[gentoo-commits] linux-patches r2668 - genpatches-2.6/trunk/3.12

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2014-02-07 19:29:34 +0000 (Fri, 07 Feb 2014)
New Revision: 2668

Added:
   genpatches-2.6/trunk/3.12/1009_linux-3.12.10.patch
Modified:
   genpatches-2.6/trunk/3.12/0000_README
Log:
Linux patch 3.12.10

Modified: genpatches-2.6/trunk/3.12/0000_README
===================================================================
--- genpatches-2.6/trunk/3.12/0000_README	2014-02-07 15:42:59 UTC (rev 2667)
+++ genpatches-2.6/trunk/3.12/0000_README	2014-02-07 19:29:34 UTC (rev 2668)
@@ -78,6 +78,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.12.9
 
+Patch:  1009_linux-3.12.10.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.12.10
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.12/1009_linux-3.12.10.patch
===================================================================
--- genpatches-2.6/trunk/3.12/1009_linux-3.12.10.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.12/1009_linux-3.12.10.patch	2014-02-07 19:29:34 UTC (rev 2668)
@@ -0,0 +1,5391 @@
+diff --git a/Documentation/devicetree/bindings/ata/marvell.txt b/Documentation/devicetree/bindings/ata/marvell.txt
+index b5cdd20cde9c..1c8351604d38 100644
+--- a/Documentation/devicetree/bindings/ata/marvell.txt
++++ b/Documentation/devicetree/bindings/ata/marvell.txt
+@@ -1,7 +1,7 @@
+ * Marvell Orion SATA
+ 
+ Required Properties:
+-- compatibility : "marvell,orion-sata"
++- compatibility : "marvell,orion-sata" or "marvell,armada-370-sata"
+ - reg           : Address range of controller
+ - interrupts    : Interrupt controller is using
+ - nr-ports      : Number of SATA ports in use.
+diff --git a/Documentation/devicetree/bindings/i2c/i2c-mv64xxx.txt b/Documentation/devicetree/bindings/i2c/i2c-mv64xxx.txt
+index 82e8f6f17179..582b4652a82a 100644
+--- a/Documentation/devicetree/bindings/i2c/i2c-mv64xxx.txt
++++ b/Documentation/devicetree/bindings/i2c/i2c-mv64xxx.txt
+@@ -5,7 +5,11 @@ Required properties :
+ 
+  - reg             : Offset and length of the register set for the device
+  - compatible      : Should be "marvell,mv64xxx-i2c" or "allwinner,sun4i-i2c"
+-                     or "marvell,mv78230-i2c"
++                     or "marvell,mv78230-i2c" or "marvell,mv78230-a0-i2c"
++                     Note: Only use "marvell,mv78230-a0-i2c" for a very rare,
++                     initial version of the SoC which had broken offload
++                     support.  Linux auto-detects this and sets it
++                     appropriately.
+  - interrupts      : The interrupt number
+ 
+ Optional properties :
+diff --git a/Documentation/i2c/busses/i2c-piix4 b/Documentation/i2c/busses/i2c-piix4
+index c097e0f020fe..aa959fd22450 100644
+--- a/Documentation/i2c/busses/i2c-piix4
++++ b/Documentation/i2c/busses/i2c-piix4
+@@ -13,7 +13,7 @@ Supported adapters:
+   * AMD SP5100 (SB700 derivative found on some server mainboards)
+     Datasheet: Publicly available at the AMD website
+     http://support.amd.com/us/Embedded_TechDocs/44413.pdf
+-  * AMD Hudson-2, CZ
++  * AMD Hudson-2, ML, CZ
+     Datasheet: Not publicly available
+   * Standard Microsystems (SMSC) SLC90E66 (Victory66) southbridge
+     Datasheet: Publicly available at the SMSC website http://www.smsc.com
+diff --git a/Makefile b/Makefile
+index 4ee77eaa7b1f..49b64402f947 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 12
+-SUBLEVEL = 9
++SUBLEVEL = 10
+ EXTRAVERSION =
+ NAME = One Giant Leap for Frogkind
+ 
+diff --git a/arch/alpha/lib/csum_partial_copy.c b/arch/alpha/lib/csum_partial_copy.c
+index ffb19b7da999..9df43dfe511e 100644
+--- a/arch/alpha/lib/csum_partial_copy.c
++++ b/arch/alpha/lib/csum_partial_copy.c
+@@ -378,6 +378,11 @@ csum_partial_copy_from_user(const void __user *src, void *dst, int len,
+ __wsum
+ csum_partial_copy_nocheck(const void *src, void *dst, int len, __wsum sum)
+ {
+-	return csum_partial_copy_from_user((__force const void __user *)src,
+-			dst, len, sum, NULL);
++	__wsum checksum;
++	mm_segment_t oldfs = get_fs();
++	set_fs(KERNEL_DS);
++	checksum = csum_partial_copy_from_user((__force const void __user *)src,
++						dst, len, sum, NULL);
++	set_fs(oldfs);
++	return checksum;
+ }
+diff --git a/arch/arm/boot/dts/armada-370-xp.dtsi b/arch/arm/boot/dts/armada-370-xp.dtsi
+index b97ab017d4a2..364a63dce6c5 100644
+--- a/arch/arm/boot/dts/armada-370-xp.dtsi
++++ b/arch/arm/boot/dts/armada-370-xp.dtsi
+@@ -143,7 +143,7 @@
+ 			};
+ 
+ 			sata@a0000 {
+-				compatible = "marvell,orion-sata";
++				compatible = "marvell,armada-370-sata";
+ 				reg = <0xa0000 0x5000>;
+ 				interrupts = <55>;
+ 				clocks = <&gateclk 15>, <&gateclk 30>;
+diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
+index c3e514837074..cf7de80377f1 100644
+--- a/arch/arm/boot/dts/at91sam9g45.dtsi
++++ b/arch/arm/boot/dts/at91sam9g45.dtsi
+@@ -618,6 +618,7 @@
+ 				compatible = "atmel,hsmci";
+ 				reg = <0xfff80000 0x600>;
+ 				interrupts = <11 IRQ_TYPE_LEVEL_HIGH 0>;
++				pinctrl-names = "default";
+ 				dmas = <&dma 1 AT91_DMA_CFG_PER_ID(0)>;
+ 				dma-names = "rxtx";
+ 				#address-cells = <1>;
+@@ -629,6 +630,7 @@
+ 				compatible = "atmel,hsmci";
+ 				reg = <0xfffd0000 0x600>;
+ 				interrupts = <29 IRQ_TYPE_LEVEL_HIGH 0>;
++				pinctrl-names = "default";
+ 				dmas = <&dma 1 AT91_DMA_CFG_PER_ID(13)>;
+ 				dma-names = "rxtx";
+ 				#address-cells = <1>;
+diff --git a/arch/arm/mach-at91/sam9_smc.c b/arch/arm/mach-at91/sam9_smc.c
+index 99a0a1d2b7dc..b26156bf15db 100644
+--- a/arch/arm/mach-at91/sam9_smc.c
++++ b/arch/arm/mach-at91/sam9_smc.c
+@@ -101,7 +101,7 @@ static void sam9_smc_cs_read(void __iomem *base,
+ 	/* Pulse register */
+ 	val = __raw_readl(base + AT91_SMC_PULSE);
+ 
+-	config->nwe_setup = val & AT91_SMC_NWEPULSE;
++	config->nwe_pulse = val & AT91_SMC_NWEPULSE;
+ 	config->ncs_write_pulse = (val & AT91_SMC_NCS_WRPULSE) >> 8;
+ 	config->nrd_pulse = (val & AT91_SMC_NRDPULSE) >> 16;
+ 	config->ncs_read_pulse = (val & AT91_SMC_NCS_RDPULSE) >> 24;
+diff --git a/arch/arm/mach-mvebu/Makefile b/arch/arm/mach-mvebu/Makefile
+index 2d04f0e21870..878aebe98dcc 100644
+--- a/arch/arm/mach-mvebu/Makefile
++++ b/arch/arm/mach-mvebu/Makefile
+@@ -3,7 +3,7 @@ ccflags-$(CONFIG_ARCH_MULTIPLATFORM) := -I$(srctree)/$(src)/include \
+ 
+ AFLAGS_coherency_ll.o		:= -Wa,-march=armv7-a
+ 
+-obj-y				 += system-controller.o
++obj-y				 += system-controller.o mvebu-soc-id.o
+ obj-$(CONFIG_MACH_ARMADA_370_XP) += armada-370-xp.o
+ obj-$(CONFIG_ARCH_MVEBU)	 += coherency.o coherency_ll.o pmsu.o
+ obj-$(CONFIG_SMP)                += platsmp.o headsmp.o
+diff --git a/arch/arm/mach-mvebu/armada-370-xp.c b/arch/arm/mach-mvebu/armada-370-xp.c
+index e2acff98e750..f6c9d1d85c14 100644
+--- a/arch/arm/mach-mvebu/armada-370-xp.c
++++ b/arch/arm/mach-mvebu/armada-370-xp.c
+@@ -21,6 +21,7 @@
+ #include <linux/clocksource.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/mbus.h>
++#include <linux/slab.h>
+ #include <asm/hardware/cache-l2x0.h>
+ #include <asm/mach/arch.h>
+ #include <asm/mach/map.h>
+@@ -28,6 +29,7 @@
+ #include "armada-370-xp.h"
+ #include "common.h"
+ #include "coherency.h"
++#include "mvebu-soc-id.h"
+ 
+ static void __init armada_370_xp_map_io(void)
+ {
+@@ -45,8 +47,38 @@ static void __init armada_370_xp_timer_and_clk_init(void)
+ #endif
+ }
+ 
++static void __init i2c_quirk(void)
++{
++	struct device_node *np;
++	u32 dev, rev;
++
++	/*
++	 * Only revisons more recent than A0 support the offload
++	 * mechanism. We can exit only if we are sure that we can
++	 * get the SoC revision and it is more recent than A0.
++	 */
++	if (mvebu_get_soc_id(&rev, &dev) == 0 && dev > MV78XX0_A0_REV)
++		return;
++
++	for_each_compatible_node(np, NULL, "marvell,mv78230-i2c") {
++		struct property *new_compat;
++
++		new_compat = kzalloc(sizeof(*new_compat), GFP_KERNEL);
++
++		new_compat->name = kstrdup("compatible", GFP_KERNEL);
++		new_compat->length = sizeof("marvell,mv78230-a0-i2c");
++		new_compat->value = kstrdup("marvell,mv78230-a0-i2c",
++						GFP_KERNEL);
++
++		of_update_property(np, new_compat);
++	}
++	return;
++}
++
+ static void __init armada_370_xp_dt_init(void)
+ {
++	if (of_machine_is_compatible("plathome,openblocks-ax3-4"))
++		i2c_quirk();
+ 	of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL);
+ }
+ 
+diff --git a/arch/arm/mach-mvebu/mvebu-soc-id.c b/arch/arm/mach-mvebu/mvebu-soc-id.c
+new file mode 100644
+index 000000000000..fe4fc1cbdfaf
+--- /dev/null
++++ b/arch/arm/mach-mvebu/mvebu-soc-id.c
+@@ -0,0 +1,119 @@
++/*
++ * ID and revision information for mvebu SoCs
++ *
++ * Copyright (C) 2014 Marvell
++ *
++ * Gregory CLEMENT <gregory.clement@××××××××××××××.com>
++ *
++ * This file is licensed under the terms of the GNU General Public
++ * License version 2.  This program is licensed "as is" without any
++ * warranty of any kind, whether express or implied.
++ *
++ * All the mvebu SoCs have information related to their variant and
++ * revision that can be read from the PCI control register. This is
++ * done before the PCI initialization to avoid any conflict. Once the
++ * ID and revision are retrieved, the mapping is freed.
++ */
++
++#define pr_fmt(fmt) "mvebu-soc-id: " fmt
++
++#include <linux/clk.h>
++#include <linux/init.h>
++#include <linux/io.h>
++#include <linux/kernel.h>
++#include <linux/of.h>
++#include <linux/of_address.h>
++#include "mvebu-soc-id.h"
++
++#define PCIE_DEV_ID_OFF		0x0
++#define PCIE_DEV_REV_OFF	0x8
++
++#define SOC_ID_MASK	    0xFFFF0000
++#define SOC_REV_MASK	    0xFF
++
++static u32 soc_dev_id;
++static u32 soc_rev;
++static bool is_id_valid;
++
++static const struct of_device_id mvebu_pcie_of_match_table[] = {
++	{ .compatible = "marvell,armada-xp-pcie", },
++	{ .compatible = "marvell,armada-370-pcie", },
++	{},
++};
++
++int mvebu_get_soc_id(u32 *dev, u32 *rev)
++{
++	if (is_id_valid) {
++		*dev = soc_dev_id;
++		*rev = soc_rev;
++		return 0;
++	} else
++		return -1;
++}
++
++static int __init mvebu_soc_id_init(void)
++{
++	struct device_node *np;
++	int ret = 0;
++	void __iomem *pci_base;
++	struct clk *clk;
++	struct device_node *child;
++
++	np = of_find_matching_node(NULL, mvebu_pcie_of_match_table);
++	if (!np)
++		return ret;
++
++	/*
++	 * ID and revision are available from any port, so we
++	 * just pick the first one
++	 */
++	child = of_get_next_child(np, NULL);
++	if (child == NULL) {
++		pr_err("cannot get pci node\n");
++		ret = -ENOMEM;
++		goto clk_err;
++	}
++
++	clk = of_clk_get_by_name(child, NULL);
++	if (IS_ERR(clk)) {
++		pr_err("cannot get clock\n");
++		ret = -ENOMEM;
++		goto clk_err;
++	}
++
++	ret = clk_prepare_enable(clk);
++	if (ret) {
++		pr_err("cannot enable clock\n");
++		goto clk_err;
++	}
++
++	pci_base = of_iomap(child, 0);
++	if (IS_ERR(pci_base)) {
++		pr_err("cannot map registers\n");
++		ret = -ENOMEM;
++		goto res_ioremap;
++	}
++
++	/* SoC ID */
++	soc_dev_id = readl(pci_base + PCIE_DEV_ID_OFF) >> 16;
++
++	/* SoC revision */
++	soc_rev = readl(pci_base + PCIE_DEV_REV_OFF) & SOC_REV_MASK;
++
++	is_id_valid = true;
++
++	pr_info("MVEBU SoC ID=0x%X, Rev=0x%X\n", soc_dev_id, soc_rev);
++
++	iounmap(pci_base);
++
++res_ioremap:
++	clk_disable_unprepare(clk);
++
++clk_err:
++	of_node_put(child);
++	of_node_put(np);
++
++	return ret;
++}
++core_initcall(mvebu_soc_id_init);
++
+diff --git a/arch/arm/mach-mvebu/mvebu-soc-id.h b/arch/arm/mach-mvebu/mvebu-soc-id.h
+new file mode 100644
+index 000000000000..31654252fe35
+--- /dev/null
++++ b/arch/arm/mach-mvebu/mvebu-soc-id.h
+@@ -0,0 +1,32 @@
++/*
++ * Marvell EBU SoC ID and revision definitions.
++ *
++ * Copyright (C) 2014 Marvell Semiconductor
++ *
++ * This file is licensed under the terms of the GNU General Public
++ * License version 2.  This program is licensed "as is" without any
++ * warranty of any kind, whether express or implied.
++ */
++
++#ifndef __LINUX_MVEBU_SOC_ID_H
++#define __LINUX_MVEBU_SOC_ID_H
++
++/* Armada XP ID */
++#define MV78230_DEV_ID	    0x7823
++#define MV78260_DEV_ID	    0x7826
++#define MV78460_DEV_ID	    0x7846
++
++/* Armada XP Revision */
++#define MV78XX0_A0_REV	    0x1
++#define MV78XX0_B0_REV	    0x2
++
++#ifdef CONFIG_ARCH_MVEBU
++int mvebu_get_soc_id(u32 *dev, u32 *rev);
++#else
++static inline int mvebu_get_soc_id(u32 *dev, u32 *rev)
++{
++	return -1;
++}
++#endif
++
++#endif /* __LINUX_MVEBU_SOC_ID_H */
+diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
+index 99b44e0e8d86..8c9106fd8163 100644
+--- a/arch/arm/net/bpf_jit_32.c
++++ b/arch/arm/net/bpf_jit_32.c
+@@ -637,10 +637,10 @@ load_ind:
+ 			emit(ARM_MUL(r_A, r_A, r_X), ctx);
+ 			break;
+ 		case BPF_S_ALU_DIV_K:
+-			/* current k == reciprocal_value(userspace k) */
++			if (k == 1)
++				break;
+ 			emit_mov_i(r_scratch, k, ctx);
+-			/* A = top 32 bits of the product */
+-			emit(ARM_UMULL(r_scratch, r_A, r_A, r_scratch), ctx);
++			emit_udiv(r_A, r_A, r_scratch, ctx);
+ 			break;
+ 		case BPF_S_ALU_DIV_X:
+ 			update_on_xread(ctx);
+diff --git a/arch/parisc/include/asm/cacheflush.h b/arch/parisc/include/asm/cacheflush.h
+index 2f9b751878ba..de65f66ea64e 100644
+--- a/arch/parisc/include/asm/cacheflush.h
++++ b/arch/parisc/include/asm/cacheflush.h
+@@ -132,7 +132,6 @@ void mark_rodata_ro(void);
+ static inline void *kmap(struct page *page)
+ {
+ 	might_sleep();
+-	flush_dcache_page(page);
+ 	return page_address(page);
+ }
+ 
+@@ -144,7 +143,6 @@ static inline void kunmap(struct page *page)
+ static inline void *kmap_atomic(struct page *page)
+ {
+ 	pagefault_disable();
+-	flush_dcache_page(page);
+ 	return page_address(page);
+ }
+ 
+diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h
+index c53fc63149e8..637fe031aa84 100644
+--- a/arch/parisc/include/asm/page.h
++++ b/arch/parisc/include/asm/page.h
+@@ -29,7 +29,8 @@ struct page;
+ void clear_page_asm(void *page);
+ void copy_page_asm(void *to, void *from);
+ #define clear_user_page(vto, vaddr, page) clear_page_asm(vto)
+-#define copy_user_page(vto, vfrom, vaddr, page) copy_page_asm(vto, vfrom)
++void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
++			struct page *pg);
+ 
+ /* #define CONFIG_PARISC_TMPALIAS */
+ 
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index a72545554a31..ac87a40502e6 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -388,6 +388,20 @@ void flush_kernel_dcache_page_addr(void *addr)
+ }
+ EXPORT_SYMBOL(flush_kernel_dcache_page_addr);
+ 
++void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
++	struct page *pg)
++{
++       /* Copy using kernel mapping.  No coherency is needed (all in
++	  kunmap) for the `to' page.  However, the `from' page needs to
++	  be flushed through a mapping equivalent to the user mapping
++	  before it can be accessed through the kernel mapping. */
++	preempt_disable();
++	flush_dcache_page_asm(__pa(vfrom), vaddr);
++	preempt_enable();
++	copy_page_asm(vto, vfrom);
++}
++EXPORT_SYMBOL(copy_user_page);
++
+ void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+ {
+ 	unsigned long flags;
+diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
+index 89e3ef2496ac..d0b5fca6b077 100644
+--- a/arch/powerpc/include/asm/topology.h
++++ b/arch/powerpc/include/asm/topology.h
+@@ -22,7 +22,15 @@ struct device_node;
+ 
+ static inline int cpu_to_node(int cpu)
+ {
+-	return numa_cpu_lookup_table[cpu];
++	int nid;
++
++	nid = numa_cpu_lookup_table[cpu];
++
++	/*
++	 * During early boot, the numa-cpu lookup table might not have been
++	 * setup for all CPUs yet. In such cases, default to node 0.
++	 */
++	return (nid < 0) ? 0 : nid;
+ }
+ 
+ #define parent_node(node)	(node)
+diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
+index 654932727873..bfb82365bc7a 100644
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -794,6 +794,9 @@ static void remove_cache_dir(struct cache_dir *cache_dir)
+ {
+ 	remove_index_dirs(cache_dir);
+ 
++	/* Remove cache dir from sysfs */
++	kobject_del(cache_dir->kobj);
++
+ 	kobject_put(cache_dir->kobj);
+ 
+ 	kfree(cache_dir);
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 62a2b5ab08ed..e1ab62e0d548 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -82,10 +82,13 @@ void kvmppc_fast_vcpu_kick(struct kvm_vcpu *vcpu)
+ 
+ 	/* CPU points to the first thread of the core */
+ 	if (cpu != me && cpu >= 0 && cpu < nr_cpu_ids) {
++#ifdef CONFIG_KVM_XICS
+ 		int real_cpu = cpu + vcpu->arch.ptid;
+ 		if (paca[real_cpu].kvm_hstate.xics_phys)
+ 			xics_wake_cpu(real_cpu);
+-		else if (cpu_online(cpu))
++		else
++#endif
++		if (cpu_online(cpu))
+ 			smp_send_reschedule(cpu);
+ 	}
+ 	put_cpu();
+@@ -1089,7 +1092,9 @@ static void kvmppc_start_thread(struct kvm_vcpu *vcpu)
+ 	smp_wmb();
+ #if defined(CONFIG_PPC_ICP_NATIVE) && defined(CONFIG_SMP)
+ 	if (vcpu->arch.ptid) {
++#ifdef CONFIG_KVM_XICS
+ 		xics_wake_cpu(cpu);
++#endif
+ 		++vc->n_woken;
+ 	}
+ #endif
+diff --git a/arch/powerpc/kvm/e500_mmu.c b/arch/powerpc/kvm/e500_mmu.c
+index 6d6f153b6c1d..c17600de7d59 100644
+--- a/arch/powerpc/kvm/e500_mmu.c
++++ b/arch/powerpc/kvm/e500_mmu.c
+@@ -127,7 +127,7 @@ static int kvmppc_e500_tlb_index(struct kvmppc_vcpu_e500 *vcpu_e500,
+ }
+ 
+ static inline void kvmppc_e500_deliver_tlb_miss(struct kvm_vcpu *vcpu,
+-		unsigned int eaddr, int as)
++		gva_t eaddr, int as)
+ {
+ 	struct kvmppc_vcpu_e500 *vcpu_e500 = to_e500(vcpu);
+ 	unsigned int victim, tsized;
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index c916127f10c3..4788ea2b343a 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -31,6 +31,8 @@
+ #include <asm/sparsemem.h>
+ #include <asm/prom.h>
+ #include <asm/smp.h>
++#include <asm/cputhreads.h>
++#include <asm/topology.h>
+ #include <asm/firmware.h>
+ #include <asm/paca.h>
+ #include <asm/hvcall.h>
+@@ -152,9 +154,22 @@ static void __init get_node_active_region(unsigned long pfn,
+ 	}
+ }
+ 
+-static void map_cpu_to_node(int cpu, int node)
++static void reset_numa_cpu_lookup_table(void)
++{
++	unsigned int cpu;
++
++	for_each_possible_cpu(cpu)
++		numa_cpu_lookup_table[cpu] = -1;
++}
++
++static void update_numa_cpu_lookup_table(unsigned int cpu, int node)
+ {
+ 	numa_cpu_lookup_table[cpu] = node;
++}
++
++static void map_cpu_to_node(int cpu, int node)
++{
++	update_numa_cpu_lookup_table(cpu, node);
+ 
+ 	dbg("adding cpu %d to node %d\n", cpu, node);
+ 
+@@ -522,11 +537,24 @@ static int of_drconf_to_nid_single(struct of_drconf_cell *drmem,
+  */
+ static int numa_setup_cpu(unsigned long lcpu)
+ {
+-	int nid = 0;
+-	struct device_node *cpu = of_get_cpu_node(lcpu, NULL);
++	int nid;
++	struct device_node *cpu;
++
++	/*
++	 * If a valid cpu-to-node mapping is already available, use it
++	 * directly instead of querying the firmware, since it represents
++	 * the most recent mapping notified to us by the platform (eg: VPHN).
++	 */
++	if ((nid = numa_cpu_lookup_table[lcpu]) >= 0) {
++		map_cpu_to_node(lcpu, nid);
++		return nid;
++	}
++
++	cpu = of_get_cpu_node(lcpu, NULL);
+ 
+ 	if (!cpu) {
+ 		WARN_ON(1);
++		nid = 0;
+ 		goto out;
+ 	}
+ 
+@@ -1068,6 +1096,7 @@ void __init do_init_bootmem(void)
+ 	 */
+ 	setup_node_to_cpumask_map();
+ 
++	reset_numa_cpu_lookup_table();
+ 	register_cpu_notifier(&ppc64_numa_nb);
+ 	cpu_numa_callback(&ppc64_numa_nb, CPU_UP_PREPARE,
+ 			  (void *)(unsigned long)boot_cpuid);
+@@ -1446,6 +1475,33 @@ static int update_cpu_topology(void *data)
+ 	return 0;
+ }
+ 
++static int update_lookup_table(void *data)
++{
++	struct topology_update_data *update;
++
++	if (!data)
++		return -EINVAL;
++
++	/*
++	 * Upon topology update, the numa-cpu lookup table needs to be updated
++	 * for all threads in the core, including offline CPUs, to ensure that
++	 * future hotplug operations respect the cpu-to-node associativity
++	 * properly.
++	 */
++	for (update = data; update; update = update->next) {
++		int nid, base, j;
++
++		nid = update->new_nid;
++		base = cpu_first_thread_sibling(update->cpu);
++
++		for (j = 0; j < threads_per_core; j++) {
++			update_numa_cpu_lookup_table(base + j, nid);
++		}
++	}
++
++	return 0;
++}
++
+ /*
+  * Update the node maps and sysfs entries for each cpu whose home node
+  * has changed. Returns 1 when the topology has changed, and 0 otherwise.
+@@ -1514,6 +1570,14 @@ int arch_update_cpu_topology(void)
+ 
+ 	stop_machine(update_cpu_topology, &updates[0], &updated_cpus);
+ 
++	/*
++	 * Update the numa-cpu lookup table with the new mappings, even for
++	 * offline CPUs. It is best to perform this update from the stop-
++	 * machine context.
++	 */
++	stop_machine(update_lookup_table, &updates[0],
++					cpumask_of(raw_smp_processor_id()));
++
+ 	for (ud = &updates[0]; ud; ud = ud->next) {
+ 		unregister_cpu_under_node(ud->cpu, ud->old_nid);
+ 		register_cpu_under_node(ud->cpu, ud->new_nid);
+diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
+index 2345bdb4d917..ebbb2f1408ff 100644
+--- a/arch/powerpc/net/bpf_jit_comp.c
++++ b/arch/powerpc/net/bpf_jit_comp.c
+@@ -209,10 +209,11 @@ static int bpf_jit_build_body(struct sk_filter *fp, u32 *image,
+ 			}
+ 			PPC_DIVWU(r_A, r_A, r_X);
+ 			break;
+-		case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K); */
++		case BPF_S_ALU_DIV_K: /* A /= K */
++			if (K == 1)
++				break;
+ 			PPC_LI32(r_scratch1, K);
+-			/* Top 32 bits of 64bit result -> A */
+-			PPC_MULHWU(r_A, r_A, r_scratch1);
++			PPC_DIVWU(r_A, r_A, r_scratch1);
+ 			break;
+ 		case BPF_S_ALU_AND_X:
+ 			ctx->seen |= SEEN_XREG;
+diff --git a/arch/s390/include/uapi/asm/statfs.h b/arch/s390/include/uapi/asm/statfs.h
+index a61d538756f2..471eb09184d4 100644
+--- a/arch/s390/include/uapi/asm/statfs.h
++++ b/arch/s390/include/uapi/asm/statfs.h
+@@ -35,11 +35,11 @@ struct statfs {
+ struct statfs64 {
+ 	unsigned int	f_type;
+ 	unsigned int	f_bsize;
+-	unsigned long	f_blocks;
+-	unsigned long	f_bfree;
+-	unsigned long	f_bavail;
+-	unsigned long	f_files;
+-	unsigned long	f_ffree;
++	unsigned long long f_blocks;
++	unsigned long long f_bfree;
++	unsigned long long f_bavail;
++	unsigned long long f_files;
++	unsigned long long f_ffree;
+ 	__kernel_fsid_t f_fsid;
+ 	unsigned int	f_namelen;
+ 	unsigned int	f_frsize;
+diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c
+index 3a74d8af0d69..d88e846a58f1 100644
+--- a/arch/s390/kvm/diag.c
++++ b/arch/s390/kvm/diag.c
+@@ -122,7 +122,7 @@ static int __diag_virtio_hypercall(struct kvm_vcpu *vcpu)
+ 	 * - gpr 4 contains the index on the bus (optionally)
+ 	 */
+ 	ret = kvm_io_bus_write_cookie(vcpu->kvm, KVM_VIRTIO_CCW_NOTIFY_BUS,
+-				      vcpu->run->s.regs.gprs[2],
++				      vcpu->run->s.regs.gprs[2] & 0xffffffff,
+ 				      8, &vcpu->run->s.regs.gprs[3],
+ 				      vcpu->run->s.regs.gprs[4]);
+ 	srcu_read_unlock(&vcpu->kvm->srcu, idx);
+@@ -139,7 +139,7 @@ static int __diag_virtio_hypercall(struct kvm_vcpu *vcpu)
+ 
+ int kvm_s390_handle_diag(struct kvm_vcpu *vcpu)
+ {
+-	int code = (vcpu->arch.sie_block->ipb & 0xfff0000) >> 16;
++	int code = kvm_s390_get_base_disp_rs(vcpu) & 0xffff;
+ 
+ 	if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
+ 		return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index a5df511e27a2..96a4b150f958 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -368,14 +368,16 @@ static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter,
+ 		EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
+ 		/* lhi %r4,0 */
+ 		EMIT4(0xa7480000);
+-		/* dr %r4,%r12 */
+-		EMIT2(0x1d4c);
++		/* dlr %r4,%r12 */
++		EMIT4(0xb997004c);
+ 		break;
+-	case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K) */
+-		/* m %r4,<d(K)>(%r13) */
+-		EMIT4_DISP(0x5c40d000, EMIT_CONST(K));
+-		/* lr %r5,%r4 */
+-		EMIT2(0x1854);
++	case BPF_S_ALU_DIV_K: /* A /= K */
++		if (K == 1)
++			break;
++		/* lhi %r4,0 */
++		EMIT4(0xa7480000);
++		/* dl %r4,<d(K)>(%r13) */
++		EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K));
+ 		break;
+ 	case BPF_S_ALU_MOD_X: /* A %= X */
+ 		jit->seen |= SEEN_XREG | SEEN_RET0;
+@@ -385,16 +387,21 @@ static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter,
+ 		EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
+ 		/* lhi %r4,0 */
+ 		EMIT4(0xa7480000);
+-		/* dr %r4,%r12 */
+-		EMIT2(0x1d4c);
++		/* dlr %r4,%r12 */
++		EMIT4(0xb997004c);
+ 		/* lr %r5,%r4 */
+ 		EMIT2(0x1854);
+ 		break;
+ 	case BPF_S_ALU_MOD_K: /* A %= K */
++		if (K == 1) {
++			/* lhi %r5,0 */
++			EMIT4(0xa7580000);
++			break;
++		}
+ 		/* lhi %r4,0 */
+ 		EMIT4(0xa7480000);
+-		/* d %r4,<d(K)>(%r13) */
+-		EMIT4_DISP(0x5d40d000, EMIT_CONST(K));
++		/* dl %r4,<d(K)>(%r13) */
++		EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K));
+ 		/* lr %r5,%r4 */
+ 		EMIT2(0x1854);
+ 		break;
+diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
+index 218b6b23c378..01fe9946d388 100644
+--- a/arch/sparc/net/bpf_jit_comp.c
++++ b/arch/sparc/net/bpf_jit_comp.c
+@@ -497,9 +497,20 @@ void bpf_jit_compile(struct sk_filter *fp)
+ 			case BPF_S_ALU_MUL_K:	/* A *= K */
+ 				emit_alu_K(MUL, K);
+ 				break;
+-			case BPF_S_ALU_DIV_K:	/* A /= K */
+-				emit_alu_K(MUL, K);
+-				emit_read_y(r_A);
++			case BPF_S_ALU_DIV_K:	/* A /= K with K != 0*/
++				if (K == 1)
++					break;
++				emit_write_y(G0);
++#ifdef CONFIG_SPARC32
++				/* The Sparc v8 architecture requires
++				 * three instructions between a %y
++				 * register write and the first use.
++				 */
++				emit_nop();
++				emit_nop();
++				emit_nop();
++#endif
++				emit_alu_K(DIV, K);
+ 				break;
+ 			case BPF_S_ALU_DIV_X:	/* A /= X; */
+ 				emit_cmpi(r_X, 0);
+diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h
+index 1df115909758..c7678e43465b 100644
+--- a/arch/x86/include/asm/kvm_para.h
++++ b/arch/x86/include/asm/kvm_para.h
+@@ -85,28 +85,9 @@ static inline long kvm_hypercall4(unsigned int nr, unsigned long p1,
+ 	return ret;
+ }
+ 
+-static inline uint32_t kvm_cpuid_base(void)
+-{
+-	if (boot_cpu_data.cpuid_level < 0)
+-		return 0;	/* So we don't blow up on old processors */
+-
+-	if (cpu_has_hypervisor)
+-		return hypervisor_cpuid_base("KVMKVMKVM\0\0\0", 0);
+-
+-	return 0;
+-}
+-
+-static inline bool kvm_para_available(void)
+-{
+-	return kvm_cpuid_base() != 0;
+-}
+-
+-static inline unsigned int kvm_arch_para_features(void)
+-{
+-	return cpuid_eax(KVM_CPUID_FEATURES);
+-}
+-
+ #ifdef CONFIG_KVM_GUEST
++bool kvm_para_available(void);
++unsigned int kvm_arch_para_features(void);
+ void __init kvm_guest_init(void);
+ void kvm_async_pf_task_wait(u32 token);
+ void kvm_async_pf_task_wake(u32 token);
+@@ -126,6 +107,16 @@ static inline void kvm_spinlock_init(void)
+ #define kvm_async_pf_task_wait(T) do {} while(0)
+ #define kvm_async_pf_task_wake(T) do {} while(0)
+ 
++static inline bool kvm_para_available(void)
++{
++	return 0;
++}
++
++static inline unsigned int kvm_arch_para_features(void)
++{
++	return 0;
++}
++
+ static inline u32 kvm_read_and_reset_pf_reason(void)
+ {
+ 	return 0;
+diff --git a/arch/x86/include/uapi/asm/msr-index.h b/arch/x86/include/uapi/asm/msr-index.h
+index bb0465090ae5..228d95f6592a 100644
+--- a/arch/x86/include/uapi/asm/msr-index.h
++++ b/arch/x86/include/uapi/asm/msr-index.h
+@@ -182,6 +182,7 @@
+ #define MSR_AMD64_PATCH_LOADER		0xc0010020
+ #define MSR_AMD64_OSVW_ID_LENGTH	0xc0010140
+ #define MSR_AMD64_OSVW_STATUS		0xc0010141
++#define MSR_AMD64_LS_CFG		0xc0011020
+ #define MSR_AMD64_DC_CFG		0xc0011022
+ #define MSR_AMD64_BU_CFG2		0xc001102a
+ #define MSR_AMD64_IBSFETCHCTL		0xc0011030
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 903a264af981..28233b9e45cc 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -508,6 +508,16 @@ static void early_init_amd(struct cpuinfo_x86 *c)
+ 			set_cpu_cap(c, X86_FEATURE_EXTD_APICID);
+ 	}
+ #endif
++
++	/* F16h erratum 793, CVE-2013-6885 */
++	if (c->x86 == 0x16 && c->x86_model <= 0xf) {
++		u64 val;
++
++		rdmsrl(MSR_AMD64_LS_CFG, val);
++		if (!(val & BIT(15)))
++			wrmsrl(MSR_AMD64_LS_CFG, val | BIT(15));
++	}
++
+ }
+ 
+ static const int amd_erratum_383[];
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index b2046e4d0b59..f022c54a79a4 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -500,6 +500,38 @@ void __init kvm_guest_init(void)
+ #endif
+ }
+ 
++static noinline uint32_t __kvm_cpuid_base(void)
++{
++	if (boot_cpu_data.cpuid_level < 0)
++		return 0;	/* So we don't blow up on old processors */
++
++	if (cpu_has_hypervisor)
++		return hypervisor_cpuid_base("KVMKVMKVM\0\0\0", 0);
++
++	return 0;
++}
++
++static inline uint32_t kvm_cpuid_base(void)
++{
++	static int kvm_cpuid_base = -1;
++
++	if (kvm_cpuid_base == -1)
++		kvm_cpuid_base = __kvm_cpuid_base();
++
++	return kvm_cpuid_base;
++}
++
++bool kvm_para_available(void)
++{
++	return kvm_cpuid_base() != 0;
++}
++EXPORT_SYMBOL_GPL(kvm_para_available);
++
++unsigned int kvm_arch_para_features(void)
++{
++	return cpuid_eax(kvm_cpuid_base() | KVM_CPUID_FEATURES);
++}
++
+ static uint32_t __init kvm_detect(void)
+ {
+ 	return kvm_cpuid_base();
+diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
+index 412a5aa0ef94..518d86471b76 100644
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -37,6 +37,7 @@
+ 
+ #include "irq.h"
+ #include "i8254.h"
++#include "x86.h"
+ 
+ #ifndef CONFIG_X86_64
+ #define mod_64(x, y) ((x) - (y) * div64_u64(x, y))
+@@ -349,6 +350,23 @@ static void create_pit_timer(struct kvm *kvm, u32 val, int is_period)
+ 	atomic_set(&ps->pending, 0);
+ 	ps->irq_ack = 1;
+ 
++	/*
++	 * Do not allow the guest to program periodic timers with small
++	 * interval, since the hrtimers are not throttled by the host
++	 * scheduler.
++	 */
++	if (ps->is_periodic) {
++		s64 min_period = min_timer_period_us * 1000LL;
++
++		if (ps->period < min_period) {
++			pr_info_ratelimited(
++			    "kvm: requested %lld ns "
++			    "i8254 timer period limited to %lld ns\n",
++			    ps->period, min_period);
++			ps->period = min_period;
++		}
++	}
++
+ 	hrtimer_start(&ps->timer, ktime_add_ns(ktime_get(), interval),
+ 		      HRTIMER_MODE_ABS);
+ }
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 1673940cf9c3..d86ff15fc89f 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -71,9 +71,6 @@
+ #define VEC_POS(v) ((v) & (32 - 1))
+ #define REG_POS(v) (((v) >> 5) << 4)
+ 
+-static unsigned int min_timer_period_us = 500;
+-module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR);
+-
+ static inline void apic_set_reg(struct kvm_lapic *apic, int reg_off, u32 val)
+ {
+ 	*((u32 *) (apic->regs + reg_off)) = val;
+@@ -1355,7 +1352,7 @@ void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value)
+ 	vcpu->arch.apic_base = value;
+ 
+ 	/* update jump label if enable bit changes */
+-	if ((vcpu->arch.apic_base ^ value) & MSR_IA32_APICBASE_ENABLE) {
++	if ((old_value ^ value) & MSR_IA32_APICBASE_ENABLE) {
+ 		if (value & MSR_IA32_APICBASE_ENABLE)
+ 			static_key_slow_dec_deferred(&apic_hw_disabled);
+ 		else
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index eb9b9c9fc3d9..16dc55a39fa3 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -94,6 +94,9 @@ EXPORT_SYMBOL_GPL(kvm_x86_ops);
+ static bool ignore_msrs = 0;
+ module_param(ignore_msrs, bool, S_IRUGO | S_IWUSR);
+ 
++unsigned int min_timer_period_us = 500;
++module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR);
++
+ bool kvm_has_tsc_control;
+ EXPORT_SYMBOL_GPL(kvm_has_tsc_control);
+ u32  kvm_max_guest_tsc_khz;
+diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
+index e224f7a671b6..3186542f2fa3 100644
+--- a/arch/x86/kvm/x86.h
++++ b/arch/x86/kvm/x86.h
+@@ -124,5 +124,7 @@ int kvm_write_guest_virt_system(struct x86_emulate_ctxt *ctxt,
+ 
+ extern u64 host_xcr0;
+ 
++extern unsigned int min_timer_period_us;
++
+ extern struct static_key kvm_no_apic_vcpu;
+ #endif
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 26328e800869..4ed75dd81d05 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -359,15 +359,21 @@ void bpf_jit_compile(struct sk_filter *fp)
+ 				EMIT2(0x89, 0xd0);	/* mov %edx,%eax */
+ 				break;
+ 			case BPF_S_ALU_MOD_K: /* A %= K; */
++				if (K == 1) {
++					CLEAR_A();
++					break;
++				}
+ 				EMIT2(0x31, 0xd2);	/* xor %edx,%edx */
+ 				EMIT1(0xb9);EMIT(K, 4);	/* mov imm32,%ecx */
+ 				EMIT2(0xf7, 0xf1);	/* div %ecx */
+ 				EMIT2(0x89, 0xd0);	/* mov %edx,%eax */
+ 				break;
+-			case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K); */
+-				EMIT3(0x48, 0x69, 0xc0); /* imul imm32,%rax,%rax */
+-				EMIT(K, 4);
+-				EMIT4(0x48, 0xc1, 0xe8, 0x20); /* shr $0x20,%rax */
++			case BPF_S_ALU_DIV_K: /* A /= K */
++				if (K == 1)
++					break;
++				EMIT2(0x31, 0xd2);	/* xor %edx,%edx */
++				EMIT1(0xb9);EMIT(K, 4);	/* mov imm32,%ecx */
++				EMIT2(0xf7, 0xf1);	/* div %ecx */
+ 				break;
+ 			case BPF_S_ALU_AND_X:
+ 				seen |= SEEN_XREG;
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 220fa52b9bd0..f19284d87dfe 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -440,7 +440,7 @@ void __init efi_reserve_boot_services(void)
+ 		 * - Not within any part of the kernel
+ 		 * - Not the bios reserved area
+ 		*/
+-		if ((start+size >= __pa_symbol(_text)
++		if ((start + size > __pa_symbol(_text)
+ 				&& start <= __pa_symbol(_end)) ||
+ 			!e820_all_mapped(start, start+size, E820_RAM) ||
+ 			memblock_is_region_reserved(start, size)) {
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 2c2780a19609..f3c361b5c5e5 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2222,6 +2222,16 @@ int ata_dev_configure(struct ata_device *dev)
+ 	if (rc)
+ 		return rc;
+ 
++	/* some WD SATA-1 drives have issues with LPM, turn on NOLPM for them */
++	if ((dev->horkage & ATA_HORKAGE_WD_BROKEN_LPM) &&
++	    (id[ATA_ID_SATA_CAPABILITY] & 0xe) == 0x2)
++		dev->horkage |= ATA_HORKAGE_NOLPM;
++
++	if (dev->horkage & ATA_HORKAGE_NOLPM) {
++		ata_dev_warn(dev, "LPM support broken, forcing max_power\n");
++		dev->link->ap->target_lpm_policy = ATA_LPM_MAX_POWER;
++	}
++
+ 	/* let ACPI work its magic */
+ 	rc = ata_acpi_on_devcfg(dev);
+ 	if (rc)
+@@ -4216,6 +4226,23 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ 	{ "Micron_M500*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+ 	{ "Crucial_CT???M500SSD1",	NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+ 
++	/*
++	 * Some WD SATA-I drives spin up and down erratically when the link
++	 * is put into the slumber mode.  We don't have full list of the
++	 * affected devices.  Disable LPM if the device matches one of the
++	 * known prefixes and is SATA-1.  As a side effect LPM partial is
++	 * lost too.
++	 *
++	 * https://bugzilla.kernel.org/show_bug.cgi?id=57211
++	 */
++	{ "WDC WD800JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD1200JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD1600JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD2000JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD2500JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD3000JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD3200JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++
+ 	/* End Marker */
+ 	{ }
+ };
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 377eb889f555..ef8567de6a75 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -111,12 +111,14 @@ static const char *ata_lpm_policy_names[] = {
+ 	[ATA_LPM_MIN_POWER]	= "min_power",
+ };
+ 
+-static ssize_t ata_scsi_lpm_store(struct device *dev,
++static ssize_t ata_scsi_lpm_store(struct device *device,
+ 				  struct device_attribute *attr,
+ 				  const char *buf, size_t count)
+ {
+-	struct Scsi_Host *shost = class_to_shost(dev);
++	struct Scsi_Host *shost = class_to_shost(device);
+ 	struct ata_port *ap = ata_shost_to_port(shost);
++	struct ata_link *link;
++	struct ata_device *dev;
+ 	enum ata_lpm_policy policy;
+ 	unsigned long flags;
+ 
+@@ -132,10 +134,20 @@ static ssize_t ata_scsi_lpm_store(struct device *dev,
+ 		return -EINVAL;
+ 
+ 	spin_lock_irqsave(ap->lock, flags);
++
++	ata_for_each_link(link, ap, EDGE) {
++		ata_for_each_dev(dev, &ap->link, ENABLED) {
++			if (dev->horkage & ATA_HORKAGE_NOLPM) {
++				count = -EOPNOTSUPP;
++				goto out_unlock;
++			}
++		}
++	}
++
+ 	ap->target_lpm_policy = policy;
+ 	ata_port_schedule_eh(ap);
++out_unlock:
+ 	spin_unlock_irqrestore(ap->lock, flags);
+-
+ 	return count;
+ }
+ 
+diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
+index 56be31819897..dc9d4b1ea4ec 100644
+--- a/drivers/ata/sata_mv.c
++++ b/drivers/ata/sata_mv.c
+@@ -304,6 +304,7 @@ enum {
+ 	MV5_LTMODE		= 0x30,
+ 	MV5_PHY_CTL		= 0x0C,
+ 	SATA_IFCFG		= 0x050,
++	LP_PHY_CTL		= 0x058,
+ 
+ 	MV_M2_PREAMP_MASK	= 0x7e0,
+ 
+@@ -431,6 +432,7 @@ enum {
+ 	MV_HP_CUT_THROUGH	= (1 << 10),	/* can use EDMA cut-through */
+ 	MV_HP_FLAG_SOC		= (1 << 11),	/* SystemOnChip, no PCI */
+ 	MV_HP_QUIRK_LED_BLINK_EN = (1 << 12),	/* is led blinking enabled? */
++	MV_HP_FIX_LP_PHY_CTL	= (1 << 13),	/* fix speed in LP_PHY_CTL ? */
+ 
+ 	/* Port private flags (pp_flags) */
+ 	MV_PP_FLAG_EDMA_EN	= (1 << 0),	/* is EDMA engine enabled? */
+@@ -1358,6 +1360,7 @@ static int mv_scr_write(struct ata_link *link, unsigned int sc_reg_in, u32 val)
+ 
+ 	if (ofs != 0xffffffffU) {
+ 		void __iomem *addr = mv_ap_base(link->ap) + ofs;
++		struct mv_host_priv *hpriv = link->ap->host->private_data;
+ 		if (sc_reg_in == SCR_CONTROL) {
+ 			/*
+ 			 * Workaround for 88SX60x1 FEr SATA#26:
+@@ -1374,6 +1377,18 @@ static int mv_scr_write(struct ata_link *link, unsigned int sc_reg_in, u32 val)
+ 			 */
+ 			if ((val & 0xf) == 1 || (readl(addr) & 0xf) == 1)
+ 				val |= 0xf000;
++
++			if (hpriv->hp_flags & MV_HP_FIX_LP_PHY_CTL) {
++				void __iomem *lp_phy_addr =
++					mv_ap_base(link->ap) + LP_PHY_CTL;
++				/*
++				 * Set PHY speed according to SControl speed.
++				 */
++				if ((val & 0xf0) == 0x10)
++					writelfl(0x7, lp_phy_addr);
++				else
++					writelfl(0x227, lp_phy_addr);
++			}
+ 		}
+ 		writelfl(val, addr);
+ 		return 0;
+@@ -4110,6 +4125,15 @@ static int mv_platform_probe(struct platform_device *pdev)
+ 	if (rc)
+ 		goto err;
+ 
++	/*
++	 * To allow disk hotplug on Armada 370/XP SoCs, the PHY speed must be
++	 * updated in the LP_PHY_CTL register.
++	 */
++	if (pdev->dev.of_node &&
++		of_device_is_compatible(pdev->dev.of_node,
++					"marvell,armada-370-sata"))
++		hpriv->hp_flags |= MV_HP_FIX_LP_PHY_CTL;
++
+ 	/* initialize adapter */
+ 	rc = mv_init_host(host);
+ 	if (rc)
+@@ -4209,6 +4233,7 @@ static int mv_platform_resume(struct platform_device *pdev)
+ 
+ #ifdef CONFIG_OF
+ static struct of_device_id mv_sata_dt_ids[] = {
++	{ .compatible = "marvell,armada-370-sata", },
+ 	{ .compatible = "marvell,orion-sata", },
+ 	{},
+ };
+diff --git a/drivers/char/tpm/tpm_i2c_stm_st33.c b/drivers/char/tpm/tpm_i2c_stm_st33.c
+index 5bb8e2ddd3b3..156bd3c72770 100644
+--- a/drivers/char/tpm/tpm_i2c_stm_st33.c
++++ b/drivers/char/tpm/tpm_i2c_stm_st33.c
+@@ -410,6 +410,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
+ 			     &chip->vendor.read_queue)
+ 	       == 0) {
+ 		burstcnt = get_burstcount(chip);
++		if (burstcnt < 0)
++			return burstcnt;
+ 		len = min_t(int, burstcnt, count - size);
+ 		I2C_READ_DATA(client, TPM_DATA_FIFO, buf + size, len);
+ 		size += len;
+@@ -451,7 +453,8 @@ static irqreturn_t tpm_ioserirq_handler(int irq, void *dev_id)
+ static int tpm_stm_i2c_send(struct tpm_chip *chip, unsigned char *buf,
+ 			    size_t len)
+ {
+-	u32 status, burstcnt = 0, i, size;
++	u32 status, i, size;
++	int burstcnt = 0;
+ 	int ret;
+ 	u8 data;
+ 	struct i2c_client *client;
+@@ -482,6 +485,8 @@ static int tpm_stm_i2c_send(struct tpm_chip *chip, unsigned char *buf,
+ 
+ 	for (i = 0; i < len - 1;) {
+ 		burstcnt = get_burstcount(chip);
++		if (burstcnt < 0)
++			return burstcnt;
+ 		size = min_t(int, len - i - 1, burstcnt);
+ 		ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf, size);
+ 		if (ret < 0)
+diff --git a/drivers/char/tpm/tpm_ppi.c b/drivers/char/tpm/tpm_ppi.c
+index 57a818b2b5f2..811ad1e4d802 100644
+--- a/drivers/char/tpm/tpm_ppi.c
++++ b/drivers/char/tpm/tpm_ppi.c
+@@ -172,7 +172,7 @@ static ssize_t tpm_store_ppi_request(struct device *dev,
+ 	 * is updated with function index from SUBREQ to SUBREQ2 since PPI
+ 	 * version 1.1
+ 	 */
+-	if (strcmp(version, "1.1") == -1)
++	if (strcmp(version, "1.1") < 0)
+ 		params[2].integer.value = TPM_PPI_FN_SUBREQ;
+ 	else
+ 		params[2].integer.value = TPM_PPI_FN_SUBREQ2;
+@@ -182,7 +182,7 @@ static ssize_t tpm_store_ppi_request(struct device *dev,
+ 	 * string/package type. For PPI version 1.0 and 1.1, use buffer type
+ 	 * for compatibility, and use package type since 1.2 according to spec.
+ 	 */
+-	if (strcmp(version, "1.2") == -1) {
++	if (strcmp(version, "1.2") < 0) {
+ 		params[3].type = ACPI_TYPE_BUFFER;
+ 		params[3].buffer.length = sizeof(req);
+ 		sscanf(buf, "%d", &req);
+@@ -248,7 +248,7 @@ static ssize_t tpm_show_ppi_transition_action(struct device *dev,
+ 	 * (e.g. Capella with PPI 1.0) need integer/string/buffer type, so for
+ 	 * compatibility, define params[3].type as buffer, if PPI version < 1.2
+ 	 */
+-	if (strcmp(version, "1.2") == -1) {
++	if (strcmp(version, "1.2") < 0) {
+ 		params[3].type = ACPI_TYPE_BUFFER;
+ 		params[3].buffer.length =  0;
+ 		params[3].buffer.pointer = NULL;
+@@ -390,7 +390,7 @@ static ssize_t show_ppi_operations(char *buf, u32 start, u32 end)
+ 	kfree(output.pointer);
+ 	output.length = ACPI_ALLOCATE_BUFFER;
+ 	output.pointer = NULL;
+-	if (strcmp(version, "1.2") == -1)
++	if (strcmp(version, "1.2") < 0)
+ 		return -EPERM;
+ 
+ 	params[2].integer.value = TPM_PPI_FN_GETOPR;
+diff --git a/drivers/edac/e752x_edac.c b/drivers/edac/e752x_edac.c
+index 644fec54681f..f1e9d7bd131f 100644
+--- a/drivers/edac/e752x_edac.c
++++ b/drivers/edac/e752x_edac.c
+@@ -1182,9 +1182,11 @@ static int e752x_get_devs(struct pci_dev *pdev, int dev_idx,
+ 	pvt->bridge_ck = pci_get_device(PCI_VENDOR_ID_INTEL,
+ 				pvt->dev_info->err_dev, pvt->bridge_ck);
+ 
+-	if (pvt->bridge_ck == NULL)
++	if (pvt->bridge_ck == NULL) {
+ 		pvt->bridge_ck = pci_scan_single_device(pdev->bus,
+ 							PCI_DEVFN(0, 1));
++		pci_dev_get(pvt->bridge_ck);
++	}
+ 
+ 	if (pvt->bridge_ck == NULL) {
+ 		e752x_printk(KERN_ERR, "error reporting device not found:"
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
+index 3dc7a997b795..a36f9c1d265c 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
+@@ -365,13 +365,13 @@ static u16
+ init_script(struct nouveau_bios *bios, int index)
+ {
+ 	struct nvbios_init init = { .bios = bios };
+-	u16 data;
++	u16 bmp_ver = bmp_version(bios), data;
+ 
+-	if (bmp_version(bios) && bmp_version(bios) < 0x0510) {
+-		if (index > 1)
++	if (bmp_ver && bmp_ver < 0x0510) {
++		if (index > 1 || bmp_ver < 0x0100)
+ 			return 0x0000;
+ 
+-		data = bios->bmp_offset + (bios->version.major < 2 ? 14 : 18);
++		data = bios->bmp_offset + (bmp_ver < 0x0200 ? 14 : 18);
+ 		return nv_ro16(bios, data + (index * 2));
+ 	}
+ 
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index d65f3fd895dd..758774f4454c 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -210,6 +210,7 @@ static DEFINE_PCI_DEVICE_TABLE(k10temp_id_table) = {
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ 	{}
+ };
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index cdcbd8368ed3..ff758eded96f 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -151,6 +151,7 @@ config I2C_PIIX4
+ 	    ATI SB700/SP5100
+ 	    ATI SB800
+ 	    AMD Hudson-2
++	    AMD ML
+ 	    AMD CZ
+ 	    Serverworks OSB4
+ 	    Serverworks CSB5
+diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
+index d3e9cc3153a9..6f02eb883e5e 100644
+--- a/drivers/i2c/busses/i2c-mv64xxx.c
++++ b/drivers/i2c/busses/i2c-mv64xxx.c
+@@ -692,6 +692,7 @@ static const struct of_device_id mv64xxx_i2c_of_match_table[] = {
+ 	{ .compatible = "allwinner,sun4i-i2c", .data = &mv64xxx_i2c_regs_sun4i},
+ 	{ .compatible = "marvell,mv64xxx-i2c", .data = &mv64xxx_i2c_regs_mv64xxx},
+ 	{ .compatible = "marvell,mv78230-i2c", .data = &mv64xxx_i2c_regs_mv64xxx},
++	{ .compatible = "marvell,mv78230-a0-i2c", .data = &mv64xxx_i2c_regs_mv64xxx},
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(of, mv64xxx_i2c_of_match_table);
+@@ -783,6 +784,10 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
+ 		drv_data->errata_delay = true;
+ 	}
+ 
++	if (of_device_is_compatible(np, "marvell,mv78230-a0-i2c")) {
++		drv_data->offload_enabled = false;
++		drv_data->errata_delay = true;
++	}
+ out:
+ 	return rc;
+ #endif
+diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
+index a028617b8f13..f71b4d381c00 100644
+--- a/drivers/i2c/busses/i2c-piix4.c
++++ b/drivers/i2c/busses/i2c-piix4.c
+@@ -22,7 +22,7 @@
+ 	Intel PIIX4, 440MX
+ 	Serverworks OSB4, CSB5, CSB6, HT-1000, HT-1100
+ 	ATI IXP200, IXP300, IXP400, SB600, SB700/SP5100, SB800
+-	AMD Hudson-2, CZ
++	AMD Hudson-2, ML, CZ
+ 	SMSC Victory66
+ 
+    Note: we assume there can only be one device, with one or more
+@@ -235,7 +235,8 @@ static int piix4_setup_sb800(struct pci_dev *PIIX4_dev,
+ {
+ 	unsigned short piix4_smba;
+ 	unsigned short smba_idx = 0xcd6;
+-	u8 smba_en_lo, smba_en_hi, i2ccfg, i2ccfg_offset = 0x10, smb_en;
++	u8 smba_en_lo, smba_en_hi, smb_en, smb_en_status;
++	u8 i2ccfg, i2ccfg_offset = 0x10;
+ 
+ 	/* SB800 and later SMBus does not support forcing address */
+ 	if (force || force_addr) {
+@@ -245,7 +246,15 @@ static int piix4_setup_sb800(struct pci_dev *PIIX4_dev,
+ 	}
+ 
+ 	/* Determine the address of the SMBus areas */
+-	smb_en = (aux) ? 0x28 : 0x2c;
++	if ((PIIX4_dev->vendor == PCI_VENDOR_ID_AMD &&
++	     PIIX4_dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS &&
++	     PIIX4_dev->revision >= 0x41) ||
++	    (PIIX4_dev->vendor == PCI_VENDOR_ID_AMD &&
++	     PIIX4_dev->device == 0x790b &&
++	     PIIX4_dev->revision >= 0x49))
++		smb_en = 0x00;
++	else
++		smb_en = (aux) ? 0x28 : 0x2c;
+ 
+ 	if (!request_region(smba_idx, 2, "smba_idx")) {
+ 		dev_err(&PIIX4_dev->dev, "SMBus base address index region "
+@@ -258,13 +267,22 @@ static int piix4_setup_sb800(struct pci_dev *PIIX4_dev,
+ 	smba_en_hi = inb_p(smba_idx + 1);
+ 	release_region(smba_idx, 2);
+ 
+-	if ((smba_en_lo & 1) == 0) {
++	if (!smb_en) {
++		smb_en_status = smba_en_lo & 0x10;
++		piix4_smba = smba_en_hi << 8;
++		if (aux)
++			piix4_smba |= 0x20;
++	} else {
++		smb_en_status = smba_en_lo & 0x01;
++		piix4_smba = ((smba_en_hi << 8) | smba_en_lo) & 0xffe0;
++	}
++
++	if (!smb_en_status) {
+ 		dev_err(&PIIX4_dev->dev,
+ 			"Host SMBus controller not enabled!\n");
+ 		return -ENODEV;
+ 	}
+ 
+-	piix4_smba = ((smba_en_hi << 8) | smba_en_lo) & 0xffe0;
+ 	if (acpi_check_region(piix4_smba, SMBIOSIZE, piix4_driver.name))
+ 		return -ENODEV;
+ 
+diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
+index 22d1ae72c282..26fdcac56ad1 100644
+--- a/drivers/md/bcache/bset.c
++++ b/drivers/md/bcache/bset.c
+@@ -935,7 +935,7 @@ static void sort_key_next(struct btree_iter *iter,
+ 		*i = iter->data[--iter->used];
+ }
+ 
+-static void btree_sort_fixup(struct btree_iter *iter)
++static struct bkey *btree_sort_fixup(struct btree_iter *iter, struct bkey *tmp)
+ {
+ 	while (iter->used > 1) {
+ 		struct btree_iter_set *top = iter->data, *i = top + 1;
+@@ -963,9 +963,22 @@ static void btree_sort_fixup(struct btree_iter *iter)
+ 		} else {
+ 			/* can't happen because of comparison func */
+ 			BUG_ON(!bkey_cmp(&START_KEY(top->k), &START_KEY(i->k)));
+-			bch_cut_back(&START_KEY(i->k), top->k);
++
++			if (bkey_cmp(i->k, top->k) < 0) {
++				bkey_copy(tmp, top->k);
++
++				bch_cut_back(&START_KEY(i->k), tmp);
++				bch_cut_front(i->k, top->k);
++				heap_sift(iter, 0, btree_iter_cmp);
++
++				return tmp;
++			} else {
++				bch_cut_back(&START_KEY(i->k), top->k);
++			}
+ 		}
+ 	}
++
++	return NULL;
+ }
+ 
+ static void btree_mergesort(struct btree *b, struct bset *out,
+@@ -973,15 +986,20 @@ static void btree_mergesort(struct btree *b, struct bset *out,
+ 			    bool fixup, bool remove_stale)
+ {
+ 	struct bkey *k, *last = NULL;
++	BKEY_PADDED(k) tmp;
+ 	bool (*bad)(struct btree *, const struct bkey *) = remove_stale
+ 		? bch_ptr_bad
+ 		: bch_ptr_invalid;
+ 
+ 	while (!btree_iter_end(iter)) {
+ 		if (fixup && !b->level)
+-			btree_sort_fixup(iter);
++			k = btree_sort_fixup(iter, &tmp.k);
++		else
++			k = NULL;
++
++		if (!k)
++			k = bch_btree_iter_next(iter);
+ 
+-		k = bch_btree_iter_next(iter);
+ 		if (bad(b, k))
+ 			continue;
+ 
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 93174c6ab37c..10e9e46108fd 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2004,6 +2004,7 @@ static void raid5_end_write_request(struct bio *bi, int error)
+ 			set_bit(R5_MadeGoodRepl, &sh->dev[i].flags);
+ 	} else {
+ 		if (!uptodate) {
++			set_bit(STRIPE_DEGRADED, &sh->state);
+ 			set_bit(WriteErrorSeen, &rdev->flags);
+ 			set_bit(R5_WriteError, &sh->dev[i].flags);
+ 			if (!test_and_set_bit(WantReplacement, &rdev->flags))
+diff --git a/drivers/mfd/max77686.c b/drivers/mfd/max77686.c
+index 522be67b2e68..108453b75ccc 100644
+--- a/drivers/mfd/max77686.c
++++ b/drivers/mfd/max77686.c
+@@ -103,7 +103,7 @@ static int max77686_i2c_probe(struct i2c_client *i2c,
+ 	max77686->irq_gpio = pdata->irq_gpio;
+ 	max77686->irq = i2c->irq;
+ 
+-	max77686->regmap = regmap_init_i2c(i2c, &max77686_regmap_config);
++	max77686->regmap = devm_regmap_init_i2c(i2c, &max77686_regmap_config);
+ 	if (IS_ERR(max77686->regmap)) {
+ 		ret = PTR_ERR(max77686->regmap);
+ 		dev_err(max77686->dev, "Failed to allocate register map: %d\n",
+diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
+index 0a0448326e9d..98f95614b5b1 100644
+--- a/drivers/misc/mei/hbm.c
++++ b/drivers/misc/mei/hbm.c
+@@ -128,6 +128,17 @@ static bool is_treat_specially_client(struct mei_cl *cl,
+ 	return false;
+ }
+ 
++/**
++ * mei_hbm_idle - set hbm to idle state
++ *
++ * @dev: the device structure
++ */
++void mei_hbm_idle(struct mei_device *dev)
++{
++	dev->init_clients_timer = 0;
++	dev->hbm_state = MEI_HBM_IDLE;
++}
++
+ int mei_hbm_start_wait(struct mei_device *dev)
+ {
+ 	int ret;
+@@ -577,6 +588,14 @@ void mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
+ 	mei_read_slots(dev, dev->rd_msg_buf, hdr->length);
+ 	mei_msg = (struct mei_bus_message *)dev->rd_msg_buf;
+ 
++	/* ignore spurious message and prevent reset nesting
++	 * hbm is put to idle during system reset
++	 */
++	if (dev->hbm_state == MEI_HBM_IDLE) {
++		dev_dbg(&dev->pdev->dev, "hbm: state is idle ignore spurious messages\n");
++		return 0;
++	}
++
+ 	switch (mei_msg->hbm_cmd) {
+ 	case HOST_START_RES_CMD:
+ 		version_res = (struct hbm_host_version_response *)mei_msg;
+diff --git a/drivers/misc/mei/hbm.h b/drivers/misc/mei/hbm.h
+index 4ae2e56e404f..210757701207 100644
+--- a/drivers/misc/mei/hbm.h
++++ b/drivers/misc/mei/hbm.h
+@@ -49,6 +49,7 @@ static inline void mei_hbm_hdr(struct mei_msg_hdr *hdr, size_t length)
+ 	hdr->reserved = 0;
+ }
+ 
++void mei_hbm_idle(struct mei_device *dev);
+ int mei_hbm_start_req(struct mei_device *dev);
+ int mei_hbm_start_wait(struct mei_device *dev);
+ int mei_hbm_cl_flow_control_req(struct mei_device *dev, struct mei_cl *cl);
+diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
+index 6197018e2f16..3fd43b0e69d1 100644
+--- a/drivers/misc/mei/init.c
++++ b/drivers/misc/mei/init.c
+@@ -139,14 +139,19 @@ void mei_reset(struct mei_device *dev, int interrupts_enabled)
+ 			dev->dev_state != MEI_DEV_POWER_DOWN &&
+ 			dev->dev_state != MEI_DEV_POWER_UP);
+ 
++	/* we're already in reset, cancel the init timer
++	 * if the reset was called due the hbm protocol error
++	 * we need to call it before hw start
++	 * so the hbm watchdog won't kick in
++	 */
++	mei_hbm_idle(dev);
++
+ 	ret = mei_hw_reset(dev, interrupts_enabled);
+ 	if (ret) {
+ 		dev_err(&dev->pdev->dev, "hw reset failed disabling the device\n");
+ 		interrupts_enabled = false;
+-		dev->dev_state = MEI_DEV_DISABLED;
+ 	}
+ 
+-	dev->hbm_state = MEI_HBM_IDLE;
+ 
+ 	if (dev->dev_state != MEI_DEV_INITIALIZING &&
+ 	    dev->dev_state != MEI_DEV_POWER_UP) {
+@@ -175,8 +180,6 @@ void mei_reset(struct mei_device *dev, int interrupts_enabled)
+ 		memset(&dev->wr_ext_msg, 0, sizeof(dev->wr_ext_msg));
+ 	}
+ 
+-	/* we're already in reset, cancel the init timer */
+-	dev->init_clients_timer = 0;
+ 
+ 	dev->me_clients_num = 0;
+ 	dev->rd_msg_hdr = 0;
+@@ -188,6 +191,7 @@ void mei_reset(struct mei_device *dev, int interrupts_enabled)
+ 
+ 	if (!interrupts_enabled) {
+ 		dev_dbg(&dev->pdev->dev, "intr not enabled end of reset\n");
++		dev->dev_state = MEI_DEV_DISABLED;
+ 		return;
+ 	}
+ 
+diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
+index 4b59cb742dee..1b922e971d3e 100644
+--- a/drivers/misc/mei/interrupt.c
++++ b/drivers/misc/mei/interrupt.c
+@@ -536,7 +536,6 @@ EXPORT_SYMBOL_GPL(mei_irq_write_handler);
+  *
+  * @work: pointer to the work_struct structure
+  *
+- * NOTE: This function is called by timer interrupt work
+  */
+ void mei_timer(struct work_struct *work)
+ {
+@@ -551,18 +550,24 @@ void mei_timer(struct work_struct *work)
+ 
+ 
+ 	mutex_lock(&dev->device_lock);
+-	if (dev->dev_state != MEI_DEV_ENABLED) {
+-		if (dev->dev_state == MEI_DEV_INIT_CLIENTS) {
+-			if (dev->init_clients_timer) {
+-				if (--dev->init_clients_timer == 0) {
+-					dev_err(&dev->pdev->dev, "reset: init clients timeout hbm_state = %d.\n",
+-						dev->hbm_state);
+-					mei_reset(dev, 1);
+-				}
++
++	/* Catch interrupt stalls during HBM init handshake */
++	if (dev->dev_state == MEI_DEV_INIT_CLIENTS &&
++	    dev->hbm_state != MEI_HBM_IDLE) {
++
++		if (dev->init_clients_timer) {
++			if (--dev->init_clients_timer == 0) {
++				dev_err(&dev->pdev->dev, "timer: init clients timeout hbm_state = %d.\n",
++					dev->hbm_state);
++				mei_reset(dev, 1);
++				goto out;
+ 			}
+ 		}
+-		goto out;
+ 	}
++
++	if (dev->dev_state != MEI_DEV_ENABLED)
++		goto out;
++
+ 	/*** connect/disconnect timeouts ***/
+ 	list_for_each_entry_safe(cl_pos, cl_next, &dev->file_list, link) {
+ 		if (cl_pos->timer_count) {
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index 4ab4c89c60cd..0399458e6d44 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -160,6 +160,7 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
+ 	struct sk_buff *skb = tx_buf->skb;
+ 	u16 bd_idx = TX_BD(tx_buf->first_bd), new_cons;
+ 	int nbd;
++	u16 split_bd_len = 0;
+ 
+ 	/* prefetch skb end pointer to speedup dev_kfree_skb() */
+ 	prefetch(&skb->end);
+@@ -167,10 +168,7 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
+ 	DP(NETIF_MSG_TX_DONE, "fp[%d]: pkt_idx %d  buff @(%p)->skb %p\n",
+ 	   txdata->txq_index, idx, tx_buf, skb);
+ 
+-	/* unmap first bd */
+ 	tx_start_bd = &txdata->tx_desc_ring[bd_idx].start_bd;
+-	dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
+-			 BD_UNMAP_LEN(tx_start_bd), DMA_TO_DEVICE);
+ 
+ 	nbd = le16_to_cpu(tx_start_bd->nbd) - 1;
+ #ifdef BNX2X_STOP_ON_ERROR
+@@ -188,12 +186,19 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
+ 	--nbd;
+ 	bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
+ 
+-	/* ...and the TSO split header bd since they have no mapping */
++	/* TSO headers+data bds share a common mapping. See bnx2x_tx_split() */
+ 	if (tx_buf->flags & BNX2X_TSO_SPLIT_BD) {
++		tx_data_bd = &txdata->tx_desc_ring[bd_idx].reg_bd;
++		split_bd_len = BD_UNMAP_LEN(tx_data_bd);
+ 		--nbd;
+ 		bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
+ 	}
+ 
++	/* unmap first bd */
++	dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
++			 BD_UNMAP_LEN(tx_start_bd) + split_bd_len,
++			 DMA_TO_DEVICE);
++
+ 	/* now free frags */
+ 	while (nbd > 0) {
+ 
+diff --git a/drivers/net/ethernet/intel/e1000e/phy.c b/drivers/net/ethernet/intel/e1000e/phy.c
+index da2be59505c0..20e71f4ca426 100644
+--- a/drivers/net/ethernet/intel/e1000e/phy.c
++++ b/drivers/net/ethernet/intel/e1000e/phy.c
+@@ -1757,19 +1757,23 @@ s32 e1000e_phy_has_link_generic(struct e1000_hw *hw, u32 iterations,
+ 		 * it across the board.
+ 		 */
+ 		ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
+-		if (ret_val)
++		if (ret_val) {
+ 			/* If the first read fails, another entity may have
+ 			 * ownership of the resources, wait and try again to
+ 			 * see if they have relinquished the resources yet.
+ 			 */
+-			udelay(usec_interval);
++			if (usec_interval >= 1000)
++				msleep(usec_interval / 1000);
++			else
++				udelay(usec_interval);
++		}
+ 		ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
+ 		if (ret_val)
+ 			break;
+ 		if (phy_status & BMSR_LSTATUS)
+ 			break;
+ 		if (usec_interval >= 1000)
+-			mdelay(usec_interval / 1000);
++			msleep(usec_interval / 1000);
+ 		else
+ 			udelay(usec_interval);
+ 	}
+diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
+index bdf697b184ae..f3ae9d94fe71 100644
+--- a/drivers/net/ethernet/via/via-rhine.c
++++ b/drivers/net/ethernet/via/via-rhine.c
+@@ -1615,6 +1615,7 @@ static void rhine_reset_task(struct work_struct *work)
+ 		goto out_unlock;
+ 
+ 	napi_disable(&rp->napi);
++	netif_tx_disable(dev);
+ 	spin_lock_bh(&rp->lock);
+ 
+ 	/* clear all descriptors */
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 8494bb53ebdc..aba04f561760 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -1245,7 +1245,7 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb)
+ 		return -ENOMEM;
+ 
+ 	urb->num_sgs = num_sgs;
+-	sg_init_table(urb->sg, urb->num_sgs);
++	sg_init_table(urb->sg, urb->num_sgs + 1);
+ 
+ 	sg_set_buf(&urb->sg[s++], skb->data, skb_headlen(skb));
+ 	total_len += skb_headlen(skb);
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 146236891889..32c45c3d820d 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -1051,6 +1051,15 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
+ 	if (!vs)
+ 		goto drop;
+ 
++	/* If the NIC driver gave us an encapsulated packet
++	 * with the encapsulation mark, the device checksummed it
++	 * for us. Otherwise force the upper layers to verify it.
++	 */
++	if (skb->ip_summed != CHECKSUM_UNNECESSARY || !skb->encapsulation)
++		skb->ip_summed = CHECKSUM_NONE;
++
++	skb->encapsulation = 0;
++
+ 	vs->rcv(vs, skb, vxh->vx_vni);
+ 	return 0;
+ 
+@@ -1109,17 +1118,6 @@ static void vxlan_rcv(struct vxlan_sock *vs,
+ 
+ 	skb_reset_network_header(skb);
+ 
+-	/* If the NIC driver gave us an encapsulated packet with
+-	 * CHECKSUM_UNNECESSARY and Rx checksum feature is enabled,
+-	 * leave the CHECKSUM_UNNECESSARY, the device checksummed it
+-	 * for us. Otherwise force the upper layers to verify it.
+-	 */
+-	if (skb->ip_summed != CHECKSUM_UNNECESSARY || !skb->encapsulation ||
+-	    !(vxlan->dev->features & NETIF_F_RXCSUM))
+-		skb->ip_summed = CHECKSUM_NONE;
+-
+-	skb->encapsulation = 0;
+-
+ 	if (oip6)
+ 		err = IP6_ECN_decapsulate(oip6, skb);
+ 	if (oip)
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index ecc6ec4a1edb..4e0a9429e192 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -2608,13 +2608,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
+ 	    ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
+ 			pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
+ 
+-	/*
+-	 * Fast channel change across bands is available
+-	 * only for AR9462 and AR9565.
+-	 */
+-	if (AR_SREV_9462(ah) || AR_SREV_9565(ah))
+-		pCap->hw_caps |= ATH9K_HW_CAP_FCC_BAND_SWITCH;
+-
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
+index ab9e3a8410bc..a1ab4ff46818 100644
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -848,20 +848,15 @@ static int ath9k_process_rate(struct ath_common *common,
+ 	enum ieee80211_band band;
+ 	unsigned int i = 0;
+ 	struct ath_softc __maybe_unused *sc = common->priv;
++	struct ath_hw *ah = sc->sc_ah;
+ 
+-	band = hw->conf.chandef.chan->band;
++	band = ah->curchan->chan->band;
+ 	sband = hw->wiphy->bands[band];
+ 
+-	switch (hw->conf.chandef.width) {
+-	case NL80211_CHAN_WIDTH_5:
++	if (IS_CHAN_QUARTER_RATE(ah->curchan))
+ 		rxs->flag |= RX_FLAG_5MHZ;
+-		break;
+-	case NL80211_CHAN_WIDTH_10:
++	else if (IS_CHAN_HALF_RATE(ah->curchan))
+ 		rxs->flag |= RX_FLAG_10MHZ;
+-		break;
+-	default:
+-		break;
+-	}
+ 
+ 	if (rx_stats->rs_rate & 0x80) {
+ 		/* HT rate */
+@@ -1175,6 +1170,14 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
+ 		ath_start_rx_poll(sc, 3);
+ 	}
+ 
++	/*
++	 * This shouldn't happen, but have a safety check anyway.
++	 */
++	if (WARN_ON(!ah->curchan)) {
++		ret = -EINVAL;
++		goto exit;
++	}
++
+ 	if (ath9k_process_rate(common, hw, rx_stats, rx_status)) {
+ 		ret =-EINVAL;
+ 		goto exit;
+@@ -1182,8 +1185,8 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
+ 
+ 	ath9k_process_rssi(common, hw, rx_stats, rx_status);
+ 
+-	rx_status->band = hw->conf.chandef.chan->band;
+-	rx_status->freq = hw->conf.chandef.chan->center_freq;
++	rx_status->band = ah->curchan->chan->band;
++	rx_status->freq = ah->curchan->chan->center_freq;
+ 	rx_status->antenna = rx_stats->rs_antenna;
+ 	rx_status->flag |= RX_FLAG_MACTIME_END;
+ 
+diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
+index 7f3d461f7e8d..54376fddfaf9 100644
+--- a/drivers/net/wireless/b43/b43.h
++++ b/drivers/net/wireless/b43/b43.h
+@@ -731,8 +731,6 @@ enum b43_firmware_file_type {
+ struct b43_request_fw_context {
+ 	/* The device we are requesting the fw for. */
+ 	struct b43_wldev *dev;
+-	/* a completion event structure needed if this call is asynchronous */
+-	struct completion fw_load_complete;
+ 	/* a pointer to the firmware object */
+ 	const struct firmware *blob;
+ 	/* The type of firmware to request. */
+@@ -809,6 +807,8 @@ enum {
+ struct b43_wldev {
+ 	struct b43_bus_dev *dev;
+ 	struct b43_wl *wl;
++	/* a completion event structure needed if this call is asynchronous */
++	struct completion fw_load_complete;
+ 
+ 	/* The device initialization status.
+ 	 * Use b43_status() to query. */
+diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
+index ccd24f0acb8d..c75237eb55a1 100644
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -2070,6 +2070,7 @@ void b43_do_release_fw(struct b43_firmware_file *fw)
+ 
+ static void b43_release_firmware(struct b43_wldev *dev)
+ {
++	complete(&dev->fw_load_complete);
+ 	b43_do_release_fw(&dev->fw.ucode);
+ 	b43_do_release_fw(&dev->fw.pcm);
+ 	b43_do_release_fw(&dev->fw.initvals);
+@@ -2095,7 +2096,7 @@ static void b43_fw_cb(const struct firmware *firmware, void *context)
+ 	struct b43_request_fw_context *ctx = context;
+ 
+ 	ctx->blob = firmware;
+-	complete(&ctx->fw_load_complete);
++	complete(&ctx->dev->fw_load_complete);
+ }
+ 
+ int b43_do_request_fw(struct b43_request_fw_context *ctx,
+@@ -2142,7 +2143,7 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
+ 	}
+ 	if (async) {
+ 		/* do this part asynchronously */
+-		init_completion(&ctx->fw_load_complete);
++		init_completion(&ctx->dev->fw_load_complete);
+ 		err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
+ 					      ctx->dev->dev->dev, GFP_KERNEL,
+ 					      ctx, b43_fw_cb);
+@@ -2150,12 +2151,11 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
+ 			pr_err("Unable to load firmware\n");
+ 			return err;
+ 		}
+-		/* stall here until fw ready */
+-		wait_for_completion(&ctx->fw_load_complete);
++		wait_for_completion(&ctx->dev->fw_load_complete);
+ 		if (ctx->blob)
+ 			goto fw_ready;
+ 	/* On some ARM systems, the async request will fail, but the next sync
+-	 * request works. For this reason, we dall through here
++	 * request works. For this reason, we fall through here
+ 	 */
+ 	}
+ 	err = request_firmware(&ctx->blob, ctx->fwname,
+@@ -2424,6 +2424,7 @@ error:
+ 
+ static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
+ static void b43_one_core_detach(struct b43_bus_dev *dev);
++static int b43_rng_init(struct b43_wl *wl);
+ 
+ static void b43_request_firmware(struct work_struct *work)
+ {
+@@ -2475,6 +2476,10 @@ start_ieee80211:
+ 		goto err_one_core_detach;
+ 	wl->hw_registred = true;
+ 	b43_leds_register(wl->current_dev);
++
++	/* Register HW RNG driver */
++	b43_rng_init(wl);
++
+ 	goto out;
+ 
+ err_one_core_detach:
+@@ -4636,9 +4641,6 @@ static void b43_wireless_core_exit(struct b43_wldev *dev)
+ 	if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
+ 		return;
+ 
+-	/* Unregister HW RNG driver */
+-	b43_rng_exit(dev->wl);
+-
+ 	b43_set_status(dev, B43_STAT_UNINIT);
+ 
+ 	/* Stop the microcode PSM. */
+@@ -4795,9 +4797,6 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
+ 
+ 	b43_set_status(dev, B43_STAT_INITIALIZED);
+ 
+-	/* Register HW RNG driver */
+-	b43_rng_init(dev->wl);
+-
+ out:
+ 	return err;
+ 
+@@ -5464,6 +5463,9 @@ static void b43_bcma_remove(struct bcma_device *core)
+ 
+ 	b43_one_core_detach(wldev->dev);
+ 
++	/* Unregister HW RNG driver */
++	b43_rng_exit(wl);
++
+ 	b43_leds_unregister(wl);
+ 
+ 	ieee80211_free_hw(wl->hw);
+@@ -5541,6 +5543,9 @@ static void b43_ssb_remove(struct ssb_device *sdev)
+ 
+ 	b43_one_core_detach(dev);
+ 
++	/* Unregister HW RNG driver */
++	b43_rng_exit(wl);
++
+ 	if (list_empty(&wl->devlist)) {
+ 		b43_leds_unregister(wl);
+ 		/* Last core on the chip unregistered.
+diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
+index 8cb206a89083..e85d34b76039 100644
+--- a/drivers/net/wireless/b43/xmit.c
++++ b/drivers/net/wireless/b43/xmit.c
+@@ -821,10 +821,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
+ 		 * channel number in b43. */
+ 		if (chanstat & B43_RX_CHAN_5GHZ) {
+ 			status.band = IEEE80211_BAND_5GHZ;
+-			status.freq = b43_freq_to_channel_5ghz(chanid);
++			status.freq = b43_channel_to_freq_5ghz(chanid);
+ 		} else {
+ 			status.band = IEEE80211_BAND_2GHZ;
+-			status.freq = b43_freq_to_channel_2ghz(chanid);
++			status.freq = b43_channel_to_freq_2ghz(chanid);
+ 		}
+ 		break;
+ 	default:
+diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
+index 572668821862..349c77605231 100644
+--- a/drivers/net/wireless/b43legacy/main.c
++++ b/drivers/net/wireless/b43legacy/main.c
+@@ -3919,6 +3919,7 @@ static void b43legacy_remove(struct ssb_device *dev)
+ 	 * as the ieee80211 unreg will destroy the workqueue. */
+ 	cancel_work_sync(&wldev->restart_work);
+ 	cancel_work_sync(&wl->firmware_load);
++	complete(&wldev->fw_load_complete);
+ 
+ 	B43legacy_WARN_ON(!wl);
+ 	if (!wldev->fw.ucode)
+diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
+index ff8cc75c189d..4e6dfbafc2a1 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
++++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
+@@ -272,4 +272,8 @@ static inline unsigned int SCD_QUEUE_STATUS_BITS(unsigned int chnl)
+ 
+ /*********************** END TX SCHEDULER *************************************/
+ 
++/* Oscillator clock */
++#define OSC_CLK				(0xa04068)
++#define OSC_CLK_FORCE_CONTROL		(0x8)
++
+ #endif				/* __iwl_prph_h__ */
+diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
+index 2fcc8ef88a68..1fd08baa0d32 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
++++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
+@@ -446,6 +446,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
+ 
+  out_unregister:
+ 	ieee80211_unregister_hw(mvm->hw);
++	iwl_mvm_leds_exit(mvm);
+  out_free:
+ 	iwl_phy_db_free(mvm->phy_db);
+ 	kfree(mvm->scan_cmd);
+diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
+index 6bc31003a32c..7bdaf06b8f5a 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -206,6 +206,28 @@ static int iwl_pcie_apm_init(struct iwl_trans *trans)
+ 		goto out;
+ 	}
+ 
++	if (trans->cfg->host_interrupt_operation_mode) {
++		/*
++		 * This is a bit of an abuse - This is needed for 7260 / 3160
++		 * only check host_interrupt_operation_mode even if this is
++		 * not related to host_interrupt_operation_mode.
++		 *
++		 * Enable the oscillator to count wake up time for L1 exit. This
++		 * consumes slightly more power (100uA) - but allows to be sure
++		 * that we wake up from L1 on time.
++		 *
++		 * This looks weird: read twice the same register, discard the
++		 * value, set a bit, and yet again, read that same register
++		 * just to discard the value. But that's the way the hardware
++		 * seems to like it.
++		 */
++		iwl_read_prph(trans, OSC_CLK);
++		iwl_read_prph(trans, OSC_CLK);
++		iwl_set_bits_prph(trans, OSC_CLK, OSC_CLK_FORCE_CONTROL);
++		iwl_read_prph(trans, OSC_CLK);
++		iwl_read_prph(trans, OSC_CLK);
++	}
++
+ 	/*
+ 	 * Enable DMA clock and wait for it to stabilize.
+ 	 *
+diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
+index f80f30b6160e..14f63c9f6220 100644
+--- a/drivers/net/wireless/mwifiex/fw.h
++++ b/drivers/net/wireless/mwifiex/fw.h
+@@ -226,7 +226,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
+ 
+ /* HW_SPEC fw_cap_info */
+ 
+-#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(13)|BIT(14)))
++#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(12)|BIT(13)))
+ 
+ #define GET_VHTCAP_CHWDSET(vht_cap_info)    ((vht_cap_info >> 2) & 0x3)
+ #define GET_VHTNSSMCS(mcs_mapset, nss) ((mcs_mapset >> (2 * (nss - 1))) & 0x3)
+diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
+index 8cf7d50a7603..ba48e64673d9 100644
+--- a/drivers/net/wireless/mwifiex/scan.c
++++ b/drivers/net/wireless/mwifiex/scan.c
+@@ -1681,7 +1681,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
+ 		const u8 *ie_buf;
+ 		size_t ie_len;
+ 		u16 channel = 0;
+-		u64 fw_tsf = 0;
++		__le64 fw_tsf = 0;
+ 		u16 beacon_size = 0;
+ 		u32 curr_bcn_bytes;
+ 		u32 freq;
+@@ -1815,7 +1815,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
+ 					      ie_buf, ie_len, rssi, GFP_KERNEL);
+ 				bss_priv = (struct mwifiex_bss_priv *)bss->priv;
+ 				bss_priv->band = band;
+-				bss_priv->fw_tsf = fw_tsf;
++				bss_priv->fw_tsf = le64_to_cpu(fw_tsf);
+ 				if (priv->media_connected &&
+ 				    !memcmp(bssid,
+ 					    priv->curr_bss_params.bss_descriptor
+diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
+index 9fa90a252b96..e99d8b1aa3bd 100644
+--- a/drivers/net/wireless/rtlwifi/base.c
++++ b/drivers/net/wireless/rtlwifi/base.c
+@@ -1437,7 +1437,8 @@ void rtl_watchdog_wq_callback(void *data)
+ 			/* if we can't recv beacon for 6s, we should
+ 			 * reconnect this AP
+ 			 */
+-			if (rtlpriv->link_info.roam_times >= 3) {
++			if ((rtlpriv->link_info.roam_times >= 3) &&
++			    !is_zero_ether_addr(rtlpriv->mac80211.bssid)) {
+ 				RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+ 					 "AP off, try to reconnect now\n");
+ 				rtlpriv->link_info.roam_times = 0;
+diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
+index 733b7ce7f0e2..3550e8ae34eb 100644
+--- a/drivers/net/wireless/rtlwifi/core.c
++++ b/drivers/net/wireless/rtlwifi/core.c
+@@ -46,10 +46,20 @@ void rtl_fw_cb(const struct firmware *firmware, void *context)
+ 			 "Firmware callback routine entered!\n");
+ 	complete(&rtlpriv->firmware_loading_complete);
+ 	if (!firmware) {
++		if (rtlpriv->cfg->alt_fw_name) {
++			err = request_firmware(&firmware,
++					       rtlpriv->cfg->alt_fw_name,
++					       rtlpriv->io.dev);
++			pr_info("Loading alternative firmware %s\n",
++				rtlpriv->cfg->alt_fw_name);
++			if (!err)
++				goto found_alt;
++		}
+ 		pr_err("Firmware %s not available\n", rtlpriv->cfg->fw_name);
+ 		rtlpriv->max_fw_size = 0;
+ 		return;
+ 	}
++found_alt:
+ 	if (firmware->size > rtlpriv->max_fw_size) {
+ 		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+ 			 "Firmware is too big!\n");
+@@ -184,6 +194,7 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ 					rtlpriv->cfg->maps
+ 					[RTL_IBSS_INT_MASKS]);
+ 		}
++		mac->link_state = MAC80211_LINKED;
+ 		break;
+ 	case NL80211_IFTYPE_ADHOC:
+ 		RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
+index 21a5cf060677..a6184b6e1d57 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
+@@ -1078,7 +1078,7 @@ static void rtl88e_dm_txpower_tracking_callback_thermalmeter(struct ieee80211_hw
+ 				rtldm->swing_flag_ofdm = true;
+ 			}
+ 
+-			if (rtldm->swing_idx_cck != rtldm->swing_idx_cck) {
++			if (rtldm->swing_idx_cck_cur != rtldm->swing_idx_cck) {
+ 				rtldm->swing_idx_cck_cur = rtldm->swing_idx_cck;
+ 				rtldm->swing_flag_cck = true;
+ 			}
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+index d2d57a27a7c1..06cb94cf5085 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+@@ -158,6 +158,42 @@ static const u8 cckswing_table_ch14[CCK_TABLE_SIZE][8] = {
+ 	{0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}
+ };
+ 
++static u32 power_index_reg[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a};
++
++void dm_restorepowerindex(struct ieee80211_hw *hw)
++{
++	struct rtl_priv *rtlpriv = rtl_priv(hw);
++	u8	index;
++
++	for (index = 0; index < 6; index++)
++		rtl_write_byte(rtlpriv, power_index_reg[index],
++			       rtlpriv->dm.powerindex_backup[index]);
++}
++EXPORT_SYMBOL_GPL(dm_restorepowerindex);
++
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value)
++{
++	struct rtl_priv *rtlpriv = rtl_priv(hw);
++	u8 index;
++
++	for (index = 0; index < 6; index++)
++		rtl_write_byte(rtlpriv, power_index_reg[index], value);
++}
++EXPORT_SYMBOL_GPL(dm_writepowerindex);
++
++void dm_savepowerindex(struct ieee80211_hw *hw)
++{
++	struct rtl_priv *rtlpriv = rtl_priv(hw);
++	u8 index;
++	u8 tmp;
++
++	for (index = 0; index < 6; index++) {
++		tmp = rtl_read_byte(rtlpriv, power_index_reg[index]);
++		rtlpriv->dm.powerindex_backup[index] = tmp;
++	}
++}
++EXPORT_SYMBOL_GPL(dm_savepowerindex);
++
+ static void rtl92c_dm_diginit(struct ieee80211_hw *hw)
+ {
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
+index 518e208c0180..4f232a063636 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
+@@ -91,6 +91,17 @@
+ #define TX_POWER_NEAR_FIELD_THRESH_LVL2		74
+ #define TX_POWER_NEAR_FIELD_THRESH_LVL1		67
+ 
++#define DYNAMIC_FUNC_DISABLE			0x0
++#define DYNAMIC_FUNC_DIG			BIT(0)
++#define DYNAMIC_FUNC_HP				BIT(1)
++#define DYNAMIC_FUNC_SS				BIT(2) /*Tx Power Tracking*/
++#define DYNAMIC_FUNC_BT				BIT(3)
++#define DYNAMIC_FUNC_ANT_DIV			BIT(4)
++
++#define	RSSI_CCK				0
++#define	RSSI_OFDM				1
++#define	RSSI_DEFAULT				2
++
+ struct swat_t {
+ 	u8 failure_cnt;
+ 	u8 try_flag;
+@@ -167,5 +178,8 @@ void rtl92c_phy_lc_calibrate(struct ieee80211_hw *hw);
+ void rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw, bool recovery);
+ void rtl92c_dm_dynamic_txpower(struct ieee80211_hw *hw);
+ void rtl92c_dm_bt_coexist(struct ieee80211_hw *hw);
++void dm_savepowerindex(struct ieee80211_hw *hw);
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value);
++void dm_restorepowerindex(struct ieee80211_hw *hw);
+ 
+ #endif
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
+index 16a0b9e59acf..c16209a336ea 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
+@@ -101,6 +101,15 @@ void rtl92cu_dm_dynamic_txpower(struct ieee80211_hw *hw)
+ 			 "PHY_SetTxPowerLevel8192S() Channel = %d\n",
+ 			 rtlphy->current_channel);
+ 		rtl92c_phy_set_txpower_level(hw, rtlphy->current_channel);
++		if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++		    TXHIGHPWRLEVEL_NORMAL)
++			dm_restorepowerindex(hw);
++		else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++			 TXHIGHPWRLEVEL_LEVEL1)
++			dm_writepowerindex(hw, 0x14);
++		else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++			 TXHIGHPWRLEVEL_LEVEL2)
++			dm_writepowerindex(hw, 0x10);
+ 	}
+ 
+ 	rtlpriv->dm.last_dtp_lvl = rtlpriv->dm.dynamic_txhighpower_lvl;
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
+index d947e7d350bb..fafa6bac2a3f 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
+@@ -30,3 +30,6 @@
+ #include "../rtl8192ce/dm.h"
+ 
+ void rtl92cu_dm_dynamic_txpower(struct ieee80211_hw *hw);
++void dm_savepowerindex(struct ieee80211_hw *hw);
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value);
++void dm_restorepowerindex(struct ieee80211_hw *hw);
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+index 2119313a737b..b878d56d2f4d 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+@@ -85,17 +85,15 @@ void rtl92cu_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+ 	if (mac->act_scanning) {
+ 		tx_agc[RF90_PATH_A] = 0x3f3f3f3f;
+ 		tx_agc[RF90_PATH_B] = 0x3f3f3f3f;
+-		if (turbo_scanoff) {
+-			for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+-				tx_agc[idx1] = ppowerlevel[idx1] |
+-				    (ppowerlevel[idx1] << 8) |
+-				    (ppowerlevel[idx1] << 16) |
+-				    (ppowerlevel[idx1] << 24);
+-				if (rtlhal->interface == INTF_USB) {
+-					if (tx_agc[idx1] > 0x20 &&
+-					    rtlefuse->external_pa)
+-						tx_agc[idx1] = 0x20;
+-				}
++		for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
++			tx_agc[idx1] = ppowerlevel[idx1] |
++			    (ppowerlevel[idx1] << 8) |
++			    (ppowerlevel[idx1] << 16) |
++			    (ppowerlevel[idx1] << 24);
++			if (rtlhal->interface == INTF_USB) {
++				if (tx_agc[idx1] > 0x20 &&
++				    rtlefuse->external_pa)
++					tx_agc[idx1] = 0x20;
+ 			}
+ 		}
+ 	} else {
+@@ -107,7 +105,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+ 			   TXHIGHPWRLEVEL_LEVEL2) {
+ 			tx_agc[RF90_PATH_A] = 0x00000000;
+ 			tx_agc[RF90_PATH_B] = 0x00000000;
+-		} else{
++		} else {
+ 			for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+ 				tx_agc[idx1] = ppowerlevel[idx1] |
+ 				    (ppowerlevel[idx1] << 8) |
+@@ -373,7 +371,12 @@ static void _rtl92c_write_ofdm_power_reg(struct ieee80211_hw *hw,
+ 			    regoffset == RTXAGC_B_MCS07_MCS04)
+ 				regoffset = 0xc98;
+ 			for (i = 0; i < 3; i++) {
+-				writeVal = (writeVal > 6) ? (writeVal - 6) : 0;
++				if (i != 2)
++					writeVal = (writeVal > 8) ?
++						   (writeVal - 8) : 0;
++				else
++					writeVal = (writeVal > 6) ?
++						   (writeVal - 6) : 0;
+ 				rtl_write_byte(rtlpriv, (u32)(regoffset + i),
+ 					      (u8)writeVal);
+ 			}
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index 2bd598526217..8188dcb512f0 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -49,6 +49,9 @@ MODULE_AUTHOR("Larry Finger	<Larry.Finger@××××××××.net>");
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Realtek 8192C/8188C 802.11n USB wireless");
+ MODULE_FIRMWARE("rtlwifi/rtl8192cufw.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8192cufw_A.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8192cufw_B.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8192cufw_TMSC.bin");
+ 
+ static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
+ {
+@@ -68,14 +71,21 @@ static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
+ 			 "Can't alloc buffer for fw\n");
+ 		return 1;
+ 	}
+-
++	if (IS_VENDOR_UMC_A_CUT(rtlpriv->rtlhal.version) &&
++	    !IS_92C_SERIAL(rtlpriv->rtlhal.version)) {
++		rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_A.bin";
++	} else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlpriv->rtlhal.version)) {
++		rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_B.bin";
++	} else {
++		rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_TMSC.bin";
++	}
++	/* provide name of alternative file */
++	rtlpriv->cfg->alt_fw_name = "rtlwifi/rtl8192cufw.bin";
+ 	pr_info("Loading firmware %s\n", rtlpriv->cfg->fw_name);
+ 	rtlpriv->max_fw_size = 0x4000;
+ 	err = request_firmware_nowait(THIS_MODULE, 1,
+ 				      rtlpriv->cfg->fw_name, rtlpriv->io.dev,
+ 				      GFP_KERNEL, hw, rtl_fw_cb);
+-
+-
+ 	return err;
+ }
+ 
+@@ -306,6 +316,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ 	{RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
+ 	{RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ 	{RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
++	{RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
+ 	{RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+ 	{RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
+ 	/* HP - Lite-On ,8188CUS Slim Combo */
+diff --git a/drivers/net/wireless/rtlwifi/stats.c b/drivers/net/wireless/rtlwifi/stats.c
+index 8ed31744a054..4f083fc1d360 100644
+--- a/drivers/net/wireless/rtlwifi/stats.c
++++ b/drivers/net/wireless/rtlwifi/stats.c
+@@ -176,6 +176,7 @@ static void rtl_process_pwdb(struct ieee80211_hw *hw, struct rtl_stats *pstatus)
+ 	struct rtl_sta_info *drv_priv = NULL;
+ 	struct ieee80211_sta *sta = NULL;
+ 	long undec_sm_pwdb;
++	long undec_sm_cck;
+ 
+ 	rcu_read_lock();
+ 	if (rtlpriv->mac80211.opmode != NL80211_IFTYPE_STATION)
+@@ -185,12 +186,16 @@ static void rtl_process_pwdb(struct ieee80211_hw *hw, struct rtl_stats *pstatus)
+ 	if (sta) {
+ 		drv_priv = (struct rtl_sta_info *) sta->drv_priv;
+ 		undec_sm_pwdb = drv_priv->rssi_stat.undec_sm_pwdb;
++		undec_sm_cck = drv_priv->rssi_stat.undec_sm_cck;
+ 	} else {
+ 		undec_sm_pwdb = rtlpriv->dm.undec_sm_pwdb;
++		undec_sm_cck = rtlpriv->dm.undec_sm_cck;
+ 	}
+ 
+ 	if (undec_sm_pwdb < 0)
+ 		undec_sm_pwdb = pstatus->rx_pwdb_all;
++	if (undec_sm_cck < 0)
++		undec_sm_cck = pstatus->rx_pwdb_all;
+ 	if (pstatus->rx_pwdb_all > (u32) undec_sm_pwdb) {
+ 		undec_sm_pwdb = (((undec_sm_pwdb) *
+ 		      (RX_SMOOTH_FACTOR - 1)) +
+@@ -200,6 +205,15 @@ static void rtl_process_pwdb(struct ieee80211_hw *hw, struct rtl_stats *pstatus)
+ 		undec_sm_pwdb = (((undec_sm_pwdb) * (RX_SMOOTH_FACTOR - 1)) +
+ 		     (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
+ 	}
++	if (pstatus->rx_pwdb_all > (u32) undec_sm_cck) {
++		undec_sm_cck = (((undec_sm_pwdb) *
++		      (RX_SMOOTH_FACTOR - 1)) +
++		     (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
++		undec_sm_cck = undec_sm_cck + 1;
++	} else {
++		undec_sm_pwdb = (((undec_sm_cck) * (RX_SMOOTH_FACTOR - 1)) +
++		     (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
++	}
+ 
+ 	if (sta) {
+ 		drv_priv->rssi_stat.undec_sm_pwdb = undec_sm_pwdb;
+diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
+index e56778cac9bf..97924743ecf6 100644
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -484,6 +484,8 @@ static void _rtl_usb_rx_process_agg(struct ieee80211_hw *hw,
+ 			if (unicast)
+ 				rtlpriv->link_info.num_rx_inperiod++;
+ 		}
++		/* static bcn for roaming */
++		rtl_beacon_statistic(hw, skb);
+ 	}
+ }
+ 
+@@ -555,7 +557,7 @@ static void _rtl_rx_pre_process(struct ieee80211_hw *hw, struct sk_buff *skb)
+ 	}
+ }
+ 
+-#define __RX_SKB_MAX_QUEUED	32
++#define __RX_SKB_MAX_QUEUED	64
+ 
+ static void _rtl_rx_work(unsigned long param)
+ {
+diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
+index ad9c37a42709..e576a927fde7 100644
+--- a/drivers/net/wireless/rtlwifi/wifi.h
++++ b/drivers/net/wireless/rtlwifi/wifi.h
+@@ -1035,6 +1035,7 @@ struct rtl_ht_agg {
+ 
+ struct rssi_sta {
+ 	long undec_sm_pwdb;
++	long undec_sm_cck;
+ };
+ 
+ struct rtl_tid_data {
+@@ -1325,8 +1326,10 @@ struct fast_ant_training {
+ struct rtl_dm {
+ 	/*PHY status for Dynamic Management */
+ 	long entry_min_undec_sm_pwdb;
++	long undec_sm_cck;
+ 	long undec_sm_pwdb;	/*out dm */
+ 	long entry_max_undec_sm_pwdb;
++	s32 ofdm_pkt_cnt;
+ 	bool dm_initialgain_enable;
+ 	bool dynamic_txpower_enable;
+ 	bool current_turbo_edca;
+@@ -1341,6 +1344,7 @@ struct rtl_dm {
+ 	bool inform_fw_driverctrldm;
+ 	bool current_mrc_switch;
+ 	u8 txpowercount;
++	u8 powerindex_backup[6];
+ 
+ 	u8 thermalvalue_rxgain;
+ 	u8 thermalvalue_iqk;
+@@ -1352,7 +1356,9 @@ struct rtl_dm {
+ 	bool done_txpower;
+ 	u8 dynamic_txhighpower_lvl;	/*Tx high power level */
+ 	u8 dm_flag;		/*Indicate each dynamic mechanism's status. */
++	u8 dm_flag_tmp;
+ 	u8 dm_type;
++	u8 dm_rssi_sel;
+ 	u8 txpower_track_control;
+ 	bool interrupt_migration;
+ 	bool disable_tx_int;
+@@ -1806,6 +1812,7 @@ struct rtl_hal_cfg {
+ 	bool write_readback;
+ 	char *name;
+ 	char *fw_name;
++	char *alt_fw_name;
+ 	struct rtl_hal_ops *ops;
+ 	struct rtl_mod_params *mod_params;
+ 	struct rtl_hal_usbint_cfg *usb_interface_cfg;
+@@ -1950,6 +1957,7 @@ struct dig_t {
+ 	u8 pre_ccastate;
+ 	u8 cur_ccasate;
+ 	u8 large_fa_hit;
++	u8 dig_dynamic_min;
+ 	u8 forbidden_igi;
+ 	u8 dig_state;
+ 	u8 dig_highpwrstate;
+@@ -2030,22 +2038,15 @@ struct rtl_priv {
+ 	struct dig_t dm_digtable;
+ 	struct ps_t dm_pstable;
+ 
+-	/* section shared by individual drivers */
+-	union {
+-		struct {	/* data buffer pointer for USB reads */
+-			__le32 *usb_data;
+-			int usb_data_index;
+-			bool initialized;
+-		};
+-		struct {	/* section for 8723ae */
+-			bool reg_init;	/* true if regs saved */
+-			u32 reg_874;
+-			u32 reg_c70;
+-			u32 reg_85c;
+-			u32 reg_a74;
+-			bool bt_operation_on;
+-		};
+-	};
++	u32 reg_874;
++	u32 reg_c70;
++	u32 reg_85c;
++	u32 reg_a74;
++	bool reg_init;	/* true if regs saved */
++	bool bt_operation_on;
++	__le32 *usb_data;
++	int usb_data_index;
++	bool initialized;
+ 	bool enter_ps;	/* true when entering PS */
+ 	u8 rate_mask[5];
+ 
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 36808bf25677..3f0f20081979 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -117,6 +117,7 @@ struct netfront_info {
+ 	} tx_skbs[NET_TX_RING_SIZE];
+ 	grant_ref_t gref_tx_head;
+ 	grant_ref_t grant_tx_ref[NET_TX_RING_SIZE];
++	struct page *grant_tx_page[NET_TX_RING_SIZE];
+ 	unsigned tx_skb_freelist;
+ 
+ 	spinlock_t   rx_lock ____cacheline_aligned_in_smp;
+@@ -395,6 +396,7 @@ static void xennet_tx_buf_gc(struct net_device *dev)
+ 			gnttab_release_grant_reference(
+ 				&np->gref_tx_head, np->grant_tx_ref[id]);
+ 			np->grant_tx_ref[id] = GRANT_INVALID_REF;
++			np->grant_tx_page[id] = NULL;
+ 			add_id_to_freelist(&np->tx_skb_freelist, np->tx_skbs, id);
+ 			dev_kfree_skb_irq(skb);
+ 		}
+@@ -451,6 +453,7 @@ static void xennet_make_frags(struct sk_buff *skb, struct net_device *dev,
+ 		gnttab_grant_foreign_access_ref(ref, np->xbdev->otherend_id,
+ 						mfn, GNTMAP_readonly);
+ 
++		np->grant_tx_page[id] = virt_to_page(data);
+ 		tx->gref = np->grant_tx_ref[id] = ref;
+ 		tx->offset = offset;
+ 		tx->size = len;
+@@ -496,6 +499,7 @@ static void xennet_make_frags(struct sk_buff *skb, struct net_device *dev,
+ 							np->xbdev->otherend_id,
+ 							mfn, GNTMAP_readonly);
+ 
++			np->grant_tx_page[id] = page;
+ 			tx->gref = np->grant_tx_ref[id] = ref;
+ 			tx->offset = offset;
+ 			tx->size = bytes;
+@@ -595,6 +599,7 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	mfn = virt_to_mfn(data);
+ 	gnttab_grant_foreign_access_ref(
+ 		ref, np->xbdev->otherend_id, mfn, GNTMAP_readonly);
++	np->grant_tx_page[id] = virt_to_page(data);
+ 	tx->gref = np->grant_tx_ref[id] = ref;
+ 	tx->offset = offset;
+ 	tx->size = len;
+@@ -1119,10 +1124,11 @@ static void xennet_release_tx_bufs(struct netfront_info *np)
+ 			continue;
+ 
+ 		skb = np->tx_skbs[i].skb;
+-		gnttab_end_foreign_access_ref(np->grant_tx_ref[i],
+-					      GNTMAP_readonly);
+-		gnttab_release_grant_reference(&np->gref_tx_head,
+-					       np->grant_tx_ref[i]);
++		get_page(np->grant_tx_page[i]);
++		gnttab_end_foreign_access(np->grant_tx_ref[i],
++					  GNTMAP_readonly,
++					  (unsigned long)page_address(np->grant_tx_page[i]));
++		np->grant_tx_page[i] = NULL;
+ 		np->grant_tx_ref[i] = GRANT_INVALID_REF;
+ 		add_id_to_freelist(&np->tx_skb_freelist, np->tx_skbs, i);
+ 		dev_kfree_skb_irq(skb);
+@@ -1131,78 +1137,35 @@ static void xennet_release_tx_bufs(struct netfront_info *np)
+ 
+ static void xennet_release_rx_bufs(struct netfront_info *np)
+ {
+-	struct mmu_update      *mmu = np->rx_mmu;
+-	struct multicall_entry *mcl = np->rx_mcl;
+-	struct sk_buff_head free_list;
+-	struct sk_buff *skb;
+-	unsigned long mfn;
+-	int xfer = 0, noxfer = 0, unused = 0;
+ 	int id, ref;
+ 
+-	dev_warn(&np->netdev->dev, "%s: fix me for copying receiver.\n",
+-			 __func__);
+-	return;
+-
+-	skb_queue_head_init(&free_list);
+-
+ 	spin_lock_bh(&np->rx_lock);
+ 
+ 	for (id = 0; id < NET_RX_RING_SIZE; id++) {
+-		ref = np->grant_rx_ref[id];
+-		if (ref == GRANT_INVALID_REF) {
+-			unused++;
+-			continue;
+-		}
++		struct sk_buff *skb;
++		struct page *page;
+ 
+ 		skb = np->rx_skbs[id];
+-		mfn = gnttab_end_foreign_transfer_ref(ref);
+-		gnttab_release_grant_reference(&np->gref_rx_head, ref);
+-		np->grant_rx_ref[id] = GRANT_INVALID_REF;
+-
+-		if (0 == mfn) {
+-			skb_shinfo(skb)->nr_frags = 0;
+-			dev_kfree_skb(skb);
+-			noxfer++;
++		if (!skb)
+ 			continue;
+-		}
+ 
+-		if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+-			/* Remap the page. */
+-			const struct page *page =
+-				skb_frag_page(&skb_shinfo(skb)->frags[0]);
+-			unsigned long pfn = page_to_pfn(page);
+-			void *vaddr = page_address(page);
++		ref = np->grant_rx_ref[id];
++		if (ref == GRANT_INVALID_REF)
++			continue;
+ 
+-			MULTI_update_va_mapping(mcl, (unsigned long)vaddr,
+-						mfn_pte(mfn, PAGE_KERNEL),
+-						0);
+-			mcl++;
+-			mmu->ptr = ((u64)mfn << PAGE_SHIFT)
+-				| MMU_MACHPHYS_UPDATE;
+-			mmu->val = pfn;
+-			mmu++;
++		page = skb_frag_page(&skb_shinfo(skb)->frags[0]);
+ 
+-			set_phys_to_machine(pfn, mfn);
+-		}
+-		__skb_queue_tail(&free_list, skb);
+-		xfer++;
+-	}
+-
+-	dev_info(&np->netdev->dev, "%s: %d xfer, %d noxfer, %d unused\n",
+-		 __func__, xfer, noxfer, unused);
++		/* gnttab_end_foreign_access() needs a page ref until
++		 * foreign access is ended (which may be deferred).
++		 */
++		get_page(page);
++		gnttab_end_foreign_access(ref, 0,
++					  (unsigned long)page_address(page));
++		np->grant_rx_ref[id] = GRANT_INVALID_REF;
+ 
+-	if (xfer) {
+-		if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+-			/* Do all the remapping work and M2P updates. */
+-			MULTI_mmu_update(mcl, np->rx_mmu, mmu - np->rx_mmu,
+-					 NULL, DOMID_SELF);
+-			mcl++;
+-			HYPERVISOR_multicall(np->rx_mcl, mcl - np->rx_mcl);
+-		}
++		kfree_skb(skb);
+ 	}
+ 
+-	__skb_queue_purge(&free_list);
+-
+ 	spin_unlock_bh(&np->rx_lock);
+ }
+ 
+@@ -1349,6 +1312,7 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
+ 	for (i = 0; i < NET_RX_RING_SIZE; i++) {
+ 		np->rx_skbs[i] = NULL;
+ 		np->grant_rx_ref[i] = GRANT_INVALID_REF;
++		np->grant_tx_page[i] = NULL;
+ 	}
+ 
+ 	/* A grant for every tx ring slot */
+diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
+index 903e1285fda0..b0a0d5389f41 100644
+--- a/drivers/parport/parport_pc.c
++++ b/drivers/parport/parport_pc.c
+@@ -2596,8 +2596,6 @@ enum parport_pc_pci_cards {
+ 	syba_2p_epp,
+ 	syba_1p_ecp,
+ 	titan_010l,
+-	titan_1284p1,
+-	titan_1284p2,
+ 	avlab_1p,
+ 	avlab_2p,
+ 	oxsemi_952,
+@@ -2656,8 +2654,6 @@ static struct parport_pc_pci {
+ 	/* syba_2p_epp AP138B */	{ 2, { { 0, 0x078 }, { 0, 0x178 }, } },
+ 	/* syba_1p_ecp W83787 */	{ 1, { { 0, 0x078 }, } },
+ 	/* titan_010l */		{ 1, { { 3, -1 }, } },
+-	/* titan_1284p1 */              { 1, { { 0, 1 }, } },
+-	/* titan_1284p2 */		{ 2, { { 0, 1 }, { 2, 3 }, } },
+ 	/* avlab_1p		*/	{ 1, { { 0, 1}, } },
+ 	/* avlab_2p		*/	{ 2, { { 0, 1}, { 2, 3 },} },
+ 	/* The Oxford Semi cards are unusual: 954 doesn't support ECP,
+@@ -2673,8 +2669,8 @@ static struct parport_pc_pci {
+ 	/* netmos_9705 */               { 1, { { 0, -1 }, } },
+ 	/* netmos_9715 */               { 2, { { 0, 1 }, { 2, 3 },} },
+ 	/* netmos_9755 */               { 2, { { 0, 1 }, { 2, 3 },} },
+-	/* netmos_9805 */               { 1, { { 0, -1 }, } },
+-	/* netmos_9815 */               { 2, { { 0, -1 }, { 2, -1 }, } },
++	/* netmos_9805 */		{ 1, { { 0, 1 }, } },
++	/* netmos_9815 */		{ 2, { { 0, 1 }, { 2, 3 }, } },
+ 	/* netmos_9901 */               { 1, { { 0, -1 }, } },
+ 	/* netmos_9865 */               { 1, { { 0, -1 }, } },
+ 	/* quatech_sppxp100 */		{ 1, { { 0, 1 }, } },
+@@ -2718,8 +2714,6 @@ static const struct pci_device_id parport_pc_pci_tbl[] = {
+ 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, syba_1p_ecp },
+ 	{ PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_010L,
+ 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, titan_010l },
+-	{ 0x9710, 0x9805, 0x1000, 0x0010, 0, 0, titan_1284p1 },
+-	{ 0x9710, 0x9815, 0x1000, 0x0020, 0, 0, titan_1284p2 },
+ 	/* PCI_VENDOR_ID_AVLAB/Intek21 has another bunch of cards ...*/
+ 	/* AFAVLAB_TK9902 */
+ 	{ 0x14db, 0x2120, PCI_ANY_ID, PCI_ANY_ID, 0, 0, avlab_1p},
+diff --git a/drivers/pinctrl/pinctrl-sunxi.c b/drivers/pinctrl/pinctrl-sunxi.c
+index 119d2ddedfe7..6ebf3067bde4 100644
+--- a/drivers/pinctrl/pinctrl-sunxi.c
++++ b/drivers/pinctrl/pinctrl-sunxi.c
+@@ -469,12 +469,6 @@ static int sunxi_pinctrl_gpio_get(struct gpio_chip *chip, unsigned offset)
+ 	return val;
+ }
+ 
+-static int sunxi_pinctrl_gpio_direction_output(struct gpio_chip *chip,
+-					unsigned offset, int value)
+-{
+-	return pinctrl_gpio_direction_output(chip->base + offset);
+-}
+-
+ static void sunxi_pinctrl_gpio_set(struct gpio_chip *chip,
+ 				unsigned offset, int value)
+ {
+@@ -498,6 +492,13 @@ static void sunxi_pinctrl_gpio_set(struct gpio_chip *chip,
+ 	spin_unlock_irqrestore(&pctl->lock, flags);
+ }
+ 
++static int sunxi_pinctrl_gpio_direction_output(struct gpio_chip *chip,
++					unsigned offset, int value)
++{
++	sunxi_pinctrl_gpio_set(chip, offset, value);
++	return pinctrl_gpio_direction_output(chip->base + offset);
++}
++
+ static int sunxi_pinctrl_gpio_of_xlate(struct gpio_chip *gc,
+ 				const struct of_phandle_args *gpiospec,
+ 				u32 *flags)
+diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
+index a8e43cf70fac..0ed96df20162 100644
+--- a/drivers/platform/x86/hp_accel.c
++++ b/drivers/platform/x86/hp_accel.c
+@@ -77,6 +77,7 @@ static inline void delayed_sysfs_set(struct led_classdev *led_cdev,
+ static struct acpi_device_id lis3lv02d_device_ids[] = {
+ 	{"HPQ0004", 0}, /* HP Mobile Data Protection System PNP */
+ 	{"HPQ6000", 0}, /* HP Mobile Data Protection System PNP */
++	{"HPQ6007", 0}, /* HP Mobile Data Protection System PNP */
+ 	{"", 0},
+ };
+ MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids);
+diff --git a/drivers/rtc/rtc-max8907.c b/drivers/rtc/rtc-max8907.c
+index 8e45b3c4aa2f..3032178bd9e6 100644
+--- a/drivers/rtc/rtc-max8907.c
++++ b/drivers/rtc/rtc-max8907.c
+@@ -51,7 +51,7 @@ static irqreturn_t max8907_irq_handler(int irq, void *data)
+ {
+ 	struct max8907_rtc *rtc = data;
+ 
+-	regmap_update_bits(rtc->regmap, MAX8907_REG_ALARM0_CNTL, 0x7f, 0);
++	regmap_write(rtc->regmap, MAX8907_REG_ALARM0_CNTL, 0);
+ 
+ 	rtc_update_irq(rtc->rtc_dev, 1, RTC_IRQF | RTC_AF);
+ 
+@@ -64,7 +64,7 @@ static void regs_to_tm(u8 *regs, struct rtc_time *tm)
+ 		bcd2bin(regs[RTC_YEAR1]) - 1900;
+ 	tm->tm_mon = bcd2bin(regs[RTC_MONTH] & 0x1f) - 1;
+ 	tm->tm_mday = bcd2bin(regs[RTC_DATE] & 0x3f);
+-	tm->tm_wday = (regs[RTC_WEEKDAY] & 0x07) - 1;
++	tm->tm_wday = (regs[RTC_WEEKDAY] & 0x07);
+ 	if (regs[RTC_HOUR] & HOUR_12) {
+ 		tm->tm_hour = bcd2bin(regs[RTC_HOUR] & 0x01f);
+ 		if (tm->tm_hour == 12)
+@@ -88,7 +88,7 @@ static void tm_to_regs(struct rtc_time *tm, u8 *regs)
+ 	regs[RTC_YEAR1] = bin2bcd(low);
+ 	regs[RTC_MONTH] = bin2bcd(tm->tm_mon + 1);
+ 	regs[RTC_DATE] = bin2bcd(tm->tm_mday);
+-	regs[RTC_WEEKDAY] = tm->tm_wday + 1;
++	regs[RTC_WEEKDAY] = tm->tm_wday;
+ 	regs[RTC_HOUR] = bin2bcd(tm->tm_hour);
+ 	regs[RTC_MIN] = bin2bcd(tm->tm_min);
+ 	regs[RTC_SEC] = bin2bcd(tm->tm_sec);
+@@ -153,7 +153,7 @@ static int max8907_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 	tm_to_regs(&alrm->time, regs);
+ 
+ 	/* Disable alarm while we update the target time */
+-	ret = regmap_update_bits(rtc->regmap, MAX8907_REG_ALARM0_CNTL, 0x7f, 0);
++	ret = regmap_write(rtc->regmap, MAX8907_REG_ALARM0_CNTL, 0);
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -163,8 +163,7 @@ static int max8907_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 		return ret;
+ 
+ 	if (alrm->enabled)
+-		ret = regmap_update_bits(rtc->regmap, MAX8907_REG_ALARM0_CNTL,
+-					 0x7f, 0x7f);
++		ret = regmap_write(rtc->regmap, MAX8907_REG_ALARM0_CNTL, 0x77);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c
+index f8ca7becacca..8ebab9c64be4 100644
+--- a/drivers/scsi/bfa/bfad.c
++++ b/drivers/scsi/bfa/bfad.c
+@@ -1832,7 +1832,7 @@ out:
+ static u32 *
+ bfad_load_fwimg(struct pci_dev *pdev)
+ {
+-	if (pdev->device == BFA_PCI_DEVICE_ID_CT2) {
++	if (bfa_asic_id_ct2(pdev->device)) {
+ 		if (bfi_image_ct2_size == 0)
+ 			bfad_read_firmware(pdev, &bfi_image_ct2,
+ 				&bfi_image_ct2_size, BFAD_FW_FILE_CT2);
+@@ -1842,12 +1842,14 @@ bfad_load_fwimg(struct pci_dev *pdev)
+ 			bfad_read_firmware(pdev, &bfi_image_ct,
+ 				&bfi_image_ct_size, BFAD_FW_FILE_CT);
+ 		return bfi_image_ct;
+-	} else {
++	} else if (bfa_asic_id_cb(pdev->device)) {
+ 		if (bfi_image_cb_size == 0)
+ 			bfad_read_firmware(pdev, &bfi_image_cb,
+ 				&bfi_image_cb_size, BFAD_FW_FILE_CB);
+ 		return bfi_image_cb;
+ 	}
++
++	return NULL;
+ }
+ 
+ static void
+diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
+index 74b88efde6ad..b26f1a5cc0ec 100644
+--- a/drivers/scsi/virtio_scsi.c
++++ b/drivers/scsi/virtio_scsi.c
+@@ -957,6 +957,10 @@ static void virtscsi_remove(struct virtio_device *vdev)
+ #ifdef CONFIG_PM
+ static int virtscsi_freeze(struct virtio_device *vdev)
+ {
++	struct Scsi_Host *sh = virtio_scsi_host(vdev);
++	struct virtio_scsi *vscsi = shost_priv(sh);
++
++	unregister_hotcpu_notifier(&vscsi->nb);
+ 	virtscsi_remove_vqs(vdev);
+ 	return 0;
+ }
+@@ -965,8 +969,17 @@ static int virtscsi_restore(struct virtio_device *vdev)
+ {
+ 	struct Scsi_Host *sh = virtio_scsi_host(vdev);
+ 	struct virtio_scsi *vscsi = shost_priv(sh);
++	int err;
++
++	err = virtscsi_init(vdev, vscsi);
++	if (err)
++		return err;
++
++	err = register_hotcpu_notifier(&vscsi->nb);
++	if (err)
++		vdev->config->del_vqs(vdev);
+ 
+-	return virtscsi_init(vdev, vscsi);
++	return err;
+ }
+ #endif
+ 
+diff --git a/drivers/staging/lustre/lustre/ptlrpc/niobuf.c b/drivers/staging/lustre/lustre/ptlrpc/niobuf.c
+index a0e009717a5a..d6047b9535ae 100644
+--- a/drivers/staging/lustre/lustre/ptlrpc/niobuf.c
++++ b/drivers/staging/lustre/lustre/ptlrpc/niobuf.c
+@@ -179,7 +179,7 @@ int ptlrpc_register_bulk(struct ptlrpc_request *req)
+ 				  LNET_UNLINK, LNET_INS_AFTER, &me_h);
+ 		if (rc != 0) {
+ 			CERROR("%s: LNetMEAttach failed x"LPU64"/%d: rc = %d\n",
+-			       desc->bd_export->exp_obd->obd_name, xid,
++			       desc->bd_import->imp_obd->obd_name, xid,
+ 			       posted_md, rc);
+ 			break;
+ 		}
+@@ -189,7 +189,7 @@ int ptlrpc_register_bulk(struct ptlrpc_request *req)
+ 				  &desc->bd_mds[posted_md]);
+ 		if (rc != 0) {
+ 			CERROR("%s: LNetMDAttach failed x"LPU64"/%d: rc = %d\n",
+-			       desc->bd_export->exp_obd->obd_name, xid,
++			       desc->bd_import->imp_obd->obd_name, xid,
+ 			       posted_md, rc);
+ 			rc2 = LNetMEUnlink(me_h);
+ 			LASSERT(rc2 == 0);
+@@ -219,7 +219,7 @@ int ptlrpc_register_bulk(struct ptlrpc_request *req)
+ 	/* Holler if peer manages to touch buffers before he knows the xid */
+ 	if (desc->bd_md_count != total_md)
+ 		CWARN("%s: Peer %s touched %d buffers while I registered\n",
+-		      desc->bd_export->exp_obd->obd_name, libcfs_id2str(peer),
++		      desc->bd_import->imp_obd->obd_name, libcfs_id2str(peer),
+ 		      total_md - desc->bd_md_count);
+ 	spin_unlock(&desc->bd_lock);
+ 
+diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
+index c812d6c7dc31..e3a005da776b 100644
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -358,6 +358,10 @@ static u8 key_2char2num(u8 hch, u8 lch)
+ 	return (hex_to_bin(hch) << 4) | hex_to_bin(lch);
+ }
+ 
++static const struct device_type wlan_type = {
++	.name = "wlan",
++};
++
+ /*
+  * drv_init() - a device potentially for us
+  *
+@@ -393,6 +397,7 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
+ 	padapter->pusb_intf = pusb_intf;
+ 	usb_set_intfdata(pusb_intf, pnetdev);
+ 	SET_NETDEV_DEV(pnetdev, &pusb_intf->dev);
++	pnetdev->dev.type = &wlan_type;
+ 	/* step 2. */
+ 	padapter->dvobj_init = &r8712_usb_dvobj_init;
+ 	padapter->dvobj_deinit = &r8712_usb_dvobj_deinit;
+diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c
+index 4aa5ef54b683..22e117440f94 100644
+--- a/drivers/staging/vt6656/baseband.c
++++ b/drivers/staging/vt6656/baseband.c
+@@ -1464,7 +1464,6 @@ void BBvUpdatePreEDThreshold(struct vnt_private *pDevice, int bScanning)
+ 
+             if( bScanning )
+             {   // need Max sensitivity //RSSI -69, -70,....
+-                if(pDevice->byBBPreEDIndex == 0) break;
+                 pDevice->byBBPreEDIndex = 0;
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x30); //CR206(0xCE)
+@@ -1607,7 +1606,6 @@ void BBvUpdatePreEDThreshold(struct vnt_private *pDevice, int bScanning)
+ 
+             if( bScanning )
+             {   // need Max sensitivity  //RSSI -69, -70, ...
+-                if(pDevice->byBBPreEDIndex == 0) break;
+                 pDevice->byBBPreEDIndex = 0;
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x24); //CR206(0xCE)
+@@ -1759,7 +1757,6 @@ void BBvUpdatePreEDThreshold(struct vnt_private *pDevice, int bScanning)
+         case RF_VT3342A0: //RobertYu:20060627, testing table
+             if( bScanning )
+             {   // need Max sensitivity  //RSSI -67, -68, ...
+-                if(pDevice->byBBPreEDIndex == 0) break;
+                 pDevice->byBBPreEDIndex = 0;
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x38); //CR206(0xCE)
+diff --git a/drivers/staging/vt6656/card.c b/drivers/staging/vt6656/card.c
+index 19d3cf451b88..34a24b78c1a7 100644
+--- a/drivers/staging/vt6656/card.c
++++ b/drivers/staging/vt6656/card.c
+@@ -731,7 +731,7 @@ u64 CARDqGetNextTBTT(u64 qwTSF, u16 wBeaconInterval)
+ 
+     uBeaconInterval = wBeaconInterval * 1024;
+     // Next TBTT = ((local_current_TSF / beacon_interval) + 1 ) * beacon_interval
+-	uLowNextTBTT = ((qwTSF & 0xffffffffU) >> 10) << 10;
++	uLowNextTBTT = ((qwTSF & 0xffffffffULL) >> 10) << 10;
+ 	uLowRemain = (uLowNextTBTT) % uBeaconInterval;
+ 	uHighRemain = ((0x80000000 % uBeaconInterval) * 2 * (u32)(qwTSF >> 32))
+ 		% uBeaconInterval;
+diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
+index e06ec4393803..d7ac040e0dc1 100644
+--- a/drivers/staging/zram/zram_drv.c
++++ b/drivers/staging/zram/zram_drv.c
+@@ -552,14 +552,14 @@ static void zram_reset_device(struct zram *zram, bool reset_capacity)
+ 	size_t index;
+ 	struct zram_meta *meta;
+ 
+-	flush_work(&zram->free_work);
+-
+ 	down_write(&zram->init_lock);
+ 	if (!zram->init_done) {
+ 		up_write(&zram->init_lock);
+ 		return;
+ 	}
+ 
++	flush_work(&zram->free_work);
++
+ 	meta = zram->meta;
+ 	zram->init_done = 0;
+ 
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index d5c724b317aa..e12f2aab3c87 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -52,7 +52,7 @@
+ static LIST_HEAD(g_tiqn_list);
+ static LIST_HEAD(g_np_list);
+ static DEFINE_SPINLOCK(tiqn_lock);
+-static DEFINE_SPINLOCK(np_lock);
++static DEFINE_MUTEX(np_lock);
+ 
+ static struct idr tiqn_idr;
+ struct idr sess_idr;
+@@ -307,6 +307,9 @@ bool iscsit_check_np_match(
+ 	return false;
+ }
+ 
++/*
++ * Called with mutex np_lock held
++ */
+ static struct iscsi_np *iscsit_get_np(
+ 	struct __kernel_sockaddr_storage *sockaddr,
+ 	int network_transport)
+@@ -314,11 +317,10 @@ static struct iscsi_np *iscsit_get_np(
+ 	struct iscsi_np *np;
+ 	bool match;
+ 
+-	spin_lock_bh(&np_lock);
+ 	list_for_each_entry(np, &g_np_list, np_list) {
+-		spin_lock(&np->np_thread_lock);
++		spin_lock_bh(&np->np_thread_lock);
+ 		if (np->np_thread_state != ISCSI_NP_THREAD_ACTIVE) {
+-			spin_unlock(&np->np_thread_lock);
++			spin_unlock_bh(&np->np_thread_lock);
+ 			continue;
+ 		}
+ 
+@@ -330,13 +332,11 @@ static struct iscsi_np *iscsit_get_np(
+ 			 * while iscsi_tpg_add_network_portal() is called.
+ 			 */
+ 			np->np_exports++;
+-			spin_unlock(&np->np_thread_lock);
+-			spin_unlock_bh(&np_lock);
++			spin_unlock_bh(&np->np_thread_lock);
+ 			return np;
+ 		}
+-		spin_unlock(&np->np_thread_lock);
++		spin_unlock_bh(&np->np_thread_lock);
+ 	}
+-	spin_unlock_bh(&np_lock);
+ 
+ 	return NULL;
+ }
+@@ -350,16 +350,22 @@ struct iscsi_np *iscsit_add_np(
+ 	struct sockaddr_in6 *sock_in6;
+ 	struct iscsi_np *np;
+ 	int ret;
++
++	mutex_lock(&np_lock);
++
+ 	/*
+ 	 * Locate the existing struct iscsi_np if already active..
+ 	 */
+ 	np = iscsit_get_np(sockaddr, network_transport);
+-	if (np)
++	if (np) {
++		mutex_unlock(&np_lock);
+ 		return np;
++	}
+ 
+ 	np = kzalloc(sizeof(struct iscsi_np), GFP_KERNEL);
+ 	if (!np) {
+ 		pr_err("Unable to allocate memory for struct iscsi_np\n");
++		mutex_unlock(&np_lock);
+ 		return ERR_PTR(-ENOMEM);
+ 	}
+ 
+@@ -382,6 +388,7 @@ struct iscsi_np *iscsit_add_np(
+ 	ret = iscsi_target_setup_login_socket(np, sockaddr);
+ 	if (ret != 0) {
+ 		kfree(np);
++		mutex_unlock(&np_lock);
+ 		return ERR_PTR(ret);
+ 	}
+ 
+@@ -390,6 +397,7 @@ struct iscsi_np *iscsit_add_np(
+ 		pr_err("Unable to create kthread: iscsi_np\n");
+ 		ret = PTR_ERR(np->np_thread);
+ 		kfree(np);
++		mutex_unlock(&np_lock);
+ 		return ERR_PTR(ret);
+ 	}
+ 	/*
+@@ -400,10 +408,10 @@ struct iscsi_np *iscsit_add_np(
+ 	 * point because iscsi_np has not been added to g_np_list yet.
+ 	 */
+ 	np->np_exports = 1;
++	np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
+ 
+-	spin_lock_bh(&np_lock);
+ 	list_add_tail(&np->np_list, &g_np_list);
+-	spin_unlock_bh(&np_lock);
++	mutex_unlock(&np_lock);
+ 
+ 	pr_debug("CORE[0] - Added Network Portal: %s:%hu on %s\n",
+ 		np->np_ip, np->np_port, np->np_transport->name);
+@@ -470,9 +478,9 @@ int iscsit_del_np(struct iscsi_np *np)
+ 
+ 	np->np_transport->iscsit_free_np(np);
+ 
+-	spin_lock_bh(&np_lock);
++	mutex_lock(&np_lock);
+ 	list_del(&np->np_list);
+-	spin_unlock_bh(&np_lock);
++	mutex_unlock(&np_lock);
+ 
+ 	pr_debug("CORE[0] - Removed Network Portal: %s:%hu on %s\n",
+ 		np->np_ip, np->np_port, np->np_transport->name);
+diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
+index a972145dbaaa..76dc32fc5e1b 100644
+--- a/drivers/target/iscsi/iscsi_target_nego.c
++++ b/drivers/target/iscsi/iscsi_target_nego.c
+@@ -1192,7 +1192,7 @@ get_target:
+ 	 */
+ alloc_tags:
+ 	tag_num = max_t(u32, ISCSIT_MIN_TAGS, queue_depth);
+-	tag_num += (tag_num / 2) + ISCSIT_EXTRA_TAGS;
++	tag_num = (tag_num * 2) + ISCSIT_EXTRA_TAGS;
+ 	tag_size = sizeof(struct iscsi_cmd) + conn->conn_transport->priv_size;
+ 
+ 	ret = transport_alloc_session_tags(sess->se_sess, tag_num, tag_size);
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index 570df9d2a5d2..4f6e01cf67f7 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -2670,6 +2670,10 @@ static void serial8250_config_port(struct uart_port *port, int flags)
+ 	if (port->type == PORT_16550A && port->iotype == UPIO_AU)
+ 		up->bugs |= UART_BUG_NOMSR;
+ 
++	/* HW bugs may trigger IRQ while IIR == NO_INT */
++	if (port->type == PORT_TEGRA)
++		up->bugs |= UART_BUG_NOMSR;
++
+ 	if (port->type != PORT_UNKNOWN && flags & UART_CONFIG_IRQ)
+ 		autoconfig_irq(up);
+ 
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index c810da7c7a88..f5df8b7067ad 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1260,10 +1260,10 @@ static int pci_quatech_init(struct pci_dev *dev)
+ 		unsigned long base = pci_resource_start(dev, 0);
+ 		if (base) {
+ 			u32 tmp;
+-			outl(inl(base + 0x38), base + 0x38);
++			outl(inl(base + 0x38) | 0x00002000, base + 0x38);
+ 			tmp = inl(base + 0x3c);
+ 			outl(tmp | 0x01000000, base + 0x3c);
+-			outl(tmp, base + 0x3c);
++			outl(tmp &= ~0x01000000, base + 0x3c);
+ 		}
+ 	}
+ 	return 0;
+@@ -1545,6 +1545,7 @@ pci_wch_ch353_setup(struct serial_private *priv,
+ #define PCI_DEVICE_ID_TITAN_800E	0xA014
+ #define PCI_DEVICE_ID_TITAN_200EI	0xA016
+ #define PCI_DEVICE_ID_TITAN_200EISI	0xA017
++#define PCI_DEVICE_ID_TITAN_200V3	0xA306
+ #define PCI_DEVICE_ID_TITAN_400V3	0xA310
+ #define PCI_DEVICE_ID_TITAN_410V3	0xA312
+ #define PCI_DEVICE_ID_TITAN_800V3	0xA314
+@@ -4140,6 +4141,9 @@ static struct pci_device_id serial_pci_tbl[] = {
+ 	{	PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200EISI,
+ 		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ 		pbn_oxsemi_2_4000000 },
++	{	PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200V3,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_b0_bt_2_921600 },
+ 	{	PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_400V3,
+ 		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ 		pbn_b0_4_921600 },
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 6b0f75eac8a2..41bb8387e80d 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -824,9 +824,6 @@ static void atmel_release_rx_dma(struct uart_port *port)
+ 	atmel_port->desc_rx = NULL;
+ 	atmel_port->chan_rx = NULL;
+ 	atmel_port->cookie_rx = -EINVAL;
+-
+-	if (!atmel_port->is_usart)
+-		del_timer_sync(&atmel_port->uart_timer);
+ }
+ 
+ static void atmel_rx_from_dma(struct uart_port *port)
+@@ -1228,9 +1225,6 @@ static void atmel_release_rx_pdc(struct uart_port *port)
+ 				 DMA_FROM_DEVICE);
+ 		kfree(pdc->buf);
+ 	}
+-
+-	if (!atmel_port->is_usart)
+-		del_timer_sync(&atmel_port->uart_timer);
+ }
+ 
+ static void atmel_rx_from_pdc(struct uart_port *port)
+@@ -1587,12 +1581,13 @@ static int atmel_startup(struct uart_port *port)
+ 	/* enable xmit & rcvr */
+ 	UART_PUT_CR(port, ATMEL_US_TXEN | ATMEL_US_RXEN);
+ 
++	setup_timer(&atmel_port->uart_timer,
++			atmel_uart_timer_callback,
++			(unsigned long)port);
++
+ 	if (atmel_use_pdc_rx(port)) {
+ 		/* set UART timeout */
+ 		if (!atmel_port->is_usart) {
+-			setup_timer(&atmel_port->uart_timer,
+-					atmel_uart_timer_callback,
+-					(unsigned long)port);
+ 			mod_timer(&atmel_port->uart_timer,
+ 					jiffies + uart_poll_timeout(port));
+ 		/* set USART timeout */
+@@ -1607,9 +1602,6 @@ static int atmel_startup(struct uart_port *port)
+ 	} else if (atmel_use_dma_rx(port)) {
+ 		/* set UART timeout */
+ 		if (!atmel_port->is_usart) {
+-			setup_timer(&atmel_port->uart_timer,
+-					atmel_uart_timer_callback,
+-					(unsigned long)port);
+ 			mod_timer(&atmel_port->uart_timer,
+ 					jiffies + uart_poll_timeout(port));
+ 		/* set USART timeout */
+@@ -1633,12 +1625,30 @@ static int atmel_startup(struct uart_port *port)
+ static void atmel_shutdown(struct uart_port *port)
+ {
+ 	struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
++
+ 	/*
+-	 * Ensure everything is stopped.
++	 * Prevent any tasklets being scheduled during
++	 * cleanup
++	 */
++	del_timer_sync(&atmel_port->uart_timer);
++
++	/*
++	 * Clear out any scheduled tasklets before
++	 * we destroy the buffers
++	 */
++	tasklet_kill(&atmel_port->tasklet);
++
++	/*
++	 * Ensure everything is stopped and
++	 * disable all interrupts, port and break condition.
+ 	 */
+ 	atmel_stop_rx(port);
+ 	atmel_stop_tx(port);
+ 
++	UART_PUT_CR(port, ATMEL_US_RSTSTA);
++	UART_PUT_IDR(port, -1);
++
++
+ 	/*
+ 	 * Shut-down the DMA.
+ 	 */
+@@ -1648,10 +1658,10 @@ static void atmel_shutdown(struct uart_port *port)
+ 		atmel_port->release_tx(port);
+ 
+ 	/*
+-	 * Disable all interrupts, port and break condition.
++	 * Reset ring buffer pointers
+ 	 */
+-	UART_PUT_CR(port, ATMEL_US_RSTSTA);
+-	UART_PUT_IDR(port, -1);
++	atmel_port->rx_ring.head = 0;
++	atmel_port->rx_ring.tail = 0;
+ 
+ 	/*
+ 	 * Free the interrupt
+@@ -2424,11 +2434,12 @@ static int atmel_serial_remove(struct platform_device *pdev)
+ 	struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+ 	int ret = 0;
+ 
++	tasklet_kill(&atmel_port->tasklet);
++
+ 	device_init_wakeup(&pdev->dev, 0);
+ 
+ 	ret = uart_remove_one_port(&atmel_uart, port);
+ 
+-	tasklet_kill(&atmel_port->tasklet);
+ 	kfree(atmel_port->rx_ring.buf);
+ 
+ 	/* "port" is allocated statically, so we shouldn't free it */
+diff --git a/drivers/usb/chipidea/ci.h b/drivers/usb/chipidea/ci.h
+index 1c94fc5257f4..5ad448d0fb7d 100644
+--- a/drivers/usb/chipidea/ci.h
++++ b/drivers/usb/chipidea/ci.h
+@@ -135,6 +135,7 @@ struct hw_bank {
+  * @id_event: indicates there is an id event, and handled at ci_otg_work
+  * @b_sess_valid_event: indicates there is a vbus event, and handled
+  * at ci_otg_work
++ * @imx28_write_fix: Freescale imx28 needs swp instruction for writing
+  */
+ struct ci_hdrc {
+ 	struct device			*dev;
+@@ -173,6 +174,7 @@ struct ci_hdrc {
+ 	struct dentry			*debugfs;
+ 	bool				id_event;
+ 	bool				b_sess_valid_event;
++	bool				imx28_write_fix;
+ };
+ 
+ static inline struct ci_role_driver *ci_role(struct ci_hdrc *ci)
+@@ -253,6 +255,26 @@ static inline u32 hw_read(struct ci_hdrc *ci, enum ci_hw_regs reg, u32 mask)
+ 	return ioread32(ci->hw_bank.regmap[reg]) & mask;
+ }
+ 
++#ifdef CONFIG_SOC_IMX28
++static inline void imx28_ci_writel(u32 val, volatile void __iomem *addr)
++{
++	__asm__ ("swp %0, %0, [%1]" : : "r"(val), "r"(addr));
++}
++#else
++static inline void imx28_ci_writel(u32 val, volatile void __iomem *addr)
++{
++}
++#endif
++
++static inline void __hw_write(struct ci_hdrc *ci, u32 val,
++		void __iomem *addr)
++{
++	if (ci->imx28_write_fix)
++		imx28_ci_writel(val, addr);
++	else
++		iowrite32(val, addr);
++}
++
+ /**
+  * hw_write: writes to a hw register
+  * @reg:  register index
+@@ -266,7 +288,7 @@ static inline void hw_write(struct ci_hdrc *ci, enum ci_hw_regs reg,
+ 		data = (ioread32(ci->hw_bank.regmap[reg]) & ~mask)
+ 			| (data & mask);
+ 
+-	iowrite32(data, ci->hw_bank.regmap[reg]);
++	__hw_write(ci, data, ci->hw_bank.regmap[reg]);
+ }
+ 
+ /**
+@@ -281,7 +303,7 @@ static inline u32 hw_test_and_clear(struct ci_hdrc *ci, enum ci_hw_regs reg,
+ {
+ 	u32 val = ioread32(ci->hw_bank.regmap[reg]) & mask;
+ 
+-	iowrite32(val, ci->hw_bank.regmap[reg]);
++	__hw_write(ci, val, ci->hw_bank.regmap[reg]);
+ 	return val;
+ }
+ 
+diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
+index be822a2c1776..76a67fb6ea32 100644
+--- a/drivers/usb/chipidea/ci_hdrc_imx.c
++++ b/drivers/usb/chipidea/ci_hdrc_imx.c
+@@ -23,6 +23,26 @@
+ #include "ci.h"
+ #include "ci_hdrc_imx.h"
+ 
++#define CI_HDRC_IMX_IMX28_WRITE_FIX BIT(0)
++
++struct ci_hdrc_imx_platform_flag {
++	unsigned int flags;
++};
++
++static const struct ci_hdrc_imx_platform_flag imx27_usb_data = {
++};
++
++static const struct ci_hdrc_imx_platform_flag imx28_usb_data = {
++	.flags = CI_HDRC_IMX_IMX28_WRITE_FIX,
++};
++
++static const struct of_device_id ci_hdrc_imx_dt_ids[] = {
++	{ .compatible = "fsl,imx28-usb", .data = &imx28_usb_data},
++	{ .compatible = "fsl,imx27-usb", .data = &imx27_usb_data},
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, ci_hdrc_imx_dt_ids);
++
+ struct ci_hdrc_imx_data {
+ 	struct usb_phy *phy;
+ 	struct platform_device *ci_pdev;
+@@ -82,6 +102,9 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
+ 				  CI_HDRC_DISABLE_STREAMING,
+ 	};
+ 	int ret;
++	const struct of_device_id *of_id =
++			of_match_device(ci_hdrc_imx_dt_ids, &pdev->dev);
++	const struct ci_hdrc_imx_platform_flag *imx_platform_flag = of_id->data;
+ 
+ 	data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
+ 	if (!data) {
+@@ -121,6 +144,9 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
+ 
+ 	pdata.phy = data->phy;
+ 
++	if (imx_platform_flag->flags & CI_HDRC_IMX_IMX28_WRITE_FIX)
++		pdata.flags |= CI_HDRC_IMX28_WRITE_FIX;
++
+ 	if (!pdev->dev.dma_mask)
+ 		pdev->dev.dma_mask = &pdev->dev.coherent_dma_mask;
+ 	if (!pdev->dev.coherent_dma_mask)
+@@ -187,12 +213,6 @@ static int ci_hdrc_imx_remove(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
+-static const struct of_device_id ci_hdrc_imx_dt_ids[] = {
+-	{ .compatible = "fsl,imx27-usb", },
+-	{ /* sentinel */ }
+-};
+-MODULE_DEVICE_TABLE(of, ci_hdrc_imx_dt_ids);
+-
+ static struct platform_driver ci_hdrc_imx_driver = {
+ 	.probe = ci_hdrc_imx_probe,
+ 	.remove = ci_hdrc_imx_remove,
+diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
+index d6a50b7bb4ca..7e8dceb4c634 100644
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -497,6 +497,8 @@ static int ci_hdrc_probe(struct platform_device *pdev)
+ 		ci->transceiver = ci->platdata->phy;
+ 	else
+ 		ci->global_phy = true;
++	ci->imx28_write_fix = !!(ci->platdata->flags &
++		CI_HDRC_IMX28_WRITE_FIX);
+ 
+ 	ret = hw_device_init(ci, base);
+ 	if (ret < 0) {
+diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
+index 5d874d5cf500..e3b9f98dfcd6 100644
+--- a/drivers/usb/chipidea/host.c
++++ b/drivers/usb/chipidea/host.c
+@@ -65,6 +65,7 @@ static int host_start(struct ci_hdrc *ci)
+ 	ehci->caps = ci->hw_bank.cap;
+ 	ehci->has_hostpc = ci->hw_bank.lpm;
+ 	ehci->has_tdi_phy_lpm = ci->hw_bank.lpm;
++	ehci->imx28_write_fix = ci->imx28_write_fix;
+ 
+ 	if (ci->platdata->reg_vbus) {
+ 		ret = regulator_enable(ci->platdata->reg_vbus);
+diff --git a/drivers/usb/chipidea/otg.h b/drivers/usb/chipidea/otg.h
+index 2d9f090733bc..449bee07f4fe 100644
+--- a/drivers/usb/chipidea/otg.h
++++ b/drivers/usb/chipidea/otg.h
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (C) 2013 Freescale Semiconductor, Inc.
++ * Copyright (C) 2013-2014 Freescale Semiconductor, Inc.
+  *
+  * Author: Peter Chen
+  *
+@@ -19,12 +19,12 @@ static inline void ci_clear_otg_interrupt(struct ci_hdrc *ci, u32 bits)
+ 
+ static inline void ci_enable_otg_interrupt(struct ci_hdrc *ci, u32 bits)
+ {
+-	hw_write(ci, OP_OTGSC, bits, bits);
++	hw_write(ci, OP_OTGSC, bits | OTGSC_INT_STATUS_BITS, bits);
+ }
+ 
+ static inline void ci_disable_otg_interrupt(struct ci_hdrc *ci, u32 bits)
+ {
+-	hw_write(ci, OP_OTGSC, bits, 0);
++	hw_write(ci, OP_OTGSC, bits | OTGSC_INT_STATUS_BITS, 0);
+ }
+ 
+ int ci_hdrc_otg_init(struct ci_hdrc *ci);
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index d98fa254eaaf..94c26acfd5a4 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -394,6 +394,14 @@ static int add_td_to_list(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq,
+ 	node->ptr->token = cpu_to_le32(length << __ffs(TD_TOTAL_BYTES));
+ 	node->ptr->token &= cpu_to_le32(TD_TOTAL_BYTES);
+ 	node->ptr->token |= cpu_to_le32(TD_STATUS_ACTIVE);
++	if (hwep->type == USB_ENDPOINT_XFER_ISOC && hwep->dir == TX) {
++		u32 mul = hwreq->req.length / hwep->ep.maxpacket;
++
++		if (hwreq->req.length == 0
++				|| hwreq->req.length % hwep->ep.maxpacket)
++			mul++;
++		node->ptr->token |= mul << __ffs(TD_MULTO);
++	}
+ 
+ 	temp = (u32) (hwreq->req.dma + hwreq->req.actual);
+ 	if (length) {
+@@ -516,10 +524,11 @@ static int _hardware_enqueue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq)
+ 	hwep->qh.ptr->td.token &=
+ 		cpu_to_le32(~(TD_STATUS_HALTED|TD_STATUS_ACTIVE));
+ 
+-	if (hwep->type == USB_ENDPOINT_XFER_ISOC) {
++	if (hwep->type == USB_ENDPOINT_XFER_ISOC && hwep->dir == RX) {
+ 		u32 mul = hwreq->req.length / hwep->ep.maxpacket;
+ 
+-		if (hwreq->req.length % hwep->ep.maxpacket)
++		if (hwreq->req.length == 0
++				|| hwreq->req.length % hwep->ep.maxpacket)
+ 			mul++;
+ 		hwep->qh.ptr->cap |= mul << __ffs(QH_MULT);
+ 	}
+@@ -1172,6 +1181,12 @@ static int ep_enable(struct usb_ep *ep,
+ 	if (hwep->num)
+ 		cap |= QH_ZLT;
+ 	cap |= (hwep->ep.maxpacket << __ffs(QH_MAX_PKT)) & QH_MAX_PKT;
++	/*
++	 * For ISO-TX, we set mult at QH as the largest value, and use
++	 * MultO at TD as real mult value.
++	 */
++	if (hwep->type == USB_ENDPOINT_XFER_ISOC && hwep->dir == TX)
++		cap |= 3 << __ffs(QH_MULT);
+ 
+ 	hwep->qh.ptr->cap = cpu_to_le32(cap);
+ 
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index a6b2cabe7930..548d1996590f 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -651,10 +651,6 @@ void usb_destroy_configuration(struct usb_device *dev)
+  *
+  * hub-only!! ... and only in reset path, or usb_new_device()
+  * (used by real hubs and virtual root hubs)
+- *
+- * NOTE: if this is a WUSB device and is not authorized, we skip the
+- *       whole thing. A non-authorized USB device has no
+- *       configurations.
+  */
+ int usb_get_configuration(struct usb_device *dev)
+ {
+@@ -666,8 +662,6 @@ int usb_get_configuration(struct usb_device *dev)
+ 	struct usb_config_descriptor *desc;
+ 
+ 	cfgno = 0;
+-	if (dev->authorized == 0)	/* Not really an error */
+-		goto out_not_authorized;
+ 	result = -ENOMEM;
+ 	if (ncfg > USB_MAXCONFIG) {
+ 		dev_warn(ddev, "too many configurations: %d, "
+@@ -751,7 +745,6 @@ int usb_get_configuration(struct usb_device *dev)
+ 
+ err:
+ 	kfree(desc);
+-out_not_authorized:
+ 	dev->descriptor.bNumConfigurations = cfgno;
+ err2:
+ 	if (result == -ENOMEM)
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index c5c366790e6a..e3f7e41818f8 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1610,7 +1610,7 @@ static void hub_disconnect(struct usb_interface *intf)
+ {
+ 	struct usb_hub *hub = usb_get_intfdata(intf);
+ 	struct usb_device *hdev = interface_to_usbdev(intf);
+-	int i;
++	int port1;
+ 
+ 	/* Take the hub off the event list and don't let it be added again */
+ 	spin_lock_irq(&hub_event_lock);
+@@ -1625,11 +1625,15 @@ static void hub_disconnect(struct usb_interface *intf)
+ 	hub->error = 0;
+ 	hub_quiesce(hub, HUB_DISCONNECT);
+ 
+-	usb_set_intfdata (intf, NULL);
++	/* Avoid races with recursively_mark_NOTATTACHED() */
++	spin_lock_irq(&device_state_lock);
++	port1 = hdev->maxchild;
++	hdev->maxchild = 0;
++	usb_set_intfdata(intf, NULL);
++	spin_unlock_irq(&device_state_lock);
+ 
+-	for (i = 0; i < hdev->maxchild; i++)
+-		usb_hub_remove_port_device(hub, i + 1);
+-	hub->hdev->maxchild = 0;
++	for (; port1 > 0; --port1)
++		usb_hub_remove_port_device(hub, port1);
+ 
+ 	if (hub->hdev->speed == USB_SPEED_HIGH)
+ 		highspeed_hubs--;
+@@ -2238,18 +2242,13 @@ static int usb_enumerate_device(struct usb_device *udev)
+ 			return err;
+ 		}
+ 	}
+-	if (udev->wusb == 1 && udev->authorized == 0) {
+-		udev->product = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+-		udev->manufacturer = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+-		udev->serial = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+-	}
+-	else {
+-		/* read the standard strings and cache them if present */
+-		udev->product = usb_cache_string(udev, udev->descriptor.iProduct);
+-		udev->manufacturer = usb_cache_string(udev,
+-						      udev->descriptor.iManufacturer);
+-		udev->serial = usb_cache_string(udev, udev->descriptor.iSerialNumber);
+-	}
++
++	/* read the standard strings and cache them if present */
++	udev->product = usb_cache_string(udev, udev->descriptor.iProduct);
++	udev->manufacturer = usb_cache_string(udev,
++					      udev->descriptor.iManufacturer);
++	udev->serial = usb_cache_string(udev, udev->descriptor.iSerialNumber);
++
+ 	err = usb_enumerate_device_otg(udev);
+ 	if (err < 0)
+ 		return err;
+@@ -2431,16 +2430,6 @@ int usb_deauthorize_device(struct usb_device *usb_dev)
+ 	usb_dev->authorized = 0;
+ 	usb_set_configuration(usb_dev, -1);
+ 
+-	kfree(usb_dev->product);
+-	usb_dev->product = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+-	kfree(usb_dev->manufacturer);
+-	usb_dev->manufacturer = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+-	kfree(usb_dev->serial);
+-	usb_dev->serial = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+-
+-	usb_destroy_configuration(usb_dev);
+-	usb_dev->descriptor.bNumConfigurations = 0;
+-
+ out_unauthorized:
+ 	usb_unlock_device(usb_dev);
+ 	return 0;
+@@ -2468,17 +2457,7 @@ int usb_authorize_device(struct usb_device *usb_dev)
+ 		goto error_device_descriptor;
+ 	}
+ 
+-	kfree(usb_dev->product);
+-	usb_dev->product = NULL;
+-	kfree(usb_dev->manufacturer);
+-	usb_dev->manufacturer = NULL;
+-	kfree(usb_dev->serial);
+-	usb_dev->serial = NULL;
+-
+ 	usb_dev->authorized = 1;
+-	result = usb_enumerate_device(usb_dev);
+-	if (result < 0)
+-		goto error_enumerate;
+ 	/* Choose and set the configuration.  This registers the interfaces
+ 	 * with the driver core and lets interface drivers bind to them.
+ 	 */
+@@ -2494,7 +2473,6 @@ int usb_authorize_device(struct usb_device *usb_dev)
+ 	}
+ 	dev_info(&usb_dev->dev, "authorized to connect\n");
+ 
+-error_enumerate:
+ error_device_descriptor:
+ 	usb_autosuspend_device(usb_dev);
+ error_autoresume:
+diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
+index 291db7d09f22..2a1f38d209f0 100644
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -203,6 +203,7 @@ struct ehci_hcd {			/* one per controller */
+ 	unsigned		has_synopsys_hc_bug:1; /* Synopsys HC */
+ 	unsigned		frame_index_bug:1; /* MosChip (AKA NetMos) */
+ 	unsigned		need_oc_pp_cycle:1; /* MPC834X port power */
++	unsigned		imx28_write_fix:1; /* For Freescale i.MX28 */
+ 
+ 	/* required for usb32 quirk */
+ 	#define OHCI_CTRL_HCFS          (3 << 6)
+@@ -679,6 +680,18 @@ static inline unsigned int ehci_readl(const struct ehci_hcd *ehci,
+ #endif
+ }
+ 
++#ifdef CONFIG_SOC_IMX28
++static inline void imx28_ehci_writel(const unsigned int val,
++		volatile __u32 __iomem *addr)
++{
++	__asm__ ("swp %0, %0, [%1]" : : "r"(val), "r"(addr));
++}
++#else
++static inline void imx28_ehci_writel(const unsigned int val,
++		volatile __u32 __iomem *addr)
++{
++}
++#endif
+ static inline void ehci_writel(const struct ehci_hcd *ehci,
+ 		const unsigned int val, __u32 __iomem *regs)
+ {
+@@ -687,7 +700,10 @@ static inline void ehci_writel(const struct ehci_hcd *ehci,
+ 		writel_be(val, regs) :
+ 		writel(val, regs);
+ #else
+-	writel(val, regs);
++	if (ehci->imx28_write_fix)
++		imx28_ehci_writel(val, regs);
++	else
++		writel(val, regs);
+ #endif
+ }
+ 
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 55fc0c39b7e1..fec3c8654ccd 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2964,7 +2964,7 @@ static int prepare_ring(struct xhci_hcd *xhci, struct xhci_ring *ep_ring,
+ 			if (num_trbs >= TRBS_PER_SEGMENT) {
+ 				xhci_err(xhci, "Too many fragments %d, max %d\n",
+ 						num_trbs, TRBS_PER_SEGMENT - 1);
+-				return -ENOMEM;
++				return -EINVAL;
+ 			}
+ 
+ 			nop_cmd = cpu_to_le32(TRB_TYPE(TRB_TR_NOOP) |
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index ed6c186a5393..1dceec25223e 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -321,6 +321,9 @@ static void xhci_cleanup_msix(struct xhci_hcd *xhci)
+ 	struct usb_hcd *hcd = xhci_to_hcd(xhci);
+ 	struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
+ 
++	if (xhci->quirks & XHCI_PLAT)
++		return;
++
+ 	xhci_free_irq(xhci);
+ 
+ 	if (xhci->msix_entries) {
+@@ -4724,8 +4727,8 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+ 	struct device		*dev = hcd->self.controller;
+ 	int			retval;
+ 
+-	/* Accept arbitrarily long scatter-gather lists */
+-	hcd->self.sg_tablesize = ~0;
++	/* Limit the block layer scatter-gather lists to half a segment. */
++	hcd->self.sg_tablesize = TRBS_PER_SEGMENT / 2;
+ 
+ 	/* support to build packet from discontinuous buffers */
+ 	hcd->self.no_sg_constraint = 1;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index ed3a425de8ce..6b3164c75c98 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1262,7 +1262,7 @@ union xhci_trb {
+  * since the command ring is 64-byte aligned.
+  * It must also be greater than 16.
+  */
+-#define TRBS_PER_SEGMENT	64
++#define TRBS_PER_SEGMENT	256
+ /* Allow two commands + a link TRB, along with any reserved command TRBs */
+ #define MAX_RSVD_CMD_TRBS	(TRBS_PER_SEGMENT - 3)
+ #define TRB_SEGMENT_SIZE	(TRBS_PER_SEGMENT*16)
+diff --git a/drivers/usb/serial/cypress_m8.h b/drivers/usb/serial/cypress_m8.h
+index b461311a2ae7..ce13e61b7d55 100644
+--- a/drivers/usb/serial/cypress_m8.h
++++ b/drivers/usb/serial/cypress_m8.h
+@@ -63,7 +63,7 @@
+ #define UART_DSR	0x20	/* data set ready - flow control - device to host */
+ #define CONTROL_RTS	0x10	/* request to send - flow control - host to device */
+ #define UART_CTS	0x10	/* clear to send - flow control - device to host */
+-#define UART_RI		0x10	/* ring indicator - modem - device to host */
++#define UART_RI		0x80	/* ring indicator - modem - device to host */
+ #define UART_CD		0x40	/* carrier detect - modem - device to host */
+ #define CYP_ERROR	0x08	/* received from input report - device to host */
+ /* Note - the below has nothing to do with the "feature report" reset */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index dccb4db98ea1..6f1cbbf51ae8 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -2116,10 +2116,20 @@ static void ftdi_set_termios(struct tty_struct *tty,
+ 	}
+ 
+ 	/*
+-	 * All FTDI UART chips are limited to CS7/8. We won't pretend to
++	 * All FTDI UART chips are limited to CS7/8. We shouldn't pretend to
+ 	 * support CS5/6 and revert the CSIZE setting instead.
++	 *
++	 * CS5 however is used to control some smartcard readers which abuse
++	 * this limitation to switch modes. Original FTDI chips fall back to
++	 * eight data bits.
++	 *
++	 * TODO: Implement a quirk to only allow this with mentioned
++	 *       readers. One I know of (Argolis Smartreader V1)
++	 *       returns "USB smartcard server" as iInterface string.
++	 *       The vendor didn't bother with a custom VID/PID of
++	 *       course.
+ 	 */
+-	if ((C_CSIZE(tty) != CS8) && (C_CSIZE(tty) != CS7)) {
++	if (C_CSIZE(tty) == CS6) {
+ 		dev_warn(ddev, "requested CSIZE setting not supported\n");
+ 
+ 		termios->c_cflag &= ~CSIZE;
+@@ -2166,6 +2176,9 @@ no_skip:
+ 		urb_value |= FTDI_SIO_SET_DATA_PARITY_NONE;
+ 	}
+ 	switch (cflag & CSIZE) {
++	case CS5:
++		dev_dbg(ddev, "Setting CS5 quirk\n");
++		break;
+ 	case CS7:
+ 		urb_value |= 7;
+ 		dev_dbg(ddev, "Setting CS7\n");
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index cc7a24154490..5c86f57e4afa 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -320,6 +320,9 @@ static void option_instat_callback(struct urb *urb);
+  * It seems to contain a Qualcomm QSC6240/6290 chipset            */
+ #define FOUR_G_SYSTEMS_PRODUCT_W14		0x9603
+ 
++/* iBall 3.5G connect wireless modem */
++#define IBALL_3_5G_CONNECT			0x9605
++
+ /* Zoom */
+ #define ZOOM_PRODUCT_4597			0x9607
+ 
+@@ -1447,6 +1450,17 @@ static const struct usb_device_id option_ids[] = {
+ 		.driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff),
+ 		.driver_info = (kernel_ulong_t)&net_intf3_blacklist },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8e, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8f, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff90, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff91, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) },
+ 
+ 	/* NOTE: most ZTE CDMA devices should be driven by zte_ev, not option */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff),
+@@ -1489,6 +1503,7 @@ static const struct usb_device_id option_ids[] = {
+   	  .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
+   	},
+ 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
++	{ USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
+ 	{ USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
+ 	/* Pirelli  */
+ 	{ USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1, 0xff) },
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 1e3318dfa1cb..beb8edce4ef2 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -142,6 +142,8 @@ struct pl2303_private {
+ 	spinlock_t lock;
+ 	u8 line_control;
+ 	u8 line_status;
++
++	u8 line_settings[7];
+ };
+ 
+ static int pl2303_vendor_read(__u16 value, __u16 index,
+@@ -339,11 +341,6 @@ static void pl2303_set_termios(struct tty_struct *tty,
+ 	int i;
+ 	u8 control;
+ 
+-	/*
+-	 * The PL2303 is reported to lose bytes if you change serial settings
+-	 * even to the same values as before. Thus we actually need to filter
+-	 * in this specific case.
+-	 */
+ 	if (old_termios && !tty_termios_hw_change(&tty->termios, old_termios))
+ 		return;
+ 
+@@ -428,10 +425,29 @@ static void pl2303_set_termios(struct tty_struct *tty,
+ 		dev_dbg(&port->dev, "parity = none\n");
+ 	}
+ 
+-	i = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
+-			    SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE,
+-			    0, 0, buf, 7, 100);
+-	dev_dbg(&port->dev, "0x21:0x20:0:0  %d\n", i);
++	/*
++	 * Some PL2303 are known to lose bytes if you change serial settings
++	 * even to the same values as before. Thus we actually need to filter
++	 * in this specific case.
++	 *
++	 * Note that the tty_termios_hw_change check above is not sufficient
++	 * as a previously requested baud rate may differ from the one
++	 * actually used (and stored in old_termios).
++	 *
++	 * NOTE: No additional locking needed for line_settings as it is
++	 *       only used in set_termios, which is serialised against itself.
++	 */
++	if (!old_termios || memcmp(buf, priv->line_settings, 7)) {
++		i = usb_control_msg(serial->dev,
++				    usb_sndctrlpipe(serial->dev, 0),
++				    SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE,
++				    0, 0, buf, 7, 100);
++
++		dev_dbg(&port->dev, "0x21:0x20:0:0  %d\n", i);
++
++		if (i == 7)
++			memcpy(priv->line_settings, buf, 7);
++	}
+ 
+ 	/* change control lines if we are switching to or from B0 */
+ 	spin_lock_irqsave(&priv->lock, flags);
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index de32cfa5bfa6..ad06255c2ade 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -234,6 +234,13 @@ UNUSUAL_DEV(  0x0421, 0x0495, 0x0370, 0x0370,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_MAX_SECTORS_64 ),
+ 
++/* Patch submitted by Mikhail Zolotaryov <lebon@×××××××××.ua> */
++UNUSUAL_DEV(  0x0421, 0x06aa, 0x1110, 0x1110,
++		"Nokia",
++		"502",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_MAX_SECTORS_64 ),
++
+ #ifdef NO_SDDR09
+ UNUSUAL_DEV(  0x0436, 0x0005, 0x0100, 0x0100,
+ 		"Microtech",
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index d58bef130a41..b256ddc1cb53 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -7718,7 +7718,7 @@ out:
+ 	 */
+ 	if (!for_reloc && root_dropped == false)
+ 		btrfs_add_dead_root(root);
+-	if (err)
++	if (err && err != -EAGAIN)
+ 		btrfs_std_error(root->fs_info, err);
+ 	return err;
+ }
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 8747feb77ec9..669eb53273c0 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -1548,6 +1548,12 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
+ 			printk(KERN_INFO "btrfs: Snapshot src from "
+ 			       "another FS\n");
+ 			ret = -EINVAL;
++		} else if (!inode_owner_or_capable(src_inode)) {
++			/*
++			 * Subvolume creation is not restricted, but snapshots
++			 * are limited to own subvolumes only
++			 */
++			ret = -EPERM;
+ 		} else {
+ 			ret = btrfs_mksubvol(&file->f_path, name, namelen,
+ 					     BTRFS_I(src_inode)->root,
+diff --git a/fs/dcache.c b/fs/dcache.c
+index f27c1d12a1fa..4021e0172602 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -3140,7 +3140,6 @@ restart:
+ 	read_seqbegin_or_lock(&rename_lock, &seq);
+ 	while (!IS_ROOT(dentry)) {
+ 		struct dentry *parent = dentry->d_parent;
+-		int error;
+ 
+ 		prefetch(parent);
+ 		error = prepend_name(&end, &len, &dentry->d_name);
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index d9ecbf1113a7..46b366897553 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1925,9 +1925,11 @@ void ext4_inline_data_truncate(struct inode *inode, int *has_inline)
+ 		}
+ 
+ 		/* Clear the content within i_blocks. */
+-		if (i_size < EXT4_MIN_INLINE_DATA_SIZE)
+-			memset(ext4_raw_inode(&is.iloc)->i_block + i_size, 0,
+-					EXT4_MIN_INLINE_DATA_SIZE - i_size);
++		if (i_size < EXT4_MIN_INLINE_DATA_SIZE) {
++			void *p = (void *) ext4_raw_inode(&is.iloc)->i_block;
++			memset(p + i_size, 0,
++			       EXT4_MIN_INLINE_DATA_SIZE - i_size);
++		}
+ 
+ 		EXT4_I(inode)->i_inline_size = i_size <
+ 					EXT4_MIN_INLINE_DATA_SIZE ?
+diff --git a/fs/hpfs/alloc.c b/fs/hpfs/alloc.c
+index cdb84a838068..58b5106186d0 100644
+--- a/fs/hpfs/alloc.c
++++ b/fs/hpfs/alloc.c
+@@ -8,6 +8,58 @@
+ 
+ #include "hpfs_fn.h"
+ 
++static void hpfs_claim_alloc(struct super_block *s, secno sec)
++{
++	struct hpfs_sb_info *sbi = hpfs_sb(s);
++	if (sbi->sb_n_free != (unsigned)-1) {
++		if (unlikely(!sbi->sb_n_free)) {
++			hpfs_error(s, "free count underflow, allocating sector %08x", sec);
++			sbi->sb_n_free = -1;
++			return;
++		}
++		sbi->sb_n_free--;
++	}
++}
++
++static void hpfs_claim_free(struct super_block *s, secno sec)
++{
++	struct hpfs_sb_info *sbi = hpfs_sb(s);
++	if (sbi->sb_n_free != (unsigned)-1) {
++		if (unlikely(sbi->sb_n_free >= sbi->sb_fs_size)) {
++			hpfs_error(s, "free count overflow, freeing sector %08x", sec);
++			sbi->sb_n_free = -1;
++			return;
++		}
++		sbi->sb_n_free++;
++	}
++}
++
++static void hpfs_claim_dirband_alloc(struct super_block *s, secno sec)
++{
++	struct hpfs_sb_info *sbi = hpfs_sb(s);
++	if (sbi->sb_n_free_dnodes != (unsigned)-1) {
++		if (unlikely(!sbi->sb_n_free_dnodes)) {
++			hpfs_error(s, "dirband free count underflow, allocating sector %08x", sec);
++			sbi->sb_n_free_dnodes = -1;
++			return;
++		}
++		sbi->sb_n_free_dnodes--;
++	}
++}
++
++static void hpfs_claim_dirband_free(struct super_block *s, secno sec)
++{
++	struct hpfs_sb_info *sbi = hpfs_sb(s);
++	if (sbi->sb_n_free_dnodes != (unsigned)-1) {
++		if (unlikely(sbi->sb_n_free_dnodes >= sbi->sb_dirband_size / 4)) {
++			hpfs_error(s, "dirband free count overflow, freeing sector %08x", sec);
++			sbi->sb_n_free_dnodes = -1;
++			return;
++		}
++		sbi->sb_n_free_dnodes++;
++	}
++}
++
+ /*
+  * Check if a sector is allocated in bitmap
+  * This is really slow. Turned on only if chk==2
+@@ -203,9 +255,15 @@ secno hpfs_alloc_sector(struct super_block *s, secno near, unsigned n, int forwa
+ 	}
+ 	sec = 0;
+ 	ret:
++	if (sec) {
++		i = 0;
++		do
++			hpfs_claim_alloc(s, sec + i);
++		while (unlikely(++i < n));
++	}
+ 	if (sec && f_p) {
+ 		for (i = 0; i < forward; i++) {
+-			if (!hpfs_alloc_if_possible(s, sec + i + 1)) {
++			if (!hpfs_alloc_if_possible(s, sec + n + i)) {
+ 				hpfs_error(s, "Prealloc doesn't work! Wanted %d, allocated at %08x, can't allocate %d", forward, sec, i);
+ 				sec = 0;
+ 				break;
+@@ -228,6 +286,7 @@ static secno alloc_in_dirband(struct super_block *s, secno near)
+ 	nr >>= 2;
+ 	sec = alloc_in_bmp(s, (~0x3fff) | nr, 1, 0);
+ 	if (!sec) return 0;
++	hpfs_claim_dirband_alloc(s, sec);
+ 	return ((sec & 0x3fff) << 2) + sbi->sb_dirband_start;
+ }
+ 
+@@ -242,6 +301,7 @@ int hpfs_alloc_if_possible(struct super_block *s, secno sec)
+ 		bmp[(sec & 0x3fff) >> 5] &= cpu_to_le32(~(1 << (sec & 0x1f)));
+ 		hpfs_mark_4buffers_dirty(&qbh);
+ 		hpfs_brelse4(&qbh);
++		hpfs_claim_alloc(s, sec);
+ 		return 1;
+ 	}
+ 	hpfs_brelse4(&qbh);
+@@ -275,6 +335,7 @@ void hpfs_free_sectors(struct super_block *s, secno sec, unsigned n)
+ 		return;
+ 	}
+ 	bmp[(sec & 0x3fff) >> 5] |= cpu_to_le32(1 << (sec & 0x1f));
++	hpfs_claim_free(s, sec);
+ 	if (!--n) {
+ 		hpfs_mark_4buffers_dirty(&qbh);
+ 		hpfs_brelse4(&qbh);
+@@ -359,6 +420,7 @@ void hpfs_free_dnode(struct super_block *s, dnode_secno dno)
+ 		bmp[ssec >> 5] |= cpu_to_le32(1 << (ssec & 0x1f));
+ 		hpfs_mark_4buffers_dirty(&qbh);
+ 		hpfs_brelse4(&qbh);
++		hpfs_claim_dirband_free(s, dno);
+ 	}
+ }
+ 
+@@ -366,7 +428,7 @@ struct dnode *hpfs_alloc_dnode(struct super_block *s, secno near,
+ 			 dnode_secno *dno, struct quad_buffer_head *qbh)
+ {
+ 	struct dnode *d;
+-	if (hpfs_count_one_bitmap(s, hpfs_sb(s)->sb_dmap) > FREE_DNODES_ADD) {
++	if (hpfs_get_free_dnodes(s) > FREE_DNODES_ADD) {
+ 		if (!(*dno = alloc_in_dirband(s, near)))
+ 			if (!(*dno = hpfs_alloc_sector(s, near, 4, 0))) return NULL;
+ 	} else {
+diff --git a/fs/hpfs/hpfs_fn.h b/fs/hpfs/hpfs_fn.h
+index 1b398636e990..c65f0bf326a1 100644
+--- a/fs/hpfs/hpfs_fn.h
++++ b/fs/hpfs/hpfs_fn.h
+@@ -311,7 +311,7 @@ static inline struct hpfs_sb_info *hpfs_sb(struct super_block *sb)
+ __printf(2, 3)
+ void hpfs_error(struct super_block *, const char *, ...);
+ int hpfs_stop_cycles(struct super_block *, int, int *, int *, char *);
+-unsigned hpfs_count_one_bitmap(struct super_block *, secno);
++unsigned hpfs_get_free_dnodes(struct super_block *);
+ 
+ /*
+  * local time (HPFS) to GMT (Unix)
+diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
+index 4334cda8dba1..3d6f8972d06e 100644
+--- a/fs/hpfs/super.c
++++ b/fs/hpfs/super.c
+@@ -115,7 +115,7 @@ static void hpfs_put_super(struct super_block *s)
+ 	kfree(sbi);
+ }
+ 
+-unsigned hpfs_count_one_bitmap(struct super_block *s, secno secno)
++static unsigned hpfs_count_one_bitmap(struct super_block *s, secno secno)
+ {
+ 	struct quad_buffer_head qbh;
+ 	unsigned long *bits;
+@@ -123,7 +123,7 @@ unsigned hpfs_count_one_bitmap(struct super_block *s, secno secno)
+ 
+ 	bits = hpfs_map_4sectors(s, secno, &qbh, 0);
+ 	if (!bits)
+-		return 0;
++		return (unsigned)-1;
+ 	count = bitmap_weight(bits, 2048 * BITS_PER_BYTE);
+ 	hpfs_brelse4(&qbh);
+ 	return count;
+@@ -138,30 +138,45 @@ static unsigned count_bitmaps(struct super_block *s)
+ 		hpfs_prefetch_bitmap(s, n);
+ 	}
+ 	for (n = 0; n < n_bands; n++) {
++		unsigned c;
+ 		hpfs_prefetch_bitmap(s, n + COUNT_RD_AHEAD);
+-		count += hpfs_count_one_bitmap(s, le32_to_cpu(hpfs_sb(s)->sb_bmp_dir[n]));
++		c = hpfs_count_one_bitmap(s, le32_to_cpu(hpfs_sb(s)->sb_bmp_dir[n]));
++		if (c != (unsigned)-1)
++			count += c;
+ 	}
+ 	return count;
+ }
+ 
++unsigned hpfs_get_free_dnodes(struct super_block *s)
++{
++	struct hpfs_sb_info *sbi = hpfs_sb(s);
++	if (sbi->sb_n_free_dnodes == (unsigned)-1) {
++		unsigned c = hpfs_count_one_bitmap(s, sbi->sb_dmap);
++		if (c == (unsigned)-1)
++			return 0;
++		sbi->sb_n_free_dnodes = c;
++	}
++	return sbi->sb_n_free_dnodes;
++}
++
+ static int hpfs_statfs(struct dentry *dentry, struct kstatfs *buf)
+ {
+ 	struct super_block *s = dentry->d_sb;
+ 	struct hpfs_sb_info *sbi = hpfs_sb(s);
+ 	u64 id = huge_encode_dev(s->s_bdev->bd_dev);
++
+ 	hpfs_lock(s);
+ 
+-	/*if (sbi->sb_n_free == -1) {*/
++	if (sbi->sb_n_free == (unsigned)-1)
+ 		sbi->sb_n_free = count_bitmaps(s);
+-		sbi->sb_n_free_dnodes = hpfs_count_one_bitmap(s, sbi->sb_dmap);
+-	/*}*/
++
+ 	buf->f_type = s->s_magic;
+ 	buf->f_bsize = 512;
+ 	buf->f_blocks = sbi->sb_fs_size;
+ 	buf->f_bfree = sbi->sb_n_free;
+ 	buf->f_bavail = sbi->sb_n_free;
+ 	buf->f_files = sbi->sb_dirband_size / 4;
+-	buf->f_ffree = sbi->sb_n_free_dnodes;
++	buf->f_ffree = hpfs_get_free_dnodes(s);
+ 	buf->f_fsid.val[0] = (u32)id;
+ 	buf->f_fsid.val[1] = (u32)(id >> 32);
+ 	buf->f_namelen = 254;
+diff --git a/fs/mount.h b/fs/mount.h
+index 64a858143ff9..68d80bdcd081 100644
+--- a/fs/mount.h
++++ b/fs/mount.h
+@@ -73,7 +73,7 @@ static inline int mnt_has_parent(struct mount *mnt)
+ static inline int is_mounted(struct vfsmount *mnt)
+ {
+ 	/* neither detached nor internal? */
+-	return !IS_ERR_OR_NULL(real_mount(mnt));
++	return !IS_ERR_OR_NULL(real_mount(mnt)->mnt_ns);
+ }
+ 
+ extern struct mount *__lookup_mnt(struct vfsmount *, struct dentry *, int);
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index 0393270466c3..6125579b5207 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -31,6 +31,7 @@ struct hugepage_subpool *hugepage_new_subpool(long nr_blocks);
+ void hugepage_put_subpool(struct hugepage_subpool *spool);
+ 
+ int PageHuge(struct page *page);
++int PageHeadHuge(struct page *page_head);
+ 
+ void reset_vma_resv_huge_pages(struct vm_area_struct *vma);
+ int hugetlb_sysctl_handler(struct ctl_table *, int, void __user *, size_t *, loff_t *);
+@@ -104,6 +105,11 @@ static inline int PageHuge(struct page *page)
+ 	return 0;
+ }
+ 
++static inline int PageHeadHuge(struct page *page_head)
++{
++	return 0;
++}
++
+ static inline void reset_vma_resv_huge_pages(struct vm_area_struct *vma)
+ {
+ }
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 9b503376738f..bec6dbe939a0 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -419,6 +419,8 @@ enum {
+ 	ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17),	/* Set max sects to 65535 */
+ 	ATA_HORKAGE_ATAPI_DMADIR = (1 << 18),	/* device requires dmadir */
+ 	ATA_HORKAGE_NO_NCQ_TRIM	= (1 << 19),	/* don't use queued TRIM */
++	ATA_HORKAGE_NOLPM	= (1 << 20),	/* don't use LPM */
++	ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21),	/* some WDs have broken LPM */
+ 
+ 	 /* DMA mask for user DMA control: User visible values; DO NOT
+ 	    renumber */
+diff --git a/include/linux/usb/chipidea.h b/include/linux/usb/chipidea.h
+index 7d399671a566..708bd119627f 100644
+--- a/include/linux/usb/chipidea.h
++++ b/include/linux/usb/chipidea.h
+@@ -24,6 +24,7 @@ struct ci_hdrc_platform_data {
+ 	 * but otg is not supported (no register otgsc).
+ 	 */
+ #define CI_HDRC_DUAL_ROLE_NOT_OTG	BIT(4)
++#define CI_HDRC_IMX28_WRITE_FIX		BIT(5)
+ 	enum usb_dr_mode	dr_mode;
+ #define CI_HDRC_CONTROLLER_RESET_EVENT		0
+ #define CI_HDRC_CONTROLLER_STOPPED_EVENT	1
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 0b7656e804d1..f0a4ca4cc219 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -736,6 +736,23 @@ int PageHuge(struct page *page)
+ }
+ EXPORT_SYMBOL_GPL(PageHuge);
+ 
++/*
++ * PageHeadHuge() only returns true for hugetlbfs head page, but not for
++ * normal or transparent huge pages.
++ */
++int PageHeadHuge(struct page *page_head)
++{
++	compound_page_dtor *dtor;
++
++	if (!PageHead(page_head))
++		return 0;
++
++	dtor = get_compound_page_dtor(page_head);
++
++	return dtor == free_huge_page;
++}
++EXPORT_SYMBOL_GPL(PageHeadHuge);
++
+ pgoff_t __basepage_index(struct page *page)
+ {
+ 	struct page *page_head = compound_head(page);
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 6b22d8f9bfb8..927a69cf354a 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2857,7 +2857,7 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol)
+ 	 */
+ 	VM_BUG_ON(maxlen < strlen("interleave") + strlen("relative") + 16);
+ 
+-	if (!pol || pol == &default_policy)
++	if (!pol || pol == &default_policy || (pol->flags & MPOL_F_MORON))
+ 		mode = MPOL_DEFAULT;
+ 	else
+ 		mode = pol->mode;
+diff --git a/mm/swap.c b/mm/swap.c
+index 759c3caf44bd..0c8f7a471925 100644
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -82,19 +82,6 @@ static void __put_compound_page(struct page *page)
+ 
+ static void put_compound_page(struct page *page)
+ {
+-	/*
+-	 * hugetlbfs pages cannot be split from under us.  If this is a
+-	 * hugetlbfs page, check refcount on head page and release the page if
+-	 * the refcount becomes zero.
+-	 */
+-	if (PageHuge(page)) {
+-		page = compound_head(page);
+-		if (put_page_testzero(page))
+-			__put_compound_page(page);
+-
+-		return;
+-	}
+-
+ 	if (unlikely(PageTail(page))) {
+ 		/* __split_huge_page_refcount can run under us */
+ 		struct page *page_head = compound_trans_head(page);
+@@ -111,14 +98,31 @@ static void put_compound_page(struct page *page)
+ 			 * still hot on arches that do not support
+ 			 * this_cpu_cmpxchg_double().
+ 			 */
+-			if (PageSlab(page_head)) {
+-				if (PageTail(page)) {
++			if (PageSlab(page_head) || PageHeadHuge(page_head)) {
++				if (likely(PageTail(page))) {
++					/*
++					 * __split_huge_page_refcount
++					 * cannot race here.
++					 */
++					VM_BUG_ON(!PageHead(page_head));
++					atomic_dec(&page->_mapcount);
+ 					if (put_page_testzero(page_head))
+ 						VM_BUG_ON(1);
+-
+-					atomic_dec(&page->_mapcount);
+-					goto skip_lock_tail;
++					if (put_page_testzero(page_head))
++						__put_compound_page(page_head);
++					return;
+ 				} else
++					/*
++					 * __split_huge_page_refcount
++					 * run before us, "page" was a
++					 * THP tail. The split
++					 * page_head has been freed
++					 * and reallocated as slab or
++					 * hugetlbfs page of smaller
++					 * order (only possible if
++					 * reallocated as slab on
++					 * x86).
++					 */
+ 					goto skip_lock;
+ 			}
+ 			/*
+@@ -132,8 +136,27 @@ static void put_compound_page(struct page *page)
+ 				/* __split_huge_page_refcount run before us */
+ 				compound_unlock_irqrestore(page_head, flags);
+ skip_lock:
+-				if (put_page_testzero(page_head))
+-					__put_single_page(page_head);
++				if (put_page_testzero(page_head)) {
++					/*
++					 * The head page may have been
++					 * freed and reallocated as a
++					 * compound page of smaller
++					 * order and then freed again.
++					 * All we know is that it
++					 * cannot have become: a THP
++					 * page, a compound page of
++					 * higher order, a tail page.
++					 * That is because we still
++					 * hold the refcount of the
++					 * split THP tail and
++					 * page_head was the THP head
++					 * before the split.
++					 */
++					if (PageHead(page_head))
++						__put_compound_page(page_head);
++					else
++						__put_single_page(page_head);
++				}
+ out_put_single:
+ 				if (put_page_testzero(page))
+ 					__put_single_page(page);
+@@ -155,7 +178,6 @@ out_put_single:
+ 			VM_BUG_ON(atomic_read(&page->_count) != 0);
+ 			compound_unlock_irqrestore(page_head, flags);
+ 
+-skip_lock_tail:
+ 			if (put_page_testzero(page_head)) {
+ 				if (PageHead(page_head))
+ 					__put_compound_page(page_head);
+@@ -198,51 +220,52 @@ bool __get_page_tail(struct page *page)
+ 	 * proper PT lock that already serializes against
+ 	 * split_huge_page().
+ 	 */
++	unsigned long flags;
+ 	bool got = false;
+-	struct page *page_head;
+-
+-	/*
+-	 * If this is a hugetlbfs page it cannot be split under us.  Simply
+-	 * increment refcount for the head page.
+-	 */
+-	if (PageHuge(page)) {
+-		page_head = compound_head(page);
+-		atomic_inc(&page_head->_count);
+-		got = true;
+-	} else {
+-		unsigned long flags;
++	struct page *page_head = compound_trans_head(page);
+ 
+-		page_head = compound_trans_head(page);
+-		if (likely(page != page_head &&
+-					get_page_unless_zero(page_head))) {
+-
+-			/* Ref to put_compound_page() comment. */
+-			if (PageSlab(page_head)) {
+-				if (likely(PageTail(page))) {
+-					__get_page_tail_foll(page, false);
+-					return true;
+-				} else {
+-					put_page(page_head);
+-					return false;
+-				}
+-			}
+-
+-			/*
+-			 * page_head wasn't a dangling pointer but it
+-			 * may not be a head page anymore by the time
+-			 * we obtain the lock. That is ok as long as it
+-			 * can't be freed from under us.
+-			 */
+-			flags = compound_lock_irqsave(page_head);
+-			/* here __split_huge_page_refcount won't run anymore */
++	if (likely(page != page_head && get_page_unless_zero(page_head))) {
++		/* Ref to put_compound_page() comment. */
++		if (PageSlab(page_head) || PageHeadHuge(page_head)) {
+ 			if (likely(PageTail(page))) {
++				/*
++				 * This is a hugetlbfs page or a slab
++				 * page. __split_huge_page_refcount
++				 * cannot race here.
++				 */
++				VM_BUG_ON(!PageHead(page_head));
+ 				__get_page_tail_foll(page, false);
+-				got = true;
+-			}
+-			compound_unlock_irqrestore(page_head, flags);
+-			if (unlikely(!got))
++				return true;
++			} else {
++				/*
++				 * __split_huge_page_refcount run
++				 * before us, "page" was a THP
++				 * tail. The split page_head has been
++				 * freed and reallocated as slab or
++				 * hugetlbfs page of smaller order
++				 * (only possible if reallocated as
++				 * slab on x86).
++				 */
+ 				put_page(page_head);
++				return false;
++			}
++		}
++
++		/*
++		 * page_head wasn't a dangling pointer but it
++		 * may not be a head page anymore by the time
++		 * we obtain the lock. That is ok as long as it
++		 * can't be freed from under us.
++		 */
++		flags = compound_lock_irqsave(page_head);
++		/* here __split_huge_page_refcount won't run anymore */
++		if (likely(PageTail(page))) {
++			__get_page_tail_foll(page, false);
++			got = true;
+ 		}
++		compound_unlock_irqrestore(page_head, flags);
++		if (unlikely(!got))
++			put_page(page_head);
+ 	}
+ 	return got;
+ }
+diff --git a/net/compat.c b/net/compat.c
+index dd32e34c1e2c..f50161fb812e 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -780,21 +780,16 @@ asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
+ 	if (flags & MSG_CMSG_COMPAT)
+ 		return -EINVAL;
+ 
+-	if (COMPAT_USE_64BIT_TIME)
+-		return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+-				      flags | MSG_CMSG_COMPAT,
+-				      (struct timespec *) timeout);
+-
+ 	if (timeout == NULL)
+ 		return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ 				      flags | MSG_CMSG_COMPAT, NULL);
+ 
+-	if (get_compat_timespec(&ktspec, timeout))
++	if (compat_get_timespec(&ktspec, timeout))
+ 		return -EFAULT;
+ 
+ 	datagrams = __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ 				   flags | MSG_CMSG_COMPAT, &ktspec);
+-	if (datagrams > 0 && put_compat_timespec(&ktspec, timeout))
++	if (datagrams > 0 && compat_put_timespec(&ktspec, timeout))
+ 		datagrams = -EFAULT;
+ 
+ 	return datagrams;
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 01b780856db2..ad30d626a5bd 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -36,7 +36,6 @@
+ #include <asm/uaccess.h>
+ #include <asm/unaligned.h>
+ #include <linux/filter.h>
+-#include <linux/reciprocal_div.h>
+ #include <linux/ratelimit.h>
+ #include <linux/seccomp.h>
+ #include <linux/if_vlan.h>
+@@ -166,7 +165,7 @@ unsigned int sk_run_filter(const struct sk_buff *skb,
+ 			A /= X;
+ 			continue;
+ 		case BPF_S_ALU_DIV_K:
+-			A = reciprocal_divide(A, K);
++			A /= K;
+ 			continue;
+ 		case BPF_S_ALU_MOD_X:
+ 			if (X == 0)
+@@ -553,11 +552,6 @@ int sk_chk_filter(struct sock_filter *filter, unsigned int flen)
+ 		/* Some instructions need special checks */
+ 		switch (code) {
+ 		case BPF_S_ALU_DIV_K:
+-			/* check for division by zero */
+-			if (ftest->k == 0)
+-				return -EINVAL;
+-			ftest->k = reciprocal_value(ftest->k);
+-			break;
+ 		case BPF_S_ALU_MOD_K:
+ 			/* check for division by zero */
+ 			if (ftest->k == 0)
+@@ -853,27 +847,7 @@ void sk_decode_filter(struct sock_filter *filt, struct sock_filter *to)
+ 	to->code = decodes[code];
+ 	to->jt = filt->jt;
+ 	to->jf = filt->jf;
+-
+-	if (code == BPF_S_ALU_DIV_K) {
+-		/*
+-		 * When loaded this rule user gave us X, which was
+-		 * translated into R = r(X). Now we calculate the
+-		 * RR = r(R) and report it back. If next time this
+-		 * value is loaded and RRR = r(RR) is calculated
+-		 * then the R == RRR will be true.
+-		 *
+-		 * One exception. X == 1 translates into R == 0 and
+-		 * we can't calculate RR out of it with r().
+-		 */
+-
+-		if (filt->k == 0)
+-			to->k = 1;
+-		else
+-			to->k = reciprocal_value(filt->k);
+-
+-		BUG_ON(reciprocal_value(to->k) != filt->k);
+-	} else
+-		to->k = filt->k;
++	to->k = filt->k;
+ }
+ 
+ int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf, unsigned int len)
+diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
+index 22b1a7058fd3..4efd2375d7e1 100644
+--- a/net/ieee802154/nl-phy.c
++++ b/net/ieee802154/nl-phy.c
+@@ -224,8 +224,10 @@ static int ieee802154_add_iface(struct sk_buff *skb,
+ 
+ 	if (info->attrs[IEEE802154_ATTR_DEV_TYPE]) {
+ 		type = nla_get_u8(info->attrs[IEEE802154_ATTR_DEV_TYPE]);
+-		if (type >= __IEEE802154_DEV_MAX)
+-			return -EINVAL;
++		if (type >= __IEEE802154_DEV_MAX) {
++			rc = -EINVAL;
++			goto nla_put_failure;
++		}
+ 	}
+ 
+ 	dev = phy->add_iface(phy, devname, type);
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index b3f627ac4ed8..f7f8cff67344 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -1049,6 +1049,8 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
+ 	}
+ 
+ 	in_dev = __in_dev_get_rtnl(dev);
++	if (!in_dev)
++		return NOTIFY_DONE;
+ 
+ 	switch (event) {
+ 	case NETDEV_UP:
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index 31cf54d18221..45dbdab915e2 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -961,7 +961,7 @@ next_normal:
+ 			++num;
+ 		}
+ 
+-		if (r->idiag_states & TCPF_TIME_WAIT) {
++		if (r->idiag_states & (TCPF_TIME_WAIT | TCPF_FIN_WAIT2)) {
+ 			struct inet_timewait_sock *tw;
+ 
+ 			inet_twsk_for_each(tw, node,
+@@ -971,6 +971,8 @@ next_normal:
+ 
+ 				if (num < s_num)
+ 					goto next_dying;
++				if (!(r->idiag_states & (1 << tw->tw_substate)))
++					goto next_dying;
+ 				if (r->sdiag_family != AF_UNSPEC &&
+ 						tw->tw_family != r->sdiag_family)
+ 					goto next_dying;
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index e560ef34cf4b..d30636080a11 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -178,7 +178,7 @@ static int ipgre_err(struct sk_buff *skb, u32 info,
+ 	else
+ 		itn = net_generic(net, ipgre_net_id);
+ 
+-	iph = (const struct iphdr *)skb->data;
++	iph = (const struct iphdr *)(icmp_hdr(skb) + 1);
+ 	t = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi->flags,
+ 			     iph->daddr, iph->saddr, tpi->key);
+ 
+diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
+index 054a3e97d822..3d4da2c16b6a 100644
+--- a/net/ipv4/ip_input.c
++++ b/net/ipv4/ip_input.c
+@@ -314,7 +314,7 @@ static int ip_rcv_finish(struct sk_buff *skb)
+ 	const struct iphdr *iph = ip_hdr(skb);
+ 	struct rtable *rt;
+ 
+-	if (sysctl_ip_early_demux && !skb_dst(skb)) {
++	if (sysctl_ip_early_demux && !skb_dst(skb) && skb->sk == NULL) {
+ 		const struct net_protocol *ipprot;
+ 		int protocol = iph->protocol;
+ 
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 254f11c24aa5..995a0bb33a65 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -618,6 +618,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 				tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
+ 			tunnel->err_count--;
+ 
++			memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ 			dst_link_failure(skb);
+ 		} else
+ 			tunnel->err_count = 0;
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 62212c772a4b..1672409f5ba5 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -157,9 +157,12 @@ static struct mr_table *ipmr_get_table(struct net *net, u32 id)
+ static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4,
+ 			   struct mr_table **mrt)
+ {
+-	struct ipmr_result res;
+-	struct fib_lookup_arg arg = { .result = &res, };
+ 	int err;
++	struct ipmr_result res;
++	struct fib_lookup_arg arg = {
++		.result = &res,
++		.flags = FIB_LOOKUP_NOREF,
++	};
+ 
+ 	err = fib_rules_lookup(net->ipv4.mr_rules_ops,
+ 			       flowi4_to_flowi(flp4), 0, &arg);
+diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
+index 310711433358..75c7f5391fb1 100644
+--- a/net/ipv4/tcp_metrics.c
++++ b/net/ipv4/tcp_metrics.c
+@@ -22,6 +22,9 @@
+ 
+ int sysctl_tcp_nometrics_save __read_mostly;
+ 
++static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *addr,
++						   struct net *net, unsigned int hash);
++
+ struct tcp_fastopen_metrics {
+ 	u16	mss;
+ 	u16	syn_loss:10;		/* Recurring Fast Open SYN losses */
+@@ -130,16 +133,41 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm, struct dst_entry *dst,
+ 	}
+ }
+ 
++#define TCP_METRICS_TIMEOUT		(60 * 60 * HZ)
++
++static void tcpm_check_stamp(struct tcp_metrics_block *tm, struct dst_entry *dst)
++{
++	if (tm && unlikely(time_after(jiffies, tm->tcpm_stamp + TCP_METRICS_TIMEOUT)))
++		tcpm_suck_dst(tm, dst, false);
++}
++
++#define TCP_METRICS_RECLAIM_DEPTH	5
++#define TCP_METRICS_RECLAIM_PTR		(struct tcp_metrics_block *) 0x1UL
++
+ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
+ 					  struct inetpeer_addr *addr,
+-					  unsigned int hash,
+-					  bool reclaim)
++					  unsigned int hash)
+ {
+ 	struct tcp_metrics_block *tm;
+ 	struct net *net;
++	bool reclaim = false;
+ 
+ 	spin_lock_bh(&tcp_metrics_lock);
+ 	net = dev_net(dst->dev);
++
++	/* While waiting for the spin-lock the cache might have been populated
++	 * with this entry and so we have to check again.
++	 */
++	tm = __tcp_get_metrics(addr, net, hash);
++	if (tm == TCP_METRICS_RECLAIM_PTR) {
++		reclaim = true;
++		tm = NULL;
++	}
++	if (tm) {
++		tcpm_check_stamp(tm, dst);
++		goto out_unlock;
++	}
++
+ 	if (unlikely(reclaim)) {
+ 		struct tcp_metrics_block *oldest;
+ 
+@@ -169,17 +197,6 @@ out_unlock:
+ 	return tm;
+ }
+ 
+-#define TCP_METRICS_TIMEOUT		(60 * 60 * HZ)
+-
+-static void tcpm_check_stamp(struct tcp_metrics_block *tm, struct dst_entry *dst)
+-{
+-	if (tm && unlikely(time_after(jiffies, tm->tcpm_stamp + TCP_METRICS_TIMEOUT)))
+-		tcpm_suck_dst(tm, dst, false);
+-}
+-
+-#define TCP_METRICS_RECLAIM_DEPTH	5
+-#define TCP_METRICS_RECLAIM_PTR		(struct tcp_metrics_block *) 0x1UL
+-
+ static struct tcp_metrics_block *tcp_get_encode(struct tcp_metrics_block *tm, int depth)
+ {
+ 	if (tm)
+@@ -280,7 +297,6 @@ static struct tcp_metrics_block *tcp_get_metrics(struct sock *sk,
+ 	struct inetpeer_addr addr;
+ 	unsigned int hash;
+ 	struct net *net;
+-	bool reclaim;
+ 
+ 	addr.family = sk->sk_family;
+ 	switch (addr.family) {
+@@ -300,13 +316,10 @@ static struct tcp_metrics_block *tcp_get_metrics(struct sock *sk,
+ 	hash = hash_32(hash, net->ipv4.tcp_metrics_hash_log);
+ 
+ 	tm = __tcp_get_metrics(&addr, net, hash);
+-	reclaim = false;
+-	if (tm == TCP_METRICS_RECLAIM_PTR) {
+-		reclaim = true;
++	if (tm == TCP_METRICS_RECLAIM_PTR)
+ 		tm = NULL;
+-	}
+ 	if (!tm && create)
+-		tm = tcpm_new(dst, &addr, hash, reclaim);
++		tm = tcpm_new(dst, &addr, hash);
+ 	else
+ 		tcpm_check_stamp(tm, dst);
+ 
+diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
+index 302d6fb1ff2b..51d54dc376f3 100644
+--- a/net/ipv6/ip6_input.c
++++ b/net/ipv6/ip6_input.c
+@@ -49,7 +49,7 @@
+ 
+ int ip6_rcv_finish(struct sk_buff *skb)
+ {
+-	if (sysctl_ip_early_demux && !skb_dst(skb)) {
++	if (sysctl_ip_early_demux && !skb_dst(skb) && skb->sk == NULL) {
+ 		const struct inet6_protocol *ipprot;
+ 
+ 		ipprot = rcu_dereference(inet6_protos[ipv6_hdr(skb)->nexthdr]);
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index f365310bfcca..0eb4038a4d63 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -141,9 +141,12 @@ static struct mr6_table *ip6mr_get_table(struct net *net, u32 id)
+ static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
+ 			    struct mr6_table **mrt)
+ {
+-	struct ip6mr_result res;
+-	struct fib_lookup_arg arg = { .result = &res, };
+ 	int err;
++	struct ip6mr_result res;
++	struct fib_lookup_arg arg = {
++		.result = &res,
++		.flags = FIB_LOOKUP_NOREF,
++	};
+ 
+ 	err = fib_rules_lookup(net->ipv6.mr6_rules_ops,
+ 			       flowi6_to_flowi(flp6), 0, &arg);
+diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
+index 8eb9501e3d60..b7ebe23cdedf 100644
+--- a/net/rds/ib_recv.c
++++ b/net/rds/ib_recv.c
+@@ -421,8 +421,7 @@ static void rds_ib_recv_cache_put(struct list_head *new_item,
+ 				 struct rds_ib_refill_cache *cache)
+ {
+ 	unsigned long flags;
+-	struct list_head *old;
+-	struct list_head __percpu *chpfirst;
++	struct list_head *old, *chpfirst;
+ 
+ 	local_irq_save(flags);
+ 
+@@ -432,7 +431,7 @@ static void rds_ib_recv_cache_put(struct list_head *new_item,
+ 	else /* put on front */
+ 		list_add_tail(new_item, chpfirst);
+ 
+-	__this_cpu_write(chpfirst, new_item);
++	__this_cpu_write(cache->percpu->first, new_item);
+ 	__this_cpu_inc(cache->percpu->count);
+ 
+ 	if (__this_cpu_read(cache->percpu->count) < RDS_IB_RECYCLE_BATCH_COUNT)
+@@ -452,7 +451,7 @@ static void rds_ib_recv_cache_put(struct list_head *new_item,
+ 	} while (old);
+ 
+ 
+-	__this_cpu_write(chpfirst, NULL);
++	__this_cpu_write(cache->percpu->first, NULL);
+ 	__this_cpu_write(cache->percpu->count, 0);
+ end:
+ 	local_irq_restore(flags);
+diff --git a/sound/core/init.c b/sound/core/init.c
+index 6b9087115da2..d04785144601 100644
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -170,7 +170,7 @@ int snd_card_create(int idx, const char *xid,
+ 	if (idx < 0) {
+ 		for (idx2 = 0; idx2 < SNDRV_CARDS; idx2++) {
+ 			/* idx == -1 == 0xffff means: take any free slot */
+-			if (idx2 < sizeof(int) && !(idx & (1U << idx2)))
++			if (idx2 < 32 && !(idx & (1U << idx2)))
+ 				continue;
+ 			if (!test_bit(idx2, snd_cards_lock)) {
+ 				if (module_slot_match(module, idx2)) {
+@@ -183,7 +183,7 @@ int snd_card_create(int idx, const char *xid,
+ 	if (idx < 0) {
+ 		for (idx2 = 0; idx2 < SNDRV_CARDS; idx2++) {
+ 			/* idx == -1 == 0xffff means: take any free slot */
+-			if (idx2 < sizeof(int) && !(idx & (1U << idx2)))
++			if (idx2 < 32 && !(idx & (1U << idx2)))
+ 				continue;
+ 			if (!test_bit(idx2, snd_cards_lock)) {
+ 				if (!slots[idx2] || !*slots[idx2]) {
+diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig
+index 46ed9e8ae0fd..cc9fd67a50df 100644
+--- a/sound/pci/Kconfig
++++ b/sound/pci/Kconfig
+@@ -25,6 +25,7 @@ config SND_ALS300
+ 	select SND_PCM
+ 	select SND_AC97_CODEC
+ 	select SND_OPL3_LIB
++	select ZONE_DMA
+ 	help
+ 	  Say 'Y' or 'M' to include support for Avance Logic ALS300/ALS300+
+ 
+@@ -49,6 +50,7 @@ config SND_ALI5451
+ 	tristate "ALi M5451 PCI Audio Controller"
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for the integrated AC97 sound
+ 	  device on motherboards using the ALi M5451 Audio Controller
+@@ -153,6 +155,7 @@ config SND_AZT3328
+ 	select SND_PCM
+ 	select SND_RAWMIDI
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for Aztech AZF3328 (PCI168)
+ 	  soundcards.
+@@ -458,6 +461,7 @@ config SND_EMU10K1
+ 	select SND_HWDEP
+ 	select SND_RAWMIDI
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y to include support for Sound Blaster PCI 512, Live!,
+ 	  Audigy and E-mu APS (partially supported) soundcards.
+@@ -473,6 +477,7 @@ config SND_EMU10K1X
+ 	tristate "Emu10k1X (Dell OEM Version)"
+ 	select SND_AC97_CODEC
+ 	select SND_RAWMIDI
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for the Dell OEM version of the
+ 	  Sound Blaster Live!.
+@@ -506,6 +511,7 @@ config SND_ES1938
+ 	select SND_OPL3_LIB
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on ESS Solo-1
+ 	  (ES1938, ES1946, ES1969) chips.
+@@ -517,6 +523,7 @@ config SND_ES1968
+ 	tristate "ESS ES1968/1978 (Maestro-1/2/2E)"
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on ESS Maestro
+ 	  1/2/2E chips.
+@@ -605,6 +612,7 @@ config SND_ICE1712
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
+ 	select BITREVERSE
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on the
+ 	  ICE1712 (Envy24) chip.
+@@ -692,6 +700,7 @@ config SND_LX6464ES
+ config SND_MAESTRO3
+ 	tristate "ESS Allegro/Maestro3"
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on ESS Maestro 3
+ 	  (Allegro) chips.
+@@ -788,6 +797,7 @@ config SND_SIS7019
+ 	tristate "SiS 7019 Audio Accelerator"
+ 	depends on X86 && !X86_64
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for the SiS 7019 Audio Accelerator.
+ 
+@@ -799,6 +809,7 @@ config SND_SONICVIBES
+ 	select SND_OPL3_LIB
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on the S3
+ 	  SonicVibes chip.
+@@ -810,6 +821,7 @@ config SND_TRIDENT
+ 	tristate "Trident 4D-Wave DX/NX; SiS 7018"
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on Trident
+ 	  4D-Wave DX/NX or SiS 7018 chips.
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index c7f6d1cab606..7d4ccfa48008 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -2857,9 +2857,11 @@ static bool look_for_mix_leaf_ctls(struct hda_codec *codec, hda_nid_t mix_nid,
+ 	if (num_conns < idx)
+ 		return false;
+ 	nid = list[idx];
+-	if (!*mix_val && nid_has_volume(codec, nid, HDA_OUTPUT))
++	if (!*mix_val && nid_has_volume(codec, nid, HDA_OUTPUT) &&
++	    !is_ctl_associated(codec, nid, HDA_OUTPUT, 0, NID_PATH_VOL_CTL))
+ 		*mix_val = HDA_COMPOSE_AMP_VAL(nid, 3, 0, HDA_OUTPUT);
+-	if (!*mute_val && nid_has_mute(codec, nid, HDA_OUTPUT))
++	if (!*mute_val && nid_has_mute(codec, nid, HDA_OUTPUT) &&
++	    !is_ctl_associated(codec, nid, HDA_OUTPUT, 0, NID_PATH_MUTE_CTL))
+ 		*mute_val = HDA_COMPOSE_AMP_VAL(nid, 3, 0, HDA_OUTPUT);
+ 
+ 	return *mix_val || *mute_val;
+diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
+index 38aa080681a3..31230c68b603 100644
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -171,7 +171,7 @@ static const struct hda_codec_ops ad198x_auto_patch_ops = {
+ };
+ 
+ 
+-static int ad198x_parse_auto_config(struct hda_codec *codec)
++static int ad198x_parse_auto_config(struct hda_codec *codec, bool indep_hp)
+ {
+ 	struct ad198x_spec *spec = codec->spec;
+ 	struct auto_pin_cfg *cfg = &spec->gen.autocfg;
+@@ -181,7 +181,7 @@ static int ad198x_parse_auto_config(struct hda_codec *codec)
+ 	codec->no_trigger_sense = 1;
+ 	codec->no_sticky_stream = 1;
+ 
+-	spec->gen.indep_hp = 1;
++	spec->gen.indep_hp = indep_hp;
+ 
+ 	err = snd_hda_parse_pin_defcfg(codec, cfg, NULL, 0);
+ 	if (err < 0)
+@@ -264,11 +264,11 @@ static const struct hda_fixup ad1986a_fixups[] = {
+ 		.v.pins = (const struct hda_pintbl[]) {
+ 			{ 0x1a, 0x02214021 }, /* headphone */
+ 			{ 0x1b, 0x01014011 }, /* front */
+-			{ 0x1c, 0x01013012 }, /* surround */
+-			{ 0x1d, 0x01019015 }, /* clfe */
++			{ 0x1c, 0x01813030 }, /* line-in */
++			{ 0x1d, 0x01a19020 }, /* rear mic */
+ 			{ 0x1e, 0x411111f0 }, /* N/A */
+ 			{ 0x1f, 0x02a190f0 }, /* mic */
+-			{ 0x20, 0x018130f0 }, /* line-in */
++			{ 0x20, 0x411111f0 }, /* N/A */
+ 			{}
+ 		},
+ 	},
+@@ -362,7 +362,7 @@ static int patch_ad1986a(struct hda_codec *codec)
+ 			   ad1986a_fixups);
+ 	snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_PRE_PROBE);
+ 
+-	err = ad198x_parse_auto_config(codec);
++	err = ad198x_parse_auto_config(codec, false);
+ 	if (err < 0) {
+ 		snd_hda_gen_free(codec);
+ 		return err;
+@@ -464,7 +464,7 @@ static int patch_ad1983(struct hda_codec *codec)
+ 
+ 	spec->gen.beep_nid = 0x10;
+ 	set_beep_amp(spec, 0x10, 0, HDA_OUTPUT);
+-	err = ad198x_parse_auto_config(codec);
++	err = ad198x_parse_auto_config(codec, false);
+ 	if (err < 0)
+ 		goto error;
+ 	err = ad1983_add_spdif_mux_ctl(codec);
+@@ -564,7 +564,7 @@ static int patch_ad1981(struct hda_codec *codec)
+ 	snd_hda_pick_fixup(codec, NULL, ad1981_fixup_tbl, ad1981_fixups);
+ 	snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_PRE_PROBE);
+ 
+-	err = ad198x_parse_auto_config(codec);
++	err = ad198x_parse_auto_config(codec, false);
+ 	if (err < 0)
+ 		goto error;
+ 	err = ad1983_add_spdif_mux_ctl(codec);
+@@ -890,7 +890,7 @@ static int patch_ad1988(struct hda_codec *codec)
+ 	snd_hda_pick_fixup(codec, ad1988_fixup_models, NULL, ad1988_fixups);
+ 	snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_PRE_PROBE);
+ 
+-	err = ad198x_parse_auto_config(codec);
++	err = ad198x_parse_auto_config(codec, true);
+ 	if (err < 0)
+ 		goto error;
+ 	err = ad1988_add_spdif_mux_ctl(codec);
+@@ -1064,7 +1064,7 @@ static int patch_ad1884(struct hda_codec *codec)
+ 	snd_hda_pick_fixup(codec, NULL, ad1884_fixup_tbl, ad1884_fixups);
+ 	snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_PRE_PROBE);
+ 
+-	err = ad198x_parse_auto_config(codec);
++	err = ad198x_parse_auto_config(codec, true);
+ 	if (err < 0)
+ 		goto error;
+ 	err = ad1983_add_spdif_mux_ctl(codec);
+@@ -1106,7 +1106,7 @@ static int patch_ad1882(struct hda_codec *codec)
+ 	spec->gen.mixer_merge_nid = 0x21;
+ 	spec->gen.beep_nid = 0x10;
+ 	set_beep_amp(spec, 0x10, 0, HDA_OUTPUT);
+-	err = ad198x_parse_auto_config(codec);
++	err = ad198x_parse_auto_config(codec, true);
+ 	if (err < 0)
+ 		goto error;
+ 	err = ad1988_add_spdif_mux_ctl(codec);
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index f26c42c92db7..417e0fc2d119 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -88,6 +88,9 @@ struct hdmi_spec {
+ 	unsigned int channels_max; /* max over all cvts */
+ 
+ 	struct hdmi_eld temp_eld;
++
++	bool dyn_pin_out;
++
+ 	/*
+ 	 * Non-generic ATI/NVIDIA specific
+ 	 */
+@@ -452,15 +455,25 @@ static void hdmi_write_dip_byte(struct hda_codec *codec, hda_nid_t pin_nid,
+ 
+ static void hdmi_init_pin(struct hda_codec *codec, hda_nid_t pin_nid)
+ {
++	struct hdmi_spec *spec = codec->spec;
++	int pin_out;
++
+ 	/* Unmute */
+ 	if (get_wcaps(codec, pin_nid) & AC_WCAP_OUT_AMP)
+ 		snd_hda_codec_write(codec, pin_nid, 0,
+ 				AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE);
+-	/* Enable pin out: some machines with GM965 gets broken output when
+-	 * the pin is disabled or changed while using with HDMI
+-	 */
++
++	if (spec->dyn_pin_out)
++		/* Disable pin out until stream is active */
++		pin_out = 0;
++	else
++		/* Enable pin out: some machines with GM965 gets broken output
++		 * when the pin is disabled or changed while using with HDMI
++		 */
++		pin_out = PIN_OUT;
++
+ 	snd_hda_codec_write(codec, pin_nid, 0,
+-			    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
++			    AC_VERB_SET_PIN_WIDGET_CONTROL, pin_out);
+ }
+ 
+ static int hdmi_get_channel_count(struct hda_codec *codec, hda_nid_t cvt_nid)
+@@ -1535,6 +1548,7 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
+ 	struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
+ 	hda_nid_t pin_nid = per_pin->pin_nid;
+ 	bool non_pcm;
++	int pinctl;
+ 
+ 	non_pcm = check_non_pcm_per_cvt(codec, cvt_nid);
+ 	per_pin->channels = substream->runtime->channels;
+@@ -1544,6 +1558,14 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
+ 
+ 	hdmi_setup_audio_infoframe(codec, per_pin, non_pcm);
+ 
++	if (spec->dyn_pin_out) {
++		pinctl = snd_hda_codec_read(codec, pin_nid, 0,
++					    AC_VERB_GET_PIN_WIDGET_CONTROL, 0);
++		snd_hda_codec_write(codec, pin_nid, 0,
++				    AC_VERB_SET_PIN_WIDGET_CONTROL,
++				    pinctl | PIN_OUT);
++	}
++
+ 	return hdmi_setup_stream(codec, cvt_nid, pin_nid, stream_tag, format);
+ }
+ 
+@@ -1563,6 +1585,7 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo,
+ 	int cvt_idx, pin_idx;
+ 	struct hdmi_spec_per_cvt *per_cvt;
+ 	struct hdmi_spec_per_pin *per_pin;
++	int pinctl;
+ 
+ 	if (hinfo->nid) {
+ 		cvt_idx = cvt_nid_to_cvt_index(spec, hinfo->nid);
+@@ -1579,6 +1602,14 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo,
+ 			return -EINVAL;
+ 		per_pin = get_pin(spec, pin_idx);
+ 
++		if (spec->dyn_pin_out) {
++			pinctl = snd_hda_codec_read(codec, per_pin->pin_nid, 0,
++					AC_VERB_GET_PIN_WIDGET_CONTROL, 0);
++			snd_hda_codec_write(codec, per_pin->pin_nid, 0,
++					    AC_VERB_SET_PIN_WIDGET_CONTROL,
++					    pinctl & ~PIN_OUT);
++		}
++
+ 		snd_hda_spdif_ctls_unassign(codec, pin_idx);
+ 		per_pin->chmap_set = false;
+ 		memset(per_pin->chmap, 0, sizeof(per_pin->chmap));
+@@ -2560,6 +2591,21 @@ static int patch_nvhdmi_8ch_7x(struct hda_codec *codec)
+ 	return 0;
+ }
+ 
++static int patch_nvhdmi(struct hda_codec *codec)
++{
++	struct hdmi_spec *spec;
++	int err;
++
++	err = patch_generic_hdmi(codec);
++	if (err)
++		return err;
++
++	spec = codec->spec;
++	spec->dyn_pin_out = true;
++
++	return 0;
++}
++
+ /*
+  * ATI-specific implementations
+  *
+@@ -2632,30 +2678,30 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
+ { .id = 0x10de0005, .name = "MCP77/78 HDMI",	.patch = patch_nvhdmi_8ch_7x },
+ { .id = 0x10de0006, .name = "MCP77/78 HDMI",	.patch = patch_nvhdmi_8ch_7x },
+ { .id = 0x10de0007, .name = "MCP79/7A HDMI",	.patch = patch_nvhdmi_8ch_7x },
+-{ .id = 0x10de000a, .name = "GPU 0a HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de000b, .name = "GPU 0b HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de000c, .name = "MCP89 HDMI",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de000d, .name = "GPU 0d HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0010, .name = "GPU 10 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0011, .name = "GPU 11 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0012, .name = "GPU 12 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0013, .name = "GPU 13 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0014, .name = "GPU 14 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0015, .name = "GPU 15 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0016, .name = "GPU 16 HDMI/DP",	.patch = patch_generic_hdmi },
++{ .id = 0x10de000a, .name = "GPU 0a HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de000b, .name = "GPU 0b HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de000c, .name = "MCP89 HDMI",	.patch = patch_nvhdmi },
++{ .id = 0x10de000d, .name = "GPU 0d HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0010, .name = "GPU 10 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0011, .name = "GPU 11 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0012, .name = "GPU 12 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0013, .name = "GPU 13 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0014, .name = "GPU 14 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0015, .name = "GPU 15 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0016, .name = "GPU 16 HDMI/DP",	.patch = patch_nvhdmi },
+ /* 17 is known to be absent */
+-{ .id = 0x10de0018, .name = "GPU 18 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0019, .name = "GPU 19 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de001a, .name = "GPU 1a HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de001b, .name = "GPU 1b HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de001c, .name = "GPU 1c HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0040, .name = "GPU 40 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0041, .name = "GPU 41 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0042, .name = "GPU 42 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0043, .name = "GPU 43 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0044, .name = "GPU 44 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0051, .name = "GPU 51 HDMI/DP",	.patch = patch_generic_hdmi },
+-{ .id = 0x10de0060, .name = "GPU 60 HDMI/DP",	.patch = patch_generic_hdmi },
++{ .id = 0x10de0018, .name = "GPU 18 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0019, .name = "GPU 19 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de001a, .name = "GPU 1a HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de001b, .name = "GPU 1b HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de001c, .name = "GPU 1c HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0040, .name = "GPU 40 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0041, .name = "GPU 41 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0042, .name = "GPU 42 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0043, .name = "GPU 43 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0044, .name = "GPU 44 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0051, .name = "GPU 51 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de0060, .name = "GPU 60 HDMI/DP",	.patch = patch_nvhdmi },
+ { .id = 0x10de0067, .name = "MCP67 HDMI",	.patch = patch_nvhdmi_2ch },
+ { .id = 0x10de8001, .name = "MCP73 HDMI",	.patch = patch_nvhdmi_2ch },
+ { .id = 0x11069f80, .name = "VX900 HDMI/DP",	.patch = patch_via_hdmi },
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index dce47c414ea7..56b62555eef4 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1769,6 +1769,7 @@ enum {
+ 	ALC889_FIXUP_DAC_ROUTE,
+ 	ALC889_FIXUP_MBP_VREF,
+ 	ALC889_FIXUP_IMAC91_VREF,
++	ALC889_FIXUP_MBA11_VREF,
+ 	ALC889_FIXUP_MBA21_VREF,
+ 	ALC882_FIXUP_INV_DMIC,
+ 	ALC882_FIXUP_NO_PRIMARY_HP,
+@@ -1898,6 +1899,16 @@ static void alc889_fixup_imac91_vref(struct hda_codec *codec,
+ 		alc889_fixup_mac_pins(codec, nids, ARRAY_SIZE(nids));
+ }
+ 
++/* Set VREF on speaker pins on mba11 */
++static void alc889_fixup_mba11_vref(struct hda_codec *codec,
++				    const struct hda_fixup *fix, int action)
++{
++	static hda_nid_t nids[1] = { 0x18 };
++
++	if (action == HDA_FIXUP_ACT_INIT)
++		alc889_fixup_mac_pins(codec, nids, ARRAY_SIZE(nids));
++}
++
+ /* Set VREF on speaker pins on mba21 */
+ static void alc889_fixup_mba21_vref(struct hda_codec *codec,
+ 				    const struct hda_fixup *fix, int action)
+@@ -2104,6 +2115,12 @@ static const struct hda_fixup alc882_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = ALC882_FIXUP_GPIO1,
+ 	},
++	[ALC889_FIXUP_MBA11_VREF] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc889_fixup_mba11_vref,
++		.chained = true,
++		.chain_id = ALC889_FIXUP_MBP_VREF,
++	},
+ 	[ALC889_FIXUP_MBA21_VREF] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc889_fixup_mba21_vref,
+@@ -2173,7 +2190,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x106b, 0x2c00, "MacbookPro rev3", ALC889_FIXUP_MBP_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x3000, "iMac", ALC889_FIXUP_MBP_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x3200, "iMac 7,1 Aluminum", ALC882_FIXUP_EAPD),
+-	SND_PCI_QUIRK(0x106b, 0x3400, "MacBookAir 1,1", ALC889_FIXUP_MBP_VREF),
++	SND_PCI_QUIRK(0x106b, 0x3400, "MacBookAir 1,1", ALC889_FIXUP_MBA11_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x3500, "MacBookAir 2,1", ALC889_FIXUP_MBA21_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x3600, "Macbook 3,1", ALC889_FIXUP_MBP_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x3800, "MacbookPro 4,1", ALC889_FIXUP_MBP_VREF),
+diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c
+index b96d9e1adf6d..3717f2dd30be 100644
+--- a/sound/pci/rme9652/rme9652.c
++++ b/sound/pci/rme9652/rme9652.c
+@@ -285,7 +285,7 @@ static char channel_map_9636_ds[26] = {
+ 	/* ADAT channels are remapped */
+ 	1, 3, 5, 7, 9, 11, 13, 15,
+ 	/* channels 8 and 9 are S/PDIF */
+-	24, 25
++	24, 25,
+ 	/* others don't exist */
+ 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
+ };
+diff --git a/sound/soc/codecs/adau1701.c b/sound/soc/codecs/adau1701.c
+index ebff1128be59..adee866f463f 100644
+--- a/sound/soc/codecs/adau1701.c
++++ b/sound/soc/codecs/adau1701.c
+@@ -71,7 +71,7 @@
+ 
+ #define ADAU1701_SEROCTL_WORD_LEN_24	0x0000
+ #define ADAU1701_SEROCTL_WORD_LEN_20	0x0001
+-#define ADAU1701_SEROCTL_WORD_LEN_16	0x0010
++#define ADAU1701_SEROCTL_WORD_LEN_16	0x0002
+ #define ADAU1701_SEROCTL_WORD_LEN_MASK	0x0003
+ 
+ #define ADAU1701_AUXNPOW_VBPD		0x40
+diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
+index 831a34d7cc72..c09a5305d601 100644
+--- a/sound/soc/codecs/wm5110.c
++++ b/sound/soc/codecs/wm5110.c
+@@ -43,6 +43,54 @@ static const struct reg_default wm5110_sysclk_revd_patch[] = {
+ 	{ 0x3133, 0x1201 },
+ 	{ 0x3183, 0x1501 },
+ 	{ 0x31D3, 0x1401 },
++	{ 0x0049, 0x01ea },
++	{ 0x004a, 0x01f2 },
++	{ 0x0057, 0x01e7 },
++	{ 0x0058, 0x01fb },
++	{ 0x33ce, 0xc4f5 },
++	{ 0x33cf, 0x1361 },
++	{ 0x33d0, 0x0402 },
++	{ 0x33d1, 0x4700 },
++	{ 0x33d2, 0x026d },
++	{ 0x33d3, 0xff00 },
++	{ 0x33d4, 0x026d },
++	{ 0x33d5, 0x0101 },
++	{ 0x33d6, 0xc4f5 },
++	{ 0x33d7, 0x0361 },
++	{ 0x33d8, 0x0402 },
++	{ 0x33d9, 0x6701 },
++	{ 0x33da, 0xc4f5 },
++	{ 0x33db, 0x136f },
++	{ 0x33dc, 0xc4f5 },
++	{ 0x33dd, 0x134f },
++	{ 0x33de, 0xc4f5 },
++	{ 0x33df, 0x131f },
++	{ 0x33e0, 0x026d },
++	{ 0x33e1, 0x4f01 },
++	{ 0x33e2, 0x026d },
++	{ 0x33e3, 0xf100 },
++	{ 0x33e4, 0x026d },
++	{ 0x33e5, 0x0001 },
++	{ 0x33e6, 0xc4f5 },
++	{ 0x33e7, 0x0361 },
++	{ 0x33e8, 0x0402 },
++	{ 0x33e9, 0x6601 },
++	{ 0x33ea, 0xc4f5 },
++	{ 0x33eb, 0x136f },
++	{ 0x33ec, 0xc4f5 },
++	{ 0x33ed, 0x134f },
++	{ 0x33ee, 0xc4f5 },
++	{ 0x33ef, 0x131f },
++	{ 0x33f0, 0x026d },
++	{ 0x33f1, 0x4e01 },
++	{ 0x33f2, 0x026d },
++	{ 0x33f3, 0xf000 },
++	{ 0x33f6, 0xc4f5 },
++	{ 0x33f7, 0x1361 },
++	{ 0x33f8, 0x0402 },
++	{ 0x33f9, 0x4600 },
++	{ 0x33fa, 0x026d },
++	{ 0x33fb, 0xfe00 },
+ };
+ 
+ static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w,
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index 568b750c01f6..9d78c70be71e 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -870,6 +870,7 @@ static struct machine *
+ 					       struct perf_sample *sample)
+ {
+ 	const u8 cpumode = event->header.misc & PERF_RECORD_MISC_CPUMODE_MASK;
++	struct machine *machine;
+ 
+ 	if (perf_guest &&
+ 	    ((cpumode == PERF_RECORD_MISC_GUEST_KERNEL) ||
+@@ -882,7 +883,11 @@ static struct machine *
+ 		else
+ 			pid = sample->pid;
+ 
+-		return perf_session__findnew_machine(session, pid);
++		machine = perf_session__find_machine(session, pid);
++		if (!machine)
++			machine = perf_session__findnew_machine(session,
++						DEFAULT_GUEST_KERNEL_ID);
++		return machine;
+ 	}
+ 
+ 	return &session->machines.host;