[gentoo-commits] linux-patches r2497 - in genpatches-2.6/trunk: . 3.10.7

[Tom Wijsman (tomwij)]

Author: tomwij
Date: 2013-08-29 12:09:12 +0000 (Thu, 29 Aug 2013)
New Revision: 2497

Added:
   genpatches-2.6/trunk/3.10.7/
   genpatches-2.6/trunk/3.10.7/0000_README
   genpatches-2.6/trunk/3.10.7/1000_linux-3.10.1.patch
   genpatches-2.6/trunk/3.10.7/1001_linux-3.10.2.patch
   genpatches-2.6/trunk/3.10.7/1002_linux-3.10.3.patch
   genpatches-2.6/trunk/3.10.7/1003_linux-3.10.4.patch
   genpatches-2.6/trunk/3.10.7/1004_linux-3.10.5.patch
   genpatches-2.6/trunk/3.10.7/1005_linux-3.10.6.patch
   genpatches-2.6/trunk/3.10.7/1006_linux-3.10.7.patch
   genpatches-2.6/trunk/3.10.7/1500_XATTR_USER_PREFIX.patch
   genpatches-2.6/trunk/3.10.7/1700_enable-thinkpad-micled.patch
   genpatches-2.6/trunk/3.10.7/1801_block-cgroups-kconfig-build-bits-for-BFQ-v6r2-3.10.patch
   genpatches-2.6/trunk/3.10.7/1802_block-introduce-the-BFQ-v6r2-I-O-sched-for-3.10.patch1
   genpatches-2.6/trunk/3.10.7/1803_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v6r2-for-3.10.0.patch1
   genpatches-2.6/trunk/3.10.7/2400_kcopy-patch-for-infiniband-driver.patch
   genpatches-2.6/trunk/3.10.7/2700_ThinkPad-30-brightness-control-fix.patch
   genpatches-2.6/trunk/3.10.7/2900_dev-root-proc-mount-fix.patch
   genpatches-2.6/trunk/3.10.7/4200_fbcondecor-0.9.6.patch
   genpatches-2.6/trunk/3.10.7/4500_nouveau-video-output-control-Kconfig.patch
   genpatches-2.6/trunk/3.10.7/4567_distro-Gentoo-Kconfig.patch
Log:
Import 3.10-13 (3.10.7 release) as 3.10.7 branch, to bring security fixes to stable.

Added: genpatches-2.6/trunk/3.10.7/0000_README
===================================================================
--- genpatches-2.6/trunk/3.10.7/0000_README	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/0000_README	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,116 @@
+README
+--------------------------------------------------------------------------
+This patchset is to be the 2.6 series of gentoo-sources.
+It is designed for cross-compatibility, fixes and stability, with performance
+and additional features/driver support being a second.
+
+Unless otherwise stated and marked as such, this kernel should be suitable for
+all environments.
+
+
+Patchset Numbering Scheme
+--------------------------------------------------------------------------
+
+FIXES
[phone]	linux-stable
[phone]	linux-stable queue
[phone]	security
[phone]	architecture-related
[phone]	mm/scheduling/misc
[phone]	filesystems
[phone]	networking core
[phone]	storage core
[phone]	power management (ACPI, APM)
[phone]	bus (USB, IEEE1394, PCI, PCMCIA, ...)
[phone]	network drivers
[phone]	storage drivers
[phone]	input
[phone]	media (graphics, sound, tv)
[phone]	other
[phone]	reserved
+
+FEATURES
[phone]	network
[phone]	storage
[phone]	graphics
[phone]	filesystem
[phone]   security enhancement
[phone]   other
+
+Individual Patch Descriptions:
+--------------------------------------------------------------------------
+Patch:  1000_linux-3.10.1.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.1
+
+Patch:  1001_linux-3.10.2.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.2
+
+Patch:  1002_linux-3.10.3.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.3
+
+Patch:  1003_linux-3.10.4.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.4
+
+Patch:  1004_linux-3.10.5.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.5
+
+Patch:  1005_linux-3.10.6.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.6
+
+Patch:  1006_linux-3.10.7.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.7
+
+Patch:  1500_XATTR_USER_PREFIX.patch
+From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
+Desc:   Support for namespace user.pax.* on tmpfs.
+
+Patch:  1700_enable-thinkpad-micled.patch
+From:   https://bugs.gentoo.org/show_bug.cgi?id=449248
+Desc:   Enable mic mute led in thinkpads
+
+Patch:  1800_memcg-OOM-revert-ZFS-deadlock.patch
+From:   https://bugs.gentoo.org/show_bug.cgi?id=462066
+Desc:   Revert memcg patches that prevent OOM with too many dirty pages.
+
+Patch:  1801_block-cgroups-kconfig-build-bits-for-BFQ-v6r2-3.10.patch        
+From:   http://algo.ing.unimo.it/people/paolo/disk_sched/
+Desc:   BFQ v6r2 patch 1 for 3.10: Build, cgroups and kconfig bits
+
+Patch:  1802_block-introduce-the-BFQ-v6r2-I-O-sched-for-3.10.patch1
+From:   http://algo.ing.unimo.it/people/paolo/disk_sched/
+Desc:   BFQ v6r2 patch 2 for 3.10: BFQ Scheduler
+
+Patch:  1803_block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v6r2-for-3.10.0.patch1
+From:   http://algo.ing.unimo.it/people/paolo/disk_sched/
+Desc:   BFQ v6r2 patch 3 for 3.10: Early Queue Merge (EQM)
+
+Patch:  2400_kcopy-patch-for-infiniband-driver.patch
+From:   Alexey Shvetsov <alexxy@g.o>
+Desc:   Zero copy for infiniband psm userspace driver
+
+Patch:  2700_ThinkPad-30-brightness-control-fix.patch
+From:   Seth Forshee <seth.forshee@×××××××××.com>
+Desc:   ACPI: Disable Windows 8 compatibility for some Lenovo ThinkPads
+
+Patch:  2900_dev-root-proc-mount-fix.patch
+From:   https://bugs.gentoo.org/show_bug.cgi?id=438380
+Desc:   Ensure that /dev/root doesn't appear in /proc/mounts when bootint without an initramfs.
+
+Patch:  4200_fbcondecor-0.9.6.patch
+From:   http://dev.gentoo.org/~spock
+Desc:   Bootsplash successor by Michal Januszewski ported by Jeremy (bug #452574)
+
+Patch:  4500_nouveau-video-output-control-Kconfig.patch
+From:   Tom Wijsman <TomWij@g.o
+Desc:   Make DRM_NOUVEU select VIDEO_OUTPUT_CONTROL, fixes bug #475748.
+
+Patch:  4567_distro-Gentoo-Kconfig.patch
+From:   Tom Wijsman <TomWij@g.o
+Desc:   Add Gentoo Linux support config settings and defaults.

Added: genpatches-2.6/trunk/3.10.7/1000_linux-3.10.1.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/1000_linux-3.10.1.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/1000_linux-3.10.1.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,511 @@
+diff --git a/MAINTAINERS b/MAINTAINERS
+index ad7e322..48c7480 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -7667,6 +7667,7 @@ STABLE BRANCH
+ M:	Greg Kroah-Hartman <gregkh@×××××××××××××××.org>
+ L:	stable@×××××××××××.org
+ S:	Supported
++F:	Documentation/stable_kernel_rules.txt
+ 
+ STAGING SUBSYSTEM
+ M:	Greg Kroah-Hartman <gregkh@×××××××××××××××.org>
+diff --git a/Makefile b/Makefile
+index e5e3ba0..b75cc30 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 0
++SUBLEVEL = 1
+ EXTRAVERSION =
+ NAME = Unicycling Gorilla
+ 
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 260a919..5402c94 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3399,15 +3399,22 @@ static void vmx_get_segment(struct kvm_vcpu *vcpu,
+ 	var->limit = vmx_read_guest_seg_limit(vmx, seg);
+ 	var->selector = vmx_read_guest_seg_selector(vmx, seg);
+ 	ar = vmx_read_guest_seg_ar(vmx, seg);
++	var->unusable = (ar >> 16) & 1;
+ 	var->type = ar & 15;
+ 	var->s = (ar >> 4) & 1;
+ 	var->dpl = (ar >> 5) & 3;
+-	var->present = (ar >> 7) & 1;
++	/*
++	 * Some userspaces do not preserve unusable property. Since usable
++	 * segment has to be present according to VMX spec we can use present
++	 * property to amend userspace bug by making unusable segment always
++	 * nonpresent. vmx_segment_access_rights() already marks nonpresent
++	 * segment as unusable.
++	 */
++	var->present = !var->unusable;
+ 	var->avl = (ar >> 12) & 1;
+ 	var->l = (ar >> 13) & 1;
+ 	var->db = (ar >> 14) & 1;
+ 	var->g = (ar >> 15) & 1;
+-	var->unusable = (ar >> 16) & 1;
+ }
+ 
+ static u64 vmx_get_segment_base(struct kvm_vcpu *vcpu, int seg)
+diff --git a/block/genhd.c b/block/genhd.c
+index 20625ee..cdeb527 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -512,7 +512,7 @@ static void register_disk(struct gendisk *disk)
+ 
+ 	ddev->parent = disk->driverfs_dev;
+ 
+-	dev_set_name(ddev, disk->disk_name);
++	dev_set_name(ddev, "%s", disk->disk_name);
+ 
+ 	/* delay uevents, until we scanned partition table */
+ 	dev_set_uevent_suppress(ddev, 1);
+diff --git a/crypto/algapi.c b/crypto/algapi.c
+index 6149a6e..7a1ae87 100644
+--- a/crypto/algapi.c
++++ b/crypto/algapi.c
+@@ -495,7 +495,8 @@ static struct crypto_template *__crypto_lookup_template(const char *name)
+ 
+ struct crypto_template *crypto_lookup_template(const char *name)
+ {
+-	return try_then_request_module(__crypto_lookup_template(name), name);
++	return try_then_request_module(__crypto_lookup_template(name), "%s",
++				       name);
+ }
+ EXPORT_SYMBOL_GPL(crypto_lookup_template);
+ 
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 037288e..46b35f7 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -714,7 +714,8 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ 		else
+ 			blk_queue_flush(nbd->disk->queue, 0);
+ 
+-		thread = kthread_create(nbd_thread, nbd, nbd->disk->disk_name);
++		thread = kthread_create(nbd_thread, nbd, "%s",
++					nbd->disk->disk_name);
+ 		if (IS_ERR(thread)) {
+ 			mutex_lock(&nbd->tx_lock);
+ 			return PTR_ERR(thread);
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index d620b44..8a3aff7 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -2882,7 +2882,7 @@ static noinline int mmc_ioctl_cdrom_read_data(struct cdrom_device_info *cdi,
+ 	if (lba < 0)
+ 		return -EINVAL;
+ 
+-	cgc->buffer = kmalloc(blocksize, GFP_KERNEL);
++	cgc->buffer = kzalloc(blocksize, GFP_KERNEL);
+ 	if (cgc->buffer == NULL)
+ 		return -ENOMEM;
+ 
+diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
+index fb65dec..591b6fb 100644
+--- a/drivers/cpufreq/cpufreq_stats.c
++++ b/drivers/cpufreq/cpufreq_stats.c
+@@ -349,6 +349,7 @@ static int __cpuinit cpufreq_stat_cpu_callback(struct notifier_block *nfb,
+ 
+ 	switch (action) {
+ 	case CPU_ONLINE:
++	case CPU_ONLINE_FROZEN:
+ 		cpufreq_update_policy(cpu);
+ 		break;
+ 	case CPU_DOWN_PREPARE:
+diff --git a/drivers/power/charger-manager.c b/drivers/power/charger-manager.c
+index fefc39f..98de1dd 100644
+--- a/drivers/power/charger-manager.c
++++ b/drivers/power/charger-manager.c
+@@ -450,7 +450,7 @@ static void uevent_notify(struct charger_manager *cm, const char *event)
+ 	strncpy(env_str, event, UEVENT_BUF_SIZE);
+ 	kobject_uevent(&cm->dev->kobj, KOBJ_CHANGE);
+ 
+-	dev_info(cm->dev, event);
++	dev_info(cm->dev, "%s", event);
+ }
+ 
+ /**
+diff --git a/drivers/scsi/osd/osd_uld.c b/drivers/scsi/osd/osd_uld.c
+index 0fab6b5..9d86947 100644
+--- a/drivers/scsi/osd/osd_uld.c
++++ b/drivers/scsi/osd/osd_uld.c
+@@ -485,7 +485,7 @@ static int osd_probe(struct device *dev)
+ 	oud->class_dev.class = &osd_uld_class;
+ 	oud->class_dev.parent = dev;
+ 	oud->class_dev.release = __remove;
+-	error = dev_set_name(&oud->class_dev, disk->disk_name);
++	error = dev_set_name(&oud->class_dev, "%s", disk->disk_name);
+ 	if (error) {
+ 		OSD_ERR("dev_set_name failed => %d\n", error);
+ 		goto err_put_cdev;
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index c1c5552..6f6a1b4 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -142,7 +142,7 @@ sd_store_cache_type(struct device *dev, struct device_attribute *attr,
+ 	char *buffer_data;
+ 	struct scsi_mode_data data;
+ 	struct scsi_sense_hdr sshdr;
+-	const char *temp = "temporary ";
++	static const char temp[] = "temporary ";
+ 	int len;
+ 
+ 	if (sdp->type != TYPE_DISK)
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index 26e3a97..c52948b 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -4797,10 +4797,6 @@ static struct pci_device_id serial_pci_tbl[] = {
+ 		PCI_VENDOR_ID_IBM, 0x0299,
+ 		0, 0, pbn_b0_bt_2_115200 },
+ 
+-	{	PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9835,
+-		0x1000, 0x0012,
+-		0, 0, pbn_b0_bt_2_115200 },
+-
+ 	{	PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9901,
+ 		0xA000, 0x1000,
+ 		0, 0, pbn_b0_1_115200 },
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 6464029..4476682 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1618,6 +1618,8 @@ static void release_tty(struct tty_struct *tty, int idx)
+ 	tty_free_termios(tty);
+ 	tty_driver_remove_tty(tty->driver, tty);
+ 	tty->port->itty = NULL;
++	if (tty->link)
++		tty->link->port->itty = NULL;
+ 	cancel_work_sync(&tty->port->buf.work);
+ 
+ 	if (tty->link)
+diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
+index 9b6b2b6..be661d8 100644
+--- a/fs/ceph/xattr.c
++++ b/fs/ceph/xattr.c
+@@ -675,17 +675,18 @@ ssize_t ceph_getxattr(struct dentry *dentry, const char *name, void *value,
+ 	if (!ceph_is_valid_xattr(name))
+ 		return -ENODATA;
+ 
+-	spin_lock(&ci->i_ceph_lock);
+-	dout("getxattr %p ver=%lld index_ver=%lld\n", inode,
+-	     ci->i_xattrs.version, ci->i_xattrs.index_version);
+ 
+ 	/* let's see if a virtual xattr was requested */
+ 	vxattr = ceph_match_vxattr(inode, name);
+ 	if (vxattr && !(vxattr->exists_cb && !vxattr->exists_cb(ci))) {
+ 		err = vxattr->getxattr_cb(ci, value, size);
+-		goto out;
++		return err;
+ 	}
+ 
++	spin_lock(&ci->i_ceph_lock);
++	dout("getxattr %p ver=%lld index_ver=%lld\n", inode,
++	     ci->i_xattrs.version, ci->i_xattrs.index_version);
++
+ 	if (__ceph_caps_issued_mask(ci, CEPH_CAP_XATTR_SHARED, 1) &&
+ 	    (ci->i_xattrs.index_version >= ci->i_xattrs.version)) {
+ 		goto get_xattr;
+diff --git a/fs/hpfs/map.c b/fs/hpfs/map.c
+index 4acb19d..803d3da 100644
+--- a/fs/hpfs/map.c
++++ b/fs/hpfs/map.c
+@@ -17,7 +17,8 @@ __le32 *hpfs_map_bitmap(struct super_block *s, unsigned bmp_block,
+ 			 struct quad_buffer_head *qbh, char *id)
+ {
+ 	secno sec;
+-	if (hpfs_sb(s)->sb_chk) if (bmp_block * 16384 > hpfs_sb(s)->sb_fs_size) {
++	unsigned n_bands = (hpfs_sb(s)->sb_fs_size + 0x3fff) >> 14;
++	if (hpfs_sb(s)->sb_chk) if (bmp_block >= n_bands) {
+ 		hpfs_error(s, "hpfs_map_bitmap called with bad parameter: %08x at %s", bmp_block, id);
+ 		return NULL;
+ 	}
+diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
+index a0617e7..962e90c 100644
+--- a/fs/hpfs/super.c
++++ b/fs/hpfs/super.c
+@@ -558,7 +558,13 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
+ 	sbi->sb_cp_table = NULL;
+ 	sbi->sb_c_bitmap = -1;
+ 	sbi->sb_max_fwd_alloc = 0xffffff;
+-	
++
++	if (sbi->sb_fs_size >= 0x80000000) {
++		hpfs_error(s, "invalid size in superblock: %08x",
++			(unsigned)sbi->sb_fs_size);
++		goto bail4;
++	}
++
+ 	/* Load bitmap directory */
+ 	if (!(sbi->sb_bmp_dir = hpfs_load_bitmap_directory(s, le32_to_cpu(superblock->bitmaps))))
+ 		goto bail4;
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 1fab140..2c37442 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -228,19 +228,8 @@ static int nfs41_setup_state_renewal(struct nfs_client *clp)
+ 	return status;
+ }
+ 
+-/*
+- * Back channel returns NFS4ERR_DELAY for new requests when
+- * NFS4_SESSION_DRAINING is set so there is no work to be done when draining
+- * is ended.
+- */
+-static void nfs4_end_drain_session(struct nfs_client *clp)
++static void nfs4_end_drain_slot_table(struct nfs4_slot_table *tbl)
+ {
+-	struct nfs4_session *ses = clp->cl_session;
+-	struct nfs4_slot_table *tbl;
+-
+-	if (ses == NULL)
+-		return;
+-	tbl = &ses->fc_slot_table;
+ 	if (test_and_clear_bit(NFS4_SLOT_TBL_DRAINING, &tbl->slot_tbl_state)) {
+ 		spin_lock(&tbl->slot_tbl_lock);
+ 		nfs41_wake_slot_table(tbl);
+@@ -248,6 +237,16 @@ static void nfs4_end_drain_session(struct nfs_client *clp)
+ 	}
+ }
+ 
++static void nfs4_end_drain_session(struct nfs_client *clp)
++{
++	struct nfs4_session *ses = clp->cl_session;
++
++	if (ses != NULL) {
++		nfs4_end_drain_slot_table(&ses->bc_slot_table);
++		nfs4_end_drain_slot_table(&ses->fc_slot_table);
++	}
++}
++
+ /*
+  * Signal state manager thread if session fore channel is drained
+  */
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 6cd86e0..582321a 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -162,8 +162,8 @@ static __be32 *read_buf(struct nfsd4_compoundargs *argp, u32 nbytes)
+ 	 */
+ 	memcpy(p, argp->p, avail);
+ 	/* step to next page */
+-	argp->p = page_address(argp->pagelist[0]);
+ 	argp->pagelist++;
++	argp->p = page_address(argp->pagelist[0]);
+ 	if (argp->pagelen < PAGE_SIZE) {
+ 		argp->end = argp->p + (argp->pagelen>>2);
+ 		argp->pagelen = 0;
+diff --git a/include/linux/ceph/decode.h b/include/linux/ceph/decode.h
+index 379f715..0442c3d 100644
+--- a/include/linux/ceph/decode.h
++++ b/include/linux/ceph/decode.h
+@@ -160,11 +160,6 @@ static inline void ceph_decode_timespec(struct timespec *ts,
+ static inline void ceph_encode_timespec(struct ceph_timespec *tv,
+ 					const struct timespec *ts)
+ {
+-	BUG_ON(ts->tv_sec < 0);
+-	BUG_ON(ts->tv_sec > (__kernel_time_t)U32_MAX);
+-	BUG_ON(ts->tv_nsec < 0);
+-	BUG_ON(ts->tv_nsec > (long)U32_MAX);
+-
+ 	tv->tv_sec = cpu_to_le32((u32)ts->tv_sec);
+ 	tv->tv_nsec = cpu_to_le32((u32)ts->tv_nsec);
+ }
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index 6b4890f..feaf0c7 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -358,6 +358,17 @@ static inline int hstate_index(struct hstate *h)
+ 	return h - hstates;
+ }
+ 
++pgoff_t __basepage_index(struct page *page);
++
++/* Return page->index in PAGE_SIZE units */
++static inline pgoff_t basepage_index(struct page *page)
++{
++	if (!PageCompound(page))
++		return page->index;
++
++	return __basepage_index(page);
++}
++
+ #else	/* CONFIG_HUGETLB_PAGE */
+ struct hstate {};
+ #define alloc_huge_page_node(h, nid) NULL
+@@ -378,6 +389,11 @@ static inline unsigned int pages_per_huge_page(struct hstate *h)
+ }
+ #define hstate_index_to_shift(index) 0
+ #define hstate_index(h) 0
++
++static inline pgoff_t basepage_index(struct page *page)
++{
++	return page->index;
++}
+ #endif	/* CONFIG_HUGETLB_PAGE */
+ 
+ #endif /* _LINUX_HUGETLB_H */
+diff --git a/kernel/futex.c b/kernel/futex.c
+index b26dcfc..49dacfb 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -61,6 +61,7 @@
+ #include <linux/nsproxy.h>
+ #include <linux/ptrace.h>
+ #include <linux/sched/rt.h>
++#include <linux/hugetlb.h>
+ 
+ #include <asm/futex.h>
+ 
+@@ -365,7 +366,7 @@ again:
+ 	} else {
+ 		key->both.offset |= FUT_OFF_INODE; /* inode-based key */
+ 		key->shared.inode = page_head->mapping->host;
+-		key->shared.pgoff = page_head->index;
++		key->shared.pgoff = basepage_index(page);
+ 	}
+ 
+ 	get_futex_key_refs(key);
+diff --git a/kernel/module.c b/kernel/module.c
+index cab4bce..fa53db8 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -2927,7 +2927,6 @@ static struct module *layout_and_allocate(struct load_info *info, int flags)
+ {
+ 	/* Module within temporary copy. */
+ 	struct module *mod;
+-	Elf_Shdr *pcpusec;
+ 	int err;
+ 
+ 	mod = setup_load_info(info, flags);
+@@ -2942,17 +2941,10 @@ static struct module *layout_and_allocate(struct load_info *info, int flags)
+ 	err = module_frob_arch_sections(info->hdr, info->sechdrs,
+ 					info->secstrings, mod);
+ 	if (err < 0)
+-		goto out;
++		return ERR_PTR(err);
+ 
+-	pcpusec = &info->sechdrs[info->index.pcpu];
+-	if (pcpusec->sh_size) {
+-		/* We have a special allocation for this section. */
+-		err = percpu_modalloc(mod,
+-				      pcpusec->sh_size, pcpusec->sh_addralign);
+-		if (err)
+-			goto out;
+-		pcpusec->sh_flags &= ~(unsigned long)SHF_ALLOC;
+-	}
++	/* We will do a special allocation for per-cpu sections later. */
++	info->sechdrs[info->index.pcpu].sh_flags &= ~(unsigned long)SHF_ALLOC;
+ 
+ 	/* Determine total sizes, and put offsets in sh_entsize.  For now
+ 	   this is done generically; there doesn't appear to be any
+@@ -2963,17 +2955,22 @@ static struct module *layout_and_allocate(struct load_info *info, int flags)
+ 	/* Allocate and move to the final place */
+ 	err = move_module(mod, info);
+ 	if (err)
+-		goto free_percpu;
++		return ERR_PTR(err);
+ 
+ 	/* Module has been copied to its final place now: return it. */
+ 	mod = (void *)info->sechdrs[info->index.mod].sh_addr;
+ 	kmemleak_load_module(mod, info);
+ 	return mod;
++}
+ 
+-free_percpu:
+-	percpu_modfree(mod);
+-out:
+-	return ERR_PTR(err);
++static int alloc_module_percpu(struct module *mod, struct load_info *info)
++{
++	Elf_Shdr *pcpusec = &info->sechdrs[info->index.pcpu];
++	if (!pcpusec->sh_size)
++		return 0;
++
++	/* We have a special allocation for this section. */
++	return percpu_modalloc(mod, pcpusec->sh_size, pcpusec->sh_addralign);
+ }
+ 
+ /* mod is no longer valid after this! */
+@@ -3237,6 +3234,11 @@ static int load_module(struct load_info *info, const char __user *uargs,
+ 	}
+ #endif
+ 
++	/* To avoid stressing percpu allocator, do this once we're unique. */
++	err = alloc_module_percpu(mod, info);
++	if (err)
++		goto unlink_mod;
++
+ 	/* Now module is in final location, initialize linked lists, etc. */
+ 	err = module_unload_init(mod);
+ 	if (err)
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index e2bfbf7..5cf99bf 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -690,6 +690,23 @@ int PageHuge(struct page *page)
+ }
+ EXPORT_SYMBOL_GPL(PageHuge);
+ 
++pgoff_t __basepage_index(struct page *page)
++{
++	struct page *page_head = compound_head(page);
++	pgoff_t index = page_index(page_head);
++	unsigned long compound_idx;
++
++	if (!PageHuge(page_head))
++		return page_index(page);
++
++	if (compound_order(page_head) >= MAX_ORDER)
++		compound_idx = page_to_pfn(page) - page_to_pfn(page_head);
++	else
++		compound_idx = page - page_head;
++
++	return (index << compound_order(page_head)) + compound_idx;
++}
++
+ static struct page *alloc_fresh_huge_page_node(struct hstate *h, int nid)
+ {
+ 	struct page *page;
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 1947218..fd79df5 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -6303,8 +6303,6 @@ mem_cgroup_css_online(struct cgroup *cont)
+ 		 * call __mem_cgroup_free, so return directly
+ 		 */
+ 		mem_cgroup_put(memcg);
+-		if (parent->use_hierarchy)
+-			mem_cgroup_put(parent);
+ 	}
+ 	return error;
+ }
+diff --git a/net/ceph/auth_none.c b/net/ceph/auth_none.c
+index 925ca58..8c93fa8 100644
+--- a/net/ceph/auth_none.c
++++ b/net/ceph/auth_none.c
+@@ -39,6 +39,11 @@ static int should_authenticate(struct ceph_auth_client *ac)
+ 	return xi->starting;
+ }
+ 
++static int build_request(struct ceph_auth_client *ac, void *buf, void *end)
++{
++	return 0;
++}
++
+ /*
+  * the generic auth code decode the global_id, and we carry no actual
+  * authenticate state, so nothing happens here.
+@@ -106,6 +111,7 @@ static const struct ceph_auth_client_ops ceph_auth_none_ops = {
+ 	.destroy = destroy,
+ 	.is_authenticated = is_authenticated,
+ 	.should_authenticate = should_authenticate,
++	.build_request = build_request,
+ 	.handle_reply = handle_reply,
+ 	.create_authorizer = ceph_auth_none_create_authorizer,
+ 	.destroy_authorizer = ceph_auth_none_destroy_authorizer,

Added: genpatches-2.6/trunk/3.10.7/1001_linux-3.10.2.patch
===================================================================
--- genpatches-2.6/trunk/3.10.7/1001_linux-3.10.2.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10.7/1001_linux-3.10.2.patch	2013-08-29 12:09:12 UTC (rev 2497)
@@ -0,0 +1,2395 @@
+diff --git a/Documentation/parisc/registers b/Documentation/parisc/registers
+index dd3cadd..10c7d17 100644
+--- a/Documentation/parisc/registers
++++ b/Documentation/parisc/registers
+@@ -78,6 +78,14 @@ Shadow Registers		used by interruption handler code
+ TOC enable bit			1
+ 
+ =========================================================================
++
++The PA-RISC architecture defines 7 registers as "shadow registers".
++Those are used in RETURN FROM INTERRUPTION AND RESTORE instruction to reduce
++the state save and restore time by eliminating the need for general register
++(GR) saves and restores in interruption handlers.
++Shadow registers are the GRs 1, 8, 9, 16, 17, 24, and 25.
++
++=========================================================================
+ Register usage notes, originally from John Marvin, with some additional
+ notes from Randolph Chung.
+ 
+diff --git a/Makefile b/Makefile
+index b75cc30..4336730 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 1
++SUBLEVEL = 2
+ EXTRAVERSION =
+ NAME = Unicycling Gorilla
+ 
+diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
+index 73fd7d0..587ceef 100644
+--- a/arch/arm/boot/dts/imx23.dtsi
++++ b/arch/arm/boot/dts/imx23.dtsi
+@@ -23,8 +23,12 @@
+ 	};
+ 
+ 	cpus {
+-		cpu@0 {
+-			compatible = "arm,arm926ejs";
++		#address-cells = <0>;
++		#size-cells = <0>;
++
++		cpu {
++			compatible = "arm,arm926ej-s";
++			device_type = "cpu";
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx28.dtsi b/arch/arm/boot/dts/imx28.dtsi
+index 600f7cb..4c10a19 100644
+--- a/arch/arm/boot/dts/imx28.dtsi
++++ b/arch/arm/boot/dts/imx28.dtsi
+@@ -32,8 +32,12 @@
+ 	};
+ 
+ 	cpus {
+-		cpu@0 {
+-			compatible = "arm,arm926ejs";
++		#address-cells = <0>;
++		#size-cells = <0>;
++
++		cpu {
++			compatible = "arm,arm926ej-s";
++			device_type = "cpu";
+ 		};
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx6dl.dtsi b/arch/arm/boot/dts/imx6dl.dtsi
+index 5bcdf3a..62dc781 100644
+--- a/arch/arm/boot/dts/imx6dl.dtsi
++++ b/arch/arm/boot/dts/imx6dl.dtsi
+@@ -18,12 +18,14 @@
+ 
+ 		cpu@0 {
+ 			compatible = "arm,cortex-a9";
++			device_type = "cpu";
+ 			reg = <0>;
+ 			next-level-cache = <&L2>;
+ 		};
+ 
+ 		cpu@1 {
+ 			compatible = "arm,cortex-a9";
++			device_type = "cpu";
+ 			reg = <1>;
+ 			next-level-cache = <&L2>;
+ 		};
+diff --git a/arch/arm/boot/dts/imx6q.dtsi b/arch/arm/boot/dts/imx6q.dtsi
+index 21e6758..dc54a72 100644
+--- a/arch/arm/boot/dts/imx6q.dtsi
++++ b/arch/arm/boot/dts/imx6q.dtsi
+@@ -18,6 +18,7 @@
+ 
+ 		cpu@0 {
+ 			compatible = "arm,cortex-a9";
++			device_type = "cpu";
+ 			reg = <0>;
+ 			next-level-cache = <&L2>;
+ 			operating-points = <
+@@ -39,18 +40,21 @@
+ 
+ 		cpu@1 {
+ 			compatible = "arm,cortex-a9";
++			device_type = "cpu";
+ 			reg = <1>;
+ 			next-level-cache = <&L2>;
+ 		};
+ 
+ 		cpu@2 {
+ 			compatible = "arm,cortex-a9";
++			device_type = "cpu";
+ 			reg = <2>;
+ 			next-level-cache = <&L2>;
+ 		};
+ 
+ 		cpu@3 {
+ 			compatible = "arm,cortex-a9";
++			device_type = "cpu";
+ 			reg = <3>;
+ 			next-level-cache = <&L2>;
+ 		};
+diff --git a/arch/arm/include/asm/mmu_context.h b/arch/arm/include/asm/mmu_context.h
+index a7b85e0..dc90203 100644
+--- a/arch/arm/include/asm/mmu_context.h
++++ b/arch/arm/include/asm/mmu_context.h
+@@ -27,7 +27,15 @@ void __check_vmalloc_seq(struct mm_struct *mm);
+ void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk);
+ #define init_new_context(tsk,mm)	({ atomic64_set(&mm->context.id, 0); 0; })
+ 
+-DECLARE_PER_CPU(atomic64_t, active_asids);
++#ifdef CONFIG_ARM_ERRATA_798181
++void a15_erratum_get_cpumask(int this_cpu, struct mm_struct *mm,
++			     cpumask_t *mask);
++#else  /* !CONFIG_ARM_ERRATA_798181 */
++static inline void a15_erratum_get_cpumask(int this_cpu, struct mm_struct *mm,
++					   cpumask_t *mask)
++{
++}
++#endif /* CONFIG_ARM_ERRATA_798181 */
+ 
+ #else	/* !CONFIG_CPU_HAS_ASID */
+ 
+diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
+index 8c3094d..d9f5cd4 100644
+--- a/arch/arm/kernel/perf_event.c
++++ b/arch/arm/kernel/perf_event.c
+@@ -569,6 +569,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
+ 		return;
+ 	}
+ 
++	perf_callchain_store(entry, regs->ARM_pc);
+ 	tail = (struct frame_tail __user *)regs->ARM_fp - 1;
+ 
+ 	while ((entry->nr < PERF_MAX_STACK_DEPTH) &&
+diff --git a/arch/arm/kernel/smp_tlb.c b/arch/arm/kernel/smp_tlb.c
+index 9a52a07..a98b62d 100644
+--- a/arch/arm/kernel/smp_tlb.c
++++ b/arch/arm/kernel/smp_tlb.c
+@@ -103,7 +103,7 @@ static void broadcast_tlb_a15_erratum(void)
+ 
+ static void broadcast_tlb_mm_a15_erratum(struct mm_struct *mm)
+ {
+-	int cpu, this_cpu;
++	int this_cpu;
+ 	cpumask_t mask = { CPU_BITS_NONE };
+ 
+ 	if (!erratum_a15_798181())
+@@ -111,21 +111,7 @@ static void broadcast_tlb_mm_a15_erratum(struct mm_struct *mm)
+ 
+ 	dummy_flush_tlb_a15_erratum();
+ 	this_cpu = get_cpu();
+-	for_each_online_cpu(cpu) {
+-		if (cpu == this_cpu)
+-			continue;
+-		/*
+-		 * We only need to send an IPI if the other CPUs are running
+-		 * the same ASID as the one being invalidated. There is no
+-		 * need for locking around the active_asids check since the
+-		 * switch_mm() function has at least one dmb() (as required by
+-		 * this workaround) in case a context switch happens on
+-		 * another CPU after the condition below.
+-		 */
+-		if (atomic64_read(&mm->context.id) ==
+-		    atomic64_read(&per_cpu(active_asids, cpu)))
+-			cpumask_set_cpu(cpu, &mask);
+-	}
++	a15_erratum_get_cpumask(this_cpu, mm, &mask);
+ 	smp_call_function_many(&mask, ipi_flush_tlb_a15_erratum, NULL, 1);
+ 	put_cpu();
+ }
+diff --git a/arch/arm/kernel/smp_twd.c b/arch/arm/kernel/smp_twd.c
+index 90525d9..f6fd1d4 100644
+--- a/arch/arm/kernel/smp_twd.c
++++ b/arch/arm/kernel/smp_twd.c
+@@ -120,7 +120,7 @@ static int twd_rate_change(struct notifier_block *nb,
+ 	 * changing cpu.
+ 	 */
+ 	if (flags == POST_RATE_CHANGE)
+-		smp_call_function(twd_update_frequency,
++		on_each_cpu(twd_update_frequency,
+ 				  (void *)&cnd->new_rate, 1);
+ 
+ 	return NOTIFY_OK;
+diff --git a/arch/arm/mach-shmobile/setup-emev2.c b/arch/arm/mach-shmobile/setup-emev2.c
+index 899a86c..1ccddd2 100644
+--- a/arch/arm/mach-shmobile/setup-emev2.c
++++ b/arch/arm/mach-shmobile/setup-emev2.c
+@@ -287,14 +287,14 @@ static struct gpio_em_config gio3_config = {
+ static struct resource gio3_resources[] = {
+ 	[0] = {
+ 		.name	= "GIO_096",
+-		.start	= 0xe0050100,
+-		.end	= 0xe005012b,
++		.start	= 0xe0050180,
++		.end	= 0xe00501ab,
+ 		.flags	= IORESOURCE_MEM,
+ 	},
+ 	[1] = {
+ 		.name	= "GIO_096",
+-		.start	= 0xe0050140,
+-		.end	= 0xe005015f,
++		.start	= 0xe00501c0,
++		.end	= 0xe00501df,
+ 		.flags	= IORESOURCE_MEM,
+ 	},
+ 	[2] = {
+diff --git a/arch/arm/mach-shmobile/setup-r8a73a4.c b/arch/arm/mach-shmobile/setup-r8a73a4.c
+index c5a75a7..7f45c2e 100644
+--- a/arch/arm/mach-shmobile/setup-r8a73a4.c
++++ b/arch/arm/mach-shmobile/setup-r8a73a4.c
+@@ -62,7 +62,7 @@ enum { SCIFA0, SCIFA1, SCIFB0, SCIFB1, SCIFB2, SCIFB3 };
+ static const struct plat_sci_port scif[] = {
+ 	SCIFA_DATA(SCIFA0, 0xe6c40000, gic_spi(144)), /* SCIFA0 */
+ 	SCIFA_DATA(SCIFA1, 0xe6c50000, gic_spi(145)), /* SCIFA1 */
+-	SCIFB_DATA(SCIFB0, 0xe6c50000, gic_spi(145)), /* SCIFB0 */
++	SCIFB_DATA(SCIFB0, 0xe6c20000, gic_spi(148)), /* SCIFB0 */
+ 	SCIFB_DATA(SCIFB1, 0xe6c30000, gic_spi(149)), /* SCIFB1 */
+ 	SCIFB_DATA(SCIFB2, 0xe6ce0000, gic_spi(150)), /* SCIFB2 */
+ 	SCIFB_DATA(SCIFB3, 0xe6cf0000, gic_spi(151)), /* SCIFB3 */
+diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
+index 2ac3737..eeab06e 100644
+--- a/arch/arm/mm/context.c
++++ b/arch/arm/mm/context.c
+@@ -39,19 +39,43 @@
+  * non 64-bit operations.
+  */
+ #define ASID_FIRST_VERSION	(1ULL << ASID_BITS)
+-#define NUM_USER_ASIDS		(ASID_FIRST_VERSION - 1)
+-
+-#define ASID_TO_IDX(asid)	((asid & ~ASID_MASK) - 1)
+-#define IDX_TO_ASID(idx)	((idx + 1) & ~ASID_MASK)
++#define NUM_USER_ASIDS		ASID_FIRST_VERSION
+ 
+ static DEFINE_RAW_SPINLOCK(cpu_asid_lock);
+ static atomic64_t asid_generation = ATOMIC64_INIT(ASID_FIRST_VERSION);
+ static DECLARE_BITMAP(asid_map, NUM_USER_ASIDS);
+ 
+-DEFINE_PER_CPU(atomic64_t, active_asids);
++static DEFINE_PER_CPU(atomic64_t, active_asids);
+ static DEFINE_PER_CPU(u64, reserved_asids);
+ static cpumask_t tlb_flush_pending;
+ 
++#ifdef CONFIG_ARM_ERRATA_798181
++void a15_erratum_get_cpumask(int this_cpu, struct mm_struct *mm,
++			     cpumask_t *mask)
++{
++	int cpu;
++	unsigned long flags;
++	u64 context_id, asid;
++
++	raw_spin_lock_irqsave(&cpu_asid_lock, flags);
++	context_id = mm->context.id.counter;
++	for_each_online_cpu(cpu) {
++		if (cpu == this_cpu)
++			continue;
++		/*
++		 * We only need to send an IPI if the other CPUs are
++		 * running the same ASID as the one being invalidated.
++		 */
++		asid = per_cpu(active_asids, cpu).counter;
++		if (asid == 0)
++			asid = per_cpu(reserved_asids, cpu);
++		if (context_id == asid)
++			cpumask_set_cpu(cpu, mask);
++	}
++	raw_spin_unlock_irqrestore(&cpu_asid_lock, flags);
++}
++#endif
++
+ #ifdef CONFIG_ARM_LPAE
+ static void cpu_set_reserved_ttbr0(void)
+ {
+@@ -128,7 +152,16 @@ static void flush_context(unsigned int cpu)
+ 			asid = 0;
+ 		} else {
+ 			asid = atomic64_xchg(&per_cpu(active_asids, i), 0);
+-			__set_bit(ASID_TO_IDX(asid), asid_map);
++			/*
++			 * If this CPU has already been through a
++			 * rollover, but hasn't run another task in
++			 * the meantime, we must preserve its reserved
++			 * ASID, as this is the only trace we have of
++			 * the process it is still running.
++			 */
++			if (asid == 0)
++				asid = per_cpu(reserved_asids, i);
++			__set_bit(asid & ~ASID_MASK, asid_map);
+ 		}
+ 		per_cpu(reserved_asids, i) = asid;
+ 	}
+@@ -167,17 +200,19 @@ static u64 new_context(struct mm_struct *mm, unsigned int cpu)
+ 		/*
+ 		 * Allocate a free ASID. If we can't find one, take a
+ 		 * note of the currently active ASIDs and mark the TLBs
+-		 * as requiring flushes.
++		 * as requiring flushes. We always count from ASID #1,
++		 * as we reserve ASID #0 to switch via TTBR0 and indicate
++		 * rollover events.
+ 		 */
+-		asid = find_first_zero_bit(asid_map, NUM_USER_ASIDS);
++		asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, 1);
+ 		if (asid == NUM_USER_ASIDS) {
+ 			generation = atomic64_add_return(ASID_FIRST_VERSION,
+ 							 &asid_generation);
+ 			flush_context(cpu);
+-			asid = find_first_zero_bit(asid_map, NUM_USER_ASIDS);
++			asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, 1);
+ 		}
+ 		__set_bit(asid, asid_map);
+-		asid = generation | IDX_TO_ASID(asid);
++		asid |= generation;
+ 		cpumask_clear(mm_cpumask(mm));
+ 	}
+ 
+diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
+index 9a5cdc0..0ecc43f 100644
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -600,7 +600,7 @@ void __init mem_init(void)
+ 
+ #ifdef CONFIG_SA1111
+ 	/* now that our DMA memory is actually so designated, we can free it */
+-	free_reserved_area(__va(PHYS_PFN_OFFSET), swapper_pg_dir, 0, NULL);
++	free_reserved_area(__va(PHYS_OFFSET), swapper_pg_dir, 0, NULL);
+ #endif
+ 
+ 	free_highpages();
+diff --git a/arch/c6x/mm/init.c b/arch/c6x/mm/init.c
+index a9fcd89..b74ccb5 100644
+--- a/arch/c6x/mm/init.c
++++ b/arch/c6x/mm/init.c
+@@ -18,6 +18,7 @@
+ #include <linux/initrd.h>
+ 
+ #include <asm/sections.h>
++#include <asm/uaccess.h>
+ 
+ /*
+  * ZERO_PAGE is a special page that is used for zero-initialized
+diff --git a/arch/parisc/include/asm/special_insns.h b/arch/parisc/include/asm/special_insns.h
+index d306b75..e150930 100644
+--- a/arch/parisc/include/asm/special_insns.h
++++ b/arch/parisc/include/asm/special_insns.h
+@@ -32,9 +32,12 @@ static inline void set_eiem(unsigned long val)
+ 	cr;				\
+ })
+ 
+-#define mtsp(gr, cr) \
+-	__asm__ __volatile__("mtsp %0,%1" \
++#define mtsp(val, cr) \
++	{ if (__builtin_constant_p(val) && ((val) == 0)) \
++	 __asm__ __volatile__("mtsp %%r0,%0" : : "i" (cr) : "memory"); \
++	else \
++	 __asm__ __volatile__("mtsp %0,%1" \
+ 		: /* no outputs */ \
+-		: "r" (gr), "i" (cr) : "memory")
++		: "r" (val), "i" (cr) : "memory"); }
+ 
+ #endif /* __PARISC_SPECIAL_INSNS_H */
+diff --git a/arch/parisc/include/asm/tlbflush.h b/arch/parisc/include/asm/tlbflush.h
+index 5273da9..9d086a5 100644
+--- a/arch/parisc/include/asm/tlbflush.h
++++ b/arch/parisc/include/asm/tlbflush.h
+@@ -63,13 +63,14 @@ static inline void flush_tlb_mm(struct mm_struct *mm)
+ static inline void flush_tlb_page(struct vm_area_struct *vma,
+ 	unsigned long addr)
+ {
+-	unsigned long flags;
++	unsigned long flags, sid;
+ 
+ 	/* For one page, it's not worth testing the split_tlb variable */
+ 
+ 	mb();
+-	mtsp(vma->vm_mm->context,1);
++	sid = vma->vm_mm->context;
+ 	purge_tlb_start(flags);
++	mtsp(sid, 1);
+ 	pdtlb(addr);
+ 	pitlb(addr);
+ 	purge_tlb_end(flags);
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index 65fb4cb..2e65aa5 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -440,8 +440,8 @@ void __flush_tlb_range(unsigned long sid, unsigned long start,
+ 	else {
+ 		unsigned long flags;
+ 
+-		mtsp(sid, 1);
+ 		purge_tlb_start(flags);
++		mtsp(sid, 1);
+ 		if (split_tlb) {
+ 			while (npages--) {
+ 				pdtlb(start);
+diff --git a/arch/parisc/lib/memcpy.c b/arch/parisc/lib/memcpy.c
+index a49cc81..ac4370b 100644
+--- a/arch/parisc/lib/memcpy.c
++++ b/arch/parisc/lib/memcpy.c
+@@ -2,6 +2,7 @@
+  *    Optimized memory copy routines.
+  *
+  *    Copyright (C) 2004 Randolph Chung <tausq@××××××.org>
++ *    Copyright (C) 2013 Helge Deller <deller@×××.de>
+  *
+  *    This program is free software; you can redistribute it and/or modify
+  *    it under the terms of the GNU General Public License as published by
+@@ -153,17 +154,21 @@ static inline void prefetch_dst(const void *addr)
+ #define prefetch_dst(addr) do { } while(0)
+ #endif
+ 
++#define PA_MEMCPY_OK		0
++#define PA_MEMCPY_LOAD_ERROR	1
++#define PA_MEMCPY_STORE_ERROR	2
++
+ /* Copy from a not-aligned src to an aligned dst, using shifts. Handles 4 words
+  * per loop.  This code is derived from glibc. 
+  */
+-static inline unsigned long copy_dstaligned(unsigned long dst, unsigned long src, unsigned long len, unsigned long o_dst, unsigned long o_src, unsigned long o_len)
++static inline unsigned long copy_dstaligned(unsigned long dst,
++					unsigned long src, unsigned long len)
+ {
+ 	/* gcc complains that a2 and a3 may be uninitialized, but actually
+ 	 * they cannot be.  Initialize a2/a3 to shut gcc up.
+ 	 */
+ 	register unsigned int a0, a1, a2 = 0, a3 = 0;
+ 	int sh_1, sh_2;
+-	struct exception_data *d;
+ 
+ 	/* prefetch_src((const void *)src); */
+ 
+@@ -197,7 +202,7 @@ static inline unsigned long copy_dstaligned(unsigned long dst, unsigned long src
+ 			goto do2;
+ 		case 0:
+ 			if (len == 0)
+-				return 0;
++				return PA_MEMCPY_OK;
+ 			/* a3 = ((unsigned int *) src)[0];
+ 			   a0 = ((unsigned int *) src)[1]; */
+ 			ldw(s_space, 0, src, a3, cda_ldw_exc);
+@@ -256,42 +261,35 @@ do0:
+ 	preserve_branch(handle_load_error);
+ 	preserve_branch(handle_store_error);
+ 
+-	return 0;
++	return PA_MEMCPY_OK;
+ 
+ handle_load_error:
+ 	__asm__ __volatile__ ("cda_ldw_exc:\n");
+-	d = &__get_cpu_var(exception_data);
+-	DPRINTF("cda_ldw_exc: o_len=%lu fault_addr=%lu o_src=%lu ret=%lu\n",
+-		o_len, d->fault_addr, o_src, o_len - d->fault_addr + o_src);
+-	return o_len * 4 - d->fault_addr + o_src;
++	return PA_MEMCPY_LOAD_ERROR;
+ 
+ handle_store_error:
+ 	__asm__ __volatile__ ("cda_stw_exc:\n");
+-	d = &__get_cpu_var(exception_data);
+-	DPRINTF("cda_stw_exc: o_len=%lu fault_addr=%lu o_dst=%lu ret=%lu\n",
+-		o_len, d->fault_addr, o_dst, o_len - d->fault_addr + o_dst);
+-	return o_len * 4 - d->fault_addr + o_dst;
++	return PA_MEMCPY_STORE_ERROR;
+ }
+ 
+ 
+-/* Returns 0 for success, otherwise, returns number of bytes not transferred. */
+-static unsigned long pa_memcpy(void *dstp, const void *srcp, unsigned long len)
++/* Returns PA_MEMCPY_OK, PA_MEMCPY_LOAD_ERROR or PA_MEMCPY_STORE_ERROR.
++ * In case of an access fault the faulty address can be read from the per_cpu
++ * exception data struct. */
++static unsigned long pa_memcpy_internal(void *dstp, const void *srcp,
++					unsigned long len)
+ {
+ 	register unsigned long src, dst, t1, t2, t3;
+ 	register unsigned char *pcs, *pcd;
+ 	register unsigned int *pws, *pwd;
+ 	register double *pds, *pdd;
+-	unsigned long ret = 0;
+-	unsigned long o_dst, o_src, o_len;
+-	struct exception_data *d;
++	unsigned long ret;
+ 
+ 	src = (unsigned long)srcp;
+ 	dst = (unsigned long)dstp;
+ 	pcs = (unsigned char *)srcp;
+ 	pcd = (unsigned char *)dstp;
+ 
+-	o_dst = dst; o_src = src; o_len = len;
+-
+ 	/* prefetch_src((const void *)srcp); */
+ 
+ 	if (len < THRESHOLD)
+@@ -401,7 +399,7 @@ byte_copy:
+ 		len--;
+ 	}
+ 
+-	return 0;
++	return PA_MEMCPY_OK;
+ 
+ unaligned_copy:
+ 	/* possibly we are aligned on a word, but not on a double... */
+@@ -438,8 +436,7 @@ unaligned_copy:
+ 		src = (unsigned long)pcs;
+ 	}
+ 
+-	ret = copy_dstaligned(dst, src, len / sizeof(unsigned int), 
+-		o_dst, o_src, o_len);
++	ret = copy_dstaligned(dst, src, len / sizeof(unsigned int));
+ 	if (ret)
+ 		return ret;
+ 
+@@ -454,17 +451,41 @@ unaligned_copy:
+ 
+ handle_load_error:
+ 	__asm__ __volatile__ ("pmc_load_exc:\n");
+-	d = &__get_cpu_var(exception_data);
+-	DPRINTF("pmc_load_exc: o_len=%lu fault_addr=%lu o_src=%lu ret=%lu\n",
+-		o_len, d->fault_addr, o_src, o_len - d->fault_addr + o_src);
+-	return o_len - d->fault_addr + o_src;
++	return PA_MEMCPY_LOAD_ERROR;
+ 
+ handle_store_error:
+ 	__asm__ __volatile__ ("pmc_store_exc:\n");
++	return PA_MEMCPY_STORE_ERROR;
++}
++
++
++/* Returns 0 for success, otherwise, returns number of bytes not transferred. */
++static unsigned long pa_memcpy(void *dstp, const void *srcp, unsigned long len)
++{
++	unsigned long ret, fault_addr, reference;
++	struct exception_data *d;
++
++	ret = pa_memcpy_internal(dstp, srcp, len);
++	if (likely(ret == PA_MEMCPY_OK))
++		return 0;
++
++	/* if a load or store fault occured we can get the faulty addr */
+ 	d = &__get_cpu_var(exception_data);
+-	DPRINTF("pmc_store_exc: o_len=%lu fault_addr=%lu o_dst=%lu ret=%lu\n",
+-		o_len, d->fault_addr, o_dst, o_len - d->fault_addr + o_dst);
+-	return o_len - d->fault_addr + o_dst;
++	fault_addr = d->fault_addr;
++
++	/* error in load or store? */
++	if (ret == PA_MEMCPY_LOAD_ERROR)
++		reference = (unsigned long) srcp;
++	else
++		reference = (unsigned long) dstp;
++
++	DPRINTF("pa_memcpy: fault type = %lu, len=%lu fault_addr=%lu ref=%lu\n",
++		ret, len, fault_addr, reference);
++
++	if (fault_addr >= reference)
++		return len - (fault_addr - reference);
++	else
++		return len;
+ }
+ 
+ #ifdef __KERNEL__
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index c205035..d606463 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -992,18 +992,20 @@ static efi_status_t exit_boot(struct boot_params *boot_params,
+ 	efi_memory_desc_t *mem_map;
+ 	efi_status_t status;
+ 	__u32 desc_version;
++	bool called_exit = false;
+ 	u8 nr_entries;
+ 	int i;
+ 
+ 	size = sizeof(*mem_map) * 32;
+ 
+ again:
+-	size += sizeof(*mem_map);
++	size += sizeof(*mem_map) * 2;
+ 	_size = size;
+ 	status = low_alloc(size, 1, (unsigned long *)&mem_map);
+ 	if (status != EFI_SUCCESS)
+ 		return status;
+ 
++get_map:
+ 	status = efi_call_phys5(sys_table->boottime->get_memory_map, &size,
+ 				mem_map, &key, &desc_size, &desc_version);
+ 	if (status == EFI_BUFFER_TOO_SMALL) {
+@@ -1029,8 +1031,20 @@ again:
+ 	/* Might as well exit boot services now */
+ 	status = efi_call_phys2(sys_table->boottime->exit_boot_services,
+ 				handle, key);
+-	if (status != EFI_SUCCESS)
+-		goto free_mem_map;
++	if (status != EFI_SUCCESS) {
++		/*
++		 * ExitBootServices() will fail if any of the event
++		 * handlers change the memory map. In which case, we
++		 * must be prepared to retry, but only once so that
++		 * we're guaranteed to exit on repeated failures instead
++		 * of spinning forever.
++		 */
++		if (called_exit)
++			goto free_mem_map;
++
++		called_exit = true;
++		goto get_map;
++	}
+ 
+ 	/* Historic? */
+ 	boot_params->alt_mem_k = 32 * 1024;
+diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
+index 3d88bfd..13e8935 100644
+--- a/arch/x86/xen/time.c
++++ b/arch/x86/xen/time.c
+@@ -36,9 +36,8 @@ static DEFINE_PER_CPU(struct vcpu_runstate_info, xen_runstate);
+ /* snapshots of runstate info */
+ static DEFINE_PER_CPU(struct vcpu_runstate_info, xen_runstate_snapshot);
+ 
+-/* unused ns of stolen and blocked time */
++/* unused ns of stolen time */
+ static DEFINE_PER_CPU(u64, xen_residual_stolen);
+-static DEFINE_PER_CPU(u64, xen_residual_blocked);
+ 
+ /* return an consistent snapshot of 64-bit time/counter value */
+ static u64 get64(const u64 *p)
+@@ -115,7 +114,7 @@ static void do_stolen_accounting(void)
+ {
+ 	struct vcpu_runstate_info state;
+ 	struct vcpu_runstate_info *snap;
+-	s64 blocked, runnable, offline, stolen;
++	s64 runnable, offline, stolen;
+ 	cputime_t ticks;
+ 
+ 	get_runstate_snapshot(&state);
+@@ -125,7 +124,6 @@ static void do_stolen_accounting(void)
+ 	snap = &__get_cpu_var(xen_runstate_snapshot);
+ 
+ 	/* work out how much time the VCPU has not been runn*ing*  */
+-	blocked = state.time[RUNSTATE_blocked] - snap->time[RUNSTATE_blocked];
+ 	runnable = state.time[RUNSTATE_runnable] - snap->time[RUNSTATE_runnable];
+ 	offline = state.time[RUNSTATE_offline] - snap->time[RUNSTATE_offline];
+ 
+@@ -141,17 +139,6 @@ static void do_stolen_accounting(void)
+ 	ticks = iter_div_u64_rem(stolen, NS_PER_TICK, &stolen);
+ 	__this_cpu_write(xen_residual_stolen, stolen);
+ 	account_steal_ticks(ticks);
+-
+-	/* Add the appropriate number of ticks of blocked time,
+-	   including any left-overs from last time. */
+-	blocked += __this_cpu_read(xen_residual_blocked);
+-
+-	if (blocked < 0)
+-		blocked = 0;
+-
+-	ticks = iter_div_u64_rem(blocked, NS_PER_TICK, &blocked);
+-	__this_cpu_write(xen_residual_blocked, blocked);
+-	account_idle_ticks(ticks);
+ }
+ 
+ /* Get the TSC speed from Xen */
+diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
+index 536562c..97c949a 100644
+--- a/drivers/acpi/Makefile
++++ b/drivers/acpi/Makefile
+@@ -43,6 +43,7 @@ acpi-y				+= acpi_platform.o
+ acpi-y				+= power.o
+ acpi-y				+= event.o
+ acpi-y				+= sysfs.o
++acpi-$(CONFIG_X86)		+= acpi_cmos_rtc.o
+ acpi-$(CONFIG_DEBUG_FS)		+= debugfs.o
+ acpi-$(CONFIG_ACPI_NUMA)	+= numa.o
+ acpi-$(CONFIG_ACPI_PROCFS_POWER) += cm_sbs.o
+diff --git a/drivers/acpi/acpi_cmos_rtc.c b/drivers/acpi/acpi_cmos_rtc.c
+new file mode 100644
+index 0000000..84190ed
+--- /dev/null
++++ b/drivers/acpi/acpi_cmos_rtc.c
+@@ -0,0 +1,92 @@
++/*
++ * ACPI support for CMOS RTC Address Space access
++ *
++ * Copyright (C) 2013, Intel Corporation
++ * Authors: Lan Tianyu <tianyu.lan@×××××.com>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/acpi.h>
++#include <linux/device.h>
++#include <linux/err.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <asm-generic/rtc.h>
++
++#include "internal.h"
++
++#define PREFIX "ACPI: "
++
++ACPI_MODULE_NAME("cmos rtc");
++
++static const struct acpi_device_id acpi_cmos_rtc_ids[] = {
++	{ "PNP0B00" },
++	{ "PNP0B01" },
++	{ "PNP0B02" },
++	{}
++};
++
++static acpi_status
++acpi_cmos_rtc_space_handler(u32 function, acpi_physical_address address,
++		      u32 bits, u64 *value64,
++		      void *handler_context, void *region_context)
++{
++	int i;
++	u8 *value = (u8 *)&value64;
++
++	if (address > 0xff || !value64)
++		return AE_BAD_PARAMETER;
++
++	if (function != ACPI_WRITE && function != ACPI_READ)
++		return AE_BAD_PARAMETER;
++
++	spin_lock_irq(&rtc_lock);
++
++	for (i = 0; i < DIV_ROUND_UP(bits, 8); ++i, ++address, ++value)
++		if (function == ACPI_READ)
++			*value = CMOS_READ(address);
++		else
++			CMOS_WRITE(*value, address);
++
++	spin_unlock_irq(&rtc_lock);
++
++	return AE_OK;
++}
++
++static int acpi_install_cmos_rtc_space_handler(struct acpi_device *adev,
++		const struct acpi_device_id *id)
++{
++	acpi_status status;
++
++	status = acpi_install_address_space_handler(adev->handle,
++			ACPI_ADR_SPACE_CMOS,
++			&acpi_cmos_rtc_space_handler,
++			NULL, NULL);
++	if (ACPI_FAILURE(status)) {
++		pr_err(PREFIX "Error installing CMOS-RTC region handler\n");
++		return -ENODEV;
++	}
++
++	return 0;
++}
++
++static void acpi_remove_cmos_rtc_space_handler(struct acpi_device *adev)
++{
++	if (ACPI_FAILURE(acpi_remove_address_space_handler(adev->handle,
++			ACPI_ADR_SPACE_CMOS, &acpi_cmos_rtc_space_handler)))
++		pr_err(PREFIX "Error removing CMOS-RTC region handler\n");
++}
++
++static struct acpi_scan_handler cmos_rtc_handler = {
++	.ids = acpi_cmos_rtc_ids,
++	.attach = acpi_install_cmos_rtc_space_handler,
++	.detach = acpi_remove_cmos_rtc_space_handler,
++};
++
++void __init acpi_cmos_rtc_init(void)
++{
++	acpi_scan_add_handler(&cmos_rtc_handler);
++}
+diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c
+index 35eebda..09b06e2 100644
+--- a/drivers/acpi/acpica/hwxfsleep.c
++++ b/drivers/acpi/acpica/hwxfsleep.c
+@@ -240,12 +240,14 @@ static acpi_status acpi_hw_sleep_dispatch(u8 sleep_state, u32 function_id)
+ 	    &acpi_sleep_dispatch[function_id];
+ 
+ #if (!ACPI_REDUCED_HARDWARE)
+-
+ 	/*
+ 	 * If the Hardware Reduced flag is set (from the FADT), we must
+-	 * use the extended sleep registers
++	 * use the extended sleep registers (FADT). Note: As per the ACPI
++	 * specification, these extended registers are to be used for HW-reduced
++	 * platforms only. They are not general-purpose replacements for the
++	 * legacy PM register sleep support.
+ 	 */
+-	if (acpi_gbl_reduced_hardware || acpi_gbl_FADT.sleep_control.address) {
++	if (acpi_gbl_reduced_hardware) {
+ 		status = sleep_functions->extended_function(sleep_state);
+ 	} else {
+ 		/* Legacy sleep */
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index 31c217a..553527c 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -324,14 +324,27 @@ int acpi_bus_update_power(acpi_handle handle, int *state_p)
+ 	if (result)
+ 		return result;
+ 
+-	if (state == ACPI_STATE_UNKNOWN)
++	if (state == ACPI_STATE_UNKNOWN) {
+ 		state = ACPI_STATE_D0;
+-
+-	result = acpi_device_set_power(device, state);
+-	if (!result && state_p)
++		result = acpi_device_set_power(device, state);
++		if (result)
++			return result;
++	} else {
++		if (device->power.flags.power_resources) {
++			/*
++			 * We don't need to really switch the state, bu we need
++			 * to update the power resources' reference counters.
++			 */
++			result = acpi_power_transition(device, state);
++			if (result)
++				return result;
++		}
++		device->power.state = state;
++	}
++	if (state_p)
+ 		*state_p = state;
+ 
+-	return result;
++	return 0;
+ }
+ EXPORT_SYMBOL_GPL(acpi_bus_update_power);
+ 
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index edc0081..80403c1 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -983,6 +983,10 @@ static struct dmi_system_id __initdata ec_dmi_table[] = {
+ 	ec_enlarge_storm_threshold, "CLEVO hardware", {
+ 	DMI_MATCH(DMI_SYS_VENDOR, "CLEVO Co."),
+ 	DMI_MATCH(DMI_PRODUCT_NAME, "M720T/M730T"),}, NULL},
++	{
++	ec_skip_dsdt_scan, "HP Folio 13", {
++	DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++	DMI_MATCH(DMI_PRODUCT_NAME, "HP Folio 13"),}, NULL},
+ 	{},
+ };
+ 
+diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
+index c610a76..63a0854 100644
+--- a/drivers/acpi/internal.h
++++ b/drivers/acpi/internal.h
+@@ -50,6 +50,11 @@ void acpi_memory_hotplug_init(void);
+ #else
+ static inline void acpi_memory_hotplug_init(void) {}
+ #endif
++#ifdef CONFIG_X86
++void acpi_cmos_rtc_init(void);
++#else
++static inline void acpi_cmos_rtc_init(void) {}
++#endif
+ 
+ void acpi_sysfs_add_hotplug_profile(struct acpi_hotplug_profile *hotplug,
+ 				    const char *name);
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 27da630..14807e5 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -2040,6 +2040,7 @@ int __init acpi_scan_init(void)
+ 	acpi_pci_link_init();
+ 	acpi_platform_init();
+ 	acpi_lpss_init();
++	acpi_cmos_rtc_init();
+ 	acpi_container_init();
+ 	acpi_memory_hotplug_init();
+ 	acpi_dock_init();
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 2b50dfd..b112625 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -291,6 +291,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	{ PCI_VDEVICE(INTEL, 0x8d64), board_ahci }, /* Wellsburg RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x8d66), board_ahci }, /* Wellsburg RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x8d6e), board_ahci }, /* Wellsburg RAID */
++	{ PCI_VDEVICE(INTEL, 0x23a3), board_ahci }, /* Coleto Creek AHCI */
+ 
+ 	/* JMicron 360/1/3/5/6, match class to avoid IDE function */
+ 	{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+@@ -310,6 +311,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 
+ 	/* AMD */
+ 	{ PCI_VDEVICE(AMD, 0x7800), board_ahci }, /* AMD Hudson-2 */
++	{ PCI_VDEVICE(AMD, 0x7900), board_ahci }, /* AMD CZ */
+ 	/* AMD is using RAID class only for ahci controllers */
+ 	{ PCI_VENDOR_ID_AMD, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+ 	  PCI_CLASS_STORAGE_RAID << 8, 0xffffff, board_ahci },
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index a70ff15..7b9bdd8 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -1560,8 +1560,7 @@ static void ahci_error_intr(struct ata_port *ap, u32 irq_stat)
+ 		u32 fbs = readl(port_mmio + PORT_FBS);
+ 		int pmp = fbs >> PORT_FBS_DWE_OFFSET;
+ 
+-		if ((fbs & PORT_FBS_SDE) && (pmp < ap->nr_pmp_links) &&
+-		    ata_link_online(&ap->pmp_link[pmp])) {
++		if ((fbs & PORT_FBS_SDE) && (pmp < ap->nr_pmp_links)) {
+ 			link = &ap->pmp_link[pmp];
+ 			fbs_need_dec = true;
+ 		}
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 46b35f7..cf1576d 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -623,8 +623,10 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ 		if (!nbd->sock)
+ 			return -EINVAL;
+ 
++		nbd->disconnect = 1;
++
+ 		nbd_send_req(nbd, &sreq);
+-                return 0;
++		return 0;
+ 	}
+  
+ 	case NBD_CLEAR_SOCK: {
+@@ -654,6 +656,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ 				nbd->sock = SOCKET_I(inode);
+ 				if (max_part > 0)
+ 					bdev->bd_invalidated = 1;
++				nbd->disconnect = 0; /* we're connected now */
+ 				return 0;
+ 			} else {
+ 				fput(file);
+@@ -743,6 +746,8 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ 		set_capacity(nbd->disk, 0);
+ 		if (max_part > 0)
+ 			ioctl_by_bdev(bdev, BLKRRPART, 0);
++		if (nbd->disconnect) /* user requested, ignore socket errors */
++			return 0;
+ 		return nbd->harderror;
+ 	}
+ 
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index a17553f..7ec82f0 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2485,10 +2485,10 @@ static void pl330_free_chan_resources(struct dma_chan *chan)
+ 	struct dma_pl330_chan *pch = to_pchan(chan);
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&pch->lock, flags);
+-
+ 	tasklet_kill(&pch->task);
+ 
++	spin_lock_irqsave(&pch->lock, flags);
++
+ 	pl330_release_channel(pch->pl330_chid);
+ 	pch->pl330_chid = NULL;
+ 
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index feae88b..c7710b5 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -524,6 +524,12 @@ static const struct hid_device_id apple_devices[] = {
+ 		.driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS),
+ 		.driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI),
++		.driver_data = APPLE_HAS_FN },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ISO),
++		.driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS),
++		.driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI),
+ 		.driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO),
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 264f550..402f486 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1547,6 +1547,9 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ISO) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS) },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
+@@ -2179,6 +2182,9 @@ static const struct hid_device_id hid_mouse_ignore_list[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ISO) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
+ 	{ }
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 38535c9..2168885 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -135,6 +135,9 @@
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS   0x023b
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI  0x0255
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO   0x0256
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI	0x0291
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO	0x0292
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS	0x0293
+ #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY	0x030a
+ #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY	0x030b
+ #define USB_DEVICE_ID_APPLE_IRCONTROL	0x8240
+diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
+index d6fbb577..791f45d 100644
+--- a/drivers/hv/ring_buffer.c
++++ b/drivers/hv/ring_buffer.c
+@@ -32,7 +32,7 @@
+ void hv_begin_read(struct hv_ring_buffer_info *rbi)
+ {
+ 	rbi->ring_buffer->interrupt_mask = 1;
+-	smp_mb();
++	mb();
+ }
+ 
+ u32 hv_end_read(struct hv_ring_buffer_info *rbi)
+@@ -41,7 +41,7 @@ u32 hv_end_read(struct hv_ring_buffer_info *rbi)
+ 	u32 write;
+ 
+ 	rbi->ring_buffer->interrupt_mask = 0;
+-	smp_mb();
++	mb();
+ 
+ 	/*
+ 	 * Now check to see if the ring buffer is still empty.
+@@ -71,7 +71,7 @@ u32 hv_end_read(struct hv_ring_buffer_info *rbi)
+ 
+ static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi)
+ {
+-	smp_mb();
++	mb();
+ 	if (rbi->ring_buffer->interrupt_mask)
+ 		return false;
+ 
+@@ -442,7 +442,7 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+ 					     sizeof(u64));
+ 
+ 	/* Issue a full memory barrier before updating the write index */
+-	smp_mb();
++	mb();
+ 
+ 	/* Now, update the write location */
+ 	hv_set_next_write_location(outring_info, next_write_location);
+@@ -549,7 +549,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info, void *buffer,
+ 	/* Make sure all reads are done before we update the read index since */
+ 	/* the writer may start writing to the read area once the read index */
+ 	/*is updated */
+-	smp_mb();
++	mb();
+ 
+ 	/* Update the read index */
+ 	hv_set_next_read_location(inring_info, next_read_location);
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index bf421e0..4004e54 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -434,7 +434,7 @@ static void vmbus_on_msg_dpc(unsigned long data)
+ 		 * will not deliver any more messages since there is
+ 		 * no empty slot
+ 		 */
+-		smp_mb();
++		mb();
+ 
+ 		if (msg->header.message_flags.msg_pending) {
+ 			/*
+diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
+index 2baff1b..4ef4d5e 100644
+--- a/drivers/input/mouse/bcm5974.c
++++ b/drivers/input/mouse/bcm5974.c
+@@ -88,6 +88,10 @@
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI	0x0259
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO	0x025a
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS	0x025b
++/* MacbookAir6,2 (unibody, June 2013) */
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI	0x0291
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO	0x0292
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS	0x0293
+ 
+ #define BCM5974_DEVICE(prod) {					\
+ 	.match_flags = (USB_DEVICE_ID_MATCH_DEVICE |		\
+@@ -145,6 +149,10 @@ static const struct usb_device_id bcm5974_table[] = {
+ 	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7A_ANSI),
+ 	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO),
+ 	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS),
++	/* MacbookAir6,2 */
++	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI),
++	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING8_ISO),
++	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING8_JIS),
+ 	/* Terminating entry */
+ 	{}
+ };
+@@ -172,15 +180,18 @@ struct bt_data {
+ /* trackpad header types */
+ enum tp_type {
+ 	TYPE1,			/* plain trackpad */
+-	TYPE2			/* button integrated in trackpad */
++	TYPE2,			/* button integrated in trackpad */
++	TYPE3			/* additional header fields since June 2013 */
+ };
+ 
+ /* trackpad finger data offsets, le16-aligned */
+ #define FINGER_TYPE1		(13 * sizeof(__le16))
+ #define FINGER_TYPE2		(15 * sizeof(__le16))
++#define FINGER_TYPE3		(19 * sizeof(__le16))
+ 
+ /* trackpad button data offsets */
+ #define BUTTON_TYPE2		15
++#define BUTTON_TYPE3		23
+ 
+ /* list of device capability bits */
+ #define HAS_INTEGRATED_BUTTON	1
+@@ -400,6 +411,19 @@ static const struct bcm5974_config bcm5974_config_table[] = {
+ 		{ SN_COORD, -150, 6730 },
+ 		{ SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
+ 	},
++	{
++		USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI,
++		USB_DEVICE_ID_APPLE_WELLSPRING8_ISO,
++		USB_DEVICE_ID_APPLE_WELLSPRING8_JIS,
++		HAS_INTEGRATED_BUTTON,
++		0, sizeof(struct bt_data),
++		0x83, TYPE3, FINGER_TYPE3, FINGER_TYPE3 + SIZEOF_ALL_FINGERS,
++		{ SN_PRESSURE, 0, 300 },
++		{ SN_WIDTH, 0, 2048 },
++		{ SN_COORD, -4620, 5140 },
++		{ SN_COORD, -150, 6600 },
++		{ SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
++	},
+ 	{}
+ };
+ 
+@@ -557,6 +581,9 @@ static int report_tp_state(struct bcm5974 *dev, int size)
+ 		input_report_key(input, BTN_LEFT, ibt);
+ 	}
+ 
++	if (c->tp_type == TYPE3)
++		input_report_key(input, BTN_LEFT, dev->tp_data[BUTTON_TYPE3]);
++
+ 	input_sync(input);
+ 
+ 	return 0;
+@@ -572,9 +599,14 @@ static int report_tp_state(struct bcm5974 *dev, int size)
+ 
+ static int bcm5974_wellspring_mode(struct bcm5974 *dev, bool on)
+ {
+-	char *data = kmalloc(8, GFP_KERNEL);
+ 	int retval = 0, size;
++	char *data;
++
++	/* Type 3 does not require a mode switch */
++	if (dev->cfg.tp_type == TYPE3)
++		return 0;
+ 
++	data = kmalloc(8, GFP_KERNEL);
+ 	if (!data) {
+ 		dev_err(&dev->intf->dev, "out of memory\n");
+ 		retval = -ENOMEM;
+diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
+index c5e3029..48acfc6 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
+@@ -576,10 +576,16 @@ static void iwl_pcie_txq_unmap(struct iwl_trans *trans, int txq_id)
+ 
+ 	spin_lock_bh(&txq->lock);
+ 	while (q->write_ptr != q->read_ptr) {
++		IWL_DEBUG_TX_REPLY(trans, "Q %d Free %d\n",
++				   txq_id, q->read_ptr);
+ 		iwl_pcie_txq_free_tfd(trans, txq);
+ 		q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd);
+ 	}
++	txq->active = false;
+ 	spin_unlock_bh(&txq->lock);
++
++	/* just in case - this queue may have been stopped */
++	iwl_wake_queue(trans, txq);
+ }
+ 
+ /*
+@@ -927,6 +933,12 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
+ 
+ 	spin_lock_bh(&txq->lock);
+ 
++	if (!txq->active) {
++		IWL_DEBUG_TX_QUEUES(trans, "Q %d inactive - ignoring idx %d\n",
++				    txq_id, ssn);
++		goto out;
++	}
++
+ 	if (txq->q.read_ptr == tfd_num)
+ 		goto out;
+ 
+@@ -1103,6 +1115,7 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, int fifo,
+ 		       (fifo << SCD_QUEUE_STTS_REG_POS_TXF) |
+ 		       (1 << SCD_QUEUE_STTS_REG_POS_WSL) |
+ 		       SCD_QUEUE_STTS_REG_MSK);
++	trans_pcie->txq[txq_id].active = true;
+ 	IWL_DEBUG_TX_QUEUES(trans, "Activate queue %d on FIFO %d WrPtr: %d\n",
+ 			    txq_id, fifo, ssn & 0xff);
+ }
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+index 953f1a0..2119313 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+@@ -104,7 +104,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+ 			tx_agc[RF90_PATH_A] = 0x10101010;
+ 			tx_agc[RF90_PATH_B] = 0x10101010;
+ 		} else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
+-			   TXHIGHPWRLEVEL_LEVEL1) {
++			   TXHIGHPWRLEVEL_LEVEL2) {
+ 			tx_agc[RF90_PATH_A] = 0x00000000;
+ 			tx_agc[RF90_PATH_B] = 0x00000000;
+ 		} else{
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index 826f085..2bd5985 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -359,6 +359,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ 	{RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
+ 	{RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/
+ 	{RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/
++	{RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/
+ 	{RTL_USB_DEVICE(0x7392, 0x7822, rtl92cu_hal_cfg)}, /*Edimax -Edimax*/
+ 	{}
+ };
+diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
+index e4c4cdc..d9ee2ef 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
+@@ -251,7 +251,7 @@ static struct rtl_hal_cfg rtl8723ae_hal_cfg = {
+ 	.bar_id = 2,
+ 	.write_readback = true,
+ 	.name = "rtl8723ae_pci",
+-	.fw_name = "rtlwifi/rtl8723aefw.bin",
++	.fw_name = "rtlwifi/rtl8723fw.bin",
+ 	.ops = &rtl8723ae_hal_ops,
+ 	.mod_params = &rtl8723ae_mod_params,
+ 	.maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
+@@ -353,8 +353,8 @@ MODULE_AUTHOR("Realtek WlanFAE	<wlanfae@×××××××.com>");
+ MODULE_AUTHOR("Larry Finger	<Larry.Finger@××××××××.net>");
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Realtek 8723E 802.11n PCI wireless");
+-MODULE_FIRMWARE("rtlwifi/rtl8723aefw.bin");
+-MODULE_FIRMWARE("rtlwifi/rtl8723aefw_B.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8723fw.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8723fw_B.bin");
+ 
+ module_param_named(swenc, rtl8723ae_mod_params.sw_crypto, bool, 0444);
+ module_param_named(debug, rtl8723ae_mod_params.debug, int, 0444);
+diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c
+index 1f05913..19f6f70 100644
+--- a/drivers/parisc/lba_pci.c
++++ b/drivers/parisc/lba_pci.c
+@@ -613,6 +613,54 @@ truncate_pat_collision(struct resource *root, struct resource *new)
+ 	return 0;	/* truncation successful */
+ }
+ 
++/*
++ * extend_lmmio_len: extend lmmio range to maximum length
++ *
++ * This is needed at least on C8000 systems to get the ATI FireGL card
++ * working. On other systems we will currently not extend the lmmio space.
++ */
++static unsigned long
++extend_lmmio_len(unsigned long start, unsigned long end, unsigned long lba_len)
++{
++	struct resource *tmp;
++
++	pr_debug("LMMIO mismatch: PAT length = 0x%lx, MASK register = 0x%lx\n",
++		end - start, lba_len);
++
++	lba_len = min(lba_len+1, 256UL*1024*1024); /* limit to 256 MB */
++
++	pr_debug("LBA: lmmio_space [0x%lx-0x%lx] - original\n", start, end);
++
++	if (boot_cpu_data.cpu_type < mako) {
++		pr_info("LBA: Not a C8000 system - not extending LMMIO range.\n");
++		return end;
++	}
++
++	end += lba_len;
++	if (end < start) /* fix overflow */
++		end = -1ULL;
++
++	pr_debug("LBA: lmmio_space [0x%lx-0x%lx] - current\n", start, end);
++
++	/* first overlap */
++	for (tmp = iomem_resource.child; tmp; tmp = tmp->sibling) {
++		pr_debug("LBA: testing %pR\n", tmp);
++		if (tmp->start == start)
++			continue; /* ignore ourself */
++		if (tmp->end < start)
++			continue;
++		if (tmp->start > end)
++			continue;
++		if (end >= tmp->start)
++			end = tmp->start - 1;
++	}
++
++	pr_info("LBA: lmmio_space [0x%lx-0x%lx] - new\n", start, end);
++
++	/* return new end */
++	return end;
++}
++
+ #else
+ #define truncate_pat_collision(r,n)  (0)
+ #endif
+@@ -994,6 +1042,14 @@ lba_pat_resources(struct parisc_device *pa_dev, struct lba_device *lba_dev)
+ 		case PAT_LMMIO:
+ 			/* used to fix up pre-initialized MEM BARs */
+ 			if (!lba_dev->hba.lmmio_space.flags) {
++				unsigned long lba_len;
++
++				lba_len = ~READ_REG32(lba_dev->hba.base_addr
++						+ LBA_LMMIO_MASK);
++				if ((p->end - p->start) != lba_len)
++					p->end = extend_lmmio_len(p->start,
++						p->end, lba_len);
++
+ 				sprintf(lba_dev->hba.lmmio_name,
+ 						"PCI%02x LMMIO",
+ 						(int)lba_dev->hba.bus_num.start);
+diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
+index c93071d..a971a6f 100644
+--- a/drivers/pci/iov.c
++++ b/drivers/pci/iov.c
+@@ -92,6 +92,8 @@ static int virtfn_add(struct pci_dev *dev, int id, int reset)
+ 	pci_read_config_word(dev, iov->pos + PCI_SRIOV_VF_DID, &virtfn->device);
+ 	pci_setup_device(virtfn);
+ 	virtfn->dev.parent = dev->dev.parent;
++	virtfn->physfn = pci_dev_get(dev);
++	virtfn->is_virtfn = 1;
+ 
+ 	for (i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
+ 		res = dev->resource + PCI_IOV_RESOURCES + i;
+@@ -113,9 +115,6 @@ static int virtfn_add(struct pci_dev *dev, int id, int reset)
+ 	pci_device_add(virtfn, virtfn->bus);
+ 	mutex_unlock(&iov->dev->sriov->lock);
+ 
+-	virtfn->physfn = pci_dev_get(dev);
+-	virtfn->is_virtfn = 1;
+-
+ 	rc = pci_bus_add_device(virtfn);
+ 	sprintf(buf, "virtfn%u", id);
+ 	rc = sysfs_create_link(&dev->dev.kobj, &virtfn->dev.kobj, buf);
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 70f10fa..ea37072 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -1703,12 +1703,16 @@ struct pci_bus *pci_create_root_bus(struct device *parent, int bus,
+ 	bridge->dev.release = pci_release_bus_bridge_dev;
+ 	dev_set_name(&bridge->dev, "pci%04x:%02x", pci_domain_nr(b), bus);
+ 	error = pcibios_root_bridge_prepare(bridge);
+-	if (error)
+-		goto bridge_dev_reg_err;
++	if (error) {
++		kfree(bridge);
++		goto err_out;
++	}
+ 
+ 	error = device_register(&bridge->dev);
+-	if (error)
+-		goto bridge_dev_reg_err;
++	if (error) {
++		put_device(&bridge->dev);
++		goto err_out;
++	}
+ 	b->bridge = get_device(&bridge->dev);
+ 	device_enable_async_suspend(b->bridge);
+ 	pci_set_bus_of_node(b);
+@@ -1764,8 +1768,6 @@ struct pci_bus *pci_create_root_bus(struct device *parent, int bus,
+ class_dev_reg_err:
+ 	put_device(&bridge->dev);
+ 	device_unregister(&bridge->dev);
+-bridge_dev_reg_err:
+-	kfree(bridge);
+ err_out:
+ 	kfree(b);
+ 	return NULL;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 7d68aee..df4655c 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1022,6 +1022,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP700_SATA, quirk
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP700_SATA, quirk_amd_ide_mode);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_HUDSON2_SATA_IDE, quirk_amd_ide_mode);
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_HUDSON2_SATA_IDE, quirk_amd_ide_mode);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x7900, quirk_amd_ide_mode);
++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_AMD, 0x7900, quirk_amd_ide_mode);
+ 
+ /*
+  *	Serverworks CSB5 IDE does not fully support native mode
+diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c
+index 966abc6..f7197a7 100644
+--- a/drivers/pci/xen-pcifront.c
++++ b/drivers/pci/xen-pcifront.c
+@@ -678,10 +678,9 @@ static int pcifront_connect_and_init_dma(struct pcifront_device *pdev)
+ 	if (!pcifront_dev) {
+ 		dev_info(&pdev->xdev->dev, "Installing PCI frontend\n");
+ 		pcifront_dev = pdev;
+-	} else {
+-		dev_err(&pdev->xdev->dev, "PCI frontend already installed!\n");
++	} else
+ 		err = -EEXIST;
+-	}
++
+ 	spin_unlock(&pcifront_dev_lock);
+ 
+ 	if (!err && !swiotlb_nr_tbl()) {
+@@ -848,7 +847,7 @@ static int pcifront_try_connect(struct pcifront_device *pdev)
+ 		goto out;
+ 
+ 	err = pcifront_connect_and_init_dma(pdev);
+-	if (err) {
++	if (err && err != -EEXIST) {
+ 		xenbus_dev_fatal(pdev->xdev, err,
+ 				 "Error setting up PCI Frontend");
+ 		goto out;
+diff --git a/drivers/pcmcia/at91_cf.c b/drivers/pcmcia/at91_cf.c
+index 01463c7..1b2c631 100644
+--- a/drivers/pcmcia/at91_cf.c
++++ b/drivers/pcmcia/at91_cf.c
+@@ -100,9 +100,9 @@ static int at91_cf_get_status(struct pcmcia_socket *s, u_int *sp)
+ 		int vcc	= gpio_is_valid(cf->board->vcc_pin);
+ 
+ 		*sp = SS_DETECT | SS_3VCARD;
+-		if (!rdy || gpio_get_value(rdy))
++		if (!rdy || gpio_get_value(cf->board->irq_pin))
+ 			*sp |= SS_READY;
+-		if (!vcc || gpio_get_value(vcc))
++		if (!vcc || gpio_get_value(cf->board->vcc_pin))
+ 			*sp |= SS_POWERON;
+ 	} else
+ 		*sp = 0;
+diff --git a/drivers/rtc/rtc-rv3029c2.c b/drivers/rtc/rtc-rv3029c2.c
+index 5032c24..9100a34 100644
+--- a/drivers/rtc/rtc-rv3029c2.c
++++ b/drivers/rtc/rtc-rv3029c2.c
+@@ -310,7 +310,7 @@ static int rv3029c2_rtc_i2c_set_alarm(struct i2c_client *client,
+ 		dev_dbg(&client->dev, "alarm IRQ armed\n");
+ 	} else {
+ 		/* disable AIE irq */
+-		ret = rv3029c2_rtc_i2c_alarm_set_irq(client, 1);
++		ret = rv3029c2_rtc_i2c_alarm_set_irq(client, 0);
+ 		if (ret)
+ 			return ret;
+ 
+diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
+index 21a7e17..572d481 100644
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -217,6 +217,7 @@ enum {
+ #define FRI2_64_UARTCLK  64000000 /*  64.0000 MHz */
+ #define FRI2_48_UARTCLK  48000000 /*  48.0000 MHz */
+ #define NTC1_UARTCLK     64000000 /*  64.0000 MHz */
++#define MINNOW_UARTCLK   50000000 /*  50.0000 MHz */
+ 
+ struct pch_uart_buffer {
+ 	unsigned char *buf;
+@@ -398,6 +399,10 @@ static int pch_uart_get_uartclk(void)
+ 		    strstr(cmp, "nanoETXexpress-TT")))
+ 		return NTC1_UARTCLK;
+ 
++	cmp = dmi_get_system_info(DMI_BOARD_NAME);
++	if (cmp && strstr(cmp, "MinnowBoard"))
++		return MINNOW_UARTCLK;
++
+ 	return DEFAULT_UARTCLK;
+ }
+ 
+diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
+index 97666e8..c35a9ec 100644
+--- a/drivers/usb/gadget/f_mass_storage.c
++++ b/drivers/usb/gadget/f_mass_storage.c
+@@ -413,6 +413,7 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
+ /* Caller must hold fsg->lock */
+ static void wakeup_thread(struct fsg_common *common)
+ {
++	smp_wmb();	/* ensure the write of bh->state is complete */
+ 	/* Tell the main thread that something has happened */
+ 	common->thread_wakeup_needed = 1;
+ 	if (common->thread_task)
+@@ -632,6 +633,7 @@ static int sleep_thread(struct fsg_common *common)
+ 	}
+ 	__set_current_state(TASK_RUNNING);
+ 	common->thread_wakeup_needed = 0;
++	smp_rmb();	/* ensure the latest bh->state is visible */
+ 	return rc;
+ }
+ 
+diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
+index 16d7150..dda408f 100644
+--- a/drivers/usb/host/ehci-omap.c
++++ b/drivers/usb/host/ehci-omap.c
+@@ -187,6 +187,12 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
+ 		}
+ 
+ 		omap->phy[i] = phy;
++
++		if (pdata->port_mode[i] == OMAP_EHCI_PORT_MODE_PHY) {
++			usb_phy_init(omap->phy[i]);
++			/* bring PHY out of suspend */
++			usb_phy_set_suspend(omap->phy[i], 0);
++		}
+ 	}
+ 
+ 	pm_runtime_enable(dev);
+@@ -211,13 +217,14 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	/*
+-	 * Bring PHYs out of reset.
++	 * Bring PHYs out of reset for non PHY modes.
+ 	 * Even though HSIC mode is a PHY-less mode, the reset
+ 	 * line exists between the chips and can be modelled
+ 	 * as a PHY device for reset control.
+ 	 */
+ 	for (i = 0; i < omap->nports; i++) {
+-		if (!omap->phy[i])
++		if (!omap->phy[i] ||
++		     pdata->port_mode[i] == OMAP_EHCI_PORT_MODE_PHY)
+ 			continue;
+ 
+ 		usb_phy_init(omap->phy[i]);
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index fbf75e5..f2e57a1 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -369,6 +369,10 @@ static struct xhci_container_ctx *xhci_alloc_container_ctx(struct xhci_hcd *xhci
+ 		ctx->size += CTX_SIZE(xhci->hcc_params);
+ 
+ 	ctx->bytes = dma_pool_alloc(xhci->device_pool, flags, &ctx->dma);
++	if (!ctx->bytes) {
++		kfree(ctx);
++		return NULL;
++	}
+ 	memset(ctx->bytes, 0, ctx->size);
+ 	return ctx;
+ }
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index df90fe5..93ad67e 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -179,6 +179,7 @@ static int xhci_plat_remove(struct platform_device *dev)
+ 
+ 	usb_remove_hcd(hcd);
+ 	iounmap(hcd->regs);
++	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+ 	usb_put_hcd(hcd);
+ 	kfree(xhci);
+ 
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index bd4323d..5dd857d 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -159,8 +159,6 @@ static void option_instat_callback(struct urb *urb);
+ #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED	0x9000
+ #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED	0x9001
+ #define NOVATELWIRELESS_PRODUCT_E362		0x9010
+-#define NOVATELWIRELESS_PRODUCT_G1		0xA001
+-#define NOVATELWIRELESS_PRODUCT_G1_M		0xA002
+ #define NOVATELWIRELESS_PRODUCT_G2		0xA010
+ #define NOVATELWIRELESS_PRODUCT_MC551		0xB001
+ 
+@@ -730,8 +728,6 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC547) },
+ 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED) },
+ 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED) },
+-	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1) },
+-	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1_M) },
+ 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G2) },
+ 	/* Novatel Ovation MC551 a.k.a. Verizon USB551L */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) },
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index bd794b4..c65437c 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -35,7 +35,13 @@ static const struct usb_device_id id_table[] = {
+ 	{DEVICE_G1K(0x04da, 0x250c)},	/* Panasonic Gobi QDL device */
+ 	{DEVICE_G1K(0x413c, 0x8172)},	/* Dell Gobi Modem device */
+ 	{DEVICE_G1K(0x413c, 0x8171)},	/* Dell Gobi QDL device */
+-	{DEVICE_G1K(0x1410, 0xa001)},	/* Novatel Gobi Modem device */
++	{DEVICE_G1K(0x1410, 0xa001)},	/* Novatel/Verizon USB-1000 */
++	{DEVICE_G1K(0x1410, 0xa002)},	/* Novatel Gobi Modem device */
++	{DEVICE_G1K(0x1410, 0xa003)},	/* Novatel Gobi Modem device */
++	{DEVICE_G1K(0x1410, 0xa004)},	/* Novatel Gobi Modem device */
++	{DEVICE_G1K(0x1410, 0xa005)},	/* Novatel Gobi Modem device */
++	{DEVICE_G1K(0x1410, 0xa006)},	/* Novatel Gobi Modem device */
++	{DEVICE_G1K(0x1410, 0xa007)},	/* Novatel Gobi Modem device */
+ 	{DEVICE_G1K(0x1410, 0xa008)},	/* Novatel Gobi QDL device */
+ 	{DEVICE_G1K(0x0b05, 0x1776)},	/* Asus Gobi Modem device */
+ 	{DEVICE_G1K(0x0b05, 0x1774)},	/* Asus Gobi QDL device */
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 02fae7f..7fb054b 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1089,7 +1089,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+ 		btrfs_set_node_ptr_generation(parent, parent_slot,
+ 					      trans->transid);
+ 		btrfs_mark_buffer_dirty(parent);
+-		tree_mod_log_free_eb(root->fs_info, buf);
++		if (last_ref)
++			tree_mod_log_free_eb(root->fs_info, buf);
+ 		btrfs_free_tree_block(trans, root, buf, parent_start,
+ 				      last_ref);
+ 	}
+@@ -1161,8 +1162,8 @@ __tree_mod_log_oldest_root(struct btrfs_fs_info *fs_info,
+  * time_seq).
+  */
+ static void
+-__tree_mod_log_rewind(struct extent_buffer *eb, u64 time_seq,
+-		      struct tree_mod_elem *first_tm)
++__tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct extent_buffer *eb,
++		      u64 time_seq, struct tree_mod_elem *first_tm)
+ {
+ 	u32 n;
+ 	struct rb_node *next;
+@@ -1172,6 +1173,7 @@ __tree_mod_log_rewind(struct extent_buffer *eb, u64 time_seq,
+ 	unsigned long p_size = sizeof(struct btrfs_key_ptr);
+ 
+ 	n = btrfs_header_nritems(eb);
++	tree_mod_log_read_lock(fs_info);
+ 	while (tm && tm->seq >= time_seq) {
+ 		/*
+ 		 * all the operations are recorded with the operator used for
+@@ -1226,6 +1228,7 @@ __tree_mod_log_rewind(struct extent_buffer *eb, u64 time_seq,
+ 		if (tm->index != first_tm->index)
+ 			break;
+ 	}
++	tree_mod_log_read_unlock(fs_info);
+ 	btrfs_set_header_nritems(eb, n);
+ }
+ 
+@@ -1274,7 +1277,7 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct extent_buffer *eb,
+ 
+ 	extent_buffer_get(eb_rewin);
+ 	btrfs_tree_read_lock(eb_rewin);
+-	__tree_mod_log_rewind(eb_rewin, time_seq, tm);
++	__tree_mod_log_rewind(fs_info, eb_rewin, time_seq, tm);
+ 	WARN_ON(btrfs_header_nritems(eb_rewin) >
+ 		BTRFS_NODEPTRS_PER_BLOCK(fs_info->tree_root));
+ 
+@@ -1350,7 +1353,7 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
+ 		btrfs_set_header_generation(eb, old_generation);
+ 	}
+ 	if (tm)
+-		__tree_mod_log_rewind(eb, time_seq, tm);
++		__tree_mod_log_rewind(root->fs_info, eb, time_seq, tm);
+ 	else
+ 		WARN_ON(btrfs_header_level(eb) != 0);
+ 	WARN_ON(btrfs_header_nritems(eb) > BTRFS_NODEPTRS_PER_BLOCK(root));
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index ff40f1c..ba9690b 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -4579,6 +4579,41 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
+ 	send_root = BTRFS_I(file_inode(mnt_file))->root;
+ 	fs_info = send_root->fs_info;
+ 
++	/*
++	 * This is done when we lookup the root, it should already be complete
++	 * by the time we get here.
++	 */
++	WARN_ON(send_root->orphan_cleanup_state != ORPHAN_CLEANUP_DONE);
++
++	/*
++	 * If we just created this root we need to make sure that the orphan
++	 * cleanup has been done and committed since we search the commit root,
++	 * so check its commit root transid with our otransid and if they match
++	 * commit the transaction to make sure everything is updated.
++	 */
++	down_read(&send_root->fs_info->extent_commit_sem);
++	if (btrfs_header_generation(send_root->commit_root) ==
++	    btrfs_root_otransid(&send_root->root_item)) {
++		struct btrfs_trans_handle *trans;
++
++		up_read(&send_root->fs_info->extent_commit_sem);
++
++		trans = btrfs_attach_transaction_barrier(send_root);
++		if (IS_ERR(trans)) {
++			if (PTR_ERR(trans) != -ENOENT) {
++				ret = PTR_ERR(trans);
++				goto out;
++			}
++			/* ENOENT means theres no transaction */
++		} else {
++			ret = btrfs_commit_transaction(trans, send_root);
++			if (ret)
++				goto out;
++		}
++	} else {
++		up_read(&send_root->fs_info->extent_commit_sem);
++	}
++
+ 	arg = memdup_user(arg_, sizeof(*arg));
+ 	if (IS_ERR(arg)) {
+ 		ret = PTR_ERR(arg);
+diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
+index 4fb0974..fe8d627 100644
+--- a/fs/cifs/cifs_unicode.h
++++ b/fs/cifs/cifs_unicode.h
+@@ -327,14 +327,14 @@ UniToupper(register wchar_t uc)
+ /*
+  * UniStrupr:  Upper case a unicode string
+  */
+-static inline wchar_t *
+-UniStrupr(register wchar_t *upin)
++static inline __le16 *
++UniStrupr(register __le16 *upin)
+ {
+-	register wchar_t *up;
++	register __le16 *up;
+ 
+ 	up = upin;
+ 	while (*up) {		/* For all characters */
+-		*up = UniToupper(*up);
++		*up = cpu_to_le16(UniToupper(le16_to_cpu(*up)));
+ 		up++;
+ 	}
+ 	return upin;		/* Return input pointer */
+diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
+index 71436d1..f59d0d5 100644
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -414,7 +414,7 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
+ 	int rc = 0;
+ 	int len;
+ 	char nt_hash[CIFS_NTHASH_SIZE];
+-	wchar_t *user;
++	__le16 *user;
+ 	wchar_t *domain;
+ 	wchar_t *server;
+ 
+@@ -439,7 +439,7 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
+ 		return rc;
+ 	}
+ 
+-	/* convert ses->user_name to unicode and uppercase */
++	/* convert ses->user_name to unicode */
+ 	len = ses->user_name ? strlen(ses->user_name) : 0;
+ 	user = kmalloc(2 + (len * 2), GFP_KERNEL);
+ 	if (user == NULL) {
+@@ -448,7 +448,7 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
+ 	}
+ 
+ 	if (len) {
+-		len = cifs_strtoUTF16((__le16 *)user, ses->user_name, len, nls_cp);
++		len = cifs_strtoUTF16(user, ses->user_name, len, nls_cp);
+ 		UniStrupr(user);
+ 	} else {
+ 		memset(user, '\0', 2);
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 48b29d2..c2934f8 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -553,11 +553,10 @@ cifs_relock_file(struct cifsFileInfo *cfile)
+ 	struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
+ 	int rc = 0;
+ 
+-	/* we are going to update can_cache_brlcks here - need a write access */
+-	down_write(&cinode->lock_sem);
++	down_read(&cinode->lock_sem);
+ 	if (cinode->can_cache_brlcks) {
+-		/* can cache locks - no need to push them */
+-		up_write(&cinode->lock_sem);
++		/* can cache locks - no need to relock */
++		up_read(&cinode->lock_sem);
+ 		return rc;
+ 	}
+ 
+@@ -568,7 +567,7 @@ cifs_relock_file(struct cifsFileInfo *cfile)
+ 	else
+ 		rc = tcon->ses->server->ops->push_mand_locks(cfile);
+ 
+-	up_write(&cinode->lock_sem);
++	up_read(&cinode->lock_sem);
+ 	return rc;
+ }
+ 
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 20efd81..449b6cf 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -558,6 +558,11 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
+ 			fattr->cf_mode &= ~(S_IWUGO);
+ 
+ 		fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
++		if (fattr->cf_nlink < 1) {
++			cifs_dbg(1, "replacing bogus file nlink value %u\n",
++				fattr->cf_nlink);
++			fattr->cf_nlink = 1;
++		}
+ 	}
+ 
+ 	fattr->cf_uid = cifs_sb->mnt_uid;
+diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
+index 692de13..cea8ecf 100644
+--- a/fs/ext3/namei.c
++++ b/fs/ext3/namei.c
+@@ -576,11 +576,8 @@ static int htree_dirblock_to_tree(struct file *dir_file,
+ 		if (!ext3_check_dir_entry("htree_dirblock_to_tree", dir, de, bh,
+ 					(block<<EXT3_BLOCK_SIZE_BITS(dir->i_sb))
+ 						+((char *)de - bh->b_data))) {
+-			/* On error, skip the f_pos to the next block. */
+-			dir_file->f_pos = (dir_file->f_pos |
+-					(dir->i_sb->s_blocksize - 1)) + 1;
+-			brelse (bh);
+-			return count;
++			/* silently ignore the rest of the block */
++			break;
+ 		}
+ 		ext3fs_dirhash(de->name, de->name_len, hinfo);
+ 		if ((hinfo->hash < start_hash) ||
+diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
+index d0f13ea..3742e4c 100644
+--- a/fs/ext4/balloc.c
++++ b/fs/ext4/balloc.c
+@@ -38,8 +38,8 @@ ext4_group_t ext4_get_group_number(struct super_block *sb,
+ 	ext4_group_t group;
+ 
+ 	if (test_opt2(sb, STD_GROUP_SIZE))
+-		group = (le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block) +
+-			 block) >>
++		group = (block -
++			 le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) >>
+ 			(EXT4_BLOCK_SIZE_BITS(sb) + EXT4_CLUSTER_BITS(sb) + 3);
+ 	else
+ 		ext4_get_group_no_and_offset(sb, block, &group, NULL);
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index bc0f191..e49da58 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4659,7 +4659,7 @@ static int ext4_xattr_fiemap(struct inode *inode,
+ 		error = ext4_get_inode_loc(inode, &iloc);
+ 		if (error)
+ 			return error;
+-		physical = iloc.bh->b_blocknr << blockbits;
++		physical = (__u64)iloc.bh->b_blocknr << blockbits;
+ 		offset = EXT4_GOOD_OLD_INODE_SIZE +
+ 				EXT4_I(inode)->i_extra_isize;
+ 		physical += offset;
+@@ -4667,7 +4667,7 @@ static int ext4_xattr_fiemap(struct inode *inode,
+ 		flags |= FIEMAP_EXTENT_DATA_INLINE;
+ 		brelse(iloc.bh);
+ 	} else { /* external block */
+-		physical = EXT4_I(inode)->i_file_acl << blockbits;
++		physical = (__u64)EXT4_I(inode)->i_file_acl << blockbits;
+ 		length = inode->i_sb->s_blocksize;
+ 	}