers = true;
+ 
+ 	/* We only support one context at this time. */
+ 	spin_lock_irq(&client->lock);
+diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
+index 9e1db64..afb701e 100644
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -2749,8 +2749,11 @@ static void copy_iso_headers(struct iso_context *ctx, const u32 *dma_hdr)
+ {
+ 	u32 *ctx_hdr;
+ 
+-	if (ctx->header_length + ctx->base.header_size > PAGE_SIZE)
++	if (ctx->header_length + ctx->base.header_size > PAGE_SIZE) {
++		if (ctx->base.drop_overflow_headers)
++			return;
+ 		flush_iso_completions(ctx);
++	}
+ 
+ 	ctx_hdr = ctx->header + ctx->header_length;
+ 	ctx->last_timestamp = (u16)le32_to_cpu((__force __le32)dma_hdr[0]);
+@@ -2910,8 +2913,11 @@ static int handle_it_packet(struct context *context,
+ 
+ 	sync_it_packet_for_cpu(context, d);
+ 
+-	if (ctx->header_length + 4 > PAGE_SIZE)
++	if (ctx->header_length + 4 > PAGE_SIZE) {
++		if (ctx->base.drop_overflow_headers)
++			return 1;
+ 		flush_iso_completions(ctx);
++	}
+ 
+ 	ctx_hdr = ctx->header + ctx->header_length;
+ 	ctx->last_timestamp = le16_to_cpu(last->res_count);
+diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
+index 3b315ba..f968590 100644
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -1511,6 +1511,13 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
+ 	dev_priv->dev = dev;
+ 	dev_priv->info = info;
+ 
++	spin_lock_init(&dev_priv->irq_lock);
++	spin_lock_init(&dev_priv->gpu_error.lock);
++	spin_lock_init(&dev_priv->rps.lock);
++	mutex_init(&dev_priv->dpio_lock);
++	mutex_init(&dev_priv->rps.hw_lock);
++	mutex_init(&dev_priv->modeset_restore_lock);
++
+ 	i915_dump_device_info(dev_priv);
+ 
+ 	if (i915_get_bridge_dev(dev)) {
+@@ -1601,6 +1608,8 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
+ 	intel_detect_pch(dev);
+ 
+ 	intel_irq_init(dev);
++	intel_pm_init(dev);
++	intel_gt_sanitize(dev);
+ 	intel_gt_init(dev);
+ 
+ 	/* Try to make sure MCHBAR is enabled before poking at it */
+@@ -1626,14 +1635,6 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
+ 	if (!IS_I945G(dev) && !IS_I945GM(dev))
+ 		pci_enable_msi(dev->pdev);
+ 
+-	spin_lock_init(&dev_priv->irq_lock);
+-	spin_lock_init(&dev_priv->gpu_error.lock);
+-	spin_lock_init(&dev_priv->rps.lock);
+-	mutex_init(&dev_priv->dpio_lock);
+-
+-	mutex_init(&dev_priv->rps.hw_lock);
+-	mutex_init(&dev_priv->modeset_restore_lock);
+-
+ 	dev_priv->num_plane = 1;
+ 	if (IS_VALLEYVIEW(dev))
+ 		dev_priv->num_plane = 2;
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index a2e4953..bc6cd31 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -685,7 +685,7 @@ static int i915_drm_thaw(struct drm_device *dev)
+ {
+ 	int error = 0;
+ 
+-	intel_gt_reset(dev);
++	intel_gt_sanitize(dev);
+ 
+ 	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+ 		mutex_lock(&dev->struct_mutex);
+@@ -711,7 +711,7 @@ int i915_resume(struct drm_device *dev)
+ 
+ 	pci_set_master(dev->pdev);
+ 
+-	intel_gt_reset(dev);
++	intel_gt_sanitize(dev);
+ 
+ 	/*
+ 	 * Platforms with opregion should have sane BIOS, older ones (gen3 and
+@@ -1247,21 +1247,21 @@ hsw_unclaimed_reg_check(struct drm_i915_private *dev_priv, u32 reg)
+ 
+ #define __i915_read(x, y) \
+ u##x i915_read##x(struct drm_i915_private *dev_priv, u32 reg) { \
++	unsigned long irqflags; \
+ 	u##x val = 0; \
++	spin_lock_irqsave(&dev_priv->gt_lock, irqflags); \
+ 	if (IS_GEN5(dev_priv->dev)) \
+ 		ilk_dummy_write(dev_priv); \
+ 	if (NEEDS_FORCE_WAKE((dev_priv), (reg))) { \
+-		unsigned long irqflags; \
+-		spin_lock_irqsave(&dev_priv->gt_lock, irqflags); \
+ 		if (dev_priv->forcewake_count == 0) \
+ 			dev_priv->gt.force_wake_get(dev_priv); \
+ 		val = read##y(dev_priv->regs + reg); \
+ 		if (dev_priv->forcewake_count == 0) \
+ 			dev_priv->gt.force_wake_put(dev_priv); \
+-		spin_unlock_irqrestore(&dev_priv->gt_lock, irqflags); \
+ 	} else { \
+ 		val = read##y(dev_priv->regs + reg); \
+ 	} \
++	spin_unlock_irqrestore(&dev_priv->gt_lock, irqflags); \
+ 	trace_i915_reg_rw(false, reg, val, sizeof(val)); \
+ 	return val; \
+ }
+@@ -1274,8 +1274,10 @@ __i915_read(64, q)
+ 
+ #define __i915_write(x, y) \
+ void i915_write##x(struct drm_i915_private *dev_priv, u32 reg, u##x val) { \
++	unsigned long irqflags; \
+ 	u32 __fifo_ret = 0; \
+ 	trace_i915_reg_rw(true, reg, val, sizeof(val)); \
++	spin_lock_irqsave(&dev_priv->gt_lock, irqflags); \
+ 	if (NEEDS_FORCE_WAKE((dev_priv), (reg))) { \
+ 		__fifo_ret = __gen6_gt_wait_for_fifo(dev_priv); \
+ 	} \
+@@ -1287,6 +1289,7 @@ void i915_write##x(struct drm_i915_private *dev_priv, u32 reg, u##x val) { \
+ 		gen6_gt_check_fifodbg(dev_priv); \
+ 	} \
+ 	hsw_unclaimed_reg_check(dev_priv, reg); \
++	spin_unlock_irqrestore(&dev_priv->gt_lock, irqflags); \
+ }
+ __i915_write(8, b)
+ __i915_write(16, w)
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 9669a0b..47d8b68 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -491,6 +491,7 @@ enum intel_sbi_destination {
+ #define QUIRK_PIPEA_FORCE (1<<0)
+ #define QUIRK_LVDS_SSC_DISABLE (1<<1)
+ #define QUIRK_INVERT_BRIGHTNESS (1<<2)
++#define QUIRK_NO_PCH_PWM_ENABLE (1<<3)
+ 
+ struct intel_fbdev;
+ struct intel_fbc_work;
+@@ -1474,9 +1475,10 @@ void i915_hangcheck_elapsed(unsigned long data);
+ void i915_handle_error(struct drm_device *dev, bool wedged);
+ 
+ extern void intel_irq_init(struct drm_device *dev);
++extern void intel_pm_init(struct drm_device *dev);
+ extern void intel_hpd_init(struct drm_device *dev);
+ extern void intel_gt_init(struct drm_device *dev);
+-extern void intel_gt_reset(struct drm_device *dev);
++extern void intel_gt_sanitize(struct drm_device *dev);
+ 
+ void i915_error_state_free(struct kref *error_ref);
+ 
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 34118b0..0a30088 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1881,6 +1881,10 @@ i915_gem_object_move_to_active(struct drm_i915_gem_object *obj,
+ 	u32 seqno = intel_ring_get_seqno(ring);
+ 
+ 	BUG_ON(ring == NULL);
++	if (obj->ring != ring && obj->last_write_seqno) {
++		/* Keep the seqno relative to the current ring */
++		obj->last_write_seqno = seqno;
++	}
+ 	obj->ring = ring;
+ 
+ 	/* Add a reference if we're newly entering the active list. */
+@@ -2134,7 +2138,17 @@ void i915_gem_restore_fences(struct drm_device *dev)
+ 
+ 	for (i = 0; i < dev_priv->num_fence_regs; i++) {
+ 		struct drm_i915_fence_reg *reg = &dev_priv->fence_regs[i];
+-		i915_gem_write_fence(dev, i, reg->obj);
++
++		/*
++		 * Commit delayed tiling changes if we have an object still
++		 * attached to the fence, otherwise just clear the fence.
++		 */
++		if (reg->obj) {
++			i915_gem_object_update_fence(reg->obj, reg,
++						     reg->obj->tiling_mode);
++		} else {
++			i915_gem_write_fence(dev, i, NULL);
++		}
+ 	}
+ }
+ 
+@@ -2534,7 +2548,6 @@ static void i965_write_fence_reg(struct drm_device *dev, int reg,
+ 	drm_i915_private_t *dev_priv = dev->dev_private;
+ 	int fence_reg;
+ 	int fence_pitch_shift;
+-	uint64_t val;
+ 
+ 	if (INTEL_INFO(dev)->gen >= 6) {
+ 		fence_reg = FENCE_REG_SANDYBRIDGE_0;
+@@ -2544,8 +2557,23 @@ static void i965_write_fence_reg(struct drm_device *dev, int reg,
+ 		fence_pitch_shift = I965_FENCE_PITCH_SHIFT;
+ 	}
+ 
++	fence_reg += reg * 8;
++
++	/* To w/a incoherency with non-atomic 64-bit register updates,
++	 * we split the 64-bit update into two 32-bit writes. In order
++	 * for a partial fence not to be evaluated between writes, we
++	 * precede the update with write to turn off the fence register,
++	 * and only enable the fence as the last step.
++	 *
++	 * For extra levels of paranoia, we make sure each step lands
++	 * before applying the next step.
++	 */
++	I915_WRITE(fence_reg, 0);
++	POSTING_READ(fence_reg);
++
+ 	if (obj) {
+ 		u32 size = obj->gtt_space->size;
++		uint64_t val;
+ 
+ 		val = (uint64_t)((obj->gtt_offset + size - 4096) &
+ 				 0xfffff000) << 32;
+@@ -2554,12 +2582,16 @@ static void i965_write_fence_reg(struct drm_device *dev, int reg,
+ 		if (obj->tiling_mode == I915_TILING_Y)
+ 			val |= 1 << I965_FENCE_TILING_Y_SHIFT;
+ 		val |= I965_FENCE_REG_VALID;
+-	} else
+-		val = 0;
+ 
+-	fence_reg += reg * 8;
+-	I915_WRITE64(fence_reg, val);
+-	POSTING_READ(fence_reg);
++		I915_WRITE(fence_reg + 4, val >> 32);
++		POSTING_READ(fence_reg + 4);
++
++		I915_WRITE(fence_reg + 0, val);
++		POSTING_READ(fence_reg);
++	} else {
++		I915_WRITE(fence_reg + 4, 0);
++		POSTING_READ(fence_reg + 4);
++	}
+ }
+ 
+ static void i915_write_fence_reg(struct drm_device *dev, int reg,
+@@ -2654,6 +2686,10 @@ static void i915_gem_write_fence(struct drm_device *dev, int reg,
+ 	if (i915_gem_object_needs_mb(dev_priv->fence_regs[reg].obj))
+ 		mb();
+ 
++	WARN(obj && (!obj->stride || !obj->tiling_mode),
++	     "bogus fence setup with stride: 0x%x, tiling mode: %i\n",
++	     obj->stride, obj->tiling_mode);
++
+ 	switch (INTEL_INFO(dev)->gen) {
+ 	case 7:
+ 	case 6:
+@@ -2713,6 +2749,7 @@ static void i915_gem_object_update_fence(struct drm_i915_gem_object *obj,
+ 		fence->obj = NULL;
+ 		list_del_init(&fence->lru_list);
+ 	}
++	obj->fence_dirty = false;
+ }
+ 
+ static int
+@@ -2842,7 +2879,6 @@ i915_gem_object_get_fence(struct drm_i915_gem_object *obj)
+ 		return 0;
+ 
+ 	i915_gem_object_update_fence(obj, reg, enable);
+-	obj->fence_dirty = false;
+ 
+ 	return 0;
+ }
+@@ -4457,7 +4493,7 @@ i915_gem_inactive_shrink(struct shrinker *shrinker, struct shrink_control *sc)
+ 	list_for_each_entry(obj, &dev_priv->mm.unbound_list, gtt_list)
+ 		if (obj->pages_pin_count == 0)
+ 			cnt += obj->base.size >> PAGE_SHIFT;
+-	list_for_each_entry(obj, &dev_priv->mm.inactive_list, gtt_list)
++	list_for_each_entry(obj, &dev_priv->mm.inactive_list, mm_list)
+ 		if (obj->pin_count == 0 && obj->pages_pin_count == 0)
+ 			cnt += obj->base.size >> PAGE_SHIFT;
+ 
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 56746dc..e1f4e6e 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -8146,15 +8146,20 @@ static void intel_set_config_restore_state(struct drm_device *dev,
+ }
+ 
+ static bool
+-is_crtc_connector_off(struct drm_crtc *crtc, struct drm_connector *connectors,
+-		      int num_connectors)
++is_crtc_connector_off(struct drm_mode_set *set)
+ {
+ 	int i;
+ 
+-	for (i = 0; i < num_connectors; i++)
+-		if (connectors[i].encoder &&
+-		    connectors[i].encoder->crtc == crtc &&
+-		    connectors[i].dpms != DRM_MODE_DPMS_ON)
++	if (set->num_connectors == 0)
++		return false;
++
++	if (WARN_ON(set->connectors == NULL))
++		return false;
++
++	for (i = 0; i < set->num_connectors; i++)
++		if (set->connectors[i]->encoder &&
++		    set->connectors[i]->encoder->crtc == set->crtc &&
++		    set->connectors[i]->dpms != DRM_MODE_DPMS_ON)
+ 			return true;
+ 
+ 	return false;
+@@ -8167,10 +8172,8 @@ intel_set_config_compute_mode_changes(struct drm_mode_set *set,
+ 
+ 	/* We should be able to check here if the fb has the same properties
+ 	 * and then just flip_or_move it */
+-	if (set->connectors != NULL &&
+-	    is_crtc_connector_off(set->crtc, *set->connectors,
+-				  set->num_connectors)) {
+-			config->mode_changed = true;
++	if (is_crtc_connector_off(set)) {
++		config->mode_changed = true;
+ 	} else if (set->crtc->fb != set->fb) {
+ 		/* If we have no fb then treat it as a full mode set */
+ 		if (set->crtc->fb == NULL) {
+@@ -8914,6 +8917,17 @@ static void quirk_invert_brightness(struct drm_device *dev)
+ 	DRM_INFO("applying inverted panel brightness quirk\n");
+ }
+ 
++/*
++ * Some machines (Dell XPS13) suffer broken backlight controls if
++ * BLM_PCH_PWM_ENABLE is set.
++ */
++static void quirk_no_pcm_pwm_enable(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++	dev_priv->quirks |= QUIRK_NO_PCH_PWM_ENABLE;
++	DRM_INFO("applying no-PCH_PWM_ENABLE quirk\n");
++}
++
+ struct intel_quirk {
+ 	int device;
+ 	int subsystem_vendor;
+@@ -8983,6 +8997,11 @@ static struct intel_quirk intel_quirks[] = {
+ 
+ 	/* Acer Aspire 4736Z */
+ 	{ 0x2a42, 0x1025, 0x0260, quirk_invert_brightness },
++
++	/* Dell XPS13 HD Sandy Bridge */
++	{ 0x0116, 0x1028, 0x052e, quirk_no_pcm_pwm_enable },
++	/* Dell XPS13 HD and XPS13 FHD Ivy Bridge */
++	{ 0x0166, 0x1028, 0x058b, quirk_no_pcm_pwm_enable },
+ };
+ 
+ static void intel_init_quirks(struct drm_device *dev)
+diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
+index eb5e6e9..33cb87f 100644
+--- a/drivers/gpu/drm/i915/intel_panel.c
++++ b/drivers/gpu/drm/i915/intel_panel.c
+@@ -354,7 +354,8 @@ void intel_panel_enable_backlight(struct drm_device *dev,
+ 		POSTING_READ(reg);
+ 		I915_WRITE(reg, tmp | BLM_PWM_ENABLE);
+ 
+-		if (HAS_PCH_SPLIT(dev)) {
++		if (HAS_PCH_SPLIT(dev) &&
++		    !(dev_priv->quirks & QUIRK_NO_PCH_PWM_ENABLE)) {
+ 			tmp = I915_READ(BLC_PWM_PCH_CTL1);
+ 			tmp |= BLM_PCH_PWM_ENABLE;
+ 			tmp &= ~BLM_PCH_OVERRIDE_ENABLE;
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index aa01128..2cfe9f6 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -4486,7 +4486,7 @@ static void vlv_force_wake_put(struct drm_i915_private *dev_priv)
+ 	gen6_gt_check_fifodbg(dev_priv);
+ }
+ 
+-void intel_gt_reset(struct drm_device *dev)
++void intel_gt_sanitize(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 
+@@ -4497,6 +4497,10 @@ void intel_gt_reset(struct drm_device *dev)
+ 		if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev))
+ 			__gen6_gt_force_wake_mt_reset(dev_priv);
+ 	}
++
++	/* BIOS often leaves RC6 enabled, but disable it for hw init */
++	if (INTEL_INFO(dev)->gen >= 6)
++		intel_disable_gt_powersave(dev);
+ }
+ 
+ void intel_gt_init(struct drm_device *dev)
+@@ -4505,18 +4509,51 @@ void intel_gt_init(struct drm_device *dev)
+ 
+ 	spin_lock_init(&dev_priv->gt_lock);
+ 
+-	intel_gt_reset(dev);
+-
+ 	if (IS_VALLEYVIEW(dev)) {
+ 		dev_priv->gt.force_wake_get = vlv_force_wake_get;
+ 		dev_priv->gt.force_wake_put = vlv_force_wake_put;
+-	} else if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev)) {
++	} else if (IS_HASWELL(dev)) {
+ 		dev_priv->gt.force_wake_get = __gen6_gt_force_wake_mt_get;
+ 		dev_priv->gt.force_wake_put = __gen6_gt_force_wake_mt_put;
++	} else if (IS_IVYBRIDGE(dev)) {
++		u32 ecobus;
++
++		/* IVB configs may use multi-threaded forcewake */
++
++		/* A small trick here - if the bios hasn't configured
++		 * MT forcewake, and if the device is in RC6, then
++		 * force_wake_mt_get will not wake the device and the
++		 * ECOBUS read will return zero. Which will be
++		 * (correctly) interpreted by the test below as MT
++		 * forcewake being disabled.
++		 */
++		mutex_lock(&dev->struct_mutex);
++		__gen6_gt_force_wake_mt_get(dev_priv);
++		ecobus = I915_READ_NOTRACE(ECOBUS);
++		__gen6_gt_force_wake_mt_put(dev_priv);
++		mutex_unlock(&dev->struct_mutex);
++
++		if (ecobus & FORCEWAKE_MT_ENABLE) {
++			dev_priv->gt.force_wake_get =
++						__gen6_gt_force_wake_mt_get;
++			dev_priv->gt.force_wake_put =
++						__gen6_gt_force_wake_mt_put;
++		} else {
++			DRM_INFO("No MT forcewake available on Ivybridge, this can result in issues\n");
++			DRM_INFO("when using vblank-synced partial screen updates.\n");
++			dev_priv->gt.force_wake_get = __gen6_gt_force_wake_get;
++			dev_priv->gt.force_wake_put = __gen6_gt_force_wake_put;
++		}
+ 	} else if (IS_GEN6(dev)) {
+ 		dev_priv->gt.force_wake_get = __gen6_gt_force_wake_get;
+ 		dev_priv->gt.force_wake_put = __gen6_gt_force_wake_put;
+ 	}
++}
++
++void intel_pm_init(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++
+ 	INIT_DELAYED_WORK(&dev_priv->rps.delayed_resume_work,
+ 			  intel_gen6_powersave_work);
+ }
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index 1d5d613..1424f20 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -490,9 +490,6 @@ cleanup_pipe_control(struct intel_ring_buffer *ring)
+ 	struct pipe_control *pc = ring->private;
+ 	struct drm_i915_gem_object *obj;
+ 
+-	if (!ring->private)
+-		return;
+-
+ 	obj = pc->obj;
+ 
+ 	kunmap(sg_page(obj->pages->sgl));
+@@ -500,7 +497,6 @@ cleanup_pipe_control(struct intel_ring_buffer *ring)
+ 	drm_gem_object_unreference(&obj->base);
+ 
+ 	kfree(pc);
+-	ring->private = NULL;
+ }
+ 
+ static int init_render_ring(struct intel_ring_buffer *ring)
+@@ -571,7 +567,10 @@ static void render_ring_cleanup(struct intel_ring_buffer *ring)
+ 	if (HAS_BROKEN_CS_TLB(dev))
+ 		drm_gem_object_unreference(to_gem_object(ring->private));
+ 
+-	cleanup_pipe_control(ring);
++	if (INTEL_INFO(dev)->gen >= 5)
++		cleanup_pipe_control(ring);
++
++	ring->private = NULL;
+ }
+ 
+ static void
+diff --git a/drivers/gpu/drm/nouveau/nv17_fence.c b/drivers/gpu/drm/nouveau/nv17_fence.c
+index 8e47a9b..22aa996 100644
+--- a/drivers/gpu/drm/nouveau/nv17_fence.c
++++ b/drivers/gpu/drm/nouveau/nv17_fence.c
+@@ -76,7 +76,7 @@ nv17_fence_context_new(struct nouveau_channel *chan)
+ 	struct ttm_mem_reg *mem = &priv->bo->bo.mem;
+ 	struct nouveau_object *object;
+ 	u32 start = mem->start * PAGE_SIZE;
+-	u32 limit = mem->start + mem->size - 1;
++	u32 limit = start + mem->size - 1;
+ 	int ret = 0;
+ 
+ 	fctx = chan->fence = kzalloc(sizeof(*fctx), GFP_KERNEL);
+diff --git a/drivers/gpu/drm/nouveau/nv50_fence.c b/drivers/gpu/drm/nouveau/nv50_fence.c
+index f9701e5..0ee3638 100644
+--- a/drivers/gpu/drm/nouveau/nv50_fence.c
++++ b/drivers/gpu/drm/nouveau/nv50_fence.c
+@@ -39,6 +39,8 @@ nv50_fence_context_new(struct nouveau_channel *chan)
+ 	struct nv10_fence_chan *fctx;
+ 	struct ttm_mem_reg *mem = &priv->bo->bo.mem;
+ 	struct nouveau_object *object;
++	u32 start = mem->start * PAGE_SIZE;
++	u32 limit = start + mem->size - 1;
+ 	int ret, i;
+ 
+ 	fctx = chan->fence = kzalloc(sizeof(*fctx), GFP_KERNEL);
+@@ -51,26 +53,28 @@ nv50_fence_context_new(struct nouveau_channel *chan)
+ 	fctx->base.sync = nv17_fence_sync;
+ 
+ 	ret = nouveau_object_new(nv_object(chan->cli), chan->handle,
+-				 NvSema, 0x0002,
++				 NvSema, 0x003d,
+ 				 &(struct nv_dma_class) {
+ 					.flags = NV_DMA_TARGET_VRAM |
+ 						 NV_DMA_ACCESS_RDWR,
+-					.start = mem->start * PAGE_SIZE,
+-					.limit = mem->size - 1,
++					.start = start,
++					.limit = limit,
+ 				 }, sizeof(struct nv_dma_class),
+ 				 &object);
+ 
+ 	/* dma objects for display sync channel semaphore blocks */
+ 	for (i = 0; !ret && i < dev->mode_config.num_crtc; i++) {
+ 		struct nouveau_bo *bo = nv50_display_crtc_sema(dev, i);
++		u32 start = bo->bo.mem.start * PAGE_SIZE;
++		u32 limit = start + bo->bo.mem.size - 1;
+ 
+ 		ret = nouveau_object_new(nv_object(chan->cli), chan->handle,
+ 					 NvEvoSema0 + i, 0x003d,
+ 					 &(struct nv_dma_class) {
+ 						.flags = NV_DMA_TARGET_VRAM |
+ 							 NV_DMA_ACCESS_RDWR,
+-						.start = bo->bo.offset,
+-						.limit = bo->bo.offset + 0xfff,
++						.start = start,
++						.limit = limit,
+ 					 }, sizeof(struct nv_dma_class),
+ 					 &object);
+ 	}
+diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
+index fb441a7..15da7ef 100644
+--- a/drivers/gpu/drm/radeon/atom.c
++++ b/drivers/gpu/drm/radeon/atom.c
+@@ -1222,12 +1222,17 @@ int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
+ 	int r;
+ 
+ 	mutex_lock(&ctx->mutex);
++	/* reset data block */
++	ctx->data_block = 0;
+ 	/* reset reg block */
+ 	ctx->reg_block = 0;
+ 	/* reset fb window */
+ 	ctx->fb_base = 0;
+ 	/* reset io mode */
+ 	ctx->io_mode = ATOM_IO_MM;
++	/* reset divmul */
++	ctx->divmul[0] = 0;
++	ctx->divmul[1] = 0;
+ 	r = atom_execute_table_locked(ctx, index, params);
+ 	mutex_unlock(&ctx->mutex);
+ 	return r;
+diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
+index 064023b..32501f6 100644
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -44,6 +44,41 @@ static char *pre_emph_names[] = {
+ };
+ 
+ /***** radeon AUX functions *****/
++
++/* Atom needs data in little endian format
++ * so swap as appropriate when copying data to
++ * or from atom. Note that atom operates on
++ * dw units.
++ */
++static void radeon_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le)
++{
++#ifdef __BIG_ENDIAN
++	u8 src_tmp[20], dst_tmp[20]; /* used for byteswapping */
++	u32 *dst32, *src32;
++	int i;
++
++	memcpy(src_tmp, src, num_bytes);
++	src32 = (u32 *)src_tmp;
++	dst32 = (u32 *)dst_tmp;
++	if (to_le) {
++		for (i = 0; i < ((num_bytes + 3) / 4); i++)
++			dst32[i] = cpu_to_le32(src32[i]);
++		memcpy(dst, dst_tmp, num_bytes);
++	} else {
++		u8 dws = num_bytes & ~3;
++		for (i = 0; i < ((num_bytes + 3) / 4); i++)
++			dst32[i] = le32_to_cpu(src32[i]);
++		memcpy(dst, dst_tmp, dws);
++		if (num_bytes % 4) {
++			for (i = 0; i < (num_bytes % 4); i++)
++				dst[dws+i] = dst_tmp[dws+i];
++		}
++	}
++#else
++	memcpy(dst, src, num_bytes);
++#endif
++}
++
+ union aux_channel_transaction {
+ 	PROCESS_AUX_CHANNEL_TRANSACTION_PS_ALLOCATION v1;
+ 	PROCESS_AUX_CHANNEL_TRANSACTION_PARAMETERS_V2 v2;
+@@ -65,10 +100,10 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
+ 
+ 	base = (unsigned char *)(rdev->mode_info.atom_context->scratch + 1);
+ 
+-	memcpy(base, send, send_bytes);
++	radeon_copy_swap(base, send, send_bytes, true);
+ 
+-	args.v1.lpAuxRequest = 0 + 4;
+-	args.v1.lpDataOut = 16 + 4;
++	args.v1.lpAuxRequest = cpu_to_le16((u16)(0 + 4));
++	args.v1.lpDataOut = cpu_to_le16((u16)(16 + 4));
+ 	args.v1.ucDataOutLen = 0;
+ 	args.v1.ucChannelID = chan->rec.i2c_id;
+ 	args.v1.ucDelay = delay / 10;
+@@ -102,7 +137,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
+ 		recv_bytes = recv_size;
+ 
+ 	if (recv && recv_size)
+-		memcpy(recv, base + 16, recv_bytes);
++		radeon_copy_swap(recv, base + 16, recv_bytes, false);
+ 
+ 	return recv_bytes;
+ }
+diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
+index b9c6f76..bb9ea36 100644
+--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
++++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
+@@ -157,9 +157,9 @@ static void evergreen_audio_set_dto(struct drm_encoder *encoder, u32 clock)
+ 	 * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
+ 	 * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
+ 	 */
++	WREG32(DCCG_AUDIO_DTO_SOURCE, DCCG_AUDIO_DTO0_SOURCE_SEL(radeon_crtc->crtc_id));
+ 	WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
+ 	WREG32(DCCG_AUDIO_DTO0_MODULE, clock * 100);
+-	WREG32(DCCG_AUDIO_DTO_SOURCE, DCCG_AUDIO_DTO0_SOURCE_SEL(radeon_crtc->crtc_id));
+ }
+ 
+ 
+@@ -177,6 +177,9 @@ void evergreen_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode
+ 	uint32_t offset;
+ 	ssize_t err;
+ 
++	if (!dig || !dig->afmt)
++		return;
++
+ 	/* Silent, r600_hdmi_enable will raise WARN for us */
+ 	if (!dig->afmt->enabled)
+ 		return;
+@@ -280,6 +283,9 @@ void evergreen_hdmi_enable(struct drm_encoder *encoder, bool enable)
+ 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+ 	struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+ 
++	if (!dig || !dig->afmt)
++		return;
++
+ 	/* Silent, r600_hdmi_enable will raise WARN for us */
+ 	if (enable && dig->afmt->enabled)
+ 		return;
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index 6948eb8..b60004e 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -2986,7 +2986,7 @@ void r600_uvd_fence_emit(struct radeon_device *rdev,
+ 			 struct radeon_fence *fence)
+ {
+ 	struct radeon_ring *ring = &rdev->ring[fence->ring];
+-	uint32_t addr = rdev->fence_drv[fence->ring].gpu_addr;
++	uint64_t addr = rdev->fence_drv[fence->ring].gpu_addr;
+ 
+ 	radeon_ring_write(ring, PACKET0(UVD_CONTEXT_ID, 0));
+ 	radeon_ring_write(ring, fence->seq);
+diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
+index e73b2a7..f48240b 100644
+--- a/drivers/gpu/drm/radeon/r600_hdmi.c
++++ b/drivers/gpu/drm/radeon/r600_hdmi.c
+@@ -266,6 +266,9 @@ void r600_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode *mod
+ 	uint32_t offset;
+ 	ssize_t err;
+ 
++	if (!dig || !dig->afmt)
++		return;
++
+ 	/* Silent, r600_hdmi_enable will raise WARN for us */
+ 	if (!dig->afmt->enabled)
+ 		return;
+@@ -448,6 +451,9 @@ void r600_hdmi_enable(struct drm_encoder *encoder, bool enable)
+ 	struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+ 	u32 hdmi = HDMI0_ERROR_ACK;
+ 
++	if (!dig || !dig->afmt)
++		return;
++
+ 	/* Silent, r600_hdmi_enable will raise WARN for us */
+ 	if (enable && dig->afmt->enabled)
+ 		return;
+diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
+index 142ce6c..f4dcfdd 100644
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -408,6 +408,7 @@ struct radeon_sa_manager {
+ 	uint64_t		gpu_addr;
+ 	void			*cpu_ptr;
+ 	uint32_t		domain;
++	uint32_t		align;
+ };
+ 
+ struct radeon_sa_bo;
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index 78edadc..68ce360 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -147,7 +147,7 @@ static uint16_t combios_get_table_offset(struct drm_device *dev,
+ 					 enum radeon_combios_table_offset table)
+ {
+ 	struct radeon_device *rdev = dev->dev_private;
+-	int rev;
++	int rev, size;
+ 	uint16_t offset = 0, check_offset;
+ 
+ 	if (!rdev->bios)
+@@ -156,174 +156,106 @@ static uint16_t combios_get_table_offset(struct drm_device *dev,
+ 	switch (table) {
+ 		/* absolute offset tables */
+ 	case COMBIOS_ASIC_INIT_1_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0xc);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0xc;
+ 		break;
+ 	case COMBIOS_BIOS_SUPPORT_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x14);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x14;
+ 		break;
+ 	case COMBIOS_DAC_PROGRAMMING_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x2a);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x2a;
+ 		break;
+ 	case COMBIOS_MAX_COLOR_DEPTH_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x2c);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x2c;
+ 		break;
+ 	case COMBIOS_CRTC_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x2e);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x2e;
+ 		break;
+ 	case COMBIOS_PLL_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x30);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x30;
+ 		break;
+ 	case COMBIOS_TV_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x32);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x32;
+ 		break;
+ 	case COMBIOS_DFP_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x34);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x34;
+ 		break;
+ 	case COMBIOS_HW_CONFIG_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x36);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x36;
+ 		break;
+ 	case COMBIOS_MULTIMEDIA_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x38);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x38;
+ 		break;
+ 	case COMBIOS_TV_STD_PATCH_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x3e);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x3e;
+ 		break;
+ 	case COMBIOS_LCD_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x40);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x40;
+ 		break;
+ 	case COMBIOS_MOBILE_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x42);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x42;
+ 		break;
+ 	case COMBIOS_PLL_INIT_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x46);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x46;
+ 		break;
+ 	case COMBIOS_MEM_CONFIG_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x48);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x48;
+ 		break;
+ 	case COMBIOS_SAVE_MASK_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x4a);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x4a;
+ 		break;
+ 	case COMBIOS_HARDCODED_EDID_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x4c);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x4c;
+ 		break;
+ 	case COMBIOS_ASIC_INIT_2_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x4e);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x4e;
+ 		break;
+ 	case COMBIOS_CONNECTOR_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x50);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x50;
+ 		break;
+ 	case COMBIOS_DYN_CLK_1_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x52);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x52;
+ 		break;
+ 	case COMBIOS_RESERVED_MEM_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x54);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x54;
+ 		break;
+ 	case COMBIOS_EXT_TMDS_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x58);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x58;
+ 		break;
+ 	case COMBIOS_MEM_CLK_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x5a);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x5a;
+ 		break;
+ 	case COMBIOS_EXT_DAC_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x5c);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x5c;
+ 		break;
+ 	case COMBIOS_MISC_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x5e);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x5e;
+ 		break;
+ 	case COMBIOS_CRT_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x60);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x60;
+ 		break;
+ 	case COMBIOS_INTEGRATED_SYSTEM_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x62);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x62;
+ 		break;
+ 	case COMBIOS_COMPONENT_VIDEO_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x64);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x64;
+ 		break;
+ 	case COMBIOS_FAN_SPEED_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x66);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x66;
+ 		break;
+ 	case COMBIOS_OVERDRIVE_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x68);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x68;
+ 		break;
+ 	case COMBIOS_OEM_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x6a);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x6a;
+ 		break;
+ 	case COMBIOS_DYN_CLK_2_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x6c);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x6c;
+ 		break;
+ 	case COMBIOS_POWER_CONNECTOR_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x6e);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x6e;
+ 		break;
+ 	case COMBIOS_I2C_INFO_TABLE:
+-		check_offset = RBIOS16(rdev->bios_header_start + 0x70);
+-		if (check_offset)
+-			offset = check_offset;
++		check_offset = 0x70;
+ 		break;
+ 		/* relative offset tables */
+ 	case COMBIOS_ASIC_INIT_3_TABLE:	/* offset from misc info */
+@@ -439,11 +371,16 @@ static uint16_t combios_get_table_offset(struct drm_device *dev,
+ 		}
+ 		break;
+ 	default:
++		check_offset = 0;
+ 		break;
+ 	}
+ 
+-	return offset;
++	size = RBIOS8(rdev->bios_header_start + 0x6);
++	/* check absolute offset tables */
++	if (table < COMBIOS_ASIC_INIT_3_TABLE && check_offset && check_offset < size)
++		offset = RBIOS16(rdev->bios_header_start + check_offset);
+ 
++	return offset;
+ }
+ 
+ bool radeon_combios_check_hardcoded_edid(struct radeon_device *rdev)
+@@ -965,16 +902,22 @@ struct radeon_encoder_primary_dac *radeon_combios_get_primary_dac_info(struct
+ 			dac = RBIOS8(dac_info + 0x3) & 0xf;
+ 			p_dac->ps2_pdac_adj = (bg << 8) | (dac);
+ 		}
+-		/* if the values are all zeros, use the table */
+-		if (p_dac->ps2_pdac_adj)
++		/* if the values are zeros, use the table */
++		if ((dac == 0) || (bg == 0))
++			found = 0;
++		else
+ 			found = 1;
+ 	}
+ 
+ 	/* quirks */
++	/* Radeon 7000 (RV100) */
++	if (((dev->pdev->device == 0x5159) &&
++	    (dev->pdev->subsystem_vendor == 0x174B) &&
++	    (dev->pdev->subsystem_device == 0x7c28)) ||
+ 	/* Radeon 9100 (R200) */
+-	if ((dev->pdev->device == 0x514D) &&
++	   ((dev->pdev->device == 0x514D) &&
+ 	    (dev->pdev->subsystem_vendor == 0x174B) &&
+-	    (dev->pdev->subsystem_device == 0x7149)) {
++	    (dev->pdev->subsystem_device == 0x7149))) {
+ 		/* vbios value is bad, use the default */
+ 		found = 0;
+ 	}
+diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
+index 43ec4a4..5ce190b 100644
+--- a/drivers/gpu/drm/radeon/radeon_gart.c
++++ b/drivers/gpu/drm/radeon/radeon_gart.c
+@@ -467,6 +467,7 @@ int radeon_vm_manager_init(struct radeon_device *rdev)
+ 		size *= 2;
+ 		r = radeon_sa_bo_manager_init(rdev, &rdev->vm_manager.sa_manager,
+ 					      RADEON_GPU_PAGE_ALIGN(size),
++					      RADEON_GPU_PAGE_SIZE,
+ 					      RADEON_GEM_DOMAIN_VRAM);
+ 		if (r) {
+ 			dev_err(rdev->dev, "failed to allocate vm bo (%dKB)\n",
+diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+index 5a99d43..1fe12ab 100644
+--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+@@ -241,9 +241,6 @@ int radeon_irq_kms_init(struct radeon_device *rdev)
+ {
+ 	int r = 0;
+ 
+-	INIT_WORK(&rdev->hotplug_work, radeon_hotplug_work_func);
+-	INIT_WORK(&rdev->audio_work, r600_audio_update_hdmi);
+-
+ 	spin_lock_init(&rdev->irq.lock);
+ 	r = drm_vblank_init(rdev->ddev, rdev->num_crtc);
+ 	if (r) {
+@@ -265,6 +262,10 @@ int radeon_irq_kms_init(struct radeon_device *rdev)
+ 		rdev->irq.installed = false;
+ 		return r;
+ 	}
++
++	INIT_WORK(&rdev->hotplug_work, radeon_hotplug_work_func);
++	INIT_WORK(&rdev->audio_work, r600_audio_update_hdmi);
++
+ 	DRM_INFO("radeon: irq initialized.\n");
+ 	return 0;
+ }
+@@ -284,8 +285,8 @@ void radeon_irq_kms_fini(struct radeon_device *rdev)
+ 		rdev->irq.installed = false;
+ 		if (rdev->msi_enabled)
+ 			pci_disable_msi(rdev->pdev);
++		flush_work(&rdev->hotplug_work);
+ 	}
+-	flush_work(&rdev->hotplug_work);
+ }
+ 
+ /**
+diff --git a/drivers/gpu/drm/radeon/radeon_object.h b/drivers/gpu/drm/radeon/radeon_object.h
+index e2cb80a..2943823 100644
+--- a/drivers/gpu/drm/radeon/radeon_object.h
++++ b/drivers/gpu/drm/radeon/radeon_object.h
+@@ -158,7 +158,7 @@ static inline void * radeon_sa_bo_cpu_addr(struct radeon_sa_bo *sa_bo)
+ 
+ extern int radeon_sa_bo_manager_init(struct radeon_device *rdev,
+ 				     struct radeon_sa_manager *sa_manager,
+-				     unsigned size, u32 domain);
++				     unsigned size, u32 align, u32 domain);
+ extern void radeon_sa_bo_manager_fini(struct radeon_device *rdev,
+ 				      struct radeon_sa_manager *sa_manager);
+ extern int radeon_sa_bo_manager_start(struct radeon_device *rdev,
+diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
+index 82434018..83f6295 100644
+--- a/drivers/gpu/drm/radeon/radeon_ring.c
++++ b/drivers/gpu/drm/radeon/radeon_ring.c
+@@ -224,6 +224,7 @@ int radeon_ib_pool_init(struct radeon_device *rdev)
+ 	}
+ 	r = radeon_sa_bo_manager_init(rdev, &rdev->ring_tmp_bo,
+ 				      RADEON_IB_POOL_SIZE*64*1024,
++				      RADEON_GPU_PAGE_SIZE,
+ 				      RADEON_GEM_DOMAIN_GTT);
+ 	if (r) {
+ 		return r;
+diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c
+index 0abe5a9..f0bac68 100644
+--- a/drivers/gpu/drm/radeon/radeon_sa.c
++++ b/drivers/gpu/drm/radeon/radeon_sa.c
+@@ -49,7 +49,7 @@ static void radeon_sa_bo_try_free(struct radeon_sa_manager *sa_manager);
+ 
+ int radeon_sa_bo_manager_init(struct radeon_device *rdev,
+ 			      struct radeon_sa_manager *sa_manager,
+-			      unsigned size, u32 domain)
++			      unsigned size, u32 align, u32 domain)
+ {
+ 	int i, r;
+ 
+@@ -57,13 +57,14 @@ int radeon_sa_bo_manager_init(struct radeon_device *rdev,
+ 	sa_manager->bo = NULL;
+ 	sa_manager->size = size;
+ 	sa_manager->domain = domain;
++	sa_manager->align = align;
+ 	sa_manager->hole = &sa_manager->olist;
+ 	INIT_LIST_HEAD(&sa_manager->olist);
+ 	for (i = 0; i < RADEON_NUM_RINGS; ++i) {
+ 		INIT_LIST_HEAD(&sa_manager->flist[i]);
+ 	}
+ 
+-	r = radeon_bo_create(rdev, size, RADEON_GPU_PAGE_SIZE, true,
++	r = radeon_bo_create(rdev, size, align, true,
+ 			     domain, NULL, &sa_manager->bo);
+ 	if (r) {
+ 		dev_err(rdev->dev, "(%d) failed to allocate bo for manager\n", r);
+@@ -317,7 +318,7 @@ int radeon_sa_bo_new(struct radeon_device *rdev,
+ 	unsigned tries[RADEON_NUM_RINGS];
+ 	int i, r;
+ 
+-	BUG_ON(align > RADEON_GPU_PAGE_SIZE);
++	BUG_ON(align > sa_manager->align);
+ 	BUG_ON(size > sa_manager->size);
+ 
+ 	*sa_bo = kmalloc(sizeof(struct radeon_sa_bo), GFP_KERNEL);
+diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
+index 4c605c7..deb5c25 100644
+--- a/drivers/hv/hv_balloon.c
++++ b/drivers/hv/hv_balloon.c
+@@ -562,7 +562,7 @@ static void hv_mem_hot_add(unsigned long start, unsigned long size,
+ 				struct hv_hotadd_state *has)
+ {
+ 	int ret = 0;
+-	int i, nid, t;
++	int i, nid;
+ 	unsigned long start_pfn;
+ 	unsigned long processed_pfn;
+ 	unsigned long total_pfn = pfn_count;
+@@ -607,14 +607,11 @@ static void hv_mem_hot_add(unsigned long start, unsigned long size,
+ 
+ 		/*
+ 		 * Wait for the memory block to be onlined.
++		 * Since the hot add has succeeded, it is ok to
++		 * proceed even if the pages in the hot added region
++		 * have not been "onlined" within the allowed time.
+ 		 */
+-		t = wait_for_completion_timeout(&dm_device.ol_waitevent, 5*HZ);
+-		if (t == 0) {
+-			pr_info("hot_add memory timedout\n");
+-			has->ha_end_pfn -= HA_CHUNK;
+-			has->covered_end_pfn -=  processed_pfn;
+-			break;
+-		}
++		wait_for_completion_timeout(&dm_device.ol_waitevent, 5*HZ);
+ 
+ 	}
+ 
+@@ -978,6 +975,14 @@ static void post_status(struct hv_dynmem_device *dm)
+ 				dm->num_pages_ballooned +
+ 				compute_balloon_floor();
+ 
++	/*
++	 * If our transaction ID is no longer current, just don't
++	 * send the status. This can happen if we were interrupted
++	 * after we picked our transaction ID.
++	 */
++	if (status.hdr.trans_id != atomic_read(&trans_id))
++		return;
++
+ 	vmbus_sendpacket(dm->dev->channel, &status,
+ 				sizeof(struct dm_status),
+ 				(unsigned long)NULL,
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index 41712f0..5849dc0 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -388,6 +388,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ 	init_waitqueue_head(&isert_conn->conn_wait_comp_err);
+ 	kref_init(&isert_conn->conn_kref);
+ 	kref_get(&isert_conn->conn_kref);
++	mutex_init(&isert_conn->conn_mutex);
+ 
+ 	cma_id->context = isert_conn;
+ 	isert_conn->conn_cm_id = cma_id;
+@@ -540,15 +541,32 @@ isert_disconnect_work(struct work_struct *work)
+ 				struct isert_conn, conn_logout_work);
+ 
+ 	pr_debug("isert_disconnect_work(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
+-
++	mutex_lock(&isert_conn->conn_mutex);
+ 	isert_conn->state = ISER_CONN_DOWN;
+ 
+ 	if (isert_conn->post_recv_buf_count == 0 &&
+ 	    atomic_read(&isert_conn->post_send_buf_count) == 0) {
+ 		pr_debug("Calling wake_up(&isert_conn->conn_wait);\n");
+-		wake_up(&isert_conn->conn_wait);
++		mutex_unlock(&isert_conn->conn_mutex);
++		goto wake_up;
++	}
++	if (!isert_conn->conn_cm_id) {
++		mutex_unlock(&isert_conn->conn_mutex);
++		isert_put_conn(isert_conn);
++		return;
++	}
++	if (!isert_conn->logout_posted) {
++		pr_debug("Calling rdma_disconnect for !logout_posted from"
++			 " isert_disconnect_work\n");
++		rdma_disconnect(isert_conn->conn_cm_id);
++		mutex_unlock(&isert_conn->conn_mutex);
++		iscsit_cause_connection_reinstatement(isert_conn->conn, 0);
++		goto wake_up;
+ 	}
++	mutex_unlock(&isert_conn->conn_mutex);
+ 
++wake_up:
++	wake_up(&isert_conn->conn_wait);
+ 	isert_put_conn(isert_conn);
+ }
+ 
+@@ -934,16 +952,11 @@ isert_handle_scsi_cmd(struct isert_conn *isert_conn,
+ 	}
+ 
+ sequence_cmd:
+-	rc = iscsit_sequence_cmd(conn, cmd, hdr->cmdsn);
++	rc = iscsit_sequence_cmd(conn, cmd, buf, hdr->cmdsn);
+ 
+ 	if (!rc && dump_payload == false && unsol_data)
+ 		iscsit_set_unsoliticed_dataout(cmd);
+ 
+-	if (rc == CMDSN_ERROR_CANNOT_RECOVER)
+-		return iscsit_add_reject_from_cmd(
+-			   ISCSI_REASON_PROTOCOL_ERROR,
+-			   1, 0, (unsigned char *)hdr, cmd);
+-
+ 	return 0;
+ }
+ 
+@@ -1184,14 +1197,12 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
+ {
+ 	struct iscsi_cmd *cmd = &isert_cmd->iscsi_cmd;
+ 	struct isert_conn *isert_conn = isert_cmd->conn;
+-	struct iscsi_conn *conn;
++	struct iscsi_conn *conn = isert_conn->conn;
+ 
+ 	pr_debug("Entering isert_put_cmd: %p\n", isert_cmd);
+ 
+ 	switch (cmd->iscsi_opcode) {
+ 	case ISCSI_OP_SCSI_CMD:
+-		conn = isert_conn->conn;
+-
+ 		spin_lock_bh(&conn->cmd_lock);
+ 		if (!list_empty(&cmd->i_conn_node))
+ 			list_del(&cmd->i_conn_node);
+@@ -1201,16 +1212,18 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
+ 			iscsit_stop_dataout_timer(cmd);
+ 
+ 		isert_unmap_cmd(isert_cmd, isert_conn);
+-		/*
+-		 * Fall-through
+-		 */
++		transport_generic_free_cmd(&cmd->se_cmd, 0);
++		break;
+ 	case ISCSI_OP_SCSI_TMFUNC:
++		spin_lock_bh(&conn->cmd_lock);
++		if (!list_empty(&cmd->i_conn_node))
++			list_del(&cmd->i_conn_node);
++		spin_unlock_bh(&conn->cmd_lock);
++
+ 		transport_generic_free_cmd(&cmd->se_cmd, 0);
+ 		break;
+ 	case ISCSI_OP_REJECT:
+ 	case ISCSI_OP_NOOP_OUT:
+-		conn = isert_conn->conn;
+-
+ 		spin_lock_bh(&conn->cmd_lock);
+ 		if (!list_empty(&cmd->i_conn_node))
+ 			list_del(&cmd->i_conn_node);
+@@ -1222,6 +1235,9 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
+ 		 * associated cmd->se_cmd needs to be released.
+ 		 */
+ 		if (cmd->se_cmd.se_tfo != NULL) {
++			pr_debug("Calling transport_generic_free_cmd from"
++				 " isert_put_cmd for 0x%02x\n",
++				 cmd->iscsi_opcode);
+ 			transport_generic_free_cmd(&cmd->se_cmd, 0);
+ 			break;
+ 		}
+@@ -1318,8 +1334,8 @@ isert_do_control_comp(struct work_struct *work)
+ 		atomic_dec(&isert_conn->post_send_buf_count);
+ 
+ 		cmd->i_state = ISTATE_SENT_STATUS;
+-		complete(&cmd->reject_comp);
+ 		isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev);
++		break;
+ 	case ISTATE_SEND_LOGOUTRSP:
+ 		pr_debug("Calling iscsit_logout_post_handler >>>>>>>>>>>>>>\n");
+ 		/*
+@@ -1345,7 +1361,8 @@ isert_response_completion(struct iser_tx_desc *tx_desc,
+ 	struct iscsi_cmd *cmd = &isert_cmd->iscsi_cmd;
+ 
+ 	if (cmd->i_state == ISTATE_SEND_TASKMGTRSP ||
+-	    cmd->i_state == ISTATE_SEND_LOGOUTRSP) {
++	    cmd->i_state == ISTATE_SEND_LOGOUTRSP ||
++	    cmd->i_state == ISTATE_SEND_REJECT) {
+ 		isert_unmap_tx_desc(tx_desc, ib_dev);
+ 
+ 		INIT_WORK(&isert_cmd->comp_work, isert_do_control_comp);
+@@ -1419,7 +1436,11 @@ isert_cq_comp_err(struct iser_tx_desc *tx_desc, struct isert_conn *isert_conn)
+ 		pr_debug("isert_cq_comp_err >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
+ 		pr_debug("Calling wake_up from isert_cq_comp_err\n");
+ 
+-		isert_conn->state = ISER_CONN_TERMINATING;
++		mutex_lock(&isert_conn->conn_mutex);
++		if (isert_conn->state != ISER_CONN_DOWN)
++			isert_conn->state = ISER_CONN_TERMINATING;
++		mutex_unlock(&isert_conn->conn_mutex);
++
+ 		wake_up(&isert_conn->conn_wait_comp_err);
+ 	}
+ }
+@@ -1637,11 +1658,25 @@ isert_put_reject(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
+ 				struct isert_cmd, iscsi_cmd);
+ 	struct isert_conn *isert_conn = (struct isert_conn *)conn->context;
+ 	struct ib_send_wr *send_wr = &isert_cmd->tx_desc.send_wr;
++	struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
++	struct ib_sge *tx_dsg = &isert_cmd->tx_desc.tx_sg[1];
++	struct iscsi_reject *hdr =
++		(struct iscsi_reject *)&isert_cmd->tx_desc.iscsi_header;
+ 
+ 	isert_create_send_desc(isert_conn, isert_cmd, &isert_cmd->tx_desc);
+-	iscsit_build_reject(cmd, conn, (struct iscsi_reject *)
+-				&isert_cmd->tx_desc.iscsi_header);
++	iscsit_build_reject(cmd, conn, hdr);
+ 	isert_init_tx_hdrs(isert_conn, &isert_cmd->tx_desc);
++
++	hton24(hdr->dlength, ISCSI_HDR_LEN);
++	isert_cmd->sense_buf_dma = ib_dma_map_single(ib_dev,
++			(void *)cmd->buf_ptr, ISCSI_HDR_LEN,
++			DMA_TO_DEVICE);
++	isert_cmd->sense_buf_len = ISCSI_HDR_LEN;
++	tx_dsg->addr	= isert_cmd->sense_buf_dma;
++	tx_dsg->length	= ISCSI_HDR_LEN;
++	tx_dsg->lkey	= isert_conn->conn_mr->lkey;
++	isert_cmd->tx_desc.num_sge = 2;
++
+ 	isert_init_send_wr(isert_cmd, send_wr);
+ 
+ 	pr_debug("Posting Reject IB_WR_SEND >>>>>>>>>>>>>>>>>>>>>>\n");
+@@ -2175,6 +2210,17 @@ isert_free_np(struct iscsi_np *np)
+ 	kfree(isert_np);
+ }
+ 
++static int isert_check_state(struct isert_conn *isert_conn, int state)
++{
++	int ret;
++
++	mutex_lock(&isert_conn->conn_mutex);
++	ret = (isert_conn->state == state);
++	mutex_unlock(&isert_conn->conn_mutex);
++
++	return ret;
++}
++
+ static void isert_free_conn(struct iscsi_conn *conn)
+ {
+ 	struct isert_conn *isert_conn = conn->context;
+@@ -2184,26 +2230,43 @@ static void isert_free_conn(struct iscsi_conn *conn)
+ 	 * Decrement post_send_buf_count for special case when called
+ 	 * from isert_do_control_comp() -> iscsit_logout_post_handler()
+ 	 */
++	mutex_lock(&isert_conn->conn_mutex);
+ 	if (isert_conn->logout_posted)
+ 		atomic_dec(&isert_conn->post_send_buf_count);
+ 
+-	if (isert_conn->conn_cm_id)
++	if (isert_conn->conn_cm_id && isert_conn->state != ISER_CONN_DOWN) {
++		pr_debug("Calling rdma_disconnect from isert_free_conn\n");
+ 		rdma_disconnect(isert_conn->conn_cm_id);
++	}
+ 	/*
+ 	 * Only wait for conn_wait_comp_err if the isert_conn made it
+ 	 * into full feature phase..
+ 	 */
+-	if (isert_conn->state > ISER_CONN_INIT) {
++	if (isert_conn->state == ISER_CONN_UP) {
+ 		pr_debug("isert_free_conn: Before wait_event comp_err %d\n",
+ 			 isert_conn->state);
++		mutex_unlock(&isert_conn->conn_mutex);
++
+ 		wait_event(isert_conn->conn_wait_comp_err,
+-			   isert_conn->state == ISER_CONN_TERMINATING);
+-		pr_debug("isert_free_conn: After wait_event #1 >>>>>>>>>>>>\n");
++			  (isert_check_state(isert_conn, ISER_CONN_TERMINATING)));
++
++		wait_event(isert_conn->conn_wait,
++			  (isert_check_state(isert_conn, ISER_CONN_DOWN)));
++
++		isert_put_conn(isert_conn);
++		return;
++	}
++	if (isert_conn->state == ISER_CONN_INIT) {
++		mutex_unlock(&isert_conn->conn_mutex);
++		isert_put_conn(isert_conn);
++		return;
+ 	}
++	pr_debug("isert_free_conn: wait_event conn_wait %d\n",
++		 isert_conn->state);
++	mutex_unlock(&isert_conn->conn_mutex);
+ 
+-	pr_debug("isert_free_conn: wait_event conn_wait %d\n", isert_conn->state);
+-	wait_event(isert_conn->conn_wait, isert_conn->state == ISER_CONN_DOWN);
+-	pr_debug("isert_free_conn: After wait_event #2 >>>>>>>>>>>>>>>>>>>>\n");
++	wait_event(isert_conn->conn_wait,
++		  (isert_check_state(isert_conn, ISER_CONN_DOWN)));
+ 
+ 	isert_put_conn(isert_conn);
+ }
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
+index b104f4c..5795c82 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.h
++++ b/drivers/infiniband/ulp/isert/ib_isert.h
+@@ -102,6 +102,7 @@ struct isert_conn {
+ 	struct ib_qp		*conn_qp;
+ 	struct isert_device	*conn_device;
+ 	struct work_struct	conn_logout_work;
++	struct mutex		conn_mutex;
+ 	wait_queue_head_t	conn_wait;
+ 	wait_queue_head_t	conn_wait_comp_err;
+ 	struct kref		conn_kref;
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index aa04f02..81a79b7 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -1644,7 +1644,10 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern
+ 	}
+ 
+ 	if (!dmi) {
++		unsigned noio_flag;
++		noio_flag = memalloc_noio_save();
+ 		dmi = __vmalloc(param_kernel->data_size, GFP_NOIO | __GFP_REPEAT | __GFP_HIGH, PAGE_KERNEL);
++		memalloc_noio_restore(noio_flag);
+ 		if (dmi)
+ 			*param_flags |= DM_PARAMS_VMALLOC;
+ 	}
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index bdf26f5..5adede1 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -1561,7 +1561,6 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
+ 	unsigned long flags;
+ 	int r;
+ 
+-again:
+ 	bdev = NULL;
+ 	mode = 0;
+ 	r = 0;
+@@ -1579,7 +1578,7 @@ again:
+ 	}
+ 
+ 	if ((pgpath && m->queue_io) || (!pgpath && m->queue_if_no_path))
+-		r = -EAGAIN;
++		r = -ENOTCONN;
+ 	else if (!bdev)
+ 		r = -EIO;
+ 
+@@ -1591,11 +1590,8 @@ again:
+ 	if (!r && ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT)
+ 		r = scsi_verify_blk_ioctl(NULL, cmd);
+ 
+-	if (r == -EAGAIN && !fatal_signal_pending(current)) {
++	if (r == -ENOTCONN && !fatal_signal_pending(current))
+ 		queue_work(kmultipathd, &m->process_queued_ios);
+-		msleep(10);
+-		goto again;
+-	}
+ 
+ 	return r ? : __blkdev_driver_ioctl(bdev, mode, cmd, arg);
+ }
+diff --git a/drivers/md/dm-verity.c b/drivers/md/dm-verity.c
+index b948fd8..0d2e812 100644
+--- a/drivers/md/dm-verity.c
++++ b/drivers/md/dm-verity.c
+@@ -831,9 +831,8 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ 	for (i = v->levels - 1; i >= 0; i--) {
+ 		sector_t s;
+ 		v->hash_level_block[i] = hash_position;
+-		s = verity_position_at_level(v, v->data_blocks, i);
+-		s = (s >> v->hash_per_block_bits) +
+-		    !!(s & ((1 << v->hash_per_block_bits) - 1));
++		s = (v->data_blocks + ((sector_t)1 << ((i + 1) * v->hash_per_block_bits)) - 1)
++					>> ((i + 1) * v->hash_per_block_bits);
+ 		if (hash_position + s < hash_position) {
+ 			ti->error = "Hash device offset overflow";
+ 			r = -E2BIG;
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index d5370a9..33f2010 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -386,10 +386,12 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
+ 			unsigned int cmd, unsigned long arg)
+ {
+ 	struct mapped_device *md = bdev->bd_disk->private_data;
+-	struct dm_table *map = dm_get_live_table(md);
++	struct dm_table *map;
+ 	struct dm_target *tgt;
+ 	int r = -ENOTTY;
+ 
++retry:
++	map = dm_get_live_table(md);
+ 	if (!map || !dm_table_get_size(map))
+ 		goto out;
+ 
+@@ -410,6 +412,11 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
+ out:
+ 	dm_table_put(map);
+ 
++	if (r == -ENOTCONN) {
++		msleep(10);
++		goto retry;
++	}
++
+ 	return r;
+ }
+ 
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 9b82377..51f0345 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -7697,20 +7697,6 @@ static int remove_and_add_spares(struct mddev *mddev,
+ 			continue;
+ 
+ 		rdev->recovery_offset = 0;
+-		if (rdev->saved_raid_disk >= 0 && mddev->in_sync) {
+-			spin_lock_irq(&mddev->write_lock);
+-			if (mddev->in_sync)
+-				/* OK, this device, which is in_sync,
+-				 * will definitely be noticed before
+-				 * the next write, so recovery isn't
+-				 * needed.
+-				 */
+-				rdev->recovery_offset = mddev->recovery_cp;
+-			spin_unlock_irq(&mddev->write_lock);
+-		}
+-		if (mddev->ro && rdev->recovery_offset != MaxSector)
+-			/* not safe to add this disk now */
+-			continue;
+ 		if (mddev->pers->
+ 		    hot_add_disk(mddev, rdev) == 0) {
+ 			if (sysfs_link_rdev(mddev, rdev))
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 6e17f81..6f48244 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1848,6 +1848,36 @@ static int process_checks(struct r1bio *r1_bio)
+ 	int i;
+ 	int vcnt;
+ 
++	/* Fix variable parts of all bios */
++	vcnt = (r1_bio->sectors + PAGE_SIZE / 512 - 1) >> (PAGE_SHIFT - 9);
++	for (i = 0; i < conf->raid_disks * 2; i++) {
++		int j;
++		int size;
++		struct bio *b = r1_bio->bios[i];
++		if (b->bi_end_io != end_sync_read)
++			continue;
++		/* fixup the bio for reuse */
++		bio_reset(b);
++		b->bi_vcnt = vcnt;
++		b->bi_size = r1_bio->sectors << 9;
++		b->bi_sector = r1_bio->sector +
++			conf->mirrors[i].rdev->data_offset;
++		b->bi_bdev = conf->mirrors[i].rdev->bdev;
++		b->bi_end_io = end_sync_read;
++		b->bi_private = r1_bio;
++
++		size = b->bi_size;
++		for (j = 0; j < vcnt ; j++) {
++			struct bio_vec *bi;
++			bi = &b->bi_io_vec[j];
++			bi->bv_offset = 0;
++			if (size > PAGE_SIZE)
++				bi->bv_len = PAGE_SIZE;
++			else
++				bi->bv_len = size;
++			size -= PAGE_SIZE;
++		}
++	}
+ 	for (primary = 0; primary < conf->raid_disks * 2; primary++)
+ 		if (r1_bio->bios[primary]->bi_end_io == end_sync_read &&
+ 		    test_bit(BIO_UPTODATE, &r1_bio->bios[primary]->bi_flags)) {
+@@ -1856,12 +1886,10 @@ static int process_checks(struct r1bio *r1_bio)
+ 			break;
+ 		}
+ 	r1_bio->read_disk = primary;
+-	vcnt = (r1_bio->sectors + PAGE_SIZE / 512 - 1) >> (PAGE_SHIFT - 9);
+ 	for (i = 0; i < conf->raid_disks * 2; i++) {
+ 		int j;
+ 		struct bio *pbio = r1_bio->bios[primary];
+ 		struct bio *sbio = r1_bio->bios[i];
+-		int size;
+ 
+ 		if (sbio->bi_end_io != end_sync_read)
+ 			continue;
+@@ -1887,27 +1915,6 @@ static int process_checks(struct r1bio *r1_bio)
+ 			rdev_dec_pending(conf->mirrors[i].rdev, mddev);
+ 			continue;
+ 		}
+-		/* fixup the bio for reuse */
+-		bio_reset(sbio);
+-		sbio->bi_vcnt = vcnt;
+-		sbio->bi_size = r1_bio->sectors << 9;
+-		sbio->bi_sector = r1_bio->sector +
+-			conf->mirrors[i].rdev->data_offset;
+-		sbio->bi_bdev = conf->mirrors[i].rdev->bdev;
+-		sbio->bi_end_io = end_sync_read;
+-		sbio->bi_private = r1_bio;
+-
+-		size = sbio->bi_size;
+-		for (j = 0; j < vcnt ; j++) {
+-			struct bio_vec *bi;
+-			bi = &sbio->bi_io_vec[j];
+-			bi->bv_offset = 0;
+-			if (size > PAGE_SIZE)
+-				bi->bv_len = PAGE_SIZE;
+-			else
+-				bi->bv_len = size;
+-			size -= PAGE_SIZE;
+-		}
+ 
+ 		bio_copy_data(sbio, pbio);
+ 	}
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index d61eb7e..081bb33 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -2268,12 +2268,18 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio)
+ 	d = r10_bio->devs[1].devnum;
+ 	wbio = r10_bio->devs[1].bio;
+ 	wbio2 = r10_bio->devs[1].repl_bio;
++	/* Need to test wbio2->bi_end_io before we call
++	 * generic_make_request as if the former is NULL,
++	 * the latter is free to free wbio2.
++	 */
++	if (wbio2 && !wbio2->bi_end_io)
++		wbio2 = NULL;
+ 	if (wbio->bi_end_io) {
+ 		atomic_inc(&conf->mirrors[d].rdev->nr_pending);
+ 		md_sync_acct(conf->mirrors[d].rdev->bdev, bio_sectors(wbio));
+ 		generic_make_request(wbio);
+ 	}
+-	if (wbio2 && wbio2->bi_end_io) {
++	if (wbio2) {
+ 		atomic_inc(&conf->mirrors[d].replacement->nr_pending);
+ 		md_sync_acct(conf->mirrors[d].replacement->bdev,
+ 			     bio_sectors(wbio2));
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 05e4a10..a35b846 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3462,6 +3462,7 @@ static void handle_stripe(struct stripe_head *sh)
+ 		    test_and_clear_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
+ 			set_bit(STRIPE_SYNCING, &sh->state);
+ 			clear_bit(STRIPE_INSYNC, &sh->state);
++			clear_bit(STRIPE_REPLACED, &sh->state);
+ 		}
+ 		spin_unlock(&sh->stripe_lock);
+ 	}
+@@ -3607,19 +3608,23 @@ static void handle_stripe(struct stripe_head *sh)
+ 			handle_parity_checks5(conf, sh, &s, disks);
+ 	}
+ 
+-	if (s.replacing && s.locked == 0
+-	    && !test_bit(STRIPE_INSYNC, &sh->state)) {
++	if ((s.replacing || s.syncing) && s.locked == 0
++	    && !test_bit(STRIPE_COMPUTE_RUN, &sh->state)
++	    && !test_bit(STRIPE_REPLACED, &sh->state)) {
+ 		/* Write out to replacement devices where possible */
+ 		for (i = 0; i < conf->raid_disks; i++)
+-			if (test_bit(R5_UPTODATE, &sh->dev[i].flags) &&
+-			    test_bit(R5_NeedReplace, &sh->dev[i].flags)) {
++			if (test_bit(R5_NeedReplace, &sh->dev[i].flags)) {
++				WARN_ON(!test_bit(R5_UPTODATE, &sh->dev[i].flags));
+ 				set_bit(R5_WantReplace, &sh->dev[i].flags);
+ 				set_bit(R5_LOCKED, &sh->dev[i].flags);
+ 				s.locked++;
+ 			}
+-		set_bit(STRIPE_INSYNC, &sh->state);
++		if (s.replacing)
++			set_bit(STRIPE_INSYNC, &sh->state);
++		set_bit(STRIPE_REPLACED, &sh->state);
+ 	}
+ 	if ((s.syncing || s.replacing) && s.locked == 0 &&
++	    !test_bit(STRIPE_COMPUTE_RUN, &sh->state) &&
+ 	    test_bit(STRIPE_INSYNC, &sh->state)) {
+ 		md_done_sync(conf->mddev, STRIPE_SECTORS, 1);
+ 		clear_bit(STRIPE_SYNCING, &sh->state);
+diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
+index b0b663b..70c4932 100644
+--- a/drivers/md/raid5.h
++++ b/drivers/md/raid5.h
+@@ -306,6 +306,7 @@ enum {
+ 	STRIPE_SYNC_REQUESTED,
+ 	STRIPE_SYNCING,
+ 	STRIPE_INSYNC,
++	STRIPE_REPLACED,
+ 	STRIPE_PREREAD_ACTIVE,
+ 	STRIPE_DELAYED,
+ 	STRIPE_DEGRADED,
+diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
+index c97e9d3..e70b4ff 100644
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -1008,19 +1008,6 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
+ 	return;
+ }
+ 
+-static void rtl_lps_change_work_callback(struct work_struct *work)
+-{
+-	struct rtl_works *rtlworks =
+-	    container_of(work, struct rtl_works, lps_change_work);
+-	struct ieee80211_hw *hw = rtlworks->hw;
+-	struct rtl_priv *rtlpriv = rtl_priv(hw);
+-
+-	if (rtlpriv->enter_ps)
+-		rtl_lps_enter(hw);
+-	else
+-		rtl_lps_leave(hw);
+-}
+-
+ static void _rtl_pci_init_trx_var(struct ieee80211_hw *hw)
+ {
+ 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c
+index 884bcea..71e917d 100644
+--- a/drivers/net/wireless/rtlwifi/ps.c
++++ b/drivers/net/wireless/rtlwifi/ps.c
+@@ -611,6 +611,18 @@ void rtl_swlps_rf_sleep(struct ieee80211_hw *hw)
+ 			MSECS(sleep_intv * mac->vif->bss_conf.beacon_int - 40));
+ }
+ 
++void rtl_lps_change_work_callback(struct work_struct *work)
++{
++	struct rtl_works *rtlworks =
++	    container_of(work, struct rtl_works, lps_change_work);
++	struct ieee80211_hw *hw = rtlworks->hw;
++	struct rtl_priv *rtlpriv = rtl_priv(hw);
++
++	if (rtlpriv->enter_ps)
++		rtl_lps_enter(hw);
++	else
++		rtl_lps_leave(hw);
++}
+ 
+ void rtl_swlps_wq_callback(void *data)
+ {
+diff --git a/drivers/net/wireless/rtlwifi/ps.h b/drivers/net/wireless/rtlwifi/ps.h
+index 4d682b7..88bd76e 100644
+--- a/drivers/net/wireless/rtlwifi/ps.h
++++ b/drivers/net/wireless/rtlwifi/ps.h
+@@ -49,5 +49,6 @@ void rtl_swlps_rf_awake(struct ieee80211_hw *hw);
+ void rtl_swlps_rf_sleep(struct ieee80211_hw *hw);
+ void rtl_p2p_ps_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
+ void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len);
++void rtl_lps_change_work_callback(struct work_struct *work);
+ 
+ #endif
+diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
+index a3532e0..1feebdc 100644
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -1070,6 +1070,8 @@ int rtl_usb_probe(struct usb_interface *intf,
+ 	spin_lock_init(&rtlpriv->locks.usb_lock);
+ 	INIT_WORK(&rtlpriv->works.fill_h2c_cmd,
+ 		  rtl_fill_h2c_cmd_work_callback);
++	INIT_WORK(&rtlpriv->works.lps_change_work,
++		  rtl_lps_change_work_callback);
+ 
+ 	rtlpriv->usb_data_index = 0;
+ 	init_completion(&rtlpriv->firmware_loading_complete);
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 1db10141..0c01b8e 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -276,8 +276,7 @@ no_skb:
+ 			break;
+ 		}
+ 
+-		__skb_fill_page_desc(skb, 0, page, 0, 0);
+-		skb_shinfo(skb)->nr_frags = 1;
++		skb_add_rx_frag(skb, 0, page, 0, 0, PAGE_SIZE);
+ 		__skb_queue_tail(&np->rx_batch, skb);
+ 	}
+ 
+@@ -822,7 +821,6 @@ static RING_IDX xennet_fill_frags(struct netfront_info *np,
+ 				  struct sk_buff_head *list)
+ {
+ 	struct skb_shared_info *shinfo = skb_shinfo(skb);
+-	int nr_frags = shinfo->nr_frags;
+ 	RING_IDX cons = np->rx.rsp_cons;
+ 	struct sk_buff *nskb;
+ 
+@@ -831,19 +829,21 @@ static RING_IDX xennet_fill_frags(struct netfront_info *np,
+ 			RING_GET_RESPONSE(&np->rx, ++cons);
+ 		skb_frag_t *nfrag = &skb_shinfo(nskb)->frags[0];
+ 
+-		__skb_fill_page_desc(skb, nr_frags,
+-				     skb_frag_page(nfrag),
+-				     rx->offset, rx->status);
++		if (shinfo->nr_frags == MAX_SKB_FRAGS) {
++			unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to;
+ 
+-		skb->data_len += rx->status;
++			BUG_ON(pull_to <= skb_headlen(skb));
++			__pskb_pull_tail(skb, pull_to - skb_headlen(skb));
++		}
++		BUG_ON(shinfo->nr_frags >= MAX_SKB_FRAGS);
++
++		skb_add_rx_frag(skb, shinfo->nr_frags, skb_frag_page(nfrag),
++				rx->offset, rx->status, PAGE_SIZE);
+ 
+ 		skb_shinfo(nskb)->nr_frags = 0;
+ 		kfree_skb(nskb);
+-
+-		nr_frags++;
+ 	}
+ 
+-	shinfo->nr_frags = nr_frags;
+ 	return cons;
+ }
+ 
+@@ -929,7 +929,8 @@ static int handle_incoming_queue(struct net_device *dev,
+ 	while ((skb = __skb_dequeue(rxq)) != NULL) {
+ 		int pull_to = NETFRONT_SKB_CB(skb)->pull_to;
+ 
+-		__pskb_pull_tail(skb, pull_to - skb_headlen(skb));
++		if (pull_to > skb_headlen(skb))
++			__pskb_pull_tail(skb, pull_to - skb_headlen(skb));
+ 
+ 		/* Ethernet work: Delayed to here as it peeks the header. */
+ 		skb->protocol = eth_type_trans(skb, dev);
+@@ -1015,16 +1016,10 @@ err:
+ 		skb_shinfo(skb)->frags[0].page_offset = rx->offset;
+ 		skb_frag_size_set(&skb_shinfo(skb)->frags[0], rx->status);
+ 		skb->data_len = rx->status;
++		skb->len += rx->status;
+ 
+ 		i = xennet_fill_frags(np, skb, &tmpq);
+ 
+-		/*
+-                 * Truesize is the actual allocation size, even if the
+-                 * allocation is only partially used.
+-                 */
+-		skb->truesize += PAGE_SIZE * skb_shinfo(skb)->nr_frags;
+-		skb->len += skb->data_len;
+-
+ 		if (rx->flags & XEN_NETRXF_csum_blank)
+ 			skb->ip_summed = CHECKSUM_PARTIAL;
+ 		else if (rx->flags & XEN_NETRXF_data_validated)
+diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
+index 9bb020a..0d30ca8 100644
+--- a/drivers/scsi/isci/task.c
++++ b/drivers/scsi/isci/task.c
+@@ -491,6 +491,7 @@ int isci_task_abort_task(struct sas_task *task)
+ 	struct isci_tmf           tmf;
+ 	int                       ret = TMF_RESP_FUNC_FAILED;
+ 	unsigned long             flags;
++	int                       target_done_already = 0;
+ 
+ 	/* Get the isci_request reference from the task.  Note that
+ 	 * this check does not depend on the pending request list
+@@ -505,9 +506,11 @@ int isci_task_abort_task(struct sas_task *task)
+ 	/* If task is already done, the request isn't valid */
+ 	if (!(task->task_state_flags & SAS_TASK_STATE_DONE) &&
+ 	    (task->task_state_flags & SAS_TASK_AT_INITIATOR) &&
+-	    old_request)
++	    old_request) {
+ 		idev = isci_get_device(task->dev->lldd_dev);
+-
++		target_done_already = test_bit(IREQ_COMPLETE_IN_TARGET,
++					       &old_request->flags);
++	}
+ 	spin_unlock(&task->task_state_lock);
+ 	spin_unlock_irqrestore(&ihost->scic_lock, flags);
+ 
+@@ -561,7 +564,7 @@ int isci_task_abort_task(struct sas_task *task)
+ 
+ 	if (task->task_proto == SAS_PROTOCOL_SMP ||
+ 	    sas_protocol_ata(task->task_proto) ||
+-	    test_bit(IREQ_COMPLETE_IN_TARGET, &old_request->flags) ||
++	    target_done_already ||
+ 	    test_bit(IDEV_GONE, &idev->flags)) {
+ 
+ 		spin_unlock_irqrestore(&ihost->scic_lock, flags);
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index 15e4080..51cd27a 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -419,6 +419,8 @@ qla2x00_start_scsi(srb_t *sp)
+ 			    __constant_cpu_to_le16(CF_SIMPLE_TAG);
+ 			break;
+ 		}
++	} else {
++		cmd_pkt->control_flags = __constant_cpu_to_le16(CF_SIMPLE_TAG);
+ 	}
+ 
+ 	/* Load SCSI command packet. */
+@@ -1308,11 +1310,11 @@ qla24xx_build_scsi_crc_2_iocbs(srb_t *sp, struct cmd_type_crc_2 *cmd_pkt,
+ 		    fcp_cmnd->task_attribute = TSK_ORDERED;
+ 		    break;
+ 		default:
+-		    fcp_cmnd->task_attribute = 0;
++		    fcp_cmnd->task_attribute = TSK_SIMPLE;
+ 		    break;
+ 		}
+ 	} else {
+-		fcp_cmnd->task_attribute = 0;
++		fcp_cmnd->task_attribute = TSK_SIMPLE;
+ 	}
+ 
+ 	cmd_pkt->fcp_rsp_dseg_len = 0; /* Let response come in status iocb */
+@@ -1527,7 +1529,12 @@ qla24xx_start_scsi(srb_t *sp)
+ 		case ORDERED_QUEUE_TAG:
+ 			cmd_pkt->task = TSK_ORDERED;
+ 			break;
++		default:
++		    cmd_pkt->task = TSK_SIMPLE;
++		    break;
+ 		}
++	} else {
++		cmd_pkt->task = TSK_SIMPLE;
+ 	}
+ 
+ 	/* Load SCSI command packet. */
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 1b1125e..610417e 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -828,10 +828,17 @@ static int scsi_setup_flush_cmnd(struct scsi_device *sdp, struct request *rq)
+ 
+ static void sd_unprep_fn(struct request_queue *q, struct request *rq)
+ {
++	struct scsi_cmnd *SCpnt = rq->special;
++
+ 	if (rq->cmd_flags & REQ_DISCARD) {
+ 		free_page((unsigned long)rq->buffer);
+ 		rq->buffer = NULL;
+ 	}
++	if (SCpnt->cmnd != rq->cmd) {
++		mempool_free(SCpnt->cmnd, sd_cdb_pool);
++		SCpnt->cmnd = NULL;
++		SCpnt->cmd_len = 0;
++	}
+ }
+ 
+ /**
+@@ -1710,21 +1717,6 @@ static int sd_done(struct scsi_cmnd *SCpnt)
+ 	if (rq_data_dir(SCpnt->request) == READ && scsi_prot_sg_count(SCpnt))
+ 		sd_dif_complete(SCpnt, good_bytes);
+ 
+-	if (scsi_host_dif_capable(sdkp->device->host, sdkp->protection_type)
+-	    == SD_DIF_TYPE2_PROTECTION && SCpnt->cmnd != SCpnt->request->cmd) {
+-
+-		/* We have to print a failed command here as the
+-		 * extended CDB gets freed before scsi_io_completion()
+-		 * is called.
+-		 */
+-		if (result)
+-			scsi_print_command(SCpnt);
+-
+-		mempool_free(SCpnt->cmnd, sd_cdb_pool);
+-		SCpnt->cmnd = NULL;
+-		SCpnt->cmd_len = 0;
+-	}
+-
+ 	return good_bytes;
+ }
+ 
+diff --git a/drivers/staging/android/logger.c b/drivers/staging/android/logger.c
+index 9bd8747..34519ea 100644
+--- a/drivers/staging/android/logger.c
++++ b/drivers/staging/android/logger.c
+@@ -469,7 +469,7 @@ static ssize_t logger_aio_write(struct kiocb *iocb, const struct iovec *iov,
+ 			 unsigned long nr_segs, loff_t ppos)
+ {
+ 	struct logger_log *log = file_get_log(iocb->ki_filp);
+-	size_t orig = log->w_off;
++	size_t orig;
+ 	struct logger_entry header;
+ 	struct timespec now;
+ 	ssize_t ret = 0;
+@@ -490,6 +490,8 @@ static ssize_t logger_aio_write(struct kiocb *iocb, const struct iovec *iov,
+ 
+ 	mutex_lock(&log->mutex);
+ 
++	orig = log->w_off;
++
+ 	/*
+ 	 * Fix up any readers, pulling them forward to the first readable
+ 	 * entry after (what will be) the new write offset. We do this now
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index 924c54c..0ae406a 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -1401,22 +1401,19 @@ static int do_cmd_ioctl(struct comedi_device *dev,
+ 		DPRINTK("subdevice busy\n");
+ 		return -EBUSY;
+ 	}
+-	s->busy = file;
+ 
+ 	/* make sure channel/gain list isn't too long */
+ 	if (cmd.chanlist_len > s->len_chanlist) {
+ 		DPRINTK("channel/gain list too long %u > %d\n",
+ 			cmd.chanlist_len, s->len_chanlist);
+-		ret = -EINVAL;
+-		goto cleanup;
++		return -EINVAL;
+ 	}
+ 
+ 	/* make sure channel/gain list isn't too short */
+ 	if (cmd.chanlist_len < 1) {
+ 		DPRINTK("channel/gain list too short %u < 1\n",
+ 			cmd.chanlist_len);
+-		ret = -EINVAL;
+-		goto cleanup;
++		return -EINVAL;
+ 	}
+ 
+ 	async->cmd = cmd;
+@@ -1426,8 +1423,7 @@ static int do_cmd_ioctl(struct comedi_device *dev,
+ 	    kmalloc(async->cmd.chanlist_len * sizeof(int), GFP_KERNEL);
+ 	if (!async->cmd.chanlist) {
+ 		DPRINTK("allocation failed\n");
+-		ret = -ENOMEM;
+-		goto cleanup;
++		return -ENOMEM;
+ 	}
+ 
+ 	if (copy_from_user(async->cmd.chanlist, user_chanlist,
+@@ -1479,6 +1475,9 @@ static int do_cmd_ioctl(struct comedi_device *dev,
+ 
+ 	comedi_set_subdevice_runflags(s, ~0, SRF_USER | SRF_RUNNING);
+ 
++	/* set s->busy _after_ setting SRF_RUNNING flag to avoid race with
++	 * comedi_read() or comedi_write() */
++	s->busy = file;
+ 	ret = s->do_cmd(dev, s);
+ 	if (ret == 0)
+ 		return 0;
+@@ -1693,6 +1692,7 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
+ 			   void *file)
+ {
+ 	struct comedi_subdevice *s;
++	int ret;
+ 
+ 	if (arg >= dev->n_subdevices)
+ 		return -EINVAL;
+@@ -1709,7 +1709,11 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
+ 	if (s->busy != file)
+ 		return -EBUSY;
+ 
+-	return do_cancel(dev, s);
++	ret = do_cancel(dev, s);
++	if (comedi_get_subdevice_runflags(s) & SRF_USER)
++		wake_up_interruptible(&s->async->wait_head);
++
++	return ret;
+ }
+ 
+ /*
+@@ -2041,11 +2045,13 @@ static ssize_t comedi_write(struct file *file, const char __user *buf,
+ 
+ 		if (!comedi_is_subdevice_running(s)) {
+ 			if (count == 0) {
++				mutex_lock(&dev->mutex);
+ 				if (comedi_is_subdevice_in_error(s))
+ 					retval = -EPIPE;
+ 				else
+ 					retval = 0;
+ 				do_become_nonbusy(dev, s);
++				mutex_unlock(&dev->mutex);
+ 			}
+ 			break;
+ 		}
+@@ -2144,11 +2150,13 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
+ 
+ 		if (n == 0) {
+ 			if (!comedi_is_subdevice_running(s)) {
++				mutex_lock(&dev->mutex);
+ 				do_become_nonbusy(dev, s);
+ 				if (comedi_is_subdevice_in_error(s))
+ 					retval = -EPIPE;
+ 				else
+ 					retval = 0;
++				mutex_unlock(&dev->mutex);
+ 				break;
+ 			}
+ 			if (file->f_flags & O_NONBLOCK) {
+@@ -2186,9 +2194,11 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
+ 		buf += n;
+ 		break;		/* makes device work like a pipe */
+ 	}
+-	if (comedi_is_subdevice_idle(s) &&
+-	    async->buf_read_count - async->buf_write_count == 0) {
+-		do_become_nonbusy(dev, s);
++	if (comedi_is_subdevice_idle(s)) {
++		mutex_lock(&dev->mutex);
++		if (async->buf_read_count - async->buf_write_count == 0)
++			do_become_nonbusy(dev, s);
++		mutex_unlock(&dev->mutex);
+ 	}
+ 	set_current_state(TASK_RUNNING);
+ 	remove_wait_queue(&async->wait_head, &wait);
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index d7705e5..012ff8b 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -628,25 +628,18 @@ static void __exit iscsi_target_cleanup_module(void)
+ }
+ 
+ static int iscsit_add_reject(
++	struct iscsi_conn *conn,
+ 	u8 reason,
+-	int fail_conn,
+-	unsigned char *buf,
+-	struct iscsi_conn *conn)
++	unsigned char *buf)
+ {
+ 	struct iscsi_cmd *cmd;
+-	struct iscsi_reject *hdr;
+-	int ret;
+ 
+ 	cmd = iscsit_allocate_cmd(conn, GFP_KERNEL);
+ 	if (!cmd)
+ 		return -1;
+ 
+ 	cmd->iscsi_opcode = ISCSI_OP_REJECT;
+-	if (fail_conn)
+-		cmd->cmd_flags |= ICF_REJECT_FAIL_CONN;
+-
+-	hdr	= (struct iscsi_reject *) cmd->pdu;
+-	hdr->reason = reason;
++	cmd->reject_reason = reason;
+ 
+ 	cmd->buf_ptr = kmemdup(buf, ISCSI_HDR_LEN, GFP_KERNEL);
+ 	if (!cmd->buf_ptr) {
+@@ -662,23 +655,16 @@ static int iscsit_add_reject(
+ 	cmd->i_state = ISTATE_SEND_REJECT;
+ 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
+ 
+-	ret = wait_for_completion_interruptible(&cmd->reject_comp);
+-	if (ret != 0)
+-		return -1;
+-
+-	return (!fail_conn) ? 0 : -1;
++	return -1;
+ }
+ 
+-int iscsit_add_reject_from_cmd(
++static int iscsit_add_reject_from_cmd(
++	struct iscsi_cmd *cmd,
+ 	u8 reason,
+-	int fail_conn,
+-	int add_to_conn,
+-	unsigned char *buf,
+-	struct iscsi_cmd *cmd)
++	bool add_to_conn,
++	unsigned char *buf)
+ {
+ 	struct iscsi_conn *conn;
+-	struct iscsi_reject *hdr;
+-	int ret;
+ 
+ 	if (!cmd->conn) {
+ 		pr_err("cmd->conn is NULL for ITT: 0x%08x\n",
+@@ -688,11 +674,7 @@ int iscsit_add_reject_from_cmd(
+ 	conn = cmd->conn;
+ 
+ 	cmd->iscsi_opcode = ISCSI_OP_REJECT;
+-	if (fail_conn)
+-		cmd->cmd_flags |= ICF_REJECT_FAIL_CONN;
+-
+-	hdr	= (struct iscsi_reject *) cmd->pdu;
+-	hdr->reason = reason;
++	cmd->reject_reason = reason;
+ 
+ 	cmd->buf_ptr = kmemdup(buf, ISCSI_HDR_LEN, GFP_KERNEL);
+ 	if (!cmd->buf_ptr) {
+@@ -709,8 +691,6 @@ int iscsit_add_reject_from_cmd(
+ 
+ 	cmd->i_state = ISTATE_SEND_REJECT;
+ 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
+-
+-	ret = wait_for_completion_interruptible(&cmd->reject_comp);
+ 	/*
+ 	 * Perform the kref_put now if se_cmd has already been setup by
+ 	 * scsit_setup_scsi_cmd()
+@@ -719,12 +699,19 @@ int iscsit_add_reject_from_cmd(
+ 		pr_debug("iscsi reject: calling target_put_sess_cmd >>>>>>\n");
+ 		target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
+ 	}
+-	if (ret != 0)
+-		return -1;
++	return -1;
++}
+ 
+-	return (!fail_conn) ? 0 : -1;
++static int iscsit_add_reject_cmd(struct iscsi_cmd *cmd, u8 reason,
++				 unsigned char *buf)
++{
++	return iscsit_add_reject_from_cmd(cmd, reason, true, buf);
++}
++
++int iscsit_reject_cmd(struct iscsi_cmd *cmd, u8 reason, unsigned char *buf)
++{
++	return iscsit_add_reject_from_cmd(cmd, reason, false, buf);
+ }
+-EXPORT_SYMBOL(iscsit_add_reject_from_cmd);
+ 
+ /*
+  * Map some portion of the allocated scatterlist to an iovec, suitable for
+@@ -844,8 +831,8 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	    !(hdr->flags & ISCSI_FLAG_CMD_FINAL)) {
+ 		pr_err("ISCSI_FLAG_CMD_WRITE & ISCSI_FLAG_CMD_FINAL"
+ 				" not set. Bad iSCSI Initiator.\n");
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_BOOKMARK_INVALID,
+-				1, 1, buf, cmd);
++		return iscsit_add_reject_cmd(cmd,
++					     ISCSI_REASON_BOOKMARK_INVALID, buf);
+ 	}
+ 
+ 	if (((hdr->flags & ISCSI_FLAG_CMD_READ) ||
+@@ -865,8 +852,8 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 		pr_err("ISCSI_FLAG_CMD_READ or ISCSI_FLAG_CMD_WRITE"
+ 			" set when Expected Data Transfer Length is 0 for"
+ 			" CDB: 0x%02x. Bad iSCSI Initiator.\n", hdr->cdb[0]);
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_BOOKMARK_INVALID,
+-				1, 1, buf, cmd);
++		return iscsit_add_reject_cmd(cmd,
++					     ISCSI_REASON_BOOKMARK_INVALID, buf);
+ 	}
+ done:
+ 
+@@ -875,62 +862,62 @@ done:
+ 		pr_err("ISCSI_FLAG_CMD_READ and/or ISCSI_FLAG_CMD_WRITE"
+ 			" MUST be set if Expected Data Transfer Length is not 0."
+ 			" Bad iSCSI Initiator\n");
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_BOOKMARK_INVALID,
+-				1, 1, buf, cmd);
++		return iscsit_add_reject_cmd(cmd,
++					     ISCSI_REASON_BOOKMARK_INVALID, buf);
+ 	}
+ 
+ 	if ((hdr->flags & ISCSI_FLAG_CMD_READ) &&
+ 	    (hdr->flags & ISCSI_FLAG_CMD_WRITE)) {
+ 		pr_err("Bidirectional operations not supported!\n");
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_BOOKMARK_INVALID,
+-				1, 1, buf, cmd);
++		return iscsit_add_reject_cmd(cmd,
++					     ISCSI_REASON_BOOKMARK_INVALID, buf);
+ 	}
+ 
+ 	if (hdr->opcode & ISCSI_OP_IMMEDIATE) {
+ 		pr_err("Illegally set Immediate Bit in iSCSI Initiator"
+ 				" Scsi Command PDU.\n");
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_BOOKMARK_INVALID,
+-				1, 1, buf, cmd);
++		return iscsit_add_reject_cmd(cmd,
++					     ISCSI_REASON_BOOKMARK_INVALID, buf);
+ 	}
+ 
+ 	if (payload_length && !conn->sess->sess_ops->ImmediateData) {
+ 		pr_err("ImmediateData=No but DataSegmentLength=%u,"
+ 			" protocol error.\n", payload_length);
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_PROTOCOL_ERROR,
+-				1, 1, buf, cmd);
++		return iscsit_add_reject_cmd(cmd,
++					     ISCSI_REASON_PROTOCOL_ERROR, buf);
+ 	}
+ 
+-	if ((be32_to_cpu(hdr->data_length )== payload_length) &&
++	if ((be32_to_cpu(hdr->data_length) == payload_length) &&
+ 	    (!(hdr->flags & ISCSI_FLAG_CMD_FINAL))) {
+ 		pr_err("Expected Data Transfer Length and Length of"
+ 			" Immediate Data are the same, but ISCSI_FLAG_CMD_FINAL"
+ 			" bit is not set protocol error\n");
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_PROTOCOL_ERROR,
+-				1, 1, buf, cmd);
++		return iscsit_add_reject_cmd(cmd,
++					     ISCSI_REASON_PROTOCOL_ERROR, buf);
+ 	}
+ 
+ 	if (payload_length > be32_to_cpu(hdr->data_length)) {
+ 		pr_err("DataSegmentLength: %u is greater than"
+ 			" EDTL: %u, protocol error.\n", payload_length,
+ 				hdr->data_length);
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_PROTOCOL_ERROR,
+-				1, 1, buf, cmd);
++		return iscsit_add_reject_cmd(cmd,
++					     ISCSI_REASON_PROTOCOL_ERROR, buf);
+ 	}
+ 
+ 	if (payload_length > conn->conn_ops->MaxXmitDataSegmentLength) {
+ 		pr_err("DataSegmentLength: %u is greater than"
+ 			" MaxXmitDataSegmentLength: %u, protocol error.\n",
+ 			payload_length, conn->conn_ops->MaxXmitDataSegmentLength);
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_PROTOCOL_ERROR,
+-				1, 1, buf, cmd);
++		return iscsit_add_reject_cmd(cmd,
++					     ISCSI_REASON_PROTOCOL_ERROR, buf);
+ 	}
+ 
+ 	if (payload_length > conn->sess->sess_ops->FirstBurstLength) {
+ 		pr_err("DataSegmentLength: %u is greater than"
+ 			" FirstBurstLength: %u, protocol error.\n",
+ 			payload_length, conn->sess->sess_ops->FirstBurstLength);
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_BOOKMARK_INVALID,
+-				1, 1, buf, cmd);
++		return iscsit_add_reject_cmd(cmd,
++					     ISCSI_REASON_BOOKMARK_INVALID, buf);
+ 	}
+ 
+ 	data_direction = (hdr->flags & ISCSI_FLAG_CMD_WRITE) ? DMA_TO_DEVICE :
+@@ -985,9 +972,8 @@ done:
+ 
+ 		dr = iscsit_allocate_datain_req();
+ 		if (!dr)
+-			return iscsit_add_reject_from_cmd(
+-					ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+-					1, 1, buf, cmd);
++			return iscsit_add_reject_cmd(cmd,
++					ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ 
+ 		iscsit_attach_datain_req(cmd, dr);
+ 	}
+@@ -1015,18 +1001,16 @@ done:
+ 	cmd->sense_reason = target_setup_cmd_from_cdb(&cmd->se_cmd, hdr->cdb);
+ 	if (cmd->sense_reason) {
+ 		if (cmd->sense_reason == TCM_OUT_OF_RESOURCES) {
+-			return iscsit_add_reject_from_cmd(
+-					ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+-					1, 1, buf, cmd);
++			return iscsit_add_reject_cmd(cmd,
++					ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ 		}
+ 
+ 		goto attach_cmd;
+ 	}
+ 
+ 	if (iscsit_build_pdu_and_seq_lists(cmd, payload_length) < 0) {
+-		return iscsit_add_reject_from_cmd(
+-			ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+-			1, 1, buf, cmd);
++		return iscsit_add_reject_cmd(cmd,
++				ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ 	}
+ 
+ attach_cmd:
+@@ -1068,17 +1052,13 @@ int iscsit_process_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	 * be acknowledged. (See below)
+ 	 */
+ 	if (!cmd->immediate_data) {
+-		cmdsn_ret = iscsit_sequence_cmd(conn, cmd, hdr->cmdsn);
+-		if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
+-			if (!cmd->sense_reason)
+-				return 0;
+-
++		cmdsn_ret = iscsit_sequence_cmd(conn, cmd,
++					(unsigned char *)hdr, hdr->cmdsn);
++		if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
++			return -1;
++		else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
+ 			target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
+ 			return 0;
+-		} else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) {
+-			return iscsit_add_reject_from_cmd(
+-				ISCSI_REASON_PROTOCOL_ERROR,
+-				1, 0, (unsigned char *)hdr, cmd);
+ 		}
+ 	}
+ 
+@@ -1103,6 +1083,9 @@ int iscsit_process_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	 * iscsit_check_received_cmdsn() in iscsit_get_immediate_data() below.
+ 	 */
+ 	if (cmd->sense_reason) {
++		if (cmd->reject_reason)
++			return 0;
++
+ 		target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
+ 		return 1;
+ 	}
+@@ -1111,10 +1094,8 @@ int iscsit_process_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	 * the backend memory allocation.
+ 	 */
+ 	cmd->sense_reason = transport_generic_new_cmd(&cmd->se_cmd);
+-	if (cmd->sense_reason) {
+-		target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
++	if (cmd->sense_reason)
+ 		return 1;
+-	}
+ 
+ 	return 0;
+ }
+@@ -1124,6 +1105,7 @@ static int
+ iscsit_get_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr,
+ 			  bool dump_payload)
+ {
++	struct iscsi_conn *conn = cmd->conn;
+ 	int cmdsn_ret = 0, immed_ret = IMMEDIATE_DATA_NORMAL_OPERATION;
+ 	/*
+ 	 * Special case for Unsupported SAM WRITE Opcodes and ImmediateData=Yes.
+@@ -1140,20 +1122,25 @@ after_immediate_data:
+ 		 * DataCRC, check against ExpCmdSN/MaxCmdSN if
+ 		 * Immediate Bit is not set.
+ 		 */
+-		cmdsn_ret = iscsit_sequence_cmd(cmd->conn, cmd, hdr->cmdsn);
++		cmdsn_ret = iscsit_sequence_cmd(cmd->conn, cmd,
++					(unsigned char *)hdr, hdr->cmdsn);
++		if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) {
++			return -1;
++		} else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
++			target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
++			return 0;
++		}
+ 
+ 		if (cmd->sense_reason) {
+-			if (iscsit_dump_data_payload(cmd->conn,
+-					cmd->first_burst_len, 1) < 0)
+-				return -1;
++			int rc;
++
++			rc = iscsit_dump_data_payload(cmd->conn,
++						      cmd->first_burst_len, 1);
++			target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
++			return rc;
+ 		} else if (cmd->unsolicited_data)
+ 			iscsit_set_unsoliticed_dataout(cmd);
+ 
+-		if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
+-			return iscsit_add_reject_from_cmd(
+-				ISCSI_REASON_PROTOCOL_ERROR,
+-				1, 0, (unsigned char *)hdr, cmd);
+-
+ 	} else if (immed_ret == IMMEDIATE_DATA_ERL1_CRC_FAILURE) {
+ 		/*
+ 		 * Immediate Data failed DataCRC and ERL>=1,
+@@ -1184,15 +1171,14 @@ iscsit_handle_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 
+ 	rc = iscsit_setup_scsi_cmd(conn, cmd, buf);
+ 	if (rc < 0)
+-		return rc;
++		return 0;
+ 	/*
+ 	 * Allocation iovecs needed for struct socket operations for
+ 	 * traditional iSCSI block I/O.
+ 	 */
+ 	if (iscsit_allocate_iovecs(cmd) < 0) {
+-		return iscsit_add_reject_from_cmd(
+-				ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+-				1, 0, buf, cmd);
++		return iscsit_add_reject_cmd(cmd,
++				ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ 	}
+ 	immed_data = cmd->immediate_data;
+ 
+@@ -1283,8 +1269,8 @@ iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf,
+ 
+ 	if (!payload_length) {
+ 		pr_err("DataOUT payload is ZERO, protocol error.\n");
+-		return iscsit_add_reject(ISCSI_REASON_PROTOCOL_ERROR, 1,
+-					buf, conn);
++		return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
++					 buf);
+ 	}
+ 
+ 	/* iSCSI write */
+@@ -1301,8 +1287,8 @@ iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf,
+ 		pr_err("DataSegmentLength: %u is greater than"
+ 			" MaxXmitDataSegmentLength: %u\n", payload_length,
+ 			conn->conn_ops->MaxXmitDataSegmentLength);
+-		return iscsit_add_reject(ISCSI_REASON_PROTOCOL_ERROR, 1,
+-					buf, conn);
++		return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
++					 buf);
+ 	}
+ 
+ 	cmd = iscsit_find_cmd_from_itt_or_dump(conn, hdr->itt,
+@@ -1325,8 +1311,7 @@ iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf,
+ 	if (cmd->data_direction != DMA_TO_DEVICE) {
+ 		pr_err("Command ITT: 0x%08x received DataOUT for a"
+ 			" NON-WRITE command.\n", cmd->init_task_tag);
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_PROTOCOL_ERROR,
+-				1, 0, buf, cmd);
++		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf);
+ 	}
+ 	se_cmd = &cmd->se_cmd;
+ 	iscsit_mod_dataout_timer(cmd);
+@@ -1335,8 +1320,7 @@ iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf,
+ 		pr_err("DataOut Offset: %u, Length %u greater than"
+ 			" iSCSI Command EDTL %u, protocol error.\n",
+ 			hdr->offset, payload_length, cmd->se_cmd.data_length);
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_BOOKMARK_INVALID,
+-				1, 0, buf, cmd);
++		return iscsit_reject_cmd(cmd, ISCSI_REASON_BOOKMARK_INVALID, buf);
+ 	}
+ 
+ 	if (cmd->unsolicited_data) {
+@@ -1528,7 +1512,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
+ 
+ 	rc = iscsit_check_dataout_hdr(conn, buf, &cmd);
+ 	if (rc < 0)
+-		return rc;
++		return 0;
+ 	else if (!cmd)
+ 		return 0;
+ 
+@@ -1557,8 +1541,8 @@ int iscsit_handle_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	if (hdr->itt == RESERVED_ITT && !(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
+ 		pr_err("NOPOUT ITT is reserved, but Immediate Bit is"
+ 			" not set, protocol error.\n");
+-		return iscsit_add_reject(ISCSI_REASON_PROTOCOL_ERROR, 1,
+-					buf, conn);
++		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
++					 (unsigned char *)hdr);
+ 	}
+ 
+ 	if (payload_length > conn->conn_ops->MaxXmitDataSegmentLength) {
+@@ -1566,8 +1550,8 @@ int iscsit_handle_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 			" greater than MaxXmitDataSegmentLength: %u, protocol"
+ 			" error.\n", payload_length,
+ 			conn->conn_ops->MaxXmitDataSegmentLength);
+-		return iscsit_add_reject(ISCSI_REASON_PROTOCOL_ERROR, 1,
+-					buf, conn);
++		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
++					 (unsigned char *)hdr);
+ 	}
+ 
+ 	pr_debug("Got NOPOUT Ping %s ITT: 0x%08x, TTT: 0x%08x,"
+@@ -1584,9 +1568,9 @@ int iscsit_handle_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	 */
+ 	if (hdr->ttt == cpu_to_be32(0xFFFFFFFF)) {
+ 		if (!cmd)
+-			return iscsit_add_reject(
++			return iscsit_reject_cmd(cmd,
+ 					ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+-					1, buf, conn);
++					(unsigned char *)hdr);
+ 
+ 		cmd->iscsi_opcode	= ISCSI_OP_NOOP_OUT;
+ 		cmd->i_state		= ISTATE_SEND_NOPIN;
+@@ -1700,15 +1684,14 @@ int iscsit_handle_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 			return 0;
+ 		}
+ 
+-		cmdsn_ret = iscsit_sequence_cmd(conn, cmd, hdr->cmdsn);
++		cmdsn_ret = iscsit_sequence_cmd(conn, cmd,
++				(unsigned char *)hdr, hdr->cmdsn);
+ 		if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
+ 			ret = 0;
+ 			goto ping_out;
+ 		}
+ 		if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
+-			return iscsit_add_reject_from_cmd(
+-					ISCSI_REASON_PROTOCOL_ERROR,
+-					1, 0, buf, cmd);
++			return -1;
+ 
+ 		return 0;
+ 	}
+@@ -1757,8 +1740,8 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	struct se_tmr_req *se_tmr;
+ 	struct iscsi_tmr_req *tmr_req;
+ 	struct iscsi_tm *hdr;
+-	int out_of_order_cmdsn = 0;
+-	int ret;
++	int out_of_order_cmdsn = 0, ret;
++	bool sess_ref = false;
+ 	u8 function;
+ 
+ 	hdr			= (struct iscsi_tm *) buf;
+@@ -1782,8 +1765,8 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 		pr_err("Task Management Request TASK_REASSIGN not"
+ 			" issued as immediate command, bad iSCSI Initiator"
+ 				"implementation\n");
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_PROTOCOL_ERROR,
+-					1, 1, buf, cmd);
++		return iscsit_add_reject_cmd(cmd,
++					     ISCSI_REASON_PROTOCOL_ERROR, buf);
+ 	}
+ 	if ((function != ISCSI_TM_FUNC_ABORT_TASK) &&
+ 	    be32_to_cpu(hdr->refcmdsn) != ISCSI_RESERVED_TAG)
+@@ -1795,9 +1778,9 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	if (!cmd->tmr_req) {
+ 		pr_err("Unable to allocate memory for"
+ 			" Task Management command!\n");
+-		return iscsit_add_reject_from_cmd(
+-			ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+-			1, 1, buf, cmd);
++		return iscsit_add_reject_cmd(cmd,
++					     ISCSI_REASON_BOOKMARK_NO_RESOURCES,
++					     buf);
+ 	}
+ 
+ 	/*
+@@ -1814,6 +1797,9 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 				      conn->sess->se_sess, 0, DMA_NONE,
+ 				      MSG_SIMPLE_TAG, cmd->sense_buffer + 2);
+ 
++		target_get_sess_cmd(conn->sess->se_sess, &cmd->se_cmd, true);
++		sess_ref = true;
++
+ 		switch (function) {
+ 		case ISCSI_TM_FUNC_ABORT_TASK:
+ 			tcm_function = TMR_ABORT_TASK;
+@@ -1839,17 +1825,15 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 		default:
+ 			pr_err("Unknown iSCSI TMR Function:"
+ 			       " 0x%02x\n", function);
+-			return iscsit_add_reject_from_cmd(
+-				ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+-				1, 1, buf, cmd);
++			return iscsit_add_reject_cmd(cmd,
++				ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ 		}
+ 
+ 		ret = core_tmr_alloc_req(&cmd->se_cmd, cmd->tmr_req,
+ 					 tcm_function, GFP_KERNEL);
+ 		if (ret < 0)
+-			return iscsit_add_reject_from_cmd(
+-				ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+-				1, 1, buf, cmd);
++			return iscsit_add_reject_cmd(cmd,
++				ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ 
+ 		cmd->tmr_req->se_tmr_req = cmd->se_cmd.se_tmr_req;
+ 	}
+@@ -1908,9 +1892,8 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 			break;
+ 
+ 		if (iscsit_check_task_reassign_expdatasn(tmr_req, conn) < 0)
+-			return iscsit_add_reject_from_cmd(
+-					ISCSI_REASON_BOOKMARK_INVALID, 1, 1,
+-					buf, cmd);
++			return iscsit_add_reject_cmd(cmd,
++					ISCSI_REASON_BOOKMARK_INVALID, buf);
+ 		break;
+ 	default:
+ 		pr_err("Unknown TMR function: 0x%02x, protocol"
+@@ -1928,15 +1911,13 @@ attach:
+ 	spin_unlock_bh(&conn->cmd_lock);
+ 
+ 	if (!(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
+-		int cmdsn_ret = iscsit_sequence_cmd(conn, cmd, hdr->cmdsn);
++		int cmdsn_ret = iscsit_sequence_cmd(conn, cmd, buf, hdr->cmdsn);
+ 		if (cmdsn_ret == CMDSN_HIGHER_THAN_EXP)
+ 			out_of_order_cmdsn = 1;
+ 		else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP)
+ 			return 0;
+ 		else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
+-			return iscsit_add_reject_from_cmd(
+-					ISCSI_REASON_PROTOCOL_ERROR,
+-					1, 0, buf, cmd);
++			return -1;
+ 	}
+ 	iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
+ 
+@@ -1956,6 +1937,11 @@ attach:
+ 	 * For connection recovery, this is also the default action for
+ 	 * TMR TASK_REASSIGN.
+ 	 */
++	if (sess_ref) {
++		pr_debug("Handle TMR, using sess_ref=true check\n");
++		target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
++	}
++
+ 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
+ 	return 0;
+ }
+@@ -1981,8 +1967,7 @@ static int iscsit_handle_text_cmd(
+ 		pr_err("Unable to accept text parameter length: %u"
+ 			"greater than MaxXmitDataSegmentLength %u.\n",
+ 		       payload_length, conn->conn_ops->MaxXmitDataSegmentLength);
+-		return iscsit_add_reject(ISCSI_REASON_PROTOCOL_ERROR, 1,
+-					buf, conn);
++		return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR, buf);
+ 	}
+ 
+ 	pr_debug("Got Text Request: ITT: 0x%08x, CmdSN: 0x%08x,"
+@@ -2084,8 +2069,8 @@ static int iscsit_handle_text_cmd(
+ 
+ 	cmd = iscsit_allocate_cmd(conn, GFP_KERNEL);
+ 	if (!cmd)
+-		return iscsit_add_reject(ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+-					1, buf, conn);
++		return iscsit_add_reject(conn,
++					 ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ 
+ 	cmd->iscsi_opcode	= ISCSI_OP_TEXT;
+ 	cmd->i_state		= ISTATE_SEND_TEXTRSP;
+@@ -2103,11 +2088,10 @@ static int iscsit_handle_text_cmd(
+ 	iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
+ 
+ 	if (!(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
+-		cmdsn_ret = iscsit_sequence_cmd(conn, cmd, hdr->cmdsn);
++		cmdsn_ret = iscsit_sequence_cmd(conn, cmd,
++				(unsigned char *)hdr, hdr->cmdsn);
+ 		if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
+-			return iscsit_add_reject_from_cmd(
+-					ISCSI_REASON_PROTOCOL_ERROR,
+-					1, 0, buf, cmd);
++			return -1;
+ 
+ 		return 0;
+ 	}
+@@ -2292,14 +2276,11 @@ iscsit_handle_logout_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 		if (ret < 0)
+ 			return ret;
+ 	} else {
+-		cmdsn_ret = iscsit_sequence_cmd(conn, cmd, hdr->cmdsn);
+-		if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
++		cmdsn_ret = iscsit_sequence_cmd(conn, cmd, buf, hdr->cmdsn);
++		if (cmdsn_ret == CMDSN_LOWER_THAN_EXP)
+ 			logout_remove = 0;
+-		} else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) {
+-			return iscsit_add_reject_from_cmd(
+-				ISCSI_REASON_PROTOCOL_ERROR,
+-				1, 0, buf, cmd);
+-		}
++		else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
++			return -1;
+ 	}
+ 
+ 	return logout_remove;
+@@ -2323,8 +2304,8 @@ static int iscsit_handle_snack(
+ 	if (!conn->sess->sess_ops->ErrorRecoveryLevel) {
+ 		pr_err("Initiator sent SNACK request while in"
+ 			" ErrorRecoveryLevel=0.\n");
+-		return iscsit_add_reject(ISCSI_REASON_PROTOCOL_ERROR, 1,
+-					buf, conn);
++		return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
++					 buf);
+ 	}
+ 	/*
+ 	 * SNACK_DATA and SNACK_R2T are both 0,  so check which function to
+@@ -2348,13 +2329,13 @@ static int iscsit_handle_snack(
+ 	case ISCSI_FLAG_SNACK_TYPE_RDATA:
+ 		/* FIXME: Support R-Data SNACK */
+ 		pr_err("R-Data SNACK Not Supported.\n");
+-		return iscsit_add_reject(ISCSI_REASON_PROTOCOL_ERROR, 1,
+-					buf, conn);
++		return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
++					 buf);
+ 	default:
+ 		pr_err("Unknown SNACK type 0x%02x, protocol"
+ 			" error.\n", hdr->flags & 0x0f);
+-		return iscsit_add_reject(ISCSI_REASON_PROTOCOL_ERROR, 1,
+-					buf, conn);
++		return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
++					 buf);
+ 	}
+ 
+ 	return 0;
+@@ -2426,14 +2407,14 @@ static int iscsit_handle_immediate_data(
+ 				pr_err("Unable to recover from"
+ 					" Immediate Data digest failure while"
+ 					" in ERL=0.\n");
+-				iscsit_add_reject_from_cmd(
++				iscsit_reject_cmd(cmd,
+ 						ISCSI_REASON_DATA_DIGEST_ERROR,
+-						1, 0, (unsigned char *)hdr, cmd);
++						(unsigned char *)hdr);
+ 				return IMMEDIATE_DATA_CANNOT_RECOVER;
+ 			} else {
+-				iscsit_add_reject_from_cmd(
++				iscsit_reject_cmd(cmd,
+ 						ISCSI_REASON_DATA_DIGEST_ERROR,
+-						0, 0, (unsigned char *)hdr, cmd);
++						(unsigned char *)hdr);
+ 				return IMMEDIATE_DATA_ERL1_CRC_FAILURE;
+ 			}
+ 		} else {
+@@ -3533,6 +3514,7 @@ iscsit_build_reject(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
+ 		    struct iscsi_reject *hdr)
+ {
+ 	hdr->opcode		= ISCSI_OP_REJECT;
++	hdr->reason		= cmd->reject_reason;
+ 	hdr->flags		|= ISCSI_FLAG_CMD_FINAL;
+ 	hton24(hdr->dlength, ISCSI_HDR_LEN);
+ 	hdr->ffffffff		= cpu_to_be32(0xffffffff);
+@@ -3806,18 +3788,11 @@ check_rsp_state:
+ 	case ISTATE_SEND_STATUS_RECOVERY:
+ 	case ISTATE_SEND_TEXTRSP:
+ 	case ISTATE_SEND_TASKMGTRSP:
++	case ISTATE_SEND_REJECT:
+ 		spin_lock_bh(&cmd->istate_lock);
+ 		cmd->i_state = ISTATE_SENT_STATUS;
+ 		spin_unlock_bh(&cmd->istate_lock);
+ 		break;
+-	case ISTATE_SEND_REJECT:
+-		if (cmd->cmd_flags & ICF_REJECT_FAIL_CONN) {
+-			cmd->cmd_flags &= ~ICF_REJECT_FAIL_CONN;
+-			complete(&cmd->reject_comp);
+-			goto err;
+-		}
+-		complete(&cmd->reject_comp);
+-		break;
+ 	default:
+ 		pr_err("Unknown Opcode: 0x%02x ITT:"
+ 		       " 0x%08x, i_state: %d on CID: %hu\n",
+@@ -3922,8 +3897,7 @@ static int iscsi_target_rx_opcode(struct iscsi_conn *conn, unsigned char *buf)
+ 	case ISCSI_OP_SCSI_CMD:
+ 		cmd = iscsit_allocate_cmd(conn, GFP_KERNEL);
+ 		if (!cmd)
+-			return iscsit_add_reject(ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+-						1, buf, conn);
++			goto reject;
+ 
+ 		ret = iscsit_handle_scsi_cmd(conn, cmd, buf);
+ 		break;
+@@ -3935,16 +3909,14 @@ static int iscsi_target_rx_opcode(struct iscsi_conn *conn, unsigned char *buf)
+ 		if (hdr->ttt == cpu_to_be32(0xFFFFFFFF)) {
+ 			cmd = iscsit_allocate_cmd(conn, GFP_KERNEL);
+ 			if (!cmd)
+-				return iscsit_add_reject(ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+-						1, buf, conn);
++				goto reject;
+ 		}
+ 		ret = iscsit_handle_nop_out(conn, cmd, buf);
+ 		break;
+ 	case ISCSI_OP_SCSI_TMFUNC:
+ 		cmd = iscsit_allocate_cmd(conn, GFP_KERNEL);
+ 		if (!cmd)
+-			return iscsit_add_reject(ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+-						1, buf, conn);
++			goto reject;
+ 
+ 		ret = iscsit_handle_task_mgt_cmd(conn, cmd, buf);
+ 		break;
+@@ -3954,8 +3926,7 @@ static int iscsi_target_rx_opcode(struct iscsi_conn *conn, unsigned char *buf)
+ 	case ISCSI_OP_LOGOUT:
+ 		cmd = iscsit_allocate_cmd(conn, GFP_KERNEL);
+ 		if (!cmd)
+-			return iscsit_add_reject(ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+-						1, buf, conn);
++			goto reject;
+ 
+ 		ret = iscsit_handle_logout_cmd(conn, cmd, buf);
+ 		if (ret > 0)
+@@ -3987,6 +3958,8 @@ static int iscsi_target_rx_opcode(struct iscsi_conn *conn, unsigned char *buf)
+ 	}
+ 
+ 	return ret;
++reject:
++	return iscsit_add_reject(conn, ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ }
+ 
+ int iscsi_target_rx_thread(void *arg)
+@@ -4086,8 +4059,8 @@ restart:
+ 		    (!(opcode & ISCSI_OP_LOGOUT)))) {
+ 			pr_err("Received illegal iSCSI Opcode: 0x%02x"
+ 			" while in Discovery Session, rejecting.\n", opcode);
+-			iscsit_add_reject(ISCSI_REASON_PROTOCOL_ERROR, 1,
+-					buffer, conn);
++			iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
++					  buffer);
+ 			goto transport_err;
+ 		}
+ 
+diff --git a/drivers/target/iscsi/iscsi_target.h b/drivers/target/iscsi/iscsi_target.h
+index a0050b2..2c437cb 100644
+--- a/drivers/target/iscsi/iscsi_target.h
++++ b/drivers/target/iscsi/iscsi_target.h
+@@ -15,7 +15,7 @@ extern struct iscsi_np *iscsit_add_np(struct __kernel_sockaddr_storage *,
+ extern int iscsit_reset_np_thread(struct iscsi_np *, struct iscsi_tpg_np *,
+ 				struct iscsi_portal_group *);
+ extern int iscsit_del_np(struct iscsi_np *);
+-extern int iscsit_add_reject_from_cmd(u8, int, int, unsigned char *, struct iscsi_cmd *);
++extern int iscsit_reject_cmd(struct iscsi_cmd *cmd, u8, unsigned char *);
+ extern void iscsit_set_unsoliticed_dataout(struct iscsi_cmd *);
+ extern int iscsit_logout_closesession(struct iscsi_cmd *, struct iscsi_conn *);
+ extern int iscsit_logout_closeconnection(struct iscsi_cmd *, struct iscsi_conn *);
+diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
+index 8d8b3ff..421344d 100644
+--- a/drivers/target/iscsi/iscsi_target_configfs.c
++++ b/drivers/target/iscsi/iscsi_target_configfs.c
+@@ -474,7 +474,7 @@ static ssize_t __iscsi_##prefix##_store_##name(				\
+ 	if (!capable(CAP_SYS_ADMIN))					\
+ 		return -EPERM;						\
+ 									\
+-	snprintf(auth->name, PAGE_SIZE, "%s", page);			\
++	snprintf(auth->name, sizeof(auth->name), "%s", page);		\
+ 	if (!strncmp("NULL", auth->name, 4))				\
+ 		auth->naf_flags &= ~flags;				\
+ 	else								\
+diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
+index 60ec4b9..8907dcd 100644
+--- a/drivers/target/iscsi/iscsi_target_core.h
++++ b/drivers/target/iscsi/iscsi_target_core.h
+@@ -132,7 +132,6 @@ enum cmd_flags_table {
+ 	ICF_CONTIG_MEMORY			= 0x00000020,
+ 	ICF_ATTACHED_TO_RQUEUE			= 0x00000040,
+ 	ICF_OOO_CMDSN				= 0x00000080,
+-	ICF_REJECT_FAIL_CONN			= 0x00000100,
+ };
+ 
+ /* struct iscsi_cmd->i_state */
+@@ -366,6 +365,8 @@ struct iscsi_cmd {
+ 	u8			maxcmdsn_inc;
+ 	/* Immediate Unsolicited Dataout */
+ 	u8			unsolicited_data;
++	/* Reject reason code */
++	u8			reject_reason;
+ 	/* CID contained in logout PDU when opcode == ISCSI_INIT_LOGOUT_CMND */
+ 	u16			logout_cid;
+ 	/* Command flags */
+@@ -446,7 +447,6 @@ struct iscsi_cmd {
+ 	struct list_head	datain_list;
+ 	/* R2T List */
+ 	struct list_head	cmd_r2t_list;
+-	struct completion	reject_comp;
+ 	/* Timer for DataOUT */
+ 	struct timer_list	dataout_timer;
+ 	/* Iovecs for SCSI data payload RX/TX w/ kernel level sockets */
+diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
+index dcb199d..08bd878 100644
+--- a/drivers/target/iscsi/iscsi_target_erl0.c
++++ b/drivers/target/iscsi/iscsi_target_erl0.c
+@@ -746,13 +746,12 @@ int iscsit_check_post_dataout(
+ 		if (!conn->sess->sess_ops->ErrorRecoveryLevel) {
+ 			pr_err("Unable to recover from DataOUT CRC"
+ 				" failure while ERL=0, closing session.\n");
+-			iscsit_add_reject_from_cmd(ISCSI_REASON_DATA_DIGEST_ERROR,
+-					1, 0, buf, cmd);
++			iscsit_reject_cmd(cmd, ISCSI_REASON_DATA_DIGEST_ERROR,
++					  buf);
+ 			return DATAOUT_CANNOT_RECOVER;
+ 		}
+ 
+-		iscsit_add_reject_from_cmd(ISCSI_REASON_DATA_DIGEST_ERROR,
+-				0, 0, buf, cmd);
++		iscsit_reject_cmd(cmd, ISCSI_REASON_DATA_DIGEST_ERROR, buf);
+ 		return iscsit_dataout_post_crc_failed(cmd, buf);
+ 	}
+ }
+@@ -909,6 +908,7 @@ void iscsit_cause_connection_reinstatement(struct iscsi_conn *conn, int sleep)
+ 	wait_for_completion(&conn->conn_wait_comp);
+ 	complete(&conn->conn_post_wait_comp);
+ }
++EXPORT_SYMBOL(iscsit_cause_connection_reinstatement);
+ 
+ void iscsit_fall_back_to_erl0(struct iscsi_session *sess)
+ {
+diff --git a/drivers/target/iscsi/iscsi_target_erl1.c b/drivers/target/iscsi/iscsi_target_erl1.c
+index 40d9dbc..586c268 100644
+--- a/drivers/target/iscsi/iscsi_target_erl1.c
++++ b/drivers/target/iscsi/iscsi_target_erl1.c
+@@ -162,9 +162,8 @@ static int iscsit_handle_r2t_snack(
+ 			" protocol error.\n", cmd->init_task_tag, begrun,
+ 			(begrun + runlength), cmd->acked_data_sn);
+ 
+-			return iscsit_add_reject_from_cmd(
+-					ISCSI_REASON_PROTOCOL_ERROR,
+-					1, 0, buf, cmd);
++			return iscsit_reject_cmd(cmd,
++					ISCSI_REASON_PROTOCOL_ERROR, buf);
+ 	}
+ 
+ 	if (runlength) {
+@@ -173,8 +172,8 @@ static int iscsit_handle_r2t_snack(
+ 			" with BegRun: 0x%08x, RunLength: 0x%08x, exceeds"
+ 			" current R2TSN: 0x%08x, protocol error.\n",
+ 			cmd->init_task_tag, begrun, runlength, cmd->r2t_sn);
+-			return iscsit_add_reject_from_cmd(
+-				ISCSI_REASON_BOOKMARK_INVALID, 1, 0, buf, cmd);
++			return iscsit_reject_cmd(cmd,
++					ISCSI_REASON_BOOKMARK_INVALID, buf);
+ 		}
+ 		last_r2tsn = (begrun + runlength);
+ 	} else
+@@ -433,8 +432,7 @@ static int iscsit_handle_recovery_datain(
+ 			" protocol error.\n", cmd->init_task_tag, begrun,
+ 			(begrun + runlength), cmd->acked_data_sn);
+ 
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_PROTOCOL_ERROR,
+-				1, 0, buf, cmd);
++		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf);
+ 	}
+ 
+ 	/*
+@@ -445,14 +443,14 @@ static int iscsit_handle_recovery_datain(
+ 		pr_err("Initiator requesting BegRun: 0x%08x, RunLength"
+ 			": 0x%08x greater than maximum DataSN: 0x%08x.\n",
+ 				begrun, runlength, (cmd->data_sn - 1));
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_BOOKMARK_INVALID,
+-				1, 0, buf, cmd);
++		return iscsit_reject_cmd(cmd, ISCSI_REASON_BOOKMARK_INVALID,
++					 buf);
+ 	}
+ 
+ 	dr = iscsit_allocate_datain_req();
+ 	if (!dr)
+-		return iscsit_add_reject_from_cmd(ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+-				1, 0, buf, cmd);
++		return iscsit_reject_cmd(cmd, ISCSI_REASON_BOOKMARK_NO_RESOURCES,
++					 buf);
+ 
+ 	dr->data_sn = dr->begrun = begrun;
+ 	dr->runlength = runlength;
+@@ -1090,7 +1088,7 @@ int iscsit_handle_ooo_cmdsn(
+ 
+ 	ooo_cmdsn = iscsit_allocate_ooo_cmdsn();
+ 	if (!ooo_cmdsn)
+-		return CMDSN_ERROR_CANNOT_RECOVER;
++		return -ENOMEM;
+ 
+ 	ooo_cmdsn->cmd			= cmd;
+ 	ooo_cmdsn->batch_count		= (batch) ?
+@@ -1101,10 +1099,10 @@ int iscsit_handle_ooo_cmdsn(
+ 
+ 	if (iscsit_attach_ooo_cmdsn(sess, ooo_cmdsn) < 0) {
+ 		kmem_cache_free(lio_ooo_cache, ooo_cmdsn);
+-		return CMDSN_ERROR_CANNOT_RECOVER;
++		return -ENOMEM;
+ 	}
+ 
+-	return CMDSN_HIGHER_THAN_EXP;
++	return 0;
+ }
+ 
+ static int iscsit_set_dataout_timeout_values(
+diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
+index 08a3bac..96e7fdb 100644
+--- a/drivers/target/iscsi/iscsi_target_util.c
++++ b/drivers/target/iscsi/iscsi_target_util.c
+@@ -178,7 +178,6 @@ struct iscsi_cmd *iscsit_allocate_cmd(struct iscsi_conn *conn, gfp_t gfp_mask)
+ 	INIT_LIST_HEAD(&cmd->i_conn_node);
+ 	INIT_LIST_HEAD(&cmd->datain_list);
+ 	INIT_LIST_HEAD(&cmd->cmd_r2t_list);
+-	init_completion(&cmd->reject_comp);
+ 	spin_lock_init(&cmd->datain_lock);
+ 	spin_lock_init(&cmd->dataout_timeout_lock);
+ 	spin_lock_init(&cmd->istate_lock);
+@@ -284,13 +283,12 @@ static inline int iscsit_check_received_cmdsn(struct iscsi_session *sess, u32 cm
+  * Commands may be received out of order if MC/S is in use.
+  * Ensure they are executed in CmdSN order.
+  */
+-int iscsit_sequence_cmd(
+-	struct iscsi_conn *conn,
+-	struct iscsi_cmd *cmd,
+-	__be32 cmdsn)
++int iscsit_sequence_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
++			unsigned char *buf, __be32 cmdsn)
+ {
+-	int ret;
+-	int cmdsn_ret;
++	int ret, cmdsn_ret;
++	bool reject = false;
++	u8 reason = ISCSI_REASON_BOOKMARK_NO_RESOURCES;
+ 
+ 	mutex_lock(&conn->sess->cmdsn_mutex);
+ 
+@@ -300,9 +298,19 @@ int iscsit_sequence_cmd(
+ 		ret = iscsit_execute_cmd(cmd, 0);
+ 		if ((ret >= 0) && !list_empty(&conn->sess->sess_ooo_cmdsn_list))
+ 			iscsit_execute_ooo_cmdsns(conn->sess);
++		else if (ret < 0) {
++			reject = true;
++			ret = CMDSN_ERROR_CANNOT_RECOVER;
++		}
+ 		break;
+ 	case CMDSN_HIGHER_THAN_EXP:
+ 		ret = iscsit_handle_ooo_cmdsn(conn->sess, cmd, be32_to_cpu(cmdsn));
++		if (ret < 0) {
++			reject = true;
++			ret = CMDSN_ERROR_CANNOT_RECOVER;
++			break;
++		}
++		ret = CMDSN_HIGHER_THAN_EXP;
+ 		break;
+ 	case CMDSN_LOWER_THAN_EXP:
+ 		cmd->i_state = ISTATE_REMOVE;
+@@ -310,11 +318,16 @@ int iscsit_sequence_cmd(
+ 		ret = cmdsn_ret;
+ 		break;
+ 	default:
++		reason = ISCSI_REASON_PROTOCOL_ERROR;
++		reject = true;
+ 		ret = cmdsn_ret;
+ 		break;
+ 	}
+ 	mutex_unlock(&conn->sess->cmdsn_mutex);
+ 
++	if (reject)
++		iscsit_reject_cmd(cmd, reason, buf);
++
+ 	return ret;
+ }
+ EXPORT_SYMBOL(iscsit_sequence_cmd);
+diff --git a/drivers/target/iscsi/iscsi_target_util.h b/drivers/target/iscsi/iscsi_target_util.h
+index a442265..e4fc34a 100644
+--- a/drivers/target/iscsi/iscsi_target_util.h
++++ b/drivers/target/iscsi/iscsi_target_util.h
+@@ -13,7 +13,8 @@ extern struct iscsi_cmd *iscsit_allocate_cmd(struct iscsi_conn *, gfp_t);
+ extern struct iscsi_seq *iscsit_get_seq_holder_for_datain(struct iscsi_cmd *, u32);
+ extern struct iscsi_seq *iscsit_get_seq_holder_for_r2t(struct iscsi_cmd *);
+ extern struct iscsi_r2t *iscsit_get_holder_for_r2tsn(struct iscsi_cmd *, u32);
+-int iscsit_sequence_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, __be32 cmdsn);
++extern int iscsit_sequence_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
++			       unsigned char * ,__be32 cmdsn);
+ extern int iscsit_check_unsolicited_dataout(struct iscsi_cmd *, unsigned char *);
+ extern struct iscsi_cmd *iscsit_find_cmd_from_itt(struct iscsi_conn *, itt_t);
+ extern struct iscsi_cmd *iscsit_find_cmd_from_itt_or_dump(struct iscsi_conn *,
+diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
+index 121aeb9..f597e88 100644
+--- a/drivers/tty/tty_port.c
++++ b/drivers/tty/tty_port.c
+@@ -256,10 +256,9 @@ void tty_port_tty_hangup(struct tty_port *port, bool check_clocal)
+ {
+ 	struct tty_struct *tty = tty_port_tty_get(port);
+ 
+-	if (tty && (!check_clocal || !C_CLOCAL(tty))) {
++	if (tty && (!check_clocal || !C_CLOCAL(tty)))
+ 		tty_hangup(tty);
+-		tty_kref_put(tty);
+-	}
++	tty_kref_put(tty);
+ }
+ EXPORT_SYMBOL_GPL(tty_port_tty_hangup);
+ 
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index feef935..b93fc88 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -668,6 +668,15 @@ resubmit:
+ static inline int
+ hub_clear_tt_buffer (struct usb_device *hdev, u16 devinfo, u16 tt)
+ {
++	/* Need to clear both directions for control ep */
++	if (((devinfo >> 11) & USB_ENDPOINT_XFERTYPE_MASK) ==
++			USB_ENDPOINT_XFER_CONTROL) {
++		int status = usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++				HUB_CLEAR_TT_BUFFER, USB_RT_PORT,
++				devinfo ^ 0x8000, tt, NULL, 0, 1000);
++		if (status)
++			return status;
++	}
+ 	return usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+ 			       HUB_CLEAR_TT_BUFFER, USB_RT_PORT, devinfo,
+ 			       tt, NULL, 0, 1000);
+@@ -2846,6 +2855,15 @@ static int usb_disable_function_remotewakeup(struct usb_device *udev)
+ 				USB_CTRL_SET_TIMEOUT);
+ }
+ 
++/* Count of wakeup-enabled devices at or below udev */
++static unsigned wakeup_enabled_descendants(struct usb_device *udev)
++{
++	struct usb_hub *hub = usb_hub_to_struct_hub(udev);
++
++	return udev->do_remote_wakeup +
++			(hub ? hub->wakeup_enabled_descendants : 0);
++}
++
+ /*
+  * usb_port_suspend - suspend a usb device's upstream port
+  * @udev: device that's no longer in active use, not a root hub
+@@ -2886,8 +2904,8 @@ static int usb_disable_function_remotewakeup(struct usb_device *udev)
+  * Linux (2.6) currently has NO mechanisms to initiate that:  no khubd
+  * timer, no SRP, no requests through sysfs.
+  *
+- * If Runtime PM isn't enabled or used, non-SuperSpeed devices really get
+- * suspended only when their bus goes into global suspend (i.e., the root
++ * If Runtime PM isn't enabled or used, non-SuperSpeed devices may not get
++ * suspended until their bus goes into global suspend (i.e., the root
+  * hub is suspended).  Nevertheless, we change @udev->state to
+  * USB_STATE_SUSPENDED as this is the device's "logical" state.  The actual
+  * upstream port setting is stored in @udev->port_is_suspended.
+@@ -2958,15 +2976,21 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ 	/* see 7.1.7.6 */
+ 	if (hub_is_superspeed(hub->hdev))
+ 		status = hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_U3);
+-	else if (PMSG_IS_AUTO(msg))
+-		status = set_port_feature(hub->hdev, port1,
+-						USB_PORT_FEAT_SUSPEND);
++
+ 	/*
+ 	 * For system suspend, we do not need to enable the suspend feature
+ 	 * on individual USB-2 ports.  The devices will automatically go
+ 	 * into suspend a few ms after the root hub stops sending packets.
+ 	 * The USB 2.0 spec calls this "global suspend".
++	 *
++	 * However, many USB hubs have a bug: They don't relay wakeup requests
++	 * from a downstream port if the port's suspend feature isn't on.
++	 * Therefore we will turn on the suspend feature if udev or any of its
++	 * descendants is enabled for remote wakeup.
+ 	 */
++	else if (PMSG_IS_AUTO(msg) || wakeup_enabled_descendants(udev) > 0)
++		status = set_port_feature(hub->hdev, port1,
++				USB_PORT_FEAT_SUSPEND);
+ 	else {
+ 		really_suspend = false;
+ 		status = 0;
+@@ -3001,15 +3025,16 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ 		if (!PMSG_IS_AUTO(msg))
+ 			status = 0;
+ 	} else {
+-		/* device has up to 10 msec to fully suspend */
+ 		dev_dbg(&udev->dev, "usb %ssuspend, wakeup %d\n",
+ 				(PMSG_IS_AUTO(msg) ? "auto-" : ""),
+ 				udev->do_remote_wakeup);
+-		usb_set_device_state(udev, USB_STATE_SUSPENDED);
+ 		if (really_suspend) {
+ 			udev->port_is_suspended = 1;
++
++			/* device has up to 10 msec to fully suspend */
+ 			msleep(10);
+ 		}
++		usb_set_device_state(udev, USB_STATE_SUSPENDED);
+ 	}
+ 
+ 	/*
+@@ -3291,7 +3316,11 @@ static int hub_suspend(struct usb_interface *intf, pm_message_t msg)
+ 	unsigned		port1;
+ 	int			status;
+ 
+-	/* Warn if children aren't already suspended */
++	/*
++	 * Warn if children aren't already suspended.
++	 * Also, add up the number of wakeup-enabled descendants.
++	 */
++	hub->wakeup_enabled_descendants = 0;
+ 	for (port1 = 1; port1 <= hdev->maxchild; port1++) {
+ 		struct usb_device	*udev;
+ 
+@@ -3301,6 +3330,9 @@ static int hub_suspend(struct usb_interface *intf, pm_message_t msg)
+ 			if (PMSG_IS_AUTO(msg))
+ 				return -EBUSY;
+ 		}
++		if (udev)
++			hub->wakeup_enabled_descendants +=
++					wakeup_enabled_descendants(udev);
+ 	}
+ 
+ 	if (hdev->do_remote_wakeup && hub->quirk_check_port_auto_suspend) {
+diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h
+index 80ab9ee..f608b39 100644
+--- a/drivers/usb/core/hub.h
++++ b/drivers/usb/core/hub.h
+@@ -59,6 +59,9 @@ struct usb_hub {
+ 	struct usb_tt		tt;		/* Transaction Translator */
+ 
+ 	unsigned		mA_per_port;	/* current for each child */
++#ifdef	CONFIG_PM
++	unsigned		wakeup_enabled_descendants;
++#endif
+ 
+ 	unsigned		limited_power:1;
+ 	unsigned		quiescing:1;
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index c35d49d..358375e 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -450,7 +450,7 @@ static int dwc3_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	if (IS_ERR(dwc->usb3_phy)) {
+-		ret = PTR_ERR(dwc->usb2_phy);
++		ret = PTR_ERR(dwc->usb3_phy);
+ 
+ 		/*
+ 		 * if -ENXIO is returned, it means PHY layer wasn't
+diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
+index b69d322..27dad99 100644
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -759,8 +759,8 @@ struct dwc3 {
+ 
+ struct dwc3_event_type {
+ 	u32	is_devspec:1;
+-	u32	type:6;
+-	u32	reserved8_31:25;
++	u32	type:7;
++	u32	reserved8_31:24;
+ } __packed;
+ 
+ #define DWC3_DEPEVT_XFERCOMPLETE	0x01
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index b5e5b35..f77083f 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1584,6 +1584,7 @@ err1:
+ 	__dwc3_gadget_ep_disable(dwc->eps[0]);
+ 
+ err0:
++	dwc->gadget_driver = NULL;
+ 	spin_unlock_irqrestore(&dwc->lock, flags);
+ 
+ 	return ret;
+diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
+index ffd8fa5..5514822 100644
+--- a/drivers/usb/gadget/udc-core.c
++++ b/drivers/usb/gadget/udc-core.c
+@@ -105,7 +105,7 @@ void usb_gadget_set_state(struct usb_gadget *gadget,
+ 		enum usb_device_state state)
+ {
+ 	gadget->state = state;
+-	sysfs_notify(&gadget->dev.kobj, NULL, "status");
++	sysfs_notify(&gadget->dev.kobj, NULL, "state");
+ }
+ EXPORT_SYMBOL_GPL(usb_gadget_set_state);
+ 
+diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
+index 9ab4a4d..ca6289b 100644
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -858,6 +858,7 @@ static int ehci_hub_control (
+ 				ehci->reset_done[wIndex] = jiffies
+ 						+ msecs_to_jiffies(20);
+ 				usb_hcd_start_port_resume(&hcd->self, wIndex);
++				set_bit(wIndex, &ehci->resuming_ports);
+ 				/* check the port again */
+ 				mod_timer(&ehci_to_hcd(ehci)->rh_timer,
+ 						ehci->reset_done[wIndex]);
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index cc24e39..f00cb20 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -93,7 +93,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 	}
+ 	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ 			pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
+-		xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
+ 		xhci->quirks |= XHCI_EP_LIMIT_QUIRK;
+ 		xhci->limit_active_eps = 64;
+ 		xhci->quirks |= XHCI_SW_BW_CHECKING;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 1969c00..cc3bfc5 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -434,7 +434,7 @@ static void ring_doorbell_for_active_rings(struct xhci_hcd *xhci,
+ 
+ 	/* A ring has pending URBs if its TD list is not empty */
+ 	if (!(ep->ep_state & EP_HAS_STREAMS)) {
+-		if (!(list_empty(&ep->ring->td_list)))
++		if (ep->ring && !(list_empty(&ep->ring->td_list)))
+ 			xhci_ring_ep_doorbell(xhci, slot_id, ep_index, 0);
+ 		return;
+ 	}
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index d8f640b..9a550b6 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1171,9 +1171,6 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
+ 	}
+ 
+ 	xhci = hcd_to_xhci(hcd);
+-	if (xhci->xhc_state & XHCI_STATE_HALTED)
+-		return -ENODEV;
+-
+ 	if (check_virt_dev) {
+ 		if (!udev->slot_id || !xhci->devs[udev->slot_id]) {
+ 			printk(KERN_DEBUG "xHCI %s called with unaddressed "
+@@ -1189,6 +1186,9 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
+ 		}
+ 	}
+ 
++	if (xhci->xhc_state & XHCI_STATE_HALTED)
++		return -ENODEV;
++
+ 	return 1;
+ }
+ 
+@@ -4697,6 +4697,13 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+ 
+ 	get_quirks(dev, xhci);
+ 
++	/* In xhci controllers which follow xhci 1.0 spec gives a spurious
++	 * success event after a short transfer. This quirk will ignore such
++	 * spurious event.
++	 */
++	if (xhci->hci_version > 0x96)
++		xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
++
+ 	/* Make sure the HC is halted. */
+ 	retval = xhci_halt(xhci);
+ 	if (retval)
+diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
+index c21386e..de98906 100644
+--- a/drivers/usb/misc/sisusbvga/sisusb.c
++++ b/drivers/usb/misc/sisusbvga/sisusb.c
+@@ -3247,6 +3247,7 @@ static const struct usb_device_id sisusb_table[] = {
+ 	{ USB_DEVICE(0x0711, 0x0903) },
+ 	{ USB_DEVICE(0x0711, 0x0918) },
+ 	{ USB_DEVICE(0x0711, 0x0920) },
++	{ USB_DEVICE(0x0711, 0x0950) },
+ 	{ USB_DEVICE(0x182d, 0x021c) },
+ 	{ USB_DEVICE(0x182d, 0x0269) },
+ 	{ }
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 7260ec6..b65e657 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -735,9 +735,34 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+ 	{ USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
+-	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
+-	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) },
+-	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_RTS01_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57B_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29A_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29B_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29F_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62B_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S01_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29C_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_81B_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_82B_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5D_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K4Y_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5G_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S05_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_60_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_61_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63B_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_64_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_65_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92D_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_W5R_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_A5R_PID) },
++	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_PW1_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
+ 	{ USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 6dd7925..1b8af46 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -815,11 +815,35 @@
+ /*
+  * RT Systems programming cables for various ham radios
+  */
+-#define RTSYSTEMS_VID			0x2100	/* Vendor ID */
+-#define RTSYSTEMS_SERIAL_VX7_PID	0x9e52	/* Serial converter for VX-7 Radios using FT232RL */
+-#define RTSYSTEMS_CT29B_PID		0x9e54	/* CT29B Radio Cable */
+-#define RTSYSTEMS_RTS01_PID		0x9e57	/* USB-RTS01 Radio Cable */
+-
++#define RTSYSTEMS_VID		0x2100	/* Vendor ID */
++#define RTSYSTEMS_USB_S03_PID	0x9001	/* RTS-03 USB to Serial Adapter */
++#define RTSYSTEMS_USB_59_PID	0x9e50	/* USB-59 USB to 8 pin plug */
++#define RTSYSTEMS_USB_57A_PID	0x9e51	/* USB-57A USB to 4pin 3.5mm plug */
++#define RTSYSTEMS_USB_57B_PID	0x9e52	/* USB-57B USB to extended 4pin 3.5mm plug */
++#define RTSYSTEMS_USB_29A_PID	0x9e53	/* USB-29A USB to 3.5mm stereo plug */
++#define RTSYSTEMS_USB_29B_PID	0x9e54	/* USB-29B USB to 6 pin mini din */
++#define RTSYSTEMS_USB_29F_PID	0x9e55	/* USB-29F USB to 6 pin modular plug */
++#define RTSYSTEMS_USB_62B_PID	0x9e56	/* USB-62B USB to 8 pin mini din plug*/
++#define RTSYSTEMS_USB_S01_PID	0x9e57	/* USB-RTS01 USB to 3.5 mm stereo plug*/
++#define RTSYSTEMS_USB_63_PID	0x9e58	/* USB-63 USB to 9 pin female*/
++#define RTSYSTEMS_USB_29C_PID	0x9e59	/* USB-29C USB to 4 pin modular plug*/
++#define RTSYSTEMS_USB_81B_PID	0x9e5A	/* USB-81 USB to 8 pin mini din plug*/
++#define RTSYSTEMS_USB_82B_PID	0x9e5B	/* USB-82 USB to 2.5 mm stereo plug*/
++#define RTSYSTEMS_USB_K5D_PID	0x9e5C	/* USB-K5D USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_K4Y_PID	0x9e5D	/* USB-K4Y USB to 2.5/3.5 mm plugs*/
++#define RTSYSTEMS_USB_K5G_PID	0x9e5E	/* USB-K5G USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_S05_PID	0x9e5F	/* USB-RTS05 USB to 2.5 mm stereo plug*/
++#define RTSYSTEMS_USB_60_PID	0x9e60	/* USB-60 USB to 6 pin din*/
++#define RTSYSTEMS_USB_61_PID	0x9e61	/* USB-61 USB to 6 pin mini din*/
++#define RTSYSTEMS_USB_62_PID	0x9e62	/* USB-62 USB to 8 pin mini din*/
++#define RTSYSTEMS_USB_63B_PID	0x9e63	/* USB-63 USB to 9 pin female*/
++#define RTSYSTEMS_USB_64_PID	0x9e64	/* USB-64 USB to 9 pin male*/
++#define RTSYSTEMS_USB_65_PID	0x9e65	/* USB-65 USB to 9 pin female null modem*/
++#define RTSYSTEMS_USB_92_PID	0x9e66	/* USB-92 USB to 12 pin plug*/
++#define RTSYSTEMS_USB_92D_PID	0x9e67	/* USB-92D USB to 12 pin plug data*/
++#define RTSYSTEMS_USB_W5R_PID	0x9e68	/* USB-W5R USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_A5R_PID	0x9e69	/* USB-A5R USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_PW1_PID	0x9e6A	/* USB-PW1 USB to 8 pin modular plug*/
+ 
+ /*
+  * Physik Instrumente
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index 7e99808..62b86a6 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -914,20 +914,20 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 	status = mos7840_get_reg_sync(port, mos7840_port->SpRegOffset, &Data);
+ 	if (status < 0) {
+ 		dev_dbg(&port->dev, "Reading Spreg failed\n");
+-		return -1;
++		goto err;
+ 	}
+ 	Data |= 0x80;
+ 	status = mos7840_set_reg_sync(port, mos7840_port->SpRegOffset, Data);
+ 	if (status < 0) {
+ 		dev_dbg(&port->dev, "writing Spreg failed\n");
+-		return -1;
++		goto err;
+ 	}
+ 
+ 	Data &= ~0x80;
+ 	status = mos7840_set_reg_sync(port, mos7840_port->SpRegOffset, Data);
+ 	if (status < 0) {
+ 		dev_dbg(&port->dev, "writing Spreg failed\n");
+-		return -1;
++		goto err;
+ 	}
+ 	/* End of block to be checked */
+ 
+@@ -936,7 +936,7 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 									&Data);
+ 	if (status < 0) {
+ 		dev_dbg(&port->dev, "Reading Controlreg failed\n");
+-		return -1;
++		goto err;
+ 	}
+ 	Data |= 0x08;		/* Driver done bit */
+ 	Data |= 0x20;		/* rx_disable */
+@@ -944,7 +944,7 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 				mos7840_port->ControlRegOffset, Data);
+ 	if (status < 0) {
+ 		dev_dbg(&port->dev, "writing Controlreg failed\n");
+-		return -1;
++		goto err;
+ 	}
+ 	/* do register settings here */
+ 	/* Set all regs to the device default values. */
+@@ -955,21 +955,21 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 	status = mos7840_set_uart_reg(port, INTERRUPT_ENABLE_REGISTER, Data);
+ 	if (status < 0) {
+ 		dev_dbg(&port->dev, "disabling interrupts failed\n");
+-		return -1;
++		goto err;
+ 	}
+ 	/* Set FIFO_CONTROL_REGISTER to the default value */
+ 	Data = 0x00;
+ 	status = mos7840_set_uart_reg(port, FIFO_CONTROL_REGISTER, Data);
+ 	if (status < 0) {
+ 		dev_dbg(&port->dev, "Writing FIFO_CONTROL_REGISTER  failed\n");
+-		return -1;
++		goto err;
+ 	}
+ 
+ 	Data = 0xcf;
+ 	status = mos7840_set_uart_reg(port, FIFO_CONTROL_REGISTER, Data);
+ 	if (status < 0) {
+ 		dev_dbg(&port->dev, "Writing FIFO_CONTROL_REGISTER  failed\n");
+-		return -1;
++		goto err;
+ 	}
+ 
+ 	Data = 0x03;
+@@ -1114,6 +1114,15 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 	/* mos7840_change_port_settings(mos7840_port,old_termios); */
+ 
+ 	return 0;
++err:
++	for (j = 0; j < NUM_URBS; ++j) {
++		urb = mos7840_port->write_urb_pool[j];
++		if (!urb)
++			continue;
++		kfree(urb->transfer_buffer);
++		usb_free_urb(urb);
++	}
++	return status;
+ }
+ 
+ /*****************************************************************************
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index e581c25..01f79f1 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -371,7 +371,7 @@ static int ti_startup(struct usb_serial *serial)
+ 	usb_set_serial_data(serial, tdev);
+ 
+ 	/* determine device type */
+-	if (usb_match_id(serial->interface, ti_id_table_3410))
++	if (serial->type == &ti_1port_device)
+ 		tdev->td_is_3410 = 1;
+ 	dev_dbg(&dev->dev, "%s - device type is %s\n", __func__,
+ 		tdev->td_is_3410 ? "3410" : "5052");
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 179933528..c015f2c 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -665,6 +665,13 @@ UNUSUAL_DEV(  0x054c, 0x016a, 0x0000, 0x9999,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_FIX_INQUIRY ),
+ 
++/* Submitted by Ren Bigcren <bigcren.ren@××××××××××.com> */
++UNUSUAL_DEV(  0x054c, 0x02a5, 0x0100, 0x0100,
++		"Sony Corp.",
++		"MicroVault Flash Drive",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_NO_READ_CAPACITY_16 ),
++
+ /* floppy reports multiple luns */
+ UNUSUAL_DEV(  0x055d, 0x2020, 0x0000, 0x0210,
+ 		"SAMSUNG",
+diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
+index 45c8efa..34924fb 100644
+--- a/drivers/xen/evtchn.c
++++ b/drivers/xen/evtchn.c
+@@ -377,18 +377,12 @@ static long evtchn_ioctl(struct file *file,
+ 		if (unbind.port >= NR_EVENT_CHANNELS)
+ 			break;
+ 
+-		spin_lock_irq(&port_user_lock);
+-
+ 		rc = -ENOTCONN;
+-		if (get_port_user(unbind.port) != u) {
+-			spin_unlock_irq(&port_user_lock);
++		if (get_port_user(unbind.port) != u)
+ 			break;
+-		}
+ 
+ 		disable_irq(irq_from_evtchn(unbind.port));
+ 
+-		spin_unlock_irq(&port_user_lock);
+-
+ 		evtchn_unbind_from_user(u, unbind.port);
+ 
+ 		rc = 0;
+@@ -488,26 +482,15 @@ static int evtchn_release(struct inode *inode, struct file *filp)
+ 	int i;
+ 	struct per_user_data *u = filp->private_data;
+ 
+-	spin_lock_irq(&port_user_lock);
+-
+-	free_page((unsigned long)u->ring);
+-
+ 	for (i = 0; i < NR_EVENT_CHANNELS; i++) {
+ 		if (get_port_user(i) != u)
+ 			continue;
+ 
+ 		disable_irq(irq_from_evtchn(i));
+-	}
+-
+-	spin_unlock_irq(&port_user_lock);
+-
+-	for (i = 0; i < NR_EVENT_CHANNELS; i++) {
+-		if (get_port_user(i) != u)
+-			continue;
+-
+ 		evtchn_unbind_from_user(get_port_user(i), i);
+ 	}
+ 
++	free_page((unsigned long)u->ring);
+ 	kfree(u->name);
+ 	kfree(u);
+ 
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index df472ab..0b272d0 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -7298,6 +7298,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
+ 	int err = 0;
+ 	int ret;
+ 	int level;
++	bool root_dropped = false;
+ 
+ 	path = btrfs_alloc_path();
+ 	if (!path) {
+@@ -7355,6 +7356,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
+ 		while (1) {
+ 			btrfs_tree_lock(path->nodes[level]);
+ 			btrfs_set_lock_blocking(path->nodes[level]);
++			path->locks[level] = BTRFS_WRITE_LOCK_BLOCKING;
+ 
+ 			ret = btrfs_lookup_extent_info(trans, root,
+ 						path->nodes[level]->start,
+@@ -7370,6 +7372,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
+ 				break;
+ 
+ 			btrfs_tree_unlock(path->nodes[level]);
++			path->locks[level] = 0;
+ 			WARN_ON(wc->refs[level] != 1);
+ 			level--;
+ 		}
+@@ -7471,12 +7474,22 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
+ 		free_extent_buffer(root->commit_root);
+ 		kfree(root);
+ 	}
++	root_dropped = true;
+ out_end_trans:
+ 	btrfs_end_transaction_throttle(trans, tree_root);
+ out_free:
+ 	kfree(wc);
+ 	btrfs_free_path(path);
+ out:
++	/*
++	 * So if we need to stop dropping the snapshot for whatever reason we
++	 * need to make sure to add it back to the dead root list so that we
++	 * keep trying to do the work later.  This also cleans up roots if we
++	 * don't have it in the radix (like when we recover after a power fail
++	 * or unmount) so we don't leak memory.
++	 */
++	if (root_dropped == false)
++		btrfs_add_dead_root(root);
+ 	if (err)
+ 		btrfs_std_error(root->fs_info, err);
+ 	return err;
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index 79bd479..eb84c2d 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -2501,7 +2501,7 @@ again:
+ 			ret = scrub_extent(sctx, extent_logical, extent_len,
+ 					   extent_physical, extent_dev, flags,
+ 					   generation, extent_mirror_num,
+-					   extent_physical);
++					   extent_logical - logical + physical);
+ 			if (ret)
+ 				goto out;
+ 
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 84ce601..baf149a 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -802,9 +802,10 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
+ 			flags = O_WRONLY|O_LARGEFILE;
+ 	}
+ 	*filp = dentry_open(&path, flags, current_cred());
+-	if (IS_ERR(*filp))
++	if (IS_ERR(*filp)) {
+ 		host_err = PTR_ERR(*filp);
+-	else {
++		*filp = NULL;
++	} else {
+ 		host_err = ima_file_check(*filp, may_flags);
+ 
+ 		if (may_flags & NFSD_MAY_64BIT_COOKIE)
+diff --git a/fs/super.c b/fs/super.c
+index 7465d43..68307c0 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -336,19 +336,19 @@ EXPORT_SYMBOL(deactivate_super);
+  *	and want to turn it into a full-blown active reference.  grab_super()
+  *	is called with sb_lock held and drops it.  Returns 1 in case of
+  *	success, 0 if we had failed (superblock contents was already dead or
+- *	dying when grab_super() had been called).
++ *	dying when grab_super() had been called).  Note that this is only
++ *	called for superblocks not in rundown mode (== ones still on ->fs_supers
++ *	of their type), so increment of ->s_count is OK here.
+  */
+ static int grab_super(struct super_block *s) __releases(sb_lock)
+ {
+-	if (atomic_inc_not_zero(&s->s_active)) {
+-		spin_unlock(&sb_lock);
+-		return 1;
+-	}
+-	/* it's going away */
+ 	s->s_count++;
+ 	spin_unlock(&sb_lock);
+-	/* wait for it to die */
+ 	down_write(&s->s_umount);
++	if ((s->s_flags & MS_BORN) && atomic_inc_not_zero(&s->s_active)) {
++		put_super(s);
++		return 1;
++	}
+ 	up_write(&s->s_umount);
+ 	put_super(s);
+ 	return 0;
+@@ -463,11 +463,6 @@ retry:
+ 				destroy_super(s);
+ 				s = NULL;
+ 			}
+-			down_write(&old->s_umount);
+-			if (unlikely(!(old->s_flags & MS_BORN))) {
+-				deactivate_locked_super(old);
+-				goto retry;
+-			}
+ 			return old;
+ 		}
+ 	}
+@@ -660,10 +655,10 @@ restart:
+ 		if (hlist_unhashed(&sb->s_instances))
+ 			continue;
+ 		if (sb->s_bdev == bdev) {
+-			if (grab_super(sb)) /* drops sb_lock */
+-				return sb;
+-			else
++			if (!grab_super(sb))
+ 				goto restart;
++			up_write(&sb->s_umount);
++			return sb;
+ 		}
+ 	}
+ 	spin_unlock(&sb_lock);
+diff --git a/include/linux/firewire.h b/include/linux/firewire.h
+index 191501a..217e4b4 100644
+--- a/include/linux/firewire.h
++++ b/include/linux/firewire.h
+@@ -434,6 +434,7 @@ struct fw_iso_context {
+ 	int type;
+ 	int channel;
+ 	int speed;
++	bool drop_overflow_headers;
+ 	size_t header_size;
+ 	union {
+ 		fw_iso_callback_t sc;
+diff --git a/include/target/iscsi/iscsi_transport.h b/include/target/iscsi/iscsi_transport.h
+index 23a87d0..c5aade5 100644
+--- a/include/target/iscsi/iscsi_transport.h
++++ b/include/target/iscsi/iscsi_transport.h
+@@ -34,8 +34,6 @@ extern void iscsit_put_transport(struct iscsit_transport *);
+ /*
+  * From iscsi_target.c
+  */
+-extern int iscsit_add_reject_from_cmd(u8, int, int, unsigned char *,
+-				struct iscsi_cmd *);
+ extern int iscsit_setup_scsi_cmd(struct iscsi_conn *, struct iscsi_cmd *,
+ 				unsigned char *);
+ extern void iscsit_set_unsoliticed_dataout(struct iscsi_cmd *);
+@@ -67,6 +65,10 @@ extern int iscsit_logout_post_handler(struct iscsi_cmd *, struct iscsi_conn *);
+  */
+ extern void iscsit_increment_maxcmdsn(struct iscsi_cmd *, struct iscsi_session *);
+ /*
++ * From iscsi_target_erl0.c
++ */
++extern void iscsit_cause_connection_reinstatement(struct iscsi_conn *, int);
++/*
+  * From iscsi_target_erl1.c
+  */
+ extern void iscsit_stop_dataout_timer(struct iscsi_cmd *);
+@@ -80,4 +82,5 @@ extern int iscsit_tmr_post_handler(struct iscsi_cmd *, struct iscsi_conn *);
+  * From iscsi_target_util.c
+  */
+ extern struct iscsi_cmd *iscsit_allocate_cmd(struct iscsi_conn *, gfp_t);
+-extern int iscsit_sequence_cmd(struct iscsi_conn *, struct iscsi_cmd *, __be32);
++extern int iscsit_sequence_cmd(struct iscsi_conn *, struct iscsi_cmd *,
++			       unsigned char *, __be32);
+diff --git a/include/uapi/linux/firewire-cdev.h b/include/uapi/linux/firewire-cdev.h
+index d500369..1db453e 100644
+--- a/include/uapi/linux/firewire-cdev.h
++++ b/include/uapi/linux/firewire-cdev.h
+@@ -215,8 +215,8 @@ struct fw_cdev_event_request2 {
+  * with the %FW_CDEV_ISO_INTERRUPT bit set, when explicitly requested with
+  * %FW_CDEV_IOC_FLUSH_ISO, or when there have been so many completed packets
+  * without the interrupt bit set that the kernel's internal buffer for @header
+- * is about to overflow.  (In the last case, kernels with ABI version < 5 drop
+- * header data up to the next interrupt packet.)
++ * is about to overflow.  (In the last case, ABI versions < 5 drop header data
++ * up to the next interrupt packet.)
+  *
+  * Isochronous transmit events (context type %FW_CDEV_ISO_CONTEXT_TRANSMIT):
+  *
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 0b936d8..f7bc3ce 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -1163,18 +1163,17 @@ void tracing_reset_current(int cpu)
+ 	tracing_reset(&global_trace.trace_buffer, cpu);
+ }
+ 
++/* Must have trace_types_lock held */
+ void tracing_reset_all_online_cpus(void)
+ {
+ 	struct trace_array *tr;
+ 
+-	mutex_lock(&trace_types_lock);
+ 	list_for_each_entry(tr, &ftrace_trace_arrays, list) {
+ 		tracing_reset_online_cpus(&tr->trace_buffer);
+ #ifdef CONFIG_TRACER_MAX_TRACE
+ 		tracing_reset_online_cpus(&tr->max_buffer);
+ #endif
+ 	}
+-	mutex_unlock(&trace_types_lock);
+ }
+ 
+ #define SAVED_CMDLINES 128
+@@ -2956,7 +2955,6 @@ static int tracing_release(struct inode *inode, struct file *file)
+ 
+ 	iter = m->private;
+ 	tr = iter->tr;
+-	trace_array_put(tr);
+ 
+ 	mutex_lock(&trace_types_lock);
+ 
+@@ -2971,6 +2969,9 @@ static int tracing_release(struct inode *inode, struct file *file)
+ 	if (!iter->snapshot)
+ 		/* reenable tracing if it was previously enabled */
+ 		tracing_start_tr(tr);
++
++	__trace_array_put(tr);
++
+ 	mutex_unlock(&trace_types_lock);
+ 
+ 	mutex_destroy(&iter->mutex);
+@@ -3395,6 +3396,7 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf,
+ static int tracing_trace_options_open(struct inode *inode, struct file *file)
+ {
+ 	struct trace_array *tr = inode->i_private;
++	int ret;
+ 
+ 	if (tracing_disabled)
+ 		return -ENODEV;
+@@ -3402,7 +3404,11 @@ static int tracing_trace_options_open(struct inode *inode, struct file *file)
+ 	if (trace_array_get(tr) < 0)
+ 		return -ENODEV;
+ 
+-	return single_open(file, tracing_trace_options_show, inode->i_private);
++	ret = single_open(file, tracing_trace_options_show, inode->i_private);
++	if (ret < 0)
++		trace_array_put(tr);
++
++	return ret;
+ }
+ 
+ static const struct file_operations tracing_iter_fops = {
+@@ -3906,6 +3912,7 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp)
+ 	iter = kzalloc(sizeof(*iter), GFP_KERNEL);
+ 	if (!iter) {
+ 		ret = -ENOMEM;
++		__trace_array_put(tr);
+ 		goto out;
+ 	}
+ 
+@@ -4652,21 +4659,24 @@ static int tracing_snapshot_open(struct inode *inode, struct file *file)
+ 			ret = PTR_ERR(iter);
+ 	} else {
+ 		/* Writes still need the seq_file to hold the private data */
++		ret = -ENOMEM;
+ 		m = kzalloc(sizeof(*m), GFP_KERNEL);
+ 		if (!m)
+-			return -ENOMEM;
++			goto out;
+ 		iter = kzalloc(sizeof(*iter), GFP_KERNEL);
+ 		if (!iter) {
+ 			kfree(m);
+-			return -ENOMEM;
++			goto out;
+ 		}
++		ret = 0;
++
+ 		iter->tr = tr;
+ 		iter->trace_buffer = &tc->tr->max_buffer;
+ 		iter->cpu_file = tc->cpu;
+ 		m->private = iter;
+ 		file->private_data = m;
+ 	}
+-
++out:
+ 	if (ret < 0)
+ 		trace_array_put(tr);
+ 
+@@ -4896,8 +4906,6 @@ static int tracing_buffers_open(struct inode *inode, struct file *filp)
+ 
+ 	mutex_lock(&trace_types_lock);
+ 
+-	tr->ref++;
+-
+ 	info->iter.tr		= tr;
+ 	info->iter.cpu_file	= tc->cpu;
+ 	info->iter.trace	= tr->current_trace;
+@@ -5276,9 +5284,10 @@ tracing_stats_read(struct file *filp, char __user *ubuf,
+ }
+ 
+ static const struct file_operations tracing_stats_fops = {
+-	.open		= tracing_open_generic,
++	.open		= tracing_open_generic_tc,
+ 	.read		= tracing_stats_read,
+ 	.llseek		= generic_file_llseek,
++	.release	= tracing_release_generic_tc,
+ };
+ 
+ #ifdef CONFIG_DYNAMIC_FTRACE
+@@ -5926,8 +5935,10 @@ static int new_instance_create(const char *name)
+ 		goto out_free_tr;
+ 
+ 	ret = event_trace_add_tracer(tr->dir, tr);
+-	if (ret)
++	if (ret) {
++		debugfs_remove_recursive(tr->dir);
+ 		goto out_free_tr;
++	}
+ 
+ 	init_tracer_debugfs(tr, tr->dir);
+ 
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 6dfd48b..6953263 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -1221,6 +1221,7 @@ show_header(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+ 
+ static int ftrace_event_avail_open(struct inode *inode, struct file *file);
+ static int ftrace_event_set_open(struct inode *inode, struct file *file);
++static int ftrace_event_release(struct inode *inode, struct file *file);
+ 
+ static const struct seq_operations show_event_seq_ops = {
+ 	.start = t_start,
+@@ -1248,7 +1249,7 @@ static const struct file_operations ftrace_set_event_fops = {
+ 	.read = seq_read,
+ 	.write = ftrace_event_write,
+ 	.llseek = seq_lseek,
+-	.release = seq_release,
++	.release = ftrace_event_release,
+ };
+ 
+ static const struct file_operations ftrace_enable_fops = {
+@@ -1326,6 +1327,15 @@ ftrace_event_open(struct inode *inode, struct file *file,
+ 	return ret;
+ }
+ 
++static int ftrace_event_release(struct inode *inode, struct file *file)
++{
++	struct trace_array *tr = inode->i_private;
++
++	trace_array_put(tr);
++
++	return seq_release(inode, file);
++}
++
+ static int
+ ftrace_event_avail_open(struct inode *inode, struct file *file)
+ {
+@@ -1339,12 +1349,19 @@ ftrace_event_set_open(struct inode *inode, struct file *file)
+ {
+ 	const struct seq_operations *seq_ops = &show_set_event_seq_ops;
+ 	struct trace_array *tr = inode->i_private;
++	int ret;
++
++	if (trace_array_get(tr) < 0)
++		return -ENODEV;
+ 
+ 	if ((file->f_mode & FMODE_WRITE) &&
+ 	    (file->f_flags & O_TRUNC))
+ 		ftrace_clear_events(tr);
+ 
+-	return ftrace_event_open(inode, file, seq_ops);
++	ret = ftrace_event_open(inode, file, seq_ops);
++	if (ret < 0)
++		trace_array_put(tr);
++	return ret;
+ }
+ 
+ static struct event_subsystem *
+diff --git a/mm/memory.c b/mm/memory.c
+index 61a262b..5e50800 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1101,6 +1101,7 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb,
+ 	spinlock_t *ptl;
+ 	pte_t *start_pte;
+ 	pte_t *pte;
++	unsigned long range_start = addr;
+ 
+ again:
+ 	init_rss_vec(rss);
+@@ -1206,12 +1207,14 @@ again:
+ 		force_flush = 0;
+ 
+ #ifdef HAVE_GENERIC_MMU_GATHER
+-		tlb->start = addr;
+-		tlb->end = end;
++		tlb->start = range_start;
++		tlb->end = addr;
+ #endif
+ 		tlb_flush_mmu(tlb);
+-		if (addr != end)
++		if (addr != end) {
++			range_start = addr;
+ 			goto again;
++		}
+ 	}
+ 
+ 	return addr;
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 7431001..4baf12e 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -732,7 +732,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
+ 		if (prev) {
+ 			vma = prev;
+ 			next = vma->vm_next;
+-			continue;
++			if (mpol_equal(vma_policy(vma), new_pol))
++				continue;
++			/* vma_merge() joined vma && vma->next, case 8 */
++			goto replace;
+ 		}
+ 		if (vma->vm_start != vmstart) {
+ 			err = split_vma(vma->vm_mm, vma, vmstart, 1);
+@@ -744,6 +747,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
+ 			if (err)
+ 				goto out;
+ 		}
++ replace:
+ 		err = vma_replace_policy(vma, new_pol);
+ 		if (err)
+ 			goto out;
+diff --git a/mm/mmap.c b/mm/mmap.c
+index f681e18..7dbe397 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -865,7 +865,7 @@ again:			remove_next = 1 + (end > next->vm_end);
+ 		if (next->anon_vma)
+ 			anon_vma_merge(vma, next);
+ 		mm->map_count--;
+-		vma_set_policy(vma, vma_policy(next));
++		mpol_put(vma_policy(next));
+ 		kmem_cache_free(vm_area_cachep, next);
+ 		/*
+ 		 * In mprotect's case 6 (see comments on vma_merge),
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_marshal.c b/net/sunrpc/xprtrdma/svc_rdma_marshal.c
+index 8d2eddd..65b1462 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_marshal.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_marshal.c
+@@ -98,6 +98,7 @@ void svc_rdma_rcl_chunk_counts(struct rpcrdma_read_chunk *ch,
+  */
+ static u32 *decode_write_list(u32 *va, u32 *vaend)
+ {
++	unsigned long start, end;
+ 	int nchunks;
+ 
+ 	struct rpcrdma_write_array *ary =
+@@ -113,9 +114,12 @@ static u32 *decode_write_list(u32 *va, u32 *vaend)
+ 		return NULL;
+ 	}
+ 	nchunks = ntohl(ary->wc_nchunks);
+-	if (((unsigned long)&ary->wc_array[0] +
+-	     (sizeof(struct rpcrdma_write_chunk) * nchunks)) >
+-	    (unsigned long)vaend) {
++
++	start = (unsigned long)&ary->wc_array[0];
++	end = (unsigned long)vaend;
++	if (nchunks < 0 ||
++	    nchunks > (SIZE_MAX - start) / sizeof(struct rpcrdma_write_chunk) ||
++	    (start + (sizeof(struct rpcrdma_write_chunk) * nchunks)) > end) {
+ 		dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",
+ 			ary, nchunks, vaend);
+ 		return NULL;
+@@ -129,6 +133,7 @@ static u32 *decode_write_list(u32 *va, u32 *vaend)
+ 
+ static u32 *decode_reply_array(u32 *va, u32 *vaend)
+ {
++	unsigned long start, end;
+ 	int nchunks;
+ 	struct rpcrdma_write_array *ary =
+ 		(struct rpcrdma_write_array *)va;
+@@ -143,9 +148,12 @@ static u32 *decode_reply_array(u32 *va, u32 *vaend)
+ 		return NULL;
+ 	}
+ 	nchunks = ntohl(ary->wc_nchunks);
+-	if (((unsigned long)&ary->wc_array[0] +
+-	     (sizeof(struct rpcrdma_write_chunk) * nchunks)) >
+-	    (unsigned long)vaend) {
++
++	start = (unsigned long)&ary->wc_array[0];
++	end = (unsigned long)vaend;
++	if (nchunks < 0 ||
++	    nchunks > (SIZE_MAX - start) / sizeof(struct rpcrdma_write_chunk) ||
++	    (start + (sizeof(struct rpcrdma_write_chunk) * nchunks)) > end) {
+ 		dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n",
+ 			ary, nchunks, vaend);
+ 		return NULL;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 403010c..051c03d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3495,9 +3495,12 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1028, 0x05f5, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x05f6, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x05f8, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
++	SND_PCI_QUIRK(0x1028, 0x05f9, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
++	SND_PCI_QUIRK(0x1028, 0x05fb, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x0606, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x0608, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x0609, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
++	SND_PCI_QUIRK(0x1028, 0x0613, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
+ 	SND_PCI_QUIRK(0x103c, 0x18e6, "HP", ALC269_FIXUP_HP_GPIO_LED),
+ 	SND_PCI_QUIRK(0x103c, 0x1973, "HP Pavilion", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c
+index 3eeada5..566a367 100644
+--- a/sound/soc/codecs/max98088.c
++++ b/sound/soc/codecs/max98088.c
+@@ -1612,7 +1612,7 @@ static int max98088_dai2_digital_mute(struct snd_soc_dai *codec_dai, int mute)
+ 
+ static void max98088_sync_cache(struct snd_soc_codec *codec)
+ {
+-       u16 *reg_cache = codec->reg_cache;
++       u8 *reg_cache = codec->reg_cache;
+        int i;
+ 
+        if (!codec->cache_sync)
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 92bbfec..ea47938 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -37,7 +37,7 @@
+ static const u16 sgtl5000_regs[SGTL5000_MAX_REG_OFFSET] =  {
+ 	[SGTL5000_CHIP_CLK_CTRL] = 0x0008,
+ 	[SGTL5000_CHIP_I2S_CTRL] = 0x0010,
+-	[SGTL5000_CHIP_SSS_CTRL] = 0x0008,
++	[SGTL5000_CHIP_SSS_CTRL] = 0x0010,
+ 	[SGTL5000_CHIP_DAC_VOL] = 0x3c3c,
+ 	[SGTL5000_CHIP_PAD_STRENGTH] = 0x015f,
+ 	[SGTL5000_CHIP_ANA_HP_CTRL] = 0x1818,
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index e971028..730dd0c 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -1600,7 +1600,6 @@ static int wm8962_put_hp_sw(struct snd_kcontrol *kcontrol,
+ 			    struct snd_ctl_elem_value *ucontrol)
+ {
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+-	u16 *reg_cache = codec->reg_cache;
+ 	int ret;
+ 
+ 	/* Apply the update (if any) */
+@@ -1609,16 +1608,19 @@ static int wm8962_put_hp_sw(struct snd_kcontrol *kcontrol,
+ 		return 0;
+ 
+ 	/* If the left PGA is enabled hit that VU bit... */
+-	if (snd_soc_read(codec, WM8962_PWR_MGMT_2) & WM8962_HPOUTL_PGA_ENA)
+-		return snd_soc_write(codec, WM8962_HPOUTL_VOLUME,
+-				     reg_cache[WM8962_HPOUTL_VOLUME]);
++	ret = snd_soc_read(codec, WM8962_PWR_MGMT_2);
++	if (ret & WM8962_HPOUTL_PGA_ENA) {
++		snd_soc_write(codec, WM8962_HPOUTL_VOLUME,
++			      snd_soc_read(codec, WM8962_HPOUTL_VOLUME));
++		return 1;
++	}
+ 
+ 	/* ...otherwise the right.  The VU is stereo. */
+-	if (snd_soc_read(codec, WM8962_PWR_MGMT_2) & WM8962_HPOUTR_PGA_ENA)
+-		return snd_soc_write(codec, WM8962_HPOUTR_VOLUME,
+-				     reg_cache[WM8962_HPOUTR_VOLUME]);
++	if (ret & WM8962_HPOUTR_PGA_ENA)
++		snd_soc_write(codec, WM8962_HPOUTR_VOLUME,
++			      snd_soc_read(codec, WM8962_HPOUTR_VOLUME));
+ 
+-	return 0;
++	return 1;
+ }
+ 
+ /* The VU bits for the speakers are in a different register to the mute
+@@ -3374,7 +3376,6 @@ static int wm8962_probe(struct snd_soc_codec *codec)
+ 	int ret;
+ 	struct wm8962_priv *wm8962 = snd_soc_codec_get_drvdata(codec);
+ 	struct wm8962_pdata *pdata = dev_get_platdata(codec->dev);
+-	u16 *reg_cache = codec->reg_cache;
+ 	int i, trigger, irq_pol;
+ 	bool dmicclk, dmicdat;
+ 
+@@ -3432,8 +3433,9 @@ static int wm8962_probe(struct snd_soc_codec *codec)
+ 
+ 		/* Put the speakers into mono mode? */
+ 		if (pdata->spk_mono)
+-			reg_cache[WM8962_CLASS_D_CONTROL_2]
+-				|= WM8962_SPK_MONO;
++			snd_soc_update_bits(codec, WM8962_CLASS_D_CONTROL_2,
++				WM8962_SPK_MONO_MASK, WM8962_SPK_MONO);
++
+ 
+ 		/* Micbias setup, detection enable and detection
+ 		 * threasholds. */
+diff --git a/sound/soc/tegra/tegra20_ac97.c b/sound/soc/tegra/tegra20_ac97.c
+index 2f70ea7..05676c0 100644
+--- a/sound/soc/tegra/tegra20_ac97.c
++++ b/sound/soc/tegra/tegra20_ac97.c
+@@ -399,9 +399,9 @@ static int tegra20_ac97_platform_probe(struct platform_device *pdev)
+ 	ac97->capture_dma_data.slave_id = of_dma[1];
+ 
+ 	ac97->playback_dma_data.addr = mem->start + TEGRA20_AC97_FIFO_TX1;
+-	ac97->capture_dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+-	ac97->capture_dma_data.maxburst = 4;
+-	ac97->capture_dma_data.slave_id = of_dma[0];
++	ac97->playback_dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++	ac97->playback_dma_data.maxburst = 4;
++	ac97->playback_dma_data.slave_id = of_dma[1];
+ 
+ 	ret = snd_soc_register_component(&pdev->dev, &tegra20_ac97_component,
+ 					 &tegra20_ac97_dai, 1);
+diff --git a/sound/soc/tegra/tegra20_spdif.c b/sound/soc/tegra/tegra20_spdif.c
+index 5eaa12c..551b3c9 100644
+--- a/sound/soc/tegra/tegra20_spdif.c
++++ b/sound/soc/tegra/tegra20_spdif.c
+@@ -323,8 +323,8 @@ static int tegra20_spdif_platform_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	spdif->playback_dma_data.addr = mem->start + TEGRA20_SPDIF_DATA_OUT;
+-	spdif->capture_dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+-	spdif->capture_dma_data.maxburst = 4;
++	spdif->playback_dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++	spdif->playback_dma_data.maxburst = 4;
+ 	spdif->playback_dma_data.slave_id = dmareq->start;
+ 
+ 	pm_runtime_enable(&pdev->dev);
+diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
+index 5a1f648..274e178 100644
+--- a/tools/hv/hv_kvp_daemon.c
++++ b/tools/hv/hv_kvp_daemon.c
+@@ -1016,9 +1016,10 @@ kvp_get_ip_info(int family, char *if_name, int op,
+ 
+ 				if (sn_offset == 0)
+ 					strcpy(sn_str, cidr_mask);
+-				else
++				else {
++					strcat((char *)ip_buffer->sub_net, ";");
+ 					strcat(sn_str, cidr_mask);
+-				strcat((char *)ip_buffer->sub_net, ";");
++				}
+ 				sn_offset += strlen(sn_str) + 1;
+ 			}
+ 
+diff --git a/tools/perf/config/utilities.mak b/tools/perf/config/utilities.mak
+index 8ef3bd3..3e89719 100644
+--- a/tools/perf/config/utilities.mak
++++ b/tools/perf/config/utilities.mak
+@@ -173,7 +173,7 @@ _ge-abspath = $(if $(is-executable),$(1))
+ # Usage: absolute-executable-path-or-empty = $(call get-executable-or-default,variable,default)
+ #
+ define get-executable-or-default
+-$(if $($(1)),$(call _ge_attempt,$($(1)),$(1)),$(call _ge_attempt,$(2),$(1)))
++$(if $($(1)),$(call _ge_attempt,$($(1)),$(1)),$(call _ge_attempt,$(2)))
+ endef
+ _ge_attempt = $(if $(get-executable),$(get-executable),$(_gea_warn)$(call _gea_err,$(2)))
+ _gea_warn = $(warning The path '$(1)' is not executable.)

Added: genpatches-2.6/trunk/3.10.7/1005_linux-3.10.6.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/1005_linux-3.10.6.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/1005_linux-3.10.6.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,4439 @@
+diff --git a/Makefile b/Makefile
+index f8349d0..fd92ffb 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,8 +1,8 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+-NAME = Unicycling Gorilla
++NAME = TOSSUG Baby Fish
+ 
+ # *DOCUMENTATION*
+ # To see a list of typical targets execute "make help"
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 136f263..18a9f5e 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -19,7 +19,6 @@ config ARM
+ 	select GENERIC_STRNCPY_FROM_USER
+ 	select GENERIC_STRNLEN_USER
+ 	select HARDIRQS_SW_RESEND
+-	select HAVE_AOUT
+ 	select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL
+ 	select HAVE_ARCH_KGDB
+ 	select HAVE_ARCH_SECCOMP_FILTER
+@@ -213,7 +212,8 @@ config VECTORS_BASE
+ 	default DRAM_BASE if REMAP_VECTORS_TO_RAM
+ 	default 0x00000000
+ 	help
+-	  The base address of exception vectors.
++	  The base address of exception vectors.  This must be two pages
++	  in size.
+ 
+ config ARM_PATCH_PHYS_VIRT
+ 	bool "Patch physical to virtual translations at runtime" if EMBEDDED
+diff --git a/arch/arm/include/asm/a.out-core.h b/arch/arm/include/asm/a.out-core.h
+deleted file mode 100644
+index 92f10cb..0000000
+--- a/arch/arm/include/asm/a.out-core.h
++++ /dev/null
+@@ -1,45 +0,0 @@
+-/* a.out coredump register dumper
+- *
+- * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
+- * Written by David Howells (dhowells@××××××.com)
+- *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public Licence
+- * as published by the Free Software Foundation; either version
+- * 2 of the Licence, or (at your option) any later version.
+- */
+-
+-#ifndef _ASM_A_OUT_CORE_H
+-#define _ASM_A_OUT_CORE_H
+-
+-#ifdef __KERNEL__
+-
+-#include <linux/user.h>
+-#include <linux/elfcore.h>
+-
+-/*
+- * fill in the user structure for an a.out core dump
+- */
+-static inline void aout_dump_thread(struct pt_regs *regs, struct user *dump)
+-{
+-	struct task_struct *tsk = current;
+-
+-	dump->magic = CMAGIC;
+-	dump->start_code = tsk->mm->start_code;
+-	dump->start_stack = regs->ARM_sp & ~(PAGE_SIZE - 1);
+-
+-	dump->u_tsize = (tsk->mm->end_code - tsk->mm->start_code) >> PAGE_SHIFT;
+-	dump->u_dsize = (tsk->mm->brk - tsk->mm->start_data + PAGE_SIZE - 1) >> PAGE_SHIFT;
+-	dump->u_ssize = 0;
+-
+-	memset(dump->u_debugreg, 0, sizeof(dump->u_debugreg));
+-
+-	if (dump->start_stack < 0x04000000)
+-		dump->u_ssize = (0x04000000 - dump->start_stack) >> PAGE_SHIFT;
+-
+-	dump->regs = *regs;
+-	dump->u_fpvalid = dump_fpu (regs, &dump->u_fp);
+-}
+-
+-#endif /* __KERNEL__ */
+-#endif /* _ASM_A_OUT_CORE_H */
+diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
+index 38050b1..56211f2 100644
+--- a/arch/arm/include/asm/elf.h
++++ b/arch/arm/include/asm/elf.h
+@@ -130,4 +130,10 @@ struct mm_struct;
+ extern unsigned long arch_randomize_brk(struct mm_struct *mm);
+ #define arch_randomize_brk arch_randomize_brk
+ 
++#ifdef CONFIG_MMU
++#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
++struct linux_binprm;
++int arch_setup_additional_pages(struct linux_binprm *, int);
++#endif
++
+ #endif
+diff --git a/arch/arm/include/asm/mmu.h b/arch/arm/include/asm/mmu.h
+index e3d5554..6f18da0 100644
+--- a/arch/arm/include/asm/mmu.h
++++ b/arch/arm/include/asm/mmu.h
+@@ -6,8 +6,11 @@
+ typedef struct {
+ #ifdef CONFIG_CPU_HAS_ASID
+ 	atomic64_t	id;
++#else
++	int		switch_pending;
+ #endif
+ 	unsigned int	vmalloc_seq;
++	unsigned long	sigpage;
+ } mm_context_t;
+ 
+ #ifdef CONFIG_CPU_HAS_ASID
+diff --git a/arch/arm/include/asm/mmu_context.h b/arch/arm/include/asm/mmu_context.h
+index dc90203..e0b10f1 100644
+--- a/arch/arm/include/asm/mmu_context.h
++++ b/arch/arm/include/asm/mmu_context.h
+@@ -55,7 +55,7 @@ static inline void check_and_switch_context(struct mm_struct *mm,
+ 		 * on non-ASID CPUs, the old mm will remain valid until the
+ 		 * finish_arch_post_lock_switch() call.
+ 		 */
+-		set_ti_thread_flag(task_thread_info(tsk), TIF_SWITCH_MM);
++		mm->context.switch_pending = 1;
+ 	else
+ 		cpu_switch_mm(mm->pgd, mm);
+ }
+@@ -64,9 +64,21 @@ static inline void check_and_switch_context(struct mm_struct *mm,
+ 	finish_arch_post_lock_switch
+ static inline void finish_arch_post_lock_switch(void)
+ {
+-	if (test_and_clear_thread_flag(TIF_SWITCH_MM)) {
+-		struct mm_struct *mm = current->mm;
+-		cpu_switch_mm(mm->pgd, mm);
++	struct mm_struct *mm = current->mm;
++
++	if (mm && mm->context.switch_pending) {
++		/*
++		 * Preemption must be disabled during cpu_switch_mm() as we
++		 * have some stateful cache flush implementations. Check
++		 * switch_pending again in case we were preempted and the
++		 * switch to this mm was already done.
++		 */
++		preempt_disable();
++		if (mm->context.switch_pending) {
++			mm->context.switch_pending = 0;
++			cpu_switch_mm(mm->pgd, mm);
++		}
++		preempt_enable_no_resched();
+ 	}
+ }
+ 
+diff --git a/arch/arm/include/asm/page.h b/arch/arm/include/asm/page.h
+index 812a494..cbdc7a2 100644
+--- a/arch/arm/include/asm/page.h
++++ b/arch/arm/include/asm/page.h
+@@ -142,7 +142,9 @@ extern void __cpu_copy_user_highpage(struct page *to, struct page *from,
+ #define clear_page(page)	memset((void *)(page), 0, PAGE_SIZE)
+ extern void copy_page(void *to, const void *from);
+ 
++#ifdef CONFIG_KUSER_HELPERS
+ #define __HAVE_ARCH_GATE_AREA 1
++#endif
+ 
+ #ifdef CONFIG_ARM_LPAE
+ #include <asm/pgtable-3level-types.h>
+diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
+index 06e7d50..413f387 100644
+--- a/arch/arm/include/asm/processor.h
++++ b/arch/arm/include/asm/processor.h
+@@ -54,7 +54,6 @@ struct thread_struct {
+ 
+ #define start_thread(regs,pc,sp)					\
+ ({									\
+-	unsigned long *stack = (unsigned long *)sp;			\
+ 	memset(regs->uregs, 0, sizeof(regs->uregs));			\
+ 	if (current->personality & ADDR_LIMIT_32BIT)			\
+ 		regs->ARM_cpsr = USR_MODE;				\
+@@ -65,9 +64,6 @@ struct thread_struct {
+ 	regs->ARM_cpsr |= PSR_ENDSTATE;					\
+ 	regs->ARM_pc = pc & ~1;		/* pc */			\
+ 	regs->ARM_sp = sp;		/* sp */			\
+-	regs->ARM_r2 = stack[2];	/* r2 (envp) */			\
+-	regs->ARM_r1 = stack[1];	/* r1 (argv) */			\
+-	regs->ARM_r0 = stack[0];	/* r0 (argc) */			\
+ 	nommu_start_thread(regs);					\
+ })
+ 
+diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
+index 1995d1a..f00b569 100644
+--- a/arch/arm/include/asm/thread_info.h
++++ b/arch/arm/include/asm/thread_info.h
+@@ -156,7 +156,6 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
+ #define TIF_USING_IWMMXT	17
+ #define TIF_MEMDIE		18	/* is terminating due to OOM killer */
+ #define TIF_RESTORE_SIGMASK	20
+-#define TIF_SWITCH_MM		22	/* deferred switch_mm */
+ 
+ #define _TIF_SIGPENDING		(1 << TIF_SIGPENDING)
+ #define _TIF_NEED_RESCHED	(1 << TIF_NEED_RESCHED)
+diff --git a/arch/arm/include/uapi/asm/Kbuild b/arch/arm/include/uapi/asm/Kbuild
+index 47bcb2d..18d76fd 100644
+--- a/arch/arm/include/uapi/asm/Kbuild
++++ b/arch/arm/include/uapi/asm/Kbuild
+@@ -1,7 +1,6 @@
+ # UAPI Header export list
+ include include/uapi/asm-generic/Kbuild.asm
+ 
+-header-y += a.out.h
+ header-y += byteorder.h
+ header-y += fcntl.h
+ header-y += hwcap.h
+diff --git a/arch/arm/include/uapi/asm/a.out.h b/arch/arm/include/uapi/asm/a.out.h
+deleted file mode 100644
+index 083894b..0000000
+--- a/arch/arm/include/uapi/asm/a.out.h
++++ /dev/null
+@@ -1,34 +0,0 @@
+-#ifndef __ARM_A_OUT_H__
+-#define __ARM_A_OUT_H__
+-
+-#include <linux/personality.h>
+-#include <linux/types.h>
+-
+-struct exec
+-{
+-  __u32 a_info;		/* Use macros N_MAGIC, etc for access */
+-  __u32 a_text;		/* length of text, in bytes */
+-  __u32 a_data;		/* length of data, in bytes */
+-  __u32 a_bss;		/* length of uninitialized data area for file, in bytes */
+-  __u32 a_syms;		/* length of symbol table data in file, in bytes */
+-  __u32 a_entry;	/* start address */
+-  __u32 a_trsize;	/* length of relocation info for text, in bytes */
+-  __u32 a_drsize;	/* length of relocation info for data, in bytes */
+-};
+-
+-/*
+- * This is always the same
+- */
+-#define N_TXTADDR(a)	(0x00008000)
+-
+-#define N_TRSIZE(a)	((a).a_trsize)
+-#define N_DRSIZE(a)	((a).a_drsize)
+-#define N_SYMSIZE(a)	((a).a_syms)
+-
+-#define M_ARM 103
+-
+-#ifndef LIBRARY_START_TEXT
+-#define LIBRARY_START_TEXT	(0x00c00000)
+-#endif
+-
+-#endif /* __A_OUT_GNU_H__ */
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index 582b405..d43c7e5 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -741,6 +741,18 @@ ENDPROC(__switch_to)
+ #endif
+ 	.endm
+ 
++	.macro	kuser_pad, sym, size
++	.if	(. - \sym) & 3
++	.rept	4 - (. - \sym) & 3
++	.byte	0
++	.endr
++	.endif
++	.rept	(\size - (. - \sym)) / 4
++	.word	0xe7fddef1
++	.endr
++	.endm
++
++#ifdef CONFIG_KUSER_HELPERS
+ 	.align	5
+ 	.globl	__kuser_helper_start
+ __kuser_helper_start:
+@@ -831,18 +843,13 @@ kuser_cmpxchg64_fixup:
+ #error "incoherent kernel configuration"
+ #endif
+ 
+-	/* pad to next slot */
+-	.rept	(16 - (. - __kuser_cmpxchg64)/4)
+-	.word	0
+-	.endr
+-
+-	.align	5
++	kuser_pad __kuser_cmpxchg64, 64
+ 
+ __kuser_memory_barrier:				@ 0xffff0fa0
+ 	smp_dmb	arm
+ 	usr_ret	lr
+ 
+-	.align	5
++	kuser_pad __kuser_memory_barrier, 32
+ 
+ __kuser_cmpxchg:				@ 0xffff0fc0
+ 
+@@ -915,13 +922,14 @@ kuser_cmpxchg32_fixup:
+ 
+ #endif
+ 
+-	.align	5
++	kuser_pad __kuser_cmpxchg, 32
+ 
+ __kuser_get_tls:				@ 0xffff0fe0
+ 	ldr	r0, [pc, #(16 - 8)]	@ read TLS, set in kuser_get_tls_init
+ 	usr_ret	lr
+ 	mrc	p15, 0, r0, c13, c0, 3	@ 0xffff0fe8 hardware TLS code
+-	.rep	4
++	kuser_pad __kuser_get_tls, 16
++	.rep	3
+ 	.word	0			@ 0xffff0ff0 software TLS value, then
+ 	.endr				@ pad up to __kuser_helper_version
+ 
+@@ -931,14 +939,16 @@ __kuser_helper_version:				@ 0xffff0ffc
+ 	.globl	__kuser_helper_end
+ __kuser_helper_end:
+ 
++#endif
++
+  THUMB(	.thumb	)
+ 
+ /*
+  * Vector stubs.
+  *
+- * This code is copied to 0xffff0200 so we can use branches in the
+- * vectors, rather than ldr's.  Note that this code must not
+- * exceed 0x300 bytes.
++ * This code is copied to 0xffff1000 so we can use branches in the
++ * vectors, rather than ldr's.  Note that this code must not exceed
++ * a page size.
+  *
+  * Common stub entry macro:
+  *   Enter in IRQ mode, spsr = SVC/USR CPSR, lr = SVC/USR PC
+@@ -985,8 +995,17 @@ ENDPROC(vector_\name)
+ 1:
+ 	.endm
+ 
+-	.globl	__stubs_start
++	.section .stubs, "ax", %progbits
+ __stubs_start:
++	@ This must be the first word
++	.word	vector_swi
++
++vector_rst:
++ ARM(	swi	SYS_ERROR0	)
++ THUMB(	svc	#0		)
++ THUMB(	nop			)
++	b	vector_und
++
+ /*
+  * Interrupt dispatcher
+  */
+@@ -1081,6 +1100,16 @@ __stubs_start:
+ 	.align	5
+ 
+ /*=============================================================================
++ * Address exception handler
++ *-----------------------------------------------------------------------------
++ * These aren't too critical.
++ * (they're not supposed to happen, and won't happen in 32-bit data mode).
++ */
++
++vector_addrexcptn:
++	b	vector_addrexcptn
++
++/*=============================================================================
+  * Undefined FIQs
+  *-----------------------------------------------------------------------------
+  * Enter in FIQ mode, spsr = ANY CPSR, lr = ANY PC
+@@ -1093,45 +1122,19 @@ __stubs_start:
+ vector_fiq:
+ 	subs	pc, lr, #4
+ 
+-/*=============================================================================
+- * Address exception handler
+- *-----------------------------------------------------------------------------
+- * These aren't too critical.
+- * (they're not supposed to happen, and won't happen in 32-bit data mode).
+- */
+-
+-vector_addrexcptn:
+-	b	vector_addrexcptn
+-
+-/*
+- * We group all the following data together to optimise
+- * for CPUs with separate I & D caches.
+- */
+-	.align	5
+-
+-.LCvswi:
+-	.word	vector_swi
+-
+-	.globl	__stubs_end
+-__stubs_end:
+-
+-	.equ	stubs_offset, __vectors_start + 0x200 - __stubs_start
++	.globl	vector_fiq_offset
++	.equ	vector_fiq_offset, vector_fiq
+ 
+-	.globl	__vectors_start
++	.section .vectors, "ax", %progbits
+ __vectors_start:
+- ARM(	swi	SYS_ERROR0	)
+- THUMB(	svc	#0		)
+- THUMB(	nop			)
+-	W(b)	vector_und + stubs_offset
+-	W(ldr)	pc, .LCvswi + stubs_offset
+-	W(b)	vector_pabt + stubs_offset
+-	W(b)	vector_dabt + stubs_offset
+-	W(b)	vector_addrexcptn + stubs_offset
+-	W(b)	vector_irq + stubs_offset
+-	W(b)	vector_fiq + stubs_offset
+-
+-	.globl	__vectors_end
+-__vectors_end:
++	W(b)	vector_rst
++	W(b)	vector_und
++	W(ldr)	pc, __vectors_start + 0x1000
++	W(b)	vector_pabt
++	W(b)	vector_dabt
++	W(b)	vector_addrexcptn
++	W(b)	vector_irq
++	W(b)	vector_fiq
+ 
+ 	.data
+ 
+diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
+index 2adda11..25442f4 100644
+--- a/arch/arm/kernel/fiq.c
++++ b/arch/arm/kernel/fiq.c
+@@ -47,6 +47,11 @@
+ #include <asm/irq.h>
+ #include <asm/traps.h>
+ 
++#define FIQ_OFFSET ({					\
++		extern void *vector_fiq_offset;		\
++		(unsigned)&vector_fiq_offset;		\
++	})
++
+ static unsigned long no_fiq_insn;
+ 
+ /* Default reacquire function
+@@ -80,13 +85,16 @@ int show_fiq_list(struct seq_file *p, int prec)
+ void set_fiq_handler(void *start, unsigned int length)
+ {
+ #if defined(CONFIG_CPU_USE_DOMAINS)
+-	memcpy((void *)0xffff001c, start, length);
++	void *base = (void *)0xffff0000;
+ #else
+-	memcpy(vectors_page + 0x1c, start, length);
++	void *base = vectors_page;
+ #endif
+-	flush_icache_range(0xffff001c, 0xffff001c + length);
++	unsigned offset = FIQ_OFFSET;
++
++	memcpy(base + offset, start, length);
++	flush_icache_range(0xffff0000 + offset, 0xffff0000 + offset + length);
+ 	if (!vectors_high())
+-		flush_icache_range(0x1c, 0x1c + length);
++		flush_icache_range(offset, offset + length);
+ }
+ 
+ int claim_fiq(struct fiq_handler *f)
+@@ -144,6 +152,7 @@ EXPORT_SYMBOL(disable_fiq);
+ 
+ void __init init_FIQ(int start)
+ {
+-	no_fiq_insn = *(unsigned long *)0xffff001c;
++	unsigned offset = FIQ_OFFSET;
++	no_fiq_insn = *(unsigned long *)(0xffff0000 + offset);
+ 	fiq_start = start;
+ }
+diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
+index 6e8931c..5bc2615 100644
+--- a/arch/arm/kernel/process.c
++++ b/arch/arm/kernel/process.c
+@@ -433,10 +433,11 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
+ }
+ 
+ #ifdef CONFIG_MMU
++#ifdef CONFIG_KUSER_HELPERS
+ /*
+  * The vectors page is always readable from user space for the
+- * atomic helpers and the signal restart code. Insert it into the
+- * gate_vma so that it is visible through ptrace and /proc/<pid>/mem.
++ * atomic helpers. Insert it into the gate_vma so that it is visible
++ * through ptrace and /proc/<pid>/mem.
+  */
+ static struct vm_area_struct gate_vma = {
+ 	.vm_start	= 0xffff0000,
+@@ -465,9 +466,48 @@ int in_gate_area_no_mm(unsigned long addr)
+ {
+ 	return in_gate_area(NULL, addr);
+ }
++#define is_gate_vma(vma)	((vma) = &gate_vma)
++#else
++#define is_gate_vma(vma)	0
++#endif
+ 
+ const char *arch_vma_name(struct vm_area_struct *vma)
+ {
+-	return (vma == &gate_vma) ? "[vectors]" : NULL;
++	return is_gate_vma(vma) ? "[vectors]" :
++		(vma->vm_mm && vma->vm_start == vma->vm_mm->context.sigpage) ?
++		 "[sigpage]" : NULL;
++}
++
++static struct page *signal_page;
++extern struct page *get_signal_page(void);
++
++int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
++{
++	struct mm_struct *mm = current->mm;
++	unsigned long addr;
++	int ret;
++
++	if (!signal_page)
++		signal_page = get_signal_page();
++	if (!signal_page)
++		return -ENOMEM;
++
++	down_write(&mm->mmap_sem);
++	addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
++	if (IS_ERR_VALUE(addr)) {
++		ret = addr;
++		goto up_fail;
++	}
++
++	ret = install_special_mapping(mm, addr, PAGE_SIZE,
++		VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC,
++		&signal_page);
++
++	if (ret == 0)
++		mm->context.sigpage = addr;
++
++ up_fail:
++	up_write(&mm->mmap_sem);
++	return ret;
+ }
+ #endif
+diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
+index 296786b..5a42c12 100644
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -8,6 +8,7 @@
+  * published by the Free Software Foundation.
+  */
+ #include <linux/errno.h>
++#include <linux/random.h>
+ #include <linux/signal.h>
+ #include <linux/personality.h>
+ #include <linux/uaccess.h>
+@@ -15,12 +16,11 @@
+ 
+ #include <asm/elf.h>
+ #include <asm/cacheflush.h>
++#include <asm/traps.h>
+ #include <asm/ucontext.h>
+ #include <asm/unistd.h>
+ #include <asm/vfp.h>
+ 
+-#include "signal.h"
+-
+ /*
+  * For ARM syscalls, we encode the syscall number into the instruction.
+  */
+@@ -40,11 +40,13 @@
+ #define SWI_THUMB_SIGRETURN	(0xdf00 << 16 | 0x2700 | (__NR_sigreturn - __NR_SYSCALL_BASE))
+ #define SWI_THUMB_RT_SIGRETURN	(0xdf00 << 16 | 0x2700 | (__NR_rt_sigreturn - __NR_SYSCALL_BASE))
+ 
+-const unsigned long sigreturn_codes[7] = {
++static const unsigned long sigreturn_codes[7] = {
+ 	MOV_R7_NR_SIGRETURN,    SWI_SYS_SIGRETURN,    SWI_THUMB_SIGRETURN,
+ 	MOV_R7_NR_RT_SIGRETURN, SWI_SYS_RT_SIGRETURN, SWI_THUMB_RT_SIGRETURN,
+ };
+ 
++static unsigned long signal_return_offset;
++
+ #ifdef CONFIG_CRUNCH
+ static int preserve_crunch_context(struct crunch_sigframe __user *frame)
+ {
+@@ -396,13 +398,19 @@ setup_return(struct pt_regs *regs, struct ksignal *ksig,
+ 		    __put_user(sigreturn_codes[idx+1], rc+1))
+ 			return 1;
+ 
++#ifdef CONFIG_MMU
+ 		if (cpsr & MODE32_BIT) {
++			struct mm_struct *mm = current->mm;
+ 			/*
+-			 * 32-bit code can use the new high-page
+-			 * signal return code support.
++			 * 32-bit code can use the signal return page
++			 * except when the MPU has protected the vectors
++			 * page from PL0
+ 			 */
+-			retcode = KERN_SIGRETURN_CODE + (idx << 2) + thumb;
+-		} else {
++			retcode = mm->context.sigpage + signal_return_offset +
++				  (idx << 2) + thumb;
++		} else
++#endif
++		{
+ 			/*
+ 			 * Ensure that the instruction cache sees
+ 			 * the return code written onto the stack.
+@@ -603,3 +611,33 @@ do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
+ 	} while (thread_flags & _TIF_WORK_MASK);
+ 	return 0;
+ }
++
++struct page *get_signal_page(void)
++{
++	unsigned long ptr;
++	unsigned offset;
++	struct page *page;
++	void *addr;
++
++	page = alloc_pages(GFP_KERNEL, 0);
++
++	if (!page)
++		return NULL;
++
++	addr = page_address(page);
++
++	/* Give the signal return code some randomness */
++	offset = 0x200 + (get_random_int() & 0x7fc);
++	signal_return_offset = offset;
++
++	/*
++	 * Copy signal return handlers into the vector page, and
++	 * set sigreturn to be a pointer to these.
++	 */
++	memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes));
++
++	ptr = (unsigned long)addr + offset;
++	flush_icache_range(ptr, ptr + sizeof(sigreturn_codes));
++
++	return page;
++}
+diff --git a/arch/arm/kernel/signal.h b/arch/arm/kernel/signal.h
+deleted file mode 100644
+index 5ff067b7..0000000
+--- a/arch/arm/kernel/signal.h
++++ /dev/null
+@@ -1,12 +0,0 @@
+-/*
+- *  linux/arch/arm/kernel/signal.h
+- *
+- *  Copyright (C) 2005-2009 Russell King.
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License version 2 as
+- * published by the Free Software Foundation.
+- */
+-#define KERN_SIGRETURN_CODE	(CONFIG_VECTORS_BASE + 0x00000500)
+-
+-extern const unsigned long sigreturn_codes[7];
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index 18b32e8..6b9567e 100644
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -35,8 +35,6 @@
+ #include <asm/tls.h>
+ #include <asm/system_misc.h>
+ 
+-#include "signal.h"
+-
+ static const char *handler[]= { "prefetch abort", "data abort", "address exception", "interrupt" };
+ 
+ void *vectors_page;
+@@ -800,47 +798,55 @@ void __init trap_init(void)
+ 	return;
+ }
+ 
+-static void __init kuser_get_tls_init(unsigned long vectors)
++#ifdef CONFIG_KUSER_HELPERS
++static void __init kuser_init(void *vectors)
+ {
++	extern char __kuser_helper_start[], __kuser_helper_end[];
++	int kuser_sz = __kuser_helper_end - __kuser_helper_start;
++
++	memcpy(vectors + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz);
++
+ 	/*
+ 	 * vectors + 0xfe0 = __kuser_get_tls
+ 	 * vectors + 0xfe8 = hardware TLS instruction at 0xffff0fe8
+ 	 */
+ 	if (tls_emu || has_tls_reg)
+-		memcpy((void *)vectors + 0xfe0, (void *)vectors + 0xfe8, 4);
++		memcpy(vectors + 0xfe0, vectors + 0xfe8, 4);
+ }
++#else
++static void __init kuser_init(void *vectors)
++{
++}
++#endif
+ 
+ void __init early_trap_init(void *vectors_base)
+ {
+ 	unsigned long vectors = (unsigned long)vectors_base;
+ 	extern char __stubs_start[], __stubs_end[];
+ 	extern char __vectors_start[], __vectors_end[];
+-	extern char __kuser_helper_start[], __kuser_helper_end[];
+-	int kuser_sz = __kuser_helper_end - __kuser_helper_start;
++	unsigned i;
+ 
+ 	vectors_page = vectors_base;
+ 
+ 	/*
++	 * Poison the vectors page with an undefined instruction.  This
++	 * instruction is chosen to be undefined for both ARM and Thumb
++	 * ISAs.  The Thumb version is an undefined instruction with a
++	 * branch back to the undefined instruction.
++	 */
++	for (i = 0; i < PAGE_SIZE / sizeof(u32); i++)
++		((u32 *)vectors_base)[i] = 0xe7fddef1;
++
++	/*
+ 	 * Copy the vectors, stubs and kuser helpers (in entry-armv.S)
+ 	 * into the vector page, mapped at 0xffff0000, and ensure these
+ 	 * are visible to the instruction stream.
+ 	 */
+ 	memcpy((void *)vectors, __vectors_start, __vectors_end - __vectors_start);
+-	memcpy((void *)vectors + 0x200, __stubs_start, __stubs_end - __stubs_start);
+-	memcpy((void *)vectors + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz);
++	memcpy((void *)vectors + 0x1000, __stubs_start, __stubs_end - __stubs_start);
+ 
+-	/*
+-	 * Do processor specific fixups for the kuser helpers
+-	 */
+-	kuser_get_tls_init(vectors);
+-
+-	/*
+-	 * Copy signal return handlers into the vector page, and
+-	 * set sigreturn to be a pointer to these.
+-	 */
+-	memcpy((void *)(vectors + KERN_SIGRETURN_CODE - CONFIG_VECTORS_BASE),
+-	       sigreturn_codes, sizeof(sigreturn_codes));
++	kuser_init(vectors_base);
+ 
+-	flush_icache_range(vectors, vectors + PAGE_SIZE);
++	flush_icache_range(vectors, vectors + PAGE_SIZE * 2);
+ 	modify_domain(DOMAIN_USER, DOMAIN_CLIENT);
+ }
+diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
+index a871b8e..33f2ea3 100644
+--- a/arch/arm/kernel/vmlinux.lds.S
++++ b/arch/arm/kernel/vmlinux.lds.S
+@@ -152,6 +152,23 @@ SECTIONS
+ 	. = ALIGN(PAGE_SIZE);
+ 	__init_begin = .;
+ #endif
++	/*
++	 * The vectors and stubs are relocatable code, and the
++	 * only thing that matters is their relative offsets
++	 */
++	__vectors_start = .;
++	.vectors 0 : AT(__vectors_start) {
++		*(.vectors)
++	}
++	. = __vectors_start + SIZEOF(.vectors);
++	__vectors_end = .;
++
++	__stubs_start = .;
++	.stubs 0x1000 : AT(__stubs_start) {
++		*(.stubs)
++	}
++	. = __stubs_start + SIZEOF(.stubs);
++	__stubs_end = .;
+ 
+ 	INIT_TEXT_SECTION(8)
+ 	.exit.text : {
+diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
+index 35955b5..2950082 100644
+--- a/arch/arm/mm/Kconfig
++++ b/arch/arm/mm/Kconfig
+@@ -411,24 +411,28 @@ config CPU_32v3
+ 	select CPU_USE_DOMAINS if MMU
+ 	select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
+ 	select TLS_REG_EMUL if SMP || !MMU
++	select NEED_KUSER_HELPERS
+ 
+ config CPU_32v4
+ 	bool
+ 	select CPU_USE_DOMAINS if MMU
+ 	select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
+ 	select TLS_REG_EMUL if SMP || !MMU
++	select NEED_KUSER_HELPERS
+ 
+ config CPU_32v4T
+ 	bool
+ 	select CPU_USE_DOMAINS if MMU
+ 	select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
+ 	select TLS_REG_EMUL if SMP || !MMU
++	select NEED_KUSER_HELPERS
+ 
+ config CPU_32v5
+ 	bool
+ 	select CPU_USE_DOMAINS if MMU
+ 	select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
+ 	select TLS_REG_EMUL if SMP || !MMU
++	select NEED_KUSER_HELPERS
+ 
+ config CPU_32v6
+ 	bool
+@@ -756,6 +760,7 @@ config CPU_BPREDICT_DISABLE
+ 
+ config TLS_REG_EMUL
+ 	bool
++	select NEED_KUSER_HELPERS
+ 	help
+ 	  An SMP system using a pre-ARMv6 processor (there are apparently
+ 	  a few prototypes like that in existence) and therefore access to
+@@ -763,11 +768,40 @@ config TLS_REG_EMUL
+ 
+ config NEEDS_SYSCALL_FOR_CMPXCHG
+ 	bool
++	select NEED_KUSER_HELPERS
+ 	help
+ 	  SMP on a pre-ARMv6 processor?  Well OK then.
+ 	  Forget about fast user space cmpxchg support.
+ 	  It is just not possible.
+ 
++config NEED_KUSER_HELPERS
++	bool
++
++config KUSER_HELPERS
++	bool "Enable kuser helpers in vector page" if !NEED_KUSER_HELPERS
++	default y
++	help
++	  Warning: disabling this option may break user programs.
++
++	  Provide kuser helpers in the vector page.  The kernel provides
++	  helper code to userspace in read only form at a fixed location
++	  in the high vector page to allow userspace to be independent of
++	  the CPU type fitted to the system.  This permits binaries to be
++	  run on ARMv4 through to ARMv7 without modification.
++
++	  However, the fixed address nature of these helpers can be used
++	  by ROP (return orientated programming) authors when creating
++	  exploits.
++
++	  If all of the binaries and libraries which run on your platform
++	  are built specifically for your platform, and make no use of
++	  these helpers, then you can turn this option off.  However,
++	  when such an binary or library is run, it will receive a SIGILL
++	  signal, which will terminate the program.
++
++	  Say N here only if you are absolutely certain that you do not
++	  need these helpers; otherwise, the safe option is to say Y.
++
+ config DMA_CACHE_RWFO
+ 	bool "Enable read/write for ownership DMA cache maintenance"
+ 	depends on CPU_V6K && SMP
+diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
+index 4d409e6..daf336f 100644
+--- a/arch/arm/mm/mmu.c
++++ b/arch/arm/mm/mmu.c
+@@ -1175,7 +1175,7 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
+ 	/*
+ 	 * Allocate the vector page early.
+ 	 */
+-	vectors = early_alloc(PAGE_SIZE);
++	vectors = early_alloc(PAGE_SIZE * 2);
+ 
+ 	early_trap_init(vectors);
+ 
+@@ -1220,15 +1220,27 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
+ 	map.pfn = __phys_to_pfn(virt_to_phys(vectors));
+ 	map.virtual = 0xffff0000;
+ 	map.length = PAGE_SIZE;
++#ifdef CONFIG_KUSER_HELPERS
+ 	map.type = MT_HIGH_VECTORS;
++#else
++	map.type = MT_LOW_VECTORS;
++#endif
+ 	create_mapping(&map);
+ 
+ 	if (!vectors_high()) {
+ 		map.virtual = 0;
++		map.length = PAGE_SIZE * 2;
+ 		map.type = MT_LOW_VECTORS;
+ 		create_mapping(&map);
+ 	}
+ 
++	/* Now create a kernel read-only mapping */
++	map.pfn += 1;
++	map.virtual = 0xffff0000 + PAGE_SIZE;
++	map.length = PAGE_SIZE;
++	map.type = MT_LOW_VECTORS;
++	create_mapping(&map);
++
+ 	/*
+ 	 * Ask the machine support to map in the statically mapped devices.
+ 	 */
+diff --git a/arch/arm/mm/proc-v7-2level.S b/arch/arm/mm/proc-v7-2level.S
+index 9704097..b3997c7 100644
+--- a/arch/arm/mm/proc-v7-2level.S
++++ b/arch/arm/mm/proc-v7-2level.S
+@@ -110,7 +110,7 @@ ENTRY(cpu_v7_set_pte_ext)
+  ARM(	str	r3, [r0, #2048]! )
+  THUMB(	add	r0, r0, #2048 )
+  THUMB(	str	r3, [r0] )
+-	ALT_SMP(mov	pc,lr)
++	ALT_SMP(W(nop))
+ 	ALT_UP (mcr	p15, 0, r0, c7, c10, 1)		@ flush_pte
+ #endif
+ 	mov	pc, lr
+diff --git a/arch/arm/mm/proc-v7-3level.S b/arch/arm/mm/proc-v7-3level.S
+index 363027e..6ba4bd9 100644
+--- a/arch/arm/mm/proc-v7-3level.S
++++ b/arch/arm/mm/proc-v7-3level.S
+@@ -73,7 +73,7 @@ ENTRY(cpu_v7_set_pte_ext)
+ 	tst	r3, #1 << (55 - 32)		@ L_PTE_DIRTY
+ 	orreq	r2, #L_PTE_RDONLY
+ 1:	strd	r2, r3, [r0]
+-	ALT_SMP(mov	pc, lr)
++	ALT_SMP(W(nop))
+ 	ALT_UP (mcr	p15, 0, r0, c7, c10, 1)		@ flush_pte
+ #endif
+ 	mov	pc, lr
+diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
+index e35fec3..5fbccee 100644
+--- a/arch/arm/mm/proc-v7.S
++++ b/arch/arm/mm/proc-v7.S
+@@ -75,13 +75,14 @@ ENTRY(cpu_v7_do_idle)
+ ENDPROC(cpu_v7_do_idle)
+ 
+ ENTRY(cpu_v7_dcache_clean_area)
+-	ALT_SMP(mov	pc, lr)			@ MP extensions imply L1 PTW
+-	ALT_UP(W(nop))
+-	dcache_line_size r2, r3
+-1:	mcr	p15, 0, r0, c7, c10, 1		@ clean D entry
++	ALT_SMP(W(nop))			@ MP extensions imply L1 PTW
++	ALT_UP_B(1f)
++	mov	pc, lr
++1:	dcache_line_size r2, r3
++2:	mcr	p15, 0, r0, c7, c10, 1		@ clean D entry
+ 	add	r0, r0, r2
+ 	subs	r1, r1, r2
+-	bhi	1b
++	bhi	2b
+ 	dsb
+ 	mov	pc, lr
+ ENDPROC(cpu_v7_dcache_clean_area)
+diff --git a/arch/parisc/include/asm/parisc-device.h b/arch/parisc/include/asm/parisc-device.h
+index 9afdad6..eaf4dc1 100644
+--- a/arch/parisc/include/asm/parisc-device.h
++++ b/arch/parisc/include/asm/parisc-device.h
+@@ -23,6 +23,7 @@ struct parisc_device {
+ 	/* generic info returned from pdc_pat_cell_module() */
+ 	unsigned long	mod_info;	/* PAT specific - Misc Module info */
+ 	unsigned long	pmod_loc;	/* physical Module location */
++	unsigned long	mod0;
+ #endif
+ 	u64		dma_mask;	/* DMA mask for I/O */
+ 	struct device 	dev;
+@@ -61,4 +62,6 @@ parisc_get_drvdata(struct parisc_device *d)
+ 
+ extern struct bus_type parisc_bus_type;
+ 
++int iosapic_serial_irq(struct parisc_device *dev);
++
+ #endif /*_ASM_PARISC_PARISC_DEVICE_H_*/
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index 2e65aa5..c035673 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -71,18 +71,27 @@ flush_cache_all_local(void)
+ }
+ EXPORT_SYMBOL(flush_cache_all_local);
+ 
++/* Virtual address of pfn.  */
++#define pfn_va(pfn)	__va(PFN_PHYS(pfn))
++
+ void
+ update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t *ptep)
+ {
+-	struct page *page = pte_page(*ptep);
++	unsigned long pfn = pte_pfn(*ptep);
++	struct page *page;
+ 
+-	if (pfn_valid(page_to_pfn(page)) && page_mapping(page) &&
+-	    test_bit(PG_dcache_dirty, &page->flags)) {
++	/* We don't have pte special.  As a result, we can be called with
++	   an invalid pfn and we don't need to flush the kernel dcache page.
++	   This occurs with FireGL card in C8000.  */
++	if (!pfn_valid(pfn))
++		return;
+ 
+-		flush_kernel_dcache_page(page);
++	page = pfn_to_page(pfn);
++	if (page_mapping(page) && test_bit(PG_dcache_dirty, &page->flags)) {
++		flush_kernel_dcache_page_addr(pfn_va(pfn));
+ 		clear_bit(PG_dcache_dirty, &page->flags);
+ 	} else if (parisc_requires_coherency())
+-		flush_kernel_dcache_page(page);
++		flush_kernel_dcache_page_addr(pfn_va(pfn));
+ }
+ 
+ void
+@@ -495,44 +504,42 @@ static inline pte_t *get_ptep(pgd_t *pgd, unsigned long addr)
+ 
+ void flush_cache_mm(struct mm_struct *mm)
+ {
++	struct vm_area_struct *vma;
++	pgd_t *pgd;
++
+ 	/* Flushing the whole cache on each cpu takes forever on
+ 	   rp3440, etc.  So, avoid it if the mm isn't too big.  */
+-	if (mm_total_size(mm) < parisc_cache_flush_threshold) {
+-		struct vm_area_struct *vma;
+-
+-		if (mm->context == mfsp(3)) {
+-			for (vma = mm->mmap; vma; vma = vma->vm_next) {
+-				flush_user_dcache_range_asm(vma->vm_start,
+-					vma->vm_end);
+-				if (vma->vm_flags & VM_EXEC)
+-					flush_user_icache_range_asm(
+-					  vma->vm_start, vma->vm_end);
+-			}
+-		} else {
+-			pgd_t *pgd = mm->pgd;
+-
+-			for (vma = mm->mmap; vma; vma = vma->vm_next) {
+-				unsigned long addr;
+-
+-				for (addr = vma->vm_start; addr < vma->vm_end;
+-				     addr += PAGE_SIZE) {
+-					pte_t *ptep = get_ptep(pgd, addr);
+-					if (ptep != NULL) {
+-						pte_t pte = *ptep;
+-						__flush_cache_page(vma, addr,
+-						  page_to_phys(pte_page(pte)));
+-					}
+-				}
+-			}
++	if (mm_total_size(mm) >= parisc_cache_flush_threshold) {
++		flush_cache_all();
++		return;
++	}
++
++	if (mm->context == mfsp(3)) {
++		for (vma = mm->mmap; vma; vma = vma->vm_next) {
++			flush_user_dcache_range_asm(vma->vm_start, vma->vm_end);
++			if ((vma->vm_flags & VM_EXEC) == 0)
++				continue;
++			flush_user_icache_range_asm(vma->vm_start, vma->vm_end);
+ 		}
+ 		return;
+ 	}
+ 
+-#ifdef CONFIG_SMP
+-	flush_cache_all();
+-#else
+-	flush_cache_all_local();
+-#endif
++	pgd = mm->pgd;
++	for (vma = mm->mmap; vma; vma = vma->vm_next) {
++		unsigned long addr;
++
++		for (addr = vma->vm_start; addr < vma->vm_end;
++		     addr += PAGE_SIZE) {
++			unsigned long pfn;
++			pte_t *ptep = get_ptep(pgd, addr);
++			if (!ptep)
++				continue;
++			pfn = pte_pfn(*ptep);
++			if (!pfn_valid(pfn))
++				continue;
++			__flush_cache_page(vma, addr, PFN_PHYS(pfn));
++		}
++	}
+ }
+ 
+ void
+@@ -556,33 +563,32 @@ flush_user_icache_range(unsigned long start, unsigned long end)
+ void flush_cache_range(struct vm_area_struct *vma,
+ 		unsigned long start, unsigned long end)
+ {
++	unsigned long addr;
++	pgd_t *pgd;
++
+ 	BUG_ON(!vma->vm_mm->context);
+ 
+-	if ((end - start) < parisc_cache_flush_threshold) {
+-		if (vma->vm_mm->context == mfsp(3)) {
+-			flush_user_dcache_range_asm(start, end);
+-			if (vma->vm_flags & VM_EXEC)
+-				flush_user_icache_range_asm(start, end);
+-		} else {
+-			unsigned long addr;
+-			pgd_t *pgd = vma->vm_mm->pgd;
+-
+-			for (addr = start & PAGE_MASK; addr < end;
+-			     addr += PAGE_SIZE) {
+-				pte_t *ptep = get_ptep(pgd, addr);
+-				if (ptep != NULL) {
+-					pte_t pte = *ptep;
+-					flush_cache_page(vma,
+-					   addr, pte_pfn(pte));
+-				}
+-			}
+-		}
+-	} else {
+-#ifdef CONFIG_SMP
++	if ((end - start) >= parisc_cache_flush_threshold) {
+ 		flush_cache_all();
+-#else
+-		flush_cache_all_local();
+-#endif
++		return;
++	}
++
++	if (vma->vm_mm->context == mfsp(3)) {
++		flush_user_dcache_range_asm(start, end);
++		if (vma->vm_flags & VM_EXEC)
++			flush_user_icache_range_asm(start, end);
++		return;
++	}
++
++	pgd = vma->vm_mm->pgd;
++	for (addr = start & PAGE_MASK; addr < end; addr += PAGE_SIZE) {
++		unsigned long pfn;
++		pte_t *ptep = get_ptep(pgd, addr);
++		if (!ptep)
++			continue;
++		pfn = pte_pfn(*ptep);
++		if (pfn_valid(pfn))
++			__flush_cache_page(vma, addr, PFN_PHYS(pfn));
+ 	}
+ }
+ 
+@@ -591,9 +597,10 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
+ {
+ 	BUG_ON(!vma->vm_mm->context);
+ 
+-	flush_tlb_page(vma, vmaddr);
+-	__flush_cache_page(vma, vmaddr, page_to_phys(pfn_to_page(pfn)));
+-
++	if (pfn_valid(pfn)) {
++		flush_tlb_page(vma, vmaddr);
++		__flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
++	}
+ }
+ 
+ #ifdef CONFIG_PARISC_TMPALIAS
+diff --git a/arch/parisc/kernel/inventory.c b/arch/parisc/kernel/inventory.c
+index 3295ef4..f0b6722 100644
+--- a/arch/parisc/kernel/inventory.c
++++ b/arch/parisc/kernel/inventory.c
+@@ -211,6 +211,7 @@ pat_query_module(ulong pcell_loc, ulong mod_index)
+ 	/* REVISIT: who is the consumer of this? not sure yet... */
+ 	dev->mod_info = pa_pdc_cell->mod_info;	/* pass to PAT_GET_ENTITY() */
+ 	dev->pmod_loc = pa_pdc_cell->mod_location;
++	dev->mod0 = pa_pdc_cell->mod[0];
+ 
+ 	register_parisc_device(dev);	/* advertise device */
+ 
+diff --git a/arch/powerpc/include/asm/smp.h b/arch/powerpc/include/asm/smp.h
+index ffbaabe..48cfc85 100644
+--- a/arch/powerpc/include/asm/smp.h
++++ b/arch/powerpc/include/asm/smp.h
+@@ -145,6 +145,10 @@ extern void __cpu_die(unsigned int cpu);
+ #define smp_setup_cpu_maps()
+ static inline void inhibit_secondary_onlining(void) {}
+ static inline void uninhibit_secondary_onlining(void) {}
++static inline const struct cpumask *cpu_sibling_mask(int cpu)
++{
++	return cpumask_of(cpu);
++}
+ 
+ #endif /* CONFIG_SMP */
+ 
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index 2859a1f..cafad40 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -27,6 +27,7 @@
+ #include <linux/seq_file.h>
+ #include <linux/uaccess.h>
+ #include <linux/slab.h>
++#include <asm/cputhreads.h>
+ #include <asm/sparsemem.h>
+ #include <asm/prom.h>
+ #include <asm/smp.h>
+@@ -1319,7 +1320,8 @@ static int update_cpu_associativity_changes_mask(void)
+ 			}
+ 		}
+ 		if (changed) {
+-			cpumask_set_cpu(cpu, changes);
++			cpumask_or(changes, changes, cpu_sibling_mask(cpu));
++			cpu = cpu_last_thread_sibling(cpu);
+ 		}
+ 	}
+ 
+@@ -1427,7 +1429,7 @@ static int update_cpu_topology(void *data)
+ 	if (!data)
+ 		return -EINVAL;
+ 
+-	cpu = get_cpu();
++	cpu = smp_processor_id();
+ 
+ 	for (update = data; update; update = update->next) {
+ 		if (cpu != update->cpu)
+@@ -1447,12 +1449,12 @@ static int update_cpu_topology(void *data)
+  */
+ int arch_update_cpu_topology(void)
+ {
+-	unsigned int cpu, changed = 0;
++	unsigned int cpu, sibling, changed = 0;
+ 	struct topology_update_data *updates, *ud;
+ 	unsigned int associativity[VPHN_ASSOC_BUFSIZE] = {0};
+ 	cpumask_t updated_cpus;
+ 	struct device *dev;
+-	int weight, i = 0;
++	int weight, new_nid, i = 0;
+ 
+ 	weight = cpumask_weight(&cpu_associativity_changes_mask);
+ 	if (!weight)
+@@ -1465,19 +1467,46 @@ int arch_update_cpu_topology(void)
+ 	cpumask_clear(&updated_cpus);
+ 
+ 	for_each_cpu(cpu, &cpu_associativity_changes_mask) {
+-		ud = &updates[i++];
+-		ud->cpu = cpu;
+-		vphn_get_associativity(cpu, associativity);
+-		ud->new_nid = associativity_to_nid(associativity);
+-
+-		if (ud->new_nid < 0 || !node_online(ud->new_nid))
+-			ud->new_nid = first_online_node;
++		/*
++		 * If siblings aren't flagged for changes, updates list
++		 * will be too short. Skip on this update and set for next
++		 * update.
++		 */
++		if (!cpumask_subset(cpu_sibling_mask(cpu),
++					&cpu_associativity_changes_mask)) {
++			pr_info("Sibling bits not set for associativity "
++					"change, cpu%d\n", cpu);
++			cpumask_or(&cpu_associativity_changes_mask,
++					&cpu_associativity_changes_mask,
++					cpu_sibling_mask(cpu));
++			cpu = cpu_last_thread_sibling(cpu);
++			continue;
++		}
+ 
+-		ud->old_nid = numa_cpu_lookup_table[cpu];
+-		cpumask_set_cpu(cpu, &updated_cpus);
++		/* Use associativity from first thread for all siblings */
++		vphn_get_associativity(cpu, associativity);
++		new_nid = associativity_to_nid(associativity);
++		if (new_nid < 0 || !node_online(new_nid))
++			new_nid = first_online_node;
++
++		if (new_nid == numa_cpu_lookup_table[cpu]) {
++			cpumask_andnot(&cpu_associativity_changes_mask,
++					&cpu_associativity_changes_mask,
++					cpu_sibling_mask(cpu));
++			cpu = cpu_last_thread_sibling(cpu);
++			continue;
++		}
+ 
+-		if (i < weight)
+-			ud->next = &updates[i];
++		for_each_cpu(sibling, cpu_sibling_mask(cpu)) {
++			ud = &updates[i++];
++			ud->cpu = sibling;
++			ud->new_nid = new_nid;
++			ud->old_nid = numa_cpu_lookup_table[sibling];
++			cpumask_set_cpu(sibling, &updated_cpus);
++			if (i < weight)
++				ud->next = &updates[i];
++		}
++		cpu = cpu_last_thread_sibling(cpu);
+ 	}
+ 
+ 	stop_machine(update_cpu_topology, &updates[0], &updated_cpus);
+diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
+index da183c5..97dcbea 100644
+--- a/arch/s390/Kconfig
++++ b/arch/s390/Kconfig
+@@ -227,11 +227,12 @@ config MARCH_Z196
+ 	  not work on older machines.
+ 
+ config MARCH_ZEC12
+-	bool "IBM zEC12"
++	bool "IBM zBC12 and zEC12"
+ 	select HAVE_MARCH_ZEC12_FEATURES if 64BIT
+ 	help
+-	  Select this to enable optimizations for IBM zEC12 (2827 series). The
+-	  kernel will be slightly faster but will not work on older machines.
++	  Select this to enable optimizations for IBM zBC12 and zEC12 (2828 and
++	  2827 series). The kernel will be slightly faster but will not work on
++	  older machines.
+ 
+ endchoice
+ 
+diff --git a/arch/s390/include/asm/bitops.h b/arch/s390/include/asm/bitops.h
+index 4d8604e..7d46767 100644
+--- a/arch/s390/include/asm/bitops.h
++++ b/arch/s390/include/asm/bitops.h
+@@ -693,7 +693,7 @@ static inline int find_next_bit_left(const unsigned long *addr,
+ 	size -= offset;
+ 	p = addr + offset / BITS_PER_LONG;
+ 	if (bit) {
+-		set = __flo_word(0, *p & (~0UL << bit));
++		set = __flo_word(0, *p & (~0UL >> bit));
+ 		if (set >= size)
+ 			return size + offset;
+ 		if (set < BITS_PER_LONG)
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index 0a49095..8ad9413 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -998,6 +998,7 @@ static void __init setup_hwcaps(void)
+ 		strcpy(elf_platform, "z196");
+ 		break;
+ 	case 0x2827:
++	case 0x2828:
+ 		strcpy(elf_platform, "zEC12");
+ 		break;
+ 	}
+diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
+index 89ebae4..eba15f1 100644
+--- a/arch/s390/mm/init.c
++++ b/arch/s390/mm/init.c
+@@ -69,6 +69,7 @@ static void __init setup_zero_pages(void)
+ 		order = 2;
+ 		break;
+ 	case 0x2827:	/* zEC12 */
++	case 0x2828:	/* zEC12 */
+ 	default:
+ 		order = 5;
+ 		break;
+diff --git a/arch/s390/oprofile/init.c b/arch/s390/oprofile/init.c
+index ffeb17c..930783d 100644
+--- a/arch/s390/oprofile/init.c
++++ b/arch/s390/oprofile/init.c
+@@ -440,7 +440,7 @@ static int oprofile_hwsampler_init(struct oprofile_operations *ops)
+ 		switch (id.machine) {
+ 		case 0x2097: case 0x2098: ops->cpu_type = "s390/z10"; break;
+ 		case 0x2817: case 0x2818: ops->cpu_type = "s390/z196"; break;
+-		case 0x2827:              ops->cpu_type = "s390/zEC12"; break;
++		case 0x2827: case 0x2828: ops->cpu_type = "s390/zEC12"; break;
+ 		default: return -ENODEV;
+ 		}
+ 	}
+diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
+index 94ab6b9..63bdb29 100644
+--- a/arch/x86/kernel/early-quirks.c
++++ b/arch/x86/kernel/early-quirks.c
+@@ -196,15 +196,23 @@ static void __init ati_bugs_contd(int num, int slot, int func)
+ static void __init intel_remapping_check(int num, int slot, int func)
+ {
+ 	u8 revision;
++	u16 device;
+ 
++	device = read_pci_config_16(num, slot, func, PCI_DEVICE_ID);
+ 	revision = read_pci_config_byte(num, slot, func, PCI_REVISION_ID);
+ 
+ 	/*
+-	 * Revision 0x13 of this chipset supports irq remapping
+-	 * but has an erratum that breaks its behavior, flag it as such
++ 	 * Revision 13 of all triggering devices id in this quirk have
++	 * a problem draining interrupts when irq remapping is enabled,
++	 * and should be flagged as broken.  Additionally revisions 0x12
++	 * and 0x22 of device id 0x3405 has this problem.
+ 	 */
+ 	if (revision == 0x13)
+ 		set_irq_remapping_broken();
++	else if ((device == 0x3405) &&
++	    ((revision == 0x12) ||
++	     (revision == 0x22)))
++		set_irq_remapping_broken();
+ 
+ }
+ 
+@@ -239,6 +247,8 @@ static struct chipset early_qrk[] __initdata = {
+ 	  PCI_CLASS_SERIAL_SMBUS, PCI_ANY_ID, 0, ati_bugs_contd },
+ 	{ PCI_VENDOR_ID_INTEL, 0x3403, PCI_CLASS_BRIDGE_HOST,
+ 	  PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
++	{ PCI_VENDOR_ID_INTEL, 0x3405, PCI_CLASS_BRIDGE_HOST,
++	  PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
+ 	{ PCI_VENDOR_ID_INTEL, 0x3406, PCI_CLASS_BRIDGE_HOST,
+ 	  PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
+ 	{}
+diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
+index cb33909..f7ea30d 100644
+--- a/arch/x86/kernel/i387.c
++++ b/arch/x86/kernel/i387.c
+@@ -116,7 +116,7 @@ static void __cpuinit mxcsr_feature_mask_init(void)
+ 
+ 	if (cpu_has_fxsr) {
+ 		memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct));
+-		asm volatile("fxsave %0" : : "m" (fx_scratch));
++		asm volatile("fxsave %0" : "+m" (fx_scratch));
+ 		mask = fx_scratch.mxcsr_mask;
+ 		if (mask == 0)
+ 			mask = 0x0000ffbf;
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index e710045..9533271 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -117,6 +117,7 @@ struct acpi_battery {
+ 	struct acpi_device *device;
+ 	struct notifier_block pm_nb;
+ 	unsigned long update_time;
++	int revision;
+ 	int rate_now;
+ 	int capacity_now;
+ 	int voltage_now;
+@@ -359,6 +360,7 @@ static struct acpi_offsets info_offsets[] = {
+ };
+ 
+ static struct acpi_offsets extended_info_offsets[] = {
++	{offsetof(struct acpi_battery, revision), 0},
+ 	{offsetof(struct acpi_battery, power_unit), 0},
+ 	{offsetof(struct acpi_battery, design_capacity), 0},
+ 	{offsetof(struct acpi_battery, full_charge_capacity), 0},
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index d89ef86..69b45fc 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -75,6 +75,7 @@ struct blk_shadow {
+ 	struct blkif_request req;
+ 	struct request *request;
+ 	struct grant *grants_used[BLKIF_MAX_SEGMENTS_PER_REQUEST];
++	struct scatterlist sg[BLKIF_MAX_SEGMENTS_PER_REQUEST];
+ };
+ 
+ static DEFINE_MUTEX(blkfront_mutex);
+@@ -98,7 +99,6 @@ struct blkfront_info
+ 	enum blkif_state connected;
+ 	int ring_ref;
+ 	struct blkif_front_ring ring;
+-	struct scatterlist sg[BLKIF_MAX_SEGMENTS_PER_REQUEST];
+ 	unsigned int evtchn, irq;
+ 	struct request_queue *rq;
+ 	struct work_struct work;
+@@ -422,11 +422,11 @@ static int blkif_queue_request(struct request *req)
+ 			ring_req->u.discard.flag = 0;
+ 	} else {
+ 		ring_req->u.rw.nr_segments = blk_rq_map_sg(req->q, req,
+-							   info->sg);
++							   info->shadow[id].sg);
+ 		BUG_ON(ring_req->u.rw.nr_segments >
+ 		       BLKIF_MAX_SEGMENTS_PER_REQUEST);
+ 
+-		for_each_sg(info->sg, sg, ring_req->u.rw.nr_segments, i) {
++		for_each_sg(info->shadow[id].sg, sg, ring_req->u.rw.nr_segments, i) {
+ 			fsect = sg->offset >> 9;
+ 			lsect = fsect + (sg->length >> 9) - 1;
+ 
+@@ -867,12 +867,12 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
+ 			     struct blkif_response *bret)
+ {
+ 	int i = 0;
+-	struct bio_vec *bvec;
+-	struct req_iterator iter;
+-	unsigned long flags;
++	struct scatterlist *sg;
+ 	char *bvec_data;
+ 	void *shared_data;
+-	unsigned int offset = 0;
++	int nseg;
++
++	nseg = s->req.u.rw.nr_segments;
+ 
+ 	if (bret->operation == BLKIF_OP_READ) {
+ 		/*
+@@ -881,19 +881,16 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
+ 		 * than PAGE_SIZE, we have to keep track of the current offset,
+ 		 * to be sure we are copying the data from the right shared page.
+ 		 */
+-		rq_for_each_segment(bvec, s->request, iter) {
+-			BUG_ON((bvec->bv_offset + bvec->bv_len) > PAGE_SIZE);
+-			if (bvec->bv_offset < offset)
+-				i++;
+-			BUG_ON(i >= s->req.u.rw.nr_segments);
++		for_each_sg(s->sg, sg, nseg, i) {
++			BUG_ON(sg->offset + sg->length > PAGE_SIZE);
+ 			shared_data = kmap_atomic(
+ 				pfn_to_page(s->grants_used[i]->pfn));
+-			bvec_data = bvec_kmap_irq(bvec, &flags);
+-			memcpy(bvec_data, shared_data + bvec->bv_offset,
+-				bvec->bv_len);
+-			bvec_kunmap_irq(bvec_data, &flags);
++			bvec_data = kmap_atomic(sg_page(sg));
++			memcpy(bvec_data   + sg->offset,
++			       shared_data + sg->offset,
++			       sg->length);
++			kunmap_atomic(bvec_data);
+ 			kunmap_atomic(shared_data);
+-			offset = bvec->bv_offset + bvec->bv_len;
+ 		}
+ 	}
+ 	/* Add the persistent grant into the list of free grants */
+@@ -1022,7 +1019,7 @@ static int setup_blkring(struct xenbus_device *dev,
+ 			 struct blkfront_info *info)
+ {
+ 	struct blkif_sring *sring;
+-	int err;
++	int err, i;
+ 
+ 	info->ring_ref = GRANT_INVALID_REF;
+ 
+@@ -1034,7 +1031,8 @@ static int setup_blkring(struct xenbus_device *dev,
+ 	SHARED_RING_INIT(sring);
+ 	FRONT_RING_INIT(&info->ring, sring, PAGE_SIZE);
+ 
+-	sg_init_table(info->sg, BLKIF_MAX_SEGMENTS_PER_REQUEST);
++	for (i = 0; i < BLK_RING_SIZE; i++)
++		sg_init_table(info->shadow[i].sg, BLKIF_MAX_SEGMENTS_PER_REQUEST);
+ 
+ 	/* Allocate memory for grants */
+ 	err = fill_grant_buffer(info, BLK_RING_SIZE *
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 11f467c..a12b923 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -91,6 +91,10 @@ static struct usb_device_id ath3k_table[] = {
+ 	{ USB_DEVICE(0x0489, 0xe04e) },
+ 	{ USB_DEVICE(0x0489, 0xe056) },
+ 	{ USB_DEVICE(0x0489, 0xe04d) },
++	{ USB_DEVICE(0x04c5, 0x1330) },
++	{ USB_DEVICE(0x13d3, 0x3402) },
++	{ USB_DEVICE(0x0cf3, 0x3121) },
++	{ USB_DEVICE(0x0cf3, 0xe003) },
+ 
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xE02C) },
+@@ -128,6 +132,10 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ 	{ USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
+ 
+ 	/* Atheros AR5BBU22 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
+@@ -193,24 +201,44 @@ error:
+ 
+ static int ath3k_get_state(struct usb_device *udev, unsigned char *state)
+ {
+-	int pipe = 0;
++	int ret, pipe = 0;
++	char *buf;
++
++	buf = kmalloc(sizeof(*buf), GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
+ 
+ 	pipe = usb_rcvctrlpipe(udev, 0);
+-	return usb_control_msg(udev, pipe, ATH3K_GETSTATE,
+-			USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
+-			state, 0x01, USB_CTRL_SET_TIMEOUT);
++	ret = usb_control_msg(udev, pipe, ATH3K_GETSTATE,
++			      USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
++			      buf, sizeof(*buf), USB_CTRL_SET_TIMEOUT);
++
++	*state = *buf;
++	kfree(buf);
++
++	return ret;
+ }
+ 
+ static int ath3k_get_version(struct usb_device *udev,
+ 			struct ath3k_version *version)
+ {
+-	int pipe = 0;
++	int ret, pipe = 0;
++	struct ath3k_version *buf;
++	const int size = sizeof(*buf);
++
++	buf = kmalloc(size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
+ 
+ 	pipe = usb_rcvctrlpipe(udev, 0);
+-	return usb_control_msg(udev, pipe, ATH3K_GETVERSION,
+-			USB_TYPE_VENDOR | USB_DIR_IN, 0, 0, version,
+-			sizeof(struct ath3k_version),
+-			USB_CTRL_SET_TIMEOUT);
++	ret = usb_control_msg(udev, pipe, ATH3K_GETVERSION,
++			      USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
++			      buf, size, USB_CTRL_SET_TIMEOUT);
++
++	memcpy(version, buf, size);
++	kfree(buf);
++
++	return ret;
+ }
+ 
+ static int ath3k_load_fwfile(struct usb_device *udev,
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 7a7e5f8..d0b3d90 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -57,6 +57,9 @@ static struct usb_device_id btusb_table[] = {
+ 	/* Apple-specific (Broadcom) devices */
+ 	{ USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
+ 
++	/* MediaTek MT76x0E */
++	{ USB_DEVICE(0x0e8d, 0x763f) },
++
+ 	/* Broadcom SoftSailing reporting vendor specific */
+ 	{ USB_DEVICE(0x0a5c, 0x21e1) },
+ 
+@@ -151,6 +154,10 @@ static struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
+ 
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+@@ -1092,7 +1099,7 @@ static int btusb_setup_intel_patching(struct hci_dev *hdev,
+ 	if (IS_ERR(skb)) {
+ 		BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
+ 		       hdev->name, cmd->opcode, PTR_ERR(skb));
+-		return -PTR_ERR(skb);
++		return PTR_ERR(skb);
+ 	}
+ 
+ 	/* It ensures that the returned event matches the event data read from
+@@ -1144,7 +1151,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
+ 	if (IS_ERR(skb)) {
+ 		BT_ERR("%s sending initial HCI reset command failed (%ld)",
+ 		       hdev->name, PTR_ERR(skb));
+-		return -PTR_ERR(skb);
++		return PTR_ERR(skb);
+ 	}
+ 	kfree_skb(skb);
+ 
+@@ -1158,7 +1165,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
+ 	if (IS_ERR(skb)) {
+ 		BT_ERR("%s reading Intel fw version command failed (%ld)",
+ 		       hdev->name, PTR_ERR(skb));
+-		return -PTR_ERR(skb);
++		return PTR_ERR(skb);
+ 	}
+ 
+ 	if (skb->len != sizeof(*ver)) {
+@@ -1216,7 +1223,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
+ 		BT_ERR("%s entering Intel manufacturer mode failed (%ld)",
+ 		       hdev->name, PTR_ERR(skb));
+ 		release_firmware(fw);
+-		return -PTR_ERR(skb);
++		return PTR_ERR(skb);
+ 	}
+ 
+ 	if (skb->data[0]) {
+@@ -1273,7 +1280,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
+ 	if (IS_ERR(skb)) {
+ 		BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
+ 		       hdev->name, PTR_ERR(skb));
+-		return -PTR_ERR(skb);
++		return PTR_ERR(skb);
+ 	}
+ 	kfree_skb(skb);
+ 
+@@ -1289,7 +1296,7 @@ exit_mfg_disable:
+ 	if (IS_ERR(skb)) {
+ 		BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
+ 		       hdev->name, PTR_ERR(skb));
+-		return -PTR_ERR(skb);
++		return PTR_ERR(skb);
+ 	}
+ 	kfree_skb(skb);
+ 
+@@ -1307,7 +1314,7 @@ exit_mfg_deactivate:
+ 	if (IS_ERR(skb)) {
+ 		BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
+ 		       hdev->name, PTR_ERR(skb));
+-		return -PTR_ERR(skb);
++		return PTR_ERR(skb);
+ 	}
+ 	kfree_skb(skb);
+ 
+diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
+index 94821ab..9576fad 100644
+--- a/drivers/char/agp/parisc-agp.c
++++ b/drivers/char/agp/parisc-agp.c
+@@ -129,7 +129,8 @@ parisc_agp_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
+ 	off_t j, io_pg_start;
+ 	int io_pg_count;
+ 
+-	if (type != 0 || mem->type != 0) {
++	if (type != mem->type ||
++		agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type)) {
+ 		return -EINVAL;
+ 	}
+ 
+@@ -175,7 +176,8 @@ parisc_agp_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
+ 	struct _parisc_agp_info *info = &parisc_agp_info;
+ 	int i, io_pg_start, io_pg_count;
+ 
+-	if (type != 0 || mem->type != 0) {
++	if (type != mem->type ||
++		agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type)) {
+ 		return -EINVAL;
+ 	}
+ 
+diff --git a/drivers/char/hw_random/bcm2835-rng.c b/drivers/char/hw_random/bcm2835-rng.c
+index eb7f147..43577ca 100644
+--- a/drivers/char/hw_random/bcm2835-rng.c
++++ b/drivers/char/hw_random/bcm2835-rng.c
+@@ -110,4 +110,4 @@ module_platform_driver(bcm2835_rng_driver);
+ 
+ MODULE_AUTHOR("Lubomir Rintel <lkundrak@××.sk>");
+ MODULE_DESCRIPTION("BCM2835 Random Number Generator (RNG) driver");
+-MODULE_LICENSE("GPLv2");
++MODULE_LICENSE("GPL v2");
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index 178fe7a..6485547 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1075,14 +1075,11 @@ static int __cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif
+ 				__func__, cpu_dev->id, cpu);
+ 	}
+ 
+-	if ((cpus == 1) && (cpufreq_driver->target))
+-		__cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
+-
+-	pr_debug("%s: removing link, cpu: %d\n", __func__, cpu);
+-	cpufreq_cpu_put(data);
+-
+ 	/* If cpu is last user of policy, free policy */
+ 	if (cpus == 1) {
++		if (cpufreq_driver->target)
++			__cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
++
+ 		lock_policy_rwsem_read(cpu);
+ 		kobj = &data->kobj;
+ 		cmp = &data->kobj_unregister;
+@@ -1103,9 +1100,13 @@ static int __cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif
+ 		free_cpumask_var(data->related_cpus);
+ 		free_cpumask_var(data->cpus);
+ 		kfree(data);
+-	} else if (cpufreq_driver->target) {
+-		__cpufreq_governor(data, CPUFREQ_GOV_START);
+-		__cpufreq_governor(data, CPUFREQ_GOV_LIMITS);
++	} else {
++		pr_debug("%s: removing link, cpu: %d\n", __func__, cpu);
++		cpufreq_cpu_put(data);
++		if (cpufreq_driver->target) {
++			__cpufreq_governor(data, CPUFREQ_GOV_START);
++			__cpufreq_governor(data, CPUFREQ_GOV_LIMITS);
++		}
+ 	}
+ 
+ 	per_cpu(cpufreq_policy_cpu, cpu) = -1;
+diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
+index fe343a0..bc580b6 100644
+--- a/drivers/cpuidle/governors/menu.c
++++ b/drivers/cpuidle/governors/menu.c
+@@ -28,13 +28,6 @@
+ #define MAX_INTERESTING 50000
+ #define STDDEV_THRESH 400
+ 
+-/* 60 * 60 > STDDEV_THRESH * INTERVALS = 400 * 8 */
+-#define MAX_DEVIATION 60
+-
+-static DEFINE_PER_CPU(struct hrtimer, menu_hrtimer);
+-static DEFINE_PER_CPU(int, hrtimer_status);
+-/* menu hrtimer mode */
+-enum {MENU_HRTIMER_STOP, MENU_HRTIMER_REPEAT, MENU_HRTIMER_GENERAL};
+ 
+ /*
+  * Concepts and ideas behind the menu governor
+@@ -116,13 +109,6 @@ enum {MENU_HRTIMER_STOP, MENU_HRTIMER_REPEAT, MENU_HRTIMER_GENERAL};
+  *
+  */
+ 
+-/*
+- * The C-state residency is so long that is is worthwhile to exit
+- * from the shallow C-state and re-enter into a deeper C-state.
+- */
+-static unsigned int perfect_cstate_ms __read_mostly = 30;
+-module_param(perfect_cstate_ms, uint, 0000);
+-
+ struct menu_device {
+ 	int		last_state_idx;
+ 	int             needs_update;
+@@ -205,52 +191,17 @@ static u64 div_round64(u64 dividend, u32 divisor)
+ 	return div_u64(dividend + (divisor / 2), divisor);
+ }
+ 
+-/* Cancel the hrtimer if it is not triggered yet */
+-void menu_hrtimer_cancel(void)
+-{
+-	int cpu = smp_processor_id();
+-	struct hrtimer *hrtmr = &per_cpu(menu_hrtimer, cpu);
+-
+-	/* The timer is still not time out*/
+-	if (per_cpu(hrtimer_status, cpu)) {
+-		hrtimer_cancel(hrtmr);
+-		per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_STOP;
+-	}
+-}
+-EXPORT_SYMBOL_GPL(menu_hrtimer_cancel);
+-
+-/* Call back for hrtimer is triggered */
+-static enum hrtimer_restart menu_hrtimer_notify(struct hrtimer *hrtimer)
+-{
+-	int cpu = smp_processor_id();
+-	struct menu_device *data = &per_cpu(menu_devices, cpu);
+-
+-	/* In general case, the expected residency is much larger than
+-	 *  deepest C-state target residency, but prediction logic still
+-	 *  predicts a small predicted residency, so the prediction
+-	 *  history is totally broken if the timer is triggered.
+-	 *  So reset the correction factor.
+-	 */
+-	if (per_cpu(hrtimer_status, cpu) == MENU_HRTIMER_GENERAL)
+-		data->correction_factor[data->bucket] = RESOLUTION * DECAY;
+-
+-	per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_STOP;
+-
+-	return HRTIMER_NORESTART;
+-}
+-
+ /*
+  * Try detecting repeating patterns by keeping track of the last 8
+  * intervals, and checking if the standard deviation of that set
+  * of points is below a threshold. If it is... then use the
+  * average of these 8 points as the estimated value.
+  */
+-static u32 get_typical_interval(struct menu_device *data)
++static void get_typical_interval(struct menu_device *data)
+ {
+ 	int i = 0, divisor = 0;
+ 	uint64_t max = 0, avg = 0, stddev = 0;
+ 	int64_t thresh = LLONG_MAX; /* Discard outliers above this value. */
+-	unsigned int ret = 0;
+ 
+ again:
+ 
+@@ -291,16 +242,13 @@ again:
+ 	if (((avg > stddev * 6) && (divisor * 4 >= INTERVALS * 3))
+ 							|| stddev <= 20) {
+ 		data->predicted_us = avg;
+-		ret = 1;
+-		return ret;
++		return;
+ 
+ 	} else if ((divisor * 4) > INTERVALS * 3) {
+ 		/* Exclude the max interval */
+ 		thresh = max - 1;
+ 		goto again;
+ 	}
+-
+-	return ret;
+ }
+ 
+ /**
+@@ -315,9 +263,6 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
+ 	int i;
+ 	int multiplier;
+ 	struct timespec t;
+-	int repeat = 0, low_predicted = 0;
+-	int cpu = smp_processor_id();
+-	struct hrtimer *hrtmr = &per_cpu(menu_hrtimer, cpu);
+ 
+ 	if (data->needs_update) {
+ 		menu_update(drv, dev);
+@@ -352,7 +297,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
+ 	data->predicted_us = div_round64(data->expected_us * data->correction_factor[data->bucket],
+ 					 RESOLUTION * DECAY);
+ 
+-	repeat = get_typical_interval(data);
++	get_typical_interval(data);
+ 
+ 	/*
+ 	 * We want to default to C1 (hlt), not to busy polling
+@@ -373,10 +318,8 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
+ 
+ 		if (s->disabled || su->disable)
+ 			continue;
+-		if (s->target_residency > data->predicted_us) {
+-			low_predicted = 1;
++		if (s->target_residency > data->predicted_us)
+ 			continue;
+-		}
+ 		if (s->exit_latency > latency_req)
+ 			continue;
+ 		if (s->exit_latency * multiplier > data->predicted_us)
+@@ -386,44 +329,6 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
+ 		data->exit_us = s->exit_latency;
+ 	}
+ 
+-	/* not deepest C-state chosen for low predicted residency */
+-	if (low_predicted) {
+-		unsigned int timer_us = 0;
+-		unsigned int perfect_us = 0;
+-
+-		/*
+-		 * Set a timer to detect whether this sleep is much
+-		 * longer than repeat mode predicted.  If the timer
+-		 * triggers, the code will evaluate whether to put
+-		 * the CPU into a deeper C-state.
+-		 * The timer is cancelled on CPU wakeup.
+-		 */
+-		timer_us = 2 * (data->predicted_us + MAX_DEVIATION);
+-
+-		perfect_us = perfect_cstate_ms * 1000;
+-
+-		if (repeat && (4 * timer_us < data->expected_us)) {
+-			RCU_NONIDLE(hrtimer_start(hrtmr,
+-				ns_to_ktime(1000 * timer_us),
+-				HRTIMER_MODE_REL_PINNED));
+-			/* In repeat case, menu hrtimer is started */
+-			per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_REPEAT;
+-		} else if (perfect_us < data->expected_us) {
+-			/*
+-			 * The next timer is long. This could be because
+-			 * we did not make a useful prediction.
+-			 * In that case, it makes sense to re-enter
+-			 * into a deeper C-state after some time.
+-			 */
+-			RCU_NONIDLE(hrtimer_start(hrtmr,
+-				ns_to_ktime(1000 * timer_us),
+-				HRTIMER_MODE_REL_PINNED));
+-			/* In general case, menu hrtimer is started */
+-			per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_GENERAL;
+-		}
+-
+-	}
+-
+ 	return data->last_state_idx;
+ }
+ 
+@@ -514,9 +419,6 @@ static int menu_enable_device(struct cpuidle_driver *drv,
+ 				struct cpuidle_device *dev)
+ {
+ 	struct menu_device *data = &per_cpu(menu_devices, dev->cpu);
+-	struct hrtimer *t = &per_cpu(menu_hrtimer, dev->cpu);
+-	hrtimer_init(t, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+-	t->function = menu_hrtimer_notify;
+ 
+ 	memset(data, 0, sizeof(struct menu_device));
+ 
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 7ec82f0..4c2f465 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2527,6 +2527,10 @@ static dma_cookie_t pl330_tx_submit(struct dma_async_tx_descriptor *tx)
+ 	/* Assign cookies to all nodes */
+ 	while (!list_empty(&last->node)) {
+ 		desc = list_entry(last->node.next, struct dma_pl330_desc, node);
++		if (pch->cyclic) {
++			desc->txd.callback = last->txd.callback;
++			desc->txd.callback_param = last->txd.callback_param;
++		}
+ 
+ 		dma_cookie_assign(&desc->txd);
+ 
+@@ -2710,45 +2714,82 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic(
+ 		size_t period_len, enum dma_transfer_direction direction,
+ 		unsigned long flags, void *context)
+ {
+-	struct dma_pl330_desc *desc;
++	struct dma_pl330_desc *desc = NULL, *first = NULL;
+ 	struct dma_pl330_chan *pch = to_pchan(chan);
++	struct dma_pl330_dmac *pdmac = pch->dmac;
++	unsigned int i;
+ 	dma_addr_t dst;
+ 	dma_addr_t src;
+ 
+-	desc = pl330_get_desc(pch);
+-	if (!desc) {
+-		dev_err(pch->dmac->pif.dev, "%s:%d Unable to fetch desc\n",
+-			__func__, __LINE__);
++	if (len % period_len != 0)
+ 		return NULL;
+-	}
+ 
+-	switch (direction) {
+-	case DMA_MEM_TO_DEV:
+-		desc->rqcfg.src_inc = 1;
+-		desc->rqcfg.dst_inc = 0;
+-		desc->req.rqtype = MEMTODEV;
+-		src = dma_addr;
+-		dst = pch->fifo_addr;
+-		break;
+-	case DMA_DEV_TO_MEM:
+-		desc->rqcfg.src_inc = 0;
+-		desc->rqcfg.dst_inc = 1;
+-		desc->req.rqtype = DEVTOMEM;
+-		src = pch->fifo_addr;
+-		dst = dma_addr;
+-		break;
+-	default:
++	if (!is_slave_direction(direction)) {
+ 		dev_err(pch->dmac->pif.dev, "%s:%d Invalid dma direction\n",
+ 		__func__, __LINE__);
+ 		return NULL;
+ 	}
+ 
+-	desc->rqcfg.brst_size = pch->burst_sz;
+-	desc->rqcfg.brst_len = 1;
++	for (i = 0; i < len / period_len; i++) {
++		desc = pl330_get_desc(pch);
++		if (!desc) {
++			dev_err(pch->dmac->pif.dev, "%s:%d Unable to fetch desc\n",
++				__func__, __LINE__);
+ 
+-	pch->cyclic = true;
++			if (!first)
++				return NULL;
++
++			spin_lock_irqsave(&pdmac->pool_lock, flags);
++
++			while (!list_empty(&first->node)) {
++				desc = list_entry(first->node.next,
++						struct dma_pl330_desc, node);
++				list_move_tail(&desc->node, &pdmac->desc_pool);
++			}
++
++			list_move_tail(&first->node, &pdmac->desc_pool);
+ 
+-	fill_px(&desc->px, dst, src, period_len);
++			spin_unlock_irqrestore(&pdmac->pool_lock, flags);
++
++			return NULL;
++		}
++
++		switch (direction) {
++		case DMA_MEM_TO_DEV:
++			desc->rqcfg.src_inc = 1;
++			desc->rqcfg.dst_inc = 0;
++			desc->req.rqtype = MEMTODEV;
++			src = dma_addr;
++			dst = pch->fifo_addr;
++			break;
++		case DMA_DEV_TO_MEM:
++			desc->rqcfg.src_inc = 0;
++			desc->rqcfg.dst_inc = 1;
++			desc->req.rqtype = DEVTOMEM;
++			src = pch->fifo_addr;
++			dst = dma_addr;
++			break;
++		default:
++			break;
++		}
++
++		desc->rqcfg.brst_size = pch->burst_sz;
++		desc->rqcfg.brst_len = 1;
++		fill_px(&desc->px, dst, src, period_len);
++
++		if (!first)
++			first = desc;
++		else
++			list_add_tail(&desc->node, &first->node);
++
++		dma_addr += period_len;
++	}
++
++	if (!desc)
++		return NULL;
++
++	pch->cyclic = true;
++	desc->txd.flags = flags;
+ 
+ 	return &desc->txd;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
+index fb961bb..16e674a 100644
+--- a/drivers/gpu/drm/i915/intel_ddi.c
++++ b/drivers/gpu/drm/i915/intel_ddi.c
+@@ -684,7 +684,7 @@ static void intel_ddi_mode_set(struct drm_encoder *encoder,
+ 		struct intel_digital_port *intel_dig_port =
+ 			enc_to_dig_port(encoder);
+ 
+-		intel_dp->DP = intel_dig_port->port_reversal |
++		intel_dp->DP = intel_dig_port->saved_port_bits |
+ 			       DDI_BUF_CTL_ENABLE | DDI_BUF_EMP_400MV_0DB_HSW;
+ 		switch (intel_dp->lane_count) {
+ 		case 1:
+@@ -1324,7 +1324,8 @@ static void intel_enable_ddi(struct intel_encoder *intel_encoder)
+ 		 * enabling the port.
+ 		 */
+ 		I915_WRITE(DDI_BUF_CTL(port),
+-			   intel_dig_port->port_reversal | DDI_BUF_CTL_ENABLE);
++			   intel_dig_port->saved_port_bits |
++			   DDI_BUF_CTL_ENABLE);
+ 	} else if (type == INTEL_OUTPUT_EDP) {
+ 		struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
+ 
+@@ -1543,8 +1544,9 @@ void intel_ddi_init(struct drm_device *dev, enum port port)
+ 	intel_encoder->get_hw_state = intel_ddi_get_hw_state;
+ 
+ 	intel_dig_port->port = port;
+-	intel_dig_port->port_reversal = I915_READ(DDI_BUF_CTL(port)) &
+-					DDI_BUF_PORT_REVERSAL;
++	intel_dig_port->saved_port_bits = I915_READ(DDI_BUF_CTL(port)) &
++					  (DDI_BUF_PORT_REVERSAL |
++					   DDI_A_4_LANES);
+ 	if (hdmi_connector)
+ 		intel_dig_port->hdmi.hdmi_reg = DDI_BUF_CTL(port);
+ 	intel_dig_port->dp.output_reg = DDI_BUF_CTL(port);
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index e1f4e6e..eea5982 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4333,7 +4333,8 @@ static void vlv_update_pll(struct intel_crtc *crtc)
+ 
+ static void i9xx_update_pll(struct intel_crtc *crtc,
+ 			    intel_clock_t *reduced_clock,
+-			    int num_connectors)
++			    int num_connectors,
++			    bool needs_tv_clock)
+ {
+ 	struct drm_device *dev = crtc->base.dev;
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -4391,7 +4392,7 @@ static void i9xx_update_pll(struct intel_crtc *crtc,
+ 	if (INTEL_INFO(dev)->gen >= 4)
+ 		dpll |= (6 << PLL_LOAD_PULSE_PHASE_SHIFT);
+ 
+-	if (is_sdvo && intel_pipe_has_type(&crtc->base, INTEL_OUTPUT_TVOUT))
++	if (is_sdvo && needs_tv_clock)
+ 		dpll |= PLL_REF_INPUT_TVCLKINBC;
+ 	else if (intel_pipe_has_type(&crtc->base, INTEL_OUTPUT_TVOUT))
+ 		/* XXX: just matching BIOS for now */
+@@ -4716,7 +4717,8 @@ static int i9xx_crtc_mode_set(struct drm_crtc *crtc,
+ 	else
+ 		i9xx_update_pll(intel_crtc,
+ 				has_reduced_clock ? &reduced_clock : NULL,
+-				num_connectors);
++				num_connectors,
++				is_sdvo && is_tv);
+ 
+ 	/* Set up the display plane register */
+ 	dspcntr = DISPPLANE_GAMMA_ENABLE;
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index 624a9e6..7cd5584 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -426,7 +426,7 @@ struct intel_dp {
+ struct intel_digital_port {
+ 	struct intel_encoder base;
+ 	enum port port;
+-	u32 port_reversal;
++	u32 saved_port_bits;
+ 	struct intel_dp dp;
+ 	struct intel_hdmi hdmi;
+ };
+diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
+index f4dcfdd..aad18e6 100644
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -1145,6 +1145,8 @@ struct radeon_uvd {
+ 	struct radeon_bo	*vcpu_bo;
+ 	void			*cpu_addr;
+ 	uint64_t		gpu_addr;
++	void			*saved_bo;
++	unsigned		fw_size;
+ 	atomic_t		handles[RADEON_MAX_UVD_HANDLES];
+ 	struct drm_file		*filp[RADEON_MAX_UVD_HANDLES];
+ 	struct delayed_work	idle_work;
+@@ -1684,7 +1686,6 @@ struct radeon_device {
+ 	const struct firmware *rlc_fw;	/* r6/700 RLC firmware */
+ 	const struct firmware *mc_fw;	/* NI MC firmware */
+ 	const struct firmware *ce_fw;	/* SI CE firmware */
+-	const struct firmware *uvd_fw;	/* UVD firmware */
+ 	struct r600_blit r600_blit;
+ 	struct r600_vram_scratch vram_scratch;
+ 	int msi_enabled; /* msi enabled */
+diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
+index a2802b47..de36c47 100644
+--- a/drivers/gpu/drm/radeon/radeon_asic.c
++++ b/drivers/gpu/drm/radeon/radeon_asic.c
+@@ -986,8 +986,8 @@ static struct radeon_asic r600_asic = {
+ 		.blit_ring_index = RADEON_RING_TYPE_GFX_INDEX,
+ 		.dma = &r600_copy_dma,
+ 		.dma_ring_index = R600_RING_TYPE_DMA_INDEX,
+-		.copy = &r600_copy_dma,
+-		.copy_ring_index = R600_RING_TYPE_DMA_INDEX,
++		.copy = &r600_copy_blit,
++		.copy_ring_index = RADEON_RING_TYPE_GFX_INDEX,
+ 	},
+ 	.surface = {
+ 		.set_reg = r600_set_surface_reg,
+@@ -1074,8 +1074,8 @@ static struct radeon_asic rs780_asic = {
+ 		.blit_ring_index = RADEON_RING_TYPE_GFX_INDEX,
+ 		.dma = &r600_copy_dma,
+ 		.dma_ring_index = R600_RING_TYPE_DMA_INDEX,
+-		.copy = &r600_copy_dma,
+-		.copy_ring_index = R600_RING_TYPE_DMA_INDEX,
++		.copy = &r600_copy_blit,
++		.copy_ring_index = RADEON_RING_TYPE_GFX_INDEX,
+ 	},
+ 	.surface = {
+ 		.set_reg = r600_set_surface_reg,
+diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
+index ddb8f8e..7ddb0ef 100644
+--- a/drivers/gpu/drm/radeon/radeon_fence.c
++++ b/drivers/gpu/drm/radeon/radeon_fence.c
+@@ -782,7 +782,7 @@ int radeon_fence_driver_start_ring(struct radeon_device *rdev, int ring)
+ 
+ 		} else {
+ 			/* put fence directly behind firmware */
+-			index = ALIGN(rdev->uvd_fw->size, 8);
++			index = ALIGN(rdev->uvd.fw_size, 8);
+ 			rdev->fence_drv[ring].cpu_addr = rdev->uvd.cpu_addr + index;
+ 			rdev->fence_drv[ring].gpu_addr = rdev->uvd.gpu_addr + index;
+ 		}
+diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
+index cad735d..1b3a91b 100644
+--- a/drivers/gpu/drm/radeon/radeon_uvd.c
++++ b/drivers/gpu/drm/radeon/radeon_uvd.c
+@@ -55,6 +55,7 @@ static void radeon_uvd_idle_work_handler(struct work_struct *work);
+ int radeon_uvd_init(struct radeon_device *rdev)
+ {
+ 	struct platform_device *pdev;
++	const struct firmware *fw;
+ 	unsigned long bo_size;
+ 	const char *fw_name;
+ 	int i, r;
+@@ -104,7 +105,7 @@ int radeon_uvd_init(struct radeon_device *rdev)
+ 		return -EINVAL;
+ 	}
+ 
+-	r = request_firmware(&rdev->uvd_fw, fw_name, &pdev->dev);
++	r = request_firmware(&fw, fw_name, &pdev->dev);
+ 	if (r) {
+ 		dev_err(rdev->dev, "radeon_uvd: Can't load firmware \"%s\"\n",
+ 			fw_name);
+@@ -114,7 +115,7 @@ int radeon_uvd_init(struct radeon_device *rdev)
+ 
+ 	platform_device_unregister(pdev);
+ 
+-	bo_size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 8) +
++	bo_size = RADEON_GPU_PAGE_ALIGN(fw->size + 8) +
+ 		  RADEON_UVD_STACK_SIZE + RADEON_UVD_HEAP_SIZE;
+ 	r = radeon_bo_create(rdev, bo_size, PAGE_SIZE, true,
+ 			     RADEON_GEM_DOMAIN_VRAM, NULL, &rdev->uvd.vcpu_bo);
+@@ -123,16 +124,35 @@ int radeon_uvd_init(struct radeon_device *rdev)
+ 		return r;
+ 	}
+ 
+-	r = radeon_uvd_resume(rdev);
+-	if (r)
++	r = radeon_bo_reserve(rdev->uvd.vcpu_bo, false);
++	if (r) {
++		radeon_bo_unref(&rdev->uvd.vcpu_bo);
++		dev_err(rdev->dev, "(%d) failed to reserve UVD bo\n", r);
+ 		return r;
++	}
+ 
+-	memset(rdev->uvd.cpu_addr, 0, bo_size);
+-	memcpy(rdev->uvd.cpu_addr, rdev->uvd_fw->data, rdev->uvd_fw->size);
++	r = radeon_bo_pin(rdev->uvd.vcpu_bo, RADEON_GEM_DOMAIN_VRAM,
++			  &rdev->uvd.gpu_addr);
++	if (r) {
++		radeon_bo_unreserve(rdev->uvd.vcpu_bo);
++		radeon_bo_unref(&rdev->uvd.vcpu_bo);
++		dev_err(rdev->dev, "(%d) UVD bo pin failed\n", r);
++		return r;
++	}
+ 
+-	r = radeon_uvd_suspend(rdev);
+-	if (r)
++	r = radeon_bo_kmap(rdev->uvd.vcpu_bo, &rdev->uvd.cpu_addr);
++	if (r) {
++		dev_err(rdev->dev, "(%d) UVD map failed\n", r);
+ 		return r;
++	}
++
++	radeon_bo_unreserve(rdev->uvd.vcpu_bo);
++
++	rdev->uvd.fw_size = fw->size;
++	memset(rdev->uvd.cpu_addr, 0, bo_size);
++	memcpy(rdev->uvd.cpu_addr, fw->data, fw->size);
++
++	release_firmware(fw);
+ 
+ 	for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
+ 		atomic_set(&rdev->uvd.handles[i], 0);
+@@ -144,71 +164,47 @@ int radeon_uvd_init(struct radeon_device *rdev)
+ 
+ void radeon_uvd_fini(struct radeon_device *rdev)
+ {
+-	radeon_uvd_suspend(rdev);
+-	radeon_bo_unref(&rdev->uvd.vcpu_bo);
+-}
+-
+-int radeon_uvd_suspend(struct radeon_device *rdev)
+-{
+ 	int r;
+ 
+ 	if (rdev->uvd.vcpu_bo == NULL)
+-		return 0;
++		return;
+ 
+ 	r = radeon_bo_reserve(rdev->uvd.vcpu_bo, false);
+ 	if (!r) {
+ 		radeon_bo_kunmap(rdev->uvd.vcpu_bo);
+ 		radeon_bo_unpin(rdev->uvd.vcpu_bo);
+-		rdev->uvd.cpu_addr = NULL;
+-		if (!radeon_bo_pin(rdev->uvd.vcpu_bo, RADEON_GEM_DOMAIN_CPU, NULL)) {
+-			radeon_bo_kmap(rdev->uvd.vcpu_bo, &rdev->uvd.cpu_addr);
+-		}
+ 		radeon_bo_unreserve(rdev->uvd.vcpu_bo);
+-
+-		if (rdev->uvd.cpu_addr) {
+-			radeon_fence_driver_start_ring(rdev, R600_RING_TYPE_UVD_INDEX);
+-		} else {
+-			rdev->fence_drv[R600_RING_TYPE_UVD_INDEX].cpu_addr = NULL;
+-		}
+ 	}
+-	return r;
++
++	radeon_bo_unref(&rdev->uvd.vcpu_bo);
+ }
+ 
+-int radeon_uvd_resume(struct radeon_device *rdev)
++int radeon_uvd_suspend(struct radeon_device *rdev)
+ {
+-	int r;
++	unsigned size;
+ 
+ 	if (rdev->uvd.vcpu_bo == NULL)
+-		return -EINVAL;
++		return 0;
+ 
+-	r = radeon_bo_reserve(rdev->uvd.vcpu_bo, false);
+-	if (r) {
+-		radeon_bo_unref(&rdev->uvd.vcpu_bo);
+-		dev_err(rdev->dev, "(%d) failed to reserve UVD bo\n", r);
+-		return r;
+-	}
++	size = radeon_bo_size(rdev->uvd.vcpu_bo);
++	rdev->uvd.saved_bo = kmalloc(size, GFP_KERNEL);
++	memcpy(rdev->uvd.saved_bo, rdev->uvd.cpu_addr, size);
+ 
+-	/* Have been pin in cpu unmap unpin */
+-	radeon_bo_kunmap(rdev->uvd.vcpu_bo);
+-	radeon_bo_unpin(rdev->uvd.vcpu_bo);
++	return 0;
++}
+ 
+-	r = radeon_bo_pin(rdev->uvd.vcpu_bo, RADEON_GEM_DOMAIN_VRAM,
+-			  &rdev->uvd.gpu_addr);
+-	if (r) {
+-		radeon_bo_unreserve(rdev->uvd.vcpu_bo);
+-		radeon_bo_unref(&rdev->uvd.vcpu_bo);
+-		dev_err(rdev->dev, "(%d) UVD bo pin failed\n", r);
+-		return r;
+-	}
++int radeon_uvd_resume(struct radeon_device *rdev)
++{
++	if (rdev->uvd.vcpu_bo == NULL)
++		return -EINVAL;
+ 
+-	r = radeon_bo_kmap(rdev->uvd.vcpu_bo, &rdev->uvd.cpu_addr);
+-	if (r) {
+-		dev_err(rdev->dev, "(%d) UVD map failed\n", r);
+-		return r;
++	if (rdev->uvd.saved_bo != NULL) {
++		unsigned size = radeon_bo_size(rdev->uvd.vcpu_bo);
++		memcpy(rdev->uvd.cpu_addr, rdev->uvd.saved_bo, size);
++		kfree(rdev->uvd.saved_bo);
++		rdev->uvd.saved_bo = NULL;
+ 	}
+ 
+-	radeon_bo_unreserve(rdev->uvd.vcpu_bo);
+-
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
+index 4a62ad2..30ea14e 100644
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -813,7 +813,7 @@ int rv770_uvd_resume(struct radeon_device *rdev)
+ 
+ 	/* programm the VCPU memory controller bits 0-27 */
+ 	addr = rdev->uvd.gpu_addr >> 3;
+-	size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 4) >> 3;
++	size = RADEON_GPU_PAGE_ALIGN(rdev->uvd.fw_size + 4) >> 3;
+ 	WREG32(UVD_VCPU_CACHE_OFFSET0, addr);
+ 	WREG32(UVD_VCPU_CACHE_SIZE0, size);
+ 
+diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c
+index 328fb03..a41b5f3 100644
+--- a/drivers/hwmon/max6697.c
++++ b/drivers/hwmon/max6697.c
+@@ -605,12 +605,12 @@ static int max6697_init_chip(struct i2c_client *client)
+ 		if (ret < 0)
+ 			return ret;
+ 		ret = i2c_smbus_write_byte_data(client, MAX6581_REG_IDEALITY,
+-						pdata->ideality_mask >> 1);
++						pdata->ideality_value);
+ 		if (ret < 0)
+ 			return ret;
+ 		ret = i2c_smbus_write_byte_data(client,
+ 						MAX6581_REG_IDEALITY_SELECT,
+-						pdata->ideality_value);
++						pdata->ideality_mask >> 1);
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+diff --git a/drivers/macintosh/windfarm_rm31.c b/drivers/macintosh/windfarm_rm31.c
+index 0b9a79b..82fc86a 100644
+--- a/drivers/macintosh/windfarm_rm31.c
++++ b/drivers/macintosh/windfarm_rm31.c
+@@ -439,15 +439,15 @@ static void backside_setup_pid(void)
+ 
+ /* Slots fan */
+ static const struct wf_pid_param slots_param = {
+-	.interval	= 5,
+-	.history_len	= 2,
+-	.gd		= 30 << 20,
+-	.gp		= 5 << 20,
+-	.gr		= 0,
+-	.itarget	= 40 << 16,
+-	.additive	= 1,
+-	.min		= 300,
+-	.max		= 4000,
++	.interval	= 1,
++	.history_len	= 20,
++	.gd		= 0,
++	.gp		= 0,
++	.gr		= 0x00100000,
++	.itarget	= 3200000,
++	.additive	= 0,
++	.min		= 20,
++	.max		= 100,
+ };
+ 
+ static void slots_fan_tick(void)
+diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
+index a746ba2..a956053 100644
+--- a/drivers/net/arcnet/arcnet.c
++++ b/drivers/net/arcnet/arcnet.c
+@@ -1007,7 +1007,7 @@ static void arcnet_rx(struct net_device *dev, int bufnum)
+ 
+ 	soft = &pkt.soft.rfc1201;
+ 
+-	lp->hw.copy_from_card(dev, bufnum, 0, &pkt, sizeof(ARC_HDR_SIZE));
++	lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE);
+ 	if (pkt.hard.offset[0]) {
+ 		ofs = pkt.hard.offset[0];
+ 		length = 256 - ofs;
+diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c.h b/drivers/net/ethernet/atheros/atl1c/atl1c.h
+index b2bf324..0f05565 100644
+--- a/drivers/net/ethernet/atheros/atl1c/atl1c.h
++++ b/drivers/net/ethernet/atheros/atl1c/atl1c.h
+@@ -520,6 +520,9 @@ struct atl1c_adapter {
+ 	struct net_device   *netdev;
+ 	struct pci_dev      *pdev;
+ 	struct napi_struct  napi;
++	struct page         *rx_page;
++	unsigned int	    rx_page_offset;
++	unsigned int	    rx_frag_size;
+ 	struct atl1c_hw        hw;
+ 	struct atl1c_hw_stats  hw_stats;
+ 	struct mii_if_info  mii;    /* MII interface info */
+diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+index 0ba9007..11cdf1d 100644
+--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
++++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+@@ -481,10 +481,15 @@ static int atl1c_set_mac_addr(struct net_device *netdev, void *p)
+ static void atl1c_set_rxbufsize(struct atl1c_adapter *adapter,
+ 				struct net_device *dev)
+ {
++	unsigned int head_size;
+ 	int mtu = dev->mtu;
+ 
+ 	adapter->rx_buffer_len = mtu > AT_RX_BUF_SIZE ?
+ 		roundup(mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN, 8) : AT_RX_BUF_SIZE;
++
++	head_size = SKB_DATA_ALIGN(adapter->rx_buffer_len + NET_SKB_PAD) +
++		    SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
++	adapter->rx_frag_size = roundup_pow_of_two(head_size);
+ }
+ 
+ static netdev_features_t atl1c_fix_features(struct net_device *netdev,
+@@ -952,6 +957,10 @@ static void atl1c_free_ring_resources(struct atl1c_adapter *adapter)
+ 		kfree(adapter->tpd_ring[0].buffer_info);
+ 		adapter->tpd_ring[0].buffer_info = NULL;
+ 	}
++	if (adapter->rx_page) {
++		put_page(adapter->rx_page);
++		adapter->rx_page = NULL;
++	}
+ }
+ 
+ /**
+@@ -1639,6 +1648,35 @@ static inline void atl1c_rx_checksum(struct atl1c_adapter *adapter,
+ 	skb_checksum_none_assert(skb);
+ }
+ 
++static struct sk_buff *atl1c_alloc_skb(struct atl1c_adapter *adapter)
++{
++	struct sk_buff *skb;
++	struct page *page;
++
++	if (adapter->rx_frag_size > PAGE_SIZE)
++		return netdev_alloc_skb(adapter->netdev,
++					adapter->rx_buffer_len);
++
++	page = adapter->rx_page;
++	if (!page) {
++		adapter->rx_page = page = alloc_page(GFP_ATOMIC);
++		if (unlikely(!page))
++			return NULL;
++		adapter->rx_page_offset = 0;
++	}
++
++	skb = build_skb(page_address(page) + adapter->rx_page_offset,
++			adapter->rx_frag_size);
++	if (likely(skb)) {
++		adapter->rx_page_offset += adapter->rx_frag_size;
++		if (adapter->rx_page_offset >= PAGE_SIZE)
++			adapter->rx_page = NULL;
++		else
++			get_page(page);
++	}
++	return skb;
++}
++
+ static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
+ {
+ 	struct atl1c_rfd_ring *rfd_ring = &adapter->rfd_ring;
+@@ -1660,7 +1698,7 @@ static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
+ 	while (next_info->flags & ATL1C_BUFFER_FREE) {
+ 		rfd_desc = ATL1C_RFD_DESC(rfd_ring, rfd_next_to_use);
+ 
+-		skb = netdev_alloc_skb(adapter->netdev, adapter->rx_buffer_len);
++		skb = atl1c_alloc_skb(adapter);
+ 		if (unlikely(!skb)) {
+ 			if (netif_msg_rx_err(adapter))
+ 				dev_warn(&pdev->dev, "alloc rx buffer failed\n");
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
+index ac78077..7a77f37 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
+@@ -108,9 +108,8 @@ s32 ixgbe_dcb_config_tx_desc_arbiter_82598(struct ixgbe_hw *hw,
+ 
+ 	/* Enable arbiter */
+ 	reg &= ~IXGBE_DPMCS_ARBDIS;
+-	/* Enable DFP and Recycle mode */
+-	reg |= (IXGBE_DPMCS_TDPAC | IXGBE_DPMCS_TRM);
+ 	reg |= IXGBE_DPMCS_TSOEF;
++
+ 	/* Configure Max TSO packet size 34KB including payload and headers */
+ 	reg |= (0x4 << IXGBE_DPMCS_MTSOS_SHIFT);
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
+index 2c97901..593177d 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
+@@ -840,16 +840,7 @@ int mlx4_QUERY_PORT_wrapper(struct mlx4_dev *dev, int slave,
+ 			   MLX4_CMD_NATIVE);
+ 
+ 	if (!err && dev->caps.function != slave) {
+-		/* if config MAC in DB use it */
+-		if (priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac)
+-			def_mac = priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac;
+-		else {
+-			/* set slave default_mac address */
+-			MLX4_GET(def_mac, outbox->buf, QUERY_PORT_MAC_OFFSET);
+-			def_mac += slave << 8;
+-			priv->mfunc.master.vf_admin[slave].vport[vhcr->in_modifier].mac = def_mac;
+-		}
+-
++		def_mac = priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac;
+ 		MLX4_PUT(outbox->buf, def_mac, QUERY_PORT_MAC_OFFSET);
+ 
+ 		/* get port type - currently only eth is enabled */
+diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
+index 8a43499..1b195fc 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -371,7 +371,7 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
+ 
+ 	dev->caps.sqp_demux = (mlx4_is_master(dev)) ? MLX4_MAX_NUM_SLAVES : 0;
+ 
+-	if (!enable_64b_cqe_eqe) {
++	if (!enable_64b_cqe_eqe && !mlx4_is_slave(dev)) {
+ 		if (dev_cap->flags &
+ 		    (MLX4_DEV_CAP_FLAG_64B_CQE | MLX4_DEV_CAP_FLAG_64B_EQE)) {
+ 			mlx4_warn(dev, "64B EQEs/CQEs supported by the device but not enabled\n");
+diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
+index 0352345..887aebe 100644
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -478,7 +478,7 @@ rx_status_loop:
+ 
+ 	while (1) {
+ 		u32 status, len;
+-		dma_addr_t mapping;
++		dma_addr_t mapping, new_mapping;
+ 		struct sk_buff *skb, *new_skb;
+ 		struct cp_desc *desc;
+ 		const unsigned buflen = cp->rx_buf_sz;
+@@ -520,6 +520,13 @@ rx_status_loop:
+ 			goto rx_next;
+ 		}
+ 
++		new_mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
++					 PCI_DMA_FROMDEVICE);
++		if (dma_mapping_error(&cp->pdev->dev, new_mapping)) {
++			dev->stats.rx_dropped++;
++			goto rx_next;
++		}
++
+ 		dma_unmap_single(&cp->pdev->dev, mapping,
+ 				 buflen, PCI_DMA_FROMDEVICE);
+ 
+@@ -531,12 +538,11 @@ rx_status_loop:
+ 
+ 		skb_put(skb, len);
+ 
+-		mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
+-					 PCI_DMA_FROMDEVICE);
+ 		cp->rx_skb[rx_tail] = new_skb;
+ 
+ 		cp_rx_skb(cp, skb, desc);
+ 		rx++;
++		mapping = new_mapping;
+ 
+ rx_next:
+ 		cp->rx_ring[rx_tail].opts2 = 0;
+@@ -716,6 +722,22 @@ static inline u32 cp_tx_vlan_tag(struct sk_buff *skb)
+ 		TxVlanTag | swab16(vlan_tx_tag_get(skb)) : 0x00;
+ }
+ 
++static void unwind_tx_frag_mapping(struct cp_private *cp, struct sk_buff *skb,
++				   int first, int entry_last)
++{
++	int frag, index;
++	struct cp_desc *txd;
++	skb_frag_t *this_frag;
++	for (frag = 0; frag+first < entry_last; frag++) {
++		index = first+frag;
++		cp->tx_skb[index] = NULL;
++		txd = &cp->tx_ring[index];
++		this_frag = &skb_shinfo(skb)->frags[frag];
++		dma_unmap_single(&cp->pdev->dev, le64_to_cpu(txd->addr),
++				 skb_frag_size(this_frag), PCI_DMA_TODEVICE);
++	}
++}
++
+ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ 					struct net_device *dev)
+ {
+@@ -749,6 +771,9 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ 
+ 		len = skb->len;
+ 		mapping = dma_map_single(&cp->pdev->dev, skb->data, len, PCI_DMA_TODEVICE);
++		if (dma_mapping_error(&cp->pdev->dev, mapping))
++			goto out_dma_error;
++
+ 		txd->opts2 = opts2;
+ 		txd->addr = cpu_to_le64(mapping);
+ 		wmb();
+@@ -786,6 +811,9 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ 		first_len = skb_headlen(skb);
+ 		first_mapping = dma_map_single(&cp->pdev->dev, skb->data,
+ 					       first_len, PCI_DMA_TODEVICE);
++		if (dma_mapping_error(&cp->pdev->dev, first_mapping))
++			goto out_dma_error;
++
+ 		cp->tx_skb[entry] = skb;
+ 		entry = NEXT_TX(entry);
+ 
+@@ -799,6 +827,11 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ 			mapping = dma_map_single(&cp->pdev->dev,
+ 						 skb_frag_address(this_frag),
+ 						 len, PCI_DMA_TODEVICE);
++			if (dma_mapping_error(&cp->pdev->dev, mapping)) {
++				unwind_tx_frag_mapping(cp, skb, first_entry, entry);
++				goto out_dma_error;
++			}
++
+ 			eor = (entry == (CP_TX_RING_SIZE - 1)) ? RingEnd : 0;
+ 
+ 			ctrl = eor | len | DescOwn;
+@@ -859,11 +892,16 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ 	if (TX_BUFFS_AVAIL(cp) <= (MAX_SKB_FRAGS + 1))
+ 		netif_stop_queue(dev);
+ 
++out_unlock:
+ 	spin_unlock_irqrestore(&cp->lock, intr_flags);
+ 
+ 	cpw8(TxPoll, NormalTxPoll);
+ 
+ 	return NETDEV_TX_OK;
++out_dma_error:
++	kfree_skb(skb);
++	cp->dev->stats.tx_dropped++;
++	goto out_unlock;
+ }
+ 
+ /* Set or clear the multicast filter for this adaptor.
+@@ -1054,6 +1092,10 @@ static int cp_refill_rx(struct cp_private *cp)
+ 
+ 		mapping = dma_map_single(&cp->pdev->dev, skb->data,
+ 					 cp->rx_buf_sz, PCI_DMA_FROMDEVICE);
++		if (dma_mapping_error(&cp->pdev->dev, mapping)) {
++			kfree_skb(skb);
++			goto err_out;
++		}
+ 		cp->rx_skb[i] = skb;
+ 
+ 		cp->rx_ring[i].opts2 = 0;
+diff --git a/drivers/net/ethernet/sfc/filter.c b/drivers/net/ethernet/sfc/filter.c
+index 2397f0e..2738b5f 100644
+--- a/drivers/net/ethernet/sfc/filter.c
++++ b/drivers/net/ethernet/sfc/filter.c
+@@ -1196,7 +1196,9 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
+ 	EFX_BUG_ON_PARANOID(skb_headlen(skb) < nhoff + 4 * ip->ihl + 4);
+ 	ports = (const __be16 *)(skb->data + nhoff + 4 * ip->ihl);
+ 
+-	efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT, 0, rxq_index);
++	efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT,
++			   efx->rx_scatter ? EFX_FILTER_FLAG_RX_SCATTER : 0,
++			   rxq_index);
+ 	rc = efx_filter_set_ipv4_full(&spec, ip->protocol,
+ 				      ip->daddr, ports[1], ip->saddr, ports[0]);
+ 	if (rc)
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index bd8758f..cea1f3d 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1029,10 +1029,10 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
+ 	dev->mii.supports_gmii = 1;
+ 
+ 	dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+-			      NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
++			      NETIF_F_RXCSUM;
+ 
+ 	dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+-				 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
++				 NETIF_F_RXCSUM;
+ 
+ 	/* Enable checksum offload */
+ 	*tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+@@ -1173,7 +1173,6 @@ ax88179_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
+ 	if (((skb->len + 8) % frame_size) == 0)
+ 		tx_hdr2 |= 0x80008000;	/* Enable padding */
+ 
+-	skb_linearize(skb);
+ 	headroom = skb_headroom(skb);
+ 	tailroom = skb_tailroom(skb);
+ 
+@@ -1317,10 +1316,10 @@ static int ax88179_reset(struct usbnet *dev)
+ 			  1, 1, tmp);
+ 
+ 	dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+-			      NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
++			      NETIF_F_RXCSUM;
+ 
+ 	dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+-				 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
++				 NETIF_F_RXCSUM;
+ 
+ 	/* Enable checksum offload */
+ 	*tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index 7540974..66ebbac 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -45,7 +45,6 @@
+ #define EEPROM_MAC_OFFSET		(0x01)
+ #define DEFAULT_TX_CSUM_ENABLE		(true)
+ #define DEFAULT_RX_CSUM_ENABLE		(true)
+-#define DEFAULT_TSO_ENABLE		(true)
+ #define SMSC75XX_INTERNAL_PHY_ID	(1)
+ #define SMSC75XX_TX_OVERHEAD		(8)
+ #define MAX_RX_FIFO_SIZE		(20 * 1024)
+@@ -1410,17 +1409,14 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
+ 
+ 	INIT_WORK(&pdata->set_multicast, smsc75xx_deferred_multicast_write);
+ 
+-	if (DEFAULT_TX_CSUM_ENABLE) {
++	if (DEFAULT_TX_CSUM_ENABLE)
+ 		dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+-		if (DEFAULT_TSO_ENABLE)
+-			dev->net->features |= NETIF_F_SG |
+-				NETIF_F_TSO | NETIF_F_TSO6;
+-	}
++
+ 	if (DEFAULT_RX_CSUM_ENABLE)
+ 		dev->net->features |= NETIF_F_RXCSUM;
+ 
+ 	dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+-		NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_RXCSUM;
++				NETIF_F_RXCSUM;
+ 
+ 	ret = smsc75xx_wait_ready(dev, 0);
+ 	if (ret < 0) {
+@@ -2200,8 +2196,6 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
+ {
+ 	u32 tx_cmd_a, tx_cmd_b;
+ 
+-	skb_linearize(skb);
+-
+ 	if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
+ 		struct sk_buff *skb2 =
+ 			skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index f5dda84..75a6376 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -1289,7 +1289,9 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
+ 
+ 	usb_set_intfdata(interface, NULL);
+ 
+-	if (!unplugged && (hif_dev->flags & HIF_USB_START))
++	/* If firmware was loaded we should drop it
++	 * go back to first stage bootloader. */
++	if (!unplugged && (hif_dev->flags & HIF_USB_READY))
+ 		ath9k_hif_usb_reboot(udev);
+ 
+ 	kfree(hif_dev);
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index a47f5e0..3b202ff 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -846,6 +846,7 @@ static int ath9k_init_device(struct ath9k_htc_priv *priv,
+ 	if (error != 0)
+ 		goto err_rx;
+ 
++	ath9k_hw_disable(priv->ah);
+ #ifdef CONFIG_MAC80211_LEDS
+ 	/* must be initialized before ieee80211_register_hw */
+ 	priv->led_cdev.default_trigger = ieee80211_create_tpt_led_trigger(priv->hw,
+diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
+index 727b1f5..d57e5be 100644
+--- a/drivers/net/wireless/ath/wil6210/debugfs.c
++++ b/drivers/net/wireless/ath/wil6210/debugfs.c
+@@ -145,7 +145,7 @@ static void wil_print_ring(struct seq_file *s, const char *prefix,
+ 				   le16_to_cpu(hdr.type), hdr.flags);
+ 			if (len <= MAX_MBOXITEM_SIZE) {
+ 				int n = 0;
+-				unsigned char printbuf[16 * 3 + 2];
++				char printbuf[16 * 3 + 2];
+ 				unsigned char databuf[MAX_MBOXITEM_SIZE];
+ 				void __iomem *src = wmi_buffer(wil, d.addr) +
+ 					sizeof(struct wil6210_mbox_hdr);
+@@ -416,7 +416,7 @@ static int wil_txdesc_debugfs_show(struct seq_file *s, void *data)
+ 		seq_printf(s, "  SKB = %p\n", skb);
+ 
+ 		if (skb) {
+-			unsigned char printbuf[16 * 3 + 2];
++			char printbuf[16 * 3 + 2];
+ 			int i = 0;
+ 			int len = skb_headlen(skb);
+ 			void *p = skb->data;
+diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
+index 74d7572..a8afc7b 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/main.c
++++ b/drivers/net/wireless/iwlwifi/dvm/main.c
+@@ -758,7 +758,7 @@ int iwl_alive_start(struct iwl_priv *priv)
+ 					 BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
+ 		if (ret)
+ 			return ret;
+-	} else {
++	} else if (priv->cfg->bt_params) {
+ 		/*
+ 		 * default is 2-wire BT coexexistence support
+ 		 */
+diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+index b60d141..365095a 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
++++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+@@ -69,7 +69,6 @@
+ /* Scan Commands, Responses, Notifications */
+ 
+ /* Masks for iwl_scan_channel.type flags */
+-#define SCAN_CHANNEL_TYPE_PASSIVE	0
+ #define SCAN_CHANNEL_TYPE_ACTIVE	BIT(0)
+ #define SCAN_CHANNEL_NARROW_BAND	BIT(22)
+ 
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index a5eb8c8..b7e95b0 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -987,6 +987,21 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
+ 	mutex_lock(&mvm->mutex);
+ 	if (old_state == IEEE80211_STA_NOTEXIST &&
+ 	    new_state == IEEE80211_STA_NONE) {
++		/*
++		 * Firmware bug - it'll crash if the beacon interval is less
++		 * than 16. We can't avoid connecting at all, so refuse the
++		 * station state change, this will cause mac80211 to abandon
++		 * attempts to connect to this AP, and eventually wpa_s will
++		 * blacklist the AP...
++		 */
++		if (vif->type == NL80211_IFTYPE_STATION &&
++		    vif->bss_conf.beacon_int < 16) {
++			IWL_ERR(mvm,
++				"AP %pM beacon interval is %d, refusing due to firmware bug!\n",
++				sta->addr, vif->bss_conf.beacon_int);
++			ret = -EINVAL;
++			goto out_unlock;
++		}
+ 		ret = iwl_mvm_add_sta(mvm, vif, sta);
+ 	} else if (old_state == IEEE80211_STA_NONE &&
+ 		   new_state == IEEE80211_STA_AUTH) {
+@@ -1015,6 +1030,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
+ 	} else {
+ 		ret = -EIO;
+ 	}
++ out_unlock:
+ 	mutex_unlock(&mvm->mutex);
+ 
+ 	return ret;
+diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
+index 2476e43..8e1f6c0 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
++++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
+@@ -137,8 +137,8 @@ static void iwl_mvm_scan_fill_ssids(struct iwl_scan_cmd *cmd,
+ {
+ 	int fw_idx, req_idx;
+ 
+-	fw_idx = 0;
+-	for (req_idx = req->n_ssids - 1; req_idx > 0; req_idx--) {
++	for (req_idx = req->n_ssids - 1, fw_idx = 0; req_idx > 0;
++	     req_idx--, fw_idx++) {
+ 		cmd->direct_scan[fw_idx].id = WLAN_EID_SSID;
+ 		cmd->direct_scan[fw_idx].len = req->ssids[req_idx].ssid_len;
+ 		memcpy(cmd->direct_scan[fw_idx].ssid,
+@@ -176,19 +176,12 @@ static void iwl_mvm_scan_fill_channels(struct iwl_scan_cmd *cmd,
+ 	struct iwl_scan_channel *chan = (struct iwl_scan_channel *)
+ 		(cmd->data + le16_to_cpu(cmd->tx_cmd.len));
+ 	int i;
+-	__le32 chan_type_value;
+-
+-	if (req->n_ssids > 0)
+-		chan_type_value = cpu_to_le32(BIT(req->n_ssids + 1) - 1);
+-	else
+-		chan_type_value = SCAN_CHANNEL_TYPE_PASSIVE;
+ 
+ 	for (i = 0; i < cmd->channel_count; i++) {
+ 		chan->channel = cpu_to_le16(req->channels[i]->hw_value);
++		chan->type = cpu_to_le32(BIT(req->n_ssids) - 1);
+ 		if (req->channels[i]->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+-			chan->type = SCAN_CHANNEL_TYPE_PASSIVE;
+-		else
+-			chan->type = chan_type_value;
++			chan->type &= cpu_to_le32(~SCAN_CHANNEL_TYPE_ACTIVE);
+ 		chan->active_dwell = cpu_to_le16(active_dwell);
+ 		chan->passive_dwell = cpu_to_le16(passive_dwell);
+ 		chan->iteration_count = cpu_to_le16(1);
+diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
+index 5c664ed..736b50b 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
+@@ -621,8 +621,12 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ 	cmd.mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color);
+ 	cmd.sta_id = mvm_sta->sta_id;
+ 	cmd.add_modify = STA_MODE_MODIFY;
+-	cmd.add_immediate_ba_tid = (u8) tid;
+-	cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
++	if (start) {
++		cmd.add_immediate_ba_tid = (u8) tid;
++		cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
++	} else {
++		cmd.remove_immediate_ba_tid = (u8) tid;
++	}
+ 	cmd.modify_mask = start ? STA_MODIFY_ADD_BA_TID :
+ 				  STA_MODIFY_REMOVE_BA_TID;
+ 
+@@ -894,6 +898,7 @@ int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ 	struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
+ 	struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
+ 	u16 txq_id;
++	enum iwl_mvm_agg_state old_state;
+ 
+ 	/*
+ 	 * First set the agg state to OFF to avoid calling
+@@ -903,13 +908,17 @@ int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ 	txq_id = tid_data->txq_id;
+ 	IWL_DEBUG_TX_QUEUES(mvm, "Flush AGG: sta %d tid %d q %d state %d\n",
+ 			    mvmsta->sta_id, tid, txq_id, tid_data->state);
++	old_state = tid_data->state;
+ 	tid_data->state = IWL_AGG_OFF;
+ 	spin_unlock_bh(&mvmsta->lock);
+ 
+-	if (iwl_mvm_flush_tx_path(mvm, BIT(txq_id), true))
+-		IWL_ERR(mvm, "Couldn't flush the AGG queue\n");
++	if (old_state >= IWL_AGG_ON) {
++		if (iwl_mvm_flush_tx_path(mvm, BIT(txq_id), true))
++			IWL_ERR(mvm, "Couldn't flush the AGG queue\n");
++
++		iwl_trans_txq_disable(mvm->trans, tid_data->txq_id);
++	}
+ 
+-	iwl_trans_txq_disable(mvm->trans, tid_data->txq_id);
+ 	mvm->queue_to_mac80211[tid_data->txq_id] =
+ 				IWL_INVALID_MAC80211_QUEUE;
+ 
+diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
+index 8cb53ec..5283b55 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
+@@ -129,6 +129,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
+ 	{IWL_PCI_DEVICE(0x423C, 0x1306, iwl5150_abg_cfg)}, /* Half Mini Card */
+ 	{IWL_PCI_DEVICE(0x423C, 0x1221, iwl5150_agn_cfg)}, /* Mini Card */
+ 	{IWL_PCI_DEVICE(0x423C, 0x1321, iwl5150_agn_cfg)}, /* Half Mini Card */
++	{IWL_PCI_DEVICE(0x423C, 0x1326, iwl5150_abg_cfg)}, /* Half Mini Card */
+ 
+ 	{IWL_PCI_DEVICE(0x423D, 0x1211, iwl5150_agn_cfg)}, /* Mini Card */
+ 	{IWL_PCI_DEVICE(0x423D, 0x1311, iwl5150_agn_cfg)}, /* Half Mini Card */
+diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
+index e42b266..e7f7cdf 100644
+--- a/drivers/net/wireless/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/mwifiex/cfg80211.c
+@@ -1668,9 +1668,9 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
+ 	struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+ 	int ret;
+ 
+-	if (priv->bss_mode != NL80211_IFTYPE_STATION) {
++	if (GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA) {
+ 		wiphy_err(wiphy,
+-			  "%s: reject infra assoc request in non-STA mode\n",
++			  "%s: reject infra assoc request in non-STA role\n",
+ 			  dev->name);
+ 		return -EINVAL;
+ 	}
+diff --git a/drivers/net/wireless/mwifiex/cfp.c b/drivers/net/wireless/mwifiex/cfp.c
+index 988552d..5178c46 100644
+--- a/drivers/net/wireless/mwifiex/cfp.c
++++ b/drivers/net/wireless/mwifiex/cfp.c
+@@ -415,7 +415,8 @@ u32 mwifiex_get_supported_rates(struct mwifiex_private *priv, u8 *rates)
+ 	u32 k = 0;
+ 	struct mwifiex_adapter *adapter = priv->adapter;
+ 
+-	if (priv->bss_mode == NL80211_IFTYPE_STATION) {
++	if (priv->bss_mode == NL80211_IFTYPE_STATION ||
++	    priv->bss_mode == NL80211_IFTYPE_P2P_CLIENT) {
+ 		switch (adapter->config_bands) {
+ 		case BAND_B:
+ 			dev_dbg(adapter->dev, "info: infra band=%d "
+diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
+index 6bcb66e..96bda6c 100644
+--- a/drivers/net/wireless/mwifiex/join.c
++++ b/drivers/net/wireless/mwifiex/join.c
+@@ -1290,8 +1290,10 @@ int mwifiex_associate(struct mwifiex_private *priv,
+ {
+ 	u8 current_bssid[ETH_ALEN];
+ 
+-	/* Return error if the adapter or table entry is not marked as infra */
+-	if ((priv->bss_mode != NL80211_IFTYPE_STATION) ||
++	/* Return error if the adapter is not STA role or table entry
++	 * is not marked as infra.
++	 */
++	if ((GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA) ||
+ 	    (bss_desc->bss_mode != NL80211_IFTYPE_STATION))
+ 		return -1;
+ 
+diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
+index 363ba31..139c958 100644
+--- a/drivers/net/wireless/mwifiex/sdio.c
++++ b/drivers/net/wireless/mwifiex/sdio.c
+@@ -1441,8 +1441,8 @@ static int mwifiex_sdio_host_to_card(struct mwifiex_adapter *adapter,
+ 	/* Allocate buffer and copy payload */
+ 	blk_size = MWIFIEX_SDIO_BLOCK_SIZE;
+ 	buf_block_len = (pkt_len + blk_size - 1) / blk_size;
+-	*(u16 *) &payload[0] = (u16) pkt_len;
+-	*(u16 *) &payload[2] = type;
++	*(__le16 *)&payload[0] = cpu_to_le16((u16)pkt_len);
++	*(__le16 *)&payload[2] = cpu_to_le16(type);
+ 
+ 	/*
+ 	 * This is SDIO specific header
+diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
+index 2c12311..d955741 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
+@@ -936,13 +936,8 @@ void rt2x00queue_index_inc(struct queue_entry *entry, enum queue_index index)
+ 	spin_unlock_irqrestore(&queue->index_lock, irqflags);
+ }
+ 
+-void rt2x00queue_pause_queue(struct data_queue *queue)
++void rt2x00queue_pause_queue_nocheck(struct data_queue *queue)
+ {
+-	if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
+-	    !test_bit(QUEUE_STARTED, &queue->flags) ||
+-	    test_and_set_bit(QUEUE_PAUSED, &queue->flags))
+-		return;
+-
+ 	switch (queue->qid) {
+ 	case QID_AC_VO:
+ 	case QID_AC_VI:
+@@ -958,6 +953,15 @@ void rt2x00queue_pause_queue(struct data_queue *queue)
+ 		break;
+ 	}
+ }
++void rt2x00queue_pause_queue(struct data_queue *queue)
++{
++	if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
++	    !test_bit(QUEUE_STARTED, &queue->flags) ||
++	    test_and_set_bit(QUEUE_PAUSED, &queue->flags))
++		return;
++
++	rt2x00queue_pause_queue_nocheck(queue);
++}
+ EXPORT_SYMBOL_GPL(rt2x00queue_pause_queue);
+ 
+ void rt2x00queue_unpause_queue(struct data_queue *queue)
+@@ -1019,7 +1023,7 @@ void rt2x00queue_stop_queue(struct data_queue *queue)
+ 		return;
+ 	}
+ 
+-	rt2x00queue_pause_queue(queue);
++	rt2x00queue_pause_queue_nocheck(queue);
+ 
+ 	queue->rt2x00dev->ops->lib->stop_queue(queue);
+ 
+diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
+index e79e006..9ee04b4 100644
+--- a/drivers/parisc/iosapic.c
++++ b/drivers/parisc/iosapic.c
+@@ -811,18 +811,28 @@ int iosapic_fixup_irq(void *isi_obj, struct pci_dev *pcidev)
+ 	return pcidev->irq;
+ }
+ 
+-static struct iosapic_info *first_isi = NULL;
++static struct iosapic_info *iosapic_list;
+ 
+ #ifdef CONFIG_64BIT
+-int iosapic_serial_irq(int num)
++int iosapic_serial_irq(struct parisc_device *dev)
+ {
+-	struct iosapic_info *isi = first_isi;
+-	struct irt_entry *irte = NULL;  /* only used if PAT PDC */
++	struct iosapic_info *isi;
++	struct irt_entry *irte;
+ 	struct vector_info *vi;
+-	int isi_line;	/* line used by device */
++	int cnt;
++	int intin;
++
++	intin = (dev->mod_info >> 24) & 15;
+ 
+ 	/* lookup IRT entry for isi/slot/pin set */
+-	irte = &irt_cell[num];
++	for (cnt = 0; cnt < irt_num_entry; cnt++) {
++		irte = &irt_cell[cnt];
++		if (COMPARE_IRTE_ADDR(irte, dev->mod0) &&
++		    irte->dest_iosapic_intin == intin)
++			break;
++	}
++	if (cnt >= irt_num_entry)
++		return 0; /* no irq found, force polling */
+ 
+ 	DBG_IRT("iosapic_serial_irq(): irte %p %x %x %x %x %x %x %x %x\n",
+ 		irte,
+@@ -834,11 +844,17 @@ int iosapic_serial_irq(int num)
+ 		irte->src_seg_id,
+ 		irte->dest_iosapic_intin,
+ 		(u32) irte->dest_iosapic_addr);
+-	isi_line = irte->dest_iosapic_intin;
++
++	/* search for iosapic */
++	for (isi = iosapic_list; isi; isi = isi->isi_next)
++		if (isi->isi_hpa == dev->mod0)
++			break;
++	if (!isi)
++		return 0; /* no iosapic found, force polling */
+ 
+ 	/* get vector info for this input line */
+-	vi = isi->isi_vector + isi_line;
+-	DBG_IRT("iosapic_serial_irq:  line %d vi 0x%p\n", isi_line, vi);
++	vi = isi->isi_vector + intin;
++	DBG_IRT("iosapic_serial_irq:  line %d vi 0x%p\n", iosapic_intin, vi);
+ 
+ 	/* If this IRQ line has already been setup, skip it */
+ 	if (vi->irte)
+@@ -941,8 +957,8 @@ void *iosapic_register(unsigned long hpa)
+ 		vip->irqline = (unsigned char) cnt;
+ 		vip->iosapic = isi;
+ 	}
+-	if (!first_isi)
+-		first_isi = isi;
++	isi->isi_next = iosapic_list;
++	iosapic_list = isi;
+ 	return isi;
+ }
+ 
+diff --git a/drivers/pci/hotplug/pciehp_pci.c b/drivers/pci/hotplug/pciehp_pci.c
+index aac7a40..0e0d0f7 100644
+--- a/drivers/pci/hotplug/pciehp_pci.c
++++ b/drivers/pci/hotplug/pciehp_pci.c
+@@ -92,7 +92,14 @@ int pciehp_unconfigure_device(struct slot *p_slot)
+ 	if (ret)
+ 		presence = 0;
+ 
+-	list_for_each_entry_safe(dev, temp, &parent->devices, bus_list) {
++	/*
++	 * Stopping an SR-IOV PF device removes all the associated VFs,
++	 * which will update the bus->devices list and confuse the
++	 * iterator.  Therefore, iterate in reverse so we remove the VFs
++	 * first, then the PF.  We do the same in pci_stop_bus_device().
++	 */
++	list_for_each_entry_safe_reverse(dev, temp, &parent->devices,
++					 bus_list) {
+ 		pci_dev_get(dev);
+ 		if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE && presence) {
+ 			pci_read_config_byte(dev, PCI_BRIDGE_CONTROL, &bctl);
+diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
+index d254e23..64a7de2 100644
+--- a/drivers/pci/setup-bus.c
++++ b/drivers/pci/setup-bus.c
+@@ -300,6 +300,47 @@ static void assign_requested_resources_sorted(struct list_head *head,
+ 	}
+ }
+ 
++static unsigned long pci_fail_res_type_mask(struct list_head *fail_head)
++{
++	struct pci_dev_resource *fail_res;
++	unsigned long mask = 0;
++
++	/* check failed type */
++	list_for_each_entry(fail_res, fail_head, list)
++		mask |= fail_res->flags;
++
++	/*
++	 * one pref failed resource will set IORESOURCE_MEM,
++	 * as we can allocate pref in non-pref range.
++	 * Will release all assigned non-pref sibling resources
++	 * according to that bit.
++	 */
++	return mask & (IORESOURCE_IO | IORESOURCE_MEM | IORESOURCE_PREFETCH);
++}
++
++static bool pci_need_to_release(unsigned long mask, struct resource *res)
++{
++	if (res->flags & IORESOURCE_IO)
++		return !!(mask & IORESOURCE_IO);
++
++	/* check pref at first */
++	if (res->flags & IORESOURCE_PREFETCH) {
++		if (mask & IORESOURCE_PREFETCH)
++			return true;
++		/* count pref if its parent is non-pref */
++		else if ((mask & IORESOURCE_MEM) &&
++			 !(res->parent->flags & IORESOURCE_PREFETCH))
++			return true;
++		else
++			return false;
++	}
++
++	if (res->flags & IORESOURCE_MEM)
++		return !!(mask & IORESOURCE_MEM);
++
++	return false;	/* should not get here */
++}
++
+ static void __assign_resources_sorted(struct list_head *head,
+ 				 struct list_head *realloc_head,
+ 				 struct list_head *fail_head)
+@@ -312,11 +353,24 @@ static void __assign_resources_sorted(struct list_head *head,
+ 	 *  if could do that, could get out early.
+ 	 *  if could not do that, we still try to assign requested at first,
+ 	 *    then try to reassign add_size for some resources.
++	 *
++	 * Separate three resource type checking if we need to release
++	 * assigned resource after requested + add_size try.
++	 *	1. if there is io port assign fail, will release assigned
++	 *	   io port.
++	 *	2. if there is pref mmio assign fail, release assigned
++	 *	   pref mmio.
++	 *	   if assigned pref mmio's parent is non-pref mmio and there
++	 *	   is non-pref mmio assign fail, will release that assigned
++	 *	   pref mmio.
++	 *	3. if there is non-pref mmio assign fail or pref mmio
++	 *	   assigned fail, will release assigned non-pref mmio.
+ 	 */
+ 	LIST_HEAD(save_head);
+ 	LIST_HEAD(local_fail_head);
+ 	struct pci_dev_resource *save_res;
+-	struct pci_dev_resource *dev_res;
++	struct pci_dev_resource *dev_res, *tmp_res;
++	unsigned long fail_type;
+ 
+ 	/* Check if optional add_size is there */
+ 	if (!realloc_head || list_empty(realloc_head))
+@@ -348,6 +402,19 @@ static void __assign_resources_sorted(struct list_head *head,
+ 		return;
+ 	}
+ 
++	/* check failed type */
++	fail_type = pci_fail_res_type_mask(&local_fail_head);
++	/* remove not need to be released assigned res from head list etc */
++	list_for_each_entry_safe(dev_res, tmp_res, head, list)
++		if (dev_res->res->parent &&
++		    !pci_need_to_release(fail_type, dev_res->res)) {
++			/* remove it from realloc_head list */
++			remove_from_list(realloc_head, dev_res->res);
++			remove_from_list(&save_head, dev_res->res);
++			list_del(&dev_res->list);
++			kfree(dev_res);
++		}
++
+ 	free_list(&local_fail_head);
+ 	/* Release assigned resource */
+ 	list_for_each_entry(dev_res, head, list)
+diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
+index 50b13c9..df0aacc 100644
+--- a/drivers/spi/spi-davinci.c
++++ b/drivers/spi/spi-davinci.c
+@@ -610,7 +610,7 @@ static int davinci_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
+ 		else
+ 			buf = (void *)t->tx_buf;
+ 		t->tx_dma = dma_map_single(&spi->dev, buf,
+-				t->len, DMA_FROM_DEVICE);
++				t->len, DMA_TO_DEVICE);
+ 		if (!t->tx_dma) {
+ 			ret = -EFAULT;
+ 			goto err_tx_map;
+diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
+index e34e3fe..1742ce5 100644
+--- a/drivers/staging/zram/zram_drv.c
++++ b/drivers/staging/zram/zram_drv.c
+@@ -272,8 +272,6 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
+ 
+ 	if (page_zero_filled(uncmem)) {
+ 		kunmap_atomic(user_mem);
+-		if (is_partial_io(bvec))
+-			kfree(uncmem);
+ 		zram->stats.pages_zero++;
+ 		zram_set_flag(meta, index, ZRAM_ZERO);
+ 		ret = 0;
+@@ -422,13 +420,20 @@ out:
+  */
+ static inline int valid_io_request(struct zram *zram, struct bio *bio)
+ {
+-	if (unlikely(
+-		(bio->bi_sector >= (zram->disksize >> SECTOR_SHIFT)) ||
+-		(bio->bi_sector & (ZRAM_SECTOR_PER_LOGICAL_BLOCK - 1)) ||
+-		(bio->bi_size & (ZRAM_LOGICAL_BLOCK_SIZE - 1)))) {
++	u64 start, end, bound;
+ 
++	/* unaligned request */
++	if (unlikely(bio->bi_sector & (ZRAM_SECTOR_PER_LOGICAL_BLOCK - 1)))
++		return 0;
++	if (unlikely(bio->bi_size & (ZRAM_LOGICAL_BLOCK_SIZE - 1)))
++		return 0;
++
++	start = bio->bi_sector;
++	end = start + (bio->bi_size >> SECTOR_SHIFT);
++	bound = zram->disksize >> SECTOR_SHIFT;
++	/* out of range range */
++	if (unlikely(start >= bound || end >= bound || start > end))
+ 		return 0;
+-	}
+ 
+ 	/* I/O request is valid */
+ 	return 1;
+@@ -582,7 +587,9 @@ static void zram_slot_free_notify(struct block_device *bdev,
+ 	struct zram *zram;
+ 
+ 	zram = bdev->bd_disk->private_data;
++	down_write(&zram->lock);
+ 	zram_free_page(zram, index);
++	up_write(&zram->lock);
+ 	zram_stat64_inc(zram, &zram->stats.notify_free);
+ }
+ 
+@@ -593,7 +600,7 @@ static const struct block_device_operations zram_devops = {
+ 
+ static int create_device(struct zram *zram, int device_id)
+ {
+-	int ret = 0;
++	int ret = -ENOMEM;
+ 
+ 	init_rwsem(&zram->lock);
+ 	init_rwsem(&zram->init_lock);
+@@ -603,7 +610,6 @@ static int create_device(struct zram *zram, int device_id)
+ 	if (!zram->queue) {
+ 		pr_err("Error allocating disk queue for device %d\n",
+ 			device_id);
+-		ret = -ENOMEM;
+ 		goto out;
+ 	}
+ 
+@@ -613,11 +619,9 @@ static int create_device(struct zram *zram, int device_id)
+ 	 /* gendisk structure */
+ 	zram->disk = alloc_disk(1);
+ 	if (!zram->disk) {
+-		blk_cleanup_queue(zram->queue);
+ 		pr_warn("Error allocating disk structure for device %d\n",
+ 			device_id);
+-		ret = -ENOMEM;
+-		goto out;
++		goto out_free_queue;
+ 	}
+ 
+ 	zram->disk->major = zram_major;
+@@ -646,11 +650,17 @@ static int create_device(struct zram *zram, int device_id)
+ 				&zram_disk_attr_group);
+ 	if (ret < 0) {
+ 		pr_warn("Error creating sysfs group");
+-		goto out;
++		goto out_free_disk;
+ 	}
+ 
+ 	zram->init_done = 0;
++	return 0;
+ 
++out_free_disk:
++	del_gendisk(zram->disk);
++	put_disk(zram->disk);
++out_free_queue:
++	blk_cleanup_queue(zram->queue);
+ out:
+ 	return ret;
+ }
+@@ -727,8 +737,10 @@ static void __exit zram_exit(void)
+ 	for (i = 0; i < num_devices; i++) {
+ 		zram = &zram_devices[i];
+ 
++		get_disk(zram->disk);
+ 		destroy_device(zram);
+ 		zram_reset_device(zram);
++		put_disk(zram->disk);
+ 	}
+ 
+ 	unregister_blkdev(zram_major, "zram");
+diff --git a/drivers/staging/zram/zram_drv.h b/drivers/staging/zram/zram_drv.h
+index 2d1a3f1..d542eee 100644
+--- a/drivers/staging/zram/zram_drv.h
++++ b/drivers/staging/zram/zram_drv.h
+@@ -93,8 +93,9 @@ struct zram_meta {
+ struct zram {
+ 	struct zram_meta *meta;
+ 	spinlock_t stat64_lock;	/* protect 64-bit stats */
+-	struct rw_semaphore lock; /* protect compression buffers and table
+-				   * against concurrent read and writes */
++	struct rw_semaphore lock; /* protect compression buffers, table,
++				   * 32bit stat counters against concurrent
++				   * notifications, reads and writes */
+ 	struct request_queue *queue;
+ 	struct gendisk *disk;
+ 	int init_done;
+diff --git a/drivers/staging/zram/zram_sysfs.c b/drivers/staging/zram/zram_sysfs.c
+index e6a929d..dc76a3d 100644
+--- a/drivers/staging/zram/zram_sysfs.c
++++ b/drivers/staging/zram/zram_sysfs.c
+@@ -188,8 +188,10 @@ static ssize_t mem_used_total_show(struct device *dev,
+ 	struct zram *zram = dev_to_zram(dev);
+ 	struct zram_meta *meta = zram->meta;
+ 
++	down_read(&zram->init_lock);
+ 	if (zram->init_done)
+ 		val = zs_get_total_size_bytes(meta->mem_pool);
++	up_read(&zram->init_lock);
+ 
+ 	return sprintf(buf, "%llu\n", val);
+ }
+diff --git a/drivers/tty/serial/8250/8250_gsc.c b/drivers/tty/serial/8250/8250_gsc.c
+index bb91b47..2e3ea1a 100644
+--- a/drivers/tty/serial/8250/8250_gsc.c
++++ b/drivers/tty/serial/8250/8250_gsc.c
+@@ -31,9 +31,8 @@ static int __init serial_init_chip(struct parisc_device *dev)
+ 	int err;
+ 
+ #ifdef CONFIG_64BIT
+-	extern int iosapic_serial_irq(int cellnum);
+ 	if (!dev->irq && (dev->id.sversion == 0xad))
+-		dev->irq = iosapic_serial_irq(dev->mod_index-1);
++		dev->irq = iosapic_serial_irq(dev);
+ #endif
+ 
+ 	if (!dev->irq) {
+diff --git a/drivers/tty/serial/arc_uart.c b/drivers/tty/serial/arc_uart.c
+index cbf1d15..22f280a 100644
+--- a/drivers/tty/serial/arc_uart.c
++++ b/drivers/tty/serial/arc_uart.c
+@@ -773,6 +773,6 @@ module_init(arc_serial_init);
+ module_exit(arc_serial_exit);
+ 
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("plat-arcfpga/uart");
++MODULE_ALIAS("platform:" DRIVER_NAME);
+ MODULE_AUTHOR("Vineet Gupta");
+ MODULE_DESCRIPTION("ARC(Synopsys) On-Chip(fpga) serial driver");
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 4f5f161..f85b8e6 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -678,11 +678,18 @@ static void mxs_auart_settermios(struct uart_port *u,
+ 
+ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
+ {
+-	u32 istatus, istat;
++	u32 istat;
+ 	struct mxs_auart_port *s = context;
+ 	u32 stat = readl(s->port.membase + AUART_STAT);
+ 
+-	istatus = istat = readl(s->port.membase + AUART_INTR);
++	istat = readl(s->port.membase + AUART_INTR);
++
++	/* ack irq */
++	writel(istat & (AUART_INTR_RTIS
++		| AUART_INTR_TXIS
++		| AUART_INTR_RXIS
++		| AUART_INTR_CTSMIS),
++			s->port.membase + AUART_INTR_CLR);
+ 
+ 	if (istat & AUART_INTR_CTSMIS) {
+ 		uart_handle_cts_change(&s->port, stat & AUART_STAT_CTS);
+@@ -702,12 +709,6 @@ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
+ 		istat &= ~AUART_INTR_TXIS;
+ 	}
+ 
+-	writel(istatus & (AUART_INTR_RTIS
+-		| AUART_INTR_TXIS
+-		| AUART_INTR_RXIS
+-		| AUART_INTR_CTSMIS),
+-			s->port.membase + AUART_INTR_CLR);
+-
+ 	return IRQ_HANDLED;
+ }
+ 
+@@ -850,7 +851,7 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
+ 	struct mxs_auart_port *s;
+ 	struct uart_port *port;
+ 	unsigned int old_ctrl0, old_ctrl2;
+-	unsigned int to = 1000;
++	unsigned int to = 20000;
+ 
+ 	if (co->index >= MXS_AUART_PORTS || co->index < 0)
+ 		return;
+@@ -871,18 +872,23 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
+ 
+ 	uart_console_write(port, str, count, mxs_auart_console_putchar);
+ 
+-	/*
+-	 * Finally, wait for transmitter to become empty
+-	 * and restore the TCR
+-	 */
++	/* Finally, wait for transmitter to become empty ... */
+ 	while (readl(port->membase + AUART_STAT) & AUART_STAT_BUSY) {
++		udelay(1);
+ 		if (!to--)
+ 			break;
+-		udelay(1);
+ 	}
+ 
+-	writel(old_ctrl0, port->membase + AUART_CTRL0);
+-	writel(old_ctrl2, port->membase + AUART_CTRL2);
++	/*
++	 * ... and restore the TCR if we waited long enough for the transmitter
++	 * to be idle. This might keep the transmitter enabled although it is
++	 * unused, but that is better than to disable it while it is still
++	 * transmitting.
++	 */
++	if (!(readl(port->membase + AUART_STAT) & AUART_STAT_BUSY)) {
++		writel(old_ctrl0, port->membase + AUART_CTRL0);
++		writel(old_ctrl2, port->membase + AUART_CTRL2);
++	}
+ 
+ 	clk_disable(s->clk);
+ }
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index 62b86a6..b92d333 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -183,7 +183,10 @@
+ #define LED_ON_MS	500
+ #define LED_OFF_MS	500
+ 
+-static int device_type;
++enum mos7840_flag {
++	MOS7840_FLAG_CTRL_BUSY,
++	MOS7840_FLAG_LED_BUSY,
++};
+ 
+ static const struct usb_device_id id_table[] = {
+ 	{USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)},
+@@ -238,9 +241,12 @@ struct moschip_port {
+ 
+ 	/* For device(s) with LED indicator */
+ 	bool has_led;
+-	bool led_flag;
+ 	struct timer_list led_timer1;	/* Timer for LED on */
+ 	struct timer_list led_timer2;	/* Timer for LED off */
++	struct urb *led_urb;
++	struct usb_ctrlrequest *led_dr;
++
++	unsigned long flags;
+ };
+ 
+ /*
+@@ -467,10 +473,10 @@ static void mos7840_control_callback(struct urb *urb)
+ 	case -ESHUTDOWN:
+ 		/* this urb is terminated, clean up */
+ 		dev_dbg(dev, "%s - urb shutting down with status: %d\n", __func__, status);
+-		return;
++		goto out;
+ 	default:
+ 		dev_dbg(dev, "%s - nonzero urb status received: %d\n", __func__, status);
+-		return;
++		goto out;
+ 	}
+ 
+ 	dev_dbg(dev, "%s urb buffer size is %d\n", __func__, urb->actual_length);
+@@ -483,6 +489,8 @@ static void mos7840_control_callback(struct urb *urb)
+ 		mos7840_handle_new_msr(mos7840_port, regval);
+ 	else if (mos7840_port->MsrLsr == 1)
+ 		mos7840_handle_new_lsr(mos7840_port, regval);
++out:
++	clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mos7840_port->flags);
+ }
+ 
+ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
+@@ -493,6 +501,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
+ 	unsigned char *buffer = mcs->ctrl_buf;
+ 	int ret;
+ 
++	if (test_and_set_bit_lock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags))
++		return -EBUSY;
++
+ 	dr->bRequestType = MCS_RD_RTYPE;
+ 	dr->bRequest = MCS_RDREQ;
+ 	dr->wValue = cpu_to_le16(Wval);	/* 0 */
+@@ -504,6 +515,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
+ 			     mos7840_control_callback, mcs);
+ 	mcs->control_urb->transfer_buffer_length = 2;
+ 	ret = usb_submit_urb(mcs->control_urb, GFP_ATOMIC);
++	if (ret)
++		clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags);
++
+ 	return ret;
+ }
+ 
+@@ -530,7 +544,7 @@ static void mos7840_set_led_async(struct moschip_port *mcs, __u16 wval,
+ 				__u16 reg)
+ {
+ 	struct usb_device *dev = mcs->port->serial->dev;
+-	struct usb_ctrlrequest *dr = mcs->dr;
++	struct usb_ctrlrequest *dr = mcs->led_dr;
+ 
+ 	dr->bRequestType = MCS_WR_RTYPE;
+ 	dr->bRequest = MCS_WRREQ;
+@@ -538,10 +552,10 @@ static void mos7840_set_led_async(struct moschip_port *mcs, __u16 wval,
+ 	dr->wIndex = cpu_to_le16(reg);
+ 	dr->wLength = cpu_to_le16(0);
+ 
+-	usb_fill_control_urb(mcs->control_urb, dev, usb_sndctrlpipe(dev, 0),
++	usb_fill_control_urb(mcs->led_urb, dev, usb_sndctrlpipe(dev, 0),
+ 		(unsigned char *)dr, NULL, 0, mos7840_set_led_callback, NULL);
+ 
+-	usb_submit_urb(mcs->control_urb, GFP_ATOMIC);
++	usb_submit_urb(mcs->led_urb, GFP_ATOMIC);
+ }
+ 
+ static void mos7840_set_led_sync(struct usb_serial_port *port, __u16 reg,
+@@ -567,7 +581,19 @@ static void mos7840_led_flag_off(unsigned long arg)
+ {
+ 	struct moschip_port *mcs = (struct moschip_port *) arg;
+ 
+-	mcs->led_flag = false;
++	clear_bit_unlock(MOS7840_FLAG_LED_BUSY, &mcs->flags);
++}
++
++static void mos7840_led_activity(struct usb_serial_port *port)
++{
++	struct moschip_port *mos7840_port = usb_get_serial_port_data(port);
++
++	if (test_and_set_bit_lock(MOS7840_FLAG_LED_BUSY, &mos7840_port->flags))
++		return;
++
++	mos7840_set_led_async(mos7840_port, 0x0301, MODEM_CONTROL_REGISTER);
++	mod_timer(&mos7840_port->led_timer1,
++				jiffies + msecs_to_jiffies(LED_ON_MS));
+ }
+ 
+ /*****************************************************************************
+@@ -767,14 +793,8 @@ static void mos7840_bulk_in_callback(struct urb *urb)
+ 		return;
+ 	}
+ 
+-	/* Turn on LED */
+-	if (mos7840_port->has_led && !mos7840_port->led_flag) {
+-		mos7840_port->led_flag = true;
+-		mos7840_set_led_async(mos7840_port, 0x0301,
+-					MODEM_CONTROL_REGISTER);
+-		mod_timer(&mos7840_port->led_timer1,
+-				jiffies + msecs_to_jiffies(LED_ON_MS));
+-	}
++	if (mos7840_port->has_led)
++		mos7840_led_activity(port);
+ 
+ 	mos7840_port->read_urb_busy = true;
+ 	retval = usb_submit_urb(mos7840_port->read_urb, GFP_ATOMIC);
+@@ -825,18 +845,6 @@ static void mos7840_bulk_out_data_callback(struct urb *urb)
+ /************************************************************************/
+ /*       D R I V E R  T T Y  I N T E R F A C E  F U N C T I O N S       */
+ /************************************************************************/
+-#ifdef MCSSerialProbe
+-static int mos7840_serial_probe(struct usb_serial *serial,
+-				const struct usb_device_id *id)
+-{
+-
+-	/*need to implement the mode_reg reading and updating\
+-	   structures usb_serial_ device_type\
+-	   (i.e num_ports, num_bulkin,bulkout etc) */
+-	/* Also we can update the changes  attach */
+-	return 1;
+-}
+-#endif
+ 
+ /*****************************************************************************
+  * mos7840_open
+@@ -1467,13 +1475,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
+ 	data1 = urb->transfer_buffer;
+ 	dev_dbg(&port->dev, "bulkout endpoint is %d\n", port->bulk_out_endpointAddress);
+ 
+-	/* Turn on LED */
+-	if (mos7840_port->has_led && !mos7840_port->led_flag) {
+-		mos7840_port->led_flag = true;
+-		mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0301);
+-		mod_timer(&mos7840_port->led_timer1,
+-				jiffies + msecs_to_jiffies(LED_ON_MS));
+-	}
++	if (mos7840_port->has_led)
++		mos7840_led_activity(port);
+ 
+ 	/* send it down the pipe */
+ 	status = usb_submit_urb(urb, GFP_ATOMIC);
+@@ -2202,38 +2205,48 @@ static int mos7810_check(struct usb_serial *serial)
+ 	return 0;
+ }
+ 
+-static int mos7840_calc_num_ports(struct usb_serial *serial)
++static int mos7840_probe(struct usb_serial *serial,
++				const struct usb_device_id *id)
+ {
+-	__u16 data = 0x00;
++	u16 product = serial->dev->descriptor.idProduct;
+ 	u8 *buf;
+-	int mos7840_num_ports;
++	int device_type;
++
++	if (product == MOSCHIP_DEVICE_ID_7810 ||
++		product == MOSCHIP_DEVICE_ID_7820) {
++		device_type = product;
++		goto out;
++	}
+ 
+ 	buf = kzalloc(VENDOR_READ_LENGTH, GFP_KERNEL);
+-	if (buf) {
+-		usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
++	if (!buf)
++		return -ENOMEM;
++
++	usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
+ 			MCS_RDREQ, MCS_RD_RTYPE, 0, GPIO_REGISTER, buf,
+ 			VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT);
+-		data = *buf;
+-		kfree(buf);
+-	}
+ 
+-	if (serial->dev->descriptor.idProduct == MOSCHIP_DEVICE_ID_7810 ||
+-		serial->dev->descriptor.idProduct == MOSCHIP_DEVICE_ID_7820) {
+-		device_type = serial->dev->descriptor.idProduct;
+-	} else {
+-		/* For a MCS7840 device GPIO0 must be set to 1 */
+-		if ((data & 0x01) == 1)
+-			device_type = MOSCHIP_DEVICE_ID_7840;
+-		else if (mos7810_check(serial))
+-			device_type = MOSCHIP_DEVICE_ID_7810;
+-		else
+-			device_type = MOSCHIP_DEVICE_ID_7820;
+-	}
++	/* For a MCS7840 device GPIO0 must be set to 1 */
++	if (buf[0] & 0x01)
++		device_type = MOSCHIP_DEVICE_ID_7840;
++	else if (mos7810_check(serial))
++		device_type = MOSCHIP_DEVICE_ID_7810;
++	else
++		device_type = MOSCHIP_DEVICE_ID_7820;
++
++	kfree(buf);
++out:
++	usb_set_serial_data(serial, (void *)(unsigned long)device_type);
++
++	return 0;
++}
++
++static int mos7840_calc_num_ports(struct usb_serial *serial)
++{
++	int device_type = (unsigned long)usb_get_serial_data(serial);
++	int mos7840_num_ports;
+ 
+ 	mos7840_num_ports = (device_type >> 4) & 0x000F;
+-	serial->num_bulk_in = mos7840_num_ports;
+-	serial->num_bulk_out = mos7840_num_ports;
+-	serial->num_ports = mos7840_num_ports;
+ 
+ 	return mos7840_num_ports;
+ }
+@@ -2241,6 +2254,7 @@ static int mos7840_calc_num_ports(struct usb_serial *serial)
+ static int mos7840_port_probe(struct usb_serial_port *port)
+ {
+ 	struct usb_serial *serial = port->serial;
++	int device_type = (unsigned long)usb_get_serial_data(serial);
+ 	struct moschip_port *mos7840_port;
+ 	int status;
+ 	int pnum;
+@@ -2418,6 +2432,14 @@ static int mos7840_port_probe(struct usb_serial_port *port)
+ 	if (device_type == MOSCHIP_DEVICE_ID_7810) {
+ 		mos7840_port->has_led = true;
+ 
++		mos7840_port->led_urb = usb_alloc_urb(0, GFP_KERNEL);
++		mos7840_port->led_dr = kmalloc(sizeof(*mos7840_port->led_dr),
++								GFP_KERNEL);
++		if (!mos7840_port->led_urb || !mos7840_port->led_dr) {
++			status = -ENOMEM;
++			goto error;
++		}
++
+ 		init_timer(&mos7840_port->led_timer1);
+ 		mos7840_port->led_timer1.function = mos7840_led_off;
+ 		mos7840_port->led_timer1.expires =
+@@ -2430,8 +2452,6 @@ static int mos7840_port_probe(struct usb_serial_port *port)
+ 			jiffies + msecs_to_jiffies(LED_OFF_MS);
+ 		mos7840_port->led_timer2.data = (unsigned long)mos7840_port;
+ 
+-		mos7840_port->led_flag = false;
+-
+ 		/* Turn off LED */
+ 		mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0300);
+ 	}
+@@ -2453,6 +2473,8 @@ out:
+ 	}
+ 	return 0;
+ error:
++	kfree(mos7840_port->led_dr);
++	usb_free_urb(mos7840_port->led_urb);
+ 	kfree(mos7840_port->dr);
+ 	kfree(mos7840_port->ctrl_buf);
+ 	usb_free_urb(mos7840_port->control_urb);
+@@ -2473,6 +2495,10 @@ static int mos7840_port_remove(struct usb_serial_port *port)
+ 
+ 		del_timer_sync(&mos7840_port->led_timer1);
+ 		del_timer_sync(&mos7840_port->led_timer2);
++
++		usb_kill_urb(mos7840_port->led_urb);
++		usb_free_urb(mos7840_port->led_urb);
++		kfree(mos7840_port->led_dr);
+ 	}
+ 	usb_kill_urb(mos7840_port->control_urb);
+ 	usb_free_urb(mos7840_port->control_urb);
+@@ -2499,9 +2525,7 @@ static struct usb_serial_driver moschip7840_4port_device = {
+ 	.throttle = mos7840_throttle,
+ 	.unthrottle = mos7840_unthrottle,
+ 	.calc_num_ports = mos7840_calc_num_ports,
+-#ifdef MCSSerialProbe
+-	.probe = mos7840_serial_probe,
+-#endif
++	.probe = mos7840_probe,
+ 	.ioctl = mos7840_ioctl,
+ 	.set_termios = mos7840_set_termios,
+ 	.break_ctl = mos7840_break,
+diff --git a/fs/btrfs/ulist.c b/fs/btrfs/ulist.c
+index 7b417e2..b0a523b2 100644
+--- a/fs/btrfs/ulist.c
++++ b/fs/btrfs/ulist.c
+@@ -205,6 +205,10 @@ int ulist_add_merge(struct ulist *ulist, u64 val, u64 aux,
+ 		u64 new_alloced = ulist->nodes_alloced + 128;
+ 		struct ulist_node *new_nodes;
+ 		void *old = NULL;
++		int i;
++
++		for (i = 0; i < ulist->nnodes; i++)
++			rb_erase(&ulist->nodes[i].rb_node, &ulist->root);
+ 
+ 		/*
+ 		 * if nodes_alloced == ULIST_SIZE no memory has been allocated
+@@ -224,6 +228,17 @@ int ulist_add_merge(struct ulist *ulist, u64 val, u64 aux,
+ 
+ 		ulist->nodes = new_nodes;
+ 		ulist->nodes_alloced = new_alloced;
++
++		/*
++		 * krealloc actually uses memcpy, which does not copy rb_node
++		 * pointers, so we have to do it ourselves.  Otherwise we may
++		 * be bitten by crashes.
++		 */
++		for (i = 0; i < ulist->nnodes; i++) {
++			ret = ulist_rbtree_insert(ulist, &ulist->nodes[i]);
++			if (ret < 0)
++				return ret;
++		}
+ 	}
+ 	ulist->nodes[ulist->nnodes].val = val;
+ 	ulist->nodes[ulist->nnodes].aux = aux;
+diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
+index 6c80083..77cc85d 100644
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -122,6 +122,7 @@ static int fill_event_metadata(struct fsnotify_group *group,
+ 	metadata->event_len = FAN_EVENT_METADATA_LEN;
+ 	metadata->metadata_len = FAN_EVENT_METADATA_LEN;
+ 	metadata->vers = FANOTIFY_METADATA_VERSION;
++	metadata->reserved = 0;
+ 	metadata->mask = event->mask & FAN_ALL_OUTGOING_EVENTS;
+ 	metadata->pid = pid_vnr(event->tgid);
+ 	if (unlikely(event->mask & FAN_Q_OVERFLOW))
+diff --git a/include/linux/tick.h b/include/linux/tick.h
+index 9180f4b..62bd8b7 100644
+--- a/include/linux/tick.h
++++ b/include/linux/tick.h
+@@ -174,10 +174,4 @@ static inline void tick_nohz_task_switch(struct task_struct *tsk) { }
+ #endif
+ 
+ 
+-# ifdef CONFIG_CPU_IDLE_GOV_MENU
+-extern void menu_hrtimer_cancel(void);
+-# else
+-static inline void menu_hrtimer_cancel(void) {}
+-# endif /* CONFIG_CPU_IDLE_GOV_MENU */
+-
+ #endif
+diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
+index b6b215f..14105c2 100644
+--- a/include/linux/user_namespace.h
++++ b/include/linux/user_namespace.h
+@@ -23,6 +23,7 @@ struct user_namespace {
+ 	struct uid_gid_map	projid_map;
+ 	atomic_t		count;
+ 	struct user_namespace	*parent;
++	int			level;
+ 	kuid_t			owner;
+ 	kgid_t			group;
+ 	unsigned int		proc_inum;
+diff --git a/include/net/ndisc.h b/include/net/ndisc.h
+index 745bf74..5043f8b 100644
+--- a/include/net/ndisc.h
++++ b/include/net/ndisc.h
+@@ -119,7 +119,7 @@ extern struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
+  * if RFC 3831 IPv6-over-Fibre Channel is ever implemented it may
+  * also need a pad of 2.
+  */
+-static int ndisc_addr_option_pad(unsigned short type)
++static inline int ndisc_addr_option_pad(unsigned short type)
+ {
+ 	switch (type) {
+ 	case ARPHRD_INFINIBAND: return 2;
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index c6e77ef..2e9b387 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -2769,13 +2769,17 @@ static void cgroup_cfts_commit(struct cgroup_subsys *ss,
+ {
+ 	LIST_HEAD(pending);
+ 	struct cgroup *cgrp, *n;
++	struct super_block *sb = ss->root->sb;
+ 
+ 	/* %NULL @cfts indicates abort and don't bother if @ss isn't attached */
+-	if (cfts && ss->root != &rootnode) {
++	if (cfts && ss->root != &rootnode &&
++	    atomic_inc_not_zero(&sb->s_active)) {
+ 		list_for_each_entry(cgrp, &ss->root->allcg_list, allcg_node) {
+ 			dget(cgrp->dentry);
+ 			list_add_tail(&cgrp->cft_q_node, &pending);
+ 		}
++	} else {
++		sb = NULL;
+ 	}
+ 
+ 	mutex_unlock(&cgroup_mutex);
+@@ -2798,6 +2802,9 @@ static void cgroup_cfts_commit(struct cgroup_subsys *ss,
+ 		dput(cgrp->dentry);
+ 	}
+ 
++	if (sb)
++		deactivate_super(sb);
++
+ 	mutex_unlock(&cgroup_cft_mutex);
+ }
+ 
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 0cf1c14..4251374 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -832,13 +832,10 @@ void tick_nohz_irq_exit(void)
+ {
+ 	struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
+ 
+-	if (ts->inidle) {
+-		/* Cancel the timer because CPU already waken up from the C-states*/
+-		menu_hrtimer_cancel();
++	if (ts->inidle)
+ 		__tick_nohz_idle_enter(ts);
+-	} else {
++	else
+ 		tick_nohz_full_stop_tick(ts);
+-	}
+ }
+ 
+ /**
+@@ -936,8 +933,6 @@ void tick_nohz_idle_exit(void)
+ 
+ 	ts->inidle = 0;
+ 
+-	/* Cancel the timer because CPU already waken up from the C-states*/
+-	menu_hrtimer_cancel();
+ 	if (ts->idle_active || ts->tick_stopped)
+ 		now = ktime_get();
+ 
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index d8c30db..9064b91 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -62,6 +62,9 @@ int create_user_ns(struct cred *new)
+ 	kgid_t group = new->egid;
+ 	int ret;
+ 
++	if (parent_ns->level > 32)
++		return -EUSERS;
++
+ 	/*
+ 	 * Verify that we can not violate the policy of which files
+ 	 * may be accessed that is specified by the root directory,
+@@ -92,6 +95,7 @@ int create_user_ns(struct cred *new)
+ 	atomic_set(&ns->count, 1);
+ 	/* Leave the new->user_ns reference with the new user namespace. */
+ 	ns->parent = parent_ns;
++	ns->level = parent_ns->level + 1;
+ 	ns->owner = owner;
+ 	ns->group = group;
+ 
+@@ -105,16 +109,21 @@ int create_user_ns(struct cred *new)
+ int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
+ {
+ 	struct cred *cred;
++	int err = -ENOMEM;
+ 
+ 	if (!(unshare_flags & CLONE_NEWUSER))
+ 		return 0;
+ 
+ 	cred = prepare_creds();
+-	if (!cred)
+-		return -ENOMEM;
++	if (cred) {
++		err = create_user_ns(cred);
++		if (err)
++			put_cred(cred);
++		else
++			*new_cred = cred;
++	}
+ 
+-	*new_cred = cred;
+-	return create_user_ns(cred);
++	return err;
+ }
+ 
+ void free_user_ns(struct user_namespace *ns)
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index ee8e29a..6f01921 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -3398,6 +3398,12 @@ static void copy_workqueue_attrs(struct workqueue_attrs *to,
+ {
+ 	to->nice = from->nice;
+ 	cpumask_copy(to->cpumask, from->cpumask);
++	/*
++	 * Unlike hash and equality test, this function doesn't ignore
++	 * ->no_numa as it is used for both pool and wq attrs.  Instead,
++	 * get_unbound_pool() explicitly clears ->no_numa after copying.
++	 */
++	to->no_numa = from->no_numa;
+ }
+ 
+ /* hash value of the content of @attr */
+@@ -3565,6 +3571,12 @@ static struct worker_pool *get_unbound_pool(const struct workqueue_attrs *attrs)
+ 	lockdep_set_subclass(&pool->lock, 1);	/* see put_pwq() */
+ 	copy_workqueue_attrs(pool->attrs, attrs);
+ 
++	/*
++	 * no_numa isn't a worker_pool attribute, always clear it.  See
++	 * 'struct workqueue_attrs' comments for detail.
++	 */
++	pool->attrs->no_numa = false;
++
+ 	/* if cpumask is contained inside a NUMA node, we belong to that node */
+ 	if (wq_numa_enabled) {
+ 		for_each_node(node) {
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index fa2f63f..3f25e75 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -36,6 +36,8 @@ static int tcp_adv_win_scale_min = -31;
+ static int tcp_adv_win_scale_max = 31;
+ static int ip_ttl_min = 1;
+ static int ip_ttl_max = 255;
++static int tcp_syn_retries_min = 1;
++static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
+ static int ip_ping_group_range_min[] = { 0, 0 };
+ static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
+ 
+@@ -331,7 +333,9 @@ static struct ctl_table ipv4_table[] = {
+ 		.data		= &sysctl_tcp_syn_retries,
+ 		.maxlen		= sizeof(int),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec
++		.proc_handler	= proc_dointvec_minmax,
++		.extra1		= &tcp_syn_retries_min,
++		.extra2		= &tcp_syn_retries_max
+ 	},
+ 	{
+ 		.procname	= "tcp_synack_retries",
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index 241fb8a..4b42124 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -259,10 +259,12 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
+ {
+ 	struct mr6_table *mrt, *next;
+ 
++	rtnl_lock();
+ 	list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
+ 		list_del(&mrt->list);
+ 		ip6mr_free_table(mrt);
+ 	}
++	rtnl_unlock();
+ 	fib_rules_unregister(net->ipv6.mr6_rules_ops);
+ }
+ #else
+@@ -289,7 +291,10 @@ static int __net_init ip6mr_rules_init(struct net *net)
+ 
+ static void __net_exit ip6mr_rules_exit(struct net *net)
+ {
++	rtnl_lock();
+ 	ip6mr_free_table(net->ipv6.mrt6);
++	net->ipv6.mrt6 = NULL;
++	rtnl_unlock();
+ }
+ #endif
+ 
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 9da8620..ab8bd2c 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2081,6 +2081,7 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, const struct xfrm_policy *
+ 			pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
+ 	}
+ 	pol->sadb_x_policy_dir = dir+1;
++	pol->sadb_x_policy_reserved = 0;
+ 	pol->sadb_x_policy_id = xp->index;
+ 	pol->sadb_x_policy_priority = xp->priority;
+ 
+@@ -3137,7 +3138,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
+ 	pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
+ 	pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
+ 	pol->sadb_x_policy_dir = XFRM_POLICY_OUT + 1;
++	pol->sadb_x_policy_reserved = 0;
+ 	pol->sadb_x_policy_id = xp->index;
++	pol->sadb_x_policy_priority = xp->priority;
+ 
+ 	/* Set sadb_comb's. */
+ 	if (x->id.proto == IPPROTO_AH)
+@@ -3525,6 +3528,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
+ 	pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
+ 	pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
+ 	pol->sadb_x_policy_dir = dir + 1;
++	pol->sadb_x_policy_reserved = 0;
+ 	pol->sadb_x_policy_id = 0;
+ 	pol->sadb_x_policy_priority = 0;
+ 
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 4fdb306e..ae36f8e 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -652,6 +652,8 @@ static void ieee80211_get_et_stats(struct wiphy *wiphy,
+ 			if (sta->sdata->dev != dev)
+ 				continue;
+ 
++			sinfo.filled = 0;
++			sta_set_sinfo(sta, &sinfo);
+ 			i = 0;
+ 			ADD_STA_STATS(sta);
+ 		}
+diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
+index 7fc5d0d..3401262 100644
+--- a/net/mac80211/pm.c
++++ b/net/mac80211/pm.c
+@@ -99,10 +99,13 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
+ 	}
+ 	mutex_unlock(&local->sta_mtx);
+ 
+-	/* remove all interfaces */
++	/* remove all interfaces that were created in the driver */
+ 	list_for_each_entry(sdata, &local->interfaces, list) {
+-		if (!ieee80211_sdata_running(sdata))
++		if (!ieee80211_sdata_running(sdata) ||
++		    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
++		    sdata->vif.type == NL80211_IFTYPE_MONITOR)
+ 			continue;
++
+ 		drv_remove_interface(local, sdata);
+ 	}
+ 
+diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
+index ac7ef54..e6512e2 100644
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
+ 	struct minstrel_rate *msr, *mr;
+ 	unsigned int ndx;
+ 	bool mrr_capable;
+-	bool prev_sample = mi->prev_sample;
++	bool prev_sample;
+ 	int delta;
+ 	int sampling_ratio;
+ 
+@@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
+ 			(mi->sample_count + mi->sample_deferred / 2);
+ 
+ 	/* delta < 0: no sampling required */
++	prev_sample = mi->prev_sample;
+ 	mi->prev_sample = false;
+ 	if (delta < 0 || (!mrr_capable && prev_sample))
+ 		return;
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index 5b2d301..f5aed96 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -804,10 +804,18 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
+ 
+ 	sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
+ 	info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
++	rate->count = 1;
++
++	if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
++		int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
++		rate->idx = mp->cck_rates[idx];
++		rate->flags = 0;
++		return;
++	}
++
+ 	rate->idx = sample_idx % MCS_GROUP_RATES +
+ 		    (sample_group->streams - 1) * MCS_GROUP_RATES;
+ 	rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
+-	rate->count = 1;
+ }
+ 
+ static void
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 8e29526..83f6d29 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -932,8 +932,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
+ 
+-	/* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
+-	if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
++	/*
++	 * Drop duplicate 802.11 retransmissions
++	 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
++	 */
++	if (rx->skb->len >= 24 && rx->sta &&
++	    !ieee80211_is_ctl(hdr->frame_control) &&
++	    !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
++	    !is_multicast_ether_addr(hdr->addr1)) {
+ 		if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
+ 			     rx->sta->last_seq_ctrl[rx->seqno_idx] ==
+ 			     hdr->seq_ctrl)) {
+diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
+index 2fd6dbe..1076fe1 100644
+--- a/net/netlink/genetlink.c
++++ b/net/netlink/genetlink.c
+@@ -877,8 +877,10 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
+ #ifdef CONFIG_MODULES
+ 		if (res == NULL) {
+ 			genl_unlock();
++			up_read(&cb_lock);
+ 			request_module("net-pf-%d-proto-%d-family-%s",
+ 				       PF_NETLINK, NETLINK_GENERIC, name);
++			down_read(&cb_lock);
+ 			genl_lock();
+ 			res = genl_family_find_byname(name);
+ 		}
+diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
+index ca8e0a5..1f9c314 100644
+--- a/net/sched/sch_atm.c
++++ b/net/sched/sch_atm.c
+@@ -605,6 +605,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
+ 		struct sockaddr_atmpvc pvc;
+ 		int state;
+ 
++		memset(&pvc, 0, sizeof(pvc));
+ 		pvc.sap_family = AF_ATMPVC;
+ 		pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
+ 		pvc.sap_addr.vpi = flow->vcc->vpi;
+diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
+index 1bc210f..8ec1598 100644
+--- a/net/sched/sch_cbq.c
++++ b/net/sched/sch_cbq.c
+@@ -1465,6 +1465,7 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
+ 	unsigned char *b = skb_tail_pointer(skb);
+ 	struct tc_cbq_wrropt opt;
+ 
++	memset(&opt, 0, sizeof(opt));
+ 	opt.flags = 0;
+ 	opt.allot = cl->allot;
+ 	opt.priority = cl->priority + 1;
+diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c
+index d304f41..af7ffd4 100644
+--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
++++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
+@@ -120,7 +120,7 @@ static int gssp_rpc_create(struct net *net, struct rpc_clnt **_clnt)
+ 	if (IS_ERR(clnt)) {
+ 		dprintk("RPC:       failed to create AF_LOCAL gssproxy "
+ 				"client (errno %ld).\n", PTR_ERR(clnt));
+-		result = -PTR_ERR(clnt);
++		result = PTR_ERR(clnt);
+ 		*_clnt = NULL;
+ 		goto out;
+ 	}
+@@ -328,7 +328,6 @@ void gssp_free_upcall_data(struct gssp_upcall_data *data)
+ 	kfree(data->in_handle.data);
+ 	kfree(data->out_handle.data);
+ 	kfree(data->out_token.data);
+-	kfree(data->mech_oid.data);
+ 	free_svc_cred(&data->creds);
+ }
+ 
+diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
+index 357f613..3c85d1c 100644
+--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
++++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
+@@ -430,7 +430,7 @@ static int dummy_enc_nameattr_array(struct xdr_stream *xdr,
+ static int dummy_dec_nameattr_array(struct xdr_stream *xdr,
+ 				    struct gssx_name_attr_array *naa)
+ {
+-	struct gssx_name_attr dummy;
++	struct gssx_name_attr dummy = { .attr = {.len = 0} };
+ 	u32 count, i;
+ 	__be32 *p;
+ 
+@@ -493,12 +493,13 @@ static int gssx_enc_name(struct xdr_stream *xdr,
+ 	return err;
+ }
+ 
++
+ static int gssx_dec_name(struct xdr_stream *xdr,
+ 			 struct gssx_name *name)
+ {
+-	struct xdr_netobj dummy_netobj;
+-	struct gssx_name_attr_array dummy_name_attr_array;
+-	struct gssx_option_array dummy_option_array;
++	struct xdr_netobj dummy_netobj = { .len = 0 };
++	struct gssx_name_attr_array dummy_name_attr_array = { .count = 0 };
++	struct gssx_option_array dummy_option_array = { .count = 0 };
+ 	int err;
+ 
+ 	/* name->display_name */
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index b14b7e3..db8ead9 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -6588,12 +6588,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
+ 
+ void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
+ {
++	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
+ 	void *hdr = ((void **)skb->cb)[1];
+ 	struct nlattr *data = ((void **)skb->cb)[2];
+ 
+ 	nla_nest_end(skb, data);
+ 	genlmsg_end(skb, hdr);
+-	genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
++	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
++				nl80211_testmode_mcgrp.id, gfp);
+ }
+ EXPORT_SYMBOL(cfg80211_testmode_event);
+ #endif
+@@ -10028,7 +10030,8 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
+ 
+ 	genlmsg_end(msg, hdr);
+ 
+-	genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
++	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
++				nl80211_mlme_mcgrp.id, gfp);
+ 	return;
+ 
+  nla_put_failure:
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 99db892..9896954 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -743,7 +743,7 @@ static long snd_compr_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+ 	mutex_lock(&stream->device->lock);
+ 	switch (_IOC_NR(cmd)) {
+ 	case _IOC_NR(SNDRV_COMPRESS_IOCTL_VERSION):
+-		put_user(SNDRV_COMPRESS_VERSION,
++		retval = put_user(SNDRV_COMPRESS_VERSION,
+ 				(int __user *)arg) ? -EFAULT : 0;
+ 		break;
+ 	case _IOC_NR(SNDRV_COMPRESS_GET_CAPS):
+diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c
+index 7c11d46..48a9d00 100644
+--- a/sound/pci/hda/hda_auto_parser.c
++++ b/sound/pci/hda/hda_auto_parser.c
+@@ -860,7 +860,7 @@ void snd_hda_pick_fixup(struct hda_codec *codec,
+ 		}
+ 	}
+ 	if (id < 0 && quirk) {
+-		for (q = quirk; q->subvendor; q++) {
++		for (q = quirk; q->subvendor || q->subdevice; q++) {
+ 			unsigned int vendorid =
+ 				q->subdevice | (q->subvendor << 16);
+ 			unsigned int mask = 0xffff0000 | q->subdevice_mask;
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index e849e1e..dc4833f 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -2815,6 +2815,7 @@ static const struct hda_pintbl ecs202_pin_configs[] = {
+ 
+ /* codec SSIDs for Intel Mac sharing the same PCI SSID 8384:7680 */
+ static const struct snd_pci_quirk stac922x_intel_mac_fixup_tbl[] = {
++	SND_PCI_QUIRK(0x0000, 0x0100, "Mac Mini", STAC_INTEL_MAC_V3),
+ 	SND_PCI_QUIRK(0x106b, 0x0800, "Mac", STAC_INTEL_MAC_V1),
+ 	SND_PCI_QUIRK(0x106b, 0x0600, "Mac", STAC_INTEL_MAC_V2),
+ 	SND_PCI_QUIRK(0x106b, 0x0700, "Mac", STAC_INTEL_MAC_V2),

Added: genpatches-2.6/trunk/3.10.7/1006_linux-3.10.7.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/1006_linux-3.10.7.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/1006_linux-3.10.7.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,2737 @@
+diff --git a/Makefile b/Makefile
+index fd92ffb..33e36ab 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 6
++SUBLEVEL = 7
+ EXTRAVERSION =
+ NAME = TOSSUG Baby Fish
+ 
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index 7a58ab9..e53e2b4 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -27,6 +27,7 @@ config MIPS
+ 	select HAVE_GENERIC_HARDIRQS
+ 	select GENERIC_IRQ_PROBE
+ 	select GENERIC_IRQ_SHOW
++	select GENERIC_PCI_IOMAP
+ 	select HAVE_ARCH_JUMP_LABEL
+ 	select ARCH_WANT_IPC_PARSE_VERSION
+ 	select IRQ_FORCED_THREADING
+@@ -2412,7 +2413,6 @@ config PCI
+ 	bool "Support for PCI controller"
+ 	depends on HW_HAS_PCI
+ 	select PCI_DOMAINS
+-	select GENERIC_PCI_IOMAP
+ 	select NO_GENERIC_PCI_IOPORT_MAP
+ 	help
+ 	  Find out whether you have a PCI motherboard. PCI is the name of a
+diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
+index b7e5985..b84e1fb 100644
+--- a/arch/mips/include/asm/io.h
++++ b/arch/mips/include/asm/io.h
+@@ -170,6 +170,11 @@ static inline void * isa_bus_to_virt(unsigned long address)
+ extern void __iomem * __ioremap(phys_t offset, phys_t size, unsigned long flags);
+ extern void __iounmap(const volatile void __iomem *addr);
+ 
++#ifndef CONFIG_PCI
++struct pci_dev;
++static inline void pci_iounmap(struct pci_dev *dev, void __iomem *addr) {}
++#endif
++
+ static inline void __iomem * __ioremap_mode(phys_t offset, unsigned long size,
+ 	unsigned long flags)
+ {
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index c33e3ad..74991fe 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -572,7 +572,7 @@ config SCHED_SMT
+ config PPC_DENORMALISATION
+ 	bool "PowerPC denormalisation exception handling"
+ 	depends on PPC_BOOK3S_64
+-	default "n"
++	default "y" if PPC_POWERNV
+ 	---help---
+ 	  Add support for handling denormalisation of single precision
+ 	  values.  Useful for bare metal only.  If unsure say Y here.
+diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
+index 14a6583..419e712 100644
+--- a/arch/powerpc/include/asm/processor.h
++++ b/arch/powerpc/include/asm/processor.h
+@@ -247,6 +247,10 @@ struct thread_struct {
+ 	unsigned long	tm_orig_msr;	/* Thread's MSR on ctx switch */
+ 	struct pt_regs	ckpt_regs;	/* Checkpointed registers */
+ 
++	unsigned long	tm_tar;
++	unsigned long	tm_ppr;
++	unsigned long	tm_dscr;
++
+ 	/*
+ 	 * Transactional FP and VSX 0-31 register set.
+ 	 * NOTE: the sense of these is the opposite of the integer ckpt_regs!
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index 362142b..e1fb161 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -254,19 +254,28 @@
+ #define SPRN_HRMOR	0x139	/* Real mode offset register */
+ #define SPRN_HSRR0	0x13A	/* Hypervisor Save/Restore 0 */
+ #define SPRN_HSRR1	0x13B	/* Hypervisor Save/Restore 1 */
++/* HFSCR and FSCR bit numbers are the same */
++#define FSCR_TAR_LG	8	/* Enable Target Address Register */
++#define FSCR_EBB_LG	7	/* Enable Event Based Branching */
++#define FSCR_TM_LG	5	/* Enable Transactional Memory */
++#define FSCR_PM_LG	4	/* Enable prob/priv access to PMU SPRs */
++#define FSCR_BHRB_LG	3	/* Enable Branch History Rolling Buffer*/
++#define FSCR_DSCR_LG	2	/* Enable Data Stream Control Register */
++#define FSCR_VECVSX_LG	1	/* Enable VMX/VSX  */
++#define FSCR_FP_LG	0	/* Enable Floating Point */
+ #define SPRN_FSCR	0x099	/* Facility Status & Control Register */
+-#define   FSCR_TAR	(1 << (63-55)) /* Enable Target Address Register */
+-#define   FSCR_EBB	(1 << (63-56)) /* Enable Event Based Branching */
+-#define   FSCR_DSCR	(1 << (63-61)) /* Enable Data Stream Control Register */
++#define   FSCR_TAR	__MASK(FSCR_TAR_LG)
++#define   FSCR_EBB	__MASK(FSCR_EBB_LG)
++#define   FSCR_DSCR	__MASK(FSCR_DSCR_LG)
+ #define SPRN_HFSCR	0xbe	/* HV=1 Facility Status & Control Register */
+-#define   HFSCR_TAR	(1 << (63-55)) /* Enable Target Address Register */
+-#define   HFSCR_EBB	(1 << (63-56)) /* Enable Event Based Branching */
+-#define   HFSCR_TM	(1 << (63-58)) /* Enable Transactional Memory */
+-#define   HFSCR_PM	(1 << (63-60)) /* Enable prob/priv access to PMU SPRs */
+-#define   HFSCR_BHRB	(1 << (63-59)) /* Enable Branch History Rolling Buffer*/
+-#define   HFSCR_DSCR	(1 << (63-61)) /* Enable Data Stream Control Register */
+-#define   HFSCR_VECVSX	(1 << (63-62)) /* Enable VMX/VSX  */
+-#define   HFSCR_FP	(1 << (63-63)) /* Enable Floating Point */
++#define   HFSCR_TAR	__MASK(FSCR_TAR_LG)
++#define   HFSCR_EBB	__MASK(FSCR_EBB_LG)
++#define   HFSCR_TM	__MASK(FSCR_TM_LG)
++#define   HFSCR_PM	__MASK(FSCR_PM_LG)
++#define   HFSCR_BHRB	__MASK(FSCR_BHRB_LG)
++#define   HFSCR_DSCR	__MASK(FSCR_DSCR_LG)
++#define   HFSCR_VECVSX	__MASK(FSCR_VECVSX_LG)
++#define   HFSCR_FP	__MASK(FSCR_FP_LG)
+ #define SPRN_TAR	0x32f	/* Target Address Register */
+ #define SPRN_LPCR	0x13E	/* LPAR Control Register */
+ #define   LPCR_VPM0	(1ul << (63-0))
+diff --git a/arch/powerpc/include/asm/switch_to.h b/arch/powerpc/include/asm/switch_to.h
+index 200d763..685ecc8 100644
+--- a/arch/powerpc/include/asm/switch_to.h
++++ b/arch/powerpc/include/asm/switch_to.h
+@@ -15,6 +15,15 @@ extern struct task_struct *__switch_to(struct task_struct *,
+ struct thread_struct;
+ extern struct task_struct *_switch(struct thread_struct *prev,
+ 				   struct thread_struct *next);
++#ifdef CONFIG_PPC_BOOK3S_64
++static inline void save_tar(struct thread_struct *prev)
++{
++	if (cpu_has_feature(CPU_FTR_ARCH_207S))
++		prev->tar = mfspr(SPRN_TAR);
++}
++#else
++static inline void save_tar(struct thread_struct *prev) {}
++#endif
+ 
+ extern void giveup_fpu(struct task_struct *);
+ extern void load_up_fpu(void);
+diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
+index 6f16ffa..302886b 100644
+--- a/arch/powerpc/kernel/asm-offsets.c
++++ b/arch/powerpc/kernel/asm-offsets.c
+@@ -139,6 +139,9 @@ int main(void)
+ 	DEFINE(THREAD_TM_TFHAR, offsetof(struct thread_struct, tm_tfhar));
+ 	DEFINE(THREAD_TM_TEXASR, offsetof(struct thread_struct, tm_texasr));
+ 	DEFINE(THREAD_TM_TFIAR, offsetof(struct thread_struct, tm_tfiar));
++	DEFINE(THREAD_TM_TAR, offsetof(struct thread_struct, tm_tar));
++	DEFINE(THREAD_TM_PPR, offsetof(struct thread_struct, tm_ppr));
++	DEFINE(THREAD_TM_DSCR, offsetof(struct thread_struct, tm_dscr));
+ 	DEFINE(PT_CKPT_REGS, offsetof(struct thread_struct, ckpt_regs));
+ 	DEFINE(THREAD_TRANSACT_VR0, offsetof(struct thread_struct,
+ 					 transact_vr[0]));
+diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
+index 8741c85..38847767 100644
+--- a/arch/powerpc/kernel/entry_64.S
++++ b/arch/powerpc/kernel/entry_64.S
+@@ -449,15 +449,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_DSCR)
+ 
+ #ifdef CONFIG_PPC_BOOK3S_64
+ BEGIN_FTR_SECTION
+-	/*
+-	 * Back up the TAR across context switches.  Note that the TAR is not
+-	 * available for use in the kernel.  (To provide this, the TAR should
+-	 * be backed up/restored on exception entry/exit instead, and be in
+-	 * pt_regs.  FIXME, this should be in pt_regs anyway (for debug).)
+-	 */
+-	mfspr	r0,SPRN_TAR
+-	std	r0,THREAD_TAR(r3)
+-
+ 	/* Event based branch registers */
+ 	mfspr	r0, SPRN_BESCR
+ 	std	r0, THREAD_BESCR(r3)
+@@ -584,9 +575,34 @@ BEGIN_FTR_SECTION
+ 	ld	r7,DSCR_DEFAULT@toc(2)
+ 	ld	r0,THREAD_DSCR(r4)
+ 	cmpwi	r6,0
++	li	r8, FSCR_DSCR
+ 	bne	1f
+ 	ld	r0,0(r7)
+-1:	cmpd	r0,r25
++	b	3f
++1:
++  BEGIN_FTR_SECTION_NESTED(70)
++	mfspr	r6, SPRN_FSCR
++	or	r6, r6, r8
++	mtspr	SPRN_FSCR, r6
++    BEGIN_FTR_SECTION_NESTED(69)
++	mfspr	r6, SPRN_HFSCR
++	or	r6, r6, r8
++	mtspr	SPRN_HFSCR, r6
++    END_FTR_SECTION_NESTED(CPU_FTR_HVMODE, CPU_FTR_HVMODE, 69)
++	b	4f
++  END_FTR_SECTION_NESTED(CPU_FTR_ARCH_207S, CPU_FTR_ARCH_207S, 70)
++3:
++  BEGIN_FTR_SECTION_NESTED(70)
++	mfspr	r6, SPRN_FSCR
++	andc	r6, r6, r8
++	mtspr	SPRN_FSCR, r6
++    BEGIN_FTR_SECTION_NESTED(69)
++	mfspr	r6, SPRN_HFSCR
++	andc	r6, r6, r8
++	mtspr	SPRN_HFSCR, r6
++    END_FTR_SECTION_NESTED(CPU_FTR_HVMODE, CPU_FTR_HVMODE, 69)
++  END_FTR_SECTION_NESTED(CPU_FTR_ARCH_207S, CPU_FTR_ARCH_207S, 70)
++4:	cmpd	r0,r25
+ 	beq	2f
+ 	mtspr	SPRN_DSCR,r0
+ 2:
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 4e00d22..902ca3c 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -848,7 +848,7 @@ hv_facility_unavailable_relon_trampoline:
+ 	. = 0x4f80
+ 	SET_SCRATCH0(r13)
+ 	EXCEPTION_PROLOG_0(PACA_EXGEN)
+-	b	facility_unavailable_relon_hv
++	b	hv_facility_unavailable_relon_hv
+ 
+ 	STD_RELON_EXCEPTION_PSERIES(0x5300, 0x1300, instruction_breakpoint)
+ #ifdef CONFIG_PPC_DENORMALISATION
+@@ -1175,6 +1175,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_VSX)
+ 	b	.ret_from_except
+ 
+ 	STD_EXCEPTION_COMMON(0xf60, facility_unavailable, .facility_unavailable_exception)
++	STD_EXCEPTION_COMMON(0xf80, hv_facility_unavailable, .facility_unavailable_exception)
+ 
+ 	.align	7
+ 	.globl	__end_handlers
+@@ -1188,7 +1189,7 @@ __end_handlers:
+ 	STD_RELON_EXCEPTION_PSERIES_OOL(0xf20, altivec_unavailable)
+ 	STD_RELON_EXCEPTION_PSERIES_OOL(0xf40, vsx_unavailable)
+ 	STD_RELON_EXCEPTION_PSERIES_OOL(0xf60, facility_unavailable)
+-	STD_RELON_EXCEPTION_HV_OOL(0xf80, facility_unavailable)
++	STD_RELON_EXCEPTION_HV_OOL(0xf80, hv_facility_unavailable)
+ 
+ #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_PPC_POWERNV)
+ /*
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index 076d124..7baa27b 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -600,6 +600,16 @@ struct task_struct *__switch_to(struct task_struct *prev,
+ 	struct ppc64_tlb_batch *batch;
+ #endif
+ 
++	/* Back up the TAR across context switches.
++	 * Note that the TAR is not available for use in the kernel.  (To
++	 * provide this, the TAR should be backed up/restored on exception
++	 * entry/exit instead, and be in pt_regs.  FIXME, this should be in
++	 * pt_regs anyway (for debug).)
++	 * Save the TAR here before we do treclaim/trecheckpoint as these
++	 * will change the TAR.
++	 */
++	save_tar(&prev->thread);
++
+ 	__switch_to_tm(prev);
+ 
+ #ifdef CONFIG_SMP
+diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S
+index 2da67e7..1edd6c2 100644
+--- a/arch/powerpc/kernel/tm.S
++++ b/arch/powerpc/kernel/tm.S
+@@ -224,6 +224,16 @@ dont_backup_fp:
+ 	std	r5, _CCR(r7)
+ 	std	r6, _XER(r7)
+ 
++
++	/* ******************** TAR, PPR, DSCR ********** */
++	mfspr	r3, SPRN_TAR
++	mfspr	r4, SPRN_PPR
++	mfspr	r5, SPRN_DSCR
++
++	std	r3, THREAD_TM_TAR(r12)
++	std	r4, THREAD_TM_PPR(r12)
++	std	r5, THREAD_TM_DSCR(r12)
++
+ 	/* MSR and flags:  We don't change CRs, and we don't need to alter
+ 	 * MSR.
+ 	 */
+@@ -338,6 +348,16 @@ dont_restore_fp:
+ 	mtmsr	r6				/* FP/Vec off again! */
+ 
+ restore_gprs:
++
++	/* ******************** TAR, PPR, DSCR ********** */
++	ld	r4, THREAD_TM_TAR(r3)
++	ld	r5, THREAD_TM_PPR(r3)
++	ld	r6, THREAD_TM_DSCR(r3)
++
++	mtspr	SPRN_TAR,	r4
++	mtspr	SPRN_PPR,	r5
++	mtspr	SPRN_DSCR,	r6
++
+ 	/* ******************** CR,LR,CCR,MSR ********** */
+ 	ld	r3, _CTR(r7)
+ 	ld	r4, _LINK(r7)
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index e4f205a..88929b1 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -44,9 +44,7 @@
+ #include <asm/machdep.h>
+ #include <asm/rtas.h>
+ #include <asm/pmc.h>
+-#ifdef CONFIG_PPC32
+ #include <asm/reg.h>
+-#endif
+ #ifdef CONFIG_PMAC_BACKLIGHT
+ #include <asm/backlight.h>
+ #endif
+@@ -1282,43 +1280,54 @@ void vsx_unavailable_exception(struct pt_regs *regs)
+ 	die("Unrecoverable VSX Unavailable Exception", regs, SIGABRT);
+ }
+ 
++#ifdef CONFIG_PPC64
+ void facility_unavailable_exception(struct pt_regs *regs)
+ {
+ 	static char *facility_strings[] = {
+-		"FPU",
+-		"VMX/VSX",
+-		"DSCR",
+-		"PMU SPRs",
+-		"BHRB",
+-		"TM",
+-		"AT",
+-		"EBB",
+-		"TAR",
++		[FSCR_FP_LG] = "FPU",
++		[FSCR_VECVSX_LG] = "VMX/VSX",
++		[FSCR_DSCR_LG] = "DSCR",
++		[FSCR_PM_LG] = "PMU SPRs",
++		[FSCR_BHRB_LG] = "BHRB",
++		[FSCR_TM_LG] = "TM",
++		[FSCR_EBB_LG] = "EBB",
++		[FSCR_TAR_LG] = "TAR",
+ 	};
+-	char *facility, *prefix;
++	char *facility = "unknown";
+ 	u64 value;
++	u8 status;
++	bool hv;
+ 
+-	if (regs->trap == 0xf60) {
+-		value = mfspr(SPRN_FSCR);
+-		prefix = "";
+-	} else {
++	hv = (regs->trap == 0xf80);
++	if (hv)
+ 		value = mfspr(SPRN_HFSCR);
+-		prefix = "Hypervisor ";
++	else
++		value = mfspr(SPRN_FSCR);
++
++	status = value >> 56;
++	if (status == FSCR_DSCR_LG) {
++		/* User is acessing the DSCR.  Set the inherit bit and allow
++		 * the user to set it directly in future by setting via the
++		 * H/FSCR DSCR bit.
++		 */
++		current->thread.dscr_inherit = 1;
++		if (hv)
++			mtspr(SPRN_HFSCR, value | HFSCR_DSCR);
++		else
++			mtspr(SPRN_FSCR,  value | FSCR_DSCR);
++		return;
+ 	}
+ 
+-	value = value >> 56;
++	if ((status < ARRAY_SIZE(facility_strings)) &&
++	    facility_strings[status])
++		facility = facility_strings[status];
+ 
+ 	/* We restore the interrupt state now */
+ 	if (!arch_irq_disabled_regs(regs))
+ 		local_irq_enable();
+ 
+-	if (value < ARRAY_SIZE(facility_strings))
+-		facility = facility_strings[value];
+-	else
+-		facility = "unknown";
+-
+ 	pr_err("%sFacility '%s' unavailable, exception at 0x%lx, MSR=%lx\n",
+-		prefix, facility, regs->nip, regs->msr);
++	       hv ? "Hypervisor " : "", facility, regs->nip, regs->msr);
+ 
+ 	if (user_mode(regs)) {
+ 		_exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
+@@ -1327,6 +1336,7 @@ void facility_unavailable_exception(struct pt_regs *regs)
+ 
+ 	die("Unexpected facility unavailable exception", regs, SIGABRT);
+ }
++#endif
+ 
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ 
+diff --git a/drivers/acpi/proc.c b/drivers/acpi/proc.c
+index aa1227a..04a1378 100644
+--- a/drivers/acpi/proc.c
++++ b/drivers/acpi/proc.c
+@@ -311,6 +311,8 @@ acpi_system_wakeup_device_seq_show(struct seq_file *seq, void *offset)
+ 			   dev->pnp.bus_id,
+ 			   (u32) dev->wakeup.sleep_state);
+ 
++		mutex_lock(&dev->physical_node_lock);
++
+ 		if (!dev->physical_node_count) {
+ 			seq_printf(seq, "%c%-8s\n",
+ 				dev->wakeup.flags.run_wake ? '*' : ' ',
+@@ -338,6 +340,8 @@ acpi_system_wakeup_device_seq_show(struct seq_file *seq, void *offset)
+ 				put_device(ldev);
+ 			}
+ 		}
++
++		mutex_unlock(&dev->physical_node_lock);
+ 	}
+ 	mutex_unlock(&acpi_device_lock);
+ 	return 0;
+@@ -347,12 +351,16 @@ static void physical_device_enable_wakeup(struct acpi_device *adev)
+ {
+ 	struct acpi_device_physical_node *entry;
+ 
++	mutex_lock(&adev->physical_node_lock);
++
+ 	list_for_each_entry(entry,
+ 		&adev->physical_node_list, node)
+ 		if (entry->dev && device_can_wakeup(entry->dev)) {
+ 			bool enable = !device_may_wakeup(entry->dev);
+ 			device_set_wakeup_enable(entry->dev, enable);
+ 		}
++
++	mutex_unlock(&adev->physical_node_lock);
+ }
+ 
+ static ssize_t
+diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
+index 507ee2d..46283fd 100644
+--- a/drivers/base/regmap/regcache.c
++++ b/drivers/base/regmap/regcache.c
+@@ -644,7 +644,8 @@ static int regcache_sync_block_raw(struct regmap *map, void *block,
+ 		}
+ 	}
+ 
+-	return regcache_sync_block_raw_flush(map, &data, base, regtmp);
++	return regcache_sync_block_raw_flush(map, &data, base, regtmp +
++			map->reg_stride);
+ }
+ 
+ int regcache_sync_block(struct regmap *map, void *block,
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index 1b456fe..fc45567 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -272,9 +272,12 @@ static struct port *find_port_by_devt_in_portdev(struct ports_device *portdev,
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&portdev->ports_lock, flags);
+-	list_for_each_entry(port, &portdev->ports, list)
+-		if (port->cdev->dev == dev)
++	list_for_each_entry(port, &portdev->ports, list) {
++		if (port->cdev->dev == dev) {
++			kref_get(&port->kref);
+ 			goto out;
++		}
++	}
+ 	port = NULL;
+ out:
+ 	spin_unlock_irqrestore(&portdev->ports_lock, flags);
+@@ -746,6 +749,10 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
+ 
+ 	port = filp->private_data;
+ 
++	/* Port is hot-unplugged. */
++	if (!port->guest_connected)
++		return -ENODEV;
++
+ 	if (!port_has_data(port)) {
+ 		/*
+ 		 * If nothing's connected on the host just return 0 in
+@@ -762,7 +769,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+-	/* Port got hot-unplugged. */
++	/* Port got hot-unplugged while we were waiting above. */
+ 	if (!port->guest_connected)
+ 		return -ENODEV;
+ 	/*
+@@ -932,13 +939,25 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe,
+ 	if (is_rproc_serial(port->out_vq->vdev))
+ 		return -EINVAL;
+ 
++	/*
++	 * pipe->nrbufs == 0 means there are no data to transfer,
++	 * so this returns just 0 for no data.
++	 */
++	pipe_lock(pipe);
++	if (!pipe->nrbufs) {
++		ret = 0;
++		goto error_out;
++	}
++
+ 	ret = wait_port_writable(port, filp->f_flags & O_NONBLOCK);
+ 	if (ret < 0)
+-		return ret;
++		goto error_out;
+ 
+ 	buf = alloc_buf(port->out_vq, 0, pipe->nrbufs);
+-	if (!buf)
+-		return -ENOMEM;
++	if (!buf) {
++		ret = -ENOMEM;
++		goto error_out;
++	}
+ 
+ 	sgl.n = 0;
+ 	sgl.len = 0;
+@@ -946,12 +965,17 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe,
+ 	sgl.sg = buf->sg;
+ 	sg_init_table(sgl.sg, sgl.size);
+ 	ret = __splice_from_pipe(pipe, &sd, pipe_to_sg);
++	pipe_unlock(pipe);
+ 	if (likely(ret > 0))
+ 		ret = __send_to_port(port, buf->sg, sgl.n, sgl.len, buf, true);
+ 
+ 	if (unlikely(ret <= 0))
+ 		free_buf(buf, true);
+ 	return ret;
++
++error_out:
++	pipe_unlock(pipe);
++	return ret;
+ }
+ 
+ static unsigned int port_fops_poll(struct file *filp, poll_table *wait)
+@@ -1019,14 +1043,14 @@ static int port_fops_open(struct inode *inode, struct file *filp)
+ 	struct port *port;
+ 	int ret;
+ 
++	/* We get the port with a kref here */
+ 	port = find_port_by_devt(cdev->dev);
++	if (!port) {
++		/* Port was unplugged before we could proceed */
++		return -ENXIO;
++	}
+ 	filp->private_data = port;
+ 
+-	/* Prevent against a port getting hot-unplugged at the same time */
+-	spin_lock_irq(&port->portdev->ports_lock);
+-	kref_get(&port->kref);
+-	spin_unlock_irq(&port->portdev->ports_lock);
+-
+ 	/*
+ 	 * Don't allow opening of console port devices -- that's done
+ 	 * via /dev/hvc
+@@ -1498,14 +1522,6 @@ static void remove_port(struct kref *kref)
+ 
+ 	port = container_of(kref, struct port, kref);
+ 
+-	sysfs_remove_group(&port->dev->kobj, &port_attribute_group);
+-	device_destroy(pdrvdata.class, port->dev->devt);
+-	cdev_del(port->cdev);
+-
+-	kfree(port->name);
+-
+-	debugfs_remove(port->debugfs_file);
+-
+ 	kfree(port);
+ }
+ 
+@@ -1539,12 +1555,14 @@ static void unplug_port(struct port *port)
+ 	spin_unlock_irq(&port->portdev->ports_lock);
+ 
+ 	if (port->guest_connected) {
++		/* Let the app know the port is going down. */
++		send_sigio_to_port(port);
++
++		/* Do this after sigio is actually sent */
+ 		port->guest_connected = false;
+ 		port->host_connected = false;
+-		wake_up_interruptible(&port->waitqueue);
+ 
+-		/* Let the app know the port is going down. */
+-		send_sigio_to_port(port);
++		wake_up_interruptible(&port->waitqueue);
+ 	}
+ 
+ 	if (is_console_port(port)) {
+@@ -1563,6 +1581,14 @@ static void unplug_port(struct port *port)
+ 	 */
+ 	port->portdev = NULL;
+ 
++	sysfs_remove_group(&port->dev->kobj, &port_attribute_group);
++	device_destroy(pdrvdata.class, port->dev->devt);
++	cdev_del(port->cdev);
++
++	kfree(port->name);
++
++	debugfs_remove(port->debugfs_file);
++
+ 	/*
+ 	 * Locks around here are not necessary - a port can't be
+ 	 * opened after we removed the port struct from ports_list
+diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
+index 0ceb2ef..f97cb3d 100644
+--- a/drivers/cpufreq/cpufreq_conservative.c
++++ b/drivers/cpufreq/cpufreq_conservative.c
+@@ -221,8 +221,8 @@ static ssize_t store_down_threshold(struct dbs_data *dbs_data, const char *buf,
+ 	return count;
+ }
+ 
+-static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
+-		size_t count)
++static ssize_t store_ignore_nice_load(struct dbs_data *dbs_data,
++		const char *buf, size_t count)
+ {
+ 	struct cs_dbs_tuners *cs_tuners = dbs_data->tuners;
+ 	unsigned int input, j;
+@@ -235,10 +235,10 @@ static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
+ 	if (input > 1)
+ 		input = 1;
+ 
+-	if (input == cs_tuners->ignore_nice) /* nothing to do */
++	if (input == cs_tuners->ignore_nice_load) /* nothing to do */
+ 		return count;
+ 
+-	cs_tuners->ignore_nice = input;
++	cs_tuners->ignore_nice_load = input;
+ 
+ 	/* we need to re-evaluate prev_cpu_idle */
+ 	for_each_online_cpu(j) {
+@@ -246,7 +246,7 @@ static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
+ 		dbs_info = &per_cpu(cs_cpu_dbs_info, j);
+ 		dbs_info->cdbs.prev_cpu_idle = get_cpu_idle_time(j,
+ 					&dbs_info->cdbs.prev_cpu_wall, 0);
+-		if (cs_tuners->ignore_nice)
++		if (cs_tuners->ignore_nice_load)
+ 			dbs_info->cdbs.prev_cpu_nice =
+ 				kcpustat_cpu(j).cpustat[CPUTIME_NICE];
+ 	}
+@@ -279,7 +279,7 @@ show_store_one(cs, sampling_rate);
+ show_store_one(cs, sampling_down_factor);
+ show_store_one(cs, up_threshold);
+ show_store_one(cs, down_threshold);
+-show_store_one(cs, ignore_nice);
++show_store_one(cs, ignore_nice_load);
+ show_store_one(cs, freq_step);
+ declare_show_sampling_rate_min(cs);
+ 
+@@ -287,7 +287,7 @@ gov_sys_pol_attr_rw(sampling_rate);
+ gov_sys_pol_attr_rw(sampling_down_factor);
+ gov_sys_pol_attr_rw(up_threshold);
+ gov_sys_pol_attr_rw(down_threshold);
+-gov_sys_pol_attr_rw(ignore_nice);
++gov_sys_pol_attr_rw(ignore_nice_load);
+ gov_sys_pol_attr_rw(freq_step);
+ gov_sys_pol_attr_ro(sampling_rate_min);
+ 
+@@ -297,7 +297,7 @@ static struct attribute *dbs_attributes_gov_sys[] = {
+ 	&sampling_down_factor_gov_sys.attr,
+ 	&up_threshold_gov_sys.attr,
+ 	&down_threshold_gov_sys.attr,
+-	&ignore_nice_gov_sys.attr,
++	&ignore_nice_load_gov_sys.attr,
+ 	&freq_step_gov_sys.attr,
+ 	NULL
+ };
+@@ -313,7 +313,7 @@ static struct attribute *dbs_attributes_gov_pol[] = {
+ 	&sampling_down_factor_gov_pol.attr,
+ 	&up_threshold_gov_pol.attr,
+ 	&down_threshold_gov_pol.attr,
+-	&ignore_nice_gov_pol.attr,
++	&ignore_nice_load_gov_pol.attr,
+ 	&freq_step_gov_pol.attr,
+ 	NULL
+ };
+@@ -338,7 +338,7 @@ static int cs_init(struct dbs_data *dbs_data)
+ 	tuners->up_threshold = DEF_FREQUENCY_UP_THRESHOLD;
+ 	tuners->down_threshold = DEF_FREQUENCY_DOWN_THRESHOLD;
+ 	tuners->sampling_down_factor = DEF_SAMPLING_DOWN_FACTOR;
+-	tuners->ignore_nice = 0;
++	tuners->ignore_nice_load = 0;
+ 	tuners->freq_step = DEF_FREQUENCY_STEP;
+ 
+ 	dbs_data->tuners = tuners;
+diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
+index 5af40ad..a86ff72 100644
+--- a/drivers/cpufreq/cpufreq_governor.c
++++ b/drivers/cpufreq/cpufreq_governor.c
+@@ -91,9 +91,9 @@ void dbs_check_cpu(struct dbs_data *dbs_data, int cpu)
+ 	unsigned int j;
+ 
+ 	if (dbs_data->cdata->governor == GOV_ONDEMAND)
+-		ignore_nice = od_tuners->ignore_nice;
++		ignore_nice = od_tuners->ignore_nice_load;
+ 	else
+-		ignore_nice = cs_tuners->ignore_nice;
++		ignore_nice = cs_tuners->ignore_nice_load;
+ 
+ 	policy = cdbs->cur_policy;
+ 
+@@ -336,12 +336,12 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
+ 		cs_tuners = dbs_data->tuners;
+ 		cs_dbs_info = dbs_data->cdata->get_cpu_dbs_info_s(cpu);
+ 		sampling_rate = cs_tuners->sampling_rate;
+-		ignore_nice = cs_tuners->ignore_nice;
++		ignore_nice = cs_tuners->ignore_nice_load;
+ 	} else {
+ 		od_tuners = dbs_data->tuners;
+ 		od_dbs_info = dbs_data->cdata->get_cpu_dbs_info_s(cpu);
+ 		sampling_rate = od_tuners->sampling_rate;
+-		ignore_nice = od_tuners->ignore_nice;
++		ignore_nice = od_tuners->ignore_nice_load;
+ 		od_ops = dbs_data->cdata->gov_ops;
+ 		io_busy = od_tuners->io_is_busy;
+ 	}
+diff --git a/drivers/cpufreq/cpufreq_governor.h b/drivers/cpufreq/cpufreq_governor.h
+index e16a961..0d9e6be 100644
+--- a/drivers/cpufreq/cpufreq_governor.h
++++ b/drivers/cpufreq/cpufreq_governor.h
+@@ -165,7 +165,7 @@ struct cs_cpu_dbs_info_s {
+ 
+ /* Per policy Governers sysfs tunables */
+ struct od_dbs_tuners {
+-	unsigned int ignore_nice;
++	unsigned int ignore_nice_load;
+ 	unsigned int sampling_rate;
+ 	unsigned int sampling_down_factor;
+ 	unsigned int up_threshold;
+@@ -175,7 +175,7 @@ struct od_dbs_tuners {
+ };
+ 
+ struct cs_dbs_tuners {
+-	unsigned int ignore_nice;
++	unsigned int ignore_nice_load;
+ 	unsigned int sampling_rate;
+ 	unsigned int sampling_down_factor;
+ 	unsigned int up_threshold;
+diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
+index 93eb5cb..c087347 100644
+--- a/drivers/cpufreq/cpufreq_ondemand.c
++++ b/drivers/cpufreq/cpufreq_ondemand.c
+@@ -403,8 +403,8 @@ static ssize_t store_sampling_down_factor(struct dbs_data *dbs_data,
+ 	return count;
+ }
+ 
+-static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
+-		size_t count)
++static ssize_t store_ignore_nice_load(struct dbs_data *dbs_data,
++		const char *buf, size_t count)
+ {
+ 	struct od_dbs_tuners *od_tuners = dbs_data->tuners;
+ 	unsigned int input;
+@@ -419,10 +419,10 @@ static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
+ 	if (input > 1)
+ 		input = 1;
+ 
+-	if (input == od_tuners->ignore_nice) { /* nothing to do */
++	if (input == od_tuners->ignore_nice_load) { /* nothing to do */
+ 		return count;
+ 	}
+-	od_tuners->ignore_nice = input;
++	od_tuners->ignore_nice_load = input;
+ 
+ 	/* we need to re-evaluate prev_cpu_idle */
+ 	for_each_online_cpu(j) {
+@@ -430,7 +430,7 @@ static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
+ 		dbs_info = &per_cpu(od_cpu_dbs_info, j);
+ 		dbs_info->cdbs.prev_cpu_idle = get_cpu_idle_time(j,
+ 			&dbs_info->cdbs.prev_cpu_wall, od_tuners->io_is_busy);
+-		if (od_tuners->ignore_nice)
++		if (od_tuners->ignore_nice_load)
+ 			dbs_info->cdbs.prev_cpu_nice =
+ 				kcpustat_cpu(j).cpustat[CPUTIME_NICE];
+ 
+@@ -461,7 +461,7 @@ show_store_one(od, sampling_rate);
+ show_store_one(od, io_is_busy);
+ show_store_one(od, up_threshold);
+ show_store_one(od, sampling_down_factor);
+-show_store_one(od, ignore_nice);
++show_store_one(od, ignore_nice_load);
+ show_store_one(od, powersave_bias);
+ declare_show_sampling_rate_min(od);
+ 
+@@ -469,7 +469,7 @@ gov_sys_pol_attr_rw(sampling_rate);
+ gov_sys_pol_attr_rw(io_is_busy);
+ gov_sys_pol_attr_rw(up_threshold);
+ gov_sys_pol_attr_rw(sampling_down_factor);
+-gov_sys_pol_attr_rw(ignore_nice);
++gov_sys_pol_attr_rw(ignore_nice_load);
+ gov_sys_pol_attr_rw(powersave_bias);
+ gov_sys_pol_attr_ro(sampling_rate_min);
+ 
+@@ -478,7 +478,7 @@ static struct attribute *dbs_attributes_gov_sys[] = {
+ 	&sampling_rate_gov_sys.attr,
+ 	&up_threshold_gov_sys.attr,
+ 	&sampling_down_factor_gov_sys.attr,
+-	&ignore_nice_gov_sys.attr,
++	&ignore_nice_load_gov_sys.attr,
+ 	&powersave_bias_gov_sys.attr,
+ 	&io_is_busy_gov_sys.attr,
+ 	NULL
+@@ -494,7 +494,7 @@ static struct attribute *dbs_attributes_gov_pol[] = {
+ 	&sampling_rate_gov_pol.attr,
+ 	&up_threshold_gov_pol.attr,
+ 	&sampling_down_factor_gov_pol.attr,
+-	&ignore_nice_gov_pol.attr,
++	&ignore_nice_load_gov_pol.attr,
+ 	&powersave_bias_gov_pol.attr,
+ 	&io_is_busy_gov_pol.attr,
+ 	NULL
+@@ -544,7 +544,7 @@ static int od_init(struct dbs_data *dbs_data)
+ 	}
+ 
+ 	tuners->sampling_down_factor = DEF_SAMPLING_DOWN_FACTOR;
+-	tuners->ignore_nice = 0;
++	tuners->ignore_nice_load = 0;
+ 	tuners->powersave_bias = default_powersave_bias;
+ 	tuners->io_is_busy = should_io_be_busy();
+ 
+diff --git a/drivers/cpufreq/loongson2_cpufreq.c b/drivers/cpufreq/loongson2_cpufreq.c
+index d539127..f92b02a 100644
+--- a/drivers/cpufreq/loongson2_cpufreq.c
++++ b/drivers/cpufreq/loongson2_cpufreq.c
+@@ -118,11 +118,6 @@ static int loongson2_cpufreq_cpu_init(struct cpufreq_policy *policy)
+ 		clk_put(cpuclk);
+ 		return -EINVAL;
+ 	}
+-	ret = clk_set_rate(cpuclk, rate);
+-	if (ret) {
+-		clk_put(cpuclk);
+-		return ret;
+-	}
+ 
+ 	/* clock table init */
+ 	for (i = 2;
+@@ -130,6 +125,12 @@ static int loongson2_cpufreq_cpu_init(struct cpufreq_policy *policy)
+ 	     i++)
+ 		loongson2_clockmod_table[i].frequency = (rate * i) / 8;
+ 
++	ret = clk_set_rate(cpuclk, rate);
++	if (ret) {
++		clk_put(cpuclk);
++		return ret;
++	}
++
+ 	policy->cur = loongson2_cpufreq_get(policy->cpu);
+ 
+ 	cpufreq_frequency_table_get_attr(&loongson2_clockmod_table[0],
+diff --git a/drivers/gpu/drm/ast/ast_ttm.c b/drivers/gpu/drm/ast/ast_ttm.c
+index 09da339..d5902e2 100644
+--- a/drivers/gpu/drm/ast/ast_ttm.c
++++ b/drivers/gpu/drm/ast/ast_ttm.c
+@@ -348,6 +348,7 @@ int ast_bo_create(struct drm_device *dev, int size, int align,
+ 
+ 	astbo->gem.driver_private = NULL;
+ 	astbo->bo.bdev = &ast->ttm.bdev;
++	astbo->bo.bdev->dev_mapping = dev->dev_mapping;
+ 
+ 	ast_ttm_placement(astbo, TTM_PL_FLAG_VRAM | TTM_PL_FLAG_SYSTEM);
+ 
+diff --git a/drivers/gpu/drm/cirrus/cirrus_ttm.c b/drivers/gpu/drm/cirrus/cirrus_ttm.c
+index 2ed8cfc..c18faff 100644
+--- a/drivers/gpu/drm/cirrus/cirrus_ttm.c
++++ b/drivers/gpu/drm/cirrus/cirrus_ttm.c
+@@ -353,6 +353,7 @@ int cirrus_bo_create(struct drm_device *dev, int size, int align,
+ 
+ 	cirrusbo->gem.driver_private = NULL;
+ 	cirrusbo->bo.bdev = &cirrus->ttm.bdev;
++	cirrusbo->bo.bdev->dev_mapping = dev->dev_mapping;
+ 
+ 	cirrus_ttm_placement(cirrusbo, TTM_PL_FLAG_VRAM | TTM_PL_FLAG_SYSTEM);
+ 
+diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
+index 8bcce78..f92da0a 100644
+--- a/drivers/gpu/drm/drm_irq.c
++++ b/drivers/gpu/drm/drm_irq.c
+@@ -708,7 +708,10 @@ int drm_calc_vbltimestamp_from_scanoutpos(struct drm_device *dev, int crtc,
+ 	/* Subtract time delta from raw timestamp to get final
+ 	 * vblank_time timestamp for end of vblank.
+ 	 */
+-	etime = ktime_sub_ns(etime, delta_ns);
++	if (delta_ns < 0)
++		etime = ktime_add_ns(etime, -delta_ns);
++	else
++		etime = ktime_sub_ns(etime, delta_ns);
+ 	*vblank_time = ktime_to_timeval(etime);
+ 
+ 	DRM_DEBUG("crtc %d : v %d p(%d,%d)@ %ld.%ld -> %ld.%ld [e %d us, %d rep]\n",
+diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
+index f968590..17d9b0b 100644
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -1514,6 +1514,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
+ 	spin_lock_init(&dev_priv->irq_lock);
+ 	spin_lock_init(&dev_priv->gpu_error.lock);
+ 	spin_lock_init(&dev_priv->rps.lock);
++	spin_lock_init(&dev_priv->gt_lock);
+ 	mutex_init(&dev_priv->dpio_lock);
+ 	mutex_init(&dev_priv->rps.hw_lock);
+ 	mutex_init(&dev_priv->modeset_restore_lock);
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 2cfe9f6..94ad6bc 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -4507,8 +4507,6 @@ void intel_gt_init(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 
+-	spin_lock_init(&dev_priv->gt_lock);
+-
+ 	if (IS_VALLEYVIEW(dev)) {
+ 		dev_priv->gt.force_wake_get = vlv_force_wake_get;
+ 		dev_priv->gt.force_wake_put = vlv_force_wake_put;
+diff --git a/drivers/gpu/drm/mgag200/mgag200_ttm.c b/drivers/gpu/drm/mgag200/mgag200_ttm.c
+index 401c989..d2cb32f 100644
+--- a/drivers/gpu/drm/mgag200/mgag200_ttm.c
++++ b/drivers/gpu/drm/mgag200/mgag200_ttm.c
+@@ -347,6 +347,7 @@ int mgag200_bo_create(struct drm_device *dev, int size, int align,
+ 
+ 	mgabo->gem.driver_private = NULL;
+ 	mgabo->bo.bdev = &mdev->ttm.bdev;
++	mgabo->bo.bdev->dev_mapping = dev->dev_mapping;
+ 
+ 	mgag200_ttm_placement(mgabo, TTM_PL_FLAG_VRAM | TTM_PL_FLAG_SYSTEM);
+ 
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index 0f89ce3..687b421 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -4681,6 +4681,8 @@ static int evergreen_startup(struct radeon_device *rdev)
+ 	/* enable pcie gen2 link */
+ 	evergreen_pcie_gen2_enable(rdev);
+ 
++	evergreen_mc_program(rdev);
++
+ 	if (ASIC_IS_DCE5(rdev)) {
+ 		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw || !rdev->mc_fw) {
+ 			r = ni_init_microcode(rdev);
+@@ -4708,7 +4710,6 @@ static int evergreen_startup(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
+-	evergreen_mc_program(rdev);
+ 	if (rdev->flags & RADEON_IS_AGP) {
+ 		evergreen_agp_enable(rdev);
+ 	} else {
+@@ -4854,10 +4855,10 @@ int evergreen_resume(struct radeon_device *rdev)
+ int evergreen_suspend(struct radeon_device *rdev)
+ {
+ 	r600_audio_fini(rdev);
++	r600_uvd_stop(rdev);
+ 	radeon_uvd_suspend(rdev);
+ 	r700_cp_stop(rdev);
+ 	r600_dma_stop(rdev);
+-	r600_uvd_rbc_stop(rdev);
+ 	evergreen_irq_suspend(rdev);
+ 	radeon_wb_disable(rdev);
+ 	evergreen_pcie_gart_disable(rdev);
+@@ -4988,6 +4989,7 @@ void evergreen_fini(struct radeon_device *rdev)
+ 	radeon_ib_pool_fini(rdev);
+ 	radeon_irq_kms_fini(rdev);
+ 	evergreen_pcie_gart_fini(rdev);
++	r600_uvd_stop(rdev);
+ 	radeon_uvd_fini(rdev);
+ 	r600_vram_scratch_fini(rdev);
+ 	radeon_gem_fini(rdev);
+diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
+index 8458330..3bf43a1 100644
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1929,6 +1929,8 @@ static int cayman_startup(struct radeon_device *rdev)
+ 	/* enable pcie gen2 link */
+ 	evergreen_pcie_gen2_enable(rdev);
+ 
++	evergreen_mc_program(rdev);
++
+ 	if (rdev->flags & RADEON_IS_IGP) {
+ 		if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
+ 			r = ni_init_microcode(rdev);
+@@ -1957,7 +1959,6 @@ static int cayman_startup(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
+-	evergreen_mc_program(rdev);
+ 	r = cayman_pcie_gart_enable(rdev);
+ 	if (r)
+ 		return r;
+@@ -2133,7 +2134,7 @@ int cayman_suspend(struct radeon_device *rdev)
+ 	radeon_vm_manager_fini(rdev);
+ 	cayman_cp_enable(rdev, false);
+ 	cayman_dma_stop(rdev);
+-	r600_uvd_rbc_stop(rdev);
++	r600_uvd_stop(rdev);
+ 	radeon_uvd_suspend(rdev);
+ 	evergreen_irq_suspend(rdev);
+ 	radeon_wb_disable(rdev);
+@@ -2265,6 +2266,7 @@ void cayman_fini(struct radeon_device *rdev)
+ 	radeon_vm_manager_fini(rdev);
+ 	radeon_ib_pool_fini(rdev);
+ 	radeon_irq_kms_fini(rdev);
++	r600_uvd_stop(rdev);
+ 	radeon_uvd_fini(rdev);
+ 	cayman_pcie_gart_fini(rdev);
+ 	r600_vram_scratch_fini(rdev);
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index b60004e..f19620b 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -2675,12 +2675,29 @@ int r600_uvd_rbc_start(struct radeon_device *rdev)
+ 	return 0;
+ }
+ 
+-void r600_uvd_rbc_stop(struct radeon_device *rdev)
++void r600_uvd_stop(struct radeon_device *rdev)
+ {
+ 	struct radeon_ring *ring = &rdev->ring[R600_RING_TYPE_UVD_INDEX];
+ 
+ 	/* force RBC into idle state */
+ 	WREG32(UVD_RBC_RB_CNTL, 0x11010101);
++
++	/* Stall UMC and register bus before resetting VCPU */
++	WREG32_P(UVD_LMI_CTRL2, 1 << 8, ~(1 << 8));
++	WREG32_P(UVD_RB_ARB_CTRL, 1 << 3, ~(1 << 3));
++	mdelay(1);
++
++	/* put VCPU into reset */
++	WREG32(UVD_SOFT_RESET, VCPU_SOFT_RESET);
++	mdelay(5);
++
++	/* disable VCPU clock */
++	WREG32(UVD_VCPU_CNTL, 0x0);
++
++	/* Unstall UMC and register bus */
++	WREG32_P(UVD_LMI_CTRL2, 0, ~(1 << 8));
++	WREG32_P(UVD_RB_ARB_CTRL, 0, ~(1 << 3));
++
+ 	ring->ready = false;
+ }
+ 
+@@ -2700,6 +2717,11 @@ int r600_uvd_init(struct radeon_device *rdev)
+ 	/* disable interupt */
+ 	WREG32_P(UVD_MASTINT_EN, 0, ~(1 << 1));
+ 
++	/* Stall UMC and register bus before resetting VCPU */
++	WREG32_P(UVD_LMI_CTRL2, 1 << 8, ~(1 << 8));
++	WREG32_P(UVD_RB_ARB_CTRL, 1 << 3, ~(1 << 3));
++	mdelay(1);
++
+ 	/* put LMI, VCPU, RBC etc... into reset */
+ 	WREG32(UVD_SOFT_RESET, LMI_SOFT_RESET | VCPU_SOFT_RESET |
+ 	       LBSI_SOFT_RESET | RBC_SOFT_RESET | CSM_SOFT_RESET |
+@@ -2729,10 +2751,6 @@ int r600_uvd_init(struct radeon_device *rdev)
+ 	WREG32(UVD_MPC_SET_ALU, 0);
+ 	WREG32(UVD_MPC_SET_MUX, 0x88);
+ 
+-	/* Stall UMC */
+-	WREG32_P(UVD_LMI_CTRL2, 1 << 8, ~(1 << 8));
+-	WREG32_P(UVD_RB_ARB_CTRL, 1 << 3, ~(1 << 3));
+-
+ 	/* take all subblocks out of reset, except VCPU */
+ 	WREG32(UVD_SOFT_RESET, VCPU_SOFT_RESET);
+ 	mdelay(5);
+@@ -3206,6 +3224,8 @@ static int r600_startup(struct radeon_device *rdev)
+ 	/* enable pcie gen2 link */
+ 	r600_pcie_gen2_enable(rdev);
+ 
++	r600_mc_program(rdev);
++
+ 	if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
+ 		r = r600_init_microcode(rdev);
+ 		if (r) {
+@@ -3218,7 +3238,6 @@ static int r600_startup(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
+-	r600_mc_program(rdev);
+ 	if (rdev->flags & RADEON_IS_AGP) {
+ 		r600_agp_enable(rdev);
+ 	} else {
+diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
+index f48240b..b9b1139 100644
+--- a/drivers/gpu/drm/radeon/r600_hdmi.c
++++ b/drivers/gpu/drm/radeon/r600_hdmi.c
+@@ -242,9 +242,15 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
+ 		/* according to the reg specs, this should DCE3.2 only, but in
+ 		 * practice it seems to cover DCE3.0 as well.
+ 		 */
+-		WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
+-		WREG32(DCCG_AUDIO_DTO0_MODULE, clock * 100);
+-		WREG32(DCCG_AUDIO_DTO_SELECT, 0); /* select DTO0 */
++		if (dig->dig_encoder == 0) {
++			WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
++			WREG32(DCCG_AUDIO_DTO0_MODULE, clock * 100);
++			WREG32(DCCG_AUDIO_DTO_SELECT, 0); /* select DTO0 */
++		} else {
++			WREG32(DCCG_AUDIO_DTO1_PHASE, base_rate * 100);
++			WREG32(DCCG_AUDIO_DTO1_MODULE, clock * 100);
++			WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
++		}
+ 	} else {
+ 		/* according to the reg specs, this should be DCE2.0 and DCE3.0 */
+ 		WREG32(AUDIO_DTO, AUDIO_DTO_PHASE(base_rate / 10) |
+diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
+index aad18e6..bdd9d56 100644
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -1146,7 +1146,6 @@ struct radeon_uvd {
+ 	void			*cpu_addr;
+ 	uint64_t		gpu_addr;
+ 	void			*saved_bo;
+-	unsigned		fw_size;
+ 	atomic_t		handles[RADEON_MAX_UVD_HANDLES];
+ 	struct drm_file		*filp[RADEON_MAX_UVD_HANDLES];
+ 	struct delayed_work	idle_work;
+@@ -1686,6 +1685,7 @@ struct radeon_device {
+ 	const struct firmware *rlc_fw;	/* r6/700 RLC firmware */
+ 	const struct firmware *mc_fw;	/* NI MC firmware */
+ 	const struct firmware *ce_fw;	/* SI CE firmware */
++	const struct firmware *uvd_fw;	/* UVD firmware */
+ 	struct r600_blit r600_blit;
+ 	struct r600_vram_scratch vram_scratch;
+ 	int msi_enabled; /* msi enabled */
+diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
+index a72759e..34223fc 100644
+--- a/drivers/gpu/drm/radeon/radeon_asic.h
++++ b/drivers/gpu/drm/radeon/radeon_asic.h
+@@ -399,7 +399,7 @@ uint64_t r600_get_gpu_clock_counter(struct radeon_device *rdev);
+ /* uvd */
+ int r600_uvd_init(struct radeon_device *rdev);
+ int r600_uvd_rbc_start(struct radeon_device *rdev);
+-void r600_uvd_rbc_stop(struct radeon_device *rdev);
++void r600_uvd_stop(struct radeon_device *rdev);
+ int r600_uvd_ib_test(struct radeon_device *rdev, struct radeon_ring *ring);
+ void r600_uvd_fence_emit(struct radeon_device *rdev,
+ 			 struct radeon_fence *fence);
+diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
+index 7ddb0ef..ddb8f8e 100644
+--- a/drivers/gpu/drm/radeon/radeon_fence.c
++++ b/drivers/gpu/drm/radeon/radeon_fence.c
+@@ -782,7 +782,7 @@ int radeon_fence_driver_start_ring(struct radeon_device *rdev, int ring)
+ 
+ 		} else {
+ 			/* put fence directly behind firmware */
+-			index = ALIGN(rdev->uvd.fw_size, 8);
++			index = ALIGN(rdev->uvd_fw->size, 8);
+ 			rdev->fence_drv[ring].cpu_addr = rdev->uvd.cpu_addr + index;
+ 			rdev->fence_drv[ring].gpu_addr = rdev->uvd.gpu_addr + index;
+ 		}
+diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
+index 1b3a91b..97002a0 100644
+--- a/drivers/gpu/drm/radeon/radeon_uvd.c
++++ b/drivers/gpu/drm/radeon/radeon_uvd.c
+@@ -55,7 +55,6 @@ static void radeon_uvd_idle_work_handler(struct work_struct *work);
+ int radeon_uvd_init(struct radeon_device *rdev)
+ {
+ 	struct platform_device *pdev;
+-	const struct firmware *fw;
+ 	unsigned long bo_size;
+ 	const char *fw_name;
+ 	int i, r;
+@@ -105,7 +104,7 @@ int radeon_uvd_init(struct radeon_device *rdev)
+ 		return -EINVAL;
+ 	}
+ 
+-	r = request_firmware(&fw, fw_name, &pdev->dev);
++	r = request_firmware(&rdev->uvd_fw, fw_name, &pdev->dev);
+ 	if (r) {
+ 		dev_err(rdev->dev, "radeon_uvd: Can't load firmware \"%s\"\n",
+ 			fw_name);
+@@ -115,7 +114,7 @@ int radeon_uvd_init(struct radeon_device *rdev)
+ 
+ 	platform_device_unregister(pdev);
+ 
+-	bo_size = RADEON_GPU_PAGE_ALIGN(fw->size + 8) +
++	bo_size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 8) +
+ 		  RADEON_UVD_STACK_SIZE + RADEON_UVD_HEAP_SIZE;
+ 	r = radeon_bo_create(rdev, bo_size, PAGE_SIZE, true,
+ 			     RADEON_GEM_DOMAIN_VRAM, NULL, &rdev->uvd.vcpu_bo);
+@@ -148,12 +147,6 @@ int radeon_uvd_init(struct radeon_device *rdev)
+ 
+ 	radeon_bo_unreserve(rdev->uvd.vcpu_bo);
+ 
+-	rdev->uvd.fw_size = fw->size;
+-	memset(rdev->uvd.cpu_addr, 0, bo_size);
+-	memcpy(rdev->uvd.cpu_addr, fw->data, fw->size);
+-
+-	release_firmware(fw);
+-
+ 	for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
+ 		atomic_set(&rdev->uvd.handles[i], 0);
+ 		rdev->uvd.filp[i] = NULL;
+@@ -177,33 +170,60 @@ void radeon_uvd_fini(struct radeon_device *rdev)
+ 	}
+ 
+ 	radeon_bo_unref(&rdev->uvd.vcpu_bo);
++
++	release_firmware(rdev->uvd_fw);
+ }
+ 
+ int radeon_uvd_suspend(struct radeon_device *rdev)
+ {
+ 	unsigned size;
++	void *ptr;
++	int i;
+ 
+ 	if (rdev->uvd.vcpu_bo == NULL)
+ 		return 0;
+ 
++	for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i)
++		if (atomic_read(&rdev->uvd.handles[i]))
++			break;
++
++	if (i == RADEON_MAX_UVD_HANDLES)
++		return 0;
++
+ 	size = radeon_bo_size(rdev->uvd.vcpu_bo);
++	size -= rdev->uvd_fw->size;
++
++	ptr = rdev->uvd.cpu_addr;
++	ptr += rdev->uvd_fw->size;
++
+ 	rdev->uvd.saved_bo = kmalloc(size, GFP_KERNEL);
+-	memcpy(rdev->uvd.saved_bo, rdev->uvd.cpu_addr, size);
++	memcpy(rdev->uvd.saved_bo, ptr, size);
+ 
+ 	return 0;
+ }
+ 
+ int radeon_uvd_resume(struct radeon_device *rdev)
+ {
++	unsigned size;
++	void *ptr;
++
+ 	if (rdev->uvd.vcpu_bo == NULL)
+ 		return -EINVAL;
+ 
++	memcpy(rdev->uvd.cpu_addr, rdev->uvd_fw->data, rdev->uvd_fw->size);
++
++	size = radeon_bo_size(rdev->uvd.vcpu_bo);
++	size -= rdev->uvd_fw->size;
++
++	ptr = rdev->uvd.cpu_addr;
++	ptr += rdev->uvd_fw->size;
++
+ 	if (rdev->uvd.saved_bo != NULL) {
+-		unsigned size = radeon_bo_size(rdev->uvd.vcpu_bo);
+-		memcpy(rdev->uvd.cpu_addr, rdev->uvd.saved_bo, size);
++		memcpy(ptr, rdev->uvd.saved_bo, size);
+ 		kfree(rdev->uvd.saved_bo);
+ 		rdev->uvd.saved_bo = NULL;
+-	}
++	} else
++		memset(ptr, 0, size);
+ 
+ 	return 0;
+ }
+@@ -218,8 +238,8 @@ void radeon_uvd_free_handles(struct radeon_device *rdev, struct drm_file *filp)
+ {
+ 	int i, r;
+ 	for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
+-		if (rdev->uvd.filp[i] == filp) {
+-			uint32_t handle = atomic_read(&rdev->uvd.handles[i]);
++		uint32_t handle = atomic_read(&rdev->uvd.handles[i]);
++		if (handle != 0 && rdev->uvd.filp[i] == filp) {
+ 			struct radeon_fence *fence;
+ 
+ 			r = radeon_uvd_get_destroy_msg(rdev,
+diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
+index 30ea14e..bcc68ec 100644
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -813,7 +813,7 @@ int rv770_uvd_resume(struct radeon_device *rdev)
+ 
+ 	/* programm the VCPU memory controller bits 0-27 */
+ 	addr = rdev->uvd.gpu_addr >> 3;
+-	size = RADEON_GPU_PAGE_ALIGN(rdev->uvd.fw_size + 4) >> 3;
++	size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 4) >> 3;
+ 	WREG32(UVD_VCPU_CACHE_OFFSET0, addr);
+ 	WREG32(UVD_VCPU_CACHE_SIZE0, size);
+ 
+@@ -1829,6 +1829,8 @@ static int rv770_startup(struct radeon_device *rdev)
+ 	/* enable pcie gen2 link */
+ 	rv770_pcie_gen2_enable(rdev);
+ 
++	rv770_mc_program(rdev);
++
+ 	if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
+ 		r = r600_init_microcode(rdev);
+ 		if (r) {
+@@ -1841,7 +1843,6 @@ static int rv770_startup(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
+-	rv770_mc_program(rdev);
+ 	if (rdev->flags & RADEON_IS_AGP) {
+ 		rv770_agp_enable(rdev);
+ 	} else {
+@@ -1983,6 +1984,7 @@ int rv770_resume(struct radeon_device *rdev)
+ int rv770_suspend(struct radeon_device *rdev)
+ {
+ 	r600_audio_fini(rdev);
++	r600_uvd_stop(rdev);
+ 	radeon_uvd_suspend(rdev);
+ 	r700_cp_stop(rdev);
+ 	r600_dma_stop(rdev);
+@@ -2098,6 +2100,7 @@ void rv770_fini(struct radeon_device *rdev)
+ 	radeon_ib_pool_fini(rdev);
+ 	radeon_irq_kms_fini(rdev);
+ 	rv770_pcie_gart_fini(rdev);
++	r600_uvd_stop(rdev);
+ 	radeon_uvd_fini(rdev);
+ 	r600_vram_scratch_fini(rdev);
+ 	radeon_gem_fini(rdev);
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index a1b0da6..1a96a16 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -5270,6 +5270,8 @@ static int si_startup(struct radeon_device *rdev)
+ 	struct radeon_ring *ring;
+ 	int r;
+ 
++	si_mc_program(rdev);
++
+ 	if (!rdev->me_fw || !rdev->pfp_fw || !rdev->ce_fw ||
+ 	    !rdev->rlc_fw || !rdev->mc_fw) {
+ 		r = si_init_microcode(rdev);
+@@ -5289,7 +5291,6 @@ static int si_startup(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 
+-	si_mc_program(rdev);
+ 	r = si_pcie_gart_enable(rdev);
+ 	if (r)
+ 		return r;
+@@ -5473,7 +5474,7 @@ int si_suspend(struct radeon_device *rdev)
+ 	si_cp_enable(rdev, false);
+ 	cayman_dma_stop(rdev);
+ 	if (rdev->has_uvd) {
+-		r600_uvd_rbc_stop(rdev);
++		r600_uvd_stop(rdev);
+ 		radeon_uvd_suspend(rdev);
+ 	}
+ 	si_irq_suspend(rdev);
+@@ -5613,8 +5614,10 @@ void si_fini(struct radeon_device *rdev)
+ 	radeon_vm_manager_fini(rdev);
+ 	radeon_ib_pool_fini(rdev);
+ 	radeon_irq_kms_fini(rdev);
+-	if (rdev->has_uvd)
++	if (rdev->has_uvd) {
++		r600_uvd_stop(rdev);
+ 		radeon_uvd_fini(rdev);
++	}
+ 	si_pcie_gart_fini(rdev);
+ 	r600_vram_scratch_fini(rdev);
+ 	radeon_gem_fini(rdev);
+diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
+index b83bf4b..5863735 100644
+--- a/drivers/hwmon/adt7470.c
++++ b/drivers/hwmon/adt7470.c
+@@ -215,7 +215,7 @@ static inline int adt7470_write_word_data(struct i2c_client *client, u8 reg,
+ 					  u16 value)
+ {
+ 	return i2c_smbus_write_byte_data(client, reg, value & 0xFF)
+-	       && i2c_smbus_write_byte_data(client, reg + 1, value >> 8);
++	       || i2c_smbus_write_byte_data(client, reg + 1, value >> 8);
+ }
+ 
+ static void adt7470_init_client(struct i2c_client *client)
+diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
+index 2039f23..6d8094d 100644
+--- a/drivers/i2c/busses/i2c-mxs.c
++++ b/drivers/i2c/busses/i2c-mxs.c
+@@ -494,7 +494,7 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
+ 	 * based on this empirical measurement and a lot of previous frobbing.
+ 	 */
+ 	i2c->cmd_err = 0;
+-	if (msg->len < 8) {
++	if (0) {	/* disable PIO mode until a proper fix is made */
+ 		ret = mxs_i2c_pio_setup_xfer(adap, msg, flags);
+ 		if (ret)
+ 			mxs_i2c_reset(i2c);
+diff --git a/drivers/media/usb/em28xx/em28xx-i2c.c b/drivers/media/usb/em28xx/em28xx-i2c.c
+index 4851cc2..c4ff973 100644
+--- a/drivers/media/usb/em28xx/em28xx-i2c.c
++++ b/drivers/media/usb/em28xx/em28xx-i2c.c
+@@ -726,7 +726,7 @@ static int em28xx_i2c_eeprom(struct em28xx *dev, unsigned bus,
+ 
+ 	*eedata = data;
+ 	*eedata_len = len;
+-	dev_config = (void *)eedata;
++	dev_config = (void *)*eedata;
+ 
+ 	switch (le16_to_cpu(dev_config->chip_conf) >> 4 & 0x3) {
+ 	case 0:
+diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
+index a60f6c1..50543f1 100644
+--- a/drivers/mtd/nand/Kconfig
++++ b/drivers/mtd/nand/Kconfig
+@@ -95,7 +95,7 @@ config MTD_NAND_OMAP2
+ 
+ config MTD_NAND_OMAP_BCH
+ 	depends on MTD_NAND && MTD_NAND_OMAP2 && ARCH_OMAP3
+-	bool "Enable support for hardware BCH error correction"
++	tristate "Enable support for hardware BCH error correction"
+ 	default n
+ 	select BCH
+ 	select BCH_CONST_PARAMS
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 89178b8..9b60dc1 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3508,11 +3508,21 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ 		break;
+ 	}
+ 
+-	/*
+-	 * We expect the FW state to be READY
+-	 */
+-	if (megasas_transition_to_ready(instance, 0))
+-		goto fail_ready_state;
++	if (megasas_transition_to_ready(instance, 0)) {
++		atomic_set(&instance->fw_reset_no_pci_access, 1);
++		instance->instancet->adp_reset
++			(instance, instance->reg_set);
++		atomic_set(&instance->fw_reset_no_pci_access, 0);
++		dev_info(&instance->pdev->dev,
++			"megasas: FW restarted successfully from %s!\n",
++			__func__);
++
++		/*waitting for about 30 second before retry*/
++		ssleep(30);
++
++		if (megasas_transition_to_ready(instance, 0))
++			goto fail_ready_state;
++	}
+ 
+ 	/* Check if MSI-X is supported while in ready state */
+ 	msix_enable = (instance->instancet->read_fw_status_reg(reg_set) &
+diff --git a/drivers/scsi/nsp32.c b/drivers/scsi/nsp32.c
+index 1e3879d..0665f9c 100644
+--- a/drivers/scsi/nsp32.c
++++ b/drivers/scsi/nsp32.c
+@@ -2899,7 +2899,7 @@ static void nsp32_do_bus_reset(nsp32_hw_data *data)
+ 	 * reset SCSI bus
+ 	 */
+ 	nsp32_write1(base, SCSI_BUS_CONTROL, BUSCTL_RST);
+-	udelay(RESET_HOLD_TIME);
++	mdelay(RESET_HOLD_TIME / 1000);
+ 	nsp32_write1(base, SCSI_BUS_CONTROL, 0);
+ 	for(i = 0; i < 5; i++) {
+ 		intrdat = nsp32_read2(base, IRQ_STATUS); /* dummy read */
+diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
+index 3b1ea34..eaa808e 100644
+--- a/drivers/scsi/scsi.c
++++ b/drivers/scsi/scsi.c
+@@ -1031,6 +1031,9 @@ int scsi_get_vpd_page(struct scsi_device *sdev, u8 page, unsigned char *buf,
+ {
+ 	int i, result;
+ 
++	if (sdev->skip_vpd_pages)
++		goto fail;
++
+ 	/* Ask for all the pages supported by this device */
+ 	result = scsi_vpd_inquiry(sdev, buf, 0, buf_len);
+ 	if (result)
+diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
+index 2168258..74b88ef 100644
+--- a/drivers/scsi/virtio_scsi.c
++++ b/drivers/scsi/virtio_scsi.c
+@@ -751,7 +751,7 @@ static void __virtscsi_set_affinity(struct virtio_scsi *vscsi, bool affinity)
+ 
+ 		vscsi->affinity_hint_set = true;
+ 	} else {
+-		for (i = 0; i < vscsi->num_queues - VIRTIO_SCSI_VQ_BASE; i++)
++		for (i = 0; i < vscsi->num_queues; i++)
+ 			virtqueue_set_affinity(vscsi->req_vqs[i].vq, -1);
+ 
+ 		vscsi->affinity_hint_set = false;
+diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
+index dcceed2..81972fa 100644
+--- a/drivers/staging/zcache/zcache-main.c
++++ b/drivers/staging/zcache/zcache-main.c
+@@ -1811,10 +1811,12 @@ static int zcache_comp_init(void)
+ #else
+ 	if (*zcache_comp_name != '\0') {
+ 		ret = crypto_has_comp(zcache_comp_name, 0, 0);
+-		if (!ret)
++		if (!ret) {
+ 			pr_info("zcache: %s not supported\n",
+ 					zcache_comp_name);
+-		goto out;
++			ret = 1;
++			goto out;
++		}
+ 	}
+ 	if (!ret)
+ 		strcpy(zcache_comp_name, "lzo");
+diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
+index 1742ce5..a333d44 100644
+--- a/drivers/staging/zram/zram_drv.c
++++ b/drivers/staging/zram/zram_drv.c
+@@ -432,7 +432,7 @@ static inline int valid_io_request(struct zram *zram, struct bio *bio)
+ 	end = start + (bio->bi_size >> SECTOR_SHIFT);
+ 	bound = zram->disksize >> SECTOR_SHIFT;
+ 	/* out of range range */
+-	if (unlikely(start >= bound || end >= bound || start > end))
++	if (unlikely(start >= bound || end > bound || start > end))
+ 		return 0;
+ 
+ 	/* I/O request is valid */
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index b93fc88..da2905a 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -4796,7 +4796,8 @@ static void hub_events(void)
+ 					hub->ports[i - 1]->child;
+ 
+ 				dev_dbg(hub_dev, "warm reset port %d\n", i);
+-				if (!udev) {
++				if (!udev || !(portstatus &
++						USB_PORT_STAT_CONNECTION)) {
+ 					status = hub_port_reset(hub, i,
+ 							NULL, HUB_BH_RESET_TIME,
+ 							true);
+@@ -4806,8 +4807,8 @@ static void hub_events(void)
+ 					usb_lock_device(udev);
+ 					status = usb_reset_device(udev);
+ 					usb_unlock_device(udev);
++					connect_change = 0;
+ 				}
+-				connect_change = 0;
+ 			}
+ 
+ 			if (connect_change)
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index c276ac9..cf68596 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3728,8 +3728,9 @@ next_slot:
+ 	}
+ 
+ log_extents:
++	btrfs_release_path(path);
++	btrfs_release_path(dst_path);
+ 	if (fast_search) {
+-		btrfs_release_path(dst_path);
+ 		ret = btrfs_log_changed_extents(trans, root, inode, dst_path);
+ 		if (ret) {
+ 			err = ret;
+@@ -3746,8 +3747,6 @@ log_extents:
+ 	}
+ 
+ 	if (inode_only == LOG_INODE_ALL && S_ISDIR(inode->i_mode)) {
+-		btrfs_release_path(path);
+-		btrfs_release_path(dst_path);
+ 		ret = log_directory_changes(trans, root, inode, path, dst_path);
+ 		if (ret) {
+ 			err = ret;
+diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
+index f59d0d5..5c807b2 100644
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -389,7 +389,7 @@ find_domain_name(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ 		if (blobptr + attrsize > blobend)
+ 			break;
+ 		if (type == NTLMSSP_AV_NB_DOMAIN_NAME) {
+-			if (!attrsize)
++			if (!attrsize || attrsize >= CIFS_MAX_DOMAINNAME_LEN)
+ 				break;
+ 			if (!ses->domainName) {
+ 				ses->domainName =
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 4f07f6f..ea3a0b3 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -44,6 +44,7 @@
+ #define MAX_TREE_SIZE (2 + MAX_SERVER_SIZE + 1 + MAX_SHARE_SIZE + 1)
+ #define MAX_SERVER_SIZE 15
+ #define MAX_SHARE_SIZE 80
++#define CIFS_MAX_DOMAINNAME_LEN 256 /* max domain name length */
+ #define MAX_USERNAME_SIZE 256	/* reasonable maximum for current servers */
+ #define MAX_PASSWORD_SIZE 512	/* max for windows seems to be 256 wide chars */
+ 
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index e3bc39b..d6a5c5a 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -1662,7 +1662,8 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+ 			if (string == NULL)
+ 				goto out_nomem;
+ 
+-			if (strnlen(string, 256) == 256) {
++			if (strnlen(string, CIFS_MAX_DOMAINNAME_LEN)
++					== CIFS_MAX_DOMAINNAME_LEN) {
+ 				printk(KERN_WARNING "CIFS: domain name too"
+ 						    " long\n");
+ 				goto cifs_parse_mount_err;
+@@ -2288,8 +2289,8 @@ cifs_put_smb_ses(struct cifs_ses *ses)
+ 
+ #ifdef CONFIG_KEYS
+ 
+-/* strlen("cifs:a:") + INET6_ADDRSTRLEN + 1 */
+-#define CIFSCREDS_DESC_SIZE (7 + INET6_ADDRSTRLEN + 1)
++/* strlen("cifs:a:") + CIFS_MAX_DOMAINNAME_LEN + 1 */
++#define CIFSCREDS_DESC_SIZE (7 + CIFS_MAX_DOMAINNAME_LEN + 1)
+ 
+ /* Populate username and pw fields from keyring if possible */
+ static int
+diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
+index 770d5a9..036279c 100644
+--- a/fs/cifs/readdir.c
++++ b/fs/cifs/readdir.c
+@@ -111,6 +111,14 @@ cifs_prime_dcache(struct dentry *parent, struct qstr *name,
+ 			return;
+ 	}
+ 
++	/*
++	 * If we know that the inode will need to be revalidated immediately,
++	 * then don't create a new dentry for it. We'll end up doing an on
++	 * the wire call either way and this spares us an invalidation.
++	 */
++	if (fattr->cf_flags & CIFS_FATTR_NEED_REVAL)
++		return;
++
+ 	dentry = d_alloc(parent, name);
+ 	if (!dentry)
+ 		return;
+diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
+index f230571..8edc9eb 100644
+--- a/fs/cifs/sess.c
++++ b/fs/cifs/sess.c
+@@ -198,7 +198,7 @@ static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
+ 		bytes_ret = 0;
+ 	} else
+ 		bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
+-					    256, nls_cp);
++					    CIFS_MAX_DOMAINNAME_LEN, nls_cp);
+ 	bcc_ptr += 2 * bytes_ret;
+ 	bcc_ptr += 2;  /* account for null terminator */
+ 
+@@ -256,8 +256,8 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
+ 
+ 	/* copy domain */
+ 	if (ses->domainName != NULL) {
+-		strncpy(bcc_ptr, ses->domainName, 256);
+-		bcc_ptr += strnlen(ses->domainName, 256);
++		strncpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
++		bcc_ptr += strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
+ 	} /* else we will send a null domain name
+ 	     so the server will default to its own domain */
+ 	*bcc_ptr = 0;
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index 4888cb3..c7c83ff 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -533,8 +533,7 @@ EXPORT_SYMBOL_GPL(debugfs_remove);
+  */
+ void debugfs_remove_recursive(struct dentry *dentry)
+ {
+-	struct dentry *child;
+-	struct dentry *parent;
++	struct dentry *child, *next, *parent;
+ 
+ 	if (IS_ERR_OR_NULL(dentry))
+ 		return;
+@@ -544,61 +543,37 @@ void debugfs_remove_recursive(struct dentry *dentry)
+ 		return;
+ 
+ 	parent = dentry;
++ down:
+ 	mutex_lock(&parent->d_inode->i_mutex);
++	list_for_each_entry_safe(child, next, &parent->d_subdirs, d_u.d_child) {
++		if (!debugfs_positive(child))
++			continue;
+ 
+-	while (1) {
+-		/*
+-		 * When all dentries under "parent" has been removed,
+-		 * walk up the tree until we reach our starting point.
+-		 */
+-		if (list_empty(&parent->d_subdirs)) {
+-			mutex_unlock(&parent->d_inode->i_mutex);
+-			if (parent == dentry)
+-				break;
+-			parent = parent->d_parent;
+-			mutex_lock(&parent->d_inode->i_mutex);
+-		}
+-		child = list_entry(parent->d_subdirs.next, struct dentry,
+-				d_u.d_child);
+- next_sibling:
+-
+-		/*
+-		 * If "child" isn't empty, walk down the tree and
+-		 * remove all its descendants first.
+-		 */
++		/* perhaps simple_empty(child) makes more sense */
+ 		if (!list_empty(&child->d_subdirs)) {
+ 			mutex_unlock(&parent->d_inode->i_mutex);
+ 			parent = child;
+-			mutex_lock(&parent->d_inode->i_mutex);
+-			continue;
++			goto down;
+ 		}
+-		__debugfs_remove(child, parent);
+-		if (parent->d_subdirs.next == &child->d_u.d_child) {
+-			/*
+-			 * Try the next sibling.
+-			 */
+-			if (child->d_u.d_child.next != &parent->d_subdirs) {
+-				child = list_entry(child->d_u.d_child.next,
+-						   struct dentry,
+-						   d_u.d_child);
+-				goto next_sibling;
+-			}
+-
+-			/*
+-			 * Avoid infinite loop if we fail to remove
+-			 * one dentry.
+-			 */
+-			mutex_unlock(&parent->d_inode->i_mutex);
+-			break;
+-		}
+-		simple_release_fs(&debugfs_mount, &debugfs_mount_count);
++ up:
++		if (!__debugfs_remove(child, parent))
++			simple_release_fs(&debugfs_mount, &debugfs_mount_count);
+ 	}
+ 
+-	parent = dentry->d_parent;
++	mutex_unlock(&parent->d_inode->i_mutex);
++	child = parent;
++	parent = parent->d_parent;
+ 	mutex_lock(&parent->d_inode->i_mutex);
+-	__debugfs_remove(dentry, parent);
++
++	if (child != dentry) {
++		next = list_entry(child->d_u.d_child.next, struct dentry,
++					d_u.d_child);
++		goto up;
++	}
++
++	if (!__debugfs_remove(child, parent))
++		simple_release_fs(&debugfs_mount, &debugfs_mount_count);
+ 	mutex_unlock(&parent->d_inode->i_mutex);
+-	simple_release_fs(&debugfs_mount, &debugfs_mount_count);
+ }
+ EXPORT_SYMBOL_GPL(debugfs_remove_recursive);
+ 
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index fddf3d9..dc1e030 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4389,7 +4389,7 @@ void ext4_ext_truncate(handle_t *handle, struct inode *inode)
+ retry:
+ 	err = ext4_es_remove_extent(inode, last_block,
+ 				    EXT_MAX_BLOCKS - last_block);
+-	if (err == ENOMEM) {
++	if (err == -ENOMEM) {
+ 		cond_resched();
+ 		congestion_wait(BLK_RW_ASYNC, HZ/50);
+ 		goto retry;
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 00a818d..3da3bf1 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -734,11 +734,8 @@ repeat_in_this_group:
+ 		ino = ext4_find_next_zero_bit((unsigned long *)
+ 					      inode_bitmap_bh->b_data,
+ 					      EXT4_INODES_PER_GROUP(sb), ino);
+-		if (ino >= EXT4_INODES_PER_GROUP(sb)) {
+-			if (++group == ngroups)
+-				group = 0;
+-			continue;
+-		}
++		if (ino >= EXT4_INODES_PER_GROUP(sb))
++			goto next_group;
+ 		if (group == 0 && (ino+1) < EXT4_FIRST_INO(sb)) {
+ 			ext4_error(sb, "reserved inode found cleared - "
+ 				   "inode=%lu", ino + 1);
+@@ -768,6 +765,9 @@ repeat_in_this_group:
+ 			goto got; /* we grabbed the inode! */
+ 		if (ino < EXT4_INODES_PER_GROUP(sb))
+ 			goto repeat_in_this_group;
++next_group:
++		if (++group == ngroups)
++			group = 0;
+ 	}
+ 	err = -ENOSPC;
+ 	goto out;
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 9491ac0..c0427e2 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -77,8 +77,10 @@ static void swap_inode_data(struct inode *inode1, struct inode *inode2)
+ 	memswap(ei1->i_data, ei2->i_data, sizeof(ei1->i_data));
+ 	memswap(&ei1->i_flags, &ei2->i_flags, sizeof(ei1->i_flags));
+ 	memswap(&ei1->i_disksize, &ei2->i_disksize, sizeof(ei1->i_disksize));
+-	memswap(&ei1->i_es_tree, &ei2->i_es_tree, sizeof(ei1->i_es_tree));
+-	memswap(&ei1->i_es_lru_nr, &ei2->i_es_lru_nr, sizeof(ei1->i_es_lru_nr));
++	ext4_es_remove_extent(inode1, 0, EXT_MAX_BLOCKS);
++	ext4_es_remove_extent(inode2, 0, EXT_MAX_BLOCKS);
++	ext4_es_lru_del(inode1);
++	ext4_es_lru_del(inode2);
+ 
+ 	isize = i_size_read(inode1);
+ 	i_size_write(inode1, i_size_read(inode2));
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 6681c03..3f7c39e 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1341,7 +1341,7 @@ static const struct mount_opts {
+ 	{Opt_delalloc, EXT4_MOUNT_DELALLOC,
+ 	 MOPT_EXT4_ONLY | MOPT_SET | MOPT_EXPLICIT},
+ 	{Opt_nodelalloc, EXT4_MOUNT_DELALLOC,
+-	 MOPT_EXT4_ONLY | MOPT_CLEAR | MOPT_EXPLICIT},
++	 MOPT_EXT4_ONLY | MOPT_CLEAR},
+ 	{Opt_journal_checksum, EXT4_MOUNT_JOURNAL_CHECKSUM,
+ 	 MOPT_EXT4_ONLY | MOPT_SET},
+ 	{Opt_journal_async_commit, (EXT4_MOUNT_JOURNAL_ASYNC_COMMIT |
+@@ -3445,7 +3445,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ 		}
+ 		if (test_opt(sb, DIOREAD_NOLOCK)) {
+ 			ext4_msg(sb, KERN_ERR, "can't mount with "
+-				 "both data=journal and delalloc");
++				 "both data=journal and dioread_nolock");
+ 			goto failed_mount;
+ 		}
+ 		if (test_opt(sb, DELALLOC))
+@@ -4646,6 +4646,21 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ 		goto restore_opts;
+ 	}
+ 
++	if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) {
++		if (test_opt2(sb, EXPLICIT_DELALLOC)) {
++			ext4_msg(sb, KERN_ERR, "can't mount with "
++				 "both data=journal and delalloc");
++			err = -EINVAL;
++			goto restore_opts;
++		}
++		if (test_opt(sb, DIOREAD_NOLOCK)) {
++			ext4_msg(sb, KERN_ERR, "can't mount with "
++				 "both data=journal and dioread_nolock");
++			err = -EINVAL;
++			goto restore_opts;
++		}
++	}
++
+ 	if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED)
+ 		ext4_abort(sb, "Abort forced by user");
+ 
+@@ -5400,6 +5415,7 @@ static void __exit ext4_exit_fs(void)
+ 	kset_unregister(ext4_kset);
+ 	ext4_exit_system_zone();
+ 	ext4_exit_pageio();
++	ext4_exit_es();
+ }
+ 
+ MODULE_AUTHOR("Remy Card, Stephen Tweedie, Andrew Morton, Andreas Dilger, Theodore Ts'o and others");
+diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
+index 01bfe76..41e491b 100644
+--- a/fs/lockd/clntlock.c
++++ b/fs/lockd/clntlock.c
+@@ -64,12 +64,17 @@ struct nlm_host *nlmclnt_init(const struct nlmclnt_initdata *nlm_init)
+ 				   nlm_init->protocol, nlm_version,
+ 				   nlm_init->hostname, nlm_init->noresvport,
+ 				   nlm_init->net);
+-	if (host == NULL) {
+-		lockd_down(nlm_init->net);
+-		return ERR_PTR(-ENOLCK);
+-	}
++	if (host == NULL)
++		goto out_nohost;
++	if (host->h_rpcclnt == NULL && nlm_bind_host(host) == NULL)
++		goto out_nobind;
+ 
+ 	return host;
++out_nobind:
++	nlmclnt_release_host(host);
++out_nohost:
++	lockd_down(nlm_init->net);
++	return ERR_PTR(-ENOLCK);
+ }
+ EXPORT_SYMBOL_GPL(nlmclnt_init);
+ 
+diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
+index 9760ecb..acd3947 100644
+--- a/fs/lockd/clntproc.c
++++ b/fs/lockd/clntproc.c
+@@ -125,14 +125,15 @@ static void nlmclnt_setlockargs(struct nlm_rqst *req, struct file_lock *fl)
+ {
+ 	struct nlm_args	*argp = &req->a_args;
+ 	struct nlm_lock	*lock = &argp->lock;
++	char *nodename = req->a_host->h_rpcclnt->cl_nodename;
+ 
+ 	nlmclnt_next_cookie(&argp->cookie);
+ 	memcpy(&lock->fh, NFS_FH(file_inode(fl->fl_file)), sizeof(struct nfs_fh));
+-	lock->caller  = utsname()->nodename;
++	lock->caller  = nodename;
+ 	lock->oh.data = req->a_owner;
+ 	lock->oh.len  = snprintf(req->a_owner, sizeof(req->a_owner), "%u@%s",
+ 				(unsigned int)fl->fl_u.nfs_fl.owner->pid,
+-				utsname()->nodename);
++				nodename);
+ 	lock->svid = fl->fl_u.nfs_fl.owner->pid;
+ 	lock->fl.fl_start = fl->fl_start;
+ 	lock->fl.fl_end = fl->fl_end;
+diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
+index 33532f7..1d48974 100644
+--- a/fs/reiserfs/procfs.c
++++ b/fs/reiserfs/procfs.c
+@@ -19,12 +19,13 @@
+ /*
+  * LOCKING:
+  *
+- * We rely on new Alexander Viro's super-block locking.
++ * These guys are evicted from procfs as the very first step in ->kill_sb().
+  *
+  */
+ 
+-static int show_version(struct seq_file *m, struct super_block *sb)
++static int show_version(struct seq_file *m, void *unused)
+ {
++	struct super_block *sb = m->private;
+ 	char *format;
+ 
+ 	if (REISERFS_SB(sb)->s_properties & (1 << REISERFS_3_6)) {
+@@ -66,8 +67,9 @@ static int show_version(struct seq_file *m, struct super_block *sb)
+ #define DJP( x ) le32_to_cpu( jp -> x )
+ #define JF( x ) ( r -> s_journal -> x )
+ 
+-static int show_super(struct seq_file *m, struct super_block *sb)
++static int show_super(struct seq_file *m, void *unused)
+ {
++	struct super_block *sb = m->private;
+ 	struct reiserfs_sb_info *r = REISERFS_SB(sb);
+ 
+ 	seq_printf(m, "state: \t%s\n"
+@@ -128,8 +130,9 @@ static int show_super(struct seq_file *m, struct super_block *sb)
+ 	return 0;
+ }
+ 
+-static int show_per_level(struct seq_file *m, struct super_block *sb)
++static int show_per_level(struct seq_file *m, void *unused)
+ {
++	struct super_block *sb = m->private;
+ 	struct reiserfs_sb_info *r = REISERFS_SB(sb);
+ 	int level;
+ 
+@@ -186,8 +189,9 @@ static int show_per_level(struct seq_file *m, struct super_block *sb)
+ 	return 0;
+ }
+ 
+-static int show_bitmap(struct seq_file *m, struct super_block *sb)
++static int show_bitmap(struct seq_file *m, void *unused)
+ {
++	struct super_block *sb = m->private;
+ 	struct reiserfs_sb_info *r = REISERFS_SB(sb);
+ 
+ 	seq_printf(m, "free_block: %lu\n"
+@@ -218,8 +222,9 @@ static int show_bitmap(struct seq_file *m, struct super_block *sb)
+ 	return 0;
+ }
+ 
+-static int show_on_disk_super(struct seq_file *m, struct super_block *sb)
++static int show_on_disk_super(struct seq_file *m, void *unused)
+ {
++	struct super_block *sb = m->private;
+ 	struct reiserfs_sb_info *sb_info = REISERFS_SB(sb);
+ 	struct reiserfs_super_block *rs = sb_info->s_rs;
+ 	int hash_code = DFL(s_hash_function_code);
+@@ -261,8 +266,9 @@ static int show_on_disk_super(struct seq_file *m, struct super_block *sb)
+ 	return 0;
+ }
+ 
+-static int show_oidmap(struct seq_file *m, struct super_block *sb)
++static int show_oidmap(struct seq_file *m, void *unused)
+ {
++	struct super_block *sb = m->private;
+ 	struct reiserfs_sb_info *sb_info = REISERFS_SB(sb);
+ 	struct reiserfs_super_block *rs = sb_info->s_rs;
+ 	unsigned int mapsize = le16_to_cpu(rs->s_v1.s_oid_cursize);
+@@ -291,8 +297,9 @@ static int show_oidmap(struct seq_file *m, struct super_block *sb)
+ 	return 0;
+ }
+ 
+-static int show_journal(struct seq_file *m, struct super_block *sb)
++static int show_journal(struct seq_file *m, void *unused)
+ {
++	struct super_block *sb = m->private;
+ 	struct reiserfs_sb_info *r = REISERFS_SB(sb);
+ 	struct reiserfs_super_block *rs = r->s_rs;
+ 	struct journal_params *jp = &rs->s_v1.s_journal;
+@@ -383,92 +390,24 @@ static int show_journal(struct seq_file *m, struct super_block *sb)
+ 	return 0;
+ }
+ 
+-/* iterator */
+-static int test_sb(struct super_block *sb, void *data)
+-{
+-	return data == sb;
+-}
+-
+-static int set_sb(struct super_block *sb, void *data)
+-{
+-	return -ENOENT;
+-}
+-
+-struct reiserfs_seq_private {
+-	struct super_block *sb;
+-	int (*show) (struct seq_file *, struct super_block *);
+-};
+-
+-static void *r_start(struct seq_file *m, loff_t * pos)
+-{
+-	struct reiserfs_seq_private *priv = m->private;
+-	loff_t l = *pos;
+-
+-	if (l)
+-		return NULL;
+-
+-	if (IS_ERR(sget(&reiserfs_fs_type, test_sb, set_sb, 0, priv->sb)))
+-		return NULL;
+-
+-	up_write(&priv->sb->s_umount);
+-	return priv->sb;
+-}
+-
+-static void *r_next(struct seq_file *m, void *v, loff_t * pos)
+-{
+-	++*pos;
+-	if (v)
+-		deactivate_super(v);
+-	return NULL;
+-}
+-
+-static void r_stop(struct seq_file *m, void *v)
+-{
+-	if (v)
+-		deactivate_super(v);
+-}
+-
+-static int r_show(struct seq_file *m, void *v)
+-{
+-	struct reiserfs_seq_private *priv = m->private;
+-	return priv->show(m, v);
+-}
+-
+-static const struct seq_operations r_ops = {
+-	.start = r_start,
+-	.next = r_next,
+-	.stop = r_stop,
+-	.show = r_show,
+-};
+-
+ static int r_open(struct inode *inode, struct file *file)
+ {
+-	struct reiserfs_seq_private *priv;
+-	int ret = seq_open_private(file, &r_ops,
+-				   sizeof(struct reiserfs_seq_private));
+-
+-	if (!ret) {
+-		struct seq_file *m = file->private_data;
+-		priv = m->private;
+-		priv->sb = proc_get_parent_data(inode);
+-		priv->show = PDE_DATA(inode);
+-	}
+-	return ret;
++	return single_open(file, PDE_DATA(inode),
++				proc_get_parent_data(inode));
+ }
+ 
+ static const struct file_operations r_file_operations = {
+ 	.open = r_open,
+ 	.read = seq_read,
+ 	.llseek = seq_lseek,
+-	.release = seq_release_private,
+-	.owner = THIS_MODULE,
++	.release = single_release,
+ };
+ 
+ static struct proc_dir_entry *proc_info_root = NULL;
+ static const char proc_info_root_name[] = "fs/reiserfs";
+ 
+ static void add_file(struct super_block *sb, char *name,
+-		     int (*func) (struct seq_file *, struct super_block *))
++		     int (*func) (struct seq_file *, void *))
+ {
+ 	proc_create_data(name, 0, REISERFS_SB(sb)->procdir,
+ 			 &r_file_operations, func);
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index f8a23c3..e2e202a 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -499,6 +499,7 @@ int remove_save_link(struct inode *inode, int truncate)
+ static void reiserfs_kill_sb(struct super_block *s)
+ {
+ 	if (REISERFS_SB(s)) {
++		reiserfs_proc_info_done(s);
+ 		/*
+ 		 * Force any pending inode evictions to occur now. Any
+ 		 * inodes to be removed that have extended attributes
+@@ -554,8 +555,6 @@ static void reiserfs_put_super(struct super_block *s)
+ 				 REISERFS_SB(s)->reserved_blocks);
+ 	}
+ 
+-	reiserfs_proc_info_done(s);
+-
+ 	reiserfs_write_unlock(s);
+ 	mutex_destroy(&REISERFS_SB(s)->lock);
+ 	kfree(s->s_fs_info);
+diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
+index 4372658..44cdc11 100644
+--- a/include/linux/ftrace_event.h
++++ b/include/linux/ftrace_event.h
+@@ -78,6 +78,11 @@ struct trace_iterator {
+ 	/* trace_seq for __print_flags() and __print_symbolic() etc. */
+ 	struct trace_seq	tmp_seq;
+ 
++	cpumask_var_t		started;
++
++	/* it's true when current open file is snapshot */
++	bool			snapshot;
++
+ 	/* The below is zeroed out in pipe_read */
+ 	struct trace_seq	seq;
+ 	struct trace_entry	*ent;
+@@ -90,10 +95,7 @@ struct trace_iterator {
+ 	loff_t			pos;
+ 	long			idx;
+ 
+-	cpumask_var_t		started;
+-
+-	/* it's true when current open file is snapshot */
+-	bool			snapshot;
++	/* All new field here will be zeroed out in pipe_read */
+ };
+ 
+ enum trace_iter_flags {
+diff --git a/include/linux/regmap.h b/include/linux/regmap.h
+index 02d84e2..f91bb41 100644
+--- a/include/linux/regmap.h
++++ b/include/linux/regmap.h
+@@ -15,6 +15,7 @@
+ 
+ #include <linux/list.h>
+ #include <linux/rbtree.h>
++#include <linux/err.h>
+ 
+ struct module;
+ struct device;
+diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
+index 84ca436..9faf0f4 100644
+--- a/include/linux/sunrpc/sched.h
++++ b/include/linux/sunrpc/sched.h
+@@ -130,6 +130,7 @@ struct rpc_task_setup {
+ #define RPC_TASK_SOFTCONN	0x0400		/* Fail if can't connect */
+ #define RPC_TASK_SENT		0x0800		/* message was sent */
+ #define RPC_TASK_TIMEOUT	0x1000		/* fail with ETIMEDOUT on timeout */
++#define RPC_TASK_NOCONNECT	0x2000		/* return ENOTCONN if not connected */
+ 
+ #define RPC_IS_ASYNC(t)		((t)->tk_flags & RPC_TASK_ASYNC)
+ #define RPC_IS_SWAPPER(t)	((t)->tk_flags & RPC_TASK_SWAPPER)
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index f7bc3ce..06a5bce 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -232,23 +232,43 @@ int filter_current_check_discard(struct ring_buffer *buffer,
+ }
+ EXPORT_SYMBOL_GPL(filter_current_check_discard);
+ 
+-cycle_t ftrace_now(int cpu)
++cycle_t buffer_ftrace_now(struct trace_buffer *buf, int cpu)
+ {
+ 	u64 ts;
+ 
+ 	/* Early boot up does not have a buffer yet */
+-	if (!global_trace.trace_buffer.buffer)
++	if (!buf->buffer)
+ 		return trace_clock_local();
+ 
+-	ts = ring_buffer_time_stamp(global_trace.trace_buffer.buffer, cpu);
+-	ring_buffer_normalize_time_stamp(global_trace.trace_buffer.buffer, cpu, &ts);
++	ts = ring_buffer_time_stamp(buf->buffer, cpu);
++	ring_buffer_normalize_time_stamp(buf->buffer, cpu, &ts);
+ 
+ 	return ts;
+ }
+ 
++cycle_t ftrace_now(int cpu)
++{
++	return buffer_ftrace_now(&global_trace.trace_buffer, cpu);
++}
++
++/**
++ * tracing_is_enabled - Show if global_trace has been disabled
++ *
++ * Shows if the global trace has been enabled or not. It uses the
++ * mirror flag "buffer_disabled" to be used in fast paths such as for
++ * the irqsoff tracer. But it may be inaccurate due to races. If you
++ * need to know the accurate state, use tracing_is_on() which is a little
++ * slower, but accurate.
++ */
+ int tracing_is_enabled(void)
+ {
+-	return tracing_is_on();
++	/*
++	 * For quick access (irqsoff uses this in fast path), just
++	 * return the mirror variable of the state of the ring buffer.
++	 * It's a little racy, but we don't really care.
++	 */
++	smp_rmb();
++	return !global_trace.buffer_disabled;
+ }
+ 
+ /*
+@@ -361,6 +381,23 @@ unsigned long trace_flags = TRACE_ITER_PRINT_PARENT | TRACE_ITER_PRINTK |
+ 	TRACE_ITER_GRAPH_TIME | TRACE_ITER_RECORD_CMD | TRACE_ITER_OVERWRITE |
+ 	TRACE_ITER_IRQ_INFO | TRACE_ITER_MARKERS | TRACE_ITER_FUNCTION;
+ 
++void tracer_tracing_on(struct trace_array *tr)
++{
++	if (tr->trace_buffer.buffer)
++		ring_buffer_record_on(tr->trace_buffer.buffer);
++	/*
++	 * This flag is looked at when buffers haven't been allocated
++	 * yet, or by some tracers (like irqsoff), that just want to
++	 * know if the ring buffer has been disabled, but it can handle
++	 * races of where it gets disabled but we still do a record.
++	 * As the check is in the fast path of the tracers, it is more
++	 * important to be fast than accurate.
++	 */
++	tr->buffer_disabled = 0;
++	/* Make the flag seen by readers */
++	smp_wmb();
++}
++
+ /**
+  * tracing_on - enable tracing buffers
+  *
+@@ -369,15 +406,7 @@ unsigned long trace_flags = TRACE_ITER_PRINT_PARENT | TRACE_ITER_PRINTK |
+  */
+ void tracing_on(void)
+ {
+-	if (global_trace.trace_buffer.buffer)
+-		ring_buffer_record_on(global_trace.trace_buffer.buffer);
+-	/*
+-	 * This flag is only looked at when buffers haven't been
+-	 * allocated yet. We don't really care about the race
+-	 * between setting this flag and actually turning
+-	 * on the buffer.
+-	 */
+-	global_trace.buffer_disabled = 0;
++	tracer_tracing_on(&global_trace);
+ }
+ EXPORT_SYMBOL_GPL(tracing_on);
+ 
+@@ -571,6 +600,23 @@ void tracing_snapshot_alloc(void)
+ EXPORT_SYMBOL_GPL(tracing_snapshot_alloc);
+ #endif /* CONFIG_TRACER_SNAPSHOT */
+ 
++void tracer_tracing_off(struct trace_array *tr)
++{
++	if (tr->trace_buffer.buffer)
++		ring_buffer_record_off(tr->trace_buffer.buffer);
++	/*
++	 * This flag is looked at when buffers haven't been allocated
++	 * yet, or by some tracers (like irqsoff), that just want to
++	 * know if the ring buffer has been disabled, but it can handle
++	 * races of where it gets disabled but we still do a record.
++	 * As the check is in the fast path of the tracers, it is more
++	 * important to be fast than accurate.
++	 */
++	tr->buffer_disabled = 1;
++	/* Make the flag seen by readers */
++	smp_wmb();
++}
++
+ /**
+  * tracing_off - turn off tracing buffers
+  *
+@@ -581,26 +627,29 @@ EXPORT_SYMBOL_GPL(tracing_snapshot_alloc);
+  */
+ void tracing_off(void)
+ {
+-	if (global_trace.trace_buffer.buffer)
+-		ring_buffer_record_off(global_trace.trace_buffer.buffer);
+-	/*
+-	 * This flag is only looked at when buffers haven't been
+-	 * allocated yet. We don't really care about the race
+-	 * between setting this flag and actually turning
+-	 * on the buffer.
+-	 */
+-	global_trace.buffer_disabled = 1;
++	tracer_tracing_off(&global_trace);
+ }
+ EXPORT_SYMBOL_GPL(tracing_off);
+ 
+ /**
++ * tracer_tracing_is_on - show real state of ring buffer enabled
++ * @tr : the trace array to know if ring buffer is enabled
++ *
++ * Shows real state of the ring buffer if it is enabled or not.
++ */
++int tracer_tracing_is_on(struct trace_array *tr)
++{
++	if (tr->trace_buffer.buffer)
++		return ring_buffer_record_is_on(tr->trace_buffer.buffer);
++	return !tr->buffer_disabled;
++}
++
++/**
+  * tracing_is_on - show state of ring buffers enabled
+  */
+ int tracing_is_on(void)
+ {
+-	if (global_trace.trace_buffer.buffer)
+-		return ring_buffer_record_is_on(global_trace.trace_buffer.buffer);
+-	return !global_trace.buffer_disabled;
++	return tracer_tracing_is_on(&global_trace);
+ }
+ EXPORT_SYMBOL_GPL(tracing_is_on);
+ 
+@@ -1150,7 +1199,7 @@ void tracing_reset_online_cpus(struct trace_buffer *buf)
+ 	/* Make sure all commits have finished */
+ 	synchronize_sched();
+ 
+-	buf->time_start = ftrace_now(buf->cpu);
++	buf->time_start = buffer_ftrace_now(buf, buf->cpu);
+ 
+ 	for_each_online_cpu(cpu)
+ 		ring_buffer_reset_cpu(buffer, cpu);
+@@ -1158,11 +1207,6 @@ void tracing_reset_online_cpus(struct trace_buffer *buf)
+ 	ring_buffer_record_enable(buffer);
+ }
+ 
+-void tracing_reset_current(int cpu)
+-{
+-	tracing_reset(&global_trace.trace_buffer, cpu);
+-}
+-
+ /* Must have trace_types_lock held */
+ void tracing_reset_all_online_cpus(void)
+ {
+@@ -4060,7 +4104,7 @@ static int tracing_wait_pipe(struct file *filp)
+ 		 *
+ 		 * iter->pos will be 0 if we haven't read anything.
+ 		 */
+-		if (!tracing_is_enabled() && iter->pos)
++		if (!tracing_is_on() && iter->pos)
+ 			break;
+ 	}
+ 
+@@ -4121,6 +4165,7 @@ waitagain:
+ 	memset(&iter->seq, 0,
+ 	       sizeof(struct trace_iterator) -
+ 	       offsetof(struct trace_iterator, seq));
++	cpumask_clear(iter->started);
+ 	iter->pos = -1;
+ 
+ 	trace_event_read_lock();
+@@ -4437,7 +4482,7 @@ tracing_free_buffer_release(struct inode *inode, struct file *filp)
+ 
+ 	/* disable tracing ? */
+ 	if (trace_flags & TRACE_ITER_STOP_ON_FREE)
+-		tracing_off();
++		tracer_tracing_off(tr);
+ 	/* resize the ring buffer to 0 */
+ 	tracing_resize_ring_buffer(tr, 0, RING_BUFFER_ALL_CPUS);
+ 
+@@ -4602,12 +4647,12 @@ static ssize_t tracing_clock_write(struct file *filp, const char __user *ubuf,
+ 	 * New clock may not be consistent with the previous clock.
+ 	 * Reset the buffer so that it doesn't have incomparable timestamps.
+ 	 */
+-	tracing_reset_online_cpus(&global_trace.trace_buffer);
++	tracing_reset_online_cpus(&tr->trace_buffer);
+ 
+ #ifdef CONFIG_TRACER_MAX_TRACE
+ 	if (tr->flags & TRACE_ARRAY_FL_GLOBAL && tr->max_buffer.buffer)
+ 		ring_buffer_set_clock(tr->max_buffer.buffer, trace_clocks[i].func);
+-	tracing_reset_online_cpus(&global_trace.max_buffer);
++	tracing_reset_online_cpus(&tr->max_buffer);
+ #endif
+ 
+ 	mutex_unlock(&trace_types_lock);
+@@ -5771,15 +5816,10 @@ rb_simple_read(struct file *filp, char __user *ubuf,
+ 	       size_t cnt, loff_t *ppos)
+ {
+ 	struct trace_array *tr = filp->private_data;
+-	struct ring_buffer *buffer = tr->trace_buffer.buffer;
+ 	char buf[64];
+ 	int r;
+ 
+-	if (buffer)
+-		r = ring_buffer_record_is_on(buffer);
+-	else
+-		r = 0;
+-
++	r = tracer_tracing_is_on(tr);
+ 	r = sprintf(buf, "%d\n", r);
+ 
+ 	return simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
+@@ -5801,11 +5841,11 @@ rb_simple_write(struct file *filp, const char __user *ubuf,
+ 	if (buffer) {
+ 		mutex_lock(&trace_types_lock);
+ 		if (val) {
+-			ring_buffer_record_on(buffer);
++			tracer_tracing_on(tr);
+ 			if (tr->current_trace->start)
+ 				tr->current_trace->start(tr);
+ 		} else {
+-			ring_buffer_record_off(buffer);
++			tracer_tracing_off(tr);
+ 			if (tr->current_trace->stop)
+ 				tr->current_trace->stop(tr);
+ 		}
+diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
+index b19d065..2aefbee 100644
+--- a/kernel/trace/trace_irqsoff.c
++++ b/kernel/trace/trace_irqsoff.c
+@@ -373,7 +373,7 @@ start_critical_timing(unsigned long ip, unsigned long parent_ip)
+ 	struct trace_array_cpu *data;
+ 	unsigned long flags;
+ 
+-	if (likely(!tracer_enabled))
++	if (!tracer_enabled || !tracing_is_enabled())
+ 		return;
+ 
+ 	cpu = raw_smp_processor_id();
+@@ -416,7 +416,7 @@ stop_critical_timing(unsigned long ip, unsigned long parent_ip)
+ 	else
+ 		return;
+ 
+-	if (!tracer_enabled)
++	if (!tracer_enabled || !tracing_is_enabled())
+ 		return;
+ 
+ 	data = per_cpu_ptr(tr->trace_buffer.data, cpu);
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 5a750b9..426f8fc 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1644,6 +1644,10 @@ call_connect(struct rpc_task *task)
+ 		task->tk_action = call_connect_status;
+ 		if (task->tk_status < 0)
+ 			return;
++		if (task->tk_flags & RPC_TASK_NOCONNECT) {
++			rpc_exit(task, -ENOTCONN);
++			return;
++		}
+ 		xprt_connect(task);
+ 	}
+ }
+diff --git a/net/sunrpc/netns.h b/net/sunrpc/netns.h
+index 74d948f..779742c 100644
+--- a/net/sunrpc/netns.h
++++ b/net/sunrpc/netns.h
+@@ -23,6 +23,7 @@ struct sunrpc_net {
+ 	struct rpc_clnt *rpcb_local_clnt4;
+ 	spinlock_t rpcb_clnt_lock;
+ 	unsigned int rpcb_users;
++	unsigned int rpcb_is_af_local : 1;
+ 
+ 	struct mutex gssp_lock;
+ 	wait_queue_head_t gssp_wq;
+diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
+index 3df764d..1891a10 100644
+--- a/net/sunrpc/rpcb_clnt.c
++++ b/net/sunrpc/rpcb_clnt.c
+@@ -204,13 +204,15 @@ void rpcb_put_local(struct net *net)
+ }
+ 
+ static void rpcb_set_local(struct net *net, struct rpc_clnt *clnt,
+-			struct rpc_clnt *clnt4)
++			struct rpc_clnt *clnt4,
++			bool is_af_local)
+ {
+ 	struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+ 
+ 	/* Protected by rpcb_create_local_mutex */
+ 	sn->rpcb_local_clnt = clnt;
+ 	sn->rpcb_local_clnt4 = clnt4;
++	sn->rpcb_is_af_local = is_af_local ? 1 : 0;
+ 	smp_wmb(); 
+ 	sn->rpcb_users = 1;
+ 	dprintk("RPC:       created new rpcb local clients (rpcb_local_clnt: "
+@@ -238,6 +240,14 @@ static int rpcb_create_local_unix(struct net *net)
+ 		.program	= &rpcb_program,
+ 		.version	= RPCBVERS_2,
+ 		.authflavor	= RPC_AUTH_NULL,
++		/*
++		 * We turn off the idle timeout to prevent the kernel
++		 * from automatically disconnecting the socket.
++		 * Otherwise, we'd have to cache the mount namespace
++		 * of the caller and somehow pass that to the socket
++		 * reconnect code.
++		 */
++		.flags		= RPC_CLNT_CREATE_NO_IDLE_TIMEOUT,
+ 	};
+ 	struct rpc_clnt *clnt, *clnt4;
+ 	int result = 0;
+@@ -263,7 +273,7 @@ static int rpcb_create_local_unix(struct net *net)
+ 		clnt4 = NULL;
+ 	}
+ 
+-	rpcb_set_local(net, clnt, clnt4);
++	rpcb_set_local(net, clnt, clnt4, true);
+ 
+ out:
+ 	return result;
+@@ -315,7 +325,7 @@ static int rpcb_create_local_net(struct net *net)
+ 		clnt4 = NULL;
+ 	}
+ 
+-	rpcb_set_local(net, clnt, clnt4);
++	rpcb_set_local(net, clnt, clnt4, false);
+ 
+ out:
+ 	return result;
+@@ -376,13 +386,16 @@ static struct rpc_clnt *rpcb_create(struct net *net, const char *hostname,
+ 	return rpc_create(&args);
+ }
+ 
+-static int rpcb_register_call(struct rpc_clnt *clnt, struct rpc_message *msg)
++static int rpcb_register_call(struct sunrpc_net *sn, struct rpc_clnt *clnt, struct rpc_message *msg, bool is_set)
+ {
+-	int result, error = 0;
++	int flags = RPC_TASK_NOCONNECT;
++	int error, result = 0;
+ 
++	if (is_set || !sn->rpcb_is_af_local)
++		flags = RPC_TASK_SOFTCONN;
+ 	msg->rpc_resp = &result;
+ 
+-	error = rpc_call_sync(clnt, msg, RPC_TASK_SOFTCONN);
++	error = rpc_call_sync(clnt, msg, flags);
+ 	if (error < 0) {
+ 		dprintk("RPC:       failed to contact local rpcbind "
+ 				"server (errno %d).\n", -error);
+@@ -439,16 +452,19 @@ int rpcb_register(struct net *net, u32 prog, u32 vers, int prot, unsigned short
+ 		.rpc_argp	= &map,
+ 	};
+ 	struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
++	bool is_set = false;
+ 
+ 	dprintk("RPC:       %sregistering (%u, %u, %d, %u) with local "
+ 			"rpcbind\n", (port ? "" : "un"),
+ 			prog, vers, prot, port);
+ 
+ 	msg.rpc_proc = &rpcb_procedures2[RPCBPROC_UNSET];
+-	if (port)
++	if (port != 0) {
+ 		msg.rpc_proc = &rpcb_procedures2[RPCBPROC_SET];
++		is_set = true;
++	}
+ 
+-	return rpcb_register_call(sn->rpcb_local_clnt, &msg);
++	return rpcb_register_call(sn, sn->rpcb_local_clnt, &msg, is_set);
+ }
+ 
+ /*
+@@ -461,6 +477,7 @@ static int rpcb_register_inet4(struct sunrpc_net *sn,
+ 	const struct sockaddr_in *sin = (const struct sockaddr_in *)sap;
+ 	struct rpcbind_args *map = msg->rpc_argp;
+ 	unsigned short port = ntohs(sin->sin_port);
++	bool is_set = false;
+ 	int result;
+ 
+ 	map->r_addr = rpc_sockaddr2uaddr(sap, GFP_KERNEL);
+@@ -471,10 +488,12 @@ static int rpcb_register_inet4(struct sunrpc_net *sn,
+ 			map->r_addr, map->r_netid);
+ 
+ 	msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
+-	if (port)
++	if (port != 0) {
+ 		msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
++		is_set = true;
++	}
+ 
+-	result = rpcb_register_call(sn->rpcb_local_clnt4, msg);
++	result = rpcb_register_call(sn, sn->rpcb_local_clnt4, msg, is_set);
+ 	kfree(map->r_addr);
+ 	return result;
+ }
+@@ -489,6 +508,7 @@ static int rpcb_register_inet6(struct sunrpc_net *sn,
+ 	const struct sockaddr_in6 *sin6 = (const struct sockaddr_in6 *)sap;
+ 	struct rpcbind_args *map = msg->rpc_argp;
+ 	unsigned short port = ntohs(sin6->sin6_port);
++	bool is_set = false;
+ 	int result;
+ 
+ 	map->r_addr = rpc_sockaddr2uaddr(sap, GFP_KERNEL);
+@@ -499,10 +519,12 @@ static int rpcb_register_inet6(struct sunrpc_net *sn,
+ 			map->r_addr, map->r_netid);
+ 
+ 	msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
+-	if (port)
++	if (port != 0) {
+ 		msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
++		is_set = true;
++	}
+ 
+-	result = rpcb_register_call(sn->rpcb_local_clnt4, msg);
++	result = rpcb_register_call(sn, sn->rpcb_local_clnt4, msg, is_set);
+ 	kfree(map->r_addr);
+ 	return result;
+ }
+@@ -519,7 +541,7 @@ static int rpcb_unregister_all_protofamilies(struct sunrpc_net *sn,
+ 	map->r_addr = "";
+ 	msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
+ 
+-	return rpcb_register_call(sn->rpcb_local_clnt4, msg);
++	return rpcb_register_call(sn, sn->rpcb_local_clnt4, msg, false);
+ }
+ 
+ /**
+diff --git a/sound/usb/6fire/comm.c b/sound/usb/6fire/comm.c
+index 9e6e3ff..23452ee 100644
+--- a/sound/usb/6fire/comm.c
++++ b/sound/usb/6fire/comm.c
+@@ -110,19 +110,37 @@ static int usb6fire_comm_send_buffer(u8 *buffer, struct usb_device *dev)
+ static int usb6fire_comm_write8(struct comm_runtime *rt, u8 request,
+ 		u8 reg, u8 value)
+ {
+-	u8 buffer[13]; /* 13: maximum length of message */
++	u8 *buffer;
++	int ret;
++
++	/* 13: maximum length of message */
++	buffer = kmalloc(13, GFP_KERNEL);
++	if (!buffer)
++		return -ENOMEM;
+ 
+ 	usb6fire_comm_init_buffer(buffer, 0x00, request, reg, value, 0x00);
+-	return usb6fire_comm_send_buffer(buffer, rt->chip->dev);
++	ret = usb6fire_comm_send_buffer(buffer, rt->chip->dev);
++
++	kfree(buffer);
++	return ret;
+ }
+ 
+ static int usb6fire_comm_write16(struct comm_runtime *rt, u8 request,
+ 		u8 reg, u8 vl, u8 vh)
+ {
+-	u8 buffer[13]; /* 13: maximum length of message */
++	u8 *buffer;
++	int ret;
++
++	/* 13: maximum length of message */
++	buffer = kmalloc(13, GFP_KERNEL);
++	if (!buffer)
++		return -ENOMEM;
+ 
+ 	usb6fire_comm_init_buffer(buffer, 0x00, request, reg, vl, vh);
+-	return usb6fire_comm_send_buffer(buffer, rt->chip->dev);
++	ret = usb6fire_comm_send_buffer(buffer, rt->chip->dev);
++
++	kfree(buffer);
++	return ret;
+ }
+ 
+ int usb6fire_comm_init(struct sfire_chip *chip)
+@@ -135,6 +153,12 @@ int usb6fire_comm_init(struct sfire_chip *chip)
+ 	if (!rt)
+ 		return -ENOMEM;
+ 
++	rt->receiver_buffer = kzalloc(COMM_RECEIVER_BUFSIZE, GFP_KERNEL);
++	if (!rt->receiver_buffer) {
++		kfree(rt);
++		return -ENOMEM;
++	}
++
+ 	urb = &rt->receiver;
+ 	rt->serial = 1;
+ 	rt->chip = chip;
+@@ -153,6 +177,7 @@ int usb6fire_comm_init(struct sfire_chip *chip)
+ 	urb->interval = 1;
+ 	ret = usb_submit_urb(urb, GFP_KERNEL);
+ 	if (ret < 0) {
++		kfree(rt->receiver_buffer);
+ 		kfree(rt);
+ 		snd_printk(KERN_ERR PREFIX "cannot create comm data receiver.");
+ 		return ret;
+@@ -171,6 +196,9 @@ void usb6fire_comm_abort(struct sfire_chip *chip)
+ 
+ void usb6fire_comm_destroy(struct sfire_chip *chip)
+ {
+-	kfree(chip->comm);
++	struct comm_runtime *rt = chip->comm;
++
++	kfree(rt->receiver_buffer);
++	kfree(rt);
+ 	chip->comm = NULL;
+ }
+diff --git a/sound/usb/6fire/comm.h b/sound/usb/6fire/comm.h
+index 6a0840b..780d5ed 100644
+--- a/sound/usb/6fire/comm.h
++++ b/sound/usb/6fire/comm.h
+@@ -24,7 +24,7 @@ struct comm_runtime {
+ 	struct sfire_chip *chip;
+ 
+ 	struct urb receiver;
+-	u8 receiver_buffer[COMM_RECEIVER_BUFSIZE];
++	u8 *receiver_buffer;
+ 
+ 	u8 serial; /* urb serial */
+ 
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 7a444b5..659950e 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -591,17 +591,16 @@ static int data_ep_set_params(struct snd_usb_endpoint *ep,
+ 	ep->stride = frame_bits >> 3;
+ 	ep->silence_value = pcm_format == SNDRV_PCM_FORMAT_U8 ? 0x80 : 0;
+ 
+-	/* calculate max. frequency */
+-	if (ep->maxpacksize) {
++	/* assume max. frequency is 25% higher than nominal */
++	ep->freqmax = ep->freqn + (ep->freqn >> 2);
++	maxsize = ((ep->freqmax + 0xffff) * (frame_bits >> 3))
++				>> (16 - ep->datainterval);
++	/* but wMaxPacketSize might reduce this */
++	if (ep->maxpacksize && ep->maxpacksize < maxsize) {
+ 		/* whatever fits into a max. size packet */
+ 		maxsize = ep->maxpacksize;
+ 		ep->freqmax = (maxsize / (frame_bits >> 3))
+ 				<< (16 - ep->datainterval);
+-	} else {
+-		/* no max. packet size: just take 25% higher than nominal */
+-		ep->freqmax = ep->freqn + (ep->freqn >> 2);
+-		maxsize = ((ep->freqmax + 0xffff) * (frame_bits >> 3))
+-				>> (16 - ep->datainterval);
+ 	}
+ 
+ 	if (ep->fill_max)

Added: genpatches-2.6/trunk/3.10.7/1500_XATTR_USER_PREFIX.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/1500_XATTR_USER_PREFIX.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/1500_XATTR_USER_PREFIX.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,54 @@
+From: Anthony G. Basile <blueness@g.o>
+
+This patch adds support for a restricted user-controlled namespace on
+tmpfs filesystem used to house PaX flags.  The namespace must be of the
+form user.pax.* and its value cannot exceed a size of 8 bytes.
+
+This is needed even on all Gentoo systems so that XATTR_PAX flags
+are preserved for users who might build packages using portage on
+a tmpfs system with a non-hardened kernel and then switch to a
+hardened kernel with XATTR_PAX enabled.
+
+The namespace is added to any user with Extended Attribute support
+enabled for tmpfs.  Users who do not enable xattrs will not have
+the XATTR_PAX flags preserved.
+
+diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h
+index e4629b9..6958086 100644
+--- a/include/uapi/linux/xattr.h
++++ b/include/uapi/linux/xattr.h
+@@ -63,5 +63,9 @@
+ #define XATTR_POSIX_ACL_DEFAULT  "posix_acl_default"
+ #define XATTR_NAME_POSIX_ACL_DEFAULT XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_DEFAULT
+ 
++/* User namespace */
++#define XATTR_PAX_PREFIX XATTR_USER_PREFIX "pax."
++#define XATTR_PAX_FLAGS_SUFFIX "flags"
++#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
+ 
+ #endif /* _UAPI_LINUX_XATTR_H */
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 1c44af7..f23bb1b 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2201,6 +2201,7 @@ static const struct xattr_handler *shmem_xattr_handlers[] = {
+ static int shmem_xattr_validate(const char *name)
+ {
+ 	struct { const char *prefix; size_t len; } arr[] = {
++		{ XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN},
+ 		{ XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN },
+ 		{ XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN }
+ 	};
+@@ -2256,6 +2257,12 @@ static int shmem_setxattr(struct dentry *dentry, const char *name,
+ 	if (err)
+ 		return err;
+ 
++	if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
++		if (strcmp(name, XATTR_NAME_PAX_FLAGS))
++			return -EOPNOTSUPP;
++		if (size > 8)
++			return -EINVAL;
++	}
+ 	return simple_xattr_set(&info->xattrs, name, value, size, flags);
+ }
+ 

Added: genpatches-2.6/trunk/3.10.7/1700_enable-thinkpad-micled.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/1700_enable-thinkpad-micled.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/1700_enable-thinkpad-micled.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,23 @@
+--- a/drivers/platform/x86/thinkpad_acpi.c	2013-02-06 08:46:53.546168051 -0500
++++ b/drivers/platform/x86/thinkpad_acpi.c	2013-02-06 08:52:16.846933455 -0500
+@@ -5056,8 +5056,10 @@ static const char * const tpacpi_led_nam
+ 	"tpacpi::unknown_led2",
+ 	"tpacpi::unknown_led3",
+ 	"tpacpi::thinkvantage",
++	"tpacpi::unknown_led4",
++	"tpacpi::micmute",
+ };
+-#define TPACPI_SAFE_LEDS	0x1081U
++#define TPACPI_SAFE_LEDS	0x5081U
+ 
+ static inline bool tpacpi_is_led_restricted(const unsigned int led)
+ {
+@@ -5280,7 +5282,7 @@ static const struct tpacpi_quirk led_use
+ 	{ /* Lenovo */
+ 	  .vendor = PCI_VENDOR_ID_LENOVO,
+ 	  .bios = TPACPI_MATCH_ANY, .ec = TPACPI_MATCH_ANY,
+-	  .quirks = 0x1fffU,
++	  .quirks = 0x5fffU,
+ 	},
+ 	{ /* IBM ThinkPads with no EC version string */
+ 	  .vendor = PCI_VENDOR_ID_IBM,

Added: genpatches-2.6/trunk/3.10.7/1801_block-cgroups-kconfig-build-bits-for-BFQ-v6r2-3.10.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/1801_block-cgroups-kconfig-build-bits-for-BFQ-v6r2-3.10.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/1801_block-cgroups-kconfig-build-bits-for-BFQ-v6r2-3.10.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,97 @@
+From 13fa5ddac2963e304e90c5beb4bc996e3557479d Mon Sep 17 00:00:00 2001
+From: Matteo Bernardini <matteo.bernardini@×××××.com>
+Date: Thu, 9 May 2013 18:58:50 +0200
+Subject: [PATCH 1/3] block: cgroups, kconfig, build bits for BFQ-v6r2-3.10
+
+Update Kconfig.iosched and do the related Makefile changes to include
+kernel configuration options for BFQ. Also add the bfqio controller
+to the cgroups subsystem.
+
+Signed-off-by: Paolo Valente <paolo.valente@×××××××.it>
+Signed-off-by: Arianna Avanzini <avanzini.arianna@×××××.com>
+Signed-off-by: Matteo Bernardini <matteo.bernardini@×××××.com>
+---
+ block/Kconfig.iosched         | 25 +++++++++++++++++++++++++
+ block/Makefile                |  1 +
+ include/linux/cgroup_subsys.h |  6 ++++++
+ 3 files changed, 32 insertions(+)
+
+diff --git a/block/Kconfig.iosched b/block/Kconfig.iosched
+index 421bef9..695e064 100644
+--- a/block/Kconfig.iosched
++++ b/block/Kconfig.iosched
+@@ -39,6 +39,27 @@ config CFQ_GROUP_IOSCHED
+ 	---help---
+ 	  Enable group IO scheduling in CFQ.
+ 
++config IOSCHED_BFQ
++	tristate "BFQ I/O scheduler"
++	default n
++	---help---
++	  The BFQ I/O scheduler tries to distribute bandwidth among
++	  all processes according to their weights.
++	  It aims at distributing the bandwidth as desired, independently of
++	  the disk parameters and with any workload. It also tries to
++	  guarantee low latency to interactive and soft real-time
++	  applications.  If compiled built-in (saying Y here), BFQ can
++	  be configured to support hierarchical scheduling.
++
++config CGROUP_BFQIO
++	bool "BFQ hierarchical scheduling support"
++	depends on CGROUPS && IOSCHED_BFQ=y
++	default n
++	---help---
++	  Enable hierarchical scheduling in BFQ, using the cgroups
++	  filesystem interface.  The name of the subsystem will be
++	  bfqio.
++
+ choice
+ 	prompt "Default I/O scheduler"
+ 	default DEFAULT_CFQ
+@@ -52,6 +73,9 @@ choice
+ 	config DEFAULT_CFQ
+ 		bool "CFQ" if IOSCHED_CFQ=y
+ 
++	config DEFAULT_BFQ
++		bool "BFQ" if IOSCHED_BFQ=y
++
+ 	config DEFAULT_NOOP
+ 		bool "No-op"
+ 
+@@ -61,6 +85,7 @@ config DEFAULT_IOSCHED
+ 	string
+ 	default "deadline" if DEFAULT_DEADLINE
+ 	default "cfq" if DEFAULT_CFQ
++	default "bfq" if DEFAULT_BFQ
+ 	default "noop" if DEFAULT_NOOP
+ 
+ endmenu
+diff --git a/block/Makefile b/block/Makefile
+index 39b76ba..c0d20fa 100644
+--- a/block/Makefile
++++ b/block/Makefile
+@@ -15,6 +15,7 @@ obj-$(CONFIG_BLK_DEV_THROTTLING)	+= blk-throttle.o
+ obj-$(CONFIG_IOSCHED_NOOP)	+= noop-iosched.o
+ obj-$(CONFIG_IOSCHED_DEADLINE)	+= deadline-iosched.o
+ obj-$(CONFIG_IOSCHED_CFQ)	+= cfq-iosched.o
++obj-$(CONFIG_IOSCHED_BFQ)	+= bfq-iosched.o
+ 
+ obj-$(CONFIG_BLOCK_COMPAT)	+= compat_ioctl.o
+ obj-$(CONFIG_BLK_DEV_INTEGRITY)	+= blk-integrity.o
+diff --git a/include/linux/cgroup_subsys.h b/include/linux/cgroup_subsys.h
+index 6e7ec64..ffa1d1f 100644
+--- a/include/linux/cgroup_subsys.h
++++ b/include/linux/cgroup_subsys.h
+@@ -84,3 +84,9 @@ SUBSYS(bcache)
+ #endif
+ 
+ /* */
++
++#ifdef CONFIG_CGROUP_BFQIO
++SUBSYS(bfqio)
++#endif
++
++/* */
+-- 
+1.8.1.4
+

Added: genpatches-2.6/trunk/3.10.7/1802_block-introduce-the-BFQ-v6r2-I-O-sched-for-3.10.patch1
===================================================================
--- genpatches-2.6/trunk/3.10.7/1802_block-introduce-the-BFQ-v6r2-I-O-sched-for-3.10.patch1	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/1802_block-introduce-the-BFQ-v6r2-I-O-sched-for-3.10.patch1	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,5775 @@
+From 2e949c3d4d8ba2af46dcedc80707ebba277d759f Mon Sep 17 00:00:00 2001
+From: Arianna Avanzini <avanzini.arianna@×××××.com>
+Date: Thu, 9 May 2013 19:10:02 +0200
+Subject: [PATCH 2/3] block: introduce the BFQ-v6r2 I/O sched for 3.10
+
+Add the BFQ-v6r2 I/O scheduler to 3.10.
+The general structure is borrowed from CFQ, as much code. A (bfq_)queue
+is associated to each task doing I/O on a device, and each time a
+scheduling decision has to be made a queue is selected and served until
+it expires.
+
+    - Slices are given in the service domain: tasks are assigned
+      budgets, measured in number of sectors. Once got the disk, a task
+      must however consume its assigned budget within a configurable
+      maximum time (by default, the maximum possible value of the
+      budgets is automatically computed to comply with this timeout).
+      This allows the desired latency vs "throughput boosting" tradeoff
+      to be set.
+
+    - Budgets are scheduled according to a variant of WF2Q+, implemented
+      using an augmented rb-tree to take eligibility into account while
+      preserving an O(log N) overall complexity.
+
+    - A low-latency tunable is provided; if enabled, both interactive
+      and soft real-time applications are guaranteed very low latency.
+
+    - Latency guarantees are preserved also in presence of NCQ.
+
+    - Also with flash-based devices, a high throughput is achieved while
+      still preserving latency guarantees.
+
+    - Useful features borrowed from CFQ: cooperating-queues merging (with
+      some additional optimizations with respect to the original CFQ version),
+      static fallback queue for OOM.
+
+    - BFQ supports full hierarchical scheduling, exporting a cgroups
+      interface.  Each node has a full scheduler, so each group can
+      be assigned its own ioprio (mapped to a weight, see next point)
+      and an ioprio_class.
+
+    - If the cgroups interface is used, weights can be explictly
+      assigned, otherwise ioprio values are mapped to weights using the
+      relation weight = IOPRIO_BE_NR - ioprio.
+
+    - ioprio classes are served in strict priority order, i.e., lower
+      priority queues are not served as long as there are higher
+      priority queues.  Among queues in the same class the bandwidth is
+      distributed in proportion to the weight of each queue. A very
+      thin extra bandwidth is however guaranteed to the Idle class, to
+      prevent it from starving.
+
+Signed-off-by: Paolo Valente <paolo.valente@×××××××.it>
+Signed-off-by: Arianna Avanzini <avanzini.arianna@×××××.com>
+---
+ block/bfq-cgroup.c            |  881 ++++++++++++
+ block/bfq-ioc.c               |   36 +
+ block/bfq-iosched.c           | 3070 +++++++++++++++++++++++++++++++++++++++++
+ block/bfq-sched.c             | 1072 ++++++++++++++
+ block/bfq.h                   |  603 ++++++++
+ include/linux/cgroup_subsys.h |    2 +-
+ 6 files changed, 5663 insertions(+), 1 deletion(-)
+ create mode 100644 block/bfq-cgroup.c
+ create mode 100644 block/bfq-ioc.c
+ create mode 100644 block/bfq-iosched.c
+ create mode 100644 block/bfq-sched.c
+ create mode 100644 block/bfq.h
+
+diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
+new file mode 100644
+index 0000000..6d57239
+--- /dev/null
++++ b/block/bfq-cgroup.c
+@@ -0,0 +1,881 @@
++/*
++ * BFQ: CGROUPS support.
++ *
++ * Based on ideas and code from CFQ:
++ * Copyright (C) 2003 Jens Axboe <axboe@××××××.dk>
++ *
++ * Copyright (C) 2008 Fabio Checconi <fabio@×××××××××××××.it>
++ *		      Paolo Valente <paolo.valente@×××××××.it>
++ *
++ * Copyright (C) 2010 Paolo Valente <paolo.valente@×××××××.it>
++ *
++ * Licensed under the GPL-2 as detailed in the accompanying COPYING.BFQ file.
++ */
++
++#ifdef CONFIG_CGROUP_BFQIO
++
++static DEFINE_MUTEX(bfqio_mutex);
++
++static bool bfqio_is_removed(struct cgroup *cgroup)
++{
++	return test_bit(CGRP_REMOVED, &cgroup->flags);
++}
++
++static struct bfqio_cgroup bfqio_root_cgroup = {
++	.weight = BFQ_DEFAULT_GRP_WEIGHT,
++	.ioprio = BFQ_DEFAULT_GRP_IOPRIO,
++	.ioprio_class = BFQ_DEFAULT_GRP_CLASS,
++};
++
++static inline void bfq_init_entity(struct bfq_entity *entity,
++				   struct bfq_group *bfqg)
++{
++	entity->weight = entity->new_weight;
++	entity->orig_weight = entity->new_weight;
++	entity->ioprio = entity->new_ioprio;
++	entity->ioprio_class = entity->new_ioprio_class;
++	entity->parent = bfqg->my_entity;
++	entity->sched_data = &bfqg->sched_data;
++}
++
++static struct bfqio_cgroup *cgroup_to_bfqio(struct cgroup *cgroup)
++{
++	return container_of(cgroup_subsys_state(cgroup, bfqio_subsys_id),
++			    struct bfqio_cgroup, css);
++}
++
++/*
++ * Search the bfq_group for bfqd into the hash table (by now only a list)
++ * of bgrp.  Must be called under rcu_read_lock().
++ */
++static struct bfq_group *bfqio_lookup_group(struct bfqio_cgroup *bgrp,
++					    struct bfq_data *bfqd)
++{
++	struct bfq_group *bfqg;
++	void *key;
++
++	hlist_for_each_entry_rcu(bfqg, &bgrp->group_data, group_node) {
++		key = rcu_dereference(bfqg->bfqd);
++		if (key == bfqd)
++			return bfqg;
++	}
++
++	return NULL;
++}
++
++static inline void bfq_group_init_entity(struct bfqio_cgroup *bgrp,
++					 struct bfq_group *bfqg)
++{
++	struct bfq_entity *entity = &bfqg->entity;
++
++	/*
++	 * If the weight of the entity has never been set via the sysfs
++	 * interface, then bgrp->weight == 0. In this case we initialize
++	 * the weight from the current ioprio value. Otherwise, the group
++	 * weight, if set, has priority over the ioprio value.
++	 */
++	if (bgrp->weight == 0) {
++		entity->new_weight = bfq_ioprio_to_weight(bgrp->ioprio);
++		entity->new_ioprio = bgrp->ioprio;
++	} else {
++		entity->new_weight = bgrp->weight;
++		entity->new_ioprio = bfq_weight_to_ioprio(bgrp->weight);
++	}
++	entity->orig_weight = entity->weight = entity->new_weight;
++	entity->ioprio = entity->new_ioprio;
++	entity->ioprio_class = entity->new_ioprio_class = bgrp->ioprio_class;
++	entity->my_sched_data = &bfqg->sched_data;
++}
++
++static inline void bfq_group_set_parent(struct bfq_group *bfqg,
++					struct bfq_group *parent)
++{
++	struct bfq_entity *entity;
++
++	BUG_ON(parent == NULL);
++	BUG_ON(bfqg == NULL);
++
++	entity = &bfqg->entity;
++	entity->parent = parent->my_entity;
++	entity->sched_data = &parent->sched_data;
++}
++
++/**
++ * bfq_group_chain_alloc - allocate a chain of groups.
++ * @bfqd: queue descriptor.
++ * @cgroup: the leaf cgroup this chain starts from.
++ *
++ * Allocate a chain of groups starting from the one belonging to
++ * @cgroup up to the root cgroup.  Stop if a cgroup on the chain
++ * to the root has already an allocated group on @bfqd.
++ */
++static struct bfq_group *bfq_group_chain_alloc(struct bfq_data *bfqd,
++					       struct cgroup *cgroup)
++{
++	struct bfqio_cgroup *bgrp;
++	struct bfq_group *bfqg, *prev = NULL, *leaf = NULL;
++
++	for (; cgroup != NULL; cgroup = cgroup->parent) {
++		bgrp = cgroup_to_bfqio(cgroup);
++
++		bfqg = bfqio_lookup_group(bgrp, bfqd);
++		if (bfqg != NULL) {
++			/*
++			 * All the cgroups in the path from there to the
++			 * root must have a bfq_group for bfqd, so we don't
++			 * need any more allocations.
++			 */
++			break;
++		}
++
++		bfqg = kzalloc(sizeof(*bfqg), GFP_ATOMIC);
++		if (bfqg == NULL)
++			goto cleanup;
++
++		bfq_group_init_entity(bgrp, bfqg);
++		bfqg->my_entity = &bfqg->entity;
++
++		if (leaf == NULL) {
++			leaf = bfqg;
++			prev = leaf;
++		} else {
++			bfq_group_set_parent(prev, bfqg);
++			/*
++			 * Build a list of allocated nodes using the bfqd
++			 * filed, that is still unused and will be initialized
++			 * only after the node will be connected.
++			 */
++			prev->bfqd = bfqg;
++			prev = bfqg;
++		}
++	}
++
++	return leaf;
++
++cleanup:
++	while (leaf != NULL) {
++		prev = leaf;
++		leaf = leaf->bfqd;
++		kfree(prev);
++	}
++
++	return NULL;
++}
++
++/**
++ * bfq_group_chain_link - link an allocatd group chain to a cgroup hierarchy.
++ * @bfqd: the queue descriptor.
++ * @cgroup: the leaf cgroup to start from.
++ * @leaf: the leaf group (to be associated to @cgroup).
++ *
++ * Try to link a chain of groups to a cgroup hierarchy, connecting the
++ * nodes bottom-up, so we can be sure that when we find a cgroup in the
++ * hierarchy that already as a group associated to @bfqd all the nodes
++ * in the path to the root cgroup have one too.
++ *
++ * On locking: the queue lock protects the hierarchy (there is a hierarchy
++ * per device) while the bfqio_cgroup lock protects the list of groups
++ * belonging to the same cgroup.
++ */
++static void bfq_group_chain_link(struct bfq_data *bfqd, struct cgroup *cgroup,
++				 struct bfq_group *leaf)
++{
++	struct bfqio_cgroup *bgrp;
++	struct bfq_group *bfqg, *next, *prev = NULL;
++	unsigned long flags;
++
++	assert_spin_locked(bfqd->queue->queue_lock);
++
++	for (; cgroup != NULL && leaf != NULL; cgroup = cgroup->parent) {
++		bgrp = cgroup_to_bfqio(cgroup);
++		next = leaf->bfqd;
++
++		bfqg = bfqio_lookup_group(bgrp, bfqd);
++		BUG_ON(bfqg != NULL);
++
++		spin_lock_irqsave(&bgrp->lock, flags);
++
++		rcu_assign_pointer(leaf->bfqd, bfqd);
++		hlist_add_head_rcu(&leaf->group_node, &bgrp->group_data);
++		hlist_add_head(&leaf->bfqd_node, &bfqd->group_list);
++
++		spin_unlock_irqrestore(&bgrp->lock, flags);
++
++		prev = leaf;
++		leaf = next;
++	}
++
++	BUG_ON(cgroup == NULL && leaf != NULL);
++	if (cgroup != NULL && prev != NULL) {
++		bgrp = cgroup_to_bfqio(cgroup);
++		bfqg = bfqio_lookup_group(bgrp, bfqd);
++		bfq_group_set_parent(prev, bfqg);
++	}
++}
++
++/**
++ * bfq_find_alloc_group - return the group associated to @bfqd in @cgroup.
++ * @bfqd: queue descriptor.
++ * @cgroup: cgroup being searched for.
++ *
++ * Return a group associated to @bfqd in @cgroup, allocating one if
++ * necessary.  When a group is returned all the cgroups in the path
++ * to the root have a group associated to @bfqd.
++ *
++ * If the allocation fails, return the root group: this breaks guarantees
++ * but is a safe fallbak.  If this loss becames a problem it can be
++ * mitigated using the equivalent weight (given by the product of the
++ * weights of the groups in the path from @group to the root) in the
++ * root scheduler.
++ *
++ * We allocate all the missing nodes in the path from the leaf cgroup
++ * to the root and we connect the nodes only after all the allocations
++ * have been successful.
++ */
++static struct bfq_group *bfq_find_alloc_group(struct bfq_data *bfqd,
++					      struct cgroup *cgroup)
++{
++	struct bfqio_cgroup *bgrp = cgroup_to_bfqio(cgroup);
++	struct bfq_group *bfqg;
++
++	bfqg = bfqio_lookup_group(bgrp, bfqd);
++	if (bfqg != NULL)
++		return bfqg;
++
++	bfqg = bfq_group_chain_alloc(bfqd, cgroup);
++	if (bfqg != NULL)
++		bfq_group_chain_link(bfqd, cgroup, bfqg);
++	else
++		bfqg = bfqd->root_group;
++
++	return bfqg;
++}
++
++/**
++ * bfq_bfqq_move - migrate @bfqq to @bfqg.
++ * @bfqd: queue descriptor.
++ * @bfqq: the queue to move.
++ * @entity: @bfqq's entity.
++ * @bfqg: the group to move to.
++ *
++ * Move @bfqq to @bfqg, deactivating it from its old group and reactivating
++ * it on the new one.  Avoid putting the entity on the old group idle tree.
++ *
++ * Must be called under the queue lock; the cgroup owning @bfqg must
++ * not disappear (by now this just means that we are called under
++ * rcu_read_lock()).
++ */
++static void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++			  struct bfq_entity *entity, struct bfq_group *bfqg)
++{
++	int busy, resume;
++
++	busy = bfq_bfqq_busy(bfqq);
++	resume = !RB_EMPTY_ROOT(&bfqq->sort_list);
++
++	BUG_ON(resume && !entity->on_st);
++	BUG_ON(busy && !resume && entity->on_st && bfqq != bfqd->active_queue);
++
++	if (busy) {
++		BUG_ON(atomic_read(&bfqq->ref) < 2);
++
++		if (!resume)
++			bfq_del_bfqq_busy(bfqd, bfqq, 0);
++		else
++			bfq_deactivate_bfqq(bfqd, bfqq, 0);
++	} else if (entity->on_st)
++		bfq_put_idle_entity(bfq_entity_service_tree(entity), entity);
++
++	/*
++	 * Here we use a reference to bfqg.  We don't need a refcounter
++	 * as the cgroup reference will not be dropped, so that its
++	 * destroy() callback will not be invoked.
++	 */
++	entity->parent = bfqg->my_entity;
++	entity->sched_data = &bfqg->sched_data;
++
++	if (busy && resume)
++		bfq_activate_bfqq(bfqd, bfqq);
++
++	if (bfqd->active_queue == NULL && !bfqd->rq_in_driver)
++		bfq_schedule_dispatch(bfqd);
++}
++
++/**
++ * __bfq_bic_change_cgroup - move @bic to @cgroup.
++ * @bfqd: the queue descriptor.
++ * @bic: the bic to move.
++ * @cgroup: the cgroup to move to.
++ *
++ * Move bic to cgroup, assuming that bfqd->queue is locked; the caller
++ * has to make sure that the reference to cgroup is valid across the call.
++ *
++ * NOTE: an alternative approach might have been to store the current
++ * cgroup in bfqq and getting a reference to it, reducing the lookup
++ * time here, at the price of slightly more complex code.
++ */
++static struct bfq_group *__bfq_bic_change_cgroup(struct bfq_data *bfqd,
++						 struct bfq_io_cq *bic,
++						 struct cgroup *cgroup)
++{
++	struct bfq_queue *async_bfqq = bic_to_bfqq(bic, 0);
++	struct bfq_queue *sync_bfqq = bic_to_bfqq(bic, 1);
++	struct bfq_entity *entity;
++	struct bfq_group *bfqg;
++	struct bfqio_cgroup *bgrp;
++
++	bgrp = cgroup_to_bfqio(cgroup);
++
++	bfqg = bfq_find_alloc_group(bfqd, cgroup);
++	if (async_bfqq != NULL) {
++		entity = &async_bfqq->entity;
++
++		if (entity->sched_data != &bfqg->sched_data) {
++			bic_set_bfqq(bic, NULL, 0);
++			bfq_log_bfqq(bfqd, async_bfqq,
++				     "bic_change_group: %p %d",
++				     async_bfqq, atomic_read(&async_bfqq->ref));
++			bfq_put_queue(async_bfqq);
++		}
++	}
++
++	if (sync_bfqq != NULL) {
++		entity = &sync_bfqq->entity;
++		if (entity->sched_data != &bfqg->sched_data)
++			bfq_bfqq_move(bfqd, sync_bfqq, entity, bfqg);
++	}
++
++	return bfqg;
++}
++
++/**
++ * bfq_bic_change_cgroup - move @bic to @cgroup.
++ * @bic: the bic being migrated.
++ * @cgroup: the destination cgroup.
++ *
++ * When the task owning @bic is moved to @cgroup, @bic is immediately
++ * moved into its new parent group.
++ */
++static void bfq_bic_change_cgroup(struct bfq_io_cq *bic,
++				  struct cgroup *cgroup)
++{
++	struct bfq_data *bfqd;
++	unsigned long uninitialized_var(flags);
++
++	bfqd = bfq_get_bfqd_locked(&(bic->icq.q->elevator->elevator_data), &flags);
++	if (bfqd != NULL) {
++		__bfq_bic_change_cgroup(bfqd, bic, cgroup);
++		bfq_put_bfqd_unlock(bfqd, &flags);
++	}
++}
++
++/**
++ * bfq_bic_update_cgroup - update the cgroup of @bic.
++ * @bic: the @bic to update.
++ *
++ * Make sure that @bic is enqueued in the cgroup of the current task.
++ * We need this in addition to moving bics during the cgroup attach
++ * phase because the task owning @bic could be at its first disk
++ * access or we may end up in the root cgroup as the result of a
++ * memory allocation failure and here we try to move to the right
++ * group.
++ *
++ * Must be called under the queue lock.  It is safe to use the returned
++ * value even after the rcu_read_unlock() as the migration/destruction
++ * paths act under the queue lock too.  IOW it is impossible to race with
++ * group migration/destruction and end up with an invalid group as:
++ *   a) here cgroup has not yet been destroyed, nor its destroy callback
++ *      has started execution, as current holds a reference to it,
++ *   b) if it is destroyed after rcu_read_unlock() [after current is
++ *      migrated to a different cgroup] its attach() callback will have
++ *      taken care of remove all the references to the old cgroup data.
++ */
++static struct bfq_group *bfq_bic_update_cgroup(struct bfq_io_cq *bic)
++{
++	struct bfq_data *bfqd = bic_to_bfqd(bic);
++	struct bfq_group *bfqg;
++	struct cgroup *cgroup;
++
++	BUG_ON(bfqd == NULL);
++
++	rcu_read_lock();
++	cgroup = task_cgroup(current, bfqio_subsys_id);
++	bfqg = __bfq_bic_change_cgroup(bfqd, bic, cgroup);
++	rcu_read_unlock();
++
++	return bfqg;
++}
++
++/**
++ * bfq_flush_idle_tree - deactivate any entity on the idle tree of @st.
++ * @st: the service tree being flushed.
++ */
++static inline void bfq_flush_idle_tree(struct bfq_service_tree *st)
++{
++	struct bfq_entity *entity = st->first_idle;
++
++	for (; entity != NULL; entity = st->first_idle)
++		__bfq_deactivate_entity(entity, 0);
++}
++
++/**
++ * bfq_reparent_leaf_entity - move leaf entity to the root_group.
++ * @bfqd: the device data structure with the root group.
++ * @entity: the entity to move.
++ */
++static inline void bfq_reparent_leaf_entity(struct bfq_data *bfqd,
++					    struct bfq_entity *entity)
++{
++	struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++
++	BUG_ON(bfqq == NULL);
++	bfq_bfqq_move(bfqd, bfqq, entity, bfqd->root_group);
++	return;
++}
++
++/**
++ * bfq_reparent_active_entities - move to the root group all active entities.
++ * @bfqd: the device data structure with the root group.
++ * @bfqg: the group to move from.
++ * @st: the service tree with the entities.
++ *
++ * Needs queue_lock to be taken and reference to be valid over the call.
++ */
++static inline void bfq_reparent_active_entities(struct bfq_data *bfqd,
++						struct bfq_group *bfqg,
++						struct bfq_service_tree *st)
++{
++	struct rb_root *active = &st->active;
++	struct bfq_entity *entity = NULL;
++
++	if (!RB_EMPTY_ROOT(&st->active))
++		entity = bfq_entity_of(rb_first(active));
++
++	for (; entity != NULL ; entity = bfq_entity_of(rb_first(active)))
++		bfq_reparent_leaf_entity(bfqd, entity);
++
++	if (bfqg->sched_data.active_entity != NULL)
++		bfq_reparent_leaf_entity(bfqd, bfqg->sched_data.active_entity);
++
++	return;
++}
++
++/**
++ * bfq_destroy_group - destroy @bfqg.
++ * @bgrp: the bfqio_cgroup containing @bfqg.
++ * @bfqg: the group being destroyed.
++ *
++ * Destroy @bfqg, making sure that it is not referenced from its parent.
++ */
++static void bfq_destroy_group(struct bfqio_cgroup *bgrp, struct bfq_group *bfqg)
++{
++	struct bfq_data *bfqd;
++	struct bfq_service_tree *st;
++	struct bfq_entity *entity = bfqg->my_entity;
++	unsigned long uninitialized_var(flags);
++	int i;
++
++	hlist_del(&bfqg->group_node);
++
++	/*
++	 * Empty all service_trees belonging to this group before deactivating
++	 * the group itself.
++	 */
++	for (i = 0; i < BFQ_IOPRIO_CLASSES; i++) {
++		st = bfqg->sched_data.service_tree + i;
++
++		/*
++		 * The idle tree may still contain bfq_queues belonging
++		 * to exited task because they never migrated to a different
++		 * cgroup from the one being destroyed now.  Noone else
++		 * can access them so it's safe to act without any lock.
++		 */
++		bfq_flush_idle_tree(st);
++
++		/*
++		 * It may happen that some queues are still active
++		 * (busy) upon group destruction (if the corresponding
++		 * processes have been forced to terminate). We move
++		 * all the leaf entities corresponding to these queues
++		 * to the root_group.
++		 * Also, it may happen that the group has an entity
++		 * under service, which is disconnected from the active
++		 * tree: it must be moved, too.
++		 * There is no need to put the sync queues, as the
++		 * scheduler has taken no reference.
++		 */
++		bfqd = bfq_get_bfqd_locked(&bfqg->bfqd, &flags);
++		if (bfqd != NULL) {
++			bfq_reparent_active_entities(bfqd, bfqg, st);
++			bfq_put_bfqd_unlock(bfqd, &flags);
++		}
++		BUG_ON(!RB_EMPTY_ROOT(&st->active));
++		BUG_ON(!RB_EMPTY_ROOT(&st->idle));
++	}
++	BUG_ON(bfqg->sched_data.next_active != NULL);
++	BUG_ON(bfqg->sched_data.active_entity != NULL);
++
++	/*
++	 * We may race with device destruction, take extra care when
++	 * dereferencing bfqg->bfqd.
++	 */
++	bfqd = bfq_get_bfqd_locked(&bfqg->bfqd, &flags);
++	if (bfqd != NULL) {
++		hlist_del(&bfqg->bfqd_node);
++		__bfq_deactivate_entity(entity, 0);
++		bfq_put_async_queues(bfqd, bfqg);
++		bfq_put_bfqd_unlock(bfqd, &flags);
++	}
++	BUG_ON(entity->tree != NULL);
++
++	/*
++	 * No need to defer the kfree() to the end of the RCU grace
++	 * period: we are called from the destroy() callback of our
++	 * cgroup, so we can be sure that noone is a) still using
++	 * this cgroup or b) doing lookups in it.
++	 */
++	kfree(bfqg);
++}
++
++static void bfq_end_raising_async(struct bfq_data *bfqd)
++{
++	struct hlist_node *tmp;
++	struct bfq_group *bfqg;
++
++	hlist_for_each_entry_safe(bfqg, tmp, &bfqd->group_list, bfqd_node)
++		bfq_end_raising_async_queues(bfqd, bfqg);
++}
++
++/**
++ * bfq_disconnect_groups - diconnect @bfqd from all its groups.
++ * @bfqd: the device descriptor being exited.
++ *
++ * When the device exits we just make sure that no lookup can return
++ * the now unused group structures.  They will be deallocated on cgroup
++ * destruction.
++ */
++static void bfq_disconnect_groups(struct bfq_data *bfqd)
++{
++	struct hlist_node *tmp;
++	struct bfq_group *bfqg;
++
++	bfq_log(bfqd, "disconnect_groups beginning") ;
++	hlist_for_each_entry_safe(bfqg, tmp, &bfqd->group_list, bfqd_node) {
++		hlist_del(&bfqg->bfqd_node);
++
++		__bfq_deactivate_entity(bfqg->my_entity, 0);
++
++		/*
++		 * Don't remove from the group hash, just set an
++		 * invalid key.  No lookups can race with the
++		 * assignment as bfqd is being destroyed; this
++		 * implies also that new elements cannot be added
++		 * to the list.
++		 */
++		rcu_assign_pointer(bfqg->bfqd, NULL);
++
++		bfq_log(bfqd, "disconnect_groups: put async for group %p",
++			bfqg) ;
++		bfq_put_async_queues(bfqd, bfqg);
++	}
++}
++
++static inline void bfq_free_root_group(struct bfq_data *bfqd)
++{
++	struct bfqio_cgroup *bgrp = &bfqio_root_cgroup;
++	struct bfq_group *bfqg = bfqd->root_group;
++
++	bfq_put_async_queues(bfqd, bfqg);
++
++	spin_lock_irq(&bgrp->lock);
++	hlist_del_rcu(&bfqg->group_node);
++	spin_unlock_irq(&bgrp->lock);
++
++	/*
++	 * No need to synchronize_rcu() here: since the device is gone
++	 * there cannot be any read-side access to its root_group.
++	 */
++	kfree(bfqg);
++}
++
++static struct bfq_group *bfq_alloc_root_group(struct bfq_data *bfqd, int node)
++{
++	struct bfq_group *bfqg;
++	struct bfqio_cgroup *bgrp;
++	int i;
++
++	bfqg = kmalloc_node(sizeof(*bfqg), GFP_KERNEL | __GFP_ZERO, node);
++	if (bfqg == NULL)
++		return NULL;
++
++	bfqg->entity.parent = NULL;
++	for (i = 0; i < BFQ_IOPRIO_CLASSES; i++)
++		bfqg->sched_data.service_tree[i] = BFQ_SERVICE_TREE_INIT;
++
++	bgrp = &bfqio_root_cgroup;
++	spin_lock_irq(&bgrp->lock);
++	rcu_assign_pointer(bfqg->bfqd, bfqd);
++	hlist_add_head_rcu(&bfqg->group_node, &bgrp->group_data);
++	spin_unlock_irq(&bgrp->lock);
++
++	return bfqg;
++}
++
++#define SHOW_FUNCTION(__VAR)						\
++static u64 bfqio_cgroup_##__VAR##_read(struct cgroup *cgroup,		\
++				       struct cftype *cftype)		\
++{									\
++	struct bfqio_cgroup *bgrp;					\
++	u64 ret = -ENODEV;						\
++									\
++	mutex_lock(&bfqio_mutex);					\
++	if (bfqio_is_removed(cgroup))					\
++		goto out_unlock;					\
++									\
++	bgrp = cgroup_to_bfqio(cgroup);					\
++	spin_lock_irq(&bgrp->lock);					\
++	ret = bgrp->__VAR;						\
++	spin_unlock_irq(&bgrp->lock);					\
++									\
++out_unlock:								\
++	mutex_unlock(&bfqio_mutex);					\
++	return ret;							\
++}
++
++SHOW_FUNCTION(weight);
++SHOW_FUNCTION(ioprio);
++SHOW_FUNCTION(ioprio_class);
++#undef SHOW_FUNCTION
++
++#define STORE_FUNCTION(__VAR, __MIN, __MAX)				\
++static int bfqio_cgroup_##__VAR##_write(struct cgroup *cgroup,		\
++					struct cftype *cftype,		\
++					u64 val)			\
++{									\
++	struct bfqio_cgroup *bgrp;					\
++	struct bfq_group *bfqg;						\
++	int ret = -EINVAL;						\
++									\
++	if (val < (__MIN) || val > (__MAX))				\
++		return ret;						\
++									\
++	ret = -ENODEV;							\
++	mutex_lock(&bfqio_mutex);					\
++	if (bfqio_is_removed(cgroup))					\
++		goto out_unlock;					\
++	ret = 0;							\
++									\
++	bgrp = cgroup_to_bfqio(cgroup);					\
++									\
++	spin_lock_irq(&bgrp->lock);					\
++	bgrp->__VAR = (unsigned short)val;				\
++	hlist_for_each_entry(bfqg, &bgrp->group_data, group_node) {	\
++		/*							\
++                 * Setting the ioprio_changed flag of the entity        \
++                 * to 1 with new_##__VAR == ##__VAR would re-set        \
++                 * the value of the weight to its ioprio mapping.       \
++                 * Set the flag only if necessary.                      \
++                 */                                                     \
++                if ((unsigned short)val != bfqg->entity.new_##__VAR) {  \
++                        bfqg->entity.new_##__VAR = (unsigned short)val; \
++                        smp_wmb();                                      \
++                        bfqg->entity.ioprio_changed = 1;                \
++                }							\
++	}								\
++	spin_unlock_irq(&bgrp->lock);					\
++									\
++out_unlock:								\
++	mutex_unlock(&bfqio_mutex);					\
++	return ret;							\
++}
++
++STORE_FUNCTION(weight, BFQ_MIN_WEIGHT, BFQ_MAX_WEIGHT);
++STORE_FUNCTION(ioprio, 0, IOPRIO_BE_NR - 1);
++STORE_FUNCTION(ioprio_class, IOPRIO_CLASS_RT, IOPRIO_CLASS_IDLE);
++#undef STORE_FUNCTION
++
++static struct cftype bfqio_files[] = {
++	{
++		.name = "weight",
++		.read_u64 = bfqio_cgroup_weight_read,
++		.write_u64 = bfqio_cgroup_weight_write,
++	},
++	{
++		.name = "ioprio",
++		.read_u64 = bfqio_cgroup_ioprio_read,
++		.write_u64 = bfqio_cgroup_ioprio_write,
++	},
++	{
++		.name = "ioprio_class",
++		.read_u64 = bfqio_cgroup_ioprio_class_read,
++		.write_u64 = bfqio_cgroup_ioprio_class_write,
++	},
++	{ },	/* terminate */
++};
++
++static struct cgroup_subsys_state *bfqio_create(struct cgroup *cgroup)
++{
++	struct bfqio_cgroup *bgrp;
++
++	if (cgroup->parent != NULL) {
++		bgrp = kzalloc(sizeof(*bgrp), GFP_KERNEL);
++		if (bgrp == NULL)
++			return ERR_PTR(-ENOMEM);
++	} else
++		bgrp = &bfqio_root_cgroup;
++
++	spin_lock_init(&bgrp->lock);
++	INIT_HLIST_HEAD(&bgrp->group_data);
++	bgrp->ioprio = BFQ_DEFAULT_GRP_IOPRIO;
++	bgrp->ioprio_class = BFQ_DEFAULT_GRP_CLASS;
++
++	return &bgrp->css;
++}
++
++/*
++ * We cannot support shared io contexts, as we have no means to support
++ * two tasks with the same ioc in two different groups without major rework
++ * of the main bic/bfqq data structures.  By now we allow a task to change
++ * its cgroup only if it's the only owner of its ioc; the drawback of this
++ * behavior is that a group containing a task that forked using CLONE_IO
++ * will not be destroyed until the tasks sharing the ioc die.
++ */
++static int bfqio_can_attach(struct cgroup *cgroup, struct cgroup_taskset *tset)
++{
++	struct task_struct *task;
++	struct io_context *ioc;
++	int ret = 0;
++
++	cgroup_taskset_for_each(task, cgroup, tset) {
++		/* task_lock() is needed to avoid races with exit_io_context() */
++		task_lock(task);
++		ioc = task->io_context;
++		if (ioc != NULL && atomic_read(&ioc->nr_tasks) > 1)
++			/*
++			 * ioc == NULL means that the task is either too young or
++			 * exiting: if it has still no ioc the ioc can't be shared,
++			 * if the task is exiting the attach will fail anyway, no
++			 * matter what we return here.
++			 */
++			ret = -EINVAL;
++		task_unlock(task);
++		if (ret)
++			break;
++	}
++
++	return ret;
++}
++
++static void bfqio_attach(struct cgroup *cgroup, struct cgroup_taskset *tset)
++{
++	struct task_struct *task;
++	struct io_context *ioc;
++	struct io_cq *icq;
++
++	/*
++	 * IMPORTANT NOTE: The move of more than one process at a time to a
++	 * new group has not yet been tested.
++	 */
++	cgroup_taskset_for_each(task, cgroup, tset) {
++		ioc = get_task_io_context(task, GFP_ATOMIC, NUMA_NO_NODE);
++		if (ioc) {
++			/*
++			 * Handle cgroup change here.
++			 */
++			rcu_read_lock();
++			hlist_for_each_entry_rcu(icq, &ioc->icq_list, ioc_node)
++				if (!strncmp(icq->q->elevator->type->elevator_name,
++					     "bfq", ELV_NAME_MAX))
++					bfq_bic_change_cgroup(icq_to_bic(icq),
++							      cgroup);
++			rcu_read_unlock();
++			put_io_context(ioc);
++		}
++	}
++}
++
++static void bfqio_destroy(struct cgroup *cgroup)
++{
++	struct bfqio_cgroup *bgrp = cgroup_to_bfqio(cgroup);
++	struct hlist_node *tmp;
++	struct bfq_group *bfqg;
++
++	/*
++	 * Since we are destroying the cgroup, there are no more tasks
++	 * referencing it, and all the RCU grace periods that may have
++	 * referenced it are ended (as the destruction of the parent
++	 * cgroup is RCU-safe); bgrp->group_data will not be accessed by
++	 * anything else and we don't need any synchronization.
++	 */
++	hlist_for_each_entry_safe(bfqg, tmp, &bgrp->group_data, group_node)
++		bfq_destroy_group(bgrp, bfqg);
++
++	BUG_ON(!hlist_empty(&bgrp->group_data));
++
++	kfree(bgrp);
++}
++
++struct cgroup_subsys bfqio_subsys = {
++	.name = "bfqio",
++	.css_alloc = bfqio_create,
++	.can_attach = bfqio_can_attach,
++	.attach = bfqio_attach,
++	.css_free = bfqio_destroy,
++	.subsys_id = bfqio_subsys_id,
++	.base_cftypes = bfqio_files,
++};
++#else
++static inline void bfq_init_entity(struct bfq_entity *entity,
++				   struct bfq_group *bfqg)
++{
++	entity->weight = entity->new_weight;
++	entity->orig_weight = entity->new_weight;
++	entity->ioprio = entity->new_ioprio;
++	entity->ioprio_class = entity->new_ioprio_class;
++	entity->sched_data = &bfqg->sched_data;
++}
++
++static inline struct bfq_group *
++bfq_bic_update_cgroup(struct bfq_io_cq *bic)
++{
++	struct bfq_data *bfqd = bic_to_bfqd(bic);
++	return bfqd->root_group;
++}
++
++static inline void bfq_bfqq_move(struct bfq_data *bfqd,
++				 struct bfq_queue *bfqq,
++				 struct bfq_entity *entity,
++				 struct bfq_group *bfqg)
++{
++}
++
++static void bfq_end_raising_async(struct bfq_data *bfqd)
++{
++	bfq_end_raising_async_queues(bfqd, bfqd->root_group);
++}
++
++static inline void bfq_disconnect_groups(struct bfq_data *bfqd)
++{
++	bfq_put_async_queues(bfqd, bfqd->root_group);
++}
++
++static inline void bfq_free_root_group(struct bfq_data *bfqd)
++{
++	kfree(bfqd->root_group);
++}
++
++static struct bfq_group *bfq_alloc_root_group(struct bfq_data *bfqd, int node)
++{
++	struct bfq_group *bfqg;
++	int i;
++
++	bfqg = kmalloc_node(sizeof(*bfqg), GFP_KERNEL | __GFP_ZERO, node);
++	if (bfqg == NULL)
++		return NULL;
++
++	for (i = 0; i < BFQ_IOPRIO_CLASSES; i++)
++		bfqg->sched_data.service_tree[i] = BFQ_SERVICE_TREE_INIT;
++
++	return bfqg;
++}
++#endif
+diff --git a/block/bfq-ioc.c b/block/bfq-ioc.c
+new file mode 100644
+index 0000000..326e3ec
+--- /dev/null
++++ b/block/bfq-ioc.c
+@@ -0,0 +1,36 @@
++/*
++ * BFQ: I/O context handling.
++ *
++ * Based on ideas and code from CFQ:
++ * Copyright (C) 2003 Jens Axboe <axboe@××××××.dk>
++ *
++ * Copyright (C) 2008 Fabio Checconi <fabio@×××××××××××××.it>
++ *		      Paolo Valente <paolo.valente@×××××××.it>
++ *
++ * Copyright (C) 2010 Paolo Valente <paolo.valente@×××××××.it>
++ */
++
++/**
++ * icq_to_bic - convert iocontext queue structure to bfq_io_cq.
++ * @icq: the iocontext queue.
++ */
++static inline struct bfq_io_cq *icq_to_bic(struct io_cq *icq)
++{
++	/* bic->icq is the first member, %NULL will convert to %NULL */
++	return container_of(icq, struct bfq_io_cq, icq);
++}
++
++/**
++ * bfq_bic_lookup - search into @ioc a bic associated to @bfqd.
++ * @bfqd: the lookup key.
++ * @ioc: the io_context of the process doing I/O.
++ *
++ * Queue lock must be held.
++ */
++static inline struct bfq_io_cq *bfq_bic_lookup(struct bfq_data *bfqd,
++					       struct io_context *ioc)
++{
++	if(ioc)
++		return icq_to_bic(ioc_lookup_icq(ioc, bfqd->queue));
++	return NULL;
++}
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+new file mode 100644
+index 0000000..b230927
+--- /dev/null
++++ b/block/bfq-iosched.c
+@@ -0,0 +1,3070 @@
++/*
++ * BFQ, or Budget Fair Queueing, disk scheduler.
++ *
++ * Based on ideas and code from CFQ:
++ * Copyright (C) 2003 Jens Axboe <axboe@××××××.dk>
++ *
++ * Copyright (C) 2008 Fabio Checconi <fabio@×××××××××××××.it>
++ *		      Paolo Valente <paolo.valente@×××××××.it>
++ *
++ * Copyright (C) 2010 Paolo Valente <paolo.valente@×××××××.it>
++ *
++ * Licensed under the GPL-2 as detailed in the accompanying COPYING.BFQ file.
++ *
++ * BFQ is a proportional share disk scheduling algorithm based on the
++ * slice-by-slice service scheme of CFQ. But BFQ assigns budgets,
++ * measured in number of sectors, to tasks instead of time slices.
++ * The disk is not granted to the active task for a given time slice,
++ * but until it has exahusted its assigned budget.  This change from
++ * the time to the service domain allows BFQ to distribute the disk
++ * bandwidth among tasks as desired, without any distortion due to
++ * ZBR, workload fluctuations or other factors. BFQ uses an ad hoc
++ * internal scheduler, called B-WF2Q+, to schedule tasks according to
++ * their budgets.  Thanks to this accurate scheduler, BFQ can afford
++ * to assign high budgets to disk-bound non-seeky tasks (to boost the
++ * throughput), and yet guarantee low latencies to interactive and
++ * soft real-time applications.
++ *
++ * BFQ has been introduced in [1], where the interested reader can
++ * find an accurate description of the algorithm, the bandwidth
++ * distribution and latency guarantees it provides, plus formal proofs
++ * of all the properties.  With respect to the algorithm presented in
++ * the paper, this implementation adds several little heuristics, and
++ * a hierarchical extension, based on H-WF2Q+.
++ *
++ * B-WF2Q+ is based on WF2Q+, that is described in [2], together with
++ * H-WF2Q+, while the augmented tree used to implement B-WF2Q+ with O(log N)
++ * complexity derives from the one introduced with EEVDF in [3].
++ *
++ * [1] P. Valente and F. Checconi, ``High Throughput Disk Scheduling
++ *     with Deterministic Guarantees on Bandwidth Distribution,'',
++ *     IEEE Transactions on Computer, May 2010.
++ *
++ *     http://algo.ing.unimo.it/people/paolo/disk_sched/bfq-techreport.pdf
++ *
++ * [2] Jon C.R. Bennett and H. Zhang, ``Hierarchical Packet Fair Queueing
++ *     Algorithms,'' IEEE/ACM Transactions on Networking, 5(5):675-689,
++ *     Oct 1997.
++ *
++ *     http://www.cs.cmu.edu/~hzhang/papers/TON-97-Oct.ps.gz
++ *
++ * [3] I. Stoica and H. Abdel-Wahab, ``Earliest Eligible Virtual Deadline
++ *     First: A Flexible and Accurate Mechanism for Proportional Share
++ *     Resource Allocation,'' technical report.
++ *
++ *     http://www.cs.berkeley.edu/~istoica/papers/eevdf-tr-95.pdf
++ */
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/blkdev.h>
++#include <linux/cgroup.h>
++#include <linux/elevator.h>
++#include <linux/jiffies.h>
++#include <linux/rbtree.h>
++#include <linux/ioprio.h>
++#include "bfq.h"
++#include "blk.h"
++
++/* Max number of dispatches in one round of service. */
++static const int bfq_quantum = 4;
++
++/* Expiration time of sync (0) and async (1) requests, in jiffies. */
++static const int bfq_fifo_expire[2] = { HZ / 4, HZ / 8 };
++
++/* Maximum backwards seek, in KiB. */
++static const int bfq_back_max = 16 * 1024;
++
++/* Penalty of a backwards seek, in number of sectors. */
++static const int bfq_back_penalty = 2;
++
++/* Idling period duration, in jiffies. */
++static int bfq_slice_idle = HZ / 125;
++
++/* Default maximum budget values, in sectors and number of requests. */
++static const int bfq_default_max_budget = 16 * 1024;
++static const int bfq_max_budget_async_rq = 4;
++
++/*
++ * Async to sync throughput distribution is controlled as follows:
++ * when an async request is served, the entity is charged the number
++ * of sectors of the request, multipled by the factor below
++ */
++static const int bfq_async_charge_factor = 10;
++
++/* Default timeout values, in jiffies, approximating CFQ defaults. */
++static const int bfq_timeout_sync = HZ / 8;
++static int bfq_timeout_async = HZ / 25;
++
++struct kmem_cache *bfq_pool;
++
++/* Below this threshold (in ms), we consider thinktime immediate. */
++#define BFQ_MIN_TT		2
++
++/* hw_tag detection: parallel requests threshold and min samples needed. */
++#define BFQ_HW_QUEUE_THRESHOLD	4
++#define BFQ_HW_QUEUE_SAMPLES	32
++
++#define BFQQ_SEEK_THR	 (sector_t)(8 * 1024)
++#define BFQQ_SEEKY(bfqq) ((bfqq)->seek_mean > BFQQ_SEEK_THR)
++
++/* Min samples used for peak rate estimation (for autotuning). */
++#define BFQ_PEAK_RATE_SAMPLES	32
++
++/* Shift used for peak rate fixed precision calculations. */
++#define BFQ_RATE_SHIFT		16
++
++/*
++ * The duration of the weight raising for interactive applications is
++ * computed automatically (as default behaviour), using the following
++ * formula: duration = (R / r) * T, where r is the peak rate of the
++ * disk, and R and T are two reference parameters. In particular, R is
++ * the peak rate of a reference disk, and T is about the maximum time
++ * for starting popular large applications on that disk, under BFQ and
++ * while reading two files in parallel. Finally, BFQ uses two
++ * different pairs (R, T) depending on whether the disk is rotational
++ * or non-rotational.
++ */
++#define T_rot			(msecs_to_jiffies(5500))
++#define T_nonrot		(msecs_to_jiffies(2000))
++/* Next two quantities are in sectors/usec, left-shifted by BFQ_RATE_SHIFT */
++#define R_rot			17415
++#define R_nonrot		34791
++
++#define BFQ_SERVICE_TREE_INIT	((struct bfq_service_tree)		\
++				{ RB_ROOT, RB_ROOT, NULL, NULL, 0, 0 })
++
++#define RQ_BIC(rq)		((struct bfq_io_cq *) (rq)->elv.priv[0])
++#define RQ_BFQQ(rq)		((rq)->elv.priv[1])
++
++static inline void bfq_schedule_dispatch(struct bfq_data *bfqd);
++
++#include "bfq-ioc.c"
++#include "bfq-sched.c"
++#include "bfq-cgroup.c"
++
++#define bfq_class_idle(bfqq)	((bfqq)->entity.ioprio_class ==\
++				 IOPRIO_CLASS_IDLE)
++#define bfq_class_rt(bfqq)	((bfqq)->entity.ioprio_class ==\
++				 IOPRIO_CLASS_RT)
++
++#define bfq_sample_valid(samples)	((samples) > 80)
++
++/*
++ * We regard a request as SYNC, if either it's a read or has the SYNC bit
++ * set (in which case it could also be a direct WRITE).
++ */
++static inline int bfq_bio_sync(struct bio *bio)
++{
++	if (bio_data_dir(bio) == READ || (bio->bi_rw & REQ_SYNC))
++		return 1;
++
++	return 0;
++}
++
++/*
++ * Scheduler run of queue, if there are requests pending and no one in the
++ * driver that will restart queueing.
++ */
++static inline void bfq_schedule_dispatch(struct bfq_data *bfqd)
++{
++	if (bfqd->queued != 0) {
++		bfq_log(bfqd, "schedule dispatch");
++		kblockd_schedule_work(bfqd->queue, &bfqd->unplug_work);
++	}
++}
++
++/*
++ * Lifted from AS - choose which of rq1 and rq2 that is best served now.
++ * We choose the request that is closesr to the head right now.  Distance
++ * behind the head is penalized and only allowed to a certain extent.
++ */
++static struct request *bfq_choose_req(struct bfq_data *bfqd,
++				      struct request *rq1,
++				      struct request *rq2,
++				      sector_t last)
++{
++	sector_t s1, s2, d1 = 0, d2 = 0;
++	unsigned long back_max;
++#define BFQ_RQ1_WRAP	0x01 /* request 1 wraps */
++#define BFQ_RQ2_WRAP	0x02 /* request 2 wraps */
++	unsigned wrap = 0; /* bit mask: requests behind the disk head? */
++
++	if (rq1 == NULL || rq1 == rq2)
++		return rq2;
++	if (rq2 == NULL)
++		return rq1;
++
++	if (rq_is_sync(rq1) && !rq_is_sync(rq2))
++		return rq1;
++	else if (rq_is_sync(rq2) && !rq_is_sync(rq1))
++		return rq2;
++	if ((rq1->cmd_flags & REQ_META) && !(rq2->cmd_flags & REQ_META))
++		return rq1;
++	else if ((rq2->cmd_flags & REQ_META) && !(rq1->cmd_flags & REQ_META))
++		return rq2;
++
++	s1 = blk_rq_pos(rq1);
++	s2 = blk_rq_pos(rq2);
++
++	/*
++	 * By definition, 1KiB is 2 sectors.
++	 */
++	back_max = bfqd->bfq_back_max * 2;
++
++	/*
++	 * Strict one way elevator _except_ in the case where we allow
++	 * short backward seeks which are biased as twice the cost of a
++	 * similar forward seek.
++	 */
++	if (s1 >= last)
++		d1 = s1 - last;
++	else if (s1 + back_max >= last)
++		d1 = (last - s1) * bfqd->bfq_back_penalty;
++	else
++		wrap |= BFQ_RQ1_WRAP;
++
++	if (s2 >= last)
++		d2 = s2 - last;
++	else if (s2 + back_max >= last)
++		d2 = (last - s2) * bfqd->bfq_back_penalty;
++	else
++		wrap |= BFQ_RQ2_WRAP;
++
++	/* Found required data */
++
++	/*
++	 * By doing switch() on the bit mask "wrap" we avoid having to
++	 * check two variables for all permutations: --> faster!
++	 */
++	switch (wrap) {
++	case 0: /* common case for CFQ: rq1 and rq2 not wrapped */
++		if (d1 < d2)
++			return rq1;
++		else if (d2 < d1)
++			return rq2;
++		else {
++			if (s1 >= s2)
++				return rq1;
++			else
++				return rq2;
++		}
++
++	case BFQ_RQ2_WRAP:
++		return rq1;
++	case BFQ_RQ1_WRAP:
++		return rq2;
++	case (BFQ_RQ1_WRAP|BFQ_RQ2_WRAP): /* both rqs wrapped */
++	default:
++		/*
++		 * Since both rqs are wrapped,
++		 * start with the one that's further behind head
++		 * (--> only *one* back seek required),
++		 * since back seek takes more time than forward.
++		 */
++		if (s1 <= s2)
++			return rq1;
++		else
++			return rq2;
++	}
++}
++
++static struct bfq_queue *
++bfq_rq_pos_tree_lookup(struct bfq_data *bfqd, struct rb_root *root,
++		     sector_t sector, struct rb_node **ret_parent,
++		     struct rb_node ***rb_link)
++{
++	struct rb_node **p, *parent;
++	struct bfq_queue *bfqq = NULL;
++
++	parent = NULL;
++	p = &root->rb_node;
++	while (*p) {
++		struct rb_node **n;
++
++		parent = *p;
++		bfqq = rb_entry(parent, struct bfq_queue, pos_node);
++
++		/*
++		 * Sort strictly based on sector. Smallest to the left,
++		 * largest to the right.
++		 */
++		if (sector > blk_rq_pos(bfqq->next_rq))
++			n = &(*p)->rb_right;
++		else if (sector < blk_rq_pos(bfqq->next_rq))
++			n = &(*p)->rb_left;
++		else
++			break;
++		p = n;
++		bfqq = NULL;
++	}
++
++	*ret_parent = parent;
++	if (rb_link)
++		*rb_link = p;
++
++	bfq_log(bfqd, "rq_pos_tree_lookup %llu: returning %d",
++		(long long unsigned)sector,
++		bfqq != NULL ? bfqq->pid : 0);
++
++	return bfqq;
++}
++
++static void bfq_rq_pos_tree_add(struct bfq_data *bfqd, struct bfq_queue *bfqq)
++{
++	struct rb_node **p, *parent;
++	struct bfq_queue *__bfqq;
++
++	if (bfqq->pos_root != NULL) {
++		rb_erase(&bfqq->pos_node, bfqq->pos_root);
++		bfqq->pos_root = NULL;
++	}
++
++	if (bfq_class_idle(bfqq))
++		return;
++	if (!bfqq->next_rq)
++		return;
++
++	bfqq->pos_root = &bfqd->rq_pos_tree;
++	__bfqq = bfq_rq_pos_tree_lookup(bfqd, bfqq->pos_root,
++			blk_rq_pos(bfqq->next_rq), &parent, &p);
++	if (__bfqq == NULL) {
++		rb_link_node(&bfqq->pos_node, parent, p);
++		rb_insert_color(&bfqq->pos_node, bfqq->pos_root);
++	} else
++		bfqq->pos_root = NULL;
++}
++
++static struct request *bfq_find_next_rq(struct bfq_data *bfqd,
++					struct bfq_queue *bfqq,
++					struct request *last)
++{
++	struct rb_node *rbnext = rb_next(&last->rb_node);
++	struct rb_node *rbprev = rb_prev(&last->rb_node);
++	struct request *next = NULL, *prev = NULL;
++
++	BUG_ON(RB_EMPTY_NODE(&last->rb_node));
++
++	if (rbprev != NULL)
++		prev = rb_entry_rq(rbprev);
++
++	if (rbnext != NULL)
++		next = rb_entry_rq(rbnext);
++	else {
++		rbnext = rb_first(&bfqq->sort_list);
++		if (rbnext && rbnext != &last->rb_node)
++			next = rb_entry_rq(rbnext);
++	}
++
++	return bfq_choose_req(bfqd, next, prev, blk_rq_pos(last));
++}
++
++static void bfq_del_rq_rb(struct request *rq)
++{
++	struct bfq_queue *bfqq = RQ_BFQQ(rq);
++	struct bfq_data *bfqd = bfqq->bfqd;
++	const int sync = rq_is_sync(rq);
++
++	BUG_ON(bfqq->queued[sync] == 0);
++	bfqq->queued[sync]--;
++	bfqd->queued--;
++
++	elv_rb_del(&bfqq->sort_list, rq);
++
++	if (RB_EMPTY_ROOT(&bfqq->sort_list)) {
++		if (bfq_bfqq_busy(bfqq) && bfqq != bfqd->active_queue)
++			bfq_del_bfqq_busy(bfqd, bfqq, 1);
++		/*
++		 * Remove queue from request-position tree as it is empty.
++		 */
++		if (bfqq->pos_root != NULL) {
++			rb_erase(&bfqq->pos_node, bfqq->pos_root);
++			bfqq->pos_root = NULL;
++		}
++	}
++}
++
++/* see the definition of bfq_async_charge_factor for details */
++static inline unsigned long bfq_serv_to_charge(struct request *rq,
++					       struct bfq_queue *bfqq)
++{
++	return blk_rq_sectors(rq) *
++		(1 + ((!bfq_bfqq_sync(bfqq)) * (bfqq->raising_coeff == 1) *
++		bfq_async_charge_factor));
++}
++
++/**
++ * bfq_updated_next_req - update the queue after a new next_rq selection.
++ * @bfqd: the device data the queue belongs to.
++ * @bfqq: the queue to update.
++ *
++ * If the first request of a queue changes we make sure that the queue
++ * has enough budget to serve at least its first request (if the
++ * request has grown).  We do this because if the queue has not enough
++ * budget for its first request, it has to go through two dispatch
++ * rounds to actually get it dispatched.
++ */
++static void bfq_updated_next_req(struct bfq_data *bfqd,
++				 struct bfq_queue *bfqq)
++{
++	struct bfq_entity *entity = &bfqq->entity;
++	struct bfq_service_tree *st = bfq_entity_service_tree(entity);
++	struct request *next_rq = bfqq->next_rq;
++	unsigned long new_budget;
++
++	if (next_rq == NULL)
++		return;
++
++	if (bfqq == bfqd->active_queue)
++		/*
++		 * In order not to break guarantees, budgets cannot be
++		 * changed after an entity has been selected.
++		 */
++		return;
++
++	BUG_ON(entity->tree != &st->active);
++	BUG_ON(entity == entity->sched_data->active_entity);
++
++	new_budget = max_t(unsigned long, bfqq->max_budget,
++			   bfq_serv_to_charge(next_rq, bfqq));
++	entity->budget = new_budget;
++	bfq_log_bfqq(bfqd, bfqq, "updated next rq: new budget %lu", new_budget);
++	bfq_activate_bfqq(bfqd, bfqq);
++}
++
++static inline unsigned int bfq_wrais_duration(struct bfq_data *bfqd)
++{
++	u64 dur;
++
++	if (bfqd->bfq_raising_max_time > 0)
++		return bfqd->bfq_raising_max_time;
++
++	dur = bfqd->RT_prod;
++	do_div(dur, bfqd->peak_rate);
++
++	return dur;
++}
++
++static void bfq_add_rq_rb(struct request *rq)
++{
++	struct bfq_queue *bfqq = RQ_BFQQ(rq);
++	struct bfq_entity *entity = &bfqq->entity;
++	struct bfq_data *bfqd = bfqq->bfqd;
++	struct request *next_rq, *prev;
++	unsigned long old_raising_coeff = bfqq->raising_coeff;
++	int idle_for_long_time = bfqq->budget_timeout +
++		bfqd->bfq_raising_min_idle_time < jiffies;
++
++	bfq_log_bfqq(bfqd, bfqq, "add_rq_rb %d", rq_is_sync(rq));
++	bfqq->queued[rq_is_sync(rq)]++;
++	bfqd->queued++;
++
++	elv_rb_add(&bfqq->sort_list, rq);
++
++	/*
++	 * Check if this request is a better next-serve candidate.
++	 */
++	prev = bfqq->next_rq;
++	next_rq = bfq_choose_req(bfqd, bfqq->next_rq, rq, bfqd->last_position);
++	BUG_ON(next_rq == NULL);
++	bfqq->next_rq = next_rq;
++
++	/*
++	 * Adjust priority tree position, if next_rq changes.
++	 */
++	if (prev != bfqq->next_rq)
++		bfq_rq_pos_tree_add(bfqd, bfqq);
++
++	if (!bfq_bfqq_busy(bfqq)) {
++		int soft_rt = bfqd->bfq_raising_max_softrt_rate > 0 &&
++			bfqq->soft_rt_next_start < jiffies;
++		entity->budget = max_t(unsigned long, bfqq->max_budget,
++				       bfq_serv_to_charge(next_rq, bfqq));
++
++		if (! bfqd->low_latency)
++			goto add_bfqq_busy;
++
++		/*
++		 * If the queue is not being boosted and has been idle
++		 * for enough time, start a weight-raising period
++		 */
++		if(old_raising_coeff == 1 && (idle_for_long_time || soft_rt)) {
++			bfqq->raising_coeff = bfqd->bfq_raising_coeff;
++			if (idle_for_long_time)
++				bfqq->raising_cur_max_time =
++					bfq_wrais_duration(bfqd);
++			else
++				bfqq->raising_cur_max_time =
++					bfqd->bfq_raising_rt_max_time;
++			bfq_log_bfqq(bfqd, bfqq,
++				     "wrais starting at %llu msec,"
++				     "rais_max_time %u",
++				     bfqq->last_rais_start_finish,
++				     jiffies_to_msecs(bfqq->
++					raising_cur_max_time));
++		} else if (old_raising_coeff > 1) {
++			if (idle_for_long_time)
++				bfqq->raising_cur_max_time =
++					bfq_wrais_duration(bfqd);
++			else if (bfqq->raising_cur_max_time ==
++				 bfqd->bfq_raising_rt_max_time &&
++				 !soft_rt) {
++				bfqq->raising_coeff = 1;
++				bfq_log_bfqq(bfqd, bfqq,
++					     "wrais ending at %llu msec,"
++					     "rais_max_time %u",
++					     bfqq->last_rais_start_finish,
++					     jiffies_to_msecs(bfqq->
++						raising_cur_max_time));
++				}
++		}
++		if (old_raising_coeff != bfqq->raising_coeff)
++			entity->ioprio_changed = 1;
++add_bfqq_busy:
++		bfq_add_bfqq_busy(bfqd, bfqq);
++        } else {
++                if(bfqd->low_latency && old_raising_coeff == 1 &&
++			!rq_is_sync(rq) &&
++			bfqq->last_rais_start_finish +
++                        bfqd->bfq_raising_min_inter_arr_async < jiffies) {
++                        bfqq->raising_coeff = bfqd->bfq_raising_coeff;
++			bfqq->raising_cur_max_time = bfq_wrais_duration(bfqd);
++
++			entity->ioprio_changed = 1;
++			bfq_log_bfqq(bfqd, bfqq,
++				     "non-idle wrais starting at %llu msec,"
++				     "rais_max_time %u",
++				     bfqq->last_rais_start_finish,
++				     jiffies_to_msecs(bfqq->
++					raising_cur_max_time));
++                }
++                bfq_updated_next_req(bfqd, bfqq);
++	}
++
++	if(bfqd->low_latency &&
++		(old_raising_coeff == 1 || bfqq->raising_coeff == 1 ||
++		 idle_for_long_time))
++		bfqq->last_rais_start_finish = jiffies;
++}
++
++static void bfq_reposition_rq_rb(struct bfq_queue *bfqq, struct request *rq)
++{
++	elv_rb_del(&bfqq->sort_list, rq);
++	bfqq->queued[rq_is_sync(rq)]--;
++	bfqq->bfqd->queued--;
++	bfq_add_rq_rb(rq);
++}
++
++static struct request *bfq_find_rq_fmerge(struct bfq_data *bfqd,
++					  struct bio *bio)
++{
++	struct task_struct *tsk = current;
++	struct bfq_io_cq *bic;
++	struct bfq_queue *bfqq;
++
++	bic = bfq_bic_lookup(bfqd, tsk->io_context);
++	if (bic == NULL)
++		return NULL;
++
++	bfqq = bic_to_bfqq(bic, bfq_bio_sync(bio));
++	if (bfqq != NULL) {
++		sector_t sector = bio->bi_sector + bio_sectors(bio);
++
++		return elv_rb_find(&bfqq->sort_list, sector);
++	}
++
++	return NULL;
++}
++
++static void bfq_activate_request(struct request_queue *q, struct request *rq)
++{
++	struct bfq_data *bfqd = q->elevator->elevator_data;
++
++	bfqd->rq_in_driver++;
++	bfqd->last_position = blk_rq_pos(rq) + blk_rq_sectors(rq);
++	bfq_log(bfqd, "activate_request: new bfqd->last_position %llu",
++		(long long unsigned)bfqd->last_position);
++}
++
++static void bfq_deactivate_request(struct request_queue *q, struct request *rq)
++{
++	struct bfq_data *bfqd = q->elevator->elevator_data;
++
++	WARN_ON(bfqd->rq_in_driver == 0);
++	bfqd->rq_in_driver--;
++}
++
++static void bfq_remove_request(struct request *rq)
++{
++	struct bfq_queue *bfqq = RQ_BFQQ(rq);
++	struct bfq_data *bfqd = bfqq->bfqd;
++
++	if (bfqq->next_rq == rq) {
++		bfqq->next_rq = bfq_find_next_rq(bfqd, bfqq, rq);
++		bfq_updated_next_req(bfqd, bfqq);
++	}
++
++	list_del_init(&rq->queuelist);
++	bfq_del_rq_rb(rq);
++
++	if (rq->cmd_flags & REQ_META) {
++		WARN_ON(bfqq->meta_pending == 0);
++		bfqq->meta_pending--;
++	}
++}
++
++static int bfq_merge(struct request_queue *q, struct request **req,
++		     struct bio *bio)
++{
++	struct bfq_data *bfqd = q->elevator->elevator_data;
++	struct request *__rq;
++
++	__rq = bfq_find_rq_fmerge(bfqd, bio);
++	if (__rq != NULL && elv_rq_merge_ok(__rq, bio)) {
++		*req = __rq;
++		return ELEVATOR_FRONT_MERGE;
++	}
++
++	return ELEVATOR_NO_MERGE;
++}
++
++static void bfq_merged_request(struct request_queue *q, struct request *req,
++			       int type)
++{
++	if (type == ELEVATOR_FRONT_MERGE) {
++		struct bfq_queue *bfqq = RQ_BFQQ(req);
++
++		bfq_reposition_rq_rb(bfqq, req);
++	}
++}
++
++static void bfq_merged_requests(struct request_queue *q, struct request *rq,
++				struct request *next)
++{
++	struct bfq_queue *bfqq = RQ_BFQQ(rq);
++
++	/*
++	 * Reposition in fifo if next is older than rq.
++	 */
++	if (!list_empty(&rq->queuelist) && !list_empty(&next->queuelist) &&
++	    time_before(rq_fifo_time(next), rq_fifo_time(rq))) {
++		list_move(&rq->queuelist, &next->queuelist);
++		rq_set_fifo_time(rq, rq_fifo_time(next));
++	}
++
++	if (bfqq->next_rq == next)
++		bfqq->next_rq = rq;
++
++	bfq_remove_request(next);
++}
++
++/* Must be called with bfqq != NULL */
++static inline void bfq_bfqq_end_raising(struct bfq_queue *bfqq)
++{
++	BUG_ON(bfqq == NULL);
++	bfqq->raising_coeff = 1;
++	bfqq->raising_cur_max_time = 0;
++	/* Trigger a weight change on the next activation of the queue */
++	bfqq->entity.ioprio_changed = 1;
++}
++
++static void bfq_end_raising_async_queues(struct bfq_data *bfqd,
++					struct bfq_group *bfqg)
++{
++	int i, j;
++
++	for (i = 0; i < 2; i++)
++		for (j = 0; j < IOPRIO_BE_NR; j++)
++			if (bfqg->async_bfqq[i][j] != NULL)
++				bfq_bfqq_end_raising(bfqg->async_bfqq[i][j]);
++	if (bfqg->async_idle_bfqq != NULL)
++		bfq_bfqq_end_raising(bfqg->async_idle_bfqq);
++}
++
++static void bfq_end_raising(struct bfq_data *bfqd)
++{
++	struct bfq_queue *bfqq;
++
++	spin_lock_irq(bfqd->queue->queue_lock);
++
++	list_for_each_entry(bfqq, &bfqd->active_list, bfqq_list)
++		bfq_bfqq_end_raising(bfqq);
++	list_for_each_entry(bfqq, &bfqd->idle_list, bfqq_list)
++		bfq_bfqq_end_raising(bfqq);
++	bfq_end_raising_async(bfqd);
++
++	spin_unlock_irq(bfqd->queue->queue_lock);
++}
++
++static int bfq_allow_merge(struct request_queue *q, struct request *rq,
++			   struct bio *bio)
++{
++	struct bfq_data *bfqd = q->elevator->elevator_data;
++	struct bfq_io_cq *bic;
++	struct bfq_queue *bfqq;
++
++	/*
++	 * Disallow merge of a sync bio into an async request.
++	 */
++	if (bfq_bio_sync(bio) && !rq_is_sync(rq))
++		return 0;
++
++	/*
++	 * Lookup the bfqq that this bio will be queued with. Allow
++	 * merge only if rq is queued there.
++	 * Queue lock is held here.
++	 */
++	bic = bfq_bic_lookup(bfqd, current->io_context);
++	if (bic == NULL)
++		return 0;
++
++	bfqq = bic_to_bfqq(bic, bfq_bio_sync(bio));
++	return bfqq == RQ_BFQQ(rq);
++}
++
++static void __bfq_set_active_queue(struct bfq_data *bfqd,
++				   struct bfq_queue *bfqq)
++{
++	if (bfqq != NULL) {
++		bfq_mark_bfqq_must_alloc(bfqq);
++		bfq_mark_bfqq_budget_new(bfqq);
++		bfq_clear_bfqq_fifo_expire(bfqq);
++
++		bfqd->budgets_assigned = (bfqd->budgets_assigned*7 + 256) / 8;
++
++		bfq_log_bfqq(bfqd, bfqq, "set_active_queue, cur-budget = %lu",
++			     bfqq->entity.budget);
++	}
++
++	bfqd->active_queue = bfqq;
++}
++
++/*
++ * Get and set a new active queue for service.
++ */
++static struct bfq_queue *bfq_set_active_queue(struct bfq_data *bfqd,
++					      struct bfq_queue *bfqq)
++{
++	if (!bfqq)
++		bfqq = bfq_get_next_queue(bfqd);
++	else
++		bfq_get_next_queue_forced(bfqd, bfqq);
++
++	__bfq_set_active_queue(bfqd, bfqq);
++	return bfqq;
++}
++
++static inline sector_t bfq_dist_from_last(struct bfq_data *bfqd,
++					  struct request *rq)
++{
++	if (blk_rq_pos(rq) >= bfqd->last_position)
++		return blk_rq_pos(rq) - bfqd->last_position;
++	else
++		return bfqd->last_position - blk_rq_pos(rq);
++}
++
++/*
++ * Return true if bfqq has no request pending and rq is close enough to
++ * bfqd->last_position, or if rq is closer to bfqd->last_position than
++ * bfqq->next_rq
++ */
++static inline int bfq_rq_close(struct bfq_data *bfqd, struct request *rq)
++{
++	return bfq_dist_from_last(bfqd, rq) <= BFQQ_SEEK_THR;
++}
++
++static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
++{
++	struct rb_root *root = &bfqd->rq_pos_tree;
++	struct rb_node *parent, *node;
++	struct bfq_queue *__bfqq;
++	sector_t sector = bfqd->last_position;
++
++	if (RB_EMPTY_ROOT(root))
++		return NULL;
++
++	/*
++	 * First, if we find a request starting at the end of the last
++	 * request, choose it.
++	 */
++	__bfqq = bfq_rq_pos_tree_lookup(bfqd, root, sector, &parent, NULL);
++	if (__bfqq != NULL)
++		return __bfqq;
++
++	/*
++	 * If the exact sector wasn't found, the parent of the NULL leaf
++	 * will contain the closest sector (rq_pos_tree sorted by next_request
++	 * position).
++	 */
++	__bfqq = rb_entry(parent, struct bfq_queue, pos_node);
++	if (bfq_rq_close(bfqd, __bfqq->next_rq))
++		return __bfqq;
++
++	if (blk_rq_pos(__bfqq->next_rq) < sector)
++		node = rb_next(&__bfqq->pos_node);
++	else
++		node = rb_prev(&__bfqq->pos_node);
++	if (node == NULL)
++		return NULL;
++
++	__bfqq = rb_entry(node, struct bfq_queue, pos_node);
++	if (bfq_rq_close(bfqd, __bfqq->next_rq))
++		return __bfqq;
++
++	return NULL;
++}
++
++/*
++ * bfqd - obvious
++ * cur_bfqq - passed in so that we don't decide that the current queue
++ *            is closely cooperating with itself.
++ *
++ * We are assuming that cur_bfqq has dispatched at least one request,
++ * and that bfqd->last_position reflects a position on the disk associated
++ * with the I/O issued by cur_bfqq.
++ */
++static struct bfq_queue *bfq_close_cooperator(struct bfq_data *bfqd,
++					      struct bfq_queue *cur_bfqq)
++{
++	struct bfq_queue *bfqq;
++
++	if (bfq_class_idle(cur_bfqq))
++		return NULL;
++	if (!bfq_bfqq_sync(cur_bfqq))
++		return NULL;
++	if (BFQQ_SEEKY(cur_bfqq))
++		return NULL;
++
++	/* If device has only one backlogged bfq_queue, don't search. */
++	if (bfqd->busy_queues == 1)
++		return NULL;
++
++	/*
++	 * We should notice if some of the queues are cooperating, e.g.
++	 * working closely on the same area of the disk. In that case,
++	 * we can group them together and don't waste time idling.
++	 */
++	bfqq = bfqq_close(bfqd);
++	if (bfqq == NULL || bfqq == cur_bfqq)
++		return NULL;
++
++	/*
++	 * Do not merge queues from different bfq_groups.
++	*/
++	if (bfqq->entity.parent != cur_bfqq->entity.parent)
++		return NULL;
++
++	/*
++	 * It only makes sense to merge sync queues.
++	 */
++	if (!bfq_bfqq_sync(bfqq))
++		return NULL;
++	if (BFQQ_SEEKY(bfqq))
++		return NULL;
++
++	/*
++	 * Do not merge queues of different priority classes.
++	 */
++	if (bfq_class_rt(bfqq) != bfq_class_rt(cur_bfqq))
++		return NULL;
++
++	return bfqq;
++}
++
++/*
++ * If enough samples have been computed, return the current max budget
++ * stored in bfqd, which is dynamically updated according to the
++ * estimated disk peak rate; otherwise return the default max budget
++ */
++static inline unsigned long bfq_max_budget(struct bfq_data *bfqd)
++{
++	if (bfqd->budgets_assigned < 194)
++		return bfq_default_max_budget;
++	else
++		return bfqd->bfq_max_budget;
++}
++
++/*
++ * Return min budget, which is a fraction of the current or default
++ * max budget (trying with 1/32)
++ */
++static inline unsigned long bfq_min_budget(struct bfq_data *bfqd)
++{
++	if (bfqd->budgets_assigned < 194)
++		return bfq_default_max_budget / 32;
++	else
++		return bfqd->bfq_max_budget / 32;
++}
++
++/*
++ * Decides whether idling should be done for given device and
++ * given active queue.
++ */
++static inline bool bfq_queue_nonrot_noidle(struct bfq_data *bfqd,
++					   struct bfq_queue *active_bfqq)
++{
++	if (active_bfqq == NULL)
++		return false;
++	/*
++	 * If device is SSD it has no seek penalty, disable idling; but
++	 * do so only if:
++	 * - device does not support queuing, otherwise we still have
++	 *   a problem with sync vs async workloads;
++	 * - the queue is not weight-raised, to preserve guarantees.
++	 */
++	return (blk_queue_nonrot(bfqd->queue) && bfqd->hw_tag &&
++		active_bfqq->raising_coeff == 1);
++}
++
++static void bfq_arm_slice_timer(struct bfq_data *bfqd)
++{
++	struct bfq_queue *bfqq = bfqd->active_queue;
++	struct bfq_io_cq *bic;
++	unsigned long sl;
++
++	WARN_ON(!RB_EMPTY_ROOT(&bfqq->sort_list));
++
++	/* Tasks have exited, don't wait. */
++	bic = bfqd->active_bic;
++	if (bic == NULL || atomic_read(&bic->icq.ioc->active_ref) == 0)
++		return;
++
++	bfq_mark_bfqq_wait_request(bfqq);
++
++	/*
++	 * We don't want to idle for seeks, but we do want to allow
++	 * fair distribution of slice time for a process doing back-to-back
++	 * seeks. So allow a little bit of time for him to submit a new rq.
++	 *
++	 * To prevent processes with (partly) seeky workloads from
++	 * being too ill-treated, grant them a small fraction of the
++	 * assigned budget before reducing the waiting time to
++	 * BFQ_MIN_TT. This happened to help reduce latency.
++	 */
++	sl = bfqd->bfq_slice_idle;
++	if (bfq_sample_valid(bfqq->seek_samples) && BFQQ_SEEKY(bfqq) &&
++	    bfqq->entity.service > bfq_max_budget(bfqd) / 8 &&
++	    bfqq->raising_coeff == 1)
++		sl = min(sl, msecs_to_jiffies(BFQ_MIN_TT));
++	else if (bfqq->raising_coeff > 1)
++		sl = sl * 3;
++	bfqd->last_idling_start = ktime_get();
++	mod_timer(&bfqd->idle_slice_timer, jiffies + sl);
++	bfq_log(bfqd, "arm idle: %u/%u ms",
++		jiffies_to_msecs(sl), jiffies_to_msecs(bfqd->bfq_slice_idle));
++}
++
++/*
++ * Set the maximum time for the active queue to consume its
++ * budget. This prevents seeky processes from lowering the disk
++ * throughput (always guaranteed with a time slice scheme as in CFQ).
++ */
++static void bfq_set_budget_timeout(struct bfq_data *bfqd)
++{
++	struct bfq_queue *bfqq = bfqd->active_queue;
++	unsigned int timeout_coeff;
++	if (bfqq->raising_cur_max_time == bfqd->bfq_raising_rt_max_time)
++		timeout_coeff = 1;
++	else
++		timeout_coeff = bfqq->entity.weight / bfqq->entity.orig_weight;
++
++	bfqd->last_budget_start = ktime_get();
++
++	bfq_clear_bfqq_budget_new(bfqq);
++	bfqq->budget_timeout = jiffies +
++		bfqd->bfq_timeout[bfq_bfqq_sync(bfqq)] * timeout_coeff;
++
++	bfq_log_bfqq(bfqd, bfqq, "set budget_timeout %u",
++		jiffies_to_msecs(bfqd->bfq_timeout[bfq_bfqq_sync(bfqq)] *
++		timeout_coeff));
++}
++
++/*
++ * Move request from internal lists to the request queue dispatch list.
++ */
++static void bfq_dispatch_insert(struct request_queue *q, struct request *rq)
++{
++	struct bfq_data *bfqd = q->elevator->elevator_data;
++	struct bfq_queue *bfqq = RQ_BFQQ(rq);
++
++	bfq_remove_request(rq);
++	bfqq->dispatched++;
++	elv_dispatch_sort(q, rq);
++
++	if (bfq_bfqq_sync(bfqq))
++		bfqd->sync_flight++;
++}
++
++/*
++ * Return expired entry, or NULL to just start from scratch in rbtree.
++ */
++static struct request *bfq_check_fifo(struct bfq_queue *bfqq)
++{
++	struct request *rq = NULL;
++
++	if (bfq_bfqq_fifo_expire(bfqq))
++		return NULL;
++
++	bfq_mark_bfqq_fifo_expire(bfqq);
++
++	if (list_empty(&bfqq->fifo))
++		return NULL;
++
++	rq = rq_entry_fifo(bfqq->fifo.next);
++
++	if (time_before(jiffies, rq_fifo_time(rq)))
++		return NULL;
++
++	return rq;
++}
++
++/*
++ * Must be called with the queue_lock held.
++ */
++static int bfqq_process_refs(struct bfq_queue *bfqq)
++{
++	int process_refs, io_refs;
++
++	io_refs = bfqq->allocated[READ] + bfqq->allocated[WRITE];
++	process_refs = atomic_read(&bfqq->ref) - io_refs - bfqq->entity.on_st;
++	BUG_ON(process_refs < 0);
++	return process_refs;
++}
++
++static void bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
++{
++	int process_refs, new_process_refs;
++	struct bfq_queue *__bfqq;
++
++	/*
++	 * If there are no process references on the new_bfqq, then it is
++	 * unsafe to follow the ->new_bfqq chain as other bfqq's in the chain
++	 * may have dropped their last reference (not just their last process
++	 * reference).
++	 */
++	if (!bfqq_process_refs(new_bfqq))
++		return;
++
++	/* Avoid a circular list and skip interim queue merges. */
++	while ((__bfqq = new_bfqq->new_bfqq)) {
++		if (__bfqq == bfqq)
++			return;
++		new_bfqq = __bfqq;
++	}
++
++	process_refs = bfqq_process_refs(bfqq);
++	new_process_refs = bfqq_process_refs(new_bfqq);
++	/*
++	 * If the process for the bfqq has gone away, there is no
++	 * sense in merging the queues.
++	 */
++	if (process_refs == 0 || new_process_refs == 0)
++		return;
++
++	/*
++	 * Merge in the direction of the lesser amount of work.
++	 */
++	if (new_process_refs >= process_refs) {
++		bfqq->new_bfqq = new_bfqq;
++		atomic_add(process_refs, &new_bfqq->ref);
++	} else {
++		new_bfqq->new_bfqq = bfqq;
++		atomic_add(new_process_refs, &bfqq->ref);
++	}
++	bfq_log_bfqq(bfqq->bfqd, bfqq, "scheduling merge with queue %d",
++		new_bfqq->pid);
++}
++
++static inline unsigned long bfq_bfqq_budget_left(struct bfq_queue *bfqq)
++{
++	struct bfq_entity *entity = &bfqq->entity;
++	return entity->budget - entity->service;
++}
++
++static void __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq)
++{
++	BUG_ON(bfqq != bfqd->active_queue);
++
++	__bfq_bfqd_reset_active(bfqd);
++
++	/*
++	 * If this bfqq is shared between multiple processes, check
++	 * to make sure that those processes are still issuing I/Os
++	 * within the mean seek distance. If not, it may be time to
++	 * break the queues apart again.
++	 */
++	if (bfq_bfqq_coop(bfqq) && BFQQ_SEEKY(bfqq))
++		bfq_mark_bfqq_split_coop(bfqq);
++
++	if (RB_EMPTY_ROOT(&bfqq->sort_list)) {
++		/*
++		 * overloading budget_timeout field to store when
++		 * the queue remains with no backlog, used by
++		 * the weight-raising mechanism
++		 */
++		bfqq->budget_timeout = jiffies ;
++		bfq_del_bfqq_busy(bfqd, bfqq, 1);
++	} else {
++		bfq_activate_bfqq(bfqd, bfqq);
++		/*
++		 * Resort priority tree of potential close cooperators.
++		 */
++		bfq_rq_pos_tree_add(bfqd, bfqq);
++	}
++}
++
++/**
++ * __bfq_bfqq_recalc_budget - try to adapt the budget to the @bfqq behavior.
++ * @bfqd: device data.
++ * @bfqq: queue to update.
++ * @reason: reason for expiration.
++ *
++ * Handle the feedback on @bfqq budget.  See the body for detailed
++ * comments.
++ */
++static void __bfq_bfqq_recalc_budget(struct bfq_data *bfqd,
++				     struct bfq_queue *bfqq,
++				     enum bfqq_expiration reason)
++{
++	struct request *next_rq;
++	unsigned long budget, min_budget;
++
++	budget = bfqq->max_budget;
++	min_budget = bfq_min_budget(bfqd);
++
++	BUG_ON(bfqq != bfqd->active_queue);
++
++	bfq_log_bfqq(bfqd, bfqq, "recalc_budg: last budg %lu, budg left %lu",
++		bfqq->entity.budget, bfq_bfqq_budget_left(bfqq));
++	bfq_log_bfqq(bfqd, bfqq, "recalc_budg: last max_budg %lu, min budg %lu",
++		budget, bfq_min_budget(bfqd));
++	bfq_log_bfqq(bfqd, bfqq, "recalc_budg: sync %d, seeky %d",
++		bfq_bfqq_sync(bfqq), BFQQ_SEEKY(bfqd->active_queue));
++
++	if (bfq_bfqq_sync(bfqq)) {
++		switch (reason) {
++		/*
++		 * Caveat: in all the following cases we trade latency
++		 * for throughput.
++		 */
++		case BFQ_BFQQ_TOO_IDLE:
++			/*
++			 * This is the only case where we may reduce
++			 * the budget: if there is no requets of the
++			 * process still waiting for completion, then
++			 * we assume (tentatively) that the timer has
++			 * expired because the batch of requests of
++			 * the process could have been served with a
++			 * smaller budget.  Hence, betting that
++			 * process will behave in the same way when it
++			 * becomes backlogged again, we reduce its
++			 * next budget.  As long as we guess right,
++			 * this budget cut reduces the latency
++			 * experienced by the process.
++			 *
++			 * However, if there are still outstanding
++			 * requests, then the process may have not yet
++			 * issued its next request just because it is
++			 * still waiting for the completion of some of
++			 * the still oustanding ones.  So in this
++			 * subcase we do not reduce its budget, on the
++			 * contrary we increase it to possibly boost
++			 * the throughput, as discussed in the
++			 * comments to the BUDGET_TIMEOUT case.
++			 */
++			if (bfqq->dispatched > 0) /* still oustanding reqs */
++				budget = min(budget * 2, bfqd->bfq_max_budget);
++			else {
++				if (budget > 5 * min_budget)
++					budget -= 4 * min_budget;
++				else
++					budget = min_budget;
++			}
++			break;
++		case BFQ_BFQQ_BUDGET_TIMEOUT:
++			/*
++			 * We double the budget here because: 1) it
++			 * gives the chance to boost the throughput if
++			 * this is not a seeky process (which may have
++			 * bumped into this timeout because of, e.g.,
++			 * ZBR), 2) together with charge_full_budget
++			 * it helps give seeky processes higher
++			 * timestamps, and hence be served less
++			 * frequently.
++			 */
++			budget = min(budget * 2, bfqd->bfq_max_budget);
++			break;
++		case BFQ_BFQQ_BUDGET_EXHAUSTED:
++			/*
++			 * The process still has backlog, and did not
++			 * let either the budget timeout or the disk
++			 * idling timeout expire. Hence it is not
++			 * seeky, has a short thinktime and may be
++			 * happy with a higher budget too. So
++			 * definitely increase the budget of this good
++			 * candidate to boost the disk throughput.
++			 */
++			budget = min(budget * 4, bfqd->bfq_max_budget);
++			break;
++		case BFQ_BFQQ_NO_MORE_REQUESTS:
++		       /*
++			* Leave the budget unchanged.
++			*/
++		default:
++			return;
++		}
++	} else /* async queue */
++	    /* async queues get always the maximum possible budget
++	     * (their ability to dispatch is limited by
++	     * @bfqd->bfq_max_budget_async_rq).
++	     */
++		budget = bfqd->bfq_max_budget;
++
++	bfqq->max_budget = budget;
++
++	if (bfqd->budgets_assigned >= 194 && bfqd->bfq_user_max_budget == 0 &&
++	    bfqq->max_budget > bfqd->bfq_max_budget)
++		bfqq->max_budget = bfqd->bfq_max_budget;
++
++	/*
++	 * Make sure that we have enough budget for the next request.
++	 * Since the finish time of the bfqq must be kept in sync with
++	 * the budget, be sure to call __bfq_bfqq_expire() after the
++	 * update.
++	 */
++	next_rq = bfqq->next_rq;
++	if (next_rq != NULL)
++		bfqq->entity.budget = max_t(unsigned long, bfqq->max_budget,
++					    bfq_serv_to_charge(next_rq, bfqq));
++	else
++		bfqq->entity.budget = bfqq->max_budget;
++
++	bfq_log_bfqq(bfqd, bfqq, "head sect: %u, new budget %lu",
++			next_rq != NULL ? blk_rq_sectors(next_rq) : 0,
++			bfqq->entity.budget);
++}
++
++static unsigned long bfq_calc_max_budget(u64 peak_rate, u64 timeout)
++{
++	unsigned long max_budget;
++
++	/*
++	 * The max_budget calculated when autotuning is equal to the
++	 * amount of sectors transfered in timeout_sync at the
++	 * estimated peak rate.
++	 */
++	max_budget = (unsigned long)(peak_rate * 1000 *
++				     timeout >> BFQ_RATE_SHIFT);
++
++	return max_budget;
++}
++
++/*
++ * In addition to updating the peak rate, checks whether the process
++ * is "slow", and returns 1 if so. This slow flag is used, in addition
++ * to the budget timeout, to reduce the amount of service provided to
++ * seeky processes, and hence reduce their chances to lower the
++ * throughput. See the code for more details.
++ */
++static int bfq_update_peak_rate(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++				int compensate, enum bfqq_expiration reason)
++{
++	u64 bw, usecs, expected, timeout;
++	ktime_t delta;
++	int update = 0;
++
++	if (!bfq_bfqq_sync(bfqq) || bfq_bfqq_budget_new(bfqq))
++		return 0;
++
++	if (compensate)
++		delta = bfqd->last_idling_start;
++	else
++		delta = ktime_get();
++	delta = ktime_sub(delta, bfqd->last_budget_start);
++	usecs = ktime_to_us(delta);
++
++	/* Don't trust short/unrealistic values. */
++	if (usecs < 100 || usecs >= LONG_MAX)
++		return 0;
++
++	/*
++	 * Calculate the bandwidth for the last slice.  We use a 64 bit
++	 * value to store the peak rate, in sectors per usec in fixed
++	 * point math.  We do so to have enough precision in the estimate
++	 * and to avoid overflows.
++	 */
++	bw = (u64)bfqq->entity.service << BFQ_RATE_SHIFT;
++	do_div(bw, (unsigned long)usecs);
++
++	timeout = jiffies_to_msecs(bfqd->bfq_timeout[BLK_RW_SYNC]);
++
++	/*
++	 * Use only long (> 20ms) intervals to filter out spikes for
++	 * the peak rate estimation.
++	 */
++	if (usecs > 20000) {
++		if (bw > bfqd->peak_rate ||
++		   (!BFQQ_SEEKY(bfqq) &&
++		    reason == BFQ_BFQQ_BUDGET_TIMEOUT)) {
++			bfq_log(bfqd, "measured bw =%llu", bw);
++			/*
++			 * To smooth oscillations use a low-pass filter with
++			 * alpha=7/8, i.e.,
++			 * new_rate = (7/8) * old_rate + (1/8) * bw
++			 */
++			do_div(bw, 8);
++			if (bw == 0)
++				return 0;
++			bfqd->peak_rate *= 7;
++			do_div(bfqd->peak_rate, 8);
++			bfqd->peak_rate += bw;
++			update = 1;
++			bfq_log(bfqd, "new peak_rate=%llu", bfqd->peak_rate);
++		}
++
++		update |= bfqd->peak_rate_samples == BFQ_PEAK_RATE_SAMPLES - 1;
++
++		if (bfqd->peak_rate_samples < BFQ_PEAK_RATE_SAMPLES)
++			bfqd->peak_rate_samples++;
++
++		if (bfqd->peak_rate_samples == BFQ_PEAK_RATE_SAMPLES &&
++		    update && bfqd->bfq_user_max_budget == 0) {
++			bfqd->bfq_max_budget =
++				bfq_calc_max_budget(bfqd->peak_rate, timeout);
++			bfq_log(bfqd, "new max_budget=%lu",
++				bfqd->bfq_max_budget);
++		}
++	}
++
++	/*
++	 * If the process has been served for a too short time
++	 * interval to let its possible sequential accesses prevail on
++	 * the initial seek time needed to move the disk head on the
++	 * first sector it requested, then give the process a chance
++	 * and for the moment return false.
++	 */
++	if (bfqq->entity.budget <= bfq_max_budget(bfqd) / 8)
++		return 0;
++
++	/*
++	 * A process is considered ``slow'' (i.e., seeky, so that we
++	 * cannot treat it fairly in the service domain, as it would
++	 * slow down too much the other processes) if, when a slice
++	 * ends for whatever reason, it has received service at a
++	 * rate that would not be high enough to complete the budget
++	 * before the budget timeout expiration.
++	 */
++	expected = bw * 1000 * timeout >> BFQ_RATE_SHIFT;
++
++	/*
++	 * Caveat: processes doing IO in the slower disk zones will
++	 * tend to be slow(er) even if not seeky. And the estimated
++	 * peak rate will actually be an average over the disk
++	 * surface. Hence, to not be too harsh with unlucky processes,
++	 * we keep a budget/3 margin of safety before declaring a
++	 * process slow.
++	 */
++	return expected > (4 * bfqq->entity.budget) / 3;
++}
++
++/**
++ * bfq_bfqq_expire - expire a queue.
++ * @bfqd: device owning the queue.
++ * @bfqq: the queue to expire.
++ * @compensate: if true, compensate for the time spent idling.
++ * @reason: the reason causing the expiration.
++ *
++ *
++ * If the process associated to the queue is slow (i.e., seeky), or in
++ * case of budget timeout, or, finally, if it is async, we
++ * artificially charge it an entire budget (independently of the
++ * actual service it received). As a consequence, the queue will get
++ * higher timestamps than the correct ones upon reactivation, and
++ * hence it will be rescheduled as if it had received more service
++ * than what it actually received. In the end, this class of processes
++ * will receive less service in proportion to how slowly they consume
++ * their budgets (and hence how seriously they tend to lower the
++ * throughput).
++ *
++ * In contrast, when a queue expires because it has been idling for
++ * too much or because it exhausted its budget, we do not touch the
++ * amount of service it has received. Hence when the queue will be
++ * reactivated and its timestamps updated, the latter will be in sync
++ * with the actual service received by the queue until expiration.
++ *
++ * Charging a full budget to the first type of queues and the exact
++ * service to the others has the effect of using the WF2Q+ policy to
++ * schedule the former on a timeslice basis, without violating the
++ * service domain guarantees of the latter.
++ */
++static void bfq_bfqq_expire(struct bfq_data *bfqd,
++			    struct bfq_queue *bfqq,
++			    int compensate,
++			    enum bfqq_expiration reason)
++{
++	int slow;
++	BUG_ON(bfqq != bfqd->active_queue);
++
++	/* Update disk peak rate for autotuning and check whether the
++	 * process is slow (see bfq_update_peak_rate).
++	 */
++	slow = bfq_update_peak_rate(bfqd, bfqq, compensate, reason);
++
++	/*
++	 * As above explained, 'punish' slow (i.e., seeky), timed-out
++	 * and async queues, to favor sequential sync workloads.
++	 *
++	 * Processes doing IO in the slower disk zones will tend to be
++	 * slow(er) even if not seeky. Hence, since the estimated peak
++	 * rate is actually an average over the disk surface, these
++	 * processes may timeout just for bad luck. To avoid punishing
++	 * them we do not charge a full budget to a process that
++	 * succeeded in consuming at least 2/3 of its budget.
++	 */
++	if (slow || (reason == BFQ_BFQQ_BUDGET_TIMEOUT &&
++		     bfq_bfqq_budget_left(bfqq) >=  bfqq->entity.budget / 3))
++		bfq_bfqq_charge_full_budget(bfqq);
++
++	if (bfqd->low_latency && bfqq->raising_coeff == 1)
++		bfqq->last_rais_start_finish = jiffies;
++
++	if (bfqd->low_latency && bfqd->bfq_raising_max_softrt_rate > 0) {
++	    if(reason != BFQ_BFQQ_BUDGET_TIMEOUT)
++		bfqq->soft_rt_next_start =
++			jiffies +
++			HZ * bfqq->entity.service /
++			bfqd->bfq_raising_max_softrt_rate;
++		else
++			bfqq->soft_rt_next_start = -1; /* infinity */
++	}
++	bfq_log_bfqq(bfqd, bfqq,
++		"expire (%d, slow %d, num_disp %d, idle_win %d)", reason, slow,
++		bfqq->dispatched, bfq_bfqq_idle_window(bfqq));
++
++	/* Increase, decrease or leave budget unchanged according to reason */
++	__bfq_bfqq_recalc_budget(bfqd, bfqq, reason);
++	__bfq_bfqq_expire(bfqd, bfqq);
++}
++
++/*
++ * Budget timeout is not implemented through a dedicated timer, but
++ * just checked on request arrivals and completions, as well as on
++ * idle timer expirations.
++ */
++static int bfq_bfqq_budget_timeout(struct bfq_queue *bfqq)
++{
++	if (bfq_bfqq_budget_new(bfqq))
++		return 0;
++
++	if (time_before(jiffies, bfqq->budget_timeout))
++		return 0;
++
++	return 1;
++}
++
++/*
++ * If we expire a queue that is waiting for the arrival of a new
++ * request, we may prevent the fictitious timestamp backshifting that
++ * allows the guarantees of the queue to be preserved (see [1] for
++ * this tricky aspect). Hence we return true only if this condition
++ * does not hold, or if the queue is slow enough to deserve only to be
++ * kicked off for preserving a high throughput.
++*/
++static inline int bfq_may_expire_for_budg_timeout(struct bfq_queue *bfqq)
++{
++	bfq_log_bfqq(bfqq->bfqd, bfqq,
++		"may_budget_timeout: wr %d left %d timeout %d",
++		bfq_bfqq_wait_request(bfqq),
++			bfq_bfqq_budget_left(bfqq) >=  bfqq->entity.budget / 3,
++		bfq_bfqq_budget_timeout(bfqq));
++
++	return (!bfq_bfqq_wait_request(bfqq) ||
++		bfq_bfqq_budget_left(bfqq) >=  bfqq->entity.budget / 3)
++		&&
++		bfq_bfqq_budget_timeout(bfqq);
++}
++
++/*
++ * If the active queue is empty, but it is sync and either of the following
++ * conditions holds, then: 1) the queue must remain active and cannot be
++ * expired, and 2) the disk must be idled to wait for the possible arrival
++ * of a new request for the queue. The conditions are:
++ * - the device is rotational and not performing NCQ, and the queue has its
++ *   idle window set (in this case, waiting for a new request for the queue
++ *   is likely to boost the disk throughput);
++ * - the queue is weight-raised (waiting for the request is necessary for
++ *   providing the queue with fairness and latency guarantees).
++ */
++static inline bool bfq_bfqq_must_idle(struct bfq_queue *bfqq,
++				      int budg_timeout)
++{
++	struct bfq_data *bfqd = bfqq->bfqd;
++
++	return (bfq_bfqq_sync(bfqq) && RB_EMPTY_ROOT(&bfqq->sort_list) &&
++		bfqd->bfq_slice_idle != 0 &&
++		((bfq_bfqq_idle_window(bfqq) && !bfqd->hw_tag &&
++		  !blk_queue_nonrot(bfqd->queue))
++		 || bfqq->raising_coeff > 1) &&
++		(bfqd->rq_in_driver == 0 ||
++				budg_timeout ||
++                                bfqq->raising_coeff > 1) &&
++                !bfq_close_cooperator(bfqd, bfqq) &&
++                (!bfq_bfqq_coop(bfqq) ||
++			!bfq_bfqq_some_coop_idle(bfqq)) &&
++		!bfq_queue_nonrot_noidle(bfqd, bfqq));
++}
++
++/*
++ * Select a queue for service.  If we have a current active queue,
++ * check whether to continue servicing it, or retrieve and set a new one.
++ */
++static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
++{
++	struct bfq_queue *bfqq, *new_bfqq = NULL;
++	struct request *next_rq;
++	enum bfqq_expiration reason = BFQ_BFQQ_BUDGET_TIMEOUT;
++	int budg_timeout;
++
++	bfqq = bfqd->active_queue;
++	if (bfqq == NULL)
++		goto new_queue;
++
++	bfq_log_bfqq(bfqd, bfqq, "select_queue: already active queue");
++
++	/*
++         * If another queue has a request waiting within our mean seek
++         * distance, let it run. The expire code will check for close
++         * cooperators and put the close queue at the front of the
++         * service tree. If possible, merge the expiring queue with the
++         * new bfqq.
++         */
++        new_bfqq = bfq_close_cooperator(bfqd, bfqq);
++        if (new_bfqq != NULL && bfqq->new_bfqq == NULL)
++                bfq_setup_merge(bfqq, new_bfqq);
++
++	budg_timeout = bfq_may_expire_for_budg_timeout(bfqq);
++	if (budg_timeout &&
++	    !bfq_bfqq_must_idle(bfqq, budg_timeout))
++		goto expire;
++
++	next_rq = bfqq->next_rq;
++	/*
++	 * If bfqq has requests queued and it has enough budget left to
++	 * serve them, keep the queue, otherwise expire it.
++	 */
++	if (next_rq != NULL) {
++		if (bfq_serv_to_charge(next_rq, bfqq) >
++			bfq_bfqq_budget_left(bfqq)) {
++			reason = BFQ_BFQQ_BUDGET_EXHAUSTED;
++			goto expire;
++		} else {
++			/*
++			 * The idle timer may be pending because we may not
++			 * disable disk idling even when a new request arrives
++			 */
++			if (timer_pending(&bfqd->idle_slice_timer)) {
++				/*
++				 * If we get here: 1) at least a new request
++				 * has arrived but we have not disabled the
++				 * timer because the request was too small,
++				 * 2) then the block layer has unplugged the
++				 * device, causing the dispatch to be invoked.
++				 *
++				 * Since the device is unplugged, now the
++				 * requests are probably large enough to
++				 * provide a reasonable throughput.
++				 * So we disable idling.
++				 */
++				bfq_clear_bfqq_wait_request(bfqq);
++				del_timer(&bfqd->idle_slice_timer);
++			}
++			if (new_bfqq == NULL)
++				goto keep_queue;
++			else
++				goto expire;
++		}
++	}
++
++	/*
++	 * No requests pending.  If there is no cooperator, and the active
++	 * queue still has requests in flight or is idling for a new request,
++	 * then keep it.
++	 */
++	if (new_bfqq == NULL && (timer_pending(&bfqd->idle_slice_timer) ||
++	    (bfqq->dispatched != 0 &&
++	     (bfq_bfqq_idle_window(bfqq) || bfqq->raising_coeff > 1) &&
++	     !bfq_queue_nonrot_noidle(bfqd, bfqq)))) {
++		bfqq = NULL;
++		goto keep_queue;
++	} else if (new_bfqq != NULL && timer_pending(&bfqd->idle_slice_timer)) {
++		/*
++		 * Expiring the queue because there is a close cooperator,
++		 * cancel timer.
++		 */
++		bfq_clear_bfqq_wait_request(bfqq);
++		del_timer(&bfqd->idle_slice_timer);
++	}
++
++	reason = BFQ_BFQQ_NO_MORE_REQUESTS;
++expire:
++	bfq_bfqq_expire(bfqd, bfqq, 0, reason);
++new_queue:
++	bfqq = bfq_set_active_queue(bfqd, new_bfqq);
++	bfq_log(bfqd, "select_queue: new queue %d returned",
++		bfqq != NULL ? bfqq->pid : 0);
++keep_queue:
++	return bfqq;
++}
++
++static void update_raising_data(struct bfq_data *bfqd, struct bfq_queue *bfqq)
++{
++	if (bfqq->raising_coeff > 1) { /* queue is being boosted */
++		struct bfq_entity *entity = &bfqq->entity;
++
++		bfq_log_bfqq(bfqd, bfqq,
++			"raising period dur %u/%u msec, "
++			"old raising coeff %u, w %d(%d)",
++			jiffies_to_msecs(jiffies -
++				bfqq->last_rais_start_finish),
++			jiffies_to_msecs(bfqq->raising_cur_max_time),
++			bfqq->raising_coeff,
++			bfqq->entity.weight, bfqq->entity.orig_weight);
++
++		BUG_ON(bfqq != bfqd->active_queue && entity->weight !=
++			entity->orig_weight * bfqq->raising_coeff);
++		if(entity->ioprio_changed)
++			bfq_log_bfqq(bfqd, bfqq,
++			"WARN: pending prio change");
++		/*
++		 * If too much time has elapsed from the beginning
++		 * of this weight-raising period and process is not soft
++		 * real-time, stop it
++		 */
++		if (jiffies - bfqq->last_rais_start_finish >
++			bfqq->raising_cur_max_time) {
++			int soft_rt = bfqd->bfq_raising_max_softrt_rate > 0 &&
++				bfqq->soft_rt_next_start < jiffies;
++
++			bfqq->last_rais_start_finish = jiffies;
++			if (soft_rt)
++				bfqq->raising_cur_max_time =
++					bfqd->bfq_raising_rt_max_time;
++			else {
++				bfq_log_bfqq(bfqd, bfqq,
++					     "wrais ending at %llu msec,"
++					     "rais_max_time %u",
++					     bfqq->last_rais_start_finish,
++					     jiffies_to_msecs(bfqq->
++						raising_cur_max_time));
++				bfq_bfqq_end_raising(bfqq);
++				__bfq_entity_update_weight_prio(
++					bfq_entity_service_tree(entity),
++					entity);
++			}
++		}
++	}
++}
++
++/*
++ * Dispatch one request from bfqq, moving it to the request queue
++ * dispatch list.
++ */
++static int bfq_dispatch_request(struct bfq_data *bfqd,
++				struct bfq_queue *bfqq)
++{
++	int dispatched = 0;
++	struct request *rq;
++	unsigned long service_to_charge;
++
++	BUG_ON(RB_EMPTY_ROOT(&bfqq->sort_list));
++
++	/* Follow expired path, else get first next available. */
++	rq = bfq_check_fifo(bfqq);
++	if (rq == NULL)
++		rq = bfqq->next_rq;
++	service_to_charge = bfq_serv_to_charge(rq, bfqq);
++
++	if (service_to_charge > bfq_bfqq_budget_left(bfqq)) {
++		/*
++		 * This may happen if the next rq is chosen
++		 * in fifo order instead of sector order.
++		 * The budget is properly dimensioned
++		 * to be always sufficient to serve the next request
++		 * only if it is chosen in sector order. The reason is
++		 * that it would be quite inefficient and little useful
++		 * to always make sure that the budget is large enough
++		 * to serve even the possible next rq in fifo order.
++		 * In fact, requests are seldom served in fifo order.
++		 *
++		 * Expire the queue for budget exhaustion, and
++		 * make sure that the next act_budget is enough
++		 * to serve the next request, even if it comes
++		 * from the fifo expired path.
++		 */
++		bfqq->next_rq = rq;
++		/*
++		 * Since this dispatch is failed, make sure that
++		 * a new one will be performed
++		 */
++		if (!bfqd->rq_in_driver)
++			bfq_schedule_dispatch(bfqd);
++		goto expire;
++	}
++
++	/* Finally, insert request into driver dispatch list. */
++	bfq_bfqq_served(bfqq, service_to_charge);
++	bfq_dispatch_insert(bfqd->queue, rq);
++
++	update_raising_data(bfqd, bfqq);
++
++	bfq_log_bfqq(bfqd, bfqq, "dispatched %u sec req (%llu), "
++			"budg left %lu",
++			blk_rq_sectors(rq),
++			(long long unsigned)blk_rq_pos(rq),
++			bfq_bfqq_budget_left(bfqq));
++
++	dispatched++;
++
++	if (bfqd->active_bic == NULL) {
++		atomic_long_inc(&RQ_BIC(rq)->icq.ioc->refcount);
++		bfqd->active_bic = RQ_BIC(rq);
++	}
++
++	if (bfqd->busy_queues > 1 && ((!bfq_bfqq_sync(bfqq) &&
++	    dispatched >= bfqd->bfq_max_budget_async_rq) ||
++	    bfq_class_idle(bfqq)))
++		goto expire;
++
++	return dispatched;
++
++expire:
++	bfq_bfqq_expire(bfqd, bfqq, 0, BFQ_BFQQ_BUDGET_EXHAUSTED);
++	return dispatched;
++}
++
++static int __bfq_forced_dispatch_bfqq(struct bfq_queue *bfqq)
++{
++	int dispatched = 0;
++
++	while (bfqq->next_rq != NULL) {
++		bfq_dispatch_insert(bfqq->bfqd->queue, bfqq->next_rq);
++		dispatched++;
++	}
++
++	BUG_ON(!list_empty(&bfqq->fifo));
++	return dispatched;
++}
++
++/*
++ * Drain our current requests.  Used for barriers and when switching
++ * io schedulers on-the-fly.
++ */
++static int bfq_forced_dispatch(struct bfq_data *bfqd)
++{
++	struct bfq_queue *bfqq, *n;
++	struct bfq_service_tree *st;
++	int dispatched = 0;
++
++	bfqq = bfqd->active_queue;
++	if (bfqq != NULL)
++		__bfq_bfqq_expire(bfqd, bfqq);
++
++	/*
++	 * Loop through classes, and be careful to leave the scheduler
++	 * in a consistent state, as feedback mechanisms and vtime
++	 * updates cannot be disabled during the process.
++	 */
++	list_for_each_entry_safe(bfqq, n, &bfqd->active_list, bfqq_list) {
++		st = bfq_entity_service_tree(&bfqq->entity);
++
++		dispatched += __bfq_forced_dispatch_bfqq(bfqq);
++		bfqq->max_budget = bfq_max_budget(bfqd);
++
++		bfq_forget_idle(st);
++	}
++
++	BUG_ON(bfqd->busy_queues != 0);
++
++	return dispatched;
++}
++
++static int bfq_dispatch_requests(struct request_queue *q, int force)
++{
++	struct bfq_data *bfqd = q->elevator->elevator_data;
++	struct bfq_queue *bfqq;
++	int max_dispatch;
++
++	bfq_log(bfqd, "dispatch requests: %d busy queues", bfqd->busy_queues);
++	if (bfqd->busy_queues == 0)
++		return 0;
++
++	if (unlikely(force))
++		return bfq_forced_dispatch(bfqd);
++
++	if((bfqq = bfq_select_queue(bfqd)) == NULL)
++		return 0;
++
++	max_dispatch = bfqd->bfq_quantum;
++	if (bfq_class_idle(bfqq))
++		max_dispatch = 1;
++
++	if (!bfq_bfqq_sync(bfqq))
++		max_dispatch = bfqd->bfq_max_budget_async_rq;
++
++	if (bfqq->dispatched >= max_dispatch) {
++		if (bfqd->busy_queues > 1)
++			return 0;
++		if (bfqq->dispatched >= 4 * max_dispatch)
++			return 0;
++	}
++
++	if (bfqd->sync_flight != 0 && !bfq_bfqq_sync(bfqq))
++		return 0;
++
++	bfq_clear_bfqq_wait_request(bfqq);
++	BUG_ON(timer_pending(&bfqd->idle_slice_timer));
++
++	if (! bfq_dispatch_request(bfqd, bfqq))
++		return 0;
++
++	bfq_log_bfqq(bfqd, bfqq, "dispatched one request of %d"
++		     "(max_disp %d)", bfqq->pid, max_dispatch);
++
++	return 1;
++}
++
++/*
++ * Task holds one reference to the queue, dropped when task exits.  Each rq
++ * in-flight on this queue also holds a reference, dropped when rq is freed.
++ *
++ * Queue lock must be held here.
++ */
++static void bfq_put_queue(struct bfq_queue *bfqq)
++{
++	struct bfq_data *bfqd = bfqq->bfqd;
++
++	BUG_ON(atomic_read(&bfqq->ref) <= 0);
++
++	bfq_log_bfqq(bfqd, bfqq, "put_queue: %p %d", bfqq,
++		     atomic_read(&bfqq->ref));
++	if (!atomic_dec_and_test(&bfqq->ref))
++		return;
++
++	BUG_ON(rb_first(&bfqq->sort_list) != NULL);
++	BUG_ON(bfqq->allocated[READ] + bfqq->allocated[WRITE] != 0);
++	BUG_ON(bfqq->entity.tree != NULL);
++	BUG_ON(bfq_bfqq_busy(bfqq));
++	BUG_ON(bfqd->active_queue == bfqq);
++
++	bfq_log_bfqq(bfqd, bfqq, "put_queue: %p freed", bfqq);
++
++	kmem_cache_free(bfq_pool, bfqq);
++}
++
++static void bfq_put_cooperator(struct bfq_queue *bfqq)
++{
++	struct bfq_queue *__bfqq, *next;
++
++	/*
++	 * If this queue was scheduled to merge with another queue, be
++	 * sure to drop the reference taken on that queue (and others in
++	 * the merge chain). See bfq_setup_merge and bfq_merge_bfqqs.
++	 */
++	__bfqq = bfqq->new_bfqq;
++	while (__bfqq) {
++		if (__bfqq == bfqq) {
++			WARN(1, "bfqq->new_bfqq loop detected.\n");
++			break;
++		}
++		next = __bfqq->new_bfqq;
++		bfq_put_queue(__bfqq);
++		__bfqq = next;
++	}
++}
++
++static void bfq_exit_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq)
++{
++	if (bfqq == bfqd->active_queue) {
++		__bfq_bfqq_expire(bfqd, bfqq);
++		bfq_schedule_dispatch(bfqd);
++	}
++
++	bfq_log_bfqq(bfqd, bfqq, "exit_bfqq: %p, %d", bfqq,
++		     atomic_read(&bfqq->ref));
++
++	bfq_put_cooperator(bfqq);
++
++	bfq_put_queue(bfqq);
++}
++
++static void bfq_init_icq(struct io_cq *icq)
++{
++	struct bfq_io_cq *bic = icq_to_bic(icq);
++
++	bic->ttime.last_end_request = jiffies;
++}
++
++static void bfq_exit_icq(struct io_cq *icq)
++{
++	struct bfq_io_cq *bic = icq_to_bic(icq);
++	struct bfq_data *bfqd = bic_to_bfqd(bic);
++
++	if (bic->bfqq[BLK_RW_ASYNC]) {
++		bfq_exit_bfqq(bfqd, bic->bfqq[BLK_RW_ASYNC]);
++		bic->bfqq[BLK_RW_ASYNC] = NULL;
++	}
++
++	if (bic->bfqq[BLK_RW_SYNC]) {
++		bfq_exit_bfqq(bfqd, bic->bfqq[BLK_RW_SYNC]);
++		bic->bfqq[BLK_RW_SYNC] = NULL;
++	}
++}
++
++/*
++ * Update the entity prio values; note that the new values will not
++ * be used until the next (re)activation.
++ */
++static void bfq_init_prio_data(struct bfq_queue *bfqq, struct bfq_io_cq *bic)
++{
++	struct task_struct *tsk = current;
++	int ioprio_class;
++
++	if (!bfq_bfqq_prio_changed(bfqq))
++		return;
++
++	ioprio_class = IOPRIO_PRIO_CLASS(bic->ioprio);
++	switch (ioprio_class) {
++	default:
++		printk(KERN_ERR "bfq: bad prio %x\n", ioprio_class);
++	case IOPRIO_CLASS_NONE:
++		/*
++		 * No prio set, inherit CPU scheduling settings.
++		 */
++		bfqq->entity.new_ioprio = task_nice_ioprio(tsk);
++		bfqq->entity.new_ioprio_class = task_nice_ioclass(tsk);
++		break;
++	case IOPRIO_CLASS_RT:
++		bfqq->entity.new_ioprio = IOPRIO_PRIO_DATA(bic->ioprio);
++		bfqq->entity.new_ioprio_class = IOPRIO_CLASS_RT;
++		break;
++	case IOPRIO_CLASS_BE:
++		bfqq->entity.new_ioprio = IOPRIO_PRIO_DATA(bic->ioprio);
++		bfqq->entity.new_ioprio_class = IOPRIO_CLASS_BE;
++		break;
++	case IOPRIO_CLASS_IDLE:
++		bfqq->entity.new_ioprio_class = IOPRIO_CLASS_IDLE;
++		bfqq->entity.new_ioprio = 7;
++		bfq_clear_bfqq_idle_window(bfqq);
++		break;
++	}
++
++	bfqq->entity.ioprio_changed = 1;
++
++	/*
++	 * Keep track of original prio settings in case we have to temporarily
++	 * elevate the priority of this queue.
++	 */
++	bfqq->org_ioprio = bfqq->entity.new_ioprio;
++	bfq_clear_bfqq_prio_changed(bfqq);
++}
++
++static void bfq_changed_ioprio(struct bfq_io_cq *bic)
++{
++	struct bfq_data *bfqd;
++	struct bfq_queue *bfqq, *new_bfqq;
++	struct bfq_group *bfqg;
++	unsigned long uninitialized_var(flags);
++	int ioprio = bic->icq.ioc->ioprio;
++
++	bfqd = bfq_get_bfqd_locked(&(bic->icq.q->elevator->elevator_data), &flags);
++	/*
++	 * This condition may trigger on a newly created bic, be sure to drop the
++	 * lock before returning.
++	 */
++	if (unlikely(bfqd == NULL) || likely(bic->ioprio == ioprio))
++		goto out;
++
++	bfqq = bic->bfqq[BLK_RW_ASYNC];
++	if (bfqq != NULL) {
++		bfqg = container_of(bfqq->entity.sched_data, struct bfq_group,
++				    sched_data);
++		new_bfqq = bfq_get_queue(bfqd, bfqg, BLK_RW_ASYNC, bic,
++					 GFP_ATOMIC);
++		if (new_bfqq != NULL) {
++			bic->bfqq[BLK_RW_ASYNC] = new_bfqq;
++			bfq_log_bfqq(bfqd, bfqq,
++				     "changed_ioprio: bfqq %p %d",
++				     bfqq, atomic_read(&bfqq->ref));
++			bfq_put_queue(bfqq);
++		}
++	}
++
++	bfqq = bic->bfqq[BLK_RW_SYNC];
++	if (bfqq != NULL)
++		bfq_mark_bfqq_prio_changed(bfqq);
++
++	bic->ioprio = ioprio;
++
++out:
++	bfq_put_bfqd_unlock(bfqd, &flags);
++}
++
++static void bfq_init_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++			  pid_t pid, int is_sync)
++{
++	RB_CLEAR_NODE(&bfqq->entity.rb_node);
++	INIT_LIST_HEAD(&bfqq->fifo);
++
++	atomic_set(&bfqq->ref, 0);
++	bfqq->bfqd = bfqd;
++
++	bfq_mark_bfqq_prio_changed(bfqq);
++
++	if (is_sync) {
++		if (!bfq_class_idle(bfqq))
++			bfq_mark_bfqq_idle_window(bfqq);
++		bfq_mark_bfqq_sync(bfqq);
++	}
++
++	/* Tentative initial value to trade off between thr and lat */
++	bfqq->max_budget = (2 * bfq_max_budget(bfqd)) / 3;
++	bfqq->pid = pid;
++
++	bfqq->raising_coeff = 1;
++	bfqq->last_rais_start_finish = 0;
++	bfqq->soft_rt_next_start = -1;
++}
++
++static struct bfq_queue *bfq_find_alloc_queue(struct bfq_data *bfqd,
++					      struct bfq_group *bfqg,
++					      int is_sync,
++					      struct bfq_io_cq *bic,
++					      gfp_t gfp_mask)
++{
++	struct bfq_queue *bfqq, *new_bfqq = NULL;
++
++retry:
++	/* bic always exists here */
++	bfqq = bic_to_bfqq(bic, is_sync);
++
++	/*
++	 * Always try a new alloc if we fall back to the OOM bfqq
++	 * originally, since it should just be a temporary situation.
++	 */
++	if (bfqq == NULL || bfqq == &bfqd->oom_bfqq) {
++		bfqq = NULL;
++		if (new_bfqq != NULL) {
++			bfqq = new_bfqq;
++			new_bfqq = NULL;
++		} else if (gfp_mask & __GFP_WAIT) {
++			spin_unlock_irq(bfqd->queue->queue_lock);
++			new_bfqq = kmem_cache_alloc_node(bfq_pool,
++					gfp_mask | __GFP_ZERO,
++					bfqd->queue->node);
++			spin_lock_irq(bfqd->queue->queue_lock);
++			if (new_bfqq != NULL)
++				goto retry;
++		} else {
++			bfqq = kmem_cache_alloc_node(bfq_pool,
++					gfp_mask | __GFP_ZERO,
++					bfqd->queue->node);
++		}
++
++		if (bfqq != NULL) {
++			bfq_init_bfqq(bfqd, bfqq, current->pid, is_sync);
++			bfq_log_bfqq(bfqd, bfqq, "allocated");
++		} else {
++			bfqq = &bfqd->oom_bfqq;
++			bfq_log_bfqq(bfqd, bfqq, "using oom bfqq");
++		}
++
++		bfq_init_prio_data(bfqq, bic);
++		bfq_init_entity(&bfqq->entity, bfqg);
++	}
++
++	if (new_bfqq != NULL)
++		kmem_cache_free(bfq_pool, new_bfqq);
++
++	return bfqq;
++}
++
++static struct bfq_queue **bfq_async_queue_prio(struct bfq_data *bfqd,
++					       struct bfq_group *bfqg,
++					       int ioprio_class, int ioprio)
++{
++	switch (ioprio_class) {
++	case IOPRIO_CLASS_RT:
++		return &bfqg->async_bfqq[0][ioprio];
++	case IOPRIO_CLASS_NONE:
++		ioprio = IOPRIO_NORM;
++		/* fall through */
++	case IOPRIO_CLASS_BE:
++		return &bfqg->async_bfqq[1][ioprio];
++	case IOPRIO_CLASS_IDLE:
++		return &bfqg->async_idle_bfqq;
++	default:
++		BUG();
++	}
++}
++
++static struct bfq_queue *bfq_get_queue(struct bfq_data *bfqd,
++				       struct bfq_group *bfqg, int is_sync,
++				       struct bfq_io_cq *bic, gfp_t gfp_mask)
++{
++	const int ioprio = IOPRIO_PRIO_DATA(bic->ioprio);
++	const int ioprio_class = IOPRIO_PRIO_CLASS(bic->ioprio);
++	struct bfq_queue **async_bfqq = NULL;
++	struct bfq_queue *bfqq = NULL;
++
++	if (!is_sync) {
++		async_bfqq = bfq_async_queue_prio(bfqd, bfqg, ioprio_class,
++						  ioprio);
++		bfqq = *async_bfqq;
++	}
++
++	if (bfqq == NULL)
++		bfqq = bfq_find_alloc_queue(bfqd, bfqg, is_sync, bic, gfp_mask);
++
++	/*
++	 * Pin the queue now that it's allocated, scheduler exit will prune it.
++	 */
++	if (!is_sync && *async_bfqq == NULL) {
++		atomic_inc(&bfqq->ref);
++		bfq_log_bfqq(bfqd, bfqq, "get_queue, bfqq not in async: %p, %d",
++			     bfqq, atomic_read(&bfqq->ref));
++		*async_bfqq = bfqq;
++	}
++
++	atomic_inc(&bfqq->ref);
++	bfq_log_bfqq(bfqd, bfqq, "get_queue, at end: %p, %d", bfqq,
++		     atomic_read(&bfqq->ref));
++	return bfqq;
++}
++
++static void bfq_update_io_thinktime(struct bfq_data *bfqd,
++				    struct bfq_io_cq *bic)
++{
++	unsigned long elapsed = jiffies - bic->ttime.last_end_request;
++	unsigned long ttime = min(elapsed, 2UL * bfqd->bfq_slice_idle);
++
++	bic->ttime.ttime_samples = (7*bic->ttime.ttime_samples + 256) / 8;
++	bic->ttime.ttime_total = (7*bic->ttime.ttime_total + 256*ttime) / 8;
++	bic->ttime.ttime_mean = (bic->ttime.ttime_total + 128) / bic->ttime.ttime_samples;
++}
++
++static void bfq_update_io_seektime(struct bfq_data *bfqd,
++				   struct bfq_queue *bfqq,
++				   struct request *rq)
++{
++	sector_t sdist;
++	u64 total;
++
++	if (bfqq->last_request_pos < blk_rq_pos(rq))
++		sdist = blk_rq_pos(rq) - bfqq->last_request_pos;
++	else
++		sdist = bfqq->last_request_pos - blk_rq_pos(rq);
++
++	/*
++	 * Don't allow the seek distance to get too large from the
++	 * odd fragment, pagein, etc.
++	 */
++	if (bfqq->seek_samples == 0) /* first request, not really a seek */
++		sdist = 0;
++	else if (bfqq->seek_samples <= 60) /* second & third seek */
++		sdist = min(sdist, (bfqq->seek_mean * 4) + 2*1024*1024);
++	else
++		sdist = min(sdist, (bfqq->seek_mean * 4) + 2*1024*64);
++
++	bfqq->seek_samples = (7*bfqq->seek_samples + 256) / 8;
++	bfqq->seek_total = (7*bfqq->seek_total + (u64)256*sdist) / 8;
++	total = bfqq->seek_total + (bfqq->seek_samples/2);
++	do_div(total, bfqq->seek_samples);
++	if (bfq_bfqq_coop(bfqq)) {
++		/*
++		 * If the mean seektime increases for a (non-seeky) shared
++		 * queue, some cooperator is likely to be idling too much.
++		 * On the contrary,  if it decreases, some cooperator has
++		 * probably waked up.
++		 *
++		 */
++		if ((sector_t)total < bfqq->seek_mean)
++			bfq_mark_bfqq_some_coop_idle(bfqq) ;
++		else if ((sector_t)total > bfqq->seek_mean)
++			bfq_clear_bfqq_some_coop_idle(bfqq) ;
++	}
++	bfqq->seek_mean = (sector_t)total;
++
++	bfq_log_bfqq(bfqd, bfqq, "dist=%llu mean=%llu", (u64)sdist,
++			(u64)bfqq->seek_mean);
++}
++
++/*
++ * Disable idle window if the process thinks too long or seeks so much that
++ * it doesn't matter.
++ */
++static void bfq_update_idle_window(struct bfq_data *bfqd,
++				   struct bfq_queue *bfqq,
++				   struct bfq_io_cq *bic)
++{
++	int enable_idle;
++
++	/* Don't idle for async or idle io prio class. */
++	if (!bfq_bfqq_sync(bfqq) || bfq_class_idle(bfqq))
++		return;
++
++	enable_idle = bfq_bfqq_idle_window(bfqq);
++
++	if (atomic_read(&bic->icq.ioc->active_ref) == 0 ||
++	    bfqd->bfq_slice_idle == 0 ||
++		(bfqd->hw_tag && BFQQ_SEEKY(bfqq) &&
++			bfqq->raising_coeff == 1))
++		enable_idle = 0;
++	else if (bfq_sample_valid(bic->ttime.ttime_samples)) {
++		if (bic->ttime.ttime_mean > bfqd->bfq_slice_idle &&
++			bfqq->raising_coeff == 1)
++			enable_idle = 0;
++		else
++			enable_idle = 1;
++	}
++	bfq_log_bfqq(bfqd, bfqq, "update_idle_window: enable_idle %d",
++		enable_idle);
++
++	if (enable_idle)
++		bfq_mark_bfqq_idle_window(bfqq);
++	else
++		bfq_clear_bfqq_idle_window(bfqq);
++}
++
++/*
++ * Called when a new fs request (rq) is added to bfqq.  Check if there's
++ * something we should do about it.
++ */
++static void bfq_rq_enqueued(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++			    struct request *rq)
++{
++	struct bfq_io_cq *bic = RQ_BIC(rq);
++
++	if (rq->cmd_flags & REQ_META)
++		bfqq->meta_pending++;
++
++	bfq_update_io_thinktime(bfqd, bic);
++	bfq_update_io_seektime(bfqd, bfqq, rq);
++	if (bfqq->entity.service > bfq_max_budget(bfqd) / 8 ||
++	    !BFQQ_SEEKY(bfqq))
++		bfq_update_idle_window(bfqd, bfqq, bic);
++
++	bfq_log_bfqq(bfqd, bfqq,
++		     "rq_enqueued: idle_window=%d (seeky %d, mean %llu)",
++		     bfq_bfqq_idle_window(bfqq), BFQQ_SEEKY(bfqq),
++		     (long long unsigned)bfqq->seek_mean);
++
++	bfqq->last_request_pos = blk_rq_pos(rq) + blk_rq_sectors(rq);
++
++	if (bfqq == bfqd->active_queue) {
++		/*
++		 * If there is just this request queued and the request
++		 * is small, just exit.
++		 * In this way, if the disk is being idled to wait for a new
++		 * request from the active queue, we avoid unplugging the
++		 * device now.
++		 *
++		 * By doing so, we spare the disk to be committed
++		 * to serve just a small request. On the contrary, we wait for
++		 * the block layer to decide when to unplug the device:
++		 * hopefully, new requests will be merged to this
++		 * one quickly, then the device will be unplugged
++		 * and larger requests will be dispatched.
++		 */
++	        if (bfqq->queued[rq_is_sync(rq)] == 1 &&
++		    blk_rq_sectors(rq) < 32) {
++		        return;
++		}
++		if (bfq_bfqq_wait_request(bfqq)) {
++			/*
++			 * If we are waiting for a request for this queue, let
++			 * it rip immediately and flag that we must not expire
++			 * this queue just now.
++			 */
++			bfq_clear_bfqq_wait_request(bfqq);
++			del_timer(&bfqd->idle_slice_timer);
++			/*
++			 * Here we can safely expire the queue, in
++			 * case of budget timeout, without wasting
++			 * guarantees
++			 */
++			if (bfq_bfqq_budget_timeout(bfqq))
++				bfq_bfqq_expire(bfqd, bfqq, 0,
++						BFQ_BFQQ_BUDGET_TIMEOUT);
++			__blk_run_queue(bfqd->queue);
++		}
++	}
++}
++
++static void bfq_insert_request(struct request_queue *q, struct request *rq)
++{
++	struct bfq_data *bfqd = q->elevator->elevator_data;
++	struct bfq_queue *bfqq = RQ_BFQQ(rq);
++
++	assert_spin_locked(bfqd->queue->queue_lock);
++	bfq_init_prio_data(bfqq, RQ_BIC(rq));
++
++	bfq_add_rq_rb(rq);
++
++	rq_set_fifo_time(rq, jiffies + bfqd->bfq_fifo_expire[rq_is_sync(rq)]);
++	list_add_tail(&rq->queuelist, &bfqq->fifo);
++
++	bfq_rq_enqueued(bfqd, bfqq, rq);
++}
++
++static void bfq_update_hw_tag(struct bfq_data *bfqd)
++{
++	bfqd->max_rq_in_driver = max(bfqd->max_rq_in_driver,
++				     bfqd->rq_in_driver);
++
++	if (bfqd->hw_tag == 1)
++		return;
++
++	/*
++	 * This sample is valid if the number of outstanding requests
++	 * is large enough to allow a queueing behavior.  Note that the
++	 * sum is not exact, as it's not taking into account deactivated
++	 * requests.
++	 */
++	if (bfqd->rq_in_driver + bfqd->queued < BFQ_HW_QUEUE_THRESHOLD)
++		return;
++
++	if (bfqd->hw_tag_samples++ < BFQ_HW_QUEUE_SAMPLES)
++		return;
++
++	bfqd->hw_tag = bfqd->max_rq_in_driver > BFQ_HW_QUEUE_THRESHOLD;
++	bfqd->max_rq_in_driver = 0;
++	bfqd->hw_tag_samples = 0;
++}
++
++static void bfq_completed_request(struct request_queue *q, struct request *rq)
++{
++	struct bfq_queue *bfqq = RQ_BFQQ(rq);
++	struct bfq_data *bfqd = bfqq->bfqd;
++	const int sync = rq_is_sync(rq);
++
++	bfq_log_bfqq(bfqd, bfqq, "completed %u sects req (%d)",
++			blk_rq_sectors(rq), sync);
++
++	bfq_update_hw_tag(bfqd);
++
++	WARN_ON(!bfqd->rq_in_driver);
++	WARN_ON(!bfqq->dispatched);
++	bfqd->rq_in_driver--;
++	bfqq->dispatched--;
++
++	if (bfq_bfqq_sync(bfqq))
++		bfqd->sync_flight--;
++
++	if (sync)
++		RQ_BIC(rq)->ttime.last_end_request = jiffies;
++
++	/*
++	 * If this is the active queue, check if it needs to be expired,
++	 * or if we want to idle in case it has no pending requests.
++	 */
++	if (bfqd->active_queue == bfqq) {
++		int budg_timeout = bfq_may_expire_for_budg_timeout(bfqq);
++		if (bfq_bfqq_budget_new(bfqq))
++			bfq_set_budget_timeout(bfqd);
++
++		/* Idling is disabled also for cooperation issues:
++		 * 1) there is a close cooperator for the queue, or
++		 * 2) the queue is shared and some cooperator is likely
++		 *    to be idle (in this case, by not arming the idle timer,
++		 *    we try to slow down the queue, to prevent the zones
++		 *    of the disk accessed by the active cooperators to become
++		 *    too distant from the zone that will be accessed by the
++		 *    currently idle cooperators)
++		 */
++		if (bfq_bfqq_must_idle(bfqq, budg_timeout))
++			bfq_arm_slice_timer(bfqd);
++		else if (budg_timeout)
++			bfq_bfqq_expire(bfqd, bfqq, 0, BFQ_BFQQ_BUDGET_TIMEOUT);
++	}
++
++	if (!bfqd->rq_in_driver)
++		bfq_schedule_dispatch(bfqd);
++}
++
++static inline int __bfq_may_queue(struct bfq_queue *bfqq)
++{
++	if (bfq_bfqq_wait_request(bfqq) && bfq_bfqq_must_alloc(bfqq)) {
++		bfq_clear_bfqq_must_alloc(bfqq);
++		return ELV_MQUEUE_MUST;
++	}
++
++	return ELV_MQUEUE_MAY;
++}
++
++static int bfq_may_queue(struct request_queue *q, int rw)
++{
++	struct bfq_data *bfqd = q->elevator->elevator_data;
++	struct task_struct *tsk = current;
++	struct bfq_io_cq *bic;
++	struct bfq_queue *bfqq;
++
++	/*
++	 * Don't force setup of a queue from here, as a call to may_queue
++	 * does not necessarily imply that a request actually will be queued.
++	 * So just lookup a possibly existing queue, or return 'may queue'
++	 * if that fails.
++	 */
++	bic = bfq_bic_lookup(bfqd, tsk->io_context);
++	if (bic == NULL)
++		return ELV_MQUEUE_MAY;
++
++	bfqq = bic_to_bfqq(bic, rw_is_sync(rw));
++	if (bfqq != NULL) {
++		bfq_init_prio_data(bfqq, bic);
++
++		return __bfq_may_queue(bfqq);
++	}
++
++	return ELV_MQUEUE_MAY;
++}
++
++/*
++ * Queue lock held here.
++ */
++static void bfq_put_request(struct request *rq)
++{
++	struct bfq_queue *bfqq = RQ_BFQQ(rq);
++
++	if (bfqq != NULL) {
++		const int rw = rq_data_dir(rq);
++
++		BUG_ON(!bfqq->allocated[rw]);
++		bfqq->allocated[rw]--;
++
++		rq->elv.priv[0] = NULL;
++		rq->elv.priv[1] = NULL;
++
++		bfq_log_bfqq(bfqq->bfqd, bfqq, "put_request %p, %d",
++			     bfqq, atomic_read(&bfqq->ref));
++		bfq_put_queue(bfqq);
++	}
++}
++
++static struct bfq_queue *
++bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic,
++                struct bfq_queue *bfqq)
++{
++        bfq_log_bfqq(bfqd, bfqq, "merging with queue %lu",
++		(long unsigned)bfqq->new_bfqq->pid);
++        bic_set_bfqq(bic, bfqq->new_bfqq, 1);
++        bfq_mark_bfqq_coop(bfqq->new_bfqq);
++        bfq_put_queue(bfqq);
++        return bic_to_bfqq(bic, 1);
++}
++
++/*
++ * Returns NULL if a new bfqq should be allocated, or the old bfqq if this
++ * was the last process referring to said bfqq.
++ */
++static struct bfq_queue *
++bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq)
++{
++	bfq_log_bfqq(bfqq->bfqd, bfqq, "splitting queue");
++	if (bfqq_process_refs(bfqq) == 1) {
++		bfqq->pid = current->pid;
++		bfq_clear_bfqq_some_coop_idle(bfqq);
++		bfq_clear_bfqq_coop(bfqq);
++		bfq_clear_bfqq_split_coop(bfqq);
++		return bfqq;
++	}
++
++	bic_set_bfqq(bic, NULL, 1);
++
++	bfq_put_cooperator(bfqq);
++
++	bfq_put_queue(bfqq);
++	return NULL;
++}
++
++/*
++ * Allocate bfq data structures associated with this request.
++ */
++static int bfq_set_request(struct request_queue *q, struct request *rq,
++			   struct bio *bio, gfp_t gfp_mask)
++{
++	struct bfq_data *bfqd = q->elevator->elevator_data;
++	struct bfq_io_cq *bic = icq_to_bic(rq->elv.icq);
++	const int rw = rq_data_dir(rq);
++	const int is_sync = rq_is_sync(rq);
++	struct bfq_queue *bfqq;
++	struct bfq_group *bfqg;
++	unsigned long flags;
++
++	might_sleep_if(gfp_mask & __GFP_WAIT);
++
++	bfq_changed_ioprio(bic);
++
++	spin_lock_irqsave(q->queue_lock, flags);
++
++	if (bic == NULL)
++		goto queue_fail;
++
++	bfqg = bfq_bic_update_cgroup(bic);
++
++new_queue:
++	bfqq = bic_to_bfqq(bic, is_sync);
++	if (bfqq == NULL || bfqq == &bfqd->oom_bfqq) {
++		bfqq = bfq_get_queue(bfqd, bfqg, is_sync, bic, gfp_mask);
++		bic_set_bfqq(bic, bfqq, is_sync);
++	} else {
++		/*
++		 * If the queue was seeky for too long, break it apart.
++		 */
++		if (bfq_bfqq_coop(bfqq) && bfq_bfqq_split_coop(bfqq)) {
++			bfq_log_bfqq(bfqd, bfqq, "breaking apart bfqq");
++			bfqq = bfq_split_bfqq(bic, bfqq);
++			if (!bfqq)
++				goto new_queue;
++		}
++
++		/*
++		 * Check to see if this queue is scheduled to merge with
++		 * another closely cooperating queue. The merging of queues
++		 * happens here as it must be done in process context.
++		 * The reference on new_bfqq was taken in merge_bfqqs.
++		 */
++		if (bfqq->new_bfqq != NULL)
++			bfqq = bfq_merge_bfqqs(bfqd, bic, bfqq);
++	}
++
++	bfqq->allocated[rw]++;
++	atomic_inc(&bfqq->ref);
++	bfq_log_bfqq(bfqd, bfqq, "set_request: bfqq %p, %d", bfqq,
++		     atomic_read(&bfqq->ref));
++
++	rq->elv.priv[0] = bic;
++	rq->elv.priv[1] = bfqq;
++
++	spin_unlock_irqrestore(q->queue_lock, flags);
++
++	return 0;
++
++queue_fail:
++	bfq_schedule_dispatch(bfqd);
++	spin_unlock_irqrestore(q->queue_lock, flags);
++
++	return 1;
++}
++
++static void bfq_kick_queue(struct work_struct *work)
++{
++	struct bfq_data *bfqd =
++		container_of(work, struct bfq_data, unplug_work);
++	struct request_queue *q = bfqd->queue;
++
++	spin_lock_irq(q->queue_lock);
++	__blk_run_queue(q);
++	spin_unlock_irq(q->queue_lock);
++}
++
++/*
++ * Handler of the expiration of the timer running if the active_queue
++ * is idling inside its time slice.
++ */
++static void bfq_idle_slice_timer(unsigned long data)
++{
++	struct bfq_data *bfqd = (struct bfq_data *)data;
++	struct bfq_queue *bfqq;
++	unsigned long flags;
++	enum bfqq_expiration reason;
++
++	spin_lock_irqsave(bfqd->queue->queue_lock, flags);
++
++	bfqq = bfqd->active_queue;
++	/*
++	 * Theoretical race here: active_queue can be NULL or different
++	 * from the queue that was idling if the timer handler spins on
++	 * the queue_lock and a new request arrives for the current
++	 * queue and there is a full dispatch cycle that changes the
++	 * active_queue.  This can hardly happen, but in the worst case
++	 * we just expire a queue too early.
++	 */
++	if (bfqq != NULL) {
++		bfq_log_bfqq(bfqd, bfqq, "slice_timer expired");
++		if (bfq_bfqq_budget_timeout(bfqq))
++			/*
++			 * Also here the queue can be safely expired
++			 * for budget timeout without wasting
++			 * guarantees
++			 */
++			reason = BFQ_BFQQ_BUDGET_TIMEOUT;
++		else if (bfqq->queued[0] == 0 && bfqq->queued[1] == 0)
++			/*
++			 * The queue may not be empty upon timer expiration,
++			 * because we may not disable the timer when the first
++			 * request of the active queue arrives during
++			 * disk idling
++			 */
++			reason = BFQ_BFQQ_TOO_IDLE;
++		else
++			goto schedule_dispatch;
++
++		bfq_bfqq_expire(bfqd, bfqq, 1, reason);
++	}
++
++schedule_dispatch:
++	bfq_schedule_dispatch(bfqd);
++
++	spin_unlock_irqrestore(bfqd->queue->queue_lock, flags);
++}
++
++static void bfq_shutdown_timer_wq(struct bfq_data *bfqd)
++{
++	del_timer_sync(&bfqd->idle_slice_timer);
++	cancel_work_sync(&bfqd->unplug_work);
++}
++
++static inline void __bfq_put_async_bfqq(struct bfq_data *bfqd,
++					struct bfq_queue **bfqq_ptr)
++{
++	struct bfq_group *root_group = bfqd->root_group;
++	struct bfq_queue *bfqq = *bfqq_ptr;
++
++	bfq_log(bfqd, "put_async_bfqq: %p", bfqq);
++	if (bfqq != NULL) {
++		bfq_bfqq_move(bfqd, bfqq, &bfqq->entity, root_group);
++		bfq_log_bfqq(bfqd, bfqq, "put_async_bfqq: putting %p, %d",
++			     bfqq, atomic_read(&bfqq->ref));
++		bfq_put_queue(bfqq);
++		*bfqq_ptr = NULL;
++	}
++}
++
++/*
++ * Release all the bfqg references to its async queues.  If we are
++ * deallocating the group these queues may still contain requests, so
++ * we reparent them to the root cgroup (i.e., the only one that will
++ * exist for sure untill all the requests on a device are gone).
++ */
++static void bfq_put_async_queues(struct bfq_data *bfqd, struct bfq_group *bfqg)
++{
++	int i, j;
++
++	for (i = 0; i < 2; i++)
++		for (j = 0; j < IOPRIO_BE_NR; j++)
++			__bfq_put_async_bfqq(bfqd, &bfqg->async_bfqq[i][j]);
++
++	__bfq_put_async_bfqq(bfqd, &bfqg->async_idle_bfqq);
++}
++
++static void bfq_exit_queue(struct elevator_queue *e)
++{
++	struct bfq_data *bfqd = e->elevator_data;
++	struct request_queue *q = bfqd->queue;
++	struct bfq_queue *bfqq, *n;
++
++	bfq_shutdown_timer_wq(bfqd);
++
++	spin_lock_irq(q->queue_lock);
++
++	BUG_ON(bfqd->active_queue != NULL);
++	list_for_each_entry_safe(bfqq, n, &bfqd->idle_list, bfqq_list)
++		bfq_deactivate_bfqq(bfqd, bfqq, 0);
++
++	bfq_disconnect_groups(bfqd);
++	spin_unlock_irq(q->queue_lock);
++
++	bfq_shutdown_timer_wq(bfqd);
++
++	synchronize_rcu();
++
++	BUG_ON(timer_pending(&bfqd->idle_slice_timer));
++
++	bfq_free_root_group(bfqd);
++	kfree(bfqd);
++}
++
++static int bfq_init_queue(struct request_queue *q)
++{
++	struct bfq_group *bfqg;
++	struct bfq_data *bfqd;
++
++	bfqd = kmalloc_node(sizeof(*bfqd), GFP_KERNEL | __GFP_ZERO, q->node);
++	if (bfqd == NULL)
++		return -ENOMEM;
++
++	/*
++	 * Our fallback bfqq if bfq_find_alloc_queue() runs into OOM issues.
++	 * Grab a permanent reference to it, so that the normal code flow
++	 * will not attempt to free it.
++	 */
++	bfq_init_bfqq(bfqd, &bfqd->oom_bfqq, 1, 0);
++	atomic_inc(&bfqd->oom_bfqq.ref);
++
++	bfqd->queue = q;
++	q->elevator->elevator_data = bfqd;
++
++	bfqg = bfq_alloc_root_group(bfqd, q->node);
++	if (bfqg == NULL) {
++		kfree(bfqd);
++		return -ENOMEM;
++	}
++
++	bfqd->root_group = bfqg;
++
++	init_timer(&bfqd->idle_slice_timer);
++	bfqd->idle_slice_timer.function = bfq_idle_slice_timer;
++	bfqd->idle_slice_timer.data = (unsigned long)bfqd;
++
++	bfqd->rq_pos_tree = RB_ROOT;
++
++	INIT_WORK(&bfqd->unplug_work, bfq_kick_queue);
++
++	INIT_LIST_HEAD(&bfqd->active_list);
++	INIT_LIST_HEAD(&bfqd->idle_list);
++
++	bfqd->hw_tag = -1;
++
++	bfqd->bfq_max_budget = bfq_default_max_budget;
++
++	bfqd->bfq_quantum = bfq_quantum;
++	bfqd->bfq_fifo_expire[0] = bfq_fifo_expire[0];
++	bfqd->bfq_fifo_expire[1] = bfq_fifo_expire[1];
++	bfqd->bfq_back_max = bfq_back_max;
++	bfqd->bfq_back_penalty = bfq_back_penalty;
++	bfqd->bfq_slice_idle = bfq_slice_idle;
++	bfqd->bfq_class_idle_last_service = 0;
++	bfqd->bfq_max_budget_async_rq = bfq_max_budget_async_rq;
++	bfqd->bfq_timeout[BLK_RW_ASYNC] = bfq_timeout_async;
++	bfqd->bfq_timeout[BLK_RW_SYNC] = bfq_timeout_sync;
++
++	bfqd->low_latency = true;
++
++	bfqd->bfq_raising_coeff = 20;
++	bfqd->bfq_raising_rt_max_time = msecs_to_jiffies(300);
++	bfqd->bfq_raising_max_time = 0;
++	bfqd->bfq_raising_min_idle_time = msecs_to_jiffies(2000);
++	bfqd->bfq_raising_min_inter_arr_async = msecs_to_jiffies(500);
++	bfqd->bfq_raising_max_softrt_rate = 7000;
++
++	/* Initially estimate the device's peak rate as the reference rate */
++	if (blk_queue_nonrot(bfqd->queue)) {
++		bfqd->RT_prod = R_nonrot * T_nonrot;
++		bfqd->peak_rate = R_nonrot;
++	} else {
++		bfqd->RT_prod = R_rot * T_rot;
++		bfqd->peak_rate = R_rot;
++	}
++
++	return 0;
++}
++
++static void bfq_slab_kill(void)
++{
++	if (bfq_pool != NULL)
++		kmem_cache_destroy(bfq_pool);
++}
++
++static int __init bfq_slab_setup(void)
++{
++	bfq_pool = KMEM_CACHE(bfq_queue, 0);
++	if (bfq_pool == NULL)
++		return -ENOMEM;
++	return 0;
++}
++
++static ssize_t bfq_var_show(unsigned int var, char *page)
++{
++	return sprintf(page, "%d\n", var);
++}
++
++static ssize_t bfq_var_store(unsigned long *var, const char *page, size_t count)
++{
++	unsigned long new_val;
++	int ret = strict_strtoul(page, 10, &new_val);
++
++	if (ret == 0)
++		*var = new_val;
++
++	return count;
++}
++
++static ssize_t bfq_raising_max_time_show(struct elevator_queue *e, char *page)
++{
++	struct bfq_data *bfqd = e->elevator_data;
++	return sprintf(page, "%d\n", bfqd->bfq_raising_max_time > 0 ?
++		       jiffies_to_msecs(bfqd->bfq_raising_max_time) :
++		       jiffies_to_msecs(bfq_wrais_duration(bfqd)));
++}
++
++static ssize_t bfq_weights_show(struct elevator_queue *e, char *page)
++{
++	struct bfq_queue *bfqq;
++	struct bfq_data *bfqd = e->elevator_data;
++	ssize_t num_char = 0;
++
++	num_char += sprintf(page + num_char, "Tot reqs queued %d\n\n",
++			    bfqd->queued);
++
++	spin_lock_irq(bfqd->queue->queue_lock);
++
++	num_char += sprintf(page + num_char, "Active:\n");
++	list_for_each_entry(bfqq, &bfqd->active_list, bfqq_list) {
++	  num_char += sprintf(page + num_char,
++			      "pid%d: weight %hu, nr_queued %d %d,"
++			      " dur %d/%u\n",
++			      bfqq->pid,
++			      bfqq->entity.weight,
++			      bfqq->queued[0],
++			      bfqq->queued[1],
++			jiffies_to_msecs(jiffies -
++				bfqq->last_rais_start_finish),
++			jiffies_to_msecs(bfqq->raising_cur_max_time));
++	}
++
++	num_char += sprintf(page + num_char, "Idle:\n");
++	list_for_each_entry(bfqq, &bfqd->idle_list, bfqq_list) {
++			num_char += sprintf(page + num_char,
++				"pid%d: weight %hu, dur %d/%u\n",
++				bfqq->pid,
++				bfqq->entity.weight,
++				jiffies_to_msecs(jiffies -
++					bfqq->last_rais_start_finish),
++				jiffies_to_msecs(bfqq->raising_cur_max_time));
++	}
++
++	spin_unlock_irq(bfqd->queue->queue_lock);
++
++	return num_char;
++}
++
++#define SHOW_FUNCTION(__FUNC, __VAR, __CONV)				\
++static ssize_t __FUNC(struct elevator_queue *e, char *page)		\
++{									\
++	struct bfq_data *bfqd = e->elevator_data;			\
++	unsigned int __data = __VAR;					\
++	if (__CONV)							\
++		__data = jiffies_to_msecs(__data);			\
++	return bfq_var_show(__data, (page));				\
++}
++SHOW_FUNCTION(bfq_quantum_show, bfqd->bfq_quantum, 0);
++SHOW_FUNCTION(bfq_fifo_expire_sync_show, bfqd->bfq_fifo_expire[1], 1);
++SHOW_FUNCTION(bfq_fifo_expire_async_show, bfqd->bfq_fifo_expire[0], 1);
++SHOW_FUNCTION(bfq_back_seek_max_show, bfqd->bfq_back_max, 0);
++SHOW_FUNCTION(bfq_back_seek_penalty_show, bfqd->bfq_back_penalty, 0);
++SHOW_FUNCTION(bfq_slice_idle_show, bfqd->bfq_slice_idle, 1);
++SHOW_FUNCTION(bfq_max_budget_show, bfqd->bfq_user_max_budget, 0);
++SHOW_FUNCTION(bfq_max_budget_async_rq_show, bfqd->bfq_max_budget_async_rq, 0);
++SHOW_FUNCTION(bfq_timeout_sync_show, bfqd->bfq_timeout[BLK_RW_SYNC], 1);
++SHOW_FUNCTION(bfq_timeout_async_show, bfqd->bfq_timeout[BLK_RW_ASYNC], 1);
++SHOW_FUNCTION(bfq_low_latency_show, bfqd->low_latency, 0);
++SHOW_FUNCTION(bfq_raising_coeff_show, bfqd->bfq_raising_coeff, 0);
++SHOW_FUNCTION(bfq_raising_rt_max_time_show, bfqd->bfq_raising_rt_max_time, 1);
++SHOW_FUNCTION(bfq_raising_min_idle_time_show, bfqd->bfq_raising_min_idle_time,
++	1);
++SHOW_FUNCTION(bfq_raising_min_inter_arr_async_show,
++	bfqd->bfq_raising_min_inter_arr_async,
++	1);
++SHOW_FUNCTION(bfq_raising_max_softrt_rate_show,
++	bfqd->bfq_raising_max_softrt_rate, 0);
++#undef SHOW_FUNCTION
++
++#define STORE_FUNCTION(__FUNC, __PTR, MIN, MAX, __CONV)			\
++static ssize_t								\
++__FUNC(struct elevator_queue *e, const char *page, size_t count)	\
++{									\
++	struct bfq_data *bfqd = e->elevator_data;			\
++	unsigned long uninitialized_var(__data);			\
++	int ret = bfq_var_store(&__data, (page), count);		\
++	if (__data < (MIN))						\
++		__data = (MIN);						\
++	else if (__data > (MAX))					\
++		__data = (MAX);						\
++	if (__CONV)							\
++		*(__PTR) = msecs_to_jiffies(__data);			\
++	else								\
++		*(__PTR) = __data;					\
++	return ret;							\
++}
++STORE_FUNCTION(bfq_quantum_store, &bfqd->bfq_quantum, 1, INT_MAX, 0);
++STORE_FUNCTION(bfq_fifo_expire_sync_store, &bfqd->bfq_fifo_expire[1], 1,
++		INT_MAX, 1);
++STORE_FUNCTION(bfq_fifo_expire_async_store, &bfqd->bfq_fifo_expire[0], 1,
++		INT_MAX, 1);
++STORE_FUNCTION(bfq_back_seek_max_store, &bfqd->bfq_back_max, 0, INT_MAX, 0);
++STORE_FUNCTION(bfq_back_seek_penalty_store, &bfqd->bfq_back_penalty, 1,
++		INT_MAX, 0);
++STORE_FUNCTION(bfq_slice_idle_store, &bfqd->bfq_slice_idle, 0, INT_MAX, 1);
++STORE_FUNCTION(bfq_max_budget_async_rq_store, &bfqd->bfq_max_budget_async_rq,
++		1, INT_MAX, 0);
++STORE_FUNCTION(bfq_timeout_async_store, &bfqd->bfq_timeout[BLK_RW_ASYNC], 0,
++		INT_MAX, 1);
++STORE_FUNCTION(bfq_raising_coeff_store, &bfqd->bfq_raising_coeff, 1,
++		INT_MAX, 0);
++STORE_FUNCTION(bfq_raising_max_time_store, &bfqd->bfq_raising_max_time, 0,
++		INT_MAX, 1);
++STORE_FUNCTION(bfq_raising_rt_max_time_store, &bfqd->bfq_raising_rt_max_time, 0,
++		INT_MAX, 1);
++STORE_FUNCTION(bfq_raising_min_idle_time_store,
++	       &bfqd->bfq_raising_min_idle_time, 0, INT_MAX, 1);
++STORE_FUNCTION(bfq_raising_min_inter_arr_async_store,
++		&bfqd->bfq_raising_min_inter_arr_async, 0, INT_MAX, 1);
++STORE_FUNCTION(bfq_raising_max_softrt_rate_store,
++	       &bfqd->bfq_raising_max_softrt_rate, 0, INT_MAX, 0);
++#undef STORE_FUNCTION
++
++/* do nothing for the moment */
++static ssize_t bfq_weights_store(struct elevator_queue *e,
++				    const char *page, size_t count)
++{
++	return count;
++}
++
++static inline unsigned long bfq_estimated_max_budget(struct bfq_data *bfqd)
++{
++	u64 timeout = jiffies_to_msecs(bfqd->bfq_timeout[BLK_RW_SYNC]);
++
++	if (bfqd->peak_rate_samples >= BFQ_PEAK_RATE_SAMPLES)
++		return bfq_calc_max_budget(bfqd->peak_rate, timeout);
++	else
++		return bfq_default_max_budget;
++}
++
++static ssize_t bfq_max_budget_store(struct elevator_queue *e,
++				    const char *page, size_t count)
++{
++	struct bfq_data *bfqd = e->elevator_data;
++	unsigned long uninitialized_var(__data);
++	int ret = bfq_var_store(&__data, (page), count);
++
++	if (__data == 0)
++		bfqd->bfq_max_budget = bfq_estimated_max_budget(bfqd);
++	else {
++		if (__data > INT_MAX)
++			__data = INT_MAX;
++		bfqd->bfq_max_budget = __data;
++	}
++
++	bfqd->bfq_user_max_budget = __data;
++
++	return ret;
++}
++
++static ssize_t bfq_timeout_sync_store(struct elevator_queue *e,
++				      const char *page, size_t count)
++{
++	struct bfq_data *bfqd = e->elevator_data;
++	unsigned long uninitialized_var(__data);
++	int ret = bfq_var_store(&__data, (page), count);
++
++	if (__data < 1)
++		__data = 1;
++	else if (__data > INT_MAX)
++		__data = INT_MAX;
++
++	bfqd->bfq_timeout[BLK_RW_SYNC] = msecs_to_jiffies(__data);
++	if (bfqd->bfq_user_max_budget == 0)
++		bfqd->bfq_max_budget = bfq_estimated_max_budget(bfqd);
++
++	return ret;
++}
++
++static ssize_t bfq_low_latency_store(struct elevator_queue *e,
++				     const char *page, size_t count)
++{
++	struct bfq_data *bfqd = e->elevator_data;
++	unsigned long uninitialized_var(__data);
++	int ret = bfq_var_store(&__data, (page), count);
++
++	if (__data > 1)
++		__data = 1;
++	if (__data == 0 && bfqd->low_latency != 0)
++		bfq_end_raising(bfqd);
++	bfqd->low_latency = __data;
++
++	return ret;
++}
++
++#define BFQ_ATTR(name) \
++	__ATTR(name, S_IRUGO|S_IWUSR, bfq_##name##_show, bfq_##name##_store)
++
++static struct elv_fs_entry bfq_attrs[] = {
++	BFQ_ATTR(quantum),
++	BFQ_ATTR(fifo_expire_sync),
++	BFQ_ATTR(fifo_expire_async),
++	BFQ_ATTR(back_seek_max),
++	BFQ_ATTR(back_seek_penalty),
++	BFQ_ATTR(slice_idle),
++	BFQ_ATTR(max_budget),
++	BFQ_ATTR(max_budget_async_rq),
++	BFQ_ATTR(timeout_sync),
++	BFQ_ATTR(timeout_async),
++	BFQ_ATTR(low_latency),
++	BFQ_ATTR(raising_coeff),
++	BFQ_ATTR(raising_max_time),
++	BFQ_ATTR(raising_rt_max_time),
++	BFQ_ATTR(raising_min_idle_time),
++	BFQ_ATTR(raising_min_inter_arr_async),
++	BFQ_ATTR(raising_max_softrt_rate),
++	BFQ_ATTR(weights),
++	__ATTR_NULL
++};
++
++static struct elevator_type iosched_bfq = {
++	.ops = {
++		.elevator_merge_fn =		bfq_merge,
++		.elevator_merged_fn =		bfq_merged_request,
++		.elevator_merge_req_fn =	bfq_merged_requests,
++		.elevator_allow_merge_fn =	bfq_allow_merge,
++		.elevator_dispatch_fn =		bfq_dispatch_requests,
++		.elevator_add_req_fn =		bfq_insert_request,
++		.elevator_activate_req_fn =	bfq_activate_request,
++		.elevator_deactivate_req_fn =	bfq_deactivate_request,
++		.elevator_completed_req_fn =	bfq_completed_request,
++		.elevator_former_req_fn =	elv_rb_former_request,
++		.elevator_latter_req_fn =	elv_rb_latter_request,
++		.elevator_init_icq_fn =		bfq_init_icq,
++		.elevator_exit_icq_fn =		bfq_exit_icq,
++		.elevator_set_req_fn =		bfq_set_request,
++		.elevator_put_req_fn =		bfq_put_request,
++		.elevator_may_queue_fn =	bfq_may_queue,
++		.elevator_init_fn =		bfq_init_queue,
++		.elevator_exit_fn =		bfq_exit_queue,
++	},
++	.icq_size =		sizeof(struct bfq_io_cq),
++	.icq_align =		__alignof__(struct bfq_io_cq),
++	.elevator_attrs =	bfq_attrs,
++	.elevator_name =	"bfq",
++	.elevator_owner =	THIS_MODULE,
++};
++
++static int __init bfq_init(void)
++{
++	/*
++	 * Can be 0 on HZ < 1000 setups.
++	 */
++	if (bfq_slice_idle == 0)
++		bfq_slice_idle = 1;
++
++	if (bfq_timeout_async == 0)
++		bfq_timeout_async = 1;
++
++	if (bfq_slab_setup())
++		return -ENOMEM;
++
++	elv_register(&iosched_bfq);
++
++	return 0;
++}
++
++static void __exit bfq_exit(void)
++{
++	elv_unregister(&iosched_bfq);
++	bfq_slab_kill();
++}
++
++module_init(bfq_init);
++module_exit(bfq_exit);
++
++MODULE_AUTHOR("Fabio Checconi, Paolo Valente");
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("Budget Fair Queueing IO scheduler");
+diff --git a/block/bfq-sched.c b/block/bfq-sched.c
+new file mode 100644
+index 0000000..03f8061
+--- /dev/null
++++ b/block/bfq-sched.c
+@@ -0,0 +1,1072 @@
++/*
++ * BFQ: Hierarchical B-WF2Q+ scheduler.
++ *
++ * Based on ideas and code from CFQ:
++ * Copyright (C) 2003 Jens Axboe <axboe@××××××.dk>
++ *
++ * Copyright (C) 2008 Fabio Checconi <fabio@×××××××××××××.it>
++ *		      Paolo Valente <paolo.valente@×××××××.it>
++ *
++ * Copyright (C) 2010 Paolo Valente <paolo.valente@×××××××.it>
++ */
++
++#ifdef CONFIG_CGROUP_BFQIO
++#define for_each_entity(entity)	\
++	for (; entity != NULL; entity = entity->parent)
++
++#define for_each_entity_safe(entity, parent) \
++	for (; entity && ({ parent = entity->parent; 1; }); entity = parent)
++
++static struct bfq_entity *bfq_lookup_next_entity(struct bfq_sched_data *sd,
++						 int extract,
++						 struct bfq_data *bfqd);
++
++static inline void bfq_update_budget(struct bfq_entity *next_active)
++{
++	struct bfq_entity *bfqg_entity;
++	struct bfq_group *bfqg;
++	struct bfq_sched_data *group_sd;
++
++	BUG_ON(next_active == NULL);
++
++	group_sd = next_active->sched_data;
++
++	bfqg = container_of(group_sd, struct bfq_group, sched_data);
++	/*
++	 * bfq_group's my_entity field is not NULL only if the group
++	 * is not the root group. We must not touch the root entity
++	 * as it must never become an active entity.
++	 */
++	bfqg_entity = bfqg->my_entity;
++	if (bfqg_entity != NULL)
++		bfqg_entity->budget = next_active->budget;
++}
++
++static int bfq_update_next_active(struct bfq_sched_data *sd)
++{
++	struct bfq_entity *next_active;
++
++	if (sd->active_entity != NULL)
++		/* will update/requeue at the end of service */
++		return 0;
++
++	/*
++	 * NOTE: this can be improved in many ways, such as returning
++	 * 1 (and thus propagating upwards the update) only when the
++	 * budget changes, or caching the bfqq that will be scheduled
++	 * next from this subtree.  By now we worry more about
++	 * correctness than about performance...
++	 */
++	next_active = bfq_lookup_next_entity(sd, 0, NULL);
++	sd->next_active = next_active;
++
++	if (next_active != NULL)
++		bfq_update_budget(next_active);
++
++	return 1;
++}
++
++static inline void bfq_check_next_active(struct bfq_sched_data *sd,
++					 struct bfq_entity *entity)
++{
++	BUG_ON(sd->next_active != entity);
++}
++#else
++#define for_each_entity(entity)	\
++	for (; entity != NULL; entity = NULL)
++
++#define for_each_entity_safe(entity, parent) \
++	for (parent = NULL; entity != NULL; entity = parent)
++
++static inline int bfq_update_next_active(struct bfq_sched_data *sd)
++{
++	return 0;
++}
++
++static inline void bfq_check_next_active(struct bfq_sched_data *sd,
++					 struct bfq_entity *entity)
++{
++}
++
++static inline void bfq_update_budget(struct bfq_entity *next_active)
++{
++}
++#endif
++
++/*
++ * Shift for timestamp calculations.  This actually limits the maximum
++ * service allowed in one timestamp delta (small shift values increase it),
++ * the maximum total weight that can be used for the queues in the system
++ * (big shift values increase it), and the period of virtual time wraparounds.
++ */
++#define WFQ_SERVICE_SHIFT	22
++
++/**
++ * bfq_gt - compare two timestamps.
++ * @a: first ts.
++ * @b: second ts.
++ *
++ * Return @a > @b, dealing with wrapping correctly.
++ */
++static inline int bfq_gt(u64 a, u64 b)
++{
++	return (s64)(a - b) > 0;
++}
++
++static inline struct bfq_queue *bfq_entity_to_bfqq(struct bfq_entity *entity)
++{
++	struct bfq_queue *bfqq = NULL;
++
++	BUG_ON(entity == NULL);
++
++	if (entity->my_sched_data == NULL)
++		bfqq = container_of(entity, struct bfq_queue, entity);
++
++	return bfqq;
++}
++
++
++/**
++ * bfq_delta - map service into the virtual time domain.
++ * @service: amount of service.
++ * @weight: scale factor (weight of an entity or weight sum).
++ */
++static inline u64 bfq_delta(unsigned long service,
++					unsigned long weight)
++{
++	u64 d = (u64)service << WFQ_SERVICE_SHIFT;
++
++	do_div(d, weight);
++	return d;
++}
++
++/**
++ * bfq_calc_finish - assign the finish time to an entity.
++ * @entity: the entity to act upon.
++ * @service: the service to be charged to the entity.
++ */
++static inline void bfq_calc_finish(struct bfq_entity *entity,
++				   unsigned long service)
++{
++	struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++
++	BUG_ON(entity->weight == 0);
++
++	entity->finish = entity->start +
++		bfq_delta(service, entity->weight);
++
++	if (bfqq != NULL) {
++		bfq_log_bfqq(bfqq->bfqd, bfqq,
++			"calc_finish: serv %lu, w %d",
++			service, entity->weight);
++		bfq_log_bfqq(bfqq->bfqd, bfqq,
++			"calc_finish: start %llu, finish %llu, delta %llu",
++			entity->start, entity->finish,
++			bfq_delta(service, entity->weight));
++	}
++}
++
++/**
++ * bfq_entity_of - get an entity from a node.
++ * @node: the node field of the entity.
++ *
++ * Convert a node pointer to the relative entity.  This is used only
++ * to simplify the logic of some functions and not as the generic
++ * conversion mechanism because, e.g., in the tree walking functions,
++ * the check for a %NULL value would be redundant.
++ */
++static inline struct bfq_entity *bfq_entity_of(struct rb_node *node)
++{
++	struct bfq_entity *entity = NULL;
++
++	if (node != NULL)
++		entity = rb_entry(node, struct bfq_entity, rb_node);
++
++	return entity;
++}
++
++/**
++ * bfq_extract - remove an entity from a tree.
++ * @root: the tree root.
++ * @entity: the entity to remove.
++ */
++static inline void bfq_extract(struct rb_root *root,
++			       struct bfq_entity *entity)
++{
++	BUG_ON(entity->tree != root);
++
++	entity->tree = NULL;
++	rb_erase(&entity->rb_node, root);
++}
++
++/**
++ * bfq_idle_extract - extract an entity from the idle tree.
++ * @st: the service tree of the owning @entity.
++ * @entity: the entity being removed.
++ */
++static void bfq_idle_extract(struct bfq_service_tree *st,
++			     struct bfq_entity *entity)
++{
++	struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++	struct rb_node *next;
++
++	BUG_ON(entity->tree != &st->idle);
++
++	if (entity == st->first_idle) {
++		next = rb_next(&entity->rb_node);
++		st->first_idle = bfq_entity_of(next);
++	}
++
++	if (entity == st->last_idle) {
++		next = rb_prev(&entity->rb_node);
++		st->last_idle = bfq_entity_of(next);
++	}
++
++	bfq_extract(&st->idle, entity);
++
++	if (bfqq != NULL)
++		list_del(&bfqq->bfqq_list);
++}
++
++/**
++ * bfq_insert - generic tree insertion.
++ * @root: tree root.
++ * @entity: entity to insert.
++ *
++ * This is used for the idle and the active tree, since they are both
++ * ordered by finish time.
++ */
++static void bfq_insert(struct rb_root *root, struct bfq_entity *entity)
++{
++	struct bfq_entity *entry;
++	struct rb_node **node = &root->rb_node;
++	struct rb_node *parent = NULL;
++
++	BUG_ON(entity->tree != NULL);
++
++	while (*node != NULL) {
++		parent = *node;
++		entry = rb_entry(parent, struct bfq_entity, rb_node);
++
++		if (bfq_gt(entry->finish, entity->finish))
++			node = &parent->rb_left;
++		else
++			node = &parent->rb_right;
++	}
++
++	rb_link_node(&entity->rb_node, parent, node);
++	rb_insert_color(&entity->rb_node, root);
++
++	entity->tree = root;
++}
++
++/**
++ * bfq_update_min - update the min_start field of a entity.
++ * @entity: the entity to update.
++ * @node: one of its children.
++ *
++ * This function is called when @entity may store an invalid value for
++ * min_start due to updates to the active tree.  The function  assumes
++ * that the subtree rooted at @node (which may be its left or its right
++ * child) has a valid min_start value.
++ */
++static inline void bfq_update_min(struct bfq_entity *entity,
++				  struct rb_node *node)
++{
++	struct bfq_entity *child;
++
++	if (node != NULL) {
++		child = rb_entry(node, struct bfq_entity, rb_node);
++		if (bfq_gt(entity->min_start, child->min_start))
++			entity->min_start = child->min_start;
++	}
++}
++
++/**
++ * bfq_update_active_node - recalculate min_start.
++ * @node: the node to update.
++ *
++ * @node may have changed position or one of its children may have moved,
++ * this function updates its min_start value.  The left and right subtrees
++ * are assumed to hold a correct min_start value.
++ */
++static inline void bfq_update_active_node(struct rb_node *node)
++{
++	struct bfq_entity *entity = rb_entry(node, struct bfq_entity, rb_node);
++
++	entity->min_start = entity->start;
++	bfq_update_min(entity, node->rb_right);
++	bfq_update_min(entity, node->rb_left);
++}
++
++/**
++ * bfq_update_active_tree - update min_start for the whole active tree.
++ * @node: the starting node.
++ *
++ * @node must be the deepest modified node after an update.  This function
++ * updates its min_start using the values held by its children, assuming
++ * that they did not change, and then updates all the nodes that may have
++ * changed in the path to the root.  The only nodes that may have changed
++ * are the ones in the path or their siblings.
++ */
++static void bfq_update_active_tree(struct rb_node *node)
++{
++	struct rb_node *parent;
++
++up:
++	bfq_update_active_node(node);
++
++	parent = rb_parent(node);
++	if (parent == NULL)
++		return;
++
++	if (node == parent->rb_left && parent->rb_right != NULL)
++		bfq_update_active_node(parent->rb_right);
++	else if (parent->rb_left != NULL)
++		bfq_update_active_node(parent->rb_left);
++
++	node = parent;
++	goto up;
++}
++
++/**
++ * bfq_active_insert - insert an entity in the active tree of its group/device.
++ * @st: the service tree of the entity.
++ * @entity: the entity being inserted.
++ *
++ * The active tree is ordered by finish time, but an extra key is kept
++ * per each node, containing the minimum value for the start times of
++ * its children (and the node itself), so it's possible to search for
++ * the eligible node with the lowest finish time in logarithmic time.
++ */
++static void bfq_active_insert(struct bfq_service_tree *st,
++			      struct bfq_entity *entity)
++{
++	struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++	struct rb_node *node = &entity->rb_node;
++
++	bfq_insert(&st->active, entity);
++
++	if (node->rb_left != NULL)
++		node = node->rb_left;
++	else if (node->rb_right != NULL)
++		node = node->rb_right;
++
++	bfq_update_active_tree(node);
++
++	if (bfqq != NULL)
++		list_add(&bfqq->bfqq_list, &bfqq->bfqd->active_list);
++}
++
++/**
++ * bfq_ioprio_to_weight - calc a weight from an ioprio.
++ * @ioprio: the ioprio value to convert.
++ */
++static unsigned short bfq_ioprio_to_weight(int ioprio)
++{
++	WARN_ON(ioprio < 0 || ioprio >= IOPRIO_BE_NR);
++	return IOPRIO_BE_NR - ioprio;
++}
++
++/**
++ * bfq_weight_to_ioprio - calc an ioprio from a weight.
++ * @weight: the weight value to convert.
++ *
++ * To preserve as mush as possible the old only-ioprio user interface,
++ * 0 is used as an escape ioprio value for weights (numerically) equal or
++ * larger than IOPRIO_BE_NR
++ */
++static unsigned short bfq_weight_to_ioprio(int weight)
++{
++	WARN_ON(weight < BFQ_MIN_WEIGHT || weight > BFQ_MAX_WEIGHT);
++	return IOPRIO_BE_NR - weight < 0 ? 0 : IOPRIO_BE_NR - weight;
++}
++
++static inline void bfq_get_entity(struct bfq_entity *entity)
++{
++	struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++	struct bfq_sched_data *sd;
++
++	if (bfqq != NULL) {
++		sd = entity->sched_data;
++		atomic_inc(&bfqq->ref);
++		bfq_log_bfqq(bfqq->bfqd, bfqq, "get_entity: %p %d",
++			     bfqq, atomic_read(&bfqq->ref));
++	}
++}
++
++/**
++ * bfq_find_deepest - find the deepest node that an extraction can modify.
++ * @node: the node being removed.
++ *
++ * Do the first step of an extraction in an rb tree, looking for the
++ * node that will replace @node, and returning the deepest node that
++ * the following modifications to the tree can touch.  If @node is the
++ * last node in the tree return %NULL.
++ */
++static struct rb_node *bfq_find_deepest(struct rb_node *node)
++{
++	struct rb_node *deepest;
++
++	if (node->rb_right == NULL && node->rb_left == NULL)
++		deepest = rb_parent(node);
++	else if (node->rb_right == NULL)
++		deepest = node->rb_left;
++	else if (node->rb_left == NULL)
++		deepest = node->rb_right;
++	else {
++		deepest = rb_next(node);
++		if (deepest->rb_right != NULL)
++			deepest = deepest->rb_right;
++		else if (rb_parent(deepest) != node)
++			deepest = rb_parent(deepest);
++	}
++
++	return deepest;
++}
++
++/**
++ * bfq_active_extract - remove an entity from the active tree.
++ * @st: the service_tree containing the tree.
++ * @entity: the entity being removed.
++ */
++static void bfq_active_extract(struct bfq_service_tree *st,
++			       struct bfq_entity *entity)
++{
++	struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++	struct rb_node *node;
++
++	node = bfq_find_deepest(&entity->rb_node);
++	bfq_extract(&st->active, entity);
++
++	if (node != NULL)
++		bfq_update_active_tree(node);
++
++	if (bfqq != NULL)
++		list_del(&bfqq->bfqq_list);
++}
++
++/**
++ * bfq_idle_insert - insert an entity into the idle tree.
++ * @st: the service tree containing the tree.
++ * @entity: the entity to insert.
++ */
++static void bfq_idle_insert(struct bfq_service_tree *st,
++			    struct bfq_entity *entity)
++{
++	struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++	struct bfq_entity *first_idle = st->first_idle;
++	struct bfq_entity *last_idle = st->last_idle;
++
++	if (first_idle == NULL || bfq_gt(first_idle->finish, entity->finish))
++		st->first_idle = entity;
++	if (last_idle == NULL || bfq_gt(entity->finish, last_idle->finish))
++		st->last_idle = entity;
++
++	bfq_insert(&st->idle, entity);
++
++	if (bfqq != NULL)
++		list_add(&bfqq->bfqq_list, &bfqq->bfqd->idle_list);
++}
++
++/**
++ * bfq_forget_entity - remove an entity from the wfq trees.
++ * @st: the service tree.
++ * @entity: the entity being removed.
++ *
++ * Update the device status and forget everything about @entity, putting
++ * the device reference to it, if it is a queue.  Entities belonging to
++ * groups are not refcounted.
++ */
++static void bfq_forget_entity(struct bfq_service_tree *st,
++			      struct bfq_entity *entity)
++{
++	struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++	struct bfq_sched_data *sd;
++
++	BUG_ON(!entity->on_st);
++
++	entity->on_st = 0;
++	st->wsum -= entity->weight;
++	if (bfqq != NULL) {
++		sd = entity->sched_data;
++		bfq_log_bfqq(bfqq->bfqd, bfqq, "forget_entity: %p %d",
++			     bfqq, atomic_read(&bfqq->ref));
++		bfq_put_queue(bfqq);
++	}
++}
++
++/**
++ * bfq_put_idle_entity - release the idle tree ref of an entity.
++ * @st: service tree for the entity.
++ * @entity: the entity being released.
++ */
++static void bfq_put_idle_entity(struct bfq_service_tree *st,
++				struct bfq_entity *entity)
++{
++	bfq_idle_extract(st, entity);
++	bfq_forget_entity(st, entity);
++}
++
++/**
++ * bfq_forget_idle - update the idle tree if necessary.
++ * @st: the service tree to act upon.
++ *
++ * To preserve the global O(log N) complexity we only remove one entry here;
++ * as the idle tree will not grow indefinitely this can be done safely.
++ */
++static void bfq_forget_idle(struct bfq_service_tree *st)
++{
++	struct bfq_entity *first_idle = st->first_idle;
++	struct bfq_entity *last_idle = st->last_idle;
++
++	if (RB_EMPTY_ROOT(&st->active) && last_idle != NULL &&
++	    !bfq_gt(last_idle->finish, st->vtime)) {
++		/*
++		 * Forget the whole idle tree, increasing the vtime past
++		 * the last finish time of idle entities.
++		 */
++		st->vtime = last_idle->finish;
++	}
++
++	if (first_idle != NULL && !bfq_gt(first_idle->finish, st->vtime))
++		bfq_put_idle_entity(st, first_idle);
++}
++
++static struct bfq_service_tree *
++__bfq_entity_update_weight_prio(struct bfq_service_tree *old_st,
++			 struct bfq_entity *entity)
++{
++	struct bfq_service_tree *new_st = old_st;
++
++	if (entity->ioprio_changed) {
++		struct bfq_queue *bfqq = bfq_entity_to_bfqq(entity);
++
++		BUG_ON(old_st->wsum < entity->weight);
++		old_st->wsum -= entity->weight;
++
++		if (entity->new_weight != entity->orig_weight) {
++			entity->orig_weight = entity->new_weight;
++			entity->ioprio =
++				bfq_weight_to_ioprio(entity->orig_weight);
++		} else if (entity->new_ioprio != entity->ioprio) {
++			entity->ioprio = entity->new_ioprio;
++			entity->orig_weight =
++					bfq_ioprio_to_weight(entity->ioprio);
++		} else
++			entity->new_weight = entity->orig_weight =
++				bfq_ioprio_to_weight(entity->ioprio);
++
++		entity->ioprio_class = entity->new_ioprio_class;
++		entity->ioprio_changed = 0;
++
++		/*
++		 * NOTE: here we may be changing the weight too early,
++		 * this will cause unfairness.  The correct approach
++		 * would have required additional complexity to defer
++		 * weight changes to the proper time instants (i.e.,
++		 * when entity->finish <= old_st->vtime).
++		 */
++		new_st = bfq_entity_service_tree(entity);
++		entity->weight = entity->orig_weight *
++			(bfqq != NULL ? bfqq->raising_coeff : 1);
++		new_st->wsum += entity->weight;
++
++		if (new_st != old_st)
++			entity->start = new_st->vtime;
++	}
++
++	return new_st;
++}
++
++/**
++ * bfq_bfqq_served - update the scheduler status after selection for service.
++ * @bfqq: the queue being served.
++ * @served: bytes to transfer.
++ *
++ * NOTE: this can be optimized, as the timestamps of upper level entities
++ * are synchronized every time a new bfqq is selected for service.  By now,
++ * we keep it to better check consistency.
++ */
++static void bfq_bfqq_served(struct bfq_queue *bfqq, unsigned long served)
++{
++	struct bfq_entity *entity = &bfqq->entity;
++	struct bfq_service_tree *st;
++
++	for_each_entity(entity) {
++		st = bfq_entity_service_tree(entity);
++
++		entity->service += served;
++		BUG_ON(entity->service > entity->budget);
++		BUG_ON(st->wsum == 0);
++
++		st->vtime += bfq_delta(served, st->wsum);
++		bfq_forget_idle(st);
++	}
++	bfq_log_bfqq(bfqq->bfqd, bfqq, "bfqq_served %lu secs", served);
++}
++
++/**
++ * bfq_bfqq_charge_full_budget - set the service to the entity budget.
++ * @bfqq: the queue that needs a service update.
++ *
++ * When it's not possible to be fair in the service domain, because
++ * a queue is not consuming its budget fast enough (the meaning of
++ * fast depends on the timeout parameter), we charge it a full
++ * budget.  In this way we should obtain a sort of time-domain
++ * fairness among all the seeky/slow queues.
++ */
++static inline void bfq_bfqq_charge_full_budget(struct bfq_queue *bfqq)
++{
++	struct bfq_entity *entity = &bfqq->entity;
++
++	bfq_log_bfqq(bfqq->bfqd, bfqq, "charge_full_budget");
++
++	bfq_bfqq_served(bfqq, entity->budget - entity->service);
++}
++
++/**
++ * __bfq_activate_entity - activate an entity.
++ * @entity: the entity being activated.
++ *
++ * Called whenever an entity is activated, i.e., it is not active and one
++ * of its children receives a new request, or has to be reactivated due to
++ * budget exhaustion.  It uses the current budget of the entity (and the
++ * service received if @entity is active) of the queue to calculate its
++ * timestamps.
++ */
++static void __bfq_activate_entity(struct bfq_entity *entity)
++{
++	struct bfq_sched_data *sd = entity->sched_data;
++	struct bfq_service_tree *st = bfq_entity_service_tree(entity);
++
++	if (entity == sd->active_entity) {
++		BUG_ON(entity->tree != NULL);
++		/*
++		 * If we are requeueing the current entity we have
++		 * to take care of not charging to it service it has
++		 * not received.
++		 */
++		bfq_calc_finish(entity, entity->service);
++		entity->start = entity->finish;
++		sd->active_entity = NULL;
++	} else if (entity->tree == &st->active) {
++		/*
++		 * Requeueing an entity due to a change of some
++		 * next_active entity below it.  We reuse the old
++		 * start time.
++		 */
++		bfq_active_extract(st, entity);
++	} else if (entity->tree == &st->idle) {
++		/*
++		 * Must be on the idle tree, bfq_idle_extract() will
++		 * check for that.
++		 */
++		bfq_idle_extract(st, entity);
++		entity->start = bfq_gt(st->vtime, entity->finish) ?
++				       st->vtime : entity->finish;
++	} else {
++		/*
++		 * The finish time of the entity may be invalid, and
++		 * it is in the past for sure, otherwise the queue
++		 * would have been on the idle tree.
++		 */
++		entity->start = st->vtime;
++		st->wsum += entity->weight;
++		bfq_get_entity(entity);
++
++		BUG_ON(entity->on_st);
++		entity->on_st = 1;
++	}
++
++	st = __bfq_entity_update_weight_prio(st, entity);
++	bfq_calc_finish(entity, entity->budget);
++	bfq_active_insert(st, entity);
++}
++
++/**
++ * bfq_activate_entity - activate an entity and its ancestors if necessary.
++ * @entity: the entity to activate.
++ *
++ * Activate @entity and all the entities on the path from it to the root.
++ */
++static void bfq_activate_entity(struct bfq_entity *entity)
++{
++	struct bfq_sched_data *sd;
++
++	for_each_entity(entity) {
++		__bfq_activate_entity(entity);
++
++		sd = entity->sched_data;
++		if (!bfq_update_next_active(sd))
++			/*
++			 * No need to propagate the activation to the
++			 * upper entities, as they will be updated when
++			 * the active entity is rescheduled.
++			 */
++			break;
++	}
++}
++
++/**
++ * __bfq_deactivate_entity - deactivate an entity from its service tree.
++ * @entity: the entity to deactivate.
++ * @requeue: if false, the entity will not be put into the idle tree.
++ *
++ * Deactivate an entity, independently from its previous state.  If the
++ * entity was not on a service tree just return, otherwise if it is on
++ * any scheduler tree, extract it from that tree, and if necessary
++ * and if the caller did not specify @requeue, put it on the idle tree.
++ *
++ * Return %1 if the caller should update the entity hierarchy, i.e.,
++ * if the entity was under service or if it was the next_active for
++ * its sched_data; return %0 otherwise.
++ */
++static int __bfq_deactivate_entity(struct bfq_entity *entity, int requeue)
++{
++	struct bfq_sched_data *sd = entity->sched_data;
++	struct bfq_service_tree *st = bfq_entity_service_tree(entity);
++	int was_active = entity == sd->active_entity;
++	int ret = 0;
++
++	if (!entity->on_st)
++		return 0;
++
++	BUG_ON(was_active && entity->tree != NULL);
++
++	if (was_active) {
++		bfq_calc_finish(entity, entity->service);
++		sd->active_entity = NULL;
++	} else if (entity->tree == &st->active)
++		bfq_active_extract(st, entity);
++	else if (entity->tree == &st->idle)
++		bfq_idle_extract(st, entity);
++	else if (entity->tree != NULL)
++		BUG();
++
++	if (was_active || sd->next_active == entity)
++		ret = bfq_update_next_active(sd);
++
++	if (!requeue || !bfq_gt(entity->finish, st->vtime))
++		bfq_forget_entity(st, entity);
++	else
++		bfq_idle_insert(st, entity);
++
++	BUG_ON(sd->active_entity == entity);
++	BUG_ON(sd->next_active == entity);
++
++	return ret;
++}
++
++/**
++ * bfq_deactivate_entity - deactivate an entity.
++ * @entity: the entity to deactivate.
++ * @requeue: true if the entity can be put on the idle tree
++ */
++static void bfq_deactivate_entity(struct bfq_entity *entity, int requeue)
++{
++	struct bfq_sched_data *sd;
++	struct bfq_entity *parent;
++
++	for_each_entity_safe(entity, parent) {
++		sd = entity->sched_data;
++
++		if (!__bfq_deactivate_entity(entity, requeue))
++			/*
++			 * The parent entity is still backlogged, and
++			 * we don't need to update it as it is still
++			 * under service.
++			 */
++			break;
++
++		if (sd->next_active != NULL)
++			/*
++			 * The parent entity is still backlogged and
++			 * the budgets on the path towards the root
++			 * need to be updated.
++			 */
++			goto update;
++
++		/*
++		 * If we reach there the parent is no more backlogged and
++		 * we want to propagate the dequeue upwards.
++		 */
++		requeue = 1;
++	}
++
++	return;
++
++update:
++	entity = parent;
++	for_each_entity(entity) {
++		__bfq_activate_entity(entity);
++
++		sd = entity->sched_data;
++		if (!bfq_update_next_active(sd))
++			break;
++	}
++}
++
++/**
++ * bfq_update_vtime - update vtime if necessary.
++ * @st: the service tree to act upon.
++ *
++ * If necessary update the service tree vtime to have at least one
++ * eligible entity, skipping to its start time.  Assumes that the
++ * active tree of the device is not empty.
++ *
++ * NOTE: this hierarchical implementation updates vtimes quite often,
++ * we may end up with reactivated tasks getting timestamps after a
++ * vtime skip done because we needed a ->first_active entity on some
++ * intermediate node.
++ */
++static void bfq_update_vtime(struct bfq_service_tree *st)
++{
++	struct bfq_entity *entry;
++	struct rb_node *node = st->active.rb_node;
++
++	entry = rb_entry(node, struct bfq_entity, rb_node);
++	if (bfq_gt(entry->min_start, st->vtime)) {
++		st->vtime = entry->min_start;
++		bfq_forget_idle(st);
++	}
++}
++
++/**
++ * bfq_first_active - find the eligible entity with the smallest finish time
++ * @st: the service tree to select from.
++ *
++ * This function searches the first schedulable entity, starting from the
++ * root of the tree and going on the left every time on this side there is
++ * a subtree with at least one eligible (start >= vtime) entity.  The path
++ * on the right is followed only if a) the left subtree contains no eligible
++ * entities and b) no eligible entity has been found yet.
++ */
++static struct bfq_entity *bfq_first_active_entity(struct bfq_service_tree *st)
++{
++	struct bfq_entity *entry, *first = NULL;
++	struct rb_node *node = st->active.rb_node;
++
++	while (node != NULL) {
++		entry = rb_entry(node, struct bfq_entity, rb_node);
++left:
++		if (!bfq_gt(entry->start, st->vtime))
++			first = entry;
++
++		BUG_ON(bfq_gt(entry->min_start, st->vtime));
++
++		if (node->rb_left != NULL) {
++			entry = rb_entry(node->rb_left,
++					 struct bfq_entity, rb_node);
++			if (!bfq_gt(entry->min_start, st->vtime)) {
++				node = node->rb_left;
++				goto left;
++			}
++		}
++		if (first != NULL)
++			break;
++		node = node->rb_right;
++	}
++
++	BUG_ON(first == NULL && !RB_EMPTY_ROOT(&st->active));
++	return first;
++}
++
++/**
++ * __bfq_lookup_next_entity - return the first eligible entity in @st.
++ * @st: the service tree.
++ *
++ * Update the virtual time in @st and return the first eligible entity
++ * it contains.
++ */
++static struct bfq_entity *__bfq_lookup_next_entity(struct bfq_service_tree *st,
++						   bool force)
++{
++	struct bfq_entity *entity, *new_next_active = NULL;
++
++	if (RB_EMPTY_ROOT(&st->active))
++		return NULL;
++
++	bfq_update_vtime(st);
++	entity = bfq_first_active_entity(st);
++	BUG_ON(bfq_gt(entity->start, st->vtime));
++
++	/*
++	 * If the chosen entity does not match with the sched_data's
++	 * next_active and we are forcedly serving the IDLE priority
++	 * class tree, bubble up budget update.
++	 */
++	if (unlikely(force && entity != entity->sched_data->next_active)) {
++		new_next_active = entity;
++		for_each_entity(new_next_active)
++			bfq_update_budget(new_next_active);
++	}
++
++	return entity;
++}
++
++/**
++ * bfq_lookup_next_entity - return the first eligible entity in @sd.
++ * @sd: the sched_data.
++ * @extract: if true the returned entity will be also extracted from @sd.
++ *
++ * NOTE: since we cache the next_active entity at each level of the
++ * hierarchy, the complexity of the lookup can be decreased with
++ * absolutely no effort just returning the cached next_active value;
++ * we prefer to do full lookups to test the consistency of * the data
++ * structures.
++ */
++static struct bfq_entity *bfq_lookup_next_entity(struct bfq_sched_data *sd,
++						 int extract,
++						 struct bfq_data *bfqd)
++{
++	struct bfq_service_tree *st = sd->service_tree;
++	struct bfq_entity *entity;
++	int i=0;
++
++	BUG_ON(sd->active_entity != NULL);
++
++	if (bfqd != NULL &&
++	    jiffies - bfqd->bfq_class_idle_last_service > BFQ_CL_IDLE_TIMEOUT) {
++		entity = __bfq_lookup_next_entity(st + BFQ_IOPRIO_CLASSES - 1, true);
++		if (entity != NULL) {
++			i = BFQ_IOPRIO_CLASSES - 1;
++			bfqd->bfq_class_idle_last_service = jiffies;
++			sd->next_active = entity;
++		}
++	}
++	for (; i < BFQ_IOPRIO_CLASSES; i++) {
++		entity = __bfq_lookup_next_entity(st + i, false);
++		if (entity != NULL) {
++			if (extract) {
++				bfq_check_next_active(sd, entity);
++				bfq_active_extract(st + i, entity);
++				sd->active_entity = entity;
++				sd->next_active = NULL;
++			}
++			break;
++		}
++	}
++
++	return entity;
++}
++
++/*
++ * Get next queue for service.
++ */
++static struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd)
++{
++	struct bfq_entity *entity = NULL;
++	struct bfq_sched_data *sd;
++	struct bfq_queue *bfqq;
++
++	BUG_ON(bfqd->active_queue != NULL);
++
++	if (bfqd->busy_queues == 0)
++		return NULL;
++
++	sd = &bfqd->root_group->sched_data;
++	for (; sd != NULL; sd = entity->my_sched_data) {
++		entity = bfq_lookup_next_entity(sd, 1, bfqd);
++		BUG_ON(entity == NULL);
++		entity->service = 0;
++	}
++
++	bfqq = bfq_entity_to_bfqq(entity);
++	BUG_ON(bfqq == NULL);
++
++	return bfqq;
++}
++
++/*
++ * Forced extraction of the given queue.
++ */
++static void bfq_get_next_queue_forced(struct bfq_data *bfqd,
++				      struct bfq_queue *bfqq)
++{
++	struct bfq_entity *entity;
++	struct bfq_sched_data *sd;
++
++	BUG_ON(bfqd->active_queue != NULL);
++
++	entity = &bfqq->entity;
++	/*
++	 * Bubble up extraction/update from the leaf to the root.
++	*/
++	for_each_entity(entity) {
++		sd = entity->sched_data;
++		bfq_update_budget(entity);
++		bfq_update_vtime(bfq_entity_service_tree(entity));
++		bfq_active_extract(bfq_entity_service_tree(entity), entity);
++		sd->active_entity = entity;
++		sd->next_active = NULL;
++		entity->service = 0;
++	}
++
++	return;
++}
++
++static void __bfq_bfqd_reset_active(struct bfq_data *bfqd)
++{
++	if (bfqd->active_bic != NULL) {
++		put_io_context(bfqd->active_bic->icq.ioc);
++		bfqd->active_bic = NULL;
++	}
++
++	bfqd->active_queue = NULL;
++	del_timer(&bfqd->idle_slice_timer);
++}
++
++static void bfq_deactivate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++				int requeue)
++{
++	struct bfq_entity *entity = &bfqq->entity;
++
++	if (bfqq == bfqd->active_queue)
++		__bfq_bfqd_reset_active(bfqd);
++
++	bfq_deactivate_entity(entity, requeue);
++}
++
++static void bfq_activate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq)
++{
++	struct bfq_entity *entity = &bfqq->entity;
++
++	bfq_activate_entity(entity);
++}
++
++/*
++ * Called when the bfqq no longer has requests pending, remove it from
++ * the service tree.
++ */
++static void bfq_del_bfqq_busy(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++			      int requeue)
++{
++	BUG_ON(!bfq_bfqq_busy(bfqq));
++	BUG_ON(!RB_EMPTY_ROOT(&bfqq->sort_list));
++
++	bfq_log_bfqq(bfqd, bfqq, "del from busy");
++
++	bfq_clear_bfqq_busy(bfqq);
++
++	BUG_ON(bfqd->busy_queues == 0);
++	bfqd->busy_queues--;
++
++	bfq_deactivate_bfqq(bfqd, bfqq, requeue);
++}
++
++/*
++ * Called when an inactive queue receives a new request.
++ */
++static void bfq_add_bfqq_busy(struct bfq_data *bfqd, struct bfq_queue *bfqq)
++{
++	BUG_ON(bfq_bfqq_busy(bfqq));
++	BUG_ON(bfqq == bfqd->active_queue);
++
++	bfq_log_bfqq(bfqd, bfqq, "add to busy");
++
++	bfq_activate_bfqq(bfqd, bfqq);
++
++	bfq_mark_bfqq_busy(bfqq);
++	bfqd->busy_queues++;
++}
+diff --git a/block/bfq.h b/block/bfq.h
+new file mode 100644
+index 0000000..48ecde9
+--- /dev/null
++++ b/block/bfq.h
+@@ -0,0 +1,603 @@
++/*
++ * BFQ-v6r2 for 3.10.0: data structures and common functions prototypes.
++ *
++ * Based on ideas and code from CFQ:
++ * Copyright (C) 2003 Jens Axboe <axboe@××××××.dk>
++ *
++ * Copyright (C) 2008 Fabio Checconi <fabio@×××××××××××××.it>
++ *		      Paolo Valente <paolo.valente@×××××××.it>
++ *
++ * Copyright (C) 2010 Paolo Valente <paolo.valente@×××××××.it>
++ */
++
++#ifndef _BFQ_H
++#define _BFQ_H
++
++#include <linux/blktrace_api.h>
++#include <linux/hrtimer.h>
++#include <linux/ioprio.h>
++#include <linux/rbtree.h>
++
++#define BFQ_IOPRIO_CLASSES	3
++#define BFQ_CL_IDLE_TIMEOUT	HZ/5
++
++#define BFQ_MIN_WEIGHT	1
++#define BFQ_MAX_WEIGHT	1000
++
++#define BFQ_DEFAULT_GRP_WEIGHT	10
++#define BFQ_DEFAULT_GRP_IOPRIO	0
++#define BFQ_DEFAULT_GRP_CLASS	IOPRIO_CLASS_BE
++
++struct bfq_entity;
++
++/**
++ * struct bfq_service_tree - per ioprio_class service tree.
++ * @active: tree for active entities (i.e., those backlogged).
++ * @idle: tree for idle entities (i.e., those not backlogged, with V <= F_i).
++ * @first_idle: idle entity with minimum F_i.
++ * @last_idle: idle entity with maximum F_i.
++ * @vtime: scheduler virtual time.
++ * @wsum: scheduler weight sum; active and idle entities contribute to it.
++ *
++ * Each service tree represents a B-WF2Q+ scheduler on its own.  Each
++ * ioprio_class has its own independent scheduler, and so its own
++ * bfq_service_tree.  All the fields are protected by the queue lock
++ * of the containing bfqd.
++ */
++struct bfq_service_tree {
++	struct rb_root active;
++	struct rb_root idle;
++
++	struct bfq_entity *first_idle;
++	struct bfq_entity *last_idle;
++
++	u64 vtime;
++	unsigned long wsum;
++};
++
++/**
++ * struct bfq_sched_data - multi-class scheduler.
++ * @active_entity: entity under service.
++ * @next_active: head-of-the-line entity in the scheduler.
++ * @service_tree: array of service trees, one per ioprio_class.
++ *
++ * bfq_sched_data is the basic scheduler queue.  It supports three
++ * ioprio_classes, and can be used either as a toplevel queue or as
++ * an intermediate queue on a hierarchical setup.
++ * @next_active points to the active entity of the sched_data service
++ * trees that will be scheduled next.
++ *
++ * The supported ioprio_classes are the same as in CFQ, in descending
++ * priority order, IOPRIO_CLASS_RT, IOPRIO_CLASS_BE, IOPRIO_CLASS_IDLE.
++ * Requests from higher priority queues are served before all the
++ * requests from lower priority queues; among requests of the same
++ * queue requests are served according to B-WF2Q+.
++ * All the fields are protected by the queue lock of the containing bfqd.
++ */
++struct bfq_sched_data {
++	struct bfq_entity *active_entity;
++	struct bfq_entity *next_active;
++	struct bfq_service_tree service_tree[BFQ_IOPRIO_CLASSES];
++};
++
++/**
++ * struct bfq_entity - schedulable entity.
++ * @rb_node: service_tree member.
++ * @on_st: flag, true if the entity is on a tree (either the active or
++ *         the idle one of its service_tree).
++ * @finish: B-WF2Q+ finish timestamp (aka F_i).
++ * @start: B-WF2Q+ start timestamp (aka S_i).
++ * @tree: tree the entity is enqueued into; %NULL if not on a tree.
++ * @min_start: minimum start time of the (active) subtree rooted at
++ *             this entity; used for O(log N) lookups into active trees.
++ * @service: service received during the last round of service.
++ * @budget: budget used to calculate F_i; F_i = S_i + @budget / @weight.
++ * @weight: weight of the queue
++ * @parent: parent entity, for hierarchical scheduling.
++ * @my_sched_data: for non-leaf nodes in the cgroup hierarchy, the
++ *                 associated scheduler queue, %NULL on leaf nodes.
++ * @sched_data: the scheduler queue this entity belongs to.
++ * @ioprio: the ioprio in use.
++ * @new_weight: when a weight change is requested, the new weight value.
++ * @orig_weight: original weight, used to implement weight boosting
++ * @new_ioprio: when an ioprio change is requested, the new ioprio value.
++ * @ioprio_class: the ioprio_class in use.
++ * @new_ioprio_class: when an ioprio_class change is requested, the new
++ *                    ioprio_class value.
++ * @ioprio_changed: flag, true when the user requested a weight, ioprio or
++ *                  ioprio_class change.
++ *
++ * A bfq_entity is used to represent either a bfq_queue (leaf node in the
++ * cgroup hierarchy) or a bfq_group into the upper level scheduler.  Each
++ * entity belongs to the sched_data of the parent group in the cgroup
++ * hierarchy.  Non-leaf entities have also their own sched_data, stored
++ * in @my_sched_data.
++ *
++ * Each entity stores independently its priority values; this would
++ * allow different weights on different devices, but this
++ * functionality is not exported to userspace by now.  Priorities and
++ * weights are updated lazily, first storing the new values into the
++ * new_* fields, then setting the @ioprio_changed flag.  As soon as
++ * there is a transition in the entity state that allows the priority
++ * update to take place the effective and the requested priority
++ * values are synchronized.
++ *
++ * Unless cgroups are used, the weight value is calculated from the
++ * ioprio to export the same interface as CFQ.  When dealing with
++ * ``well-behaved'' queues (i.e., queues that do not spend too much
++ * time to consume their budget and have true sequential behavior, and
++ * when there are no external factors breaking anticipation) the
++ * relative weights at each level of the cgroups hierarchy should be
++ * guaranteed.  All the fields are protected by the queue lock of the
++ * containing bfqd.
++ */
++struct bfq_entity {
++	struct rb_node rb_node;
++
++	int on_st;
++
++	u64 finish;
++	u64 start;
++
++	struct rb_root *tree;
++
++	u64 min_start;
++
++	unsigned long service, budget;
++	unsigned short weight, new_weight;
++	unsigned short orig_weight;
++
++	struct bfq_entity *parent;
++
++	struct bfq_sched_data *my_sched_data;
++	struct bfq_sched_data *sched_data;
++
++	unsigned short ioprio, new_ioprio;
++	unsigned short ioprio_class, new_ioprio_class;
++
++	int ioprio_changed;
++};
++
++struct bfq_group;
++
++/**
++ * struct bfq_queue - leaf schedulable entity.
++ * @ref: reference counter.
++ * @bfqd: parent bfq_data.
++ * @new_bfqq: shared bfq_queue if queue is cooperating with
++ *           one or more other queues.
++ * @pos_node: request-position tree member (see bfq_data's @rq_pos_tree).
++ * @pos_root: request-position tree root (see bfq_data's @rq_pos_tree).
++ * @sort_list: sorted list of pending requests.
++ * @next_rq: if fifo isn't expired, next request to serve.
++ * @queued: nr of requests queued in @sort_list.
++ * @allocated: currently allocated requests.
++ * @meta_pending: pending metadata requests.
++ * @fifo: fifo list of requests in sort_list.
++ * @entity: entity representing this queue in the scheduler.
++ * @max_budget: maximum budget allowed from the feedback mechanism.
++ * @budget_timeout: budget expiration (in jiffies).
++ * @dispatched: number of requests on the dispatch list or inside driver.
++ * @org_ioprio: saved ioprio during boosted periods.
++ * @flags: status flags.
++ * @bfqq_list: node for active/idle bfqq list inside our bfqd.
++ * @seek_samples: number of seeks sampled
++ * @seek_total: sum of the distances of the seeks sampled
++ * @seek_mean: mean seek distance
++ * @last_request_pos: position of the last request enqueued
++ * @pid: pid of the process owning the queue, used for logging purposes.
++ * @last_rais_start_time: last (idle -> weight-raised) transition attempt
++ * @raising_cur_max_time: current max raising time for this queue
++ *
++ * A bfq_queue is a leaf request queue; it can be associated to an io_context
++ * or more (if it is an async one).  @cgroup holds a reference to the
++ * cgroup, to be sure that it does not disappear while a bfqq still
++ * references it (mostly to avoid races between request issuing and task
++ * migration followed by cgroup distruction).
++ * All the fields are protected by the queue lock of the containing bfqd.
++ */
++struct bfq_queue {
++	atomic_t ref;
++	struct bfq_data *bfqd;
++
++	/* fields for cooperating queues handling */
++	struct bfq_queue *new_bfqq;
++	struct rb_node pos_node;
++	struct rb_root *pos_root;
++
++	struct rb_root sort_list;
++	struct request *next_rq;
++	int queued[2];
++	int allocated[2];
++	int meta_pending;
++	struct list_head fifo;
++
++	struct bfq_entity entity;
++
++	unsigned long max_budget;
++	unsigned long budget_timeout;
++
++	int dispatched;
++
++	unsigned short org_ioprio;
++
++	unsigned int flags;
++
++	struct list_head bfqq_list;
++
++	unsigned int seek_samples;
++	u64 seek_total;
++	sector_t seek_mean;
++	sector_t last_request_pos;
++
++	pid_t pid;
++
++	/* weight-raising fields */
++	unsigned int raising_cur_max_time;
++	u64 last_rais_start_finish, soft_rt_next_start;
++	unsigned int raising_coeff;
++};
++
++/**
++ * struct bfq_ttime - per process thinktime stats.
++ * @ttime_total: total process thinktime
++ * @ttime_samples: number of thinktime samples
++ * @ttime_mean: average process thinktime
++ */
++struct bfq_ttime {
++	unsigned long last_end_request;
++
++	unsigned long ttime_total;
++	unsigned long ttime_samples;
++	unsigned long ttime_mean;
++};
++
++/**
++ * struct bfq_io_cq - per (request_queue, io_context) structure.
++ * @icq: associated io_cq structure
++ * @bfqq: array of two process queues, the sync and the async
++ * @ttime: associated @bfq_ttime struct
++ */
++struct bfq_io_cq {
++	struct io_cq icq; /* must be the first member */
++	struct bfq_queue *bfqq[2];
++	struct bfq_ttime ttime;
++	int ioprio;
++};
++
++/**
++ * struct bfq_data - per device data structure.
++ * @queue: request queue for the managed device.
++ * @root_group: root bfq_group for the device.
++ * @rq_pos_tree: rbtree sorted by next_request position,
++ *		used when determining if two or more queues
++ *		have interleaving requests (see bfq_close_cooperator).
++ * @busy_queues: number of bfq_queues containing requests (including the
++ *		 queue under service, even if it is idling).
++ * @queued: number of queued requests.
++ * @rq_in_driver: number of requests dispatched and waiting for completion.
++ * @sync_flight: number of sync requests in the driver.
++ * @max_rq_in_driver: max number of reqs in driver in the last @hw_tag_samples
++ *		      completed requests .
++ * @hw_tag_samples: nr of samples used to calculate hw_tag.
++ * @hw_tag: flag set to one if the driver is showing a queueing behavior.
++ * @budgets_assigned: number of budgets assigned.
++ * @idle_slice_timer: timer set when idling for the next sequential request
++ *                    from the queue under service.
++ * @unplug_work: delayed work to restart dispatching on the request queue.
++ * @active_queue: bfq_queue under service.
++ * @active_bic: bfq_io_cq (bic) associated with the @active_queue.
++ * @last_position: on-disk position of the last served request.
++ * @last_budget_start: beginning of the last budget.
++ * @last_idling_start: beginning of the last idle slice.
++ * @peak_rate: peak transfer rate observed for a budget.
++ * @peak_rate_samples: number of samples used to calculate @peak_rate.
++ * @bfq_max_budget: maximum budget allotted to a bfq_queue before rescheduling.
++ * @group_list: list of all the bfq_groups active on the device.
++ * @active_list: list of all the bfq_queues active on the device.
++ * @idle_list: list of all the bfq_queues idle on the device.
++ * @bfq_quantum: max number of requests dispatched per dispatch round.
++ * @bfq_fifo_expire: timeout for async/sync requests; when it expires
++ *                   requests are served in fifo order.
++ * @bfq_back_penalty: weight of backward seeks wrt forward ones.
++ * @bfq_back_max: maximum allowed backward seek.
++ * @bfq_slice_idle: maximum idling time.
++ * @bfq_user_max_budget: user-configured max budget value (0 for auto-tuning).
++ * @bfq_max_budget_async_rq: maximum budget (in nr of requests) allotted to
++ *                           async queues.
++ * @bfq_timeout: timeout for bfq_queues to consume their budget; used to
++ *               to prevent seeky queues to impose long latencies to well
++ *               behaved ones (this also implies that seeky queues cannot
++ *               receive guarantees in the service domain; after a timeout
++ *               they are charged for the whole allocated budget, to try
++ *               to preserve a behavior reasonably fair among them, but
++ *               without service-domain guarantees).
++ * @bfq_raising_coeff: Maximum factor by which the weight of a boosted
++ *                            queue is multiplied
++ * @bfq_raising_max_time: maximum duration of a weight-raising period (jiffies)
++ * @bfq_raising_rt_max_time: maximum duration for soft real-time processes
++ * @bfq_raising_min_idle_time: minimum idle period after which weight-raising
++ *			       may be reactivated for a queue (in jiffies)
++ * @bfq_raising_min_inter_arr_async: minimum period between request arrivals
++ *				     after which weight-raising may be
++ *				     reactivated for an already busy queue
++ *				     (in jiffies)
++ * @bfq_raising_max_softrt_rate: max service-rate for a soft real-time queue,
++ *			         sectors per seconds
++ * @RT_prod: cached value of the product R*T used for computing the maximum
++ * 	     duration of the weight raising automatically
++ * @oom_bfqq: fallback dummy bfqq for extreme OOM conditions
++ *
++ * All the fields are protected by the @queue lock.
++ */
++struct bfq_data {
++	struct request_queue *queue;
++
++	struct bfq_group *root_group;
++
++	struct rb_root rq_pos_tree;
++
++	int busy_queues;
++	int queued;
++	int rq_in_driver;
++	int sync_flight;
++
++	int max_rq_in_driver;
++	int hw_tag_samples;
++	int hw_tag;
++
++	int budgets_assigned;
++
++	struct timer_list idle_slice_timer;
++	struct work_struct unplug_work;
++
++	struct bfq_queue *active_queue;
++	struct bfq_io_cq *active_bic;
++
++	sector_t last_position;
++
++	ktime_t last_budget_start;
++	ktime_t last_idling_start;
++	int peak_rate_samples;
++	u64 peak_rate;
++	unsigned long bfq_max_budget;
++
++	struct hlist_head group_list;
++	struct list_head active_list;
++	struct list_head idle_list;
++
++	unsigned int bfq_quantum;
++	unsigned int bfq_fifo_expire[2];
++	unsigned int bfq_back_penalty;
++	unsigned int bfq_back_max;
++	unsigned int bfq_slice_idle;
++	u64 bfq_class_idle_last_service;
++
++	unsigned int bfq_user_max_budget;
++	unsigned int bfq_max_budget_async_rq;
++	unsigned int bfq_timeout[2];
++
++	bool low_latency;
++
++	/* parameters of the low_latency heuristics */
++	unsigned int bfq_raising_coeff;
++	unsigned int bfq_raising_max_time;
++	unsigned int bfq_raising_rt_max_time;
++	unsigned int bfq_raising_min_idle_time;
++	unsigned int bfq_raising_min_inter_arr_async;
++	unsigned int bfq_raising_max_softrt_rate;
++	u64 RT_prod;
++
++	struct bfq_queue oom_bfqq;
++};
++
++enum bfqq_state_flags {
++	BFQ_BFQQ_FLAG_busy = 0,		/* has requests or is under service */
++	BFQ_BFQQ_FLAG_wait_request,	/* waiting for a request */
++	BFQ_BFQQ_FLAG_must_alloc,	/* must be allowed rq alloc */
++	BFQ_BFQQ_FLAG_fifo_expire,	/* FIFO checked in this slice */
++	BFQ_BFQQ_FLAG_idle_window,	/* slice idling enabled */
++	BFQ_BFQQ_FLAG_prio_changed,	/* task priority has changed */
++	BFQ_BFQQ_FLAG_sync,		/* synchronous queue */
++	BFQ_BFQQ_FLAG_budget_new,	/* no completion with this budget */
++	BFQ_BFQQ_FLAG_coop,		/* bfqq is shared */
++	BFQ_BFQQ_FLAG_split_coop,	/* shared bfqq will be splitted */
++	BFQ_BFQQ_FLAG_some_coop_idle,   /* some cooperator is inactive */
++};
++
++#define BFQ_BFQQ_FNS(name)						\
++static inline void bfq_mark_bfqq_##name(struct bfq_queue *bfqq)		\
++{									\
++	(bfqq)->flags |= (1 << BFQ_BFQQ_FLAG_##name);			\
++}									\
++static inline void bfq_clear_bfqq_##name(struct bfq_queue *bfqq)	\
++{									\
++	(bfqq)->flags &= ~(1 << BFQ_BFQQ_FLAG_##name);			\
++}									\
++static inline int bfq_bfqq_##name(const struct bfq_queue *bfqq)		\
++{									\
++	return ((bfqq)->flags & (1 << BFQ_BFQQ_FLAG_##name)) != 0;	\
++}
++
++BFQ_BFQQ_FNS(busy);
++BFQ_BFQQ_FNS(wait_request);
++BFQ_BFQQ_FNS(must_alloc);
++BFQ_BFQQ_FNS(fifo_expire);
++BFQ_BFQQ_FNS(idle_window);
++BFQ_BFQQ_FNS(prio_changed);
++BFQ_BFQQ_FNS(sync);
++BFQ_BFQQ_FNS(budget_new);
++BFQ_BFQQ_FNS(coop);
++BFQ_BFQQ_FNS(split_coop);
++BFQ_BFQQ_FNS(some_coop_idle);
++#undef BFQ_BFQQ_FNS
++
++/* Logging facilities. */
++#define bfq_log_bfqq(bfqd, bfqq, fmt, args...) \
++	blk_add_trace_msg((bfqd)->queue, "bfq%d " fmt, (bfqq)->pid, ##args)
++
++#define bfq_log(bfqd, fmt, args...) \
++	blk_add_trace_msg((bfqd)->queue, "bfq " fmt, ##args)
++
++/* Expiration reasons. */
++enum bfqq_expiration {
++	BFQ_BFQQ_TOO_IDLE = 0,		/* queue has been idling for too long */
++	BFQ_BFQQ_BUDGET_TIMEOUT,	/* budget took too long to be used */
++	BFQ_BFQQ_BUDGET_EXHAUSTED,	/* budget consumed */
++	BFQ_BFQQ_NO_MORE_REQUESTS,	/* the queue has no more requests */
++};
++
++#ifdef CONFIG_CGROUP_BFQIO
++/**
++ * struct bfq_group - per (device, cgroup) data structure.
++ * @entity: schedulable entity to insert into the parent group sched_data.
++ * @sched_data: own sched_data, to contain child entities (they may be
++ *              both bfq_queues and bfq_groups).
++ * @group_node: node to be inserted into the bfqio_cgroup->group_data
++ *              list of the containing cgroup's bfqio_cgroup.
++ * @bfqd_node: node to be inserted into the @bfqd->group_list list
++ *             of the groups active on the same device; used for cleanup.
++ * @bfqd: the bfq_data for the device this group acts upon.
++ * @async_bfqq: array of async queues for all the tasks belonging to
++ *              the group, one queue per ioprio value per ioprio_class,
++ *              except for the idle class that has only one queue.
++ * @async_idle_bfqq: async queue for the idle class (ioprio is ignored).
++ * @my_entity: pointer to @entity, %NULL for the toplevel group; used
++ *             to avoid too many special cases during group creation/migration.
++ *
++ * Each (device, cgroup) pair has its own bfq_group, i.e., for each cgroup
++ * there is a set of bfq_groups, each one collecting the lower-level
++ * entities belonging to the group that are acting on the same device.
++ *
++ * Locking works as follows:
++ *    o @group_node is protected by the bfqio_cgroup lock, and is accessed
++ *      via RCU from its readers.
++ *    o @bfqd is protected by the queue lock, RCU is used to access it
++ *      from the readers.
++ *    o All the other fields are protected by the @bfqd queue lock.
++ */
++struct bfq_group {
++	struct bfq_entity entity;
++	struct bfq_sched_data sched_data;
++
++	struct hlist_node group_node;
++	struct hlist_node bfqd_node;
++
++	void *bfqd;
++
++	struct bfq_queue *async_bfqq[2][IOPRIO_BE_NR];
++	struct bfq_queue *async_idle_bfqq;
++
++	struct bfq_entity *my_entity;
++};
++
++/**
++ * struct bfqio_cgroup - bfq cgroup data structure.
++ * @css: subsystem state for bfq in the containing cgroup.
++ * @weight: cgroup weight.
++ * @ioprio: cgroup ioprio.
++ * @ioprio_class: cgroup ioprio_class.
++ * @lock: spinlock that protects @ioprio, @ioprio_class and @group_data.
++ * @group_data: list containing the bfq_group belonging to this cgroup.
++ *
++ * @group_data is accessed using RCU, with @lock protecting the updates,
++ * @ioprio and @ioprio_class are protected by @lock.
++ */
++struct bfqio_cgroup {
++	struct cgroup_subsys_state css;
++
++	unsigned short weight, ioprio, ioprio_class;
++
++	spinlock_t lock;
++	struct hlist_head group_data;
++};
++#else
++struct bfq_group {
++	struct bfq_sched_data sched_data;
++
++	struct bfq_queue *async_bfqq[2][IOPRIO_BE_NR];
++	struct bfq_queue *async_idle_bfqq;
++};
++#endif
++
++static inline struct bfq_service_tree *
++bfq_entity_service_tree(struct bfq_entity *entity)
++{
++	struct bfq_sched_data *sched_data = entity->sched_data;
++	unsigned int idx = entity->ioprio_class - 1;
++
++	BUG_ON(idx >= BFQ_IOPRIO_CLASSES);
++	BUG_ON(sched_data == NULL);
++
++	return sched_data->service_tree + idx;
++}
++
++static inline struct bfq_queue *bic_to_bfqq(struct bfq_io_cq *bic,
++					    int is_sync)
++{
++	return bic->bfqq[!!is_sync];
++}
++
++static inline void bic_set_bfqq(struct bfq_io_cq *bic,
++				struct bfq_queue *bfqq, int is_sync)
++{
++	bic->bfqq[!!is_sync] = bfqq;
++}
++
++static inline struct bfq_data *bic_to_bfqd(struct bfq_io_cq *bic)
++{
++	return bic->icq.q->elevator->elevator_data;
++}
++
++/**
++ * bfq_get_bfqd_locked - get a lock to a bfqd using a RCU protected pointer.
++ * @ptr: a pointer to a bfqd.
++ * @flags: storage for the flags to be saved.
++ *
++ * This function allows bfqg->bfqd to be protected by the
++ * queue lock of the bfqd they reference; the pointer is dereferenced
++ * under RCU, so the storage for bfqd is assured to be safe as long
++ * as the RCU read side critical section does not end.  After the
++ * bfqd->queue->queue_lock is taken the pointer is rechecked, to be
++ * sure that no other writer accessed it.  If we raced with a writer,
++ * the function returns NULL, with the queue unlocked, otherwise it
++ * returns the dereferenced pointer, with the queue locked.
++ */
++static inline struct bfq_data *bfq_get_bfqd_locked(void **ptr,
++						   unsigned long *flags)
++{
++	struct bfq_data *bfqd;
++
++	rcu_read_lock();
++	bfqd = rcu_dereference(*(struct bfq_data **)ptr);
++
++	if (bfqd != NULL) {
++		spin_lock_irqsave(bfqd->queue->queue_lock, *flags);
++		if (*ptr == bfqd)
++			goto out;
++		spin_unlock_irqrestore(bfqd->queue->queue_lock, *flags);
++	}
++
++	bfqd = NULL;
++out:
++	rcu_read_unlock();
++	return bfqd;
++}
++
++static inline void bfq_put_bfqd_unlock(struct bfq_data *bfqd,
++				       unsigned long *flags)
++{
++	spin_unlock_irqrestore(bfqd->queue->queue_lock, *flags);
++}
++
++static void bfq_changed_ioprio(struct bfq_io_cq *bic);
++static void bfq_put_queue(struct bfq_queue *bfqq);
++static void bfq_dispatch_insert(struct request_queue *q, struct request *rq);
++static struct bfq_queue *bfq_get_queue(struct bfq_data *bfqd,
++				       struct bfq_group *bfqg, int is_sync,
++				       struct bfq_io_cq *bic, gfp_t gfp_mask);
++static void bfq_end_raising_async_queues(struct bfq_data *bfqd,
++					 struct bfq_group *bfqg);
++static void bfq_put_async_queues(struct bfq_data *bfqd, struct bfq_group *bfqg);
++static void bfq_exit_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq);
++#endif
+diff --git a/include/linux/cgroup_subsys.h b/include/linux/cgroup_subsys.h
+index ffa1d1f..e5e6b0d 100644
+--- a/include/linux/cgroup_subsys.h
++++ b/include/linux/cgroup_subsys.h
+@@ -85,7 +85,7 @@ SUBSYS(bcache)
+ 
+ /* */
+ 
+-#ifdef CONFIG_CGROUP_BFQIO
++#if IS_SUBSYS_ENABLED(CONFIG_CGROUP_BFQIO)
+ SUBSYS(bfqio)
+ #endif
+ 
+-- 
+1.8.1.4
+

Added: genpatches-2.6/trunk/3.10.7/1803_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v6r2-for-3.10.0.patch1
===================================================================
--- genpatches-2.6/trunk/3.10.7/1803_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v6r2-for-3.10.0.patch1	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/1803_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v6r2-for-3.10.0.patch1	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,1049 @@
+From 9204dcb026a40cd2cb4310fecf788924d0fbec8d Mon Sep 17 00:00:00 2001
+From: Mauro Andreolini <mauro.andreolini@×××××××.it>
+Date: Fri, 14 Jun 2013 13:46:47 +0200
+Subject: [PATCH 3/3] block, bfq: add Early Queue Merge (EQM) to BFQ-v6r2 for
+ 3.10.0
+
+A set of processes may happen  to  perform interleaved reads, i.e., requests
+whose union would give rise to a  sequential read  pattern.  There   are two
+typical  cases: in the first  case,   processes  read  fixed-size  chunks of
+data at a fixed distance from each other, while in the second case processes
+may read variable-size chunks at  variable distances. The latter case occurs
+for  example with  KVM, which  splits the  I/O generated  by the  guest into
+multiple chunks,  and lets these chunks  be served by a  pool of cooperating
+processes,  iteratively  assigning  the  next  chunk of  I/O  to  the  first
+available  process. CFQ  uses actual  queue merging  for the  first type  of
+processes, whereas it  uses preemption to get a sequential  read pattern out
+of the read requests  performed by the second type of  processes. In the end
+it uses  two different  mechanisms to  achieve the  same goal:  boosting the
+throughput with interleaved I/O.
+
+This patch introduces  Early Queue Merge (EQM), a unified mechanism to get a
+sequential  read pattern  with both  types of  processes. The  main idea  is
+checking newly arrived requests against the next request of the active queue
+both in case of actual request insert and in case of request merge. By doing
+so, both the types of processes can be handled by just merging their queues.
+EQM is  then simpler and  more compact than the  pair of mechanisms  used in
+CFQ.
+
+Finally, EQM  also preserves the  typical low-latency properties of  BFQ, by
+properly restoring the weight-raising state of  a queue when it gets back to
+a non-merged state.
+
+Signed-off-by: Mauro Andreolini <mauro.andreolini@×××××××.it>
+Signed-off-by: Arianna Avanzini <avanzini.arianna@×××××.com>
+Reviewed-by: Paolo Valente <paolo.valente@×××××××.it>
+---
+ block/bfq-iosched.c | 653 ++++++++++++++++++++++++++++++++++++----------------
+ block/bfq-sched.c   |  28 ---
+ block/bfq.h         |  16 ++
+ 3 files changed, 466 insertions(+), 231 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index b230927..bc57923 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -444,6 +444,43 @@ static inline unsigned int bfq_wrais_duration(struct bfq_data *bfqd)
+ 	return dur;
+ }
+ 
++static inline void
++bfq_bfqq_resume_state(struct bfq_queue *bfqq, struct bfq_io_cq *bic)
++{
++	if (bic->saved_idle_window)
++		bfq_mark_bfqq_idle_window(bfqq);
++	else
++		bfq_clear_bfqq_idle_window(bfqq);
++	if (bic->raising_time_left && bfqq->bfqd->low_latency) {
++		/*
++		 * Start a weight raising period with the duration given by
++		 * the raising_time_left snapshot.
++		 */
++		bfqq->raising_coeff = bfqq->bfqd->bfq_raising_coeff;
++		bfqq->raising_cur_max_time = bic->raising_time_left;
++		bfqq->last_rais_start_finish = jiffies;
++	}
++	/*
++	 * Clear raising_time_left to prevent bfq_bfqq_save_state() from
++	 * getting confused about the queue's need of a weight-raising
++	 * period.
++	 */
++	bic->raising_time_left = 0;
++}
++
++/*
++ * Must be called with the queue_lock held.
++ */
++static int bfqq_process_refs(struct bfq_queue *bfqq)
++{
++	int process_refs, io_refs;
++
++	io_refs = bfqq->allocated[READ] + bfqq->allocated[WRITE];
++	process_refs = atomic_read(&bfqq->ref) - io_refs - bfqq->entity.on_st;
++	BUG_ON(process_refs < 0);
++	return process_refs;
++}
++
+ static void bfq_add_rq_rb(struct request *rq)
+ {
+ 	struct bfq_queue *bfqq = RQ_BFQQ(rq);
+@@ -483,11 +520,20 @@ static void bfq_add_rq_rb(struct request *rq)
+ 		if (! bfqd->low_latency)
+ 			goto add_bfqq_busy;
+ 
++		if (bfq_bfqq_just_split(bfqq))
++			goto set_ioprio_changed;
++
+ 		/*
+-		 * If the queue is not being boosted and has been idle
+-		 * for enough time, start a weight-raising period
++		 * If the queue:
++		 * - is not being boosted,
++		 * - has been idle for enough time,
++		 * - is not a sync queue or is linked to a bfq_io_cq (it is
++		 *   shared "for its nature" or it is not shared and its
++		 *   requests have not been redirected to a shared queue)
++		 * start a weight-raising period.
+ 		 */
+-		if(old_raising_coeff == 1 && (idle_for_long_time || soft_rt)) {
++		if(old_raising_coeff == 1 && (idle_for_long_time || soft_rt) &&
++		   (!bfq_bfqq_sync(bfqq) || bfqq->bic != NULL)) {
+ 			bfqq->raising_coeff = bfqd->bfq_raising_coeff;
+ 			if (idle_for_long_time)
+ 				bfqq->raising_cur_max_time =
+@@ -517,6 +563,7 @@ static void bfq_add_rq_rb(struct request *rq)
+ 						raising_cur_max_time));
+ 				}
+ 		}
++set_ioprio_changed:
+ 		if (old_raising_coeff != bfqq->raising_coeff)
+ 			entity->ioprio_changed = 1;
+ add_bfqq_busy:
+@@ -695,89 +742,35 @@ static void bfq_end_raising(struct bfq_data *bfqd)
+ 	spin_unlock_irq(bfqd->queue->queue_lock);
+ }
+ 
+-static int bfq_allow_merge(struct request_queue *q, struct request *rq,
+-			   struct bio *bio)
++static inline sector_t bfq_io_struct_pos(void *io_struct, bool request)
+ {
+-	struct bfq_data *bfqd = q->elevator->elevator_data;
+-	struct bfq_io_cq *bic;
+-	struct bfq_queue *bfqq;
+-
+-	/*
+-	 * Disallow merge of a sync bio into an async request.
+-	 */
+-	if (bfq_bio_sync(bio) && !rq_is_sync(rq))
+-		return 0;
+-
+-	/*
+-	 * Lookup the bfqq that this bio will be queued with. Allow
+-	 * merge only if rq is queued there.
+-	 * Queue lock is held here.
+-	 */
+-	bic = bfq_bic_lookup(bfqd, current->io_context);
+-	if (bic == NULL)
+-		return 0;
+-
+-	bfqq = bic_to_bfqq(bic, bfq_bio_sync(bio));
+-	return bfqq == RQ_BFQQ(rq);
+-}
+-
+-static void __bfq_set_active_queue(struct bfq_data *bfqd,
+-				   struct bfq_queue *bfqq)
+-{
+-	if (bfqq != NULL) {
+-		bfq_mark_bfqq_must_alloc(bfqq);
+-		bfq_mark_bfqq_budget_new(bfqq);
+-		bfq_clear_bfqq_fifo_expire(bfqq);
+-
+-		bfqd->budgets_assigned = (bfqd->budgets_assigned*7 + 256) / 8;
+-
+-		bfq_log_bfqq(bfqd, bfqq, "set_active_queue, cur-budget = %lu",
+-			     bfqq->entity.budget);
+-	}
+-
+-	bfqd->active_queue = bfqq;
+-}
+-
+-/*
+- * Get and set a new active queue for service.
+- */
+-static struct bfq_queue *bfq_set_active_queue(struct bfq_data *bfqd,
+-					      struct bfq_queue *bfqq)
+-{
+-	if (!bfqq)
+-		bfqq = bfq_get_next_queue(bfqd);
++	if (request)
++		return blk_rq_pos(io_struct);
+ 	else
+-		bfq_get_next_queue_forced(bfqd, bfqq);
+-
+-	__bfq_set_active_queue(bfqd, bfqq);
+-	return bfqq;
++		return ((struct bio *)io_struct)->bi_sector;
+ }
+ 
+-static inline sector_t bfq_dist_from_last(struct bfq_data *bfqd,
+-					  struct request *rq)
++static inline sector_t bfq_dist_from(sector_t pos1,
++				     sector_t pos2)
+ {
+-	if (blk_rq_pos(rq) >= bfqd->last_position)
+-		return blk_rq_pos(rq) - bfqd->last_position;
++	if (pos1 >= pos2)
++		return pos1 - pos2;
+ 	else
+-		return bfqd->last_position - blk_rq_pos(rq);
++		return pos2 - pos1;
+ }
+ 
+-/*
+- * Return true if bfqq has no request pending and rq is close enough to
+- * bfqd->last_position, or if rq is closer to bfqd->last_position than
+- * bfqq->next_rq
+- */
+-static inline int bfq_rq_close(struct bfq_data *bfqd, struct request *rq)
++static inline int bfq_rq_close_to_sector(void *io_struct, bool request,
++					 sector_t sector)
+ {
+-	return bfq_dist_from_last(bfqd, rq) <= BFQQ_SEEK_THR;
++	return bfq_dist_from(bfq_io_struct_pos(io_struct, request), sector) <=
++	       BFQQ_SEEK_THR;
+ }
+ 
+-static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
++static struct bfq_queue *bfqq_close(struct bfq_data *bfqd, sector_t sector)
+ {
+ 	struct rb_root *root = &bfqd->rq_pos_tree;
+ 	struct rb_node *parent, *node;
+ 	struct bfq_queue *__bfqq;
+-	sector_t sector = bfqd->last_position;
+ 
+ 	if (RB_EMPTY_ROOT(root))
+ 		return NULL;
+@@ -796,7 +789,7 @@ static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
+ 	 * position).
+ 	 */
+ 	__bfqq = rb_entry(parent, struct bfq_queue, pos_node);
+-	if (bfq_rq_close(bfqd, __bfqq->next_rq))
++	if (bfq_rq_close_to_sector(__bfqq->next_rq, true, sector))
+ 		return __bfqq;
+ 
+ 	if (blk_rq_pos(__bfqq->next_rq) < sector)
+@@ -807,7 +800,7 @@ static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
+ 		return NULL;
+ 
+ 	__bfqq = rb_entry(node, struct bfq_queue, pos_node);
+-	if (bfq_rq_close(bfqd, __bfqq->next_rq))
++	if (bfq_rq_close_to_sector(__bfqq->next_rq, true, sector))
+ 		return __bfqq;
+ 
+ 	return NULL;
+@@ -816,14 +809,12 @@ static struct bfq_queue *bfqq_close(struct bfq_data *bfqd)
+ /*
+  * bfqd - obvious
+  * cur_bfqq - passed in so that we don't decide that the current queue
+- *            is closely cooperating with itself.
+- *
+- * We are assuming that cur_bfqq has dispatched at least one request,
+- * and that bfqd->last_position reflects a position on the disk associated
+- * with the I/O issued by cur_bfqq.
++ *            is closely cooperating with itself
++ * sector - used as a reference point to search for a close queue
+  */
+ static struct bfq_queue *bfq_close_cooperator(struct bfq_data *bfqd,
+-					      struct bfq_queue *cur_bfqq)
++					      struct bfq_queue *cur_bfqq,
++					      sector_t sector)
+ {
+ 	struct bfq_queue *bfqq;
+ 
+@@ -843,7 +834,7 @@ static struct bfq_queue *bfq_close_cooperator(struct bfq_data *bfqd,
+ 	 * working closely on the same area of the disk. In that case,
+ 	 * we can group them together and don't waste time idling.
+ 	 */
+-	bfqq = bfqq_close(bfqd);
++	bfqq = bfqq_close(bfqd, sector);
+ 	if (bfqq == NULL || bfqq == cur_bfqq)
+ 		return NULL;
+ 
+@@ -870,6 +861,275 @@ static struct bfq_queue *bfq_close_cooperator(struct bfq_data *bfqd,
+ 	return bfqq;
+ }
+ 
++static struct bfq_queue *
++bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
++{
++	int process_refs, new_process_refs;
++	struct bfq_queue *__bfqq;
++
++	/*
++	 * If there are no process references on the new_bfqq, then it is
++	 * unsafe to follow the ->new_bfqq chain as other bfqq's in the chain
++	 * may have dropped their last reference (not just their last process
++	 * reference).
++	 */
++	if (!bfqq_process_refs(new_bfqq))
++		return NULL;
++
++	/* Avoid a circular list and skip interim queue merges. */
++	while ((__bfqq = new_bfqq->new_bfqq)) {
++		if (__bfqq == bfqq)
++			return NULL;
++		new_bfqq = __bfqq;
++	}
++
++	process_refs = bfqq_process_refs(bfqq);
++	new_process_refs = bfqq_process_refs(new_bfqq);
++	/*
++	 * If the process for the bfqq has gone away, there is no
++	 * sense in merging the queues.
++	 */
++	if (process_refs == 0 || new_process_refs == 0)
++		return NULL;
++
++	bfq_log_bfqq(bfqq->bfqd, bfqq, "scheduling merge with queue %d",
++		new_bfqq->pid);
++
++	/*
++	 * Merging is just a redirection: the requests of the process owning
++	 * one of the two queues are redirected to the other queue. The latter
++	 * queue, in its turn, is set as shared if this is the first time that
++	 * the requests of some process are redirected to it.
++	 *
++	 * We redirect bfqq to new_bfqq and not the opposite, because we
++	 * are in the context of the process owning bfqq, hence we have the
++	 * io_cq of this process. So we can immediately configure this io_cq
++	 * to redirect the requests of the process to new_bfqq.
++	 *
++	 * NOTE, even if new_bfqq coincides with the active queue, the io_cq of
++	 * new_bfqq is not available, because, if the active queue is shared,
++	 * bfqd->active_bic may not point to the io_cq of the active queue.
++	 * Redirecting the requests of the process owning bfqq to the currently
++	 * active queue is in any case the best option, as we feed the active queue
++	 * with new requests close to the last request served and, by doing so,
++	 * hopefully increase the throughput.
++	 */
++	bfqq->new_bfqq = new_bfqq;
++	atomic_add(process_refs, &new_bfqq->ref);
++	return new_bfqq;
++}
++
++/*
++ * Attempt to schedule a merge of bfqq with the currently active queue or
++ * with a close queue among the scheduled queues.
++ * Return NULL if no merge was scheduled, a pointer to the shared bfq_queue
++ * structure otherwise.
++ */
++static struct bfq_queue *
++bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
++		     void *io_struct, bool request)
++{
++	struct bfq_queue *active_bfqq, *new_bfqq;
++
++	if (bfqq->new_bfqq)
++		return bfqq->new_bfqq;
++
++	if (!io_struct)
++		return NULL;
++
++	active_bfqq = bfqd->active_queue;
++
++	if (active_bfqq == NULL || active_bfqq == bfqq || !bfqd->active_bic)
++		goto check_scheduled;
++
++	if (bfq_class_idle(active_bfqq) || bfq_class_idle(bfqq))
++		goto check_scheduled;
++
++	if (bfq_class_rt(active_bfqq) != bfq_class_rt(bfqq))
++		goto check_scheduled;
++
++	if (active_bfqq->entity.parent != bfqq->entity.parent)
++		goto check_scheduled;
++
++	if (bfq_rq_close_to_sector(io_struct, request, bfqd->last_position) &&
++	    bfq_bfqq_sync(active_bfqq) && bfq_bfqq_sync(bfqq))
++		if ((new_bfqq = bfq_setup_merge(bfqq, active_bfqq)))
++			return new_bfqq; /* Merge with the active queue */
++
++	/*
++	 * Check whether there is a cooperator among currently scheduled
++	 * queues. The only thing we need is that the bio/request is not
++	 * NULL, as we need it to establish whether a cooperator exists.
++	 */
++check_scheduled:
++	new_bfqq = bfq_close_cooperator(bfqd, bfqq,
++					bfq_io_struct_pos(io_struct, request));
++	if (new_bfqq)
++		return bfq_setup_merge(bfqq, new_bfqq);
++
++	return NULL;
++}
++
++static inline void
++bfq_bfqq_save_state(struct bfq_queue *bfqq)
++{
++	/*
++	 * If bfqq->bic == NULL, the queue is already shared or its requests
++	 * have already been redirected to a shared queue; both idle window
++	 * and weight raising state have already been saved. Do nothing.
++	 */
++	if (bfqq->bic == NULL)
++		return;
++	if (bfqq->bic->raising_time_left)
++		/*
++		 * This is the queue of a just-started process, and would
++		 * deserve weight raising: we set raising_time_left to the full
++		 * weight-raising duration to trigger weight-raising when and
++		 * if the queue is split and the first request of the queue
++		 * is enqueued.
++		 */
++		bfqq->bic->raising_time_left = bfq_wrais_duration(bfqq->bfqd);
++	else if (bfqq->raising_coeff > 1) {
++		unsigned long wrais_duration =
++			jiffies - bfqq->last_rais_start_finish;
++		/*
++		 * It may happen that a queue's weight raising period lasts
++		 * longer than its raising_cur_max_time, as weight raising is
++		 * handled only when a request is enqueued or dispatched (it
++		 * does not use any timer). If the weight raising period is
++		 * about to end, don't save it.
++		 */
++		if (bfqq->raising_cur_max_time <= wrais_duration)
++			bfqq->bic->raising_time_left = 0;
++		else
++			bfqq->bic->raising_time_left =
++				bfqq->raising_cur_max_time - wrais_duration;
++		/*
++		 * The bfq_queue is becoming shared or the requests of the
++		 * process owning the queue are being redirected to a shared
++		 * queue. Stop the weight raising period of the queue, as in
++		 * both cases it should not be owned by an interactive or soft
++		 * real-time application.
++		 */
++		bfq_bfqq_end_raising(bfqq);
++	} else
++		bfqq->bic->raising_time_left = 0;
++	bfqq->bic->saved_idle_window = bfq_bfqq_idle_window(bfqq);
++}
++
++static inline void
++bfq_get_bic_reference(struct bfq_queue *bfqq)
++{
++	/*
++	 * If bfqq->bic has a non-NULL value, the bic to which it belongs
++	 * is about to begin using a shared bfq_queue.
++	 */
++	if (bfqq->bic)
++		atomic_long_inc(&bfqq->bic->icq.ioc->refcount);
++}
++
++static void
++bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic,
++                struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
++{
++        bfq_log_bfqq(bfqd, bfqq, "merging with queue %lu",
++		(long unsigned)new_bfqq->pid);
++	/* Save weight raising and idle window of the merged queues */
++	bfq_bfqq_save_state(bfqq);
++	bfq_bfqq_save_state(new_bfqq);
++	/*
++	 * Grab a reference to the bic, to prevent it from being destroyed
++	 * before being possibly touched by a bfq_split_bfqq().
++	 */
++	bfq_get_bic_reference(bfqq);
++	bfq_get_bic_reference(new_bfqq);
++	/* Merge queues (that is, let bic redirect its requests to new_bfqq) */
++        bic_set_bfqq(bic, new_bfqq, 1);
++        bfq_mark_bfqq_coop(new_bfqq);
++	/*
++	 * new_bfqq now belongs to at least two bics (it is a shared queue): set
++	 * new_bfqq->bic to NULL. bfqq either:
++	 * - does not belong to any bic any more, and hence bfqq->bic must
++	 *   be set to NULL, or
++	 * - is a queue whose owning bics have already been redirected to a
++	 *   different queue, hence the queue is destined to not belong to any
++	 *   bic soon and bfqq->bic is already NULL (therefore the next
++	 *   assignment causes no harm).
++	 */
++	new_bfqq->bic = NULL;
++	bfqq->bic = NULL;
++        bfq_put_queue(bfqq);
++}
++
++static int bfq_allow_merge(struct request_queue *q, struct request *rq,
++			   struct bio *bio)
++{
++	struct bfq_data *bfqd = q->elevator->elevator_data;
++	struct bfq_io_cq *bic;
++	struct bfq_queue *bfqq, *new_bfqq;
++
++	/*
++	 * Disallow merge of a sync bio into an async request.
++	 */
++	if (bfq_bio_sync(bio) && !rq_is_sync(rq))
++		return 0;
++
++	/*
++	 * Lookup the bfqq that this bio will be queued with. Allow
++	 * merge only if rq is queued there.
++	 * Queue lock is held here.
++	 */
++	bic = bfq_bic_lookup(bfqd, current->io_context);
++	if (bic == NULL)
++		return 0;
++
++	bfqq = bic_to_bfqq(bic, bfq_bio_sync(bio));
++	/*
++	 * We take advantage of this function to perform an early merge
++	 * of the queues of possible cooperating processes.
++	 */
++	if (bfqq != NULL &&
++	    (new_bfqq = bfq_setup_cooperator(bfqd, bfqq, bio, false))) {
++		bfq_merge_bfqqs(bfqd, bic, bfqq, new_bfqq);
++		/*
++		 * If we get here, the bio will be queued in the shared queue,
++		 * i.e., new_bfqq, so use new_bfqq to decide whether bio and
++		 * rq can be merged.
++		 */
++		bfqq = new_bfqq;
++	}
++
++	return bfqq == RQ_BFQQ(rq);
++}
++
++static void __bfq_set_active_queue(struct bfq_data *bfqd,
++				   struct bfq_queue *bfqq)
++{
++	if (bfqq != NULL) {
++		bfq_mark_bfqq_must_alloc(bfqq);
++		bfq_mark_bfqq_budget_new(bfqq);
++		bfq_clear_bfqq_fifo_expire(bfqq);
++
++		bfqd->budgets_assigned = (bfqd->budgets_assigned*7 + 256) / 8;
++
++		bfq_log_bfqq(bfqd, bfqq, "set_active_queue, cur-budget = %lu",
++			     bfqq->entity.budget);
++	}
++
++	bfqd->active_queue = bfqq;
++}
++
++/*
++ * Get and set a new active queue for service.
++ */
++static struct bfq_queue *bfq_set_active_queue(struct bfq_data *bfqd)
++{
++	struct bfq_queue *bfqq = bfq_get_next_queue(bfqd);
++
++	__bfq_set_active_queue(bfqd, bfqq);
++	return bfqq;
++}
++
+ /*
+  * If enough samples have been computed, return the current max budget
+  * stored in bfqd, which is dynamically updated according to the
+@@ -1017,63 +1277,6 @@ static struct request *bfq_check_fifo(struct bfq_queue *bfqq)
+ 	return rq;
+ }
+ 
+-/*
+- * Must be called with the queue_lock held.
+- */
+-static int bfqq_process_refs(struct bfq_queue *bfqq)
+-{
+-	int process_refs, io_refs;
+-
+-	io_refs = bfqq->allocated[READ] + bfqq->allocated[WRITE];
+-	process_refs = atomic_read(&bfqq->ref) - io_refs - bfqq->entity.on_st;
+-	BUG_ON(process_refs < 0);
+-	return process_refs;
+-}
+-
+-static void bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
+-{
+-	int process_refs, new_process_refs;
+-	struct bfq_queue *__bfqq;
+-
+-	/*
+-	 * If there are no process references on the new_bfqq, then it is
+-	 * unsafe to follow the ->new_bfqq chain as other bfqq's in the chain
+-	 * may have dropped their last reference (not just their last process
+-	 * reference).
+-	 */
+-	if (!bfqq_process_refs(new_bfqq))
+-		return;
+-
+-	/* Avoid a circular list and skip interim queue merges. */
+-	while ((__bfqq = new_bfqq->new_bfqq)) {
+-		if (__bfqq == bfqq)
+-			return;
+-		new_bfqq = __bfqq;
+-	}
+-
+-	process_refs = bfqq_process_refs(bfqq);
+-	new_process_refs = bfqq_process_refs(new_bfqq);
+-	/*
+-	 * If the process for the bfqq has gone away, there is no
+-	 * sense in merging the queues.
+-	 */
+-	if (process_refs == 0 || new_process_refs == 0)
+-		return;
+-
+-	/*
+-	 * Merge in the direction of the lesser amount of work.
+-	 */
+-	if (new_process_refs >= process_refs) {
+-		bfqq->new_bfqq = new_bfqq;
+-		atomic_add(process_refs, &new_bfqq->ref);
+-	} else {
+-		new_bfqq->new_bfqq = bfqq;
+-		atomic_add(new_process_refs, &bfqq->ref);
+-	}
+-	bfq_log_bfqq(bfqq->bfqd, bfqq, "scheduling merge with queue %d",
+-		new_bfqq->pid);
+-}
+-
+ static inline unsigned long bfq_bfqq_budget_left(struct bfq_queue *bfqq)
+ {
+ 	struct bfq_entity *entity = &bfqq->entity;
+@@ -1493,6 +1696,14 @@ static inline int bfq_may_expire_for_budg_timeout(struct bfq_queue *bfqq)
+  *   is likely to boost the disk throughput);
+  * - the queue is weight-raised (waiting for the request is necessary for
+  *   providing the queue with fairness and latency guarantees).
++ *
++ * In any case, idling can be disabled for cooperation issues, if
++ * 1) there is a close cooperator for the queue, or
++ * 2) the queue is shared and some cooperator is likely to be idle (in this
++ *    case, by not arming the idle timer, we try to slow down the queue, to
++ *    prevent the zones of the disk accessed by the active cooperators to
++ *    become too distant from the zone that will be accessed by the currently
++ *    idle cooperators).
+  */
+ static inline bool bfq_bfqq_must_idle(struct bfq_queue *bfqq,
+ 				      int budg_timeout)
+@@ -1507,7 +1718,7 @@ static inline bool bfq_bfqq_must_idle(struct bfq_queue *bfqq,
+ 		(bfqd->rq_in_driver == 0 ||
+ 				budg_timeout ||
+                                 bfqq->raising_coeff > 1) &&
+-                !bfq_close_cooperator(bfqd, bfqq) &&
++                !bfq_close_cooperator(bfqd, bfqq, bfqd->last_position) &&
+                 (!bfq_bfqq_coop(bfqq) ||
+ 			!bfq_bfqq_some_coop_idle(bfqq)) &&
+ 		!bfq_queue_nonrot_noidle(bfqd, bfqq));
+@@ -1519,7 +1730,7 @@ static inline bool bfq_bfqq_must_idle(struct bfq_queue *bfqq,
+  */
+ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
+ {
+-	struct bfq_queue *bfqq, *new_bfqq = NULL;
++	struct bfq_queue *bfqq;
+ 	struct request *next_rq;
+ 	enum bfqq_expiration reason = BFQ_BFQQ_BUDGET_TIMEOUT;
+ 	int budg_timeout;
+@@ -1530,17 +1741,6 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
+ 
+ 	bfq_log_bfqq(bfqd, bfqq, "select_queue: already active queue");
+ 
+-	/*
+-         * If another queue has a request waiting within our mean seek
+-         * distance, let it run. The expire code will check for close
+-         * cooperators and put the close queue at the front of the
+-         * service tree. If possible, merge the expiring queue with the
+-         * new bfqq.
+-         */
+-        new_bfqq = bfq_close_cooperator(bfqd, bfqq);
+-        if (new_bfqq != NULL && bfqq->new_bfqq == NULL)
+-                bfq_setup_merge(bfqq, new_bfqq);
+-
+ 	budg_timeout = bfq_may_expire_for_budg_timeout(bfqq);
+ 	if (budg_timeout &&
+ 	    !bfq_bfqq_must_idle(bfqq, budg_timeout))
+@@ -1577,10 +1777,7 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
+ 				bfq_clear_bfqq_wait_request(bfqq);
+ 				del_timer(&bfqd->idle_slice_timer);
+ 			}
+-			if (new_bfqq == NULL)
+-				goto keep_queue;
+-			else
+-				goto expire;
++			goto keep_queue;
+ 		}
+ 	}
+ 
+@@ -1589,26 +1786,19 @@ static struct bfq_queue *bfq_select_queue(struct bfq_data *bfqd)
+ 	 * queue still has requests in flight or is idling for a new request,
+ 	 * then keep it.
+ 	 */
+-	if (new_bfqq == NULL && (timer_pending(&bfqd->idle_slice_timer) ||
++	if (timer_pending(&bfqd->idle_slice_timer) ||
+ 	    (bfqq->dispatched != 0 &&
+ 	     (bfq_bfqq_idle_window(bfqq) || bfqq->raising_coeff > 1) &&
+-	     !bfq_queue_nonrot_noidle(bfqd, bfqq)))) {
++	     !bfq_queue_nonrot_noidle(bfqd, bfqq))) {
+ 		bfqq = NULL;
+ 		goto keep_queue;
+-	} else if (new_bfqq != NULL && timer_pending(&bfqd->idle_slice_timer)) {
+-		/*
+-		 * Expiring the queue because there is a close cooperator,
+-		 * cancel timer.
+-		 */
+-		bfq_clear_bfqq_wait_request(bfqq);
+-		del_timer(&bfqd->idle_slice_timer);
+ 	}
+ 
+ 	reason = BFQ_BFQQ_NO_MORE_REQUESTS;
+ expire:
+ 	bfq_bfqq_expire(bfqd, bfqq, 0, reason);
+ new_queue:
+-	bfqq = bfq_set_active_queue(bfqd, new_bfqq);
++	bfqq = bfq_set_active_queue(bfqd);
+ 	bfq_log(bfqd, "select_queue: new queue %d returned",
+ 		bfqq != NULL ? bfqq->pid : 0);
+ keep_queue:
+@@ -1617,9 +1807,8 @@ keep_queue:
+ 
+ static void update_raising_data(struct bfq_data *bfqd, struct bfq_queue *bfqq)
+ {
++	struct bfq_entity *entity = &bfqq->entity;
+ 	if (bfqq->raising_coeff > 1) { /* queue is being boosted */
+-		struct bfq_entity *entity = &bfqq->entity;
+-
+ 		bfq_log_bfqq(bfqd, bfqq,
+ 			"raising period dur %u/%u msec, "
+ 			"old raising coeff %u, w %d(%d)",
+@@ -1656,12 +1845,14 @@ static void update_raising_data(struct bfq_data *bfqd, struct bfq_queue *bfqq)
+ 					     jiffies_to_msecs(bfqq->
+ 						raising_cur_max_time));
+ 				bfq_bfqq_end_raising(bfqq);
+-				__bfq_entity_update_weight_prio(
+-					bfq_entity_service_tree(entity),
+-					entity);
+ 			}
+ 		}
+ 	}
++	/* Update weight both if it must be raised and if it must be lowered */
++	if ((entity->weight > entity->orig_weight) != (bfqq->raising_coeff > 1))
++		__bfq_entity_update_weight_prio(
++			bfq_entity_service_tree(entity),
++			entity);
+ }
+ 
+ /*
+@@ -1901,6 +2092,25 @@ static void bfq_init_icq(struct io_cq *icq)
+ 	struct bfq_io_cq *bic = icq_to_bic(icq);
+ 
+ 	bic->ttime.last_end_request = jiffies;
++	/*
++	 * A newly created bic indicates that the process has just
++	 * started doing I/O, and is probably mapping into memory its
++	 * executable and libraries: it definitely needs weight raising.
++	 * There is however the possibility that the process performs,
++	 * for a while, I/O close to some other process. EQM intercepts
++	 * this behavior and may merge the queue corresponding to the
++	 * process  with some other queue, BEFORE the weight of the queue
++	 * is raised. Merged queues are not weight-raised (they are assumed
++	 * to belong to processes that benefit only from high throughput).
++	 * If the merge is basically the consequence of an accident, then
++	 * the queue will be split soon and will get back its old weight.
++	 * It is then important to write down somewhere that this queue
++	 * does need weight raising, even if it did not make it to get its
++	 * weight raised before being merged. To this purpose, we overload
++	 * the field raising_time_left and assign 1 to it, to mark the queue
++	 * as needing weight raising.
++	 */
++	bic->raising_time_left = 1;
+ }
+ 
+ static void bfq_exit_icq(struct io_cq *icq)
+@@ -1914,6 +2124,13 @@ static void bfq_exit_icq(struct io_cq *icq)
+ 	}
+ 
+ 	if (bic->bfqq[BLK_RW_SYNC]) {
++		/*
++		 * If the bic is using a shared queue, put the reference
++		 * taken on the io_context when the bic started using a
++		 * shared bfq_queue.
++		 */
++		if (bfq_bfqq_coop(bic->bfqq[BLK_RW_SYNC]))
++			put_io_context(icq->ioc);
+ 		bfq_exit_bfqq(bfqd, bic->bfqq[BLK_RW_SYNC]);
+ 		bic->bfqq[BLK_RW_SYNC] = NULL;
+ 	}
+@@ -2211,6 +2428,10 @@ static void bfq_update_idle_window(struct bfq_data *bfqd,
+ 	if (!bfq_bfqq_sync(bfqq) || bfq_class_idle(bfqq))
+ 		return;
+ 
++	/* Idle window just restored, statistics are meaningless. */
++	if (bfq_bfqq_just_split(bfqq))
++		return;
++
+ 	enable_idle = bfq_bfqq_idle_window(bfqq);
+ 
+ 	if (atomic_read(&bic->icq.ioc->active_ref) == 0 ||
+@@ -2251,6 +2472,7 @@ static void bfq_rq_enqueued(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ 	if (bfqq->entity.service > bfq_max_budget(bfqd) / 8 ||
+ 	    !BFQQ_SEEKY(bfqq))
+ 		bfq_update_idle_window(bfqd, bfqq, bic);
++	bfq_clear_bfqq_just_split(bfqq);
+ 
+ 	bfq_log_bfqq(bfqd, bfqq,
+ 		     "rq_enqueued: idle_window=%d (seeky %d, mean %llu)",
+@@ -2302,13 +2524,45 @@ static void bfq_rq_enqueued(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ static void bfq_insert_request(struct request_queue *q, struct request *rq)
+ {
+ 	struct bfq_data *bfqd = q->elevator->elevator_data;
+-	struct bfq_queue *bfqq = RQ_BFQQ(rq);
++	struct bfq_queue *bfqq = RQ_BFQQ(rq), *new_bfqq;
+ 
+ 	assert_spin_locked(bfqd->queue->queue_lock);
++
++	/*
++	 * An unplug may trigger a requeue of a request from the device
++	 * driver: make sure we are in process context while trying to
++	 * merge two bfq_queues.
++	 */
++	if (!in_interrupt() &&
++	    (new_bfqq = bfq_setup_cooperator(bfqd, bfqq, rq, true))) {
++		if (bic_to_bfqq(RQ_BIC(rq), 1) != bfqq)
++			new_bfqq = bic_to_bfqq(RQ_BIC(rq), 1);
++		/*
++		 * Release the request's reference to the old bfqq
++		 * and make sure one is taken to the shared queue.
++		 */
++		new_bfqq->allocated[rq_data_dir(rq)]++;
++		bfqq->allocated[rq_data_dir(rq)]--;
++		atomic_inc(&new_bfqq->ref);
++		bfq_put_queue(bfqq);
++		if (bic_to_bfqq(RQ_BIC(rq), 1) == bfqq)
++			bfq_merge_bfqqs(bfqd, RQ_BIC(rq), bfqq, new_bfqq);
++		rq->elv.priv[1] = new_bfqq;
++		bfqq = new_bfqq;
++	}
++
+ 	bfq_init_prio_data(bfqq, RQ_BIC(rq));
+ 
+ 	bfq_add_rq_rb(rq);
+ 
++	/*
++	 * Here a newly-created bfq_queue has already started a weight-raising
++	 * period: clear raising_time_left to prevent bfq_bfqq_save_state()
++	 * from assigning it a full weight-raising period. See the detailed
++	 * comments about this field in bfq_init_icq().
++	 */
++	if (bfqq->bic != NULL)
++		bfqq->bic->raising_time_left = 0;
+ 	rq_set_fifo_time(rq, jiffies + bfqd->bfq_fifo_expire[rq_is_sync(rq)]);
+ 	list_add_tail(&rq->queuelist, &bfqq->fifo);
+ 
+@@ -2371,15 +2625,6 @@ static void bfq_completed_request(struct request_queue *q, struct request *rq)
+ 		if (bfq_bfqq_budget_new(bfqq))
+ 			bfq_set_budget_timeout(bfqd);
+ 
+-		/* Idling is disabled also for cooperation issues:
+-		 * 1) there is a close cooperator for the queue, or
+-		 * 2) the queue is shared and some cooperator is likely
+-		 *    to be idle (in this case, by not arming the idle timer,
+-		 *    we try to slow down the queue, to prevent the zones
+-		 *    of the disk accessed by the active cooperators to become
+-		 *    too distant from the zone that will be accessed by the
+-		 *    currently idle cooperators)
+-		 */
+ 		if (bfq_bfqq_must_idle(bfqq, budg_timeout))
+ 			bfq_arm_slice_timer(bfqd);
+ 		else if (budg_timeout)
+@@ -2449,18 +2694,6 @@ static void bfq_put_request(struct request *rq)
+ 	}
+ }
+ 
+-static struct bfq_queue *
+-bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic,
+-                struct bfq_queue *bfqq)
+-{
+-        bfq_log_bfqq(bfqd, bfqq, "merging with queue %lu",
+-		(long unsigned)bfqq->new_bfqq->pid);
+-        bic_set_bfqq(bic, bfqq->new_bfqq, 1);
+-        bfq_mark_bfqq_coop(bfqq->new_bfqq);
+-        bfq_put_queue(bfqq);
+-        return bic_to_bfqq(bic, 1);
+-}
+-
+ /*
+  * Returns NULL if a new bfqq should be allocated, or the old bfqq if this
+  * was the last process referring to said bfqq.
+@@ -2469,6 +2702,9 @@ static struct bfq_queue *
+ bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq)
+ {
+ 	bfq_log_bfqq(bfqq->bfqd, bfqq, "splitting queue");
++
++	put_io_context(bic->icq.ioc);
++
+ 	if (bfqq_process_refs(bfqq) == 1) {
+ 		bfqq->pid = current->pid;
+ 		bfq_clear_bfqq_some_coop_idle(bfqq);
+@@ -2498,6 +2734,7 @@ static int bfq_set_request(struct request_queue *q, struct request *rq,
+ 	struct bfq_queue *bfqq;
+ 	struct bfq_group *bfqg;
+ 	unsigned long flags;
++	bool split = false;
+ 
+ 	might_sleep_if(gfp_mask & __GFP_WAIT);
+ 
+@@ -2516,24 +2753,14 @@ new_queue:
+ 		bfqq = bfq_get_queue(bfqd, bfqg, is_sync, bic, gfp_mask);
+ 		bic_set_bfqq(bic, bfqq, is_sync);
+ 	} else {
+-		/*
+-		 * If the queue was seeky for too long, break it apart.
+-		 */
++		/* If the queue was seeky for too long, break it apart. */
+ 		if (bfq_bfqq_coop(bfqq) && bfq_bfqq_split_coop(bfqq)) {
+ 			bfq_log_bfqq(bfqd, bfqq, "breaking apart bfqq");
+ 			bfqq = bfq_split_bfqq(bic, bfqq);
++			split = true;
+ 			if (!bfqq)
+ 				goto new_queue;
+ 		}
+-
+-		/*
+-		 * Check to see if this queue is scheduled to merge with
+-		 * another closely cooperating queue. The merging of queues
+-		 * happens here as it must be done in process context.
+-		 * The reference on new_bfqq was taken in merge_bfqqs.
+-		 */
+-		if (bfqq->new_bfqq != NULL)
+-			bfqq = bfq_merge_bfqqs(bfqd, bic, bfqq);
+ 	}
+ 
+ 	bfqq->allocated[rw]++;
+@@ -2544,6 +2771,26 @@ new_queue:
+ 	rq->elv.priv[0] = bic;
+ 	rq->elv.priv[1] = bfqq;
+ 
++	/*
++	 * If a bfq_queue has only one process reference, it is owned
++	 * by only one bfq_io_cq: we can set the bic field of the
++	 * bfq_queue to the address of that structure. Also, if the
++	 * queue has just been split, mark a flag so that the
++	 * information is available to the other scheduler hooks.
++	 */
++	if (bfqq_process_refs(bfqq) == 1) {
++		bfqq->bic = bic;
++		if (split) {
++			bfq_mark_bfqq_just_split(bfqq);
++			/*
++			 * If the queue has just been split from a shared queue,
++			 * restore the idle window and the possible weight
++			 * raising period.
++			 */
++			bfq_bfqq_resume_state(bfqq, bic);
++		}
++	}
++
+ 	spin_unlock_irqrestore(q->queue_lock, flags);
+ 
+ 	return 0;
+diff --git a/block/bfq-sched.c b/block/bfq-sched.c
+index 03f8061..a0edaa2 100644
+--- a/block/bfq-sched.c
++++ b/block/bfq-sched.c
+@@ -978,34 +978,6 @@ static struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd)
+ 	return bfqq;
+ }
+ 
+-/*
+- * Forced extraction of the given queue.
+- */
+-static void bfq_get_next_queue_forced(struct bfq_data *bfqd,
+-				      struct bfq_queue *bfqq)
+-{
+-	struct bfq_entity *entity;
+-	struct bfq_sched_data *sd;
+-
+-	BUG_ON(bfqd->active_queue != NULL);
+-
+-	entity = &bfqq->entity;
+-	/*
+-	 * Bubble up extraction/update from the leaf to the root.
+-	*/
+-	for_each_entity(entity) {
+-		sd = entity->sched_data;
+-		bfq_update_budget(entity);
+-		bfq_update_vtime(bfq_entity_service_tree(entity));
+-		bfq_active_extract(bfq_entity_service_tree(entity), entity);
+-		sd->active_entity = entity;
+-		sd->next_active = NULL;
+-		entity->service = 0;
+-	}
+-
+-	return;
+-}
+-
+ static void __bfq_bfqd_reset_active(struct bfq_data *bfqd)
+ {
+ 	if (bfqd->active_bic != NULL) {
+diff --git a/block/bfq.h b/block/bfq.h
+index 48ecde9..bb52975 100644
+--- a/block/bfq.h
++++ b/block/bfq.h
+@@ -188,6 +188,8 @@ struct bfq_group;
+  * @pid: pid of the process owning the queue, used for logging purposes.
+  * @last_rais_start_time: last (idle -> weight-raised) transition attempt
+  * @raising_cur_max_time: current max raising time for this queue
++ * @bic: pointer to the bfq_io_cq owning the bfq_queue, set to %NULL if the
++ *	 queue is shared
+  *
+  * A bfq_queue is a leaf request queue; it can be associated to an io_context
+  * or more (if it is an async one).  @cgroup holds a reference to the
+@@ -231,6 +233,7 @@ struct bfq_queue {
+ 	sector_t last_request_pos;
+ 
+ 	pid_t pid;
++	struct bfq_io_cq *bic;
+ 
+ 	/* weight-raising fields */
+ 	unsigned int raising_cur_max_time;
+@@ -257,12 +260,23 @@ struct bfq_ttime {
+  * @icq: associated io_cq structure
+  * @bfqq: array of two process queues, the sync and the async
+  * @ttime: associated @bfq_ttime struct
++ * @raising_time_left: snapshot of the time left before weight raising ends
++ *		       for the sync queue associated to this process; this
++ *		       snapshot is taken to remember this value while the weight
++ *		       raising is suspended because the queue is merged with a
++ *		       shared queue, and is used to set @raising_cur_max_time
++ *		       when the queue is split from the shared queue and its
++ *		       weight is raised again
++ * @saved_idle_window: same purpose as the previous field for the idle window
+  */
+ struct bfq_io_cq {
+ 	struct io_cq icq; /* must be the first member */
+ 	struct bfq_queue *bfqq[2];
+ 	struct bfq_ttime ttime;
+ 	int ioprio;
++
++	unsigned int raising_time_left;
++	unsigned int saved_idle_window;
+ };
+ 
+ /**
+@@ -403,6 +417,7 @@ enum bfqq_state_flags {
+ 	BFQ_BFQQ_FLAG_coop,		/* bfqq is shared */
+ 	BFQ_BFQQ_FLAG_split_coop,	/* shared bfqq will be splitted */
+ 	BFQ_BFQQ_FLAG_some_coop_idle,   /* some cooperator is inactive */
++	BFQ_BFQQ_FLAG_just_split,	/* queue has just been split */
+ };
+ 
+ #define BFQ_BFQQ_FNS(name)						\
+@@ -430,6 +445,7 @@ BFQ_BFQQ_FNS(budget_new);
+ BFQ_BFQQ_FNS(coop);
+ BFQ_BFQQ_FNS(split_coop);
+ BFQ_BFQQ_FNS(some_coop_idle);
++BFQ_BFQQ_FNS(just_split);
+ #undef BFQ_BFQQ_FNS
+ 
+ /* Logging facilities. */
+-- 
+1.8.1.4
+

Added: genpatches-2.6/trunk/3.10.7/2400_kcopy-patch-for-infiniband-driver.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/2400_kcopy-patch-for-infiniband-driver.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/2400_kcopy-patch-for-infiniband-driver.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,731 @@
+From 1f52075d672a9bdd0069b3ea68be266ef5c229bd Mon Sep 17 00:00:00 2001
+From: Alexey Shvetsov <alexxy@g.o>
+Date: Tue, 17 Jan 2012 21:08:49 +0400
+Subject: [PATCH] [kcopy] Add kcopy driver
+
+Add kcopy driver from qlogic to implement zero copy for infiniband psm
+userspace driver
+
+Signed-off-by: Alexey Shvetsov <alexxy@g.o>
+---
+ drivers/char/Kconfig        |    2 +
+ drivers/char/Makefile       |    2 +
+ drivers/char/kcopy/Kconfig  |   17 ++
+ drivers/char/kcopy/Makefile |    4 +
+ drivers/char/kcopy/kcopy.c  |  646 +++++++++++++++++++++++++++++++++++++++++++
+ 5 files changed, 671 insertions(+)
+ create mode 100644 drivers/char/kcopy/Kconfig
+ create mode 100644 drivers/char/kcopy/Makefile
+ create mode 100644 drivers/char/kcopy/kcopy.c
+
+diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
+index ee94686..5b81449 100644
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -6,6 +6,8 @@ menu "Character devices"
+ 
+ source "drivers/tty/Kconfig"
+ 
++source "drivers/char/kcopy/Kconfig"
++
+ config DEVKMEM
+    bool "/dev/kmem virtual device support"
+    default y
+diff --git a/drivers/char/Makefile b/drivers/char/Makefile
+index 0dc5d7c..be519d6 100644
+--- a/drivers/char/Makefile
++++ b/drivers/char/Makefile
+@@ -62,3 +62,5 @@
+ js-rtc-y = rtc.o
+
+ obj-$(CONFIG_TILE_SROM)		+= tile-srom.o
++
++obj-$(CONFIG_KCOPY)		+= kcopy/
+diff --git a/drivers/char/kcopy/Kconfig b/drivers/char/kcopy/Kconfig
+new file mode 100644
+index 0000000..453ae52
+--- /dev/null
++++ b/drivers/char/kcopy/Kconfig
+@@ -0,0 +1,17 @@
++#
++# KCopy character device configuration
++#
++
++menu "KCopy"
++
++config KCOPY
++   tristate "Memory-to-memory copies using kernel assist"
++   default m
++   ---help---
++     High-performance inter-process memory copies.  Can often save a
++     memory copy to shared memory in the application.   Useful at least
++     for MPI applications where the point-to-point nature of vmsplice
++     and pipes can be a limiting factor in performance.
++
++endmenu
++
+diff --git a/drivers/char/kcopy/Makefile b/drivers/char/kcopy/Makefile
+new file mode 100644
+index 0000000..9cb269b
+--- /dev/null
++++ b/drivers/char/kcopy/Makefile
+@@ -0,0 +1,4 @@
++#
++# Makefile for the kernel character device drivers.
++#
++obj-$(CONFIG_KCOPY)    += kcopy.o
+diff --git a/drivers/char/kcopy/kcopy.c b/drivers/char/kcopy/kcopy.c
+new file mode 100644
+index 0000000..a9f915c
+--- /dev/null
++++ b/drivers/char/kcopy/kcopy.c
+@@ -0,0 +1,646 @@
++#include <linux/module.h>
++#include <linux/fs.h>
++#include <linux/cdev.h>
++#include <linux/device.h>
++#include <linux/mutex.h>
++#include <linux/mman.h>
++#include <linux/highmem.h>
++#include <linux/spinlock.h>
++#include <linux/sched.h>
++#include <linux/rbtree.h>
++#include <linux/rcupdate.h>
++#include <linux/uaccess.h>
++#include <linux/slab.h>
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Arthur Jones <arthur.jones@××××××.com>");
++MODULE_DESCRIPTION("QLogic kcopy driver");
++
++#define KCOPY_ABI      1
++#define KCOPY_MAX_MINORS   64
++
++struct kcopy_device {
++   struct cdev cdev;
++   struct class *class;
++   struct device *devp[KCOPY_MAX_MINORS];
++   dev_t dev;
++
++   struct kcopy_file *kf[KCOPY_MAX_MINORS];
++   struct mutex open_lock;
++};
++
++static struct kcopy_device kcopy_dev;
++
++/* per file data / one of these is shared per minor */
++struct kcopy_file {
++   int count;
++
++   /* pid indexed */
++   struct rb_root live_map_tree;
++
++   struct mutex map_lock;
++};
++
++struct kcopy_map_entry {
++   int    count;
++   struct task_struct *task;
++   pid_t  pid;
++   struct kcopy_file *file; /* file backpointer */
++
++   struct list_head list; /* free map list */
++   struct rb_node   node; /* live map tree */
++};
++
++#define KCOPY_GET_SYSCALL 1
++#define KCOPY_PUT_SYSCALL 2
++#define KCOPY_ABI_SYSCALL 3
++
++struct kcopy_syscall {
++   __u32 tag;
++   pid_t pid;
++   __u64 n;
++   __u64 src;
++   __u64 dst;
++};
++
++static const void __user *kcopy_syscall_src(const struct kcopy_syscall *ks)
++{
++   return (const void __user *) (unsigned long) ks->src;
++}
++
++static void __user *kcopy_syscall_dst(const struct kcopy_syscall *ks)
++{
++   return (void __user *) (unsigned long) ks->dst;
++}
++
++static unsigned long kcopy_syscall_n(const struct kcopy_syscall *ks)
++{
++   return (unsigned long) ks->n;
++}
++
++static struct kcopy_map_entry *kcopy_create_entry(struct kcopy_file *file)
++{
++   struct kcopy_map_entry *kme =
++       kmalloc(sizeof(struct kcopy_map_entry), GFP_KERNEL);
++
++   if (!kme)
++       return NULL;
++
++   kme->count = 1;
++   kme->file = file;
++   kme->task = current;
++   kme->pid = current->tgid;
++   INIT_LIST_HEAD(&kme->list);
++
++   return kme;
++}
++
++static struct kcopy_map_entry *
++kcopy_lookup_pid(struct rb_root *root, pid_t pid)
++{
++   struct rb_node *node = root->rb_node;
++
++   while (node) {
++       struct kcopy_map_entry *kme =
++           container_of(node, struct kcopy_map_entry, node);
++
++       if (pid < kme->pid)
++           node = node->rb_left;
++       else if (pid > kme->pid)
++           node = node->rb_right;
++       else
++           return kme;
++   }
++
++   return NULL;
++}
++
++static int kcopy_insert(struct rb_root *root, struct kcopy_map_entry *kme)
++{
++   struct rb_node **new = &(root->rb_node);
++   struct rb_node *parent = NULL;
++
++   while (*new) {
++       struct kcopy_map_entry *tkme =
++           container_of(*new, struct kcopy_map_entry, node);
++
++       parent = *new;
++       if (kme->pid < tkme->pid)
++           new = &((*new)->rb_left);
++       else if (kme->pid > tkme->pid)
++           new = &((*new)->rb_right);
++       else {
++           printk(KERN_INFO "!!! debugging: bad rb tree !!!\n");
++           return -EINVAL;
++       }
++   }
++
++   rb_link_node(&kme->node, parent, new);
++   rb_insert_color(&kme->node, root);
++
++   return 0;
++}
++
++static int kcopy_open(struct inode *inode, struct file *filp)
++{
++   int ret;
++   const int minor = iminor(inode);
++   struct kcopy_file *kf = NULL;
++   struct kcopy_map_entry *kme;
++   struct kcopy_map_entry *okme;
++
++   if (minor < 0 || minor >= KCOPY_MAX_MINORS)
++       return -ENODEV;
++
++   mutex_lock(&kcopy_dev.open_lock);
++
++   if (!kcopy_dev.kf[minor]) {
++       kf = kmalloc(sizeof(struct kcopy_file), GFP_KERNEL);
++
++       if (!kf) {
++           ret = -ENOMEM;
++           goto bail;
++       }
++
++       kf->count = 1;
++       kf->live_map_tree = RB_ROOT;
++       mutex_init(&kf->map_lock);
++       kcopy_dev.kf[minor] = kf;
++   } else {
++       if (filp->f_flags & O_EXCL) {
++           ret = -EBUSY;
++           goto bail;
++       }
++       kcopy_dev.kf[minor]->count++;
++   }
++
++   kme = kcopy_create_entry(kcopy_dev.kf[minor]);
++   if (!kme) {
++       ret = -ENOMEM;
++       goto err_free_kf;
++   }
++
++   kf = kcopy_dev.kf[minor];
++
++   mutex_lock(&kf->map_lock);
++
++   okme = kcopy_lookup_pid(&kf->live_map_tree, kme->pid);
++   if (okme) {
++       /* pid already exists... */
++       okme->count++;
++       kfree(kme);
++       kme = okme;
++   } else
++       ret = kcopy_insert(&kf->live_map_tree, kme);
++
++   mutex_unlock(&kf->map_lock);
++
++   filp->private_data = kme;
++
++   ret = 0;
++   goto bail;
++
++err_free_kf:
++   if (kf) {
++       kcopy_dev.kf[minor] = NULL;
++       kfree(kf);
++   }
++bail:
++   mutex_unlock(&kcopy_dev.open_lock);
++   return ret;
++}
++
++static int kcopy_flush(struct file *filp, fl_owner_t id)
++{
++   struct kcopy_map_entry *kme = filp->private_data;
++   struct kcopy_file *kf = kme->file;
++
++   if (file_count(filp) == 1) {
++       mutex_lock(&kf->map_lock);
++       kme->count--;
++
++       if (!kme->count) {
++           rb_erase(&kme->node, &kf->live_map_tree);
++           kfree(kme);
++       }
++       mutex_unlock(&kf->map_lock);
++   }
++
++   return 0;
++}
++
++static int kcopy_release(struct inode *inode, struct file *filp)
++{
++   const int minor = iminor(inode);
++
++   mutex_lock(&kcopy_dev.open_lock);
++   kcopy_dev.kf[minor]->count--;
++   if (!kcopy_dev.kf[minor]->count) {
++       kfree(kcopy_dev.kf[minor]);
++       kcopy_dev.kf[minor] = NULL;
++   }
++   mutex_unlock(&kcopy_dev.open_lock);
++
++   return 0;
++}
++
++static void kcopy_put_pages(struct page **pages, int npages)
++{
++   int j;
++
++   for (j = 0; j < npages; j++)
++       put_page(pages[j]);
++}
++
++static int kcopy_validate_task(struct task_struct *p)
++{
++   return p && (uid_eq(current_euid(), task_euid(p)) || uid_eq(current_euid(), task_uid(p)));
++}
++
++static int kcopy_get_pages(struct kcopy_file *kf, pid_t pid,
++              struct page **pages, void __user *addr,
++              int write, size_t npages)
++{
++   int err;
++   struct mm_struct *mm;
++   struct kcopy_map_entry *rkme;
++
++   mutex_lock(&kf->map_lock);
++
++   rkme = kcopy_lookup_pid(&kf->live_map_tree, pid);
++   if (!rkme || !kcopy_validate_task(rkme->task)) {
++       err = -EINVAL;
++       goto bail_unlock;
++   }
++
++   mm = get_task_mm(rkme->task);
++   if (unlikely(!mm)) {
++       err = -ENOMEM;
++       goto bail_unlock;
++   }
++
++   down_read(&mm->mmap_sem);
++   err = get_user_pages(rkme->task, mm,
++                (unsigned long) addr, npages, write, 0,
++                pages, NULL);
++
++   if (err < npages && err > 0) {
++       kcopy_put_pages(pages, err);
++       err = -ENOMEM;
++   } else if (err == npages)
++       err = 0;
++
++   up_read(&mm->mmap_sem);
++
++   mmput(mm);
++
++bail_unlock:
++   mutex_unlock(&kf->map_lock);
++
++   return err;
++}
++
++static unsigned long kcopy_copy_pages_from_user(void __user *src,
++                       struct page **dpages,
++                       unsigned doff,
++                       unsigned long n)
++{
++   struct page *dpage = *dpages;
++   char *daddr = kmap(dpage);
++   int ret = 0;
++
++   while (1) {
++       const unsigned long nleft = PAGE_SIZE - doff;
++       const unsigned long nc = (n < nleft) ? n : nleft;
++
++       /* if (copy_from_user(daddr + doff, src, nc)) { */
++       if (__copy_from_user_nocache(daddr + doff, src, nc)) {
++           ret = -EFAULT;
++           goto bail;
++       }
++
++       n -= nc;
++       if (n == 0)
++           break;
++
++       doff += nc;
++       doff &= ~PAGE_MASK;
++       if (doff == 0) {
++           kunmap(dpage);
++           dpages++;
++           dpage = *dpages;
++           daddr = kmap(dpage);
++       }
++
++       src += nc;
++   }
++
++bail:
++   kunmap(dpage);
++
++   return ret;
++}
++
++static unsigned long kcopy_copy_pages_to_user(void __user *dst,
++                         struct page **spages,
++                         unsigned soff,
++                         unsigned long n)
++{
++   struct page *spage = *spages;
++   const char *saddr = kmap(spage);
++   int ret = 0;
++
++   while (1) {
++       const unsigned long nleft = PAGE_SIZE - soff;
++       const unsigned long nc = (n < nleft) ? n : nleft;
++
++       if (copy_to_user(dst, saddr + soff, nc)) {
++           ret = -EFAULT;
++           goto bail;
++       }
++
++       n -= nc;
++       if (n == 0)
++           break;
++
++       soff += nc;
++       soff &= ~PAGE_MASK;
++       if (soff == 0) {
++           kunmap(spage);
++           spages++;
++           spage = *spages;
++           saddr = kmap(spage);
++       }
++
++       dst += nc;
++   }
++
++bail:
++   kunmap(spage);
++
++   return ret;
++}
++
++static unsigned long kcopy_copy_to_user(void __user *dst,
++                   struct kcopy_file *kf, pid_t pid,
++                   void __user *src,
++                   unsigned long n)
++{
++   struct page **pages;
++   const int pages_len = PAGE_SIZE / sizeof(struct page *);
++   int ret = 0;
++
++   pages = (struct page **) __get_free_page(GFP_KERNEL);
++   if (!pages) {
++       ret = -ENOMEM;
++       goto bail;
++   }
++
++   while (n) {
++       const unsigned long soff = (unsigned long) src & ~PAGE_MASK;
++       const unsigned long spages_left =
++           (soff + n + PAGE_SIZE - 1) >> PAGE_SHIFT;
++       const unsigned long spages_cp =
++           min_t(unsigned long, spages_left, pages_len);
++       const unsigned long sbytes =
++           PAGE_SIZE - soff + (spages_cp - 1) * PAGE_SIZE;
++       const unsigned long nbytes = min_t(unsigned long, sbytes, n);
++
++       ret = kcopy_get_pages(kf, pid, pages, src, 0, spages_cp);
++       if (unlikely(ret))
++           goto bail_free;
++
++       ret = kcopy_copy_pages_to_user(dst, pages, soff, nbytes);
++       kcopy_put_pages(pages, spages_cp);
++       if (ret)
++           goto bail_free;
++       dst = (char *) dst + nbytes;
++       src = (char *) src + nbytes;
++
++       n -= nbytes;
++   }
++
++bail_free:
++   free_page((unsigned long) pages);
++bail:
++   return ret;
++}
++
++static unsigned long kcopy_copy_from_user(const void __user *src,
++                     struct kcopy_file *kf, pid_t pid,
++                     void __user *dst,
++                     unsigned long n)
++{
++   struct page **pages;
++   const int pages_len = PAGE_SIZE / sizeof(struct page *);
++   int ret = 0;
++
++   pages = (struct page **) __get_free_page(GFP_KERNEL);
++   if (!pages) {
++       ret = -ENOMEM;
++       goto bail;
++   }
++
++   while (n) {
++       const unsigned long doff = (unsigned long) dst & ~PAGE_MASK;
++       const unsigned long dpages_left =
++           (doff + n + PAGE_SIZE - 1) >> PAGE_SHIFT;
++       const unsigned long dpages_cp =
++           min_t(unsigned long, dpages_left, pages_len);
++       const unsigned long dbytes =
++           PAGE_SIZE - doff + (dpages_cp - 1) * PAGE_SIZE;
++       const unsigned long nbytes = min_t(unsigned long, dbytes, n);
++
++       ret = kcopy_get_pages(kf, pid, pages, dst, 1, dpages_cp);
++       if (unlikely(ret))
++           goto bail_free;
++
++       ret = kcopy_copy_pages_from_user((void __user *) src,
++                        pages, doff, nbytes);
++       kcopy_put_pages(pages, dpages_cp);
++       if (ret)
++           goto bail_free;
++
++       dst = (char *) dst + nbytes;
++       src = (char *) src + nbytes;
++
++       n -= nbytes;
++   }
++
++bail_free:
++   free_page((unsigned long) pages);
++bail:
++   return ret;
++}
++
++static int kcopy_do_get(struct kcopy_map_entry *kme, pid_t pid,
++           const void __user *src, void __user *dst,
++           unsigned long n)
++{
++   struct kcopy_file *kf = kme->file;
++   int ret = 0;
++
++   if (n == 0) {
++       ret = -EINVAL;
++       goto bail;
++   }
++
++   ret = kcopy_copy_to_user(dst, kf, pid, (void __user *) src, n);
++
++bail:
++   return ret;
++}
++
++static int kcopy_do_put(struct kcopy_map_entry *kme, const void __user *src,
++           pid_t pid, void __user *dst,
++           unsigned long n)
++{
++   struct kcopy_file *kf = kme->file;
++   int ret = 0;
++
++   if (n == 0) {
++       ret = -EINVAL;
++       goto bail;
++   }
++
++   ret = kcopy_copy_from_user(src, kf, pid, (void __user *) dst, n);
++
++bail:
++   return ret;
++}
++
++static int kcopy_do_abi(u32 __user *dst)
++{
++   u32 val = KCOPY_ABI;
++   int err;
++
++   err = put_user(val, dst);
++   if (err)
++       return -EFAULT;
++
++   return 0;
++}
++
++ssize_t kcopy_write(struct file *filp, const char __user *data, size_t cnt,
++           loff_t *o)
++{
++   struct kcopy_map_entry *kme = filp->private_data;
++   struct kcopy_syscall ks;
++   int err = 0;
++   const void __user *src;
++   void __user *dst;
++   unsigned long n;
++
++   if (cnt != sizeof(struct kcopy_syscall)) {
++       err = -EINVAL;
++       goto bail;
++   }
++
++   err = copy_from_user(&ks, data, cnt);
++   if (unlikely(err))
++       goto bail;
++
++   src = kcopy_syscall_src(&ks);
++   dst = kcopy_syscall_dst(&ks);
++   n = kcopy_syscall_n(&ks);
++   if (ks.tag == KCOPY_GET_SYSCALL)
++       err = kcopy_do_get(kme, ks.pid, src, dst, n);
++   else if (ks.tag == KCOPY_PUT_SYSCALL)
++       err = kcopy_do_put(kme, src, ks.pid, dst, n);
++   else if (ks.tag == KCOPY_ABI_SYSCALL)
++       err = kcopy_do_abi(dst);
++   else
++       err = -EINVAL;
++
++bail:
++   return err ? err : cnt;
++}
++
++static const struct file_operations kcopy_fops = {
++   .owner = THIS_MODULE,
++   .open = kcopy_open,
++   .release = kcopy_release,
++   .flush = kcopy_flush,
++   .write = kcopy_write,
++};
++
++static int __init kcopy_init(void)
++{
++   int ret;
++   const char *name = "kcopy";
++   int i;
++   int ninit = 0;
++
++   mutex_init(&kcopy_dev.open_lock);
++
++   ret = alloc_chrdev_region(&kcopy_dev.dev, 0, KCOPY_MAX_MINORS, name);
++   if (ret)
++       goto bail;
++
++   kcopy_dev.class = class_create(THIS_MODULE, (char *) name);
++
++   if (IS_ERR(kcopy_dev.class)) {
++       ret = PTR_ERR(kcopy_dev.class);
++       printk(KERN_ERR "kcopy: Could not create "
++           "device class (err %d)\n", -ret);
++       goto bail_chrdev;
++   }
++
++   cdev_init(&kcopy_dev.cdev, &kcopy_fops);
++   ret = cdev_add(&kcopy_dev.cdev, kcopy_dev.dev, KCOPY_MAX_MINORS);
++   if (ret < 0) {
++       printk(KERN_ERR "kcopy: Could not add cdev (err %d)\n",
++                  -ret);
++       goto bail_class;
++   }
++
++   for (i = 0; i < KCOPY_MAX_MINORS; i++) {
++       char devname[8];
++       const int minor = MINOR(kcopy_dev.dev) + i;
++       const dev_t dev = MKDEV(MAJOR(kcopy_dev.dev), minor);
++
++       snprintf(devname, sizeof(devname), "kcopy%02d", i);
++       kcopy_dev.devp[i] =
++           device_create(kcopy_dev.class, NULL,
++               dev, NULL, devname);
++
++       if (IS_ERR(kcopy_dev.devp[i])) {
++           ret = PTR_ERR(kcopy_dev.devp[i]);
++           printk(KERN_ERR "kcopy: Could not create "
++                  "devp %d (err %d)\n", i, -ret);
++           goto bail_cdev_add;
++       }
++
++       ninit++;
++   }
++
++   ret = 0;
++   goto bail;
++
++bail_cdev_add:
++   for (i = 0; i < ninit; i++)
++       device_unregister(kcopy_dev.devp[i]);
++
++   cdev_del(&kcopy_dev.cdev);
++bail_class:
++   class_destroy(kcopy_dev.class);
++bail_chrdev:
++   unregister_chrdev_region(kcopy_dev.dev, KCOPY_MAX_MINORS);
++bail:
++   return ret;
++}
++
++static void __exit kcopy_fini(void)
++{
++   int i;
++
++   for (i = 0; i < KCOPY_MAX_MINORS; i++)
++       device_unregister(kcopy_dev.devp[i]);
++
++   cdev_del(&kcopy_dev.cdev);
++   class_destroy(kcopy_dev.class);
++   unregister_chrdev_region(kcopy_dev.dev, KCOPY_MAX_MINORS);
++}
++
++module_init(kcopy_init);
++module_exit(kcopy_fini);
+-- 
+1.7.10
+

Added: genpatches-2.6/trunk/3.10.7/2700_ThinkPad-30-brightness-control-fix.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/2700_ThinkPad-30-brightness-control-fix.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/2700_ThinkPad-30-brightness-control-fix.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,81 @@
+diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
+index cb96296..6c242ed 100644
+--- a/drivers/acpi/blacklist.c
++++ b/drivers/acpi/blacklist.c
+@@ -193,6 +193,13 @@  static int __init dmi_disable_osi_win7(const struct dmi_system_id *d)
+ 	return 0;
+ }
+ 
++static int __init dmi_disable_osi_win8(const struct dmi_system_id *d)
++{
++	printk(KERN_NOTICE PREFIX "DMI detected: %s\n", d->ident);
++	acpi_osi_setup("!Windows 2012");
++	return 0;
++}
++
+ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
+ 	{
+ 	.callback = dmi_disable_osi_vista,
+@@ -269,6 +276,61 @@  static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
+ 	},
+ 
+ 	/*
++	 * The following Lenovo models have a broken workaround in the
++	 * acpi_video backlight implementation to meet the Windows 8
++	 * requirement of 101 backlight levels. Reverting to pre-Win8
++	 * behavior fixes the problem.
++	 */
++	{
++	.callback = dmi_disable_osi_win8,
++	.ident = "Lenovo ThinkPad L430",
++	.matches = {
++		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L430"),
++		},
++	},
++	{
++	.callback = dmi_disable_osi_win8,
++	.ident = "Lenovo ThinkPad T430s",
++	.matches = {
++		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T430s"),
++		},
++	},
++	{
++	.callback = dmi_disable_osi_win8,
++	.ident = "Lenovo ThinkPad T530",
++	.matches = {
++		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T530"),
++		},
++	},
++	{
++	.callback = dmi_disable_osi_win8,
++	.ident = "Lenovo ThinkPad W530",
++	.matches = {
++		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W530"),
++		},
++	},
++	{
++	.callback = dmi_disable_osi_win8,
++	.ident = "Lenovo ThinkPad X1 Carbon",
++	.matches = {
++		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X1 Carbon"),
++		},
++	},
++	{
++	.callback = dmi_disable_osi_win8,
++	.ident = "Lenovo ThinkPad X230",
++	.matches = {
++		     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X230"),
++		},
++	},
++
++	/*
+ 	 * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
+ 	 * Linux ignores it, except for the machines enumerated below.
+ 	 */
+

Added: genpatches-2.6/trunk/3.10.7/2900_dev-root-proc-mount-fix.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/2900_dev-root-proc-mount-fix.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/2900_dev-root-proc-mount-fix.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,29 @@
+--- a/init/do_mounts.c	2013-01-25 19:11:11.609802424 -0500
++++ b/init/do_mounts.c	2013-01-25 19:14:20.606053568 -0500
+@@ -461,7 +461,10 @@ void __init change_floppy(char *fmt, ...
+ 	va_start(args, fmt);
+ 	vsprintf(buf, fmt, args);
+ 	va_end(args);
+-	fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
++	if (saved_root_name[0])
++		fd = sys_open(saved_root_name, O_RDWR | O_NDELAY, 0);
++	else
++		fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
+ 	if (fd >= 0) {
+ 		sys_ioctl(fd, FDEJECT, 0);
+ 		sys_close(fd);
+@@ -505,7 +508,13 @@ void __init mount_root(void)
+ #endif
+ #ifdef CONFIG_BLOCK
+ 	create_dev("/dev/root", ROOT_DEV);
+-	mount_block_root("/dev/root", root_mountflags);
++	if (saved_root_name[0]) {
++		create_dev(saved_root_name, ROOT_DEV);
++		mount_block_root(saved_root_name, root_mountflags);
++	} else {
++		create_dev("/dev/root", ROOT_DEV);
++		mount_block_root("/dev/root", root_mountflags);
++	}
+ #endif
+ }
+ 

Added: genpatches-2.6/trunk/3.10.7/4200_fbcondecor-0.9.6.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/4200_fbcondecor-0.9.6.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/4200_fbcondecor-0.9.6.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,2344 @@
+diff --git a/Documentation/fb/00-INDEX b/Documentation/fb/00-INDEX
+index 30a7054..9b6a733 100644
+--- a/Documentation/fb/00-INDEX
++++ b/Documentation/fb/00-INDEX
+@@ -21,6 +21,8 @@ ep93xx-fb.txt
+ 	- info on the driver for EP93xx LCD controller.
+ fbcon.txt
+ 	- intro to and usage guide for the framebuffer console (fbcon).
++fbcondecor.txt
++	- info on the Framebuffer Console Decoration
+ framebuffer.txt
+ 	- introduction to frame buffer devices.
+ gxfb.txt
+diff --git a/Documentation/fb/fbcondecor.txt b/Documentation/fb/fbcondecor.txt
+new file mode 100644
+index 0000000..15889f3
+--- /dev/null
++++ b/Documentation/fb/fbcondecor.txt
+@@ -0,0 +1,207 @@
++What is it?
++-----------
++
++The framebuffer decorations are a kernel feature which allows displaying a 
++background picture on selected consoles.
++
++What do I need to get it to work?
++---------------------------------
++
++To get fbcondecor up-and-running you will have to:
++ 1) get a copy of splashutils [1] or a similar program
++ 2) get some fbcondecor themes
++ 3) build the kernel helper program
++ 4) build your kernel with the FB_CON_DECOR option enabled.
++
++To get fbcondecor operational right after fbcon initialization is finished, you
++will have to include a theme and the kernel helper into your initramfs image.
++Please refer to splashutils documentation for instructions on how to do that.
++
++[1] The splashutils package can be downloaded from:
++    http://dev.gentoo.org/~spock/projects/splashutils/
++
++The userspace helper
++--------------------
++
++The userspace fbcondecor helper (by default: /sbin/fbcondecor_helper) is called by the
++kernel whenever an important event occurs and the kernel needs some kind of
++job to be carried out. Important events include console switches and video
++mode switches (the kernel requests background images and configuration
++parameters for the current console). The fbcondecor helper must be accessible at
++all times. If it's not, fbcondecor will be switched off automatically.
++
++It's possible to set path to the fbcondecor helper by writing it to
++/proc/sys/kernel/fbcondecor.
++
++*****************************************************************************
++
++The information below is mostly technical stuff. There's probably no need to
++read it unless you plan to develop a userspace helper.
++
++The fbcondecor protocol
++-----------------------
++
++The fbcondecor protocol defines a communication interface between the kernel and
++the userspace fbcondecor helper.
++
++The kernel side is responsible for:
++
++ * rendering console text, using an image as a background (instead of a
++   standard solid color fbcon uses),
++ * accepting commands from the user via ioctls on the fbcondecor device,
++ * calling the userspace helper to set things up as soon as the fb subsystem 
++   is initialized.
++
++The userspace helper is responsible for everything else, including parsing
++configuration files, decompressing the image files whenever the kernel needs
++it, and communicating with the kernel if necessary.
++
++The fbcondecor protocol specifies how communication is done in both ways:
++kernel->userspace and userspace->helper.
++  
++Kernel -> Userspace
++-------------------
++
++The kernel communicates with the userspace helper by calling it and specifying
++the task to be done in a series of arguments.
++
++The arguments follow the pattern:
++<fbcondecor protocol version> <command> <parameters>
++
++All commands defined in fbcondecor protocol v2 have the following parameters:
++ virtual console
++ framebuffer number
++ theme
++
++Fbcondecor protocol v1 specified an additional 'fbcondecor mode' after the
++framebuffer number. Fbcondecor protocol v1 is deprecated and should not be used.
++
++Fbcondecor protocol v2 specifies the following commands:
++
++getpic
++------
++ The kernel issues this command to request image data. It's up to the 
++ userspace  helper to find a background image appropriate for the specified 
++ theme and the current resolution. The userspace helper should respond by 
++ issuing the FBIOCONDECOR_SETPIC ioctl.
++
++init
++----
++ The kernel issues this command after the fbcondecor device is created and
++ the fbcondecor interface is initialized. Upon receiving 'init', the userspace
++ helper should parse the kernel command line (/proc/cmdline) or otherwise
++ decide whether fbcondecor is to be activated.
++
++ To activate fbcondecor on the first console the helper should issue the
++ FBIOCONDECOR_SETCFG, FBIOCONDECOR_SETPIC and FBIOCONDECOR_SETSTATE commands,
++ in the above-mentioned order.
++
++ When the userspace helper is called in an early phase of the boot process
++ (right after the initialization of fbcon), no filesystems will be mounted.
++ The helper program should mount sysfs and then create the appropriate
++ framebuffer, fbcondecor and tty0 devices (if they don't already exist) to get
++ current display settings and to be able to communicate with the kernel side.
++ It should probably also mount the procfs to be able to parse the kernel
++ command line parameters.
++
++ Note that the console sem is not held when the kernel calls fbcondecor_helper
++ with the 'init' command. The fbcondecor helper should perform all ioctls with
++ origin set to FBCON_DECOR_IO_ORIG_USER.
++
++modechange
++----------
++ The kernel issues this command on a mode change. The helper's response should
++ be similar to the response to the 'init' command. Note that this time the
++ console sem is held and all ioctls must be performed with origin set to
++ FBCON_DECOR_IO_ORIG_KERNEL.
++
++
++Userspace -> Kernel
++-------------------
++
++Userspace programs can communicate with fbcondecor via ioctls on the
++fbcondecor device. These ioctls are to be used by both the userspace helper
++(called only by the kernel) and userspace configuration tools (run by the users).
++
++The fbcondecor helper should set the origin field to FBCON_DECOR_IO_ORIG_KERNEL
++when doing the appropriate ioctls. All userspace configuration tools should
++use FBCON_DECOR_IO_ORIG_USER. Failure to set the appropriate value in the origin
++field when performing ioctls from the kernel helper will most likely result
++in a console deadlock.
++
++FBCON_DECOR_IO_ORIG_KERNEL instructs fbcondecor not to try to acquire the console
++semaphore. Not surprisingly, FBCON_DECOR_IO_ORIG_USER instructs it to acquire
++the console sem.
++
++The framebuffer console decoration provides the following ioctls (all defined in 
++linux/fb.h):
++
++FBIOCONDECOR_SETPIC
++description: loads a background picture for a virtual console
++argument: struct fbcon_decor_iowrapper*; data: struct fb_image*
++notes: 
++If called for consoles other than the current foreground one, the picture data
++will be ignored.
++
++If the current virtual console is running in a 8-bpp mode, the cmap substruct
++of fb_image has to be filled appropriately: start should be set to 16 (first
++16 colors are reserved for fbcon), len to a value <= 240 and red, green and
++blue should point to valid cmap data. The transp field is ingored. The fields
++dx, dy, bg_color, fg_color in fb_image are ignored as well.
++
++FBIOCONDECOR_SETCFG
++description: sets the fbcondecor config for a virtual console
++argument: struct fbcon_decor_iowrapper*; data: struct vc_decor*
++notes: The structure has to be filled with valid data.
++
++FBIOCONDECOR_GETCFG
++description: gets the fbcondecor config for a virtual console
++argument: struct fbcon_decor_iowrapper*; data: struct vc_decor*
++
++FBIOCONDECOR_SETSTATE
++description: sets the fbcondecor state for a virtual console
++argument: struct fbcon_decor_iowrapper*; data: unsigned int*
++          values: 0 = disabled, 1 = enabled.
++
++FBIOCONDECOR_GETSTATE
++description: gets the fbcondecor state for a virtual console
++argument: struct fbcon_decor_iowrapper*; data: unsigned int*
++          values: as in FBIOCONDECOR_SETSTATE
++
++Info on used structures:
++
++Definition of struct vc_decor can be found in linux/console_decor.h. It's
++heavily commented. Note that the 'theme' field should point to a string
++no longer than FBCON_DECOR_THEME_LEN. When FBIOCONDECOR_GETCFG call is
++performed, the theme field should point to a char buffer of length
++FBCON_DECOR_THEME_LEN.
++
++Definition of struct fbcon_decor_iowrapper can be found in linux/fb.h.
++The fields in this struct have the following meaning:
++
++vc: 
++Virtual console number.
++
++origin: 
++Specifies if the ioctl is performed as a response to a kernel request. The
++fbcondecor helper should set this field to FBCON_DECOR_IO_ORIG_KERNEL, userspace
++programs should set it to FBCON_DECOR_IO_ORIG_USER. This field is necessary to
++avoid console semaphore deadlocks.
++
++data: 
++Pointer to a data structure appropriate for the performed ioctl. Type of
++the data struct is specified in the ioctls description.
++
++*****************************************************************************
++
++Credit
++------
++
++Original 'bootsplash' project & implementation by:
++  Volker Poplawski <volker@×××××××××.de>, Stefan Reinauer <stepan@××××.de>,
++  Steffen Winterfeldt <snwint@××××.de>, Michael Schroeder <mls@××××.de>,
++  Ken Wimer <wimer@××××.de>.
++
++Fbcondecor, fbcondecor protocol design, current implementation & docs by:
++  Michal Januszewski <spock@g.o>
++
+diff --git a/drivers/Makefile b/drivers/Makefile
+index 95952c8..b55db6d 100644
+--- a/drivers/Makefile
++++ b/drivers/Makefile
+@@ -16,4 +16,8 @@ obj-$(CONFIG_PCI)		+= pci/
+ obj-$(CONFIG_PARISC)		+= parisc/
+ obj-$(CONFIG_RAPIDIO)		+= rapidio/
++# tty/ comes before char/ so that the VT console is the boot-time
++# default.
++obj-y				+= tty/
++obj-y				+= char/
+ obj-y				+= video/
+ obj-y				+= idle/
+@@ -37,11 +41,6 @@ obj-$(CONFIG_XEN)		+= xen/
+ # regulators early, since some subsystems rely on them to initialize
+ obj-$(CONFIG_REGULATOR)		+= regulator/
+ 
+-# tty/ comes before char/ so that the VT console is the boot-time
+-# default.
+-obj-y				+= tty/
+-obj-y				+= char/
+-
+ # gpu/ comes after char for AGP vs DRM startup
+ obj-y				+= gpu/
+ 
+diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
+index a290be5..3a4ca32 100644
+--- a/drivers/video/Kconfig
++++ b/drivers/video/Kconfig
+@@ -1229,7 +1229,6 @@ config FB_MATROX
+ 	select FB_CFB_FILLRECT
+ 	select FB_CFB_COPYAREA
+ 	select FB_CFB_IMAGEBLIT
+-	select FB_TILEBLITTING
+ 	select FB_MACMODES if PPC_PMAC
+ 	---help---
+ 	  Say Y here if you have a Matrox Millennium, Matrox Millennium II,
+diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig
+index c2d11fe..1be9de4 100644
+--- a/drivers/video/console/Kconfig
++++ b/drivers/video/console/Kconfig
+@@ -120,6 +120,19 @@ config FRAMEBUFFER_CONSOLE_ROTATION
+          such that other users of the framebuffer will remain normally
+          oriented.
+ 
++config FB_CON_DECOR
++	bool "Support for the Framebuffer Console Decorations"
++	depends on FRAMEBUFFER_CONSOLE=y && !FB_TILEBLITTING
++	default n
++	---help---
++	  This option enables support for framebuffer console decorations which
++	  makes it possible to display images in the background of the system
++	  consoles.  Note that userspace utilities are necessary in order to take 
++	  advantage of these features. Refer to Documentation/fb/fbcondecor.txt 
++	  for more information.
++
++	  If unsure, say N.
++
+ config STI_CONSOLE
+         bool "STI text console"
+         depends on PARISC
+diff --git a/drivers/video/console/Makefile b/drivers/video/console/Makefile
+index a862e91..86bfcff 100644
+--- a/drivers/video/console/Makefile
++++ b/drivers/video/console/Makefile
+@@ -34,6 +34,7 @@ obj-$(CONFIG_FRAMEBUFFER_CONSOLE)     += fbcon_rotate.o fbcon_cw.o fbcon_ud.o \
+                                          fbcon_ccw.o
+ endif
+ 
++obj-$(CONFIG_FB_CON_DECOR)     	  += fbcondecor.o cfbcondecor.o
+ obj-$(CONFIG_FB_STI)              += sticore.o font.o
+ 
+ ifeq ($(CONFIG_USB_SISUSBVGA_CON),y)
+diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c
+index 28b1a83..33712c0 100644
+--- a/drivers/video/console/bitblit.c
++++ b/drivers/video/console/bitblit.c
+@@ -18,6 +18,7 @@
+ #include <linux/console.h>
+ #include <asm/types.h>
+ #include "fbcon.h"
++#include "fbcondecor.h"
+ 
+ /*
+  * Accelerated handlers.
+@@ -55,6 +56,13 @@ static void bit_bmove(struct vc_data *vc, struct fb_info *info, int sy,
+ 	area.height = height * vc->vc_font.height;
+ 	area.width = width * vc->vc_font.width;
+ 
++	if (fbcon_decor_active(info, vc)) {
++ 		area.sx += vc->vc_decor.tx;
++ 		area.sy += vc->vc_decor.ty;
++ 		area.dx += vc->vc_decor.tx;
++ 		area.dy += vc->vc_decor.ty;
++ 	}
++
+ 	info->fbops->fb_copyarea(info, &area);
+ }
+ 
+@@ -380,11 +388,15 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+ 	cursor.image.depth = 1;
+ 	cursor.rop = ROP_XOR;
+ 
+-	if (info->fbops->fb_cursor)
+-		err = info->fbops->fb_cursor(info, &cursor);
++	if (fbcon_decor_active(info, vc)) {
++		fbcon_decor_cursor(info, &cursor);
++	} else {
++		if (info->fbops->fb_cursor)
++			err = info->fbops->fb_cursor(info, &cursor);
+ 
+-	if (err)
+-		soft_cursor(info, &cursor);
++		if (err)
++			soft_cursor(info, &cursor);
++	}
+ 
+ 	ops->cursor_reset = 0;
+ }
+diff --git a/drivers/video/console/cfbcondecor.c b/drivers/video/console/cfbcondecor.c
+new file mode 100644
+index 0000000..09381d3
+--- /dev/null
++++ b/drivers/video/console/cfbcondecor.c
+@@ -0,0 +1,471 @@
++/*
++ *  linux/drivers/video/cfbcon_decor.c -- Framebuffer decor render functions
++ *
++ *  Copyright (C) 2004 Michal Januszewski <spock@g.o>
++ *
++ *  Code based upon "Bootdecor" (C) 2001-2003
++ *       Volker Poplawski <volker@×××××××××.de>,
++ *       Stefan Reinauer <stepan@××××.de>,
++ *       Steffen Winterfeldt <snwint@××××.de>,
++ *       Michael Schroeder <mls@××××.de>,
++ *       Ken Wimer <wimer@××××.de>.
++ *
++ *  This file is subject to the terms and conditions of the GNU General Public
++ *  License.  See the file COPYING in the main directory of this archive for
++ *  more details.
++ */
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/fb.h>
++#include <linux/selection.h>
++#include <linux/slab.h>
++#include <linux/vt_kern.h>
++#include <asm/irq.h>
++
++#include "fbcon.h"
++#include "fbcondecor.h"
++
++#define parse_pixel(shift,bpp,type)						\
++	do {									\
++		if (d & (0x80 >> (shift)))					\
++			dd2[(shift)] = fgx;					\
++		else								\
++			dd2[(shift)] = transparent ? *(type *)decor_src : bgx;	\
++		decor_src += (bpp);						\
++	} while (0)								\
++
++extern int get_color(struct vc_data *vc, struct fb_info *info,
++		     u16 c, int is_fg);
++
++void fbcon_decor_fix_pseudo_pal(struct fb_info *info, struct vc_data *vc)
++{
++	int i, j, k;
++	int minlen = min(min(info->var.red.length, info->var.green.length),
++			     info->var.blue.length);
++	u32 col;
++
++	for (j = i = 0; i < 16; i++) {
++		k = color_table[i];
++
++		col = ((vc->vc_palette[j++]  >> (8-minlen))
++			<< info->var.red.offset);
++		col |= ((vc->vc_palette[j++] >> (8-minlen))
++			<< info->var.green.offset);
++		col |= ((vc->vc_palette[j++] >> (8-minlen))
++			<< info->var.blue.offset);
++			((u32 *)info->pseudo_palette)[k] = col;
++	}
++}
++
++void fbcon_decor_renderc(struct fb_info *info, int ypos, int xpos, int height,
++		      int width, u8* src, u32 fgx, u32 bgx, u8 transparent)
++{
++	unsigned int x, y;
++	u32 dd;
++	int bytespp = ((info->var.bits_per_pixel + 7) >> 3);
++	unsigned int d = ypos * info->fix.line_length + xpos * bytespp;
++	unsigned int ds = (ypos * info->var.xres + xpos) * bytespp;
++	u16 dd2[4];
++
++	u8* decor_src = (u8 *)(info->bgdecor.data + ds);
++	u8* dst = (u8 *)(info->screen_base + d);
++
++	if ((ypos + height) > info->var.yres || (xpos + width) > info->var.xres)
++		return;
++
++	for (y = 0; y < height; y++) {
++		switch (info->var.bits_per_pixel) {
++
++		case 32:
++			for (x = 0; x < width; x++) {
++
++				if ((x & 7) == 0)
++					d = *src++;
++				if (d & 0x80)
++					dd = fgx;
++				else
++					dd = transparent ?
++					     *(u32 *)decor_src : bgx;
++
++				d <<= 1;
++				decor_src += 4;
++				fb_writel(dd, dst);
++				dst += 4;
++			}
++			break;
++		case 24:
++			for (x = 0; x < width; x++) {
++
++				if ((x & 7) == 0)
++					d = *src++;
++				if (d & 0x80)
++					dd = fgx;
++				else
++					dd = transparent ?
++					     (*(u32 *)decor_src & 0xffffff) : bgx;
++
++				d <<= 1;
++				decor_src += 3;
++#ifdef __LITTLE_ENDIAN
++				fb_writew(dd & 0xffff, dst);
++				dst += 2;
++				fb_writeb((dd >> 16), dst);
++#else
++				fb_writew(dd >> 8, dst);
++				dst += 2;
++				fb_writeb(dd & 0xff, dst);
++#endif
++				dst++;
++			}
++			break;
++		case 16:
++			for (x = 0; x < width; x += 2) {
++				if ((x & 7) == 0)
++					d = *src++;
++
++				parse_pixel(0, 2, u16);
++				parse_pixel(1, 2, u16);
++#ifdef __LITTLE_ENDIAN
++				dd = dd2[0] | (dd2[1] << 16);
++#else
++				dd = dd2[1] | (dd2[0] << 16);
++#endif
++				d <<= 2;
++				fb_writel(dd, dst);
++				dst += 4;
++			}
++			break;
++
++		case 8:
++			for (x = 0; x < width; x += 4) {
++				if ((x & 7) == 0)
++					d = *src++;
++
++				parse_pixel(0, 1, u8);
++				parse_pixel(1, 1, u8);
++				parse_pixel(2, 1, u8);
++				parse_pixel(3, 1, u8);
++
++#ifdef __LITTLE_ENDIAN
++				dd = dd2[0] | (dd2[1] << 8) | (dd2[2] << 16) | (dd2[3] << 24);
++#else
++				dd = dd2[3] | (dd2[2] << 8) | (dd2[1] << 16) | (dd2[0] << 24);
++#endif
++				d <<= 4;
++				fb_writel(dd, dst);
++				dst += 4;
++			}
++		}
++
++		dst += info->fix.line_length - width * bytespp;
++		decor_src += (info->var.xres - width) * bytespp;
++	}
++}
++
++#define cc2cx(a) 						\
++	((info->fix.visual == FB_VISUAL_TRUECOLOR || 		\
++	  info->fix.visual == FB_VISUAL_DIRECTCOLOR) ? 		\
++	 ((u32*)info->pseudo_palette)[a] : a)
++
++void fbcon_decor_putcs(struct vc_data *vc, struct fb_info *info,
++		   const unsigned short *s, int count, int yy, int xx)
++{
++	unsigned short charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
++	struct fbcon_ops *ops = info->fbcon_par;
++	int fg_color, bg_color, transparent;
++	u8 *src;
++	u32 bgx, fgx;
++	u16 c = scr_readw(s);
++
++	fg_color = get_color(vc, info, c, 1);
++        bg_color = get_color(vc, info, c, 0);
++
++	/* Don't paint the background image if console is blanked */
++	transparent = ops->blank_state ? 0 :
++		(vc->vc_decor.bg_color == bg_color);
++
++	xx = xx * vc->vc_font.width + vc->vc_decor.tx;
++	yy = yy * vc->vc_font.height + vc->vc_decor.ty;
++
++	fgx = cc2cx(fg_color);
++	bgx = cc2cx(bg_color);
++
++	while (count--) {
++		c = scr_readw(s++);
++		src = vc->vc_font.data + (c & charmask) * vc->vc_font.height *
++		      ((vc->vc_font.width + 7) >> 3);
++
++		fbcon_decor_renderc(info, yy, xx, vc->vc_font.height,
++			       vc->vc_font.width, src, fgx, bgx, transparent);
++		xx += vc->vc_font.width;
++	}
++}
++
++void fbcon_decor_cursor(struct fb_info *info, struct fb_cursor *cursor)
++{
++	int i;
++	unsigned int dsize, s_pitch;
++	struct fbcon_ops *ops = info->fbcon_par;
++	struct vc_data* vc;
++	u8 *src;
++
++	/* we really don't need any cursors while the console is blanked */
++	if (info->state != FBINFO_STATE_RUNNING || ops->blank_state)
++		return;
++
++	vc = vc_cons[ops->currcon].d;
++
++	src = kmalloc(64 + sizeof(struct fb_image), GFP_ATOMIC);
++	if (!src)
++		return;
++
++	s_pitch = (cursor->image.width + 7) >> 3;
++	dsize = s_pitch * cursor->image.height;
++	if (cursor->enable) {
++		switch (cursor->rop) {
++		case ROP_XOR:
++			for (i = 0; i < dsize; i++)
++				src[i] = cursor->image.data[i] ^ cursor->mask[i];
++                        break;
++		case ROP_COPY:
++		default:
++			for (i = 0; i < dsize; i++)
++				src[i] = cursor->image.data[i] & cursor->mask[i];
++			break;
++		}
++	} else
++		memcpy(src, cursor->image.data, dsize);
++
++	fbcon_decor_renderc(info,
++			cursor->image.dy + vc->vc_decor.ty,
++			cursor->image.dx + vc->vc_decor.tx,
++			cursor->image.height,
++			cursor->image.width,
++			(u8*)src,
++			cc2cx(cursor->image.fg_color),
++			cc2cx(cursor->image.bg_color),
++			cursor->image.bg_color == vc->vc_decor.bg_color);
++
++	kfree(src);
++}
++
++static void decorset(u8 *dst, int height, int width, int dstbytes,
++		        u32 bgx, int bpp)
++{
++	int i;
++
++	if (bpp == 8)
++		bgx |= bgx << 8;
++	if (bpp == 16 || bpp == 8)
++		bgx |= bgx << 16;
++
++	while (height-- > 0) {
++		u8 *p = dst;
++
++		switch (bpp) {
++
++		case 32:
++			for (i=0; i < width; i++) {
++				fb_writel(bgx, p); p += 4;
++			}
++			break;
++		case 24:
++			for (i=0; i < width; i++) {
++#ifdef __LITTLE_ENDIAN
++				fb_writew((bgx & 0xffff),(u16*)p); p += 2;
++				fb_writeb((bgx >> 16),p++);
++#else
++				fb_writew((bgx >> 8),(u16*)p); p += 2;
++				fb_writeb((bgx & 0xff),p++);
++#endif
++			}
++		case 16:
++			for (i=0; i < width/4; i++) {
++				fb_writel(bgx,p); p += 4;
++				fb_writel(bgx,p); p += 4;
++			}
++			if (width & 2) {
++				fb_writel(bgx,p); p += 4;
++			}
++			if (width & 1)
++				fb_writew(bgx,(u16*)p);
++			break;
++		case 8:
++			for (i=0; i < width/4; i++) {
++				fb_writel(bgx,p); p += 4;
++			}
++
++			if (width & 2) {
++				fb_writew(bgx,p); p += 2;
++			}
++			if (width & 1)
++				fb_writeb(bgx,(u8*)p);
++			break;
++
++		}
++		dst += dstbytes;
++	}
++}
++
++void fbcon_decor_copy(u8 *dst, u8 *src, int height, int width, int linebytes,
++		   int srclinebytes, int bpp)
++{
++	int i;
++
++	while (height-- > 0) {
++		u32 *p = (u32 *)dst;
++		u32 *q = (u32 *)src;
++
++		switch (bpp) {
++
++		case 32:
++			for (i=0; i < width; i++)
++				fb_writel(*q++, p++);
++			break;
++		case 24:
++			for (i=0; i < (width*3/4); i++)
++				fb_writel(*q++, p++);
++			if ((width*3) % 4) {
++				if (width & 2) {
++					fb_writeb(*(u8*)q, (u8*)p);
++				} else if (width & 1) {
++					fb_writew(*(u16*)q, (u16*)p);
++					fb_writeb(*(u8*)((u16*)q+1),(u8*)((u16*)p+2));
++				}
++			}
++			break;
++		case 16:
++			for (i=0; i < width/4; i++) {
++				fb_writel(*q++, p++);
++				fb_writel(*q++, p++);
++			}
++			if (width & 2)
++				fb_writel(*q++, p++);
++			if (width & 1)
++				fb_writew(*(u16*)q, (u16*)p);
++			break;
++		case 8:
++			for (i=0; i < width/4; i++)
++				fb_writel(*q++, p++);
++
++			if (width & 2) {
++				fb_writew(*(u16*)q, (u16*)p);
++				q = (u32*) ((u16*)q + 1);
++				p = (u32*) ((u16*)p + 1);
++			}
++			if (width & 1)
++				fb_writeb(*(u8*)q, (u8*)p);
++			break;
++		}
++
++		dst += linebytes;
++		src += srclinebytes;
++	}
++}
++
++static void decorfill(struct fb_info *info, int sy, int sx, int height,
++		       int width)
++{
++	int bytespp = ((info->var.bits_per_pixel + 7) >> 3);
++	int d  = sy * info->fix.line_length + sx * bytespp;
++	int ds = (sy * info->var.xres + sx) * bytespp;
++
++	fbcon_decor_copy((u8 *)(info->screen_base + d), (u8 *)(info->bgdecor.data + ds),
++		    height, width, info->fix.line_length, info->var.xres * bytespp,
++		    info->var.bits_per_pixel);
++}
++
++void fbcon_decor_clear(struct vc_data *vc, struct fb_info *info, int sy, int sx,
++		    int height, int width)
++{
++	int bgshift = (vc->vc_hi_font_mask) ? 13 : 12;
++	struct fbcon_ops *ops = info->fbcon_par;
++	u8 *dst;
++	int transparent, bg_color = attr_bgcol_ec(bgshift, vc, info);
++
++	transparent = (vc->vc_decor.bg_color == bg_color);
++	sy = sy * vc->vc_font.height + vc->vc_decor.ty;
++	sx = sx * vc->vc_font.width + vc->vc_decor.tx;
++	height *= vc->vc_font.height;
++	width *= vc->vc_font.width;
++
++	/* Don't paint the background image if console is blanked */
++	if (transparent && !ops->blank_state) {
++		decorfill(info, sy, sx, height, width);
++	} else {
++		dst = (u8 *)(info->screen_base + sy * info->fix.line_length +
++			     sx * ((info->var.bits_per_pixel + 7) >> 3));
++		decorset(dst, height, width, info->fix.line_length, cc2cx(bg_color),
++			  info->var.bits_per_pixel);
++	}
++}
++
++void fbcon_decor_clear_margins(struct vc_data *vc, struct fb_info *info,
++			    int bottom_only)
++{
++	unsigned int tw = vc->vc_cols*vc->vc_font.width;
++	unsigned int th = vc->vc_rows*vc->vc_font.height;
++
++	if (!bottom_only) {
++		/* top margin */
++		decorfill(info, 0, 0, vc->vc_decor.ty, info->var.xres);
++		/* left margin */
++		decorfill(info, vc->vc_decor.ty, 0, th, vc->vc_decor.tx);
++		/* right margin */
++		decorfill(info, vc->vc_decor.ty, vc->vc_decor.tx + tw, th, 
++			   info->var.xres - vc->vc_decor.tx - tw);
++	}
++	decorfill(info, vc->vc_decor.ty + th, 0, 
++		   info->var.yres - vc->vc_decor.ty - th, info->var.xres);
++}
++
++void fbcon_decor_bmove_redraw(struct vc_data *vc, struct fb_info *info, int y, 
++			   int sx, int dx, int width)
++{
++	u16 *d = (u16 *) (vc->vc_origin + vc->vc_size_row * y + dx * 2);
++	u16 *s = d + (dx - sx);
++	u16 *start = d;
++	u16 *ls = d;
++	u16 *le = d + width;
++	u16 c;
++	int x = dx;
++	u16 attr = 1;
++
++	do {
++		c = scr_readw(d);
++		if (attr != (c & 0xff00)) {
++			attr = c & 0xff00;
++			if (d > start) {
++				fbcon_decor_putcs(vc, info, start, d - start, y, x);
++				x += d - start;
++				start = d;
++			}
++		}
++		if (s >= ls && s < le && c == scr_readw(s)) {
++			if (d > start) {
++				fbcon_decor_putcs(vc, info, start, d - start, y, x);
++				x += d - start + 1;
++				start = d + 1;
++			} else {
++				x++;
++				start++;
++			}
++		}
++		s++;
++		d++;
++	} while (d < le);
++	if (d > start)
++		fbcon_decor_putcs(vc, info, start, d - start, y, x);
++}
++
++void fbcon_decor_blank(struct vc_data *vc, struct fb_info *info, int blank)
++{
++	if (blank) {
++		decorset((u8 *)info->screen_base, info->var.yres, info->var.xres,
++			  info->fix.line_length, 0, info->var.bits_per_pixel);
++	} else {
++		update_screen(vc);
++		fbcon_decor_clear_margins(vc, info, 0);
++	}
++}
++
+diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
+index 2e471c2..b9679a7e 100644
+--- a/drivers/video/console/fbcon.c
++++ b/drivers/video/console/fbcon.c
+@@ -26,7 +26,7 @@
+  *
+  *  Hardware cursor support added by Emmanuel Marty (core@×××××××××××.org)
+  *  Smart redraw scrolling, arbitrary font width support, 512char font support
+- *  and software scrollback added by 
++ *  and software scrollback added by
+  *                         Jakub Jelinek (jj@×××××××××××.cz)
+  *
+  *  Random hacking by Martin Mares <mj@×××.cz>
+@@ -79,6 +79,7 @@
+ #include <asm/irq.h>
+ 
+ #include "fbcon.h"
++#include "fbcondecor.h"
+ 
+ #ifdef FBCONDEBUG
+ #  define DPRINTK(fmt, args...) printk(KERN_DEBUG "%s: " fmt, __func__ , ## args)
+@@ -94,7 +95,7 @@ enum {
+ 
+ static struct display fb_display[MAX_NR_CONSOLES];
+ 
+-static signed char con2fb_map[MAX_NR_CONSOLES];
++signed char con2fb_map[MAX_NR_CONSOLES];
+ static signed char con2fb_map_boot[MAX_NR_CONSOLES];
+ 
+ static int logo_lines;
+@@ -110,7 +111,7 @@ static int softback_lines;
+ /* console mappings */
+ static int first_fb_vc;
+ static int last_fb_vc = MAX_NR_CONSOLES - 1;
+-static int fbcon_is_default = 1; 
++static int fbcon_is_default = 1;
+ static int fbcon_has_exited;
+ static int primary_device = -1;
+ static int fbcon_has_console_bind;
+@@ -286,7 +287,7 @@ static inline int fbcon_is_inactive(struct vc_data *vc, struct fb_info *info)
+ 		!vt_force_oops_output(vc);
+ }
+ 
+-static int get_color(struct vc_data *vc, struct fb_info *info,
++int get_color(struct vc_data *vc, struct fb_info *info,
+ 	      u16 c, int is_fg)
+ {
+ 	int depth = fb_get_color_depth(&info->var, &info->fix);
+@@ -465,7 +466,7 @@ static int __init fb_console_setup(char *this_opt)
+ 			} else
+ 				return 1;
+ 		}
+-		
++
+ 		if (!strncmp(options, "map:", 4)) {
+ 			options += 4;
+ 			if (*options) {
+@@ -490,8 +491,8 @@ static int __init fb_console_setup(char *this_opt)
+ 				first_fb_vc = 0;
+ 			if (*options++ == '-')
+ 				last_fb_vc = simple_strtoul(options, &options, 10) - 1;
+-			fbcon_is_default = 0; 
+-		}	
++			fbcon_is_default = 0;
++		}
+ 
+ 		if (!strncmp(options, "rotate:", 7)) {
+ 			options += 7;
+@@ -552,6 +553,9 @@ static int fbcon_takeover(int show_logo)
+ 		info_idx = -1;
+ 	} else {
+ 		fbcon_has_console_bind = 1;
++#ifdef CONFIG_FB_CON_DECOR
++		fbcon_decor_init();
++#endif
+ 	}
+ 
+ 	return err;
+@@ -942,7 +946,7 @@ static const char *fbcon_startup(void)
+ 	info = registered_fb[info_idx];
+ 	if (!info)
+ 		return NULL;
+-	
++
+ 	owner = info->fbops->owner;
+ 	if (!try_module_get(owner))
+ 		return NULL;
+@@ -1006,6 +1010,12 @@ static const char *fbcon_startup(void)
+ 	rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
+ 	cols /= vc->vc_font.width;
+ 	rows /= vc->vc_font.height;
++
++	if (fbcon_decor_active(info, vc)) {
++		cols = vc->vc_decor.twidth / vc->vc_font.width;
++		rows = vc->vc_decor.theight / vc->vc_font.height;
++	}
++
+ 	vc_resize(vc, cols, rows);
+ 
+ 	DPRINTK("mode:   %s\n", info->fix.id);
+@@ -1035,7 +1045,7 @@ static void fbcon_init(struct vc_data *vc, int init)
+ 	cap = info->flags;
+ 
+ 	if (vc != svc || logo_shown == FBCON_LOGO_DONTSHOW ||
+-	    (info->fix.type == FB_TYPE_TEXT))
++	    (info->fix.type == FB_TYPE_TEXT) || fbcon_decor_active(info, vc))
+ 		logo = 0;
+ 
+ 	if (var_to_display(p, &info->var, info))
+@@ -1245,6 +1255,11 @@ static void fbcon_clear(struct vc_data *vc, int sy, int sx, int height,
+ 	if (sy < vc->vc_top && vc->vc_top == logo_lines)
+ 		vc->vc_top = 0;
+ 
++ 	if (fbcon_decor_active(info, vc)) {
++ 		fbcon_decor_clear(vc, info, sy, sx, height, width);
++ 		return;
++ 	}
++
+ 	/* Split blits that cross physical y_wrap boundary */
+ 
+ 	y_break = p->vrows - p->yscroll;
+@@ -1264,10 +1279,15 @@ static void fbcon_putcs(struct vc_data *vc, const unsigned short *s,
+ 	struct display *p = &fb_display[vc->vc_num];
+ 	struct fbcon_ops *ops = info->fbcon_par;
+ 
+-	if (!fbcon_is_inactive(vc, info))
+-		ops->putcs(vc, info, s, count, real_y(p, ypos), xpos,
+-			   get_color(vc, info, scr_readw(s), 1),
+-			   get_color(vc, info, scr_readw(s), 0));
++	if (!fbcon_is_inactive(vc, info)) {
++
++		if (fbcon_decor_active(info, vc))
++			fbcon_decor_putcs(vc, info, s, count, ypos, xpos);
++		else
++			ops->putcs(vc, info, s, count, real_y(p, ypos), xpos,
++				   get_color(vc, info, scr_readw(s), 1),
++				   get_color(vc, info, scr_readw(s), 0));
++	}
+ }
+ 
+ static void fbcon_putc(struct vc_data *vc, int c, int ypos, int xpos)
+@@ -1283,8 +1303,13 @@ static void fbcon_clear_margins(struct vc_data *vc, int bottom_only)
+ 	struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
+ 	struct fbcon_ops *ops = info->fbcon_par;
+ 
+-	if (!fbcon_is_inactive(vc, info))
+-		ops->clear_margins(vc, info, bottom_only);
++	if (!fbcon_is_inactive(vc, info)) {
++	 	if (fbcon_decor_active(info, vc)) {
++	 		fbcon_decor_clear_margins(vc, info, bottom_only);
++ 		} else {
++			ops->clear_margins(vc, info, bottom_only);
++		}
++	}
+ }
+ 
+ static void fbcon_cursor(struct vc_data *vc, int mode)
+@@ -1394,7 +1419,7 @@ static __inline__ void ywrap_up(struct vc_data *vc, int count)
+ 	struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
+ 	struct fbcon_ops *ops = info->fbcon_par;
+ 	struct display *p = &fb_display[vc->vc_num];
+-	
++
+ 	p->yscroll += count;
+ 	if (p->yscroll >= p->vrows)	/* Deal with wrap */
+ 		p->yscroll -= p->vrows;
+@@ -1413,7 +1438,7 @@ static __inline__ void ywrap_down(struct vc_data *vc, int count)
+ 	struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
+ 	struct fbcon_ops *ops = info->fbcon_par;
+ 	struct display *p = &fb_display[vc->vc_num];
+-	
++
+ 	p->yscroll -= count;
+ 	if (p->yscroll < 0)	/* Deal with wrap */
+ 		p->yscroll += p->vrows;
+@@ -1480,7 +1505,7 @@ static __inline__ void ypan_down(struct vc_data *vc, int count)
+ 	struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
+ 	struct display *p = &fb_display[vc->vc_num];
+ 	struct fbcon_ops *ops = info->fbcon_par;
+-	
++
+ 	p->yscroll -= count;
+ 	if (p->yscroll < 0) {
+ 		ops->bmove(vc, info, 0, 0, p->vrows - vc->vc_rows,
+@@ -1804,7 +1829,7 @@ static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir,
+ 			count = vc->vc_rows;
+ 		if (softback_top)
+ 			fbcon_softback_note(vc, t, count);
+-		if (logo_shown >= 0)
++		if (logo_shown >= 0 || fbcon_decor_active(info, vc))
+ 			goto redraw_up;
+ 		switch (p->scrollmode) {
+ 		case SCROLL_MOVE:
+@@ -1897,6 +1922,8 @@ static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir,
+ 			count = vc->vc_rows;
+ 		if (logo_shown >= 0)
+ 			goto redraw_down;
++		if (fbcon_decor_active(info, vc))
++			goto redraw_down;
+ 		switch (p->scrollmode) {
+ 		case SCROLL_MOVE:
+ 			fbcon_redraw_blit(vc, info, p, b - 1, b - t - count,
+@@ -1989,7 +2016,7 @@ static void fbcon_bmove(struct vc_data *vc, int sy, int sx, int dy, int dx,
+ {
+ 	struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
+ 	struct display *p = &fb_display[vc->vc_num];
+-	
++
+ 	if (fbcon_is_inactive(vc, info))
+ 		return;
+ 
+@@ -2007,7 +2034,7 @@ static void fbcon_bmove(struct vc_data *vc, int sy, int sx, int dy, int dx,
+ 			p->vrows - p->yscroll);
+ }
+ 
+-static void fbcon_bmove_rec(struct vc_data *vc, struct display *p, int sy, int sx, 
++static void fbcon_bmove_rec(struct vc_data *vc, struct display *p, int sy, int sx,
+ 			    int dy, int dx, int height, int width, u_int y_break)
+ {
+ 	struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
+@@ -2045,6 +2072,13 @@ static void fbcon_bmove_rec(struct vc_data *vc, struct display *p, int sy, int s
+ 		}
+ 		return;
+ 	}
++
++	if (fbcon_decor_active(info, vc) && sy == dy && height == 1) {
++ 		/* must use slower redraw bmove to keep background pic intact */
++ 		fbcon_decor_bmove_redraw(vc, info, sy, sx, dx, width);
++ 		return;
++ 	}
++
+ 	ops->bmove(vc, info, real_y(p, sy), sx, real_y(p, dy), dx,
+ 		   height, width);
+ }
+@@ -2096,7 +2130,7 @@ static void updatescrollmode(struct display *p,
+ 	}
+ }
+ 
+-static int fbcon_resize(struct vc_data *vc, unsigned int width, 
++static int fbcon_resize(struct vc_data *vc, unsigned int width,
+ 			unsigned int height, unsigned int user)
+ {
+ 	struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
+@@ -2115,8 +2149,8 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
+ 	var.yres = virt_h * virt_fh;
+ 	x_diff = info->var.xres - var.xres;
+ 	y_diff = info->var.yres - var.yres;
+-	if (x_diff < 0 || x_diff > virt_fw ||
+-	    y_diff < 0 || y_diff > virt_fh) {
++	if ((x_diff < 0 || x_diff > virt_fw ||
++		y_diff < 0 || y_diff > virt_fh) && !vc->vc_decor.state) {
+ 		const struct fb_videomode *mode;
+ 
+ 		DPRINTK("attempting resize %ix%i\n", var.xres, var.yres);
+@@ -2152,6 +2186,21 @@ static int fbcon_switch(struct vc_data *vc)
+ 
+ 	info = registered_fb[con2fb_map[vc->vc_num]];
+ 	ops = info->fbcon_par;
++	prev_console = ops->currcon;
++	if (prev_console != -1)
++		old_info = registered_fb[con2fb_map[prev_console]];
++
++#ifdef CONFIG_FB_CON_DECOR
++	if (!fbcon_decor_active_vc(vc) && info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
++		struct vc_data *vc_curr = vc_cons[prev_console].d;
++		if (vc_curr && fbcon_decor_active_vc(vc_curr)) {
++			/* Clear the screen to avoid displaying funky colors during
++			 * palette updates. */
++			memset((u8*)info->screen_base + info->fix.line_length * info->var.yoffset,
++			       0, info->var.yres * info->fix.line_length);
++		}
++	}
++#endif
+ 
+ 	if (softback_top) {
+ 		if (softback_lines)
+@@ -2170,9 +2219,6 @@ static int fbcon_switch(struct vc_data *vc)
+ 		logo_shown = FBCON_LOGO_CANSHOW;
+ 	}
+ 
+-	prev_console = ops->currcon;
+-	if (prev_console != -1)
+-		old_info = registered_fb[con2fb_map[prev_console]];
+ 	/*
+ 	 * FIXME: If we have multiple fbdev's loaded, we need to
+ 	 * update all info->currcon.  Perhaps, we can place this
+@@ -2216,6 +2262,18 @@ static int fbcon_switch(struct vc_data *vc)
+ 			fbcon_del_cursor_timer(old_info);
+ 	}
+ 
++	if (fbcon_decor_active_vc(vc)) {
++		struct vc_data *vc_curr = vc_cons[prev_console].d;
++
++		if (!vc_curr->vc_decor.theme ||
++			strcmp(vc->vc_decor.theme, vc_curr->vc_decor.theme) ||
++			(fbcon_decor_active_nores(info, vc_curr) &&
++			 !fbcon_decor_active(info, vc_curr))) {
++			fbcon_decor_disable(vc, 0);
++			fbcon_decor_call_helper("modechange", vc->vc_num);
++		}
++	}
++
+ 	if (fbcon_is_inactive(vc, info) ||
+ 	    ops->blank_state != FB_BLANK_UNBLANK)
+ 		fbcon_del_cursor_timer(info);
+@@ -2264,11 +2322,10 @@ static int fbcon_switch(struct vc_data *vc)
+ 	    ops->update_start(info);
+ 	}
+ 
+-	fbcon_set_palette(vc, color_table); 	
++	fbcon_set_palette(vc, color_table);
+ 	fbcon_clear_margins(vc, 0);
+ 
+ 	if (logo_shown == FBCON_LOGO_DRAW) {
+-
+ 		logo_shown = fg_console;
+ 		/* This is protected above by initmem_freed */
+ 		fb_show_logo(info, ops->rotate);
+@@ -2324,15 +2381,20 @@ static int fbcon_blank(struct vc_data *vc, int blank, int mode_switch)
+ 		}
+ 	}
+ 
+- 	if (!fbcon_is_inactive(vc, info)) {
++	if (!fbcon_is_inactive(vc, info)) {
+ 		if (ops->blank_state != blank) {
+ 			ops->blank_state = blank;
+ 			fbcon_cursor(vc, blank ? CM_ERASE : CM_DRAW);
+ 			ops->cursor_flash = (!blank);
+ 
+-			if (!(info->flags & FBINFO_MISC_USEREVENT))
+-				if (fb_blank(info, blank))
+-					fbcon_generic_blank(vc, info, blank);
++			if (!(info->flags & FBINFO_MISC_USEREVENT)) {
++				if (fb_blank(info, blank)) {
++					if (fbcon_decor_active(info, vc))
++						fbcon_decor_blank(vc, info, blank);
++					else
++						fbcon_generic_blank(vc, info, blank);
++				}
++			}
+ 		}
+ 
+ 		if (!blank)
+@@ -2454,7 +2516,7 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
+ 			vc->vc_complement_mask >>= 1;
+ 			vc->vc_s_complement_mask >>= 1;
+ 		}
+-			
++
+ 		/* ++Edmund: reorder the attribute bits */
+ 		if (vc->vc_can_do_color) {
+ 			unsigned short *cp =
+@@ -2477,7 +2539,7 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
+ 			vc->vc_complement_mask <<= 1;
+ 			vc->vc_s_complement_mask <<= 1;
+ 		}
+-			
++
+ 		/* ++Edmund: reorder the attribute bits */
+ 		{
+ 			unsigned short *cp =
+@@ -2507,13 +2569,22 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
+ 	}
+ 
+ 	if (resize) {
++		/* reset wrap/pan */
+ 		int cols, rows;
+ 
+ 		cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
+ 		rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
++
++		if (fbcon_decor_active(info, vc)) {
++			info->var.xoffset = info->var.yoffset = p->yscroll = 0;
++			cols = vc->vc_decor.twidth;
++			rows = vc->vc_decor.theight;
++		}
+ 		cols /= w;
+ 		rows /= h;
++
+ 		vc_resize(vc, cols, rows);
++
+ 		if (CON_IS_VISIBLE(vc) && softback_buf)
+ 			fbcon_update_softback(vc);
+ 	} else if (CON_IS_VISIBLE(vc)
+@@ -2597,7 +2661,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne
+ 	/* Check if the same font is on some other console already */
+ 	for (i = first_fb_vc; i <= last_fb_vc; i++) {
+ 		struct vc_data *tmp = vc_cons[i].d;
+-		
++
+ 		if (fb_display[i].userfont &&
+ 		    fb_display[i].fontdata &&
+ 		    FNTSUM(fb_display[i].fontdata) == csum &&
+@@ -2642,7 +2713,11 @@ static int fbcon_set_palette(struct vc_data *vc, unsigned char *table)
+ 	int i, j, k, depth;
+ 	u8 val;
+ 
+-	if (fbcon_is_inactive(vc, info))
++	if (fbcon_is_inactive(vc, info)
++#ifdef CONFIG_FB_CON_DECOR
++			|| vc->vc_num != fg_console
++#endif
++		)
+ 		return -EINVAL;
+ 
+ 	if (!CON_IS_VISIBLE(vc))
+@@ -2668,14 +2743,56 @@ static int fbcon_set_palette(struct vc_data *vc, unsigned char *table)
+ 	} else
+ 		fb_copy_cmap(fb_default_cmap(1 << depth), &palette_cmap);
+ 
+-	return fb_set_cmap(&palette_cmap, info);
++	if (fbcon_decor_active(info, vc_cons[fg_console].d) &&
++	    info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
++
++		u16 *red, *green, *blue;
++		int minlen = min(min(info->var.red.length, info->var.green.length),
++				     info->var.blue.length);
++		int h;
++
++		struct fb_cmap cmap = {
++			.start = 0,
++			.len = (1 << minlen),
++			.red = NULL,
++			.green = NULL,
++			.blue = NULL,
++			.transp = NULL
++		};
++
++		red = kmalloc(256 * sizeof(u16) * 3, GFP_KERNEL);
++
++		if (!red)
++			goto out;
++
++		green = red + 256;
++		blue = green + 256;
++		cmap.red = red;
++		cmap.green = green;
++		cmap.blue = blue;
++
++		for (i = 0; i < cmap.len; i++) {
++			red[i] = green[i] = blue[i] = (0xffff * i)/(cmap.len-1);
++		}
++
++		h = fb_set_cmap(&cmap, info);
++		fbcon_decor_fix_pseudo_pal(info, vc_cons[fg_console].d);
++		kfree(red);
++
++		return h;
++
++	} else if (fbcon_decor_active(info, vc_cons[fg_console].d) &&
++		   info->var.bits_per_pixel == 8 && info->bgdecor.cmap.red != NULL)
++		fb_set_cmap(&info->bgdecor.cmap, info);
++
++out:	return fb_set_cmap(&palette_cmap, info);
+ }
+ 
+ static u16 *fbcon_screen_pos(struct vc_data *vc, int offset)
+ {
+ 	unsigned long p;
+ 	int line;
+-	
++
+ 	if (vc->vc_num != fg_console || !softback_lines)
+ 		return (u16 *) (vc->vc_origin + offset);
+ 	line = offset / vc->vc_size_row;
+@@ -2894,7 +3011,14 @@ static void fbcon_modechanged(struct fb_info *info)
+ 		rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
+ 		cols /= vc->vc_font.width;
+ 		rows /= vc->vc_font.height;
+-		vc_resize(vc, cols, rows);
++
++		if (!fbcon_decor_active_nores(info, vc)) {
++			vc_resize(vc, cols, rows);
++		} else {
++			fbcon_decor_disable(vc, 0);
++			fbcon_decor_call_helper("modechange", vc->vc_num);
++		}
++
+ 		updatescrollmode(p, info, vc);
+ 		scrollback_max = 0;
+ 		scrollback_current = 0;
+@@ -2939,7 +3063,9 @@ static void fbcon_set_all_vcs(struct fb_info *info)
+ 		rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
+ 		cols /= vc->vc_font.width;
+ 		rows /= vc->vc_font.height;
+-		vc_resize(vc, cols, rows);
++		if (!fbcon_decor_active_nores(info, vc)) {
++			vc_resize(vc, cols, rows);
++		}
+ 	}
+ 
+ 	if (fg != -1)
+@@ -3549,6 +3675,7 @@ static void fbcon_exit(void)
+ 		}
+ 	}
+ 
++	fbcon_decor_exit();
+ 	fbcon_has_exited = 1;
+ }
+ 
+@@ -3602,7 +3729,7 @@ static void __exit fb_console_exit(void)
+ 	fbcon_exit();
+ 	console_unlock();
+ 	unregister_con_driver(&fb_con);
+-}	
++}
+ 
+ module_exit(fb_console_exit);
+ 
+diff --git a/drivers/video/console/fbcondecor.c b/drivers/video/console/fbcondecor.c
+new file mode 100644
+index 0000000..7189ce6
+--- /dev/null
++++ b/drivers/video/console/fbcondecor.c
+@@ -0,0 +1,555 @@
++/*
++ *  linux/drivers/video/console/fbcondecor.c -- Framebuffer console decorations
++ *
++ *  Copyright (C) 2004-2009 Michal Januszewski <spock@g.o>
++ *
++ *  Code based upon "Bootsplash" (C) 2001-2003
++ *       Volker Poplawski <volker@×××××××××.de>,
++ *       Stefan Reinauer <stepan@××××.de>,
++ *       Steffen Winterfeldt <snwint@××××.de>,
++ *       Michael Schroeder <mls@××××.de>,
++ *       Ken Wimer <wimer@××××.de>.
++ *
++ *  Compat ioctl support by Thorsten Klein <TK@××××××××××××××.de>.
++ *
++ *  This file is subject to the terms and conditions of the GNU General Public
++ *  License.  See the file COPYING in the main directory of this archive for
++ *  more details.
++ *
++ */
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/string.h>
++#include <linux/types.h>
++#include <linux/fb.h>
++#include <linux/vt_kern.h>
++#include <linux/vmalloc.h>
++#include <linux/unistd.h>
++#include <linux/syscalls.h>
++#include <linux/init.h>
++#include <linux/proc_fs.h>
++#include <linux/workqueue.h>
++#include <linux/kmod.h>
++#include <linux/miscdevice.h>
++#include <linux/device.h>
++#include <linux/fs.h>
++#include <linux/compat.h>
++#include <linux/console.h>
++
++#include <asm/uaccess.h>
++#include <asm/irq.h>
++
++#include "fbcon.h"
++#include "fbcondecor.h"
++
++extern signed char con2fb_map[];
++static int fbcon_decor_enable(struct vc_data *vc);
++char fbcon_decor_path[KMOD_PATH_LEN] = "/sbin/fbcondecor_helper";
++static int initialized = 0;
++
++int fbcon_decor_call_helper(char* cmd, unsigned short vc)
++{
++	char *envp[] = {
++		"HOME=/",
++		"PATH=/sbin:/bin",
++		NULL
++	};
++
++	char tfb[5];
++	char tcons[5];
++	unsigned char fb = (int) con2fb_map[vc];
++
++	char *argv[] = {
++		fbcon_decor_path,
++		"2",
++		cmd,
++		tcons,
++		tfb,
++		vc_cons[vc].d->vc_decor.theme,
++		NULL
++	};
++
++	snprintf(tfb,5,"%d",fb);
++	snprintf(tcons,5,"%d",vc);
++
++	return call_usermodehelper(fbcon_decor_path, argv, envp, UMH_WAIT_EXEC);
++}
++
++/* Disables fbcondecor on a virtual console; called with console sem held. */
++int fbcon_decor_disable(struct vc_data *vc, unsigned char redraw)
++{
++	struct fb_info* info;
++
++	if (!vc->vc_decor.state)
++		return -EINVAL;
++
++	info = registered_fb[(int) con2fb_map[vc->vc_num]];
++
++	if (info == NULL)
++		return -EINVAL;
++
++	vc->vc_decor.state = 0;
++	vc_resize(vc, info->var.xres / vc->vc_font.width,
++		  info->var.yres / vc->vc_font.height);
++
++	if (fg_console == vc->vc_num && redraw) {
++		redraw_screen(vc, 0);
++		update_region(vc, vc->vc_origin +
++			      vc->vc_size_row * vc->vc_top,
++			      vc->vc_size_row * (vc->vc_bottom - vc->vc_top) / 2);
++	}
++
++	printk(KERN_INFO "fbcondecor: switched decor state to 'off' on console %d\n",
++			 vc->vc_num);
++
++	return 0;
++}
++
++/* Enables fbcondecor on a virtual console; called with console sem held. */
++static int fbcon_decor_enable(struct vc_data *vc)
++{
++	struct fb_info* info;
++
++	info = registered_fb[(int) con2fb_map[vc->vc_num]];
++
++	if (vc->vc_decor.twidth == 0 || vc->vc_decor.theight == 0 ||
++	    info == NULL || vc->vc_decor.state || (!info->bgdecor.data &&
++	    vc->vc_num == fg_console))
++		return -EINVAL;
++
++	vc->vc_decor.state = 1;
++	vc_resize(vc, vc->vc_decor.twidth / vc->vc_font.width,
++		  vc->vc_decor.theight / vc->vc_font.height);
++
++	if (fg_console == vc->vc_num) {
++		redraw_screen(vc, 0);
++		update_region(vc, vc->vc_origin +
++			      vc->vc_size_row * vc->vc_top,
++			      vc->vc_size_row * (vc->vc_bottom - vc->vc_top) / 2);
++		fbcon_decor_clear_margins(vc, info, 0);
++	}
++
++	printk(KERN_INFO "fbcondecor: switched decor state to 'on' on console %d\n",
++			 vc->vc_num);
++
++	return 0;
++}
++
++static inline int fbcon_decor_ioctl_dosetstate(struct vc_data *vc, unsigned int state, unsigned char origin)
++{
++	int ret;
++
++//	if (origin == FBCON_DECOR_IO_ORIG_USER)
++		console_lock();
++	if (!state)
++		ret = fbcon_decor_disable(vc, 1);
++	else
++		ret = fbcon_decor_enable(vc);
++//	if (origin == FBCON_DECOR_IO_ORIG_USER)
++		console_unlock();
++
++	return ret;
++}
++
++static inline void fbcon_decor_ioctl_dogetstate(struct vc_data *vc, unsigned int *state)
++{
++	*state = vc->vc_decor.state;
++}
++
++static int fbcon_decor_ioctl_dosetcfg(struct vc_data *vc, struct vc_decor *cfg, unsigned char origin)
++{
++	struct fb_info *info;
++	int len;
++	char *tmp;
++
++	info = registered_fb[(int) con2fb_map[vc->vc_num]];
++
++	if (info == NULL || !cfg->twidth || !cfg->theight ||
++	    cfg->tx + cfg->twidth  > info->var.xres ||
++	    cfg->ty + cfg->theight > info->var.yres)
++		return -EINVAL;
++
++	len = strlen_user(cfg->theme);
++	if (!len || len > FBCON_DECOR_THEME_LEN)
++		return -EINVAL;
++	tmp = kmalloc(len, GFP_KERNEL);
++	if (!tmp)
++		return -ENOMEM;
++	if (copy_from_user(tmp, (void __user *)cfg->theme, len))
++		return -EFAULT;
++	cfg->theme = tmp;
++	cfg->state = 0;
++
++	/* If this ioctl is a response to a request from kernel, the console sem
++	 * is already held; we also don't need to disable decor because either the
++	 * new config and background picture will be successfully loaded, and the
++	 * decor will stay on, or in case of a failure it'll be turned off in fbcon. */
++//	if (origin == FBCON_DECOR_IO_ORIG_USER) {
++		console_lock();
++		if (vc->vc_decor.state)
++			fbcon_decor_disable(vc, 1);
++//	}
++
++	if (vc->vc_decor.theme)
++		kfree(vc->vc_decor.theme);
++
++	vc->vc_decor = *cfg;
++
++//	if (origin == FBCON_DECOR_IO_ORIG_USER)
++		console_unlock();
++
++	printk(KERN_INFO "fbcondecor: console %d using theme '%s'\n",
++			 vc->vc_num, vc->vc_decor.theme);
++	return 0;
++}
++
++static int fbcon_decor_ioctl_dogetcfg(struct vc_data *vc, struct vc_decor *decor)
++{
++	char __user *tmp;
++
++	tmp = decor->theme;
++	*decor = vc->vc_decor;
++	decor->theme = tmp;
++
++	if (vc->vc_decor.theme) {
++		if (copy_to_user(tmp, vc->vc_decor.theme, strlen(vc->vc_decor.theme) + 1))
++			return -EFAULT;
++	} else
++		if (put_user(0, tmp))
++			return -EFAULT;
++
++	return 0;
++}
++
++static int fbcon_decor_ioctl_dosetpic(struct vc_data *vc, struct fb_image *img, unsigned char origin)
++{
++	struct fb_info *info;
++	int len;
++	u8 *tmp;
++
++	if (vc->vc_num != fg_console)
++		return -EINVAL;
++
++	info = registered_fb[(int) con2fb_map[vc->vc_num]];
++
++	if (info == NULL)
++		return -EINVAL;
++
++	if (img->width != info->var.xres || img->height != info->var.yres) {
++		printk(KERN_ERR "fbcondecor: picture dimensions mismatch\n");
++		printk(KERN_ERR "%dx%d vs %dx%d\n", img->width, img->height, info->var.xres, info->var.yres);
++		return -EINVAL;
++	}
++
++	if (img->depth != info->var.bits_per_pixel) {
++		printk(KERN_ERR "fbcondecor: picture depth mismatch\n");
++		return -EINVAL;
++	}
++
++	if (img->depth == 8) {
++		if (!img->cmap.len || !img->cmap.red || !img->cmap.green ||
++		    !img->cmap.blue)
++			return -EINVAL;
++
++		tmp = vmalloc(img->cmap.len * 3 * 2);
++		if (!tmp)
++			return -ENOMEM;
++
++		if (copy_from_user(tmp,
++			    	   (void __user*)img->cmap.red, (img->cmap.len << 1)) ||
++		    copy_from_user(tmp + (img->cmap.len << 1),
++			    	   (void __user*)img->cmap.green, (img->cmap.len << 1)) ||
++		    copy_from_user(tmp + (img->cmap.len << 2),
++			    	   (void __user*)img->cmap.blue, (img->cmap.len << 1))) {
++			vfree(tmp);
++			return -EFAULT;
++		}
++
++		img->cmap.transp = NULL;
++		img->cmap.red = (u16*)tmp;
++		img->cmap.green = img->cmap.red + img->cmap.len;
++		img->cmap.blue = img->cmap.green + img->cmap.len;
++	} else {
++		img->cmap.red = NULL;
++	}
++
++	len = ((img->depth + 7) >> 3) * img->width * img->height;
++
++	/*
++	 * Allocate an additional byte so that we never go outside of the
++	 * buffer boundaries in the rendering functions in a 24 bpp mode.
++	 */
++	tmp = vmalloc(len + 1);
++
++	if (!tmp)
++		goto out;
++
++	if (copy_from_user(tmp, (void __user*)img->data, len))
++		goto out;
++
++	img->data = tmp;
++
++	/* If this ioctl is a response to a request from kernel, the console sem
++	 * is already held. */
++//	if (origin == FBCON_DECOR_IO_ORIG_USER)
++		console_lock();
++
++	if (info->bgdecor.data)
++		vfree((u8*)info->bgdecor.data);
++	if (info->bgdecor.cmap.red)
++		vfree(info->bgdecor.cmap.red);
++
++	info->bgdecor = *img;
++
++	if (fbcon_decor_active_vc(vc) && fg_console == vc->vc_num) {
++		redraw_screen(vc, 0);
++		update_region(vc, vc->vc_origin +
++			      vc->vc_size_row * vc->vc_top,
++			      vc->vc_size_row * (vc->vc_bottom - vc->vc_top) / 2);
++		fbcon_decor_clear_margins(vc, info, 0);
++	}
++
++//	if (origin == FBCON_DECOR_IO_ORIG_USER)
++		console_unlock();
++
++	return 0;
++
++out:	if (img->cmap.red)
++		vfree(img->cmap.red);
++
++	if (tmp)
++		vfree(tmp);
++	return -ENOMEM;
++}
++
++static long fbcon_decor_ioctl(struct file *filp, u_int cmd, u_long arg)
++{
++	struct fbcon_decor_iowrapper __user *wrapper = (void __user*) arg;
++	struct vc_data *vc = NULL;
++	unsigned short vc_num = 0;
++	unsigned char origin = 0;
++	void __user *data = NULL;
++
++	if (!access_ok(VERIFY_READ, wrapper,
++			sizeof(struct fbcon_decor_iowrapper)))
++		return -EFAULT;
++
++	__get_user(vc_num, &wrapper->vc);
++	__get_user(origin, &wrapper->origin);
++	__get_user(data, &wrapper->data);
++
++	if (!vc_cons_allocated(vc_num))
++		return -EINVAL;
++
++	vc = vc_cons[vc_num].d;
++
++	switch (cmd) {
++	case FBIOCONDECOR_SETPIC:
++	{
++		struct fb_image img;
++		if (copy_from_user(&img, (struct fb_image __user *)data, sizeof(struct fb_image)))
++			return -EFAULT;
++
++		return fbcon_decor_ioctl_dosetpic(vc, &img, origin);
++	}
++	case FBIOCONDECOR_SETCFG:
++	{
++		struct vc_decor cfg;
++		if (copy_from_user(&cfg, (struct vc_decor __user *)data, sizeof(struct vc_decor)))
++			return -EFAULT;
++
++		return fbcon_decor_ioctl_dosetcfg(vc, &cfg, origin);
++	}
++	case FBIOCONDECOR_GETCFG:
++	{
++		int rval;
++		struct vc_decor cfg;
++
++		if (copy_from_user(&cfg, (struct vc_decor __user *)data, sizeof(struct vc_decor)))
++			return -EFAULT;
++
++		rval = fbcon_decor_ioctl_dogetcfg(vc, &cfg);
++
++		if (copy_to_user(data, &cfg, sizeof(struct vc_decor)))
++			return -EFAULT;
++		return rval;
++	}
++	case FBIOCONDECOR_SETSTATE:
++	{
++		unsigned int state = 0;
++		if (get_user(state, (unsigned int __user *)data))
++			return -EFAULT;
++		return fbcon_decor_ioctl_dosetstate(vc, state, origin);
++	}
++	case FBIOCONDECOR_GETSTATE:
++	{
++		unsigned int state = 0;
++		fbcon_decor_ioctl_dogetstate(vc, &state);
++		return put_user(state, (unsigned int __user *)data);
++	}
++
++	default:
++		return -ENOIOCTLCMD;
++	}
++}
++
++#ifdef CONFIG_COMPAT
++
++static long fbcon_decor_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) {
++
++	struct fbcon_decor_iowrapper32 __user *wrapper = (void __user *)arg;
++	struct vc_data *vc = NULL;
++	unsigned short vc_num = 0;
++	unsigned char origin = 0;
++	compat_uptr_t data_compat = 0;
++	void __user *data = NULL;
++
++	if (!access_ok(VERIFY_READ, wrapper,
++                       sizeof(struct fbcon_decor_iowrapper32)))
++		return -EFAULT;
++
++	__get_user(vc_num, &wrapper->vc);
++	__get_user(origin, &wrapper->origin);
++	__get_user(data_compat, &wrapper->data);
++	data = compat_ptr(data_compat);
++
++	if (!vc_cons_allocated(vc_num))
++		return -EINVAL;
++
++	vc = vc_cons[vc_num].d;
++
++	switch (cmd) {
++	case FBIOCONDECOR_SETPIC32:
++	{
++		struct fb_image32 img_compat;
++		struct fb_image img;
++
++		if (copy_from_user(&img_compat, (struct fb_image32 __user *)data, sizeof(struct fb_image32)))
++			return -EFAULT;
++
++		fb_image_from_compat(img, img_compat);
++
++		return fbcon_decor_ioctl_dosetpic(vc, &img, origin);
++	}
++
++	case FBIOCONDECOR_SETCFG32:
++	{
++		struct vc_decor32 cfg_compat;
++		struct vc_decor cfg;
++
++		if (copy_from_user(&cfg_compat, (struct vc_decor32 __user *)data, sizeof(struct vc_decor32)))
++			return -EFAULT;
++
++		vc_decor_from_compat(cfg, cfg_compat);
++
++		return fbcon_decor_ioctl_dosetcfg(vc, &cfg, origin);
++	}
++
++	case FBIOCONDECOR_GETCFG32:
++	{
++		int rval;
++		struct vc_decor32 cfg_compat;
++		struct vc_decor cfg;
++
++		if (copy_from_user(&cfg_compat, (struct vc_decor32 __user *)data, sizeof(struct vc_decor32)))
++			return -EFAULT;
++		cfg.theme = compat_ptr(cfg_compat.theme);
++
++		rval = fbcon_decor_ioctl_dogetcfg(vc, &cfg);
++
++		vc_decor_to_compat(cfg_compat, cfg);
++
++		if (copy_to_user((struct vc_decor32 __user *)data, &cfg_compat, sizeof(struct vc_decor32)))
++			return -EFAULT;
++		return rval;
++	}
++
++	case FBIOCONDECOR_SETSTATE32:
++	{
++		compat_uint_t state_compat = 0;
++		unsigned int state = 0;
++
++		if (get_user(state_compat, (compat_uint_t __user *)data))
++			return -EFAULT;
++
++		state = (unsigned int)state_compat;
++
++		return fbcon_decor_ioctl_dosetstate(vc, state, origin);
++	}
++
++	case FBIOCONDECOR_GETSTATE32:
++	{
++		compat_uint_t state_compat = 0;
++		unsigned int state = 0;
++
++		fbcon_decor_ioctl_dogetstate(vc, &state);
++		state_compat = (compat_uint_t)state;
++
++		return put_user(state_compat, (compat_uint_t __user *)data);
++	}
++
++	default:
++		return -ENOIOCTLCMD;
++	}
++}
++#else
++  #define fbcon_decor_compat_ioctl NULL
++#endif
++
++static struct file_operations fbcon_decor_ops = {
++	.owner = THIS_MODULE,
++	.unlocked_ioctl = fbcon_decor_ioctl,
++	.compat_ioctl = fbcon_decor_compat_ioctl
++};
++
++static struct miscdevice fbcon_decor_dev = {
++	.minor = MISC_DYNAMIC_MINOR,
++	.name = "fbcondecor",
++	.fops = &fbcon_decor_ops
++};
++
++void fbcon_decor_reset()
++{
++	int i;
++
++	for (i = 0; i < num_registered_fb; i++) {
++		registered_fb[i]->bgdecor.data = NULL;
++		registered_fb[i]->bgdecor.cmap.red = NULL;
++	}
++
++	for (i = 0; i < MAX_NR_CONSOLES && vc_cons[i].d; i++) {
++		vc_cons[i].d->vc_decor.state = vc_cons[i].d->vc_decor.twidth =
++						vc_cons[i].d->vc_decor.theight = 0;
++		vc_cons[i].d->vc_decor.theme = NULL;
++	}
++
++	return;
++}
++
++int fbcon_decor_init()
++{
++	int i;
++
++	fbcon_decor_reset();
++
++	if (initialized)
++		return 0;
++
++	i = misc_register(&fbcon_decor_dev);
++	if (i) {
++		printk(KERN_ERR "fbcondecor: failed to register device\n");
++		return i;
++	}
++
++	fbcon_decor_call_helper("init", 0);
++	initialized = 1;
++	return 0;
++}
++
++int fbcon_decor_exit(void)
++{
++	fbcon_decor_reset();
++	return 0;
++}
++
++EXPORT_SYMBOL(fbcon_decor_path);
+diff --git a/drivers/video/console/fbcondecor.h b/drivers/video/console/fbcondecor.h
+new file mode 100644
+index 0000000..1d852dd
+--- /dev/null
++++ b/drivers/video/console/fbcondecor.h
+@@ -0,0 +1,78 @@
++/* 
++ *  linux/drivers/video/console/fbcondecor.h -- Framebuffer Console Decoration headers
++ *
++ *  Copyright (C) 2004 Michal Januszewski <spock@g.o>
++ *
++ */
++
++#ifndef __FBCON_DECOR_H
++#define __FBCON_DECOR_H
++
++#ifndef _LINUX_FB_H
++#include <linux/fb.h>
++#endif
++
++/* This is needed for vc_cons in fbcmap.c */
++#include <linux/vt_kern.h>
++
++struct fb_cursor;
++struct fb_info;
++struct vc_data;
++
++#ifdef CONFIG_FB_CON_DECOR
++/* fbcondecor.c */
++int fbcon_decor_init(void);
++int fbcon_decor_exit(void);
++int fbcon_decor_call_helper(char* cmd, unsigned short cons);
++int fbcon_decor_disable(struct vc_data *vc, unsigned char redraw);
++
++/* cfbcondecor.c */
++void fbcon_decor_putcs(struct vc_data *vc, struct fb_info *info, const unsigned short *s, int count, int yy, int xx);
++void fbcon_decor_cursor(struct fb_info *info, struct fb_cursor *cursor);
++void fbcon_decor_clear(struct vc_data *vc, struct fb_info *info, int sy, int sx, int height, int width);
++void fbcon_decor_clear_margins(struct vc_data *vc, struct fb_info *info, int bottom_only);
++void fbcon_decor_blank(struct vc_data *vc, struct fb_info *info, int blank);
++void fbcon_decor_bmove_redraw(struct vc_data *vc, struct fb_info *info, int y, int sx, int dx, int width);
++void fbcon_decor_copy(u8 *dst, u8 *src, int height, int width, int linebytes, int srclinesbytes, int bpp);
++void fbcon_decor_fix_pseudo_pal(struct fb_info *info, struct vc_data *vc);
++
++/* vt.c */
++void acquire_console_sem(void);
++void release_console_sem(void);
++void do_unblank_screen(int entering_gfx);
++
++/* struct vc_data *y */
++#define fbcon_decor_active_vc(y) (y->vc_decor.state && y->vc_decor.theme) 
++
++/* struct fb_info *x, struct vc_data *y */
++#define fbcon_decor_active_nores(x,y) (x->bgdecor.data && fbcon_decor_active_vc(y))
++
++/* struct fb_info *x, struct vc_data *y */
++#define fbcon_decor_active(x,y) (fbcon_decor_active_nores(x,y) &&		\
++			      x->bgdecor.width == x->var.xres && 	\
++			      x->bgdecor.height == x->var.yres &&	\
++			      x->bgdecor.depth == x->var.bits_per_pixel)
++
++
++#else /* CONFIG_FB_CON_DECOR */
++
++static inline void fbcon_decor_putcs(struct vc_data *vc, struct fb_info *info, const unsigned short *s, int count, int yy, int xx) {}
++static inline void fbcon_decor_putc(struct vc_data *vc, struct fb_info *info, int c, int ypos, int xpos) {}
++static inline void fbcon_decor_cursor(struct fb_info *info, struct fb_cursor *cursor) {}
++static inline void fbcon_decor_clear(struct vc_data *vc, struct fb_info *info, int sy, int sx, int height, int width) {}
++static inline void fbcon_decor_clear_margins(struct vc_data *vc, struct fb_info *info, int bottom_only) {}
++static inline void fbcon_decor_blank(struct vc_data *vc, struct fb_info *info, int blank) {}
++static inline void fbcon_decor_bmove_redraw(struct vc_data *vc, struct fb_info *info, int y, int sx, int dx, int width) {}
++static inline void fbcon_decor_fix_pseudo_pal(struct fb_info *info, struct vc_data *vc) {}
++static inline int fbcon_decor_call_helper(char* cmd, unsigned short cons) { return 0; }
++static inline int fbcon_decor_init(void) { return 0; }
++static inline int fbcon_decor_exit(void) { return 0; }
++static inline int fbcon_decor_disable(struct vc_data *vc, unsigned char redraw) { return 0; }
++
++#define fbcon_decor_active_vc(y) (0)
++#define fbcon_decor_active_nores(x,y) (0)
++#define fbcon_decor_active(x,y) (0)
++
++#endif /* CONFIG_FB_CON_DECOR */
++
++#endif /* __FBCON_DECOR_H */
+diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
+index 5c3960d..162b5f4 100644
+--- a/drivers/video/fbcmap.c
++++ b/drivers/video/fbcmap.c
+@@ -17,6 +17,8 @@
+ #include <linux/slab.h>
+ #include <linux/uaccess.h>
+ 
++#include "console/fbcondecor.h"
++
+ static u16 red2[] __read_mostly = {
+     0x0000, 0xaaaa
+ };
+@@ -249,14 +251,17 @@ int fb_set_cmap(struct fb_cmap *cmap, struct fb_info *info)
+ 			if (transp)
+ 				htransp = *transp++;
+ 			if (info->fbops->fb_setcolreg(start++,
+-						      hred, hgreen, hblue,
++						      hred, hgreen, hblue, 
+ 						      htransp, info))
+ 				break;
+ 		}
+ 	}
+-	if (rc == 0)
++	if (rc == 0) {
+ 		fb_copy_cmap(cmap, &info->cmap);
+-
++		if (fbcon_decor_active(info, vc_cons[fg_console].d) &&
++		    info->fix.visual == FB_VISUAL_DIRECTCOLOR)
++			fbcon_decor_fix_pseudo_pal(info, vc_cons[fg_console].d);
++	}
+ 	return rc;
+ }
+ 
+diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
+index c6ce416..7ce6640 100644
+--- a/drivers/video/fbmem.c
++++ b/drivers/video/fbmem.c
+@@ -1231,15 +1231,6 @@ struct fb_fix_screeninfo32 {
+ 	u16			reserved[3];
+ };
+ 
+-struct fb_cmap32 {
+-	u32			start;
+-	u32			len;
+-	compat_caddr_t	red;
+-	compat_caddr_t	green;
+-	compat_caddr_t	blue;
+-	compat_caddr_t	transp;
+-};
+-
+ static int fb_getput_cmap(struct fb_info *info, unsigned int cmd,
+ 			  unsigned long arg)
+ {
+diff --git a/include/linux/console_decor.h b/include/linux/console_decor.h
+new file mode 100644
+index 0000000..04b8d80
+--- /dev/null
++++ b/include/linux/console_decor.h
+@@ -0,0 +1,46 @@
++#ifndef _LINUX_CONSOLE_DECOR_H_
++#define _LINUX_CONSOLE_DECOR_H_ 1
++
++/* A structure used by the framebuffer console decorations (drivers/video/console/fbcondecor.c) */
++struct vc_decor {
++	__u8 bg_color;				/* The color that is to be treated as transparent */
++	__u8 state;				/* Current decor state: 0 = off, 1 = on */
++	__u16 tx, ty;				/* Top left corner coordinates of the text field */
++	__u16 twidth, theight;			/* Width and height of the text field */
++	char* theme;
++};
++
++#ifdef __KERNEL__
++#ifdef CONFIG_COMPAT
++#include <linux/compat.h>
++
++struct vc_decor32 {
++	__u8 bg_color;				/* The color that is to be treated as transparent */
++	__u8 state;				/* Current decor state: 0 = off, 1 = on */
++	__u16 tx, ty;				/* Top left corner coordinates of the text field */
++	__u16 twidth, theight;			/* Width and height of the text field */
++	compat_uptr_t theme;
++};
++
++#define vc_decor_from_compat(to, from) \
++	(to).bg_color = (from).bg_color; \
++	(to).state    = (from).state; \
++	(to).tx       = (from).tx; \
++	(to).ty       = (from).ty; \
++	(to).twidth   = (from).twidth; \
++	(to).theight  = (from).theight; \
++	(to).theme    = compat_ptr((from).theme)
++
++#define vc_decor_to_compat(to, from) \
++	(to).bg_color = (from).bg_color; \
++	(to).state    = (from).state; \
++	(to).tx       = (from).tx; \
++	(to).ty       = (from).ty; \
++	(to).twidth   = (from).twidth; \
++	(to).theight  = (from).theight; \
++	(to).theme    = ptr_to_compat((from).theme)
++
++#endif /* CONFIG_COMPAT */
++#endif /* __KERNEL__ */
++
++#endif
+diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h
+index 7f0c329..98f5d60 100644
+--- a/include/linux/console_struct.h
++++ b/include/linux/console_struct.h
+@@ -19,6 +19,7 @@
+ struct vt_struct;
+ 
+ #define NPAR 16
++#include <linux/console_decor.h>
+ 
+ struct vc_data {
+ 	struct tty_port port;			/* Upper level data */
+@@ -107,6 +108,8 @@ struct vc_data {
+ 	unsigned long	vc_uni_pagedir;
+ 	unsigned long	*vc_uni_pagedir_loc;  /* [!] Location of uni_pagedir variable for this console */
+ 	bool vc_panic_force_write; /* when oops/panic this VC can accept forced output/blanking */
++
++	struct vc_decor vc_decor;
+ 	/* additional information is in vt_kern.h */
+ };
+ 
+diff --git a/include/uapi/linux/fb.h b/include/uapi/linux/fb.h
+index d31cb68..ad161bb 100644
+--- a/include/uapi/linux/fb.h
++++ b/include/uapi/linux/fb.h
+@@ -8,6 +8,25 @@
+ 
+ #define FB_MAX			32	/* sufficient for now */
+ 
++struct fbcon_decor_iowrapper
++{
++	unsigned short vc;		/* Virtual console */
++	unsigned char origin;		/* Point of origin of the request */
++	void *data;
++};
++
++#ifdef __KERNEL__
++#ifdef CONFIG_COMPAT
++#include <linux/compat.h>
++struct fbcon_decor_iowrapper32
++{
++	unsigned short vc;		/* Virtual console */
++	unsigned char origin;		/* Point of origin of the request */
++	compat_uptr_t data;
++};
++#endif /* CONFIG_COMPAT */
++#endif /* __KERNEL__ */
++
+ /* ioctls
+    0x46 is 'F'								*/
+ #define FBIOGET_VSCREENINFO	0x4600
+@@ -34,6 +53,24 @@
+ #define FBIOPUT_MODEINFO        0x4617
+ #define FBIOGET_DISPINFO        0x4618
+ #define FBIO_WAITFORVSYNC	_IOW('F', 0x20, __u32)
++#define FBIOCONDECOR_SETCFG	_IOWR('F', 0x19, struct fbcon_decor_iowrapper)
++#define FBIOCONDECOR_GETCFG	_IOR('F', 0x1A, struct fbcon_decor_iowrapper)
++#define FBIOCONDECOR_SETSTATE	_IOWR('F', 0x1B, struct fbcon_decor_iowrapper)
++#define FBIOCONDECOR_GETSTATE	_IOR('F', 0x1C, struct fbcon_decor_iowrapper)
++#define FBIOCONDECOR_SETPIC 	_IOWR('F', 0x1D, struct fbcon_decor_iowrapper)
++#ifdef __KERNEL__
++#ifdef CONFIG_COMPAT
++#define FBIOCONDECOR_SETCFG32	_IOWR('F', 0x19, struct fbcon_decor_iowrapper32)
++#define FBIOCONDECOR_GETCFG32	_IOR('F', 0x1A, struct fbcon_decor_iowrapper32)
++#define FBIOCONDECOR_SETSTATE32	_IOWR('F', 0x1B, struct fbcon_decor_iowrapper32)
++#define FBIOCONDECOR_GETSTATE32	_IOR('F', 0x1C, struct fbcon_decor_iowrapper32)
++#define FBIOCONDECOR_SETPIC32	_IOWR('F', 0x1D, struct fbcon_decor_iowrapper32)
++#endif /* CONFIG_COMPAT */
++#endif /* __KERNEL__ */
++
++#define FBCON_DECOR_THEME_LEN		128	/* Maximum lenght of a theme name */
++#define FBCON_DECOR_IO_ORIG_KERNEL	0	/* Kernel ioctl origin */
++#define FBCON_DECOR_IO_ORIG_USER	1	/* User ioctl origin */
+ 
+ #define FB_TYPE_PACKED_PIXELS		0	/* Packed Pixels	*/
+ #define FB_TYPE_PLANES			1	/* Non interleaved planes */
+@@ -286,6 +323,28 @@ struct fb_cmap {
+ 	__u16 *transp;			/* transparency, can be NULL */
+ };
+ 
++#ifdef __KERNEL__
++#ifdef CONFIG_COMPAT
++struct fb_cmap32 {
++	__u32 start;
++	__u32 len;			/* Number of entries */
++	compat_uptr_t red;		/* Red values	*/
++	compat_uptr_t green;
++	compat_uptr_t blue;
++	compat_uptr_t transp;		/* transparency, can be NULL */
++};
++
++#define fb_cmap_from_compat(to, from) \
++	(to).start  = (from).start; \
++	(to).len    = (from).len; \
++	(to).red    = compat_ptr((from).red); \
++	(to).green  = compat_ptr((from).green); \
++	(to).blue   = compat_ptr((from).blue); \
++	(to).transp = compat_ptr((from).transp)
++
++#endif /* CONFIG_COMPAT */
++#endif /* __KERNEL__ */
++
+ struct fb_con2fbmap {
+ 	__u32 console;
+ 	__u32 framebuffer;
+@@ -367,6 +426,34 @@ struct fb_image {
+ 	struct fb_cmap cmap;	/* color map info */
+ };
+ 
++#ifdef __KERNEL__
++#ifdef CONFIG_COMPAT
++struct fb_image32 {
++	__u32 dx;			/* Where to place image */
++	__u32 dy;
++	__u32 width;			/* Size of image */
++	__u32 height;
++	__u32 fg_color;			/* Only used when a mono bitmap */
++	__u32 bg_color;
++	__u8  depth;			/* Depth of the image */
++	const compat_uptr_t data;	/* Pointer to image data */
++	struct fb_cmap32 cmap;		/* color map info */
++};
++
++#define fb_image_from_compat(to, from) \
++	(to).dx       = (from).dx; \
++	(to).dy       = (from).dy; \
++	(to).width    = (from).width; \
++	(to).height   = (from).height; \
++	(to).fg_color = (from).fg_color; \
++	(to).bg_color = (from).bg_color; \
++	(to).depth    = (from).depth; \
++	(to).data     = compat_ptr((from).data); \
++	fb_cmap_from_compat((to).cmap, (from).cmap)
++
++#endif /* CONFIG_COMPAT */
++#endif /* __KERNEL__ */
++
+ /*
+  * hardware cursor control
+  */
+
+diff --git a/include/linux/fb.h b/include/linux/fb.h
+index d31cb68..ad161bb 100644
+--- a/include/linux/fb.h
++++ b/include/linux/fb.h
+@@ -488,5 +488,8 @@ #define FBINFO_STATE_SUSPENDED		1
+ 	u32 state;			/* Hardware state i.e suspend */
+ 	void *fbcon_par;                /* fbcon use-only private area */
++
++	struct fb_image bgdecor;
++
+ 	/* From here on everything is device dependent */
+ 	void *par;
+ 	/* we need the PCI or similar aperture base/size not
+
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 4ab1187..6561627 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -145,6 +145,10 @@ static int min_percpu_pagelist_fract = 8;
+ static int ngroups_max = NGROUPS_MAX;
+ static const int cap_last_cap = CAP_LAST_CAP;
+ 
++#ifdef CONFIG_FB_CON_DECOR
++extern char fbcon_decor_path[];
++#endif
++
+ #ifdef CONFIG_INOTIFY_USER
+ #include <linux/inotify.h>
+ #endif
+@@ -248,6 +252,15 @@ static struct ctl_table sysctl_base_table[] = {
+ 		.mode		= 0555,
+ 		.child		= dev_table,
+ 	},
++#ifdef CONFIG_FB_CON_DECOR
++	{
++		.procname	= "fbcondecor",
++		.data		= &fbcon_decor_path,
++		.maxlen		= KMOD_PATH_LEN,
++		.mode		= 0644,
++		.proc_handler	= &proc_dostring,
++	},
++#endif
+ 	{ }
+ };
+ 
+@@ -1091,7 +1104,7 @@ static struct ctl_table vm_table[] = {
+ 		.proc_handler	= proc_dointvec,
+ 	},
+ 	{
+-		.procname	= "page-cluster", 
++		.procname	= "page-cluster",
+ 		.data		= &page_cluster,
+ 		.maxlen		= sizeof(int),
+ 		.mode		= 0644,
+@@ -1535,7 +1548,7 @@ static struct ctl_table fs_table[] = {
+ 		.mode		= 0555,
+ 		.child		= inotify_table,
+ 	},
+-#endif	
++#endif
+ #ifdef CONFIG_EPOLL
+ 	{
+ 		.procname	= "epoll",
+@@ -1873,12 +1886,12 @@ static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
+ 	unsigned long page = 0;
+ 	size_t left;
+ 	char *kbuf;
+-	
++
+ 	if (!tbl_data || !table->maxlen || !*lenp || (*ppos && !write)) {
+ 		*lenp = 0;
+ 		return 0;
+ 	}
+-	
++
+ 	i = (int *) tbl_data;
+ 	vleft = table->maxlen / sizeof(*i);
+ 	left = *lenp;
+@@ -1967,7 +1980,7 @@ static int do_proc_dointvec(struct ctl_table *table, int write,
+  * @ppos: file position
+  *
+  * Reads/writes up to table->maxlen/sizeof(unsigned int) integer
+- * values from/to the user buffer, treated as an ASCII string. 
++ * values from/to the user buffer, treated as an ASCII string.
+  *
+  * Returns 0 on success.
+  */
+@@ -2326,7 +2339,7 @@ static int do_proc_dointvec_ms_jiffies_conv(bool *negp, unsigned long *lvalp,
+  * @ppos: file position
+  *
+  * Reads/writes up to table->maxlen/sizeof(unsigned int) integer
+- * values from/to the user buffer, treated as an ASCII string. 
++ * values from/to the user buffer, treated as an ASCII string.
+  * The values read are assumed to be in seconds, and are converted into
+  * jiffies.
+  *
+@@ -2348,8 +2361,8 @@ int proc_dointvec_jiffies(struct ctl_table *table, int write,
+  * @ppos: pointer to the file position
+  *
+  * Reads/writes up to table->maxlen/sizeof(unsigned int) integer
+- * values from/to the user buffer, treated as an ASCII string. 
+- * The values read are assumed to be in 1/USER_HZ seconds, and 
++ * values from/to the user buffer, treated as an ASCII string.
++ * The values read are assumed to be in 1/USER_HZ seconds, and
+  * are converted into jiffies.
+  *
+  * Returns 0 on success.
+@@ -2371,8 +2384,8 @@ int proc_dointvec_userhz_jiffies(struct ctl_table *table, int write,
+  * @ppos: the current position in the file
+  *
+  * Reads/writes up to table->maxlen/sizeof(unsigned int) integer
+- * values from/to the user buffer, treated as an ASCII string. 
+- * The values read are assumed to be in 1/1000 seconds, and 
++ * values from/to the user buffer, treated as an ASCII string.
++ * The values read are assumed to be in 1/1000 seconds, and
+  * are converted into jiffies.
+  *
+  * Returns 0 on success.
+-- 
+1.7.10
+

Added: genpatches-2.6/trunk/3.10.7/4500_nouveau-video-output-control-Kconfig.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/4500_nouveau-video-output-control-Kconfig.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/4500_nouveau-video-output-control-Kconfig.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,10 @@
+--- a/drivers/gpu/drm/nouveau/Kconfig
++++ b/drivers/gpu/drm/nouveau/Kconfig
+@@ -15,6 +15,7 @@ config DRM_NOUVEAU
+ 	select ACPI_WMI if ACPI && X86
+ 	select MXM_WMI if ACPI && X86
+ 	select POWER_SUPPLY
++	select VIDEO_OUTPUT_CONTROL
+ 	help
+ 	  Choose this option for open-source nVidia support.
+ 

Added: genpatches-2.6/trunk/3.10.7/4567_distro-Gentoo-Kconfig.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/4567_distro-Gentoo-Kconfig.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/4567_distro-Gentoo-Kconfig.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,113 @@
+--- a/Kconfig
++++ b/Kconfig
+@@ -8,4 +8,6 @@ config SRCARCH
+ 	string
+ 	option env="SRCARCH"
+ 
++source "distro/Kconfig"
++
+ source "arch/$SRCARCH/Kconfig"
+--- /dev/null
++++ b/distro/Kconfig
+@@ -0,0 +1,101 @@
++menu "Gentoo Linux"
++
++config GENTOO_LINUX
++	bool "Gentoo Linux support"
++
++	default y
++
++config GENTOO_LINUX_UDEV
++	bool "Linux dynamic and persistent device naming (userspace devfs) support"
++
++	depends on GENTOO_LINUX
++	default y if GENTOO_LINUX
++	
++	select DEVTMPFS
++	select TMPFS
++
++	select MMU
++	select HOTPLUG
++	select SHMEM
++
++	help
++		In order to boot Gentoo Linux a minimal set of config settings needs to
++		be enabled in the kernel; to avoid the users from having to enable them
++		manually as part of a Gentoo Linux installation or a new clean config,
++		we enable these config settings by default for convenience.
++
++		Currently this only selects TMPFS, DEVTMPFS and their dependencies.
++		TMPFS is enabled to maintain a tmpfs file system at /dev/shm, /run and
++		/sys/fs/cgroup; DEVTMPFS to maintain a devtmpfs file system at /dev.
++
++		Some of these are critical files that need to be available early in the
++		boot process; if not available, it causes sysfs and udev to malfunction.
++
++		To ensure Gentoo Linux boots, it is best to leave this option enabled;
++		if you run a custom setup, you could consider whether to disable this. 
++
++menu "Support for init systems, system and service managers"
++	visible if GENTOO_LINUX
++
++config GENTOO_LINUX_INIT_SCRIPT
++	bool "OpenRC, runit and other script based systems and managers"
++
++	default y if GENTOO_LINUX
++
++	depends on GENTOO_LINUX
++
++	select BINFMT_SCRIPT
++
++	help
++		The init system is the first thing that loads after the kernel booted.
++
++		These config settings allow you to select which init systems to support;
++		instead of having to select all the individual settings all over the
++		place, these settings allows you to select all the settings at once.
++
++		This particular setting enables all the known requirements for OpenRC,
++		runit and similar script based systems and managers.
++
++		If you are unsure about this, it is best to leave this option enabled.
++
++config GENTOO_LINUX_INIT_SYSTEMD
++	bool "systemd"
++
++	default n
++
++	depends on GENTOO_LINUX && GENTOO_LINUX_UDEV
++
++	select AUTOFS4_FS
++	select BLK_DEV_BSG
++	select CGROUPS
++	select EPOLL
++	select FANOTIFY
++	select HOTPLUG
++	select INOTIFY_USER
++	select IPV6
++	select NET
++	select PROC_FS
++	select SIGNALFD
++	select SYSFS
++	select TIMERFD
++
++	select ANON_INODES
++	select BLOCK
++	select EVENTFD
++	select FSNOTIFY
++	select INET
++	select NLATTR
++
++	help
++		The init system is the first thing that loads after the kernel booted.
++
++		These config settings allow you to select which init systems to support;
++		instead of having to select all the individual settings all over the
++		place, these settings allows you to select all the settings at once.
++
++		This particular setting enables all the known requirements for systemd;
++		it also enables suggested optional settings, as the package suggests to.
++
++endmenu
++
++endmenu