[gentoo-commits] linux-patches r2604 - genpatches-2.6/trunk/3.10

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2013-12-07 00:57:03 +0000 (Sat, 07 Dec 2013)
New Revision: 2604

Added:
   genpatches-2.6/trunk/3.10/1021_linux-3.10.22.patch
Modified:
   genpatches-2.6/trunk/3.10/0000_README
Log:
Linux patch 3.10.22

Modified: genpatches-2.6/trunk/3.10/0000_README
===================================================================
--- genpatches-2.6/trunk/3.10/0000_README	2013-12-06 23:53:32 UTC (rev 2603)
+++ genpatches-2.6/trunk/3.10/0000_README	2013-12-07 00:57:03 UTC (rev 2604)
@@ -126,6 +126,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.10.21
 
+Patch:  1021_linux-3.10.22.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.22
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.10/1021_linux-3.10.22.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1021_linux-3.10.22.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10/1021_linux-3.10.22.patch	2013-12-07 00:57:03 UTC (rev 2604)
@@ -0,0 +1,7544 @@
+diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
+index ccd42589..9b34b168 100644
+--- a/Documentation/sysctl/kernel.txt
++++ b/Documentation/sysctl/kernel.txt
+@@ -289,13 +289,24 @@ Default value is "/sbin/hotplug".
+ kptr_restrict:
+ 
+ This toggle indicates whether restrictions are placed on
+-exposing kernel addresses via /proc and other interfaces.  When
+-kptr_restrict is set to (0), there are no restrictions.  When
+-kptr_restrict is set to (1), the default, kernel pointers
+-printed using the %pK format specifier will be replaced with 0's
+-unless the user has CAP_SYSLOG.  When kptr_restrict is set to
+-(2), kernel pointers printed using %pK will be replaced with 0's
+-regardless of privileges.
++exposing kernel addresses via /proc and other interfaces.
++
++When kptr_restrict is set to (0), the default, there are no restrictions.
++
++When kptr_restrict is set to (1), kernel pointers printed using the %pK
++format specifier will be replaced with 0's unless the user has CAP_SYSLOG
++and effective user and group ids are equal to the real ids. This is
++because %pK checks are done at read() time rather than open() time, so
++if permissions are elevated between the open() and the read() (e.g via
++a setuid binary) then %pK will not leak kernel pointers to unprivileged
++users. Note, this is a temporary solution only. The correct long-term
++solution is to do the permission checks at open() time. Consider removing
++world read permissions from files that use %pK, and using dmesg_restrict
++to protect against uses of %pK in dmesg(8) if leaking kernel pointer
++values to unprivileged users is a concern.
++
++When kptr_restrict is set to (2), kernel pointers printed using
++%pK will be replaced with 0's regardless of privileges.
+ 
+ ==============================================================
+ 
+diff --git a/Makefile b/Makefile
+index c0635fba..001188ce 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 21
++SUBLEVEL = 22
+ EXTRAVERSION =
+ NAME = TOSSUG Baby Fish
+ 
+diff --git a/arch/arm/boot/dts/bcm2835.dtsi b/arch/arm/boot/dts/bcm2835.dtsi
+index 1e12aeff..aa537ed1 100644
+--- a/arch/arm/boot/dts/bcm2835.dtsi
++++ b/arch/arm/boot/dts/bcm2835.dtsi
+@@ -85,6 +85,8 @@
+ 			reg = <0x7e205000 0x1000>;
+ 			interrupts = <2 21>;
+ 			clocks = <&clk_i2c>;
++			#address-cells = <1>;
++			#size-cells = <0>;
+ 			status = "disabled";
+ 		};
+ 
+@@ -93,6 +95,8 @@
+ 			reg = <0x7e804000 0x1000>;
+ 			interrupts = <2 21>;
+ 			clocks = <&clk_i2c>;
++			#address-cells = <1>;
++			#size-cells = <0>;
+ 			status = "disabled";
+ 		};
+ 
+diff --git a/arch/arm/boot/dts/cros5250-common.dtsi b/arch/arm/boot/dts/cros5250-common.dtsi
+index 3f0239ec..49d8da27 100644
+--- a/arch/arm/boot/dts/cros5250-common.dtsi
++++ b/arch/arm/boot/dts/cros5250-common.dtsi
+@@ -27,6 +27,13 @@
+ 		i2c2_bus: i2c2-bus {
+ 			samsung,pin-pud = <0>;
+ 		};
++
++		max77686_irq: max77686-irq {
++			samsung,pins = "gpx3-2";
++			samsung,pin-function = <0>;
++			samsung,pin-pud = <0>;
++			samsung,pin-drv = <0>;
++		};
+ 	};
+ 
+ 	i2c@12C60000 {
+@@ -35,6 +42,11 @@
+ 
+ 		max77686@09 {
+ 			compatible = "maxim,max77686";
++			interrupt-parent = <&gpx3>;
++			interrupts = <2 0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&max77686_irq>;
++			wakeup-source;
+ 			reg = <0x09>;
+ 
+ 			voltage-regulators {
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index d43c7e54..32640ae7 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -192,6 +192,7 @@ __dabt_svc:
+ 	svc_entry
+ 	mov	r2, sp
+ 	dabt_helper
++ THUMB(	ldr	r5, [sp, #S_PSR]	)	@ potentially updated CPSR
+ 	svc_exit r5				@ return from exception
+  UNWIND(.fnend		)
+ ENDPROC(__dabt_svc)
+diff --git a/arch/arm/mach-at91/Makefile b/arch/arm/mach-at91/Makefile
+index 788562dc..c336efdf 100644
+--- a/arch/arm/mach-at91/Makefile
++++ b/arch/arm/mach-at91/Makefile
+@@ -2,7 +2,7 @@
+ # Makefile for the linux kernel.
+ #
+ 
+-obj-y		:= irq.o gpio.o setup.o
++obj-y		:= irq.o gpio.o setup.o sysirq_mask.o
+ obj-m		:=
+ obj-n		:=
+ obj-		:=
+diff --git a/arch/arm/mach-at91/at91sam9260.c b/arch/arm/mach-at91/at91sam9260.c
+index a8ce2453..cdb1fb69 100644
+--- a/arch/arm/mach-at91/at91sam9260.c
++++ b/arch/arm/mach-at91/at91sam9260.c
+@@ -351,6 +351,8 @@ static void __init at91sam9260_initialize(void)
+ 	at91_extern_irq = (1 << AT91SAM9260_ID_IRQ0) | (1 << AT91SAM9260_ID_IRQ1)
+ 			| (1 << AT91SAM9260_ID_IRQ2);
+ 
++	at91_sysirq_mask_rtt(AT91SAM9260_BASE_RTT);
++
+ 	/* Register GPIO subsystem */
+ 	at91_gpio_init(at91sam9260_gpio, 3);
+ }
+diff --git a/arch/arm/mach-at91/at91sam9261.c b/arch/arm/mach-at91/at91sam9261.c
+index 25efb5ac..7c9d2ea5 100644
+--- a/arch/arm/mach-at91/at91sam9261.c
++++ b/arch/arm/mach-at91/at91sam9261.c
+@@ -293,6 +293,8 @@ static void __init at91sam9261_initialize(void)
+ 	at91_extern_irq = (1 << AT91SAM9261_ID_IRQ0) | (1 << AT91SAM9261_ID_IRQ1)
+ 			| (1 << AT91SAM9261_ID_IRQ2);
+ 
++	at91_sysirq_mask_rtt(AT91SAM9261_BASE_RTT);
++
+ 	/* Register GPIO subsystem */
+ 	at91_gpio_init(at91sam9261_gpio, 3);
+ }
+diff --git a/arch/arm/mach-at91/at91sam9263.c b/arch/arm/mach-at91/at91sam9263.c
+index f44ffd21..c6b2f477 100644
+--- a/arch/arm/mach-at91/at91sam9263.c
++++ b/arch/arm/mach-at91/at91sam9263.c
+@@ -329,6 +329,9 @@ static void __init at91sam9263_initialize(void)
+ 	arm_pm_restart = at91sam9_alt_restart;
+ 	at91_extern_irq = (1 << AT91SAM9263_ID_IRQ0) | (1 << AT91SAM9263_ID_IRQ1);
+ 
++	at91_sysirq_mask_rtt(AT91SAM9263_BASE_RTT0);
++	at91_sysirq_mask_rtt(AT91SAM9263_BASE_RTT1);
++
+ 	/* Register GPIO subsystem */
+ 	at91_gpio_init(at91sam9263_gpio, 5);
+ }
+diff --git a/arch/arm/mach-at91/at91sam9g45.c b/arch/arm/mach-at91/at91sam9g45.c
+index 8b7fce06..e381fa12 100644
+--- a/arch/arm/mach-at91/at91sam9g45.c
++++ b/arch/arm/mach-at91/at91sam9g45.c
+@@ -376,6 +376,9 @@ static void __init at91sam9g45_initialize(void)
+ 	arm_pm_restart = at91sam9g45_restart;
+ 	at91_extern_irq = (1 << AT91SAM9G45_ID_IRQ0);
+ 
++	at91_sysirq_mask_rtc(AT91SAM9G45_BASE_RTC);
++	at91_sysirq_mask_rtt(AT91SAM9G45_BASE_RTT);
++
+ 	/* Register GPIO subsystem */
+ 	at91_gpio_init(at91sam9g45_gpio, 5);
+ }
+diff --git a/arch/arm/mach-at91/at91sam9n12.c b/arch/arm/mach-at91/at91sam9n12.c
+index c7d670d1..4d6001c3 100644
+--- a/arch/arm/mach-at91/at91sam9n12.c
++++ b/arch/arm/mach-at91/at91sam9n12.c
+@@ -223,7 +223,13 @@ static void __init at91sam9n12_map_io(void)
+ 	at91_init_sram(0, AT91SAM9N12_SRAM_BASE, AT91SAM9N12_SRAM_SIZE);
+ }
+ 
++static void __init at91sam9n12_initialize(void)
++{
++	at91_sysirq_mask_rtc(AT91SAM9N12_BASE_RTC);
++}
++
+ AT91_SOC_START(at91sam9n12)
+ 	.map_io = at91sam9n12_map_io,
+ 	.register_clocks = at91sam9n12_register_clocks,
++	.init = at91sam9n12_initialize,
+ AT91_SOC_END
+diff --git a/arch/arm/mach-at91/at91sam9rl.c b/arch/arm/mach-at91/at91sam9rl.c
+index f77fae55..5615d28a 100644
+--- a/arch/arm/mach-at91/at91sam9rl.c
++++ b/arch/arm/mach-at91/at91sam9rl.c
+@@ -295,6 +295,9 @@ static void __init at91sam9rl_initialize(void)
+ 	arm_pm_restart = at91sam9_alt_restart;
+ 	at91_extern_irq = (1 << AT91SAM9RL_ID_IRQ0);
+ 
++	at91_sysirq_mask_rtc(AT91SAM9RL_BASE_RTC);
++	at91_sysirq_mask_rtt(AT91SAM9RL_BASE_RTT);
++
+ 	/* Register GPIO subsystem */
+ 	at91_gpio_init(at91sam9rl_gpio, 4);
+ }
+diff --git a/arch/arm/mach-at91/at91sam9x5.c b/arch/arm/mach-at91/at91sam9x5.c
+index e631fec0..7b4f8483 100644
+--- a/arch/arm/mach-at91/at91sam9x5.c
++++ b/arch/arm/mach-at91/at91sam9x5.c
+@@ -318,6 +318,11 @@ static void __init at91sam9x5_map_io(void)
+ 	at91_init_sram(0, AT91SAM9X5_SRAM_BASE, AT91SAM9X5_SRAM_SIZE);
+ }
+ 
++static void __init at91sam9x5_initialize(void)
++{
++	at91_sysirq_mask_rtc(AT91SAM9X5_BASE_RTC);
++}
++
+ /* --------------------------------------------------------------------
+  *  Interrupt initialization
+  * -------------------------------------------------------------------- */
+@@ -325,4 +330,5 @@ static void __init at91sam9x5_map_io(void)
+ AT91_SOC_START(at91sam9x5)
+ 	.map_io = at91sam9x5_map_io,
+ 	.register_clocks = at91sam9x5_register_clocks,
++	.init = at91sam9x5_initialize,
+ AT91_SOC_END
+diff --git a/arch/arm/mach-at91/generic.h b/arch/arm/mach-at91/generic.h
+index 78ab0654..d949ab4e 100644
+--- a/arch/arm/mach-at91/generic.h
++++ b/arch/arm/mach-at91/generic.h
+@@ -33,6 +33,8 @@ extern int  __init at91_aic_of_init(struct device_node *node,
+ 				    struct device_node *parent);
+ extern int  __init at91_aic5_of_init(struct device_node *node,
+ 				    struct device_node *parent);
++extern void __init at91_sysirq_mask_rtc(u32 rtc_base);
++extern void __init at91_sysirq_mask_rtt(u32 rtt_base);
+ 
+ 
+  /* Timer */
+diff --git a/arch/arm/mach-at91/include/mach/at91sam9n12.h b/arch/arm/mach-at91/include/mach/at91sam9n12.h
+index d374b87c..0151bcf6 100644
+--- a/arch/arm/mach-at91/include/mach/at91sam9n12.h
++++ b/arch/arm/mach-at91/include/mach/at91sam9n12.h
+@@ -49,6 +49,11 @@
+ #define AT91SAM9N12_BASE_USART3	0xf8028000
+ 
+ /*
++ * System Peripherals
++ */
++#define AT91SAM9N12_BASE_RTC	0xfffffeb0
++
++/*
+  * Internal Memory.
+  */
+ #define AT91SAM9N12_SRAM_BASE	0x00300000	/* Internal SRAM base address */
+diff --git a/arch/arm/mach-at91/include/mach/at91sam9x5.h b/arch/arm/mach-at91/include/mach/at91sam9x5.h
+index c75ee19b..2fc76c49 100644
+--- a/arch/arm/mach-at91/include/mach/at91sam9x5.h
++++ b/arch/arm/mach-at91/include/mach/at91sam9x5.h
+@@ -55,6 +55,11 @@
+ #define AT91SAM9X5_BASE_USART2	0xf8024000
+ 
+ /*
++ * System Peripherals
++ */
++#define AT91SAM9X5_BASE_RTC	0xfffffeb0
++
++/*
+  * Internal Memory.
+  */
+ #define AT91SAM9X5_SRAM_BASE	0x00300000	/* Internal SRAM base address */
+diff --git a/arch/arm/mach-at91/include/mach/sama5d3.h b/arch/arm/mach-at91/include/mach/sama5d3.h
+index 6dc81ee3..3abbc428 100644
+--- a/arch/arm/mach-at91/include/mach/sama5d3.h
++++ b/arch/arm/mach-at91/include/mach/sama5d3.h
+@@ -65,6 +65,11 @@
+ #define SAMA5D3_ID_IRQ0		47	/* Advanced Interrupt Controller (IRQ0) */
+ 
+ /*
++ * System Peripherals
++ */
++#define SAMA5D3_BASE_RTC	0xfffffeb0
++
++/*
+  * Internal Memory
+  */
+ #define SAMA5D3_SRAM_BASE	0x00300000	/* Internal SRAM base address */
+diff --git a/arch/arm/mach-at91/sama5d3.c b/arch/arm/mach-at91/sama5d3.c
+index 40127971..3ea86428 100644
+--- a/arch/arm/mach-at91/sama5d3.c
++++ b/arch/arm/mach-at91/sama5d3.c
+@@ -371,7 +371,13 @@ static void __init sama5d3_map_io(void)
+ 	at91_init_sram(0, SAMA5D3_SRAM_BASE, SAMA5D3_SRAM_SIZE);
+ }
+ 
++static void __init sama5d3_initialize(void)
++{
++	at91_sysirq_mask_rtc(SAMA5D3_BASE_RTC);
++}
++
+ AT91_SOC_START(sama5d3)
+ 	.map_io = sama5d3_map_io,
+ 	.register_clocks = sama5d3_register_clocks,
++	.init = sama5d3_initialize,
+ AT91_SOC_END
+diff --git a/arch/arm/mach-at91/sysirq_mask.c b/arch/arm/mach-at91/sysirq_mask.c
+new file mode 100644
+index 00000000..2ba694f9
+--- /dev/null
++++ b/arch/arm/mach-at91/sysirq_mask.c
+@@ -0,0 +1,71 @@
++/*
++ * sysirq_mask.c - System-interrupt masking
++ *
++ * Copyright (C) 2013 Johan Hovold <jhovold@×××××.com>
++ *
++ * Functions to disable system interrupts from backup-powered peripherals.
++ *
++ * The RTC and RTT-peripherals are generally powered by backup power (VDDBU)
++ * and are not reset on wake-up, user, watchdog or software reset. This means
++ * that their interrupts may be enabled during early boot (e.g. after a user
++ * reset).
++ *
++ * As the RTC and RTT share the system-interrupt line with the PIT, an
++ * interrupt occurring before a handler has been installed would lead to the
++ * system interrupt being disabled and prevent the system from booting.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ */
++
++#include <linux/io.h>
++#include <mach/at91_rtt.h>
++
++#include "generic.h"
++
++#define AT91_RTC_IDR	0x24	/* Interrupt Disable Register */
++#define AT91_RTC_IMR	0x28	/* Interrupt Mask Register */
++
++void __init at91_sysirq_mask_rtc(u32 rtc_base)
++{
++	void __iomem *base;
++	u32 mask;
++
++	base = ioremap(rtc_base, 64);
++	if (!base)
++		return;
++
++	mask = readl_relaxed(base + AT91_RTC_IMR);
++	if (mask) {
++		pr_info("AT91: Disabling rtc irq\n");
++		writel_relaxed(mask, base + AT91_RTC_IDR);
++		(void)readl_relaxed(base + AT91_RTC_IMR);	/* flush */
++	}
++
++	iounmap(base);
++}
++
++void __init at91_sysirq_mask_rtt(u32 rtt_base)
++{
++	void __iomem *base;
++	void __iomem *reg;
++	u32 mode;
++
++	base = ioremap(rtt_base, 16);
++	if (!base)
++		return;
++
++	reg = base + AT91_RTT_MR;
++
++	mode = readl_relaxed(reg);
++	if (mode & (AT91_RTT_ALMIEN | AT91_RTT_RTTINCIEN)) {
++		pr_info("AT91: Disabling rtt irq\n");
++		mode &= ~(AT91_RTT_ALMIEN | AT91_RTT_RTTINCIEN);
++		writel_relaxed(mode, reg);
++		(void)readl_relaxed(reg);			/* flush */
++	}
++
++	iounmap(base);
++}
+diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
+index 4e3148ce..0b9e4377 100644
+--- a/arch/arm/mach-imx/clk-imx6q.c
++++ b/arch/arm/mach-imx/clk-imx6q.c
+@@ -424,7 +424,7 @@ int __init mx6q_clocks_init(void)
+ 	clk[asrc_podf]        = imx_clk_divider("asrc_podf",        "asrc_pred",         base + 0x30, 9,  3);
+ 	clk[spdif_pred]       = imx_clk_divider("spdif_pred",       "spdif_sel",         base + 0x30, 25, 3);
+ 	clk[spdif_podf]       = imx_clk_divider("spdif_podf",       "spdif_pred",        base + 0x30, 22, 3);
+-	clk[can_root]         = imx_clk_divider("can_root",         "pll3_usb_otg",      base + 0x20, 2,  6);
++	clk[can_root]         = imx_clk_divider("can_root",         "pll3_60m",          base + 0x20, 2,  6);
+ 	clk[ecspi_root]       = imx_clk_divider("ecspi_root",       "pll3_60m",          base + 0x38, 19, 6);
+ 	clk[gpu2d_core_podf]  = imx_clk_divider("gpu2d_core_podf",  "gpu2d_core_sel",    base + 0x18, 23, 3);
+ 	clk[gpu3d_core_podf]  = imx_clk_divider("gpu3d_core_podf",  "gpu3d_core_sel",    base + 0x18, 26, 3);
+diff --git a/arch/arm/mach-integrator/integrator_cp.c b/arch/arm/mach-integrator/integrator_cp.c
+index 8c60fcb0..2f4c9248 100644
+--- a/arch/arm/mach-integrator/integrator_cp.c
++++ b/arch/arm/mach-integrator/integrator_cp.c
+@@ -199,7 +199,8 @@ static struct mmci_platform_data mmc_data = {
+ static void cp_clcd_enable(struct clcd_fb *fb)
+ {
+ 	struct fb_var_screeninfo *var = &fb->fb.var;
+-	u32 val = CM_CTRL_STATIC1 | CM_CTRL_STATIC2;
++	u32 val = CM_CTRL_STATIC1 | CM_CTRL_STATIC2
++			| CM_CTRL_LCDEN0 | CM_CTRL_LCDEN1;
+ 
+ 	if (var->bits_per_pixel <= 8 ||
+ 	    (var->bits_per_pixel == 16 && var->green.length == 5))
+diff --git a/arch/arm/mach-omap2/irq.c b/arch/arm/mach-omap2/irq.c
+index 3926f370..e022a869 100644
+--- a/arch/arm/mach-omap2/irq.c
++++ b/arch/arm/mach-omap2/irq.c
+@@ -233,7 +233,7 @@ static inline void omap_intc_handle_irq(void __iomem *base_addr, struct pt_regs
+ 			goto out;
+ 
+ 		irqnr = readl_relaxed(base_addr + 0xd8);
+-#ifdef CONFIG_SOC_TI81XX
++#if IS_ENABLED(CONFIG_SOC_TI81XX) || IS_ENABLED(CONFIG_SOC_AM33XX)
+ 		if (irqnr)
+ 			goto out;
+ 		irqnr = readl_relaxed(base_addr + 0xf8);
+diff --git a/arch/arm/mach-sa1100/assabet.c b/arch/arm/mach-sa1100/assabet.c
+index e838ba27..c9808c68 100644
+--- a/arch/arm/mach-sa1100/assabet.c
++++ b/arch/arm/mach-sa1100/assabet.c
+@@ -512,6 +512,9 @@ static void __init assabet_map_io(void)
+ 	 * Its called GPCLKR0 in my SA1110 manual.
+ 	 */
+ 	Ser1SDCR0 |= SDCR0_SUS;
++	MSC1 = (MSC1 & ~0xffff) |
++		MSC_NonBrst | MSC_32BitStMem |
++		MSC_RdAcc(2) | MSC_WrAcc(2) | MSC_Rec(0);
+ 
+ 	if (!machine_has_neponset())
+ 		sa1100_register_uart_fns(&assabet_port_fns);
+diff --git a/arch/arm/mm/extable.c b/arch/arm/mm/extable.c
+index 9d285626..312e15e6 100644
+--- a/arch/arm/mm/extable.c
++++ b/arch/arm/mm/extable.c
+@@ -9,8 +9,13 @@ int fixup_exception(struct pt_regs *regs)
+ 	const struct exception_table_entry *fixup;
+ 
+ 	fixup = search_exception_tables(instruction_pointer(regs));
+-	if (fixup)
++	if (fixup) {
+ 		regs->ARM_pc = fixup->fixup;
++#ifdef CONFIG_THUMB2_KERNEL
++		/* Clear the IT state to avoid nasty surprises in the fixup */
++		regs->ARM_cpsr &= ~PSR_IT_MASK;
++#endif
++	}
+ 
+ 	return fixup != NULL;
+ }
+diff --git a/arch/avr32/boot/u-boot/head.S b/arch/avr32/boot/u-boot/head.S
+index 4488fa27..2ffc298f 100644
+--- a/arch/avr32/boot/u-boot/head.S
++++ b/arch/avr32/boot/u-boot/head.S
+@@ -8,6 +8,8 @@
+  * published by the Free Software Foundation.
+  */
+ #include <asm/setup.h>
++#include <asm/thread_info.h>
++#include <asm/sysreg.h>
+ 
+ 	/*
+ 	 * The kernel is loaded where we want it to be and all caches
+@@ -20,11 +22,6 @@
+ 	.section .init.text,"ax"
+ 	.global _start
+ _start:
+-	/* Check if the boot loader actually provided a tag table */
+-	lddpc	r0, magic_number
+-	cp.w	r12, r0
+-	brne	no_tag_table
+-
+ 	/* Initialize .bss */
+ 	lddpc	r2, bss_start_addr
+ 	lddpc   r3, end_addr
+@@ -34,6 +31,25 @@ _start:
+ 	cp      r2, r3
+ 	brlo    1b
+ 
++	/* Initialize status register */
++	lddpc	r0, init_sr
++	mtsr	SYSREG_SR, r0
++
++	/* Set initial stack pointer */
++	lddpc	sp, stack_addr
++	sub	sp, -THREAD_SIZE
++
++#ifdef CONFIG_FRAME_POINTER
++	/* Mark last stack frame */
++	mov	lr, 0
++	mov	r7, 0
++#endif
++
++	/* Check if the boot loader actually provided a tag table */
++	lddpc	r0, magic_number
++	cp.w	r12, r0
++	brne	no_tag_table
++
+ 	/*
+ 	 * Save the tag table address for later use. This must be done
+ 	 * _after_ .bss has been initialized...
+@@ -53,8 +69,15 @@ bss_start_addr:
+ 	.long   __bss_start
+ end_addr:
+ 	.long   _end
++init_sr:
++	.long	0x007f0000	/* Supervisor mode, everything masked */
++stack_addr:
++	.long	init_thread_union
++panic_addr:
++	.long	panic
+ 
+ no_tag_table:
+ 	sub	r12, pc, (. - 2f)
+-	bral	panic
++	/* branch to panic() which can be far away with that construct */
++	lddpc	pc, panic_addr
+ 2:	.asciz	"Boot loader didn't provide correct magic number\n"
+diff --git a/arch/avr32/kernel/entry-avr32b.S b/arch/avr32/kernel/entry-avr32b.S
+index 9899d3cc..7301f480 100644
+--- a/arch/avr32/kernel/entry-avr32b.S
++++ b/arch/avr32/kernel/entry-avr32b.S
+@@ -401,9 +401,10 @@ handle_critical:
+ 	/* We should never get here... */
+ bad_return:
+ 	sub	r12, pc, (. - 1f)
+-	bral	panic
++	lddpc	pc, 2f
+ 	.align	2
+ 1:	.asciz	"Return from critical exception!"
++2:	.long	panic
+ 
+ 	.align	1
+ do_bus_error_write:
+diff --git a/arch/avr32/kernel/head.S b/arch/avr32/kernel/head.S
+index 6163bd0a..59eae6df 100644
+--- a/arch/avr32/kernel/head.S
++++ b/arch/avr32/kernel/head.S
+@@ -10,33 +10,13 @@
+ #include <linux/linkage.h>
+ 
+ #include <asm/page.h>
+-#include <asm/thread_info.h>
+-#include <asm/sysreg.h>
+ 
+ 	.section .init.text,"ax"
+ 	.global kernel_entry
+ kernel_entry:
+-	/* Initialize status register */
+-	lddpc   r0, init_sr
+-	mtsr	SYSREG_SR, r0
+-
+-	/* Set initial stack pointer */
+-	lddpc   sp, stack_addr
+-	sub	sp, -THREAD_SIZE
+-
+-#ifdef CONFIG_FRAME_POINTER
+-	/* Mark last stack frame */
+-	mov	lr, 0
+-	mov	r7, 0
+-#endif
+-
+ 	/* Start the show */
+ 	lddpc   pc, kernel_start_addr
+ 
+ 	.align  2
+-init_sr:
+-	.long   0x007f0000	/* Supervisor mode, everything masked */
+-stack_addr:
+-	.long   init_thread_union
+ kernel_start_addr:
+ 	.long   start_kernel
+diff --git a/arch/parisc/include/asm/socket.h b/arch/parisc/include/asm/socket.h
+new file mode 100644
+index 00000000..748016cb
+--- /dev/null
++++ b/arch/parisc/include/asm/socket.h
+@@ -0,0 +1,11 @@
++#ifndef _ASM_SOCKET_H
++#define _ASM_SOCKET_H
++
++#include <uapi/asm/socket.h>
++
++/* O_NONBLOCK clashes with the bits used for socket types.  Therefore we
++ * have to define SOCK_NONBLOCK to a different value here.
++ */
++#define SOCK_NONBLOCK	0x40000000
++
++#endif /* _ASM_SOCKET_H */
+diff --git a/arch/parisc/include/uapi/asm/socket.h b/arch/parisc/include/uapi/asm/socket.h
+index 70c512a3..4fecb262 100644
+--- a/arch/parisc/include/uapi/asm/socket.h
++++ b/arch/parisc/include/uapi/asm/socket.h
+@@ -1,5 +1,5 @@
+-#ifndef _ASM_SOCKET_H
+-#define _ASM_SOCKET_H
++#ifndef _UAPI_ASM_SOCKET_H
++#define _UAPI_ASM_SOCKET_H
+ 
+ #include <asm/sockios.h>
+ 
+@@ -73,9 +73,4 @@
+ 
+ #define SO_SELECT_ERR_QUEUE	0x4026
+ 
+-/* O_NONBLOCK clashes with the bits used for socket types.  Therefore we
+- * have to define SOCK_NONBLOCK to a different value here.
+- */
+-#define SOCK_NONBLOCK   0x40000000
+-
+-#endif /* _ASM_SOCKET_H */
++#endif /* _UAPI_ASM_SOCKET_H */
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
+index 32330996..7e9dff80 100644
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -442,6 +442,12 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
+ #endif /* CONFIG_ALTIVEC */
+ 	if (copy_fpr_to_user(&frame->mc_fregs, current))
+ 		return 1;
++
++	/*
++	 * Clear the MSR VSX bit to indicate there is no valid state attached
++	 * to this context, except in the specific case below where we set it.
++	 */
++	msr &= ~MSR_VSX;
+ #ifdef CONFIG_VSX
+ 	/*
+ 	 * Copy VSR 0-31 upper half from thread_struct to local
+@@ -454,15 +460,7 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
+ 		if (copy_vsx_to_user(&frame->mc_vsregs, current))
+ 			return 1;
+ 		msr |= MSR_VSX;
+-	} else if (!ctx_has_vsx_region)
+-		/*
+-		 * With a small context structure we can't hold the VSX
+-		 * registers, hence clear the MSR value to indicate the state
+-		 * was not saved.
+-		 */
+-		msr &= ~MSR_VSX;
+-
+-
++	}
+ #endif /* CONFIG_VSX */
+ #ifdef CONFIG_SPE
+ 	/* save spe registers */
+diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
+index 887e99d8..35c20a1f 100644
+--- a/arch/powerpc/kernel/signal_64.c
++++ b/arch/powerpc/kernel/signal_64.c
+@@ -121,6 +121,12 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
+ 	flush_fp_to_thread(current);
+ 	/* copy fpr regs and fpscr */
+ 	err |= copy_fpr_to_user(&sc->fp_regs, current);
++
++	/*
++	 * Clear the MSR VSX bit to indicate there is no valid state attached
++	 * to this context, except in the specific case below where we set it.
++	 */
++	msr &= ~MSR_VSX;
+ #ifdef CONFIG_VSX
+ 	/*
+ 	 * Copy VSX low doubleword to local buffer for formatting,
+diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
+index 50ea137a..1bf40ef5 100644
+--- a/arch/s390/lib/uaccess_pt.c
++++ b/arch/s390/lib/uaccess_pt.c
+@@ -78,11 +78,14 @@ static size_t copy_in_kernel(size_t count, void __user *to,
+  * contains the (negative) exception code.
+  */
+ #ifdef CONFIG_64BIT
++
+ static unsigned long follow_table(struct mm_struct *mm,
+ 				  unsigned long address, int write)
+ {
+ 	unsigned long *table = (unsigned long *)__pa(mm->pgd);
+ 
++	if (unlikely(address > mm->context.asce_limit - 1))
++		return -0x38UL;
+ 	switch (mm->context.asce_bits & _ASCE_TYPE_MASK) {
+ 	case _ASCE_TYPE_REGION1:
+ 		table = table + ((address >> 53) & 0x7ff);
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 45f3a51f..acf3bf6a 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -645,10 +645,12 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id)
+ 	__set_bit(QUEUE_FLAG_BYPASS, &q->queue_flags);
+ 
+ 	if (blkcg_init_queue(q))
+-		goto fail_id;
++		goto fail_bdi;
+ 
+ 	return q;
+ 
++fail_bdi:
++	bdi_destroy(&q->backing_dev_info);
+ fail_id:
+ 	ida_simple_remove(&blk_queue_ida, q->id);
+ fail_q:
+diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
+index 06007f0e..52222a2f 100644
+--- a/crypto/asymmetric_keys/x509_public_key.c
++++ b/crypto/asymmetric_keys/x509_public_key.c
+@@ -106,7 +106,6 @@ error_no_sig:
+ static int x509_key_preparse(struct key_preparsed_payload *prep)
+ {
+ 	struct x509_certificate *cert;
+-	struct tm now;
+ 	size_t srlen, sulen;
+ 	char *desc = NULL;
+ 	int ret;
+@@ -137,43 +136,6 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
+ 		goto error_free_cert;
+ 	}
+ 
+-	time_to_tm(CURRENT_TIME.tv_sec, 0, &now);
+-	pr_devel("Now: %04ld-%02d-%02d %02d:%02d:%02d\n",
+-		 now.tm_year + 1900, now.tm_mon + 1, now.tm_mday,
+-		 now.tm_hour, now.tm_min,  now.tm_sec);
+-	if (now.tm_year < cert->valid_from.tm_year ||
+-	    (now.tm_year == cert->valid_from.tm_year &&
+-	     (now.tm_mon < cert->valid_from.tm_mon ||
+-	      (now.tm_mon == cert->valid_from.tm_mon &&
+-	       (now.tm_mday < cert->valid_from.tm_mday ||
+-		(now.tm_mday == cert->valid_from.tm_mday &&
+-		 (now.tm_hour < cert->valid_from.tm_hour ||
+-		  (now.tm_hour == cert->valid_from.tm_hour &&
+-		   (now.tm_min < cert->valid_from.tm_min ||
+-		    (now.tm_min == cert->valid_from.tm_min &&
+-		     (now.tm_sec < cert->valid_from.tm_sec
+-		      ))))))))))) {
+-		pr_warn("Cert %s is not yet valid\n", cert->fingerprint);
+-		ret = -EKEYREJECTED;
+-		goto error_free_cert;
+-	}
+-	if (now.tm_year > cert->valid_to.tm_year ||
+-	    (now.tm_year == cert->valid_to.tm_year &&
+-	     (now.tm_mon > cert->valid_to.tm_mon ||
+-	      (now.tm_mon == cert->valid_to.tm_mon &&
+-	       (now.tm_mday > cert->valid_to.tm_mday ||
+-		(now.tm_mday == cert->valid_to.tm_mday &&
+-		 (now.tm_hour > cert->valid_to.tm_hour ||
+-		  (now.tm_hour == cert->valid_to.tm_hour &&
+-		   (now.tm_min > cert->valid_to.tm_min ||
+-		    (now.tm_min == cert->valid_to.tm_min &&
+-		     (now.tm_sec > cert->valid_to.tm_sec
+-		      ))))))))))) {
+-		pr_warn("Cert %s has expired\n", cert->fingerprint);
+-		ret = -EKEYEXPIRED;
+-		goto error_free_cert;
+-	}
+-
+ 	cert->pub->algo = x509_public_key_algorithms[cert->pkey_algo];
+ 	cert->pub->id_type = PKEY_ID_X509;
+ 
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index e36842b9..a02a91cd 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -63,6 +63,9 @@ static struct acpi_scan_handler pci_root_handler = {
+ 	.ids = root_device_ids,
+ 	.attach = acpi_pci_root_add,
+ 	.detach = acpi_pci_root_remove,
++	.hotplug = {
++		.ignore = true,
++	},
+ };
+ 
+ /* Lock to protect both acpi_pci_roots lists */
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 362f0c2a..cca761e8 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -1790,7 +1790,7 @@ static void acpi_scan_init_hotplug(acpi_handle handle, int type)
+ 	 */
+ 	list_for_each_entry(hwid, &pnp.ids, list) {
+ 		handler = acpi_scan_match_handler(hwid->id, NULL);
+-		if (handler) {
++		if (handler && !handler->hotplug.ignore) {
+ 			acpi_install_notify_handler(handle, ACPI_SYSTEM_NOTIFY,
+ 					acpi_hotplug_notify_cb, handler);
+ 			break;
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index b1126254..3d67f764 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -292,6 +292,10 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	{ PCI_VDEVICE(INTEL, 0x8d66), board_ahci }, /* Wellsburg RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x8d6e), board_ahci }, /* Wellsburg RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x23a3), board_ahci }, /* Coleto Creek AHCI */
++	{ PCI_VDEVICE(INTEL, 0x9c83), board_ahci }, /* Wildcat Point-LP AHCI */
++	{ PCI_VDEVICE(INTEL, 0x9c85), board_ahci }, /* Wildcat Point-LP RAID */
++	{ PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */
++	{ PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */
+ 
+ 	/* JMicron 360/1/3/5/6, match class to avoid IDE function */
+ 	{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+@@ -431,6 +435,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	  .driver_data = board_ahci_yes_fbs },			/* 88se9172 on some Gigabyte */
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x91a3),
+ 	  .driver_data = board_ahci_yes_fbs },
++	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230),
++	  .driver_data = board_ahci_yes_fbs },
+ 
+ 	/* Promise */
+ 	{ PCI_VDEVICE(PROMISE, 0x3f20), board_ahci },	/* PDC42819 */
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index 7b9bdd82..8905e03a 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -1266,9 +1266,11 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class,
+ {
+ 	struct ata_port *ap = link->ap;
+ 	struct ahci_host_priv *hpriv = ap->host->private_data;
++	struct ahci_port_priv *pp = ap->private_data;
+ 	const char *reason = NULL;
+ 	unsigned long now, msecs;
+ 	struct ata_taskfile tf;
++	bool fbs_disabled = false;
+ 	int rc;
+ 
+ 	DPRINTK("ENTER\n");
+@@ -1278,6 +1280,16 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class,
+ 	if (rc && rc != -EOPNOTSUPP)
+ 		ata_link_warn(link, "failed to reset engine (errno=%d)\n", rc);
+ 
++	/*
++	 * According to AHCI-1.2 9.3.9: if FBS is enable, software shall
++	 * clear PxFBS.EN to '0' prior to issuing software reset to devices
++	 * that is attached to port multiplier.
++	 */
++	if (!ata_is_host_link(link) && pp->fbs_enabled) {
++		ahci_disable_fbs(ap);
++		fbs_disabled = true;
++	}
++
+ 	ata_tf_init(link->device, &tf);
+ 
+ 	/* issue the first D2H Register FIS */
+@@ -1318,6 +1330,10 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class,
+ 	} else
+ 		*class = ahci_dev_classify(ap);
+ 
++	/* re-enable FBS if disabled before */
++	if (fbs_disabled)
++		ahci_enable_fbs(ap);
++
+ 	DPRINTK("EXIT, class=%u\n", *class);
+ 	return 0;
+ 
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index adf002a3..cd6aa28a 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4110,6 +4110,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ 	{ "TORiSAN DVD-ROM DRD-N216", NULL,	ATA_HORKAGE_MAX_SEC_128 },
+ 	{ "QUANTUM DAT    DAT72-000", NULL,	ATA_HORKAGE_ATAPI_MOD16_DMA },
+ 	{ "Slimtype DVD A  DS8A8SH", NULL,	ATA_HORKAGE_MAX_SEC_LBA48 },
++	{ "Slimtype DVD A  DS8A9SH", NULL,	ATA_HORKAGE_MAX_SEC_LBA48 },
+ 
+ 	/* Devices we expect to fail diagnostics */
+ 
+diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
+index c04d393d..08e67285 100644
+--- a/drivers/ata/libata-transport.c
++++ b/drivers/ata/libata-transport.c
+@@ -319,25 +319,25 @@ int ata_tport_add(struct device *parent,
+ /*
+  * ATA link attributes
+  */
++static int noop(int x) { return x; }
+ 
+-
+-#define ata_link_show_linkspeed(field)					\
++#define ata_link_show_linkspeed(field, format)			        \
+ static ssize_t								\
+ show_ata_link_##field(struct device *dev,				\
+ 		      struct device_attribute *attr, char *buf)		\
+ {									\
+ 	struct ata_link *link = transport_class_to_link(dev);		\
+ 									\
+-	return sprintf(buf,"%s\n", sata_spd_string(fls(link->field)));	\
++	return sprintf(buf, "%s\n", sata_spd_string(format(link->field))); \
+ }
+ 
+-#define ata_link_linkspeed_attr(field)					\
+-	ata_link_show_linkspeed(field)					\
++#define ata_link_linkspeed_attr(field, format)				\
++	ata_link_show_linkspeed(field, format)				\
+ static DEVICE_ATTR(field, S_IRUGO, show_ata_link_##field, NULL)
+ 
+-ata_link_linkspeed_attr(hw_sata_spd_limit);
+-ata_link_linkspeed_attr(sata_spd_limit);
+-ata_link_linkspeed_attr(sata_spd);
++ata_link_linkspeed_attr(hw_sata_spd_limit, fls);
++ata_link_linkspeed_attr(sata_spd_limit, fls);
++ata_link_linkspeed_attr(sata_spd, noop);
+ 
+ 
+ static DECLARE_TRANSPORT_CLASS(ata_link_class,
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 35fa3689..06051767 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -499,7 +499,7 @@ static void __device_release_driver(struct device *dev)
+ 						     BUS_NOTIFY_UNBIND_DRIVER,
+ 						     dev);
+ 
+-		pm_runtime_put(dev);
++		pm_runtime_put_sync(dev);
+ 
+ 		if (dev->bus && dev->bus->remove)
+ 			dev->bus->remove(dev);
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 00559736..4a811654 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -894,13 +894,6 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
+ 
+ 	bio_list_init(&lo->lo_bio_list);
+ 
+-	/*
+-	 * set queue make_request_fn, and add limits based on lower level
+-	 * device
+-	 */
+-	blk_queue_make_request(lo->lo_queue, loop_make_request);
+-	lo->lo_queue->queuedata = lo;
+-
+ 	if (!(lo_flags & LO_FLAGS_READ_ONLY) && file->f_op->fsync)
+ 		blk_queue_flush(lo->lo_queue, REQ_FLUSH);
+ 
+@@ -1618,6 +1611,8 @@ static int loop_add(struct loop_device **l, int i)
+ 	if (!lo)
+ 		goto out;
+ 
++	lo->lo_state = Lo_unbound;
++
+ 	/* allocate id, if @id >= 0, we're requesting that specific id */
+ 	if (i >= 0) {
+ 		err = idr_alloc(&loop_index_idr, lo, i, i + 1, GFP_KERNEL);
+@@ -1633,7 +1628,13 @@ static int loop_add(struct loop_device **l, int i)
+ 	err = -ENOMEM;
+ 	lo->lo_queue = blk_alloc_queue(GFP_KERNEL);
+ 	if (!lo->lo_queue)
+-		goto out_free_dev;
++		goto out_free_idr;
++
++	/*
++	 * set queue make_request_fn
++	 */
++	blk_queue_make_request(lo->lo_queue, loop_make_request);
++	lo->lo_queue->queuedata = lo;
+ 
+ 	disk = lo->lo_disk = alloc_disk(1 << part_shift);
+ 	if (!disk)
+@@ -1678,6 +1679,8 @@ static int loop_add(struct loop_device **l, int i)
+ 
+ out_free_queue:
+ 	blk_cleanup_queue(lo->lo_queue);
++out_free_idr:
++	idr_remove(&loop_index_idr, i);
+ out_free_dev:
+ 	kfree(lo);
+ out:
+diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
+index d81dfca7..03dd4aa6 100644
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -649,6 +649,8 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
+ 	unsigned long secure;
+ 	struct phys_req preq;
+ 
++	xen_blkif_get(blkif);
++
+ 	preq.sector_number = req->u.discard.sector_number;
+ 	preq.nr_sects      = req->u.discard.nr_sectors;
+ 
+@@ -661,7 +663,6 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
+ 	}
+ 	blkif->st_ds_req++;
+ 
+-	xen_blkif_get(blkif);
+ 	secure = (blkif->vbd.discard_secure &&
+ 		 (req->u.discard.flag & BLKIF_DISCARD_SECURE)) ?
+ 		 BLKDEV_DISCARD_SECURE : 0;
+diff --git a/drivers/clk/mvebu/clk-core.c b/drivers/clk/mvebu/clk-core.c
+index 0a53edba..e5c477b4 100644
+--- a/drivers/clk/mvebu/clk-core.c
++++ b/drivers/clk/mvebu/clk-core.c
+@@ -126,8 +126,8 @@ static void __init mvebu_clk_core_setup(struct device_node *np,
+ #define	    SARH_AXP_FAB_FREQ_OPT_SHIFT	    4
+ 
+ static const u32 __initconst armada_370_tclk_frequencies[] = {
+-	16600000,
+-	20000000,
++	166000000,
++	200000000,
+ };
+ 
+ static u32 __init armada_370_get_tclk_freq(void __iomem *sar)
+diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c
+index b61b5a3f..8c4771da 100644
+--- a/drivers/cpufreq/highbank-cpufreq.c
++++ b/drivers/cpufreq/highbank-cpufreq.c
+@@ -66,7 +66,8 @@ static int hb_cpufreq_driver_init(void)
+ 	struct device_node *np;
+ 	int ret;
+ 
+-	if (!of_machine_is_compatible("calxeda,highbank"))
++	if ((!of_machine_is_compatible("calxeda,highbank")) &&
++		(!of_machine_is_compatible("calxeda,ecx-2000")))
+ 		return -ENODEV;
+ 
+ 	for_each_child_of_node(of_find_node_by_path("/cpus"), np)
+diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
+index ca6ea9b3..fa43a42c 100644
+--- a/drivers/dma/ioat/dma_v3.c
++++ b/drivers/dma/ioat/dma_v3.c
+@@ -87,13 +87,6 @@ static const u8 pq_idx_to_field[] = { 1, 4, 5, 0, 1, 2, 4, 5 };
+ static const u8 pq16_idx_to_field[] = { 1, 4, 1, 2, 3, 4, 5, 6, 7,
+ 					0, 1, 2, 3, 4, 5, 6 };
+ 
+-/*
+- * technically sources 1 and 2 do not require SED, but the op will have
+- * at least 9 descriptors so that's irrelevant.
+- */
+-static const u8 pq16_idx_to_sed[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0,
+-				      1, 1, 1, 1, 1, 1, 1 };
+-
+ static void ioat3_eh(struct ioat2_dma_chan *ioat);
+ 
+ static dma_addr_t xor_get_src(struct ioat_raw_descriptor *descs[2], int idx)
+@@ -135,12 +128,6 @@ static void pq_set_src(struct ioat_raw_descriptor *descs[2],
+ 	pq->coef[idx] = coef;
+ }
+ 
+-static int sed_get_pq16_pool_idx(int src_cnt)
+-{
+-
+-	return pq16_idx_to_sed[src_cnt];
+-}
+-
+ static bool is_jf_ioat(struct pci_dev *pdev)
+ {
+ 	switch (pdev->device) {
+@@ -1182,9 +1169,6 @@ __ioat3_prep_pq16_lock(struct dma_chan *c, enum sum_check_flags *result,
+ 	u8 op;
+ 	int i, s, idx, num_descs;
+ 
+-	/* this function only handles src_cnt 9 - 16 */
+-	BUG_ON(src_cnt < 9);
+-
+ 	/* this function is only called with 9-16 sources */
+ 	op = result ? IOAT_OP_PQ_VAL_16S : IOAT_OP_PQ_16S;
+ 
+@@ -1212,8 +1196,7 @@ __ioat3_prep_pq16_lock(struct dma_chan *c, enum sum_check_flags *result,
+ 
+ 		descs[0] = (struct ioat_raw_descriptor *) pq;
+ 
+-		desc->sed = ioat3_alloc_sed(device,
+-					    sed_get_pq16_pool_idx(src_cnt));
++		desc->sed = ioat3_alloc_sed(device, (src_cnt-2) >> 3);
+ 		if (!desc->sed) {
+ 			dev_err(to_dev(chan),
+ 				"%s: no free sed entries\n", __func__);
+@@ -1271,13 +1254,21 @@ __ioat3_prep_pq16_lock(struct dma_chan *c, enum sum_check_flags *result,
+ 	return &desc->txd;
+ }
+ 
++static int src_cnt_flags(unsigned int src_cnt, unsigned long flags)
++{
++	if (dmaf_p_disabled_continue(flags))
++		return src_cnt + 1;
++	else if (dmaf_continue(flags))
++		return src_cnt + 3;
++	else
++		return src_cnt;
++}
++
+ static struct dma_async_tx_descriptor *
+ ioat3_prep_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
+ 	      unsigned int src_cnt, const unsigned char *scf, size_t len,
+ 	      unsigned long flags)
+ {
+-	struct dma_device *dma = chan->device;
+-
+ 	/* specify valid address for disabled result */
+ 	if (flags & DMA_PREP_PQ_DISABLE_P)
+ 		dst[0] = dst[1];
+@@ -1297,7 +1288,7 @@ ioat3_prep_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
+ 		single_source_coef[0] = scf[0];
+ 		single_source_coef[1] = 0;
+ 
+-		return (src_cnt > 8) && (dma->max_pq > 8) ?
++		return src_cnt_flags(src_cnt, flags) > 8 ?
+ 			__ioat3_prep_pq16_lock(chan, NULL, dst, single_source,
+ 					       2, single_source_coef, len,
+ 					       flags) :
+@@ -1305,7 +1296,7 @@ ioat3_prep_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
+ 					     single_source_coef, len, flags);
+ 
+ 	} else {
+-		return (src_cnt > 8) && (dma->max_pq > 8) ?
++		return src_cnt_flags(src_cnt, flags) > 8 ?
+ 			__ioat3_prep_pq16_lock(chan, NULL, dst, src, src_cnt,
+ 					       scf, len, flags) :
+ 			__ioat3_prep_pq_lock(chan, NULL, dst, src, src_cnt,
+@@ -1318,8 +1309,6 @@ ioat3_prep_pq_val(struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src,
+ 		  unsigned int src_cnt, const unsigned char *scf, size_t len,
+ 		  enum sum_check_flags *pqres, unsigned long flags)
+ {
+-	struct dma_device *dma = chan->device;
+-
+ 	/* specify valid address for disabled result */
+ 	if (flags & DMA_PREP_PQ_DISABLE_P)
+ 		pq[0] = pq[1];
+@@ -1331,7 +1320,7 @@ ioat3_prep_pq_val(struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src,
+ 	 */
+ 	*pqres = 0;
+ 
+-	return (src_cnt > 8) && (dma->max_pq > 8) ?
++	return src_cnt_flags(src_cnt, flags) > 8 ?
+ 		__ioat3_prep_pq16_lock(chan, pqres, pq, src, src_cnt, scf, len,
+ 				       flags) :
+ 		__ioat3_prep_pq_lock(chan, pqres, pq, src, src_cnt, scf, len,
+@@ -1342,7 +1331,6 @@ static struct dma_async_tx_descriptor *
+ ioat3_prep_pqxor(struct dma_chan *chan, dma_addr_t dst, dma_addr_t *src,
+ 		 unsigned int src_cnt, size_t len, unsigned long flags)
+ {
+-	struct dma_device *dma = chan->device;
+ 	unsigned char scf[src_cnt];
+ 	dma_addr_t pq[2];
+ 
+@@ -1351,7 +1339,7 @@ ioat3_prep_pqxor(struct dma_chan *chan, dma_addr_t dst, dma_addr_t *src,
+ 	flags |= DMA_PREP_PQ_DISABLE_Q;
+ 	pq[1] = dst; /* specify valid address for disabled result */
+ 
+-	return (src_cnt > 8) && (dma->max_pq > 8) ?
++	return src_cnt_flags(src_cnt, flags) > 8 ?
+ 		__ioat3_prep_pq16_lock(chan, NULL, pq, src, src_cnt, scf, len,
+ 				       flags) :
+ 		__ioat3_prep_pq_lock(chan, NULL, pq, src, src_cnt, scf, len,
+@@ -1363,7 +1351,6 @@ ioat3_prep_pqxor_val(struct dma_chan *chan, dma_addr_t *src,
+ 		     unsigned int src_cnt, size_t len,
+ 		     enum sum_check_flags *result, unsigned long flags)
+ {
+-	struct dma_device *dma = chan->device;
+ 	unsigned char scf[src_cnt];
+ 	dma_addr_t pq[2];
+ 
+@@ -1377,8 +1364,7 @@ ioat3_prep_pqxor_val(struct dma_chan *chan, dma_addr_t *src,
+ 	flags |= DMA_PREP_PQ_DISABLE_Q;
+ 	pq[1] = pq[0]; /* specify valid address for disabled result */
+ 
+-
+-	return (src_cnt > 8) && (dma->max_pq > 8) ?
++	return src_cnt_flags(src_cnt, flags) > 8 ?
+ 		__ioat3_prep_pq16_lock(chan, result, pq, &src[1], src_cnt - 1,
+ 				       scf, len, flags) :
+ 		__ioat3_prep_pq_lock(chan, result, pq, &src[1], src_cnt - 1,
+diff --git a/drivers/edac/highbank_l2_edac.c b/drivers/edac/highbank_l2_edac.c
+index c2bd8c6a..10d3d298 100644
+--- a/drivers/edac/highbank_l2_edac.c
++++ b/drivers/edac/highbank_l2_edac.c
+@@ -90,28 +90,30 @@ static int highbank_l2_err_probe(struct platform_device *pdev)
+ 		goto err;
+ 	}
+ 
++	dci->mod_name = dev_name(&pdev->dev);
++	dci->dev_name = dev_name(&pdev->dev);
++
++	if (edac_device_add_device(dci))
++		goto err;
++
+ 	drvdata->db_irq = platform_get_irq(pdev, 0);
+ 	res = devm_request_irq(&pdev->dev, drvdata->db_irq,
+ 			       highbank_l2_err_handler,
+ 			       0, dev_name(&pdev->dev), dci);
+ 	if (res < 0)
+-		goto err;
++		goto err2;
+ 
+ 	drvdata->sb_irq = platform_get_irq(pdev, 1);
+ 	res = devm_request_irq(&pdev->dev, drvdata->sb_irq,
+ 			       highbank_l2_err_handler,
+ 			       0, dev_name(&pdev->dev), dci);
+ 	if (res < 0)
+-		goto err;
+-
+-	dci->mod_name = dev_name(&pdev->dev);
+-	dci->dev_name = dev_name(&pdev->dev);
+-
+-	if (edac_device_add_device(dci))
+-		goto err;
++		goto err2;
+ 
+ 	devres_close_group(&pdev->dev, NULL);
+ 	return 0;
++err2:
++	edac_device_del_device(&pdev->dev);
+ err:
+ 	devres_release_group(&pdev->dev, NULL);
+ 	edac_device_free_ctl_info(dci);
+diff --git a/drivers/edac/highbank_mc_edac.c b/drivers/edac/highbank_mc_edac.c
+index 4695dd2d..7a783075 100644
+--- a/drivers/edac/highbank_mc_edac.c
++++ b/drivers/edac/highbank_mc_edac.c
+@@ -189,14 +189,6 @@ static int highbank_mc_probe(struct platform_device *pdev)
+ 		goto err;
+ 	}
+ 
+-	irq = platform_get_irq(pdev, 0);
+-	res = devm_request_irq(&pdev->dev, irq, highbank_mc_err_handler,
+-			       0, dev_name(&pdev->dev), mci);
+-	if (res < 0) {
+-		dev_err(&pdev->dev, "Unable to request irq %d\n", irq);
+-		goto err;
+-	}
+-
+ 	mci->mtype_cap = MEM_FLAG_DDR3;
+ 	mci->edac_ctl_cap = EDAC_FLAG_NONE | EDAC_FLAG_SECDED;
+ 	mci->edac_cap = EDAC_FLAG_SECDED;
+@@ -217,10 +209,20 @@ static int highbank_mc_probe(struct platform_device *pdev)
+ 	if (res < 0)
+ 		goto err;
+ 
++	irq = platform_get_irq(pdev, 0);
++	res = devm_request_irq(&pdev->dev, irq, highbank_mc_err_handler,
++			       0, dev_name(&pdev->dev), mci);
++	if (res < 0) {
++		dev_err(&pdev->dev, "Unable to request irq %d\n", irq);
++		goto err2;
++	}
++
+ 	highbank_mc_create_debugfs_nodes(mci);
+ 
+ 	devres_close_group(&pdev->dev, NULL);
+ 	return 0;
++err2:
++	edac_mc_del_mc(&pdev->dev);
+ err:
+ 	devres_release_group(&pdev->dev, NULL);
+ 	edac_mc_free(mci);
+diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
+index 3a4816ad..5c27da6a 100644
+--- a/drivers/gpio/gpio-mvebu.c
++++ b/drivers/gpio/gpio-mvebu.c
+@@ -79,7 +79,7 @@ struct mvebu_gpio_chip {
+ 	spinlock_t	   lock;
+ 	void __iomem	  *membase;
+ 	void __iomem	  *percpu_membase;
+-	unsigned int       irqbase;
++	int		   irqbase;
+ 	struct irq_domain *domain;
+ 	int                soc_variant;
+ };
+diff --git a/drivers/gpio/gpio-pl061.c b/drivers/gpio/gpio-pl061.c
+index 6a4bd0da..4fbe12d2 100644
+--- a/drivers/gpio/gpio-pl061.c
++++ b/drivers/gpio/gpio-pl061.c
+@@ -286,11 +286,6 @@ static int pl061_probe(struct amba_device *adev, const struct amba_id *id)
+ 	if (!chip->base)
+ 		return -ENOMEM;
+ 
+-	chip->domain = irq_domain_add_simple(adev->dev.of_node, PL061_GPIO_NR,
+-					     irq_base, &pl061_domain_ops, chip);
+-	if (!chip->domain)
+-		return -ENODEV;
+-
+ 	spin_lock_init(&chip->lock);
+ 
+ 	chip->gc.request = pl061_gpio_request;
+@@ -320,6 +315,11 @@ static int pl061_probe(struct amba_device *adev, const struct amba_id *id)
+ 	irq_set_chained_handler(irq, pl061_irq_handler);
+ 	irq_set_handler_data(irq, chip);
+ 
++	chip->domain = irq_domain_add_simple(adev->dev.of_node, PL061_GPIO_NR,
++					     irq_base, &pl061_domain_ops, chip);
++	if (!chip->domain)
++		return -ENODEV;
++
+ 	for (i = 0; i < PL061_GPIO_NR; i++) {
+ 		if (pdata) {
+ 			if (pdata->directions & (1 << i))
+diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
+index b4ca4509..c45ad478 100644
+--- a/drivers/gpio/gpio-rcar.c
++++ b/drivers/gpio/gpio-rcar.c
+@@ -329,7 +329,7 @@ static int gpio_rcar_probe(struct platform_device *pdev)
+ 	if (!p->irq_domain) {
+ 		ret = -ENXIO;
+ 		dev_err(&pdev->dev, "cannot initialize irq domain\n");
+-		goto err1;
++		goto err0;
+ 	}
+ 
+ 	if (devm_request_irq(&pdev->dev, irq->start,
+diff --git a/drivers/gpio/gpio-twl4030.c b/drivers/gpio/gpio-twl4030.c
+index 4d330e36..ed1d10ae 100644
+--- a/drivers/gpio/gpio-twl4030.c
++++ b/drivers/gpio/gpio-twl4030.c
+@@ -354,17 +354,18 @@ static void twl_set(struct gpio_chip *chip, unsigned offset, int value)
+ static int twl_direction_out(struct gpio_chip *chip, unsigned offset, int value)
+ {
+ 	struct gpio_twl4030_priv *priv = to_gpio_twl4030(chip);
++	int ret = -EINVAL;
+ 
+ 	mutex_lock(&priv->mutex);
+ 	if (offset < TWL4030_GPIO_MAX)
+-		twl4030_set_gpio_dataout(offset, value);
++		ret = twl4030_set_gpio_direction(offset, 0);
+ 
+ 	priv->direction |= BIT(offset);
+ 	mutex_unlock(&priv->mutex);
+ 
+ 	twl_set(chip, offset, value);
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static int twl_to_irq(struct gpio_chip *chip, unsigned offset)
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index ab952595..c714d4d5 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -6262,7 +6262,9 @@ static void i9xx_update_cursor(struct drm_crtc *crtc, u32 base)
+ 		intel_crtc->cursor_visible = visible;
+ 	}
+ 	/* and commit changes on next vblank */
++	POSTING_READ(CURCNTR(pipe));
+ 	I915_WRITE(CURBASE(pipe), base);
++	POSTING_READ(CURBASE(pipe));
+ }
+ 
+ static void ivb_update_cursor(struct drm_crtc *crtc, u32 base)
+@@ -6289,7 +6291,9 @@ static void ivb_update_cursor(struct drm_crtc *crtc, u32 base)
+ 		intel_crtc->cursor_visible = visible;
+ 	}
+ 	/* and commit changes on next vblank */
++	POSTING_READ(CURCNTR_IVB(pipe));
+ 	I915_WRITE(CURBASE_IVB(pipe), base);
++	POSTING_READ(CURBASE_IVB(pipe));
+ }
+ 
+ /* If no-part of the cursor is visible on the framebuffer, then the GPU may hang... */
+diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
+index b4b4d0c1..5bccf31c 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -287,7 +287,8 @@ validate_fini_list(struct list_head *list, struct nouveau_fence *fence)
+ 	list_for_each_safe(entry, tmp, list) {
+ 		nvbo = list_entry(entry, struct nouveau_bo, entry);
+ 
+-		nouveau_bo_fence(nvbo, fence);
++		if (likely(fence))
++			nouveau_bo_fence(nvbo, fence);
+ 
+ 		if (unlikely(nvbo->validate_mapped)) {
+ 			ttm_bo_kunmap(&nvbo->kmap);
+diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c
+index b3c51275..7002de79 100644
+--- a/drivers/gpu/drm/qxl/qxl_fb.c
++++ b/drivers/gpu/drm/qxl/qxl_fb.c
+@@ -91,7 +91,7 @@ static void qxl_fb_dirty_flush(struct fb_info *info)
+ 	u32 x1, x2, y1, y2;
+ 
+ 	/* TODO: hard coding 32 bpp */
+-	int stride = qfbdev->qfb.base.pitches[0] * 4;
++	int stride = qfbdev->qfb.base.pitches[0];
+ 
+ 	x1 = qfbdev->dirty.x1;
+ 	x2 = qfbdev->dirty.x2;
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index d5df8fd1..22f06c8d 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1683,7 +1683,7 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
+ 				if (pll != ATOM_PPLL_INVALID)
+ 					return pll;
+ 			}
+-		} else {
++		} else if (!ASIC_IS_DCE41(rdev)) { /* Don't share PLLs on DCE4.1 chips */
+ 			/* use the same PPLL for all monitors with the same clock */
+ 			pll = radeon_get_shared_nondp_ppll(crtc);
+ 			if (pll != ATOM_PPLL_INVALID)
+diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
+index bb9ea364..067cc1fc 100644
+--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
++++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
+@@ -219,8 +219,7 @@ void evergreen_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode
+ 	/* fglrx clears sth in AFMT_AUDIO_PACKET_CONTROL2 here */
+ 
+ 	WREG32(HDMI_ACR_PACKET_CONTROL + offset,
+-	       HDMI_ACR_AUTO_SEND | /* allow hw to sent ACR packets when required */
+-	       HDMI_ACR_SOURCE); /* select SW CTS value */
++	       HDMI_ACR_AUTO_SEND); /* allow hw to sent ACR packets when required */
+ 
+ 	evergreen_hdmi_update_ACR(encoder, mode->clock);
+ 
+diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
+index 0efe2a93..635e8f2e 100644
+--- a/drivers/gpu/drm/radeon/r600_hdmi.c
++++ b/drivers/gpu/drm/radeon/r600_hdmi.c
+@@ -57,15 +57,15 @@ enum r600_hdmi_iec_status_bits {
+ static const struct radeon_hdmi_acr r600_hdmi_predefined_acr[] = {
+     /*	     32kHz	  44.1kHz	48kHz    */
+     /* Clock      N     CTS      N     CTS      N     CTS */
+-    {  25174,  4576,  28125,  7007,  31250,  6864,  28125 }, /*  25,20/1.001 MHz */
++    {  25175,  4576,  28125,  7007,  31250,  6864,  28125 }, /*  25,20/1.001 MHz */
+     {  25200,  4096,  25200,  6272,  28000,  6144,  25200 }, /*  25.20       MHz */
+     {  27000,  4096,  27000,  6272,  30000,  6144,  27000 }, /*  27.00       MHz */
+     {  27027,  4096,  27027,  6272,  30030,  6144,  27027 }, /*  27.00*1.001 MHz */
+     {  54000,  4096,  54000,  6272,  60000,  6144,  54000 }, /*  54.00       MHz */
+     {  54054,  4096,  54054,  6272,  60060,  6144,  54054 }, /*  54.00*1.001 MHz */
+-    {  74175, 11648, 210937, 17836, 234375, 11648, 140625 }, /*  74.25/1.001 MHz */
++    {  74176, 11648, 210937, 17836, 234375, 11648, 140625 }, /*  74.25/1.001 MHz */
+     {  74250,  4096,  74250,  6272,  82500,  6144,  74250 }, /*  74.25       MHz */
+-    { 148351, 11648, 421875,  8918, 234375,  5824, 140625 }, /* 148.50/1.001 MHz */
++    { 148352, 11648, 421875,  8918, 234375,  5824, 140625 }, /* 148.50/1.001 MHz */
+     { 148500,  4096, 148500,  6272, 165000,  6144, 148500 }, /* 148.50       MHz */
+     {      0,  4096,      0,  6272,      0,  6144,      0 }  /* Other */
+ };
+@@ -75,8 +75,15 @@ static const struct radeon_hdmi_acr r600_hdmi_predefined_acr[] = {
+  */
+ static void r600_hdmi_calc_cts(uint32_t clock, int *CTS, int N, int freq)
+ {
+-	if (*CTS == 0)
+-		*CTS = clock * N / (128 * freq) * 1000;
++	u64 n;
++	u32 d;
++
++	if (*CTS == 0) {
++		n = (u64)clock * (u64)N * 1000ULL;
++		d = 128 * freq;
++		do_div(n, d);
++		*CTS = n;
++	}
+ 	DRM_DEBUG("Using ACR timing N=%d CTS=%d for frequency %d\n",
+ 		  N, *CTS, freq);
+ }
+@@ -313,8 +320,8 @@ void r600_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode *mod
+ 	}
+ 
+ 	WREG32(HDMI0_ACR_PACKET_CONTROL + offset,
+-	       HDMI0_ACR_AUTO_SEND | /* allow hw to sent ACR packets when required */
+-	       HDMI0_ACR_SOURCE); /* select SW CTS value */
++	       HDMI0_ACR_SOURCE | /* select SW CTS value - XXX verify that hw CTS works on all families */
++	       HDMI0_ACR_AUTO_SEND); /* allow hw to sent ACR packets when required */
+ 
+ 	WREG32(HDMI0_VBI_PACKET_CONTROL + offset,
+ 	       HDMI0_NULL_SEND | /* send null packets when required */
+diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
+index 5ce190b8..2915a1c5 100644
+--- a/drivers/gpu/drm/radeon/radeon_gart.c
++++ b/drivers/gpu/drm/radeon/radeon_gart.c
+@@ -1157,6 +1157,8 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
+ 		return -ENOMEM;
+ 
+ 	r = radeon_ib_get(rdev, ridx, &ib, NULL, ndw * 4);
++	if (r)
++		return r;
+ 	ib.length_dw = 0;
+ 
+ 	r = radeon_vm_update_pdes(rdev, vm, &ib, bo_va->soffset, bo_va->eoffset);
+diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+index 7cb178a3..bc73021d 100644
+--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
++++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+@@ -422,6 +422,7 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
+ 	/* Pin framebuffer & get tilling informations */
+ 	obj = radeon_fb->obj;
+ 	rbo = gem_to_radeon_bo(obj);
++retry:
+ 	r = radeon_bo_reserve(rbo, false);
+ 	if (unlikely(r != 0))
+ 		return r;
+@@ -430,6 +431,33 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
+ 				     &base);
+ 	if (unlikely(r != 0)) {
+ 		radeon_bo_unreserve(rbo);
++
++		/* On old GPU like RN50 with little vram pining can fails because
++		 * current fb is taking all space needed. So instead of unpining
++		 * the old buffer after pining the new one, first unpin old one
++		 * and then retry pining new one.
++		 *
++		 * As only master can set mode only master can pin and it is
++		 * unlikely the master client will race with itself especialy
++		 * on those old gpu with single crtc.
++		 *
++		 * We don't shutdown the display controller because new buffer
++		 * will end up in same spot.
++		 */
++		if (!atomic && fb && fb != crtc->fb) {
++			struct radeon_bo *old_rbo;
++			unsigned long nsize, osize;
++
++			old_rbo = gem_to_radeon_bo(to_radeon_framebuffer(fb)->obj);
++			osize = radeon_bo_size(old_rbo);
++			nsize = radeon_bo_size(rbo);
++			if (nsize <= osize && !radeon_bo_reserve(old_rbo, false)) {
++				radeon_bo_unpin(old_rbo);
++				radeon_bo_unreserve(old_rbo);
++				fb = NULL;
++				goto retry;
++			}
++		}
+ 		return -EINVAL;
+ 	}
+ 	radeon_bo_get_tiling_flags(rbo, &tiling_flags, NULL);
+diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
+index f3ccf6d4..a809b173 100644
+--- a/drivers/gpu/drm/radeon/radeon_uvd.c
++++ b/drivers/gpu/drm/radeon/radeon_uvd.c
+@@ -242,6 +242,8 @@ void radeon_uvd_free_handles(struct radeon_device *rdev, struct drm_file *filp)
+ 		if (handle != 0 && rdev->uvd.filp[i] == filp) {
+ 			struct radeon_fence *fence;
+ 
++			radeon_uvd_note_usage(rdev);
++
+ 			r = radeon_uvd_get_destroy_msg(rdev,
+ 				R600_RING_TYPE_UVD_INDEX, handle, &fence);
+ 			if (r) {
+diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
+index 495f41f2..108c8d25 100644
+--- a/drivers/gpu/drm/radeon/sid.h
++++ b/drivers/gpu/drm/radeon/sid.h
+@@ -247,7 +247,7 @@
+ #define		NOOFGROUPS_SHIFT				12
+ #define		NOOFGROUPS_MASK					0x00001000
+ 
+-#define	MC_SEQ_TRAIN_WAKEUP_CNTL			0x2808
++#define	MC_SEQ_TRAIN_WAKEUP_CNTL			0x28e8
+ #define		TRAIN_DONE_D0      			(1 << 30)
+ #define		TRAIN_DONE_D1      			(1 << 31)
+ 
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index 9b07b7d4..8697abd7 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -1153,24 +1153,32 @@ out_unlock:
+ 	return ret;
+ }
+ 
+-static int ttm_bo_mem_compat(struct ttm_placement *placement,
+-			     struct ttm_mem_reg *mem)
++static bool ttm_bo_mem_compat(struct ttm_placement *placement,
++			      struct ttm_mem_reg *mem,
++			      uint32_t *new_flags)
+ {
+ 	int i;
+ 
+ 	if (mem->mm_node && placement->lpfn != 0 &&
+ 	    (mem->start < placement->fpfn ||
+ 	     mem->start + mem->num_pages > placement->lpfn))
+-		return -1;
++		return false;
+ 
+ 	for (i = 0; i < placement->num_placement; i++) {
+-		if ((placement->placement[i] & mem->placement &
+-			TTM_PL_MASK_CACHING) &&
+-			(placement->placement[i] & mem->placement &
+-			TTM_PL_MASK_MEM))
+-			return i;
++		*new_flags = placement->placement[i];
++		if ((*new_flags & mem->placement & TTM_PL_MASK_CACHING) &&
++		    (*new_flags & mem->placement & TTM_PL_MASK_MEM))
++			return true;
++	}
++
++	for (i = 0; i < placement->num_busy_placement; i++) {
++		*new_flags = placement->busy_placement[i];
++		if ((*new_flags & mem->placement & TTM_PL_MASK_CACHING) &&
++		    (*new_flags & mem->placement & TTM_PL_MASK_MEM))
++			return true;
+ 	}
+-	return -1;
++
++	return false;
+ }
+ 
+ int ttm_bo_validate(struct ttm_buffer_object *bo,
+@@ -1179,6 +1187,7 @@ int ttm_bo_validate(struct ttm_buffer_object *bo,
+ 			bool no_wait_gpu)
+ {
+ 	int ret;
++	uint32_t new_flags;
+ 
+ 	BUG_ON(!ttm_bo_is_reserved(bo));
+ 	/* Check that range is valid */
+@@ -1189,8 +1198,7 @@ int ttm_bo_validate(struct ttm_buffer_object *bo,
+ 	/*
+ 	 * Check whether we need to move buffer.
+ 	 */
+-	ret = ttm_bo_mem_compat(placement, &bo->mem);
+-	if (ret < 0) {
++	if (!ttm_bo_mem_compat(placement, &bo->mem, &new_flags)) {
+ 		ret = ttm_bo_move_buffer(bo, placement, interruptible,
+ 					 no_wait_gpu);
+ 		if (ret)
+@@ -1200,7 +1208,7 @@ int ttm_bo_validate(struct ttm_buffer_object *bo,
+ 		 * Use the access and other non-mapping-related flag bits from
+ 		 * the compatible memory placement flags to the active flags
+ 		 */
+-		ttm_flag_masked(&bo->mem.placement, placement->placement[ret],
++		ttm_flag_masked(&bo->mem.placement, new_flags,
+ 				~TTM_PL_MASK_MEMTYPE);
+ 	}
+ 	/*
+diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
+index af894584..b7f75715 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
+@@ -342,19 +342,25 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
+ 	if (ret)
+ 		goto out;
+ 
++	/*
++	 * Single TTM move. NOP.
++	 */
+ 	if (old_iomap == NULL && new_iomap == NULL)
+ 		goto out2;
++
++	/*
++	 * Move nonexistent data. NOP.
++	 */
+ 	if (old_iomap == NULL && ttm == NULL)
+ 		goto out2;
+ 
+-	if (ttm->state == tt_unpopulated) {
++	/*
++	 * TTM might be null for moves within the same region.
++	 */
++	if (ttm && ttm->state == tt_unpopulated) {
+ 		ret = ttm->bdev->driver->ttm_tt_populate(ttm);
+-		if (ret) {
+-			/* if we fail here don't nuke the mm node
+-			 * as the bo still owns it */
+-			old_copy.mm_node = NULL;
++		if (ret)
+ 			goto out1;
+-		}
+ 	}
+ 
+ 	add = 0;
+@@ -380,11 +386,8 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
+ 						   prot);
+ 		} else
+ 			ret = ttm_copy_io_page(new_iomap, old_iomap, page);
+-		if (ret) {
+-			/* failing here, means keep old copy as-is */
+-			old_copy.mm_node = NULL;
++		if (ret)
+ 			goto out1;
+-		}
+ 	}
+ 	mb();
+ out2:
+@@ -402,7 +405,12 @@ out1:
+ 	ttm_mem_reg_iounmap(bdev, old_mem, new_iomap);
+ out:
+ 	ttm_mem_reg_iounmap(bdev, &old_copy, old_iomap);
+-	ttm_bo_mem_put(bo, &old_copy);
++
++	/*
++	 * On error, keep the mm node!
++	 */
++	if (!ret)
++		ttm_bo_mem_put(bo, &old_copy);
+ 	return ret;
+ }
+ EXPORT_SYMBOL(ttm_bo_move_memcpy);
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index fb52f3f6..bee88ee8 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -352,12 +352,14 @@ config LOGITECH_FF
+ 	  force feedback.
+ 
+ config LOGIRUMBLEPAD2_FF
+-	bool "Logitech RumblePad/Rumblepad 2 force feedback support"
++	bool "Logitech force feedback support (variant 2)"
+ 	depends on HID_LOGITECH
+ 	select INPUT_FF_MEMLESS
+ 	help
+-	  Say Y here if you want to enable force feedback support for Logitech
+-	  RumblePad and Rumblepad 2 devices.
++	  Say Y here if you want to enable force feedback support for:
++	  - Logitech RumblePad
++	  - Logitech Rumblepad 2
++	  - Logitech Formula Vibration Feedback Wheel
+ 
+ config LOGIG940_FF
+ 	bool "Logitech Flight System G940 force feedback support"
+@@ -436,9 +438,11 @@ config HID_MULTITOUCH
+ 	  - Pixcir dual touch panels
+ 	  - Quanta panels
+ 	  - eGalax dual-touch panels, including the Joojoo and Wetab tablets
++	  - SiS multitouch panels
+ 	  - Stantum multitouch panels
+ 	  - Touch International Panels
+ 	  - Unitec Panels
++	  - Wistron optical touch panels
+ 	  - XAT optical touch panels
+ 	  - Xiroku optical touch panels
+ 	  - Zytronic touch panels
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index c7710b5c..d54e1d0a 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -46,6 +46,12 @@ module_param(iso_layout, uint, 0644);
+ MODULE_PARM_DESC(iso_layout, "Enable/Disable hardcoded ISO-layout of the keyboard. "
+ 		"(0 = disabled, [1] = enabled)");
+ 
++static unsigned int swap_opt_cmd = 0;
++module_param(swap_opt_cmd, uint, 0644);
++MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\") keys. "
++		"(For people who want to keep Windows PC keyboard muscle memory. "
++		"[0] = as-is, Mac layout. 1 = swapped, Windows layout.)");
++
+ struct apple_sc {
+ 	unsigned long quirks;
+ 	unsigned int fn_on;
+@@ -150,6 +156,14 @@ static const struct apple_key_translation apple_iso_keyboard[] = {
+ 	{ }
+ };
+ 
++static const struct apple_key_translation swapped_option_cmd_keys[] = {
++	{ KEY_LEFTALT,	KEY_LEFTMETA },
++	{ KEY_LEFTMETA,	KEY_LEFTALT },
++	{ KEY_RIGHTALT,	KEY_RIGHTMETA },
++	{ KEY_RIGHTMETA,KEY_RIGHTALT },
++	{ }
++};
++
+ static const struct apple_key_translation *apple_find_translation(
+ 		const struct apple_key_translation *table, u16 from)
+ {
+@@ -242,6 +256,14 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
+ 		}
+ 	}
+ 
++	if (swap_opt_cmd) {
++		trans = apple_find_translation(swapped_option_cmd_keys, usage->code);
++		if (trans) {
++			input_event(input, usage->type, trans->to, value);
++			return 1;
++		}
++	}
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/hid/hid-axff.c b/drivers/hid/hid-axff.c
+index 64ab94a5..a594e478 100644
+--- a/drivers/hid/hid-axff.c
++++ b/drivers/hid/hid-axff.c
+@@ -95,7 +95,7 @@ static int axff_init(struct hid_device *hid)
+ 		}
+ 	}
+ 
+-	if (field_count < 4) {
++	if (field_count < 4 && hid->product != 0xf705) {
+ 		hid_err(hid, "not enough fields in the report: %d\n",
+ 			field_count);
+ 		return -ENODEV;
+@@ -180,6 +180,7 @@ static void ax_remove(struct hid_device *hdev)
+ 
+ static const struct hid_device_id ax_devices[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0x0802), },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0xf705), },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(hid, ax_devices);
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index e04bf0ef..c4e5cdfa 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1562,6 +1562,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_RP_649) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0x0802) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0xf705) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MIGHTYMOUSE) },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICMOUSE) },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICTRACKPAD) },
+@@ -1703,6 +1704,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_FLIGHT_SYSTEM_G940) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOMO_WHEEL) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_VIBRATION_WHEEL) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_DFP_WHEEL) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_DFGT_WHEEL) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G25_WHEEL) },
+@@ -1750,12 +1752,14 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_KEYBOARD) },
+ #if IS_ENABLED(CONFIG_HID_ROCCAT)
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ARVO) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ISKU) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ISKUFX) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONEPLUS) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONEPURE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONEPURE_OPTICAL) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONEXTD) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KOVAPLUS) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_LUA) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_PYRA_WIRED) },
+@@ -1765,6 +1769,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_PS1000) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_SIS2_TOUCH, USB_DEVICE_ID_SIS9200_TOUCH) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_SIS2_TOUCH, USB_DEVICE_ID_SIS817_TOUCH) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SKYCABLE, USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER) },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_BDREMOTE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) },
+@@ -2317,15 +2323,6 @@ bool hid_ignore(struct hid_device *hdev)
+ 				hdev->type == HID_TYPE_USBNONE)
+ 			return true;
+ 		break;
+-	case USB_VENDOR_ID_DWAV:
+-		/* These are handled by usbtouchscreen. hdev->type is probably
+-		 * HID_TYPE_USBNONE, but we say !HID_TYPE_USBMOUSE to match
+-		 * usbtouchscreen. */
+-		if ((hdev->product == USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER ||
+-		     hdev->product == USB_DEVICE_ID_DWAV_TOUCHCONTROLLER) &&
+-		    hdev->type != HID_TYPE_USBMOUSE)
+-			return true;
+-		break;
+ 	case USB_VENDOR_ID_VELLEMAN:
+ 		/* These are not HID devices.  They are handled by comedi. */
+ 		if ((hdev->product >= USB_DEVICE_ID_VELLEMAN_K8055_FIRST &&
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 114fd166..799dbec2 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -330,6 +330,11 @@
+ #define USB_VENDOR_ID_GENERAL_TOUCH	0x0dfc
+ #define USB_DEVICE_ID_GENERAL_TOUCH_WIN7_TWOFINGERS 0x0003
+ #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PWT_TENFINGERS 0x0100
++#define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_0101 0x0101
++#define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_0102 0x0102
++#define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_0106 0x0106
++#define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_010A 0x010a
++#define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100
+ 
+ #define USB_VENDOR_ID_GLAB		0x06c2
+ #define USB_DEVICE_ID_4_PHIDGETSERVO_30	0x0038
+@@ -557,6 +562,7 @@
+ #define USB_DEVICE_ID_DINOVO_EDGE	0xc714
+ #define USB_DEVICE_ID_DINOVO_MINI	0xc71f
+ #define USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2	0xca03
++#define USB_DEVICE_ID_LOGITECH_VIBRATION_WHEEL	0xca04
+ 
+ #define USB_VENDOR_ID_LUMIO		0x202e
+ #define USB_DEVICE_ID_CRYSTALTOUCH	0x0006
+@@ -730,6 +736,10 @@
+ #define USB_VENDOR_ID_SIGMATEL		0x066F
+ #define USB_DEVICE_ID_SIGMATEL_STMP3780	0x3780
+ 
++#define USB_VENDOR_ID_SIS2_TOUCH	0x0457
++#define USB_DEVICE_ID_SIS9200_TOUCH	0x9200
++#define USB_DEVICE_ID_SIS817_TOUCH	0x0817
++
+ #define USB_VENDOR_ID_SKYCABLE			0x1223
+ #define	USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER	0x3F07
+ 
+@@ -869,6 +879,9 @@
+ #define USB_DEVICE_ID_SUPER_DUAL_BOX_PRO 0x8802
+ #define USB_DEVICE_ID_SUPER_JOY_BOX_5_PRO 0x8804
+ 
++#define USB_VENDOR_ID_WISTRON		0x0fb8
++#define USB_DEVICE_ID_WISTRON_OPTICAL_TOUCH		0x1109
++
+ #define USB_VENDOR_ID_X_TENSIONS               0x1ae7
+ #define USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE    0x9001
+ 
+diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
+index 6f12ecd3..1bfd292c 100644
+--- a/drivers/hid/hid-lg.c
++++ b/drivers/hid/hid-lg.c
+@@ -45,6 +45,7 @@
+ /* Size of the original descriptors of the Driving Force (and Pro) wheels */
+ #define DF_RDESC_ORIG_SIZE	130
+ #define DFP_RDESC_ORIG_SIZE	97
++#define FV_RDESC_ORIG_SIZE	130
+ #define MOMO_RDESC_ORIG_SIZE	87
+ 
+ /* Fixed report descriptors for Logitech Driving Force (and Pro)
+@@ -170,6 +171,73 @@ static __u8 dfp_rdesc_fixed[] = {
+ 0xC0                /*  End Collection                          */
+ };
+ 
++static __u8 fv_rdesc_fixed[] = {
++0x05, 0x01,         /*  Usage Page (Desktop),                   */
++0x09, 0x04,         /*  Usage (Joystik),                        */
++0xA1, 0x01,         /*  Collection (Application),               */
++0xA1, 0x02,         /*      Collection (Logical),               */
++0x95, 0x01,         /*          Report Count (1),               */
++0x75, 0x0A,         /*          Report Size (10),               */
++0x15, 0x00,         /*          Logical Minimum (0),            */
++0x26, 0xFF, 0x03,   /*          Logical Maximum (1023),         */
++0x35, 0x00,         /*          Physical Minimum (0),           */
++0x46, 0xFF, 0x03,   /*          Physical Maximum (1023),        */
++0x09, 0x30,         /*          Usage (X),                      */
++0x81, 0x02,         /*          Input (Variable),               */
++0x95, 0x0C,         /*          Report Count (12),              */
++0x75, 0x01,         /*          Report Size (1),                */
++0x25, 0x01,         /*          Logical Maximum (1),            */
++0x45, 0x01,         /*          Physical Maximum (1),           */
++0x05, 0x09,         /*          Usage Page (Button),            */
++0x19, 0x01,         /*          Usage Minimum (01h),            */
++0x29, 0x0C,         /*          Usage Maximum (0Ch),            */
++0x81, 0x02,         /*          Input (Variable),               */
++0x95, 0x02,         /*          Report Count (2),               */
++0x06, 0x00, 0xFF,   /*          Usage Page (FF00h),             */
++0x09, 0x01,         /*          Usage (01h),                    */
++0x81, 0x02,         /*          Input (Variable),               */
++0x09, 0x02,         /*          Usage (02h),                    */
++0x26, 0xFF, 0x00,   /*          Logical Maximum (255),          */
++0x46, 0xFF, 0x00,   /*          Physical Maximum (255),         */
++0x95, 0x01,         /*          Report Count (1),               */
++0x75, 0x08,         /*          Report Size (8),                */
++0x81, 0x02,         /*          Input (Variable),               */
++0x05, 0x01,         /*          Usage Page (Desktop),           */
++0x25, 0x07,         /*          Logical Maximum (7),            */
++0x46, 0x3B, 0x01,   /*          Physical Maximum (315),         */
++0x75, 0x04,         /*          Report Size (4),                */
++0x65, 0x14,         /*          Unit (Degrees),                 */
++0x09, 0x39,         /*          Usage (Hat Switch),             */
++0x81, 0x42,         /*          Input (Variable, Null State),   */
++0x75, 0x01,         /*          Report Size (1),                */
++0x95, 0x04,         /*          Report Count (4),               */
++0x65, 0x00,         /*          Unit,                           */
++0x06, 0x00, 0xFF,   /*          Usage Page (FF00h),             */
++0x09, 0x01,         /*          Usage (01h),                    */
++0x25, 0x01,         /*          Logical Maximum (1),            */
++0x45, 0x01,         /*          Physical Maximum (1),           */
++0x81, 0x02,         /*          Input (Variable),               */
++0x05, 0x01,         /*          Usage Page (Desktop),           */
++0x95, 0x01,         /*          Report Count (1),               */
++0x75, 0x08,         /*          Report Size (8),                */
++0x26, 0xFF, 0x00,   /*          Logical Maximum (255),          */
++0x46, 0xFF, 0x00,   /*          Physical Maximum (255),         */
++0x09, 0x31,         /*          Usage (Y),                      */
++0x81, 0x02,         /*          Input (Variable),               */
++0x09, 0x32,         /*          Usage (Z),                      */
++0x81, 0x02,         /*          Input (Variable),               */
++0xC0,               /*      End Collection,                     */
++0xA1, 0x02,         /*      Collection (Logical),               */
++0x26, 0xFF, 0x00,   /*          Logical Maximum (255),          */
++0x46, 0xFF, 0x00,   /*          Physical Maximum (255),         */
++0x95, 0x07,         /*          Report Count (7),               */
++0x75, 0x08,         /*          Report Size (8),                */
++0x09, 0x03,         /*          Usage (03h),                    */
++0x91, 0x02,         /*          Output (Variable),              */
++0xC0,               /*      End Collection,                     */
++0xC0                /*  End Collection                          */
++};
++
+ static __u8 momo_rdesc_fixed[] = {
+ 0x05, 0x01,         /*  Usage Page (Desktop),               */
+ 0x09, 0x04,         /*  Usage (Joystik),                    */
+@@ -275,6 +343,15 @@ static __u8 *lg_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 		}
+ 		break;
+ 
++	case USB_DEVICE_ID_LOGITECH_VIBRATION_WHEEL:
++		if (*rsize == FV_RDESC_ORIG_SIZE) {
++			hid_info(hdev,
++				"fixing up Logitech Formula Vibration report descriptor\n");
++			rdesc = fv_rdesc_fixed;
++			*rsize = sizeof(fv_rdesc_fixed);
++		}
++		break;
++
+ 	case USB_DEVICE_ID_LOGITECH_DFP_WHEEL:
+ 		if (*rsize == DFP_RDESC_ORIG_SIZE) {
+ 			hid_info(hdev,
+@@ -492,6 +569,7 @@ static int lg_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ 		case USB_DEVICE_ID_LOGITECH_G27_WHEEL:
+ 		case USB_DEVICE_ID_LOGITECH_WII_WHEEL:
+ 		case USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2:
++		case USB_DEVICE_ID_LOGITECH_VIBRATION_WHEEL:
+ 			field->application = HID_GD_MULTIAXIS;
+ 			break;
+ 		default:
+@@ -639,6 +717,8 @@ static const struct hid_device_id lg_devices[] = {
+ 		.driver_data = LG_NOGET | LG_FF4 },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2),
+ 		.driver_data = LG_FF4 },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_VIBRATION_WHEEL),
++		.driver_data = LG_FF2 },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G25_WHEEL),
+ 		.driver_data = LG_FF4 },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_DFGT_WHEEL),
+diff --git a/drivers/hid/hid-lg2ff.c b/drivers/hid/hid-lg2ff.c
+index 1a42eaa6..0e3fb1a7 100644
+--- a/drivers/hid/hid-lg2ff.c
++++ b/drivers/hid/hid-lg2ff.c
+@@ -95,7 +95,7 @@ int lg2ff_init(struct hid_device *hid)
+ 
+ 	hid_hw_request(hid, report, HID_REQ_SET_REPORT);
+ 
+-	hid_info(hid, "Force feedback for Logitech RumblePad/Rumblepad 2 by Anssi Hannula <anssi.hannula@×××××.com>\n");
++	hid_info(hid, "Force feedback for Logitech variant 2 rumble devices by Anssi Hannula <anssi.hannula@×××××.com>\n");
+ 
+ 	return 0;
+ }
+diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
+index 8782fe1a..35180536 100644
+--- a/drivers/hid/hid-lg4ff.c
++++ b/drivers/hid/hid-lg4ff.c
+@@ -218,12 +218,46 @@ static void hid_lg4ff_set_autocenter_default(struct input_dev *dev, u16 magnitud
+ 	struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
+ 	struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
+ 	__s32 *value = report->field[0]->value;
++	__u32 expand_a, expand_b;
++
++	/* De-activate Auto-Center */
++	if (magnitude == 0) {
++		value[0] = 0xf5;
++		value[1] = 0x00;
++		value[2] = 0x00;
++		value[3] = 0x00;
++		value[4] = 0x00;
++		value[5] = 0x00;
++		value[6] = 0x00;
++
++		hid_hw_request(hid, report, HID_REQ_SET_REPORT);
++		return;
++	}
++
++	if (magnitude <= 0xaaaa) {
++		expand_a = 0x0c * magnitude;
++		expand_b = 0x80 * magnitude;
++	} else {
++		expand_a = (0x0c * 0xaaaa) + 0x06 * (magnitude - 0xaaaa);
++		expand_b = (0x80 * 0xaaaa) + 0xff * (magnitude - 0xaaaa);
++	}
+ 
+ 	value[0] = 0xfe;
+ 	value[1] = 0x0d;
+-	value[2] = magnitude >> 13;
+-	value[3] = magnitude >> 13;
+-	value[4] = magnitude >> 8;
++	value[2] = expand_a / 0xaaaa;
++	value[3] = expand_a / 0xaaaa;
++	value[4] = expand_b / 0xaaaa;
++	value[5] = 0x00;
++	value[6] = 0x00;
++
++	hid_hw_request(hid, report, HID_REQ_SET_REPORT);
++
++	/* Activate Auto-Center */
++	value[0] = 0x14;
++	value[1] = 0x00;
++	value[2] = 0x00;
++	value[3] = 0x00;
++	value[4] = 0x00;
+ 	value[5] = 0x00;
+ 	value[6] = 0x00;
+ 
+@@ -540,17 +574,6 @@ int lg4ff_init(struct hid_device *hid)
+ 	if (error)
+ 		return error;
+ 
+-	/* Check if autocentering is available and
+-	 * set the centering force to zero by default */
+-	if (test_bit(FF_AUTOCENTER, dev->ffbit)) {
+-		if (rev_maj == FFEX_REV_MAJ && rev_min == FFEX_REV_MIN)	/* Formula Force EX expects different autocentering command */
+-			dev->ff->set_autocenter = hid_lg4ff_set_autocenter_ffex;
+-		else
+-			dev->ff->set_autocenter = hid_lg4ff_set_autocenter_default;
+-
+-		dev->ff->set_autocenter(dev, 0);
+-	}
+-
+ 	/* Get private driver data */
+ 	drv_data = hid_get_drvdata(hid);
+ 	if (!drv_data) {
+@@ -571,6 +594,17 @@ int lg4ff_init(struct hid_device *hid)
+ 	entry->max_range = lg4ff_devices[i].max_range;
+ 	entry->set_range = lg4ff_devices[i].set_range;
+ 
++	/* Check if autocentering is available and
++	 * set the centering force to zero by default */
++	if (test_bit(FF_AUTOCENTER, dev->ffbit)) {
++		if (rev_maj == FFEX_REV_MAJ && rev_min == FFEX_REV_MIN)	/* Formula Force EX expects different autocentering command */
++			dev->ff->set_autocenter = hid_lg4ff_set_autocenter_ffex;
++		else
++			dev->ff->set_autocenter = hid_lg4ff_set_autocenter_default;
++
++		dev->ff->set_autocenter(dev, 0);
++	}
++
+ 	/* Create sysfs interface */
+ 	error = device_create_file(&hid->dev, &dev_attr_range);
+ 	if (error)
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index b6701cec..3d8e58ac 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -244,12 +244,12 @@ static struct mt_class mt_classes[] = {
+ 	{ .name	= MT_CLS_GENERALTOUCH_TWOFINGERS,
+ 		.quirks	= MT_QUIRK_NOT_SEEN_MEANS_UP |
+ 			MT_QUIRK_VALID_IS_INRANGE |
+-			MT_QUIRK_SLOT_IS_CONTACTNUMBER,
++			MT_QUIRK_SLOT_IS_CONTACTID,
+ 		.maxcontacts = 2
+ 	},
+ 	{ .name	= MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
+ 		.quirks	= MT_QUIRK_NOT_SEEN_MEANS_UP |
+-			MT_QUIRK_SLOT_IS_CONTACTNUMBER
++			MT_QUIRK_SLOT_IS_CONTACTID
+ 	},
+ 
+ 	{ .name = MT_CLS_FLATFROG,
+@@ -1191,6 +1191,21 @@ static const struct hid_device_id mt_devices[] = {
+ 	{ .driver_data = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
+ 		MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
+ 			USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PWT_TENFINGERS) },
++	{ .driver_data = MT_CLS_GENERALTOUCH_TWOFINGERS,
++		MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
++			USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_0101) },
++	{ .driver_data = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
++		MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
++			USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_0102) },
++	{ .driver_data = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
++		MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
++			USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_0106) },
++	{ .driver_data = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
++		MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
++			USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_010A) },
++	{ .driver_data = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
++		MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
++			USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100) },
+ 
+ 	/* Gametel game controller */
+ 	{ .driver_data = MT_CLS_NSMU,
+@@ -1302,6 +1317,14 @@ static const struct hid_device_id mt_devices[] = {
+ 		MT_USB_DEVICE(USB_VENDOR_ID_QUANTA,
+ 			USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008) },
+ 
++	/* SiS panels */
++	{ .driver_data = MT_CLS_DEFAULT,
++		HID_USB_DEVICE(USB_VENDOR_ID_SIS2_TOUCH,
++		USB_DEVICE_ID_SIS9200_TOUCH) },
++	{ .driver_data = MT_CLS_DEFAULT,
++		HID_USB_DEVICE(USB_VENDOR_ID_SIS2_TOUCH,
++		USB_DEVICE_ID_SIS817_TOUCH) },
++
+ 	/* Stantum panels */
+ 	{ .driver_data = MT_CLS_CONFIDENCE,
+ 		MT_USB_DEVICE(USB_VENDOR_ID_STANTUM,
+@@ -1330,6 +1353,12 @@ static const struct hid_device_id mt_devices[] = {
+ 	{ .driver_data = MT_CLS_NSMU,
+ 		MT_USB_DEVICE(USB_VENDOR_ID_UNITEC,
+ 			USB_DEVICE_ID_UNITEC_USB_TOUCH_0A19) },
++
++	/* Wistron panels */
++	{ .driver_data = MT_CLS_NSMU,
++		MT_USB_DEVICE(USB_VENDOR_ID_WISTRON,
++			USB_DEVICE_ID_WISTRON_OPTICAL_TOUCH) },
++
+ 	/* XAT */
+ 	{ .driver_data = MT_CLS_NSMU,
+ 		MT_USB_DEVICE(USB_VENDOR_ID_XAT,
+diff --git a/drivers/hid/hid-roccat-common.c b/drivers/hid/hid-roccat-common.c
+index 74f70403..e8408999 100644
+--- a/drivers/hid/hid-roccat-common.c
++++ b/drivers/hid/hid-roccat-common.c
+@@ -65,10 +65,11 @@ int roccat_common2_send(struct usb_device *usb_dev, uint report_id,
+ EXPORT_SYMBOL_GPL(roccat_common2_send);
+ 
+ enum roccat_common2_control_states {
+-	ROCCAT_COMMON_CONTROL_STATUS_OVERLOAD = 0,
++	ROCCAT_COMMON_CONTROL_STATUS_CRITICAL = 0,
+ 	ROCCAT_COMMON_CONTROL_STATUS_OK = 1,
+ 	ROCCAT_COMMON_CONTROL_STATUS_INVALID = 2,
+-	ROCCAT_COMMON_CONTROL_STATUS_WAIT = 3,
++	ROCCAT_COMMON_CONTROL_STATUS_BUSY = 3,
++	ROCCAT_COMMON_CONTROL_STATUS_CRITICAL_NEW = 4,
+ };
+ 
+ static int roccat_common2_receive_control_status(struct usb_device *usb_dev)
+@@ -88,13 +89,12 @@ static int roccat_common2_receive_control_status(struct usb_device *usb_dev)
+ 		switch (control.value) {
+ 		case ROCCAT_COMMON_CONTROL_STATUS_OK:
+ 			return 0;
+-		case ROCCAT_COMMON_CONTROL_STATUS_WAIT:
++		case ROCCAT_COMMON_CONTROL_STATUS_BUSY:
+ 			msleep(500);
+ 			continue;
+ 		case ROCCAT_COMMON_CONTROL_STATUS_INVALID:
+-
+-		case ROCCAT_COMMON_CONTROL_STATUS_OVERLOAD:
+-			/* seems to be critical - replug necessary */
++		case ROCCAT_COMMON_CONTROL_STATUS_CRITICAL:
++		case ROCCAT_COMMON_CONTROL_STATUS_CRITICAL_NEW:
+ 			return -EINVAL;
+ 		default:
+ 			dev_err(&usb_dev->dev,
+diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
+index b8b37789..2c571dad 100644
+--- a/drivers/hid/hid-roccat-kovaplus.c
++++ b/drivers/hid/hid-roccat-kovaplus.c
+@@ -577,9 +577,13 @@ static void kovaplus_keep_values_up_to_date(struct kovaplus_device *kovaplus,
+ 		break;
+ 	case KOVAPLUS_MOUSE_REPORT_BUTTON_TYPE_CPI:
+ 		kovaplus->actual_cpi = kovaplus_convert_event_cpi(button_report->data1);
++		break;
+ 	case KOVAPLUS_MOUSE_REPORT_BUTTON_TYPE_SENSITIVITY:
+ 		kovaplus->actual_x_sensitivity = button_report->data1;
+ 		kovaplus->actual_y_sensitivity = button_report->data2;
++		break;
++	default:
++		break;
+ 	}
+ }
+ 
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index aa34755c..b189feb6 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -327,7 +327,8 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
+ 				field->logical == attr_usage_id) {
+ 				sensor_hub_fill_attr_info(info, i, report->id,
+ 					field->unit, field->unit_exponent,
+-					field->report_size);
++					field->report_size *
++							field->report_count);
+ 				ret = 0;
+ 			} else {
+ 				for (j = 0; j < field->maxusage; ++j) {
+@@ -339,7 +340,8 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
+ 							i, report->id,
+ 							field->unit,
+ 							field->unit_exponent,
+-							field->report_size);
++							field->report_size *
++							field->report_count);
+ 						ret = 0;
+ 						break;
+ 					}
+@@ -426,9 +428,10 @@ static int sensor_hub_raw_event(struct hid_device *hdev,
+ 		hid_dbg(hdev, "%d collection_index:%x hid:%x sz:%x\n",
+ 				i, report->field[i]->usage->collection_index,
+ 				report->field[i]->usage->hid,
+-				report->field[i]->report_size/8);
+-
+-		sz = report->field[i]->report_size/8;
++				(report->field[i]->report_size *
++					report->field[i]->report_count)/8);
++		sz = (report->field[i]->report_size *
++					report->field[i]->report_count)/8;
+ 		if (pdata->pending.status && pdata->pending.attr_usage_id ==
+ 				report->field[i]->usage->hid) {
+ 			hid_dbg(hdev, "data was pending ...\n");
+diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
+index 145a4cb5..0bb3bb88 100644
+--- a/drivers/hid/uhid.c
++++ b/drivers/hid/uhid.c
+@@ -312,7 +312,7 @@ static int uhid_event_from_user(const char __user *buffer, size_t len,
+ 			 */
+ 			struct uhid_create_req_compat *compat;
+ 
+-			compat = kmalloc(sizeof(*compat), GFP_KERNEL);
++			compat = kzalloc(sizeof(*compat), GFP_KERNEL);
+ 			if (!compat)
+ 				return -ENOMEM;
+ 
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 07345521..ae5c6347 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -84,6 +84,8 @@ static const struct hid_blacklist {
+ 	{ USB_VENDOR_ID_REALTEK, USB_DEVICE_ID_REALTEK_READER, HID_QUIRK_NO_INIT_REPORTS },
+ 	{ USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_SIGMATEL, USB_DEVICE_ID_SIGMATEL_STMP3780, HID_QUIRK_NOGET },
++	{ USB_VENDOR_ID_SIS2_TOUCH, USB_DEVICE_ID_SIS9200_TOUCH, HID_QUIRK_NOGET },
++	{ USB_VENDOR_ID_SIS2_TOUCH, USB_DEVICE_ID_SIS817_TOUCH, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_1, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_2, HID_QUIRK_NOGET },
+diff --git a/drivers/i2c/muxes/i2c-mux-gpio.c b/drivers/i2c/muxes/i2c-mux-gpio.c
+index 5a0ce008..bb4f69f7 100644
+--- a/drivers/i2c/muxes/i2c-mux-gpio.c
++++ b/drivers/i2c/muxes/i2c-mux-gpio.c
+@@ -31,15 +31,15 @@ static void i2c_mux_gpio_set(const struct gpiomux *mux, unsigned val)
+ 	int i;
+ 
+ 	for (i = 0; i < mux->data.n_gpios; i++)
+-		gpio_set_value(mux->gpio_base + mux->data.gpios[i],
+-			       val & (1 << i));
++		gpio_set_value_cansleep(mux->gpio_base + mux->data.gpios[i],
++					val & (1 << i));
+ }
+ 
+ static int i2c_mux_gpio_select(struct i2c_adapter *adap, void *data, u32 chan)
+ {
+ 	struct gpiomux *mux = data;
+ 
+-	i2c_mux_gpio_set(mux, mux->data.values[chan]);
++	i2c_mux_gpio_set(mux, chan);
+ 
+ 	return 0;
+ }
+@@ -223,7 +223,7 @@ static int i2c_mux_gpio_probe(struct platform_device *pdev)
+ 		unsigned int class = mux->data.classes ? mux->data.classes[i] : 0;
+ 
+ 		mux->adap[i] = i2c_add_mux_adapter(parent, &pdev->dev, mux, nr,
+-						   i, class,
++						   mux->data.values[i], class,
+ 						   i2c_mux_gpio_select, deselect);
+ 		if (!mux->adap[i]) {
+ 			ret = -ENODEV;
+diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
+index 7229645b..7c9a1d97 100644
+--- a/drivers/iio/accel/kxsd9.c
++++ b/drivers/iio/accel/kxsd9.c
+@@ -112,9 +112,10 @@ static int kxsd9_read(struct iio_dev *indio_dev, u8 address)
+ 	mutex_lock(&st->buf_lock);
+ 	st->tx[0] = KXSD9_READ(address);
+ 	ret = spi_sync_transfer(st->us, xfers, ARRAY_SIZE(xfers));
+-	if (ret)
+-		return ret;
+-	return (((u16)(st->rx[0])) << 8) | (st->rx[1] & 0xF0);
++	if (!ret)
++		ret = (((u16)(st->rx[0])) << 8) | (st->rx[1] & 0xF0);
++	mutex_unlock(&st->buf_lock);
++	return ret;
+ }
+ 
+ static IIO_CONST_ATTR(accel_scale_available,
+diff --git a/drivers/infiniband/hw/ipath/ipath_user_sdma.c b/drivers/infiniband/hw/ipath/ipath_user_sdma.c
+index f5cb13b2..cc04b7ba 100644
+--- a/drivers/infiniband/hw/ipath/ipath_user_sdma.c
++++ b/drivers/infiniband/hw/ipath/ipath_user_sdma.c
+@@ -280,9 +280,7 @@ static int ipath_user_sdma_pin_pages(const struct ipath_devdata *dd,
+ 	int j;
+ 	int ret;
+ 
+-	ret = get_user_pages(current, current->mm, addr,
+-			     npages, 0, 1, pages, NULL);
+-
++	ret = get_user_pages_fast(addr, npages, 0, pages);
+ 	if (ret != npages) {
+ 		int i;
+ 
+@@ -811,10 +809,7 @@ int ipath_user_sdma_writev(struct ipath_devdata *dd,
+ 	while (dim) {
+ 		const int mxp = 8;
+ 
+-		down_write(&current->mm->mmap_sem);
+ 		ret = ipath_user_sdma_queue_pkts(dd, pq, &list, iov, dim, mxp);
+-		up_write(&current->mm->mmap_sem);
+-
+ 		if (ret <= 0)
+ 			goto done_unlock;
+ 		else {
+diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
+index 3f6b21e9..bd8cb0f8 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7322.c
++++ b/drivers/infiniband/hw/qib/qib_iba7322.c
+@@ -5853,21 +5853,20 @@ static int setup_txselect(const char *str, struct kernel_param *kp)
+ {
+ 	struct qib_devdata *dd;
+ 	unsigned long val;
+-	int ret;
+-
++	char *n;
+ 	if (strlen(str) >= MAX_ATTEN_LEN) {
+ 		pr_info("txselect_values string too long\n");
+ 		return -ENOSPC;
+ 	}
+-	ret = kstrtoul(str, 0, &val);
+-	if (ret || val >= (TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ +
++	val = simple_strtoul(str, &n, 0);
++	if (n == str || val >= (TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ +
+ 				TXDDS_MFG_SZ)) {
+ 		pr_info("txselect_values must start with a number < %d\n",
+ 			TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ + TXDDS_MFG_SZ);
+-		return ret ? ret : -EINVAL;
++		return -EINVAL;
+ 	}
+-
+ 	strcpy(txselect_list, str);
++
+ 	list_for_each_entry(dd, &qib_dev_list, list)
+ 		if (dd->deviceid == PCI_DEVICE_ID_QLOGIC_IB_7322)
+ 			set_no_qsfp_atten(dd, 1);
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 7ccf3284..793ac5dc 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -1300,14 +1300,13 @@ static void srp_handle_recv(struct srp_target_port *target, struct ib_wc *wc)
+ 			     PFX "Recv failed with error code %d\n", res);
+ }
+ 
+-static void srp_handle_qp_err(enum ib_wc_status wc_status,
+-			      enum ib_wc_opcode wc_opcode,
++static void srp_handle_qp_err(enum ib_wc_status wc_status, bool send_err,
+ 			      struct srp_target_port *target)
+ {
+ 	if (target->connected && !target->qp_in_error) {
+ 		shost_printk(KERN_ERR, target->scsi_host,
+ 			     PFX "failed %s status %d\n",
+-			     wc_opcode & IB_WC_RECV ? "receive" : "send",
++			     send_err ? "send" : "receive",
+ 			     wc_status);
+ 	}
+ 	target->qp_in_error = true;
+@@ -1323,7 +1322,7 @@ static void srp_recv_completion(struct ib_cq *cq, void *target_ptr)
+ 		if (likely(wc.status == IB_WC_SUCCESS)) {
+ 			srp_handle_recv(target, &wc);
+ 		} else {
+-			srp_handle_qp_err(wc.status, wc.opcode, target);
++			srp_handle_qp_err(wc.status, false, target);
+ 		}
+ 	}
+ }
+@@ -1339,7 +1338,7 @@ static void srp_send_completion(struct ib_cq *cq, void *target_ptr)
+ 			iu = (struct srp_iu *) (uintptr_t) wc.wr_id;
+ 			list_add(&iu->list, &target->free_tx);
+ 		} else {
+-			srp_handle_qp_err(wc.status, wc.opcode, target);
++			srp_handle_qp_err(wc.status, true, target);
+ 		}
+ 	}
+ }
+diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
+index f0f8928b..c122dd2a 100644
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -18,6 +18,8 @@
+ #include <linux/poll.h>
+ #include <linux/sched.h>
+ #include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <linux/mm.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
+ #include <linux/input/mt.h>
+@@ -289,7 +291,11 @@ static int evdev_release(struct inode *inode, struct file *file)
+ 	mutex_unlock(&evdev->mutex);
+ 
+ 	evdev_detach_client(evdev, client);
+-	kfree(client);
++
++	if (is_vmalloc_addr(client))
++		vfree(client);
++	else
++		kfree(client);
+ 
+ 	evdev_close_device(evdev);
+ 
+@@ -309,12 +315,14 @@ static int evdev_open(struct inode *inode, struct file *file)
+ {
+ 	struct evdev *evdev = container_of(inode->i_cdev, struct evdev, cdev);
+ 	unsigned int bufsize = evdev_compute_buffer_size(evdev->handle.dev);
++	unsigned int size = sizeof(struct evdev_client) +
++					bufsize * sizeof(struct input_event);
+ 	struct evdev_client *client;
+ 	int error;
+ 
+-	client = kzalloc(sizeof(struct evdev_client) +
+-				bufsize * sizeof(struct input_event),
+-			 GFP_KERNEL);
++	client = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
++	if (!client)
++		client = vzalloc(size);
+ 	if (!client)
+ 		return -ENOMEM;
+ 
+diff --git a/drivers/input/mouse/cypress_ps2.c b/drivers/input/mouse/cypress_ps2.c
+index f51765ff..888a81a7 100644
+--- a/drivers/input/mouse/cypress_ps2.c
++++ b/drivers/input/mouse/cypress_ps2.c
+@@ -439,7 +439,7 @@ static int cypress_get_finger_count(unsigned char header_byte)
+ 			case 2: return 5;
+ 			default:
+ 				/* Invalid contact (e.g. palm). Ignore it. */
+-				return -1;
++				return 0;
+ 		}
+ 	}
+ 
+@@ -452,17 +452,10 @@ static int cypress_parse_packet(struct psmouse *psmouse,
+ {
+ 	unsigned char *packet = psmouse->packet;
+ 	unsigned char header_byte = packet[0];
+-	int contact_cnt;
+ 
+ 	memset(report_data, 0, sizeof(struct cytp_report_data));
+ 
+-	contact_cnt = cypress_get_finger_count(header_byte);
+-
+-	if (contact_cnt < 0) /* e.g. palm detect */
+-		return -EINVAL;
+-
+-	report_data->contact_cnt = contact_cnt;
+-
++	report_data->contact_cnt = cypress_get_finger_count(header_byte);
+ 	report_data->tap = (header_byte & ABS_MULTIFINGER_TAP) ? 1 : 0;
+ 
+ 	if (report_data->contact_cnt == 1) {
+@@ -535,11 +528,9 @@ static void cypress_process_packet(struct psmouse *psmouse, bool zero_pkt)
+ 	int slots[CYTP_MAX_MT_SLOTS];
+ 	int n;
+ 
+-	if (cypress_parse_packet(psmouse, cytp, &report_data))
+-		return;
++	cypress_parse_packet(psmouse, cytp, &report_data);
+ 
+ 	n = report_data.contact_cnt;
+-
+ 	if (n > CYTP_MAX_MT_SLOTS)
+ 		n = CYTP_MAX_MT_SLOTS;
+ 
+@@ -605,10 +596,6 @@ static psmouse_ret_t cypress_validate_byte(struct psmouse *psmouse)
+ 		return PSMOUSE_BAD_DATA;
+ 
+ 	contact_cnt = cypress_get_finger_count(packet[0]);
+-
+-	if (contact_cnt < 0)
+-		return PSMOUSE_BAD_DATA;
+-
+ 	if (cytp->mode & CYTP_BIT_ABS_NO_PRESSURE)
+ 		cypress_set_packet_size(psmouse, contact_cnt == 2 ? 7 : 4);
+ 	else
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 5f306f79..0ec9abbe 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -765,6 +765,7 @@ static struct pnp_device_id pnp_kbd_devids[] = {
+ 	{ .id = "CPQA0D7", .driver_data = 0 },
+ 	{ .id = "", },
+ };
++MODULE_DEVICE_TABLE(pnp, pnp_kbd_devids);
+ 
+ static struct pnp_driver i8042_pnp_kbd_driver = {
+ 	.name           = "i8042 kbd",
+@@ -786,6 +787,7 @@ static struct pnp_device_id pnp_aux_devids[] = {
+ 	{ .id = "SYN0801", .driver_data = 0 },
+ 	{ .id = "", },
+ };
++MODULE_DEVICE_TABLE(pnp, pnp_aux_devids);
+ 
+ static struct pnp_driver i8042_pnp_aux_driver = {
+ 	.name           = "i8042 aux",
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index 721fdb35..ae4b6b90 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -146,12 +146,10 @@ enum {
+ 
+ #define USB_DEVICE_HID_CLASS(vend, prod) \
+ 	.match_flags = USB_DEVICE_ID_MATCH_INT_CLASS \
+-		| USB_DEVICE_ID_MATCH_INT_PROTOCOL \
+ 		| USB_DEVICE_ID_MATCH_DEVICE, \
+ 	.idVendor = (vend), \
+ 	.idProduct = (prod), \
+-	.bInterfaceClass = USB_INTERFACE_CLASS_HID, \
+-	.bInterfaceProtocol = USB_INTERFACE_PROTOCOL_MOUSE
++	.bInterfaceClass = USB_INTERFACE_CLASS_HID
+ 
+ static const struct usb_device_id usbtouch_devices[] = {
+ #ifdef CONFIG_TOUCHSCREEN_USB_EGALAX
+diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
+index df44b60e..516f9c92 100644
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -151,6 +151,9 @@ struct cache {
+ 	atomic_t nr_migrations;
+ 	wait_queue_head_t migration_wait;
+ 
++	wait_queue_head_t quiescing_wait;
++	atomic_t quiescing_ack;
++
+ 	/*
+ 	 * cache_size entries, dirty if set
+ 	 */
+@@ -742,8 +745,9 @@ static void cell_defer(struct cache *cache, struct dm_bio_prison_cell *cell,
+ 
+ static void cleanup_migration(struct dm_cache_migration *mg)
+ {
+-	dec_nr_migrations(mg->cache);
++	struct cache *cache = mg->cache;
+ 	free_migration(mg);
++	dec_nr_migrations(cache);
+ }
+ 
+ static void migration_failure(struct dm_cache_migration *mg)
+@@ -1340,34 +1344,51 @@ static void writeback_some_dirty_blocks(struct cache *cache)
+ /*----------------------------------------------------------------
+  * Main worker loop
+  *--------------------------------------------------------------*/
+-static void start_quiescing(struct cache *cache)
++static bool is_quiescing(struct cache *cache)
+ {
++	int r;
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&cache->lock, flags);
+-	cache->quiescing = 1;
++	r = cache->quiescing;
+ 	spin_unlock_irqrestore(&cache->lock, flags);
++
++	return r;
+ }
+ 
+-static void stop_quiescing(struct cache *cache)
++static void ack_quiescing(struct cache *cache)
++{
++	if (is_quiescing(cache)) {
++		atomic_inc(&cache->quiescing_ack);
++		wake_up(&cache->quiescing_wait);
++	}
++}
++
++static void wait_for_quiescing_ack(struct cache *cache)
++{
++	wait_event(cache->quiescing_wait, atomic_read(&cache->quiescing_ack));
++}
++
++static void start_quiescing(struct cache *cache)
+ {
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&cache->lock, flags);
+-	cache->quiescing = 0;
++	cache->quiescing = true;
+ 	spin_unlock_irqrestore(&cache->lock, flags);
++
++	wait_for_quiescing_ack(cache);
+ }
+ 
+-static bool is_quiescing(struct cache *cache)
++static void stop_quiescing(struct cache *cache)
+ {
+-	int r;
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&cache->lock, flags);
+-	r = cache->quiescing;
++	cache->quiescing = false;
+ 	spin_unlock_irqrestore(&cache->lock, flags);
+ 
+-	return r;
++	atomic_set(&cache->quiescing_ack, 0);
+ }
+ 
+ static void wait_for_migrations(struct cache *cache)
+@@ -1414,16 +1435,15 @@ static void do_worker(struct work_struct *ws)
+ 	struct cache *cache = container_of(ws, struct cache, worker);
+ 
+ 	do {
+-		if (!is_quiescing(cache))
++		if (!is_quiescing(cache)) {
++			writeback_some_dirty_blocks(cache);
++			process_deferred_writethrough_bios(cache);
+ 			process_deferred_bios(cache);
++		}
+ 
+ 		process_migrations(cache, &cache->quiesced_migrations, issue_copy);
+ 		process_migrations(cache, &cache->completed_migrations, complete_migration);
+ 
+-		writeback_some_dirty_blocks(cache);
+-
+-		process_deferred_writethrough_bios(cache);
+-
+ 		if (commit_if_needed(cache)) {
+ 			process_deferred_flush_bios(cache, false);
+ 
+@@ -1436,6 +1456,9 @@ static void do_worker(struct work_struct *ws)
+ 			process_migrations(cache, &cache->need_commit_migrations,
+ 					   migration_success_post_commit);
+ 		}
++
++		ack_quiescing(cache);
++
+ 	} while (more_work(cache));
+ }
+ 
+@@ -1998,6 +2021,9 @@ static int cache_create(struct cache_args *ca, struct cache **result)
+ 	atomic_set(&cache->nr_migrations, 0);
+ 	init_waitqueue_head(&cache->migration_wait);
+ 
++	init_waitqueue_head(&cache->quiescing_wait);
++	atomic_set(&cache->quiescing_ack, 0);
++
+ 	r = -ENOMEM;
+ 	cache->nr_dirty = 0;
+ 	cache->dirty_bitset = alloc_bitset(from_cblock(cache->cache_size));
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index c5b7b3dd..eb7ddb20 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -86,6 +86,7 @@ struct multipath {
+ 	unsigned queue_if_no_path:1;	/* Queue I/O if last path fails? */
+ 	unsigned saved_queue_if_no_path:1; /* Saved state during suspension */
+ 	unsigned retain_attached_hw_handler:1; /* If there's already a hw_handler present, don't change it. */
++	unsigned pg_init_disabled:1;	/* pg_init is not currently allowed */
+ 
+ 	unsigned pg_init_retries;	/* Number of times to retry pg_init */
+ 	unsigned pg_init_count;		/* Number of times pg_init called */
+@@ -497,7 +498,8 @@ static void process_queued_ios(struct work_struct *work)
+ 	    (!pgpath && !m->queue_if_no_path))
+ 		must_queue = 0;
+ 
+-	if (m->pg_init_required && !m->pg_init_in_progress && pgpath)
++	if (m->pg_init_required && !m->pg_init_in_progress && pgpath &&
++	    !m->pg_init_disabled)
+ 		__pg_init_all_paths(m);
+ 
+ 	spin_unlock_irqrestore(&m->lock, flags);
+@@ -942,10 +944,20 @@ static void multipath_wait_for_pg_init_completion(struct multipath *m)
+ 
+ static void flush_multipath_work(struct multipath *m)
+ {
++	unsigned long flags;
++
++	spin_lock_irqsave(&m->lock, flags);
++	m->pg_init_disabled = 1;
++	spin_unlock_irqrestore(&m->lock, flags);
++
+ 	flush_workqueue(kmpath_handlerd);
+ 	multipath_wait_for_pg_init_completion(m);
+ 	flush_workqueue(kmultipathd);
+ 	flush_work(&m->trigger_event);
++
++	spin_lock_irqsave(&m->lock, flags);
++	m->pg_init_disabled = 0;
++	spin_unlock_irqrestore(&m->lock, flags);
+ }
+ 
+ static void multipath_dtr(struct dm_target *ti)
+@@ -1164,7 +1176,7 @@ static int pg_init_limit_reached(struct multipath *m, struct pgpath *pgpath)
+ 
+ 	spin_lock_irqsave(&m->lock, flags);
+ 
+-	if (m->pg_init_count <= m->pg_init_retries)
++	if (m->pg_init_count <= m->pg_init_retries && !m->pg_init_disabled)
+ 		m->pg_init_required = 1;
+ 	else
+ 		limit_reached = 1;
+@@ -1699,7 +1711,7 @@ out:
+  *---------------------------------------------------------------*/
+ static struct target_type multipath_target = {
+ 	.name = "multipath",
+-	.version = {1, 5, 1},
++	.version = {1, 6, 0},
+ 	.module = THIS_MODULE,
+ 	.ctr = multipath_ctr,
+ 	.dtr = multipath_dtr,
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index 1ff252ab..9e3a045e 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -580,14 +580,28 @@ static int adjoin(struct dm_table *table, struct dm_target *ti)
+ 
+ /*
+  * Used to dynamically allocate the arg array.
++ *
++ * We do first allocation with GFP_NOIO because dm-mpath and dm-thin must
++ * process messages even if some device is suspended. These messages have a
++ * small fixed number of arguments.
++ *
++ * On the other hand, dm-switch needs to process bulk data using messages and
++ * excessive use of GFP_NOIO could cause trouble.
+  */
+ static char **realloc_argv(unsigned *array_size, char **old_argv)
+ {
+ 	char **argv;
+ 	unsigned new_size;
++	gfp_t gfp;
+ 
+-	new_size = *array_size ? *array_size * 2 : 64;
+-	argv = kmalloc(new_size * sizeof(*argv), GFP_KERNEL);
++	if (*array_size) {
++		new_size = *array_size * 2;
++		gfp = GFP_KERNEL;
++	} else {
++		new_size = 8;
++		gfp = GFP_NOIO;
++	}
++	argv = kmalloc(new_size * sizeof(*argv), gfp);
+ 	if (argv) {
+ 		memcpy(argv, old_argv, *array_size * sizeof(*argv));
+ 		*array_size = new_size;
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index d78f1fff..2290b950 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -3619,6 +3619,7 @@ level_store(struct mddev *mddev, const char *buf, size_t len)
+ 		mddev->in_sync = 1;
+ 		del_timer_sync(&mddev->safemode_timer);
+ 	}
++	blk_set_stacking_limits(&mddev->queue->limits);
+ 	pers->run(mddev);
+ 	set_bit(MD_CHANGE_DEVS, &mddev->flags);
+ 	mddev_resume(mddev);
+diff --git a/drivers/md/persistent-data/dm-array.c b/drivers/md/persistent-data/dm-array.c
+index 172147eb..af96e24e 100644
+--- a/drivers/md/persistent-data/dm-array.c
++++ b/drivers/md/persistent-data/dm-array.c
+@@ -509,15 +509,18 @@ static int grow_add_tail_block(struct resize *resize)
+ static int grow_needs_more_blocks(struct resize *resize)
+ {
+ 	int r;
++	unsigned old_nr_blocks = resize->old_nr_full_blocks;
+ 
+ 	if (resize->old_nr_entries_in_last_block > 0) {
++		old_nr_blocks++;
++
+ 		r = grow_extend_tail_block(resize, resize->max_entries);
+ 		if (r)
+ 			return r;
+ 	}
+ 
+ 	r = insert_full_ablocks(resize->info, resize->size_of_block,
+-				resize->old_nr_full_blocks,
++				old_nr_blocks,
+ 				resize->new_nr_full_blocks,
+ 				resize->max_entries, resize->value,
+ 				&resize->root);
+diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c
+index a204f282..fb504f1e 100644
+--- a/drivers/media/dvb-frontends/af9013.c
++++ b/drivers/media/dvb-frontends/af9013.c
+@@ -24,6 +24,9 @@
+ 
+ #include "af9013_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ struct af9013_state {
+ 	struct i2c_adapter *i2c;
+ 	struct dvb_frontend fe;
+@@ -50,16 +53,23 @@ static int af9013_wr_regs_i2c(struct af9013_state *priv, u8 mbox, u16 reg,
+ 	const u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[3+len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->config.i2c_addr,
+ 			.flags = 0,
+-			.len = sizeof(buf),
++			.len = 3 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (3 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = (reg >> 8) & 0xff;
+ 	buf[1] = (reg >> 0) & 0xff;
+ 	buf[2] = mbox;
+diff --git a/drivers/media/dvb-frontends/af9033.c b/drivers/media/dvb-frontends/af9033.c
+index a777b4b9..30ee5905 100644
+--- a/drivers/media/dvb-frontends/af9033.c
++++ b/drivers/media/dvb-frontends/af9033.c
+@@ -21,6 +21,9 @@
+ 
+ #include "af9033_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ struct af9033_state {
+ 	struct i2c_adapter *i2c;
+ 	struct dvb_frontend fe;
+@@ -40,16 +43,23 @@ static int af9033_wr_regs(struct af9033_state *state, u32 reg, const u8 *val,
+ 		int len)
+ {
+ 	int ret;
+-	u8 buf[3 + len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = state->cfg.i2c_addr,
+ 			.flags = 0,
+-			.len = sizeof(buf),
++			.len = 3 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (3 + len > sizeof(buf)) {
++		dev_warn(&state->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = (reg >> 16) & 0xff;
+ 	buf[1] = (reg >>  8) & 0xff;
+ 	buf[2] = (reg >>  0) & 0xff;
+@@ -161,7 +171,14 @@ static int af9033_wr_reg_val_tab(struct af9033_state *state,
+ 		const struct reg_val *tab, int tab_len)
+ {
+ 	int ret, i, j;
+-	u8 buf[tab_len];
++	u8 buf[MAX_XFER_SIZE];
++
++	if (tab_len > sizeof(buf)) {
++		dev_warn(&state->i2c->dev,
++			 "%s: i2c wr len=%d is too big!\n",
++			 KBUILD_MODNAME, tab_len);
++		return -EINVAL;
++	}
+ 
+ 	dev_dbg(&state->i2c->dev, "%s: tab_len=%d\n", __func__, tab_len);
+ 
+diff --git a/drivers/media/dvb-frontends/bcm3510.c b/drivers/media/dvb-frontends/bcm3510.c
+index 1b77909c..39a29dd2 100644
+--- a/drivers/media/dvb-frontends/bcm3510.c
++++ b/drivers/media/dvb-frontends/bcm3510.c
+@@ -44,6 +44,9 @@
+ #include "bcm3510.h"
+ #include "bcm3510_priv.h"
+ 
++/* Max transfer size done by bcm3510_do_hab_cmd() function */
++#define MAX_XFER_SIZE	128
++
+ struct bcm3510_state {
+ 
+ 	struct i2c_adapter* i2c;
+@@ -201,9 +204,19 @@ static int bcm3510_hab_send_request(struct bcm3510_state *st, u8 *buf, int len)
+ 
+ static int bcm3510_do_hab_cmd(struct bcm3510_state *st, u8 cmd, u8 msgid, u8 *obuf, u8 olen, u8 *ibuf, u8 ilen)
+ {
+-	u8 ob[olen+2],ib[ilen+2];
++	u8 ob[MAX_XFER_SIZE], ib[MAX_XFER_SIZE];
+ 	int ret = 0;
+ 
++	if (ilen + 2 > sizeof(ib)) {
++		deb_hab("do_hab_cmd: ilen=%d is too big!\n", ilen);
++		return -EINVAL;
++	}
++
++	if (olen + 2 > sizeof(ob)) {
++		deb_hab("do_hab_cmd: olen=%d is too big!\n", olen);
++		return -EINVAL;
++	}
++
+ 	ob[0] = cmd;
+ 	ob[1] = msgid;
+ 	memcpy(&ob[2],obuf,olen);
+diff --git a/drivers/media/dvb-frontends/cxd2820r_core.c b/drivers/media/dvb-frontends/cxd2820r_core.c
+index 7ca5c69d..51447a04 100644
+--- a/drivers/media/dvb-frontends/cxd2820r_core.c
++++ b/drivers/media/dvb-frontends/cxd2820r_core.c
+@@ -21,12 +21,15 @@
+ 
+ #include "cxd2820r_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ /* write multiple registers */
+ static int cxd2820r_wr_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg,
+ 	u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[len+1];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = i2c,
+@@ -36,6 +39,13 @@ static int cxd2820r_wr_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg,
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], val, len);
+ 
+@@ -55,7 +65,7 @@ static int cxd2820r_rd_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg,
+ 	u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[2] = {
+ 		{
+ 			.addr = i2c,
+@@ -70,6 +80,13 @@ static int cxd2820r_rd_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg,
+ 		}
+ 	};
+ 
++	if (len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	ret = i2c_transfer(priv->i2c, msg, 2);
+ 	if (ret == 2) {
+ 		memcpy(val, buf, len);
+diff --git a/drivers/media/dvb-frontends/itd1000.c b/drivers/media/dvb-frontends/itd1000.c
+index c1c3400b..cadcae4c 100644
+--- a/drivers/media/dvb-frontends/itd1000.c
++++ b/drivers/media/dvb-frontends/itd1000.c
+@@ -31,6 +31,9 @@
+ #include "itd1000.h"
+ #include "itd1000_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static int debug;
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
+@@ -52,10 +55,18 @@ MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
+ /* don't write more than one byte with flexcop behind */
+ static int itd1000_write_regs(struct itd1000_state *state, u8 reg, u8 v[], u8 len)
+ {
+-	u8 buf[1+len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg = {
+ 		.addr = state->cfg->i2c_address, .flags = 0, .buf = buf, .len = len+1
+ 	};
++
++	if (1 + len > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "itd1000: i2c wr reg=%04x: len=%d is too big!\n",
++		       reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], v, len);
+ 
+diff --git a/drivers/media/dvb-frontends/mt312.c b/drivers/media/dvb-frontends/mt312.c
+index ec388c1d..a74ac0dd 100644
+--- a/drivers/media/dvb-frontends/mt312.c
++++ b/drivers/media/dvb-frontends/mt312.c
+@@ -36,6 +36,8 @@
+ #include "mt312_priv.h"
+ #include "mt312.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
+ 
+ struct mt312_state {
+ 	struct i2c_adapter *i2c;
+@@ -96,9 +98,15 @@ static int mt312_write(struct mt312_state *state, const enum mt312_reg_addr reg,
+ 		       const u8 *src, const size_t count)
+ {
+ 	int ret;
+-	u8 buf[count + 1];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg;
+ 
++	if (1 + count > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "mt312: write: len=%zd is too big!\n", count);
++		return -EINVAL;
++	}
++
+ 	if (debug) {
+ 		int i;
+ 		dprintk("W(%d):", reg & 0x7f);
+diff --git a/drivers/media/dvb-frontends/nxt200x.c b/drivers/media/dvb-frontends/nxt200x.c
+index 8e288940..fbca9856 100644
+--- a/drivers/media/dvb-frontends/nxt200x.c
++++ b/drivers/media/dvb-frontends/nxt200x.c
+@@ -39,6 +39,9 @@
+  */
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ #define NXT2002_DEFAULT_FIRMWARE "dvb-fe-nxt2002.fw"
+ #define NXT2004_DEFAULT_FIRMWARE "dvb-fe-nxt2004.fw"
+ #define CRC_CCIT_MASK 0x1021
+@@ -95,10 +98,16 @@ static int i2c_readbytes(struct nxt200x_state *state, u8 addr, u8 *buf, u8 len)
+ static int nxt200x_writebytes (struct nxt200x_state* state, u8 reg,
+ 			       const u8 *buf, u8 len)
+ {
+-	u8 buf2 [len+1];
++	u8 buf2[MAX_XFER_SIZE];
+ 	int err;
+ 	struct i2c_msg msg = { .addr = state->config->demod_address, .flags = 0, .buf = buf2, .len = len + 1 };
+ 
++	if (1 + len > sizeof(buf2)) {
++		pr_warn("%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 __func__, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf2[0] = reg;
+ 	memcpy(&buf2[1], buf, len);
+ 
+diff --git a/drivers/media/dvb-frontends/rtl2830.c b/drivers/media/dvb-frontends/rtl2830.c
+index 362d26d1..7efb796c 100644
+--- a/drivers/media/dvb-frontends/rtl2830.c
++++ b/drivers/media/dvb-frontends/rtl2830.c
+@@ -27,20 +27,30 @@
+ 
+ #include "rtl2830_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ /* write multiple hardware registers */
+ static int rtl2830_wr(struct rtl2830_priv *priv, u8 reg, const u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[1+len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->cfg.i2c_addr,
+ 			.flags = 0,
+-			.len = 1+len,
++			.len = 1 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], val, len);
+ 
+diff --git a/drivers/media/dvb-frontends/rtl2832.c b/drivers/media/dvb-frontends/rtl2832.c
+index facb8484..b8dd0a13 100644
+--- a/drivers/media/dvb-frontends/rtl2832.c
++++ b/drivers/media/dvb-frontends/rtl2832.c
+@@ -22,6 +22,9 @@
+ #include "dvb_math.h"
+ #include <linux/bitops.h>
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ int rtl2832_debug;
+ module_param_named(debug, rtl2832_debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
+@@ -162,16 +165,23 @@ static const struct rtl2832_reg_entry registers[] = {
+ static int rtl2832_wr(struct rtl2832_priv *priv, u8 reg, u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[1+len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->cfg.i2c_addr,
+ 			.flags = 0,
+-			.len = 1+len,
++			.len = 1 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], val, len);
+ 
+diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c
+index e2fec9eb..93eeaf71 100644
+--- a/drivers/media/dvb-frontends/s5h1420.c
++++ b/drivers/media/dvb-frontends/s5h1420.c
+@@ -836,9 +836,16 @@ static u32 s5h1420_tuner_i2c_func(struct i2c_adapter *adapter)
+ static int s5h1420_tuner_i2c_tuner_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msg[], int num)
+ {
+ 	struct s5h1420_state *state = i2c_get_adapdata(i2c_adap);
+-	struct i2c_msg m[1 + num];
++	struct i2c_msg m[3];
+ 	u8 tx_open[2] = { CON_1, state->CON_1_val | 1 }; /* repeater stops once there was a stop condition */
+ 
++	if (1 + num > ARRAY_SIZE(m)) {
++		printk(KERN_WARNING
++		       "%s: i2c xfer: num=%d is too big!\n",
++		       KBUILD_MODNAME, num);
++		return  -EOPNOTSUPP;
++	}
++
+ 	memset(m, 0, sizeof(struct i2c_msg) * (1 + num));
+ 
+ 	m[0].addr = state->config->demod_address;
+@@ -847,7 +854,7 @@ static int s5h1420_tuner_i2c_tuner_xfer(struct i2c_adapter *i2c_adap, struct i2c
+ 
+ 	memcpy(&m[1], msg, sizeof(struct i2c_msg) * num);
+ 
+-	return i2c_transfer(state->i2c, m, 1+num) == 1 + num ? num : -EIO;
++	return i2c_transfer(state->i2c, m, 1 + num) == 1 + num ? num : -EIO;
+ }
+ 
+ static struct i2c_algorithm s5h1420_tuner_i2c_algo = {
+diff --git a/drivers/media/dvb-frontends/stb0899_drv.c b/drivers/media/dvb-frontends/stb0899_drv.c
+index cc278b3d..2a979cfa 100644
+--- a/drivers/media/dvb-frontends/stb0899_drv.c
++++ b/drivers/media/dvb-frontends/stb0899_drv.c
+@@ -32,6 +32,9 @@
+ #include "stb0899_priv.h"
+ #include "stb0899_reg.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static unsigned int verbose = 0;//1;
+ module_param(verbose, int, 0644);
+ 
+@@ -499,7 +502,7 @@ err:
+ int stb0899_write_regs(struct stb0899_state *state, unsigned int reg, u8 *data, u32 count)
+ {
+ 	int ret;
+-	u8 buf[2 + count];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg i2c_msg = {
+ 		.addr	= state->config->demod_address,
+ 		.flags	= 0,
+@@ -507,6 +510,13 @@ int stb0899_write_regs(struct stb0899_state *state, unsigned int reg, u8 *data,
+ 		.len	= 2 + count
+ 	};
+ 
++	if (2 + count > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr reg=%04x: len=%d is too big!\n",
++		       KBUILD_MODNAME, reg, count);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg >> 8;
+ 	buf[1] = reg & 0xff;
+ 	memcpy(&buf[2], data, count);
+diff --git a/drivers/media/dvb-frontends/stb6100.c b/drivers/media/dvb-frontends/stb6100.c
+index 45f9523f..cea175d1 100644
+--- a/drivers/media/dvb-frontends/stb6100.c
++++ b/drivers/media/dvb-frontends/stb6100.c
+@@ -31,6 +31,8 @@
+ static unsigned int verbose;
+ module_param(verbose, int, 0644);
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
+ 
+ #define FE_ERROR		0
+ #define FE_NOTICE		1
+@@ -183,7 +185,7 @@ static int stb6100_read_reg(struct stb6100_state *state, u8 reg)
+ static int stb6100_write_reg_range(struct stb6100_state *state, u8 buf[], int start, int len)
+ {
+ 	int rc;
+-	u8 cmdbuf[len + 1];
++	u8 cmdbuf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg = {
+ 		.addr	= state->config->tuner_address,
+ 		.flags	= 0,
+@@ -191,6 +193,13 @@ static int stb6100_write_reg_range(struct stb6100_state *state, u8 buf[], int st
+ 		.len	= len + 1
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr: len=%d is too big!\n",
++		       KBUILD_MODNAME, len);
++		return -EINVAL;
++	}
++
+ 	if (unlikely(start < 1 || start + len > STB6100_NUMREGS)) {
+ 		dprintk(verbose, FE_ERROR, 1, "Invalid register range %d:%d",
+ 			start, len);
+diff --git a/drivers/media/dvb-frontends/stv0367.c b/drivers/media/dvb-frontends/stv0367.c
+index 0c8e4594..f6c72779 100644
+--- a/drivers/media/dvb-frontends/stv0367.c
++++ b/drivers/media/dvb-frontends/stv0367.c
+@@ -33,6 +33,9 @@
+ #include "stv0367_regs.h"
+ #include "stv0367_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static int stvdebug;
+ module_param_named(debug, stvdebug, int, 0644);
+ 
+@@ -767,7 +770,7 @@ static struct st_register def0367cab[STV0367CAB_NBREGS] = {
+ static
+ int stv0367_writeregs(struct stv0367_state *state, u16 reg, u8 *data, int len)
+ {
+-	u8 buf[len + 2];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg = {
+ 		.addr = state->config->demod_address,
+ 		.flags = 0,
+@@ -776,6 +779,14 @@ int stv0367_writeregs(struct stv0367_state *state, u16 reg, u8 *data, int len)
+ 	};
+ 	int ret;
+ 
++	if (2 + len > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr reg=%04x: len=%d is too big!\n",
++		       KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
++
+ 	buf[0] = MSB(reg);
+ 	buf[1] = LSB(reg);
+ 	memcpy(buf + 2, data, len);
+diff --git a/drivers/media/dvb-frontends/stv090x.c b/drivers/media/dvb-frontends/stv090x.c
+index 56d470ad..23e872f8 100644
+--- a/drivers/media/dvb-frontends/stv090x.c
++++ b/drivers/media/dvb-frontends/stv090x.c
+@@ -35,6 +35,9 @@
+ #include "stv090x.h"
+ #include "stv090x_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static unsigned int verbose;
+ module_param(verbose, int, 0644);
+ 
+@@ -722,9 +725,16 @@ static int stv090x_write_regs(struct stv090x_state *state, unsigned int reg, u8
+ {
+ 	const struct stv090x_config *config = state->config;
+ 	int ret;
+-	u8 buf[2 + count];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg i2c_msg = { .addr = config->address, .flags = 0, .buf = buf, .len = 2 + count };
+ 
++	if (2 + count > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr reg=%04x: len=%d is too big!\n",
++		       KBUILD_MODNAME, reg, count);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg >> 8;
+ 	buf[1] = reg & 0xff;
+ 	memcpy(&buf[2], data, count);
+diff --git a/drivers/media/dvb-frontends/stv6110.c b/drivers/media/dvb-frontends/stv6110.c
+index 20b5fa92..b1425830 100644
+--- a/drivers/media/dvb-frontends/stv6110.c
++++ b/drivers/media/dvb-frontends/stv6110.c
+@@ -30,6 +30,9 @@
+ 
+ #include "stv6110.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static int debug;
+ 
+ struct stv6110_priv {
+@@ -68,7 +71,7 @@ static int stv6110_write_regs(struct dvb_frontend *fe, u8 buf[],
+ {
+ 	struct stv6110_priv *priv = fe->tuner_priv;
+ 	int rc;
+-	u8 cmdbuf[len + 1];
++	u8 cmdbuf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg = {
+ 		.addr	= priv->i2c_address,
+ 		.flags	= 0,
+@@ -78,6 +81,13 @@ static int stv6110_write_regs(struct dvb_frontend *fe, u8 buf[],
+ 
+ 	dprintk("%s\n", __func__);
+ 
++	if (1 + len > sizeof(cmdbuf)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr: len=%d is too big!\n",
++		       KBUILD_MODNAME, len);
++		return -EINVAL;
++	}
++
+ 	if (start + len > 8)
+ 		return -EINVAL;
+ 
+diff --git a/drivers/media/dvb-frontends/stv6110x.c b/drivers/media/dvb-frontends/stv6110x.c
+index f36cab12..e66154e5 100644
+--- a/drivers/media/dvb-frontends/stv6110x.c
++++ b/drivers/media/dvb-frontends/stv6110x.c
+@@ -32,6 +32,9 @@
+ #include "stv6110x.h"
+ #include "stv6110x_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static unsigned int verbose;
+ module_param(verbose, int, 0644);
+ MODULE_PARM_DESC(verbose, "Set Verbosity level");
+@@ -61,7 +64,8 @@ static int stv6110x_write_regs(struct stv6110x_state *stv6110x, int start, u8 da
+ {
+ 	int ret;
+ 	const struct stv6110x_config *config = stv6110x->config;
+-	u8 buf[len + 1];
++	u8 buf[MAX_XFER_SIZE];
++
+ 	struct i2c_msg msg = {
+ 		.addr = config->addr,
+ 		.flags = 0,
+@@ -69,6 +73,13 @@ static int stv6110x_write_regs(struct stv6110x_state *stv6110x, int start, u8 da
+ 		.len = len + 1
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr: len=%d is too big!\n",
++		       KBUILD_MODNAME, len);
++		return -EINVAL;
++	}
++
+ 	if (start + len > 8)
+ 		return -EINVAL;
+ 
+diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c
+index 2521f7e2..36eb27d3 100644
+--- a/drivers/media/dvb-frontends/tda10071.c
++++ b/drivers/media/dvb-frontends/tda10071.c
+@@ -20,6 +20,9 @@
+ 
+ #include "tda10071_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static struct dvb_frontend_ops tda10071_ops;
+ 
+ /* write multiple registers */
+@@ -27,16 +30,23 @@ static int tda10071_wr_regs(struct tda10071_priv *priv, u8 reg, u8 *val,
+ 	int len)
+ {
+ 	int ret;
+-	u8 buf[len+1];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->cfg.demod_i2c_addr,
+ 			.flags = 0,
+-			.len = sizeof(buf),
++			.len = 1 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], val, len);
+ 
+@@ -56,7 +66,7 @@ static int tda10071_rd_regs(struct tda10071_priv *priv, u8 reg, u8 *val,
+ 	int len)
+ {
+ 	int ret;
+-	u8 buf[len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[2] = {
+ 		{
+ 			.addr = priv->cfg.demod_i2c_addr,
+@@ -66,11 +76,18 @@ static int tda10071_rd_regs(struct tda10071_priv *priv, u8 reg, u8 *val,
+ 		}, {
+ 			.addr = priv->cfg.demod_i2c_addr,
+ 			.flags = I2C_M_RD,
+-			.len = sizeof(buf),
++			.len = len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	ret = i2c_transfer(priv->i2c, msg, 2);
+ 	if (ret == 2) {
+ 		memcpy(val, buf, len);
+diff --git a/drivers/media/dvb-frontends/tda18271c2dd.c b/drivers/media/dvb-frontends/tda18271c2dd.c
+index d281f77d..2c54586a 100644
+--- a/drivers/media/dvb-frontends/tda18271c2dd.c
++++ b/drivers/media/dvb-frontends/tda18271c2dd.c
+@@ -34,6 +34,9 @@
+ #include "dvb_frontend.h"
+ #include "tda18271c2dd.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ struct SStandardParam {
+ 	s32   m_IFFrequency;
+ 	u32   m_BandWidth;
+@@ -139,11 +142,18 @@ static int i2c_write(struct i2c_adapter *adap, u8 adr, u8 *data, int len)
+ static int WriteRegs(struct tda_state *state,
+ 		     u8 SubAddr, u8 *Regs, u16 nRegs)
+ {
+-	u8 data[nRegs+1];
++	u8 data[MAX_XFER_SIZE];
++
++	if (1 + nRegs > sizeof(data)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr: len=%d is too big!\n",
++		       KBUILD_MODNAME, nRegs);
++		return -EINVAL;
++	}
+ 
+ 	data[0] = SubAddr;
+ 	memcpy(data + 1, Regs, nRegs);
+-	return i2c_write(state->i2c, state->adr, data, nRegs+1);
++	return i2c_write(state->i2c, state->adr, data, nRegs + 1);
+ }
+ 
+ static int WriteReg(struct tda_state *state, u8 SubAddr, u8 Reg)
+diff --git a/drivers/media/dvb-frontends/zl10039.c b/drivers/media/dvb-frontends/zl10039.c
+index eff9c5fd..91b6b2e9 100644
+--- a/drivers/media/dvb-frontends/zl10039.c
++++ b/drivers/media/dvb-frontends/zl10039.c
+@@ -30,6 +30,9 @@
+ 
+ static int debug;
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ #define dprintk(args...) \
+ 	do { \
+ 		if (debug) \
+@@ -98,7 +101,7 @@ static int zl10039_write(struct zl10039_state *state,
+ 			const enum zl10039_reg_addr reg, const u8 *src,
+ 			const size_t count)
+ {
+-	u8 buf[count + 1];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg = {
+ 		.addr = state->i2c_addr,
+ 		.flags = 0,
+@@ -106,6 +109,13 @@ static int zl10039_write(struct zl10039_state *state,
+ 		.len = count + 1,
+ 	};
+ 
++	if (1 + count > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr reg=%04x: len=%zd is too big!\n",
++		       KBUILD_MODNAME, reg, count);
++		return -EINVAL;
++	}
++
+ 	dprintk("%s\n", __func__);
+ 	/* Write register address and data in one go */
+ 	buf[0] = reg;
+diff --git a/drivers/media/pci/cx18/cx18-driver.c b/drivers/media/pci/cx18/cx18-driver.c
+index 67b61cf3..13c9718a 100644
+--- a/drivers/media/pci/cx18/cx18-driver.c
++++ b/drivers/media/pci/cx18/cx18-driver.c
+@@ -324,23 +324,24 @@ static void cx18_eeprom_dump(struct cx18 *cx, unsigned char *eedata, int len)
+ /* Hauppauge card? get values from tveeprom */
+ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
+ {
+-	struct i2c_client c;
++	struct i2c_client *c;
+ 	u8 eedata[256];
+ 
+-	memset(&c, 0, sizeof(c));
+-	strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
+-	c.adapter = &cx->i2c_adap[0];
+-	c.addr = 0xA0 >> 1;
++	c = kzalloc(sizeof(*c), GFP_KERNEL);
++
++	strlcpy(c->name, "cx18 tveeprom tmp", sizeof(c->name));
++	c->adapter = &cx->i2c_adap[0];
++	c->addr = 0xa0 >> 1;
+ 
+ 	memset(tv, 0, sizeof(*tv));
+-	if (tveeprom_read(&c, eedata, sizeof(eedata)))
+-		return;
++	if (tveeprom_read(c, eedata, sizeof(eedata)))
++		goto ret;
+ 
+ 	switch (cx->card->type) {
+ 	case CX18_CARD_HVR_1600_ESMT:
+ 	case CX18_CARD_HVR_1600_SAMSUNG:
+ 	case CX18_CARD_HVR_1600_S5H1411:
+-		tveeprom_hauppauge_analog(&c, tv, eedata);
++		tveeprom_hauppauge_analog(c, tv, eedata);
+ 		break;
+ 	case CX18_CARD_YUAN_MPC718:
+ 	case CX18_CARD_GOTVIEW_PCI_DVD3:
+@@ -354,6 +355,9 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
+ 		cx18_eeprom_dump(cx, eedata, sizeof(eedata));
+ 		break;
+ 	}
++
++ret:
++	kfree(c);
+ }
+ 
+ static void cx18_process_eeprom(struct cx18 *cx)
+diff --git a/drivers/media/pci/cx23885/cimax2.c b/drivers/media/pci/cx23885/cimax2.c
+index 73448491..16fa7ea4 100644
+--- a/drivers/media/pci/cx23885/cimax2.c
++++ b/drivers/media/pci/cx23885/cimax2.c
+@@ -26,6 +26,10 @@
+ #include "cx23885.h"
+ #include "cimax2.h"
+ #include "dvb_ca_en50221.h"
++
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ /**** Bit definitions for MC417_RWD and MC417_OEN registers  ***
+   bits 31-16
+ +-----------+
+@@ -125,7 +129,7 @@ static int netup_write_i2c(struct i2c_adapter *i2c_adap, u8 addr, u8 reg,
+ 						u8 *buf, int len)
+ {
+ 	int ret;
+-	u8 buffer[len + 1];
++	u8 buffer[MAX_XFER_SIZE];
+ 
+ 	struct i2c_msg msg = {
+ 		.addr	= addr,
+@@ -134,6 +138,13 @@ static int netup_write_i2c(struct i2c_adapter *i2c_adap, u8 addr, u8 reg,
+ 		.len	= len + 1
+ 	};
+ 
++	if (1 + len > sizeof(buffer)) {
++		printk(KERN_WARNING
++		       "%s: i2c wr reg=%04x: len=%d is too big!\n",
++		       KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buffer[0] = reg;
+ 	memcpy(&buffer[1], buf, len);
+ 
+diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
+index 9c5ed10b..bb291c66 100644
+--- a/drivers/media/pci/cx23885/cx23885-dvb.c
++++ b/drivers/media/pci/cx23885/cx23885-dvb.c
+@@ -1249,6 +1249,10 @@ static int dvb_register(struct cx23885_tsport *port)
+ 		fe0->dvb.frontend = dvb_attach(ds3000_attach,
+ 					&tevii_ds3000_config,
+ 					&i2c_bus->i2c_adap);
++		if (fe0->dvb.frontend != NULL) {
++			dvb_attach(ts2020_attach, fe0->dvb.frontend,
++				&tevii_ts2020_config, &i2c_bus->i2c_adap);
++		}
+ 		break;
+ 	case CX23885_BOARD_PROF_8000:
+ 		i2c_bus = &dev->i2c_bus[0];
+diff --git a/drivers/media/pci/ttpci/av7110_hw.c b/drivers/media/pci/ttpci/av7110_hw.c
+index f1cbfe52..6299d5da 100644
+--- a/drivers/media/pci/ttpci/av7110_hw.c
++++ b/drivers/media/pci/ttpci/av7110_hw.c
+@@ -22,7 +22,7 @@
+  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+  * Or, point your browser to http://www.gnu.org/copyleft/gpl.html
+  *
+- * the project's page is at http://www.linuxtv.org/ 
++ * the project's page is at http://www.linuxtv.org/
+  */
+ 
+ /* for debugging ARM communication: */
+@@ -40,6 +40,14 @@
+ 
+ #define _NOHANDSHAKE
+ 
++/*
++ * Max transfer size done by av7110_fw_cmd()
++ *
++ * The maximum size passed to this function is 6 bytes. The buffer also
++ * uses two additional ones for type and size. So, 8 bytes is enough.
++ */
++#define MAX_XFER_SIZE  8
++
+ /****************************************************************************
+  * DEBI functions
+  ****************************************************************************/
+@@ -488,11 +496,18 @@ static int av7110_send_fw_cmd(struct av7110 *av7110, u16* buf, int length)
+ int av7110_fw_cmd(struct av7110 *av7110, int type, int com, int num, ...)
+ {
+ 	va_list args;
+-	u16 buf[num + 2];
++	u16 buf[MAX_XFER_SIZE];
+ 	int i, ret;
+ 
+ //	dprintk(4, "%p\n", av7110);
+ 
++	if (2 + num > sizeof(buf)) {
++		printk(KERN_WARNING
++		       "%s: %s len=%d is too big!\n",
++		       KBUILD_MODNAME, __func__, num);
++		return -EINVAL;
++	}
++
+ 	buf[0] = ((type << 8) | com);
+ 	buf[1] = num;
+ 
+diff --git a/drivers/media/tuners/e4000.c b/drivers/media/tuners/e4000.c
+index 1b33ed36..c4ce4500 100644
+--- a/drivers/media/tuners/e4000.c
++++ b/drivers/media/tuners/e4000.c
+@@ -20,20 +20,30 @@
+ 
+ #include "e4000_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ /* write multiple registers */
+ static int e4000_wr_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[1 + len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->cfg->i2c_addr,
+ 			.flags = 0,
+-			.len = sizeof(buf),
++			.len = 1 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], val, len);
+ 
+@@ -52,7 +62,7 @@ static int e4000_wr_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
+ static int e4000_rd_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[2] = {
+ 		{
+ 			.addr = priv->cfg->i2c_addr,
+@@ -62,11 +72,18 @@ static int e4000_rd_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
+ 		}, {
+ 			.addr = priv->cfg->i2c_addr,
+ 			.flags = I2C_M_RD,
+-			.len = sizeof(buf),
++			.len = len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c rd reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	ret = i2c_transfer(priv->i2c, msg, 2);
+ 	if (ret == 2) {
+ 		memcpy(val, buf, len);
+diff --git a/drivers/media/tuners/fc2580.c b/drivers/media/tuners/fc2580.c
+index 81f38aae..3aecaf46 100644
+--- a/drivers/media/tuners/fc2580.c
++++ b/drivers/media/tuners/fc2580.c
+@@ -20,6 +20,9 @@
+ 
+ #include "fc2580_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ /*
+  * TODO:
+  * I2C write and read works only for one single register. Multiple registers
+@@ -41,16 +44,23 @@
+ static int fc2580_wr_regs(struct fc2580_priv *priv, u8 reg, u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[1 + len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->cfg->i2c_addr,
+ 			.flags = 0,
+-			.len = sizeof(buf),
++			.len = 1 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], val, len);
+ 
+@@ -69,7 +79,7 @@ static int fc2580_wr_regs(struct fc2580_priv *priv, u8 reg, u8 *val, int len)
+ static int fc2580_rd_regs(struct fc2580_priv *priv, u8 reg, u8 *val, int len)
+ {
+ 	int ret;
+-	u8 buf[len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[2] = {
+ 		{
+ 			.addr = priv->cfg->i2c_addr,
+@@ -79,11 +89,18 @@ static int fc2580_rd_regs(struct fc2580_priv *priv, u8 reg, u8 *val, int len)
+ 		}, {
+ 			.addr = priv->cfg->i2c_addr,
+ 			.flags = I2C_M_RD,
+-			.len = sizeof(buf),
++			.len = len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c rd reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	ret = i2c_transfer(priv->i2c, msg, 2);
+ 	if (ret == 2) {
+ 		memcpy(val, buf, len);
+diff --git a/drivers/media/tuners/tda18212.c b/drivers/media/tuners/tda18212.c
+index e4a84ee2..abe256e1 100644
+--- a/drivers/media/tuners/tda18212.c
++++ b/drivers/media/tuners/tda18212.c
+@@ -20,6 +20,9 @@
+ 
+ #include "tda18212.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ struct tda18212_priv {
+ 	struct tda18212_config *cfg;
+ 	struct i2c_adapter *i2c;
+@@ -32,16 +35,23 @@ static int tda18212_wr_regs(struct tda18212_priv *priv, u8 reg, u8 *val,
+ 	int len)
+ {
+ 	int ret;
+-	u8 buf[len+1];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->cfg->i2c_address,
+ 			.flags = 0,
+-			.len = sizeof(buf),
++			.len = 1 + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	buf[0] = reg;
+ 	memcpy(&buf[1], val, len);
+ 
+@@ -61,7 +71,7 @@ static int tda18212_rd_regs(struct tda18212_priv *priv, u8 reg, u8 *val,
+ 	int len)
+ {
+ 	int ret;
+-	u8 buf[len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[2] = {
+ 		{
+ 			.addr = priv->cfg->i2c_address,
+@@ -71,11 +81,18 @@ static int tda18212_rd_regs(struct tda18212_priv *priv, u8 reg, u8 *val,
+ 		}, {
+ 			.addr = priv->cfg->i2c_address,
+ 			.flags = I2C_M_RD,
+-			.len = sizeof(buf),
++			.len = len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c rd reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	ret = i2c_transfer(priv->i2c, msg, 2);
+ 	if (ret == 2) {
+ 		memcpy(val, buf, len);
+diff --git a/drivers/media/tuners/tda18218.c b/drivers/media/tuners/tda18218.c
+index 2d31aeb6..9300e936 100644
+--- a/drivers/media/tuners/tda18218.c
++++ b/drivers/media/tuners/tda18218.c
+@@ -20,11 +20,14 @@
+ 
+ #include "tda18218_priv.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ /* write multiple registers */
+ static int tda18218_wr_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
+ {
+ 	int ret = 0, len2, remaining;
+-	u8 buf[1 + len];
++	u8 buf[MAX_XFER_SIZE];
+ 	struct i2c_msg msg[1] = {
+ 		{
+ 			.addr = priv->cfg->i2c_address,
+@@ -33,6 +36,13 @@ static int tda18218_wr_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
+ 		}
+ 	};
+ 
++	if (1 + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	for (remaining = len; remaining > 0;
+ 			remaining -= (priv->cfg->i2c_wr_max - 1)) {
+ 		len2 = remaining;
+@@ -63,7 +73,7 @@ static int tda18218_wr_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
+ static int tda18218_rd_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
+ {
+ 	int ret;
+-	u8 buf[reg+len]; /* we must start read always from reg 0x00 */
++	u8 buf[MAX_XFER_SIZE]; /* we must start read always from reg 0x00 */
+ 	struct i2c_msg msg[2] = {
+ 		{
+ 			.addr = priv->cfg->i2c_address,
+@@ -73,11 +83,18 @@ static int tda18218_rd_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
+ 		}, {
+ 			.addr = priv->cfg->i2c_address,
+ 			.flags = I2C_M_RD,
+-			.len = sizeof(buf),
++			.len = reg + len,
+ 			.buf = buf,
+ 		}
+ 	};
+ 
++	if (reg + len > sizeof(buf)) {
++		dev_warn(&priv->i2c->dev,
++			 "%s: i2c wr reg=%04x: len=%d is too big!\n",
++			 KBUILD_MODNAME, reg, len);
++		return -EINVAL;
++	}
++
+ 	ret = i2c_transfer(priv->i2c, msg, 2);
+ 	if (ret == 2) {
+ 		memcpy(val, &buf[reg], len);
+diff --git a/drivers/media/tuners/tuner-xc2028.c b/drivers/media/tuners/tuner-xc2028.c
+index 878d2c4d..9771cd83 100644
+--- a/drivers/media/tuners/tuner-xc2028.c
++++ b/drivers/media/tuners/tuner-xc2028.c
+@@ -24,6 +24,9 @@
+ #include <linux/dvb/frontend.h>
+ #include "dvb_frontend.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  80
++
+ /* Registers (Write-only) */
+ #define XREG_INIT         0x00
+ #define XREG_RF_FREQ      0x02
+@@ -547,7 +550,10 @@ static int load_firmware(struct dvb_frontend *fe, unsigned int type,
+ {
+ 	struct xc2028_data *priv = fe->tuner_priv;
+ 	int                pos, rc;
+-	unsigned char      *p, *endp, buf[priv->ctrl.max_len];
++	unsigned char      *p, *endp, buf[MAX_XFER_SIZE];
++
++	if (priv->ctrl.max_len > sizeof(buf))
++		priv->ctrl.max_len = sizeof(buf);
+ 
+ 	tuner_dbg("%s called\n", __func__);
+ 
+diff --git a/drivers/media/usb/dvb-usb-v2/af9015.c b/drivers/media/usb/dvb-usb-v2/af9015.c
+index d556042c..da47d239 100644
+--- a/drivers/media/usb/dvb-usb-v2/af9015.c
++++ b/drivers/media/usb/dvb-usb-v2/af9015.c
+@@ -397,12 +397,13 @@ error:
+ 	return ret;
+ }
+ 
++#define AF9015_EEPROM_SIZE 256
++
+ /* hash (and dump) eeprom */
+ static int af9015_eeprom_hash(struct dvb_usb_device *d)
+ {
+ 	struct af9015_state *state = d_to_priv(d);
+ 	int ret, i;
+-	static const unsigned int AF9015_EEPROM_SIZE = 256;
+ 	u8 buf[AF9015_EEPROM_SIZE];
+ 	struct req_t req = {READ_I2C, AF9015_I2C_EEPROM, 0, 0, 1, 1, NULL};
+ 
+diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
+index b638fc1c..3968bff3 100644
+--- a/drivers/media/usb/dvb-usb-v2/af9035.c
++++ b/drivers/media/usb/dvb-usb-v2/af9035.c
+@@ -21,6 +21,9 @@
+ 
+ #include "af9035.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
+ 
+ static u16 af9035_checksum(const u8 *buf, size_t len)
+@@ -125,10 +128,16 @@ exit:
+ /* write multiple registers */
+ static int af9035_wr_regs(struct dvb_usb_device *d, u32 reg, u8 *val, int len)
+ {
+-	u8 wbuf[6 + len];
++	u8 wbuf[MAX_XFER_SIZE];
+ 	u8 mbox = (reg >> 16) & 0xff;
+ 	struct usb_req req = { CMD_MEM_WR, mbox, sizeof(wbuf), wbuf, 0, NULL };
+ 
++	if (6 + len > sizeof(wbuf)) {
++		dev_warn(&d->udev->dev, "%s: i2c wr: len=%d is too big!\n",
++			 KBUILD_MODNAME, len);
++		return -EOPNOTSUPP;
++	}
++
+ 	wbuf[0] = len;
+ 	wbuf[1] = 2;
+ 	wbuf[2] = 0;
+@@ -227,9 +236,16 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
+ 					msg[1].len);
+ 		} else {
+ 			/* I2C */
+-			u8 buf[5 + msg[0].len];
++			u8 buf[MAX_XFER_SIZE];
+ 			struct usb_req req = { CMD_I2C_RD, 0, sizeof(buf),
+ 					buf, msg[1].len, msg[1].buf };
++
++			if (5 + msg[0].len > sizeof(buf)) {
++				dev_warn(&d->udev->dev,
++					 "%s: i2c xfer: len=%d is too big!\n",
++					 KBUILD_MODNAME, msg[0].len);
++				return -EOPNOTSUPP;
++			}
+ 			req.mbox |= ((msg[0].addr & 0x80)  >>  3);
+ 			buf[0] = msg[1].len;
+ 			buf[1] = msg[0].addr << 1;
+@@ -256,9 +272,16 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
+ 					msg[0].len - 3);
+ 		} else {
+ 			/* I2C */
+-			u8 buf[5 + msg[0].len];
++			u8 buf[MAX_XFER_SIZE];
+ 			struct usb_req req = { CMD_I2C_WR, 0, sizeof(buf), buf,
+ 					0, NULL };
++
++			if (5 + msg[0].len > sizeof(buf)) {
++				dev_warn(&d->udev->dev,
++					 "%s: i2c xfer: len=%d is too big!\n",
++					 KBUILD_MODNAME, msg[0].len);
++				return -EOPNOTSUPP;
++			}
+ 			req.mbox |= ((msg[0].addr & 0x80)  >>  3);
+ 			buf[0] = msg[0].len;
+ 			buf[1] = msg[0].addr << 1;
+diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+index efdcb153..419a7c7e 100644
+--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
++++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+@@ -23,6 +23,9 @@
+ #include "lgdt3305.h"
+ #include "lg2160.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ int dvb_usb_mxl111sf_debug;
+ module_param_named(debug, dvb_usb_mxl111sf_debug, int, 0644);
+ MODULE_PARM_DESC(debug, "set debugging level "
+@@ -63,7 +66,12 @@ int mxl111sf_ctrl_msg(struct dvb_usb_device *d,
+ {
+ 	int wo = (rbuf == NULL || rlen == 0); /* write-only */
+ 	int ret;
+-	u8 sndbuf[1+wlen];
++	u8 sndbuf[MAX_XFER_SIZE];
++
++	if (1 + wlen > sizeof(sndbuf)) {
++		pr_warn("%s: len=%d is too big!\n", __func__, wlen);
++		return -EOPNOTSUPP;
++	}
+ 
+ 	deb_adv("%s(wlen = %d, rlen = %d)\n", __func__, wlen, rlen);
+ 
+diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
+index 3940bb0f..20e345d9 100644
+--- a/drivers/media/usb/dvb-usb/cxusb.c
++++ b/drivers/media/usb/dvb-usb/cxusb.c
+@@ -43,6 +43,9 @@
+ #include "lgs8gxx.h"
+ #include "atbm8830.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ /* debug */
+ static int dvb_usb_cxusb_debug;
+ module_param_named(debug, dvb_usb_cxusb_debug, int, 0644);
+@@ -57,7 +60,14 @@ static int cxusb_ctrl_msg(struct dvb_usb_device *d,
+ 			  u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
+ {
+ 	int wo = (rbuf == NULL || rlen == 0); /* write-only */
+-	u8 sndbuf[1+wlen];
++	u8 sndbuf[MAX_XFER_SIZE];
++
++	if (1 + wlen > sizeof(sndbuf)) {
++		warn("i2c wr: len=%d is too big!\n",
++		     wlen);
++		return -EOPNOTSUPP;
++	}
++
+ 	memset(sndbuf, 0, 1+wlen);
+ 
+ 	sndbuf[0] = cmd;
+@@ -158,7 +168,13 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 
+ 		if (msg[i].flags & I2C_M_RD) {
+ 			/* read only */
+-			u8 obuf[3], ibuf[1+msg[i].len];
++			u8 obuf[3], ibuf[MAX_XFER_SIZE];
++
++			if (1 + msg[i].len > sizeof(ibuf)) {
++				warn("i2c rd: len=%d is too big!\n",
++				     msg[i].len);
++				return -EOPNOTSUPP;
++			}
+ 			obuf[0] = 0;
+ 			obuf[1] = msg[i].len;
+ 			obuf[2] = msg[i].addr;
+@@ -172,7 +188,18 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 		} else if (i+1 < num && (msg[i+1].flags & I2C_M_RD) &&
+ 			   msg[i].addr == msg[i+1].addr) {
+ 			/* write to then read from same address */
+-			u8 obuf[3+msg[i].len], ibuf[1+msg[i+1].len];
++			u8 obuf[MAX_XFER_SIZE], ibuf[MAX_XFER_SIZE];
++
++			if (3 + msg[i].len > sizeof(obuf)) {
++				warn("i2c wr: len=%d is too big!\n",
++				     msg[i].len);
++				return -EOPNOTSUPP;
++			}
++			if (1 + msg[i + 1].len > sizeof(ibuf)) {
++				warn("i2c rd: len=%d is too big!\n",
++				     msg[i + 1].len);
++				return -EOPNOTSUPP;
++			}
+ 			obuf[0] = msg[i].len;
+ 			obuf[1] = msg[i+1].len;
+ 			obuf[2] = msg[i].addr;
+@@ -191,7 +218,13 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 			i++;
+ 		} else {
+ 			/* write only */
+-			u8 obuf[2+msg[i].len], ibuf;
++			u8 obuf[MAX_XFER_SIZE], ibuf;
++
++			if (2 + msg[i].len > sizeof(obuf)) {
++				warn("i2c wr: len=%d is too big!\n",
++				     msg[i].len);
++				return -EOPNOTSUPP;
++			}
+ 			obuf[0] = msg[i].addr;
+ 			obuf[1] = msg[i].len;
+ 			memcpy(&obuf[2], msg[i].buf, msg[i].len);
+diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c
+index c2dded92..6d68af0c 100644
+--- a/drivers/media/usb/dvb-usb/dibusb-common.c
++++ b/drivers/media/usb/dvb-usb/dibusb-common.c
+@@ -12,6 +12,9 @@
+ #include <linux/kconfig.h>
+ #include "dibusb.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ static int debug;
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "set debugging level (1=info (|-able))." DVB_USB_DEBUG_STATUS);
+@@ -105,11 +108,16 @@ EXPORT_SYMBOL(dibusb2_0_power_ctrl);
+ static int dibusb_i2c_msg(struct dvb_usb_device *d, u8 addr,
+ 			  u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen)
+ {
+-	u8 sndbuf[wlen+4]; /* lead(1) devaddr,direction(1) addr(2) data(wlen) (len(2) (when reading)) */
++	u8 sndbuf[MAX_XFER_SIZE]; /* lead(1) devaddr,direction(1) addr(2) data(wlen) (len(2) (when reading)) */
+ 	/* write only ? */
+ 	int wo = (rbuf == NULL || rlen == 0),
+ 		len = 2 + wlen + (wo ? 0 : 2);
+ 
++	if (4 + wlen > sizeof(sndbuf)) {
++		warn("i2c wr: len=%d is too big!\n", wlen);
++		return -EOPNOTSUPP;
++	}
++
+ 	sndbuf[0] = wo ? DIBUSB_REQ_I2C_WRITE : DIBUSB_REQ_I2C_READ;
+ 	sndbuf[1] = (addr << 1) | (wo ? 0 : 1);
+ 
+diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
+index 6e237b6d..71b22f5a 100644
+--- a/drivers/media/usb/dvb-usb/dw2102.c
++++ b/drivers/media/usb/dvb-usb/dw2102.c
+@@ -30,6 +30,9 @@
+ #include "stb6100_proc.h"
+ #include "m88rs2000.h"
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ #ifndef USB_PID_DW2102
+ #define USB_PID_DW2102 0x2102
+ #endif
+@@ -308,7 +311,14 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
+ 	case 2: {
+ 		/* read */
+ 		/* first write first register number */
+-		u8 ibuf[msg[1].len + 2], obuf[3];
++		u8 ibuf[MAX_XFER_SIZE], obuf[3];
++
++		if (2 + msg[1].len > sizeof(ibuf)) {
++			warn("i2c rd: len=%d is too big!\n",
++			     msg[1].len);
++			return -EOPNOTSUPP;
++		}
++
+ 		obuf[0] = msg[0].addr << 1;
+ 		obuf[1] = msg[0].len;
+ 		obuf[2] = msg[0].buf[0];
+@@ -325,7 +335,14 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
+ 		switch (msg[0].addr) {
+ 		case 0x68: {
+ 			/* write to register */
+-			u8 obuf[msg[0].len + 2];
++			u8 obuf[MAX_XFER_SIZE];
++
++			if (2 + msg[0].len > sizeof(obuf)) {
++				warn("i2c wr: len=%d is too big!\n",
++				     msg[1].len);
++				return -EOPNOTSUPP;
++			}
++
+ 			obuf[0] = msg[0].addr << 1;
+ 			obuf[1] = msg[0].len;
+ 			memcpy(obuf + 2, msg[0].buf, msg[0].len);
+@@ -335,7 +352,14 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
+ 		}
+ 		case 0x61: {
+ 			/* write to tuner */
+-			u8 obuf[msg[0].len + 2];
++			u8 obuf[MAX_XFER_SIZE];
++
++			if (2 + msg[0].len > sizeof(obuf)) {
++				warn("i2c wr: len=%d is too big!\n",
++				     msg[1].len);
++				return -EOPNOTSUPP;
++			}
++
+ 			obuf[0] = msg[0].addr << 1;
+ 			obuf[1] = msg[0].len;
+ 			memcpy(obuf + 2, msg[0].buf, msg[0].len);
+@@ -401,7 +425,14 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i
+ 		default: {
+ 			if (msg[j].flags == I2C_M_RD) {
+ 				/* read registers */
+-				u8  ibuf[msg[j].len + 2];
++				u8  ibuf[MAX_XFER_SIZE];
++
++				if (2 + msg[j].len > sizeof(ibuf)) {
++					warn("i2c rd: len=%d is too big!\n",
++					     msg[j].len);
++					return -EOPNOTSUPP;
++				}
++
+ 				dw210x_op_rw(d->udev, 0xc3,
+ 						(msg[j].addr << 1) + 1, 0,
+ 						ibuf, msg[j].len + 2,
+@@ -430,7 +461,14 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i
+ 				} while (len > 0);
+ 			} else {
+ 				/* write registers */
+-				u8 obuf[msg[j].len + 2];
++				u8 obuf[MAX_XFER_SIZE];
++
++				if (2 + msg[j].len > sizeof(obuf)) {
++					warn("i2c wr: len=%d is too big!\n",
++					     msg[j].len);
++					return -EOPNOTSUPP;
++				}
++
+ 				obuf[0] = msg[j].addr << 1;
+ 				obuf[1] = msg[j].len;
+ 				memcpy(obuf + 2, msg[j].buf, msg[j].len);
+@@ -463,7 +501,13 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 	case 2: {
+ 		/* read */
+ 		/* first write first register number */
+-		u8 ibuf[msg[1].len + 2], obuf[3];
++		u8 ibuf[MAX_XFER_SIZE], obuf[3];
++
++		if (2 + msg[1].len > sizeof(ibuf)) {
++			warn("i2c rd: len=%d is too big!\n",
++			     msg[1].len);
++			return -EOPNOTSUPP;
++		}
+ 		obuf[0] = msg[0].addr << 1;
+ 		obuf[1] = msg[0].len;
+ 		obuf[2] = msg[0].buf[0];
+@@ -481,7 +525,13 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 		case 0x60:
+ 		case 0x0c: {
+ 			/* write to register */
+-			u8 obuf[msg[0].len + 2];
++			u8 obuf[MAX_XFER_SIZE];
++
++			if (2 + msg[0].len > sizeof(obuf)) {
++				warn("i2c wr: len=%d is too big!\n",
++				     msg[0].len);
++				return -EOPNOTSUPP;
++			}
+ 			obuf[0] = msg[0].addr << 1;
+ 			obuf[1] = msg[0].len;
+ 			memcpy(obuf + 2, msg[0].buf, msg[0].len);
+@@ -563,7 +613,14 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 		default: {
+ 			if (msg[j].flags == I2C_M_RD) {
+ 				/* read registers */
+-				u8 ibuf[msg[j].len];
++				u8 ibuf[MAX_XFER_SIZE];
++
++				if (msg[j].len > sizeof(ibuf)) {
++					warn("i2c rd: len=%d is too big!\n",
++					     msg[j].len);
++					return -EOPNOTSUPP;
++				}
++
+ 				dw210x_op_rw(d->udev, 0x91, 0, 0,
+ 						ibuf, msg[j].len,
+ 						DW210X_READ_MSG);
+@@ -590,7 +647,14 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 				} while (len > 0);
+ 			} else if (j < (num - 1)) {
+ 				/* write register addr before read */
+-				u8 obuf[msg[j].len + 2];
++				u8 obuf[MAX_XFER_SIZE];
++
++				if (2 + msg[j].len > sizeof(obuf)) {
++					warn("i2c wr: len=%d is too big!\n",
++					     msg[j].len);
++					return -EOPNOTSUPP;
++				}
++
+ 				obuf[0] = msg[j + 1].len;
+ 				obuf[1] = (msg[j].addr << 1);
+ 				memcpy(obuf + 2, msg[j].buf, msg[j].len);
+@@ -602,7 +666,13 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ 				break;
+ 			} else {
+ 				/* write registers */
+-				u8 obuf[msg[j].len + 2];
++				u8 obuf[MAX_XFER_SIZE];
++
++				if (2 + msg[j].len > sizeof(obuf)) {
++					warn("i2c wr: len=%d is too big!\n",
++					     msg[j].len);
++					return -EOPNOTSUPP;
++				}
+ 				obuf[0] = msg[j].len + 1;
+ 				obuf[1] = (msg[j].addr << 1);
+ 				memcpy(obuf + 2, msg[j].buf, msg[j].len);
+diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
+index aca59d93..b5c95043 100644
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -584,6 +584,13 @@ static void atmci_timeout_timer(unsigned long data)
+ 	if (host->mrq->cmd->data) {
+ 		host->mrq->cmd->data->error = -ETIMEDOUT;
+ 		host->data = NULL;
++		/*
++		 * With some SDIO modules, sometimes DMA transfer hangs. If
++		 * stop_transfer() is not called then the DMA request is not
++		 * removed, following ones are queued and never computed.
++		 */
++		if (host->state == STATE_DATA_XFER)
++			host->stop_transfer(host);
+ 	} else {
+ 		host->mrq->cmd->error = -ETIMEDOUT;
+ 		host->cmd = NULL;
+@@ -1787,12 +1794,14 @@ static void atmci_tasklet_func(unsigned long priv)
+ 			if (unlikely(status)) {
+ 				host->stop_transfer(host);
+ 				host->data = NULL;
+-				if (status & ATMCI_DTOE) {
+-					data->error = -ETIMEDOUT;
+-				} else if (status & ATMCI_DCRCE) {
+-					data->error = -EILSEQ;
+-				} else {
+-					data->error = -EIO;
++				if (data) {
++					if (status & ATMCI_DTOE) {
++						data->error = -ETIMEDOUT;
++					} else if (status & ATMCI_DCRCE) {
++						data->error = -EILSEQ;
++					} else {
++						data->error = -EIO;
++					}
+ 				}
+ 			}
+ 
+diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+index 25ecfa18..ab6581f1 100644
+--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+@@ -264,8 +264,6 @@ static void dma_irq_callback(void *param)
+ 	struct gpmi_nand_data *this = param;
+ 	struct completion *dma_c = &this->dma_done;
+ 
+-	complete(dma_c);
+-
+ 	switch (this->dma_type) {
+ 	case DMA_FOR_COMMAND:
+ 		dma_unmap_sg(this->dev, &this->cmd_sgl, 1, DMA_TO_DEVICE);
+@@ -290,6 +288,8 @@ static void dma_irq_callback(void *param)
+ 	default:
+ 		pr_err("in wrong DMA operation.\n");
+ 	}
++
++	complete(dma_c);
+ }
+ 
+ int start_dma_without_bch_irq(struct gpmi_nand_data *this,
+diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
+index fb8c4dea..633db883 100644
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -2904,10 +2904,21 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
+ 	sanitize_string(p->model, sizeof(p->model));
+ 	if (!mtd->name)
+ 		mtd->name = p->model;
++
+ 	mtd->writesize = le32_to_cpu(p->byte_per_page);
+-	mtd->erasesize = le32_to_cpu(p->pages_per_block) * mtd->writesize;
++
++	/*
++	 * pages_per_block and blocks_per_lun may not be a power-of-2 size
++	 * (don't ask me who thought of this...). MTD assumes that these
++	 * dimensions will be power-of-2, so just truncate the remaining area.
++	 */
++	mtd->erasesize = 1 << (fls(le32_to_cpu(p->pages_per_block)) - 1);
++	mtd->erasesize *= mtd->writesize;
++
+ 	mtd->oobsize = le16_to_cpu(p->spare_bytes_per_page);
+-	chip->chipsize = le32_to_cpu(p->blocks_per_lun);
++
++	/* See erasesize comment */
++	chip->chipsize = 1 << (fls(le32_to_cpu(p->blocks_per_lun)) - 1);
+ 	chip->chipsize *= (uint64_t)mtd->erasesize * p->lun_count;
+ 	*busw = 0;
+ 	if (le16_to_cpu(p->features) & 1)
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index a8f33a52..f63169d6 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -711,7 +711,6 @@ static int flexcan_chip_start(struct net_device *dev)
+ {
+ 	struct flexcan_priv *priv = netdev_priv(dev);
+ 	struct flexcan_regs __iomem *regs = priv->base;
+-	unsigned int i;
+ 	int err;
+ 	u32 reg_mcr, reg_ctrl;
+ 
+@@ -783,17 +782,6 @@ static int flexcan_chip_start(struct net_device *dev)
+ 	netdev_dbg(dev, "%s: writing ctrl=0x%08x", __func__, reg_ctrl);
+ 	flexcan_write(reg_ctrl, &regs->ctrl);
+ 
+-	for (i = 0; i < ARRAY_SIZE(regs->cantxfg); i++) {
+-		flexcan_write(0, &regs->cantxfg[i].can_ctrl);
+-		flexcan_write(0, &regs->cantxfg[i].can_id);
+-		flexcan_write(0, &regs->cantxfg[i].data[0]);
+-		flexcan_write(0, &regs->cantxfg[i].data[1]);
+-
+-		/* put MB into rx queue */
+-		flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
+-			&regs->cantxfg[i].can_ctrl);
+-	}
+-
+ 	/* Abort any pending TX, mark Mailbox as INACTIVE */
+ 	flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
+ 		      &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
+diff --git a/drivers/net/wireless/iwlegacy/3945.c b/drivers/net/wireless/iwlegacy/3945.c
+index dc1e6da9..9a5f36e5 100644
+--- a/drivers/net/wireless/iwlegacy/3945.c
++++ b/drivers/net/wireless/iwlegacy/3945.c
+@@ -462,6 +462,8 @@ il3945_is_network_packet(struct il_priv *il, struct ieee80211_hdr *header)
+ 	}
+ }
+ 
++#define SMALL_PACKET_SIZE 256
++
+ static void
+ il3945_pass_packet_to_mac80211(struct il_priv *il, struct il_rx_buf *rxb,
+ 			       struct ieee80211_rx_status *stats)
+@@ -470,14 +472,13 @@ il3945_pass_packet_to_mac80211(struct il_priv *il, struct il_rx_buf *rxb,
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)IL_RX_DATA(pkt);
+ 	struct il3945_rx_frame_hdr *rx_hdr = IL_RX_HDR(pkt);
+ 	struct il3945_rx_frame_end *rx_end = IL_RX_END(pkt);
+-	u16 len = le16_to_cpu(rx_hdr->len);
++	u32 len = le16_to_cpu(rx_hdr->len);
+ 	struct sk_buff *skb;
+ 	__le16 fc = hdr->frame_control;
++	u32 fraglen = PAGE_SIZE << il->hw_params.rx_page_order;
+ 
+ 	/* We received data from the HW, so stop the watchdog */
+-	if (unlikely
+-	    (len + IL39_RX_FRAME_SIZE >
+-	     PAGE_SIZE << il->hw_params.rx_page_order)) {
++	if (unlikely(len + IL39_RX_FRAME_SIZE > fraglen)) {
+ 		D_DROP("Corruption detected!\n");
+ 		return;
+ 	}
+@@ -488,26 +489,32 @@ il3945_pass_packet_to_mac80211(struct il_priv *il, struct il_rx_buf *rxb,
+ 		return;
+ 	}
+ 
+-	skb = dev_alloc_skb(128);
++	skb = dev_alloc_skb(SMALL_PACKET_SIZE);
+ 	if (!skb) {
+ 		IL_ERR("dev_alloc_skb failed\n");
+ 		return;
+ 	}
+ 
+ 	if (!il3945_mod_params.sw_crypto)
+-		il_set_decrypted_flag(il, (struct ieee80211_hdr *)rxb_addr(rxb),
++		il_set_decrypted_flag(il, (struct ieee80211_hdr *)pkt,
+ 				      le32_to_cpu(rx_end->status), stats);
+ 
+-	skb_add_rx_frag(skb, 0, rxb->page,
+-			(void *)rx_hdr->payload - (void *)pkt, len,
+-			len);
+-
++	/* If frame is small enough to fit into skb->head, copy it
++	 * and do not consume a full page
++	 */
++	if (len <= SMALL_PACKET_SIZE) {
++		memcpy(skb_put(skb, len), rx_hdr->payload, len);
++	} else {
++		skb_add_rx_frag(skb, 0, rxb->page,
++				(void *)rx_hdr->payload - (void *)pkt, len,
++				fraglen);
++		il->alloc_rxb_page--;
++		rxb->page = NULL;
++	}
+ 	il_update_stats(il, false, fc, len);
+ 	memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
+ 
+ 	ieee80211_rx(il->hw, skb);
+-	il->alloc_rxb_page--;
+-	rxb->page = NULL;
+ }
+ 
+ #define IL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
+diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
+index a8eff95e..d2586f09 100644
+--- a/drivers/net/wireless/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/iwlegacy/4965-mac.c
+@@ -574,9 +574,11 @@ il4965_translate_rx_status(struct il_priv *il, u32 decrypt_in)
+ 	return decrypt_out;
+ }
+ 
++#define SMALL_PACKET_SIZE 256
++
+ static void
+ il4965_pass_packet_to_mac80211(struct il_priv *il, struct ieee80211_hdr *hdr,
+-			       u16 len, u32 ampdu_status, struct il_rx_buf *rxb,
++			       u32 len, u32 ampdu_status, struct il_rx_buf *rxb,
+ 			       struct ieee80211_rx_status *stats)
+ {
+ 	struct sk_buff *skb;
+@@ -593,21 +595,25 @@ il4965_pass_packet_to_mac80211(struct il_priv *il, struct ieee80211_hdr *hdr,
+ 	    il_set_decrypted_flag(il, hdr, ampdu_status, stats))
+ 		return;
+ 
+-	skb = dev_alloc_skb(128);
++	skb = dev_alloc_skb(SMALL_PACKET_SIZE);
+ 	if (!skb) {
+ 		IL_ERR("dev_alloc_skb failed\n");
+ 		return;
+ 	}
+ 
+-	skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb), len,
+-			len);
++	if (len <= SMALL_PACKET_SIZE) {
++		memcpy(skb_put(skb, len), hdr, len);
++	} else {
++		skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb),
++				len, PAGE_SIZE << il->hw_params.rx_page_order);
++		il->alloc_rxb_page--;
++		rxb->page = NULL;
++	}
+ 
+ 	il_update_stats(il, false, fc, len);
+ 	memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
+ 
+ 	ieee80211_rx(il->hw, skb);
+-	il->alloc_rxb_page--;
+-	rxb->page = NULL;
+ }
+ 
+ /* Called for N_RX (legacy ABG frames), or
+diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
+index 7a13790b..72d2ecce 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
++++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
+@@ -605,8 +605,10 @@ static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
+ {
+ 	int ret;
+ 
+-	WARN_ONCE(trans->state != IWL_TRANS_FW_ALIVE,
+-		  "%s bad state = %d", __func__, trans->state);
++	if (trans->state != IWL_TRANS_FW_ALIVE) {
++		IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
++		return -EIO;
++	}
+ 
+ 	if (!(cmd->flags & CMD_ASYNC))
+ 		lock_map_acquire_read(&trans->sync_cmd_lockdep_map);
+diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
+index 139c9581..047a6f34 100644
+--- a/drivers/net/wireless/mwifiex/sdio.c
++++ b/drivers/net/wireless/mwifiex/sdio.c
+@@ -930,7 +930,10 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
+ 				    struct sk_buff *skb, u32 upld_typ)
+ {
+ 	u8 *cmd_buf;
++	__le16 *curr_ptr = (__le16 *)skb->data;
++	u16 pkt_len = le16_to_cpu(*curr_ptr);
+ 
++	skb_trim(skb, pkt_len);
+ 	skb_pull(skb, INTF_HEADER_LEN);
+ 
+ 	switch (upld_typ) {
+diff --git a/drivers/net/wireless/mwifiex/uap_txrx.c b/drivers/net/wireless/mwifiex/uap_txrx.c
+index a018e42d..48e67247 100644
+--- a/drivers/net/wireless/mwifiex/uap_txrx.c
++++ b/drivers/net/wireless/mwifiex/uap_txrx.c
+@@ -34,6 +34,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
+ 	struct mwifiex_txinfo *tx_info;
+ 	int hdr_chop;
+ 	struct timeval tv;
++	struct ethhdr *p_ethhdr;
+ 	u8 rfc1042_eth_hdr[ETH_ALEN] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
+ 
+ 	uap_rx_pd = (struct uap_rxpd *)(skb->data);
+@@ -48,14 +49,36 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
+ 	}
+ 
+ 	if (!memcmp(&rx_pkt_hdr->rfc1042_hdr,
+-		    rfc1042_eth_hdr, sizeof(rfc1042_eth_hdr)))
++		    rfc1042_eth_hdr, sizeof(rfc1042_eth_hdr))) {
++		/* Replace the 803 header and rfc1042 header (llc/snap) with
++		 * an Ethernet II header, keep the src/dst and snap_type
++		 * (ethertype).
++		 *
++		 * The firmware only passes up SNAP frames converting all RX
++		 * data from 802.11 to 802.2/LLC/SNAP frames.
++		 *
++		 * To create the Ethernet II, just move the src, dst address
++		 * right before the snap_type.
++		 */
++		p_ethhdr = (struct ethhdr *)
++			((u8 *)(&rx_pkt_hdr->eth803_hdr)
++			 + sizeof(rx_pkt_hdr->eth803_hdr)
++			 + sizeof(rx_pkt_hdr->rfc1042_hdr)
++			 - sizeof(rx_pkt_hdr->eth803_hdr.h_dest)
++			 - sizeof(rx_pkt_hdr->eth803_hdr.h_source)
++			 - sizeof(rx_pkt_hdr->rfc1042_hdr.snap_type));
++		memcpy(p_ethhdr->h_source, rx_pkt_hdr->eth803_hdr.h_source,
++		       sizeof(p_ethhdr->h_source));
++		memcpy(p_ethhdr->h_dest, rx_pkt_hdr->eth803_hdr.h_dest,
++		       sizeof(p_ethhdr->h_dest));
+ 		/* Chop off the rxpd + the excess memory from
+ 		 * 802.2/llc/snap header that was removed.
+ 		 */
+-		hdr_chop = (u8 *)eth_hdr - (u8 *)uap_rx_pd;
+-	else
++		hdr_chop = (u8 *)p_ethhdr - (u8 *)uap_rx_pd;
++	} else {
+ 		/* Chop off the rxpd */
+ 		hdr_chop = (u8 *)&rx_pkt_hdr->eth803_hdr - (u8 *)uap_rx_pd;
++	}
+ 
+ 	/* Chop off the leading header bytes so the it points
+ 	 * to the start of either the reconstructed EthII frame
+diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
+index 5970ff6f..d498b02f 100644
+--- a/drivers/net/wireless/prism54/islpci_dev.c
++++ b/drivers/net/wireless/prism54/islpci_dev.c
+@@ -811,6 +811,10 @@ static const struct net_device_ops islpci_netdev_ops = {
+ 	.ndo_validate_addr	= eth_validate_addr,
+ };
+ 
++static struct device_type wlan_type = {
++	.name	= "wlan",
++};
++
+ struct net_device *
+ islpci_setup(struct pci_dev *pdev)
+ {
+@@ -821,9 +825,8 @@ islpci_setup(struct pci_dev *pdev)
+ 		return ndev;
+ 
+ 	pci_set_drvdata(pdev, ndev);
+-#if defined(SET_NETDEV_DEV)
+ 	SET_NETDEV_DEV(ndev, &pdev->dev);
+-#endif
++	SET_NETDEV_DEVTYPE(ndev, &wlan_type);
+ 
+ 	/* setup the structure members */
+ 	ndev->base_addr = pci_resource_start(pdev, 0);
+diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
+index f7143733..a3a2dcd2 100644
+--- a/drivers/net/wireless/rt2x00/rt2400pci.c
++++ b/drivers/net/wireless/rt2x00/rt2400pci.c
+@@ -1261,7 +1261,7 @@ static void rt2400pci_fill_rxdone(struct queue_entry *entry,
+ 	 */
+ 	rxdesc->timestamp = ((u64)rx_high << 32) | rx_low;
+ 	rxdesc->signal = rt2x00_get_field32(word2, RXD_W2_SIGNAL) & ~0x08;
+-	rxdesc->rssi = rt2x00_get_field32(word2, RXD_W3_RSSI) -
++	rxdesc->rssi = rt2x00_get_field32(word3, RXD_W3_RSSI) -
+ 	    entry->queue->rt2x00dev->rssi_offset;
+ 	rxdesc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
+ 
+diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
+index af59dd57..3698028c 100644
+--- a/drivers/net/wireless/rtlwifi/base.c
++++ b/drivers/net/wireless/rtlwifi/base.c
+@@ -37,6 +37,7 @@
+ 
+ #include <linux/ip.h>
+ #include <linux/module.h>
++#include <linux/udp.h>
+ 
+ /*
+  *NOTICE!!!: This file will be very big, we should
+@@ -1066,64 +1067,52 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
+ 	if (!ieee80211_is_data(fc))
+ 		return false;
+ 
++	ip = (const struct iphdr *)(skb->data + mac_hdr_len +
++				    SNAP_SIZE + PROTOC_TYPE_SIZE);
++	ether_type = be16_to_cpup((__be16 *)
++				  (skb->data + mac_hdr_len + SNAP_SIZE));
+ 
+-	ip = (struct iphdr *)((u8 *) skb->data + mac_hdr_len +
+-			      SNAP_SIZE + PROTOC_TYPE_SIZE);
+-	ether_type = *(u16 *) ((u8 *) skb->data + mac_hdr_len + SNAP_SIZE);
+-	/*	ether_type = ntohs(ether_type); */
+-
+-	if (ETH_P_IP == ether_type) {
+-		if (IPPROTO_UDP == ip->protocol) {
+-			struct udphdr *udp = (struct udphdr *)((u8 *) ip +
+-							       (ip->ihl << 2));
+-			if (((((u8 *) udp)[1] == 68) &&
+-			     (((u8 *) udp)[3] == 67)) ||
+-			    ((((u8 *) udp)[1] == 67) &&
+-			     (((u8 *) udp)[3] == 68))) {
+-				/*
+-				 * 68 : UDP BOOTP client
+-				 * 67 : UDP BOOTP server
+-				 */
+-				RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV),
+-					 DBG_DMESG, "dhcp %s !!\n",
+-					 is_tx ? "Tx" : "Rx");
+-
+-				if (is_tx) {
+-					rtlpriv->enter_ps = false;
+-					schedule_work(&rtlpriv->
+-						      works.lps_change_work);
+-					ppsc->last_delaylps_stamp_jiffies =
+-					    jiffies;
+-				}
++	switch (ether_type) {
++	case ETH_P_IP: {
++		struct udphdr *udp;
++		u16 src;
++		u16 dst;
+ 
+-				return true;
+-			}
+-		}
+-	} else if (ETH_P_ARP == ether_type) {
+-		if (is_tx) {
+-			rtlpriv->enter_ps = false;
+-			schedule_work(&rtlpriv->works.lps_change_work);
+-			ppsc->last_delaylps_stamp_jiffies = jiffies;
+-		}
++		if (ip->protocol != IPPROTO_UDP)
++			return false;
++		udp = (struct udphdr *)((u8 *)ip + (ip->ihl << 2));
++		src = be16_to_cpu(udp->source);
++		dst = be16_to_cpu(udp->dest);
+ 
+-		return true;
+-	} else if (ETH_P_PAE == ether_type) {
++		/* If this case involves port 68 (UDP BOOTP client) connecting
++		 * with port 67 (UDP BOOTP server), then return true so that
++		 * the lowest speed is used.
++		 */
++		if (!((src == 68 && dst == 67) || (src == 67 && dst == 68)))
++			return false;
++
++		RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
++			 "dhcp %s !!\n", is_tx ? "Tx" : "Rx");
++		break;
++	}
++	case ETH_P_ARP:
++		break;
++	case ETH_P_PAE:
+ 		RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+ 			 "802.1X %s EAPOL pkt!!\n", is_tx ? "Tx" : "Rx");
+-
+-		if (is_tx) {
+-			rtlpriv->enter_ps = false;
+-			schedule_work(&rtlpriv->works.lps_change_work);
+-			ppsc->last_delaylps_stamp_jiffies = jiffies;
+-		}
+-
+-		return true;
+-	} else if (ETH_P_IPV6 == ether_type) {
+-		/* IPv6 */
+-		return true;
++		break;
++	case ETH_P_IPV6:
++		/* TODO: Is this right? */
++		return false;
++	default:
++		return false;
+ 	}
+-
+-	return false;
++	if (is_tx) {
++		rtlpriv->enter_ps = false;
++		schedule_work(&rtlpriv->works.lps_change_work);
++		ppsc->last_delaylps_stamp_jiffies = jiffies;
++	}
++	return true;
+ }
+ 
+ /*********************************************************
+diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
+index b68cae30..e06971be 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
+@@ -143,6 +143,7 @@ static void _rtl88ee_set_fw_clock_on(struct ieee80211_hw *hw,
+ 		} else {
+ 			rtlhal->fw_clk_change_in_progress = false;
+ 			spin_unlock_bh(&rtlpriv->locks.fw_ps_lock);
++			break;
+ 		}
+ 	}
+ 
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
+index da4f5871..2c68c138 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
+@@ -778,7 +778,7 @@ static long _rtl92c_signal_scale_mapping(struct ieee80211_hw *hw,
+ 
+ static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
+ 				      struct rtl_stats *pstats,
+-				      struct rx_desc_92c *pdesc,
++				      struct rx_desc_92c *p_desc,
+ 				      struct rx_fwinfo_92c *p_drvinfo,
+ 				      bool packet_match_bssid,
+ 				      bool packet_toself,
+@@ -793,11 +793,11 @@ static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
+ 	u32 rssi, total_rssi = 0;
+ 	bool in_powersavemode = false;
+ 	bool is_cck_rate;
++	u8 *pdesc = (u8 *)p_desc;
+ 
+-	is_cck_rate = RX_HAL_IS_CCK_RATE(pdesc);
++	is_cck_rate = RX_HAL_IS_CCK_RATE(p_desc);
+ 	pstats->packet_matchbssid = packet_match_bssid;
+ 	pstats->packet_toself = packet_toself;
+-	pstats->is_cck = is_cck_rate;
+ 	pstats->packet_beacon = packet_beacon;
+ 	pstats->is_cck = is_cck_rate;
+ 	pstats->RX_SIGQ[0] = -1;
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+index 5a060e53..5c52a8ac 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+@@ -303,10 +303,10 @@ out:
+ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
+ 			   struct rtl_stats *stats,
+ 			   struct ieee80211_rx_status *rx_status,
+-			   u8 *p_desc, struct sk_buff *skb)
++			   u8 *pdesc, struct sk_buff *skb)
+ {
+ 	struct rx_fwinfo_92c *p_drvinfo;
+-	struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc;
++	struct rx_desc_92c *p_desc = (struct rx_desc_92c *)pdesc;
+ 	u32 phystatus = GET_RX_DESC_PHY_STATUS(pdesc);
+ 
+ 	stats->length = (u16) GET_RX_DESC_PKT_LEN(pdesc);
+@@ -345,11 +345,11 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
+ 	if (phystatus) {
+ 		p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
+ 						     stats->rx_bufshift);
+-		rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc,
++		rtl92c_translate_rx_signal_stuff(hw, skb, stats, p_desc,
+ 						 p_drvinfo);
+ 	}
+ 	/*rx_status->qual = stats->signal; */
+-	rx_status->signal = stats->rssi + 10;
++	rx_status->signal = stats->recvsignalpower + 10;
+ 	/*rx_status->noise = -stats->noise; */
+ 	return true;
+ }
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
+index b8ec718a..542394c8 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
+@@ -525,7 +525,7 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw,	struct rtl_stats *stats,
+ 						   p_drvinfo);
+ 	}
+ 	/*rx_status->qual = stats->signal; */
+-	rx_status->signal = stats->rssi + 10;
++	rx_status->signal = stats->recvsignalpower + 10;
+ 	/*rx_status->noise = -stats->noise; */
+ 	return true;
+ }
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/rf.c b/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
+index 5061f1db..92d38ab3 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
+@@ -265,7 +265,7 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw,
+ 				    rtlefuse->pwrgroup_ht40
+ 				    [RF90_PATH_A][chnl - 1]) {
+ 					pwrdiff_limit[i] =
+-					  rtlefuse->pwrgroup_ht20
++					  rtlefuse->pwrgroup_ht40
+ 					  [RF90_PATH_A][chnl - 1];
+ 				}
+ 			} else {
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+index c7095118..7d0f2e20 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+@@ -329,7 +329,7 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
+ 	}
+ 
+ 	/*rx_status->qual = stats->signal; */
+-	rx_status->signal = stats->rssi + 10;
++	rx_status->signal = stats->recvsignalpower + 10;
+ 	/*rx_status->noise = -stats->noise; */
+ 
+ 	return true;
+diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
+index 70325874..ad9c37a4 100644
+--- a/drivers/net/wireless/rtlwifi/wifi.h
++++ b/drivers/net/wireless/rtlwifi/wifi.h
+@@ -77,11 +77,7 @@
+ #define RTL_SLOT_TIME_9				9
+ #define RTL_SLOT_TIME_20			20
+ 
+-/*related with tcp/ip. */
+-/*if_ehther.h*/
+-#define ETH_P_PAE		0x888E	/*Port Access Entity (IEEE 802.1X) */
+-#define ETH_P_IP		0x0800	/*Internet Protocol packet */
+-#define ETH_P_ARP		0x0806	/*Address Resolution packet */
++/*related to tcp/ip. */
+ #define SNAP_SIZE		6
+ #define PROTOC_TYPE_SIZE	2
+ 
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index c4a2eb2c..540a7965 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -365,17 +365,19 @@ void xenvif_disconnect(struct xenvif *vif)
+ 	if (netif_carrier_ok(vif->dev))
+ 		xenvif_carrier_off(vif);
+ 
+-	atomic_dec(&vif->refcnt);
+-	wait_event(vif->waiting_to_free, atomic_read(&vif->refcnt) == 0);
+-
+-	if (vif->irq)
++	if (vif->irq) {
+ 		unbind_from_irqhandler(vif->irq, vif);
++		vif->irq = 0;
++	}
+ 
+ 	xen_netbk_unmap_frontend_rings(vif);
+ }
+ 
+ void xenvif_free(struct xenvif *vif)
+ {
++	atomic_dec(&vif->refcnt);
++	wait_event(vif->waiting_to_free, atomic_read(&vif->refcnt) == 0);
++
+ 	unregister_netdev(vif->dev);
+ 
+ 	free_netdev(vif->dev);
+diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
+index 696caed5..ce8acc71 100644
+--- a/drivers/pci/pcie/portdrv_pci.c
++++ b/drivers/pci/pcie/portdrv_pci.c
+@@ -223,7 +223,6 @@ static int pcie_portdrv_probe(struct pci_dev *dev,
+ static void pcie_portdrv_remove(struct pci_dev *dev)
+ {
+ 	pcie_port_device_remove(dev);
+-	pci_disable_device(dev);
+ }
+ 
+ static int error_detected_iter(struct device *device, void *data)
+diff --git a/drivers/pinctrl/mvebu/pinctrl-dove.c b/drivers/pinctrl/mvebu/pinctrl-dove.c
+index 428ea96a..e29e6d83 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-dove.c
++++ b/drivers/pinctrl/mvebu/pinctrl-dove.c
+@@ -323,7 +323,7 @@ static int dove_twsi_ctrl_set(struct mvebu_mpp_ctrl *ctrl,
+ 	unsigned long gcfg2 = readl(DOVE_GLOBAL_CONFIG_2);
+ 
+ 	gcfg1 &= ~DOVE_TWSI_ENABLE_OPTION1;
+-	gcfg2 &= ~(DOVE_TWSI_ENABLE_OPTION2 | DOVE_TWSI_ENABLE_OPTION2);
++	gcfg2 &= ~(DOVE_TWSI_ENABLE_OPTION2 | DOVE_TWSI_ENABLE_OPTION3);
+ 
+ 	switch (config) {
+ 	case 1:
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 6cd0fc1b..e06cb8f8 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -4448,7 +4448,7 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
+ 	struct qeth_cmd_buffer *iob;
+ 	struct qeth_ipa_cmd *cmd;
+ 	struct qeth_snmp_ureq *ureq;
+-	int req_len;
++	unsigned int req_len;
+ 	struct qeth_arp_query_info qinfo = {0, };
+ 	int rc = 0;
+ 
+@@ -4464,6 +4464,10 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
+ 	/* skip 4 bytes (data_len struct member) to get req_len */
+ 	if (copy_from_user(&req_len, udata + sizeof(int), sizeof(int)))
+ 		return -EFAULT;
++	if (req_len > (QETH_BUFSIZE - IPA_PDU_HEADER_SIZE -
++		       sizeof(struct qeth_ipacmd_hdr) -
++		       sizeof(struct qeth_ipacmd_setadpparms_hdr)))
++		return -EINVAL;
+ 	ureq = memdup_user(udata, req_len + sizeof(struct qeth_snmp_ureq_hdr));
+ 	if (IS_ERR(ureq)) {
+ 		QETH_CARD_TEXT(card, 2, "snmpnome");
+diff --git a/drivers/staging/media/lirc/lirc_zilog.c b/drivers/staging/media/lirc/lirc_zilog.c
+index 11d5338b..0feeaadf 100644
+--- a/drivers/staging/media/lirc/lirc_zilog.c
++++ b/drivers/staging/media/lirc/lirc_zilog.c
+@@ -61,6 +61,9 @@
+ #include <media/lirc_dev.h>
+ #include <media/lirc.h>
+ 
++/* Max transfer size done by I2C transfer functions */
++#define MAX_XFER_SIZE  64
++
+ struct IR;
+ 
+ struct IR_rx {
+@@ -941,7 +944,14 @@ static ssize_t read(struct file *filep, char *outbuf, size_t n, loff_t *ppos)
+ 			schedule();
+ 			set_current_state(TASK_INTERRUPTIBLE);
+ 		} else {
+-			unsigned char buf[rbuf->chunk_size];
++			unsigned char buf[MAX_XFER_SIZE];
++
++			if (rbuf->chunk_size > sizeof(buf)) {
++				zilog_error("chunk_size is too big (%d)!\n",
++					    rbuf->chunk_size);
++				ret = -EINVAL;
++				break;
++			}
+ 			m = lirc_buffer_read(rbuf, buf);
+ 			if (m == rbuf->chunk_size) {
+ 				ret = copy_to_user((void *)outbuf+written, buf,
+diff --git a/drivers/staging/tidspbridge/Kconfig b/drivers/staging/tidspbridge/Kconfig
+index 60848f19..f7deabcf 100644
+--- a/drivers/staging/tidspbridge/Kconfig
++++ b/drivers/staging/tidspbridge/Kconfig
+@@ -4,7 +4,7 @@
+ 
+ menuconfig TIDSPBRIDGE
+ 	tristate "DSP Bridge driver"
+-	depends on ARCH_OMAP3 && !ARCH_MULTIPLATFORM
++	depends on ARCH_OMAP3 && !ARCH_MULTIPLATFORM && BROKEN
+ 	select OMAP_MBOX_FWK
+ 	help
+ 	  DSP/BIOS Bridge is designed for platforms that contain a GPP and
+diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c
+index 33fa7675..3ff1126c 100644
+--- a/drivers/staging/vt6656/baseband.c
++++ b/drivers/staging/vt6656/baseband.c
+@@ -941,6 +941,7 @@ int BBbVT3184Init(struct vnt_private *pDevice)
+     u8 *                   pbyAgc;
+     u16                    wLengthAgc;
+     u8                    abyArray[256];
++	u8 data;
+ 
+     ntStatus = CONTROLnsRequestIn(pDevice,
+                                   MESSAGE_TYPE_READ,
+@@ -1106,6 +1107,16 @@ else {
+     ControlvWriteByte(pDevice,MESSAGE_REQUEST_BBREG,0x0D,0x01);
+ 
+     RFbRFTableDownload(pDevice);
++
++	/* Fix for TX USB resets from vendors driver */
++	CONTROLnsRequestIn(pDevice, MESSAGE_TYPE_READ, USB_REG4,
++		MESSAGE_REQUEST_MEM, sizeof(data), &data);
++
++	data |= 0x2;
++
++	CONTROLnsRequestOut(pDevice, MESSAGE_TYPE_WRITE, USB_REG4,
++		MESSAGE_REQUEST_MEM, sizeof(data), &data);
++
+     return true;//ntStatus;
+ }
+ 
+diff --git a/drivers/staging/vt6656/rndis.h b/drivers/staging/vt6656/rndis.h
+index 5e073062..5cf5e732 100644
+--- a/drivers/staging/vt6656/rndis.h
++++ b/drivers/staging/vt6656/rndis.h
+@@ -66,6 +66,8 @@
+ 
+ #define VIAUSB20_PACKET_HEADER          0x04
+ 
++#define USB_REG4	0x604
++
+ typedef struct _CMD_MESSAGE
+ {
+     u8        byData[256];
+diff --git a/drivers/staging/zsmalloc/zsmalloc-main.c b/drivers/staging/zsmalloc/zsmalloc-main.c
+index f82f7e69..288f5825 100644
+--- a/drivers/staging/zsmalloc/zsmalloc-main.c
++++ b/drivers/staging/zsmalloc/zsmalloc-main.c
+@@ -430,7 +430,12 @@ static struct page *get_next_page(struct page *page)
+ 	return next;
+ }
+ 
+-/* Encode <page, obj_idx> as a single handle value */
++/*
++ * Encode <page, obj_idx> as a single handle value.
++ * On hardware platforms with physical memory starting at 0x0 the pfn
++ * could be 0 so we ensure that the handle will never be 0 by adjusting the
++ * encoded obj_idx value before encoding.
++ */
+ static void *obj_location_to_handle(struct page *page, unsigned long obj_idx)
+ {
+ 	unsigned long handle;
+@@ -441,17 +446,21 @@ static void *obj_location_to_handle(struct page *page, unsigned long obj_idx)
+ 	}
+ 
+ 	handle = page_to_pfn(page) << OBJ_INDEX_BITS;
+-	handle |= (obj_idx & OBJ_INDEX_MASK);
++	handle |= ((obj_idx + 1) & OBJ_INDEX_MASK);
+ 
+ 	return (void *)handle;
+ }
+ 
+-/* Decode <page, obj_idx> pair from the given object handle */
++/*
++ * Decode <page, obj_idx> pair from the given object handle. We adjust the
++ * decoded obj_idx back to its original value since it was adjusted in
++ * obj_location_to_handle().
++ */
+ static void obj_handle_to_location(unsigned long handle, struct page **page,
+ 				unsigned long *obj_idx)
+ {
+ 	*page = pfn_to_page(handle >> OBJ_INDEX_BITS);
+-	*obj_idx = handle & OBJ_INDEX_MASK;
++	*obj_idx = (handle & OBJ_INDEX_MASK) - 1;
+ }
+ 
+ static unsigned long obj_idx_to_offset(struct page *page,
+diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
+index cee17543..130a1e4f 100644
+--- a/drivers/target/iscsi/iscsi_target_auth.c
++++ b/drivers/target/iscsi/iscsi_target_auth.c
+@@ -148,6 +148,7 @@ static int chap_server_compute_md5(
+ 	unsigned char client_digest[MD5_SIGNATURE_SIZE];
+ 	unsigned char server_digest[MD5_SIGNATURE_SIZE];
+ 	unsigned char chap_n[MAX_CHAP_N_SIZE], chap_r[MAX_RESPONSE_LENGTH];
++	size_t compare_len;
+ 	struct iscsi_chap *chap = conn->auth_protocol;
+ 	struct crypto_hash *tfm;
+ 	struct hash_desc desc;
+@@ -186,7 +187,9 @@ static int chap_server_compute_md5(
+ 		goto out;
+ 	}
+ 
+-	if (memcmp(chap_n, auth->userid, strlen(auth->userid)) != 0) {
++	/* Include the terminating NULL in the compare */
++	compare_len = strlen(auth->userid) + 1;
++	if (strncmp(chap_n, auth->userid, compare_len) != 0) {
+ 		pr_err("CHAP_N values do not match!\n");
+ 		goto out;
+ 	}
+diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
+index 421344da..c45b3365 100644
+--- a/drivers/target/iscsi/iscsi_target_configfs.c
++++ b/drivers/target/iscsi/iscsi_target_configfs.c
+@@ -1650,6 +1650,11 @@ static int lio_queue_status(struct se_cmd *se_cmd)
+ 	struct iscsi_cmd *cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd);
+ 
+ 	cmd->i_state = ISTATE_SEND_STATUS;
++
++	if (cmd->se_cmd.scsi_status || cmd->sense_reason) {
++		iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
++		return 0;
++	}
+ 	cmd->conn->conn_transport->iscsit_queue_status(cmd->conn, cmd);
+ 
+ 	return 0;
+diff --git a/drivers/target/iscsi/iscsi_target_device.c b/drivers/target/iscsi/iscsi_target_device.c
+index 1b740335..4edcc47c 100644
+--- a/drivers/target/iscsi/iscsi_target_device.c
++++ b/drivers/target/iscsi/iscsi_target_device.c
+@@ -60,11 +60,7 @@ void iscsit_increment_maxcmdsn(struct iscsi_cmd *cmd, struct iscsi_session *sess
+ 
+ 	cmd->maxcmdsn_inc = 1;
+ 
+-	if (!mutex_trylock(&sess->cmdsn_mutex)) {
+-		sess->max_cmd_sn += 1;
+-		pr_debug("Updated MaxCmdSN to 0x%08x\n", sess->max_cmd_sn);
+-		return;
+-	}
++	mutex_lock(&sess->cmdsn_mutex);
+ 	sess->max_cmd_sn += 1;
+ 	pr_debug("Updated MaxCmdSN to 0x%08x\n", sess->max_cmd_sn);
+ 	mutex_unlock(&sess->cmdsn_mutex);
+diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
+index cd5018ff..72d9dec9 100644
+--- a/drivers/target/iscsi/iscsi_target_nego.c
++++ b/drivers/target/iscsi/iscsi_target_nego.c
+@@ -90,7 +90,7 @@ int extract_param(
+ 	if (len < 0)
+ 		return -1;
+ 
+-	if (len > max_length) {
++	if (len >= max_length) {
+ 		pr_err("Length of input: %d exceeds max_length:"
+ 			" %d\n", len, max_length);
+ 		return -1;
+diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c
+index 30e4ed52..27a14a05 100644
+--- a/drivers/video/backlight/atmel-pwm-bl.c
++++ b/drivers/video/backlight/atmel-pwm-bl.c
+@@ -70,7 +70,7 @@ static int atmel_pwm_bl_set_intensity(struct backlight_device *bd)
+ static int atmel_pwm_bl_get_intensity(struct backlight_device *bd)
+ {
+ 	struct atmel_pwm_bl *pwmbl = bl_get_data(bd);
+-	u8 intensity;
++	u32 intensity;
+ 
+ 	if (pwmbl->pdata->pwm_active_low) {
+ 		intensity = pwm_channel_readl(&pwmbl->pwmc, PWM_CDTY) -
+@@ -80,7 +80,7 @@ static int atmel_pwm_bl_get_intensity(struct backlight_device *bd)
+ 			pwm_channel_readl(&pwmbl->pwmc, PWM_CDTY);
+ 	}
+ 
+-	return intensity;
++	return intensity & 0xffff;
+ }
+ 
+ static int atmel_pwm_bl_init_pwm(struct atmel_pwm_bl *pwmbl)
+@@ -207,8 +207,10 @@ static int atmel_pwm_bl_remove(struct platform_device *pdev)
+ {
+ 	struct atmel_pwm_bl *pwmbl = platform_get_drvdata(pdev);
+ 
+-	if (pwmbl->gpio_on != -1)
+-		gpio_set_value(pwmbl->gpio_on, 0);
++	if (pwmbl->gpio_on != -1) {
++		gpio_set_value(pwmbl->gpio_on,
++					0 ^ pwmbl->pdata->on_active_low);
++	}
+ 	pwm_channel_disable(&pwmbl->pwmc);
+ 	pwm_channel_free(&pwmbl->pwmc);
+ 	backlight_device_unregister(pwmbl->bldev);
+diff --git a/drivers/video/console/sticore.c b/drivers/video/console/sticore.c
+index 35687fd5..4ad24f2c 100644
+--- a/drivers/video/console/sticore.c
++++ b/drivers/video/console/sticore.c
+@@ -3,7 +3,7 @@
+  *	core code for console driver using HP's STI firmware
+  *
+  *	Copyright (C) 2000 Philipp Rumpf <prumpf@×××.org>
+- *	Copyright (C) 2001-2003 Helge Deller <deller@×××.de>
++ *	Copyright (C) 2001-2013 Helge Deller <deller@×××.de>
+  *	Copyright (C) 2001-2002 Thomas Bogendoerfer <tsbogend@×××××××××××××.de>
+  * 
+  * TODO:
+@@ -30,7 +30,7 @@
+ 
+ #include "../sticore.h"
+ 
+-#define STI_DRIVERVERSION "Version 0.9a"
++#define STI_DRIVERVERSION "Version 0.9b"
+ 
+ static struct sti_struct *default_sti __read_mostly;
+ 
+@@ -73,28 +73,34 @@ static const struct sti_init_flags default_init_flags = {
+ 
+ static int sti_init_graph(struct sti_struct *sti)
+ {
+-	struct sti_init_inptr_ext inptr_ext = { 0, };
+-	struct sti_init_inptr inptr = {
+-		.text_planes	= 3, /* # of text planes (max 3 for STI) */
+-		.ext_ptr	= STI_PTR(&inptr_ext)
+-	};
+-	struct sti_init_outptr outptr = { 0, };
++	struct sti_init_inptr *inptr = &sti->sti_data->init_inptr;
++	struct sti_init_inptr_ext *inptr_ext = &sti->sti_data->init_inptr_ext;
++	struct sti_init_outptr *outptr = &sti->sti_data->init_outptr;
+ 	unsigned long flags;
+-	int ret;
++	int ret, err;
+ 
+ 	spin_lock_irqsave(&sti->lock, flags);
+ 
+-	ret = STI_CALL(sti->init_graph, &default_init_flags, &inptr,
+-		&outptr, sti->glob_cfg);
++	memset(inptr, 0, sizeof(*inptr));
++	inptr->text_planes = 3; /* # of text planes (max 3 for STI) */
++	memset(inptr_ext, 0, sizeof(*inptr_ext));
++	inptr->ext_ptr = STI_PTR(inptr_ext);
++	outptr->errno = 0;
++
++	ret = sti_call(sti, sti->init_graph, &default_init_flags, inptr,
++		outptr, sti->glob_cfg);
++
++	if (ret >= 0)
++		sti->text_planes = outptr->text_planes;
++	err = outptr->errno;
+ 
+ 	spin_unlock_irqrestore(&sti->lock, flags);
+ 
+ 	if (ret < 0) {
+-		printk(KERN_ERR "STI init_graph failed (ret %d, errno %d)\n",ret,outptr.errno);
++		pr_err("STI init_graph failed (ret %d, errno %d)\n", ret, err);
+ 		return -1;
+ 	}
+ 	
+-	sti->text_planes = outptr.text_planes;
+ 	return 0;
+ }
+ 
+@@ -104,16 +110,18 @@ static const struct sti_conf_flags default_conf_flags = {
+ 
+ static void sti_inq_conf(struct sti_struct *sti)
+ {
+-	struct sti_conf_inptr inptr = { 0, };
++	struct sti_conf_inptr *inptr = &sti->sti_data->inq_inptr;
++	struct sti_conf_outptr *outptr = &sti->sti_data->inq_outptr;
+ 	unsigned long flags;
+ 	s32 ret;
+ 
+-	sti->outptr.ext_ptr = STI_PTR(&sti->outptr_ext);
++	outptr->ext_ptr = STI_PTR(&sti->sti_data->inq_outptr_ext);
+ 	
+ 	do {
+ 		spin_lock_irqsave(&sti->lock, flags);
+-		ret = STI_CALL(sti->inq_conf, &default_conf_flags,
+-			&inptr, &sti->outptr, sti->glob_cfg);
++		memset(inptr, 0, sizeof(*inptr));
++		ret = sti_call(sti, sti->inq_conf, &default_conf_flags,
++			inptr, outptr, sti->glob_cfg);
+ 		spin_unlock_irqrestore(&sti->lock, flags);
+ 	} while (ret == 1);
+ }
+@@ -126,7 +134,8 @@ static const struct sti_font_flags default_font_flags = {
+ void
+ sti_putc(struct sti_struct *sti, int c, int y, int x)
+ {
+-	struct sti_font_inptr inptr = {
++	struct sti_font_inptr *inptr = &sti->sti_data->font_inptr;
++	struct sti_font_inptr inptr_default = {
+ 		.font_start_addr= STI_PTR(sti->font->raw),
+ 		.index		= c_index(sti, c),
+ 		.fg_color	= c_fg(sti, c),
+@@ -134,14 +143,15 @@ sti_putc(struct sti_struct *sti, int c, int y, int x)
+ 		.dest_x		= x * sti->font_width,
+ 		.dest_y		= y * sti->font_height,
+ 	};
+-	struct sti_font_outptr outptr = { 0, };
++	struct sti_font_outptr *outptr = &sti->sti_data->font_outptr;
+ 	s32 ret;
+ 	unsigned long flags;
+ 
+ 	do {
+ 		spin_lock_irqsave(&sti->lock, flags);
+-		ret = STI_CALL(sti->font_unpmv, &default_font_flags,
+-			&inptr, &outptr, sti->glob_cfg);
++		*inptr = inptr_default;
++		ret = sti_call(sti, sti->font_unpmv, &default_font_flags,
++			inptr, outptr, sti->glob_cfg);
+ 		spin_unlock_irqrestore(&sti->lock, flags);
+ 	} while (ret == 1);
+ }
+@@ -156,7 +166,8 @@ void
+ sti_set(struct sti_struct *sti, int src_y, int src_x,
+ 	int height, int width, u8 color)
+ {
+-	struct sti_blkmv_inptr inptr = {
++	struct sti_blkmv_inptr *inptr = &sti->sti_data->blkmv_inptr;
++	struct sti_blkmv_inptr inptr_default = {
+ 		.fg_color	= color,
+ 		.bg_color	= color,
+ 		.src_x		= src_x,
+@@ -166,14 +177,15 @@ sti_set(struct sti_struct *sti, int src_y, int src_x,
+ 		.width		= width,
+ 		.height		= height,
+ 	};
+-	struct sti_blkmv_outptr outptr = { 0, };
++	struct sti_blkmv_outptr *outptr = &sti->sti_data->blkmv_outptr;
+ 	s32 ret;
+ 	unsigned long flags;
+ 	
+ 	do {
+ 		spin_lock_irqsave(&sti->lock, flags);
+-		ret = STI_CALL(sti->block_move, &clear_blkmv_flags,
+-			&inptr, &outptr, sti->glob_cfg);
++		*inptr = inptr_default;
++		ret = sti_call(sti, sti->block_move, &clear_blkmv_flags,
++			inptr, outptr, sti->glob_cfg);
+ 		spin_unlock_irqrestore(&sti->lock, flags);
+ 	} while (ret == 1);
+ }
+@@ -182,7 +194,8 @@ void
+ sti_clear(struct sti_struct *sti, int src_y, int src_x,
+ 	  int height, int width, int c)
+ {
+-	struct sti_blkmv_inptr inptr = {
++	struct sti_blkmv_inptr *inptr = &sti->sti_data->blkmv_inptr;
++	struct sti_blkmv_inptr inptr_default = {
+ 		.fg_color	= c_fg(sti, c),
+ 		.bg_color	= c_bg(sti, c),
+ 		.src_x		= src_x * sti->font_width,
+@@ -192,14 +205,15 @@ sti_clear(struct sti_struct *sti, int src_y, int src_x,
+ 		.width		= width * sti->font_width,
+ 		.height		= height* sti->font_height,
+ 	};
+-	struct sti_blkmv_outptr outptr = { 0, };
++	struct sti_blkmv_outptr *outptr = &sti->sti_data->blkmv_outptr;
+ 	s32 ret;
+ 	unsigned long flags;
+ 
+ 	do {
+ 		spin_lock_irqsave(&sti->lock, flags);
+-		ret = STI_CALL(sti->block_move, &clear_blkmv_flags,
+-			&inptr, &outptr, sti->glob_cfg);
++		*inptr = inptr_default;
++		ret = sti_call(sti, sti->block_move, &clear_blkmv_flags,
++			inptr, outptr, sti->glob_cfg);
+ 		spin_unlock_irqrestore(&sti->lock, flags);
+ 	} while (ret == 1);
+ }
+@@ -212,7 +226,8 @@ void
+ sti_bmove(struct sti_struct *sti, int src_y, int src_x,
+ 	  int dst_y, int dst_x, int height, int width)
+ {
+-	struct sti_blkmv_inptr inptr = {
++	struct sti_blkmv_inptr *inptr = &sti->sti_data->blkmv_inptr;
++	struct sti_blkmv_inptr inptr_default = {
+ 		.src_x		= src_x * sti->font_width,
+ 		.src_y		= src_y * sti->font_height,
+ 		.dest_x		= dst_x * sti->font_width,
+@@ -220,14 +235,15 @@ sti_bmove(struct sti_struct *sti, int src_y, int src_x,
+ 		.width		= width * sti->font_width,
+ 		.height		= height* sti->font_height,
+ 	};
+-	struct sti_blkmv_outptr outptr = { 0, };
++	struct sti_blkmv_outptr *outptr = &sti->sti_data->blkmv_outptr;
+ 	s32 ret;
+ 	unsigned long flags;
+ 
+ 	do {
+ 		spin_lock_irqsave(&sti->lock, flags);
+-		ret = STI_CALL(sti->block_move, &default_blkmv_flags,
+-			&inptr, &outptr, sti->glob_cfg);
++		*inptr = inptr_default;
++		ret = sti_call(sti, sti->block_move, &default_blkmv_flags,
++			inptr, outptr, sti->glob_cfg);
+ 		spin_unlock_irqrestore(&sti->lock, flags);
+ 	} while (ret == 1);
+ }
+@@ -284,7 +300,7 @@ __setup("sti=", sti_setup);
+ 
+ 
+ 
+-static char *font_name[MAX_STI_ROMS] = { "VGA8x16", };
++static char *font_name[MAX_STI_ROMS];
+ static int font_index[MAX_STI_ROMS],
+ 	   font_height[MAX_STI_ROMS],
+ 	   font_width[MAX_STI_ROMS];
+@@ -389,10 +405,10 @@ static void sti_dump_outptr(struct sti_struct *sti)
+ 		"%d used bits\n"
+ 		"%d planes\n"
+ 		"attributes %08x\n",
+-		 sti->outptr.bits_per_pixel,
+-		 sti->outptr.bits_used,
+-		 sti->outptr.planes,
+-		 sti->outptr.attributes));
++		 sti->sti_data->inq_outptr.bits_per_pixel,
++		 sti->sti_data->inq_outptr.bits_used,
++		 sti->sti_data->inq_outptr.planes,
++		 sti->sti_data->inq_outptr.attributes));
+ }
+ 
+ static int sti_init_glob_cfg(struct sti_struct *sti, unsigned long rom_address,
+@@ -402,24 +418,21 @@ static int sti_init_glob_cfg(struct sti_struct *sti, unsigned long rom_address,
+ 	struct sti_glob_cfg_ext *glob_cfg_ext;
+ 	void *save_addr;
+ 	void *sti_mem_addr;
+-	const int save_addr_size = 1024;	/* XXX */
+-	int i;
++	int i, size;
+ 
+-	if (!sti->sti_mem_request)
++	if (sti->sti_mem_request < 256)
+ 		sti->sti_mem_request = 256; /* STI default */
+ 
+-	glob_cfg = kzalloc(sizeof(*sti->glob_cfg), GFP_KERNEL);
+-	glob_cfg_ext = kzalloc(sizeof(*glob_cfg_ext), GFP_KERNEL);
+-	save_addr = kzalloc(save_addr_size, GFP_KERNEL);
+-	sti_mem_addr = kzalloc(sti->sti_mem_request, GFP_KERNEL);
++	size = sizeof(struct sti_all_data) + sti->sti_mem_request - 256;
+ 
+-	if (!(glob_cfg && glob_cfg_ext && save_addr && sti_mem_addr)) {
+-		kfree(glob_cfg);
+-		kfree(glob_cfg_ext);
+-		kfree(save_addr);
+-		kfree(sti_mem_addr);
++	sti->sti_data = kzalloc(size, STI_LOWMEM);
++	if (!sti->sti_data)
+ 		return -ENOMEM;
+-	}
++
++	glob_cfg	= &sti->sti_data->glob_cfg;
++	glob_cfg_ext	= &sti->sti_data->glob_cfg_ext;
++	save_addr	= &sti->sti_data->save_addr;
++	sti_mem_addr	= &sti->sti_data->sti_mem_addr;
+ 
+ 	glob_cfg->ext_ptr = STI_PTR(glob_cfg_ext);
+ 	glob_cfg->save_addr = STI_PTR(save_addr);
+@@ -475,32 +488,31 @@ static int sti_init_glob_cfg(struct sti_struct *sti, unsigned long rom_address,
+ 	return 0;
+ }
+ 
+-#ifdef CONFIG_FB
++#ifdef CONFIG_FONTS
+ static struct sti_cooked_font *
+ sti_select_fbfont(struct sti_cooked_rom *cooked_rom, const char *fbfont_name)
+ {
+-	const struct font_desc *fbfont;
++	const struct font_desc *fbfont = NULL;
+ 	unsigned int size, bpc;
+ 	void *dest;
+ 	struct sti_rom_font *nf;
+ 	struct sti_cooked_font *cooked_font;
+ 	
+-	if (!fbfont_name || !strlen(fbfont_name))
+-		return NULL;
+-	fbfont = find_font(fbfont_name);
++	if (fbfont_name && strlen(fbfont_name))
++		fbfont = find_font(fbfont_name);
+ 	if (!fbfont)
+ 		fbfont = get_default_font(1024,768, ~(u32)0, ~(u32)0);
+ 	if (!fbfont)
+ 		return NULL;
+ 
+-	DPRINTK((KERN_DEBUG "selected %dx%d fb-font %s\n",
+-			fbfont->width, fbfont->height, fbfont->name));
++	pr_info("STI selected %dx%d framebuffer font %s for sticon\n",
++			fbfont->width, fbfont->height, fbfont->name);
+ 			
+ 	bpc = ((fbfont->width+7)/8) * fbfont->height; 
+ 	size = bpc * 256;
+ 	size += sizeof(struct sti_rom_font);
+ 
+-	nf = kzalloc(size, GFP_KERNEL);
++	nf = kzalloc(size, STI_LOWMEM);
+ 	if (!nf)
+ 		return NULL;
+ 
+@@ -637,7 +649,7 @@ static void *sti_bmode_font_raw(struct sti_cooked_font *f)
+ 	unsigned char *n, *p, *q;
+ 	int size = f->raw->bytes_per_char*256+sizeof(struct sti_rom_font);
+ 	
+-	n = kzalloc (4*size, GFP_KERNEL);
++	n = kzalloc(4*size, STI_LOWMEM);
+ 	if (!n)
+ 		return NULL;
+ 	p = n + 3;
+@@ -673,7 +685,7 @@ static struct sti_rom *sti_get_bmode_rom (unsigned long address)
+ 	sti_bmode_rom_copy(address + BMODE_LAST_ADDR_OFFS, sizeof(size), &size);
+ 
+ 	size = (size+3) / 4;
+-	raw = kmalloc(size, GFP_KERNEL);
++	raw = kmalloc(size, STI_LOWMEM);
+ 	if (raw) {
+ 		sti_bmode_rom_copy(address, size, raw);
+ 		memmove (&raw->res004, &raw->type[0], 0x3c);
+@@ -707,7 +719,7 @@ static struct sti_rom *sti_get_wmode_rom(unsigned long address)
+ 	/* read the ROM size directly from the struct in ROM */ 
+ 	size = gsc_readl(address + offsetof(struct sti_rom,last_addr));
+ 
+-	raw = kmalloc(size, GFP_KERNEL);
++	raw = kmalloc(size, STI_LOWMEM);
+ 	if (raw)
+ 		sti_rom_copy(address, size, raw);
+ 
+@@ -743,6 +755,10 @@ static int sti_read_rom(int wordmode, struct sti_struct *sti,
+ 
+ 	address = (unsigned long) STI_PTR(raw);
+ 
++	pr_info("STI ROM supports 32 %sbit firmware functions.\n",
++		raw->alt_code_type == ALT_CODE_TYPE_PA_RISC_64
++		? "and 64 " : "");
++
+ 	sti->font_unpmv = address + (raw->font_unpmv & 0x03ffffff);
+ 	sti->block_move = address + (raw->block_move & 0x03ffffff);
+ 	sti->init_graph = address + (raw->init_graph & 0x03ffffff);
+@@ -901,7 +917,8 @@ test_rom:
+ 	sti_dump_globcfg(sti->glob_cfg, sti->sti_mem_request);
+ 	sti_dump_outptr(sti);
+ 	
+-	printk(KERN_INFO "    graphics card name: %s\n", sti->outptr.dev_name );
++	pr_info("    graphics card name: %s\n",
++		sti->sti_data->inq_outptr.dev_name);
+ 
+ 	sti_roms[num_sti_roms] = sti;
+ 	num_sti_roms++;
+@@ -1073,6 +1090,29 @@ struct sti_struct * sti_get_rom(unsigned int index)
+ }
+ EXPORT_SYMBOL(sti_get_rom);
+ 
++
++int sti_call(const struct sti_struct *sti, unsigned long func,
++		const void *flags, void *inptr, void *outptr,
++		struct sti_glob_cfg *glob_cfg)
++{
++	unsigned long _flags = STI_PTR(flags);
++	unsigned long _inptr = STI_PTR(inptr);
++	unsigned long _outptr = STI_PTR(outptr);
++	unsigned long _glob_cfg = STI_PTR(glob_cfg);
++	int ret;
++
++#ifdef CONFIG_64BIT
++	/* Check for overflow when using 32bit STI on 64bit kernel. */
++	if (WARN_ONCE(_flags>>32 || _inptr>>32 || _outptr>>32 || _glob_cfg>>32,
++			"Out of 32bit-range pointers!"))
++		return -1;
++#endif
++
++	ret = pdc_sti_call(func, _flags, _inptr, _outptr, _glob_cfg);
++
++	return ret;
++}
++
+ MODULE_AUTHOR("Philipp Rumpf, Helge Deller, Thomas Bogendoerfer");
+ MODULE_DESCRIPTION("Core STI driver for HP's NGLE series graphics cards in HP PARISC machines");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/video/sticore.h b/drivers/video/sticore.h
+index addf7b61..af161953 100644
+--- a/drivers/video/sticore.h
++++ b/drivers/video/sticore.h
+@@ -18,6 +18,9 @@
+ #define STI_FONT_HPROMAN8 1
+ #define STI_FONT_KANA8 2
+ 
++#define ALT_CODE_TYPE_UNKNOWN 0x00	/* alt code type values */
++#define ALT_CODE_TYPE_PA_RISC_64 0x01
++
+ /* The latency of the STI functions cannot really be reduced by setting
+  * this to 0;  STI doesn't seem to be designed to allow calling a different
+  * function (or the same function with different arguments) after a
+@@ -40,14 +43,6 @@
+ 
+ #define STI_PTR(p)	( virt_to_phys(p) )
+ #define PTR_STI(p)	( phys_to_virt((unsigned long)p) )
+-#define STI_CALL(func, flags, inptr, outptr, glob_cfg)	\
+-       ({						\
+-               pdc_sti_call( func, STI_PTR(flags),	\
+-				   STI_PTR(inptr),	\
+-				   STI_PTR(outptr),	\
+-				   STI_PTR(glob_cfg));	\
+-       })
+-
+ 
+ #define sti_onscreen_x(sti) (sti->glob_cfg->onscreen_x)
+ #define sti_onscreen_y(sti) (sti->glob_cfg->onscreen_y)
+@@ -56,6 +51,12 @@
+ #define sti_font_x(sti) (PTR_STI(sti->font)->width)
+ #define sti_font_y(sti) (PTR_STI(sti->font)->height)
+ 
++#ifdef CONFIG_64BIT
++#define STI_LOWMEM	(GFP_KERNEL | GFP_DMA)
++#else
++#define STI_LOWMEM	(GFP_KERNEL)
++#endif
++
+ 
+ /* STI function configuration structs */
+ 
+@@ -306,6 +307,34 @@ struct sti_blkmv_outptr {
+ };
+ 
+ 
++/* sti_all_data is an internal struct which needs to be allocated in
++ * low memory (< 4GB) if STI is used with 32bit STI on a 64bit kernel */
++
++struct sti_all_data {
++	struct sti_glob_cfg glob_cfg;
++	struct sti_glob_cfg_ext glob_cfg_ext;
++
++	struct sti_conf_inptr		inq_inptr;
++	struct sti_conf_outptr		inq_outptr; /* configuration */
++	struct sti_conf_outptr_ext	inq_outptr_ext;
++
++	struct sti_init_inptr_ext	init_inptr_ext;
++	struct sti_init_inptr		init_inptr;
++	struct sti_init_outptr		init_outptr;
++
++	struct sti_blkmv_inptr		blkmv_inptr;
++	struct sti_blkmv_outptr		blkmv_outptr;
++
++	struct sti_font_inptr		font_inptr;
++	struct sti_font_outptr		font_outptr;
++
++	/* leave as last entries */
++	unsigned long save_addr[1024 / sizeof(unsigned long)];
++	   /* min 256 bytes which is STI default, max sti->sti_mem_request */
++	unsigned long sti_mem_addr[256 / sizeof(unsigned long)];
++	/* do not add something below here ! */
++};
++
+ /* internal generic STI struct */
+ 
+ struct sti_struct {
+@@ -330,11 +359,9 @@ struct sti_struct {
+ 	region_t regions[STI_REGION_MAX];
+ 	unsigned long regions_phys[STI_REGION_MAX];
+ 
+-	struct sti_glob_cfg *glob_cfg;
+-	struct sti_cooked_font *font;	/* ptr to selected font (cooked) */
++	struct sti_glob_cfg *glob_cfg;	/* points into sti_all_data */
+ 
+-	struct sti_conf_outptr outptr; /* configuration */
+-	struct sti_conf_outptr_ext outptr_ext;
++	struct sti_cooked_font *font;	/* ptr to selected font (cooked) */
+ 
+ 	struct pci_dev *pd;
+ 
+@@ -343,6 +370,9 @@ struct sti_struct {
+ 
+ 	/* pointer to the fb_info where this STI device is used */
+ 	struct fb_info *info;
++
++	/* pointer to all internal data */
++	struct sti_all_data *sti_data;
+ };
+ 
+ 
+@@ -350,6 +380,14 @@ struct sti_struct {
+ 
+ struct sti_struct *sti_get_rom(unsigned int index); /* 0: default sti */
+ 
++
++/* sticore main function to call STI firmware */
++
++int sti_call(const struct sti_struct *sti, unsigned long func,
++		const void *flags, void *inptr, void *outptr,
++		struct sti_glob_cfg *glob_cfg);
++
++
+ /* functions to call the STI ROM directly */
+ 
+ void sti_putc(struct sti_struct *sti, int c, int y, int x);
+diff --git a/drivers/video/stifb.c b/drivers/video/stifb.c
+index 876648e1..019a1fee 100644
+--- a/drivers/video/stifb.c
++++ b/drivers/video/stifb.c
+@@ -1101,6 +1101,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
+ 	var = &info->var;
+ 
+ 	fb->sti = sti;
++	dev_name = sti->sti_data->inq_outptr.dev_name;
+ 	/* store upper 32bits of the graphics id */
+ 	fb->id = fb->sti->graphics_id[0];
+ 
+@@ -1114,11 +1115,11 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
+ 		  Since this driver only supports standard mode, we check
+ 		  if the device name contains the string "DX" and tell the
+ 		  user how to reconfigure the card. */
+-		if (strstr(sti->outptr.dev_name, "DX")) {
++		if (strstr(dev_name, "DX")) {
+ 		   printk(KERN_WARNING
+ "WARNING: stifb framebuffer driver does not support '%s' in double-buffer mode.\n"
+ "WARNING: Please disable the double-buffer mode in IPL menu (the PARISC-BIOS).\n",
+-			sti->outptr.dev_name);
++			dev_name);
+ 		   goto out_err0;
+ 		}
+ 		/* fall though */
+@@ -1130,7 +1131,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
+ 		break;
+ 	default:
+ 		printk(KERN_WARNING "stifb: '%s' (id: 0x%08x) not supported.\n",
+-			sti->outptr.dev_name, fb->id);
++			dev_name, fb->id);
+ 		goto out_err0;
+ 	}
+ 	
+@@ -1154,7 +1155,6 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
+ 		fb->id = S9000_ID_A1659A;
+ 		break;
+ 	case S9000_ID_TIMBER:	/* HP9000/710 Any (may be a grayscale device) */
+-		dev_name = fb->sti->outptr.dev_name;
+ 		if (strstr(dev_name, "GRAYSCALE") || 
+ 		    strstr(dev_name, "Grayscale") ||
+ 		    strstr(dev_name, "grayscale"))
+@@ -1290,7 +1290,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
+ 		var->xres, 
+ 		var->yres,
+ 		var->bits_per_pixel,
+-		sti->outptr.dev_name,
++		dev_name,
+ 		fb->id, 
+ 		fix->mmio_start);
+ 
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index a58dc77c..d17c5d72 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -3306,11 +3306,13 @@ static __u16 ACL_to_cifs_posix(char *parm_data, const char *pACL,
+ 		return 0;
+ 	}
+ 	cifs_acl->version = cpu_to_le16(1);
+-	if (acl_type == ACL_TYPE_ACCESS)
++	if (acl_type == ACL_TYPE_ACCESS) {
+ 		cifs_acl->access_entry_count = cpu_to_le16(count);
+-	else if (acl_type == ACL_TYPE_DEFAULT)
++		cifs_acl->default_entry_count = __constant_cpu_to_le16(0xFFFF);
++	} else if (acl_type == ACL_TYPE_DEFAULT) {
+ 		cifs_acl->default_entry_count = cpu_to_le16(count);
+-	else {
++		cifs_acl->access_entry_count = __constant_cpu_to_le16(0xFFFF);
++	} else {
+ 		cifs_dbg(FYI, "unknown ACL type %d\n", acl_type);
+ 		return 0;
+ 	}
+diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
+index 073d30b9..a726b9f2 100644
+--- a/fs/devpts/inode.c
++++ b/fs/devpts/inode.c
+@@ -498,6 +498,7 @@ static void devpts_kill_sb(struct super_block *sb)
+ {
+ 	struct pts_fs_info *fsi = DEVPTS_SB(sb);
+ 
++	ida_destroy(&fsi->allocated_ptys);
+ 	kfree(fsi);
+ 	kill_litter_super(sb);
+ }
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 03e9bebb..1423c481 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1352,6 +1352,7 @@ retry:
+ 					new_extra_isize = s_min_extra_isize;
+ 					kfree(is); is = NULL;
+ 					kfree(bs); bs = NULL;
++					brelse(bh);
+ 					goto retry;
+ 				}
+ 				error = -1;
+diff --git a/fs/namei.c b/fs/namei.c
+index 9ed93612..cccaf77e 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -2263,6 +2263,7 @@ static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
+  */
+ static inline int may_create(struct inode *dir, struct dentry *child)
+ {
++	audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
+ 	if (child->d_inode)
+ 		return -EEXIST;
+ 	if (IS_DEADDIR(dir))
+diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
+index f45b2a78..6b66efdc 100644
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -97,6 +97,7 @@ enum acpi_hotplug_mode {
+ struct acpi_hotplug_profile {
+ 	struct kobject kobj;
+ 	bool enabled:1;
++	bool ignore:1;
+ 	enum acpi_hotplug_mode mode;
+ };
+ 
+diff --git a/include/linux/audit.h b/include/linux/audit.h
+index b20b0385..729a4d16 100644
+--- a/include/linux/audit.h
++++ b/include/linux/audit.h
+@@ -103,8 +103,11 @@ extern void __audit_syscall_exit(int ret_success, long ret_value);
+ extern struct filename *__audit_reusename(const __user char *uptr);
+ extern void __audit_getname(struct filename *name);
+ extern void audit_putname(struct filename *name);
++
++#define AUDIT_INODE_PARENT	1	/* dentry represents the parent */
++#define AUDIT_INODE_HIDDEN	2	/* audit record should be hidden */
+ extern void __audit_inode(struct filename *name, const struct dentry *dentry,
+-				unsigned int parent);
++				unsigned int flags);
+ extern void __audit_inode_child(const struct inode *parent,
+ 				const struct dentry *dentry,
+ 				const unsigned char type);
+@@ -148,10 +151,22 @@ static inline void audit_getname(struct filename *name)
+ 	if (unlikely(!audit_dummy_context()))
+ 		__audit_getname(name);
+ }
+-static inline void audit_inode(struct filename *name, const struct dentry *dentry,
++static inline void audit_inode(struct filename *name,
++				const struct dentry *dentry,
+ 				unsigned int parent) {
++	if (unlikely(!audit_dummy_context())) {
++		unsigned int flags = 0;
++		if (parent)
++			flags |= AUDIT_INODE_PARENT;
++		__audit_inode(name, dentry, flags);
++	}
++}
++static inline void audit_inode_parent_hidden(struct filename *name,
++						const struct dentry *dentry)
++{
+ 	if (unlikely(!audit_dummy_context()))
+-		__audit_inode(name, dentry, parent);
++		__audit_inode(name, dentry,
++				AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN);
+ }
+ static inline void audit_inode_child(const struct inode *parent,
+ 				     const struct dentry *dentry,
+@@ -311,7 +326,7 @@ static inline void audit_putname(struct filename *name)
+ { }
+ static inline void __audit_inode(struct filename *name,
+ 					const struct dentry *dentry,
+-					unsigned int parent)
++					unsigned int flags)
+ { }
+ static inline void __audit_inode_child(const struct inode *parent,
+ 					const struct dentry *dentry,
+@@ -321,6 +336,9 @@ static inline void audit_inode(struct filename *name,
+ 				const struct dentry *dentry,
+ 				unsigned int parent)
+ { }
++static inline void audit_inode_parent_hidden(struct filename *name,
++				const struct dentry *dentry)
++{ }
+ static inline void audit_inode_child(const struct inode *parent,
+ 				     const struct dentry *dentry,
+ 				     const unsigned char type)
+diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h
+index 19c19a5e..f6c82de1 100644
+--- a/include/linux/ipc_namespace.h
++++ b/include/linux/ipc_namespace.h
+@@ -34,9 +34,9 @@ struct ipc_namespace {
+ 	int		sem_ctls[4];
+ 	int		used_sems;
+ 
+-	int		msg_ctlmax;
+-	int		msg_ctlmnb;
+-	int		msg_ctlmni;
++	unsigned int	msg_ctlmax;
++	unsigned int	msg_ctlmnb;
++	unsigned int	msg_ctlmni;
+ 	atomic_t	msg_bytes;
+ 	atomic_t	msg_hdrs;
+ 	int		auto_msgmni;
+diff --git a/include/linux/msg.h b/include/linux/msg.h
+index 391af8d1..e21f9d44 100644
+--- a/include/linux/msg.h
++++ b/include/linux/msg.h
+@@ -6,9 +6,9 @@
+ 
+ /* one msg_msg structure for each message */
+ struct msg_msg {
+-	struct list_head m_list; 
+-	long  m_type;          
+-	int m_ts;           /* message text size */
++	struct list_head m_list;
++	long m_type;
++	size_t m_ts;		/* message text size */
+ 	struct msg_msgseg* next;
+ 	void *security;
+ 	/* the actual message follows immediately */
+diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h
+index 4b02512e..5f487d77 100644
+--- a/include/linux/mtd/map.h
++++ b/include/linux/mtd/map.h
+@@ -365,7 +365,7 @@ static inline map_word map_word_load_partial(struct map_info *map, map_word orig
+ 			bitpos = (map_bankwidth(map)-1-i)*8;
+ #endif
+ 			orig.x[0] &= ~(0xff << bitpos);
+-			orig.x[0] |= buf[i-start] << bitpos;
++			orig.x[0] |= (unsigned long)buf[i-start] << bitpos;
+ 		}
+ 	}
+ 	return orig;
+@@ -384,7 +384,7 @@ static inline map_word map_word_ff(struct map_info *map)
+ 
+ 	if (map_bankwidth(map) < MAP_FF_LIMIT) {
+ 		int bw = 8 * map_bankwidth(map);
+-		r.x[0] = (1 << bw) - 1;
++		r.x[0] = (1UL << bw) - 1;
+ 	} else {
+ 		for (i=0; i<map_words(map); i++)
+ 			r.x[i] = ~0UL;
+diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
+index 977bc8a4..33131085 100644
+--- a/include/net/netfilter/nf_conntrack_extend.h
++++ b/include/net/netfilter/nf_conntrack_extend.h
+@@ -80,7 +80,7 @@ static inline void nf_ct_ext_destroy(struct nf_conn *ct)
+ static inline void nf_ct_ext_free(struct nf_conn *ct)
+ {
+ 	if (ct->ext)
+-		kfree(ct->ext);
++		kfree_rcu(ct->ext, rcu);
+ }
+ 
+ /* Add this type, returns pointer to data or NULL. */
+diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
+index 19edd7fa..66dba421 100644
+--- a/include/trace/ftrace.h
++++ b/include/trace/ftrace.h
+@@ -368,7 +368,8 @@ ftrace_define_fields_##call(struct ftrace_event_call *event_call)	\
+ 	__data_size += (len) * sizeof(type);
+ 
+ #undef __string
+-#define __string(item, src) __dynamic_array(char, item, strlen(src) + 1)
++#define __string(item, src) __dynamic_array(char, item,			\
++		    strlen((src) ? (const char *)(src) : "(null)") + 1)
+ 
+ #undef DECLARE_EVENT_CLASS
+ #define DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print)	\
+@@ -498,7 +499,7 @@ static inline notrace int ftrace_get_offsets_##call(			\
+ 
+ #undef __assign_str
+ #define __assign_str(dst, src)						\
+-	strcpy(__get_str(dst), src);
++	strcpy(__get_str(dst), (src) ? (const char *)(src) : "(null)");
+ 
+ #undef TP_fast_assign
+ #define TP_fast_assign(args...) args
+diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
+index 130dfece..b0e99deb 100644
+--- a/ipc/ipc_sysctl.c
++++ b/ipc/ipc_sysctl.c
+@@ -62,7 +62,7 @@ static int proc_ipc_dointvec_minmax_orphans(ctl_table *table, int write,
+ 	return err;
+ }
+ 
+-static int proc_ipc_callback_dointvec(ctl_table *table, int write,
++static int proc_ipc_callback_dointvec_minmax(ctl_table *table, int write,
+ 	void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+ 	struct ctl_table ipc_table;
+@@ -72,7 +72,7 @@ static int proc_ipc_callback_dointvec(ctl_table *table, int write,
+ 	memcpy(&ipc_table, table, sizeof(ipc_table));
+ 	ipc_table.data = get_ipc(table);
+ 
+-	rc = proc_dointvec(&ipc_table, write, buffer, lenp, ppos);
++	rc = proc_dointvec_minmax(&ipc_table, write, buffer, lenp, ppos);
+ 
+ 	if (write && !rc && lenp_bef == *lenp)
+ 		/*
+@@ -152,15 +152,13 @@ static int proc_ipcauto_dointvec_minmax(ctl_table *table, int write,
+ #define proc_ipc_dointvec	   NULL
+ #define proc_ipc_dointvec_minmax   NULL
+ #define proc_ipc_dointvec_minmax_orphans   NULL
+-#define proc_ipc_callback_dointvec NULL
++#define proc_ipc_callback_dointvec_minmax  NULL
+ #define proc_ipcauto_dointvec_minmax NULL
+ #endif
+ 
+ static int zero;
+ static int one = 1;
+-#ifdef CONFIG_CHECKPOINT_RESTORE
+ static int int_max = INT_MAX;
+-#endif
+ 
+ static struct ctl_table ipc_kern_table[] = {
+ 	{
+@@ -198,21 +196,27 @@ static struct ctl_table ipc_kern_table[] = {
+ 		.data		= &init_ipc_ns.msg_ctlmax,
+ 		.maxlen		= sizeof (init_ipc_ns.msg_ctlmax),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_ipc_dointvec,
++		.proc_handler	= proc_ipc_dointvec_minmax,
++		.extra1		= &zero,
++		.extra2		= &int_max,
+ 	},
+ 	{
+ 		.procname	= "msgmni",
+ 		.data		= &init_ipc_ns.msg_ctlmni,
+ 		.maxlen		= sizeof (init_ipc_ns.msg_ctlmni),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_ipc_callback_dointvec,
++		.proc_handler	= proc_ipc_callback_dointvec_minmax,
++		.extra1		= &zero,
++		.extra2		= &int_max,
+ 	},
+ 	{
+ 		.procname	=  "msgmnb",
+ 		.data		= &init_ipc_ns.msg_ctlmnb,
+ 		.maxlen		= sizeof (init_ipc_ns.msg_ctlmnb),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_ipc_dointvec,
++		.proc_handler	= proc_ipc_dointvec_minmax,
++		.extra1		= &zero,
++		.extra2		= &int_max,
+ 	},
+ 	{
+ 		.procname	= "sem",
+diff --git a/ipc/mqueue.c b/ipc/mqueue.c
+index e4e47f64..ae1996d3 100644
+--- a/ipc/mqueue.c
++++ b/ipc/mqueue.c
+@@ -823,6 +823,7 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, umode_t, mode,
+ 				error = ro;
+ 				goto out;
+ 			}
++			audit_inode_parent_hidden(name, root);
+ 			filp = do_create(ipc_ns, root->d_inode,
+ 						&path, oflag, mode,
+ 						u_attr ? &attr : NULL);
+@@ -868,6 +869,7 @@ SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name)
+ 	if (IS_ERR(name))
+ 		return PTR_ERR(name);
+ 
++	audit_inode_parent_hidden(name, mnt->mnt_root);
+ 	err = mnt_want_write(mnt);
+ 	if (err)
+ 		goto out_name;
+diff --git a/ipc/msgutil.c b/ipc/msgutil.c
+index 491e71f2..7e709597 100644
+--- a/ipc/msgutil.c
++++ b/ipc/msgutil.c
+@@ -41,15 +41,15 @@ struct msg_msgseg {
+ 	/* the next part of the message follows immediately */
+ };
+ 
+-#define DATALEN_MSG	(int)(PAGE_SIZE-sizeof(struct msg_msg))
+-#define DATALEN_SEG	(int)(PAGE_SIZE-sizeof(struct msg_msgseg))
++#define DATALEN_MSG	((size_t)PAGE_SIZE-sizeof(struct msg_msg))
++#define DATALEN_SEG	((size_t)PAGE_SIZE-sizeof(struct msg_msgseg))
+ 
+ 
+-static struct msg_msg *alloc_msg(int len)
++static struct msg_msg *alloc_msg(size_t len)
+ {
+ 	struct msg_msg *msg;
+ 	struct msg_msgseg **pseg;
+-	int alen;
++	size_t alen;
+ 
+ 	alen = min(len, DATALEN_MSG);
+ 	msg = kmalloc(sizeof(*msg) + alen, GFP_KERNEL);
+@@ -80,12 +80,12 @@ out_err:
+ 	return NULL;
+ }
+ 
+-struct msg_msg *load_msg(const void __user *src, int len)
++struct msg_msg *load_msg(const void __user *src, size_t len)
+ {
+ 	struct msg_msg *msg;
+ 	struct msg_msgseg *seg;
+ 	int err = -EFAULT;
+-	int alen;
++	size_t alen;
+ 
+ 	msg = alloc_msg(len);
+ 	if (msg == NULL)
+@@ -117,8 +117,8 @@ out_err:
+ struct msg_msg *copy_msg(struct msg_msg *src, struct msg_msg *dst)
+ {
+ 	struct msg_msgseg *dst_pseg, *src_pseg;
+-	int len = src->m_ts;
+-	int alen;
++	size_t len = src->m_ts;
++	size_t alen;
+ 
+ 	BUG_ON(dst == NULL);
+ 	if (src->m_ts > dst->m_ts)
+@@ -147,9 +147,9 @@ struct msg_msg *copy_msg(struct msg_msg *src, struct msg_msg *dst)
+ 	return ERR_PTR(-ENOSYS);
+ }
+ #endif
+-int store_msg(void __user *dest, struct msg_msg *msg, int len)
++int store_msg(void __user *dest, struct msg_msg *msg, size_t len)
+ {
+-	int alen;
++	size_t alen;
+ 	struct msg_msgseg *seg;
+ 
+ 	alen = min(len, DATALEN_MSG);
+diff --git a/ipc/sem.c b/ipc/sem.c
+index 8c4f59b0..db9d241a 100644
+--- a/ipc/sem.c
++++ b/ipc/sem.c
+@@ -1282,6 +1282,12 @@ static int semctl_setval(struct ipc_namespace *ns, int semid, int semnum,
+ 
+ 	sem_lock(sma, NULL, -1);
+ 
++	if (sma->sem_perm.deleted) {
++		sem_unlock(sma, -1);
++		rcu_read_unlock();
++		return -EIDRM;
++	}
++
+ 	curr = &sma->sem_base[semnum];
+ 
+ 	ipc_assert_locked_object(&sma->sem_perm);
+@@ -1336,12 +1342,14 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
+ 		int i;
+ 
+ 		sem_lock(sma, NULL, -1);
++		if (sma->sem_perm.deleted) {
++			err = -EIDRM;
++			goto out_unlock;
++		}
+ 		if(nsems > SEMMSL_FAST) {
+ 			if (!ipc_rcu_getref(sma)) {
+-				sem_unlock(sma, -1);
+-				rcu_read_unlock();
+ 				err = -EIDRM;
+-				goto out_free;
++				goto out_unlock;
+ 			}
+ 			sem_unlock(sma, -1);
+ 			rcu_read_unlock();
+@@ -1354,10 +1362,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
+ 			rcu_read_lock();
+ 			sem_lock_and_putref(sma);
+ 			if (sma->sem_perm.deleted) {
+-				sem_unlock(sma, -1);
+-				rcu_read_unlock();
+ 				err = -EIDRM;
+-				goto out_free;
++				goto out_unlock;
+ 			}
+ 		}
+ 		for (i = 0; i < sma->sem_nsems; i++)
+@@ -1375,8 +1381,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
+ 		struct sem_undo *un;
+ 
+ 		if (!ipc_rcu_getref(sma)) {
+-			rcu_read_unlock();
+-			return -EIDRM;
++			err = -EIDRM;
++			goto out_rcu_wakeup;
+ 		}
+ 		rcu_read_unlock();
+ 
+@@ -1404,10 +1410,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
+ 		rcu_read_lock();
+ 		sem_lock_and_putref(sma);
+ 		if (sma->sem_perm.deleted) {
+-			sem_unlock(sma, -1);
+-			rcu_read_unlock();
+ 			err = -EIDRM;
+-			goto out_free;
++			goto out_unlock;
+ 		}
+ 
+ 		for (i = 0; i < nsems; i++)
+@@ -1431,6 +1435,10 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
+ 		goto out_rcu_wakeup;
+ 
+ 	sem_lock(sma, NULL, -1);
++	if (sma->sem_perm.deleted) {
++		err = -EIDRM;
++		goto out_unlock;
++	}
+ 	curr = &sma->sem_base[semnum];
+ 
+ 	switch (cmd) {
+@@ -1836,6 +1844,10 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
+ 	if (error)
+ 		goto out_rcu_wakeup;
+ 
++	error = -EIDRM;
++	locknum = sem_lock(sma, sops, nsops);
++	if (sma->sem_perm.deleted)
++		goto out_unlock_free;
+ 	/*
+ 	 * semid identifiers are not unique - find_alloc_undo may have
+ 	 * allocated an undo structure, it was invalidated by an RMID
+@@ -1843,8 +1855,6 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
+ 	 * This case can be detected checking un->semid. The existence of
+ 	 * "un" itself is guaranteed by rcu.
+ 	 */
+-	error = -EIDRM;
+-	locknum = sem_lock(sma, sops, nsops);
+ 	if (un && un->semid == -1)
+ 		goto out_unlock_free;
+ 
+@@ -2057,6 +2067,12 @@ void exit_sem(struct task_struct *tsk)
+ 		}
+ 
+ 		sem_lock(sma, NULL, -1);
++		/* exit_sem raced with IPC_RMID, nothing to do */
++		if (sma->sem_perm.deleted) {
++			sem_unlock(sma, -1);
++			rcu_read_unlock();
++			continue;
++		}
+ 		un = __lookup_undo(ulp, semid);
+ 		if (un == NULL) {
+ 			/* exit_sem raced with IPC_RMID+semget() that created
+diff --git a/ipc/util.c b/ipc/util.c
+index fdb8ae74..7684f41b 100644
+--- a/ipc/util.c
++++ b/ipc/util.c
+@@ -17,12 +17,27 @@
+  *            Pavel Emelianov <xemul@××××××.org>
+  *
+  * General sysv ipc locking scheme:
+- *  when doing ipc id lookups, take the ids->rwsem
+- *      rcu_read_lock()
+- *          obtain the ipc object (kern_ipc_perm)
+- *          perform security, capabilities, auditing and permission checks, etc.
+- *          acquire the ipc lock (kern_ipc_perm.lock) throught ipc_lock_object()
+- *             perform data updates (ie: SET, RMID, LOCK/UNLOCK commands)
++ *	rcu_read_lock()
++ *          obtain the ipc object (kern_ipc_perm) by looking up the id in an idr
++ *	    tree.
++ *	    - perform initial checks (capabilities, auditing and permission,
++ *	      etc).
++ *	    - perform read-only operations, such as STAT, INFO commands.
++ *	      acquire the ipc lock (kern_ipc_perm.lock) through
++ *	      ipc_lock_object()
++ *		- perform data updates, such as SET, RMID commands and
++ *		  mechanism-specific operations (semop/semtimedop,
++ *		  msgsnd/msgrcv, shmat/shmdt).
++ *	    drop the ipc lock, through ipc_unlock_object().
++ *	rcu_read_unlock()
++ *
++ *  The ids->rwsem must be taken when:
++ *	- creating, removing and iterating the existing entries in ipc
++ *	  identifier sets.
++ *	- iterating through files under /proc/sysvipc/
++ *
++ *  Note that sems have a special fast path that avoids kern_ipc_perm.lock -
++ *  see sem_lock().
+  */
+ 
+ #include <linux/mm.h>
+diff --git a/ipc/util.h b/ipc/util.h
+index f2f5036f..59d78aa9 100644
+--- a/ipc/util.h
++++ b/ipc/util.h
+@@ -148,9 +148,9 @@ int ipc_parse_version (int *cmd);
+ #endif
+ 
+ extern void free_msg(struct msg_msg *msg);
+-extern struct msg_msg *load_msg(const void __user *src, int len);
++extern struct msg_msg *load_msg(const void __user *src, size_t len);
+ extern struct msg_msg *copy_msg(struct msg_msg *src, struct msg_msg *dst);
+-extern int store_msg(void __user *dest, struct msg_msg *msg, int len);
++extern int store_msg(void __user *dest, struct msg_msg *msg, size_t len);
+ 
+ extern void recompute_msgmni(struct ipc_namespace *);
+ 
+diff --git a/kernel/audit.c b/kernel/audit.c
+index 7b0e23a7..7ddfd8a0 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -613,7 +613,7 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type)
+ 	int rc = 0;
+ 	uid_t uid = from_kuid(&init_user_ns, current_uid());
+ 
+-	if (!audit_enabled) {
++	if (!audit_enabled && msg_type != AUDIT_USER_AVC) {
+ 		*ab = NULL;
+ 		return rc;
+ 	}
+@@ -659,6 +659,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 
+ 	switch (msg_type) {
+ 	case AUDIT_GET:
++		status_set.mask		 = 0;
+ 		status_set.enabled	 = audit_enabled;
+ 		status_set.failure	 = audit_failure;
+ 		status_set.pid		 = audit_pid;
+@@ -670,7 +671,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 				 &status_set, sizeof(status_set));
+ 		break;
+ 	case AUDIT_SET:
+-		if (nlh->nlmsg_len < sizeof(struct audit_status))
++		if (nlmsg_len(nlh) < sizeof(struct audit_status))
+ 			return -EINVAL;
+ 		status_get   = (struct audit_status *)data;
+ 		if (status_get->mask & AUDIT_STATUS_ENABLED) {
+@@ -832,7 +833,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 
+ 		memset(&s, 0, sizeof(s));
+ 		/* guard against past and future API changes */
+-		memcpy(&s, data, min(sizeof(s), (size_t)nlh->nlmsg_len));
++		memcpy(&s, data, min_t(size_t, sizeof(s), nlmsg_len(nlh)));
+ 		if ((s.enabled != 0 && s.enabled != 1) ||
+ 		    (s.log_passwd != 0 && s.log_passwd != 1))
+ 			return -EINVAL;
+@@ -1536,6 +1537,26 @@ void audit_log_name(struct audit_context *context, struct audit_names *n,
+ 		}
+ 	}
+ 
++	/* log the audit_names record type */
++	audit_log_format(ab, " nametype=");
++	switch(n->type) {
++	case AUDIT_TYPE_NORMAL:
++		audit_log_format(ab, "NORMAL");
++		break;
++	case AUDIT_TYPE_PARENT:
++		audit_log_format(ab, "PARENT");
++		break;
++	case AUDIT_TYPE_CHILD_DELETE:
++		audit_log_format(ab, "DELETE");
++		break;
++	case AUDIT_TYPE_CHILD_CREATE:
++		audit_log_format(ab, "CREATE");
++		break;
++	default:
++		audit_log_format(ab, "UNKNOWN");
++		break;
++	}
++
+ 	audit_log_fcaps(ab, n);
+ 	audit_log_end(ab);
+ }
+diff --git a/kernel/audit.h b/kernel/audit.h
+index 1c95131e..123c9b7c 100644
+--- a/kernel/audit.h
++++ b/kernel/audit.h
+@@ -85,6 +85,7 @@ struct audit_names {
+ 
+ 	struct filename		*name;
+ 	int			name_len;	/* number of chars to log */
++	bool			hidden;		/* don't log this record */
+ 	bool			name_put;	/* call __putname()? */
+ 
+ 	unsigned long		ino;
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index 3c8a6013..9845cb32 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -1399,8 +1399,11 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
+ 	}
+ 
+ 	i = 0;
+-	list_for_each_entry(n, &context->names_list, list)
++	list_for_each_entry(n, &context->names_list, list) {
++		if (n->hidden)
++			continue;
+ 		audit_log_name(context, n, NULL, i++, &call_panic);
++	}
+ 
+ 	/* Send end of event record to help user space know we are finished */
+ 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
+@@ -1769,14 +1772,15 @@ void audit_putname(struct filename *name)
+  * __audit_inode - store the inode and device from a lookup
+  * @name: name being audited
+  * @dentry: dentry being audited
+- * @parent: does this dentry represent the parent?
++ * @flags: attributes for this particular entry
+  */
+ void __audit_inode(struct filename *name, const struct dentry *dentry,
+-		   unsigned int parent)
++		   unsigned int flags)
+ {
+ 	struct audit_context *context = current->audit_context;
+ 	const struct inode *inode = dentry->d_inode;
+ 	struct audit_names *n;
++	bool parent = flags & AUDIT_INODE_PARENT;
+ 
+ 	if (!context->in_syscall)
+ 		return;
+@@ -1831,6 +1835,8 @@ out:
+ 	if (parent) {
+ 		n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL;
+ 		n->type = AUDIT_TYPE_PARENT;
++		if (flags & AUDIT_INODE_HIDDEN)
++			n->hidden = true;
+ 	} else {
+ 		n->name_len = AUDIT_NAME_FULL;
+ 		n->type = AUDIT_TYPE_NORMAL;
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index b6b26faf..d0def7fc 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -92,6 +92,14 @@ static DEFINE_MUTEX(cgroup_mutex);
+ static DEFINE_MUTEX(cgroup_root_mutex);
+ 
+ /*
++ * cgroup destruction makes heavy use of work items and there can be a lot
++ * of concurrent destructions.  Use a separate workqueue so that cgroup
++ * destruction work items don't end up filling up max_active of system_wq
++ * which may lead to deadlock.
++ */
++static struct workqueue_struct *cgroup_destroy_wq;
++
++/*
+  * Generate an array of cgroup subsystem pointers. At boot time, this is
+  * populated with the built in subsystems, and modular subsystems are
+  * registered after that. The mutable section of this array is protected by
+@@ -873,7 +881,7 @@ static void cgroup_free_rcu(struct rcu_head *head)
+ {
+ 	struct cgroup *cgrp = container_of(head, struct cgroup, rcu_head);
+ 
+-	schedule_work(&cgrp->free_work);
++	queue_work(cgroup_destroy_wq, &cgrp->free_work);
+ }
+ 
+ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
+@@ -4686,6 +4694,22 @@ out:
+ 	return err;
+ }
+ 
++static int __init cgroup_wq_init(void)
++{
++	/*
++	 * There isn't much point in executing destruction path in
++	 * parallel.  Good chunk is serialized with cgroup_mutex anyway.
++	 * Use 1 for @max_active.
++	 *
++	 * We would prefer to do this in cgroup_init() above, but that
++	 * is called before init_workqueues(): so leave this until after.
++	 */
++	cgroup_destroy_wq = alloc_workqueue("cgroup_destroy", 0, 1);
++	BUG_ON(!cgroup_destroy_wq);
++	return 0;
++}
++core_initcall(cgroup_wq_init);
++
+ /*
+  * proc_cgroup_show()
+  *  - Print task's cgroup paths into seq_file, one line for each hierarchy
+@@ -4996,7 +5020,7 @@ void __css_put(struct cgroup_subsys_state *css)
+ 
+ 	v = css_unbias_refcnt(atomic_dec_return(&css->refcnt));
+ 	if (v == 0)
+-		schedule_work(&css->dput_work);
++		queue_work(cgroup_destroy_wq, &css->dput_work);
+ }
+ EXPORT_SYMBOL_GPL(__css_put);
+ 
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index 6948e947..d313870d 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -984,8 +984,10 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
+ 	need_loop = task_has_mempolicy(tsk) ||
+ 			!nodes_intersects(*newmems, tsk->mems_allowed);
+ 
+-	if (need_loop)
++	if (need_loop) {
++		local_irq_disable();
+ 		write_seqcount_begin(&tsk->mems_allowed_seq);
++	}
+ 
+ 	nodes_or(tsk->mems_allowed, tsk->mems_allowed, *newmems);
+ 	mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP1);
+@@ -993,8 +995,10 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
+ 	mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP2);
+ 	tsk->mems_allowed = *newmems;
+ 
+-	if (need_loop)
++	if (need_loop) {
+ 		write_seqcount_end(&tsk->mems_allowed_seq);
++		local_irq_enable();
++	}
+ 
+ 	task_unlock(tsk);
+ }
+diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
+index 0de28576..91c04f16 100644
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -1398,7 +1398,11 @@ int hibernate_preallocate_memory(void)
+ 	 * highmem and non-highmem zones separately.
+ 	 */
+ 	pages_highmem = preallocate_image_highmem(highmem / 2);
+-	alloc = (count - max_size) - pages_highmem;
++	alloc = count - max_size;
++	if (alloc > pages_highmem)
++		alloc -= pages_highmem;
++	else
++		alloc = 0;
+ 	pages = preallocate_image_memory(alloc, avail_normal);
+ 	if (pages < alloc) {
+ 		/* We have exhausted non-highmem pages, try highmem. */
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index f11d83b1..a8f5084d 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -445,7 +445,7 @@ static int alarm_clock_getres(const clockid_t which_clock, struct timespec *tp)
+ 	clockid_t baseid = alarm_bases[clock2alarm(which_clock)].base_clockid;
+ 
+ 	if (!alarmtimer_get_rtcdev())
+-		return -ENOTSUPP;
++		return -EINVAL;
+ 
+ 	return hrtimer_get_res(baseid, tp);
+ }
+@@ -462,7 +462,7 @@ static int alarm_clock_get(clockid_t which_clock, struct timespec *tp)
+ 	struct alarm_base *base = &alarm_bases[clock2alarm(which_clock)];
+ 
+ 	if (!alarmtimer_get_rtcdev())
+-		return -ENOTSUPP;
++		return -EINVAL;
+ 
+ 	*tp = ktime_to_timespec(base->gettime());
+ 	return 0;
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index f23449d0..331c1021 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -367,9 +367,6 @@ static int remove_ftrace_list_ops(struct ftrace_ops **list,
+ 
+ static int __register_ftrace_function(struct ftrace_ops *ops)
+ {
+-	if (unlikely(ftrace_disabled))
+-		return -ENODEV;
+-
+ 	if (FTRACE_WARN_ON(ops == &global_ops))
+ 		return -EINVAL;
+ 
+@@ -417,9 +414,6 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops)
+ {
+ 	int ret;
+ 
+-	if (ftrace_disabled)
+-		return -ENODEV;
+-
+ 	if (WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED)))
+ 		return -EBUSY;
+ 
+@@ -2048,10 +2042,15 @@ static void ftrace_startup_enable(int command)
+ static int ftrace_startup(struct ftrace_ops *ops, int command)
+ {
+ 	bool hash_enable = true;
++	int ret;
+ 
+ 	if (unlikely(ftrace_disabled))
+ 		return -ENODEV;
+ 
++	ret = __register_ftrace_function(ops);
++	if (ret)
++		return ret;
++
+ 	ftrace_start_up++;
+ 	command |= FTRACE_UPDATE_CALLS;
+ 
+@@ -2073,12 +2072,17 @@ static int ftrace_startup(struct ftrace_ops *ops, int command)
+ 	return 0;
+ }
+ 
+-static void ftrace_shutdown(struct ftrace_ops *ops, int command)
++static int ftrace_shutdown(struct ftrace_ops *ops, int command)
+ {
+ 	bool hash_disable = true;
++	int ret;
+ 
+ 	if (unlikely(ftrace_disabled))
+-		return;
++		return -ENODEV;
++
++	ret = __unregister_ftrace_function(ops);
++	if (ret)
++		return ret;
+ 
+ 	ftrace_start_up--;
+ 	/*
+@@ -2113,9 +2117,10 @@ static void ftrace_shutdown(struct ftrace_ops *ops, int command)
+ 	}
+ 
+ 	if (!command || !ftrace_enabled)
+-		return;
++		return 0;
+ 
+ 	ftrace_run_update_code(command);
++	return 0;
+ }
+ 
+ static void ftrace_startup_sysctl(void)
+@@ -3020,16 +3025,13 @@ static void __enable_ftrace_function_probe(void)
+ 	if (i == FTRACE_FUNC_HASHSIZE)
+ 		return;
+ 
+-	ret = __register_ftrace_function(&trace_probe_ops);
+-	if (!ret)
+-		ret = ftrace_startup(&trace_probe_ops, 0);
++	ret = ftrace_startup(&trace_probe_ops, 0);
+ 
+ 	ftrace_probe_registered = 1;
+ }
+ 
+ static void __disable_ftrace_function_probe(void)
+ {
+-	int ret;
+ 	int i;
+ 
+ 	if (!ftrace_probe_registered)
+@@ -3042,9 +3044,7 @@ static void __disable_ftrace_function_probe(void)
+ 	}
+ 
+ 	/* no more funcs left */
+-	ret = __unregister_ftrace_function(&trace_probe_ops);
+-	if (!ret)
+-		ftrace_shutdown(&trace_probe_ops, 0);
++	ftrace_shutdown(&trace_probe_ops, 0);
+ 
+ 	ftrace_probe_registered = 0;
+ }
+@@ -4241,12 +4241,15 @@ core_initcall(ftrace_nodyn_init);
+ static inline int ftrace_init_dyn_debugfs(struct dentry *d_tracer) { return 0; }
+ static inline void ftrace_startup_enable(int command) { }
+ /* Keep as macros so we do not need to define the commands */
+-# define ftrace_startup(ops, command)			\
+-	({						\
+-		(ops)->flags |= FTRACE_OPS_FL_ENABLED;	\
+-		0;					\
++# define ftrace_startup(ops, command)					\
++	({								\
++		int ___ret = __register_ftrace_function(ops);		\
++		if (!___ret)						\
++			(ops)->flags |= FTRACE_OPS_FL_ENABLED;		\
++		___ret;							\
+ 	})
+-# define ftrace_shutdown(ops, command)	do { } while (0)
++# define ftrace_shutdown(ops, command) __unregister_ftrace_function(ops)
++
+ # define ftrace_startup_sysctl()	do { } while (0)
+ # define ftrace_shutdown_sysctl()	do { } while (0)
+ 
+@@ -4646,9 +4649,7 @@ int register_ftrace_function(struct ftrace_ops *ops)
+ 
+ 	mutex_lock(&ftrace_lock);
+ 
+-	ret = __register_ftrace_function(ops);
+-	if (!ret)
+-		ret = ftrace_startup(ops, 0);
++	ret = ftrace_startup(ops, 0);
+ 
+ 	mutex_unlock(&ftrace_lock);
+ 
+@@ -4667,9 +4668,7 @@ int unregister_ftrace_function(struct ftrace_ops *ops)
+ 	int ret;
+ 
+ 	mutex_lock(&ftrace_lock);
+-	ret = __unregister_ftrace_function(ops);
+-	if (!ret)
+-		ftrace_shutdown(ops, 0);
++	ret = ftrace_shutdown(ops, 0);
+ 	mutex_unlock(&ftrace_lock);
+ 
+ 	return ret;
+@@ -4863,6 +4862,13 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
+ 	return NOTIFY_DONE;
+ }
+ 
++/* Just a place holder for function graph */
++static struct ftrace_ops fgraph_ops __read_mostly = {
++	.func		= ftrace_stub,
++	.flags		= FTRACE_OPS_FL_STUB | FTRACE_OPS_FL_GLOBAL |
++				FTRACE_OPS_FL_RECURSION_SAFE,
++};
++
+ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
+ 			trace_func_graph_ent_t entryfunc)
+ {
+@@ -4889,7 +4895,7 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
+ 	ftrace_graph_return = retfunc;
+ 	ftrace_graph_entry = entryfunc;
+ 
+-	ret = ftrace_startup(&global_ops, FTRACE_START_FUNC_RET);
++	ret = ftrace_startup(&fgraph_ops, FTRACE_START_FUNC_RET);
+ 
+ out:
+ 	mutex_unlock(&ftrace_lock);
+@@ -4906,7 +4912,7 @@ void unregister_ftrace_graph(void)
+ 	ftrace_graph_active--;
+ 	ftrace_graph_return = (trace_func_graph_ret_t)ftrace_stub;
+ 	ftrace_graph_entry = ftrace_graph_entry_stub;
+-	ftrace_shutdown(&global_ops, FTRACE_STOP_FUNC_RET);
++	ftrace_shutdown(&fgraph_ops, FTRACE_STOP_FUNC_RET);
+ 	unregister_pm_notifier(&ftrace_suspend_notifier);
+ 	unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL);
+ 
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index e52d002d..68086a34 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -295,6 +295,9 @@ static DEFINE_HASHTABLE(unbound_pool_hash, UNBOUND_POOL_HASH_ORDER);
+ /* I: attributes used when instantiating standard unbound pools on demand */
+ static struct workqueue_attrs *unbound_std_wq_attrs[NR_STD_WORKER_POOLS];
+ 
++/* I: attributes used when instantiating ordered pools on demand */
++static struct workqueue_attrs *ordered_wq_attrs[NR_STD_WORKER_POOLS];
++
+ struct workqueue_struct *system_wq __read_mostly;
+ EXPORT_SYMBOL(system_wq);
+ struct workqueue_struct *system_highpri_wq __read_mostly;
+@@ -4059,7 +4062,7 @@ out_unlock:
+ static int alloc_and_link_pwqs(struct workqueue_struct *wq)
+ {
+ 	bool highpri = wq->flags & WQ_HIGHPRI;
+-	int cpu;
++	int cpu, ret;
+ 
+ 	if (!(wq->flags & WQ_UNBOUND)) {
+ 		wq->cpu_pwqs = alloc_percpu(struct pool_workqueue);
+@@ -4079,6 +4082,13 @@ static int alloc_and_link_pwqs(struct workqueue_struct *wq)
+ 			mutex_unlock(&wq->mutex);
+ 		}
+ 		return 0;
++	} else if (wq->flags & __WQ_ORDERED) {
++		ret = apply_workqueue_attrs(wq, ordered_wq_attrs[highpri]);
++		/* there should only be single pwq for ordering guarantee */
++		WARN(!ret && (wq->pwqs.next != &wq->dfl_pwq->pwqs_node ||
++			      wq->pwqs.prev != &wq->dfl_pwq->pwqs_node),
++		     "ordering guarantee broken for workqueue %s\n", wq->name);
++		return ret;
+ 	} else {
+ 		return apply_workqueue_attrs(wq, unbound_std_wq_attrs[highpri]);
+ 	}
+@@ -4990,13 +5000,23 @@ static int __init init_workqueues(void)
+ 		}
+ 	}
+ 
+-	/* create default unbound wq attrs */
++	/* create default unbound and ordered wq attrs */
+ 	for (i = 0; i < NR_STD_WORKER_POOLS; i++) {
+ 		struct workqueue_attrs *attrs;
+ 
+ 		BUG_ON(!(attrs = alloc_workqueue_attrs(GFP_KERNEL)));
+ 		attrs->nice = std_nice[i];
+ 		unbound_std_wq_attrs[i] = attrs;
++
++		/*
++		 * An ordered wq should have only one pwq as ordering is
++		 * guaranteed by max_active which is enforced by pwqs.
++		 * Turn off NUMA so that dfl_pwq is used for all nodes.
++		 */
++		BUG_ON(!(attrs = alloc_workqueue_attrs(GFP_KERNEL)));
++		attrs->nice = std_nice[i];
++		attrs->no_numa = true;
++		ordered_wq_attrs[i] = attrs;
+ 	}
+ 
+ 	system_wq = alloc_workqueue("events", 0, 0);
+diff --git a/lib/vsprintf.c b/lib/vsprintf.c
+index e149c641..620fae4c 100644
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -26,6 +26,7 @@
+ #include <linux/math64.h>
+ #include <linux/uaccess.h>
+ #include <linux/ioport.h>
++#include <linux/cred.h>
+ #include <net/addrconf.h>
+ 
+ #include <asm/page.h>		/* for PAGE_SIZE */
+@@ -1118,11 +1119,37 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
+ 				spec.field_width = default_width;
+ 			return string(buf, end, "pK-error", spec);
+ 		}
+-		if (!((kptr_restrict == 0) ||
+-		      (kptr_restrict == 1 &&
+-		       has_capability_noaudit(current, CAP_SYSLOG))))
++
++		switch (kptr_restrict) {
++		case 0:
++			/* Always print %pK values */
++			break;
++		case 1: {
++			/*
++			 * Only print the real pointer value if the current
++			 * process has CAP_SYSLOG and is running with the
++			 * same credentials it started with. This is because
++			 * access to files is checked at open() time, but %pK
++			 * checks permission at read() time. We don't want to
++			 * leak pointer values if a binary opens a file using
++			 * %pK and then elevates privileges before reading it.
++			 */
++			const struct cred *cred = current_cred();
++
++			if (!has_capability_noaudit(current, CAP_SYSLOG) ||
++			    !uid_eq(cred->euid, cred->uid) ||
++			    !gid_eq(cred->egid, cred->gid))
++				ptr = NULL;
++			break;
++		}
++		case 2:
++		default:
++			/* Always print 0's for %pK */
+ 			ptr = NULL;
++			break;
++		}
+ 		break;
++
+ 	case 'N':
+ 		switch (fmt[1]) {
+ 		case 'F':
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 8d25fdc6..8f87b14c 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1853,7 +1853,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ 	struct vm_area_struct *vma;
+ 	struct vm_unmapped_area_info info;
+ 
+-	if (len > TASK_SIZE)
++	if (len > TASK_SIZE - mmap_min_addr)
+ 		return -ENOMEM;
+ 
+ 	if (flags & MAP_FIXED)
+@@ -1862,7 +1862,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+-		if (TASK_SIZE - len >= addr &&
++		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
+ 		    (!vma || addr + len <= vma->vm_start))
+ 			return addr;
+ 	}
+@@ -1901,7 +1901,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 	struct vm_unmapped_area_info info;
+ 
+ 	/* requested length too big for entire address space */
+-	if (len > TASK_SIZE)
++	if (len > TASK_SIZE - mmap_min_addr)
+ 		return -ENOMEM;
+ 
+ 	if (flags & MAP_FIXED)
+@@ -1911,14 +1911,14 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+-		if (TASK_SIZE - len >= addr &&
++		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
+ 				(!vma || addr + len <= vma->vm_start))
+ 			return addr;
+ 	}
+ 
+ 	info.flags = VM_UNMAPPED_AREA_TOPDOWN;
+ 	info.length = len;
+-	info.low_limit = PAGE_SIZE;
++	info.low_limit = max(PAGE_SIZE, mmap_min_addr);
+ 	info.high_limit = mm->mmap_base;
+ 	info.align_mask = 0;
+ 	addr = vm_unmapped_area(&info);
+diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
+index e1c26b10..990afab2 100644
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -577,6 +577,10 @@ static int p9_virtio_probe(struct virtio_device *vdev)
+ 	mutex_lock(&virtio_9p_lock);
+ 	list_add_tail(&chan->chan_list, &virtio_chan_list);
+ 	mutex_unlock(&virtio_9p_lock);
++
++	/* Let udev rules use the new mount_tag attribute. */
++	kobject_uevent(&(vdev->dev.kobj), KOBJ_CHANGE);
++
+ 	return 0;
+ 
+ out_free_tag:
+@@ -654,6 +658,7 @@ static void p9_virtio_remove(struct virtio_device *vdev)
+ 	list_del(&chan->chan_list);
+ 	mutex_unlock(&virtio_9p_lock);
+ 	sysfs_remove_file(&(vdev->dev.kobj), &dev_attr_mount_tag.attr);
++	kobject_uevent(&(vdev->dev.kobj), KOBJ_CHANGE);
+ 	kfree(chan->tag);
+ 	kfree(chan->vc_wq);
+ 	kfree(chan);
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index fd99ea49..81019ee3 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -253,10 +253,10 @@ void __cfg80211_sched_scan_results(struct work_struct *wk)
+ 	rdev = container_of(wk, struct cfg80211_registered_device,
+ 			    sched_scan_results_wk);
+ 
+-	request = rdev->sched_scan_req;
+-
+ 	mutex_lock(&rdev->sched_scan_mtx);
+ 
++	request = rdev->sched_scan_req;
++
+ 	/* we don't have sched_scan_req anymore if the scan is stopping */
+ 	if (request) {
+ 		if (request->flags & NL80211_SCAN_FLAG_FLUSH) {
+diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
+index da4b8b23..6235d052 100644
+--- a/security/selinux/netlabel.c
++++ b/security/selinux/netlabel.c
+@@ -442,8 +442,7 @@ int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
+ 	    sksec->nlbl_state != NLBL_CONNLABELED)
+ 		return 0;
+ 
+-	local_bh_disable();
+-	bh_lock_sock_nested(sk);
++	lock_sock(sk);
+ 
+ 	/* connected sockets are allowed to disconnect when the address family
+ 	 * is set to AF_UNSPEC, if that is what is happening we want to reset
+@@ -464,7 +463,6 @@ int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
+ 		sksec->nlbl_state = NLBL_CONNLABELED;
+ 
+ socket_connect_return:
+-	bh_unlock_sock(sk);
+-	local_bh_enable();
++	release_sock(sk);
+ 	return rc;
+ }
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 26ed56f0..79750313 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -2445,12 +2445,8 @@ static int create_out_jack_modes(struct hda_codec *codec, int num_pins,
+ 
+ 	for (i = 0; i < num_pins; i++) {
+ 		hda_nid_t pin = pins[i];
+-		if (pin == spec->hp_mic_pin) {
+-			int ret = create_hp_mic_jack_mode(codec, pin);
+-			if (ret < 0)
+-				return ret;
++		if (pin == spec->hp_mic_pin)
+ 			continue;
+-		}
+ 		if (get_out_jack_num_items(codec, pin) > 1) {
+ 			struct snd_kcontrol_new *knew;
+ 			char name[44];
+@@ -2703,7 +2699,7 @@ static int hp_mic_jack_mode_put(struct snd_kcontrol *kcontrol,
+ 			val &= ~(AC_PINCTL_VREFEN | PIN_HP);
+ 			val |= get_vref_idx(vref_caps, idx) | PIN_IN;
+ 		} else
+-			val = snd_hda_get_default_vref(codec, nid);
++			val = snd_hda_get_default_vref(codec, nid) | PIN_IN;
+ 	}
+ 	snd_hda_set_pin_ctl_cache(codec, nid, val);
+ 	call_hp_automute(codec, NULL);
+@@ -2723,9 +2719,6 @@ static int create_hp_mic_jack_mode(struct hda_codec *codec, hda_nid_t pin)
+ 	struct hda_gen_spec *spec = codec->spec;
+ 	struct snd_kcontrol_new *knew;
+ 
+-	if (get_out_jack_num_items(codec, pin) <= 1 &&
+-	    get_in_jack_num_items(codec, pin) <= 1)
+-		return 0; /* no need */
+ 	knew = snd_hda_gen_add_kctl(spec, "Headphone Mic Jack Mode",
+ 				    &hp_mic_jack_mode_enum);
+ 	if (!knew)
+@@ -2754,6 +2747,42 @@ static int add_loopback_list(struct hda_gen_spec *spec, hda_nid_t mix, int idx)
+ 	return 0;
+ }
+ 
++/* return true if either a volume or a mute amp is found for the given
++ * aamix path; the amp has to be either in the mixer node or its direct leaf
++ */
++static bool look_for_mix_leaf_ctls(struct hda_codec *codec, hda_nid_t mix_nid,
++				   hda_nid_t pin, unsigned int *mix_val,
++				   unsigned int *mute_val)
++{
++	int idx, num_conns;
++	const hda_nid_t *list;
++	hda_nid_t nid;
++
++	idx = snd_hda_get_conn_index(codec, mix_nid, pin, true);
++	if (idx < 0)
++		return false;
++
++	*mix_val = *mute_val = 0;
++	if (nid_has_volume(codec, mix_nid, HDA_INPUT))
++		*mix_val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
++	if (nid_has_mute(codec, mix_nid, HDA_INPUT))
++		*mute_val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
++	if (*mix_val && *mute_val)
++		return true;
++
++	/* check leaf node */
++	num_conns = snd_hda_get_conn_list(codec, mix_nid, &list);
++	if (num_conns < idx)
++		return false;
++	nid = list[idx];
++	if (!*mix_val && nid_has_volume(codec, nid, HDA_OUTPUT))
++		*mix_val = HDA_COMPOSE_AMP_VAL(nid, 3, 0, HDA_OUTPUT);
++	if (!*mute_val && nid_has_mute(codec, nid, HDA_OUTPUT))
++		*mute_val = HDA_COMPOSE_AMP_VAL(nid, 3, 0, HDA_OUTPUT);
++
++	return *mix_val || *mute_val;
++}
++
+ /* create input playback/capture controls for the given pin */
+ static int new_analog_input(struct hda_codec *codec, int input_idx,
+ 			    hda_nid_t pin, const char *ctlname, int ctlidx,
+@@ -2761,12 +2790,11 @@ static int new_analog_input(struct hda_codec *codec, int input_idx,
+ {
+ 	struct hda_gen_spec *spec = codec->spec;
+ 	struct nid_path *path;
+-	unsigned int val;
++	unsigned int mix_val, mute_val;
+ 	int err, idx;
+ 
+-	if (!nid_has_volume(codec, mix_nid, HDA_INPUT) &&
+-	    !nid_has_mute(codec, mix_nid, HDA_INPUT))
+-		return 0; /* no need for analog loopback */
++	if (!look_for_mix_leaf_ctls(codec, mix_nid, pin, &mix_val, &mute_val))
++		return 0;
+ 
+ 	path = snd_hda_add_new_path(codec, pin, mix_nid, 0);
+ 	if (!path)
+@@ -2775,20 +2803,18 @@ static int new_analog_input(struct hda_codec *codec, int input_idx,
+ 	spec->loopback_paths[input_idx] = snd_hda_get_path_idx(codec, path);
+ 
+ 	idx = path->idx[path->depth - 1];
+-	if (nid_has_volume(codec, mix_nid, HDA_INPUT)) {
+-		val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
+-		err = __add_pb_vol_ctrl(spec, HDA_CTL_WIDGET_VOL, ctlname, ctlidx, val);
++	if (mix_val) {
++		err = __add_pb_vol_ctrl(spec, HDA_CTL_WIDGET_VOL, ctlname, ctlidx, mix_val);
+ 		if (err < 0)
+ 			return err;
+-		path->ctls[NID_PATH_VOL_CTL] = val;
++		path->ctls[NID_PATH_VOL_CTL] = mix_val;
+ 	}
+ 
+-	if (nid_has_mute(codec, mix_nid, HDA_INPUT)) {
+-		val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
+-		err = __add_pb_sw_ctrl(spec, HDA_CTL_WIDGET_MUTE, ctlname, ctlidx, val);
++	if (mute_val) {
++		err = __add_pb_sw_ctrl(spec, HDA_CTL_WIDGET_MUTE, ctlname, ctlidx, mute_val);
+ 		if (err < 0)
+ 			return err;
+-		path->ctls[NID_PATH_MUTE_CTL] = val;
++		path->ctls[NID_PATH_MUTE_CTL] = mute_val;
+ 	}
+ 
+ 	path->active = true;
+@@ -4287,6 +4313,17 @@ int snd_hda_gen_parse_auto_config(struct hda_codec *codec,
+ 	if (err < 0)
+ 		return err;
+ 
++	/* create "Headphone Mic Jack Mode" if no input selection is
++	 * available (or user specifies add_jack_modes hint)
++	 */
++	if (spec->hp_mic_pin &&
++	    (spec->auto_mic || spec->input_mux.num_items == 1 ||
++	     spec->add_jack_modes)) {
++		err = create_hp_mic_jack_mode(codec, spec->hp_mic_pin);
++		if (err < 0)
++			return err;
++	}
++
+ 	if (spec->add_jack_modes) {
+ 		if (cfg->line_out_type != AUTO_PIN_SPEAKER_OUT) {
+ 			err = create_out_jack_modes(codec, cfg->line_outs,
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 8bce0445..661afe7d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1765,6 +1765,7 @@ enum {
+ 	ALC889_FIXUP_IMAC91_VREF,
+ 	ALC882_FIXUP_INV_DMIC,
+ 	ALC882_FIXUP_NO_PRIMARY_HP,
++	ALC887_FIXUP_ASUS_BASS,
+ };
+ 
+ static void alc889_fixup_coef(struct hda_codec *codec,
+@@ -2086,6 +2087,13 @@ static const struct hda_fixup alc882_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc882_fixup_no_primary_hp,
+ 	},
++	[ALC887_FIXUP_ASUS_BASS] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{0x16, 0x99130130}, /* bass speaker */
++			{}
++		},
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+@@ -2119,6 +2127,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x1873, "ASUS W90V", ALC882_FIXUP_ASUS_W90V),
+ 	SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC),
+ 	SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
++	SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
+ 	SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
+ 	SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
+ 	SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
+@@ -4494,6 +4503,7 @@ static int patch_alc662(struct hda_codec *codec)
+ 		case 0x10ec0272:
+ 		case 0x10ec0663:
+ 		case 0x10ec0665:
++		case 0x10ec0668:
+ 			set_beep_amp(spec, 0x0b, 0x04, HDA_INPUT);
+ 			break;
+ 		case 0x10ec0273:
+@@ -4551,6 +4561,7 @@ static int patch_alc680(struct hda_codec *codec)
+  */
+ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
+ 	{ .id = 0x10ec0221, .name = "ALC221", .patch = patch_alc269 },
++	{ .id = 0x10ec0231, .name = "ALC231", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0233, .name = "ALC233", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0255, .name = "ALC255", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0260, .name = "ALC260", .patch = patch_alc260 },
+diff --git a/sound/soc/blackfin/bf5xx-i2s.c b/sound/soc/blackfin/bf5xx-i2s.c
+index dd0c2a4f..e0869aaa 100644
+--- a/sound/soc/blackfin/bf5xx-i2s.c
++++ b/sound/soc/blackfin/bf5xx-i2s.c
+@@ -111,6 +111,7 @@ static int bf5xx_i2s_hw_params(struct snd_pcm_substream *substream,
+ 		bf5xx_i2s->tcr2 |= 7;
+ 		bf5xx_i2s->rcr2 |= 7;
+ 		sport_handle->wdsize = 1;
++		break;
+ 	case SNDRV_PCM_FORMAT_S16_LE:
+ 		bf5xx_i2s->tcr2 |= 15;
+ 		bf5xx_i2s->rcr2 |= 15;
+diff --git a/sound/soc/codecs/ak4642.c b/sound/soc/codecs/ak4642.c
+index 2d037870..687565d0 100644
+--- a/sound/soc/codecs/ak4642.c
++++ b/sound/soc/codecs/ak4642.c
+@@ -257,7 +257,7 @@ static int ak4642_dai_startup(struct snd_pcm_substream *substream,
+ 		 * This operation came from example code of
+ 		 * "ASAHI KASEI AK4642" (japanese) manual p94.
+ 		 */
+-		snd_soc_write(codec, SG_SL1, PMMP | MGAIN0);
++		snd_soc_update_bits(codec, SG_SL1, PMMP | MGAIN0, PMMP | MGAIN0);
+ 		snd_soc_write(codec, TIMER, ZTM(0x3) | WTM(0x3));
+ 		snd_soc_write(codec, ALC_CTL1, ALC | LMTH0);
+ 		snd_soc_update_bits(codec, PW_MGMT1, PMADL, PMADL);
+diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c
+index 389f2325..663a2a74 100644
+--- a/sound/soc/codecs/arizona.c
++++ b/sound/soc/codecs/arizona.c
+@@ -1455,6 +1455,8 @@ static void arizona_enable_fll(struct arizona_fll *fll,
+ 	try_wait_for_completion(&fll->ok);
+ 
+ 	regmap_update_bits(arizona->regmap, fll->base + 1,
++			   ARIZONA_FLL1_FREERUN, 0);
++	regmap_update_bits(arizona->regmap, fll->base + 1,
+ 			   ARIZONA_FLL1_ENA, ARIZONA_FLL1_ENA);
+ 	if (fll->ref_src >= 0 && fll->sync_src >= 0 &&
+ 	    fll->ref_src != fll->sync_src)
+@@ -1473,6 +1475,8 @@ static void arizona_disable_fll(struct arizona_fll *fll)
+ 	struct arizona *arizona = fll->arizona;
+ 	bool change;
+ 
++	regmap_update_bits(arizona->regmap, fll->base + 1,
++			   ARIZONA_FLL1_FREERUN, ARIZONA_FLL1_FREERUN);
+ 	regmap_update_bits_check(arizona->regmap, fll->base + 1,
+ 				 ARIZONA_FLL1_ENA, 0, &change);
+ 	regmap_update_bits(arizona->regmap, fll->base + 0x11,
+diff --git a/sound/soc/codecs/cs42l52.h b/sound/soc/codecs/cs42l52.h
+index 4277012c..a935d738 100644
+--- a/sound/soc/codecs/cs42l52.h
++++ b/sound/soc/codecs/cs42l52.h
+@@ -179,7 +179,7 @@
+ #define CS42L52_MICB_CTL			0x11
+ #define	CS42L52_MIC_CTL_MIC_SEL_MASK		0xBF
+ #define	CS42L52_MIC_CTL_MIC_SEL_SHIFT		6
+-#define CS42L52_MIC_CTL_TYPE_MASK		0xDF
++#define CS42L52_MIC_CTL_TYPE_MASK		0x20
+ #define CS42L52_MIC_CTL_TYPE_SHIFT		5
+ 
+ 
+diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
+index 88ad7db5..cd6ed884 100644
+--- a/sound/soc/codecs/wm5110.c
++++ b/sound/soc/codecs/wm5110.c
+@@ -37,6 +37,47 @@ struct wm5110_priv {
+ 	struct arizona_fll fll[2];
+ };
+ 
++static const struct reg_default wm5110_sysclk_revd_patch[] = {
++	{ 0x3093, 0x1001 },
++	{ 0x30E3, 0x1301 },
++	{ 0x3133, 0x1201 },
++	{ 0x3183, 0x1501 },
++	{ 0x31D3, 0x1401 },
++};
++
++static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w,
++			    struct snd_kcontrol *kcontrol, int event)
++{
++	struct snd_soc_codec *codec = w->codec;
++	struct arizona *arizona = dev_get_drvdata(codec->dev->parent);
++	struct regmap *regmap = codec->control_data;
++	const struct reg_default *patch = NULL;
++	int i, patch_size;
++
++	switch (arizona->rev) {
++	case 3:
++		patch = wm5110_sysclk_revd_patch;
++		patch_size = ARRAY_SIZE(wm5110_sysclk_revd_patch);
++		break;
++	default:
++		return 0;
++	}
++
++	switch (event) {
++	case SND_SOC_DAPM_POST_PMU:
++		if (patch)
++			for (i = 0; i < patch_size; i++)
++				regmap_write(regmap, patch[i].reg,
++					     patch[i].def);
++		break;
++
++	default:
++		break;
++	}
++
++	return 0;
++}
++
+ static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
+ static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
+ static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
+@@ -386,7 +427,7 @@ static const struct snd_kcontrol_new wm5110_aec_loopback_mux =
+ 
+ static const struct snd_soc_dapm_widget wm5110_dapm_widgets[] = {
+ SND_SOC_DAPM_SUPPLY("SYSCLK", ARIZONA_SYSTEM_CLOCK_1, ARIZONA_SYSCLK_ENA_SHIFT,
+-		    0, NULL, 0),
++		    0, wm5110_sysclk_ev, SND_SOC_DAPM_POST_PMU),
+ SND_SOC_DAPM_SUPPLY("ASYNCCLK", ARIZONA_ASYNC_CLOCK_1,
+ 		    ARIZONA_ASYNC_CLK_ENA_SHIFT, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY("OPCLK", ARIZONA_OUTPUT_SYSTEM_CLOCK,
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 730dd0c0..e3cd8651 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -3686,6 +3686,8 @@ static int wm8962_i2c_probe(struct i2c_client *i2c,
+ 	if (ret < 0)
+ 		goto err_enable;
+ 
++	regcache_cache_only(wm8962->regmap, true);
++
+ 	/* The drivers should power up as needed */
+ 	regulator_bulk_disable(ARRAY_SIZE(wm8962->supplies), wm8962->supplies);
+ 
+diff --git a/sound/soc/fsl/imx-pcm-fiq.c b/sound/soc/fsl/imx-pcm-fiq.c
+index 670b96b0..dcfd0fae 100644
+--- a/sound/soc/fsl/imx-pcm-fiq.c
++++ b/sound/soc/fsl/imx-pcm-fiq.c
+@@ -42,7 +42,8 @@ struct imx_pcm_runtime_data {
+ 	struct hrtimer hrt;
+ 	int poll_time_ns;
+ 	struct snd_pcm_substream *substream;
+-	atomic_t running;
++	atomic_t playing;
++	atomic_t capturing;
+ };
+ 
+ static enum hrtimer_restart snd_hrtimer_callback(struct hrtimer *hrt)
+@@ -54,7 +55,7 @@ static enum hrtimer_restart snd_hrtimer_callback(struct hrtimer *hrt)
+ 	struct pt_regs regs;
+ 	unsigned long delta;
+ 
+-	if (!atomic_read(&iprtd->running))
++	if (!atomic_read(&iprtd->playing) && !atomic_read(&iprtd->capturing))
+ 		return HRTIMER_NORESTART;
+ 
+ 	get_fiq_regs(&regs);
+@@ -122,7 +123,6 @@ static int snd_imx_pcm_prepare(struct snd_pcm_substream *substream)
+ 	return 0;
+ }
+ 
+-static int fiq_enable;
+ static int imx_pcm_fiq;
+ 
+ static int snd_imx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
+@@ -134,23 +134,27 @@ static int snd_imx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
+ 	case SNDRV_PCM_TRIGGER_START:
+ 	case SNDRV_PCM_TRIGGER_RESUME:
+ 	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+-		atomic_set(&iprtd->running, 1);
++		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
++			atomic_set(&iprtd->playing, 1);
++		else
++			atomic_set(&iprtd->capturing, 1);
+ 		hrtimer_start(&iprtd->hrt, ns_to_ktime(iprtd->poll_time_ns),
+ 		      HRTIMER_MODE_REL);
+-		if (++fiq_enable == 1)
+-			enable_fiq(imx_pcm_fiq);
+-
++		enable_fiq(imx_pcm_fiq);
+ 		break;
+ 
+ 	case SNDRV_PCM_TRIGGER_STOP:
+ 	case SNDRV_PCM_TRIGGER_SUSPEND:
+ 	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+-		atomic_set(&iprtd->running, 0);
+-
+-		if (--fiq_enable == 0)
++		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
++			atomic_set(&iprtd->playing, 0);
++		else
++			atomic_set(&iprtd->capturing, 0);
++		if (!atomic_read(&iprtd->playing) &&
++				!atomic_read(&iprtd->capturing))
+ 			disable_fiq(imx_pcm_fiq);
+-
+ 		break;
++
+ 	default:
+ 		return -EINVAL;
+ 	}
+@@ -198,7 +202,8 @@ static int snd_imx_open(struct snd_pcm_substream *substream)
+ 
+ 	iprtd->substream = substream;
+ 
+-	atomic_set(&iprtd->running, 0);
++	atomic_set(&iprtd->playing, 0);
++	atomic_set(&iprtd->capturing, 0);
+ 	hrtimer_init(&iprtd->hrt, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ 	iprtd->hrt.function = snd_hrtimer_callback;
+ 
+diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
+index 4bf91b09..794bb1a1 100644
+--- a/tools/perf/ui/hist.c
++++ b/tools/perf/ui/hist.c
+@@ -113,7 +113,7 @@ static u64 he_get_##_field(struct hist_entry *he)				\
+ static int hpp__color_##_type(struct perf_hpp *hpp, struct hist_entry *he) 	\
+ {										\
+ 	return __hpp__fmt(hpp, he, he_get_##_field, " %6.2f%%",			\
+-			  (hpp_snprint_fn)percent_color_snprintf, true);	\
++			  percent_color_snprintf, true);			\
+ }
+ 
+ #define __HPP_ENTRY_PERCENT_FN(_type, _field)					\
+diff --git a/tools/perf/util/color.c b/tools/perf/util/color.c
+index 11e46da1..66e44a50 100644
+--- a/tools/perf/util/color.c
++++ b/tools/perf/util/color.c
+@@ -318,8 +318,15 @@ int percent_color_fprintf(FILE *fp, const char *fmt, double percent)
+ 	return r;
+ }
+ 
+-int percent_color_snprintf(char *bf, size_t size, const char *fmt, double percent)
++int percent_color_snprintf(char *bf, size_t size, const char *fmt, ...)
+ {
+-	const char *color = get_percent_color(percent);
++	va_list args;
++	double percent;
++	const char *color;
++
++	va_start(args, fmt);
++	percent = va_arg(args, double);
++	va_end(args);
++	color = get_percent_color(percent);
+ 	return color_snprintf(bf, size, color, fmt, percent);
+ }
+diff --git a/tools/perf/util/color.h b/tools/perf/util/color.h
+index dea082b7..fced3840 100644
+--- a/tools/perf/util/color.h
++++ b/tools/perf/util/color.h
+@@ -39,7 +39,7 @@ int color_fprintf(FILE *fp, const char *color, const char *fmt, ...);
+ int color_snprintf(char *bf, size_t size, const char *color, const char *fmt, ...);
+ int color_fprintf_ln(FILE *fp, const char *color, const char *fmt, ...);
+ int color_fwrite_lines(FILE *fp, const char *color, size_t count, const char *buf);
+-int percent_color_snprintf(char *bf, size_t size, const char *fmt, double percent);
++int percent_color_snprintf(char *bf, size_t size, const char *fmt, ...);
+ int percent_color_fprintf(FILE *fp, const char *fmt, double percent);
+ const char *get_percent_color(double percent);
+