* [gentoo-commits] linux-patches r2529 - in genpatches-2.6/trunk: 3.0 3.10 3.11 3.4
@ 2013-09-27 17:20 Tom Wijsman (tomwij)
0 siblings, 0 replies; only message in thread
From: Tom Wijsman (tomwij) @ 2013-09-27 17:20 UTC (permalink / raw
To: gentoo-commits
Author: tomwij
Date: 2013-09-27 17:20:08 +0000 (Fri, 27 Sep 2013)
New Revision: 2529
Added:
genpatches-2.6/trunk/3.0/1096_linux-3.0.97.patch
genpatches-2.6/trunk/3.10/1012_linux-3.10.13.patch
genpatches-2.6/trunk/3.11/1001_linux-3.11.2.patch
genpatches-2.6/trunk/3.4/1062_linux-3.4.63.patch
Removed:
genpatches-2.6/trunk/3.10/1500_CVE-2013-4300-net-Check-the-correct-namespace-when-spoofing-pid-ov.patch
Modified:
genpatches-2.6/trunk/3.0/0000_README
genpatches-2.6/trunk/3.10/0000_README
genpatches-2.6/trunk/3.11/0000_README
genpatches-2.6/trunk/3.4/0000_README
Log:
Linux patches 3.0.97, 3.4.63, 3.10.13 and 3.11.2.
Modified: genpatches-2.6/trunk/3.0/0000_README
===================================================================
--- genpatches-2.6/trunk/3.0/0000_README 2013-09-25 17:13:05 UTC (rev 2528)
+++ genpatches-2.6/trunk/3.0/0000_README 2013-09-27 17:20:08 UTC (rev 2529)
@@ -419,6 +419,10 @@
From: http://www.kernel.org
Desc: Linux 3.0.96
+Patch: 1096_linux-3.0.97.patch
+From: http://www.kernel.org
+Desc: Linux 3.0.97
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
Added: genpatches-2.6/trunk/3.0/1096_linux-3.0.97.patch
===================================================================
--- genpatches-2.6/trunk/3.0/1096_linux-3.0.97.patch (rev 0)
+++ genpatches-2.6/trunk/3.0/1096_linux-3.0.97.patch 2013-09-27 17:20:08 UTC (rev 2529)
@@ -0,0 +1,597 @@
+diff --git a/Makefile b/Makefile
+index e2a73ebd..53c9a5dc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 0
+-SUBLEVEL = 96
++SUBLEVEL = 97
+ EXTRAVERSION =
+ NAME = Sneaky Weasel
+
+diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
+index 13c7e5f9..3f47259b 100644
+--- a/arch/arm/mach-versatile/pci.c
++++ b/arch/arm/mach-versatile/pci.c
+@@ -43,9 +43,9 @@
+ #define PCI_IMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x0)
+ #define PCI_IMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x4)
+ #define PCI_IMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x8)
+-#define PCI_SMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x10)
+-#define PCI_SMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
+-#define PCI_SMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
++#define PCI_SMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x1c)
+ #define PCI_SELFID __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0xc)
+
+ #define DEVICE_ID_OFFSET 0x00
+diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
+index 8184ee97..3fcbae0f 100644
+--- a/arch/powerpc/kernel/align.c
++++ b/arch/powerpc/kernel/align.c
+@@ -764,6 +764,16 @@ int fix_alignment(struct pt_regs *regs)
+ nb = aligninfo[instr].len;
+ flags = aligninfo[instr].flags;
+
++ /* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */
++ if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) {
++ nb = 8;
++ flags = LD+SW;
++ } else if (IS_XFORM(instruction) &&
++ ((instruction >> 1) & 0x3ff) == 660) {
++ nb = 8;
++ flags = ST+SW;
++ }
++
+ /* Byteswap little endian loads and stores */
+ swiz = 0;
+ if (regs->msr & MSR_LE) {
+diff --git a/crypto/api.c b/crypto/api.c
+index 033a7147..4f98dd5b 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -40,6 +40,8 @@ static inline struct crypto_alg *crypto_alg_get(struct crypto_alg *alg)
+ return alg;
+ }
+
++static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg);
++
+ struct crypto_alg *crypto_mod_get(struct crypto_alg *alg)
+ {
+ return try_module_get(alg->cra_module) ? crypto_alg_get(alg) : NULL;
+@@ -150,8 +152,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,
+ }
+ up_write(&crypto_alg_sem);
+
+- if (alg != &larval->alg)
++ if (alg != &larval->alg) {
+ kfree(larval);
++ if (crypto_is_larval(alg))
++ alg = crypto_larval_wait(alg);
++ }
+
+ return alg;
+ }
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 53576e7c..a9c2b689 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -58,6 +58,8 @@ struct hid_report *hid_register_report(struct hid_device *device, unsigned type,
+ struct hid_report_enum *report_enum = device->report_enum + type;
+ struct hid_report *report;
+
++ if (id >= HID_MAX_IDS)
++ return NULL;
+ if (report_enum->report_id_hash[id])
+ return report_enum->report_id_hash[id];
+
+@@ -379,9 +381,11 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
+
+ case HID_GLOBAL_ITEM_TAG_REPORT_ID:
+ parser->global.report_id = item_udata(item);
+- if (parser->global.report_id == 0) {
+- dbg_hid("report_id 0 is invalid\n");
+- return -1;
++ if (parser->global.report_id == 0 ||
++ parser->global.report_id >= HID_MAX_IDS) {
++ hid_err(parser->device, "report_id %u is invalid\n",
++ parser->global.report_id);
++ return -1;
+ }
+ return 0;
+
+@@ -551,7 +555,7 @@ static void hid_device_release(struct device *dev)
+ for (i = 0; i < HID_REPORT_TYPES; i++) {
+ struct hid_report_enum *report_enum = device->report_enum + i;
+
+- for (j = 0; j < 256; j++) {
++ for (j = 0; j < HID_MAX_IDS; j++) {
+ struct hid_report *report = report_enum->report_id_hash[j];
+ if (report)
+ hid_free_report(report);
+@@ -989,7 +993,12 @@ EXPORT_SYMBOL_GPL(hid_output_report);
+
+ int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
+ {
+- unsigned size = field->report_size;
++ unsigned size;
++
++ if (!field)
++ return -1;
++
++ size = field->report_size;
+
+ hid_dump_input(field->report->device, field->usage + offset, value);
+
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index 9fae2ebd..48cba857 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev)
+ struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT].
+ report_id_hash[0x0d];
+
+- if (!report)
++ if (!report || report->maxfield < 1 ||
++ report->field[0]->report_count < 1)
+ return -EINVAL;
+
+ usbhid_submit_report(hdev, report, USB_DIR_IN);
+diff --git a/drivers/hid/hid-pl.c b/drivers/hid/hid-pl.c
+index 06e5300d..fa742323 100644
+--- a/drivers/hid/hid-pl.c
++++ b/drivers/hid/hid-pl.c
+@@ -128,8 +128,14 @@ static int plff_init(struct hid_device *hid)
+ strong = &report->field[0]->value[2];
+ weak = &report->field[0]->value[3];
+ debug("detected single-field device");
+- } else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 &&
+- report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) {
++ } else if (report->field[0]->maxusage == 1 &&
++ report->field[0]->usage[0].hid ==
++ (HID_UP_LED | 0x43) &&
++ report->maxfield >= 4 &&
++ report->field[0]->report_count >= 1 &&
++ report->field[1]->report_count >= 1 &&
++ report->field[2]->report_count >= 1 &&
++ report->field[3]->report_count >= 1) {
+ report->field[0]->value[0] = 0x00;
+ report->field[1]->value[0] = 0x00;
+ strong = &report->field[2]->value[0];
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+index 892c48b1..b8a26d20 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -1005,6 +1005,10 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah,
+ * is_on == 0 means MRC CCK is OFF (more noise imm)
+ */
+ bool is_on = param ? 1 : 0;
++
++ if (ah->caps.rx_chainmask == 1)
++ break;
++
+ REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+ AR_PHY_MRC_CCK_ENABLE, is_on);
+ REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 6f6f1002..e1f19719 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2433,6 +2433,7 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
+ for (acno = 0, ac = &an->ac[acno];
+ acno < WME_NUM_AC; acno++, ac++) {
+ ac->sched = false;
++ ac->clear_ps_filter = true;
+ ac->txq = sc->tx.txq_map[acno];
+ INIT_LIST_HEAD(&ac->tid_q);
+ }
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 3d15a37c..cc3943a0 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2135,14 +2135,9 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
+ }
+ }
+
+- if (modepage == 0x3F) {
+- sd_printk(KERN_ERR, sdkp, "No Caching mode page "
+- "present\n");
+- goto defaults;
+- } else if ((buffer[offset] & 0x3f) != modepage) {
+- sd_printk(KERN_ERR, sdkp, "Got wrong page\n");
+- goto defaults;
+- }
++ sd_printk(KERN_ERR, sdkp, "No Caching mode page found\n");
++ goto defaults;
++
+ Page_found:
+ if (modepage == 8) {
+ sdkp->WCE = ((buffer[offset + 2] & 0x04) != 0);
+diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c
+index 8cea9dca..00a285c5 100644
+--- a/drivers/staging/comedi/drivers/dt282x.c
++++ b/drivers/staging/comedi/drivers/dt282x.c
+@@ -406,8 +406,9 @@ struct dt282x_private {
+ } \
+ udelay(5); \
+ } \
+- if (_i) \
++ if (_i) { \
+ b \
++ } \
+ } while (0)
+
+ static int dt282x_attach(struct comedi_device *dev,
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index c84b4553..0b85e2c7 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -171,6 +171,7 @@ skip_error:
+ static void wdm_int_callback(struct urb *urb)
+ {
+ int rv = 0;
++ int responding;
+ int status = urb->status;
+ struct wdm_device *desc;
+ struct usb_ctrlrequest *req;
+@@ -244,8 +245,8 @@ static void wdm_int_callback(struct urb *urb)
+ desc->response->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+ spin_lock(&desc->iuspin);
+ clear_bit(WDM_READ, &desc->flags);
+- set_bit(WDM_RESPONDING, &desc->flags);
+- if (!test_bit(WDM_DISCONNECTING, &desc->flags)
++ responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
++ if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags)
+ && !test_bit(WDM_SUSPENDING, &desc->flags)) {
+ rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+ dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
+@@ -635,16 +636,20 @@ static void wdm_rxwork(struct work_struct *work)
+ {
+ struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);
+ unsigned long flags;
+- int rv;
++ int rv = 0;
++ int responding;
+
+ spin_lock_irqsave(&desc->iuspin, flags);
+ if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+ } else {
++ responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+- rv = usb_submit_urb(desc->response, GFP_KERNEL);
++ if (!responding)
++ rv = usb_submit_urb(desc->response, GFP_KERNEL);
+ if (rv < 0 && rv != -EPERM) {
+ spin_lock_irqsave(&desc->iuspin, flags);
++ clear_bit(WDM_RESPONDING, &desc->flags);
+ if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+ schedule_work(&desc->rxwork);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 26678cad..c29f5214 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -424,7 +424,8 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
+
+ memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+ if (config->desc.bDescriptorType != USB_DT_CONFIG ||
+- config->desc.bLength < USB_DT_CONFIG_SIZE) {
++ config->desc.bLength < USB_DT_CONFIG_SIZE ||
++ config->desc.bLength > size) {
+ dev_err(ddev, "invalid descriptor for config index %d: "
+ "type = 0x%X, length = %d\n", cfgidx,
+ config->desc.bDescriptorType, config->desc.bLength);
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 7f07eb8d..c95252d1 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -2713,10 +2713,21 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct xhci_virt_device *virt_dev;
++ struct device *dev = hcd->self.controller;
+ unsigned long flags;
+ u32 state;
+ int i, ret;
+
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++ /*
++ * We called pm_runtime_get_noresume when the device was attached.
++ * Decrement the counter here to allow controller to runtime suspend
++ * if no devices remain.
++ */
++ if (xhci->quirks & XHCI_RESET_ON_RESUME)
++ pm_runtime_put_noidle(dev);
++#endif
++
+ ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
+ /* If the host is halted due to driver unload, we still need to free the
+ * device.
+@@ -2783,6 +2794,7 @@ static int xhci_reserve_host_control_ep_resources(struct xhci_hcd *xhci)
+ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++ struct device *dev = hcd->self.controller;
+ unsigned long flags;
+ int timeleft;
+ int ret;
+@@ -2835,6 +2847,16 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ goto disable_slot;
+ }
+ udev->slot_id = xhci->slot_id;
++
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++ /*
++ * If resetting upon resume, we can't put the controller into runtime
++ * suspend if there is a device attached.
++ */
++ if (xhci->quirks & XHCI_RESET_ON_RESUME)
++ pm_runtime_get_noresume(dev);
++#endif
++
+ /* Is this a LS or FS device under a HS hub? */
+ /* Hub or peripherial? */
+ return 1;
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index 267dff94..7ee78bd6 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -383,7 +383,7 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ kfree(urbtrack);
+ return -ENOMEM;
+ }
+- urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
++ urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_ATOMIC);
+ if (!urbtrack->setup) {
+ usb_free_urb(urbtrack->urb);
+ kfree(urbtrack);
+@@ -391,8 +391,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ }
+ urbtrack->setup->bRequestType = (__u8)0x40;
+ urbtrack->setup->bRequest = (__u8)0x0e;
+- urbtrack->setup->wValue = get_reg_value(reg, dummy);
+- urbtrack->setup->wIndex = get_reg_index(reg);
++ urbtrack->setup->wValue = cpu_to_le16(get_reg_value(reg, dummy));
++ urbtrack->setup->wIndex = cpu_to_le16(get_reg_index(reg));
+ urbtrack->setup->wLength = 0;
+ usb_fill_control_urb(urbtrack->urb, usbdev,
+ usb_sndctrlpipe(usbdev, 0),
+diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
+index fd725cde..949af52a 100644
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -355,9 +355,18 @@ void gnttab_request_free_callback(struct gnttab_free_callback *callback,
+ void (*fn)(void *), void *arg, u16 count)
+ {
+ unsigned long flags;
++ struct gnttab_free_callback *cb;
++
+ spin_lock_irqsave(&gnttab_list_lock, flags);
+- if (callback->next)
+- goto out;
++
++ /* Check if the callback is already on the list */
++ cb = gnttab_free_callback_list;
++ while (cb) {
++ if (cb == callback)
++ goto out;
++ cb = cb->next;
++ }
++
+ callback->fn = fn;
+ callback->arg = arg;
+ callback->count = count;
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index b7758094..9e6ee471 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -158,6 +158,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ try_to_freeze();
+
+ /* we should try only the port we connected to before */
++ mutex_lock(&server->srv_mutex);
+ rc = generic_ip_connect(server);
+ if (rc) {
+ cFYI(1, "reconnect error %d", rc);
+@@ -169,6 +170,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ server->tcpStatus = CifsNeedNegotiate;
+ spin_unlock(&GlobalMid_Lock);
+ }
++ mutex_unlock(&server->srv_mutex);
+ } while (server->tcpStatus == CifsNeedReconnect);
+
+ return rc;
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index c04a025c..607a9736 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1439,6 +1439,8 @@ static int fuse_setxattr(struct dentry *entry, const char *name,
+ fc->no_setxattr = 1;
+ err = -EOPNOTSUPP;
+ }
++ if (!err)
++ fuse_invalidate_attr(inode);
+ return err;
+ }
+
+@@ -1568,6 +1570,8 @@ static int fuse_removexattr(struct dentry *entry, const char *name)
+ fc->no_removexattr = 1;
+ err = -EOPNOTSUPP;
+ }
++ if (!err)
++ fuse_invalidate_attr(inode);
+ return err;
+ }
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 79fca8df..2e1c10fe 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1298,7 +1298,6 @@ static int fuse_writepage_locked(struct page *page)
+
+ inc_bdi_stat(mapping->backing_dev_info, BDI_WRITEBACK);
+ inc_zone_page_state(tmp_page, NR_WRITEBACK_TEMP);
+- end_page_writeback(page);
+
+ spin_lock(&fc->lock);
+ list_add(&req->writepages_entry, &fi->writepages);
+@@ -1306,6 +1305,8 @@ static int fuse_writepage_locked(struct page *page)
+ fuse_flush_writepages(inode);
+ spin_unlock(&fc->lock);
+
++ end_page_writeback(page);
++
+ return 0;
+
+ err_free:
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index b3cc8586..26f63644 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -119,8 +119,8 @@ static void destroy_inodecache(void)
+
+ static int isofs_remount(struct super_block *sb, int *flags, char *data)
+ {
+- /* we probably want a lot more here */
+- *flags |= MS_RDONLY;
++ if (!(*flags & MS_RDONLY))
++ return -EROFS;
+ return 0;
+ }
+
+@@ -769,15 +769,6 @@ root_found:
+ */
+ s->s_maxbytes = 0x80000000000LL;
+
+- /*
+- * The CDROM is read-only, has no nodes (devices) on it, and since
+- * all of the files appear to be owned by root, we really do not want
+- * to allow suid. (suid or devices will not show up unless we have
+- * Rock Ridge extensions)
+- */
+-
+- s->s_flags |= MS_RDONLY /* | MS_NODEV | MS_NOSUID */;
+-
+ /* Set this for reference. Its not currently used except on write
+ which we don't have .. */
+
+@@ -1528,6 +1519,9 @@ struct inode *isofs_iget(struct super_block *sb,
+ static struct dentry *isofs_mount(struct file_system_type *fs_type,
+ int flags, const char *dev_name, void *data)
+ {
++ /* We don't support read-write mounts */
++ if (!(flags & MS_RDONLY))
++ return ERR_PTR(-EACCES);
+ return mount_bdev(fs_type, flags, dev_name, data, isofs_fill_super);
+ }
+
+diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
+index 59412840..774a032a 100644
+--- a/fs/ocfs2/extent_map.c
++++ b/fs/ocfs2/extent_map.c
+@@ -782,7 +782,6 @@ int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ cpos = map_start >> osb->s_clustersize_bits;
+ mapping_end = ocfs2_clusters_for_bytes(inode->i_sb,
+ map_start + map_len);
+- mapping_end -= cpos;
+ is_last = 0;
+ while (cpos < mapping_end && !is_last) {
+ u32 fe_flags;
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 42f7e2fb..af30c641 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -414,10 +414,12 @@ struct hid_report {
+ struct hid_device *device; /* associated device */
+ };
+
++#define HID_MAX_IDS 256
++
+ struct hid_report_enum {
+ unsigned numbered;
+ struct list_head report_list;
+- struct hid_report *report_id_hash[256];
++ struct hid_report *report_id_hash[HID_MAX_IDS];
+ };
+
+ #define HID_REPORT_TYPES 3
+diff --git a/include/linux/rculist.h b/include/linux/rculist.h
+index c30ffd87..52d280ba 100644
+--- a/include/linux/rculist.h
++++ b/include/linux/rculist.h
+@@ -254,8 +254,9 @@ static inline void list_splice_init_rcu(struct list_head *list,
+ */
+ #define list_first_or_null_rcu(ptr, type, member) \
+ ({struct list_head *__ptr = (ptr); \
+- struct list_head __rcu *__next = list_next_rcu(__ptr); \
+- likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \
++ struct list_head *__next = ACCESS_ONCE(__ptr->next); \
++ likely(__ptr != __next) ? \
++ list_entry_rcu(__next, type, member) : NULL; \
+ })
+
+ /**
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 983d2e11..78f71869 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1838,6 +1838,8 @@ static void collapse_huge_page(struct mm_struct *mm,
+ goto out;
+
+ vma = find_vma(mm, address);
++ if (!vma)
++ goto out;
+ hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ hend = vma->vm_end & HPAGE_PMD_MASK;
+ if (address < hstart || address + HPAGE_PMD_SIZE > hend)
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 57cdf5ad..d7b51d5b 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -4433,7 +4433,13 @@ static int compare_thresholds(const void *a, const void *b)
+ const struct mem_cgroup_threshold *_a = a;
+ const struct mem_cgroup_threshold *_b = b;
+
+- return _a->threshold - _b->threshold;
++ if (_a->threshold > _b->threshold)
++ return 1;
++
++ if (_a->threshold < _b->threshold)
++ return -1;
++
++ return 0;
+ }
+
+ static int mem_cgroup_oom_notify_cb(struct mem_cgroup *mem)
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index c5c97880..a9537d42 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2461,6 +2461,7 @@ static struct snd_pci_quirk msi_black_list[] __devinitdata = {
+ SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
+ SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
+ SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
++ SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */
+ SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */
+ SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */
+ {}
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 4393394b..ca1a90b8 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -801,9 +801,9 @@ static int wm8960_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
+ if (pll_div.k) {
+ reg |= 0x20;
+
+- snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 18) & 0x3f);
+- snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 9) & 0x1ff);
+- snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0x1ff);
++ snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 16) & 0xff);
++ snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 8) & 0xff);
++ snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0xff);
+ }
+ snd_soc_write(codec, WM8960_PLL1, reg);
+
Modified: genpatches-2.6/trunk/3.10/0000_README
===================================================================
--- genpatches-2.6/trunk/3.10/0000_README 2013-09-25 17:13:05 UTC (rev 2528)
+++ genpatches-2.6/trunk/3.10/0000_README 2013-09-27 17:20:08 UTC (rev 2529)
@@ -90,9 +90,9 @@
From: http://www.kernel.org
Desc: Linux 3.10.12
-Patch: 1500_CVE-2013-4300-net-Check-the-correct-namespace-when-spoofing-pid-ov.patch
-From: http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=d661684cf6820331feae71146c35da83d794467e
-Desc: CVE-2013-4300: PID Spoofing Privilege Escalation Vulnerability
+Patch: 1012_linux-3.10.13.patch
+From: http://www.kernel.org
+Desc: Linux 3.10.13
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Added: genpatches-2.6/trunk/3.10/1012_linux-3.10.13.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1012_linux-3.10.13.patch (rev 0)
+++ genpatches-2.6/trunk/3.10/1012_linux-3.10.13.patch 2013-09-27 17:20:08 UTC (rev 2529)
@@ -0,0 +1,3897 @@
+diff --git a/Documentation/DocBook/media_api.tmpl b/Documentation/DocBook/media_api.tmpl
+index 6a8b7158..9c92bb87 100644
+--- a/Documentation/DocBook/media_api.tmpl
++++ b/Documentation/DocBook/media_api.tmpl
+@@ -1,6 +1,6 @@
+ <?xml version="1.0"?>
+-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" [
++<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
++ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
+ <!ENTITY % media-entities SYSTEM "./media-entities.tmpl"> %media-entities;
+ <!ENTITY media-indices SYSTEM "./media-indices.tmpl">
+
+diff --git a/Makefile b/Makefile
+index afe001e3..25d38b79 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 12
++SUBLEVEL = 13
+ EXTRAVERSION =
+ NAME = TOSSUG Baby Fish
+
+diff --git a/arch/arm/boot/dts/at91rm9200.dtsi b/arch/arm/boot/dts/at91rm9200.dtsi
+index 5d3ed5aa..0af879a4 100644
+--- a/arch/arm/boot/dts/at91rm9200.dtsi
++++ b/arch/arm/boot/dts/at91rm9200.dtsi
+@@ -35,8 +35,12 @@
+ ssc2 = &ssc2;
+ };
+ cpus {
+- cpu@0 {
++ #address-cells = <0>;
++ #size-cells = <0>;
++
++ cpu {
+ compatible = "arm,arm920t";
++ device_type = "cpu";
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/at91sam9260.dtsi b/arch/arm/boot/dts/at91sam9260.dtsi
+index 43a18f74..0dbdb846 100644
+--- a/arch/arm/boot/dts/at91sam9260.dtsi
++++ b/arch/arm/boot/dts/at91sam9260.dtsi
+@@ -32,8 +32,12 @@
+ ssc0 = &ssc0;
+ };
+ cpus {
+- cpu@0 {
+- compatible = "arm,arm926ejs";
++ #address-cells = <0>;
++ #size-cells = <0>;
++
++ cpu {
++ compatible = "arm,arm926ej-s";
++ device_type = "cpu";
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi
+index 94b58ab2..fcd38f89 100644
+--- a/arch/arm/boot/dts/at91sam9263.dtsi
++++ b/arch/arm/boot/dts/at91sam9263.dtsi
+@@ -29,8 +29,12 @@
+ ssc1 = &ssc1;
+ };
+ cpus {
+- cpu@0 {
+- compatible = "arm,arm926ejs";
++ #address-cells = <0>;
++ #size-cells = <0>;
++
++ cpu {
++ compatible = "arm,arm926ej-s";
++ device_type = "cpu";
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
+index bf18a735..479a0622 100644
+--- a/arch/arm/boot/dts/at91sam9g45.dtsi
++++ b/arch/arm/boot/dts/at91sam9g45.dtsi
+@@ -35,8 +35,12 @@
+ ssc1 = &ssc1;
+ };
+ cpus {
+- cpu@0 {
+- compatible = "arm,arm926ejs";
++ #address-cells = <0>;
++ #size-cells = <0>;
++
++ cpu {
++ compatible = "arm,arm926ej-s";
++ device_type = "cpu";
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/at91sam9n12.dtsi b/arch/arm/boot/dts/at91sam9n12.dtsi
+index 8d25f889..a92ec783 100644
+--- a/arch/arm/boot/dts/at91sam9n12.dtsi
++++ b/arch/arm/boot/dts/at91sam9n12.dtsi
+@@ -31,8 +31,12 @@
+ ssc0 = &ssc0;
+ };
+ cpus {
+- cpu@0 {
+- compatible = "arm,arm926ejs";
++ #address-cells = <0>;
++ #size-cells = <0>;
++
++ cpu {
++ compatible = "arm,arm926ej-s";
++ device_type = "cpu";
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
+index b5833d1f..2b2b6923 100644
+--- a/arch/arm/boot/dts/at91sam9x5.dtsi
++++ b/arch/arm/boot/dts/at91sam9x5.dtsi
+@@ -33,8 +33,12 @@
+ ssc0 = &ssc0;
+ };
+ cpus {
+- cpu@0 {
+- compatible = "arm,arm926ejs";
++ #address-cells = <0>;
++ #size-cells = <0>;
++
++ cpu {
++ compatible = "arm,arm926ej-s";
++ device_type = "cpu";
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/sama5d3.dtsi b/arch/arm/boot/dts/sama5d3.dtsi
+index 5000e0d4..642775d7 100644
+--- a/arch/arm/boot/dts/sama5d3.dtsi
++++ b/arch/arm/boot/dts/sama5d3.dtsi
+@@ -35,8 +35,12 @@
+ ssc1 = &ssc1;
+ };
+ cpus {
++ #address-cells = <1>;
++ #size-cells = <0>;
+ cpu@0 {
++ device_type = "cpu";
+ compatible = "arm,cortex-a5";
++ reg = <0x0>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
+index e7ef619a..06ef8b62 100644
+--- a/arch/arm/boot/dts/sun4i-a10.dtsi
++++ b/arch/arm/boot/dts/sun4i-a10.dtsi
+@@ -16,8 +16,12 @@
+ interrupt-parent = <&intc>;
+
+ cpus {
++ #address-cells = <1>;
++ #size-cells = <0>;
+ cpu@0 {
++ device_type = "cpu";
+ compatible = "arm,cortex-a8";
++ reg = <0x0>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
+index 31fa38f8..d2852547 100644
+--- a/arch/arm/boot/dts/sun5i-a13.dtsi
++++ b/arch/arm/boot/dts/sun5i-a13.dtsi
+@@ -17,8 +17,12 @@
+ interrupt-parent = <&intc>;
+
+ cpus {
++ #address-cells = <1>;
++ #size-cells = <0>;
+ cpu@0 {
++ device_type = "cpu";
+ compatible = "arm,cortex-a8";
++ reg = <0x0>;
+ };
+ };
+
+diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
+index 4a519907..db9cf692 100644
+--- a/arch/arm/kvm/coproc.c
++++ b/arch/arm/kvm/coproc.c
+@@ -146,7 +146,11 @@ static bool pm_fake(struct kvm_vcpu *vcpu,
+ #define access_pmintenclr pm_fake
+
+ /* Architected CP15 registers.
+- * Important: Must be sorted ascending by CRn, CRM, Op1, Op2
++ * CRn denotes the primary register number, but is copied to the CRm in the
++ * user space API for 64-bit register access in line with the terminology used
++ * in the ARM ARM.
++ * Important: Must be sorted ascending by CRn, CRM, Op1, Op2 and with 64-bit
++ * registers preceding 32-bit ones.
+ */
+ static const struct coproc_reg cp15_regs[] = {
+ /* CSSELR: swapped by interrupt.S. */
+@@ -154,8 +158,8 @@ static const struct coproc_reg cp15_regs[] = {
+ NULL, reset_unknown, c0_CSSELR },
+
+ /* TTBR0/TTBR1: swapped by interrupt.S. */
+- { CRm( 2), Op1( 0), is64, NULL, reset_unknown64, c2_TTBR0 },
+- { CRm( 2), Op1( 1), is64, NULL, reset_unknown64, c2_TTBR1 },
++ { CRm64( 2), Op1( 0), is64, NULL, reset_unknown64, c2_TTBR0 },
++ { CRm64( 2), Op1( 1), is64, NULL, reset_unknown64, c2_TTBR1 },
+
+ /* TTBCR: swapped by interrupt.S. */
+ { CRn( 2), CRm( 0), Op1( 0), Op2( 2), is32,
+@@ -182,7 +186,7 @@ static const struct coproc_reg cp15_regs[] = {
+ NULL, reset_unknown, c6_IFAR },
+
+ /* PAR swapped by interrupt.S */
+- { CRn( 7), Op1( 0), is64, NULL, reset_unknown64, c7_PAR },
++ { CRm64( 7), Op1( 0), is64, NULL, reset_unknown64, c7_PAR },
+
+ /*
+ * DC{C,I,CI}SW operations:
+@@ -399,12 +403,13 @@ static bool index_to_params(u64 id, struct coproc_params *params)
+ | KVM_REG_ARM_OPC1_MASK))
+ return false;
+ params->is_64bit = true;
+- params->CRm = ((id & KVM_REG_ARM_CRM_MASK)
++ /* CRm to CRn: see cp15_to_index for details */
++ params->CRn = ((id & KVM_REG_ARM_CRM_MASK)
+ >> KVM_REG_ARM_CRM_SHIFT);
+ params->Op1 = ((id & KVM_REG_ARM_OPC1_MASK)
+ >> KVM_REG_ARM_OPC1_SHIFT);
+ params->Op2 = 0;
+- params->CRn = 0;
++ params->CRm = 0;
+ return true;
+ default:
+ return false;
+@@ -898,7 +903,14 @@ static u64 cp15_to_index(const struct coproc_reg *reg)
+ if (reg->is_64) {
+ val |= KVM_REG_SIZE_U64;
+ val |= (reg->Op1 << KVM_REG_ARM_OPC1_SHIFT);
+- val |= (reg->CRm << KVM_REG_ARM_CRM_SHIFT);
++ /*
++ * CRn always denotes the primary coproc. reg. nr. for the
++ * in-kernel representation, but the user space API uses the
++ * CRm for the encoding, because it is modelled after the
++ * MRRC/MCRR instructions: see the ARM ARM rev. c page
++ * B3-1445
++ */
++ val |= (reg->CRn << KVM_REG_ARM_CRM_SHIFT);
+ } else {
+ val |= KVM_REG_SIZE_U32;
+ val |= (reg->Op1 << KVM_REG_ARM_OPC1_SHIFT);
+diff --git a/arch/arm/kvm/coproc.h b/arch/arm/kvm/coproc.h
+index b7301d3e..0461d5c8 100644
+--- a/arch/arm/kvm/coproc.h
++++ b/arch/arm/kvm/coproc.h
+@@ -135,6 +135,8 @@ static inline int cmp_reg(const struct coproc_reg *i1,
+ return -1;
+ if (i1->CRn != i2->CRn)
+ return i1->CRn - i2->CRn;
++ if (i1->is_64 != i2->is_64)
++ return i2->is_64 - i1->is_64;
+ if (i1->CRm != i2->CRm)
+ return i1->CRm - i2->CRm;
+ if (i1->Op1 != i2->Op1)
+@@ -145,6 +147,7 @@ static inline int cmp_reg(const struct coproc_reg *i1,
+
+ #define CRn(_x) .CRn = _x
+ #define CRm(_x) .CRm = _x
++#define CRm64(_x) .CRn = _x, .CRm = 0
+ #define Op1(_x) .Op1 = _x
+ #define Op2(_x) .Op2 = _x
+ #define is64 .is_64 = true
+diff --git a/arch/arm/kvm/coproc_a15.c b/arch/arm/kvm/coproc_a15.c
+index 685063a6..cf93472b 100644
+--- a/arch/arm/kvm/coproc_a15.c
++++ b/arch/arm/kvm/coproc_a15.c
+@@ -114,7 +114,11 @@ static bool access_l2ectlr(struct kvm_vcpu *vcpu,
+
+ /*
+ * A15-specific CP15 registers.
+- * Important: Must be sorted ascending by CRn, CRM, Op1, Op2
++ * CRn denotes the primary register number, but is copied to the CRm in the
++ * user space API for 64-bit register access in line with the terminology used
++ * in the ARM ARM.
++ * Important: Must be sorted ascending by CRn, CRM, Op1, Op2 and with 64-bit
++ * registers preceding 32-bit ones.
+ */
+ static const struct coproc_reg a15_regs[] = {
+ /* MPIDR: we use VMPIDR for guest access. */
+diff --git a/arch/arm/mach-versatile/include/mach/platform.h b/arch/arm/mach-versatile/include/mach/platform.h
+index ec087407..6f938ccb 100644
+--- a/arch/arm/mach-versatile/include/mach/platform.h
++++ b/arch/arm/mach-versatile/include/mach/platform.h
+@@ -231,12 +231,14 @@
+ /* PCI space */
+ #define VERSATILE_PCI_BASE 0x41000000 /* PCI Interface */
+ #define VERSATILE_PCI_CFG_BASE 0x42000000
++#define VERSATILE_PCI_IO_BASE 0x43000000
+ #define VERSATILE_PCI_MEM_BASE0 0x44000000
+ #define VERSATILE_PCI_MEM_BASE1 0x50000000
+ #define VERSATILE_PCI_MEM_BASE2 0x60000000
+ /* Sizes of above maps */
+ #define VERSATILE_PCI_BASE_SIZE 0x01000000
+ #define VERSATILE_PCI_CFG_BASE_SIZE 0x02000000
++#define VERSATILE_PCI_IO_BASE_SIZE 0x01000000
+ #define VERSATILE_PCI_MEM_BASE0_SIZE 0x0c000000 /* 32Mb */
+ #define VERSATILE_PCI_MEM_BASE1_SIZE 0x10000000 /* 256Mb */
+ #define VERSATILE_PCI_MEM_BASE2_SIZE 0x10000000 /* 256Mb */
+diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
+index e92e5e07..c97be4ea 100644
+--- a/arch/arm/mach-versatile/pci.c
++++ b/arch/arm/mach-versatile/pci.c
+@@ -43,9 +43,9 @@
+ #define PCI_IMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x0)
+ #define PCI_IMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x4)
+ #define PCI_IMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x8)
+-#define PCI_SMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x10)
+-#define PCI_SMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
+-#define PCI_SMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
++#define PCI_SMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x1c)
+ #define PCI_SELFID __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0xc)
+
+ #define DEVICE_ID_OFFSET 0x00
+@@ -170,8 +170,8 @@ static struct pci_ops pci_versatile_ops = {
+ .write = versatile_write_config,
+ };
+
+-static struct resource io_mem = {
+- .name = "PCI I/O space",
++static struct resource unused_mem = {
++ .name = "PCI unused",
+ .start = VERSATILE_PCI_MEM_BASE0,
+ .end = VERSATILE_PCI_MEM_BASE0+VERSATILE_PCI_MEM_BASE0_SIZE-1,
+ .flags = IORESOURCE_MEM,
+@@ -195,9 +195,9 @@ static int __init pci_versatile_setup_resources(struct pci_sys_data *sys)
+ {
+ int ret = 0;
+
+- ret = request_resource(&iomem_resource, &io_mem);
++ ret = request_resource(&iomem_resource, &unused_mem);
+ if (ret) {
+- printk(KERN_ERR "PCI: unable to allocate I/O "
++ printk(KERN_ERR "PCI: unable to allocate unused "
+ "memory region (%d)\n", ret);
+ goto out;
+ }
+@@ -205,7 +205,7 @@ static int __init pci_versatile_setup_resources(struct pci_sys_data *sys)
+ if (ret) {
+ printk(KERN_ERR "PCI: unable to allocate non-prefetchable "
+ "memory region (%d)\n", ret);
+- goto release_io_mem;
++ goto release_unused_mem;
+ }
+ ret = request_resource(&iomem_resource, &pre_mem);
+ if (ret) {
+@@ -225,8 +225,8 @@ static int __init pci_versatile_setup_resources(struct pci_sys_data *sys)
+
+ release_non_mem:
+ release_resource(&non_mem);
+- release_io_mem:
+- release_resource(&io_mem);
++ release_unused_mem:
++ release_resource(&unused_mem);
+ out:
+ return ret;
+ }
+@@ -246,7 +246,7 @@ int __init pci_versatile_setup(int nr, struct pci_sys_data *sys)
+ goto out;
+ }
+
+- ret = pci_ioremap_io(0, VERSATILE_PCI_MEM_BASE0);
++ ret = pci_ioremap_io(0, VERSATILE_PCI_IO_BASE);
+ if (ret)
+ goto out;
+
+@@ -295,6 +295,19 @@ int __init pci_versatile_setup(int nr, struct pci_sys_data *sys)
+ __raw_writel(PHYS_OFFSET, local_pci_cfg_base + PCI_BASE_ADDRESS_2);
+
+ /*
++ * For many years the kernel and QEMU were symbiotically buggy
++ * in that they both assumed the same broken IRQ mapping.
++ * QEMU therefore attempts to auto-detect old broken kernels
++ * so that they still work on newer QEMU as they did on old
++ * QEMU. Since we now use the correct (ie matching-hardware)
++ * IRQ mapping we write a definitely different value to a
++ * PCI_INTERRUPT_LINE register to tell QEMU that we expect
++ * real hardware behaviour and it need not be backwards
++ * compatible for us. This write is harmless on real hardware.
++ */
++ __raw_writel(0, VERSATILE_PCI_VIRT_BASE+PCI_INTERRUPT_LINE);
++
++ /*
+ * Do not to map Versatile FPGA PCI device into memory space
+ */
+ pci_slot_ignore |= (1 << myslot);
+@@ -327,13 +340,13 @@ static int __init versatile_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+ {
+ int irq;
+
+- /* slot, pin, irq
+- * 24 1 IRQ_SIC_PCI0
+- * 25 1 IRQ_SIC_PCI1
+- * 26 1 IRQ_SIC_PCI2
+- * 27 1 IRQ_SIC_PCI3
++ /*
++ * Slot INTA INTB INTC INTD
++ * 31 PCI1 PCI2 PCI3 PCI0
++ * 30 PCI0 PCI1 PCI2 PCI3
++ * 29 PCI3 PCI0 PCI1 PCI2
+ */
+- irq = IRQ_SIC_PCI0 + ((slot - 24 + pin - 1) & 3);
++ irq = IRQ_SIC_PCI0 + ((slot + 2 + pin - 1) & 3);
+
+ return irq;
+ }
+diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
+index 05db95d0..81edd31b 100644
+--- a/arch/arm/xen/enlighten.c
++++ b/arch/arm/xen/enlighten.c
+@@ -273,12 +273,15 @@ core_initcall(xen_guest_init);
+
+ static int __init xen_pm_init(void)
+ {
++ if (!xen_domain())
++ return -ENODEV;
++
+ pm_power_off = xen_power_off;
+ arm_pm_restart = xen_restart;
+
+ return 0;
+ }
+-subsys_initcall(xen_pm_init);
++late_initcall(xen_pm_init);
+
+ static irqreturn_t xen_arm_callback(int irq, void *arg)
+ {
+diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
+index 12e6ccb8..cea1594f 100644
+--- a/arch/arm64/kernel/perf_event.c
++++ b/arch/arm64/kernel/perf_event.c
+@@ -325,7 +325,10 @@ validate_event(struct pmu_hw_events *hw_events,
+ if (is_software_event(event))
+ return 1;
+
+- if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)
++ if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
++ return 1;
++
++ if (event->state == PERF_EVENT_STATE_OFF && !event->attr.enable_on_exec)
+ return 1;
+
+ return armpmu->get_event_idx(hw_events, &fake_event) >= 0;
+@@ -781,7 +784,7 @@ static const unsigned armv8_pmuv3_perf_cache_map[PERF_COUNT_HW_CACHE_MAX]
+ /*
+ * PMXEVTYPER: Event selection reg
+ */
+-#define ARMV8_EVTYPE_MASK 0xc00000ff /* Mask for writable bits */
++#define ARMV8_EVTYPE_MASK 0xc80000ff /* Mask for writable bits */
+ #define ARMV8_EVTYPE_EVENT 0xff /* Mask for EVENT bits */
+
+ /*
+diff --git a/arch/mips/ath79/clock.c b/arch/mips/ath79/clock.c
+index 765ef30e..733017b3 100644
+--- a/arch/mips/ath79/clock.c
++++ b/arch/mips/ath79/clock.c
+@@ -164,7 +164,7 @@ static void __init ar933x_clocks_init(void)
+ ath79_ahb_clk.rate = freq / t;
+ }
+
+- ath79_wdt_clk.rate = ath79_ref_clk.rate;
++ ath79_wdt_clk.rate = ath79_ahb_clk.rate;
+ ath79_uart_clk.rate = ath79_ref_clk.rate;
+ }
+
+diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
+index ee5b690a..52e5758e 100644
+--- a/arch/powerpc/kernel/align.c
++++ b/arch/powerpc/kernel/align.c
+@@ -764,6 +764,16 @@ int fix_alignment(struct pt_regs *regs)
+ nb = aligninfo[instr].len;
+ flags = aligninfo[instr].flags;
+
++ /* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */
++ if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) {
++ nb = 8;
++ flags = LD+SW;
++ } else if (IS_XFORM(instruction) &&
++ ((instruction >> 1) & 0x3ff) == 660) {
++ nb = 8;
++ flags = ST+SW;
++ }
++
+ /* Byteswap little endian loads and stores */
+ swiz = 0;
+ if (regs->msr & MSR_LE) {
+diff --git a/arch/powerpc/kvm/book3s_xics.c b/arch/powerpc/kvm/book3s_xics.c
+index 94c1dd46..a3a5cb8e 100644
+--- a/arch/powerpc/kvm/book3s_xics.c
++++ b/arch/powerpc/kvm/book3s_xics.c
+@@ -19,6 +19,7 @@
+ #include <asm/hvcall.h>
+ #include <asm/xics.h>
+ #include <asm/debug.h>
++#include <asm/time.h>
+
+ #include <linux/debugfs.h>
+ #include <linux/seq_file.h>
+diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
+index c11c8238..54b998f2 100644
+--- a/arch/powerpc/platforms/pseries/setup.c
++++ b/arch/powerpc/platforms/pseries/setup.c
+@@ -354,7 +354,7 @@ static int alloc_dispatch_log_kmem_cache(void)
+ }
+ early_initcall(alloc_dispatch_log_kmem_cache);
+
+-static void pSeries_idle(void)
++static void pseries_lpar_idle(void)
+ {
+ /* This would call on the cpuidle framework, and the back-end pseries
+ * driver to go to idle states
+@@ -362,10 +362,22 @@ static void pSeries_idle(void)
+ if (cpuidle_idle_call()) {
+ /* On error, execute default handler
+ * to go into low thread priority and possibly
+- * low power mode.
++ * low power mode by cedeing processor to hypervisor
+ */
+- HMT_low();
+- HMT_very_low();
++
++ /* Indicate to hypervisor that we are idle. */
++ get_lppaca()->idle = 1;
++
++ /*
++ * Yield the processor to the hypervisor. We return if
++ * an external interrupt occurs (which are driven prior
++ * to returning here) or if a prod occurs from another
++ * processor. When returning here, external interrupts
++ * are enabled.
++ */
++ cede_processor();
++
++ get_lppaca()->idle = 0;
+ }
+ }
+
+@@ -456,15 +468,14 @@ static void __init pSeries_setup_arch(void)
+
+ pSeries_nvram_init();
+
+- if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
++ if (firmware_has_feature(FW_FEATURE_LPAR)) {
+ vpa_init(boot_cpuid);
+- ppc_md.power_save = pSeries_idle;
+- }
+-
+- if (firmware_has_feature(FW_FEATURE_LPAR))
++ ppc_md.power_save = pseries_lpar_idle;
+ ppc_md.enable_pmcs = pseries_lpar_enable_pmcs;
+- else
++ } else {
++ /* No special idle routine */
+ ppc_md.enable_pmcs = power4_enable_pmcs;
++ }
+
+ ppc_md.pcibios_root_bridge_prepare = pseries_root_bridge_prepare;
+
+diff --git a/arch/um/include/shared/os.h b/arch/um/include/shared/os.h
+index 95feaa47..c70a234a 100644
+--- a/arch/um/include/shared/os.h
++++ b/arch/um/include/shared/os.h
+@@ -200,6 +200,7 @@ extern int os_unmap_memory(void *addr, int len);
+ extern int os_drop_memory(void *addr, int length);
+ extern int can_drop_memory(void);
+ extern void os_flush_stdout(void);
++extern int os_mincore(void *addr, unsigned long len);
+
+ /* execvp.c */
+ extern int execvp_noalloc(char *buf, const char *file, char *const argv[]);
+diff --git a/arch/um/kernel/Makefile b/arch/um/kernel/Makefile
+index babe2182..d8b78a03 100644
+--- a/arch/um/kernel/Makefile
++++ b/arch/um/kernel/Makefile
+@@ -13,7 +13,7 @@ clean-files :=
+ obj-y = config.o exec.o exitcode.o irq.o ksyms.o mem.o \
+ physmem.o process.o ptrace.o reboot.o sigio.o \
+ signal.o smp.o syscall.o sysrq.o time.o tlb.o trap.o \
+- um_arch.o umid.o skas/
++ um_arch.o umid.o maccess.o skas/
+
+ obj-$(CONFIG_BLK_DEV_INITRD) += initrd.o
+ obj-$(CONFIG_GPROF) += gprof_syms.o
+diff --git a/arch/um/kernel/maccess.c b/arch/um/kernel/maccess.c
+new file mode 100644
+index 00000000..1f3d5c49
+--- /dev/null
++++ b/arch/um/kernel/maccess.c
+@@ -0,0 +1,24 @@
++/*
++ * Copyright (C) 2013 Richard Weinberger <richrd@nod.at>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/uaccess.h>
++#include <linux/kernel.h>
++#include <os.h>
++
++long probe_kernel_read(void *dst, const void *src, size_t size)
++{
++ void *psrc = (void *)rounddown((unsigned long)src, PAGE_SIZE);
++
++ if ((unsigned long)src < PAGE_SIZE || size <= 0)
++ return -EFAULT;
++
++ if (os_mincore(psrc, size + src - psrc) <= 0)
++ return -EFAULT;
++
++ return __probe_kernel_read(dst, src, size);
++}
+diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c
+index b8f34c9e..67b9c8f5 100644
+--- a/arch/um/os-Linux/process.c
++++ b/arch/um/os-Linux/process.c
+@@ -4,6 +4,7 @@
+ */
+
+ #include <stdio.h>
++#include <stdlib.h>
+ #include <unistd.h>
+ #include <errno.h>
+ #include <signal.h>
+@@ -232,6 +233,57 @@ out:
+ return ok;
+ }
+
++static int os_page_mincore(void *addr)
++{
++ char vec[2];
++ int ret;
++
++ ret = mincore(addr, UM_KERN_PAGE_SIZE, vec);
++ if (ret < 0) {
++ if (errno == ENOMEM || errno == EINVAL)
++ return 0;
++ else
++ return -errno;
++ }
++
++ return vec[0] & 1;
++}
++
++int os_mincore(void *addr, unsigned long len)
++{
++ char *vec;
++ int ret, i;
++
++ if (len <= UM_KERN_PAGE_SIZE)
++ return os_page_mincore(addr);
++
++ vec = calloc(1, (len + UM_KERN_PAGE_SIZE - 1) / UM_KERN_PAGE_SIZE);
++ if (!vec)
++ return -ENOMEM;
++
++ ret = mincore(addr, UM_KERN_PAGE_SIZE, vec);
++ if (ret < 0) {
++ if (errno == ENOMEM || errno == EINVAL)
++ ret = 0;
++ else
++ ret = -errno;
++
++ goto out;
++ }
++
++ for (i = 0; i < ((len + UM_KERN_PAGE_SIZE - 1) / UM_KERN_PAGE_SIZE); i++) {
++ if (!(vec[i] & 1)) {
++ ret = 0;
++ goto out;
++ }
++ }
++
++ ret = 1;
++out:
++ free(vec);
++ return ret;
++}
++
+ void init_new_thread_signals(void)
+ {
+ set_handler(SIGSEGV);
+diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
+index cf1a471a..10adb41f 100644
+--- a/arch/x86/ia32/ia32_signal.c
++++ b/arch/x86/ia32/ia32_signal.c
+@@ -459,7 +459,7 @@ int ia32_setup_rt_frame(int sig, struct ksignal *ksig,
+ else
+ put_user_ex(0, &frame->uc.uc_flags);
+ put_user_ex(0, &frame->uc.uc_link);
+- err |= __compat_save_altstack(&frame->uc.uc_stack, regs->sp);
++ compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+
+ if (ksig->ka.sa.sa_flags & SA_RESTORER)
+ restorer = ksig->ka.sa.sa_restorer;
+diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
+index 46fc474f..f50de695 100644
+--- a/arch/x86/include/asm/checksum_32.h
++++ b/arch/x86/include/asm/checksum_32.h
+@@ -49,9 +49,15 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
+ int len, __wsum sum,
+ int *err_ptr)
+ {
++ __wsum ret;
++
+ might_sleep();
+- return csum_partial_copy_generic((__force void *)src, dst,
+- len, sum, err_ptr, NULL);
++ stac();
++ ret = csum_partial_copy_generic((__force void *)src, dst,
++ len, sum, err_ptr, NULL);
++ clac();
++
++ return ret;
+ }
+
+ /*
+@@ -176,10 +182,16 @@ static inline __wsum csum_and_copy_to_user(const void *src,
+ int len, __wsum sum,
+ int *err_ptr)
+ {
++ __wsum ret;
++
+ might_sleep();
+- if (access_ok(VERIFY_WRITE, dst, len))
+- return csum_partial_copy_generic(src, (__force void *)dst,
+- len, sum, NULL, err_ptr);
++ if (access_ok(VERIFY_WRITE, dst, len)) {
++ stac();
++ ret = csum_partial_copy_generic(src, (__force void *)dst,
++ len, sum, NULL, err_ptr);
++ clac();
++ return ret;
++ }
+
+ if (len)
+ *err_ptr = -EFAULT;
+diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
+index fa5f71e0..e6833c65 100644
+--- a/arch/x86/include/asm/mce.h
++++ b/arch/x86/include/asm/mce.h
+@@ -32,11 +32,20 @@
+ #define MCI_STATUS_PCC (1ULL<<57) /* processor context corrupt */
+ #define MCI_STATUS_S (1ULL<<56) /* Signaled machine check */
+ #define MCI_STATUS_AR (1ULL<<55) /* Action required */
+-#define MCACOD 0xffff /* MCA Error Code */
++
++/*
++ * Note that the full MCACOD field of IA32_MCi_STATUS MSR is
++ * bits 15:0. But bit 12 is the 'F' bit, defined for corrected
++ * errors to indicate that errors are being filtered by hardware.
++ * We should mask out bit 12 when looking for specific signatures
++ * of uncorrected errors - so the F bit is deliberately skipped
++ * in this #define.
++ */
++#define MCACOD 0xefff /* MCA Error Code */
+
+ /* Architecturally defined codes from SDM Vol. 3B Chapter 15 */
+ #define MCACOD_SCRUB 0x00C0 /* 0xC0-0xCF Memory Scrubbing */
+-#define MCACOD_SCRUBMSK 0xfff0
++#define MCACOD_SCRUBMSK 0xeff0 /* Skip bit 12 ('F' bit) */
+ #define MCACOD_L3WB 0x017A /* L3 Explicit Writeback */
+ #define MCACOD_DATA 0x0134 /* Data Load */
+ #define MCACOD_INSTR 0x0150 /* Instruction Fetch */
+diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
+index cdbf3677..be12c534 100644
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -45,22 +45,28 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ /* Re-load page tables */
+ load_cr3(next->pgd);
+
+- /* stop flush ipis for the previous mm */
++ /* Stop flush ipis for the previous mm */
+ cpumask_clear_cpu(cpu, mm_cpumask(prev));
+
+- /*
+- * load the LDT, if the LDT is different:
+- */
++ /* Load the LDT, if the LDT is different: */
+ if (unlikely(prev->context.ldt != next->context.ldt))
+ load_LDT_nolock(&next->context);
+ }
+ #ifdef CONFIG_SMP
+- else {
++ else {
+ this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+ BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next);
+
+- if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next))) {
+- /* We were in lazy tlb mode and leave_mm disabled
++ if (!cpumask_test_cpu(cpu, mm_cpumask(next))) {
++ /*
++ * On established mms, the mm_cpumask is only changed
++ * from irq context, from ptep_clear_flush() while in
++ * lazy tlb mode, and here. Irqs are blocked during
++ * schedule, protecting us from simultaneous changes.
++ */
++ cpumask_set_cpu(cpu, mm_cpumask(next));
++ /*
++ * We were in lazy tlb mode and leave_mm disabled
+ * tlb flush IPI delivery. We must reload CR3
+ * to make sure to use no freed page tables.
+ */
+diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
+index 3048ded1..59554dca 100644
+--- a/arch/x86/kernel/amd_nb.c
++++ b/arch/x86/kernel/amd_nb.c
+@@ -20,6 +20,7 @@ const struct pci_device_id amd_nb_misc_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ {}
+ };
+@@ -27,6 +28,7 @@ EXPORT_SYMBOL(amd_nb_misc_ids);
+
+ static const struct pci_device_id amd_nb_link_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F4) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
+ {}
+ };
+@@ -81,13 +83,20 @@ int amd_cache_northbridges(void)
+ next_northbridge(misc, amd_nb_misc_ids);
+ node_to_amd_nb(i)->link = link =
+ next_northbridge(link, amd_nb_link_ids);
+- }
++ }
+
++ /* GART present only on Fam15h upto model 0fh */
+ if (boot_cpu_data.x86 == 0xf || boot_cpu_data.x86 == 0x10 ||
+- boot_cpu_data.x86 == 0x15)
++ (boot_cpu_data.x86 == 0x15 && boot_cpu_data.x86_model < 0x10))
+ amd_northbridges.flags |= AMD_NB_GART;
+
+ /*
++ * Check for L3 cache presence.
++ */
++ if (!cpuid_edx(0x80000006))
++ return 0;
++
++ /*
+ * Some CPU families support L3 Cache Index Disable. There are some
+ * limitations because of E382 and E388 on family 0x10.
+ */
+diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
+index 69562992..087ab2af 100644
+--- a/arch/x86/kernel/signal.c
++++ b/arch/x86/kernel/signal.c
+@@ -364,7 +364,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
+ else
+ put_user_ex(0, &frame->uc.uc_flags);
+ put_user_ex(0, &frame->uc.uc_link);
+- err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
++ save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+
+ /* Set up to return from userspace. */
+ restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
+@@ -429,7 +429,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
+ else
+ put_user_ex(0, &frame->uc.uc_flags);
+ put_user_ex(0, &frame->uc.uc_link);
+- err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
++ save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+
+ /* Set up to return from userspace. If provided, use a stub
+ already in userspace. */
+@@ -496,7 +496,7 @@ static int x32_setup_rt_frame(struct ksignal *ksig,
+ else
+ put_user_ex(0, &frame->uc.uc_flags);
+ put_user_ex(0, &frame->uc.uc_link);
+- err |= __compat_save_altstack(&frame->uc.uc_stack, regs->sp);
++ compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+ put_user_ex(0, &frame->uc.uc__pad0);
+
+ if (ksig->ka.sa.sa_flags & SA_RESTORER) {
+diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
+index 25b7ae8d..7609e0e4 100644
+--- a/arch/x86/lib/csum-wrappers_64.c
++++ b/arch/x86/lib/csum-wrappers_64.c
+@@ -6,6 +6,7 @@
+ */
+ #include <asm/checksum.h>
+ #include <linux/module.h>
++#include <asm/smap.h>
+
+ /**
+ * csum_partial_copy_from_user - Copy and checksum from user space.
+@@ -52,8 +53,10 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
+ len -= 2;
+ }
+ }
++ stac();
+ isum = csum_partial_copy_generic((__force const void *)src,
+ dst, len, isum, errp, NULL);
++ clac();
+ if (unlikely(*errp))
+ goto out_err;
+
+@@ -82,6 +85,8 @@ __wsum
+ csum_partial_copy_to_user(const void *src, void __user *dst,
+ int len, __wsum isum, int *errp)
+ {
++ __wsum ret;
++
+ might_sleep();
+
+ if (unlikely(!access_ok(VERIFY_WRITE, dst, len))) {
+@@ -105,8 +110,11 @@ csum_partial_copy_to_user(const void *src, void __user *dst,
+ }
+
+ *errp = 0;
+- return csum_partial_copy_generic(src, (void __force *)dst,
+- len, isum, NULL, errp);
++ stac();
++ ret = csum_partial_copy_generic(src, (void __force *)dst,
++ len, isum, NULL, errp);
++ clac();
++ return ret;
+ }
+ EXPORT_SYMBOL(csum_partial_copy_to_user);
+
+diff --git a/crypto/api.c b/crypto/api.c
+index 3b618033..37c4c721 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -34,6 +34,8 @@ EXPORT_SYMBOL_GPL(crypto_alg_sem);
+ BLOCKING_NOTIFIER_HEAD(crypto_chain);
+ EXPORT_SYMBOL_GPL(crypto_chain);
+
++static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg);
++
+ struct crypto_alg *crypto_mod_get(struct crypto_alg *alg)
+ {
+ return try_module_get(alg->cra_module) ? crypto_alg_get(alg) : NULL;
+@@ -144,8 +146,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,
+ }
+ up_write(&crypto_alg_sem);
+
+- if (alg != &larval->alg)
++ if (alg != &larval->alg) {
+ kfree(larval);
++ if (crypto_is_larval(alg))
++ alg = crypto_larval_wait(alg);
++ }
+
+ return alg;
+ }
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index cab13f2f..7c451cb2 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -155,12 +155,13 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
+ pdata->mmio_size = resource_size(&rentry->res);
+ pdata->mmio_base = ioremap(rentry->res.start,
+ pdata->mmio_size);
+- pdata->dev_desc = dev_desc;
+ break;
+ }
+
+ acpi_dev_free_resource_list(&resource_list);
+
++ pdata->dev_desc = dev_desc;
++
+ if (dev_desc->clk_required) {
+ ret = register_device_clock(adev, pdata);
+ if (ret) {
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index aff789d6..8c7421af 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -1565,11 +1565,12 @@ rbd_img_obj_request_read_callback(struct rbd_obj_request *obj_request)
+ obj_request, obj_request->img_request, obj_request->result,
+ xferred, length);
+ /*
+- * ENOENT means a hole in the image. We zero-fill the
+- * entire length of the request. A short read also implies
+- * zero-fill to the end of the request. Either way we
+- * update the xferred count to indicate the whole request
+- * was satisfied.
++ * ENOENT means a hole in the image. We zero-fill the entire
++ * length of the request. A short read also implies zero-fill
++ * to the end of the request. An error requires the whole
++ * length of the request to be reported finished with an error
++ * to the block layer. In each case we update the xferred
++ * count to indicate the whole request was satisfied.
+ */
+ rbd_assert(obj_request->type != OBJ_REQUEST_NODATA);
+ if (obj_request->result == -ENOENT) {
+@@ -1578,14 +1579,13 @@ rbd_img_obj_request_read_callback(struct rbd_obj_request *obj_request)
+ else
+ zero_pages(obj_request->pages, 0, length);
+ obj_request->result = 0;
+- obj_request->xferred = length;
+ } else if (xferred < length && !obj_request->result) {
+ if (obj_request->type == OBJ_REQUEST_BIO)
+ zero_bio_chain(obj_request->bio_list, xferred);
+ else
+ zero_pages(obj_request->pages, xferred, length);
+- obj_request->xferred = length;
+ }
++ obj_request->xferred = length;
+ obj_request_done_set(obj_request);
+ }
+
+diff --git a/drivers/clk/clk-wm831x.c b/drivers/clk/clk-wm831x.c
+index 16ed0680..917a3ab4 100644
+--- a/drivers/clk/clk-wm831x.c
++++ b/drivers/clk/clk-wm831x.c
+@@ -360,6 +360,8 @@ static int wm831x_clk_probe(struct platform_device *pdev)
+ if (!clkdata)
+ return -ENOMEM;
+
++ clkdata->wm831x = wm831x;
++
+ /* XTAL_ENA can only be set via OTP/InstantConfig so just read once */
+ ret = wm831x_reg_read(wm831x, WM831X_CLOCK_CONTROL_2);
+ if (ret < 0) {
+diff --git a/drivers/cpuidle/coupled.c b/drivers/cpuidle/coupled.c
+index 2a297f86..fe853903 100644
+--- a/drivers/cpuidle/coupled.c
++++ b/drivers/cpuidle/coupled.c
+@@ -106,6 +106,7 @@ struct cpuidle_coupled {
+ cpumask_t coupled_cpus;
+ int requested_state[NR_CPUS];
+ atomic_t ready_waiting_counts;
++ atomic_t abort_barrier;
+ int online_count;
+ int refcnt;
+ int prevent;
+@@ -122,12 +123,19 @@ static DEFINE_MUTEX(cpuidle_coupled_lock);
+ static DEFINE_PER_CPU(struct call_single_data, cpuidle_coupled_poke_cb);
+
+ /*
+- * The cpuidle_coupled_poked_mask mask is used to avoid calling
++ * The cpuidle_coupled_poke_pending mask is used to avoid calling
+ * __smp_call_function_single with the per cpu call_single_data struct already
+ * in use. This prevents a deadlock where two cpus are waiting for each others
+ * call_single_data struct to be available
+ */
+-static cpumask_t cpuidle_coupled_poked_mask;
++static cpumask_t cpuidle_coupled_poke_pending;
++
++/*
++ * The cpuidle_coupled_poked mask is used to ensure that each cpu has been poked
++ * once to minimize entering the ready loop with a poke pending, which would
++ * require aborting and retrying.
++ */
++static cpumask_t cpuidle_coupled_poked;
+
+ /**
+ * cpuidle_coupled_parallel_barrier - synchronize all online coupled cpus
+@@ -291,10 +299,11 @@ static inline int cpuidle_coupled_get_state(struct cpuidle_device *dev,
+ return state;
+ }
+
+-static void cpuidle_coupled_poked(void *info)
++static void cpuidle_coupled_handle_poke(void *info)
+ {
+ int cpu = (unsigned long)info;
+- cpumask_clear_cpu(cpu, &cpuidle_coupled_poked_mask);
++ cpumask_set_cpu(cpu, &cpuidle_coupled_poked);
++ cpumask_clear_cpu(cpu, &cpuidle_coupled_poke_pending);
+ }
+
+ /**
+@@ -313,7 +322,7 @@ static void cpuidle_coupled_poke(int cpu)
+ {
+ struct call_single_data *csd = &per_cpu(cpuidle_coupled_poke_cb, cpu);
+
+- if (!cpumask_test_and_set_cpu(cpu, &cpuidle_coupled_poked_mask))
++ if (!cpumask_test_and_set_cpu(cpu, &cpuidle_coupled_poke_pending))
+ __smp_call_function_single(cpu, csd, 0);
+ }
+
+@@ -340,30 +349,19 @@ static void cpuidle_coupled_poke_others(int this_cpu,
+ * @coupled: the struct coupled that contains the current cpu
+ * @next_state: the index in drv->states of the requested state for this cpu
+ *
+- * Updates the requested idle state for the specified cpuidle device,
+- * poking all coupled cpus out of idle if necessary to let them see the new
+- * state.
++ * Updates the requested idle state for the specified cpuidle device.
++ * Returns the number of waiting cpus.
+ */
+-static void cpuidle_coupled_set_waiting(int cpu,
++static int cpuidle_coupled_set_waiting(int cpu,
+ struct cpuidle_coupled *coupled, int next_state)
+ {
+- int w;
+-
+ coupled->requested_state[cpu] = next_state;
+
+ /*
+- * If this is the last cpu to enter the waiting state, poke
+- * all the other cpus out of their waiting state so they can
+- * enter a deeper state. This can race with one of the cpus
+- * exiting the waiting state due to an interrupt and
+- * decrementing waiting_count, see comment below.
+- *
+ * The atomic_inc_return provides a write barrier to order the write
+ * to requested_state with the later write that increments ready_count.
+ */
+- w = atomic_inc_return(&coupled->ready_waiting_counts) & WAITING_MASK;
+- if (w == coupled->online_count)
+- cpuidle_coupled_poke_others(cpu, coupled);
++ return atomic_inc_return(&coupled->ready_waiting_counts) & WAITING_MASK;
+ }
+
+ /**
+@@ -410,19 +408,33 @@ static void cpuidle_coupled_set_done(int cpu, struct cpuidle_coupled *coupled)
+ * been processed and the poke bit has been cleared.
+ *
+ * Other interrupts may also be processed while interrupts are enabled, so
+- * need_resched() must be tested after turning interrupts off again to make sure
++ * need_resched() must be tested after this function returns to make sure
+ * the interrupt didn't schedule work that should take the cpu out of idle.
+ *
+- * Returns 0 if need_resched was false, -EINTR if need_resched was true.
++ * Returns 0 if no poke was pending, 1 if a poke was cleared.
+ */
+ static int cpuidle_coupled_clear_pokes(int cpu)
+ {
++ if (!cpumask_test_cpu(cpu, &cpuidle_coupled_poke_pending))
++ return 0;
++
+ local_irq_enable();
+- while (cpumask_test_cpu(cpu, &cpuidle_coupled_poked_mask))
++ while (cpumask_test_cpu(cpu, &cpuidle_coupled_poke_pending))
+ cpu_relax();
+ local_irq_disable();
+
+- return need_resched() ? -EINTR : 0;
++ return 1;
++}
++
++static bool cpuidle_coupled_any_pokes_pending(struct cpuidle_coupled *coupled)
++{
++ cpumask_t cpus;
++ int ret;
++
++ cpumask_and(&cpus, cpu_online_mask, &coupled->coupled_cpus);
++ ret = cpumask_and(&cpus, &cpuidle_coupled_poke_pending, &cpus);
++
++ return ret;
+ }
+
+ /**
+@@ -449,12 +461,14 @@ int cpuidle_enter_state_coupled(struct cpuidle_device *dev,
+ {
+ int entered_state = -1;
+ struct cpuidle_coupled *coupled = dev->coupled;
++ int w;
+
+ if (!coupled)
+ return -EINVAL;
+
+ while (coupled->prevent) {
+- if (cpuidle_coupled_clear_pokes(dev->cpu)) {
++ cpuidle_coupled_clear_pokes(dev->cpu);
++ if (need_resched()) {
+ local_irq_enable();
+ return entered_state;
+ }
+@@ -465,15 +479,37 @@ int cpuidle_enter_state_coupled(struct cpuidle_device *dev,
+ /* Read barrier ensures online_count is read after prevent is cleared */
+ smp_rmb();
+
+- cpuidle_coupled_set_waiting(dev->cpu, coupled, next_state);
++reset:
++ cpumask_clear_cpu(dev->cpu, &cpuidle_coupled_poked);
++
++ w = cpuidle_coupled_set_waiting(dev->cpu, coupled, next_state);
++ /*
++ * If this is the last cpu to enter the waiting state, poke
++ * all the other cpus out of their waiting state so they can
++ * enter a deeper state. This can race with one of the cpus
++ * exiting the waiting state due to an interrupt and
++ * decrementing waiting_count, see comment below.
++ */
++ if (w == coupled->online_count) {
++ cpumask_set_cpu(dev->cpu, &cpuidle_coupled_poked);
++ cpuidle_coupled_poke_others(dev->cpu, coupled);
++ }
+
+ retry:
+ /*
+ * Wait for all coupled cpus to be idle, using the deepest state
+- * allowed for a single cpu.
++ * allowed for a single cpu. If this was not the poking cpu, wait
++ * for at least one poke before leaving to avoid a race where
++ * two cpus could arrive at the waiting loop at the same time,
++ * but the first of the two to arrive could skip the loop without
++ * processing the pokes from the last to arrive.
+ */
+- while (!cpuidle_coupled_cpus_waiting(coupled)) {
+- if (cpuidle_coupled_clear_pokes(dev->cpu)) {
++ while (!cpuidle_coupled_cpus_waiting(coupled) ||
++ !cpumask_test_cpu(dev->cpu, &cpuidle_coupled_poked)) {
++ if (cpuidle_coupled_clear_pokes(dev->cpu))
++ continue;
++
++ if (need_resched()) {
+ cpuidle_coupled_set_not_waiting(dev->cpu, coupled);
+ goto out;
+ }
+@@ -487,12 +523,19 @@ retry:
+ dev->safe_state_index);
+ }
+
+- if (cpuidle_coupled_clear_pokes(dev->cpu)) {
++ cpuidle_coupled_clear_pokes(dev->cpu);
++ if (need_resched()) {
+ cpuidle_coupled_set_not_waiting(dev->cpu, coupled);
+ goto out;
+ }
+
+ /*
++ * Make sure final poke status for this cpu is visible before setting
++ * cpu as ready.
++ */
++ smp_wmb();
++
++ /*
+ * All coupled cpus are probably idle. There is a small chance that
+ * one of the other cpus just became active. Increment the ready count,
+ * and spin until all coupled cpus have incremented the counter. Once a
+@@ -511,6 +554,28 @@ retry:
+ cpu_relax();
+ }
+
++ /*
++ * Make sure read of all cpus ready is done before reading pending pokes
++ */
++ smp_rmb();
++
++ /*
++ * There is a small chance that a cpu left and reentered idle after this
++ * cpu saw that all cpus were waiting. The cpu that reentered idle will
++ * have sent this cpu a poke, which will still be pending after the
++ * ready loop. The pending interrupt may be lost by the interrupt
++ * controller when entering the deep idle state. It's not possible to
++ * clear a pending interrupt without turning interrupts on and handling
++ * it, and it's too late to turn on interrupts here, so reset the
++ * coupled idle state of all cpus and retry.
++ */
++ if (cpuidle_coupled_any_pokes_pending(coupled)) {
++ cpuidle_coupled_set_done(dev->cpu, coupled);
++ /* Wait for all cpus to see the pending pokes */
++ cpuidle_coupled_parallel_barrier(dev, &coupled->abort_barrier);
++ goto reset;
++ }
++
+ /* all cpus have acked the coupled state */
+ next_state = cpuidle_coupled_get_state(dev, coupled);
+
+@@ -596,7 +661,7 @@ have_coupled:
+ coupled->refcnt++;
+
+ csd = &per_cpu(cpuidle_coupled_poke_cb, dev->cpu);
+- csd->func = cpuidle_coupled_poked;
++ csd->func = cpuidle_coupled_handle_poke;
+ csd->info = (void *)(unsigned long)dev->cpu;
+
+ return 0;
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index 8b6a0343..8b3d9014 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -2470,8 +2470,15 @@ static int amd64_init_one_instance(struct pci_dev *F2)
+ layers[0].size = pvt->csels[0].b_cnt;
+ layers[0].is_virt_csrow = true;
+ layers[1].type = EDAC_MC_LAYER_CHANNEL;
+- layers[1].size = pvt->channel_count;
++
++ /*
++ * Always allocate two channels since we can have setups with DIMMs on
++ * only one channel. Also, this simplifies handling later for the price
++ * of a couple of KBs tops.
++ */
++ layers[1].size = 2;
+ layers[1].is_virt_csrow = false;
++
+ mci = edac_mc_alloc(nid, ARRAY_SIZE(layers), layers, 0);
+ if (!mci)
+ goto err_siblings;
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 9e62bbed..0cb9b5d8 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -125,6 +125,9 @@ static struct edid_quirk {
+
+ /* ViewSonic VA2026w */
+ { "VSC", 5020, EDID_QUIRK_FORCE_REDUCED_BLANKING },
++
++ /* Medion MD 30217 PG */
++ { "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
+ };
+
+ /*
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 402f4868..ed626e01 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -63,6 +63,8 @@ struct hid_report *hid_register_report(struct hid_device *device, unsigned type,
+ struct hid_report_enum *report_enum = device->report_enum + type;
+ struct hid_report *report;
+
++ if (id >= HID_MAX_IDS)
++ return NULL;
+ if (report_enum->report_id_hash[id])
+ return report_enum->report_id_hash[id];
+
+@@ -404,8 +406,10 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
+
+ case HID_GLOBAL_ITEM_TAG_REPORT_ID:
+ parser->global.report_id = item_udata(item);
+- if (parser->global.report_id == 0) {
+- hid_err(parser->device, "report_id 0 is invalid\n");
++ if (parser->global.report_id == 0 ||
++ parser->global.report_id >= HID_MAX_IDS) {
++ hid_err(parser->device, "report_id %u is invalid\n",
++ parser->global.report_id);
+ return -1;
+ }
+ return 0;
+@@ -575,7 +579,7 @@ static void hid_close_report(struct hid_device *device)
+ for (i = 0; i < HID_REPORT_TYPES; i++) {
+ struct hid_report_enum *report_enum = device->report_enum + i;
+
+- for (j = 0; j < 256; j++) {
++ for (j = 0; j < HID_MAX_IDS; j++) {
+ struct hid_report *report = report_enum->report_id_hash[j];
+ if (report)
+ hid_free_report(report);
+@@ -1152,7 +1156,12 @@ EXPORT_SYMBOL_GPL(hid_output_report);
+
+ int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
+ {
+- unsigned size = field->report_size;
++ unsigned size;
++
++ if (!field)
++ return -1;
++
++ size = field->report_size;
+
+ hid_dump_input(field->report->device, field->usage + offset, value);
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 21688853..ca0219f9 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -135,9 +135,9 @@
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS 0x023b
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI 0x0255
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO 0x0256
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0291
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0292
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0293
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0290
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0291
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0292
+ #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY 0x030a
+ #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY 0x030b
+ #define USB_DEVICE_ID_APPLE_IRCONTROL 0x8240
+@@ -646,6 +646,7 @@
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16 0x0012
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17 0x0013
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18 0x0014
++#define USB_DEVICE_ID_NTRIG_DUOSENSE 0x1500
+
+ #define USB_VENDOR_ID_ONTRAK 0x0a07
+ #define USB_DEVICE_ID_ONTRAK_ADU100 0x0064
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 945b8158..ac5e9352 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -340,7 +340,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ {
+ struct hid_device *dev = container_of(psy, struct hid_device, battery);
+ int ret = 0;
+- __u8 buf[2] = {};
++ __u8 *buf;
+
+ switch (prop) {
+ case POWER_SUPPLY_PROP_PRESENT:
+@@ -349,13 +349,20 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ break;
+
+ case POWER_SUPPLY_PROP_CAPACITY:
++
++ buf = kmalloc(2 * sizeof(__u8), GFP_KERNEL);
++ if (!buf) {
++ ret = -ENOMEM;
++ break;
++ }
+ ret = dev->hid_get_raw_report(dev, dev->battery_report_id,
+- buf, sizeof(buf),
++ buf, 2,
+ dev->battery_report_type);
+
+ if (ret != 2) {
+ if (ret >= 0)
+ ret = -EINVAL;
++ kfree(buf);
+ break;
+ }
+
+@@ -364,6 +371,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ buf[1] <= dev->battery_max)
+ val->intval = (100 * (buf[1] - dev->battery_min)) /
+ (dev->battery_max - dev->battery_min);
++ kfree(buf);
+ break;
+
+ case POWER_SUPPLY_PROP_MODEL_NAME:
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index ef951025..5482156a 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev)
+ struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT].
+ report_id_hash[0x0d];
+
+- if (!report)
++ if (!report || report->maxfield < 1 ||
++ report->field[0]->report_count < 1)
+ return -EINVAL;
+
+ hid_hw_request(hdev, report, HID_REQ_GET_REPORT);
+diff --git a/drivers/hid/hid-picolcd_cir.c b/drivers/hid/hid-picolcd_cir.c
+index e346038f..59d5eb1e 100644
+--- a/drivers/hid/hid-picolcd_cir.c
++++ b/drivers/hid/hid-picolcd_cir.c
+@@ -145,6 +145,7 @@ void picolcd_exit_cir(struct picolcd_data *data)
+ struct rc_dev *rdev = data->rc_dev;
+
+ data->rc_dev = NULL;
+- rc_unregister_device(rdev);
++ if (rdev)
++ rc_unregister_device(rdev);
+ }
+
+diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
+index b48092d0..acbb0210 100644
+--- a/drivers/hid/hid-picolcd_core.c
++++ b/drivers/hid/hid-picolcd_core.c
+@@ -290,7 +290,7 @@ static ssize_t picolcd_operation_mode_store(struct device *dev,
+ buf += 10;
+ cnt -= 10;
+ }
+- if (!report)
++ if (!report || report->maxfield != 1)
+ return -EINVAL;
+
+ while (cnt > 0 && (buf[cnt-1] == '\n' || buf[cnt-1] == '\r'))
+diff --git a/drivers/hid/hid-picolcd_fb.c b/drivers/hid/hid-picolcd_fb.c
+index 591f6b22..c930ab85 100644
+--- a/drivers/hid/hid-picolcd_fb.c
++++ b/drivers/hid/hid-picolcd_fb.c
+@@ -593,10 +593,14 @@ err_nomem:
+ void picolcd_exit_framebuffer(struct picolcd_data *data)
+ {
+ struct fb_info *info = data->fb_info;
+- struct picolcd_fb_data *fbdata = info->par;
++ struct picolcd_fb_data *fbdata;
+ unsigned long flags;
+
++ if (!info)
++ return;
++
+ device_remove_file(&data->hdev->dev, &dev_attr_fb_update_rate);
++ fbdata = info->par;
+
+ /* disconnect framebuffer from HID dev */
+ spin_lock_irqsave(&fbdata->lock, flags);
+diff --git a/drivers/hid/hid-pl.c b/drivers/hid/hid-pl.c
+index d29112fa..2dcd7d98 100644
+--- a/drivers/hid/hid-pl.c
++++ b/drivers/hid/hid-pl.c
+@@ -132,8 +132,14 @@ static int plff_init(struct hid_device *hid)
+ strong = &report->field[0]->value[2];
+ weak = &report->field[0]->value[3];
+ debug("detected single-field device");
+- } else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 &&
+- report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) {
++ } else if (report->field[0]->maxusage == 1 &&
++ report->field[0]->usage[0].hid ==
++ (HID_UP_LED | 0x43) &&
++ report->maxfield >= 4 &&
++ report->field[0]->report_count >= 1 &&
++ report->field[1]->report_count >= 1 &&
++ report->field[2]->report_count >= 1 &&
++ report->field[3]->report_count >= 1) {
+ report->field[0]->value[0] = 0x00;
+ report->field[1]->value[0] = 0x00;
+ strong = &report->field[2]->value[0];
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index ca749810..aa34755c 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -221,7 +221,8 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
+
+ mutex_lock(&data->mutex);
+ report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
+- if (!report || (field_index >= report->maxfield)) {
++ if (!report || (field_index >= report->maxfield) ||
++ report->field[field_index]->report_count < 1) {
+ ret = -EINVAL;
+ goto done_proc;
+ }
+diff --git a/drivers/hid/hid-speedlink.c b/drivers/hid/hid-speedlink.c
+index a2f587d0..7112f3e8 100644
+--- a/drivers/hid/hid-speedlink.c
++++ b/drivers/hid/hid-speedlink.c
+@@ -3,7 +3,7 @@
+ * Fixes "jumpy" cursor and removes nonexistent keyboard LEDS from
+ * the HID descriptor.
+ *
+- * Copyright (c) 2011 Stefan Kriwanek <mail@stefankriwanek.de>
++ * Copyright (c) 2011, 2013 Stefan Kriwanek <dev@stefankriwanek.de>
+ */
+
+ /*
+@@ -46,8 +46,13 @@ static int speedlink_event(struct hid_device *hdev, struct hid_field *field,
+ struct hid_usage *usage, __s32 value)
+ {
+ /* No other conditions due to usage_table. */
+- /* Fix "jumpy" cursor (invalid events sent by device). */
+- if (value == 256)
++
++ /* This fixes the "jumpy" cursor occuring due to invalid events sent
++ * by the device. Some devices only send them with value==+256, others
++ * don't. However, catching abs(value)>=256 is restrictive enough not
++ * to interfere with devices that were bug-free (has been tested).
++ */
++ if (abs(value) >= 256)
+ return 1;
+ /* Drop useless distance 0 events (on button clicks etc.) as well */
+ if (value == 0)
+diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
+index a7451632..612a655b 100644
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -113,7 +113,7 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer,
+ __u8 *buf;
+ int ret = 0;
+
+- if (!hidraw_table[minor]) {
++ if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
+ ret = -ENODEV;
+ goto out;
+ }
+@@ -261,7 +261,7 @@ static int hidraw_open(struct inode *inode, struct file *file)
+ }
+
+ mutex_lock(&minors_lock);
+- if (!hidraw_table[minor]) {
++ if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
+ err = -ENODEV;
+ goto out_unlock;
+ }
+@@ -302,39 +302,38 @@ static int hidraw_fasync(int fd, struct file *file, int on)
+ return fasync_helper(fd, file, on, &list->fasync);
+ }
+
++static void drop_ref(struct hidraw *hidraw, int exists_bit)
++{
++ if (exists_bit) {
++ hid_hw_close(hidraw->hid);
++ hidraw->exist = 0;
++ if (hidraw->open)
++ wake_up_interruptible(&hidraw->wait);
++ } else {
++ --hidraw->open;
++ }
++
++ if (!hidraw->open && !hidraw->exist) {
++ device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
++ hidraw_table[hidraw->minor] = NULL;
++ kfree(hidraw);
++ }
++}
++
+ static int hidraw_release(struct inode * inode, struct file * file)
+ {
+ unsigned int minor = iminor(inode);
+- struct hidraw *dev;
+ struct hidraw_list *list = file->private_data;
+- int ret;
+- int i;
+
+ mutex_lock(&minors_lock);
+- if (!hidraw_table[minor]) {
+- ret = -ENODEV;
+- goto unlock;
+- }
+
+ list_del(&list->node);
+- dev = hidraw_table[minor];
+- if (!--dev->open) {
+- if (list->hidraw->exist) {
+- hid_hw_power(dev->hid, PM_HINT_NORMAL);
+- hid_hw_close(dev->hid);
+- } else {
+- kfree(list->hidraw);
+- }
+- }
+-
+- for (i = 0; i < HIDRAW_BUFFER_SIZE; ++i)
+- kfree(list->buffer[i].value);
+ kfree(list);
+- ret = 0;
+-unlock:
+- mutex_unlock(&minors_lock);
+
+- return ret;
++ drop_ref(hidraw_table[minor], 0);
++
++ mutex_unlock(&minors_lock);
++ return 0;
+ }
+
+ static long hidraw_ioctl(struct file *file, unsigned int cmd,
+@@ -539,18 +538,9 @@ void hidraw_disconnect(struct hid_device *hid)
+ struct hidraw *hidraw = hid->hidraw;
+
+ mutex_lock(&minors_lock);
+- hidraw->exist = 0;
+-
+- device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
+
+- hidraw_table[hidraw->minor] = NULL;
++ drop_ref(hidraw, 1);
+
+- if (hidraw->open) {
+- hid_hw_close(hid);
+- wake_up_interruptible(&hidraw->wait);
+- } else {
+- kfree(hidraw);
+- }
+ mutex_unlock(&minors_lock);
+ }
+ EXPORT_SYMBOL_GPL(hidraw_disconnect);
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 19b8360f..07345521 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -109,6 +109,8 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
++ { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
++
+ { 0, 0 }
+ };
+
+diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
+index 4ef4d5e1..a73f9618 100644
+--- a/drivers/input/mouse/bcm5974.c
++++ b/drivers/input/mouse/bcm5974.c
+@@ -89,9 +89,9 @@
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO 0x025a
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS 0x025b
+ /* MacbookAir6,2 (unibody, June 2013) */
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0291
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0292
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0293
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0290
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0291
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0292
+
+ #define BCM5974_DEVICE(prod) { \
+ .match_flags = (USB_DEVICE_ID_MATCH_DEVICE | \
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index b4f0e28d..fa004b11 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -890,56 +890,54 @@ static int dma_pte_clear_range(struct dmar_domain *domain,
+ return order;
+ }
+
++static void dma_pte_free_level(struct dmar_domain *domain, int level,
++ struct dma_pte *pte, unsigned long pfn,
++ unsigned long start_pfn, unsigned long last_pfn)
++{
++ pfn = max(start_pfn, pfn);
++ pte = &pte[pfn_level_offset(pfn, level)];
++
++ do {
++ unsigned long level_pfn;
++ struct dma_pte *level_pte;
++
++ if (!dma_pte_present(pte) || dma_pte_superpage(pte))
++ goto next;
++
++ level_pfn = pfn & level_mask(level - 1);
++ level_pte = phys_to_virt(dma_pte_addr(pte));
++
++ if (level > 2)
++ dma_pte_free_level(domain, level - 1, level_pte,
++ level_pfn, start_pfn, last_pfn);
++
++ /* If range covers entire pagetable, free it */
++ if (!(start_pfn > level_pfn ||
++ last_pfn < level_pfn + level_size(level))) {
++ dma_clear_pte(pte);
++ domain_flush_cache(domain, pte, sizeof(*pte));
++ free_pgtable_page(level_pte);
++ }
++next:
++ pfn += level_size(level);
++ } while (!first_pte_in_page(++pte) && pfn <= last_pfn);
++}
++
+ /* free page table pages. last level pte should already be cleared */
+ static void dma_pte_free_pagetable(struct dmar_domain *domain,
+ unsigned long start_pfn,
+ unsigned long last_pfn)
+ {
+ int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
+- struct dma_pte *first_pte, *pte;
+- int total = agaw_to_level(domain->agaw);
+- int level;
+- unsigned long tmp;
+- int large_page = 2;
+
+ BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
+ BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width);
+ BUG_ON(start_pfn > last_pfn);
+
+ /* We don't need lock here; nobody else touches the iova range */
+- level = 2;
+- while (level <= total) {
+- tmp = align_to_level(start_pfn, level);
+-
+- /* If we can't even clear one PTE at this level, we're done */
+- if (tmp + level_size(level) - 1 > last_pfn)
+- return;
+-
+- do {
+- large_page = level;
+- first_pte = pte = dma_pfn_level_pte(domain, tmp, level, &large_page);
+- if (large_page > level)
+- level = large_page + 1;
+- if (!pte) {
+- tmp = align_to_level(tmp + 1, level + 1);
+- continue;
+- }
+- do {
+- if (dma_pte_present(pte)) {
+- free_pgtable_page(phys_to_virt(dma_pte_addr(pte)));
+- dma_clear_pte(pte);
+- }
+- pte++;
+- tmp += level_size(level);
+- } while (!first_pte_in_page(pte) &&
+- tmp + level_size(level) - 1 <= last_pfn);
++ dma_pte_free_level(domain, agaw_to_level(domain->agaw),
++ domain->pgd, 0, start_pfn, last_pfn);
+
+- domain_flush_cache(domain, first_pte,
+- (void *)pte - (void *)first_pte);
+-
+- } while (tmp && tmp + level_size(level) - 1 <= last_pfn);
+- level++;
+- }
+ /* free pgd */
+ if (start_pfn == 0 && last_pfn == DOMAIN_MAX_PFN(domain->gaw)) {
+ free_pgtable_page(domain->pgd);
+diff --git a/drivers/leds/leds-wm831x-status.c b/drivers/leds/leds-wm831x-status.c
+index 6bd5c679..b7d83d68 100644
+--- a/drivers/leds/leds-wm831x-status.c
++++ b/drivers/leds/leds-wm831x-status.c
+@@ -230,9 +230,9 @@ static int wm831x_status_probe(struct platform_device *pdev)
+ int id = pdev->id % ARRAY_SIZE(chip_pdata->status);
+ int ret;
+
+- res = platform_get_resource(pdev, IORESOURCE_IO, 0);
++ res = platform_get_resource(pdev, IORESOURCE_REG, 0);
+ if (res == NULL) {
+- dev_err(&pdev->dev, "No I/O resource\n");
++ dev_err(&pdev->dev, "No register resource\n");
+ ret = -EINVAL;
+ goto err;
+ }
+diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c
+index 297f1b2f..8df1aea5 100644
+--- a/drivers/media/common/siano/smsdvb-main.c
++++ b/drivers/media/common/siano/smsdvb-main.c
+@@ -275,7 +275,8 @@ static void smsdvb_update_per_slices(struct smsdvb_client_t *client,
+
+ /* Legacy PER/BER */
+ tmp = p->ets_packets * 65535;
+- do_div(tmp, p->ts_packets + p->ets_packets);
++ if (p->ts_packets + p->ets_packets)
++ do_div(tmp, p->ts_packets + p->ets_packets);
+ client->legacy_per = tmp;
+ }
+
+diff --git a/drivers/media/dvb-frontends/mb86a20s.c b/drivers/media/dvb-frontends/mb86a20s.c
+index 856374bd..2c7217fb 100644
+--- a/drivers/media/dvb-frontends/mb86a20s.c
++++ b/drivers/media/dvb-frontends/mb86a20s.c
+@@ -157,7 +157,6 @@ static struct regdata mb86a20s_init2[] = {
+ { 0x45, 0x04 }, /* CN symbol 4 */
+ { 0x48, 0x04 }, /* CN manual mode */
+
+- { 0x50, 0xd5 }, { 0x51, 0x01 }, /* Serial */
+ { 0x50, 0xd6 }, { 0x51, 0x1f },
+ { 0x50, 0xd2 }, { 0x51, 0x03 },
+ { 0x50, 0xd7 }, { 0x51, 0xbf },
+@@ -1860,16 +1859,15 @@ static int mb86a20s_initfe(struct dvb_frontend *fe)
+ dev_dbg(&state->i2c->dev, "%s: IF=%d, IF reg=0x%06llx\n",
+ __func__, state->if_freq, (long long)pll);
+
+- if (!state->config->is_serial) {
++ if (!state->config->is_serial)
+ regD5 &= ~1;
+
+- rc = mb86a20s_writereg(state, 0x50, 0xd5);
+- if (rc < 0)
+- goto err;
+- rc = mb86a20s_writereg(state, 0x51, regD5);
+- if (rc < 0)
+- goto err;
+- }
++ rc = mb86a20s_writereg(state, 0x50, 0xd5);
++ if (rc < 0)
++ goto err;
++ rc = mb86a20s_writereg(state, 0x51, regD5);
++ if (rc < 0)
++ goto err;
+
+ rc = mb86a20s_writeregdata(state, mb86a20s_init2);
+ if (rc < 0)
+diff --git a/drivers/media/platform/coda.c b/drivers/media/platform/coda.c
+index 9d1481a6..c504f70d 100644
+--- a/drivers/media/platform/coda.c
++++ b/drivers/media/platform/coda.c
+@@ -1933,7 +1933,7 @@ MODULE_DEVICE_TABLE(platform, coda_platform_ids);
+
+ #ifdef CONFIG_OF
+ static const struct of_device_id coda_dt_ids[] = {
+- { .compatible = "fsl,imx27-vpu", .data = &coda_platform_ids[CODA_IMX27] },
++ { .compatible = "fsl,imx27-vpu", .data = &coda_devdata[CODA_IMX27] },
+ { .compatible = "fsl,imx53-vpu", .data = &coda_devdata[CODA_IMX53] },
+ { /* sentinel */ }
+ };
+diff --git a/drivers/media/platform/exynos-gsc/gsc-core.c b/drivers/media/platform/exynos-gsc/gsc-core.c
+index 33b5ffc8..f45b940d 100644
+--- a/drivers/media/platform/exynos-gsc/gsc-core.c
++++ b/drivers/media/platform/exynos-gsc/gsc-core.c
+@@ -1122,10 +1122,14 @@ static int gsc_probe(struct platform_device *pdev)
+ goto err_clk;
+ }
+
+- ret = gsc_register_m2m_device(gsc);
++ ret = v4l2_device_register(dev, &gsc->v4l2_dev);
+ if (ret)
+ goto err_clk;
+
++ ret = gsc_register_m2m_device(gsc);
++ if (ret)
++ goto err_v4l2;
++
+ platform_set_drvdata(pdev, gsc);
+ pm_runtime_enable(dev);
+ ret = pm_runtime_get_sync(&pdev->dev);
+@@ -1147,6 +1151,8 @@ err_pm:
+ pm_runtime_put(dev);
+ err_m2m:
+ gsc_unregister_m2m_device(gsc);
++err_v4l2:
++ v4l2_device_unregister(&gsc->v4l2_dev);
+ err_clk:
+ gsc_clk_put(gsc);
+ return ret;
+@@ -1157,6 +1163,7 @@ static int gsc_remove(struct platform_device *pdev)
+ struct gsc_dev *gsc = platform_get_drvdata(pdev);
+
+ gsc_unregister_m2m_device(gsc);
++ v4l2_device_unregister(&gsc->v4l2_dev);
+
+ vb2_dma_contig_cleanup_ctx(gsc->alloc_ctx);
+ pm_runtime_disable(&pdev->dev);
+diff --git a/drivers/media/platform/exynos-gsc/gsc-core.h b/drivers/media/platform/exynos-gsc/gsc-core.h
+index cc19bba0..76435d3b 100644
+--- a/drivers/media/platform/exynos-gsc/gsc-core.h
++++ b/drivers/media/platform/exynos-gsc/gsc-core.h
+@@ -343,6 +343,7 @@ struct gsc_dev {
+ unsigned long state;
+ struct vb2_alloc_ctx *alloc_ctx;
+ struct video_device vdev;
++ struct v4l2_device v4l2_dev;
+ };
+
+ /**
+diff --git a/drivers/media/platform/exynos-gsc/gsc-m2m.c b/drivers/media/platform/exynos-gsc/gsc-m2m.c
+index 40a73f7d..e576ff2d 100644
+--- a/drivers/media/platform/exynos-gsc/gsc-m2m.c
++++ b/drivers/media/platform/exynos-gsc/gsc-m2m.c
+@@ -751,6 +751,7 @@ int gsc_register_m2m_device(struct gsc_dev *gsc)
+ gsc->vdev.release = video_device_release_empty;
+ gsc->vdev.lock = &gsc->lock;
+ gsc->vdev.vfl_dir = VFL_DIR_M2M;
++ gsc->vdev.v4l2_dev = &gsc->v4l2_dev;
+ snprintf(gsc->vdev.name, sizeof(gsc->vdev.name), "%s.%d:m2m",
+ GSC_MODULE_NAME, gsc->id);
+
+diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
+index 15ef8f28..b5b480be 100644
+--- a/drivers/media/platform/exynos4-is/media-dev.c
++++ b/drivers/media/platform/exynos4-is/media-dev.c
+@@ -1441,9 +1441,9 @@ static int fimc_md_probe(struct platform_device *pdev)
+ err_unlock:
+ mutex_unlock(&fmd->media_dev.graph_mutex);
+ err_clk:
+- media_device_unregister(&fmd->media_dev);
+ fimc_md_put_clocks(fmd);
+ fimc_md_unregister_entities(fmd);
++ media_device_unregister(&fmd->media_dev);
+ err_md:
+ v4l2_device_unregister(&fmd->v4l2_dev);
+ return ret;
+diff --git a/drivers/media/platform/s5p-g2d/g2d.c b/drivers/media/platform/s5p-g2d/g2d.c
+index 553d87e5..fd6289d6 100644
+--- a/drivers/media/platform/s5p-g2d/g2d.c
++++ b/drivers/media/platform/s5p-g2d/g2d.c
+@@ -784,6 +784,7 @@ static int g2d_probe(struct platform_device *pdev)
+ }
+ *vfd = g2d_videodev;
+ vfd->lock = &dev->mutex;
++ vfd->v4l2_dev = &dev->v4l2_dev;
+ ret = video_register_device(vfd, VFL_TYPE_GRABBER, 0);
+ if (ret) {
+ v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
+diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c
+index 8247c19d..77d7b7fb 100644
+--- a/drivers/media/usb/hdpvr/hdpvr-core.c
++++ b/drivers/media/usb/hdpvr/hdpvr-core.c
+@@ -311,6 +311,11 @@ static int hdpvr_probe(struct usb_interface *interface,
+
+ dev->workqueue = 0;
+
++ /* init video transfer queues first of all */
++ /* to prevent oops in hdpvr_delete() on error paths */
++ INIT_LIST_HEAD(&dev->free_buff_list);
++ INIT_LIST_HEAD(&dev->rec_buff_list);
++
+ /* register v4l2_device early so it can be used for printks */
+ if (v4l2_device_register(&interface->dev, &dev->v4l2_dev)) {
+ dev_err(&interface->dev, "v4l2_device_register failed\n");
+@@ -333,10 +338,6 @@ static int hdpvr_probe(struct usb_interface *interface,
+ if (!dev->workqueue)
+ goto error;
+
+- /* init video transfer queues */
+- INIT_LIST_HEAD(&dev->free_buff_list);
+- INIT_LIST_HEAD(&dev->rec_buff_list);
+-
+ dev->options = hdpvr_default_options;
+
+ if (default_video_input < HDPVR_VIDEO_INPUTS)
+@@ -413,7 +414,7 @@ static int hdpvr_probe(struct usb_interface *interface,
+ video_nr[atomic_inc_return(&dev_nr)]);
+ if (retval < 0) {
+ v4l2_err(&dev->v4l2_dev, "registering videodev failed\n");
+- goto error;
++ goto reg_fail;
+ }
+
+ /* let the user know what node this device is now attached to */
+diff --git a/drivers/mmc/host/tmio_mmc_dma.c b/drivers/mmc/host/tmio_mmc_dma.c
+index fff92860..491e9ecc 100644
+--- a/drivers/mmc/host/tmio_mmc_dma.c
++++ b/drivers/mmc/host/tmio_mmc_dma.c
+@@ -104,6 +104,7 @@ static void tmio_mmc_start_dma_rx(struct tmio_mmc_host *host)
+ pio:
+ if (!desc) {
+ /* DMA failed, fall back to PIO */
++ tmio_mmc_enable_dma(host, false);
+ if (ret >= 0)
+ ret = -EIO;
+ host->chan_rx = NULL;
+@@ -116,7 +117,6 @@ pio:
+ }
+ dev_warn(&host->pdev->dev,
+ "DMA failed: %d, falling back to PIO\n", ret);
+- tmio_mmc_enable_dma(host, false);
+ }
+
+ dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d, sg[%d]\n", __func__,
+@@ -185,6 +185,7 @@ static void tmio_mmc_start_dma_tx(struct tmio_mmc_host *host)
+ pio:
+ if (!desc) {
+ /* DMA failed, fall back to PIO */
++ tmio_mmc_enable_dma(host, false);
+ if (ret >= 0)
+ ret = -EIO;
+ host->chan_tx = NULL;
+@@ -197,7 +198,6 @@ pio:
+ }
+ dev_warn(&host->pdev->dev,
+ "DMA failed: %d, falling back to PIO\n", ret);
+- tmio_mmc_enable_dma(host, false);
+ }
+
+ dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d\n", __func__,
+diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
+index dfcd0a56..fb8c4dea 100644
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -2793,7 +2793,9 @@ static void nand_set_defaults(struct nand_chip *chip, int busw)
+
+ if (!chip->select_chip)
+ chip->select_chip = nand_select_chip;
+- if (!chip->read_byte)
++
++ /* If called twice, pointers that depend on busw may need to be reset */
++ if (!chip->read_byte || chip->read_byte == nand_read_byte)
+ chip->read_byte = busw ? nand_read_byte16 : nand_read_byte;
+ if (!chip->read_word)
+ chip->read_word = nand_read_word;
+@@ -2801,9 +2803,9 @@ static void nand_set_defaults(struct nand_chip *chip, int busw)
+ chip->block_bad = nand_block_bad;
+ if (!chip->block_markbad)
+ chip->block_markbad = nand_default_block_markbad;
+- if (!chip->write_buf)
++ if (!chip->write_buf || chip->write_buf == nand_write_buf)
+ chip->write_buf = busw ? nand_write_buf16 : nand_write_buf;
+- if (!chip->read_buf)
++ if (!chip->read_buf || chip->read_buf == nand_read_buf)
+ chip->read_buf = busw ? nand_read_buf16 : nand_read_buf;
+ if (!chip->scan_bbt)
+ chip->scan_bbt = nand_default_bbt;
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 5df49d3c..c95bfb18 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -1069,6 +1069,9 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ if (!(e2->ec - e1->ec >= UBI_WL_THRESHOLD)) {
+ dbg_wl("no WL needed: min used EC %d, max free EC %d",
+ e1->ec, e2->ec);
++
++ /* Give the unused PEB back */
++ wl_tree_add(e2, &ubi->free);
+ goto out_cancel;
+ }
+ self_check_in_wl_tree(ubi, e1, &ubi->used);
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+index e1714d7c..3457ca53 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -1076,6 +1076,10 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah,
+ * is_on == 0 means MRC CCK is OFF (more noise imm)
+ */
+ bool is_on = param ? 1 : 0;
++
++ if (ah->caps.rx_chainmask == 1)
++ break;
++
+ REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+ AR_PHY_MRC_CCK_ENABLE, is_on);
+ REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index 42b03dc3..4ebd9fd8 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -79,10 +79,6 @@ struct ath_config {
+ sizeof(struct ath_buf_state)); \
+ } while (0)
+
+-#define ATH_RXBUF_RESET(_bf) do { \
+- (_bf)->bf_stale = false; \
+- } while (0)
+-
+ /**
+ * enum buffer_type - Buffer type flags
+ *
+@@ -316,6 +312,7 @@ struct ath_rx {
+ struct ath_descdma rxdma;
+ struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
+
++ struct ath_buf *buf_hold;
+ struct sk_buff *frag;
+
+ u32 ampdu_ref;
+diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
+index 8be2b5d8..f53dbd11 100644
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -42,8 +42,6 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+ struct ath_desc *ds;
+ struct sk_buff *skb;
+
+- ATH_RXBUF_RESET(bf);
+-
+ ds = bf->bf_desc;
+ ds->ds_link = 0; /* link to null */
+ ds->ds_data = bf->bf_buf_addr;
+@@ -70,6 +68,14 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+ sc->rx.rxlink = &ds->ds_link;
+ }
+
++static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
++{
++ if (sc->rx.buf_hold)
++ ath_rx_buf_link(sc, sc->rx.buf_hold);
++
++ sc->rx.buf_hold = bf;
++}
++
+ static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
+ {
+ /* XXX block beacon interrupts */
+@@ -117,7 +123,6 @@ static bool ath_rx_edma_buf_link(struct ath_softc *sc,
+
+ skb = bf->bf_mpdu;
+
+- ATH_RXBUF_RESET(bf);
+ memset(skb->data, 0, ah->caps.rx_status_len);
+ dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+ ah->caps.rx_status_len, DMA_TO_DEVICE);
+@@ -432,6 +437,7 @@ int ath_startrecv(struct ath_softc *sc)
+ if (list_empty(&sc->rx.rxbuf))
+ goto start_recv;
+
++ sc->rx.buf_hold = NULL;
+ sc->rx.rxlink = NULL;
+ list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
+ ath_rx_buf_link(sc, bf);
+@@ -677,6 +683,9 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
+ }
+
+ bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
++ if (bf == sc->rx.buf_hold)
++ return NULL;
++
+ ds = bf->bf_desc;
+
+ /*
+@@ -1378,7 +1387,7 @@ requeue:
+ if (edma) {
+ ath_rx_edma_buf_link(sc, qtype);
+ } else {
+- ath_rx_buf_link(sc, bf);
++ ath_rx_buf_relink(sc, bf);
+ ath9k_hw_rxena(ah);
+ }
+ } while (1);
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 83ab6be3..e752f5d4 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2387,6 +2387,7 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
+ for (acno = 0, ac = &an->ac[acno];
+ acno < IEEE80211_NUM_ACS; acno++, ac++) {
+ ac->sched = false;
++ ac->clear_ps_filter = true;
+ ac->txq = sc->tx.txq_map[acno];
+ INIT_LIST_HEAD(&ac->tid_q);
+ }
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+index 1860c572..4fb9635d 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+@@ -1015,9 +1015,10 @@ static bool dma64_txidle(struct dma_info *di)
+
+ /*
+ * post receive buffers
+- * return false is refill failed completely and ring is empty this will stall
+- * the rx dma and user might want to call rxfill again asap. This unlikely
+- * happens on memory-rich NIC, but often on memory-constrained dongle
++ * Return false if refill failed completely or dma mapping failed. The ring
++ * is empty, which will stall the rx dma and user might want to call rxfill
++ * again asap. This is unlikely to happen on a memory-rich NIC, but often on
++ * memory-constrained dongle.
+ */
+ bool dma_rxfill(struct dma_pub *pub)
+ {
+@@ -1078,6 +1079,8 @@ bool dma_rxfill(struct dma_pub *pub)
+
+ pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
+ DMA_FROM_DEVICE);
++ if (dma_mapping_error(di->dmadev, pa))
++ return false;
+
+ /* save the free packet pointer */
+ di->rxp[rxout] = p;
+@@ -1284,7 +1287,11 @@ static void dma_txenq(struct dma_info *di, struct sk_buff *p)
+
+ /* get physical address of buffer start */
+ pa = dma_map_single(di->dmadev, data, len, DMA_TO_DEVICE);
+-
++ /* if mapping failed, free skb */
++ if (dma_mapping_error(di->dmadev, pa)) {
++ brcmu_pkt_buf_free_skb(p);
++ return;
++ }
+ /* With a DMA segment list, Descriptor table is filled
+ * using the segment list instead of looping over
+ * buffers in multi-chain DMA. Therefore, EOF for SGLIST
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index a6f584a7..1d10b4ec 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1629,6 +1629,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
+ ap = dt_alloc(sizeof(*ap) + len + 1, 4);
+ if (!ap)
+ continue;
++ memset(ap, 0, sizeof(*ap) + len + 1);
+ ap->alias = start;
+ of_alias_add(ap, np, id, start, len);
+ }
+diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
+index 5d7529ed..314e5e8e 100644
+--- a/drivers/pinctrl/pinctrl-at91.c
++++ b/drivers/pinctrl/pinctrl-at91.c
+@@ -325,7 +325,7 @@ static void at91_mux_disable_interrupt(void __iomem *pio, unsigned mask)
+
+ static unsigned at91_mux_get_pullup(void __iomem *pio, unsigned pin)
+ {
+- return (readl_relaxed(pio + PIO_PUSR) >> pin) & 0x1;
++ return !((readl_relaxed(pio + PIO_PUSR) >> pin) & 0x1);
+ }
+
+ static void at91_mux_set_pullup(void __iomem *pio, unsigned mask, bool on)
+@@ -445,7 +445,7 @@ static void at91_mux_pio3_set_debounce(void __iomem *pio, unsigned mask,
+
+ static bool at91_mux_pio3_get_pulldown(void __iomem *pio, unsigned pin)
+ {
+- return (__raw_readl(pio + PIO_PPDSR) >> pin) & 0x1;
++ return !((__raw_readl(pio + PIO_PPDSR) >> pin) & 0x1);
+ }
+
+ static void at91_mux_pio3_set_pulldown(void __iomem *pio, unsigned mask, bool is_on)
+diff --git a/drivers/scsi/mpt3sas/Makefile b/drivers/scsi/mpt3sas/Makefile
+index 4c1d2e7a..efb0c4c2 100644
+--- a/drivers/scsi/mpt3sas/Makefile
++++ b/drivers/scsi/mpt3sas/Makefile
+@@ -1,5 +1,5 @@
+ # mpt3sas makefile
+-obj-m += mpt3sas.o
++obj-$(CONFIG_SCSI_MPT3SAS) += mpt3sas.o
+ mpt3sas-y += mpt3sas_base.o \
+ mpt3sas_config.o \
+ mpt3sas_scsih.o \
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 610417ec..c3986344 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2409,14 +2409,9 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
+ }
+ }
+
+- if (modepage == 0x3F) {
+- sd_printk(KERN_ERR, sdkp, "No Caching mode page "
+- "present\n");
+- goto defaults;
+- } else if ((buffer[offset] & 0x3f) != modepage) {
+- sd_printk(KERN_ERR, sdkp, "Got wrong page\n");
+- goto defaults;
+- }
++ sd_printk(KERN_ERR, sdkp, "No Caching mode page found\n");
++ goto defaults;
++
+ Page_found:
+ if (modepage == 8) {
+ sdkp->WCE = ((buffer[offset + 2] & 0x04) != 0);
+diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c
+index 90f2de9b..f4c1e998 100644
+--- a/drivers/staging/comedi/drivers/dt282x.c
++++ b/drivers/staging/comedi/drivers/dt282x.c
+@@ -269,8 +269,9 @@ struct dt282x_private {
+ } \
+ udelay(5); \
+ } \
+- if (_i) \
++ if (_i) { \
+ b \
++ } \
+ } while (0)
+
+ static int prep_ai_dma(struct comedi_device *dev, int chan, int size);
+diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
+index 163c638e..972a0723 100644
+--- a/drivers/staging/iio/adc/mxs-lradc.c
++++ b/drivers/staging/iio/adc/mxs-lradc.c
+@@ -234,7 +234,6 @@ static int mxs_lradc_read_raw(struct iio_dev *iio_dev,
+ {
+ struct mxs_lradc *lradc = iio_priv(iio_dev);
+ int ret;
+- unsigned long mask;
+
+ if (m != IIO_CHAN_INFO_RAW)
+ return -EINVAL;
+@@ -243,12 +242,6 @@ static int mxs_lradc_read_raw(struct iio_dev *iio_dev,
+ if (chan->channel > LRADC_MAX_TOTAL_CHANS)
+ return -EINVAL;
+
+- /* Validate the channel if it doesn't intersect with reserved chans. */
+- bitmap_set(&mask, chan->channel, 1);
+- ret = iio_validate_scan_mask_onehot(iio_dev, &mask);
+- if (ret)
+- return -EINVAL;
+-
+ /*
+ * See if there is no buffered operation in progess. If there is, simply
+ * bail out. This can be improved to support both buffered and raw IO at
+@@ -661,12 +654,13 @@ static int mxs_lradc_trigger_init(struct iio_dev *iio)
+ {
+ int ret;
+ struct iio_trigger *trig;
++ struct mxs_lradc *lradc = iio_priv(iio);
+
+ trig = iio_trigger_alloc("%s-dev%i", iio->name, iio->id);
+ if (trig == NULL)
+ return -ENOMEM;
+
+- trig->dev.parent = iio->dev.parent;
++ trig->dev.parent = lradc->dev;
+ iio_trigger_set_drvdata(trig, iio);
+ trig->ops = &mxs_lradc_trigger_ops;
+
+@@ -676,15 +670,17 @@ static int mxs_lradc_trigger_init(struct iio_dev *iio)
+ return ret;
+ }
+
+- iio->trig = trig;
++ lradc->trig = trig;
+
+ return 0;
+ }
+
+ static void mxs_lradc_trigger_remove(struct iio_dev *iio)
+ {
+- iio_trigger_unregister(iio->trig);
+- iio_trigger_free(iio->trig);
++ struct mxs_lradc *lradc = iio_priv(iio);
++
++ iio_trigger_unregister(lradc->trig);
++ iio_trigger_free(lradc->trig);
+ }
+
+ static int mxs_lradc_buffer_preenable(struct iio_dev *iio)
+diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
+index cbe48ab4..f608fbc1 100644
+--- a/drivers/target/target_core_alua.c
++++ b/drivers/target/target_core_alua.c
+@@ -730,7 +730,7 @@ static int core_alua_write_tpg_metadata(
+ if (ret < 0)
+ pr_err("Error writing ALUA metadata file: %s\n", path);
+ fput(file);
+- return ret ? -EIO : 0;
++ return (ret < 0) ? -EIO : 0;
+ }
+
+ /*
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index 3240f2cc..04a74938 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -1987,7 +1987,7 @@ static int __core_scsi3_write_aptpl_to_file(
+ pr_debug("Error writing APTPL metadata file: %s\n", path);
+ fput(file);
+
+- return ret ? -EIO : 0;
++ return (ret < 0) ? -EIO : 0;
+ }
+
+ static int
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 44766821..59d26ef5 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -850,7 +850,8 @@ void disassociate_ctty(int on_exit)
+ struct pid *tty_pgrp = tty_get_pgrp(tty);
+ if (tty_pgrp) {
+ kill_pgrp(tty_pgrp, SIGHUP, on_exit);
+- kill_pgrp(tty_pgrp, SIGCONT, on_exit);
++ if (!on_exit)
++ kill_pgrp(tty_pgrp, SIGCONT, on_exit);
+ put_pid(tty_pgrp);
+ }
+ }
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 8a230f0e..d3318a0d 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -209,6 +209,7 @@ skip_error:
+ static void wdm_int_callback(struct urb *urb)
+ {
+ int rv = 0;
++ int responding;
+ int status = urb->status;
+ struct wdm_device *desc;
+ struct usb_cdc_notification *dr;
+@@ -262,8 +263,8 @@ static void wdm_int_callback(struct urb *urb)
+
+ spin_lock(&desc->iuspin);
+ clear_bit(WDM_READ, &desc->flags);
+- set_bit(WDM_RESPONDING, &desc->flags);
+- if (!test_bit(WDM_DISCONNECTING, &desc->flags)
++ responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
++ if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags)
+ && !test_bit(WDM_SUSPENDING, &desc->flags)) {
+ rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+ dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
+@@ -685,16 +686,20 @@ static void wdm_rxwork(struct work_struct *work)
+ {
+ struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);
+ unsigned long flags;
+- int rv;
++ int rv = 0;
++ int responding;
+
+ spin_lock_irqsave(&desc->iuspin, flags);
+ if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+ } else {
++ responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+- rv = usb_submit_urb(desc->response, GFP_KERNEL);
++ if (!responding)
++ rv = usb_submit_urb(desc->response, GFP_KERNEL);
+ if (rv < 0 && rv != -EPERM) {
+ spin_lock_irqsave(&desc->iuspin, flags);
++ clear_bit(WDM_RESPONDING, &desc->flags);
+ if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+ schedule_work(&desc->rxwork);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 7199adcc..a6b2cabe 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -424,7 +424,8 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
+
+ memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+ if (config->desc.bDescriptorType != USB_DT_CONFIG ||
+- config->desc.bLength < USB_DT_CONFIG_SIZE) {
++ config->desc.bLength < USB_DT_CONFIG_SIZE ||
++ config->desc.bLength > size) {
+ dev_err(ddev, "invalid descriptor for config index %d: "
+ "type = 0x%X, length = %d\n", cfgidx,
+ config->desc.bDescriptorType, config->desc.bLength);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index da2905a1..6cf2ae0a 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2916,7 +2916,6 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ {
+ struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent);
+ struct usb_port *port_dev = hub->ports[udev->portnum - 1];
+- enum pm_qos_flags_status pm_qos_stat;
+ int port1 = udev->portnum;
+ int status;
+ bool really_suspend = true;
+@@ -2954,7 +2953,7 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ status);
+ /* bail if autosuspend is requested */
+ if (PMSG_IS_AUTO(msg))
+- return status;
++ goto err_wakeup;
+ }
+ }
+
+@@ -2963,14 +2962,16 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ usb_set_usb2_hardware_lpm(udev, 0);
+
+ if (usb_disable_ltm(udev)) {
+- dev_err(&udev->dev, "%s Failed to disable LTM before suspend\n.",
+- __func__);
+- return -ENOMEM;
++ dev_err(&udev->dev, "Failed to disable LTM before suspend\n.");
++ status = -ENOMEM;
++ if (PMSG_IS_AUTO(msg))
++ goto err_ltm;
+ }
+ if (usb_unlocked_disable_lpm(udev)) {
+- dev_err(&udev->dev, "%s Failed to disable LPM before suspend\n.",
+- __func__);
+- return -ENOMEM;
++ dev_err(&udev->dev, "Failed to disable LPM before suspend\n.");
++ status = -ENOMEM;
++ if (PMSG_IS_AUTO(msg))
++ goto err_lpm3;
+ }
+
+ /* see 7.1.7.6 */
+@@ -2998,28 +2999,31 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ if (status) {
+ dev_dbg(hub->intfdev, "can't suspend port %d, status %d\n",
+ port1, status);
+- /* paranoia: "should not happen" */
+- if (udev->do_remote_wakeup) {
+- if (!hub_is_superspeed(hub->hdev)) {
+- (void) usb_control_msg(udev,
+- usb_sndctrlpipe(udev, 0),
+- USB_REQ_CLEAR_FEATURE,
+- USB_RECIP_DEVICE,
+- USB_DEVICE_REMOTE_WAKEUP, 0,
+- NULL, 0,
+- USB_CTRL_SET_TIMEOUT);
+- } else
+- (void) usb_disable_function_remotewakeup(udev);
+-
+- }
+
++ /* Try to enable USB3 LPM and LTM again */
++ usb_unlocked_enable_lpm(udev);
++ err_lpm3:
++ usb_enable_ltm(udev);
++ err_ltm:
+ /* Try to enable USB2 hardware LPM again */
+ if (udev->usb2_hw_lpm_capable == 1)
+ usb_set_usb2_hardware_lpm(udev, 1);
+
+- /* Try to enable USB3 LTM and LPM again */
+- usb_enable_ltm(udev);
+- usb_unlocked_enable_lpm(udev);
++ if (udev->do_remote_wakeup) {
++ if (udev->speed < USB_SPEED_SUPER)
++ usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
++ USB_REQ_CLEAR_FEATURE,
++ USB_RECIP_DEVICE,
++ USB_DEVICE_REMOTE_WAKEUP, 0,
++ NULL, 0, USB_CTRL_SET_TIMEOUT);
++ else
++ usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
++ USB_REQ_CLEAR_FEATURE,
++ USB_RECIP_INTERFACE,
++ USB_INTRF_FUNC_SUSPEND, 0,
++ NULL, 0, USB_CTRL_SET_TIMEOUT);
++ }
++ err_wakeup:
+
+ /* System sleep transitions should never fail */
+ if (!PMSG_IS_AUTO(msg))
+@@ -3037,16 +3041,7 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ usb_set_device_state(udev, USB_STATE_SUSPENDED);
+ }
+
+- /*
+- * Check whether current status meets the requirement of
+- * usb port power off mechanism
+- */
+- pm_qos_stat = dev_pm_qos_flags(&port_dev->dev,
+- PM_QOS_FLAG_NO_POWER_OFF);
+- if (!udev->do_remote_wakeup
+- && pm_qos_stat != PM_QOS_FLAGS_ALL
+- && udev->persist_enabled
+- && !status) {
++ if (status == 0 && !udev->do_remote_wakeup && udev->persist_enabled) {
+ pm_runtime_put_sync(&port_dev->dev);
+ port_dev->did_runtime_put = true;
+ }
+diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c
+index b8bad294..ef07b359 100644
+--- a/drivers/usb/core/port.c
++++ b/drivers/usb/core/port.c
+@@ -89,22 +89,19 @@ static int usb_port_runtime_resume(struct device *dev)
+ retval = usb_hub_set_port_power(hdev, port1, true);
+ if (port_dev->child && !retval) {
+ /*
+- * Wait for usb hub port to be reconnected in order to make
+- * the resume procedure successful.
++ * Attempt to wait for usb hub port to be reconnected in order
++ * to make the resume procedure successful. The device may have
++ * disconnected while the port was powered off, so ignore the
++ * return status.
+ */
+ retval = hub_port_debounce_be_connected(hub, port1);
+- if (retval < 0) {
++ if (retval < 0)
+ dev_dbg(&port_dev->dev, "can't get reconnection after setting port power on, status %d\n",
+ retval);
+- goto out;
+- }
+ usb_clear_port_feature(hdev, port1, USB_PORT_FEAT_C_ENABLE);
+-
+- /* Set return value to 0 if debounce successful */
+ retval = 0;
+ }
+
+-out:
+ clear_bit(port1, hub->busy_bits);
+ usb_autopm_put_interface(intf);
+ return retval;
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index f77083fe..14d28d61 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1508,6 +1508,15 @@ static int dwc3_gadget_start(struct usb_gadget *g,
+ int irq;
+ u32 reg;
+
++ irq = platform_get_irq(to_platform_device(dwc->dev), 0);
++ ret = request_threaded_irq(irq, dwc3_interrupt, dwc3_thread_interrupt,
++ IRQF_SHARED | IRQF_ONESHOT, "dwc3", dwc);
++ if (ret) {
++ dev_err(dwc->dev, "failed to request irq #%d --> %d\n",
++ irq, ret);
++ goto err0;
++ }
++
+ spin_lock_irqsave(&dwc->lock, flags);
+
+ if (dwc->gadget_driver) {
+@@ -1515,7 +1524,7 @@ static int dwc3_gadget_start(struct usb_gadget *g,
+ dwc->gadget.name,
+ dwc->gadget_driver->driver.name);
+ ret = -EBUSY;
+- goto err0;
++ goto err1;
+ }
+
+ dwc->gadget_driver = driver;
+@@ -1551,42 +1560,38 @@ static int dwc3_gadget_start(struct usb_gadget *g,
+ ret = __dwc3_gadget_ep_enable(dep, &dwc3_gadget_ep0_desc, NULL, false);
+ if (ret) {
+ dev_err(dwc->dev, "failed to enable %s\n", dep->name);
+- goto err0;
++ goto err2;
+ }
+
+ dep = dwc->eps[1];
+ ret = __dwc3_gadget_ep_enable(dep, &dwc3_gadget_ep0_desc, NULL, false);
+ if (ret) {
+ dev_err(dwc->dev, "failed to enable %s\n", dep->name);
+- goto err1;
++ goto err3;
+ }
+
+ /* begin to receive SETUP packets */
+ dwc->ep0state = EP0_SETUP_PHASE;
+ dwc3_ep0_out_start(dwc);
+
+- irq = platform_get_irq(to_platform_device(dwc->dev), 0);
+- ret = request_threaded_irq(irq, dwc3_interrupt, dwc3_thread_interrupt,
+- IRQF_SHARED | IRQF_ONESHOT, "dwc3", dwc);
+- if (ret) {
+- dev_err(dwc->dev, "failed to request irq #%d --> %d\n",
+- irq, ret);
+- goto err1;
+- }
+-
+ dwc3_gadget_enable_irq(dwc);
+
+ spin_unlock_irqrestore(&dwc->lock, flags);
+
+ return 0;
+
+-err1:
++err3:
+ __dwc3_gadget_ep_disable(dwc->eps[0]);
+
+-err0:
++err2:
+ dwc->gadget_driver = NULL;
++
++err1:
+ spin_unlock_irqrestore(&dwc->lock, flags);
+
++ free_irq(irq, dwc);
++
++err0:
+ return ret;
+ }
+
+@@ -1600,9 +1605,6 @@ static int dwc3_gadget_stop(struct usb_gadget *g,
+ spin_lock_irqsave(&dwc->lock, flags);
+
+ dwc3_gadget_disable_irq(dwc);
+- irq = platform_get_irq(to_platform_device(dwc->dev), 0);
+- free_irq(irq, dwc);
+-
+ __dwc3_gadget_ep_disable(dwc->eps[0]);
+ __dwc3_gadget_ep_disable(dwc->eps[1]);
+
+@@ -1610,6 +1612,9 @@ static int dwc3_gadget_stop(struct usb_gadget *g,
+
+ spin_unlock_irqrestore(&dwc->lock, flags);
+
++ irq = platform_get_irq(to_platform_device(dwc->dev), 0);
++ free_irq(irq, dwc);
++
+ return 0;
+ }
+
+diff --git a/drivers/usb/gadget/uvc_queue.c b/drivers/usb/gadget/uvc_queue.c
+index 7ce27e35..de456a5a 100644
+--- a/drivers/usb/gadget/uvc_queue.c
++++ b/drivers/usb/gadget/uvc_queue.c
+@@ -177,12 +177,16 @@ static int uvc_queue_buffer(struct uvc_video_queue *queue,
+
+ mutex_lock(&queue->mutex);
+ ret = vb2_qbuf(&queue->queue, buf);
++ if (ret < 0)
++ goto done;
++
+ spin_lock_irqsave(&queue->irqlock, flags);
+ ret = (queue->flags & UVC_QUEUE_PAUSED) != 0;
+ queue->flags &= ~UVC_QUEUE_PAUSED;
+ spin_unlock_irqrestore(&queue->irqlock, flags);
+- mutex_unlock(&queue->mutex);
+
++done:
++ mutex_unlock(&queue->mutex);
+ return ret;
+ }
+
+diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
+index c369767b..ec128bc7 100644
+--- a/drivers/usb/host/ehci-mxc.c
++++ b/drivers/usb/host/ehci-mxc.c
+@@ -184,7 +184,7 @@ static int ehci_mxc_drv_remove(struct platform_device *pdev)
+ if (pdata && pdata->exit)
+ pdata->exit(pdev);
+
+- if (pdata->otg)
++ if (pdata && pdata->otg)
+ usb_phy_shutdown(pdata->otg);
+
+ clk_disable_unprepare(priv->usbclk);
+diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
+index 951514ef..ef6782bd 100644
+--- a/drivers/usb/host/ohci-pci.c
++++ b/drivers/usb/host/ohci-pci.c
+@@ -371,7 +371,7 @@ static struct pci_driver ohci_pci_driver = {
+ .remove = usb_hcd_pci_remove,
+ .shutdown = usb_hcd_pci_shutdown,
+
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_PM
+ .driver = {
+ .pm = &usb_hcd_pci_pm_ops
+ },
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 93ad67ec..6e70ce97 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -24,7 +24,7 @@ static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci)
+ * here that the generic code does not try to make a pci_dev from our
+ * dev struct in order to setup MSI
+ */
+- xhci->quirks |= XHCI_BROKEN_MSI;
++ xhci->quirks |= XHCI_PLAT;
+ }
+
+ /* called during probe() after chip reset completes */
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 9a550b6a..f4a49c45 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -342,9 +342,14 @@ static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
+ static int xhci_try_enable_msi(struct usb_hcd *hcd)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+- struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
++ struct pci_dev *pdev;
+ int ret;
+
++ /* The xhci platform device has set up IRQs through usb_add_hcd. */
++ if (xhci->quirks & XHCI_PLAT)
++ return 0;
++
++ pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+ /*
+ * Some Fresco Logic host controllers advertise MSI, but fail to
+ * generate interrupts. Don't even try to enable MSI.
+@@ -3506,10 +3511,21 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct xhci_virt_device *virt_dev;
++ struct device *dev = hcd->self.controller;
+ unsigned long flags;
+ u32 state;
+ int i, ret;
+
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++ /*
++ * We called pm_runtime_get_noresume when the device was attached.
++ * Decrement the counter here to allow controller to runtime suspend
++ * if no devices remain.
++ */
++ if (xhci->quirks & XHCI_RESET_ON_RESUME)
++ pm_runtime_put_noidle(dev);
++#endif
++
+ ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
+ /* If the host is halted due to driver unload, we still need to free the
+ * device.
+@@ -3581,6 +3597,7 @@ static int xhci_reserve_host_control_ep_resources(struct xhci_hcd *xhci)
+ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++ struct device *dev = hcd->self.controller;
+ unsigned long flags;
+ int timeleft;
+ int ret;
+@@ -3633,6 +3650,16 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ goto disable_slot;
+ }
+ udev->slot_id = xhci->slot_id;
++
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++ /*
++ * If resetting upon resume, we can't put the controller into runtime
++ * suspend if there is a device attached.
++ */
++ if (xhci->quirks & XHCI_RESET_ON_RESUME)
++ pm_runtime_get_noresume(dev);
++#endif
++
+ /* Is this a LS or FS device under a HS hub? */
+ /* Hub or peripherial? */
+ return 1;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 77600cef..3638f1d7 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1516,6 +1516,7 @@ struct xhci_hcd {
+ #define XHCI_SPURIOUS_REBOOT (1 << 13)
+ #define XHCI_COMP_MODE_QUIRK (1 << 14)
+ #define XHCI_AVOID_BEI (1 << 15)
++#define XHCI_PLAT (1 << 16)
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+ /* There are two roothubs to keep track of bus suspend info for */
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index 5050cc85..0f16bf6e 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -374,7 +374,7 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ kfree(urbtrack);
+ return -ENOMEM;
+ }
+- urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
++ urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_ATOMIC);
+ if (!urbtrack->setup) {
+ usb_free_urb(urbtrack->urb);
+ kfree(urbtrack);
+@@ -382,8 +382,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ }
+ urbtrack->setup->bRequestType = (__u8)0x40;
+ urbtrack->setup->bRequest = (__u8)0x0e;
+- urbtrack->setup->wValue = get_reg_value(reg, dummy);
+- urbtrack->setup->wIndex = get_reg_index(reg);
++ urbtrack->setup->wValue = cpu_to_le16(get_reg_value(reg, dummy));
++ urbtrack->setup->wIndex = cpu_to_le16(get_reg_index(reg));
+ urbtrack->setup->wLength = 0;
+ usb_fill_control_urb(urbtrack->urb, usbdev,
+ usb_sndctrlpipe(usbdev, 0),
+diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
+index 04c1b2d9..d5418c1b 100644
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -729,9 +729,18 @@ void gnttab_request_free_callback(struct gnttab_free_callback *callback,
+ void (*fn)(void *), void *arg, u16 count)
+ {
+ unsigned long flags;
++ struct gnttab_free_callback *cb;
++
+ spin_lock_irqsave(&gnttab_list_lock, flags);
+- if (callback->next)
+- goto out;
++
++ /* Check if the callback is already on the list */
++ cb = gnttab_free_callback_list;
++ while (cb) {
++ if (cb == callback)
++ goto out;
++ cb = cb->next;
++ }
++
+ callback->fn = fn;
+ callback->arg = arg;
+ callback->count = count;
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 0f81d67c..8dedf401 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -3299,6 +3299,9 @@ static long btrfs_ioctl_dev_replace(struct btrfs_root *root, void __user *arg)
+
+ switch (p->cmd) {
+ case BTRFS_IOCTL_DEV_REPLACE_CMD_START:
++ if (root->fs_info->sb->s_flags & MS_RDONLY)
++ return -EROFS;
++
+ if (atomic_xchg(
+ &root->fs_info->mutually_exclusive_operation_running,
+ 1)) {
+diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
+index e0b4ef31..a5ce62eb 100644
+--- a/fs/ceph/ioctl.c
++++ b/fs/ceph/ioctl.c
+@@ -196,8 +196,10 @@ static long ceph_ioctl_get_dataloc(struct file *file, void __user *arg)
+ r = ceph_calc_file_object_mapping(&ci->i_layout, dl.file_offset, len,
+ &dl.object_no, &dl.object_offset,
+ &olen);
+- if (r < 0)
++ if (r < 0) {
++ up_read(&osdc->map_sem);
+ return -EIO;
++ }
+ dl.file_offset -= dl.object_offset;
+ dl.object_size = ceph_file_layout_object_size(ci->i_layout);
+ dl.block_size = ceph_file_layout_su(ci->i_layout);
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index d6a5c5ac..d05a3007 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -377,6 +377,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ try_to_freeze();
+
+ /* we should try only the port we connected to before */
++ mutex_lock(&server->srv_mutex);
+ rc = generic_ip_connect(server);
+ if (rc) {
+ cifs_dbg(FYI, "reconnect error %d\n", rc);
+@@ -388,6 +389,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ server->tcpStatus = CifsNeedNegotiate;
+ spin_unlock(&GlobalMid_Lock);
+ }
++ mutex_unlock(&server->srv_mutex);
+ } while (server->tcpStatus == CifsNeedReconnect);
+
+ return rc;
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 10383d8c..4f791e0e 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -413,96 +413,108 @@ cifs_ses_oplock_break(struct work_struct *work)
+ }
+
+ static bool
+-smb2_is_valid_lease_break(char *buffer, struct TCP_Server_Info *server)
++smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
++ struct smb2_lease_break_work *lw)
+ {
+- struct smb2_lease_break *rsp = (struct smb2_lease_break *)buffer;
+- struct list_head *tmp, *tmp1, *tmp2;
+- struct cifs_ses *ses;
+- struct cifs_tcon *tcon;
+- struct cifsInodeInfo *cinode;
++ bool found;
++ __u8 lease_state;
++ struct list_head *tmp;
+ struct cifsFileInfo *cfile;
+ struct cifs_pending_open *open;
+- struct smb2_lease_break_work *lw;
+- bool found;
++ struct cifsInodeInfo *cinode;
+ int ack_req = le32_to_cpu(rsp->Flags &
+ SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED);
+
+- lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
+- if (!lw)
+- return false;
++ lease_state = smb2_map_lease_to_oplock(rsp->NewLeaseState);
+
+- INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
+- lw->lease_state = rsp->NewLeaseState;
++ list_for_each(tmp, &tcon->openFileList) {
++ cfile = list_entry(tmp, struct cifsFileInfo, tlist);
++ cinode = CIFS_I(cfile->dentry->d_inode);
+
+- cifs_dbg(FYI, "Checking for lease break\n");
++ if (memcmp(cinode->lease_key, rsp->LeaseKey,
++ SMB2_LEASE_KEY_SIZE))
++ continue;
+
+- /* look up tcon based on tid & uid */
+- spin_lock(&cifs_tcp_ses_lock);
+- list_for_each(tmp, &server->smb_ses_list) {
+- ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
++ cifs_dbg(FYI, "found in the open list\n");
++ cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
++ le32_to_cpu(rsp->NewLeaseState));
+
+- spin_lock(&cifs_file_list_lock);
+- list_for_each(tmp1, &ses->tcon_list) {
+- tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
++ smb2_set_oplock_level(cinode, lease_state);
+
+- cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks);
+- list_for_each(tmp2, &tcon->openFileList) {
+- cfile = list_entry(tmp2, struct cifsFileInfo,
+- tlist);
+- cinode = CIFS_I(cfile->dentry->d_inode);
++ if (ack_req)
++ cfile->oplock_break_cancelled = false;
++ else
++ cfile->oplock_break_cancelled = true;
+
+- if (memcmp(cinode->lease_key, rsp->LeaseKey,
+- SMB2_LEASE_KEY_SIZE))
+- continue;
++ queue_work(cifsiod_wq, &cfile->oplock_break);
++ kfree(lw);
++ return true;
++ }
+
+- cifs_dbg(FYI, "found in the open list\n");
+- cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
+- le32_to_cpu(rsp->NewLeaseState));
++ found = false;
++ list_for_each_entry(open, &tcon->pending_opens, olist) {
++ if (memcmp(open->lease_key, rsp->LeaseKey,
++ SMB2_LEASE_KEY_SIZE))
++ continue;
++
++ if (!found && ack_req) {
++ found = true;
++ memcpy(lw->lease_key, open->lease_key,
++ SMB2_LEASE_KEY_SIZE);
++ lw->tlink = cifs_get_tlink(open->tlink);
++ queue_work(cifsiod_wq, &lw->lease_break);
++ }
+
+- smb2_set_oplock_level(cinode,
+- smb2_map_lease_to_oplock(rsp->NewLeaseState));
++ cifs_dbg(FYI, "found in the pending open list\n");
++ cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
++ le32_to_cpu(rsp->NewLeaseState));
+
+- if (ack_req)
+- cfile->oplock_break_cancelled = false;
+- else
+- cfile->oplock_break_cancelled = true;
++ open->oplock = lease_state;
++ }
++ return found;
++}
+
+- queue_work(cifsiod_wq, &cfile->oplock_break);
++static bool
++smb2_is_valid_lease_break(char *buffer)
++{
++ struct smb2_lease_break *rsp = (struct smb2_lease_break *)buffer;
++ struct list_head *tmp, *tmp1, *tmp2;
++ struct TCP_Server_Info *server;
++ struct cifs_ses *ses;
++ struct cifs_tcon *tcon;
++ struct smb2_lease_break_work *lw;
+
+- spin_unlock(&cifs_file_list_lock);
+- spin_unlock(&cifs_tcp_ses_lock);
+- return true;
+- }
++ lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
++ if (!lw)
++ return false;
+
+- found = false;
+- list_for_each_entry(open, &tcon->pending_opens, olist) {
+- if (memcmp(open->lease_key, rsp->LeaseKey,
+- SMB2_LEASE_KEY_SIZE))
+- continue;
++ INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
++ lw->lease_state = rsp->NewLeaseState;
+
+- if (!found && ack_req) {
+- found = true;
+- memcpy(lw->lease_key, open->lease_key,
+- SMB2_LEASE_KEY_SIZE);
+- lw->tlink = cifs_get_tlink(open->tlink);
+- queue_work(cifsiod_wq,
+- &lw->lease_break);
+- }
++ cifs_dbg(FYI, "Checking for lease break\n");
++
++ /* look up tcon based on tid & uid */
++ spin_lock(&cifs_tcp_ses_lock);
++ list_for_each(tmp, &cifs_tcp_ses_list) {
++ server = list_entry(tmp, struct TCP_Server_Info, tcp_ses_list);
+
+- cifs_dbg(FYI, "found in the pending open list\n");
+- cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
+- le32_to_cpu(rsp->NewLeaseState));
++ list_for_each(tmp1, &server->smb_ses_list) {
++ ses = list_entry(tmp1, struct cifs_ses, smb_ses_list);
+
+- open->oplock =
+- smb2_map_lease_to_oplock(rsp->NewLeaseState);
+- }
+- if (found) {
+- spin_unlock(&cifs_file_list_lock);
+- spin_unlock(&cifs_tcp_ses_lock);
+- return true;
++ spin_lock(&cifs_file_list_lock);
++ list_for_each(tmp2, &ses->tcon_list) {
++ tcon = list_entry(tmp2, struct cifs_tcon,
++ tcon_list);
++ cifs_stats_inc(
++ &tcon->stats.cifs_stats.num_oplock_brks);
++ if (smb2_tcon_has_lease(tcon, rsp, lw)) {
++ spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&cifs_tcp_ses_lock);
++ return true;
++ }
+ }
++ spin_unlock(&cifs_file_list_lock);
+ }
+- spin_unlock(&cifs_file_list_lock);
+ }
+ spin_unlock(&cifs_tcp_ses_lock);
+ kfree(lw);
+@@ -528,7 +540,7 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ if (rsp->StructureSize !=
+ smb2_rsp_struct_sizes[SMB2_OPLOCK_BREAK_HE]) {
+ if (le16_to_cpu(rsp->StructureSize) == 44)
+- return smb2_is_valid_lease_break(buffer, server);
++ return smb2_is_valid_lease_break(buffer);
+ else
+ return false;
+ }
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index ccbfbbb1..904ca1a2 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4706,7 +4706,9 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ ext4_journal_stop(handle);
+ }
+
+- if (attr->ia_valid & ATTR_SIZE) {
++ if (attr->ia_valid & ATTR_SIZE && attr->ia_size != inode->i_size) {
++ handle_t *handle;
++ loff_t oldsize = inode->i_size;
+
+ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+@@ -4714,73 +4716,60 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ if (attr->ia_size > sbi->s_bitmap_maxbytes)
+ return -EFBIG;
+ }
+- }
+-
+- if (S_ISREG(inode->i_mode) &&
+- attr->ia_valid & ATTR_SIZE &&
+- (attr->ia_size < inode->i_size)) {
+- handle_t *handle;
+-
+- handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
+- if (IS_ERR(handle)) {
+- error = PTR_ERR(handle);
+- goto err_out;
+- }
+- if (ext4_handle_valid(handle)) {
+- error = ext4_orphan_add(handle, inode);
+- orphan = 1;
+- }
+- EXT4_I(inode)->i_disksize = attr->ia_size;
+- rc = ext4_mark_inode_dirty(handle, inode);
+- if (!error)
+- error = rc;
+- ext4_journal_stop(handle);
+-
+- if (ext4_should_order_data(inode)) {
+- error = ext4_begin_ordered_truncate(inode,
++ if (S_ISREG(inode->i_mode) &&
++ (attr->ia_size < inode->i_size)) {
++ if (ext4_should_order_data(inode)) {
++ error = ext4_begin_ordered_truncate(inode,
+ attr->ia_size);
+- if (error) {
+- /* Do as much error cleanup as possible */
+- handle = ext4_journal_start(inode,
+- EXT4_HT_INODE, 3);
+- if (IS_ERR(handle)) {
+- ext4_orphan_del(NULL, inode);
++ if (error)
+ goto err_out;
+- }
+- ext4_orphan_del(handle, inode);
+- orphan = 0;
+- ext4_journal_stop(handle);
++ }
++ handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
++ if (IS_ERR(handle)) {
++ error = PTR_ERR(handle);
++ goto err_out;
++ }
++ if (ext4_handle_valid(handle)) {
++ error = ext4_orphan_add(handle, inode);
++ orphan = 1;
++ }
++ EXT4_I(inode)->i_disksize = attr->ia_size;
++ rc = ext4_mark_inode_dirty(handle, inode);
++ if (!error)
++ error = rc;
++ ext4_journal_stop(handle);
++ if (error) {
++ ext4_orphan_del(NULL, inode);
+ goto err_out;
+ }
+ }
+- }
+-
+- if (attr->ia_valid & ATTR_SIZE) {
+- if (attr->ia_size != inode->i_size) {
+- loff_t oldsize = inode->i_size;
+
+- i_size_write(inode, attr->ia_size);
+- /*
+- * Blocks are going to be removed from the inode. Wait
+- * for dio in flight. Temporarily disable
+- * dioread_nolock to prevent livelock.
+- */
+- if (orphan) {
+- if (!ext4_should_journal_data(inode)) {
+- ext4_inode_block_unlocked_dio(inode);
+- inode_dio_wait(inode);
+- ext4_inode_resume_unlocked_dio(inode);
+- } else
+- ext4_wait_for_tail_page_commit(inode);
+- }
+- /*
+- * Truncate pagecache after we've waited for commit
+- * in data=journal mode to make pages freeable.
+- */
+- truncate_pagecache(inode, oldsize, inode->i_size);
++ i_size_write(inode, attr->ia_size);
++ /*
++ * Blocks are going to be removed from the inode. Wait
++ * for dio in flight. Temporarily disable
++ * dioread_nolock to prevent livelock.
++ */
++ if (orphan) {
++ if (!ext4_should_journal_data(inode)) {
++ ext4_inode_block_unlocked_dio(inode);
++ inode_dio_wait(inode);
++ ext4_inode_resume_unlocked_dio(inode);
++ } else
++ ext4_wait_for_tail_page_commit(inode);
+ }
+- ext4_truncate(inode);
++ /*
++ * Truncate pagecache after we've waited for commit
++ * in data=journal mode to make pages freeable.
++ */
++ truncate_pagecache(inode, oldsize, inode->i_size);
+ }
++ /*
++ * We want to call ext4_truncate() even if attr->ia_size ==
++ * inode->i_size for cases like truncation of fallocated space
++ */
++ if (attr->ia_valid & ATTR_SIZE)
++ ext4_truncate(inode);
+
+ if (!rc) {
+ setattr_copy(inode, attr);
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 5b127469..e67b13de 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1175,6 +1175,8 @@ static int parse_dirfile(char *buf, size_t nbytes, struct file *file,
+ return -EIO;
+ if (reclen > nbytes)
+ break;
++ if (memchr(dirent->name, '/', dirent->namelen) != NULL)
++ return -EIO;
+
+ over = filldir(dstbuf, dirent->name, dirent->namelen,
+ file->f_pos, dirent->ino, dirent->type);
+@@ -1323,6 +1325,8 @@ static int parse_dirplusfile(char *buf, size_t nbytes, struct file *file,
+ return -EIO;
+ if (reclen > nbytes)
+ break;
++ if (memchr(dirent->name, '/', dirent->namelen) != NULL)
++ return -EIO;
+
+ if (!over) {
+ /* We fill entries into dstbuf only as much as
+@@ -1594,6 +1598,7 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
+ struct file *file)
+ {
+ struct fuse_conn *fc = get_fuse_conn(inode);
++ struct fuse_inode *fi = get_fuse_inode(inode);
+ struct fuse_req *req;
+ struct fuse_setattr_in inarg;
+ struct fuse_attr_out outarg;
+@@ -1621,8 +1626,10 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
+ if (IS_ERR(req))
+ return PTR_ERR(req);
+
+- if (is_truncate)
++ if (is_truncate) {
+ fuse_set_nowrite(inode);
++ set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
++ }
+
+ memset(&inarg, 0, sizeof(inarg));
+ memset(&outarg, 0, sizeof(outarg));
+@@ -1684,12 +1691,14 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
+ invalidate_inode_pages2(inode->i_mapping);
+ }
+
++ clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ return 0;
+
+ error:
+ if (is_truncate)
+ fuse_release_nowrite(inode);
+
++ clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ return err;
+ }
+
+@@ -1753,6 +1762,8 @@ static int fuse_setxattr(struct dentry *entry, const char *name,
+ fc->no_setxattr = 1;
+ err = -EOPNOTSUPP;
+ }
++ if (!err)
++ fuse_invalidate_attr(inode);
+ return err;
+ }
+
+@@ -1882,6 +1893,8 @@ static int fuse_removexattr(struct dentry *entry, const char *name)
+ fc->no_removexattr = 1;
+ err = -EOPNOTSUPP;
+ }
++ if (!err)
++ fuse_invalidate_attr(inode);
+ return err;
+ }
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 35f28103..473e8453 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -630,7 +630,8 @@ static void fuse_read_update_size(struct inode *inode, loff_t size,
+ struct fuse_inode *fi = get_fuse_inode(inode);
+
+ spin_lock(&fc->lock);
+- if (attr_ver == fi->attr_version && size < inode->i_size) {
++ if (attr_ver == fi->attr_version && size < inode->i_size &&
++ !test_bit(FUSE_I_SIZE_UNSTABLE, &fi->state)) {
+ fi->attr_version = ++fc->attr_version;
+ i_size_write(inode, size);
+ }
+@@ -1033,12 +1034,16 @@ static ssize_t fuse_perform_write(struct file *file,
+ {
+ struct inode *inode = mapping->host;
+ struct fuse_conn *fc = get_fuse_conn(inode);
++ struct fuse_inode *fi = get_fuse_inode(inode);
+ int err = 0;
+ ssize_t res = 0;
+
+ if (is_bad_inode(inode))
+ return -EIO;
+
++ if (inode->i_size < pos + iov_iter_count(ii))
++ set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
++
+ do {
+ struct fuse_req *req;
+ ssize_t count;
+@@ -1074,6 +1079,7 @@ static ssize_t fuse_perform_write(struct file *file,
+ if (res > 0)
+ fuse_write_update_size(inode, pos);
+
++ clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ fuse_invalidate_attr(inode);
+
+ return res > 0 ? res : err;
+@@ -1530,7 +1536,6 @@ static int fuse_writepage_locked(struct page *page)
+
+ inc_bdi_stat(mapping->backing_dev_info, BDI_WRITEBACK);
+ inc_zone_page_state(tmp_page, NR_WRITEBACK_TEMP);
+- end_page_writeback(page);
+
+ spin_lock(&fc->lock);
+ list_add(&req->writepages_entry, &fi->writepages);
+@@ -1538,6 +1543,8 @@ static int fuse_writepage_locked(struct page *page)
+ fuse_flush_writepages(inode);
+ spin_unlock(&fc->lock);
+
++ end_page_writeback(page);
++
+ return 0;
+
+ err_free:
+diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
+index fde7249a..5ced199b 100644
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -115,6 +115,8 @@ struct fuse_inode {
+ enum {
+ /** Advise readdirplus */
+ FUSE_I_ADVISE_RDPLUS,
++ /** An operation changing file size is in progress */
++ FUSE_I_SIZE_UNSTABLE,
+ };
+
+ struct fuse_conn;
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index 9a0cdde1..b5718516 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -201,7 +201,8 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,
+ struct timespec old_mtime;
+
+ spin_lock(&fc->lock);
+- if (attr_version != 0 && fi->attr_version > attr_version) {
++ if ((attr_version != 0 && fi->attr_version > attr_version) ||
++ test_bit(FUSE_I_SIZE_UNSTABLE, &fi->state)) {
+ spin_unlock(&fc->lock);
+ return;
+ }
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index d9b8aebd..d3705490 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -125,8 +125,8 @@ static void destroy_inodecache(void)
+
+ static int isofs_remount(struct super_block *sb, int *flags, char *data)
+ {
+- /* we probably want a lot more here */
+- *flags |= MS_RDONLY;
++ if (!(*flags & MS_RDONLY))
++ return -EROFS;
+ return 0;
+ }
+
+@@ -779,15 +779,6 @@ root_found:
+ */
+ s->s_maxbytes = 0x80000000000LL;
+
+- /*
+- * The CDROM is read-only, has no nodes (devices) on it, and since
+- * all of the files appear to be owned by root, we really do not want
+- * to allow suid. (suid or devices will not show up unless we have
+- * Rock Ridge extensions)
+- */
+-
+- s->s_flags |= MS_RDONLY /* | MS_NODEV | MS_NOSUID */;
+-
+ /* Set this for reference. Its not currently used except on write
+ which we don't have .. */
+
+@@ -1546,6 +1537,9 @@ struct inode *isofs_iget(struct super_block *sb,
+ static struct dentry *isofs_mount(struct file_system_type *fs_type,
+ int flags, const char *dev_name, void *data)
+ {
++ /* We don't support read-write mounts */
++ if (!(flags & MS_RDONLY))
++ return ERR_PTR(-EACCES);
+ return mount_bdev(fs_type, flags, dev_name, data, isofs_fill_super);
+ }
+
+diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
+index 2487116d..84606472 100644
+--- a/fs/ocfs2/extent_map.c
++++ b/fs/ocfs2/extent_map.c
+@@ -781,7 +781,6 @@ int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ cpos = map_start >> osb->s_clustersize_bits;
+ mapping_end = ocfs2_clusters_for_bytes(inode->i_sb,
+ map_start + map_len);
+- mapping_end -= cpos;
+ is_last = 0;
+ while (cpos < mapping_end && !is_last) {
+ u32 fe_flags;
+diff --git a/fs/proc/root.c b/fs/proc/root.c
+index 41a6ea93..04ec276c 100644
+--- a/fs/proc/root.c
++++ b/fs/proc/root.c
+@@ -110,7 +110,8 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
+ ns = task_active_pid_ns(current);
+ options = data;
+
+- if (!current_user_ns()->may_mount_proc)
++ if (!current_user_ns()->may_mount_proc ||
++ !ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+ return ERR_PTR(-EPERM);
+ }
+
+diff --git a/include/linux/compat.h b/include/linux/compat.h
+index 7f0c1dd0..ec1aee4a 100644
+--- a/include/linux/compat.h
++++ b/include/linux/compat.h
+@@ -669,6 +669,13 @@ asmlinkage long compat_sys_sigaltstack(const compat_stack_t __user *uss_ptr,
+
+ int compat_restore_altstack(const compat_stack_t __user *uss);
+ int __compat_save_altstack(compat_stack_t __user *, unsigned long);
++#define compat_save_altstack_ex(uss, sp) do { \
++ compat_stack_t __user *__uss = uss; \
++ struct task_struct *t = current; \
++ put_user_ex(ptr_to_compat((void __user *)t->sas_ss_sp), &__uss->ss_sp); \
++ put_user_ex(sas_ss_flags(sp), &__uss->ss_flags); \
++ put_user_ex(t->sas_ss_size, &__uss->ss_size); \
++} while (0);
+
+ asmlinkage long compat_sys_sched_rr_get_interval(compat_pid_t pid,
+ struct compat_timespec __user *interval);
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 0c48991b..ff545cc3 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -393,10 +393,12 @@ struct hid_report {
+ struct hid_device *device; /* associated device */
+ };
+
++#define HID_MAX_IDS 256
++
+ struct hid_report_enum {
+ unsigned numbered;
+ struct list_head report_list;
+- struct hid_report *report_id_hash[256];
++ struct hid_report *report_id_hash[HID_MAX_IDS];
+ };
+
+ #define HID_REPORT_TYPES 3
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index c1291624..6c7bb35a 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -518,6 +518,8 @@
+ #define PCI_DEVICE_ID_AMD_11H_NB_MISC 0x1303
+ #define PCI_DEVICE_ID_AMD_11H_NB_LINK 0x1304
+ #define PCI_DEVICE_ID_AMD_15H_M10H_F3 0x1403
++#define PCI_DEVICE_ID_AMD_15H_M30H_NB_F3 0x141d
++#define PCI_DEVICE_ID_AMD_15H_M30H_NB_F4 0x141e
+ #define PCI_DEVICE_ID_AMD_15H_NB_F0 0x1600
+ #define PCI_DEVICE_ID_AMD_15H_NB_F1 0x1601
+ #define PCI_DEVICE_ID_AMD_15H_NB_F2 0x1602
+diff --git a/include/linux/rculist.h b/include/linux/rculist.h
+index f4b1001a..4106721c 100644
+--- a/include/linux/rculist.h
++++ b/include/linux/rculist.h
+@@ -267,8 +267,9 @@ static inline void list_splice_init_rcu(struct list_head *list,
+ */
+ #define list_first_or_null_rcu(ptr, type, member) \
+ ({struct list_head *__ptr = (ptr); \
+- struct list_head __rcu *__next = list_next_rcu(__ptr); \
+- likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \
++ struct list_head *__next = ACCESS_ONCE(__ptr->next); \
++ likely(__ptr != __next) ? \
++ list_entry_rcu(__next, type, member) : NULL; \
+ })
+
+ /**
+diff --git a/include/linux/signal.h b/include/linux/signal.h
+index d8974847..2ac423bd 100644
+--- a/include/linux/signal.h
++++ b/include/linux/signal.h
+@@ -434,6 +434,14 @@ void signals_init(void);
+ int restore_altstack(const stack_t __user *);
+ int __save_altstack(stack_t __user *, unsigned long);
+
++#define save_altstack_ex(uss, sp) do { \
++ stack_t __user *__uss = uss; \
++ struct task_struct *t = current; \
++ put_user_ex((void __user *)t->sas_ss_sp, &__uss->ss_sp); \
++ put_user_ex(sas_ss_flags(sp), &__uss->ss_flags); \
++ put_user_ex(t->sas_ss_size, &__uss->ss_size); \
++} while (0);
++
+ #ifdef CONFIG_PROC_FS
+ struct seq_file;
+ extern void render_sigset_t(struct seq_file *, const char *, sigset_t *);
+diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
+index f5f5c7df..0fdff28d 100644
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -410,7 +410,7 @@ extern int usb_hcd_pci_probe(struct pci_dev *dev,
+ extern void usb_hcd_pci_remove(struct pci_dev *dev);
+ extern void usb_hcd_pci_shutdown(struct pci_dev *dev);
+
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_PM
+ extern const struct dev_pm_ops usb_hcd_pci_pm_ops;
+ #endif
+ #endif /* CONFIG_PCI */
+diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
+index 7343a27f..47ada233 100644
+--- a/include/media/v4l2-ctrls.h
++++ b/include/media/v4l2-ctrls.h
+@@ -22,6 +22,7 @@
+ #define _V4L2_CTRLS_H
+
+ #include <linux/list.h>
++#include <linux/mutex.h>
+ #include <linux/videodev2.h>
+
+ /* forward references */
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index f3569747..ad8e1bdc 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -1682,12 +1682,10 @@ static bool handle_trampoline(struct pt_regs *regs)
+ tmp = ri;
+ ri = ri->next;
+ kfree(tmp);
++ utask->depth--;
+
+ if (!chained)
+ break;
+-
+- utask->depth--;
+-
+ BUG_ON(!ri);
+ }
+
+diff --git a/kernel/fork.c b/kernel/fork.c
+index ffbc0904..80d92e98 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1171,10 +1171,11 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ return ERR_PTR(-EINVAL);
+
+ /*
+- * If the new process will be in a different pid namespace
+- * don't allow the creation of threads.
++ * If the new process will be in a different pid namespace don't
++ * allow it to share a thread group or signal handlers with the
++ * forking task.
+ */
+- if ((clone_flags & (CLONE_VM|CLONE_NEWPID)) &&
++ if ((clone_flags & (CLONE_SIGHAND | CLONE_NEWPID)) &&
+ (task_active_pid_ns(current) != current->nsproxy->pid_ns))
+ return ERR_PTR(-EINVAL);
+
+diff --git a/kernel/pid.c b/kernel/pid.c
+index 0db3e791..0eb6d8e8 100644
+--- a/kernel/pid.c
++++ b/kernel/pid.c
+@@ -264,6 +264,7 @@ void free_pid(struct pid *pid)
+ struct pid_namespace *ns = upid->ns;
+ hlist_del_rcu(&upid->pid_chain);
+ switch(--ns->nr_hashed) {
++ case 2:
+ case 1:
+ /* When all that is left in the pid namespace
+ * is the reaper wake up the reaper. The reaper
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 362c329b..b92d0ce4 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2286,6 +2286,8 @@ static void collapse_huge_page(struct mm_struct *mm,
+ goto out;
+
+ vma = find_vma(mm, address);
++ if (!vma)
++ goto out;
+ hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ hend = vma->vm_end & HPAGE_PMD_MASK;
+ if (address < hstart || address + HPAGE_PMD_SIZE > hend)
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 82a187ae..905ce72c 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -5584,7 +5584,13 @@ static int compare_thresholds(const void *a, const void *b)
+ const struct mem_cgroup_threshold *_a = a;
+ const struct mem_cgroup_threshold *_b = b;
+
+- return _a->threshold - _b->threshold;
++ if (_a->threshold > _b->threshold)
++ return 1;
++
++ if (_a->threshold < _b->threshold)
++ return -1;
++
++ return 0;
+ }
+
+ static int mem_cgroup_oom_notify_cb(struct mem_cgroup *memcg)
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index 3a246a6c..46ec7672 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -2130,6 +2130,8 @@ int ceph_osdc_start_request(struct ceph_osd_client *osdc,
+ dout("osdc_start_request failed map, "
+ " will retry %lld\n", req->r_tid);
+ rc = 0;
++ } else {
++ __unregister_request(osdc, req);
+ }
+ goto out_unlock;
+ }
+diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
+index 603ddd92..dbd9a479 100644
+--- a/net/ceph/osdmap.c
++++ b/net/ceph/osdmap.c
+@@ -1129,7 +1129,7 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
+
+ /* pg_temp? */
+ pgid.seed = ceph_stable_mod(pgid.seed, pool->pg_num,
+- pool->pgp_num_mask);
++ pool->pg_num_mask);
+ pg = __lookup_pg_mapping(&osdmap->pg_temp, pgid);
+ if (pg) {
+ *num = pg->len;
+diff --git a/net/core/scm.c b/net/core/scm.c
+index 03795d01..b4da80b1 100644
+--- a/net/core/scm.c
++++ b/net/core/scm.c
+@@ -54,7 +54,7 @@ static __inline__ int scm_check_creds(struct ucred *creds)
+ return -EINVAL;
+
+ if ((creds->pid == task_tgid_vnr(current) ||
+- ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
++ ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
+ ((uid_eq(uid, cred->uid) || uid_eq(uid, cred->euid) ||
+ uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
+ ((gid_eq(gid, cred->gid) || gid_eq(gid, cred->egid) ||
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index de18722c..624e6c04 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -3335,6 +3335,7 @@ static struct snd_pci_quirk msi_black_list[] = {
+ SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
+ SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
+ SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
++ SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */
+ SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */
+ SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */
+ {}
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 5bc41945..b5375ed0 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -67,6 +67,8 @@ struct hdmi_spec_per_pin {
+ struct delayed_work work;
+ struct snd_kcontrol *eld_ctl;
+ int repoll_count;
++ bool setup; /* the stream has been set up by prepare callback */
++ int channels; /* current number of channels */
+ bool non_pcm;
+ bool chmap_set; /* channel-map override by ALSA API? */
+ unsigned char chmap[8]; /* ALSA API channel-map */
+@@ -551,6 +553,17 @@ static int hdmi_channel_allocation(struct hdmi_eld *eld, int channels)
+ }
+ }
+
++ if (!ca) {
++ /* if there was no match, select the regular ALSA channel
++ * allocation with the matching number of channels */
++ for (i = 0; i < ARRAY_SIZE(channel_allocations); i++) {
++ if (channels == channel_allocations[i].channels) {
++ ca = channel_allocations[i].ca_index;
++ break;
++ }
++ }
++ }
++
+ snd_print_channel_allocation(eld->info.spk_alloc, buf, sizeof(buf));
+ snd_printdd("HDMI: select CA 0x%x for %d-channel allocation: %s\n",
+ ca, channels, buf);
+@@ -868,18 +881,19 @@ static bool hdmi_infoframe_uptodate(struct hda_codec *codec, hda_nid_t pin_nid,
+ return true;
+ }
+
+-static void hdmi_setup_audio_infoframe(struct hda_codec *codec, int pin_idx,
+- bool non_pcm,
+- struct snd_pcm_substream *substream)
++static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
++ struct hdmi_spec_per_pin *per_pin,
++ bool non_pcm)
+ {
+- struct hdmi_spec *spec = codec->spec;
+- struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
+ hda_nid_t pin_nid = per_pin->pin_nid;
+- int channels = substream->runtime->channels;
++ int channels = per_pin->channels;
+ struct hdmi_eld *eld;
+ int ca;
+ union audio_infoframe ai;
+
++ if (!channels)
++ return;
++
+ eld = &per_pin->sink_eld;
+ if (!eld->monitor_present)
+ return;
+@@ -1263,6 +1277,7 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
+ eld_changed = true;
+ }
+ if (update_eld) {
++ bool old_eld_valid = pin_eld->eld_valid;
+ pin_eld->eld_valid = eld->eld_valid;
+ eld_changed = pin_eld->eld_size != eld->eld_size ||
+ memcmp(pin_eld->eld_buffer, eld->eld_buffer,
+@@ -1272,6 +1287,18 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
+ eld->eld_size);
+ pin_eld->eld_size = eld->eld_size;
+ pin_eld->info = eld->info;
++
++ /* Haswell-specific workaround: re-setup when the transcoder is
++ * changed during the stream playback
++ */
++ if (codec->vendor_id == 0x80862807 &&
++ eld->eld_valid && !old_eld_valid && per_pin->setup) {
++ snd_hda_codec_write(codec, pin_nid, 0,
++ AC_VERB_SET_AMP_GAIN_MUTE,
++ AMP_OUT_UNMUTE);
++ hdmi_setup_audio_infoframe(codec, per_pin,
++ per_pin->non_pcm);
++ }
+ }
+ mutex_unlock(&pin_eld->lock);
+
+@@ -1444,14 +1471,17 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
+ hda_nid_t cvt_nid = hinfo->nid;
+ struct hdmi_spec *spec = codec->spec;
+ int pin_idx = hinfo_to_pin_index(spec, hinfo);
+- hda_nid_t pin_nid = get_pin(spec, pin_idx)->pin_nid;
++ struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
++ hda_nid_t pin_nid = per_pin->pin_nid;
+ bool non_pcm;
+
+ non_pcm = check_non_pcm_per_cvt(codec, cvt_nid);
++ per_pin->channels = substream->runtime->channels;
++ per_pin->setup = true;
+
+ hdmi_set_channel_count(codec, cvt_nid, substream->runtime->channels);
+
+- hdmi_setup_audio_infoframe(codec, pin_idx, non_pcm, substream);
++ hdmi_setup_audio_infoframe(codec, per_pin, non_pcm);
+
+ return hdmi_setup_stream(codec, cvt_nid, pin_nid, stream_tag, format);
+ }
+@@ -1491,6 +1521,9 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo,
+ snd_hda_spdif_ctls_unassign(codec, pin_idx);
+ per_pin->chmap_set = false;
+ memset(per_pin->chmap, 0, sizeof(per_pin->chmap));
++
++ per_pin->setup = false;
++ per_pin->channels = 0;
+ }
+
+ return 0;
+@@ -1626,8 +1659,7 @@ static int hdmi_chmap_ctl_put(struct snd_kcontrol *kcontrol,
+ per_pin->chmap_set = true;
+ memcpy(per_pin->chmap, chmap, sizeof(chmap));
+ if (prepared)
+- hdmi_setup_audio_infoframe(codec, pin_idx, per_pin->non_pcm,
+- substream);
++ hdmi_setup_audio_infoframe(codec, per_pin, per_pin->non_pcm);
+
+ return 0;
+ }
+diff --git a/sound/soc/codecs/mc13783.c b/sound/soc/codecs/mc13783.c
+index 5402dfbb..8a8d9364 100644
+--- a/sound/soc/codecs/mc13783.c
++++ b/sound/soc/codecs/mc13783.c
+@@ -126,6 +126,10 @@ static int mc13783_write(struct snd_soc_codec *codec,
+
+ ret = mc13xxx_reg_write(priv->mc13xxx, reg, value);
+
++ /* include errata fix for spi audio problems */
++ if (reg == MC13783_AUDIO_CODEC || reg == MC13783_AUDIO_DAC)
++ ret = mc13xxx_reg_write(priv->mc13xxx, reg, value);
++
+ mc13xxx_unlock(priv->mc13xxx);
+
+ return ret;
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 0a4ffdd1..5e5af898 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -857,9 +857,9 @@ static int wm8960_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
+ if (pll_div.k) {
+ reg |= 0x20;
+
+- snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 18) & 0x3f);
+- snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 9) & 0x1ff);
+- snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0x1ff);
++ snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 16) & 0xff);
++ snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 8) & 0xff);
++ snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0xff);
+ }
+ snd_soc_write(codec, WM8960_PLL1, reg);
+
Deleted: genpatches-2.6/trunk/3.10/1500_CVE-2013-4300-net-Check-the-correct-namespace-when-spoofing-pid-ov.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1500_CVE-2013-4300-net-Check-the-correct-namespace-when-spoofing-pid-ov.patch 2013-09-25 17:13:05 UTC (rev 2528)
+++ genpatches-2.6/trunk/3.10/1500_CVE-2013-4300-net-Check-the-correct-namespace-when-spoofing-pid-ov.patch 2013-09-27 17:20:08 UTC (rev 2529)
@@ -1,35 +0,0 @@
-From d661684cf6820331feae71146c35da83d794467e Mon Sep 17 00:00:00 2001
-From: Andy Lutomirski <luto@amacapital.net>
-Date: Thu, 22 Aug 2013 11:39:15 -0700
-Subject: [PATCH] net: Check the correct namespace when spoofing pid over
- SCM_RIGHTS
-
-This is a security bug.
-
-The follow-up will fix nsproxy to discourage this type of issue from
-happening again.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Andy Lutomirski <luto@amacapital.net>
-Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- net/core/scm.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/core/scm.c b/net/core/scm.c
-index 03795d0..b4da80b 100644
---- a/net/core/scm.c
-+++ b/net/core/scm.c
-@@ -54,7 +54,7 @@ static __inline__ int scm_check_creds(struct ucred *creds)
- return -EINVAL;
-
- if ((creds->pid == task_tgid_vnr(current) ||
-- ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
-+ ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
- ((uid_eq(uid, cred->uid) || uid_eq(uid, cred->euid) ||
- uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
- ((gid_eq(gid, cred->gid) || gid_eq(gid, cred->egid) ||
---
-1.8.3.2
-
Modified: genpatches-2.6/trunk/3.11/0000_README
===================================================================
--- genpatches-2.6/trunk/3.11/0000_README 2013-09-25 17:13:05 UTC (rev 2528)
+++ genpatches-2.6/trunk/3.11/0000_README 2013-09-27 17:20:08 UTC (rev 2529)
@@ -46,6 +46,10 @@
From: http://www.kernel.org
Desc: Linux 3.11.1
+Patch: 1001_linux-3.11.2.patch
+From: http://www.kernel.org
+Desc: Linux 3.11.2
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
Added: genpatches-2.6/trunk/3.11/1001_linux-3.11.2.patch
===================================================================
--- genpatches-2.6/trunk/3.11/1001_linux-3.11.2.patch (rev 0)
+++ genpatches-2.6/trunk/3.11/1001_linux-3.11.2.patch 2013-09-27 17:20:08 UTC (rev 2529)
@@ -0,0 +1,4419 @@
+diff --git a/Makefile b/Makefile
+index efd23961..aede3194 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 11
+-SUBLEVEL = 1
++SUBLEVEL = 2
+ EXTRAVERSION =
+ NAME = Linux for Workgroups
+
+diff --git a/arch/arc/include/asm/sections.h b/arch/arc/include/asm/sections.h
+index 6fc1159d..764f1e3b 100644
+--- a/arch/arc/include/asm/sections.h
++++ b/arch/arc/include/asm/sections.h
+@@ -11,7 +11,6 @@
+
+ #include <asm-generic/sections.h>
+
+-extern char _int_vec_base_lds[];
+ extern char __arc_dccm_base[];
+ extern char __dtb_start[];
+
+diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S
+index 2a913f85..0f944f02 100644
+--- a/arch/arc/kernel/head.S
++++ b/arch/arc/kernel/head.S
+@@ -34,6 +34,9 @@ stext:
+ ; IDENTITY Reg [ 3 2 1 0 ]
+ ; (cpu-id) ^^^ => Zero for UP ARC700
+ ; => #Core-ID if SMP (Master 0)
++ ; Note that non-boot CPUs might not land here if halt-on-reset and
++ ; instead breath life from @first_lines_of_secondary, but we still
++ ; need to make sure only boot cpu takes this path.
+ GET_CPU_ID r5
+ cmp r5, 0
+ jnz arc_platform_smp_wait_to_boot
+@@ -98,6 +101,8 @@ stext:
+
+ first_lines_of_secondary:
+
++ sr @_int_vec_base_lds, [AUX_INTR_VEC_BASE]
++
+ ; setup per-cpu idle task as "current" on this CPU
+ ld r0, [@secondary_idle_tsk]
+ SET_CURR_TASK_ON_CPU r0, r1
+diff --git a/arch/arc/kernel/irq.c b/arch/arc/kernel/irq.c
+index 305b3f86..5fc92455 100644
+--- a/arch/arc/kernel/irq.c
++++ b/arch/arc/kernel/irq.c
+@@ -24,7 +24,6 @@
+ * -Needed for each CPU (hence not foldable into init_IRQ)
+ *
+ * what it does ?
+- * -setup Vector Table Base Reg - in case Linux not linked at 0x8000_0000
+ * -Disable all IRQs (on CPU side)
+ * -Optionally, setup the High priority Interrupts as Level 2 IRQs
+ */
+diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
+index 6b083454..e8185631 100644
+--- a/arch/arc/kernel/setup.c
++++ b/arch/arc/kernel/setup.c
+@@ -47,10 +47,7 @@ void read_arc_build_cfg_regs(void)
+ READ_BCR(AUX_IDENTITY, cpu->core);
+
+ cpu->timers = read_aux_reg(ARC_REG_TIMERS_BCR);
+-
+ cpu->vec_base = read_aux_reg(AUX_INTR_VEC_BASE);
+- if (cpu->vec_base == 0)
+- cpu->vec_base = (unsigned int)_int_vec_base_lds;
+
+ READ_BCR(ARC_REG_D_UNCACH_BCR, uncached_space);
+ cpu->uncached_base = uncached_space.start << 24;
+diff --git a/arch/arm/mach-versatile/include/mach/platform.h b/arch/arm/mach-versatile/include/mach/platform.h
+index ec087407..6f938ccb 100644
+--- a/arch/arm/mach-versatile/include/mach/platform.h
++++ b/arch/arm/mach-versatile/include/mach/platform.h
+@@ -231,12 +231,14 @@
+ /* PCI space */
+ #define VERSATILE_PCI_BASE 0x41000000 /* PCI Interface */
+ #define VERSATILE_PCI_CFG_BASE 0x42000000
++#define VERSATILE_PCI_IO_BASE 0x43000000
+ #define VERSATILE_PCI_MEM_BASE0 0x44000000
+ #define VERSATILE_PCI_MEM_BASE1 0x50000000
+ #define VERSATILE_PCI_MEM_BASE2 0x60000000
+ /* Sizes of above maps */
+ #define VERSATILE_PCI_BASE_SIZE 0x01000000
+ #define VERSATILE_PCI_CFG_BASE_SIZE 0x02000000
++#define VERSATILE_PCI_IO_BASE_SIZE 0x01000000
+ #define VERSATILE_PCI_MEM_BASE0_SIZE 0x0c000000 /* 32Mb */
+ #define VERSATILE_PCI_MEM_BASE1_SIZE 0x10000000 /* 256Mb */
+ #define VERSATILE_PCI_MEM_BASE2_SIZE 0x10000000 /* 256Mb */
+diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
+index e92e5e07..c97be4ea 100644
+--- a/arch/arm/mach-versatile/pci.c
++++ b/arch/arm/mach-versatile/pci.c
+@@ -43,9 +43,9 @@
+ #define PCI_IMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x0)
+ #define PCI_IMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x4)
+ #define PCI_IMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x8)
+-#define PCI_SMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x10)
+-#define PCI_SMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
+-#define PCI_SMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
++#define PCI_SMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x1c)
+ #define PCI_SELFID __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0xc)
+
+ #define DEVICE_ID_OFFSET 0x00
+@@ -170,8 +170,8 @@ static struct pci_ops pci_versatile_ops = {
+ .write = versatile_write_config,
+ };
+
+-static struct resource io_mem = {
+- .name = "PCI I/O space",
++static struct resource unused_mem = {
++ .name = "PCI unused",
+ .start = VERSATILE_PCI_MEM_BASE0,
+ .end = VERSATILE_PCI_MEM_BASE0+VERSATILE_PCI_MEM_BASE0_SIZE-1,
+ .flags = IORESOURCE_MEM,
+@@ -195,9 +195,9 @@ static int __init pci_versatile_setup_resources(struct pci_sys_data *sys)
+ {
+ int ret = 0;
+
+- ret = request_resource(&iomem_resource, &io_mem);
++ ret = request_resource(&iomem_resource, &unused_mem);
+ if (ret) {
+- printk(KERN_ERR "PCI: unable to allocate I/O "
++ printk(KERN_ERR "PCI: unable to allocate unused "
+ "memory region (%d)\n", ret);
+ goto out;
+ }
+@@ -205,7 +205,7 @@ static int __init pci_versatile_setup_resources(struct pci_sys_data *sys)
+ if (ret) {
+ printk(KERN_ERR "PCI: unable to allocate non-prefetchable "
+ "memory region (%d)\n", ret);
+- goto release_io_mem;
++ goto release_unused_mem;
+ }
+ ret = request_resource(&iomem_resource, &pre_mem);
+ if (ret) {
+@@ -225,8 +225,8 @@ static int __init pci_versatile_setup_resources(struct pci_sys_data *sys)
+
+ release_non_mem:
+ release_resource(&non_mem);
+- release_io_mem:
+- release_resource(&io_mem);
++ release_unused_mem:
++ release_resource(&unused_mem);
+ out:
+ return ret;
+ }
+@@ -246,7 +246,7 @@ int __init pci_versatile_setup(int nr, struct pci_sys_data *sys)
+ goto out;
+ }
+
+- ret = pci_ioremap_io(0, VERSATILE_PCI_MEM_BASE0);
++ ret = pci_ioremap_io(0, VERSATILE_PCI_IO_BASE);
+ if (ret)
+ goto out;
+
+@@ -295,6 +295,19 @@ int __init pci_versatile_setup(int nr, struct pci_sys_data *sys)
+ __raw_writel(PHYS_OFFSET, local_pci_cfg_base + PCI_BASE_ADDRESS_2);
+
+ /*
++ * For many years the kernel and QEMU were symbiotically buggy
++ * in that they both assumed the same broken IRQ mapping.
++ * QEMU therefore attempts to auto-detect old broken kernels
++ * so that they still work on newer QEMU as they did on old
++ * QEMU. Since we now use the correct (ie matching-hardware)
++ * IRQ mapping we write a definitely different value to a
++ * PCI_INTERRUPT_LINE register to tell QEMU that we expect
++ * real hardware behaviour and it need not be backwards
++ * compatible for us. This write is harmless on real hardware.
++ */
++ __raw_writel(0, VERSATILE_PCI_VIRT_BASE+PCI_INTERRUPT_LINE);
++
++ /*
+ * Do not to map Versatile FPGA PCI device into memory space
+ */
+ pci_slot_ignore |= (1 << myslot);
+@@ -327,13 +340,13 @@ static int __init versatile_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+ {
+ int irq;
+
+- /* slot, pin, irq
+- * 24 1 IRQ_SIC_PCI0
+- * 25 1 IRQ_SIC_PCI1
+- * 26 1 IRQ_SIC_PCI2
+- * 27 1 IRQ_SIC_PCI3
++ /*
++ * Slot INTA INTB INTC INTD
++ * 31 PCI1 PCI2 PCI3 PCI0
++ * 30 PCI0 PCI1 PCI2 PCI3
++ * 29 PCI3 PCI0 PCI1 PCI2
+ */
+- irq = IRQ_SIC_PCI0 + ((slot - 24 + pin - 1) & 3);
++ irq = IRQ_SIC_PCI0 + ((slot + 2 + pin - 1) & 3);
+
+ return irq;
+ }
+diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
+index 8a6295c8..7071fcac 100644
+--- a/arch/arm/xen/enlighten.c
++++ b/arch/arm/xen/enlighten.c
+@@ -273,12 +273,15 @@ core_initcall(xen_guest_init);
+
+ static int __init xen_pm_init(void)
+ {
++ if (!xen_domain())
++ return -ENODEV;
++
+ pm_power_off = xen_power_off;
+ arm_pm_restart = xen_restart;
+
+ return 0;
+ }
+-subsys_initcall(xen_pm_init);
++late_initcall(xen_pm_init);
+
+ static irqreturn_t xen_arm_callback(int irq, void *arg)
+ {
+diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
+index 12e6ccb8..cea1594f 100644
+--- a/arch/arm64/kernel/perf_event.c
++++ b/arch/arm64/kernel/perf_event.c
+@@ -325,7 +325,10 @@ validate_event(struct pmu_hw_events *hw_events,
+ if (is_software_event(event))
+ return 1;
+
+- if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)
++ if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
++ return 1;
++
++ if (event->state == PERF_EVENT_STATE_OFF && !event->attr.enable_on_exec)
+ return 1;
+
+ return armpmu->get_event_idx(hw_events, &fake_event) >= 0;
+@@ -781,7 +784,7 @@ static const unsigned armv8_pmuv3_perf_cache_map[PERF_COUNT_HW_CACHE_MAX]
+ /*
+ * PMXEVTYPER: Event selection reg
+ */
+-#define ARMV8_EVTYPE_MASK 0xc00000ff /* Mask for writable bits */
++#define ARMV8_EVTYPE_MASK 0xc80000ff /* Mask for writable bits */
+ #define ARMV8_EVTYPE_EVENT 0xff /* Mask for EVENT bits */
+
+ /*
+diff --git a/arch/mips/ath79/clock.c b/arch/mips/ath79/clock.c
+index 765ef30e..733017b3 100644
+--- a/arch/mips/ath79/clock.c
++++ b/arch/mips/ath79/clock.c
+@@ -164,7 +164,7 @@ static void __init ar933x_clocks_init(void)
+ ath79_ahb_clk.rate = freq / t;
+ }
+
+- ath79_wdt_clk.rate = ath79_ref_clk.rate;
++ ath79_wdt_clk.rate = ath79_ahb_clk.rate;
+ ath79_uart_clk.rate = ath79_ref_clk.rate;
+ }
+
+diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
+index ee5b690a..52e5758e 100644
+--- a/arch/powerpc/kernel/align.c
++++ b/arch/powerpc/kernel/align.c
+@@ -764,6 +764,16 @@ int fix_alignment(struct pt_regs *regs)
+ nb = aligninfo[instr].len;
+ flags = aligninfo[instr].flags;
+
++ /* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */
++ if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) {
++ nb = 8;
++ flags = LD+SW;
++ } else if (IS_XFORM(instruction) &&
++ ((instruction >> 1) & 0x3ff) == 660) {
++ nb = 8;
++ flags = ST+SW;
++ }
++
+ /* Byteswap little endian loads and stores */
+ swiz = 0;
+ if (regs->msr & MSR_LE) {
+diff --git a/arch/powerpc/kvm/book3s_xics.c b/arch/powerpc/kvm/book3s_xics.c
+index 94c1dd46..a3a5cb8e 100644
+--- a/arch/powerpc/kvm/book3s_xics.c
++++ b/arch/powerpc/kvm/book3s_xics.c
+@@ -19,6 +19,7 @@
+ #include <asm/hvcall.h>
+ #include <asm/xics.h>
+ #include <asm/debug.h>
++#include <asm/time.h>
+
+ #include <linux/debugfs.h>
+ #include <linux/seq_file.h>
+diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
+index c11c8238..54b998f2 100644
+--- a/arch/powerpc/platforms/pseries/setup.c
++++ b/arch/powerpc/platforms/pseries/setup.c
+@@ -354,7 +354,7 @@ static int alloc_dispatch_log_kmem_cache(void)
+ }
+ early_initcall(alloc_dispatch_log_kmem_cache);
+
+-static void pSeries_idle(void)
++static void pseries_lpar_idle(void)
+ {
+ /* This would call on the cpuidle framework, and the back-end pseries
+ * driver to go to idle states
+@@ -362,10 +362,22 @@ static void pSeries_idle(void)
+ if (cpuidle_idle_call()) {
+ /* On error, execute default handler
+ * to go into low thread priority and possibly
+- * low power mode.
++ * low power mode by cedeing processor to hypervisor
+ */
+- HMT_low();
+- HMT_very_low();
++
++ /* Indicate to hypervisor that we are idle. */
++ get_lppaca()->idle = 1;
++
++ /*
++ * Yield the processor to the hypervisor. We return if
++ * an external interrupt occurs (which are driven prior
++ * to returning here) or if a prod occurs from another
++ * processor. When returning here, external interrupts
++ * are enabled.
++ */
++ cede_processor();
++
++ get_lppaca()->idle = 0;
+ }
+ }
+
+@@ -456,15 +468,14 @@ static void __init pSeries_setup_arch(void)
+
+ pSeries_nvram_init();
+
+- if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
++ if (firmware_has_feature(FW_FEATURE_LPAR)) {
+ vpa_init(boot_cpuid);
+- ppc_md.power_save = pSeries_idle;
+- }
+-
+- if (firmware_has_feature(FW_FEATURE_LPAR))
++ ppc_md.power_save = pseries_lpar_idle;
+ ppc_md.enable_pmcs = pseries_lpar_enable_pmcs;
+- else
++ } else {
++ /* No special idle routine */
+ ppc_md.enable_pmcs = power4_enable_pmcs;
++ }
+
+ ppc_md.pcibios_root_bridge_prepare = pseries_root_bridge_prepare;
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index d5f10a43..70923928 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -805,7 +805,7 @@ static struct bpf_binary_header *bpf_alloc_binary(unsigned int bpfsize,
+ return NULL;
+ memset(header, 0, sz);
+ header->pages = sz / PAGE_SIZE;
+- hole = sz - bpfsize + sizeof(*header);
++ hole = sz - (bpfsize + sizeof(*header));
+ /* Insert random number of illegal instructions before BPF code
+ * and make sure the first instruction starts at an even address.
+ */
+diff --git a/arch/um/include/shared/os.h b/arch/um/include/shared/os.h
+index 95feaa47..c70a234a 100644
+--- a/arch/um/include/shared/os.h
++++ b/arch/um/include/shared/os.h
+@@ -200,6 +200,7 @@ extern int os_unmap_memory(void *addr, int len);
+ extern int os_drop_memory(void *addr, int length);
+ extern int can_drop_memory(void);
+ extern void os_flush_stdout(void);
++extern int os_mincore(void *addr, unsigned long len);
+
+ /* execvp.c */
+ extern int execvp_noalloc(char *buf, const char *file, char *const argv[]);
+diff --git a/arch/um/kernel/Makefile b/arch/um/kernel/Makefile
+index babe2182..d8b78a03 100644
+--- a/arch/um/kernel/Makefile
++++ b/arch/um/kernel/Makefile
+@@ -13,7 +13,7 @@ clean-files :=
+ obj-y = config.o exec.o exitcode.o irq.o ksyms.o mem.o \
+ physmem.o process.o ptrace.o reboot.o sigio.o \
+ signal.o smp.o syscall.o sysrq.o time.o tlb.o trap.o \
+- um_arch.o umid.o skas/
++ um_arch.o umid.o maccess.o skas/
+
+ obj-$(CONFIG_BLK_DEV_INITRD) += initrd.o
+ obj-$(CONFIG_GPROF) += gprof_syms.o
+diff --git a/arch/um/kernel/maccess.c b/arch/um/kernel/maccess.c
+new file mode 100644
+index 00000000..1f3d5c49
+--- /dev/null
++++ b/arch/um/kernel/maccess.c
+@@ -0,0 +1,24 @@
++/*
++ * Copyright (C) 2013 Richard Weinberger <richrd@nod.at>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/uaccess.h>
++#include <linux/kernel.h>
++#include <os.h>
++
++long probe_kernel_read(void *dst, const void *src, size_t size)
++{
++ void *psrc = (void *)rounddown((unsigned long)src, PAGE_SIZE);
++
++ if ((unsigned long)src < PAGE_SIZE || size <= 0)
++ return -EFAULT;
++
++ if (os_mincore(psrc, size + src - psrc) <= 0)
++ return -EFAULT;
++
++ return __probe_kernel_read(dst, src, size);
++}
+diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c
+index b8f34c9e..67b9c8f5 100644
+--- a/arch/um/os-Linux/process.c
++++ b/arch/um/os-Linux/process.c
+@@ -4,6 +4,7 @@
+ */
+
+ #include <stdio.h>
++#include <stdlib.h>
+ #include <unistd.h>
+ #include <errno.h>
+ #include <signal.h>
+@@ -232,6 +233,57 @@ out:
+ return ok;
+ }
+
++static int os_page_mincore(void *addr)
++{
++ char vec[2];
++ int ret;
++
++ ret = mincore(addr, UM_KERN_PAGE_SIZE, vec);
++ if (ret < 0) {
++ if (errno == ENOMEM || errno == EINVAL)
++ return 0;
++ else
++ return -errno;
++ }
++
++ return vec[0] & 1;
++}
++
++int os_mincore(void *addr, unsigned long len)
++{
++ char *vec;
++ int ret, i;
++
++ if (len <= UM_KERN_PAGE_SIZE)
++ return os_page_mincore(addr);
++
++ vec = calloc(1, (len + UM_KERN_PAGE_SIZE - 1) / UM_KERN_PAGE_SIZE);
++ if (!vec)
++ return -ENOMEM;
++
++ ret = mincore(addr, UM_KERN_PAGE_SIZE, vec);
++ if (ret < 0) {
++ if (errno == ENOMEM || errno == EINVAL)
++ ret = 0;
++ else
++ ret = -errno;
++
++ goto out;
++ }
++
++ for (i = 0; i < ((len + UM_KERN_PAGE_SIZE - 1) / UM_KERN_PAGE_SIZE); i++) {
++ if (!(vec[i] & 1)) {
++ ret = 0;
++ goto out;
++ }
++ }
++
++ ret = 1;
++out:
++ free(vec);
++ return ret;
++}
++
+ void init_new_thread_signals(void)
+ {
+ set_handler(SIGSEGV);
+diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
+index bccfca68..665a7303 100644
+--- a/arch/x86/ia32/ia32_signal.c
++++ b/arch/x86/ia32/ia32_signal.c
+@@ -457,7 +457,7 @@ int ia32_setup_rt_frame(int sig, struct ksignal *ksig,
+ else
+ put_user_ex(0, &frame->uc.uc_flags);
+ put_user_ex(0, &frame->uc.uc_link);
+- err |= __compat_save_altstack(&frame->uc.uc_stack, regs->sp);
++ compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+
+ if (ksig->ka.sa.sa_flags & SA_RESTORER)
+ restorer = ksig->ka.sa.sa_restorer;
+diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
+index 46fc474f..f50de695 100644
+--- a/arch/x86/include/asm/checksum_32.h
++++ b/arch/x86/include/asm/checksum_32.h
+@@ -49,9 +49,15 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
+ int len, __wsum sum,
+ int *err_ptr)
+ {
++ __wsum ret;
++
+ might_sleep();
+- return csum_partial_copy_generic((__force void *)src, dst,
+- len, sum, err_ptr, NULL);
++ stac();
++ ret = csum_partial_copy_generic((__force void *)src, dst,
++ len, sum, err_ptr, NULL);
++ clac();
++
++ return ret;
+ }
+
+ /*
+@@ -176,10 +182,16 @@ static inline __wsum csum_and_copy_to_user(const void *src,
+ int len, __wsum sum,
+ int *err_ptr)
+ {
++ __wsum ret;
++
+ might_sleep();
+- if (access_ok(VERIFY_WRITE, dst, len))
+- return csum_partial_copy_generic(src, (__force void *)dst,
+- len, sum, NULL, err_ptr);
++ if (access_ok(VERIFY_WRITE, dst, len)) {
++ stac();
++ ret = csum_partial_copy_generic(src, (__force void *)dst,
++ len, sum, NULL, err_ptr);
++ clac();
++ return ret;
++ }
+
+ if (len)
+ *err_ptr = -EFAULT;
+diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
+index 29e3093b..aa97342e 100644
+--- a/arch/x86/include/asm/mce.h
++++ b/arch/x86/include/asm/mce.h
+@@ -32,11 +32,20 @@
+ #define MCI_STATUS_PCC (1ULL<<57) /* processor context corrupt */
+ #define MCI_STATUS_S (1ULL<<56) /* Signaled machine check */
+ #define MCI_STATUS_AR (1ULL<<55) /* Action required */
+-#define MCACOD 0xffff /* MCA Error Code */
++
++/*
++ * Note that the full MCACOD field of IA32_MCi_STATUS MSR is
++ * bits 15:0. But bit 12 is the 'F' bit, defined for corrected
++ * errors to indicate that errors are being filtered by hardware.
++ * We should mask out bit 12 when looking for specific signatures
++ * of uncorrected errors - so the F bit is deliberately skipped
++ * in this #define.
++ */
++#define MCACOD 0xefff /* MCA Error Code */
+
+ /* Architecturally defined codes from SDM Vol. 3B Chapter 15 */
+ #define MCACOD_SCRUB 0x00C0 /* 0xC0-0xCF Memory Scrubbing */
+-#define MCACOD_SCRUBMSK 0xfff0
++#define MCACOD_SCRUBMSK 0xeff0 /* Skip bit 12 ('F' bit) */
+ #define MCACOD_L3WB 0x017A /* L3 Explicit Writeback */
+ #define MCACOD_DATA 0x0134 /* Data Load */
+ #define MCACOD_INSTR 0x0150 /* Instruction Fetch */
+diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
+index cdbf3677..be12c534 100644
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -45,22 +45,28 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ /* Re-load page tables */
+ load_cr3(next->pgd);
+
+- /* stop flush ipis for the previous mm */
++ /* Stop flush ipis for the previous mm */
+ cpumask_clear_cpu(cpu, mm_cpumask(prev));
+
+- /*
+- * load the LDT, if the LDT is different:
+- */
++ /* Load the LDT, if the LDT is different: */
+ if (unlikely(prev->context.ldt != next->context.ldt))
+ load_LDT_nolock(&next->context);
+ }
+ #ifdef CONFIG_SMP
+- else {
++ else {
+ this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+ BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next);
+
+- if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next))) {
+- /* We were in lazy tlb mode and leave_mm disabled
++ if (!cpumask_test_cpu(cpu, mm_cpumask(next))) {
++ /*
++ * On established mms, the mm_cpumask is only changed
++ * from irq context, from ptep_clear_flush() while in
++ * lazy tlb mode, and here. Irqs are blocked during
++ * schedule, protecting us from simultaneous changes.
++ */
++ cpumask_set_cpu(cpu, mm_cpumask(next));
++ /*
++ * We were in lazy tlb mode and leave_mm disabled
+ * tlb flush IPI delivery. We must reload CR3
+ * to make sure to use no freed page tables.
+ */
+diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
+index 3048ded1..59554dca 100644
+--- a/arch/x86/kernel/amd_nb.c
++++ b/arch/x86/kernel/amd_nb.c
+@@ -20,6 +20,7 @@ const struct pci_device_id amd_nb_misc_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ {}
+ };
+@@ -27,6 +28,7 @@ EXPORT_SYMBOL(amd_nb_misc_ids);
+
+ static const struct pci_device_id amd_nb_link_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F4) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
+ {}
+ };
+@@ -81,13 +83,20 @@ int amd_cache_northbridges(void)
+ next_northbridge(misc, amd_nb_misc_ids);
+ node_to_amd_nb(i)->link = link =
+ next_northbridge(link, amd_nb_link_ids);
+- }
++ }
+
++ /* GART present only on Fam15h upto model 0fh */
+ if (boot_cpu_data.x86 == 0xf || boot_cpu_data.x86 == 0x10 ||
+- boot_cpu_data.x86 == 0x15)
++ (boot_cpu_data.x86 == 0x15 && boot_cpu_data.x86_model < 0x10))
+ amd_northbridges.flags |= AMD_NB_GART;
+
+ /*
++ * Check for L3 cache presence.
++ */
++ if (!cpuid_edx(0x80000006))
++ return 0;
++
++ /*
+ * Some CPU families support L3 Cache Index Disable. There are some
+ * limitations because of E382 and E388 on family 0x10.
+ */
+diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
+index cf913587..d859eea0 100644
+--- a/arch/x86/kernel/signal.c
++++ b/arch/x86/kernel/signal.c
+@@ -358,7 +358,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
+ else
+ put_user_ex(0, &frame->uc.uc_flags);
+ put_user_ex(0, &frame->uc.uc_link);
+- err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
++ save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+
+ /* Set up to return from userspace. */
+ restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
+@@ -423,7 +423,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
+ else
+ put_user_ex(0, &frame->uc.uc_flags);
+ put_user_ex(0, &frame->uc.uc_link);
+- err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
++ save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+
+ /* Set up to return from userspace. If provided, use a stub
+ already in userspace. */
+@@ -490,7 +490,7 @@ static int x32_setup_rt_frame(struct ksignal *ksig,
+ else
+ put_user_ex(0, &frame->uc.uc_flags);
+ put_user_ex(0, &frame->uc.uc_link);
+- err |= __compat_save_altstack(&frame->uc.uc_stack, regs->sp);
++ compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+ put_user_ex(0, &frame->uc.uc__pad0);
+
+ if (ksig->ka.sa.sa_flags & SA_RESTORER) {
+diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
+index 25b7ae8d..7609e0e4 100644
+--- a/arch/x86/lib/csum-wrappers_64.c
++++ b/arch/x86/lib/csum-wrappers_64.c
+@@ -6,6 +6,7 @@
+ */
+ #include <asm/checksum.h>
+ #include <linux/module.h>
++#include <asm/smap.h>
+
+ /**
+ * csum_partial_copy_from_user - Copy and checksum from user space.
+@@ -52,8 +53,10 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
+ len -= 2;
+ }
+ }
++ stac();
+ isum = csum_partial_copy_generic((__force const void *)src,
+ dst, len, isum, errp, NULL);
++ clac();
+ if (unlikely(*errp))
+ goto out_err;
+
+@@ -82,6 +85,8 @@ __wsum
+ csum_partial_copy_to_user(const void *src, void __user *dst,
+ int len, __wsum isum, int *errp)
+ {
++ __wsum ret;
++
+ might_sleep();
+
+ if (unlikely(!access_ok(VERIFY_WRITE, dst, len))) {
+@@ -105,8 +110,11 @@ csum_partial_copy_to_user(const void *src, void __user *dst,
+ }
+
+ *errp = 0;
+- return csum_partial_copy_generic(src, (void __force *)dst,
+- len, isum, NULL, errp);
++ stac();
++ ret = csum_partial_copy_generic(src, (void __force *)dst,
++ len, isum, NULL, errp);
++ clac();
++ return ret;
+ }
+ EXPORT_SYMBOL(csum_partial_copy_to_user);
+
+diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
+index d8507f81..74a60c7e 100644
+--- a/arch/xtensa/kernel/xtensa_ksyms.c
++++ b/arch/xtensa/kernel/xtensa_ksyms.c
+@@ -25,6 +25,7 @@
+ #include <asm/io.h>
+ #include <asm/page.h>
+ #include <asm/pgalloc.h>
++#include <asm/ftrace.h>
+ #ifdef CONFIG_BLK_DEV_FD
+ #include <asm/floppy.h>
+ #endif
+diff --git a/crypto/api.c b/crypto/api.c
+index 3b618033..37c4c721 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -34,6 +34,8 @@ EXPORT_SYMBOL_GPL(crypto_alg_sem);
+ BLOCKING_NOTIFIER_HEAD(crypto_chain);
+ EXPORT_SYMBOL_GPL(crypto_chain);
+
++static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg);
++
+ struct crypto_alg *crypto_mod_get(struct crypto_alg *alg)
+ {
+ return try_module_get(alg->cra_module) ? crypto_alg_get(alg) : NULL;
+@@ -144,8 +146,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,
+ }
+ up_write(&crypto_alg_sem);
+
+- if (alg != &larval->alg)
++ if (alg != &larval->alg) {
+ kfree(larval);
++ if (crypto_is_larval(alg))
++ alg = crypto_larval_wait(alg);
++ }
+
+ return alg;
+ }
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 6a382188..fb78bb9a 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -257,12 +257,13 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
+ pdata->mmio_size = resource_size(&rentry->res);
+ pdata->mmio_base = ioremap(rentry->res.start,
+ pdata->mmio_size);
+- pdata->dev_desc = dev_desc;
+ break;
+ }
+
+ acpi_dev_free_resource_list(&resource_list);
+
++ pdata->dev_desc = dev_desc;
++
+ if (dev_desc->clk_required) {
+ ret = register_device_clock(adev, pdata);
+ if (ret) {
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index 59178393..a67853e3 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -378,6 +378,7 @@ static int acpi_pci_root_add(struct acpi_device *device,
+ struct acpi_pci_root *root;
+ u32 flags, base_flags;
+ acpi_handle handle = device->handle;
++ bool no_aspm = false, clear_aspm = false;
+
+ root = kzalloc(sizeof(struct acpi_pci_root), GFP_KERNEL);
+ if (!root)
+@@ -437,27 +438,6 @@ static int acpi_pci_root_add(struct acpi_device *device,
+ flags = base_flags = OSC_PCI_SEGMENT_GROUPS_SUPPORT;
+ acpi_pci_osc_support(root, flags);
+
+- /*
+- * TBD: Need PCI interface for enumeration/configuration of roots.
+- */
+-
+- /*
+- * Scan the Root Bridge
+- * --------------------
+- * Must do this prior to any attempt to bind the root device, as the
+- * PCI namespace does not get created until this call is made (and
+- * thus the root bridge's pci_dev does not exist).
+- */
+- root->bus = pci_acpi_scan_root(root);
+- if (!root->bus) {
+- dev_err(&device->dev,
+- "Bus %04x:%02x not present in PCI namespace\n",
+- root->segment, (unsigned int)root->secondary.start);
+- result = -ENODEV;
+- goto end;
+- }
+-
+- /* Indicate support for various _OSC capabilities. */
+ if (pci_ext_cfg_avail())
+ flags |= OSC_EXT_PCI_CONFIG_SUPPORT;
+ if (pcie_aspm_support_enabled()) {
+@@ -471,7 +451,7 @@ static int acpi_pci_root_add(struct acpi_device *device,
+ if (ACPI_FAILURE(status)) {
+ dev_info(&device->dev, "ACPI _OSC support "
+ "notification failed, disabling PCIe ASPM\n");
+- pcie_no_aspm();
++ no_aspm = true;
+ flags = base_flags;
+ }
+ }
+@@ -503,7 +483,7 @@ static int acpi_pci_root_add(struct acpi_device *device,
+ * We have ASPM control, but the FADT indicates
+ * that it's unsupported. Clear it.
+ */
+- pcie_clear_aspm(root->bus);
++ clear_aspm = true;
+ }
+ } else {
+ dev_info(&device->dev,
+@@ -512,7 +492,14 @@ static int acpi_pci_root_add(struct acpi_device *device,
+ acpi_format_exception(status), flags);
+ dev_info(&device->dev,
+ "ACPI _OSC control for PCIe not granted, disabling ASPM\n");
+- pcie_no_aspm();
++ /*
++ * We want to disable ASPM here, but aspm_disabled
++ * needs to remain in its state from boot so that we
++ * properly handle PCIe 1.1 devices. So we set this
++ * flag here, to defer the action until after the ACPI
++ * root scan.
++ */
++ no_aspm = true;
+ }
+ } else {
+ dev_info(&device->dev,
+@@ -520,6 +507,33 @@ static int acpi_pci_root_add(struct acpi_device *device,
+ "(_OSC support mask: 0x%02x)\n", flags);
+ }
+
++ /*
++ * TBD: Need PCI interface for enumeration/configuration of roots.
++ */
++
++ /*
++ * Scan the Root Bridge
++ * --------------------
++ * Must do this prior to any attempt to bind the root device, as the
++ * PCI namespace does not get created until this call is made (and
++ * thus the root bridge's pci_dev does not exist).
++ */
++ root->bus = pci_acpi_scan_root(root);
++ if (!root->bus) {
++ dev_err(&device->dev,
++ "Bus %04x:%02x not present in PCI namespace\n",
++ root->segment, (unsigned int)root->secondary.start);
++ result = -ENODEV;
++ goto end;
++ }
++
++ if (clear_aspm) {
++ dev_info(&device->dev, "Disabling ASPM (FADT indicates it is unsupported)\n");
++ pcie_clear_aspm(root->bus);
++ }
++ if (no_aspm)
++ pcie_no_aspm();
++
+ pci_acpi_add_bus_pm_notifier(device, root->bus);
+ if (device->wakeup.flags.run_wake)
+ device_set_run_wake(root->bus->bridge, true);
+diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
+index a439602e..c8dac745 100644
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -868,8 +868,15 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,
+ goto err_del_dev;
+ }
+
++ mutex_lock(&fw_lock);
++ list_add(&buf->pending_list, &pending_fw_head);
++ mutex_unlock(&fw_lock);
++
+ retval = device_create_file(f_dev, &dev_attr_loading);
+ if (retval) {
++ mutex_lock(&fw_lock);
++ list_del_init(&buf->pending_list);
++ mutex_unlock(&fw_lock);
+ dev_err(f_dev, "%s: device_create_file failed\n", __func__);
+ goto err_del_bin_attr;
+ }
+@@ -884,10 +891,6 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,
+ kobject_uevent(&fw_priv->dev.kobj, KOBJ_ADD);
+ }
+
+- mutex_lock(&fw_lock);
+- list_add(&buf->pending_list, &pending_fw_head);
+- mutex_unlock(&fw_lock);
+-
+ wait_for_completion(&buf->completion);
+
+ cancel_delayed_work_sync(&fw_priv->timeout_work);
+diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
+index 53495753..6c2652a8 100644
+--- a/drivers/base/regmap/regmap-debugfs.c
++++ b/drivers/base/regmap/regmap-debugfs.c
+@@ -85,8 +85,8 @@ static unsigned int regmap_debugfs_get_dump_start(struct regmap *map,
+ unsigned int reg_offset;
+
+ /* Suppress the cache if we're using a subrange */
+- if (from)
+- return from;
++ if (base)
++ return base;
+
+ /*
+ * If we don't have a cache build one so we don't have to do a
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 4ad2ad9a..45aa20aa 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -1557,11 +1557,12 @@ rbd_img_obj_request_read_callback(struct rbd_obj_request *obj_request)
+ obj_request, obj_request->img_request, obj_request->result,
+ xferred, length);
+ /*
+- * ENOENT means a hole in the image. We zero-fill the
+- * entire length of the request. A short read also implies
+- * zero-fill to the end of the request. Either way we
+- * update the xferred count to indicate the whole request
+- * was satisfied.
++ * ENOENT means a hole in the image. We zero-fill the entire
++ * length of the request. A short read also implies zero-fill
++ * to the end of the request. An error requires the whole
++ * length of the request to be reported finished with an error
++ * to the block layer. In each case we update the xferred
++ * count to indicate the whole request was satisfied.
+ */
+ rbd_assert(obj_request->type != OBJ_REQUEST_NODATA);
+ if (obj_request->result == -ENOENT) {
+@@ -1570,14 +1571,13 @@ rbd_img_obj_request_read_callback(struct rbd_obj_request *obj_request)
+ else
+ zero_pages(obj_request->pages, 0, length);
+ obj_request->result = 0;
+- obj_request->xferred = length;
+ } else if (xferred < length && !obj_request->result) {
+ if (obj_request->type == OBJ_REQUEST_BIO)
+ zero_bio_chain(obj_request->bio_list, xferred);
+ else
+ zero_pages(obj_request->pages, xferred, length);
+- obj_request->xferred = length;
+ }
++ obj_request->xferred = length;
+ obj_request_done_set(obj_request);
+ }
+
+diff --git a/drivers/clk/clk-wm831x.c b/drivers/clk/clk-wm831x.c
+index 1b3f8c9b..1d5af3f7 100644
+--- a/drivers/clk/clk-wm831x.c
++++ b/drivers/clk/clk-wm831x.c
+@@ -360,6 +360,8 @@ static int wm831x_clk_probe(struct platform_device *pdev)
+ if (!clkdata)
+ return -ENOMEM;
+
++ clkdata->wm831x = wm831x;
++
+ /* XTAL_ENA can only be set via OTP/InstantConfig so just read once */
+ ret = wm831x_reg_read(wm831x, WM831X_CLOCK_CONTROL_2);
+ if (ret < 0) {
+diff --git a/drivers/cpuidle/coupled.c b/drivers/cpuidle/coupled.c
+index 2a297f86..fe853903 100644
+--- a/drivers/cpuidle/coupled.c
++++ b/drivers/cpuidle/coupled.c
+@@ -106,6 +106,7 @@ struct cpuidle_coupled {
+ cpumask_t coupled_cpus;
+ int requested_state[NR_CPUS];
+ atomic_t ready_waiting_counts;
++ atomic_t abort_barrier;
+ int online_count;
+ int refcnt;
+ int prevent;
+@@ -122,12 +123,19 @@ static DEFINE_MUTEX(cpuidle_coupled_lock);
+ static DEFINE_PER_CPU(struct call_single_data, cpuidle_coupled_poke_cb);
+
+ /*
+- * The cpuidle_coupled_poked_mask mask is used to avoid calling
++ * The cpuidle_coupled_poke_pending mask is used to avoid calling
+ * __smp_call_function_single with the per cpu call_single_data struct already
+ * in use. This prevents a deadlock where two cpus are waiting for each others
+ * call_single_data struct to be available
+ */
+-static cpumask_t cpuidle_coupled_poked_mask;
++static cpumask_t cpuidle_coupled_poke_pending;
++
++/*
++ * The cpuidle_coupled_poked mask is used to ensure that each cpu has been poked
++ * once to minimize entering the ready loop with a poke pending, which would
++ * require aborting and retrying.
++ */
++static cpumask_t cpuidle_coupled_poked;
+
+ /**
+ * cpuidle_coupled_parallel_barrier - synchronize all online coupled cpus
+@@ -291,10 +299,11 @@ static inline int cpuidle_coupled_get_state(struct cpuidle_device *dev,
+ return state;
+ }
+
+-static void cpuidle_coupled_poked(void *info)
++static void cpuidle_coupled_handle_poke(void *info)
+ {
+ int cpu = (unsigned long)info;
+- cpumask_clear_cpu(cpu, &cpuidle_coupled_poked_mask);
++ cpumask_set_cpu(cpu, &cpuidle_coupled_poked);
++ cpumask_clear_cpu(cpu, &cpuidle_coupled_poke_pending);
+ }
+
+ /**
+@@ -313,7 +322,7 @@ static void cpuidle_coupled_poke(int cpu)
+ {
+ struct call_single_data *csd = &per_cpu(cpuidle_coupled_poke_cb, cpu);
+
+- if (!cpumask_test_and_set_cpu(cpu, &cpuidle_coupled_poked_mask))
++ if (!cpumask_test_and_set_cpu(cpu, &cpuidle_coupled_poke_pending))
+ __smp_call_function_single(cpu, csd, 0);
+ }
+
+@@ -340,30 +349,19 @@ static void cpuidle_coupled_poke_others(int this_cpu,
+ * @coupled: the struct coupled that contains the current cpu
+ * @next_state: the index in drv->states of the requested state for this cpu
+ *
+- * Updates the requested idle state for the specified cpuidle device,
+- * poking all coupled cpus out of idle if necessary to let them see the new
+- * state.
++ * Updates the requested idle state for the specified cpuidle device.
++ * Returns the number of waiting cpus.
+ */
+-static void cpuidle_coupled_set_waiting(int cpu,
++static int cpuidle_coupled_set_waiting(int cpu,
+ struct cpuidle_coupled *coupled, int next_state)
+ {
+- int w;
+-
+ coupled->requested_state[cpu] = next_state;
+
+ /*
+- * If this is the last cpu to enter the waiting state, poke
+- * all the other cpus out of their waiting state so they can
+- * enter a deeper state. This can race with one of the cpus
+- * exiting the waiting state due to an interrupt and
+- * decrementing waiting_count, see comment below.
+- *
+ * The atomic_inc_return provides a write barrier to order the write
+ * to requested_state with the later write that increments ready_count.
+ */
+- w = atomic_inc_return(&coupled->ready_waiting_counts) & WAITING_MASK;
+- if (w == coupled->online_count)
+- cpuidle_coupled_poke_others(cpu, coupled);
++ return atomic_inc_return(&coupled->ready_waiting_counts) & WAITING_MASK;
+ }
+
+ /**
+@@ -410,19 +408,33 @@ static void cpuidle_coupled_set_done(int cpu, struct cpuidle_coupled *coupled)
+ * been processed and the poke bit has been cleared.
+ *
+ * Other interrupts may also be processed while interrupts are enabled, so
+- * need_resched() must be tested after turning interrupts off again to make sure
++ * need_resched() must be tested after this function returns to make sure
+ * the interrupt didn't schedule work that should take the cpu out of idle.
+ *
+- * Returns 0 if need_resched was false, -EINTR if need_resched was true.
++ * Returns 0 if no poke was pending, 1 if a poke was cleared.
+ */
+ static int cpuidle_coupled_clear_pokes(int cpu)
+ {
++ if (!cpumask_test_cpu(cpu, &cpuidle_coupled_poke_pending))
++ return 0;
++
+ local_irq_enable();
+- while (cpumask_test_cpu(cpu, &cpuidle_coupled_poked_mask))
++ while (cpumask_test_cpu(cpu, &cpuidle_coupled_poke_pending))
+ cpu_relax();
+ local_irq_disable();
+
+- return need_resched() ? -EINTR : 0;
++ return 1;
++}
++
++static bool cpuidle_coupled_any_pokes_pending(struct cpuidle_coupled *coupled)
++{
++ cpumask_t cpus;
++ int ret;
++
++ cpumask_and(&cpus, cpu_online_mask, &coupled->coupled_cpus);
++ ret = cpumask_and(&cpus, &cpuidle_coupled_poke_pending, &cpus);
++
++ return ret;
+ }
+
+ /**
+@@ -449,12 +461,14 @@ int cpuidle_enter_state_coupled(struct cpuidle_device *dev,
+ {
+ int entered_state = -1;
+ struct cpuidle_coupled *coupled = dev->coupled;
++ int w;
+
+ if (!coupled)
+ return -EINVAL;
+
+ while (coupled->prevent) {
+- if (cpuidle_coupled_clear_pokes(dev->cpu)) {
++ cpuidle_coupled_clear_pokes(dev->cpu);
++ if (need_resched()) {
+ local_irq_enable();
+ return entered_state;
+ }
+@@ -465,15 +479,37 @@ int cpuidle_enter_state_coupled(struct cpuidle_device *dev,
+ /* Read barrier ensures online_count is read after prevent is cleared */
+ smp_rmb();
+
+- cpuidle_coupled_set_waiting(dev->cpu, coupled, next_state);
++reset:
++ cpumask_clear_cpu(dev->cpu, &cpuidle_coupled_poked);
++
++ w = cpuidle_coupled_set_waiting(dev->cpu, coupled, next_state);
++ /*
++ * If this is the last cpu to enter the waiting state, poke
++ * all the other cpus out of their waiting state so they can
++ * enter a deeper state. This can race with one of the cpus
++ * exiting the waiting state due to an interrupt and
++ * decrementing waiting_count, see comment below.
++ */
++ if (w == coupled->online_count) {
++ cpumask_set_cpu(dev->cpu, &cpuidle_coupled_poked);
++ cpuidle_coupled_poke_others(dev->cpu, coupled);
++ }
+
+ retry:
+ /*
+ * Wait for all coupled cpus to be idle, using the deepest state
+- * allowed for a single cpu.
++ * allowed for a single cpu. If this was not the poking cpu, wait
++ * for at least one poke before leaving to avoid a race where
++ * two cpus could arrive at the waiting loop at the same time,
++ * but the first of the two to arrive could skip the loop without
++ * processing the pokes from the last to arrive.
+ */
+- while (!cpuidle_coupled_cpus_waiting(coupled)) {
+- if (cpuidle_coupled_clear_pokes(dev->cpu)) {
++ while (!cpuidle_coupled_cpus_waiting(coupled) ||
++ !cpumask_test_cpu(dev->cpu, &cpuidle_coupled_poked)) {
++ if (cpuidle_coupled_clear_pokes(dev->cpu))
++ continue;
++
++ if (need_resched()) {
+ cpuidle_coupled_set_not_waiting(dev->cpu, coupled);
+ goto out;
+ }
+@@ -487,12 +523,19 @@ retry:
+ dev->safe_state_index);
+ }
+
+- if (cpuidle_coupled_clear_pokes(dev->cpu)) {
++ cpuidle_coupled_clear_pokes(dev->cpu);
++ if (need_resched()) {
+ cpuidle_coupled_set_not_waiting(dev->cpu, coupled);
+ goto out;
+ }
+
+ /*
++ * Make sure final poke status for this cpu is visible before setting
++ * cpu as ready.
++ */
++ smp_wmb();
++
++ /*
+ * All coupled cpus are probably idle. There is a small chance that
+ * one of the other cpus just became active. Increment the ready count,
+ * and spin until all coupled cpus have incremented the counter. Once a
+@@ -511,6 +554,28 @@ retry:
+ cpu_relax();
+ }
+
++ /*
++ * Make sure read of all cpus ready is done before reading pending pokes
++ */
++ smp_rmb();
++
++ /*
++ * There is a small chance that a cpu left and reentered idle after this
++ * cpu saw that all cpus were waiting. The cpu that reentered idle will
++ * have sent this cpu a poke, which will still be pending after the
++ * ready loop. The pending interrupt may be lost by the interrupt
++ * controller when entering the deep idle state. It's not possible to
++ * clear a pending interrupt without turning interrupts on and handling
++ * it, and it's too late to turn on interrupts here, so reset the
++ * coupled idle state of all cpus and retry.
++ */
++ if (cpuidle_coupled_any_pokes_pending(coupled)) {
++ cpuidle_coupled_set_done(dev->cpu, coupled);
++ /* Wait for all cpus to see the pending pokes */
++ cpuidle_coupled_parallel_barrier(dev, &coupled->abort_barrier);
++ goto reset;
++ }
++
+ /* all cpus have acked the coupled state */
+ next_state = cpuidle_coupled_get_state(dev, coupled);
+
+@@ -596,7 +661,7 @@ have_coupled:
+ coupled->refcnt++;
+
+ csd = &per_cpu(cpuidle_coupled_poke_cb, dev->cpu);
+- csd->func = cpuidle_coupled_poked;
++ csd->func = cpuidle_coupled_handle_poke;
+ csd->info = (void *)(unsigned long)dev->cpu;
+
+ return 0;
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index 8b6a0343..8b3d9014 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -2470,8 +2470,15 @@ static int amd64_init_one_instance(struct pci_dev *F2)
+ layers[0].size = pvt->csels[0].b_cnt;
+ layers[0].is_virt_csrow = true;
+ layers[1].type = EDAC_MC_LAYER_CHANNEL;
+- layers[1].size = pvt->channel_count;
++
++ /*
++ * Always allocate two channels since we can have setups with DIMMs on
++ * only one channel. Also, this simplifies handling later for the price
++ * of a couple of KBs tops.
++ */
++ layers[1].size = 2;
+ layers[1].is_virt_csrow = false;
++
+ mci = edac_mc_alloc(nid, ARRAY_SIZE(layers), layers, 0);
+ if (!mci)
+ goto err_siblings;
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 95d6f4b6..70fc1335 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -125,6 +125,9 @@ static struct edid_quirk {
+
+ /* ViewSonic VA2026w */
+ { "VSC", 5020, EDID_QUIRK_FORCE_REDUCED_BLANKING },
++
++ /* Medion MD 30217 PG */
++ { "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
+ };
+
+ /*
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index be79f477..ca40d1b1 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -7809,6 +7809,19 @@ intel_modeset_pipe_config(struct drm_crtc *crtc,
+ pipe_config->cpu_transcoder = to_intel_crtc(crtc)->pipe;
+ pipe_config->shared_dpll = DPLL_ID_PRIVATE;
+
++ /*
++ * Sanitize sync polarity flags based on requested ones. If neither
++ * positive or negative polarity is requested, treat this as meaning
++ * negative polarity.
++ */
++ if (!(pipe_config->adjusted_mode.flags &
++ (DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_NHSYNC)))
++ pipe_config->adjusted_mode.flags |= DRM_MODE_FLAG_NHSYNC;
++
++ if (!(pipe_config->adjusted_mode.flags &
++ (DRM_MODE_FLAG_PVSYNC | DRM_MODE_FLAG_NVSYNC)))
++ pipe_config->adjusted_mode.flags |= DRM_MODE_FLAG_NVSYNC;
++
+ /* Compute a starting value for pipe_config->pipe_bpp taking the source
+ * plane pixel format and any sink constraints into account. Returns the
+ * source plane bpp so that dithering can be selected on mismatches
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 36668d1a..5956445d 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -63,6 +63,8 @@ struct hid_report *hid_register_report(struct hid_device *device, unsigned type,
+ struct hid_report_enum *report_enum = device->report_enum + type;
+ struct hid_report *report;
+
++ if (id >= HID_MAX_IDS)
++ return NULL;
+ if (report_enum->report_id_hash[id])
+ return report_enum->report_id_hash[id];
+
+@@ -404,8 +406,10 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
+
+ case HID_GLOBAL_ITEM_TAG_REPORT_ID:
+ parser->global.report_id = item_udata(item);
+- if (parser->global.report_id == 0) {
+- hid_err(parser->device, "report_id 0 is invalid\n");
++ if (parser->global.report_id == 0 ||
++ parser->global.report_id >= HID_MAX_IDS) {
++ hid_err(parser->device, "report_id %u is invalid\n",
++ parser->global.report_id);
+ return -1;
+ }
+ return 0;
+@@ -575,7 +579,7 @@ static void hid_close_report(struct hid_device *device)
+ for (i = 0; i < HID_REPORT_TYPES; i++) {
+ struct hid_report_enum *report_enum = device->report_enum + i;
+
+- for (j = 0; j < 256; j++) {
++ for (j = 0; j < HID_MAX_IDS; j++) {
+ struct hid_report *report = report_enum->report_id_hash[j];
+ if (report)
+ hid_free_report(report);
+@@ -1152,7 +1156,12 @@ EXPORT_SYMBOL_GPL(hid_output_report);
+
+ int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
+ {
+- unsigned size = field->report_size;
++ unsigned size;
++
++ if (!field)
++ return -1;
++
++ size = field->report_size;
+
+ hid_dump_input(field->report->device, field->usage + offset, value);
+
+@@ -1597,6 +1606,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KEYTOUCH, USB_DEVICE_ID_KEYTOUCH_IEC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_I405X) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index ffe4c7ae..22134d4b 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -135,9 +135,9 @@
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS 0x023b
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI 0x0255
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO 0x0256
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0291
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0292
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0293
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0290
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0291
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0292
+ #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY 0x030a
+ #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY 0x030b
+ #define USB_DEVICE_ID_APPLE_IRCONTROL 0x8240
+@@ -482,6 +482,7 @@
+ #define USB_VENDOR_ID_KYE 0x0458
+ #define USB_DEVICE_ID_KYE_ERGO_525V 0x0087
+ #define USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE 0x0138
++#define USB_DEVICE_ID_GENIUS_GX_IMPERATOR 0x4018
+ #define USB_DEVICE_ID_KYE_GPEN_560 0x5003
+ #define USB_DEVICE_ID_KYE_EASYPEN_I405X 0x5010
+ #define USB_DEVICE_ID_KYE_MOUSEPEN_I608X 0x5011
+@@ -658,6 +659,7 @@
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16 0x0012
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17 0x0013
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18 0x0014
++#define USB_DEVICE_ID_NTRIG_DUOSENSE 0x1500
+
+ #define USB_VENDOR_ID_ONTRAK 0x0a07
+ #define USB_DEVICE_ID_ONTRAK_ADU100 0x0064
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 7480799e..3fc4034a 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -340,7 +340,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ {
+ struct hid_device *dev = container_of(psy, struct hid_device, battery);
+ int ret = 0;
+- __u8 buf[2] = {};
++ __u8 *buf;
+
+ switch (prop) {
+ case POWER_SUPPLY_PROP_PRESENT:
+@@ -349,12 +349,19 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ break;
+
+ case POWER_SUPPLY_PROP_CAPACITY:
++
++ buf = kmalloc(2 * sizeof(__u8), GFP_KERNEL);
++ if (!buf) {
++ ret = -ENOMEM;
++ break;
++ }
+ ret = dev->hid_get_raw_report(dev, dev->battery_report_id,
+- buf, sizeof(buf),
++ buf, 2,
+ dev->battery_report_type);
+
+ if (ret != 2) {
+ ret = -ENODATA;
++ kfree(buf);
+ break;
+ }
+ ret = 0;
+@@ -364,6 +371,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ buf[1] <= dev->battery_max)
+ val->intval = (100 * (buf[1] - dev->battery_min)) /
+ (dev->battery_max - dev->battery_min);
++ kfree(buf);
+ break;
+
+ case POWER_SUPPLY_PROP_MODEL_NAME:
+diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
+index 1e2ee2aa..73845120 100644
+--- a/drivers/hid/hid-kye.c
++++ b/drivers/hid/hid-kye.c
+@@ -268,6 +268,26 @@ static __u8 easypen_m610x_rdesc_fixed[] = {
+ 0xC0 /* End Collection */
+ };
+
++static __u8 *kye_consumer_control_fixup(struct hid_device *hdev, __u8 *rdesc,
++ unsigned int *rsize, int offset, const char *device_name) {
++ /*
++ * the fixup that need to be done:
++ * - change Usage Maximum in the Comsumer Control
++ * (report ID 3) to a reasonable value
++ */
++ if (*rsize >= offset + 31 &&
++ /* Usage Page (Consumer Devices) */
++ rdesc[offset] == 0x05 && rdesc[offset + 1] == 0x0c &&
++ /* Usage (Consumer Control) */
++ rdesc[offset + 2] == 0x09 && rdesc[offset + 3] == 0x01 &&
++ /* Usage Maximum > 12287 */
++ rdesc[offset + 10] == 0x2a && rdesc[offset + 12] > 0x2f) {
++ hid_info(hdev, "fixing up %s report descriptor\n", device_name);
++ rdesc[offset + 12] = 0x2f;
++ }
++ return rdesc;
++}
++
+ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+@@ -315,23 +335,12 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ }
+ break;
+ case USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE:
+- /*
+- * the fixup that need to be done:
+- * - change Usage Maximum in the Comsumer Control
+- * (report ID 3) to a reasonable value
+- */
+- if (*rsize >= 135 &&
+- /* Usage Page (Consumer Devices) */
+- rdesc[104] == 0x05 && rdesc[105] == 0x0c &&
+- /* Usage (Consumer Control) */
+- rdesc[106] == 0x09 && rdesc[107] == 0x01 &&
+- /* Usage Maximum > 12287 */
+- rdesc[114] == 0x2a && rdesc[116] > 0x2f) {
+- hid_info(hdev,
+- "fixing up Genius Gila Gaming Mouse "
+- "report descriptor\n");
+- rdesc[116] = 0x2f;
+- }
++ rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 104,
++ "Genius Gila Gaming Mouse");
++ break;
++ case USB_DEVICE_ID_GENIUS_GX_IMPERATOR:
++ rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 83,
++ "Genius Gx Imperator Keyboard");
+ break;
+ }
+ return rdesc;
+@@ -428,6 +437,8 @@ static const struct hid_device_id kye_devices[] = {
+ USB_DEVICE_ID_KYE_EASYPEN_M610X) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+ USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
++ USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, kye_devices);
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index ef951025..5482156a 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev)
+ struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT].
+ report_id_hash[0x0d];
+
+- if (!report)
++ if (!report || report->maxfield < 1 ||
++ report->field[0]->report_count < 1)
+ return -EINVAL;
+
+ hid_hw_request(hdev, report, HID_REQ_GET_REPORT);
+diff --git a/drivers/hid/hid-picolcd_cir.c b/drivers/hid/hid-picolcd_cir.c
+index e346038f..59d5eb1e 100644
+--- a/drivers/hid/hid-picolcd_cir.c
++++ b/drivers/hid/hid-picolcd_cir.c
+@@ -145,6 +145,7 @@ void picolcd_exit_cir(struct picolcd_data *data)
+ struct rc_dev *rdev = data->rc_dev;
+
+ data->rc_dev = NULL;
+- rc_unregister_device(rdev);
++ if (rdev)
++ rc_unregister_device(rdev);
+ }
+
+diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
+index b48092d0..acbb0210 100644
+--- a/drivers/hid/hid-picolcd_core.c
++++ b/drivers/hid/hid-picolcd_core.c
+@@ -290,7 +290,7 @@ static ssize_t picolcd_operation_mode_store(struct device *dev,
+ buf += 10;
+ cnt -= 10;
+ }
+- if (!report)
++ if (!report || report->maxfield != 1)
+ return -EINVAL;
+
+ while (cnt > 0 && (buf[cnt-1] == '\n' || buf[cnt-1] == '\r'))
+diff --git a/drivers/hid/hid-picolcd_fb.c b/drivers/hid/hid-picolcd_fb.c
+index 591f6b22..c930ab85 100644
+--- a/drivers/hid/hid-picolcd_fb.c
++++ b/drivers/hid/hid-picolcd_fb.c
+@@ -593,10 +593,14 @@ err_nomem:
+ void picolcd_exit_framebuffer(struct picolcd_data *data)
+ {
+ struct fb_info *info = data->fb_info;
+- struct picolcd_fb_data *fbdata = info->par;
++ struct picolcd_fb_data *fbdata;
+ unsigned long flags;
+
++ if (!info)
++ return;
++
+ device_remove_file(&data->hdev->dev, &dev_attr_fb_update_rate);
++ fbdata = info->par;
+
+ /* disconnect framebuffer from HID dev */
+ spin_lock_irqsave(&fbdata->lock, flags);
+diff --git a/drivers/hid/hid-pl.c b/drivers/hid/hid-pl.c
+index d29112fa..2dcd7d98 100644
+--- a/drivers/hid/hid-pl.c
++++ b/drivers/hid/hid-pl.c
+@@ -132,8 +132,14 @@ static int plff_init(struct hid_device *hid)
+ strong = &report->field[0]->value[2];
+ weak = &report->field[0]->value[3];
+ debug("detected single-field device");
+- } else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 &&
+- report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) {
++ } else if (report->field[0]->maxusage == 1 &&
++ report->field[0]->usage[0].hid ==
++ (HID_UP_LED | 0x43) &&
++ report->maxfield >= 4 &&
++ report->field[0]->report_count >= 1 &&
++ report->field[1]->report_count >= 1 &&
++ report->field[2]->report_count >= 1 &&
++ report->field[3]->report_count >= 1) {
+ report->field[0]->value[0] = 0x00;
+ report->field[1]->value[0] = 0x00;
+ strong = &report->field[2]->value[0];
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index ca749810..aa34755c 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -221,7 +221,8 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
+
+ mutex_lock(&data->mutex);
+ report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
+- if (!report || (field_index >= report->maxfield)) {
++ if (!report || (field_index >= report->maxfield) ||
++ report->field[field_index]->report_count < 1) {
+ ret = -EINVAL;
+ goto done_proc;
+ }
+diff --git a/drivers/hid/hid-speedlink.c b/drivers/hid/hid-speedlink.c
+index a2f587d0..7112f3e8 100644
+--- a/drivers/hid/hid-speedlink.c
++++ b/drivers/hid/hid-speedlink.c
+@@ -3,7 +3,7 @@
+ * Fixes "jumpy" cursor and removes nonexistent keyboard LEDS from
+ * the HID descriptor.
+ *
+- * Copyright (c) 2011 Stefan Kriwanek <mail@stefankriwanek.de>
++ * Copyright (c) 2011, 2013 Stefan Kriwanek <dev@stefankriwanek.de>
+ */
+
+ /*
+@@ -46,8 +46,13 @@ static int speedlink_event(struct hid_device *hdev, struct hid_field *field,
+ struct hid_usage *usage, __s32 value)
+ {
+ /* No other conditions due to usage_table. */
+- /* Fix "jumpy" cursor (invalid events sent by device). */
+- if (value == 256)
++
++ /* This fixes the "jumpy" cursor occuring due to invalid events sent
++ * by the device. Some devices only send them with value==+256, others
++ * don't. However, catching abs(value)>=256 is restrictive enough not
++ * to interfere with devices that were bug-free (has been tested).
++ */
++ if (abs(value) >= 256)
+ return 1;
+ /* Drop useless distance 0 events (on button clicks etc.) as well */
+ if (value == 0)
+diff --git a/drivers/hid/hid-wiimote-core.c b/drivers/hid/hid-wiimote-core.c
+index 0c06054c..66020982 100644
+--- a/drivers/hid/hid-wiimote-core.c
++++ b/drivers/hid/hid-wiimote-core.c
+@@ -212,10 +212,12 @@ static __u8 select_drm(struct wiimote_data *wdata)
+
+ if (ir == WIIPROTO_FLAG_IR_BASIC) {
+ if (wdata->state.flags & WIIPROTO_FLAG_ACCEL) {
+- if (ext)
+- return WIIPROTO_REQ_DRM_KAIE;
+- else
+- return WIIPROTO_REQ_DRM_KAI;
++ /* GEN10 and ealier devices bind IR formats to DRMs.
++ * Hence, we cannot use DRM_KAI here as it might be
++ * bound to IR_EXT. Use DRM_KAIE unconditionally so we
++ * work with all devices and our parsers can use the
++ * fixed formats, too. */
++ return WIIPROTO_REQ_DRM_KAIE;
+ } else {
+ return WIIPROTO_REQ_DRM_KIE;
+ }
+diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
+index 6f1feb2c..dbfe3007 100644
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -113,7 +113,7 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer,
+ __u8 *buf;
+ int ret = 0;
+
+- if (!hidraw_table[minor]) {
++ if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
+ ret = -ENODEV;
+ goto out;
+ }
+@@ -261,7 +261,7 @@ static int hidraw_open(struct inode *inode, struct file *file)
+ }
+
+ mutex_lock(&minors_lock);
+- if (!hidraw_table[minor]) {
++ if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
+ err = -ENODEV;
+ goto out_unlock;
+ }
+@@ -302,39 +302,38 @@ static int hidraw_fasync(int fd, struct file *file, int on)
+ return fasync_helper(fd, file, on, &list->fasync);
+ }
+
++static void drop_ref(struct hidraw *hidraw, int exists_bit)
++{
++ if (exists_bit) {
++ hid_hw_close(hidraw->hid);
++ hidraw->exist = 0;
++ if (hidraw->open)
++ wake_up_interruptible(&hidraw->wait);
++ } else {
++ --hidraw->open;
++ }
++
++ if (!hidraw->open && !hidraw->exist) {
++ device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
++ hidraw_table[hidraw->minor] = NULL;
++ kfree(hidraw);
++ }
++}
++
+ static int hidraw_release(struct inode * inode, struct file * file)
+ {
+ unsigned int minor = iminor(inode);
+- struct hidraw *dev;
+ struct hidraw_list *list = file->private_data;
+- int ret;
+- int i;
+
+ mutex_lock(&minors_lock);
+- if (!hidraw_table[minor]) {
+- ret = -ENODEV;
+- goto unlock;
+- }
+
+ list_del(&list->node);
+- dev = hidraw_table[minor];
+- if (!--dev->open) {
+- if (list->hidraw->exist) {
+- hid_hw_power(dev->hid, PM_HINT_NORMAL);
+- hid_hw_close(dev->hid);
+- } else {
+- kfree(list->hidraw);
+- }
+- }
+-
+- for (i = 0; i < HIDRAW_BUFFER_SIZE; ++i)
+- kfree(list->buffer[i].value);
+ kfree(list);
+- ret = 0;
+-unlock:
+- mutex_unlock(&minors_lock);
+
+- return ret;
++ drop_ref(hidraw_table[minor], 0);
++
++ mutex_unlock(&minors_lock);
++ return 0;
+ }
+
+ static long hidraw_ioctl(struct file *file, unsigned int cmd,
+@@ -539,18 +538,9 @@ void hidraw_disconnect(struct hid_device *hid)
+ struct hidraw *hidraw = hid->hidraw;
+
+ mutex_lock(&minors_lock);
+- hidraw->exist = 0;
+-
+- device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
+
+- hidraw_table[hidraw->minor] = NULL;
++ drop_ref(hidraw, 1);
+
+- if (hidraw->open) {
+- hid_hw_close(hid);
+- wake_up_interruptible(&hidraw->wait);
+- } else {
+- kfree(hidraw);
+- }
+ mutex_unlock(&minors_lock);
+ }
+ EXPORT_SYMBOL_GPL(hidraw_disconnect);
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 19b8360f..07345521 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -109,6 +109,8 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
++ { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
++
+ { 0, 0 }
+ };
+
+diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
+index 4ef4d5e1..a73f9618 100644
+--- a/drivers/input/mouse/bcm5974.c
++++ b/drivers/input/mouse/bcm5974.c
+@@ -89,9 +89,9 @@
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO 0x025a
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS 0x025b
+ /* MacbookAir6,2 (unibody, June 2013) */
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0291
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0292
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0293
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0290
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0291
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0292
+
+ #define BCM5974_DEVICE(prod) { \
+ .match_flags = (USB_DEVICE_ID_MATCH_DEVICE | \
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index eec0d3e0..15e9b57e 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -890,56 +890,54 @@ static int dma_pte_clear_range(struct dmar_domain *domain,
+ return order;
+ }
+
++static void dma_pte_free_level(struct dmar_domain *domain, int level,
++ struct dma_pte *pte, unsigned long pfn,
++ unsigned long start_pfn, unsigned long last_pfn)
++{
++ pfn = max(start_pfn, pfn);
++ pte = &pte[pfn_level_offset(pfn, level)];
++
++ do {
++ unsigned long level_pfn;
++ struct dma_pte *level_pte;
++
++ if (!dma_pte_present(pte) || dma_pte_superpage(pte))
++ goto next;
++
++ level_pfn = pfn & level_mask(level - 1);
++ level_pte = phys_to_virt(dma_pte_addr(pte));
++
++ if (level > 2)
++ dma_pte_free_level(domain, level - 1, level_pte,
++ level_pfn, start_pfn, last_pfn);
++
++ /* If range covers entire pagetable, free it */
++ if (!(start_pfn > level_pfn ||
++ last_pfn < level_pfn + level_size(level))) {
++ dma_clear_pte(pte);
++ domain_flush_cache(domain, pte, sizeof(*pte));
++ free_pgtable_page(level_pte);
++ }
++next:
++ pfn += level_size(level);
++ } while (!first_pte_in_page(++pte) && pfn <= last_pfn);
++}
++
+ /* free page table pages. last level pte should already be cleared */
+ static void dma_pte_free_pagetable(struct dmar_domain *domain,
+ unsigned long start_pfn,
+ unsigned long last_pfn)
+ {
+ int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
+- struct dma_pte *first_pte, *pte;
+- int total = agaw_to_level(domain->agaw);
+- int level;
+- unsigned long tmp;
+- int large_page = 2;
+
+ BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
+ BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width);
+ BUG_ON(start_pfn > last_pfn);
+
+ /* We don't need lock here; nobody else touches the iova range */
+- level = 2;
+- while (level <= total) {
+- tmp = align_to_level(start_pfn, level);
+-
+- /* If we can't even clear one PTE at this level, we're done */
+- if (tmp + level_size(level) - 1 > last_pfn)
+- return;
+-
+- do {
+- large_page = level;
+- first_pte = pte = dma_pfn_level_pte(domain, tmp, level, &large_page);
+- if (large_page > level)
+- level = large_page + 1;
+- if (!pte) {
+- tmp = align_to_level(tmp + 1, level + 1);
+- continue;
+- }
+- do {
+- if (dma_pte_present(pte)) {
+- free_pgtable_page(phys_to_virt(dma_pte_addr(pte)));
+- dma_clear_pte(pte);
+- }
+- pte++;
+- tmp += level_size(level);
+- } while (!first_pte_in_page(pte) &&
+- tmp + level_size(level) - 1 <= last_pfn);
++ dma_pte_free_level(domain, agaw_to_level(domain->agaw),
++ domain->pgd, 0, start_pfn, last_pfn);
+
+- domain_flush_cache(domain, first_pte,
+- (void *)pte - (void *)first_pte);
+-
+- } while (tmp && tmp + level_size(level) - 1 <= last_pfn);
+- level++;
+- }
+ /* free pgd */
+ if (start_pfn == 0 && last_pfn == DOMAIN_MAX_PFN(domain->gaw)) {
+ free_pgtable_page(domain->pgd);
+diff --git a/drivers/leds/leds-wm831x-status.c b/drivers/leds/leds-wm831x-status.c
+index 120815a4..5a19abde 100644
+--- a/drivers/leds/leds-wm831x-status.c
++++ b/drivers/leds/leds-wm831x-status.c
+@@ -230,9 +230,9 @@ static int wm831x_status_probe(struct platform_device *pdev)
+ int id = pdev->id % ARRAY_SIZE(chip_pdata->status);
+ int ret;
+
+- res = platform_get_resource(pdev, IORESOURCE_IO, 0);
++ res = platform_get_resource(pdev, IORESOURCE_REG, 0);
+ if (res == NULL) {
+- dev_err(&pdev->dev, "No I/O resource\n");
++ dev_err(&pdev->dev, "No register resource\n");
+ ret = -EINVAL;
+ goto err;
+ }
+diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c
+index 08626225..63676a8b 100644
+--- a/drivers/media/common/siano/smsdvb-main.c
++++ b/drivers/media/common/siano/smsdvb-main.c
+@@ -276,7 +276,8 @@ static void smsdvb_update_per_slices(struct smsdvb_client_t *client,
+
+ /* Legacy PER/BER */
+ tmp = p->ets_packets * 65535;
+- do_div(tmp, p->ts_packets + p->ets_packets);
++ if (p->ts_packets + p->ets_packets)
++ do_div(tmp, p->ts_packets + p->ets_packets);
+ client->legacy_per = tmp;
+ }
+
+diff --git a/drivers/media/dvb-frontends/mb86a20s.c b/drivers/media/dvb-frontends/mb86a20s.c
+index 856374bd..2c7217fb 100644
+--- a/drivers/media/dvb-frontends/mb86a20s.c
++++ b/drivers/media/dvb-frontends/mb86a20s.c
+@@ -157,7 +157,6 @@ static struct regdata mb86a20s_init2[] = {
+ { 0x45, 0x04 }, /* CN symbol 4 */
+ { 0x48, 0x04 }, /* CN manual mode */
+
+- { 0x50, 0xd5 }, { 0x51, 0x01 }, /* Serial */
+ { 0x50, 0xd6 }, { 0x51, 0x1f },
+ { 0x50, 0xd2 }, { 0x51, 0x03 },
+ { 0x50, 0xd7 }, { 0x51, 0xbf },
+@@ -1860,16 +1859,15 @@ static int mb86a20s_initfe(struct dvb_frontend *fe)
+ dev_dbg(&state->i2c->dev, "%s: IF=%d, IF reg=0x%06llx\n",
+ __func__, state->if_freq, (long long)pll);
+
+- if (!state->config->is_serial) {
++ if (!state->config->is_serial)
+ regD5 &= ~1;
+
+- rc = mb86a20s_writereg(state, 0x50, 0xd5);
+- if (rc < 0)
+- goto err;
+- rc = mb86a20s_writereg(state, 0x51, regD5);
+- if (rc < 0)
+- goto err;
+- }
++ rc = mb86a20s_writereg(state, 0x50, 0xd5);
++ if (rc < 0)
++ goto err;
++ rc = mb86a20s_writereg(state, 0x51, regD5);
++ if (rc < 0)
++ goto err;
+
+ rc = mb86a20s_writeregdata(state, mb86a20s_init2);
+ if (rc < 0)
+diff --git a/drivers/media/pci/cx88/cx88.h b/drivers/media/pci/cx88/cx88.h
+index afe0eaea..28893a6b 100644
+--- a/drivers/media/pci/cx88/cx88.h
++++ b/drivers/media/pci/cx88/cx88.h
+@@ -259,7 +259,7 @@ struct cx88_input {
+ };
+
+ enum cx88_audio_chip {
+- CX88_AUDIO_WM8775,
++ CX88_AUDIO_WM8775 = 1,
+ CX88_AUDIO_TVAUDIO,
+ };
+
+diff --git a/drivers/media/platform/exynos-gsc/gsc-core.c b/drivers/media/platform/exynos-gsc/gsc-core.c
+index 559fab2a..1ec60264 100644
+--- a/drivers/media/platform/exynos-gsc/gsc-core.c
++++ b/drivers/media/platform/exynos-gsc/gsc-core.c
+@@ -1122,10 +1122,14 @@ static int gsc_probe(struct platform_device *pdev)
+ goto err_clk;
+ }
+
+- ret = gsc_register_m2m_device(gsc);
++ ret = v4l2_device_register(dev, &gsc->v4l2_dev);
+ if (ret)
+ goto err_clk;
+
++ ret = gsc_register_m2m_device(gsc);
++ if (ret)
++ goto err_v4l2;
++
+ platform_set_drvdata(pdev, gsc);
+ pm_runtime_enable(dev);
+ ret = pm_runtime_get_sync(&pdev->dev);
+@@ -1147,6 +1151,8 @@ err_pm:
+ pm_runtime_put(dev);
+ err_m2m:
+ gsc_unregister_m2m_device(gsc);
++err_v4l2:
++ v4l2_device_unregister(&gsc->v4l2_dev);
+ err_clk:
+ gsc_clk_put(gsc);
+ return ret;
+@@ -1157,6 +1163,7 @@ static int gsc_remove(struct platform_device *pdev)
+ struct gsc_dev *gsc = platform_get_drvdata(pdev);
+
+ gsc_unregister_m2m_device(gsc);
++ v4l2_device_unregister(&gsc->v4l2_dev);
+
+ vb2_dma_contig_cleanup_ctx(gsc->alloc_ctx);
+ pm_runtime_disable(&pdev->dev);
+diff --git a/drivers/media/platform/exynos-gsc/gsc-core.h b/drivers/media/platform/exynos-gsc/gsc-core.h
+index cc19bba0..76435d3b 100644
+--- a/drivers/media/platform/exynos-gsc/gsc-core.h
++++ b/drivers/media/platform/exynos-gsc/gsc-core.h
+@@ -343,6 +343,7 @@ struct gsc_dev {
+ unsigned long state;
+ struct vb2_alloc_ctx *alloc_ctx;
+ struct video_device vdev;
++ struct v4l2_device v4l2_dev;
+ };
+
+ /**
+diff --git a/drivers/media/platform/exynos-gsc/gsc-m2m.c b/drivers/media/platform/exynos-gsc/gsc-m2m.c
+index 40a73f7d..e576ff2d 100644
+--- a/drivers/media/platform/exynos-gsc/gsc-m2m.c
++++ b/drivers/media/platform/exynos-gsc/gsc-m2m.c
+@@ -751,6 +751,7 @@ int gsc_register_m2m_device(struct gsc_dev *gsc)
+ gsc->vdev.release = video_device_release_empty;
+ gsc->vdev.lock = &gsc->lock;
+ gsc->vdev.vfl_dir = VFL_DIR_M2M;
++ gsc->vdev.v4l2_dev = &gsc->v4l2_dev;
+ snprintf(gsc->vdev.name, sizeof(gsc->vdev.name), "%s.%d:m2m",
+ GSC_MODULE_NAME, gsc->id);
+
+diff --git a/drivers/media/platform/exynos4-is/fimc-lite.c b/drivers/media/platform/exynos4-is/fimc-lite.c
+index 08fbfede..e85dc4f2 100644
+--- a/drivers/media/platform/exynos4-is/fimc-lite.c
++++ b/drivers/media/platform/exynos4-is/fimc-lite.c
+@@ -90,7 +90,7 @@ static const struct fimc_fmt fimc_lite_formats[] = {
+ .name = "RAW10 (GRBG)",
+ .fourcc = V4L2_PIX_FMT_SGRBG10,
+ .colorspace = V4L2_COLORSPACE_SRGB,
+- .depth = { 10 },
++ .depth = { 16 },
+ .color = FIMC_FMT_RAW10,
+ .memplanes = 1,
+ .mbus_code = V4L2_MBUS_FMT_SGRBG10_1X10,
+@@ -99,7 +99,7 @@ static const struct fimc_fmt fimc_lite_formats[] = {
+ .name = "RAW12 (GRBG)",
+ .fourcc = V4L2_PIX_FMT_SGRBG12,
+ .colorspace = V4L2_COLORSPACE_SRGB,
+- .depth = { 12 },
++ .depth = { 16 },
+ .color = FIMC_FMT_RAW12,
+ .memplanes = 1,
+ .mbus_code = V4L2_MBUS_FMT_SGRBG12_1X12,
+diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
+index 19f556c5..91f21e27 100644
+--- a/drivers/media/platform/exynos4-is/media-dev.c
++++ b/drivers/media/platform/exynos4-is/media-dev.c
+@@ -1530,9 +1530,9 @@ static int fimc_md_probe(struct platform_device *pdev)
+ err_unlock:
+ mutex_unlock(&fmd->media_dev.graph_mutex);
+ err_clk:
+- media_device_unregister(&fmd->media_dev);
+ fimc_md_put_clocks(fmd);
+ fimc_md_unregister_entities(fmd);
++ media_device_unregister(&fmd->media_dev);
+ err_md:
+ v4l2_device_unregister(&fmd->v4l2_dev);
+ return ret;
+diff --git a/drivers/mmc/host/tmio_mmc_dma.c b/drivers/mmc/host/tmio_mmc_dma.c
+index 47bdb8fa..65edb4a6 100644
+--- a/drivers/mmc/host/tmio_mmc_dma.c
++++ b/drivers/mmc/host/tmio_mmc_dma.c
+@@ -104,6 +104,7 @@ static void tmio_mmc_start_dma_rx(struct tmio_mmc_host *host)
+ pio:
+ if (!desc) {
+ /* DMA failed, fall back to PIO */
++ tmio_mmc_enable_dma(host, false);
+ if (ret >= 0)
+ ret = -EIO;
+ host->chan_rx = NULL;
+@@ -116,7 +117,6 @@ pio:
+ }
+ dev_warn(&host->pdev->dev,
+ "DMA failed: %d, falling back to PIO\n", ret);
+- tmio_mmc_enable_dma(host, false);
+ }
+
+ dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d, sg[%d]\n", __func__,
+@@ -185,6 +185,7 @@ static void tmio_mmc_start_dma_tx(struct tmio_mmc_host *host)
+ pio:
+ if (!desc) {
+ /* DMA failed, fall back to PIO */
++ tmio_mmc_enable_dma(host, false);
+ if (ret >= 0)
+ ret = -EIO;
+ host->chan_tx = NULL;
+@@ -197,7 +198,6 @@ pio:
+ }
+ dev_warn(&host->pdev->dev,
+ "DMA failed: %d, falling back to PIO\n", ret);
+- tmio_mmc_enable_dma(host, false);
+ }
+
+ dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d\n", __func__,
+diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
+index dfcd0a56..fb8c4dea 100644
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -2793,7 +2793,9 @@ static void nand_set_defaults(struct nand_chip *chip, int busw)
+
+ if (!chip->select_chip)
+ chip->select_chip = nand_select_chip;
+- if (!chip->read_byte)
++
++ /* If called twice, pointers that depend on busw may need to be reset */
++ if (!chip->read_byte || chip->read_byte == nand_read_byte)
+ chip->read_byte = busw ? nand_read_byte16 : nand_read_byte;
+ if (!chip->read_word)
+ chip->read_word = nand_read_word;
+@@ -2801,9 +2803,9 @@ static void nand_set_defaults(struct nand_chip *chip, int busw)
+ chip->block_bad = nand_block_bad;
+ if (!chip->block_markbad)
+ chip->block_markbad = nand_default_block_markbad;
+- if (!chip->write_buf)
++ if (!chip->write_buf || chip->write_buf == nand_write_buf)
+ chip->write_buf = busw ? nand_write_buf16 : nand_write_buf;
+- if (!chip->read_buf)
++ if (!chip->read_buf || chip->read_buf == nand_read_buf)
+ chip->read_buf = busw ? nand_read_buf16 : nand_read_buf;
+ if (!chip->scan_bbt)
+ chip->scan_bbt = nand_default_bbt;
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 5df49d3c..c95bfb18 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -1069,6 +1069,9 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ if (!(e2->ec - e1->ec >= UBI_WL_THRESHOLD)) {
+ dbg_wl("no WL needed: min used EC %d, max free EC %d",
+ e1->ec, e2->ec);
++
++ /* Give the unused PEB back */
++ wl_tree_add(e2, &ubi->free);
+ goto out_cancel;
+ }
+ self_check_in_wl_tree(ubi, e1, &ubi->used);
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index b017818b..90ab2928 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -138,7 +138,9 @@
+ #define MVNETA_GMAC_FORCE_LINK_PASS BIT(1)
+ #define MVNETA_GMAC_CONFIG_MII_SPEED BIT(5)
+ #define MVNETA_GMAC_CONFIG_GMII_SPEED BIT(6)
++#define MVNETA_GMAC_AN_SPEED_EN BIT(7)
+ #define MVNETA_GMAC_CONFIG_FULL_DUPLEX BIT(12)
++#define MVNETA_GMAC_AN_DUPLEX_EN BIT(13)
+ #define MVNETA_MIB_COUNTERS_BASE 0x3080
+ #define MVNETA_MIB_LATE_COLLISION 0x7c
+ #define MVNETA_DA_FILT_SPEC_MCAST 0x3400
+@@ -915,6 +917,13 @@ static void mvneta_defaults_set(struct mvneta_port *pp)
+ /* Assign port SDMA configuration */
+ mvreg_write(pp, MVNETA_SDMA_CONFIG, val);
+
++ /* Disable PHY polling in hardware, since we're using the
++ * kernel phylib to do this.
++ */
++ val = mvreg_read(pp, MVNETA_UNIT_CONTROL);
++ val &= ~MVNETA_PHY_POLLING_ENABLE;
++ mvreg_write(pp, MVNETA_UNIT_CONTROL, val);
++
+ mvneta_set_ucast_table(pp, -1);
+ mvneta_set_special_mcast_table(pp, -1);
+ mvneta_set_other_mcast_table(pp, -1);
+@@ -2307,7 +2316,9 @@ static void mvneta_adjust_link(struct net_device *ndev)
+ val = mvreg_read(pp, MVNETA_GMAC_AUTONEG_CONFIG);
+ val &= ~(MVNETA_GMAC_CONFIG_MII_SPEED |
+ MVNETA_GMAC_CONFIG_GMII_SPEED |
+- MVNETA_GMAC_CONFIG_FULL_DUPLEX);
++ MVNETA_GMAC_CONFIG_FULL_DUPLEX |
++ MVNETA_GMAC_AN_SPEED_EN |
++ MVNETA_GMAC_AN_DUPLEX_EN);
+
+ if (phydev->duplex)
+ val |= MVNETA_GMAC_CONFIG_FULL_DUPLEX;
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+index 1f694ab3..77d3a705 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -1173,6 +1173,10 @@ skip_ws_det:
+ * is_on == 0 means MRC CCK is OFF (more noise imm)
+ */
+ bool is_on = param ? 1 : 0;
++
++ if (ah->caps.rx_chainmask == 1)
++ break;
++
+ REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+ AR_PHY_MRC_CCK_ENABLE, is_on);
+ REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index c1224b5a..020b9b37 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -79,10 +79,6 @@ struct ath_config {
+ sizeof(struct ath_buf_state)); \
+ } while (0)
+
+-#define ATH_RXBUF_RESET(_bf) do { \
+- (_bf)->bf_stale = false; \
+- } while (0)
+-
+ /**
+ * enum buffer_type - Buffer type flags
+ *
+@@ -317,6 +313,7 @@ struct ath_rx {
+ struct ath_descdma rxdma;
+ struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
+
++ struct ath_buf *buf_hold;
+ struct sk_buff *frag;
+
+ u32 ampdu_ref;
+diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
+index 865e043e..b4902b34 100644
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -42,8 +42,6 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+ struct ath_desc *ds;
+ struct sk_buff *skb;
+
+- ATH_RXBUF_RESET(bf);
+-
+ ds = bf->bf_desc;
+ ds->ds_link = 0; /* link to null */
+ ds->ds_data = bf->bf_buf_addr;
+@@ -70,6 +68,14 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+ sc->rx.rxlink = &ds->ds_link;
+ }
+
++static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
++{
++ if (sc->rx.buf_hold)
++ ath_rx_buf_link(sc, sc->rx.buf_hold);
++
++ sc->rx.buf_hold = bf;
++}
++
+ static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
+ {
+ /* XXX block beacon interrupts */
+@@ -117,7 +123,6 @@ static bool ath_rx_edma_buf_link(struct ath_softc *sc,
+
+ skb = bf->bf_mpdu;
+
+- ATH_RXBUF_RESET(bf);
+ memset(skb->data, 0, ah->caps.rx_status_len);
+ dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+ ah->caps.rx_status_len, DMA_TO_DEVICE);
+@@ -432,6 +437,7 @@ int ath_startrecv(struct ath_softc *sc)
+ if (list_empty(&sc->rx.rxbuf))
+ goto start_recv;
+
++ sc->rx.buf_hold = NULL;
+ sc->rx.rxlink = NULL;
+ list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
+ ath_rx_buf_link(sc, bf);
+@@ -677,6 +683,9 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
+ }
+
+ bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
++ if (bf == sc->rx.buf_hold)
++ return NULL;
++
+ ds = bf->bf_desc;
+
+ /*
+@@ -1375,7 +1384,7 @@ requeue:
+ if (edma) {
+ ath_rx_edma_buf_link(sc, qtype);
+ } else {
+- ath_rx_buf_link(sc, bf);
++ ath_rx_buf_relink(sc, bf);
+ ath9k_hw_rxena(ah);
+ }
+ } while (1);
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 92799273..ab646838 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2602,6 +2602,7 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
+ for (acno = 0, ac = &an->ac[acno];
+ acno < IEEE80211_NUM_ACS; acno++, ac++) {
+ ac->sched = false;
++ ac->clear_ps_filter = true;
+ ac->txq = sc->tx.txq_map[acno];
+ INIT_LIST_HEAD(&ac->tid_q);
+ }
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+index 1860c572..4fb9635d 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+@@ -1015,9 +1015,10 @@ static bool dma64_txidle(struct dma_info *di)
+
+ /*
+ * post receive buffers
+- * return false is refill failed completely and ring is empty this will stall
+- * the rx dma and user might want to call rxfill again asap. This unlikely
+- * happens on memory-rich NIC, but often on memory-constrained dongle
++ * Return false if refill failed completely or dma mapping failed. The ring
++ * is empty, which will stall the rx dma and user might want to call rxfill
++ * again asap. This is unlikely to happen on a memory-rich NIC, but often on
++ * memory-constrained dongle.
+ */
+ bool dma_rxfill(struct dma_pub *pub)
+ {
+@@ -1078,6 +1079,8 @@ bool dma_rxfill(struct dma_pub *pub)
+
+ pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
+ DMA_FROM_DEVICE);
++ if (dma_mapping_error(di->dmadev, pa))
++ return false;
+
+ /* save the free packet pointer */
+ di->rxp[rxout] = p;
+@@ -1284,7 +1287,11 @@ static void dma_txenq(struct dma_info *di, struct sk_buff *p)
+
+ /* get physical address of buffer start */
+ pa = dma_map_single(di->dmadev, data, len, DMA_TO_DEVICE);
+-
++ /* if mapping failed, free skb */
++ if (dma_mapping_error(di->dmadev, pa)) {
++ brcmu_pkt_buf_free_skb(p);
++ return;
++ }
+ /* With a DMA segment list, Descriptor table is filled
+ * using the segment list instead of looping over
+ * buffers in multi-chain DMA. Therefore, EOF for SGLIST
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 5c542791..bf8432f5 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1629,6 +1629,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
+ ap = dt_alloc(sizeof(*ap) + len + 1, 4);
+ if (!ap)
+ continue;
++ memset(ap, 0, sizeof(*ap) + len + 1);
+ ap->alias = start;
+ of_alias_add(ap, np, id, start, len);
+ }
+diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
+index b90a3a0a..19afb9a7 100644
+--- a/drivers/pinctrl/pinctrl-at91.c
++++ b/drivers/pinctrl/pinctrl-at91.c
+@@ -325,7 +325,7 @@ static void at91_mux_disable_interrupt(void __iomem *pio, unsigned mask)
+
+ static unsigned at91_mux_get_pullup(void __iomem *pio, unsigned pin)
+ {
+- return (readl_relaxed(pio + PIO_PUSR) >> pin) & 0x1;
++ return !((readl_relaxed(pio + PIO_PUSR) >> pin) & 0x1);
+ }
+
+ static void at91_mux_set_pullup(void __iomem *pio, unsigned mask, bool on)
+@@ -445,7 +445,7 @@ static void at91_mux_pio3_set_debounce(void __iomem *pio, unsigned mask,
+
+ static bool at91_mux_pio3_get_pulldown(void __iomem *pio, unsigned pin)
+ {
+- return (__raw_readl(pio + PIO_PPDSR) >> pin) & 0x1;
++ return !((__raw_readl(pio + PIO_PPDSR) >> pin) & 0x1);
+ }
+
+ static void at91_mux_pio3_set_pulldown(void __iomem *pio, unsigned mask, bool is_on)
+diff --git a/drivers/scsi/mpt3sas/Makefile b/drivers/scsi/mpt3sas/Makefile
+index 4c1d2e7a..efb0c4c2 100644
+--- a/drivers/scsi/mpt3sas/Makefile
++++ b/drivers/scsi/mpt3sas/Makefile
+@@ -1,5 +1,5 @@
+ # mpt3sas makefile
+-obj-m += mpt3sas.o
++obj-$(CONFIG_SCSI_MPT3SAS) += mpt3sas.o
+ mpt3sas-y += mpt3sas_base.o \
+ mpt3sas_config.o \
+ mpt3sas_scsih.o \
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 86fcf2c3..2783dd70 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2419,14 +2419,9 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
+ }
+ }
+
+- if (modepage == 0x3F) {
+- sd_printk(KERN_ERR, sdkp, "No Caching mode page "
+- "present\n");
+- goto defaults;
+- } else if ((buffer[offset] & 0x3f) != modepage) {
+- sd_printk(KERN_ERR, sdkp, "Got wrong page\n");
+- goto defaults;
+- }
++ sd_printk(KERN_ERR, sdkp, "No Caching mode page found\n");
++ goto defaults;
++
+ Page_found:
+ if (modepage == 8) {
+ sdkp->WCE = ((buffer[offset + 2] & 0x04) != 0);
+diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c
+index c1950e3b..674b236f 100644
+--- a/drivers/staging/comedi/drivers/dt282x.c
++++ b/drivers/staging/comedi/drivers/dt282x.c
+@@ -264,8 +264,9 @@ struct dt282x_private {
+ } \
+ udelay(5); \
+ } \
+- if (_i) \
++ if (_i) { \
+ b \
++ } \
+ } while (0)
+
+ static int prep_ai_dma(struct comedi_device *dev, int chan, int size);
+diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
+index e77fb6ea..8f54c503 100644
+--- a/drivers/staging/zram/zram_drv.c
++++ b/drivers/staging/zram/zram_drv.c
+@@ -445,6 +445,14 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
+ goto out;
+ }
+
++ /*
++ * zram_slot_free_notify could miss free so that let's
++ * double check.
++ */
++ if (unlikely(meta->table[index].handle ||
++ zram_test_flag(meta, index, ZRAM_ZERO)))
++ zram_free_page(zram, index);
++
+ ret = lzo1x_1_compress(uncmem, PAGE_SIZE, src, &clen,
+ meta->compress_workmem);
+
+@@ -504,6 +512,20 @@ out:
+ return ret;
+ }
+
++static void handle_pending_slot_free(struct zram *zram)
++{
++ struct zram_slot_free *free_rq;
++
++ spin_lock(&zram->slot_free_lock);
++ while (zram->slot_free_rq) {
++ free_rq = zram->slot_free_rq;
++ zram->slot_free_rq = free_rq->next;
++ zram_free_page(zram, free_rq->index);
++ kfree(free_rq);
++ }
++ spin_unlock(&zram->slot_free_lock);
++}
++
+ static int zram_bvec_rw(struct zram *zram, struct bio_vec *bvec, u32 index,
+ int offset, struct bio *bio, int rw)
+ {
+@@ -511,10 +533,12 @@ static int zram_bvec_rw(struct zram *zram, struct bio_vec *bvec, u32 index,
+
+ if (rw == READ) {
+ down_read(&zram->lock);
++ handle_pending_slot_free(zram);
+ ret = zram_bvec_read(zram, bvec, index, offset, bio);
+ up_read(&zram->lock);
+ } else {
+ down_write(&zram->lock);
++ handle_pending_slot_free(zram);
+ ret = zram_bvec_write(zram, bvec, index, offset);
+ up_write(&zram->lock);
+ }
+@@ -522,11 +546,13 @@ static int zram_bvec_rw(struct zram *zram, struct bio_vec *bvec, u32 index,
+ return ret;
+ }
+
+-static void zram_reset_device(struct zram *zram)
++static void zram_reset_device(struct zram *zram, bool reset_capacity)
+ {
+ size_t index;
+ struct zram_meta *meta;
+
++ flush_work(&zram->free_work);
++
+ down_write(&zram->init_lock);
+ if (!zram->init_done) {
+ up_write(&zram->init_lock);
+@@ -551,7 +577,8 @@ static void zram_reset_device(struct zram *zram)
+ memset(&zram->stats, 0, sizeof(zram->stats));
+
+ zram->disksize = 0;
+- set_capacity(zram->disk, 0);
++ if (reset_capacity)
++ set_capacity(zram->disk, 0);
+ up_write(&zram->init_lock);
+ }
+
+@@ -635,7 +662,7 @@ static ssize_t reset_store(struct device *dev,
+ if (bdev)
+ fsync_bdev(bdev);
+
+- zram_reset_device(zram);
++ zram_reset_device(zram, true);
+ return len;
+ }
+
+@@ -720,16 +747,40 @@ error:
+ bio_io_error(bio);
+ }
+
++static void zram_slot_free(struct work_struct *work)
++{
++ struct zram *zram;
++
++ zram = container_of(work, struct zram, free_work);
++ down_write(&zram->lock);
++ handle_pending_slot_free(zram);
++ up_write(&zram->lock);
++}
++
++static void add_slot_free(struct zram *zram, struct zram_slot_free *free_rq)
++{
++ spin_lock(&zram->slot_free_lock);
++ free_rq->next = zram->slot_free_rq;
++ zram->slot_free_rq = free_rq;
++ spin_unlock(&zram->slot_free_lock);
++}
++
+ static void zram_slot_free_notify(struct block_device *bdev,
+ unsigned long index)
+ {
+ struct zram *zram;
++ struct zram_slot_free *free_rq;
+
+ zram = bdev->bd_disk->private_data;
+- down_write(&zram->lock);
+- zram_free_page(zram, index);
+- up_write(&zram->lock);
+ atomic64_inc(&zram->stats.notify_free);
++
++ free_rq = kmalloc(sizeof(struct zram_slot_free), GFP_ATOMIC);
++ if (!free_rq)
++ return;
++
++ free_rq->index = index;
++ add_slot_free(zram, free_rq);
++ schedule_work(&zram->free_work);
+ }
+
+ static const struct block_device_operations zram_devops = {
+@@ -776,6 +827,10 @@ static int create_device(struct zram *zram, int device_id)
+ init_rwsem(&zram->lock);
+ init_rwsem(&zram->init_lock);
+
++ INIT_WORK(&zram->free_work, zram_slot_free);
++ spin_lock_init(&zram->slot_free_lock);
++ zram->slot_free_rq = NULL;
++
+ zram->queue = blk_alloc_queue(GFP_KERNEL);
+ if (!zram->queue) {
+ pr_err("Error allocating disk queue for device %d\n",
+@@ -902,10 +957,12 @@ static void __exit zram_exit(void)
+ for (i = 0; i < num_devices; i++) {
+ zram = &zram_devices[i];
+
+- get_disk(zram->disk);
+ destroy_device(zram);
+- zram_reset_device(zram);
+- put_disk(zram->disk);
++ /*
++ * Shouldn't access zram->disk after destroy_device
++ * because destroy_device already released zram->disk.
++ */
++ zram_reset_device(zram, false);
+ }
+
+ unregister_blkdev(zram_major, "zram");
+diff --git a/drivers/staging/zram/zram_drv.h b/drivers/staging/zram/zram_drv.h
+index 9e57bfb2..97a3acf6 100644
+--- a/drivers/staging/zram/zram_drv.h
++++ b/drivers/staging/zram/zram_drv.h
+@@ -94,11 +94,20 @@ struct zram_meta {
+ struct zs_pool *mem_pool;
+ };
+
++struct zram_slot_free {
++ unsigned long index;
++ struct zram_slot_free *next;
++};
++
+ struct zram {
+ struct zram_meta *meta;
+ struct rw_semaphore lock; /* protect compression buffers, table,
+ * 32bit stat counters against concurrent
+ * notifications, reads and writes */
++
++ struct work_struct free_work; /* handle pending free request */
++ struct zram_slot_free *slot_free_rq; /* list head of free request */
++
+ struct request_queue *queue;
+ struct gendisk *disk;
+ int init_done;
+@@ -109,6 +118,7 @@ struct zram {
+ * we can store in a disk.
+ */
+ u64 disksize; /* bytes */
++ spinlock_t slot_free_lock;
+
+ struct zram_stats stats;
+ };
+diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
+index cbe48ab4..f608fbc1 100644
+--- a/drivers/target/target_core_alua.c
++++ b/drivers/target/target_core_alua.c
+@@ -730,7 +730,7 @@ static int core_alua_write_tpg_metadata(
+ if (ret < 0)
+ pr_err("Error writing ALUA metadata file: %s\n", path);
+ fput(file);
+- return ret ? -EIO : 0;
++ return (ret < 0) ? -EIO : 0;
+ }
+
+ /*
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index bd78faf6..adec5a82 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -1949,7 +1949,7 @@ static int __core_scsi3_write_aptpl_to_file(
+ pr_debug("Error writing APTPL metadata file: %s\n", path);
+ fput(file);
+
+- return ret ? -EIO : 0;
++ return (ret < 0) ? -EIO : 0;
+ }
+
+ /*
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 366af832..20689b95 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -850,7 +850,8 @@ void disassociate_ctty(int on_exit)
+ struct pid *tty_pgrp = tty_get_pgrp(tty);
+ if (tty_pgrp) {
+ kill_pgrp(tty_pgrp, SIGHUP, on_exit);
+- kill_pgrp(tty_pgrp, SIGCONT, on_exit);
++ if (!on_exit)
++ kill_pgrp(tty_pgrp, SIGCONT, on_exit);
+ put_pid(tty_pgrp);
+ }
+ }
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 8a230f0e..d3318a0d 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -209,6 +209,7 @@ skip_error:
+ static void wdm_int_callback(struct urb *urb)
+ {
+ int rv = 0;
++ int responding;
+ int status = urb->status;
+ struct wdm_device *desc;
+ struct usb_cdc_notification *dr;
+@@ -262,8 +263,8 @@ static void wdm_int_callback(struct urb *urb)
+
+ spin_lock(&desc->iuspin);
+ clear_bit(WDM_READ, &desc->flags);
+- set_bit(WDM_RESPONDING, &desc->flags);
+- if (!test_bit(WDM_DISCONNECTING, &desc->flags)
++ responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
++ if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags)
+ && !test_bit(WDM_SUSPENDING, &desc->flags)) {
+ rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+ dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
+@@ -685,16 +686,20 @@ static void wdm_rxwork(struct work_struct *work)
+ {
+ struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);
+ unsigned long flags;
+- int rv;
++ int rv = 0;
++ int responding;
+
+ spin_lock_irqsave(&desc->iuspin, flags);
+ if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+ } else {
++ responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+- rv = usb_submit_urb(desc->response, GFP_KERNEL);
++ if (!responding)
++ rv = usb_submit_urb(desc->response, GFP_KERNEL);
+ if (rv < 0 && rv != -EPERM) {
+ spin_lock_irqsave(&desc->iuspin, flags);
++ clear_bit(WDM_RESPONDING, &desc->flags);
+ if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+ schedule_work(&desc->rxwork);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 7199adcc..a6b2cabe 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -424,7 +424,8 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
+
+ memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+ if (config->desc.bDescriptorType != USB_DT_CONFIG ||
+- config->desc.bLength < USB_DT_CONFIG_SIZE) {
++ config->desc.bLength < USB_DT_CONFIG_SIZE ||
++ config->desc.bLength > size) {
+ dev_err(ddev, "invalid descriptor for config index %d: "
+ "type = 0x%X, length = %d\n", cfgidx,
+ config->desc.bDescriptorType, config->desc.bLength);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 558313de..17c37852 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2918,7 +2918,6 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ {
+ struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent);
+ struct usb_port *port_dev = hub->ports[udev->portnum - 1];
+- enum pm_qos_flags_status pm_qos_stat;
+ int port1 = udev->portnum;
+ int status;
+ bool really_suspend = true;
+@@ -2956,7 +2955,7 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ status);
+ /* bail if autosuspend is requested */
+ if (PMSG_IS_AUTO(msg))
+- return status;
++ goto err_wakeup;
+ }
+ }
+
+@@ -2965,14 +2964,16 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ usb_set_usb2_hardware_lpm(udev, 0);
+
+ if (usb_disable_ltm(udev)) {
+- dev_err(&udev->dev, "%s Failed to disable LTM before suspend\n.",
+- __func__);
+- return -ENOMEM;
++ dev_err(&udev->dev, "Failed to disable LTM before suspend\n.");
++ status = -ENOMEM;
++ if (PMSG_IS_AUTO(msg))
++ goto err_ltm;
+ }
+ if (usb_unlocked_disable_lpm(udev)) {
+- dev_err(&udev->dev, "%s Failed to disable LPM before suspend\n.",
+- __func__);
+- return -ENOMEM;
++ dev_err(&udev->dev, "Failed to disable LPM before suspend\n.");
++ status = -ENOMEM;
++ if (PMSG_IS_AUTO(msg))
++ goto err_lpm3;
+ }
+
+ /* see 7.1.7.6 */
+@@ -3000,28 +3001,31 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ if (status) {
+ dev_dbg(hub->intfdev, "can't suspend port %d, status %d\n",
+ port1, status);
+- /* paranoia: "should not happen" */
+- if (udev->do_remote_wakeup) {
+- if (!hub_is_superspeed(hub->hdev)) {
+- (void) usb_control_msg(udev,
+- usb_sndctrlpipe(udev, 0),
+- USB_REQ_CLEAR_FEATURE,
+- USB_RECIP_DEVICE,
+- USB_DEVICE_REMOTE_WAKEUP, 0,
+- NULL, 0,
+- USB_CTRL_SET_TIMEOUT);
+- } else
+- (void) usb_disable_function_remotewakeup(udev);
+-
+- }
+
++ /* Try to enable USB3 LPM and LTM again */
++ usb_unlocked_enable_lpm(udev);
++ err_lpm3:
++ usb_enable_ltm(udev);
++ err_ltm:
+ /* Try to enable USB2 hardware LPM again */
+ if (udev->usb2_hw_lpm_capable == 1)
+ usb_set_usb2_hardware_lpm(udev, 1);
+
+- /* Try to enable USB3 LTM and LPM again */
+- usb_enable_ltm(udev);
+- usb_unlocked_enable_lpm(udev);
++ if (udev->do_remote_wakeup) {
++ if (udev->speed < USB_SPEED_SUPER)
++ usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
++ USB_REQ_CLEAR_FEATURE,
++ USB_RECIP_DEVICE,
++ USB_DEVICE_REMOTE_WAKEUP, 0,
++ NULL, 0, USB_CTRL_SET_TIMEOUT);
++ else
++ usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
++ USB_REQ_CLEAR_FEATURE,
++ USB_RECIP_INTERFACE,
++ USB_INTRF_FUNC_SUSPEND, 0,
++ NULL, 0, USB_CTRL_SET_TIMEOUT);
++ }
++ err_wakeup:
+
+ /* System sleep transitions should never fail */
+ if (!PMSG_IS_AUTO(msg))
+@@ -3039,16 +3043,7 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ usb_set_device_state(udev, USB_STATE_SUSPENDED);
+ }
+
+- /*
+- * Check whether current status meets the requirement of
+- * usb port power off mechanism
+- */
+- pm_qos_stat = dev_pm_qos_flags(&port_dev->dev,
+- PM_QOS_FLAG_NO_POWER_OFF);
+- if (!udev->do_remote_wakeup
+- && pm_qos_stat != PM_QOS_FLAGS_ALL
+- && udev->persist_enabled
+- && !status) {
++ if (status == 0 && !udev->do_remote_wakeup && udev->persist_enabled) {
+ pm_runtime_put_sync(&port_dev->dev);
+ port_dev->did_runtime_put = true;
+ }
+diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c
+index d6b0fadf..99099116 100644
+--- a/drivers/usb/core/port.c
++++ b/drivers/usb/core/port.c
+@@ -89,22 +89,19 @@ static int usb_port_runtime_resume(struct device *dev)
+ retval = usb_hub_set_port_power(hdev, hub, port1, true);
+ if (port_dev->child && !retval) {
+ /*
+- * Wait for usb hub port to be reconnected in order to make
+- * the resume procedure successful.
++ * Attempt to wait for usb hub port to be reconnected in order
++ * to make the resume procedure successful. The device may have
++ * disconnected while the port was powered off, so ignore the
++ * return status.
+ */
+ retval = hub_port_debounce_be_connected(hub, port1);
+- if (retval < 0) {
++ if (retval < 0)
+ dev_dbg(&port_dev->dev, "can't get reconnection after setting port power on, status %d\n",
+ retval);
+- goto out;
+- }
+ usb_clear_port_feature(hdev, port1, USB_PORT_FEAT_C_ENABLE);
+-
+- /* Set return value to 0 if debounce successful */
+ retval = 0;
+ }
+
+-out:
+ clear_bit(port1, hub->busy_bits);
+ usb_autopm_put_interface(intf);
+ return retval;
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index f77083fe..14d28d61 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1508,6 +1508,15 @@ static int dwc3_gadget_start(struct usb_gadget *g,
+ int irq;
+ u32 reg;
+
++ irq = platform_get_irq(to_platform_device(dwc->dev), 0);
++ ret = request_threaded_irq(irq, dwc3_interrupt, dwc3_thread_interrupt,
++ IRQF_SHARED | IRQF_ONESHOT, "dwc3", dwc);
++ if (ret) {
++ dev_err(dwc->dev, "failed to request irq #%d --> %d\n",
++ irq, ret);
++ goto err0;
++ }
++
+ spin_lock_irqsave(&dwc->lock, flags);
+
+ if (dwc->gadget_driver) {
+@@ -1515,7 +1524,7 @@ static int dwc3_gadget_start(struct usb_gadget *g,
+ dwc->gadget.name,
+ dwc->gadget_driver->driver.name);
+ ret = -EBUSY;
+- goto err0;
++ goto err1;
+ }
+
+ dwc->gadget_driver = driver;
+@@ -1551,42 +1560,38 @@ static int dwc3_gadget_start(struct usb_gadget *g,
+ ret = __dwc3_gadget_ep_enable(dep, &dwc3_gadget_ep0_desc, NULL, false);
+ if (ret) {
+ dev_err(dwc->dev, "failed to enable %s\n", dep->name);
+- goto err0;
++ goto err2;
+ }
+
+ dep = dwc->eps[1];
+ ret = __dwc3_gadget_ep_enable(dep, &dwc3_gadget_ep0_desc, NULL, false);
+ if (ret) {
+ dev_err(dwc->dev, "failed to enable %s\n", dep->name);
+- goto err1;
++ goto err3;
+ }
+
+ /* begin to receive SETUP packets */
+ dwc->ep0state = EP0_SETUP_PHASE;
+ dwc3_ep0_out_start(dwc);
+
+- irq = platform_get_irq(to_platform_device(dwc->dev), 0);
+- ret = request_threaded_irq(irq, dwc3_interrupt, dwc3_thread_interrupt,
+- IRQF_SHARED | IRQF_ONESHOT, "dwc3", dwc);
+- if (ret) {
+- dev_err(dwc->dev, "failed to request irq #%d --> %d\n",
+- irq, ret);
+- goto err1;
+- }
+-
+ dwc3_gadget_enable_irq(dwc);
+
+ spin_unlock_irqrestore(&dwc->lock, flags);
+
+ return 0;
+
+-err1:
++err3:
+ __dwc3_gadget_ep_disable(dwc->eps[0]);
+
+-err0:
++err2:
+ dwc->gadget_driver = NULL;
++
++err1:
+ spin_unlock_irqrestore(&dwc->lock, flags);
+
++ free_irq(irq, dwc);
++
++err0:
+ return ret;
+ }
+
+@@ -1600,9 +1605,6 @@ static int dwc3_gadget_stop(struct usb_gadget *g,
+ spin_lock_irqsave(&dwc->lock, flags);
+
+ dwc3_gadget_disable_irq(dwc);
+- irq = platform_get_irq(to_platform_device(dwc->dev), 0);
+- free_irq(irq, dwc);
+-
+ __dwc3_gadget_ep_disable(dwc->eps[0]);
+ __dwc3_gadget_ep_disable(dwc->eps[1]);
+
+@@ -1610,6 +1612,9 @@ static int dwc3_gadget_stop(struct usb_gadget *g,
+
+ spin_unlock_irqrestore(&dwc->lock, flags);
+
++ irq = platform_get_irq(to_platform_device(dwc->dev), 0);
++ free_irq(irq, dwc);
++
+ return 0;
+ }
+
+diff --git a/drivers/usb/gadget/uvc_queue.c b/drivers/usb/gadget/uvc_queue.c
+index e6170478..0bb5d500 100644
+--- a/drivers/usb/gadget/uvc_queue.c
++++ b/drivers/usb/gadget/uvc_queue.c
+@@ -193,12 +193,16 @@ static int uvc_queue_buffer(struct uvc_video_queue *queue,
+
+ mutex_lock(&queue->mutex);
+ ret = vb2_qbuf(&queue->queue, buf);
++ if (ret < 0)
++ goto done;
++
+ spin_lock_irqsave(&queue->irqlock, flags);
+ ret = (queue->flags & UVC_QUEUE_PAUSED) != 0;
+ queue->flags &= ~UVC_QUEUE_PAUSED;
+ spin_unlock_irqrestore(&queue->irqlock, flags);
+- mutex_unlock(&queue->mutex);
+
++done:
++ mutex_unlock(&queue->mutex);
+ return ret;
+ }
+
+diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
+index e4c34ac3..4c166e1e 100644
+--- a/drivers/usb/host/ehci-mxc.c
++++ b/drivers/usb/host/ehci-mxc.c
+@@ -184,7 +184,7 @@ static int ehci_mxc_drv_remove(struct platform_device *pdev)
+ if (pdata && pdata->exit)
+ pdata->exit(pdev);
+
+- if (pdata->otg)
++ if (pdata && pdata->otg)
+ usb_phy_shutdown(pdata->otg);
+
+ clk_disable_unprepare(priv->usbclk);
+diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
+index 279b0491..ec337c2b 100644
+--- a/drivers/usb/host/ohci-pci.c
++++ b/drivers/usb/host/ohci-pci.c
+@@ -289,7 +289,7 @@ static struct pci_driver ohci_pci_driver = {
+ .remove = usb_hcd_pci_remove,
+ .shutdown = usb_hcd_pci_shutdown,
+
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_PM
+ .driver = {
+ .pm = &usb_hcd_pci_pm_ops
+ },
+diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h
+index 8d7a1324..9fe3225e 100644
+--- a/drivers/usb/host/xhci-ext-caps.h
++++ b/drivers/usb/host/xhci-ext-caps.h
+@@ -71,7 +71,7 @@
+
+ /* USB 2.0 xHCI 1.0 hardware LMP capability - section 7.2.2.1.3.2 */
+ #define XHCI_HLC (1 << 19)
+-#define XHCI_BLC (1 << 19)
++#define XHCI_BLC (1 << 20)
+
+ /* command register values to disable interrupts and halt the HC */
+ /* start/stop HC execution - do not write unless HC is halted*/
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 51e22bf8..6eca5a53 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -24,7 +24,7 @@ static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci)
+ * here that the generic code does not try to make a pci_dev from our
+ * dev struct in order to setup MSI
+ */
+- xhci->quirks |= XHCI_BROKEN_MSI;
++ xhci->quirks |= XHCI_PLAT;
+ }
+
+ /* called during probe() after chip reset completes */
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 9478caa2..b3c4162c 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -343,9 +343,14 @@ static void __maybe_unused xhci_msix_sync_irqs(struct xhci_hcd *xhci)
+ static int xhci_try_enable_msi(struct usb_hcd *hcd)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+- struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
++ struct pci_dev *pdev;
+ int ret;
+
++ /* The xhci platform device has set up IRQs through usb_add_hcd. */
++ if (xhci->quirks & XHCI_PLAT)
++ return 0;
++
++ pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+ /*
+ * Some Fresco Logic host controllers advertise MSI, but fail to
+ * generate interrupts. Don't even try to enable MSI.
+@@ -3581,10 +3586,21 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct xhci_virt_device *virt_dev;
++ struct device *dev = hcd->self.controller;
+ unsigned long flags;
+ u32 state;
+ int i, ret;
+
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++ /*
++ * We called pm_runtime_get_noresume when the device was attached.
++ * Decrement the counter here to allow controller to runtime suspend
++ * if no devices remain.
++ */
++ if (xhci->quirks & XHCI_RESET_ON_RESUME)
++ pm_runtime_put_noidle(dev);
++#endif
++
+ ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
+ /* If the host is halted due to driver unload, we still need to free the
+ * device.
+@@ -3656,6 +3672,7 @@ static int xhci_reserve_host_control_ep_resources(struct xhci_hcd *xhci)
+ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++ struct device *dev = hcd->self.controller;
+ unsigned long flags;
+ int timeleft;
+ int ret;
+@@ -3708,6 +3725,16 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ goto disable_slot;
+ }
+ udev->slot_id = xhci->slot_id;
++
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++ /*
++ * If resetting upon resume, we can't put the controller into runtime
++ * suspend if there is a device attached.
++ */
++ if (xhci->quirks & XHCI_RESET_ON_RESUME)
++ pm_runtime_get_noresume(dev);
++#endif
++
+ /* Is this a LS or FS device under a HS hub? */
+ /* Hub or peripherial? */
+ return 1;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index c338741a..6ab1e600 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1542,6 +1542,7 @@ struct xhci_hcd {
+ #define XHCI_SPURIOUS_REBOOT (1 << 13)
+ #define XHCI_COMP_MODE_QUIRK (1 << 14)
+ #define XHCI_AVOID_BEI (1 << 15)
++#define XHCI_PLAT (1 << 16)
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+ /* There are two roothubs to keep track of bus suspend info for */
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index b0130016..84657e07 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -374,7 +374,7 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ kfree(urbtrack);
+ return -ENOMEM;
+ }
+- urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
++ urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_ATOMIC);
+ if (!urbtrack->setup) {
+ usb_free_urb(urbtrack->urb);
+ kfree(urbtrack);
+@@ -382,8 +382,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ }
+ urbtrack->setup->bRequestType = (__u8)0x40;
+ urbtrack->setup->bRequest = (__u8)0x0e;
+- urbtrack->setup->wValue = get_reg_value(reg, dummy);
+- urbtrack->setup->wIndex = get_reg_index(reg);
++ urbtrack->setup->wValue = cpu_to_le16(get_reg_value(reg, dummy));
++ urbtrack->setup->wIndex = cpu_to_le16(get_reg_index(reg));
+ urbtrack->setup->wLength = 0;
+ usb_fill_control_urb(urbtrack->urb, usbdev,
+ usb_sndctrlpipe(usbdev, 0),
+diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
+index 04cdeb8e..c4d22988 100644
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -730,9 +730,18 @@ void gnttab_request_free_callback(struct gnttab_free_callback *callback,
+ void (*fn)(void *), void *arg, u16 count)
+ {
+ unsigned long flags;
++ struct gnttab_free_callback *cb;
++
+ spin_lock_irqsave(&gnttab_list_lock, flags);
+- if (callback->next)
+- goto out;
++
++ /* Check if the callback is already on the list */
++ cb = gnttab_free_callback_list;
++ while (cb) {
++ if (cb == callback)
++ goto out;
++ cb = cb->next;
++ }
++
+ callback->fn = fn;
+ callback->arg = arg;
+ callback->count = count;
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 238a0554..9877a2a2 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -3312,6 +3312,9 @@ static long btrfs_ioctl_dev_replace(struct btrfs_root *root, void __user *arg)
+
+ switch (p->cmd) {
+ case BTRFS_IOCTL_DEV_REPLACE_CMD_START:
++ if (root->fs_info->sb->s_flags & MS_RDONLY)
++ return -EROFS;
++
+ if (atomic_xchg(
+ &root->fs_info->mutually_exclusive_operation_running,
+ 1)) {
+diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
+index e0b4ef31..a5ce62eb 100644
+--- a/fs/ceph/ioctl.c
++++ b/fs/ceph/ioctl.c
+@@ -196,8 +196,10 @@ static long ceph_ioctl_get_dataloc(struct file *file, void __user *arg)
+ r = ceph_calc_file_object_mapping(&ci->i_layout, dl.file_offset, len,
+ &dl.object_no, &dl.object_offset,
+ &olen);
+- if (r < 0)
++ if (r < 0) {
++ up_read(&osdc->map_sem);
+ return -EIO;
++ }
+ dl.file_offset -= dl.object_offset;
+ dl.object_size = ceph_file_layout_object_size(ci->i_layout);
+ dl.block_size = ceph_file_layout_su(ci->i_layout);
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index d67c550c..37950c65 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -379,6 +379,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ try_to_freeze();
+
+ /* we should try only the port we connected to before */
++ mutex_lock(&server->srv_mutex);
+ rc = generic_ip_connect(server);
+ if (rc) {
+ cifs_dbg(FYI, "reconnect error %d\n", rc);
+@@ -390,6 +391,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ server->tcpStatus = CifsNeedNegotiate;
+ spin_unlock(&GlobalMid_Lock);
+ }
++ mutex_unlock(&server->srv_mutex);
+ } while (server->tcpStatus == CifsNeedReconnect);
+
+ return rc;
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index b0c43345..f851d03f 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -417,96 +417,108 @@ cifs_ses_oplock_break(struct work_struct *work)
+ }
+
+ static bool
+-smb2_is_valid_lease_break(char *buffer, struct TCP_Server_Info *server)
++smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
++ struct smb2_lease_break_work *lw)
+ {
+- struct smb2_lease_break *rsp = (struct smb2_lease_break *)buffer;
+- struct list_head *tmp, *tmp1, *tmp2;
+- struct cifs_ses *ses;
+- struct cifs_tcon *tcon;
+- struct cifsInodeInfo *cinode;
++ bool found;
++ __u8 lease_state;
++ struct list_head *tmp;
+ struct cifsFileInfo *cfile;
+ struct cifs_pending_open *open;
+- struct smb2_lease_break_work *lw;
+- bool found;
++ struct cifsInodeInfo *cinode;
+ int ack_req = le32_to_cpu(rsp->Flags &
+ SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED);
+
+- lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
+- if (!lw)
+- return false;
++ lease_state = smb2_map_lease_to_oplock(rsp->NewLeaseState);
+
+- INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
+- lw->lease_state = rsp->NewLeaseState;
++ list_for_each(tmp, &tcon->openFileList) {
++ cfile = list_entry(tmp, struct cifsFileInfo, tlist);
++ cinode = CIFS_I(cfile->dentry->d_inode);
+
+- cifs_dbg(FYI, "Checking for lease break\n");
++ if (memcmp(cinode->lease_key, rsp->LeaseKey,
++ SMB2_LEASE_KEY_SIZE))
++ continue;
+
+- /* look up tcon based on tid & uid */
+- spin_lock(&cifs_tcp_ses_lock);
+- list_for_each(tmp, &server->smb_ses_list) {
+- ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
++ cifs_dbg(FYI, "found in the open list\n");
++ cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
++ le32_to_cpu(rsp->NewLeaseState));
+
+- spin_lock(&cifs_file_list_lock);
+- list_for_each(tmp1, &ses->tcon_list) {
+- tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
++ smb2_set_oplock_level(cinode, lease_state);
+
+- cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks);
+- list_for_each(tmp2, &tcon->openFileList) {
+- cfile = list_entry(tmp2, struct cifsFileInfo,
+- tlist);
+- cinode = CIFS_I(cfile->dentry->d_inode);
++ if (ack_req)
++ cfile->oplock_break_cancelled = false;
++ else
++ cfile->oplock_break_cancelled = true;
+
+- if (memcmp(cinode->lease_key, rsp->LeaseKey,
+- SMB2_LEASE_KEY_SIZE))
+- continue;
++ queue_work(cifsiod_wq, &cfile->oplock_break);
++ kfree(lw);
++ return true;
++ }
+
+- cifs_dbg(FYI, "found in the open list\n");
+- cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
+- le32_to_cpu(rsp->NewLeaseState));
++ found = false;
++ list_for_each_entry(open, &tcon->pending_opens, olist) {
++ if (memcmp(open->lease_key, rsp->LeaseKey,
++ SMB2_LEASE_KEY_SIZE))
++ continue;
++
++ if (!found && ack_req) {
++ found = true;
++ memcpy(lw->lease_key, open->lease_key,
++ SMB2_LEASE_KEY_SIZE);
++ lw->tlink = cifs_get_tlink(open->tlink);
++ queue_work(cifsiod_wq, &lw->lease_break);
++ }
+
+- smb2_set_oplock_level(cinode,
+- smb2_map_lease_to_oplock(rsp->NewLeaseState));
++ cifs_dbg(FYI, "found in the pending open list\n");
++ cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
++ le32_to_cpu(rsp->NewLeaseState));
+
+- if (ack_req)
+- cfile->oplock_break_cancelled = false;
+- else
+- cfile->oplock_break_cancelled = true;
++ open->oplock = lease_state;
++ }
++ return found;
++}
+
+- queue_work(cifsiod_wq, &cfile->oplock_break);
++static bool
++smb2_is_valid_lease_break(char *buffer)
++{
++ struct smb2_lease_break *rsp = (struct smb2_lease_break *)buffer;
++ struct list_head *tmp, *tmp1, *tmp2;
++ struct TCP_Server_Info *server;
++ struct cifs_ses *ses;
++ struct cifs_tcon *tcon;
++ struct smb2_lease_break_work *lw;
+
+- spin_unlock(&cifs_file_list_lock);
+- spin_unlock(&cifs_tcp_ses_lock);
+- return true;
+- }
++ lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
++ if (!lw)
++ return false;
+
+- found = false;
+- list_for_each_entry(open, &tcon->pending_opens, olist) {
+- if (memcmp(open->lease_key, rsp->LeaseKey,
+- SMB2_LEASE_KEY_SIZE))
+- continue;
++ INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
++ lw->lease_state = rsp->NewLeaseState;
+
+- if (!found && ack_req) {
+- found = true;
+- memcpy(lw->lease_key, open->lease_key,
+- SMB2_LEASE_KEY_SIZE);
+- lw->tlink = cifs_get_tlink(open->tlink);
+- queue_work(cifsiod_wq,
+- &lw->lease_break);
+- }
++ cifs_dbg(FYI, "Checking for lease break\n");
++
++ /* look up tcon based on tid & uid */
++ spin_lock(&cifs_tcp_ses_lock);
++ list_for_each(tmp, &cifs_tcp_ses_list) {
++ server = list_entry(tmp, struct TCP_Server_Info, tcp_ses_list);
+
+- cifs_dbg(FYI, "found in the pending open list\n");
+- cifs_dbg(FYI, "lease key match, lease break 0x%d\n",
+- le32_to_cpu(rsp->NewLeaseState));
++ list_for_each(tmp1, &server->smb_ses_list) {
++ ses = list_entry(tmp1, struct cifs_ses, smb_ses_list);
+
+- open->oplock =
+- smb2_map_lease_to_oplock(rsp->NewLeaseState);
+- }
+- if (found) {
+- spin_unlock(&cifs_file_list_lock);
+- spin_unlock(&cifs_tcp_ses_lock);
+- return true;
++ spin_lock(&cifs_file_list_lock);
++ list_for_each(tmp2, &ses->tcon_list) {
++ tcon = list_entry(tmp2, struct cifs_tcon,
++ tcon_list);
++ cifs_stats_inc(
++ &tcon->stats.cifs_stats.num_oplock_brks);
++ if (smb2_tcon_has_lease(tcon, rsp, lw)) {
++ spin_unlock(&cifs_file_list_lock);
++ spin_unlock(&cifs_tcp_ses_lock);
++ return true;
++ }
+ }
++ spin_unlock(&cifs_file_list_lock);
+ }
+- spin_unlock(&cifs_file_list_lock);
+ }
+ spin_unlock(&cifs_tcp_ses_lock);
+ kfree(lw);
+@@ -532,7 +544,7 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ if (rsp->StructureSize !=
+ smb2_rsp_struct_sizes[SMB2_OPLOCK_BREAK_HE]) {
+ if (le16_to_cpu(rsp->StructureSize) == 44)
+- return smb2_is_valid_lease_break(buffer, server);
++ return smb2_is_valid_lease_break(buffer);
+ else
+ return false;
+ }
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index c2ca04e6..ea4d1884 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1890,6 +1890,26 @@ static int ext4_writepage(struct page *page,
+ return ret;
+ }
+
++static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page)
++{
++ int len;
++ loff_t size = i_size_read(mpd->inode);
++ int err;
++
++ BUG_ON(page->index != mpd->first_page);
++ if (page->index == size >> PAGE_CACHE_SHIFT)
++ len = size & ~PAGE_CACHE_MASK;
++ else
++ len = PAGE_CACHE_SIZE;
++ clear_page_dirty_for_io(page);
++ err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc);
++ if (!err)
++ mpd->wbc->nr_to_write--;
++ mpd->first_page++;
++
++ return err;
++}
++
+ #define BH_FLAGS ((1 << BH_Unwritten) | (1 << BH_Delay))
+
+ /*
+@@ -1904,82 +1924,94 @@ static int ext4_writepage(struct page *page,
+ *
+ * @mpd - extent of blocks
+ * @lblk - logical number of the block in the file
+- * @b_state - b_state of the buffer head added
++ * @bh - buffer head we want to add to the extent
+ *
+- * the function is used to collect contig. blocks in same state
++ * The function is used to collect contig. blocks in the same state. If the
++ * buffer doesn't require mapping for writeback and we haven't started the
++ * extent of buffers to map yet, the function returns 'true' immediately - the
++ * caller can write the buffer right away. Otherwise the function returns true
++ * if the block has been added to the extent, false if the block couldn't be
++ * added.
+ */
+-static int mpage_add_bh_to_extent(struct mpage_da_data *mpd, ext4_lblk_t lblk,
+- unsigned long b_state)
++static bool mpage_add_bh_to_extent(struct mpage_da_data *mpd, ext4_lblk_t lblk,
++ struct buffer_head *bh)
+ {
+ struct ext4_map_blocks *map = &mpd->map;
+
+- /* Don't go larger than mballoc is willing to allocate */
+- if (map->m_len >= MAX_WRITEPAGES_EXTENT_LEN)
+- return 0;
++ /* Buffer that doesn't need mapping for writeback? */
++ if (!buffer_dirty(bh) || !buffer_mapped(bh) ||
++ (!buffer_delay(bh) && !buffer_unwritten(bh))) {
++ /* So far no extent to map => we write the buffer right away */
++ if (map->m_len == 0)
++ return true;
++ return false;
++ }
+
+ /* First block in the extent? */
+ if (map->m_len == 0) {
+ map->m_lblk = lblk;
+ map->m_len = 1;
+- map->m_flags = b_state & BH_FLAGS;
+- return 1;
++ map->m_flags = bh->b_state & BH_FLAGS;
++ return true;
+ }
+
++ /* Don't go larger than mballoc is willing to allocate */
++ if (map->m_len >= MAX_WRITEPAGES_EXTENT_LEN)
++ return false;
++
+ /* Can we merge the block to our big extent? */
+ if (lblk == map->m_lblk + map->m_len &&
+- (b_state & BH_FLAGS) == map->m_flags) {
++ (bh->b_state & BH_FLAGS) == map->m_flags) {
+ map->m_len++;
+- return 1;
++ return true;
+ }
+- return 0;
++ return false;
+ }
+
+-static bool add_page_bufs_to_extent(struct mpage_da_data *mpd,
+- struct buffer_head *head,
+- struct buffer_head *bh,
+- ext4_lblk_t lblk)
++/*
++ * mpage_process_page_bufs - submit page buffers for IO or add them to extent
++ *
++ * @mpd - extent of blocks for mapping
++ * @head - the first buffer in the page
++ * @bh - buffer we should start processing from
++ * @lblk - logical number of the block in the file corresponding to @bh
++ *
++ * Walk through page buffers from @bh upto @head (exclusive) and either submit
++ * the page for IO if all buffers in this page were mapped and there's no
++ * accumulated extent of buffers to map or add buffers in the page to the
++ * extent of buffers to map. The function returns 1 if the caller can continue
++ * by processing the next page, 0 if it should stop adding buffers to the
++ * extent to map because we cannot extend it anymore. It can also return value
++ * < 0 in case of error during IO submission.
++ */
++static int mpage_process_page_bufs(struct mpage_da_data *mpd,
++ struct buffer_head *head,
++ struct buffer_head *bh,
++ ext4_lblk_t lblk)
+ {
+ struct inode *inode = mpd->inode;
++ int err;
+ ext4_lblk_t blocks = (i_size_read(inode) + (1 << inode->i_blkbits) - 1)
+ >> inode->i_blkbits;
+
+ do {
+ BUG_ON(buffer_locked(bh));
+
+- if (!buffer_dirty(bh) || !buffer_mapped(bh) ||
+- (!buffer_delay(bh) && !buffer_unwritten(bh)) ||
+- lblk >= blocks) {
++ if (lblk >= blocks || !mpage_add_bh_to_extent(mpd, lblk, bh)) {
+ /* Found extent to map? */
+ if (mpd->map.m_len)
+- return false;
+- if (lblk >= blocks)
+- return true;
+- continue;
++ return 0;
++ /* Everything mapped so far and we hit EOF */
++ break;
+ }
+- if (!mpage_add_bh_to_extent(mpd, lblk, bh->b_state))
+- return false;
+ } while (lblk++, (bh = bh->b_this_page) != head);
+- return true;
+-}
+-
+-static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page)
+-{
+- int len;
+- loff_t size = i_size_read(mpd->inode);
+- int err;
+-
+- BUG_ON(page->index != mpd->first_page);
+- if (page->index == size >> PAGE_CACHE_SHIFT)
+- len = size & ~PAGE_CACHE_MASK;
+- else
+- len = PAGE_CACHE_SIZE;
+- clear_page_dirty_for_io(page);
+- err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc);
+- if (!err)
+- mpd->wbc->nr_to_write--;
+- mpd->first_page++;
+-
+- return err;
++ /* So far everything mapped? Submit the page for IO. */
++ if (mpd->map.m_len == 0) {
++ err = mpage_submit_page(mpd, head->b_page);
++ if (err < 0)
++ return err;
++ }
++ return lblk < blocks;
+ }
+
+ /*
+@@ -2003,8 +2035,6 @@ static int mpage_map_and_submit_buffers(struct mpage_da_data *mpd)
+ struct inode *inode = mpd->inode;
+ struct buffer_head *head, *bh;
+ int bpp_bits = PAGE_CACHE_SHIFT - inode->i_blkbits;
+- ext4_lblk_t blocks = (i_size_read(inode) + (1 << inode->i_blkbits) - 1)
+- >> inode->i_blkbits;
+ pgoff_t start, end;
+ ext4_lblk_t lblk;
+ sector_t pblock;
+@@ -2039,18 +2069,26 @@ static int mpage_map_and_submit_buffers(struct mpage_da_data *mpd)
+ */
+ mpd->map.m_len = 0;
+ mpd->map.m_flags = 0;
+- add_page_bufs_to_extent(mpd, head, bh,
+- lblk);
++ /*
++ * FIXME: If dioread_nolock supports
++ * blocksize < pagesize, we need to make
++ * sure we add size mapped so far to
++ * io_end->size as the following call
++ * can submit the page for IO.
++ */
++ err = mpage_process_page_bufs(mpd, head,
++ bh, lblk);
+ pagevec_release(&pvec);
+- return 0;
++ if (err > 0)
++ err = 0;
++ return err;
+ }
+ if (buffer_delay(bh)) {
+ clear_buffer_delay(bh);
+ bh->b_blocknr = pblock++;
+ }
+ clear_buffer_unwritten(bh);
+- } while (++lblk < blocks &&
+- (bh = bh->b_this_page) != head);
++ } while (lblk++, (bh = bh->b_this_page) != head);
+
+ /*
+ * FIXME: This is going to break if dioread_nolock
+@@ -2319,14 +2357,10 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd)
+ lblk = ((ext4_lblk_t)page->index) <<
+ (PAGE_CACHE_SHIFT - blkbits);
+ head = page_buffers(page);
+- if (!add_page_bufs_to_extent(mpd, head, head, lblk))
++ err = mpage_process_page_bufs(mpd, head, head, lblk);
++ if (err <= 0)
+ goto out;
+- /* So far everything mapped? Submit the page for IO. */
+- if (mpd->map.m_len == 0) {
+- err = mpage_submit_page(mpd, page);
+- if (err < 0)
+- goto out;
+- }
++ err = 0;
+
+ /*
+ * Accumulated enough dirty pages? This doesn't apply
+@@ -4566,7 +4600,9 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ ext4_journal_stop(handle);
+ }
+
+- if (attr->ia_valid & ATTR_SIZE) {
++ if (attr->ia_valid & ATTR_SIZE && attr->ia_size != inode->i_size) {
++ handle_t *handle;
++ loff_t oldsize = inode->i_size;
+
+ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+@@ -4574,73 +4610,60 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ if (attr->ia_size > sbi->s_bitmap_maxbytes)
+ return -EFBIG;
+ }
+- }
+-
+- if (S_ISREG(inode->i_mode) &&
+- attr->ia_valid & ATTR_SIZE &&
+- (attr->ia_size < inode->i_size)) {
+- handle_t *handle;
+-
+- handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
+- if (IS_ERR(handle)) {
+- error = PTR_ERR(handle);
+- goto err_out;
+- }
+- if (ext4_handle_valid(handle)) {
+- error = ext4_orphan_add(handle, inode);
+- orphan = 1;
+- }
+- EXT4_I(inode)->i_disksize = attr->ia_size;
+- rc = ext4_mark_inode_dirty(handle, inode);
+- if (!error)
+- error = rc;
+- ext4_journal_stop(handle);
+-
+- if (ext4_should_order_data(inode)) {
+- error = ext4_begin_ordered_truncate(inode,
++ if (S_ISREG(inode->i_mode) &&
++ (attr->ia_size < inode->i_size)) {
++ if (ext4_should_order_data(inode)) {
++ error = ext4_begin_ordered_truncate(inode,
+ attr->ia_size);
+- if (error) {
+- /* Do as much error cleanup as possible */
+- handle = ext4_journal_start(inode,
+- EXT4_HT_INODE, 3);
+- if (IS_ERR(handle)) {
+- ext4_orphan_del(NULL, inode);
++ if (error)
+ goto err_out;
+- }
+- ext4_orphan_del(handle, inode);
+- orphan = 0;
+- ext4_journal_stop(handle);
++ }
++ handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
++ if (IS_ERR(handle)) {
++ error = PTR_ERR(handle);
++ goto err_out;
++ }
++ if (ext4_handle_valid(handle)) {
++ error = ext4_orphan_add(handle, inode);
++ orphan = 1;
++ }
++ EXT4_I(inode)->i_disksize = attr->ia_size;
++ rc = ext4_mark_inode_dirty(handle, inode);
++ if (!error)
++ error = rc;
++ ext4_journal_stop(handle);
++ if (error) {
++ ext4_orphan_del(NULL, inode);
+ goto err_out;
+ }
+ }
+- }
+-
+- if (attr->ia_valid & ATTR_SIZE) {
+- if (attr->ia_size != inode->i_size) {
+- loff_t oldsize = inode->i_size;
+
+- i_size_write(inode, attr->ia_size);
+- /*
+- * Blocks are going to be removed from the inode. Wait
+- * for dio in flight. Temporarily disable
+- * dioread_nolock to prevent livelock.
+- */
+- if (orphan) {
+- if (!ext4_should_journal_data(inode)) {
+- ext4_inode_block_unlocked_dio(inode);
+- inode_dio_wait(inode);
+- ext4_inode_resume_unlocked_dio(inode);
+- } else
+- ext4_wait_for_tail_page_commit(inode);
+- }
+- /*
+- * Truncate pagecache after we've waited for commit
+- * in data=journal mode to make pages freeable.
+- */
+- truncate_pagecache(inode, oldsize, inode->i_size);
++ i_size_write(inode, attr->ia_size);
++ /*
++ * Blocks are going to be removed from the inode. Wait
++ * for dio in flight. Temporarily disable
++ * dioread_nolock to prevent livelock.
++ */
++ if (orphan) {
++ if (!ext4_should_journal_data(inode)) {
++ ext4_inode_block_unlocked_dio(inode);
++ inode_dio_wait(inode);
++ ext4_inode_resume_unlocked_dio(inode);
++ } else
++ ext4_wait_for_tail_page_commit(inode);
+ }
+- ext4_truncate(inode);
++ /*
++ * Truncate pagecache after we've waited for commit
++ * in data=journal mode to make pages freeable.
++ */
++ truncate_pagecache(inode, oldsize, inode->i_size);
+ }
++ /*
++ * We want to call ext4_truncate() even if attr->ia_size ==
++ * inode->i_size for cases like truncation of fallocated space
++ */
++ if (attr->ia_valid & ATTR_SIZE)
++ ext4_truncate(inode);
+
+ if (!rc) {
+ setattr_copy(inode, attr);
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 72a5d5b0..8fec28ff 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1174,6 +1174,8 @@ static int parse_dirfile(char *buf, size_t nbytes, struct file *file,
+ return -EIO;
+ if (reclen > nbytes)
+ break;
++ if (memchr(dirent->name, '/', dirent->namelen) != NULL)
++ return -EIO;
+
+ if (!dir_emit(ctx, dirent->name, dirent->namelen,
+ dirent->ino, dirent->type))
+@@ -1320,6 +1322,8 @@ static int parse_dirplusfile(char *buf, size_t nbytes, struct file *file,
+ return -EIO;
+ if (reclen > nbytes)
+ break;
++ if (memchr(dirent->name, '/', dirent->namelen) != NULL)
++ return -EIO;
+
+ if (!over) {
+ /* We fill entries into dstbuf only as much as
+@@ -1590,6 +1594,7 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
+ struct file *file)
+ {
+ struct fuse_conn *fc = get_fuse_conn(inode);
++ struct fuse_inode *fi = get_fuse_inode(inode);
+ struct fuse_req *req;
+ struct fuse_setattr_in inarg;
+ struct fuse_attr_out outarg;
+@@ -1617,8 +1622,10 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
+ if (IS_ERR(req))
+ return PTR_ERR(req);
+
+- if (is_truncate)
++ if (is_truncate) {
+ fuse_set_nowrite(inode);
++ set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
++ }
+
+ memset(&inarg, 0, sizeof(inarg));
+ memset(&outarg, 0, sizeof(outarg));
+@@ -1680,12 +1687,14 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
+ invalidate_inode_pages2(inode->i_mapping);
+ }
+
++ clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ return 0;
+
+ error:
+ if (is_truncate)
+ fuse_release_nowrite(inode);
+
++ clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ return err;
+ }
+
+@@ -1749,6 +1758,8 @@ static int fuse_setxattr(struct dentry *entry, const char *name,
+ fc->no_setxattr = 1;
+ err = -EOPNOTSUPP;
+ }
++ if (!err)
++ fuse_invalidate_attr(inode);
+ return err;
+ }
+
+@@ -1878,6 +1889,8 @@ static int fuse_removexattr(struct dentry *entry, const char *name)
+ fc->no_removexattr = 1;
+ err = -EOPNOTSUPP;
+ }
++ if (!err)
++ fuse_invalidate_attr(inode);
+ return err;
+ }
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 5c121fe1..d409deaf 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -629,7 +629,8 @@ static void fuse_read_update_size(struct inode *inode, loff_t size,
+ struct fuse_inode *fi = get_fuse_inode(inode);
+
+ spin_lock(&fc->lock);
+- if (attr_ver == fi->attr_version && size < inode->i_size) {
++ if (attr_ver == fi->attr_version && size < inode->i_size &&
++ !test_bit(FUSE_I_SIZE_UNSTABLE, &fi->state)) {
+ fi->attr_version = ++fc->attr_version;
+ i_size_write(inode, size);
+ }
+@@ -1032,12 +1033,16 @@ static ssize_t fuse_perform_write(struct file *file,
+ {
+ struct inode *inode = mapping->host;
+ struct fuse_conn *fc = get_fuse_conn(inode);
++ struct fuse_inode *fi = get_fuse_inode(inode);
+ int err = 0;
+ ssize_t res = 0;
+
+ if (is_bad_inode(inode))
+ return -EIO;
+
++ if (inode->i_size < pos + iov_iter_count(ii))
++ set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
++
+ do {
+ struct fuse_req *req;
+ ssize_t count;
+@@ -1073,6 +1078,7 @@ static ssize_t fuse_perform_write(struct file *file,
+ if (res > 0)
+ fuse_write_update_size(inode, pos);
+
++ clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+ fuse_invalidate_attr(inode);
+
+ return res > 0 ? res : err;
+@@ -1529,7 +1535,6 @@ static int fuse_writepage_locked(struct page *page)
+
+ inc_bdi_stat(mapping->backing_dev_info, BDI_WRITEBACK);
+ inc_zone_page_state(tmp_page, NR_WRITEBACK_TEMP);
+- end_page_writeback(page);
+
+ spin_lock(&fc->lock);
+ list_add(&req->writepages_entry, &fi->writepages);
+@@ -1537,6 +1542,8 @@ static int fuse_writepage_locked(struct page *page)
+ fuse_flush_writepages(inode);
+ spin_unlock(&fc->lock);
+
++ end_page_writeback(page);
++
+ return 0;
+
+ err_free:
+diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
+index fde7249a..5ced199b 100644
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -115,6 +115,8 @@ struct fuse_inode {
+ enum {
+ /** Advise readdirplus */
+ FUSE_I_ADVISE_RDPLUS,
++ /** An operation changing file size is in progress */
++ FUSE_I_SIZE_UNSTABLE,
+ };
+
+ struct fuse_conn;
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index 0b578598..e0fe703e 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -201,7 +201,8 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,
+ struct timespec old_mtime;
+
+ spin_lock(&fc->lock);
+- if (attr_version != 0 && fi->attr_version > attr_version) {
++ if ((attr_version != 0 && fi->attr_version > attr_version) ||
++ test_bit(FUSE_I_SIZE_UNSTABLE, &fi->state)) {
+ spin_unlock(&fc->lock);
+ return;
+ }
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index c348d6d8..e5d408a7 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -117,8 +117,8 @@ static void destroy_inodecache(void)
+
+ static int isofs_remount(struct super_block *sb, int *flags, char *data)
+ {
+- /* we probably want a lot more here */
+- *flags |= MS_RDONLY;
++ if (!(*flags & MS_RDONLY))
++ return -EROFS;
+ return 0;
+ }
+
+@@ -763,15 +763,6 @@ root_found:
+ */
+ s->s_maxbytes = 0x80000000000LL;
+
+- /*
+- * The CDROM is read-only, has no nodes (devices) on it, and since
+- * all of the files appear to be owned by root, we really do not want
+- * to allow suid. (suid or devices will not show up unless we have
+- * Rock Ridge extensions)
+- */
+-
+- s->s_flags |= MS_RDONLY /* | MS_NODEV | MS_NOSUID */;
+-
+ /* Set this for reference. Its not currently used except on write
+ which we don't have .. */
+
+@@ -1530,6 +1521,9 @@ struct inode *isofs_iget(struct super_block *sb,
+ static struct dentry *isofs_mount(struct file_system_type *fs_type,
+ int flags, const char *dev_name, void *data)
+ {
++ /* We don't support read-write mounts */
++ if (!(flags & MS_RDONLY))
++ return ERR_PTR(-EACCES);
+ return mount_bdev(fs_type, flags, dev_name, data, isofs_fill_super);
+ }
+
+diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
+index 2487116d..84606472 100644
+--- a/fs/ocfs2/extent_map.c
++++ b/fs/ocfs2/extent_map.c
+@@ -781,7 +781,6 @@ int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ cpos = map_start >> osb->s_clustersize_bits;
+ mapping_end = ocfs2_clusters_for_bytes(inode->i_sb,
+ map_start + map_len);
+- mapping_end -= cpos;
+ is_last = 0;
+ while (cpos < mapping_end && !is_last) {
+ u32 fe_flags;
+diff --git a/fs/proc/root.c b/fs/proc/root.c
+index e0a790da..0e0e83c4 100644
+--- a/fs/proc/root.c
++++ b/fs/proc/root.c
+@@ -110,7 +110,8 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
+ ns = task_active_pid_ns(current);
+ options = data;
+
+- if (!current_user_ns()->may_mount_proc)
++ if (!current_user_ns()->may_mount_proc ||
++ !ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+ return ERR_PTR(-EPERM);
+ }
+
+diff --git a/include/linux/compat.h b/include/linux/compat.h
+index 7f0c1dd0..ec1aee4a 100644
+--- a/include/linux/compat.h
++++ b/include/linux/compat.h
+@@ -669,6 +669,13 @@ asmlinkage long compat_sys_sigaltstack(const compat_stack_t __user *uss_ptr,
+
+ int compat_restore_altstack(const compat_stack_t __user *uss);
+ int __compat_save_altstack(compat_stack_t __user *, unsigned long);
++#define compat_save_altstack_ex(uss, sp) do { \
++ compat_stack_t __user *__uss = uss; \
++ struct task_struct *t = current; \
++ put_user_ex(ptr_to_compat((void __user *)t->sas_ss_sp), &__uss->ss_sp); \
++ put_user_ex(sas_ss_flags(sp), &__uss->ss_flags); \
++ put_user_ex(t->sas_ss_size, &__uss->ss_size); \
++} while (0);
+
+ asmlinkage long compat_sys_sched_rr_get_interval(compat_pid_t pid,
+ struct compat_timespec __user *interval);
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 0c48991b..ff545cc3 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -393,10 +393,12 @@ struct hid_report {
+ struct hid_device *device; /* associated device */
+ };
+
++#define HID_MAX_IDS 256
++
+ struct hid_report_enum {
+ unsigned numbered;
+ struct list_head report_list;
+- struct hid_report *report_id_hash[256];
++ struct hid_report *report_id_hash[HID_MAX_IDS];
+ };
+
+ #define HID_REPORT_TYPES 3
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index 3bed2e89..d1fe5d00 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -518,6 +518,8 @@
+ #define PCI_DEVICE_ID_AMD_11H_NB_MISC 0x1303
+ #define PCI_DEVICE_ID_AMD_11H_NB_LINK 0x1304
+ #define PCI_DEVICE_ID_AMD_15H_M10H_F3 0x1403
++#define PCI_DEVICE_ID_AMD_15H_M30H_NB_F3 0x141d
++#define PCI_DEVICE_ID_AMD_15H_M30H_NB_F4 0x141e
+ #define PCI_DEVICE_ID_AMD_15H_NB_F0 0x1600
+ #define PCI_DEVICE_ID_AMD_15H_NB_F1 0x1601
+ #define PCI_DEVICE_ID_AMD_15H_NB_F2 0x1602
+diff --git a/include/linux/rculist.h b/include/linux/rculist.h
+index f4b1001a..4106721c 100644
+--- a/include/linux/rculist.h
++++ b/include/linux/rculist.h
+@@ -267,8 +267,9 @@ static inline void list_splice_init_rcu(struct list_head *list,
+ */
+ #define list_first_or_null_rcu(ptr, type, member) \
+ ({struct list_head *__ptr = (ptr); \
+- struct list_head __rcu *__next = list_next_rcu(__ptr); \
+- likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \
++ struct list_head *__next = ACCESS_ONCE(__ptr->next); \
++ likely(__ptr != __next) ? \
++ list_entry_rcu(__next, type, member) : NULL; \
+ })
+
+ /**
+diff --git a/include/linux/signal.h b/include/linux/signal.h
+index d8974847..2ac423bd 100644
+--- a/include/linux/signal.h
++++ b/include/linux/signal.h
+@@ -434,6 +434,14 @@ void signals_init(void);
+ int restore_altstack(const stack_t __user *);
+ int __save_altstack(stack_t __user *, unsigned long);
+
++#define save_altstack_ex(uss, sp) do { \
++ stack_t __user *__uss = uss; \
++ struct task_struct *t = current; \
++ put_user_ex((void __user *)t->sas_ss_sp, &__uss->ss_sp); \
++ put_user_ex(sas_ss_flags(sp), &__uss->ss_flags); \
++ put_user_ex(t->sas_ss_size, &__uss->ss_size); \
++} while (0);
++
+ #ifdef CONFIG_PROC_FS
+ struct seq_file;
+ extern void render_sigset_t(struct seq_file *, const char *, sigset_t *);
+diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
+index 1e88377e..3e541e63 100644
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -411,7 +411,7 @@ extern int usb_hcd_pci_probe(struct pci_dev *dev,
+ extern void usb_hcd_pci_remove(struct pci_dev *dev);
+ extern void usb_hcd_pci_shutdown(struct pci_dev *dev);
+
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_PM
+ extern const struct dev_pm_ops usb_hcd_pci_pm_ops;
+ #endif
+ #endif /* CONFIG_PCI */
+diff --git a/ipc/msg.c b/ipc/msg.c
+index 9f29d9e8..b65fdf1a 100644
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -680,16 +680,18 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
+ goto out_unlock1;
+ }
+
++ ipc_lock_object(&msq->q_perm);
++
+ for (;;) {
+ struct msg_sender s;
+
+ err = -EACCES;
+ if (ipcperms(ns, &msq->q_perm, S_IWUGO))
+- goto out_unlock1;
++ goto out_unlock0;
+
+ err = security_msg_queue_msgsnd(msq, msg, msgflg);
+ if (err)
+- goto out_unlock1;
++ goto out_unlock0;
+
+ if (msgsz + msq->q_cbytes <= msq->q_qbytes &&
+ 1 + msq->q_qnum <= msq->q_qbytes) {
+@@ -699,10 +701,9 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
+ /* queue full, wait: */
+ if (msgflg & IPC_NOWAIT) {
+ err = -EAGAIN;
+- goto out_unlock1;
++ goto out_unlock0;
+ }
+
+- ipc_lock_object(&msq->q_perm);
+ ss_add(msq, &s);
+
+ if (!ipc_rcu_getref(msq)) {
+@@ -730,10 +731,7 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
+ goto out_unlock0;
+ }
+
+- ipc_unlock_object(&msq->q_perm);
+ }
+-
+- ipc_lock_object(&msq->q_perm);
+ msq->q_lspid = task_tgid_vnr(current);
+ msq->q_stime = get_seconds();
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index f3569747..ad8e1bdc 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -1682,12 +1682,10 @@ static bool handle_trampoline(struct pt_regs *regs)
+ tmp = ri;
+ ri = ri->next;
+ kfree(tmp);
++ utask->depth--;
+
+ if (!chained)
+ break;
+-
+- utask->depth--;
+-
+ BUG_ON(!ri);
+ }
+
+diff --git a/kernel/fork.c b/kernel/fork.c
+index bf46287c..200a7a29 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1173,10 +1173,11 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ return ERR_PTR(-EINVAL);
+
+ /*
+- * If the new process will be in a different pid namespace
+- * don't allow the creation of threads.
++ * If the new process will be in a different pid namespace don't
++ * allow it to share a thread group or signal handlers with the
++ * forking task.
+ */
+- if ((clone_flags & (CLONE_VM|CLONE_NEWPID)) &&
++ if ((clone_flags & (CLONE_SIGHAND | CLONE_NEWPID)) &&
+ (task_active_pid_ns(current) !=
+ current->nsproxy->pid_ns_for_children))
+ return ERR_PTR(-EINVAL);
+diff --git a/kernel/pid.c b/kernel/pid.c
+index 66505c1d..ebe5e80b 100644
+--- a/kernel/pid.c
++++ b/kernel/pid.c
+@@ -265,6 +265,7 @@ void free_pid(struct pid *pid)
+ struct pid_namespace *ns = upid->ns;
+ hlist_del_rcu(&upid->pid_chain);
+ switch(--ns->nr_hashed) {
++ case 2:
+ case 1:
+ /* When all that is left in the pid namespace
+ * is the reaper wake up the reaper. The reaper
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index a92012a7..f2820fbf 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2296,6 +2296,8 @@ static void collapse_huge_page(struct mm_struct *mm,
+ goto out;
+
+ vma = find_vma(mm, address);
++ if (!vma)
++ goto out;
+ hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ hend = vma->vm_end & HPAGE_PMD_MASK;
+ if (address < hstart || address + HPAGE_PMD_SIZE > hend)
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 0878ff7c..aa44621e 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -5616,7 +5616,13 @@ static int compare_thresholds(const void *a, const void *b)
+ const struct mem_cgroup_threshold *_a = a;
+ const struct mem_cgroup_threshold *_b = b;
+
+- return _a->threshold - _b->threshold;
++ if (_a->threshold > _b->threshold)
++ return 1;
++
++ if (_a->threshold < _b->threshold)
++ return -1;
++
++ return 0;
+ }
+
+ static int mem_cgroup_oom_notify_cb(struct mem_cgroup *memcg)
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index dd47889a..dbc0a739 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -2129,6 +2129,8 @@ int ceph_osdc_start_request(struct ceph_osd_client *osdc,
+ dout("osdc_start_request failed map, "
+ " will retry %lld\n", req->r_tid);
+ rc = 0;
++ } else {
++ __unregister_request(osdc, req);
+ }
+ goto out_unlock;
+ }
+diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
+index 603ddd92..dbd9a479 100644
+--- a/net/ceph/osdmap.c
++++ b/net/ceph/osdmap.c
+@@ -1129,7 +1129,7 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
+
+ /* pg_temp? */
+ pgid.seed = ceph_stable_mod(pgid.seed, pool->pg_num,
+- pool->pgp_num_mask);
++ pool->pg_num_mask);
+ pg = __lookup_pg_mapping(&osdmap->pg_temp, pgid);
+ if (pg) {
+ *num = pg->len;
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index cc9e02d7..7a98d524 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2851,14 +2851,6 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
+ ieee80211_rx_bss_put(local, bss);
+ sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
+ }
+-
+- if (!sdata->u.mgd.associated ||
+- !ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid))
+- return;
+-
+- ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
+- elems, true);
+-
+ }
+
+
+@@ -3147,6 +3139,9 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
+
+ ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
+
++ ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
++ &elems, true);
++
+ if (ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
+ elems.wmm_param_len))
+ changed |= BSS_CHANGED_QOS;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 8860dd52..9552da23 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -3376,6 +3376,7 @@ static struct snd_pci_quirk msi_black_list[] = {
+ SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
+ SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
+ SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
++ SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */
+ SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */
+ SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */
+ {}
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 9f358627..45850f67 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -67,6 +67,8 @@ struct hdmi_spec_per_pin {
+ struct delayed_work work;
+ struct snd_kcontrol *eld_ctl;
+ int repoll_count;
++ bool setup; /* the stream has been set up by prepare callback */
++ int channels; /* current number of channels */
+ bool non_pcm;
+ bool chmap_set; /* channel-map override by ALSA API? */
+ unsigned char chmap[8]; /* ALSA API channel-map */
+@@ -551,6 +553,17 @@ static int hdmi_channel_allocation(struct hdmi_eld *eld, int channels)
+ }
+ }
+
++ if (!ca) {
++ /* if there was no match, select the regular ALSA channel
++ * allocation with the matching number of channels */
++ for (i = 0; i < ARRAY_SIZE(channel_allocations); i++) {
++ if (channels == channel_allocations[i].channels) {
++ ca = channel_allocations[i].ca_index;
++ break;
++ }
++ }
++ }
++
+ snd_print_channel_allocation(eld->info.spk_alloc, buf, sizeof(buf));
+ snd_printdd("HDMI: select CA 0x%x for %d-channel allocation: %s\n",
+ ca, channels, buf);
+@@ -868,18 +881,19 @@ static bool hdmi_infoframe_uptodate(struct hda_codec *codec, hda_nid_t pin_nid,
+ return true;
+ }
+
+-static void hdmi_setup_audio_infoframe(struct hda_codec *codec, int pin_idx,
+- bool non_pcm,
+- struct snd_pcm_substream *substream)
++static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
++ struct hdmi_spec_per_pin *per_pin,
++ bool non_pcm)
+ {
+- struct hdmi_spec *spec = codec->spec;
+- struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
+ hda_nid_t pin_nid = per_pin->pin_nid;
+- int channels = substream->runtime->channels;
++ int channels = per_pin->channels;
+ struct hdmi_eld *eld;
+ int ca;
+ union audio_infoframe ai;
+
++ if (!channels)
++ return;
++
+ eld = &per_pin->sink_eld;
+ if (!eld->monitor_present)
+ return;
+@@ -1329,6 +1343,7 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
+ eld_changed = true;
+ }
+ if (update_eld) {
++ bool old_eld_valid = pin_eld->eld_valid;
+ pin_eld->eld_valid = eld->eld_valid;
+ eld_changed = pin_eld->eld_size != eld->eld_size ||
+ memcmp(pin_eld->eld_buffer, eld->eld_buffer,
+@@ -1338,6 +1353,18 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
+ eld->eld_size);
+ pin_eld->eld_size = eld->eld_size;
+ pin_eld->info = eld->info;
++
++ /* Haswell-specific workaround: re-setup when the transcoder is
++ * changed during the stream playback
++ */
++ if (codec->vendor_id == 0x80862807 &&
++ eld->eld_valid && !old_eld_valid && per_pin->setup) {
++ snd_hda_codec_write(codec, pin_nid, 0,
++ AC_VERB_SET_AMP_GAIN_MUTE,
++ AMP_OUT_UNMUTE);
++ hdmi_setup_audio_infoframe(codec, per_pin,
++ per_pin->non_pcm);
++ }
+ }
+ mutex_unlock(&pin_eld->lock);
+
+@@ -1510,14 +1537,17 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
+ hda_nid_t cvt_nid = hinfo->nid;
+ struct hdmi_spec *spec = codec->spec;
+ int pin_idx = hinfo_to_pin_index(spec, hinfo);
+- hda_nid_t pin_nid = get_pin(spec, pin_idx)->pin_nid;
++ struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
++ hda_nid_t pin_nid = per_pin->pin_nid;
+ bool non_pcm;
+
+ non_pcm = check_non_pcm_per_cvt(codec, cvt_nid);
++ per_pin->channels = substream->runtime->channels;
++ per_pin->setup = true;
+
+ hdmi_set_channel_count(codec, cvt_nid, substream->runtime->channels);
+
+- hdmi_setup_audio_infoframe(codec, pin_idx, non_pcm, substream);
++ hdmi_setup_audio_infoframe(codec, per_pin, non_pcm);
+
+ return hdmi_setup_stream(codec, cvt_nid, pin_nid, stream_tag, format);
+ }
+@@ -1557,6 +1587,9 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo,
+ snd_hda_spdif_ctls_unassign(codec, pin_idx);
+ per_pin->chmap_set = false;
+ memset(per_pin->chmap, 0, sizeof(per_pin->chmap));
++
++ per_pin->setup = false;
++ per_pin->channels = 0;
+ }
+
+ return 0;
+@@ -1692,8 +1725,7 @@ static int hdmi_chmap_ctl_put(struct snd_kcontrol *kcontrol,
+ per_pin->chmap_set = true;
+ memcpy(per_pin->chmap, chmap, sizeof(chmap));
+ if (prepared)
+- hdmi_setup_audio_infoframe(codec, pin_idx, per_pin->non_pcm,
+- substream);
++ hdmi_setup_audio_infoframe(codec, per_pin, per_pin->non_pcm);
+
+ return 0;
+ }
+diff --git a/sound/soc/codecs/mc13783.c b/sound/soc/codecs/mc13783.c
+index 5402dfbb..8a8d9364 100644
+--- a/sound/soc/codecs/mc13783.c
++++ b/sound/soc/codecs/mc13783.c
+@@ -126,6 +126,10 @@ static int mc13783_write(struct snd_soc_codec *codec,
+
+ ret = mc13xxx_reg_write(priv->mc13xxx, reg, value);
+
++ /* include errata fix for spi audio problems */
++ if (reg == MC13783_AUDIO_CODEC || reg == MC13783_AUDIO_DAC)
++ ret = mc13xxx_reg_write(priv->mc13xxx, reg, value);
++
+ mc13xxx_unlock(priv->mc13xxx);
+
+ return ret;
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 0a4ffdd1..5e5af898 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -857,9 +857,9 @@ static int wm8960_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
+ if (pll_div.k) {
+ reg |= 0x20;
+
+- snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 18) & 0x3f);
+- snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 9) & 0x1ff);
+- snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0x1ff);
++ snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 16) & 0xff);
++ snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 8) & 0xff);
++ snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0xff);
+ }
+ snd_soc_write(codec, WM8960_PLL1, reg);
+
Modified: genpatches-2.6/trunk/3.4/0000_README
===================================================================
--- genpatches-2.6/trunk/3.4/0000_README 2013-09-25 17:13:05 UTC (rev 2528)
+++ genpatches-2.6/trunk/3.4/0000_README 2013-09-27 17:20:08 UTC (rev 2529)
@@ -287,6 +287,10 @@
From: http://www.kernel.org
Desc: Linux 3.4.62
+Patch: 1062_linux-3.4.63.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.63
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
Added: genpatches-2.6/trunk/3.4/1062_linux-3.4.63.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1062_linux-3.4.63.patch (rev 0)
+++ genpatches-2.6/trunk/3.4/1062_linux-3.4.63.patch 2013-09-27 17:20:08 UTC (rev 2529)
@@ -0,0 +1,1055 @@
+diff --git a/Makefile b/Makefile
+index 3f23cb7e..94ce9416 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 62
++SUBLEVEL = 63
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
+index d2268be8..709beb1d 100644
+--- a/arch/arm/mach-versatile/pci.c
++++ b/arch/arm/mach-versatile/pci.c
+@@ -42,9 +42,9 @@
+ #define PCI_IMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x0)
+ #define PCI_IMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x4)
+ #define PCI_IMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x8)
+-#define PCI_SMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x10)
+-#define PCI_SMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
+-#define PCI_SMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
++#define PCI_SMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
++#define PCI_SMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x1c)
+ #define PCI_SELFID __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0xc)
+
+ #define DEVICE_ID_OFFSET 0x00
+diff --git a/arch/mips/ath79/clock.c b/arch/mips/ath79/clock.c
+index 54d0eb4db..89276a2f 100644
+--- a/arch/mips/ath79/clock.c
++++ b/arch/mips/ath79/clock.c
+@@ -159,7 +159,7 @@ static void __init ar933x_clocks_init(void)
+ ath79_ahb_clk.rate = freq / t;
+ }
+
+- ath79_wdt_clk.rate = ath79_ref_clk.rate;
++ ath79_wdt_clk.rate = ath79_ahb_clk.rate;
+ ath79_uart_clk.rate = ath79_ref_clk.rate;
+ }
+
+diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
+index ee5b690a..52e5758e 100644
+--- a/arch/powerpc/kernel/align.c
++++ b/arch/powerpc/kernel/align.c
+@@ -764,6 +764,16 @@ int fix_alignment(struct pt_regs *regs)
+ nb = aligninfo[instr].len;
+ flags = aligninfo[instr].flags;
+
++ /* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */
++ if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) {
++ nb = 8;
++ flags = LD+SW;
++ } else if (IS_XFORM(instruction) &&
++ ((instruction >> 1) & 0x3ff) == 660) {
++ nb = 8;
++ flags = ST+SW;
++ }
++
+ /* Byteswap little endian loads and stores */
+ swiz = 0;
+ if (regs->msr & MSR_LE) {
+diff --git a/crypto/api.c b/crypto/api.c
+index 033a7147..4f98dd5b 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -40,6 +40,8 @@ static inline struct crypto_alg *crypto_alg_get(struct crypto_alg *alg)
+ return alg;
+ }
+
++static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg);
++
+ struct crypto_alg *crypto_mod_get(struct crypto_alg *alg)
+ {
+ return try_module_get(alg->cra_module) ? crypto_alg_get(alg) : NULL;
+@@ -150,8 +152,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,
+ }
+ up_write(&crypto_alg_sem);
+
+- if (alg != &larval->alg)
++ if (alg != &larval->alg) {
+ kfree(larval);
++ if (crypto_is_larval(alg))
++ alg = crypto_larval_wait(alg);
++ }
+
+ return alg;
+ }
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 8b77fd31..efe172f3 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -125,6 +125,9 @@ static struct edid_quirk {
+
+ /* ViewSonic VA2026w */
+ { "VSC", 5020, EDID_QUIRK_FORCE_REDUCED_BLANKING },
++
++ /* Medion MD 30217 PG */
++ { "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
+ };
+
+ /*** DDC fetch and block validation ***/
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index ff73d60c..ab59fdf0 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -63,6 +63,8 @@ struct hid_report *hid_register_report(struct hid_device *device, unsigned type,
+ struct hid_report_enum *report_enum = device->report_enum + type;
+ struct hid_report *report;
+
++ if (id >= HID_MAX_IDS)
++ return NULL;
+ if (report_enum->report_id_hash[id])
+ return report_enum->report_id_hash[id];
+
+@@ -385,8 +387,10 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
+
+ case HID_GLOBAL_ITEM_TAG_REPORT_ID:
+ parser->global.report_id = item_udata(item);
+- if (parser->global.report_id == 0) {
+- hid_err(parser->device, "report_id 0 is invalid\n");
++ if (parser->global.report_id == 0 ||
++ parser->global.report_id >= HID_MAX_IDS) {
++ hid_err(parser->device, "report_id %u is invalid\n",
++ parser->global.report_id);
+ return -1;
+ }
+ return 0;
+@@ -557,7 +561,7 @@ static void hid_device_release(struct device *dev)
+ for (i = 0; i < HID_REPORT_TYPES; i++) {
+ struct hid_report_enum *report_enum = device->report_enum + i;
+
+- for (j = 0; j < 256; j++) {
++ for (j = 0; j < HID_MAX_IDS; j++) {
+ struct hid_report *report = report_enum->report_id_hash[j];
+ if (report)
+ hid_free_report(report);
+@@ -995,7 +999,12 @@ EXPORT_SYMBOL_GPL(hid_output_report);
+
+ int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
+ {
+- unsigned size = field->report_size;
++ unsigned size;
++
++ if (!field)
++ return -1;
++
++ size = field->report_size;
+
+ hid_dump_input(field->report->device, field->usage + offset, value);
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 14d22399..8cc08e23 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -595,6 +595,7 @@
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16 0x0012
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17 0x0013
+ #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18 0x0014
++#define USB_DEVICE_ID_NTRIG_DUOSENSE 0x1500
+
+ #define USB_VENDOR_ID_ONTRAK 0x0a07
+ #define USB_DEVICE_ID_ONTRAK_ADU100 0x0064
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 21e473e7..f03c684e 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -314,7 +314,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ {
+ struct hid_device *dev = container_of(psy, struct hid_device, battery);
+ int ret = 0;
+- __u8 buf[2] = {};
++ __u8 *buf;
+
+ switch (prop) {
+ case POWER_SUPPLY_PROP_PRESENT:
+@@ -323,13 +323,20 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ break;
+
+ case POWER_SUPPLY_PROP_CAPACITY:
++
++ buf = kmalloc(2 * sizeof(__u8), GFP_KERNEL);
++ if (!buf) {
++ ret = -ENOMEM;
++ break;
++ }
+ ret = dev->hid_get_raw_report(dev, dev->battery_report_id,
+- buf, sizeof(buf),
++ buf, 2,
+ dev->battery_report_type);
+
+ if (ret != 2) {
+ if (ret >= 0)
+ ret = -EINVAL;
++ kfree(buf);
+ break;
+ }
+
+@@ -338,6 +345,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+ buf[1] <= dev->battery_max)
+ val->intval = (100 * (buf[1] - dev->battery_min)) /
+ (dev->battery_max - dev->battery_min);
++ kfree(buf);
+ break;
+
+ case POWER_SUPPLY_PROP_MODEL_NAME:
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index 9fae2ebd..48cba857 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev)
+ struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT].
+ report_id_hash[0x0d];
+
+- if (!report)
++ if (!report || report->maxfield < 1 ||
++ report->field[0]->report_count < 1)
+ return -EINVAL;
+
+ usbhid_submit_report(hdev, report, USB_DIR_IN);
+diff --git a/drivers/hid/hid-pl.c b/drivers/hid/hid-pl.c
+index 47ed74c4..00cd2f8b 100644
+--- a/drivers/hid/hid-pl.c
++++ b/drivers/hid/hid-pl.c
+@@ -129,8 +129,14 @@ static int plff_init(struct hid_device *hid)
+ strong = &report->field[0]->value[2];
+ weak = &report->field[0]->value[3];
+ debug("detected single-field device");
+- } else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 &&
+- report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) {
++ } else if (report->field[0]->maxusage == 1 &&
++ report->field[0]->usage[0].hid ==
++ (HID_UP_LED | 0x43) &&
++ report->maxfield >= 4 &&
++ report->field[0]->report_count >= 1 &&
++ report->field[1]->report_count >= 1 &&
++ report->field[2]->report_count >= 1 &&
++ report->field[3]->report_count >= 1) {
+ report->field[0]->value[0] = 0x00;
+ report->field[1]->value[0] = 0x00;
+ strong = &report->field[2]->value[0];
+diff --git a/drivers/hid/hid-speedlink.c b/drivers/hid/hid-speedlink.c
+index 60201374..2b03c9ba 100644
+--- a/drivers/hid/hid-speedlink.c
++++ b/drivers/hid/hid-speedlink.c
+@@ -3,7 +3,7 @@
+ * Fixes "jumpy" cursor and removes nonexistent keyboard LEDS from
+ * the HID descriptor.
+ *
+- * Copyright (c) 2011 Stefan Kriwanek <mail@stefankriwanek.de>
++ * Copyright (c) 2011, 2013 Stefan Kriwanek <dev@stefankriwanek.de>
+ */
+
+ /*
+@@ -48,8 +48,13 @@ static int speedlink_event(struct hid_device *hdev, struct hid_field *field,
+ struct hid_usage *usage, __s32 value)
+ {
+ /* No other conditions due to usage_table. */
+- /* Fix "jumpy" cursor (invalid events sent by device). */
+- if (value == 256)
++
++ /* This fixes the "jumpy" cursor occuring due to invalid events sent
++ * by the device. Some devices only send them with value==+256, others
++ * don't. However, catching abs(value)>=256 is restrictive enough not
++ * to interfere with devices that were bug-free (has been tested).
++ */
++ if (abs(value) >= 256)
+ return 1;
+ /* Drop useless distance 0 events (on button clicks etc.) as well */
+ if (value == 0)
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 5c4112e6..d712294b 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -103,6 +103,8 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
++ { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
++
+ { 0, 0 }
+ };
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 17119247..a60a54d8 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -886,56 +886,54 @@ static int dma_pte_clear_range(struct dmar_domain *domain,
+ return order;
+ }
+
++static void dma_pte_free_level(struct dmar_domain *domain, int level,
++ struct dma_pte *pte, unsigned long pfn,
++ unsigned long start_pfn, unsigned long last_pfn)
++{
++ pfn = max(start_pfn, pfn);
++ pte = &pte[pfn_level_offset(pfn, level)];
++
++ do {
++ unsigned long level_pfn;
++ struct dma_pte *level_pte;
++
++ if (!dma_pte_present(pte) || dma_pte_superpage(pte))
++ goto next;
++
++ level_pfn = pfn & level_mask(level - 1);
++ level_pte = phys_to_virt(dma_pte_addr(pte));
++
++ if (level > 2)
++ dma_pte_free_level(domain, level - 1, level_pte,
++ level_pfn, start_pfn, last_pfn);
++
++ /* If range covers entire pagetable, free it */
++ if (!(start_pfn > level_pfn ||
++ last_pfn < level_pfn + level_size(level))) {
++ dma_clear_pte(pte);
++ domain_flush_cache(domain, pte, sizeof(*pte));
++ free_pgtable_page(level_pte);
++ }
++next:
++ pfn += level_size(level);
++ } while (!first_pte_in_page(++pte) && pfn <= last_pfn);
++}
++
+ /* free page table pages. last level pte should already be cleared */
+ static void dma_pte_free_pagetable(struct dmar_domain *domain,
+ unsigned long start_pfn,
+ unsigned long last_pfn)
+ {
+ int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
+- struct dma_pte *first_pte, *pte;
+- int total = agaw_to_level(domain->agaw);
+- int level;
+- unsigned long tmp;
+- int large_page = 2;
+
+ BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
+ BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width);
+ BUG_ON(start_pfn > last_pfn);
+
+ /* We don't need lock here; nobody else touches the iova range */
+- level = 2;
+- while (level <= total) {
+- tmp = align_to_level(start_pfn, level);
+-
+- /* If we can't even clear one PTE at this level, we're done */
+- if (tmp + level_size(level) - 1 > last_pfn)
+- return;
+-
+- do {
+- large_page = level;
+- first_pte = pte = dma_pfn_level_pte(domain, tmp, level, &large_page);
+- if (large_page > level)
+- level = large_page + 1;
+- if (!pte) {
+- tmp = align_to_level(tmp + 1, level + 1);
+- continue;
+- }
+- do {
+- if (dma_pte_present(pte)) {
+- free_pgtable_page(phys_to_virt(dma_pte_addr(pte)));
+- dma_clear_pte(pte);
+- }
+- pte++;
+- tmp += level_size(level);
+- } while (!first_pte_in_page(pte) &&
+- tmp + level_size(level) - 1 <= last_pfn);
++ dma_pte_free_level(domain, agaw_to_level(domain->agaw),
++ domain->pgd, 0, start_pfn, last_pfn);
+
+- domain_flush_cache(domain, first_pte,
+- (void *)pte - (void *)first_pte);
+-
+- } while (tmp && tmp + level_size(level) - 1 <= last_pfn);
+- level++;
+- }
+ /* free pgd */
+ if (start_pfn == 0 && last_pfn == DOMAIN_MAX_PFN(domain->gaw)) {
+ free_pgtable_page(domain->pgd);
+diff --git a/drivers/mmc/host/tmio_mmc_dma.c b/drivers/mmc/host/tmio_mmc_dma.c
+index fff92860..491e9ecc 100644
+--- a/drivers/mmc/host/tmio_mmc_dma.c
++++ b/drivers/mmc/host/tmio_mmc_dma.c
+@@ -104,6 +104,7 @@ static void tmio_mmc_start_dma_rx(struct tmio_mmc_host *host)
+ pio:
+ if (!desc) {
+ /* DMA failed, fall back to PIO */
++ tmio_mmc_enable_dma(host, false);
+ if (ret >= 0)
+ ret = -EIO;
+ host->chan_rx = NULL;
+@@ -116,7 +117,6 @@ pio:
+ }
+ dev_warn(&host->pdev->dev,
+ "DMA failed: %d, falling back to PIO\n", ret);
+- tmio_mmc_enable_dma(host, false);
+ }
+
+ dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d, sg[%d]\n", __func__,
+@@ -185,6 +185,7 @@ static void tmio_mmc_start_dma_tx(struct tmio_mmc_host *host)
+ pio:
+ if (!desc) {
+ /* DMA failed, fall back to PIO */
++ tmio_mmc_enable_dma(host, false);
+ if (ret >= 0)
+ ret = -EIO;
+ host->chan_tx = NULL;
+@@ -197,7 +198,6 @@ pio:
+ }
+ dev_warn(&host->pdev->dev,
+ "DMA failed: %d, falling back to PIO\n", ret);
+- tmio_mmc_enable_dma(host, false);
+ }
+
+ dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d\n", __func__,
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+index f86ee0c7..503ff9f6 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -1030,6 +1030,10 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah,
+ * is_on == 0 means MRC CCK is OFF (more noise imm)
+ */
+ bool is_on = param ? 1 : 0;
++
++ if (ah->caps.rx_chainmask == 1)
++ break;
++
+ REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+ AR_PHY_MRC_CCK_ENABLE, is_on);
+ REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index 4bfb44a0..e2ab182d 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -78,10 +78,6 @@ struct ath_config {
+ sizeof(struct ath_buf_state)); \
+ } while (0)
+
+-#define ATH_RXBUF_RESET(_bf) do { \
+- (_bf)->bf_stale = false; \
+- } while (0)
+-
+ /**
+ * enum buffer_type - Buffer type flags
+ *
+@@ -314,6 +310,7 @@ struct ath_rx {
+ struct ath_buf *rx_bufptr;
+ struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
+
++ struct ath_buf *buf_hold;
+ struct sk_buff *frag;
+ };
+
+diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
+index 039bac7e..2e6583d3 100644
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -78,8 +78,6 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+ struct ath_desc *ds;
+ struct sk_buff *skb;
+
+- ATH_RXBUF_RESET(bf);
+-
+ ds = bf->bf_desc;
+ ds->ds_link = 0; /* link to null */
+ ds->ds_data = bf->bf_buf_addr;
+@@ -106,6 +104,14 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+ sc->rx.rxlink = &ds->ds_link;
+ }
+
++static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
++{
++ if (sc->rx.buf_hold)
++ ath_rx_buf_link(sc, sc->rx.buf_hold);
++
++ sc->rx.buf_hold = bf;
++}
++
+ static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
+ {
+ /* XXX block beacon interrupts */
+@@ -153,7 +159,6 @@ static bool ath_rx_edma_buf_link(struct ath_softc *sc,
+
+ skb = bf->bf_mpdu;
+
+- ATH_RXBUF_RESET(bf);
+ memset(skb->data, 0, ah->caps.rx_status_len);
+ dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+ ah->caps.rx_status_len, DMA_TO_DEVICE);
+@@ -485,6 +490,7 @@ int ath_startrecv(struct ath_softc *sc)
+ if (list_empty(&sc->rx.rxbuf))
+ goto start_recv;
+
++ sc->rx.buf_hold = NULL;
+ sc->rx.rxlink = NULL;
+ list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
+ ath_rx_buf_link(sc, bf);
+@@ -734,6 +740,9 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
+ }
+
+ bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
++ if (bf == sc->rx.buf_hold)
++ return NULL;
++
+ ds = bf->bf_desc;
+
+ /*
+@@ -1974,7 +1983,7 @@ requeue:
+ if (edma) {
+ ath_rx_edma_buf_link(sc, qtype);
+ } else {
+- ath_rx_buf_link(sc, bf);
++ ath_rx_buf_relink(sc, bf);
+ ath9k_hw_rxena(ah);
+ }
+ } while (1);
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 12a42f2c..3d0aa472 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2479,6 +2479,7 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
+ for (acno = 0, ac = &an->ac[acno];
+ acno < WME_NUM_AC; acno++, ac++) {
+ ac->sched = false;
++ ac->clear_ps_filter = true;
+ ac->txq = sc->tx.txq_map[acno];
+ INIT_LIST_HEAD(&ac->tid_q);
+ }
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+index 11054ae9..9a184058 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+@@ -1013,9 +1013,10 @@ static bool dma64_rxidle(struct dma_info *di)
+
+ /*
+ * post receive buffers
+- * return false is refill failed completely and ring is empty this will stall
+- * the rx dma and user might want to call rxfill again asap. This unlikely
+- * happens on memory-rich NIC, but often on memory-constrained dongle
++ * Return false if refill failed completely or dma mapping failed. The ring
++ * is empty, which will stall the rx dma and user might want to call rxfill
++ * again asap. This is unlikely to happen on a memory-rich NIC, but often on
++ * memory-constrained dongle.
+ */
+ bool dma_rxfill(struct dma_pub *pub)
+ {
+@@ -1074,6 +1075,8 @@ bool dma_rxfill(struct dma_pub *pub)
+
+ pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
+ DMA_FROM_DEVICE);
++ if (dma_mapping_error(di->dmadev, pa))
++ return false;
+
+ /* save the free packet pointer */
+ di->rxp[rxout] = p;
+@@ -1294,7 +1297,11 @@ int dma_txfast(struct dma_pub *pub, struct sk_buff *p, bool commit)
+
+ /* get physical address of buffer start */
+ pa = dma_map_single(di->dmadev, data, len, DMA_TO_DEVICE);
+-
++ /* if mapping failed, free skb */
++ if (dma_mapping_error(di->dmadev, pa)) {
++ brcmu_pkt_buf_free_skb(p);
++ return;
++ }
+ /* With a DMA segment list, Descriptor table is filled
+ * using the segment list instead of looping over
+ * buffers in multi-chain DMA. Therefore, EOF for SGLIST
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 58064498..1c207f23 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1227,6 +1227,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
+ ap = dt_alloc(sizeof(*ap) + len + 1, 4);
+ if (!ap)
+ continue;
++ memset(ap, 0, sizeof(*ap) + len + 1);
+ ap->alias = start;
+ of_alias_add(ap, np, id, start, len);
+ }
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 105fff2e..05973a49 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2225,14 +2225,9 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
+ }
+ }
+
+- if (modepage == 0x3F) {
+- sd_printk(KERN_ERR, sdkp, "No Caching mode page "
+- "present\n");
+- goto defaults;
+- } else if ((buffer[offset] & 0x3f) != modepage) {
+- sd_printk(KERN_ERR, sdkp, "Got wrong page\n");
+- goto defaults;
+- }
++ sd_printk(KERN_ERR, sdkp, "No Caching mode page found\n");
++ goto defaults;
++
+ Page_found:
+ if (modepage == 8) {
+ sdkp->WCE = ((buffer[offset + 2] & 0x04) != 0);
+diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c
+index 95ebc267..e3adb382 100644
+--- a/drivers/staging/comedi/drivers/dt282x.c
++++ b/drivers/staging/comedi/drivers/dt282x.c
+@@ -407,8 +407,9 @@ struct dt282x_private {
+ } \
+ udelay(5); \
+ } \
+- if (_i) \
++ if (_i) { \
+ b \
++ } \
+ } while (0)
+
+ static int dt282x_attach(struct comedi_device *dev,
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 9dd51f7f..1434ee9e 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -233,6 +233,7 @@ skip_error:
+ static void wdm_int_callback(struct urb *urb)
+ {
+ int rv = 0;
++ int responding;
+ int status = urb->status;
+ struct wdm_device *desc;
+ struct usb_cdc_notification *dr;
+@@ -286,8 +287,8 @@ static void wdm_int_callback(struct urb *urb)
+
+ spin_lock(&desc->iuspin);
+ clear_bit(WDM_READ, &desc->flags);
+- set_bit(WDM_RESPONDING, &desc->flags);
+- if (!test_bit(WDM_DISCONNECTING, &desc->flags)
++ responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
++ if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags)
+ && !test_bit(WDM_SUSPENDING, &desc->flags)) {
+ rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+ dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
+@@ -687,16 +688,20 @@ static void wdm_rxwork(struct work_struct *work)
+ {
+ struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);
+ unsigned long flags;
+- int rv;
++ int rv = 0;
++ int responding;
+
+ spin_lock_irqsave(&desc->iuspin, flags);
+ if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+ } else {
++ responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+- rv = usb_submit_urb(desc->response, GFP_KERNEL);
++ if (!responding)
++ rv = usb_submit_urb(desc->response, GFP_KERNEL);
+ if (rv < 0 && rv != -EPERM) {
+ spin_lock_irqsave(&desc->iuspin, flags);
++ clear_bit(WDM_RESPONDING, &desc->flags);
+ if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+ schedule_work(&desc->rxwork);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index f4bdd0ce..78609d30 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -424,7 +424,8 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
+
+ memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+ if (config->desc.bDescriptorType != USB_DT_CONFIG ||
+- config->desc.bLength < USB_DT_CONFIG_SIZE) {
++ config->desc.bLength < USB_DT_CONFIG_SIZE ||
++ config->desc.bLength > size) {
+ dev_err(ddev, "invalid descriptor for config index %d: "
+ "type = 0x%X, length = %d\n", cfgidx,
+ config->desc.bDescriptorType, config->desc.bLength);
+diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
+index a797d51e..77477ca5 100644
+--- a/drivers/usb/host/ehci-mxc.c
++++ b/drivers/usb/host/ehci-mxc.c
+@@ -298,7 +298,7 @@ static int __exit ehci_mxc_drv_remove(struct platform_device *pdev)
+ if (pdata && pdata->exit)
+ pdata->exit(pdev);
+
+- if (pdata->otg)
++ if (pdata && pdata->otg)
+ usb_phy_shutdown(pdata->otg);
+
+ usb_remove_hcd(hcd);
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 93ad67ec..6e70ce97 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -24,7 +24,7 @@ static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci)
+ * here that the generic code does not try to make a pci_dev from our
+ * dev struct in order to setup MSI
+ */
+- xhci->quirks |= XHCI_BROKEN_MSI;
++ xhci->quirks |= XHCI_PLAT;
+ }
+
+ /* called during probe() after chip reset completes */
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 8072a932..1504946c 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -342,9 +342,14 @@ static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
+ static int xhci_try_enable_msi(struct usb_hcd *hcd)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+- struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
++ struct pci_dev *pdev;
+ int ret;
+
++ /* The xhci platform device has set up IRQs through usb_add_hcd. */
++ if (xhci->quirks & XHCI_PLAT)
++ return 0;
++
++ pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+ /*
+ * Some Fresco Logic host controllers advertise MSI, but fail to
+ * generate interrupts. Don't even try to enable MSI.
+@@ -3496,10 +3501,21 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct xhci_virt_device *virt_dev;
++ struct device *dev = hcd->self.controller;
+ unsigned long flags;
+ u32 state;
+ int i, ret;
+
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++ /*
++ * We called pm_runtime_get_noresume when the device was attached.
++ * Decrement the counter here to allow controller to runtime suspend
++ * if no devices remain.
++ */
++ if (xhci->quirks & XHCI_RESET_ON_RESUME)
++ pm_runtime_put_noidle(dev);
++#endif
++
+ ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
+ /* If the host is halted due to driver unload, we still need to free the
+ * device.
+@@ -3571,6 +3587,7 @@ static int xhci_reserve_host_control_ep_resources(struct xhci_hcd *xhci)
+ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++ struct device *dev = hcd->self.controller;
+ unsigned long flags;
+ int timeleft;
+ int ret;
+@@ -3623,6 +3640,16 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ goto disable_slot;
+ }
+ udev->slot_id = xhci->slot_id;
++
++#ifndef CONFIG_USB_DEFAULT_PERSIST
++ /*
++ * If resetting upon resume, we can't put the controller into runtime
++ * suspend if there is a device attached.
++ */
++ if (xhci->quirks & XHCI_RESET_ON_RESUME)
++ pm_runtime_get_noresume(dev);
++#endif
++
+ /* Is this a LS or FS device under a HS hub? */
+ /* Hub or peripherial? */
+ return 1;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 15aaf58c..a54a408c 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1508,6 +1508,7 @@ struct xhci_hcd {
+ #define XHCI_SPURIOUS_REBOOT (1 << 13)
+ #define XHCI_COMP_MODE_QUIRK (1 << 14)
+ #define XHCI_AVOID_BEI (1 << 15)
++#define XHCI_PLAT (1 << 16)
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+ /* There are two roothubs to keep track of bus suspend info for */
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index cdde45de..4491830b 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -383,7 +383,7 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ kfree(urbtrack);
+ return -ENOMEM;
+ }
+- urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
++ urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_ATOMIC);
+ if (!urbtrack->setup) {
+ usb_free_urb(urbtrack->urb);
+ kfree(urbtrack);
+@@ -391,8 +391,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ }
+ urbtrack->setup->bRequestType = (__u8)0x40;
+ urbtrack->setup->bRequest = (__u8)0x0e;
+- urbtrack->setup->wValue = get_reg_value(reg, dummy);
+- urbtrack->setup->wIndex = get_reg_index(reg);
++ urbtrack->setup->wValue = cpu_to_le16(get_reg_value(reg, dummy));
++ urbtrack->setup->wIndex = cpu_to_le16(get_reg_index(reg));
+ urbtrack->setup->wLength = 0;
+ usb_fill_control_urb(urbtrack->urb, usbdev,
+ usb_sndctrlpipe(usbdev, 0),
+diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
+index 7e34beed..3275bde6 100644
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -641,9 +641,18 @@ void gnttab_request_free_callback(struct gnttab_free_callback *callback,
+ void (*fn)(void *), void *arg, u16 count)
+ {
+ unsigned long flags;
++ struct gnttab_free_callback *cb;
++
+ spin_lock_irqsave(&gnttab_list_lock, flags);
+- if (callback->next)
+- goto out;
++
++ /* Check if the callback is already on the list */
++ cb = gnttab_free_callback_list;
++ while (cb) {
++ if (cb == callback)
++ goto out;
++ cb = cb->next;
++ }
++
+ callback->fn = fn;
+ callback->arg = arg;
+ callback->count = count;
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index e7fe81d3..4ac06b08 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -362,6 +362,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ try_to_freeze();
+
+ /* we should try only the port we connected to before */
++ mutex_lock(&server->srv_mutex);
+ rc = generic_ip_connect(server);
+ if (rc) {
+ cFYI(1, "reconnect error %d", rc);
+@@ -373,6 +374,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ server->tcpStatus = CifsNeedNegotiate;
+ spin_unlock(&GlobalMid_Lock);
+ }
++ mutex_unlock(&server->srv_mutex);
+ } while (server->tcpStatus == CifsNeedReconnect);
+
+ return rc;
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index d48478a8..373b2514 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1503,6 +1503,8 @@ static int fuse_setxattr(struct dentry *entry, const char *name,
+ fc->no_setxattr = 1;
+ err = -EOPNOTSUPP;
+ }
++ if (!err)
++ fuse_invalidate_attr(inode);
+ return err;
+ }
+
+@@ -1632,6 +1634,8 @@ static int fuse_removexattr(struct dentry *entry, const char *name)
+ fc->no_removexattr = 1;
+ err = -EOPNOTSUPP;
+ }
++ if (!err)
++ fuse_invalidate_attr(inode);
+ return err;
+ }
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 8e6381a1..df25454e 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1294,7 +1294,6 @@ static int fuse_writepage_locked(struct page *page)
+
+ inc_bdi_stat(mapping->backing_dev_info, BDI_WRITEBACK);
+ inc_zone_page_state(tmp_page, NR_WRITEBACK_TEMP);
+- end_page_writeback(page);
+
+ spin_lock(&fc->lock);
+ list_add(&req->writepages_entry, &fi->writepages);
+@@ -1302,6 +1301,8 @@ static int fuse_writepage_locked(struct page *page)
+ fuse_flush_writepages(inode);
+ spin_unlock(&fc->lock);
+
++ end_page_writeback(page);
++
+ return 0;
+
+ err_free:
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index 29037c36..e92a342f 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -119,8 +119,8 @@ static void destroy_inodecache(void)
+
+ static int isofs_remount(struct super_block *sb, int *flags, char *data)
+ {
+- /* we probably want a lot more here */
+- *flags |= MS_RDONLY;
++ if (!(*flags & MS_RDONLY))
++ return -EROFS;
+ return 0;
+ }
+
+@@ -769,15 +769,6 @@ root_found:
+ */
+ s->s_maxbytes = 0x80000000000LL;
+
+- /*
+- * The CDROM is read-only, has no nodes (devices) on it, and since
+- * all of the files appear to be owned by root, we really do not want
+- * to allow suid. (suid or devices will not show up unless we have
+- * Rock Ridge extensions)
+- */
+-
+- s->s_flags |= MS_RDONLY /* | MS_NODEV | MS_NOSUID */;
+-
+ /* Set this for reference. Its not currently used except on write
+ which we don't have .. */
+
+@@ -1536,6 +1527,9 @@ struct inode *isofs_iget(struct super_block *sb,
+ static struct dentry *isofs_mount(struct file_system_type *fs_type,
+ int flags, const char *dev_name, void *data)
+ {
++ /* We don't support read-write mounts */
++ if (!(flags & MS_RDONLY))
++ return ERR_PTR(-EACCES);
+ return mount_bdev(fs_type, flags, dev_name, data, isofs_fill_super);
+ }
+
+diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
+index 7eb1c0c7..cf228479 100644
+--- a/fs/ocfs2/extent_map.c
++++ b/fs/ocfs2/extent_map.c
+@@ -782,7 +782,6 @@ int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ cpos = map_start >> osb->s_clustersize_bits;
+ mapping_end = ocfs2_clusters_for_bytes(inode->i_sb,
+ map_start + map_len);
+- mapping_end -= cpos;
+ is_last = 0;
+ while (cpos < mapping_end && !is_last) {
+ u32 fe_flags;
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 3a95da60..8c933a86 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -420,10 +420,12 @@ struct hid_report {
+ struct hid_device *device; /* associated device */
+ };
+
++#define HID_MAX_IDS 256
++
+ struct hid_report_enum {
+ unsigned numbered;
+ struct list_head report_list;
+- struct hid_report *report_id_hash[256];
++ struct hid_report *report_id_hash[HID_MAX_IDS];
+ };
+
+ #define HID_REPORT_TYPES 3
+diff --git a/include/linux/rculist.h b/include/linux/rculist.h
+index 6f95e241..38633526 100644
+--- a/include/linux/rculist.h
++++ b/include/linux/rculist.h
+@@ -254,8 +254,9 @@ static inline void list_splice_init_rcu(struct list_head *list,
+ */
+ #define list_first_or_null_rcu(ptr, type, member) \
+ ({struct list_head *__ptr = (ptr); \
+- struct list_head __rcu *__next = list_next_rcu(__ptr); \
+- likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \
++ struct list_head *__next = ACCESS_ONCE(__ptr->next); \
++ likely(__ptr != __next) ? \
++ list_entry_rcu(__next, type, member) : NULL; \
+ })
+
+ /**
+diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
+index 11e67562..ab45ea5b 100644
+--- a/include/media/v4l2-ctrls.h
++++ b/include/media/v4l2-ctrls.h
+@@ -22,6 +22,7 @@
+ #define _V4L2_CTRLS_H
+
+ #include <linux/list.h>
++#include <linux/mutex.h>
+ #include <linux/videodev2.h>
+
+ /* forward references */
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index ef99c15f..3da5c0bf 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1894,6 +1894,8 @@ static void collapse_huge_page(struct mm_struct *mm,
+ goto out;
+
+ vma = find_vma(mm, address);
++ if (!vma)
++ goto out;
+ hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ hend = vma->vm_end & HPAGE_PMD_MASK;
+ if (address < hstart || address + HPAGE_PMD_SIZE > hend)
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 81c275b3..9c364428 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -4349,7 +4349,13 @@ static int compare_thresholds(const void *a, const void *b)
+ const struct mem_cgroup_threshold *_a = a;
+ const struct mem_cgroup_threshold *_b = b;
+
+- return _a->threshold - _b->threshold;
++ if (_a->threshold > _b->threshold)
++ return 1;
++
++ if (_a->threshold < _b->threshold)
++ return -1;
++
++ return 0;
+ }
+
+ static int mem_cgroup_oom_notify_cb(struct mem_cgroup *memcg)
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 1f350522..e6083c14 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2602,6 +2602,7 @@ static struct snd_pci_quirk msi_black_list[] __devinitdata = {
+ SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
+ SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
+ SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
++ SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */
+ SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */
+ SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */
+ {}
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 840d7208..ddb0d904 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -790,9 +790,9 @@ static int wm8960_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
+ if (pll_div.k) {
+ reg |= 0x20;
+
+- snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 18) & 0x3f);
+- snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 9) & 0x1ff);
+- snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0x1ff);
++ snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 16) & 0xff);
++ snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 8) & 0xff);
++ snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0xff);
+ }
+ snd_soc_write(codec, WM8960_PLL1, reg);
+
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2013-09-27 17:20 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-09-27 17:20 [gentoo-commits] linux-patches r2529 - in genpatches-2.6/trunk: 3.0 3.10 3.11 3.4 Tom Wijsman (tomwij)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox