[gentoo-commits] linux-patches r2698 - genpatches-2.6/trunk/3.10

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2014-02-24 23:55:00 +0000 (Mon, 24 Feb 2014)
New Revision: 2698

Added:
   genpatches-2.6/trunk/3.10/1031_linux-3.10.32.patch
Modified:
   genpatches-2.6/trunk/3.10/0000_README
Log:
Linux patch 3.10.32

Modified: genpatches-2.6/trunk/3.10/0000_README
===================================================================
--- genpatches-2.6/trunk/3.10/0000_README	2014-02-24 23:42:49 UTC (rev 2697)
+++ genpatches-2.6/trunk/3.10/0000_README	2014-02-24 23:55:00 UTC (rev 2698)
@@ -166,6 +166,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.10.31
 
+Patch:  1031_linux-3.10.32.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.32
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.10/1031_linux-3.10.32.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1031_linux-3.10.32.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10/1031_linux-3.10.32.patch	2014-02-24 23:55:00 UTC (rev 2698)
@@ -0,0 +1,2000 @@
+diff --git a/Makefile b/Makefile
+index 56b93edbbe4e..aab192446f50 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 31
++SUBLEVEL = 32
+ EXTRAVERSION =
+ NAME = TOSSUG Baby Fish
+ 
+diff --git a/arch/s390/kernel/head64.S b/arch/s390/kernel/head64.S
+index b9e25ae2579c..d7c00507568a 100644
+--- a/arch/s390/kernel/head64.S
++++ b/arch/s390/kernel/head64.S
+@@ -59,7 +59,7 @@ ENTRY(startup_continue)
+ 	.quad	0			# cr12: tracing off
+ 	.quad	0			# cr13: home space segment table
+ 	.quad	0xc0000000		# cr14: machine check handling off
+-	.quad	0			# cr15: linkage stack operations
++	.quad	.Llinkage_stack		# cr15: linkage stack operations
+ .Lpcmsk:.quad	0x0000000180000000
+ .L4malign:.quad 0xffffffffffc00000
+ .Lscan2g:.quad	0x80000000 + 0x20000 - 8	# 2GB + 128K - 8
+@@ -67,12 +67,15 @@ ENTRY(startup_continue)
+ .Lparmaddr:
+ 	.quad	PARMAREA
+ 	.align	64
+-.Lduct: .long	0,0,0,0,.Lduald,0,0,0
++.Lduct: .long	0,.Laste,.Laste,0,.Lduald,0,0,0
+ 	.long	0,0,0,0,0,0,0,0
++.Laste:	.quad	0,0xffffffffffffffff,0,0,0,0,0,0
+ 	.align	128
+ .Lduald:.rept	8
+ 	.long	0x80000000,0,0,0	# invalid access-list entries
+ 	.endr
++.Llinkage_stack:
++	.long	0,0,0x89000000,0,0,0,0x8a000000,0
+ 
+ ENTRY(_ehead)
+ 
+diff --git a/arch/s390/mm/page-states.c b/arch/s390/mm/page-states.c
+index a90d45e9dfb0..27c50f4d90cb 100644
+--- a/arch/s390/mm/page-states.c
++++ b/arch/s390/mm/page-states.c
+@@ -12,6 +12,8 @@
+ #include <linux/mm.h>
+ #include <linux/gfp.h>
+ #include <linux/init.h>
++#include <asm/setup.h>
++#include <asm/ipl.h>
+ 
+ #define ESSA_SET_STABLE		1
+ #define ESSA_SET_UNUSED		2
+@@ -41,6 +43,14 @@ void __init cmma_init(void)
+ 
+ 	if (!cmma_flag)
+ 		return;
++	/*
++	 * Disable CMM for dump, otherwise  the tprot based memory
++	 * detection can fail because of unstable pages.
++	 */
++	if (OLDMEM_BASE || ipl_info.type == IPL_TYPE_FCP_DUMP) {
++		cmma_flag = 0;
++		return;
++	}
+ 	asm volatile(
+ 		"       .insn rrf,0xb9ab0000,%1,%1,0,0\n"
+ 		"0:     la      %0,0\n"
+diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
+index 6aef9fbc09b7..b913915e8e63 100644
+--- a/arch/x86/include/asm/xen/page.h
++++ b/arch/x86/include/asm/xen/page.h
+@@ -79,30 +79,38 @@ static inline int phys_to_machine_mapping_valid(unsigned long pfn)
+ 	return get_phys_to_machine(pfn) != INVALID_P2M_ENTRY;
+ }
+ 
+-static inline unsigned long mfn_to_pfn(unsigned long mfn)
++static inline unsigned long mfn_to_pfn_no_overrides(unsigned long mfn)
+ {
+ 	unsigned long pfn;
+-	int ret = 0;
++	int ret;
+ 
+ 	if (xen_feature(XENFEAT_auto_translated_physmap))
+ 		return mfn;
+ 
+-	if (unlikely(mfn >= machine_to_phys_nr)) {
+-		pfn = ~0;
+-		goto try_override;
+-	}
+-	pfn = 0;
++	if (unlikely(mfn >= machine_to_phys_nr))
++		return ~0;
++
+ 	/*
+ 	 * The array access can fail (e.g., device space beyond end of RAM).
+ 	 * In such cases it doesn't matter what we return (we return garbage),
+ 	 * but we must handle the fault without crashing!
+ 	 */
+ 	ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
+-try_override:
+-	/* ret might be < 0 if there are no entries in the m2p for mfn */
+ 	if (ret < 0)
+-		pfn = ~0;
+-	else if (get_phys_to_machine(pfn) != mfn)
++		return ~0;
++
++	return pfn;
++}
++
++static inline unsigned long mfn_to_pfn(unsigned long mfn)
++{
++	unsigned long pfn;
++
++	if (xen_feature(XENFEAT_auto_translated_physmap))
++		return mfn;
++
++	pfn = mfn_to_pfn_no_overrides(mfn);
++	if (get_phys_to_machine(pfn) != mfn) {
+ 		/*
+ 		 * If this appears to be a foreign mfn (because the pfn
+ 		 * doesn't map back to the mfn), then check the local override
+@@ -111,6 +119,7 @@ try_override:
+ 		 * m2p_find_override_pfn returns ~0 if it doesn't find anything.
+ 		 */
+ 		pfn = m2p_find_override_pfn(mfn, ~0);
++	}
+ 
+ 	/* 
+ 	 * pfn is ~0 if there are no entries in the m2p for mfn or if the
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 22018f70a671..deeb48d9459b 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -284,8 +284,13 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
+ 	raw_local_save_flags(eflags);
+ 	BUG_ON(eflags & X86_EFLAGS_AC);
+ 
+-	if (cpu_has(c, X86_FEATURE_SMAP))
++	if (cpu_has(c, X86_FEATURE_SMAP)) {
++#ifdef CONFIG_X86_SMAP
+ 		set_in_cr4(X86_CR4_SMAP);
++#else
++		clear_in_cr4(X86_CR4_SMAP);
++#endif
++	}
+ }
+ 
+ /*
+diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
+index d4bdd253fea7..e6253195a301 100644
+--- a/arch/x86/kernel/ftrace.c
++++ b/arch/x86/kernel/ftrace.c
+@@ -77,8 +77,7 @@ within(unsigned long addr, unsigned long start, unsigned long end)
+ 	return addr >= start && addr < end;
+ }
+ 
+-static int
+-do_ftrace_mod_code(unsigned long ip, const void *new_code)
++static unsigned long text_ip_addr(unsigned long ip)
+ {
+ 	/*
+ 	 * On x86_64, kernel text mappings are mapped read-only with
+@@ -91,7 +90,7 @@ do_ftrace_mod_code(unsigned long ip, const void *new_code)
+ 	if (within(ip, (unsigned long)_text, (unsigned long)_etext))
+ 		ip = (unsigned long)__va(__pa_symbol(ip));
+ 
+-	return probe_kernel_write((void *)ip, new_code, MCOUNT_INSN_SIZE);
++	return ip;
+ }
+ 
+ static const unsigned char *ftrace_nop_replace(void)
+@@ -123,8 +122,10 @@ ftrace_modify_code_direct(unsigned long ip, unsigned const char *old_code,
+ 	if (memcmp(replaced, old_code, MCOUNT_INSN_SIZE) != 0)
+ 		return -EINVAL;
+ 
++	ip = text_ip_addr(ip);
++
+ 	/* replace the text with the new text */
+-	if (do_ftrace_mod_code(ip, new_code))
++	if (probe_kernel_write((void *)ip, new_code, MCOUNT_INSN_SIZE))
+ 		return -EPERM;
+ 
+ 	sync_core();
+@@ -221,37 +222,51 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
+ 	return -EINVAL;
+ }
+ 
+-int ftrace_update_ftrace_func(ftrace_func_t func)
++static unsigned long ftrace_update_func;
++
++static int update_ftrace_func(unsigned long ip, void *new)
+ {
+-	unsigned long ip = (unsigned long)(&ftrace_call);
+-	unsigned char old[MCOUNT_INSN_SIZE], *new;
++	unsigned char old[MCOUNT_INSN_SIZE];
+ 	int ret;
+ 
+-	memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
+-	new = ftrace_call_replace(ip, (unsigned long)func);
++	memcpy(old, (void *)ip, MCOUNT_INSN_SIZE);
++
++	ftrace_update_func = ip;
++	/* Make sure the breakpoints see the ftrace_update_func update */
++	smp_wmb();
+ 
+ 	/* See comment above by declaration of modifying_ftrace_code */
+ 	atomic_inc(&modifying_ftrace_code);
+ 
+ 	ret = ftrace_modify_code(ip, old, new);
+ 
++	atomic_dec(&modifying_ftrace_code);
++
++	return ret;
++}
++
++int ftrace_update_ftrace_func(ftrace_func_t func)
++{
++	unsigned long ip = (unsigned long)(&ftrace_call);
++	unsigned char *new;
++	int ret;
++
++	new = ftrace_call_replace(ip, (unsigned long)func);
++	ret = update_ftrace_func(ip, new);
++
+ 	/* Also update the regs callback function */
+ 	if (!ret) {
+ 		ip = (unsigned long)(&ftrace_regs_call);
+-		memcpy(old, &ftrace_regs_call, MCOUNT_INSN_SIZE);
+ 		new = ftrace_call_replace(ip, (unsigned long)func);
+-		ret = ftrace_modify_code(ip, old, new);
++		ret = update_ftrace_func(ip, new);
+ 	}
+ 
+-	atomic_dec(&modifying_ftrace_code);
+-
+ 	return ret;
+ }
+ 
+ static int is_ftrace_caller(unsigned long ip)
+ {
+-	if (ip == (unsigned long)(&ftrace_call) ||
+-		ip == (unsigned long)(&ftrace_regs_call))
++	if (ip == ftrace_update_func)
+ 		return 1;
+ 
+ 	return 0;
+@@ -677,45 +692,41 @@ int __init ftrace_dyn_arch_init(void *data)
+ #ifdef CONFIG_DYNAMIC_FTRACE
+ extern void ftrace_graph_call(void);
+ 
+-static int ftrace_mod_jmp(unsigned long ip,
+-			  int old_offset, int new_offset)
++static unsigned char *ftrace_jmp_replace(unsigned long ip, unsigned long addr)
+ {
+-	unsigned char code[MCOUNT_INSN_SIZE];
++	static union ftrace_code_union calc;
+ 
+-	if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
+-		return -EFAULT;
++	/* Jmp not a call (ignore the .e8) */
++	calc.e8		= 0xe9;
++	calc.offset	= ftrace_calc_offset(ip + MCOUNT_INSN_SIZE, addr);
+ 
+-	if (code[0] != 0xe9 || old_offset != *(int *)(&code[1]))
+-		return -EINVAL;
++	/*
++	 * ftrace external locks synchronize the access to the static variable.
++	 */
++	return calc.code;
++}
+ 
+-	*(int *)(&code[1]) = new_offset;
++static int ftrace_mod_jmp(unsigned long ip, void *func)
++{
++	unsigned char *new;
+ 
+-	if (do_ftrace_mod_code(ip, &code))
+-		return -EPERM;
++	new = ftrace_jmp_replace(ip, (unsigned long)func);
+ 
+-	return 0;
++	return update_ftrace_func(ip, new);
+ }
+ 
+ int ftrace_enable_ftrace_graph_caller(void)
+ {
+ 	unsigned long ip = (unsigned long)(&ftrace_graph_call);
+-	int old_offset, new_offset;
+ 
+-	old_offset = (unsigned long)(&ftrace_stub) - (ip + MCOUNT_INSN_SIZE);
+-	new_offset = (unsigned long)(&ftrace_graph_caller) - (ip + MCOUNT_INSN_SIZE);
+-
+-	return ftrace_mod_jmp(ip, old_offset, new_offset);
++	return ftrace_mod_jmp(ip, &ftrace_graph_caller);
+ }
+ 
+ int ftrace_disable_ftrace_graph_caller(void)
+ {
+ 	unsigned long ip = (unsigned long)(&ftrace_graph_call);
+-	int old_offset, new_offset;
+-
+-	old_offset = (unsigned long)(&ftrace_graph_caller) - (ip + MCOUNT_INSN_SIZE);
+-	new_offset = (unsigned long)(&ftrace_stub) - (ip + MCOUNT_INSN_SIZE);
+ 
+-	return ftrace_mod_jmp(ip, old_offset, new_offset);
++	return ftrace_mod_jmp(ip, &ftrace_stub);
+ }
+ 
+ #endif /* !CONFIG_DYNAMIC_FTRACE */
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index 654be4ae3047..c1e9e4cbbd76 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -989,6 +989,12 @@ static int fault_in_kernel_space(unsigned long address)
+ 
+ static inline bool smap_violation(int error_code, struct pt_regs *regs)
+ {
++	if (!IS_ENABLED(CONFIG_X86_SMAP))
++		return false;
++
++	if (!static_cpu_has(X86_FEATURE_SMAP))
++		return false;
++
+ 	if (error_code & PF_USER)
+ 		return false;
+ 
+@@ -1091,11 +1097,9 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code)
+ 	if (unlikely(error_code & PF_RSVD))
+ 		pgtable_bad(regs, error_code, address);
+ 
+-	if (static_cpu_has(X86_FEATURE_SMAP)) {
+-		if (unlikely(smap_violation(error_code, regs))) {
+-			bad_area_nosemaphore(regs, error_code, address);
+-			return;
+-		}
++	if (unlikely(smap_violation(error_code, regs))) {
++		bad_area_nosemaphore(regs, error_code, address);
++		return;
+ 	}
+ 
+ 	perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
+diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
+index 95fb2aa5927e..156344448d19 100644
+--- a/arch/x86/xen/p2m.c
++++ b/arch/x86/xen/p2m.c
+@@ -878,7 +878,6 @@ int m2p_add_override(unsigned long mfn, struct page *page,
+ 	unsigned long uninitialized_var(address);
+ 	unsigned level;
+ 	pte_t *ptep = NULL;
+-	int ret = 0;
+ 
+ 	pfn = page_to_pfn(page);
+ 	if (!PageHighMem(page)) {
+@@ -925,8 +924,8 @@ int m2p_add_override(unsigned long mfn, struct page *page,
+ 	 * frontend pages while they are being shared with the backend,
+ 	 * because mfn_to_pfn (that ends up being called by GUPF) will
+ 	 * return the backend pfn rather than the frontend pfn. */
+-	ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
+-	if (ret == 0 && get_phys_to_machine(pfn) == mfn)
++	pfn = mfn_to_pfn_no_overrides(mfn);
++	if (get_phys_to_machine(pfn) == mfn)
+ 		set_phys_to_machine(pfn, FOREIGN_FRAME(mfn));
+ 
+ 	return 0;
+@@ -941,7 +940,6 @@ int m2p_remove_override(struct page *page,
+ 	unsigned long uninitialized_var(address);
+ 	unsigned level;
+ 	pte_t *ptep = NULL;
+-	int ret = 0;
+ 
+ 	pfn = page_to_pfn(page);
+ 	mfn = get_phys_to_machine(pfn);
+@@ -1019,8 +1017,8 @@ int m2p_remove_override(struct page *page,
+ 	 * the original pfn causes mfn_to_pfn(mfn) to return the frontend
+ 	 * pfn again. */
+ 	mfn &= ~FOREIGN_FRAME_BIT;
+-	ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
+-	if (ret == 0 && get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) &&
++	pfn = mfn_to_pfn_no_overrides(mfn);
++	if (get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) &&
+ 			m2p_find_override(mfn) == NULL)
+ 		set_phys_to_machine(pfn, mfn);
+ 
+diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
+index a1e58e19d0cc..570c9a5c4d3f 100644
+--- a/arch/x86/xen/smp.c
++++ b/arch/x86/xen/smp.c
+@@ -245,6 +245,15 @@ static void __init xen_smp_prepare_boot_cpu(void)
+ 	   old memory can be recycled */
+ 	make_lowmem_page_readwrite(xen_initial_gdt);
+ 
++#ifdef CONFIG_X86_32
++	/*
++	 * Xen starts us with XEN_FLAT_RING1_DS, but linux code
++	 * expects __USER_DS
++	 */
++	loadsegment(ds, __USER_DS);
++	loadsegment(es, __USER_DS);
++#endif
++
+ 	xen_filter_cpu_maps();
+ 	xen_setup_vcpu_info_placement();
+ }
+diff --git a/block/blk-lib.c b/block/blk-lib.c
+index d6f50d572565..9a32f5868fb9 100644
+--- a/block/blk-lib.c
++++ b/block/blk-lib.c
+@@ -121,6 +121,14 @@ int blkdev_issue_discard(struct block_device *bdev, sector_t sector,
+ 
+ 		atomic_inc(&bb.done);
+ 		submit_bio(type, bio);
++
++		/*
++		 * We can loop for a long time in here, if someone does
++		 * full device discards (like mkfs). Be nice and allow
++		 * us to schedule out to avoid softlocking if preempt
++		 * is disabled.
++		 */
++		cond_resched();
+ 	}
+ 	blk_finish_plug(&plug);
+ 
+diff --git a/block/blk.h b/block/blk.h
+index e837b8f619b7..b3bdeb36f361 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -96,7 +96,7 @@ static inline struct request *__elv_next_request(struct request_queue *q)
+ 			q->flush_queue_delayed = 1;
+ 			return NULL;
+ 		}
+-		if (unlikely(blk_queue_dying(q)) ||
++		if (unlikely(blk_queue_bypass(q)) ||
+ 		    !q->elevator->type->ops.elevator_dispatch_fn(q, 0))
+ 			return NULL;
+ 	}
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 69b45fc97276..1735b0d17e29 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1518,13 +1518,16 @@ static void blkback_changed(struct xenbus_device *dev,
+ 	case XenbusStateReconfiguring:
+ 	case XenbusStateReconfigured:
+ 	case XenbusStateUnknown:
+-	case XenbusStateClosed:
+ 		break;
+ 
+ 	case XenbusStateConnected:
+ 		blkfront_connect(info);
+ 		break;
+ 
++	case XenbusStateClosed:
++		if (dev->state == XenbusStateClosed)
++			break;
++		/* Missed the backend's Closing state -- fallthrough */
+ 	case XenbusStateClosing:
+ 		blkfront_closing(info);
+ 		break;
+diff --git a/drivers/char/raw.c b/drivers/char/raw.c
+index f3223aac4df1..6e8d65e9b1d3 100644
+--- a/drivers/char/raw.c
++++ b/drivers/char/raw.c
+@@ -190,7 +190,7 @@ static int bind_get(int number, dev_t *dev)
+ 	struct raw_device_data *rawdev;
+ 	struct block_device *bdev;
+ 
+-	if (number <= 0 || number >= MAX_RAW_MINORS)
++	if (number <= 0 || number >= max_raw_minors)
+ 		return -EINVAL;
+ 
+ 	rawdev = &raw_devices[number];
+diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
+index 89e109022d78..a9d98cdd11f4 100644
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -559,7 +559,8 @@ static void edac_mc_workq_function(struct work_struct *work_req)
+  *
+  *		called with the mem_ctls_mutex held
+  */
+-static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec)
++static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec,
++				bool init)
+ {
+ 	edac_dbg(0, "\n");
+ 
+@@ -567,7 +568,9 @@ static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec)
+ 	if (mci->op_state != OP_RUNNING_POLL)
+ 		return;
+ 
+-	INIT_DELAYED_WORK(&mci->work, edac_mc_workq_function);
++	if (init)
++		INIT_DELAYED_WORK(&mci->work, edac_mc_workq_function);
++
+ 	mod_delayed_work(edac_workqueue, &mci->work, msecs_to_jiffies(msec));
+ }
+ 
+@@ -601,7 +604,7 @@ static void edac_mc_workq_teardown(struct mem_ctl_info *mci)
+  *	user space has updated our poll period value, need to
+  *	reset our workq delays
+  */
+-void edac_mc_reset_delay_period(int value)
++void edac_mc_reset_delay_period(unsigned long value)
+ {
+ 	struct mem_ctl_info *mci;
+ 	struct list_head *item;
+@@ -611,7 +614,7 @@ void edac_mc_reset_delay_period(int value)
+ 	list_for_each(item, &mc_devices) {
+ 		mci = list_entry(item, struct mem_ctl_info, link);
+ 
+-		edac_mc_workq_setup(mci, (unsigned long) value);
++		edac_mc_workq_setup(mci, value, false);
+ 	}
+ 
+ 	mutex_unlock(&mem_ctls_mutex);
+@@ -782,7 +785,7 @@ int edac_mc_add_mc(struct mem_ctl_info *mci)
+ 		/* This instance is NOW RUNNING */
+ 		mci->op_state = OP_RUNNING_POLL;
+ 
+-		edac_mc_workq_setup(mci, edac_mc_get_poll_msec());
++		edac_mc_workq_setup(mci, edac_mc_get_poll_msec(), true);
+ 	} else {
+ 		mci->op_state = OP_RUNNING_INTERRUPT;
+ 	}
+diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
+index c4d700a577d2..88cd940ece63 100644
+--- a/drivers/edac/edac_mc_sysfs.c
++++ b/drivers/edac/edac_mc_sysfs.c
+@@ -52,16 +52,20 @@ int edac_mc_get_poll_msec(void)
+ 
+ static int edac_set_poll_msec(const char *val, struct kernel_param *kp)
+ {
+-	long l;
++	unsigned long l;
+ 	int ret;
+ 
+ 	if (!val)
+ 		return -EINVAL;
+ 
+-	ret = strict_strtol(val, 0, &l);
+-	if (ret == -EINVAL || ((int)l != l))
++	ret = kstrtoul(val, 0, &l);
++	if (ret)
++		return ret;
++
++	if (l < 1000)
+ 		return -EINVAL;
+-	*((int *)kp->arg) = l;
++
++	*((unsigned long *)kp->arg) = l;
+ 
+ 	/* notify edac_mc engine to reset the poll period */
+ 	edac_mc_reset_delay_period(l);
+diff --git a/drivers/edac/edac_module.h b/drivers/edac/edac_module.h
+index 3d139c6e7fe3..f2118bfcf8df 100644
+--- a/drivers/edac/edac_module.h
++++ b/drivers/edac/edac_module.h
+@@ -52,7 +52,7 @@ extern void edac_device_workq_setup(struct edac_device_ctl_info *edac_dev,
+ extern void edac_device_workq_teardown(struct edac_device_ctl_info *edac_dev);
+ extern void edac_device_reset_delay_period(struct edac_device_ctl_info
+ 					   *edac_dev, unsigned long value);
+-extern void edac_mc_reset_delay_period(int value);
++extern void edac_mc_reset_delay_period(unsigned long value);
+ 
+ extern void *edac_align_ptr(void **p, unsigned size, int n_elems);
+ 
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index 1b8c3707bf42..4cf21ec1abe3 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -4509,6 +4509,10 @@ restart_ih:
+ 				break;
+ 			}
+ 			break;
++		case 124: /* UVD */
++			DRM_DEBUG("IH: UVD int: 0x%08x\n", src_data);
++			radeon_fence_process(rdev, R600_RING_TYPE_UVD_INDEX);
++			break;
+ 		case 176: /* CP_INT in ring buffer */
+ 		case 177: /* CP_INT in IB1 */
+ 		case 178: /* CP_INT in IB2 */
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 3cf38ff09e70..03add5d5542e 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -5159,6 +5159,10 @@ restart_ih:
+ 				break;
+ 			}
+ 			break;
++		case 124: /* UVD */
++			DRM_DEBUG("IH: UVD int: 0x%08x\n", src_data);
++			radeon_fence_process(rdev, R600_RING_TYPE_UVD_INDEX);
++			break;
+ 		case 146:
+ 		case 147:
+ 			dev_err(rdev->dev, "GPU fault detected: %d 0x%08x\n", src_id, src_data);
+diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
+index 253a74ba245c..d4fac934b220 100644
+--- a/drivers/hv/connection.c
++++ b/drivers/hv/connection.c
+@@ -67,7 +67,6 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo,
+ 	int ret = 0;
+ 	struct vmbus_channel_initiate_contact *msg;
+ 	unsigned long flags;
+-	int t;
+ 
+ 	init_completion(&msginfo->waitevent);
+ 
+@@ -102,15 +101,7 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo,
+ 	}
+ 
+ 	/* Wait for the connection response */
+-	t =  wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
+-	if (t == 0) {
+-		spin_lock_irqsave(&vmbus_connection.channelmsg_lock,
+-				flags);
+-		list_del(&msginfo->msglistentry);
+-		spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock,
+-					flags);
+-		return -ETIMEDOUT;
+-	}
++	wait_for_completion(&msginfo->waitevent);
+ 
+ 	spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
+ 	list_del(&msginfo->msglistentry);
+diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
+index d6d640a733d5..9297164a23a5 100644
+--- a/drivers/hwmon/ntc_thermistor.c
++++ b/drivers/hwmon/ntc_thermistor.c
+@@ -145,7 +145,7 @@ struct ntc_data {
+ static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata)
+ {
+ 	struct iio_channel *channel = pdata->chan;
+-	unsigned int result;
++	s64 result;
+ 	int val, ret;
+ 
+ 	ret = iio_read_channel_raw(channel, &val);
+@@ -155,10 +155,10 @@ static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata)
+ 	}
+ 
+ 	/* unit: mV */
+-	result = pdata->pullup_uv * val;
++	result = pdata->pullup_uv * (s64) val;
+ 	result >>= 12;
+ 
+-	return result;
++	return (int)result;
+ }
+ 
+ static const struct of_device_id ntc_match[] = {
+diff --git a/drivers/iio/imu/adis16400.h b/drivers/iio/imu/adis16400.h
+index 2f8f9d632386..0916bf6b6c31 100644
+--- a/drivers/iio/imu/adis16400.h
++++ b/drivers/iio/imu/adis16400.h
+@@ -189,6 +189,7 @@ enum {
+ 	ADIS16300_SCAN_INCLI_X,
+ 	ADIS16300_SCAN_INCLI_Y,
+ 	ADIS16400_SCAN_ADC,
++	ADIS16400_SCAN_TIMESTAMP,
+ };
+ 
+ #ifdef CONFIG_IIO_BUFFER
+diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c
+index e58c529aacdf..d6ece2d17dec 100644
+--- a/drivers/iio/imu/adis16400_core.c
++++ b/drivers/iio/imu/adis16400_core.c
+@@ -632,7 +632,7 @@ static const struct iio_chan_spec adis16400_channels[] = {
+ 	ADIS16400_MAGN_CHAN(Z, ADIS16400_ZMAGN_OUT, 14),
+ 	ADIS16400_TEMP_CHAN(ADIS16400_TEMP_OUT, 12),
+ 	ADIS16400_AUX_ADC_CHAN(ADIS16400_AUX_ADC, 12),
+-	IIO_CHAN_SOFT_TIMESTAMP(12)
++	IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP),
+ };
+ 
+ static const struct iio_chan_spec adis16448_channels[] = {
+@@ -659,7 +659,7 @@ static const struct iio_chan_spec adis16448_channels[] = {
+ 		},
+ 	},
+ 	ADIS16400_TEMP_CHAN(ADIS16448_TEMP_OUT, 12),
+-	IIO_CHAN_SOFT_TIMESTAMP(11)
++	IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP),
+ };
+ 
+ static const struct iio_chan_spec adis16350_channels[] = {
+@@ -677,7 +677,7 @@ static const struct iio_chan_spec adis16350_channels[] = {
+ 	ADIS16400_MOD_TEMP_CHAN(X, ADIS16350_XTEMP_OUT, 12),
+ 	ADIS16400_MOD_TEMP_CHAN(Y, ADIS16350_YTEMP_OUT, 12),
+ 	ADIS16400_MOD_TEMP_CHAN(Z, ADIS16350_ZTEMP_OUT, 12),
+-	IIO_CHAN_SOFT_TIMESTAMP(11)
++	IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP),
+ };
+ 
+ static const struct iio_chan_spec adis16300_channels[] = {
+@@ -690,7 +690,7 @@ static const struct iio_chan_spec adis16300_channels[] = {
+ 	ADIS16400_AUX_ADC_CHAN(ADIS16300_AUX_ADC, 12),
+ 	ADIS16400_INCLI_CHAN(X, ADIS16300_PITCH_OUT, 13),
+ 	ADIS16400_INCLI_CHAN(Y, ADIS16300_ROLL_OUT, 13),
+-	IIO_CHAN_SOFT_TIMESTAMP(14)
++	IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP),
+ };
+ 
+ static const struct iio_chan_spec adis16334_channels[] = {
+@@ -701,7 +701,7 @@ static const struct iio_chan_spec adis16334_channels[] = {
+ 	ADIS16400_ACCEL_CHAN(Y, ADIS16400_YACCL_OUT, 14),
+ 	ADIS16400_ACCEL_CHAN(Z, ADIS16400_ZACCL_OUT, 14),
+ 	ADIS16400_TEMP_CHAN(ADIS16350_XTEMP_OUT, 12),
+-	IIO_CHAN_SOFT_TIMESTAMP(8)
++	IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP),
+ };
+ 
+ static struct attribute *adis16400_attributes[] = {
+diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
+index bd8cb0f89ef1..14103ffb4839 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7322.c
++++ b/drivers/infiniband/hw/qib/qib_iba7322.c
+@@ -2287,6 +2287,11 @@ static int qib_7322_bringup_serdes(struct qib_pportdata *ppd)
+ 	qib_write_kreg_port(ppd, krp_ibcctrl_a, ppd->cpspec->ibcctrl_a);
+ 	qib_write_kreg(dd, kr_scratch, 0ULL);
+ 
++	/* ensure previous Tx parameters are not still forced */
++	qib_write_kreg_port(ppd, krp_tx_deemph_override,
++		SYM_MASK(IBSD_TX_DEEMPHASIS_OVERRIDE_0,
++		reset_tx_deemphasis_override));
++
+ 	if (qib_compat_ddr_negotiate) {
+ 		ppd->cpspec->ibdeltainprog = 1;
+ 		ppd->cpspec->ibsymsnap = read_7322_creg32_port(ppd,
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index afaa5d425e9a..e73740b55aea 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1854,11 +1854,15 @@ static int process_checks(struct r1bio *r1_bio)
+ 	for (i = 0; i < conf->raid_disks * 2; i++) {
+ 		int j;
+ 		int size;
++		int uptodate;
+ 		struct bio *b = r1_bio->bios[i];
+ 		if (b->bi_end_io != end_sync_read)
+ 			continue;
+-		/* fixup the bio for reuse */
++		/* fixup the bio for reuse, but preserve BIO_UPTODATE */
++		uptodate = test_bit(BIO_UPTODATE, &b->bi_flags);
+ 		bio_reset(b);
++		if (!uptodate)
++			clear_bit(BIO_UPTODATE, &b->bi_flags);
+ 		b->bi_vcnt = vcnt;
+ 		b->bi_size = r1_bio->sectors << 9;
+ 		b->bi_sector = r1_bio->sector +
+@@ -1891,11 +1895,14 @@ static int process_checks(struct r1bio *r1_bio)
+ 		int j;
+ 		struct bio *pbio = r1_bio->bios[primary];
+ 		struct bio *sbio = r1_bio->bios[i];
++		int uptodate = test_bit(BIO_UPTODATE, &sbio->bi_flags);
+ 
+ 		if (sbio->bi_end_io != end_sync_read)
+ 			continue;
++		/* Now we can 'fixup' the BIO_UPTODATE flag */
++		set_bit(BIO_UPTODATE, &sbio->bi_flags);
+ 
+-		if (test_bit(BIO_UPTODATE, &sbio->bi_flags)) {
++		if (uptodate) {
+ 			for (j = vcnt; j-- ; ) {
+ 				struct page *p, *s;
+ 				p = pbio->bi_io_vec[j].bv_page;
+@@ -1910,7 +1917,7 @@ static int process_checks(struct r1bio *r1_bio)
+ 		if (j >= 0)
+ 			atomic64_add(r1_bio->sectors, &mddev->resync_mismatches);
+ 		if (j < 0 || (test_bit(MD_RECOVERY_CHECK, &mddev->recovery)
+-			      && test_bit(BIO_UPTODATE, &sbio->bi_flags))) {
++			      && uptodate)) {
+ 			/* No need to write to this device. */
+ 			sbio->bi_end_io = NULL;
+ 			rdev_dec_pending(conf->mirrors[i].rdev, mddev);
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 740e3f42bef8..5e3c25d4562c 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -5037,23 +5037,43 @@ raid5_size(struct mddev *mddev, sector_t sectors, int raid_disks)
+ 	return sectors * (raid_disks - conf->max_degraded);
+ }
+ 
++static void free_scratch_buffer(struct r5conf *conf, struct raid5_percpu *percpu)
++{
++	safe_put_page(percpu->spare_page);
++	kfree(percpu->scribble);
++	percpu->spare_page = NULL;
++	percpu->scribble = NULL;
++}
++
++static int alloc_scratch_buffer(struct r5conf *conf, struct raid5_percpu *percpu)
++{
++	if (conf->level == 6 && !percpu->spare_page)
++		percpu->spare_page = alloc_page(GFP_KERNEL);
++	if (!percpu->scribble)
++		percpu->scribble = kmalloc(conf->scribble_len, GFP_KERNEL);
++
++	if (!percpu->scribble || (conf->level == 6 && !percpu->spare_page)) {
++		free_scratch_buffer(conf, percpu);
++		return -ENOMEM;
++	}
++
++	return 0;
++}
++
+ static void raid5_free_percpu(struct r5conf *conf)
+ {
+-	struct raid5_percpu *percpu;
+ 	unsigned long cpu;
+ 
+ 	if (!conf->percpu)
+ 		return;
+ 
+-	get_online_cpus();
+-	for_each_possible_cpu(cpu) {
+-		percpu = per_cpu_ptr(conf->percpu, cpu);
+-		safe_put_page(percpu->spare_page);
+-		kfree(percpu->scribble);
+-	}
+ #ifdef CONFIG_HOTPLUG_CPU
+ 	unregister_cpu_notifier(&conf->cpu_notify);
+ #endif
++
++	get_online_cpus();
++	for_each_possible_cpu(cpu)
++		free_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu));
+ 	put_online_cpus();
+ 
+ 	free_percpu(conf->percpu);
+@@ -5079,15 +5099,7 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action,
+ 	switch (action) {
+ 	case CPU_UP_PREPARE:
+ 	case CPU_UP_PREPARE_FROZEN:
+-		if (conf->level == 6 && !percpu->spare_page)
+-			percpu->spare_page = alloc_page(GFP_KERNEL);
+-		if (!percpu->scribble)
+-			percpu->scribble = kmalloc(conf->scribble_len, GFP_KERNEL);
+-
+-		if (!percpu->scribble ||
+-		    (conf->level == 6 && !percpu->spare_page)) {
+-			safe_put_page(percpu->spare_page);
+-			kfree(percpu->scribble);
++		if (alloc_scratch_buffer(conf, percpu)) {
+ 			pr_err("%s: failed memory allocation for cpu%ld\n",
+ 			       __func__, cpu);
+ 			return notifier_from_errno(-ENOMEM);
+@@ -5095,10 +5107,7 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action,
+ 		break;
+ 	case CPU_DEAD:
+ 	case CPU_DEAD_FROZEN:
+-		safe_put_page(percpu->spare_page);
+-		kfree(percpu->scribble);
+-		percpu->spare_page = NULL;
+-		percpu->scribble = NULL;
++		free_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu));
+ 		break;
+ 	default:
+ 		break;
+@@ -5110,40 +5119,29 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action,
+ static int raid5_alloc_percpu(struct r5conf *conf)
+ {
+ 	unsigned long cpu;
+-	struct page *spare_page;
+-	struct raid5_percpu __percpu *allcpus;
+-	void *scribble;
+-	int err;
++	int err = 0;
+ 
+-	allcpus = alloc_percpu(struct raid5_percpu);
+-	if (!allcpus)
++	conf->percpu = alloc_percpu(struct raid5_percpu);
++	if (!conf->percpu)
+ 		return -ENOMEM;
+-	conf->percpu = allcpus;
++
++#ifdef CONFIG_HOTPLUG_CPU
++	conf->cpu_notify.notifier_call = raid456_cpu_notify;
++	conf->cpu_notify.priority = 0;
++	err = register_cpu_notifier(&conf->cpu_notify);
++	if (err)
++		return err;
++#endif
+ 
+ 	get_online_cpus();
+-	err = 0;
+ 	for_each_present_cpu(cpu) {
+-		if (conf->level == 6) {
+-			spare_page = alloc_page(GFP_KERNEL);
+-			if (!spare_page) {
+-				err = -ENOMEM;
+-				break;
+-			}
+-			per_cpu_ptr(conf->percpu, cpu)->spare_page = spare_page;
+-		}
+-		scribble = kmalloc(conf->scribble_len, GFP_KERNEL);
+-		if (!scribble) {
+-			err = -ENOMEM;
++		err = alloc_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu));
++		if (err) {
++			pr_err("%s: failed memory allocation for cpu%ld\n",
++			       __func__, cpu);
+ 			break;
+ 		}
+-		per_cpu_ptr(conf->percpu, cpu)->scribble = scribble;
+ 	}
+-#ifdef CONFIG_HOTPLUG_CPU
+-	conf->cpu_notify.notifier_call = raid456_cpu_notify;
+-	conf->cpu_notify.priority = 0;
+-	if (err == 0)
+-		err = register_cpu_notifier(&conf->cpu_notify);
+-#endif
+ 	put_online_cpus();
+ 
+ 	return err;
+diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
+index e310ca6ed1a3..957fb36c7eb3 100644
+--- a/drivers/misc/mei/client.c
++++ b/drivers/misc/mei/client.c
+@@ -799,7 +799,6 @@ void mei_cl_all_disconnect(struct mei_device *dev)
+ 	list_for_each_entry_safe(cl, next, &dev->file_list, link) {
+ 		cl->state = MEI_FILE_DISCONNECTED;
+ 		cl->mei_flow_ctrl_creds = 0;
+-		cl->read_cb = NULL;
+ 		cl->timer_count = 0;
+ 	}
+ }
+@@ -829,8 +828,16 @@ void mei_cl_all_read_wakeup(struct mei_device *dev)
+ void mei_cl_all_write_clear(struct mei_device *dev)
+ {
+ 	struct mei_cl_cb *cb, *next;
++	struct list_head *list;
+ 
+-	list_for_each_entry_safe(cb, next, &dev->write_list.list, list) {
++	list = &dev->write_list.list;
++	list_for_each_entry_safe(cb, next, list, list) {
++		list_del(&cb->list);
++		mei_io_cb_free(cb);
++	}
++
++	list = &dev->write_waiting_list.list;
++	list_for_each_entry_safe(cb, next, list, list) {
+ 		list_del(&cb->list);
+ 		mei_io_cb_free(cb);
+ 	}
+diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
+index 17d7fece35d2..57fc06e0f434 100644
+--- a/drivers/net/wireless/ath/ar5523/ar5523.c
++++ b/drivers/net/wireless/ath/ar5523/ar5523.c
+@@ -1764,7 +1764,7 @@ static struct usb_device_id ar5523_id_table[] = {
+ 	AR5523_DEVICE_UX(0x2001, 0x3a04),	/* Dlink / DWLAG122 */
+ 	AR5523_DEVICE_UG(0x1690, 0x0712),	/* Gigaset / AR5523 */
+ 	AR5523_DEVICE_UG(0x1690, 0x0710),	/* Gigaset / SMCWUSBTG */
+-	AR5523_DEVICE_UG(0x129b, 0x160c),	/* Gigaset / USB stick 108
++	AR5523_DEVICE_UG(0x129b, 0x160b),	/* Gigaset / USB stick 108
+ 						   (CyberTAN Technology) */
+ 	AR5523_DEVICE_UG(0x16ab, 0x7801),	/* Globalsun / AR5523_1 */
+ 	AR5523_DEVICE_UX(0x16ab, 0x7811),	/* Globalsun / AR5523_2 */
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+index 21e7edc7207c..04b3822ef93a 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+@@ -1331,21 +1331,22 @@ static void ath9k_htc_sta_rc_update(struct ieee80211_hw *hw,
+ 	struct ath_common *common = ath9k_hw_common(priv->ah);
+ 	struct ath9k_htc_target_rate trate;
+ 
++	if (!(changed & IEEE80211_RC_SUPP_RATES_CHANGED))
++		return;
++
+ 	mutex_lock(&priv->mutex);
+ 	ath9k_htc_ps_wakeup(priv);
+ 
+-	if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
+-		memset(&trate, 0, sizeof(struct ath9k_htc_target_rate));
+-		ath9k_htc_setup_rate(priv, sta, &trate);
+-		if (!ath9k_htc_send_rate_cmd(priv, &trate))
+-			ath_dbg(common, CONFIG,
+-				"Supported rates for sta: %pM updated, rate caps: 0x%X\n",
+-				sta->addr, be32_to_cpu(trate.capflags));
+-		else
+-			ath_dbg(common, CONFIG,
+-				"Unable to update supported rates for sta: %pM\n",
+-				sta->addr);
+-	}
++	memset(&trate, 0, sizeof(struct ath9k_htc_target_rate));
++	ath9k_htc_setup_rate(priv, sta, &trate);
++	if (!ath9k_htc_send_rate_cmd(priv, &trate))
++		ath_dbg(common, CONFIG,
++			"Supported rates for sta: %pM updated, rate caps: 0x%X\n",
++			sta->addr, be32_to_cpu(trate.capflags));
++	else
++		ath_dbg(common, CONFIG,
++			"Unable to update supported rates for sta: %pM\n",
++			sta->addr);
+ 
+ 	ath9k_htc_ps_restore(priv);
+ 	mutex_unlock(&priv->mutex);
+diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+index 6199a0a597a6..a7cf535216c9 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+@@ -180,6 +180,11 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
+ 
+ 	for (ch_idx = 0; ch_idx < IWL_NUM_CHANNELS; ch_idx++) {
+ 		ch_flags = __le16_to_cpup(nvm_ch_flags + ch_idx);
++
++		if (ch_idx >= NUM_2GHZ_CHANNELS &&
++		    !data->sku_cap_band_52GHz_enable)
++			ch_flags &= ~NVM_CHANNEL_VALID;
++
+ 		if (!(ch_flags & NVM_CHANNEL_VALID)) {
+ 			IWL_DEBUG_EEPROM(dev,
+ 					 "Ch. %d Flags %x [%sGHz] - No traffic\n",
+diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
+index 8e1f6c095a9e..b987dfb879df 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
++++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
+@@ -313,7 +313,8 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
+ 
+ 	iwl_mvm_scan_fill_ssids(cmd, req);
+ 
+-	cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL);
++	cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
++					   TX_CMD_FLG_BT_DIS);
+ 	cmd->tx_cmd.sta_id = mvm->aux_sta.sta_id;
+ 	cmd->tx_cmd.life_time = cpu_to_le32(TX_CMD_LIFE_TIME_INFINITE);
+ 	cmd->tx_cmd.rate_n_flags =
+diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
+index 687b34e387ac..0d9e08160fec 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
++++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
+@@ -401,6 +401,8 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
+ 			mvm->status, table.valid);
+ 	}
+ 
++	IWL_ERR(mvm, "Loaded firmware version: %s\n", mvm->fw->fw_version);
++
+ 	trace_iwlwifi_dev_ucode_error(trans->dev, table.error_id, table.tsf_low,
+ 				      table.data1, table.data2, table.data3,
+ 				      table.blink1, table.blink2, table.ilink1,
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index 9e69b4f0d204..00bc55cc821c 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -99,11 +99,12 @@ static unsigned int of_bus_default_get_flags(const __be32 *addr)
+ static int of_bus_pci_match(struct device_node *np)
+ {
+ 	/*
++ 	 * "pciex" is PCI Express
+ 	 * "vci" is for the /chaos bridge on 1st-gen PCI powermacs
+ 	 * "ht" is hypertransport
+ 	 */
+-	return !strcmp(np->type, "pci") || !strcmp(np->type, "vci") ||
+-		!strcmp(np->type, "ht");
++	return !strcmp(np->type, "pci") || !strcmp(np->type, "pciex") ||
++		!strcmp(np->type, "vci") || !strcmp(np->type, "ht");
+ }
+ 
+ static void of_bus_pci_count_cells(struct device_node *np,
+diff --git a/drivers/power/max17040_battery.c b/drivers/power/max17040_battery.c
+index c7ff6d67f158..0fbac861080d 100644
+--- a/drivers/power/max17040_battery.c
++++ b/drivers/power/max17040_battery.c
+@@ -148,7 +148,7 @@ static void max17040_get_online(struct i2c_client *client)
+ {
+ 	struct max17040_chip *chip = i2c_get_clientdata(client);
+ 
+-	if (chip->pdata->battery_online)
++	if (chip->pdata && chip->pdata->battery_online)
+ 		chip->online = chip->pdata->battery_online();
+ 	else
+ 		chip->online = 1;
+@@ -158,7 +158,8 @@ static void max17040_get_status(struct i2c_client *client)
+ {
+ 	struct max17040_chip *chip = i2c_get_clientdata(client);
+ 
+-	if (!chip->pdata->charger_online || !chip->pdata->charger_enable) {
++	if (!chip->pdata || !chip->pdata->charger_online
++			|| !chip->pdata->charger_enable) {
+ 		chip->status = POWER_SUPPLY_STATUS_UNKNOWN;
+ 		return;
+ 	}
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index ca99ac9295cf..32b7bb111eb6 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -584,9 +584,7 @@ static void spi_pump_messages(struct kthread_work *work)
+ 	ret = master->transfer_one_message(master, master->cur_msg);
+ 	if (ret) {
+ 		dev_err(&master->dev,
+-			"failed to transfer one message from queue: %d\n", ret);
+-		master->cur_msg->status = ret;
+-		spi_finalize_current_message(master);
++			"failed to transfer one message from queue\n");
+ 		return;
+ 	}
+ }
+diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
+index f847bbc175e7..acb66a9513cf 100644
+--- a/drivers/staging/comedi/drivers/adv_pci1710.c
++++ b/drivers/staging/comedi/drivers/adv_pci1710.c
+@@ -489,6 +489,7 @@ static int pci171x_insn_write_ao(struct comedi_device *dev,
+ 				 struct comedi_insn *insn, unsigned int *data)
+ {
+ 	struct pci1710_private *devpriv = dev->private;
++	unsigned int val;
+ 	int n, chan, range, ofs;
+ 
+ 	chan = CR_CHAN(insn->chanspec);
+@@ -504,11 +505,14 @@ static int pci171x_insn_write_ao(struct comedi_device *dev,
+ 		outw(devpriv->da_ranges, dev->iobase + PCI171x_DAREF);
+ 		ofs = PCI171x_DA1;
+ 	}
++	val = devpriv->ao_data[chan];
+ 
+-	for (n = 0; n < insn->n; n++)
+-		outw(data[n], dev->iobase + ofs);
++	for (n = 0; n < insn->n; n++) {
++		val = data[n];
++		outw(val, dev->iobase + ofs);
++	}
+ 
+-	devpriv->ao_data[chan] = data[n];
++	devpriv->ao_data[chan] = val;
+ 
+ 	return n;
+ 
+@@ -678,6 +682,7 @@ static int pci1720_insn_write_ao(struct comedi_device *dev,
+ 				 struct comedi_insn *insn, unsigned int *data)
+ {
+ 	struct pci1710_private *devpriv = dev->private;
++	unsigned int val;
+ 	int n, rangereg, chan;
+ 
+ 	chan = CR_CHAN(insn->chanspec);
+@@ -687,13 +692,15 @@ static int pci1720_insn_write_ao(struct comedi_device *dev,
+ 		outb(rangereg, dev->iobase + PCI1720_RANGE);
+ 		devpriv->da_ranges = rangereg;
+ 	}
++	val = devpriv->ao_data[chan];
+ 
+ 	for (n = 0; n < insn->n; n++) {
+-		outw(data[n], dev->iobase + PCI1720_DA0 + (chan << 1));
++		val = data[n];
++		outw(val, dev->iobase + PCI1720_DA0 + (chan << 1));
+ 		outb(0, dev->iobase + PCI1720_SYNCOUT);	/*  update outputs */
+ 	}
+ 
+-	devpriv->ao_data[chan] = data[n];
++	devpriv->ao_data[chan] = val;
+ 
+ 	return n;
+ }
+diff --git a/drivers/staging/iio/adc/ad799x_core.c b/drivers/staging/iio/adc/ad799x_core.c
+index 8dc97b36e05a..b0cb2de93050 100644
+--- a/drivers/staging/iio/adc/ad799x_core.c
++++ b/drivers/staging/iio/adc/ad799x_core.c
+@@ -644,7 +644,8 @@ static int ad799x_probe(struct i2c_client *client,
+ 	return 0;
+ 
+ error_free_irq:
+-	free_irq(client->irq, indio_dev);
++	if (client->irq > 0)
++		free_irq(client->irq, indio_dev);
+ error_cleanup_ring:
+ 	ad799x_ring_cleanup(indio_dev);
+ error_disable_reg:
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index 642239015b46..3ee7217e25b2 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -1089,6 +1089,7 @@ static void gsm_control_modem(struct gsm_mux *gsm, u8 *data, int clen)
+ {
+ 	unsigned int addr = 0;
+ 	unsigned int modem = 0;
++	unsigned int brk = 0;
+ 	struct gsm_dlci *dlci;
+ 	int len = clen;
+ 	u8 *dp = data;
+@@ -1115,6 +1116,16 @@ static void gsm_control_modem(struct gsm_mux *gsm, u8 *data, int clen)
+ 		if (len == 0)
+ 			return;
+ 	}
++	len--;
++	if (len > 0) {
++		while (gsm_read_ea(&brk, *dp++) == 0) {
++			len--;
++			if (len == 0)
++				return;
++		}
++		modem <<= 7;
++		modem |= (brk & 0x7f);
++	}
+ 	tty = tty_port_tty_get(&dlci->port);
+ 	gsm_process_modem(tty, dlci, modem, clen);
+ 	if (tty) {
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 740202d8a5c4..0d1b3757cfb6 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1164,6 +1164,8 @@ static void csi_J(struct vc_data *vc, int vpar)
+ 			scr_memsetw(vc->vc_screenbuf, vc->vc_video_erase_char,
+ 				    vc->vc_screenbuf_size >> 1);
+ 			set_origin(vc);
++			if (CON_IS_VISIBLE(vc))
++				update_screen(vc);
+ 			/* fall through */
+ 		case 2: /* erase whole display */
+ 			count = vc->vc_cols * vc->vc_rows;
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index d3aa353908aa..d53547d2e4c7 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1010,7 +1010,6 @@ static int register_root_hub(struct usb_hcd *hcd)
+ 					dev_name(&usb_dev->dev), retval);
+ 			return retval;
+ 		}
+-		usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev);
+ 	}
+ 
+ 	retval = usb_new_device (usb_dev);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index e604645a1290..3a2eb4cc8959 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -135,7 +135,7 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
+ 	return usb_get_intfdata(hdev->actconfig->interface[0]);
+ }
+ 
+-int usb_device_supports_lpm(struct usb_device *udev)
++static int usb_device_supports_lpm(struct usb_device *udev)
+ {
+ 	/* USB 2.1 (and greater) devices indicate LPM support through
+ 	 * their USB 2.0 Extended Capabilities BOS descriptor.
+@@ -156,11 +156,6 @@ int usb_device_supports_lpm(struct usb_device *udev)
+ 				"Power management will be impacted.\n");
+ 		return 0;
+ 	}
+-
+-	/* udev is root hub */
+-	if (!udev->parent)
+-		return 1;
+-
+ 	if (udev->parent->lpm_capable)
+ 		return 1;
+ 
+diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
+index c49383669cd8..823857767a16 100644
+--- a/drivers/usb/core/usb.h
++++ b/drivers/usb/core/usb.h
+@@ -35,7 +35,6 @@ extern int usb_get_device_descriptor(struct usb_device *dev,
+ 		unsigned int size);
+ extern int usb_get_bos_descriptor(struct usb_device *dev);
+ extern void usb_release_bos_descriptor(struct usb_device *dev);
+-extern int usb_device_supports_lpm(struct usb_device *udev);
+ extern char *usb_cache_string(struct usb_device *udev, int index);
+ extern int usb_set_configuration(struct usb_device *dev, int configuration);
+ extern int usb_choose_configuration(struct usb_device *udev);
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 089248c1d597..b7446a69d2a9 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -155,6 +155,7 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_EV3CON_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_1_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_2_PID) },
+@@ -194,6 +195,8 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
+ 	{ USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_SPROG_II) },
++	{ USB_DEVICE(FTDI_VID, FTDI_TAGSYS_LP101_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_TAGSYS_P200X_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_LENZ_LIUSB_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_XF_632_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_XF_634_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index a7019d1e3058..1e2d369df86e 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -50,6 +50,7 @@
+ #define TI_XDS100V2_PID		0xa6d0
+ 
+ #define FTDI_NXTCAM_PID		0xABB8 /* NXTCam for Mindstorms NXT */
++#define FTDI_EV3CON_PID		0xABB9 /* Mindstorms EV3 Console Adapter */
+ 
+ /* US Interface Navigator (http://www.usinterface.com/) */
+ #define FTDI_USINT_CAT_PID	0xb810	/* Navigator CAT and 2nd PTT lines */
+@@ -363,6 +364,12 @@
+ /* Sprog II (Andrew Crosland's SprogII DCC interface) */
+ #define FTDI_SPROG_II		0xF0C8
+ 
++/*
++ * Two of the Tagsys RFID Readers
++ */
++#define FTDI_TAGSYS_LP101_PID	0xF0E9	/* Tagsys L-P101 RFID*/
++#define FTDI_TAGSYS_P200X_PID	0xF0EE	/* Tagsys Medio P200x RFID*/
++
+ /* an infrared receiver for user access control with IR tags */
+ #define FTDI_PIEGROUP_PID	0xF208	/* Product Id */
+ 
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 5c86f57e4afa..216d20affba8 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1362,7 +1362,8 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1267, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1268, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1269, 0xff, 0xff, 0xff) },
+-	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1271, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) },
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index c65437cfd4a2..968a40201e5f 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -139,6 +139,9 @@ static const struct usb_device_id id_table[] = {
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 0)},	/* Sierra Wireless EM7700 Device Management */
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 2)},	/* Sierra Wireless EM7700 NMEA */
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 3)},	/* Sierra Wireless EM7700 Modem */
++	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 0)},	/* Netgear AirCard 340U Device Management */
++	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 2)},	/* Netgear AirCard 340U NMEA */
++	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 3)},	/* Netgear AirCard 340U Modem */
+ 
+ 	{ }				/* Terminating entry */
+ };
+diff --git a/drivers/usb/storage/Kconfig b/drivers/usb/storage/Kconfig
+index 8470e1b114f2..1dd0604d1911 100644
+--- a/drivers/usb/storage/Kconfig
++++ b/drivers/usb/storage/Kconfig
+@@ -18,7 +18,9 @@ config USB_STORAGE
+ 
+ 	  This option depends on 'SCSI' support being enabled, but you
+ 	  probably also need 'SCSI device support: SCSI disk support'
+-	  (BLK_DEV_SD) for most USB storage devices.
++	  (BLK_DEV_SD) for most USB storage devices.  Some devices also
++	  will require 'Probe all LUNs on each SCSI device'
++	  (SCSI_MULTI_LUN).
+ 
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called usb-storage.
+diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
+index 5db153260827..bb7bf198caab 100644
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -78,6 +78,8 @@ static const char* host_info(struct Scsi_Host *host)
+ 
+ static int slave_alloc (struct scsi_device *sdev)
+ {
++	struct us_data *us = host_to_us(sdev->host);
++
+ 	/*
+ 	 * Set the INQUIRY transfer length to 36.  We don't use any of
+ 	 * the extra data and many devices choke if asked for more or
+@@ -102,6 +104,10 @@ static int slave_alloc (struct scsi_device *sdev)
+ 	 */
+ 	blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1));
+ 
++	/* Tell the SCSI layer if we know there is more than one LUN */
++	if (us->protocol == USB_PR_BULK && us->max_lun > 0)
++		sdev->sdev_bflags |= BLIST_FORCELUN;
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/storage/unusual_cypress.h b/drivers/usb/storage/unusual_cypress.h
+index 65a6a75066a8..82e8ed0324e3 100644
+--- a/drivers/usb/storage/unusual_cypress.h
++++ b/drivers/usb/storage/unusual_cypress.h
+@@ -31,7 +31,7 @@ UNUSUAL_DEV(  0x04b4, 0x6831, 0x0000, 0x9999,
+ 		"Cypress ISD-300LP",
+ 		USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
+ 
+-UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x0219,
++UNUSUAL_DEV( 0x14cd, 0x6116, 0x0160, 0x0160,
+ 		"Super Top",
+ 		"USB 2.0  SATA BRIDGE",
+ 		USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index ad06255c2ade..adbeb255616a 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1455,6 +1455,13 @@ UNUSUAL_DEV( 0x0f88, 0x042e, 0x0100, 0x0100,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_FIX_CAPACITY ),
+ 
++/* Reported by Moritz Moeller-Herrmann <moritz-kernel@××××××××××××××××.de> */
++UNUSUAL_DEV(  0x0fca, 0x8004, 0x0201, 0x0201,
++		"Research In Motion",
++		"BlackBerry Bold 9000",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_MAX_SECTORS_64 ),
++
+ /* Reported by Michael Stattmann <michael@×××××××××.com> */
+ UNUSUAL_DEV(  0x0fce, 0xd008, 0x0000, 0x0000,
+ 		"Sony Ericsson",
+diff --git a/drivers/vme/bridges/vme_ca91cx42.c b/drivers/vme/bridges/vme_ca91cx42.c
+index 64bfea314429..8ca1030675a6 100644
+--- a/drivers/vme/bridges/vme_ca91cx42.c
++++ b/drivers/vme/bridges/vme_ca91cx42.c
+@@ -880,7 +880,7 @@ static ssize_t ca91cx42_master_read(struct vme_master_resource *image,
+ 		if (done == count)
+ 			goto out;
+ 	}
+-	if ((uintptr_t)addr & 0x2) {
++	if ((uintptr_t)(addr + done) & 0x2) {
+ 		if ((count - done) < 2) {
+ 			*(u8 *)(buf + done) = ioread8(addr + done);
+ 			done += 1;
+@@ -934,7 +934,7 @@ static ssize_t ca91cx42_master_write(struct vme_master_resource *image,
+ 		if (done == count)
+ 			goto out;
+ 	}
+-	if ((uintptr_t)addr & 0x2) {
++	if ((uintptr_t)(addr + done) & 0x2) {
+ 		if ((count - done) < 2) {
+ 			iowrite8(*(u8 *)(buf + done), addr + done);
+ 			done += 1;
+diff --git a/drivers/vme/bridges/vme_tsi148.c b/drivers/vme/bridges/vme_tsi148.c
+index 9c1aa4dc39c9..63424060b04f 100644
+--- a/drivers/vme/bridges/vme_tsi148.c
++++ b/drivers/vme/bridges/vme_tsi148.c
+@@ -1283,7 +1283,7 @@ static ssize_t tsi148_master_read(struct vme_master_resource *image, void *buf,
+ 		if (done == count)
+ 			goto out;
+ 	}
+-	if ((uintptr_t)addr & 0x2) {
++	if ((uintptr_t)(addr + done) & 0x2) {
+ 		if ((count - done) < 2) {
+ 			*(u8 *)(buf + done) = ioread8(addr + done);
+ 			done += 1;
+@@ -1365,7 +1365,7 @@ static ssize_t tsi148_master_write(struct vme_master_resource *image, void *buf,
+ 		if (done == count)
+ 			goto out;
+ 	}
+-	if ((uintptr_t)addr & 0x2) {
++	if ((uintptr_t)(addr + done) & 0x2) {
+ 		if ((count - done) < 2) {
+ 			iowrite8(*(u8 *)(buf + done), addr + done);
+ 			done += 1;
+diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c
+index 45e944fe52a6..8dccf73025b3 100644
+--- a/fs/bio-integrity.c
++++ b/fs/bio-integrity.c
+@@ -114,6 +114,14 @@ void bio_integrity_free(struct bio *bio)
+ }
+ EXPORT_SYMBOL(bio_integrity_free);
+ 
++static inline unsigned int bip_integrity_vecs(struct bio_integrity_payload *bip)
++{
++	if (bip->bip_slab == BIO_POOL_NONE)
++		return BIP_INLINE_VECS;
++
++	return bvec_nr_vecs(bip->bip_slab);
++}
++
+ /**
+  * bio_integrity_add_page - Attach integrity metadata
+  * @bio:	bio to update
+@@ -129,7 +137,7 @@ int bio_integrity_add_page(struct bio *bio, struct page *page,
+ 	struct bio_integrity_payload *bip = bio->bi_integrity;
+ 	struct bio_vec *iv;
+ 
+-	if (bip->bip_vcnt >= bvec_nr_vecs(bip->bip_slab)) {
++	if (bip->bip_vcnt >= bip_integrity_vecs(bip)) {
+ 		printk(KERN_ERR "%s: bip_vec full\n", __func__);
+ 		return 0;
+ 	}
+diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
+index 51f5e0ee7237..494b68349667 100644
+--- a/fs/cifs/cifsacl.c
++++ b/fs/cifs/cifsacl.c
+@@ -1027,15 +1027,30 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode,
+ 	__u32 secdesclen = 0;
+ 	struct cifs_ntsd *pntsd = NULL; /* acl obtained from server */
+ 	struct cifs_ntsd *pnntsd = NULL; /* modified acl to be sent to server */
++	struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
++	struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
++	struct cifs_tcon *tcon;
++
++	if (IS_ERR(tlink))
++		return PTR_ERR(tlink);
++	tcon = tlink_tcon(tlink);
+ 
+ 	cifs_dbg(NOISY, "set ACL from mode for %s\n", path);
+ 
+ 	/* Get the security descriptor */
+-	pntsd = get_cifs_acl(CIFS_SB(inode->i_sb), inode, path, &secdesclen);
++
++	if (tcon->ses->server->ops->get_acl == NULL) {
++		cifs_put_tlink(tlink);
++		return -EOPNOTSUPP;
++	}
++
++	pntsd = tcon->ses->server->ops->get_acl(cifs_sb, inode, path,
++						&secdesclen);
+ 	if (IS_ERR(pntsd)) {
+ 		rc = PTR_ERR(pntsd);
+ 		cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc);
+-		goto out;
++		cifs_put_tlink(tlink);
++		return rc;
+ 	}
+ 
+ 	/*
+@@ -1048,6 +1063,7 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode,
+ 	pnntsd = kmalloc(secdesclen, GFP_KERNEL);
+ 	if (!pnntsd) {
+ 		kfree(pntsd);
++		cifs_put_tlink(tlink);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -1056,14 +1072,18 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode,
+ 
+ 	cifs_dbg(NOISY, "build_sec_desc rc: %d\n", rc);
+ 
++	if (tcon->ses->server->ops->set_acl == NULL)
++		rc = -EOPNOTSUPP;
++
+ 	if (!rc) {
+ 		/* Set the security descriptor */
+-		rc = set_cifs_acl(pnntsd, secdesclen, inode, path, aclflag);
++		rc = tcon->ses->server->ops->set_acl(pnntsd, secdesclen, inode,
++						     path, aclflag);
+ 		cifs_dbg(NOISY, "set_cifs_acl rc: %d\n", rc);
+ 	}
++	cifs_put_tlink(tlink);
+ 
+ 	kfree(pnntsd);
+ 	kfree(pntsd);
+-out:
+ 	return rc;
+ }
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index ea3a0b3018a5..e2c2d96491fa 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -370,6 +370,16 @@ struct smb_version_operations {
+ 	void (*new_lease_key)(struct cifs_fid *fid);
+ 	int (*calc_signature)(struct smb_rqst *rqst,
+ 				   struct TCP_Server_Info *server);
++	ssize_t (*query_all_EAs)(const unsigned int, struct cifs_tcon *,
++			const unsigned char *, const unsigned char *, char *,
++			size_t, const struct nls_table *, int);
++	int (*set_EA)(const unsigned int, struct cifs_tcon *, const char *,
++			const char *, const void *, const __u16,
++			const struct nls_table *, int);
++	struct cifs_ntsd * (*get_acl)(struct cifs_sb_info *, struct inode *,
++			const char *, u32 *);
++	int (*set_acl)(struct cifs_ntsd *, __u32, struct inode *, const char *,
++			int);
+ };
+ 
+ struct smb_version_values {
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 449b6cf09b09..9d463501348f 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -490,10 +490,15 @@ static int cifs_sfu_mode(struct cifs_fattr *fattr, const unsigned char *path,
+ 		return PTR_ERR(tlink);
+ 	tcon = tlink_tcon(tlink);
+ 
+-	rc = CIFSSMBQAllEAs(xid, tcon, path, "SETFILEBITS",
+-			    ea_value, 4 /* size of buf */, cifs_sb->local_nls,
+-			    cifs_sb->mnt_cifs_flags &
+-				CIFS_MOUNT_MAP_SPECIAL_CHR);
++	if (tcon->ses->server->ops->query_all_EAs == NULL) {
++		cifs_put_tlink(tlink);
++		return -EOPNOTSUPP;
++	}
++
++	rc = tcon->ses->server->ops->query_all_EAs(xid, tcon, path,
++			"SETFILEBITS", ea_value, 4 /* size of buf */,
++			cifs_sb->local_nls,
++			cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
+ 	cifs_put_tlink(tlink);
+ 	if (rc < 0)
+ 		return (int)rc;
+diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
+index 3efdb9d5c0b8..4885a40f3210 100644
+--- a/fs/cifs/smb1ops.c
++++ b/fs/cifs/smb1ops.c
+@@ -948,6 +948,14 @@ struct smb_version_operations smb1_operations = {
+ 	.mand_lock = cifs_mand_lock,
+ 	.mand_unlock_range = cifs_unlock_range,
+ 	.push_mand_locks = cifs_push_mandatory_locks,
++#ifdef CONFIG_CIFS_XATTR
++	.query_all_EAs = CIFSSMBQAllEAs,
++	.set_EA = CIFSSMBSetEA,
++#endif /* CIFS_XATTR */
++#ifdef CONFIG_CIFS_ACL
++	.get_acl = get_cifs_acl,
++	.set_acl = set_cifs_acl,
++#endif /* CIFS_ACL */
+ };
+ 
+ struct smb_version_values smb1_values = {
+diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
+index 09afda4cc58e..5ac836a86b18 100644
+--- a/fs/cifs/xattr.c
++++ b/fs/cifs/xattr.c
+@@ -82,9 +82,11 @@ int cifs_removexattr(struct dentry *direntry, const char *ea_name)
+ 			goto remove_ea_exit;
+ 
+ 		ea_name += XATTR_USER_PREFIX_LEN; /* skip past user. prefix */
+-		rc = CIFSSMBSetEA(xid, pTcon, full_path, ea_name, NULL,
+-			(__u16)0, cifs_sb->local_nls,
+-			cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
++		if (pTcon->ses->server->ops->set_EA)
++			rc = pTcon->ses->server->ops->set_EA(xid, pTcon,
++				full_path, ea_name, NULL, (__u16)0,
++				cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
++					CIFS_MOUNT_MAP_SPECIAL_CHR);
+ 	}
+ remove_ea_exit:
+ 	kfree(full_path);
+@@ -149,18 +151,22 @@ int cifs_setxattr(struct dentry *direntry, const char *ea_name,
+ 			cifs_dbg(FYI, "attempt to set cifs inode metadata\n");
+ 
+ 		ea_name += XATTR_USER_PREFIX_LEN; /* skip past user. prefix */
+-		rc = CIFSSMBSetEA(xid, pTcon, full_path, ea_name, ea_value,
+-			(__u16)value_size, cifs_sb->local_nls,
+-			cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
++		if (pTcon->ses->server->ops->set_EA)
++			rc = pTcon->ses->server->ops->set_EA(xid, pTcon,
++				full_path, ea_name, ea_value, (__u16)value_size,
++				cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
++					CIFS_MOUNT_MAP_SPECIAL_CHR);
+ 	} else if (strncmp(ea_name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN)
+ 		   == 0) {
+ 		if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR)
+ 			goto set_ea_exit;
+ 
+ 		ea_name += XATTR_OS2_PREFIX_LEN; /* skip past os2. prefix */
+-		rc = CIFSSMBSetEA(xid, pTcon, full_path, ea_name, ea_value,
+-			(__u16)value_size, cifs_sb->local_nls,
+-			cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
++		if (pTcon->ses->server->ops->set_EA)
++			rc = pTcon->ses->server->ops->set_EA(xid, pTcon,
++				full_path, ea_name, ea_value, (__u16)value_size,
++				cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
++					CIFS_MOUNT_MAP_SPECIAL_CHR);
+ 	} else if (strncmp(ea_name, CIFS_XATTR_CIFS_ACL,
+ 			strlen(CIFS_XATTR_CIFS_ACL)) == 0) {
+ #ifdef CONFIG_CIFS_ACL
+@@ -170,8 +176,12 @@ int cifs_setxattr(struct dentry *direntry, const char *ea_name,
+ 			rc = -ENOMEM;
+ 		} else {
+ 			memcpy(pacl, ea_value, value_size);
+-			rc = set_cifs_acl(pacl, value_size,
+-				direntry->d_inode, full_path, CIFS_ACL_DACL);
++			if (pTcon->ses->server->ops->set_acl)
++				rc = pTcon->ses->server->ops->set_acl(pacl,
++						value_size, direntry->d_inode,
++						full_path, CIFS_ACL_DACL);
++			else
++				rc = -EOPNOTSUPP;
+ 			if (rc == 0) /* force revalidate of the inode */
+ 				CIFS_I(direntry->d_inode)->time = 0;
+ 			kfree(pacl);
+@@ -272,17 +282,21 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
+ 			/* revalidate/getattr then populate from inode */
+ 		} /* BB add else when above is implemented */
+ 		ea_name += XATTR_USER_PREFIX_LEN; /* skip past user. prefix */
+-		rc = CIFSSMBQAllEAs(xid, pTcon, full_path, ea_name, ea_value,
+-			buf_size, cifs_sb->local_nls,
+-			cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
++		if (pTcon->ses->server->ops->query_all_EAs)
++			rc = pTcon->ses->server->ops->query_all_EAs(xid, pTcon,
++				full_path, ea_name, ea_value, buf_size,
++				cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
++					CIFS_MOUNT_MAP_SPECIAL_CHR);
+ 	} else if (strncmp(ea_name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN) == 0) {
+ 		if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR)
+ 			goto get_ea_exit;
+ 
+ 		ea_name += XATTR_OS2_PREFIX_LEN; /* skip past os2. prefix */
+-		rc = CIFSSMBQAllEAs(xid, pTcon, full_path, ea_name, ea_value,
+-			buf_size, cifs_sb->local_nls,
+-			cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
++		if (pTcon->ses->server->ops->query_all_EAs)
++			rc = pTcon->ses->server->ops->query_all_EAs(xid, pTcon,
++				full_path, ea_name, ea_value, buf_size,
++				cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
++					CIFS_MOUNT_MAP_SPECIAL_CHR);
+ 	} else if (strncmp(ea_name, POSIX_ACL_XATTR_ACCESS,
+ 			  strlen(POSIX_ACL_XATTR_ACCESS)) == 0) {
+ #ifdef CONFIG_CIFS_POSIX
+@@ -313,8 +327,11 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
+ 			u32 acllen;
+ 			struct cifs_ntsd *pacl;
+ 
+-			pacl = get_cifs_acl(cifs_sb, direntry->d_inode,
+-						full_path, &acllen);
++			if (pTcon->ses->server->ops->get_acl == NULL)
++				goto get_ea_exit; /* rc already EOPNOTSUPP */
++
++			pacl = pTcon->ses->server->ops->get_acl(cifs_sb,
++					direntry->d_inode, full_path, &acllen);
+ 			if (IS_ERR(pacl)) {
+ 				rc = PTR_ERR(pacl);
+ 				cifs_dbg(VFS, "%s: error %zd getting sec desc\n",
+@@ -400,11 +417,12 @@ ssize_t cifs_listxattr(struct dentry *direntry, char *data, size_t buf_size)
+ 	/* if proc/fs/cifs/streamstoxattr is set then
+ 		search server for EAs or streams to
+ 		returns as xattrs */
+-	rc = CIFSSMBQAllEAs(xid, pTcon, full_path, NULL, data,
+-				buf_size, cifs_sb->local_nls,
+-				cifs_sb->mnt_cifs_flags &
+-					CIFS_MOUNT_MAP_SPECIAL_CHR);
+ 
++	if (pTcon->ses->server->ops->query_all_EAs)
++		rc = pTcon->ses->server->ops->query_all_EAs(xid, pTcon,
++				full_path, NULL, data, buf_size,
++				cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
++					CIFS_MOUNT_MAP_SPECIAL_CHR);
+ list_ea_exit:
+ 	kfree(full_path);
+ 	free_xid(xid);
+diff --git a/fs/file.c b/fs/file.c
+index 4a78f981557a..9de20265a78c 100644
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -34,7 +34,7 @@ static void *alloc_fdmem(size_t size)
+ 	 * vmalloc() if the allocation size will be considered "large" by the VM.
+ 	 */
+ 	if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
+-		void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN);
++		void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY);
+ 		if (data != NULL)
+ 			return data;
+ 	}
+diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
+index 8ebd3f551e0c..ffc4045fc62e 100644
+--- a/fs/lockd/svclock.c
++++ b/fs/lockd/svclock.c
+@@ -767,6 +767,7 @@ nlmsvc_grant_blocked(struct nlm_block *block)
+ 	struct nlm_file		*file = block->b_file;
+ 	struct nlm_lock		*lock = &block->b_call->a_args.lock;
+ 	int			error;
++	loff_t			fl_start, fl_end;
+ 
+ 	dprintk("lockd: grant blocked lock %p\n", block);
+ 
+@@ -784,9 +785,16 @@ nlmsvc_grant_blocked(struct nlm_block *block)
+ 	}
+ 
+ 	/* Try the lock operation again */
++	/* vfs_lock_file() can mangle fl_start and fl_end, but we need
++	 * them unchanged for the GRANT_MSG
++	 */
+ 	lock->fl.fl_flags |= FL_SLEEP;
++	fl_start = lock->fl.fl_start;
++	fl_end = lock->fl.fl_end;
+ 	error = vfs_lock_file(file->f_file, F_SETLK, &lock->fl, NULL);
+ 	lock->fl.fl_flags &= ~FL_SLEEP;
++	lock->fl.fl_start = fl_start;
++	lock->fl.fl_end = fl_end;
+ 
+ 	switch (error) {
+ 	case 0:
+diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
+index ded429966c1f..2507fd2a1eb4 100644
+--- a/include/linux/compiler-gcc4.h
++++ b/include/linux/compiler-gcc4.h
+@@ -75,11 +75,7 @@
+  *
+  * (asm goto is automatically volatile - the naming reflects this.)
+  */
+-#if GCC_VERSION <= 40801
+-# define asm_volatile_goto(x...)	do { asm goto(x); asm (""); } while (0)
+-#else
+-# define asm_volatile_goto(x...)	do { asm goto(x); } while (0)
+-#endif
++#define asm_volatile_goto(x...)	do { asm goto(x); asm (""); } while (0)
+ 
+ #ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP
+ #if GCC_VERSION >= 40400
+diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
+index 192a302d6cfd..8ab8e9390297 100644
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -274,6 +274,7 @@ struct irq_desc *irq_to_desc(unsigned int irq)
+ {
+ 	return (irq < NR_IRQS) ? irq_desc + irq : NULL;
+ }
++EXPORT_SYMBOL(irq_to_desc);
+ 
+ static void free_desc(unsigned int irq)
+ {
+diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
+index 7a925ba456fb..a6a5bf53e86d 100644
+--- a/kernel/time/jiffies.c
++++ b/kernel/time/jiffies.c
+@@ -51,7 +51,13 @@
+  * HZ shrinks, so values greater than 8 overflow 32bits when
+  * HZ=100.
+  */
++#if HZ < 34
++#define JIFFIES_SHIFT	6
++#elif HZ < 67
++#define JIFFIES_SHIFT	7
++#else
+ #define JIFFIES_SHIFT	8
++#endif
+ 
+ static cycle_t jiffies_read(struct clocksource *cs)
+ {
+diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
+index 52d4827cf2d4..f681da32a2ff 100644
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -745,6 +745,7 @@ out:
+ static void tick_broadcast_clear_oneshot(int cpu)
+ {
+ 	cpumask_clear_cpu(cpu, tick_broadcast_oneshot_mask);
++	cpumask_clear_cpu(cpu, tick_broadcast_pending_mask);
+ }
+ 
+ static void tick_broadcast_init_next_event(struct cpumask *mask,
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index e444ff88f0a4..fd12cc56371f 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2396,6 +2396,13 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
+ 	write &= RB_WRITE_MASK;
+ 	tail = write - length;
+ 
++	/*
++	 * If this is the first commit on the page, then it has the same
++	 * timestamp as the page itself.
++	 */
++	if (!tail)
++		delta = 0;
++
+ 	/* See if we shot pass the end of this buffer page */
+ 	if (unlikely(write > BUF_PAGE_SIZE))
+ 		return rb_move_tail(cpu_buffer, length, tail,
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index f2a591d87d00..e386beefc994 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -943,8 +943,10 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
+ 			 * to it. Similarly, page lock is shifted.
+ 			 */
+ 			if (hpage != p) {
+-				put_page(hpage);
+-				get_page(p);
++				if (!(flags & MF_COUNT_INCREASED)) {
++					put_page(hpage);
++					get_page(p);
++				}
+ 				lock_page(p);
+ 				unlock_page(hpage);
+ 				*hpagep = p;
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 18687f1fca75..e922bf3f422c 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -975,8 +975,10 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
+ 					IEEE80211_P2P_OPPPS_ENABLE_BIT;
+ 
+ 	err = ieee80211_assign_beacon(sdata, &params->beacon);
+-	if (err < 0)
++	if (err < 0) {
++		ieee80211_vif_release_channel(sdata);
+ 		return err;
++	}
+ 	changed |= err;
+ 
+ 	err = drv_start_ap(sdata->local, sdata);
+@@ -985,6 +987,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
+ 		if (old)
+ 			kfree_rcu(old, rcu_head);
+ 		RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
++		ieee80211_vif_release_channel(sdata);
+ 		return err;
+ 	}
+ 
+@@ -2476,6 +2479,24 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
+ 	INIT_DELAYED_WORK(&roc->work, ieee80211_sw_roc_work);
+ 	INIT_LIST_HEAD(&roc->dependents);
+ 
++	/*
++	 * cookie is either the roc cookie (for normal roc)
++	 * or the SKB (for mgmt TX)
++	 */
++	if (!txskb) {
++		/* local->mtx protects this */
++		local->roc_cookie_counter++;
++		roc->cookie = local->roc_cookie_counter;
++		/* wow, you wrapped 64 bits ... more likely a bug */
++		if (WARN_ON(roc->cookie == 0)) {
++			roc->cookie = 1;
++			local->roc_cookie_counter++;
++		}
++		*cookie = roc->cookie;
++	} else {
++		*cookie = (unsigned long)txskb;
++	}
++
+ 	/* if there's one pending or we're scanning, queue this one */
+ 	if (!list_empty(&local->roc_list) ||
+ 	    local->scanning || local->radar_detect_enabled)
+@@ -2610,24 +2631,6 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
+ 	if (!queued)
+ 		list_add_tail(&roc->list, &local->roc_list);
+ 
+-	/*
+-	 * cookie is either the roc cookie (for normal roc)
+-	 * or the SKB (for mgmt TX)
+-	 */
+-	if (!txskb) {
+-		/* local->mtx protects this */
+-		local->roc_cookie_counter++;
+-		roc->cookie = local->roc_cookie_counter;
+-		/* wow, you wrapped 64 bits ... more likely a bug */
+-		if (WARN_ON(roc->cookie == 0)) {
+-			roc->cookie = 1;
+-			local->roc_cookie_counter++;
+-		}
+-		*cookie = roc->cookie;
+-	} else {
+-		*cookie = (unsigned long)txskb;
+-	}
+-
+ 	return 0;
+ }
+ 
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index cc65cdddb047..fe9d6e7b904b 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -854,7 +854,7 @@ static int ieee80211_fragment(struct ieee80211_tx_data *tx,
+ 	}
+ 
+ 	/* adjust first fragment's length */
+-	skb->len = hdrlen + per_fragm;
++	skb_trim(skb, hdrlen + per_fragm);
+ 	return 0;
+ }
+ 
+diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
+index 45f9a3377dcd..4319a3824727 100644
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -208,8 +208,8 @@ static void do_usb_entry(void *symval,
+ 				range_lo < 0x9 ? "[%X-9" : "[%X",
+ 				range_lo);
+ 			sprintf(alias + strlen(alias),
+-				range_hi > 0xA ? "a-%X]" : "%X]",
+-				range_lo);
++				range_hi > 0xA ? "A-%X]" : "%X]",
++				range_hi);
+ 		}
+ 	}
+ 	if (bcdDevice_initial_digits < (sizeof(bcdDevice_lo) * 2 - 1))
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 87a03aca1b2e..e0bdcb3ecf0e 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3700,6 +3700,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
+ 	SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
+ 	SND_PCI_QUIRK(0x1043, 0x8516, "ASUS X101CH", ALC269_FIXUP_ASUS_X101),
++	SND_PCI_QUIRK(0x104d, 0x90b5, "Sony VAIO Pro 11", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x104d, 0x9073, "Sony VAIO", ALC275_FIXUP_SONY_VAIO_GPIO2),
+ 	SND_PCI_QUIRK(0x104d, 0x907b, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
+diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c
+index 88b2fe3ddf42..00d86427af0f 100644
+--- a/virt/kvm/coalesced_mmio.c
++++ b/virt/kvm/coalesced_mmio.c
+@@ -154,17 +154,13 @@ int kvm_vm_ioctl_register_coalesced_mmio(struct kvm *kvm,
+ 	list_add_tail(&dev->list, &kvm->coalesced_zones);
+ 	mutex_unlock(&kvm->slots_lock);
+ 
+-	return ret;
++	return 0;
+ 
+ out_free_dev:
+ 	mutex_unlock(&kvm->slots_lock);
+-
+ 	kfree(dev);
+ 
+-	if (dev == NULL)
+-		return -ENXIO;
+-
+-	return 0;
++	return ret;
+ }
+ 
+ int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm,