* [gentoo-commits] linux-patches r2471 - in genpatches-2.6/trunk: 3.0 3.10 3.4
@ 2013-08-12 10:42 Tom Wijsman (tomwij)
0 siblings, 0 replies; only message in thread
From: Tom Wijsman (tomwij) @ 2013-08-12 10:42 UTC (permalink / raw
To: gentoo-commits
Author: tomwij
Date: 2013-08-12 10:42:00 +0000 (Mon, 12 Aug 2013)
New Revision: 2471
Added:
genpatches-2.6/trunk/3.0/1088_linux-3.0.89.patch
genpatches-2.6/trunk/3.0/1089_linux-3.0.90.patch
genpatches-2.6/trunk/3.10/1005_linux-3.10.6.patch
genpatches-2.6/trunk/3.4/1055_linux-3.4.56.patch
genpatches-2.6/trunk/3.4/1056_linux-3.4.57.patch
Modified:
genpatches-2.6/trunk/3.0/0000_README
genpatches-2.6/trunk/3.10/0000_README
genpatches-2.6/trunk/3.4/0000_README
Log:
Linux patches 3.0.89, 3.0.90, 3.4.56, 3.4.57 and 3.10.6.
Modified: genpatches-2.6/trunk/3.0/0000_README
===================================================================
--- genpatches-2.6/trunk/3.0/0000_README 2013-08-06 15:26:12 UTC (rev 2470)
+++ genpatches-2.6/trunk/3.0/0000_README 2013-08-12 10:42:00 UTC (rev 2471)
@@ -387,6 +387,14 @@
From: http://www.kernel.org
Desc: Linux 3.0.88
+Patch: 1088_linux-3.0.89.patch
+From: http://www.kernel.org
+Desc: Linux 3.0.89
+
+Patch: 1089_linux-3.0.90.patch
+From: http://www.kernel.org
+Desc: Linux 3.0.90
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
Added: genpatches-2.6/trunk/3.0/1088_linux-3.0.89.patch
===================================================================
--- genpatches-2.6/trunk/3.0/1088_linux-3.0.89.patch (rev 0)
+++ genpatches-2.6/trunk/3.0/1088_linux-3.0.89.patch 2013-08-12 10:42:00 UTC (rev 2471)
@@ -0,0 +1,949 @@
+diff --git a/Makefile b/Makefile
+index 2b40b0a..45f74af 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 0
+-SUBLEVEL = 88
++SUBLEVEL = 89
+ EXTRAVERSION =
+ NAME = Sneaky Weasel
+
+diff --git a/arch/powerpc/include/asm/module.h b/arch/powerpc/include/asm/module.h
+index 0192a4e..80de64b 100644
+--- a/arch/powerpc/include/asm/module.h
++++ b/arch/powerpc/include/asm/module.h
+@@ -87,10 +87,9 @@ struct exception_table_entry;
+ void sort_ex_table(struct exception_table_entry *start,
+ struct exception_table_entry *finish);
+
+-#ifdef CONFIG_MODVERSIONS
++#if defined(CONFIG_MODVERSIONS) && defined(CONFIG_PPC64)
+ #define ARCH_RELOCATES_KCRCTAB
+-
+-extern const unsigned long reloc_start[];
++#define reloc_start PHYSICAL_START
+ #endif
+ #endif /* __KERNEL__ */
+ #endif /* _ASM_POWERPC_MODULE_H */
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index 920276c..3e8fe4b 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -38,9 +38,6 @@ jiffies = jiffies_64 + 4;
+ #endif
+ SECTIONS
+ {
+- . = 0;
+- reloc_start = .;
+-
+ . = KERNELBASE;
+
+ /*
+diff --git a/drivers/acpi/acpi_memhotplug.c b/drivers/acpi/acpi_memhotplug.c
+index d985713..f81597f 100644
+--- a/drivers/acpi/acpi_memhotplug.c
++++ b/drivers/acpi/acpi_memhotplug.c
+@@ -421,6 +421,7 @@ static int acpi_memory_device_add(struct acpi_device *device)
+ /* Get the range from the _CRS */
+ result = acpi_memory_get_device_resources(mem_device);
+ if (result) {
++ device->driver_data = NULL;
+ kfree(mem_device);
+ return result;
+ }
+diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
+index 75afa75..34575fb 100644
+--- a/drivers/ata/Kconfig
++++ b/drivers/ata/Kconfig
+@@ -93,7 +93,7 @@ config SATA_FSL
+ If unsure, say N.
+
+ config SATA_INIC162X
+- tristate "Initio 162x SATA support"
++ tristate "Initio 162x SATA support (Very Experimental)"
+ depends on PCI
+ help
+ This option enables support for Initio 162x Serial ATA.
+diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
+index 83a4447..15391ee 100644
+--- a/drivers/ata/sata_inic162x.c
++++ b/drivers/ata/sata_inic162x.c
+@@ -6,6 +6,18 @@
+ *
+ * This file is released under GPL v2.
+ *
++ * **** WARNING ****
++ *
++ * This driver never worked properly and unfortunately data corruption is
++ * relatively common. There isn't anyone working on the driver and there's
++ * no support from the vendor. Do not use this driver in any production
++ * environment.
++ *
++ * http://thread.gmane.org/gmane.linux.debian.devel.bugs.rc/378525/focus=54491
++ * https://bugzilla.kernel.org/show_bug.cgi?id=60565
++ *
++ * *****************
++ *
+ * This controller is eccentric and easily locks up if something isn't
+ * right. Documentation is available at initio's website but it only
+ * documents registers (not programming model).
+@@ -810,6 +822,8 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (!printed_version++)
+ dev_printk(KERN_DEBUG, &pdev->dev, "version " DRV_VERSION "\n");
+
++ dev_alert(&pdev->dev, "inic162x support is broken with common data corruption issues and will be disabled by default, contact linux-ide@vger.kernel.org if in production use\n");
++
+ /* alloc host */
+ host = ata_host_alloc_pinfo(&pdev->dev, ppi, NR_PORTS);
+ hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL);
+diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
+index 6b84d279..a1df7d7 100644
+--- a/drivers/gpu/drm/radeon/atom.c
++++ b/drivers/gpu/drm/radeon/atom.c
+@@ -1220,12 +1220,17 @@ int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
+ int r;
+
+ mutex_lock(&ctx->mutex);
++ /* reset data block */
++ ctx->data_block = 0;
+ /* reset reg block */
+ ctx->reg_block = 0;
+ /* reset fb window */
+ ctx->fb_base = 0;
+ /* reset io mode */
+ ctx->io_mode = ATOM_IO_MM;
++ /* reset divmul */
++ ctx->divmul[0] = 0;
++ ctx->divmul[1] = 0;
+ r = atom_execute_table_locked(ctx, index, params);
+ mutex_unlock(&ctx->mutex);
+ return r;
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index 98fb3d7..f616e40 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -147,7 +147,7 @@ static uint16_t combios_get_table_offset(struct drm_device *dev,
+ enum radeon_combios_table_offset table)
+ {
+ struct radeon_device *rdev = dev->dev_private;
+- int rev;
++ int rev, size;
+ uint16_t offset = 0, check_offset;
+
+ if (!rdev->bios)
+@@ -156,174 +156,106 @@ static uint16_t combios_get_table_offset(struct drm_device *dev,
+ switch (table) {
+ /* absolute offset tables */
+ case COMBIOS_ASIC_INIT_1_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0xc);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0xc;
+ break;
+ case COMBIOS_BIOS_SUPPORT_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x14);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x14;
+ break;
+ case COMBIOS_DAC_PROGRAMMING_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x2a);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x2a;
+ break;
+ case COMBIOS_MAX_COLOR_DEPTH_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x2c);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x2c;
+ break;
+ case COMBIOS_CRTC_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x2e);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x2e;
+ break;
+ case COMBIOS_PLL_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x30);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x30;
+ break;
+ case COMBIOS_TV_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x32);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x32;
+ break;
+ case COMBIOS_DFP_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x34);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x34;
+ break;
+ case COMBIOS_HW_CONFIG_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x36);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x36;
+ break;
+ case COMBIOS_MULTIMEDIA_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x38);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x38;
+ break;
+ case COMBIOS_TV_STD_PATCH_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x3e);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x3e;
+ break;
+ case COMBIOS_LCD_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x40);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x40;
+ break;
+ case COMBIOS_MOBILE_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x42);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x42;
+ break;
+ case COMBIOS_PLL_INIT_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x46);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x46;
+ break;
+ case COMBIOS_MEM_CONFIG_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x48);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x48;
+ break;
+ case COMBIOS_SAVE_MASK_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x4a);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x4a;
+ break;
+ case COMBIOS_HARDCODED_EDID_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x4c);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x4c;
+ break;
+ case COMBIOS_ASIC_INIT_2_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x4e);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x4e;
+ break;
+ case COMBIOS_CONNECTOR_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x50);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x50;
+ break;
+ case COMBIOS_DYN_CLK_1_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x52);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x52;
+ break;
+ case COMBIOS_RESERVED_MEM_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x54);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x54;
+ break;
+ case COMBIOS_EXT_TMDS_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x58);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x58;
+ break;
+ case COMBIOS_MEM_CLK_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x5a);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x5a;
+ break;
+ case COMBIOS_EXT_DAC_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x5c);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x5c;
+ break;
+ case COMBIOS_MISC_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x5e);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x5e;
+ break;
+ case COMBIOS_CRT_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x60);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x60;
+ break;
+ case COMBIOS_INTEGRATED_SYSTEM_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x62);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x62;
+ break;
+ case COMBIOS_COMPONENT_VIDEO_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x64);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x64;
+ break;
+ case COMBIOS_FAN_SPEED_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x66);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x66;
+ break;
+ case COMBIOS_OVERDRIVE_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x68);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x68;
+ break;
+ case COMBIOS_OEM_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x6a);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x6a;
+ break;
+ case COMBIOS_DYN_CLK_2_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x6c);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x6c;
+ break;
+ case COMBIOS_POWER_CONNECTOR_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x6e);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x6e;
+ break;
+ case COMBIOS_I2C_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x70);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x70;
+ break;
+ /* relative offset tables */
+ case COMBIOS_ASIC_INIT_3_TABLE: /* offset from misc info */
+@@ -439,11 +371,16 @@ static uint16_t combios_get_table_offset(struct drm_device *dev,
+ }
+ break;
+ default:
++ check_offset = 0;
+ break;
+ }
+
+- return offset;
++ size = RBIOS8(rdev->bios_header_start + 0x6);
++ /* check absolute offset tables */
++ if (table < COMBIOS_ASIC_INIT_3_TABLE && check_offset && check_offset < size)
++ offset = RBIOS16(rdev->bios_header_start + check_offset);
+
++ return offset;
+ }
+
+ bool radeon_combios_check_hardcoded_edid(struct radeon_device *rdev)
+@@ -953,8 +890,10 @@ struct radeon_encoder_primary_dac *radeon_combios_get_primary_dac_info(struct
+ dac = RBIOS8(dac_info + 0x3) & 0xf;
+ p_dac->ps2_pdac_adj = (bg << 8) | (dac);
+ }
+- /* if the values are all zeros, use the table */
+- if (p_dac->ps2_pdac_adj)
++ /* if the values are zeros, use the table */
++ if ((dac == 0) || (bg == 0))
++ found = 0;
++ else
+ found = 1;
+ }
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index f685324..316a565 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -480,7 +480,7 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
+ {
+ struct virtnet_info *vi = container_of(napi, struct virtnet_info, napi);
+ void *buf;
+- unsigned int len, received = 0;
++ unsigned int r, len, received = 0;
+
+ again:
+ while (received < budget &&
+@@ -497,8 +497,9 @@ again:
+
+ /* Out of packets? */
+ if (received < budget) {
++ r = virtqueue_enable_cb_prepare(vi->rvq);
+ napi_complete(napi);
+- if (unlikely(!virtqueue_enable_cb(vi->rvq)) &&
++ if (unlikely(virtqueue_poll(vi->rvq, r)) &&
+ napi_schedule_prep(napi)) {
+ virtqueue_disable_cb(vi->rvq);
+ __napi_schedule(napi);
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index 7bac3cd..d2fb950 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -422,6 +422,8 @@ qla2x00_start_scsi(srb_t *sp)
+ __constant_cpu_to_le16(CF_SIMPLE_TAG);
+ break;
+ }
++ } else {
++ cmd_pkt->control_flags = __constant_cpu_to_le16(CF_SIMPLE_TAG);
+ }
+
+ /* Load SCSI command packet. */
+@@ -1099,11 +1101,11 @@ qla24xx_build_scsi_crc_2_iocbs(srb_t *sp, struct cmd_type_crc_2 *cmd_pkt,
+ fcp_cmnd->task_attribute = TSK_ORDERED;
+ break;
+ default:
+- fcp_cmnd->task_attribute = 0;
++ fcp_cmnd->task_attribute = TSK_SIMPLE;
+ break;
+ }
+ } else {
+- fcp_cmnd->task_attribute = 0;
++ fcp_cmnd->task_attribute = TSK_SIMPLE;
+ }
+
+ cmd_pkt->fcp_rsp_dseg_len = 0; /* Let response come in status iocb */
+@@ -1305,7 +1307,12 @@ qla24xx_start_scsi(srb_t *sp)
+ case ORDERED_QUEUE_TAG:
+ cmd_pkt->task = TSK_ORDERED;
+ break;
++ default:
++ cmd_pkt->task = TSK_SIMPLE;
++ break;
+ }
++ } else {
++ cmd_pkt->task = TSK_SIMPLE;
+ }
+
+ /* Load SCSI command packet. */
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 43c7a90..3d15a37 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -641,10 +641,17 @@ static int scsi_setup_flush_cmnd(struct scsi_device *sdp, struct request *rq)
+
+ static void sd_unprep_fn(struct request_queue *q, struct request *rq)
+ {
++ struct scsi_cmnd *SCpnt = rq->special;
++
+ if (rq->cmd_flags & REQ_DISCARD) {
+ free_page((unsigned long)rq->buffer);
+ rq->buffer = NULL;
+ }
++ if (SCpnt->cmnd != rq->cmd) {
++ mempool_free(SCpnt->cmnd, sd_cdb_pool);
++ SCpnt->cmnd = NULL;
++ SCpnt->cmd_len = 0;
++ }
+ }
+
+ /**
+@@ -1451,21 +1458,6 @@ static int sd_done(struct scsi_cmnd *SCpnt)
+ if (rq_data_dir(SCpnt->request) == READ && scsi_prot_sg_count(SCpnt))
+ sd_dif_complete(SCpnt, good_bytes);
+
+- if (scsi_host_dif_capable(sdkp->device->host, sdkp->protection_type)
+- == SD_DIF_TYPE2_PROTECTION && SCpnt->cmnd != SCpnt->request->cmd) {
+-
+- /* We have to print a failed command here as the
+- * extended CDB gets freed before scsi_io_completion()
+- * is called.
+- */
+- if (result)
+- scsi_print_command(SCpnt);
+-
+- mempool_free(SCpnt->cmnd, sd_cdb_pool);
+- SCpnt->cmnd = NULL;
+- SCpnt->cmd_len = 0;
+- }
+-
+ return good_bytes;
+ }
+
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index ee33cba..40b40ed 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -1370,6 +1370,7 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
+ void *file)
+ {
+ struct comedi_subdevice *s;
++ int ret;
+
+ if (arg >= dev->n_subdevices)
+ return -EINVAL;
+@@ -1386,7 +1387,11 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
+ if (s->busy != file)
+ return -EBUSY;
+
+- return do_cancel(dev, s);
++ ret = do_cancel(dev, s);
++ if (comedi_get_subdevice_runflags(s) & SRF_USER)
++ wake_up_interruptible(&s->async->wait_head);
++
++ return ret;
+ }
+
+ /*
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index be9cac6..cb98968 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -463,6 +463,15 @@ resubmit:
+ static inline int
+ hub_clear_tt_buffer (struct usb_device *hdev, u16 devinfo, u16 tt)
+ {
++ /* Need to clear both directions for control ep */
++ if (((devinfo >> 11) & USB_ENDPOINT_XFERTYPE_MASK) ==
++ USB_ENDPOINT_XFER_CONTROL) {
++ int status = usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++ HUB_CLEAR_TT_BUFFER, USB_RT_PORT,
++ devinfo ^ 0x8000, tt, NULL, 0, 1000);
++ if (status)
++ return status;
++ }
+ return usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+ HUB_CLEAR_TT_BUFFER, USB_RT_PORT, devinfo,
+ tt, NULL, 0, 1000);
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 151ca5e..f40567e 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -465,7 +465,7 @@ static void ring_doorbell_for_active_rings(struct xhci_hcd *xhci,
+
+ /* A ring has pending URBs if its TD list is not empty */
+ if (!(ep->ep_state & EP_HAS_STREAMS)) {
+- if (!(list_empty(&ep->ring->td_list)))
++ if (ep->ring && !(list_empty(&ep->ring->td_list)))
+ xhci_ring_ep_doorbell(xhci, slot_id, ep_index, 0);
+ return;
+ }
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 4864b25..7f07eb8 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -956,9 +956,6 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
+ }
+
+ xhci = hcd_to_xhci(hcd);
+- if (xhci->xhc_state & XHCI_STATE_HALTED)
+- return -ENODEV;
+-
+ if (check_virt_dev) {
+ if (!udev->slot_id || !xhci->devs
+ || !xhci->devs[udev->slot_id]) {
+@@ -975,6 +972,9 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
+ }
+ }
+
++ if (xhci->xhc_state & XHCI_STATE_HALTED)
++ return -ENODEV;
++
+ return 1;
+ }
+
+diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
+index dd573ab..7af163d 100644
+--- a/drivers/usb/misc/sisusbvga/sisusb.c
++++ b/drivers/usb/misc/sisusbvga/sisusb.c
+@@ -3247,6 +3247,7 @@ static const struct usb_device_id sisusb_table[] = {
+ { USB_DEVICE(0x0711, 0x0903) },
+ { USB_DEVICE(0x0711, 0x0918) },
+ { USB_DEVICE(0x0711, 0x0920) },
++ { USB_DEVICE(0x0711, 0x0950) },
+ { USB_DEVICE(0x182d, 0x021c) },
+ { USB_DEVICE(0x182d, 0x0269) },
+ { }
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 45e55e2..04d5427 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -743,9 +743,34 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+ { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
+- { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
+- { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) },
+- { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_RTS01_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29A_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29F_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S01_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29C_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_81B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_82B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5D_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K4Y_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5G_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S05_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_60_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_61_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_64_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_65_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92D_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_W5R_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_A5R_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_PW1_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
+ { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 5d25e26..61685ed 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -815,11 +815,35 @@
+ /*
+ * RT Systems programming cables for various ham radios
+ */
+-#define RTSYSTEMS_VID 0x2100 /* Vendor ID */
+-#define RTSYSTEMS_SERIAL_VX7_PID 0x9e52 /* Serial converter for VX-7 Radios using FT232RL */
+-#define RTSYSTEMS_CT29B_PID 0x9e54 /* CT29B Radio Cable */
+-#define RTSYSTEMS_RTS01_PID 0x9e57 /* USB-RTS01 Radio Cable */
+-
++#define RTSYSTEMS_VID 0x2100 /* Vendor ID */
++#define RTSYSTEMS_USB_S03_PID 0x9001 /* RTS-03 USB to Serial Adapter */
++#define RTSYSTEMS_USB_59_PID 0x9e50 /* USB-59 USB to 8 pin plug */
++#define RTSYSTEMS_USB_57A_PID 0x9e51 /* USB-57A USB to 4pin 3.5mm plug */
++#define RTSYSTEMS_USB_57B_PID 0x9e52 /* USB-57B USB to extended 4pin 3.5mm plug */
++#define RTSYSTEMS_USB_29A_PID 0x9e53 /* USB-29A USB to 3.5mm stereo plug */
++#define RTSYSTEMS_USB_29B_PID 0x9e54 /* USB-29B USB to 6 pin mini din */
++#define RTSYSTEMS_USB_29F_PID 0x9e55 /* USB-29F USB to 6 pin modular plug */
++#define RTSYSTEMS_USB_62B_PID 0x9e56 /* USB-62B USB to 8 pin mini din plug*/
++#define RTSYSTEMS_USB_S01_PID 0x9e57 /* USB-RTS01 USB to 3.5 mm stereo plug*/
++#define RTSYSTEMS_USB_63_PID 0x9e58 /* USB-63 USB to 9 pin female*/
++#define RTSYSTEMS_USB_29C_PID 0x9e59 /* USB-29C USB to 4 pin modular plug*/
++#define RTSYSTEMS_USB_81B_PID 0x9e5A /* USB-81 USB to 8 pin mini din plug*/
++#define RTSYSTEMS_USB_82B_PID 0x9e5B /* USB-82 USB to 2.5 mm stereo plug*/
++#define RTSYSTEMS_USB_K5D_PID 0x9e5C /* USB-K5D USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_K4Y_PID 0x9e5D /* USB-K4Y USB to 2.5/3.5 mm plugs*/
++#define RTSYSTEMS_USB_K5G_PID 0x9e5E /* USB-K5G USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_S05_PID 0x9e5F /* USB-RTS05 USB to 2.5 mm stereo plug*/
++#define RTSYSTEMS_USB_60_PID 0x9e60 /* USB-60 USB to 6 pin din*/
++#define RTSYSTEMS_USB_61_PID 0x9e61 /* USB-61 USB to 6 pin mini din*/
++#define RTSYSTEMS_USB_62_PID 0x9e62 /* USB-62 USB to 8 pin mini din*/
++#define RTSYSTEMS_USB_63B_PID 0x9e63 /* USB-63 USB to 9 pin female*/
++#define RTSYSTEMS_USB_64_PID 0x9e64 /* USB-64 USB to 9 pin male*/
++#define RTSYSTEMS_USB_65_PID 0x9e65 /* USB-65 USB to 9 pin female null modem*/
++#define RTSYSTEMS_USB_92_PID 0x9e66 /* USB-92 USB to 12 pin plug*/
++#define RTSYSTEMS_USB_92D_PID 0x9e67 /* USB-92D USB to 12 pin plug data*/
++#define RTSYSTEMS_USB_W5R_PID 0x9e68 /* USB-W5R USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_A5R_PID 0x9e69 /* USB-A5R USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_PW1_PID 0x9e6A /* USB-PW1 USB to 8 pin modular plug*/
+
+ /*
+ * Physik Instrumente
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index a8c4f44..4757880 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -409,7 +409,7 @@ static int ti_startup(struct usb_serial *serial)
+ usb_set_serial_data(serial, tdev);
+
+ /* determine device type */
+- if (usb_match_id(serial->interface, ti_id_table_3410))
++ if (serial->type == &ti_1port_device)
+ tdev->td_is_3410 = 1;
+ dbg("%s - device type is %s", __func__,
+ tdev->td_is_3410 ? "3410" : "5052");
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 7b8d564..e073e2f 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -657,6 +657,20 @@ UNUSUAL_DEV( 0x054c, 0x016a, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_FIX_INQUIRY ),
+
++/* Submitted by Ren Bigcren <bigcren.ren@sonymobile.com> */
++UNUSUAL_DEV( 0x054c, 0x02a5, 0x0100, 0x0100,
++ "Sony Corp.",
++ "MicroVault Flash Drive",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_READ_CAPACITY_16 ),
++
++/* Submitted by Ren Bigcren <bigcren.ren@sonymobile.com> */
++UNUSUAL_DEV( 0x054c, 0x02a5, 0x0100, 0x0100,
++ "Sony Corp.",
++ "MicroVault Flash Drive",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_READ_CAPACITY_16 ),
++
+ /* floppy reports multiple luns */
+ UNUSUAL_DEV( 0x055d, 0x2020, 0x0000, 0x0210,
+ "SAMSUNG",
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 92bd773..a0aecab 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -359,9 +359,22 @@ void virtqueue_disable_cb(struct virtqueue *_vq)
+ }
+ EXPORT_SYMBOL_GPL(virtqueue_disable_cb);
+
+-bool virtqueue_enable_cb(struct virtqueue *_vq)
++/**
++ * virtqueue_enable_cb_prepare - restart callbacks after disable_cb
++ * @vq: the struct virtqueue we're talking about.
++ *
++ * This re-enables callbacks; it returns current queue state
++ * in an opaque unsigned value. This value should be later tested by
++ * virtqueue_poll, to detect a possible race between the driver checking for
++ * more work, and enabling callbacks.
++ *
++ * Caller must ensure we don't call this with other virtqueue
++ * operations at the same time (except where noted).
++ */
++unsigned virtqueue_enable_cb_prepare(struct virtqueue *_vq)
+ {
+ struct vring_virtqueue *vq = to_vvq(_vq);
++ u16 last_used_idx;
+
+ START_USE(vq);
+
+@@ -371,15 +384,45 @@ bool virtqueue_enable_cb(struct virtqueue *_vq)
+ * either clear the flags bit or point the event index at the next
+ * entry. Always do both to keep code simple. */
+ vq->vring.avail->flags &= ~VRING_AVAIL_F_NO_INTERRUPT;
+- vring_used_event(&vq->vring) = vq->last_used_idx;
++ vring_used_event(&vq->vring) = last_used_idx = vq->last_used_idx;
++ END_USE(vq);
++ return last_used_idx;
++}
++EXPORT_SYMBOL_GPL(virtqueue_enable_cb_prepare);
++
++/**
++ * virtqueue_poll - query pending used buffers
++ * @vq: the struct virtqueue we're talking about.
++ * @last_used_idx: virtqueue state (from call to virtqueue_enable_cb_prepare).
++ *
++ * Returns "true" if there are pending used buffers in the queue.
++ *
++ * This does not need to be serialized.
++ */
++bool virtqueue_poll(struct virtqueue *_vq, unsigned last_used_idx)
++{
++ struct vring_virtqueue *vq = to_vvq(_vq);
++
+ virtio_mb();
+- if (unlikely(more_used(vq))) {
+- END_USE(vq);
+- return false;
+- }
++ return (u16)last_used_idx != vq->vring.used->idx;
++}
++EXPORT_SYMBOL_GPL(virtqueue_poll);
+
+- END_USE(vq);
+- return true;
++/**
++ * virtqueue_enable_cb - restart callbacks after disable_cb.
++ * @vq: the struct virtqueue we're talking about.
++ *
++ * This re-enables callbacks; it returns "false" if there are pending
++ * buffers in the queue, to detect a possible race between the driver
++ * checking for more work, and enabling callbacks.
++ *
++ * Caller must ensure we don't call this with other virtqueue
++ * operations at the same time (except where noted).
++ */
++bool virtqueue_enable_cb(struct virtqueue *_vq)
++{
++ unsigned last_used_idx = virtqueue_enable_cb_prepare(_vq);
++ return !virtqueue_poll(_vq, last_used_idx);
+ }
+ EXPORT_SYMBOL_GPL(virtqueue_enable_cb);
+
+diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
+index dbc13e9..ce3a0f5 100644
+--- a/drivers/xen/evtchn.c
++++ b/drivers/xen/evtchn.c
+@@ -367,18 +367,12 @@ static long evtchn_ioctl(struct file *file,
+ if (unbind.port >= NR_EVENT_CHANNELS)
+ break;
+
+- spin_lock_irq(&port_user_lock);
+-
+ rc = -ENOTCONN;
+- if (get_port_user(unbind.port) != u) {
+- spin_unlock_irq(&port_user_lock);
++ if (get_port_user(unbind.port) != u)
+ break;
+- }
+
+ disable_irq(irq_from_evtchn(unbind.port));
+
+- spin_unlock_irq(&port_user_lock);
+-
+ evtchn_unbind_from_user(u, unbind.port);
+
+ rc = 0;
+@@ -478,26 +472,15 @@ static int evtchn_release(struct inode *inode, struct file *filp)
+ int i;
+ struct per_user_data *u = filp->private_data;
+
+- spin_lock_irq(&port_user_lock);
+-
+- free_page((unsigned long)u->ring);
+-
+ for (i = 0; i < NR_EVENT_CHANNELS; i++) {
+ if (get_port_user(i) != u)
+ continue;
+
+ disable_irq(irq_from_evtchn(i));
+- }
+-
+- spin_unlock_irq(&port_user_lock);
+-
+- for (i = 0; i < NR_EVENT_CHANNELS; i++) {
+- if (get_port_user(i) != u)
+- continue;
+-
+ evtchn_unbind_from_user(get_port_user(i), i);
+ }
+
++ free_page((unsigned long)u->ring);
+ kfree(u->name);
+ kfree(u);
+
+diff --git a/fs/super.c b/fs/super.c
+index caf4dfa..a448af5 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -222,19 +222,19 @@ EXPORT_SYMBOL(deactivate_super);
+ * and want to turn it into a full-blown active reference. grab_super()
+ * is called with sb_lock held and drops it. Returns 1 in case of
+ * success, 0 if we had failed (superblock contents was already dead or
+- * dying when grab_super() had been called).
++ * dying when grab_super() had been called). Note that this is only
++ * called for superblocks not in rundown mode (== ones still on ->fs_supers
++ * of their type), so increment of ->s_count is OK here.
+ */
+ static int grab_super(struct super_block *s) __releases(sb_lock)
+ {
+- if (atomic_inc_not_zero(&s->s_active)) {
+- spin_unlock(&sb_lock);
+- return 1;
+- }
+- /* it's going away */
+ s->s_count++;
+ spin_unlock(&sb_lock);
+- /* wait for it to die */
+ down_write(&s->s_umount);
++ if ((s->s_flags & MS_BORN) && atomic_inc_not_zero(&s->s_active)) {
++ put_super(s);
++ return 1;
++ }
+ up_write(&s->s_umount);
+ put_super(s);
+ return 0;
+@@ -335,11 +335,6 @@ retry:
+ destroy_super(s);
+ s = NULL;
+ }
+- down_write(&old->s_umount);
+- if (unlikely(!(old->s_flags & MS_BORN))) {
+- deactivate_locked_super(old);
+- goto retry;
+- }
+ return old;
+ }
+ }
+@@ -512,10 +507,10 @@ restart:
+ if (list_empty(&sb->s_instances))
+ continue;
+ if (sb->s_bdev == bdev) {
+- if (grab_super(sb)) /* drops sb_lock */
+- return sb;
+- else
++ if (!grab_super(sb))
+ goto restart;
++ up_write(&sb->s_umount);
++ return sb;
+ }
+ }
+ spin_unlock(&sb_lock);
+diff --git a/include/linux/virtio.h b/include/linux/virtio.h
+index 7108857..a39e962 100644
+--- a/include/linux/virtio.h
++++ b/include/linux/virtio.h
+@@ -93,6 +93,10 @@ void virtqueue_disable_cb(struct virtqueue *vq);
+
+ bool virtqueue_enable_cb(struct virtqueue *vq);
+
++unsigned virtqueue_enable_cb_prepare(struct virtqueue *vq);
++
++bool virtqueue_poll(struct virtqueue *vq, unsigned);
++
+ bool virtqueue_enable_cb_delayed(struct virtqueue *vq);
+
+ void *virtqueue_detach_unused_buf(struct virtqueue *vq);
+diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
+index 9b7dad8..5819cd5 100644
+--- a/kernel/trace/trace_syscalls.c
++++ b/kernel/trace/trace_syscalls.c
+@@ -357,6 +357,9 @@ void ftrace_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
+ if (!sys_data)
+ return;
+
++ local_save_flags(irq_flags);
++ pc = preempt_count();
++
+ event = trace_current_buffer_lock_reserve(&buffer,
+ sys_data->exit_event->event.type, sizeof(*entry),
+ irq_flags, pc);
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 1b94f08..1edf00e 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5737,6 +5737,10 @@ __offline_isolated_pages(unsigned long start_pfn, unsigned long end_pfn)
+ zone->free_area[order].nr_free--;
+ __mod_zone_page_state(zone, NR_FREE_PAGES,
+ - (1UL << order));
++#ifdef CONFIG_HIGHMEM
++ if (PageHighMem(page))
++ totalhigh_pages -= 1 << order;
++#endif
+ for (i = 0; i < (1 << order); i++)
+ SetPageReserved((page+i));
+ pfn += (1 << order);
+diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c
+index a69eede..1d5cff2 100644
+--- a/sound/soc/codecs/max98088.c
++++ b/sound/soc/codecs/max98088.c
+@@ -1598,7 +1598,7 @@ static int max98088_dai2_digital_mute(struct snd_soc_dai *codec_dai, int mute)
+
+ static void max98088_sync_cache(struct snd_soc_codec *codec)
+ {
+- u16 *reg_cache = codec->reg_cache;
++ u8 *reg_cache = codec->reg_cache;
+ int i;
+
+ if (!codec->cache_sync)
Added: genpatches-2.6/trunk/3.0/1089_linux-3.0.90.patch
===================================================================
--- genpatches-2.6/trunk/3.0/1089_linux-3.0.90.patch (rev 0)
+++ genpatches-2.6/trunk/3.0/1089_linux-3.0.90.patch 2013-08-12 10:42:00 UTC (rev 2471)
@@ -0,0 +1,553 @@
+diff --git a/MAINTAINERS b/MAINTAINERS
+index d81f637..08e6f61 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -5725,7 +5725,6 @@ P: Vincent Sanders <vince@simtec.co.uk>
+ M: Simtec Linux Team <linux@simtec.co.uk>
+ W: http://www.simtec.co.uk/products/EB110ATX/
+ S: Supported
+-F: Documentation/stable_kernel_rules.txt
+
+ SIMTEC EB2410ITX (BAST)
+ P: Ben Dooks
+@@ -6041,7 +6040,8 @@ F: arch/alpha/kernel/srm_env.c
+ STABLE BRANCH
+ M: Greg Kroah-Hartman <greg@kroah.com>
+ L: stable@vger.kernel.org
+-S: Maintained
++S: Supported
++F: Documentation/stable_kernel_rules.txt
+
+ STAGING SUBSYSTEM
+ M: Greg Kroah-Hartman <gregkh@suse.de>
+diff --git a/Makefile b/Makefile
+index 45f74af..4789f7a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 0
+-SUBLEVEL = 89
++SUBLEVEL = 90
+ EXTRAVERSION =
+ NAME = Sneaky Weasel
+
+diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
+index 12aff25..f7183ec 100644
+--- a/arch/x86/kernel/i387.c
++++ b/arch/x86/kernel/i387.c
+@@ -51,7 +51,7 @@ void __cpuinit mxcsr_feature_mask_init(void)
+ clts();
+ if (cpu_has_fxsr) {
+ memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct));
+- asm volatile("fxsave %0" : : "m" (fx_scratch));
++ asm volatile("fxsave %0" : "+m" (fx_scratch));
+ mask = fx_scratch.mxcsr_mask;
+ if (mask == 0)
+ mask = 0x0000ffbf;
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index 4a15d57..908f40a 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -118,6 +118,7 @@ struct acpi_battery {
+ struct acpi_device *device;
+ struct notifier_block pm_nb;
+ unsigned long update_time;
++ int revision;
+ int rate_now;
+ int capacity_now;
+ int voltage_now;
+@@ -350,6 +351,7 @@ static struct acpi_offsets info_offsets[] = {
+ };
+
+ static struct acpi_offsets extended_info_offsets[] = {
++ {offsetof(struct acpi_battery, revision), 0},
+ {offsetof(struct acpi_battery, power_unit), 0},
+ {offsetof(struct acpi_battery, design_capacity), 0},
+ {offsetof(struct acpi_battery, full_charge_capacity), 0},
+diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
+index a746ba2..a956053 100644
+--- a/drivers/net/arcnet/arcnet.c
++++ b/drivers/net/arcnet/arcnet.c
+@@ -1007,7 +1007,7 @@ static void arcnet_rx(struct net_device *dev, int bufnum)
+
+ soft = &pkt.soft.rfc1201;
+
+- lp->hw.copy_from_card(dev, bufnum, 0, &pkt, sizeof(ARC_HDR_SIZE));
++ lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE);
+ if (pkt.hard.offset[0]) {
+ ofs = pkt.hard.offset[0];
+ length = 256 - ofs;
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index 2f4775f..be27891 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -43,7 +43,6 @@
+ #define EEPROM_MAC_OFFSET (0x01)
+ #define DEFAULT_TX_CSUM_ENABLE (true)
+ #define DEFAULT_RX_CSUM_ENABLE (true)
+-#define DEFAULT_TSO_ENABLE (true)
+ #define SMSC75XX_INTERNAL_PHY_ID (1)
+ #define SMSC75XX_TX_OVERHEAD (8)
+ #define MAX_RX_FIFO_SIZE (20 * 1024)
+@@ -1034,17 +1033,14 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
+
+ INIT_WORK(&pdata->set_multicast, smsc75xx_deferred_multicast_write);
+
+- if (DEFAULT_TX_CSUM_ENABLE) {
++ if (DEFAULT_TX_CSUM_ENABLE)
+ dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+- if (DEFAULT_TSO_ENABLE)
+- dev->net->features |= NETIF_F_SG |
+- NETIF_F_TSO | NETIF_F_TSO6;
+- }
++
+ if (DEFAULT_RX_CSUM_ENABLE)
+ dev->net->features |= NETIF_F_RXCSUM;
+
+ dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+- NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_RXCSUM;
++ NETIF_F_RXCSUM;
+
+ /* Init all registers */
+ ret = smsc75xx_reset(dev);
+@@ -1169,8 +1165,6 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
+ {
+ u32 tx_cmd_a, tx_cmd_b;
+
+- skb_linearize(skb);
+-
+ if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
+ struct sk_buff *skb2 =
+ skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index 4099712..403d33f 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -873,6 +873,7 @@ static int ath9k_init_device(struct ath9k_htc_priv *priv,
+ if (error != 0)
+ goto err_rx;
+
++ ath9k_hw_disable(priv->ah);
+ #ifdef CONFIG_MAC80211_LEDS
+ /* must be initialized before ieee80211_register_hw */
+ priv->led_cdev.default_trigger = ieee80211_create_tpt_led_trigger(priv->hw,
+diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
+index 3b1217f..61e152d 100644
+--- a/drivers/net/wireless/mwifiex/sdio.c
++++ b/drivers/net/wireless/mwifiex/sdio.c
+@@ -1387,8 +1387,8 @@ static int mwifiex_sdio_host_to_card(struct mwifiex_adapter *adapter,
+ /* Allocate buffer and copy payload */
+ blk_size = MWIFIEX_SDIO_BLOCK_SIZE;
+ buf_block_len = (pkt_len + blk_size - 1) / blk_size;
+- *(u16 *) &payload[0] = (u16) pkt_len;
+- *(u16 *) &payload[2] = type;
++ *(__le16 *)&payload[0] = cpu_to_le16((u16)pkt_len);
++ *(__le16 *)&payload[2] = cpu_to_le16(type);
+
+ /*
+ * This is SDIO specific header
+diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
+index 76f26ad..2d7c59f 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
+@@ -848,13 +848,8 @@ void rt2x00queue_index_inc(struct queue_entry *entry, enum queue_index index)
+ spin_unlock_irqrestore(&queue->index_lock, irqflags);
+ }
+
+-void rt2x00queue_pause_queue(struct data_queue *queue)
++void rt2x00queue_pause_queue_nocheck(struct data_queue *queue)
+ {
+- if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
+- !test_bit(QUEUE_STARTED, &queue->flags) ||
+- test_and_set_bit(QUEUE_PAUSED, &queue->flags))
+- return;
+-
+ switch (queue->qid) {
+ case QID_AC_VO:
+ case QID_AC_VI:
+@@ -870,6 +865,15 @@ void rt2x00queue_pause_queue(struct data_queue *queue)
+ break;
+ }
+ }
++void rt2x00queue_pause_queue(struct data_queue *queue)
++{
++ if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
++ !test_bit(QUEUE_STARTED, &queue->flags) ||
++ test_and_set_bit(QUEUE_PAUSED, &queue->flags))
++ return;
++
++ rt2x00queue_pause_queue_nocheck(queue);
++}
+ EXPORT_SYMBOL_GPL(rt2x00queue_pause_queue);
+
+ void rt2x00queue_unpause_queue(struct data_queue *queue)
+@@ -931,7 +935,7 @@ void rt2x00queue_stop_queue(struct data_queue *queue)
+ return;
+ }
+
+- rt2x00queue_pause_queue(queue);
++ rt2x00queue_pause_queue_nocheck(queue);
+
+ queue->rt2x00dev->ops->lib->stop_queue(queue);
+
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 5b3d063..ab7d11e 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -374,11 +374,18 @@ static void mxs_auart_settermios(struct uart_port *u,
+
+ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
+ {
+- u32 istatus, istat;
++ u32 istat;
+ struct mxs_auart_port *s = context;
+ u32 stat = readl(s->port.membase + AUART_STAT);
+
+- istatus = istat = readl(s->port.membase + AUART_INTR);
++ istat = readl(s->port.membase + AUART_INTR);
++
++ /* ack irq */
++ writel(istat & (AUART_INTR_RTIS
++ | AUART_INTR_TXIS
++ | AUART_INTR_RXIS
++ | AUART_INTR_CTSMIS),
++ s->port.membase + AUART_INTR_CLR);
+
+ if (istat & AUART_INTR_CTSMIS) {
+ uart_handle_cts_change(&s->port, stat & AUART_STAT_CTS);
+@@ -397,12 +404,6 @@ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
+ istat &= ~AUART_INTR_TXIS;
+ }
+
+- writel(istatus & (AUART_INTR_RTIS
+- | AUART_INTR_TXIS
+- | AUART_INTR_RXIS
+- | AUART_INTR_CTSMIS),
+- s->port.membase + AUART_INTR_CLR);
+-
+ return IRQ_HANDLED;
+ }
+
+@@ -542,7 +543,7 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
+ struct mxs_auart_port *s;
+ struct uart_port *port;
+ unsigned int old_ctrl0, old_ctrl2;
+- unsigned int to = 1000;
++ unsigned int to = 20000;
+
+ if (co->index > MXS_AUART_PORTS || co->index < 0)
+ return;
+@@ -563,18 +564,23 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
+
+ uart_console_write(port, str, count, mxs_auart_console_putchar);
+
+- /*
+- * Finally, wait for transmitter to become empty
+- * and restore the TCR
+- */
++ /* Finally, wait for transmitter to become empty ... */
+ while (readl(port->membase + AUART_STAT) & AUART_STAT_BUSY) {
++ udelay(1);
+ if (!to--)
+ break;
+- udelay(1);
+ }
+
+- writel(old_ctrl0, port->membase + AUART_CTRL0);
+- writel(old_ctrl2, port->membase + AUART_CTRL2);
++ /*
++ * ... and restore the TCR if we waited long enough for the transmitter
++ * to be idle. This might keep the transmitter enabled although it is
++ * unused, but that is better than to disable it while it is still
++ * transmitting.
++ */
++ if (!(readl(port->membase + AUART_STAT) & AUART_STAT_BUSY)) {
++ writel(old_ctrl0, port->membase + AUART_CTRL0);
++ writel(old_ctrl2, port->membase + AUART_CTRL2);
++ }
+
+ clk_disable(s->clk);
+ }
+diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
+index 9fde1c0..9860f6b 100644
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -118,6 +118,7 @@ static int fill_event_metadata(struct fsnotify_group *group,
+ metadata->event_len = FAN_EVENT_METADATA_LEN;
+ metadata->metadata_len = FAN_EVENT_METADATA_LEN;
+ metadata->vers = FANOTIFY_METADATA_VERSION;
++ metadata->reserved = 0;
+ metadata->mask = event->mask & FAN_ALL_OUTGOING_EVENTS;
+ metadata->pid = pid_vnr(event->tgid);
+ if (unlikely(event->mask & FAN_Q_OVERFLOW))
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index da60cfa..a8102d2 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -223,9 +223,9 @@ perf_cgroup_match(struct perf_event *event)
+ return !event->cgrp || event->cgrp == cpuctx->cgrp;
+ }
+
+-static inline void perf_get_cgroup(struct perf_event *event)
++static inline bool perf_tryget_cgroup(struct perf_event *event)
+ {
+- css_get(&event->cgrp->css);
++ return css_tryget(&event->cgrp->css);
+ }
+
+ static inline void perf_put_cgroup(struct perf_event *event)
+@@ -415,7 +415,11 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,
+ event->cgrp = cgrp;
+
+ /* must be done before we fput() the file */
+- perf_get_cgroup(event);
++ if (!perf_tryget_cgroup(event)) {
++ event->cgrp = NULL;
++ ret = -ENOENT;
++ goto out;
++ }
+
+ /*
+ * all events in a group must monitor
+@@ -839,6 +843,15 @@ list_add_event(struct perf_event *event, struct perf_event_context *ctx)
+ }
+
+ /*
++ * Initialize event state based on the perf_event_attr::disabled.
++ */
++static inline void perf_event__state_init(struct perf_event *event)
++{
++ event->state = event->attr.disabled ? PERF_EVENT_STATE_OFF :
++ PERF_EVENT_STATE_INACTIVE;
++}
++
++/*
+ * Called at perf_event creation and when events are attached/detached from a
+ * group.
+ */
+@@ -6241,8 +6254,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+
+ event->overflow_handler = overflow_handler;
+
+- if (attr->disabled)
+- event->state = PERF_EVENT_STATE_OFF;
++ perf_event__state_init(event);
+
+ pmu = NULL;
+
+@@ -6616,9 +6628,17 @@ SYSCALL_DEFINE5(perf_event_open,
+
+ mutex_lock(&gctx->mutex);
+ perf_remove_from_context(group_leader);
++
++ /*
++ * Removing from the context ends up with disabled
++ * event. What we want here is event in the initial
++ * startup state, ready to be add into new context.
++ */
++ perf_event__state_init(group_leader);
+ list_for_each_entry(sibling, &group_leader->sibling_list,
+ group_entry) {
+ perf_remove_from_context(sibling);
++ perf_event__state_init(sibling);
+ put_ctx(gctx);
+ }
+ mutex_unlock(&gctx->mutex);
+diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
+index c768588..fae7d67 100644
+--- a/kernel/sched_fair.c
++++ b/kernel/sched_fair.c
+@@ -4277,7 +4277,7 @@ static unsigned int get_rr_interval_fair(struct rq *rq, struct task_struct *task
+ * idle runqueue:
+ */
+ if (rq->cfs.load.weight)
+- rr_interval = NS_TO_JIFFIES(sched_slice(&rq->cfs, se));
++ rr_interval = NS_TO_JIFFIES(sched_slice(cfs_rq_of(se), se));
+
+ return rr_interval;
+ }
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index 46b5950..3a22b1c 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -32,6 +32,8 @@ static int tcp_adv_win_scale_min = -31;
+ static int tcp_adv_win_scale_max = 31;
+ static int ip_ttl_min = 1;
+ static int ip_ttl_max = 255;
++static int tcp_syn_retries_min = 1;
++static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
+ static int ip_ping_group_range_min[] = { 0, 0 };
+ static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
+
+@@ -231,7 +233,9 @@ static struct ctl_table ipv4_table[] = {
+ .data = &sysctl_tcp_syn_retries,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &tcp_syn_retries_min,
++ .extra2 = &tcp_syn_retries_max
+ },
+ {
+ .procname = "tcp_synack_retries",
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index def0538..4aa8a19 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -256,10 +256,12 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
+ {
+ struct mr6_table *mrt, *next;
+
++ rtnl_lock();
+ list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
+ list_del(&mrt->list);
+ ip6mr_free_table(mrt);
+ }
++ rtnl_unlock();
+ fib_rules_unregister(net->ipv6.mr6_rules_ops);
+ }
+ #else
+@@ -286,7 +288,10 @@ static int __net_init ip6mr_rules_init(struct net *net)
+
+ static void __net_exit ip6mr_rules_exit(struct net *net)
+ {
++ rtnl_lock();
+ ip6mr_free_table(net->ipv6.mrt6);
++ net->ipv6.mrt6 = NULL;
++ rtnl_unlock();
+ }
+ #endif
+
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 01eb92c..d040880 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2073,6 +2073,7 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, const struct xfrm_policy *
+ pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
+ }
+ pol->sadb_x_policy_dir = dir+1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = xp->index;
+ pol->sadb_x_policy_priority = xp->priority;
+
+@@ -3108,7 +3109,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
+ pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
+ pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
+ pol->sadb_x_policy_dir = dir+1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = xp->index;
++ pol->sadb_x_policy_priority = xp->priority;
+
+ /* Set sadb_comb's. */
+ if (x->id.proto == IPPROTO_AH)
+@@ -3496,6 +3499,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
+ pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
+ pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
+ pol->sadb_x_policy_dir = dir + 1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = 0;
+ pol->sadb_x_policy_priority = 0;
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 785b6e9..10e8842 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -810,8 +810,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+ struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
+
+- /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
+- if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
++ /*
++ * Drop duplicate 802.11 retransmissions
++ * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
++ */
++ if (rx->skb->len >= 24 && rx->sta &&
++ !ieee80211_is_ctl(hdr->frame_control) &&
++ !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
++ !is_multicast_ether_addr(hdr->addr1)) {
+ if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
+ rx->sta->last_seq_ctrl[rx->queue] ==
+ hdr->seq_ctrl)) {
+diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
+index 3f08158..46a39dc 100644
+--- a/net/sched/sch_atm.c
++++ b/net/sched/sch_atm.c
+@@ -605,6 +605,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
+ struct sockaddr_atmpvc pvc;
+ int state;
+
++ memset(&pvc, 0, sizeof(pvc));
+ pvc.sap_family = AF_ATMPVC;
+ pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
+ pvc.sap_addr.vpi = flow->vcc->vpi;
+diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
+index b7cddb9..7f59944 100644
+--- a/net/sched/sch_cbq.c
++++ b/net/sched/sch_cbq.c
+@@ -1467,6 +1467,7 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
+ unsigned char *b = skb_tail_pointer(skb);
+ struct tc_cbq_wrropt opt;
+
++ memset(&opt, 0, sizeof(opt));
+ opt.flags = 0;
+ opt.allot = cl->allot;
+ opt.priority = cl->priority + 1;
+diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
+index 2325ce6..35e44e2 100644
+--- a/net/sctp/outqueue.c
++++ b/net/sctp/outqueue.c
+@@ -205,6 +205,8 @@ static inline int sctp_cacc_skip(struct sctp_transport *primary,
+ */
+ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
+ {
++ memset(q, 0, sizeof(struct sctp_outq));
++
+ q->asoc = asoc;
+ INIT_LIST_HEAD(&q->out_chunk_list);
+ INIT_LIST_HEAD(&q->control_chunk_list);
+@@ -212,13 +214,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
+ INIT_LIST_HEAD(&q->sacked);
+ INIT_LIST_HEAD(&q->abandoned);
+
+- q->fast_rtx = 0;
+- q->outstanding_bytes = 0;
+ q->empty = 1;
+- q->cork = 0;
+-
+- q->malloced = 0;
+- q->out_qlen = 0;
+ }
+
+ /* Free the outqueue structure and any related pending chunks.
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index f310a0d..17bf4a7 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -4454,12 +4454,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
+
+ void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
+ {
++ struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
+ void *hdr = ((void **)skb->cb)[1];
+ struct nlattr *data = ((void **)skb->cb)[2];
+
+ nla_nest_end(skb, data);
+ genlmsg_end(skb, hdr);
+- genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
++ genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
++ nl80211_testmode_mcgrp.id, gfp);
+ }
+ EXPORT_SYMBOL(cfg80211_testmode_event);
+ #endif
+@@ -6745,7 +6747,8 @@ void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
+ return;
+ }
+
+- genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
++ genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
++ nl80211_mlme_mcgrp.id, gfp);
+ return;
+
+ nla_put_failure:
Modified: genpatches-2.6/trunk/3.10/0000_README
===================================================================
--- genpatches-2.6/trunk/3.10/0000_README 2013-08-06 15:26:12 UTC (rev 2470)
+++ genpatches-2.6/trunk/3.10/0000_README 2013-08-12 10:42:00 UTC (rev 2471)
@@ -59,6 +59,10 @@
From: http://www.kernel.org
Desc: Linux 3.10.5
+Patch: 1005_linux-3.10.6.patch
+From: http://www.kernel.org
+Desc: Linux 3.10.6
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
Added: genpatches-2.6/trunk/3.10/1005_linux-3.10.6.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1005_linux-3.10.6.patch (rev 0)
+++ genpatches-2.6/trunk/3.10/1005_linux-3.10.6.patch 2013-08-12 10:42:00 UTC (rev 2471)
@@ -0,0 +1,4439 @@
+diff --git a/Makefile b/Makefile
+index f8349d0..fd92ffb 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,8 +1,8 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+-NAME = Unicycling Gorilla
++NAME = TOSSUG Baby Fish
+
+ # *DOCUMENTATION*
+ # To see a list of typical targets execute "make help"
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 136f263..18a9f5e 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -19,7 +19,6 @@ config ARM
+ select GENERIC_STRNCPY_FROM_USER
+ select GENERIC_STRNLEN_USER
+ select HARDIRQS_SW_RESEND
+- select HAVE_AOUT
+ select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL
+ select HAVE_ARCH_KGDB
+ select HAVE_ARCH_SECCOMP_FILTER
+@@ -213,7 +212,8 @@ config VECTORS_BASE
+ default DRAM_BASE if REMAP_VECTORS_TO_RAM
+ default 0x00000000
+ help
+- The base address of exception vectors.
++ The base address of exception vectors. This must be two pages
++ in size.
+
+ config ARM_PATCH_PHYS_VIRT
+ bool "Patch physical to virtual translations at runtime" if EMBEDDED
+diff --git a/arch/arm/include/asm/a.out-core.h b/arch/arm/include/asm/a.out-core.h
+deleted file mode 100644
+index 92f10cb..0000000
+--- a/arch/arm/include/asm/a.out-core.h
++++ /dev/null
+@@ -1,45 +0,0 @@
+-/* a.out coredump register dumper
+- *
+- * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
+- * Written by David Howells (dhowells@redhat.com)
+- *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public Licence
+- * as published by the Free Software Foundation; either version
+- * 2 of the Licence, or (at your option) any later version.
+- */
+-
+-#ifndef _ASM_A_OUT_CORE_H
+-#define _ASM_A_OUT_CORE_H
+-
+-#ifdef __KERNEL__
+-
+-#include <linux/user.h>
+-#include <linux/elfcore.h>
+-
+-/*
+- * fill in the user structure for an a.out core dump
+- */
+-static inline void aout_dump_thread(struct pt_regs *regs, struct user *dump)
+-{
+- struct task_struct *tsk = current;
+-
+- dump->magic = CMAGIC;
+- dump->start_code = tsk->mm->start_code;
+- dump->start_stack = regs->ARM_sp & ~(PAGE_SIZE - 1);
+-
+- dump->u_tsize = (tsk->mm->end_code - tsk->mm->start_code) >> PAGE_SHIFT;
+- dump->u_dsize = (tsk->mm->brk - tsk->mm->start_data + PAGE_SIZE - 1) >> PAGE_SHIFT;
+- dump->u_ssize = 0;
+-
+- memset(dump->u_debugreg, 0, sizeof(dump->u_debugreg));
+-
+- if (dump->start_stack < 0x04000000)
+- dump->u_ssize = (0x04000000 - dump->start_stack) >> PAGE_SHIFT;
+-
+- dump->regs = *regs;
+- dump->u_fpvalid = dump_fpu (regs, &dump->u_fp);
+-}
+-
+-#endif /* __KERNEL__ */
+-#endif /* _ASM_A_OUT_CORE_H */
+diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
+index 38050b1..56211f2 100644
+--- a/arch/arm/include/asm/elf.h
++++ b/arch/arm/include/asm/elf.h
+@@ -130,4 +130,10 @@ struct mm_struct;
+ extern unsigned long arch_randomize_brk(struct mm_struct *mm);
+ #define arch_randomize_brk arch_randomize_brk
+
++#ifdef CONFIG_MMU
++#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
++struct linux_binprm;
++int arch_setup_additional_pages(struct linux_binprm *, int);
++#endif
++
+ #endif
+diff --git a/arch/arm/include/asm/mmu.h b/arch/arm/include/asm/mmu.h
+index e3d5554..6f18da0 100644
+--- a/arch/arm/include/asm/mmu.h
++++ b/arch/arm/include/asm/mmu.h
+@@ -6,8 +6,11 @@
+ typedef struct {
+ #ifdef CONFIG_CPU_HAS_ASID
+ atomic64_t id;
++#else
++ int switch_pending;
+ #endif
+ unsigned int vmalloc_seq;
++ unsigned long sigpage;
+ } mm_context_t;
+
+ #ifdef CONFIG_CPU_HAS_ASID
+diff --git a/arch/arm/include/asm/mmu_context.h b/arch/arm/include/asm/mmu_context.h
+index dc90203..e0b10f1 100644
+--- a/arch/arm/include/asm/mmu_context.h
++++ b/arch/arm/include/asm/mmu_context.h
+@@ -55,7 +55,7 @@ static inline void check_and_switch_context(struct mm_struct *mm,
+ * on non-ASID CPUs, the old mm will remain valid until the
+ * finish_arch_post_lock_switch() call.
+ */
+- set_ti_thread_flag(task_thread_info(tsk), TIF_SWITCH_MM);
++ mm->context.switch_pending = 1;
+ else
+ cpu_switch_mm(mm->pgd, mm);
+ }
+@@ -64,9 +64,21 @@ static inline void check_and_switch_context(struct mm_struct *mm,
+ finish_arch_post_lock_switch
+ static inline void finish_arch_post_lock_switch(void)
+ {
+- if (test_and_clear_thread_flag(TIF_SWITCH_MM)) {
+- struct mm_struct *mm = current->mm;
+- cpu_switch_mm(mm->pgd, mm);
++ struct mm_struct *mm = current->mm;
++
++ if (mm && mm->context.switch_pending) {
++ /*
++ * Preemption must be disabled during cpu_switch_mm() as we
++ * have some stateful cache flush implementations. Check
++ * switch_pending again in case we were preempted and the
++ * switch to this mm was already done.
++ */
++ preempt_disable();
++ if (mm->context.switch_pending) {
++ mm->context.switch_pending = 0;
++ cpu_switch_mm(mm->pgd, mm);
++ }
++ preempt_enable_no_resched();
+ }
+ }
+
+diff --git a/arch/arm/include/asm/page.h b/arch/arm/include/asm/page.h
+index 812a494..cbdc7a2 100644
+--- a/arch/arm/include/asm/page.h
++++ b/arch/arm/include/asm/page.h
+@@ -142,7 +142,9 @@ extern void __cpu_copy_user_highpage(struct page *to, struct page *from,
+ #define clear_page(page) memset((void *)(page), 0, PAGE_SIZE)
+ extern void copy_page(void *to, const void *from);
+
++#ifdef CONFIG_KUSER_HELPERS
+ #define __HAVE_ARCH_GATE_AREA 1
++#endif
+
+ #ifdef CONFIG_ARM_LPAE
+ #include <asm/pgtable-3level-types.h>
+diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
+index 06e7d50..413f387 100644
+--- a/arch/arm/include/asm/processor.h
++++ b/arch/arm/include/asm/processor.h
+@@ -54,7 +54,6 @@ struct thread_struct {
+
+ #define start_thread(regs,pc,sp) \
+ ({ \
+- unsigned long *stack = (unsigned long *)sp; \
+ memset(regs->uregs, 0, sizeof(regs->uregs)); \
+ if (current->personality & ADDR_LIMIT_32BIT) \
+ regs->ARM_cpsr = USR_MODE; \
+@@ -65,9 +64,6 @@ struct thread_struct {
+ regs->ARM_cpsr |= PSR_ENDSTATE; \
+ regs->ARM_pc = pc & ~1; /* pc */ \
+ regs->ARM_sp = sp; /* sp */ \
+- regs->ARM_r2 = stack[2]; /* r2 (envp) */ \
+- regs->ARM_r1 = stack[1]; /* r1 (argv) */ \
+- regs->ARM_r0 = stack[0]; /* r0 (argc) */ \
+ nommu_start_thread(regs); \
+ })
+
+diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
+index 1995d1a..f00b569 100644
+--- a/arch/arm/include/asm/thread_info.h
++++ b/arch/arm/include/asm/thread_info.h
+@@ -156,7 +156,6 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
+ #define TIF_USING_IWMMXT 17
+ #define TIF_MEMDIE 18 /* is terminating due to OOM killer */
+ #define TIF_RESTORE_SIGMASK 20
+-#define TIF_SWITCH_MM 22 /* deferred switch_mm */
+
+ #define _TIF_SIGPENDING (1 << TIF_SIGPENDING)
+ #define _TIF_NEED_RESCHED (1 << TIF_NEED_RESCHED)
+diff --git a/arch/arm/include/uapi/asm/Kbuild b/arch/arm/include/uapi/asm/Kbuild
+index 47bcb2d..18d76fd 100644
+--- a/arch/arm/include/uapi/asm/Kbuild
++++ b/arch/arm/include/uapi/asm/Kbuild
+@@ -1,7 +1,6 @@
+ # UAPI Header export list
+ include include/uapi/asm-generic/Kbuild.asm
+
+-header-y += a.out.h
+ header-y += byteorder.h
+ header-y += fcntl.h
+ header-y += hwcap.h
+diff --git a/arch/arm/include/uapi/asm/a.out.h b/arch/arm/include/uapi/asm/a.out.h
+deleted file mode 100644
+index 083894b..0000000
+--- a/arch/arm/include/uapi/asm/a.out.h
++++ /dev/null
+@@ -1,34 +0,0 @@
+-#ifndef __ARM_A_OUT_H__
+-#define __ARM_A_OUT_H__
+-
+-#include <linux/personality.h>
+-#include <linux/types.h>
+-
+-struct exec
+-{
+- __u32 a_info; /* Use macros N_MAGIC, etc for access */
+- __u32 a_text; /* length of text, in bytes */
+- __u32 a_data; /* length of data, in bytes */
+- __u32 a_bss; /* length of uninitialized data area for file, in bytes */
+- __u32 a_syms; /* length of symbol table data in file, in bytes */
+- __u32 a_entry; /* start address */
+- __u32 a_trsize; /* length of relocation info for text, in bytes */
+- __u32 a_drsize; /* length of relocation info for data, in bytes */
+-};
+-
+-/*
+- * This is always the same
+- */
+-#define N_TXTADDR(a) (0x00008000)
+-
+-#define N_TRSIZE(a) ((a).a_trsize)
+-#define N_DRSIZE(a) ((a).a_drsize)
+-#define N_SYMSIZE(a) ((a).a_syms)
+-
+-#define M_ARM 103
+-
+-#ifndef LIBRARY_START_TEXT
+-#define LIBRARY_START_TEXT (0x00c00000)
+-#endif
+-
+-#endif /* __A_OUT_GNU_H__ */
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index 582b405..d43c7e5 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -741,6 +741,18 @@ ENDPROC(__switch_to)
+ #endif
+ .endm
+
++ .macro kuser_pad, sym, size
++ .if (. - \sym) & 3
++ .rept 4 - (. - \sym) & 3
++ .byte 0
++ .endr
++ .endif
++ .rept (\size - (. - \sym)) / 4
++ .word 0xe7fddef1
++ .endr
++ .endm
++
++#ifdef CONFIG_KUSER_HELPERS
+ .align 5
+ .globl __kuser_helper_start
+ __kuser_helper_start:
+@@ -831,18 +843,13 @@ kuser_cmpxchg64_fixup:
+ #error "incoherent kernel configuration"
+ #endif
+
+- /* pad to next slot */
+- .rept (16 - (. - __kuser_cmpxchg64)/4)
+- .word 0
+- .endr
+-
+- .align 5
++ kuser_pad __kuser_cmpxchg64, 64
+
+ __kuser_memory_barrier: @ 0xffff0fa0
+ smp_dmb arm
+ usr_ret lr
+
+- .align 5
++ kuser_pad __kuser_memory_barrier, 32
+
+ __kuser_cmpxchg: @ 0xffff0fc0
+
+@@ -915,13 +922,14 @@ kuser_cmpxchg32_fixup:
+
+ #endif
+
+- .align 5
++ kuser_pad __kuser_cmpxchg, 32
+
+ __kuser_get_tls: @ 0xffff0fe0
+ ldr r0, [pc, #(16 - 8)] @ read TLS, set in kuser_get_tls_init
+ usr_ret lr
+ mrc p15, 0, r0, c13, c0, 3 @ 0xffff0fe8 hardware TLS code
+- .rep 4
++ kuser_pad __kuser_get_tls, 16
++ .rep 3
+ .word 0 @ 0xffff0ff0 software TLS value, then
+ .endr @ pad up to __kuser_helper_version
+
+@@ -931,14 +939,16 @@ __kuser_helper_version: @ 0xffff0ffc
+ .globl __kuser_helper_end
+ __kuser_helper_end:
+
++#endif
++
+ THUMB( .thumb )
+
+ /*
+ * Vector stubs.
+ *
+- * This code is copied to 0xffff0200 so we can use branches in the
+- * vectors, rather than ldr's. Note that this code must not
+- * exceed 0x300 bytes.
++ * This code is copied to 0xffff1000 so we can use branches in the
++ * vectors, rather than ldr's. Note that this code must not exceed
++ * a page size.
+ *
+ * Common stub entry macro:
+ * Enter in IRQ mode, spsr = SVC/USR CPSR, lr = SVC/USR PC
+@@ -985,8 +995,17 @@ ENDPROC(vector_\name)
+ 1:
+ .endm
+
+- .globl __stubs_start
++ .section .stubs, "ax", %progbits
+ __stubs_start:
++ @ This must be the first word
++ .word vector_swi
++
++vector_rst:
++ ARM( swi SYS_ERROR0 )
++ THUMB( svc #0 )
++ THUMB( nop )
++ b vector_und
++
+ /*
+ * Interrupt dispatcher
+ */
+@@ -1081,6 +1100,16 @@ __stubs_start:
+ .align 5
+
+ /*=============================================================================
++ * Address exception handler
++ *-----------------------------------------------------------------------------
++ * These aren't too critical.
++ * (they're not supposed to happen, and won't happen in 32-bit data mode).
++ */
++
++vector_addrexcptn:
++ b vector_addrexcptn
++
++/*=============================================================================
+ * Undefined FIQs
+ *-----------------------------------------------------------------------------
+ * Enter in FIQ mode, spsr = ANY CPSR, lr = ANY PC
+@@ -1093,45 +1122,19 @@ __stubs_start:
+ vector_fiq:
+ subs pc, lr, #4
+
+-/*=============================================================================
+- * Address exception handler
+- *-----------------------------------------------------------------------------
+- * These aren't too critical.
+- * (they're not supposed to happen, and won't happen in 32-bit data mode).
+- */
+-
+-vector_addrexcptn:
+- b vector_addrexcptn
+-
+-/*
+- * We group all the following data together to optimise
+- * for CPUs with separate I & D caches.
+- */
+- .align 5
+-
+-.LCvswi:
+- .word vector_swi
+-
+- .globl __stubs_end
+-__stubs_end:
+-
+- .equ stubs_offset, __vectors_start + 0x200 - __stubs_start
++ .globl vector_fiq_offset
++ .equ vector_fiq_offset, vector_fiq
+
+- .globl __vectors_start
++ .section .vectors, "ax", %progbits
+ __vectors_start:
+- ARM( swi SYS_ERROR0 )
+- THUMB( svc #0 )
+- THUMB( nop )
+- W(b) vector_und + stubs_offset
+- W(ldr) pc, .LCvswi + stubs_offset
+- W(b) vector_pabt + stubs_offset
+- W(b) vector_dabt + stubs_offset
+- W(b) vector_addrexcptn + stubs_offset
+- W(b) vector_irq + stubs_offset
+- W(b) vector_fiq + stubs_offset
+-
+- .globl __vectors_end
+-__vectors_end:
++ W(b) vector_rst
++ W(b) vector_und
++ W(ldr) pc, __vectors_start + 0x1000
++ W(b) vector_pabt
++ W(b) vector_dabt
++ W(b) vector_addrexcptn
++ W(b) vector_irq
++ W(b) vector_fiq
+
+ .data
+
+diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
+index 2adda11..25442f4 100644
+--- a/arch/arm/kernel/fiq.c
++++ b/arch/arm/kernel/fiq.c
+@@ -47,6 +47,11 @@
+ #include <asm/irq.h>
+ #include <asm/traps.h>
+
++#define FIQ_OFFSET ({ \
++ extern void *vector_fiq_offset; \
++ (unsigned)&vector_fiq_offset; \
++ })
++
+ static unsigned long no_fiq_insn;
+
+ /* Default reacquire function
+@@ -80,13 +85,16 @@ int show_fiq_list(struct seq_file *p, int prec)
+ void set_fiq_handler(void *start, unsigned int length)
+ {
+ #if defined(CONFIG_CPU_USE_DOMAINS)
+- memcpy((void *)0xffff001c, start, length);
++ void *base = (void *)0xffff0000;
+ #else
+- memcpy(vectors_page + 0x1c, start, length);
++ void *base = vectors_page;
+ #endif
+- flush_icache_range(0xffff001c, 0xffff001c + length);
++ unsigned offset = FIQ_OFFSET;
++
++ memcpy(base + offset, start, length);
++ flush_icache_range(0xffff0000 + offset, 0xffff0000 + offset + length);
+ if (!vectors_high())
+- flush_icache_range(0x1c, 0x1c + length);
++ flush_icache_range(offset, offset + length);
+ }
+
+ int claim_fiq(struct fiq_handler *f)
+@@ -144,6 +152,7 @@ EXPORT_SYMBOL(disable_fiq);
+
+ void __init init_FIQ(int start)
+ {
+- no_fiq_insn = *(unsigned long *)0xffff001c;
++ unsigned offset = FIQ_OFFSET;
++ no_fiq_insn = *(unsigned long *)(0xffff0000 + offset);
+ fiq_start = start;
+ }
+diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
+index 6e8931c..5bc2615 100644
+--- a/arch/arm/kernel/process.c
++++ b/arch/arm/kernel/process.c
+@@ -433,10 +433,11 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
+ }
+
+ #ifdef CONFIG_MMU
++#ifdef CONFIG_KUSER_HELPERS
+ /*
+ * The vectors page is always readable from user space for the
+- * atomic helpers and the signal restart code. Insert it into the
+- * gate_vma so that it is visible through ptrace and /proc/<pid>/mem.
++ * atomic helpers. Insert it into the gate_vma so that it is visible
++ * through ptrace and /proc/<pid>/mem.
+ */
+ static struct vm_area_struct gate_vma = {
+ .vm_start = 0xffff0000,
+@@ -465,9 +466,48 @@ int in_gate_area_no_mm(unsigned long addr)
+ {
+ return in_gate_area(NULL, addr);
+ }
++#define is_gate_vma(vma) ((vma) = &gate_vma)
++#else
++#define is_gate_vma(vma) 0
++#endif
+
+ const char *arch_vma_name(struct vm_area_struct *vma)
+ {
+- return (vma == &gate_vma) ? "[vectors]" : NULL;
++ return is_gate_vma(vma) ? "[vectors]" :
++ (vma->vm_mm && vma->vm_start == vma->vm_mm->context.sigpage) ?
++ "[sigpage]" : NULL;
++}
++
++static struct page *signal_page;
++extern struct page *get_signal_page(void);
++
++int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
++{
++ struct mm_struct *mm = current->mm;
++ unsigned long addr;
++ int ret;
++
++ if (!signal_page)
++ signal_page = get_signal_page();
++ if (!signal_page)
++ return -ENOMEM;
++
++ down_write(&mm->mmap_sem);
++ addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
++ if (IS_ERR_VALUE(addr)) {
++ ret = addr;
++ goto up_fail;
++ }
++
++ ret = install_special_mapping(mm, addr, PAGE_SIZE,
++ VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC,
++ &signal_page);
++
++ if (ret == 0)
++ mm->context.sigpage = addr;
++
++ up_fail:
++ up_write(&mm->mmap_sem);
++ return ret;
+ }
+ #endif
+diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
+index 296786b..5a42c12 100644
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -8,6 +8,7 @@
+ * published by the Free Software Foundation.
+ */
+ #include <linux/errno.h>
++#include <linux/random.h>
+ #include <linux/signal.h>
+ #include <linux/personality.h>
+ #include <linux/uaccess.h>
+@@ -15,12 +16,11 @@
+
+ #include <asm/elf.h>
+ #include <asm/cacheflush.h>
++#include <asm/traps.h>
+ #include <asm/ucontext.h>
+ #include <asm/unistd.h>
+ #include <asm/vfp.h>
+
+-#include "signal.h"
+-
+ /*
+ * For ARM syscalls, we encode the syscall number into the instruction.
+ */
+@@ -40,11 +40,13 @@
+ #define SWI_THUMB_SIGRETURN (0xdf00 << 16 | 0x2700 | (__NR_sigreturn - __NR_SYSCALL_BASE))
+ #define SWI_THUMB_RT_SIGRETURN (0xdf00 << 16 | 0x2700 | (__NR_rt_sigreturn - __NR_SYSCALL_BASE))
+
+-const unsigned long sigreturn_codes[7] = {
++static const unsigned long sigreturn_codes[7] = {
+ MOV_R7_NR_SIGRETURN, SWI_SYS_SIGRETURN, SWI_THUMB_SIGRETURN,
+ MOV_R7_NR_RT_SIGRETURN, SWI_SYS_RT_SIGRETURN, SWI_THUMB_RT_SIGRETURN,
+ };
+
++static unsigned long signal_return_offset;
++
+ #ifdef CONFIG_CRUNCH
+ static int preserve_crunch_context(struct crunch_sigframe __user *frame)
+ {
+@@ -396,13 +398,19 @@ setup_return(struct pt_regs *regs, struct ksignal *ksig,
+ __put_user(sigreturn_codes[idx+1], rc+1))
+ return 1;
+
++#ifdef CONFIG_MMU
+ if (cpsr & MODE32_BIT) {
++ struct mm_struct *mm = current->mm;
+ /*
+- * 32-bit code can use the new high-page
+- * signal return code support.
++ * 32-bit code can use the signal return page
++ * except when the MPU has protected the vectors
++ * page from PL0
+ */
+- retcode = KERN_SIGRETURN_CODE + (idx << 2) + thumb;
+- } else {
++ retcode = mm->context.sigpage + signal_return_offset +
++ (idx << 2) + thumb;
++ } else
++#endif
++ {
+ /*
+ * Ensure that the instruction cache sees
+ * the return code written onto the stack.
+@@ -603,3 +611,33 @@ do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
+ } while (thread_flags & _TIF_WORK_MASK);
+ return 0;
+ }
++
++struct page *get_signal_page(void)
++{
++ unsigned long ptr;
++ unsigned offset;
++ struct page *page;
++ void *addr;
++
++ page = alloc_pages(GFP_KERNEL, 0);
++
++ if (!page)
++ return NULL;
++
++ addr = page_address(page);
++
++ /* Give the signal return code some randomness */
++ offset = 0x200 + (get_random_int() & 0x7fc);
++ signal_return_offset = offset;
++
++ /*
++ * Copy signal return handlers into the vector page, and
++ * set sigreturn to be a pointer to these.
++ */
++ memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes));
++
++ ptr = (unsigned long)addr + offset;
++ flush_icache_range(ptr, ptr + sizeof(sigreturn_codes));
++
++ return page;
++}
+diff --git a/arch/arm/kernel/signal.h b/arch/arm/kernel/signal.h
+deleted file mode 100644
+index 5ff067b7..0000000
+--- a/arch/arm/kernel/signal.h
++++ /dev/null
+@@ -1,12 +0,0 @@
+-/*
+- * linux/arch/arm/kernel/signal.h
+- *
+- * Copyright (C) 2005-2009 Russell King.
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License version 2 as
+- * published by the Free Software Foundation.
+- */
+-#define KERN_SIGRETURN_CODE (CONFIG_VECTORS_BASE + 0x00000500)
+-
+-extern const unsigned long sigreturn_codes[7];
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index 18b32e8..6b9567e 100644
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -35,8 +35,6 @@
+ #include <asm/tls.h>
+ #include <asm/system_misc.h>
+
+-#include "signal.h"
+-
+ static const char *handler[]= { "prefetch abort", "data abort", "address exception", "interrupt" };
+
+ void *vectors_page;
+@@ -800,47 +798,55 @@ void __init trap_init(void)
+ return;
+ }
+
+-static void __init kuser_get_tls_init(unsigned long vectors)
++#ifdef CONFIG_KUSER_HELPERS
++static void __init kuser_init(void *vectors)
+ {
++ extern char __kuser_helper_start[], __kuser_helper_end[];
++ int kuser_sz = __kuser_helper_end - __kuser_helper_start;
++
++ memcpy(vectors + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz);
++
+ /*
+ * vectors + 0xfe0 = __kuser_get_tls
+ * vectors + 0xfe8 = hardware TLS instruction at 0xffff0fe8
+ */
+ if (tls_emu || has_tls_reg)
+- memcpy((void *)vectors + 0xfe0, (void *)vectors + 0xfe8, 4);
++ memcpy(vectors + 0xfe0, vectors + 0xfe8, 4);
+ }
++#else
++static void __init kuser_init(void *vectors)
++{
++}
++#endif
+
+ void __init early_trap_init(void *vectors_base)
+ {
+ unsigned long vectors = (unsigned long)vectors_base;
+ extern char __stubs_start[], __stubs_end[];
+ extern char __vectors_start[], __vectors_end[];
+- extern char __kuser_helper_start[], __kuser_helper_end[];
+- int kuser_sz = __kuser_helper_end - __kuser_helper_start;
++ unsigned i;
+
+ vectors_page = vectors_base;
+
+ /*
++ * Poison the vectors page with an undefined instruction. This
++ * instruction is chosen to be undefined for both ARM and Thumb
++ * ISAs. The Thumb version is an undefined instruction with a
++ * branch back to the undefined instruction.
++ */
++ for (i = 0; i < PAGE_SIZE / sizeof(u32); i++)
++ ((u32 *)vectors_base)[i] = 0xe7fddef1;
++
++ /*
+ * Copy the vectors, stubs and kuser helpers (in entry-armv.S)
+ * into the vector page, mapped at 0xffff0000, and ensure these
+ * are visible to the instruction stream.
+ */
+ memcpy((void *)vectors, __vectors_start, __vectors_end - __vectors_start);
+- memcpy((void *)vectors + 0x200, __stubs_start, __stubs_end - __stubs_start);
+- memcpy((void *)vectors + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz);
++ memcpy((void *)vectors + 0x1000, __stubs_start, __stubs_end - __stubs_start);
+
+- /*
+- * Do processor specific fixups for the kuser helpers
+- */
+- kuser_get_tls_init(vectors);
+-
+- /*
+- * Copy signal return handlers into the vector page, and
+- * set sigreturn to be a pointer to these.
+- */
+- memcpy((void *)(vectors + KERN_SIGRETURN_CODE - CONFIG_VECTORS_BASE),
+- sigreturn_codes, sizeof(sigreturn_codes));
++ kuser_init(vectors_base);
+
+- flush_icache_range(vectors, vectors + PAGE_SIZE);
++ flush_icache_range(vectors, vectors + PAGE_SIZE * 2);
+ modify_domain(DOMAIN_USER, DOMAIN_CLIENT);
+ }
+diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
+index a871b8e..33f2ea3 100644
+--- a/arch/arm/kernel/vmlinux.lds.S
++++ b/arch/arm/kernel/vmlinux.lds.S
+@@ -152,6 +152,23 @@ SECTIONS
+ . = ALIGN(PAGE_SIZE);
+ __init_begin = .;
+ #endif
++ /*
++ * The vectors and stubs are relocatable code, and the
++ * only thing that matters is their relative offsets
++ */
++ __vectors_start = .;
++ .vectors 0 : AT(__vectors_start) {
++ *(.vectors)
++ }
++ . = __vectors_start + SIZEOF(.vectors);
++ __vectors_end = .;
++
++ __stubs_start = .;
++ .stubs 0x1000 : AT(__stubs_start) {
++ *(.stubs)
++ }
++ . = __stubs_start + SIZEOF(.stubs);
++ __stubs_end = .;
+
+ INIT_TEXT_SECTION(8)
+ .exit.text : {
+diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
+index 35955b5..2950082 100644
+--- a/arch/arm/mm/Kconfig
++++ b/arch/arm/mm/Kconfig
+@@ -411,24 +411,28 @@ config CPU_32v3
+ select CPU_USE_DOMAINS if MMU
+ select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
+ select TLS_REG_EMUL if SMP || !MMU
++ select NEED_KUSER_HELPERS
+
+ config CPU_32v4
+ bool
+ select CPU_USE_DOMAINS if MMU
+ select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
+ select TLS_REG_EMUL if SMP || !MMU
++ select NEED_KUSER_HELPERS
+
+ config CPU_32v4T
+ bool
+ select CPU_USE_DOMAINS if MMU
+ select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
+ select TLS_REG_EMUL if SMP || !MMU
++ select NEED_KUSER_HELPERS
+
+ config CPU_32v5
+ bool
+ select CPU_USE_DOMAINS if MMU
+ select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
+ select TLS_REG_EMUL if SMP || !MMU
++ select NEED_KUSER_HELPERS
+
+ config CPU_32v6
+ bool
+@@ -756,6 +760,7 @@ config CPU_BPREDICT_DISABLE
+
+ config TLS_REG_EMUL
+ bool
++ select NEED_KUSER_HELPERS
+ help
+ An SMP system using a pre-ARMv6 processor (there are apparently
+ a few prototypes like that in existence) and therefore access to
+@@ -763,11 +768,40 @@ config TLS_REG_EMUL
+
+ config NEEDS_SYSCALL_FOR_CMPXCHG
+ bool
++ select NEED_KUSER_HELPERS
+ help
+ SMP on a pre-ARMv6 processor? Well OK then.
+ Forget about fast user space cmpxchg support.
+ It is just not possible.
+
++config NEED_KUSER_HELPERS
++ bool
++
++config KUSER_HELPERS
++ bool "Enable kuser helpers in vector page" if !NEED_KUSER_HELPERS
++ default y
++ help
++ Warning: disabling this option may break user programs.
++
++ Provide kuser helpers in the vector page. The kernel provides
++ helper code to userspace in read only form at a fixed location
++ in the high vector page to allow userspace to be independent of
++ the CPU type fitted to the system. This permits binaries to be
++ run on ARMv4 through to ARMv7 without modification.
++
++ However, the fixed address nature of these helpers can be used
++ by ROP (return orientated programming) authors when creating
++ exploits.
++
++ If all of the binaries and libraries which run on your platform
++ are built specifically for your platform, and make no use of
++ these helpers, then you can turn this option off. However,
++ when such an binary or library is run, it will receive a SIGILL
++ signal, which will terminate the program.
++
++ Say N here only if you are absolutely certain that you do not
++ need these helpers; otherwise, the safe option is to say Y.
++
+ config DMA_CACHE_RWFO
+ bool "Enable read/write for ownership DMA cache maintenance"
+ depends on CPU_V6K && SMP
+diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
+index 4d409e6..daf336f 100644
+--- a/arch/arm/mm/mmu.c
++++ b/arch/arm/mm/mmu.c
+@@ -1175,7 +1175,7 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
+ /*
+ * Allocate the vector page early.
+ */
+- vectors = early_alloc(PAGE_SIZE);
++ vectors = early_alloc(PAGE_SIZE * 2);
+
+ early_trap_init(vectors);
+
+@@ -1220,15 +1220,27 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
+ map.pfn = __phys_to_pfn(virt_to_phys(vectors));
+ map.virtual = 0xffff0000;
+ map.length = PAGE_SIZE;
++#ifdef CONFIG_KUSER_HELPERS
+ map.type = MT_HIGH_VECTORS;
++#else
++ map.type = MT_LOW_VECTORS;
++#endif
+ create_mapping(&map);
+
+ if (!vectors_high()) {
+ map.virtual = 0;
++ map.length = PAGE_SIZE * 2;
+ map.type = MT_LOW_VECTORS;
+ create_mapping(&map);
+ }
+
++ /* Now create a kernel read-only mapping */
++ map.pfn += 1;
++ map.virtual = 0xffff0000 + PAGE_SIZE;
++ map.length = PAGE_SIZE;
++ map.type = MT_LOW_VECTORS;
++ create_mapping(&map);
++
+ /*
+ * Ask the machine support to map in the statically mapped devices.
+ */
+diff --git a/arch/arm/mm/proc-v7-2level.S b/arch/arm/mm/proc-v7-2level.S
+index 9704097..b3997c7 100644
+--- a/arch/arm/mm/proc-v7-2level.S
++++ b/arch/arm/mm/proc-v7-2level.S
+@@ -110,7 +110,7 @@ ENTRY(cpu_v7_set_pte_ext)
+ ARM( str r3, [r0, #2048]! )
+ THUMB( add r0, r0, #2048 )
+ THUMB( str r3, [r0] )
+- ALT_SMP(mov pc,lr)
++ ALT_SMP(W(nop))
+ ALT_UP (mcr p15, 0, r0, c7, c10, 1) @ flush_pte
+ #endif
+ mov pc, lr
+diff --git a/arch/arm/mm/proc-v7-3level.S b/arch/arm/mm/proc-v7-3level.S
+index 363027e..6ba4bd9 100644
+--- a/arch/arm/mm/proc-v7-3level.S
++++ b/arch/arm/mm/proc-v7-3level.S
+@@ -73,7 +73,7 @@ ENTRY(cpu_v7_set_pte_ext)
+ tst r3, #1 << (55 - 32) @ L_PTE_DIRTY
+ orreq r2, #L_PTE_RDONLY
+ 1: strd r2, r3, [r0]
+- ALT_SMP(mov pc, lr)
++ ALT_SMP(W(nop))
+ ALT_UP (mcr p15, 0, r0, c7, c10, 1) @ flush_pte
+ #endif
+ mov pc, lr
+diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
+index e35fec3..5fbccee 100644
+--- a/arch/arm/mm/proc-v7.S
++++ b/arch/arm/mm/proc-v7.S
+@@ -75,13 +75,14 @@ ENTRY(cpu_v7_do_idle)
+ ENDPROC(cpu_v7_do_idle)
+
+ ENTRY(cpu_v7_dcache_clean_area)
+- ALT_SMP(mov pc, lr) @ MP extensions imply L1 PTW
+- ALT_UP(W(nop))
+- dcache_line_size r2, r3
+-1: mcr p15, 0, r0, c7, c10, 1 @ clean D entry
++ ALT_SMP(W(nop)) @ MP extensions imply L1 PTW
++ ALT_UP_B(1f)
++ mov pc, lr
++1: dcache_line_size r2, r3
++2: mcr p15, 0, r0, c7, c10, 1 @ clean D entry
+ add r0, r0, r2
+ subs r1, r1, r2
+- bhi 1b
++ bhi 2b
+ dsb
+ mov pc, lr
+ ENDPROC(cpu_v7_dcache_clean_area)
+diff --git a/arch/parisc/include/asm/parisc-device.h b/arch/parisc/include/asm/parisc-device.h
+index 9afdad6..eaf4dc1 100644
+--- a/arch/parisc/include/asm/parisc-device.h
++++ b/arch/parisc/include/asm/parisc-device.h
+@@ -23,6 +23,7 @@ struct parisc_device {
+ /* generic info returned from pdc_pat_cell_module() */
+ unsigned long mod_info; /* PAT specific - Misc Module info */
+ unsigned long pmod_loc; /* physical Module location */
++ unsigned long mod0;
+ #endif
+ u64 dma_mask; /* DMA mask for I/O */
+ struct device dev;
+@@ -61,4 +62,6 @@ parisc_get_drvdata(struct parisc_device *d)
+
+ extern struct bus_type parisc_bus_type;
+
++int iosapic_serial_irq(struct parisc_device *dev);
++
+ #endif /*_ASM_PARISC_PARISC_DEVICE_H_*/
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index 2e65aa5..c035673 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -71,18 +71,27 @@ flush_cache_all_local(void)
+ }
+ EXPORT_SYMBOL(flush_cache_all_local);
+
++/* Virtual address of pfn. */
++#define pfn_va(pfn) __va(PFN_PHYS(pfn))
++
+ void
+ update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t *ptep)
+ {
+- struct page *page = pte_page(*ptep);
++ unsigned long pfn = pte_pfn(*ptep);
++ struct page *page;
+
+- if (pfn_valid(page_to_pfn(page)) && page_mapping(page) &&
+- test_bit(PG_dcache_dirty, &page->flags)) {
++ /* We don't have pte special. As a result, we can be called with
++ an invalid pfn and we don't need to flush the kernel dcache page.
++ This occurs with FireGL card in C8000. */
++ if (!pfn_valid(pfn))
++ return;
+
+- flush_kernel_dcache_page(page);
++ page = pfn_to_page(pfn);
++ if (page_mapping(page) && test_bit(PG_dcache_dirty, &page->flags)) {
++ flush_kernel_dcache_page_addr(pfn_va(pfn));
+ clear_bit(PG_dcache_dirty, &page->flags);
+ } else if (parisc_requires_coherency())
+- flush_kernel_dcache_page(page);
++ flush_kernel_dcache_page_addr(pfn_va(pfn));
+ }
+
+ void
+@@ -495,44 +504,42 @@ static inline pte_t *get_ptep(pgd_t *pgd, unsigned long addr)
+
+ void flush_cache_mm(struct mm_struct *mm)
+ {
++ struct vm_area_struct *vma;
++ pgd_t *pgd;
++
+ /* Flushing the whole cache on each cpu takes forever on
+ rp3440, etc. So, avoid it if the mm isn't too big. */
+- if (mm_total_size(mm) < parisc_cache_flush_threshold) {
+- struct vm_area_struct *vma;
+-
+- if (mm->context == mfsp(3)) {
+- for (vma = mm->mmap; vma; vma = vma->vm_next) {
+- flush_user_dcache_range_asm(vma->vm_start,
+- vma->vm_end);
+- if (vma->vm_flags & VM_EXEC)
+- flush_user_icache_range_asm(
+- vma->vm_start, vma->vm_end);
+- }
+- } else {
+- pgd_t *pgd = mm->pgd;
+-
+- for (vma = mm->mmap; vma; vma = vma->vm_next) {
+- unsigned long addr;
+-
+- for (addr = vma->vm_start; addr < vma->vm_end;
+- addr += PAGE_SIZE) {
+- pte_t *ptep = get_ptep(pgd, addr);
+- if (ptep != NULL) {
+- pte_t pte = *ptep;
+- __flush_cache_page(vma, addr,
+- page_to_phys(pte_page(pte)));
+- }
+- }
+- }
++ if (mm_total_size(mm) >= parisc_cache_flush_threshold) {
++ flush_cache_all();
++ return;
++ }
++
++ if (mm->context == mfsp(3)) {
++ for (vma = mm->mmap; vma; vma = vma->vm_next) {
++ flush_user_dcache_range_asm(vma->vm_start, vma->vm_end);
++ if ((vma->vm_flags & VM_EXEC) == 0)
++ continue;
++ flush_user_icache_range_asm(vma->vm_start, vma->vm_end);
+ }
+ return;
+ }
+
+-#ifdef CONFIG_SMP
+- flush_cache_all();
+-#else
+- flush_cache_all_local();
+-#endif
++ pgd = mm->pgd;
++ for (vma = mm->mmap; vma; vma = vma->vm_next) {
++ unsigned long addr;
++
++ for (addr = vma->vm_start; addr < vma->vm_end;
++ addr += PAGE_SIZE) {
++ unsigned long pfn;
++ pte_t *ptep = get_ptep(pgd, addr);
++ if (!ptep)
++ continue;
++ pfn = pte_pfn(*ptep);
++ if (!pfn_valid(pfn))
++ continue;
++ __flush_cache_page(vma, addr, PFN_PHYS(pfn));
++ }
++ }
+ }
+
+ void
+@@ -556,33 +563,32 @@ flush_user_icache_range(unsigned long start, unsigned long end)
+ void flush_cache_range(struct vm_area_struct *vma,
+ unsigned long start, unsigned long end)
+ {
++ unsigned long addr;
++ pgd_t *pgd;
++
+ BUG_ON(!vma->vm_mm->context);
+
+- if ((end - start) < parisc_cache_flush_threshold) {
+- if (vma->vm_mm->context == mfsp(3)) {
+- flush_user_dcache_range_asm(start, end);
+- if (vma->vm_flags & VM_EXEC)
+- flush_user_icache_range_asm(start, end);
+- } else {
+- unsigned long addr;
+- pgd_t *pgd = vma->vm_mm->pgd;
+-
+- for (addr = start & PAGE_MASK; addr < end;
+- addr += PAGE_SIZE) {
+- pte_t *ptep = get_ptep(pgd, addr);
+- if (ptep != NULL) {
+- pte_t pte = *ptep;
+- flush_cache_page(vma,
+- addr, pte_pfn(pte));
+- }
+- }
+- }
+- } else {
+-#ifdef CONFIG_SMP
++ if ((end - start) >= parisc_cache_flush_threshold) {
+ flush_cache_all();
+-#else
+- flush_cache_all_local();
+-#endif
++ return;
++ }
++
++ if (vma->vm_mm->context == mfsp(3)) {
++ flush_user_dcache_range_asm(start, end);
++ if (vma->vm_flags & VM_EXEC)
++ flush_user_icache_range_asm(start, end);
++ return;
++ }
++
++ pgd = vma->vm_mm->pgd;
++ for (addr = start & PAGE_MASK; addr < end; addr += PAGE_SIZE) {
++ unsigned long pfn;
++ pte_t *ptep = get_ptep(pgd, addr);
++ if (!ptep)
++ continue;
++ pfn = pte_pfn(*ptep);
++ if (pfn_valid(pfn))
++ __flush_cache_page(vma, addr, PFN_PHYS(pfn));
+ }
+ }
+
+@@ -591,9 +597,10 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
+ {
+ BUG_ON(!vma->vm_mm->context);
+
+- flush_tlb_page(vma, vmaddr);
+- __flush_cache_page(vma, vmaddr, page_to_phys(pfn_to_page(pfn)));
+-
++ if (pfn_valid(pfn)) {
++ flush_tlb_page(vma, vmaddr);
++ __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
++ }
+ }
+
+ #ifdef CONFIG_PARISC_TMPALIAS
+diff --git a/arch/parisc/kernel/inventory.c b/arch/parisc/kernel/inventory.c
+index 3295ef4..f0b6722 100644
+--- a/arch/parisc/kernel/inventory.c
++++ b/arch/parisc/kernel/inventory.c
+@@ -211,6 +211,7 @@ pat_query_module(ulong pcell_loc, ulong mod_index)
+ /* REVISIT: who is the consumer of this? not sure yet... */
+ dev->mod_info = pa_pdc_cell->mod_info; /* pass to PAT_GET_ENTITY() */
+ dev->pmod_loc = pa_pdc_cell->mod_location;
++ dev->mod0 = pa_pdc_cell->mod[0];
+
+ register_parisc_device(dev); /* advertise device */
+
+diff --git a/arch/powerpc/include/asm/smp.h b/arch/powerpc/include/asm/smp.h
+index ffbaabe..48cfc85 100644
+--- a/arch/powerpc/include/asm/smp.h
++++ b/arch/powerpc/include/asm/smp.h
+@@ -145,6 +145,10 @@ extern void __cpu_die(unsigned int cpu);
+ #define smp_setup_cpu_maps()
+ static inline void inhibit_secondary_onlining(void) {}
+ static inline void uninhibit_secondary_onlining(void) {}
++static inline const struct cpumask *cpu_sibling_mask(int cpu)
++{
++ return cpumask_of(cpu);
++}
+
+ #endif /* CONFIG_SMP */
+
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index 2859a1f..cafad40 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -27,6 +27,7 @@
+ #include <linux/seq_file.h>
+ #include <linux/uaccess.h>
+ #include <linux/slab.h>
++#include <asm/cputhreads.h>
+ #include <asm/sparsemem.h>
+ #include <asm/prom.h>
+ #include <asm/smp.h>
+@@ -1319,7 +1320,8 @@ static int update_cpu_associativity_changes_mask(void)
+ }
+ }
+ if (changed) {
+- cpumask_set_cpu(cpu, changes);
++ cpumask_or(changes, changes, cpu_sibling_mask(cpu));
++ cpu = cpu_last_thread_sibling(cpu);
+ }
+ }
+
+@@ -1427,7 +1429,7 @@ static int update_cpu_topology(void *data)
+ if (!data)
+ return -EINVAL;
+
+- cpu = get_cpu();
++ cpu = smp_processor_id();
+
+ for (update = data; update; update = update->next) {
+ if (cpu != update->cpu)
+@@ -1447,12 +1449,12 @@ static int update_cpu_topology(void *data)
+ */
+ int arch_update_cpu_topology(void)
+ {
+- unsigned int cpu, changed = 0;
++ unsigned int cpu, sibling, changed = 0;
+ struct topology_update_data *updates, *ud;
+ unsigned int associativity[VPHN_ASSOC_BUFSIZE] = {0};
+ cpumask_t updated_cpus;
+ struct device *dev;
+- int weight, i = 0;
++ int weight, new_nid, i = 0;
+
+ weight = cpumask_weight(&cpu_associativity_changes_mask);
+ if (!weight)
+@@ -1465,19 +1467,46 @@ int arch_update_cpu_topology(void)
+ cpumask_clear(&updated_cpus);
+
+ for_each_cpu(cpu, &cpu_associativity_changes_mask) {
+- ud = &updates[i++];
+- ud->cpu = cpu;
+- vphn_get_associativity(cpu, associativity);
+- ud->new_nid = associativity_to_nid(associativity);
+-
+- if (ud->new_nid < 0 || !node_online(ud->new_nid))
+- ud->new_nid = first_online_node;
++ /*
++ * If siblings aren't flagged for changes, updates list
++ * will be too short. Skip on this update and set for next
++ * update.
++ */
++ if (!cpumask_subset(cpu_sibling_mask(cpu),
++ &cpu_associativity_changes_mask)) {
++ pr_info("Sibling bits not set for associativity "
++ "change, cpu%d\n", cpu);
++ cpumask_or(&cpu_associativity_changes_mask,
++ &cpu_associativity_changes_mask,
++ cpu_sibling_mask(cpu));
++ cpu = cpu_last_thread_sibling(cpu);
++ continue;
++ }
+
+- ud->old_nid = numa_cpu_lookup_table[cpu];
+- cpumask_set_cpu(cpu, &updated_cpus);
++ /* Use associativity from first thread for all siblings */
++ vphn_get_associativity(cpu, associativity);
++ new_nid = associativity_to_nid(associativity);
++ if (new_nid < 0 || !node_online(new_nid))
++ new_nid = first_online_node;
++
++ if (new_nid == numa_cpu_lookup_table[cpu]) {
++ cpumask_andnot(&cpu_associativity_changes_mask,
++ &cpu_associativity_changes_mask,
++ cpu_sibling_mask(cpu));
++ cpu = cpu_last_thread_sibling(cpu);
++ continue;
++ }
+
+- if (i < weight)
+- ud->next = &updates[i];
++ for_each_cpu(sibling, cpu_sibling_mask(cpu)) {
++ ud = &updates[i++];
++ ud->cpu = sibling;
++ ud->new_nid = new_nid;
++ ud->old_nid = numa_cpu_lookup_table[sibling];
++ cpumask_set_cpu(sibling, &updated_cpus);
++ if (i < weight)
++ ud->next = &updates[i];
++ }
++ cpu = cpu_last_thread_sibling(cpu);
+ }
+
+ stop_machine(update_cpu_topology, &updates[0], &updated_cpus);
+diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
+index da183c5..97dcbea 100644
+--- a/arch/s390/Kconfig
++++ b/arch/s390/Kconfig
+@@ -227,11 +227,12 @@ config MARCH_Z196
+ not work on older machines.
+
+ config MARCH_ZEC12
+- bool "IBM zEC12"
++ bool "IBM zBC12 and zEC12"
+ select HAVE_MARCH_ZEC12_FEATURES if 64BIT
+ help
+- Select this to enable optimizations for IBM zEC12 (2827 series). The
+- kernel will be slightly faster but will not work on older machines.
++ Select this to enable optimizations for IBM zBC12 and zEC12 (2828 and
++ 2827 series). The kernel will be slightly faster but will not work on
++ older machines.
+
+ endchoice
+
+diff --git a/arch/s390/include/asm/bitops.h b/arch/s390/include/asm/bitops.h
+index 4d8604e..7d46767 100644
+--- a/arch/s390/include/asm/bitops.h
++++ b/arch/s390/include/asm/bitops.h
+@@ -693,7 +693,7 @@ static inline int find_next_bit_left(const unsigned long *addr,
+ size -= offset;
+ p = addr + offset / BITS_PER_LONG;
+ if (bit) {
+- set = __flo_word(0, *p & (~0UL << bit));
++ set = __flo_word(0, *p & (~0UL >> bit));
+ if (set >= size)
+ return size + offset;
+ if (set < BITS_PER_LONG)
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index 0a49095..8ad9413 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -998,6 +998,7 @@ static void __init setup_hwcaps(void)
+ strcpy(elf_platform, "z196");
+ break;
+ case 0x2827:
++ case 0x2828:
+ strcpy(elf_platform, "zEC12");
+ break;
+ }
+diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
+index 89ebae4..eba15f1 100644
+--- a/arch/s390/mm/init.c
++++ b/arch/s390/mm/init.c
+@@ -69,6 +69,7 @@ static void __init setup_zero_pages(void)
+ order = 2;
+ break;
+ case 0x2827: /* zEC12 */
++ case 0x2828: /* zEC12 */
+ default:
+ order = 5;
+ break;
+diff --git a/arch/s390/oprofile/init.c b/arch/s390/oprofile/init.c
+index ffeb17c..930783d 100644
+--- a/arch/s390/oprofile/init.c
++++ b/arch/s390/oprofile/init.c
+@@ -440,7 +440,7 @@ static int oprofile_hwsampler_init(struct oprofile_operations *ops)
+ switch (id.machine) {
+ case 0x2097: case 0x2098: ops->cpu_type = "s390/z10"; break;
+ case 0x2817: case 0x2818: ops->cpu_type = "s390/z196"; break;
+- case 0x2827: ops->cpu_type = "s390/zEC12"; break;
++ case 0x2827: case 0x2828: ops->cpu_type = "s390/zEC12"; break;
+ default: return -ENODEV;
+ }
+ }
+diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
+index 94ab6b9..63bdb29 100644
+--- a/arch/x86/kernel/early-quirks.c
++++ b/arch/x86/kernel/early-quirks.c
+@@ -196,15 +196,23 @@ static void __init ati_bugs_contd(int num, int slot, int func)
+ static void __init intel_remapping_check(int num, int slot, int func)
+ {
+ u8 revision;
++ u16 device;
+
++ device = read_pci_config_16(num, slot, func, PCI_DEVICE_ID);
+ revision = read_pci_config_byte(num, slot, func, PCI_REVISION_ID);
+
+ /*
+- * Revision 0x13 of this chipset supports irq remapping
+- * but has an erratum that breaks its behavior, flag it as such
++ * Revision 13 of all triggering devices id in this quirk have
++ * a problem draining interrupts when irq remapping is enabled,
++ * and should be flagged as broken. Additionally revisions 0x12
++ * and 0x22 of device id 0x3405 has this problem.
+ */
+ if (revision == 0x13)
+ set_irq_remapping_broken();
++ else if ((device == 0x3405) &&
++ ((revision == 0x12) ||
++ (revision == 0x22)))
++ set_irq_remapping_broken();
+
+ }
+
+@@ -239,6 +247,8 @@ static struct chipset early_qrk[] __initdata = {
+ PCI_CLASS_SERIAL_SMBUS, PCI_ANY_ID, 0, ati_bugs_contd },
+ { PCI_VENDOR_ID_INTEL, 0x3403, PCI_CLASS_BRIDGE_HOST,
+ PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
++ { PCI_VENDOR_ID_INTEL, 0x3405, PCI_CLASS_BRIDGE_HOST,
++ PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
+ { PCI_VENDOR_ID_INTEL, 0x3406, PCI_CLASS_BRIDGE_HOST,
+ PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
+ {}
+diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
+index cb33909..f7ea30d 100644
+--- a/arch/x86/kernel/i387.c
++++ b/arch/x86/kernel/i387.c
+@@ -116,7 +116,7 @@ static void __cpuinit mxcsr_feature_mask_init(void)
+
+ if (cpu_has_fxsr) {
+ memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct));
+- asm volatile("fxsave %0" : : "m" (fx_scratch));
++ asm volatile("fxsave %0" : "+m" (fx_scratch));
+ mask = fx_scratch.mxcsr_mask;
+ if (mask == 0)
+ mask = 0x0000ffbf;
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index e710045..9533271 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -117,6 +117,7 @@ struct acpi_battery {
+ struct acpi_device *device;
+ struct notifier_block pm_nb;
+ unsigned long update_time;
++ int revision;
+ int rate_now;
+ int capacity_now;
+ int voltage_now;
+@@ -359,6 +360,7 @@ static struct acpi_offsets info_offsets[] = {
+ };
+
+ static struct acpi_offsets extended_info_offsets[] = {
++ {offsetof(struct acpi_battery, revision), 0},
+ {offsetof(struct acpi_battery, power_unit), 0},
+ {offsetof(struct acpi_battery, design_capacity), 0},
+ {offsetof(struct acpi_battery, full_charge_capacity), 0},
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index d89ef86..69b45fc 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -75,6 +75,7 @@ struct blk_shadow {
+ struct blkif_request req;
+ struct request *request;
+ struct grant *grants_used[BLKIF_MAX_SEGMENTS_PER_REQUEST];
++ struct scatterlist sg[BLKIF_MAX_SEGMENTS_PER_REQUEST];
+ };
+
+ static DEFINE_MUTEX(blkfront_mutex);
+@@ -98,7 +99,6 @@ struct blkfront_info
+ enum blkif_state connected;
+ int ring_ref;
+ struct blkif_front_ring ring;
+- struct scatterlist sg[BLKIF_MAX_SEGMENTS_PER_REQUEST];
+ unsigned int evtchn, irq;
+ struct request_queue *rq;
+ struct work_struct work;
+@@ -422,11 +422,11 @@ static int blkif_queue_request(struct request *req)
+ ring_req->u.discard.flag = 0;
+ } else {
+ ring_req->u.rw.nr_segments = blk_rq_map_sg(req->q, req,
+- info->sg);
++ info->shadow[id].sg);
+ BUG_ON(ring_req->u.rw.nr_segments >
+ BLKIF_MAX_SEGMENTS_PER_REQUEST);
+
+- for_each_sg(info->sg, sg, ring_req->u.rw.nr_segments, i) {
++ for_each_sg(info->shadow[id].sg, sg, ring_req->u.rw.nr_segments, i) {
+ fsect = sg->offset >> 9;
+ lsect = fsect + (sg->length >> 9) - 1;
+
+@@ -867,12 +867,12 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
+ struct blkif_response *bret)
+ {
+ int i = 0;
+- struct bio_vec *bvec;
+- struct req_iterator iter;
+- unsigned long flags;
++ struct scatterlist *sg;
+ char *bvec_data;
+ void *shared_data;
+- unsigned int offset = 0;
++ int nseg;
++
++ nseg = s->req.u.rw.nr_segments;
+
+ if (bret->operation == BLKIF_OP_READ) {
+ /*
+@@ -881,19 +881,16 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
+ * than PAGE_SIZE, we have to keep track of the current offset,
+ * to be sure we are copying the data from the right shared page.
+ */
+- rq_for_each_segment(bvec, s->request, iter) {
+- BUG_ON((bvec->bv_offset + bvec->bv_len) > PAGE_SIZE);
+- if (bvec->bv_offset < offset)
+- i++;
+- BUG_ON(i >= s->req.u.rw.nr_segments);
++ for_each_sg(s->sg, sg, nseg, i) {
++ BUG_ON(sg->offset + sg->length > PAGE_SIZE);
+ shared_data = kmap_atomic(
+ pfn_to_page(s->grants_used[i]->pfn));
+- bvec_data = bvec_kmap_irq(bvec, &flags);
+- memcpy(bvec_data, shared_data + bvec->bv_offset,
+- bvec->bv_len);
+- bvec_kunmap_irq(bvec_data, &flags);
++ bvec_data = kmap_atomic(sg_page(sg));
++ memcpy(bvec_data + sg->offset,
++ shared_data + sg->offset,
++ sg->length);
++ kunmap_atomic(bvec_data);
+ kunmap_atomic(shared_data);
+- offset = bvec->bv_offset + bvec->bv_len;
+ }
+ }
+ /* Add the persistent grant into the list of free grants */
+@@ -1022,7 +1019,7 @@ static int setup_blkring(struct xenbus_device *dev,
+ struct blkfront_info *info)
+ {
+ struct blkif_sring *sring;
+- int err;
++ int err, i;
+
+ info->ring_ref = GRANT_INVALID_REF;
+
+@@ -1034,7 +1031,8 @@ static int setup_blkring(struct xenbus_device *dev,
+ SHARED_RING_INIT(sring);
+ FRONT_RING_INIT(&info->ring, sring, PAGE_SIZE);
+
+- sg_init_table(info->sg, BLKIF_MAX_SEGMENTS_PER_REQUEST);
++ for (i = 0; i < BLK_RING_SIZE; i++)
++ sg_init_table(info->shadow[i].sg, BLKIF_MAX_SEGMENTS_PER_REQUEST);
+
+ /* Allocate memory for grants */
+ err = fill_grant_buffer(info, BLK_RING_SIZE *
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 11f467c..a12b923 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -91,6 +91,10 @@ static struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x0489, 0xe04e) },
+ { USB_DEVICE(0x0489, 0xe056) },
+ { USB_DEVICE(0x0489, 0xe04d) },
++ { USB_DEVICE(0x04c5, 0x1330) },
++ { USB_DEVICE(0x13d3, 0x3402) },
++ { USB_DEVICE(0x0cf3, 0x3121) },
++ { USB_DEVICE(0x0cf3, 0xe003) },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE02C) },
+@@ -128,6 +132,10 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU22 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
+@@ -193,24 +201,44 @@ error:
+
+ static int ath3k_get_state(struct usb_device *udev, unsigned char *state)
+ {
+- int pipe = 0;
++ int ret, pipe = 0;
++ char *buf;
++
++ buf = kmalloc(sizeof(*buf), GFP_KERNEL);
++ if (!buf)
++ return -ENOMEM;
+
+ pipe = usb_rcvctrlpipe(udev, 0);
+- return usb_control_msg(udev, pipe, ATH3K_GETSTATE,
+- USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
+- state, 0x01, USB_CTRL_SET_TIMEOUT);
++ ret = usb_control_msg(udev, pipe, ATH3K_GETSTATE,
++ USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
++ buf, sizeof(*buf), USB_CTRL_SET_TIMEOUT);
++
++ *state = *buf;
++ kfree(buf);
++
++ return ret;
+ }
+
+ static int ath3k_get_version(struct usb_device *udev,
+ struct ath3k_version *version)
+ {
+- int pipe = 0;
++ int ret, pipe = 0;
++ struct ath3k_version *buf;
++ const int size = sizeof(*buf);
++
++ buf = kmalloc(size, GFP_KERNEL);
++ if (!buf)
++ return -ENOMEM;
+
+ pipe = usb_rcvctrlpipe(udev, 0);
+- return usb_control_msg(udev, pipe, ATH3K_GETVERSION,
+- USB_TYPE_VENDOR | USB_DIR_IN, 0, 0, version,
+- sizeof(struct ath3k_version),
+- USB_CTRL_SET_TIMEOUT);
++ ret = usb_control_msg(udev, pipe, ATH3K_GETVERSION,
++ USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
++ buf, size, USB_CTRL_SET_TIMEOUT);
++
++ memcpy(version, buf, size);
++ kfree(buf);
++
++ return ret;
+ }
+
+ static int ath3k_load_fwfile(struct usb_device *udev,
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 7a7e5f8..d0b3d90 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -57,6 +57,9 @@ static struct usb_device_id btusb_table[] = {
+ /* Apple-specific (Broadcom) devices */
+ { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
+
++ /* MediaTek MT76x0E */
++ { USB_DEVICE(0x0e8d, 0x763f) },
++
+ /* Broadcom SoftSailing reporting vendor specific */
+ { USB_DEVICE(0x0a5c, 0x21e1) },
+
+@@ -151,6 +154,10 @@ static struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+@@ -1092,7 +1099,7 @@ static int btusb_setup_intel_patching(struct hci_dev *hdev,
+ if (IS_ERR(skb)) {
+ BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
+ hdev->name, cmd->opcode, PTR_ERR(skb));
+- return -PTR_ERR(skb);
++ return PTR_ERR(skb);
+ }
+
+ /* It ensures that the returned event matches the event data read from
+@@ -1144,7 +1151,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
+ if (IS_ERR(skb)) {
+ BT_ERR("%s sending initial HCI reset command failed (%ld)",
+ hdev->name, PTR_ERR(skb));
+- return -PTR_ERR(skb);
++ return PTR_ERR(skb);
+ }
+ kfree_skb(skb);
+
+@@ -1158,7 +1165,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
+ if (IS_ERR(skb)) {
+ BT_ERR("%s reading Intel fw version command failed (%ld)",
+ hdev->name, PTR_ERR(skb));
+- return -PTR_ERR(skb);
++ return PTR_ERR(skb);
+ }
+
+ if (skb->len != sizeof(*ver)) {
+@@ -1216,7 +1223,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
+ BT_ERR("%s entering Intel manufacturer mode failed (%ld)",
+ hdev->name, PTR_ERR(skb));
+ release_firmware(fw);
+- return -PTR_ERR(skb);
++ return PTR_ERR(skb);
+ }
+
+ if (skb->data[0]) {
+@@ -1273,7 +1280,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
+ if (IS_ERR(skb)) {
+ BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
+ hdev->name, PTR_ERR(skb));
+- return -PTR_ERR(skb);
++ return PTR_ERR(skb);
+ }
+ kfree_skb(skb);
+
+@@ -1289,7 +1296,7 @@ exit_mfg_disable:
+ if (IS_ERR(skb)) {
+ BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
+ hdev->name, PTR_ERR(skb));
+- return -PTR_ERR(skb);
++ return PTR_ERR(skb);
+ }
+ kfree_skb(skb);
+
+@@ -1307,7 +1314,7 @@ exit_mfg_deactivate:
+ if (IS_ERR(skb)) {
+ BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
+ hdev->name, PTR_ERR(skb));
+- return -PTR_ERR(skb);
++ return PTR_ERR(skb);
+ }
+ kfree_skb(skb);
+
+diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
+index 94821ab..9576fad 100644
+--- a/drivers/char/agp/parisc-agp.c
++++ b/drivers/char/agp/parisc-agp.c
+@@ -129,7 +129,8 @@ parisc_agp_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
+ off_t j, io_pg_start;
+ int io_pg_count;
+
+- if (type != 0 || mem->type != 0) {
++ if (type != mem->type ||
++ agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type)) {
+ return -EINVAL;
+ }
+
+@@ -175,7 +176,8 @@ parisc_agp_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
+ struct _parisc_agp_info *info = &parisc_agp_info;
+ int i, io_pg_start, io_pg_count;
+
+- if (type != 0 || mem->type != 0) {
++ if (type != mem->type ||
++ agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type)) {
+ return -EINVAL;
+ }
+
+diff --git a/drivers/char/hw_random/bcm2835-rng.c b/drivers/char/hw_random/bcm2835-rng.c
+index eb7f147..43577ca 100644
+--- a/drivers/char/hw_random/bcm2835-rng.c
++++ b/drivers/char/hw_random/bcm2835-rng.c
+@@ -110,4 +110,4 @@ module_platform_driver(bcm2835_rng_driver);
+
+ MODULE_AUTHOR("Lubomir Rintel <lkundrak@v3.sk>");
+ MODULE_DESCRIPTION("BCM2835 Random Number Generator (RNG) driver");
+-MODULE_LICENSE("GPLv2");
++MODULE_LICENSE("GPL v2");
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index 178fe7a..6485547 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1075,14 +1075,11 @@ static int __cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif
+ __func__, cpu_dev->id, cpu);
+ }
+
+- if ((cpus == 1) && (cpufreq_driver->target))
+- __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
+-
+- pr_debug("%s: removing link, cpu: %d\n", __func__, cpu);
+- cpufreq_cpu_put(data);
+-
+ /* If cpu is last user of policy, free policy */
+ if (cpus == 1) {
++ if (cpufreq_driver->target)
++ __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
++
+ lock_policy_rwsem_read(cpu);
+ kobj = &data->kobj;
+ cmp = &data->kobj_unregister;
+@@ -1103,9 +1100,13 @@ static int __cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif
+ free_cpumask_var(data->related_cpus);
+ free_cpumask_var(data->cpus);
+ kfree(data);
+- } else if (cpufreq_driver->target) {
+- __cpufreq_governor(data, CPUFREQ_GOV_START);
+- __cpufreq_governor(data, CPUFREQ_GOV_LIMITS);
++ } else {
++ pr_debug("%s: removing link, cpu: %d\n", __func__, cpu);
++ cpufreq_cpu_put(data);
++ if (cpufreq_driver->target) {
++ __cpufreq_governor(data, CPUFREQ_GOV_START);
++ __cpufreq_governor(data, CPUFREQ_GOV_LIMITS);
++ }
+ }
+
+ per_cpu(cpufreq_policy_cpu, cpu) = -1;
+diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
+index fe343a0..bc580b6 100644
+--- a/drivers/cpuidle/governors/menu.c
++++ b/drivers/cpuidle/governors/menu.c
+@@ -28,13 +28,6 @@
+ #define MAX_INTERESTING 50000
+ #define STDDEV_THRESH 400
+
+-/* 60 * 60 > STDDEV_THRESH * INTERVALS = 400 * 8 */
+-#define MAX_DEVIATION 60
+-
+-static DEFINE_PER_CPU(struct hrtimer, menu_hrtimer);
+-static DEFINE_PER_CPU(int, hrtimer_status);
+-/* menu hrtimer mode */
+-enum {MENU_HRTIMER_STOP, MENU_HRTIMER_REPEAT, MENU_HRTIMER_GENERAL};
+
+ /*
+ * Concepts and ideas behind the menu governor
+@@ -116,13 +109,6 @@ enum {MENU_HRTIMER_STOP, MENU_HRTIMER_REPEAT, MENU_HRTIMER_GENERAL};
+ *
+ */
+
+-/*
+- * The C-state residency is so long that is is worthwhile to exit
+- * from the shallow C-state and re-enter into a deeper C-state.
+- */
+-static unsigned int perfect_cstate_ms __read_mostly = 30;
+-module_param(perfect_cstate_ms, uint, 0000);
+-
+ struct menu_device {
+ int last_state_idx;
+ int needs_update;
+@@ -205,52 +191,17 @@ static u64 div_round64(u64 dividend, u32 divisor)
+ return div_u64(dividend + (divisor / 2), divisor);
+ }
+
+-/* Cancel the hrtimer if it is not triggered yet */
+-void menu_hrtimer_cancel(void)
+-{
+- int cpu = smp_processor_id();
+- struct hrtimer *hrtmr = &per_cpu(menu_hrtimer, cpu);
+-
+- /* The timer is still not time out*/
+- if (per_cpu(hrtimer_status, cpu)) {
+- hrtimer_cancel(hrtmr);
+- per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_STOP;
+- }
+-}
+-EXPORT_SYMBOL_GPL(menu_hrtimer_cancel);
+-
+-/* Call back for hrtimer is triggered */
+-static enum hrtimer_restart menu_hrtimer_notify(struct hrtimer *hrtimer)
+-{
+- int cpu = smp_processor_id();
+- struct menu_device *data = &per_cpu(menu_devices, cpu);
+-
+- /* In general case, the expected residency is much larger than
+- * deepest C-state target residency, but prediction logic still
+- * predicts a small predicted residency, so the prediction
+- * history is totally broken if the timer is triggered.
+- * So reset the correction factor.
+- */
+- if (per_cpu(hrtimer_status, cpu) == MENU_HRTIMER_GENERAL)
+- data->correction_factor[data->bucket] = RESOLUTION * DECAY;
+-
+- per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_STOP;
+-
+- return HRTIMER_NORESTART;
+-}
+-
+ /*
+ * Try detecting repeating patterns by keeping track of the last 8
+ * intervals, and checking if the standard deviation of that set
+ * of points is below a threshold. If it is... then use the
+ * average of these 8 points as the estimated value.
+ */
+-static u32 get_typical_interval(struct menu_device *data)
++static void get_typical_interval(struct menu_device *data)
+ {
+ int i = 0, divisor = 0;
+ uint64_t max = 0, avg = 0, stddev = 0;
+ int64_t thresh = LLONG_MAX; /* Discard outliers above this value. */
+- unsigned int ret = 0;
+
+ again:
+
+@@ -291,16 +242,13 @@ again:
+ if (((avg > stddev * 6) && (divisor * 4 >= INTERVALS * 3))
+ || stddev <= 20) {
+ data->predicted_us = avg;
+- ret = 1;
+- return ret;
++ return;
+
+ } else if ((divisor * 4) > INTERVALS * 3) {
+ /* Exclude the max interval */
+ thresh = max - 1;
+ goto again;
+ }
+-
+- return ret;
+ }
+
+ /**
+@@ -315,9 +263,6 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
+ int i;
+ int multiplier;
+ struct timespec t;
+- int repeat = 0, low_predicted = 0;
+- int cpu = smp_processor_id();
+- struct hrtimer *hrtmr = &per_cpu(menu_hrtimer, cpu);
+
+ if (data->needs_update) {
+ menu_update(drv, dev);
+@@ -352,7 +297,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
+ data->predicted_us = div_round64(data->expected_us * data->correction_factor[data->bucket],
+ RESOLUTION * DECAY);
+
+- repeat = get_typical_interval(data);
++ get_typical_interval(data);
+
+ /*
+ * We want to default to C1 (hlt), not to busy polling
+@@ -373,10 +318,8 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
+
+ if (s->disabled || su->disable)
+ continue;
+- if (s->target_residency > data->predicted_us) {
+- low_predicted = 1;
++ if (s->target_residency > data->predicted_us)
+ continue;
+- }
+ if (s->exit_latency > latency_req)
+ continue;
+ if (s->exit_latency * multiplier > data->predicted_us)
+@@ -386,44 +329,6 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
+ data->exit_us = s->exit_latency;
+ }
+
+- /* not deepest C-state chosen for low predicted residency */
+- if (low_predicted) {
+- unsigned int timer_us = 0;
+- unsigned int perfect_us = 0;
+-
+- /*
+- * Set a timer to detect whether this sleep is much
+- * longer than repeat mode predicted. If the timer
+- * triggers, the code will evaluate whether to put
+- * the CPU into a deeper C-state.
+- * The timer is cancelled on CPU wakeup.
+- */
+- timer_us = 2 * (data->predicted_us + MAX_DEVIATION);
+-
+- perfect_us = perfect_cstate_ms * 1000;
+-
+- if (repeat && (4 * timer_us < data->expected_us)) {
+- RCU_NONIDLE(hrtimer_start(hrtmr,
+- ns_to_ktime(1000 * timer_us),
+- HRTIMER_MODE_REL_PINNED));
+- /* In repeat case, menu hrtimer is started */
+- per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_REPEAT;
+- } else if (perfect_us < data->expected_us) {
+- /*
+- * The next timer is long. This could be because
+- * we did not make a useful prediction.
+- * In that case, it makes sense to re-enter
+- * into a deeper C-state after some time.
+- */
+- RCU_NONIDLE(hrtimer_start(hrtmr,
+- ns_to_ktime(1000 * timer_us),
+- HRTIMER_MODE_REL_PINNED));
+- /* In general case, menu hrtimer is started */
+- per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_GENERAL;
+- }
+-
+- }
+-
+ return data->last_state_idx;
+ }
+
+@@ -514,9 +419,6 @@ static int menu_enable_device(struct cpuidle_driver *drv,
+ struct cpuidle_device *dev)
+ {
+ struct menu_device *data = &per_cpu(menu_devices, dev->cpu);
+- struct hrtimer *t = &per_cpu(menu_hrtimer, dev->cpu);
+- hrtimer_init(t, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+- t->function = menu_hrtimer_notify;
+
+ memset(data, 0, sizeof(struct menu_device));
+
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 7ec82f0..4c2f465 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2527,6 +2527,10 @@ static dma_cookie_t pl330_tx_submit(struct dma_async_tx_descriptor *tx)
+ /* Assign cookies to all nodes */
+ while (!list_empty(&last->node)) {
+ desc = list_entry(last->node.next, struct dma_pl330_desc, node);
++ if (pch->cyclic) {
++ desc->txd.callback = last->txd.callback;
++ desc->txd.callback_param = last->txd.callback_param;
++ }
+
+ dma_cookie_assign(&desc->txd);
+
+@@ -2710,45 +2714,82 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic(
+ size_t period_len, enum dma_transfer_direction direction,
+ unsigned long flags, void *context)
+ {
+- struct dma_pl330_desc *desc;
++ struct dma_pl330_desc *desc = NULL, *first = NULL;
+ struct dma_pl330_chan *pch = to_pchan(chan);
++ struct dma_pl330_dmac *pdmac = pch->dmac;
++ unsigned int i;
+ dma_addr_t dst;
+ dma_addr_t src;
+
+- desc = pl330_get_desc(pch);
+- if (!desc) {
+- dev_err(pch->dmac->pif.dev, "%s:%d Unable to fetch desc\n",
+- __func__, __LINE__);
++ if (len % period_len != 0)
+ return NULL;
+- }
+
+- switch (direction) {
+- case DMA_MEM_TO_DEV:
+- desc->rqcfg.src_inc = 1;
+- desc->rqcfg.dst_inc = 0;
+- desc->req.rqtype = MEMTODEV;
+- src = dma_addr;
+- dst = pch->fifo_addr;
+- break;
+- case DMA_DEV_TO_MEM:
+- desc->rqcfg.src_inc = 0;
+- desc->rqcfg.dst_inc = 1;
+- desc->req.rqtype = DEVTOMEM;
+- src = pch->fifo_addr;
+- dst = dma_addr;
+- break;
+- default:
++ if (!is_slave_direction(direction)) {
+ dev_err(pch->dmac->pif.dev, "%s:%d Invalid dma direction\n",
+ __func__, __LINE__);
+ return NULL;
+ }
+
+- desc->rqcfg.brst_size = pch->burst_sz;
+- desc->rqcfg.brst_len = 1;
++ for (i = 0; i < len / period_len; i++) {
++ desc = pl330_get_desc(pch);
++ if (!desc) {
++ dev_err(pch->dmac->pif.dev, "%s:%d Unable to fetch desc\n",
++ __func__, __LINE__);
+
+- pch->cyclic = true;
++ if (!first)
++ return NULL;
++
++ spin_lock_irqsave(&pdmac->pool_lock, flags);
++
++ while (!list_empty(&first->node)) {
++ desc = list_entry(first->node.next,
++ struct dma_pl330_desc, node);
++ list_move_tail(&desc->node, &pdmac->desc_pool);
++ }
++
++ list_move_tail(&first->node, &pdmac->desc_pool);
+
+- fill_px(&desc->px, dst, src, period_len);
++ spin_unlock_irqrestore(&pdmac->pool_lock, flags);
++
++ return NULL;
++ }
++
++ switch (direction) {
++ case DMA_MEM_TO_DEV:
++ desc->rqcfg.src_inc = 1;
++ desc->rqcfg.dst_inc = 0;
++ desc->req.rqtype = MEMTODEV;
++ src = dma_addr;
++ dst = pch->fifo_addr;
++ break;
++ case DMA_DEV_TO_MEM:
++ desc->rqcfg.src_inc = 0;
++ desc->rqcfg.dst_inc = 1;
++ desc->req.rqtype = DEVTOMEM;
++ src = pch->fifo_addr;
++ dst = dma_addr;
++ break;
++ default:
++ break;
++ }
++
++ desc->rqcfg.brst_size = pch->burst_sz;
++ desc->rqcfg.brst_len = 1;
++ fill_px(&desc->px, dst, src, period_len);
++
++ if (!first)
++ first = desc;
++ else
++ list_add_tail(&desc->node, &first->node);
++
++ dma_addr += period_len;
++ }
++
++ if (!desc)
++ return NULL;
++
++ pch->cyclic = true;
++ desc->txd.flags = flags;
+
+ return &desc->txd;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
+index fb961bb..16e674a 100644
+--- a/drivers/gpu/drm/i915/intel_ddi.c
++++ b/drivers/gpu/drm/i915/intel_ddi.c
+@@ -684,7 +684,7 @@ static void intel_ddi_mode_set(struct drm_encoder *encoder,
+ struct intel_digital_port *intel_dig_port =
+ enc_to_dig_port(encoder);
+
+- intel_dp->DP = intel_dig_port->port_reversal |
++ intel_dp->DP = intel_dig_port->saved_port_bits |
+ DDI_BUF_CTL_ENABLE | DDI_BUF_EMP_400MV_0DB_HSW;
+ switch (intel_dp->lane_count) {
+ case 1:
+@@ -1324,7 +1324,8 @@ static void intel_enable_ddi(struct intel_encoder *intel_encoder)
+ * enabling the port.
+ */
+ I915_WRITE(DDI_BUF_CTL(port),
+- intel_dig_port->port_reversal | DDI_BUF_CTL_ENABLE);
++ intel_dig_port->saved_port_bits |
++ DDI_BUF_CTL_ENABLE);
+ } else if (type == INTEL_OUTPUT_EDP) {
+ struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
+
+@@ -1543,8 +1544,9 @@ void intel_ddi_init(struct drm_device *dev, enum port port)
+ intel_encoder->get_hw_state = intel_ddi_get_hw_state;
+
+ intel_dig_port->port = port;
+- intel_dig_port->port_reversal = I915_READ(DDI_BUF_CTL(port)) &
+- DDI_BUF_PORT_REVERSAL;
++ intel_dig_port->saved_port_bits = I915_READ(DDI_BUF_CTL(port)) &
++ (DDI_BUF_PORT_REVERSAL |
++ DDI_A_4_LANES);
+ if (hdmi_connector)
+ intel_dig_port->hdmi.hdmi_reg = DDI_BUF_CTL(port);
+ intel_dig_port->dp.output_reg = DDI_BUF_CTL(port);
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index e1f4e6e..eea5982 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4333,7 +4333,8 @@ static void vlv_update_pll(struct intel_crtc *crtc)
+
+ static void i9xx_update_pll(struct intel_crtc *crtc,
+ intel_clock_t *reduced_clock,
+- int num_connectors)
++ int num_connectors,
++ bool needs_tv_clock)
+ {
+ struct drm_device *dev = crtc->base.dev;
+ struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -4391,7 +4392,7 @@ static void i9xx_update_pll(struct intel_crtc *crtc,
+ if (INTEL_INFO(dev)->gen >= 4)
+ dpll |= (6 << PLL_LOAD_PULSE_PHASE_SHIFT);
+
+- if (is_sdvo && intel_pipe_has_type(&crtc->base, INTEL_OUTPUT_TVOUT))
++ if (is_sdvo && needs_tv_clock)
+ dpll |= PLL_REF_INPUT_TVCLKINBC;
+ else if (intel_pipe_has_type(&crtc->base, INTEL_OUTPUT_TVOUT))
+ /* XXX: just matching BIOS for now */
+@@ -4716,7 +4717,8 @@ static int i9xx_crtc_mode_set(struct drm_crtc *crtc,
+ else
+ i9xx_update_pll(intel_crtc,
+ has_reduced_clock ? &reduced_clock : NULL,
+- num_connectors);
++ num_connectors,
++ is_sdvo && is_tv);
+
+ /* Set up the display plane register */
+ dspcntr = DISPPLANE_GAMMA_ENABLE;
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index 624a9e6..7cd5584 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -426,7 +426,7 @@ struct intel_dp {
+ struct intel_digital_port {
+ struct intel_encoder base;
+ enum port port;
+- u32 port_reversal;
++ u32 saved_port_bits;
+ struct intel_dp dp;
+ struct intel_hdmi hdmi;
+ };
+diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
+index f4dcfdd..aad18e6 100644
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -1145,6 +1145,8 @@ struct radeon_uvd {
+ struct radeon_bo *vcpu_bo;
+ void *cpu_addr;
+ uint64_t gpu_addr;
++ void *saved_bo;
++ unsigned fw_size;
+ atomic_t handles[RADEON_MAX_UVD_HANDLES];
+ struct drm_file *filp[RADEON_MAX_UVD_HANDLES];
+ struct delayed_work idle_work;
+@@ -1684,7 +1686,6 @@ struct radeon_device {
+ const struct firmware *rlc_fw; /* r6/700 RLC firmware */
+ const struct firmware *mc_fw; /* NI MC firmware */
+ const struct firmware *ce_fw; /* SI CE firmware */
+- const struct firmware *uvd_fw; /* UVD firmware */
+ struct r600_blit r600_blit;
+ struct r600_vram_scratch vram_scratch;
+ int msi_enabled; /* msi enabled */
+diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
+index a2802b47..de36c47 100644
+--- a/drivers/gpu/drm/radeon/radeon_asic.c
++++ b/drivers/gpu/drm/radeon/radeon_asic.c
+@@ -986,8 +986,8 @@ static struct radeon_asic r600_asic = {
+ .blit_ring_index = RADEON_RING_TYPE_GFX_INDEX,
+ .dma = &r600_copy_dma,
+ .dma_ring_index = R600_RING_TYPE_DMA_INDEX,
+- .copy = &r600_copy_dma,
+- .copy_ring_index = R600_RING_TYPE_DMA_INDEX,
++ .copy = &r600_copy_blit,
++ .copy_ring_index = RADEON_RING_TYPE_GFX_INDEX,
+ },
+ .surface = {
+ .set_reg = r600_set_surface_reg,
+@@ -1074,8 +1074,8 @@ static struct radeon_asic rs780_asic = {
+ .blit_ring_index = RADEON_RING_TYPE_GFX_INDEX,
+ .dma = &r600_copy_dma,
+ .dma_ring_index = R600_RING_TYPE_DMA_INDEX,
+- .copy = &r600_copy_dma,
+- .copy_ring_index = R600_RING_TYPE_DMA_INDEX,
++ .copy = &r600_copy_blit,
++ .copy_ring_index = RADEON_RING_TYPE_GFX_INDEX,
+ },
+ .surface = {
+ .set_reg = r600_set_surface_reg,
+diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
+index ddb8f8e..7ddb0ef 100644
+--- a/drivers/gpu/drm/radeon/radeon_fence.c
++++ b/drivers/gpu/drm/radeon/radeon_fence.c
+@@ -782,7 +782,7 @@ int radeon_fence_driver_start_ring(struct radeon_device *rdev, int ring)
+
+ } else {
+ /* put fence directly behind firmware */
+- index = ALIGN(rdev->uvd_fw->size, 8);
++ index = ALIGN(rdev->uvd.fw_size, 8);
+ rdev->fence_drv[ring].cpu_addr = rdev->uvd.cpu_addr + index;
+ rdev->fence_drv[ring].gpu_addr = rdev->uvd.gpu_addr + index;
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
+index cad735d..1b3a91b 100644
+--- a/drivers/gpu/drm/radeon/radeon_uvd.c
++++ b/drivers/gpu/drm/radeon/radeon_uvd.c
+@@ -55,6 +55,7 @@ static void radeon_uvd_idle_work_handler(struct work_struct *work);
+ int radeon_uvd_init(struct radeon_device *rdev)
+ {
+ struct platform_device *pdev;
++ const struct firmware *fw;
+ unsigned long bo_size;
+ const char *fw_name;
+ int i, r;
+@@ -104,7 +105,7 @@ int radeon_uvd_init(struct radeon_device *rdev)
+ return -EINVAL;
+ }
+
+- r = request_firmware(&rdev->uvd_fw, fw_name, &pdev->dev);
++ r = request_firmware(&fw, fw_name, &pdev->dev);
+ if (r) {
+ dev_err(rdev->dev, "radeon_uvd: Can't load firmware \"%s\"\n",
+ fw_name);
+@@ -114,7 +115,7 @@ int radeon_uvd_init(struct radeon_device *rdev)
+
+ platform_device_unregister(pdev);
+
+- bo_size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 8) +
++ bo_size = RADEON_GPU_PAGE_ALIGN(fw->size + 8) +
+ RADEON_UVD_STACK_SIZE + RADEON_UVD_HEAP_SIZE;
+ r = radeon_bo_create(rdev, bo_size, PAGE_SIZE, true,
+ RADEON_GEM_DOMAIN_VRAM, NULL, &rdev->uvd.vcpu_bo);
+@@ -123,16 +124,35 @@ int radeon_uvd_init(struct radeon_device *rdev)
+ return r;
+ }
+
+- r = radeon_uvd_resume(rdev);
+- if (r)
++ r = radeon_bo_reserve(rdev->uvd.vcpu_bo, false);
++ if (r) {
++ radeon_bo_unref(&rdev->uvd.vcpu_bo);
++ dev_err(rdev->dev, "(%d) failed to reserve UVD bo\n", r);
+ return r;
++ }
+
+- memset(rdev->uvd.cpu_addr, 0, bo_size);
+- memcpy(rdev->uvd.cpu_addr, rdev->uvd_fw->data, rdev->uvd_fw->size);
++ r = radeon_bo_pin(rdev->uvd.vcpu_bo, RADEON_GEM_DOMAIN_VRAM,
++ &rdev->uvd.gpu_addr);
++ if (r) {
++ radeon_bo_unreserve(rdev->uvd.vcpu_bo);
++ radeon_bo_unref(&rdev->uvd.vcpu_bo);
++ dev_err(rdev->dev, "(%d) UVD bo pin failed\n", r);
++ return r;
++ }
+
+- r = radeon_uvd_suspend(rdev);
+- if (r)
++ r = radeon_bo_kmap(rdev->uvd.vcpu_bo, &rdev->uvd.cpu_addr);
++ if (r) {
++ dev_err(rdev->dev, "(%d) UVD map failed\n", r);
+ return r;
++ }
++
++ radeon_bo_unreserve(rdev->uvd.vcpu_bo);
++
++ rdev->uvd.fw_size = fw->size;
++ memset(rdev->uvd.cpu_addr, 0, bo_size);
++ memcpy(rdev->uvd.cpu_addr, fw->data, fw->size);
++
++ release_firmware(fw);
+
+ for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
+ atomic_set(&rdev->uvd.handles[i], 0);
+@@ -144,71 +164,47 @@ int radeon_uvd_init(struct radeon_device *rdev)
+
+ void radeon_uvd_fini(struct radeon_device *rdev)
+ {
+- radeon_uvd_suspend(rdev);
+- radeon_bo_unref(&rdev->uvd.vcpu_bo);
+-}
+-
+-int radeon_uvd_suspend(struct radeon_device *rdev)
+-{
+ int r;
+
+ if (rdev->uvd.vcpu_bo == NULL)
+- return 0;
++ return;
+
+ r = radeon_bo_reserve(rdev->uvd.vcpu_bo, false);
+ if (!r) {
+ radeon_bo_kunmap(rdev->uvd.vcpu_bo);
+ radeon_bo_unpin(rdev->uvd.vcpu_bo);
+- rdev->uvd.cpu_addr = NULL;
+- if (!radeon_bo_pin(rdev->uvd.vcpu_bo, RADEON_GEM_DOMAIN_CPU, NULL)) {
+- radeon_bo_kmap(rdev->uvd.vcpu_bo, &rdev->uvd.cpu_addr);
+- }
+ radeon_bo_unreserve(rdev->uvd.vcpu_bo);
+-
+- if (rdev->uvd.cpu_addr) {
+- radeon_fence_driver_start_ring(rdev, R600_RING_TYPE_UVD_INDEX);
+- } else {
+- rdev->fence_drv[R600_RING_TYPE_UVD_INDEX].cpu_addr = NULL;
+- }
+ }
+- return r;
++
++ radeon_bo_unref(&rdev->uvd.vcpu_bo);
+ }
+
+-int radeon_uvd_resume(struct radeon_device *rdev)
++int radeon_uvd_suspend(struct radeon_device *rdev)
+ {
+- int r;
++ unsigned size;
+
+ if (rdev->uvd.vcpu_bo == NULL)
+- return -EINVAL;
++ return 0;
+
+- r = radeon_bo_reserve(rdev->uvd.vcpu_bo, false);
+- if (r) {
+- radeon_bo_unref(&rdev->uvd.vcpu_bo);
+- dev_err(rdev->dev, "(%d) failed to reserve UVD bo\n", r);
+- return r;
+- }
++ size = radeon_bo_size(rdev->uvd.vcpu_bo);
++ rdev->uvd.saved_bo = kmalloc(size, GFP_KERNEL);
++ memcpy(rdev->uvd.saved_bo, rdev->uvd.cpu_addr, size);
+
+- /* Have been pin in cpu unmap unpin */
+- radeon_bo_kunmap(rdev->uvd.vcpu_bo);
+- radeon_bo_unpin(rdev->uvd.vcpu_bo);
++ return 0;
++}
+
+- r = radeon_bo_pin(rdev->uvd.vcpu_bo, RADEON_GEM_DOMAIN_VRAM,
+- &rdev->uvd.gpu_addr);
+- if (r) {
+- radeon_bo_unreserve(rdev->uvd.vcpu_bo);
+- radeon_bo_unref(&rdev->uvd.vcpu_bo);
+- dev_err(rdev->dev, "(%d) UVD bo pin failed\n", r);
+- return r;
+- }
++int radeon_uvd_resume(struct radeon_device *rdev)
++{
++ if (rdev->uvd.vcpu_bo == NULL)
++ return -EINVAL;
+
+- r = radeon_bo_kmap(rdev->uvd.vcpu_bo, &rdev->uvd.cpu_addr);
+- if (r) {
+- dev_err(rdev->dev, "(%d) UVD map failed\n", r);
+- return r;
++ if (rdev->uvd.saved_bo != NULL) {
++ unsigned size = radeon_bo_size(rdev->uvd.vcpu_bo);
++ memcpy(rdev->uvd.cpu_addr, rdev->uvd.saved_bo, size);
++ kfree(rdev->uvd.saved_bo);
++ rdev->uvd.saved_bo = NULL;
+ }
+
+- radeon_bo_unreserve(rdev->uvd.vcpu_bo);
+-
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
+index 4a62ad2..30ea14e 100644
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -813,7 +813,7 @@ int rv770_uvd_resume(struct radeon_device *rdev)
+
+ /* programm the VCPU memory controller bits 0-27 */
+ addr = rdev->uvd.gpu_addr >> 3;
+- size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 4) >> 3;
++ size = RADEON_GPU_PAGE_ALIGN(rdev->uvd.fw_size + 4) >> 3;
+ WREG32(UVD_VCPU_CACHE_OFFSET0, addr);
+ WREG32(UVD_VCPU_CACHE_SIZE0, size);
+
+diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c
+index 328fb03..a41b5f3 100644
+--- a/drivers/hwmon/max6697.c
++++ b/drivers/hwmon/max6697.c
+@@ -605,12 +605,12 @@ static int max6697_init_chip(struct i2c_client *client)
+ if (ret < 0)
+ return ret;
+ ret = i2c_smbus_write_byte_data(client, MAX6581_REG_IDEALITY,
+- pdata->ideality_mask >> 1);
++ pdata->ideality_value);
+ if (ret < 0)
+ return ret;
+ ret = i2c_smbus_write_byte_data(client,
+ MAX6581_REG_IDEALITY_SELECT,
+- pdata->ideality_value);
++ pdata->ideality_mask >> 1);
+ if (ret < 0)
+ return ret;
+ }
+diff --git a/drivers/macintosh/windfarm_rm31.c b/drivers/macintosh/windfarm_rm31.c
+index 0b9a79b..82fc86a 100644
+--- a/drivers/macintosh/windfarm_rm31.c
++++ b/drivers/macintosh/windfarm_rm31.c
+@@ -439,15 +439,15 @@ static void backside_setup_pid(void)
+
+ /* Slots fan */
+ static const struct wf_pid_param slots_param = {
+- .interval = 5,
+- .history_len = 2,
+- .gd = 30 << 20,
+- .gp = 5 << 20,
+- .gr = 0,
+- .itarget = 40 << 16,
+- .additive = 1,
+- .min = 300,
+- .max = 4000,
++ .interval = 1,
++ .history_len = 20,
++ .gd = 0,
++ .gp = 0,
++ .gr = 0x00100000,
++ .itarget = 3200000,
++ .additive = 0,
++ .min = 20,
++ .max = 100,
+ };
+
+ static void slots_fan_tick(void)
+diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
+index a746ba2..a956053 100644
+--- a/drivers/net/arcnet/arcnet.c
++++ b/drivers/net/arcnet/arcnet.c
+@@ -1007,7 +1007,7 @@ static void arcnet_rx(struct net_device *dev, int bufnum)
+
+ soft = &pkt.soft.rfc1201;
+
+- lp->hw.copy_from_card(dev, bufnum, 0, &pkt, sizeof(ARC_HDR_SIZE));
++ lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE);
+ if (pkt.hard.offset[0]) {
+ ofs = pkt.hard.offset[0];
+ length = 256 - ofs;
+diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c.h b/drivers/net/ethernet/atheros/atl1c/atl1c.h
+index b2bf324..0f05565 100644
+--- a/drivers/net/ethernet/atheros/atl1c/atl1c.h
++++ b/drivers/net/ethernet/atheros/atl1c/atl1c.h
+@@ -520,6 +520,9 @@ struct atl1c_adapter {
+ struct net_device *netdev;
+ struct pci_dev *pdev;
+ struct napi_struct napi;
++ struct page *rx_page;
++ unsigned int rx_page_offset;
++ unsigned int rx_frag_size;
+ struct atl1c_hw hw;
+ struct atl1c_hw_stats hw_stats;
+ struct mii_if_info mii; /* MII interface info */
+diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+index 0ba9007..11cdf1d 100644
+--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
++++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+@@ -481,10 +481,15 @@ static int atl1c_set_mac_addr(struct net_device *netdev, void *p)
+ static void atl1c_set_rxbufsize(struct atl1c_adapter *adapter,
+ struct net_device *dev)
+ {
++ unsigned int head_size;
+ int mtu = dev->mtu;
+
+ adapter->rx_buffer_len = mtu > AT_RX_BUF_SIZE ?
+ roundup(mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN, 8) : AT_RX_BUF_SIZE;
++
++ head_size = SKB_DATA_ALIGN(adapter->rx_buffer_len + NET_SKB_PAD) +
++ SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
++ adapter->rx_frag_size = roundup_pow_of_two(head_size);
+ }
+
+ static netdev_features_t atl1c_fix_features(struct net_device *netdev,
+@@ -952,6 +957,10 @@ static void atl1c_free_ring_resources(struct atl1c_adapter *adapter)
+ kfree(adapter->tpd_ring[0].buffer_info);
+ adapter->tpd_ring[0].buffer_info = NULL;
+ }
++ if (adapter->rx_page) {
++ put_page(adapter->rx_page);
++ adapter->rx_page = NULL;
++ }
+ }
+
+ /**
+@@ -1639,6 +1648,35 @@ static inline void atl1c_rx_checksum(struct atl1c_adapter *adapter,
+ skb_checksum_none_assert(skb);
+ }
+
++static struct sk_buff *atl1c_alloc_skb(struct atl1c_adapter *adapter)
++{
++ struct sk_buff *skb;
++ struct page *page;
++
++ if (adapter->rx_frag_size > PAGE_SIZE)
++ return netdev_alloc_skb(adapter->netdev,
++ adapter->rx_buffer_len);
++
++ page = adapter->rx_page;
++ if (!page) {
++ adapter->rx_page = page = alloc_page(GFP_ATOMIC);
++ if (unlikely(!page))
++ return NULL;
++ adapter->rx_page_offset = 0;
++ }
++
++ skb = build_skb(page_address(page) + adapter->rx_page_offset,
++ adapter->rx_frag_size);
++ if (likely(skb)) {
++ adapter->rx_page_offset += adapter->rx_frag_size;
++ if (adapter->rx_page_offset >= PAGE_SIZE)
++ adapter->rx_page = NULL;
++ else
++ get_page(page);
++ }
++ return skb;
++}
++
+ static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
+ {
+ struct atl1c_rfd_ring *rfd_ring = &adapter->rfd_ring;
+@@ -1660,7 +1698,7 @@ static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
+ while (next_info->flags & ATL1C_BUFFER_FREE) {
+ rfd_desc = ATL1C_RFD_DESC(rfd_ring, rfd_next_to_use);
+
+- skb = netdev_alloc_skb(adapter->netdev, adapter->rx_buffer_len);
++ skb = atl1c_alloc_skb(adapter);
+ if (unlikely(!skb)) {
+ if (netif_msg_rx_err(adapter))
+ dev_warn(&pdev->dev, "alloc rx buffer failed\n");
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
+index ac78077..7a77f37 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
+@@ -108,9 +108,8 @@ s32 ixgbe_dcb_config_tx_desc_arbiter_82598(struct ixgbe_hw *hw,
+
+ /* Enable arbiter */
+ reg &= ~IXGBE_DPMCS_ARBDIS;
+- /* Enable DFP and Recycle mode */
+- reg |= (IXGBE_DPMCS_TDPAC | IXGBE_DPMCS_TRM);
+ reg |= IXGBE_DPMCS_TSOEF;
++
+ /* Configure Max TSO packet size 34KB including payload and headers */
+ reg |= (0x4 << IXGBE_DPMCS_MTSOS_SHIFT);
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
+index 2c97901..593177d 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
+@@ -840,16 +840,7 @@ int mlx4_QUERY_PORT_wrapper(struct mlx4_dev *dev, int slave,
+ MLX4_CMD_NATIVE);
+
+ if (!err && dev->caps.function != slave) {
+- /* if config MAC in DB use it */
+- if (priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac)
+- def_mac = priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac;
+- else {
+- /* set slave default_mac address */
+- MLX4_GET(def_mac, outbox->buf, QUERY_PORT_MAC_OFFSET);
+- def_mac += slave << 8;
+- priv->mfunc.master.vf_admin[slave].vport[vhcr->in_modifier].mac = def_mac;
+- }
+-
++ def_mac = priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac;
+ MLX4_PUT(outbox->buf, def_mac, QUERY_PORT_MAC_OFFSET);
+
+ /* get port type - currently only eth is enabled */
+diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
+index 8a43499..1b195fc 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -371,7 +371,7 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
+
+ dev->caps.sqp_demux = (mlx4_is_master(dev)) ? MLX4_MAX_NUM_SLAVES : 0;
+
+- if (!enable_64b_cqe_eqe) {
++ if (!enable_64b_cqe_eqe && !mlx4_is_slave(dev)) {
+ if (dev_cap->flags &
+ (MLX4_DEV_CAP_FLAG_64B_CQE | MLX4_DEV_CAP_FLAG_64B_EQE)) {
+ mlx4_warn(dev, "64B EQEs/CQEs supported by the device but not enabled\n");
+diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
+index 0352345..887aebe 100644
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -478,7 +478,7 @@ rx_status_loop:
+
+ while (1) {
+ u32 status, len;
+- dma_addr_t mapping;
++ dma_addr_t mapping, new_mapping;
+ struct sk_buff *skb, *new_skb;
+ struct cp_desc *desc;
+ const unsigned buflen = cp->rx_buf_sz;
+@@ -520,6 +520,13 @@ rx_status_loop:
+ goto rx_next;
+ }
+
++ new_mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
++ PCI_DMA_FROMDEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, new_mapping)) {
++ dev->stats.rx_dropped++;
++ goto rx_next;
++ }
++
+ dma_unmap_single(&cp->pdev->dev, mapping,
+ buflen, PCI_DMA_FROMDEVICE);
+
+@@ -531,12 +538,11 @@ rx_status_loop:
+
+ skb_put(skb, len);
+
+- mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
+- PCI_DMA_FROMDEVICE);
+ cp->rx_skb[rx_tail] = new_skb;
+
+ cp_rx_skb(cp, skb, desc);
+ rx++;
++ mapping = new_mapping;
+
+ rx_next:
+ cp->rx_ring[rx_tail].opts2 = 0;
+@@ -716,6 +722,22 @@ static inline u32 cp_tx_vlan_tag(struct sk_buff *skb)
+ TxVlanTag | swab16(vlan_tx_tag_get(skb)) : 0x00;
+ }
+
++static void unwind_tx_frag_mapping(struct cp_private *cp, struct sk_buff *skb,
++ int first, int entry_last)
++{
++ int frag, index;
++ struct cp_desc *txd;
++ skb_frag_t *this_frag;
++ for (frag = 0; frag+first < entry_last; frag++) {
++ index = first+frag;
++ cp->tx_skb[index] = NULL;
++ txd = &cp->tx_ring[index];
++ this_frag = &skb_shinfo(skb)->frags[frag];
++ dma_unmap_single(&cp->pdev->dev, le64_to_cpu(txd->addr),
++ skb_frag_size(this_frag), PCI_DMA_TODEVICE);
++ }
++}
++
+ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ struct net_device *dev)
+ {
+@@ -749,6 +771,9 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+
+ len = skb->len;
+ mapping = dma_map_single(&cp->pdev->dev, skb->data, len, PCI_DMA_TODEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, mapping))
++ goto out_dma_error;
++
+ txd->opts2 = opts2;
+ txd->addr = cpu_to_le64(mapping);
+ wmb();
+@@ -786,6 +811,9 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ first_len = skb_headlen(skb);
+ first_mapping = dma_map_single(&cp->pdev->dev, skb->data,
+ first_len, PCI_DMA_TODEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, first_mapping))
++ goto out_dma_error;
++
+ cp->tx_skb[entry] = skb;
+ entry = NEXT_TX(entry);
+
+@@ -799,6 +827,11 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ mapping = dma_map_single(&cp->pdev->dev,
+ skb_frag_address(this_frag),
+ len, PCI_DMA_TODEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, mapping)) {
++ unwind_tx_frag_mapping(cp, skb, first_entry, entry);
++ goto out_dma_error;
++ }
++
+ eor = (entry == (CP_TX_RING_SIZE - 1)) ? RingEnd : 0;
+
+ ctrl = eor | len | DescOwn;
+@@ -859,11 +892,16 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ if (TX_BUFFS_AVAIL(cp) <= (MAX_SKB_FRAGS + 1))
+ netif_stop_queue(dev);
+
++out_unlock:
+ spin_unlock_irqrestore(&cp->lock, intr_flags);
+
+ cpw8(TxPoll, NormalTxPoll);
+
+ return NETDEV_TX_OK;
++out_dma_error:
++ kfree_skb(skb);
++ cp->dev->stats.tx_dropped++;
++ goto out_unlock;
+ }
+
+ /* Set or clear the multicast filter for this adaptor.
+@@ -1054,6 +1092,10 @@ static int cp_refill_rx(struct cp_private *cp)
+
+ mapping = dma_map_single(&cp->pdev->dev, skb->data,
+ cp->rx_buf_sz, PCI_DMA_FROMDEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, mapping)) {
++ kfree_skb(skb);
++ goto err_out;
++ }
+ cp->rx_skb[i] = skb;
+
+ cp->rx_ring[i].opts2 = 0;
+diff --git a/drivers/net/ethernet/sfc/filter.c b/drivers/net/ethernet/sfc/filter.c
+index 2397f0e..2738b5f 100644
+--- a/drivers/net/ethernet/sfc/filter.c
++++ b/drivers/net/ethernet/sfc/filter.c
+@@ -1196,7 +1196,9 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
+ EFX_BUG_ON_PARANOID(skb_headlen(skb) < nhoff + 4 * ip->ihl + 4);
+ ports = (const __be16 *)(skb->data + nhoff + 4 * ip->ihl);
+
+- efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT, 0, rxq_index);
++ efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT,
++ efx->rx_scatter ? EFX_FILTER_FLAG_RX_SCATTER : 0,
++ rxq_index);
+ rc = efx_filter_set_ipv4_full(&spec, ip->protocol,
+ ip->daddr, ports[1], ip->saddr, ports[0]);
+ if (rc)
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index bd8758f..cea1f3d 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1029,10 +1029,10 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
+ dev->mii.supports_gmii = 1;
+
+ dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+- NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
++ NETIF_F_RXCSUM;
+
+ dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+- NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
++ NETIF_F_RXCSUM;
+
+ /* Enable checksum offload */
+ *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+@@ -1173,7 +1173,6 @@ ax88179_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
+ if (((skb->len + 8) % frame_size) == 0)
+ tx_hdr2 |= 0x80008000; /* Enable padding */
+
+- skb_linearize(skb);
+ headroom = skb_headroom(skb);
+ tailroom = skb_tailroom(skb);
+
+@@ -1317,10 +1316,10 @@ static int ax88179_reset(struct usbnet *dev)
+ 1, 1, tmp);
+
+ dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+- NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
++ NETIF_F_RXCSUM;
+
+ dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+- NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
++ NETIF_F_RXCSUM;
+
+ /* Enable checksum offload */
+ *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index 7540974..66ebbac 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -45,7 +45,6 @@
+ #define EEPROM_MAC_OFFSET (0x01)
+ #define DEFAULT_TX_CSUM_ENABLE (true)
+ #define DEFAULT_RX_CSUM_ENABLE (true)
+-#define DEFAULT_TSO_ENABLE (true)
+ #define SMSC75XX_INTERNAL_PHY_ID (1)
+ #define SMSC75XX_TX_OVERHEAD (8)
+ #define MAX_RX_FIFO_SIZE (20 * 1024)
+@@ -1410,17 +1409,14 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
+
+ INIT_WORK(&pdata->set_multicast, smsc75xx_deferred_multicast_write);
+
+- if (DEFAULT_TX_CSUM_ENABLE) {
++ if (DEFAULT_TX_CSUM_ENABLE)
+ dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+- if (DEFAULT_TSO_ENABLE)
+- dev->net->features |= NETIF_F_SG |
+- NETIF_F_TSO | NETIF_F_TSO6;
+- }
++
+ if (DEFAULT_RX_CSUM_ENABLE)
+ dev->net->features |= NETIF_F_RXCSUM;
+
+ dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+- NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_RXCSUM;
++ NETIF_F_RXCSUM;
+
+ ret = smsc75xx_wait_ready(dev, 0);
+ if (ret < 0) {
+@@ -2200,8 +2196,6 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
+ {
+ u32 tx_cmd_a, tx_cmd_b;
+
+- skb_linearize(skb);
+-
+ if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
+ struct sk_buff *skb2 =
+ skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index f5dda84..75a6376 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -1289,7 +1289,9 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
+
+ usb_set_intfdata(interface, NULL);
+
+- if (!unplugged && (hif_dev->flags & HIF_USB_START))
++ /* If firmware was loaded we should drop it
++ * go back to first stage bootloader. */
++ if (!unplugged && (hif_dev->flags & HIF_USB_READY))
+ ath9k_hif_usb_reboot(udev);
+
+ kfree(hif_dev);
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index a47f5e0..3b202ff 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -846,6 +846,7 @@ static int ath9k_init_device(struct ath9k_htc_priv *priv,
+ if (error != 0)
+ goto err_rx;
+
++ ath9k_hw_disable(priv->ah);
+ #ifdef CONFIG_MAC80211_LEDS
+ /* must be initialized before ieee80211_register_hw */
+ priv->led_cdev.default_trigger = ieee80211_create_tpt_led_trigger(priv->hw,
+diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
+index 727b1f5..d57e5be 100644
+--- a/drivers/net/wireless/ath/wil6210/debugfs.c
++++ b/drivers/net/wireless/ath/wil6210/debugfs.c
+@@ -145,7 +145,7 @@ static void wil_print_ring(struct seq_file *s, const char *prefix,
+ le16_to_cpu(hdr.type), hdr.flags);
+ if (len <= MAX_MBOXITEM_SIZE) {
+ int n = 0;
+- unsigned char printbuf[16 * 3 + 2];
++ char printbuf[16 * 3 + 2];
+ unsigned char databuf[MAX_MBOXITEM_SIZE];
+ void __iomem *src = wmi_buffer(wil, d.addr) +
+ sizeof(struct wil6210_mbox_hdr);
+@@ -416,7 +416,7 @@ static int wil_txdesc_debugfs_show(struct seq_file *s, void *data)
+ seq_printf(s, " SKB = %p\n", skb);
+
+ if (skb) {
+- unsigned char printbuf[16 * 3 + 2];
++ char printbuf[16 * 3 + 2];
+ int i = 0;
+ int len = skb_headlen(skb);
+ void *p = skb->data;
+diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
+index 74d7572..a8afc7b 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/main.c
++++ b/drivers/net/wireless/iwlwifi/dvm/main.c
+@@ -758,7 +758,7 @@ int iwl_alive_start(struct iwl_priv *priv)
+ BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
+ if (ret)
+ return ret;
+- } else {
++ } else if (priv->cfg->bt_params) {
+ /*
+ * default is 2-wire BT coexexistence support
+ */
+diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+index b60d141..365095a 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
++++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+@@ -69,7 +69,6 @@
+ /* Scan Commands, Responses, Notifications */
+
+ /* Masks for iwl_scan_channel.type flags */
+-#define SCAN_CHANNEL_TYPE_PASSIVE 0
+ #define SCAN_CHANNEL_TYPE_ACTIVE BIT(0)
+ #define SCAN_CHANNEL_NARROW_BAND BIT(22)
+
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index a5eb8c8..b7e95b0 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -987,6 +987,21 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
+ mutex_lock(&mvm->mutex);
+ if (old_state == IEEE80211_STA_NOTEXIST &&
+ new_state == IEEE80211_STA_NONE) {
++ /*
++ * Firmware bug - it'll crash if the beacon interval is less
++ * than 16. We can't avoid connecting at all, so refuse the
++ * station state change, this will cause mac80211 to abandon
++ * attempts to connect to this AP, and eventually wpa_s will
++ * blacklist the AP...
++ */
++ if (vif->type == NL80211_IFTYPE_STATION &&
++ vif->bss_conf.beacon_int < 16) {
++ IWL_ERR(mvm,
++ "AP %pM beacon interval is %d, refusing due to firmware bug!\n",
++ sta->addr, vif->bss_conf.beacon_int);
++ ret = -EINVAL;
++ goto out_unlock;
++ }
+ ret = iwl_mvm_add_sta(mvm, vif, sta);
+ } else if (old_state == IEEE80211_STA_NONE &&
+ new_state == IEEE80211_STA_AUTH) {
+@@ -1015,6 +1030,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
+ } else {
+ ret = -EIO;
+ }
++ out_unlock:
+ mutex_unlock(&mvm->mutex);
+
+ return ret;
+diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
+index 2476e43..8e1f6c0 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
++++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
+@@ -137,8 +137,8 @@ static void iwl_mvm_scan_fill_ssids(struct iwl_scan_cmd *cmd,
+ {
+ int fw_idx, req_idx;
+
+- fw_idx = 0;
+- for (req_idx = req->n_ssids - 1; req_idx > 0; req_idx--) {
++ for (req_idx = req->n_ssids - 1, fw_idx = 0; req_idx > 0;
++ req_idx--, fw_idx++) {
+ cmd->direct_scan[fw_idx].id = WLAN_EID_SSID;
+ cmd->direct_scan[fw_idx].len = req->ssids[req_idx].ssid_len;
+ memcpy(cmd->direct_scan[fw_idx].ssid,
+@@ -176,19 +176,12 @@ static void iwl_mvm_scan_fill_channels(struct iwl_scan_cmd *cmd,
+ struct iwl_scan_channel *chan = (struct iwl_scan_channel *)
+ (cmd->data + le16_to_cpu(cmd->tx_cmd.len));
+ int i;
+- __le32 chan_type_value;
+-
+- if (req->n_ssids > 0)
+- chan_type_value = cpu_to_le32(BIT(req->n_ssids + 1) - 1);
+- else
+- chan_type_value = SCAN_CHANNEL_TYPE_PASSIVE;
+
+ for (i = 0; i < cmd->channel_count; i++) {
+ chan->channel = cpu_to_le16(req->channels[i]->hw_value);
++ chan->type = cpu_to_le32(BIT(req->n_ssids) - 1);
+ if (req->channels[i]->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+- chan->type = SCAN_CHANNEL_TYPE_PASSIVE;
+- else
+- chan->type = chan_type_value;
++ chan->type &= cpu_to_le32(~SCAN_CHANNEL_TYPE_ACTIVE);
+ chan->active_dwell = cpu_to_le16(active_dwell);
+ chan->passive_dwell = cpu_to_le16(passive_dwell);
+ chan->iteration_count = cpu_to_le16(1);
+diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
+index 5c664ed..736b50b 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
+@@ -621,8 +621,12 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ cmd.mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color);
+ cmd.sta_id = mvm_sta->sta_id;
+ cmd.add_modify = STA_MODE_MODIFY;
+- cmd.add_immediate_ba_tid = (u8) tid;
+- cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
++ if (start) {
++ cmd.add_immediate_ba_tid = (u8) tid;
++ cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
++ } else {
++ cmd.remove_immediate_ba_tid = (u8) tid;
++ }
+ cmd.modify_mask = start ? STA_MODIFY_ADD_BA_TID :
+ STA_MODIFY_REMOVE_BA_TID;
+
+@@ -894,6 +898,7 @@ int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
+ struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
+ u16 txq_id;
++ enum iwl_mvm_agg_state old_state;
+
+ /*
+ * First set the agg state to OFF to avoid calling
+@@ -903,13 +908,17 @@ int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ txq_id = tid_data->txq_id;
+ IWL_DEBUG_TX_QUEUES(mvm, "Flush AGG: sta %d tid %d q %d state %d\n",
+ mvmsta->sta_id, tid, txq_id, tid_data->state);
++ old_state = tid_data->state;
+ tid_data->state = IWL_AGG_OFF;
+ spin_unlock_bh(&mvmsta->lock);
+
+- if (iwl_mvm_flush_tx_path(mvm, BIT(txq_id), true))
+- IWL_ERR(mvm, "Couldn't flush the AGG queue\n");
++ if (old_state >= IWL_AGG_ON) {
++ if (iwl_mvm_flush_tx_path(mvm, BIT(txq_id), true))
++ IWL_ERR(mvm, "Couldn't flush the AGG queue\n");
++
++ iwl_trans_txq_disable(mvm->trans, tid_data->txq_id);
++ }
+
+- iwl_trans_txq_disable(mvm->trans, tid_data->txq_id);
+ mvm->queue_to_mac80211[tid_data->txq_id] =
+ IWL_INVALID_MAC80211_QUEUE;
+
+diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
+index 8cb53ec..5283b55 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
+@@ -129,6 +129,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
+ {IWL_PCI_DEVICE(0x423C, 0x1306, iwl5150_abg_cfg)}, /* Half Mini Card */
+ {IWL_PCI_DEVICE(0x423C, 0x1221, iwl5150_agn_cfg)}, /* Mini Card */
+ {IWL_PCI_DEVICE(0x423C, 0x1321, iwl5150_agn_cfg)}, /* Half Mini Card */
++ {IWL_PCI_DEVICE(0x423C, 0x1326, iwl5150_abg_cfg)}, /* Half Mini Card */
+
+ {IWL_PCI_DEVICE(0x423D, 0x1211, iwl5150_agn_cfg)}, /* Mini Card */
+ {IWL_PCI_DEVICE(0x423D, 0x1311, iwl5150_agn_cfg)}, /* Half Mini Card */
+diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
+index e42b266..e7f7cdf 100644
+--- a/drivers/net/wireless/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/mwifiex/cfg80211.c
+@@ -1668,9 +1668,9 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
+ struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+ int ret;
+
+- if (priv->bss_mode != NL80211_IFTYPE_STATION) {
++ if (GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA) {
+ wiphy_err(wiphy,
+- "%s: reject infra assoc request in non-STA mode\n",
++ "%s: reject infra assoc request in non-STA role\n",
+ dev->name);
+ return -EINVAL;
+ }
+diff --git a/drivers/net/wireless/mwifiex/cfp.c b/drivers/net/wireless/mwifiex/cfp.c
+index 988552d..5178c46 100644
+--- a/drivers/net/wireless/mwifiex/cfp.c
++++ b/drivers/net/wireless/mwifiex/cfp.c
+@@ -415,7 +415,8 @@ u32 mwifiex_get_supported_rates(struct mwifiex_private *priv, u8 *rates)
+ u32 k = 0;
+ struct mwifiex_adapter *adapter = priv->adapter;
+
+- if (priv->bss_mode == NL80211_IFTYPE_STATION) {
++ if (priv->bss_mode == NL80211_IFTYPE_STATION ||
++ priv->bss_mode == NL80211_IFTYPE_P2P_CLIENT) {
+ switch (adapter->config_bands) {
+ case BAND_B:
+ dev_dbg(adapter->dev, "info: infra band=%d "
+diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
+index 6bcb66e..96bda6c 100644
+--- a/drivers/net/wireless/mwifiex/join.c
++++ b/drivers/net/wireless/mwifiex/join.c
+@@ -1290,8 +1290,10 @@ int mwifiex_associate(struct mwifiex_private *priv,
+ {
+ u8 current_bssid[ETH_ALEN];
+
+- /* Return error if the adapter or table entry is not marked as infra */
+- if ((priv->bss_mode != NL80211_IFTYPE_STATION) ||
++ /* Return error if the adapter is not STA role or table entry
++ * is not marked as infra.
++ */
++ if ((GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA) ||
+ (bss_desc->bss_mode != NL80211_IFTYPE_STATION))
+ return -1;
+
+diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
+index 363ba31..139c958 100644
+--- a/drivers/net/wireless/mwifiex/sdio.c
++++ b/drivers/net/wireless/mwifiex/sdio.c
+@@ -1441,8 +1441,8 @@ static int mwifiex_sdio_host_to_card(struct mwifiex_adapter *adapter,
+ /* Allocate buffer and copy payload */
+ blk_size = MWIFIEX_SDIO_BLOCK_SIZE;
+ buf_block_len = (pkt_len + blk_size - 1) / blk_size;
+- *(u16 *) &payload[0] = (u16) pkt_len;
+- *(u16 *) &payload[2] = type;
++ *(__le16 *)&payload[0] = cpu_to_le16((u16)pkt_len);
++ *(__le16 *)&payload[2] = cpu_to_le16(type);
+
+ /*
+ * This is SDIO specific header
+diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
+index 2c12311..d955741 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
+@@ -936,13 +936,8 @@ void rt2x00queue_index_inc(struct queue_entry *entry, enum queue_index index)
+ spin_unlock_irqrestore(&queue->index_lock, irqflags);
+ }
+
+-void rt2x00queue_pause_queue(struct data_queue *queue)
++void rt2x00queue_pause_queue_nocheck(struct data_queue *queue)
+ {
+- if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
+- !test_bit(QUEUE_STARTED, &queue->flags) ||
+- test_and_set_bit(QUEUE_PAUSED, &queue->flags))
+- return;
+-
+ switch (queue->qid) {
+ case QID_AC_VO:
+ case QID_AC_VI:
+@@ -958,6 +953,15 @@ void rt2x00queue_pause_queue(struct data_queue *queue)
+ break;
+ }
+ }
++void rt2x00queue_pause_queue(struct data_queue *queue)
++{
++ if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
++ !test_bit(QUEUE_STARTED, &queue->flags) ||
++ test_and_set_bit(QUEUE_PAUSED, &queue->flags))
++ return;
++
++ rt2x00queue_pause_queue_nocheck(queue);
++}
+ EXPORT_SYMBOL_GPL(rt2x00queue_pause_queue);
+
+ void rt2x00queue_unpause_queue(struct data_queue *queue)
+@@ -1019,7 +1023,7 @@ void rt2x00queue_stop_queue(struct data_queue *queue)
+ return;
+ }
+
+- rt2x00queue_pause_queue(queue);
++ rt2x00queue_pause_queue_nocheck(queue);
+
+ queue->rt2x00dev->ops->lib->stop_queue(queue);
+
+diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
+index e79e006..9ee04b4 100644
+--- a/drivers/parisc/iosapic.c
++++ b/drivers/parisc/iosapic.c
+@@ -811,18 +811,28 @@ int iosapic_fixup_irq(void *isi_obj, struct pci_dev *pcidev)
+ return pcidev->irq;
+ }
+
+-static struct iosapic_info *first_isi = NULL;
++static struct iosapic_info *iosapic_list;
+
+ #ifdef CONFIG_64BIT
+-int iosapic_serial_irq(int num)
++int iosapic_serial_irq(struct parisc_device *dev)
+ {
+- struct iosapic_info *isi = first_isi;
+- struct irt_entry *irte = NULL; /* only used if PAT PDC */
++ struct iosapic_info *isi;
++ struct irt_entry *irte;
+ struct vector_info *vi;
+- int isi_line; /* line used by device */
++ int cnt;
++ int intin;
++
++ intin = (dev->mod_info >> 24) & 15;
+
+ /* lookup IRT entry for isi/slot/pin set */
+- irte = &irt_cell[num];
++ for (cnt = 0; cnt < irt_num_entry; cnt++) {
++ irte = &irt_cell[cnt];
++ if (COMPARE_IRTE_ADDR(irte, dev->mod0) &&
++ irte->dest_iosapic_intin == intin)
++ break;
++ }
++ if (cnt >= irt_num_entry)
++ return 0; /* no irq found, force polling */
+
+ DBG_IRT("iosapic_serial_irq(): irte %p %x %x %x %x %x %x %x %x\n",
+ irte,
+@@ -834,11 +844,17 @@ int iosapic_serial_irq(int num)
+ irte->src_seg_id,
+ irte->dest_iosapic_intin,
+ (u32) irte->dest_iosapic_addr);
+- isi_line = irte->dest_iosapic_intin;
++
++ /* search for iosapic */
++ for (isi = iosapic_list; isi; isi = isi->isi_next)
++ if (isi->isi_hpa == dev->mod0)
++ break;
++ if (!isi)
++ return 0; /* no iosapic found, force polling */
+
+ /* get vector info for this input line */
+- vi = isi->isi_vector + isi_line;
+- DBG_IRT("iosapic_serial_irq: line %d vi 0x%p\n", isi_line, vi);
++ vi = isi->isi_vector + intin;
++ DBG_IRT("iosapic_serial_irq: line %d vi 0x%p\n", iosapic_intin, vi);
+
+ /* If this IRQ line has already been setup, skip it */
+ if (vi->irte)
+@@ -941,8 +957,8 @@ void *iosapic_register(unsigned long hpa)
+ vip->irqline = (unsigned char) cnt;
+ vip->iosapic = isi;
+ }
+- if (!first_isi)
+- first_isi = isi;
++ isi->isi_next = iosapic_list;
++ iosapic_list = isi;
+ return isi;
+ }
+
+diff --git a/drivers/pci/hotplug/pciehp_pci.c b/drivers/pci/hotplug/pciehp_pci.c
+index aac7a40..0e0d0f7 100644
+--- a/drivers/pci/hotplug/pciehp_pci.c
++++ b/drivers/pci/hotplug/pciehp_pci.c
+@@ -92,7 +92,14 @@ int pciehp_unconfigure_device(struct slot *p_slot)
+ if (ret)
+ presence = 0;
+
+- list_for_each_entry_safe(dev, temp, &parent->devices, bus_list) {
++ /*
++ * Stopping an SR-IOV PF device removes all the associated VFs,
++ * which will update the bus->devices list and confuse the
++ * iterator. Therefore, iterate in reverse so we remove the VFs
++ * first, then the PF. We do the same in pci_stop_bus_device().
++ */
++ list_for_each_entry_safe_reverse(dev, temp, &parent->devices,
++ bus_list) {
+ pci_dev_get(dev);
+ if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE && presence) {
+ pci_read_config_byte(dev, PCI_BRIDGE_CONTROL, &bctl);
+diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
+index d254e23..64a7de2 100644
+--- a/drivers/pci/setup-bus.c
++++ b/drivers/pci/setup-bus.c
+@@ -300,6 +300,47 @@ static void assign_requested_resources_sorted(struct list_head *head,
+ }
+ }
+
++static unsigned long pci_fail_res_type_mask(struct list_head *fail_head)
++{
++ struct pci_dev_resource *fail_res;
++ unsigned long mask = 0;
++
++ /* check failed type */
++ list_for_each_entry(fail_res, fail_head, list)
++ mask |= fail_res->flags;
++
++ /*
++ * one pref failed resource will set IORESOURCE_MEM,
++ * as we can allocate pref in non-pref range.
++ * Will release all assigned non-pref sibling resources
++ * according to that bit.
++ */
++ return mask & (IORESOURCE_IO | IORESOURCE_MEM | IORESOURCE_PREFETCH);
++}
++
++static bool pci_need_to_release(unsigned long mask, struct resource *res)
++{
++ if (res->flags & IORESOURCE_IO)
++ return !!(mask & IORESOURCE_IO);
++
++ /* check pref at first */
++ if (res->flags & IORESOURCE_PREFETCH) {
++ if (mask & IORESOURCE_PREFETCH)
++ return true;
++ /* count pref if its parent is non-pref */
++ else if ((mask & IORESOURCE_MEM) &&
++ !(res->parent->flags & IORESOURCE_PREFETCH))
++ return true;
++ else
++ return false;
++ }
++
++ if (res->flags & IORESOURCE_MEM)
++ return !!(mask & IORESOURCE_MEM);
++
++ return false; /* should not get here */
++}
++
+ static void __assign_resources_sorted(struct list_head *head,
+ struct list_head *realloc_head,
+ struct list_head *fail_head)
+@@ -312,11 +353,24 @@ static void __assign_resources_sorted(struct list_head *head,
+ * if could do that, could get out early.
+ * if could not do that, we still try to assign requested at first,
+ * then try to reassign add_size for some resources.
++ *
++ * Separate three resource type checking if we need to release
++ * assigned resource after requested + add_size try.
++ * 1. if there is io port assign fail, will release assigned
++ * io port.
++ * 2. if there is pref mmio assign fail, release assigned
++ * pref mmio.
++ * if assigned pref mmio's parent is non-pref mmio and there
++ * is non-pref mmio assign fail, will release that assigned
++ * pref mmio.
++ * 3. if there is non-pref mmio assign fail or pref mmio
++ * assigned fail, will release assigned non-pref mmio.
+ */
+ LIST_HEAD(save_head);
+ LIST_HEAD(local_fail_head);
+ struct pci_dev_resource *save_res;
+- struct pci_dev_resource *dev_res;
++ struct pci_dev_resource *dev_res, *tmp_res;
++ unsigned long fail_type;
+
+ /* Check if optional add_size is there */
+ if (!realloc_head || list_empty(realloc_head))
+@@ -348,6 +402,19 @@ static void __assign_resources_sorted(struct list_head *head,
+ return;
+ }
+
++ /* check failed type */
++ fail_type = pci_fail_res_type_mask(&local_fail_head);
++ /* remove not need to be released assigned res from head list etc */
++ list_for_each_entry_safe(dev_res, tmp_res, head, list)
++ if (dev_res->res->parent &&
++ !pci_need_to_release(fail_type, dev_res->res)) {
++ /* remove it from realloc_head list */
++ remove_from_list(realloc_head, dev_res->res);
++ remove_from_list(&save_head, dev_res->res);
++ list_del(&dev_res->list);
++ kfree(dev_res);
++ }
++
+ free_list(&local_fail_head);
+ /* Release assigned resource */
+ list_for_each_entry(dev_res, head, list)
+diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
+index 50b13c9..df0aacc 100644
+--- a/drivers/spi/spi-davinci.c
++++ b/drivers/spi/spi-davinci.c
+@@ -610,7 +610,7 @@ static int davinci_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
+ else
+ buf = (void *)t->tx_buf;
+ t->tx_dma = dma_map_single(&spi->dev, buf,
+- t->len, DMA_FROM_DEVICE);
++ t->len, DMA_TO_DEVICE);
+ if (!t->tx_dma) {
+ ret = -EFAULT;
+ goto err_tx_map;
+diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
+index e34e3fe..1742ce5 100644
+--- a/drivers/staging/zram/zram_drv.c
++++ b/drivers/staging/zram/zram_drv.c
+@@ -272,8 +272,6 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
+
+ if (page_zero_filled(uncmem)) {
+ kunmap_atomic(user_mem);
+- if (is_partial_io(bvec))
+- kfree(uncmem);
+ zram->stats.pages_zero++;
+ zram_set_flag(meta, index, ZRAM_ZERO);
+ ret = 0;
+@@ -422,13 +420,20 @@ out:
+ */
+ static inline int valid_io_request(struct zram *zram, struct bio *bio)
+ {
+- if (unlikely(
+- (bio->bi_sector >= (zram->disksize >> SECTOR_SHIFT)) ||
+- (bio->bi_sector & (ZRAM_SECTOR_PER_LOGICAL_BLOCK - 1)) ||
+- (bio->bi_size & (ZRAM_LOGICAL_BLOCK_SIZE - 1)))) {
++ u64 start, end, bound;
+
++ /* unaligned request */
++ if (unlikely(bio->bi_sector & (ZRAM_SECTOR_PER_LOGICAL_BLOCK - 1)))
++ return 0;
++ if (unlikely(bio->bi_size & (ZRAM_LOGICAL_BLOCK_SIZE - 1)))
++ return 0;
++
++ start = bio->bi_sector;
++ end = start + (bio->bi_size >> SECTOR_SHIFT);
++ bound = zram->disksize >> SECTOR_SHIFT;
++ /* out of range range */
++ if (unlikely(start >= bound || end >= bound || start > end))
+ return 0;
+- }
+
+ /* I/O request is valid */
+ return 1;
+@@ -582,7 +587,9 @@ static void zram_slot_free_notify(struct block_device *bdev,
+ struct zram *zram;
+
+ zram = bdev->bd_disk->private_data;
++ down_write(&zram->lock);
+ zram_free_page(zram, index);
++ up_write(&zram->lock);
+ zram_stat64_inc(zram, &zram->stats.notify_free);
+ }
+
+@@ -593,7 +600,7 @@ static const struct block_device_operations zram_devops = {
+
+ static int create_device(struct zram *zram, int device_id)
+ {
+- int ret = 0;
++ int ret = -ENOMEM;
+
+ init_rwsem(&zram->lock);
+ init_rwsem(&zram->init_lock);
+@@ -603,7 +610,6 @@ static int create_device(struct zram *zram, int device_id)
+ if (!zram->queue) {
+ pr_err("Error allocating disk queue for device %d\n",
+ device_id);
+- ret = -ENOMEM;
+ goto out;
+ }
+
+@@ -613,11 +619,9 @@ static int create_device(struct zram *zram, int device_id)
+ /* gendisk structure */
+ zram->disk = alloc_disk(1);
+ if (!zram->disk) {
+- blk_cleanup_queue(zram->queue);
+ pr_warn("Error allocating disk structure for device %d\n",
+ device_id);
+- ret = -ENOMEM;
+- goto out;
++ goto out_free_queue;
+ }
+
+ zram->disk->major = zram_major;
+@@ -646,11 +650,17 @@ static int create_device(struct zram *zram, int device_id)
+ &zram_disk_attr_group);
+ if (ret < 0) {
+ pr_warn("Error creating sysfs group");
+- goto out;
++ goto out_free_disk;
+ }
+
+ zram->init_done = 0;
++ return 0;
+
++out_free_disk:
++ del_gendisk(zram->disk);
++ put_disk(zram->disk);
++out_free_queue:
++ blk_cleanup_queue(zram->queue);
+ out:
+ return ret;
+ }
+@@ -727,8 +737,10 @@ static void __exit zram_exit(void)
+ for (i = 0; i < num_devices; i++) {
+ zram = &zram_devices[i];
+
++ get_disk(zram->disk);
+ destroy_device(zram);
+ zram_reset_device(zram);
++ put_disk(zram->disk);
+ }
+
+ unregister_blkdev(zram_major, "zram");
+diff --git a/drivers/staging/zram/zram_drv.h b/drivers/staging/zram/zram_drv.h
+index 2d1a3f1..d542eee 100644
+--- a/drivers/staging/zram/zram_drv.h
++++ b/drivers/staging/zram/zram_drv.h
+@@ -93,8 +93,9 @@ struct zram_meta {
+ struct zram {
+ struct zram_meta *meta;
+ spinlock_t stat64_lock; /* protect 64-bit stats */
+- struct rw_semaphore lock; /* protect compression buffers and table
+- * against concurrent read and writes */
++ struct rw_semaphore lock; /* protect compression buffers, table,
++ * 32bit stat counters against concurrent
++ * notifications, reads and writes */
+ struct request_queue *queue;
+ struct gendisk *disk;
+ int init_done;
+diff --git a/drivers/staging/zram/zram_sysfs.c b/drivers/staging/zram/zram_sysfs.c
+index e6a929d..dc76a3d 100644
+--- a/drivers/staging/zram/zram_sysfs.c
++++ b/drivers/staging/zram/zram_sysfs.c
+@@ -188,8 +188,10 @@ static ssize_t mem_used_total_show(struct device *dev,
+ struct zram *zram = dev_to_zram(dev);
+ struct zram_meta *meta = zram->meta;
+
++ down_read(&zram->init_lock);
+ if (zram->init_done)
+ val = zs_get_total_size_bytes(meta->mem_pool);
++ up_read(&zram->init_lock);
+
+ return sprintf(buf, "%llu\n", val);
+ }
+diff --git a/drivers/tty/serial/8250/8250_gsc.c b/drivers/tty/serial/8250/8250_gsc.c
+index bb91b47..2e3ea1a 100644
+--- a/drivers/tty/serial/8250/8250_gsc.c
++++ b/drivers/tty/serial/8250/8250_gsc.c
+@@ -31,9 +31,8 @@ static int __init serial_init_chip(struct parisc_device *dev)
+ int err;
+
+ #ifdef CONFIG_64BIT
+- extern int iosapic_serial_irq(int cellnum);
+ if (!dev->irq && (dev->id.sversion == 0xad))
+- dev->irq = iosapic_serial_irq(dev->mod_index-1);
++ dev->irq = iosapic_serial_irq(dev);
+ #endif
+
+ if (!dev->irq) {
+diff --git a/drivers/tty/serial/arc_uart.c b/drivers/tty/serial/arc_uart.c
+index cbf1d15..22f280a 100644
+--- a/drivers/tty/serial/arc_uart.c
++++ b/drivers/tty/serial/arc_uart.c
+@@ -773,6 +773,6 @@ module_init(arc_serial_init);
+ module_exit(arc_serial_exit);
+
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("plat-arcfpga/uart");
++MODULE_ALIAS("platform:" DRIVER_NAME);
+ MODULE_AUTHOR("Vineet Gupta");
+ MODULE_DESCRIPTION("ARC(Synopsys) On-Chip(fpga) serial driver");
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 4f5f161..f85b8e6 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -678,11 +678,18 @@ static void mxs_auart_settermios(struct uart_port *u,
+
+ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
+ {
+- u32 istatus, istat;
++ u32 istat;
+ struct mxs_auart_port *s = context;
+ u32 stat = readl(s->port.membase + AUART_STAT);
+
+- istatus = istat = readl(s->port.membase + AUART_INTR);
++ istat = readl(s->port.membase + AUART_INTR);
++
++ /* ack irq */
++ writel(istat & (AUART_INTR_RTIS
++ | AUART_INTR_TXIS
++ | AUART_INTR_RXIS
++ | AUART_INTR_CTSMIS),
++ s->port.membase + AUART_INTR_CLR);
+
+ if (istat & AUART_INTR_CTSMIS) {
+ uart_handle_cts_change(&s->port, stat & AUART_STAT_CTS);
+@@ -702,12 +709,6 @@ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
+ istat &= ~AUART_INTR_TXIS;
+ }
+
+- writel(istatus & (AUART_INTR_RTIS
+- | AUART_INTR_TXIS
+- | AUART_INTR_RXIS
+- | AUART_INTR_CTSMIS),
+- s->port.membase + AUART_INTR_CLR);
+-
+ return IRQ_HANDLED;
+ }
+
+@@ -850,7 +851,7 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
+ struct mxs_auart_port *s;
+ struct uart_port *port;
+ unsigned int old_ctrl0, old_ctrl2;
+- unsigned int to = 1000;
++ unsigned int to = 20000;
+
+ if (co->index >= MXS_AUART_PORTS || co->index < 0)
+ return;
+@@ -871,18 +872,23 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
+
+ uart_console_write(port, str, count, mxs_auart_console_putchar);
+
+- /*
+- * Finally, wait for transmitter to become empty
+- * and restore the TCR
+- */
++ /* Finally, wait for transmitter to become empty ... */
+ while (readl(port->membase + AUART_STAT) & AUART_STAT_BUSY) {
++ udelay(1);
+ if (!to--)
+ break;
+- udelay(1);
+ }
+
+- writel(old_ctrl0, port->membase + AUART_CTRL0);
+- writel(old_ctrl2, port->membase + AUART_CTRL2);
++ /*
++ * ... and restore the TCR if we waited long enough for the transmitter
++ * to be idle. This might keep the transmitter enabled although it is
++ * unused, but that is better than to disable it while it is still
++ * transmitting.
++ */
++ if (!(readl(port->membase + AUART_STAT) & AUART_STAT_BUSY)) {
++ writel(old_ctrl0, port->membase + AUART_CTRL0);
++ writel(old_ctrl2, port->membase + AUART_CTRL2);
++ }
+
+ clk_disable(s->clk);
+ }
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index 62b86a6..b92d333 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -183,7 +183,10 @@
+ #define LED_ON_MS 500
+ #define LED_OFF_MS 500
+
+-static int device_type;
++enum mos7840_flag {
++ MOS7840_FLAG_CTRL_BUSY,
++ MOS7840_FLAG_LED_BUSY,
++};
+
+ static const struct usb_device_id id_table[] = {
+ {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)},
+@@ -238,9 +241,12 @@ struct moschip_port {
+
+ /* For device(s) with LED indicator */
+ bool has_led;
+- bool led_flag;
+ struct timer_list led_timer1; /* Timer for LED on */
+ struct timer_list led_timer2; /* Timer for LED off */
++ struct urb *led_urb;
++ struct usb_ctrlrequest *led_dr;
++
++ unsigned long flags;
+ };
+
+ /*
+@@ -467,10 +473,10 @@ static void mos7840_control_callback(struct urb *urb)
+ case -ESHUTDOWN:
+ /* this urb is terminated, clean up */
+ dev_dbg(dev, "%s - urb shutting down with status: %d\n", __func__, status);
+- return;
++ goto out;
+ default:
+ dev_dbg(dev, "%s - nonzero urb status received: %d\n", __func__, status);
+- return;
++ goto out;
+ }
+
+ dev_dbg(dev, "%s urb buffer size is %d\n", __func__, urb->actual_length);
+@@ -483,6 +489,8 @@ static void mos7840_control_callback(struct urb *urb)
+ mos7840_handle_new_msr(mos7840_port, regval);
+ else if (mos7840_port->MsrLsr == 1)
+ mos7840_handle_new_lsr(mos7840_port, regval);
++out:
++ clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mos7840_port->flags);
+ }
+
+ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
+@@ -493,6 +501,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
+ unsigned char *buffer = mcs->ctrl_buf;
+ int ret;
+
++ if (test_and_set_bit_lock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags))
++ return -EBUSY;
++
+ dr->bRequestType = MCS_RD_RTYPE;
+ dr->bRequest = MCS_RDREQ;
+ dr->wValue = cpu_to_le16(Wval); /* 0 */
+@@ -504,6 +515,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
+ mos7840_control_callback, mcs);
+ mcs->control_urb->transfer_buffer_length = 2;
+ ret = usb_submit_urb(mcs->control_urb, GFP_ATOMIC);
++ if (ret)
++ clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags);
++
+ return ret;
+ }
+
+@@ -530,7 +544,7 @@ static void mos7840_set_led_async(struct moschip_port *mcs, __u16 wval,
+ __u16 reg)
+ {
+ struct usb_device *dev = mcs->port->serial->dev;
+- struct usb_ctrlrequest *dr = mcs->dr;
++ struct usb_ctrlrequest *dr = mcs->led_dr;
+
+ dr->bRequestType = MCS_WR_RTYPE;
+ dr->bRequest = MCS_WRREQ;
+@@ -538,10 +552,10 @@ static void mos7840_set_led_async(struct moschip_port *mcs, __u16 wval,
+ dr->wIndex = cpu_to_le16(reg);
+ dr->wLength = cpu_to_le16(0);
+
+- usb_fill_control_urb(mcs->control_urb, dev, usb_sndctrlpipe(dev, 0),
++ usb_fill_control_urb(mcs->led_urb, dev, usb_sndctrlpipe(dev, 0),
+ (unsigned char *)dr, NULL, 0, mos7840_set_led_callback, NULL);
+
+- usb_submit_urb(mcs->control_urb, GFP_ATOMIC);
++ usb_submit_urb(mcs->led_urb, GFP_ATOMIC);
+ }
+
+ static void mos7840_set_led_sync(struct usb_serial_port *port, __u16 reg,
+@@ -567,7 +581,19 @@ static void mos7840_led_flag_off(unsigned long arg)
+ {
+ struct moschip_port *mcs = (struct moschip_port *) arg;
+
+- mcs->led_flag = false;
++ clear_bit_unlock(MOS7840_FLAG_LED_BUSY, &mcs->flags);
++}
++
++static void mos7840_led_activity(struct usb_serial_port *port)
++{
++ struct moschip_port *mos7840_port = usb_get_serial_port_data(port);
++
++ if (test_and_set_bit_lock(MOS7840_FLAG_LED_BUSY, &mos7840_port->flags))
++ return;
++
++ mos7840_set_led_async(mos7840_port, 0x0301, MODEM_CONTROL_REGISTER);
++ mod_timer(&mos7840_port->led_timer1,
++ jiffies + msecs_to_jiffies(LED_ON_MS));
+ }
+
+ /*****************************************************************************
+@@ -767,14 +793,8 @@ static void mos7840_bulk_in_callback(struct urb *urb)
+ return;
+ }
+
+- /* Turn on LED */
+- if (mos7840_port->has_led && !mos7840_port->led_flag) {
+- mos7840_port->led_flag = true;
+- mos7840_set_led_async(mos7840_port, 0x0301,
+- MODEM_CONTROL_REGISTER);
+- mod_timer(&mos7840_port->led_timer1,
+- jiffies + msecs_to_jiffies(LED_ON_MS));
+- }
++ if (mos7840_port->has_led)
++ mos7840_led_activity(port);
+
+ mos7840_port->read_urb_busy = true;
+ retval = usb_submit_urb(mos7840_port->read_urb, GFP_ATOMIC);
+@@ -825,18 +845,6 @@ static void mos7840_bulk_out_data_callback(struct urb *urb)
+ /************************************************************************/
+ /* D R I V E R T T Y I N T E R F A C E F U N C T I O N S */
+ /************************************************************************/
+-#ifdef MCSSerialProbe
+-static int mos7840_serial_probe(struct usb_serial *serial,
+- const struct usb_device_id *id)
+-{
+-
+- /*need to implement the mode_reg reading and updating\
+- structures usb_serial_ device_type\
+- (i.e num_ports, num_bulkin,bulkout etc) */
+- /* Also we can update the changes attach */
+- return 1;
+-}
+-#endif
+
+ /*****************************************************************************
+ * mos7840_open
+@@ -1467,13 +1475,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
+ data1 = urb->transfer_buffer;
+ dev_dbg(&port->dev, "bulkout endpoint is %d\n", port->bulk_out_endpointAddress);
+
+- /* Turn on LED */
+- if (mos7840_port->has_led && !mos7840_port->led_flag) {
+- mos7840_port->led_flag = true;
+- mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0301);
+- mod_timer(&mos7840_port->led_timer1,
+- jiffies + msecs_to_jiffies(LED_ON_MS));
+- }
++ if (mos7840_port->has_led)
++ mos7840_led_activity(port);
+
+ /* send it down the pipe */
+ status = usb_submit_urb(urb, GFP_ATOMIC);
+@@ -2202,38 +2205,48 @@ static int mos7810_check(struct usb_serial *serial)
+ return 0;
+ }
+
+-static int mos7840_calc_num_ports(struct usb_serial *serial)
++static int mos7840_probe(struct usb_serial *serial,
++ const struct usb_device_id *id)
+ {
+- __u16 data = 0x00;
++ u16 product = serial->dev->descriptor.idProduct;
+ u8 *buf;
+- int mos7840_num_ports;
++ int device_type;
++
++ if (product == MOSCHIP_DEVICE_ID_7810 ||
++ product == MOSCHIP_DEVICE_ID_7820) {
++ device_type = product;
++ goto out;
++ }
+
+ buf = kzalloc(VENDOR_READ_LENGTH, GFP_KERNEL);
+- if (buf) {
+- usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
++ if (!buf)
++ return -ENOMEM;
++
++ usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
+ MCS_RDREQ, MCS_RD_RTYPE, 0, GPIO_REGISTER, buf,
+ VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT);
+- data = *buf;
+- kfree(buf);
+- }
+
+- if (serial->dev->descriptor.idProduct == MOSCHIP_DEVICE_ID_7810 ||
+- serial->dev->descriptor.idProduct == MOSCHIP_DEVICE_ID_7820) {
+- device_type = serial->dev->descriptor.idProduct;
+- } else {
+- /* For a MCS7840 device GPIO0 must be set to 1 */
+- if ((data & 0x01) == 1)
+- device_type = MOSCHIP_DEVICE_ID_7840;
+- else if (mos7810_check(serial))
+- device_type = MOSCHIP_DEVICE_ID_7810;
+- else
+- device_type = MOSCHIP_DEVICE_ID_7820;
+- }
++ /* For a MCS7840 device GPIO0 must be set to 1 */
++ if (buf[0] & 0x01)
++ device_type = MOSCHIP_DEVICE_ID_7840;
++ else if (mos7810_check(serial))
++ device_type = MOSCHIP_DEVICE_ID_7810;
++ else
++ device_type = MOSCHIP_DEVICE_ID_7820;
++
++ kfree(buf);
++out:
++ usb_set_serial_data(serial, (void *)(unsigned long)device_type);
++
++ return 0;
++}
++
++static int mos7840_calc_num_ports(struct usb_serial *serial)
++{
++ int device_type = (unsigned long)usb_get_serial_data(serial);
++ int mos7840_num_ports;
+
+ mos7840_num_ports = (device_type >> 4) & 0x000F;
+- serial->num_bulk_in = mos7840_num_ports;
+- serial->num_bulk_out = mos7840_num_ports;
+- serial->num_ports = mos7840_num_ports;
+
+ return mos7840_num_ports;
+ }
+@@ -2241,6 +2254,7 @@ static int mos7840_calc_num_ports(struct usb_serial *serial)
+ static int mos7840_port_probe(struct usb_serial_port *port)
+ {
+ struct usb_serial *serial = port->serial;
++ int device_type = (unsigned long)usb_get_serial_data(serial);
+ struct moschip_port *mos7840_port;
+ int status;
+ int pnum;
+@@ -2418,6 +2432,14 @@ static int mos7840_port_probe(struct usb_serial_port *port)
+ if (device_type == MOSCHIP_DEVICE_ID_7810) {
+ mos7840_port->has_led = true;
+
++ mos7840_port->led_urb = usb_alloc_urb(0, GFP_KERNEL);
++ mos7840_port->led_dr = kmalloc(sizeof(*mos7840_port->led_dr),
++ GFP_KERNEL);
++ if (!mos7840_port->led_urb || !mos7840_port->led_dr) {
++ status = -ENOMEM;
++ goto error;
++ }
++
+ init_timer(&mos7840_port->led_timer1);
+ mos7840_port->led_timer1.function = mos7840_led_off;
+ mos7840_port->led_timer1.expires =
+@@ -2430,8 +2452,6 @@ static int mos7840_port_probe(struct usb_serial_port *port)
+ jiffies + msecs_to_jiffies(LED_OFF_MS);
+ mos7840_port->led_timer2.data = (unsigned long)mos7840_port;
+
+- mos7840_port->led_flag = false;
+-
+ /* Turn off LED */
+ mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0300);
+ }
+@@ -2453,6 +2473,8 @@ out:
+ }
+ return 0;
+ error:
++ kfree(mos7840_port->led_dr);
++ usb_free_urb(mos7840_port->led_urb);
+ kfree(mos7840_port->dr);
+ kfree(mos7840_port->ctrl_buf);
+ usb_free_urb(mos7840_port->control_urb);
+@@ -2473,6 +2495,10 @@ static int mos7840_port_remove(struct usb_serial_port *port)
+
+ del_timer_sync(&mos7840_port->led_timer1);
+ del_timer_sync(&mos7840_port->led_timer2);
++
++ usb_kill_urb(mos7840_port->led_urb);
++ usb_free_urb(mos7840_port->led_urb);
++ kfree(mos7840_port->led_dr);
+ }
+ usb_kill_urb(mos7840_port->control_urb);
+ usb_free_urb(mos7840_port->control_urb);
+@@ -2499,9 +2525,7 @@ static struct usb_serial_driver moschip7840_4port_device = {
+ .throttle = mos7840_throttle,
+ .unthrottle = mos7840_unthrottle,
+ .calc_num_ports = mos7840_calc_num_ports,
+-#ifdef MCSSerialProbe
+- .probe = mos7840_serial_probe,
+-#endif
++ .probe = mos7840_probe,
+ .ioctl = mos7840_ioctl,
+ .set_termios = mos7840_set_termios,
+ .break_ctl = mos7840_break,
+diff --git a/fs/btrfs/ulist.c b/fs/btrfs/ulist.c
+index 7b417e2..b0a523b2 100644
+--- a/fs/btrfs/ulist.c
++++ b/fs/btrfs/ulist.c
+@@ -205,6 +205,10 @@ int ulist_add_merge(struct ulist *ulist, u64 val, u64 aux,
+ u64 new_alloced = ulist->nodes_alloced + 128;
+ struct ulist_node *new_nodes;
+ void *old = NULL;
++ int i;
++
++ for (i = 0; i < ulist->nnodes; i++)
++ rb_erase(&ulist->nodes[i].rb_node, &ulist->root);
+
+ /*
+ * if nodes_alloced == ULIST_SIZE no memory has been allocated
+@@ -224,6 +228,17 @@ int ulist_add_merge(struct ulist *ulist, u64 val, u64 aux,
+
+ ulist->nodes = new_nodes;
+ ulist->nodes_alloced = new_alloced;
++
++ /*
++ * krealloc actually uses memcpy, which does not copy rb_node
++ * pointers, so we have to do it ourselves. Otherwise we may
++ * be bitten by crashes.
++ */
++ for (i = 0; i < ulist->nnodes; i++) {
++ ret = ulist_rbtree_insert(ulist, &ulist->nodes[i]);
++ if (ret < 0)
++ return ret;
++ }
+ }
+ ulist->nodes[ulist->nnodes].val = val;
+ ulist->nodes[ulist->nnodes].aux = aux;
+diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
+index 6c80083..77cc85d 100644
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -122,6 +122,7 @@ static int fill_event_metadata(struct fsnotify_group *group,
+ metadata->event_len = FAN_EVENT_METADATA_LEN;
+ metadata->metadata_len = FAN_EVENT_METADATA_LEN;
+ metadata->vers = FANOTIFY_METADATA_VERSION;
++ metadata->reserved = 0;
+ metadata->mask = event->mask & FAN_ALL_OUTGOING_EVENTS;
+ metadata->pid = pid_vnr(event->tgid);
+ if (unlikely(event->mask & FAN_Q_OVERFLOW))
+diff --git a/include/linux/tick.h b/include/linux/tick.h
+index 9180f4b..62bd8b7 100644
+--- a/include/linux/tick.h
++++ b/include/linux/tick.h
+@@ -174,10 +174,4 @@ static inline void tick_nohz_task_switch(struct task_struct *tsk) { }
+ #endif
+
+
+-# ifdef CONFIG_CPU_IDLE_GOV_MENU
+-extern void menu_hrtimer_cancel(void);
+-# else
+-static inline void menu_hrtimer_cancel(void) {}
+-# endif /* CONFIG_CPU_IDLE_GOV_MENU */
+-
+ #endif
+diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
+index b6b215f..14105c2 100644
+--- a/include/linux/user_namespace.h
++++ b/include/linux/user_namespace.h
+@@ -23,6 +23,7 @@ struct user_namespace {
+ struct uid_gid_map projid_map;
+ atomic_t count;
+ struct user_namespace *parent;
++ int level;
+ kuid_t owner;
+ kgid_t group;
+ unsigned int proc_inum;
+diff --git a/include/net/ndisc.h b/include/net/ndisc.h
+index 745bf74..5043f8b 100644
+--- a/include/net/ndisc.h
++++ b/include/net/ndisc.h
+@@ -119,7 +119,7 @@ extern struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
+ * if RFC 3831 IPv6-over-Fibre Channel is ever implemented it may
+ * also need a pad of 2.
+ */
+-static int ndisc_addr_option_pad(unsigned short type)
++static inline int ndisc_addr_option_pad(unsigned short type)
+ {
+ switch (type) {
+ case ARPHRD_INFINIBAND: return 2;
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index c6e77ef..2e9b387 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -2769,13 +2769,17 @@ static void cgroup_cfts_commit(struct cgroup_subsys *ss,
+ {
+ LIST_HEAD(pending);
+ struct cgroup *cgrp, *n;
++ struct super_block *sb = ss->root->sb;
+
+ /* %NULL @cfts indicates abort and don't bother if @ss isn't attached */
+- if (cfts && ss->root != &rootnode) {
++ if (cfts && ss->root != &rootnode &&
++ atomic_inc_not_zero(&sb->s_active)) {
+ list_for_each_entry(cgrp, &ss->root->allcg_list, allcg_node) {
+ dget(cgrp->dentry);
+ list_add_tail(&cgrp->cft_q_node, &pending);
+ }
++ } else {
++ sb = NULL;
+ }
+
+ mutex_unlock(&cgroup_mutex);
+@@ -2798,6 +2802,9 @@ static void cgroup_cfts_commit(struct cgroup_subsys *ss,
+ dput(cgrp->dentry);
+ }
+
++ if (sb)
++ deactivate_super(sb);
++
+ mutex_unlock(&cgroup_cft_mutex);
+ }
+
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 0cf1c14..4251374 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -832,13 +832,10 @@ void tick_nohz_irq_exit(void)
+ {
+ struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
+
+- if (ts->inidle) {
+- /* Cancel the timer because CPU already waken up from the C-states*/
+- menu_hrtimer_cancel();
++ if (ts->inidle)
+ __tick_nohz_idle_enter(ts);
+- } else {
++ else
+ tick_nohz_full_stop_tick(ts);
+- }
+ }
+
+ /**
+@@ -936,8 +933,6 @@ void tick_nohz_idle_exit(void)
+
+ ts->inidle = 0;
+
+- /* Cancel the timer because CPU already waken up from the C-states*/
+- menu_hrtimer_cancel();
+ if (ts->idle_active || ts->tick_stopped)
+ now = ktime_get();
+
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index d8c30db..9064b91 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -62,6 +62,9 @@ int create_user_ns(struct cred *new)
+ kgid_t group = new->egid;
+ int ret;
+
++ if (parent_ns->level > 32)
++ return -EUSERS;
++
+ /*
+ * Verify that we can not violate the policy of which files
+ * may be accessed that is specified by the root directory,
+@@ -92,6 +95,7 @@ int create_user_ns(struct cred *new)
+ atomic_set(&ns->count, 1);
+ /* Leave the new->user_ns reference with the new user namespace. */
+ ns->parent = parent_ns;
++ ns->level = parent_ns->level + 1;
+ ns->owner = owner;
+ ns->group = group;
+
+@@ -105,16 +109,21 @@ int create_user_ns(struct cred *new)
+ int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
+ {
+ struct cred *cred;
++ int err = -ENOMEM;
+
+ if (!(unshare_flags & CLONE_NEWUSER))
+ return 0;
+
+ cred = prepare_creds();
+- if (!cred)
+- return -ENOMEM;
++ if (cred) {
++ err = create_user_ns(cred);
++ if (err)
++ put_cred(cred);
++ else
++ *new_cred = cred;
++ }
+
+- *new_cred = cred;
+- return create_user_ns(cred);
++ return err;
+ }
+
+ void free_user_ns(struct user_namespace *ns)
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index ee8e29a..6f01921 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -3398,6 +3398,12 @@ static void copy_workqueue_attrs(struct workqueue_attrs *to,
+ {
+ to->nice = from->nice;
+ cpumask_copy(to->cpumask, from->cpumask);
++ /*
++ * Unlike hash and equality test, this function doesn't ignore
++ * ->no_numa as it is used for both pool and wq attrs. Instead,
++ * get_unbound_pool() explicitly clears ->no_numa after copying.
++ */
++ to->no_numa = from->no_numa;
+ }
+
+ /* hash value of the content of @attr */
+@@ -3565,6 +3571,12 @@ static struct worker_pool *get_unbound_pool(const struct workqueue_attrs *attrs)
+ lockdep_set_subclass(&pool->lock, 1); /* see put_pwq() */
+ copy_workqueue_attrs(pool->attrs, attrs);
+
++ /*
++ * no_numa isn't a worker_pool attribute, always clear it. See
++ * 'struct workqueue_attrs' comments for detail.
++ */
++ pool->attrs->no_numa = false;
++
+ /* if cpumask is contained inside a NUMA node, we belong to that node */
+ if (wq_numa_enabled) {
+ for_each_node(node) {
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index fa2f63f..3f25e75 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -36,6 +36,8 @@ static int tcp_adv_win_scale_min = -31;
+ static int tcp_adv_win_scale_max = 31;
+ static int ip_ttl_min = 1;
+ static int ip_ttl_max = 255;
++static int tcp_syn_retries_min = 1;
++static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
+ static int ip_ping_group_range_min[] = { 0, 0 };
+ static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
+
+@@ -331,7 +333,9 @@ static struct ctl_table ipv4_table[] = {
+ .data = &sysctl_tcp_syn_retries,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &tcp_syn_retries_min,
++ .extra2 = &tcp_syn_retries_max
+ },
+ {
+ .procname = "tcp_synack_retries",
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index 241fb8a..4b42124 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -259,10 +259,12 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
+ {
+ struct mr6_table *mrt, *next;
+
++ rtnl_lock();
+ list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
+ list_del(&mrt->list);
+ ip6mr_free_table(mrt);
+ }
++ rtnl_unlock();
+ fib_rules_unregister(net->ipv6.mr6_rules_ops);
+ }
+ #else
+@@ -289,7 +291,10 @@ static int __net_init ip6mr_rules_init(struct net *net)
+
+ static void __net_exit ip6mr_rules_exit(struct net *net)
+ {
++ rtnl_lock();
+ ip6mr_free_table(net->ipv6.mrt6);
++ net->ipv6.mrt6 = NULL;
++ rtnl_unlock();
+ }
+ #endif
+
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 9da8620..ab8bd2c 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2081,6 +2081,7 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, const struct xfrm_policy *
+ pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
+ }
+ pol->sadb_x_policy_dir = dir+1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = xp->index;
+ pol->sadb_x_policy_priority = xp->priority;
+
+@@ -3137,7 +3138,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
+ pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
+ pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
+ pol->sadb_x_policy_dir = XFRM_POLICY_OUT + 1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = xp->index;
++ pol->sadb_x_policy_priority = xp->priority;
+
+ /* Set sadb_comb's. */
+ if (x->id.proto == IPPROTO_AH)
+@@ -3525,6 +3528,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
+ pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
+ pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
+ pol->sadb_x_policy_dir = dir + 1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = 0;
+ pol->sadb_x_policy_priority = 0;
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 4fdb306e..ae36f8e 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -652,6 +652,8 @@ static void ieee80211_get_et_stats(struct wiphy *wiphy,
+ if (sta->sdata->dev != dev)
+ continue;
+
++ sinfo.filled = 0;
++ sta_set_sinfo(sta, &sinfo);
+ i = 0;
+ ADD_STA_STATS(sta);
+ }
+diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
+index 7fc5d0d..3401262 100644
+--- a/net/mac80211/pm.c
++++ b/net/mac80211/pm.c
+@@ -99,10 +99,13 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
+ }
+ mutex_unlock(&local->sta_mtx);
+
+- /* remove all interfaces */
++ /* remove all interfaces that were created in the driver */
+ list_for_each_entry(sdata, &local->interfaces, list) {
+- if (!ieee80211_sdata_running(sdata))
++ if (!ieee80211_sdata_running(sdata) ||
++ sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
++ sdata->vif.type == NL80211_IFTYPE_MONITOR)
+ continue;
++
+ drv_remove_interface(local, sdata);
+ }
+
+diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
+index ac7ef54..e6512e2 100644
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
+ struct minstrel_rate *msr, *mr;
+ unsigned int ndx;
+ bool mrr_capable;
+- bool prev_sample = mi->prev_sample;
++ bool prev_sample;
+ int delta;
+ int sampling_ratio;
+
+@@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
+ (mi->sample_count + mi->sample_deferred / 2);
+
+ /* delta < 0: no sampling required */
++ prev_sample = mi->prev_sample;
+ mi->prev_sample = false;
+ if (delta < 0 || (!mrr_capable && prev_sample))
+ return;
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index 5b2d301..f5aed96 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -804,10 +804,18 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
+
+ sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
+ info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
++ rate->count = 1;
++
++ if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
++ int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
++ rate->idx = mp->cck_rates[idx];
++ rate->flags = 0;
++ return;
++ }
++
+ rate->idx = sample_idx % MCS_GROUP_RATES +
+ (sample_group->streams - 1) * MCS_GROUP_RATES;
+ rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
+- rate->count = 1;
+ }
+
+ static void
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 8e29526..83f6d29 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -932,8 +932,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+ struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
+
+- /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
+- if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
++ /*
++ * Drop duplicate 802.11 retransmissions
++ * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
++ */
++ if (rx->skb->len >= 24 && rx->sta &&
++ !ieee80211_is_ctl(hdr->frame_control) &&
++ !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
++ !is_multicast_ether_addr(hdr->addr1)) {
+ if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
+ rx->sta->last_seq_ctrl[rx->seqno_idx] ==
+ hdr->seq_ctrl)) {
+diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
+index 2fd6dbe..1076fe1 100644
+--- a/net/netlink/genetlink.c
++++ b/net/netlink/genetlink.c
+@@ -877,8 +877,10 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
+ #ifdef CONFIG_MODULES
+ if (res == NULL) {
+ genl_unlock();
++ up_read(&cb_lock);
+ request_module("net-pf-%d-proto-%d-family-%s",
+ PF_NETLINK, NETLINK_GENERIC, name);
++ down_read(&cb_lock);
+ genl_lock();
+ res = genl_family_find_byname(name);
+ }
+diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
+index ca8e0a5..1f9c314 100644
+--- a/net/sched/sch_atm.c
++++ b/net/sched/sch_atm.c
+@@ -605,6 +605,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
+ struct sockaddr_atmpvc pvc;
+ int state;
+
++ memset(&pvc, 0, sizeof(pvc));
+ pvc.sap_family = AF_ATMPVC;
+ pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
+ pvc.sap_addr.vpi = flow->vcc->vpi;
+diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
+index 1bc210f..8ec1598 100644
+--- a/net/sched/sch_cbq.c
++++ b/net/sched/sch_cbq.c
+@@ -1465,6 +1465,7 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
+ unsigned char *b = skb_tail_pointer(skb);
+ struct tc_cbq_wrropt opt;
+
++ memset(&opt, 0, sizeof(opt));
+ opt.flags = 0;
+ opt.allot = cl->allot;
+ opt.priority = cl->priority + 1;
+diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c
+index d304f41..af7ffd4 100644
+--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
++++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
+@@ -120,7 +120,7 @@ static int gssp_rpc_create(struct net *net, struct rpc_clnt **_clnt)
+ if (IS_ERR(clnt)) {
+ dprintk("RPC: failed to create AF_LOCAL gssproxy "
+ "client (errno %ld).\n", PTR_ERR(clnt));
+- result = -PTR_ERR(clnt);
++ result = PTR_ERR(clnt);
+ *_clnt = NULL;
+ goto out;
+ }
+@@ -328,7 +328,6 @@ void gssp_free_upcall_data(struct gssp_upcall_data *data)
+ kfree(data->in_handle.data);
+ kfree(data->out_handle.data);
+ kfree(data->out_token.data);
+- kfree(data->mech_oid.data);
+ free_svc_cred(&data->creds);
+ }
+
+diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
+index 357f613..3c85d1c 100644
+--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
++++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
+@@ -430,7 +430,7 @@ static int dummy_enc_nameattr_array(struct xdr_stream *xdr,
+ static int dummy_dec_nameattr_array(struct xdr_stream *xdr,
+ struct gssx_name_attr_array *naa)
+ {
+- struct gssx_name_attr dummy;
++ struct gssx_name_attr dummy = { .attr = {.len = 0} };
+ u32 count, i;
+ __be32 *p;
+
+@@ -493,12 +493,13 @@ static int gssx_enc_name(struct xdr_stream *xdr,
+ return err;
+ }
+
++
+ static int gssx_dec_name(struct xdr_stream *xdr,
+ struct gssx_name *name)
+ {
+- struct xdr_netobj dummy_netobj;
+- struct gssx_name_attr_array dummy_name_attr_array;
+- struct gssx_option_array dummy_option_array;
++ struct xdr_netobj dummy_netobj = { .len = 0 };
++ struct gssx_name_attr_array dummy_name_attr_array = { .count = 0 };
++ struct gssx_option_array dummy_option_array = { .count = 0 };
+ int err;
+
+ /* name->display_name */
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index b14b7e3..db8ead9 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -6588,12 +6588,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
+
+ void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
+ {
++ struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
+ void *hdr = ((void **)skb->cb)[1];
+ struct nlattr *data = ((void **)skb->cb)[2];
+
+ nla_nest_end(skb, data);
+ genlmsg_end(skb, hdr);
+- genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
++ genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
++ nl80211_testmode_mcgrp.id, gfp);
+ }
+ EXPORT_SYMBOL(cfg80211_testmode_event);
+ #endif
+@@ -10028,7 +10030,8 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
+
+ genlmsg_end(msg, hdr);
+
+- genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
++ genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
++ nl80211_mlme_mcgrp.id, gfp);
+ return;
+
+ nla_put_failure:
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 99db892..9896954 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -743,7 +743,7 @@ static long snd_compr_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+ mutex_lock(&stream->device->lock);
+ switch (_IOC_NR(cmd)) {
+ case _IOC_NR(SNDRV_COMPRESS_IOCTL_VERSION):
+- put_user(SNDRV_COMPRESS_VERSION,
++ retval = put_user(SNDRV_COMPRESS_VERSION,
+ (int __user *)arg) ? -EFAULT : 0;
+ break;
+ case _IOC_NR(SNDRV_COMPRESS_GET_CAPS):
+diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c
+index 7c11d46..48a9d00 100644
+--- a/sound/pci/hda/hda_auto_parser.c
++++ b/sound/pci/hda/hda_auto_parser.c
+@@ -860,7 +860,7 @@ void snd_hda_pick_fixup(struct hda_codec *codec,
+ }
+ }
+ if (id < 0 && quirk) {
+- for (q = quirk; q->subvendor; q++) {
++ for (q = quirk; q->subvendor || q->subdevice; q++) {
+ unsigned int vendorid =
+ q->subdevice | (q->subvendor << 16);
+ unsigned int mask = 0xffff0000 | q->subdevice_mask;
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index e849e1e..dc4833f 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -2815,6 +2815,7 @@ static const struct hda_pintbl ecs202_pin_configs[] = {
+
+ /* codec SSIDs for Intel Mac sharing the same PCI SSID 8384:7680 */
+ static const struct snd_pci_quirk stac922x_intel_mac_fixup_tbl[] = {
++ SND_PCI_QUIRK(0x0000, 0x0100, "Mac Mini", STAC_INTEL_MAC_V3),
+ SND_PCI_QUIRK(0x106b, 0x0800, "Mac", STAC_INTEL_MAC_V1),
+ SND_PCI_QUIRK(0x106b, 0x0600, "Mac", STAC_INTEL_MAC_V2),
+ SND_PCI_QUIRK(0x106b, 0x0700, "Mac", STAC_INTEL_MAC_V2),
Modified: genpatches-2.6/trunk/3.4/0000_README
===================================================================
--- genpatches-2.6/trunk/3.4/0000_README 2013-08-06 15:26:12 UTC (rev 2470)
+++ genpatches-2.6/trunk/3.4/0000_README 2013-08-12 10:42:00 UTC (rev 2471)
@@ -259,6 +259,14 @@
From: http://www.kernel.org
Desc: Linux 3.4.55
+Patch: 1055_linux-3.4.56.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.56
+
+Patch: 1056_linux-3.4.57.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.57
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
Added: genpatches-2.6/trunk/3.4/1055_linux-3.4.56.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1055_linux-3.4.56.patch (rev 0)
+++ genpatches-2.6/trunk/3.4/1055_linux-3.4.56.patch 2013-08-12 10:42:00 UTC (rev 2471)
@@ -0,0 +1,1511 @@
+diff --git a/Makefile b/Makefile
+index c11116f..2fe1f6d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 55
++SUBLEVEL = 56
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/powerpc/include/asm/module.h b/arch/powerpc/include/asm/module.h
+index 0192a4e..80de64b 100644
+--- a/arch/powerpc/include/asm/module.h
++++ b/arch/powerpc/include/asm/module.h
+@@ -87,10 +87,9 @@ struct exception_table_entry;
+ void sort_ex_table(struct exception_table_entry *start,
+ struct exception_table_entry *finish);
+
+-#ifdef CONFIG_MODVERSIONS
++#if defined(CONFIG_MODVERSIONS) && defined(CONFIG_PPC64)
+ #define ARCH_RELOCATES_KCRCTAB
+-
+-extern const unsigned long reloc_start[];
++#define reloc_start PHYSICAL_START
+ #endif
+ #endif /* __KERNEL__ */
+ #endif /* _ASM_POWERPC_MODULE_H */
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index 65d1c08..7703569 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -38,9 +38,6 @@ jiffies = jiffies_64 + 4;
+ #endif
+ SECTIONS
+ {
+- . = 0;
+- reloc_start = .;
+-
+ . = KERNELBASE;
+
+ /*
+diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
+index 011358c..2f36a66 100644
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@ -67,6 +67,10 @@ static inline int is_zero_pfn(unsigned long pfn)
+
+ #define my_zero_pfn(addr) page_to_pfn(ZERO_PAGE(addr))
+
++/* TODO: s390 cannot support io_remap_pfn_range... */
++#define io_remap_pfn_range(vma, vaddr, pfn, size, prot) \
++ remap_pfn_range(vma, vaddr, pfn, size, prot)
++
+ #endif /* !__ASSEMBLY__ */
+
+ /*
+diff --git a/drivers/acpi/acpi_memhotplug.c b/drivers/acpi/acpi_memhotplug.c
+index d985713..f81597f 100644
+--- a/drivers/acpi/acpi_memhotplug.c
++++ b/drivers/acpi/acpi_memhotplug.c
+@@ -421,6 +421,7 @@ static int acpi_memory_device_add(struct acpi_device *device)
+ /* Get the range from the _CRS */
+ result = acpi_memory_get_device_resources(mem_device);
+ if (result) {
++ device->driver_data = NULL;
+ kfree(mem_device);
+ return result;
+ }
+diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
+index 6bdedd7..1ad34ed 100644
+--- a/drivers/ata/Kconfig
++++ b/drivers/ata/Kconfig
+@@ -93,7 +93,7 @@ config SATA_FSL
+ If unsure, say N.
+
+ config SATA_INIC162X
+- tristate "Initio 162x SATA support"
++ tristate "Initio 162x SATA support (Very Experimental)"
+ depends on PCI
+ help
+ This option enables support for Initio 162x Serial ATA.
+diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
+index 45cc02b..9dbd3ae 100644
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -344,7 +344,7 @@ static const struct pci_device_id piix_pci_tbl[] = {
+ /* SATA Controller IDE (Wellsburg) */
+ { 0x8086, 0x8d00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+ /* SATA Controller IDE (Wellsburg) */
+- { 0x8086, 0x8d08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
++ { 0x8086, 0x8d08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
+ /* SATA Controller IDE (Wellsburg) */
+ { 0x8086, 0x8d60, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+ /* SATA Controller IDE (Wellsburg) */
+diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
+index 5c7d70c..3a8b55e 100644
+--- a/drivers/ata/sata_inic162x.c
++++ b/drivers/ata/sata_inic162x.c
+@@ -6,6 +6,18 @@
+ *
+ * This file is released under GPL v2.
+ *
++ * **** WARNING ****
++ *
++ * This driver never worked properly and unfortunately data corruption is
++ * relatively common. There isn't anyone working on the driver and there's
++ * no support from the vendor. Do not use this driver in any production
++ * environment.
++ *
++ * http://thread.gmane.org/gmane.linux.debian.devel.bugs.rc/378525/focus=54491
++ * https://bugzilla.kernel.org/show_bug.cgi?id=60565
++ *
++ * *****************
++ *
+ * This controller is eccentric and easily locks up if something isn't
+ * right. Documentation is available at initio's website but it only
+ * documents registers (not programming model).
+@@ -809,6 +821,8 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ ata_print_version_once(&pdev->dev, DRV_VERSION);
+
++ dev_alert(&pdev->dev, "inic162x support is broken with common data corruption issues and will be disabled by default, contact linux-ide@vger.kernel.org if in production use\n");
++
+ /* alloc host */
+ host = ata_host_alloc_pinfo(&pdev->dev, ppi, NR_PORTS);
+ hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL);
+diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
+index 4fd1dea..4ed7bf9 100644
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -399,7 +399,18 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
+ int status = BLKIF_RSP_OKAY;
+ struct block_device *bdev = blkif->vbd.bdev;
+ unsigned long secure;
++ struct phys_req preq;
++
++ preq.sector_number = req->u.discard.sector_number;
++ preq.nr_sects = req->u.discard.nr_sectors;
+
++ err = xen_vbd_translate(&preq, blkif, WRITE);
++ if (err) {
++ pr_warn(DRV_PFX "access denied: DISCARD [%llu->%llu] on dev=%04x\n",
++ preq.sector_number,
++ preq.sector_number + preq.nr_sects, blkif->vbd.pdevice);
++ goto fail_response;
++ }
+ blkif->st_ds_req++;
+
+ xen_blkif_get(blkif);
+@@ -410,7 +421,7 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
+ err = blkdev_issue_discard(bdev, req->u.discard.sector_number,
+ req->u.discard.nr_sectors,
+ GFP_KERNEL, secure);
+-
++fail_response:
+ if (err == -EOPNOTSUPP) {
+ pr_debug(DRV_PFX "discard op failed, not supported\n");
+ status = BLKIF_RSP_EOPNOTSUPP;
+diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
+index b8e4809..b558810 100644
+--- a/drivers/firewire/core-cdev.c
++++ b/drivers/firewire/core-cdev.c
+@@ -53,6 +53,7 @@
+ #define FW_CDEV_KERNEL_VERSION 5
+ #define FW_CDEV_VERSION_EVENT_REQUEST2 4
+ #define FW_CDEV_VERSION_ALLOCATE_REGION_END 4
++#define FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW 5
+
+ struct client {
+ u32 version;
+@@ -998,6 +999,8 @@ static int ioctl_create_iso_context(struct client *client, union ioctl_arg *arg)
+ a->channel, a->speed, a->header_size, cb, client);
+ if (IS_ERR(context))
+ return PTR_ERR(context);
++ if (client->version < FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW)
++ context->drop_overflow_headers = true;
+
+ /* We only support one context at this time. */
+ spin_lock_irq(&client->lock);
+diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
+index 2b54600..c1de4c3 100644
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -2694,8 +2694,11 @@ static void copy_iso_headers(struct iso_context *ctx, const u32 *dma_hdr)
+ {
+ u32 *ctx_hdr;
+
+- if (ctx->header_length + ctx->base.header_size > PAGE_SIZE)
++ if (ctx->header_length + ctx->base.header_size > PAGE_SIZE) {
++ if (ctx->base.drop_overflow_headers)
++ return;
+ flush_iso_completions(ctx);
++ }
+
+ ctx_hdr = ctx->header + ctx->header_length;
+ ctx->last_timestamp = (u16)le32_to_cpu((__force __le32)dma_hdr[0]);
+@@ -2855,8 +2858,11 @@ static int handle_it_packet(struct context *context,
+
+ sync_it_packet_for_cpu(context, d);
+
+- if (ctx->header_length + 4 > PAGE_SIZE)
++ if (ctx->header_length + 4 > PAGE_SIZE) {
++ if (ctx->base.drop_overflow_headers)
++ return 1;
+ flush_iso_completions(ctx);
++ }
+
+ ctx_hdr = ctx->header + ctx->header_length;
+ ctx->last_timestamp = le16_to_cpu(last->res_count);
+diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
+index 43672b6..daa1e34 100644
+--- a/drivers/gpu/drm/radeon/atom.c
++++ b/drivers/gpu/drm/radeon/atom.c
+@@ -1222,12 +1222,17 @@ int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
+ int r;
+
+ mutex_lock(&ctx->mutex);
++ /* reset data block */
++ ctx->data_block = 0;
+ /* reset reg block */
+ ctx->reg_block = 0;
+ /* reset fb window */
+ ctx->fb_base = 0;
+ /* reset io mode */
+ ctx->io_mode = ATOM_IO_MM;
++ /* reset divmul */
++ ctx->divmul[0] = 0;
++ ctx->divmul[1] = 0;
+ r = atom_execute_table_locked(ctx, index, params);
+ mutex_unlock(&ctx->mutex);
+ return r;
+diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
+index 886b41f..505f27e 100644
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -45,6 +45,41 @@ static char *pre_emph_names[] = {
+ };
+
+ /***** radeon AUX functions *****/
++
++/* Atom needs data in little endian format
++ * so swap as appropriate when copying data to
++ * or from atom. Note that atom operates on
++ * dw units.
++ */
++static void radeon_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le)
++{
++#ifdef __BIG_ENDIAN
++ u8 src_tmp[20], dst_tmp[20]; /* used for byteswapping */
++ u32 *dst32, *src32;
++ int i;
++
++ memcpy(src_tmp, src, num_bytes);
++ src32 = (u32 *)src_tmp;
++ dst32 = (u32 *)dst_tmp;
++ if (to_le) {
++ for (i = 0; i < ((num_bytes + 3) / 4); i++)
++ dst32[i] = cpu_to_le32(src32[i]);
++ memcpy(dst, dst_tmp, num_bytes);
++ } else {
++ u8 dws = num_bytes & ~3;
++ for (i = 0; i < ((num_bytes + 3) / 4); i++)
++ dst32[i] = le32_to_cpu(src32[i]);
++ memcpy(dst, dst_tmp, dws);
++ if (num_bytes % 4) {
++ for (i = 0; i < (num_bytes % 4); i++)
++ dst[dws+i] = dst_tmp[dws+i];
++ }
++ }
++#else
++ memcpy(dst, src, num_bytes);
++#endif
++}
++
+ union aux_channel_transaction {
+ PROCESS_AUX_CHANNEL_TRANSACTION_PS_ALLOCATION v1;
+ PROCESS_AUX_CHANNEL_TRANSACTION_PARAMETERS_V2 v2;
+@@ -66,10 +101,10 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
+
+ base = (unsigned char *)(rdev->mode_info.atom_context->scratch + 1);
+
+- memcpy(base, send, send_bytes);
++ radeon_copy_swap(base, send, send_bytes, true);
+
+- args.v1.lpAuxRequest = 0 + 4;
+- args.v1.lpDataOut = 16 + 4;
++ args.v1.lpAuxRequest = cpu_to_le16((u16)(0 + 4));
++ args.v1.lpDataOut = cpu_to_le16((u16)(16 + 4));
+ args.v1.ucDataOutLen = 0;
+ args.v1.ucChannelID = chan->rec.i2c_id;
+ args.v1.ucDelay = delay / 10;
+@@ -103,7 +138,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
+ recv_bytes = recv_size;
+
+ if (recv && recv_size)
+- memcpy(recv, base + 16, recv_bytes);
++ radeon_copy_swap(recv, base + 16, recv_bytes, false);
+
+ return recv_bytes;
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index 2b2c557..07d0bcd 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -147,7 +147,7 @@ static uint16_t combios_get_table_offset(struct drm_device *dev,
+ enum radeon_combios_table_offset table)
+ {
+ struct radeon_device *rdev = dev->dev_private;
+- int rev;
++ int rev, size;
+ uint16_t offset = 0, check_offset;
+
+ if (!rdev->bios)
+@@ -156,174 +156,106 @@ static uint16_t combios_get_table_offset(struct drm_device *dev,
+ switch (table) {
+ /* absolute offset tables */
+ case COMBIOS_ASIC_INIT_1_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0xc);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0xc;
+ break;
+ case COMBIOS_BIOS_SUPPORT_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x14);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x14;
+ break;
+ case COMBIOS_DAC_PROGRAMMING_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x2a);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x2a;
+ break;
+ case COMBIOS_MAX_COLOR_DEPTH_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x2c);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x2c;
+ break;
+ case COMBIOS_CRTC_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x2e);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x2e;
+ break;
+ case COMBIOS_PLL_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x30);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x30;
+ break;
+ case COMBIOS_TV_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x32);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x32;
+ break;
+ case COMBIOS_DFP_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x34);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x34;
+ break;
+ case COMBIOS_HW_CONFIG_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x36);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x36;
+ break;
+ case COMBIOS_MULTIMEDIA_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x38);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x38;
+ break;
+ case COMBIOS_TV_STD_PATCH_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x3e);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x3e;
+ break;
+ case COMBIOS_LCD_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x40);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x40;
+ break;
+ case COMBIOS_MOBILE_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x42);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x42;
+ break;
+ case COMBIOS_PLL_INIT_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x46);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x46;
+ break;
+ case COMBIOS_MEM_CONFIG_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x48);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x48;
+ break;
+ case COMBIOS_SAVE_MASK_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x4a);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x4a;
+ break;
+ case COMBIOS_HARDCODED_EDID_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x4c);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x4c;
+ break;
+ case COMBIOS_ASIC_INIT_2_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x4e);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x4e;
+ break;
+ case COMBIOS_CONNECTOR_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x50);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x50;
+ break;
+ case COMBIOS_DYN_CLK_1_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x52);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x52;
+ break;
+ case COMBIOS_RESERVED_MEM_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x54);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x54;
+ break;
+ case COMBIOS_EXT_TMDS_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x58);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x58;
+ break;
+ case COMBIOS_MEM_CLK_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x5a);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x5a;
+ break;
+ case COMBIOS_EXT_DAC_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x5c);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x5c;
+ break;
+ case COMBIOS_MISC_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x5e);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x5e;
+ break;
+ case COMBIOS_CRT_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x60);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x60;
+ break;
+ case COMBIOS_INTEGRATED_SYSTEM_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x62);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x62;
+ break;
+ case COMBIOS_COMPONENT_VIDEO_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x64);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x64;
+ break;
+ case COMBIOS_FAN_SPEED_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x66);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x66;
+ break;
+ case COMBIOS_OVERDRIVE_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x68);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x68;
+ break;
+ case COMBIOS_OEM_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x6a);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x6a;
+ break;
+ case COMBIOS_DYN_CLK_2_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x6c);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x6c;
+ break;
+ case COMBIOS_POWER_CONNECTOR_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x6e);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x6e;
+ break;
+ case COMBIOS_I2C_INFO_TABLE:
+- check_offset = RBIOS16(rdev->bios_header_start + 0x70);
+- if (check_offset)
+- offset = check_offset;
++ check_offset = 0x70;
+ break;
+ /* relative offset tables */
+ case COMBIOS_ASIC_INIT_3_TABLE: /* offset from misc info */
+@@ -439,11 +371,16 @@ static uint16_t combios_get_table_offset(struct drm_device *dev,
+ }
+ break;
+ default:
++ check_offset = 0;
+ break;
+ }
+
+- return offset;
++ size = RBIOS8(rdev->bios_header_start + 0x6);
++ /* check absolute offset tables */
++ if (table < COMBIOS_ASIC_INIT_3_TABLE && check_offset && check_offset < size)
++ offset = RBIOS16(rdev->bios_header_start + check_offset);
+
++ return offset;
+ }
+
+ bool radeon_combios_check_hardcoded_edid(struct radeon_device *rdev)
+@@ -953,8 +890,10 @@ struct radeon_encoder_primary_dac *radeon_combios_get_primary_dac_info(struct
+ dac = RBIOS8(dac_info + 0x3) & 0xf;
+ p_dac->ps2_pdac_adj = (bg << 8) | (dac);
+ }
+- /* if the values are all zeros, use the table */
+- if (p_dac->ps2_pdac_adj)
++ /* if the values are zeros, use the table */
++ if ((dac == 0) || (bg == 0))
++ found = 0;
++ else
+ found = 1;
+ }
+
+diff --git a/drivers/md/dm-verity.c b/drivers/md/dm-verity.c
+index 68bf5c3..9ab2a6a 100644
+--- a/drivers/md/dm-verity.c
++++ b/drivers/md/dm-verity.c
+@@ -813,9 +813,8 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ for (i = v->levels - 1; i >= 0; i--) {
+ sector_t s;
+ v->hash_level_block[i] = hash_position;
+- s = verity_position_at_level(v, v->data_blocks, i);
+- s = (s >> v->hash_per_block_bits) +
+- !!(s & ((1 << v->hash_per_block_bits) - 1));
++ s = (v->data_blocks + ((sector_t)1 << ((i + 1) * v->hash_per_block_bits)) - 1)
++ >> ((i + 1) * v->hash_per_block_bits);
+ if (hash_position + s < hash_position) {
+ ti->error = "Hash device offset overflow";
+ r = -E2BIG;
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 0cc7985..54ba531 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -2029,12 +2029,18 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio)
+ d = r10_bio->devs[1].devnum;
+ wbio = r10_bio->devs[1].bio;
+ wbio2 = r10_bio->devs[1].repl_bio;
++ /* Need to test wbio2->bi_end_io before we call
++ * generic_make_request as if the former is NULL,
++ * the latter is free to free wbio2.
++ */
++ if (wbio2 && !wbio2->bi_end_io)
++ wbio2 = NULL;
+ if (wbio->bi_end_io) {
+ atomic_inc(&conf->mirrors[d].rdev->nr_pending);
+ md_sync_acct(conf->mirrors[d].rdev->bdev, wbio->bi_size >> 9);
+ generic_make_request(wbio);
+ }
+- if (wbio2 && wbio2->bi_end_io) {
++ if (wbio2) {
+ atomic_inc(&conf->mirrors[d].replacement->nr_pending);
+ md_sync_acct(conf->mirrors[d].replacement->bdev,
+ wbio2->bi_size >> 9);
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 0240576..6155c8b 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3326,6 +3326,7 @@ static void handle_stripe(struct stripe_head *sh)
+ if (test_and_clear_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
+ set_bit(STRIPE_SYNCING, &sh->state);
+ clear_bit(STRIPE_INSYNC, &sh->state);
++ clear_bit(STRIPE_REPLACED, &sh->state);
+ }
+ clear_bit(STRIPE_DELAYED, &sh->state);
+
+@@ -3465,19 +3466,23 @@ static void handle_stripe(struct stripe_head *sh)
+ handle_parity_checks5(conf, sh, &s, disks);
+ }
+
+- if (s.replacing && s.locked == 0
+- && !test_bit(STRIPE_INSYNC, &sh->state)) {
++ if ((s.replacing || s.syncing) && s.locked == 0
++ && !test_bit(STRIPE_COMPUTE_RUN, &sh->state)
++ && !test_bit(STRIPE_REPLACED, &sh->state)) {
+ /* Write out to replacement devices where possible */
+ for (i = 0; i < conf->raid_disks; i++)
+- if (test_bit(R5_UPTODATE, &sh->dev[i].flags) &&
+- test_bit(R5_NeedReplace, &sh->dev[i].flags)) {
++ if (test_bit(R5_NeedReplace, &sh->dev[i].flags)) {
++ WARN_ON(!test_bit(R5_UPTODATE, &sh->dev[i].flags));
+ set_bit(R5_WantReplace, &sh->dev[i].flags);
+ set_bit(R5_LOCKED, &sh->dev[i].flags);
+ s.locked++;
+ }
+- set_bit(STRIPE_INSYNC, &sh->state);
++ if (s.replacing)
++ set_bit(STRIPE_INSYNC, &sh->state);
++ set_bit(STRIPE_REPLACED, &sh->state);
+ }
+ if ((s.syncing || s.replacing) && s.locked == 0 &&
++ !test_bit(STRIPE_COMPUTE_RUN, &sh->state) &&
+ test_bit(STRIPE_INSYNC, &sh->state)) {
+ md_done_sync(conf->mddev, STRIPE_SECTORS, 1);
+ clear_bit(STRIPE_SYNCING, &sh->state);
+diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
+index 8d8e139..f1ed18e 100644
+--- a/drivers/md/raid5.h
++++ b/drivers/md/raid5.h
+@@ -306,6 +306,7 @@ enum {
+ STRIPE_SYNC_REQUESTED,
+ STRIPE_SYNCING,
+ STRIPE_INSYNC,
++ STRIPE_REPLACED,
+ STRIPE_PREREAD_ACTIVE,
+ STRIPE_DELAYED,
+ STRIPE_DEGRADED,
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index cbefe67..bc177b9 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -518,7 +518,7 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
+ {
+ struct virtnet_info *vi = container_of(napi, struct virtnet_info, napi);
+ void *buf;
+- unsigned int len, received = 0;
++ unsigned int r, len, received = 0;
+
+ again:
+ while (received < budget &&
+@@ -535,8 +535,9 @@ again:
+
+ /* Out of packets? */
+ if (received < budget) {
++ r = virtqueue_enable_cb_prepare(vi->rvq);
+ napi_complete(napi);
+- if (unlikely(!virtqueue_enable_cb(vi->rvq)) &&
++ if (unlikely(virtqueue_poll(vi->rvq, r)) &&
+ napi_schedule_prep(napi)) {
+ virtqueue_disable_cb(vi->rvq);
+ __napi_schedule(napi);
+diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
+index 4f1b10b..3743ac9 100644
+--- a/drivers/s390/scsi/zfcp_aux.c
++++ b/drivers/s390/scsi/zfcp_aux.c
+@@ -3,7 +3,7 @@
+ *
+ * Module interface and handling of zfcp data structures.
+ *
+- * Copyright IBM Corporation 2002, 2010
++ * Copyright IBM Corp. 2002, 2013
+ */
+
+ /*
+@@ -23,6 +23,7 @@
+ * Christof Schmitt
+ * Martin Petermann
+ * Sven Schuetz
++ * Steffen Maier
+ */
+
+ #define KMSG_COMPONENT "zfcp"
+@@ -415,6 +416,8 @@ struct zfcp_adapter *zfcp_adapter_enqueue(struct ccw_device *ccw_device)
+ adapter->dma_parms.max_segment_size = ZFCP_QDIO_SBALE_LEN;
+ adapter->ccw_device->dev.dma_parms = &adapter->dma_parms;
+
++ adapter->stat_read_buf_num = FSF_STATUS_READS_RECOM;
++
+ if (!zfcp_scsi_adapter_register(adapter))
+ return adapter;
+
+diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
+index 5fdf70b..961e327 100644
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -3,7 +3,7 @@
+ *
+ * Implementation of FSF commands.
+ *
+- * Copyright IBM Corporation 2002, 2010
++ * Copyright IBM Corp. 2002, 2013
+ */
+
+ #define KMSG_COMPONENT "zfcp"
+@@ -483,12 +483,8 @@ static int zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *req)
+
+ fc_host_port_name(shost) = nsp->fl_wwpn;
+ fc_host_node_name(shost) = nsp->fl_wwnn;
+- fc_host_port_id(shost) = ntoh24(bottom->s_id);
+- fc_host_speed(shost) =
+- zfcp_fsf_convert_portspeed(bottom->fc_link_speed);
+ fc_host_supported_classes(shost) = FC_COS_CLASS2 | FC_COS_CLASS3;
+
+- adapter->hydra_version = bottom->adapter_type;
+ adapter->timer_ticks = bottom->timer_interval & ZFCP_FSF_TIMER_INT_MASK;
+ adapter->stat_read_buf_num = max(bottom->status_read_buf_num,
+ (u16)FSF_STATUS_READS_RECOM);
+@@ -496,6 +492,19 @@ static int zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *req)
+ if (fc_host_permanent_port_name(shost) == -1)
+ fc_host_permanent_port_name(shost) = fc_host_port_name(shost);
+
++ zfcp_scsi_set_prot(adapter);
++
++ /* no error return above here, otherwise must fix call chains */
++ /* do not evaluate invalid fields */
++ if (req->qtcb->header.fsf_status == FSF_EXCHANGE_CONFIG_DATA_INCOMPLETE)
++ return 0;
++
++ fc_host_port_id(shost) = ntoh24(bottom->s_id);
++ fc_host_speed(shost) =
++ zfcp_fsf_convert_portspeed(bottom->fc_link_speed);
++
++ adapter->hydra_version = bottom->adapter_type;
++
+ switch (bottom->fc_topology) {
+ case FSF_TOPO_P2P:
+ adapter->peer_d_id = ntoh24(bottom->peer_d_id);
+@@ -517,8 +526,6 @@ static int zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *req)
+ return -EIO;
+ }
+
+- zfcp_scsi_set_prot(adapter);
+-
+ return 0;
+ }
+
+@@ -569,6 +576,8 @@ static void zfcp_fsf_exchange_config_data_handler(struct zfcp_fsf_req *req)
+ &adapter->status);
+ zfcp_fsf_link_down_info_eval(req,
+ &qtcb->header.fsf_status_qual.link_down_info);
++ if (zfcp_fsf_exchange_config_evaluate(req))
++ return;
+ break;
+ default:
+ zfcp_erp_adapter_shutdown(adapter, 0, "fsecdh3");
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index eac9509..d99d4a0 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -423,6 +423,8 @@ qla2x00_start_scsi(srb_t *sp)
+ __constant_cpu_to_le16(CF_SIMPLE_TAG);
+ break;
+ }
++ } else {
++ cmd_pkt->control_flags = __constant_cpu_to_le16(CF_SIMPLE_TAG);
+ }
+
+ /* Load SCSI command packet. */
+@@ -1331,11 +1333,11 @@ qla24xx_build_scsi_crc_2_iocbs(srb_t *sp, struct cmd_type_crc_2 *cmd_pkt,
+ fcp_cmnd->task_attribute = TSK_ORDERED;
+ break;
+ default:
+- fcp_cmnd->task_attribute = 0;
++ fcp_cmnd->task_attribute = TSK_SIMPLE;
+ break;
+ }
+ } else {
+- fcp_cmnd->task_attribute = 0;
++ fcp_cmnd->task_attribute = TSK_SIMPLE;
+ }
+
+ cmd_pkt->fcp_rsp_dseg_len = 0; /* Let response come in status iocb */
+@@ -1541,7 +1543,12 @@ qla24xx_start_scsi(srb_t *sp)
+ case ORDERED_QUEUE_TAG:
+ cmd_pkt->task = TSK_ORDERED;
+ break;
++ default:
++ cmd_pkt->task = TSK_SIMPLE;
++ break;
+ }
++ } else {
++ cmd_pkt->task = TSK_SIMPLE;
+ }
+
+ /* Load SCSI command packet. */
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 3141c1a..105fff2 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -672,10 +672,17 @@ static int scsi_setup_flush_cmnd(struct scsi_device *sdp, struct request *rq)
+
+ static void sd_unprep_fn(struct request_queue *q, struct request *rq)
+ {
++ struct scsi_cmnd *SCpnt = rq->special;
++
+ if (rq->cmd_flags & REQ_DISCARD) {
+ free_page((unsigned long)rq->buffer);
+ rq->buffer = NULL;
+ }
++ if (SCpnt->cmnd != rq->cmd) {
++ mempool_free(SCpnt->cmnd, sd_cdb_pool);
++ SCpnt->cmnd = NULL;
++ SCpnt->cmd_len = 0;
++ }
+ }
+
+ /**
+@@ -1539,21 +1546,6 @@ static int sd_done(struct scsi_cmnd *SCpnt)
+ if (rq_data_dir(SCpnt->request) == READ && scsi_prot_sg_count(SCpnt))
+ sd_dif_complete(SCpnt, good_bytes);
+
+- if (scsi_host_dif_capable(sdkp->device->host, sdkp->protection_type)
+- == SD_DIF_TYPE2_PROTECTION && SCpnt->cmnd != SCpnt->request->cmd) {
+-
+- /* We have to print a failed command here as the
+- * extended CDB gets freed before scsi_io_completion()
+- * is called.
+- */
+- if (result)
+- scsi_print_command(SCpnt);
+-
+- mempool_free(SCpnt->cmnd, sd_cdb_pool);
+- SCpnt->cmnd = NULL;
+- SCpnt->cmd_len = 0;
+- }
+-
+ return good_bytes;
+ }
+
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index 3799cf1..50dc93e 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -1370,6 +1370,7 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
+ void *file)
+ {
+ struct comedi_subdevice *s;
++ int ret;
+
+ if (arg >= dev->n_subdevices)
+ return -EINVAL;
+@@ -1386,7 +1387,11 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
+ if (s->busy != file)
+ return -EBUSY;
+
+- return do_cancel(dev, s);
++ ret = do_cancel(dev, s);
++ if (comedi_get_subdevice_runflags(s) & SRF_USER)
++ wake_up_interruptible(&s->async->wait_head);
++
++ return ret;
+ }
+
+ /*
+diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
+index 00c58cc..facb3ad 100644
+--- a/drivers/target/iscsi/iscsi_target_configfs.c
++++ b/drivers/target/iscsi/iscsi_target_configfs.c
+@@ -415,7 +415,7 @@ static ssize_t __iscsi_##prefix##_store_##name( \
+ if (!capable(CAP_SYS_ADMIN)) \
+ return -EPERM; \
+ \
+- snprintf(auth->name, PAGE_SIZE, "%s", page); \
++ snprintf(auth->name, sizeof(auth->name), "%s", page); \
+ if (!strncmp("NULL", auth->name, 4)) \
+ auth->naf_flags &= ~flags; \
+ else \
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 49b139c..a969ec1 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -488,6 +488,15 @@ resubmit:
+ static inline int
+ hub_clear_tt_buffer (struct usb_device *hdev, u16 devinfo, u16 tt)
+ {
++ /* Need to clear both directions for control ep */
++ if (((devinfo >> 11) & USB_ENDPOINT_XFERTYPE_MASK) ==
++ USB_ENDPOINT_XFER_CONTROL) {
++ int status = usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
++ HUB_CLEAR_TT_BUFFER, USB_RT_PORT,
++ devinfo ^ 0x8000, tt, NULL, 0, 1000);
++ if (status)
++ return status;
++ }
+ return usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+ HUB_CLEAR_TT_BUFFER, USB_RT_PORT, devinfo,
+ tt, NULL, 0, 1000);
+diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
+index 6c7945b..29a68f0a 100644
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -641,8 +641,8 @@ struct dwc3 {
+
+ struct dwc3_event_type {
+ u32 is_devspec:1;
+- u32 type:6;
+- u32 reserved8_31:25;
++ u32 type:7;
++ u32 reserved8_31:24;
+ } __packed;
+
+ #define DWC3_DEPEVT_XFERCOMPLETE 0x01
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index f62629b..6d6fb88 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1393,6 +1393,7 @@ err1:
+ __dwc3_gadget_ep_disable(dwc->eps[0]);
+
+ err0:
++ dwc->gadget_driver = NULL;
+ spin_unlock_irqrestore(&dwc->lock, flags);
+
+ return ret;
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 84e82dc..8b1c27f 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -89,7 +89,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ xhci->quirks |= XHCI_AMD_PLL_FIX;
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
+- xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
+ xhci->quirks |= XHCI_EP_LIMIT_QUIRK;
+ xhci->limit_active_eps = 64;
+ xhci->quirks |= XHCI_SW_BW_CHECKING;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 843b3e8..1770ed5 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -434,7 +434,7 @@ static void ring_doorbell_for_active_rings(struct xhci_hcd *xhci,
+
+ /* A ring has pending URBs if its TD list is not empty */
+ if (!(ep->ep_state & EP_HAS_STREAMS)) {
+- if (!(list_empty(&ep->ring->td_list)))
++ if (ep->ring && !(list_empty(&ep->ring->td_list)))
+ xhci_ring_ep_doorbell(xhci, slot_id, ep_index, 0);
+ return;
+ }
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 0f928b3..8072a93 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1162,9 +1162,6 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
+ }
+
+ xhci = hcd_to_xhci(hcd);
+- if (xhci->xhc_state & XHCI_STATE_HALTED)
+- return -ENODEV;
+-
+ if (check_virt_dev) {
+ if (!udev->slot_id || !xhci->devs[udev->slot_id]) {
+ printk(KERN_DEBUG "xHCI %s called with unaddressed "
+@@ -1180,6 +1177,9 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
+ }
+ }
+
++ if (xhci->xhc_state & XHCI_STATE_HALTED)
++ return -ENODEV;
++
+ return 1;
+ }
+
+@@ -4194,6 +4194,13 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+
+ get_quirks(dev, xhci);
+
++ /* In xhci controllers which follow xhci 1.0 spec gives a spurious
++ * success event after a short transfer. This quirk will ignore such
++ * spurious event.
++ */
++ if (xhci->hci_version > 0x96)
++ xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
++
+ /* Make sure the HC is halted. */
+ retval = xhci_halt(xhci);
+ if (retval)
+diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
+index dd573ab..7af163d 100644
+--- a/drivers/usb/misc/sisusbvga/sisusb.c
++++ b/drivers/usb/misc/sisusbvga/sisusb.c
+@@ -3247,6 +3247,7 @@ static const struct usb_device_id sisusb_table[] = {
+ { USB_DEVICE(0x0711, 0x0903) },
+ { USB_DEVICE(0x0711, 0x0918) },
+ { USB_DEVICE(0x0711, 0x0920) },
++ { USB_DEVICE(0x0711, 0x0950) },
+ { USB_DEVICE(0x182d, 0x021c) },
+ { USB_DEVICE(0x182d, 0x0269) },
+ { }
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index f8a9cd7..3e4c27d 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -745,9 +745,34 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+ { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
+- { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
+- { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) },
+- { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_RTS01_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29A_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29F_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S01_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29C_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_81B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_82B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5D_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K4Y_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5G_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S05_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_60_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_61_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_64_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_65_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92D_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_W5R_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_A5R_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_PW1_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
+ { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 6dd7925..1b8af46 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -815,11 +815,35 @@
+ /*
+ * RT Systems programming cables for various ham radios
+ */
+-#define RTSYSTEMS_VID 0x2100 /* Vendor ID */
+-#define RTSYSTEMS_SERIAL_VX7_PID 0x9e52 /* Serial converter for VX-7 Radios using FT232RL */
+-#define RTSYSTEMS_CT29B_PID 0x9e54 /* CT29B Radio Cable */
+-#define RTSYSTEMS_RTS01_PID 0x9e57 /* USB-RTS01 Radio Cable */
+-
++#define RTSYSTEMS_VID 0x2100 /* Vendor ID */
++#define RTSYSTEMS_USB_S03_PID 0x9001 /* RTS-03 USB to Serial Adapter */
++#define RTSYSTEMS_USB_59_PID 0x9e50 /* USB-59 USB to 8 pin plug */
++#define RTSYSTEMS_USB_57A_PID 0x9e51 /* USB-57A USB to 4pin 3.5mm plug */
++#define RTSYSTEMS_USB_57B_PID 0x9e52 /* USB-57B USB to extended 4pin 3.5mm plug */
++#define RTSYSTEMS_USB_29A_PID 0x9e53 /* USB-29A USB to 3.5mm stereo plug */
++#define RTSYSTEMS_USB_29B_PID 0x9e54 /* USB-29B USB to 6 pin mini din */
++#define RTSYSTEMS_USB_29F_PID 0x9e55 /* USB-29F USB to 6 pin modular plug */
++#define RTSYSTEMS_USB_62B_PID 0x9e56 /* USB-62B USB to 8 pin mini din plug*/
++#define RTSYSTEMS_USB_S01_PID 0x9e57 /* USB-RTS01 USB to 3.5 mm stereo plug*/
++#define RTSYSTEMS_USB_63_PID 0x9e58 /* USB-63 USB to 9 pin female*/
++#define RTSYSTEMS_USB_29C_PID 0x9e59 /* USB-29C USB to 4 pin modular plug*/
++#define RTSYSTEMS_USB_81B_PID 0x9e5A /* USB-81 USB to 8 pin mini din plug*/
++#define RTSYSTEMS_USB_82B_PID 0x9e5B /* USB-82 USB to 2.5 mm stereo plug*/
++#define RTSYSTEMS_USB_K5D_PID 0x9e5C /* USB-K5D USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_K4Y_PID 0x9e5D /* USB-K4Y USB to 2.5/3.5 mm plugs*/
++#define RTSYSTEMS_USB_K5G_PID 0x9e5E /* USB-K5G USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_S05_PID 0x9e5F /* USB-RTS05 USB to 2.5 mm stereo plug*/
++#define RTSYSTEMS_USB_60_PID 0x9e60 /* USB-60 USB to 6 pin din*/
++#define RTSYSTEMS_USB_61_PID 0x9e61 /* USB-61 USB to 6 pin mini din*/
++#define RTSYSTEMS_USB_62_PID 0x9e62 /* USB-62 USB to 8 pin mini din*/
++#define RTSYSTEMS_USB_63B_PID 0x9e63 /* USB-63 USB to 9 pin female*/
++#define RTSYSTEMS_USB_64_PID 0x9e64 /* USB-64 USB to 9 pin male*/
++#define RTSYSTEMS_USB_65_PID 0x9e65 /* USB-65 USB to 9 pin female null modem*/
++#define RTSYSTEMS_USB_92_PID 0x9e66 /* USB-92 USB to 12 pin plug*/
++#define RTSYSTEMS_USB_92D_PID 0x9e67 /* USB-92D USB to 12 pin plug data*/
++#define RTSYSTEMS_USB_W5R_PID 0x9e68 /* USB-W5R USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_A5R_PID 0x9e69 /* USB-A5R USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_PW1_PID 0x9e6A /* USB-PW1 USB to 8 pin modular plug*/
+
+ /*
+ * Physik Instrumente
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index a39a08c..a7492ba 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -390,7 +390,7 @@ static int ti_startup(struct usb_serial *serial)
+ usb_set_serial_data(serial, tdev);
+
+ /* determine device type */
+- if (usb_match_id(serial->interface, ti_id_table_3410))
++ if (serial->type == &ti_1port_device)
+ tdev->td_is_3410 = 1;
+ dbg("%s - device type is %s", __func__,
+ tdev->td_is_3410 ? "3410" : "5052");
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 8ee632c..cf442e0 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -657,6 +657,13 @@ UNUSUAL_DEV( 0x054c, 0x016a, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_FIX_INQUIRY ),
+
++/* Submitted by Ren Bigcren <bigcren.ren@sonymobile.com> */
++UNUSUAL_DEV( 0x054c, 0x02a5, 0x0100, 0x0100,
++ "Sony Corp.",
++ "MicroVault Flash Drive",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_READ_CAPACITY_16 ),
++
+ /* floppy reports multiple luns */
+ UNUSUAL_DEV( 0x055d, 0x2020, 0x0000, 0x0210,
+ "SAMSUNG",
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 52bfd07..c212de7 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -498,16 +498,18 @@ EXPORT_SYMBOL_GPL(virtqueue_disable_cb);
+ * virtqueue_enable_cb - restart callbacks after disable_cb.
+ * @vq: the struct virtqueue we're talking about.
+ *
+- * This re-enables callbacks; it returns "false" if there are pending
+- * buffers in the queue, to detect a possible race between the driver
+- * checking for more work, and enabling callbacks.
++ * This re-enables callbacks; it returns current queue state
++ * in an opaque unsigned value. This value should be later tested by
++ * virtqueue_poll, to detect a possible race between the driver checking for
++ * more work, and enabling callbacks.
+ *
+ * Caller must ensure we don't call this with other virtqueue
+ * operations at the same time (except where noted).
+ */
+-bool virtqueue_enable_cb(struct virtqueue *_vq)
++unsigned virtqueue_enable_cb_prepare(struct virtqueue *_vq)
+ {
+ struct vring_virtqueue *vq = to_vvq(_vq);
++ u16 last_used_idx;
+
+ START_USE(vq);
+
+@@ -517,15 +519,45 @@ bool virtqueue_enable_cb(struct virtqueue *_vq)
+ * either clear the flags bit or point the event index at the next
+ * entry. Always do both to keep code simple. */
+ vq->vring.avail->flags &= ~VRING_AVAIL_F_NO_INTERRUPT;
+- vring_used_event(&vq->vring) = vq->last_used_idx;
++ vring_used_event(&vq->vring) = last_used_idx = vq->last_used_idx;
++ END_USE(vq);
++ return last_used_idx;
++}
++EXPORT_SYMBOL_GPL(virtqueue_enable_cb_prepare);
++
++/**
++ * virtqueue_poll - query pending used buffers
++ * @vq: the struct virtqueue we're talking about.
++ * @last_used_idx: virtqueue state (from call to virtqueue_enable_cb_prepare).
++ *
++ * Returns "true" if there are pending used buffers in the queue.
++ *
++ * This does not need to be serialized.
++ */
++bool virtqueue_poll(struct virtqueue *_vq, unsigned last_used_idx)
++{
++ struct vring_virtqueue *vq = to_vvq(_vq);
++
+ virtio_mb(vq);
+- if (unlikely(more_used(vq))) {
+- END_USE(vq);
+- return false;
+- }
++ return (u16)last_used_idx != vq->vring.used->idx;
++}
++EXPORT_SYMBOL_GPL(virtqueue_poll);
+
+- END_USE(vq);
+- return true;
++/**
++ * virtqueue_enable_cb - restart callbacks after disable_cb.
++ * @vq: the struct virtqueue we're talking about.
++ *
++ * This re-enables callbacks; it returns "false" if there are pending
++ * buffers in the queue, to detect a possible race between the driver
++ * checking for more work, and enabling callbacks.
++ *
++ * Caller must ensure we don't call this with other virtqueue
++ * operations at the same time (except where noted).
++ */
++bool virtqueue_enable_cb(struct virtqueue *_vq)
++{
++ unsigned last_used_idx = virtqueue_enable_cb_prepare(_vq);
++ return !virtqueue_poll(_vq, last_used_idx);
+ }
+ EXPORT_SYMBOL_GPL(virtqueue_enable_cb);
+
+diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
+index b2db77e..82b27d4 100644
+--- a/drivers/xen/evtchn.c
++++ b/drivers/xen/evtchn.c
+@@ -377,18 +377,12 @@ static long evtchn_ioctl(struct file *file,
+ if (unbind.port >= NR_EVENT_CHANNELS)
+ break;
+
+- spin_lock_irq(&port_user_lock);
+-
+ rc = -ENOTCONN;
+- if (get_port_user(unbind.port) != u) {
+- spin_unlock_irq(&port_user_lock);
++ if (get_port_user(unbind.port) != u)
+ break;
+- }
+
+ disable_irq(irq_from_evtchn(unbind.port));
+
+- spin_unlock_irq(&port_user_lock);
+-
+ evtchn_unbind_from_user(u, unbind.port);
+
+ rc = 0;
+@@ -488,26 +482,15 @@ static int evtchn_release(struct inode *inode, struct file *filp)
+ int i;
+ struct per_user_data *u = filp->private_data;
+
+- spin_lock_irq(&port_user_lock);
+-
+- free_page((unsigned long)u->ring);
+-
+ for (i = 0; i < NR_EVENT_CHANNELS; i++) {
+ if (get_port_user(i) != u)
+ continue;
+
+ disable_irq(irq_from_evtchn(i));
+- }
+-
+- spin_unlock_irq(&port_user_lock);
+-
+- for (i = 0; i < NR_EVENT_CHANNELS; i++) {
+- if (get_port_user(i) != u)
+- continue;
+-
+ evtchn_unbind_from_user(get_port_user(i), i);
+ }
+
++ free_page((unsigned long)u->ring);
+ kfree(u->name);
+ kfree(u);
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index fef1f21..c4f0a99 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -6846,6 +6846,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
+ int err = 0;
+ int ret;
+ int level;
++ bool root_dropped = false;
+
+ path = btrfs_alloc_path();
+ if (!path) {
+@@ -6903,6 +6904,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
+ while (1) {
+ btrfs_tree_lock(path->nodes[level]);
+ btrfs_set_lock_blocking(path->nodes[level]);
++ path->locks[level] = BTRFS_WRITE_LOCK_BLOCKING;
+
+ ret = btrfs_lookup_extent_info(trans, root,
+ path->nodes[level]->start,
+@@ -6919,6 +6921,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
+ break;
+
+ btrfs_tree_unlock(path->nodes[level]);
++ path->locks[level] = 0;
+ WARN_ON(wc->refs[level] != 1);
+ level--;
+ }
+@@ -7014,12 +7017,22 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
+ free_extent_buffer(root->commit_root);
+ kfree(root);
+ }
++ root_dropped = true;
+ out_end_trans:
+ btrfs_end_transaction_throttle(trans, tree_root);
+ out_free:
+ kfree(wc);
+ btrfs_free_path(path);
+ out:
++ /*
++ * So if we need to stop dropping the snapshot for whatever reason we
++ * need to make sure to add it back to the dead root list so that we
++ * keep trying to do the work later. This also cleans up roots if we
++ * don't have it in the radix (like when we recover after a power fail
++ * or unmount) so we don't leak memory.
++ */
++ if (root_dropped == false)
++ btrfs_add_dead_root(root);
+ if (err)
+ btrfs_std_error(root->fs_info, err);
+ return err;
+diff --git a/fs/super.c b/fs/super.c
+index cf00177..3c520a5 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -298,19 +298,19 @@ EXPORT_SYMBOL(deactivate_super);
+ * and want to turn it into a full-blown active reference. grab_super()
+ * is called with sb_lock held and drops it. Returns 1 in case of
+ * success, 0 if we had failed (superblock contents was already dead or
+- * dying when grab_super() had been called).
++ * dying when grab_super() had been called). Note that this is only
++ * called for superblocks not in rundown mode (== ones still on ->fs_supers
++ * of their type), so increment of ->s_count is OK here.
+ */
+ static int grab_super(struct super_block *s) __releases(sb_lock)
+ {
+- if (atomic_inc_not_zero(&s->s_active)) {
+- spin_unlock(&sb_lock);
+- return 1;
+- }
+- /* it's going away */
+ s->s_count++;
+ spin_unlock(&sb_lock);
+- /* wait for it to die */
+ down_write(&s->s_umount);
++ if ((s->s_flags & MS_BORN) && atomic_inc_not_zero(&s->s_active)) {
++ put_super(s);
++ return 1;
++ }
+ up_write(&s->s_umount);
+ put_super(s);
+ return 0;
+@@ -440,11 +440,6 @@ retry:
+ destroy_super(s);
+ s = NULL;
+ }
+- down_write(&old->s_umount);
+- if (unlikely(!(old->s_flags & MS_BORN))) {
+- deactivate_locked_super(old);
+- goto retry;
+- }
+ return old;
+ }
+ }
+@@ -677,10 +672,10 @@ restart:
+ if (hlist_unhashed(&sb->s_instances))
+ continue;
+ if (sb->s_bdev == bdev) {
+- if (grab_super(sb)) /* drops sb_lock */
+- return sb;
+- else
++ if (!grab_super(sb))
+ goto restart;
++ up_write(&sb->s_umount);
++ return sb;
+ }
+ }
+ spin_unlock(&sb_lock);
+diff --git a/include/linux/firewire-cdev.h b/include/linux/firewire-cdev.h
+index d500369..1db453e 100644
+--- a/include/linux/firewire-cdev.h
++++ b/include/linux/firewire-cdev.h
+@@ -215,8 +215,8 @@ struct fw_cdev_event_request2 {
+ * with the %FW_CDEV_ISO_INTERRUPT bit set, when explicitly requested with
+ * %FW_CDEV_IOC_FLUSH_ISO, or when there have been so many completed packets
+ * without the interrupt bit set that the kernel's internal buffer for @header
+- * is about to overflow. (In the last case, kernels with ABI version < 5 drop
+- * header data up to the next interrupt packet.)
++ * is about to overflow. (In the last case, ABI versions < 5 drop header data
++ * up to the next interrupt packet.)
+ *
+ * Isochronous transmit events (context type %FW_CDEV_ISO_CONTEXT_TRANSMIT):
+ *
+diff --git a/include/linux/firewire.h b/include/linux/firewire.h
+index cdc9b71..4d259fc 100644
+--- a/include/linux/firewire.h
++++ b/include/linux/firewire.h
+@@ -409,6 +409,7 @@ struct fw_iso_context {
+ int type;
+ int channel;
+ int speed;
++ bool drop_overflow_headers;
+ size_t header_size;
+ union {
+ fw_iso_callback_t sc;
+diff --git a/include/linux/virtio.h b/include/linux/virtio.h
+index 8efd28a..2b779bf 100644
+--- a/include/linux/virtio.h
++++ b/include/linux/virtio.h
+@@ -44,6 +44,10 @@ void virtqueue_disable_cb(struct virtqueue *vq);
+
+ bool virtqueue_enable_cb(struct virtqueue *vq);
+
++unsigned virtqueue_enable_cb_prepare(struct virtqueue *vq);
++
++bool virtqueue_poll(struct virtqueue *vq, unsigned);
++
+ bool virtqueue_enable_cb_delayed(struct virtqueue *vq);
+
+ void *virtqueue_detach_unused_buf(struct virtqueue *vq);
+diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
+index e675182..c9ce09a 100644
+--- a/kernel/trace/trace_syscalls.c
++++ b/kernel/trace/trace_syscalls.c
+@@ -358,6 +358,9 @@ void ftrace_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
+ if (!sys_data)
+ return;
+
++ local_save_flags(irq_flags);
++ pc = preempt_count();
++
+ event = trace_current_buffer_lock_reserve(&buffer,
+ sys_data->exit_event->event.type, sizeof(*entry),
+ irq_flags, pc);
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 533ea80..8090542 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5592,6 +5592,10 @@ __offline_isolated_pages(unsigned long start_pfn, unsigned long end_pfn)
+ zone->free_area[order].nr_free--;
+ __mod_zone_page_state(zone, NR_FREE_PAGES,
+ - (1UL << order));
++#ifdef CONFIG_HIGHMEM
++ if (PageHighMem(page))
++ totalhigh_pages -= 1 << order;
++#endif
+ for (i = 0; i < (1 << order); i++)
+ SetPageReserved((page+i));
+ pfn += (1 << order);
+diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c
+index 4790568..8df4597 100644
+--- a/sound/soc/codecs/max98088.c
++++ b/sound/soc/codecs/max98088.c
+@@ -1594,7 +1594,7 @@ static int max98088_dai2_digital_mute(struct snd_soc_dai *codec_dai, int mute)
+
+ static void max98088_sync_cache(struct snd_soc_codec *codec)
+ {
+- u16 *reg_cache = codec->reg_cache;
++ u8 *reg_cache = codec->reg_cache;
+ int i;
+
+ if (!codec->cache_sync)
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 96f6f9f..e96c6ed 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -1599,7 +1599,6 @@ static int wm8962_put_hp_sw(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_value *ucontrol)
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+- u16 *reg_cache = codec->reg_cache;
+ int ret;
+
+ /* Apply the update (if any) */
+@@ -1608,16 +1607,19 @@ static int wm8962_put_hp_sw(struct snd_kcontrol *kcontrol,
+ return 0;
+
+ /* If the left PGA is enabled hit that VU bit... */
+- if (snd_soc_read(codec, WM8962_PWR_MGMT_2) & WM8962_HPOUTL_PGA_ENA)
+- return snd_soc_write(codec, WM8962_HPOUTL_VOLUME,
+- reg_cache[WM8962_HPOUTL_VOLUME]);
++ ret = snd_soc_read(codec, WM8962_PWR_MGMT_2);
++ if (ret & WM8962_HPOUTL_PGA_ENA) {
++ snd_soc_write(codec, WM8962_HPOUTL_VOLUME,
++ snd_soc_read(codec, WM8962_HPOUTL_VOLUME));
++ return 1;
++ }
+
+ /* ...otherwise the right. The VU is stereo. */
+- if (snd_soc_read(codec, WM8962_PWR_MGMT_2) & WM8962_HPOUTR_PGA_ENA)
+- return snd_soc_write(codec, WM8962_HPOUTR_VOLUME,
+- reg_cache[WM8962_HPOUTR_VOLUME]);
++ if (ret & WM8962_HPOUTR_PGA_ENA)
++ snd_soc_write(codec, WM8962_HPOUTR_VOLUME,
++ snd_soc_read(codec, WM8962_HPOUTR_VOLUME));
+
+- return 0;
++ return 1;
+ }
+
+ /* The VU bits for the speakers are in a different register to the mute
+@@ -3363,7 +3365,6 @@ static int wm8962_probe(struct snd_soc_codec *codec)
+ int ret;
+ struct wm8962_priv *wm8962 = snd_soc_codec_get_drvdata(codec);
+ struct wm8962_pdata *pdata = dev_get_platdata(codec->dev);
+- u16 *reg_cache = codec->reg_cache;
+ int i, trigger, irq_pol;
+ bool dmicclk, dmicdat;
+
+@@ -3421,8 +3422,9 @@ static int wm8962_probe(struct snd_soc_codec *codec)
+
+ /* Put the speakers into mono mode? */
+ if (pdata->spk_mono)
+- reg_cache[WM8962_CLASS_D_CONTROL_2]
+- |= WM8962_SPK_MONO;
++ snd_soc_update_bits(codec, WM8962_CLASS_D_CONTROL_2,
++ WM8962_SPK_MONO_MASK, WM8962_SPK_MONO);
++
+
+ /* Micbias setup, detection enable and detection
+ * threasholds. */
Added: genpatches-2.6/trunk/3.4/1056_linux-3.4.57.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1056_linux-3.4.57.patch (rev 0)
+++ genpatches-2.6/trunk/3.4/1056_linux-3.4.57.patch 2013-08-12 10:42:00 UTC (rev 2471)
@@ -0,0 +1,743 @@
+diff --git a/Makefile b/Makefile
+index 2fe1f6d..7f4df0c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 56
++SUBLEVEL = 57
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
+index 2d6e649..6610e81 100644
+--- a/arch/x86/kernel/i387.c
++++ b/arch/x86/kernel/i387.c
+@@ -132,7 +132,7 @@ static void __cpuinit mxcsr_feature_mask_init(void)
+ clts();
+ if (cpu_has_fxsr) {
+ memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct));
+- asm volatile("fxsave %0" : : "m" (fx_scratch));
++ asm volatile("fxsave %0" : "+m" (fx_scratch));
+ mask = fx_scratch.mxcsr_mask;
+ if (mask == 0)
+ mask = 0x0000ffbf;
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index 6ea287e2..9bdfcf5 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -117,6 +117,7 @@ struct acpi_battery {
+ struct acpi_device *device;
+ struct notifier_block pm_nb;
+ unsigned long update_time;
++ int revision;
+ int rate_now;
+ int capacity_now;
+ int voltage_now;
+@@ -350,6 +351,7 @@ static struct acpi_offsets info_offsets[] = {
+ };
+
+ static struct acpi_offsets extended_info_offsets[] = {
++ {offsetof(struct acpi_battery, revision), 0},
+ {offsetof(struct acpi_battery, power_unit), 0},
+ {offsetof(struct acpi_battery, design_capacity), 0},
+ {offsetof(struct acpi_battery, full_charge_capacity), 0},
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 45c5cf8..232119a 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -296,6 +296,7 @@ enum intel_pch {
+
+ #define QUIRK_PIPEA_FORCE (1<<0)
+ #define QUIRK_LVDS_SSC_DISABLE (1<<1)
++#define QUIRK_NO_PCH_PWM_ENABLE (1<<2)
+
+ struct intel_fbdev;
+ struct intel_fbc_work;
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 84867a8..0e35922 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -9160,6 +9160,17 @@ static void quirk_ssc_force_disable(struct drm_device *dev)
+ dev_priv->quirks |= QUIRK_LVDS_SSC_DISABLE;
+ }
+
++/*
++ * Some machines (Dell XPS13) suffer broken backlight controls if
++ * BLM_PCH_PWM_ENABLE is set.
++ */
++static void quirk_no_pcm_pwm_enable(struct drm_device *dev)
++{
++ struct drm_i915_private *dev_priv = dev->dev_private;
++ dev_priv->quirks |= QUIRK_NO_PCH_PWM_ENABLE;
++ DRM_INFO("applying no-PCH_PWM_ENABLE quirk\n");
++}
++
+ struct intel_quirk {
+ int device;
+ int subsystem_vendor;
+@@ -9192,6 +9203,11 @@ struct intel_quirk intel_quirks[] = {
+
+ /* Sony Vaio Y cannot use SSC on LVDS */
+ { 0x0046, 0x104d, 0x9076, quirk_ssc_force_disable },
++
++ /* Dell XPS13 HD Sandy Bridge */
++ { 0x0116, 0x1028, 0x052e, quirk_no_pcm_pwm_enable },
++ /* Dell XPS13 HD and XPS13 FHD Ivy Bridge */
++ { 0x0166, 0x1028, 0x058b, quirk_no_pcm_pwm_enable },
+ };
+
+ static void intel_init_quirks(struct drm_device *dev)
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index 207180d..ab4d990 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -1097,7 +1097,8 @@ bool intel_lvds_init(struct drm_device *dev)
+ goto failed;
+
+ out:
+- if (HAS_PCH_SPLIT(dev)) {
++ if (HAS_PCH_SPLIT(dev) &&
++ !(dev_priv->quirks & QUIRK_NO_PCH_PWM_ENABLE)) {
+ u32 pwm;
+
+ pipe = (I915_READ(PCH_LVDS) & LVDS_PIPEB_SELECT) ? 1 : 0;
+diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
+index a746ba2..a956053 100644
+--- a/drivers/net/arcnet/arcnet.c
++++ b/drivers/net/arcnet/arcnet.c
+@@ -1007,7 +1007,7 @@ static void arcnet_rx(struct net_device *dev, int bufnum)
+
+ soft = &pkt.soft.rfc1201;
+
+- lp->hw.copy_from_card(dev, bufnum, 0, &pkt, sizeof(ARC_HDR_SIZE));
++ lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE);
+ if (pkt.hard.offset[0]) {
+ ofs = pkt.hard.offset[0];
+ length = 256 - ofs;
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
+index d3695ed..a061e37 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
+@@ -108,9 +108,8 @@ s32 ixgbe_dcb_config_tx_desc_arbiter_82598(struct ixgbe_hw *hw,
+
+ /* Enable arbiter */
+ reg &= ~IXGBE_DPMCS_ARBDIS;
+- /* Enable DFP and Recycle mode */
+- reg |= (IXGBE_DPMCS_TDPAC | IXGBE_DPMCS_TRM);
+ reg |= IXGBE_DPMCS_TSOEF;
++
+ /* Configure Max TSO packet size 34KB including payload and headers */
+ reg |= (0x4 << IXGBE_DPMCS_MTSOS_SHIFT);
+
+diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
+index 4ce981c..2205db7 100644
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -478,7 +478,7 @@ rx_status_loop:
+
+ while (1) {
+ u32 status, len;
+- dma_addr_t mapping;
++ dma_addr_t mapping, new_mapping;
+ struct sk_buff *skb, *new_skb;
+ struct cp_desc *desc;
+ const unsigned buflen = cp->rx_buf_sz;
+@@ -520,6 +520,13 @@ rx_status_loop:
+ goto rx_next;
+ }
+
++ new_mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
++ PCI_DMA_FROMDEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, new_mapping)) {
++ dev->stats.rx_dropped++;
++ goto rx_next;
++ }
++
+ dma_unmap_single(&cp->pdev->dev, mapping,
+ buflen, PCI_DMA_FROMDEVICE);
+
+@@ -531,12 +538,11 @@ rx_status_loop:
+
+ skb_put(skb, len);
+
+- mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
+- PCI_DMA_FROMDEVICE);
+ cp->rx_skb[rx_tail] = new_skb;
+
+ cp_rx_skb(cp, skb, desc);
+ rx++;
++ mapping = new_mapping;
+
+ rx_next:
+ cp->rx_ring[rx_tail].opts2 = 0;
+@@ -704,6 +710,22 @@ static inline u32 cp_tx_vlan_tag(struct sk_buff *skb)
+ TxVlanTag | swab16(vlan_tx_tag_get(skb)) : 0x00;
+ }
+
++static void unwind_tx_frag_mapping(struct cp_private *cp, struct sk_buff *skb,
++ int first, int entry_last)
++{
++ int frag, index;
++ struct cp_desc *txd;
++ skb_frag_t *this_frag;
++ for (frag = 0; frag+first < entry_last; frag++) {
++ index = first+frag;
++ cp->tx_skb[index] = NULL;
++ txd = &cp->tx_ring[index];
++ this_frag = &skb_shinfo(skb)->frags[frag];
++ dma_unmap_single(&cp->pdev->dev, le64_to_cpu(txd->addr),
++ skb_frag_size(this_frag), PCI_DMA_TODEVICE);
++ }
++}
++
+ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ struct net_device *dev)
+ {
+@@ -737,6 +759,9 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+
+ len = skb->len;
+ mapping = dma_map_single(&cp->pdev->dev, skb->data, len, PCI_DMA_TODEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, mapping))
++ goto out_dma_error;
++
+ txd->opts2 = opts2;
+ txd->addr = cpu_to_le64(mapping);
+ wmb();
+@@ -774,6 +799,9 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ first_len = skb_headlen(skb);
+ first_mapping = dma_map_single(&cp->pdev->dev, skb->data,
+ first_len, PCI_DMA_TODEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, first_mapping))
++ goto out_dma_error;
++
+ cp->tx_skb[entry] = skb;
+ entry = NEXT_TX(entry);
+
+@@ -787,6 +815,11 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ mapping = dma_map_single(&cp->pdev->dev,
+ skb_frag_address(this_frag),
+ len, PCI_DMA_TODEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, mapping)) {
++ unwind_tx_frag_mapping(cp, skb, first_entry, entry);
++ goto out_dma_error;
++ }
++
+ eor = (entry == (CP_TX_RING_SIZE - 1)) ? RingEnd : 0;
+
+ ctrl = eor | len | DescOwn;
+@@ -845,11 +878,16 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ if (TX_BUFFS_AVAIL(cp) <= (MAX_SKB_FRAGS + 1))
+ netif_stop_queue(dev);
+
++out_unlock:
+ spin_unlock_irqrestore(&cp->lock, intr_flags);
+
+ cpw8(TxPoll, NormalTxPoll);
+
+ return NETDEV_TX_OK;
++out_dma_error:
++ kfree_skb(skb);
++ cp->dev->stats.tx_dropped++;
++ goto out_unlock;
+ }
+
+ /* Set or clear the multicast filter for this adaptor.
+@@ -1020,6 +1058,10 @@ static int cp_refill_rx(struct cp_private *cp)
+
+ mapping = dma_map_single(&cp->pdev->dev, skb->data,
+ cp->rx_buf_sz, PCI_DMA_FROMDEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, mapping)) {
++ kfree_skb(skb);
++ goto err_out;
++ }
+ cp->rx_skb[i] = skb;
+
+ cp->rx_ring[i].opts2 = 0;
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index 5caba55..d89747a 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -43,7 +43,6 @@
+ #define EEPROM_MAC_OFFSET (0x01)
+ #define DEFAULT_TX_CSUM_ENABLE (true)
+ #define DEFAULT_RX_CSUM_ENABLE (true)
+-#define DEFAULT_TSO_ENABLE (true)
+ #define SMSC75XX_INTERNAL_PHY_ID (1)
+ #define SMSC75XX_TX_OVERHEAD (8)
+ #define MAX_RX_FIFO_SIZE (20 * 1024)
+@@ -1049,17 +1048,14 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
+
+ INIT_WORK(&pdata->set_multicast, smsc75xx_deferred_multicast_write);
+
+- if (DEFAULT_TX_CSUM_ENABLE) {
++ if (DEFAULT_TX_CSUM_ENABLE)
+ dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+- if (DEFAULT_TSO_ENABLE)
+- dev->net->features |= NETIF_F_SG |
+- NETIF_F_TSO | NETIF_F_TSO6;
+- }
++
+ if (DEFAULT_RX_CSUM_ENABLE)
+ dev->net->features |= NETIF_F_RXCSUM;
+
+ dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+- NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_RXCSUM;
++ NETIF_F_RXCSUM;
+
+ /* Init all registers */
+ ret = smsc75xx_reset(dev);
+@@ -1184,8 +1180,6 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
+ {
+ u32 tx_cmd_a, tx_cmd_b;
+
+- skb_linearize(skb);
+-
+ if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
+ struct sk_buff *skb2 =
+ skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index 41c5237..2b8406a 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -821,6 +821,7 @@ static int ath9k_init_device(struct ath9k_htc_priv *priv,
+ if (error != 0)
+ goto err_rx;
+
++ ath9k_hw_disable(priv->ah);
+ #ifdef CONFIG_MAC80211_LEDS
+ /* must be initialized before ieee80211_register_hw */
+ priv->led_cdev.default_trigger = ieee80211_create_tpt_led_trigger(priv->hw,
+diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
+index 7d00a87..4be8ccc 100644
+--- a/drivers/net/wireless/mwifiex/sdio.c
++++ b/drivers/net/wireless/mwifiex/sdio.c
+@@ -1449,8 +1449,8 @@ static int mwifiex_sdio_host_to_card(struct mwifiex_adapter *adapter,
+ /* Allocate buffer and copy payload */
+ blk_size = MWIFIEX_SDIO_BLOCK_SIZE;
+ buf_block_len = (pkt_len + blk_size - 1) / blk_size;
+- *(u16 *) &payload[0] = (u16) pkt_len;
+- *(u16 *) &payload[2] = type;
++ *(__le16 *)&payload[0] = cpu_to_le16((u16)pkt_len);
++ *(__le16 *)&payload[2] = cpu_to_le16(type);
+
+ /*
+ * This is SDIO specific header
+diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
+index 50f92d5..4d792a2 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
+@@ -856,13 +856,8 @@ void rt2x00queue_index_inc(struct queue_entry *entry, enum queue_index index)
+ spin_unlock_irqrestore(&queue->index_lock, irqflags);
+ }
+
+-void rt2x00queue_pause_queue(struct data_queue *queue)
++void rt2x00queue_pause_queue_nocheck(struct data_queue *queue)
+ {
+- if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
+- !test_bit(QUEUE_STARTED, &queue->flags) ||
+- test_and_set_bit(QUEUE_PAUSED, &queue->flags))
+- return;
+-
+ switch (queue->qid) {
+ case QID_AC_VO:
+ case QID_AC_VI:
+@@ -878,6 +873,15 @@ void rt2x00queue_pause_queue(struct data_queue *queue)
+ break;
+ }
+ }
++void rt2x00queue_pause_queue(struct data_queue *queue)
++{
++ if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
++ !test_bit(QUEUE_STARTED, &queue->flags) ||
++ test_and_set_bit(QUEUE_PAUSED, &queue->flags))
++ return;
++
++ rt2x00queue_pause_queue_nocheck(queue);
++}
+ EXPORT_SYMBOL_GPL(rt2x00queue_pause_queue);
+
+ void rt2x00queue_unpause_queue(struct data_queue *queue)
+@@ -939,7 +943,7 @@ void rt2x00queue_stop_queue(struct data_queue *queue)
+ return;
+ }
+
+- rt2x00queue_pause_queue(queue);
++ rt2x00queue_pause_queue_nocheck(queue);
+
+ queue->rt2x00dev->ops->lib->stop_queue(queue);
+
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 039c054..c75b27b 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -375,11 +375,18 @@ static void mxs_auart_settermios(struct uart_port *u,
+
+ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
+ {
+- u32 istatus, istat;
++ u32 istat;
+ struct mxs_auart_port *s = context;
+ u32 stat = readl(s->port.membase + AUART_STAT);
+
+- istatus = istat = readl(s->port.membase + AUART_INTR);
++ istat = readl(s->port.membase + AUART_INTR);
++
++ /* ack irq */
++ writel(istat & (AUART_INTR_RTIS
++ | AUART_INTR_TXIS
++ | AUART_INTR_RXIS
++ | AUART_INTR_CTSMIS),
++ s->port.membase + AUART_INTR_CLR);
+
+ if (istat & AUART_INTR_CTSMIS) {
+ uart_handle_cts_change(&s->port, stat & AUART_STAT_CTS);
+@@ -398,12 +405,6 @@ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
+ istat &= ~AUART_INTR_TXIS;
+ }
+
+- writel(istatus & (AUART_INTR_RTIS
+- | AUART_INTR_TXIS
+- | AUART_INTR_RXIS
+- | AUART_INTR_CTSMIS),
+- s->port.membase + AUART_INTR_CLR);
+-
+ return IRQ_HANDLED;
+ }
+
+@@ -543,7 +544,7 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
+ struct mxs_auart_port *s;
+ struct uart_port *port;
+ unsigned int old_ctrl0, old_ctrl2;
+- unsigned int to = 1000;
++ unsigned int to = 20000;
+
+ if (co->index > MXS_AUART_PORTS || co->index < 0)
+ return;
+@@ -564,18 +565,23 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
+
+ uart_console_write(port, str, count, mxs_auart_console_putchar);
+
+- /*
+- * Finally, wait for transmitter to become empty
+- * and restore the TCR
+- */
++ /* Finally, wait for transmitter to become empty ... */
+ while (readl(port->membase + AUART_STAT) & AUART_STAT_BUSY) {
++ udelay(1);
+ if (!to--)
+ break;
+- udelay(1);
+ }
+
+- writel(old_ctrl0, port->membase + AUART_CTRL0);
+- writel(old_ctrl2, port->membase + AUART_CTRL2);
++ /*
++ * ... and restore the TCR if we waited long enough for the transmitter
++ * to be idle. This might keep the transmitter enabled although it is
++ * unused, but that is better than to disable it while it is still
++ * transmitting.
++ */
++ if (!(readl(port->membase + AUART_STAT) & AUART_STAT_BUSY)) {
++ writel(old_ctrl0, port->membase + AUART_CTRL0);
++ writel(old_ctrl2, port->membase + AUART_CTRL2);
++ }
+
+ clk_disable(s->clk);
+ }
+diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
+index 3568c8a..48bc91d 100644
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -120,6 +120,7 @@ static int fill_event_metadata(struct fsnotify_group *group,
+ metadata->event_len = FAN_EVENT_METADATA_LEN;
+ metadata->metadata_len = FAN_EVENT_METADATA_LEN;
+ metadata->vers = FANOTIFY_METADATA_VERSION;
++ metadata->reserved = 0;
+ metadata->mask = event->mask & FAN_ALL_OUTGOING_EVENTS;
+ metadata->pid = pid_vnr(event->tgid);
+ if (unlikely(event->mask & FAN_Q_OVERFLOW))
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index d074cf0..8e810ba 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -250,9 +250,9 @@ perf_cgroup_match(struct perf_event *event)
+ return !event->cgrp || event->cgrp == cpuctx->cgrp;
+ }
+
+-static inline void perf_get_cgroup(struct perf_event *event)
++static inline bool perf_tryget_cgroup(struct perf_event *event)
+ {
+- css_get(&event->cgrp->css);
++ return css_tryget(&event->cgrp->css);
+ }
+
+ static inline void perf_put_cgroup(struct perf_event *event)
+@@ -481,7 +481,11 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,
+ event->cgrp = cgrp;
+
+ /* must be done before we fput() the file */
+- perf_get_cgroup(event);
++ if (!perf_tryget_cgroup(event)) {
++ event->cgrp = NULL;
++ ret = -ENOENT;
++ goto out;
++ }
+
+ /*
+ * all events in a group must monitor
+@@ -911,6 +915,15 @@ list_add_event(struct perf_event *event, struct perf_event_context *ctx)
+ }
+
+ /*
++ * Initialize event state based on the perf_event_attr::disabled.
++ */
++static inline void perf_event__state_init(struct perf_event *event)
++{
++ event->state = event->attr.disabled ? PERF_EVENT_STATE_OFF :
++ PERF_EVENT_STATE_INACTIVE;
++}
++
++/*
+ * Called at perf_event creation and when events are attached/detached from a
+ * group.
+ */
+@@ -6058,8 +6071,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+ event->overflow_handler = overflow_handler;
+ event->overflow_handler_context = context;
+
+- if (attr->disabled)
+- event->state = PERF_EVENT_STATE_OFF;
++ perf_event__state_init(event);
+
+ pmu = NULL;
+
+@@ -6481,9 +6493,17 @@ SYSCALL_DEFINE5(perf_event_open,
+
+ mutex_lock(&gctx->mutex);
+ perf_remove_from_context(group_leader);
++
++ /*
++ * Removing from the context ends up with disabled
++ * event. What we want here is event in the initial
++ * startup state, ready to be add into new context.
++ */
++ perf_event__state_init(group_leader);
+ list_for_each_entry(sibling, &group_leader->sibling_list,
+ group_entry) {
+ perf_remove_from_context(sibling);
++ perf_event__state_init(sibling);
+ put_ctx(gctx);
+ }
+ mutex_unlock(&gctx->mutex);
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index e955364..da4512f 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -5511,7 +5511,7 @@ static unsigned int get_rr_interval_fair(struct rq *rq, struct task_struct *task
+ * idle runqueue:
+ */
+ if (rq->cfs.load.weight)
+- rr_interval = NS_TO_JIFFIES(sched_slice(&rq->cfs, se));
++ rr_interval = NS_TO_JIFFIES(sched_slice(cfs_rq_of(se), se));
+
+ return rr_interval;
+ }
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index bf7a604..086c973 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -34,6 +34,8 @@ static int tcp_adv_win_scale_min = -31;
+ static int tcp_adv_win_scale_max = 31;
+ static int ip_ttl_min = 1;
+ static int ip_ttl_max = 255;
++static int tcp_syn_retries_min = 1;
++static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
+ static int ip_ping_group_range_min[] = { 0, 0 };
+ static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
+
+@@ -276,7 +278,9 @@ static struct ctl_table ipv4_table[] = {
+ .data = &sysctl_tcp_syn_retries,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &tcp_syn_retries_min,
++ .extra2 = &tcp_syn_retries_max
+ },
+ {
+ .procname = "tcp_synack_retries",
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index 8110362..d5e4615 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -256,10 +256,12 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
+ {
+ struct mr6_table *mrt, *next;
+
++ rtnl_lock();
+ list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
+ list_del(&mrt->list);
+ ip6mr_free_table(mrt);
+ }
++ rtnl_unlock();
+ fib_rules_unregister(net->ipv6.mr6_rules_ops);
+ }
+ #else
+@@ -286,7 +288,10 @@ static int __net_init ip6mr_rules_init(struct net *net)
+
+ static void __net_exit ip6mr_rules_exit(struct net *net)
+ {
++ rtnl_lock();
+ ip6mr_free_table(net->ipv6.mrt6);
++ net->ipv6.mrt6 = NULL;
++ rtnl_unlock();
+ }
+ #endif
+
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 5bbab6a..60109f4 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2073,6 +2073,7 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, const struct xfrm_policy *
+ pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
+ }
+ pol->sadb_x_policy_dir = dir+1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = xp->index;
+ pol->sadb_x_policy_priority = xp->priority;
+
+@@ -3108,7 +3109,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
+ pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
+ pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
+ pol->sadb_x_policy_dir = dir+1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = xp->index;
++ pol->sadb_x_policy_priority = xp->priority;
+
+ /* Set sadb_comb's. */
+ if (x->id.proto == IPPROTO_AH)
+@@ -3496,6 +3499,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
+ pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
+ pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
+ pol->sadb_x_policy_dir = dir + 1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = 0;
+ pol->sadb_x_policy_priority = 0;
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 8ce9feb..067aa2a 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -831,8 +831,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+ struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
+
+- /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
+- if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
++ /*
++ * Drop duplicate 802.11 retransmissions
++ * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
++ */
++ if (rx->skb->len >= 24 && rx->sta &&
++ !ieee80211_is_ctl(hdr->frame_control) &&
++ !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
++ !is_multicast_ether_addr(hdr->addr1)) {
+ if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
+ rx->sta->last_seq_ctrl[rx->seqno_idx] ==
+ hdr->seq_ctrl)) {
+diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
+index e25e490..6e38ef0 100644
+--- a/net/sched/sch_atm.c
++++ b/net/sched/sch_atm.c
+@@ -606,6 +606,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
+ struct sockaddr_atmpvc pvc;
+ int state;
+
++ memset(&pvc, 0, sizeof(pvc));
+ pvc.sap_family = AF_ATMPVC;
+ pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
+ pvc.sap_addr.vpi = flow->vcc->vpi;
+diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
+index b7cddb9..7f59944 100644
+--- a/net/sched/sch_cbq.c
++++ b/net/sched/sch_cbq.c
+@@ -1467,6 +1467,7 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
+ unsigned char *b = skb_tail_pointer(skb);
+ struct tc_cbq_wrropt opt;
+
++ memset(&opt, 0, sizeof(opt));
+ opt.flags = 0;
+ opt.allot = cl->allot;
+ opt.priority = cl->priority + 1;
+diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
+index 96eb168..3dd7207 100644
+--- a/net/sctp/outqueue.c
++++ b/net/sctp/outqueue.c
+@@ -205,6 +205,8 @@ static inline int sctp_cacc_skip(struct sctp_transport *primary,
+ */
+ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
+ {
++ memset(q, 0, sizeof(struct sctp_outq));
++
+ q->asoc = asoc;
+ INIT_LIST_HEAD(&q->out_chunk_list);
+ INIT_LIST_HEAD(&q->control_chunk_list);
+@@ -212,13 +214,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
+ INIT_LIST_HEAD(&q->sacked);
+ INIT_LIST_HEAD(&q->abandoned);
+
+- q->fast_rtx = 0;
+- q->outstanding_bytes = 0;
+ q->empty = 1;
+- q->cork = 0;
+-
+- q->malloced = 0;
+- q->out_qlen = 0;
+ }
+
+ /* Free the outqueue structure and any related pending chunks.
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index f432c57..add9f94 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -5081,12 +5081,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
+
+ void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
+ {
++ struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
+ void *hdr = ((void **)skb->cb)[1];
+ struct nlattr *data = ((void **)skb->cb)[2];
+
+ nla_nest_end(skb, data);
+ genlmsg_end(skb, hdr);
+- genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
++ genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
++ nl80211_testmode_mcgrp.id, gfp);
+ }
+ EXPORT_SYMBOL(cfg80211_testmode_event);
+ #endif
+@@ -7768,7 +7770,8 @@ void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
+
+ genlmsg_end(msg, hdr);
+
+- genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
++ genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
++ nl80211_mlme_mcgrp.id, gfp);
+ return;
+
+ nla_put_failure:
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index a58cf35..84717ce 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -582,7 +582,7 @@ static long snd_compr_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+ mutex_lock(&stream->device->lock);
+ switch (_IOC_NR(cmd)) {
+ case _IOC_NR(SNDRV_COMPRESS_IOCTL_VERSION):
+- put_user(SNDRV_COMPRESS_VERSION,
++ retval = put_user(SNDRV_COMPRESS_VERSION,
+ (int __user *)arg) ? -EFAULT : 0;
+ break;
+ case _IOC_NR(SNDRV_COMPRESS_GET_CAPS):
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2013-08-12 10:42 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-08-12 10:42 [gentoo-commits] linux-patches r2471 - in genpatches-2.6/trunk: 3.0 3.10 3.4 Tom Wijsman (tomwij)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox