[gentoo-commits] linux-patches r2150 - genpatches-2.6/trunk/3.2

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2012-06-06 00:46:35 +0000 (Wed, 06 Jun 2012)
New Revision: 2150

Added:
   genpatches-2.6/trunk/3.2/1016_linux-3.2.17.patch
   genpatches-2.6/trunk/3.2/1017_linux-3.2.18.patch
   genpatches-2.6/trunk/3.2/1018_linux-3.2.19.patch
Modified:
   genpatches-2.6/trunk/3.2/0000_README
Log:
Linux patches 3.2.17, 3.2.18 and 3.2.19

Modified: genpatches-2.6/trunk/3.2/0000_README
===================================================================
--- genpatches-2.6/trunk/3.2/0000_README	2012-06-06 00:39:15 UTC (rev 2149)
+++ genpatches-2.6/trunk/3.2/0000_README	2012-06-06 00:46:35 UTC (rev 2150)
@@ -104,6 +104,18 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.2.16
 
+Patch:  1016_linux-3.2.17.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.2.17
+
+Patch:  1017_linux-3.2.18.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.2.18
+
+Patch:  1018_linux-3.2.19.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.2.19
+
 Patch:  2300_per-pci-device-msi-irq-listing.patch
 From:   http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=da8d1c8ba4dcb16d60be54b233deca9a7cac98dc
 Desc:   Add a per-pci-device subdirectory in sysfs

Added: genpatches-2.6/trunk/3.2/1016_linux-3.2.17.patch
===================================================================
--- genpatches-2.6/trunk/3.2/1016_linux-3.2.17.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.2/1016_linux-3.2.17.patch	2012-06-06 00:46:35 UTC (rev 2150)
@@ -0,0 +1,5695 @@
+diff --git a/Makefile b/Makefile
+index 3da29cb..4c4efa3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 16
++SUBLEVEL = 17
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index ab3740e..ef642a0 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1155,6 +1155,15 @@ if !MMU
+ source "arch/arm/Kconfig-nommu"
+ endif
+ 
++config ARM_ERRATA_326103
++	bool "ARM errata: FSR write bit incorrect on a SWP to read-only memory"
++	depends on CPU_V6
++	help
++	  Executing a SWP instruction to read-only memory does not set bit 11
++	  of the FSR on the ARM 1136 prior to r1p0. This causes the kernel to
++	  treat the access as a read, preventing a COW from occurring and
++	  causing the faulting task to livelock.
++
+ config ARM_ERRATA_411920
+ 	bool "ARM errata: Invalidation of the Instruction Cache operation can fail"
+ 	depends on CPU_V6 || CPU_V6K
+diff --git a/arch/arm/include/asm/tls.h b/arch/arm/include/asm/tls.h
+index 60843eb..73409e6 100644
+--- a/arch/arm/include/asm/tls.h
++++ b/arch/arm/include/asm/tls.h
+@@ -7,6 +7,8 @@
+ 
+ 	.macro set_tls_v6k, tp, tmp1, tmp2
+ 	mcr	p15, 0, \tp, c13, c0, 3		@ set TLS register
++	mov	\tmp1, #0
++	mcr	p15, 0, \tmp1, c13, c0, 2	@ clear user r/w TLS register
+ 	.endm
+ 
+ 	.macro set_tls_v6, tp, tmp1, tmp2
+@@ -15,6 +17,8 @@
+ 	mov	\tmp2, #0xffff0fff
+ 	tst	\tmp1, #HWCAP_TLS		@ hardware TLS available?
+ 	mcrne	p15, 0, \tp, c13, c0, 3		@ yes, set TLS register
++	movne	\tmp1, #0
++	mcrne	p15, 0, \tmp1, c13, c0, 2	@ clear user r/w TLS register
+ 	streq	\tp, [\tmp2, #-15]		@ set TLS value at 0xffff0ff0
+ 	.endm
+ 
+diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
+index 3efd82c..87c8be5 100644
+--- a/arch/arm/kernel/irq.c
++++ b/arch/arm/kernel/irq.c
+@@ -156,10 +156,10 @@ static bool migrate_one_irq(struct irq_desc *desc)
+ 	}
+ 
+ 	c = irq_data_get_irq_chip(d);
+-	if (c->irq_set_affinity)
+-		c->irq_set_affinity(d, affinity, true);
+-	else
++	if (!c->irq_set_affinity)
+ 		pr_debug("IRQ%u: unable to set affinity\n", d->irq);
++	else if (c->irq_set_affinity(d, affinity, true) == IRQ_SET_MASK_OK && ret)
++		cpumask_copy(d->affinity, affinity);
+ 
+ 	return ret;
+ }
+diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
+index ef5640b..e10e59a 100644
+--- a/arch/arm/kernel/smp.c
++++ b/arch/arm/kernel/smp.c
+@@ -297,8 +297,6 @@ asmlinkage void __cpuinit secondary_start_kernel(void)
+ 	struct mm_struct *mm = &init_mm;
+ 	unsigned int cpu = smp_processor_id();
+ 
+-	printk("CPU%u: Booted secondary processor\n", cpu);
+-
+ 	/*
+ 	 * All kernel threads share the same mm context; grab a
+ 	 * reference and switch to it.
+@@ -310,6 +308,8 @@ asmlinkage void __cpuinit secondary_start_kernel(void)
+ 	enter_lazy_tlb(mm, current);
+ 	local_flush_tlb_all();
+ 
++	printk("CPU%u: Booted secondary processor\n", cpu);
++
+ 	cpu_init();
+ 	preempt_disable();
+ 	trace_hardirqs_off();
+diff --git a/arch/arm/kernel/sys_arm.c b/arch/arm/kernel/sys_arm.c
+index d2b1779..76cbb05 100644
+--- a/arch/arm/kernel/sys_arm.c
++++ b/arch/arm/kernel/sys_arm.c
+@@ -115,7 +115,7 @@ int kernel_execve(const char *filename,
+ 		  "Ir" (THREAD_START_SP - sizeof(regs)),
+ 		  "r" (&regs),
+ 		  "Ir" (sizeof(regs))
+-		: "r0", "r1", "r2", "r3", "ip", "lr", "memory");
++		: "r0", "r1", "r2", "r3", "r8", "r9", "ip", "lr", "memory");
+ 
+  out:
+ 	return ret;
+diff --git a/arch/arm/mach-omap1/timer.c b/arch/arm/mach-omap1/timer.c
+index 6e90665..fb202af 100644
+--- a/arch/arm/mach-omap1/timer.c
++++ b/arch/arm/mach-omap1/timer.c
+@@ -47,9 +47,9 @@ static int omap1_dm_timer_set_src(struct platform_device *pdev,
+ 	int n = (pdev->id - 1) << 1;
+ 	u32 l;
+ 
+-	l = __raw_readl(MOD_CONF_CTRL_1) & ~(0x03 << n);
++	l = omap_readl(MOD_CONF_CTRL_1) & ~(0x03 << n);
+ 	l |= source << n;
+-	__raw_writel(l, MOD_CONF_CTRL_1);
++	omap_writel(l, MOD_CONF_CTRL_1);
+ 
+ 	return 0;
+ }
+diff --git a/arch/arm/mm/abort-ev6.S b/arch/arm/mm/abort-ev6.S
+index ff1f7cc..8074199 100644
+--- a/arch/arm/mm/abort-ev6.S
++++ b/arch/arm/mm/abort-ev6.S
+@@ -26,18 +26,23 @@ ENTRY(v6_early_abort)
+ 	mrc	p15, 0, r1, c5, c0, 0		@ get FSR
+ 	mrc	p15, 0, r0, c6, c0, 0		@ get FAR
+ /*
+- * Faulty SWP instruction on 1136 doesn't set bit 11 in DFSR (erratum 326103).
+- * The test below covers all the write situations, including Java bytecodes
++ * Faulty SWP instruction on 1136 doesn't set bit 11 in DFSR.
+  */
+-	bic	r1, r1, #1 << 11		@ clear bit 11 of FSR
++#ifdef CONFIG_ARM_ERRATA_326103
++	ldr	ip, =0x4107b36
++	mrc	p15, 0, r3, c0, c0, 0		@ get processor id
++	teq	ip, r3, lsr #4			@ r0 ARM1136?
++	bne	do_DataAbort
+ 	tst	r5, #PSR_J_BIT			@ Java?
++	tsteq	r5, #PSR_T_BIT			@ Thumb?
+ 	bne	do_DataAbort
+-	do_thumb_abort fsr=r1, pc=r4, psr=r5, tmp=r3
+-	ldreq	r3, [r4]			@ read aborted ARM instruction
++	bic	r1, r1, #1 << 11		@ clear bit 11 of FSR
++	ldr	r3, [r4]			@ read aborted ARM instruction
+ #ifdef CONFIG_CPU_ENDIAN_BE8
+-	reveq	r3, r3
++	rev	r3, r3
+ #endif
+ 	do_ldrd_abort tmp=ip, insn=r3
+ 	tst	r3, #1 << 20			@ L = 0 -> write
+ 	orreq	r1, r1, #1 << 11		@ yes.
++#endif
+ 	b	do_DataAbort
+diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
+index b1e192b..db7bcc0 100644
+--- a/arch/arm/mm/cache-l2x0.c
++++ b/arch/arm/mm/cache-l2x0.c
+@@ -32,6 +32,7 @@ static void __iomem *l2x0_base;
+ static DEFINE_RAW_SPINLOCK(l2x0_lock);
+ static uint32_t l2x0_way_mask;	/* Bitmask of active ways */
+ static uint32_t l2x0_size;
++static unsigned long sync_reg_offset = L2X0_CACHE_SYNC;
+ 
+ struct l2x0_regs l2x0_saved_regs;
+ 
+@@ -61,12 +62,7 @@ static inline void cache_sync(void)
+ {
+ 	void __iomem *base = l2x0_base;
+ 
+-#ifdef CONFIG_PL310_ERRATA_753970
+-	/* write to an unmmapped register */
+-	writel_relaxed(0, base + L2X0_DUMMY_REG);
+-#else
+-	writel_relaxed(0, base + L2X0_CACHE_SYNC);
+-#endif
++	writel_relaxed(0, base + sync_reg_offset);
+ 	cache_wait(base + L2X0_CACHE_SYNC, 1);
+ }
+ 
+@@ -85,10 +81,13 @@ static inline void l2x0_inv_line(unsigned long addr)
+ }
+ 
+ #if defined(CONFIG_PL310_ERRATA_588369) || defined(CONFIG_PL310_ERRATA_727915)
++static inline void debug_writel(unsigned long val)
++{
++	if (outer_cache.set_debug)
++		outer_cache.set_debug(val);
++}
+ 
+-#define debug_writel(val)	outer_cache.set_debug(val)
+-
+-static void l2x0_set_debug(unsigned long val)
++static void pl310_set_debug(unsigned long val)
+ {
+ 	writel_relaxed(val, l2x0_base + L2X0_DEBUG_CTRL);
+ }
+@@ -98,7 +97,7 @@ static inline void debug_writel(unsigned long val)
+ {
+ }
+ 
+-#define l2x0_set_debug	NULL
++#define pl310_set_debug	NULL
+ #endif
+ 
+ #ifdef CONFIG_PL310_ERRATA_588369
+@@ -331,6 +330,11 @@ void __init l2x0_init(void __iomem *base, __u32 aux_val, __u32 aux_mask)
+ 		else
+ 			ways = 8;
+ 		type = "L310";
++#ifdef CONFIG_PL310_ERRATA_753970
++		/* Unmapped register. */
++		sync_reg_offset = L2X0_DUMMY_REG;
++#endif
++		outer_cache.set_debug = pl310_set_debug;
+ 		break;
+ 	case L2X0_CACHE_ID_PART_L210:
+ 		ways = (aux >> 13) & 0xf;
+@@ -379,7 +383,6 @@ void __init l2x0_init(void __iomem *base, __u32 aux_val, __u32 aux_mask)
+ 	outer_cache.flush_all = l2x0_flush_all;
+ 	outer_cache.inv_all = l2x0_inv_all;
+ 	outer_cache.disable = l2x0_disable;
+-	outer_cache.set_debug = l2x0_set_debug;
+ 
+ 	printk(KERN_INFO "%s cache controller enabled\n", type);
+ 	printk(KERN_INFO "l2x0: %d ways, CACHE_ID 0x%08x, AUX_CTRL 0x%08x, Cache size: %d B\n",
+diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
+index 89bbf4e..e77f4e4 100644
+--- a/arch/x86/boot/compressed/relocs.c
++++ b/arch/x86/boot/compressed/relocs.c
+@@ -402,13 +402,11 @@ static void print_absolute_symbols(void)
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		char *sym_strtab;
+-		Elf32_Sym *sh_symtab;
+ 		int j;
+ 
+ 		if (sec->shdr.sh_type != SHT_SYMTAB) {
+ 			continue;
+ 		}
+-		sh_symtab = sec->symtab;
+ 		sym_strtab = sec->link->strtab;
+ 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Sym); j++) {
+ 			Elf32_Sym *sym;
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index f98d84c..c4e3581 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1577,9 +1577,11 @@ static int __init apic_verify(void)
+ 	mp_lapic_addr = APIC_DEFAULT_PHYS_BASE;
+ 
+ 	/* The BIOS may have set up the APIC at some other address */
+-	rdmsr(MSR_IA32_APICBASE, l, h);
+-	if (l & MSR_IA32_APICBASE_ENABLE)
+-		mp_lapic_addr = l & MSR_IA32_APICBASE_BASE;
++	if (boot_cpu_data.x86 >= 6) {
++		rdmsr(MSR_IA32_APICBASE, l, h);
++		if (l & MSR_IA32_APICBASE_ENABLE)
++			mp_lapic_addr = l & MSR_IA32_APICBASE_BASE;
++	}
+ 
+ 	pr_info("Found and enabled local APIC!\n");
+ 	return 0;
+@@ -1597,13 +1599,15 @@ int __init apic_force_enable(unsigned long addr)
+ 	 * MSR. This can only be done in software for Intel P6 or later
+ 	 * and AMD K7 (Model > 1) or later.
+ 	 */
+-	rdmsr(MSR_IA32_APICBASE, l, h);
+-	if (!(l & MSR_IA32_APICBASE_ENABLE)) {
+-		pr_info("Local APIC disabled by BIOS -- reenabling.\n");
+-		l &= ~MSR_IA32_APICBASE_BASE;
+-		l |= MSR_IA32_APICBASE_ENABLE | addr;
+-		wrmsr(MSR_IA32_APICBASE, l, h);
+-		enabled_via_apicbase = 1;
++	if (boot_cpu_data.x86 >= 6) {
++		rdmsr(MSR_IA32_APICBASE, l, h);
++		if (!(l & MSR_IA32_APICBASE_ENABLE)) {
++			pr_info("Local APIC disabled by BIOS -- reenabling.\n");
++			l &= ~MSR_IA32_APICBASE_BASE;
++			l |= MSR_IA32_APICBASE_ENABLE | addr;
++			wrmsr(MSR_IA32_APICBASE, l, h);
++			enabled_via_apicbase = 1;
++		}
+ 	}
+ 	return apic_verify();
+ }
+@@ -2149,10 +2153,12 @@ static void lapic_resume(void)
+ 		 * FIXME! This will be wrong if we ever support suspend on
+ 		 * SMP! We'll need to do this as part of the CPU restore!
+ 		 */
+-		rdmsr(MSR_IA32_APICBASE, l, h);
+-		l &= ~MSR_IA32_APICBASE_BASE;
+-		l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr;
+-		wrmsr(MSR_IA32_APICBASE, l, h);
++		if (boot_cpu_data.x86 >= 6) {
++			rdmsr(MSR_IA32_APICBASE, l, h);
++			l &= ~MSR_IA32_APICBASE_BASE;
++			l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr;
++			wrmsr(MSR_IA32_APICBASE, l, h);
++		}
+ 	}
+ 
+ 	maxlvt = lapic_get_maxlvt();
+diff --git a/arch/x86/kernel/microcode_core.c b/arch/x86/kernel/microcode_core.c
+index 9d46f5e..563a09d 100644
+--- a/arch/x86/kernel/microcode_core.c
++++ b/arch/x86/kernel/microcode_core.c
+@@ -418,10 +418,8 @@ static int mc_sysdev_add(struct sys_device *sys_dev)
+ 	if (err)
+ 		return err;
+ 
+-	if (microcode_init_cpu(cpu) == UCODE_ERROR) {
+-		sysfs_remove_group(&sys_dev->kobj, &mc_attr_group);
++	if (microcode_init_cpu(cpu) == UCODE_ERROR)
+ 		return -EINVAL;
+-	}
+ 
+ 	return err;
+ }
+diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
+index 71f4727..5a98aa2 100644
+--- a/arch/x86/kernel/setup_percpu.c
++++ b/arch/x86/kernel/setup_percpu.c
+@@ -185,10 +185,22 @@ void __init setup_per_cpu_areas(void)
+ #endif
+ 	rc = -EINVAL;
+ 	if (pcpu_chosen_fc != PCPU_FC_PAGE) {
+-		const size_t atom_size = cpu_has_pse ? PMD_SIZE : PAGE_SIZE;
+ 		const size_t dyn_size = PERCPU_MODULE_RESERVE +
+ 			PERCPU_DYNAMIC_RESERVE - PERCPU_FIRST_CHUNK_RESERVE;
++		size_t atom_size;
+ 
++		/*
++		 * On 64bit, use PMD_SIZE for atom_size so that embedded
++		 * percpu areas are aligned to PMD.  This, in the future,
++		 * can also allow using PMD mappings in vmalloc area.  Use
++		 * PAGE_SIZE on 32bit as vmalloc space is highly contended
++		 * and large vmalloc area allocs can easily fail.
++		 */
++#ifdef CONFIG_X86_64
++		atom_size = PMD_SIZE;
++#else
++		atom_size = PAGE_SIZE;
++#endif
+ 		rc = pcpu_embed_first_chunk(PERCPU_FIRST_CHUNK_RESERVE,
+ 					    dyn_size, atom_size,
+ 					    pcpu_cpu_distance,
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index 1f92865..e7c920b 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -62,6 +62,7 @@
+ #include <asm/reboot.h>
+ #include <asm/stackprotector.h>
+ #include <asm/hypervisor.h>
++#include <asm/pci_x86.h>
+ 
+ #include "xen-ops.h"
+ #include "mmu.h"
+@@ -1278,8 +1279,10 @@ asmlinkage void __init xen_start_kernel(void)
+ 		/* Make sure ACS will be enabled */
+ 		pci_request_acs();
+ 	}
+-		
+-
++#ifdef CONFIG_PCI
++	/* PCI BIOS service won't work from a PV guest. */
++	pci_probe &= ~PCI_PROBE_BIOS;
++#endif
+ 	xen_raw_console_write("about to get started...\n");
+ 
+ 	xen_setup_runstate_info(0);
+diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
+index 87f6673..ec3d603 100644
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -353,8 +353,13 @@ static pteval_t pte_mfn_to_pfn(pteval_t val)
+ {
+ 	if (val & _PAGE_PRESENT) {
+ 		unsigned long mfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
++		unsigned long pfn = mfn_to_pfn(mfn);
++
+ 		pteval_t flags = val & PTE_FLAGS_MASK;
+-		val = ((pteval_t)mfn_to_pfn(mfn) << PAGE_SHIFT) | flags;
++		if (unlikely(pfn == ~0))
++			val = flags & ~_PAGE_PRESENT;
++		else
++			val = ((pteval_t)pfn << PAGE_SHIFT) | flags;
+ 	}
+ 
+ 	return val;
+diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
+index 041d4fe..9a23fff 100644
+--- a/arch/x86/xen/smp.c
++++ b/arch/x86/xen/smp.c
+@@ -172,6 +172,7 @@ static void __init xen_fill_possible_map(void)
+ static void __init xen_filter_cpu_maps(void)
+ {
+ 	int i, rc;
++	unsigned int subtract = 0;
+ 
+ 	if (!xen_initial_domain())
+ 		return;
+@@ -186,8 +187,22 @@ static void __init xen_filter_cpu_maps(void)
+ 		} else {
+ 			set_cpu_possible(i, false);
+ 			set_cpu_present(i, false);
++			subtract++;
+ 		}
+ 	}
++#ifdef CONFIG_HOTPLUG_CPU
++	/* This is akin to using 'nr_cpus' on the Linux command line.
++	 * Which is OK as when we use 'dom0_max_vcpus=X' we can only
++	 * have up to X, while nr_cpu_ids is greater than X. This
++	 * normally is not a problem, except when CPU hotplugging
++	 * is involved and then there might be more than X CPUs
++	 * in the guest - which will not work as there is no
++	 * hypercall to expand the max number of VCPUs an already
++	 * running guest has. So cap it up to X. */
++	if (subtract)
++		nr_cpu_ids = nr_cpu_ids - subtract;
++#endif
++
+ }
+ 
+ static void __init xen_smp_prepare_boot_cpu(void)
+diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S
+index 79d7362..3e45aa0 100644
+--- a/arch/x86/xen/xen-asm.S
++++ b/arch/x86/xen/xen-asm.S
+@@ -96,7 +96,7 @@ ENTRY(xen_restore_fl_direct)
+ 
+ 	/* check for unmasked and pending */
+ 	cmpw $0x0001, PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_pending
+-	jz 1f
++	jnz 1f
+ 2:	call check_events
+ 1:
+ ENDPATCH(xen_restore_fl_direct)
+diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
+index 107f6f7..dd30f40 100644
+--- a/crypto/sha512_generic.c
++++ b/crypto/sha512_generic.c
+@@ -174,7 +174,7 @@ sha512_update(struct shash_desc *desc, const u8 *data, unsigned int len)
+ 	index = sctx->count[0] & 0x7f;
+ 
+ 	/* Update number of bytes */
+-	if (!(sctx->count[0] += len))
++	if ((sctx->count[0] += len) < len)
+ 		sctx->count[1]++;
+ 
+         part_len = 128 - index;
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index a9b2820..58db834 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -3500,7 +3500,8 @@ static int ata_count_probe_trials_cb(struct ata_ering_entry *ent, void *void_arg
+ 	u64 now = get_jiffies_64();
+ 	int *trials = void_arg;
+ 
+-	if (ent->timestamp < now - min(now, interval))
++	if ((ent->eflags & ATA_EFLAG_OLD_ER) ||
++	    (ent->timestamp < now - min(now, interval)))
+ 		return -1;
+ 
+ 	(*trials)++;
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 003cd8d..99fefbd 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -73,6 +73,7 @@ static struct usb_device_id ath3k_table[] = {
+ 	{ USB_DEVICE(0x0CF3, 0x3004) },
+ 	{ USB_DEVICE(0x0CF3, 0x311D) },
+ 	{ USB_DEVICE(0x13d3, 0x3375) },
++	{ USB_DEVICE(0x04CA, 0x3005) },
+ 
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xE02C) },
+@@ -91,6 +92,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ 	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+ 
+ 	{ }	/* Terminating entry */
+ };
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index db44ad5..e56da6a 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -129,6 +129,7 @@ static struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+ 
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
+index a60adbf..79dcf6e 100644
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -239,10 +239,6 @@ static void atc_dostart(struct at_dma_chan *atchan, struct at_desc *first)
+ 
+ 	vdbg_dump_regs(atchan);
+ 
+-	/* clear any pending interrupt */
+-	while (dma_readl(atdma, EBCISR))
+-		cpu_relax();
+-
+ 	channel_writel(atchan, SADDR, 0);
+ 	channel_writel(atchan, DADDR, 0);
+ 	channel_writel(atchan, CTRLA, 0);
+diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
+index b0a8117..0535c21 100644
+--- a/drivers/firmware/efivars.c
++++ b/drivers/firmware/efivars.c
+@@ -191,6 +191,190 @@ utf16_strncmp(const efi_char16_t *a, const efi_char16_t *b, size_t len)
+ 	}
+ }
+ 
++static bool
++validate_device_path(struct efi_variable *var, int match, u8 *buffer,
++		     unsigned long len)
++{
++	struct efi_generic_dev_path *node;
++	int offset = 0;
++
++	node = (struct efi_generic_dev_path *)buffer;
++
++	if (len < sizeof(*node))
++		return false;
++
++	while (offset <= len - sizeof(*node) &&
++	       node->length >= sizeof(*node) &&
++		node->length <= len - offset) {
++		offset += node->length;
++
++		if ((node->type == EFI_DEV_END_PATH ||
++		     node->type == EFI_DEV_END_PATH2) &&
++		    node->sub_type == EFI_DEV_END_ENTIRE)
++			return true;
++
++		node = (struct efi_generic_dev_path *)(buffer + offset);
++	}
++
++	/*
++	 * If we're here then either node->length pointed past the end
++	 * of the buffer or we reached the end of the buffer without
++	 * finding a device path end node.
++	 */
++	return false;
++}
++
++static bool
++validate_boot_order(struct efi_variable *var, int match, u8 *buffer,
++		    unsigned long len)
++{
++	/* An array of 16-bit integers */
++	if ((len % 2) != 0)
++		return false;
++
++	return true;
++}
++
++static bool
++validate_load_option(struct efi_variable *var, int match, u8 *buffer,
++		     unsigned long len)
++{
++	u16 filepathlength;
++	int i, desclength = 0, namelen;
++
++	namelen = utf16_strnlen(var->VariableName, sizeof(var->VariableName));
++
++	/* Either "Boot" or "Driver" followed by four digits of hex */
++	for (i = match; i < match+4; i++) {
++		if (var->VariableName[i] > 127 ||
++		    hex_to_bin(var->VariableName[i] & 0xff) < 0)
++			return true;
++	}
++
++	/* Reject it if there's 4 digits of hex and then further content */
++	if (namelen > match + 4)
++		return false;
++
++	/* A valid entry must be at least 8 bytes */
++	if (len < 8)
++		return false;
++
++	filepathlength = buffer[4] | buffer[5] << 8;
++
++	/*
++	 * There's no stored length for the description, so it has to be
++	 * found by hand
++	 */
++	desclength = utf16_strsize((efi_char16_t *)(buffer + 6), len - 6) + 2;
++
++	/* Each boot entry must have a descriptor */
++	if (!desclength)
++		return false;
++
++	/*
++	 * If the sum of the length of the description, the claimed filepath
++	 * length and the original header are greater than the length of the
++	 * variable, it's malformed
++	 */
++	if ((desclength + filepathlength + 6) > len)
++		return false;
++
++	/*
++	 * And, finally, check the filepath
++	 */
++	return validate_device_path(var, match, buffer + desclength + 6,
++				    filepathlength);
++}
++
++static bool
++validate_uint16(struct efi_variable *var, int match, u8 *buffer,
++		unsigned long len)
++{
++	/* A single 16-bit integer */
++	if (len != 2)
++		return false;
++
++	return true;
++}
++
++static bool
++validate_ascii_string(struct efi_variable *var, int match, u8 *buffer,
++		      unsigned long len)
++{
++	int i;
++
++	for (i = 0; i < len; i++) {
++		if (buffer[i] > 127)
++			return false;
++
++		if (buffer[i] == 0)
++			return true;
++	}
++
++	return false;
++}
++
++struct variable_validate {
++	char *name;
++	bool (*validate)(struct efi_variable *var, int match, u8 *data,
++			 unsigned long len);
++};
++
++static const struct variable_validate variable_validate[] = {
++	{ "BootNext", validate_uint16 },
++	{ "BootOrder", validate_boot_order },
++	{ "DriverOrder", validate_boot_order },
++	{ "Boot*", validate_load_option },
++	{ "Driver*", validate_load_option },
++	{ "ConIn", validate_device_path },
++	{ "ConInDev", validate_device_path },
++	{ "ConOut", validate_device_path },
++	{ "ConOutDev", validate_device_path },
++	{ "ErrOut", validate_device_path },
++	{ "ErrOutDev", validate_device_path },
++	{ "Timeout", validate_uint16 },
++	{ "Lang", validate_ascii_string },
++	{ "PlatformLang", validate_ascii_string },
++	{ "", NULL },
++};
++
++static bool
++validate_var(struct efi_variable *var, u8 *data, unsigned long len)
++{
++	int i;
++	u16 *unicode_name = var->VariableName;
++
++	for (i = 0; variable_validate[i].validate != NULL; i++) {
++		const char *name = variable_validate[i].name;
++		int match;
++
++		for (match = 0; ; match++) {
++			char c = name[match];
++			u16 u = unicode_name[match];
++
++			/* All special variables are plain ascii */
++			if (u > 127)
++				return true;
++
++			/* Wildcard in the matching name means we've matched */
++			if (c == '*')
++				return variable_validate[i].validate(var,
++							     match, data, len);
++
++			/* Case sensitive match */
++			if (c != u)
++				break;
++
++			/* Reached the end of the string while matching */
++			if (!c)
++				return variable_validate[i].validate(var,
++							     match, data, len);
++		}
++	}
++
++	return true;
++}
++
+ static efi_status_t
+ get_var_data_locked(struct efivars *efivars, struct efi_variable *var)
+ {
+@@ -324,6 +508,12 @@ efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count)
+ 		return -EINVAL;
+ 	}
+ 
++	if ((new_var->Attributes & ~EFI_VARIABLE_MASK) != 0 ||
++	    validate_var(new_var, new_var->Data, new_var->DataSize) == false) {
++		printk(KERN_ERR "efivars: Malformed variable content\n");
++		return -EINVAL;
++	}
++
+ 	spin_lock(&efivars->lock);
+ 	status = efivars->ops->set_variable(new_var->VariableName,
+ 					    &new_var->VendorGuid,
+@@ -624,6 +814,12 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
+ 	if (!capable(CAP_SYS_ADMIN))
+ 		return -EACCES;
+ 
++	if ((new_var->Attributes & ~EFI_VARIABLE_MASK) != 0 ||
++	    validate_var(new_var, new_var->Data, new_var->DataSize) == false) {
++		printk(KERN_ERR "efivars: Malformed variable content\n");
++		return -EINVAL;
++	}
++
+ 	spin_lock(&efivars->lock);
+ 
+ 	/*
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index b9da890..a6c2f7a 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -984,6 +984,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
+ 	struct intel_ring_buffer *ring;
+ 	u32 exec_start, exec_len;
+ 	u32 seqno;
++	u32 mask;
+ 	int ret, mode, i;
+ 
+ 	if (!i915_gem_check_execbuffer(args)) {
+@@ -1021,6 +1022,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
+ 	}
+ 
+ 	mode = args->flags & I915_EXEC_CONSTANTS_MASK;
++	mask = I915_EXEC_CONSTANTS_MASK;
+ 	switch (mode) {
+ 	case I915_EXEC_CONSTANTS_REL_GENERAL:
+ 	case I915_EXEC_CONSTANTS_ABSOLUTE:
+@@ -1034,18 +1036,9 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
+ 			    mode == I915_EXEC_CONSTANTS_REL_SURFACE)
+ 				return -EINVAL;
+ 
+-			ret = intel_ring_begin(ring, 4);
+-			if (ret)
+-				return ret;
+-
+-			intel_ring_emit(ring, MI_NOOP);
+-			intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(1));
+-			intel_ring_emit(ring, INSTPM);
+-			intel_ring_emit(ring,
+-					I915_EXEC_CONSTANTS_MASK << 16 | mode);
+-			intel_ring_advance(ring);
+-
+-			dev_priv->relative_constants_mode = mode;
++			/* The HW changed the meaning on this bit on gen6 */
++			if (INTEL_INFO(dev)->gen >= 6)
++				mask &= ~I915_EXEC_CONSTANTS_REL_SURFACE;
+ 		}
+ 		break;
+ 	default:
+@@ -1064,6 +1057,11 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
+ 			return -EINVAL;
+ 		}
+ 
++		if (args->num_cliprects > UINT_MAX / sizeof(*cliprects)) {
++			DRM_DEBUG("execbuf with %u cliprects\n",
++				  args->num_cliprects);
++			return -EINVAL;
++		}
+ 		cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects),
+ 				    GFP_KERNEL);
+ 		if (cliprects == NULL) {
+@@ -1176,6 +1174,21 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
+ 		}
+ 	}
+ 
++	if (ring == &dev_priv->ring[RCS] &&
++	    mode != dev_priv->relative_constants_mode) {
++		ret = intel_ring_begin(ring, 4);
++		if (ret)
++				goto err;
++
++		intel_ring_emit(ring, MI_NOOP);
++		intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(1));
++		intel_ring_emit(ring, INSTPM);
++		intel_ring_emit(ring, mask << 16 | mode);
++		intel_ring_advance(ring);
++
++		dev_priv->relative_constants_mode = mode;
++	}
++
+ 	trace_i915_gem_ring_dispatch(ring, seqno);
+ 
+ 	exec_start = batch_obj->gtt_offset + args->batch_start_offset;
+@@ -1314,7 +1327,8 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
+ 	struct drm_i915_gem_exec_object2 *exec2_list = NULL;
+ 	int ret;
+ 
+-	if (args->buffer_count < 1) {
++	if (args->buffer_count < 1 ||
++	    args->buffer_count > UINT_MAX / sizeof(*exec2_list)) {
+ 		DRM_ERROR("execbuf2 with %d buffers\n", args->buffer_count);
+ 		return -EINVAL;
+ 	}
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 2f99fd4..cbe5a88 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -442,6 +442,7 @@
+ #define   INSTPM_AGPBUSY_DIS (1<<11) /* gen3: when disabled, pending interrupts
+ 					will not assert AGPBUSY# and will only
+ 					be delivered when out of C3. */
++#define   INSTPM_FORCE_ORDERING				(1<<7) /* GEN6+ */
+ #define ACTHD	        0x020c8
+ #define FW_BLC		0x020d8
+ #define FW_BLC2		0x020dc
+@@ -522,6 +523,7 @@
+ #define   CM0_MASK_SHIFT          16
+ #define   CM0_IZ_OPT_DISABLE      (1<<6)
+ #define   CM0_ZR_OPT_DISABLE      (1<<5)
++#define	  CM0_STC_EVICT_DISABLE_LRA_SNB	(1<<5)
+ #define   CM0_DEPTH_EVICT_DISABLE (1<<4)
+ #define   CM0_COLOR_EVICT_DISABLE (1<<3)
+ #define   CM0_DEPTH_WRITE_DISABLE (1<<1)
+diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
+index 64541f7..9cd81ba 100644
+--- a/drivers/gpu/drm/i915/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/intel_hdmi.c
+@@ -136,7 +136,7 @@ static void i9xx_write_infoframe(struct drm_encoder *encoder,
+ 
+ 	val &= ~VIDEO_DIP_SELECT_MASK;
+ 
+-	I915_WRITE(VIDEO_DIP_CTL, val | port | flags);
++	I915_WRITE(VIDEO_DIP_CTL, VIDEO_DIP_ENABLE | val | port | flags);
+ 
+ 	for (i = 0; i < len; i += 4) {
+ 		I915_WRITE(VIDEO_DIP_DATA, *data);
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index 8673581..62f9ac5 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -414,6 +414,22 @@ static int init_render_ring(struct intel_ring_buffer *ring)
+ 			return ret;
+ 	}
+ 
++
++	if (IS_GEN6(dev)) {
++		/* From the Sandybridge PRM, volume 1 part 3, page 24:
++		 * "If this bit is set, STCunit will have LRA as replacement
++		 *  policy. [...] This bit must be reset.  LRA replacement
++		 *  policy is not supported."
++		 */
++		I915_WRITE(CACHE_MODE_0,
++			   CM0_STC_EVICT_DISABLE_LRA_SNB << CM0_MASK_SHIFT);
++	}
++
++	if (INTEL_INFO(dev)->gen >= 6) {
++		I915_WRITE(INSTPM,
++			   INSTPM_FORCE_ORDERING << 16 | INSTPM_FORCE_ORDERING);
++	}
++
+ 	return ret;
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
+index e334ec3..8eddcca 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -731,6 +731,7 @@ static void intel_sdvo_get_dtd_from_mode(struct intel_sdvo_dtd *dtd,
+ 	uint16_t width, height;
+ 	uint16_t h_blank_len, h_sync_len, v_blank_len, v_sync_len;
+ 	uint16_t h_sync_offset, v_sync_offset;
++	int mode_clock;
+ 
+ 	width = mode->crtc_hdisplay;
+ 	height = mode->crtc_vdisplay;
+@@ -745,7 +746,11 @@ static void intel_sdvo_get_dtd_from_mode(struct intel_sdvo_dtd *dtd,
+ 	h_sync_offset = mode->crtc_hsync_start - mode->crtc_hblank_start;
+ 	v_sync_offset = mode->crtc_vsync_start - mode->crtc_vblank_start;
+ 
+-	dtd->part1.clock = mode->clock / 10;
++	mode_clock = mode->clock;
++	mode_clock /= intel_mode_get_pixel_multiplier(mode) ?: 1;
++	mode_clock /= 10;
++	dtd->part1.clock = mode_clock;
++
+ 	dtd->part1.h_active = width & 0xff;
+ 	dtd->part1.h_blank = h_blank_len & 0xff;
+ 	dtd->part1.h_high = (((width >> 8) & 0xf) << 4) |
+@@ -997,7 +1002,7 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
+ 	struct intel_sdvo *intel_sdvo = to_intel_sdvo(encoder);
+ 	u32 sdvox;
+ 	struct intel_sdvo_in_out_map in_out;
+-	struct intel_sdvo_dtd input_dtd;
++	struct intel_sdvo_dtd input_dtd, output_dtd;
+ 	int pixel_multiplier = intel_mode_get_pixel_multiplier(adjusted_mode);
+ 	int rate;
+ 
+@@ -1022,20 +1027,13 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
+ 					  intel_sdvo->attached_output))
+ 		return;
+ 
+-	/* We have tried to get input timing in mode_fixup, and filled into
+-	 * adjusted_mode.
+-	 */
+-	if (intel_sdvo->is_tv || intel_sdvo->is_lvds) {
+-		input_dtd = intel_sdvo->input_dtd;
+-	} else {
+-		/* Set the output timing to the screen */
+-		if (!intel_sdvo_set_target_output(intel_sdvo,
+-						  intel_sdvo->attached_output))
+-			return;
+-
+-		intel_sdvo_get_dtd_from_mode(&input_dtd, adjusted_mode);
+-		(void) intel_sdvo_set_output_timing(intel_sdvo, &input_dtd);
+-	}
++	/* lvds has a special fixed output timing. */
++	if (intel_sdvo->is_lvds)
++		intel_sdvo_get_dtd_from_mode(&output_dtd,
++					     intel_sdvo->sdvo_lvds_fixed_mode);
++	else
++		intel_sdvo_get_dtd_from_mode(&output_dtd, mode);
++	(void) intel_sdvo_set_output_timing(intel_sdvo, &output_dtd);
+ 
+ 	/* Set the input timing to the screen. Assume always input 0. */
+ 	if (!intel_sdvo_set_target_input(intel_sdvo))
+@@ -1053,6 +1051,10 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
+ 	    !intel_sdvo_set_tv_format(intel_sdvo))
+ 		return;
+ 
++	/* We have tried to get input timing in mode_fixup, and filled into
++	 * adjusted_mode.
++	 */
++	intel_sdvo_get_dtd_from_mode(&input_dtd, adjusted_mode);
+ 	(void) intel_sdvo_set_input_timing(intel_sdvo, &input_dtd);
+ 
+ 	switch (pixel_multiplier) {
+@@ -1219,8 +1221,14 @@ static bool intel_sdvo_get_capabilities(struct intel_sdvo *intel_sdvo, struct in
+ 
+ static int intel_sdvo_supports_hotplug(struct intel_sdvo *intel_sdvo)
+ {
++	struct drm_device *dev = intel_sdvo->base.base.dev;
+ 	u8 response[2];
+ 
++	/* HW Erratum: SDVO Hotplug is broken on all i945G chips, there's noise
++	 * on the line. */
++	if (IS_I945G(dev) || IS_I945GM(dev))
++		return false;
++
+ 	return intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_HOT_PLUG_SUPPORT,
+ 				    &response, 2) && response[0];
+ }
+diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
+index 525744d..3df56c7 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
++++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
+@@ -245,7 +245,7 @@ static bool nouveau_dsm_detect(void)
+ 	struct acpi_buffer buffer = {sizeof(acpi_method_name), acpi_method_name};
+ 	struct pci_dev *pdev = NULL;
+ 	int has_dsm = 0;
+-	int has_optimus;
++	int has_optimus = 0;
+ 	int vga_count = 0;
+ 	bool guid_valid;
+ 	int retval;
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index b30081f..757c549 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -917,8 +917,8 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
+ 		break;
+ 	}
+ 
+-	if (radeon_encoder->active_device &
+-	    (ATOM_DEVICE_LCD_SUPPORT | ATOM_DEVICE_DFP_SUPPORT)) {
++	if ((radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT | ATOM_DEVICE_DFP_SUPPORT)) ||
++	    (radeon_encoder_get_dp_bridge_encoder_id(encoder) != ENCODER_OBJECT_ID_NONE)) {
+ 		struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+ 		struct drm_connector *connector =
+ 			radeon_get_connector_for_encoder(encoder);
+diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
+index 104b376..427468f 100644
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -51,7 +51,7 @@ module_param_named(tjmax, force_tjmax, int, 0444);
+ MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
+ 
+ #define BASE_SYSFS_ATTR_NO	2	/* Sysfs Base attr no for coretemp */
+-#define NUM_REAL_CORES		16	/* Number of Real cores per cpu */
++#define NUM_REAL_CORES		32	/* Number of Real cores per cpu */
+ #define CORETEMP_NAME_LENGTH	17	/* String Length of attrs */
+ #define MAX_CORE_ATTRS		4	/* Maximum no of basic attrs */
+ #define TOTAL_ATTRS		(MAX_CORE_ATTRS + 1)
+@@ -705,6 +705,10 @@ static void __cpuinit put_core_offline(unsigned int cpu)
+ 
+ 	indx = TO_ATTR_NO(cpu);
+ 
++	/* The core id is too big, just return */
++	if (indx > MAX_CORE_DATA - 1)
++		return;
++
+ 	if (pdata->core_data[indx] && pdata->core_data[indx]->cpu == cpu)
+ 		coretemp_remove_core(pdata, &pdev->dev, indx);
+ 
+diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c
+index 930370d..9a4c3ab 100644
+--- a/drivers/hwmon/fam15h_power.c
++++ b/drivers/hwmon/fam15h_power.c
+@@ -122,6 +122,41 @@ static bool __devinit fam15h_power_is_internal_node0(struct pci_dev *f4)
+ 	return true;
+ }
+ 
++/*
++ * Newer BKDG versions have an updated recommendation on how to properly
++ * initialize the running average range (was: 0xE, now: 0x9). This avoids
++ * counter saturations resulting in bogus power readings.
++ * We correct this value ourselves to cope with older BIOSes.
++ */
++static DEFINE_PCI_DEVICE_TABLE(affected_device) = {
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
++	{ 0 }
++};
++
++static void __devinit tweak_runavg_range(struct pci_dev *pdev)
++{
++	u32 val;
++
++	/*
++	 * let this quirk apply only to the current version of the
++	 * northbridge, since future versions may change the behavior
++	 */
++	if (!pci_match_id(affected_device, pdev))
++		return;
++
++	pci_bus_read_config_dword(pdev->bus,
++		PCI_DEVFN(PCI_SLOT(pdev->devfn), 5),
++		REG_TDP_RUNNING_AVERAGE, &val);
++	if ((val & 0xf) != 0xe)
++		return;
++
++	val &= ~0xf;
++	val |=  0x9;
++	pci_bus_write_config_dword(pdev->bus,
++		PCI_DEVFN(PCI_SLOT(pdev->devfn), 5),
++		REG_TDP_RUNNING_AVERAGE, val);
++}
++
+ static void __devinit fam15h_power_init_data(struct pci_dev *f4,
+ 					     struct fam15h_power_data *data)
+ {
+@@ -155,6 +190,13 @@ static int __devinit fam15h_power_probe(struct pci_dev *pdev,
+ 	struct device *dev;
+ 	int err;
+ 
++	/*
++	 * though we ignore every other northbridge, we still have to
++	 * do the tweaking on _each_ node in MCM processors as the counters
++	 * are working hand-in-hand
++	 */
++	tweak_runavg_range(pdev);
++
+ 	if (!fam15h_power_is_internal_node0(pdev)) {
+ 		err = -ENODEV;
+ 		goto exit;
+diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c
+index 04be9f8..eb8ad53 100644
+--- a/drivers/i2c/busses/i2c-pnx.c
++++ b/drivers/i2c/busses/i2c-pnx.c
+@@ -546,8 +546,7 @@ static int i2c_pnx_controller_suspend(struct platform_device *pdev,
+ {
+ 	struct i2c_pnx_algo_data *alg_data = platform_get_drvdata(pdev);
+ 
+-	/* FIXME: shouldn't this be clk_disable? */
+-	clk_enable(alg_data->clk);
++	clk_disable(alg_data->clk);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 6f37aa4..065ab4f 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -8100,7 +8100,8 @@ static int md_notify_reboot(struct notifier_block *this,
+ 
+ 	for_each_mddev(mddev, tmp) {
+ 		if (mddev_trylock(mddev)) {
+-			__md_stop_writes(mddev);
++			if (mddev->pers)
++				__md_stop_writes(mddev);
+ 			mddev->safemode = 2;
+ 			mddev_unlock(mddev);
+ 		}
+diff --git a/drivers/media/dvb/frontends/drxk_hard.c b/drivers/media/dvb/frontends/drxk_hard.c
+index f6431ef..a1f5e3d 100644
+--- a/drivers/media/dvb/frontends/drxk_hard.c
++++ b/drivers/media/dvb/frontends/drxk_hard.c
+@@ -1523,8 +1523,10 @@ static int scu_command(struct drxk_state *state,
+ 	dprintk(1, "\n");
+ 
+ 	if ((cmd == 0) || ((parameterLen > 0) && (parameter == NULL)) ||
+-	    ((resultLen > 0) && (result == NULL)))
+-		goto error;
++	    ((resultLen > 0) && (result == NULL))) {
++		printk(KERN_ERR "drxk: Error %d on %s\n", status, __func__);
++		return status;
++	}
+ 
+ 	mutex_lock(&state->mutex);
+ 
+diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c
+index 13f54b5..a7e7d6f 100644
+--- a/drivers/media/rc/winbond-cir.c
++++ b/drivers/media/rc/winbond-cir.c
+@@ -1046,6 +1046,7 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
+ 		goto exit_unregister_led;
+ 	}
+ 
++	data->dev->driver_type = RC_DRIVER_IR_RAW;
+ 	data->dev->driver_name = WBCIR_NAME;
+ 	data->dev->input_name = WBCIR_NAME;
+ 	data->dev->input_phys = "wbcir/cir0";
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index e15e47d..34416d4 100644
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -799,7 +799,7 @@ static int mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq,
+ {
+ 	struct mmc_blk_data *md = mq->data;
+ 	struct mmc_card *card = md->queue.card;
+-	unsigned int from, nr, arg;
++	unsigned int from, nr, arg, trim_arg, erase_arg;
+ 	int err = 0, type = MMC_BLK_SECDISCARD;
+ 
+ 	if (!(mmc_can_secure_erase_trim(card) || mmc_can_sanitize(card))) {
+@@ -807,20 +807,26 @@ static int mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq,
+ 		goto out;
+ 	}
+ 
++	from = blk_rq_pos(req);
++	nr = blk_rq_sectors(req);
++
+ 	/* The sanitize operation is supported at v4.5 only */
+ 	if (mmc_can_sanitize(card)) {
+-		err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+-				EXT_CSD_SANITIZE_START, 1, 0);
+-		goto out;
++		erase_arg = MMC_ERASE_ARG;
++		trim_arg = MMC_TRIM_ARG;
++	} else {
++		erase_arg = MMC_SECURE_ERASE_ARG;
++		trim_arg = MMC_SECURE_TRIM1_ARG;
+ 	}
+ 
+-	from = blk_rq_pos(req);
+-	nr = blk_rq_sectors(req);
+-
+-	if (mmc_can_trim(card) && !mmc_erase_group_aligned(card, from, nr))
+-		arg = MMC_SECURE_TRIM1_ARG;
+-	else
+-		arg = MMC_SECURE_ERASE_ARG;
++	if (mmc_erase_group_aligned(card, from, nr))
++		arg = erase_arg;
++	else if (mmc_can_trim(card))
++		arg = trim_arg;
++	else {
++		err = -EINVAL;
++		goto out;
++	}
+ retry:
+ 	if (card->quirks & MMC_QUIRK_INAND_CMD38) {
+ 		err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+@@ -830,25 +836,41 @@ retry:
+ 				 INAND_CMD38_ARG_SECERASE,
+ 				 0);
+ 		if (err)
+-			goto out;
++			goto out_retry;
+ 	}
++
+ 	err = mmc_erase(card, from, nr, arg);
+-	if (!err && arg == MMC_SECURE_TRIM1_ARG) {
++	if (err == -EIO)
++		goto out_retry;
++	if (err)
++		goto out;
++
++	if (arg == MMC_SECURE_TRIM1_ARG) {
+ 		if (card->quirks & MMC_QUIRK_INAND_CMD38) {
+ 			err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+ 					 INAND_CMD38_ARG_EXT_CSD,
+ 					 INAND_CMD38_ARG_SECTRIM2,
+ 					 0);
+ 			if (err)
+-				goto out;
++				goto out_retry;
+ 		}
++
+ 		err = mmc_erase(card, from, nr, MMC_SECURE_TRIM2_ARG);
++		if (err == -EIO)
++			goto out_retry;
++		if (err)
++			goto out;
+ 	}
+-out:
+-	if (err == -EIO && !mmc_blk_reset(md, card->host, type))
++
++	if (mmc_can_sanitize(card))
++		err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
++				 EXT_CSD_SANITIZE_START, 1, 0);
++out_retry:
++	if (err && !mmc_blk_reset(md, card->host, type))
+ 		goto retry;
+ 	if (!err)
+ 		mmc_blk_reset_success(md, type);
++out:
+ 	spin_lock_irq(&md->lock);
+ 	__blk_end_request(req, err, blk_rq_bytes(req));
+ 	spin_unlock_irq(&md->lock);
+diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
+index dcad59c..78690f2 100644
+--- a/drivers/mmc/card/queue.c
++++ b/drivers/mmc/card/queue.c
+@@ -134,7 +134,7 @@ static void mmc_queue_setup_discard(struct request_queue *q,
+ 
+ 	queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
+ 	q->limits.max_discard_sectors = max_discard;
+-	if (card->erased_byte == 0)
++	if (card->erased_byte == 0 && !mmc_can_discard(card))
+ 		q->limits.discard_zeroes_data = 1;
+ 	q->limits.discard_granularity = card->pref_erase << 9;
+ 	/* granularity must not be greater than max. discard */
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 950b97d..411a994 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -1516,7 +1516,10 @@ static unsigned int mmc_mmc_erase_timeout(struct mmc_card *card,
+ {
+ 	unsigned int erase_timeout;
+ 
+-	if (card->ext_csd.erase_group_def & 1) {
++	if (arg == MMC_DISCARD_ARG ||
++	    (arg == MMC_TRIM_ARG && card->ext_csd.rev >= 6)) {
++		erase_timeout = card->ext_csd.trim_timeout;
++	} else if (card->ext_csd.erase_group_def & 1) {
+ 		/* High Capacity Erase Group Size uses HC timeouts */
+ 		if (arg == MMC_TRIM_ARG)
+ 			erase_timeout = card->ext_csd.trim_timeout;
+@@ -1788,8 +1791,6 @@ int mmc_can_trim(struct mmc_card *card)
+ {
+ 	if (card->ext_csd.sec_feature_support & EXT_CSD_SEC_GB_CL_EN)
+ 		return 1;
+-	if (mmc_can_discard(card))
+-		return 1;
+ 	return 0;
+ }
+ EXPORT_SYMBOL(mmc_can_trim);
+@@ -1808,6 +1809,8 @@ EXPORT_SYMBOL(mmc_can_discard);
+ 
+ int mmc_can_sanitize(struct mmc_card *card)
+ {
++	if (!mmc_can_trim(card) && !mmc_can_erase(card))
++		return 0;
+ 	if (card->ext_csd.sec_feature_support & EXT_CSD_SEC_SANITIZE)
+ 		return 1;
+ 	return 0;
+diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
+index 4540e37..1b47937 100644
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -467,8 +467,7 @@ static int __devinit sdhci_esdhc_imx_probe(struct platform_device *pdev)
+ 	clk_enable(clk);
+ 	pltfm_host->clk = clk;
+ 
+-	if (!is_imx25_esdhc(imx_data))
+-		host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
++	host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
+ 
+ 	if (is_imx25_esdhc(imx_data) || is_imx35_esdhc(imx_data))
+ 		/* Fix errata ENGcm07207 present on i.MX25 and i.MX35 */
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index e58aa2b..f65e0b9 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2982,7 +2982,11 @@ static void bond_ab_arp_commit(struct bonding *bond, int delta_in_ticks)
+ 					   trans_start + delta_in_ticks)) ||
+ 			    bond->curr_active_slave != slave) {
+ 				slave->link = BOND_LINK_UP;
+-				bond->current_arp_slave = NULL;
++				if (bond->current_arp_slave) {
++					bond_set_slave_inactive_flags(
++						bond->current_arp_slave);
++					bond->current_arp_slave = NULL;
++				}
+ 
+ 				pr_info("%s: link status definitely up for interface %s.\n",
+ 					bond->dev->name, slave->dev->name);
+diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
+index a7c5e88..eeac9ca 100644
+--- a/drivers/net/dummy.c
++++ b/drivers/net/dummy.c
+@@ -106,14 +106,14 @@ static int dummy_dev_init(struct net_device *dev)
+ 	return 0;
+ }
+ 
+-static void dummy_dev_free(struct net_device *dev)
++static void dummy_dev_uninit(struct net_device *dev)
+ {
+ 	free_percpu(dev->dstats);
+-	free_netdev(dev);
+ }
+ 
+ static const struct net_device_ops dummy_netdev_ops = {
+ 	.ndo_init		= dummy_dev_init,
++	.ndo_uninit		= dummy_dev_uninit,
+ 	.ndo_start_xmit		= dummy_xmit,
+ 	.ndo_validate_addr	= eth_validate_addr,
+ 	.ndo_set_rx_mode	= set_multicast_list,
+@@ -127,7 +127,7 @@ static void dummy_setup(struct net_device *dev)
+ 
+ 	/* Initialize the device structure. */
+ 	dev->netdev_ops = &dummy_netdev_ops;
+-	dev->destructor = dummy_dev_free;
++	dev->destructor = free_netdev;
+ 
+ 	/* Fill in device structure with ethernet-generic values. */
+ 	dev->tx_queue_len = 0;
+diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/ethernet/atheros/atlx/atl1.c
+index 33a4e35..ee532e1 100644
+--- a/drivers/net/ethernet/atheros/atlx/atl1.c
++++ b/drivers/net/ethernet/atheros/atlx/atl1.c
+@@ -2473,7 +2473,7 @@ static irqreturn_t atl1_intr(int irq, void *data)
+ 					"pcie phy link down %x\n", status);
+ 			if (netif_running(adapter->netdev)) {	/* reset MAC */
+ 				iowrite32(0, adapter->hw.hw_addr + REG_IMR);
+-				schedule_work(&adapter->pcie_dma_to_rst_task);
++				schedule_work(&adapter->reset_dev_task);
+ 				return IRQ_HANDLED;
+ 			}
+ 		}
+@@ -2485,7 +2485,7 @@ static irqreturn_t atl1_intr(int irq, void *data)
+ 					"pcie DMA r/w error (status = 0x%x)\n",
+ 					status);
+ 			iowrite32(0, adapter->hw.hw_addr + REG_IMR);
+-			schedule_work(&adapter->pcie_dma_to_rst_task);
++			schedule_work(&adapter->reset_dev_task);
+ 			return IRQ_HANDLED;
+ 		}
+ 
+@@ -2630,10 +2630,10 @@ static void atl1_down(struct atl1_adapter *adapter)
+ 	atl1_clean_rx_ring(adapter);
+ }
+ 
+-static void atl1_tx_timeout_task(struct work_struct *work)
++static void atl1_reset_dev_task(struct work_struct *work)
+ {
+ 	struct atl1_adapter *adapter =
+-		container_of(work, struct atl1_adapter, tx_timeout_task);
++		container_of(work, struct atl1_adapter, reset_dev_task);
+ 	struct net_device *netdev = adapter->netdev;
+ 
+ 	netif_device_detach(netdev);
+@@ -3032,12 +3032,10 @@ static int __devinit atl1_probe(struct pci_dev *pdev,
+ 		    (unsigned long)adapter);
+ 	adapter->phy_timer_pending = false;
+ 
+-	INIT_WORK(&adapter->tx_timeout_task, atl1_tx_timeout_task);
++	INIT_WORK(&adapter->reset_dev_task, atl1_reset_dev_task);
+ 
+ 	INIT_WORK(&adapter->link_chg_task, atlx_link_chg_task);
+ 
+-	INIT_WORK(&adapter->pcie_dma_to_rst_task, atl1_tx_timeout_task);
+-
+ 	err = register_netdev(netdev);
+ 	if (err)
+ 		goto err_common;
+diff --git a/drivers/net/ethernet/atheros/atlx/atl1.h b/drivers/net/ethernet/atheros/atlx/atl1.h
+index 109d6da..e04bf4d 100644
+--- a/drivers/net/ethernet/atheros/atlx/atl1.h
++++ b/drivers/net/ethernet/atheros/atlx/atl1.h
+@@ -758,9 +758,8 @@ struct atl1_adapter {
+ 	u16 link_speed;
+ 	u16 link_duplex;
+ 	spinlock_t lock;
+-	struct work_struct tx_timeout_task;
++	struct work_struct reset_dev_task;
+ 	struct work_struct link_chg_task;
+-	struct work_struct pcie_dma_to_rst_task;
+ 
+ 	struct timer_list phy_config_timer;
+ 	bool phy_timer_pending;
+diff --git a/drivers/net/ethernet/atheros/atlx/atlx.c b/drivers/net/ethernet/atheros/atlx/atlx.c
+index aabcf4b..41c6d83 100644
+--- a/drivers/net/ethernet/atheros/atlx/atlx.c
++++ b/drivers/net/ethernet/atheros/atlx/atlx.c
+@@ -193,7 +193,7 @@ static void atlx_tx_timeout(struct net_device *netdev)
+ {
+ 	struct atlx_adapter *adapter = netdev_priv(netdev);
+ 	/* Do the reset outside of interrupt context */
+-	schedule_work(&adapter->tx_timeout_task);
++	schedule_work(&adapter->reset_dev_task);
+ }
+ 
+ /*
+diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
+index d19c849..77241b6 100644
+--- a/drivers/net/ethernet/micrel/ks8851_mll.c
++++ b/drivers/net/ethernet/micrel/ks8851_mll.c
+@@ -40,7 +40,7 @@
+ #define	DRV_NAME	"ks8851_mll"
+ 
+ static u8 KS_DEFAULT_MAC_ADDRESS[] = { 0x00, 0x10, 0xA1, 0x86, 0x95, 0x11 };
+-#define MAX_RECV_FRAMES			32
++#define MAX_RECV_FRAMES			255
+ #define MAX_BUF_SIZE			2048
+ #define TX_BUF_SIZE			2000
+ #define RX_BUF_SIZE			2000
+diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
+index 7ece990..4b9f4bd 100644
+--- a/drivers/net/ethernet/micrel/ksz884x.c
++++ b/drivers/net/ethernet/micrel/ksz884x.c
+@@ -5679,7 +5679,7 @@ static int netdev_set_mac_address(struct net_device *dev, void *addr)
+ 		memcpy(hw->override_addr, mac->sa_data, MAC_ADDR_LEN);
+ 	}
+ 
+-	memcpy(dev->dev_addr, mac->sa_data, MAX_ADDR_LEN);
++	memcpy(dev->dev_addr, mac->sa_data, ETH_ALEN);
+ 
+ 	interrupt = hw_block_intr(hw);
+ 
+diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
+index aba4f67..8f47907 100644
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -961,6 +961,11 @@ static inline void cp_start_hw (struct cp_private *cp)
+ 	cpw8(Cmd, RxOn | TxOn);
+ }
+ 
++static void cp_enable_irq(struct cp_private *cp)
++{
++	cpw16_f(IntrMask, cp_intr_mask);
++}
++
+ static void cp_init_hw (struct cp_private *cp)
+ {
+ 	struct net_device *dev = cp->dev;
+@@ -1000,8 +1005,6 @@ static void cp_init_hw (struct cp_private *cp)
+ 
+ 	cpw16(MultiIntr, 0);
+ 
+-	cpw16_f(IntrMask, cp_intr_mask);
+-
+ 	cpw8_f(Cfg9346, Cfg9346_Lock);
+ }
+ 
+@@ -1133,6 +1136,8 @@ static int cp_open (struct net_device *dev)
+ 	if (rc)
+ 		goto err_out_hw;
+ 
++	cp_enable_irq(cp);
++
+ 	netif_carrier_off(dev);
+ 	mii_check_media(&cp->mii_if, netif_msg_link(cp), true);
+ 	netif_start_queue(dev);
+@@ -2034,6 +2039,7 @@ static int cp_resume (struct pci_dev *pdev)
+ 	/* FIXME: sh*t may happen if the Rx ring buffer is depleted */
+ 	cp_init_rings_index (cp);
+ 	cp_init_hw (cp);
++	cp_enable_irq(cp);
+ 	netif_start_queue (dev);
+ 
+ 	spin_lock_irqsave (&cp->lock, flags);
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index 8843071..8c7dd21 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -1089,10 +1089,8 @@ smsc911x_rx_counterrors(struct net_device *dev, unsigned int rxstat)
+ 
+ /* Quickly dumps bad packets */
+ static void
+-smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktbytes)
++smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktwords)
+ {
+-	unsigned int pktwords = (pktbytes + NET_IP_ALIGN + 3) >> 2;
+-
+ 	if (likely(pktwords >= 4)) {
+ 		unsigned int timeout = 500;
+ 		unsigned int val;
+@@ -1156,7 +1154,7 @@ static int smsc911x_poll(struct napi_struct *napi, int budget)
+ 			continue;
+ 		}
+ 
+-		skb = netdev_alloc_skb(dev, pktlength + NET_IP_ALIGN);
++		skb = netdev_alloc_skb(dev, pktwords << 2);
+ 		if (unlikely(!skb)) {
+ 			SMSC_WARN(pdata, rx_err,
+ 				  "Unable to allocate skb for rx packet");
+@@ -1166,14 +1164,12 @@ static int smsc911x_poll(struct napi_struct *napi, int budget)
+ 			break;
+ 		}
+ 
+-		skb->data = skb->head;
+-		skb_reset_tail_pointer(skb);
++		pdata->ops->rx_readfifo(pdata,
++				 (unsigned int *)skb->data, pktwords);
+ 
+ 		/* Align IP on 16B boundary */
+ 		skb_reserve(skb, NET_IP_ALIGN);
+ 		skb_put(skb, pktlength - 4);
+-		pdata->ops->rx_readfifo(pdata,
+-				 (unsigned int *)skb->head, pktwords);
+ 		skb->protocol = eth_type_trans(skb, dev);
+ 		skb_checksum_none_assert(skb);
+ 		netif_receive_skb(skb);
+@@ -1396,7 +1392,7 @@ static int smsc911x_open(struct net_device *dev)
+ 	smsc911x_reg_write(pdata, FIFO_INT, temp);
+ 
+ 	/* set RX Data offset to 2 bytes for alignment */
+-	smsc911x_reg_write(pdata, RX_CFG, (2 << 8));
++	smsc911x_reg_write(pdata, RX_CFG, (NET_IP_ALIGN << 8));
+ 
+ 	/* enable NAPI polling before enabling RX interrupts */
+ 	napi_enable(&pdata->napi);
+diff --git a/drivers/net/ethernet/ti/davinci_mdio.c b/drivers/net/ethernet/ti/davinci_mdio.c
+index 7615040..f470ab6 100644
+--- a/drivers/net/ethernet/ti/davinci_mdio.c
++++ b/drivers/net/ethernet/ti/davinci_mdio.c
+@@ -181,6 +181,11 @@ static inline int wait_for_user_access(struct davinci_mdio_data *data)
+ 		__davinci_mdio_reset(data);
+ 		return -EAGAIN;
+ 	}
++
++	reg = __raw_readl(&regs->user[0].access);
++	if ((reg & USERACCESS_GO) == 0)
++		return 0;
++
+ 	dev_err(data->dev, "timed out waiting for user access\n");
+ 	return -ETIMEDOUT;
+ }
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index 486b404..3ed983c 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -968,7 +968,6 @@ ppp_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	proto = npindex_to_proto[npi];
+ 	put_unaligned_be16(proto, pp);
+ 
+-	netif_stop_queue(dev);
+ 	skb_queue_tail(&ppp->file.xq, skb);
+ 	ppp_xmit_process(ppp);
+ 	return NETDEV_TX_OK;
+@@ -1063,6 +1062,8 @@ ppp_xmit_process(struct ppp *ppp)
+ 		   code that we can accept some more. */
+ 		if (!ppp->xmit_pending && !skb_peek(&ppp->file.xq))
+ 			netif_wake_queue(ppp->dev);
++		else
++			netif_stop_queue(ppp->dev);
+ 	}
+ 	ppp_xmit_unlock(ppp);
+ }
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index a5b9b12..7bd219b 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -1050,6 +1050,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
+ 	dev->net->ethtool_ops = &smsc75xx_ethtool_ops;
+ 	dev->net->flags |= IFF_MULTICAST;
+ 	dev->net->hard_header_len += SMSC75XX_TX_OVERHEAD;
++	dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
+index eff6767..55b3218 100644
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -1190,7 +1190,7 @@ static const struct driver_info smsc95xx_info = {
+ 	.rx_fixup	= smsc95xx_rx_fixup,
+ 	.tx_fixup	= smsc95xx_tx_fixup,
+ 	.status		= smsc95xx_status,
+-	.flags		= FLAG_ETHER | FLAG_SEND_ZLP,
++	.flags		= FLAG_ETHER | FLAG_SEND_ZLP | FLAG_LINK_INTR,
+ };
+ 
+ static const struct usb_device_id products[] = {
+diff --git a/drivers/net/wimax/i2400m/netdev.c b/drivers/net/wimax/i2400m/netdev.c
+index 64a1106..4697cf3 100644
+--- a/drivers/net/wimax/i2400m/netdev.c
++++ b/drivers/net/wimax/i2400m/netdev.c
+@@ -607,7 +607,8 @@ static void i2400m_get_drvinfo(struct net_device *net_dev,
+ 	struct i2400m *i2400m = net_dev_to_i2400m(net_dev);
+ 
+ 	strncpy(info->driver, KBUILD_MODNAME, sizeof(info->driver) - 1);
+-	strncpy(info->fw_version, i2400m->fw_name, sizeof(info->fw_version) - 1);
++	strncpy(info->fw_version,
++	        i2400m->fw_name ? : "", sizeof(info->fw_version) - 1);
+ 	if (net_dev->dev.parent)
+ 		strncpy(info->bus_info, dev_name(net_dev->dev.parent),
+ 			sizeof(info->bus_info) - 1);
+diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
+index 5634d9a..680709c 100644
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -4820,8 +4820,14 @@ static int b43_op_start(struct ieee80211_hw *hw)
+  out_mutex_unlock:
+ 	mutex_unlock(&wl->mutex);
+ 
+-	/* reload configuration */
+-	b43_op_config(hw, ~0);
++	/*
++	 * Configuration may have been overwritten during initialization.
++	 * Reload the configuration, but only if initialization was
++	 * successful. Reloading the configuration after a failed init
++	 * may hang the system.
++	 */
++	if (!err)
++		b43_op_config(hw, ~0);
+ 
+ 	return err;
+ }
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+index 453f58e..f98becc 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+@@ -7865,6 +7865,7 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
+ {
+ 	int len_mpdu;
+ 	struct ieee80211_rx_status rx_status;
++	struct ieee80211_hdr *hdr;
+ 
+ 	memset(&rx_status, 0, sizeof(rx_status));
+ 	prep_mac80211_status(wlc, rxh, p, &rx_status);
+@@ -7874,6 +7875,13 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
+ 	skb_pull(p, D11_PHY_HDR_LEN);
+ 	__skb_trim(p, len_mpdu);
+ 
++	/* unmute transmit */
++	if (wlc->hw->suspended_fifos) {
++		hdr = (struct ieee80211_hdr *)p->data;
++		if (ieee80211_is_beacon(hdr->frame_control))
++			brcms_b_mute(wlc->hw, false);
++	}
++
+ 	memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
+ 	ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
+ }
+diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
+index 99a710d..827889b 100644
+--- a/drivers/net/wireless/ipw2x00/ipw2200.c
++++ b/drivers/net/wireless/ipw2x00/ipw2200.c
+@@ -2183,6 +2183,7 @@ static int __ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
+ {
+ 	int rc = 0;
+ 	unsigned long flags;
++	unsigned long now, end;
+ 
+ 	spin_lock_irqsave(&priv->lock, flags);
+ 	if (priv->status & STATUS_HCMD_ACTIVE) {
+@@ -2224,10 +2225,20 @@ static int __ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
+ 	}
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 
++	now = jiffies;
++	end = now + HOST_COMPLETE_TIMEOUT;
++again:
+ 	rc = wait_event_interruptible_timeout(priv->wait_command_queue,
+ 					      !(priv->
+ 						status & STATUS_HCMD_ACTIVE),
+-					      HOST_COMPLETE_TIMEOUT);
++					      end - now);
++	if (rc < 0) {
++		now = jiffies;
++		if (time_before(now, end))
++			goto again;
++		rc = 0;
++	}
++
+ 	if (rc == 0) {
+ 		spin_lock_irqsave(&priv->lock, flags);
+ 		if (priv->status & STATUS_HCMD_ACTIVE) {
+diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
+index dd008b0..1e6c8cc 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
+@@ -45,8 +45,8 @@
+ #include "iwl-cfg.h"
+ 
+ /* Highest firmware API version supported */
+-#define IWL1000_UCODE_API_MAX 6
+-#define IWL100_UCODE_API_MAX 6
++#define IWL1000_UCODE_API_MAX 5
++#define IWL100_UCODE_API_MAX 5
+ 
+ /* Oldest version we won't warn about */
+ #define IWL1000_UCODE_API_OK 5
+@@ -244,5 +244,5 @@ struct iwl_cfg iwl100_bg_cfg = {
+ 	IWL_DEVICE_100,
+ };
+ 
+-MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_MAX));
+-MODULE_FIRMWARE(IWL100_MODULE_FIRMWARE(IWL100_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_OK));
++MODULE_FIRMWARE(IWL100_MODULE_FIRMWARE(IWL100_UCODE_API_OK));
+diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
+index 7943197..9823e41 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
+@@ -51,10 +51,10 @@
+ #define IWL135_UCODE_API_MAX 6
+ 
+ /* Oldest version we won't warn about */
+-#define IWL2030_UCODE_API_OK 5
+-#define IWL2000_UCODE_API_OK 5
+-#define IWL105_UCODE_API_OK 5
+-#define IWL135_UCODE_API_OK 5
++#define IWL2030_UCODE_API_OK 6
++#define IWL2000_UCODE_API_OK 6
++#define IWL105_UCODE_API_OK 6
++#define IWL135_UCODE_API_OK 6
+ 
+ /* Lowest firmware API version supported */
+ #define IWL2030_UCODE_API_MIN 5
+@@ -372,7 +372,7 @@ struct iwl_cfg iwl135_bgn_cfg = {
+ 	.ht_params = &iwl2000_ht_params,
+ };
+ 
+-MODULE_FIRMWARE(IWL2000_MODULE_FIRMWARE(IWL2000_UCODE_API_MAX));
+-MODULE_FIRMWARE(IWL2030_MODULE_FIRMWARE(IWL2030_UCODE_API_MAX));
+-MODULE_FIRMWARE(IWL105_MODULE_FIRMWARE(IWL105_UCODE_API_MAX));
+-MODULE_FIRMWARE(IWL135_MODULE_FIRMWARE(IWL135_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL2000_MODULE_FIRMWARE(IWL2000_UCODE_API_OK));
++MODULE_FIRMWARE(IWL2030_MODULE_FIRMWARE(IWL2030_UCODE_API_OK));
++MODULE_FIRMWARE(IWL105_MODULE_FIRMWARE(IWL105_UCODE_API_OK));
++MODULE_FIRMWARE(IWL135_MODULE_FIRMWARE(IWL135_UCODE_API_OK));
+diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
+index f55fb2d..606213f 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
+@@ -50,6 +50,10 @@
+ #define IWL5000_UCODE_API_MAX 5
+ #define IWL5150_UCODE_API_MAX 2
+ 
++/* Oldest version we won't warn about */
++#define IWL5000_UCODE_API_OK 5
++#define IWL5150_UCODE_API_OK 2
++
+ /* Lowest firmware API version supported */
+ #define IWL5000_UCODE_API_MIN 1
+ #define IWL5150_UCODE_API_MIN 1
+@@ -373,6 +377,7 @@ static struct iwl_ht_params iwl5000_ht_params = {
+ #define IWL_DEVICE_5000						\
+ 	.fw_name_pre = IWL5000_FW_PRE,				\
+ 	.ucode_api_max = IWL5000_UCODE_API_MAX,			\
++	.ucode_api_ok = IWL5000_UCODE_API_OK,			\
+ 	.ucode_api_min = IWL5000_UCODE_API_MIN,			\
+ 	.eeprom_ver = EEPROM_5000_EEPROM_VERSION,		\
+ 	.eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,	\
+@@ -416,6 +421,7 @@ struct iwl_cfg iwl5350_agn_cfg = {
+ 	.name = "Intel(R) WiMAX/WiFi Link 5350 AGN",
+ 	.fw_name_pre = IWL5000_FW_PRE,
+ 	.ucode_api_max = IWL5000_UCODE_API_MAX,
++	.ucode_api_ok = IWL5000_UCODE_API_OK,
+ 	.ucode_api_min = IWL5000_UCODE_API_MIN,
+ 	.eeprom_ver = EEPROM_5050_EEPROM_VERSION,
+ 	.eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
+@@ -429,6 +435,7 @@ struct iwl_cfg iwl5350_agn_cfg = {
+ #define IWL_DEVICE_5150						\
+ 	.fw_name_pre = IWL5150_FW_PRE,				\
+ 	.ucode_api_max = IWL5150_UCODE_API_MAX,			\
++	.ucode_api_ok = IWL5150_UCODE_API_OK,			\
+ 	.ucode_api_min = IWL5150_UCODE_API_MIN,			\
+ 	.eeprom_ver = EEPROM_5050_EEPROM_VERSION,		\
+ 	.eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,	\
+@@ -450,5 +457,5 @@ struct iwl_cfg iwl5150_abg_cfg = {
+ 	IWL_DEVICE_5150,
+ };
+ 
+-MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX));
+-MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_OK));
++MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_OK));
+diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
+index c840c78..b4f809c 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
+@@ -46,12 +46,15 @@
+ #include "iwl-cfg.h"
+ 
+ /* Highest firmware API version supported */
+-#define IWL6000_UCODE_API_MAX 4
++#define IWL6000_UCODE_API_MAX 6
+ #define IWL6050_UCODE_API_MAX 5
+ #define IWL6000G2_UCODE_API_MAX 6
+ 
+ /* Oldest version we won't warn about */
++#define IWL6000_UCODE_API_OK 4
+ #define IWL6000G2_UCODE_API_OK 5
++#define IWL6050_UCODE_API_OK 5
++#define IWL6000G2B_UCODE_API_OK 6
+ 
+ /* Lowest firmware API version supported */
+ #define IWL6000_UCODE_API_MIN 4
+@@ -399,7 +402,7 @@ struct iwl_cfg iwl6005_2agn_d_cfg = {
+ #define IWL_DEVICE_6030						\
+ 	.fw_name_pre = IWL6030_FW_PRE,				\
+ 	.ucode_api_max = IWL6000G2_UCODE_API_MAX,		\
+-	.ucode_api_ok = IWL6000G2_UCODE_API_OK,			\
++	.ucode_api_ok = IWL6000G2B_UCODE_API_OK,		\
+ 	.ucode_api_min = IWL6000G2_UCODE_API_MIN,		\
+ 	.eeprom_ver = EEPROM_6030_EEPROM_VERSION,		\
+ 	.eeprom_calib_ver = EEPROM_6030_TX_POWER_VERSION,	\
+@@ -479,6 +482,7 @@ struct iwl_cfg iwl130_bg_cfg = {
+ #define IWL_DEVICE_6000i					\
+ 	.fw_name_pre = IWL6000_FW_PRE,				\
+ 	.ucode_api_max = IWL6000_UCODE_API_MAX,			\
++	.ucode_api_ok = IWL6000_UCODE_API_OK,			\
+ 	.ucode_api_min = IWL6000_UCODE_API_MIN,			\
+ 	.valid_tx_ant = ANT_BC,		/* .cfg overwrite */	\
+ 	.valid_rx_ant = ANT_BC,		/* .cfg overwrite */	\
+@@ -559,6 +563,7 @@ struct iwl_cfg iwl6000_3agn_cfg = {
+ 	.name = "Intel(R) Centrino(R) Ultimate-N 6300 AGN",
+ 	.fw_name_pre = IWL6000_FW_PRE,
+ 	.ucode_api_max = IWL6000_UCODE_API_MAX,
++	.ucode_api_ok = IWL6000_UCODE_API_OK,
+ 	.ucode_api_min = IWL6000_UCODE_API_MIN,
+ 	.eeprom_ver = EEPROM_6000_EEPROM_VERSION,
+ 	.eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
+@@ -569,7 +574,7 @@ struct iwl_cfg iwl6000_3agn_cfg = {
+ 	.led_mode = IWL_LED_BLINK,
+ };
+ 
+-MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
+-MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_MAX));
+-MODULE_FIRMWARE(IWL6005_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
+-MODULE_FIRMWARE(IWL6030_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_OK));
++MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_OK));
++MODULE_FIRMWARE(IWL6005_MODULE_FIRMWARE(IWL6000G2_UCODE_API_OK));
++MODULE_FIRMWARE(IWL6030_MODULE_FIRMWARE(IWL6000G2B_UCODE_API_OK));
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
+index e0e9a3d..d7d2512 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -1504,7 +1504,6 @@ static void iwl_bg_run_time_calib_work(struct work_struct *work)
+ 
+ static void iwlagn_prepare_restart(struct iwl_priv *priv)
+ {
+-	struct iwl_rxon_context *ctx;
+ 	bool bt_full_concurrent;
+ 	u8 bt_ci_compliance;
+ 	u8 bt_load;
+@@ -1513,8 +1512,6 @@ static void iwlagn_prepare_restart(struct iwl_priv *priv)
+ 
+ 	lockdep_assert_held(&priv->shrd->mutex);
+ 
+-	for_each_context(priv, ctx)
+-		ctx->vif = NULL;
+ 	priv->is_open = 0;
+ 
+ 	/*
+diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
+index 3d75d4c..832ec4d 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -1228,6 +1228,7 @@ int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
+ 	struct iwl_rxon_context *tmp, *ctx = NULL;
+ 	int err;
+ 	enum nl80211_iftype viftype = ieee80211_vif_type_p2p(vif);
++	bool reset = false;
+ 
+ 	IWL_DEBUG_MAC80211(priv, "enter: type %d, addr %pM\n",
+ 			   viftype, vif->addr);
+@@ -1249,6 +1250,13 @@ int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
+ 			tmp->interface_modes | tmp->exclusive_interface_modes;
+ 
+ 		if (tmp->vif) {
++			/* On reset we need to add the same interface again */
++			if (tmp->vif == vif) {
++				reset = true;
++				ctx = tmp;
++				break;
++			}
++
+ 			/* check if this busy context is exclusive */
+ 			if (tmp->exclusive_interface_modes &
+ 						BIT(tmp->vif->type)) {
+@@ -1275,7 +1283,7 @@ int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
+ 	ctx->vif = vif;
+ 
+ 	err = iwl_setup_interface(priv, ctx);
+-	if (!err)
++	if (!err || reset)
+ 		goto out;
+ 
+ 	ctx->vif = NULL;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
+index 5bede9d..aae992a 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-fh.h
++++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
+@@ -104,15 +104,29 @@
+  * (see struct iwl_tfd_frame).  These 16 pointer registers are offset by 0x04
+  * bytes from one another.  Each TFD circular buffer in DRAM must be 256-byte
+  * aligned (address bits 0-7 must be 0).
++ * Later devices have 20 (5000 series) or 30 (higher) queues, but the registers
++ * for them are in different places.
+  *
+  * Bit fields in each pointer register:
+  *  27-0: TFD CB physical base address [35:8], must be 256-byte aligned
+  */
+-#define FH_MEM_CBBC_LOWER_BOUND          (FH_MEM_LOWER_BOUND + 0x9D0)
+-#define FH_MEM_CBBC_UPPER_BOUND          (FH_MEM_LOWER_BOUND + 0xA10)
+-
+-/* Find TFD CB base pointer for given queue (range 0-15). */
+-#define FH_MEM_CBBC_QUEUE(x)  (FH_MEM_CBBC_LOWER_BOUND + (x) * 0x4)
++#define FH_MEM_CBBC_0_15_LOWER_BOUND		(FH_MEM_LOWER_BOUND + 0x9D0)
++#define FH_MEM_CBBC_0_15_UPPER_BOUND		(FH_MEM_LOWER_BOUND + 0xA10)
++#define FH_MEM_CBBC_16_19_LOWER_BOUND		(FH_MEM_LOWER_BOUND + 0xBF0)
++#define FH_MEM_CBBC_16_19_UPPER_BOUND		(FH_MEM_LOWER_BOUND + 0xC00)
++#define FH_MEM_CBBC_20_31_LOWER_BOUND		(FH_MEM_LOWER_BOUND + 0xB20)
++#define FH_MEM_CBBC_20_31_UPPER_BOUND		(FH_MEM_LOWER_BOUND + 0xB80)
++
++/* Find TFD CB base pointer for given queue */
++static inline unsigned int FH_MEM_CBBC_QUEUE(unsigned int chnl)
++{
++	if (chnl < 16)
++		return FH_MEM_CBBC_0_15_LOWER_BOUND + 4 * chnl;
++	if (chnl < 20)
++		return FH_MEM_CBBC_16_19_LOWER_BOUND + 4 * (chnl - 16);
++	WARN_ON_ONCE(chnl >= 32);
++	return FH_MEM_CBBC_20_31_LOWER_BOUND + 4 * (chnl - 20);
++}
+ 
+ 
+ /**
+diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
+index bebdd82..d9b089e 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
++++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
+@@ -227,12 +227,33 @@
+ #define SCD_AIT			(SCD_BASE + 0x0c)
+ #define SCD_TXFACT		(SCD_BASE + 0x10)
+ #define SCD_ACTIVE		(SCD_BASE + 0x14)
+-#define SCD_QUEUE_WRPTR(x)	(SCD_BASE + 0x18 + (x) * 4)
+-#define SCD_QUEUE_RDPTR(x)	(SCD_BASE + 0x68 + (x) * 4)
+ #define SCD_QUEUECHAIN_SEL	(SCD_BASE + 0xe8)
+ #define SCD_AGGR_SEL		(SCD_BASE + 0x248)
+ #define SCD_INTERRUPT_MASK	(SCD_BASE + 0x108)
+-#define SCD_QUEUE_STATUS_BITS(x)	(SCD_BASE + 0x10c + (x) * 4)
++
++static inline unsigned int SCD_QUEUE_WRPTR(unsigned int chnl)
++{
++	if (chnl < 20)
++		return SCD_BASE + 0x18 + chnl * 4;
++	WARN_ON_ONCE(chnl >= 32);
++	return SCD_BASE + 0x284 + (chnl - 20) * 4;
++}
++
++static inline unsigned int SCD_QUEUE_RDPTR(unsigned int chnl)
++{
++	if (chnl < 20)
++		return SCD_BASE + 0x68 + chnl * 4;
++	WARN_ON_ONCE(chnl >= 32);
++	return SCD_BASE + 0x2B4 + (chnl - 20) * 4;
++}
++
++static inline unsigned int SCD_QUEUE_STATUS_BITS(unsigned int chnl)
++{
++	if (chnl < 20)
++		return SCD_BASE + 0x10c + chnl * 4;
++	WARN_ON_ONCE(chnl >= 32);
++	return SCD_BASE + 0x384 + (chnl - 20) * 4;
++}
+ 
+ /*********************** END TX SCHEDULER *************************************/
+ 
+diff --git a/drivers/net/wireless/mwifiex/pcie.h b/drivers/net/wireless/mwifiex/pcie.h
+index 445ff21..2f218f9 100644
+--- a/drivers/net/wireless/mwifiex/pcie.h
++++ b/drivers/net/wireless/mwifiex/pcie.h
+@@ -48,15 +48,15 @@
+ #define PCIE_HOST_INT_STATUS_MASK			0xC3C
+ #define PCIE_SCRATCH_2_REG				0xC40
+ #define PCIE_SCRATCH_3_REG				0xC44
+-#define PCIE_SCRATCH_4_REG				0xCC0
+-#define PCIE_SCRATCH_5_REG				0xCC4
+-#define PCIE_SCRATCH_6_REG				0xCC8
+-#define PCIE_SCRATCH_7_REG				0xCCC
+-#define PCIE_SCRATCH_8_REG				0xCD0
+-#define PCIE_SCRATCH_9_REG				0xCD4
+-#define PCIE_SCRATCH_10_REG				0xCD8
+-#define PCIE_SCRATCH_11_REG				0xCDC
+-#define PCIE_SCRATCH_12_REG				0xCE0
++#define PCIE_SCRATCH_4_REG				0xCD0
++#define PCIE_SCRATCH_5_REG				0xCD4
++#define PCIE_SCRATCH_6_REG				0xCD8
++#define PCIE_SCRATCH_7_REG				0xCDC
++#define PCIE_SCRATCH_8_REG				0xCE0
++#define PCIE_SCRATCH_9_REG				0xCE4
++#define PCIE_SCRATCH_10_REG				0xCE8
++#define PCIE_SCRATCH_11_REG				0xCEC
++#define PCIE_SCRATCH_12_REG				0xCF0
+ 
+ #define CPU_INTR_DNLD_RDY				BIT(0)
+ #define CPU_INTR_DOOR_BELL				BIT(1)
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index cb71e88..0ffa111 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -914,12 +914,14 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x050d, 0x8053) },
+ 	{ USB_DEVICE(0x050d, 0x805c) },
+ 	{ USB_DEVICE(0x050d, 0x815c) },
++	{ USB_DEVICE(0x050d, 0x825a) },
+ 	{ USB_DEVICE(0x050d, 0x825b) },
+ 	{ USB_DEVICE(0x050d, 0x935a) },
+ 	{ USB_DEVICE(0x050d, 0x935b) },
+ 	/* Buffalo */
+ 	{ USB_DEVICE(0x0411, 0x00e8) },
+ 	{ USB_DEVICE(0x0411, 0x0158) },
++	{ USB_DEVICE(0x0411, 0x015d) },
+ 	{ USB_DEVICE(0x0411, 0x016f) },
+ 	{ USB_DEVICE(0x0411, 0x01a2) },
+ 	/* Corega */
+@@ -934,6 +936,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x07d1, 0x3c0e) },
+ 	{ USB_DEVICE(0x07d1, 0x3c0f) },
+ 	{ USB_DEVICE(0x07d1, 0x3c11) },
++	{ USB_DEVICE(0x07d1, 0x3c13) },
++	{ USB_DEVICE(0x07d1, 0x3c15) },
+ 	{ USB_DEVICE(0x07d1, 0x3c16) },
+ 	{ USB_DEVICE(0x2001, 0x3c1b) },
+ 	/* Draytek */
+@@ -944,6 +948,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x7392, 0x7711) },
+ 	{ USB_DEVICE(0x7392, 0x7717) },
+ 	{ USB_DEVICE(0x7392, 0x7718) },
++	{ USB_DEVICE(0x7392, 0x7722) },
+ 	/* Encore */
+ 	{ USB_DEVICE(0x203d, 0x1480) },
+ 	{ USB_DEVICE(0x203d, 0x14a9) },
+@@ -978,6 +983,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x1737, 0x0070) },
+ 	{ USB_DEVICE(0x1737, 0x0071) },
+ 	{ USB_DEVICE(0x1737, 0x0077) },
++	{ USB_DEVICE(0x1737, 0x0078) },
+ 	/* Logitec */
+ 	{ USB_DEVICE(0x0789, 0x0162) },
+ 	{ USB_DEVICE(0x0789, 0x0163) },
+@@ -1001,9 +1007,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x0db0, 0x871b) },
+ 	{ USB_DEVICE(0x0db0, 0x871c) },
+ 	{ USB_DEVICE(0x0db0, 0x899a) },
++	/* Ovislink */
++	{ USB_DEVICE(0x1b75, 0x3071) },
++	{ USB_DEVICE(0x1b75, 0x3072) },
+ 	/* Para */
+ 	{ USB_DEVICE(0x20b8, 0x8888) },
+ 	/* Pegatron */
++	{ USB_DEVICE(0x1d4d, 0x0002) },
+ 	{ USB_DEVICE(0x1d4d, 0x000c) },
+ 	{ USB_DEVICE(0x1d4d, 0x000e) },
+ 	{ USB_DEVICE(0x1d4d, 0x0011) },
+@@ -1056,7 +1066,9 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	/* Sparklan */
+ 	{ USB_DEVICE(0x15a9, 0x0006) },
+ 	/* Sweex */
++	{ USB_DEVICE(0x177f, 0x0153) },
+ 	{ USB_DEVICE(0x177f, 0x0302) },
++	{ USB_DEVICE(0x177f, 0x0313) },
+ 	/* U-Media */
+ 	{ USB_DEVICE(0x157e, 0x300e) },
+ 	{ USB_DEVICE(0x157e, 0x3013) },
+@@ -1140,27 +1152,24 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x13d3, 0x3322) },
+ 	/* Belkin */
+ 	{ USB_DEVICE(0x050d, 0x1003) },
+-	{ USB_DEVICE(0x050d, 0x825a) },
+ 	/* Buffalo */
+ 	{ USB_DEVICE(0x0411, 0x012e) },
+ 	{ USB_DEVICE(0x0411, 0x0148) },
+ 	{ USB_DEVICE(0x0411, 0x0150) },
+-	{ USB_DEVICE(0x0411, 0x015d) },
+ 	/* Corega */
+ 	{ USB_DEVICE(0x07aa, 0x0041) },
+ 	{ USB_DEVICE(0x07aa, 0x0042) },
+ 	{ USB_DEVICE(0x18c5, 0x0008) },
+ 	/* D-Link */
+ 	{ USB_DEVICE(0x07d1, 0x3c0b) },
+-	{ USB_DEVICE(0x07d1, 0x3c13) },
+-	{ USB_DEVICE(0x07d1, 0x3c15) },
+ 	{ USB_DEVICE(0x07d1, 0x3c17) },
+ 	{ USB_DEVICE(0x2001, 0x3c17) },
+ 	/* Edimax */
+ 	{ USB_DEVICE(0x7392, 0x4085) },
+-	{ USB_DEVICE(0x7392, 0x7722) },
+ 	/* Encore */
+ 	{ USB_DEVICE(0x203d, 0x14a1) },
++	/* Fujitsu Stylistic 550 */
++	{ USB_DEVICE(0x1690, 0x0761) },
+ 	/* Gemtek */
+ 	{ USB_DEVICE(0x15a9, 0x0010) },
+ 	/* Gigabyte */
+@@ -1172,19 +1181,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	/* LevelOne */
+ 	{ USB_DEVICE(0x1740, 0x0605) },
+ 	{ USB_DEVICE(0x1740, 0x0615) },
+-	/* Linksys */
+-	{ USB_DEVICE(0x1737, 0x0078) },
+ 	/* Logitec */
+ 	{ USB_DEVICE(0x0789, 0x0168) },
+ 	{ USB_DEVICE(0x0789, 0x0169) },
+ 	/* Motorola */
+ 	{ USB_DEVICE(0x100d, 0x9032) },
+-	/* Ovislink */
+-	{ USB_DEVICE(0x1b75, 0x3071) },
+-	{ USB_DEVICE(0x1b75, 0x3072) },
+ 	/* Pegatron */
+ 	{ USB_DEVICE(0x05a6, 0x0101) },
+-	{ USB_DEVICE(0x1d4d, 0x0002) },
+ 	{ USB_DEVICE(0x1d4d, 0x0010) },
+ 	/* Planex */
+ 	{ USB_DEVICE(0x2019, 0x5201) },
+@@ -1203,9 +1206,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x083a, 0xc522) },
+ 	{ USB_DEVICE(0x083a, 0xd522) },
+ 	{ USB_DEVICE(0x083a, 0xf511) },
+-	/* Sweex */
+-	{ USB_DEVICE(0x177f, 0x0153) },
+-	{ USB_DEVICE(0x177f, 0x0313) },
+ 	/* Zyxel */
+ 	{ USB_DEVICE(0x0586, 0x341a) },
+ #endif
+diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
+index d44d398..47ba0f7 100644
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -1961,6 +1961,7 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
+ 		rtl_deinit_deferred_work(hw);
+ 		rtlpriv->intf_ops->adapter_stop(hw);
+ 	}
++	rtlpriv->cfg->ops->disable_interrupt(hw);
+ 
+ 	/*deinit rfkill */
+ 	rtl_deinit_rfkill(hw);
+diff --git a/drivers/net/wireless/wl1251/main.c b/drivers/net/wireless/wl1251/main.c
+index ba3268e..40c1574 100644
+--- a/drivers/net/wireless/wl1251/main.c
++++ b/drivers/net/wireless/wl1251/main.c
+@@ -479,6 +479,7 @@ static void wl1251_op_stop(struct ieee80211_hw *hw)
+ 	cancel_work_sync(&wl->irq_work);
+ 	cancel_work_sync(&wl->tx_work);
+ 	cancel_work_sync(&wl->filter_work);
++	cancel_delayed_work_sync(&wl->elp_work);
+ 
+ 	mutex_lock(&wl->mutex);
+ 
+diff --git a/drivers/net/wireless/wl1251/sdio.c b/drivers/net/wireless/wl1251/sdio.c
+index f786942..1b851f6 100644
+--- a/drivers/net/wireless/wl1251/sdio.c
++++ b/drivers/net/wireless/wl1251/sdio.c
+@@ -315,8 +315,8 @@ static void __devexit wl1251_sdio_remove(struct sdio_func *func)
+ 
+ 	if (wl->irq)
+ 		free_irq(wl->irq, wl);
+-	kfree(wl_sdio);
+ 	wl1251_free_hw(wl);
++	kfree(wl_sdio);
+ 
+ 	sdio_claim_host(func);
+ 	sdio_release_irq(func);
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 6476547..78fda9c 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2906,6 +2906,40 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f8, quirk_intel_mc_errata);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f9, quirk_intel_mc_errata);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65fa, quirk_intel_mc_errata);
+ 
++/*
++ * Some BIOS implementations leave the Intel GPU interrupts enabled,
++ * even though no one is handling them (f.e. i915 driver is never loaded).
++ * Additionally the interrupt destination is not set up properly
++ * and the interrupt ends up -somewhere-.
++ *
++ * These spurious interrupts are "sticky" and the kernel disables
++ * the (shared) interrupt line after 100.000+ generated interrupts.
++ *
++ * Fix it by disabling the still enabled interrupts.
++ * This resolves crashes often seen on monitor unplug.
++ */
++#define I915_DEIER_REG 0x4400c
++static void __devinit disable_igfx_irq(struct pci_dev *dev)
++{
++	void __iomem *regs = pci_iomap(dev, 0, 0);
++	if (regs == NULL) {
++		dev_warn(&dev->dev, "igfx quirk: Can't iomap PCI device\n");
++		return;
++	}
++
++	/* Check if any interrupt line is still enabled */
++	if (readl(regs + I915_DEIER_REG) != 0) {
++		dev_warn(&dev->dev, "BIOS left Intel GPU interrupts enabled; "
++			"disabling\n");
++
++		writel(0, regs + I915_DEIER_REG);
++	}
++
++	pci_iounmap(dev, regs);
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
++
+ static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
+ 			  struct pci_fixup *end)
+ {
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index d93e962..1d3bcce 100644
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -184,6 +184,34 @@ static struct dmi_system_id __devinitdata dell_quirks[] = {
+ 		},
+ 		.driver_data = &quirk_dell_vostro_v130,
+ 	},
++	{
++		.callback = dmi_matched,
++		.ident = "Dell Vostro 3555",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3555"),
++		},
++		.driver_data = &quirk_dell_vostro_v130,
++	},
++	{
++		.callback = dmi_matched,
++		.ident = "Dell Inspiron N311z",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron N311z"),
++		},
++		.driver_data = &quirk_dell_vostro_v130,
++	},
++	{
++		.callback = dmi_matched,
++		.ident = "Dell Inspiron M5110",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron M5110"),
++		},
++		.driver_data = &quirk_dell_vostro_v130,
++	},
++	{ }
+ };
+ 
+ static struct calling_interface_buffer *buffer;
+@@ -615,6 +643,7 @@ static void touchpad_led_set(struct led_classdev *led_cdev,
+ static struct led_classdev touchpad_led = {
+ 	.name = "dell-laptop::touchpad",
+ 	.brightness_set = touchpad_led_set,
++	.flags = LED_CORE_SUSPENDRESUME,
+ };
+ 
+ static int __devinit touchpad_led_init(struct device *dev)
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index 1b831c5..e48ba4b 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -192,7 +192,14 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id,
+ 	phy->attached_sata_ps   = dr->attached_sata_ps;
+ 	phy->attached_iproto = dr->iproto << 1;
+ 	phy->attached_tproto = dr->tproto << 1;
+-	memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE);
++	/* help some expanders that fail to zero sas_address in the 'no
++	 * device' case
++	 */
++	if (phy->attached_dev_type == NO_DEVICE ||
++	    phy->linkrate < SAS_LINK_RATE_1_5_GBPS)
++		memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
++	else
++		memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE);
+ 	phy->attached_phy_id = dr->attached_phy_id;
+ 	phy->phy_change_count = dr->change_count;
+ 	phy->routing_attr = dr->routing_attr;
+@@ -1643,9 +1650,17 @@ static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id,
+ 		int phy_change_count = 0;
+ 
+ 		res = sas_get_phy_change_count(dev, i, &phy_change_count);
+-		if (res)
+-			goto out;
+-		else if (phy_change_count != ex->ex_phy[i].phy_change_count) {
++		switch (res) {
++		case SMP_RESP_PHY_VACANT:
++		case SMP_RESP_NO_PHY:
++			continue;
++		case SMP_RESP_FUNC_ACC:
++			break;
++		default:
++			return res;
++		}
++
++		if (phy_change_count != ex->ex_phy[i].phy_change_count) {
+ 			if (update)
+ 				ex->ex_phy[i].phy_change_count =
+ 					phy_change_count;
+@@ -1653,8 +1668,7 @@ static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id,
+ 			return 0;
+ 		}
+ 	}
+-out:
+-	return res;
++	return 0;
+ }
+ 
+ static int sas_get_ex_change_count(struct domain_device *dev, int *ecc)
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 24cacff..5f748c0 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -139,10 +139,12 @@ static void fsl_spi_change_mode(struct spi_device *spi)
+ static void fsl_spi_chipselect(struct spi_device *spi, int value)
+ {
+ 	struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(spi->master);
+-	struct fsl_spi_platform_data *pdata = spi->dev.parent->platform_data;
++	struct fsl_spi_platform_data *pdata;
+ 	bool pol = spi->mode & SPI_CS_HIGH;
+ 	struct spi_mpc8xxx_cs	*cs = spi->controller_state;
+ 
++	pdata = spi->dev.parent->parent->platform_data;
++
+ 	if (value == BITBANG_CS_INACTIVE) {
+ 		if (pdata->cs_control)
+ 			pdata->cs_control(spi, !pol);
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 77eae99..b2ccdea 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -319,7 +319,7 @@ struct spi_device *spi_alloc_device(struct spi_master *master)
+ 	}
+ 
+ 	spi->master = master;
+-	spi->dev.parent = dev;
++	spi->dev.parent = &master->dev;
+ 	spi->dev.bus = &spi_bus_type;
+ 	spi->dev.release = spidev_release;
+ 	device_initialize(&spi->dev);
+diff --git a/drivers/staging/rtl8712/os_intfs.c b/drivers/staging/rtl8712/os_intfs.c
+index fb11743..4bb2797 100644
+--- a/drivers/staging/rtl8712/os_intfs.c
++++ b/drivers/staging/rtl8712/os_intfs.c
+@@ -476,9 +476,6 @@ static int netdev_close(struct net_device *pnetdev)
+ 	r8712_free_assoc_resources(padapter);
+ 	/*s2-4.*/
+ 	r8712_free_network_queue(padapter);
+-	release_firmware(padapter->fw);
+-	/* never exit with a firmware callback pending */
+-	wait_for_completion(&padapter->rtl8712_fw_ready);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
+index 9bade18..ec41d38 100644
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -30,6 +30,7 @@
+ 
+ #include <linux/usb.h>
+ #include <linux/module.h>
++#include <linux/firmware.h>
+ 
+ #include "osdep_service.h"
+ #include "drv_types.h"
+@@ -621,6 +622,10 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)
+ 	struct _adapter *padapter = netdev_priv(pnetdev);
+ 	struct usb_device *udev = interface_to_usbdev(pusb_intf);
+ 
++	if (padapter->fw_found)
++		release_firmware(padapter->fw);
++	/* never exit with a firmware callback pending */
++	wait_for_completion(&padapter->rtl8712_fw_ready);
+ 	usb_set_intfdata(pusb_intf, NULL);
+ 	if (padapter) {
+ 		if (drvpriv.drv_registered == true)
+diff --git a/drivers/tty/amiserial.c b/drivers/tty/amiserial.c
+index b84c834..8daf073 100644
+--- a/drivers/tty/amiserial.c
++++ b/drivers/tty/amiserial.c
+@@ -1113,8 +1113,10 @@ static int set_serial_info(struct async_struct * info,
+ 		    (new_serial.close_delay != state->close_delay) ||
+ 		    (new_serial.xmit_fifo_size != state->xmit_fifo_size) ||
+ 		    ((new_serial.flags & ~ASYNC_USR_MASK) !=
+-		     (state->flags & ~ASYNC_USR_MASK)))
++		     (state->flags & ~ASYNC_USR_MASK))) {
++			tty_unlock();
+ 			return -EPERM;
++		}
+ 		state->flags = ((state->flags & ~ASYNC_USR_MASK) |
+ 			       (new_serial.flags & ASYNC_USR_MASK));
+ 		info->flags = ((info->flags & ~ASYNC_USR_MASK) |
+diff --git a/drivers/tty/serial/clps711x.c b/drivers/tty/serial/clps711x.c
+index e6c3dbd..836fe273 100644
+--- a/drivers/tty/serial/clps711x.c
++++ b/drivers/tty/serial/clps711x.c
+@@ -154,10 +154,9 @@ static irqreturn_t clps711xuart_int_tx(int irq, void *dev_id)
+ 		port->x_char = 0;
+ 		return IRQ_HANDLED;
+ 	}
+-	if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
+-		clps711xuart_stop_tx(port);
+-		return IRQ_HANDLED;
+-	}
++
++	if (uart_circ_empty(xmit) || uart_tx_stopped(port))
++		goto disable_tx_irq;
+ 
+ 	count = port->fifosize >> 1;
+ 	do {
+@@ -171,8 +170,11 @@ static irqreturn_t clps711xuart_int_tx(int irq, void *dev_id)
+ 	if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+ 		uart_write_wakeup(port);
+ 
+-	if (uart_circ_empty(xmit))
+-		clps711xuart_stop_tx(port);
++	if (uart_circ_empty(xmit)) {
++	disable_tx_irq:
++		disable_irq_nosync(TX_IRQ(port));
++		tx_enabled(port) = 0;
++	}
+ 
+ 	return IRQ_HANDLED;
+ }
+diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
+index da776a0..a4b192d 100644
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -1356,9 +1356,11 @@ static int pch_uart_verify_port(struct uart_port *port,
+ 			__func__);
+ 		return -EOPNOTSUPP;
+ #endif
+-		priv->use_dma = 1;
+ 		priv->use_dma_flag = 1;
+ 		dev_info(priv->port.dev, "PCH UART : Use DMA Mode\n");
++		if (!priv->use_dma)
++			pch_request_dma(port);
++		priv->use_dma = 1;
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 9eb71d8..2db0327 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -108,8 +108,9 @@ static void wdm_out_callback(struct urb *urb)
+ 	spin_lock(&desc->iuspin);
+ 	desc->werr = urb->status;
+ 	spin_unlock(&desc->iuspin);
+-	clear_bit(WDM_IN_USE, &desc->flags);
+ 	kfree(desc->outbuf);
++	desc->outbuf = NULL;
++	clear_bit(WDM_IN_USE, &desc->flags);
+ 	wake_up(&desc->wait);
+ }
+ 
+@@ -312,7 +313,7 @@ static ssize_t wdm_write
+ 	if (we < 0)
+ 		return -EIO;
+ 
+-	desc->outbuf = buf = kmalloc(count, GFP_KERNEL);
++	buf = kmalloc(count, GFP_KERNEL);
+ 	if (!buf) {
+ 		rv = -ENOMEM;
+ 		goto outnl;
+@@ -376,10 +377,12 @@ static ssize_t wdm_write
+ 	req->wIndex = desc->inum;
+ 	req->wLength = cpu_to_le16(count);
+ 	set_bit(WDM_IN_USE, &desc->flags);
++	desc->outbuf = buf;
+ 
+ 	rv = usb_submit_urb(desc->command, GFP_KERNEL);
+ 	if (rv < 0) {
+ 		kfree(buf);
++		desc->outbuf = NULL;
+ 		clear_bit(WDM_IN_USE, &desc->flags);
+ 		dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
+ 	} else {
+diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
+index 61d08dd..5f1404a 100644
+--- a/drivers/usb/core/hcd-pci.c
++++ b/drivers/usb/core/hcd-pci.c
+@@ -495,6 +495,15 @@ static int hcd_pci_suspend_noirq(struct device *dev)
+ 
+ 	pci_save_state(pci_dev);
+ 
++	/*
++	 * Some systems crash if an EHCI controller is in D3 during
++	 * a sleep transition.  We have to leave such controllers in D0.
++	 */
++	if (hcd->broken_pci_sleep) {
++		dev_dbg(dev, "Staying in PCI D0\n");
++		return retval;
++	}
++
+ 	/* If the root hub is dead rather than suspended, disallow remote
+ 	 * wakeup.  usb_hc_died() should ensure that both hosts are marked as
+ 	 * dying, so we only need to check the primary roothub.
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index e238b3b..2b0a341 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1644,7 +1644,6 @@ void usb_disconnect(struct usb_device **pdev)
+ {
+ 	struct usb_device	*udev = *pdev;
+ 	int			i;
+-	struct usb_hcd		*hcd = bus_to_hcd(udev->bus);
+ 
+ 	/* mark the device as inactive, so any further urb submissions for
+ 	 * this device (and any of its children) will fail immediately.
+@@ -1667,9 +1666,7 @@ void usb_disconnect(struct usb_device **pdev)
+ 	 * so that the hardware is now fully quiesced.
+ 	 */
+ 	dev_dbg (&udev->dev, "unregistering device\n");
+-	mutex_lock(hcd->bandwidth_mutex);
+ 	usb_disable_device(udev, 0);
+-	mutex_unlock(hcd->bandwidth_mutex);
+ 	usb_hcd_synchronize_unlinks(udev);
+ 
+ 	usb_remove_ep_devs(&udev->ep0);
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index aed3e07..ca717da 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1136,8 +1136,6 @@ void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf,
+  * Deallocates hcd/hardware state for the endpoints (nuking all or most
+  * pending urbs) and usbcore state for the interfaces, so that usbcore
+  * must usb_set_configuration() before any interfaces could be used.
+- *
+- * Must be called with hcd->bandwidth_mutex held.
+  */
+ void usb_disable_device(struct usb_device *dev, int skip_ep0)
+ {
+@@ -1190,7 +1188,9 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
+ 			usb_disable_endpoint(dev, i + USB_DIR_IN, false);
+ 		}
+ 		/* Remove endpoints from the host controller internal state */
++		mutex_lock(hcd->bandwidth_mutex);
+ 		usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
++		mutex_unlock(hcd->bandwidth_mutex);
+ 		/* Second pass: remove endpoint pointers */
+ 	}
+ 	for (i = skip_ep0; i < 16; ++i) {
+@@ -1750,7 +1750,6 @@ free_interfaces:
+ 	/* if it's already configured, clear out old state first.
+ 	 * getting rid of old interfaces means unbinding their drivers.
+ 	 */
+-	mutex_lock(hcd->bandwidth_mutex);
+ 	if (dev->state != USB_STATE_ADDRESS)
+ 		usb_disable_device(dev, 1);	/* Skip ep0 */
+ 
+@@ -1763,6 +1762,7 @@ free_interfaces:
+ 	 * host controller will not allow submissions to dropped endpoints.  If
+ 	 * this call fails, the device state is unchanged.
+ 	 */
++	mutex_lock(hcd->bandwidth_mutex);
+ 	ret = usb_hcd_alloc_bandwidth(dev, cp, NULL, NULL);
+ 	if (ret < 0) {
+ 		mutex_unlock(hcd->bandwidth_mutex);
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index 27bd50a..c0dcf69 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -572,9 +572,10 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
+ 		dwc->ep0_bounced = false;
+ 	} else {
+ 		transferred = ur->length - trb.length;
+-		ur->actual += transferred;
+ 	}
+ 
++	ur->actual += transferred;
++
+ 	if ((epnum & 1) && ur->actual < ur->length) {
+ 		/* for some reason we did not get everything out */
+ 
+diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
+index ab8f1b4..527736e 100644
+--- a/drivers/usb/gadget/dummy_hcd.c
++++ b/drivers/usb/gadget/dummy_hcd.c
+@@ -925,7 +925,6 @@ static int dummy_udc_stop(struct usb_gadget *g,
+ 
+ 	dum->driver = NULL;
+ 
+-	dummy_pullup(&dum->gadget, 0);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
+index acb3800..0e641a1 100644
+--- a/drivers/usb/gadget/f_fs.c
++++ b/drivers/usb/gadget/f_fs.c
+@@ -712,7 +712,7 @@ static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
+ 	if (code == FUNCTIONFS_INTERFACE_REVMAP) {
+ 		struct ffs_function *func = ffs->func;
+ 		ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
+-	} else if (gadget->ops->ioctl) {
++	} else if (gadget && gadget->ops->ioctl) {
+ 		ret = gadget->ops->ioctl(gadget, code, value);
+ 	} else {
+ 		ret = -ENOTTY;
+diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
+index 1a6f415..a5570b6 100644
+--- a/drivers/usb/gadget/f_mass_storage.c
++++ b/drivers/usb/gadget/f_mass_storage.c
+@@ -2182,7 +2182,7 @@ unknown_cmnd:
+ 		common->data_size_from_cmnd = 0;
+ 		sprintf(unknown, "Unknown x%02x", common->cmnd[0]);
+ 		reply = check_command(common, common->cmnd_size,
+-				      DATA_DIR_UNKNOWN, 0xff, 0, unknown);
++				      DATA_DIR_UNKNOWN, ~0, 0, unknown);
+ 		if (reply == 0) {
+ 			common->curlun->sense_data = SS_INVALID_COMMAND;
+ 			reply = -EINVAL;
+diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
+index 11b5196..db2d607 100644
+--- a/drivers/usb/gadget/file_storage.c
++++ b/drivers/usb/gadget/file_storage.c
+@@ -2569,7 +2569,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
+ 		fsg->data_size_from_cmnd = 0;
+ 		sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
+ 		if ((reply = check_command(fsg, fsg->cmnd_size,
+-				DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) {
++				DATA_DIR_UNKNOWN, ~0, 0, unknown)) == 0) {
+ 			fsg->curlun->sense_data = SS_INVALID_COMMAND;
+ 			reply = -EINVAL;
+ 		}
+diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
+index 6939e17..901924a 100644
+--- a/drivers/usb/gadget/udc-core.c
++++ b/drivers/usb/gadget/udc-core.c
+@@ -211,9 +211,9 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
+ 
+ 	if (udc_is_newstyle(udc)) {
+ 		udc->driver->disconnect(udc->gadget);
++		usb_gadget_disconnect(udc->gadget);
+ 		udc->driver->unbind(udc->gadget);
+ 		usb_gadget_udc_stop(udc->gadget, udc->driver);
+-		usb_gadget_disconnect(udc->gadget);
+ 	} else {
+ 		usb_gadget_stop(udc->gadget, udc->driver);
+ 	}
+@@ -359,9 +359,13 @@ static ssize_t usb_udc_softconn_store(struct device *dev,
+ 	struct usb_udc		*udc = container_of(dev, struct usb_udc, dev);
+ 
+ 	if (sysfs_streq(buf, "connect")) {
++		if (udc_is_newstyle(udc))
++			usb_gadget_udc_start(udc->gadget, udc->driver);
+ 		usb_gadget_connect(udc->gadget);
+ 	} else if (sysfs_streq(buf, "disconnect")) {
+ 		usb_gadget_disconnect(udc->gadget);
++		if (udc_is_newstyle(udc))
++			usb_gadget_udc_stop(udc->gadget, udc->driver);
+ 	} else {
+ 		dev_err(dev, "unsupported command '%s'\n", buf);
+ 		return -EINVAL;
+diff --git a/drivers/usb/gadget/uvc.h b/drivers/usb/gadget/uvc.h
+index bc78c60..ca4e03a 100644
+--- a/drivers/usb/gadget/uvc.h
++++ b/drivers/usb/gadget/uvc.h
+@@ -28,7 +28,7 @@
+ 
+ struct uvc_request_data
+ {
+-	unsigned int length;
++	__s32 length;
+ 	__u8 data[60];
+ };
+ 
+diff --git a/drivers/usb/gadget/uvc_v4l2.c b/drivers/usb/gadget/uvc_v4l2.c
+index f6e083b..54d7ca5 100644
+--- a/drivers/usb/gadget/uvc_v4l2.c
++++ b/drivers/usb/gadget/uvc_v4l2.c
+@@ -39,7 +39,7 @@ uvc_send_response(struct uvc_device *uvc, struct uvc_request_data *data)
+ 	if (data->length < 0)
+ 		return usb_ep_set_halt(cdev->gadget->ep0);
+ 
+-	req->length = min(uvc->event_length, data->length);
++	req->length = min_t(unsigned int, uvc->event_length, data->length);
+ 	req->zero = data->length < uvc->event_length;
+ 	req->dma = DMA_ADDR_INVALID;
+ 
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index 3ff9f82..da2f711 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -815,8 +815,13 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
+ 		goto dead;
+ 	}
+ 
++	/*
++	 * We don't use STS_FLR, but some controllers don't like it to
++	 * remain on, so mask it out along with the other status bits.
++	 */
++	masked_status = status & (INTR_MASK | STS_FLR);
++
+ 	/* Shared IRQ? */
+-	masked_status = status & INTR_MASK;
+ 	if (!masked_status || unlikely(ehci->rh_state == EHCI_RH_HALTED)) {
+ 		spin_unlock(&ehci->lock);
+ 		return IRQ_NONE;
+@@ -867,7 +872,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
+ 		pcd_status = status;
+ 
+ 		/* resume root hub? */
+-		if (!(cmd & CMD_RUN))
++		if (ehci->rh_state == EHCI_RH_SUSPENDED)
+ 			usb_hcd_resume_root_hub(hcd);
+ 
+ 		/* get per-port change detect bits */
+diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
+index f4b627d..971d312 100644
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -144,6 +144,14 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
+ 			hcd->has_tt = 1;
+ 			tdi_reset(ehci);
+ 		}
++		if (pdev->subsystem_vendor == PCI_VENDOR_ID_ASUSTEK) {
++			/* EHCI #1 or #2 on 6 Series/C200 Series chipset */
++			if (pdev->device == 0x1c26 || pdev->device == 0x1c2d) {
++				ehci_info(ehci, "broken D3 during system sleep on ASUS\n");
++				hcd->broken_pci_sleep = 1;
++				device_set_wakeup_capable(&pdev->dev, false);
++			}
++		}
+ 		break;
+ 	case PCI_VENDOR_ID_TDI:
+ 		if (pdev->device == PCI_DEVICE_ID_TDI_EHCI) {
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index ac5bfd6..2504694 100644
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -99,9 +99,7 @@ static void yurex_delete(struct kref *kref)
+ 	usb_put_dev(dev->udev);
+ 	if (dev->cntl_urb) {
+ 		usb_kill_urb(dev->cntl_urb);
+-		if (dev->cntl_req)
+-			usb_free_coherent(dev->udev, YUREX_BUF_SIZE,
+-				dev->cntl_req, dev->cntl_urb->setup_dma);
++		kfree(dev->cntl_req);
+ 		if (dev->cntl_buffer)
+ 			usb_free_coherent(dev->udev, YUREX_BUF_SIZE,
+ 				dev->cntl_buffer, dev->cntl_urb->transfer_dma);
+@@ -234,9 +232,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_
+ 	}
+ 
+ 	/* allocate buffer for control req */
+-	dev->cntl_req = usb_alloc_coherent(dev->udev, YUREX_BUF_SIZE,
+-					   GFP_KERNEL,
+-					   &dev->cntl_urb->setup_dma);
++	dev->cntl_req = kmalloc(YUREX_BUF_SIZE, GFP_KERNEL);
+ 	if (!dev->cntl_req) {
+ 		err("Could not allocate cntl_req");
+ 		goto error;
+@@ -286,7 +282,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_
+ 			 usb_rcvintpipe(dev->udev, dev->int_in_endpointAddr),
+ 			 dev->int_buffer, YUREX_BUF_SIZE, yurex_interrupt,
+ 			 dev, 1);
+-	dev->cntl_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
++	dev->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+ 	if (usb_submit_urb(dev->urb, GFP_KERNEL)) {
+ 		retval = -EIO;
+ 		err("Could not submitting URB");
+diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
+index ba85f27..a8f0c09 100644
+--- a/drivers/usb/musb/omap2430.c
++++ b/drivers/usb/musb/omap2430.c
+@@ -282,7 +282,8 @@ static int musb_otg_notifications(struct notifier_block *nb,
+ 
+ static int omap2430_musb_init(struct musb *musb)
+ {
+-	u32 l, status = 0;
++	u32 l;
++	int status = 0;
+ 	struct device *dev = musb->controller;
+ 	struct musb_hdrc_platform_data *plat = dev->platform_data;
+ 	struct omap_musb_board_data *data = plat->board_data;
+@@ -299,7 +300,7 @@ static int omap2430_musb_init(struct musb *musb)
+ 
+ 	status = pm_runtime_get_sync(dev);
+ 	if (status < 0) {
+-		dev_err(dev, "pm_runtime_get_sync FAILED");
++		dev_err(dev, "pm_runtime_get_sync FAILED %d\n", status);
+ 		goto err1;
+ 	}
+ 
+@@ -451,14 +452,14 @@ static int __init omap2430_probe(struct platform_device *pdev)
+ 		goto err2;
+ 	}
+ 
++	pm_runtime_enable(&pdev->dev);
++
+ 	ret = platform_device_add(musb);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "failed to register musb device\n");
+ 		goto err2;
+ 	}
+ 
+-	pm_runtime_enable(&pdev->dev);
+-
+ 	return 0;
+ 
+ err2:
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 4c12404..f2c57e0 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -285,7 +285,8 @@ static int cp210x_get_config(struct usb_serial_port *port, u8 request,
+ 	/* Issue the request, attempting to read 'size' bytes */
+ 	result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
+ 				request, REQTYPE_DEVICE_TO_HOST, 0x0000,
+-				port_priv->bInterfaceNumber, buf, size, 300);
++				port_priv->bInterfaceNumber, buf, size,
++				USB_CTRL_GET_TIMEOUT);
+ 
+ 	/* Convert data into an array of integers */
+ 	for (i = 0; i < length; i++)
+@@ -335,12 +336,14 @@ static int cp210x_set_config(struct usb_serial_port *port, u8 request,
+ 		result = usb_control_msg(serial->dev,
+ 				usb_sndctrlpipe(serial->dev, 0),
+ 				request, REQTYPE_HOST_TO_DEVICE, 0x0000,
+-				port_priv->bInterfaceNumber, buf, size, 300);
++				port_priv->bInterfaceNumber, buf, size,
++				USB_CTRL_SET_TIMEOUT);
+ 	} else {
+ 		result = usb_control_msg(serial->dev,
+ 				usb_sndctrlpipe(serial->dev, 0),
+ 				request, REQTYPE_HOST_TO_DEVICE, data[0],
+-				port_priv->bInterfaceNumber, NULL, 0, 300);
++				port_priv->bInterfaceNumber, NULL, 0,
++				USB_CTRL_SET_TIMEOUT);
+ 	}
+ 
+ 	kfree(buf);
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index 7c3ec9e..e093585 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -221,7 +221,7 @@ static const struct sierra_iface_info typeB_interface_list = {
+ };
+ 
+ /* 'blacklist' of interfaces not served by this driver */
+-static const u8 direct_ip_non_serial_ifaces[] = { 7, 8, 9, 10, 11 };
++static const u8 direct_ip_non_serial_ifaces[] = { 7, 8, 9, 10, 11, 19, 20 };
+ static const struct sierra_iface_info direct_ip_interface_blacklist = {
+ 	.infolen = ARRAY_SIZE(direct_ip_non_serial_ifaces),
+ 	.ifaceinfo = direct_ip_non_serial_ifaces,
+@@ -289,7 +289,6 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x1199, 0x6856) },	/* Sierra Wireless AirCard 881 U */
+ 	{ USB_DEVICE(0x1199, 0x6859) },	/* Sierra Wireless AirCard 885 E */
+ 	{ USB_DEVICE(0x1199, 0x685A) },	/* Sierra Wireless AirCard 885 E */
+-	{ USB_DEVICE(0x1199, 0x68A2) }, /* Sierra Wireless MC7710 */
+ 	/* Sierra Wireless C885 */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6880, 0xFF, 0xFF, 0xFF)},
+ 	/* Sierra Wireless C888, Air Card 501, USB 303, USB 304 */
+@@ -299,6 +298,9 @@ static const struct usb_device_id id_table[] = {
+ 	/* Sierra Wireless HSPA Non-Composite Device */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6892, 0xFF, 0xFF, 0xFF)},
+ 	{ USB_DEVICE(0x1199, 0x6893) },	/* Sierra Wireless Device */
++	{ USB_DEVICE(0x1199, 0x68A2),   /* Sierra Wireless MC77xx in QMI mode */
++	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
++	},
+ 	{ USB_DEVICE(0x1199, 0x68A3), 	/* Sierra Wireless Direct IP modems */
+ 	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ 	},
+diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
+index 2babcd4..86685e9 100644
+--- a/drivers/uwb/hwa-rc.c
++++ b/drivers/uwb/hwa-rc.c
+@@ -645,7 +645,8 @@ void hwarc_neep_cb(struct urb *urb)
+ 		dev_err(dev, "NEEP: URB error %d\n", urb->status);
+ 	}
+ 	result = usb_submit_urb(urb, GFP_ATOMIC);
+-	if (result < 0) {
++	if (result < 0 && result != -ENODEV && result != -EPERM) {
++		/* ignoring unrecoverable errors */
+ 		dev_err(dev, "NEEP: Can't resubmit URB (%d) resetting device\n",
+ 			result);
+ 		goto error;
+diff --git a/drivers/uwb/neh.c b/drivers/uwb/neh.c
+index a269937..8cb71bb 100644
+--- a/drivers/uwb/neh.c
++++ b/drivers/uwb/neh.c
+@@ -107,6 +107,7 @@ struct uwb_rc_neh {
+ 	u8 evt_type;
+ 	__le16 evt;
+ 	u8 context;
++	u8 completed;
+ 	uwb_rc_cmd_cb_f cb;
+ 	void *arg;
+ 
+@@ -409,6 +410,7 @@ static void uwb_rc_neh_grok_event(struct uwb_rc *rc, struct uwb_rceb *rceb, size
+ 	struct device *dev = &rc->uwb_dev.dev;
+ 	struct uwb_rc_neh *neh;
+ 	struct uwb_rceb *notif;
++	unsigned long flags;
+ 
+ 	if (rceb->bEventContext == 0) {
+ 		notif = kmalloc(size, GFP_ATOMIC);
+@@ -422,7 +424,11 @@ static void uwb_rc_neh_grok_event(struct uwb_rc *rc, struct uwb_rceb *rceb, size
+ 	} else {
+ 		neh = uwb_rc_neh_lookup(rc, rceb);
+ 		if (neh) {
+-			del_timer_sync(&neh->timer);
++			spin_lock_irqsave(&rc->neh_lock, flags);
++			/* to guard against a timeout */
++			neh->completed = 1;
++			del_timer(&neh->timer);
++			spin_unlock_irqrestore(&rc->neh_lock, flags);
+ 			uwb_rc_neh_cb(neh, rceb, size);
+ 		} else
+ 			dev_warn(dev, "event 0x%02x/%04x/%02x (%zu bytes): nobody cared\n",
+@@ -568,6 +574,10 @@ static void uwb_rc_neh_timer(unsigned long arg)
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&rc->neh_lock, flags);
++	if (neh->completed) {
++		spin_unlock_irqrestore(&rc->neh_lock, flags);
++		return;
++	}
+ 	if (neh->context)
+ 		__uwb_rc_neh_rm(rc, neh);
+ 	else
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
+index afca14d..625890c 100644
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -692,7 +692,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
+ 	vma->vm_flags |= VM_RESERVED|VM_DONTEXPAND;
+ 
+ 	if (use_ptemod)
+-		vma->vm_flags |= VM_DONTCOPY|VM_PFNMAP;
++		vma->vm_flags |= VM_DONTCOPY;
+ 
+ 	vma->vm_private_data = map;
+ 
+diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
+index 2f73195..2ce95c0 100644
+--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
+@@ -129,7 +129,7 @@ static int read_backend_details(struct xenbus_device *xendev)
+ 	return xenbus_read_otherend_details(xendev, "backend-id", "backend");
+ }
+ 
+-static int is_device_connecting(struct device *dev, void *data)
++static int is_device_connecting(struct device *dev, void *data, bool ignore_nonessential)
+ {
+ 	struct xenbus_device *xendev = to_xenbus_device(dev);
+ 	struct device_driver *drv = data;
+@@ -146,16 +146,41 @@ static int is_device_connecting(struct device *dev, void *data)
+ 	if (drv && (dev->driver != drv))
+ 		return 0;
+ 
++	if (ignore_nonessential) {
++		/* With older QEMU, for PVonHVM guests the guest config files
++		 * could contain: vfb = [ 'vnc=1, vnclisten=0.0.0.0']
++		 * which is nonsensical as there is no PV FB (there can be
++		 * a PVKB) running as HVM guest. */
++
++		if ((strncmp(xendev->nodename, "device/vkbd", 11) == 0))
++			return 0;
++
++		if ((strncmp(xendev->nodename, "device/vfb", 10) == 0))
++			return 0;
++	}
+ 	xendrv = to_xenbus_driver(dev->driver);
+ 	return (xendev->state < XenbusStateConnected ||
+ 		(xendev->state == XenbusStateConnected &&
+ 		 xendrv->is_ready && !xendrv->is_ready(xendev)));
+ }
++static int essential_device_connecting(struct device *dev, void *data)
++{
++	return is_device_connecting(dev, data, true /* ignore PV[KBB+FB] */);
++}
++static int non_essential_device_connecting(struct device *dev, void *data)
++{
++	return is_device_connecting(dev, data, false);
++}
+ 
+-static int exists_connecting_device(struct device_driver *drv)
++static int exists_essential_connecting_device(struct device_driver *drv)
+ {
+ 	return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
+-				is_device_connecting);
++				essential_device_connecting);
++}
++static int exists_non_essential_connecting_device(struct device_driver *drv)
++{
++	return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
++				non_essential_device_connecting);
+ }
+ 
+ static int print_device_status(struct device *dev, void *data)
+@@ -186,6 +211,23 @@ static int print_device_status(struct device *dev, void *data)
+ /* We only wait for device setup after most initcalls have run. */
+ static int ready_to_wait_for_devices;
+ 
++static bool wait_loop(unsigned long start, unsigned int max_delay,
++		     unsigned int *seconds_waited)
++{
++	if (time_after(jiffies, start + (*seconds_waited+5)*HZ)) {
++		if (!*seconds_waited)
++			printk(KERN_WARNING "XENBUS: Waiting for "
++			       "devices to initialise: ");
++		*seconds_waited += 5;
++		printk("%us...", max_delay - *seconds_waited);
++		if (*seconds_waited == max_delay)
++			return true;
++	}
++
++	schedule_timeout_interruptible(HZ/10);
++
++	return false;
++}
+ /*
+  * On a 5-minute timeout, wait for all devices currently configured.  We need
+  * to do this to guarantee that the filesystems and / or network devices
+@@ -209,19 +251,14 @@ static void wait_for_devices(struct xenbus_driver *xendrv)
+ 	if (!ready_to_wait_for_devices || !xen_domain())
+ 		return;
+ 
+-	while (exists_connecting_device(drv)) {
+-		if (time_after(jiffies, start + (seconds_waited+5)*HZ)) {
+-			if (!seconds_waited)
+-				printk(KERN_WARNING "XENBUS: Waiting for "
+-				       "devices to initialise: ");
+-			seconds_waited += 5;
+-			printk("%us...", 300 - seconds_waited);
+-			if (seconds_waited == 300)
+-				break;
+-		}
+-
+-		schedule_timeout_interruptible(HZ/10);
+-	}
++	while (exists_non_essential_connecting_device(drv))
++		if (wait_loop(start, 30, &seconds_waited))
++			break;
++
++	/* Skips PVKB and PVFB check.*/
++	while (exists_essential_connecting_device(drv))
++		if (wait_loop(start, 270, &seconds_waited))
++			break;
+ 
+ 	if (seconds_waited)
+ 		printk("\n");
+diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
+index 308a98b..650d520 100644
+--- a/fs/autofs4/autofs_i.h
++++ b/fs/autofs4/autofs_i.h
+@@ -110,7 +110,6 @@ struct autofs_sb_info {
+ 	int sub_version;
+ 	int min_proto;
+ 	int max_proto;
+-	int compat_daemon;
+ 	unsigned long exp_timeout;
+ 	unsigned int type;
+ 	int reghost_enabled;
+@@ -269,6 +268,17 @@ int autofs4_fill_super(struct super_block *, void *, int);
+ struct autofs_info *autofs4_new_ino(struct autofs_sb_info *);
+ void autofs4_clean_ino(struct autofs_info *);
+ 
++static inline int autofs_prepare_pipe(struct file *pipe)
++{
++	if (!pipe->f_op || !pipe->f_op->write)
++		return -EINVAL;
++	if (!S_ISFIFO(pipe->f_dentry->d_inode->i_mode))
++		return -EINVAL;
++	/* We want a packet pipe */
++	pipe->f_flags |= O_DIRECT;
++	return 0;
++}
++
+ /* Queue management functions */
+ 
+ int autofs4_wait(struct autofs_sb_info *,struct dentry *, enum autofs_notify);
+diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
+index 56bac70..de54271 100644
+--- a/fs/autofs4/dev-ioctl.c
++++ b/fs/autofs4/dev-ioctl.c
+@@ -376,7 +376,7 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
+ 			err = -EBADF;
+ 			goto out;
+ 		}
+-		if (!pipe->f_op || !pipe->f_op->write) {
++		if (autofs_prepare_pipe(pipe) < 0) {
+ 			err = -EPIPE;
+ 			fput(pipe);
+ 			goto out;
+@@ -385,7 +385,6 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
+ 		sbi->pipefd = pipefd;
+ 		sbi->pipe = pipe;
+ 		sbi->catatonic = 0;
+-		sbi->compat_daemon = is_compat_task();
+ 	}
+ out:
+ 	mutex_unlock(&sbi->wq_mutex);
+diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
+index 98a5695..7b5293e 100644
+--- a/fs/autofs4/inode.c
++++ b/fs/autofs4/inode.c
+@@ -19,7 +19,6 @@
+ #include <linux/parser.h>
+ #include <linux/bitops.h>
+ #include <linux/magic.h>
+-#include <linux/compat.h>
+ #include "autofs_i.h"
+ #include <linux/module.h>
+ 
+@@ -225,7 +224,6 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
+ 	set_autofs_type_indirect(&sbi->type);
+ 	sbi->min_proto = 0;
+ 	sbi->max_proto = 0;
+-	sbi->compat_daemon = is_compat_task();
+ 	mutex_init(&sbi->wq_mutex);
+ 	spin_lock_init(&sbi->fs_lock);
+ 	sbi->queues = NULL;
+@@ -294,7 +292,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
+ 		printk("autofs: could not open pipe file descriptor\n");
+ 		goto fail_dput;
+ 	}
+-	if (!pipe->f_op || !pipe->f_op->write)
++	if (autofs_prepare_pipe(pipe) < 0)
+ 		goto fail_fput;
+ 	sbi->pipe = pipe;
+ 	sbi->pipefd = pipefd;
+diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
+index 6861f61..e1fbdee 100644
+--- a/fs/autofs4/waitq.c
++++ b/fs/autofs4/waitq.c
+@@ -90,24 +90,7 @@ static int autofs4_write(struct file *file, const void *addr, int bytes)
+ 
+ 	return (bytes > 0);
+ }
+-
+-/*
+- * The autofs_v5 packet was misdesigned.
+- *
+- * The packets are identical on x86-32 and x86-64, but have different
+- * alignment. Which means that 'sizeof()' will give different results.
+- * Fix it up for the case of running 32-bit user mode on a 64-bit kernel.
+- */
+-static noinline size_t autofs_v5_packet_size(struct autofs_sb_info *sbi)
+-{
+-	size_t pktsz = sizeof(struct autofs_v5_packet);
+-#if defined(CONFIG_X86_64) && defined(CONFIG_COMPAT)
+-	if (sbi->compat_daemon > 0)
+-		pktsz -= 4;
+-#endif
+-	return pktsz;
+-}
+-
++	
+ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
+ 				 struct autofs_wait_queue *wq,
+ 				 int type)
+@@ -164,7 +147,8 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
+ 	{
+ 		struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet;
+ 
+-		pktsz = autofs_v5_packet_size(sbi);
++		pktsz = sizeof(*packet);
++
+ 		packet->wait_queue_token = wq->wait_queue_token;
+ 		packet->len = wq->name.len;
+ 		memcpy(packet->name, wq->name.name, wq->name.len);
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 6738503..83a871f 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -2025,7 +2025,7 @@ BTRFS_SETGET_STACK_FUNCS(root_last_snapshot, struct btrfs_root_item,
+ 
+ static inline bool btrfs_root_readonly(struct btrfs_root *root)
+ {
+-	return root->root_item.flags & BTRFS_ROOT_SUBVOL_RDONLY;
++	return (root->root_item.flags & cpu_to_le64(BTRFS_ROOT_SUBVOL_RDONLY)) != 0;
+ }
+ 
+ /* struct btrfs_root_backup */
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index 0e6adac..e89803b 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -4826,8 +4826,12 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
+ 		max_len = data_end - temp;
+ 		node->node_name = cifs_strndup_from_ucs(temp, max_len,
+ 						      is_unicode, nls_codepage);
+-		if (!node->node_name)
++		if (!node->node_name) {
+ 			rc = -ENOMEM;
++			goto parse_DFS_referrals_exit;
++		}
++
++		ref++;
+ 	}
+ 
+ parse_DFS_referrals_exit:
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index ea54cde..4d9d3a4 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -988,6 +988,10 @@ static int path_count[PATH_ARR_SIZE];
+ 
+ static int path_count_inc(int nests)
+ {
++	/* Allow an arbitrary number of depth 1 paths */
++	if (nests == 0)
++		return 0;
++
+ 	if (++path_count[nests] > path_limits[nests])
+ 		return -1;
+ 	return 0;
+diff --git a/fs/exec.c b/fs/exec.c
+index 3625464..160cd2f 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -973,6 +973,9 @@ static int de_thread(struct task_struct *tsk)
+ 	sig->notify_count = 0;
+ 
+ no_thread_group:
++	/* we have changed execution domain */
++	tsk->exit_signal = SIGCHLD;
++
+ 	if (current->mm)
+ 		setmax_mm_hiwater_rss(&sig->maxrss, current->mm);
+ 
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index c2a2012..54f2bdc 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -2812,7 +2812,7 @@ static int ext4_split_extent_at(handle_t *handle,
+ 		if (err)
+ 			goto fix_extent_len;
+ 		/* update the extent length and mark as initialized */
+-		ex->ee_len = cpu_to_le32(ee_len);
++		ex->ee_len = cpu_to_le16(ee_len);
+ 		ext4_ext_try_to_merge(inode, path, ex);
+ 		err = ext4_ext_dirty(handle, inode, path + depth);
+ 		goto out;
+diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
+index 4dfbfec..ec2a9c2 100644
+--- a/fs/hfsplus/catalog.c
++++ b/fs/hfsplus/catalog.c
+@@ -366,6 +366,10 @@ int hfsplus_rename_cat(u32 cnid,
+ 	err = hfs_brec_find(&src_fd);
+ 	if (err)
+ 		goto out;
++	if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
++		err = -EIO;
++		goto out;
++	}
+ 
+ 	hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
+ 				src_fd.entrylength);
+diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
+index 4536cd3..5adb740 100644
+--- a/fs/hfsplus/dir.c
++++ b/fs/hfsplus/dir.c
+@@ -150,6 +150,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ 		filp->f_pos++;
+ 		/* fall through */
+ 	case 1:
++		if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
++			err = -EIO;
++			goto out;
++		}
++
+ 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
+ 			fd.entrylength);
+ 		if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) {
+@@ -181,6 +186,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ 			err = -EIO;
+ 			goto out;
+ 		}
++
++		if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
++			err = -EIO;
++			goto out;
++		}
++
+ 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
+ 			fd.entrylength);
+ 		type = be16_to_cpu(entry.type);
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index 68d704d..d751f04 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -683,7 +683,7 @@ start_journal_io:
+ 	if (commit_transaction->t_need_data_flush &&
+ 	    (journal->j_fs_dev != journal->j_dev) &&
+ 	    (journal->j_flags & JBD2_BARRIER))
+-		blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
++		blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
+ 
+ 	/* Done it all: now write the commit record asynchronously. */
+ 	if (JBD2_HAS_INCOMPAT_FEATURE(journal,
+@@ -819,7 +819,7 @@ wait_for_iobuf:
+ 	if (JBD2_HAS_INCOMPAT_FEATURE(journal,
+ 				      JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT) &&
+ 	    journal->j_flags & JBD2_BARRIER) {
+-		blkdev_issue_flush(journal->j_dev, GFP_KERNEL, NULL);
++		blkdev_issue_flush(journal->j_dev, GFP_NOFS, NULL);
+ 	}
+ 
+ 	if (err)
+diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c
+index f848b52..046bb77 100644
+--- a/fs/lockd/clnt4xdr.c
++++ b/fs/lockd/clnt4xdr.c
+@@ -241,7 +241,7 @@ static int decode_nlm4_stat(struct xdr_stream *xdr, __be32 *stat)
+ 	p = xdr_inline_decode(xdr, 4);
+ 	if (unlikely(p == NULL))
+ 		goto out_overflow;
+-	if (unlikely(*p > nlm4_failed))
++	if (unlikely(ntohl(*p) > ntohl(nlm4_failed)))
+ 		goto out_bad_xdr;
+ 	*stat = *p;
+ 	return 0;
+diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c
+index 180ac34..36057ce 100644
+--- a/fs/lockd/clntxdr.c
++++ b/fs/lockd/clntxdr.c
+@@ -236,7 +236,7 @@ static int decode_nlm_stat(struct xdr_stream *xdr,
+ 	p = xdr_inline_decode(xdr, 4);
+ 	if (unlikely(p == NULL))
+ 		goto out_overflow;
+-	if (unlikely(*p > nlm_lck_denied_grace_period))
++	if (unlikely(ntohl(*p) > ntohl(nlm_lck_denied_grace_period)))
+ 		goto out_enum;
+ 	*stat = *p;
+ 	return 0;
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 757293b..51f6a40 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -4453,7 +4453,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
+ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {
++		.inode = state->inode,
++	};
+ 	int err;
+ 
+ 	do {
+@@ -4471,7 +4473,9 @@ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request
+ static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {
++		.inode = state->inode,
++	};
+ 	int err;
+ 
+ 	err = nfs4_set_lock_state(state, request);
+@@ -4551,6 +4555,7 @@ static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *
+ {
+ 	struct nfs4_exception exception = {
+ 		.state = state,
++		.inode = state->inode,
+ 	};
+ 	int err;
+ 
+@@ -4596,6 +4601,20 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request)
+ 
+ 	if (state == NULL)
+ 		return -ENOLCK;
++	/*
++	 * Don't rely on the VFS having checked the file open mode,
++	 * since it won't do this for flock() locks.
++	 */
++	switch (request->fl_type & (F_RDLCK|F_WRLCK|F_UNLCK)) {
++	case F_RDLCK:
++		if (!(filp->f_mode & FMODE_READ))
++			return -EBADF;
++		break;
++	case F_WRLCK:
++		if (!(filp->f_mode & FMODE_WRITE))
++			return -EBADF;
++	}
++
+ 	do {
+ 		status = nfs4_proc_setlk(state, cmd, request);
+ 		if ((status != -EAGAIN) || IS_SETLK(cmd))
+diff --git a/fs/nfs/read.c b/fs/nfs/read.c
+index cfa175c..41bae32 100644
+--- a/fs/nfs/read.c
++++ b/fs/nfs/read.c
+@@ -324,7 +324,7 @@ out_bad:
+ 	while (!list_empty(res)) {
+ 		data = list_entry(res->next, struct nfs_read_data, list);
+ 		list_del(&data->list);
+-		nfs_readdata_free(data);
++		nfs_readdata_release(data);
+ 	}
+ 	nfs_readpage_release(req);
+ 	return -ENOMEM;
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 3ada13c..376cd65 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -2708,11 +2708,15 @@ static struct vfsmount *nfs_do_root_mount(struct file_system_type *fs_type,
+ 	char *root_devname;
+ 	size_t len;
+ 
+-	len = strlen(hostname) + 3;
++	len = strlen(hostname) + 5;
+ 	root_devname = kmalloc(len, GFP_KERNEL);
+ 	if (root_devname == NULL)
+ 		return ERR_PTR(-ENOMEM);
+-	snprintf(root_devname, len, "%s:/", hostname);
++	/* Does hostname needs to be enclosed in brackets? */
++	if (strchr(hostname, ':'))
++		snprintf(root_devname, len, "[%s]:/", hostname);
++	else
++		snprintf(root_devname, len, "%s:/", hostname);
+ 	root_mnt = vfs_kern_mount(fs_type, flags, root_devname, data);
+ 	kfree(root_devname);
+ 	return root_mnt;
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 1dda78d..4efd421 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -974,7 +974,7 @@ out_bad:
+ 	while (!list_empty(res)) {
+ 		data = list_entry(res->next, struct nfs_write_data, list);
+ 		list_del(&data->list);
+-		nfs_writedata_free(data);
++		nfs_writedata_release(data);
+ 	}
+ 	nfs_redirty_request(req);
+ 	return -ENOMEM;
+diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
+index 08c6e36..43f46cd 100644
+--- a/fs/nfsd/nfs3xdr.c
++++ b/fs/nfsd/nfs3xdr.c
+@@ -803,13 +803,13 @@ encode_entry_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name,
+ 	return p;
+ }
+ 
+-static int
++static __be32
+ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
+ 		const char *name, int namlen)
+ {
+ 	struct svc_export	*exp;
+ 	struct dentry		*dparent, *dchild;
+-	int rv = 0;
++	__be32 rv = nfserr_noent;
+ 
+ 	dparent = cd->fh.fh_dentry;
+ 	exp  = cd->fh.fh_export;
+@@ -817,26 +817,20 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
+ 	if (isdotent(name, namlen)) {
+ 		if (namlen == 2) {
+ 			dchild = dget_parent(dparent);
+-			if (dchild == dparent) {
+-				/* filesystem root - cannot return filehandle for ".." */
+-				dput(dchild);
+-				return -ENOENT;
+-			}
++			/* filesystem root - cannot return filehandle for ".." */
++			if (dchild == dparent)
++				goto out;
+ 		} else
+ 			dchild = dget(dparent);
+ 	} else
+ 		dchild = lookup_one_len(name, dparent, namlen);
+ 	if (IS_ERR(dchild))
+-		return -ENOENT;
+-	rv = -ENOENT;
++		return rv;
+ 	if (d_mountpoint(dchild))
+ 		goto out;
+-	rv = fh_compose(fhp, exp, dchild, &cd->fh);
+-	if (rv)
+-		goto out;
+ 	if (!dchild->d_inode)
+ 		goto out;
+-	rv = 0;
++	rv = fh_compose(fhp, exp, dchild, &cd->fh);
+ out:
+ 	dput(dchild);
+ 	return rv;
+@@ -845,7 +839,7 @@ out:
+ static __be32 *encode_entryplus_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name, int namlen)
+ {
+ 	struct svc_fh	fh;
+-	int err;
++	__be32 err;
+ 
+ 	fh_init(&fh, NFS3_FHSIZE);
+ 	err = compose_entry_fh(cd, &fh, name, namlen);
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index fa38336..b8c5538 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -231,17 +231,17 @@ do_open_lookup(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_o
+ 		 */
+ 		if (open->op_createmode == NFS4_CREATE_EXCLUSIVE && status == 0)
+ 			open->op_bmval[1] = (FATTR4_WORD1_TIME_ACCESS |
+-						FATTR4_WORD1_TIME_MODIFY);
++							FATTR4_WORD1_TIME_MODIFY);
+ 	} else {
+ 		status = nfsd_lookup(rqstp, current_fh,
+ 				     open->op_fname.data, open->op_fname.len, &resfh);
+ 		fh_unlock(current_fh);
+-		if (status)
+-			goto out;
+-		status = nfsd_check_obj_isreg(&resfh);
+ 	}
+ 	if (status)
+ 		goto out;
++	status = nfsd_check_obj_isreg(&resfh);
++	if (status)
++		goto out;
+ 
+ 	if (is_create_with_attrs(open) && open->op_acl != NULL)
+ 		do_set_nfs4_acl(rqstp, &resfh, open->op_acl, open->op_bmval);
+@@ -827,6 +827,7 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ 	      struct nfsd4_setattr *setattr)
+ {
+ 	__be32 status = nfs_ok;
++	int err;
+ 
+ 	if (setattr->sa_iattr.ia_valid & ATTR_SIZE) {
+ 		nfs4_lock_state();
+@@ -838,9 +839,9 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ 			return status;
+ 		}
+ 	}
+-	status = mnt_want_write(cstate->current_fh.fh_export->ex_path.mnt);
+-	if (status)
+-		return status;
++	err = mnt_want_write(cstate->current_fh.fh_export->ex_path.mnt);
++	if (err)
++		return nfserrno(err);
+ 	status = nfs_ok;
+ 
+ 	status = check_attr_support(rqstp, cstate, setattr->sa_bmval,
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 5abced7..4cfe260 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -4080,16 +4080,14 @@ out:
+  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
+  * inode operation.)
+  */
+-static int nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
++static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
+ {
+ 	struct file *file;
+-	int err;
+-
+-	err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
+-	if (err)
+-		return err;
+-	err = vfs_test_lock(file, lock);
+-	nfsd_close(file);
++	__be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
++	if (!err) {
++		err = nfserrno(vfs_test_lock(file, lock));
++		nfsd_close(file);
++	}
+ 	return err;
+ }
+ 
+@@ -4103,7 +4101,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ 	struct inode *inode;
+ 	struct file_lock file_lock;
+ 	struct nfs4_lockowner *lo;
+-	int error;
+ 	__be32 status;
+ 
+ 	if (locks_in_grace())
+@@ -4149,12 +4146,10 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ 
+ 	nfs4_transform_lock_offset(&file_lock);
+ 
+-	status = nfs_ok;
+-	error = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
+-	if (error) {
+-		status = nfserrno(error);
++	status = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
++	if (status)
+ 		goto out;
+-	}
++
+ 	if (file_lock.fl_type != F_UNLCK) {
+ 		status = nfserr_denied;
+ 		nfs4_set_lock_denied(&file_lock, &lockt->lt_denied);
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index b6fa792..9cfa60a 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -3411,7 +3411,7 @@ nfsd4_encode_test_stateid(struct nfsd4_compoundres *resp, int nfserr,
+ 		nfsd4_decode_stateid(argp, &si);
+ 		valid = nfs4_validate_stateid(cl, &si);
+ 		RESERVE_SPACE(4);
+-		*p++ = htonl(valid);
++		*p++ = valid;
+ 		resp->p = p;
+ 	}
+ 	nfs4_unlock_state();
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 7a2e442..5c3cd82 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -1439,7 +1439,7 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ 		switch (createmode) {
+ 		case NFS3_CREATE_UNCHECKED:
+ 			if (! S_ISREG(dchild->d_inode->i_mode))
+-				err = nfserr_exist;
++				goto out;
+ 			else if (truncp) {
+ 				/* in nfsv4, we need to treat this case a little
+ 				 * differently.  we don't want to truncate the
+diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
+index 3165aeb..31b9463 100644
+--- a/fs/ocfs2/alloc.c
++++ b/fs/ocfs2/alloc.c
+@@ -1134,7 +1134,7 @@ static int ocfs2_adjust_rightmost_branch(handle_t *handle,
+ 	}
+ 
+ 	el = path_leaf_el(path);
+-	rec = &el->l_recs[le32_to_cpu(el->l_next_free_rec) - 1];
++	rec = &el->l_recs[le16_to_cpu(el->l_next_free_rec) - 1];
+ 
+ 	ocfs2_adjust_rightmost_records(handle, et, path, rec);
+ 
+diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
+index cf78233..9f32d7c 100644
+--- a/fs/ocfs2/refcounttree.c
++++ b/fs/ocfs2/refcounttree.c
+@@ -1036,14 +1036,14 @@ static int ocfs2_get_refcount_cpos_end(struct ocfs2_caching_info *ci,
+ 
+ 	tmp_el = left_path->p_node[subtree_root].el;
+ 	blkno = left_path->p_node[subtree_root+1].bh->b_blocknr;
+-	for (i = 0; i < le32_to_cpu(tmp_el->l_next_free_rec); i++) {
++	for (i = 0; i < le16_to_cpu(tmp_el->l_next_free_rec); i++) {
+ 		if (le64_to_cpu(tmp_el->l_recs[i].e_blkno) == blkno) {
+ 			*cpos_end = le32_to_cpu(tmp_el->l_recs[i+1].e_cpos);
+ 			break;
+ 		}
+ 	}
+ 
+-	BUG_ON(i == le32_to_cpu(tmp_el->l_next_free_rec));
++	BUG_ON(i == le16_to_cpu(tmp_el->l_next_free_rec));
+ 
+ out:
+ 	ocfs2_free_path(left_path);
+@@ -1468,7 +1468,7 @@ static int ocfs2_divide_leaf_refcount_block(struct buffer_head *ref_leaf_bh,
+ 
+ 	trace_ocfs2_divide_leaf_refcount_block(
+ 		(unsigned long long)ref_leaf_bh->b_blocknr,
+-		le32_to_cpu(rl->rl_count), le32_to_cpu(rl->rl_used));
++		le16_to_cpu(rl->rl_count), le16_to_cpu(rl->rl_used));
+ 
+ 	/*
+ 	 * XXX: Improvement later.
+@@ -2411,7 +2411,7 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb,
+ 				rb = (struct ocfs2_refcount_block *)
+ 							prev_bh->b_data;
+ 
+-				if (le64_to_cpu(rb->rf_records.rl_used) +
++				if (le16_to_cpu(rb->rf_records.rl_used) +
+ 				    recs_add >
+ 				    le16_to_cpu(rb->rf_records.rl_count))
+ 					ref_blocks++;
+@@ -2476,7 +2476,7 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb,
+ 	if (prev_bh) {
+ 		rb = (struct ocfs2_refcount_block *)prev_bh->b_data;
+ 
+-		if (le64_to_cpu(rb->rf_records.rl_used) + recs_add >
++		if (le16_to_cpu(rb->rf_records.rl_used) + recs_add >
+ 		    le16_to_cpu(rb->rf_records.rl_count))
+ 			ref_blocks++;
+ 
+@@ -3629,7 +3629,7 @@ int ocfs2_refcounted_xattr_delete_need(struct inode *inode,
+ 			 * one will split a refcount rec, so totally we need
+ 			 * clusters * 2 new refcount rec.
+ 			 */
+-			if (le64_to_cpu(rb->rf_records.rl_used) + clusters * 2 >
++			if (le16_to_cpu(rb->rf_records.rl_used) + clusters * 2 >
+ 			    le16_to_cpu(rb->rf_records.rl_count))
+ 				ref_blocks++;
+ 
+diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
+index ba5d97e..f169da4 100644
+--- a/fs/ocfs2/suballoc.c
++++ b/fs/ocfs2/suballoc.c
+@@ -600,7 +600,7 @@ static void ocfs2_bg_alloc_cleanup(handle_t *handle,
+ 		ret = ocfs2_free_clusters(handle, cluster_ac->ac_inode,
+ 					  cluster_ac->ac_bh,
+ 					  le64_to_cpu(rec->e_blkno),
+-					  le32_to_cpu(rec->e_leaf_clusters));
++					  le16_to_cpu(rec->e_leaf_clusters));
+ 		if (ret)
+ 			mlog_errno(ret);
+ 		/* Try all the clusters to free */
+@@ -1628,7 +1628,7 @@ static int ocfs2_bg_discontig_fix_by_rec(struct ocfs2_suballoc_result *res,
+ {
+ 	unsigned int bpc = le16_to_cpu(cl->cl_bpc);
+ 	unsigned int bitoff = le32_to_cpu(rec->e_cpos) * bpc;
+-	unsigned int bitcount = le32_to_cpu(rec->e_leaf_clusters) * bpc;
++	unsigned int bitcount = le16_to_cpu(rec->e_leaf_clusters) * bpc;
+ 
+ 	if (res->sr_bit_offset < bitoff)
+ 		return 0;
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 4065f07..05ed5ca 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -345,6 +345,16 @@ static const struct pipe_buf_operations anon_pipe_buf_ops = {
+ 	.get = generic_pipe_buf_get,
+ };
+ 
++static const struct pipe_buf_operations packet_pipe_buf_ops = {
++	.can_merge = 0,
++	.map = generic_pipe_buf_map,
++	.unmap = generic_pipe_buf_unmap,
++	.confirm = generic_pipe_buf_confirm,
++	.release = anon_pipe_buf_release,
++	.steal = generic_pipe_buf_steal,
++	.get = generic_pipe_buf_get,
++};
++
+ static ssize_t
+ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
+ 	   unsigned long nr_segs, loff_t pos)
+@@ -406,6 +416,13 @@ redo:
+ 			ret += chars;
+ 			buf->offset += chars;
+ 			buf->len -= chars;
++
++			/* Was it a packet buffer? Clean up and exit */
++			if (buf->flags & PIPE_BUF_FLAG_PACKET) {
++				total_len = chars;
++				buf->len = 0;
++			}
++
+ 			if (!buf->len) {
+ 				buf->ops = NULL;
+ 				ops->release(pipe, buf);
+@@ -458,6 +475,11 @@ redo:
+ 	return ret;
+ }
+ 
++static inline int is_packetized(struct file *file)
++{
++	return (file->f_flags & O_DIRECT) != 0;
++}
++
+ static ssize_t
+ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+ 	    unsigned long nr_segs, loff_t ppos)
+@@ -592,6 +614,11 @@ redo2:
+ 			buf->ops = &anon_pipe_buf_ops;
+ 			buf->offset = 0;
+ 			buf->len = chars;
++			buf->flags = 0;
++			if (is_packetized(filp)) {
++				buf->ops = &packet_pipe_buf_ops;
++				buf->flags = PIPE_BUF_FLAG_PACKET;
++			}
+ 			pipe->nrbufs = ++bufs;
+ 			pipe->tmp_page = NULL;
+ 
+@@ -1012,7 +1039,7 @@ struct file *create_write_pipe(int flags)
+ 		goto err_dentry;
+ 	f->f_mapping = inode->i_mapping;
+ 
+-	f->f_flags = O_WRONLY | (flags & O_NONBLOCK);
++	f->f_flags = O_WRONLY | (flags & (O_NONBLOCK | O_DIRECT));
+ 	f->f_version = 0;
+ 
+ 	return f;
+@@ -1056,7 +1083,7 @@ int do_pipe_flags(int *fd, int flags)
+ 	int error;
+ 	int fdw, fdr;
+ 
+-	if (flags & ~(O_CLOEXEC | O_NONBLOCK))
++	if (flags & ~(O_CLOEXEC | O_NONBLOCK | O_DIRECT))
+ 		return -EINVAL;
+ 
+ 	fw = create_write_pipe(flags);
+diff --git a/fs/splice.c b/fs/splice.c
+index fa2defa..6d0dfb8 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -31,6 +31,7 @@
+ #include <linux/uio.h>
+ #include <linux/security.h>
+ #include <linux/gfp.h>
++#include <linux/socket.h>
+ 
+ /*
+  * Attempt to steal a page from a pipe buffer. This should perhaps go into
+@@ -691,7 +692,9 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
+ 	if (!likely(file->f_op && file->f_op->sendpage))
+ 		return -EINVAL;
+ 
+-	more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;
++	more = (sd->flags & SPLICE_F_MORE) ? MSG_MORE : 0;
++	if (sd->len < sd->total_len)
++		more |= MSG_SENDPAGE_NOTLAST;
+ 	return file->f_op->sendpage(file, buf->page, buf->offset,
+ 				    sd->len, &pos, more);
+ }
+diff --git a/include/asm-generic/statfs.h b/include/asm-generic/statfs.h
+index 0fd28e0..c749af9 100644
+--- a/include/asm-generic/statfs.h
++++ b/include/asm-generic/statfs.h
+@@ -15,7 +15,7 @@ typedef __kernel_fsid_t	fsid_t;
+  * with a 10' pole.
+  */
+ #ifndef __statfs_word
+-#if BITS_PER_LONG == 64
++#if __BITS_PER_LONG == 64
+ #define __statfs_word long
+ #else
+ #define __statfs_word __u32
+diff --git a/include/linux/efi.h b/include/linux/efi.h
+index 2362a0b..1328d8c 100644
+--- a/include/linux/efi.h
++++ b/include/linux/efi.h
+@@ -383,7 +383,18 @@ extern int __init efi_setup_pcdp_console(char *);
+ #define EFI_VARIABLE_NON_VOLATILE       0x0000000000000001
+ #define EFI_VARIABLE_BOOTSERVICE_ACCESS 0x0000000000000002
+ #define EFI_VARIABLE_RUNTIME_ACCESS     0x0000000000000004
+-
++#define EFI_VARIABLE_HARDWARE_ERROR_RECORD 0x0000000000000008
++#define EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS 0x0000000000000010
++#define EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS 0x0000000000000020
++#define EFI_VARIABLE_APPEND_WRITE	0x0000000000000040
++
++#define EFI_VARIABLE_MASK 	(EFI_VARIABLE_NON_VOLATILE | \
++				EFI_VARIABLE_BOOTSERVICE_ACCESS | \
++				EFI_VARIABLE_RUNTIME_ACCESS | \
++				EFI_VARIABLE_HARDWARE_ERROR_RECORD | \
++				EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | \
++				EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | \
++				EFI_VARIABLE_APPEND_WRITE)
+ /*
+  * EFI Device Path information
+  */
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index d526231..35410ef 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -562,6 +562,7 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id);
+ 
+ #ifdef CONFIG_IOMMU_API
+ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot);
++void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot);
+ int kvm_iommu_map_guest(struct kvm *kvm);
+ int kvm_iommu_unmap_guest(struct kvm *kvm);
+ int kvm_assign_device(struct kvm *kvm,
+@@ -575,6 +576,11 @@ static inline int kvm_iommu_map_pages(struct kvm *kvm,
+ 	return 0;
+ }
+ 
++static inline void kvm_iommu_unmap_pages(struct kvm *kvm,
++					 struct kvm_memory_slot *slot)
++{
++}
++
+ static inline int kvm_iommu_map_guest(struct kvm *kvm)
+ {
+ 	return -ENODEV;
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index a82ad4d..cbeb586 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2536,8 +2536,6 @@ extern void		net_disable_timestamp(void);
+ extern void *dev_seq_start(struct seq_file *seq, loff_t *pos);
+ extern void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos);
+ extern void dev_seq_stop(struct seq_file *seq, void *v);
+-extern int dev_seq_open_ops(struct inode *inode, struct file *file,
+-			    const struct seq_operations *ops);
+ #endif
+ 
+ extern int netdev_class_create_file(struct class_attribute *class_attr);
+diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
+index 77257c9..0072a53 100644
+--- a/include/linux/pipe_fs_i.h
++++ b/include/linux/pipe_fs_i.h
+@@ -8,6 +8,7 @@
+ #define PIPE_BUF_FLAG_LRU	0x01	/* page is on the LRU */
+ #define PIPE_BUF_FLAG_ATOMIC	0x02	/* was atomically mapped */
+ #define PIPE_BUF_FLAG_GIFT	0x04	/* page is a gift */
++#define PIPE_BUF_FLAG_PACKET	0x08	/* read() as a packet */
+ 
+ /**
+  *	struct pipe_buffer - a linux kernel pipe buffer
+diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
+index c6db9fb..bb1fac5 100644
+--- a/include/linux/seqlock.h
++++ b/include/linux/seqlock.h
+@@ -141,7 +141,7 @@ static inline unsigned __read_seqcount_begin(const seqcount_t *s)
+ 	unsigned ret;
+ 
+ repeat:
+-	ret = s->sequence;
++	ret = ACCESS_ONCE(s->sequence);
+ 	if (unlikely(ret & 1)) {
+ 		cpu_relax();
+ 		goto repeat;
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 6cf8b53..e689b47 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -458,6 +458,7 @@ struct sk_buff {
+ 	union {
+ 		__u32		mark;
+ 		__u32		dropcount;
++		__u32		avail_size;
+ 	};
+ 
+ 	__u16			vlan_tci;
+@@ -1326,6 +1327,18 @@ static inline int skb_tailroom(const struct sk_buff *skb)
+ }
+ 
+ /**
++ *	skb_availroom - bytes at buffer end
++ *	@skb: buffer to check
++ *
++ *	Return the number of bytes of free space at the tail of an sk_buff
++ *	allocated by sk_stream_alloc()
++ */
++static inline int skb_availroom(const struct sk_buff *skb)
++{
++	return skb_is_nonlinear(skb) ? 0 : skb->avail_size - skb->len;
++}
++
++/**
+  *	skb_reserve - adjust headroom
+  *	@skb: buffer to alter
+  *	@len: bytes to move
+diff --git a/include/linux/socket.h b/include/linux/socket.h
+index d0e77f6..ad919e0 100644
+--- a/include/linux/socket.h
++++ b/include/linux/socket.h
+@@ -265,7 +265,7 @@ struct ucred {
+ #define MSG_NOSIGNAL	0x4000	/* Do not generate SIGPIPE */
+ #define MSG_MORE	0x8000	/* Sender will send more */
+ #define MSG_WAITFORONE	0x10000	/* recvmmsg(): block until 1+ packets avail */
+-
++#define MSG_SENDPAGE_NOTLAST 0x20000 /* sendpage() internal : not the last page */
+ #define MSG_EOF         MSG_FIN
+ 
+ #define MSG_CMSG_CLOEXEC 0x40000000	/* Set close_on_exit for file
+diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
+index 03354d5..64cec8d 100644
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -128,6 +128,8 @@ struct usb_hcd {
+ 	unsigned		wireless:1;	/* Wireless USB HCD */
+ 	unsigned		authorized_default:1;
+ 	unsigned		has_tt:1;	/* Integrated TT in root hub */
++	unsigned		broken_pci_sleep:1;	/* Don't put the
++			controller in PCI-D3 for system sleep */
+ 
+ 	int			irq;		/* irq allocated */
+ 	void __iomem		*regs;		/* device memory/io */
+diff --git a/kernel/exit.c b/kernel/exit.c
+index e6e01b9..5a8a66e 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -819,25 +819,6 @@ static void exit_notify(struct task_struct *tsk, int group_dead)
+ 	if (group_dead)
+ 		kill_orphaned_pgrp(tsk->group_leader, NULL);
+ 
+-	/* Let father know we died
+-	 *
+-	 * Thread signals are configurable, but you aren't going to use
+-	 * that to send signals to arbitrary processes.
+-	 * That stops right now.
+-	 *
+-	 * If the parent exec id doesn't match the exec id we saved
+-	 * when we started then we know the parent has changed security
+-	 * domain.
+-	 *
+-	 * If our self_exec id doesn't match our parent_exec_id then
+-	 * we have changed execution domain as these two values started
+-	 * the same after a fork.
+-	 */
+-	if (thread_group_leader(tsk) && tsk->exit_signal != SIGCHLD &&
+-	    (tsk->parent_exec_id != tsk->real_parent->self_exec_id ||
+-	     tsk->self_exec_id != tsk->parent_exec_id))
+-		tsk->exit_signal = SIGCHLD;
+-
+ 	if (unlikely(tsk->ptrace)) {
+ 		int sig = thread_group_leader(tsk) &&
+ 				thread_group_empty(tsk) &&
+diff --git a/kernel/power/swap.c b/kernel/power/swap.c
+index 11a594c..b313086 100644
+--- a/kernel/power/swap.c
++++ b/kernel/power/swap.c
+@@ -52,6 +52,23 @@
+ 
+ #define MAP_PAGE_ENTRIES	(PAGE_SIZE / sizeof(sector_t) - 1)
+ 
++/*
++ * Number of free pages that are not high.
++ */
++static inline unsigned long low_free_pages(void)
++{
++	return nr_free_pages() - nr_free_highpages();
++}
++
++/*
++ * Number of pages required to be kept free while writing the image. Always
++ * half of all available low pages before the writing starts.
++ */
++static inline unsigned long reqd_free_pages(void)
++{
++	return low_free_pages() / 2;
++}
++
+ struct swap_map_page {
+ 	sector_t entries[MAP_PAGE_ENTRIES];
+ 	sector_t next_swap;
+@@ -73,7 +90,7 @@ struct swap_map_handle {
+ 	sector_t cur_swap;
+ 	sector_t first_sector;
+ 	unsigned int k;
+-	unsigned long nr_free_pages, written;
++	unsigned long reqd_free_pages;
+ 	u32 crc32;
+ };
+ 
+@@ -317,8 +334,7 @@ static int get_swap_writer(struct swap_map_handle *handle)
+ 		goto err_rel;
+ 	}
+ 	handle->k = 0;
+-	handle->nr_free_pages = nr_free_pages() >> 1;
+-	handle->written = 0;
++	handle->reqd_free_pages = reqd_free_pages();
+ 	handle->first_sector = handle->cur_swap;
+ 	return 0;
+ err_rel:
+@@ -353,11 +369,11 @@ static int swap_write_page(struct swap_map_handle *handle, void *buf,
+ 		handle->cur_swap = offset;
+ 		handle->k = 0;
+ 	}
+-	if (bio_chain && ++handle->written > handle->nr_free_pages) {
++	if (bio_chain && low_free_pages() <= handle->reqd_free_pages) {
+ 		error = hib_wait_on_bio_chain(bio_chain);
+ 		if (error)
+ 			goto out;
+-		handle->written = 0;
++		handle->reqd_free_pages = reqd_free_pages();
+ 	}
+  out:
+ 	return error;
+@@ -619,7 +635,7 @@ static int save_image_lzo(struct swap_map_handle *handle,
+ 	 * Adjust number of free pages after all allocations have been done.
+ 	 * We don't want to run out of pages when writing.
+ 	 */
+-	handle->nr_free_pages = nr_free_pages() >> 1;
++	handle->reqd_free_pages = reqd_free_pages();
+ 
+ 	/*
+ 	 * Start the CRC32 thread.
+diff --git a/kernel/sched.c b/kernel/sched.c
+index d6b149c..299f55c 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -3538,13 +3538,10 @@ calc_load_n(unsigned long load, unsigned long exp,
+  * Once we've updated the global active value, we need to apply the exponential
+  * weights adjusted to the number of cycles missed.
+  */
+-static void calc_global_nohz(unsigned long ticks)
++static void calc_global_nohz(void)
+ {
+ 	long delta, active, n;
+ 
+-	if (time_before(jiffies, calc_load_update))
+-		return;
+-
+ 	/*
+ 	 * If we crossed a calc_load_update boundary, make sure to fold
+ 	 * any pending idle changes, the respective CPUs might have
+@@ -3556,31 +3553,25 @@ static void calc_global_nohz(unsigned long ticks)
+ 		atomic_long_add(delta, &calc_load_tasks);
+ 
+ 	/*
+-	 * If we were idle for multiple load cycles, apply them.
++	 * It could be the one fold was all it took, we done!
+ 	 */
+-	if (ticks >= LOAD_FREQ) {
+-		n = ticks / LOAD_FREQ;
++	if (time_before(jiffies, calc_load_update + 10))
++		return;
+ 
+-		active = atomic_long_read(&calc_load_tasks);
+-		active = active > 0 ? active * FIXED_1 : 0;
++	/*
++	 * Catch-up, fold however many we are behind still
++	 */
++	delta = jiffies - calc_load_update - 10;
++	n = 1 + (delta / LOAD_FREQ);
+ 
+-		avenrun[0] = calc_load_n(avenrun[0], EXP_1, active, n);
+-		avenrun[1] = calc_load_n(avenrun[1], EXP_5, active, n);
+-		avenrun[2] = calc_load_n(avenrun[2], EXP_15, active, n);
++	active = atomic_long_read(&calc_load_tasks);
++	active = active > 0 ? active * FIXED_1 : 0;
+ 
+-		calc_load_update += n * LOAD_FREQ;
+-	}
++	avenrun[0] = calc_load_n(avenrun[0], EXP_1, active, n);
++	avenrun[1] = calc_load_n(avenrun[1], EXP_5, active, n);
++	avenrun[2] = calc_load_n(avenrun[2], EXP_15, active, n);
+ 
+-	/*
+-	 * Its possible the remainder of the above division also crosses
+-	 * a LOAD_FREQ period, the regular check in calc_global_load()
+-	 * which comes after this will take care of that.
+-	 *
+-	 * Consider us being 11 ticks before a cycle completion, and us
+-	 * sleeping for 4*LOAD_FREQ + 22 ticks, then the above code will
+-	 * age us 4 cycles, and the test in calc_global_load() will
+-	 * pick up the final one.
+-	 */
++	calc_load_update += n * LOAD_FREQ;
+ }
+ #else
+ static void calc_load_account_idle(struct rq *this_rq)
+@@ -3592,7 +3583,7 @@ static inline long calc_load_fold_idle(void)
+ 	return 0;
+ }
+ 
+-static void calc_global_nohz(unsigned long ticks)
++static void calc_global_nohz(void)
+ {
+ }
+ #endif
+@@ -3620,8 +3611,6 @@ void calc_global_load(unsigned long ticks)
+ {
+ 	long active;
+ 
+-	calc_global_nohz(ticks);
+-
+ 	if (time_before(jiffies, calc_load_update + 10))
+ 		return;
+ 
+@@ -3633,6 +3622,16 @@ void calc_global_load(unsigned long ticks)
+ 	avenrun[2] = calc_load(avenrun[2], EXP_15, active);
+ 
+ 	calc_load_update += LOAD_FREQ;
++
++	/*
++	 * Account one period with whatever state we found before
++	 * folding in the nohz state and ageing the entire idle period.
++	 *
++	 * This avoids loosing a sample when we go idle between 
++	 * calc_load_account_active() (10 ticks ago) and now and thus
++	 * under-accounting.
++	 */
++	calc_global_nohz();
+ }
+ 
+ /*
+@@ -7605,16 +7604,26 @@ static void __sdt_free(const struct cpumask *cpu_map)
+ 		struct sd_data *sdd = &tl->data;
+ 
+ 		for_each_cpu(j, cpu_map) {
+-			struct sched_domain *sd = *per_cpu_ptr(sdd->sd, j);
+-			if (sd && (sd->flags & SD_OVERLAP))
+-				free_sched_groups(sd->groups, 0);
+-			kfree(*per_cpu_ptr(sdd->sd, j));
+-			kfree(*per_cpu_ptr(sdd->sg, j));
+-			kfree(*per_cpu_ptr(sdd->sgp, j));
++			struct sched_domain *sd;
++
++			if (sdd->sd) {
++				sd = *per_cpu_ptr(sdd->sd, j);
++				if (sd && (sd->flags & SD_OVERLAP))
++					free_sched_groups(sd->groups, 0);
++				kfree(*per_cpu_ptr(sdd->sd, j));
++			}
++
++			if (sdd->sg)
++				kfree(*per_cpu_ptr(sdd->sg, j));
++			if (sdd->sgp)
++				kfree(*per_cpu_ptr(sdd->sgp, j));
+ 		}
+ 		free_percpu(sdd->sd);
++		sdd->sd = NULL;
+ 		free_percpu(sdd->sg);
++		sdd->sg = NULL;
+ 		free_percpu(sdd->sgp);
++		sdd->sgp = NULL;
+ 	}
+ }
+ 
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 2065515..08e0b97 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -1610,6 +1610,15 @@ bool do_notify_parent(struct task_struct *tsk, int sig)
+ 	BUG_ON(!tsk->ptrace &&
+ 	       (tsk->group_leader != tsk || !thread_group_empty(tsk)));
+ 
++	if (sig != SIGCHLD) {
++		/*
++		 * This is only possible if parent == real_parent.
++		 * Check if it has changed security domain.
++		 */
++		if (tsk->parent_exec_id != tsk->parent->self_exec_id)
++			sig = SIGCHLD;
++	}
++
+ 	info.si_signo = sig;
+ 	info.si_errno = 0;
+ 	/*
+diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
+index 5199930..1dcf253 100644
+--- a/kernel/trace/trace_output.c
++++ b/kernel/trace/trace_output.c
+@@ -638,6 +638,8 @@ int trace_print_lat_context(struct trace_iterator *iter)
+ {
+ 	u64 next_ts;
+ 	int ret;
++	/* trace_find_next_entry will reset ent_size */
++	int ent_size = iter->ent_size;
+ 	struct trace_seq *s = &iter->seq;
+ 	struct trace_entry *entry = iter->ent,
+ 			   *next_entry = trace_find_next_entry(iter, NULL,
+@@ -646,6 +648,9 @@ int trace_print_lat_context(struct trace_iterator *iter)
+ 	unsigned long abs_usecs = ns2usecs(iter->ts - iter->tr->time_start);
+ 	unsigned long rel_usecs;
+ 
++	/* Restore the original ent_size */
++	iter->ent_size = ent_size;
++
+ 	if (!next_entry)
+ 		next_ts = iter->ts;
+ 	rel_usecs = ns2usecs(next_ts - iter->ts);
+diff --git a/mm/swap_state.c b/mm/swap_state.c
+index 78cc4d1..7704d9c 100644
+--- a/mm/swap_state.c
++++ b/mm/swap_state.c
+@@ -27,7 +27,7 @@
+  */
+ static const struct address_space_operations swap_aops = {
+ 	.writepage	= swap_writepage,
+-	.set_page_dirty	= __set_page_dirty_nobuffers,
++	.set_page_dirty	= __set_page_dirty_no_writeback,
+ 	.migratepage	= migrate_page,
+ };
+ 
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index e7c69f4..b04a6ef 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -2006,16 +2006,17 @@ static void __exit ax25_exit(void)
+ 	proc_net_remove(&init_net, "ax25_route");
+ 	proc_net_remove(&init_net, "ax25");
+ 	proc_net_remove(&init_net, "ax25_calls");
+-	ax25_rt_free();
+-	ax25_uid_free();
+-	ax25_dev_free();
+ 
+-	ax25_unregister_sysctl();
+ 	unregister_netdevice_notifier(&ax25_dev_notifier);
++	ax25_unregister_sysctl();
+ 
+ 	dev_remove_pack(&ax25_packet_type);
+ 
+ 	sock_unregister(PF_AX25);
+ 	proto_unregister(&ax25_proto);
++
++	ax25_rt_free();
++	ax25_uid_free();
++	ax25_dev_free();
+ }
+ module_exit(ax25_exit);
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 8eb6b15..5ac1811 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -241,7 +241,6 @@ static void br_multicast_group_expired(unsigned long data)
+ 	hlist_del_rcu(&mp->hlist[mdb->ver]);
+ 	mdb->size--;
+ 
+-	del_timer(&mp->query_timer);
+ 	call_rcu_bh(&mp->rcu, br_multicast_free_group);
+ 
+ out:
+@@ -271,7 +270,6 @@ static void br_multicast_del_pg(struct net_bridge *br,
+ 		rcu_assign_pointer(*pp, p->next);
+ 		hlist_del_init(&p->mglist);
+ 		del_timer(&p->timer);
+-		del_timer(&p->query_timer);
+ 		call_rcu_bh(&p->rcu, br_multicast_free_pg);
+ 
+ 		if (!mp->ports && !mp->mglist &&
+@@ -507,74 +505,6 @@ static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
+ 	return NULL;
+ }
+ 
+-static void br_multicast_send_group_query(struct net_bridge_mdb_entry *mp)
+-{
+-	struct net_bridge *br = mp->br;
+-	struct sk_buff *skb;
+-
+-	skb = br_multicast_alloc_query(br, &mp->addr);
+-	if (!skb)
+-		goto timer;
+-
+-	netif_rx(skb);
+-
+-timer:
+-	if (++mp->queries_sent < br->multicast_last_member_count)
+-		mod_timer(&mp->query_timer,
+-			  jiffies + br->multicast_last_member_interval);
+-}
+-
+-static void br_multicast_group_query_expired(unsigned long data)
+-{
+-	struct net_bridge_mdb_entry *mp = (void *)data;
+-	struct net_bridge *br = mp->br;
+-
+-	spin_lock(&br->multicast_lock);
+-	if (!netif_running(br->dev) || !mp->mglist ||
+-	    mp->queries_sent >= br->multicast_last_member_count)
+-		goto out;
+-
+-	br_multicast_send_group_query(mp);
+-
+-out:
+-	spin_unlock(&br->multicast_lock);
+-}
+-
+-static void br_multicast_send_port_group_query(struct net_bridge_port_group *pg)
+-{
+-	struct net_bridge_port *port = pg->port;
+-	struct net_bridge *br = port->br;
+-	struct sk_buff *skb;
+-
+-	skb = br_multicast_alloc_query(br, &pg->addr);
+-	if (!skb)
+-		goto timer;
+-
+-	br_deliver(port, skb);
+-
+-timer:
+-	if (++pg->queries_sent < br->multicast_last_member_count)
+-		mod_timer(&pg->query_timer,
+-			  jiffies + br->multicast_last_member_interval);
+-}
+-
+-static void br_multicast_port_group_query_expired(unsigned long data)
+-{
+-	struct net_bridge_port_group *pg = (void *)data;
+-	struct net_bridge_port *port = pg->port;
+-	struct net_bridge *br = port->br;
+-
+-	spin_lock(&br->multicast_lock);
+-	if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
+-	    pg->queries_sent >= br->multicast_last_member_count)
+-		goto out;
+-
+-	br_multicast_send_port_group_query(pg);
+-
+-out:
+-	spin_unlock(&br->multicast_lock);
+-}
+-
+ static struct net_bridge_mdb_entry *br_multicast_get_group(
+ 	struct net_bridge *br, struct net_bridge_port *port,
+ 	struct br_ip *group, int hash)
+@@ -690,8 +620,6 @@ rehash:
+ 	mp->addr = *group;
+ 	setup_timer(&mp->timer, br_multicast_group_expired,
+ 		    (unsigned long)mp);
+-	setup_timer(&mp->query_timer, br_multicast_group_query_expired,
+-		    (unsigned long)mp);
+ 
+ 	hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
+ 	mdb->size++;
+@@ -746,8 +674,6 @@ static int br_multicast_add_group(struct net_bridge *br,
+ 	hlist_add_head(&p->mglist, &port->mglist);
+ 	setup_timer(&p->timer, br_multicast_port_group_expired,
+ 		    (unsigned long)p);
+-	setup_timer(&p->query_timer, br_multicast_port_group_query_expired,
+-		    (unsigned long)p);
+ 
+ 	rcu_assign_pointer(*pp, p);
+ 
+@@ -1291,9 +1217,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
+ 		     time_after(mp->timer.expires, time) :
+ 		     try_to_del_timer_sync(&mp->timer) >= 0)) {
+ 			mod_timer(&mp->timer, time);
+-
+-			mp->queries_sent = 0;
+-			mod_timer(&mp->query_timer, now);
+ 		}
+ 
+ 		goto out;
+@@ -1310,9 +1233,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
+ 		     time_after(p->timer.expires, time) :
+ 		     try_to_del_timer_sync(&p->timer) >= 0)) {
+ 			mod_timer(&p->timer, time);
+-
+-			p->queries_sent = 0;
+-			mod_timer(&p->query_timer, now);
+ 		}
+ 
+ 		break;
+@@ -1680,7 +1600,6 @@ void br_multicast_stop(struct net_bridge *br)
+ 		hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i],
+ 					  hlist[ver]) {
+ 			del_timer(&mp->timer);
+-			del_timer(&mp->query_timer);
+ 			call_rcu_bh(&mp->rcu, br_multicast_free_group);
+ 		}
+ 	}
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index d7d6fb0..93264df 100644
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -82,9 +82,7 @@ struct net_bridge_port_group {
+ 	struct hlist_node		mglist;
+ 	struct rcu_head			rcu;
+ 	struct timer_list		timer;
+-	struct timer_list		query_timer;
+ 	struct br_ip			addr;
+-	u32				queries_sent;
+ };
+ 
+ struct net_bridge_mdb_entry
+@@ -94,10 +92,8 @@ struct net_bridge_mdb_entry
+ 	struct net_bridge_port_group __rcu *ports;
+ 	struct rcu_head			rcu;
+ 	struct timer_list		timer;
+-	struct timer_list		query_timer;
+ 	struct br_ip			addr;
+ 	bool				mglist;
+-	u32				queries_sent;
+ };
+ 
+ struct net_bridge_mdb_htable
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 55cd370..cd5050e 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4102,54 +4102,41 @@ static int dev_ifconf(struct net *net, char __user *arg)
+ 
+ #ifdef CONFIG_PROC_FS
+ 
+-#define BUCKET_SPACE (32 - NETDEV_HASHBITS)
+-
+-struct dev_iter_state {
+-	struct seq_net_private p;
+-	unsigned int pos; /* bucket << BUCKET_SPACE + offset */
+-};
++#define BUCKET_SPACE (32 - NETDEV_HASHBITS - 1)
+ 
+ #define get_bucket(x) ((x) >> BUCKET_SPACE)
+ #define get_offset(x) ((x) & ((1 << BUCKET_SPACE) - 1))
+ #define set_bucket_offset(b, o) ((b) << BUCKET_SPACE | (o))
+ 
+-static inline struct net_device *dev_from_same_bucket(struct seq_file *seq)
++static inline struct net_device *dev_from_same_bucket(struct seq_file *seq, loff_t *pos)
+ {
+-	struct dev_iter_state *state = seq->private;
+ 	struct net *net = seq_file_net(seq);
+ 	struct net_device *dev;
+ 	struct hlist_node *p;
+ 	struct hlist_head *h;
+-	unsigned int count, bucket, offset;
++	unsigned int count = 0, offset = get_offset(*pos);
+ 
+-	bucket = get_bucket(state->pos);
+-	offset = get_offset(state->pos);
+-	h = &net->dev_name_head[bucket];
+-	count = 0;
++	h = &net->dev_name_head[get_bucket(*pos)];
+ 	hlist_for_each_entry_rcu(dev, p, h, name_hlist) {
+-		if (count++ == offset) {
+-			state->pos = set_bucket_offset(bucket, count);
++		if (++count == offset)
+ 			return dev;
+-		}
+ 	}
+ 
+ 	return NULL;
+ }
+ 
+-static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
++static inline struct net_device *dev_from_bucket(struct seq_file *seq, loff_t *pos)
+ {
+-	struct dev_iter_state *state = seq->private;
+ 	struct net_device *dev;
+ 	unsigned int bucket;
+ 
+-	bucket = get_bucket(state->pos);
+ 	do {
+-		dev = dev_from_same_bucket(seq);
++		dev = dev_from_same_bucket(seq, pos);
+ 		if (dev)
+ 			return dev;
+ 
+-		bucket++;
+-		state->pos = set_bucket_offset(bucket, 0);
++		bucket = get_bucket(*pos) + 1;
++		*pos = set_bucket_offset(bucket, 1);
+ 	} while (bucket < NETDEV_HASHENTRIES);
+ 
+ 	return NULL;
+@@ -4162,33 +4149,20 @@ static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
+ void *dev_seq_start(struct seq_file *seq, loff_t *pos)
+ 	__acquires(RCU)
+ {
+-	struct dev_iter_state *state = seq->private;
+-
+ 	rcu_read_lock();
+ 	if (!*pos)
+ 		return SEQ_START_TOKEN;
+ 
+-	/* check for end of the hash */
+-	if (state->pos == 0 && *pos > 1)
++	if (get_bucket(*pos) >= NETDEV_HASHENTRIES)
+ 		return NULL;
+ 
+-	return dev_from_new_bucket(seq);
++	return dev_from_bucket(seq, pos);
+ }
+ 
+ void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
+-	struct net_device *dev;
+-
+ 	++*pos;
+-
+-	if (v == SEQ_START_TOKEN)
+-		return dev_from_new_bucket(seq);
+-
+-	dev = dev_from_same_bucket(seq);
+-	if (dev)
+-		return dev;
+-
+-	return dev_from_new_bucket(seq);
++	return dev_from_bucket(seq, pos);
+ }
+ 
+ void dev_seq_stop(struct seq_file *seq, void *v)
+@@ -4287,13 +4261,7 @@ static const struct seq_operations dev_seq_ops = {
+ static int dev_seq_open(struct inode *inode, struct file *file)
+ {
+ 	return seq_open_net(inode, file, &dev_seq_ops,
+-			    sizeof(struct dev_iter_state));
+-}
+-
+-int dev_seq_open_ops(struct inode *inode, struct file *file,
+-		     const struct seq_operations *ops)
+-{
+-	return seq_open_net(inode, file, ops, sizeof(struct dev_iter_state));
++			    sizeof(struct seq_net_private));
+ }
+ 
+ static const struct file_operations dev_seq_fops = {
+diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
+index febba51..277faef 100644
+--- a/net/core/dev_addr_lists.c
++++ b/net/core/dev_addr_lists.c
+@@ -696,7 +696,8 @@ static const struct seq_operations dev_mc_seq_ops = {
+ 
+ static int dev_mc_seq_open(struct inode *inode, struct file *file)
+ {
+-	return dev_seq_open_ops(inode, file, &dev_mc_seq_ops);
++	return seq_open_net(inode, file, &dev_mc_seq_ops,
++			    sizeof(struct seq_net_private));
+ }
+ 
+ static const struct file_operations dev_mc_seq_fops = {
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 0e950fd..31a5ae5 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -83,21 +83,29 @@ assign:
+ 
+ static int ops_init(const struct pernet_operations *ops, struct net *net)
+ {
+-	int err;
++	int err = -ENOMEM;
++	void *data = NULL;
++
+ 	if (ops->id && ops->size) {
+-		void *data = kzalloc(ops->size, GFP_KERNEL);
++		data = kzalloc(ops->size, GFP_KERNEL);
+ 		if (!data)
+-			return -ENOMEM;
++			goto out;
+ 
+ 		err = net_assign_generic(net, *ops->id, data);
+-		if (err) {
+-			kfree(data);
+-			return err;
+-		}
++		if (err)
++			goto cleanup;
+ 	}
++	err = 0;
+ 	if (ops->init)
+-		return ops->init(net);
+-	return 0;
++		err = ops->init(net);
++	if (!err)
++		return 0;
++
++cleanup:
++	kfree(data);
++
++out:
++	return err;
+ }
+ 
+ static void ops_free(const struct pernet_operations *ops, struct net *net)
+@@ -448,12 +456,7 @@ static void __unregister_pernet_operations(struct pernet_operations *ops)
+ static int __register_pernet_operations(struct list_head *list,
+ 					struct pernet_operations *ops)
+ {
+-	int err = 0;
+-	err = ops_init(ops, &init_net);
+-	if (err)
+-		ops_free(ops, &init_net);
+-	return err;
+-	
++	return ops_init(ops, &init_net);
+ }
+ 
+ static void __unregister_pernet_operations(struct pernet_operations *ops)
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 3c30ee4..2ec200de 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -903,9 +903,11 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
+ 		goto adjust_others;
+ 	}
+ 
+-	data = kmalloc(size + sizeof(struct skb_shared_info), gfp_mask);
++	data = kmalloc(size + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)),
++		       gfp_mask);
+ 	if (!data)
+ 		goto nodata;
++	size = SKB_WITH_OVERHEAD(ksize(data));
+ 
+ 	/* Copy only real data... and, alas, header. This should be
+ 	 * optimized for the cases when header is void.
+@@ -3111,6 +3113,8 @@ static void sock_rmem_free(struct sk_buff *skb)
+  */
+ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
+ {
++	int len = skb->len;
++
+ 	if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
+ 	    (unsigned)sk->sk_rcvbuf)
+ 		return -ENOMEM;
+@@ -3125,7 +3129,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
+ 
+ 	skb_queue_tail(&sk->sk_error_queue, skb);
+ 	if (!sock_flag(sk, SOCK_DEAD))
+-		sk->sk_data_ready(sk, skb->len);
++		sk->sk_data_ready(sk, len);
+ 	return 0;
+ }
+ EXPORT_SYMBOL(sock_queue_err_skb);
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 34f5db1..7904db4 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -701,11 +701,12 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
+ 	skb = alloc_skb_fclone(size + sk->sk_prot->max_header, gfp);
+ 	if (skb) {
+ 		if (sk_wmem_schedule(sk, skb->truesize)) {
++			skb_reserve(skb, sk->sk_prot->max_header);
+ 			/*
+ 			 * Make sure that we have exactly size bytes
+ 			 * available to the caller, no more, no less.
+ 			 */
+-			skb_reserve(skb, skb_tailroom(skb) - size);
++			skb->avail_size = size;
+ 			return skb;
+ 		}
+ 		__kfree_skb(skb);
+@@ -860,7 +861,7 @@ wait_for_memory:
+ 	}
+ 
+ out:
+-	if (copied)
++	if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
+ 		tcp_push(sk, flags, mss_now, tp->nonagle);
+ 	return copied;
+ 
+@@ -995,10 +996,9 @@ new_segment:
+ 				copy = seglen;
+ 
+ 			/* Where to copy to? */
+-			if (skb_tailroom(skb) > 0) {
++			if (skb_availroom(skb) > 0) {
+ 				/* We have some space in skb head. Superb! */
+-				if (copy > skb_tailroom(skb))
+-					copy = skb_tailroom(skb);
++				copy = min_t(int, copy, skb_availroom(skb));
+ 				err = skb_add_data_nocache(sk, skb, from, copy);
+ 				if (err)
+ 					goto do_fault;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index e4d1e4a..daedc07 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -334,6 +334,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
+ 			incr = __tcp_grow_window(sk, skb);
+ 
+ 		if (incr) {
++			incr = max_t(int, incr, 2 * skb->len);
+ 			tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
+ 					       tp->window_clamp);
+ 			inet_csk(sk)->icsk_ack.quick |= 1;
+@@ -473,8 +474,11 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)
+ 		if (!win_dep) {
+ 			m -= (new_sample >> 3);
+ 			new_sample += m;
+-		} else if (m < new_sample)
+-			new_sample = m << 3;
++		} else {
++			m <<= 3;
++			if (m < new_sample)
++				new_sample = m;
++		}
+ 	} else {
+ 		/* No previous measure. */
+ 		new_sample = m << 3;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 097e0c7..c51dd5b 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1093,6 +1093,14 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
+ {
+ 	int i, k, eat;
+ 
++	eat = min_t(int, len, skb_headlen(skb));
++	if (eat) {
++		__skb_pull(skb, eat);
++		skb->avail_size -= eat;
++		len -= eat;
++		if (!len)
++			return;
++	}
+ 	eat = len;
+ 	k = 0;
+ 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+@@ -1124,11 +1132,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
+ 	if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+ 		return -ENOMEM;
+ 
+-	/* If len == headlen, we avoid __skb_pull to preserve alignment. */
+-	if (unlikely(len < skb_headlen(skb)))
+-		__skb_pull(skb, len);
+-	else
+-		__pskb_trim_head(skb, len - skb_headlen(skb));
++	__pskb_trim_head(skb, len);
+ 
+ 	TCP_SKB_CB(skb)->seq += len;
+ 	skb->ip_summed = CHECKSUM_PARTIAL;
+@@ -2057,7 +2061,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
+ 		/* Punt if not enough space exists in the first SKB for
+ 		 * the data in the second
+ 		 */
+-		if (skb->len > skb_tailroom(to))
++		if (skb->len > skb_availroom(to))
+ 			break;
+ 
+ 		if (after(TCP_SKB_CB(skb)->end_seq, tcp_wnd_end(tp)))
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index 2257366..f2d74ea 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -2054,7 +2054,7 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
+ 		if (!delta)
+ 			pmc->mca_sfcount[sfmode]--;
+ 		for (j=0; j<i; j++)
+-			(void) ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
++			ip6_mc_del1_src(pmc, sfmode, &psfsrc[j]);
+ 	} else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
+ 		struct ip6_sf_list *psf;
+ 
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index b859e4a..4a56574 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1494,6 +1494,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
+ 	tcp_mtup_init(newsk);
+ 	tcp_sync_mss(newsk, dst_mtu(dst));
+ 	newtp->advmss = dst_metric_advmss(dst);
++	if (tcp_sk(sk)->rx_opt.user_mss &&
++	    tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
++		newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
++
+ 	tcp_initialize_rcv_mss(newsk);
+ 	if (tcp_rsk(req)->snt_synack)
+ 		tcp_valid_rtt_meas(newsk,
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index eff1f4e..4ff35bf 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1121,7 +1121,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
+ 		tx->sta = rcu_dereference(sdata->u.vlan.sta);
+ 		if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
+ 			return TX_DROP;
+-	} else if (info->flags & IEEE80211_TX_CTL_INJECTED) {
++	} else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
++		   tx->sdata->control_port_protocol == tx->skb->protocol) {
+ 		tx->sta = sta_info_get_bss(sdata, hdr->addr1);
+ 	}
+ 	if (!tx->sta)
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 1201b6d..a99fb41 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -830,12 +830,19 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
+ 	return 0;
+ }
+ 
+-int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
++static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
+ {
+ 	int len = skb->len;
+ 
+ 	skb_queue_tail(&sk->sk_receive_queue, skb);
+ 	sk->sk_data_ready(sk, len);
++	return len;
++}
++
++int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
++{
++	int len = __netlink_sendskb(sk, skb);
++
+ 	sock_put(sk);
+ 	return len;
+ }
+@@ -960,8 +967,7 @@ static inline int netlink_broadcast_deliver(struct sock *sk,
+ 	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
+ 	    !test_bit(0, &nlk->state)) {
+ 		skb_set_owner_r(skb, sk);
+-		skb_queue_tail(&sk->sk_receive_queue, skb);
+-		sk->sk_data_ready(sk, skb->len);
++		__netlink_sendskb(sk, skb);
+ 		return atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf;
+ 	}
+ 	return -1;
+@@ -1684,10 +1690,8 @@ static int netlink_dump(struct sock *sk)
+ 
+ 		if (sk_filter(sk, skb))
+ 			kfree_skb(skb);
+-		else {
+-			skb_queue_tail(&sk->sk_receive_queue, skb);
+-			sk->sk_data_ready(sk, skb->len);
+-		}
++		else
++			__netlink_sendskb(sk, skb);
+ 		return 0;
+ 	}
+ 
+@@ -1701,10 +1705,8 @@ static int netlink_dump(struct sock *sk)
+ 
+ 	if (sk_filter(sk, skb))
+ 		kfree_skb(skb);
+-	else {
+-		skb_queue_tail(&sk->sk_receive_queue, skb);
+-		sk->sk_data_ready(sk, skb->len);
+-	}
++	else
++		__netlink_sendskb(sk, skb);
+ 
+ 	if (cb->done)
+ 		cb->done(cb);
+diff --git a/net/phonet/pep.c b/net/phonet/pep.c
+index 2ba6e9f..007546d 100644
+--- a/net/phonet/pep.c
++++ b/net/phonet/pep.c
+@@ -1046,6 +1046,9 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
+ 	int flags = msg->msg_flags;
+ 	int err, done;
+ 
++	if (len > USHRT_MAX)
++		return -EMSGSIZE;
++
+ 	if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|
+ 				MSG_CMSG_COMPAT)) ||
+ 			!(msg->msg_flags & MSG_EOR))
+diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
+index 6cd8ddf..e1afe0c 100644
+--- a/net/sched/sch_gred.c
++++ b/net/sched/sch_gred.c
+@@ -544,11 +544,8 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
+ 		opt.packets	= q->packetsin;
+ 		opt.bytesin	= q->bytesin;
+ 
+-		if (gred_wred_mode(table)) {
+-			q->parms.qidlestart =
+-				table->tab[table->def]->parms.qidlestart;
+-			q->parms.qavg = table->tab[table->def]->parms.qavg;
+-		}
++		if (gred_wred_mode(table))
++			gred_load_wred_set(table, q);
+ 
+ 		opt.qave = red_calc_qavg(&q->parms, q->parms.qavg);
+ 
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 54a7cd2..0075554 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -4133,9 +4133,10 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
+ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
+ 				  int __user *optlen)
+ {
+-	if (len < sizeof(struct sctp_event_subscribe))
++	if (len <= 0)
+ 		return -EINVAL;
+-	len = sizeof(struct sctp_event_subscribe);
++	if (len > sizeof(struct sctp_event_subscribe))
++		len = sizeof(struct sctp_event_subscribe);
+ 	if (put_user(len, optlen))
+ 		return -EFAULT;
+ 	if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len))
+diff --git a/net/socket.c b/net/socket.c
+index 2dce67a..273cbce 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -791,9 +791,9 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
+ 
+ 	sock = file->private_data;
+ 
+-	flags = !(file->f_flags & O_NONBLOCK) ? 0 : MSG_DONTWAIT;
+-	if (more)
+-		flags |= MSG_MORE;
++	flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
++	/* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
++	flags |= more;
+ 
+ 	return kernel_sendpage(sock, page, offset, size, flags);
+ }
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index ffafda5..c06c365 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -1258,6 +1258,11 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
+ 			goto bad_res;
+ 		}
+ 
++		if (!netif_running(netdev)) {
++			result = -ENETDOWN;
++			goto bad_res;
++		}
++
+ 		nla_for_each_nested(nl_txq_params,
+ 				    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
+ 				    rem_txq_params) {
+@@ -5944,7 +5949,7 @@ static struct genl_ops nl80211_ops[] = {
+ 		.doit = nl80211_get_key,
+ 		.policy = nl80211_policy,
+ 		.flags = GENL_ADMIN_PERM,
+-		.internal_flags = NL80211_FLAG_NEED_NETDEV |
++		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+ 				  NL80211_FLAG_NEED_RTNL,
+ 	},
+ 	{
+@@ -5976,7 +5981,7 @@ static struct genl_ops nl80211_ops[] = {
+ 		.policy = nl80211_policy,
+ 		.flags = GENL_ADMIN_PERM,
+ 		.doit = nl80211_addset_beacon,
+-		.internal_flags = NL80211_FLAG_NEED_NETDEV |
++		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+ 				  NL80211_FLAG_NEED_RTNL,
+ 	},
+ 	{
+@@ -5984,7 +5989,7 @@ static struct genl_ops nl80211_ops[] = {
+ 		.policy = nl80211_policy,
+ 		.flags = GENL_ADMIN_PERM,
+ 		.doit = nl80211_addset_beacon,
+-		.internal_flags = NL80211_FLAG_NEED_NETDEV |
++		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+ 				  NL80211_FLAG_NEED_RTNL,
+ 	},
+ 	{
+@@ -6008,7 +6013,7 @@ static struct genl_ops nl80211_ops[] = {
+ 		.doit = nl80211_set_station,
+ 		.policy = nl80211_policy,
+ 		.flags = GENL_ADMIN_PERM,
+-		.internal_flags = NL80211_FLAG_NEED_NETDEV |
++		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+ 				  NL80211_FLAG_NEED_RTNL,
+ 	},
+ 	{
+@@ -6024,7 +6029,7 @@ static struct genl_ops nl80211_ops[] = {
+ 		.doit = nl80211_del_station,
+ 		.policy = nl80211_policy,
+ 		.flags = GENL_ADMIN_PERM,
+-		.internal_flags = NL80211_FLAG_NEED_NETDEV |
++		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+ 				  NL80211_FLAG_NEED_RTNL,
+ 	},
+ 	{
+@@ -6057,7 +6062,7 @@ static struct genl_ops nl80211_ops[] = {
+ 		.doit = nl80211_del_mpath,
+ 		.policy = nl80211_policy,
+ 		.flags = GENL_ADMIN_PERM,
+-		.internal_flags = NL80211_FLAG_NEED_NETDEV |
++		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+ 				  NL80211_FLAG_NEED_RTNL,
+ 	},
+ 	{
+@@ -6065,7 +6070,7 @@ static struct genl_ops nl80211_ops[] = {
+ 		.doit = nl80211_set_bss,
+ 		.policy = nl80211_policy,
+ 		.flags = GENL_ADMIN_PERM,
+-		.internal_flags = NL80211_FLAG_NEED_NETDEV |
++		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+ 				  NL80211_FLAG_NEED_RTNL,
+ 	},
+ 	{
+@@ -6091,7 +6096,7 @@ static struct genl_ops nl80211_ops[] = {
+ 		.doit = nl80211_get_mesh_config,
+ 		.policy = nl80211_policy,
+ 		/* can be retrieved by unprivileged users */
+-		.internal_flags = NL80211_FLAG_NEED_NETDEV |
++		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+ 				  NL80211_FLAG_NEED_RTNL,
+ 	},
+ 	{
+@@ -6224,7 +6229,7 @@ static struct genl_ops nl80211_ops[] = {
+ 		.doit = nl80211_setdel_pmksa,
+ 		.policy = nl80211_policy,
+ 		.flags = GENL_ADMIN_PERM,
+-		.internal_flags = NL80211_FLAG_NEED_NETDEV |
++		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+ 				  NL80211_FLAG_NEED_RTNL,
+ 	},
+ 	{
+@@ -6232,7 +6237,7 @@ static struct genl_ops nl80211_ops[] = {
+ 		.doit = nl80211_setdel_pmksa,
+ 		.policy = nl80211_policy,
+ 		.flags = GENL_ADMIN_PERM,
+-		.internal_flags = NL80211_FLAG_NEED_NETDEV |
++		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+ 				  NL80211_FLAG_NEED_RTNL,
+ 	},
+ 	{
+@@ -6240,7 +6245,7 @@ static struct genl_ops nl80211_ops[] = {
+ 		.doit = nl80211_flush_pmksa,
+ 		.policy = nl80211_policy,
+ 		.flags = GENL_ADMIN_PERM,
+-		.internal_flags = NL80211_FLAG_NEED_NETDEV |
++		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+ 				  NL80211_FLAG_NEED_RTNL,
+ 	},
+ 	{
+@@ -6328,7 +6333,7 @@ static struct genl_ops nl80211_ops[] = {
+ 		.doit = nl80211_set_wds_peer,
+ 		.policy = nl80211_policy,
+ 		.flags = GENL_ADMIN_PERM,
+-		.internal_flags = NL80211_FLAG_NEED_NETDEV |
++		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+ 				  NL80211_FLAG_NEED_RTNL,
+ 	},
+ 	{
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 4dde429..8bf8902 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -996,7 +996,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
+ 			if (rdev->wiphy.software_iftypes & BIT(iftype))
+ 				continue;
+ 			for (j = 0; j < c->n_limits; j++) {
+-				if (!(limits[j].types & iftype))
++				if (!(limits[j].types & BIT(iftype)))
+ 					continue;
+ 				if (limits[j].max < num[iftype])
+ 					goto cont;
+diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
+index f936d1f..d1d0ae8 100644
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -926,6 +926,10 @@ void handle_moddevtable(struct module *mod, struct elf_info *info,
+ 	if (!sym->st_shndx || get_secindex(info, sym) >= info->num_sections)
+ 		return;
+ 
++	/* We're looking for an object */
++	if (ELF_ST_TYPE(sym->st_info) != STT_OBJECT)
++		return;
++
+ 	/* Handle all-NULL symbols allocated into .bss */
+ 	if (info->sechdrs[get_secindex(info, sym)].sh_type & SHT_NOBITS) {
+ 		zeros = calloc(1, sym->st_size);
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index ae94929..51a1afc 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -4003,9 +4003,14 @@ static void cx_auto_init_output(struct hda_codec *codec)
+ 	int i;
+ 
+ 	mute_outputs(codec, spec->multiout.num_dacs, spec->multiout.dac_nids);
+-	for (i = 0; i < cfg->hp_outs; i++)
++	for (i = 0; i < cfg->hp_outs; i++) {
++		unsigned int val = PIN_OUT;
++		if (snd_hda_query_pin_caps(codec, cfg->hp_pins[i]) &
++		    AC_PINCAP_HP_DRV)
++			val |= AC_PINCTL_HP_EN;
+ 		snd_hda_codec_write(codec, cfg->hp_pins[i], 0,
+-				    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP);
++				    AC_VERB_SET_PIN_WIDGET_CONTROL, val);
++	}
+ 	mute_outputs(codec, cfg->hp_outs, cfg->hp_pins);
+ 	mute_outputs(codec, cfg->line_outs, cfg->line_out_pins);
+ 	mute_outputs(codec, cfg->speaker_outs, cfg->speaker_pins);
+@@ -4408,8 +4413,10 @@ static void apply_pin_fixup(struct hda_codec *codec,
+ 
+ enum {
+ 	CXT_PINCFG_LENOVO_X200,
++	CXT_PINCFG_LENOVO_TP410,
+ };
+ 
++/* ThinkPad X200 & co with cxt5051 */
+ static const struct cxt_pincfg cxt_pincfg_lenovo_x200[] = {
+ 	{ 0x16, 0x042140ff }, /* HP (seq# overridden) */
+ 	{ 0x17, 0x21a11000 }, /* dock-mic */
+@@ -4417,15 +4424,33 @@ static const struct cxt_pincfg cxt_pincfg_lenovo_x200[] = {
+ 	{}
+ };
+ 
++/* ThinkPad 410/420/510/520, X201 & co with cxt5066 */
++static const struct cxt_pincfg cxt_pincfg_lenovo_tp410[] = {
++	{ 0x19, 0x042110ff }, /* HP (seq# overridden) */
++	{ 0x1a, 0x21a190f0 }, /* dock-mic */
++	{ 0x1c, 0x212140ff }, /* dock-HP */
++	{}
++};
++
+ static const struct cxt_pincfg *cxt_pincfg_tbl[] = {
+ 	[CXT_PINCFG_LENOVO_X200] = cxt_pincfg_lenovo_x200,
++	[CXT_PINCFG_LENOVO_TP410] = cxt_pincfg_lenovo_tp410,
+ };
+ 
+-static const struct snd_pci_quirk cxt_fixups[] = {
++static const struct snd_pci_quirk cxt5051_fixups[] = {
+ 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
+ 	{}
+ };
+ 
++static const struct snd_pci_quirk cxt5066_fixups[] = {
++	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
++	SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410),
++	SND_PCI_QUIRK(0x17aa, 0x215f, "Lenovo T510", CXT_PINCFG_LENOVO_TP410),
++	SND_PCI_QUIRK(0x17aa, 0x21ce, "Lenovo T420", CXT_PINCFG_LENOVO_TP410),
++	SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
++	{}
++};
++
+ /* add "fake" mute amp-caps to DACs on cx5051 so that mixer mute switches
+  * can be created (bko#42825)
+  */
+@@ -4462,11 +4487,13 @@ static int patch_conexant_auto(struct hda_codec *codec)
+ 		break;
+ 	case 0x14f15051:
+ 		add_cx5051_fake_mutes(codec);
++		apply_pin_fixup(codec, cxt5051_fixups, cxt_pincfg_tbl);
++		break;
++	default:
++		apply_pin_fixup(codec, cxt5066_fixups, cxt_pincfg_tbl);
+ 		break;
+ 	}
+ 
+-	apply_pin_fixup(codec, cxt_fixups, cxt_pincfg_tbl);
+-
+ 	err = cx_auto_search_adcs(codec);
+ 	if (err < 0)
+ 		return err;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index dc8a6fc..0bc5a46 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5032,6 +5032,7 @@ static const struct alc_fixup alc269_fixups[] = {
+ };
+ 
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
++	SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_DMIC),
+ 	SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+ 	SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
+ 	SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
+diff --git a/sound/soc/codecs/tlv320aic23.c b/sound/soc/codecs/tlv320aic23.c
+index 336de8f..0e7e26e 100644
+--- a/sound/soc/codecs/tlv320aic23.c
++++ b/sound/soc/codecs/tlv320aic23.c
+@@ -473,7 +473,7 @@ static int tlv320aic23_set_dai_sysclk(struct snd_soc_dai *codec_dai,
+ static int tlv320aic23_set_bias_level(struct snd_soc_codec *codec,
+ 				      enum snd_soc_bias_level level)
+ {
+-	u16 reg = snd_soc_read(codec, TLV320AIC23_PWR) & 0xff7f;
++	u16 reg = snd_soc_read(codec, TLV320AIC23_PWR) & 0x17f;
+ 
+ 	switch (level) {
+ 	case SND_SOC_BIAS_ON:
+@@ -492,7 +492,7 @@ static int tlv320aic23_set_bias_level(struct snd_soc_codec *codec,
+ 	case SND_SOC_BIAS_OFF:
+ 		/* everything off, dac mute, inactive */
+ 		snd_soc_write(codec, TLV320AIC23_ACTIVE, 0x0);
+-		snd_soc_write(codec, TLV320AIC23_PWR, 0xffff);
++		snd_soc_write(codec, TLV320AIC23_PWR, 0x1ff);
+ 		break;
+ 	}
+ 	codec->dapm.bias_level = level;
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index 2f1f5f8..7806301 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -883,61 +883,170 @@ static void wm8994_update_class_w(struct snd_soc_codec *codec)
+ 	}
+ }
+ 
+-static int late_enable_ev(struct snd_soc_dapm_widget *w,
+-			  struct snd_kcontrol *kcontrol, int event)
++static int aif1clk_ev(struct snd_soc_dapm_widget *w,
++		      struct snd_kcontrol *kcontrol, int event)
+ {
+ 	struct snd_soc_codec *codec = w->codec;
+-	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
++	struct wm8994 *control = codec->control_data;
++	int mask = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC1R_ENA;
++	int dac;
++	int adc;
++	int val;
++
++	switch (control->type) {
++	case WM8994:
++	case WM8958:
++		mask |= WM8994_AIF1DAC2L_ENA | WM8994_AIF1DAC2R_ENA;
++		break;
++	default:
++		break;
++	}
+ 
+ 	switch (event) {
+ 	case SND_SOC_DAPM_PRE_PMU:
+-		if (wm8994->aif1clk_enable) {
+-			snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
+-					    WM8994_AIF1CLK_ENA_MASK,
+-					    WM8994_AIF1CLK_ENA);
+-			wm8994->aif1clk_enable = 0;
+-		}
+-		if (wm8994->aif2clk_enable) {
+-			snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
+-					    WM8994_AIF2CLK_ENA_MASK,
+-					    WM8994_AIF2CLK_ENA);
+-			wm8994->aif2clk_enable = 0;
+-		}
++		val = snd_soc_read(codec, WM8994_AIF1_CONTROL_1);
++		if ((val & WM8994_AIF1ADCL_SRC) &&
++		    (val & WM8994_AIF1ADCR_SRC))
++			adc = WM8994_AIF1ADC1R_ENA | WM8994_AIF1ADC2R_ENA;
++		else if (!(val & WM8994_AIF1ADCL_SRC) &&
++			 !(val & WM8994_AIF1ADCR_SRC))
++			adc = WM8994_AIF1ADC1L_ENA | WM8994_AIF1ADC2L_ENA;
++		else
++			adc = WM8994_AIF1ADC1R_ENA | WM8994_AIF1ADC2R_ENA |
++				WM8994_AIF1ADC1L_ENA | WM8994_AIF1ADC2L_ENA;
++
++		val = snd_soc_read(codec, WM8994_AIF1_CONTROL_2);
++		if ((val & WM8994_AIF1DACL_SRC) &&
++		    (val & WM8994_AIF1DACR_SRC))
++			dac = WM8994_AIF1DAC1R_ENA | WM8994_AIF1DAC2R_ENA;
++		else if (!(val & WM8994_AIF1DACL_SRC) &&
++			 !(val & WM8994_AIF1DACR_SRC))
++			dac = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC2L_ENA;
++		else
++			dac = WM8994_AIF1DAC1R_ENA | WM8994_AIF1DAC2R_ENA |
++				WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC2L_ENA;
++
++		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
++				    mask, adc);
++		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++				    mask, dac);
++		snd_soc_update_bits(codec, WM8994_CLOCKING_1,
++				    WM8994_AIF1DSPCLK_ENA |
++				    WM8994_SYSDSPCLK_ENA,
++				    WM8994_AIF1DSPCLK_ENA |
++				    WM8994_SYSDSPCLK_ENA);
++		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4, mask,
++				    WM8994_AIF1ADC1R_ENA |
++				    WM8994_AIF1ADC1L_ENA |
++				    WM8994_AIF1ADC2R_ENA |
++				    WM8994_AIF1ADC2L_ENA);
++		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, mask,
++				    WM8994_AIF1DAC1R_ENA |
++				    WM8994_AIF1DAC1L_ENA |
++				    WM8994_AIF1DAC2R_ENA |
++				    WM8994_AIF1DAC2L_ENA);
++		break;
++
++	case SND_SOC_DAPM_PRE_PMD:
++	case SND_SOC_DAPM_POST_PMD:
++		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++				    mask, 0);
++		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
++				    mask, 0);
++
++		val = snd_soc_read(codec, WM8994_CLOCKING_1);
++		if (val & WM8994_AIF2DSPCLK_ENA)
++			val = WM8994_SYSDSPCLK_ENA;
++		else
++			val = 0;
++		snd_soc_update_bits(codec, WM8994_CLOCKING_1,
++				    WM8994_SYSDSPCLK_ENA |
++				    WM8994_AIF1DSPCLK_ENA, val);
+ 		break;
+ 	}
+ 
+-	/* We may also have postponed startup of DSP, handle that. */
+-	wm8958_aif_ev(w, kcontrol, event);
+-
+ 	return 0;
+ }
+ 
+-static int late_disable_ev(struct snd_soc_dapm_widget *w,
+-			   struct snd_kcontrol *kcontrol, int event)
++static int aif2clk_ev(struct snd_soc_dapm_widget *w,
++		      struct snd_kcontrol *kcontrol, int event)
+ {
+ 	struct snd_soc_codec *codec = w->codec;
+-	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
++	int dac;
++	int adc;
++	int val;
+ 
+ 	switch (event) {
++	case SND_SOC_DAPM_PRE_PMU:
++		val = snd_soc_read(codec, WM8994_AIF2_CONTROL_1);
++		if ((val & WM8994_AIF2ADCL_SRC) &&
++		    (val & WM8994_AIF2ADCR_SRC))
++			adc = WM8994_AIF2ADCR_ENA;
++		else if (!(val & WM8994_AIF2ADCL_SRC) &&
++			 !(val & WM8994_AIF2ADCR_SRC))
++			adc = WM8994_AIF2ADCL_ENA;
++		else
++			adc = WM8994_AIF2ADCL_ENA | WM8994_AIF2ADCR_ENA;
++
++
++		val = snd_soc_read(codec, WM8994_AIF2_CONTROL_2);
++		if ((val & WM8994_AIF2DACL_SRC) &&
++		    (val & WM8994_AIF2DACR_SRC))
++			dac = WM8994_AIF2DACR_ENA;
++		else if (!(val & WM8994_AIF2DACL_SRC) &&
++			 !(val & WM8994_AIF2DACR_SRC))
++			dac = WM8994_AIF2DACL_ENA;
++		else
++			dac = WM8994_AIF2DACL_ENA | WM8994_AIF2DACR_ENA;
++
++		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
++				    WM8994_AIF2ADCL_ENA |
++				    WM8994_AIF2ADCR_ENA, adc);
++		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++				    WM8994_AIF2DACL_ENA |
++				    WM8994_AIF2DACR_ENA, dac);
++		snd_soc_update_bits(codec, WM8994_CLOCKING_1,
++				    WM8994_AIF2DSPCLK_ENA |
++				    WM8994_SYSDSPCLK_ENA,
++				    WM8994_AIF2DSPCLK_ENA |
++				    WM8994_SYSDSPCLK_ENA);
++		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
++				    WM8994_AIF2ADCL_ENA |
++				    WM8994_AIF2ADCR_ENA,
++				    WM8994_AIF2ADCL_ENA |
++				    WM8994_AIF2ADCR_ENA);
++		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++				    WM8994_AIF2DACL_ENA |
++				    WM8994_AIF2DACR_ENA,
++				    WM8994_AIF2DACL_ENA |
++				    WM8994_AIF2DACR_ENA);
++		break;
++
++	case SND_SOC_DAPM_PRE_PMD:
+ 	case SND_SOC_DAPM_POST_PMD:
+-		if (wm8994->aif1clk_disable) {
+-			snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
+-					    WM8994_AIF1CLK_ENA_MASK, 0);
+-			wm8994->aif1clk_disable = 0;
+-		}
+-		if (wm8994->aif2clk_disable) {
+-			snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
+-					    WM8994_AIF2CLK_ENA_MASK, 0);
+-			wm8994->aif2clk_disable = 0;
+-		}
++		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++				    WM8994_AIF2DACL_ENA |
++				    WM8994_AIF2DACR_ENA, 0);
++		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++				    WM8994_AIF2ADCL_ENA |
++				    WM8994_AIF2ADCR_ENA, 0);
++
++		val = snd_soc_read(codec, WM8994_CLOCKING_1);
++		if (val & WM8994_AIF1DSPCLK_ENA)
++			val = WM8994_SYSDSPCLK_ENA;
++		else
++			val = 0;
++		snd_soc_update_bits(codec, WM8994_CLOCKING_1,
++				    WM8994_SYSDSPCLK_ENA |
++				    WM8994_AIF2DSPCLK_ENA, val);
+ 		break;
+ 	}
+ 
+ 	return 0;
+ }
+ 
+-static int aif1clk_ev(struct snd_soc_dapm_widget *w,
+-		      struct snd_kcontrol *kcontrol, int event)
++static int aif1clk_late_ev(struct snd_soc_dapm_widget *w,
++			   struct snd_kcontrol *kcontrol, int event)
+ {
+ 	struct snd_soc_codec *codec = w->codec;
+ 	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+@@ -954,8 +1063,8 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w,
+ 	return 0;
+ }
+ 
+-static int aif2clk_ev(struct snd_soc_dapm_widget *w,
+-		      struct snd_kcontrol *kcontrol, int event)
++static int aif2clk_late_ev(struct snd_soc_dapm_widget *w,
++			   struct snd_kcontrol *kcontrol, int event)
+ {
+ 	struct snd_soc_codec *codec = w->codec;
+ 	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+@@ -972,6 +1081,63 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w,
+ 	return 0;
+ }
+ 
++static int late_enable_ev(struct snd_soc_dapm_widget *w,
++			  struct snd_kcontrol *kcontrol, int event)
++{
++	struct snd_soc_codec *codec = w->codec;
++	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
++
++	switch (event) {
++	case SND_SOC_DAPM_PRE_PMU:
++		if (wm8994->aif1clk_enable) {
++			aif1clk_ev(w, kcontrol, event);
++			snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
++					    WM8994_AIF1CLK_ENA_MASK,
++					    WM8994_AIF1CLK_ENA);
++			wm8994->aif1clk_enable = 0;
++		}
++		if (wm8994->aif2clk_enable) {
++			aif2clk_ev(w, kcontrol, event);
++			snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
++					    WM8994_AIF2CLK_ENA_MASK,
++					    WM8994_AIF2CLK_ENA);
++			wm8994->aif2clk_enable = 0;
++		}
++		break;
++	}
++
++	/* We may also have postponed startup of DSP, handle that. */
++	wm8958_aif_ev(w, kcontrol, event);
++
++	return 0;
++}
++
++static int late_disable_ev(struct snd_soc_dapm_widget *w,
++			   struct snd_kcontrol *kcontrol, int event)
++{
++	struct snd_soc_codec *codec = w->codec;
++	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
++
++	switch (event) {
++	case SND_SOC_DAPM_POST_PMD:
++		if (wm8994->aif1clk_disable) {
++			snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
++					    WM8994_AIF1CLK_ENA_MASK, 0);
++			aif1clk_ev(w, kcontrol, event);
++			wm8994->aif1clk_disable = 0;
++		}
++		if (wm8994->aif2clk_disable) {
++			snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
++					    WM8994_AIF2CLK_ENA_MASK, 0);
++			aif2clk_ev(w, kcontrol, event);
++			wm8994->aif2clk_disable = 0;
++		}
++		break;
++	}
++
++	return 0;
++}
++
+ static int adc_mux_ev(struct snd_soc_dapm_widget *w,
+ 		      struct snd_kcontrol *kcontrol, int event)
+ {
+@@ -1268,9 +1434,9 @@ static const struct snd_kcontrol_new aif2dacr_src_mux =
+ 	SOC_DAPM_ENUM("AIF2DACR Mux", aif2dacr_src_enum);
+ 
+ static const struct snd_soc_dapm_widget wm8994_lateclk_revd_widgets[] = {
+-SND_SOC_DAPM_SUPPLY("AIF1CLK", SND_SOC_NOPM, 0, 0, aif1clk_ev,
++SND_SOC_DAPM_SUPPLY("AIF1CLK", SND_SOC_NOPM, 0, 0, aif1clk_late_ev,
+ 	SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+-SND_SOC_DAPM_SUPPLY("AIF2CLK", SND_SOC_NOPM, 0, 0, aif2clk_ev,
++SND_SOC_DAPM_SUPPLY("AIF2CLK", SND_SOC_NOPM, 0, 0, aif2clk_late_ev,
+ 	SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+ 
+ SND_SOC_DAPM_PGA_E("Late DAC1L Enable PGA", SND_SOC_NOPM, 0, 0, NULL, 0,
+@@ -1299,8 +1465,10 @@ SND_SOC_DAPM_POST("Late Disable PGA", late_disable_ev)
+ };
+ 
+ static const struct snd_soc_dapm_widget wm8994_lateclk_widgets[] = {
+-SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, NULL, 0),
+-SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, NULL, 0),
++SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, aif1clk_ev,
++		    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
++SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, aif2clk_ev,
++		    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
+ SND_SOC_DAPM_PGA("Direct Voice", SND_SOC_NOPM, 0, 0, NULL, 0),
+ SND_SOC_DAPM_MIXER("SPKL", WM8994_POWER_MANAGEMENT_3, 8, 0,
+ 		   left_speaker_mixer, ARRAY_SIZE(left_speaker_mixer)),
+@@ -1353,30 +1521,30 @@ SND_SOC_DAPM_SUPPLY("VMID", SND_SOC_NOPM, 0, 0, vmid_event,
+ SND_SOC_DAPM_SUPPLY("CLK_SYS", SND_SOC_NOPM, 0, 0, clk_sys_event,
+ 		    SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+ 
+-SND_SOC_DAPM_SUPPLY("DSP1CLK", WM8994_CLOCKING_1, 3, 0, NULL, 0),
+-SND_SOC_DAPM_SUPPLY("DSP2CLK", WM8994_CLOCKING_1, 2, 0, NULL, 0),
+-SND_SOC_DAPM_SUPPLY("DSPINTCLK", WM8994_CLOCKING_1, 1, 0, NULL, 0),
++SND_SOC_DAPM_SUPPLY("DSP1CLK", SND_SOC_NOPM, 3, 0, NULL, 0),
++SND_SOC_DAPM_SUPPLY("DSP2CLK", SND_SOC_NOPM, 2, 0, NULL, 0),
++SND_SOC_DAPM_SUPPLY("DSPINTCLK", SND_SOC_NOPM, 1, 0, NULL, 0),
+ 
+ SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", NULL,
+-		     0, WM8994_POWER_MANAGEMENT_4, 9, 0),
++		     0, SND_SOC_NOPM, 9, 0),
+ SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", NULL,
+-		     0, WM8994_POWER_MANAGEMENT_4, 8, 0),
++		     0, SND_SOC_NOPM, 8, 0),
+ SND_SOC_DAPM_AIF_IN_E("AIF1DAC1L", NULL, 0,
+-		      WM8994_POWER_MANAGEMENT_5, 9, 0, wm8958_aif_ev,
++		      SND_SOC_NOPM, 9, 0, wm8958_aif_ev,
+ 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+ SND_SOC_DAPM_AIF_IN_E("AIF1DAC1R", NULL, 0,
+-		      WM8994_POWER_MANAGEMENT_5, 8, 0, wm8958_aif_ev,
++		      SND_SOC_NOPM, 8, 0, wm8958_aif_ev,
+ 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+ 
+ SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", NULL,
+-		     0, WM8994_POWER_MANAGEMENT_4, 11, 0),
++		     0, SND_SOC_NOPM, 11, 0),
+ SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", NULL,
+-		     0, WM8994_POWER_MANAGEMENT_4, 10, 0),
++		     0, SND_SOC_NOPM, 10, 0),
+ SND_SOC_DAPM_AIF_IN_E("AIF1DAC2L", NULL, 0,
+-		      WM8994_POWER_MANAGEMENT_5, 11, 0, wm8958_aif_ev,
++		      SND_SOC_NOPM, 11, 0, wm8958_aif_ev,
+ 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+ SND_SOC_DAPM_AIF_IN_E("AIF1DAC2R", NULL, 0,
+-		      WM8994_POWER_MANAGEMENT_5, 10, 0, wm8958_aif_ev,
++		      SND_SOC_NOPM, 10, 0, wm8958_aif_ev,
+ 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+ 
+ SND_SOC_DAPM_MIXER("AIF1ADC1L Mixer", SND_SOC_NOPM, 0, 0,
+@@ -1403,14 +1571,14 @@ SND_SOC_DAPM_MIXER("DAC1R Mixer", SND_SOC_NOPM, 0, 0,
+ 		   dac1r_mix, ARRAY_SIZE(dac1r_mix)),
+ 
+ SND_SOC_DAPM_AIF_OUT("AIF2ADCL", NULL, 0,
+-		     WM8994_POWER_MANAGEMENT_4, 13, 0),
++		     SND_SOC_NOPM, 13, 0),
+ SND_SOC_DAPM_AIF_OUT("AIF2ADCR", NULL, 0,
+-		     WM8994_POWER_MANAGEMENT_4, 12, 0),
++		     SND_SOC_NOPM, 12, 0),
+ SND_SOC_DAPM_AIF_IN_E("AIF2DACL", NULL, 0,
+-		      WM8994_POWER_MANAGEMENT_5, 13, 0, wm8958_aif_ev,
++		      SND_SOC_NOPM, 13, 0, wm8958_aif_ev,
+ 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+ SND_SOC_DAPM_AIF_IN_E("AIF2DACR", NULL, 0,
+-		      WM8994_POWER_MANAGEMENT_5, 12, 0, wm8958_aif_ev,
++		      SND_SOC_NOPM, 12, 0, wm8958_aif_ev,
+ 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+ 
+ SND_SOC_DAPM_AIF_IN("AIF1DACDAT", "AIF1 Playback", 0, SND_SOC_NOPM, 0, 0),
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index ea909c5..90e93bf 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -69,6 +69,7 @@ static int dapm_up_seq[] = {
+ 	[snd_soc_dapm_out_drv] = 10,
+ 	[snd_soc_dapm_hp] = 10,
+ 	[snd_soc_dapm_spk] = 10,
++	[snd_soc_dapm_line] = 10,
+ 	[snd_soc_dapm_post] = 11,
+ };
+ 
+@@ -77,6 +78,7 @@ static int dapm_down_seq[] = {
+ 	[snd_soc_dapm_adc] = 1,
+ 	[snd_soc_dapm_hp] = 2,
+ 	[snd_soc_dapm_spk] = 2,
++	[snd_soc_dapm_line] = 2,
+ 	[snd_soc_dapm_out_drv] = 2,
+ 	[snd_soc_dapm_pga] = 4,
+ 	[snd_soc_dapm_mixer_named_ctl] = 5,
+diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
+index adb372d..e0a0970 100644
+--- a/tools/perf/util/hist.c
++++ b/tools/perf/util/hist.c
+@@ -237,8 +237,8 @@ struct hist_entry *__hists__add_entry(struct hists *hists,
+ 			 * mis-adjust symbol addresses when computing
+ 			 * the history counter to increment.
+ 			 */
+-			if (he->ms.map != entry->ms.map) {
+-				he->ms.map = entry->ms.map;
++			if (he->ms.map != entry.ms.map) {
++				he->ms.map = entry.ms.map;
+ 				if (he->ms.map)
+ 					he->ms.map->referenced = true;
+ 			}
+diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
+index a195c07..fd817a2 100644
+--- a/virt/kvm/iommu.c
++++ b/virt/kvm/iommu.c
+@@ -309,6 +309,11 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
+ 	}
+ }
+ 
++void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
++{
++	kvm_iommu_put_pages(kvm, slot->base_gfn, slot->npages);
++}
++
+ static int kvm_iommu_unmap_memslots(struct kvm *kvm)
+ {
+ 	int i, idx;
+@@ -317,10 +322,9 @@ static int kvm_iommu_unmap_memslots(struct kvm *kvm)
+ 	idx = srcu_read_lock(&kvm->srcu);
+ 	slots = kvm_memslots(kvm);
+ 
+-	for (i = 0; i < slots->nmemslots; i++) {
+-		kvm_iommu_put_pages(kvm, slots->memslots[i].base_gfn,
+-				    slots->memslots[i].npages);
+-	}
++	for (i = 0; i < slots->nmemslots; i++)
++		kvm_iommu_unmap_pages(kvm, &slots->memslots[i]);
++
+ 	srcu_read_unlock(&kvm->srcu, idx);
+ 
+ 	return 0;
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index d9cfb78..e401c1b 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -802,12 +802,13 @@ skip_lpage:
+ 	if (r)
+ 		goto out_free;
+ 
+-	/* map the pages in iommu page table */
++	/* map/unmap the pages in iommu page table */
+ 	if (npages) {
+ 		r = kvm_iommu_map_pages(kvm, &new);
+ 		if (r)
+ 			goto out_free;
+-	}
++	} else
++		kvm_iommu_unmap_pages(kvm, &old);
+ 
+ 	r = -ENOMEM;
+ 	slots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);

Added: genpatches-2.6/trunk/3.2/1017_linux-3.2.18.patch
===================================================================
--- genpatches-2.6/trunk/3.2/1017_linux-3.2.18.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.2/1017_linux-3.2.18.patch	2012-06-06 00:46:35 UTC (rev 2150)
@@ -0,0 +1,1791 @@
+diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
+index 589f2da..a4399f5 100644
+--- a/Documentation/networking/ip-sysctl.txt
++++ b/Documentation/networking/ip-sysctl.txt
+@@ -137,7 +137,7 @@ tcp_adv_win_scale - INTEGER
+ 	(if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),
+ 	if it is <= 0.
+ 	Possible values are [-31, 31], inclusive.
+-	Default: 2
++	Default: 1
+ 
+ tcp_allowed_congestion_control - STRING
+ 	Show/set the congestion control choices available to non-privileged
+@@ -397,7 +397,7 @@ tcp_rmem - vector of 3 INTEGERs: min, default, max
+ 	net.core.rmem_max.  Calling setsockopt() with SO_RCVBUF disables
+ 	automatic tuning of that socket's receive buffer size, in which
+ 	case this value is ignored.
+-	Default: between 87380B and 4MB, depending on RAM size.
++	Default: between 87380B and 6MB, depending on RAM size.
+ 
+ tcp_sack - BOOLEAN
+ 	Enable select acknowledgments (SACKS).
+diff --git a/Makefile b/Makefile
+index 4c4efa3..add68f1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 17
++SUBLEVEL = 18
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h b/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h
+index 1e2d332..c88420d 100644
+--- a/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h
++++ b/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h
+@@ -941,10 +941,10 @@
+ #define OMAP4_DSI2_LANEENABLE_MASK				(0x7 << 29)
+ #define OMAP4_DSI1_LANEENABLE_SHIFT				24
+ #define OMAP4_DSI1_LANEENABLE_MASK				(0x1f << 24)
+-#define OMAP4_DSI2_PIPD_SHIFT					19
+-#define OMAP4_DSI2_PIPD_MASK					(0x1f << 19)
+-#define OMAP4_DSI1_PIPD_SHIFT					14
+-#define OMAP4_DSI1_PIPD_MASK					(0x1f << 14)
++#define OMAP4_DSI1_PIPD_SHIFT					19
++#define OMAP4_DSI1_PIPD_MASK					(0x1f << 19)
++#define OMAP4_DSI2_PIPD_SHIFT					14
++#define OMAP4_DSI2_PIPD_MASK					(0x1f << 14)
+ 
+ /* CONTROL_MCBSPLP */
+ #define OMAP4_ALBCTRLRX_FSX_SHIFT				31
+diff --git a/arch/arm/mach-orion5x/mpp.h b/arch/arm/mach-orion5x/mpp.h
+index eac6897..db70e79 100644
+--- a/arch/arm/mach-orion5x/mpp.h
++++ b/arch/arm/mach-orion5x/mpp.h
+@@ -65,8 +65,8 @@
+ #define MPP8_GIGE               MPP(8,  0x1, 0, 0, 1,   1,   1)
+ 
+ #define MPP9_UNUSED		MPP(9,  0x0, 0, 0, 1,   1,   1)
+-#define MPP9_GPIO		MPP(9,  0x0, 0, 0, 1,   1,   1)
+-#define MPP9_GIGE               MPP(9,  0x1, 1, 1, 1,   1,   1)
++#define MPP9_GPIO		MPP(9,  0x0, 1, 1, 1,   1,   1)
++#define MPP9_GIGE               MPP(9,  0x1, 0, 0, 1,   1,   1)
+ 
+ #define MPP10_UNUSED		MPP(10, 0x0, 0, 0, 1,   1,   1)
+ #define MPP10_GPIO		MPP(10, 0x0, 1, 1, 1,   1,   1)
+diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
+index aa33949..4b0bc37 100644
+--- a/arch/arm/mm/fault.c
++++ b/arch/arm/mm/fault.c
+@@ -267,7 +267,9 @@ good_area:
+ 	return fault;
+ 
+ check_stack:
+-	if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
++	/* Don't allow expansion below FIRST_USER_ADDRESS */
++	if (vma->vm_flags & VM_GROWSDOWN &&
++	    addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr))
+ 		goto good_area;
+ out:
+ 	return fault;
+diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
+index 8f3ccdd..8ea07e4 100644
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -11,6 +11,7 @@
+ #include <linux/types.h>
+ #include <linux/cpu.h>
+ #include <linux/cpu_pm.h>
++#include <linux/hardirq.h>
+ #include <linux/kernel.h>
+ #include <linux/notifier.h>
+ #include <linux/signal.h>
+@@ -428,7 +429,10 @@ void VFP_bounce(u32 trigger, u32 fpexc, struct pt_regs *regs)
+ 
+ static void vfp_enable(void *unused)
+ {
+-	u32 access = get_copro_access();
++	u32 access;
++
++	BUG_ON(preemptible());
++	access = get_copro_access();
+ 
+ 	/*
+ 	 * Enable full access to VFP (cp10 and cp11)
+@@ -556,7 +560,7 @@ static int __init vfp_init(void)
+ 	unsigned int cpu_arch = cpu_architecture();
+ 
+ 	if (cpu_arch >= CPU_ARCH_ARMv6)
+-		vfp_enable(NULL);
++		on_each_cpu(vfp_enable, NULL, 1);
+ 
+ 	/*
+ 	 * First check that there is a VFP that we can use.
+@@ -577,8 +581,6 @@ static int __init vfp_init(void)
+ 	} else {
+ 		hotcpu_notifier(vfp_hotplug, 0);
+ 
+-		smp_call_function(vfp_enable, NULL, 1);
+-
+ 		VFP_arch = (vfpsid & FPSID_ARCH_MASK) >> FPSID_ARCH_BIT;  /* Extract the architecture version */
+ 		printk("implementor %02x architecture %d part %02x variant %x rev %x\n",
+ 			(vfpsid & FPSID_IMPLEMENTER_MASK) >> FPSID_IMPLEMENTER_BIT,
+diff --git a/arch/ia64/include/asm/unistd.h b/arch/ia64/include/asm/unistd.h
+index 7617248..7a3bd25 100644
+--- a/arch/ia64/include/asm/unistd.h
++++ b/arch/ia64/include/asm/unistd.h
+@@ -323,11 +323,12 @@
+ #define __NR_sendmmsg			1331
+ #define __NR_process_vm_readv		1332
+ #define __NR_process_vm_writev		1333
++#define __NR_accept4			1334
+ 
+ #ifdef __KERNEL__
+ 
+ 
+-#define NR_syscalls			310 /* length of syscall table */
++#define NR_syscalls			311 /* length of syscall table */
+ 
+ /*
+  * The following defines stop scripts/checksyscalls.sh from complaining about
+diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
+index 5b31d46..1ccbe12 100644
+--- a/arch/ia64/kernel/entry.S
++++ b/arch/ia64/kernel/entry.S
+@@ -1779,6 +1779,7 @@ sys_call_table:
+ 	data8 sys_sendmmsg
+ 	data8 sys_process_vm_readv
+ 	data8 sys_process_vm_writev
++	data8 sys_accept4
+ 
+ 	.org sys_call_table + 8*NR_syscalls	// guard against failures to increase NR_syscalls
+ #endif /* __IA64_ASM_PARAVIRTUALIZED_NATIVE */
+diff --git a/arch/sparc/kernel/central.c b/arch/sparc/kernel/central.c
+index 38d48a5..9708851 100644
+--- a/arch/sparc/kernel/central.c
++++ b/arch/sparc/kernel/central.c
+@@ -269,4 +269,4 @@ static int __init sunfire_init(void)
+ 	return 0;
+ }
+ 
+-subsys_initcall(sunfire_init);
++fs_initcall(sunfire_init);
+diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
+index b57a594..874162a 100644
+--- a/arch/sparc/mm/ultra.S
++++ b/arch/sparc/mm/ultra.S
+@@ -495,11 +495,11 @@ xcall_fetch_glob_regs:
+ 	stx		%o7, [%g1 + GR_SNAP_O7]
+ 	stx		%i7, [%g1 + GR_SNAP_I7]
+ 	/* Don't try this at home kids... */
+-	rdpr		%cwp, %g2
+-	sub		%g2, 1, %g7
++	rdpr		%cwp, %g3
++	sub		%g3, 1, %g7
+ 	wrpr		%g7, %cwp
+ 	mov		%i7, %g7
+-	wrpr		%g2, %cwp
++	wrpr		%g3, %cwp
+ 	stx		%g7, [%g1 + GR_SNAP_RPC]
+ 	sethi		%hi(trap_block), %g7
+ 	or		%g7, %lo(trap_block), %g7
+diff --git a/arch/tile/kernel/compat_signal.c b/arch/tile/kernel/compat_signal.c
+index a7869ad..41459d8 100644
+--- a/arch/tile/kernel/compat_signal.c
++++ b/arch/tile/kernel/compat_signal.c
+@@ -406,19 +406,17 @@ int compat_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
+ 	 * Set up registers for signal handler.
+ 	 * Registers that we don't modify keep the value they had from
+ 	 * user-space at the time we took the signal.
++	 * We always pass siginfo and mcontext, regardless of SA_SIGINFO,
++	 * since some things rely on this (e.g. glibc's debug/segfault.c).
+ 	 */
+ 	regs->pc = ptr_to_compat_reg(ka->sa.sa_handler);
+ 	regs->ex1 = PL_ICS_EX1(USER_PL, 1); /* set crit sec in handler */
+ 	regs->sp = ptr_to_compat_reg(frame);
+ 	regs->lr = restorer;
+ 	regs->regs[0] = (unsigned long) usig;
+-
+-	if (ka->sa.sa_flags & SA_SIGINFO) {
+-		/* Need extra arguments, so mark to restore caller-saves. */
+-		regs->regs[1] = ptr_to_compat_reg(&frame->info);
+-		regs->regs[2] = ptr_to_compat_reg(&frame->uc);
+-		regs->flags |= PT_FLAGS_CALLER_SAVES;
+-	}
++	regs->regs[1] = ptr_to_compat_reg(&frame->info);
++	regs->regs[2] = ptr_to_compat_reg(&frame->uc);
++	regs->flags |= PT_FLAGS_CALLER_SAVES;
+ 
+ 	/*
+ 	 * Notify any tracer that was single-stepping it.
+diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
+index 6d16b4b..7e3002b 100644
+--- a/drivers/crypto/Kconfig
++++ b/drivers/crypto/Kconfig
+@@ -173,6 +173,7 @@ config CRYPTO_DEV_MV_CESA
+ 	select CRYPTO_ALGAPI
+ 	select CRYPTO_AES
+ 	select CRYPTO_BLKCIPHER2
++	select CRYPTO_HASH
+ 	help
+ 	  This driver allows you to utilize the Cryptographic Engines and
+ 	  Security Accelerator (CESA) which can be found on the Marvell Orion
+diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c
+index 461958f..271fd49 100644
+--- a/drivers/gpio/gpio-ml-ioh.c
++++ b/drivers/gpio/gpio-ml-ioh.c
+@@ -448,6 +448,7 @@ static int __devinit ioh_gpio_probe(struct pci_dev *pdev,
+ 		chip->reg = chip->base;
+ 		chip->ch = i;
+ 		mutex_init(&chip->lock);
++		spin_lock_init(&chip->spinlock);
+ 		ioh_gpio_setup(chip, num_ports[i]);
+ 		ret = gpiochip_add(&chip->gpio);
+ 		if (ret) {
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index 801d92d..a417f94 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -698,8 +698,8 @@ static int parse_hw_handler(struct dm_arg_set *as, struct multipath *m)
+ 		return 0;
+ 
+ 	m->hw_handler_name = kstrdup(dm_shift_arg(as), GFP_KERNEL);
+-	request_module("scsi_dh_%s", m->hw_handler_name);
+-	if (scsi_dh_handler_exist(m->hw_handler_name) == 0) {
++	if (!try_then_request_module(scsi_dh_handler_exist(m->hw_handler_name),
++				     "scsi_dh_%s", m->hw_handler_name)) {
+ 		ti->error = "unknown hardware handler type";
+ 		ret = -EINVAL;
+ 		goto fail;
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 065ab4f..adcd850 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -392,6 +392,8 @@ void mddev_suspend(struct mddev *mddev)
+ 	synchronize_rcu();
+ 	wait_event(mddev->sb_wait, atomic_read(&mddev->active_io) == 0);
+ 	mddev->pers->quiesce(mddev, 1);
++
++	del_timer_sync(&mddev->safemode_timer);
+ }
+ EXPORT_SYMBOL_GPL(mddev_suspend);
+ 
+diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
+index cf10ecf..ed77c6d 100644
+--- a/drivers/media/rc/ene_ir.c
++++ b/drivers/media/rc/ene_ir.c
+@@ -1018,22 +1018,6 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
+ 
+ 	spin_lock_init(&dev->hw_lock);
+ 
+-	/* claim the resources */
+-	error = -EBUSY;
+-	dev->hw_io = pnp_port_start(pnp_dev, 0);
+-	if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) {
+-		dev->hw_io = -1;
+-		dev->irq = -1;
+-		goto error;
+-	}
+-
+-	dev->irq = pnp_irq(pnp_dev, 0);
+-	if (request_irq(dev->irq, ene_isr,
+-			IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) {
+-		dev->irq = -1;
+-		goto error;
+-	}
+-
+ 	pnp_set_drvdata(pnp_dev, dev);
+ 	dev->pnp_dev = pnp_dev;
+ 
+@@ -1086,6 +1070,22 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
+ 	device_set_wakeup_capable(&pnp_dev->dev, true);
+ 	device_set_wakeup_enable(&pnp_dev->dev, true);
+ 
++	/* claim the resources */
++	error = -EBUSY;
++	dev->hw_io = pnp_port_start(pnp_dev, 0);
++	if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) {
++		dev->hw_io = -1;
++		dev->irq = -1;
++		goto error;
++	}
++
++	dev->irq = pnp_irq(pnp_dev, 0);
++	if (request_irq(dev->irq, ene_isr,
++			IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) {
++		dev->irq = -1;
++		goto error;
++	}
++
+ 	error = rc_register_device(rdev);
+ 	if (error < 0)
+ 		goto error;
+diff --git a/drivers/media/rc/fintek-cir.c b/drivers/media/rc/fintek-cir.c
+index 7f7079b..4218f73 100644
+--- a/drivers/media/rc/fintek-cir.c
++++ b/drivers/media/rc/fintek-cir.c
+@@ -504,16 +504,6 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id
+ 
+ 	spin_lock_init(&fintek->fintek_lock);
+ 
+-	ret = -EBUSY;
+-	/* now claim resources */
+-	if (!request_region(fintek->cir_addr,
+-			    fintek->cir_port_len, FINTEK_DRIVER_NAME))
+-		goto failure;
+-
+-	if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
+-			FINTEK_DRIVER_NAME, (void *)fintek))
+-		goto failure;
+-
+ 	pnp_set_drvdata(pdev, fintek);
+ 	fintek->pdev = pdev;
+ 
+@@ -548,6 +538,16 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id
+ 	/* rx resolution is hardwired to 50us atm, 1, 25, 100 also possible */
+ 	rdev->rx_resolution = US_TO_NS(CIR_SAMPLE_PERIOD);
+ 
++	ret = -EBUSY;
++	/* now claim resources */
++	if (!request_region(fintek->cir_addr,
++			    fintek->cir_port_len, FINTEK_DRIVER_NAME))
++		goto failure;
++
++	if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
++			FINTEK_DRIVER_NAME, (void *)fintek))
++		goto failure;
++
+ 	ret = rc_register_device(rdev);
+ 	if (ret)
+ 		goto failure;
+diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
+index 682009d..0e49c99 100644
+--- a/drivers/media/rc/ite-cir.c
++++ b/drivers/media/rc/ite-cir.c
+@@ -1515,16 +1515,6 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
+ 	/* initialize raw event */
+ 	init_ir_raw_event(&itdev->rawir);
+ 
+-	ret = -EBUSY;
+-	/* now claim resources */
+-	if (!request_region(itdev->cir_addr,
+-				dev_desc->io_region_size, ITE_DRIVER_NAME))
+-		goto failure;
+-
+-	if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
+-			ITE_DRIVER_NAME, (void *)itdev))
+-		goto failure;
+-
+ 	/* set driver data into the pnp device */
+ 	pnp_set_drvdata(pdev, itdev);
+ 	itdev->pdev = pdev;
+@@ -1600,6 +1590,16 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
+ 	rdev->driver_name = ITE_DRIVER_NAME;
+ 	rdev->map_name = RC_MAP_RC6_MCE;
+ 
++	ret = -EBUSY;
++	/* now claim resources */
++	if (!request_region(itdev->cir_addr,
++				dev_desc->io_region_size, ITE_DRIVER_NAME))
++		goto failure;
++
++	if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
++			ITE_DRIVER_NAME, (void *)itdev))
++		goto failure;
++
+ 	ret = rc_register_device(rdev);
+ 	if (ret)
+ 		goto failure;
+diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
+index 144f3f5..8b2c071 100644
+--- a/drivers/media/rc/nuvoton-cir.c
++++ b/drivers/media/rc/nuvoton-cir.c
+@@ -1021,24 +1021,6 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
+ 	spin_lock_init(&nvt->nvt_lock);
+ 	spin_lock_init(&nvt->tx.lock);
+ 
+-	ret = -EBUSY;
+-	/* now claim resources */
+-	if (!request_region(nvt->cir_addr,
+-			    CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
+-		goto failure;
+-
+-	if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
+-			NVT_DRIVER_NAME, (void *)nvt))
+-		goto failure;
+-
+-	if (!request_region(nvt->cir_wake_addr,
+-			    CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
+-		goto failure;
+-
+-	if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
+-			NVT_DRIVER_NAME, (void *)nvt))
+-		goto failure;
+-
+ 	pnp_set_drvdata(pdev, nvt);
+ 	nvt->pdev = pdev;
+ 
+@@ -1085,6 +1067,24 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
+ 	rdev->tx_resolution = XYZ;
+ #endif
+ 
++	ret = -EBUSY;
++	/* now claim resources */
++	if (!request_region(nvt->cir_addr,
++			    CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
++		goto failure;
++
++	if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
++			NVT_DRIVER_NAME, (void *)nvt))
++		goto failure;
++
++	if (!request_region(nvt->cir_wake_addr,
++			    CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
++		goto failure;
++
++	if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
++			NVT_DRIVER_NAME, (void *)nvt))
++		goto failure;
++
+ 	ret = rc_register_device(rdev);
+ 	if (ret)
+ 		goto failure;
+diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c
+index a7e7d6f..4591770 100644
+--- a/drivers/media/rc/winbond-cir.c
++++ b/drivers/media/rc/winbond-cir.c
+@@ -991,39 +991,10 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
+ 		"(w: 0x%lX, e: 0x%lX, s: 0x%lX, i: %u)\n",
+ 		data->wbase, data->ebase, data->sbase, data->irq);
+ 
+-	if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) {
+-		dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+-			data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1);
+-		err = -EBUSY;
+-		goto exit_free_data;
+-	}
+-
+-	if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) {
+-		dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+-			data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1);
+-		err = -EBUSY;
+-		goto exit_release_wbase;
+-	}
+-
+-	if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) {
+-		dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+-			data->sbase, data->sbase + SP_IOMEM_LEN - 1);
+-		err = -EBUSY;
+-		goto exit_release_ebase;
+-	}
+-
+-	err = request_irq(data->irq, wbcir_irq_handler,
+-			  IRQF_DISABLED, DRVNAME, device);
+-	if (err) {
+-		dev_err(dev, "Failed to claim IRQ %u\n", data->irq);
+-		err = -EBUSY;
+-		goto exit_release_sbase;
+-	}
+-
+ 	led_trigger_register_simple("cir-tx", &data->txtrigger);
+ 	if (!data->txtrigger) {
+ 		err = -ENOMEM;
+-		goto exit_free_irq;
++		goto exit_free_data;
+ 	}
+ 
+ 	led_trigger_register_simple("cir-rx", &data->rxtrigger);
+@@ -1062,9 +1033,38 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
+ 	data->dev->priv = data;
+ 	data->dev->dev.parent = &device->dev;
+ 
++	if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) {
++		dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
++			data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1);
++		err = -EBUSY;
++		goto exit_free_rc;
++	}
++
++	if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) {
++		dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
++			data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1);
++		err = -EBUSY;
++		goto exit_release_wbase;
++	}
++
++	if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) {
++		dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
++			data->sbase, data->sbase + SP_IOMEM_LEN - 1);
++		err = -EBUSY;
++		goto exit_release_ebase;
++	}
++
++	err = request_irq(data->irq, wbcir_irq_handler,
++			  IRQF_DISABLED, DRVNAME, device);
++	if (err) {
++		dev_err(dev, "Failed to claim IRQ %u\n", data->irq);
++		err = -EBUSY;
++		goto exit_release_sbase;
++	}
++
+ 	err = rc_register_device(data->dev);
+ 	if (err)
+-		goto exit_free_rc;
++		goto exit_free_irq;
+ 
+ 	device_init_wakeup(&device->dev, 1);
+ 
+@@ -1072,14 +1072,6 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
+ 
+ 	return 0;
+ 
+-exit_free_rc:
+-	rc_free_device(data->dev);
+-exit_unregister_led:
+-	led_classdev_unregister(&data->led);
+-exit_unregister_rxtrigger:
+-	led_trigger_unregister_simple(data->rxtrigger);
+-exit_unregister_txtrigger:
+-	led_trigger_unregister_simple(data->txtrigger);
+ exit_free_irq:
+ 	free_irq(data->irq, device);
+ exit_release_sbase:
+@@ -1088,6 +1080,14 @@ exit_release_ebase:
+ 	release_region(data->ebase, EHFUNC_IOMEM_LEN);
+ exit_release_wbase:
+ 	release_region(data->wbase, WAKEUP_IOMEM_LEN);
++exit_free_rc:
++	rc_free_device(data->dev);
++exit_unregister_led:
++	led_classdev_unregister(&data->led);
++exit_unregister_rxtrigger:
++	led_trigger_unregister_simple(data->rxtrigger);
++exit_unregister_txtrigger:
++	led_trigger_unregister_simple(data->txtrigger);
+ exit_free_data:
+ 	kfree(data);
+ 	pnp_set_drvdata(device, NULL);
+diff --git a/drivers/media/video/marvell-ccic/mmp-driver.c b/drivers/media/video/marvell-ccic/mmp-driver.c
+index fb0b124..a6b7657 100644
+--- a/drivers/media/video/marvell-ccic/mmp-driver.c
++++ b/drivers/media/video/marvell-ccic/mmp-driver.c
+@@ -175,7 +175,6 @@ static int mmpcam_probe(struct platform_device *pdev)
+ 	INIT_LIST_HEAD(&cam->devlist);
+ 
+ 	mcam = &cam->mcam;
+-	mcam->platform = MHP_Armada610;
+ 	mcam->plat_power_up = mmpcam_power_up;
+ 	mcam->plat_power_down = mmpcam_power_down;
+ 	mcam->dev = &pdev->dev;
+diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c
+index 2cc3b91..327a81f 100644
+--- a/drivers/media/video/s5p-fimc/fimc-capture.c
++++ b/drivers/media/video/s5p-fimc/fimc-capture.c
+@@ -1304,7 +1304,7 @@ static int fimc_subdev_set_crop(struct v4l2_subdev *sd,
+ 	fimc_capture_try_crop(ctx, r, crop->pad);
+ 
+ 	if (crop->which == V4L2_SUBDEV_FORMAT_TRY) {
+-		mutex_lock(&fimc->lock);
++		mutex_unlock(&fimc->lock);
+ 		*v4l2_subdev_get_try_crop(fh, crop->pad) = *r;
+ 		return 0;
+ 	}
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 3d55883..2dcac28 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -879,8 +879,13 @@ static inline unsigned int tg3_has_work(struct tg3_napi *tnapi)
+ 		if (sblk->status & SD_STATUS_LINK_CHG)
+ 			work_exists = 1;
+ 	}
+-	/* check for RX/TX work to do */
+-	if (sblk->idx[0].tx_consumer != tnapi->tx_cons ||
++
++	/* check for TX work to do */
++	if (sblk->idx[0].tx_consumer != tnapi->tx_cons)
++		work_exists = 1;
++
++	/* check for RX work to do */
++	if (tnapi->rx_rcb_prod_idx &&
+ 	    *(tnapi->rx_rcb_prod_idx) != tnapi->rx_rcb_ptr)
+ 		work_exists = 1;
+ 
+@@ -5895,6 +5900,9 @@ static int tg3_poll_work(struct tg3_napi *tnapi, int work_done, int budget)
+ 			return work_done;
+ 	}
+ 
++	if (!tnapi->rx_rcb_prod_idx)
++		return work_done;
++
+ 	/* run RX thread, within the bounds set by NAPI.
+ 	 * All RX "locking" is done by ensuring outside
+ 	 * code synchronizes with tg3->napi.poll()
+@@ -7448,6 +7456,12 @@ static int tg3_alloc_consistent(struct tg3 *tp)
+ 		 */
+ 		switch (i) {
+ 		default:
++			if (tg3_flag(tp, ENABLE_RSS)) {
++				tnapi->rx_rcb_prod_idx = NULL;
++				break;
++			}
++			/* Fall through */
++		case 1:
+ 			tnapi->rx_rcb_prod_idx = &sblk->idx[0].rx_producer;
+ 			break;
+ 		case 2:
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
+index cf480b5..de00805 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -494,7 +494,11 @@ out:
+ static void e1000_down_and_stop(struct e1000_adapter *adapter)
+ {
+ 	set_bit(__E1000_DOWN, &adapter->flags);
+-	cancel_work_sync(&adapter->reset_task);
++
++	/* Only kill reset task if adapter is not resetting */
++	if (!test_bit(__E1000_RESETTING, &adapter->flags))
++		cancel_work_sync(&adapter->reset_task);
++
+ 	cancel_delayed_work_sync(&adapter->watchdog_task);
+ 	cancel_delayed_work_sync(&adapter->phy_info_task);
+ 	cancel_delayed_work_sync(&adapter->fifo_stall_task);
+diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
+index 7eb8a00..65c51ff 100644
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -2475,8 +2475,13 @@ static struct sk_buff *receive_copy(struct sky2_port *sky2,
+ 		skb_copy_from_linear_data(re->skb, skb->data, length);
+ 		skb->ip_summed = re->skb->ip_summed;
+ 		skb->csum = re->skb->csum;
++		skb->rxhash = re->skb->rxhash;
++		skb->vlan_tci = re->skb->vlan_tci;
++
+ 		pci_dma_sync_single_for_device(sky2->hw->pdev, re->data_addr,
+ 					       length, PCI_DMA_FROMDEVICE);
++		re->skb->vlan_tci = 0;
++		re->skb->rxhash = 0;
+ 		re->skb->ip_summed = CHECKSUM_NONE;
+ 		skb_put(skb, length);
+ 	}
+@@ -2561,9 +2566,6 @@ static struct sk_buff *sky2_receive(struct net_device *dev,
+ 	struct sk_buff *skb = NULL;
+ 	u16 count = (status & GMR_FS_LEN) >> 16;
+ 
+-	if (status & GMR_FS_VLAN)
+-		count -= VLAN_HLEN;	/* Account for vlan tag */
+-
+ 	netif_printk(sky2, rx_status, KERN_DEBUG, dev,
+ 		     "rx slot %u status 0x%x len %d\n",
+ 		     sky2->rx_next, status, length);
+@@ -2571,6 +2573,9 @@ static struct sk_buff *sky2_receive(struct net_device *dev,
+ 	sky2->rx_next = (sky2->rx_next + 1) % sky2->rx_pending;
+ 	prefetch(sky2->rx_ring + sky2->rx_next);
+ 
++	if (vlan_tx_tag_present(re->skb))
++		count -= VLAN_HLEN;	/* Account for vlan tag */
++
+ 	/* This chip has hardware problems that generates bogus status.
+ 	 * So do only marginal checking and expect higher level protocols
+ 	 * to handle crap frames.
+@@ -2628,11 +2633,8 @@ static inline void sky2_tx_done(struct net_device *dev, u16 last)
+ }
+ 
+ static inline void sky2_skb_rx(const struct sky2_port *sky2,
+-			       u32 status, struct sk_buff *skb)
++			       struct sk_buff *skb)
+ {
+-	if (status & GMR_FS_VLAN)
+-		__vlan_hwaccel_put_tag(skb, be16_to_cpu(sky2->rx_tag));
+-
+ 	if (skb->ip_summed == CHECKSUM_NONE)
+ 		netif_receive_skb(skb);
+ 	else
+@@ -2686,6 +2688,14 @@ static void sky2_rx_checksum(struct sky2_port *sky2, u32 status)
+ 	}
+ }
+ 
++static void sky2_rx_tag(struct sky2_port *sky2, u16 length)
++{
++	struct sk_buff *skb;
++
++	skb = sky2->rx_ring[sky2->rx_next].skb;
++	__vlan_hwaccel_put_tag(skb, be16_to_cpu(length));
++}
++
+ static void sky2_rx_hash(struct sky2_port *sky2, u32 status)
+ {
+ 	struct sk_buff *skb;
+@@ -2744,8 +2754,7 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
+ 			}
+ 
+ 			skb->protocol = eth_type_trans(skb, dev);
+-
+-			sky2_skb_rx(sky2, status, skb);
++			sky2_skb_rx(sky2, skb);
+ 
+ 			/* Stop after net poll weight */
+ 			if (++work_done >= to_do)
+@@ -2753,11 +2762,11 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
+ 			break;
+ 
+ 		case OP_RXVLAN:
+-			sky2->rx_tag = length;
++			sky2_rx_tag(sky2, length);
+ 			break;
+ 
+ 		case OP_RXCHKSVLAN:
+-			sky2->rx_tag = length;
++			sky2_rx_tag(sky2, length);
+ 			/* fall through */
+ 		case OP_RXCHKS:
+ 			if (likely(dev->features & NETIF_F_RXCSUM))
+diff --git a/drivers/net/ethernet/marvell/sky2.h b/drivers/net/ethernet/marvell/sky2.h
+index ff6f58b..3c896ce 100644
+--- a/drivers/net/ethernet/marvell/sky2.h
++++ b/drivers/net/ethernet/marvell/sky2.h
+@@ -2241,7 +2241,6 @@ struct sky2_port {
+ 	u16		     rx_pending;
+ 	u16		     rx_data_size;
+ 	u16		     rx_nfrags;
+-	u16		     rx_tag;
+ 
+ 	struct {
+ 		unsigned long last;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
+index 41e6b33..c07cfe9 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
+@@ -22,6 +22,7 @@
+   Author: Giuseppe Cavallaro <peppe.cavallaro@××.com>
+ *******************************************************************************/
+ 
++#include <linux/kernel.h>
+ #include <linux/io.h>
+ #include "mmc.h"
+ 
+diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c
+index ceab215..c508d6a 100644
+--- a/drivers/net/ethernet/sun/sungem.c
++++ b/drivers/net/ethernet/sun/sungem.c
+@@ -2340,7 +2340,7 @@ static int gem_suspend(struct pci_dev *pdev, pm_message_t state)
+ 	netif_device_detach(dev);
+ 
+ 	/* Switch off chip, remember WOL setting */
+-	gp->asleep_wol = gp->wake_on_lan;
++	gp->asleep_wol = !!gp->wake_on_lan;
+ 	gem_do_stop(dev, gp->asleep_wol);
+ 
+ 	/* Unlock the network stack */
+diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
+index c81f136..b142300 100644
+--- a/drivers/net/phy/icplus.c
++++ b/drivers/net/phy/icplus.c
+@@ -150,7 +150,8 @@ static int ip101a_config_init(struct phy_device *phydev)
+ 	/* Enable Auto Power Saving mode */
+ 	c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
+ 	c |= IP101A_APS_ON;
+-	return c;
++
++	return phy_write(phydev, IP10XX_SPEC_CTRL_STATUS, c);
+ }
+ 
+ static int ip175c_read_status(struct phy_device *phydev)
+diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
+index fda4be2..a9abee8 100644
+--- a/drivers/net/usb/asix.c
++++ b/drivers/net/usb/asix.c
+@@ -403,7 +403,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+ 	u32 packet_len;
+ 	u32 padbytes = 0xffff0000;
+ 
+-	padlen = ((skb->len + 4) % 512) ? 0 : 4;
++	padlen = ((skb->len + 4) & (dev->maxpacket - 1)) ? 0 : 4;
+ 
+ 	if ((!skb_cloned(skb)) &&
+ 	    ((headroom + tailroom) >= (4 + padlen))) {
+@@ -425,7 +425,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+ 	cpu_to_le32s(&packet_len);
+ 	skb_copy_to_linear_data(skb, &packet_len, sizeof(packet_len));
+ 
+-	if ((skb->len % 512) == 0) {
++	if (padlen) {
+ 		cpu_to_le32s(&padbytes);
+ 		memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
+ 		skb_put(skb, sizeof(padbytes));
+diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
+index 4fd4144..2ba40cf 100644
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -83,6 +83,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+ 	struct cdc_state		*info = (void *) &dev->data;
+ 	int				status;
+ 	int				rndis;
++	bool				android_rndis_quirk = false;
+ 	struct usb_driver		*driver = driver_of(intf);
+ 	struct usb_cdc_mdlm_desc	*desc = NULL;
+ 	struct usb_cdc_mdlm_detail_desc *detail = NULL;
+@@ -195,6 +196,11 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+ 					info->control,
+ 					info->u->bSlaveInterface0,
+ 					info->data);
++				/* fall back to hard-wiring for RNDIS */
++				if (rndis) {
++					android_rndis_quirk = true;
++					goto next_desc;
++				}
+ 				goto bad_desc;
+ 			}
+ 			if (info->control != intf) {
+@@ -271,11 +277,15 @@ next_desc:
+ 	/* Microsoft ActiveSync based and some regular RNDIS devices lack the
+ 	 * CDC descriptors, so we'll hard-wire the interfaces and not check
+ 	 * for descriptors.
++	 *
++	 * Some Android RNDIS devices have a CDC Union descriptor pointing
++	 * to non-existing interfaces.  Ignore that and attempt the same
++	 * hard-wired 0 and 1 interfaces.
+ 	 */
+-	if (rndis && !info->u) {
++	if (rndis && (!info->u || android_rndis_quirk)) {
+ 		info->control = usb_ifnum_to_if(dev->udev, 0);
+ 		info->data = usb_ifnum_to_if(dev->udev, 1);
+-		if (!info->control || !info->data) {
++		if (!info->control || !info->data || info->control != intf) {
+ 			dev_dbg(&intf->dev,
+ 				"rndis: master #0/%p slave #1/%p\n",
+ 				info->control,
+@@ -472,6 +482,7 @@ static const struct driver_info wwan_info = {
+ /*-------------------------------------------------------------------------*/
+ 
+ #define HUAWEI_VENDOR_ID	0x12D1
++#define NOVATEL_VENDOR_ID	0x1410
+ 
+ static const struct usb_device_id	products [] = {
+ /*
+@@ -589,6 +600,21 @@ static const struct usb_device_id	products [] = {
+  * because of bugs/quirks in a given product (like Zaurus, above).
+  */
+ {
++	/* Novatel USB551L */
++	/* This match must come *before* the generic CDC-ETHER match so that
++	 * we get FLAG_WWAN set on the device, since it's descriptors are
++	 * generic CDC-ETHER.
++	 */
++	.match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
++		 | USB_DEVICE_ID_MATCH_PRODUCT
++		 | USB_DEVICE_ID_MATCH_INT_INFO,
++	.idVendor               = NOVATEL_VENDOR_ID,
++	.idProduct		= 0xB001,
++	.bInterfaceClass	= USB_CLASS_COMM,
++	.bInterfaceSubClass	= USB_CDC_SUBCLASS_ETHERNET,
++	.bInterfaceProtocol	= USB_CDC_PROTO_NONE,
++	.driver_info = (unsigned long)&wwan_info,
++}, {
+ 	USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
+ 			USB_CDC_PROTO_NONE),
+ 	.driver_info = (unsigned long) &cdc_info,
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 750e330..b873b5d 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -281,17 +281,32 @@ int usbnet_change_mtu (struct net_device *net, int new_mtu)
+ }
+ EXPORT_SYMBOL_GPL(usbnet_change_mtu);
+ 
++/* The caller must hold list->lock */
++static void __usbnet_queue_skb(struct sk_buff_head *list,
++			struct sk_buff *newsk, enum skb_state state)
++{
++	struct skb_data *entry = (struct skb_data *) newsk->cb;
++
++	__skb_queue_tail(list, newsk);
++	entry->state = state;
++}
++
+ /*-------------------------------------------------------------------------*/
+ 
+ /* some LK 2.4 HCDs oopsed if we freed or resubmitted urbs from
+  * completion callbacks.  2.5 should have fixed those bugs...
+  */
+ 
+-static void defer_bh(struct usbnet *dev, struct sk_buff *skb, struct sk_buff_head *list)
++static enum skb_state defer_bh(struct usbnet *dev, struct sk_buff *skb,
++		struct sk_buff_head *list, enum skb_state state)
+ {
+ 	unsigned long		flags;
++	enum skb_state 		old_state;
++	struct skb_data *entry = (struct skb_data *) skb->cb;
+ 
+ 	spin_lock_irqsave(&list->lock, flags);
++	old_state = entry->state;
++	entry->state = state;
+ 	__skb_unlink(skb, list);
+ 	spin_unlock(&list->lock);
+ 	spin_lock(&dev->done.lock);
+@@ -299,6 +314,7 @@ static void defer_bh(struct usbnet *dev, struct sk_buff *skb, struct sk_buff_hea
+ 	if (dev->done.qlen == 1)
+ 		tasklet_schedule(&dev->bh);
+ 	spin_unlock_irqrestore(&dev->done.lock, flags);
++	return old_state;
+ }
+ 
+ /* some work can't be done in tasklets, so we use keventd
+@@ -339,7 +355,6 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
+ 	entry = (struct skb_data *) skb->cb;
+ 	entry->urb = urb;
+ 	entry->dev = dev;
+-	entry->state = rx_start;
+ 	entry->length = 0;
+ 
+ 	usb_fill_bulk_urb (urb, dev->udev, dev->in,
+@@ -371,7 +386,7 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
+ 			tasklet_schedule (&dev->bh);
+ 			break;
+ 		case 0:
+-			__skb_queue_tail (&dev->rxq, skb);
++			__usbnet_queue_skb(&dev->rxq, skb, rx_start);
+ 		}
+ 	} else {
+ 		netif_dbg(dev, ifdown, dev->net, "rx: stopped\n");
+@@ -422,16 +437,17 @@ static void rx_complete (struct urb *urb)
+ 	struct skb_data		*entry = (struct skb_data *) skb->cb;
+ 	struct usbnet		*dev = entry->dev;
+ 	int			urb_status = urb->status;
++	enum skb_state		state;
+ 
+ 	skb_put (skb, urb->actual_length);
+-	entry->state = rx_done;
++	state = rx_done;
+ 	entry->urb = NULL;
+ 
+ 	switch (urb_status) {
+ 	/* success */
+ 	case 0:
+ 		if (skb->len < dev->net->hard_header_len) {
+-			entry->state = rx_cleanup;
++			state = rx_cleanup;
+ 			dev->net->stats.rx_errors++;
+ 			dev->net->stats.rx_length_errors++;
+ 			netif_dbg(dev, rx_err, dev->net,
+@@ -470,7 +486,7 @@ static void rx_complete (struct urb *urb)
+ 				  "rx throttle %d\n", urb_status);
+ 		}
+ block:
+-		entry->state = rx_cleanup;
++		state = rx_cleanup;
+ 		entry->urb = urb;
+ 		urb = NULL;
+ 		break;
+@@ -481,17 +497,18 @@ block:
+ 		// FALLTHROUGH
+ 
+ 	default:
+-		entry->state = rx_cleanup;
++		state = rx_cleanup;
+ 		dev->net->stats.rx_errors++;
+ 		netif_dbg(dev, rx_err, dev->net, "rx status %d\n", urb_status);
+ 		break;
+ 	}
+ 
+-	defer_bh(dev, skb, &dev->rxq);
++	state = defer_bh(dev, skb, &dev->rxq, state);
+ 
+ 	if (urb) {
+ 		if (netif_running (dev->net) &&
+-		    !test_bit (EVENT_RX_HALT, &dev->flags)) {
++		    !test_bit (EVENT_RX_HALT, &dev->flags) &&
++		    state != unlink_start) {
+ 			rx_submit (dev, urb, GFP_ATOMIC);
+ 			return;
+ 		}
+@@ -577,16 +594,23 @@ EXPORT_SYMBOL_GPL(usbnet_purge_paused_rxq);
+ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
+ {
+ 	unsigned long		flags;
+-	struct sk_buff		*skb, *skbnext;
++	struct sk_buff		*skb;
+ 	int			count = 0;
+ 
+ 	spin_lock_irqsave (&q->lock, flags);
+-	skb_queue_walk_safe(q, skb, skbnext) {
++	while (!skb_queue_empty(q)) {
+ 		struct skb_data		*entry;
+ 		struct urb		*urb;
+ 		int			retval;
+ 
+-		entry = (struct skb_data *) skb->cb;
++		skb_queue_walk(q, skb) {
++			entry = (struct skb_data *) skb->cb;
++			if (entry->state != unlink_start)
++				goto found;
++		}
++		break;
++found:
++		entry->state = unlink_start;
+ 		urb = entry->urb;
+ 
+ 		/*
+@@ -1037,8 +1061,7 @@ static void tx_complete (struct urb *urb)
+ 	}
+ 
+ 	usb_autopm_put_interface_async(dev->intf);
+-	entry->state = tx_done;
+-	defer_bh(dev, skb, &dev->txq);
++	(void) defer_bh(dev, skb, &dev->txq, tx_done);
+ }
+ 
+ /*-------------------------------------------------------------------------*/
+@@ -1094,7 +1117,6 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
+ 	entry = (struct skb_data *) skb->cb;
+ 	entry->urb = urb;
+ 	entry->dev = dev;
+-	entry->state = tx_start;
+ 	entry->length = length;
+ 
+ 	usb_fill_bulk_urb (urb, dev->udev, dev->out,
+@@ -1153,7 +1175,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
+ 		break;
+ 	case 0:
+ 		net->trans_start = jiffies;
+-		__skb_queue_tail (&dev->txq, skb);
++		__usbnet_queue_skb(&dev->txq, skb, tx_start);
+ 		if (dev->txq.qlen >= TX_QLEN (dev))
+ 			netif_stop_queue (net);
+ 	}
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+index 7f27dbd..0515862 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+@@ -1053,17 +1053,13 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
+ 		}
+ 		/* either retransmit or send bar if ack not recd */
+ 		if (!ack_recd) {
+-			struct ieee80211_tx_rate *txrate =
+-			    tx_info->status.rates;
+-			if (retry && (txrate[0].count < (int)retry_limit)) {
++			if (retry && (ini->txretry[index] < (int)retry_limit)) {
+ 				ini->txretry[index]++;
+ 				ini->tx_in_transit--;
+ 				/*
+ 				 * Use high prededence for retransmit to
+ 				 * give some punch
+ 				 */
+-				/* brcms_c_txq_enq(wlc, scb, p,
+-				 * BRCMS_PRIO_TO_PREC(tid)); */
+ 				brcms_c_txq_enq(wlc, scb, p,
+ 						BRCMS_PRIO_TO_HI_PREC(tid));
+ 			} else {
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+index f98becc..833cbef 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+@@ -7879,7 +7879,7 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
+ 	if (wlc->hw->suspended_fifos) {
+ 		hdr = (struct ieee80211_hdr *)p->data;
+ 		if (ieee80211_is_beacon(hdr->frame_control))
+-			brcms_b_mute(wlc->hw, false);
++			brcms_b_mute(wlc->hw, false, 0);
+ 	}
+ 
+ 	memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
+diff --git a/drivers/regulator/max8997.c b/drivers/regulator/max8997.c
+index 6176129..8cba82d 100644
+--- a/drivers/regulator/max8997.c
++++ b/drivers/regulator/max8997.c
+@@ -689,7 +689,7 @@ static int max8997_set_voltage_buck(struct regulator_dev *rdev,
+ 		}
+ 
+ 		new_val++;
+-	} while (desc->min + desc->step + new_val <= desc->max);
++	} while (desc->min + desc->step * new_val <= desc->max);
+ 
+ 	new_idx = tmp_idx;
+ 	new_val = tmp_val;
+diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
+index 54b9d2e..1590dbd 100644
+--- a/drivers/spi/spi-topcliff-pch.c
++++ b/drivers/spi/spi-topcliff-pch.c
+@@ -196,6 +196,7 @@ struct pch_spi_data {
+ 	struct pch_spi_dma_ctrl dma;
+ 	int use_dma;
+ 	u8 irq_reg_sts;
++	int save_total_len;
+ };
+ 
+ /**
+@@ -823,11 +824,13 @@ static void pch_spi_copy_rx_data_for_dma(struct pch_spi_data *data, int bpw)
+ 		rx_dma_buf = data->dma.rx_buf_virt;
+ 		for (j = 0; j < data->bpw_len; j++)
+ 			*rx_buf++ = *rx_dma_buf++ & 0xFF;
++		data->cur_trans->rx_buf = rx_buf;
+ 	} else {
+ 		rx_sbuf = data->cur_trans->rx_buf;
+ 		rx_dma_sbuf = data->dma.rx_buf_virt;
+ 		for (j = 0; j < data->bpw_len; j++)
+ 			*rx_sbuf++ = *rx_dma_sbuf++;
++		data->cur_trans->rx_buf = rx_sbuf;
+ 	}
+ }
+ 
+@@ -853,6 +856,9 @@ static int pch_spi_start_transfer(struct pch_spi_data *data)
+ 	rtn = wait_event_interruptible_timeout(data->wait,
+ 					       data->transfer_complete,
+ 					       msecs_to_jiffies(2 * HZ));
++	if (!rtn)
++		dev_err(&data->master->dev,
++			"%s wait-event timeout\n", __func__);
+ 
+ 	dma_sync_sg_for_cpu(&data->master->dev, dma->sg_rx_p, dma->nent,
+ 			    DMA_FROM_DEVICE);
+@@ -924,7 +930,8 @@ static void pch_spi_request_dma(struct pch_spi_data *data, int bpw)
+ 	dma_cap_set(DMA_SLAVE, mask);
+ 
+ 	/* Get DMA's dev information */
+-	dma_dev = pci_get_bus_and_slot(2, PCI_DEVFN(12, 0));
++	dma_dev = pci_get_bus_and_slot(data->board_dat->pdev->bus->number,
++				       PCI_DEVFN(12, 0));
+ 
+ 	/* Set Tx DMA */
+ 	param = &dma->param_tx;
+@@ -988,6 +995,7 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+ 	int i;
+ 	int size;
+ 	int rem;
++	int head;
+ 	unsigned long flags;
+ 	struct pch_spi_dma_ctrl *dma;
+ 
+@@ -1016,6 +1024,11 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+ 	}
+ 	data->bpw_len = data->cur_trans->len / (*bpw / 8);
+ 
++	if (data->bpw_len > PCH_BUF_SIZE) {
++		data->bpw_len = PCH_BUF_SIZE;
++		data->cur_trans->len -= PCH_BUF_SIZE;
++	}
++
+ 	/* copy Tx Data */
+ 	if (data->cur_trans->tx_buf != NULL) {
+ 		if (*bpw == 8) {
+@@ -1030,10 +1043,17 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+ 				*tx_dma_sbuf++ = *tx_sbuf++;
+ 		}
+ 	}
++
++	/* Calculate Rx parameter for DMA transmitting */
+ 	if (data->bpw_len > PCH_DMA_TRANS_SIZE) {
+-		num = data->bpw_len / PCH_DMA_TRANS_SIZE + 1;
++		if (data->bpw_len % PCH_DMA_TRANS_SIZE) {
++			num = data->bpw_len / PCH_DMA_TRANS_SIZE + 1;
++			rem = data->bpw_len % PCH_DMA_TRANS_SIZE;
++		} else {
++			num = data->bpw_len / PCH_DMA_TRANS_SIZE;
++			rem = PCH_DMA_TRANS_SIZE;
++		}
+ 		size = PCH_DMA_TRANS_SIZE;
+-		rem = data->bpw_len % PCH_DMA_TRANS_SIZE;
+ 	} else {
+ 		num = 1;
+ 		size = data->bpw_len;
+@@ -1093,15 +1113,23 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+ 	dma->nent = num;
+ 	dma->desc_rx = desc_rx;
+ 
+-	/* TX */
+-	if (data->bpw_len > PCH_DMA_TRANS_SIZE) {
+-		num = data->bpw_len / PCH_DMA_TRANS_SIZE;
++	/* Calculate Tx parameter for DMA transmitting */
++	if (data->bpw_len > PCH_MAX_FIFO_DEPTH) {
++		head = PCH_MAX_FIFO_DEPTH - PCH_DMA_TRANS_SIZE;
++		if (data->bpw_len % PCH_DMA_TRANS_SIZE > 4) {
++			num = data->bpw_len / PCH_DMA_TRANS_SIZE + 1;
++			rem = data->bpw_len % PCH_DMA_TRANS_SIZE - head;
++		} else {
++			num = data->bpw_len / PCH_DMA_TRANS_SIZE;
++			rem = data->bpw_len % PCH_DMA_TRANS_SIZE +
++			      PCH_DMA_TRANS_SIZE - head;
++		}
+ 		size = PCH_DMA_TRANS_SIZE;
+-		rem = 16;
+ 	} else {
+ 		num = 1;
+ 		size = data->bpw_len;
+ 		rem = data->bpw_len;
++		head = 0;
+ 	}
+ 
+ 	dma->sg_tx_p = kzalloc(sizeof(struct scatterlist)*num, GFP_ATOMIC);
+@@ -1111,11 +1139,17 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+ 	for (i = 0; i < num; i++, sg++) {
+ 		if (i == 0) {
+ 			sg->offset = 0;
++			sg_set_page(sg, virt_to_page(dma->tx_buf_virt), size + head,
++				    sg->offset);
++			sg_dma_len(sg) = size + head;
++		} else if (i == (num - 1)) {
++			sg->offset = head + size * i;
++			sg->offset = sg->offset * (*bpw / 8);
+ 			sg_set_page(sg, virt_to_page(dma->tx_buf_virt), rem,
+ 				    sg->offset);
+ 			sg_dma_len(sg) = rem;
+ 		} else {
+-			sg->offset = rem + size * (i - 1);
++			sg->offset = head + size * i;
+ 			sg->offset = sg->offset * (*bpw / 8);
+ 			sg_set_page(sg, virt_to_page(dma->tx_buf_virt), size,
+ 				    sg->offset);
+@@ -1203,6 +1237,7 @@ static void pch_spi_process_messages(struct work_struct *pwork)
+ 				    data->current_msg->spi->bits_per_word);
+ 	pch_spi_writereg(data->master, PCH_SSNXCR, SSN_NO_CONTROL);
+ 	do {
++		int cnt;
+ 		/* If we are already processing a message get the next
+ 		transfer structure from the message otherwise retrieve
+ 		the 1st transfer request from the message. */
+@@ -1222,11 +1257,28 @@ static void pch_spi_process_messages(struct work_struct *pwork)
+ 		}
+ 		spin_unlock(&data->lock);
+ 
++		if (!data->cur_trans->len)
++			goto out;
++		cnt = (data->cur_trans->len - 1) / PCH_BUF_SIZE + 1;
++		data->save_total_len = data->cur_trans->len;
+ 		if (data->use_dma) {
+-			pch_spi_handle_dma(data, &bpw);
+-			if (!pch_spi_start_transfer(data))
+-				goto out;
+-			pch_spi_copy_rx_data_for_dma(data, bpw);
++			int i;
++			char *save_rx_buf = data->cur_trans->rx_buf;
++			for (i = 0; i < cnt; i ++) {
++				pch_spi_handle_dma(data, &bpw);
++				if (!pch_spi_start_transfer(data)) {
++					data->transfer_complete = true;
++					data->current_msg->status = -EIO;
++					data->current_msg->complete
++						   (data->current_msg->context);
++					data->bcurrent_msg_processing = false;
++					data->current_msg = NULL;
++					data->cur_trans = NULL;
++					goto out;
++				}
++				pch_spi_copy_rx_data_for_dma(data, bpw);
++			}
++			data->cur_trans->rx_buf = save_rx_buf;
+ 		} else {
+ 			pch_spi_set_tx(data, &bpw);
+ 			pch_spi_set_ir(data);
+@@ -1237,6 +1289,7 @@ static void pch_spi_process_messages(struct work_struct *pwork)
+ 			data->pkt_tx_buff = NULL;
+ 		}
+ 		/* increment message count */
++		data->cur_trans->len = data->save_total_len;
+ 		data->current_msg->actual_length += data->cur_trans->len;
+ 
+ 		dev_dbg(&data->master->dev,
+@@ -1389,6 +1442,7 @@ static int __devinit pch_spi_pd_probe(struct platform_device *plat_dev)
+ 	master->num_chipselect = PCH_MAX_CS;
+ 	master->setup = pch_spi_setup;
+ 	master->transfer = pch_spi_transfer;
++	master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_LSB_FIRST;
+ 
+ 	data->board_dat = board_dat;
+ 	data->plat_dev = plat_dev;
+diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
+index b4864fb..cad8b92 100644
+--- a/drivers/target/target_core_file.c
++++ b/drivers/target/target_core_file.c
+@@ -170,6 +170,7 @@ static struct se_device *fd_create_virtdevice(
+ 	inode = file->f_mapping->host;
+ 	if (S_ISBLK(inode->i_mode)) {
+ 		struct request_queue *q;
++		unsigned long long dev_size;
+ 		/*
+ 		 * Setup the local scope queue_limits from struct request_queue->limits
+ 		 * to pass into transport_add_device_to_core_hba() as struct se_dev_limits.
+@@ -184,13 +185,12 @@ static struct se_device *fd_create_virtdevice(
+ 		 * one (1) logical sector from underlying struct block_device
+ 		 */
+ 		fd_dev->fd_block_size = bdev_logical_block_size(inode->i_bdev);
+-		fd_dev->fd_dev_size = (i_size_read(file->f_mapping->host) -
++		dev_size = (i_size_read(file->f_mapping->host) -
+ 				       fd_dev->fd_block_size);
+ 
+ 		pr_debug("FILEIO: Using size: %llu bytes from struct"
+ 			" block_device blocks: %llu logical_block_size: %d\n",
+-			fd_dev->fd_dev_size,
+-			div_u64(fd_dev->fd_dev_size, fd_dev->fd_block_size),
++			dev_size, div_u64(dev_size, fd_dev->fd_block_size),
+ 			fd_dev->fd_block_size);
+ 	} else {
+ 		if (!(fd_dev->fbd_flags & FBDF_HAS_SIZE)) {
+@@ -606,10 +606,20 @@ static u32 fd_get_device_type(struct se_device *dev)
+ static sector_t fd_get_blocks(struct se_device *dev)
+ {
+ 	struct fd_dev *fd_dev = dev->dev_ptr;
+-	unsigned long long blocks_long = div_u64(fd_dev->fd_dev_size,
+-			dev->se_sub_dev->se_dev_attrib.block_size);
++	struct file *f = fd_dev->fd_file;
++	struct inode *i = f->f_mapping->host;
++	unsigned long long dev_size;
++	/*
++	 * When using a file that references an underlying struct block_device,
++	 * ensure dev_size is always based on the current inode size in order
++	 * to handle underlying block_device resize operations.
++	 */
++	if (S_ISBLK(i->i_mode))
++		dev_size = (i_size_read(i) - fd_dev->fd_block_size);
++	else
++		dev_size = fd_dev->fd_dev_size;
+ 
+-	return blocks_long;
++	return div_u64(dev_size, dev->se_sub_dev->se_dev_attrib.block_size);
+ }
+ 
+ static struct se_subsystem_api fileio_template = {
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index 6cf6ff4..b75bc92 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -223,6 +223,9 @@ int target_scsi2_reservation_release(struct se_task *task)
+ 	if (dev->dev_reserved_node_acl != sess->se_node_acl)
+ 		goto out_unlock;
+ 
++	if (dev->dev_res_bin_isid != sess->sess_bin_isid)
++		goto out_unlock;
++
+ 	dev->dev_reserved_node_acl = NULL;
+ 	dev->dev_flags &= ~DF_SPC2_RESERVATIONS;
+ 	if (dev->dev_flags & DF_SPC2_RESERVATIONS_WITH_ISID) {
+diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
+index 8ddd133..d91fe44 100644
+--- a/drivers/target/target_core_tpg.c
++++ b/drivers/target/target_core_tpg.c
+@@ -63,7 +63,6 @@ static void core_clear_initiator_node_from_tpg(
+ 	int i;
+ 	struct se_dev_entry *deve;
+ 	struct se_lun *lun;
+-	struct se_lun_acl *acl, *acl_tmp;
+ 
+ 	spin_lock_irq(&nacl->device_list_lock);
+ 	for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) {
+@@ -84,28 +83,7 @@ static void core_clear_initiator_node_from_tpg(
+ 		core_update_device_list_for_node(lun, NULL, deve->mapped_lun,
+ 			TRANSPORT_LUNFLAGS_NO_ACCESS, nacl, tpg, 0);
+ 
+-		spin_lock(&lun->lun_acl_lock);
+-		list_for_each_entry_safe(acl, acl_tmp,
+-					&lun->lun_acl_list, lacl_list) {
+-			if (!strcmp(acl->initiatorname, nacl->initiatorname) &&
+-			    (acl->mapped_lun == deve->mapped_lun))
+-				break;
+-		}
+-
+-		if (!acl) {
+-			pr_err("Unable to locate struct se_lun_acl for %s,"
+-				" mapped_lun: %u\n", nacl->initiatorname,
+-				deve->mapped_lun);
+-			spin_unlock(&lun->lun_acl_lock);
+-			spin_lock_irq(&nacl->device_list_lock);
+-			continue;
+-		}
+-
+-		list_del(&acl->lacl_list);
+-		spin_unlock(&lun->lun_acl_lock);
+-
+ 		spin_lock_irq(&nacl->device_list_lock);
+-		kfree(acl);
+ 	}
+ 	spin_unlock_irq(&nacl->device_list_lock);
+ }
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 93a00d8..4410ae7 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -487,18 +487,19 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
+ 		ext4_free_blocks(handle, inode, bh, 0, 1,
+ 				 EXT4_FREE_BLOCKS_METADATA |
+ 				 EXT4_FREE_BLOCKS_FORGET);
++		unlock_buffer(bh);
+ 	} else {
+ 		le32_add_cpu(&BHDR(bh)->h_refcount, -1);
++		if (ce)
++			mb_cache_entry_release(ce);
++		unlock_buffer(bh);
+ 		error = ext4_handle_dirty_metadata(handle, inode, bh);
+ 		if (IS_SYNC(inode))
+ 			ext4_handle_sync(handle);
+ 		dquot_free_block(inode, 1);
+ 		ea_bdebug(bh, "refcount now=%d; releasing",
+ 			  le32_to_cpu(BHDR(bh)->h_refcount));
+-		if (ce)
+-			mb_cache_entry_release(ce);
+ 	}
+-	unlock_buffer(bh);
+ out:
+ 	ext4_std_error(inode->i_sb, error);
+ 	return;
+diff --git a/fs/jffs2/gc.c b/fs/jffs2/gc.c
+index 31dce61..4bbd521 100644
+--- a/fs/jffs2/gc.c
++++ b/fs/jffs2/gc.c
+@@ -225,8 +225,8 @@ int jffs2_garbage_collect_pass(struct jffs2_sb_info *c)
+ 			return 0;
+ 
+ 		D1(printk(KERN_DEBUG "No progress from erasing blocks; doing GC anyway\n"));
+-		spin_lock(&c->erase_completion_lock);
+ 		mutex_lock(&c->alloc_sem);
++		spin_lock(&c->erase_completion_lock);
+ 	}
+ 
+ 	/* First, work out which block we're garbage-collecting */
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 51f6a40..bab7c58 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1802,6 +1802,7 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, fmode_t fmode
+ 			nfs_setattr_update_inode(state->inode, sattr);
+ 		nfs_post_op_update_inode(state->inode, opendata->o_res.f_attr);
+ 	}
++	nfs_revalidate_inode(server, state->inode);
+ 	nfs4_opendata_put(opendata);
+ 	nfs4_put_state_owner(sp);
+ 	*res = state;
+diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h
+index a9e6ba4..daad4e6 100644
+--- a/include/linux/mtd/map.h
++++ b/include/linux/mtd/map.h
+@@ -26,7 +26,7 @@
+ #include <linux/list.h>
+ #include <linux/string.h>
+ #include <linux/bug.h>
+-
++#include <linux/kernel.h>
+ 
+ #include <asm/unaligned.h>
+ #include <asm/system.h>
+diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
+index 605b0aa..76f4396 100644
+--- a/include/linux/usb/usbnet.h
++++ b/include/linux/usb/usbnet.h
+@@ -191,7 +191,8 @@ extern void usbnet_cdc_status(struct usbnet *, struct urb *);
+ enum skb_state {
+ 	illegal = 0,
+ 	tx_start, tx_done,
+-	rx_start, rx_done, rx_cleanup
++	rx_start, rx_done, rx_cleanup,
++	unlink_start
+ };
+ 
+ struct skb_data {	/* skb->cb is one of these */
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 0acf42c0..26f1ab0 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -47,6 +47,7 @@
+ #include <linux/audit.h>
+ #include <linux/memcontrol.h>
+ #include <linux/ftrace.h>
++#include <linux/proc_fs.h>
+ #include <linux/profile.h>
+ #include <linux/rmap.h>
+ #include <linux/ksm.h>
+@@ -1387,6 +1388,8 @@ bad_fork_cleanup_io:
+ 	if (p->io_context)
+ 		exit_io_context(p);
+ bad_fork_cleanup_namespaces:
++	if (unlikely(clone_flags & CLONE_NEWPID))
++		pid_ns_release_proc(p->nsproxy->pid_ns);
+ 	exit_task_namespaces(p);
+ bad_fork_cleanup_mm:
+ 	if (p->mm)
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index bd936ed..7120c2e 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2405,7 +2405,6 @@ retry_avoidcopy:
+ 		if (outside_reserve) {
+ 			BUG_ON(huge_pte_none(pte));
+ 			if (unmap_ref_private(mm, vma, old_page, address)) {
+-				BUG_ON(page_count(old_page) != 1);
+ 				BUG_ON(huge_pte_none(pte));
+ 				spin_lock(&mm->page_table_lock);
+ 				goto retry_avoidcopy;
+diff --git a/mm/nobootmem.c b/mm/nobootmem.c
+index 7fa41b4..07c08c4 100644
+--- a/mm/nobootmem.c
++++ b/mm/nobootmem.c
+@@ -83,8 +83,7 @@ void __init free_bootmem_late(unsigned long addr, unsigned long size)
+ 
+ static void __init __free_pages_memory(unsigned long start, unsigned long end)
+ {
+-	int i;
+-	unsigned long start_aligned, end_aligned;
++	unsigned long i, start_aligned, end_aligned;
+ 	int order = ilog2(BITS_PER_LONG);
+ 
+ 	start_aligned = (start + (BITS_PER_LONG - 1)) & ~(BITS_PER_LONG - 1);
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 716eb4a..5c29750 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1642,6 +1642,16 @@ int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size,
+ 		areas[group] = ptr;
+ 
+ 		base = min(ptr, base);
++	}
++
++	/*
++	 * Copy data and free unused parts.  This should happen after all
++	 * allocations are complete; otherwise, we may end up with
++	 * overlapping groups.
++	 */
++	for (group = 0; group < ai->nr_groups; group++) {
++		struct pcpu_group_info *gi = &ai->groups[group];
++		void *ptr = areas[group];
+ 
+ 		for (i = 0; i < gi->nr_units; i++, ptr += ai->unit_size) {
+ 			if (gi->cpu_map[i] == NR_CPUS) {
+diff --git a/net/core/dev.c b/net/core/dev.c
+index cd5050e..61a7baa 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1421,14 +1421,34 @@ EXPORT_SYMBOL(register_netdevice_notifier);
+  *	register_netdevice_notifier(). The notifier is unlinked into the
+  *	kernel structures and may then be reused. A negative errno code
+  *	is returned on a failure.
++ *
++ * 	After unregistering unregister and down device events are synthesized
++ *	for all devices on the device list to the removed notifier to remove
++ *	the need for special case cleanup code.
+  */
+ 
+ int unregister_netdevice_notifier(struct notifier_block *nb)
+ {
++	struct net_device *dev;
++	struct net *net;
+ 	int err;
+ 
+ 	rtnl_lock();
+ 	err = raw_notifier_chain_unregister(&netdev_chain, nb);
++	if (err)
++		goto unlock;
++
++	for_each_net(net) {
++		for_each_netdev(net, dev) {
++			if (dev->flags & IFF_UP) {
++				nb->notifier_call(nb, NETDEV_GOING_DOWN, dev);
++				nb->notifier_call(nb, NETDEV_DOWN, dev);
++			}
++			nb->notifier_call(nb, NETDEV_UNREGISTER, dev);
++			nb->notifier_call(nb, NETDEV_UNREGISTER_BATCH, dev);
++		}
++	}
++unlock:
+ 	rtnl_unlock();
+ 	return err;
+ }
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index 0001c24..df878de 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -1932,7 +1932,7 @@ static int pktgen_device_event(struct notifier_block *unused,
+ {
+ 	struct net_device *dev = ptr;
+ 
+-	if (!net_eq(dev_net(dev), &init_net))
++	if (!net_eq(dev_net(dev), &init_net) || pktgen_exiting)
+ 		return NOTIFY_DONE;
+ 
+ 	/* It is OK that we do not hold the group lock right now,
+@@ -3758,12 +3758,18 @@ static void __exit pg_cleanup(void)
+ {
+ 	struct pktgen_thread *t;
+ 	struct list_head *q, *n;
++	LIST_HEAD(list);
+ 
+ 	/* Stop all interfaces & threads */
+ 	pktgen_exiting = true;
+ 
+-	list_for_each_safe(q, n, &pktgen_threads) {
++	mutex_lock(&pktgen_thread_lock);
++	list_splice_init(&pktgen_threads, &list);
++	mutex_unlock(&pktgen_thread_lock);
++
++	list_for_each_safe(q, n, &list) {
+ 		t = list_entry(q, struct pktgen_thread, th_list);
++		list_del(&t->th_list);
+ 		kthread_stop(t->tsk);
+ 		kfree(t);
+ 	}
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 7904db4..11ba922 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -851,8 +851,7 @@ new_segment:
+ wait_for_sndbuf:
+ 		set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+ wait_for_memory:
+-		if (copied)
+-			tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
++		tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+ 
+ 		if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
+ 			goto do_error;
+@@ -3216,7 +3215,7 @@ void __init tcp_init(void)
+ {
+ 	struct sk_buff *skb = NULL;
+ 	unsigned long limit;
+-	int i, max_share, cnt;
++	int i, max_rshare, max_wshare, cnt;
+ 	unsigned long jiffy = jiffies;
+ 
+ 	BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
+@@ -3280,15 +3279,16 @@ void __init tcp_init(void)
+ 
+ 	/* Set per-socket limits to no more than 1/128 the pressure threshold */
+ 	limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7);
+-	max_share = min(4UL*1024*1024, limit);
++	max_wshare = min(4UL*1024*1024, limit);
++	max_rshare = min(6UL*1024*1024, limit);
+ 
+ 	sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
+ 	sysctl_tcp_wmem[1] = 16*1024;
+-	sysctl_tcp_wmem[2] = max(64*1024, max_share);
++	sysctl_tcp_wmem[2] = max(64*1024, max_wshare);
+ 
+ 	sysctl_tcp_rmem[0] = SK_MEM_QUANTUM;
+ 	sysctl_tcp_rmem[1] = 87380;
+-	sysctl_tcp_rmem[2] = max(87380, max_share);
++	sysctl_tcp_rmem[2] = max(87380, max_rshare);
+ 
+ 	printk(KERN_INFO "TCP: Hash tables configured "
+ 	       "(established %u bind %u)\n",
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index daedc07..9726927 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -83,7 +83,7 @@ int sysctl_tcp_ecn __read_mostly = 2;
+ EXPORT_SYMBOL(sysctl_tcp_ecn);
+ int sysctl_tcp_dsack __read_mostly = 1;
+ int sysctl_tcp_app_win __read_mostly = 31;
+-int sysctl_tcp_adv_win_scale __read_mostly = 2;
++int sysctl_tcp_adv_win_scale __read_mostly = 1;
+ EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
+ 
+ int sysctl_tcp_stdurg __read_mostly;
+@@ -2868,11 +2868,14 @@ static inline void tcp_complete_cwr(struct sock *sk)
+ 
+ 	/* Do not moderate cwnd if it's already undone in cwr or recovery. */
+ 	if (tp->undo_marker) {
+-		if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR)
++		if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR) {
+ 			tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
+-		else /* PRR */
++			tp->snd_cwnd_stamp = tcp_time_stamp;
++		} else if (tp->snd_ssthresh < TCP_INFINITE_SSTHRESH) {
++			/* PRR algorithm. */
+ 			tp->snd_cwnd = tp->snd_ssthresh;
+-		tp->snd_cwnd_stamp = tcp_time_stamp;
++			tp->snd_cwnd_stamp = tcp_time_stamp;
++		}
+ 	}
+ 	tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
+ }
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index 55670ec..2a2a3e7 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -441,8 +441,9 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
+ 
+ 		daddr = lip->l2tp_addr.s_addr;
+ 	} else {
++		rc = -EDESTADDRREQ;
+ 		if (sk->sk_state != TCP_ESTABLISHED)
+-			return -EDESTADDRREQ;
++			goto out;
+ 
+ 		daddr = inet->inet_daddr;
+ 		connected = 1;
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 7801b15..a489d8b 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -351,10 +351,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+ 	if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
+ 		if (!(skb = skb_unshare(skb, GFP_ATOMIC)) ||
+ 		    (skb->ip_summed == CHECKSUM_PARTIAL &&
+-		     skb_checksum_help(skb))) {
+-			sch->qstats.drops++;
+-			return NET_XMIT_DROP;
+-		}
++		     skb_checksum_help(skb)))
++			return qdisc_drop(skb, sch);
+ 
+ 		skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8);
+ 	}
+diff --git a/sound/pci/echoaudio/echoaudio_dsp.c b/sound/pci/echoaudio/echoaudio_dsp.c
+index 64417a7..d8c670c 100644
+--- a/sound/pci/echoaudio/echoaudio_dsp.c
++++ b/sound/pci/echoaudio/echoaudio_dsp.c
+@@ -475,7 +475,7 @@ static int load_firmware(struct echoaudio *chip)
+ 	const struct firmware *fw;
+ 	int box_type, err;
+ 
+-	if (snd_BUG_ON(!chip->dsp_code_to_load || !chip->comm_page))
++	if (snd_BUG_ON(!chip->comm_page))
+ 		return -EPERM;
+ 
+ 	/* See if the ASIC is present and working - only if the DSP is already loaded */
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 192e6c0..53345bc 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -769,11 +769,13 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
+ {
+ 	struct azx *chip = bus->private_data;
+ 	unsigned long timeout;
++	unsigned long loopcounter;
+ 	int do_poll = 0;
+ 
+  again:
+ 	timeout = jiffies + msecs_to_jiffies(1000);
+-	for (;;) {
++
++	for (loopcounter = 0;; loopcounter++) {
+ 		if (chip->polling_mode || do_poll) {
+ 			spin_lock_irq(&chip->reg_lock);
+ 			azx_update_rirb(chip);
+@@ -789,7 +791,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
+ 		}
+ 		if (time_after(jiffies, timeout))
+ 			break;
+-		if (bus->needs_damn_long_delay)
++		if (bus->needs_damn_long_delay || loopcounter > 3000)
+ 			msleep(2); /* temporary workaround */
+ 		else {
+ 			udelay(10);
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index ed67698..7b7a516 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4484,9 +4484,9 @@ static int stac92xx_init(struct hda_codec *codec)
+ 		def_conf = get_defcfg_connect(def_conf);
+ 		/* skip any ports that don't have jacks since presence
+  		 * detection is useless */
+-		if (def_conf != AC_JACK_PORT_COMPLEX) {
+-			if (def_conf != AC_JACK_PORT_NONE)
+-				stac_toggle_power_map(codec, nid, 1);
++		if (def_conf != AC_JACK_PORT_NONE &&
++		    !is_jack_detectable(codec, nid)) {
++			stac_toggle_power_map(codec, nid, 1);
+ 			continue;
+ 		}
+ 		if (enable_pin_detect(codec, nid, STAC_PWR_EVENT)) {
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index 7806301..3e7aa22 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -1027,7 +1027,7 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w,
+ 		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+ 				    WM8994_AIF2DACL_ENA |
+ 				    WM8994_AIF2DACR_ENA, 0);
+-		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
+ 				    WM8994_AIF2ADCL_ENA |
+ 				    WM8994_AIF2ADCR_ENA, 0);
+ 

Added: genpatches-2.6/trunk/3.2/1018_linux-3.2.19.patch
===================================================================
--- genpatches-2.6/trunk/3.2/1018_linux-3.2.19.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.2/1018_linux-3.2.19.patch	2012-06-06 00:46:35 UTC (rev 2150)
@@ -0,0 +1,4857 @@
+diff --git a/Documentation/HOWTO b/Documentation/HOWTO
+index f7ade3b..59c080f 100644
+--- a/Documentation/HOWTO
++++ b/Documentation/HOWTO
+@@ -218,16 +218,16 @@ The development process
+ Linux kernel development process currently consists of a few different
+ main kernel "branches" and lots of different subsystem-specific kernel
+ branches.  These different branches are:
+-  - main 2.6.x kernel tree
+-  - 2.6.x.y -stable kernel tree
+-  - 2.6.x -git kernel patches
++  - main 3.x kernel tree
++  - 3.x.y -stable kernel tree
++  - 3.x -git kernel patches
+   - subsystem specific kernel trees and patches
+-  - the 2.6.x -next kernel tree for integration tests
++  - the 3.x -next kernel tree for integration tests
+ 
+-2.6.x kernel tree
++3.x kernel tree
+ -----------------
+-2.6.x kernels are maintained by Linus Torvalds, and can be found on
+-kernel.org in the pub/linux/kernel/v2.6/ directory.  Its development
++3.x kernels are maintained by Linus Torvalds, and can be found on
++kernel.org in the pub/linux/kernel/v3.x/ directory.  Its development
+ process is as follows:
+   - As soon as a new kernel is released a two weeks window is open,
+     during this period of time maintainers can submit big diffs to
+@@ -262,20 +262,20 @@ mailing list about kernel releases:
+ 	released according to perceived bug status, not according to a
+ 	preconceived timeline."
+ 
+-2.6.x.y -stable kernel tree
++3.x.y -stable kernel tree
+ ---------------------------
+-Kernels with 4-part versions are -stable kernels. They contain
++Kernels with 3-part versions are -stable kernels. They contain
+ relatively small and critical fixes for security problems or significant
+-regressions discovered in a given 2.6.x kernel.
++regressions discovered in a given 3.x kernel.
+ 
+ This is the recommended branch for users who want the most recent stable
+ kernel and are not interested in helping test development/experimental
+ versions.
+ 
+-If no 2.6.x.y kernel is available, then the highest numbered 2.6.x
++If no 3.x.y kernel is available, then the highest numbered 3.x
+ kernel is the current stable kernel.
+ 
+-2.6.x.y are maintained by the "stable" team <stable@×××××××××××.org>, and
++3.x.y are maintained by the "stable" team <stable@×××××××××××.org>, and
+ are released as needs dictate.  The normal release period is approximately
+ two weeks, but it can be longer if there are no pressing problems.  A
+ security-related problem, instead, can cause a release to happen almost
+@@ -285,7 +285,7 @@ The file Documentation/stable_kernel_rules.txt in the kernel tree
+ documents what kinds of changes are acceptable for the -stable tree, and
+ how the release process works.
+ 
+-2.6.x -git patches
++3.x -git patches
+ ------------------
+ These are daily snapshots of Linus' kernel tree which are managed in a
+ git repository (hence the name.) These patches are usually released
+@@ -317,13 +317,13 @@ revisions to it, and maintainers can mark patches as under review,
+ accepted, or rejected.  Most of these patchwork sites are listed at
+ http://patchwork.kernel.org/.
+ 
+-2.6.x -next kernel tree for integration tests
++3.x -next kernel tree for integration tests
+ ---------------------------------------------
+-Before updates from subsystem trees are merged into the mainline 2.6.x
++Before updates from subsystem trees are merged into the mainline 3.x
+ tree, they need to be integration-tested.  For this purpose, a special
+ testing repository exists into which virtually all subsystem trees are
+ pulled on an almost daily basis:
+-	http://git.kernel.org/?p=linux/kernel/git/sfr/linux-next.git
++	http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git
+ 	http://linux.f-seidel.de/linux-next/pmwiki/
+ 
+ This way, the -next kernel gives a summary outlook onto what will be
+diff --git a/Makefile b/Makefile
+index add68f1..c291184 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 18
++SUBLEVEL = 19
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+@@ -442,7 +442,7 @@ asm-generic:
+ 
+ no-dot-config-targets := clean mrproper distclean \
+ 			 cscope gtags TAGS tags help %docs check% coccicheck \
+-			 include/linux/version.h headers_% \
++			 include/linux/version.h headers_% archscripts \
+ 			 kernelversion %src-pkg
+ 
+ config-targets := 0
+@@ -979,7 +979,7 @@ prepare1: prepare2 include/linux/version.h include/generated/utsrelease.h \
+                    include/config/auto.conf
+ 	$(cmd_crmodverdir)
+ 
+-archprepare: prepare1 scripts_basic
++archprepare: archscripts prepare1 scripts_basic
+ 
+ prepare0: archprepare FORCE
+ 	$(Q)$(MAKE) $(build)=.
+@@ -1046,8 +1046,11 @@ hdr-inst := -rR -f $(srctree)/scripts/Makefile.headersinst obj
+ # If we do an all arch process set dst to asm-$(hdr-arch)
+ hdr-dst = $(if $(KBUILD_HEADERS), dst=include/asm-$(hdr-arch), dst=include/asm)
+ 
++PHONY += archscripts
++archscripts:
++
+ PHONY += __headers
+-__headers: include/linux/version.h scripts_basic asm-generic FORCE
++__headers: include/linux/version.h scripts_basic asm-generic archscripts FORCE
+ 	$(Q)$(MAKE) $(build)=scripts build_unifdef
+ 
+ PHONY += headers_install_all
+diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
+index d5d8d5c..1252a26 100644
+--- a/arch/arm/include/asm/cacheflush.h
++++ b/arch/arm/include/asm/cacheflush.h
+@@ -249,7 +249,7 @@ extern void flush_cache_page(struct vm_area_struct *vma, unsigned long user_addr
+  * Harvard caches are synchronised for the user space address range.
+  * This is used for the ARM private sys_cacheflush system call.
+  */
+-#define flush_cache_user_range(vma,start,end) \
++#define flush_cache_user_range(start,end) \
+ 	__cpuc_coherent_user_range((start) & PAGE_MASK, PAGE_ALIGN(end))
+ 
+ /*
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index 99a5727..160cb16 100644
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -488,7 +488,9 @@ do_cache_op(unsigned long start, unsigned long end, int flags)
+ 		if (end > vma->vm_end)
+ 			end = vma->vm_end;
+ 
+-		flush_cache_user_range(vma, start, end);
++		up_read(&mm->mmap_sem);
++		flush_cache_user_range(start, end);
++		return;
+ 	}
+ 	up_read(&mm->mmap_sem);
+ }
+diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
+index 43f4c92..7073185 100644
+--- a/arch/ia64/kvm/kvm-ia64.c
++++ b/arch/ia64/kvm/kvm-ia64.c
+@@ -1169,6 +1169,11 @@ out:
+ 
+ #define PALE_RESET_ENTRY    0x80000000ffffffb0UL
+ 
++bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
++{
++	return irqchip_in_kernel(vcpu->kcm) == (vcpu->arch.apic != NULL);
++}
++
+ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+ {
+ 	struct kvm_vcpu *v;
+diff --git a/arch/parisc/include/asm/prefetch.h b/arch/parisc/include/asm/prefetch.h
+index c5edc60..1ee7c82 100644
+--- a/arch/parisc/include/asm/prefetch.h
++++ b/arch/parisc/include/asm/prefetch.h
+@@ -21,7 +21,12 @@
+ #define ARCH_HAS_PREFETCH
+ static inline void prefetch(const void *addr)
+ {
+-	__asm__("ldw 0(%0), %%r0" : : "r" (addr));
++	__asm__(
++#ifndef CONFIG_PA20
++		/* Need to avoid prefetch of NULL on PA7300LC */
++		"	extrw,u,= %0,31,32,%%r0\n"
++#endif
++		"	ldw 0(%0), %%r0" : : "r" (addr));
+ }
+ 
+ /* LDD is a PA2.0 addition. */
+diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
+index 6f05944..5350342 100644
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -581,7 +581,11 @@
+ 	 */
+ 	cmpiclr,=	0x01,\tmp,%r0
+ 	ldi		(_PAGE_DIRTY|_PAGE_READ|_PAGE_WRITE),\prot
++#ifdef CONFIG_64BIT
+ 	depd,z		\prot,8,7,\prot
++#else
++	depw,z		\prot,8,7,\prot
++#endif
+ 	/*
+ 	 * OK, it is in the temp alias region, check whether "from" or "to".
+ 	 * Check "subtle" note in pacache.S re: r23/r26.
+diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
+index 93ff3d9..5d7218a 100644
+--- a/arch/parisc/kernel/pacache.S
++++ b/arch/parisc/kernel/pacache.S
+@@ -692,7 +692,7 @@ ENTRY(flush_icache_page_asm)
+ 
+ 	/* Purge any old translation */
+ 
+-	pitlb		(%sr0,%r28)
++	pitlb		(%sr4,%r28)
+ 
+ 	ldil		L%icache_stride, %r1
+ 	ldw		R%icache_stride(%r1), %r1
+@@ -706,27 +706,29 @@ ENTRY(flush_icache_page_asm)
+ 	sub		%r25, %r1, %r25
+ 
+ 
+-1:      fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
++	/* fic only has the type 26 form on PA1.1, requiring an
++	 * explicit space specification, so use %sr4 */
++1:      fic,m		%r1(%sr4,%r28)
++	fic,m		%r1(%sr4,%r28)
++	fic,m		%r1(%sr4,%r28)
++	fic,m		%r1(%sr4,%r28)
++	fic,m		%r1(%sr4,%r28)
++	fic,m		%r1(%sr4,%r28)
++	fic,m		%r1(%sr4,%r28)
++	fic,m		%r1(%sr4,%r28)
++	fic,m		%r1(%sr4,%r28)
++	fic,m		%r1(%sr4,%r28)
++	fic,m		%r1(%sr4,%r28)
++	fic,m		%r1(%sr4,%r28)
++	fic,m		%r1(%sr4,%r28)
++	fic,m		%r1(%sr4,%r28)
++	fic,m		%r1(%sr4,%r28)
+ 	cmpb,COND(<<)		%r28, %r25,1b
+-	fic,m		%r1(%r28)
++	fic,m		%r1(%sr4,%r28)
+ 
+ 	sync
+ 	bv		%r0(%r2)
+-	pitlb		(%sr0,%r25)
++	pitlb		(%sr4,%r25)
+ 	.exit
+ 
+ 	.procend
+diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c
+index 0243454..a5f6eff 100644
+--- a/arch/s390/kvm/intercept.c
++++ b/arch/s390/kvm/intercept.c
+@@ -133,13 +133,6 @@ static int handle_stop(struct kvm_vcpu *vcpu)
+ 
+ 	vcpu->stat.exit_stop_request++;
+ 	spin_lock_bh(&vcpu->arch.local_int.lock);
+-	if (vcpu->arch.local_int.action_bits & ACTION_STORE_ON_STOP) {
+-		vcpu->arch.local_int.action_bits &= ~ACTION_STORE_ON_STOP;
+-		rc = kvm_s390_vcpu_store_status(vcpu,
+-						  KVM_S390_STORE_STATUS_NOADDR);
+-		if (rc >= 0)
+-			rc = -EOPNOTSUPP;
+-	}
+ 
+ 	if (vcpu->arch.local_int.action_bits & ACTION_RELOADVCPU_ON_STOP) {
+ 		vcpu->arch.local_int.action_bits &= ~ACTION_RELOADVCPU_ON_STOP;
+@@ -155,7 +148,18 @@ static int handle_stop(struct kvm_vcpu *vcpu)
+ 		rc = -EOPNOTSUPP;
+ 	}
+ 
+-	spin_unlock_bh(&vcpu->arch.local_int.lock);
++	if (vcpu->arch.local_int.action_bits & ACTION_STORE_ON_STOP) {
++		vcpu->arch.local_int.action_bits &= ~ACTION_STORE_ON_STOP;
++		/* store status must be called unlocked. Since local_int.lock
++		 * only protects local_int.* and not guest memory we can give
++		 * up the lock here */
++		spin_unlock_bh(&vcpu->arch.local_int.lock);
++		rc = kvm_s390_vcpu_store_status(vcpu,
++						KVM_S390_STORE_STATUS_NOADDR);
++		if (rc >= 0)
++			rc = -EOPNOTSUPP;
++	} else
++		spin_unlock_bh(&vcpu->arch.local_int.lock);
+ 	return rc;
+ }
+ 
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index d1c44573..d3cb86c 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -418,7 +418,7 @@ int kvm_arch_vcpu_ioctl_get_sregs(struct kvm_vcpu *vcpu,
+ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
+ {
+ 	memcpy(&vcpu->arch.guest_fpregs.fprs, &fpu->fprs, sizeof(fpu->fprs));
+-	vcpu->arch.guest_fpregs.fpc = fpu->fpc;
++	vcpu->arch.guest_fpregs.fpc = fpu->fpc & FPC_VALID_MASK;
+ 	restore_fp_regs(&vcpu->arch.guest_fpregs);
+ 	return 0;
+ }
+diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
+index c7f0fbc..b28aaa4 100644
+--- a/arch/s390/mm/fault.c
++++ b/arch/s390/mm/fault.c
+@@ -583,6 +583,7 @@ static void pfault_interrupt(unsigned int ext_int_code,
+ 			tsk->thread.pfault_wait = 0;
+ 			list_del(&tsk->thread.list);
+ 			wake_up_process(tsk);
++			put_task_struct(tsk);
+ 		} else {
+ 			/* Completion interrupt was faster than initial
+ 			 * interrupt. Set pfault_wait to -1 so the initial
+@@ -597,14 +598,22 @@ static void pfault_interrupt(unsigned int ext_int_code,
+ 		put_task_struct(tsk);
+ 	} else {
+ 		/* signal bit not set -> a real page is missing. */
+-		if (tsk->thread.pfault_wait == -1) {
++		if (tsk->thread.pfault_wait == 1) {
++			/* Already on the list with a reference: put to sleep */
++			set_task_state(tsk, TASK_UNINTERRUPTIBLE);
++			set_tsk_need_resched(tsk);
++		} else if (tsk->thread.pfault_wait == -1) {
+ 			/* Completion interrupt was faster than the initial
+ 			 * interrupt (pfault_wait == -1). Set pfault_wait
+ 			 * back to zero and exit. */
+ 			tsk->thread.pfault_wait = 0;
+ 		} else {
+ 			/* Initial interrupt arrived before completion
+-			 * interrupt. Let the task sleep. */
++			 * interrupt. Let the task sleep.
++			 * An extra task reference is needed since a different
++			 * cpu may set the task state to TASK_RUNNING again
++			 * before the scheduler is reached. */
++			get_task_struct(tsk);
+ 			tsk->thread.pfault_wait = 1;
+ 			list_add(&tsk->thread.list, &pfault_list);
+ 			set_task_state(tsk, TASK_UNINTERRUPTIBLE);
+@@ -629,6 +638,7 @@ static int __cpuinit pfault_cpu_notify(struct notifier_block *self,
+ 			list_del(&thread->list);
+ 			tsk = container_of(thread, struct task_struct, thread);
+ 			wake_up_process(tsk);
++			put_task_struct(tsk);
+ 		}
+ 		spin_unlock_irq(&pfault_lock);
+ 		break;
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index f92602e..f210d51 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -583,6 +583,9 @@ config SYSVIPC_COMPAT
+ 	depends on COMPAT && SYSVIPC
+ 	default y
+ 
++config KEYS_COMPAT
++	def_bool y if COMPAT && KEYS
++
+ endmenu
+ 
+ source "net/Kconfig"
+diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
+index db86b1a..3a58e0d 100644
+--- a/arch/sparc/kernel/systbls_64.S
++++ b/arch/sparc/kernel/systbls_64.S
+@@ -74,7 +74,7 @@ sys_call_table32:
+ 	.word sys_timer_delete, compat_sys_timer_create, sys_ni_syscall, compat_sys_io_setup, sys_io_destroy
+ /*270*/	.word sys32_io_submit, sys_io_cancel, compat_sys_io_getevents, sys32_mq_open, sys_mq_unlink
+ 	.word compat_sys_mq_timedsend, compat_sys_mq_timedreceive, compat_sys_mq_notify, compat_sys_mq_getsetattr, compat_sys_waitid
+-/*280*/	.word sys32_tee, sys_add_key, sys_request_key, sys_keyctl, compat_sys_openat
++/*280*/	.word sys32_tee, sys_add_key, sys_request_key, compat_sys_keyctl, compat_sys_openat
+ 	.word sys_mkdirat, sys_mknodat, sys_fchownat, compat_sys_futimesat, compat_sys_fstatat64
+ /*290*/	.word sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
+ 	.word sys_fchmodat, sys_faccessat, compat_sys_pselect6, compat_sys_ppoll, sys_unshare
+diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
+index 70a0de4..6cb8319 100644
+--- a/arch/tile/Kconfig
++++ b/arch/tile/Kconfig
+@@ -11,8 +11,9 @@ config TILE
+ 	select GENERIC_IRQ_PROBE
+ 	select GENERIC_PENDING_IRQ if SMP
+ 	select GENERIC_IRQ_SHOW
++	select HAVE_SYSCALL_WRAPPERS if TILEGX
+ 	select SYS_HYPERVISOR
+-	select ARCH_HAVE_NMI_SAFE_CMPXCHG if !M386
++	select ARCH_HAVE_NMI_SAFE_CMPXCHG
+ 
+ # FIXME: investigate whether we need/want these options.
+ #	select HAVE_IOREMAP_PROT
+diff --git a/arch/tile/include/asm/bitops.h b/arch/tile/include/asm/bitops.h
+index 16f1fa5..bd186c4 100644
+--- a/arch/tile/include/asm/bitops.h
++++ b/arch/tile/include/asm/bitops.h
+@@ -77,6 +77,11 @@ static inline int ffs(int x)
+ 	return __builtin_ffs(x);
+ }
+ 
++static inline int fls64(__u64 w)
++{
++	return (sizeof(__u64) * 8) - __builtin_clzll(w);
++}
++
+ /**
+  * fls - find last set bit in word
+  * @x: the word to search
+@@ -90,12 +95,7 @@ static inline int ffs(int x)
+  */
+ static inline int fls(int x)
+ {
+-	return (sizeof(int) * 8) - __builtin_clz(x);
+-}
+-
+-static inline int fls64(__u64 w)
+-{
+-	return (sizeof(__u64) * 8) - __builtin_clzll(w);
++	return fls64((unsigned int) x);
+ }
+ 
+ static inline unsigned int __arch_hweight32(unsigned int w)
+diff --git a/arch/um/include/asm/pgtable.h b/arch/um/include/asm/pgtable.h
+index 41474fb..aa365c5 100644
+--- a/arch/um/include/asm/pgtable.h
++++ b/arch/um/include/asm/pgtable.h
+@@ -271,6 +271,12 @@ static inline void set_pte(pte_t *pteptr, pte_t pteval)
+ }
+ #define set_pte_at(mm,addr,ptep,pteval) set_pte(ptep,pteval)
+ 
++#define __HAVE_ARCH_PTE_SAME
++static inline int pte_same(pte_t pte_a, pte_t pte_b)
++{
++	return !((pte_val(pte_a) ^ pte_val(pte_b)) & ~_PAGE_NEWPAGE);
++}
++
+ /*
+  * Conversion functions: convert a page and protection to a page entry,
+  * and a page entry and page directory to the page they refer to.
+@@ -346,11 +352,11 @@ extern pte_t *virt_to_pte(struct mm_struct *mm, unsigned long addr);
+ #define update_mmu_cache(vma,address,ptep) do ; while (0)
+ 
+ /* Encode and de-code a swap entry */
+-#define __swp_type(x)			(((x).val >> 4) & 0x3f)
++#define __swp_type(x)			(((x).val >> 5) & 0x1f)
+ #define __swp_offset(x)			((x).val >> 11)
+ 
+ #define __swp_entry(type, offset) \
+-	((swp_entry_t) { ((type) << 4) | ((offset) << 11) })
++	((swp_entry_t) { ((type) << 5) | ((offset) << 11) })
+ #define __pte_to_swp_entry(pte) \
+ 	((swp_entry_t) { pte_val(pte_mkuptodate(pte)) })
+ #define __swp_entry_to_pte(x)		((pte_t) { (x).val })
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index b02e509..03dbc7f5b 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -117,6 +117,9 @@ KBUILD_CFLAGS += $(call cc-option,-mno-sse -mno-mmx -mno-sse2 -mno-3dnow,)
+ KBUILD_CFLAGS += $(mflags-y)
+ KBUILD_AFLAGS += $(mflags-y)
+ 
++archscripts:
++	$(Q)$(MAKE) $(build)=arch/x86/tools relocs
++
+ ###
+ # Kernel objects
+ 
+@@ -180,6 +183,7 @@ archclean:
+ 	$(Q)rm -rf $(objtree)/arch/i386
+ 	$(Q)rm -rf $(objtree)/arch/x86_64
+ 	$(Q)$(MAKE) $(clean)=$(boot)
++	$(Q)$(MAKE) $(clean)=arch/x86/tools
+ 
+ define archhelp
+   echo  '* bzImage      - Compressed kernel image (arch/x86/boot/bzImage)'
+diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
+index 09664ef..77453c6 100644
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -31,13 +31,12 @@ OBJCOPYFLAGS_vmlinux.bin :=  -R .comment -S
+ $(obj)/vmlinux.bin: vmlinux FORCE
+ 	$(call if_changed,objcopy)
+ 
++targets += vmlinux.bin.all vmlinux.relocs
+ 
+-targets += vmlinux.bin.all vmlinux.relocs relocs
+-hostprogs-$(CONFIG_X86_NEED_RELOCS) += relocs
+-
++CMD_RELOCS = arch/x86/tools/relocs
+ quiet_cmd_relocs = RELOCS  $@
+-      cmd_relocs = $(obj)/relocs $< > $@;$(obj)/relocs --abs-relocs $<
+-$(obj)/vmlinux.relocs: vmlinux $(obj)/relocs FORCE
++      cmd_relocs = $(CMD_RELOCS) $< > $@;$(CMD_RELOCS) --abs-relocs $<
++$(obj)/vmlinux.relocs: vmlinux FORCE
+ 	$(call if_changed,relocs)
+ 
+ vmlinux.bin.all-y := $(obj)/vmlinux.bin
+diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
+deleted file mode 100644
+index e77f4e4..0000000
+--- a/arch/x86/boot/compressed/relocs.c
++++ /dev/null
+@@ -1,680 +0,0 @@
+-#include <stdio.h>
+-#include <stdarg.h>
+-#include <stdlib.h>
+-#include <stdint.h>
+-#include <string.h>
+-#include <errno.h>
+-#include <unistd.h>
+-#include <elf.h>
+-#include <byteswap.h>
+-#define USE_BSD
+-#include <endian.h>
+-#include <regex.h>
+-
+-static void die(char *fmt, ...);
+-
+-#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+-static Elf32_Ehdr ehdr;
+-static unsigned long reloc_count, reloc_idx;
+-static unsigned long *relocs;
+-
+-struct section {
+-	Elf32_Shdr     shdr;
+-	struct section *link;
+-	Elf32_Sym      *symtab;
+-	Elf32_Rel      *reltab;
+-	char           *strtab;
+-};
+-static struct section *secs;
+-
+-/*
+- * Following symbols have been audited. There values are constant and do
+- * not change if bzImage is loaded at a different physical address than
+- * the address for which it has been compiled. Don't warn user about
+- * absolute relocations present w.r.t these symbols.
+- */
+-static const char abs_sym_regex[] =
+-	"^(xen_irq_disable_direct_reloc$|"
+-	"xen_save_fl_direct_reloc$|"
+-	"VDSO|"
+-	"__crc_)";
+-static regex_t abs_sym_regex_c;
+-static int is_abs_reloc(const char *sym_name)
+-{
+-	return !regexec(&abs_sym_regex_c, sym_name, 0, NULL, 0);
+-}
+-
+-/*
+- * These symbols are known to be relative, even if the linker marks them
+- * as absolute (typically defined outside any section in the linker script.)
+- */
+-static const char rel_sym_regex[] =
+-	"^_end$";
+-static regex_t rel_sym_regex_c;
+-static int is_rel_reloc(const char *sym_name)
+-{
+-	return !regexec(&rel_sym_regex_c, sym_name, 0, NULL, 0);
+-}
+-
+-static void regex_init(void)
+-{
+-        char errbuf[128];
+-        int err;
+-	
+-        err = regcomp(&abs_sym_regex_c, abs_sym_regex,
+-                      REG_EXTENDED|REG_NOSUB);
+-        if (err) {
+-                regerror(err, &abs_sym_regex_c, errbuf, sizeof errbuf);
+-                die("%s", errbuf);
+-        }
+-
+-        err = regcomp(&rel_sym_regex_c, rel_sym_regex,
+-                      REG_EXTENDED|REG_NOSUB);
+-        if (err) {
+-                regerror(err, &rel_sym_regex_c, errbuf, sizeof errbuf);
+-                die("%s", errbuf);
+-        }
+-}
+-
+-static void die(char *fmt, ...)
+-{
+-	va_list ap;
+-	va_start(ap, fmt);
+-	vfprintf(stderr, fmt, ap);
+-	va_end(ap);
+-	exit(1);
+-}
+-
+-static const char *sym_type(unsigned type)
+-{
+-	static const char *type_name[] = {
+-#define SYM_TYPE(X) [X] = #X
+-		SYM_TYPE(STT_NOTYPE),
+-		SYM_TYPE(STT_OBJECT),
+-		SYM_TYPE(STT_FUNC),
+-		SYM_TYPE(STT_SECTION),
+-		SYM_TYPE(STT_FILE),
+-		SYM_TYPE(STT_COMMON),
+-		SYM_TYPE(STT_TLS),
+-#undef SYM_TYPE
+-	};
+-	const char *name = "unknown sym type name";
+-	if (type < ARRAY_SIZE(type_name)) {
+-		name = type_name[type];
+-	}
+-	return name;
+-}
+-
+-static const char *sym_bind(unsigned bind)
+-{
+-	static const char *bind_name[] = {
+-#define SYM_BIND(X) [X] = #X
+-		SYM_BIND(STB_LOCAL),
+-		SYM_BIND(STB_GLOBAL),
+-		SYM_BIND(STB_WEAK),
+-#undef SYM_BIND
+-	};
+-	const char *name = "unknown sym bind name";
+-	if (bind < ARRAY_SIZE(bind_name)) {
+-		name = bind_name[bind];
+-	}
+-	return name;
+-}
+-
+-static const char *sym_visibility(unsigned visibility)
+-{
+-	static const char *visibility_name[] = {
+-#define SYM_VISIBILITY(X) [X] = #X
+-		SYM_VISIBILITY(STV_DEFAULT),
+-		SYM_VISIBILITY(STV_INTERNAL),
+-		SYM_VISIBILITY(STV_HIDDEN),
+-		SYM_VISIBILITY(STV_PROTECTED),
+-#undef SYM_VISIBILITY
+-	};
+-	const char *name = "unknown sym visibility name";
+-	if (visibility < ARRAY_SIZE(visibility_name)) {
+-		name = visibility_name[visibility];
+-	}
+-	return name;
+-}
+-
+-static const char *rel_type(unsigned type)
+-{
+-	static const char *type_name[] = {
+-#define REL_TYPE(X) [X] = #X
+-		REL_TYPE(R_386_NONE),
+-		REL_TYPE(R_386_32),
+-		REL_TYPE(R_386_PC32),
+-		REL_TYPE(R_386_GOT32),
+-		REL_TYPE(R_386_PLT32),
+-		REL_TYPE(R_386_COPY),
+-		REL_TYPE(R_386_GLOB_DAT),
+-		REL_TYPE(R_386_JMP_SLOT),
+-		REL_TYPE(R_386_RELATIVE),
+-		REL_TYPE(R_386_GOTOFF),
+-		REL_TYPE(R_386_GOTPC),
+-#undef REL_TYPE
+-	};
+-	const char *name = "unknown type rel type name";
+-	if (type < ARRAY_SIZE(type_name) && type_name[type]) {
+-		name = type_name[type];
+-	}
+-	return name;
+-}
+-
+-static const char *sec_name(unsigned shndx)
+-{
+-	const char *sec_strtab;
+-	const char *name;
+-	sec_strtab = secs[ehdr.e_shstrndx].strtab;
+-	name = "<noname>";
+-	if (shndx < ehdr.e_shnum) {
+-		name = sec_strtab + secs[shndx].shdr.sh_name;
+-	}
+-	else if (shndx == SHN_ABS) {
+-		name = "ABSOLUTE";
+-	}
+-	else if (shndx == SHN_COMMON) {
+-		name = "COMMON";
+-	}
+-	return name;
+-}
+-
+-static const char *sym_name(const char *sym_strtab, Elf32_Sym *sym)
+-{
+-	const char *name;
+-	name = "<noname>";
+-	if (sym->st_name) {
+-		name = sym_strtab + sym->st_name;
+-	}
+-	else {
+-		name = sec_name(secs[sym->st_shndx].shdr.sh_name);
+-	}
+-	return name;
+-}
+-
+-
+-
+-#if BYTE_ORDER == LITTLE_ENDIAN
+-#define le16_to_cpu(val) (val)
+-#define le32_to_cpu(val) (val)
+-#endif
+-#if BYTE_ORDER == BIG_ENDIAN
+-#define le16_to_cpu(val) bswap_16(val)
+-#define le32_to_cpu(val) bswap_32(val)
+-#endif
+-
+-static uint16_t elf16_to_cpu(uint16_t val)
+-{
+-	return le16_to_cpu(val);
+-}
+-
+-static uint32_t elf32_to_cpu(uint32_t val)
+-{
+-	return le32_to_cpu(val);
+-}
+-
+-static void read_ehdr(FILE *fp)
+-{
+-	if (fread(&ehdr, sizeof(ehdr), 1, fp) != 1) {
+-		die("Cannot read ELF header: %s\n",
+-			strerror(errno));
+-	}
+-	if (memcmp(ehdr.e_ident, ELFMAG, SELFMAG) != 0) {
+-		die("No ELF magic\n");
+-	}
+-	if (ehdr.e_ident[EI_CLASS] != ELFCLASS32) {
+-		die("Not a 32 bit executable\n");
+-	}
+-	if (ehdr.e_ident[EI_DATA] != ELFDATA2LSB) {
+-		die("Not a LSB ELF executable\n");
+-	}
+-	if (ehdr.e_ident[EI_VERSION] != EV_CURRENT) {
+-		die("Unknown ELF version\n");
+-	}
+-	/* Convert the fields to native endian */
+-	ehdr.e_type      = elf16_to_cpu(ehdr.e_type);
+-	ehdr.e_machine   = elf16_to_cpu(ehdr.e_machine);
+-	ehdr.e_version   = elf32_to_cpu(ehdr.e_version);
+-	ehdr.e_entry     = elf32_to_cpu(ehdr.e_entry);
+-	ehdr.e_phoff     = elf32_to_cpu(ehdr.e_phoff);
+-	ehdr.e_shoff     = elf32_to_cpu(ehdr.e_shoff);
+-	ehdr.e_flags     = elf32_to_cpu(ehdr.e_flags);
+-	ehdr.e_ehsize    = elf16_to_cpu(ehdr.e_ehsize);
+-	ehdr.e_phentsize = elf16_to_cpu(ehdr.e_phentsize);
+-	ehdr.e_phnum     = elf16_to_cpu(ehdr.e_phnum);
+-	ehdr.e_shentsize = elf16_to_cpu(ehdr.e_shentsize);
+-	ehdr.e_shnum     = elf16_to_cpu(ehdr.e_shnum);
+-	ehdr.e_shstrndx  = elf16_to_cpu(ehdr.e_shstrndx);
+-
+-	if ((ehdr.e_type != ET_EXEC) && (ehdr.e_type != ET_DYN)) {
+-		die("Unsupported ELF header type\n");
+-	}
+-	if (ehdr.e_machine != EM_386) {
+-		die("Not for x86\n");
+-	}
+-	if (ehdr.e_version != EV_CURRENT) {
+-		die("Unknown ELF version\n");
+-	}
+-	if (ehdr.e_ehsize != sizeof(Elf32_Ehdr)) {
+-		die("Bad Elf header size\n");
+-	}
+-	if (ehdr.e_phentsize != sizeof(Elf32_Phdr)) {
+-		die("Bad program header entry\n");
+-	}
+-	if (ehdr.e_shentsize != sizeof(Elf32_Shdr)) {
+-		die("Bad section header entry\n");
+-	}
+-	if (ehdr.e_shstrndx >= ehdr.e_shnum) {
+-		die("String table index out of bounds\n");
+-	}
+-}
+-
+-static void read_shdrs(FILE *fp)
+-{
+-	int i;
+-	Elf32_Shdr shdr;
+-
+-	secs = calloc(ehdr.e_shnum, sizeof(struct section));
+-	if (!secs) {
+-		die("Unable to allocate %d section headers\n",
+-		    ehdr.e_shnum);
+-	}
+-	if (fseek(fp, ehdr.e_shoff, SEEK_SET) < 0) {
+-		die("Seek to %d failed: %s\n",
+-			ehdr.e_shoff, strerror(errno));
+-	}
+-	for (i = 0; i < ehdr.e_shnum; i++) {
+-		struct section *sec = &secs[i];
+-		if (fread(&shdr, sizeof shdr, 1, fp) != 1)
+-			die("Cannot read ELF section headers %d/%d: %s\n",
+-			    i, ehdr.e_shnum, strerror(errno));
+-		sec->shdr.sh_name      = elf32_to_cpu(shdr.sh_name);
+-		sec->shdr.sh_type      = elf32_to_cpu(shdr.sh_type);
+-		sec->shdr.sh_flags     = elf32_to_cpu(shdr.sh_flags);
+-		sec->shdr.sh_addr      = elf32_to_cpu(shdr.sh_addr);
+-		sec->shdr.sh_offset    = elf32_to_cpu(shdr.sh_offset);
+-		sec->shdr.sh_size      = elf32_to_cpu(shdr.sh_size);
+-		sec->shdr.sh_link      = elf32_to_cpu(shdr.sh_link);
+-		sec->shdr.sh_info      = elf32_to_cpu(shdr.sh_info);
+-		sec->shdr.sh_addralign = elf32_to_cpu(shdr.sh_addralign);
+-		sec->shdr.sh_entsize   = elf32_to_cpu(shdr.sh_entsize);
+-		if (sec->shdr.sh_link < ehdr.e_shnum)
+-			sec->link = &secs[sec->shdr.sh_link];
+-	}
+-
+-}
+-
+-static void read_strtabs(FILE *fp)
+-{
+-	int i;
+-	for (i = 0; i < ehdr.e_shnum; i++) {
+-		struct section *sec = &secs[i];
+-		if (sec->shdr.sh_type != SHT_STRTAB) {
+-			continue;
+-		}
+-		sec->strtab = malloc(sec->shdr.sh_size);
+-		if (!sec->strtab) {
+-			die("malloc of %d bytes for strtab failed\n",
+-				sec->shdr.sh_size);
+-		}
+-		if (fseek(fp, sec->shdr.sh_offset, SEEK_SET) < 0) {
+-			die("Seek to %d failed: %s\n",
+-				sec->shdr.sh_offset, strerror(errno));
+-		}
+-		if (fread(sec->strtab, 1, sec->shdr.sh_size, fp)
+-		    != sec->shdr.sh_size) {
+-			die("Cannot read symbol table: %s\n",
+-				strerror(errno));
+-		}
+-	}
+-}
+-
+-static void read_symtabs(FILE *fp)
+-{
+-	int i,j;
+-	for (i = 0; i < ehdr.e_shnum; i++) {
+-		struct section *sec = &secs[i];
+-		if (sec->shdr.sh_type != SHT_SYMTAB) {
+-			continue;
+-		}
+-		sec->symtab = malloc(sec->shdr.sh_size);
+-		if (!sec->symtab) {
+-			die("malloc of %d bytes for symtab failed\n",
+-				sec->shdr.sh_size);
+-		}
+-		if (fseek(fp, sec->shdr.sh_offset, SEEK_SET) < 0) {
+-			die("Seek to %d failed: %s\n",
+-				sec->shdr.sh_offset, strerror(errno));
+-		}
+-		if (fread(sec->symtab, 1, sec->shdr.sh_size, fp)
+-		    != sec->shdr.sh_size) {
+-			die("Cannot read symbol table: %s\n",
+-				strerror(errno));
+-		}
+-		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Sym); j++) {
+-			Elf32_Sym *sym = &sec->symtab[j];
+-			sym->st_name  = elf32_to_cpu(sym->st_name);
+-			sym->st_value = elf32_to_cpu(sym->st_value);
+-			sym->st_size  = elf32_to_cpu(sym->st_size);
+-			sym->st_shndx = elf16_to_cpu(sym->st_shndx);
+-		}
+-	}
+-}
+-
+-
+-static void read_relocs(FILE *fp)
+-{
+-	int i,j;
+-	for (i = 0; i < ehdr.e_shnum; i++) {
+-		struct section *sec = &secs[i];
+-		if (sec->shdr.sh_type != SHT_REL) {
+-			continue;
+-		}
+-		sec->reltab = malloc(sec->shdr.sh_size);
+-		if (!sec->reltab) {
+-			die("malloc of %d bytes for relocs failed\n",
+-				sec->shdr.sh_size);
+-		}
+-		if (fseek(fp, sec->shdr.sh_offset, SEEK_SET) < 0) {
+-			die("Seek to %d failed: %s\n",
+-				sec->shdr.sh_offset, strerror(errno));
+-		}
+-		if (fread(sec->reltab, 1, sec->shdr.sh_size, fp)
+-		    != sec->shdr.sh_size) {
+-			die("Cannot read symbol table: %s\n",
+-				strerror(errno));
+-		}
+-		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
+-			Elf32_Rel *rel = &sec->reltab[j];
+-			rel->r_offset = elf32_to_cpu(rel->r_offset);
+-			rel->r_info   = elf32_to_cpu(rel->r_info);
+-		}
+-	}
+-}
+-
+-
+-static void print_absolute_symbols(void)
+-{
+-	int i;
+-	printf("Absolute symbols\n");
+-	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
+-	for (i = 0; i < ehdr.e_shnum; i++) {
+-		struct section *sec = &secs[i];
+-		char *sym_strtab;
+-		int j;
+-
+-		if (sec->shdr.sh_type != SHT_SYMTAB) {
+-			continue;
+-		}
+-		sym_strtab = sec->link->strtab;
+-		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Sym); j++) {
+-			Elf32_Sym *sym;
+-			const char *name;
+-			sym = &sec->symtab[j];
+-			name = sym_name(sym_strtab, sym);
+-			if (sym->st_shndx != SHN_ABS) {
+-				continue;
+-			}
+-			printf("%5d %08x %5d %10s %10s %12s %s\n",
+-				j, sym->st_value, sym->st_size,
+-				sym_type(ELF32_ST_TYPE(sym->st_info)),
+-				sym_bind(ELF32_ST_BIND(sym->st_info)),
+-				sym_visibility(ELF32_ST_VISIBILITY(sym->st_other)),
+-				name);
+-		}
+-	}
+-	printf("\n");
+-}
+-
+-static void print_absolute_relocs(void)
+-{
+-	int i, printed = 0;
+-
+-	for (i = 0; i < ehdr.e_shnum; i++) {
+-		struct section *sec = &secs[i];
+-		struct section *sec_applies, *sec_symtab;
+-		char *sym_strtab;
+-		Elf32_Sym *sh_symtab;
+-		int j;
+-		if (sec->shdr.sh_type != SHT_REL) {
+-			continue;
+-		}
+-		sec_symtab  = sec->link;
+-		sec_applies = &secs[sec->shdr.sh_info];
+-		if (!(sec_applies->shdr.sh_flags & SHF_ALLOC)) {
+-			continue;
+-		}
+-		sh_symtab  = sec_symtab->symtab;
+-		sym_strtab = sec_symtab->link->strtab;
+-		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
+-			Elf32_Rel *rel;
+-			Elf32_Sym *sym;
+-			const char *name;
+-			rel = &sec->reltab[j];
+-			sym = &sh_symtab[ELF32_R_SYM(rel->r_info)];
+-			name = sym_name(sym_strtab, sym);
+-			if (sym->st_shndx != SHN_ABS) {
+-				continue;
+-			}
+-
+-			/* Absolute symbols are not relocated if bzImage is
+-			 * loaded at a non-compiled address. Display a warning
+-			 * to user at compile time about the absolute
+-			 * relocations present.
+-			 *
+-			 * User need to audit the code to make sure
+-			 * some symbols which should have been section
+-			 * relative have not become absolute because of some
+-			 * linker optimization or wrong programming usage.
+-			 *
+-			 * Before warning check if this absolute symbol
+-			 * relocation is harmless.
+-			 */
+-			if (is_abs_reloc(name) || is_rel_reloc(name))
+-				continue;
+-
+-			if (!printed) {
+-				printf("WARNING: Absolute relocations"
+-					" present\n");
+-				printf("Offset     Info     Type     Sym.Value "
+-					"Sym.Name\n");
+-				printed = 1;
+-			}
+-
+-			printf("%08x %08x %10s %08x  %s\n",
+-				rel->r_offset,
+-				rel->r_info,
+-				rel_type(ELF32_R_TYPE(rel->r_info)),
+-				sym->st_value,
+-				name);
+-		}
+-	}
+-
+-	if (printed)
+-		printf("\n");
+-}
+-
+-static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
+-{
+-	int i;
+-	/* Walk through the relocations */
+-	for (i = 0; i < ehdr.e_shnum; i++) {
+-		char *sym_strtab;
+-		Elf32_Sym *sh_symtab;
+-		struct section *sec_applies, *sec_symtab;
+-		int j;
+-		struct section *sec = &secs[i];
+-
+-		if (sec->shdr.sh_type != SHT_REL) {
+-			continue;
+-		}
+-		sec_symtab  = sec->link;
+-		sec_applies = &secs[sec->shdr.sh_info];
+-		if (!(sec_applies->shdr.sh_flags & SHF_ALLOC)) {
+-			continue;
+-		}
+-		sh_symtab = sec_symtab->symtab;
+-		sym_strtab = sec_symtab->link->strtab;
+-		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
+-			Elf32_Rel *rel;
+-			Elf32_Sym *sym;
+-			unsigned r_type;
+-			rel = &sec->reltab[j];
+-			sym = &sh_symtab[ELF32_R_SYM(rel->r_info)];
+-			r_type = ELF32_R_TYPE(rel->r_info);
+-			/* Don't visit relocations to absolute symbols */
+-			if (sym->st_shndx == SHN_ABS &&
+-			    !is_rel_reloc(sym_name(sym_strtab, sym))) {
+-				continue;
+-			}
+-			switch (r_type) {
+-			case R_386_NONE:
+-			case R_386_PC32:
+-				/*
+-				 * NONE can be ignored and and PC relative
+-				 * relocations don't need to be adjusted.
+-				 */
+-				break;
+-			case R_386_32:
+-				/* Visit relocations that need to be adjusted */
+-				visit(rel, sym);
+-				break;
+-			default:
+-				die("Unsupported relocation type: %s (%d)\n",
+-				    rel_type(r_type), r_type);
+-				break;
+-			}
+-		}
+-	}
+-}
+-
+-static void count_reloc(Elf32_Rel *rel, Elf32_Sym *sym)
+-{
+-	reloc_count += 1;
+-}
+-
+-static void collect_reloc(Elf32_Rel *rel, Elf32_Sym *sym)
+-{
+-	/* Remember the address that needs to be adjusted. */
+-	relocs[reloc_idx++] = rel->r_offset;
+-}
+-
+-static int cmp_relocs(const void *va, const void *vb)
+-{
+-	const unsigned long *a, *b;
+-	a = va; b = vb;
+-	return (*a == *b)? 0 : (*a > *b)? 1 : -1;
+-}
+-
+-static void emit_relocs(int as_text)
+-{
+-	int i;
+-	/* Count how many relocations I have and allocate space for them. */
+-	reloc_count = 0;
+-	walk_relocs(count_reloc);
+-	relocs = malloc(reloc_count * sizeof(relocs[0]));
+-	if (!relocs) {
+-		die("malloc of %d entries for relocs failed\n",
+-			reloc_count);
+-	}
+-	/* Collect up the relocations */
+-	reloc_idx = 0;
+-	walk_relocs(collect_reloc);
+-
+-	/* Order the relocations for more efficient processing */
+-	qsort(relocs, reloc_count, sizeof(relocs[0]), cmp_relocs);
+-
+-	/* Print the relocations */
+-	if (as_text) {
+-		/* Print the relocations in a form suitable that
+-		 * gas will like.
+-		 */
+-		printf(".section \".data.reloc\",\"a\"\n");
+-		printf(".balign 4\n");
+-		for (i = 0; i < reloc_count; i++) {
+-			printf("\t .long 0x%08lx\n", relocs[i]);
+-		}
+-		printf("\n");
+-	}
+-	else {
+-		unsigned char buf[4];
+-		/* Print a stop */
+-		fwrite("\0\0\0\0", 4, 1, stdout);
+-		/* Now print each relocation */
+-		for (i = 0; i < reloc_count; i++) {
+-			buf[0] = (relocs[i] >>  0) & 0xff;
+-			buf[1] = (relocs[i] >>  8) & 0xff;
+-			buf[2] = (relocs[i] >> 16) & 0xff;
+-			buf[3] = (relocs[i] >> 24) & 0xff;
+-			fwrite(buf, 4, 1, stdout);
+-		}
+-	}
+-}
+-
+-static void usage(void)
+-{
+-	die("relocs [--abs-syms |--abs-relocs | --text] vmlinux\n");
+-}
+-
+-int main(int argc, char **argv)
+-{
+-	int show_absolute_syms, show_absolute_relocs;
+-	int as_text;
+-	const char *fname;
+-	FILE *fp;
+-	int i;
+-
+-	regex_init();
+-
+-	show_absolute_syms = 0;
+-	show_absolute_relocs = 0;
+-	as_text = 0;
+-	fname = NULL;
+-	for (i = 1; i < argc; i++) {
+-		char *arg = argv[i];
+-		if (*arg == '-') {
+-			if (strcmp(argv[1], "--abs-syms") == 0) {
+-				show_absolute_syms = 1;
+-				continue;
+-			}
+-
+-			if (strcmp(argv[1], "--abs-relocs") == 0) {
+-				show_absolute_relocs = 1;
+-				continue;
+-			}
+-			else if (strcmp(argv[1], "--text") == 0) {
+-				as_text = 1;
+-				continue;
+-			}
+-		}
+-		else if (!fname) {
+-			fname = arg;
+-			continue;
+-		}
+-		usage();
+-	}
+-	if (!fname) {
+-		usage();
+-	}
+-	fp = fopen(fname, "r");
+-	if (!fp) {
+-		die("Cannot open %s: %s\n",
+-			fname, strerror(errno));
+-	}
+-	read_ehdr(fp);
+-	read_shdrs(fp);
+-	read_strtabs(fp);
+-	read_symtabs(fp);
+-	read_relocs(fp);
+-	if (show_absolute_syms) {
+-		print_absolute_symbols();
+-		return 0;
+-	}
+-	if (show_absolute_relocs) {
+-		print_absolute_relocs();
+-		return 0;
+-	}
+-	emit_relocs(as_text);
+-	return 0;
+-}
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c
+index 7395d5f..c9c9cfe 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
++++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
+@@ -145,15 +145,19 @@ static struct severity {
+ };
+ 
+ /*
+- * If the EIPV bit is set, it means the saved IP is the
+- * instruction which caused the MCE.
++ * If mcgstatus indicated that ip/cs on the stack were
++ * no good, then "m->cs" will be zero and we will have
++ * to assume the worst case (IN_KERNEL) as we actually
++ * have no idea what we were executing when the machine
++ * check hit.
++ * If we do have a good "m->cs" (or a faked one in the
++ * case we were executing in VM86 mode) we can use it to
++ * distinguish an exception taken in user from from one
++ * taken in the kernel.
+  */
+ static int error_context(struct mce *m)
+ {
+-	if (m->mcgstatus & MCG_STATUS_EIPV)
+-		return (m->ip && (m->cs & 3) == 3) ? IN_USER : IN_KERNEL;
+-	/* Unknown, assume kernel */
+-	return IN_KERNEL;
++	return ((m->cs & 3) == 3) ? IN_USER : IN_KERNEL;
+ }
+ 
+ int mce_severity(struct mce *m, int tolerant, char **msg)
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 2af127d..b0f1271 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -389,6 +389,14 @@ static inline void mce_gather_info(struct mce *m, struct pt_regs *regs)
+ 		if (m->mcgstatus & (MCG_STATUS_RIPV|MCG_STATUS_EIPV)) {
+ 			m->ip = regs->ip;
+ 			m->cs = regs->cs;
++
++			/*
++			 * When in VM86 mode make the cs look like ring 3
++			 * always. This is a lie, but it's better than passing
++			 * the additional vm86 bit around everywhere.
++			 */
++			if (v8086_mode(regs))
++				m->cs |= 3;
+ 		}
+ 		/* Use accurate RIP reporting if available. */
+ 		if (rip_msr)
+diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
+index f64a039..3dbfb00 100644
+--- a/arch/x86/kernel/cpu/perf_event_amd.c
++++ b/arch/x86/kernel/cpu/perf_event_amd.c
+@@ -473,6 +473,7 @@ static __initconst const struct x86_pmu amd_pmu = {
+  * 0x023	DE	PERF_CTL[2:0]
+  * 0x02D	LS	PERF_CTL[3]
+  * 0x02E	LS	PERF_CTL[3,0]
++ * 0x031	LS	PERF_CTL[2:0] (**)
+  * 0x043	CU	PERF_CTL[2:0]
+  * 0x045	CU	PERF_CTL[2:0]
+  * 0x046	CU	PERF_CTL[2:0]
+@@ -486,10 +487,12 @@ static __initconst const struct x86_pmu amd_pmu = {
+  * 0x0DD	LS	PERF_CTL[5:0]
+  * 0x0DE	LS	PERF_CTL[5:0]
+  * 0x0DF	LS	PERF_CTL[5:0]
++ * 0x1C0	EX	PERF_CTL[5:3]
+  * 0x1D6	EX	PERF_CTL[5:0]
+  * 0x1D8	EX	PERF_CTL[5:0]
+  *
+- * (*) depending on the umask all FPU counters may be used
++ * (*)  depending on the umask all FPU counters may be used
++ * (**) only one unitmask enabled at a time
+  */
+ 
+ static struct event_constraint amd_f15_PMC0  = EVENT_CONSTRAINT(0, 0x01, 0);
+@@ -539,6 +542,12 @@ amd_get_event_constraints_f15h(struct cpu_hw_events *cpuc, struct perf_event *ev
+ 			return &amd_f15_PMC3;
+ 		case 0x02E:
+ 			return &amd_f15_PMC30;
++		case 0x031:
++			if (hweight_long(hwc->config & ARCH_PERFMON_EVENTSEL_UMASK) <= 1)
++				return &amd_f15_PMC20;
++			return &emptyconstraint;
++		case 0x1C0:
++			return &amd_f15_PMC53;
+ 		default:
+ 			return &amd_f15_PMC50;
+ 		}
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 4ea7678..7315488 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -1677,7 +1677,7 @@ static int nested_pf_handled(struct kvm_vcpu *vcpu)
+ 	struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+ 
+ 	/* TODO: also check PFEC_MATCH/MASK, not just EB.PF. */
+-	if (!(vmcs12->exception_bitmap & PF_VECTOR))
++	if (!(vmcs12->exception_bitmap & (1u << PF_VECTOR)))
+ 		return 0;
+ 
+ 	nested_vmx_vmexit(vcpu);
+@@ -3915,7 +3915,9 @@ static int vmx_vcpu_reset(struct kvm_vcpu *vcpu)
+ 		vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->vpid);
+ 
+ 	vmx->vcpu.arch.cr0 = X86_CR0_NW | X86_CR0_CD | X86_CR0_ET;
++	vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
+ 	vmx_set_cr0(&vmx->vcpu, kvm_read_cr0(vcpu)); /* enter rmode */
++	srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
+ 	vmx_set_cr4(&vmx->vcpu, 0);
+ 	vmx_set_efer(&vmx->vcpu, 0);
+ 	vmx_fpu_activate(&vmx->vcpu);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index e04cae1..4fc5323 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3579,6 +3579,9 @@ long kvm_arch_vm_ioctl(struct file *filp,
+ 		r = -EEXIST;
+ 		if (kvm->arch.vpic)
+ 			goto create_irqchip_unlock;
++		r = -EINVAL;
++		if (atomic_read(&kvm->online_vcpus))
++			goto create_irqchip_unlock;
+ 		r = -ENOMEM;
+ 		vpic = kvm_create_pic(kvm);
+ 		if (vpic) {
+@@ -6486,6 +6489,11 @@ void kvm_arch_check_processor_compat(void *rtn)
+ 	kvm_x86_ops->check_processor_compatibility(rtn);
+ }
+ 
++bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
++{
++	return irqchip_in_kernel(vcpu->kvm) == (vcpu->arch.apic != NULL);
++}
++
+ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+ {
+ 	struct page *page;
+diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
+index d99346e..4c262f6 100644
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -64,6 +64,10 @@ static int xen_register_pirq(u32 gsi, int gsi_override, int triggering,
+ 	int shareable = 0;
+ 	char *name;
+ 
++	irq = xen_irq_from_gsi(gsi);
++	if (irq > 0)
++		return irq;
++
+ 	if (set_pirq)
+ 		pirq = gsi;
+ 
+diff --git a/arch/x86/tools/.gitignore b/arch/x86/tools/.gitignore
+new file mode 100644
+index 0000000..be0ed06
+--- /dev/null
++++ b/arch/x86/tools/.gitignore
+@@ -0,0 +1 @@
++relocs
+diff --git a/arch/x86/tools/Makefile b/arch/x86/tools/Makefile
+index f820826..162a34a 100644
+--- a/arch/x86/tools/Makefile
++++ b/arch/x86/tools/Makefile
+@@ -29,3 +29,6 @@ HOSTCFLAGS_test_get_len.o := -Wall -I$(objtree)/arch/x86/lib/ -I$(srctree)/arch/
+ # Dependencies are also needed.
+ $(obj)/test_get_len.o: $(srctree)/arch/x86/lib/insn.c $(srctree)/arch/x86/lib/inat.c $(srctree)/arch/x86/include/asm/inat_types.h $(srctree)/arch/x86/include/asm/inat.h $(srctree)/arch/x86/include/asm/insn.h $(objtree)/arch/x86/lib/inat-tables.c
+ 
++HOST_EXTRACFLAGS += -I$(srctree)/tools/include
++hostprogs-y	+= relocs
++relocs: $(obj)/relocs
+diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
+new file mode 100644
+index 0000000..e529730
+--- /dev/null
++++ b/arch/x86/tools/relocs.c
+@@ -0,0 +1,820 @@
++#include <stdio.h>
++#include <stdarg.h>
++#include <stdlib.h>
++#include <stdint.h>
++#include <string.h>
++#include <errno.h>
++#include <unistd.h>
++#include <elf.h>
++#include <byteswap.h>
++#define USE_BSD
++#include <endian.h>
++#include <regex.h>
++
++static void die(char *fmt, ...);
++
++#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
++static Elf32_Ehdr ehdr;
++static unsigned long reloc_count, reloc_idx;
++static unsigned long *relocs;
++static unsigned long reloc16_count, reloc16_idx;
++static unsigned long *relocs16;
++
++struct section {
++	Elf32_Shdr     shdr;
++	struct section *link;
++	Elf32_Sym      *symtab;
++	Elf32_Rel      *reltab;
++	char           *strtab;
++};
++static struct section *secs;
++
++enum symtype {
++	S_ABS,
++	S_REL,
++	S_SEG,
++	S_LIN,
++	S_NSYMTYPES
++};
++
++static const char * const sym_regex_kernel[S_NSYMTYPES] = {
++/*
++ * Following symbols have been audited. There values are constant and do
++ * not change if bzImage is loaded at a different physical address than
++ * the address for which it has been compiled. Don't warn user about
++ * absolute relocations present w.r.t these symbols.
++ */
++	[S_ABS] =
++	"^(xen_irq_disable_direct_reloc$|"
++	"xen_save_fl_direct_reloc$|"
++	"VDSO|"
++	"__crc_)",
++
++/*
++ * These symbols are known to be relative, even if the linker marks them
++ * as absolute (typically defined outside any section in the linker script.)
++ */
++	[S_REL] =
++	"^(__init_(begin|end)|"
++	"__x86_cpu_dev_(start|end)|"
++	"(__parainstructions|__alt_instructions)(|_end)|"
++	"(__iommu_table|__apicdrivers|__smp_locks)(|_end)|"
++	"__(start|end)_pci_.*|"
++	"__(start|end)_builtin_fw|"
++	"__(start|stop)___ksymtab(|_gpl|_unused|_unused_gpl|_gpl_future)|"
++	"__(start|stop)___kcrctab(|_gpl|_unused|_unused_gpl|_gpl_future)|"
++	"__(start|stop)___param|"
++	"__(start|stop)___modver|"
++	"__(start|stop)___bug_table|"
++	"__tracedata_(start|end)|"
++	"__(start|stop)_notes|"
++	"__end_rodata|"
++	"__initramfs_start|"
++	"(jiffies|jiffies_64)|"
++	"_end)$"
++};
++
++
++static const char * const sym_regex_realmode[S_NSYMTYPES] = {
++/*
++ * These are 16-bit segment symbols when compiling 16-bit code.
++ */
++	[S_SEG] =
++	"^real_mode_seg$",
++
++/*
++ * These are offsets belonging to segments, as opposed to linear addresses,
++ * when compiling 16-bit code.
++ */
++	[S_LIN] =
++	"^pa_",
++};
++
++static const char * const *sym_regex;
++
++static regex_t sym_regex_c[S_NSYMTYPES];
++static int is_reloc(enum symtype type, const char *sym_name)
++{
++	return sym_regex[type] &&
++		!regexec(&sym_regex_c[type], sym_name, 0, NULL, 0);
++}
++
++static void regex_init(int use_real_mode)
++{
++        char errbuf[128];
++        int err;
++	int i;
++
++	if (use_real_mode)
++		sym_regex = sym_regex_realmode;
++	else
++		sym_regex = sym_regex_kernel;
++
++	for (i = 0; i < S_NSYMTYPES; i++) {
++		if (!sym_regex[i])
++			continue;
++
++		err = regcomp(&sym_regex_c[i], sym_regex[i],
++			      REG_EXTENDED|REG_NOSUB);
++
++		if (err) {
++			regerror(err, &sym_regex_c[i], errbuf, sizeof errbuf);
++			die("%s", errbuf);
++		}
++        }
++}
++
++static void die(char *fmt, ...)
++{
++	va_list ap;
++	va_start(ap, fmt);
++	vfprintf(stderr, fmt, ap);
++	va_end(ap);
++	exit(1);
++}
++
++static const char *sym_type(unsigned type)
++{
++	static const char *type_name[] = {
++#define SYM_TYPE(X) [X] = #X
++		SYM_TYPE(STT_NOTYPE),
++		SYM_TYPE(STT_OBJECT),
++		SYM_TYPE(STT_FUNC),
++		SYM_TYPE(STT_SECTION),
++		SYM_TYPE(STT_FILE),
++		SYM_TYPE(STT_COMMON),
++		SYM_TYPE(STT_TLS),
++#undef SYM_TYPE
++	};
++	const char *name = "unknown sym type name";
++	if (type < ARRAY_SIZE(type_name)) {
++		name = type_name[type];
++	}
++	return name;
++}
++
++static const char *sym_bind(unsigned bind)
++{
++	static const char *bind_name[] = {
++#define SYM_BIND(X) [X] = #X
++		SYM_BIND(STB_LOCAL),
++		SYM_BIND(STB_GLOBAL),
++		SYM_BIND(STB_WEAK),
++#undef SYM_BIND
++	};
++	const char *name = "unknown sym bind name";
++	if (bind < ARRAY_SIZE(bind_name)) {
++		name = bind_name[bind];
++	}
++	return name;
++}
++
++static const char *sym_visibility(unsigned visibility)
++{
++	static const char *visibility_name[] = {
++#define SYM_VISIBILITY(X) [X] = #X
++		SYM_VISIBILITY(STV_DEFAULT),
++		SYM_VISIBILITY(STV_INTERNAL),
++		SYM_VISIBILITY(STV_HIDDEN),
++		SYM_VISIBILITY(STV_PROTECTED),
++#undef SYM_VISIBILITY
++	};
++	const char *name = "unknown sym visibility name";
++	if (visibility < ARRAY_SIZE(visibility_name)) {
++		name = visibility_name[visibility];
++	}
++	return name;
++}
++
++static const char *rel_type(unsigned type)
++{
++	static const char *type_name[] = {
++#define REL_TYPE(X) [X] = #X
++		REL_TYPE(R_386_NONE),
++		REL_TYPE(R_386_32),
++		REL_TYPE(R_386_PC32),
++		REL_TYPE(R_386_GOT32),
++		REL_TYPE(R_386_PLT32),
++		REL_TYPE(R_386_COPY),
++		REL_TYPE(R_386_GLOB_DAT),
++		REL_TYPE(R_386_JMP_SLOT),
++		REL_TYPE(R_386_RELATIVE),
++		REL_TYPE(R_386_GOTOFF),
++		REL_TYPE(R_386_GOTPC),
++		REL_TYPE(R_386_8),
++		REL_TYPE(R_386_PC8),
++		REL_TYPE(R_386_16),
++		REL_TYPE(R_386_PC16),
++#undef REL_TYPE
++	};
++	const char *name = "unknown type rel type name";
++	if (type < ARRAY_SIZE(type_name) && type_name[type]) {
++		name = type_name[type];
++	}
++	return name;
++}
++
++static const char *sec_name(unsigned shndx)
++{
++	const char *sec_strtab;
++	const char *name;
++	sec_strtab = secs[ehdr.e_shstrndx].strtab;
++	name = "<noname>";
++	if (shndx < ehdr.e_shnum) {
++		name = sec_strtab + secs[shndx].shdr.sh_name;
++	}
++	else if (shndx == SHN_ABS) {
++		name = "ABSOLUTE";
++	}
++	else if (shndx == SHN_COMMON) {
++		name = "COMMON";
++	}
++	return name;
++}
++
++static const char *sym_name(const char *sym_strtab, Elf32_Sym *sym)
++{
++	const char *name;
++	name = "<noname>";
++	if (sym->st_name) {
++		name = sym_strtab + sym->st_name;
++	}
++	else {
++		name = sec_name(sym->st_shndx);
++	}
++	return name;
++}
++
++
++
++#if BYTE_ORDER == LITTLE_ENDIAN
++#define le16_to_cpu(val) (val)
++#define le32_to_cpu(val) (val)
++#endif
++#if BYTE_ORDER == BIG_ENDIAN
++#define le16_to_cpu(val) bswap_16(val)
++#define le32_to_cpu(val) bswap_32(val)
++#endif
++
++static uint16_t elf16_to_cpu(uint16_t val)
++{
++	return le16_to_cpu(val);
++}
++
++static uint32_t elf32_to_cpu(uint32_t val)
++{
++	return le32_to_cpu(val);
++}
++
++static void read_ehdr(FILE *fp)
++{
++	if (fread(&ehdr, sizeof(ehdr), 1, fp) != 1) {
++		die("Cannot read ELF header: %s\n",
++			strerror(errno));
++	}
++	if (memcmp(ehdr.e_ident, ELFMAG, SELFMAG) != 0) {
++		die("No ELF magic\n");
++	}
++	if (ehdr.e_ident[EI_CLASS] != ELFCLASS32) {
++		die("Not a 32 bit executable\n");
++	}
++	if (ehdr.e_ident[EI_DATA] != ELFDATA2LSB) {
++		die("Not a LSB ELF executable\n");
++	}
++	if (ehdr.e_ident[EI_VERSION] != EV_CURRENT) {
++		die("Unknown ELF version\n");
++	}
++	/* Convert the fields to native endian */
++	ehdr.e_type      = elf16_to_cpu(ehdr.e_type);
++	ehdr.e_machine   = elf16_to_cpu(ehdr.e_machine);
++	ehdr.e_version   = elf32_to_cpu(ehdr.e_version);
++	ehdr.e_entry     = elf32_to_cpu(ehdr.e_entry);
++	ehdr.e_phoff     = elf32_to_cpu(ehdr.e_phoff);
++	ehdr.e_shoff     = elf32_to_cpu(ehdr.e_shoff);
++	ehdr.e_flags     = elf32_to_cpu(ehdr.e_flags);
++	ehdr.e_ehsize    = elf16_to_cpu(ehdr.e_ehsize);
++	ehdr.e_phentsize = elf16_to_cpu(ehdr.e_phentsize);
++	ehdr.e_phnum     = elf16_to_cpu(ehdr.e_phnum);
++	ehdr.e_shentsize = elf16_to_cpu(ehdr.e_shentsize);
++	ehdr.e_shnum     = elf16_to_cpu(ehdr.e_shnum);
++	ehdr.e_shstrndx  = elf16_to_cpu(ehdr.e_shstrndx);
++
++	if ((ehdr.e_type != ET_EXEC) && (ehdr.e_type != ET_DYN)) {
++		die("Unsupported ELF header type\n");
++	}
++	if (ehdr.e_machine != EM_386) {
++		die("Not for x86\n");
++	}
++	if (ehdr.e_version != EV_CURRENT) {
++		die("Unknown ELF version\n");
++	}
++	if (ehdr.e_ehsize != sizeof(Elf32_Ehdr)) {
++		die("Bad Elf header size\n");
++	}
++	if (ehdr.e_phentsize != sizeof(Elf32_Phdr)) {
++		die("Bad program header entry\n");
++	}
++	if (ehdr.e_shentsize != sizeof(Elf32_Shdr)) {
++		die("Bad section header entry\n");
++	}
++	if (ehdr.e_shstrndx >= ehdr.e_shnum) {
++		die("String table index out of bounds\n");
++	}
++}
++
++static void read_shdrs(FILE *fp)
++{
++	int i;
++	Elf32_Shdr shdr;
++
++	secs = calloc(ehdr.e_shnum, sizeof(struct section));
++	if (!secs) {
++		die("Unable to allocate %d section headers\n",
++		    ehdr.e_shnum);
++	}
++	if (fseek(fp, ehdr.e_shoff, SEEK_SET) < 0) {
++		die("Seek to %d failed: %s\n",
++			ehdr.e_shoff, strerror(errno));
++	}
++	for (i = 0; i < ehdr.e_shnum; i++) {
++		struct section *sec = &secs[i];
++		if (fread(&shdr, sizeof shdr, 1, fp) != 1)
++			die("Cannot read ELF section headers %d/%d: %s\n",
++			    i, ehdr.e_shnum, strerror(errno));
++		sec->shdr.sh_name      = elf32_to_cpu(shdr.sh_name);
++		sec->shdr.sh_type      = elf32_to_cpu(shdr.sh_type);
++		sec->shdr.sh_flags     = elf32_to_cpu(shdr.sh_flags);
++		sec->shdr.sh_addr      = elf32_to_cpu(shdr.sh_addr);
++		sec->shdr.sh_offset    = elf32_to_cpu(shdr.sh_offset);
++		sec->shdr.sh_size      = elf32_to_cpu(shdr.sh_size);
++		sec->shdr.sh_link      = elf32_to_cpu(shdr.sh_link);
++		sec->shdr.sh_info      = elf32_to_cpu(shdr.sh_info);
++		sec->shdr.sh_addralign = elf32_to_cpu(shdr.sh_addralign);
++		sec->shdr.sh_entsize   = elf32_to_cpu(shdr.sh_entsize);
++		if (sec->shdr.sh_link < ehdr.e_shnum)
++			sec->link = &secs[sec->shdr.sh_link];
++	}
++
++}
++
++static void read_strtabs(FILE *fp)
++{
++	int i;
++	for (i = 0; i < ehdr.e_shnum; i++) {
++		struct section *sec = &secs[i];
++		if (sec->shdr.sh_type != SHT_STRTAB) {
++			continue;
++		}
++		sec->strtab = malloc(sec->shdr.sh_size);
++		if (!sec->strtab) {
++			die("malloc of %d bytes for strtab failed\n",
++				sec->shdr.sh_size);
++		}
++		if (fseek(fp, sec->shdr.sh_offset, SEEK_SET) < 0) {
++			die("Seek to %d failed: %s\n",
++				sec->shdr.sh_offset, strerror(errno));
++		}
++		if (fread(sec->strtab, 1, sec->shdr.sh_size, fp)
++		    != sec->shdr.sh_size) {
++			die("Cannot read symbol table: %s\n",
++				strerror(errno));
++		}
++	}
++}
++
++static void read_symtabs(FILE *fp)
++{
++	int i,j;
++	for (i = 0; i < ehdr.e_shnum; i++) {
++		struct section *sec = &secs[i];
++		if (sec->shdr.sh_type != SHT_SYMTAB) {
++			continue;
++		}
++		sec->symtab = malloc(sec->shdr.sh_size);
++		if (!sec->symtab) {
++			die("malloc of %d bytes for symtab failed\n",
++				sec->shdr.sh_size);
++		}
++		if (fseek(fp, sec->shdr.sh_offset, SEEK_SET) < 0) {
++			die("Seek to %d failed: %s\n",
++				sec->shdr.sh_offset, strerror(errno));
++		}
++		if (fread(sec->symtab, 1, sec->shdr.sh_size, fp)
++		    != sec->shdr.sh_size) {
++			die("Cannot read symbol table: %s\n",
++				strerror(errno));
++		}
++		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Sym); j++) {
++			Elf32_Sym *sym = &sec->symtab[j];
++			sym->st_name  = elf32_to_cpu(sym->st_name);
++			sym->st_value = elf32_to_cpu(sym->st_value);
++			sym->st_size  = elf32_to_cpu(sym->st_size);
++			sym->st_shndx = elf16_to_cpu(sym->st_shndx);
++		}
++	}
++}
++
++
++static void read_relocs(FILE *fp)
++{
++	int i,j;
++	for (i = 0; i < ehdr.e_shnum; i++) {
++		struct section *sec = &secs[i];
++		if (sec->shdr.sh_type != SHT_REL) {
++			continue;
++		}
++		sec->reltab = malloc(sec->shdr.sh_size);
++		if (!sec->reltab) {
++			die("malloc of %d bytes for relocs failed\n",
++				sec->shdr.sh_size);
++		}
++		if (fseek(fp, sec->shdr.sh_offset, SEEK_SET) < 0) {
++			die("Seek to %d failed: %s\n",
++				sec->shdr.sh_offset, strerror(errno));
++		}
++		if (fread(sec->reltab, 1, sec->shdr.sh_size, fp)
++		    != sec->shdr.sh_size) {
++			die("Cannot read symbol table: %s\n",
++				strerror(errno));
++		}
++		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
++			Elf32_Rel *rel = &sec->reltab[j];
++			rel->r_offset = elf32_to_cpu(rel->r_offset);
++			rel->r_info   = elf32_to_cpu(rel->r_info);
++		}
++	}
++}
++
++
++static void print_absolute_symbols(void)
++{
++	int i;
++	printf("Absolute symbols\n");
++	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
++	for (i = 0; i < ehdr.e_shnum; i++) {
++		struct section *sec = &secs[i];
++		char *sym_strtab;
++		int j;
++
++		if (sec->shdr.sh_type != SHT_SYMTAB) {
++			continue;
++		}
++		sym_strtab = sec->link->strtab;
++		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Sym); j++) {
++			Elf32_Sym *sym;
++			const char *name;
++			sym = &sec->symtab[j];
++			name = sym_name(sym_strtab, sym);
++			if (sym->st_shndx != SHN_ABS) {
++				continue;
++			}
++			printf("%5d %08x %5d %10s %10s %12s %s\n",
++				j, sym->st_value, sym->st_size,
++				sym_type(ELF32_ST_TYPE(sym->st_info)),
++				sym_bind(ELF32_ST_BIND(sym->st_info)),
++				sym_visibility(ELF32_ST_VISIBILITY(sym->st_other)),
++				name);
++		}
++	}
++	printf("\n");
++}
++
++static void print_absolute_relocs(void)
++{
++	int i, printed = 0;
++
++	for (i = 0; i < ehdr.e_shnum; i++) {
++		struct section *sec = &secs[i];
++		struct section *sec_applies, *sec_symtab;
++		char *sym_strtab;
++		Elf32_Sym *sh_symtab;
++		int j;
++		if (sec->shdr.sh_type != SHT_REL) {
++			continue;
++		}
++		sec_symtab  = sec->link;
++		sec_applies = &secs[sec->shdr.sh_info];
++		if (!(sec_applies->shdr.sh_flags & SHF_ALLOC)) {
++			continue;
++		}
++		sh_symtab  = sec_symtab->symtab;
++		sym_strtab = sec_symtab->link->strtab;
++		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
++			Elf32_Rel *rel;
++			Elf32_Sym *sym;
++			const char *name;
++			rel = &sec->reltab[j];
++			sym = &sh_symtab[ELF32_R_SYM(rel->r_info)];
++			name = sym_name(sym_strtab, sym);
++			if (sym->st_shndx != SHN_ABS) {
++				continue;
++			}
++
++			/* Absolute symbols are not relocated if bzImage is
++			 * loaded at a non-compiled address. Display a warning
++			 * to user at compile time about the absolute
++			 * relocations present.
++			 *
++			 * User need to audit the code to make sure
++			 * some symbols which should have been section
++			 * relative have not become absolute because of some
++			 * linker optimization or wrong programming usage.
++			 *
++			 * Before warning check if this absolute symbol
++			 * relocation is harmless.
++			 */
++			if (is_reloc(S_ABS, name) || is_reloc(S_REL, name))
++				continue;
++
++			if (!printed) {
++				printf("WARNING: Absolute relocations"
++					" present\n");
++				printf("Offset     Info     Type     Sym.Value "
++					"Sym.Name\n");
++				printed = 1;
++			}
++
++			printf("%08x %08x %10s %08x  %s\n",
++				rel->r_offset,
++				rel->r_info,
++				rel_type(ELF32_R_TYPE(rel->r_info)),
++				sym->st_value,
++				name);
++		}
++	}
++
++	if (printed)
++		printf("\n");
++}
++
++static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym),
++			int use_real_mode)
++{
++	int i;
++	/* Walk through the relocations */
++	for (i = 0; i < ehdr.e_shnum; i++) {
++		char *sym_strtab;
++		Elf32_Sym *sh_symtab;
++		struct section *sec_applies, *sec_symtab;
++		int j;
++		struct section *sec = &secs[i];
++
++		if (sec->shdr.sh_type != SHT_REL) {
++			continue;
++		}
++		sec_symtab  = sec->link;
++		sec_applies = &secs[sec->shdr.sh_info];
++		if (!(sec_applies->shdr.sh_flags & SHF_ALLOC)) {
++			continue;
++		}
++		sh_symtab = sec_symtab->symtab;
++		sym_strtab = sec_symtab->link->strtab;
++		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
++			Elf32_Rel *rel;
++			Elf32_Sym *sym;
++			unsigned r_type;
++			const char *symname;
++			int shn_abs;
++
++			rel = &sec->reltab[j];
++			sym = &sh_symtab[ELF32_R_SYM(rel->r_info)];
++			r_type = ELF32_R_TYPE(rel->r_info);
++
++			shn_abs = sym->st_shndx == SHN_ABS;
++
++			switch (r_type) {
++			case R_386_NONE:
++			case R_386_PC32:
++			case R_386_PC16:
++			case R_386_PC8:
++				/*
++				 * NONE can be ignored and and PC relative
++				 * relocations don't need to be adjusted.
++				 */
++				break;
++
++			case R_386_16:
++				symname = sym_name(sym_strtab, sym);
++				if (!use_real_mode)
++					goto bad;
++				if (shn_abs) {
++					if (is_reloc(S_ABS, symname))
++						break;
++					else if (!is_reloc(S_SEG, symname))
++						goto bad;
++				} else {
++					if (is_reloc(S_LIN, symname))
++						goto bad;
++					else
++						break;
++				}
++				visit(rel, sym);
++				break;
++
++			case R_386_32:
++				symname = sym_name(sym_strtab, sym);
++				if (shn_abs) {
++					if (is_reloc(S_ABS, symname))
++						break;
++					else if (!is_reloc(S_REL, symname))
++						goto bad;
++				} else {
++					if (use_real_mode &&
++					    !is_reloc(S_LIN, symname))
++						break;
++				}
++				visit(rel, sym);
++				break;
++			default:
++				die("Unsupported relocation type: %s (%d)\n",
++				    rel_type(r_type), r_type);
++				break;
++			bad:
++				symname = sym_name(sym_strtab, sym);
++				die("Invalid %s %s relocation: %s\n",
++				    shn_abs ? "absolute" : "relative",
++				    rel_type(r_type), symname);
++			}
++		}
++	}
++}
++
++static void count_reloc(Elf32_Rel *rel, Elf32_Sym *sym)
++{
++	if (ELF32_R_TYPE(rel->r_info) == R_386_16)
++		reloc16_count++;
++	else
++		reloc_count++;
++}
++
++static void collect_reloc(Elf32_Rel *rel, Elf32_Sym *sym)
++{
++	/* Remember the address that needs to be adjusted. */
++	if (ELF32_R_TYPE(rel->r_info) == R_386_16)
++		relocs16[reloc16_idx++] = rel->r_offset;
++	else
++		relocs[reloc_idx++] = rel->r_offset;
++}
++
++static int cmp_relocs(const void *va, const void *vb)
++{
++	const unsigned long *a, *b;
++	a = va; b = vb;
++	return (*a == *b)? 0 : (*a > *b)? 1 : -1;
++}
++
++static int write32(unsigned int v, FILE *f)
++{
++	unsigned char buf[4];
++
++	buf[0] = (v >>  0) & 0xff;
++	buf[1] = (v >>  8) & 0xff;
++	buf[2] = (v >> 16) & 0xff;
++	buf[3] = (v >> 24) & 0xff;
++	return fwrite(buf, 1, 4, f) == 4 ? 0 : -1;
++}
++
++static void emit_relocs(int as_text, int use_real_mode)
++{
++	int i;
++	/* Count how many relocations I have and allocate space for them. */
++	reloc_count = 0;
++	walk_relocs(count_reloc, use_real_mode);
++	relocs = malloc(reloc_count * sizeof(relocs[0]));
++	if (!relocs) {
++		die("malloc of %d entries for relocs failed\n",
++			reloc_count);
++	}
++
++	relocs16 = malloc(reloc16_count * sizeof(relocs[0]));
++	if (!relocs16) {
++		die("malloc of %d entries for relocs16 failed\n",
++			reloc16_count);
++	}
++	/* Collect up the relocations */
++	reloc_idx = 0;
++	walk_relocs(collect_reloc, use_real_mode);
++
++	if (reloc16_count && !use_real_mode)
++		die("Segment relocations found but --realmode not specified\n");
++
++	/* Order the relocations for more efficient processing */
++	qsort(relocs, reloc_count, sizeof(relocs[0]), cmp_relocs);
++	qsort(relocs16, reloc16_count, sizeof(relocs16[0]), cmp_relocs);
++
++	/* Print the relocations */
++	if (as_text) {
++		/* Print the relocations in a form suitable that
++		 * gas will like.
++		 */
++		printf(".section \".data.reloc\",\"a\"\n");
++		printf(".balign 4\n");
++		if (use_real_mode) {
++			printf("\t.long %lu\n", reloc16_count);
++			for (i = 0; i < reloc16_count; i++)
++				printf("\t.long 0x%08lx\n", relocs16[i]);
++			printf("\t.long %lu\n", reloc_count);
++			for (i = 0; i < reloc_count; i++) {
++				printf("\t.long 0x%08lx\n", relocs[i]);
++			}
++		} else {
++			/* Print a stop */
++			printf("\t.long 0x%08lx\n", (unsigned long)0);
++			for (i = 0; i < reloc_count; i++) {
++				printf("\t.long 0x%08lx\n", relocs[i]);
++			}
++		}
++
++		printf("\n");
++	}
++	else {
++		if (use_real_mode) {
++			write32(reloc16_count, stdout);
++			for (i = 0; i < reloc16_count; i++)
++				write32(relocs16[i], stdout);
++			write32(reloc_count, stdout);
++
++			/* Now print each relocation */
++			for (i = 0; i < reloc_count; i++)
++				write32(relocs[i], stdout);
++		} else {
++			/* Print a stop */
++			write32(0, stdout);
++
++			/* Now print each relocation */
++			for (i = 0; i < reloc_count; i++) {
++				write32(relocs[i], stdout);
++			}
++		}
++	}
++}
++
++static void usage(void)
++{
++	die("relocs [--abs-syms|--abs-relocs|--text|--realmode] vmlinux\n");
++}
++
++int main(int argc, char **argv)
++{
++	int show_absolute_syms, show_absolute_relocs;
++	int as_text, use_real_mode;
++	const char *fname;
++	FILE *fp;
++	int i;
++
++	show_absolute_syms = 0;
++	show_absolute_relocs = 0;
++	as_text = 0;
++	use_real_mode = 0;
++	fname = NULL;
++	for (i = 1; i < argc; i++) {
++		char *arg = argv[i];
++		if (*arg == '-') {
++			if (strcmp(arg, "--abs-syms") == 0) {
++				show_absolute_syms = 1;
++				continue;
++			}
++			if (strcmp(arg, "--abs-relocs") == 0) {
++				show_absolute_relocs = 1;
++				continue;
++			}
++			if (strcmp(arg, "--text") == 0) {
++				as_text = 1;
++				continue;
++			}
++			if (strcmp(arg, "--realmode") == 0) {
++				use_real_mode = 1;
++				continue;
++			}
++		}
++		else if (!fname) {
++			fname = arg;
++			continue;
++		}
++		usage();
++	}
++	if (!fname) {
++		usage();
++	}
++	regex_init(use_real_mode);
++	fp = fopen(fname, "r");
++	if (!fp) {
++		die("Cannot open %s: %s\n",
++			fname, strerror(errno));
++	}
++	read_ehdr(fp);
++	read_shdrs(fp);
++	read_strtabs(fp);
++	read_symtabs(fp);
++	read_relocs(fp);
++	if (show_absolute_syms) {
++		print_absolute_symbols();
++		return 0;
++	}
++	if (show_absolute_relocs) {
++		print_absolute_relocs();
++		return 0;
++	}
++	emit_relocs(as_text, use_real_mode);
++	return 0;
++}
+diff --git a/block/genhd.c b/block/genhd.c
+index 997afd6..4927476 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -744,7 +744,7 @@ void __init printk_all_partitions(void)
+ 		struct hd_struct *part;
+ 		char name_buf[BDEVNAME_SIZE];
+ 		char devt_buf[BDEVT_SIZE];
+-		u8 uuid[PARTITION_META_INFO_UUIDLTH * 2 + 1];
++		char uuid_buf[PARTITION_META_INFO_UUIDLTH * 2 + 5];
+ 
+ 		/*
+ 		 * Don't show empty devices or things that have been
+@@ -763,14 +763,16 @@ void __init printk_all_partitions(void)
+ 		while ((part = disk_part_iter_next(&piter))) {
+ 			bool is_part0 = part == &disk->part0;
+ 
+-			uuid[0] = 0;
++			uuid_buf[0] = '\0';
+ 			if (part->info)
+-				part_unpack_uuid(part->info->uuid, uuid);
++				snprintf(uuid_buf, sizeof(uuid_buf), "%pU",
++					 part->info->uuid);
+ 
+ 			printk("%s%s %10llu %s %s", is_part0 ? "" : "  ",
+ 			       bdevt_str(part_devt(part), devt_buf),
+ 			       (unsigned long long)part->nr_sects >> 1,
+-			       disk_name(disk, part->partno, name_buf), uuid);
++			       disk_name(disk, part->partno, name_buf),
++			       uuid_buf);
+ 			if (is_part0) {
+ 				if (disk->driverfs_dev != NULL &&
+ 				    disk->driverfs_dev->driver != NULL)
+diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
+index 0a7ed69..ca191ff 100644
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -438,6 +438,14 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
+ 	},
+ 	{
+ 	.callback = init_nvs_nosave,
++	.ident = "Sony Vaio VPCCW29FX",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
++		DMI_MATCH(DMI_PRODUCT_NAME, "VPCCW29FX"),
++		},
++	},
++	{
++	.callback = init_nvs_nosave,
+ 	.ident = "Averatec AV1020-ED2",
+ 	.matches = {
+ 		DMI_MATCH(DMI_SYS_VENDOR, "AVERATEC"),
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index cf26222..fb65915 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -384,6 +384,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	  .driver_data = board_ahci_yes_fbs },			/* 88se9128 */
+ 	{ PCI_DEVICE(0x1b4b, 0x9125),
+ 	  .driver_data = board_ahci_yes_fbs },			/* 88se9125 */
++	{ PCI_DEVICE(0x1b4b, 0x917a),
++	  .driver_data = board_ahci_yes_fbs },			/* 88se9172 */
+ 	{ PCI_DEVICE(0x1b4b, 0x91a3),
+ 	  .driver_data = board_ahci_yes_fbs },
+ 
+diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
+index 5cd04b6..edcffd6 100644
+--- a/drivers/gpio/gpio-mpc8xxx.c
++++ b/drivers/gpio/gpio-mpc8xxx.c
+@@ -163,7 +163,8 @@ static void mpc8xxx_gpio_irq_cascade(unsigned int irq, struct irq_desc *desc)
+ 	if (mask)
+ 		generic_handle_irq(irq_linear_revmap(mpc8xxx_gc->irq,
+ 						     32 - ffs(mask)));
+-	chip->irq_eoi(&desc->irq_data);
++	if (chip->irq_eoi)
++		chip->irq_eoi(&desc->irq_data);
+ }
+ 
+ static void mpc8xxx_irq_unmask(struct irq_data *d)
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index d47a53b..d3820c2 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -424,14 +424,11 @@ static void gen6_pm_rps_work(struct work_struct *work)
+ 	mutex_unlock(&dev_priv->dev->struct_mutex);
+ }
+ 
+-static void pch_irq_handler(struct drm_device *dev)
++static void pch_irq_handler(struct drm_device *dev, u32 pch_iir)
+ {
+ 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+-	u32 pch_iir;
+ 	int pipe;
+ 
+-	pch_iir = I915_READ(SDEIIR);
+-
+ 	if (pch_iir & SDE_AUDIO_POWER_MASK)
+ 		DRM_DEBUG_DRIVER("PCH audio power change on port %d\n",
+ 				 (pch_iir & SDE_AUDIO_POWER_MASK) >>
+@@ -529,7 +526,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
+ 	if (de_iir & DE_PCH_EVENT_IVB) {
+ 		if (pch_iir & SDE_HOTPLUG_MASK_CPT)
+ 			queue_work(dev_priv->wq, &dev_priv->hotplug_work);
+-		pch_irq_handler(dev);
++		pch_irq_handler(dev, pch_iir);
+ 	}
+ 
+ 	if (pm_iir & GEN6_PM_DEFERRED_EVENTS) {
+@@ -629,7 +626,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
+ 	if (de_iir & DE_PCH_EVENT) {
+ 		if (pch_iir & hotplug_mask)
+ 			queue_work(dev_priv->wq, &dev_priv->hotplug_work);
+-		pch_irq_handler(dev);
++		pch_irq_handler(dev, pch_iir);
+ 	}
+ 
+ 	if (de_iir & DE_PCU_EVENT) {
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index cbe5a88..a1d53b6 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -570,6 +570,21 @@
+ 
+ #define GEN6_BSD_RNCID			0x12198
+ 
++#define GEN7_FF_THREAD_MODE		0x20a0
++#define   GEN7_FF_SCHED_MASK		0x0077070
++#define   GEN7_FF_TS_SCHED_HS1		(0x5<<16)
++#define   GEN7_FF_TS_SCHED_HS0		(0x3<<16)
++#define   GEN7_FF_TS_SCHED_LOAD_BALANCE	(0x1<<16)
++#define   GEN7_FF_TS_SCHED_HW		(0x0<<16) /* Default */
++#define   GEN7_FF_VS_SCHED_HS1		(0x5<<12)
++#define   GEN7_FF_VS_SCHED_HS0		(0x3<<12)
++#define   GEN7_FF_VS_SCHED_LOAD_BALANCE	(0x1<<12) /* Default */
++#define   GEN7_FF_VS_SCHED_HW		(0x0<<12)
++#define   GEN7_FF_DS_SCHED_HS1		(0x5<<4)
++#define   GEN7_FF_DS_SCHED_HS0		(0x3<<4)
++#define   GEN7_FF_DS_SCHED_LOAD_BALANCE	(0x1<<4)  /* Default */
++#define   GEN7_FF_DS_SCHED_HW		(0x0<<4)
++
+ /*
+  * Framebuffer compression (915+ only)
+  */
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 390768f..3ff980d 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -7280,10 +7280,11 @@ static void intel_sanitize_modesetting(struct drm_device *dev,
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 	u32 reg, val;
++	int i;
+ 
+ 	/* Clear any frame start delays used for debugging left by the BIOS */
+-	for_each_pipe(pipe) {
+-		reg = PIPECONF(pipe);
++	for_each_pipe(i) {
++		reg = PIPECONF(i);
+ 		I915_WRITE(reg, I915_READ(reg) & ~PIPECONF_FRAME_START_DELAY_MASK);
+ 	}
+ 
+@@ -8245,6 +8246,18 @@ static void gen6_init_clock_gating(struct drm_device *dev)
+ 	}
+ }
+ 
++static void gen7_setup_fixed_func_scheduler(struct drm_i915_private *dev_priv)
++{
++	uint32_t reg = I915_READ(GEN7_FF_THREAD_MODE);
++
++	reg &= ~GEN7_FF_SCHED_MASK;
++	reg |= GEN7_FF_TS_SCHED_HW;
++	reg |= GEN7_FF_VS_SCHED_HW;
++	reg |= GEN7_FF_DS_SCHED_HW;
++
++	I915_WRITE(GEN7_FF_THREAD_MODE, reg);
++}
++
+ static void ivybridge_init_clock_gating(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -8285,6 +8298,8 @@ static void ivybridge_init_clock_gating(struct drm_device *dev)
+ 			   DISPPLANE_TRICKLE_FEED_DISABLE);
+ 		intel_flush_display_plane(dev_priv, pipe);
+ 	}
++
++	gen7_setup_fixed_func_scheduler(dev_priv);
+ }
+ 
+ static void g4x_init_clock_gating(struct drm_device *dev)
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
+index 7cc37e6..d5af089 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
+@@ -1024,7 +1024,7 @@ nouveau_ttm_fault_reserve_notify(struct ttm_buffer_object *bo)
+ 
+ 	nvbo->placement.fpfn = 0;
+ 	nvbo->placement.lpfn = dev_priv->fb_mappable_pages;
+-	nouveau_bo_placement_set(nvbo, TTM_PL_VRAM, 0);
++	nouveau_bo_placement_set(nvbo, TTM_PL_FLAG_VRAM, 0);
+ 	return nouveau_bo_validate(nvbo, false, true, false);
+ }
+ 
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index 38b12e4..2eac8c5 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -26,6 +26,7 @@
+ #include <linux/hid.h>
+ #include <linux/module.h>
+ #include <linux/usb.h>
++#include <asm/unaligned.h>
+ #include "usbhid/usbhid.h"
+ #include "hid-ids.h"
+ #include "hid-logitech-dj.h"
+@@ -265,8 +266,8 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
+ 		goto dj_device_allocate_fail;
+ 	}
+ 
+-	dj_dev->reports_supported = le32_to_cpu(
+-		dj_report->report_params[DEVICE_PAIRED_RF_REPORT_TYPE]);
++	dj_dev->reports_supported = get_unaligned_le32(
++		dj_report->report_params + DEVICE_PAIRED_RF_REPORT_TYPE);
+ 	dj_dev->hdev = dj_hiddev;
+ 	dj_dev->dj_receiver_dev = djrcv_dev;
+ 	dj_dev->device_index = dj_report->device_index;
+diff --git a/drivers/hid/hid-wiimote.c b/drivers/hid/hid-wiimote.c
+index 76739c0..bfa9a27 100644
+--- a/drivers/hid/hid-wiimote.c
++++ b/drivers/hid/hid-wiimote.c
+@@ -829,7 +829,7 @@ static void __ir_to_input(struct wiimote_data *wdata, const __u8 *ir,
+ 
+ 	/*
+ 	 * Basic IR data is encoded into 3 bytes. The first two bytes are the
+-	 * upper 8 bit of the X/Y data, the 3rd byte contains the lower 2 bits
++	 * lower 8 bit of the X/Y data, the 3rd byte contains the upper 2 bits
+ 	 * of both.
+ 	 * If data is packed, then the 3rd byte is put first and slightly
+ 	 * reordered. This allows to interleave packed and non-packed data to
+@@ -838,17 +838,11 @@ static void __ir_to_input(struct wiimote_data *wdata, const __u8 *ir,
+ 	 */
+ 
+ 	if (packed) {
+-		x = ir[1] << 2;
+-		y = ir[2] << 2;
+-
+-		x |= ir[0] & 0x3;
+-		y |= (ir[0] >> 2) & 0x3;
++		x = ir[1] | ((ir[0] & 0x03) << 8);
++		y = ir[2] | ((ir[0] & 0x0c) << 6);
+ 	} else {
+-		x = ir[0] << 2;
+-		y = ir[1] << 2;
+-
+-		x |= (ir[2] >> 4) & 0x3;
+-		y |= (ir[2] >> 6) & 0x3;
++		x = ir[0] | ((ir[2] & 0x30) << 4);
++		y = ir[1] | ((ir[2] & 0xc0) << 2);
+ 	}
+ 
+ 	input_report_abs(wdata->ir, xid, x);
+diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
+index a76d85f..79b4bcb 100644
+--- a/drivers/i2c/busses/i2c-davinci.c
++++ b/drivers/i2c/busses/i2c-davinci.c
+@@ -755,7 +755,7 @@ static int davinci_i2c_remove(struct platform_device *pdev)
+ 	dev->clk = NULL;
+ 
+ 	davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, 0);
+-	free_irq(IRQ_I2C, dev);
++	free_irq(dev->irq, dev);
+ 	iounmap(dev->base);
+ 	kfree(dev);
+ 
+diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
+index 730215e..2cda65bf 100644
+--- a/drivers/i2c/busses/i2c-eg20t.c
++++ b/drivers/i2c/busses/i2c-eg20t.c
+@@ -315,7 +315,7 @@ static s32 pch_i2c_wait_for_xfer_complete(struct i2c_algo_pch_data *adap)
+ {
+ 	long ret;
+ 	ret = wait_event_timeout(pch_event,
+-			(adap->pch_event_flag != 0), msecs_to_jiffies(50));
++			(adap->pch_event_flag != 0), msecs_to_jiffies(1000));
+ 
+ 	if (ret == 0) {
+ 		pch_err(adap, "timeout: %x\n", adap->pch_event_flag);
+diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
+index 46b6500..3d7885a 100644
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -401,8 +401,6 @@ static irqreturn_t tegra_i2c_isr(int irq, void *dev_id)
+ 			disable_irq_nosync(i2c_dev->irq);
+ 			i2c_dev->irq_disabled = 1;
+ 		}
+-
+-		complete(&i2c_dev->msg_complete);
+ 		goto err;
+ 	}
+ 
+@@ -411,7 +409,6 @@ static irqreturn_t tegra_i2c_isr(int irq, void *dev_id)
+ 			i2c_dev->msg_err |= I2C_ERR_NO_ACK;
+ 		if (status & I2C_INT_ARBITRATION_LOST)
+ 			i2c_dev->msg_err |= I2C_ERR_ARBITRATION_LOST;
+-		complete(&i2c_dev->msg_complete);
+ 		goto err;
+ 	}
+ 
+@@ -429,14 +426,14 @@ static irqreturn_t tegra_i2c_isr(int irq, void *dev_id)
+ 			tegra_i2c_mask_irq(i2c_dev, I2C_INT_TX_FIFO_DATA_REQ);
+ 	}
+ 
++	i2c_writel(i2c_dev, status, I2C_INT_STATUS);
++	if (i2c_dev->is_dvc)
++		dvc_writel(i2c_dev, DVC_STATUS_I2C_DONE_INTR, DVC_STATUS);
++
+ 	if (status & I2C_INT_PACKET_XFER_COMPLETE) {
+ 		BUG_ON(i2c_dev->msg_buf_remaining);
+ 		complete(&i2c_dev->msg_complete);
+ 	}
+-
+-	i2c_writel(i2c_dev, status, I2C_INT_STATUS);
+-	if (i2c_dev->is_dvc)
+-		dvc_writel(i2c_dev, DVC_STATUS_I2C_DONE_INTR, DVC_STATUS);
+ 	return IRQ_HANDLED;
+ err:
+ 	/* An error occurred, mask all interrupts */
+@@ -446,6 +443,8 @@ err:
+ 	i2c_writel(i2c_dev, status, I2C_INT_STATUS);
+ 	if (i2c_dev->is_dvc)
+ 		dvc_writel(i2c_dev, DVC_STATUS_I2C_DONE_INTR, DVC_STATUS);
++
++	complete(&i2c_dev->msg_complete);
+ 	return IRQ_HANDLED;
+ }
+ 
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index 71f0c0f..a841123 100644
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -269,7 +269,7 @@ void ib_umem_release(struct ib_umem *umem)
+ 	} else
+ 		down_write(&mm->mmap_sem);
+ 
+-	current->mm->locked_vm -= diff;
++	current->mm->pinned_vm -= diff;
+ 	up_write(&mm->mmap_sem);
+ 	mmput(mm);
+ 	kfree(umem);
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 0747004..2e6a538 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2714,6 +2714,12 @@ static int peer_abort_intr(struct c4iw_dev *dev, struct sk_buff *skb)
+ 	unsigned int tid = GET_TID(req);
+ 
+ 	ep = lookup_tid(t, tid);
++	if (!ep) {
++		printk(KERN_WARNING MOD
++		       "Abort on non-existent endpoint, tid %d\n", tid);
++		kfree_skb(skb);
++		return 0;
++	}
+ 	if (is_neg_adv_abort(req->status)) {
+ 		PDBG("%s neg_adv_abort ep %p tid %u\n", __func__, ep,
+ 		     ep->hwtid);
+@@ -2725,11 +2731,8 @@ static int peer_abort_intr(struct c4iw_dev *dev, struct sk_buff *skb)
+ 
+ 	/*
+ 	 * Wake up any threads in rdma_init() or rdma_fini().
+-	 * However, this is not needed if com state is just
+-	 * MPA_REQ_SENT
+ 	 */
+-	if (ep->com.state != MPA_REQ_SENT)
+-		c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
++	c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
+ 	sched(dev, skb);
+ 	return 0;
+ }
+diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
+index 2ee47d0..f00c70e 100644
+--- a/drivers/input/tablet/wacom_wac.c
++++ b/drivers/input/tablet/wacom_wac.c
+@@ -843,12 +843,7 @@ static int wacom_bpt_pen(struct wacom_wac *wacom)
+ 	unsigned char *data = wacom->data;
+ 	int prox = 0, x = 0, y = 0, p = 0, d = 0, pen = 0, btn1 = 0, btn2 = 0;
+ 
+-	/*
+-	 * Similar to Graphire protocol, data[1] & 0x20 is proximity and
+-	 * data[1] & 0x18 is tool ID.  0x30 is safety check to ignore
+-	 * 2 unused tool ID's.
+-	 */
+-	prox = (data[1] & 0x30) == 0x30;
++	prox = (data[1] & 0x20) == 0x20;
+ 
+ 	/*
+ 	 * All reports shared between PEN and RUBBER tool must be
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 35c1e17..97b2e21 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -1056,8 +1056,8 @@ static const char *intr_remap_fault_reasons[] =
+ 
+ const char *dmar_get_fault_reason(u8 fault_reason, int *fault_type)
+ {
+-	if (fault_reason >= 0x20 && (fault_reason <= 0x20 +
+-				     ARRAY_SIZE(intr_remap_fault_reasons))) {
++	if (fault_reason >= 0x20 && (fault_reason - 0x20 <
++					ARRAY_SIZE(intr_remap_fault_reasons))) {
+ 		*fault_type = INTR_REMAP;
+ 		return intr_remap_fault_reasons[fault_reason - 0x20];
+ 	} else if (fault_reason < ARRAY_SIZE(dma_remap_fault_reasons)) {
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index bdc447f..ccf347f 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -2267,12 +2267,6 @@ static int domain_add_dev_info(struct dmar_domain *domain,
+ 	if (!info)
+ 		return -ENOMEM;
+ 
+-	ret = domain_context_mapping(domain, pdev, translation);
+-	if (ret) {
+-		free_devinfo_mem(info);
+-		return ret;
+-	}
+-
+ 	info->segment = pci_domain_nr(pdev->bus);
+ 	info->bus = pdev->bus->number;
+ 	info->devfn = pdev->devfn;
+@@ -2285,6 +2279,17 @@ static int domain_add_dev_info(struct dmar_domain *domain,
+ 	pdev->dev.archdata.iommu = info;
+ 	spin_unlock_irqrestore(&device_domain_lock, flags);
+ 
++	ret = domain_context_mapping(domain, pdev, translation);
++	if (ret) {
++		spin_lock_irqsave(&device_domain_lock, flags);
++		list_del(&info->link);
++		list_del(&info->global);
++		pdev->dev.archdata.iommu = NULL;
++		spin_unlock_irqrestore(&device_domain_lock, flags);
++		free_devinfo_mem(info);
++		return ret;
++	}
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
+index 6d5ceee..fd17bb3 100644
+--- a/drivers/isdn/gigaset/capi.c
++++ b/drivers/isdn/gigaset/capi.c
+@@ -14,6 +14,7 @@
+ #include "gigaset.h"
+ #include <linux/proc_fs.h>
+ #include <linux/seq_file.h>
++#include <linux/ratelimit.h>
+ #include <linux/isdn/capilli.h>
+ #include <linux/isdn/capicmd.h>
+ #include <linux/isdn/capiutil.h>
+@@ -223,10 +224,14 @@ get_appl(struct gigaset_capi_ctr *iif, u16 appl)
+ static inline void dump_cmsg(enum debuglevel level, const char *tag, _cmsg *p)
+ {
+ #ifdef CONFIG_GIGASET_DEBUG
++	/* dump at most 20 messages in 20 secs */
++	static DEFINE_RATELIMIT_STATE(msg_dump_ratelimit, 20 * HZ, 20);
+ 	_cdebbuf *cdb;
+ 
+ 	if (!(gigaset_debuglevel & level))
+ 		return;
++	if (!___ratelimit(&msg_dump_ratelimit, tag))
++		return;
+ 
+ 	cdb = capi_cmsg2str(p);
+ 	if (cdb) {
+@@ -1882,6 +1887,9 @@ static void do_disconnect_req(struct gigaset_capi_ctr *iif,
+ 
+ 	/* check for active logical connection */
+ 	if (bcs->apconnstate >= APCONN_ACTIVE) {
++		/* clear it */
++		bcs->apconnstate = APCONN_SETUP;
++
+ 		/*
+ 		 * emit DISCONNECT_B3_IND with cause 0x3301
+ 		 * use separate cmsg structure, as the content of iif->acmsg
+@@ -1906,6 +1914,7 @@ static void do_disconnect_req(struct gigaset_capi_ctr *iif,
+ 		}
+ 		capi_cmsg2message(b3cmsg,
+ 			__skb_put(b3skb, CAPI_DISCONNECT_B3_IND_BASELEN));
++		dump_cmsg(DEBUG_CMD, __func__, b3cmsg);
+ 		kfree(b3cmsg);
+ 		capi_ctr_handle_message(&iif->ctr, ap->id, b3skb);
+ 	}
+@@ -2059,12 +2068,6 @@ static void do_reset_b3_req(struct gigaset_capi_ctr *iif,
+ }
+ 
+ /*
+- * dump unsupported/ignored messages at most twice per minute,
+- * some apps send those very frequently
+- */
+-static unsigned long ignored_msg_dump_time;
+-
+-/*
+  * unsupported CAPI message handler
+  */
+ static void do_unsupported(struct gigaset_capi_ctr *iif,
+@@ -2073,8 +2076,7 @@ static void do_unsupported(struct gigaset_capi_ctr *iif,
+ {
+ 	/* decode message */
+ 	capi_message2cmsg(&iif->acmsg, skb->data);
+-	if (printk_timed_ratelimit(&ignored_msg_dump_time, 30 * 1000))
+-		dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
++	dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
+ 	send_conf(iif, ap, skb, CapiMessageNotSupportedInCurrentState);
+ }
+ 
+@@ -2085,11 +2087,9 @@ static void do_nothing(struct gigaset_capi_ctr *iif,
+ 		       struct gigaset_capi_appl *ap,
+ 		       struct sk_buff *skb)
+ {
+-	if (printk_timed_ratelimit(&ignored_msg_dump_time, 30 * 1000)) {
+-		/* decode message */
+-		capi_message2cmsg(&iif->acmsg, skb->data);
+-		dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
+-	}
++	/* decode message */
++	capi_message2cmsg(&iif->acmsg, skb->data);
++	dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
+ 	dev_kfree_skb_any(skb);
+ }
+ 
+diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
+index 6d12623..e95fac0 100644
+--- a/drivers/isdn/gigaset/ev-layer.c
++++ b/drivers/isdn/gigaset/ev-layer.c
+@@ -190,6 +190,7 @@ struct reply_t gigaset_tab_nocid[] =
+ 							  ACT_INIT} },
+ {RSP_OK,	121, 121, -1,			  0,  0, {ACT_GOTVER,
+ 							  ACT_INIT} },
++{RSP_NONE,	121, 121, -1,			120,  0, {ACT_GETSTRING} },
+ 
+ /* leave dle mode */
+ {RSP_INIT,	  0,   0, SEQ_DLE0,		201,  5, {0},	"^SDLE=0\r"},
+@@ -1314,8 +1315,9 @@ static void do_action(int action, struct cardstate *cs,
+ 		s = ev->ptr;
+ 
+ 		if (!strcmp(s, "OK")) {
++			/* OK without version string: assume old response */
+ 			*p_genresp = 1;
+-			*p_resp_code = RSP_ERROR;
++			*p_resp_code = RSP_NONE;
+ 			break;
+ 		}
+ 
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index adcd850..700ecae 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -453,7 +453,7 @@ static void submit_flushes(struct work_struct *ws)
+ 			atomic_inc(&rdev->nr_pending);
+ 			atomic_inc(&rdev->nr_pending);
+ 			rcu_read_unlock();
+-			bi = bio_alloc_mddev(GFP_KERNEL, 0, mddev);
++			bi = bio_alloc_mddev(GFP_NOIO, 0, mddev);
+ 			bi->bi_end_io = md_end_flush;
+ 			bi->bi_private = rdev;
+ 			bi->bi_bdev = rdev->bdev;
+diff --git a/drivers/media/dvb/siano/smsusb.c b/drivers/media/dvb/siano/smsusb.c
+index 51c7121..b7d1e3e 100644
+--- a/drivers/media/dvb/siano/smsusb.c
++++ b/drivers/media/dvb/siano/smsusb.c
+@@ -542,6 +542,8 @@ static const struct usb_device_id smsusb_id_table[] __devinitconst = {
+ 		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+ 	{ USB_DEVICE(0x2040, 0xc090),
+ 		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
++	{ USB_DEVICE(0x2040, 0xc0a0),
++		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+ 	{ } /* Terminating entry */
+ 	};
+ 
+diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
+index cf7788f..1030479 100644
+--- a/drivers/media/video/uvc/uvc_v4l2.c
++++ b/drivers/media/video/uvc/uvc_v4l2.c
+@@ -689,7 +689,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
+ 					break;
+ 			}
+ 			pin = iterm->id;
+-		} else if (pin < selector->bNrInPins) {
++		} else if (index < selector->bNrInPins) {
+ 			pin = selector->baSourceID[index];
+ 			list_for_each_entry(iterm, &chain->entities, chain) {
+ 				if (!UVC_ENTITY_IS_ITERM(iterm))
+diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
+index 3ab565e..558a495 100644
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -663,7 +663,7 @@ static int mmc_sdio_resume(struct mmc_host *host)
+ 	}
+ 
+ 	if (!err && host->sdio_irqs)
+-		mmc_signal_sdio_irq(host);
++		wake_up_process(host->sdio_irq_thread);
+ 	mmc_release_host(host);
+ 
+ 	/*
+diff --git a/drivers/mmc/core/sdio_irq.c b/drivers/mmc/core/sdio_irq.c
+index 68f81b9..9dd0462 100644
+--- a/drivers/mmc/core/sdio_irq.c
++++ b/drivers/mmc/core/sdio_irq.c
+@@ -28,18 +28,20 @@
+ 
+ #include "sdio_ops.h"
+ 
+-static int process_sdio_pending_irqs(struct mmc_card *card)
++static int process_sdio_pending_irqs(struct mmc_host *host)
+ {
++	struct mmc_card *card = host->card;
+ 	int i, ret, count;
+ 	unsigned char pending;
+ 	struct sdio_func *func;
+ 
+ 	/*
+ 	 * Optimization, if there is only 1 function interrupt registered
+-	 * call irq handler directly
++	 * and we know an IRQ was signaled then call irq handler directly.
++	 * Otherwise do the full probe.
+ 	 */
+ 	func = card->sdio_single_irq;
+-	if (func) {
++	if (func && host->sdio_irq_pending) {
+ 		func->irq_handler(func);
+ 		return 1;
+ 	}
+@@ -116,7 +118,8 @@ static int sdio_irq_thread(void *_host)
+ 		ret = __mmc_claim_host(host, &host->sdio_irq_thread_abort);
+ 		if (ret)
+ 			break;
+-		ret = process_sdio_pending_irqs(host->card);
++		ret = process_sdio_pending_irqs(host);
++		host->sdio_irq_pending = false;
+ 		mmc_release_host(host);
+ 
+ 		/*
+diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
+index fddb714..a9ff89ff 100644
+--- a/drivers/mtd/sm_ftl.c
++++ b/drivers/mtd/sm_ftl.c
+@@ -1256,7 +1256,7 @@ static void sm_remove_dev(struct mtd_blktrans_dev *dev)
+ 
+ static struct mtd_blktrans_ops sm_ftl_ops = {
+ 	.name		= "smblk",
+-	.major		= -1,
++	.major		= 0,
+ 	.part_bits	= SM_FTL_PARTN_BITS,
+ 	.blksize	= SM_SECTOR_SIZE,
+ 	.getgeo		= sm_getgeo,
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index b2dc2c8..2e09edb 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -1259,55 +1259,21 @@ rio_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
+ {
+ 	int phy_addr;
+ 	struct netdev_private *np = netdev_priv(dev);
+-	struct mii_data *miidata = (struct mii_data *) &rq->ifr_ifru;
+-
+-	struct netdev_desc *desc;
+-	int i;
++	struct mii_ioctl_data *miidata = if_mii(rq);
+ 
+ 	phy_addr = np->phy_addr;
+ 	switch (cmd) {
+-	case SIOCDEVPRIVATE:
+-		break;
+-
+-	case SIOCDEVPRIVATE + 1:
+-		miidata->out_value = mii_read (dev, phy_addr, miidata->reg_num);
++	case SIOCGMIIPHY:
++		miidata->phy_id = phy_addr;
+ 		break;
+-	case SIOCDEVPRIVATE + 2:
+-		mii_write (dev, phy_addr, miidata->reg_num, miidata->in_value);
++	case SIOCGMIIREG:
++		miidata->val_out = mii_read (dev, phy_addr, miidata->reg_num);
+ 		break;
+-	case SIOCDEVPRIVATE + 3:
+-		break;
+-	case SIOCDEVPRIVATE + 4:
+-		break;
+-	case SIOCDEVPRIVATE + 5:
+-		netif_stop_queue (dev);
++	case SIOCSMIIREG:
++		if (!capable(CAP_NET_ADMIN))
++			return -EPERM;
++		mii_write (dev, phy_addr, miidata->reg_num, miidata->val_in);
+ 		break;
+-	case SIOCDEVPRIVATE + 6:
+-		netif_wake_queue (dev);
+-		break;
+-	case SIOCDEVPRIVATE + 7:
+-		printk
+-		    ("tx_full=%x cur_tx=%lx old_tx=%lx cur_rx=%lx old_rx=%lx\n",
+-		     netif_queue_stopped(dev), np->cur_tx, np->old_tx, np->cur_rx,
+-		     np->old_rx);
+-		break;
+-	case SIOCDEVPRIVATE + 8:
+-		printk("TX ring:\n");
+-		for (i = 0; i < TX_RING_SIZE; i++) {
+-			desc = &np->tx_ring[i];
+-			printk
+-			    ("%02x:cur:%08x next:%08x status:%08x frag1:%08x frag0:%08x",
+-			     i,
+-			     (u32) (np->tx_ring_dma + i * sizeof (*desc)),
+-			     (u32)le64_to_cpu(desc->next_desc),
+-			     (u32)le64_to_cpu(desc->status),
+-			     (u32)(le64_to_cpu(desc->fraginfo) >> 32),
+-			     (u32)le64_to_cpu(desc->fraginfo));
+-			printk ("\n");
+-		}
+-		printk ("\n");
+-		break;
+-
+ 	default:
+ 		return -EOPNOTSUPP;
+ 	}
+diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h
+index ba0adca..30c2da3 100644
+--- a/drivers/net/ethernet/dlink/dl2k.h
++++ b/drivers/net/ethernet/dlink/dl2k.h
+@@ -365,13 +365,6 @@ struct ioctl_data {
+ 	char *data;
+ };
+ 
+-struct mii_data {
+-	__u16 reserved;
+-	__u16 reg_num;
+-	__u16 in_value;
+-	__u16 out_value;
+-};
+-
+ /* The Rx and Tx buffer descriptors. */
+ struct netdev_desc {
+ 	__le64 next_desc;
+diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c
+index bf8153e..7570c1a 100644
+--- a/drivers/net/ethernet/emulex/benet/be_ethtool.c
++++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c
+@@ -649,12 +649,8 @@ static int
+ be_do_flash(struct net_device *netdev, struct ethtool_flash *efl)
+ {
+ 	struct be_adapter *adapter = netdev_priv(netdev);
+-	char file_name[ETHTOOL_FLASH_MAX_FILENAME];
+ 
+-	file_name[ETHTOOL_FLASH_MAX_FILENAME - 1] = 0;
+-	strcpy(file_name, efl->data);
+-
+-	return be_load_fw(adapter, file_name);
++	return be_load_fw(adapter, efl->data);
+ }
+ 
+ static int
+diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
+index 20f0243..c5ce163 100644
+--- a/drivers/net/wireless/b43legacy/main.c
++++ b/drivers/net/wireless/b43legacy/main.c
+@@ -1564,8 +1564,6 @@ static int b43legacy_request_firmware(struct b43legacy_wldev *dev)
+ 	const char *filename;
+ 	int err;
+ 
+-	/* do dummy read */
+-	ssb_read32(dev->dev, SSB_TMSHIGH);
+ 	if (!fw->ucode) {
+ 		if (rev == 2)
+ 			filename = "ucode2";
+diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
+index 2b7bcc8..db34db6 100644
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -113,46 +113,38 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request,
+ 	return status;
+ }
+ 
+-static u32 _usb_read_sync(struct usb_device *udev, u32 addr, u16 len)
++static u32 _usb_read_sync(struct rtl_priv *rtlpriv, u32 addr, u16 len)
+ {
++	struct device *dev = rtlpriv->io.dev;
++	struct usb_device *udev = to_usb_device(dev);
+ 	u8 request;
+ 	u16 wvalue;
+ 	u16 index;
+-	u32 *data;
+-	u32 ret;
++	__le32 *data = &rtlpriv->usb_data[rtlpriv->usb_data_index];
+ 
+-	data = kmalloc(sizeof(u32), GFP_KERNEL);
+-	if (!data)
+-		return -ENOMEM;
+ 	request = REALTEK_USB_VENQT_CMD_REQ;
+ 	index = REALTEK_USB_VENQT_CMD_IDX; /* n/a */
+ 
+ 	wvalue = (u16)addr;
+ 	_usbctrl_vendorreq_sync_read(udev, request, wvalue, index, data, len);
+-	ret = *data;
+-	kfree(data);
+-	return ret;
++	if (++rtlpriv->usb_data_index >= RTL_USB_MAX_RX_COUNT)
++		rtlpriv->usb_data_index = 0;
++	return le32_to_cpu(*data);
+ }
+ 
+ static u8 _usb_read8_sync(struct rtl_priv *rtlpriv, u32 addr)
+ {
+-	struct device *dev = rtlpriv->io.dev;
+-
+-	return (u8)_usb_read_sync(to_usb_device(dev), addr, 1);
++	return (u8)_usb_read_sync(rtlpriv, addr, 1);
+ }
+ 
+ static u16 _usb_read16_sync(struct rtl_priv *rtlpriv, u32 addr)
+ {
+-	struct device *dev = rtlpriv->io.dev;
+-
+-	return (u16)_usb_read_sync(to_usb_device(dev), addr, 2);
++	return (u16)_usb_read_sync(rtlpriv, addr, 2);
+ }
+ 
+ static u32 _usb_read32_sync(struct rtl_priv *rtlpriv, u32 addr)
+ {
+-	struct device *dev = rtlpriv->io.dev;
+-
+-	return _usb_read_sync(to_usb_device(dev), addr, 4);
++	return _usb_read_sync(rtlpriv, addr, 4);
+ }
+ 
+ static void _usb_write_async(struct usb_device *udev, u32 addr, u32 val,
+@@ -913,6 +905,11 @@ int __devinit rtl_usb_probe(struct usb_interface *intf,
+ 		return -ENOMEM;
+ 	}
+ 	rtlpriv = hw->priv;
++	rtlpriv->usb_data = kzalloc(RTL_USB_MAX_RX_COUNT * sizeof(u32),
++				    GFP_KERNEL);
++	if (!rtlpriv->usb_data)
++		return -ENOMEM;
++	rtlpriv->usb_data_index = 0;
+ 	SET_IEEE80211_DEV(hw, &intf->dev);
+ 	udev = interface_to_usbdev(intf);
+ 	usb_get_dev(udev);
+@@ -990,6 +987,7 @@ void rtl_usb_disconnect(struct usb_interface *intf)
+ 	/* rtl_deinit_rfkill(hw); */
+ 	rtl_usb_deinit(hw);
+ 	rtl_deinit_core(hw);
++	kfree(rtlpriv->usb_data);
+ 	rtlpriv->cfg->ops->deinit_sw_leds(hw);
+ 	rtlpriv->cfg->ops->deinit_sw_vars(hw);
+ 	_rtl_usb_io_handler_release(hw);
+diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
+index 713c7dd..b1e9deb 100644
+--- a/drivers/net/wireless/rtlwifi/wifi.h
++++ b/drivers/net/wireless/rtlwifi/wifi.h
+@@ -63,7 +63,7 @@
+ #define AC_MAX					4
+ #define QOS_QUEUE_NUM				4
+ #define RTL_MAC80211_NUM_QUEUE			5
+-
++#define RTL_USB_MAX_RX_COUNT			100
+ #define QBSS_LOAD_SIZE				5
+ #define MAX_WMMELE_LENGTH			64
+ 
+@@ -1621,6 +1621,10 @@ struct rtl_priv {
+ 	   interface or hardware */
+ 	unsigned long status;
+ 
++	/* data buffer pointer for USB reads */
++	__le32 *usb_data;
++	int usb_data_index;
++
+ 	/*This must be the last item so
+ 	   that it points to the data allocated
+ 	   beyond  this structure like:
+diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
+index c006dee..40c4705 100644
+--- a/drivers/platform/x86/sony-laptop.c
++++ b/drivers/platform/x86/sony-laptop.c
+@@ -127,7 +127,7 @@ MODULE_PARM_DESC(minor,
+ 		 "default is -1 (automatic)");
+ #endif
+ 
+-static int kbd_backlight;	/* = 1 */
++static int kbd_backlight = 1;
+ module_param(kbd_backlight, int, 0444);
+ MODULE_PARM_DESC(kbd_backlight,
+ 		 "set this to 0 to disable keyboard backlight, "
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 938398f..6ec610c 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -2765,6 +2765,8 @@ unset_supplies:
+ 	unset_regulator_supplies(rdev);
+ 
+ scrub:
++	if (rdev->supply)
++		regulator_put(rdev->supply);
+ 	kfree(rdev->constraints);
+ 	device_unregister(&rdev->dev);
+ 	/* device core frees rdev */
+diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c
+index e86edfc..1e80a48 100644
+--- a/drivers/rtc/rtc-pl031.c
++++ b/drivers/rtc/rtc-pl031.c
+@@ -312,6 +312,7 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
+ 	int ret;
+ 	struct pl031_local *ldata;
+ 	struct rtc_class_ops *ops = id->data;
++	unsigned long time;
+ 
+ 	ret = amba_request_regions(adev, NULL);
+ 	if (ret)
+@@ -343,6 +344,23 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
+ 		writel(readl(ldata->base + RTC_CR) | RTC_CR_CWEN,
+ 		       ldata->base + RTC_CR);
+ 
++	/*
++	 * On ST PL031 variants, the RTC reset value does not provide correct
++	 * weekday for 2000-01-01. Correct the erroneous sunday to saturday.
++	 */
++	if (ldata->hw_designer == AMBA_VENDOR_ST) {
++		if (readl(ldata->base + RTC_YDR) == 0x2000) {
++			time = readl(ldata->base + RTC_DR);
++			if ((time &
++			     (RTC_MON_MASK | RTC_MDAY_MASK | RTC_WDAY_MASK))
++			    == 0x02120000) {
++				time = time | (0x7 << RTC_WDAY_SHIFT);
++				writel(0x2000, ldata->base + RTC_YLR);
++				writel(time, ldata->base + RTC_LR);
++			}
++		}
++	}
++
+ 	ldata->rtc = rtc_device_register("pl031", &adev->dev, ops,
+ 					THIS_MODULE);
+ 	if (IS_ERR(ldata->rtc)) {
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index 865d452..b4d2c86 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -1674,30 +1674,26 @@ static void figure_bus_target_lun(struct ctlr_info *h,
+ 
+ 	if (is_logical_dev_addr_mode(lunaddrbytes)) {
+ 		/* logical device */
+-		if (unlikely(is_scsi_rev_5(h))) {
+-			/* p1210m, logical drives lun assignments
+-			 * match SCSI REPORT LUNS data.
++		lunid = le32_to_cpu(*((__le32 *) lunaddrbytes));
++		if (is_msa2xxx(h, device)) {
++			/* msa2xxx way, put logicals on bus 1
++			 * and match target/lun numbers box
++			 * reports.
+ 			 */
+-			lunid = le32_to_cpu(*((__le32 *) lunaddrbytes));
+-			*bus = 0;
+-			*target = 0;
+-			*lun = (lunid & 0x3fff) + 1;
++			*bus = 1;
++			*target = (lunid >> 16) & 0x3fff;
++			*lun = lunid & 0x00ff;
+ 		} else {
+-			/* not p1210m... */
+-			lunid = le32_to_cpu(*((__le32 *) lunaddrbytes));
+-			if (is_msa2xxx(h, device)) {
+-				/* msa2xxx way, put logicals on bus 1
+-				 * and match target/lun numbers box
+-				 * reports.
+-				 */
+-				*bus = 1;
+-				*target = (lunid >> 16) & 0x3fff;
+-				*lun = lunid & 0x00ff;
++			if (likely(is_scsi_rev_5(h))) {
++				/* All current smart arrays (circa 2011) */
++				*bus = 0;
++				*target = 0;
++				*lun = (lunid & 0x3fff) + 1;
+ 			} else {
+-				/* Traditional smart array way. */
++				/* Traditional old smart array way. */
+ 				*bus = 0;
+-				*lun = 0;
+ 				*target = lunid & 0x3fff;
++				*lun = 0;
+ 			}
+ 		}
+ 	} else {
+@@ -4072,10 +4068,10 @@ static int hpsa_request_irq(struct ctlr_info *h,
+ 
+ 	if (h->msix_vector || h->msi_vector)
+ 		rc = request_irq(h->intr[h->intr_mode], msixhandler,
+-				IRQF_DISABLED, h->devname, h);
++				0, h->devname, h);
+ 	else
+ 		rc = request_irq(h->intr[h->intr_mode], intxhandler,
+-				IRQF_DISABLED, h->devname, h);
++				IRQF_SHARED, h->devname, h);
+ 	if (rc) {
+ 		dev_err(&h->pdev->dev, "unable to get irq %d for %s\n",
+ 		       h->intr[h->intr_mode], h->devname);
+diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
+index a97edab..83d08b6 100644
+--- a/drivers/scsi/isci/init.c
++++ b/drivers/scsi/isci/init.c
+@@ -465,7 +465,7 @@ static int __devinit isci_pci_probe(struct pci_dev *pdev, const struct pci_devic
+ 	if (!orom)
+ 		orom = isci_request_oprom(pdev);
+ 
+-	for (i = 0; orom && i < ARRAY_SIZE(orom->ctrl); i++) {
++	for (i = 0; orom && i < num_controllers(pdev); i++) {
+ 		if (sci_oem_parameters_validate(&orom->ctrl[i])) {
+ 			dev_warn(&pdev->dev,
+ 				 "[%d]: invalid oem parameters detected, falling back to firmware\n", i);
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
+index b1ddfef..ac336e1 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -3274,7 +3274,7 @@ _base_get_port_facts(struct MPT2SAS_ADAPTER *ioc, int port, int sleep_flag)
+ 	}
+ 
+ 	pfacts = &ioc->pfacts[port];
+-	memset(pfacts, 0, sizeof(Mpi2PortFactsReply_t));
++	memset(pfacts, 0, sizeof(struct mpt2sas_port_facts));
+ 	pfacts->PortNumber = mpi_reply.PortNumber;
+ 	pfacts->VP_ID = mpi_reply.VP_ID;
+ 	pfacts->VF_ID = mpi_reply.VF_ID;
+@@ -3316,7 +3316,7 @@ _base_get_ioc_facts(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+ 	}
+ 
+ 	facts = &ioc->facts;
+-	memset(facts, 0, sizeof(Mpi2IOCFactsReply_t));
++	memset(facts, 0, sizeof(struct mpt2sas_facts));
+ 	facts->MsgVersion = le16_to_cpu(mpi_reply.MsgVersion);
+ 	facts->HeaderVersion = le16_to_cpu(mpi_reply.HeaderVersion);
+ 	facts->VP_ID = mpi_reply.VP_ID;
+@@ -4193,7 +4193,7 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
+ 		goto out_free_resources;
+ 
+ 	ioc->pfacts = kcalloc(ioc->facts.NumberOfPorts,
+-	    sizeof(Mpi2PortFactsReply_t), GFP_KERNEL);
++	    sizeof(struct mpt2sas_port_facts), GFP_KERNEL);
+ 	if (!ioc->pfacts) {
+ 		r = -ENOMEM;
+ 		goto out_free_resources;
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 5f748c0..6a62934 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -933,7 +933,7 @@ err:
+ 
+ static void fsl_spi_cs_control(struct spi_device *spi, bool on)
+ {
+-	struct device *dev = spi->dev.parent;
++	struct device *dev = spi->dev.parent->parent;
+ 	struct mpc8xxx_spi_probe_info *pinfo = to_of_pinfo(dev->platform_data);
+ 	u16 cs = spi->chip_select;
+ 	int gpio = pinfo->gpios[cs];
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index 5e78c77..4ad2c0e 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -280,7 +280,7 @@ static int do_devconfig_ioctl(struct comedi_device *dev,
+ 	if (ret == 0) {
+ 		if (!try_module_get(dev->driver->module)) {
+ 			comedi_device_detach(dev);
+-			return -ENOSYS;
++			ret = -ENOSYS;
+ 		}
+ 	}
+ 
+diff --git a/drivers/tty/serial/8250.c b/drivers/tty/serial/8250.c
+index eeadf1b..70585b6 100644
+--- a/drivers/tty/serial/8250.c
++++ b/drivers/tty/serial/8250.c
+@@ -2327,10 +2327,11 @@ serial8250_do_set_termios(struct uart_port *port, struct ktermios *termios,
+ 		quot++;
+ 
+ 	if (up->capabilities & UART_CAP_FIFO && up->port.fifosize > 1) {
+-		if (baud < 2400)
+-			fcr = UART_FCR_ENABLE_FIFO | UART_FCR_TRIGGER_1;
+-		else
+-			fcr = uart_config[up->port.type].fcr;
++		fcr = uart_config[up->port.type].fcr;
++		if (baud < 2400) {
++			fcr &= ~UART_FCR_TRIGGER_MASK;
++			fcr |= UART_FCR_TRIGGER_1;
++		}
+ 	}
+ 
+ 	/*
+diff --git a/drivers/tty/serial/8250_pci.c b/drivers/tty/serial/8250_pci.c
+index 825937a..482d51e 100644
+--- a/drivers/tty/serial/8250_pci.c
++++ b/drivers/tty/serial/8250_pci.c
+@@ -1590,54 +1590,72 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
+ 	{
+ 		.vendor         = PCI_VENDOR_ID_INTEL,
+ 		.device         = 0x8811,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = PCI_VENDOR_ID_INTEL,
+ 		.device         = 0x8812,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = PCI_VENDOR_ID_INTEL,
+ 		.device         = 0x8813,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = PCI_VENDOR_ID_INTEL,
+ 		.device         = 0x8814,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x8027,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x8028,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x8029,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x800C,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x800D,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 7e02c9c..5b3d063 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -368,6 +368,8 @@ static void mxs_auart_settermios(struct uart_port *u,
+ 
+ 	writel(ctrl, u->membase + AUART_LINECTRL);
+ 	writel(ctrl2, u->membase + AUART_CTRL2);
++
++	uart_update_timeout(u, termios->c_cflag, baud);
+ }
+ 
+ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 0406d7f..af5ffb9 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -2305,6 +2305,7 @@ void uart_unregister_driver(struct uart_driver *drv)
+ 	tty_unregister_driver(p);
+ 	put_tty_driver(p);
+ 	kfree(drv->state);
++	drv->state = NULL;
+ 	drv->tty_driver = NULL;
+ }
+ 
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 2db0327..554ac90 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -496,11 +496,13 @@ static int wdm_flush(struct file *file, fl_owner_t id)
+ 	struct wdm_device *desc = file->private_data;
+ 
+ 	wait_event(desc->wait, !test_bit(WDM_IN_USE, &desc->flags));
+-	if (desc->werr < 0)
++
++	/* cannot dereference desc->intf if WDM_DISCONNECTING */
++	if (desc->werr < 0 && !test_bit(WDM_DISCONNECTING, &desc->flags))
+ 		dev_err(&desc->intf->dev, "Error in flush path: %d\n",
+ 			desc->werr);
+ 
+-	return desc->werr;
++	return usb_translate_errors(desc->werr);
+ }
+ 
+ static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait)
+@@ -511,7 +513,7 @@ static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait)
+ 
+ 	spin_lock_irqsave(&desc->iuspin, flags);
+ 	if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+-		mask = POLLERR;
++		mask = POLLHUP | POLLERR;
+ 		spin_unlock_irqrestore(&desc->iuspin, flags);
+ 		goto desc_out;
+ 	}
+@@ -586,10 +588,15 @@ static int wdm_release(struct inode *inode, struct file *file)
+ 	mutex_unlock(&desc->wlock);
+ 
+ 	if (!desc->count) {
+-		dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
+-		kill_urbs(desc);
+-		if (!test_bit(WDM_DISCONNECTING, &desc->flags))
++		if (!test_bit(WDM_DISCONNECTING, &desc->flags)) {
++			dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
++			kill_urbs(desc);
+ 			desc->intf->needs_remote_wakeup = 0;
++		} else {
++			/* must avoid dev_printk here as desc->intf is invalid */
++			pr_debug(KBUILD_MODNAME " %s: device gone - cleaning up\n", __func__);
++			cleanup(desc);
++		}
+ 	}
+ 	mutex_unlock(&wdm_mutex);
+ 	return 0;
+@@ -805,6 +812,8 @@ static void wdm_disconnect(struct usb_interface *intf)
+ 	mutex_unlock(&desc->rlock);
+ 	if (!desc->count)
+ 		cleanup(desc);
++	else
++		dev_dbg(&intf->dev, "%s: %d open files - postponing cleanup\n", __func__, desc->count);
+ 	mutex_unlock(&wdm_mutex);
+ }
+ 
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 7abf060..f6ff837 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -295,17 +295,14 @@ static struct async *async_getcompleted(struct dev_state *ps)
+ static struct async *async_getpending(struct dev_state *ps,
+ 					     void __user *userurb)
+ {
+-	unsigned long flags;
+ 	struct async *as;
+ 
+-	spin_lock_irqsave(&ps->lock, flags);
+ 	list_for_each_entry(as, &ps->async_pending, asynclist)
+ 		if (as->userurb == userurb) {
+ 			list_del_init(&as->asynclist);
+-			spin_unlock_irqrestore(&ps->lock, flags);
+ 			return as;
+ 		}
+-	spin_unlock_irqrestore(&ps->lock, flags);
++
+ 	return NULL;
+ }
+ 
+@@ -360,6 +357,7 @@ static void cancel_bulk_urbs(struct dev_state *ps, unsigned bulk_addr)
+ __releases(ps->lock)
+ __acquires(ps->lock)
+ {
++	struct urb *urb;
+ 	struct async *as;
+ 
+ 	/* Mark all the pending URBs that match bulk_addr, up to but not
+@@ -382,8 +380,11 @@ __acquires(ps->lock)
+ 	list_for_each_entry(as, &ps->async_pending, asynclist) {
+ 		if (as->bulk_status == AS_UNLINK) {
+ 			as->bulk_status = 0;		/* Only once */
++			urb = as->urb;
++			usb_get_urb(urb);
+ 			spin_unlock(&ps->lock);		/* Allow completions */
+-			usb_unlink_urb(as->urb);
++			usb_unlink_urb(urb);
++			usb_put_urb(urb);
+ 			spin_lock(&ps->lock);
+ 			goto rescan;
+ 		}
+@@ -434,6 +435,7 @@ static void async_completed(struct urb *urb)
+ 
+ static void destroy_async(struct dev_state *ps, struct list_head *list)
+ {
++	struct urb *urb;
+ 	struct async *as;
+ 	unsigned long flags;
+ 
+@@ -441,10 +443,13 @@ static void destroy_async(struct dev_state *ps, struct list_head *list)
+ 	while (!list_empty(list)) {
+ 		as = list_entry(list->next, struct async, asynclist);
+ 		list_del_init(&as->asynclist);
++		urb = as->urb;
++		usb_get_urb(urb);
+ 
+ 		/* drop the spinlock so the completion handler can run */
+ 		spin_unlock_irqrestore(&ps->lock, flags);
+-		usb_kill_urb(as->urb);
++		usb_kill_urb(urb);
++		usb_put_urb(urb);
+ 		spin_lock_irqsave(&ps->lock, flags);
+ 	}
+ 	spin_unlock_irqrestore(&ps->lock, flags);
+@@ -1350,12 +1355,24 @@ static int proc_submiturb(struct dev_state *ps, void __user *arg)
+ 
+ static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
+ {
++	struct urb *urb;
+ 	struct async *as;
++	unsigned long flags;
+ 
++	spin_lock_irqsave(&ps->lock, flags);
+ 	as = async_getpending(ps, arg);
+-	if (!as)
++	if (!as) {
++		spin_unlock_irqrestore(&ps->lock, flags);
+ 		return -EINVAL;
+-	usb_kill_urb(as->urb);
++	}
++
++	urb = as->urb;
++	usb_get_urb(urb);
++	spin_unlock_irqrestore(&ps->lock, flags);
++
++	usb_kill_urb(urb);
++	usb_put_urb(urb);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 2b0a341..52d27ed 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2420,6 +2420,10 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ 				NULL, 0,
+ 				USB_CTRL_SET_TIMEOUT);
+ 
++		/* Try to enable USB2 hardware LPM again */
++		if (udev->usb2_hw_lpm_capable == 1)
++			usb_set_usb2_hardware_lpm(udev, 1);
++
+ 		/* System sleep transitions should never fail */
+ 		if (!PMSG_IS_AUTO(msg))
+ 			status = 0;
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 4c65eb6..32d3adc 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -123,6 +123,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Guillemot Webcam Hercules Dualpix Exchange*/
+ 	{ USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
++	/* Midiman M-Audio Keystation 88es */
++	{ USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ 	/* M-Systems Flash Disk Pioneers */
+ 	{ USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
+index 3888778..45e8479 100644
+--- a/drivers/usb/core/usb.h
++++ b/drivers/usb/core/usb.h
+@@ -132,20 +132,6 @@ static inline int is_usb_device_driver(struct device_driver *drv)
+ 			for_devices;
+ }
+ 
+-/* translate USB error codes to codes user space understands */
+-static inline int usb_translate_errors(int error_code)
+-{
+-	switch (error_code) {
+-	case 0:
+-	case -ENOMEM:
+-	case -ENODEV:
+-		return error_code;
+-	default:
+-		return -EIO;
+-	}
+-}
+-
+-
+ /* for labeling diagnostics */
+ extern const char *usbcore_name;
+ 
+diff --git a/drivers/usb/gadget/fsl_udc_core.c b/drivers/usb/gadget/fsl_udc_core.c
+index 8e3e509..01de16e 100644
+--- a/drivers/usb/gadget/fsl_udc_core.c
++++ b/drivers/usb/gadget/fsl_udc_core.c
+@@ -736,6 +736,8 @@ static void fsl_queue_td(struct fsl_ep *ep, struct fsl_req *req)
+ 		lastreq = list_entry(ep->queue.prev, struct fsl_req, queue);
+ 		lastreq->tail->next_td_ptr =
+ 			cpu_to_hc32(req->head->td_dma & DTD_ADDR_MASK);
++		/* Ensure dTD's next dtd pointer to be updated */
++		wmb();
+ 		/* Read prime bit, if 1 goto done */
+ 		if (fsl_readl(&dr_regs->endpointprime) & bitmask)
+ 			return;
+diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
+index 971d312..ee85e81 100644
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -365,7 +365,9 @@ static bool usb_is_intel_switchable_ehci(struct pci_dev *pdev)
+ {
+ 	return pdev->class == PCI_CLASS_SERIAL_USB_EHCI &&
+ 		pdev->vendor == PCI_VENDOR_ID_INTEL &&
+-		pdev->device == 0x1E26;
++		(pdev->device == 0x1E26 ||
++		 pdev->device == 0x8C2D ||
++		 pdev->device == 0x8C26);
+ }
+ 
+ static void ehci_enable_xhci_companion(void)
+diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
+index 95a9fec..a60c7aa 100644
+--- a/drivers/usb/host/ohci-at91.c
++++ b/drivers/usb/host/ohci-at91.c
+@@ -199,7 +199,7 @@ static void usb_hcd_at91_remove(struct usb_hcd *hcd,
+ /*-------------------------------------------------------------------------*/
+ 
+ static int __devinit
+-ohci_at91_start (struct usb_hcd *hcd)
++ohci_at91_reset (struct usb_hcd *hcd)
+ {
+ 	struct at91_usbh_data	*board = hcd->self.controller->platform_data;
+ 	struct ohci_hcd		*ohci = hcd_to_ohci (hcd);
+@@ -209,6 +209,14 @@ ohci_at91_start (struct usb_hcd *hcd)
+ 		return ret;
+ 
+ 	ohci->num_ports = board->ports;
++	return 0;
++}
++
++static int __devinit
++ohci_at91_start (struct usb_hcd *hcd)
++{
++	struct ohci_hcd		*ohci = hcd_to_ohci (hcd);
++	int			ret;
+ 
+ 	if ((ret = ohci_run(ohci)) < 0) {
+ 		err("can't start %s", hcd->self.bus_name);
+@@ -390,6 +398,7 @@ static const struct hc_driver ohci_at91_hc_driver = {
+ 	/*
+ 	 * basic lifecycle operations
+ 	 */
++	.reset =		ohci_at91_reset,
+ 	.start =		ohci_at91_start,
+ 	.stop =			ohci_stop,
+ 	.shutdown =		ohci_shutdown,
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index 2afff88..833b3c6 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -9,6 +9,7 @@
+  */
+ 
+ #include <linux/types.h>
++#include <linux/kconfig.h>
+ #include <linux/kernel.h>
+ #include <linux/pci.h>
+ #include <linux/init.h>
+@@ -712,12 +713,28 @@ static int handshake(void __iomem *ptr, u32 mask, u32 done,
+ 	return -ETIMEDOUT;
+ }
+ 
+-bool usb_is_intel_switchable_xhci(struct pci_dev *pdev)
++#define PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI	0x8C31
++
++bool usb_is_intel_ppt_switchable_xhci(struct pci_dev *pdev)
+ {
+ 	return pdev->class == PCI_CLASS_SERIAL_USB_XHCI &&
+ 		pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ 		pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI;
+ }
++
++/* The Intel Lynx Point chipset also has switchable ports. */
++bool usb_is_intel_lpt_switchable_xhci(struct pci_dev *pdev)
++{
++	return pdev->class == PCI_CLASS_SERIAL_USB_XHCI &&
++		pdev->vendor == PCI_VENDOR_ID_INTEL &&
++		pdev->device == PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI;
++}
++
++bool usb_is_intel_switchable_xhci(struct pci_dev *pdev)
++{
++	return usb_is_intel_ppt_switchable_xhci(pdev) ||
++		usb_is_intel_lpt_switchable_xhci(pdev);
++}
+ EXPORT_SYMBOL_GPL(usb_is_intel_switchable_xhci);
+ 
+ /*
+@@ -742,6 +759,19 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
+ {
+ 	u32		ports_available;
+ 
++	/* Don't switchover the ports if the user hasn't compiled the xHCI
++	 * driver.  Otherwise they will see "dead" USB ports that don't power
++	 * the devices.
++	 */
++	if (!IS_ENABLED(CONFIG_USB_XHCI_HCD)) {
++		dev_warn(&xhci_pdev->dev,
++				"CONFIG_USB_XHCI_HCD is turned off, "
++				"defaulting to EHCI.\n");
++		dev_warn(&xhci_pdev->dev,
++				"USB 3.0 devices will work at USB 2.0 speeds.\n");
++		return;
++	}
++
+ 	ports_available = 0xffffffff;
+ 	/* Write USB3_PSSEN, the USB 3.0 Port SuperSpeed Enable
+ 	 * Register, to turn on SuperSpeed terminations for all
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 01c3800..4232e868 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1699,6 +1699,14 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ {
+ 	struct pci_dev	*pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+ 	struct dev_info	*dev_info, *next;
++	struct list_head *tt_list_head;
++	struct list_head *tt;
++	struct list_head *endpoints;
++	struct list_head *ep, *q;
++	struct xhci_tt_bw_info *tt_info;
++	struct xhci_interval_bw_table *bwt;
++	struct xhci_virt_ep *virt_ep;
++
+ 	unsigned long	flags;
+ 	int size;
+ 	int i;
+@@ -1715,6 +1723,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ 	xhci->event_ring = NULL;
+ 	xhci_dbg(xhci, "Freed event ring\n");
+ 
++	xhci->cmd_ring_reserved_trbs = 0;
+ 	if (xhci->cmd_ring)
+ 		xhci_ring_free(xhci, xhci->cmd_ring);
+ 	xhci->cmd_ring = NULL;
+@@ -1757,8 +1766,26 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ 	}
+ 	spin_unlock_irqrestore(&xhci->lock, flags);
+ 
++	bwt = &xhci->rh_bw->bw_table;
++	for (i = 0; i < XHCI_MAX_INTERVAL; i++) {
++		endpoints = &bwt->interval_bw[i].endpoints;
++		list_for_each_safe(ep, q, endpoints) {
++			virt_ep = list_entry(ep, struct xhci_virt_ep, bw_endpoint_list);
++			list_del(&virt_ep->bw_endpoint_list);
++			kfree(virt_ep);
++		}
++	}
++
++	tt_list_head = &xhci->rh_bw->tts;
++	list_for_each_safe(tt, q, tt_list_head) {
++		tt_info = list_entry(tt, struct xhci_tt_bw_info, tt_list);
++		list_del(tt);
++		kfree(tt_info);
++	}
++
+ 	xhci->num_usb2_ports = 0;
+ 	xhci->num_usb3_ports = 0;
++	xhci->num_active_eps = 0;
+ 	kfree(xhci->usb2_ports);
+ 	kfree(xhci->usb3_ports);
+ 	kfree(xhci->port_array);
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 211296a..daf5754 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -72,6 +72,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 		xhci_dbg(xhci, "QUIRK: Fresco Logic revision %u "
+ 				"has broken MSI implementation\n",
+ 				pdev->revision);
++		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+ 	}
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_NEC)
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 43b3447..fb0981e 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1735,8 +1735,12 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 	/* handle completion code */
+ 	switch (trb_comp_code) {
+ 	case COMP_SUCCESS:
+-		frame->status = 0;
+-		break;
++		if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {
++			frame->status = 0;
++			break;
++		}
++		if ((xhci->quirks & XHCI_TRUST_TX_LENGTH))
++			trb_comp_code = COMP_SHORT_TX;
+ 	case COMP_SHORT_TX:
+ 		frame->status = td->urb->transfer_flags & URB_SHORT_NOT_OK ?
+ 				-EREMOTEIO : 0;
+@@ -1752,6 +1756,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 		break;
+ 	case COMP_DEV_ERR:
+ 	case COMP_STALL:
++	case COMP_TX_ERR:
+ 		frame->status = -EPROTO;
+ 		skip_td = true;
+ 		break;
+@@ -1832,13 +1837,16 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 	switch (trb_comp_code) {
+ 	case COMP_SUCCESS:
+ 		/* Double check that the HW transferred everything. */
+-		if (event_trb != td->last_trb) {
++		if (event_trb != td->last_trb ||
++				TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
+ 			xhci_warn(xhci, "WARN Successful completion "
+ 					"on short TX\n");
+ 			if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+ 				*status = -EREMOTEIO;
+ 			else
+ 				*status = 0;
++			if ((xhci->quirks & XHCI_TRUST_TX_LENGTH))
++				trb_comp_code = COMP_SHORT_TX;
+ 		} else {
+ 			*status = 0;
+ 		}
+@@ -1977,6 +1985,13 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ 	 * transfer type
+ 	 */
+ 	case COMP_SUCCESS:
++		if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
++			break;
++		if (xhci->quirks & XHCI_TRUST_TX_LENGTH)
++			trb_comp_code = COMP_SHORT_TX;
++		else
++			xhci_warn(xhci, "WARN Successful completion on short TX: "
++					"needs XHCI_TRUST_TX_LENGTH quirk?\n");
+ 	case COMP_SHORT_TX:
+ 		break;
+ 	case COMP_STOP:
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 4850c4d..363b141 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1466,6 +1466,7 @@ struct xhci_hcd {
+ #define XHCI_RESET_ON_RESUME	(1 << 7)
+ #define	XHCI_SW_BW_CHECKING	(1 << 8)
+ #define XHCI_AMD_0x96_HOST	(1 << 9)
++#define XHCI_TRUST_TX_LENGTH	(1 << 10)
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
+ 	/* There are two roothubs to keep track of bus suspend info for */
+diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
+index bd6d008..b9ac9a3 100644
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -1025,7 +1025,10 @@ test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param)
+ 		case 13:	/* short read, resembling case 10 */
+ 			req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
+ 			/* last data packet "should" be DATA1, not DATA0 */
+-			len = 1024 - udev->descriptor.bMaxPacketSize0;
++			if (udev->speed == USB_SPEED_SUPER)
++				len = 1024 - 512;
++			else
++				len = 1024 - udev->descriptor.bMaxPacketSize0;
+ 			expected = -EREMOTEIO;
+ 			break;
+ 		case 14:	/* short read; try to fill the last packet */
+@@ -1384,11 +1387,15 @@ static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
+ 
+ static int halt_simple(struct usbtest_dev *dev)
+ {
+-	int		ep;
+-	int		retval = 0;
+-	struct urb	*urb;
++	int			ep;
++	int			retval = 0;
++	struct urb		*urb;
++	struct usb_device	*udev = testdev_to_usbdev(dev);
+ 
+-	urb = simple_alloc_urb(testdev_to_usbdev(dev), 0, 512);
++	if (udev->speed == USB_SPEED_SUPER)
++		urb = simple_alloc_urb(udev, 0, 1024);
++	else
++		urb = simple_alloc_urb(udev, 0, 512);
+ 	if (urb == NULL)
+ 		return -ENOMEM;
+ 
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index c4cf3f3..450bdfe 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -809,6 +809,7 @@ static struct usb_device_id id_table_combined [] = {
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ 	{ USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
+ 	{ USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
++	{ USB_DEVICE(PI_VID, PI_E861_PID) },
+ 	{ USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
+ 	{ USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index c6dd18e..219b199 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -785,6 +785,14 @@
+ #define RTSYSTEMS_SERIAL_VX7_PID	0x9e52	/* Serial converter for VX-7 Radios using FT232RL */
+ #define RTSYSTEMS_CT29B_PID		0x9e54	/* CT29B Radio Cable */
+ 
++
++/*
++ * Physik Instrumente
++ * http://www.physikinstrumente.com/en/products/
++ */
++#define PI_VID              0x1a72  /* Vendor ID */
++#define PI_E861_PID         0x1008  /* E-861 piezo controller USB connection */
++
+ /*
+  * Bayer Ascensia Contour blood glucose meter USB-converter cable.
+  * http://winglucofacts.com/cables/
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index 21c82b0..2856474 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -165,7 +165,7 @@ static unsigned int product_5052_count;
+ /* the array dimension is the number of default entries plus */
+ /* TI_EXTRA_VID_PID_COUNT user defined entries plus 1 terminating */
+ /* null entry */
+-static struct usb_device_id ti_id_table_3410[14+TI_EXTRA_VID_PID_COUNT+1] = {
++static struct usb_device_id ti_id_table_3410[15+TI_EXTRA_VID_PID_COUNT+1] = {
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
+ 	{ USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
+@@ -180,6 +180,7 @@ static struct usb_device_id ti_id_table_3410[14+TI_EXTRA_VID_PID_COUNT+1] = {
+ 	{ USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
+ 	{ USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
+ 	{ USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
++	{ USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
+ };
+ 
+ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
+@@ -189,7 +190,7 @@ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
+ };
+ 
+-static struct usb_device_id ti_id_table_combined[18+2*TI_EXTRA_VID_PID_COUNT+1] = {
++static struct usb_device_id ti_id_table_combined[19+2*TI_EXTRA_VID_PID_COUNT+1] = {
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
+ 	{ USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
+@@ -208,6 +209,7 @@ static struct usb_device_id ti_id_table_combined[18+2*TI_EXTRA_VID_PID_COUNT+1]
+ 	{ USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
+ 	{ USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
+ 	{ USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
++	{ USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
+ 	{ }
+ };
+ 
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
+index f140f1b..b353e7e 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.h
++++ b/drivers/usb/serial/ti_usb_3410_5052.h
+@@ -37,6 +37,7 @@
+ #define TI_5152_BOOT_PRODUCT_ID		0x5152	/* no EEPROM, no firmware */
+ #define TI_5052_EEPROM_PRODUCT_ID	0x505A	/* EEPROM, no firmware */
+ #define TI_5052_FIRMWARE_PRODUCT_ID	0x505F	/* firmware is running */
++#define FRI2_PRODUCT_ID			0x5053  /* Fish River Island II */
+ 
+ /* Multi-Tech vendor and product ids */
+ #define MTS_VENDOR_ID			0x06E0
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 24caba7..591f57f 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1885,6 +1885,13 @@ UNUSUAL_DEV(  0x1652, 0x6600, 0x0201, 0x0201,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_IGNORE_RESIDUE ),
+ 
++/* Reported by Jesse Feddema <jdfeddema@×××××.com> */
++UNUSUAL_DEV(  0x177f, 0x0400, 0x0000, 0x0000,
++		"Yarvik",
++		"PMP400",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
++
+ /* Reported by Hans de Goede <hdegoede@××××××.com>
+  * These Appotech controllers are found in Picture Frames, they provide a
+  * (buggy) emulation of a cdrom drive which contains the windows software
+diff --git a/drivers/video/omap2/dss/venc.c b/drivers/video/omap2/dss/venc.c
+index 7533458..7152b53 100644
+--- a/drivers/video/omap2/dss/venc.c
++++ b/drivers/video/omap2/dss/venc.c
+@@ -679,6 +679,11 @@ void venc_dump_regs(struct seq_file *s)
+ {
+ #define DUMPREG(r) seq_printf(s, "%-35s %08x\n", #r, venc_read_reg(r))
+ 
++	if (cpu_is_omap44xx()) {
++		seq_printf(s, "VENC currently disabled on OMAP44xx\n");
++		return;
++	}
++
+ 	if (venc_runtime_get())
+ 		return;
+ 
+diff --git a/drivers/xen/events.c b/drivers/xen/events.c
+index 6e075cd..fec1204 100644
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -600,7 +600,7 @@ static void disable_pirq(struct irq_data *data)
+ 	disable_dynirq(data);
+ }
+ 
+-static int find_irq_by_gsi(unsigned gsi)
++int xen_irq_from_gsi(unsigned gsi)
+ {
+ 	struct irq_info *info;
+ 
+@@ -614,6 +614,7 @@ static int find_irq_by_gsi(unsigned gsi)
+ 
+ 	return -1;
+ }
++EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
+ 
+ /*
+  * Do not make any assumptions regarding the relationship between the
+@@ -633,7 +634,7 @@ int xen_bind_pirq_gsi_to_irq(unsigned gsi,
+ 
+ 	mutex_lock(&irq_mapping_update_lock);
+ 
+-	irq = find_irq_by_gsi(gsi);
++	irq = xen_irq_from_gsi(gsi);
+ 	if (irq != -1) {
+ 		printk(KERN_INFO "xen_map_pirq_gsi: returning irq %d for gsi %u\n",
+ 		       irq, gsi);
+diff --git a/fs/aio.c b/fs/aio.c
+index b9d64d8..3b65ee7 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -1477,6 +1477,10 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
+ 	if (ret < 0)
+ 		goto out;
+ 
++	ret = rw_verify_area(type, kiocb->ki_filp, &kiocb->ki_pos, ret);
++	if (ret < 0)
++		goto out;
++
+ 	kiocb->ki_nr_segs = kiocb->ki_nbytes;
+ 	kiocb->ki_cur_seg = 0;
+ 	/* ki_nbytes/left now reflect bytes instead of segs */
+@@ -1488,11 +1492,17 @@ out:
+ 	return ret;
+ }
+ 
+-static ssize_t aio_setup_single_vector(struct kiocb *kiocb)
++static ssize_t aio_setup_single_vector(int type, struct file * file, struct kiocb *kiocb)
+ {
++	int bytes;
++
++	bytes = rw_verify_area(type, file, &kiocb->ki_pos, kiocb->ki_left);
++	if (bytes < 0)
++		return bytes;
++
+ 	kiocb->ki_iovec = &kiocb->ki_inline_vec;
+ 	kiocb->ki_iovec->iov_base = kiocb->ki_buf;
+-	kiocb->ki_iovec->iov_len = kiocb->ki_left;
++	kiocb->ki_iovec->iov_len = bytes;
+ 	kiocb->ki_nr_segs = 1;
+ 	kiocb->ki_cur_seg = 0;
+ 	return 0;
+@@ -1517,10 +1527,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ 		if (unlikely(!access_ok(VERIFY_WRITE, kiocb->ki_buf,
+ 			kiocb->ki_left)))
+ 			break;
+-		ret = security_file_permission(file, MAY_READ);
+-		if (unlikely(ret))
+-			break;
+-		ret = aio_setup_single_vector(kiocb);
++		ret = aio_setup_single_vector(READ, file, kiocb);
+ 		if (ret)
+ 			break;
+ 		ret = -EINVAL;
+@@ -1535,10 +1542,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ 		if (unlikely(!access_ok(VERIFY_READ, kiocb->ki_buf,
+ 			kiocb->ki_left)))
+ 			break;
+-		ret = security_file_permission(file, MAY_WRITE);
+-		if (unlikely(ret))
+-			break;
+-		ret = aio_setup_single_vector(kiocb);
++		ret = aio_setup_single_vector(WRITE, file, kiocb);
+ 		if (ret)
+ 			break;
+ 		ret = -EINVAL;
+@@ -1549,9 +1553,6 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ 		ret = -EBADF;
+ 		if (unlikely(!(file->f_mode & FMODE_READ)))
+ 			break;
+-		ret = security_file_permission(file, MAY_READ);
+-		if (unlikely(ret))
+-			break;
+ 		ret = aio_setup_vectored_rw(READ, kiocb, compat);
+ 		if (ret)
+ 			break;
+@@ -1563,9 +1564,6 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ 		ret = -EBADF;
+ 		if (unlikely(!(file->f_mode & FMODE_WRITE)))
+ 			break;
+-		ret = security_file_permission(file, MAY_WRITE);
+-		if (unlikely(ret))
+-			break;
+ 		ret = aio_setup_vectored_rw(WRITE, kiocb, compat);
+ 		if (ret)
+ 			break;
+diff --git a/fs/bio.c b/fs/bio.c
+index b1fe82c..4fc4dbb 100644
+--- a/fs/bio.c
++++ b/fs/bio.c
+@@ -507,11 +507,12 @@ int bio_get_nr_vecs(struct block_device *bdev)
+ 	struct request_queue *q = bdev_get_queue(bdev);
+ 	int nr_pages;
+ 
+-	nr_pages = ((queue_max_sectors(q) << 9) + PAGE_SIZE - 1) >> PAGE_SHIFT;
+-	if (nr_pages > queue_max_segments(q))
+-		nr_pages = queue_max_segments(q);
++	nr_pages = min_t(unsigned,
++		     queue_max_segments(q),
++		     queue_max_sectors(q) / (PAGE_SIZE >> 9) + 1);
++
++	return min_t(unsigned, nr_pages, BIO_MAX_PAGES);
+ 
+-	return nr_pages;
+ }
+ EXPORT_SYMBOL(bio_get_nr_vecs);
+ 
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index abe9b48..9b98987 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -68,7 +68,7 @@ static void bdev_inode_switch_bdi(struct inode *inode,
+ 	spin_unlock(&dst->wb.list_lock);
+ }
+ 
+-static sector_t max_block(struct block_device *bdev)
++sector_t blkdev_max_block(struct block_device *bdev)
+ {
+ 	sector_t retval = ~((sector_t)0);
+ 	loff_t sz = i_size_read(bdev->bd_inode);
+@@ -139,7 +139,7 @@ static int
+ blkdev_get_block(struct inode *inode, sector_t iblock,
+ 		struct buffer_head *bh, int create)
+ {
+-	if (iblock >= max_block(I_BDEV(inode))) {
++	if (iblock >= blkdev_max_block(I_BDEV(inode))) {
+ 		if (create)
+ 			return -EIO;
+ 
+@@ -161,7 +161,7 @@ static int
+ blkdev_get_blocks(struct inode *inode, sector_t iblock,
+ 		struct buffer_head *bh, int create)
+ {
+-	sector_t end_block = max_block(I_BDEV(inode));
++	sector_t end_block = blkdev_max_block(I_BDEV(inode));
+ 	unsigned long max_blocks = bh->b_size >> inode->i_blkbits;
+ 
+ 	if ((iblock + max_blocks) > end_block) {
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 19d8eb7..c807931 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -971,6 +971,7 @@ init_page_buffers(struct page *page, struct block_device *bdev,
+ 	struct buffer_head *head = page_buffers(page);
+ 	struct buffer_head *bh = head;
+ 	int uptodate = PageUptodate(page);
++	sector_t end_block = blkdev_max_block(I_BDEV(bdev->bd_inode));
+ 
+ 	do {
+ 		if (!buffer_mapped(bh)) {
+@@ -979,7 +980,8 @@ init_page_buffers(struct page *page, struct block_device *bdev,
+ 			bh->b_blocknr = block;
+ 			if (uptodate)
+ 				set_buffer_uptodate(bh);
+-			set_buffer_mapped(bh);
++			if (block < end_block)
++				set_buffer_mapped(bh);
+ 		}
+ 		block++;
+ 		bh = bh->b_this_page;
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index b4c2c99..b1451af 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -703,7 +703,7 @@ static loff_t cifs_llseek(struct file *file, loff_t offset, int origin)
+ 	 * origin == SEEK_END || SEEK_DATA || SEEK_HOLE => we must revalidate
+ 	 * the cached file length
+ 	 */
+-	if (origin != SEEK_SET || origin != SEEK_CUR) {
++	if (origin != SEEK_SET && origin != SEEK_CUR) {
+ 		int rc;
+ 		struct inode *inode = file->f_path.dentry->d_inode;
+ 
+diff --git a/fs/ext3/ialloc.c b/fs/ext3/ialloc.c
+index 5c866e0..adae962 100644
+--- a/fs/ext3/ialloc.c
++++ b/fs/ext3/ialloc.c
+@@ -525,8 +525,12 @@ got:
+ 	if (IS_DIRSYNC(inode))
+ 		handle->h_sync = 1;
+ 	if (insert_inode_locked(inode) < 0) {
+-		err = -EINVAL;
+-		goto fail_drop;
++		/*
++		 * Likely a bitmap corruption causing inode to be allocated
++		 * twice.
++		 */
++		err = -EIO;
++		goto fail;
+ 	}
+ 	spin_lock(&sbi->s_next_gen_lock);
+ 	inode->i_generation = sbi->s_next_generation++;
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 00beb4f..8fb6844 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -885,8 +885,12 @@ got:
+ 	if (IS_DIRSYNC(inode))
+ 		ext4_handle_sync(handle);
+ 	if (insert_inode_locked(inode) < 0) {
+-		err = -EINVAL;
+-		goto fail_drop;
++		/*
++		 * Likely a bitmap corruption causing inode to be allocated
++		 * twice.
++		 */
++		err = -EIO;
++		goto fail;
+ 	}
+ 	spin_lock(&sbi->s_next_gen_lock);
+ 	inode->i_generation = sbi->s_next_generation++;
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index bab7c58..03d9b90 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3526,16 +3526,16 @@ out:
+ 	return ret;
+ }
+ 
+-static void nfs4_write_cached_acl(struct inode *inode, const char *buf, size_t acl_len)
++static void nfs4_write_cached_acl(struct inode *inode, struct page **pages, size_t pgbase, size_t acl_len)
+ {
+ 	struct nfs4_cached_acl *acl;
+ 
+-	if (buf && acl_len <= PAGE_SIZE) {
++	if (pages && acl_len <= PAGE_SIZE) {
+ 		acl = kmalloc(sizeof(*acl) + acl_len, GFP_KERNEL);
+ 		if (acl == NULL)
+ 			goto out;
+ 		acl->cached = 1;
+-		memcpy(acl->data, buf, acl_len);
++		_copy_from_pages(acl->data, pages, pgbase, acl_len);
+ 	} else {
+ 		acl = kmalloc(sizeof(*acl), GFP_KERNEL);
+ 		if (acl == NULL)
+@@ -3568,7 +3568,6 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
+ 	struct nfs_getaclres res = {
+ 		.acl_len = buflen,
+ 	};
+-	void *resp_buf;
+ 	struct rpc_message msg = {
+ 		.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_GETACL],
+ 		.rpc_argp = &args,
+@@ -3582,26 +3581,29 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
+ 	if (npages == 0)
+ 		npages = 1;
+ 
++	/* Add an extra page to handle the bitmap returned */
++	npages++;
++
+ 	for (i = 0; i < npages; i++) {
+ 		pages[i] = alloc_page(GFP_KERNEL);
+ 		if (!pages[i])
+ 			goto out_free;
+ 	}
+-	if (npages > 1) {
+-		/* for decoding across pages */
+-		res.acl_scratch = alloc_page(GFP_KERNEL);
+-		if (!res.acl_scratch)
+-			goto out_free;
+-	}
++
++	/* for decoding across pages */
++	res.acl_scratch = alloc_page(GFP_KERNEL);
++	if (!res.acl_scratch)
++		goto out_free;
++
+ 	args.acl_len = npages * PAGE_SIZE;
+ 	args.acl_pgbase = 0;
++
+ 	/* Let decode_getfacl know not to fail if the ACL data is larger than
+ 	 * the page we send as a guess */
+ 	if (buf == NULL)
+ 		res.acl_flags |= NFS4_ACL_LEN_REQUEST;
+-	resp_buf = page_address(pages[0]);
+ 
+-	dprintk("%s  buf %p buflen %ld npages %d args.acl_len %ld\n",
++	dprintk("%s  buf %p buflen %zu npages %d args.acl_len %zu\n",
+ 		__func__, buf, buflen, npages, args.acl_len);
+ 	ret = nfs4_call_sync(NFS_SERVER(inode)->client, NFS_SERVER(inode),
+ 			     &msg, &args.seq_args, &res.seq_res, 0);
+@@ -3610,9 +3612,9 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
+ 
+ 	acl_len = res.acl_len - res.acl_data_offset;
+ 	if (acl_len > args.acl_len)
+-		nfs4_write_cached_acl(inode, NULL, acl_len);
++		nfs4_write_cached_acl(inode, NULL, 0, acl_len);
+ 	else
+-		nfs4_write_cached_acl(inode, resp_buf + res.acl_data_offset,
++		nfs4_write_cached_acl(inode, pages, res.acl_data_offset,
+ 				      acl_len);
+ 	if (buf) {
+ 		ret = -ERANGE;
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index 68adab4..bdd5bdc 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -4965,11 +4965,19 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
+ 		 bitmap[3] = {0};
+ 	struct kvec *iov = req->rq_rcv_buf.head;
+ 	int status;
++	size_t page_len = xdr->buf->page_len;
+ 
+ 	res->acl_len = 0;
+ 	if ((status = decode_op_hdr(xdr, OP_GETATTR)) != 0)
+ 		goto out;
++
+ 	bm_p = xdr->p;
++	res->acl_data_offset = be32_to_cpup(bm_p) + 2;
++	res->acl_data_offset <<= 2;
++	/* Check if the acl data starts beyond the allocated buffer */
++	if (res->acl_data_offset > page_len)
++		return -ERANGE;
++
+ 	if ((status = decode_attr_bitmap(xdr, bitmap)) != 0)
+ 		goto out;
+ 	if ((status = decode_attr_length(xdr, &attrlen, &savep)) != 0)
+@@ -4979,28 +4987,24 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
+ 		return -EIO;
+ 	if (likely(bitmap[0] & FATTR4_WORD0_ACL)) {
+ 		size_t hdrlen;
+-		u32 recvd;
+ 
+ 		/* The bitmap (xdr len + bitmaps) and the attr xdr len words
+ 		 * are stored with the acl data to handle the problem of
+ 		 * variable length bitmaps.*/
+ 		xdr->p = bm_p;
+-		res->acl_data_offset = be32_to_cpup(bm_p) + 2;
+-		res->acl_data_offset <<= 2;
+ 
+ 		/* We ignore &savep and don't do consistency checks on
+ 		 * the attr length.  Let userspace figure it out.... */
+ 		hdrlen = (u8 *)xdr->p - (u8 *)iov->iov_base;
+ 		attrlen += res->acl_data_offset;
+-		recvd = req->rq_rcv_buf.len - hdrlen;
+-		if (attrlen > recvd) {
++		if (attrlen > page_len) {
+ 			if (res->acl_flags & NFS4_ACL_LEN_REQUEST) {
+ 				/* getxattr interface called with a NULL buf */
+ 				res->acl_len = attrlen;
+ 				goto out;
+ 			}
+-			dprintk("NFS: acl reply: attrlen %u > recvd %u\n",
+-					attrlen, recvd);
++			dprintk("NFS: acl reply: attrlen %u > page_len %zu\n",
++					attrlen, page_len);
+ 			return -EINVAL;
+ 		}
+ 		xdr_read_pages(xdr, attrlen);
+diff --git a/fs/super.c b/fs/super.c
+index afd0f1a..2a698f6 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -1166,6 +1166,8 @@ int freeze_super(struct super_block *sb)
+ 			printk(KERN_ERR
+ 				"VFS:Filesystem freeze failed\n");
+ 			sb->s_frozen = SB_UNFROZEN;
++			smp_wmb();
++			wake_up(&sb->s_wait_unfrozen);
+ 			deactivate_locked_super(sb);
+ 			return ret;
+ 		}
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 11f1951..43d36b7 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -2094,6 +2094,7 @@ extern void unregister_blkdev(unsigned int, const char *);
+ extern struct block_device *bdget(dev_t);
+ extern struct block_device *bdgrab(struct block_device *bdev);
+ extern void bd_set_size(struct block_device *, loff_t size);
++extern sector_t blkdev_max_block(struct block_device *bdev);
+ extern void bd_forget(struct inode *inode);
+ extern void bdput(struct block_device *);
+ extern void invalidate_bdev(struct block_device *);
+diff --git a/include/linux/genhd.h b/include/linux/genhd.h
+index c6f7f6a..4eec461 100644
+--- a/include/linux/genhd.h
++++ b/include/linux/genhd.h
+@@ -222,12 +222,6 @@ static inline void part_pack_uuid(const u8 *uuid_str, u8 *to)
+ 	}
+ }
+ 
+-static inline char *part_unpack_uuid(const u8 *uuid, char *out)
+-{
+-	sprintf(out, "%pU", uuid);
+-	return out;
+-}
+-
+ static inline int disk_max_parts(struct gendisk *disk)
+ {
+ 	if (disk->flags & GENHD_FL_EXT_DEVT)
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 35410ef..6136821 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -744,6 +744,13 @@ static inline bool kvm_vcpu_is_bsp(struct kvm_vcpu *vcpu)
+ {
+ 	return vcpu->kvm->bsp_vcpu_id == vcpu->vcpu_id;
+ }
++
++bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu);
++
++#else
++
++static inline bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu) { return true; }
++
+ #endif
+ 
+ #ifdef __KVM_HAVE_DEVICE_ASSIGNMENT
+diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
+index a3ac9c4..deb6282 100644
+--- a/include/linux/mmc/host.h
++++ b/include/linux/mmc/host.h
+@@ -303,6 +303,7 @@ struct mmc_host {
+ 
+ 	unsigned int		sdio_irqs;
+ 	struct task_struct	*sdio_irq_thread;
++	bool			sdio_irq_pending;
+ 	atomic_t		sdio_irq_thread_abort;
+ 
+ 	mmc_pm_flag_t		pm_flags;	/* requested pm features */
+@@ -356,6 +357,7 @@ extern int mmc_cache_ctrl(struct mmc_host *, u8);
+ static inline void mmc_signal_sdio_irq(struct mmc_host *host)
+ {
+ 	host->ops->enable_sdio_irq(host, 0);
++	host->sdio_irq_pending = true;
+ 	wake_up_process(host->sdio_irq_thread);
+ }
+ 
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 7503352..4269c3f 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -1599,6 +1599,19 @@ usb_maxpacket(struct usb_device *udev, int pipe, int is_out)
+ 
+ /* ----------------------------------------------------------------------- */
+ 
++/* translate USB error codes to codes user space understands */
++static inline int usb_translate_errors(int error_code)
++{
++	switch (error_code) {
++	case 0:
++	case -ENOMEM:
++	case -ENODEV:
++		return error_code;
++	default:
++		return -EIO;
++	}
++}
++
+ /* Events from the usb core */
+ #define USB_DEVICE_ADD		0x0001
+ #define USB_DEVICE_REMOVE	0x0002
+diff --git a/include/xen/events.h b/include/xen/events.h
+index d287997..8f3d622 100644
+--- a/include/xen/events.h
++++ b/include/xen/events.h
+@@ -96,6 +96,9 @@ int xen_irq_from_pirq(unsigned pirq);
+ /* Return the pirq allocated to the irq. */
+ int xen_pirq_from_irq(unsigned irq);
+ 
++/* Return the irq allocated to the gsi */
++int xen_irq_from_gsi(unsigned gsi);
++
+ /* Determine whether to ignore this IRQ if it is passed to a guest. */
+ int xen_test_irq_shared(int irq);
+ 
+diff --git a/init/do_mounts.c b/init/do_mounts.c
+index db6e5ee..d6c229f 100644
+--- a/init/do_mounts.c
++++ b/init/do_mounts.c
+@@ -470,7 +470,7 @@ void __init change_floppy(char *fmt, ...)
+ void __init mount_root(void)
+ {
+ #ifdef CONFIG_ROOT_NFS
+-	if (MAJOR(ROOT_DEV) == UNNAMED_MAJOR) {
++	if (ROOT_DEV == Root_NFS) {
+ 		if (mount_nfs_root())
+ 			return;
+ 
+diff --git a/init/main.c b/init/main.c
+index 217ed23..cb08fea2 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -563,9 +563,6 @@ asmlinkage void __init start_kernel(void)
+ 	early_boot_irqs_disabled = false;
+ 	local_irq_enable();
+ 
+-	/* Interrupts are enabled now so all GFP allocations are safe. */
+-	gfp_allowed_mask = __GFP_BITS_MASK;
+-
+ 	kmem_cache_init_late();
+ 
+ 	/*
+@@ -798,6 +795,10 @@ static int __init kernel_init(void * unused)
+ 	 * Wait until kthreadd is all set-up.
+ 	 */
+ 	wait_for_completion(&kthreadd_done);
++
++	/* Now the scheduler is fully set up and can do blocking allocations */
++	gfp_allowed_mask = __GFP_BITS_MASK;
++
+ 	/*
+ 	 * init can allocate pages on any node
+ 	 */
+diff --git a/kernel/compat.c b/kernel/compat.c
+index f346ced..a6d0649 100644
+--- a/kernel/compat.c
++++ b/kernel/compat.c
+@@ -320,25 +320,54 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set)
+ 
+ #ifdef __ARCH_WANT_SYS_SIGPROCMASK
+ 
+-asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set,
+-		compat_old_sigset_t __user *oset)
++/*
++ * sys_sigprocmask SIG_SETMASK sets the first (compat) word of the
++ * blocked set of signals to the supplied signal set
++ */
++static inline void compat_sig_setmask(sigset_t *blocked, compat_sigset_word set)
+ {
+-	old_sigset_t s;
+-	long ret;
+-	mm_segment_t old_fs;
++	memcpy(blocked->sig, &set, sizeof(set));
++}
+ 
+-	if (set && get_user(s, set))
+-		return -EFAULT;
+-	old_fs = get_fs();
+-	set_fs(KERNEL_DS);
+-	ret = sys_sigprocmask(how,
+-			      set ? (old_sigset_t __user *) &s : NULL,
+-			      oset ? (old_sigset_t __user *) &s : NULL);
+-	set_fs(old_fs);
+-	if (ret == 0)
+-		if (oset)
+-			ret = put_user(s, oset);
+-	return ret;
++asmlinkage long compat_sys_sigprocmask(int how,
++				       compat_old_sigset_t __user *nset,
++				       compat_old_sigset_t __user *oset)
++{
++	old_sigset_t old_set, new_set;
++	sigset_t new_blocked;
++
++	old_set = current->blocked.sig[0];
++
++	if (nset) {
++		if (get_user(new_set, nset))
++			return -EFAULT;
++		new_set &= ~(sigmask(SIGKILL) | sigmask(SIGSTOP));
++
++		new_blocked = current->blocked;
++
++		switch (how) {
++		case SIG_BLOCK:
++			sigaddsetmask(&new_blocked, new_set);
++			break;
++		case SIG_UNBLOCK:
++			sigdelsetmask(&new_blocked, new_set);
++			break;
++		case SIG_SETMASK:
++			compat_sig_setmask(&new_blocked, new_set);
++			break;
++		default:
++			return -EINVAL;
++		}
++
++		set_current_blocked(&new_blocked);
++	}
++
++	if (oset) {
++		if (put_user(old_set, oset))
++			return -EFAULT;
++	}
++
++	return 0;
+ }
+ 
+ #endif
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index bb425b1..7947e16 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1215,8 +1215,13 @@ static void worker_enter_idle(struct worker *worker)
+ 	} else
+ 		wake_up_all(&gcwq->trustee_wait);
+ 
+-	/* sanity check nr_running */
+-	WARN_ON_ONCE(gcwq->nr_workers == gcwq->nr_idle &&
++	/*
++	 * Sanity check nr_running.  Because trustee releases gcwq->lock
++	 * between setting %WORKER_ROGUE and zapping nr_running, the
++	 * warning may trigger spuriously.  Check iff trustee is idle.
++	 */
++	WARN_ON_ONCE(gcwq->trustee_state == TRUSTEE_DONE &&
++		     gcwq->nr_workers == gcwq->nr_idle &&
+ 		     atomic_read(get_gcwq_nr_running(gcwq->cpu)));
+ }
+ 
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 778554f..c8425b1 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -4549,6 +4549,12 @@ static void mem_cgroup_usage_unregister_event(struct cgroup *cgrp,
+ swap_buffers:
+ 	/* Swap primary and spare array */
+ 	thresholds->spare = thresholds->primary;
++	/* If all events are unregistered, free the spare array */
++	if (!new) {
++		kfree(thresholds->spare);
++		thresholds->spare = NULL;
++	}
++
+ 	rcu_assign_pointer(thresholds->primary, new);
+ 
+ 	/* To be sure that nobody uses thresholds */
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 2015a1e..d3955f2 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -2102,7 +2102,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
+ 			p->flags |= SWP_SOLIDSTATE;
+ 			p->cluster_next = 1 + (random32() % p->highest_bit);
+ 		}
+-		if (discard_swap(p) == 0 && (swap_flags & SWAP_FLAG_DISCARD))
++		if ((swap_flags & SWAP_FLAG_DISCARD) && discard_swap(p) == 0)
+ 			p->flags |= SWP_DISCARDABLE;
+ 	}
+ 
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index f444817..2b587ec 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -1549,6 +1549,8 @@ static noinline_for_stack int ethtool_flash_device(struct net_device *dev,
+ 	if (!dev->ethtool_ops->flash_device)
+ 		return -EOPNOTSUPP;
+ 
++	efl.data[ETHTOOL_FLASH_MAX_FILENAME - 1] = 0;
++
+ 	return dev->ethtool_ops->flash_device(dev, &efl);
+ }
+ 
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 3302c56..c1c99dd 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -379,7 +379,15 @@ static void reg_regdb_query(const char *alpha2)
+ 
+ 	schedule_work(&reg_regdb_work);
+ }
++
++/* Feel free to add any other sanity checks here */
++static void reg_regdb_size_check(void)
++{
++	/* We should ideally BUILD_BUG_ON() but then random builds would fail */
++	WARN_ONCE(!reg_regdb_size, "db.txt is empty, you should update it...");
++}
+ #else
++static inline void reg_regdb_size_check(void) {}
+ static inline void reg_regdb_query(const char *alpha2) {}
+ #endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+ 
+@@ -2236,6 +2244,8 @@ int __init regulatory_init(void)
+ 	spin_lock_init(&reg_requests_lock);
+ 	spin_lock_init(&reg_pending_beacons_lock);
+ 
++	reg_regdb_size_check();
++
+ 	cfg80211_regdomain = cfg80211_world_regdom;
+ 
+ 	user_alpha2[0] = '9';
+diff --git a/scripts/Makefile b/scripts/Makefile
+index df7678f..3626666 100644
+--- a/scripts/Makefile
++++ b/scripts/Makefile
+@@ -8,6 +8,8 @@
+ # conmakehash:	 Create arrays for initializing the kernel console tables
+ # docproc:       Used in Documentation/DocBook
+ 
++HOST_EXTRACFLAGS += -I$(srctree)/tools/include
++
+ hostprogs-$(CONFIG_KALLSYMS)     += kallsyms
+ hostprogs-$(CONFIG_LOGO)         += pnmtologo
+ hostprogs-$(CONFIG_VT)           += conmakehash
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index f466587..b4f802d 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -1238,6 +1238,7 @@ static int sel_make_bools(void)
+ 		kfree(bool_pending_names[i]);
+ 	kfree(bool_pending_names);
+ 	kfree(bool_pending_values);
++	bool_num = 0;
+ 	bool_pending_names = NULL;
+ 	bool_pending_values = NULL;
+ 
+diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c
+index b9c7986..f17dfee 100644
+--- a/tools/usb/ffs-test.c
++++ b/tools/usb/ffs-test.c
+@@ -324,7 +324,7 @@ static void *start_thread_helper(void *arg)
+ 
+ 		ret = t->in(t, t->buf, t->buf_size);
+ 		if (ret > 0) {
+-			ret = t->out(t, t->buf, t->buf_size);
++			ret = t->out(t, t->buf, ret);
+ 			name = out_name;
+ 			op = "write";
+ 		} else {
+diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
+index fd817a2..533db33 100644
+--- a/virt/kvm/iommu.c
++++ b/virt/kvm/iommu.c
+@@ -239,9 +239,13 @@ int kvm_iommu_map_guest(struct kvm *kvm)
+ 		return -ENODEV;
+ 	}
+ 
++	mutex_lock(&kvm->slots_lock);
++
+ 	kvm->arch.iommu_domain = iommu_domain_alloc(&pci_bus_type);
+-	if (!kvm->arch.iommu_domain)
+-		return -ENOMEM;
++	if (!kvm->arch.iommu_domain) {
++		r = -ENOMEM;
++		goto out_unlock;
++	}
+ 
+ 	if (!allow_unsafe_assigned_interrupts &&
+ 	    !iommu_domain_has_cap(kvm->arch.iommu_domain,
+@@ -252,17 +256,16 @@ int kvm_iommu_map_guest(struct kvm *kvm)
+ 		       " module option.\n", __func__);
+ 		iommu_domain_free(kvm->arch.iommu_domain);
+ 		kvm->arch.iommu_domain = NULL;
+-		return -EPERM;
++		r = -EPERM;
++		goto out_unlock;
+ 	}
+ 
+ 	r = kvm_iommu_map_memslots(kvm);
+ 	if (r)
+-		goto out_unmap;
+-
+-	return 0;
++		kvm_iommu_unmap_memslots(kvm);
+ 
+-out_unmap:
+-	kvm_iommu_unmap_memslots(kvm);
++out_unlock:
++	mutex_unlock(&kvm->slots_lock);
+ 	return r;
+ }
+ 
+@@ -338,7 +341,11 @@ int kvm_iommu_unmap_guest(struct kvm *kvm)
+ 	if (!domain)
+ 		return 0;
+ 
++	mutex_lock(&kvm->slots_lock);
+ 	kvm_iommu_unmap_memslots(kvm);
++	kvm->arch.iommu_domain = NULL;
++	mutex_unlock(&kvm->slots_lock);
++
+ 	iommu_domain_free(domain);
+ 	return 0;
+ }
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index e401c1b..ec747dc 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -289,15 +289,15 @@ static void kvm_mmu_notifier_invalidate_page(struct mmu_notifier *mn,
+ 	 */
+ 	idx = srcu_read_lock(&kvm->srcu);
+ 	spin_lock(&kvm->mmu_lock);
++
+ 	kvm->mmu_notifier_seq++;
+ 	need_tlb_flush = kvm_unmap_hva(kvm, address) | kvm->tlbs_dirty;
+-	spin_unlock(&kvm->mmu_lock);
+-	srcu_read_unlock(&kvm->srcu, idx);
+-
+ 	/* we've to flush the tlb before the pages can be freed */
+ 	if (need_tlb_flush)
+ 		kvm_flush_remote_tlbs(kvm);
+ 
++	spin_unlock(&kvm->mmu_lock);
++	srcu_read_unlock(&kvm->srcu, idx);
+ }
+ 
+ static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn,
+@@ -335,12 +335,12 @@ static void kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
+ 	for (; start < end; start += PAGE_SIZE)
+ 		need_tlb_flush |= kvm_unmap_hva(kvm, start);
+ 	need_tlb_flush |= kvm->tlbs_dirty;
+-	spin_unlock(&kvm->mmu_lock);
+-	srcu_read_unlock(&kvm->srcu, idx);
+-
+ 	/* we've to flush the tlb before the pages can be freed */
+ 	if (need_tlb_flush)
+ 		kvm_flush_remote_tlbs(kvm);
++
++	spin_unlock(&kvm->mmu_lock);
++	srcu_read_unlock(&kvm->srcu, idx);
+ }
+ 
+ static void kvm_mmu_notifier_invalidate_range_end(struct mmu_notifier *mn,
+@@ -378,13 +378,14 @@ static int kvm_mmu_notifier_clear_flush_young(struct mmu_notifier *mn,
+ 
+ 	idx = srcu_read_lock(&kvm->srcu);
+ 	spin_lock(&kvm->mmu_lock);
+-	young = kvm_age_hva(kvm, address);
+-	spin_unlock(&kvm->mmu_lock);
+-	srcu_read_unlock(&kvm->srcu, idx);
+ 
++	young = kvm_age_hva(kvm, address);
+ 	if (young)
+ 		kvm_flush_remote_tlbs(kvm);
+ 
++	spin_unlock(&kvm->mmu_lock);
++	srcu_read_unlock(&kvm->srcu, idx);
++
+ 	return young;
+ }
+ 
+@@ -1666,6 +1667,10 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
+ 		goto vcpu_destroy;
+ 
+ 	mutex_lock(&kvm->lock);
++	if (!kvm_vcpu_compatible(vcpu)) {
++		r = -EINVAL;
++		goto unlock_vcpu_destroy;
++	}
+ 	if (atomic_read(&kvm->online_vcpus) == KVM_MAX_VCPUS) {
+ 		r = -EINVAL;
+ 		goto unlock_vcpu_destroy;