[gentoo-commits] linux-patches r2602 - genpatches-2.6/trunk/3.12

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2013-12-06 23:52:05 +0000 (Fri, 06 Dec 2013)
New Revision: 2602

Added:
   genpatches-2.6/trunk/3.12/1002_linux-3.12.3.patch
Modified:
   genpatches-2.6/trunk/3.12/0000_README
Log:
Linux patch 3.12.3

Modified: genpatches-2.6/trunk/3.12/0000_README
===================================================================
--- genpatches-2.6/trunk/3.12/0000_README	2013-12-06 23:49:49 UTC (rev 2601)
+++ genpatches-2.6/trunk/3.12/0000_README	2013-12-06 23:52:05 UTC (rev 2602)
@@ -50,6 +50,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.12.2
 
+Patch:  1002_linux-3.12.3.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.12.3
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.12/1002_linux-3.12.3.patch
===================================================================
--- genpatches-2.6/trunk/3.12/1002_linux-3.12.3.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.12/1002_linux-3.12.3.patch	2013-12-06 23:52:05 UTC (rev 2602)
@@ -0,0 +1,8639 @@
+diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
+index 9d4c1d18..fb78e60a 100644
+--- a/Documentation/sysctl/kernel.txt
++++ b/Documentation/sysctl/kernel.txt
+@@ -290,13 +290,24 @@ Default value is "/sbin/hotplug".
+ kptr_restrict:
+ 
+ This toggle indicates whether restrictions are placed on
+-exposing kernel addresses via /proc and other interfaces.  When
+-kptr_restrict is set to (0), there are no restrictions.  When
+-kptr_restrict is set to (1), the default, kernel pointers
+-printed using the %pK format specifier will be replaced with 0's
+-unless the user has CAP_SYSLOG.  When kptr_restrict is set to
+-(2), kernel pointers printed using %pK will be replaced with 0's
+-regardless of privileges.
++exposing kernel addresses via /proc and other interfaces.
++
++When kptr_restrict is set to (0), the default, there are no restrictions.
++
++When kptr_restrict is set to (1), kernel pointers printed using the %pK
++format specifier will be replaced with 0's unless the user has CAP_SYSLOG
++and effective user and group ids are equal to the real ids. This is
++because %pK checks are done at read() time rather than open() time, so
++if permissions are elevated between the open() and the read() (e.g via
++a setuid binary) then %pK will not leak kernel pointers to unprivileged
++users. Note, this is a temporary solution only. The correct long-term
++solution is to do the permission checks at open() time. Consider removing
++world read permissions from files that use %pK, and using dmesg_restrict
++to protect against uses of %pK in dmesg(8) if leaking kernel pointer
++values to unprivileged users is a concern.
++
++When kptr_restrict is set to (2), kernel pointers printed using
++%pK will be replaced with 0's regardless of privileges.
+ 
+ ==============================================================
+ 
+diff --git a/Makefile b/Makefile
+index e6e72b62..b28bc57d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 12
+-SUBLEVEL = 2
++SUBLEVEL = 3
+ EXTRAVERSION =
+ NAME = One Giant Leap for Frogkind
+ 
+diff --git a/arch/arm/boot/dts/bcm2835.dtsi b/arch/arm/boot/dts/bcm2835.dtsi
+index 1e12aeff..aa537ed1 100644
+--- a/arch/arm/boot/dts/bcm2835.dtsi
++++ b/arch/arm/boot/dts/bcm2835.dtsi
+@@ -85,6 +85,8 @@
+ 			reg = <0x7e205000 0x1000>;
+ 			interrupts = <2 21>;
+ 			clocks = <&clk_i2c>;
++			#address-cells = <1>;
++			#size-cells = <0>;
+ 			status = "disabled";
+ 		};
+ 
+@@ -93,6 +95,8 @@
+ 			reg = <0x7e804000 0x1000>;
+ 			interrupts = <2 21>;
+ 			clocks = <&clk_i2c>;
++			#address-cells = <1>;
++			#size-cells = <0>;
+ 			status = "disabled";
+ 		};
+ 
+diff --git a/arch/arm/boot/dts/cros5250-common.dtsi b/arch/arm/boot/dts/cros5250-common.dtsi
+index dc259e8b..9b186ac0 100644
+--- a/arch/arm/boot/dts/cros5250-common.dtsi
++++ b/arch/arm/boot/dts/cros5250-common.dtsi
+@@ -27,6 +27,13 @@
+ 		i2c2_bus: i2c2-bus {
+ 			samsung,pin-pud = <0>;
+ 		};
++
++		max77686_irq: max77686-irq {
++			samsung,pins = "gpx3-2";
++			samsung,pin-function = <0>;
++			samsung,pin-pud = <0>;
++			samsung,pin-drv = <0>;
++		};
+ 	};
+ 
+ 	i2c@12C60000 {
+@@ -35,6 +42,11 @@
+ 
+ 		max77686@09 {
+ 			compatible = "maxim,max77686";
++			interrupt-parent = <&gpx3>;
++			interrupts = <2 0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&max77686_irq>;
++			wakeup-source;
+ 			reg = <0x09>;
+ 
+ 			voltage-regulators {
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index 9cbe70c8..ec3e5cf4 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -192,6 +192,7 @@ __dabt_svc:
+ 	svc_entry
+ 	mov	r2, sp
+ 	dabt_helper
++ THUMB(	ldr	r5, [sp, #S_PSR]	)	@ potentially updated CPSR
+ 	svc_exit r5				@ return from exception
+  UNWIND(.fnend		)
+ ENDPROC(__dabt_svc)
+diff --git a/arch/arm/mach-at91/Makefile b/arch/arm/mach-at91/Makefile
+index 3b0a9538..e0fda04e 100644
+--- a/arch/arm/mach-at91/Makefile
++++ b/arch/arm/mach-at91/Makefile
+@@ -2,7 +2,7 @@
+ # Makefile for the linux kernel.
+ #
+ 
+-obj-y		:= irq.o gpio.o setup.o
++obj-y		:= irq.o gpio.o setup.o sysirq_mask.o
+ obj-m		:=
+ obj-n		:=
+ obj-		:=
+diff --git a/arch/arm/mach-at91/at91sam9260.c b/arch/arm/mach-at91/at91sam9260.c
+index 5de6074b..ae10d14d 100644
+--- a/arch/arm/mach-at91/at91sam9260.c
++++ b/arch/arm/mach-at91/at91sam9260.c
+@@ -349,6 +349,8 @@ static void __init at91sam9260_initialize(void)
+ 	arm_pm_idle = at91sam9_idle;
+ 	arm_pm_restart = at91sam9_alt_restart;
+ 
++	at91_sysirq_mask_rtt(AT91SAM9260_BASE_RTT);
++
+ 	/* Register GPIO subsystem */
+ 	at91_gpio_init(at91sam9260_gpio, 3);
+ }
+diff --git a/arch/arm/mach-at91/at91sam9261.c b/arch/arm/mach-at91/at91sam9261.c
+index 0e079324..e761e74a 100644
+--- a/arch/arm/mach-at91/at91sam9261.c
++++ b/arch/arm/mach-at91/at91sam9261.c
+@@ -291,6 +291,8 @@ static void __init at91sam9261_initialize(void)
+ 	arm_pm_idle = at91sam9_idle;
+ 	arm_pm_restart = at91sam9_alt_restart;
+ 
++	at91_sysirq_mask_rtt(AT91SAM9261_BASE_RTT);
++
+ 	/* Register GPIO subsystem */
+ 	at91_gpio_init(at91sam9261_gpio, 3);
+ }
+diff --git a/arch/arm/mach-at91/at91sam9263.c b/arch/arm/mach-at91/at91sam9263.c
+index 6ce7d185..e6fed625 100644
+--- a/arch/arm/mach-at91/at91sam9263.c
++++ b/arch/arm/mach-at91/at91sam9263.c
+@@ -328,6 +328,9 @@ static void __init at91sam9263_initialize(void)
+ 	arm_pm_idle = at91sam9_idle;
+ 	arm_pm_restart = at91sam9_alt_restart;
+ 
++	at91_sysirq_mask_rtt(AT91SAM9263_BASE_RTT0);
++	at91_sysirq_mask_rtt(AT91SAM9263_BASE_RTT1);
++
+ 	/* Register GPIO subsystem */
+ 	at91_gpio_init(at91sam9263_gpio, 5);
+ }
+diff --git a/arch/arm/mach-at91/at91sam9g45.c b/arch/arm/mach-at91/at91sam9g45.c
+index 474ee04d..9f7a97c8 100644
+--- a/arch/arm/mach-at91/at91sam9g45.c
++++ b/arch/arm/mach-at91/at91sam9g45.c
+@@ -377,6 +377,9 @@ static void __init at91sam9g45_initialize(void)
+ 	arm_pm_idle = at91sam9_idle;
+ 	arm_pm_restart = at91sam9g45_restart;
+ 
++	at91_sysirq_mask_rtc(AT91SAM9G45_BASE_RTC);
++	at91_sysirq_mask_rtt(AT91SAM9G45_BASE_RTT);
++
+ 	/* Register GPIO subsystem */
+ 	at91_gpio_init(at91sam9g45_gpio, 5);
+ }
+diff --git a/arch/arm/mach-at91/at91sam9n12.c b/arch/arm/mach-at91/at91sam9n12.c
+index c7d670d1..4d6001c3 100644
+--- a/arch/arm/mach-at91/at91sam9n12.c
++++ b/arch/arm/mach-at91/at91sam9n12.c
+@@ -223,7 +223,13 @@ static void __init at91sam9n12_map_io(void)
+ 	at91_init_sram(0, AT91SAM9N12_SRAM_BASE, AT91SAM9N12_SRAM_SIZE);
+ }
+ 
++static void __init at91sam9n12_initialize(void)
++{
++	at91_sysirq_mask_rtc(AT91SAM9N12_BASE_RTC);
++}
++
+ AT91_SOC_START(at91sam9n12)
+ 	.map_io = at91sam9n12_map_io,
+ 	.register_clocks = at91sam9n12_register_clocks,
++	.init = at91sam9n12_initialize,
+ AT91_SOC_END
+diff --git a/arch/arm/mach-at91/at91sam9rl.c b/arch/arm/mach-at91/at91sam9rl.c
+index d4ec0d9a..301e1728 100644
+--- a/arch/arm/mach-at91/at91sam9rl.c
++++ b/arch/arm/mach-at91/at91sam9rl.c
+@@ -294,6 +294,9 @@ static void __init at91sam9rl_initialize(void)
+ 	arm_pm_idle = at91sam9_idle;
+ 	arm_pm_restart = at91sam9_alt_restart;
+ 
++	at91_sysirq_mask_rtc(AT91SAM9RL_BASE_RTC);
++	at91_sysirq_mask_rtt(AT91SAM9RL_BASE_RTT);
++
+ 	/* Register GPIO subsystem */
+ 	at91_gpio_init(at91sam9rl_gpio, 4);
+ }
+diff --git a/arch/arm/mach-at91/at91sam9x5.c b/arch/arm/mach-at91/at91sam9x5.c
+index 916e5a14..e8a2e075 100644
+--- a/arch/arm/mach-at91/at91sam9x5.c
++++ b/arch/arm/mach-at91/at91sam9x5.c
+@@ -322,6 +322,11 @@ static void __init at91sam9x5_map_io(void)
+ 	at91_init_sram(0, AT91SAM9X5_SRAM_BASE, AT91SAM9X5_SRAM_SIZE);
+ }
+ 
++static void __init at91sam9x5_initialize(void)
++{
++	at91_sysirq_mask_rtc(AT91SAM9X5_BASE_RTC);
++}
++
+ /* --------------------------------------------------------------------
+  *  Interrupt initialization
+  * -------------------------------------------------------------------- */
+@@ -329,4 +334,5 @@ static void __init at91sam9x5_map_io(void)
+ AT91_SOC_START(at91sam9x5)
+ 	.map_io = at91sam9x5_map_io,
+ 	.register_clocks = at91sam9x5_register_clocks,
++	.init = at91sam9x5_initialize,
+ AT91_SOC_END
+diff --git a/arch/arm/mach-at91/generic.h b/arch/arm/mach-at91/generic.h
+index dc6e2f5f..26dee3ce 100644
+--- a/arch/arm/mach-at91/generic.h
++++ b/arch/arm/mach-at91/generic.h
+@@ -34,6 +34,8 @@ extern int  __init at91_aic_of_init(struct device_node *node,
+ 				    struct device_node *parent);
+ extern int  __init at91_aic5_of_init(struct device_node *node,
+ 				    struct device_node *parent);
++extern void __init at91_sysirq_mask_rtc(u32 rtc_base);
++extern void __init at91_sysirq_mask_rtt(u32 rtt_base);
+ 
+ 
+  /* Timer */
+diff --git a/arch/arm/mach-at91/include/mach/at91sam9n12.h b/arch/arm/mach-at91/include/mach/at91sam9n12.h
+index d374b87c..0151bcf6 100644
+--- a/arch/arm/mach-at91/include/mach/at91sam9n12.h
++++ b/arch/arm/mach-at91/include/mach/at91sam9n12.h
+@@ -49,6 +49,11 @@
+ #define AT91SAM9N12_BASE_USART3	0xf8028000
+ 
+ /*
++ * System Peripherals
++ */
++#define AT91SAM9N12_BASE_RTC	0xfffffeb0
++
++/*
+  * Internal Memory.
+  */
+ #define AT91SAM9N12_SRAM_BASE	0x00300000	/* Internal SRAM base address */
+diff --git a/arch/arm/mach-at91/include/mach/at91sam9x5.h b/arch/arm/mach-at91/include/mach/at91sam9x5.h
+index c75ee19b..2fc76c49 100644
+--- a/arch/arm/mach-at91/include/mach/at91sam9x5.h
++++ b/arch/arm/mach-at91/include/mach/at91sam9x5.h
+@@ -55,6 +55,11 @@
+ #define AT91SAM9X5_BASE_USART2	0xf8024000
+ 
+ /*
++ * System Peripherals
++ */
++#define AT91SAM9X5_BASE_RTC	0xfffffeb0
++
++/*
+  * Internal Memory.
+  */
+ #define AT91SAM9X5_SRAM_BASE	0x00300000	/* Internal SRAM base address */
+diff --git a/arch/arm/mach-at91/include/mach/sama5d3.h b/arch/arm/mach-at91/include/mach/sama5d3.h
+index 31096a8a..25613d8c 100644
+--- a/arch/arm/mach-at91/include/mach/sama5d3.h
++++ b/arch/arm/mach-at91/include/mach/sama5d3.h
+@@ -73,6 +73,11 @@
+ #define SAMA5D3_BASE_USART3	0xf8024000
+ 
+ /*
++ * System Peripherals
++ */
++#define SAMA5D3_BASE_RTC	0xfffffeb0
++
++/*
+  * Internal Memory
+  */
+ #define SAMA5D3_SRAM_BASE	0x00300000	/* Internal SRAM base address */
+diff --git a/arch/arm/mach-at91/sama5d3.c b/arch/arm/mach-at91/sama5d3.c
+index 40127971..3ea86428 100644
+--- a/arch/arm/mach-at91/sama5d3.c
++++ b/arch/arm/mach-at91/sama5d3.c
+@@ -371,7 +371,13 @@ static void __init sama5d3_map_io(void)
+ 	at91_init_sram(0, SAMA5D3_SRAM_BASE, SAMA5D3_SRAM_SIZE);
+ }
+ 
++static void __init sama5d3_initialize(void)
++{
++	at91_sysirq_mask_rtc(SAMA5D3_BASE_RTC);
++}
++
+ AT91_SOC_START(sama5d3)
+ 	.map_io = sama5d3_map_io,
+ 	.register_clocks = sama5d3_register_clocks,
++	.init = sama5d3_initialize,
+ AT91_SOC_END
+diff --git a/arch/arm/mach-at91/sysirq_mask.c b/arch/arm/mach-at91/sysirq_mask.c
+new file mode 100644
+index 00000000..2ba694f9
+--- /dev/null
++++ b/arch/arm/mach-at91/sysirq_mask.c
+@@ -0,0 +1,71 @@
++/*
++ * sysirq_mask.c - System-interrupt masking
++ *
++ * Copyright (C) 2013 Johan Hovold <jhovold@×××××.com>
++ *
++ * Functions to disable system interrupts from backup-powered peripherals.
++ *
++ * The RTC and RTT-peripherals are generally powered by backup power (VDDBU)
++ * and are not reset on wake-up, user, watchdog or software reset. This means
++ * that their interrupts may be enabled during early boot (e.g. after a user
++ * reset).
++ *
++ * As the RTC and RTT share the system-interrupt line with the PIT, an
++ * interrupt occurring before a handler has been installed would lead to the
++ * system interrupt being disabled and prevent the system from booting.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ */
++
++#include <linux/io.h>
++#include <mach/at91_rtt.h>
++
++#include "generic.h"
++
++#define AT91_RTC_IDR	0x24	/* Interrupt Disable Register */
++#define AT91_RTC_IMR	0x28	/* Interrupt Mask Register */
++
++void __init at91_sysirq_mask_rtc(u32 rtc_base)
++{
++	void __iomem *base;
++	u32 mask;
++
++	base = ioremap(rtc_base, 64);
++	if (!base)
++		return;
++
++	mask = readl_relaxed(base + AT91_RTC_IMR);
++	if (mask) {
++		pr_info("AT91: Disabling rtc irq\n");
++		writel_relaxed(mask, base + AT91_RTC_IDR);
++		(void)readl_relaxed(base + AT91_RTC_IMR);	/* flush */
++	}
++
++	iounmap(base);
++}
++
++void __init at91_sysirq_mask_rtt(u32 rtt_base)
++{
++	void __iomem *base;
++	void __iomem *reg;
++	u32 mode;
++
++	base = ioremap(rtt_base, 16);
++	if (!base)
++		return;
++
++	reg = base + AT91_RTT_MR;
++
++	mode = readl_relaxed(reg);
++	if (mode & (AT91_RTT_ALMIEN | AT91_RTT_RTTINCIEN)) {
++		pr_info("AT91: Disabling rtt irq\n");
++		mode &= ~(AT91_RTT_ALMIEN | AT91_RTT_RTTINCIEN);
++		writel_relaxed(mode, reg);
++		(void)readl_relaxed(reg);			/* flush */
++	}
++
++	iounmap(base);
++}
+diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
+index 9181a241..ef85ac49 100644
+--- a/arch/arm/mach-imx/clk-imx6q.c
++++ b/arch/arm/mach-imx/clk-imx6q.c
+@@ -428,7 +428,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ 	clk[asrc_podf]        = imx_clk_divider("asrc_podf",        "asrc_pred",         base + 0x30, 9,  3);
+ 	clk[spdif_pred]       = imx_clk_divider("spdif_pred",       "spdif_sel",         base + 0x30, 25, 3);
+ 	clk[spdif_podf]       = imx_clk_divider("spdif_podf",       "spdif_pred",        base + 0x30, 22, 3);
+-	clk[can_root]         = imx_clk_divider("can_root",         "pll3_usb_otg",      base + 0x20, 2,  6);
++	clk[can_root]         = imx_clk_divider("can_root",         "pll3_60m",          base + 0x20, 2,  6);
+ 	clk[ecspi_root]       = imx_clk_divider("ecspi_root",       "pll3_60m",          base + 0x38, 19, 6);
+ 	clk[gpu2d_core_podf]  = imx_clk_divider("gpu2d_core_podf",  "gpu2d_core_sel",    base + 0x18, 23, 3);
+ 	clk[gpu3d_core_podf]  = imx_clk_divider("gpu3d_core_podf",  "gpu3d_core_sel",    base + 0x18, 26, 3);
+diff --git a/arch/arm/mach-integrator/integrator_cp.c b/arch/arm/mach-integrator/integrator_cp.c
+index 8c60fcb0..2f4c9248 100644
+--- a/arch/arm/mach-integrator/integrator_cp.c
++++ b/arch/arm/mach-integrator/integrator_cp.c
+@@ -199,7 +199,8 @@ static struct mmci_platform_data mmc_data = {
+ static void cp_clcd_enable(struct clcd_fb *fb)
+ {
+ 	struct fb_var_screeninfo *var = &fb->fb.var;
+-	u32 val = CM_CTRL_STATIC1 | CM_CTRL_STATIC2;
++	u32 val = CM_CTRL_STATIC1 | CM_CTRL_STATIC2
++			| CM_CTRL_LCDEN0 | CM_CTRL_LCDEN1;
+ 
+ 	if (var->bits_per_pixel <= 8 ||
+ 	    (var->bits_per_pixel == 16 && var->green.length == 5))
+diff --git a/arch/arm/mach-omap2/irq.c b/arch/arm/mach-omap2/irq.c
+index 3926f370..e022a869 100644
+--- a/arch/arm/mach-omap2/irq.c
++++ b/arch/arm/mach-omap2/irq.c
+@@ -233,7 +233,7 @@ static inline void omap_intc_handle_irq(void __iomem *base_addr, struct pt_regs
+ 			goto out;
+ 
+ 		irqnr = readl_relaxed(base_addr + 0xd8);
+-#ifdef CONFIG_SOC_TI81XX
++#if IS_ENABLED(CONFIG_SOC_TI81XX) || IS_ENABLED(CONFIG_SOC_AM33XX)
+ 		if (irqnr)
+ 			goto out;
+ 		irqnr = readl_relaxed(base_addr + 0xf8);
+diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
+index b69dd9ab..53f07358 100644
+--- a/arch/arm/mach-omap2/omap_device.c
++++ b/arch/arm/mach-omap2/omap_device.c
+@@ -621,6 +621,7 @@ static int _od_suspend_noirq(struct device *dev)
+ 
+ 	if (!ret && !pm_runtime_status_suspended(dev)) {
+ 		if (pm_generic_runtime_suspend(dev) == 0) {
++			pm_runtime_set_suspended(dev);
+ 			omap_device_idle(pdev);
+ 			od->flags |= OMAP_DEVICE_SUSPENDED;
+ 		}
+@@ -634,10 +635,18 @@ static int _od_resume_noirq(struct device *dev)
+ 	struct platform_device *pdev = to_platform_device(dev);
+ 	struct omap_device *od = to_omap_device(pdev);
+ 
+-	if ((od->flags & OMAP_DEVICE_SUSPENDED) &&
+-	    !pm_runtime_status_suspended(dev)) {
++	if (od->flags & OMAP_DEVICE_SUSPENDED) {
+ 		od->flags &= ~OMAP_DEVICE_SUSPENDED;
+ 		omap_device_enable(pdev);
++		/*
++		 * XXX: we run before core runtime pm has resumed itself. At
++		 * this point in time, we just restore the runtime pm state and
++		 * considering symmetric operations in resume, we donot expect
++		 * to fail. If we failed, something changed in core runtime_pm
++		 * framework OR some device driver messed things up, hence, WARN
++		 */
++		WARN(pm_runtime_set_active(dev),
++		     "Could not set %s runtime state active\n", dev_name(dev));
+ 		pm_generic_runtime_resume(dev);
+ 	}
+ 
+diff --git a/arch/arm/mach-sa1100/assabet.c b/arch/arm/mach-sa1100/assabet.c
+index e838ba27..c9808c68 100644
+--- a/arch/arm/mach-sa1100/assabet.c
++++ b/arch/arm/mach-sa1100/assabet.c
+@@ -512,6 +512,9 @@ static void __init assabet_map_io(void)
+ 	 * Its called GPCLKR0 in my SA1110 manual.
+ 	 */
+ 	Ser1SDCR0 |= SDCR0_SUS;
++	MSC1 = (MSC1 & ~0xffff) |
++		MSC_NonBrst | MSC_32BitStMem |
++		MSC_RdAcc(2) | MSC_WrAcc(2) | MSC_Rec(0);
+ 
+ 	if (!machine_has_neponset())
+ 		sa1100_register_uart_fns(&assabet_port_fns);
+diff --git a/arch/arm/mm/extable.c b/arch/arm/mm/extable.c
+index 9d285626..312e15e6 100644
+--- a/arch/arm/mm/extable.c
++++ b/arch/arm/mm/extable.c
+@@ -9,8 +9,13 @@ int fixup_exception(struct pt_regs *regs)
+ 	const struct exception_table_entry *fixup;
+ 
+ 	fixup = search_exception_tables(instruction_pointer(regs));
+-	if (fixup)
++	if (fixup) {
+ 		regs->ARM_pc = fixup->fixup;
++#ifdef CONFIG_THUMB2_KERNEL
++		/* Clear the IT state to avoid nasty surprises in the fixup */
++		regs->ARM_cpsr &= ~PSR_IT_MASK;
++#endif
++	}
+ 
+ 	return fixup != NULL;
+ }
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index f0bebc5e..0b27b657 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -25,10 +25,11 @@
+  * Software defined PTE bits definition.
+  */
+ #define PTE_VALID		(_AT(pteval_t, 1) << 0)
+-#define PTE_PROT_NONE		(_AT(pteval_t, 1) << 2)	/* only when !PTE_VALID */
+-#define PTE_FILE		(_AT(pteval_t, 1) << 3)	/* only when !pte_present() */
++#define PTE_FILE		(_AT(pteval_t, 1) << 2)	/* only when !pte_present() */
+ #define PTE_DIRTY		(_AT(pteval_t, 1) << 55)
+ #define PTE_SPECIAL		(_AT(pteval_t, 1) << 56)
++				/* bit 57 for PMD_SECT_SPLITTING */
++#define PTE_PROT_NONE		(_AT(pteval_t, 1) << 58) /* only when !PTE_VALID */
+ 
+ /*
+  * VMALLOC and SPARSEMEM_VMEMMAP ranges.
+@@ -357,18 +358,20 @@ extern pgd_t idmap_pg_dir[PTRS_PER_PGD];
+ 
+ /*
+  * Encode and decode a swap entry:
+- *	bits 0, 2:	present (must both be zero)
+- *	bit  3:		PTE_FILE
+- *	bits 4-8:	swap type
+- *	bits 9-63:	swap offset
++ *	bits 0-1:	present (must be zero)
++ *	bit  2:		PTE_FILE
++ *	bits 3-8:	swap type
++ *	bits 9-57:	swap offset
+  */
+-#define __SWP_TYPE_SHIFT	4
++#define __SWP_TYPE_SHIFT	3
+ #define __SWP_TYPE_BITS		6
++#define __SWP_OFFSET_BITS	49
+ #define __SWP_TYPE_MASK		((1 << __SWP_TYPE_BITS) - 1)
+ #define __SWP_OFFSET_SHIFT	(__SWP_TYPE_BITS + __SWP_TYPE_SHIFT)
++#define __SWP_OFFSET_MASK	((1UL << __SWP_OFFSET_BITS) - 1)
+ 
+ #define __swp_type(x)		(((x).val >> __SWP_TYPE_SHIFT) & __SWP_TYPE_MASK)
+-#define __swp_offset(x)		((x).val >> __SWP_OFFSET_SHIFT)
++#define __swp_offset(x)		(((x).val >> __SWP_OFFSET_SHIFT) & __SWP_OFFSET_MASK)
+ #define __swp_entry(type,offset) ((swp_entry_t) { ((type) << __SWP_TYPE_SHIFT) | ((offset) << __SWP_OFFSET_SHIFT) })
+ 
+ #define __pte_to_swp_entry(pte)	((swp_entry_t) { pte_val(pte) })
+@@ -382,15 +385,15 @@ extern pgd_t idmap_pg_dir[PTRS_PER_PGD];
+ 
+ /*
+  * Encode and decode a file entry:
+- *	bits 0, 2:	present (must both be zero)
+- *	bit  3:		PTE_FILE
+- *	bits 4-63:	file offset / PAGE_SIZE
++ *	bits 0-1:	present (must be zero)
++ *	bit  2:		PTE_FILE
++ *	bits 3-57:	file offset / PAGE_SIZE
+  */
+ #define pte_file(pte)		(pte_val(pte) & PTE_FILE)
+-#define pte_to_pgoff(x)		(pte_val(x) >> 4)
+-#define pgoff_to_pte(x)		__pte(((x) << 4) | PTE_FILE)
++#define pte_to_pgoff(x)		(pte_val(x) >> 3)
++#define pgoff_to_pte(x)		__pte(((x) << 3) | PTE_FILE)
+ 
+-#define PTE_FILE_MAX_BITS	60
++#define PTE_FILE_MAX_BITS	55
+ 
+ extern int kern_addr_valid(unsigned long addr);
+ 
+diff --git a/arch/avr32/boot/u-boot/head.S b/arch/avr32/boot/u-boot/head.S
+index 4488fa27..2ffc298f 100644
+--- a/arch/avr32/boot/u-boot/head.S
++++ b/arch/avr32/boot/u-boot/head.S
+@@ -8,6 +8,8 @@
+  * published by the Free Software Foundation.
+  */
+ #include <asm/setup.h>
++#include <asm/thread_info.h>
++#include <asm/sysreg.h>
+ 
+ 	/*
+ 	 * The kernel is loaded where we want it to be and all caches
+@@ -20,11 +22,6 @@
+ 	.section .init.text,"ax"
+ 	.global _start
+ _start:
+-	/* Check if the boot loader actually provided a tag table */
+-	lddpc	r0, magic_number
+-	cp.w	r12, r0
+-	brne	no_tag_table
+-
+ 	/* Initialize .bss */
+ 	lddpc	r2, bss_start_addr
+ 	lddpc   r3, end_addr
+@@ -34,6 +31,25 @@ _start:
+ 	cp      r2, r3
+ 	brlo    1b
+ 
++	/* Initialize status register */
++	lddpc	r0, init_sr
++	mtsr	SYSREG_SR, r0
++
++	/* Set initial stack pointer */
++	lddpc	sp, stack_addr
++	sub	sp, -THREAD_SIZE
++
++#ifdef CONFIG_FRAME_POINTER
++	/* Mark last stack frame */
++	mov	lr, 0
++	mov	r7, 0
++#endif
++
++	/* Check if the boot loader actually provided a tag table */
++	lddpc	r0, magic_number
++	cp.w	r12, r0
++	brne	no_tag_table
++
+ 	/*
+ 	 * Save the tag table address for later use. This must be done
+ 	 * _after_ .bss has been initialized...
+@@ -53,8 +69,15 @@ bss_start_addr:
+ 	.long   __bss_start
+ end_addr:
+ 	.long   _end
++init_sr:
++	.long	0x007f0000	/* Supervisor mode, everything masked */
++stack_addr:
++	.long	init_thread_union
++panic_addr:
++	.long	panic
+ 
+ no_tag_table:
+ 	sub	r12, pc, (. - 2f)
+-	bral	panic
++	/* branch to panic() which can be far away with that construct */
++	lddpc	pc, panic_addr
+ 2:	.asciz	"Boot loader didn't provide correct magic number\n"
+diff --git a/arch/avr32/kernel/entry-avr32b.S b/arch/avr32/kernel/entry-avr32b.S
+index 9899d3cc..7301f480 100644
+--- a/arch/avr32/kernel/entry-avr32b.S
++++ b/arch/avr32/kernel/entry-avr32b.S
+@@ -401,9 +401,10 @@ handle_critical:
+ 	/* We should never get here... */
+ bad_return:
+ 	sub	r12, pc, (. - 1f)
+-	bral	panic
++	lddpc	pc, 2f
+ 	.align	2
+ 1:	.asciz	"Return from critical exception!"
++2:	.long	panic
+ 
+ 	.align	1
+ do_bus_error_write:
+diff --git a/arch/avr32/kernel/head.S b/arch/avr32/kernel/head.S
+index 6163bd0a..59eae6df 100644
+--- a/arch/avr32/kernel/head.S
++++ b/arch/avr32/kernel/head.S
+@@ -10,33 +10,13 @@
+ #include <linux/linkage.h>
+ 
+ #include <asm/page.h>
+-#include <asm/thread_info.h>
+-#include <asm/sysreg.h>
+ 
+ 	.section .init.text,"ax"
+ 	.global kernel_entry
+ kernel_entry:
+-	/* Initialize status register */
+-	lddpc   r0, init_sr
+-	mtsr	SYSREG_SR, r0
+-
+-	/* Set initial stack pointer */
+-	lddpc   sp, stack_addr
+-	sub	sp, -THREAD_SIZE
+-
+-#ifdef CONFIG_FRAME_POINTER
+-	/* Mark last stack frame */
+-	mov	lr, 0
+-	mov	r7, 0
+-#endif
+-
+ 	/* Start the show */
+ 	lddpc   pc, kernel_start_addr
+ 
+ 	.align  2
+-init_sr:
+-	.long   0x007f0000	/* Supervisor mode, everything masked */
+-stack_addr:
+-	.long   init_thread_union
+ kernel_start_addr:
+ 	.long   start_kernel
+diff --git a/arch/parisc/include/asm/socket.h b/arch/parisc/include/asm/socket.h
+new file mode 100644
+index 00000000..748016cb
+--- /dev/null
++++ b/arch/parisc/include/asm/socket.h
+@@ -0,0 +1,11 @@
++#ifndef _ASM_SOCKET_H
++#define _ASM_SOCKET_H
++
++#include <uapi/asm/socket.h>
++
++/* O_NONBLOCK clashes with the bits used for socket types.  Therefore we
++ * have to define SOCK_NONBLOCK to a different value here.
++ */
++#define SOCK_NONBLOCK	0x40000000
++
++#endif /* _ASM_SOCKET_H */
+diff --git a/arch/parisc/include/uapi/asm/socket.h b/arch/parisc/include/uapi/asm/socket.h
+index 71700e63..9f2174f4 100644
+--- a/arch/parisc/include/uapi/asm/socket.h
++++ b/arch/parisc/include/uapi/asm/socket.h
+@@ -1,5 +1,5 @@
+-#ifndef _ASM_SOCKET_H
+-#define _ASM_SOCKET_H
++#ifndef _UAPI_ASM_SOCKET_H
++#define _UAPI_ASM_SOCKET_H
+ 
+ #include <asm/sockios.h>
+ 
+@@ -75,9 +75,4 @@
+ 
+ #define SO_BUSY_POLL		0x4027
+ 
+-/* O_NONBLOCK clashes with the bits used for socket types.  Therefore we
+- * have to define SOCK_NONBLOCK to a different value here.
+- */
+-#define SOCK_NONBLOCK   0x40000000
+-
+-#endif /* _ASM_SOCKET_H */
++#endif /* _UAPI_ASM_SOCKET_H */
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
+index 36d49e6b..fea2dba1 100644
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -445,6 +445,12 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
+ #endif /* CONFIG_ALTIVEC */
+ 	if (copy_fpr_to_user(&frame->mc_fregs, current))
+ 		return 1;
++
++	/*
++	 * Clear the MSR VSX bit to indicate there is no valid state attached
++	 * to this context, except in the specific case below where we set it.
++	 */
++	msr &= ~MSR_VSX;
+ #ifdef CONFIG_VSX
+ 	/*
+ 	 * Copy VSR 0-31 upper half from thread_struct to local
+@@ -457,15 +463,7 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
+ 		if (copy_vsx_to_user(&frame->mc_vsregs, current))
+ 			return 1;
+ 		msr |= MSR_VSX;
+-	} else if (!ctx_has_vsx_region)
+-		/*
+-		 * With a small context structure we can't hold the VSX
+-		 * registers, hence clear the MSR value to indicate the state
+-		 * was not saved.
+-		 */
+-		msr &= ~MSR_VSX;
+-
+-
++	}
+ #endif /* CONFIG_VSX */
+ #ifdef CONFIG_SPE
+ 	/* save spe registers */
+diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
+index f93ec283..1e7ba881 100644
+--- a/arch/powerpc/kernel/signal_64.c
++++ b/arch/powerpc/kernel/signal_64.c
+@@ -121,6 +121,12 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
+ 	flush_fp_to_thread(current);
+ 	/* copy fpr regs and fpscr */
+ 	err |= copy_fpr_to_user(&sc->fp_regs, current);
++
++	/*
++	 * Clear the MSR VSX bit to indicate there is no valid state attached
++	 * to this context, except in the specific case below where we set it.
++	 */
++	msr &= ~MSR_VSX;
+ #ifdef CONFIG_VSX
+ 	/*
+ 	 * Copy VSX low doubleword to local buffer for formatting,
+diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
+index 1694d738..26588fdc 100644
+--- a/arch/s390/lib/uaccess_pt.c
++++ b/arch/s390/lib/uaccess_pt.c
+@@ -78,11 +78,14 @@ static size_t copy_in_kernel(size_t count, void __user *to,
+  * contains the (negative) exception code.
+  */
+ #ifdef CONFIG_64BIT
++
+ static unsigned long follow_table(struct mm_struct *mm,
+ 				  unsigned long address, int write)
+ {
+ 	unsigned long *table = (unsigned long *)__pa(mm->pgd);
+ 
++	if (unlikely(address > mm->context.asce_limit - 1))
++		return -0x38UL;
+ 	switch (mm->context.asce_bits & _ASCE_TYPE_MASK) {
+ 	case _ASCE_TYPE_REGION1:
+ 		table = table + ((address >> 53) & 0x7ff);
+diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c
+index 1fa8be40..122f737a 100644
+--- a/arch/sh/boards/mach-ecovec24/setup.c
++++ b/arch/sh/boards/mach-ecovec24/setup.c
+@@ -15,6 +15,7 @@
+ #include <linux/mmc/sh_mmcif.h>
+ #include <linux/mmc/sh_mobile_sdhi.h>
+ #include <linux/mtd/physmap.h>
++#include <linux/mfd/tmio.h>
+ #include <linux/gpio.h>
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 5e00b5a5..0c611d89 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -645,10 +645,12 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id)
+ 	__set_bit(QUEUE_FLAG_BYPASS, &q->queue_flags);
+ 
+ 	if (blkcg_init_queue(q))
+-		goto fail_id;
++		goto fail_bdi;
+ 
+ 	return q;
+ 
++fail_bdi:
++	bdi_destroy(&q->backing_dev_info);
+ fail_id:
+ 	ida_simple_remove(&blk_queue_ida, q->id);
+ fail_q:
+diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
+index 06007f0e..52222a2f 100644
+--- a/crypto/asymmetric_keys/x509_public_key.c
++++ b/crypto/asymmetric_keys/x509_public_key.c
+@@ -106,7 +106,6 @@ error_no_sig:
+ static int x509_key_preparse(struct key_preparsed_payload *prep)
+ {
+ 	struct x509_certificate *cert;
+-	struct tm now;
+ 	size_t srlen, sulen;
+ 	char *desc = NULL;
+ 	int ret;
+@@ -137,43 +136,6 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
+ 		goto error_free_cert;
+ 	}
+ 
+-	time_to_tm(CURRENT_TIME.tv_sec, 0, &now);
+-	pr_devel("Now: %04ld-%02d-%02d %02d:%02d:%02d\n",
+-		 now.tm_year + 1900, now.tm_mon + 1, now.tm_mday,
+-		 now.tm_hour, now.tm_min,  now.tm_sec);
+-	if (now.tm_year < cert->valid_from.tm_year ||
+-	    (now.tm_year == cert->valid_from.tm_year &&
+-	     (now.tm_mon < cert->valid_from.tm_mon ||
+-	      (now.tm_mon == cert->valid_from.tm_mon &&
+-	       (now.tm_mday < cert->valid_from.tm_mday ||
+-		(now.tm_mday == cert->valid_from.tm_mday &&
+-		 (now.tm_hour < cert->valid_from.tm_hour ||
+-		  (now.tm_hour == cert->valid_from.tm_hour &&
+-		   (now.tm_min < cert->valid_from.tm_min ||
+-		    (now.tm_min == cert->valid_from.tm_min &&
+-		     (now.tm_sec < cert->valid_from.tm_sec
+-		      ))))))))))) {
+-		pr_warn("Cert %s is not yet valid\n", cert->fingerprint);
+-		ret = -EKEYREJECTED;
+-		goto error_free_cert;
+-	}
+-	if (now.tm_year > cert->valid_to.tm_year ||
+-	    (now.tm_year == cert->valid_to.tm_year &&
+-	     (now.tm_mon > cert->valid_to.tm_mon ||
+-	      (now.tm_mon == cert->valid_to.tm_mon &&
+-	       (now.tm_mday > cert->valid_to.tm_mday ||
+-		(now.tm_mday == cert->valid_to.tm_mday &&
+-		 (now.tm_hour > cert->valid_to.tm_hour ||
+-		  (now.tm_hour == cert->valid_to.tm_hour &&
+-		   (now.tm_min > cert->valid_to.tm_min ||
+-		    (now.tm_min == cert->valid_to.tm_min &&
+-		     (now.tm_sec > cert->valid_to.tm_sec
+-		      ))))))))))) {
+-		pr_warn("Cert %s has expired\n", cert->fingerprint);
+-		ret = -EKEYEXPIRED;
+-		goto error_free_cert;
+-	}
+-
+ 	cert->pub->algo = x509_public_key_algorithms[cert->pkey_algo];
+ 	cert->pub->id_type = PKEY_ID_X509;
+ 
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index d7e53ea5..79de26ed 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -63,6 +63,9 @@ static struct acpi_scan_handler pci_root_handler = {
+ 	.ids = root_device_ids,
+ 	.attach = acpi_pci_root_add,
+ 	.detach = acpi_pci_root_remove,
++	.hotplug = {
++		.ignore = true,
++	},
+ };
+ 
+ static DEFINE_MUTEX(osc_lock);
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 3601738e..d047771c 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -1812,7 +1812,7 @@ static void acpi_scan_init_hotplug(acpi_handle handle, int type)
+ 	 */
+ 	list_for_each_entry(hwid, &pnp.ids, list) {
+ 		handler = acpi_scan_match_handler(hwid->id, NULL);
+-		if (handler) {
++		if (handler && !handler->hotplug.ignore) {
+ 			acpi_install_notify_handler(handle, ACPI_SYSTEM_NOTIFY,
+ 					acpi_hotplug_notify_cb, handler);
+ 			break;
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 8e28f923..14f1e950 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -292,6 +292,10 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	{ PCI_VDEVICE(INTEL, 0x8d66), board_ahci }, /* Wellsburg RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x8d6e), board_ahci }, /* Wellsburg RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x23a3), board_ahci }, /* Coleto Creek AHCI */
++	{ PCI_VDEVICE(INTEL, 0x9c83), board_ahci }, /* Wildcat Point-LP AHCI */
++	{ PCI_VDEVICE(INTEL, 0x9c85), board_ahci }, /* Wildcat Point-LP RAID */
++	{ PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */
++	{ PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */
+ 
+ 	/* JMicron 360/1/3/5/6, match class to avoid IDE function */
+ 	{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+@@ -431,6 +435,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	  .driver_data = board_ahci_yes_fbs },			/* 88se9172 on some Gigabyte */
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x91a3),
+ 	  .driver_data = board_ahci_yes_fbs },
++	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230),
++	  .driver_data = board_ahci_yes_fbs },
+ 
+ 	/* Promise */
+ 	{ PCI_VDEVICE(PROMISE, 0x3f20), board_ahci },	/* PDC42819 */
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index aaac4fb0..cfb74470 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -1275,9 +1275,11 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class,
+ {
+ 	struct ata_port *ap = link->ap;
+ 	struct ahci_host_priv *hpriv = ap->host->private_data;
++	struct ahci_port_priv *pp = ap->private_data;
+ 	const char *reason = NULL;
+ 	unsigned long now, msecs;
+ 	struct ata_taskfile tf;
++	bool fbs_disabled = false;
+ 	int rc;
+ 
+ 	DPRINTK("ENTER\n");
+@@ -1287,6 +1289,16 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class,
+ 	if (rc && rc != -EOPNOTSUPP)
+ 		ata_link_warn(link, "failed to reset engine (errno=%d)\n", rc);
+ 
++	/*
++	 * According to AHCI-1.2 9.3.9: if FBS is enable, software shall
++	 * clear PxFBS.EN to '0' prior to issuing software reset to devices
++	 * that is attached to port multiplier.
++	 */
++	if (!ata_is_host_link(link) && pp->fbs_enabled) {
++		ahci_disable_fbs(ap);
++		fbs_disabled = true;
++	}
++
+ 	ata_tf_init(link->device, &tf);
+ 
+ 	/* issue the first D2H Register FIS */
+@@ -1327,6 +1339,10 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class,
+ 	} else
+ 		*class = ahci_dev_classify(ap);
+ 
++	/* re-enable FBS if disabled before */
++	if (fbs_disabled)
++		ahci_enable_fbs(ap);
++
+ 	DPRINTK("EXIT, class=%u\n", *class);
+ 	return 0;
+ 
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 83b1a9fb..81a94a39 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4126,6 +4126,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ 	{ "TORiSAN DVD-ROM DRD-N216", NULL,	ATA_HORKAGE_MAX_SEC_128 },
+ 	{ "QUANTUM DAT    DAT72-000", NULL,	ATA_HORKAGE_ATAPI_MOD16_DMA },
+ 	{ "Slimtype DVD A  DS8A8SH", NULL,	ATA_HORKAGE_MAX_SEC_LBA48 },
++	{ "Slimtype DVD A  DS8A9SH", NULL,	ATA_HORKAGE_MAX_SEC_LBA48 },
+ 
+ 	/* Devices we expect to fail diagnostics */
+ 
+diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
+index 150a917f..e37413228 100644
+--- a/drivers/ata/libata-transport.c
++++ b/drivers/ata/libata-transport.c
+@@ -321,25 +321,25 @@ int ata_tport_add(struct device *parent,
+ /*
+  * ATA link attributes
+  */
++static int noop(int x) { return x; }
+ 
+-
+-#define ata_link_show_linkspeed(field)					\
++#define ata_link_show_linkspeed(field, format)			        \
+ static ssize_t								\
+ show_ata_link_##field(struct device *dev,				\
+ 		      struct device_attribute *attr, char *buf)		\
+ {									\
+ 	struct ata_link *link = transport_class_to_link(dev);		\
+ 									\
+-	return sprintf(buf,"%s\n", sata_spd_string(fls(link->field)));	\
++	return sprintf(buf, "%s\n", sata_spd_string(format(link->field))); \
+ }
+ 
+-#define ata_link_linkspeed_attr(field)					\
+-	ata_link_show_linkspeed(field)					\
++#define ata_link_linkspeed_attr(field, format)				\
++	ata_link_show_linkspeed(field, format)				\
+ static DEVICE_ATTR(field, S_IRUGO, show_ata_link_##field, NULL)
+ 
+-ata_link_linkspeed_attr(hw_sata_spd_limit);
+-ata_link_linkspeed_attr(sata_spd_limit);
+-ata_link_linkspeed_attr(sata_spd);
++ata_link_linkspeed_attr(hw_sata_spd_limit, fls);
++ata_link_linkspeed_attr(sata_spd_limit, fls);
++ata_link_linkspeed_attr(sata_spd, noop);
+ 
+ 
+ static DECLARE_TRANSPORT_CLASS(ata_link_class,
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 35fa3689..06051767 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -499,7 +499,7 @@ static void __device_release_driver(struct device *dev)
+ 						     BUS_NOTIFY_UNBIND_DRIVER,
+ 						     dev);
+ 
+-		pm_runtime_put(dev);
++		pm_runtime_put_sync(dev);
+ 
+ 		if (dev->bus && dev->bus->remove)
+ 			dev->bus->remove(dev);
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 2f036ca4..c8dac730 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -894,13 +894,6 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
+ 
+ 	bio_list_init(&lo->lo_bio_list);
+ 
+-	/*
+-	 * set queue make_request_fn, and add limits based on lower level
+-	 * device
+-	 */
+-	blk_queue_make_request(lo->lo_queue, loop_make_request);
+-	lo->lo_queue->queuedata = lo;
+-
+ 	if (!(lo_flags & LO_FLAGS_READ_ONLY) && file->f_op->fsync)
+ 		blk_queue_flush(lo->lo_queue, REQ_FLUSH);
+ 
+@@ -1618,6 +1611,8 @@ static int loop_add(struct loop_device **l, int i)
+ 	if (!lo)
+ 		goto out;
+ 
++	lo->lo_state = Lo_unbound;
++
+ 	/* allocate id, if @id >= 0, we're requesting that specific id */
+ 	if (i >= 0) {
+ 		err = idr_alloc(&loop_index_idr, lo, i, i + 1, GFP_KERNEL);
+@@ -1633,7 +1628,13 @@ static int loop_add(struct loop_device **l, int i)
+ 	err = -ENOMEM;
+ 	lo->lo_queue = blk_alloc_queue(GFP_KERNEL);
+ 	if (!lo->lo_queue)
+-		goto out_free_dev;
++		goto out_free_idr;
++
++	/*
++	 * set queue make_request_fn
++	 */
++	blk_queue_make_request(lo->lo_queue, loop_make_request);
++	lo->lo_queue->queuedata = lo;
+ 
+ 	disk = lo->lo_disk = alloc_disk(1 << part_shift);
+ 	if (!disk)
+@@ -1678,6 +1679,8 @@ static int loop_add(struct loop_device **l, int i)
+ 
+ out_free_queue:
+ 	blk_cleanup_queue(lo->lo_queue);
++out_free_idr:
++	idr_remove(&loop_index_idr, i);
+ out_free_dev:
+ 	kfree(lo);
+ out:
+diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
+index bf4b9d28..6620b73d 100644
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -887,6 +887,8 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
+ 	unsigned long secure;
+ 	struct phys_req preq;
+ 
++	xen_blkif_get(blkif);
++
+ 	preq.sector_number = req->u.discard.sector_number;
+ 	preq.nr_sects      = req->u.discard.nr_sectors;
+ 
+@@ -899,7 +901,6 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
+ 	}
+ 	blkif->st_ds_req++;
+ 
+-	xen_blkif_get(blkif);
+ 	secure = (blkif->vbd.discard_secure &&
+ 		 (req->u.discard.flag & BLKIF_DISCARD_SECURE)) ?
+ 		 BLKDEV_DISCARD_SECURE : 0;
+diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c
+index 794123fc..bf8902a0 100644
+--- a/drivers/cpufreq/highbank-cpufreq.c
++++ b/drivers/cpufreq/highbank-cpufreq.c
+@@ -66,7 +66,8 @@ static int hb_cpufreq_driver_init(void)
+ 	struct device_node *np;
+ 	int ret;
+ 
+-	if (!of_machine_is_compatible("calxeda,highbank"))
++	if ((!of_machine_is_compatible("calxeda,highbank")) &&
++		(!of_machine_is_compatible("calxeda,ecx-2000")))
+ 		return -ENODEV;
+ 
+ 	cpu_dev = get_cpu_device(0);
+diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
+index d8ececaf..3efc4dcf 100644
+--- a/drivers/dma/ioat/dma_v3.c
++++ b/drivers/dma/ioat/dma_v3.c
+@@ -87,13 +87,6 @@ static const u8 pq_idx_to_field[] = { 1, 4, 5, 0, 1, 2, 4, 5 };
+ static const u8 pq16_idx_to_field[] = { 1, 4, 1, 2, 3, 4, 5, 6, 7,
+ 					0, 1, 2, 3, 4, 5, 6 };
+ 
+-/*
+- * technically sources 1 and 2 do not require SED, but the op will have
+- * at least 9 descriptors so that's irrelevant.
+- */
+-static const u8 pq16_idx_to_sed[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0,
+-				      1, 1, 1, 1, 1, 1, 1 };
+-
+ static void ioat3_eh(struct ioat2_dma_chan *ioat);
+ 
+ static dma_addr_t xor_get_src(struct ioat_raw_descriptor *descs[2], int idx)
+@@ -135,12 +128,6 @@ static void pq_set_src(struct ioat_raw_descriptor *descs[2],
+ 	pq->coef[idx] = coef;
+ }
+ 
+-static int sed_get_pq16_pool_idx(int src_cnt)
+-{
+-
+-	return pq16_idx_to_sed[src_cnt];
+-}
+-
+ static bool is_jf_ioat(struct pci_dev *pdev)
+ {
+ 	switch (pdev->device) {
+@@ -1129,9 +1116,6 @@ __ioat3_prep_pq16_lock(struct dma_chan *c, enum sum_check_flags *result,
+ 	u8 op;
+ 	int i, s, idx, num_descs;
+ 
+-	/* this function only handles src_cnt 9 - 16 */
+-	BUG_ON(src_cnt < 9);
+-
+ 	/* this function is only called with 9-16 sources */
+ 	op = result ? IOAT_OP_PQ_VAL_16S : IOAT_OP_PQ_16S;
+ 
+@@ -1159,8 +1143,7 @@ __ioat3_prep_pq16_lock(struct dma_chan *c, enum sum_check_flags *result,
+ 
+ 		descs[0] = (struct ioat_raw_descriptor *) pq;
+ 
+-		desc->sed = ioat3_alloc_sed(device,
+-					    sed_get_pq16_pool_idx(src_cnt));
++		desc->sed = ioat3_alloc_sed(device, (src_cnt-2) >> 3);
+ 		if (!desc->sed) {
+ 			dev_err(to_dev(chan),
+ 				"%s: no free sed entries\n", __func__);
+@@ -1218,13 +1201,21 @@ __ioat3_prep_pq16_lock(struct dma_chan *c, enum sum_check_flags *result,
+ 	return &desc->txd;
+ }
+ 
++static int src_cnt_flags(unsigned int src_cnt, unsigned long flags)
++{
++	if (dmaf_p_disabled_continue(flags))
++		return src_cnt + 1;
++	else if (dmaf_continue(flags))
++		return src_cnt + 3;
++	else
++		return src_cnt;
++}
++
+ static struct dma_async_tx_descriptor *
+ ioat3_prep_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
+ 	      unsigned int src_cnt, const unsigned char *scf, size_t len,
+ 	      unsigned long flags)
+ {
+-	struct dma_device *dma = chan->device;
+-
+ 	/* specify valid address for disabled result */
+ 	if (flags & DMA_PREP_PQ_DISABLE_P)
+ 		dst[0] = dst[1];
+@@ -1244,7 +1235,7 @@ ioat3_prep_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
+ 		single_source_coef[0] = scf[0];
+ 		single_source_coef[1] = 0;
+ 
+-		return (src_cnt > 8) && (dma->max_pq > 8) ?
++		return src_cnt_flags(src_cnt, flags) > 8 ?
+ 			__ioat3_prep_pq16_lock(chan, NULL, dst, single_source,
+ 					       2, single_source_coef, len,
+ 					       flags) :
+@@ -1252,7 +1243,7 @@ ioat3_prep_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
+ 					     single_source_coef, len, flags);
+ 
+ 	} else {
+-		return (src_cnt > 8) && (dma->max_pq > 8) ?
++		return src_cnt_flags(src_cnt, flags) > 8 ?
+ 			__ioat3_prep_pq16_lock(chan, NULL, dst, src, src_cnt,
+ 					       scf, len, flags) :
+ 			__ioat3_prep_pq_lock(chan, NULL, dst, src, src_cnt,
+@@ -1265,8 +1256,6 @@ ioat3_prep_pq_val(struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src,
+ 		  unsigned int src_cnt, const unsigned char *scf, size_t len,
+ 		  enum sum_check_flags *pqres, unsigned long flags)
+ {
+-	struct dma_device *dma = chan->device;
+-
+ 	/* specify valid address for disabled result */
+ 	if (flags & DMA_PREP_PQ_DISABLE_P)
+ 		pq[0] = pq[1];
+@@ -1278,7 +1267,7 @@ ioat3_prep_pq_val(struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src,
+ 	 */
+ 	*pqres = 0;
+ 
+-	return (src_cnt > 8) && (dma->max_pq > 8) ?
++	return src_cnt_flags(src_cnt, flags) > 8 ?
+ 		__ioat3_prep_pq16_lock(chan, pqres, pq, src, src_cnt, scf, len,
+ 				       flags) :
+ 		__ioat3_prep_pq_lock(chan, pqres, pq, src, src_cnt, scf, len,
+@@ -1289,7 +1278,6 @@ static struct dma_async_tx_descriptor *
+ ioat3_prep_pqxor(struct dma_chan *chan, dma_addr_t dst, dma_addr_t *src,
+ 		 unsigned int src_cnt, size_t len, unsigned long flags)
+ {
+-	struct dma_device *dma = chan->device;
+ 	unsigned char scf[src_cnt];
+ 	dma_addr_t pq[2];
+ 
+@@ -1298,7 +1286,7 @@ ioat3_prep_pqxor(struct dma_chan *chan, dma_addr_t dst, dma_addr_t *src,
+ 	flags |= DMA_PREP_PQ_DISABLE_Q;
+ 	pq[1] = dst; /* specify valid address for disabled result */
+ 
+-	return (src_cnt > 8) && (dma->max_pq > 8) ?
++	return src_cnt_flags(src_cnt, flags) > 8 ?
+ 		__ioat3_prep_pq16_lock(chan, NULL, pq, src, src_cnt, scf, len,
+ 				       flags) :
+ 		__ioat3_prep_pq_lock(chan, NULL, pq, src, src_cnt, scf, len,
+@@ -1310,7 +1298,6 @@ ioat3_prep_pqxor_val(struct dma_chan *chan, dma_addr_t *src,
+ 		     unsigned int src_cnt, size_t len,
+ 		     enum sum_check_flags *result, unsigned long flags)
+ {
+-	struct dma_device *dma = chan->device;
+ 	unsigned char scf[src_cnt];
+ 	dma_addr_t pq[2];
+ 
+@@ -1324,8 +1311,7 @@ ioat3_prep_pqxor_val(struct dma_chan *chan, dma_addr_t *src,
+ 	flags |= DMA_PREP_PQ_DISABLE_Q;
+ 	pq[1] = pq[0]; /* specify valid address for disabled result */
+ 
+-
+-	return (src_cnt > 8) && (dma->max_pq > 8) ?
++	return src_cnt_flags(src_cnt, flags) > 8 ?
+ 		__ioat3_prep_pq16_lock(chan, result, pq, &src[1], src_cnt - 1,
+ 				       scf, len, flags) :
+ 		__ioat3_prep_pq_lock(chan, result, pq, &src[1], src_cnt - 1,
+@@ -1545,6 +1531,8 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
+ 		goto free_resources;
+ 	}
+ 
++	memset(page_address(dest), 0, PAGE_SIZE);
++
+ 	/* test for non-zero parity sum */
+ 	op = IOAT_OP_XOR_VAL;
+ 
+diff --git a/drivers/edac/highbank_l2_edac.c b/drivers/edac/highbank_l2_edac.c
+index c2bd8c6a..10d3d298 100644
+--- a/drivers/edac/highbank_l2_edac.c
++++ b/drivers/edac/highbank_l2_edac.c
+@@ -90,28 +90,30 @@ static int highbank_l2_err_probe(struct platform_device *pdev)
+ 		goto err;
+ 	}
+ 
++	dci->mod_name = dev_name(&pdev->dev);
++	dci->dev_name = dev_name(&pdev->dev);
++
++	if (edac_device_add_device(dci))
++		goto err;
++
+ 	drvdata->db_irq = platform_get_irq(pdev, 0);
+ 	res = devm_request_irq(&pdev->dev, drvdata->db_irq,
+ 			       highbank_l2_err_handler,
+ 			       0, dev_name(&pdev->dev), dci);
+ 	if (res < 0)
+-		goto err;
++		goto err2;
+ 
+ 	drvdata->sb_irq = platform_get_irq(pdev, 1);
+ 	res = devm_request_irq(&pdev->dev, drvdata->sb_irq,
+ 			       highbank_l2_err_handler,
+ 			       0, dev_name(&pdev->dev), dci);
+ 	if (res < 0)
+-		goto err;
+-
+-	dci->mod_name = dev_name(&pdev->dev);
+-	dci->dev_name = dev_name(&pdev->dev);
+-
+-	if (edac_device_add_device(dci))
+-		goto err;
++		goto err2;
+ 
+ 	devres_close_group(&pdev->dev, NULL);
+ 	return 0;
++err2:
++	edac_device_del_device(&pdev->dev);
+ err:
+ 	devres_release_group(&pdev->dev, NULL);
+ 	edac_device_free_ctl_info(dci);
+diff --git a/drivers/edac/highbank_mc_edac.c b/drivers/edac/highbank_mc_edac.c
+index 4695dd2d..7a783075 100644
+--- a/drivers/edac/highbank_mc_edac.c
++++ b/drivers/edac/highbank_mc_edac.c
+@@ -189,14 +189,6 @@ static int highbank_mc_probe(struct platform_device *pdev)
+ 		goto err;
+ 	}
+ 
+-	irq = platform_get_irq(pdev, 0);
+-	res = devm_request_irq(&pdev->dev, irq, highbank_mc_err_handler,
+-			       0, dev_name(&pdev->dev), mci);
+-	if (res < 0) {
+-		dev_err(&pdev->dev, "Unable to request irq %d\n", irq);
+-		goto err;
+-	}
+-
+ 	mci->mtype_cap = MEM_FLAG_DDR3;
+ 	mci->edac_ctl_cap = EDAC_FLAG_NONE | EDAC_FLAG_SECDED;
+ 	mci->edac_cap = EDAC_FLAG_SECDED;
+@@ -217,10 +209,20 @@ static int highbank_mc_probe(struct platform_device *pdev)
+ 	if (res < 0)
+ 		goto err;
+ 
++	irq = platform_get_irq(pdev, 0);
++	res = devm_request_irq(&pdev->dev, irq, highbank_mc_err_handler,
++			       0, dev_name(&pdev->dev), mci);
++	if (res < 0) {
++		dev_err(&pdev->dev, "Unable to request irq %d\n", irq);
++		goto err2;
++	}
++
+ 	highbank_mc_create_debugfs_nodes(mci);
+ 
+ 	devres_close_group(&pdev->dev, NULL);
+ 	return 0;
++err2:
++	edac_mc_del_mc(&pdev->dev);
+ err:
+ 	devres_release_group(&pdev->dev, NULL);
+ 	edac_mc_free(mci);
+diff --git a/drivers/gpio/gpio-msm-v2.c b/drivers/gpio/gpio-msm-v2.c
+index f7a0cc4d..7b373009 100644
+--- a/drivers/gpio/gpio-msm-v2.c
++++ b/drivers/gpio/gpio-msm-v2.c
+@@ -102,7 +102,7 @@ struct msm_gpio_dev {
+ 	DECLARE_BITMAP(wake_irqs, MAX_NR_GPIO);
+ 	DECLARE_BITMAP(dual_edge_irqs, MAX_NR_GPIO);
+ 	struct irq_domain *domain;
+-	unsigned int summary_irq;
++	int summary_irq;
+ 	void __iomem *msm_tlmm_base;
+ };
+ 
+diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
+index 3c3321f9..db312904 100644
+--- a/drivers/gpio/gpio-mvebu.c
++++ b/drivers/gpio/gpio-mvebu.c
+@@ -79,7 +79,7 @@ struct mvebu_gpio_chip {
+ 	spinlock_t	   lock;
+ 	void __iomem	  *membase;
+ 	void __iomem	  *percpu_membase;
+-	unsigned int       irqbase;
++	int		   irqbase;
+ 	struct irq_domain *domain;
+ 	int                soc_variant;
+ };
+diff --git a/drivers/gpio/gpio-pl061.c b/drivers/gpio/gpio-pl061.c
+index 4274e2e7..e925ca2e 100644
+--- a/drivers/gpio/gpio-pl061.c
++++ b/drivers/gpio/gpio-pl061.c
+@@ -286,11 +286,6 @@ static int pl061_probe(struct amba_device *adev, const struct amba_id *id)
+ 	if (!chip->base)
+ 		return -ENOMEM;
+ 
+-	chip->domain = irq_domain_add_simple(adev->dev.of_node, PL061_GPIO_NR,
+-					     irq_base, &pl061_domain_ops, chip);
+-	if (!chip->domain)
+-		return -ENODEV;
+-
+ 	spin_lock_init(&chip->lock);
+ 
+ 	chip->gc.request = pl061_gpio_request;
+@@ -320,6 +315,11 @@ static int pl061_probe(struct amba_device *adev, const struct amba_id *id)
+ 	irq_set_chained_handler(irq, pl061_irq_handler);
+ 	irq_set_handler_data(irq, chip);
+ 
++	chip->domain = irq_domain_add_simple(adev->dev.of_node, PL061_GPIO_NR,
++					     irq_base, &pl061_domain_ops, chip);
++	if (!chip->domain)
++		return -ENODEV;
++
+ 	for (i = 0; i < PL061_GPIO_NR; i++) {
+ 		if (pdata) {
+ 			if (pdata->directions & (1 << i))
+diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
+index 6038966a..8f64b670 100644
+--- a/drivers/gpio/gpio-rcar.c
++++ b/drivers/gpio/gpio-rcar.c
+@@ -380,7 +380,7 @@ static int gpio_rcar_probe(struct platform_device *pdev)
+ 	if (!p->irq_domain) {
+ 		ret = -ENXIO;
+ 		dev_err(&pdev->dev, "cannot initialize irq domain\n");
+-		goto err1;
++		goto err0;
+ 	}
+ 
+ 	if (devm_request_irq(&pdev->dev, irq->start,
+diff --git a/drivers/gpio/gpio-twl4030.c b/drivers/gpio/gpio-twl4030.c
+index d8e4f6ef..db2de1a2 100644
+--- a/drivers/gpio/gpio-twl4030.c
++++ b/drivers/gpio/gpio-twl4030.c
+@@ -354,17 +354,18 @@ static void twl_set(struct gpio_chip *chip, unsigned offset, int value)
+ static int twl_direction_out(struct gpio_chip *chip, unsigned offset, int value)
+ {
+ 	struct gpio_twl4030_priv *priv = to_gpio_twl4030(chip);
++	int ret = -EINVAL;
+ 
+ 	mutex_lock(&priv->mutex);
+ 	if (offset < TWL4030_GPIO_MAX)
+-		twl4030_set_gpio_dataout(offset, value);
++		ret = twl4030_set_gpio_direction(offset, 0);
+ 
+ 	priv->direction |= BIT(offset);
+ 	mutex_unlock(&priv->mutex);
+ 
+ 	twl_set(chip, offset, value);
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static int twl_to_irq(struct gpio_chip *chip, unsigned offset)
+diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
+index b53fff84..a069b5e2 100644
+--- a/drivers/gpu/drm/i915/intel_ddi.c
++++ b/drivers/gpu/drm/i915/intel_ddi.c
+@@ -1285,6 +1285,26 @@ void intel_ddi_get_config(struct intel_encoder *encoder,
+ 	default:
+ 		break;
+ 	}
++
++	if (encoder->type == INTEL_OUTPUT_EDP && dev_priv->vbt.edp_bpp &&
++	    pipe_config->pipe_bpp > dev_priv->vbt.edp_bpp) {
++		/*
++		 * This is a big fat ugly hack.
++		 *
++		 * Some machines in UEFI boot mode provide us a VBT that has 18
++		 * bpp and 1.62 GHz link bandwidth for eDP, which for reasons
++		 * unknown we fail to light up. Yet the same BIOS boots up with
++		 * 24 bpp and 2.7 GHz link. Use the same bpp as the BIOS uses as
++		 * max, not what it tells us to use.
++		 *
++		 * Note: This will still be broken if the eDP panel is not lit
++		 * up by the BIOS, and thus we can't get the mode at module
++		 * load.
++		 */
++		DRM_DEBUG_KMS("pipe has %d bpp for eDP panel, overriding BIOS-provided max %d bpp\n",
++			      pipe_config->pipe_bpp, dev_priv->vbt.edp_bpp);
++		dev_priv->vbt.edp_bpp = pipe_config->pipe_bpp;
++	}
+ }
+ 
+ static void intel_ddi_destroy(struct drm_encoder *encoder)
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index d78d33f9..333aa1bc 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -6770,7 +6770,9 @@ static void i9xx_update_cursor(struct drm_crtc *crtc, u32 base)
+ 		intel_crtc->cursor_visible = visible;
+ 	}
+ 	/* and commit changes on next vblank */
++	POSTING_READ(CURCNTR(pipe));
+ 	I915_WRITE(CURBASE(pipe), base);
++	POSTING_READ(CURBASE(pipe));
+ }
+ 
+ static void ivb_update_cursor(struct drm_crtc *crtc, u32 base)
+@@ -6799,7 +6801,9 @@ static void ivb_update_cursor(struct drm_crtc *crtc, u32 base)
+ 		intel_crtc->cursor_visible = visible;
+ 	}
+ 	/* and commit changes on next vblank */
++	POSTING_READ(CURCNTR_IVB(pipe));
+ 	I915_WRITE(CURBASE_IVB(pipe), base);
++	POSTING_READ(CURBASE_IVB(pipe));
+ }
+ 
+ /* If no-part of the cursor is visible on the framebuffer, then the GPU may hang... */
+diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
+index 7fa7df54..922cacc1 100644
+--- a/drivers/gpu/drm/i915/intel_dvo.c
++++ b/drivers/gpu/drm/i915/intel_dvo.c
+@@ -171,11 +171,16 @@ static void intel_enable_dvo(struct intel_encoder *encoder)
+ {
+ 	struct drm_i915_private *dev_priv = encoder->base.dev->dev_private;
+ 	struct intel_dvo *intel_dvo = enc_to_dvo(encoder);
++	struct intel_crtc *crtc = to_intel_crtc(encoder->base.crtc);
+ 	u32 dvo_reg = intel_dvo->dev.dvo_reg;
+ 	u32 temp = I915_READ(dvo_reg);
+ 
+ 	I915_WRITE(dvo_reg, temp | DVO_ENABLE);
+ 	I915_READ(dvo_reg);
++	intel_dvo->dev.dev_ops->mode_set(&intel_dvo->dev,
++					 &crtc->config.requested_mode,
++					 &crtc->config.adjusted_mode);
++
+ 	intel_dvo->dev.dev_ops->dpms(&intel_dvo->dev, true);
+ }
+ 
+@@ -184,6 +189,7 @@ static void intel_dvo_dpms(struct drm_connector *connector, int mode)
+ {
+ 	struct intel_dvo *intel_dvo = intel_attached_dvo(connector);
+ 	struct drm_crtc *crtc;
++	struct intel_crtc_config *config;
+ 
+ 	/* dvo supports only 2 dpms states. */
+ 	if (mode != DRM_MODE_DPMS_ON)
+@@ -204,10 +210,16 @@ static void intel_dvo_dpms(struct drm_connector *connector, int mode)
+ 	/* We call connector dpms manually below in case pipe dpms doesn't
+ 	 * change due to cloning. */
+ 	if (mode == DRM_MODE_DPMS_ON) {
++		config = &to_intel_crtc(crtc)->config;
++
+ 		intel_dvo->base.connectors_active = true;
+ 
+ 		intel_crtc_update_dpms(crtc);
+ 
++		intel_dvo->dev.dev_ops->mode_set(&intel_dvo->dev,
++						 &config->requested_mode,
++						 &config->adjusted_mode);
++
+ 		intel_dvo->dev.dev_ops->dpms(&intel_dvo->dev, true);
+ 	} else {
+ 		intel_dvo->dev.dev_ops->dpms(&intel_dvo->dev, false);
+@@ -299,10 +311,6 @@ static void intel_dvo_mode_set(struct intel_encoder *encoder)
+ 		break;
+ 	}
+ 
+-	intel_dvo->dev.dev_ops->mode_set(&intel_dvo->dev,
+-					 &crtc->config.requested_mode,
+-					 adjusted_mode);
+-
+ 	/* Save the data order, since I don't know what it should be set to. */
+ 	dvo_val = I915_READ(dvo_reg) &
+ 		  (DVO_PRESERVE_MASK | DVO_DATA_ORDER_GBRG);
+diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
+index 8649f1c3..ee7d6491 100644
+--- a/drivers/gpu/drm/i915/intel_uncore.c
++++ b/drivers/gpu/drm/i915/intel_uncore.c
+@@ -204,6 +204,19 @@ static void vlv_force_wake_put(struct drm_i915_private *dev_priv)
+ 	gen6_gt_check_fifodbg(dev_priv);
+ }
+ 
++static void intel_uncore_forcewake_reset(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++
++	if (IS_VALLEYVIEW(dev)) {
++		vlv_force_wake_reset(dev_priv);
++	} else if (INTEL_INFO(dev)->gen >= 6) {
++		__gen6_gt_force_wake_reset(dev_priv);
++		if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev))
++			__gen6_gt_force_wake_mt_reset(dev_priv);
++	}
++}
++
+ void intel_uncore_early_sanitize(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -259,19 +272,8 @@ void intel_uncore_init(struct drm_device *dev)
+ 		dev_priv->uncore.funcs.force_wake_put =
+ 			__gen6_gt_force_wake_put;
+ 	}
+-}
+ 
+-static void intel_uncore_forcewake_reset(struct drm_device *dev)
+-{
+-	struct drm_i915_private *dev_priv = dev->dev_private;
+-
+-	if (IS_VALLEYVIEW(dev)) {
+-		vlv_force_wake_reset(dev_priv);
+-	} else if (INTEL_INFO(dev)->gen >= 6) {
+-		__gen6_gt_force_wake_reset(dev_priv);
+-		if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev))
+-			__gen6_gt_force_wake_mt_reset(dev_priv);
+-	}
++	intel_uncore_forcewake_reset(dev);
+ }
+ 
+ void intel_uncore_sanitize(struct drm_device *dev)
+diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
+index f32b7123..d2dfdf76 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -317,7 +317,8 @@ validate_fini_list(struct list_head *list, struct nouveau_fence *fence,
+ 	list_for_each_safe(entry, tmp, list) {
+ 		nvbo = list_entry(entry, struct nouveau_bo, entry);
+ 
+-		nouveau_bo_fence(nvbo, fence);
++		if (likely(fence))
++			nouveau_bo_fence(nvbo, fence);
+ 
+ 		if (unlikely(nvbo->validate_mapped)) {
+ 			ttm_bo_kunmap(&nvbo->kmap);
+diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c
+index 88722f23..f437b30c 100644
+--- a/drivers/gpu/drm/qxl/qxl_fb.c
++++ b/drivers/gpu/drm/qxl/qxl_fb.c
+@@ -108,7 +108,7 @@ static void qxl_fb_dirty_flush(struct fb_info *info)
+ 	u32 x1, x2, y1, y2;
+ 
+ 	/* TODO: hard coding 32 bpp */
+-	int stride = qfbdev->qfb.base.pitches[0] * 4;
++	int stride = qfbdev->qfb.base.pitches[0];
+ 
+ 	x1 = qfbdev->dirty.x1;
+ 	x2 = qfbdev->dirty.x2;
+diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c
+index 0109a964..821ab7b9 100644
+--- a/drivers/gpu/drm/qxl/qxl_release.c
++++ b/drivers/gpu/drm/qxl/qxl_release.c
+@@ -92,6 +92,7 @@ qxl_release_free(struct qxl_device *qdev,
+ 						- DRM_FILE_OFFSET);
+ 		qxl_fence_remove_release(&bo->fence, release->id);
+ 		qxl_bo_unref(&bo);
++		kfree(entry);
+ 	}
+ 	spin_lock(&qdev->release_idr_lock);
+ 	idr_remove(&qdev->release_idr, release->id);
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index bf87f6d4..86d9ee08 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1753,7 +1753,7 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
+ 				if (pll != ATOM_PPLL_INVALID)
+ 					return pll;
+ 			}
+-		} else {
++		} else if (!ASIC_IS_DCE41(rdev)) { /* Don't share PLLs on DCE4.1 chips */
+ 			/* use the same PPLL for all monitors with the same clock */
+ 			pll = radeon_get_shared_nondp_ppll(crtc);
+ 			if (pll != ATOM_PPLL_INVALID)
+diff --git a/drivers/gpu/drm/radeon/atombios_i2c.c b/drivers/gpu/drm/radeon/atombios_i2c.c
+index deaf98cd..0652ee0a 100644
+--- a/drivers/gpu/drm/radeon/atombios_i2c.c
++++ b/drivers/gpu/drm/radeon/atombios_i2c.c
+@@ -56,8 +56,10 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
+ 			return -EINVAL;
+ 		}
+ 		args.ucRegIndex = buf[0];
+-		if (num > 1)
+-			memcpy(&out, &buf[1], num - 1);
++		if (num > 1) {
++			num--;
++			memcpy(&out, &buf[1], num);
++		}
+ 		args.lpI2CDataOut = cpu_to_le16(out);
+ 	} else {
+ 		if (num > ATOM_MAX_HW_I2C_READ) {
+diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
+index 8f7e0453..5720e66d 100644
+--- a/drivers/gpu/drm/radeon/radeon_asic.c
++++ b/drivers/gpu/drm/radeon/radeon_asic.c
+@@ -2019,6 +2019,8 @@ static struct radeon_asic ci_asic = {
+ 		.bandwidth_update = &dce8_bandwidth_update,
+ 		.get_vblank_counter = &evergreen_get_vblank_counter,
+ 		.wait_for_vblank = &dce4_wait_for_vblank,
++		.set_backlight_level = &atombios_set_backlight_level,
++		.get_backlight_level = &atombios_get_backlight_level,
+ 		.hdmi_enable = &evergreen_hdmi_enable,
+ 		.hdmi_setmode = &evergreen_hdmi_setmode,
+ 	},
+@@ -2119,6 +2121,8 @@ static struct radeon_asic kv_asic = {
+ 		.bandwidth_update = &dce8_bandwidth_update,
+ 		.get_vblank_counter = &evergreen_get_vblank_counter,
+ 		.wait_for_vblank = &dce4_wait_for_vblank,
++		.set_backlight_level = &atombios_set_backlight_level,
++		.get_backlight_level = &atombios_get_backlight_level,
+ 		.hdmi_enable = &evergreen_hdmi_enable,
+ 		.hdmi_setmode = &evergreen_hdmi_setmode,
+ 	},
+diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
+index b990b1a2..3b1de72b 100644
+--- a/drivers/gpu/drm/radeon/radeon_gart.c
++++ b/drivers/gpu/drm/radeon/radeon_gart.c
+@@ -1156,6 +1156,8 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
+ 		return -ENOMEM;
+ 
+ 	r = radeon_ib_get(rdev, ridx, &ib, NULL, ndw * 4);
++	if (r)
++		return r;
+ 	ib.length_dw = 0;
+ 
+ 	r = radeon_vm_update_pdes(rdev, vm, &ib, bo_va->soffset, bo_va->eoffset);
+diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+index 7cb178a3..bc73021d 100644
+--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
++++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+@@ -422,6 +422,7 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
+ 	/* Pin framebuffer & get tilling informations */
+ 	obj = radeon_fb->obj;
+ 	rbo = gem_to_radeon_bo(obj);
++retry:
+ 	r = radeon_bo_reserve(rbo, false);
+ 	if (unlikely(r != 0))
+ 		return r;
+@@ -430,6 +431,33 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
+ 				     &base);
+ 	if (unlikely(r != 0)) {
+ 		radeon_bo_unreserve(rbo);
++
++		/* On old GPU like RN50 with little vram pining can fails because
++		 * current fb is taking all space needed. So instead of unpining
++		 * the old buffer after pining the new one, first unpin old one
++		 * and then retry pining new one.
++		 *
++		 * As only master can set mode only master can pin and it is
++		 * unlikely the master client will race with itself especialy
++		 * on those old gpu with single crtc.
++		 *
++		 * We don't shutdown the display controller because new buffer
++		 * will end up in same spot.
++		 */
++		if (!atomic && fb && fb != crtc->fb) {
++			struct radeon_bo *old_rbo;
++			unsigned long nsize, osize;
++
++			old_rbo = gem_to_radeon_bo(to_radeon_framebuffer(fb)->obj);
++			osize = radeon_bo_size(old_rbo);
++			nsize = radeon_bo_size(rbo);
++			if (nsize <= osize && !radeon_bo_reserve(old_rbo, false)) {
++				radeon_bo_unpin(old_rbo);
++				radeon_bo_unreserve(old_rbo);
++				fb = NULL;
++				goto retry;
++			}
++		}
+ 		return -EINVAL;
+ 	}
+ 	radeon_bo_get_tiling_flags(rbo, &tiling_flags, NULL);
+diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
+index 308eff5b..ab0a1724 100644
+--- a/drivers/gpu/drm/radeon/radeon_uvd.c
++++ b/drivers/gpu/drm/radeon/radeon_uvd.c
+@@ -240,6 +240,8 @@ void radeon_uvd_free_handles(struct radeon_device *rdev, struct drm_file *filp)
+ 		if (handle != 0 && rdev->uvd.filp[i] == filp) {
+ 			struct radeon_fence *fence;
+ 
++			radeon_uvd_note_usage(rdev);
++
+ 			r = radeon_uvd_get_destroy_msg(rdev,
+ 				R600_RING_TYPE_UVD_INDEX, handle, &fence);
+ 			if (r) {
+@@ -620,7 +622,7 @@ static int radeon_uvd_send_msg(struct radeon_device *rdev,
+ 	if (r) 
+ 		goto err;
+ 
+-	r = radeon_ib_get(rdev, ring, &ib, NULL, 16);
++	r = radeon_ib_get(rdev, ring, &ib, NULL, 64);
+ 	if (r)
+ 		goto err;
+ 
+diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
+index 7e2e0ea6..6e23019c 100644
+--- a/drivers/gpu/drm/radeon/sid.h
++++ b/drivers/gpu/drm/radeon/sid.h
+@@ -478,7 +478,7 @@
+ #define		STATE3_MASK				(0x1f << 15)
+ #define		STATE3_SHIFT				15
+ 
+-#define	MC_SEQ_TRAIN_WAKEUP_CNTL			0x2808
++#define	MC_SEQ_TRAIN_WAKEUP_CNTL			0x28e8
+ #define		TRAIN_DONE_D0      			(1 << 30)
+ #define		TRAIN_DONE_D1      			(1 << 31)
+ 
+diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
+index 9364129b..d700698a 100644
+--- a/drivers/gpu/drm/radeon/trinity_dpm.c
++++ b/drivers/gpu/drm/radeon/trinity_dpm.c
+@@ -1873,9 +1873,9 @@ int trinity_dpm_init(struct radeon_device *rdev)
+ 	pi->enable_sclk_ds = true;
+ 	pi->enable_gfx_power_gating = true;
+ 	pi->enable_gfx_clock_gating = true;
+-	pi->enable_mg_clock_gating = true;
+-	pi->enable_gfx_dynamic_mgpg = true; /* ??? */
+-	pi->override_dynamic_mgpg = true;
++	pi->enable_mg_clock_gating = false;
++	pi->enable_gfx_dynamic_mgpg = false;
++	pi->override_dynamic_mgpg = false;
+ 	pi->enable_auto_thermal_throttling = true;
+ 	pi->voltage_drop_in_dce = false; /* need to restructure dpm/modeset interaction */
+ 	pi->uvd_dpm = true; /* ??? */
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index f1a857ec..72980532 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -986,24 +986,32 @@ out_unlock:
+ 	return ret;
+ }
+ 
+-static int ttm_bo_mem_compat(struct ttm_placement *placement,
+-			     struct ttm_mem_reg *mem)
++static bool ttm_bo_mem_compat(struct ttm_placement *placement,
++			      struct ttm_mem_reg *mem,
++			      uint32_t *new_flags)
+ {
+ 	int i;
+ 
+ 	if (mem->mm_node && placement->lpfn != 0 &&
+ 	    (mem->start < placement->fpfn ||
+ 	     mem->start + mem->num_pages > placement->lpfn))
+-		return -1;
++		return false;
+ 
+ 	for (i = 0; i < placement->num_placement; i++) {
+-		if ((placement->placement[i] & mem->placement &
+-			TTM_PL_MASK_CACHING) &&
+-			(placement->placement[i] & mem->placement &
+-			TTM_PL_MASK_MEM))
+-			return i;
++		*new_flags = placement->placement[i];
++		if ((*new_flags & mem->placement & TTM_PL_MASK_CACHING) &&
++		    (*new_flags & mem->placement & TTM_PL_MASK_MEM))
++			return true;
++	}
++
++	for (i = 0; i < placement->num_busy_placement; i++) {
++		*new_flags = placement->busy_placement[i];
++		if ((*new_flags & mem->placement & TTM_PL_MASK_CACHING) &&
++		    (*new_flags & mem->placement & TTM_PL_MASK_MEM))
++			return true;
+ 	}
+-	return -1;
++
++	return false;
+ }
+ 
+ int ttm_bo_validate(struct ttm_buffer_object *bo,
+@@ -1012,6 +1020,7 @@ int ttm_bo_validate(struct ttm_buffer_object *bo,
+ 			bool no_wait_gpu)
+ {
+ 	int ret;
++	uint32_t new_flags;
+ 
+ 	lockdep_assert_held(&bo->resv->lock.base);
+ 	/* Check that range is valid */
+@@ -1022,8 +1031,7 @@ int ttm_bo_validate(struct ttm_buffer_object *bo,
+ 	/*
+ 	 * Check whether we need to move buffer.
+ 	 */
+-	ret = ttm_bo_mem_compat(placement, &bo->mem);
+-	if (ret < 0) {
++	if (!ttm_bo_mem_compat(placement, &bo->mem, &new_flags)) {
+ 		ret = ttm_bo_move_buffer(bo, placement, interruptible,
+ 					 no_wait_gpu);
+ 		if (ret)
+@@ -1033,7 +1041,7 @@ int ttm_bo_validate(struct ttm_buffer_object *bo,
+ 		 * Use the access and other non-mapping-related flag bits from
+ 		 * the compatible memory placement flags to the active flags
+ 		 */
+-		ttm_flag_masked(&bo->mem.placement, placement->placement[ret],
++		ttm_flag_masked(&bo->mem.placement, new_flags,
+ 				~TTM_PL_MASK_MEMTYPE);
+ 	}
+ 	/*
+diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
+index 7cc904d3..4834c463 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
+@@ -343,19 +343,25 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
+ 	if (ret)
+ 		goto out;
+ 
++	/*
++	 * Single TTM move. NOP.
++	 */
+ 	if (old_iomap == NULL && new_iomap == NULL)
+ 		goto out2;
++
++	/*
++	 * Move nonexistent data. NOP.
++	 */
+ 	if (old_iomap == NULL && ttm == NULL)
+ 		goto out2;
+ 
+-	if (ttm->state == tt_unpopulated) {
++	/*
++	 * TTM might be null for moves within the same region.
++	 */
++	if (ttm && ttm->state == tt_unpopulated) {
+ 		ret = ttm->bdev->driver->ttm_tt_populate(ttm);
+-		if (ret) {
+-			/* if we fail here don't nuke the mm node
+-			 * as the bo still owns it */
+-			old_copy.mm_node = NULL;
++		if (ret)
+ 			goto out1;
+-		}
+ 	}
+ 
+ 	add = 0;
+@@ -381,11 +387,8 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
+ 						   prot);
+ 		} else
+ 			ret = ttm_copy_io_page(new_iomap, old_iomap, page);
+-		if (ret) {
+-			/* failing here, means keep old copy as-is */
+-			old_copy.mm_node = NULL;
++		if (ret)
+ 			goto out1;
+-		}
+ 	}
+ 	mb();
+ out2:
+@@ -403,7 +406,12 @@ out1:
+ 	ttm_mem_reg_iounmap(bdev, old_mem, new_iomap);
+ out:
+ 	ttm_mem_reg_iounmap(bdev, &old_copy, old_iomap);
+-	ttm_bo_mem_put(bo, &old_copy);
++
++	/*
++	 * On error, keep the mm node!
++	 */
++	if (!ret)
++		ttm_bo_mem_put(bo, &old_copy);
+ 	return ret;
+ }
+ EXPORT_SYMBOL(ttm_bo_move_memcpy);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+index 37fb4bef..252501a5 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+@@ -32,6 +32,8 @@
+ #include <drm/drmP.h>
+ #include "vmwgfx_resource_priv.h"
+ 
++#define VMW_RES_EVICT_ERR_COUNT 10
++
+ struct vmw_user_dma_buffer {
+ 	struct ttm_base_object base;
+ 	struct vmw_dma_buffer dma;
+@@ -1091,8 +1093,9 @@ vmw_resource_backoff_reservation(struct ww_acquire_ctx *ticket,
+  *                         to a backup buffer.
+  *
+  * @res:            The resource to evict.
++ * @interruptible:  Whether to wait interruptible.
+  */
+-int vmw_resource_do_evict(struct vmw_resource *res)
++int vmw_resource_do_evict(struct vmw_resource *res, bool interruptible)
+ {
+ 	struct ttm_validate_buffer val_buf;
+ 	const struct vmw_res_func *func = res->func;
+@@ -1102,7 +1105,8 @@ int vmw_resource_do_evict(struct vmw_resource *res)
+ 	BUG_ON(!func->may_evict);
+ 
+ 	val_buf.bo = NULL;
+-	ret = vmw_resource_check_buffer(res, &ticket, true, &val_buf);
++	ret = vmw_resource_check_buffer(res, &ticket, interruptible,
++					&val_buf);
+ 	if (unlikely(ret != 0))
+ 		return ret;
+ 
+@@ -1141,6 +1145,7 @@ int vmw_resource_validate(struct vmw_resource *res)
+ 	struct vmw_private *dev_priv = res->dev_priv;
+ 	struct list_head *lru_list = &dev_priv->res_lru[res->func->res_type];
+ 	struct ttm_validate_buffer val_buf;
++	unsigned err_count = 0;
+ 
+ 	if (likely(!res->func->may_evict))
+ 		return 0;
+@@ -1155,7 +1160,7 @@ int vmw_resource_validate(struct vmw_resource *res)
+ 
+ 		write_lock(&dev_priv->resource_lock);
+ 		if (list_empty(lru_list) || !res->func->may_evict) {
+-			DRM_ERROR("Out of device device id entries "
++			DRM_ERROR("Out of device device resources "
+ 				  "for %s.\n", res->func->type_name);
+ 			ret = -EBUSY;
+ 			write_unlock(&dev_priv->resource_lock);
+@@ -1168,7 +1173,19 @@ int vmw_resource_validate(struct vmw_resource *res)
+ 		list_del_init(&evict_res->lru_head);
+ 
+ 		write_unlock(&dev_priv->resource_lock);
+-		vmw_resource_do_evict(evict_res);
++
++		ret = vmw_resource_do_evict(evict_res, true);
++		if (unlikely(ret != 0)) {
++			write_lock(&dev_priv->resource_lock);
++			list_add_tail(&evict_res->lru_head, lru_list);
++			write_unlock(&dev_priv->resource_lock);
++			if (ret == -ERESTARTSYS ||
++			    ++err_count > VMW_RES_EVICT_ERR_COUNT) {
++				vmw_resource_unreference(&evict_res);
++				goto out_no_validate;
++			}
++		}
++
+ 		vmw_resource_unreference(&evict_res);
+ 	} while (1);
+ 
+@@ -1253,13 +1270,15 @@ bool vmw_resource_needs_backup(const struct vmw_resource *res)
+  * @type:           The resource type to evict
+  *
+  * To avoid thrashing starvation or as part of the hibernation sequence,
+- * evict all evictable resources of a specific type.
++ * try to evict all evictable resources of a specific type.
+  */
+ static void vmw_resource_evict_type(struct vmw_private *dev_priv,
+ 				    enum vmw_res_type type)
+ {
+ 	struct list_head *lru_list = &dev_priv->res_lru[type];
+ 	struct vmw_resource *evict_res;
++	unsigned err_count = 0;
++	int ret;
+ 
+ 	do {
+ 		write_lock(&dev_priv->resource_lock);
+@@ -1272,7 +1291,18 @@ static void vmw_resource_evict_type(struct vmw_private *dev_priv,
+ 					 lru_head));
+ 		list_del_init(&evict_res->lru_head);
+ 		write_unlock(&dev_priv->resource_lock);
+-		vmw_resource_do_evict(evict_res);
++
++		ret = vmw_resource_do_evict(evict_res, false);
++		if (unlikely(ret != 0)) {
++			write_lock(&dev_priv->resource_lock);
++			list_add_tail(&evict_res->lru_head, lru_list);
++			write_unlock(&dev_priv->resource_lock);
++			if (++err_count > VMW_RES_EVICT_ERR_COUNT) {
++				vmw_resource_unreference(&evict_res);
++				return;
++			}
++		}
++
+ 		vmw_resource_unreference(&evict_res);
+ 	} while (1);
+ 
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index c91d5471..1fc15699 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -242,6 +242,7 @@ config HID_HOLTEK
+ 	  - Tracer Sniper TRM-503 / NOVA Gaming Slider X200 /
+ 	    Zalman ZM-GM1
+ 	  - SHARKOON DarkGlider Gaming mouse
++	  - LEETGION Hellion Gaming Mouse
+ 
+ config HOLTEK_FF
+ 	bool "Holtek On Line Grip force feedback support"
+@@ -369,12 +370,14 @@ config LOGITECH_FF
+ 	  force feedback.
+ 
+ config LOGIRUMBLEPAD2_FF
+-	bool "Logitech RumblePad/Rumblepad 2 force feedback support"
++	bool "Logitech force feedback support (variant 2)"
+ 	depends on HID_LOGITECH
+ 	select INPUT_FF_MEMLESS
+ 	help
+-	  Say Y here if you want to enable force feedback support for Logitech
+-	  RumblePad and Rumblepad 2 devices.
++	  Say Y here if you want to enable force feedback support for:
++	  - Logitech RumblePad
++	  - Logitech Rumblepad 2
++	  - Logitech Formula Vibration Feedback Wheel
+ 
+ config LOGIG940_FF
+ 	bool "Logitech Flight System G940 force feedback support"
+@@ -453,9 +456,11 @@ config HID_MULTITOUCH
+ 	  - Pixcir dual touch panels
+ 	  - Quanta panels
+ 	  - eGalax dual-touch panels, including the Joojoo and Wetab tablets
++	  - SiS multitouch panels
+ 	  - Stantum multitouch panels
+ 	  - Touch International Panels
+ 	  - Unitec Panels
++	  - Wistron optical touch panels
+ 	  - XAT optical touch panels
+ 	  - Xiroku optical touch panels
+ 	  - Zytronic touch panels
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 881cf7b4..3b219b95 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -46,6 +46,12 @@ module_param(iso_layout, uint, 0644);
+ MODULE_PARM_DESC(iso_layout, "Enable/Disable hardcoded ISO-layout of the keyboard. "
+ 		"(0 = disabled, [1] = enabled)");
+ 
++static unsigned int swap_opt_cmd = 0;
++module_param(swap_opt_cmd, uint, 0644);
++MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\") keys. "
++		"(For people who want to keep Windows PC keyboard muscle memory. "
++		"[0] = as-is, Mac layout. 1 = swapped, Windows layout.)");
++
+ struct apple_sc {
+ 	unsigned long quirks;
+ 	unsigned int fn_on;
+@@ -150,6 +156,14 @@ static const struct apple_key_translation apple_iso_keyboard[] = {
+ 	{ }
+ };
+ 
++static const struct apple_key_translation swapped_option_cmd_keys[] = {
++	{ KEY_LEFTALT,	KEY_LEFTMETA },
++	{ KEY_LEFTMETA,	KEY_LEFTALT },
++	{ KEY_RIGHTALT,	KEY_RIGHTMETA },
++	{ KEY_RIGHTMETA,KEY_RIGHTALT },
++	{ }
++};
++
+ static const struct apple_key_translation *apple_find_translation(
+ 		const struct apple_key_translation *table, u16 from)
+ {
+@@ -242,6 +256,14 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
+ 		}
+ 	}
+ 
++	if (swap_opt_cmd) {
++		trans = apple_find_translation(swapped_option_cmd_keys, usage->code);
++		if (trans) {
++			input_event(input, usage->type, trans->to, value);
++			return 1;
++		}
++	}
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/hid/hid-axff.c b/drivers/hid/hid-axff.c
+index 64ab94a5..a594e478 100644
+--- a/drivers/hid/hid-axff.c
++++ b/drivers/hid/hid-axff.c
+@@ -95,7 +95,7 @@ static int axff_init(struct hid_device *hid)
+ 		}
+ 	}
+ 
+-	if (field_count < 4) {
++	if (field_count < 4 && hid->product != 0xf705) {
+ 		hid_err(hid, "not enough fields in the report: %d\n",
+ 			field_count);
+ 		return -ENODEV;
+@@ -180,6 +180,7 @@ static void ax_remove(struct hid_device *hdev)
+ 
+ static const struct hid_device_id ax_devices[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0x0802), },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0xf705), },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(hid, ax_devices);
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index e80da623..c08b5c14 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1605,6 +1605,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_RP_649) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0x0802) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0xf705) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MIGHTYMOUSE) },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICMOUSE) },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICTRACKPAD) },
+@@ -1716,6 +1717,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_580) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
+@@ -1754,6 +1756,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_FLIGHT_SYSTEM_G940) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOMO_WHEEL) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_VIBRATION_WHEEL) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_DFP_WHEEL) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_DFGT_WHEEL) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G25_WHEEL) },
+@@ -1801,12 +1804,14 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_KEYBOARD) },
+ #if IS_ENABLED(CONFIG_HID_ROCCAT)
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ARVO) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ISKU) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ISKUFX) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONEPLUS) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONEPURE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONEPURE_OPTICAL) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONEXTD) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KOVAPLUS) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_LUA) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_PYRA_WIRED) },
+@@ -1816,6 +1821,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_PS1000) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_SIS2_TOUCH, USB_DEVICE_ID_SIS9200_TOUCH) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_SIS2_TOUCH, USB_DEVICE_ID_SIS817_TOUCH) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SKYCABLE, USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_BUZZ_CONTROLLER) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_WIRELESS_BUZZ_CONTROLLER) },
+@@ -2376,15 +2383,6 @@ bool hid_ignore(struct hid_device *hdev)
+ 				hdev->type == HID_TYPE_USBNONE)
+ 			return true;
+ 		break;
+-	case USB_VENDOR_ID_DWAV:
+-		/* These are handled by usbtouchscreen. hdev->type is probably
+-		 * HID_TYPE_USBNONE, but we say !HID_TYPE_USBMOUSE to match
+-		 * usbtouchscreen. */
+-		if ((hdev->product == USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER ||
+-		     hdev->product == USB_DEVICE_ID_DWAV_TOUCHCONTROLLER) &&
+-		    hdev->type != HID_TYPE_USBMOUSE)
+-			return true;
+-		break;
+ 	case USB_VENDOR_ID_VELLEMAN:
+ 		/* These are not HID devices.  They are handled by comedi. */
+ 		if ((hdev->product >= USB_DEVICE_ID_VELLEMAN_K8055_FIRST &&
+diff --git a/drivers/hid/hid-holtek-mouse.c b/drivers/hid/hid-holtek-mouse.c
+index e696566c..0caa676d 100644
+--- a/drivers/hid/hid-holtek-mouse.c
++++ b/drivers/hid/hid-holtek-mouse.c
+@@ -28,6 +28,7 @@
+  * - USB ID 04d9:a04a, sold as Tracer Sniper TRM-503, NOVA Gaming Slider X200
+  *   and Zalman ZM-GM1
+  * - USB ID 04d9:a081, sold as SHARKOON DarkGlider Gaming mouse
++ * - USB ID 04d9:a072, sold as LEETGION Hellion Gaming Mouse
+  */
+ 
+ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+@@ -40,6 +41,7 @@ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 		 * 0x2fff, so they don't exceed HID_MAX_USAGES */
+ 		switch (hdev->product) {
+ 		case USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067:
++		case USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072:
+ 			if (*rsize >= 122 && rdesc[115] == 0xff && rdesc[116] == 0x7f
+ 					&& rdesc[120] == 0xff && rdesc[121] == 0x7f) {
+ 				hid_info(hdev, "Fixing up report descriptor\n");
+@@ -66,6 +68,8 @@ static const struct hid_device_id holtek_mouse_devices[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
+ 			USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
++			USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
+ 			USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
+ 	{ }
+ };
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index f0296a50..9480b425 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -332,6 +332,11 @@
+ #define USB_VENDOR_ID_GENERAL_TOUCH	0x0dfc
+ #define USB_DEVICE_ID_GENERAL_TOUCH_WIN7_TWOFINGERS 0x0003
+ #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PWT_TENFINGERS 0x0100
++#define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_0101 0x0101
++#define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_0102 0x0102
++#define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_0106 0x0106
++#define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_010A 0x010a
++#define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100
+ 
+ #define USB_VENDOR_ID_GLAB		0x06c2
+ #define USB_DEVICE_ID_4_PHIDGETSERVO_30	0x0038
+@@ -448,8 +453,9 @@
+ 
+ #define USB_VENDOR_ID_HOLTEK_ALT		0x04d9
+ #define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD	0xa055
+-#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067	0xa067
+ #define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A	0xa04a
++#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067	0xa067
++#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072	0xa072
+ #define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081	0xa081
+ 
+ #define USB_VENDOR_ID_IMATION		0x0718
+@@ -571,6 +577,7 @@
+ #define USB_DEVICE_ID_DINOVO_EDGE	0xc714
+ #define USB_DEVICE_ID_DINOVO_MINI	0xc71f
+ #define USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2	0xca03
++#define USB_DEVICE_ID_LOGITECH_VIBRATION_WHEEL	0xca04
+ 
+ #define USB_VENDOR_ID_LUMIO		0x202e
+ #define USB_DEVICE_ID_CRYSTALTOUCH	0x0006
+@@ -745,6 +752,10 @@
+ #define USB_VENDOR_ID_SIGMATEL		0x066F
+ #define USB_DEVICE_ID_SIGMATEL_STMP3780	0x3780
+ 
++#define USB_VENDOR_ID_SIS2_TOUCH	0x0457
++#define USB_DEVICE_ID_SIS9200_TOUCH	0x9200
++#define USB_DEVICE_ID_SIS817_TOUCH	0x0817
++
+ #define USB_VENDOR_ID_SKYCABLE			0x1223
+ #define	USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER	0x3F07
+ 
+@@ -888,6 +899,9 @@
+ #define USB_DEVICE_ID_SUPER_DUAL_BOX_PRO 0x8802
+ #define USB_DEVICE_ID_SUPER_JOY_BOX_5_PRO 0x8804
+ 
++#define USB_VENDOR_ID_WISTRON		0x0fb8
++#define USB_DEVICE_ID_WISTRON_OPTICAL_TOUCH		0x1109
++
+ #define USB_VENDOR_ID_X_TENSIONS               0x1ae7
+ #define USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE    0x9001
+ 
+diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
+index 6f12ecd3..1bfd292c 100644
+--- a/drivers/hid/hid-lg.c
++++ b/drivers/hid/hid-lg.c
+@@ -45,6 +45,7 @@
+ /* Size of the original descriptors of the Driving Force (and Pro) wheels */
+ #define DF_RDESC_ORIG_SIZE	130
+ #define DFP_RDESC_ORIG_SIZE	97
++#define FV_RDESC_ORIG_SIZE	130
+ #define MOMO_RDESC_ORIG_SIZE	87
+ 
+ /* Fixed report descriptors for Logitech Driving Force (and Pro)
+@@ -170,6 +171,73 @@ static __u8 dfp_rdesc_fixed[] = {
+ 0xC0                /*  End Collection                          */
+ };
+ 
++static __u8 fv_rdesc_fixed[] = {
++0x05, 0x01,         /*  Usage Page (Desktop),                   */
++0x09, 0x04,         /*  Usage (Joystik),                        */
++0xA1, 0x01,         /*  Collection (Application),               */
++0xA1, 0x02,         /*      Collection (Logical),               */
++0x95, 0x01,         /*          Report Count (1),               */
++0x75, 0x0A,         /*          Report Size (10),               */
++0x15, 0x00,         /*          Logical Minimum (0),            */
++0x26, 0xFF, 0x03,   /*          Logical Maximum (1023),         */
++0x35, 0x00,         /*          Physical Minimum (0),           */
++0x46, 0xFF, 0x03,   /*          Physical Maximum (1023),        */
++0x09, 0x30,         /*          Usage (X),                      */
++0x81, 0x02,         /*          Input (Variable),               */
++0x95, 0x0C,         /*          Report Count (12),              */
++0x75, 0x01,         /*          Report Size (1),                */
++0x25, 0x01,         /*          Logical Maximum (1),            */
++0x45, 0x01,         /*          Physical Maximum (1),           */
++0x05, 0x09,         /*          Usage Page (Button),            */
++0x19, 0x01,         /*          Usage Minimum (01h),            */
++0x29, 0x0C,         /*          Usage Maximum (0Ch),            */
++0x81, 0x02,         /*          Input (Variable),               */
++0x95, 0x02,         /*          Report Count (2),               */
++0x06, 0x00, 0xFF,   /*          Usage Page (FF00h),             */
++0x09, 0x01,         /*          Usage (01h),                    */
++0x81, 0x02,         /*          Input (Variable),               */
++0x09, 0x02,         /*          Usage (02h),                    */
++0x26, 0xFF, 0x00,   /*          Logical Maximum (255),          */
++0x46, 0xFF, 0x00,   /*          Physical Maximum (255),         */
++0x95, 0x01,         /*          Report Count (1),               */
++0x75, 0x08,         /*          Report Size (8),                */
++0x81, 0x02,         /*          Input (Variable),               */
++0x05, 0x01,         /*          Usage Page (Desktop),           */
++0x25, 0x07,         /*          Logical Maximum (7),            */
++0x46, 0x3B, 0x01,   /*          Physical Maximum (315),         */
++0x75, 0x04,         /*          Report Size (4),                */
++0x65, 0x14,         /*          Unit (Degrees),                 */
++0x09, 0x39,         /*          Usage (Hat Switch),             */
++0x81, 0x42,         /*          Input (Variable, Null State),   */
++0x75, 0x01,         /*          Report Size (1),                */
++0x95, 0x04,         /*          Report Count (4),               */
++0x65, 0x00,         /*          Unit,                           */
++0x06, 0x00, 0xFF,   /*          Usage Page (FF00h),             */
++0x09, 0x01,         /*          Usage (01h),                    */
++0x25, 0x01,         /*          Logical Maximum (1),            */
++0x45, 0x01,         /*          Physical Maximum (1),           */
++0x81, 0x02,         /*          Input (Variable),               */
++0x05, 0x01,         /*          Usage Page (Desktop),           */
++0x95, 0x01,         /*          Report Count (1),               */
++0x75, 0x08,         /*          Report Size (8),                */
++0x26, 0xFF, 0x00,   /*          Logical Maximum (255),          */
++0x46, 0xFF, 0x00,   /*          Physical Maximum (255),         */
++0x09, 0x31,         /*          Usage (Y),                      */
++0x81, 0x02,         /*          Input (Variable),               */
++0x09, 0x32,         /*          Usage (Z),                      */
++0x81, 0x02,         /*          Input (Variable),               */
++0xC0,               /*      End Collection,                     */
++0xA1, 0x02,         /*      Collection (Logical),               */
++0x26, 0xFF, 0x00,   /*          Logical Maximum (255),          */
++0x46, 0xFF, 0x00,   /*          Physical Maximum (255),         */
++0x95, 0x07,         /*          Report Count (7),               */
++0x75, 0x08,         /*          Report Size (8),                */
++0x09, 0x03,         /*          Usage (03h),                    */
++0x91, 0x02,         /*          Output (Variable),              */
++0xC0,               /*      End Collection,                     */
++0xC0                /*  End Collection                          */
++};
++
+ static __u8 momo_rdesc_fixed[] = {
+ 0x05, 0x01,         /*  Usage Page (Desktop),               */
+ 0x09, 0x04,         /*  Usage (Joystik),                    */
+@@ -275,6 +343,15 @@ static __u8 *lg_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 		}
+ 		break;
+ 
++	case USB_DEVICE_ID_LOGITECH_VIBRATION_WHEEL:
++		if (*rsize == FV_RDESC_ORIG_SIZE) {
++			hid_info(hdev,
++				"fixing up Logitech Formula Vibration report descriptor\n");
++			rdesc = fv_rdesc_fixed;
++			*rsize = sizeof(fv_rdesc_fixed);
++		}
++		break;
++
+ 	case USB_DEVICE_ID_LOGITECH_DFP_WHEEL:
+ 		if (*rsize == DFP_RDESC_ORIG_SIZE) {
+ 			hid_info(hdev,
+@@ -492,6 +569,7 @@ static int lg_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ 		case USB_DEVICE_ID_LOGITECH_G27_WHEEL:
+ 		case USB_DEVICE_ID_LOGITECH_WII_WHEEL:
+ 		case USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2:
++		case USB_DEVICE_ID_LOGITECH_VIBRATION_WHEEL:
+ 			field->application = HID_GD_MULTIAXIS;
+ 			break;
+ 		default:
+@@ -639,6 +717,8 @@ static const struct hid_device_id lg_devices[] = {
+ 		.driver_data = LG_NOGET | LG_FF4 },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2),
+ 		.driver_data = LG_FF4 },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_VIBRATION_WHEEL),
++		.driver_data = LG_FF2 },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G25_WHEEL),
+ 		.driver_data = LG_FF4 },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_DFGT_WHEEL),
+diff --git a/drivers/hid/hid-lg2ff.c b/drivers/hid/hid-lg2ff.c
+index 1a42eaa6..0e3fb1a7 100644
+--- a/drivers/hid/hid-lg2ff.c
++++ b/drivers/hid/hid-lg2ff.c
+@@ -95,7 +95,7 @@ int lg2ff_init(struct hid_device *hid)
+ 
+ 	hid_hw_request(hid, report, HID_REQ_SET_REPORT);
+ 
+-	hid_info(hid, "Force feedback for Logitech RumblePad/Rumblepad 2 by Anssi Hannula <anssi.hannula@×××××.com>\n");
++	hid_info(hid, "Force feedback for Logitech variant 2 rumble devices by Anssi Hannula <anssi.hannula@×××××.com>\n");
+ 
+ 	return 0;
+ }
+diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
+index 8782fe1a..49f6cc0f 100644
+--- a/drivers/hid/hid-lg4ff.c
++++ b/drivers/hid/hid-lg4ff.c
+@@ -218,12 +218,46 @@ static void hid_lg4ff_set_autocenter_default(struct input_dev *dev, u16 magnitud
+ 	struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
+ 	struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
+ 	__s32 *value = report->field[0]->value;
++	__u32 expand_a, expand_b;
++
++	/* De-activate Auto-Center */
++	if (magnitude == 0) {
++		value[0] = 0xf5;
++		value[1] = 0x00;
++		value[2] = 0x00;
++		value[3] = 0x00;
++		value[4] = 0x00;
++		value[5] = 0x00;
++		value[6] = 0x00;
++
++		hid_hw_request(hid, report, HID_REQ_SET_REPORT);
++		return;
++	}
++
++	if (magnitude <= 0xaaaa) {
++		expand_a = 0x0c * magnitude;
++		expand_b = 0x80 * magnitude;
++	} else {
++		expand_a = (0x0c * 0xaaaa) + 0x06 * (magnitude - 0xaaaa);
++		expand_b = (0x80 * 0xaaaa) + 0xff * (magnitude - 0xaaaa);
++	}
+ 
+ 	value[0] = 0xfe;
+ 	value[1] = 0x0d;
+-	value[2] = magnitude >> 13;
+-	value[3] = magnitude >> 13;
+-	value[4] = magnitude >> 8;
++	value[2] = expand_a / 0xaaaa;
++	value[3] = expand_a / 0xaaaa;
++	value[4] = expand_b / 0xaaaa;
++	value[5] = 0x00;
++	value[6] = 0x00;
++
++	hid_hw_request(hid, report, HID_REQ_SET_REPORT);
++
++	/* Activate Auto-Center */
++	value[0] = 0x14;
++	value[1] = 0x00;
++	value[2] = 0x00;
++	value[3] = 0x00;
++	value[4] = 0x00;
+ 	value[5] = 0x00;
+ 	value[6] = 0x00;
+ 
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 5e5fe1b8..d83b1e8b 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -250,12 +250,12 @@ static struct mt_class mt_classes[] = {
+ 	{ .name	= MT_CLS_GENERALTOUCH_TWOFINGERS,
+ 		.quirks	= MT_QUIRK_NOT_SEEN_MEANS_UP |
+ 			MT_QUIRK_VALID_IS_INRANGE |
+-			MT_QUIRK_SLOT_IS_CONTACTNUMBER,
++			MT_QUIRK_SLOT_IS_CONTACTID,
+ 		.maxcontacts = 2
+ 	},
+ 	{ .name	= MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
+ 		.quirks	= MT_QUIRK_NOT_SEEN_MEANS_UP |
+-			MT_QUIRK_SLOT_IS_CONTACTNUMBER
++			MT_QUIRK_SLOT_IS_CONTACTID
+ 	},
+ 
+ 	{ .name = MT_CLS_FLATFROG,
+@@ -1173,6 +1173,21 @@ static const struct hid_device_id mt_devices[] = {
+ 	{ .driver_data = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
+ 		MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
+ 			USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PWT_TENFINGERS) },
++	{ .driver_data = MT_CLS_GENERALTOUCH_TWOFINGERS,
++		MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
++			USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_0101) },
++	{ .driver_data = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
++		MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
++			USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_0102) },
++	{ .driver_data = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
++		MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
++			USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_0106) },
++	{ .driver_data = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
++		MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
++			USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_010A) },
++	{ .driver_data = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
++		MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
++			USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100) },
+ 
+ 	/* Gametel game controller */
+ 	{ .driver_data = MT_CLS_NSMU,
+@@ -1284,6 +1299,14 @@ static const struct hid_device_id mt_devices[] = {
+ 		MT_USB_DEVICE(USB_VENDOR_ID_QUANTA,
+ 			USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008) },
+ 
++	/* SiS panels */
++	{ .driver_data = MT_CLS_DEFAULT,
++		HID_USB_DEVICE(USB_VENDOR_ID_SIS2_TOUCH,
++		USB_DEVICE_ID_SIS9200_TOUCH) },
++	{ .driver_data = MT_CLS_DEFAULT,
++		HID_USB_DEVICE(USB_VENDOR_ID_SIS2_TOUCH,
++		USB_DEVICE_ID_SIS817_TOUCH) },
++
+ 	/* Stantum panels */
+ 	{ .driver_data = MT_CLS_CONFIDENCE,
+ 		MT_USB_DEVICE(USB_VENDOR_ID_STANTUM,
+@@ -1312,6 +1335,12 @@ static const struct hid_device_id mt_devices[] = {
+ 	{ .driver_data = MT_CLS_NSMU,
+ 		MT_USB_DEVICE(USB_VENDOR_ID_UNITEC,
+ 			USB_DEVICE_ID_UNITEC_USB_TOUCH_0A19) },
++
++	/* Wistron panels */
++	{ .driver_data = MT_CLS_NSMU,
++		MT_USB_DEVICE(USB_VENDOR_ID_WISTRON,
++			USB_DEVICE_ID_WISTRON_OPTICAL_TOUCH) },
++
+ 	/* XAT */
+ 	{ .driver_data = MT_CLS_NSMU,
+ 		MT_USB_DEVICE(USB_VENDOR_ID_XAT,
+diff --git a/drivers/hid/hid-roccat-common.c b/drivers/hid/hid-roccat-common.c
+index 74f70403..e8408999 100644
+--- a/drivers/hid/hid-roccat-common.c
++++ b/drivers/hid/hid-roccat-common.c
+@@ -65,10 +65,11 @@ int roccat_common2_send(struct usb_device *usb_dev, uint report_id,
+ EXPORT_SYMBOL_GPL(roccat_common2_send);
+ 
+ enum roccat_common2_control_states {
+-	ROCCAT_COMMON_CONTROL_STATUS_OVERLOAD = 0,
++	ROCCAT_COMMON_CONTROL_STATUS_CRITICAL = 0,
+ 	ROCCAT_COMMON_CONTROL_STATUS_OK = 1,
+ 	ROCCAT_COMMON_CONTROL_STATUS_INVALID = 2,
+-	ROCCAT_COMMON_CONTROL_STATUS_WAIT = 3,
++	ROCCAT_COMMON_CONTROL_STATUS_BUSY = 3,
++	ROCCAT_COMMON_CONTROL_STATUS_CRITICAL_NEW = 4,
+ };
+ 
+ static int roccat_common2_receive_control_status(struct usb_device *usb_dev)
+@@ -88,13 +89,12 @@ static int roccat_common2_receive_control_status(struct usb_device *usb_dev)
+ 		switch (control.value) {
+ 		case ROCCAT_COMMON_CONTROL_STATUS_OK:
+ 			return 0;
+-		case ROCCAT_COMMON_CONTROL_STATUS_WAIT:
++		case ROCCAT_COMMON_CONTROL_STATUS_BUSY:
+ 			msleep(500);
+ 			continue;
+ 		case ROCCAT_COMMON_CONTROL_STATUS_INVALID:
+-
+-		case ROCCAT_COMMON_CONTROL_STATUS_OVERLOAD:
+-			/* seems to be critical - replug necessary */
++		case ROCCAT_COMMON_CONTROL_STATUS_CRITICAL:
++		case ROCCAT_COMMON_CONTROL_STATUS_CRITICAL_NEW:
+ 			return -EINVAL;
+ 		default:
+ 			dev_err(&usb_dev->dev,
+diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
+index 0c8e1ef0..96604771 100644
+--- a/drivers/hid/hid-roccat-kovaplus.c
++++ b/drivers/hid/hid-roccat-kovaplus.c
+@@ -554,9 +554,13 @@ static void kovaplus_keep_values_up_to_date(struct kovaplus_device *kovaplus,
+ 		break;
+ 	case KOVAPLUS_MOUSE_REPORT_BUTTON_TYPE_CPI:
+ 		kovaplus->actual_cpi = kovaplus_convert_event_cpi(button_report->data1);
++		break;
+ 	case KOVAPLUS_MOUSE_REPORT_BUTTON_TYPE_SENSITIVITY:
+ 		kovaplus->actual_x_sensitivity = button_report->data1;
+ 		kovaplus->actual_y_sensitivity = button_report->data2;
++		break;
++	default:
++		break;
+ 	}
+ }
+ 
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index 10e15810..9e4cdca5 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -326,7 +326,8 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
+ 				field->logical == attr_usage_id) {
+ 				sensor_hub_fill_attr_info(info, i, report->id,
+ 					field->unit, field->unit_exponent,
+-					field->report_size);
++					field->report_size *
++							field->report_count);
+ 				ret = 0;
+ 			} else {
+ 				for (j = 0; j < field->maxusage; ++j) {
+@@ -338,7 +339,8 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
+ 							i, report->id,
+ 							field->unit,
+ 							field->unit_exponent,
+-							field->report_size);
++							field->report_size *
++							field->report_count);
+ 						ret = 0;
+ 						break;
+ 					}
+@@ -425,9 +427,10 @@ static int sensor_hub_raw_event(struct hid_device *hdev,
+ 		hid_dbg(hdev, "%d collection_index:%x hid:%x sz:%x\n",
+ 				i, report->field[i]->usage->collection_index,
+ 				report->field[i]->usage->hid,
+-				report->field[i]->report_size/8);
+-
+-		sz = report->field[i]->report_size/8;
++				(report->field[i]->report_size *
++					report->field[i]->report_count)/8);
++		sz = (report->field[i]->report_size *
++					report->field[i]->report_count)/8;
+ 		if (pdata->pending.status && pdata->pending.attr_usage_id ==
+ 				report->field[i]->usage->hid) {
+ 			hid_dbg(hdev, "data was pending ...\n");
+diff --git a/drivers/hid/hid-wiimote-modules.c b/drivers/hid/hid-wiimote-modules.c
+index 71adf9e6..e30567af 100644
+--- a/drivers/hid/hid-wiimote-modules.c
++++ b/drivers/hid/hid-wiimote-modules.c
+@@ -1656,9 +1656,9 @@ static void wiimod_pro_in_ext(struct wiimote_data *wdata, const __u8 *ext)
+ 	ry = (ext[6] & 0xff) | ((ext[7] & 0x0f) << 8);
+ 
+ 	input_report_abs(wdata->extension.input, ABS_X, lx - 0x800);
+-	input_report_abs(wdata->extension.input, ABS_Y, ly - 0x800);
++	input_report_abs(wdata->extension.input, ABS_Y, 0x800 - ly);
+ 	input_report_abs(wdata->extension.input, ABS_RX, rx - 0x800);
+-	input_report_abs(wdata->extension.input, ABS_RY, ry - 0x800);
++	input_report_abs(wdata->extension.input, ABS_RY, 0x800 - ry);
+ 
+ 	input_report_key(wdata->extension.input,
+ 			 wiimod_pro_map[WIIMOD_PRO_KEY_RIGHT],
+diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
+index 93b00d76..cedc6da9 100644
+--- a/drivers/hid/uhid.c
++++ b/drivers/hid/uhid.c
+@@ -287,7 +287,7 @@ static int uhid_event_from_user(const char __user *buffer, size_t len,
+ 			 */
+ 			struct uhid_create_req_compat *compat;
+ 
+-			compat = kmalloc(sizeof(*compat), GFP_KERNEL);
++			compat = kzalloc(sizeof(*compat), GFP_KERNEL);
+ 			if (!compat)
+ 				return -ENOMEM;
+ 
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 3fca3be0..0db9a672 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -84,6 +84,8 @@ static const struct hid_blacklist {
+ 	{ USB_VENDOR_ID_REALTEK, USB_DEVICE_ID_REALTEK_READER, HID_QUIRK_NO_INIT_REPORTS },
+ 	{ USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_SIGMATEL, USB_DEVICE_ID_SIGMATEL_STMP3780, HID_QUIRK_NOGET },
++	{ USB_VENDOR_ID_SIS2_TOUCH, USB_DEVICE_ID_SIS9200_TOUCH, HID_QUIRK_NOGET },
++	{ USB_VENDOR_ID_SIS2_TOUCH, USB_DEVICE_ID_SIS817_TOUCH, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_1, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_2, HID_QUIRK_NOGET },
+diff --git a/drivers/i2c/busses/i2c-wmt.c b/drivers/i2c/busses/i2c-wmt.c
+index c65da3d9..4bf9507c 100644
+--- a/drivers/i2c/busses/i2c-wmt.c
++++ b/drivers/i2c/busses/i2c-wmt.c
+@@ -349,6 +349,7 @@ static int wmt_i2c_reset_hardware(struct wmt_i2c_dev *i2c_dev)
+ 	err = clk_set_rate(i2c_dev->clk, 20000000);
+ 	if (err) {
+ 		dev_err(i2c_dev->dev, "failed to set clock = 20Mhz\n");
++		clk_disable_unprepare(i2c_dev->clk);
+ 		return err;
+ 	}
+ 
+diff --git a/drivers/i2c/muxes/i2c-mux-gpio.c b/drivers/i2c/muxes/i2c-mux-gpio.c
+index a764da77..f821facb 100644
+--- a/drivers/i2c/muxes/i2c-mux-gpio.c
++++ b/drivers/i2c/muxes/i2c-mux-gpio.c
+@@ -30,15 +30,15 @@ static void i2c_mux_gpio_set(const struct gpiomux *mux, unsigned val)
+ 	int i;
+ 
+ 	for (i = 0; i < mux->data.n_gpios; i++)
+-		gpio_set_value(mux->gpio_base + mux->data.gpios[i],
+-			       val & (1 << i));
++		gpio_set_value_cansleep(mux->gpio_base + mux->data.gpios[i],
++					val & (1 << i));
+ }
+ 
+ static int i2c_mux_gpio_select(struct i2c_adapter *adap, void *data, u32 chan)
+ {
+ 	struct gpiomux *mux = data;
+ 
+-	i2c_mux_gpio_set(mux, mux->data.values[chan]);
++	i2c_mux_gpio_set(mux, chan);
+ 
+ 	return 0;
+ }
+@@ -228,7 +228,7 @@ static int i2c_mux_gpio_probe(struct platform_device *pdev)
+ 		unsigned int class = mux->data.classes ? mux->data.classes[i] : 0;
+ 
+ 		mux->adap[i] = i2c_add_mux_adapter(parent, &pdev->dev, mux, nr,
+-						   i, class,
++						   mux->data.values[i], class,
+ 						   i2c_mux_gpio_select, deselect);
+ 		if (!mux->adap[i]) {
+ 			ret = -ENODEV;
+diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
+index 709c1325..34277153 100644
+--- a/drivers/iio/accel/kxsd9.c
++++ b/drivers/iio/accel/kxsd9.c
+@@ -112,9 +112,10 @@ static int kxsd9_read(struct iio_dev *indio_dev, u8 address)
+ 	mutex_lock(&st->buf_lock);
+ 	st->tx[0] = KXSD9_READ(address);
+ 	ret = spi_sync_transfer(st->us, xfers, ARRAY_SIZE(xfers));
+-	if (ret)
+-		return ret;
+-	return (((u16)(st->rx[0])) << 8) | (st->rx[1] & 0xF0);
++	if (!ret)
++		ret = (((u16)(st->rx[0])) << 8) | (st->rx[1] & 0xF0);
++	mutex_unlock(&st->buf_lock);
++	return ret;
+ }
+ 
+ static IIO_CONST_ATTR(accel_scale_available,
+diff --git a/drivers/infiniband/hw/ipath/ipath_user_sdma.c b/drivers/infiniband/hw/ipath/ipath_user_sdma.c
+index f5cb13b2..cc04b7ba 100644
+--- a/drivers/infiniband/hw/ipath/ipath_user_sdma.c
++++ b/drivers/infiniband/hw/ipath/ipath_user_sdma.c
+@@ -280,9 +280,7 @@ static int ipath_user_sdma_pin_pages(const struct ipath_devdata *dd,
+ 	int j;
+ 	int ret;
+ 
+-	ret = get_user_pages(current, current->mm, addr,
+-			     npages, 0, 1, pages, NULL);
+-
++	ret = get_user_pages_fast(addr, npages, 0, pages);
+ 	if (ret != npages) {
+ 		int i;
+ 
+@@ -811,10 +809,7 @@ int ipath_user_sdma_writev(struct ipath_devdata *dd,
+ 	while (dim) {
+ 		const int mxp = 8;
+ 
+-		down_write(&current->mm->mmap_sem);
+ 		ret = ipath_user_sdma_queue_pkts(dd, pq, &list, iov, dim, mxp);
+-		up_write(&current->mm->mmap_sem);
+-
+ 		if (ret <= 0)
+ 			goto done_unlock;
+ 		else {
+diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
+index 016e7429..5bfc02f4 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7322.c
++++ b/drivers/infiniband/hw/qib/qib_iba7322.c
+@@ -6190,21 +6190,20 @@ static int setup_txselect(const char *str, struct kernel_param *kp)
+ {
+ 	struct qib_devdata *dd;
+ 	unsigned long val;
+-	int ret;
+-
++	char *n;
+ 	if (strlen(str) >= MAX_ATTEN_LEN) {
+ 		pr_info("txselect_values string too long\n");
+ 		return -ENOSPC;
+ 	}
+-	ret = kstrtoul(str, 0, &val);
+-	if (ret || val >= (TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ +
++	val = simple_strtoul(str, &n, 0);
++	if (n == str || val >= (TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ +
+ 				TXDDS_MFG_SZ)) {
+ 		pr_info("txselect_values must start with a number < %d\n",
+ 			TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ + TXDDS_MFG_SZ);
+-		return ret ? ret : -EINVAL;
++		return -EINVAL;
+ 	}
+-
+ 	strcpy(txselect_list, str);
++
+ 	list_for_each_entry(dd, &qib_dev_list, list)
+ 		if (dd->deviceid == PCI_DEVICE_ID_QLOGIC_IB_7322)
+ 			set_no_qsfp_atten(dd, 1);
+diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c
+index d0a0ea0c..165aee2c 100644
+--- a/drivers/infiniband/hw/qib/qib_user_sdma.c
++++ b/drivers/infiniband/hw/qib/qib_user_sdma.c
+@@ -594,8 +594,7 @@ static int qib_user_sdma_pin_pages(const struct qib_devdata *dd,
+ 		else
+ 			j = npages;
+ 
+-		ret = get_user_pages(current, current->mm, addr,
+-			     j, 0, 1, pages, NULL);
++		ret = get_user_pages_fast(addr, j, 0, pages);
+ 		if (ret != j) {
+ 			i = 0;
+ 			j = ret;
+@@ -1294,11 +1293,8 @@ int qib_user_sdma_writev(struct qib_ctxtdata *rcd,
+ 		int mxp = 8;
+ 		int ndesc = 0;
+ 
+-		down_write(&current->mm->mmap_sem);
+ 		ret = qib_user_sdma_queue_pkts(dd, ppd, pq,
+ 				iov, dim, &list, &mxp, &ndesc);
+-		up_write(&current->mm->mmap_sem);
+-
+ 		if (ret < 0)
+ 			goto done_unlock;
+ 		else {
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index 6df23502..db5d0a31 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -1991,8 +1991,6 @@ isert_map_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 
+ 	if (wr->iser_ib_op == ISER_IB_RDMA_WRITE) {
+ 		data_left = se_cmd->data_length;
+-		iscsit_increment_maxcmdsn(cmd, conn->sess);
+-		cmd->stat_sn = conn->stat_sn++;
+ 	} else {
+ 		sg_off = cmd->write_data_done / PAGE_SIZE;
+ 		data_left = se_cmd->data_length - cmd->write_data_done;
+@@ -2204,8 +2202,6 @@ isert_reg_rdma_frwr(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 
+ 	if (wr->iser_ib_op == ISER_IB_RDMA_WRITE) {
+ 		data_left = se_cmd->data_length;
+-		iscsit_increment_maxcmdsn(cmd, conn->sess);
+-		cmd->stat_sn = conn->stat_sn++;
+ 	} else {
+ 		sg_off = cmd->write_data_done / PAGE_SIZE;
+ 		data_left = se_cmd->data_length - cmd->write_data_done;
+@@ -2259,18 +2255,26 @@ isert_reg_rdma_frwr(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	data_len = min(data_left, rdma_write_max);
+ 	wr->cur_rdma_length = data_len;
+ 
+-	spin_lock_irqsave(&isert_conn->conn_lock, flags);
+-	fr_desc = list_first_entry(&isert_conn->conn_frwr_pool,
+-				   struct fast_reg_descriptor, list);
+-	list_del(&fr_desc->list);
+-	spin_unlock_irqrestore(&isert_conn->conn_lock, flags);
+-	wr->fr_desc = fr_desc;
++	/* if there is a single dma entry, dma mr is sufficient */
++	if (count == 1) {
++		ib_sge->addr = ib_sg_dma_address(ib_dev, &sg_start[0]);
++		ib_sge->length = ib_sg_dma_len(ib_dev, &sg_start[0]);
++		ib_sge->lkey = isert_conn->conn_mr->lkey;
++		wr->fr_desc = NULL;
++	} else {
++		spin_lock_irqsave(&isert_conn->conn_lock, flags);
++		fr_desc = list_first_entry(&isert_conn->conn_frwr_pool,
++					   struct fast_reg_descriptor, list);
++		list_del(&fr_desc->list);
++		spin_unlock_irqrestore(&isert_conn->conn_lock, flags);
++		wr->fr_desc = fr_desc;
+ 
+-	ret = isert_fast_reg_mr(fr_desc, isert_cmd, isert_conn,
+-			  ib_sge, offset, data_len);
+-	if (ret) {
+-		list_add_tail(&fr_desc->list, &isert_conn->conn_frwr_pool);
+-		goto unmap_sg;
++		ret = isert_fast_reg_mr(fr_desc, isert_cmd, isert_conn,
++				  ib_sge, offset, data_len);
++		if (ret) {
++			list_add_tail(&fr_desc->list, &isert_conn->conn_frwr_pool);
++			goto unmap_sg;
++		}
+ 	}
+ 
+ 	return 0;
+@@ -2306,7 +2310,7 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
+ 	 * Build isert_conn->tx_desc for iSCSI response PDU and attach
+ 	 */
+ 	isert_create_send_desc(isert_conn, isert_cmd, &isert_cmd->tx_desc);
+-	iscsit_build_rsp_pdu(cmd, conn, false, (struct iscsi_scsi_rsp *)
++	iscsit_build_rsp_pdu(cmd, conn, true, (struct iscsi_scsi_rsp *)
+ 			     &isert_cmd->tx_desc.iscsi_header);
+ 	isert_init_tx_hdrs(isert_conn, &isert_cmd->tx_desc);
+ 	isert_init_send_wr(isert_cmd, &isert_cmd->tx_desc.send_wr);
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index f93baf82..17b58f4f 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -534,6 +534,11 @@ static void srp_remove_target(struct srp_target_port *target)
+ 	ib_destroy_cm_id(target->cm_id);
+ 	srp_free_target_ib(target);
+ 	srp_free_req_data(target);
++
++	spin_lock(&target->srp_host->target_lock);
++	list_del(&target->list);
++	spin_unlock(&target->srp_host->target_lock);
++
+ 	scsi_host_put(target->scsi_host);
+ }
+ 
+@@ -545,10 +550,6 @@ static void srp_remove_work(struct work_struct *work)
+ 	WARN_ON_ONCE(target->state != SRP_TARGET_REMOVED);
+ 
+ 	srp_remove_target(target);
+-
+-	spin_lock(&target->srp_host->target_lock);
+-	list_del(&target->list);
+-	spin_unlock(&target->srp_host->target_lock);
+ }
+ 
+ static void srp_rport_delete(struct srp_rport *rport)
+@@ -1302,14 +1303,13 @@ static void srp_handle_recv(struct srp_target_port *target, struct ib_wc *wc)
+ 			     PFX "Recv failed with error code %d\n", res);
+ }
+ 
+-static void srp_handle_qp_err(enum ib_wc_status wc_status,
+-			      enum ib_wc_opcode wc_opcode,
++static void srp_handle_qp_err(enum ib_wc_status wc_status, bool send_err,
+ 			      struct srp_target_port *target)
+ {
+ 	if (target->connected && !target->qp_in_error) {
+ 		shost_printk(KERN_ERR, target->scsi_host,
+ 			     PFX "failed %s status %d\n",
+-			     wc_opcode & IB_WC_RECV ? "receive" : "send",
++			     send_err ? "send" : "receive",
+ 			     wc_status);
+ 	}
+ 	target->qp_in_error = true;
+@@ -1325,7 +1325,7 @@ static void srp_recv_completion(struct ib_cq *cq, void *target_ptr)
+ 		if (likely(wc.status == IB_WC_SUCCESS)) {
+ 			srp_handle_recv(target, &wc);
+ 		} else {
+-			srp_handle_qp_err(wc.status, wc.opcode, target);
++			srp_handle_qp_err(wc.status, false, target);
+ 		}
+ 	}
+ }
+@@ -1341,7 +1341,7 @@ static void srp_send_completion(struct ib_cq *cq, void *target_ptr)
+ 			iu = (struct srp_iu *) (uintptr_t) wc.wr_id;
+ 			list_add(&iu->list, &target->free_tx);
+ 		} else {
+-			srp_handle_qp_err(wc.status, wc.opcode, target);
++			srp_handle_qp_err(wc.status, true, target);
+ 		}
+ 	}
+ }
+@@ -1751,7 +1751,7 @@ static int srp_abort(struct scsi_cmnd *scmnd)
+ 	shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n");
+ 
+ 	if (!req || !srp_claim_req(target, req, scmnd))
+-		return FAILED;
++		return SUCCESS;
+ 	if (srp_send_tsk_mgmt(target, req->index, scmnd->device->lun,
+ 			      SRP_TSK_ABORT_TASK) == 0)
+ 		ret = SUCCESS;
+diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
+index b6ded17b..a06e1255 100644
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -18,6 +18,8 @@
+ #include <linux/poll.h>
+ #include <linux/sched.h>
+ #include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <linux/mm.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
+ #include <linux/input/mt.h>
+@@ -369,7 +371,11 @@ static int evdev_release(struct inode *inode, struct file *file)
+ 	mutex_unlock(&evdev->mutex);
+ 
+ 	evdev_detach_client(evdev, client);
+-	kfree(client);
++
++	if (is_vmalloc_addr(client))
++		vfree(client);
++	else
++		kfree(client);
+ 
+ 	evdev_close_device(evdev);
+ 
+@@ -389,12 +395,14 @@ static int evdev_open(struct inode *inode, struct file *file)
+ {
+ 	struct evdev *evdev = container_of(inode->i_cdev, struct evdev, cdev);
+ 	unsigned int bufsize = evdev_compute_buffer_size(evdev->handle.dev);
++	unsigned int size = sizeof(struct evdev_client) +
++					bufsize * sizeof(struct input_event);
+ 	struct evdev_client *client;
+ 	int error;
+ 
+-	client = kzalloc(sizeof(struct evdev_client) +
+-				bufsize * sizeof(struct input_event),
+-			 GFP_KERNEL);
++	client = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
++	if (!client)
++		client = vzalloc(size);
+ 	if (!client)
+ 		return -ENOMEM;
+ 
+diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
+index 83658472..7c5d72a6 100644
+--- a/drivers/input/mouse/alps.c
++++ b/drivers/input/mouse/alps.c
+@@ -103,7 +103,6 @@ static const struct alps_model_info alps_model_data[] = {
+ 	/* Dell Latitude E5500, E6400, E6500, Precision M4400 */
+ 	{ { 0x62, 0x02, 0x14 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf,
+ 		ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },
+-	{ { 0x73, 0x00, 0x14 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf, ALPS_DUALPOINT },		/* Dell XT2 */
+ 	{ { 0x73, 0x02, 0x50 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf, ALPS_FOUR_BUTTONS },		/* Dell Vostro 1400 */
+ 	{ { 0x52, 0x01, 0x14 }, 0x00, ALPS_PROTO_V2, 0xff, 0xff,
+ 		ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },				/* Toshiba Tecra A11-11L */
+diff --git a/drivers/input/mouse/cypress_ps2.c b/drivers/input/mouse/cypress_ps2.c
+index f51765ff..888a81a7 100644
+--- a/drivers/input/mouse/cypress_ps2.c
++++ b/drivers/input/mouse/cypress_ps2.c
+@@ -439,7 +439,7 @@ static int cypress_get_finger_count(unsigned char header_byte)
+ 			case 2: return 5;
+ 			default:
+ 				/* Invalid contact (e.g. palm). Ignore it. */
+-				return -1;
++				return 0;
+ 		}
+ 	}
+ 
+@@ -452,17 +452,10 @@ static int cypress_parse_packet(struct psmouse *psmouse,
+ {
+ 	unsigned char *packet = psmouse->packet;
+ 	unsigned char header_byte = packet[0];
+-	int contact_cnt;
+ 
+ 	memset(report_data, 0, sizeof(struct cytp_report_data));
+ 
+-	contact_cnt = cypress_get_finger_count(header_byte);
+-
+-	if (contact_cnt < 0) /* e.g. palm detect */
+-		return -EINVAL;
+-
+-	report_data->contact_cnt = contact_cnt;
+-
++	report_data->contact_cnt = cypress_get_finger_count(header_byte);
+ 	report_data->tap = (header_byte & ABS_MULTIFINGER_TAP) ? 1 : 0;
+ 
+ 	if (report_data->contact_cnt == 1) {
+@@ -535,11 +528,9 @@ static void cypress_process_packet(struct psmouse *psmouse, bool zero_pkt)
+ 	int slots[CYTP_MAX_MT_SLOTS];
+ 	int n;
+ 
+-	if (cypress_parse_packet(psmouse, cytp, &report_data))
+-		return;
++	cypress_parse_packet(psmouse, cytp, &report_data);
+ 
+ 	n = report_data.contact_cnt;
+-
+ 	if (n > CYTP_MAX_MT_SLOTS)
+ 		n = CYTP_MAX_MT_SLOTS;
+ 
+@@ -605,10 +596,6 @@ static psmouse_ret_t cypress_validate_byte(struct psmouse *psmouse)
+ 		return PSMOUSE_BAD_DATA;
+ 
+ 	contact_cnt = cypress_get_finger_count(packet[0]);
+-
+-	if (contact_cnt < 0)
+-		return PSMOUSE_BAD_DATA;
+-
+ 	if (cytp->mode & CYTP_BIT_ABS_NO_PRESSURE)
+ 		cypress_set_packet_size(psmouse, contact_cnt == 2 ? 7 : 4);
+ 	else
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 5f306f79..0ec9abbe 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -765,6 +765,7 @@ static struct pnp_device_id pnp_kbd_devids[] = {
+ 	{ .id = "CPQA0D7", .driver_data = 0 },
+ 	{ .id = "", },
+ };
++MODULE_DEVICE_TABLE(pnp, pnp_kbd_devids);
+ 
+ static struct pnp_driver i8042_pnp_kbd_driver = {
+ 	.name           = "i8042 kbd",
+@@ -786,6 +787,7 @@ static struct pnp_device_id pnp_aux_devids[] = {
+ 	{ .id = "SYN0801", .driver_data = 0 },
+ 	{ .id = "", },
+ };
++MODULE_DEVICE_TABLE(pnp, pnp_aux_devids);
+ 
+ static struct pnp_driver i8042_pnp_aux_driver = {
+ 	.name           = "i8042 aux",
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index 721fdb35..ae4b6b90 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -146,12 +146,10 @@ enum {
+ 
+ #define USB_DEVICE_HID_CLASS(vend, prod) \
+ 	.match_flags = USB_DEVICE_ID_MATCH_INT_CLASS \
+-		| USB_DEVICE_ID_MATCH_INT_PROTOCOL \
+ 		| USB_DEVICE_ID_MATCH_DEVICE, \
+ 	.idVendor = (vend), \
+ 	.idProduct = (prod), \
+-	.bInterfaceClass = USB_INTERFACE_CLASS_HID, \
+-	.bInterfaceProtocol = USB_INTERFACE_PROTOCOL_MOUSE
++	.bInterfaceClass = USB_INTERFACE_CLASS_HID
+ 
+ static const struct usb_device_id usbtouch_devices[] = {
+ #ifdef CONFIG_TOUCHSCREEN_USB_EGALAX
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index f42fc7ed..d1734d9d 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -1742,6 +1742,9 @@ static bool fix_overlapping_extents(struct btree *b,
+ 		if (bkey_cmp(insert, k) < 0) {
+ 			bch_cut_front(insert, k);
+ 		} else {
++			if (bkey_cmp(&START_KEY(insert), &START_KEY(k)) > 0)
++				old_offset = KEY_START(insert);
++
+ 			if (bkey_written(b, k) &&
+ 			    bkey_cmp(&START_KEY(insert), &START_KEY(k)) <= 0) {
+ 				/*
+@@ -1803,6 +1806,10 @@ static bool btree_insert_key(struct btree *b, struct btree_op *op,
+ 		if (fix_overlapping_extents(b, k, &iter, op))
+ 			return false;
+ 
++		if (KEY_DIRTY(k))
++			bcache_dev_sectors_dirty_add(b->c, KEY_INODE(k),
++						     KEY_START(k), KEY_SIZE(k));
++
+ 		while (m != end(i) &&
+ 		       bkey_cmp(k, &START_KEY(m)) > 0)
+ 			prev = m, m = bkey_next(m);
+@@ -1831,10 +1838,6 @@ static bool btree_insert_key(struct btree *b, struct btree_op *op,
+ insert:	shift_keys(b, m, k);
+ copy:	bkey_copy(m, k);
+ merged:
+-	if (KEY_DIRTY(k))
+-		bcache_dev_sectors_dirty_add(b->c, KEY_INODE(k),
+-					     KEY_START(k), KEY_SIZE(k));
+-
+ 	bch_check_keys(b, "%u for %s", status, op_type(op));
+ 
+ 	if (b->level && !KEY_OFFSET(k))
+diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
+index 29569768..ea3e4b4f 100644
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -148,6 +148,9 @@ struct cache {
+ 	wait_queue_head_t migration_wait;
+ 	atomic_t nr_migrations;
+ 
++	wait_queue_head_t quiescing_wait;
++	atomic_t quiescing_ack;
++
+ 	/*
+ 	 * cache_size entries, dirty if set
+ 	 */
+@@ -748,8 +751,9 @@ static void cell_defer(struct cache *cache, struct dm_bio_prison_cell *cell,
+ 
+ static void cleanup_migration(struct dm_cache_migration *mg)
+ {
+-	dec_nr_migrations(mg->cache);
++	struct cache *cache = mg->cache;
+ 	free_migration(mg);
++	dec_nr_migrations(cache);
+ }
+ 
+ static void migration_failure(struct dm_cache_migration *mg)
+@@ -1346,34 +1350,51 @@ static void writeback_some_dirty_blocks(struct cache *cache)
+ /*----------------------------------------------------------------
+  * Main worker loop
+  *--------------------------------------------------------------*/
+-static void start_quiescing(struct cache *cache)
++static bool is_quiescing(struct cache *cache)
+ {
++	int r;
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&cache->lock, flags);
+-	cache->quiescing = 1;
++	r = cache->quiescing;
+ 	spin_unlock_irqrestore(&cache->lock, flags);
++
++	return r;
+ }
+ 
+-static void stop_quiescing(struct cache *cache)
++static void ack_quiescing(struct cache *cache)
++{
++	if (is_quiescing(cache)) {
++		atomic_inc(&cache->quiescing_ack);
++		wake_up(&cache->quiescing_wait);
++	}
++}
++
++static void wait_for_quiescing_ack(struct cache *cache)
++{
++	wait_event(cache->quiescing_wait, atomic_read(&cache->quiescing_ack));
++}
++
++static void start_quiescing(struct cache *cache)
+ {
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&cache->lock, flags);
+-	cache->quiescing = 0;
++	cache->quiescing = true;
+ 	spin_unlock_irqrestore(&cache->lock, flags);
++
++	wait_for_quiescing_ack(cache);
+ }
+ 
+-static bool is_quiescing(struct cache *cache)
++static void stop_quiescing(struct cache *cache)
+ {
+-	int r;
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&cache->lock, flags);
+-	r = cache->quiescing;
++	cache->quiescing = false;
+ 	spin_unlock_irqrestore(&cache->lock, flags);
+ 
+-	return r;
++	atomic_set(&cache->quiescing_ack, 0);
+ }
+ 
+ static void wait_for_migrations(struct cache *cache)
+@@ -1420,16 +1441,15 @@ static void do_worker(struct work_struct *ws)
+ 	struct cache *cache = container_of(ws, struct cache, worker);
+ 
+ 	do {
+-		if (!is_quiescing(cache))
++		if (!is_quiescing(cache)) {
++			writeback_some_dirty_blocks(cache);
++			process_deferred_writethrough_bios(cache);
+ 			process_deferred_bios(cache);
++		}
+ 
+ 		process_migrations(cache, &cache->quiesced_migrations, issue_copy);
+ 		process_migrations(cache, &cache->completed_migrations, complete_migration);
+ 
+-		writeback_some_dirty_blocks(cache);
+-
+-		process_deferred_writethrough_bios(cache);
+-
+ 		if (commit_if_needed(cache)) {
+ 			process_deferred_flush_bios(cache, false);
+ 
+@@ -1442,6 +1462,9 @@ static void do_worker(struct work_struct *ws)
+ 			process_migrations(cache, &cache->need_commit_migrations,
+ 					   migration_success_post_commit);
+ 		}
++
++		ack_quiescing(cache);
++
+ 	} while (more_work(cache));
+ }
+ 
+@@ -2005,6 +2028,9 @@ static int cache_create(struct cache_args *ca, struct cache **result)
+ 	atomic_set(&cache->nr_migrations, 0);
+ 	init_waitqueue_head(&cache->migration_wait);
+ 
++	init_waitqueue_head(&cache->quiescing_wait);
++	atomic_set(&cache->quiescing_ack, 0);
++
+ 	r = -ENOMEM;
+ 	cache->nr_dirty = 0;
+ 	cache->dirty_bitset = alloc_bitset(from_cblock(cache->cache_size));
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index de570a55..799e479d 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -87,6 +87,7 @@ struct multipath {
+ 	unsigned queue_if_no_path:1;	/* Queue I/O if last path fails? */
+ 	unsigned saved_queue_if_no_path:1; /* Saved state during suspension */
+ 	unsigned retain_attached_hw_handler:1; /* If there's already a hw_handler present, don't change it. */
++	unsigned pg_init_disabled:1;	/* pg_init is not currently allowed */
+ 
+ 	unsigned pg_init_retries;	/* Number of times to retry pg_init */
+ 	unsigned pg_init_count;		/* Number of times pg_init called */
+@@ -497,7 +498,8 @@ static void process_queued_ios(struct work_struct *work)
+ 	    (!pgpath && !m->queue_if_no_path))
+ 		must_queue = 0;
+ 
+-	if (m->pg_init_required && !m->pg_init_in_progress && pgpath)
++	if (m->pg_init_required && !m->pg_init_in_progress && pgpath &&
++	    !m->pg_init_disabled)
+ 		__pg_init_all_paths(m);
+ 
+ 	spin_unlock_irqrestore(&m->lock, flags);
+@@ -942,10 +944,20 @@ static void multipath_wait_for_pg_init_completion(struct multipath *m)
+ 
+ static void flush_multipath_work(struct multipath *m)
+ {
++	unsigned long flags;
++
++	spin_lock_irqsave(&m->lock, flags);
++	m->pg_init_disabled = 1;
++	spin_unlock_irqrestore(&m->lock, flags);
++
+ 	flush_workqueue(kmpath_handlerd);
+ 	multipath_wait_for_pg_init_completion(m);
+ 	flush_workqueue(kmultipathd);
+ 	flush_work(&m->trigger_event);
++
++	spin_lock_irqsave(&m->lock, flags);
++	m->pg_init_disabled = 0;
++	spin_unlock_irqrestore(&m->lock, flags);
+ }
+ 
+ static void multipath_dtr(struct dm_target *ti)
+@@ -1164,7 +1176,7 @@ static int pg_init_limit_reached(struct multipath *m, struct pgpath *pgpath)
+ 
+ 	spin_lock_irqsave(&m->lock, flags);
+ 
+-	if (m->pg_init_count <= m->pg_init_retries)
++	if (m->pg_init_count <= m->pg_init_retries && !m->pg_init_disabled)
+ 		m->pg_init_required = 1;
+ 	else
+ 		limit_reached = 1;
+@@ -1714,7 +1726,7 @@ out:
+  *---------------------------------------------------------------*/
+ static struct target_type multipath_target = {
+ 	.name = "multipath",
+-	.version = {1, 5, 1},
++	.version = {1, 6, 0},
+ 	.module = THIS_MODULE,
+ 	.ctr = multipath_ctr,
+ 	.dtr = multipath_dtr,
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index 8f878353..41d907b5 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -545,14 +545,28 @@ static int adjoin(struct dm_table *table, struct dm_target *ti)
+ 
+ /*
+  * Used to dynamically allocate the arg array.
++ *
++ * We do first allocation with GFP_NOIO because dm-mpath and dm-thin must
++ * process messages even if some device is suspended. These messages have a
++ * small fixed number of arguments.
++ *
++ * On the other hand, dm-switch needs to process bulk data using messages and
++ * excessive use of GFP_NOIO could cause trouble.
+  */
+ static char **realloc_argv(unsigned *array_size, char **old_argv)
+ {
+ 	char **argv;
+ 	unsigned new_size;
++	gfp_t gfp;
+ 
+-	new_size = *array_size ? *array_size * 2 : 64;
+-	argv = kmalloc(new_size * sizeof(*argv), GFP_KERNEL);
++	if (*array_size) {
++		new_size = *array_size * 2;
++		gfp = GFP_KERNEL;
++	} else {
++		new_size = 8;
++		gfp = GFP_NOIO;
++	}
++	argv = kmalloc(new_size * sizeof(*argv), gfp);
+ 	if (argv) {
+ 		memcpy(argv, old_argv, *array_size * sizeof(*argv));
+ 		*array_size = new_size;
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 561a65f8..ba46d974 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -3620,6 +3620,7 @@ level_store(struct mddev *mddev, const char *buf, size_t len)
+ 		mddev->in_sync = 1;
+ 		del_timer_sync(&mddev->safemode_timer);
+ 	}
++	blk_set_stacking_limits(&mddev->queue->limits);
+ 	pers->run(mddev);
+ 	set_bit(MD_CHANGE_DEVS, &mddev->flags);
+ 	mddev_resume(mddev);
+@@ -7791,7 +7792,7 @@ void md_check_recovery(struct mddev *mddev)
+ 	if (mddev->ro && !test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))
+ 		return;
+ 	if ( ! (
+-		(mddev->flags & ~ (1<<MD_CHANGE_PENDING)) ||
++		(mddev->flags & MD_UPDATE_SB_FLAGS & ~ (1<<MD_CHANGE_PENDING)) ||
+ 		test_bit(MD_RECOVERY_NEEDED, &mddev->recovery) ||
+ 		test_bit(MD_RECOVERY_DONE, &mddev->recovery) ||
+ 		(mddev->external == 0 && mddev->safemode == 1) ||
+diff --git a/drivers/md/persistent-data/dm-array.c b/drivers/md/persistent-data/dm-array.c
+index 172147eb..af96e24e 100644
+--- a/drivers/md/persistent-data/dm-array.c
++++ b/drivers/md/persistent-data/dm-array.c
+@@ -509,15 +509,18 @@ static int grow_add_tail_block(struct resize *resize)
+ static int grow_needs_more_blocks(struct resize *resize)
+ {
+ 	int r;
++	unsigned old_nr_blocks = resize->old_nr_full_blocks;
+ 
+ 	if (resize->old_nr_entries_in_last_block > 0) {
++		old_nr_blocks++;
++
+ 		r = grow_extend_tail_block(resize, resize->max_entries);
+ 		if (r)
+ 			return r;
+ 	}
+ 
+ 	r = insert_full_ablocks(resize->info, resize->size_of_block,
+-				resize->old_nr_full_blocks,
++				old_nr_blocks,
+ 				resize->new_nr_full_blocks,
+ 				resize->max_entries, resize->value,
+ 				&resize->root);
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index f8b90684..e4109f61 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -340,7 +340,8 @@ static void release_stripe(struct stripe_head *sh)
+ 	unsigned long flags;
+ 	bool wakeup;
+ 
+-	if (test_and_set_bit(STRIPE_ON_RELEASE_LIST, &sh->state))
++	if (unlikely(!conf->mddev->thread) ||
++		test_and_set_bit(STRIPE_ON_RELEASE_LIST, &sh->state))
+ 		goto slow_path;
+ 	wakeup = llist_add(&sh->release_list, &conf->released_stripes);
+ 	if (wakeup)
+@@ -5239,6 +5240,9 @@ raid5_store_group_thread_cnt(struct mddev *mddev, const char *page, size_t len)
+ 	old_groups = conf->worker_groups;
+ 	old_group_cnt = conf->worker_cnt_per_group;
+ 
++	if (old_groups)
++		flush_workqueue(raid5_wq);
++
+ 	conf->worker_groups = NULL;
+ 	err = alloc_thread_groups(conf, new);
+ 	if (err) {
+diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c
+index a204f282..fb504f1e 100644
+--- a/drivers/media/dvb-frontends/af9013.c
++++ b/drivers/media/dvb-frontends/af9013.c
+@@ -24,6 +24,9 @@
+ 
+ #include "af9013_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ struct af9013_state {
+ 	struct i2c_adapter *i2c;
+ 	struct dvb_frontend fe;
+@@ -50,16 +53,23 @@ static int af9013_wr_regs_i2c(struct af9013_state *priv, u8 mbox, u16 reg,
+ 	const u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[3+len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->config.i2c_addr,
+ 			.flags = 0,
+-			.len = sizeof(buf),
++			.len = 3 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (3 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = (reg >> 8) & 0xff;
+ 	buf[1] = (reg >> 0) & 0xff;
+ 	buf[2] = mbox;
+diff --git a/drivers/media/dvb-frontends/af9033.c b/drivers/media/dvb-frontends/af9033.c
+index a777b4b9..30ee5905 100644
+--- a/drivers/media/dvb-frontends/af9033.c
++++ b/drivers/media/dvb-frontends/af9033.c
+@@ -21,6 +21,9 @@
+ 
+ #include "af9033_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ struct af9033_state {
+ 	struct i2c_adapter *i2c;
+ 	struct dvb_frontend fe;
+@@ -40,16 +43,23 @@ static int af9033_wr_regs(struct af9033_state *state, u32 reg, const u8 *val,
+ 		int len)
+ {
+ 	int ret;
+-	u8 buf[3 + len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = state->cfg.i2c_addr,
+ 			.flags = 0,
+-			.len = sizeof(buf),
++			.len = 3 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (3 + len > sizeof(buf)) {
++		dev_warn(&state->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = (reg >> 16) & 0xff;
+ 	buf[1] = (reg >>  8) & 0xff;
+ 	buf[2] = (reg >>  0) & 0xff;
+@@ -161,7 +171,14 @@ static int af9033_wr_reg_val_tab(struct af9033_state *state,
+ 		const struct reg_val *tab, int tab_len)
+ {
+ 	int ret, i, j;
+-	u8 buf[tab_len];
++	u8 buf[MAX_XFER_SIZE];
++
++	if (tab_len > sizeof(buf)) {
++		dev_warn(&state->i2c->dev,
++			 "%s: i2c wr len=%d is too big!\n",
++			 KBUILD_MODNAME, tab_len);
++		return -EINVAL;
++	}
+ 
+ 	dev_dbg(&state->i2c->dev, "%s: tab_len=%d\n", __func__, tab_len);
+ 
+diff --git a/drivers/media/dvb-frontends/bcm3510.c b/drivers/media/dvb-frontends/bcm3510.c
+index 1b77909c..39a29dd2 100644
+--- a/drivers/media/dvb-frontends/bcm3510.c
++++ b/drivers/media/dvb-frontends/bcm3510.c
+@@ -44,6 +44,9 @@
+ #include "bcm3510.h"
+ #include "bcm3510_priv.h"
+ 
++/* Max transfer size done by bcm3510_do_hab_cmd() function */
++#define MAX_XFER_SIZE	128
++
+ struct bcm3510_state {
+ 
+ 	struct i2c_adapter* i2c;
+@@ -201,9 +204,19 @@ static int bcm3510_hab_send_request(struct bcm3510_state *st, u8 *buf, int len)
+ 
+ static int bcm3510_do_hab_cmd(struct bcm3510_state *st, u8 cmd, u8 msgid, u8 *obuf, u8 olen, u8 *ibuf, u8 ilen)
+ {
+-	u8 ob[olen+2],ib[ilen+2];
++	u8 ob[MAX_XFER_SIZE], ib[MAX_XFER_SIZE];
+ 	int ret = 0;
+ 
++	if (ilen + 2 > sizeof(ib)) {
++		deb_hab("do_hab_cmd: ilen=%d is too big!\n", ilen);
++		return -EINVAL;
++	}
++
++	if (olen + 2 > sizeof(ob)) {
++		deb_hab("do_hab_cmd: olen=%d is too big!\n", olen);
++		return -EINVAL;
++	}
++
+ 	ob[0] = cmd;
+ 	ob[1] = msgid;
+ 	memcpy(&ob[2],obuf,olen);
+diff --git a/drivers/media/dvb-frontends/cxd2820r_core.c b/drivers/media/dvb-frontends/cxd2820r_core.c
+index 7ca5c69d..51447a04 100644
+--- a/drivers/media/dvb-frontends/cxd2820r_core.c
++++ b/drivers/media/dvb-frontends/cxd2820r_core.c
+@@ -21,12 +21,15 @@
+ 
+ #include "cxd2820r_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ /* write multiple registers */
+ static int cxd2820r_wr_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg,
+ 	u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[len+1];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = i2c,
+@@ -36,6 +39,13 @@ static int cxd2820r_wr_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg,
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], val, len);
+ 
+@@ -55,7 +65,7 @@ static int cxd2820r_rd_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg,
+ 	u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[2] = {
+ 		{
+ 			.addr = i2c,
+@@ -70,6 +80,13 @@ static int cxd2820r_rd_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg,
+ 		}
+ 	};
+ 
++	if (len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	ret = i2c_transfer(priv->i2c, msg, 2);
+ 	if (ret == 2) {
+ 		memcpy(val, buf, len);
+diff --git a/drivers/media/dvb-frontends/itd1000.c b/drivers/media/dvb-frontends/itd1000.c
+index c1c3400b..cadcae4c 100644
+--- a/drivers/media/dvb-frontends/itd1000.c
++++ b/drivers/media/dvb-frontends/itd1000.c
+@@ -31,6 +31,9 @@
+ #include "itd1000.h"
+ #include "itd1000_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static int debug;
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
+@@ -52,10 +55,18 @@ MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
+ /* don't write more than one byte with flexcop behind */
+ static int itd1000_write_regs(struct itd1000_state *state, u8 reg, u8 v[], u8 len)
+ {
+-	u8 buf[1+len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg = {
+ 		.addr = state->cfg->i2c_address, .flags = 0, .buf = buf, .len = len+1
+ 	};
++
++	if (1 + len > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "itd1000: i2c wr reg=%04x: len=%d is too big!\n",
++		       reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], v, len);
+ 
+diff --git a/drivers/media/dvb-frontends/mt312.c b/drivers/media/dvb-frontends/mt312.c
+index ec388c1d..a74ac0dd 100644
+--- a/drivers/media/dvb-frontends/mt312.c
++++ b/drivers/media/dvb-frontends/mt312.c
+@@ -36,6 +36,8 @@
+ #include "mt312_priv.h"
+ #include "mt312.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
+ 
+ struct mt312_state {
+ 	struct i2c_adapter *i2c;
+@@ -96,9 +98,15 @@ static int mt312_write(struct mt312_state *state, const enum mt312_reg_addr reg,
+ 		       const u8 *src, const size_t count)
+ {
+ 	int ret;
+-	u8 buf[count + 1];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg;
+ 
++	if (1 + count > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "mt312: write: len=%zd is too big!\n", count);
++		return -EINVAL;
++	}
++
+ 	if (debug) {
+ 		int i;
+ 		dprintk("W(%d):", reg & 0x7f);
+diff --git a/drivers/media/dvb-frontends/nxt200x.c b/drivers/media/dvb-frontends/nxt200x.c
+index 8e288940..fbca9856 100644
+--- a/drivers/media/dvb-frontends/nxt200x.c
++++ b/drivers/media/dvb-frontends/nxt200x.c
+@@ -39,6 +39,9 @@
+  */
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ #define NXT2002_DEFAULT_FIRMWARE "dvb-fe-nxt2002.fw"
+ #define NXT2004_DEFAULT_FIRMWARE "dvb-fe-nxt2004.fw"
+ #define CRC_CCIT_MASK 0x1021
+@@ -95,10 +98,16 @@ static int i2c_readbytes(struct nxt200x_state *state, u8 addr, u8 *buf, u8 len)
+ static int nxt200x_writebytes (struct nxt200x_state* state, u8 reg,
+ 			       const u8 *buf, u8 len)
+ {
+-	u8 buf2 [len+1];
++	u8 buf2[MAX_XFER_SIZE];
+ 	int err;
+ 	struct i2c_msg msg = { .addr = state->config->demod_address, .flags = 0, .buf = buf2, .len = len + 1 };
+ 
++	if (1 + len > sizeof(buf2)) {
++		pr_warn("%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 __func__, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf2[0] = reg;
+ 	memcpy(&buf2[1], buf, len);
+ 
+diff --git a/drivers/media/dvb-frontends/rtl2830.c b/drivers/media/dvb-frontends/rtl2830.c
+index 362d26d1..7efb796c 100644
+--- a/drivers/media/dvb-frontends/rtl2830.c
++++ b/drivers/media/dvb-frontends/rtl2830.c
+@@ -27,20 +27,30 @@
+ 
+ #include "rtl2830_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ /* write multiple hardware registers */
+ static int rtl2830_wr(struct rtl2830_priv *priv, u8 reg, const u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[1+len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->cfg.i2c_addr,
+ 			.flags = 0,
+-			.len = 1+len,
++			.len = 1 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], val, len);
+ 
+diff --git a/drivers/media/dvb-frontends/rtl2832.c b/drivers/media/dvb-frontends/rtl2832.c
+index facb8484..b8dd0a13 100644
+--- a/drivers/media/dvb-frontends/rtl2832.c
++++ b/drivers/media/dvb-frontends/rtl2832.c
+@@ -22,6 +22,9 @@
+ #include "dvb_math.h"
+ #include <linux/bitops.h>
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ int rtl2832_debug;
+ module_param_named(debug, rtl2832_debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
+@@ -162,16 +165,23 @@ static const struct rtl2832_reg_entry registers[] = {
+ static int rtl2832_wr(struct rtl2832_priv *priv, u8 reg, u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[1+len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->cfg.i2c_addr,
+ 			.flags = 0,
+-			.len = 1+len,
++			.len = 1 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], val, len);
+ 
+diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c
+index e2fec9eb..93eeaf71 100644
+--- a/drivers/media/dvb-frontends/s5h1420.c
++++ b/drivers/media/dvb-frontends/s5h1420.c
+@@ -836,9 +836,16 @@ static u32 s5h1420_tuner_i2c_func(struct i2c_adapter *adapter)
+ static int s5h1420_tuner_i2c_tuner_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msg[], int num)
+ {
+ 	struct s5h1420_state *state = i2c_get_adapdata(i2c_adap);
+-	struct i2c_msg m[1 + num];
++	struct i2c_msg m[3];
+ 	u8 tx_open[2] = { CON_1, state->CON_1_val | 1 }; /* repeater stops once there was a stop condition */
+ 
++	if (1 + num > ARRAY_SIZE(m)) {
++		printk(KERN_WARNING
++		       "%s: i2c xfer: num=%d is too big!\n",
++		       KBUILD_MODNAME, num);
++		return  -EOPNOTSUPP;
++	}
++
+ 	memset(m, 0, sizeof(struct i2c_msg) * (1 + num));
+ 
+ 	m[0].addr = state->config->demod_address;
+@@ -847,7 +854,7 @@ static int s5h1420_tuner_i2c_tuner_xfer(struct i2c_adapter *i2c_adap, struct i2c
+ 
+ 	memcpy(&m[1], msg, sizeof(struct i2c_msg) * num);
+ 
+-	return i2c_transfer(state->i2c, m, 1+num) == 1 + num ? num : -EIO;
++	return i2c_transfer(state->i2c, m, 1 + num) == 1 + num ? num : -EIO;
+ }
+ 
+ static struct i2c_algorithm s5h1420_tuner_i2c_algo = {
+diff --git a/drivers/media/dvb-frontends/stb0899_drv.c b/drivers/media/dvb-frontends/stb0899_drv.c
+index 3dd5714e..07cd5ea7 100644
+--- a/drivers/media/dvb-frontends/stb0899_drv.c
++++ b/drivers/media/dvb-frontends/stb0899_drv.c
+@@ -32,6 +32,9 @@
+ #include "stb0899_priv.h"
+ #include "stb0899_reg.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static unsigned int verbose = 0;//1;
+ module_param(verbose, int, 0644);
+ 
+@@ -499,7 +502,7 @@ err:
+ int stb0899_write_regs(struct stb0899_state *state, unsigned int reg, u8 *data, u32 count)
+ {
+ 	int ret;
+-	u8 buf[2 + count];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg i2c_msg = {
+ 		.addr	= state->config->demod_address,
+ 		.flags	= 0,
+@@ -507,6 +510,13 @@ int stb0899_write_regs(struct stb0899_state *state, unsigned int reg, u8 *data,
+ 		.len	= 2 + count
+ 	};
+ 
++	if (2 + count > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr reg=%04x: len=%d is too big!\n",
++		       KBUILD_MODNAME, reg, count);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg >> 8;
+ 	buf[1] = reg & 0xff;
+ 	memcpy(&buf[2], data, count);
+diff --git a/drivers/media/dvb-frontends/stb6100.c b/drivers/media/dvb-frontends/stb6100.c
+index 45f9523f..cea175d1 100644
+--- a/drivers/media/dvb-frontends/stb6100.c
++++ b/drivers/media/dvb-frontends/stb6100.c
+@@ -31,6 +31,8 @@
+ static unsigned int verbose;
+ module_param(verbose, int, 0644);
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
+ 
+ #define FE_ERROR		0
+ #define FE_NOTICE		1
+@@ -183,7 +185,7 @@ static int stb6100_read_reg(struct stb6100_state *state, u8 reg)
+ static int stb6100_write_reg_range(struct stb6100_state *state, u8 buf[], int start, int len)
+ {
+ 	int rc;
+-	u8 cmdbuf[len + 1];
++	u8 cmdbuf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg = {
+ 		.addr	= state->config->tuner_address,
+ 		.flags	= 0,
+@@ -191,6 +193,13 @@ static int stb6100_write_reg_range(struct stb6100_state *state, u8 buf[], int st
+ 		.len	= len + 1
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr: len=%d is too big!\n",
++		       KBUILD_MODNAME, len);
++		return -EINVAL;
++	}
++
+ 	if (unlikely(start < 1 || start + len > STB6100_NUMREGS)) {
+ 		dprintk(verbose, FE_ERROR, 1, "Invalid register range %d:%d",
+ 			start, len);
+diff --git a/drivers/media/dvb-frontends/stv0367.c b/drivers/media/dvb-frontends/stv0367.c
+index 7b6dba3c..45877273 100644
+--- a/drivers/media/dvb-frontends/stv0367.c
++++ b/drivers/media/dvb-frontends/stv0367.c
+@@ -33,6 +33,9 @@
+ #include "stv0367_regs.h"
+ #include "stv0367_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static int stvdebug;
+ module_param_named(debug, stvdebug, int, 0644);
+ 
+@@ -767,7 +770,7 @@ static struct st_register def0367cab[STV0367CAB_NBREGS] = {
+ static
+ int stv0367_writeregs(struct stv0367_state *state, u16 reg, u8 *data, int len)
+ {
+-	u8 buf[len + 2];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg = {
+ 		.addr = state->config->demod_address,
+ 		.flags = 0,
+@@ -776,6 +779,14 @@ int stv0367_writeregs(struct stv0367_state *state, u16 reg, u8 *data, int len)
+ 	};
+ 	int ret;
+ 
++	if (2 + len > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr reg=%04x: len=%d is too big!\n",
++		       KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
++
+ 	buf[0] = MSB(reg);
+ 	buf[1] = LSB(reg);
+ 	memcpy(buf + 2, data, len);
+diff --git a/drivers/media/dvb-frontends/stv090x.c b/drivers/media/dvb-frontends/stv090x.c
+index 56d470ad..23e872f8 100644
+--- a/drivers/media/dvb-frontends/stv090x.c
++++ b/drivers/media/dvb-frontends/stv090x.c
+@@ -35,6 +35,9 @@
+ #include "stv090x.h"
+ #include "stv090x_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static unsigned int verbose;
+ module_param(verbose, int, 0644);
+ 
+@@ -722,9 +725,16 @@ static int stv090x_write_regs(struct stv090x_state *state, unsigned int reg, u8
+ {
+ 	const struct stv090x_config *config = state->config;
+ 	int ret;
+-	u8 buf[2 + count];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg i2c_msg = { .addr = config->address, .flags = 0, .buf = buf, .len = 2 + count };
+ 
++	if (2 + count > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr reg=%04x: len=%d is too big!\n",
++		       KBUILD_MODNAME, reg, count);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg >> 8;
+ 	buf[1] = reg & 0xff;
+ 	memcpy(&buf[2], data, count);
+diff --git a/drivers/media/dvb-frontends/stv6110.c b/drivers/media/dvb-frontends/stv6110.c
+index 20b5fa92..b1425830 100644
+--- a/drivers/media/dvb-frontends/stv6110.c
++++ b/drivers/media/dvb-frontends/stv6110.c
+@@ -30,6 +30,9 @@
+ 
+ #include "stv6110.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static int debug;
+ 
+ struct stv6110_priv {
+@@ -68,7 +71,7 @@ static int stv6110_write_regs(struct dvb_frontend *fe, u8 buf[],
+ {
+ 	struct stv6110_priv *priv = fe->tuner_priv;
+ 	int rc;
+-	u8 cmdbuf[len + 1];
++	u8 cmdbuf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg = {
+ 		.addr	= priv->i2c_address,
+ 		.flags	= 0,
+@@ -78,6 +81,13 @@ static int stv6110_write_regs(struct dvb_frontend *fe, u8 buf[],
+ 
+ 	dprintk("%s\n", __func__);
+ 
++	if (1 + len > sizeof(cmdbuf)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr: len=%d is too big!\n",
++		       KBUILD_MODNAME, len);
++		return -EINVAL;
++	}
++
+ 	if (start + len > 8)
+ 		return -EINVAL;
+ 
+diff --git a/drivers/media/dvb-frontends/stv6110x.c b/drivers/media/dvb-frontends/stv6110x.c
+index f36cab12..e66154e5 100644
+--- a/drivers/media/dvb-frontends/stv6110x.c
++++ b/drivers/media/dvb-frontends/stv6110x.c
+@@ -32,6 +32,9 @@
+ #include "stv6110x.h"
+ #include "stv6110x_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static unsigned int verbose;
+ module_param(verbose, int, 0644);
+ MODULE_PARM_DESC(verbose, "Set Verbosity level");
+@@ -61,7 +64,8 @@ static int stv6110x_write_regs(struct stv6110x_state *stv6110x, int start, u8 da
+ {
+ 	int ret;
+ 	const struct stv6110x_config *config = stv6110x->config;
+-	u8 buf[len + 1];
++	u8 buf[MAX_XFER_SIZE];
++
+ 	struct i2c_msg msg = {
+ 		.addr = config->addr,
+ 		.flags = 0,
+@@ -69,6 +73,13 @@ static int stv6110x_write_regs(struct stv6110x_state *stv6110x, int start, u8 da
+ 		.len = len + 1
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr: len=%d is too big!\n",
++		       KBUILD_MODNAME, len);
++		return -EINVAL;
++	}
++
+ 	if (start + len > 8)
+ 		return -EINVAL;
+ 
+diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c
+index e79749cf..8ad3a57c 100644
+--- a/drivers/media/dvb-frontends/tda10071.c
++++ b/drivers/media/dvb-frontends/tda10071.c
+@@ -20,6 +20,9 @@
+ 
+ #include "tda10071_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static struct dvb_frontend_ops tda10071_ops;
+ 
+ /* write multiple registers */
+@@ -27,16 +30,23 @@ static int tda10071_wr_regs(struct tda10071_priv *priv, u8 reg, u8 *val,
+ 	int len)
+ {
+ 	int ret;
+-	u8 buf[len+1];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->cfg.demod_i2c_addr,
+ 			.flags = 0,
+-			.len = sizeof(buf),
++			.len = 1 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], val, len);
+ 
+@@ -56,7 +66,7 @@ static int tda10071_rd_regs(struct tda10071_priv *priv, u8 reg, u8 *val,
+ 	int len)
+ {
+ 	int ret;
+-	u8 buf[len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[2] = {
+ 		{
+ 			.addr = priv->cfg.demod_i2c_addr,
+@@ -66,11 +76,18 @@ static int tda10071_rd_regs(struct tda10071_priv *priv, u8 reg, u8 *val,
+ 		}, {
+ 			.addr = priv->cfg.demod_i2c_addr,
+ 			.flags = I2C_M_RD,
+-			.len = sizeof(buf),
++			.len = len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	ret = i2c_transfer(priv->i2c, msg, 2);
+ 	if (ret == 2) {
+ 		memcpy(val, buf, len);
+diff --git a/drivers/media/dvb-frontends/tda18271c2dd.c b/drivers/media/dvb-frontends/tda18271c2dd.c
+index d281f77d..2c54586a 100644
+--- a/drivers/media/dvb-frontends/tda18271c2dd.c
++++ b/drivers/media/dvb-frontends/tda18271c2dd.c
+@@ -34,6 +34,9 @@
+ #include "dvb_frontend.h"
+ #include "tda18271c2dd.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ struct SStandardParam {
+ 	s32   m_IFFrequency;
+ 	u32   m_BandWidth;
+@@ -139,11 +142,18 @@ static int i2c_write(struct i2c_adapter *adap, u8 adr, u8 *data, int len)
+ static int WriteRegs(struct tda_state *state,
+ 		     u8 SubAddr, u8 *Regs, u16 nRegs)
+ {
+-	u8 data[nRegs+1];
++	u8 data[MAX_XFER_SIZE];
++
++	if (1 + nRegs > sizeof(data)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr: len=%d is too big!\n",
++		       KBUILD_MODNAME, nRegs);
++		return -EINVAL;
++	}
+ 
+ 	data[0] = SubAddr;
+ 	memcpy(data + 1, Regs, nRegs);
+-	return i2c_write(state->i2c, state->adr, data, nRegs+1);
++	return i2c_write(state->i2c, state->adr, data, nRegs + 1);
+ }
+ 
+ static int WriteReg(struct tda_state *state, u8 SubAddr, u8 Reg)
+diff --git a/drivers/media/dvb-frontends/zl10039.c b/drivers/media/dvb-frontends/zl10039.c
+index eff9c5fd..91b6b2e9 100644
+--- a/drivers/media/dvb-frontends/zl10039.c
++++ b/drivers/media/dvb-frontends/zl10039.c
+@@ -30,6 +30,9 @@
+ 
+ static int debug;
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ #define dprintk(args...) \
+ 	do { \
+ 		if (debug) \
+@@ -98,7 +101,7 @@ static int zl10039_write(struct zl10039_state *state,
+ 			const enum zl10039_reg_addr reg, const u8 *src,
+ 			const size_t count)
+ {
+-	u8 buf[count + 1];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg = {
+ 		.addr = state->i2c_addr,
+ 		.flags = 0,
+@@ -106,6 +109,13 @@ static int zl10039_write(struct zl10039_state *state,
+ 		.len = count + 1,
+ 	};
+ 
++	if (1 + count > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr reg=%04x: len=%zd is too big!\n",
++		       KBUILD_MODNAME, reg, count);
++		return -EINVAL;
++	}
++
+ 	dprintk("%s\n", __func__);
+ 	/* Write register address and data in one go */
+ 	buf[0] = reg;
+diff --git a/drivers/media/pci/cx18/cx18-driver.c b/drivers/media/pci/cx18/cx18-driver.c
+index 004d8ace..6386ced9 100644
+--- a/drivers/media/pci/cx18/cx18-driver.c
++++ b/drivers/media/pci/cx18/cx18-driver.c
+@@ -324,23 +324,24 @@ static void cx18_eeprom_dump(struct cx18 *cx, unsigned char *eedata, int len)
+ /* Hauppauge card? get values from tveeprom */
+ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
+ {
+-	struct i2c_client c;
++	struct i2c_client *c;
+ 	u8 eedata[256];
+ 
+-	memset(&c, 0, sizeof(c));
+-	strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
+-	c.adapter = &cx->i2c_adap[0];
+-	c.addr = 0xA0 >> 1;
++	c = kzalloc(sizeof(*c), GFP_KERNEL);
++
++	strlcpy(c->name, "cx18 tveeprom tmp", sizeof(c->name));
++	c->adapter = &cx->i2c_adap[0];
++	c->addr = 0xa0 >> 1;
+ 
+ 	memset(tv, 0, sizeof(*tv));
+-	if (tveeprom_read(&c, eedata, sizeof(eedata)))
+-		return;
++	if (tveeprom_read(c, eedata, sizeof(eedata)))
++		goto ret;
+ 
+ 	switch (cx->card->type) {
+ 	case CX18_CARD_HVR_1600_ESMT:
+ 	case CX18_CARD_HVR_1600_SAMSUNG:
+ 	case CX18_CARD_HVR_1600_S5H1411:
+-		tveeprom_hauppauge_analog(&c, tv, eedata);
++		tveeprom_hauppauge_analog(c, tv, eedata);
+ 		break;
+ 	case CX18_CARD_YUAN_MPC718:
+ 	case CX18_CARD_GOTVIEW_PCI_DVD3:
+@@ -354,6 +355,9 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
+ 		cx18_eeprom_dump(cx, eedata, sizeof(eedata));
+ 		break;
+ 	}
++
++ret:
++	kfree(c);
+ }
+ 
+ static void cx18_process_eeprom(struct cx18 *cx)
+diff --git a/drivers/media/pci/cx23885/cimax2.c b/drivers/media/pci/cx23885/cimax2.c
+index 73448491..16fa7ea4 100644
+--- a/drivers/media/pci/cx23885/cimax2.c
++++ b/drivers/media/pci/cx23885/cimax2.c
+@@ -26,6 +26,10 @@
+ #include "cx23885.h"
+ #include "cimax2.h"
+ #include "dvb_ca_en50221.h"
++
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ /**** Bit definitions for MC417_RWD and MC417_OEN registers  ***
+   bits 31-16
+ +-----------+
+@@ -125,7 +129,7 @@ static int netup_write_i2c(struct i2c_adapter *i2c_adap, u8 addr, u8 reg,
+ 						u8 *buf, int len)
+ {
+ 	int ret;
+-	u8 buffer[len + 1];
++	u8 buffer[MAX_XFER_SIZE];
+ 
+ 	struct i2c_msg msg = {
+ 		.addr	= addr,
+@@ -134,6 +138,13 @@ static int netup_write_i2c(struct i2c_adapter *i2c_adap, u8 addr, u8 reg,
+ 		.len	= len + 1
+ 	};
+ 
++	if (1 + len > sizeof(buffer)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr reg=%04x: len=%d is too big!\n",
++		       KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buffer[0] = reg;
+ 	memcpy(&buffer[1], buf, len);
+ 
+diff --git a/drivers/media/pci/ttpci/av7110_hw.c b/drivers/media/pci/ttpci/av7110_hw.c
+index f1cbfe52..6299d5da 100644
+--- a/drivers/media/pci/ttpci/av7110_hw.c
++++ b/drivers/media/pci/ttpci/av7110_hw.c
+@@ -22,7 +22,7 @@
+  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+  * Or, point your browser to http://www.gnu.org/copyleft/gpl.html
+  *
+- * the project's page is at http://www.linuxtv.org/ 
++ * the project's page is at http://www.linuxtv.org/
+  */
+ 
+ /* for debugging ARM communication: */
+@@ -40,6 +40,14 @@
+ 
+ #define _NOHANDSHAKE
+ 
++/*
++ * Max transfer size done by av7110_fw_cmd()
++ *
++ * The maximum size passed to this function is 6 bytes. The buffer also
++ * uses two additional ones for type and size. So, 8 bytes is enough.
++ */
++#define MAX_XFER_SIZE  8
++
+ /****************************************************************************
+  * DEBI functions
+  ****************************************************************************/
+@@ -488,11 +496,18 @@ static int av7110_send_fw_cmd(struct av7110 *av7110, u16* buf, int length)
+ int av7110_fw_cmd(struct av7110 *av7110, int type, int com, int num, ...)
+ {
+ 	va_list args;
+-	u16 buf[num + 2];
++	u16 buf[MAX_XFER_SIZE];
+ 	int i, ret;
+ 
+ //	dprintk(4, "%p\n", av7110);
+ 
++	if (2 + num > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "%s: %s len=%d is too big!\n",
++		       KBUILD_MODNAME, __func__, num);
++		return -EINVAL;
++	}
++
+ 	buf[0] = ((type << 8) | com);
+ 	buf[1] = num;
+ 
+diff --git a/drivers/media/tuners/e4000.c b/drivers/media/tuners/e4000.c
+index 6c96e489..72971a8d 100644
+--- a/drivers/media/tuners/e4000.c
++++ b/drivers/media/tuners/e4000.c
+@@ -21,20 +21,30 @@
+ #include "e4000_priv.h"
+ #include <linux/math64.h>
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ /* write multiple registers */
+ static int e4000_wr_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[1 + len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->cfg->i2c_addr,
+ 			.flags = 0,
+-			.len = sizeof(buf),
++			.len = 1 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], val, len);
+ 
+@@ -54,7 +64,7 @@ static int e4000_wr_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
+ static int e4000_rd_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[2] = {
+ 		{
+ 			.addr = priv->cfg->i2c_addr,
+@@ -64,11 +74,18 @@ static int e4000_rd_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
+ 		}, {
+ 			.addr = priv->cfg->i2c_addr,
+ 			.flags = I2C_M_RD,
+-			.len = sizeof(buf),
++			.len = len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c rd reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	ret = i2c_transfer(priv->i2c, msg, 2);
+ 	if (ret == 2) {
+ 		memcpy(val, buf, len);
+diff --git a/drivers/media/tuners/fc2580.c b/drivers/media/tuners/fc2580.c
+index 81f38aae..3aecaf46 100644
+--- a/drivers/media/tuners/fc2580.c
++++ b/drivers/media/tuners/fc2580.c
+@@ -20,6 +20,9 @@
+ 
+ #include "fc2580_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ /*
+  * TODO:
+  * I2C write and read works only for one single register. Multiple registers
+@@ -41,16 +44,23 @@
+ static int fc2580_wr_regs(struct fc2580_priv *priv, u8 reg, u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[1 + len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->cfg->i2c_addr,
+ 			.flags = 0,
+-			.len = sizeof(buf),
++			.len = 1 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], val, len);
+ 
+@@ -69,7 +79,7 @@ static int fc2580_wr_regs(struct fc2580_priv *priv, u8 reg, u8 *val, int len)
+ static int fc2580_rd_regs(struct fc2580_priv *priv, u8 reg, u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[2] = {
+ 		{
+ 			.addr = priv->cfg->i2c_addr,
+@@ -79,11 +89,18 @@ static int fc2580_rd_regs(struct fc2580_priv *priv, u8 reg, u8 *val, int len)
+ 		}, {
+ 			.addr = priv->cfg->i2c_addr,
+ 			.flags = I2C_M_RD,
+-			.len = sizeof(buf),
++			.len = len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c rd reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	ret = i2c_transfer(priv->i2c, msg, 2);
+ 	if (ret == 2) {
+ 		memcpy(val, buf, len);
+diff --git a/drivers/media/tuners/tda18212.c b/drivers/media/tuners/tda18212.c
+index e4a84ee2..abe256e1 100644
+--- a/drivers/media/tuners/tda18212.c
++++ b/drivers/media/tuners/tda18212.c
+@@ -20,6 +20,9 @@
+ 
+ #include "tda18212.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ struct tda18212_priv {
+ 	struct tda18212_config *cfg;
+ 	struct i2c_adapter *i2c;
+@@ -32,16 +35,23 @@ static int tda18212_wr_regs(struct tda18212_priv *priv, u8 reg, u8 *val,
+ 	int len)
+ {
+ 	int ret;
+-	u8 buf[len+1];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->cfg->i2c_address,
+ 			.flags = 0,
+-			.len = sizeof(buf),
++			.len = 1 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], val, len);
+ 
+@@ -61,7 +71,7 @@ static int tda18212_rd_regs(struct tda18212_priv *priv, u8 reg, u8 *val,
+ 	int len)
+ {
+ 	int ret;
+-	u8 buf[len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[2] = {
+ 		{
+ 			.addr = priv->cfg->i2c_address,
+@@ -71,11 +81,18 @@ static int tda18212_rd_regs(struct tda18212_priv *priv, u8 reg, u8 *val,
+ 		}, {
+ 			.addr = priv->cfg->i2c_address,
+ 			.flags = I2C_M_RD,
+-			.len = sizeof(buf),
++			.len = len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c rd reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	ret = i2c_transfer(priv->i2c, msg, 2);
+ 	if (ret == 2) {
+ 		memcpy(val, buf, len);
+diff --git a/drivers/media/tuners/tda18218.c b/drivers/media/tuners/tda18218.c
+index 2d31aeb6..9300e936 100644
+--- a/drivers/media/tuners/tda18218.c
++++ b/drivers/media/tuners/tda18218.c
+@@ -20,11 +20,14 @@
+ 
+ #include "tda18218_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ /* write multiple registers */
+ static int tda18218_wr_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
+ {
+ 	int ret = 0, len2, remaining;
+-	u8 buf[1 + len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->cfg->i2c_address,
+@@ -33,6 +36,13 @@ static int tda18218_wr_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	for (remaining = len; remaining > 0;
+ 			remaining -= (priv->cfg->i2c_wr_max - 1)) {
+ 		len2 = remaining;
+@@ -63,7 +73,7 @@ static int tda18218_wr_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
+ static int tda18218_rd_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
+ {
+ 	int ret;
+-	u8 buf[reg+len]; /* we must start read always from reg 0x00 */
++	u8 buf[MAX_XFER_SIZE]; /* we must start read always from reg 0x00 */
+ 	struct i2c_msg msg[2] = {
+ 		{
+ 			.addr = priv->cfg->i2c_address,
+@@ -73,11 +83,18 @@ static int tda18218_rd_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
+ 		}, {
+ 			.addr = priv->cfg->i2c_address,
+ 			.flags = I2C_M_RD,
+-			.len = sizeof(buf),
++			.len = reg + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (reg + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	ret = i2c_transfer(priv->i2c, msg, 2);
+ 	if (ret == 2) {
+ 		memcpy(val, &buf[reg], len);
+diff --git a/drivers/media/tuners/tuner-xc2028.c b/drivers/media/tuners/tuner-xc2028.c
+index 878d2c4d..9771cd83 100644
+--- a/drivers/media/tuners/tuner-xc2028.c
++++ b/drivers/media/tuners/tuner-xc2028.c
+@@ -24,6 +24,9 @@
+ #include <linux/dvb/frontend.h>
+ #include "dvb_frontend.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  80
++
+ /* Registers (Write-only) */
+ #define XREG_INIT         0x00
+ #define XREG_RF_FREQ      0x02
+@@ -547,7 +550,10 @@ static int load_firmware(struct dvb_frontend *fe, unsigned int type,
+ {
+ 	struct xc2028_data *priv = fe->tuner_priv;
+ 	int                pos, rc;
+-	unsigned char      *p, *endp, buf[priv->ctrl.max_len];
++	unsigned char      *p, *endp, buf[MAX_XFER_SIZE];
++
++	if (priv->ctrl.max_len > sizeof(buf))
++		priv->ctrl.max_len = sizeof(buf);
+ 
+ 	tuner_dbg("%s called\n", __func__);
+ 
+diff --git a/drivers/media/usb/dvb-usb-v2/af9015.c b/drivers/media/usb/dvb-usb-v2/af9015.c
+index d556042c..da47d239 100644
+--- a/drivers/media/usb/dvb-usb-v2/af9015.c
++++ b/drivers/media/usb/dvb-usb-v2/af9015.c
+@@ -397,12 +397,13 @@ error:
+ 	return ret;
+ }
+ 
++#define AF9015_EEPROM_SIZE 256
++
+ /* hash (and dump) eeprom */
+ static int af9015_eeprom_hash(struct dvb_usb_device *d)
+ {
+ 	struct af9015_state *state = d_to_priv(d);
+ 	int ret, i;
+-	static const unsigned int AF9015_EEPROM_SIZE = 256;
+ 	u8 buf[AF9015_EEPROM_SIZE];
+ 	struct req_t req = {READ_I2C, AF9015_I2C_EEPROM, 0, 0, 1, 1, NULL};
+ 
+diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
+index 1ea17dc2..c8fcd784 100644
+--- a/drivers/media/usb/dvb-usb-v2/af9035.c
++++ b/drivers/media/usb/dvb-usb-v2/af9035.c
+@@ -21,6 +21,9 @@
+ 
+ #include "af9035.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
+ 
+ static u16 af9035_checksum(const u8 *buf, size_t len)
+@@ -126,10 +129,16 @@ exit:
+ /* write multiple registers */
+ static int af9035_wr_regs(struct dvb_usb_device *d, u32 reg, u8 *val, int len)
+ {
+-	u8 wbuf[6 + len];
++	u8 wbuf[MAX_XFER_SIZE];
+ 	u8 mbox = (reg >> 16) & 0xff;
+ 	struct usb_req req = { CMD_MEM_WR, mbox, sizeof(wbuf), wbuf, 0, NULL };
+ 
++	if (6 + len > sizeof(wbuf)) {
++		dev_warn(&d->udev->dev, "%s: i2c wr: len=%d is too big!\n",
++			 KBUILD_MODNAME, len);
++		return -EOPNOTSUPP;
++	}
++
+ 	wbuf[0] = len;
+ 	wbuf[1] = 2;
+ 	wbuf[2] = 0;
+@@ -228,9 +237,16 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
+ 					msg[1].len);
+ 		} else {
+ 			/* I2C */
+-			u8 buf[5 + msg[0].len];
++			u8 buf[MAX_XFER_SIZE];
+ 			struct usb_req req = { CMD_I2C_RD, 0, sizeof(buf),
+ 					buf, msg[1].len, msg[1].buf };
++
++			if (5 + msg[0].len > sizeof(buf)) {
++				dev_warn(&d->udev->dev,
++					 "%s: i2c xfer: len=%d is too big!\n",
++					 KBUILD_MODNAME, msg[0].len);
++				return -EOPNOTSUPP;
++			}
+ 			req.mbox |= ((msg[0].addr & 0x80)  >>  3);
+ 			buf[0] = msg[1].len;
+ 			buf[1] = msg[0].addr << 1;
+@@ -257,9 +273,16 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
+ 					msg[0].len - 3);
+ 		} else {
+ 			/* I2C */
+-			u8 buf[5 + msg[0].len];
++			u8 buf[MAX_XFER_SIZE];
+ 			struct usb_req req = { CMD_I2C_WR, 0, sizeof(buf), buf,
+ 					0, NULL };
++
++			if (5 + msg[0].len > sizeof(buf)) {
++				dev_warn(&d->udev->dev,
++					 "%s: i2c xfer: len=%d is too big!\n",
++					 KBUILD_MODNAME, msg[0].len);
++				return -EOPNOTSUPP;
++			}
+ 			req.mbox |= ((msg[0].addr & 0x80)  >>  3);
+ 			buf[0] = msg[0].len;
+ 			buf[1] = msg[0].addr << 1;
+diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+index e97964ef..2627553f 100644
+--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
++++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+@@ -23,6 +23,9 @@
+ #include "lgdt3305.h"
+ #include "lg2160.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ int dvb_usb_mxl111sf_debug;
+ module_param_named(debug, dvb_usb_mxl111sf_debug, int, 0644);
+ MODULE_PARM_DESC(debug, "set debugging level "
+@@ -57,7 +60,12 @@ int mxl111sf_ctrl_msg(struct dvb_usb_device *d,
+ {
+ 	int wo = (rbuf == NULL || rlen == 0); /* write-only */
+ 	int ret;
+-	u8 sndbuf[1+wlen];
++	u8 sndbuf[MAX_XFER_SIZE];
++
++	if (1 + wlen > sizeof(sndbuf)) {
++		pr_warn("%s: len=%d is too big!\n", __func__, wlen);
++		return -EOPNOTSUPP;
++	}
+ 
+ 	pr_debug("%s(wlen = %d, rlen = %d)\n", __func__, wlen, rlen);
+ 
+diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
+index 3940bb0f..20e345d9 100644
+--- a/drivers/media/usb/dvb-usb/cxusb.c
++++ b/drivers/media/usb/dvb-usb/cxusb.c
+@@ -43,6 +43,9 @@
+ #include "lgs8gxx.h"
+ #include "atbm8830.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ /* debug */
+ static int dvb_usb_cxusb_debug;
+ module_param_named(debug, dvb_usb_cxusb_debug, int, 0644);
+@@ -57,7 +60,14 @@ static int cxusb_ctrl_msg(struct dvb_usb_device *d,
+ 			  u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
+ {
+ 	int wo = (rbuf == NULL || rlen == 0); /* write-only */
+-	u8 sndbuf[1+wlen];
++	u8 sndbuf[MAX_XFER_SIZE];
++
++	if (1 + wlen > sizeof(sndbuf)) {
++		warn("i2c wr: len=%d is too big!\n",
++		     wlen);
++		return -EOPNOTSUPP;
++	}
++
+ 	memset(sndbuf, 0, 1+wlen);
+ 
+ 	sndbuf[0] = cmd;
+@@ -158,7 +168,13 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 
+ 		if (msg[i].flags & I2C_M_RD) {
+ 			/* read only */
+-			u8 obuf[3], ibuf[1+msg[i].len];
++			u8 obuf[3], ibuf[MAX_XFER_SIZE];
++
++			if (1 + msg[i].len > sizeof(ibuf)) {
++				warn("i2c rd: len=%d is too big!\n",
++				     msg[i].len);
++				return -EOPNOTSUPP;
++			}
+ 			obuf[0] = 0;
+ 			obuf[1] = msg[i].len;
+ 			obuf[2] = msg[i].addr;
+@@ -172,7 +188,18 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 		} else if (i+1 < num && (msg[i+1].flags & I2C_M_RD) &&
+ 			   msg[i].addr == msg[i+1].addr) {
+ 			/* write to then read from same address */
+-			u8 obuf[3+msg[i].len], ibuf[1+msg[i+1].len];
++			u8 obuf[MAX_XFER_SIZE], ibuf[MAX_XFER_SIZE];
++
++			if (3 + msg[i].len > sizeof(obuf)) {
++				warn("i2c wr: len=%d is too big!\n",
++				     msg[i].len);
++				return -EOPNOTSUPP;
++			}
++			if (1 + msg[i + 1].len > sizeof(ibuf)) {
++				warn("i2c rd: len=%d is too big!\n",
++				     msg[i + 1].len);
++				return -EOPNOTSUPP;
++			}
+ 			obuf[0] = msg[i].len;
+ 			obuf[1] = msg[i+1].len;
+ 			obuf[2] = msg[i].addr;
+@@ -191,7 +218,13 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 			i++;
+ 		} else {
+ 			/* write only */
+-			u8 obuf[2+msg[i].len], ibuf;
++			u8 obuf[MAX_XFER_SIZE], ibuf;
++
++			if (2 + msg[i].len > sizeof(obuf)) {
++				warn("i2c wr: len=%d is too big!\n",
++				     msg[i].len);
++				return -EOPNOTSUPP;
++			}
+ 			obuf[0] = msg[i].addr;
+ 			obuf[1] = msg[i].len;
+ 			memcpy(&obuf[2], msg[i].buf, msg[i].len);
+diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c
+index c2dded92..6d68af0c 100644
+--- a/drivers/media/usb/dvb-usb/dibusb-common.c
++++ b/drivers/media/usb/dvb-usb/dibusb-common.c
+@@ -12,6 +12,9 @@
+ #include <linux/kconfig.h>
+ #include "dibusb.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static int debug;
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "set debugging level (1=info (|-able))." DVB_USB_DEBUG_STATUS);
+@@ -105,11 +108,16 @@ EXPORT_SYMBOL(dibusb2_0_power_ctrl);
+ static int dibusb_i2c_msg(struct dvb_usb_device *d, u8 addr,
+ 			  u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen)
+ {
+-	u8 sndbuf[wlen+4]; /* lead(1) devaddr,direction(1) addr(2) data(wlen) (len(2) (when reading)) */
++	u8 sndbuf[MAX_XFER_SIZE]; /* lead(1) devaddr,direction(1) addr(2) data(wlen) (len(2) (when reading)) */
+ 	/* write only ? */
+ 	int wo = (rbuf == NULL || rlen == 0),
+ 		len = 2 + wlen + (wo ? 0 : 2);
+ 
++	if (4 + wlen > sizeof(sndbuf)) {
++		warn("i2c wr: len=%d is too big!\n", wlen);
++		return -EOPNOTSUPP;
++	}
++
+ 	sndbuf[0] = wo ? DIBUSB_REQ_I2C_WRITE : DIBUSB_REQ_I2C_READ;
+ 	sndbuf[1] = (addr << 1) | (wo ? 0 : 1);
+ 
+diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
+index 6e237b6d..71b22f5a 100644
+--- a/drivers/media/usb/dvb-usb/dw2102.c
++++ b/drivers/media/usb/dvb-usb/dw2102.c
+@@ -30,6 +30,9 @@
+ #include "stb6100_proc.h"
+ #include "m88rs2000.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ #ifndef USB_PID_DW2102
+ #define USB_PID_DW2102 0x2102
+ #endif
+@@ -308,7 +311,14 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
+ 	case 2: {
+ 		/* read */
+ 		/* first write first register number */
+-		u8 ibuf[msg[1].len + 2], obuf[3];
++		u8 ibuf[MAX_XFER_SIZE], obuf[3];
++
++		if (2 + msg[1].len > sizeof(ibuf)) {
++			warn("i2c rd: len=%d is too big!\n",
++			     msg[1].len);
++			return -EOPNOTSUPP;
++		}
++
+ 		obuf[0] = msg[0].addr << 1;
+ 		obuf[1] = msg[0].len;
+ 		obuf[2] = msg[0].buf[0];
+@@ -325,7 +335,14 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
+ 		switch (msg[0].addr) {
+ 		case 0x68: {
+ 			/* write to register */
+-			u8 obuf[msg[0].len + 2];
++			u8 obuf[MAX_XFER_SIZE];
++
++			if (2 + msg[0].len > sizeof(obuf)) {
++				warn("i2c wr: len=%d is too big!\n",
++				     msg[1].len);
++				return -EOPNOTSUPP;
++			}
++
+ 			obuf[0] = msg[0].addr << 1;
+ 			obuf[1] = msg[0].len;
+ 			memcpy(obuf + 2, msg[0].buf, msg[0].len);
+@@ -335,7 +352,14 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
+ 		}
+ 		case 0x61: {
+ 			/* write to tuner */
+-			u8 obuf[msg[0].len + 2];
++			u8 obuf[MAX_XFER_SIZE];
++
++			if (2 + msg[0].len > sizeof(obuf)) {
++				warn("i2c wr: len=%d is too big!\n",
++				     msg[1].len);
++				return -EOPNOTSUPP;
++			}
++
+ 			obuf[0] = msg[0].addr << 1;
+ 			obuf[1] = msg[0].len;
+ 			memcpy(obuf + 2, msg[0].buf, msg[0].len);
+@@ -401,7 +425,14 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i
+ 		default: {
+ 			if (msg[j].flags == I2C_M_RD) {
+ 				/* read registers */
+-				u8  ibuf[msg[j].len + 2];
++				u8  ibuf[MAX_XFER_SIZE];
++
++				if (2 + msg[j].len > sizeof(ibuf)) {
++					warn("i2c rd: len=%d is too big!\n",
++					     msg[j].len);
++					return -EOPNOTSUPP;
++				}
++
+ 				dw210x_op_rw(d->udev, 0xc3,
+ 						(msg[j].addr << 1) + 1, 0,
+ 						ibuf, msg[j].len + 2,
+@@ -430,7 +461,14 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i
+ 				} while (len > 0);
+ 			} else {
+ 				/* write registers */
+-				u8 obuf[msg[j].len + 2];
++				u8 obuf[MAX_XFER_SIZE];
++
++				if (2 + msg[j].len > sizeof(obuf)) {
++					warn("i2c wr: len=%d is too big!\n",
++					     msg[j].len);
++					return -EOPNOTSUPP;
++				}
++
+ 				obuf[0] = msg[j].addr << 1;
+ 				obuf[1] = msg[j].len;
+ 				memcpy(obuf + 2, msg[j].buf, msg[j].len);
+@@ -463,7 +501,13 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 	case 2: {
+ 		/* read */
+ 		/* first write first register number */
+-		u8 ibuf[msg[1].len + 2], obuf[3];
++		u8 ibuf[MAX_XFER_SIZE], obuf[3];
++
++		if (2 + msg[1].len > sizeof(ibuf)) {
++			warn("i2c rd: len=%d is too big!\n",
++			     msg[1].len);
++			return -EOPNOTSUPP;
++		}
+ 		obuf[0] = msg[0].addr << 1;
+ 		obuf[1] = msg[0].len;
+ 		obuf[2] = msg[0].buf[0];
+@@ -481,7 +525,13 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 		case 0x60:
+ 		case 0x0c: {
+ 			/* write to register */
+-			u8 obuf[msg[0].len + 2];
++			u8 obuf[MAX_XFER_SIZE];
++
++			if (2 + msg[0].len > sizeof(obuf)) {
++				warn("i2c wr: len=%d is too big!\n",
++				     msg[0].len);
++				return -EOPNOTSUPP;
++			}
+ 			obuf[0] = msg[0].addr << 1;
+ 			obuf[1] = msg[0].len;
+ 			memcpy(obuf + 2, msg[0].buf, msg[0].len);
+@@ -563,7 +613,14 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 		default: {
+ 			if (msg[j].flags == I2C_M_RD) {
+ 				/* read registers */
+-				u8 ibuf[msg[j].len];
++				u8 ibuf[MAX_XFER_SIZE];
++
++				if (msg[j].len > sizeof(ibuf)) {
++					warn("i2c rd: len=%d is too big!\n",
++					     msg[j].len);
++					return -EOPNOTSUPP;
++				}
++
+ 				dw210x_op_rw(d->udev, 0x91, 0, 0,
+ 						ibuf, msg[j].len,
+ 						DW210X_READ_MSG);
+@@ -590,7 +647,14 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 				} while (len > 0);
+ 			} else if (j < (num - 1)) {
+ 				/* write register addr before read */
+-				u8 obuf[msg[j].len + 2];
++				u8 obuf[MAX_XFER_SIZE];
++
++				if (2 + msg[j].len > sizeof(obuf)) {
++					warn("i2c wr: len=%d is too big!\n",
++					     msg[j].len);
++					return -EOPNOTSUPP;
++				}
++
+ 				obuf[0] = msg[j + 1].len;
+ 				obuf[1] = (msg[j].addr << 1);
+ 				memcpy(obuf + 2, msg[j].buf, msg[j].len);
+@@ -602,7 +666,13 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 				break;
+ 			} else {
+ 				/* write registers */
+-				u8 obuf[msg[j].len + 2];
++				u8 obuf[MAX_XFER_SIZE];
++
++				if (2 + msg[j].len > sizeof(obuf)) {
++					warn("i2c wr: len=%d is too big!\n",
++					     msg[j].len);
++					return -EOPNOTSUPP;
++				}
+ 				obuf[0] = msg[j].len + 1;
+ 				obuf[1] = (msg[j].addr << 1);
+ 				memcpy(obuf + 2, msg[j].buf, msg[j].len);
+diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
+index c85d69da..85a6a341 100644
+--- a/drivers/media/v4l2-core/v4l2-async.c
++++ b/drivers/media/v4l2-core/v4l2-async.c
+@@ -189,30 +189,53 @@ void v4l2_async_notifier_unregister(struct v4l2_async_notifier *notifier)
+ 	struct v4l2_subdev *sd, *tmp;
+ 	unsigned int notif_n_subdev = notifier->num_subdevs;
+ 	unsigned int n_subdev = min(notif_n_subdev, V4L2_MAX_SUBDEVS);
+-	struct device *dev[n_subdev];
++	struct device **dev;
+ 	int i = 0;
+ 
+ 	if (!notifier->v4l2_dev)
+ 		return;
+ 
++	dev = kmalloc(n_subdev * sizeof(*dev), GFP_KERNEL);
++	if (!dev) {
++		dev_err(notifier->v4l2_dev->dev,
++			"Failed to allocate device cache!\n");
++	}
++
+ 	mutex_lock(&list_lock);
+ 
+ 	list_del(&notifier->list);
+ 
+ 	list_for_each_entry_safe(sd, tmp, &notifier->done, async_list) {
+-		dev[i] = get_device(sd->dev);
++		struct device *d;
++
++		d = get_device(sd->dev);
+ 
+ 		v4l2_async_cleanup(sd);
+ 
+ 		/* If we handled USB devices, we'd have to lock the parent too */
+-		device_release_driver(dev[i++]);
++		device_release_driver(d);
+ 
+ 		if (notifier->unbind)
+ 			notifier->unbind(notifier, sd, sd->asd);
++
++		/*
++		 * Store device at the device cache, in order to call
++		 * put_device() on the final step
++		 */
++		if (dev)
++			dev[i++] = d;
++		else
++			put_device(d);
+ 	}
+ 
+ 	mutex_unlock(&list_lock);
+ 
++	/*
++	 * Call device_attach() to reprobe devices
++	 *
++	 * NOTE: If dev allocation fails, i is 0, and the whole loop won't be
++	 * executed.
++	 */
+ 	while (i--) {
+ 		struct device *d = dev[i];
+ 
+@@ -228,6 +251,7 @@ void v4l2_async_notifier_unregister(struct v4l2_async_notifier *notifier)
+ 		}
+ 		put_device(d);
+ 	}
++	kfree(dev);
+ 
+ 	notifier->v4l2_dev = NULL;
+ 
+diff --git a/drivers/mfd/lpc_ich.c b/drivers/mfd/lpc_ich.c
+index 9483bc84..e775bfbc 100644
+--- a/drivers/mfd/lpc_ich.c
++++ b/drivers/mfd/lpc_ich.c
+@@ -53,6 +53,7 @@
+  *	document number TBD : Wellsburg
+  *	document number TBD : Avoton SoC
+  *	document number TBD : Coleto Creek
++ *	document number TBD : Wildcat Point-LP
+  */
+ 
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+@@ -211,6 +212,7 @@ enum lpc_chipsets {
+ 	LPC_WBG,	/* Wellsburg */
+ 	LPC_AVN,	/* Avoton SoC */
+ 	LPC_COLETO,	/* Coleto Creek */
++	LPC_WPT_LP,	/* Wildcat Point-LP */
+ };
+ 
+ static struct lpc_ich_info lpc_chipset_info[] = {
+@@ -503,6 +505,10 @@ static struct lpc_ich_info lpc_chipset_info[] = {
+ 		.name = "Coleto Creek",
+ 		.iTCO_version = 2,
+ 	},
++	[LPC_WPT_LP] = {
++		.name = "Lynx Point_LP",
++		.iTCO_version = 2,
++	},
+ };
+ 
+ /*
+@@ -721,6 +727,13 @@ static DEFINE_PCI_DEVICE_TABLE(lpc_ich_ids) = {
+ 	{ PCI_VDEVICE(INTEL, 0x1f3a), LPC_AVN},
+ 	{ PCI_VDEVICE(INTEL, 0x1f3b), LPC_AVN},
+ 	{ PCI_VDEVICE(INTEL, 0x2390), LPC_COLETO},
++	{ PCI_VDEVICE(INTEL, 0x9cc1), LPC_WPT_LP},
++	{ PCI_VDEVICE(INTEL, 0x9cc2), LPC_WPT_LP},
++	{ PCI_VDEVICE(INTEL, 0x9cc3), LPC_WPT_LP},
++	{ PCI_VDEVICE(INTEL, 0x9cc5), LPC_WPT_LP},
++	{ PCI_VDEVICE(INTEL, 0x9cc6), LPC_WPT_LP},
++	{ PCI_VDEVICE(INTEL, 0x9cc7), LPC_WPT_LP},
++	{ PCI_VDEVICE(INTEL, 0x9cc9), LPC_WPT_LP},
+ 	{ 0, },			/* End of list */
+ };
+ MODULE_DEVICE_TABLE(pci, lpc_ich_ids);
+diff --git a/drivers/mfd/rts5249.c b/drivers/mfd/rts5249.c
+index 3b835f59..573de7bf 100644
+--- a/drivers/mfd/rts5249.c
++++ b/drivers/mfd/rts5249.c
+@@ -130,13 +130,57 @@ static int rts5249_optimize_phy(struct rtsx_pcr *pcr)
+ {
+ 	int err;
+ 
+-	err = rtsx_pci_write_phy_register(pcr, PHY_REG_REV, 0xFE46);
++	err = rtsx_pci_write_phy_register(pcr, PHY_REG_REV,
++			PHY_REG_REV_RESV | PHY_REG_REV_RXIDLE_LATCHED |
++			PHY_REG_REV_P1_EN | PHY_REG_REV_RXIDLE_EN |
++			PHY_REG_REV_RX_PWST | PHY_REG_REV_CLKREQ_DLY_TIMER_1_0 |
++			PHY_REG_REV_STOP_CLKRD | PHY_REG_REV_STOP_CLKWR);
+ 	if (err < 0)
+ 		return err;
+ 
+ 	msleep(1);
+ 
+-	return rtsx_pci_write_phy_register(pcr, PHY_BPCR, 0x05C0);
++	err = rtsx_pci_write_phy_register(pcr, PHY_BPCR,
++			PHY_BPCR_IBRXSEL | PHY_BPCR_IBTXSEL |
++			PHY_BPCR_IB_FILTER | PHY_BPCR_CMIRROR_EN);
++	if (err < 0)
++		return err;
++	err = rtsx_pci_write_phy_register(pcr, PHY_PCR,
++			PHY_PCR_FORCE_CODE | PHY_PCR_OOBS_CALI_50 |
++			PHY_PCR_OOBS_VCM_08 | PHY_PCR_OOBS_SEN_90 |
++			PHY_PCR_RSSI_EN);
++	if (err < 0)
++		return err;
++	err = rtsx_pci_write_phy_register(pcr, PHY_RCR2,
++			PHY_RCR2_EMPHASE_EN | PHY_RCR2_NADJR |
++			PHY_RCR2_CDR_CP_10 | PHY_RCR2_CDR_SR_2 |
++			PHY_RCR2_FREQSEL_12 | PHY_RCR2_CPADJEN |
++			PHY_RCR2_CDR_SC_8 | PHY_RCR2_CALIB_LATE);
++	if (err < 0)
++		return err;
++	err = rtsx_pci_write_phy_register(pcr, PHY_FLD4,
++			PHY_FLD4_FLDEN_SEL | PHY_FLD4_REQ_REF |
++			PHY_FLD4_RXAMP_OFF | PHY_FLD4_REQ_ADDA |
++			PHY_FLD4_BER_COUNT | PHY_FLD4_BER_TIMER |
++			PHY_FLD4_BER_CHK_EN);
++	if (err < 0)
++		return err;
++	err = rtsx_pci_write_phy_register(pcr, PHY_RDR, PHY_RDR_RXDSEL_1_9);
++	if (err < 0)
++		return err;
++	err = rtsx_pci_write_phy_register(pcr, PHY_RCR1,
++			PHY_RCR1_ADP_TIME | PHY_RCR1_VCO_COARSE);
++	if (err < 0)
++		return err;
++	err = rtsx_pci_write_phy_register(pcr, PHY_FLD3,
++			PHY_FLD3_TIMER_4 | PHY_FLD3_TIMER_6 |
++			PHY_FLD3_RXDELINK);
++	if (err < 0)
++		return err;
++	return rtsx_pci_write_phy_register(pcr, PHY_TUNE,
++			PHY_TUNE_TUNEREF_1_0 | PHY_TUNE_VBGSEL_1252 |
++			PHY_TUNE_SDBUS_33 | PHY_TUNE_TUNED18 |
++			PHY_TUNE_TUNED12);
+ }
+ 
+ static int rts5249_turn_on_led(struct rtsx_pcr *pcr)
+diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
+index 69e438ee..92c18779 100644
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -589,6 +589,13 @@ static void atmci_timeout_timer(unsigned long data)
+ 	if (host->mrq->cmd->data) {
+ 		host->mrq->cmd->data->error = -ETIMEDOUT;
+ 		host->data = NULL;
++		/*
++		 * With some SDIO modules, sometimes DMA transfer hangs. If
++		 * stop_transfer() is not called then the DMA request is not
++		 * removed, following ones are queued and never computed.
++		 */
++		if (host->state == STATE_DATA_XFER)
++			host->stop_transfer(host);
+ 	} else {
+ 		host->mrq->cmd->error = -ETIMEDOUT;
+ 		host->cmd = NULL;
+@@ -1803,12 +1810,14 @@ static void atmci_tasklet_func(unsigned long priv)
+ 			if (unlikely(status)) {
+ 				host->stop_transfer(host);
+ 				host->data = NULL;
+-				if (status & ATMCI_DTOE) {
+-					data->error = -ETIMEDOUT;
+-				} else if (status & ATMCI_DCRCE) {
+-					data->error = -EILSEQ;
+-				} else {
+-					data->error = -EIO;
++				if (data) {
++					if (status & ATMCI_DTOE) {
++						data->error = -ETIMEDOUT;
++					} else if (status & ATMCI_DCRCE) {
++						data->error = -EILSEQ;
++					} else {
++						data->error = -EIO;
++					}
+ 				}
+ 			}
+ 
+diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
+index 6bc9618a..f111f04f 100644
+--- a/drivers/mtd/devices/m25p80.c
++++ b/drivers/mtd/devices/m25p80.c
+@@ -78,7 +78,7 @@
+ 
+ /* Define max times to check status register before we give up. */
+ #define	MAX_READY_WAIT_JIFFIES	(40 * HZ)	/* M25P16 specs 40s max chip erase */
+-#define	MAX_CMD_SIZE		5
++#define	MAX_CMD_SIZE		6
+ 
+ #define JEDEC_MFR(_jedec_id)	((_jedec_id) >> 16)
+ 
+@@ -992,15 +992,13 @@ static int m25p_probe(struct spi_device *spi)
+ 		}
+ 	}
+ 
+-	flash = kzalloc(sizeof *flash, GFP_KERNEL);
++	flash = devm_kzalloc(&spi->dev, sizeof(*flash), GFP_KERNEL);
+ 	if (!flash)
+ 		return -ENOMEM;
+-	flash->command = kmalloc(MAX_CMD_SIZE + (flash->fast_read ? 1 : 0),
+-					GFP_KERNEL);
+-	if (!flash->command) {
+-		kfree(flash);
++
++	flash->command = devm_kzalloc(&spi->dev, MAX_CMD_SIZE, GFP_KERNEL);
++	if (!flash->command)
+ 		return -ENOMEM;
+-	}
+ 
+ 	flash->spi = spi;
+ 	mutex_init(&flash->lock);
+@@ -1133,14 +1131,10 @@ static int m25p_probe(struct spi_device *spi)
+ static int m25p_remove(struct spi_device *spi)
+ {
+ 	struct m25p	*flash = spi_get_drvdata(spi);
+-	int		status;
+ 
+ 	/* Clean up MTD stuff. */
+-	status = mtd_device_unregister(&flash->mtd);
+-	if (status == 0) {
+-		kfree(flash->command);
+-		kfree(flash);
+-	}
++	mtd_device_unregister(&flash->mtd);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c
+index 060feeaf..9be07922 100644
+--- a/drivers/mtd/nand/atmel_nand.c
++++ b/drivers/mtd/nand/atmel_nand.c
+@@ -2177,7 +2177,6 @@ err_no_card:
+ 	if (host->dma_chan)
+ 		dma_release_channel(host->dma_chan);
+ err_nand_ioremap:
+-	platform_driver_unregister(&atmel_nand_nfc_driver);
+ 	return res;
+ }
+ 
+diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+index a9830ff8..a9260178 100644
+--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+@@ -392,8 +392,6 @@ static void dma_irq_callback(void *param)
+ 	struct gpmi_nand_data *this = param;
+ 	struct completion *dma_c = &this->dma_done;
+ 
+-	complete(dma_c);
+-
+ 	switch (this->dma_type) {
+ 	case DMA_FOR_COMMAND:
+ 		dma_unmap_sg(this->dev, &this->cmd_sgl, 1, DMA_TO_DEVICE);
+@@ -418,6 +416,8 @@ static void dma_irq_callback(void *param)
+ 	default:
+ 		pr_err("in wrong DMA operation.\n");
+ 	}
++
++	complete(dma_c);
+ }
+ 
+ int start_dma_without_bch_irq(struct gpmi_nand_data *this,
+@@ -1568,8 +1568,6 @@ static int gpmi_set_geometry(struct gpmi_nand_data *this)
+ 
+ static int gpmi_pre_bbt_scan(struct gpmi_nand_data  *this)
+ {
+-	int ret;
+-
+ 	/* Set up swap_block_mark, must be set before the gpmi_set_geometry() */
+ 	if (GPMI_IS_MX23(this))
+ 		this->swap_block_mark = false;
+@@ -1577,12 +1575,8 @@ static int gpmi_pre_bbt_scan(struct gpmi_nand_data  *this)
+ 		this->swap_block_mark = true;
+ 
+ 	/* Set up the medium geometry */
+-	ret = gpmi_set_geometry(this);
+-	if (ret)
+-		return ret;
++	return gpmi_set_geometry(this);
+ 
+-	/* NAND boot init, depends on the gpmi_set_geometry(). */
+-	return nand_boot_init(this);
+ }
+ 
+ static void gpmi_nfc_exit(struct gpmi_nand_data *this)
+@@ -1672,10 +1666,16 @@ static int gpmi_nfc_init(struct gpmi_nand_data *this)
+ 	if (ret)
+ 		goto err_out;
+ 
++	chip->options |= NAND_SKIP_BBTSCAN;
+ 	ret = nand_scan_tail(mtd);
+ 	if (ret)
+ 		goto err_out;
+ 
++	ret = nand_boot_init(this);
++	if (ret)
++		goto err_out;
++	chip->scan_bbt(mtd);
++
+ 	ppdata.of_node = this->pdev->dev.of_node;
+ 	ret = mtd_device_parse_register(mtd, NULL, &ppdata, NULL, 0);
+ 	if (ret)
+diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
+index d340b2f1..d92d94bb 100644
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -2981,10 +2981,21 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
+ 	sanitize_string(p->model, sizeof(p->model));
+ 	if (!mtd->name)
+ 		mtd->name = p->model;
++
+ 	mtd->writesize = le32_to_cpu(p->byte_per_page);
+-	mtd->erasesize = le32_to_cpu(p->pages_per_block) * mtd->writesize;
++
++	/*
++	 * pages_per_block and blocks_per_lun may not be a power-of-2 size
++	 * (don't ask me who thought of this...). MTD assumes that these
++	 * dimensions will be power-of-2, so just truncate the remaining area.
++	 */
++	mtd->erasesize = 1 << (fls(le32_to_cpu(p->pages_per_block)) - 1);
++	mtd->erasesize *= mtd->writesize;
++
+ 	mtd->oobsize = le16_to_cpu(p->spare_bytes_per_page);
+-	chip->chipsize = le32_to_cpu(p->blocks_per_lun);
++
++	/* See erasesize comment */
++	chip->chipsize = 1 << (fls(le32_to_cpu(p->blocks_per_lun)) - 1);
+ 	chip->chipsize *= (uint64_t)mtd->erasesize * p->lun_count;
+ 
+ 	if (onfi_feature(chip) & ONFI_FEATURE_16_BIT_BUS)
+diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
+index 48161ede..69f58b07 100644
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -1663,15 +1663,15 @@ ath5k_tx_frame_completed(struct ath5k_hw *ah, struct sk_buff *skb,
+ 	ah->stats.tx_bytes_count += skb->len;
+ 	info = IEEE80211_SKB_CB(skb);
+ 
++	size = min_t(int, sizeof(info->status.rates), sizeof(bf->rates));
++	memcpy(info->status.rates, bf->rates, size);
++
+ 	tries[0] = info->status.rates[0].count;
+ 	tries[1] = info->status.rates[1].count;
+ 	tries[2] = info->status.rates[2].count;
+ 
+ 	ieee80211_tx_info_clear_status(info);
+ 
+-	size = min_t(int, sizeof(info->status.rates), sizeof(bf->rates));
+-	memcpy(info->status.rates, bf->rates, size);
+-
+ 	for (i = 0; i < ts->ts_final_idx; i++) {
+ 		struct ieee80211_tx_rate *r =
+ 			&info->status.rates[i];
+diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
+index 1576104e..9bf88987 100644
+--- a/drivers/net/wireless/mwifiex/sdio.c
++++ b/drivers/net/wireless/mwifiex/sdio.c
+@@ -1029,7 +1029,10 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
+ 				    struct sk_buff *skb, u32 upld_typ)
+ {
+ 	u8 *cmd_buf;
++	__le16 *curr_ptr = (__le16 *)skb->data;
++	u16 pkt_len = le16_to_cpu(*curr_ptr);
+ 
++	skb_trim(skb, pkt_len);
+ 	skb_pull(skb, INTF_HEADER_LEN);
+ 
+ 	switch (upld_typ) {
+diff --git a/drivers/net/wireless/mwifiex/uap_txrx.c b/drivers/net/wireless/mwifiex/uap_txrx.c
+index 1cfe5a73..92f76d65 100644
+--- a/drivers/net/wireless/mwifiex/uap_txrx.c
++++ b/drivers/net/wireless/mwifiex/uap_txrx.c
+@@ -97,6 +97,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
+ 	struct mwifiex_txinfo *tx_info;
+ 	int hdr_chop;
+ 	struct timeval tv;
++	struct ethhdr *p_ethhdr;
+ 	u8 rfc1042_eth_hdr[ETH_ALEN] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
+ 
+ 	uap_rx_pd = (struct uap_rxpd *)(skb->data);
+@@ -112,14 +113,36 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
+ 	}
+ 
+ 	if (!memcmp(&rx_pkt_hdr->rfc1042_hdr,
+-		    rfc1042_eth_hdr, sizeof(rfc1042_eth_hdr)))
++		    rfc1042_eth_hdr, sizeof(rfc1042_eth_hdr))) {
++		/* Replace the 803 header and rfc1042 header (llc/snap) with
++		 * an Ethernet II header, keep the src/dst and snap_type
++		 * (ethertype).
++		 *
++		 * The firmware only passes up SNAP frames converting all RX
++		 * data from 802.11 to 802.2/LLC/SNAP frames.
++		 *
++		 * To create the Ethernet II, just move the src, dst address
++		 * right before the snap_type.
++		 */
++		p_ethhdr = (struct ethhdr *)
++			((u8 *)(&rx_pkt_hdr->eth803_hdr)
++			 + sizeof(rx_pkt_hdr->eth803_hdr)
++			 + sizeof(rx_pkt_hdr->rfc1042_hdr)
++			 - sizeof(rx_pkt_hdr->eth803_hdr.h_dest)
++			 - sizeof(rx_pkt_hdr->eth803_hdr.h_source)
++			 - sizeof(rx_pkt_hdr->rfc1042_hdr.snap_type));
++		memcpy(p_ethhdr->h_source, rx_pkt_hdr->eth803_hdr.h_source,
++		       sizeof(p_ethhdr->h_source));
++		memcpy(p_ethhdr->h_dest, rx_pkt_hdr->eth803_hdr.h_dest,
++		       sizeof(p_ethhdr->h_dest));
+ 		/* Chop off the rxpd + the excess memory from
+ 		 * 802.2/llc/snap header that was removed.
+ 		 */
+-		hdr_chop = (u8 *)eth_hdr - (u8 *)uap_rx_pd;
+-	else
++		hdr_chop = (u8 *)p_ethhdr - (u8 *)uap_rx_pd;
++	} else {
+ 		/* Chop off the rxpd */
+ 		hdr_chop = (u8 *)&rx_pkt_hdr->eth803_hdr - (u8 *)uap_rx_pd;
++	}
+ 
+ 	/* Chop off the leading header bytes so the it points
+ 	 * to the start of either the reconstructed EthII frame
+diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
+index 5970ff6f..d498b02f 100644
+--- a/drivers/net/wireless/prism54/islpci_dev.c
++++ b/drivers/net/wireless/prism54/islpci_dev.c
+@@ -811,6 +811,10 @@ static const struct net_device_ops islpci_netdev_ops = {
+ 	.ndo_validate_addr	= eth_validate_addr,
+ };
+ 
++static struct device_type wlan_type = {
++	.name	= "wlan",
++};
++
+ struct net_device *
+ islpci_setup(struct pci_dev *pdev)
+ {
+@@ -821,9 +825,8 @@ islpci_setup(struct pci_dev *pdev)
+ 		return ndev;
+ 
+ 	pci_set_drvdata(pdev, ndev);
+-#if defined(SET_NETDEV_DEV)
+ 	SET_NETDEV_DEV(ndev, &pdev->dev);
+-#endif
++	SET_NETDEV_DEVTYPE(ndev, &wlan_type);
+ 
+ 	/* setup the structure members */
+ 	ndev->base_addr = pci_resource_start(pdev, 0);
+diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
+index 3d53a09d..38ed9a3e 100644
+--- a/drivers/net/wireless/rt2x00/rt2400pci.c
++++ b/drivers/net/wireless/rt2x00/rt2400pci.c
+@@ -1261,7 +1261,7 @@ static void rt2400pci_fill_rxdone(struct queue_entry *entry,
+ 	 */
+ 	rxdesc->timestamp = ((u64)rx_high << 32) | rx_low;
+ 	rxdesc->signal = rt2x00_get_field32(word2, RXD_W2_SIGNAL) & ~0x08;
+-	rxdesc->rssi = rt2x00_get_field32(word2, RXD_W3_RSSI) -
++	rxdesc->rssi = rt2x00_get_field32(word3, RXD_W3_RSSI) -
+ 	    entry->queue->rt2x00dev->rssi_offset;
+ 	rxdesc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
+ 
+diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
+index 8bb4a9a0..9fa90a25 100644
+--- a/drivers/net/wireless/rtlwifi/base.c
++++ b/drivers/net/wireless/rtlwifi/base.c
+@@ -37,6 +37,7 @@
+ 
+ #include <linux/ip.h>
+ #include <linux/module.h>
++#include <linux/udp.h>
+ 
+ /*
+  *NOTICE!!!: This file will be very big, we should
+@@ -1074,64 +1075,52 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
+ 	if (!ieee80211_is_data(fc))
+ 		return false;
+ 
++	ip = (const struct iphdr *)(skb->data + mac_hdr_len +
++				    SNAP_SIZE + PROTOC_TYPE_SIZE);
++	ether_type = be16_to_cpup((__be16 *)
++				  (skb->data + mac_hdr_len + SNAP_SIZE));
+ 
+-	ip = (struct iphdr *)((u8 *) skb->data + mac_hdr_len +
+-			      SNAP_SIZE + PROTOC_TYPE_SIZE);
+-	ether_type = *(u16 *) ((u8 *) skb->data + mac_hdr_len + SNAP_SIZE);
+-	/*	ether_type = ntohs(ether_type); */
+-
+-	if (ETH_P_IP == ether_type) {
+-		if (IPPROTO_UDP == ip->protocol) {
+-			struct udphdr *udp = (struct udphdr *)((u8 *) ip +
+-							       (ip->ihl << 2));
+-			if (((((u8 *) udp)[1] == 68) &&
+-			     (((u8 *) udp)[3] == 67)) ||
+-			    ((((u8 *) udp)[1] == 67) &&
+-			     (((u8 *) udp)[3] == 68))) {
+-				/*
+-				 * 68 : UDP BOOTP client
+-				 * 67 : UDP BOOTP server
+-				 */
+-				RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV),
+-					 DBG_DMESG, "dhcp %s !!\n",
+-					 is_tx ? "Tx" : "Rx");
+-
+-				if (is_tx) {
+-					rtlpriv->enter_ps = false;
+-					schedule_work(&rtlpriv->
+-						      works.lps_change_work);
+-					ppsc->last_delaylps_stamp_jiffies =
+-					    jiffies;
+-				}
++	switch (ether_type) {
++	case ETH_P_IP: {
++		struct udphdr *udp;
++		u16 src;
++		u16 dst;
+ 
+-				return true;
+-			}
+-		}
+-	} else if (ETH_P_ARP == ether_type) {
+-		if (is_tx) {
+-			rtlpriv->enter_ps = false;
+-			schedule_work(&rtlpriv->works.lps_change_work);
+-			ppsc->last_delaylps_stamp_jiffies = jiffies;
+-		}
++		if (ip->protocol != IPPROTO_UDP)
++			return false;
++		udp = (struct udphdr *)((u8 *)ip + (ip->ihl << 2));
++		src = be16_to_cpu(udp->source);
++		dst = be16_to_cpu(udp->dest);
+ 
+-		return true;
+-	} else if (ETH_P_PAE == ether_type) {
++		/* If this case involves port 68 (UDP BOOTP client) connecting
++		 * with port 67 (UDP BOOTP server), then return true so that
++		 * the lowest speed is used.
++		 */
++		if (!((src == 68 && dst == 67) || (src == 67 && dst == 68)))
++			return false;
++
++		RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
++			 "dhcp %s !!\n", is_tx ? "Tx" : "Rx");
++		break;
++	}
++	case ETH_P_ARP:
++		break;
++	case ETH_P_PAE:
+ 		RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+ 			 "802.1X %s EAPOL pkt!!\n", is_tx ? "Tx" : "Rx");
+-
+-		if (is_tx) {
+-			rtlpriv->enter_ps = false;
+-			schedule_work(&rtlpriv->works.lps_change_work);
+-			ppsc->last_delaylps_stamp_jiffies = jiffies;
+-		}
+-
+-		return true;
+-	} else if (ETH_P_IPV6 == ether_type) {
+-		/* IPv6 */
+-		return true;
++		break;
++	case ETH_P_IPV6:
++		/* TODO: Is this right? */
++		return false;
++	default:
++		return false;
+ 	}
+-
+-	return false;
++	if (is_tx) {
++		rtlpriv->enter_ps = false;
++		schedule_work(&rtlpriv->works.lps_change_work);
++		ppsc->last_delaylps_stamp_jiffies = jiffies;
++	}
++	return true;
+ }
+ EXPORT_SYMBOL_GPL(rtl_is_special_data);
+ 
+diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
+index b68cae30..e06971be 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
+@@ -143,6 +143,7 @@ static void _rtl88ee_set_fw_clock_on(struct ieee80211_hw *hw,
+ 		} else {
+ 			rtlhal->fw_clk_change_in_progress = false;
+ 			spin_unlock_bh(&rtlpriv->locks.fw_ps_lock);
++			break;
+ 		}
+ 	}
+ 
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
+index da4f5871..2c68c138 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
+@@ -778,7 +778,7 @@ static long _rtl92c_signal_scale_mapping(struct ieee80211_hw *hw,
+ 
+ static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
+ 				      struct rtl_stats *pstats,
+-				      struct rx_desc_92c *pdesc,
++				      struct rx_desc_92c *p_desc,
+ 				      struct rx_fwinfo_92c *p_drvinfo,
+ 				      bool packet_match_bssid,
+ 				      bool packet_toself,
+@@ -793,11 +793,11 @@ static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
+ 	u32 rssi, total_rssi = 0;
+ 	bool in_powersavemode = false;
+ 	bool is_cck_rate;
++	u8 *pdesc = (u8 *)p_desc;
+ 
+-	is_cck_rate = RX_HAL_IS_CCK_RATE(pdesc);
++	is_cck_rate = RX_HAL_IS_CCK_RATE(p_desc);
+ 	pstats->packet_matchbssid = packet_match_bssid;
+ 	pstats->packet_toself = packet_toself;
+-	pstats->is_cck = is_cck_rate;
+ 	pstats->packet_beacon = packet_beacon;
+ 	pstats->is_cck = is_cck_rate;
+ 	pstats->RX_SIGQ[0] = -1;
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+index 5a060e53..5c52a8ac 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+@@ -303,10 +303,10 @@ out:
+ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
+ 			   struct rtl_stats *stats,
+ 			   struct ieee80211_rx_status *rx_status,
+-			   u8 *p_desc, struct sk_buff *skb)
++			   u8 *pdesc, struct sk_buff *skb)
+ {
+ 	struct rx_fwinfo_92c *p_drvinfo;
+-	struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc;
++	struct rx_desc_92c *p_desc = (struct rx_desc_92c *)pdesc;
+ 	u32 phystatus = GET_RX_DESC_PHY_STATUS(pdesc);
+ 
+ 	stats->length = (u16) GET_RX_DESC_PKT_LEN(pdesc);
+@@ -345,11 +345,11 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
+ 	if (phystatus) {
+ 		p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
+ 						     stats->rx_bufshift);
+-		rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc,
++		rtl92c_translate_rx_signal_stuff(hw, skb, stats, p_desc,
+ 						 p_drvinfo);
+ 	}
+ 	/*rx_status->qual = stats->signal; */
+-	rx_status->signal = stats->rssi + 10;
++	rx_status->signal = stats->recvsignalpower + 10;
+ 	/*rx_status->noise = -stats->noise; */
+ 	return true;
+ }
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
+index b8ec718a..542394c8 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
+@@ -525,7 +525,7 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw,	struct rtl_stats *stats,
+ 						   p_drvinfo);
+ 	}
+ 	/*rx_status->qual = stats->signal; */
+-	rx_status->signal = stats->rssi + 10;
++	rx_status->signal = stats->recvsignalpower + 10;
+ 	/*rx_status->noise = -stats->noise; */
+ 	return true;
+ }
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/rf.c b/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
+index 5061f1db..92d38ab3 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
+@@ -265,7 +265,7 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw,
+ 				    rtlefuse->pwrgroup_ht40
+ 				    [RF90_PATH_A][chnl - 1]) {
+ 					pwrdiff_limit[i] =
+-					  rtlefuse->pwrgroup_ht20
++					  rtlefuse->pwrgroup_ht40
+ 					  [RF90_PATH_A][chnl - 1];
+ 				}
+ 			} else {
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+index c7095118..7d0f2e20 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+@@ -329,7 +329,7 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
+ 	}
+ 
+ 	/*rx_status->qual = stats->signal; */
+-	rx_status->signal = stats->rssi + 10;
++	rx_status->signal = stats->recvsignalpower + 10;
+ 	/*rx_status->noise = -stats->noise; */
+ 
+ 	return true;
+diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
+index 70325874..ad9c37a4 100644
+--- a/drivers/net/wireless/rtlwifi/wifi.h
++++ b/drivers/net/wireless/rtlwifi/wifi.h
+@@ -77,11 +77,7 @@
+ #define RTL_SLOT_TIME_9				9
+ #define RTL_SLOT_TIME_20			20
+ 
+-/*related with tcp/ip. */
+-/*if_ehther.h*/
+-#define ETH_P_PAE		0x888E	/*Port Access Entity (IEEE 802.1X) */
+-#define ETH_P_IP		0x0800	/*Internet Protocol packet */
+-#define ETH_P_ARP		0x0806	/*Address Resolution packet */
++/*related to tcp/ip. */
+ #define SNAP_SIZE		6
+ #define PROTOC_TYPE_SIZE	2
+ 
+diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
+index 696caed5..ce8acc71 100644
+--- a/drivers/pci/pcie/portdrv_pci.c
++++ b/drivers/pci/pcie/portdrv_pci.c
+@@ -223,7 +223,6 @@ static int pcie_portdrv_probe(struct pci_dev *dev,
+ static void pcie_portdrv_remove(struct pci_dev *dev)
+ {
+ 	pcie_port_device_remove(dev);
+-	pci_disable_device(dev);
+ }
+ 
+ static int error_detected_iter(struct device *device, void *data)
+diff --git a/drivers/pinctrl/mvebu/pinctrl-dove.c b/drivers/pinctrl/mvebu/pinctrl-dove.c
+index 29f7e4fc..360b9b23 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-dove.c
++++ b/drivers/pinctrl/mvebu/pinctrl-dove.c
+@@ -335,7 +335,7 @@ static int dove_twsi_ctrl_set(struct mvebu_mpp_ctrl *ctrl,
+ 	unsigned long gcfg2 = readl(DOVE_GLOBAL_CONFIG_2);
+ 
+ 	gcfg1 &= ~DOVE_TWSI_ENABLE_OPTION1;
+-	gcfg2 &= ~(DOVE_TWSI_ENABLE_OPTION2 | DOVE_TWSI_ENABLE_OPTION2);
++	gcfg2 &= ~(DOVE_TWSI_ENABLE_OPTION2 | DOVE_TWSI_ENABLE_OPTION3);
+ 
+ 	switch (config) {
+ 	case 1:
+diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
+index 13ec195f..3484dd29 100644
+--- a/drivers/platform/x86/sony-laptop.c
++++ b/drivers/platform/x86/sony-laptop.c
+@@ -140,7 +140,6 @@ MODULE_PARM_DESC(kbd_backlight_timeout,
+ 		 "on the model (default: no change from current value)");
+ 
+ #ifdef CONFIG_PM_SLEEP
+-static void sony_nc_kbd_backlight_resume(void);
+ static void sony_nc_thermal_resume(void);
+ #endif
+ static int sony_nc_kbd_backlight_setup(struct platform_device *pd,
+@@ -1486,13 +1485,6 @@ static void sony_nc_function_resume(void)
+ 		case 0x0135:
+ 			sony_nc_rfkill_update();
+ 			break;
+-		case 0x0137:
+-		case 0x0143:
+-		case 0x014b:
+-		case 0x014c:
+-		case 0x0163:
+-			sony_nc_kbd_backlight_resume();
+-			break;
+ 		default:
+ 			continue;
+ 		}
+@@ -1894,25 +1886,6 @@ static void sony_nc_kbd_backlight_cleanup(struct platform_device *pd)
+ 	}
+ }
+ 
+-#ifdef CONFIG_PM_SLEEP
+-static void sony_nc_kbd_backlight_resume(void)
+-{
+-	int ignore = 0;
+-
+-	if (!kbdbl_ctl)
+-		return;
+-
+-	if (kbdbl_ctl->mode == 0)
+-		sony_call_snc_handle(kbdbl_ctl->handle, kbdbl_ctl->base,
+-				&ignore);
+-
+-	if (kbdbl_ctl->timeout != 0)
+-		sony_call_snc_handle(kbdbl_ctl->handle,
+-				(kbdbl_ctl->base + 0x200) |
+-				(kbdbl_ctl->timeout << 0x10), &ignore);
+-}
+-#endif
+-
+ struct battery_care_control {
+ 	struct device_attribute attrs[2];
+ 	unsigned int handle;
+diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
+index ba67b2c4..032df379 100644
+--- a/drivers/regulator/pfuze100-regulator.c
++++ b/drivers/regulator/pfuze100-regulator.c
+@@ -308,9 +308,15 @@ static int pfuze_identify(struct pfuze_chip *pfuze_chip)
+ 	if (ret)
+ 		return ret;
+ 
+-	if (value & 0x0f) {
+-		dev_warn(pfuze_chip->dev, "Illegal ID: %x\n", value);
+-		return -ENODEV;
++	switch (value & 0x0f) {
++		/* Freescale misprogrammed 1-3% of parts prior to week 8 of 2013 as ID=8 */
++		case 0x8:
++			dev_info(pfuze_chip->dev, "Assuming misprogrammed ID=0x8");
++		case 0x0:
++			break;
++		default:
++			dev_warn(pfuze_chip->dev, "Illegal ID: %x\n", value);
++			return -ENODEV;
+ 	}
+ 
+ 	ret = regmap_read(pfuze_chip->regmap, PFUZE100_REVID, &value);
+diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
+index 20c271d4..b993ec57 100644
+--- a/drivers/regulator/ti-abb-regulator.c
++++ b/drivers/regulator/ti-abb-regulator.c
+@@ -615,7 +615,7 @@ static int ti_abb_init_table(struct device *dev, struct ti_abb *abb,
+ 					pname, *volt_table, vset_mask);
+ 			continue;
+ 		}
+-		info->vset = efuse_val & vset_mask >> __ffs(vset_mask);
++		info->vset = (efuse_val & vset_mask) >> __ffs(vset_mask);
+ 		dev_dbg(dev, "[%d]v=%d vset=%x\n", i, *volt_table, info->vset);
+ check_abb:
+ 		switch (info->opp_sel) {
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 0a328d0d..bd8c09e7 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -4451,7 +4451,7 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
+ 	struct qeth_cmd_buffer *iob;
+ 	struct qeth_ipa_cmd *cmd;
+ 	struct qeth_snmp_ureq *ureq;
+-	int req_len;
++	unsigned int req_len;
+ 	struct qeth_arp_query_info qinfo = {0, };
+ 	int rc = 0;
+ 
+@@ -4467,6 +4467,10 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
+ 	/* skip 4 bytes (data_len struct member) to get req_len */
+ 	if (copy_from_user(&req_len, udata + sizeof(int), sizeof(int)))
+ 		return -EFAULT;
++	if (req_len > (QETH_BUFSIZE - IPA_PDU_HEADER_SIZE -
++		       sizeof(struct qeth_ipacmd_hdr) -
++		       sizeof(struct qeth_ipacmd_setadpparms_hdr)))
++		return -EINVAL;
+ 	ureq = memdup_user(udata, req_len + sizeof(struct qeth_snmp_ureq_hdr));
+ 	if (IS_ERR(ureq)) {
+ 		QETH_CARD_TEXT(card, 2, "snmpnome");
+diff --git a/drivers/staging/lustre/lustre/ptlrpc/pinger.c b/drivers/staging/lustre/lustre/ptlrpc/pinger.c
+index 5dec771d..4d340f4a 100644
+--- a/drivers/staging/lustre/lustre/ptlrpc/pinger.c
++++ b/drivers/staging/lustre/lustre/ptlrpc/pinger.c
+@@ -409,8 +409,8 @@ int ptlrpc_stop_pinger(void)
+ 	struct l_wait_info lwi = { 0 };
+ 	int rc = 0;
+ 
+-	if (!thread_is_init(&pinger_thread) &&
+-	    !thread_is_stopped(&pinger_thread))
++	if (thread_is_init(&pinger_thread) ||
++	    thread_is_stopped(&pinger_thread))
+ 		return -EALREADY;
+ 
+ 	ptlrpc_pinger_remove_timeouts();
+diff --git a/drivers/staging/media/lirc/lirc_zilog.c b/drivers/staging/media/lirc/lirc_zilog.c
+index 11d5338b..0feeaadf 100644
+--- a/drivers/staging/media/lirc/lirc_zilog.c
++++ b/drivers/staging/media/lirc/lirc_zilog.c
+@@ -61,6 +61,9 @@
+ #include <media/lirc_dev.h>
+ #include <media/lirc.h>
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ struct IR;
+ 
+ struct IR_rx {
+@@ -941,7 +944,14 @@ static ssize_t read(struct file *filep, char *outbuf, size_t n, loff_t *ppos)
+ 			schedule();
+ 			set_current_state(TASK_INTERRUPTIBLE);
+ 		} else {
+-			unsigned char buf[rbuf->chunk_size];
++			unsigned char buf[MAX_XFER_SIZE];
++
++			if (rbuf->chunk_size > sizeof(buf)) {
++				zilog_error("chunk_size is too big (%d)!\n",
++					    rbuf->chunk_size);
++				ret = -EINVAL;
++				break;
++			}
+ 			m = lirc_buffer_read(rbuf, buf);
+ 			if (m == rbuf->chunk_size) {
+ 				ret = copy_to_user((void *)outbuf+written, buf,
+diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8188eu/core/rtw_ap.c
+index 2c73823d..2a13a41f 100644
+--- a/drivers/staging/rtl8188eu/core/rtw_ap.c
++++ b/drivers/staging/rtl8188eu/core/rtw_ap.c
+@@ -1115,6 +1115,9 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
+ 			return _FAIL;
+ 	}
+ 
++	/* fix bug of flush_cam_entry at STOP AP mode */
++	psta->state |= WIFI_AP_STATE;
++	rtw_indicate_connect(padapter);
+ 	pmlmepriv->cur_network.join_res = true;/* for check if already set beacon */
+ 	return ret;
+ }
+diff --git a/drivers/staging/tidspbridge/Kconfig b/drivers/staging/tidspbridge/Kconfig
+index 165b918b..1b6d581c 100644
+--- a/drivers/staging/tidspbridge/Kconfig
++++ b/drivers/staging/tidspbridge/Kconfig
+@@ -4,7 +4,7 @@
+ 
+ menuconfig TIDSPBRIDGE
+ 	tristate "DSP Bridge driver"
+-	depends on ARCH_OMAP3 && !ARCH_MULTIPLATFORM
++	depends on ARCH_OMAP3 && !ARCH_MULTIPLATFORM && BROKEN
+ 	select MAILBOX
+ 	select OMAP2PLUS_MBOX
+ 	help
+diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c
+index 1e8b8412..4aa5ef54 100644
+--- a/drivers/staging/vt6656/baseband.c
++++ b/drivers/staging/vt6656/baseband.c
+@@ -939,6 +939,7 @@ int BBbVT3184Init(struct vnt_private *pDevice)
+     u8 *                   pbyAgc;
+     u16                    wLengthAgc;
+     u8                    abyArray[256];
++	u8 data;
+ 
+     ntStatus = CONTROLnsRequestIn(pDevice,
+                                   MESSAGE_TYPE_READ,
+@@ -1104,6 +1105,16 @@ else {
+     ControlvWriteByte(pDevice,MESSAGE_REQUEST_BBREG,0x0D,0x01);
+ 
+     RFbRFTableDownload(pDevice);
++
++	/* Fix for TX USB resets from vendors driver */
++	CONTROLnsRequestIn(pDevice, MESSAGE_TYPE_READ, USB_REG4,
++		MESSAGE_REQUEST_MEM, sizeof(data), &data);
++
++	data |= 0x2;
++
++	CONTROLnsRequestOut(pDevice, MESSAGE_TYPE_WRITE, USB_REG4,
++		MESSAGE_REQUEST_MEM, sizeof(data), &data);
++
+     return true;//ntStatus;
+ }
+ 
+diff --git a/drivers/staging/vt6656/rndis.h b/drivers/staging/vt6656/rndis.h
+index 5e073062..5cf5e732 100644
+--- a/drivers/staging/vt6656/rndis.h
++++ b/drivers/staging/vt6656/rndis.h
+@@ -66,6 +66,8 @@
+ 
+ #define VIAUSB20_PACKET_HEADER          0x04
+ 
++#define USB_REG4	0x604
++
+ typedef struct _CMD_MESSAGE
+ {
+     u8        byData[256];
+diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
+index 012ba15e..e06ec439 100644
+--- a/drivers/staging/zram/zram_drv.c
++++ b/drivers/staging/zram/zram_drv.c
+@@ -652,21 +652,30 @@ static ssize_t reset_store(struct device *dev,
+ 		return -ENOMEM;
+ 
+ 	/* Do not reset an active device! */
+-	if (bdev->bd_holders)
+-		return -EBUSY;
++	if (bdev->bd_holders) {
++		ret = -EBUSY;
++		goto out;
++	}
+ 
+ 	ret = kstrtou16(buf, 10, &do_reset);
+ 	if (ret)
+-		return ret;
++		goto out;
+ 
+-	if (!do_reset)
+-		return -EINVAL;
++	if (!do_reset) {
++		ret = -EINVAL;
++		goto out;
++	}
+ 
+ 	/* Make sure all pending I/O is finished */
+ 	fsync_bdev(bdev);
++	bdput(bdev);
+ 
+ 	zram_reset_device(zram, true);
+ 	return len;
++
++out:
++	bdput(bdev);
++	return ret;
+ }
+ 
+ static void __zram_make_request(struct zram *zram, struct bio *bio, int rw)
+diff --git a/drivers/staging/zsmalloc/zsmalloc-main.c b/drivers/staging/zsmalloc/zsmalloc-main.c
+index 1a67537d..3b950e5a 100644
+--- a/drivers/staging/zsmalloc/zsmalloc-main.c
++++ b/drivers/staging/zsmalloc/zsmalloc-main.c
+@@ -430,7 +430,12 @@ static struct page *get_next_page(struct page *page)
+ 	return next;
+ }
+ 
+-/* Encode <page, obj_idx> as a single handle value */
++/*
++ * Encode <page, obj_idx> as a single handle value.
++ * On hardware platforms with physical memory starting at 0x0 the pfn
++ * could be 0 so we ensure that the handle will never be 0 by adjusting the
++ * encoded obj_idx value before encoding.
++ */
+ static void *obj_location_to_handle(struct page *page, unsigned long obj_idx)
+ {
+ 	unsigned long handle;
+@@ -441,17 +446,21 @@ static void *obj_location_to_handle(struct page *page, unsigned long obj_idx)
+ 	}
+ 
+ 	handle = page_to_pfn(page) << OBJ_INDEX_BITS;
+-	handle |= (obj_idx & OBJ_INDEX_MASK);
++	handle |= ((obj_idx + 1) & OBJ_INDEX_MASK);
+ 
+ 	return (void *)handle;
+ }
+ 
+-/* Decode <page, obj_idx> pair from the given object handle */
++/*
++ * Decode <page, obj_idx> pair from the given object handle. We adjust the
++ * decoded obj_idx back to its original value since it was adjusted in
++ * obj_location_to_handle().
++ */
+ static void obj_handle_to_location(unsigned long handle, struct page **page,
+ 				unsigned long *obj_idx)
+ {
+ 	*page = pfn_to_page(handle >> OBJ_INDEX_BITS);
+-	*obj_idx = handle & OBJ_INDEX_MASK;
++	*obj_idx = (handle & OBJ_INDEX_MASK) - 1;
+ }
+ 
+ static unsigned long obj_idx_to_offset(struct page *page,
+diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
+index 7505fddc..3e801885 100644
+--- a/drivers/target/iscsi/iscsi_target_auth.c
++++ b/drivers/target/iscsi/iscsi_target_auth.c
+@@ -146,6 +146,7 @@ static int chap_server_compute_md5(
+ 	unsigned char client_digest[MD5_SIGNATURE_SIZE];
+ 	unsigned char server_digest[MD5_SIGNATURE_SIZE];
+ 	unsigned char chap_n[MAX_CHAP_N_SIZE], chap_r[MAX_RESPONSE_LENGTH];
++	size_t compare_len;
+ 	struct iscsi_chap *chap = conn->auth_protocol;
+ 	struct crypto_hash *tfm;
+ 	struct hash_desc desc;
+@@ -184,7 +185,9 @@ static int chap_server_compute_md5(
+ 		goto out;
+ 	}
+ 
+-	if (memcmp(chap_n, auth->userid, strlen(auth->userid)) != 0) {
++	/* Include the terminating NULL in the compare */
++	compare_len = strlen(auth->userid) + 1;
++	if (strncmp(chap_n, auth->userid, compare_len) != 0) {
+ 		pr_err("CHAP_N values do not match!\n");
+ 		goto out;
+ 	}
+diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
+index fd145259..8a1bd1af 100644
+--- a/drivers/target/iscsi/iscsi_target_configfs.c
++++ b/drivers/target/iscsi/iscsi_target_configfs.c
+@@ -1784,6 +1784,11 @@ static int lio_queue_status(struct se_cmd *se_cmd)
+ 	struct iscsi_cmd *cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd);
+ 
+ 	cmd->i_state = ISTATE_SEND_STATUS;
++
++	if (cmd->se_cmd.scsi_status || cmd->sense_reason) {
++		iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
++		return 0;
++	}
+ 	cmd->conn->conn_transport->iscsit_queue_status(cmd->conn, cmd);
+ 
+ 	return 0;
+diff --git a/drivers/target/iscsi/iscsi_target_device.c b/drivers/target/iscsi/iscsi_target_device.c
+index 6c7a5104..7087c736 100644
+--- a/drivers/target/iscsi/iscsi_target_device.c
++++ b/drivers/target/iscsi/iscsi_target_device.c
+@@ -58,11 +58,7 @@ void iscsit_increment_maxcmdsn(struct iscsi_cmd *cmd, struct iscsi_session *sess
+ 
+ 	cmd->maxcmdsn_inc = 1;
+ 
+-	if (!mutex_trylock(&sess->cmdsn_mutex)) {
+-		sess->max_cmd_sn += 1;
+-		pr_debug("Updated MaxCmdSN to 0x%08x\n", sess->max_cmd_sn);
+-		return;
+-	}
++	mutex_lock(&sess->cmdsn_mutex);
+ 	sess->max_cmd_sn += 1;
+ 	pr_debug("Updated MaxCmdSN to 0x%08x\n", sess->max_cmd_sn);
+ 	mutex_unlock(&sess->cmdsn_mutex);
+diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
+index ef6d836a..a972145d 100644
+--- a/drivers/target/iscsi/iscsi_target_nego.c
++++ b/drivers/target/iscsi/iscsi_target_nego.c
+@@ -88,7 +88,7 @@ int extract_param(
+ 	if (len < 0)
+ 		return -1;
+ 
+-	if (len > max_length) {
++	if (len >= max_length) {
+ 		pr_err("Length of input: %d exceeds max_length:"
+ 			" %d\n", len, max_length);
+ 		return -1;
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 81e945ee..0b0009b5 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2910,6 +2910,7 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
+ 		 cmd->t_task_cdb[0], cmd->se_tfo->get_task_tag(cmd));
+ 
+ 	cmd->se_cmd_flags |= SCF_SENT_DELAYED_TAS;
++	cmd->scsi_status = SAM_STAT_TASK_ABORTED;
+ 	trace_target_cmd_complete(cmd);
+ 	cmd->se_tfo->queue_status(cmd);
+ 
+@@ -2938,6 +2939,7 @@ void transport_send_task_abort(struct se_cmd *cmd)
+ 		if (cmd->se_tfo->write_pending_status(cmd) != 0) {
+ 			cmd->transport_state |= CMD_T_ABORTED;
+ 			smp_mb__after_atomic_inc();
++			return;
+ 		}
+ 	}
+ 	cmd->scsi_status = SAM_STAT_TASK_ABORTED;
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 7a744b69..ff582933 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -767,8 +767,8 @@ static size_t __process_echoes(struct tty_struct *tty)
+ 	 * of echo overrun before the next commit), then discard enough
+ 	 * data at the tail to prevent a subsequent overrun */
+ 	while (ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) {
+-		if (echo_buf(ldata, tail == ECHO_OP_START)) {
+-			if (echo_buf(ldata, tail) == ECHO_OP_ERASE_TAB)
++		if (echo_buf(ldata, tail) == ECHO_OP_START) {
++			if (echo_buf(ldata, tail + 1) == ECHO_OP_ERASE_TAB)
+ 				tail += 3;
+ 			else
+ 				tail += 2;
+@@ -2005,7 +2005,10 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
+ 		found = 1;
+ 
+ 	size = N_TTY_BUF_SIZE - tail;
+-	n = (found + eol + size) & (N_TTY_BUF_SIZE - 1);
++	n = eol - tail;
++	if (n > 4096)
++		n += 4096;
++	n += found;
+ 	c = n;
+ 
+ 	if (found && read_buf(ldata, eol) == __DISABLED_CHAR) {
+@@ -2250,6 +2253,9 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
+ 		if (time)
+ 			timeout = time;
+ 	}
++	n_tty_set_room(tty);
++	up_read(&tty->termios_rwsem);
++
+ 	mutex_unlock(&ldata->atomic_read_lock);
+ 	remove_wait_queue(&tty->read_wait, &wait);
+ 
+@@ -2260,8 +2266,6 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
+ 	if (b - buf)
+ 		retval = b - buf;
+ 
+-	n_tty_set_room(tty);
+-	up_read(&tty->termios_rwsem);
+ 	return retval;
+ }
+ 
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 3a1a01af..c74a00ad 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -2086,6 +2086,7 @@ retry_open:
+ 			filp->f_op = &tty_fops;
+ 		goto retry_open;
+ 	}
++	clear_bit(TTY_HUPPED, &tty->flags);
+ 	tty_unlock(tty);
+ 
+ 
+diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c
+index f7447f70..d18da911 100644
+--- a/drivers/video/backlight/atmel-pwm-bl.c
++++ b/drivers/video/backlight/atmel-pwm-bl.c
+@@ -70,7 +70,7 @@ static int atmel_pwm_bl_set_intensity(struct backlight_device *bd)
+ static int atmel_pwm_bl_get_intensity(struct backlight_device *bd)
+ {
+ 	struct atmel_pwm_bl *pwmbl = bl_get_data(bd);
+-	u8 intensity;
++	u32 intensity;
+ 
+ 	if (pwmbl->pdata->pwm_active_low) {
+ 		intensity = pwm_channel_readl(&pwmbl->pwmc, PWM_CDTY) -
+@@ -80,7 +80,7 @@ static int atmel_pwm_bl_get_intensity(struct backlight_device *bd)
+ 			pwm_channel_readl(&pwmbl->pwmc, PWM_CDTY);
+ 	}
+ 
+-	return intensity;
++	return intensity & 0xffff;
+ }
+ 
+ static int atmel_pwm_bl_init_pwm(struct atmel_pwm_bl *pwmbl)
+@@ -206,8 +206,10 @@ static int atmel_pwm_bl_remove(struct platform_device *pdev)
+ {
+ 	struct atmel_pwm_bl *pwmbl = platform_get_drvdata(pdev);
+ 
+-	if (pwmbl->gpio_on != -1)
+-		gpio_set_value(pwmbl->gpio_on, 0);
++	if (pwmbl->gpio_on != -1) {
++		gpio_set_value(pwmbl->gpio_on,
++					0 ^ pwmbl->pdata->on_active_low);
++	}
+ 	pwm_channel_disable(&pwmbl->pwmc);
+ 	pwm_channel_free(&pwmbl->pwmc);
+ 	backlight_device_unregister(pwmbl->bldev);
+diff --git a/drivers/video/console/sticore.c b/drivers/video/console/sticore.c
+index 35687fd5..4ad24f2c 100644
+--- a/drivers/video/console/sticore.c
++++ b/drivers/video/console/sticore.c
+@@ -3,7 +3,7 @@
+  *	core code for console driver using HP's STI firmware
+  *
+  *	Copyright (C) 2000 Philipp Rumpf <prumpf@×××.org>
+- *	Copyright (C) 2001-2003 Helge Deller <deller@×××.de>
++ *	Copyright (C) 2001-2013 Helge Deller <deller@×××.de>
+  *	Copyright (C) 2001-2002 Thomas Bogendoerfer <tsbogend@×××××××××××××.de>
+  * 
+  * TODO:
+@@ -30,7 +30,7 @@
+ 
+ #include "../sticore.h"
+ 
+-#define STI_DRIVERVERSION "Version 0.9a"
++#define STI_DRIVERVERSION "Version 0.9b"
+ 
+ static struct sti_struct *default_sti __read_mostly;
+ 
+@@ -73,28 +73,34 @@ static const struct sti_init_flags default_init_flags = {
+ 
+ static int sti_init_graph(struct sti_struct *sti)
+ {
+-	struct sti_init_inptr_ext inptr_ext = { 0, };
+-	struct sti_init_inptr inptr = {
+-		.text_planes	= 3, /* # of text planes (max 3 for STI) */
+-		.ext_ptr	= STI_PTR(&inptr_ext)
+-	};
+-	struct sti_init_outptr outptr = { 0, };
++	struct sti_init_inptr *inptr = &sti->sti_data->init_inptr;
++	struct sti_init_inptr_ext *inptr_ext = &sti->sti_data->init_inptr_ext;
++	struct sti_init_outptr *outptr = &sti->sti_data->init_outptr;
+ 	unsigned long flags;
+-	int ret;
++	int ret, err;
+ 
+ 	spin_lock_irqsave(&sti->lock, flags);
+ 
+-	ret = STI_CALL(sti->init_graph, &default_init_flags, &inptr,
+-		&outptr, sti->glob_cfg);
++	memset(inptr, 0, sizeof(*inptr));
++	inptr->text_planes = 3; /* # of text planes (max 3 for STI) */
++	memset(inptr_ext, 0, sizeof(*inptr_ext));
++	inptr->ext_ptr = STI_PTR(inptr_ext);
++	outptr->errno = 0;
++
++	ret = sti_call(sti, sti->init_graph, &default_init_flags, inptr,
++		outptr, sti->glob_cfg);
++
++	if (ret >= 0)
++		sti->text_planes = outptr->text_planes;
++	err = outptr->errno;
+ 
+ 	spin_unlock_irqrestore(&sti->lock, flags);
+ 
+ 	if (ret < 0) {
+-		printk(KERN_ERR "STI init_graph failed (ret %d, errno %d)\n",ret,outptr.errno);
++		pr_err("STI init_graph failed (ret %d, errno %d)\n", ret, err);
+ 		return -1;
+ 	}
+ 	
+-	sti->text_planes = outptr.text_planes;
+ 	return 0;
+ }
+ 
+@@ -104,16 +110,18 @@ static const struct sti_conf_flags default_conf_flags = {
+ 
+ static void sti_inq_conf(struct sti_struct *sti)
+ {
+-	struct sti_conf_inptr inptr = { 0, };
++	struct sti_conf_inptr *inptr = &sti->sti_data->inq_inptr;
++	struct sti_conf_outptr *outptr = &sti->sti_data->inq_outptr;
+ 	unsigned long flags;
+ 	s32 ret;
+ 
+-	sti->outptr.ext_ptr = STI_PTR(&sti->outptr_ext);
++	outptr->ext_ptr = STI_PTR(&sti->sti_data->inq_outptr_ext);
+ 	
+ 	do {
+ 		spin_lock_irqsave(&sti->lock, flags);
+-		ret = STI_CALL(sti->inq_conf, &default_conf_flags,
+-			&inptr, &sti->outptr, sti->glob_cfg);
++		memset(inptr, 0, sizeof(*inptr));
++		ret = sti_call(sti, sti->inq_conf, &default_conf_flags,
++			inptr, outptr, sti->glob_cfg);
+ 		spin_unlock_irqrestore(&sti->lock, flags);
+ 	} while (ret == 1);
+ }
+@@ -126,7 +134,8 @@ static const struct sti_font_flags default_font_flags = {
+ void
+ sti_putc(struct sti_struct *sti, int c, int y, int x)
+ {
+-	struct sti_font_inptr inptr = {
++	struct sti_font_inptr *inptr = &sti->sti_data->font_inptr;
++	struct sti_font_inptr inptr_default = {
+ 		.font_start_addr= STI_PTR(sti->font->raw),
+ 		.index		= c_index(sti, c),
+ 		.fg_color	= c_fg(sti, c),
+@@ -134,14 +143,15 @@ sti_putc(struct sti_struct *sti, int c, int y, int x)
+ 		.dest_x		= x * sti->font_width,
+ 		.dest_y		= y * sti->font_height,
+ 	};
+-	struct sti_font_outptr outptr = { 0, };
++	struct sti_font_outptr *outptr = &sti->sti_data->font_outptr;
+ 	s32 ret;
+ 	unsigned long flags;
+ 
+ 	do {
+ 		spin_lock_irqsave(&sti->lock, flags);
+-		ret = STI_CALL(sti->font_unpmv, &default_font_flags,
+-			&inptr, &outptr, sti->glob_cfg);
++		*inptr = inptr_default;
++		ret = sti_call(sti, sti->font_unpmv, &default_font_flags,
++			inptr, outptr, sti->glob_cfg);
+ 		spin_unlock_irqrestore(&sti->lock, flags);
+ 	} while (ret == 1);
+ }
+@@ -156,7 +166,8 @@ void
+ sti_set(struct sti_struct *sti, int src_y, int src_x,
+ 	int height, int width, u8 color)
+ {
+-	struct sti_blkmv_inptr inptr = {
++	struct sti_blkmv_inptr *inptr = &sti->sti_data->blkmv_inptr;
++	struct sti_blkmv_inptr inptr_default = {
+ 		.fg_color	= color,
+ 		.bg_color	= color,
+ 		.src_x		= src_x,
+@@ -166,14 +177,15 @@ sti_set(struct sti_struct *sti, int src_y, int src_x,
+ 		.width		= width,
+ 		.height		= height,
+ 	};
+-	struct sti_blkmv_outptr outptr = { 0, };
++	struct sti_blkmv_outptr *outptr = &sti->sti_data->blkmv_outptr;
+ 	s32 ret;
+ 	unsigned long flags;
+ 	
+ 	do {
+ 		spin_lock_irqsave(&sti->lock, flags);
+-		ret = STI_CALL(sti->block_move, &clear_blkmv_flags,
+-			&inptr, &outptr, sti->glob_cfg);
++		*inptr = inptr_default;
++		ret = sti_call(sti, sti->block_move, &clear_blkmv_flags,
++			inptr, outptr, sti->glob_cfg);
+ 		spin_unlock_irqrestore(&sti->lock, flags);
+ 	} while (ret == 1);
+ }
+@@ -182,7 +194,8 @@ void
+ sti_clear(struct sti_struct *sti, int src_y, int src_x,
+ 	  int height, int width, int c)
+ {
+-	struct sti_blkmv_inptr inptr = {
++	struct sti_blkmv_inptr *inptr = &sti->sti_data->blkmv_inptr;
++	struct sti_blkmv_inptr inptr_default = {
+ 		.fg_color	= c_fg(sti, c),
+ 		.bg_color	= c_bg(sti, c),
+ 		.src_x		= src_x * sti->font_width,
+@@ -192,14 +205,15 @@ sti_clear(struct sti_struct *sti, int src_y, int src_x,
+ 		.width		= width * sti->font_width,
+ 		.height		= height* sti->font_height,
+ 	};
+-	struct sti_blkmv_outptr outptr = { 0, };
++	struct sti_blkmv_outptr *outptr = &sti->sti_data->blkmv_outptr;
+ 	s32 ret;
+ 	unsigned long flags;
+ 
+ 	do {
+ 		spin_lock_irqsave(&sti->lock, flags);
+-		ret = STI_CALL(sti->block_move, &clear_blkmv_flags,
+-			&inptr, &outptr, sti->glob_cfg);
++		*inptr = inptr_default;
++		ret = sti_call(sti, sti->block_move, &clear_blkmv_flags,
++			inptr, outptr, sti->glob_cfg);
+ 		spin_unlock_irqrestore(&sti->lock, flags);
+ 	} while (ret == 1);
+ }
+@@ -212,7 +226,8 @@ void
+ sti_bmove(struct sti_struct *sti, int src_y, int src_x,
+ 	  int dst_y, int dst_x, int height, int width)
+ {
+-	struct sti_blkmv_inptr inptr = {
++	struct sti_blkmv_inptr *inptr = &sti->sti_data->blkmv_inptr;
++	struct sti_blkmv_inptr inptr_default = {
+ 		.src_x		= src_x * sti->font_width,
+ 		.src_y		= src_y * sti->font_height,
+ 		.dest_x		= dst_x * sti->font_width,
+@@ -220,14 +235,15 @@ sti_bmove(struct sti_struct *sti, int src_y, int src_x,
+ 		.width		= width * sti->font_width,
+ 		.height		= height* sti->font_height,
+ 	};
+-	struct sti_blkmv_outptr outptr = { 0, };
++	struct sti_blkmv_outptr *outptr = &sti->sti_data->blkmv_outptr;
+ 	s32 ret;
+ 	unsigned long flags;
+ 
+ 	do {
+ 		spin_lock_irqsave(&sti->lock, flags);
+-		ret = STI_CALL(sti->block_move, &default_blkmv_flags,
+-			&inptr, &outptr, sti->glob_cfg);
++		*inptr = inptr_default;
++		ret = sti_call(sti, sti->block_move, &default_blkmv_flags,
++			inptr, outptr, sti->glob_cfg);
+ 		spin_unlock_irqrestore(&sti->lock, flags);
+ 	} while (ret == 1);
+ }
+@@ -284,7 +300,7 @@ __setup("sti=", sti_setup);
+ 
+ 
+ 
+-static char *font_name[MAX_STI_ROMS] = { "VGA8x16", };
++static char *font_name[MAX_STI_ROMS];
+ static int font_index[MAX_STI_ROMS],
+ 	   font_height[MAX_STI_ROMS],
+ 	   font_width[MAX_STI_ROMS];
+@@ -389,10 +405,10 @@ static void sti_dump_outptr(struct sti_struct *sti)
+ 		"%d used bits\n"
+ 		"%d planes\n"
+ 		"attributes %08x\n",
+-		 sti->outptr.bits_per_pixel,
+-		 sti->outptr.bits_used,
+-		 sti->outptr.planes,
+-		 sti->outptr.attributes));
++		 sti->sti_data->inq_outptr.bits_per_pixel,
++		 sti->sti_data->inq_outptr.bits_used,
++		 sti->sti_data->inq_outptr.planes,
++		 sti->sti_data->inq_outptr.attributes));
+ }
+ 
+ static int sti_init_glob_cfg(struct sti_struct *sti, unsigned long rom_address,
+@@ -402,24 +418,21 @@ static int sti_init_glob_cfg(struct sti_struct *sti, unsigned long rom_address,
+ 	struct sti_glob_cfg_ext *glob_cfg_ext;
+ 	void *save_addr;
+ 	void *sti_mem_addr;
+-	const int save_addr_size = 1024;	/* XXX */
+-	int i;
++	int i, size;
+ 
+-	if (!sti->sti_mem_request)
++	if (sti->sti_mem_request < 256)
+ 		sti->sti_mem_request = 256; /* STI default */
+ 
+-	glob_cfg = kzalloc(sizeof(*sti->glob_cfg), GFP_KERNEL);
+-	glob_cfg_ext = kzalloc(sizeof(*glob_cfg_ext), GFP_KERNEL);
+-	save_addr = kzalloc(save_addr_size, GFP_KERNEL);
+-	sti_mem_addr = kzalloc(sti->sti_mem_request, GFP_KERNEL);
++	size = sizeof(struct sti_all_data) + sti->sti_mem_request - 256;
+ 
+-	if (!(glob_cfg && glob_cfg_ext && save_addr && sti_mem_addr)) {
+-		kfree(glob_cfg);
+-		kfree(glob_cfg_ext);
+-		kfree(save_addr);
+-		kfree(sti_mem_addr);
++	sti->sti_data = kzalloc(size, STI_LOWMEM);
++	if (!sti->sti_data)
+ 		return -ENOMEM;
+-	}
++
++	glob_cfg	= &sti->sti_data->glob_cfg;
++	glob_cfg_ext	= &sti->sti_data->glob_cfg_ext;
++	save_addr	= &sti->sti_data->save_addr;
++	sti_mem_addr	= &sti->sti_data->sti_mem_addr;
+ 
+ 	glob_cfg->ext_ptr = STI_PTR(glob_cfg_ext);
+ 	glob_cfg->save_addr = STI_PTR(save_addr);
+@@ -475,32 +488,31 @@ static int sti_init_glob_cfg(struct sti_struct *sti, unsigned long rom_address,
+ 	return 0;
+ }
+ 
+-#ifdef CONFIG_FB
++#ifdef CONFIG_FONTS
+ static struct sti_cooked_font *
+ sti_select_fbfont(struct sti_cooked_rom *cooked_rom, const char *fbfont_name)
+ {
+-	const struct font_desc *fbfont;
++	const struct font_desc *fbfont = NULL;
+ 	unsigned int size, bpc;
+ 	void *dest;
+ 	struct sti_rom_font *nf;
+ 	struct sti_cooked_font *cooked_font;
+ 	
+-	if (!fbfont_name || !strlen(fbfont_name))
+-		return NULL;
+-	fbfont = find_font(fbfont_name);
++	if (fbfont_name && strlen(fbfont_name))
++		fbfont = find_font(fbfont_name);
+ 	if (!fbfont)
+ 		fbfont = get_default_font(1024,768, ~(u32)0, ~(u32)0);
+ 	if (!fbfont)
+ 		return NULL;
+ 
+-	DPRINTK((KERN_DEBUG "selected %dx%d fb-font %s\n",
+-			fbfont->width, fbfont->height, fbfont->name));
++	pr_info("STI selected %dx%d framebuffer font %s for sticon\n",
++			fbfont->width, fbfont->height, fbfont->name);
+ 			
+ 	bpc = ((fbfont->width+7)/8) * fbfont->height; 
+ 	size = bpc * 256;
+ 	size += sizeof(struct sti_rom_font);
+ 
+-	nf = kzalloc(size, GFP_KERNEL);
++	nf = kzalloc(size, STI_LOWMEM);
+ 	if (!nf)
+ 		return NULL;
+ 
+@@ -637,7 +649,7 @@ static void *sti_bmode_font_raw(struct sti_cooked_font *f)
+ 	unsigned char *n, *p, *q;
+ 	int size = f->raw->bytes_per_char*256+sizeof(struct sti_rom_font);
+ 	
+-	n = kzalloc (4*size, GFP_KERNEL);
++	n = kzalloc(4*size, STI_LOWMEM);
+ 	if (!n)
+ 		return NULL;
+ 	p = n + 3;
+@@ -673,7 +685,7 @@ static struct sti_rom *sti_get_bmode_rom (unsigned long address)
+ 	sti_bmode_rom_copy(address + BMODE_LAST_ADDR_OFFS, sizeof(size), &size);
+ 
+ 	size = (size+3) / 4;
+-	raw = kmalloc(size, GFP_KERNEL);
++	raw = kmalloc(size, STI_LOWMEM);
+ 	if (raw) {
+ 		sti_bmode_rom_copy(address, size, raw);
+ 		memmove (&raw->res004, &raw->type[0], 0x3c);
+@@ -707,7 +719,7 @@ static struct sti_rom *sti_get_wmode_rom(unsigned long address)
+ 	/* read the ROM size directly from the struct in ROM */ 
+ 	size = gsc_readl(address + offsetof(struct sti_rom,last_addr));
+ 
+-	raw = kmalloc(size, GFP_KERNEL);
++	raw = kmalloc(size, STI_LOWMEM);
+ 	if (raw)
+ 		sti_rom_copy(address, size, raw);
+ 
+@@ -743,6 +755,10 @@ static int sti_read_rom(int wordmode, struct sti_struct *sti,
+ 
+ 	address = (unsigned long) STI_PTR(raw);
+ 
++	pr_info("STI ROM supports 32 %sbit firmware functions.\n",
++		raw->alt_code_type == ALT_CODE_TYPE_PA_RISC_64
++		? "and 64 " : "");
++
+ 	sti->font_unpmv = address + (raw->font_unpmv & 0x03ffffff);
+ 	sti->block_move = address + (raw->block_move & 0x03ffffff);
+ 	sti->init_graph = address + (raw->init_graph & 0x03ffffff);
+@@ -901,7 +917,8 @@ test_rom:
+ 	sti_dump_globcfg(sti->glob_cfg, sti->sti_mem_request);
+ 	sti_dump_outptr(sti);
+ 	
+-	printk(KERN_INFO "    graphics card name: %s\n", sti->outptr.dev_name );
++	pr_info("    graphics card name: %s\n",
++		sti->sti_data->inq_outptr.dev_name);
+ 
+ 	sti_roms[num_sti_roms] = sti;
+ 	num_sti_roms++;
+@@ -1073,6 +1090,29 @@ struct sti_struct * sti_get_rom(unsigned int index)
+ }
+ EXPORT_SYMBOL(sti_get_rom);
+ 
++
++int sti_call(const struct sti_struct *sti, unsigned long func,
++		const void *flags, void *inptr, void *outptr,
++		struct sti_glob_cfg *glob_cfg)
++{
++	unsigned long _flags = STI_PTR(flags);
++	unsigned long _inptr = STI_PTR(inptr);
++	unsigned long _outptr = STI_PTR(outptr);
++	unsigned long _glob_cfg = STI_PTR(glob_cfg);
++	int ret;
++
++#ifdef CONFIG_64BIT
++	/* Check for overflow when using 32bit STI on 64bit kernel. */
++	if (WARN_ONCE(_flags>>32 || _inptr>>32 || _outptr>>32 || _glob_cfg>>32,
++			"Out of 32bit-range pointers!"))
++		return -1;
++#endif
++
++	ret = pdc_sti_call(func, _flags, _inptr, _outptr, _glob_cfg);
++
++	return ret;
++}
++
+ MODULE_AUTHOR("Philipp Rumpf, Helge Deller, Thomas Bogendoerfer");
+ MODULE_DESCRIPTION("Core STI driver for HP's NGLE series graphics cards in HP PARISC machines");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/video/sticore.h b/drivers/video/sticore.h
+index addf7b61..af161953 100644
+--- a/drivers/video/sticore.h
++++ b/drivers/video/sticore.h
+@@ -18,6 +18,9 @@
+ #define STI_FONT_HPROMAN8 1
+ #define STI_FONT_KANA8 2
+ 
++#define ALT_CODE_TYPE_UNKNOWN 0x00	/* alt code type values */
++#define ALT_CODE_TYPE_PA_RISC_64 0x01
++
+ /* The latency of the STI functions cannot really be reduced by setting
+  * this to 0;  STI doesn't seem to be designed to allow calling a different
+  * function (or the same function with different arguments) after a
+@@ -40,14 +43,6 @@
+ 
+ #define STI_PTR(p)	( virt_to_phys(p) )
+ #define PTR_STI(p)	( phys_to_virt((unsigned long)p) )
+-#define STI_CALL(func, flags, inptr, outptr, glob_cfg)	\
+-       ({						\
+-               pdc_sti_call( func, STI_PTR(flags),	\
+-				   STI_PTR(inptr),	\
+-				   STI_PTR(outptr),	\
+-				   STI_PTR(glob_cfg));	\
+-       })
+-
+ 
+ #define sti_onscreen_x(sti) (sti->glob_cfg->onscreen_x)
+ #define sti_onscreen_y(sti) (sti->glob_cfg->onscreen_y)
+@@ -56,6 +51,12 @@
+ #define sti_font_x(sti) (PTR_STI(sti->font)->width)
+ #define sti_font_y(sti) (PTR_STI(sti->font)->height)
+ 
++#ifdef CONFIG_64BIT
++#define STI_LOWMEM	(GFP_KERNEL | GFP_DMA)
++#else
++#define STI_LOWMEM	(GFP_KERNEL)
++#endif
++
+ 
+ /* STI function configuration structs */
+ 
+@@ -306,6 +307,34 @@ struct sti_blkmv_outptr {
+ };
+ 
+ 
++/* sti_all_data is an internal struct which needs to be allocated in
++ * low memory (< 4GB) if STI is used with 32bit STI on a 64bit kernel */
++
++struct sti_all_data {
++	struct sti_glob_cfg glob_cfg;
++	struct sti_glob_cfg_ext glob_cfg_ext;
++
++	struct sti_conf_inptr		inq_inptr;
++	struct sti_conf_outptr		inq_outptr; /* configuration */
++	struct sti_conf_outptr_ext	inq_outptr_ext;
++
++	struct sti_init_inptr_ext	init_inptr_ext;
++	struct sti_init_inptr		init_inptr;
++	struct sti_init_outptr		init_outptr;
++
++	struct sti_blkmv_inptr		blkmv_inptr;
++	struct sti_blkmv_outptr		blkmv_outptr;
++
++	struct sti_font_inptr		font_inptr;
++	struct sti_font_outptr		font_outptr;
++
++	/* leave as last entries */
++	unsigned long save_addr[1024 / sizeof(unsigned long)];
++	   /* min 256 bytes which is STI default, max sti->sti_mem_request */
++	unsigned long sti_mem_addr[256 / sizeof(unsigned long)];
++	/* do not add something below here ! */
++};
++
+ /* internal generic STI struct */
+ 
+ struct sti_struct {
+@@ -330,11 +359,9 @@ struct sti_struct {
+ 	region_t regions[STI_REGION_MAX];
+ 	unsigned long regions_phys[STI_REGION_MAX];
+ 
+-	struct sti_glob_cfg *glob_cfg;
+-	struct sti_cooked_font *font;	/* ptr to selected font (cooked) */
++	struct sti_glob_cfg *glob_cfg;	/* points into sti_all_data */
+ 
+-	struct sti_conf_outptr outptr; /* configuration */
+-	struct sti_conf_outptr_ext outptr_ext;
++	struct sti_cooked_font *font;	/* ptr to selected font (cooked) */
+ 
+ 	struct pci_dev *pd;
+ 
+@@ -343,6 +370,9 @@ struct sti_struct {
+ 
+ 	/* pointer to the fb_info where this STI device is used */
+ 	struct fb_info *info;
++
++	/* pointer to all internal data */
++	struct sti_all_data *sti_data;
+ };
+ 
+ 
+@@ -350,6 +380,14 @@ struct sti_struct {
+ 
+ struct sti_struct *sti_get_rom(unsigned int index); /* 0: default sti */
+ 
++
++/* sticore main function to call STI firmware */
++
++int sti_call(const struct sti_struct *sti, unsigned long func,
++		const void *flags, void *inptr, void *outptr,
++		struct sti_glob_cfg *glob_cfg);
++
++
+ /* functions to call the STI ROM directly */
+ 
+ void sti_putc(struct sti_struct *sti, int c, int y, int x);
+diff --git a/drivers/video/stifb.c b/drivers/video/stifb.c
+index 876648e1..019a1fee 100644
+--- a/drivers/video/stifb.c
++++ b/drivers/video/stifb.c
+@@ -1101,6 +1101,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
+ 	var = &info->var;
+ 
+ 	fb->sti = sti;
++	dev_name = sti->sti_data->inq_outptr.dev_name;
+ 	/* store upper 32bits of the graphics id */
+ 	fb->id = fb->sti->graphics_id[0];
+ 
+@@ -1114,11 +1115,11 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
+ 		  Since this driver only supports standard mode, we check
+ 		  if the device name contains the string "DX" and tell the
+ 		  user how to reconfigure the card. */
+-		if (strstr(sti->outptr.dev_name, "DX")) {
++		if (strstr(dev_name, "DX")) {
+ 		   printk(KERN_WARNING
+ "WARNING: stifb framebuffer driver does not support '%s' in double-buffer mode.\n"
+ "WARNING: Please disable the double-buffer mode in IPL menu (the PARISC-BIOS).\n",
+-			sti->outptr.dev_name);
++			dev_name);
+ 		   goto out_err0;
+ 		}
+ 		/* fall though */
+@@ -1130,7 +1131,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
+ 		break;
+ 	default:
+ 		printk(KERN_WARNING "stifb: '%s' (id: 0x%08x) not supported.\n",
+-			sti->outptr.dev_name, fb->id);
++			dev_name, fb->id);
+ 		goto out_err0;
+ 	}
+ 	
+@@ -1154,7 +1155,6 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
+ 		fb->id = S9000_ID_A1659A;
+ 		break;
+ 	case S9000_ID_TIMBER:	/* HP9000/710 Any (may be a grayscale device) */
+-		dev_name = fb->sti->outptr.dev_name;
+ 		if (strstr(dev_name, "GRAYSCALE") || 
+ 		    strstr(dev_name, "Grayscale") ||
+ 		    strstr(dev_name, "grayscale"))
+@@ -1290,7 +1290,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
+ 		var->xres, 
+ 		var->yres,
+ 		var->bits_per_pixel,
+-		sti->outptr.dev_name,
++		dev_name,
+ 		fb->id, 
+ 		fix->mmio_start);
+ 
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 52b6f6c2..c8e03f8d 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -261,7 +261,7 @@ struct smb_version_operations {
+ 	/* query path data from the server */
+ 	int (*query_path_info)(const unsigned int, struct cifs_tcon *,
+ 			       struct cifs_sb_info *, const char *,
+-			       FILE_ALL_INFO *, bool *);
++			       FILE_ALL_INFO *, bool *, bool *);
+ 	/* query file data from the server */
+ 	int (*query_file_info)(const unsigned int, struct cifs_tcon *,
+ 			       struct cifs_fid *, FILE_ALL_INFO *);
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index ccd31ab8..5f1f3285 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -3315,11 +3315,13 @@ static __u16 ACL_to_cifs_posix(char *parm_data, const char *pACL,
+ 		return 0;
+ 	}
+ 	cifs_acl->version = cpu_to_le16(1);
+-	if (acl_type == ACL_TYPE_ACCESS)
++	if (acl_type == ACL_TYPE_ACCESS) {
+ 		cifs_acl->access_entry_count = cpu_to_le16(count);
+-	else if (acl_type == ACL_TYPE_DEFAULT)
++		cifs_acl->default_entry_count = __constant_cpu_to_le16(0xFFFF);
++	} else if (acl_type == ACL_TYPE_DEFAULT) {
+ 		cifs_acl->default_entry_count = cpu_to_le16(count);
+-	else {
++		cifs_acl->access_entry_count = __constant_cpu_to_le16(0xFFFF);
++	} else {
+ 		cifs_dbg(FYI, "unknown ACL type %d\n", acl_type);
+ 		return 0;
+ 	}
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 867b7cdc..36f9ebb9 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -542,7 +542,8 @@ static int cifs_sfu_mode(struct cifs_fattr *fattr, const unsigned char *path,
+ /* Fill a cifs_fattr struct with info from FILE_ALL_INFO */
+ static void
+ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
+-		       struct cifs_sb_info *cifs_sb, bool adjust_tz)
++		       struct cifs_sb_info *cifs_sb, bool adjust_tz,
++		       bool symlink)
+ {
+ 	struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
+ 
+@@ -569,7 +570,11 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
+ 	fattr->cf_createtime = le64_to_cpu(info->CreationTime);
+ 
+ 	fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
+-	if (fattr->cf_cifsattrs & ATTR_DIRECTORY) {
++
++	if (symlink) {
++		fattr->cf_mode = S_IFLNK;
++		fattr->cf_dtype = DT_LNK;
++	} else if (fattr->cf_cifsattrs & ATTR_DIRECTORY) {
+ 		fattr->cf_mode = S_IFDIR | cifs_sb->mnt_dir_mode;
+ 		fattr->cf_dtype = DT_DIR;
+ 		/*
+@@ -578,10 +583,6 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
+ 		 */
+ 		if (!tcon->unix_ext)
+ 			fattr->cf_flags |= CIFS_FATTR_UNKNOWN_NLINK;
+-	} else if (fattr->cf_cifsattrs & ATTR_REPARSE) {
+-		fattr->cf_mode = S_IFLNK;
+-		fattr->cf_dtype = DT_LNK;
+-		fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
+ 	} else {
+ 		fattr->cf_mode = S_IFREG | cifs_sb->mnt_file_mode;
+ 		fattr->cf_dtype = DT_REG;
+@@ -626,7 +627,8 @@ cifs_get_file_info(struct file *filp)
+ 	rc = server->ops->query_file_info(xid, tcon, &cfile->fid, &find_data);
+ 	switch (rc) {
+ 	case 0:
+-		cifs_all_info_to_fattr(&fattr, &find_data, cifs_sb, false);
++		cifs_all_info_to_fattr(&fattr, &find_data, cifs_sb, false,
++				       false);
+ 		break;
+ 	case -EREMOTE:
+ 		cifs_create_dfs_fattr(&fattr, inode->i_sb);
+@@ -673,6 +675,7 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
+ 	bool adjust_tz = false;
+ 	struct cifs_fattr fattr;
+ 	struct cifs_search_info *srchinf = NULL;
++	bool symlink = false;
+ 
+ 	tlink = cifs_sb_tlink(cifs_sb);
+ 	if (IS_ERR(tlink))
+@@ -702,12 +705,12 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
+ 		}
+ 		data = (FILE_ALL_INFO *)buf;
+ 		rc = server->ops->query_path_info(xid, tcon, cifs_sb, full_path,
+-						  data, &adjust_tz);
++						  data, &adjust_tz, &symlink);
+ 	}
+ 
+ 	if (!rc) {
+-		cifs_all_info_to_fattr(&fattr, (FILE_ALL_INFO *)data, cifs_sb,
+-				       adjust_tz);
++		cifs_all_info_to_fattr(&fattr, data, cifs_sb, adjust_tz,
++				       symlink);
+ 	} else if (rc == -EREMOTE) {
+ 		cifs_create_dfs_fattr(&fattr, sb);
+ 		rc = 0;
+diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
+index 53a75f3d..5940ecab 100644
+--- a/fs/cifs/readdir.c
++++ b/fs/cifs/readdir.c
+@@ -134,22 +134,6 @@ out:
+ 	dput(dentry);
+ }
+ 
+-/*
+- * Is it possible that this directory might turn out to be a DFS referral
+- * once we go to try and use it?
+- */
+-static bool
+-cifs_dfs_is_possible(struct cifs_sb_info *cifs_sb)
+-{
+-#ifdef CONFIG_CIFS_DFS_UPCALL
+-	struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
+-
+-	if (tcon->Flags & SMB_SHARE_IS_IN_DFS)
+-		return true;
+-#endif
+-	return false;
+-}
+-
+ static void
+ cifs_fill_common_info(struct cifs_fattr *fattr, struct cifs_sb_info *cifs_sb)
+ {
+@@ -159,27 +143,19 @@ cifs_fill_common_info(struct cifs_fattr *fattr, struct cifs_sb_info *cifs_sb)
+ 	if (fattr->cf_cifsattrs & ATTR_DIRECTORY) {
+ 		fattr->cf_mode = S_IFDIR | cifs_sb->mnt_dir_mode;
+ 		fattr->cf_dtype = DT_DIR;
+-		/*
+-		 * Windows CIFS servers generally make DFS referrals look
+-		 * like directories in FIND_* responses with the reparse
+-		 * attribute flag also set (since DFS junctions are
+-		 * reparse points). We must revalidate at least these
+-		 * directory inodes before trying to use them (if
+-		 * they are DFS we will get PATH_NOT_COVERED back
+-		 * when queried directly and can then try to connect
+-		 * to the DFS target)
+-		 */
+-		if (cifs_dfs_is_possible(cifs_sb) &&
+-		    (fattr->cf_cifsattrs & ATTR_REPARSE))
+-			fattr->cf_flags |= CIFS_FATTR_NEED_REVAL;
+-	} else if (fattr->cf_cifsattrs & ATTR_REPARSE) {
+-		fattr->cf_mode = S_IFLNK;
+-		fattr->cf_dtype = DT_LNK;
+ 	} else {
+ 		fattr->cf_mode = S_IFREG | cifs_sb->mnt_file_mode;
+ 		fattr->cf_dtype = DT_REG;
+ 	}
+ 
++	/*
++	 * We need to revalidate it further to make a decision about whether it
++	 * is a symbolic link, DFS referral or a reparse point with a direct
++	 * access like junctions, deduplicated files, NFS symlinks.
++	 */
++	if (fattr->cf_cifsattrs & ATTR_REPARSE)
++		fattr->cf_flags |= CIFS_FATTR_NEED_REVAL;
++
+ 	/* non-unix readdir doesn't provide nlink */
+ 	fattr->cf_flags |= CIFS_FATTR_UNKNOWN_NLINK;
+ 
+diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
+index 8233b174..e50554b7 100644
+--- a/fs/cifs/smb1ops.c
++++ b/fs/cifs/smb1ops.c
+@@ -534,10 +534,12 @@ cifs_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon,
+ static int
+ cifs_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
+ 		     struct cifs_sb_info *cifs_sb, const char *full_path,
+-		     FILE_ALL_INFO *data, bool *adjustTZ)
++		     FILE_ALL_INFO *data, bool *adjustTZ, bool *symlink)
+ {
+ 	int rc;
+ 
++	*symlink = false;
++
+ 	/* could do find first instead but this returns more info */
+ 	rc = CIFSSMBQPathInfo(xid, tcon, full_path, data, 0 /* not legacy */,
+ 			      cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
+@@ -554,6 +556,23 @@ cifs_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
+ 						CIFS_MOUNT_MAP_SPECIAL_CHR);
+ 		*adjustTZ = true;
+ 	}
++
++	if (!rc && (le32_to_cpu(data->Attributes) & ATTR_REPARSE)) {
++		int tmprc;
++		int oplock = 0;
++		__u16 netfid;
++
++		/* Need to check if this is a symbolic link or not */
++		tmprc = CIFSSMBOpen(xid, tcon, full_path, FILE_OPEN,
++				    FILE_READ_ATTRIBUTES, 0, &netfid, &oplock,
++				    NULL, cifs_sb->local_nls,
++			cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
++		if (tmprc == -EOPNOTSUPP)
++			*symlink = true;
++		else
++			CIFSSMBClose(xid, tcon, netfid);
++	}
++
+ 	return rc;
+ }
+ 
+diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c
+index 78ff88c4..84c012a6 100644
+--- a/fs/cifs/smb2inode.c
++++ b/fs/cifs/smb2inode.c
+@@ -123,12 +123,13 @@ move_smb2_info_to_cifs(FILE_ALL_INFO *dst, struct smb2_file_all_info *src)
+ int
+ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
+ 		     struct cifs_sb_info *cifs_sb, const char *full_path,
+-		     FILE_ALL_INFO *data, bool *adjust_tz)
++		     FILE_ALL_INFO *data, bool *adjust_tz, bool *symlink)
+ {
+ 	int rc;
+ 	struct smb2_file_all_info *smb2_data;
+ 
+ 	*adjust_tz = false;
++	*symlink = false;
+ 
+ 	smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + MAX_NAME * 2,
+ 			    GFP_KERNEL);
+@@ -136,9 +137,16 @@ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
+ 		return -ENOMEM;
+ 
+ 	rc = smb2_open_op_close(xid, tcon, cifs_sb, full_path,
+-				FILE_READ_ATTRIBUTES, FILE_OPEN,
+-				OPEN_REPARSE_POINT, smb2_data,
+-				SMB2_OP_QUERY_INFO);
++				FILE_READ_ATTRIBUTES, FILE_OPEN, 0,
++				smb2_data, SMB2_OP_QUERY_INFO);
++	if (rc == -EOPNOTSUPP) {
++		*symlink = true;
++		/* Failed on a symbolic link - query a reparse point info */
++		rc = smb2_open_op_close(xid, tcon, cifs_sb, full_path,
++					FILE_READ_ATTRIBUTES, FILE_OPEN,
++					OPEN_REPARSE_POINT, smb2_data,
++					SMB2_OP_QUERY_INFO);
++	}
+ 	if (rc)
+ 		goto out;
+ 
+diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
+index e3fb4801..7db5db0e 100644
+--- a/fs/cifs/smb2proto.h
++++ b/fs/cifs/smb2proto.h
+@@ -61,7 +61,7 @@ extern void move_smb2_info_to_cifs(FILE_ALL_INFO *dst,
+ extern int smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
+ 				struct cifs_sb_info *cifs_sb,
+ 				const char *full_path, FILE_ALL_INFO *data,
+-				bool *adjust_tz);
++				bool *adjust_tz, bool *symlink);
+ extern int smb2_set_path_size(const unsigned int xid, struct cifs_tcon *tcon,
+ 			      const char *full_path, __u64 size,
+ 			      struct cifs_sb_info *cifs_sb, bool set_alloc);
+diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
+index 073d30b9..a726b9f2 100644
+--- a/fs/devpts/inode.c
++++ b/fs/devpts/inode.c
+@@ -498,6 +498,7 @@ static void devpts_kill_sb(struct super_block *sb)
+ {
+ 	struct pts_fs_info *fsi = DEVPTS_SB(sb);
+ 
++	ida_destroy(&fsi->allocated_ptys);
+ 	kfree(fsi);
+ 	kill_litter_super(sb);
+ }
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 03e9bebb..1423c481 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1352,6 +1352,7 @@ retry:
+ 					new_extra_isize = s_min_extra_isize;
+ 					kfree(is); is = NULL;
+ 					kfree(bs); bs = NULL;
++					brelse(bh);
+ 					goto retry;
+ 				}
+ 				error = -1;
+diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
+index 968d4c56..12987666 100644
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -1168,8 +1168,11 @@ static int gfs2_atomic_open(struct inode *dir, struct dentry *dentry,
+ 	if (d != NULL)
+ 		dentry = d;
+ 	if (dentry->d_inode) {
+-		if (!(*opened & FILE_OPENED))
++		if (!(*opened & FILE_OPENED)) {
++			if (d == NULL)
++				dget(dentry);
+ 			return finish_no_open(file, dentry);
++		}
+ 		dput(d);
+ 		return 0;
+ 	}
+diff --git a/fs/namei.c b/fs/namei.c
+index caa28051..23ac50f4 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -2468,6 +2468,7 @@ static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
+  */
+ static inline int may_create(struct inode *dir, struct dentry *child)
+ {
++	audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
+ 	if (child->d_inode)
+ 		return -EEXIST;
+ 	if (IS_DEADDIR(dir))
+diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
+index d9019821..26115778 100644
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -100,6 +100,7 @@ enum acpi_hotplug_mode {
+ struct acpi_hotplug_profile {
+ 	struct kobject kobj;
+ 	bool enabled:1;
++	bool ignore:1;
+ 	enum acpi_hotplug_mode mode;
+ };
+ 
+diff --git a/include/linux/mfd/rtsx_pci.h b/include/linux/mfd/rtsx_pci.h
+index d1382dfb..0ce77210 100644
+--- a/include/linux/mfd/rtsx_pci.h
++++ b/include/linux/mfd/rtsx_pci.h
+@@ -756,6 +756,59 @@
+ #define PCR_SETTING_REG2		0x814
+ #define PCR_SETTING_REG3		0x747
+ 
++/* Phy bits */
++#define PHY_PCR_FORCE_CODE			0xB000
++#define PHY_PCR_OOBS_CALI_50			0x0800
++#define PHY_PCR_OOBS_VCM_08			0x0200
++#define PHY_PCR_OOBS_SEN_90			0x0040
++#define PHY_PCR_RSSI_EN				0x0002
++
++#define PHY_RCR1_ADP_TIME			0x0100
++#define PHY_RCR1_VCO_COARSE			0x001F
++
++#define PHY_RCR2_EMPHASE_EN			0x8000
++#define PHY_RCR2_NADJR				0x4000
++#define PHY_RCR2_CDR_CP_10			0x0400
++#define PHY_RCR2_CDR_SR_2			0x0100
++#define PHY_RCR2_FREQSEL_12			0x0040
++#define PHY_RCR2_CPADJEN			0x0020
++#define PHY_RCR2_CDR_SC_8			0x0008
++#define PHY_RCR2_CALIB_LATE			0x0002
++
++#define PHY_RDR_RXDSEL_1_9			0x4000
++
++#define PHY_TUNE_TUNEREF_1_0			0x4000
++#define PHY_TUNE_VBGSEL_1252			0x0C00
++#define PHY_TUNE_SDBUS_33			0x0200
++#define PHY_TUNE_TUNED18			0x01C0
++#define PHY_TUNE_TUNED12			0X0020
++
++#define PHY_BPCR_IBRXSEL			0x0400
++#define PHY_BPCR_IBTXSEL			0x0100
++#define PHY_BPCR_IB_FILTER			0x0080
++#define PHY_BPCR_CMIRROR_EN			0x0040
++
++#define PHY_REG_REV_RESV			0xE000
++#define PHY_REG_REV_RXIDLE_LATCHED		0x1000
++#define PHY_REG_REV_P1_EN			0x0800
++#define PHY_REG_REV_RXIDLE_EN			0x0400
++#define PHY_REG_REV_CLKREQ_DLY_TIMER_1_0	0x0040
++#define PHY_REG_REV_STOP_CLKRD			0x0020
++#define PHY_REG_REV_RX_PWST			0x0008
++#define PHY_REG_REV_STOP_CLKWR			0x0004
++
++#define PHY_FLD3_TIMER_4			0x7800
++#define PHY_FLD3_TIMER_6			0x00E0
++#define PHY_FLD3_RXDELINK			0x0004
++
++#define PHY_FLD4_FLDEN_SEL			0x4000
++#define PHY_FLD4_REQ_REF			0x2000
++#define PHY_FLD4_RXAMP_OFF			0x1000
++#define PHY_FLD4_REQ_ADDA			0x0800
++#define PHY_FLD4_BER_COUNT			0x00E0
++#define PHY_FLD4_BER_TIMER			0x000A
++#define PHY_FLD4_BER_CHK_EN			0x0001
++
+ #define rtsx_pci_init_cmd(pcr)		((pcr)->ci = 0)
+ 
+ struct rtsx_pcr;
+diff --git a/include/linux/msg.h b/include/linux/msg.h
+index 391af8d1..e21f9d44 100644
+--- a/include/linux/msg.h
++++ b/include/linux/msg.h
+@@ -6,9 +6,9 @@
+ 
+ /* one msg_msg structure for each message */
+ struct msg_msg {
+-	struct list_head m_list; 
+-	long  m_type;          
+-	int m_ts;           /* message text size */
++	struct list_head m_list;
++	long m_type;
++	size_t m_ts;		/* message text size */
+ 	struct msg_msgseg* next;
+ 	void *security;
+ 	/* the actual message follows immediately */
+diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h
+index 4b02512e..5f487d77 100644
+--- a/include/linux/mtd/map.h
++++ b/include/linux/mtd/map.h
+@@ -365,7 +365,7 @@ static inline map_word map_word_load_partial(struct map_info *map, map_word orig
+ 			bitpos = (map_bankwidth(map)-1-i)*8;
+ #endif
+ 			orig.x[0] &= ~(0xff << bitpos);
+-			orig.x[0] |= buf[i-start] << bitpos;
++			orig.x[0] |= (unsigned long)buf[i-start] << bitpos;
+ 		}
+ 	}
+ 	return orig;
+@@ -384,7 +384,7 @@ static inline map_word map_word_ff(struct map_info *map)
+ 
+ 	if (map_bankwidth(map) < MAP_FF_LIMIT) {
+ 		int bw = 8 * map_bankwidth(map);
+-		r.x[0] = (1 << bw) - 1;
++		r.x[0] = (1UL << bw) - 1;
+ 	} else {
+ 		for (i=0; i<map_words(map); i++)
+ 			r.x[i] = ~0UL;
+diff --git a/include/linux/rbtree.h b/include/linux/rbtree.h
+index aa870a4d..57e75ae9 100644
+--- a/include/linux/rbtree.h
++++ b/include/linux/rbtree.h
+@@ -85,6 +85,11 @@ static inline void rb_link_node(struct rb_node * node, struct rb_node * parent,
+ 	*rb_link = node;
+ }
+ 
++#define rb_entry_safe(ptr, type, member) \
++	({ typeof(ptr) ____ptr = (ptr); \
++	   ____ptr ? rb_entry(____ptr, type, member) : NULL; \
++	})
++
+ /**
+  * rbtree_postorder_for_each_entry_safe - iterate over rb_root in post order of
+  * given type safe against removal of rb_node entry
+@@ -95,12 +100,9 @@ static inline void rb_link_node(struct rb_node * node, struct rb_node * parent,
+  * @field:	the name of the rb_node field within 'type'.
+  */
+ #define rbtree_postorder_for_each_entry_safe(pos, n, root, field) \
+-	for (pos = rb_entry(rb_first_postorder(root), typeof(*pos), field),\
+-		n = rb_entry(rb_next_postorder(&pos->field), \
+-			typeof(*pos), field); \
+-	     &pos->field; \
+-	     pos = n, \
+-		n = rb_entry(rb_next_postorder(&pos->field), \
+-			typeof(*pos), field))
++	for (pos = rb_entry_safe(rb_first_postorder(root), typeof(*pos), field); \
++	     pos && ({ n = rb_entry_safe(rb_next_postorder(&pos->field), \
++			typeof(*pos), field); 1; }); \
++	     pos = n)
+ 
+ #endif	/* _LINUX_RBTREE_H */
+diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
+index 5c7ab17c..712ea360 100644
+--- a/include/trace/ftrace.h
++++ b/include/trace/ftrace.h
+@@ -372,7 +372,8 @@ ftrace_define_fields_##call(struct ftrace_event_call *event_call)	\
+ 	__data_size += (len) * sizeof(type);
+ 
+ #undef __string
+-#define __string(item, src) __dynamic_array(char, item, strlen(src) + 1)
++#define __string(item, src) __dynamic_array(char, item,			\
++		    strlen((src) ? (const char *)(src) : "(null)") + 1)
+ 
+ #undef DECLARE_EVENT_CLASS
+ #define DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print)	\
+@@ -502,7 +503,7 @@ static inline notrace int ftrace_get_offsets_##call(			\
+ 
+ #undef __assign_str
+ #define __assign_str(dst, src)						\
+-	strcpy(__get_str(dst), src);
++	strcpy(__get_str(dst), (src) ? (const char *)(src) : "(null)");
+ 
+ #undef TP_fast_assign
+ #define TP_fast_assign(args...) args
+diff --git a/ipc/msgutil.c b/ipc/msgutil.c
+index 491e71f2..7e709597 100644
+--- a/ipc/msgutil.c
++++ b/ipc/msgutil.c
+@@ -41,15 +41,15 @@ struct msg_msgseg {
+ 	/* the next part of the message follows immediately */
+ };
+ 
+-#define DATALEN_MSG	(int)(PAGE_SIZE-sizeof(struct msg_msg))
+-#define DATALEN_SEG	(int)(PAGE_SIZE-sizeof(struct msg_msgseg))
++#define DATALEN_MSG	((size_t)PAGE_SIZE-sizeof(struct msg_msg))
++#define DATALEN_SEG	((size_t)PAGE_SIZE-sizeof(struct msg_msgseg))
+ 
+ 
+-static struct msg_msg *alloc_msg(int len)
++static struct msg_msg *alloc_msg(size_t len)
+ {
+ 	struct msg_msg *msg;
+ 	struct msg_msgseg **pseg;
+-	int alen;
++	size_t alen;
+ 
+ 	alen = min(len, DATALEN_MSG);
+ 	msg = kmalloc(sizeof(*msg) + alen, GFP_KERNEL);
+@@ -80,12 +80,12 @@ out_err:
+ 	return NULL;
+ }
+ 
+-struct msg_msg *load_msg(const void __user *src, int len)
++struct msg_msg *load_msg(const void __user *src, size_t len)
+ {
+ 	struct msg_msg *msg;
+ 	struct msg_msgseg *seg;
+ 	int err = -EFAULT;
+-	int alen;
++	size_t alen;
+ 
+ 	msg = alloc_msg(len);
+ 	if (msg == NULL)
+@@ -117,8 +117,8 @@ out_err:
+ struct msg_msg *copy_msg(struct msg_msg *src, struct msg_msg *dst)
+ {
+ 	struct msg_msgseg *dst_pseg, *src_pseg;
+-	int len = src->m_ts;
+-	int alen;
++	size_t len = src->m_ts;
++	size_t alen;
+ 
+ 	BUG_ON(dst == NULL);
+ 	if (src->m_ts > dst->m_ts)
+@@ -147,9 +147,9 @@ struct msg_msg *copy_msg(struct msg_msg *src, struct msg_msg *dst)
+ 	return ERR_PTR(-ENOSYS);
+ }
+ #endif
+-int store_msg(void __user *dest, struct msg_msg *msg, int len)
++int store_msg(void __user *dest, struct msg_msg *msg, size_t len)
+ {
+-	int alen;
++	size_t alen;
+ 	struct msg_msgseg *seg;
+ 
+ 	alen = min(len, DATALEN_MSG);
+diff --git a/ipc/util.h b/ipc/util.h
+index f2f5036f..59d78aa9 100644
+--- a/ipc/util.h
++++ b/ipc/util.h
+@@ -148,9 +148,9 @@ int ipc_parse_version (int *cmd);
+ #endif
+ 
+ extern void free_msg(struct msg_msg *msg);
+-extern struct msg_msg *load_msg(const void __user *src, int len);
++extern struct msg_msg *load_msg(const void __user *src, size_t len);
+ extern struct msg_msg *copy_msg(struct msg_msg *src, struct msg_msg *dst);
+-extern int store_msg(void __user *dest, struct msg_msg *msg, int len);
++extern int store_msg(void __user *dest, struct msg_msg *msg, size_t len);
+ 
+ extern void recompute_msgmni(struct ipc_namespace *);
+ 
+diff --git a/kernel/audit.c b/kernel/audit.c
+index 7b0e23a7..7ddfd8a0 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -613,7 +613,7 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type)
+ 	int rc = 0;
+ 	uid_t uid = from_kuid(&init_user_ns, current_uid());
+ 
+-	if (!audit_enabled) {
++	if (!audit_enabled && msg_type != AUDIT_USER_AVC) {
+ 		*ab = NULL;
+ 		return rc;
+ 	}
+@@ -659,6 +659,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 
+ 	switch (msg_type) {
+ 	case AUDIT_GET:
++		status_set.mask		 = 0;
+ 		status_set.enabled	 = audit_enabled;
+ 		status_set.failure	 = audit_failure;
+ 		status_set.pid		 = audit_pid;
+@@ -670,7 +671,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 				 &status_set, sizeof(status_set));
+ 		break;
+ 	case AUDIT_SET:
+-		if (nlh->nlmsg_len < sizeof(struct audit_status))
++		if (nlmsg_len(nlh) < sizeof(struct audit_status))
+ 			return -EINVAL;
+ 		status_get   = (struct audit_status *)data;
+ 		if (status_get->mask & AUDIT_STATUS_ENABLED) {
+@@ -832,7 +833,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 
+ 		memset(&s, 0, sizeof(s));
+ 		/* guard against past and future API changes */
+-		memcpy(&s, data, min(sizeof(s), (size_t)nlh->nlmsg_len));
++		memcpy(&s, data, min_t(size_t, sizeof(s), nlmsg_len(nlh)));
+ 		if ((s.enabled != 0 && s.enabled != 1) ||
+ 		    (s.log_passwd != 0 && s.log_passwd != 1))
+ 			return -EINVAL;
+@@ -1536,6 +1537,26 @@ void audit_log_name(struct audit_context *context, struct audit_names *n,
+ 		}
+ 	}
+ 
++	/* log the audit_names record type */
++	audit_log_format(ab, " nametype=");
++	switch(n->type) {
++	case AUDIT_TYPE_NORMAL:
++		audit_log_format(ab, "NORMAL");
++		break;
++	case AUDIT_TYPE_PARENT:
++		audit_log_format(ab, "PARENT");
++		break;
++	case AUDIT_TYPE_CHILD_DELETE:
++		audit_log_format(ab, "DELETE");
++		break;
++	case AUDIT_TYPE_CHILD_CREATE:
++		audit_log_format(ab, "CREATE");
++		break;
++	default:
++		audit_log_format(ab, "UNKNOWN");
++		break;
++	}
++
+ 	audit_log_fcaps(ab, n);
+ 	audit_log_end(ab);
+ }
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index 8bd9cfdc..5c9127dc 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -90,6 +90,14 @@ static DEFINE_MUTEX(cgroup_mutex);
+ static DEFINE_MUTEX(cgroup_root_mutex);
+ 
+ /*
++ * cgroup destruction makes heavy use of work items and there can be a lot
++ * of concurrent destructions.  Use a separate workqueue so that cgroup
++ * destruction work items don't end up filling up max_active of system_wq
++ * which may lead to deadlock.
++ */
++static struct workqueue_struct *cgroup_destroy_wq;
++
++/*
+  * Generate an array of cgroup subsystem pointers. At boot time, this is
+  * populated with the built in subsystems, and modular subsystems are
+  * registered after that. The mutable section of this array is protected by
+@@ -223,6 +231,7 @@ static void cgroup_destroy_css_killed(struct cgroup *cgrp);
+ static int cgroup_destroy_locked(struct cgroup *cgrp);
+ static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[],
+ 			      bool is_add);
++static int cgroup_file_release(struct inode *inode, struct file *file);
+ 
+ /**
+  * cgroup_css - obtain a cgroup's css for the specified subsystem
+@@ -908,7 +917,7 @@ static void cgroup_free_rcu(struct rcu_head *head)
+ 	struct cgroup *cgrp = container_of(head, struct cgroup, rcu_head);
+ 
+ 	INIT_WORK(&cgrp->destroy_work, cgroup_free_fn);
+-	schedule_work(&cgrp->destroy_work);
++	queue_work(cgroup_destroy_wq, &cgrp->destroy_work);
+ }
+ 
+ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
+@@ -2463,7 +2472,7 @@ static const struct file_operations cgroup_seqfile_operations = {
+ 	.read = seq_read,
+ 	.write = cgroup_file_write,
+ 	.llseek = seq_lseek,
+-	.release = single_release,
++	.release = cgroup_file_release,
+ };
+ 
+ static int cgroup_file_open(struct inode *inode, struct file *file)
+@@ -2524,6 +2533,8 @@ static int cgroup_file_release(struct inode *inode, struct file *file)
+ 		ret = cft->release(inode, file);
+ 	if (css->ss)
+ 		css_put(css);
++	if (file->f_op == &cgroup_seqfile_operations)
++		single_release(inode, file);
+ 	return ret;
+ }
+ 
+@@ -4306,7 +4317,7 @@ static void css_free_rcu_fn(struct rcu_head *rcu_head)
+ 	 * css_put().  dput() requires process context which we don't have.
+ 	 */
+ 	INIT_WORK(&css->destroy_work, css_free_work_fn);
+-	schedule_work(&css->destroy_work);
++	queue_work(cgroup_destroy_wq, &css->destroy_work);
+ }
+ 
+ static void css_release(struct percpu_ref *ref)
+@@ -4603,7 +4614,7 @@ static void css_killed_ref_fn(struct percpu_ref *ref)
+ 		container_of(ref, struct cgroup_subsys_state, refcnt);
+ 
+ 	INIT_WORK(&css->destroy_work, css_killed_work_fn);
+-	schedule_work(&css->destroy_work);
++	queue_work(cgroup_destroy_wq, &css->destroy_work);
+ }
+ 
+ /**
+@@ -5139,6 +5150,22 @@ out:
+ 	return err;
+ }
+ 
++static int __init cgroup_wq_init(void)
++{
++	/*
++	 * There isn't much point in executing destruction path in
++	 * parallel.  Good chunk is serialized with cgroup_mutex anyway.
++	 * Use 1 for @max_active.
++	 *
++	 * We would prefer to do this in cgroup_init() above, but that
++	 * is called before init_workqueues(): so leave this until after.
++	 */
++	cgroup_destroy_wq = alloc_workqueue("cgroup_destroy", 0, 1);
++	BUG_ON(!cgroup_destroy_wq);
++	return 0;
++}
++core_initcall(cgroup_wq_init);
++
+ /*
+  * proc_cgroup_show()
+  *  - Print task's cgroup paths into seq_file, one line for each hierarchy
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index 6bf981e1..4772034b 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -1033,8 +1033,10 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
+ 	need_loop = task_has_mempolicy(tsk) ||
+ 			!nodes_intersects(*newmems, tsk->mems_allowed);
+ 
+-	if (need_loop)
++	if (need_loop) {
++		local_irq_disable();
+ 		write_seqcount_begin(&tsk->mems_allowed_seq);
++	}
+ 
+ 	nodes_or(tsk->mems_allowed, tsk->mems_allowed, *newmems);
+ 	mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP1);
+@@ -1042,8 +1044,10 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
+ 	mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP2);
+ 	tsk->mems_allowed = *newmems;
+ 
+-	if (need_loop)
++	if (need_loop) {
+ 		write_seqcount_end(&tsk->mems_allowed_seq);
++		local_irq_enable();
++	}
+ 
+ 	task_unlock(tsk);
+ }
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 514bcfd8..3e59f951 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -956,7 +956,7 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
+ 			goto out_mput;
+ 		}
+ 
+-		sched_setscheduler(t, SCHED_FIFO, &param);
++		sched_setscheduler_nocheck(t, SCHED_FIFO, &param);
+ 
+ 		/*
+ 		 * We keep the reference to the task struct even if
+diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
+index 98c3b34a..b38109e2 100644
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -792,7 +792,8 @@ void free_basic_memory_bitmaps(void)
+ {
+ 	struct memory_bitmap *bm1, *bm2;
+ 
+-	BUG_ON(!(forbidden_pages_map && free_pages_map));
++	if (WARN_ON(!(forbidden_pages_map && free_pages_map)))
++		return;
+ 
+ 	bm1 = forbidden_pages_map;
+ 	bm2 = free_pages_map;
+@@ -1402,7 +1403,11 @@ int hibernate_preallocate_memory(void)
+ 	 * highmem and non-highmem zones separately.
+ 	 */
+ 	pages_highmem = preallocate_image_highmem(highmem / 2);
+-	alloc = (count - max_size) - pages_highmem;
++	alloc = count - max_size;
++	if (alloc > pages_highmem)
++		alloc -= pages_highmem;
++	else
++		alloc = 0;
+ 	pages = preallocate_image_memory(alloc, avail_normal);
+ 	if (pages < alloc) {
+ 		/* We have exhausted non-highmem pages, try highmem. */
+diff --git a/kernel/power/user.c b/kernel/power/user.c
+index 957f0616..ffc931c3 100644
+--- a/kernel/power/user.c
++++ b/kernel/power/user.c
+@@ -70,6 +70,7 @@ static int snapshot_open(struct inode *inode, struct file *filp)
+ 		data->swap = swsusp_resume_device ?
+ 			swap_type_of(swsusp_resume_device, 0, NULL) : -1;
+ 		data->mode = O_RDONLY;
++		data->free_bitmaps = false;
+ 		error = pm_notifier_call_chain(PM_HIBERNATION_PREPARE);
+ 		if (error)
+ 			pm_notifier_call_chain(PM_POST_HIBERNATION);
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index eec50fce..88c9c65a 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -490,7 +490,7 @@ static int alarm_clock_getres(const clockid_t which_clock, struct timespec *tp)
+ 	clockid_t baseid = alarm_bases[clock2alarm(which_clock)].base_clockid;
+ 
+ 	if (!alarmtimer_get_rtcdev())
+-		return -ENOTSUPP;
++		return -EINVAL;
+ 
+ 	return hrtimer_get_res(baseid, tp);
+ }
+@@ -507,7 +507,7 @@ static int alarm_clock_get(clockid_t which_clock, struct timespec *tp)
+ 	struct alarm_base *base = &alarm_bases[clock2alarm(which_clock)];
+ 
+ 	if (!alarmtimer_get_rtcdev())
+-		return -ENOTSUPP;
++		return -EINVAL;
+ 
+ 	*tp = ktime_to_timespec(base->gettime());
+ 	return 0;
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 03cf44ac..f3bd09ee 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -367,9 +367,6 @@ static int remove_ftrace_list_ops(struct ftrace_ops **list,
+ 
+ static int __register_ftrace_function(struct ftrace_ops *ops)
+ {
+-	if (unlikely(ftrace_disabled))
+-		return -ENODEV;
+-
+ 	if (FTRACE_WARN_ON(ops == &global_ops))
+ 		return -EINVAL;
+ 
+@@ -428,9 +425,6 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops)
+ {
+ 	int ret;
+ 
+-	if (ftrace_disabled)
+-		return -ENODEV;
+-
+ 	if (WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED)))
+ 		return -EBUSY;
+ 
+@@ -2088,10 +2082,15 @@ static void ftrace_startup_enable(int command)
+ static int ftrace_startup(struct ftrace_ops *ops, int command)
+ {
+ 	bool hash_enable = true;
++	int ret;
+ 
+ 	if (unlikely(ftrace_disabled))
+ 		return -ENODEV;
+ 
++	ret = __register_ftrace_function(ops);
++	if (ret)
++		return ret;
++
+ 	ftrace_start_up++;
+ 	command |= FTRACE_UPDATE_CALLS;
+ 
+@@ -2113,12 +2112,17 @@ static int ftrace_startup(struct ftrace_ops *ops, int command)
+ 	return 0;
+ }
+ 
+-static void ftrace_shutdown(struct ftrace_ops *ops, int command)
++static int ftrace_shutdown(struct ftrace_ops *ops, int command)
+ {
+ 	bool hash_disable = true;
++	int ret;
+ 
+ 	if (unlikely(ftrace_disabled))
+-		return;
++		return -ENODEV;
++
++	ret = __unregister_ftrace_function(ops);
++	if (ret)
++		return ret;
+ 
+ 	ftrace_start_up--;
+ 	/*
+@@ -2153,9 +2157,10 @@ static void ftrace_shutdown(struct ftrace_ops *ops, int command)
+ 	}
+ 
+ 	if (!command || !ftrace_enabled)
+-		return;
++		return 0;
+ 
+ 	ftrace_run_update_code(command);
++	return 0;
+ }
+ 
+ static void ftrace_startup_sysctl(void)
+@@ -3060,16 +3065,13 @@ static void __enable_ftrace_function_probe(void)
+ 	if (i == FTRACE_FUNC_HASHSIZE)
+ 		return;
+ 
+-	ret = __register_ftrace_function(&trace_probe_ops);
+-	if (!ret)
+-		ret = ftrace_startup(&trace_probe_ops, 0);
++	ret = ftrace_startup(&trace_probe_ops, 0);
+ 
+ 	ftrace_probe_registered = 1;
+ }
+ 
+ static void __disable_ftrace_function_probe(void)
+ {
+-	int ret;
+ 	int i;
+ 
+ 	if (!ftrace_probe_registered)
+@@ -3082,9 +3084,7 @@ static void __disable_ftrace_function_probe(void)
+ 	}
+ 
+ 	/* no more funcs left */
+-	ret = __unregister_ftrace_function(&trace_probe_ops);
+-	if (!ret)
+-		ftrace_shutdown(&trace_probe_ops, 0);
++	ftrace_shutdown(&trace_probe_ops, 0);
+ 
+ 	ftrace_probe_registered = 0;
+ }
+@@ -4290,12 +4290,15 @@ core_initcall(ftrace_nodyn_init);
+ static inline int ftrace_init_dyn_debugfs(struct dentry *d_tracer) { return 0; }
+ static inline void ftrace_startup_enable(int command) { }
+ /* Keep as macros so we do not need to define the commands */
+-# define ftrace_startup(ops, command)			\
+-	({						\
+-		(ops)->flags |= FTRACE_OPS_FL_ENABLED;	\
+-		0;					\
++# define ftrace_startup(ops, command)					\
++	({								\
++		int ___ret = __register_ftrace_function(ops);		\
++		if (!___ret)						\
++			(ops)->flags |= FTRACE_OPS_FL_ENABLED;		\
++		___ret;							\
+ 	})
+-# define ftrace_shutdown(ops, command)	do { } while (0)
++# define ftrace_shutdown(ops, command) __unregister_ftrace_function(ops)
++
+ # define ftrace_startup_sysctl()	do { } while (0)
+ # define ftrace_shutdown_sysctl()	do { } while (0)
+ 
+@@ -4695,9 +4698,7 @@ int register_ftrace_function(struct ftrace_ops *ops)
+ 
+ 	mutex_lock(&ftrace_lock);
+ 
+-	ret = __register_ftrace_function(ops);
+-	if (!ret)
+-		ret = ftrace_startup(ops, 0);
++	ret = ftrace_startup(ops, 0);
+ 
+ 	mutex_unlock(&ftrace_lock);
+ 
+@@ -4716,9 +4717,7 @@ int unregister_ftrace_function(struct ftrace_ops *ops)
+ 	int ret;
+ 
+ 	mutex_lock(&ftrace_lock);
+-	ret = __unregister_ftrace_function(ops);
+-	if (!ret)
+-		ftrace_shutdown(ops, 0);
++	ret = ftrace_shutdown(ops, 0);
+ 	mutex_unlock(&ftrace_lock);
+ 
+ 	return ret;
+@@ -4912,6 +4911,13 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
+ 	return NOTIFY_DONE;
+ }
+ 
++/* Just a place holder for function graph */
++static struct ftrace_ops fgraph_ops __read_mostly = {
++	.func		= ftrace_stub,
++	.flags		= FTRACE_OPS_FL_STUB | FTRACE_OPS_FL_GLOBAL |
++				FTRACE_OPS_FL_RECURSION_SAFE,
++};
++
+ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
+ 			trace_func_graph_ent_t entryfunc)
+ {
+@@ -4938,7 +4944,7 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
+ 	ftrace_graph_return = retfunc;
+ 	ftrace_graph_entry = entryfunc;
+ 
+-	ret = ftrace_startup(&global_ops, FTRACE_START_FUNC_RET);
++	ret = ftrace_startup(&fgraph_ops, FTRACE_START_FUNC_RET);
+ 
+ out:
+ 	mutex_unlock(&ftrace_lock);
+@@ -4955,7 +4961,7 @@ void unregister_ftrace_graph(void)
+ 	ftrace_graph_active--;
+ 	ftrace_graph_return = (trace_func_graph_ret_t)ftrace_stub;
+ 	ftrace_graph_entry = ftrace_graph_entry_stub;
+-	ftrace_shutdown(&global_ops, FTRACE_STOP_FUNC_RET);
++	ftrace_shutdown(&fgraph_ops, FTRACE_STOP_FUNC_RET);
+ 	unregister_pm_notifier(&ftrace_suspend_notifier);
+ 	unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL);
+ 
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 987293d0..93c26528 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -305,6 +305,9 @@ static DEFINE_HASHTABLE(unbound_pool_hash, UNBOUND_POOL_HASH_ORDER);
+ /* I: attributes used when instantiating standard unbound pools on demand */
+ static struct workqueue_attrs *unbound_std_wq_attrs[NR_STD_WORKER_POOLS];
+ 
++/* I: attributes used when instantiating ordered pools on demand */
++static struct workqueue_attrs *ordered_wq_attrs[NR_STD_WORKER_POOLS];
++
+ struct workqueue_struct *system_wq __read_mostly;
+ EXPORT_SYMBOL(system_wq);
+ struct workqueue_struct *system_highpri_wq __read_mostly;
+@@ -4106,7 +4109,7 @@ out_unlock:
+ static int alloc_and_link_pwqs(struct workqueue_struct *wq)
+ {
+ 	bool highpri = wq->flags & WQ_HIGHPRI;
+-	int cpu;
++	int cpu, ret;
+ 
+ 	if (!(wq->flags & WQ_UNBOUND)) {
+ 		wq->cpu_pwqs = alloc_percpu(struct pool_workqueue);
+@@ -4126,6 +4129,13 @@ static int alloc_and_link_pwqs(struct workqueue_struct *wq)
+ 			mutex_unlock(&wq->mutex);
+ 		}
+ 		return 0;
++	} else if (wq->flags & __WQ_ORDERED) {
++		ret = apply_workqueue_attrs(wq, ordered_wq_attrs[highpri]);
++		/* there should only be single pwq for ordering guarantee */
++		WARN(!ret && (wq->pwqs.next != &wq->dfl_pwq->pwqs_node ||
++			      wq->pwqs.prev != &wq->dfl_pwq->pwqs_node),
++		     "ordering guarantee broken for workqueue %s\n", wq->name);
++		return ret;
+ 	} else {
+ 		return apply_workqueue_attrs(wq, unbound_std_wq_attrs[highpri]);
+ 	}
+@@ -5051,13 +5061,23 @@ static int __init init_workqueues(void)
+ 		}
+ 	}
+ 
+-	/* create default unbound wq attrs */
++	/* create default unbound and ordered wq attrs */
+ 	for (i = 0; i < NR_STD_WORKER_POOLS; i++) {
+ 		struct workqueue_attrs *attrs;
+ 
+ 		BUG_ON(!(attrs = alloc_workqueue_attrs(GFP_KERNEL)));
+ 		attrs->nice = std_nice[i];
+ 		unbound_std_wq_attrs[i] = attrs;
++
++		/*
++		 * An ordered wq should have only one pwq as ordering is
++		 * guaranteed by max_active which is enforced by pwqs.
++		 * Turn off NUMA so that dfl_pwq is used for all nodes.
++		 */
++		BUG_ON(!(attrs = alloc_workqueue_attrs(GFP_KERNEL)));
++		attrs->nice = std_nice[i];
++		attrs->no_numa = true;
++		ordered_wq_attrs[i] = attrs;
+ 	}
+ 
+ 	system_wq = alloc_workqueue("events", 0, 0);
+diff --git a/lib/vsprintf.c b/lib/vsprintf.c
+index 26559bdb..d76555c4 100644
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -27,6 +27,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/ioport.h>
+ #include <linux/dcache.h>
++#include <linux/cred.h>
+ #include <net/addrconf.h>
+ 
+ #include <asm/page.h>		/* for PAGE_SIZE */
+@@ -1312,11 +1313,37 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
+ 				spec.field_width = default_width;
+ 			return string(buf, end, "pK-error", spec);
+ 		}
+-		if (!((kptr_restrict == 0) ||
+-		      (kptr_restrict == 1 &&
+-		       has_capability_noaudit(current, CAP_SYSLOG))))
++
++		switch (kptr_restrict) {
++		case 0:
++			/* Always print %pK values */
++			break;
++		case 1: {
++			/*
++			 * Only print the real pointer value if the current
++			 * process has CAP_SYSLOG and is running with the
++			 * same credentials it started with. This is because
++			 * access to files is checked at open() time, but %pK
++			 * checks permission at read() time. We don't want to
++			 * leak pointer values if a binary opens a file using
++			 * %pK and then elevates privileges before reading it.
++			 */
++			const struct cred *cred = current_cred();
++
++			if (!has_capability_noaudit(current, CAP_SYSLOG) ||
++			    !uid_eq(cred->euid, cred->uid) ||
++			    !gid_eq(cred->egid, cred->gid))
++				ptr = NULL;
++			break;
++		}
++		case 2:
++		default:
++			/* Always print 0's for %pK */
+ 			ptr = NULL;
++			break;
++		}
+ 		break;
++
+ 	case 'N':
+ 		switch (fmt[1]) {
+ 		case 'F':
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 9d548512..362e5f13 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1856,7 +1856,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ 	struct vm_area_struct *vma;
+ 	struct vm_unmapped_area_info info;
+ 
+-	if (len > TASK_SIZE)
++	if (len > TASK_SIZE - mmap_min_addr)
+ 		return -ENOMEM;
+ 
+ 	if (flags & MAP_FIXED)
+@@ -1865,7 +1865,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+-		if (TASK_SIZE - len >= addr &&
++		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
+ 		    (!vma || addr + len <= vma->vm_start))
+ 			return addr;
+ 	}
+@@ -1895,7 +1895,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 	struct vm_unmapped_area_info info;
+ 
+ 	/* requested length too big for entire address space */
+-	if (len > TASK_SIZE)
++	if (len > TASK_SIZE - mmap_min_addr)
+ 		return -ENOMEM;
+ 
+ 	if (flags & MAP_FIXED)
+@@ -1905,14 +1905,14 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+-		if (TASK_SIZE - len >= addr &&
++		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
+ 				(!vma || addr + len <= vma->vm_start))
+ 			return addr;
+ 	}
+ 
+ 	info.flags = VM_UNMAPPED_AREA_TOPDOWN;
+ 	info.length = len;
+-	info.low_limit = PAGE_SIZE;
++	info.low_limit = max(PAGE_SIZE, mmap_min_addr);
+ 	info.high_limit = mm->mmap_base;
+ 	info.align_mask = 0;
+ 	addr = vm_unmapped_area(&info);
+diff --git a/mm/zswap.c b/mm/zswap.c
+index d93510c6..6b862518 100644
+--- a/mm/zswap.c
++++ b/mm/zswap.c
+@@ -387,7 +387,7 @@ static void zswap_free_entry(struct zswap_tree *tree, struct zswap_entry *entry)
+ enum zswap_get_swap_ret {
+ 	ZSWAP_SWAPCACHE_NEW,
+ 	ZSWAP_SWAPCACHE_EXIST,
+-	ZSWAP_SWAPCACHE_NOMEM
++	ZSWAP_SWAPCACHE_FAIL,
+ };
+ 
+ /*
+@@ -401,9 +401,10 @@ enum zswap_get_swap_ret {
+  * added to the swap cache, and returned in retpage.
+  *
+  * If success, the swap cache page is returned in retpage
+- * Returns 0 if page was already in the swap cache, page is not locked
+- * Returns 1 if the new page needs to be populated, page is locked
+- * Returns <0 on error
++ * Returns ZSWAP_SWAPCACHE_EXIST if page was already in the swap cache
++ * Returns ZSWAP_SWAPCACHE_NEW if the new page needs to be populated,
++ *     the new page is added to swapcache and locked
++ * Returns ZSWAP_SWAPCACHE_FAIL on error
+  */
+ static int zswap_get_swap_cache_page(swp_entry_t entry,
+ 				struct page **retpage)
+@@ -475,7 +476,7 @@ static int zswap_get_swap_cache_page(swp_entry_t entry,
+ 	if (new_page)
+ 		page_cache_release(new_page);
+ 	if (!found_page)
+-		return ZSWAP_SWAPCACHE_NOMEM;
++		return ZSWAP_SWAPCACHE_FAIL;
+ 	*retpage = found_page;
+ 	return ZSWAP_SWAPCACHE_EXIST;
+ }
+@@ -529,11 +530,11 @@ static int zswap_writeback_entry(struct zbud_pool *pool, unsigned long handle)
+ 
+ 	/* try to allocate swap cache page */
+ 	switch (zswap_get_swap_cache_page(swpentry, &page)) {
+-	case ZSWAP_SWAPCACHE_NOMEM: /* no memory */
++	case ZSWAP_SWAPCACHE_FAIL: /* no memory or invalidate happened */
+ 		ret = -ENOMEM;
+ 		goto fail;
+ 
+-	case ZSWAP_SWAPCACHE_EXIST: /* page is unlocked */
++	case ZSWAP_SWAPCACHE_EXIST:
+ 		/* page is already in the swap cache, ignore for now */
+ 		page_cache_release(page);
+ 		ret = -EEXIST;
+@@ -591,7 +592,12 @@ static int zswap_writeback_entry(struct zbud_pool *pool, unsigned long handle)
+ 
+ fail:
+ 	spin_lock(&tree->lock);
+-	zswap_entry_put(entry);
++	refcount = zswap_entry_put(entry);
++	if (refcount <= 0) {
++		/* invalidate happened, consider writeback as success */
++		zswap_free_entry(tree, entry);
++		ret = 0;
++	}
+ 	spin_unlock(&tree->lock);
+ 	return ret;
+ }
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index eeb71480..d4397eba 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -254,10 +254,10 @@ void __cfg80211_sched_scan_results(struct work_struct *wk)
+ 	rdev = container_of(wk, struct cfg80211_registered_device,
+ 			    sched_scan_results_wk);
+ 
+-	request = rdev->sched_scan_req;
+-
+ 	rtnl_lock();
+ 
++	request = rdev->sched_scan_req;
++
+ 	/* we don't have sched_scan_req anymore if the scan is stopping */
+ 	if (request) {
+ 		if (request->flags & NL80211_SCAN_FLAG_FLUSH) {
+diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
+index da4b8b23..6235d052 100644
+--- a/security/selinux/netlabel.c
++++ b/security/selinux/netlabel.c
+@@ -442,8 +442,7 @@ int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
+ 	    sksec->nlbl_state != NLBL_CONNLABELED)
+ 		return 0;
+ 
+-	local_bh_disable();
+-	bh_lock_sock_nested(sk);
++	lock_sock(sk);
+ 
+ 	/* connected sockets are allowed to disconnect when the address family
+ 	 * is set to AF_UNSPEC, if that is what is happening we want to reset
+@@ -464,7 +463,6 @@ int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
+ 		sksec->nlbl_state = NLBL_CONNLABELED;
+ 
+ socket_connect_return:
+-	bh_unlock_sock(sk);
+-	local_bh_enable();
++	release_sock(sk);
+ 	return rc;
+ }
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 3067ed4f..c4671d00 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -2506,12 +2506,8 @@ static int create_out_jack_modes(struct hda_codec *codec, int num_pins,
+ 
+ 	for (i = 0; i < num_pins; i++) {
+ 		hda_nid_t pin = pins[i];
+-		if (pin == spec->hp_mic_pin) {
+-			int ret = create_hp_mic_jack_mode(codec, pin);
+-			if (ret < 0)
+-				return ret;
++		if (pin == spec->hp_mic_pin)
+ 			continue;
+-		}
+ 		if (get_out_jack_num_items(codec, pin) > 1) {
+ 			struct snd_kcontrol_new *knew;
+ 			char name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN];
+@@ -2764,7 +2760,7 @@ static int hp_mic_jack_mode_put(struct snd_kcontrol *kcontrol,
+ 			val &= ~(AC_PINCTL_VREFEN | PIN_HP);
+ 			val |= get_vref_idx(vref_caps, idx) | PIN_IN;
+ 		} else
+-			val = snd_hda_get_default_vref(codec, nid);
++			val = snd_hda_get_default_vref(codec, nid) | PIN_IN;
+ 	}
+ 	snd_hda_set_pin_ctl_cache(codec, nid, val);
+ 	call_hp_automute(codec, NULL);
+@@ -2784,9 +2780,6 @@ static int create_hp_mic_jack_mode(struct hda_codec *codec, hda_nid_t pin)
+ 	struct hda_gen_spec *spec = codec->spec;
+ 	struct snd_kcontrol_new *knew;
+ 
+-	if (get_out_jack_num_items(codec, pin) <= 1 &&
+-	    get_in_jack_num_items(codec, pin) <= 1)
+-		return 0; /* no need */
+ 	knew = snd_hda_gen_add_kctl(spec, "Headphone Mic Jack Mode",
+ 				    &hp_mic_jack_mode_enum);
+ 	if (!knew)
+@@ -2815,6 +2808,42 @@ static int add_loopback_list(struct hda_gen_spec *spec, hda_nid_t mix, int idx)
+ 	return 0;
+ }
+ 
++/* return true if either a volume or a mute amp is found for the given
++ * aamix path; the amp has to be either in the mixer node or its direct leaf
++ */
++static bool look_for_mix_leaf_ctls(struct hda_codec *codec, hda_nid_t mix_nid,
++				   hda_nid_t pin, unsigned int *mix_val,
++				   unsigned int *mute_val)
++{
++	int idx, num_conns;
++	const hda_nid_t *list;
++	hda_nid_t nid;
++
++	idx = snd_hda_get_conn_index(codec, mix_nid, pin, true);
++	if (idx < 0)
++		return false;
++
++	*mix_val = *mute_val = 0;
++	if (nid_has_volume(codec, mix_nid, HDA_INPUT))
++		*mix_val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
++	if (nid_has_mute(codec, mix_nid, HDA_INPUT))
++		*mute_val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
++	if (*mix_val && *mute_val)
++		return true;
++
++	/* check leaf node */
++	num_conns = snd_hda_get_conn_list(codec, mix_nid, &list);
++	if (num_conns < idx)
++		return false;
++	nid = list[idx];
++	if (!*mix_val && nid_has_volume(codec, nid, HDA_OUTPUT))
++		*mix_val = HDA_COMPOSE_AMP_VAL(nid, 3, 0, HDA_OUTPUT);
++	if (!*mute_val && nid_has_mute(codec, nid, HDA_OUTPUT))
++		*mute_val = HDA_COMPOSE_AMP_VAL(nid, 3, 0, HDA_OUTPUT);
++
++	return *mix_val || *mute_val;
++}
++
+ /* create input playback/capture controls for the given pin */
+ static int new_analog_input(struct hda_codec *codec, int input_idx,
+ 			    hda_nid_t pin, const char *ctlname, int ctlidx,
+@@ -2822,12 +2851,11 @@ static int new_analog_input(struct hda_codec *codec, int input_idx,
+ {
+ 	struct hda_gen_spec *spec = codec->spec;
+ 	struct nid_path *path;
+-	unsigned int val;
++	unsigned int mix_val, mute_val;
+ 	int err, idx;
+ 
+-	if (!nid_has_volume(codec, mix_nid, HDA_INPUT) &&
+-	    !nid_has_mute(codec, mix_nid, HDA_INPUT))
+-		return 0; /* no need for analog loopback */
++	if (!look_for_mix_leaf_ctls(codec, mix_nid, pin, &mix_val, &mute_val))
++		return 0;
+ 
+ 	path = snd_hda_add_new_path(codec, pin, mix_nid, 0);
+ 	if (!path)
+@@ -2836,20 +2864,18 @@ static int new_analog_input(struct hda_codec *codec, int input_idx,
+ 	spec->loopback_paths[input_idx] = snd_hda_get_path_idx(codec, path);
+ 
+ 	idx = path->idx[path->depth - 1];
+-	if (nid_has_volume(codec, mix_nid, HDA_INPUT)) {
+-		val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
+-		err = __add_pb_vol_ctrl(spec, HDA_CTL_WIDGET_VOL, ctlname, ctlidx, val);
++	if (mix_val) {
++		err = __add_pb_vol_ctrl(spec, HDA_CTL_WIDGET_VOL, ctlname, ctlidx, mix_val);
+ 		if (err < 0)
+ 			return err;
+-		path->ctls[NID_PATH_VOL_CTL] = val;
++		path->ctls[NID_PATH_VOL_CTL] = mix_val;
+ 	}
+ 
+-	if (nid_has_mute(codec, mix_nid, HDA_INPUT)) {
+-		val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
+-		err = __add_pb_sw_ctrl(spec, HDA_CTL_WIDGET_MUTE, ctlname, ctlidx, val);
++	if (mute_val) {
++		err = __add_pb_sw_ctrl(spec, HDA_CTL_WIDGET_MUTE, ctlname, ctlidx, mute_val);
+ 		if (err < 0)
+ 			return err;
+-		path->ctls[NID_PATH_MUTE_CTL] = val;
++		path->ctls[NID_PATH_MUTE_CTL] = mute_val;
+ 	}
+ 
+ 	path->active = true;
+@@ -4383,6 +4409,17 @@ int snd_hda_gen_parse_auto_config(struct hda_codec *codec,
+ 	if (err < 0)
+ 		return err;
+ 
++	/* create "Headphone Mic Jack Mode" if no input selection is
++	 * available (or user specifies add_jack_modes hint)
++	 */
++	if (spec->hp_mic_pin &&
++	    (spec->auto_mic || spec->input_mux.num_items == 1 ||
++	     spec->add_jack_modes)) {
++		err = create_hp_mic_jack_mode(codec, spec->hp_mic_pin);
++		if (err < 0)
++			return err;
++	}
++
+ 	if (spec->add_jack_modes) {
+ 		if (cfg->line_out_type != AUTO_PIN_SPEAKER_OUT) {
+ 			err = create_out_jack_modes(codec, cfg->line_outs,
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 2f39631f..f0f54829 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1771,6 +1771,7 @@ enum {
+ 	ALC889_FIXUP_IMAC91_VREF,
+ 	ALC882_FIXUP_INV_DMIC,
+ 	ALC882_FIXUP_NO_PRIMARY_HP,
++	ALC887_FIXUP_ASUS_BASS,
+ };
+ 
+ static void alc889_fixup_coef(struct hda_codec *codec,
+@@ -2094,6 +2095,13 @@ static const struct hda_fixup alc882_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc882_fixup_no_primary_hp,
+ 	},
++	[ALC887_FIXUP_ASUS_BASS] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{0x16, 0x99130130}, /* bass speaker */
++			{}
++		},
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+@@ -2127,6 +2135,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x1873, "ASUS W90V", ALC882_FIXUP_ASUS_W90V),
+ 	SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC),
+ 	SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
++	SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
+ 	SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
+ 	SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
+ 	SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
+@@ -4864,6 +4873,7 @@ static int patch_alc662(struct hda_codec *codec)
+ 		case 0x10ec0272:
+ 		case 0x10ec0663:
+ 		case 0x10ec0665:
++		case 0x10ec0668:
+ 			set_beep_amp(spec, 0x0b, 0x04, HDA_INPUT);
+ 			break;
+ 		case 0x10ec0273:
+@@ -4921,6 +4931,7 @@ static int patch_alc680(struct hda_codec *codec)
+  */
+ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
+ 	{ .id = 0x10ec0221, .name = "ALC221", .patch = patch_alc269 },
++	{ .id = 0x10ec0231, .name = "ALC231", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0233, .name = "ALC233", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0255, .name = "ALC255", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0260, .name = "ALC260", .patch = patch_alc260 },
+diff --git a/sound/soc/blackfin/bf5xx-i2s.c b/sound/soc/blackfin/bf5xx-i2s.c
+index 9a174fc4..39d77483 100644
+--- a/sound/soc/blackfin/bf5xx-i2s.c
++++ b/sound/soc/blackfin/bf5xx-i2s.c
+@@ -121,6 +121,7 @@ static int bf5xx_i2s_hw_params(struct snd_pcm_substream *substream,
+ 		bf5xx_i2s->tcr2 |= 7;
+ 		bf5xx_i2s->rcr2 |= 7;
+ 		sport_handle->wdsize = 1;
++		break;
+ 	case SNDRV_PCM_FORMAT_S16_LE:
+ 		bf5xx_i2s->tcr2 |= 15;
+ 		bf5xx_i2s->rcr2 |= 15;
+diff --git a/sound/soc/codecs/ak4642.c b/sound/soc/codecs/ak4642.c
+index 2d037870..687565d0 100644
+--- a/sound/soc/codecs/ak4642.c
++++ b/sound/soc/codecs/ak4642.c
+@@ -257,7 +257,7 @@ static int ak4642_dai_startup(struct snd_pcm_substream *substream,
+ 		 * This operation came from example code of
+ 		 * "ASAHI KASEI AK4642" (japanese) manual p94.
+ 		 */
+-		snd_soc_write(codec, SG_SL1, PMMP | MGAIN0);
++		snd_soc_update_bits(codec, SG_SL1, PMMP | MGAIN0, PMMP | MGAIN0);
+ 		snd_soc_write(codec, TIMER, ZTM(0x3) | WTM(0x3));
+ 		snd_soc_write(codec, ALC_CTL1, ALC | LMTH0);
+ 		snd_soc_update_bits(codec, PW_MGMT1, PMADL, PMADL);
+diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c
+index 657808ba..f38ed4d2 100644
+--- a/sound/soc/codecs/arizona.c
++++ b/sound/soc/codecs/arizona.c
+@@ -1525,6 +1525,8 @@ static void arizona_enable_fll(struct arizona_fll *fll,
+ 	try_wait_for_completion(&fll->ok);
+ 
+ 	regmap_update_bits(arizona->regmap, fll->base + 1,
++			   ARIZONA_FLL1_FREERUN, 0);
++	regmap_update_bits(arizona->regmap, fll->base + 1,
+ 			   ARIZONA_FLL1_ENA, ARIZONA_FLL1_ENA);
+ 	if (fll->ref_src >= 0 && fll->sync_src >= 0 &&
+ 	    fll->ref_src != fll->sync_src)
+@@ -1543,6 +1545,8 @@ static void arizona_disable_fll(struct arizona_fll *fll)
+ 	struct arizona *arizona = fll->arizona;
+ 	bool change;
+ 
++	regmap_update_bits(arizona->regmap, fll->base + 1,
++			   ARIZONA_FLL1_FREERUN, ARIZONA_FLL1_FREERUN);
+ 	regmap_update_bits_check(arizona->regmap, fll->base + 1,
+ 				 ARIZONA_FLL1_ENA, 0, &change);
+ 	regmap_update_bits(arizona->regmap, fll->base + 0x11,
+diff --git a/sound/soc/codecs/cs42l52.h b/sound/soc/codecs/cs42l52.h
+index 4277012c..a935d738 100644
+--- a/sound/soc/codecs/cs42l52.h
++++ b/sound/soc/codecs/cs42l52.h
+@@ -179,7 +179,7 @@
+ #define CS42L52_MICB_CTL			0x11
+ #define	CS42L52_MIC_CTL_MIC_SEL_MASK		0xBF
+ #define	CS42L52_MIC_CTL_MIC_SEL_SHIFT		6
+-#define CS42L52_MIC_CTL_TYPE_MASK		0xDF
++#define CS42L52_MIC_CTL_TYPE_MASK		0x20
+ #define CS42L52_MIC_CTL_TYPE_SHIFT		5
+ 
+ 
+diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
+index bbd64384..0048ce5b 100644
+--- a/sound/soc/codecs/wm5110.c
++++ b/sound/soc/codecs/wm5110.c
+@@ -37,6 +37,47 @@ struct wm5110_priv {
+ 	struct arizona_fll fll[2];
+ };
+ 
++static const struct reg_default wm5110_sysclk_revd_patch[] = {
++	{ 0x3093, 0x1001 },
++	{ 0x30E3, 0x1301 },
++	{ 0x3133, 0x1201 },
++	{ 0x3183, 0x1501 },
++	{ 0x31D3, 0x1401 },
++};
++
++static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w,
++			    struct snd_kcontrol *kcontrol, int event)
++{
++	struct snd_soc_codec *codec = w->codec;
++	struct arizona *arizona = dev_get_drvdata(codec->dev->parent);
++	struct regmap *regmap = codec->control_data;
++	const struct reg_default *patch = NULL;
++	int i, patch_size;
++
++	switch (arizona->rev) {
++	case 3:
++		patch = wm5110_sysclk_revd_patch;
++		patch_size = ARRAY_SIZE(wm5110_sysclk_revd_patch);
++		break;
++	default:
++		return 0;
++	}
++
++	switch (event) {
++	case SND_SOC_DAPM_POST_PMU:
++		if (patch)
++			for (i = 0; i < patch_size; i++)
++				regmap_write(regmap, patch[i].reg,
++					     patch[i].def);
++		break;
++
++	default:
++		break;
++	}
++
++	return 0;
++}
++
+ static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
+ static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
+ static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
+@@ -400,7 +441,7 @@ static const struct snd_kcontrol_new wm5110_aec_loopback_mux =
+ 
+ static const struct snd_soc_dapm_widget wm5110_dapm_widgets[] = {
+ SND_SOC_DAPM_SUPPLY("SYSCLK", ARIZONA_SYSTEM_CLOCK_1, ARIZONA_SYSCLK_ENA_SHIFT,
+-		    0, NULL, 0),
++		    0, wm5110_sysclk_ev, SND_SOC_DAPM_POST_PMU),
+ SND_SOC_DAPM_SUPPLY("ASYNCCLK", ARIZONA_ASYNC_CLOCK_1,
+ 		    ARIZONA_ASYNC_CLK_ENA_SHIFT, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY("OPCLK", ARIZONA_OUTPUT_SYSTEM_CLOCK,
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 11d80f3b..871f8518 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -3722,6 +3722,8 @@ static int wm8962_i2c_probe(struct i2c_client *i2c,
+ 	if (ret < 0)
+ 		goto err_enable;
+ 
++	regcache_cache_only(wm8962->regmap, true);
++
+ 	/* The drivers should power up as needed */
+ 	regulator_bulk_disable(ARRAY_SIZE(wm8962->supplies), wm8962->supplies);
+ 
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index b38f3506..60b6b593 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -1062,6 +1062,7 @@ static int wm_adsp_setup_algs(struct wm_adsp *dsp)
+ 			if (i + 1 < algs) {
+ 				region->len = be32_to_cpu(adsp1_alg[i + 1].dm);
+ 				region->len -= be32_to_cpu(adsp1_alg[i].dm);
++				region->len *= 4;
+ 				wm_adsp_create_control(dsp, region);
+ 			} else {
+ 				adsp_warn(dsp, "Missing length info for region DM with ID %x\n",
+@@ -1079,6 +1080,7 @@ static int wm_adsp_setup_algs(struct wm_adsp *dsp)
+ 			if (i + 1 < algs) {
+ 				region->len = be32_to_cpu(adsp1_alg[i + 1].zm);
+ 				region->len -= be32_to_cpu(adsp1_alg[i].zm);
++				region->len *= 4;
+ 				wm_adsp_create_control(dsp, region);
+ 			} else {
+ 				adsp_warn(dsp, "Missing length info for region ZM with ID %x\n",
+@@ -1108,6 +1110,7 @@ static int wm_adsp_setup_algs(struct wm_adsp *dsp)
+ 			if (i + 1 < algs) {
+ 				region->len = be32_to_cpu(adsp2_alg[i + 1].xm);
+ 				region->len -= be32_to_cpu(adsp2_alg[i].xm);
++				region->len *= 4;
+ 				wm_adsp_create_control(dsp, region);
+ 			} else {
+ 				adsp_warn(dsp, "Missing length info for region XM with ID %x\n",
+@@ -1125,6 +1128,7 @@ static int wm_adsp_setup_algs(struct wm_adsp *dsp)
+ 			if (i + 1 < algs) {
+ 				region->len = be32_to_cpu(adsp2_alg[i + 1].ym);
+ 				region->len -= be32_to_cpu(adsp2_alg[i].ym);
++				region->len *= 4;
+ 				wm_adsp_create_control(dsp, region);
+ 			} else {
+ 				adsp_warn(dsp, "Missing length info for region YM with ID %x\n",
+@@ -1142,6 +1146,7 @@ static int wm_adsp_setup_algs(struct wm_adsp *dsp)
+ 			if (i + 1 < algs) {
+ 				region->len = be32_to_cpu(adsp2_alg[i + 1].zm);
+ 				region->len -= be32_to_cpu(adsp2_alg[i].zm);
++				region->len *= 4;
+ 				wm_adsp_create_control(dsp, region);
+ 			} else {
+ 				adsp_warn(dsp, "Missing length info for region ZM with ID %x\n",
+diff --git a/sound/soc/fsl/imx-pcm-fiq.c b/sound/soc/fsl/imx-pcm-fiq.c
+index 34043c55..2fc872b2 100644
+--- a/sound/soc/fsl/imx-pcm-fiq.c
++++ b/sound/soc/fsl/imx-pcm-fiq.c
+@@ -44,7 +44,8 @@ struct imx_pcm_runtime_data {
+ 	struct hrtimer hrt;
+ 	int poll_time_ns;
+ 	struct snd_pcm_substream *substream;
+-	atomic_t running;
++	atomic_t playing;
++	atomic_t capturing;
+ };
+ 
+ static enum hrtimer_restart snd_hrtimer_callback(struct hrtimer *hrt)
+@@ -56,7 +57,7 @@ static enum hrtimer_restart snd_hrtimer_callback(struct hrtimer *hrt)
+ 	struct pt_regs regs;
+ 	unsigned long delta;
+ 
+-	if (!atomic_read(&iprtd->running))
++	if (!atomic_read(&iprtd->playing) && !atomic_read(&iprtd->capturing))
+ 		return HRTIMER_NORESTART;
+ 
+ 	get_fiq_regs(&regs);
+@@ -124,7 +125,6 @@ static int snd_imx_pcm_prepare(struct snd_pcm_substream *substream)
+ 	return 0;
+ }
+ 
+-static int fiq_enable;
+ static int imx_pcm_fiq;
+ 
+ static int snd_imx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
+@@ -136,23 +136,27 @@ static int snd_imx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
+ 	case SNDRV_PCM_TRIGGER_START:
+ 	case SNDRV_PCM_TRIGGER_RESUME:
+ 	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+-		atomic_set(&iprtd->running, 1);
++		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
++			atomic_set(&iprtd->playing, 1);
++		else
++			atomic_set(&iprtd->capturing, 1);
+ 		hrtimer_start(&iprtd->hrt, ns_to_ktime(iprtd->poll_time_ns),
+ 		      HRTIMER_MODE_REL);
+-		if (++fiq_enable == 1)
+-			enable_fiq(imx_pcm_fiq);
+-
++		enable_fiq(imx_pcm_fiq);
+ 		break;
+ 
+ 	case SNDRV_PCM_TRIGGER_STOP:
+ 	case SNDRV_PCM_TRIGGER_SUSPEND:
+ 	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+-		atomic_set(&iprtd->running, 0);
+-
+-		if (--fiq_enable == 0)
++		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
++			atomic_set(&iprtd->playing, 0);
++		else
++			atomic_set(&iprtd->capturing, 0);
++		if (!atomic_read(&iprtd->playing) &&
++				!atomic_read(&iprtd->capturing))
+ 			disable_fiq(imx_pcm_fiq);
+-
+ 		break;
++
+ 	default:
+ 		return -EINVAL;
+ 	}
+@@ -200,7 +204,8 @@ static int snd_imx_open(struct snd_pcm_substream *substream)
+ 
+ 	iprtd->substream = substream;
+ 
+-	atomic_set(&iprtd->running, 0);
++	atomic_set(&iprtd->playing, 0);
++	atomic_set(&iprtd->capturing, 0);
+ 	hrtimer_init(&iprtd->hrt, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ 	iprtd->hrt.function = snd_hrtimer_callback;
+ 
+diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
+index 0a193281..78f4c92e 100644
+--- a/tools/perf/ui/hist.c
++++ b/tools/perf/ui/hist.c
+@@ -117,7 +117,7 @@ static int hpp__color_##_type(struct perf_hpp_fmt *fmt __maybe_unused,		\
+ 			      struct perf_hpp *hpp, struct hist_entry *he) 	\
+ {										\
+ 	return __hpp__fmt(hpp, he, he_get_##_field, " %6.2f%%",			\
+-			  (hpp_snprint_fn)percent_color_snprintf, true);	\
++			  percent_color_snprintf, true);			\
+ }
+ 
+ #define __HPP_ENTRY_PERCENT_FN(_type, _field)					\
+diff --git a/tools/perf/util/color.c b/tools/perf/util/color.c
+index 11e46da1..66e44a50 100644
+--- a/tools/perf/util/color.c
++++ b/tools/perf/util/color.c
+@@ -318,8 +318,15 @@ int percent_color_fprintf(FILE *fp, const char *fmt, double percent)
+ 	return r;
+ }
+ 
+-int percent_color_snprintf(char *bf, size_t size, const char *fmt, double percent)
++int percent_color_snprintf(char *bf, size_t size, const char *fmt, ...)
+ {
+-	const char *color = get_percent_color(percent);
++	va_list args;
++	double percent;
++	const char *color;
++
++	va_start(args, fmt);
++	percent = va_arg(args, double);
++	va_end(args);
++	color = get_percent_color(percent);
+ 	return color_snprintf(bf, size, color, fmt, percent);
+ }
+diff --git a/tools/perf/util/color.h b/tools/perf/util/color.h
+index dea082b7..fced3840 100644
+--- a/tools/perf/util/color.h
++++ b/tools/perf/util/color.h
+@@ -39,7 +39,7 @@ int color_fprintf(FILE *fp, const char *color, const char *fmt, ...);
+ int color_snprintf(char *bf, size_t size, const char *color, const char *fmt, ...);
+ int color_fprintf_ln(FILE *fp, const char *color, const char *fmt, ...);
+ int color_fwrite_lines(FILE *fp, const char *color, size_t count, const char *buf);
+-int percent_color_snprintf(char *bf, size_t size, const char *fmt, double percent);
++int percent_color_snprintf(char *bf, size_t size, const char *fmt, ...);
+ int percent_color_fprintf(FILE *fp, const char *fmt, double percent);
+ const char *get_percent_color(double percent);
+ 
+diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
+index 49096ea5..1ae1b082 100644
+--- a/tools/perf/util/event.c
++++ b/tools/perf/util/event.c
+@@ -212,8 +212,10 @@ static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
+ 		       &event->mmap.start, &event->mmap.len, prot,
+ 		       &event->mmap.pgoff,
+ 		       execname);
+-
+-		if (n != 5)
++		/*
++ 		 * Anon maps don't have the execname.
++ 		 */
++		if (n < 4)
+ 			continue;
+ 
+ 		if (prot[2] != 'x')